[Mon Nov 10 21:07:14.701861 2025] [:error] [pid 31031:tid 31124] [client 43.165.69.68:49278] [client 43.165.69.68] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aRHjgnI8L5KZTd8nCaaBIgAAAJU"]
[Mon Nov 10 21:30:13.105137 2025] [:error] [pid 31029:tid 31050] [client 108.167.189.100:25588] [client 108.167.189.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.167.189.100, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRHo5QaWYU_3FzBvTGj6ugAAAAE"]
[Mon Nov 10 21:43:55.870838 2025] [:error] [pid 31136:tid 31152] [client 142.93.129.190:59864] [client 142.93.129.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aRHsG_tvd8w_jsstCainHQAAAMs"]
[Mon Nov 10 21:44:06.663382 2025] [authz_core:error] [pid 31029:tid 31058] [client 142.93.129.190:41612] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Mon Nov 10 21:44:12.055126 2025] [:error] [pid 31136:tid 31162] [client 142.93.129.190:57248] [client 142.93.129.190] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aRHsLPtvd8w_jsstCainOwAAANU"]
[Mon Nov 10 21:44:12.989630 2025] [:error] [pid 31030:tid 31078] [client 142.93.129.190:57252] [client 142.93.129.190] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aRHsLDdQpWeECLLAfnZjDAAAAEI"]
[Mon Nov 10 21:54:35.576819 2025] [:error] [pid 31030:tid 31089] [client 161.248.188.190:56304] [client 161.248.188.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.248.188.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRHumzdQpWeECLLAfnZlmQAAAE0"]
[Mon Nov 10 21:54:36.840526 2025] [:error] [pid 31030:tid 31092] [client 161.248.188.190:56304] [client 161.248.188.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.248.188.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRHunDdQpWeECLLAfnZlnAAAAFA"], referer: https://expressinteriors.com/wp-login.php
[Mon Nov 10 22:10:29.113984 2025] [:error] [pid 31031:tid 31120] [client 89.248.161.162:45804] [client 89.248.161.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.248.161.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRHyVXI8L5KZTd8nCaaVJgAAAJE"]
[Mon Nov 10 22:52:06.966630 2025] [:error] [pid 34820:tid 34840] [client 142.93.120.13:25796] [client 142.93.120.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.93.120.13, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRH8FmK3qvhYIA1ghWD6cgAAARI"]
[Mon Nov 10 23:30:22.021520 2025] [:error] [pid 31030:tid 31100] [client 80.179.139.13:47674] [client 80.179.139.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.179.139.13, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRIFDjdQpWeECLLAfnaDBQAAAFg"]
[Tue Nov 11 00:48:03.997682 2025] [:error] [pid 14120:tid 14122] [client 91.92.242.56:60519] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/wp-content/debug.log"] [unique_id "aRIXQyT8OKKuPaCGMt0XewAAAUA"]
[Tue Nov 11 00:56:41.245074 2025] [:error] [pid 24554:tid 24579] [client 91.92.242.56:59866] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/usc-e-shop/functions/content-log.php"] [unique_id "aRIZSRbgcg5JFvN-BGVmDgAAAtU"]
[Tue Nov 11 00:59:30.763072 2025] [:error] [pid 41825:tid 41898] [client 91.92.242.56:62728] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/post-pdf-export/dompdf/dompdf.php"] [unique_id "aRIZ8or5hkwmQG_pQgAEugAAAEs"]
[Tue Nov 11 00:59:31.847041 2025] [:error] [pid 17139:tid 17147] [client 91.92.242.56:64722] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/web-portal-lite-client-portal-secure-file-sharing-private-messaging/includes/libs/pdf/dompdf.php"] [unique_id "aRIZ8wBMXuz26L49J3ghFQAAAYY"]
[Tue Nov 11 00:59:32.910258 2025] [:error] [pid 17139:tid 17158] [client 91.92.242.56:49256] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-ecommerce-shop-styling/includes/download.php"] [unique_id "aRIZ9ABMXuz26L49J3ghFgAAAZE"]
[Tue Nov 11 00:59:33.977143 2025] [:error] [pid 41839:tid 41927] [client 91.92.242.56:50303] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRIZ9TGxg5uCD9Nfh5W5bQAAAI0"]
[Tue Nov 11 00:59:35.041098 2025] [:error] [pid 41839:tid 41926] [client 91.92.242.56:51316] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/cherry-plugin/admin/import-export/download-content.php"] [unique_id "aRIZ9zGxg5uCD9Nfh5W5bgAAAIw"]
[Tue Nov 11 00:59:36.126524 2025] [:error] [pid 24817:tid 24835] [client 91.92.242.56:52467] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRIZ-OBo1Juuc7yq76DFWwAAAxA"]
[Tue Nov 11 00:59:37.192413 2025] [:error] [pid 24817:tid 24836] [client 91.92.242.56:53713] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRIZ-eBo1Juuc7yq76DFXQAAAxE"]
[Tue Nov 11 00:59:38.280055 2025] [:error] [pid 14120:tid 14151] [client 91.92.242.56:54887] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/mapsvg/gm_download.php"] [unique_id "aRIZ-iT8OKKuPaCGMt0Z4QAAAVg"]
[Tue Nov 11 00:59:39.344053 2025] [:error] [pid 14120:tid 14124] [client 91.92.242.56:56246] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/mapsvg-lite-interactive-vector-maps/gm_download.php"] [unique_id "aRIZ-yT8OKKuPaCGMt0Z4wAAAUI"]
[Tue Nov 11 01:04:53.991615 2025] [:error] [pid 17139:tid 17142] [client 101.53.147.194:41158] [client 101.53.147.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 101.53.147.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRIbNQBMXuz26L49J3gh5gAAAYE"]
[Tue Nov 11 01:05:26.904685 2025] [:error] [pid 41839:tid 41933] [client 101.53.147.194:38734] [client 101.53.147.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 101.53.147.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRIbVjGxg5uCD9Nfh5W7QAAAAJM"]
[Tue Nov 11 01:37:49.045129 2025] [:error] [pid 14120:tid 14127] [client 43.155.188.157:54142] [client 43.155.188.157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRIi7ST8OKKuPaCGMt0lqwAAAUU"]
[Tue Nov 11 02:26:17.961718 2025] [autoindex:error] [pid 41816:tid 41867] [client 143.110.247.169:52552] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Nov 11 04:00:44.184898 2025] [:error] [pid 43435:tid 43449] [client 108.167.158.154:46516] [client 108.167.158.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 108.167.158.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRJEbGeCenDmgzLwDULEkAAAAAk"]
[Tue Nov 11 04:01:05.363166 2025] [:error] [pid 43437:tid 43494] [client 48.210.24.245:29012] [client 48.210.24.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 48.210.24.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRJEgQLPT6kbVOb_pwt8TQAAAIA"]
[Tue Nov 11 04:01:06.042998 2025] [:error] [pid 43437:tid 43510] [client 48.210.24.245:29012] [client 48.210.24.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 48.210.24.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRJEggLPT6kbVOb_pwt8TwAAAI8"]
[Tue Nov 11 04:01:07.259397 2025] [:error] [pid 43436:tid 43491] [client 48.210.24.245:63398] [client 48.210.24.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 48.210.24.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRJEg9uzjoymDUxEiDgImwAAAFg"]
[Tue Nov 11 04:01:07.941267 2025] [:error] [pid 43437:tid 43505] [client 48.210.24.245:29012] [client 48.210.24.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 48.210.24.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRJEgwLPT6kbVOb_pwt8UQAAAIo"]
[Tue Nov 11 04:01:45.057501 2025] [autoindex:error] [pid 43436:tid 43480] [client 48.210.24.245:63398] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 04:01:46.112419 2025] [autoindex:error] [pid 43436:tid 43491] [client 48.210.24.245:63398] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 04:01:46.388670 2025] [autoindex:error] [pid 43436:tid 43487] [client 48.210.24.245:63398] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 04:01:46.843453 2025] [autoindex:error] [pid 43436:tid 43470] [client 48.210.24.245:63398] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 04:01:47.457194 2025] [autoindex:error] [pid 43436:tid 43482] [client 48.210.24.245:63398] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 04:01:47.615139 2025] [autoindex:error] [pid 43436:tid 43486] [client 48.210.24.245:63398] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 04:01:47.778846 2025] [autoindex:error] [pid 43436:tid 43469] [client 48.210.24.245:63398] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 04:01:48.034345 2025] [autoindex:error] [pid 43436:tid 43473] [client 48.210.24.245:63398] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 11 04:58:56.999054 2025] [:error] [pid 43435:tid 43460] [client 162.19.58.174:44426] [client 162.19.58.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.19.58.174, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRJSEGeCenDmgzLwDULXRAAAABQ"]
[Tue Nov 11 04:58:57.901544 2025] [:error] [pid 43435:tid 43458] [client 162.19.58.174:44426] [client 162.19.58.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.19.58.174, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRJSEWeCenDmgzLwDULXSgAAABI"], referer: https://expressinteriors.com/wp-login.php
[Tue Nov 11 05:20:00.521936 2025] [:error] [pid 33932:tid 33983] [client 192.64.117.87:43028] [client 192.64.117.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.64.117.87, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRJXAJdn2hP2rg5PoHIxlgAAAVA"]
[Tue Nov 11 05:47:53.590714 2025] [autoindex:error] [pid 33931:tid 33958] [client 196.251.85.129:60613] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Nov 11 07:06:08.586386 2025] [:error] [pid 34002:tid 34023] [client 192.250.234.56:55262] [client 192.250.234.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.250.234.56, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRJv4NNx46Ag0u620orSggAAABE"]
[Tue Nov 11 07:06:09.525685 2025] [:error] [pid 34002:tid 34015] [client 192.250.234.56:55262] [client 192.250.234.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.250.234.56, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRJv4dNx46Ag0u620orShQAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Tue Nov 11 07:46:15.403248 2025] [:error] [pid 33932:tid 33991] [client 45.88.183.158:51576] [client 45.88.183.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.88.183.158, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRJ5R5dn2hP2rg5PoHJyKwAAAVg"]
[Tue Nov 11 07:46:21.843373 2025] [:error] [pid 33932:tid 33980] [client 57.129.59.193:49972] [client 57.129.59.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 57.129.59.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRJ5TZdn2hP2rg5PoHJyOQAAAU0"]
[Tue Nov 11 08:04:48.825328 2025] [:error] [pid 19756:tid 19779] [client 91.92.242.56:65054] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/wp-content/debug.log"] [unique_id "aRJ9oOkAxCY2xqQFnfr3QgAAAlU"]
[Tue Nov 11 08:14:01.655898 2025] [:error] [pid 33932:tid 33976] [client 91.92.242.56:65390] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/usc-e-shop/functions/content-log.php"] [unique_id "aRJ_yZdn2hP2rg5PoHKB1wAAAUk"]
[Tue Nov 11 08:17:21.607957 2025] [:error] [pid 20101:tid 20119] [client 91.92.242.56:62217] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/post-pdf-export/dompdf/dompdf.php"] [unique_id "aRKAkfSZnd_J7V4i60I5YQAAAtA"]
[Tue Nov 11 08:17:22.702081 2025] [:error] [pid 33888:tid 33905] [client 91.92.242.56:50888] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/web-portal-lite-client-portal-secure-file-sharing-private-messaging/includes/libs/pdf/dompdf.php"] [unique_id "aRKAkohA0uVBNwBRvPokKAAAAI4"]
[Tue Nov 11 08:17:23.779938 2025] [:error] [pid 20101:tid 20108] [client 91.92.242.56:51584] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-ecommerce-shop-styling/includes/download.php"] [unique_id "aRKAk_SZnd_J7V4i60I5YwAAAsU"]
[Tue Nov 11 08:17:24.854142 2025] [:error] [pid 18828:tid 18833] [client 91.92.242.56:52262] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRKAlBPP-hmbFD1dOrqWWAAAAMI"]
[Tue Nov 11 08:17:25.929343 2025] [:error] [pid 33931:tid 33963] [client 91.92.242.56:52878] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/cherry-plugin/admin/import-export/download-content.php"] [unique_id "aRKAlUnJb679KZEjo-MWhwAAARc"]
[Tue Nov 11 08:17:27.005202 2025] [:error] [pid 19559:tid 19565] [client 91.92.242.56:53505] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRKAl02A7XQJ15MEH8Ch1AAAAgI"]
[Tue Nov 11 08:17:28.081136 2025] [:error] [pid 19436:tid 19460] [client 91.92.242.56:54094] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRKAmIDAvO-suY2r0aRqWwAAAdM"]
[Tue Nov 11 08:17:29.158179 2025] [:error] [pid 19909:tid 19923] [client 91.92.242.56:54754] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/mapsvg/gm_download.php"] [unique_id "aRKAmZj4ijhm0fzOSagTvAAAAoo"]
[Tue Nov 11 08:17:30.236420 2025] [:error] [pid 19909:tid 19934] [client 91.92.242.56:55330] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/mapsvg-lite-interactive-vector-maps/gm_download.php"] [unique_id "aRKAmpj4ijhm0fzOSagTvgAAApU"]
[Tue Nov 11 09:57:03.921299 2025] [:error] [pid 53449:tid 53471] [client 143.110.189.28:48874] [client 143.110.189.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.189.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRKX79pz08j5NoUSzp-2aAAAAVE"]
[Tue Nov 11 09:57:05.943736 2025] [:error] [pid 53449:tid 53473] [client 143.110.189.28:48874] [client 143.110.189.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.189.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRKX8dpz08j5NoUSzp-2dwAAAVM"], referer: https://expressinteriors.com/wp-login.php
[Tue Nov 11 12:07:50.760358 2025] [:error] [pid 53449:tid 53466] [client 213.209.143.137:58149] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aRK2ltpz08j5NoUSzp_sHAAAAUw"]
[Tue Nov 11 12:07:51.279273 2025] [:error] [pid 53449:tid 53461] [client 213.209.143.137:60417] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aRK2l9pz08j5NoUSzp_sHgAAAUc"]
[Tue Nov 11 12:07:51.798737 2025] [:error] [pid 53356:tid 53400] [client 213.209.143.137:62505] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aRK2l-kdmt0kzjVcUN9mZAAAAE8"]
[Tue Nov 11 16:10:36.440974 2025] [:error] [pid 31441:tid 31453] [client 45.153.34.41:57412] [client 45.153.34.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aRLvfPQ8TlGWLenoKAXT8wAAAYo"]
[Tue Nov 11 16:46:35.233052 2025] [:error] [pid 36580:tid 36655] [client 45.153.34.41:45218] [client 45.153.34.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aRL365aaFQZGE3H9yOGjbwAAAFE"]
[Tue Nov 11 17:39:31.419253 2025] [:error] [pid 36579:tid 36613] [client 185.244.36.159:46808] [client 185.244.36.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.244.36.159, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRMEU-muedRSntjwLw5ivAAAAAI"]
[Tue Nov 11 17:46:21.040950 2025] [:error] [pid 36579:tid 36628] [client 43.163.206.70:51064] [client 43.163.206.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aRMF7emuedRSntjwLw5kjQAAABE"]
[Tue Nov 11 18:17:43.012164 2025] [:error] [pid 43205:tid 43226] [client 223.244.35.77:49954] [client 223.244.35.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRMNR748SbhIkX6TjwNp2wAAARI"]
[Tue Nov 11 19:50:30.985467 2025] [:error] [pid 43205:tid 43217] [client 84.247.166.224:65443] [client 84.247.166.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 84.247.166.224, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRMjBr48SbhIkX6TjwONbAAAAQk"], referer: binance.com
[Tue Nov 11 19:50:32.638654 2025] [:error] [pid 43205:tid 43225] [client 84.247.166.224:63392] [client 84.247.166.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.247.166.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRMjCL48SbhIkX6TjwONbwAAARE"], referer: binance.com
[Tue Nov 11 19:50:38.666661 2025] [:error] [pid 36580:tid 36643] [client 84.247.166.224:51795] [client 84.247.166.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.247.166.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRMjDpaaFQZGE3H9yOHRmAAAAEU"]
[Tue Nov 11 19:50:40.280424 2025] [:error] [pid 43205:tid 43215] [client 84.247.166.224:57788] [client 84.247.166.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.247.166.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRMjEL48SbhIkX6TjwONdgAAAQc"]
[Tue Nov 11 19:50:41.899007 2025] [:error] [pid 43205:tid 43214] [client 84.247.166.224:64436] [client 84.247.166.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.247.166.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRMjEb48SbhIkX6TjwONeQAAAQY"]
[Tue Nov 11 19:50:43.467895 2025] [:error] [pid 36673:tid 36698] [client 84.247.166.224:55266] [client 84.247.166.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.247.166.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRMjEyvASiSDHs9bkfcNtQAAAJc"]
[Tue Nov 11 19:50:45.047266 2025] [:error] [pid 36580:tid 36647] [client 84.247.166.224:55266] [client 84.247.166.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.247.166.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRMjFZaaFQZGE3H9yOHRoAAAAEk"]
[Tue Nov 11 19:50:46.688408 2025] [:error] [pid 36580:tid 36640] [client 84.247.166.224:60251] [client 84.247.166.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.247.166.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRMjFpaaFQZGE3H9yOHRoQAAAEI"]
[Tue Nov 11 21:18:09.491588 2025] [:error] [pid 43205:tid 43210] [client 155.138.221.234:51630] [client 155.138.221.234] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 155.138.221.234, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRM3kb48SbhIkX6TjwOvZQAAAQI"]
[Tue Nov 11 21:18:27.795956 2025] [:error] [pid 36578:tid 36594] [client 155.138.221.234:59718] [client 155.138.221.234] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 155.138.221.234, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRM3o0Mi03XeylcOo5XosQAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Tue Nov 11 22:09:05.164732 2025] [:error] [pid 47859:tid 47877] [client 43.166.129.247:57336] [client 43.166.129.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRNDgaRzLR7egYHK_4d44QAAAA0"]
[Tue Nov 11 22:11:02.645413 2025] [:error] [pid 47859:tid 47871] [client 213.209.143.137:57897] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wc-fields-factory/readme.txt"] [unique_id "aRND9qRzLR7egYHK_4d6bQAAAAc"]
[Tue Nov 11 22:11:03.168179 2025] [:error] [pid 47931:tid 47953] [client 213.209.143.137:58884] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wc-fields-factory/readme.txt"] [unique_id "aRND9zWP7ptQ6Y-gz68eLQAAAVM"]
[Tue Nov 11 22:11:07.404885 2025] [:error] [pid 47860:tid 47902] [client 213.209.143.137:61099] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/user-registration/readme.txt"] [unique_id "aRND-6Pe6bkmJWx80CzSqAAAAEs"]
[Tue Nov 11 22:11:07.926943 2025] [:error] [pid 47859:tid 47864] [client 213.209.143.137:60504] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/user-registration/readme.txt"] [unique_id "aRND-6RzLR7egYHK_4d6hQAAAAA"]
[Tue Nov 11 22:11:08.451123 2025] [:error] [pid 47964:tid 47991] [client 213.209.143.137:62556] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/user-registration/readme.txt"] [unique_id "aRND_F6CQC3ebUS5pkQDrAAAAZg"]
[Tue Nov 11 22:11:08.994370 2025] [:error] [pid 47931:tid 47958] [client 213.209.143.137:64432] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/user-registration/readme.txt"] [unique_id "aRND_DWP7ptQ6Y-gz68eXQAAAVg"]
[Wed Nov 12 02:23:18.012874 2025] [:error] [pid 40833:tid 40856] [client 185.238.231.28:50847] [client 185.238.231.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRN_FmTefCfEPkRt3xnlfQAAAM0"]
[Wed Nov 12 03:13:50.459444 2025] [:error] [pid 40746:tid 40790] [client 185.238.231.115:57819] [client 185.238.231.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.115, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aROK7p75CjGFTLdEMn4O9QAAAE0"]
[Wed Nov 12 03:24:28.218252 2025] [:error] [pid 40747:tid 40823] [client 185.238.231.158:24331] [client 185.238.231.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.158, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRONbP9Knd3RnQx09rL3JwAAAJM"]
[Wed Nov 12 03:34:24.557941 2025] [:error] [pid 5539:tid 5565] [client 185.238.231.136:42717] [client 185.238.231.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aROPwLpvPPcBzWUzARpmXAAAAM0"]
[Wed Nov 12 03:45:01.924611 2025] [:error] [pid 37551:tid 37623] [client 185.238.231.17:33785] [client 185.238.231.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aROSPUIv6UBuonU0j8_nNwAAAI8"]
[Wed Nov 12 03:55:25.269582 2025] [:error] [pid 11923:tid 11933] [client 185.238.231.24:24077] [client 185.238.231.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aROUrePkZOglr3Kaij-cHgAAAMA"]
[Wed Nov 12 04:06:29.341213 2025] [:error] [pid 57222:tid 57239] [client 185.238.231.22:37935] [client 185.238.231.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aROXRWGJazH5XCcA91cOOAAAAAw"]
[Wed Nov 12 04:16:15.202034 2025] [:error] [pid 57222:tid 57240] [client 185.238.231.19:55065] [client 185.238.231.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aROZj2GJazH5XCcA91cR3AAAAA0"]
[Wed Nov 12 04:20:17.040679 2025] [:error] [pid 57223:tid 57266] [client 213.209.143.137:50358] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aROagRUU8_2aS__aG8YtQgAAAEk"]
[Wed Nov 12 04:20:17.544365 2025] [:error] [pid 57223:tid 57279] [client 213.209.143.137:52697] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aROagRUU8_2aS__aG8YtRAAAAFY"]
[Wed Nov 12 04:20:18.047752 2025] [:error] [pid 57312:tid 57324] [client 213.209.143.137:55201] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aROago0cuHgB17JK5qWd8gAAAMc"]
[Wed Nov 12 04:26:58.711814 2025] [:error] [pid 57222:tid 57232] [client 185.238.231.151:40065] [client 185.238.231.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aROcEmGJazH5XCcA91cXuAAAAAU"]
[Wed Nov 12 04:37:09.805811 2025] [:error] [pid 32959:tid 32975] [client 185.238.231.161:63271] [client 185.238.231.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.161, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aROedXoyrq7OJfcFnDidrgAAAQw"]
[Wed Nov 12 04:48:01.438068 2025] [:error] [pid 57223:tid 57278] [client 185.238.231.147:63689] [client 185.238.231.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aROhARUU8_2aS__aG8Y3yQAAAFU"]
[Wed Nov 12 04:58:25.407591 2025] [:error] [pid 57312:tid 57320] [client 185.238.231.138:46505] [client 185.238.231.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aROjcY0cuHgB17JK5qWuWAAAAMM"]
[Wed Nov 12 05:09:28.106772 2025] [:error] [pid 57224:tid 57302] [client 185.238.231.154:61893] [client 185.238.231.154] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.154, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aROmCBs7oZ7imwCSdAn4zAAAAJI"]
[Wed Nov 12 05:19:53.769416 2025] [:error] [pid 32959:tid 32980] [client 185.238.231.140:42981] [client 185.238.231.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.140, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aROoeXoyrq7OJfcFnDi2mQAAARE"]
[Wed Nov 12 05:29:54.005363 2025] [:error] [pid 32959:tid 32975] [client 185.238.231.118:56109] [client 185.238.231.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aROq0noyrq7OJfcFnDi9JAAAAQw"]
[Wed Nov 12 05:40:15.603134 2025] [:error] [pid 57223:tid 57276] [client 185.238.231.21:22685] [client 185.238.231.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aROtPxUU8_2aS__aG8ZHkQAAAFM"]
[Wed Nov 12 05:50:31.085821 2025] [:error] [pid 32959:tid 32965] [client 185.238.231.144:46101] [client 185.238.231.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aROvp3oyrq7OJfcFnDjICQAAAQI"]
[Wed Nov 12 06:00:35.460653 2025] [:error] [pid 57224:tid 57296] [client 185.238.231.122:25041] [client 185.238.231.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aROyAxs7oZ7imwCSdAkJ_wAAAIw"]
[Wed Nov 12 06:12:00.099697 2025] [:error] [pid 57222:tid 57232] [client 185.238.231.151:47357] [client 185.238.231.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRO0sGGJazH5XCcA91c1zgAAAAU"]
[Wed Nov 12 06:22:31.900141 2025] [:error] [pid 57224:tid 57290] [client 185.238.231.28:36033] [client 185.238.231.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRO3Jxs7oZ7imwCSdAkSTAAAAIY"]
[Wed Nov 12 06:33:19.685933 2025] [:error] [pid 57222:tid 57237] [client 185.238.231.151:61801] [client 185.238.231.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRO5r2GJazH5XCcA91c--wAAAAo"]
[Wed Nov 12 06:43:26.911822 2025] [:error] [pid 57312:tid 57322] [client 185.238.231.27:60787] [client 185.238.231.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRO8Do0cuHgB17JK5qXa8QAAAMU"]
[Wed Nov 12 06:53:29.398344 2025] [:error] [pid 57312:tid 57322] [client 185.238.231.151:42805] [client 185.238.231.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRO-aY0cuHgB17JK5qXf8QAAAMU"]
[Wed Nov 12 07:03:14.589485 2025] [:error] [pid 57224:tid 57298] [client 185.238.231.155:44031] [client 185.238.231.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.155, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRPAshs7oZ7imwCSdAkjswAAAI4"]
[Wed Nov 12 07:05:57.949818 2025] [:error] [pid 32959:tid 32972] [client 110.166.71.39:53891] [client 110.166.71.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRPBVXoyrq7OJfcFnDj6wQAAAQk"]
[Wed Nov 12 07:13:20.093207 2025] [:error] [pid 57224:tid 57295] [client 185.238.231.133:43303] [client 185.238.231.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRPDEBs7oZ7imwCSdAknMAAAAIs"]
[Wed Nov 12 07:23:05.276077 2025] [:error] [pid 32959:tid 32966] [client 185.238.231.115:34475] [client 185.238.231.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.115, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRPFWXoyrq7OJfcFnDgFtAAAAQM"]
[Wed Nov 12 07:33:44.279883 2025] [:error] [pid 32959:tid 32966] [client 185.238.231.154:51661] [client 185.238.231.154] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.154, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRPH2Hoyrq7OJfcFnDgMLwAAAQM"]
[Wed Nov 12 07:44:18.758280 2025] [:error] [pid 57312:tid 57339] [client 185.238.231.144:50215] [client 185.238.231.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRPKUo0cuHgB17JK5qX4WAAAANY"]
2025/11/12 08:46:55 [error] 24805#24805: *1301 connect() failed (111: Connection refused) while connecting to upstream, client: 185.238.231.135, server: expressinteriors.com, request: "POST /wp-login.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-login.php", host: "expressinteriors.com"
2025/11/12 08:56:36 [error] 24801#24801: *4006 connect() failed (111: Connection refused) while connecting to upstream, client: 185.238.231.152, server: expressinteriors.com, request: "POST /wp-login.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-login.php", host: "expressinteriors.com"
[Wed Nov 12 09:28:39.077137 2025] [ssl:error] [pid 41920:tid 41928] [client 34.222.208.20:42166] AH02032: Hostname www.cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup
[Wed Nov 12 09:33:15.804935 2025] [:error] [pid 41920:tid 41932] [client 185.238.231.30:53717] [client 185.238.231.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRPj2-XWVOMJCZeU4HGGCAAAAMo"]
[Wed Nov 12 09:43:29.981453 2025] [:error] [pid 41830:tid 41916] [client 185.238.231.140:38011] [client 185.238.231.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.140, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRPmQdqZnx4EJABV9sTgOgAAAJg"]
[Wed Nov 12 09:54:55.267801 2025] [:error] [pid 41829:tid 41876] [client 185.238.231.116:43577] [client 185.238.231.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRPo70UtUz3Zf1wIC3wsjAAAAEs"]
[Wed Nov 12 10:08:07.182871 2025] [:error] [pid 60095:tid 60109] [client 185.238.231.27:29923] [client 185.238.231.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRPsB3lw2elroagFF1qhEAAAAEo"]
[Wed Nov 12 10:19:27.930850 2025] [:error] [pid 60097:tid 60162] [client 185.238.231.25:63025] [client 185.238.231.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRPur8dT5oio_TbWpi_figAAAMk"]
[Wed Nov 12 10:30:02.362380 2025] [:error] [pid 60097:tid 60142] [client 185.238.231.146:40487] [client 185.238.231.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRPxKsdT5oio_TbWpi_jlgAAAMA"]
[Wed Nov 12 10:36:55.090757 2025] [:error] [pid 60095:tid 60110] [client 65.109.108.202:33526] [client 65.109.108.202] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.109.108.202, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRPyx3lw2elroagFF1qrHwAAAEs"]
[Wed Nov 12 10:37:00.580241 2025] [:error] [pid 60095:tid 60103] [client 65.109.108.202:33526] [client 65.109.108.202] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.109.108.202, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRPyzHlw2elroagFF1qrJgAAAEQ"], referer: https://expressinteriors.com/wp-login.php
[Wed Nov 12 10:40:11.300310 2025] [:error] [pid 60095:tid 60104] [client 185.238.231.116:28377] [client 185.238.231.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRPzi3lw2elroagFF1qsOgAAAEU"]
[Wed Nov 12 10:50:52.134678 2025] [:error] [pid 60097:tid 60163] [client 185.238.231.159:29391] [client 185.238.231.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.159, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRP2DMdT5oio_TbWpi_sMAAAAMo"]
[Wed Nov 12 11:03:17.034872 2025] [:error] [pid 60405:tid 60409] [client 185.238.231.143:65257] [client 185.238.231.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.143, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRP49XMGv_mlVi6mf5pf0wAAAAE"]
[Wed Nov 12 11:13:19.279352 2025] [:error] [pid 12744:tid 12755] [client 185.238.231.116:25167] [client 185.238.231.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRP7T51cp_ouUvkFj0WOuAAAAQc"]
[Wed Nov 12 11:23:02.431269 2025] [:error] [pid 60095:tid 60114] [client 185.238.231.27:33649] [client 185.238.231.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRP9lnlw2elroagFF1q4eQAAAE8"]
[Wed Nov 12 11:33:38.857941 2025] [:error] [pid 60405:tid 60431] [client 185.238.231.26:23419] [client 185.238.231.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQAEnMGv_mlVi6mf5prdAAAABc"]
[Wed Nov 12 11:42:22.126662 2025] [:error] [pid 60405:tid 60431] [client 51.178.68.226:56302] [client 51.178.68.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.178.68.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRQCHnMGv_mlVi6mf5puPwAAABc"]
[Wed Nov 12 11:44:12.666709 2025] [:error] [pid 60405:tid 60410] [client 185.238.231.23:30665] [client 185.238.231.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQCjHMGv_mlVi6mf5pu3gAAAAI"]
[Wed Nov 12 11:57:05.540471 2025] [:error] [pid 60095:tid 60111] [client 185.238.231.132:26327] [client 185.238.231.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.132, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQFkXlw2elroagFF1rCvAAAAEw"]
[Wed Nov 12 12:10:48.330946 2025] [:error] [pid 60096:tid 60126] [client 185.238.231.146:35719] [client 185.238.231.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQIyDmzkhCvvk8DXOwxDAAAAIA"]
[Wed Nov 12 12:17:06.165726 2025] [:error] [pid 60095:tid 60104] [client 173.236.255.37:40298] [client 173.236.255.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.255.37, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQKQnlw2elroagFF1rJvgAAAEU"]
[Wed Nov 12 12:22:11.739156 2025] [:error] [pid 60095:tid 60111] [client 185.238.231.24:62417] [client 185.238.231.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQLc3lw2elroagFF1rLJQAAAEw"]
[Wed Nov 12 12:35:31.239482 2025] [:error] [pid 60405:tid 60408] [client 185.238.231.146:47033] [client 185.238.231.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQOk3MGv_mlVi6mf5qFCAAAAAA"]
[Wed Nov 12 12:47:54.946895 2025] [:error] [pid 60096:tid 60158] [client 89.36.74.169:39427] [client 89.36.74.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.36.74.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQRejmzkhCvvk8DXOw79AAAAJg"]
[Wed Nov 12 12:47:56.334306 2025] [:error] [pid 60096:tid 60138] [client 89.36.74.169:39427] [client 89.36.74.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.36.74.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQRfDmzkhCvvk8DXOw79gAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Wed Nov 12 12:49:51.359785 2025] [:error] [pid 60180:tid 60182] [client 185.238.231.159:23541] [client 185.238.231.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.159, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQR71hgd7ccS8EZg1rSLAAAAUA"]
[Wed Nov 12 12:51:58.218239 2025] [:error] [pid 60095:tid 60105] [client 164.92.107.174:46158] [client 164.92.107.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/@vite/env"] [unique_id "aRQSbnlw2elroagFF1rUtAAAAEY"]
[Wed Nov 12 12:51:58.707075 2025] [:error] [pid 12744:tid 12748] [client 164.92.107.174:46166] [client 164.92.107.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/actuator/env"] [unique_id "aRQSbp1cp_ouUvkFj0XDKQAAAQA"]
[Wed Nov 12 12:51:59.195602 2025] [:error] [pid 60096:tid 60145] [client 164.92.107.174:46176] [client 164.92.107.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aRQSbzmzkhCvvk8DXOw84AAAAJA"]
[Wed Nov 12 12:51:59.685314 2025] [:error] [pid 60097:tid 60164] [client 164.92.107.174:46192] [client 164.92.107.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/server"] [unique_id "aRQSb8dT5oio_TbWpi8ShwAAAMs"]
[Wed Nov 12 12:52:00.173887 2025] [:error] [pid 12744:tid 12767] [client 164.92.107.174:46204] [client 164.92.107.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aRQScJ1cp_ouUvkFj0XDLQAAARM"]
[Wed Nov 12 12:52:00.662665 2025] [:error] [pid 12744:tid 12763] [client 164.92.107.174:46220] [client 164.92.107.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/about"] [unique_id "aRQScJ1cp_ouUvkFj0XDLwAAAQ8"]
[Wed Nov 12 12:52:01.149738 2025] [:error] [pid 60097:tid 60154] [client 164.92.107.174:46230] [client 164.92.107.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/debug/default/view"] [unique_id "aRQSccdT5oio_TbWpi8SiQAAAMY"]
[Wed Nov 12 12:52:01.665262 2025] [:error] [pid 60097:tid 60168] [client 164.92.107.174:46246] [client 164.92.107.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/v2/_catalog"] [unique_id "aRQSccdT5oio_TbWpi8SiwAAAM8"]
[Wed Nov 12 12:52:02.308238 2025] [:error] [pid 60180:tid 60194] [client 164.92.107.174:46262] [client 164.92.107.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aRQSclhgd7ccS8EZg1rS-gAAAUw"]
[Wed Nov 12 12:52:02.862137 2025] [:error] [pid 60405:tid 60418] [client 164.92.107.174:46266] [client 164.92.107.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/server-status"] [unique_id "aRQScnMGv_mlVi6mf5qK0wAAAAo"]
[Wed Nov 12 12:52:03.348274 2025] [:error] [pid 12744:tid 12755] [client 164.92.107.174:39814] [client 164.92.107.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/login.action"] [unique_id "aRQSc51cp_ouUvkFj0XDNwAAAQc"]
[Wed Nov 12 12:52:04.942513 2025] [:error] [pid 60405:tid 60420] [client 164.92.107.174:39826] [client 164.92.107.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/.DS_Store"] [unique_id "aRQSdHMGv_mlVi6mf5qK2wAAAAw"]
[Wed Nov 12 12:52:05.430112 2025] [:error] [pid 60095:tid 60107] [client 164.92.107.174:39834] [client 164.92.107.174] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aRQSdXlw2elroagFF1rUuAAAAEg"]
[Wed Nov 12 12:52:05.918950 2025] [:error] [pid 12744:tid 12757] [client 164.92.107.174:39846] [client 164.92.107.174] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aRQSdZ1cp_ouUvkFj0XDPAAAAQk"]
[Wed Nov 12 12:52:06.407124 2025] [:error] [pid 60405:tid 60428] [client 164.92.107.174:39858] [client 164.92.107.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aRQSdnMGv_mlVi6mf5qK3wAAABQ"]
[Wed Nov 12 12:52:06.895391 2025] [:error] [pid 60180:tid 60196] [client 164.92.107.174:39866] [client 164.92.107.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/config.json"] [unique_id "aRQSdlhgd7ccS8EZg1rTBQAAAU4"]
[Wed Nov 12 12:52:07.383899 2025] [:error] [pid 60096:tid 60134] [client 164.92.107.174:39870] [client 164.92.107.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/telescope/requests"] [unique_id "aRQSdzmzkhCvvk8DXOw85wAAAIg"]
[Wed Nov 12 12:52:07.873126 2025] [:error] [pid 60096:tid 60148] [client 164.92.107.174:39878] [client 164.92.107.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/info.php"] [unique_id "aRQSdzmzkhCvvk8DXOw86AAAAJI"]
[Wed Nov 12 12:52:08.361257 2025] [:error] [pid 60095:tid 60114] [client 164.92.107.174:39890] [client 164.92.107.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aRQSeHlw2elroagFF1rUuwAAAE8"]
[Wed Nov 12 13:03:21.096323 2025] [:error] [pid 60405:tid 60426] [client 185.238.231.150:63545] [client 185.238.231.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQVGXMGv_mlVi6mf5qP1AAAABI"]
[Wed Nov 12 13:14:50.410410 2025] [:error] [pid 60180:tid 60188] [client 185.238.231.20:38679] [client 185.238.231.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.20, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQXylhgd7ccS8EZg1rcTwAAAUY"]
[Wed Nov 12 13:25:12.116094 2025] [:error] [pid 60405:tid 60422] [client 185.238.231.136:46781] [client 185.238.231.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQaOHMGv_mlVi6mf5qZxAAAAA4"]
[Wed Nov 12 13:35:52.177727 2025] [:error] [pid 60096:tid 60148] [client 185.238.231.21:58525] [client 185.238.231.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQcuDmzkhCvvk8DXOxPEAAAAJI"]
[Wed Nov 12 13:46:13.049321 2025] [:error] [pid 60405:tid 60409] [client 185.238.231.143:37551] [client 185.238.231.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.143, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQfJXMGv_mlVi6mf5qh0QAAAAE"]
[Wed Nov 12 13:56:37.489077 2025] [:error] [pid 60096:tid 60145] [client 185.238.231.149:48015] [client 185.238.231.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.149, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQhlTmzkhCvvk8DXOxVwQAAAJA"]
[Wed Nov 12 13:58:17.587004 2025] [:error] [pid 60096:tid 60137] [client 185.88.176.214:57950] [client 185.88.176.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.88.176.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRQh-TmzkhCvvk8DXOxWOAAAAIs"]
[Wed Nov 12 14:08:27.771243 2025] [:error] [pid 60097:tid 60166] [client 185.238.231.114:30895] [client 185.238.231.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQkW8dT5oio_TbWpi8u3wAAAM0"]
[Wed Nov 12 14:14:20.552165 2025] [:error] [pid 12744:tid 12760] [client 146.190.81.111:59850] [client 146.190.81.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.81.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRQlvJ1cp_ouUvkFj0XtKgAAAQw"]
[Wed Nov 12 14:19:44.228773 2025] [:error] [pid 60095:tid 60118] [client 185.238.231.158:43659] [client 185.238.231.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.158, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQnAHlw2elroagFF1rx5gAAAFM"]
[Wed Nov 12 14:30:12.615914 2025] [:error] [pid 60095:tid 60120] [client 185.238.231.30:50025] [client 185.238.231.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQpdHlw2elroagFF1r0ogAAAFU"]
[Wed Nov 12 14:40:21.773905 2025] [:error] [pid 60405:tid 60410] [client 185.238.231.149:60299] [client 185.238.231.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.149, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQr1XMGv_mlVi6mf5q0oAAAAAI"]
[Wed Nov 12 14:50:38.018168 2025] [:error] [pid 60096:tid 60130] [client 185.238.231.117:46629] [client 185.238.231.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.117, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQuPjmzkhCvvk8DXOxlUQAAAIQ"]
[Wed Nov 12 14:50:39.228316 2025] [:error] [pid 60097:tid 60162] [client 165.22.241.155:37916] [client 165.22.241.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.241.155, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQuP8dT5oio_TbWpi87oQAAAMk"]
[Wed Nov 12 15:02:21.276200 2025] [:error] [pid 60180:tid 60198] [client 185.238.231.23:37857] [client 185.238.231.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQw_Vhgd7ccS8EZg1oBVQAAAVA"]
[Wed Nov 12 15:13:05.180871 2025] [:error] [pid 60097:tid 60171] [client 185.238.231.22:35055] [client 185.238.231.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQzgcdT5oio_TbWpi9A0AAAANI"]
[Wed Nov 12 15:23:39.334851 2025] [:error] [pid 60180:tid 60189] [client 185.238.231.116:61821] [client 185.238.231.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQ1-1hgd7ccS8EZg1oGHQAAAUc"]
[Wed Nov 12 15:32:54.004975 2025] [:error] [pid 60096:tid 60133] [client 103.205.141.156:55158] [client 103.205.141.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.205.141.156, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQ4JjmzkhCvvk8DXOxvaQAAAIc"]
[Wed Nov 12 15:32:54.740125 2025] [:error] [pid 60096:tid 60137] [client 103.205.141.156:55158] [client 103.205.141.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.205.141.156, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQ4JjmzkhCvvk8DXOxvbAAAAIs"], referer: https://expressinteriors.com/wp-login.php
[Wed Nov 12 15:35:20.434515 2025] [:error] [pid 60180:tid 60183] [client 185.238.231.158:24907] [client 185.238.231.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.158, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQ4uFhgd7ccS8EZg1oJjgAAAUE"]
[Wed Nov 12 15:46:21.708361 2025] [:error] [pid 60405:tid 60425] [client 185.238.231.28:55963] [client 185.238.231.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQ7TXMGv_mlVi6mf5rH-QAAABE"]
[Wed Nov 12 15:56:49.872141 2025] [:error] [pid 60405:tid 60432] [client 202.59.80.192:46560] [client 202.59.80.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.59.80.192, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRQ9wXMGv_mlVi6mf5rLPgAAABg"]
[Wed Nov 12 15:57:29.207266 2025] [:error] [pid 12744:tid 12755] [client 185.238.231.142:54351] [client 185.238.231.142] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.142, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQ96Z1cp_ouUvkFj0UZaAAAAQc"]
[Wed Nov 12 15:58:51.683482 2025] [:error] [pid 60180:tid 60189] [client 64.31.40.162:49136] [client 64.31.40.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.31.40.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQ-O1hgd7ccS8EZg1oRRgAAAUc"]
[Wed Nov 12 15:58:53.095844 2025] [:error] [pid 60180:tid 60195] [client 64.31.40.162:49136] [client 64.31.40.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.31.40.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRQ-PVhgd7ccS8EZg1oRRwAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Wed Nov 12 16:10:05.852919 2025] [:error] [pid 12744:tid 12757] [client 185.238.231.135:25693] [client 185.238.231.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRA3Z1cp_ouUvkFj0UdiQAAAQk"]
[Wed Nov 12 16:20:46.560839 2025] [:error] [pid 60095:tid 60114] [client 185.238.231.117:60551] [client 185.238.231.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.117, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRDXnlw2elroagFF1oOJgAAAE8"]
[Wed Nov 12 16:31:16.825128 2025] [:error] [pid 60097:tid 60160] [client 185.11.166.192:56390] [client 185.11.166.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.11.166.192, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRRF1MdT5oio_TbWpi9UZgAAAMc"]
[Wed Nov 12 16:31:24.909016 2025] [:error] [pid 12744:tid 12765] [client 185.238.231.120:51069] [client 185.238.231.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.120, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRF3J1cp_ouUvkFj0UlvgAAARE"]
[Wed Nov 12 16:41:59.067003 2025] [:error] [pid 60095:tid 60119] [client 185.238.231.115:32647] [client 185.238.231.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.115, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRIV3lw2elroagFF1oTOwAAAFQ"]
[Wed Nov 12 16:52:40.792131 2025] [:error] [pid 60096:tid 60146] [client 185.238.231.27:36383] [client 185.238.231.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRK2DmzkhCvvk8DXOyF4AAAAJE"]
[Wed Nov 12 16:54:05.422457 2025] [:error] [pid 12744:tid 12771] [client 13.234.84.242:56894] [client 13.234.84.242] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 13.234.84.242, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRLLZ1cp_ouUvkFj0Ux9wAAARc"]
[Wed Nov 12 16:54:09.416549 2025] [:error] [pid 12744:tid 12761] [client 13.234.84.242:56894] [client 13.234.84.242] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 13.234.84.242, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRLMZ1cp_ouUvkFj0UyAwAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Wed Nov 12 17:03:56.476663 2025] [:error] [pid 60096:tid 60145] [client 185.238.231.28:56109] [client 185.238.231.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRNfDmzkhCvvk8DXOyIRwAAAJA"]
[Wed Nov 12 17:15:29.653604 2025] [:error] [pid 60405:tid 60421] [client 185.238.231.147:32157] [client 185.238.231.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRQMXMGv_mlVi6mf5rk-gAAAA0"]
[Wed Nov 12 17:25:39.963355 2025] [:error] [pid 60096:tid 60155] [client 157.10.198.29:38082] [client 157.10.198.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.10.198.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRRSkzmzkhCvvk8DXOyMmQAAAJU"]
[Wed Nov 12 17:26:59.833402 2025] [:error] [pid 60096:tid 60129] [client 185.238.231.146:34275] [client 185.238.231.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRS4zmzkhCvvk8DXOyMzQAAAIM"]
[Wed Nov 12 17:37:52.473718 2025] [:error] [pid 60096:tid 60156] [client 185.238.231.157:26119] [client 185.238.231.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.157, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRVcDmzkhCvvk8DXOyO_gAAAJY"]
[Wed Nov 12 17:48:02.543000 2025] [:error] [pid 60096:tid 60138] [client 124.47.187.245:55242] [client 124.47.187.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.47.187.245, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRRX0jmzkhCvvk8DXOyR_wAAAIw"]
[Wed Nov 12 17:48:26.008195 2025] [:error] [pid 60180:tid 60187] [client 185.238.231.154:48485] [client 185.238.231.154] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.154, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRX6lhgd7ccS8EZg1ow8QAAAUU"]
[Wed Nov 12 17:53:26.575701 2025] [:error] [pid 60097:tid 60165] [client 201.46.112.136:59594] [client 201.46.112.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 201.46.112.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRZFsdT5oio_TbWpi9rpAAAAMw"]
[Wed Nov 12 17:59:09.015849 2025] [:error] [pid 23737:tid 23770] [client 185.238.231.138:45061] [client 185.238.231.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRabRQUsVVfOZWgW_WPNQAAAZU"]
[Wed Nov 12 18:11:26.485158 2025] [:error] [pid 60097:tid 60144] [client 185.238.231.117:54933] [client 185.238.231.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.117, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRdTsdT5oio_TbWpi9wgwAAAME"]
[Wed Nov 12 18:22:45.064517 2025] [:error] [pid 60405:tid 60414] [client 185.238.231.31:37533] [client 185.238.231.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRf9XMGv_mlVi6mf5r38QAAAAY"]
[Wed Nov 12 18:33:40.617172 2025] [:error] [pid 60097:tid 60150] [client 185.238.231.150:33561] [client 185.238.231.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRihMdT5oio_TbWpi93mAAAAMQ"]
[Wed Nov 12 18:42:06.359053 2025] [:error] [pid 12744:tid 12770] [client 15.235.218.124:57338] [client 15.235.218.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.235.218.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRkfp1cp_ouUvkFj0VZDgAAARY"]
[Wed Nov 12 18:42:09.049261 2025] [:error] [pid 12744:tid 12755] [client 15.235.218.124:57338] [client 15.235.218.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.235.218.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRkgZ1cp_ouUvkFj0VZFAAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Wed Nov 12 18:44:43.432861 2025] [:error] [pid 23737:tid 23763] [client 185.238.231.129:51679] [client 185.238.231.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.129, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRlGxQUsVVfOZWgW_Wi-AAAAY4"]
[Wed Nov 12 18:55:33.506369 2025] [:error] [pid 12744:tid 12749] [client 185.238.231.138:20293] [client 185.238.231.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRnpZ1cp_ouUvkFj0VcrwAAAQE"]
[Wed Nov 12 19:07:18.314372 2025] [:error] [pid 23737:tid 23769] [client 185.238.231.157:53757] [client 185.238.231.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.157, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRqZhQUsVVfOZWgW_WqlgAAAZQ"]
[Wed Nov 12 19:10:09.920114 2025] [:error] [pid 60180:tid 60195] [client 41.216.188.194:49869] [client 41.216.188.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.216.188.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRrEVhgd7ccS8EZg1pJLgAAAU0"]
[Wed Nov 12 19:10:11.554462 2025] [:error] [pid 60180:tid 60188] [client 41.216.188.194:49869] [client 41.216.188.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.216.188.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRrE1hgd7ccS8EZg1pJMgAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Wed Nov 12 19:10:13.417073 2025] [:error] [pid 60180:tid 60203] [client 41.216.188.194:49869] [client 41.216.188.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.216.188.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRrFVhgd7ccS8EZg1pJNAAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Wed Nov 12 19:10:15.062311 2025] [:error] [pid 60180:tid 60202] [client 41.216.188.194:49869] [client 41.216.188.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.216.188.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRrF1hgd7ccS8EZg1pJNQAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Wed Nov 12 19:10:16.679629 2025] [:error] [pid 60180:tid 60183] [client 41.216.188.194:49869] [client 41.216.188.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.216.188.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRrGFhgd7ccS8EZg1pJNwAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Wed Nov 12 19:10:17.904501 2025] [:error] [pid 60180:tid 60197] [client 41.216.188.194:49869] [client 41.216.188.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.216.188.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRrGVhgd7ccS8EZg1pJOAAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Wed Nov 12 19:10:19.651468 2025] [:error] [pid 60180:tid 60187] [client 41.216.188.194:49869] [client 41.216.188.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.216.188.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRrG1hgd7ccS8EZg1pJOgAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Wed Nov 12 19:10:21.353727 2025] [:error] [pid 60180:tid 60191] [client 41.216.188.194:49869] [client 41.216.188.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.216.188.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRrHVhgd7ccS8EZg1pJPQAAAUk"], referer: https://expressinteriors.com/wp-login.php
[Wed Nov 12 19:10:22.959143 2025] [:error] [pid 60180:tid 60190] [client 41.216.188.194:49869] [client 41.216.188.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.216.188.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRrHlhgd7ccS8EZg1pJQwAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Wed Nov 12 19:10:24.491876 2025] [:error] [pid 60180:tid 60204] [client 41.216.188.194:49869] [client 41.216.188.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.216.188.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRrIFhgd7ccS8EZg1pJRQAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Wed Nov 12 19:10:26.057494 2025] [:error] [pid 60180:tid 60184] [client 41.216.188.194:49869] [client 41.216.188.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.216.188.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRrIlhgd7ccS8EZg1pJSAAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Wed Nov 12 19:10:27.418445 2025] [:error] [pid 60180:tid 60206] [client 41.216.188.194:49869] [client 41.216.188.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.216.188.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRrI1hgd7ccS8EZg1pJSQAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Wed Nov 12 19:10:29.037582 2025] [:error] [pid 60180:tid 60197] [client 41.216.188.194:49869] [client 41.216.188.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.216.188.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRrJVhgd7ccS8EZg1pJTAAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Wed Nov 12 19:18:37.432888 2025] [:error] [pid 60405:tid 60430] [client 185.238.231.138:36729] [client 185.238.231.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRtDXMGv_mlVi6mf5oGOwAAABY"]
[Wed Nov 12 19:29:33.182171 2025] [:error] [pid 60095:tid 60123] [client 185.238.231.134:61311] [client 185.238.231.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRvnXlw2elroagFF1o7cAAAAFg"]
[Wed Nov 12 19:40:10.862438 2025] [:error] [pid 60097:tid 60165] [client 124.47.187.245:52800] [client 124.47.187.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 124.47.187.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRyGsdT5oio_TbWpi-GhgAAAMw"]
[Wed Nov 12 19:40:15.084557 2025] [:error] [pid 60097:tid 60144] [client 124.47.187.245:52800] [client 124.47.187.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 124.47.187.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRyH8dT5oio_TbWpi-GiwAAAME"], referer: https://expressinteriors.com/wp-login.php
[Wed Nov 12 19:40:40.508164 2025] [:error] [pid 60405:tid 60423] [client 185.238.231.18:36383] [client 185.238.231.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.18, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRRyOHMGv_mlVi6mf5oKXwAAAA8"]
[Wed Nov 12 19:51:12.700645 2025] [:error] [pid 60097:tid 60144] [client 185.238.231.19:59671] [client 185.238.231.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRR0sMdT5oio_TbWpi-ITwAAAME"]
[Wed Nov 12 20:02:59.695488 2025] [:error] [pid 23737:tid 23768] [client 185.238.231.150:24459] [client 185.238.231.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRR3cxQUsVVfOZWgW_W7nwAAAZM"]
[Wed Nov 12 20:14:12.889855 2025] [:error] [pid 60095:tid 60111] [client 185.238.231.29:60335] [client 185.238.231.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRR6FHlw2elroagFF1pBaAAAAEw"]
[Wed Nov 12 20:21:12.844997 2025] [:error] [pid 60096:tid 60127] [client 78.157.49.100:49128] [client 78.157.49.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.157.49.100, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRR7uDmzkhCvvk8DXOyyKAAAAIE"]
[Wed Nov 12 20:21:18.078729 2025] [:error] [pid 60096:tid 60131] [client 78.157.49.100:49128] [client 78.157.49.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.157.49.100, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRR7vjmzkhCvvk8DXOyyLAAAAIU"], referer: https://expressinteriors.com/wp-login.php
[Wed Nov 12 20:25:29.194694 2025] [:error] [pid 60096:tid 60130] [client 185.238.231.144:47757] [client 185.238.231.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRR8uTmzkhCvvk8DXOyzAgAAAIQ"]
[Wed Nov 12 20:34:41.098891 2025] [:error] [pid 60180:tid 60201] [client 154.53.62.61:58266] [client 154.53.62.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.53.62.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRR-4Vhgd7ccS8EZg1pZdgAAAVM"]
[Wed Nov 12 20:36:30.787703 2025] [:error] [pid 60095:tid 60122] [client 185.238.231.27:55049] [client 185.238.231.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRR_Tnlw2elroagFF1pFWwAAAFc"]
[Wed Nov 12 20:47:19.974135 2025] [:error] [pid 60180:tid 60187] [client 185.238.231.135:65413] [client 185.238.231.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRSB11hgd7ccS8EZg1pb4wAAAUU"]
[Wed Nov 12 20:58:10.105134 2025] [:error] [pid 23737:tid 23753] [client 185.238.231.23:47493] [client 185.238.231.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRSEYhQUsVVfOZWgW_XOoQAAAYQ"]
[Wed Nov 12 21:10:08.447835 2025] [:error] [pid 12744:tid 12769] [client 185.238.231.22:58677] [client 185.238.231.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRSHMJ1cp_ouUvkFj0V_IwAAARU"]
[Wed Nov 12 21:19:18.267295 2025] [:error] [pid 60095:tid 60102] [client 52.242.231.163:23545] [client 52.242.231.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.242.231.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRSJVnlw2elroagFF1pNOAAAAEM"]
[Wed Nov 12 21:19:52.986162 2025] [:error] [pid 60180:tid 60197] [client 52.242.231.163:3095] [client 52.242.231.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.242.231.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRSJeFhgd7ccS8EZg1pjXwAAAU8"]
[Wed Nov 12 21:21:16.826777 2025] [:error] [pid 23737:tid 23773] [client 185.238.231.31:64061] [client 185.238.231.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRSJzBQUsVVfOZWgW_XVCQAAAZg"]
[Wed Nov 12 21:32:22.472149 2025] [:error] [pid 60180:tid 60202] [client 185.238.231.134:56101] [client 185.238.231.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRSMZlhgd7ccS8EZg1pl7gAAAVQ"]
[Wed Nov 12 21:43:30.830784 2025] [:error] [pid 23737:tid 23755] [client 185.238.231.151:56059] [client 185.238.231.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRSPAhQUsVVfOZWgW_XcvQAAAYY"]
[Wed Nov 12 21:54:24.225694 2025] [:error] [pid 60405:tid 60424] [client 185.238.231.135:47801] [client 185.238.231.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRSRkHMGv_mlVi6mf5omcgAAABA"]
[Wed Nov 12 22:05:38.357283 2025] [:error] [pid 12744:tid 12770] [client 185.238.231.116:56419] [client 185.238.231.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRSUMp1cp_ouUvkFj0WMXwAAARY"]
[Wed Nov 12 22:16:42.379392 2025] [:error] [pid 12744:tid 12765] [client 185.238.231.117:36017] [client 185.238.231.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.117, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRSWyp1cp_ouUvkFj0WOoAAAARE"]
[Wed Nov 12 22:24:58.382114 2025] [:error] [pid 23737:tid 23763] [client 185.193.19.102:39084] [client 185.193.19.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.193.19.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRSYuhQUsVVfOZWgW_XnkwAAAY4"]
[Wed Nov 12 22:27:57.005052 2025] [:error] [pid 60095:tid 60108] [client 185.238.231.138:48967] [client 185.238.231.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRSZbXlw2elroagFF1pZBwAAAEk"]
[Wed Nov 12 22:38:44.541349 2025] [:error] [pid 60096:tid 60155] [client 185.238.231.154:30899] [client 185.238.231.154] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.154, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRSb9DmzkhCvvk8DXOzNRQAAAJU"]
[Wed Nov 12 23:09:10.771274 2025] [:error] [pid 60180:tid 60187] [client 148.66.159.158:42906] [client 148.66.159.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.66.159.158, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRSjFlhgd7ccS8EZg1p4RAAAAUU"]
[Wed Nov 12 23:09:13.927087 2025] [:error] [pid 60180:tid 60188] [client 148.66.159.158:42906] [client 148.66.159.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.66.159.158, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRSjGVhgd7ccS8EZg1p4SQAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Wed Nov 12 23:33:50.794718 2025] [:error] [pid 60096:tid 60153] [client 162.55.231.170:60072] [client 162.55.231.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.55.231.170, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRSo3jmzkhCvvk8DXOzXuQAAAJQ"]
[Thu Nov 13 00:25:21.756782 2025] [:error] [pid 23737:tid 23751] [client 220.158.234.54:41800] [client 220.158.234.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 220.158.234.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRS08RQUsVVfOZWgW_UNoQAAAYI"]
[Thu Nov 13 00:25:27.639076 2025] [:error] [pid 23737:tid 23767] [client 220.158.234.54:41800] [client 220.158.234.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 220.158.234.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRS09xQUsVVfOZWgW_UNyAAAAZI"], referer: https://expressinteriors.com/wp-login.php
[Thu Nov 13 00:33:18.775584 2025] [:error] [pid 23737:tid 23757] [client 194.164.126.55:51790] [client 194.164.126.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.126.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRS2zhQUsVVfOZWgW_UQdAAAAYg"]
[Thu Nov 13 00:33:41.103123 2025] [:error] [pid 23737:tid 23752] [client 194.164.126.55:43272] [client 194.164.126.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.126.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRS25RQUsVVfOZWgW_UQmwAAAYM"]
[Thu Nov 13 01:09:06.004098 2025] [:error] [pid 60095:tid 60122] [client 187.115.88.131:49704] [client 187.115.88.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.115.88.131, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRS_Mnlw2elroagFF1p2bgAAAFc"]
[Thu Nov 13 01:19:37.944525 2025] [:error] [pid 12744:tid 12759] [client 45.124.84.162:4362] [client 45.124.84.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.124.84.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRTBqZ1cp_ouUvkFj0W7CgAAAQs"]
[Thu Nov 13 01:19:43.020337 2025] [:error] [pid 12744:tid 12768] [client 45.124.84.162:4362] [client 45.124.84.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.124.84.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRTBr51cp_ouUvkFj0W7EQAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Nov 13 01:37:10.909169 2025] [:error] [pid 60097:tid 60147] [client 74.208.183.129:57160] [client 74.208.183.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.208.183.129, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRTFxsdT5oio_TbWpi_JqgAAAMI"]
[Thu Nov 13 01:37:14.732168 2025] [:error] [pid 60097:tid 60142] [client 74.208.183.129:57160] [client 74.208.183.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.208.183.129, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRTFysdT5oio_TbWpi_JtAAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Thu Nov 13 01:42:12.231433 2025] [:error] [pid 12744:tid 12769] [client 15.204.248.161:41368] [client 15.204.248.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style.php"] [unique_id "aRTG9J1cp_ouUvkFj0XAaQAAARU"]
[Thu Nov 13 01:54:43.757866 2025] [:error] [pid 23737:tid 23773] [client 119.252.200.128:23490] [client 119.252.200.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 119.252.200.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRTJ4xQUsVVfOZWgW_Up0QAAAZg"]
[Thu Nov 13 02:04:07.861149 2025] [:error] [pid 60180:tid 60195] [client 135.181.31.52:42192] [client 135.181.31.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 135.181.31.52, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRTMF1hgd7ccS8EZg1qZvwAAAU0"]
[Thu Nov 13 02:04:35.459888 2025] [:error] [pid 60405:tid 60418] [client 135.181.31.52:45632] [client 135.181.31.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 135.181.31.52, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRTMM3MGv_mlVi6mf5pXSgAAAAo"]
[Thu Nov 13 02:50:22.200748 2025] [:error] [pid 12744:tid 12752] [client 45.87.42.68:36528] [client 45.87.42.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.87.42.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRTW7p1cp_ouUvkFj0XT-AAAAQQ"]
[Thu Nov 13 02:50:51.688450 2025] [:error] [pid 12744:tid 12772] [client 45.87.42.68:35606] [client 45.87.42.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.87.42.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRTXC51cp_ouUvkFj0XUGgAAARg"]
[Thu Nov 13 02:50:55.877417 2025] [:error] [pid 12744:tid 12752] [client 45.87.42.68:35606] [client 45.87.42.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.87.42.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRTXD51cp_ouUvkFj0XUJAAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Nov 13 02:58:25.455068 2025] [:error] [pid 60096:tid 60148] [client 198.54.125.193:37928] [client 198.54.125.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.125.193, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRTY0TmzkhCvvk8DXOz-oAAAAJI"]
[Thu Nov 13 03:37:07.604032 2025] [:error] [pid 60096:tid 60134] [client 14.225.216.240:50834] [client 14.225.216.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 14.225.216.240, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRTh4zmzkhCvvk8DXOwH_wAAAIg"]
[Thu Nov 13 03:44:05.193364 2025] [:error] [pid 31277:tid 31284] [client 43.205.119.78:35940] [client 43.205.119.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.205.119.78, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRTjhT29YgTp66_v048SVgAAAME"]
[Thu Nov 13 04:09:00.638626 2025] [:error] [pid 7045:tid 7097] [client 160.30.112.53:55028] [client 160.30.112.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 160.30.112.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRTpXOM1dyjPrDV86qS9vAAAAFA"]
[Thu Nov 13 04:09:05.140562 2025] [:error] [pid 7045:tid 7085] [client 160.30.112.53:55028] [client 160.30.112.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 160.30.112.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRTpYeM1dyjPrDV86qS9wgAAAEQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Nov 13 04:23:00.502752 2025] [:error] [pid 51491:tid 51516] [client 68.183.180.73:46018] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2/api-docs"] [unique_id "aRTspNQaME15TQuGVKTlSAAAANQ"]
[Thu Nov 13 04:23:00.839291 2025] [:error] [pid 51491:tid 51518] [client 68.183.180.73:46022] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3/api-docs"] [unique_id "aRTspNQaME15TQuGVKTlSQAAANY"]
[Thu Nov 13 04:23:01.101807 2025] [:error] [pid 51491:tid 51515] [client 68.183.180.73:46024] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api-docs/swagger.json"] [unique_id "aRTspdQaME15TQuGVKTlSwAAANM"]
[Thu Nov 13 04:23:01.361783 2025] [:error] [pid 51491:tid 51519] [client 68.183.180.73:46030] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api/swagger.json"] [unique_id "aRTspdQaME15TQuGVKTlTQAAANc"]
[Thu Nov 13 04:23:01.625613 2025] [:error] [pid 51491:tid 51505] [client 68.183.180.73:46032] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/@vite/env"] [unique_id "aRTspdQaME15TQuGVKTlTwAAAMk"]
[Thu Nov 13 04:23:01.902807 2025] [:error] [pid 51491:tid 51499] [client 68.183.180.73:46040] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/actuator/env"] [unique_id "aRTspdQaME15TQuGVKTlUAAAAMM"]
[Thu Nov 13 04:23:02.165397 2025] [:error] [pid 51491:tid 51513] [client 68.183.180.73:46044] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aRTsptQaME15TQuGVKTlUQAAANE"]
[Thu Nov 13 04:23:02.425273 2025] [:error] [pid 51491:tid 51508] [client 68.183.180.73:46056] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server"] [unique_id "aRTsptQaME15TQuGVKTlUgAAAMw"]
[Thu Nov 13 04:23:02.685321 2025] [:error] [pid 51491:tid 51520] [client 68.183.180.73:46072] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aRTsptQaME15TQuGVKTlUwAAANg"]
[Thu Nov 13 04:23:02.945014 2025] [:error] [pid 51491:tid 51517] [client 68.183.180.73:46080] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about"] [unique_id "aRTsptQaME15TQuGVKTlVQAAANU"]
[Thu Nov 13 04:23:03.224983 2025] [:error] [pid 51491:tid 51497] [client 68.183.180.73:46096] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/debug/default/view"] [unique_id "aRTsp9QaME15TQuGVKTlVwAAAME"]
[Thu Nov 13 04:23:03.493318 2025] [:error] [pid 51407:tid 51482] [client 68.183.180.73:46108] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2/_catalog"] [unique_id "aRTsp6KnD465ID-ycMKB9AAAAJE"]
[Thu Nov 13 04:23:03.753804 2025] [:error] [pid 51491:tid 51506] [client 68.183.180.73:46124] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aRTsp9QaME15TQuGVKTlWAAAAMo"]
[Thu Nov 13 04:23:04.013754 2025] [:error] [pid 51406:tid 51460] [client 68.183.180.73:46138] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server-status"] [unique_id "aRTsqHJ88_IXhWnPqG9XsgAAAFY"]
[Thu Nov 13 04:23:04.274222 2025] [:error] [pid 51405:tid 51414] [client 68.183.180.73:46148] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login.action"] [unique_id "aRTsqMgQcOoeDKJ17JeLdAAAAAM"]
[Thu Nov 13 04:23:04.563804 2025] [:error] [pid 51406:tid 51442] [client 68.183.180.73:46158] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/_all_dbs"] [unique_id "aRTsqHJ88_IXhWnPqG9XtAAAAEQ"]
[Thu Nov 13 04:23:04.823624 2025] [:error] [pid 51405:tid 51426] [client 68.183.180.73:46162] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.DS_Store"] [unique_id "aRTsqMgQcOoeDKJ17JeLdwAAAA8"]
[Thu Nov 13 04:23:05.083412 2025] [:error] [pid 51406:tid 51444] [client 68.183.180.73:46164] [client 68.183.180.73] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aRTsqXJ88_IXhWnPqG9XtgAAAEY"]
[Thu Nov 13 04:23:05.343233 2025] [:error] [pid 51405:tid 51422] [client 68.183.180.73:46172] [client 68.183.180.73] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aRTsqcgQcOoeDKJ17JeLeAAAAAs"]
[Thu Nov 13 04:23:05.603658 2025] [:error] [pid 51406:tid 51451] [client 68.183.180.73:46178] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aRTsqXJ88_IXhWnPqG9XtwAAAE0"]
[Thu Nov 13 04:23:05.875577 2025] [:error] [pid 51405:tid 51435] [client 68.183.180.73:46190] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aRTsqcgQcOoeDKJ17JeLeQAAABg"]
[Thu Nov 13 04:23:06.147169 2025] [:error] [pid 51407:tid 51483] [client 68.183.180.73:46204] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/telescope/requests"] [unique_id "aRTsqqKnD465ID-ycMKB-QAAAJI"]
[Thu Nov 13 04:23:06.414293 2025] [:error] [pid 51405:tid 51416] [client 68.183.180.73:46206] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aRTsqsgQcOoeDKJ17JeLewAAAAU"]
[Thu Nov 13 04:23:06.677464 2025] [:error] [pid 51405:tid 51424] [client 68.183.180.73:46220] [client 68.183.180.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRTsqsgQcOoeDKJ17JeLfQAAAA0"]
[Thu Nov 13 04:24:47.713697 2025] [:error] [pid 51491:tid 51496] [client 74.63.210.136:52344] [client 74.63.210.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.63.210.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRTtD9QaME15TQuGVKTmgAAAAMA"]
[Thu Nov 13 04:24:52.288974 2025] [:error] [pid 51491:tid 51500] [client 74.63.210.136:52344] [client 74.63.210.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.63.210.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRTtFNQaME15TQuGVKTmkgAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Nov 13 04:30:20.122544 2025] [:error] [pid 51491:tid 51504] [client 208.97.137.134:39280] [client 208.97.137.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.97.137.134, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRTuXNQaME15TQuGVKTpxAAAAMg"]
[Thu Nov 13 04:55:38.730830 2025] [:error] [pid 51491:tid 51508] [client 51.210.194.145:44058] [client 51.210.194.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.194.145, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRT0StQaME15TQuGVKT4vAAAAMw"]
[Thu Nov 13 05:10:44.548199 2025] [:error] [pid 18960:tid 18981] [client 74.7.227.96:51222] [client 74.7.227.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.7.227.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRT31IvOP-uT_KFAcQN1IwAAARM"]
[Thu Nov 13 05:16:57.807301 2025] [:error] [pid 51405:tid 51431] [client 195.178.110.242:49534] [client 195.178.110.242] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aRT5ScgQcOoeDKJ17JejPwAAABQ"]
[Thu Nov 13 05:16:57.810395 2025] [:error] [pid 30162:tid 30173] [client 195.178.110.242:49536] [client 195.178.110.242] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aRT5SZYPAuLETx2485WSuwAAAUk"]
[Thu Nov 13 06:04:40.832514 2025] [:error] [pid 22566:tid 22574] [client 4.255.247.224:58756] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEeDfdqWaUbu3e06-XTwAAAQY"]
[Thu Nov 13 06:04:41.509789 2025] [:error] [pid 22566:tid 22580] [client 4.255.247.224:58756] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.255.247.224, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRUEeTfdqWaUbu3e06-XVgAAAQw"]
[Thu Nov 13 06:04:43.795990 2025] [:error] [pid 22566:tid 22583] [client 4.255.247.224:58756] [client 4.255.247.224] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aRUEezfdqWaUbu3e06-XWgAAAQ8"]
[Thu Nov 13 06:04:43.968566 2025] [:error] [pid 22566:tid 22573] [client 4.255.247.224:58756] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEezfdqWaUbu3e06-XWwAAAQU"]
[Thu Nov 13 06:04:43.971117 2025] [:error] [pid 22566:tid 22573] [client 4.255.247.224:58756] [client 4.255.247.224] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEezfdqWaUbu3e06-XWwAAAQU"]
[Thu Nov 13 06:04:43.973100 2025] [:error] [pid 22566:tid 22573] [client 4.255.247.224:58756] [client 4.255.247.224] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEezfdqWaUbu3e06-XWwAAAQU"]
[Thu Nov 13 06:04:45.248752 2025] [:error] [pid 22223:tid 22264] [client 4.255.247.224:59200] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEfd6it_tNBGH9EAEeYAAAAEs"]
[Thu Nov 13 06:04:45.250270 2025] [:error] [pid 22223:tid 22264] [client 4.255.247.224:59200] [client 4.255.247.224] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEfd6it_tNBGH9EAEeYAAAAEs"]
[Thu Nov 13 06:04:45.251563 2025] [:error] [pid 22223:tid 22264] [client 4.255.247.224:59200] [client 4.255.247.224] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEfd6it_tNBGH9EAEeYAAAAEs"]
[Thu Nov 13 06:04:46.499467 2025] [:error] [pid 22222:tid 22247] [client 4.255.247.224:59287] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEfjL-5qXvQuZkA4GqZgAAABU"]
[Thu Nov 13 06:04:47.849677 2025] [:error] [pid 22307:tid 22316] [client 4.255.247.224:59384] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEf6r7fLMQQanZ_9yChwAAAMc"]
[Thu Nov 13 06:04:49.093745 2025] [:error] [pid 22566:tid 22582] [client 4.255.247.224:59468] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEgTfdqWaUbu3e06-XZgAAAQ4"]
[Thu Nov 13 06:04:49.093892 2025] [:error] [pid 22566:tid 22582] [client 4.255.247.224:59468] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEgTfdqWaUbu3e06-XZgAAAQ4"]
[Thu Nov 13 06:04:49.781718 2025] [:error] [pid 22224:tid 22303] [client 4.255.247.224:59515] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEgbuEVuTj3a_UBfAKOwAAAJc"]
[Thu Nov 13 06:04:49.781874 2025] [:error] [pid 22224:tid 22303] [client 4.255.247.224:59515] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEgbuEVuTj3a_UBfAKOwAAAJc"]
[Thu Nov 13 06:04:50.469119 2025] [:error] [pid 22566:tid 22578] [client 4.255.247.224:59558] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEgjfdqWaUbu3e06-XbQAAAQo"]
[Thu Nov 13 06:04:50.469283 2025] [:error] [pid 22566:tid 22578] [client 4.255.247.224:59558] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 8"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEgjfdqWaUbu3e06-XbQAAAQo"]
[Thu Nov 13 06:04:51.157688 2025] [:error] [pid 22307:tid 22322] [client 4.255.247.224:59588] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEg6r7fLMQQanZ_9yCjwAAAM0"]
[Thu Nov 13 06:04:51.157832 2025] [:error] [pid 22307:tid 22322] [client 4.255.247.224:59588] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 9"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEg6r7fLMQQanZ_9yCjwAAAM0"]
[Thu Nov 13 06:04:51.846449 2025] [:error] [pid 22566:tid 22587] [client 4.255.247.224:59633] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEgzfdqWaUbu3e06-XcgAAARM"]
[Thu Nov 13 06:04:51.846719 2025] [:error] [pid 22566:tid 22587] [client 4.255.247.224:59633] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 10"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEgzfdqWaUbu3e06-XcgAAARM"]
[Thu Nov 13 06:04:52.536731 2025] [:error] [pid 22566:tid 22589] [client 4.255.247.224:59678] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEhDfdqWaUbu3e06-XdAAAARU"]
[Thu Nov 13 06:04:52.536843 2025] [:error] [pid 22566:tid 22589] [client 4.255.247.224:59678] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 11"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEhDfdqWaUbu3e06-XdAAAARU"]
[Thu Nov 13 06:04:53.222647 2025] [:error] [pid 22307:tid 22333] [client 4.255.247.224:59721] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEhar7fLMQQanZ_9yCkQAAANg"]
[Thu Nov 13 06:04:53.222784 2025] [:error] [pid 22307:tid 22333] [client 4.255.247.224:59721] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 12"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEhar7fLMQQanZ_9yCkQAAANg"]
[Thu Nov 13 06:04:53.909287 2025] [:error] [pid 22222:tid 22249] [client 4.255.247.224:59764] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEhTL-5qXvQuZkA4GqdwAAABc"]
[Thu Nov 13 06:04:53.909406 2025] [:error] [pid 22222:tid 22249] [client 4.255.247.224:59764] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 13"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEhTL-5qXvQuZkA4GqdwAAABc"]
[Thu Nov 13 06:04:54.597820 2025] [:error] [pid 22224:tid 22294] [client 4.255.247.224:59813] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEhruEVuTj3a_UBfAKXwAAAI4"]
[Thu Nov 13 06:04:54.597963 2025] [:error] [pid 22224:tid 22294] [client 4.255.247.224:59813] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 14"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEhruEVuTj3a_UBfAKXwAAAI4"]
[Thu Nov 13 06:04:55.285005 2025] [:error] [pid 22223:tid 22258] [client 4.255.247.224:59855] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEh96it_tNBGH9EAEecQAAAEU"]
[Thu Nov 13 06:04:55.285114 2025] [:error] [pid 22223:tid 22258] [client 4.255.247.224:59855] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 15"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEh96it_tNBGH9EAEecQAAAEU"]
[Thu Nov 13 06:04:55.971817 2025] [:error] [pid 22566:tid 22581] [client 4.255.247.224:59903] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEhzfdqWaUbu3e06-XeAAAAQ0"]
[Thu Nov 13 06:04:55.971990 2025] [:error] [pid 22566:tid 22581] [client 4.255.247.224:59903] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 16"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEhzfdqWaUbu3e06-XeAAAAQ0"]
[Thu Nov 13 06:04:56.658150 2025] [:error] [pid 22222:tid 22237] [client 4.255.247.224:59948] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEiDL-5qXvQuZkA4GqgwAAAAs"]
[Thu Nov 13 06:04:56.658350 2025] [:error] [pid 22222:tid 22237] [client 4.255.247.224:59948] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 17"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEiDL-5qXvQuZkA4GqgwAAAAs"]
[Thu Nov 13 06:04:57.346094 2025] [:error] [pid 22566:tid 22568] [client 4.255.247.224:59993] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEiTfdqWaUbu3e06-XfQAAAQA"]
[Thu Nov 13 06:04:57.346310 2025] [:error] [pid 22566:tid 22568] [client 4.255.247.224:59993] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 18"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEiTfdqWaUbu3e06-XfQAAAQA"]
[Thu Nov 13 06:04:58.035407 2025] [:error] [pid 22223:tid 22257] [client 4.255.247.224:60031] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEit6it_tNBGH9EAEedAAAAEQ"]
[Thu Nov 13 06:04:58.035569 2025] [:error] [pid 22223:tid 22257] [client 4.255.247.224:60031] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 19"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEit6it_tNBGH9EAEedAAAAEQ"]
[Thu Nov 13 06:04:58.721423 2025] [:error] [pid 22307:tid 22324] [client 4.255.247.224:60076] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEiqr7fLMQQanZ_9yClQAAAM8"]
[Thu Nov 13 06:04:58.721598 2025] [:error] [pid 22307:tid 22324] [client 4.255.247.224:60076] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 20"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEiqr7fLMQQanZ_9yClQAAAM8"]
[Thu Nov 13 06:04:59.410466 2025] [:error] [pid 22223:tid 22272] [client 4.255.247.224:60120] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEi96it_tNBGH9EAEedQAAAFM"]
[Thu Nov 13 06:04:59.410640 2025] [:error] [pid 22223:tid 22272] [client 4.255.247.224:60120] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 21"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEi96it_tNBGH9EAEedQAAAFM"]
[Thu Nov 13 06:05:00.096555 2025] [:error] [pid 22222:tid 22248] [client 4.255.247.224:60159] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEjDL-5qXvQuZkA4GqjAAAABY"]
[Thu Nov 13 06:05:00.096715 2025] [:error] [pid 22222:tid 22248] [client 4.255.247.224:60159] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 22"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEjDL-5qXvQuZkA4GqjAAAABY"]
[Thu Nov 13 06:05:00.783981 2025] [:error] [pid 22307:tid 22326] [client 4.255.247.224:60201] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEjKr7fLMQQanZ_9yCmAAAANE"]
[Thu Nov 13 06:05:00.784156 2025] [:error] [pid 22307:tid 22326] [client 4.255.247.224:60201] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 23"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEjKr7fLMQQanZ_9yCmAAAANE"]
[Thu Nov 13 06:05:01.474682 2025] [:error] [pid 22307:tid 22310] [client 4.255.247.224:60239] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEjar7fLMQQanZ_9yCmQAAAME"]
[Thu Nov 13 06:05:01.474817 2025] [:error] [pid 22307:tid 22310] [client 4.255.247.224:60239] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 24"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEjar7fLMQQanZ_9yCmQAAAME"]
[Thu Nov 13 06:05:02.163420 2025] [:error] [pid 22566:tid 22586] [client 4.255.247.224:60283] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEjjfdqWaUbu3e06-XjwAAARI"]
[Thu Nov 13 06:05:02.163565 2025] [:error] [pid 22566:tid 22586] [client 4.255.247.224:60283] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 25"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEjjfdqWaUbu3e06-XjwAAARI"]
[Thu Nov 13 06:05:02.850488 2025] [:error] [pid 22307:tid 22324] [client 4.255.247.224:60324] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEjqr7fLMQQanZ_9yCqgAAAM8"]
[Thu Nov 13 06:05:02.850615 2025] [:error] [pid 22307:tid 22324] [client 4.255.247.224:60324] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 26"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEjqr7fLMQQanZ_9yCqgAAAM8"]
[Thu Nov 13 06:05:03.542529 2025] [:error] [pid 22224:tid 22300] [client 4.255.247.224:60367] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEj7uEVuTj3a_UBfAKnAAAAJQ"]
[Thu Nov 13 06:05:03.542684 2025] [:error] [pid 22224:tid 22300] [client 4.255.247.224:60367] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 27"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEj7uEVuTj3a_UBfAKnAAAAJQ"]
[Thu Nov 13 06:05:04.228478 2025] [:error] [pid 22223:tid 22263] [client 4.255.247.224:60413] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEkN6it_tNBGH9EAEeeAAAAEo"]
[Thu Nov 13 06:05:04.228633 2025] [:error] [pid 22223:tid 22263] [client 4.255.247.224:60413] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 28"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEkN6it_tNBGH9EAEeeAAAAEo"]
[Thu Nov 13 06:05:04.939028 2025] [:error] [pid 22566:tid 22580] [client 4.255.247.224:60452] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEkDfdqWaUbu3e06-XlAAAAQw"]
[Thu Nov 13 06:05:04.939136 2025] [:error] [pid 22566:tid 22580] [client 4.255.247.224:60452] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 29"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEkDfdqWaUbu3e06-XlAAAAQw"]
[Thu Nov 13 06:05:05.627093 2025] [:error] [pid 22223:tid 22267] [client 4.255.247.224:60488] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEkd6it_tNBGH9EAEefAAAAE4"]
[Thu Nov 13 06:05:05.627278 2025] [:error] [pid 22223:tid 22267] [client 4.255.247.224:60488] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 30"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEkd6it_tNBGH9EAEefAAAAE4"]
[Thu Nov 13 06:05:06.317934 2025] [:error] [pid 22223:tid 22271] [client 4.255.247.224:60535] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEkt6it_tNBGH9EAEefQAAAFI"]
[Thu Nov 13 06:05:06.318150 2025] [:error] [pid 22223:tid 22271] [client 4.255.247.224:60535] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 31"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEkt6it_tNBGH9EAEefQAAAFI"]
[Thu Nov 13 06:05:07.005600 2025] [:error] [pid 22307:tid 22322] [client 4.255.247.224:60576] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEk6r7fLMQQanZ_9yCuAAAAM0"]
[Thu Nov 13 06:05:07.005750 2025] [:error] [pid 22307:tid 22322] [client 4.255.247.224:60576] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 32"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEk6r7fLMQQanZ_9yCuAAAAM0"]
[Thu Nov 13 06:05:07.696442 2025] [:error] [pid 22566:tid 22572] [client 4.255.247.224:60617] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEkzfdqWaUbu3e06-XsAAAAQQ"]
[Thu Nov 13 06:05:07.696601 2025] [:error] [pid 22566:tid 22572] [client 4.255.247.224:60617] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 33"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEkzfdqWaUbu3e06-XsAAAAQQ"]
[Thu Nov 13 06:05:08.382841 2025] [:error] [pid 22307:tid 22330] [client 4.255.247.224:60661] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUElKr7fLMQQanZ_9yCuQAAANU"]
[Thu Nov 13 06:05:08.382961 2025] [:error] [pid 22307:tid 22330] [client 4.255.247.224:60661] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 34"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUElKr7fLMQQanZ_9yCuQAAANU"]
[Thu Nov 13 06:05:09.074252 2025] [:error] [pid 22223:tid 22276] [client 4.255.247.224:60709] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEld6it_tNBGH9EAEelAAAAFc"]
[Thu Nov 13 06:05:09.074390 2025] [:error] [pid 22223:tid 22276] [client 4.255.247.224:60709] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 35"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEld6it_tNBGH9EAEelAAAAFc"]
[Thu Nov 13 06:05:09.761265 2025] [:error] [pid 22307:tid 22329] [client 4.255.247.224:60753] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUElar7fLMQQanZ_9yCvAAAANQ"]
[Thu Nov 13 06:05:09.761414 2025] [:error] [pid 22307:tid 22329] [client 4.255.247.224:60753] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 36"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUElar7fLMQQanZ_9yCvAAAANQ"]
[Thu Nov 13 06:05:10.456803 2025] [:error] [pid 22223:tid 22253] [client 4.255.247.224:60802] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUElt6it_tNBGH9EAEelwAAAEA"]
[Thu Nov 13 06:05:10.456947 2025] [:error] [pid 22223:tid 22253] [client 4.255.247.224:60802] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 37"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUElt6it_tNBGH9EAEelwAAAEA"]
[Thu Nov 13 06:05:11.146377 2025] [:error] [pid 22224:tid 22302] [client 4.255.247.224:60843] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEl7uEVuTj3a_UBfAKswAAAJY"]
[Thu Nov 13 06:05:11.146505 2025] [:error] [pid 22224:tid 22302] [client 4.255.247.224:60843] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 38"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEl7uEVuTj3a_UBfAKswAAAJY"]
[Thu Nov 13 06:05:11.840684 2025] [:error] [pid 22224:tid 22298] [client 4.255.247.224:60888] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEl7uEVuTj3a_UBfAKtgAAAJI"]
[Thu Nov 13 06:05:11.840821 2025] [:error] [pid 22224:tid 22298] [client 4.255.247.224:60888] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 39"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEl7uEVuTj3a_UBfAKtgAAAJI"]
[Thu Nov 13 06:05:12.527538 2025] [:error] [pid 22222:tid 22245] [client 4.255.247.224:60932] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEmDL-5qXvQuZkA4GqoQAAABM"]
[Thu Nov 13 06:05:12.527700 2025] [:error] [pid 22222:tid 22245] [client 4.255.247.224:60932] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 40"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEmDL-5qXvQuZkA4GqoQAAABM"]
[Thu Nov 13 06:05:13.213419 2025] [:error] [pid 22224:tid 22291] [client 4.255.247.224:60975] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEmbuEVuTj3a_UBfAKuQAAAIs"]
[Thu Nov 13 06:05:13.213600 2025] [:error] [pid 22224:tid 22291] [client 4.255.247.224:60975] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 41"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEmbuEVuTj3a_UBfAKuQAAAIs"]
[Thu Nov 13 06:05:13.900770 2025] [:error] [pid 22566:tid 22586] [client 4.255.247.224:61011] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEmTfdqWaUbu3e06-X4gAAARI"]
[Thu Nov 13 06:05:13.900932 2025] [:error] [pid 22566:tid 22586] [client 4.255.247.224:61011] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 42"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEmTfdqWaUbu3e06-X4gAAARI"]
[Thu Nov 13 06:05:14.586411 2025] [:error] [pid 22222:tid 22249] [client 4.255.247.224:61055] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEmjL-5qXvQuZkA4GqqQAAABc"]
[Thu Nov 13 06:05:14.586598 2025] [:error] [pid 22222:tid 22249] [client 4.255.247.224:61055] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 43"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEmjL-5qXvQuZkA4GqqQAAABc"]
[Thu Nov 13 06:05:15.273898 2025] [:error] [pid 22224:tid 22303] [client 4.255.247.224:61100] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEm7uEVuTj3a_UBfAKxQAAAJc"]
[Thu Nov 13 06:05:15.274016 2025] [:error] [pid 22224:tid 22303] [client 4.255.247.224:61100] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 44"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEm7uEVuTj3a_UBfAKxQAAAJc"]
[Thu Nov 13 06:05:15.960727 2025] [:error] [pid 22222:tid 22250] [client 4.255.247.224:61148] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEmzL-5qXvQuZkA4GqqwAAABg"]
[Thu Nov 13 06:05:15.960885 2025] [:error] [pid 22222:tid 22250] [client 4.255.247.224:61148] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 45"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEmzL-5qXvQuZkA4GqqwAAABg"]
[Thu Nov 13 06:05:16.648676 2025] [:error] [pid 22566:tid 22581] [client 4.255.247.224:61199] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEnDfdqWaUbu3e06-X8gAAAQ0"]
[Thu Nov 13 06:05:16.648804 2025] [:error] [pid 22566:tid 22581] [client 4.255.247.224:61199] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 46"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEnDfdqWaUbu3e06-X8gAAAQ0"]
[Thu Nov 13 06:05:17.334918 2025] [:error] [pid 22566:tid 22580] [client 4.255.247.224:61245] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEnTfdqWaUbu3e06-X9gAAAQw"]
[Thu Nov 13 06:05:17.335077 2025] [:error] [pid 22566:tid 22580] [client 4.255.247.224:61245] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 47"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEnTfdqWaUbu3e06-X9gAAAQw"]
[Thu Nov 13 06:05:18.021972 2025] [:error] [pid 22223:tid 22254] [client 4.255.247.224:61293] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEnt6it_tNBGH9EAEerwAAAEE"]
[Thu Nov 13 06:05:18.022151 2025] [:error] [pid 22223:tid 22254] [client 4.255.247.224:61293] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 48"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEnt6it_tNBGH9EAEerwAAAEE"]
[Thu Nov 13 06:05:18.715089 2025] [:error] [pid 22224:tid 22282] [client 4.255.247.224:61336] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEnruEVuTj3a_UBfAKzQAAAII"]
[Thu Nov 13 06:05:18.715312 2025] [:error] [pid 22224:tid 22282] [client 4.255.247.224:61336] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 49"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEnruEVuTj3a_UBfAKzQAAAII"]
[Thu Nov 13 06:05:19.404001 2025] [:error] [pid 22566:tid 22576] [client 4.255.247.224:61380] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEnzfdqWaUbu3e06-YCwAAAQg"]
[Thu Nov 13 06:05:19.404203 2025] [:error] [pid 22566:tid 22576] [client 4.255.247.224:61380] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 50"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEnzfdqWaUbu3e06-YCwAAAQg"]
[Thu Nov 13 06:05:20.113604 2025] [:error] [pid 22223:tid 22270] [client 4.255.247.224:61425] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEoN6it_tNBGH9EAEetAAAAFE"]
[Thu Nov 13 06:05:20.113767 2025] [:error] [pid 22223:tid 22270] [client 4.255.247.224:61425] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 51"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEoN6it_tNBGH9EAEetAAAAFE"]
[Thu Nov 13 06:05:20.800314 2025] [:error] [pid 22222:tid 22242] [client 4.255.247.224:61471] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEoDL-5qXvQuZkA4GqtwAAABA"]
[Thu Nov 13 06:05:20.800470 2025] [:error] [pid 22222:tid 22242] [client 4.255.247.224:61471] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 52"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEoDL-5qXvQuZkA4GqtwAAABA"]
[Thu Nov 13 06:05:21.487418 2025] [:error] [pid 22223:tid 22266] [client 4.255.247.224:61520] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEod6it_tNBGH9EAEeuQAAAE0"]
[Thu Nov 13 06:05:21.487604 2025] [:error] [pid 22223:tid 22266] [client 4.255.247.224:61520] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 53"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEod6it_tNBGH9EAEeuQAAAE0"]
[Thu Nov 13 06:05:22.173617 2025] [:error] [pid 22566:tid 22575] [client 4.255.247.224:61558] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEojfdqWaUbu3e06-YGwAAAQc"]
[Thu Nov 13 06:05:22.173741 2025] [:error] [pid 22566:tid 22575] [client 4.255.247.224:61558] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 54"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEojfdqWaUbu3e06-YGwAAAQc"]
[Thu Nov 13 06:05:22.864489 2025] [:error] [pid 22307:tid 22314] [client 4.255.247.224:61600] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEoqr7fLMQQanZ_9yC4gAAAMU"]
[Thu Nov 13 06:05:22.864660 2025] [:error] [pid 22307:tid 22314] [client 4.255.247.224:61600] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 55"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEoqr7fLMQQanZ_9yC4gAAAMU"]
[Thu Nov 13 06:05:23.551058 2025] [:error] [pid 22307:tid 22315] [client 4.255.247.224:61639] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEo6r7fLMQQanZ_9yC5QAAAMY"]
[Thu Nov 13 06:05:23.551253 2025] [:error] [pid 22307:tid 22315] [client 4.255.247.224:61639] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 56"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEo6r7fLMQQanZ_9yC5QAAAMY"]
[Thu Nov 13 06:05:24.241031 2025] [:error] [pid 22222:tid 22249] [client 4.255.247.224:61680] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEpDL-5qXvQuZkA4GqugAAABc"]
[Thu Nov 13 06:05:24.241174 2025] [:error] [pid 22222:tid 22249] [client 4.255.247.224:61680] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 57"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEpDL-5qXvQuZkA4GqugAAABc"]
[Thu Nov 13 06:05:24.927853 2025] [:error] [pid 22224:tid 22302] [client 4.255.247.224:61716] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEpLuEVuTj3a_UBfAK2gAAAJY"]
[Thu Nov 13 06:05:24.927970 2025] [:error] [pid 22224:tid 22302] [client 4.255.247.224:61716] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 58"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEpLuEVuTj3a_UBfAK2gAAAJY"]
[Thu Nov 13 06:05:25.620273 2025] [:error] [pid 22224:tid 22300] [client 4.255.247.224:61767] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEpbuEVuTj3a_UBfAK2wAAAJQ"]
[Thu Nov 13 06:05:25.620413 2025] [:error] [pid 22224:tid 22300] [client 4.255.247.224:61767] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 59"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEpbuEVuTj3a_UBfAK2wAAAJQ"]
[Thu Nov 13 06:05:26.307622 2025] [:error] [pid 22223:tid 22265] [client 4.255.247.224:61814] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEpt6it_tNBGH9EAEeyQAAAEw"]
[Thu Nov 13 06:05:26.307757 2025] [:error] [pid 22223:tid 22265] [client 4.255.247.224:61814] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 60"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEpt6it_tNBGH9EAEeyQAAAEw"]
[Thu Nov 13 06:05:26.998402 2025] [:error] [pid 22566:tid 22585] [client 4.255.247.224:61855] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEpjfdqWaUbu3e06-YOgAAARE"]
[Thu Nov 13 06:05:26.998541 2025] [:error] [pid 22566:tid 22585] [client 4.255.247.224:61855] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 61"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEpjfdqWaUbu3e06-YOgAAARE"]
[Thu Nov 13 06:05:27.682860 2025] [:error] [pid 22307:tid 22312] [client 4.255.247.224:61907] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEp6r7fLMQQanZ_9yC7gAAAMM"]
[Thu Nov 13 06:05:27.682968 2025] [:error] [pid 22307:tid 22312] [client 4.255.247.224:61907] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 62"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEp6r7fLMQQanZ_9yC7gAAAMM"]
[Thu Nov 13 06:05:28.372415 2025] [:error] [pid 22566:tid 22570] [client 4.255.247.224:61955] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEqDfdqWaUbu3e06-YQwAAAQI"]
[Thu Nov 13 06:05:28.372649 2025] [:error] [pid 22566:tid 22570] [client 4.255.247.224:61955] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 63"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEqDfdqWaUbu3e06-YQwAAAQI"]
[Thu Nov 13 06:05:29.067896 2025] [:error] [pid 22566:tid 22576] [client 4.255.247.224:61994] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEqTfdqWaUbu3e06-YRAAAAQg"]
[Thu Nov 13 06:05:29.068036 2025] [:error] [pid 22566:tid 22576] [client 4.255.247.224:61994] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 64"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEqTfdqWaUbu3e06-YRAAAAQg"]
[Thu Nov 13 06:05:29.763688 2025] [:error] [pid 22224:tid 22300] [client 4.255.247.224:62053] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEqbuEVuTj3a_UBfAK6wAAAJQ"]
[Thu Nov 13 06:05:29.763866 2025] [:error] [pid 22224:tid 22300] [client 4.255.247.224:62053] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 65"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEqbuEVuTj3a_UBfAK6wAAAJQ"]
[Thu Nov 13 06:05:30.449418 2025] [:error] [pid 22307:tid 22322] [client 4.255.247.224:62097] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEqqr7fLMQQanZ_9yC-QAAAM0"]
[Thu Nov 13 06:05:30.449651 2025] [:error] [pid 22307:tid 22322] [client 4.255.247.224:62097] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 66"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEqqr7fLMQQanZ_9yC-QAAAM0"]
[Thu Nov 13 06:05:31.140513 2025] [:error] [pid 22566:tid 22588] [client 4.255.247.224:62143] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEqzfdqWaUbu3e06-YSAAAARQ"]
[Thu Nov 13 06:05:31.140715 2025] [:error] [pid 22566:tid 22588] [client 4.255.247.224:62143] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 67"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEqzfdqWaUbu3e06-YSAAAARQ"]
[Thu Nov 13 06:05:31.827707 2025] [:error] [pid 22566:tid 22581] [client 4.255.247.224:62184] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEqzfdqWaUbu3e06-YTgAAAQ0"]
[Thu Nov 13 06:05:31.827844 2025] [:error] [pid 22566:tid 22581] [client 4.255.247.224:62184] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 68"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEqzfdqWaUbu3e06-YTgAAAQ0"]
[Thu Nov 13 06:05:32.517991 2025] [:error] [pid 22566:tid 22589] [client 4.255.247.224:62238] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUErDfdqWaUbu3e06-YVwAAARU"]
[Thu Nov 13 06:05:32.518151 2025] [:error] [pid 22566:tid 22589] [client 4.255.247.224:62238] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 69"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUErDfdqWaUbu3e06-YVwAAARU"]
[Thu Nov 13 06:05:33.203745 2025] [:error] [pid 22223:tid 22266] [client 4.255.247.224:62289] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUErd6it_tNBGH9EAEe5AAAAE0"]
[Thu Nov 13 06:05:33.203933 2025] [:error] [pid 22223:tid 22266] [client 4.255.247.224:62289] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 70"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUErd6it_tNBGH9EAEe5AAAAE0"]
[Thu Nov 13 06:05:33.893798 2025] [:error] [pid 22222:tid 22234] [client 4.255.247.224:62353] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUErTL-5qXvQuZkA4Gq1gAAAAg"]
[Thu Nov 13 06:05:33.893973 2025] [:error] [pid 22222:tid 22234] [client 4.255.247.224:62353] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 71"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUErTL-5qXvQuZkA4Gq1gAAAAg"]
[Thu Nov 13 06:05:34.579229 2025] [:error] [pid 22307:tid 22310] [client 4.255.247.224:62414] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUErqr7fLMQQanZ_9yDBAAAAME"]
[Thu Nov 13 06:05:34.579374 2025] [:error] [pid 22307:tid 22310] [client 4.255.247.224:62414] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 72"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUErqr7fLMQQanZ_9yDBAAAAME"]
[Thu Nov 13 06:05:35.268624 2025] [:error] [pid 22224:tid 22303] [client 4.255.247.224:62452] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEr7uEVuTj3a_UBfALEwAAAJc"]
[Thu Nov 13 06:05:35.268754 2025] [:error] [pid 22224:tid 22303] [client 4.255.247.224:62452] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 73"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEr7uEVuTj3a_UBfALEwAAAJc"]
[Thu Nov 13 06:05:35.953847 2025] [:error] [pid 22566:tid 22575] [client 4.255.247.224:62495] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUErzfdqWaUbu3e06-YZwAAAQc"]
[Thu Nov 13 06:05:35.954017 2025] [:error] [pid 22566:tid 22575] [client 4.255.247.224:62495] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 74"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUErzfdqWaUbu3e06-YZwAAAQc"]
[Thu Nov 13 06:05:36.645218 2025] [:error] [pid 22222:tid 22237] [client 4.255.247.224:62550] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEsDL-5qXvQuZkA4Gq2QAAAAs"]
[Thu Nov 13 06:05:36.645366 2025] [:error] [pid 22222:tid 22237] [client 4.255.247.224:62550] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 75"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEsDL-5qXvQuZkA4Gq2QAAAAs"]
[Thu Nov 13 06:05:37.332762 2025] [:error] [pid 22222:tid 22241] [client 4.255.247.224:62604] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEsTL-5qXvQuZkA4Gq3gAAAA8"]
[Thu Nov 13 06:05:37.332886 2025] [:error] [pid 22222:tid 22241] [client 4.255.247.224:62604] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 76"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEsTL-5qXvQuZkA4Gq3gAAAA8"]
[Thu Nov 13 06:05:38.024576 2025] [:error] [pid 22566:tid 22568] [client 4.255.247.224:62650] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEsjfdqWaUbu3e06-YcQAAAQA"]
[Thu Nov 13 06:05:38.024720 2025] [:error] [pid 22566:tid 22568] [client 4.255.247.224:62650] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 77"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEsjfdqWaUbu3e06-YcQAAAQA"]
[Thu Nov 13 06:05:38.711687 2025] [:error] [pid 22223:tid 22262] [client 4.255.247.224:62710] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEst6it_tNBGH9EAEe9AAAAEk"]
[Thu Nov 13 06:05:38.711847 2025] [:error] [pid 22223:tid 22262] [client 4.255.247.224:62710] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 78"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEst6it_tNBGH9EAEe9AAAAEk"]
[Thu Nov 13 06:05:39.399368 2025] [:error] [pid 22223:tid 22255] [client 4.255.247.224:62760] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEs96it_tNBGH9EAEe9gAAAEI"]
[Thu Nov 13 06:05:39.399626 2025] [:error] [pid 22223:tid 22255] [client 4.255.247.224:62760] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 79"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEs96it_tNBGH9EAEe9gAAAEI"]
[Thu Nov 13 06:05:40.087201 2025] [:error] [pid 22223:tid 22264] [client 4.255.247.224:62817] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEtN6it_tNBGH9EAEe9wAAAEs"]
[Thu Nov 13 06:05:40.087374 2025] [:error] [pid 22223:tid 22264] [client 4.255.247.224:62817] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 80"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEtN6it_tNBGH9EAEe9wAAAEs"]
[Thu Nov 13 06:05:40.776942 2025] [:error] [pid 22566:tid 22568] [client 4.255.247.224:62868] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEtDfdqWaUbu3e06-YgQAAAQA"]
[Thu Nov 13 06:05:40.777096 2025] [:error] [pid 22566:tid 22568] [client 4.255.247.224:62868] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 81"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEtDfdqWaUbu3e06-YgQAAAQA"]
[Thu Nov 13 06:05:41.463896 2025] [:error] [pid 22566:tid 22578] [client 4.255.247.224:62910] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEtTfdqWaUbu3e06-YhAAAAQo"]
[Thu Nov 13 06:05:41.464058 2025] [:error] [pid 22566:tid 22578] [client 4.255.247.224:62910] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 82"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEtTfdqWaUbu3e06-YhAAAAQo"]
[Thu Nov 13 06:05:42.153068 2025] [:error] [pid 22566:tid 22574] [client 4.255.247.224:62938] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEtjfdqWaUbu3e06-YhgAAAQY"]
[Thu Nov 13 06:05:42.153230 2025] [:error] [pid 22566:tid 22574] [client 4.255.247.224:62938] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 83"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEtjfdqWaUbu3e06-YhgAAAQY"]
[Thu Nov 13 06:05:42.839650 2025] [:error] [pid 22223:tid 22272] [client 4.255.247.224:62991] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEtt6it_tNBGH9EAEfAgAAAFM"]
[Thu Nov 13 06:05:42.839803 2025] [:error] [pid 22223:tid 22272] [client 4.255.247.224:62991] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 84"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEtt6it_tNBGH9EAEfAgAAAFM"]
[Thu Nov 13 06:05:43.527425 2025] [:error] [pid 22566:tid 22586] [client 4.255.247.224:63042] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEtzfdqWaUbu3e06-YjQAAARI"]
[Thu Nov 13 06:05:43.527559 2025] [:error] [pid 22566:tid 22586] [client 4.255.247.224:63042] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 85"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEtzfdqWaUbu3e06-YjQAAARI"]
[Thu Nov 13 06:05:44.214223 2025] [:error] [pid 22223:tid 22267] [client 4.255.247.224:63086] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEuN6it_tNBGH9EAEfCAAAAE4"]
[Thu Nov 13 06:05:44.214374 2025] [:error] [pid 22223:tid 22267] [client 4.255.247.224:63086] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 86"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEuN6it_tNBGH9EAEfCAAAAE4"]
[Thu Nov 13 06:05:44.900303 2025] [:error] [pid 22307:tid 22313] [client 4.255.247.224:63143] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEuKr7fLMQQanZ_9yDKwAAAMQ"]
[Thu Nov 13 06:05:44.900439 2025] [:error] [pid 22307:tid 22313] [client 4.255.247.224:63143] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 87"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEuKr7fLMQQanZ_9yDKwAAAMQ"]
[Thu Nov 13 06:05:45.586142 2025] [:error] [pid 22566:tid 22584] [client 4.255.247.224:63202] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEuTfdqWaUbu3e06-YkwAAARA"]
[Thu Nov 13 06:05:45.586258 2025] [:error] [pid 22566:tid 22584] [client 4.255.247.224:63202] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 88"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEuTfdqWaUbu3e06-YkwAAARA"]
[Thu Nov 13 06:05:46.276870 2025] [:error] [pid 22222:tid 22230] [client 4.255.247.224:63253] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEujL-5qXvQuZkA4Gq-AAAAAQ"]
[Thu Nov 13 06:05:46.277077 2025] [:error] [pid 22222:tid 22230] [client 4.255.247.224:63253] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 89"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEujL-5qXvQuZkA4Gq-AAAAAQ"]
[Thu Nov 13 06:05:46.964474 2025] [:error] [pid 22566:tid 22591] [client 4.255.247.224:63308] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEujfdqWaUbu3e06-YnAAAARc"]
[Thu Nov 13 06:05:46.964693 2025] [:error] [pid 22566:tid 22591] [client 4.255.247.224:63308] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 90"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEujfdqWaUbu3e06-YnAAAARc"]
[Thu Nov 13 06:05:47.650195 2025] [:error] [pid 22223:tid 22267] [client 4.255.247.224:63360] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEu96it_tNBGH9EAEfGAAAAE4"]
[Thu Nov 13 06:05:47.650353 2025] [:error] [pid 22223:tid 22267] [client 4.255.247.224:63360] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 91"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEu96it_tNBGH9EAEfGAAAAE4"]
[Thu Nov 13 06:05:48.338697 2025] [:error] [pid 22223:tid 22259] [client 4.255.247.224:63406] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEvN6it_tNBGH9EAEfGgAAAEY"]
[Thu Nov 13 06:05:48.338855 2025] [:error] [pid 22223:tid 22259] [client 4.255.247.224:63406] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 92"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEvN6it_tNBGH9EAEfGgAAAEY"]
[Thu Nov 13 06:05:49.023860 2025] [:error] [pid 22223:tid 22256] [client 4.255.247.224:63455] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEvd6it_tNBGH9EAEfHgAAAEM"]
[Thu Nov 13 06:05:49.024023 2025] [:error] [pid 22223:tid 22256] [client 4.255.247.224:63455] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 93"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEvd6it_tNBGH9EAEfHgAAAEM"]
[Thu Nov 13 06:05:49.716403 2025] [:error] [pid 22566:tid 22583] [client 4.255.247.224:63507] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEvTfdqWaUbu3e06-YqAAAAQ8"]
[Thu Nov 13 06:05:49.716521 2025] [:error] [pid 22566:tid 22583] [client 4.255.247.224:63507] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 94"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEvTfdqWaUbu3e06-YqAAAAQ8"]
[Thu Nov 13 06:05:50.409667 2025] [:error] [pid 22307:tid 22333] [client 4.255.247.224:63558] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEvqr7fLMQQanZ_9yDLgAAANg"]
[Thu Nov 13 06:05:50.409804 2025] [:error] [pid 22307:tid 22333] [client 4.255.247.224:63558] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 95"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEvqr7fLMQQanZ_9yDLgAAANg"]
[Thu Nov 13 06:05:51.099635 2025] [:error] [pid 22222:tid 22247] [client 4.255.247.224:63606] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEvzL-5qXvQuZkA4GrBwAAABU"]
[Thu Nov 13 06:05:51.099794 2025] [:error] [pid 22222:tid 22247] [client 4.255.247.224:63606] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 96"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEvzL-5qXvQuZkA4GrBwAAABU"]
[Thu Nov 13 06:05:51.786545 2025] [:error] [pid 22223:tid 22259] [client 4.255.247.224:63661] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEv96it_tNBGH9EAEfKQAAAEY"]
[Thu Nov 13 06:05:51.786691 2025] [:error] [pid 22223:tid 22259] [client 4.255.247.224:63661] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 97"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEv96it_tNBGH9EAEfKQAAAEY"]
[Thu Nov 13 06:05:52.477319 2025] [:error] [pid 22566:tid 22590] [client 4.255.247.224:63705] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEwDfdqWaUbu3e06-YsQAAARY"]
[Thu Nov 13 06:05:52.477485 2025] [:error] [pid 22566:tid 22590] [client 4.255.247.224:63705] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 98"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEwDfdqWaUbu3e06-YsQAAARY"]
[Thu Nov 13 06:05:53.174618 2025] [:error] [pid 22223:tid 22263] [client 4.255.247.224:63745] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEwd6it_tNBGH9EAEfKgAAAEo"]
[Thu Nov 13 06:05:53.174759 2025] [:error] [pid 22223:tid 22263] [client 4.255.247.224:63745] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 99"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEwd6it_tNBGH9EAEfKgAAAEo"]
[Thu Nov 13 06:05:53.865211 2025] [:error] [pid 22223:tid 22256] [client 4.255.247.224:63792] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEwd6it_tNBGH9EAEfKwAAAEM"]
[Thu Nov 13 06:05:53.865408 2025] [:error] [pid 22223:tid 22256] [client 4.255.247.224:63792] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 100"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEwd6it_tNBGH9EAEfKwAAAEM"]
[Thu Nov 13 06:05:54.555314 2025] [:error] [pid 22566:tid 22582] [client 4.255.247.224:63828] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEwjfdqWaUbu3e06-YuQAAAQ4"]
[Thu Nov 13 06:05:54.555452 2025] [:error] [pid 22566:tid 22582] [client 4.255.247.224:63828] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 101"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEwjfdqWaUbu3e06-YuQAAAQ4"]
[Thu Nov 13 06:05:55.240982 2025] [:error] [pid 22307:tid 22324] [client 4.255.247.224:63882] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEw6r7fLMQQanZ_9yDPAAAAM8"]
[Thu Nov 13 06:05:55.241137 2025] [:error] [pid 22307:tid 22324] [client 4.255.247.224:63882] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 102"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEw6r7fLMQQanZ_9yDPAAAAM8"]
[Thu Nov 13 06:05:55.926840 2025] [:error] [pid 22307:tid 22327] [client 4.255.247.224:63932] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEw6r7fLMQQanZ_9yDQgAAANI"]
[Thu Nov 13 06:05:55.927023 2025] [:error] [pid 22307:tid 22327] [client 4.255.247.224:63932] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 103"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEw6r7fLMQQanZ_9yDQgAAANI"]
[Thu Nov 13 06:05:56.618087 2025] [:error] [pid 22223:tid 22276] [client 4.255.247.224:63969] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUExN6it_tNBGH9EAEfNgAAAFc"]
[Thu Nov 13 06:05:56.618235 2025] [:error] [pid 22223:tid 22276] [client 4.255.247.224:63969] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 104"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUExN6it_tNBGH9EAEfNgAAAFc"]
[Thu Nov 13 06:05:57.305056 2025] [:error] [pid 22566:tid 22583] [client 4.255.247.224:64018] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUExTfdqWaUbu3e06-YygAAAQ8"]
[Thu Nov 13 06:05:57.305182 2025] [:error] [pid 22566:tid 22583] [client 4.255.247.224:64018] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 105"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUExTfdqWaUbu3e06-YygAAAQ8"]
[Thu Nov 13 06:05:57.993727 2025] [:error] [pid 22566:tid 22577] [client 4.255.247.224:64073] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUExTfdqWaUbu3e06-YzwAAAQk"]
[Thu Nov 13 06:05:57.993879 2025] [:error] [pid 22566:tid 22577] [client 4.255.247.224:64073] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 106"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUExTfdqWaUbu3e06-YzwAAAQk"]
[Thu Nov 13 06:05:58.681764 2025] [:error] [pid 22223:tid 22268] [client 4.255.247.224:64129] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUExt6it_tNBGH9EAEfQgAAAE8"]
[Thu Nov 13 06:05:58.681946 2025] [:error] [pid 22223:tid 22268] [client 4.255.247.224:64129] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 107"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUExt6it_tNBGH9EAEfQgAAAE8"]
[Thu Nov 13 06:05:59.375925 2025] [:error] [pid 22223:tid 22277] [client 4.255.247.224:64175] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEx96it_tNBGH9EAEfSgAAAFg"]
[Thu Nov 13 06:05:59.376129 2025] [:error] [pid 22223:tid 22277] [client 4.255.247.224:64175] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 108"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEx96it_tNBGH9EAEfSgAAAFg"]
[Thu Nov 13 06:06:00.062287 2025] [:error] [pid 22566:tid 22574] [client 4.255.247.224:64229] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEyDfdqWaUbu3e06-Y0wAAAQY"]
[Thu Nov 13 06:06:00.062427 2025] [:error] [pid 22566:tid 22574] [client 4.255.247.224:64229] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 109"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEyDfdqWaUbu3e06-Y0wAAAQY"]
[Thu Nov 13 06:06:00.756538 2025] [:error] [pid 22223:tid 22265] [client 4.255.247.224:64270] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEyN6it_tNBGH9EAEfTwAAAEw"]
[Thu Nov 13 06:06:00.756856 2025] [:error] [pid 22223:tid 22265] [client 4.255.247.224:64270] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 110"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEyN6it_tNBGH9EAEfTwAAAEw"]
[Thu Nov 13 06:06:01.443595 2025] [:error] [pid 22307:tid 22333] [client 4.255.247.224:64316] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEyar7fLMQQanZ_9yDXwAAANg"]
[Thu Nov 13 06:06:01.443771 2025] [:error] [pid 22307:tid 22333] [client 4.255.247.224:64316] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 111"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEyar7fLMQQanZ_9yDXwAAANg"]
[Thu Nov 13 06:06:02.133480 2025] [:error] [pid 22222:tid 22235] [client 4.255.247.224:64361] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEyjL-5qXvQuZkA4GrHQAAAAk"]
[Thu Nov 13 06:06:02.133719 2025] [:error] [pid 22222:tid 22235] [client 4.255.247.224:64361] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 112"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEyjL-5qXvQuZkA4GrHQAAAAk"]
[Thu Nov 13 06:06:02.818815 2025] [:error] [pid 22566:tid 22571] [client 4.255.247.224:64421] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEyjfdqWaUbu3e06-Y4gAAAQM"]
[Thu Nov 13 06:06:02.819004 2025] [:error] [pid 22566:tid 22571] [client 4.255.247.224:64421] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 113"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEyjfdqWaUbu3e06-Y4gAAAQM"]
[Thu Nov 13 06:06:03.511875 2025] [:error] [pid 22222:tid 22243] [client 4.255.247.224:64469] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEyzL-5qXvQuZkA4GrIQAAABE"]
[Thu Nov 13 06:06:03.512085 2025] [:error] [pid 22222:tid 22243] [client 4.255.247.224:64469] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 114"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEyzL-5qXvQuZkA4GrIQAAABE"]
[Thu Nov 13 06:06:04.199358 2025] [:error] [pid 22222:tid 22226] [client 4.255.247.224:64508] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEzDL-5qXvQuZkA4GrJgAAAAA"]
[Thu Nov 13 06:06:04.199540 2025] [:error] [pid 22222:tid 22226] [client 4.255.247.224:64508] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 115"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEzDL-5qXvQuZkA4GrJgAAAAA"]
[Thu Nov 13 06:06:04.886776 2025] [:error] [pid 22223:tid 22254] [client 4.255.247.224:64550] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEzN6it_tNBGH9EAEfWgAAAEE"]
[Thu Nov 13 06:06:04.886903 2025] [:error] [pid 22223:tid 22254] [client 4.255.247.224:64550] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 116"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEzN6it_tNBGH9EAEfWgAAAEE"]
[Thu Nov 13 06:06:05.573633 2025] [:error] [pid 22222:tid 22229] [client 4.255.247.224:64596] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEzTL-5qXvQuZkA4GrLwAAAAM"]
[Thu Nov 13 06:06:05.573804 2025] [:error] [pid 22222:tid 22229] [client 4.255.247.224:64596] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 117"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEzTL-5qXvQuZkA4GrLwAAAAM"]
[Thu Nov 13 06:06:06.265130 2025] [:error] [pid 22566:tid 22582] [client 4.255.247.224:64641] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEzjfdqWaUbu3e06-Y9gAAAQ4"]
[Thu Nov 13 06:06:06.265265 2025] [:error] [pid 22566:tid 22582] [client 4.255.247.224:64641] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 118"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEzjfdqWaUbu3e06-Y9gAAAQ4"]
[Thu Nov 13 06:06:06.955413 2025] [:error] [pid 22223:tid 22255] [client 4.255.247.224:64699] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEzt6it_tNBGH9EAEfZQAAAEI"]
[Thu Nov 13 06:06:06.955588 2025] [:error] [pid 22223:tid 22255] [client 4.255.247.224:64699] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 119"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEzt6it_tNBGH9EAEfZQAAAEI"]
[Thu Nov 13 06:06:07.641731 2025] [:error] [pid 22566:tid 22569] [client 4.255.247.224:64744] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEzzfdqWaUbu3e06-Y-gAAAQE"]
[Thu Nov 13 06:06:07.641928 2025] [:error] [pid 22566:tid 22569] [client 4.255.247.224:64744] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 120"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUEzzfdqWaUbu3e06-Y-gAAAQE"]
[Thu Nov 13 06:06:08.327166 2025] [:error] [pid 22224:tid 22284] [client 4.255.247.224:64786] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE0LuEVuTj3a_UBfAMDgAAAIQ"]
[Thu Nov 13 06:06:08.327366 2025] [:error] [pid 22224:tid 22284] [client 4.255.247.224:64786] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 120"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE0LuEVuTj3a_UBfAMDgAAAIQ"]
[Thu Nov 13 06:06:09.022827 2025] [:error] [pid 22224:tid 22300] [client 4.255.247.224:64835] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE0buEVuTj3a_UBfAMEAAAAJQ"]
[Thu Nov 13 06:06:09.022935 2025] [:error] [pid 22224:tid 22300] [client 4.255.247.224:64835] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 122"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE0buEVuTj3a_UBfAMEAAAAJQ"]
[Thu Nov 13 06:06:09.708922 2025] [:error] [pid 22566:tid 22575] [client 4.255.247.224:64888] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE0TfdqWaUbu3e06-Y_QAAAQc"]
[Thu Nov 13 06:06:09.708979 2025] [:error] [pid 22566:tid 22575] [client 4.255.247.224:64888] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 123"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE0TfdqWaUbu3e06-Y_QAAAQc"]
[Thu Nov 13 06:06:10.401244 2025] [:error] [pid 22224:tid 22301] [client 4.255.247.224:64942] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE0ruEVuTj3a_UBfAMFAAAAJU"]
[Thu Nov 13 06:06:10.401381 2025] [:error] [pid 22224:tid 22301] [client 4.255.247.224:64942] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 124"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE0ruEVuTj3a_UBfAMFAAAAJU"]
[Thu Nov 13 06:06:11.086474 2025] [:error] [pid 22222:tid 22239] [client 4.255.247.224:64982] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE0zL-5qXvQuZkA4GrNwAAAA0"]
[Thu Nov 13 06:06:11.086655 2025] [:error] [pid 22222:tid 22239] [client 4.255.247.224:64982] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 125"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE0zL-5qXvQuZkA4GrNwAAAA0"]
[Thu Nov 13 06:06:11.779682 2025] [:error] [pid 22223:tid 22273] [client 4.255.247.224:65034] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE096it_tNBGH9EAEfawAAAFQ"]
[Thu Nov 13 06:06:11.779825 2025] [:error] [pid 22223:tid 22273] [client 4.255.247.224:65034] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 126"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE096it_tNBGH9EAEfawAAAFQ"]
[Thu Nov 13 06:06:12.482695 2025] [:error] [pid 22566:tid 22579] [client 4.255.247.224:65082] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE1DfdqWaUbu3e06-ZEAAAAQs"]
[Thu Nov 13 06:06:12.482913 2025] [:error] [pid 22566:tid 22579] [client 4.255.247.224:65082] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 127"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE1DfdqWaUbu3e06-ZEAAAAQs"]
[Thu Nov 13 06:06:13.177674 2025] [:error] [pid 22566:tid 22577] [client 4.255.247.224:65132] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE1TfdqWaUbu3e06-ZGwAAAQk"]
[Thu Nov 13 06:06:13.177824 2025] [:error] [pid 22566:tid 22577] [client 4.255.247.224:65132] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 128"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE1TfdqWaUbu3e06-ZGwAAAQk"]
[Thu Nov 13 06:06:13.863965 2025] [:error] [pid 22566:tid 22590] [client 4.255.247.224:65187] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE1TfdqWaUbu3e06-ZIgAAARY"]
[Thu Nov 13 06:06:13.864162 2025] [:error] [pid 22566:tid 22590] [client 4.255.247.224:65187] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 129"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE1TfdqWaUbu3e06-ZIgAAARY"]
[Thu Nov 13 06:06:14.551078 2025] [:error] [pid 22223:tid 22277] [client 4.255.247.224:65237] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE1t6it_tNBGH9EAEfbQAAAFg"]
[Thu Nov 13 06:06:14.551239 2025] [:error] [pid 22223:tid 22277] [client 4.255.247.224:65237] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 130"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE1t6it_tNBGH9EAEfbQAAAFg"]
[Thu Nov 13 06:06:15.237834 2025] [:error] [pid 22223:tid 22267] [client 4.255.247.224:65276] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE196it_tNBGH9EAEfbgAAAE4"]
[Thu Nov 13 06:06:15.237993 2025] [:error] [pid 22223:tid 22267] [client 4.255.247.224:65276] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 131"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE196it_tNBGH9EAEfbgAAAE4"]
[Thu Nov 13 06:06:15.939747 2025] [:error] [pid 22566:tid 22583] [client 4.255.247.224:65329] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE1zfdqWaUbu3e06-ZKgAAAQ8"]
[Thu Nov 13 06:06:15.939866 2025] [:error] [pid 22566:tid 22583] [client 4.255.247.224:65329] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 132"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE1zfdqWaUbu3e06-ZKgAAAQ8"]
[Thu Nov 13 06:06:16.626676 2025] [:error] [pid 22222:tid 22248] [client 4.255.247.224:65382] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE2DL-5qXvQuZkA4GrRQAAABY"]
[Thu Nov 13 06:06:16.626839 2025] [:error] [pid 22222:tid 22248] [client 4.255.247.224:65382] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 133"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE2DL-5qXvQuZkA4GrRQAAABY"]
[Thu Nov 13 06:06:17.322864 2025] [:error] [pid 22222:tid 22245] [client 4.255.247.224:65428] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE2TL-5qXvQuZkA4GrSQAAABM"]
[Thu Nov 13 06:06:17.323051 2025] [:error] [pid 22222:tid 22245] [client 4.255.247.224:65428] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 134"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE2TL-5qXvQuZkA4GrSQAAABM"]
[Thu Nov 13 06:06:18.009896 2025] [:error] [pid 22307:tid 22330] [client 4.255.247.224:65474] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE2qr7fLMQQanZ_9yDdQAAANU"]
[Thu Nov 13 06:06:18.010064 2025] [:error] [pid 22307:tid 22330] [client 4.255.247.224:65474] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 135"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE2qr7fLMQQanZ_9yDdQAAANU"]
[Thu Nov 13 06:06:18.697561 2025] [:error] [pid 22307:tid 22311] [client 4.255.247.224:65523] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE2qr7fLMQQanZ_9yDdgAAAMI"]
[Thu Nov 13 06:06:18.697680 2025] [:error] [pid 22307:tid 22311] [client 4.255.247.224:65523] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 136"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE2qr7fLMQQanZ_9yDdgAAAMI"]
[Thu Nov 13 06:06:19.399119 2025] [:error] [pid 22566:tid 22579] [client 4.255.247.224:49187] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE2zfdqWaUbu3e06-ZOAAAAQs"]
[Thu Nov 13 06:06:19.399258 2025] [:error] [pid 22566:tid 22579] [client 4.255.247.224:49187] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 137"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE2zfdqWaUbu3e06-ZOAAAAQs"]
[Thu Nov 13 06:06:20.085156 2025] [:error] [pid 22222:tid 22230] [client 4.255.247.224:49236] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE3DL-5qXvQuZkA4GrUAAAAAQ"]
[Thu Nov 13 06:06:20.085320 2025] [:error] [pid 22222:tid 22230] [client 4.255.247.224:49236] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 138"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE3DL-5qXvQuZkA4GrUAAAAAQ"]
[Thu Nov 13 06:06:20.772876 2025] [:error] [pid 22307:tid 22320] [client 4.255.247.224:49283] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE3Kr7fLMQQanZ_9yDfwAAAMs"]
[Thu Nov 13 06:06:20.772987 2025] [:error] [pid 22307:tid 22320] [client 4.255.247.224:49283] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 139"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE3Kr7fLMQQanZ_9yDfwAAAMs"]
[Thu Nov 13 06:06:21.460272 2025] [:error] [pid 22307:tid 22328] [client 4.255.247.224:49322] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE3ar7fLMQQanZ_9yDgAAAANM"]
[Thu Nov 13 06:06:21.460417 2025] [:error] [pid 22307:tid 22328] [client 4.255.247.224:49322] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 140"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE3ar7fLMQQanZ_9yDgAAAANM"]
[Thu Nov 13 06:06:22.150291 2025] [:error] [pid 22566:tid 22587] [client 4.255.247.224:49363] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE3jfdqWaUbu3e06-ZUgAAARM"]
[Thu Nov 13 06:06:22.150402 2025] [:error] [pid 22566:tid 22587] [client 4.255.247.224:49363] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 141"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE3jfdqWaUbu3e06-ZUgAAARM"]
[Thu Nov 13 06:06:22.841741 2025] [:error] [pid 22566:tid 22581] [client 4.255.247.224:49405] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE3jfdqWaUbu3e06-ZXgAAAQ0"]
[Thu Nov 13 06:06:22.841886 2025] [:error] [pid 22566:tid 22581] [client 4.255.247.224:49405] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 142"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE3jfdqWaUbu3e06-ZXgAAAQ0"]
[Thu Nov 13 06:06:23.528969 2025] [:error] [pid 22223:tid 22254] [client 4.255.247.224:49457] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE396it_tNBGH9EAEfdQAAAEE"]
[Thu Nov 13 06:06:23.529117 2025] [:error] [pid 22223:tid 22254] [client 4.255.247.224:49457] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 142"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE396it_tNBGH9EAEfdQAAAEE"]
[Thu Nov 13 06:06:24.218309 2025] [:error] [pid 22566:tid 22584] [client 4.255.247.224:49491] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE4DfdqWaUbu3e06-ZaQAAARA"]
[Thu Nov 13 06:06:24.218448 2025] [:error] [pid 22566:tid 22584] [client 4.255.247.224:49491] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 144"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE4DfdqWaUbu3e06-ZaQAAARA"]
[Thu Nov 13 06:06:24.906261 2025] [:error] [pid 22566:tid 22576] [client 4.255.247.224:49536] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE4DfdqWaUbu3e06-ZbwAAAQg"]
[Thu Nov 13 06:06:24.906469 2025] [:error] [pid 22566:tid 22576] [client 4.255.247.224:49536] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 145"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE4DfdqWaUbu3e06-ZbwAAAQg"]
[Thu Nov 13 06:06:25.594471 2025] [:error] [pid 22224:tid 22301] [client 4.255.247.224:49580] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE4buEVuTj3a_UBfAMLwAAAJU"]
[Thu Nov 13 06:06:25.594636 2025] [:error] [pid 22224:tid 22301] [client 4.255.247.224:49580] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 146"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE4buEVuTj3a_UBfAMLwAAAJU"]
[Thu Nov 13 06:06:26.280688 2025] [:error] [pid 22222:tid 22248] [client 4.255.247.224:49616] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE4jL-5qXvQuZkA4GrXwAAABY"]
[Thu Nov 13 06:06:26.280834 2025] [:error] [pid 22222:tid 22248] [client 4.255.247.224:49616] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 147"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE4jL-5qXvQuZkA4GrXwAAABY"]
[Thu Nov 13 06:06:26.968877 2025] [:error] [pid 22566:tid 22584] [client 4.255.247.224:49654] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE4jfdqWaUbu3e06-ZfAAAARA"]
[Thu Nov 13 06:06:26.969042 2025] [:error] [pid 22566:tid 22584] [client 4.255.247.224:49654] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 148"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE4jfdqWaUbu3e06-ZfAAAARA"]
[Thu Nov 13 06:06:27.662104 2025] [:error] [pid 22566:tid 22575] [client 4.255.247.224:49708] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE4zfdqWaUbu3e06-ZfgAAAQc"]
[Thu Nov 13 06:06:27.662239 2025] [:error] [pid 22566:tid 22575] [client 4.255.247.224:49708] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 149"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE4zfdqWaUbu3e06-ZfgAAAQc"]
[Thu Nov 13 06:06:28.349451 2025] [:error] [pid 22307:tid 22321] [client 4.255.247.224:49753] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE5Kr7fLMQQanZ_9yDkAAAAMw"]
[Thu Nov 13 06:06:28.349600 2025] [:error] [pid 22307:tid 22321] [client 4.255.247.224:49753] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 150"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE5Kr7fLMQQanZ_9yDkAAAAMw"]
[Thu Nov 13 06:06:29.036112 2025] [:error] [pid 22307:tid 22311] [client 4.255.247.224:49805] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE5ar7fLMQQanZ_9yDkwAAAMI"]
[Thu Nov 13 06:06:29.036244 2025] [:error] [pid 22307:tid 22311] [client 4.255.247.224:49805] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 151"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE5ar7fLMQQanZ_9yDkwAAAMI"]
[Thu Nov 13 06:06:29.725502 2025] [:error] [pid 22566:tid 22592] [client 4.255.247.224:49851] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE5TfdqWaUbu3e06-ZkgAAARg"]
[Thu Nov 13 06:06:29.725700 2025] [:error] [pid 22566:tid 22592] [client 4.255.247.224:49851] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 152"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE5TfdqWaUbu3e06-ZkgAAARg"]
[Thu Nov 13 06:06:30.414498 2025] [:error] [pid 22224:tid 22296] [client 4.255.247.224:49906] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE5ruEVuTj3a_UBfAMNwAAAJA"]
[Thu Nov 13 06:06:30.414686 2025] [:error] [pid 22224:tid 22296] [client 4.255.247.224:49906] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 153"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE5ruEVuTj3a_UBfAMNwAAAJA"]
[Thu Nov 13 06:06:31.100772 2025] [:error] [pid 22307:tid 22311] [client 4.255.247.224:49955] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE56r7fLMQQanZ_9yDngAAAMI"]
[Thu Nov 13 06:06:31.100927 2025] [:error] [pid 22307:tid 22311] [client 4.255.247.224:49955] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 154"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE56r7fLMQQanZ_9yDngAAAMI"]
[Thu Nov 13 06:06:31.788854 2025] [:error] [pid 22566:tid 22590] [client 4.255.247.224:50012] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE5zfdqWaUbu3e06-ZmwAAARY"]
[Thu Nov 13 06:06:31.789018 2025] [:error] [pid 22566:tid 22590] [client 4.255.247.224:50012] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 155"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE5zfdqWaUbu3e06-ZmwAAARY"]
[Thu Nov 13 06:06:32.475625 2025] [:error] [pid 22566:tid 22585] [client 4.255.247.224:50054] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE6DfdqWaUbu3e06-ZnwAAARE"]
[Thu Nov 13 06:06:32.475778 2025] [:error] [pid 22566:tid 22585] [client 4.255.247.224:50054] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 156"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE6DfdqWaUbu3e06-ZnwAAARE"]
[Thu Nov 13 06:06:33.161813 2025] [:error] [pid 22566:tid 22577] [client 4.255.247.224:50107] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE6TfdqWaUbu3e06-ZogAAAQk"]
[Thu Nov 13 06:06:33.161978 2025] [:error] [pid 22566:tid 22577] [client 4.255.247.224:50107] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 157"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE6TfdqWaUbu3e06-ZogAAAQk"]
[Thu Nov 13 06:06:33.853412 2025] [:error] [pid 22224:tid 22294] [client 4.255.247.224:50148] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE6buEVuTj3a_UBfAMPgAAAI4"]
[Thu Nov 13 06:06:33.853626 2025] [:error] [pid 22224:tid 22294] [client 4.255.247.224:50148] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 158"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE6buEVuTj3a_UBfAMPgAAAI4"]
[Thu Nov 13 06:06:34.542193 2025] [:error] [pid 22566:tid 22583] [client 4.255.247.224:50199] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE6jfdqWaUbu3e06-ZrQAAAQ8"]
[Thu Nov 13 06:06:34.542371 2025] [:error] [pid 22566:tid 22583] [client 4.255.247.224:50199] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 159"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE6jfdqWaUbu3e06-ZrQAAAQ8"]
[Thu Nov 13 06:06:35.233029 2025] [:error] [pid 22566:tid 22581] [client 4.255.247.224:50248] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE6zfdqWaUbu3e06-ZswAAAQ0"]
[Thu Nov 13 06:06:35.233204 2025] [:error] [pid 22566:tid 22581] [client 4.255.247.224:50248] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 160"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE6zfdqWaUbu3e06-ZswAAAQ0"]
[Thu Nov 13 06:06:35.920120 2025] [:error] [pid 22307:tid 22314] [client 4.255.247.224:50285] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE66r7fLMQQanZ_9yDsgAAAMU"]
[Thu Nov 13 06:06:35.920240 2025] [:error] [pid 22307:tid 22314] [client 4.255.247.224:50285] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 161"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE66r7fLMQQanZ_9yDsgAAAMU"]
[Thu Nov 13 06:06:36.609265 2025] [:error] [pid 22307:tid 22330] [client 4.255.247.224:50328] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE7Kr7fLMQQanZ_9yDtwAAANU"]
[Thu Nov 13 06:06:36.609450 2025] [:error] [pid 22307:tid 22330] [client 4.255.247.224:50328] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 162"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE7Kr7fLMQQanZ_9yDtwAAANU"]
[Thu Nov 13 06:06:37.295732 2025] [:error] [pid 22222:tid 22247] [client 4.255.247.224:50380] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE7TL-5qXvQuZkA4GrdQAAABU"]
[Thu Nov 13 06:06:37.295917 2025] [:error] [pid 22222:tid 22247] [client 4.255.247.224:50380] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 163"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE7TL-5qXvQuZkA4GrdQAAABU"]
[Thu Nov 13 06:06:37.990500 2025] [:error] [pid 22222:tid 22236] [client 4.255.247.224:50425] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE7TL-5qXvQuZkA4GrfgAAAAo"]
[Thu Nov 13 06:06:37.990680 2025] [:error] [pid 22222:tid 22236] [client 4.255.247.224:50425] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 164"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE7TL-5qXvQuZkA4GrfgAAAAo"]
[Thu Nov 13 06:06:38.678135 2025] [:error] [pid 22222:tid 22245] [client 4.255.247.224:50463] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE7jL-5qXvQuZkA4GrfwAAABM"]
[Thu Nov 13 06:06:38.678317 2025] [:error] [pid 22222:tid 22245] [client 4.255.247.224:50463] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 165"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE7jL-5qXvQuZkA4GrfwAAABM"]
[Thu Nov 13 06:06:39.369438 2025] [:error] [pid 22223:tid 22260] [client 4.255.247.224:50512] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE796it_tNBGH9EAEfyAAAAEc"]
[Thu Nov 13 06:06:39.369615 2025] [:error] [pid 22223:tid 22260] [client 4.255.247.224:50512] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 166"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE796it_tNBGH9EAEfyAAAAEc"]
[Thu Nov 13 06:06:40.063044 2025] [:error] [pid 22307:tid 22331] [client 4.255.247.224:50560] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE8Kr7fLMQQanZ_9yDxgAAANY"]
[Thu Nov 13 06:06:40.063236 2025] [:error] [pid 22307:tid 22331] [client 4.255.247.224:50560] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 167"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE8Kr7fLMQQanZ_9yDxgAAANY"]
[Thu Nov 13 06:06:40.754262 2025] [:error] [pid 22224:tid 22297] [client 4.255.247.224:50604] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE8LuEVuTj3a_UBfAMTgAAAJE"]
[Thu Nov 13 06:06:40.754497 2025] [:error] [pid 22224:tid 22297] [client 4.255.247.224:50604] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 168"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE8LuEVuTj3a_UBfAMTgAAAJE"]
[Thu Nov 13 06:06:41.441402 2025] [:error] [pid 22307:tid 22317] [client 4.255.247.224:50652] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE8ar7fLMQQanZ_9yDzAAAAMg"]
[Thu Nov 13 06:06:41.441566 2025] [:error] [pid 22307:tid 22317] [client 4.255.247.224:50652] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 169"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE8ar7fLMQQanZ_9yDzAAAAMg"]
[Thu Nov 13 06:06:42.129080 2025] [:error] [pid 22222:tid 22248] [client 4.255.247.224:50698] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE8jL-5qXvQuZkA4GrjQAAABY"]
[Thu Nov 13 06:06:42.129188 2025] [:error] [pid 22222:tid 22248] [client 4.255.247.224:50698] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 170"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE8jL-5qXvQuZkA4GrjQAAABY"]
[Thu Nov 13 06:06:42.820648 2025] [:error] [pid 22223:tid 22256] [client 4.255.247.224:50738] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE8t6it_tNBGH9EAEf4QAAAEM"]
[Thu Nov 13 06:06:42.820787 2025] [:error] [pid 22223:tid 22256] [client 4.255.247.224:50738] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 171"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE8t6it_tNBGH9EAEf4QAAAEM"]
[Thu Nov 13 06:06:43.518292 2025] [:error] [pid 22223:tid 22274] [client 4.255.247.224:50783] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE896it_tNBGH9EAEf8wAAAFU"]
[Thu Nov 13 06:06:43.518509 2025] [:error] [pid 22223:tid 22274] [client 4.255.247.224:50783] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 172"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE896it_tNBGH9EAEf8wAAAFU"]
[Thu Nov 13 06:06:44.205064 2025] [:error] [pid 22566:tid 22581] [client 4.255.247.224:50820] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE9DfdqWaUbu3e06-Z4QAAAQ0"]
[Thu Nov 13 06:06:44.205146 2025] [:error] [pid 22566:tid 22581] [client 4.255.247.224:50820] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 173"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE9DfdqWaUbu3e06-Z4QAAAQ0"]
[Thu Nov 13 06:06:44.890532 2025] [:error] [pid 22223:tid 22255] [client 4.255.247.224:50878] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE9N6it_tNBGH9EAEf_wAAAEI"]
[Thu Nov 13 06:06:44.890742 2025] [:error] [pid 22223:tid 22255] [client 4.255.247.224:50878] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 174"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE9N6it_tNBGH9EAEf_wAAAEI"]
[Thu Nov 13 06:06:45.576022 2025] [:error] [pid 22566:tid 22583] [client 4.255.247.224:50931] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE9TfdqWaUbu3e06-Z5wAAAQ8"]
[Thu Nov 13 06:06:45.576161 2025] [:error] [pid 22566:tid 22583] [client 4.255.247.224:50931] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 175"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE9TfdqWaUbu3e06-Z5wAAAQ8"]
[Thu Nov 13 06:06:46.262535 2025] [:error] [pid 22566:tid 22577] [client 4.255.247.224:50996] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE9jfdqWaUbu3e06-Z6gAAAQk"]
[Thu Nov 13 06:06:46.262709 2025] [:error] [pid 22566:tid 22577] [client 4.255.247.224:50996] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 176"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE9jfdqWaUbu3e06-Z6gAAAQk"]
[Thu Nov 13 06:06:46.949720 2025] [:error] [pid 22222:tid 22238] [client 4.255.247.224:51043] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE9jL-5qXvQuZkA4GrmgAAAAw"]
[Thu Nov 13 06:06:46.949869 2025] [:error] [pid 22222:tid 22238] [client 4.255.247.224:51043] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 177"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE9jL-5qXvQuZkA4GrmgAAAAw"]
[Thu Nov 13 06:06:47.636441 2025] [:error] [pid 22307:tid 22328] [client 4.255.247.224:51086] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE96r7fLMQQanZ_9yD7gAAANM"]
[Thu Nov 13 06:06:47.636606 2025] [:error] [pid 22307:tid 22328] [client 4.255.247.224:51086] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 178"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE96r7fLMQQanZ_9yD7gAAANM"]
[Thu Nov 13 06:06:48.323833 2025] [:error] [pid 22222:tid 22239] [client 4.255.247.224:51140] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE-DL-5qXvQuZkA4GrnQAAAA0"]
[Thu Nov 13 06:06:48.323976 2025] [:error] [pid 22222:tid 22239] [client 4.255.247.224:51140] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 179"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE-DL-5qXvQuZkA4GrnQAAAA0"]
[Thu Nov 13 06:06:49.010221 2025] [:error] [pid 22222:tid 22229] [client 4.255.247.224:51192] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE-TL-5qXvQuZkA4GroQAAAAM"]
[Thu Nov 13 06:06:49.010416 2025] [:error] [pid 22222:tid 22229] [client 4.255.247.224:51192] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 180"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE-TL-5qXvQuZkA4GroQAAAAM"]
[Thu Nov 13 06:06:49.696254 2025] [:error] [pid 22566:tid 22583] [client 4.255.247.224:51249] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE-TfdqWaUbu3e06-Z_wAAAQ8"]
[Thu Nov 13 06:06:49.696411 2025] [:error] [pid 22566:tid 22583] [client 4.255.247.224:51249] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 181"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE-TfdqWaUbu3e06-Z_wAAAQ8"]
[Thu Nov 13 06:06:50.381468 2025] [:error] [pid 22224:tid 22284] [client 4.255.247.224:51288] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE-ruEVuTj3a_UBfAMcwAAAIQ"]
[Thu Nov 13 06:06:50.381632 2025] [:error] [pid 22224:tid 22284] [client 4.255.247.224:51288] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 182"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE-ruEVuTj3a_UBfAMcwAAAIQ"]
[Thu Nov 13 06:06:51.067843 2025] [:error] [pid 22224:tid 22285] [client 4.255.247.224:51332] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE-7uEVuTj3a_UBfAMdQAAAIU"]
[Thu Nov 13 06:06:51.068038 2025] [:error] [pid 22224:tid 22285] [client 4.255.247.224:51332] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 183"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE-7uEVuTj3a_UBfAMdQAAAIU"]
[Thu Nov 13 06:06:51.753801 2025] [:error] [pid 22566:tid 22574] [client 4.255.247.224:51396] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE-zfdqWaUbu3e06-aCQAAAQY"]
[Thu Nov 13 06:06:51.753996 2025] [:error] [pid 22566:tid 22574] [client 4.255.247.224:51396] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 184"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE-zfdqWaUbu3e06-aCQAAAQY"]
[Thu Nov 13 06:06:52.442459 2025] [:error] [pid 22566:tid 22592] [client 4.255.247.224:51455] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE_DfdqWaUbu3e06-aDAAAARg"]
[Thu Nov 13 06:06:52.442606 2025] [:error] [pid 22566:tid 22592] [client 4.255.247.224:51455] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 185"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE_DfdqWaUbu3e06-aDAAAARg"]
[Thu Nov 13 06:06:53.140646 2025] [:error] [pid 22307:tid 22321] [client 4.255.247.224:51502] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE_ar7fLMQQanZ_9yEBAAAAMw"]
[Thu Nov 13 06:06:53.140786 2025] [:error] [pid 22307:tid 22321] [client 4.255.247.224:51502] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 186"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE_ar7fLMQQanZ_9yEBAAAAMw"]
[Thu Nov 13 06:06:53.830915 2025] [:error] [pid 22566:tid 22584] [client 4.255.247.224:51554] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE_TfdqWaUbu3e06-aFwAAARA"]
[Thu Nov 13 06:06:53.831080 2025] [:error] [pid 22566:tid 22584] [client 4.255.247.224:51554] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 187"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE_TfdqWaUbu3e06-aFwAAARA"]
[Thu Nov 13 06:06:54.532689 2025] [:error] [pid 22224:tid 22297] [client 4.255.247.224:51604] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE_ruEVuTj3a_UBfAMjAAAAJE"]
[Thu Nov 13 06:06:54.532819 2025] [:error] [pid 22224:tid 22297] [client 4.255.247.224:51604] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 188"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE_ruEVuTj3a_UBfAMjAAAAJE"]
[Thu Nov 13 06:06:55.227166 2025] [:error] [pid 22307:tid 22310] [client 4.255.247.224:51657] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE_6r7fLMQQanZ_9yEFAAAAME"]
[Thu Nov 13 06:06:55.227331 2025] [:error] [pid 22307:tid 22310] [client 4.255.247.224:51657] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 189"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE_6r7fLMQQanZ_9yEFAAAAME"]
[Thu Nov 13 06:06:55.915851 2025] [:error] [pid 22224:tid 22280] [client 4.255.247.224:51702] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE_7uEVuTj3a_UBfAMkQAAAIA"]
[Thu Nov 13 06:06:55.916014 2025] [:error] [pid 22224:tid 22280] [client 4.255.247.224:51702] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 190"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUE_7uEVuTj3a_UBfAMkQAAAIA"]
[Thu Nov 13 06:06:56.605631 2025] [:error] [pid 22224:tid 22303] [client 4.255.247.224:51748] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFALuEVuTj3a_UBfAMlgAAAJc"]
[Thu Nov 13 06:06:56.605768 2025] [:error] [pid 22224:tid 22303] [client 4.255.247.224:51748] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 191"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFALuEVuTj3a_UBfAMlgAAAJc"]
[Thu Nov 13 06:06:57.291818 2025] [:error] [pid 22307:tid 22314] [client 4.255.247.224:51787] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFAar7fLMQQanZ_9yEHwAAAMU"]
[Thu Nov 13 06:06:57.291977 2025] [:error] [pid 22307:tid 22314] [client 4.255.247.224:51787] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 192"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFAar7fLMQQanZ_9yEHwAAAMU"]
[Thu Nov 13 06:06:57.979287 2025] [:error] [pid 22307:tid 22316] [client 4.255.247.224:51837] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFAar7fLMQQanZ_9yEIQAAAMc"]
[Thu Nov 13 06:06:57.979413 2025] [:error] [pid 22307:tid 22316] [client 4.255.247.224:51837] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 193"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFAar7fLMQQanZ_9yEIQAAAMc"]
[Thu Nov 13 06:06:58.665696 2025] [:error] [pid 22222:tid 22231] [client 4.255.247.224:51891] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFAjL-5qXvQuZkA4GrygAAAAU"]
[Thu Nov 13 06:06:58.665854 2025] [:error] [pid 22222:tid 22231] [client 4.255.247.224:51891] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 194"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFAjL-5qXvQuZkA4GrygAAAAU"]
[Thu Nov 13 06:06:59.356536 2025] [:error] [pid 22224:tid 22293] [client 4.255.247.224:51932] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFA7uEVuTj3a_UBfAMngAAAI0"]
[Thu Nov 13 06:06:59.356691 2025] [:error] [pid 22224:tid 22293] [client 4.255.247.224:51932] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 195"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFA7uEVuTj3a_UBfAMngAAAI0"]
[Thu Nov 13 06:07:00.042128 2025] [:error] [pid 22566:tid 22580] [client 4.255.247.224:51986] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFBDfdqWaUbu3e06-aNAAAAQw"]
[Thu Nov 13 06:07:00.042286 2025] [:error] [pid 22566:tid 22580] [client 4.255.247.224:51986] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 196"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFBDfdqWaUbu3e06-aNAAAAQw"]
[Thu Nov 13 06:07:00.737858 2025] [:error] [pid 22222:tid 22228] [client 4.255.247.224:52034] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFBDL-5qXvQuZkA4GrzQAAAAI"]
[Thu Nov 13 06:07:00.738051 2025] [:error] [pid 22222:tid 22228] [client 4.255.247.224:52034] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 197"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFBDL-5qXvQuZkA4GrzQAAAAI"]
[Thu Nov 13 06:07:01.424024 2025] [:error] [pid 22566:tid 22577] [client 4.255.247.224:52081] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFBTfdqWaUbu3e06-aOQAAAQk"]
[Thu Nov 13 06:07:01.424171 2025] [:error] [pid 22566:tid 22577] [client 4.255.247.224:52081] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 198"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFBTfdqWaUbu3e06-aOQAAAQk"]
[Thu Nov 13 06:07:02.111841 2025] [:error] [pid 22222:tid 22241] [client 4.255.247.224:52125] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFBjL-5qXvQuZkA4Gr0AAAAA8"]
[Thu Nov 13 06:07:02.112009 2025] [:error] [pid 22222:tid 22241] [client 4.255.247.224:52125] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 199"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFBjL-5qXvQuZkA4Gr0AAAAA8"]
[Thu Nov 13 06:07:02.798361 2025] [:error] [pid 22307:tid 22319] [client 4.255.247.224:52177] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFBqr7fLMQQanZ_9yENAAAAMo"]
[Thu Nov 13 06:07:02.798465 2025] [:error] [pid 22307:tid 22319] [client 4.255.247.224:52177] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 200"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFBqr7fLMQQanZ_9yENAAAAMo"]
[Thu Nov 13 06:07:03.489765 2025] [:error] [pid 22224:tid 22302] [client 4.255.247.224:52222] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFB7uEVuTj3a_UBfAMrgAAAJY"]
[Thu Nov 13 06:07:03.489884 2025] [:error] [pid 22224:tid 22302] [client 4.255.247.224:52222] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 201"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFB7uEVuTj3a_UBfAMrgAAAJY"]
[Thu Nov 13 06:07:04.176996 2025] [:error] [pid 22307:tid 22321] [client 4.255.247.224:52264] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFCKr7fLMQQanZ_9yEOgAAAMw"]
[Thu Nov 13 06:07:04.177171 2025] [:error] [pid 22307:tid 22321] [client 4.255.247.224:52264] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 202"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFCKr7fLMQQanZ_9yEOgAAAMw"]
[Thu Nov 13 06:07:04.871217 2025] [:error] [pid 22566:tid 22587] [client 4.255.247.224:52302] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFCDfdqWaUbu3e06-aRQAAARM"]
[Thu Nov 13 06:07:04.871412 2025] [:error] [pid 22566:tid 22587] [client 4.255.247.224:52302] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 203"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFCDfdqWaUbu3e06-aRQAAARM"]
[Thu Nov 13 06:07:05.557224 2025] [:error] [pid 22566:tid 22576] [client 4.255.247.224:52342] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFCTfdqWaUbu3e06-aSQAAAQg"]
[Thu Nov 13 06:07:05.557378 2025] [:error] [pid 22566:tid 22576] [client 4.255.247.224:52342] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 204"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFCTfdqWaUbu3e06-aSQAAAQg"]
[Thu Nov 13 06:07:06.245478 2025] [:error] [pid 22222:tid 22231] [client 4.255.247.224:52382] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFCjL-5qXvQuZkA4Gr2QAAAAU"]
[Thu Nov 13 06:07:06.245646 2025] [:error] [pid 22222:tid 22231] [client 4.255.247.224:52382] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 205"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFCjL-5qXvQuZkA4Gr2QAAAAU"]
[Thu Nov 13 06:07:06.931598 2025] [:error] [pid 22222:tid 22248] [client 4.255.247.224:52418] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFCjL-5qXvQuZkA4Gr3AAAABY"]
[Thu Nov 13 06:07:06.931814 2025] [:error] [pid 22222:tid 22248] [client 4.255.247.224:52418] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 206"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFCjL-5qXvQuZkA4Gr3AAAABY"]
[Thu Nov 13 06:07:07.620697 2025] [:error] [pid 22224:tid 22291] [client 4.255.247.224:52461] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFC7uEVuTj3a_UBfAMugAAAIs"]
[Thu Nov 13 06:07:07.620837 2025] [:error] [pid 22224:tid 22291] [client 4.255.247.224:52461] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 207"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFC7uEVuTj3a_UBfAMugAAAIs"]
[Thu Nov 13 06:07:08.306820 2025] [:error] [pid 22222:tid 22235] [client 4.255.247.224:52491] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFDDL-5qXvQuZkA4Gr4gAAAAk"]
[Thu Nov 13 06:07:08.306957 2025] [:error] [pid 22222:tid 22235] [client 4.255.247.224:52491] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 208"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFDDL-5qXvQuZkA4Gr4gAAAAk"]
[Thu Nov 13 06:07:08.997397 2025] [:error] [pid 22222:tid 22240] [client 4.255.247.224:52535] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFDDL-5qXvQuZkA4Gr5QAAAA4"]
[Thu Nov 13 06:07:08.997593 2025] [:error] [pid 22222:tid 22240] [client 4.255.247.224:52535] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 209"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFDDL-5qXvQuZkA4Gr5QAAAA4"]
[Thu Nov 13 06:07:09.683629 2025] [:error] [pid 22566:tid 22570] [client 4.255.247.224:52581] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFDTfdqWaUbu3e06-aVgAAAQI"]
[Thu Nov 13 06:07:09.683781 2025] [:error] [pid 22566:tid 22570] [client 4.255.247.224:52581] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 210"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFDTfdqWaUbu3e06-aVgAAAQI"]
[Thu Nov 13 06:07:10.376251 2025] [:error] [pid 22566:tid 22582] [client 4.255.247.224:52623] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFDjfdqWaUbu3e06-aXgAAAQ4"]
[Thu Nov 13 06:07:10.376426 2025] [:error] [pid 22566:tid 22582] [client 4.255.247.224:52623] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 211"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFDjfdqWaUbu3e06-aXgAAAQ4"]
[Thu Nov 13 06:07:11.062094 2025] [:error] [pid 22307:tid 22321] [client 4.255.247.224:52668] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFD6r7fLMQQanZ_9yEZgAAAMw"]
[Thu Nov 13 06:07:11.062258 2025] [:error] [pid 22307:tid 22321] [client 4.255.247.224:52668] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 212"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFD6r7fLMQQanZ_9yEZgAAAMw"]
[Thu Nov 13 06:07:11.750620 2025] [:error] [pid 22222:tid 22235] [client 4.255.247.224:52711] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFDzL-5qXvQuZkA4Gr6wAAAAk"]
[Thu Nov 13 06:07:11.750731 2025] [:error] [pid 22222:tid 22235] [client 4.255.247.224:52711] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 213"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFDzL-5qXvQuZkA4Gr6wAAAAk"]
[Thu Nov 13 06:07:12.437075 2025] [:error] [pid 22307:tid 22317] [client 4.255.247.224:52758] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFEKr7fLMQQanZ_9yEdgAAAMg"]
[Thu Nov 13 06:07:12.437298 2025] [:error] [pid 22307:tid 22317] [client 4.255.247.224:52758] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 214"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFEKr7fLMQQanZ_9yEdgAAAMg"]
[Thu Nov 13 06:07:13.132607 2025] [:error] [pid 22566:tid 22576] [client 4.255.247.224:52803] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFETfdqWaUbu3e06-abgAAAQg"]
[Thu Nov 13 06:07:13.132738 2025] [:error] [pid 22566:tid 22576] [client 4.255.247.224:52803] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 215"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFETfdqWaUbu3e06-abgAAAQg"]
[Thu Nov 13 06:07:13.819744 2025] [:error] [pid 22222:tid 22240] [client 4.255.247.224:52849] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFETL-5qXvQuZkA4Gr8wAAAA4"]
[Thu Nov 13 06:07:13.819865 2025] [:error] [pid 22222:tid 22240] [client 4.255.247.224:52849] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 216"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFETL-5qXvQuZkA4Gr8wAAAA4"]
[Thu Nov 13 06:07:14.514590 2025] [:error] [pid 22307:tid 22316] [client 4.255.247.224:52892] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFEqr7fLMQQanZ_9yEfAAAAMc"]
[Thu Nov 13 06:07:14.514759 2025] [:error] [pid 22307:tid 22316] [client 4.255.247.224:52892] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 217"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFEqr7fLMQQanZ_9yEfAAAAMc"]
[Thu Nov 13 06:07:15.201810 2025] [:error] [pid 22222:tid 22230] [client 4.255.247.224:52936] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFEzL-5qXvQuZkA4Gr-wAAAAQ"]
[Thu Nov 13 06:07:15.201977 2025] [:error] [pid 22222:tid 22230] [client 4.255.247.224:52936] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 218"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFEzL-5qXvQuZkA4Gr-wAAAAQ"]
[Thu Nov 13 06:07:15.892621 2025] [:error] [pid 22222:tid 22237] [client 4.255.247.224:52981] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFEzL-5qXvQuZkA4GsAAAAAAs"]
[Thu Nov 13 06:07:15.892793 2025] [:error] [pid 22222:tid 22237] [client 4.255.247.224:52981] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 219"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFEzL-5qXvQuZkA4GsAAAAAAs"]
[Thu Nov 13 06:07:16.580607 2025] [:error] [pid 22222:tid 22232] [client 4.255.247.224:53027] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFFDL-5qXvQuZkA4GsBAAAAAY"]
[Thu Nov 13 06:07:16.580764 2025] [:error] [pid 22222:tid 22232] [client 4.255.247.224:53027] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 220"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFFDL-5qXvQuZkA4GsBAAAAAY"]
[Thu Nov 13 06:07:17.271803 2025] [:error] [pid 22224:tid 22295] [client 4.255.247.224:53071] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFFbuEVuTj3a_UBfAMzgAAAI8"]
[Thu Nov 13 06:07:17.271950 2025] [:error] [pid 22224:tid 22295] [client 4.255.247.224:53071] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 221"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFFbuEVuTj3a_UBfAMzgAAAI8"]
[Thu Nov 13 06:07:17.964387 2025] [:error] [pid 22222:tid 22250] [client 4.255.247.224:53117] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFFTL-5qXvQuZkA4GsCgAAABg"]
[Thu Nov 13 06:07:17.964494 2025] [:error] [pid 22222:tid 22250] [client 4.255.247.224:53117] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 222"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFFTL-5qXvQuZkA4GsCgAAABg"]
[Thu Nov 13 06:07:18.658826 2025] [:error] [pid 22224:tid 22289] [client 4.255.247.224:53156] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFFruEVuTj3a_UBfAM1QAAAIk"]
[Thu Nov 13 06:07:18.658970 2025] [:error] [pid 22224:tid 22289] [client 4.255.247.224:53156] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 223"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFFruEVuTj3a_UBfAM1QAAAIk"]
[Thu Nov 13 06:07:19.344164 2025] [:error] [pid 22224:tid 22302] [client 4.255.247.224:53211] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFF7uEVuTj3a_UBfAM1gAAAJY"]
[Thu Nov 13 06:07:19.344262 2025] [:error] [pid 22224:tid 22302] [client 4.255.247.224:53211] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 224"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFF7uEVuTj3a_UBfAM1gAAAJY"]
[Thu Nov 13 06:07:20.035512 2025] [:error] [pid 22224:tid 22300] [client 4.255.247.224:53255] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFGLuEVuTj3a_UBfAM1wAAAJQ"]
[Thu Nov 13 06:07:20.035734 2025] [:error] [pid 22224:tid 22300] [client 4.255.247.224:53255] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 225"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFGLuEVuTj3a_UBfAM1wAAAJQ"]
[Thu Nov 13 06:07:20.720811 2025] [:error] [pid 22223:tid 22263] [client 4.255.247.224:53312] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFGN6it_tNBGH9EAEg5QAAAEo"]
[Thu Nov 13 06:07:20.720932 2025] [:error] [pid 22223:tid 22263] [client 4.255.247.224:53312] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 226"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFGN6it_tNBGH9EAEg5QAAAEo"]
[Thu Nov 13 06:07:21.417216 2025] [:error] [pid 22566:tid 22571] [client 4.255.247.224:53370] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFGTfdqWaUbu3e06-ajAAAAQM"]
[Thu Nov 13 06:07:21.417397 2025] [:error] [pid 22566:tid 22571] [client 4.255.247.224:53370] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 227"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFGTfdqWaUbu3e06-ajAAAAQM"]
[Thu Nov 13 06:07:22.103131 2025] [:error] [pid 22307:tid 22315] [client 4.255.247.224:53419] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFGqr7fLMQQanZ_9yEkgAAAMY"]
[Thu Nov 13 06:07:22.103251 2025] [:error] [pid 22307:tid 22315] [client 4.255.247.224:53419] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 228"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFGqr7fLMQQanZ_9yEkgAAAMY"]
[Thu Nov 13 06:07:22.794726 2025] [:error] [pid 22566:tid 22571] [client 4.255.247.224:53469] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFGjfdqWaUbu3e06-amgAAAQM"]
[Thu Nov 13 06:07:22.794866 2025] [:error] [pid 22566:tid 22571] [client 4.255.247.224:53469] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 229"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFGjfdqWaUbu3e06-amgAAAQM"]
[Thu Nov 13 06:07:23.480334 2025] [:error] [pid 22307:tid 22316] [client 4.255.247.224:53515] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFG6r7fLMQQanZ_9yEnwAAAMc"]
[Thu Nov 13 06:07:23.480471 2025] [:error] [pid 22307:tid 22316] [client 4.255.247.224:53515] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 230"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFG6r7fLMQQanZ_9yEnwAAAMc"]
[Thu Nov 13 06:07:24.172585 2025] [:error] [pid 22222:tid 22229] [client 4.255.247.224:53556] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFHDL-5qXvQuZkA4GsGwAAAAM"]
[Thu Nov 13 06:07:24.172712 2025] [:error] [pid 22222:tid 22229] [client 4.255.247.224:53556] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 231"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFHDL-5qXvQuZkA4GsGwAAAAM"]
[Thu Nov 13 06:07:24.860565 2025] [:error] [pid 22566:tid 22577] [client 4.255.247.224:53599] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFHDfdqWaUbu3e06-aoAAAAQk"]
[Thu Nov 13 06:07:24.860708 2025] [:error] [pid 22566:tid 22577] [client 4.255.247.224:53599] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 232"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFHDfdqWaUbu3e06-aoAAAAQk"]
[Thu Nov 13 06:07:25.561057 2025] [:error] [pid 22307:tid 22318] [client 4.255.247.224:53642] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFHar7fLMQQanZ_9yEqAAAAMk"]
[Thu Nov 13 06:07:25.561224 2025] [:error] [pid 22307:tid 22318] [client 4.255.247.224:53642] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 233"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFHar7fLMQQanZ_9yEqAAAAMk"]
[Thu Nov 13 06:07:26.249503 2025] [:error] [pid 22224:tid 22289] [client 4.255.247.224:53683] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFHruEVuTj3a_UBfAM-QAAAIk"]
[Thu Nov 13 06:07:26.249666 2025] [:error] [pid 22224:tid 22289] [client 4.255.247.224:53683] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 234"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFHruEVuTj3a_UBfAM-QAAAIk"]
[Thu Nov 13 06:07:26.935835 2025] [:error] [pid 22566:tid 22576] [client 4.255.247.224:53725] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFHjfdqWaUbu3e06-aqAAAAQg"]
[Thu Nov 13 06:07:26.936026 2025] [:error] [pid 22566:tid 22576] [client 4.255.247.224:53725] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 235"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFHjfdqWaUbu3e06-aqAAAAQg"]
[Thu Nov 13 06:07:27.622506 2025] [:error] [pid 22224:tid 22300] [client 4.255.247.224:53760] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFH7uEVuTj3a_UBfAM_wAAAJQ"]
[Thu Nov 13 06:07:27.622674 2025] [:error] [pid 22224:tid 22300] [client 4.255.247.224:53760] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 236"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFH7uEVuTj3a_UBfAM_wAAAJQ"]
[Thu Nov 13 06:07:28.308088 2025] [:error] [pid 22223:tid 22265] [client 4.255.247.224:53804] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFIN6it_tNBGH9EAEhKgAAAEw"]
[Thu Nov 13 06:07:28.308230 2025] [:error] [pid 22223:tid 22265] [client 4.255.247.224:53804] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 237"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFIN6it_tNBGH9EAEhKgAAAEw"]
[Thu Nov 13 06:07:28.993687 2025] [:error] [pid 22222:tid 22231] [client 4.255.247.224:53842] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFIDL-5qXvQuZkA4GsMAAAAAU"]
[Thu Nov 13 06:07:28.993783 2025] [:error] [pid 22222:tid 22231] [client 4.255.247.224:53842] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 238"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFIDL-5qXvQuZkA4GsMAAAAAU"]
[Thu Nov 13 06:07:29.692205 2025] [:error] [pid 22223:tid 22260] [client 4.255.247.224:53876] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFId6it_tNBGH9EAEhOAAAAEc"]
[Thu Nov 13 06:07:29.692328 2025] [:error] [pid 22223:tid 22260] [client 4.255.247.224:53876] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 239"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFId6it_tNBGH9EAEhOAAAAEc"]
[Thu Nov 13 06:07:30.377312 2025] [:error] [pid 22224:tid 22295] [client 4.255.247.224:53917] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFIruEVuTj3a_UBfANDwAAAI8"]
[Thu Nov 13 06:07:30.377412 2025] [:error] [pid 22224:tid 22295] [client 4.255.247.224:53917] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 240"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFIruEVuTj3a_UBfANDwAAAI8"]
[Thu Nov 13 06:07:31.066430 2025] [:error] [pid 22307:tid 22332] [client 4.255.247.224:53969] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFI6r7fLMQQanZ_9yEwgAAANc"]
[Thu Nov 13 06:07:31.066597 2025] [:error] [pid 22307:tid 22332] [client 4.255.247.224:53969] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 241"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFI6r7fLMQQanZ_9yEwgAAANc"]
[Thu Nov 13 06:07:31.752503 2025] [:error] [pid 22566:tid 22584] [client 4.255.247.224:54012] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFIzfdqWaUbu3e06-aqwAAARA"]
[Thu Nov 13 06:07:31.752676 2025] [:error] [pid 22566:tid 22584] [client 4.255.247.224:54012] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 242"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFIzfdqWaUbu3e06-aqwAAARA"]
[Thu Nov 13 06:07:32.443743 2025] [:error] [pid 22224:tid 22291] [client 4.255.247.224:54061] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFJLuEVuTj3a_UBfANJwAAAIs"]
[Thu Nov 13 06:07:32.443933 2025] [:error] [pid 22224:tid 22291] [client 4.255.247.224:54061] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 243"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFJLuEVuTj3a_UBfANJwAAAIs"]
[Thu Nov 13 06:07:33.129444 2025] [:error] [pid 22307:tid 22333] [client 4.255.247.224:54113] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFJar7fLMQQanZ_9yEyQAAANg"]
[Thu Nov 13 06:07:33.129619 2025] [:error] [pid 22307:tid 22333] [client 4.255.247.224:54113] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 244"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFJar7fLMQQanZ_9yEyQAAANg"]
[Thu Nov 13 06:07:33.822840 2025] [:error] [pid 22307:tid 22330] [client 4.255.247.224:54155] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFJar7fLMQQanZ_9yEywAAANU"]
[Thu Nov 13 06:07:33.823016 2025] [:error] [pid 22307:tid 22330] [client 4.255.247.224:54155] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 245"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFJar7fLMQQanZ_9yEywAAANU"]
[Thu Nov 13 06:07:34.510684 2025] [:error] [pid 22566:tid 22573] [client 4.255.247.224:54218] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFJjfdqWaUbu3e06-atQAAAQU"]
[Thu Nov 13 06:07:34.510830 2025] [:error] [pid 22566:tid 22573] [client 4.255.247.224:54218] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 246"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFJjfdqWaUbu3e06-atQAAAQU"]
[Thu Nov 13 06:07:35.202018 2025] [:error] [pid 22566:tid 22578] [client 4.255.247.224:54262] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFJzfdqWaUbu3e06-atwAAAQo"]
[Thu Nov 13 06:07:35.202125 2025] [:error] [pid 22566:tid 22578] [client 4.255.247.224:54262] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 247"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFJzfdqWaUbu3e06-atwAAAQo"]
[Thu Nov 13 06:07:35.889601 2025] [:error] [pid 22224:tid 22302] [client 4.255.247.224:54309] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFJ7uEVuTj3a_UBfANRwAAAJY"]
[Thu Nov 13 06:07:35.889734 2025] [:error] [pid 22224:tid 22302] [client 4.255.247.224:54309] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 248"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFJ7uEVuTj3a_UBfANRwAAAJY"]
[Thu Nov 13 06:07:36.585981 2025] [:error] [pid 22224:tid 22297] [client 4.255.247.224:54353] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFKLuEVuTj3a_UBfANTQAAAJE"]
[Thu Nov 13 06:07:36.586170 2025] [:error] [pid 22224:tid 22297] [client 4.255.247.224:54353] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 249"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFKLuEVuTj3a_UBfANTQAAAJE"]
[Thu Nov 13 06:07:37.271756 2025] [:error] [pid 22566:tid 22580] [client 4.255.247.224:54398] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFKTfdqWaUbu3e06-ayQAAAQw"]
[Thu Nov 13 06:07:37.271899 2025] [:error] [pid 22566:tid 22580] [client 4.255.247.224:54398] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 250"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFKTfdqWaUbu3e06-ayQAAAQw"]
[Thu Nov 13 06:07:37.967788 2025] [:error] [pid 22222:tid 22246] [client 4.255.247.224:54445] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFKTL-5qXvQuZkA4GsTgAAABQ"]
[Thu Nov 13 06:07:37.967898 2025] [:error] [pid 22222:tid 22246] [client 4.255.247.224:54445] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 251"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFKTL-5qXvQuZkA4GsTgAAABQ"]
[Thu Nov 13 06:07:38.656332 2025] [:error] [pid 22222:tid 22241] [client 4.255.247.224:54495] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFKjL-5qXvQuZkA4GsTwAAAA8"]
[Thu Nov 13 06:07:38.656338 2025] [:error] [pid 22222:tid 22241] [client 4.255.247.224:54495] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 252"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFKjL-5qXvQuZkA4GsTwAAAA8"]
[Thu Nov 13 06:07:39.345436 2025] [:error] [pid 22224:tid 22291] [client 4.255.247.224:54533] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFK7uEVuTj3a_UBfANXgAAAIs"]
[Thu Nov 13 06:07:39.345597 2025] [:error] [pid 22224:tid 22291] [client 4.255.247.224:54533] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 253"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFK7uEVuTj3a_UBfANXgAAAIs"]
[Thu Nov 13 06:07:40.029957 2025] [:error] [pid 22566:tid 22584] [client 4.255.247.224:54577] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFLDfdqWaUbu3e06-a1AAAARA"]
[Thu Nov 13 06:07:40.030115 2025] [:error] [pid 22566:tid 22584] [client 4.255.247.224:54577] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 254"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFLDfdqWaUbu3e06-a1AAAARA"]
[Thu Nov 13 06:07:40.720783 2025] [:error] [pid 22307:tid 22309] [client 4.255.247.224:54621] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFLKr7fLMQQanZ_9yE8gAAAMA"]
[Thu Nov 13 06:07:40.720922 2025] [:error] [pid 22307:tid 22309] [client 4.255.247.224:54621] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 255"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFLKr7fLMQQanZ_9yE8gAAAMA"]
[Thu Nov 13 06:07:41.408525 2025] [:error] [pid 22223:tid 22273] [client 4.255.247.224:54664] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFLd6it_tNBGH9EAEhXgAAAFQ"]
[Thu Nov 13 06:07:41.408683 2025] [:error] [pid 22223:tid 22273] [client 4.255.247.224:54664] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 256"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFLd6it_tNBGH9EAEhXgAAAFQ"]
[Thu Nov 13 06:07:42.101359 2025] [:error] [pid 22223:tid 22263] [client 4.255.247.224:54707] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFLt6it_tNBGH9EAEhYQAAAEo"]
[Thu Nov 13 06:07:42.101516 2025] [:error] [pid 22223:tid 22263] [client 4.255.247.224:54707] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 257"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFLt6it_tNBGH9EAEhYQAAAEo"]
[Thu Nov 13 06:07:42.788193 2025] [:error] [pid 22566:tid 22579] [client 4.255.247.224:54753] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFLjfdqWaUbu3e06-a4gAAAQs"]
[Thu Nov 13 06:07:42.788343 2025] [:error] [pid 22566:tid 22579] [client 4.255.247.224:54753] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 258"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFLjfdqWaUbu3e06-a4gAAAQs"]
[Thu Nov 13 06:07:43.476746 2025] [:error] [pid 22223:tid 22272] [client 4.255.247.224:54799] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFL96it_tNBGH9EAEhagAAAFM"]
[Thu Nov 13 06:07:43.476909 2025] [:error] [pid 22223:tid 22272] [client 4.255.247.224:54799] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 259"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFL96it_tNBGH9EAEhagAAAFM"]
[Thu Nov 13 06:07:44.163296 2025] [:error] [pid 22224:tid 22298] [client 4.255.247.224:54847] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFMLuEVuTj3a_UBfANjAAAAJI"]
[Thu Nov 13 06:07:44.163491 2025] [:error] [pid 22224:tid 22298] [client 4.255.247.224:54847] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 260"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFMLuEVuTj3a_UBfANjAAAAJI"]
[Thu Nov 13 06:07:44.855589 2025] [:error] [pid 22224:tid 22296] [client 4.255.247.224:54881] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFMLuEVuTj3a_UBfANmQAAAJA"]
[Thu Nov 13 06:07:44.855716 2025] [:error] [pid 22224:tid 22296] [client 4.255.247.224:54881] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 261"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFMLuEVuTj3a_UBfANmQAAAJA"]
[Thu Nov 13 06:07:45.542703 2025] [:error] [pid 22307:tid 22315] [client 4.255.247.224:54929] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFMar7fLMQQanZ_9yFAQAAAMY"]
[Thu Nov 13 06:07:45.542834 2025] [:error] [pid 22307:tid 22315] [client 4.255.247.224:54929] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 262"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFMar7fLMQQanZ_9yFAQAAAMY"]
[Thu Nov 13 06:07:46.228014 2025] [:error] [pid 22566:tid 22571] [client 4.255.247.224:54969] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFMjfdqWaUbu3e06-a5wAAAQM"]
[Thu Nov 13 06:07:46.228188 2025] [:error] [pid 22566:tid 22571] [client 4.255.247.224:54969] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 263"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFMjfdqWaUbu3e06-a5wAAAQM"]
[Thu Nov 13 06:07:46.914771 2025] [:error] [pid 22224:tid 22304] [client 4.255.247.224:55011] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFMruEVuTj3a_UBfANsAAAAJg"]
[Thu Nov 13 06:07:46.914870 2025] [:error] [pid 22224:tid 22304] [client 4.255.247.224:55011] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 264"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFMruEVuTj3a_UBfANsAAAAJg"]
[Thu Nov 13 06:07:47.605664 2025] [:error] [pid 22566:tid 22577] [client 4.255.247.224:55061] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFMzfdqWaUbu3e06-a_QAAAQk"]
[Thu Nov 13 06:07:47.605884 2025] [:error] [pid 22566:tid 22577] [client 4.255.247.224:55061] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 265"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFMzfdqWaUbu3e06-a_QAAAQk"]
[Thu Nov 13 06:07:48.292035 2025] [:error] [pid 22223:tid 22259] [client 4.255.247.224:55102] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFNN6it_tNBGH9EAEhgwAAAEY"]
[Thu Nov 13 06:07:48.292213 2025] [:error] [pid 22223:tid 22259] [client 4.255.247.224:55102] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 266"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFNN6it_tNBGH9EAEhgwAAAEY"]
[Thu Nov 13 06:07:48.991187 2025] [:error] [pid 22222:tid 22240] [client 4.255.247.224:55147] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFNDL-5qXvQuZkA4GsdgAAAA4"]
[Thu Nov 13 06:07:48.991393 2025] [:error] [pid 22222:tid 22240] [client 4.255.247.224:55147] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 267"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFNDL-5qXvQuZkA4GsdgAAAA4"]
[Thu Nov 13 06:07:49.675979 2025] [:error] [pid 22307:tid 22309] [client 4.255.247.224:55189] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFNar7fLMQQanZ_9yFIgAAAMA"]
[Thu Nov 13 06:07:49.676081 2025] [:error] [pid 22307:tid 22309] [client 4.255.247.224:55189] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 268"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFNar7fLMQQanZ_9yFIgAAAMA"]
[Thu Nov 13 06:07:50.370641 2025] [:error] [pid 22307:tid 22324] [client 4.255.247.224:55230] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFNqr7fLMQQanZ_9yFLAAAAM8"]
[Thu Nov 13 06:07:50.370743 2025] [:error] [pid 22307:tid 22324] [client 4.255.247.224:55230] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 269"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFNqr7fLMQQanZ_9yFLAAAAM8"]
[Thu Nov 13 06:07:51.057303 2025] [:error] [pid 22223:tid 22259] [client 4.255.247.224:55270] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFN96it_tNBGH9EAEhkgAAAEY"]
[Thu Nov 13 06:07:51.057453 2025] [:error] [pid 22223:tid 22259] [client 4.255.247.224:55270] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 270"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFN96it_tNBGH9EAEhkgAAAEY"]
[Thu Nov 13 06:07:51.747398 2025] [:error] [pid 22223:tid 22263] [client 4.255.247.224:55310] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFN96it_tNBGH9EAEhlAAAAEo"]
[Thu Nov 13 06:07:51.747533 2025] [:error] [pid 22223:tid 22263] [client 4.255.247.224:55310] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 271"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFN96it_tNBGH9EAEhlAAAAEo"]
[Thu Nov 13 06:07:52.433053 2025] [:error] [pid 22566:tid 22570] [client 4.255.247.224:55353] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFODfdqWaUbu3e06-bEAAAAQI"]
[Thu Nov 13 06:07:52.433232 2025] [:error] [pid 22566:tid 22570] [client 4.255.247.224:55353] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 272"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFODfdqWaUbu3e06-bEAAAAQI"]
[Thu Nov 13 06:07:53.121214 2025] [:error] [pid 22307:tid 22324] [client 4.255.247.224:55398] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFOar7fLMQQanZ_9yFNgAAAM8"]
[Thu Nov 13 06:07:53.121358 2025] [:error] [pid 22307:tid 22324] [client 4.255.247.224:55398] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 273"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFOar7fLMQQanZ_9yFNgAAAM8"]
[Thu Nov 13 06:07:53.809543 2025] [:error] [pid 22223:tid 22257] [client 4.255.247.224:55441] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFOd6it_tNBGH9EAEhlgAAAEQ"]
[Thu Nov 13 06:07:53.809735 2025] [:error] [pid 22223:tid 22257] [client 4.255.247.224:55441] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 274"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFOd6it_tNBGH9EAEhlgAAAEQ"]
[Thu Nov 13 06:07:54.502085 2025] [:error] [pid 22566:tid 22572] [client 4.255.247.224:55480] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFOjfdqWaUbu3e06-bFwAAAQQ"]
[Thu Nov 13 06:07:54.502233 2025] [:error] [pid 22566:tid 22572] [client 4.255.247.224:55480] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 275"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFOjfdqWaUbu3e06-bFwAAAQQ"]
[Thu Nov 13 06:07:55.191745 2025] [:error] [pid 22566:tid 22579] [client 4.255.247.224:55528] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFOzfdqWaUbu3e06-bGwAAAQs"]
[Thu Nov 13 06:07:55.191935 2025] [:error] [pid 22566:tid 22579] [client 4.255.247.224:55528] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 276"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFOzfdqWaUbu3e06-bGwAAAQs"]
[Thu Nov 13 06:07:55.878982 2025] [:error] [pid 22222:tid 22231] [client 4.255.247.224:55577] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFOzL-5qXvQuZkA4GsjgAAAAU"]
[Thu Nov 13 06:07:55.879131 2025] [:error] [pid 22222:tid 22231] [client 4.255.247.224:55577] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 277"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFOzL-5qXvQuZkA4GsjgAAAAU"]
[Thu Nov 13 06:07:56.565929 2025] [:error] [pid 22566:tid 22576] [client 4.255.247.224:55614] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFPDfdqWaUbu3e06-bIgAAAQg"]
[Thu Nov 13 06:07:56.566061 2025] [:error] [pid 22566:tid 22576] [client 4.255.247.224:55614] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 278"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFPDfdqWaUbu3e06-bIgAAAQg"]
[Thu Nov 13 06:07:57.255910 2025] [:error] [pid 22222:tid 22248] [client 4.255.247.224:55654] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFPTL-5qXvQuZkA4GskQAAABY"]
[Thu Nov 13 06:07:57.256037 2025] [:error] [pid 22222:tid 22248] [client 4.255.247.224:55654] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 279"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFPTL-5qXvQuZkA4GskQAAABY"]
[Thu Nov 13 06:07:57.943887 2025] [:error] [pid 22566:tid 22583] [client 4.255.247.224:55704] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFPTfdqWaUbu3e06-bJgAAAQ8"]
[Thu Nov 13 06:07:57.944047 2025] [:error] [pid 22566:tid 22583] [client 4.255.247.224:55704] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 280"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFPTfdqWaUbu3e06-bJgAAAQ8"]
[Thu Nov 13 06:07:58.631613 2025] [:error] [pid 22224:tid 22296] [client 4.255.247.224:55746] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFPruEVuTj3a_UBfAN-wAAAJA"]
[Thu Nov 13 06:07:58.631926 2025] [:error] [pid 22224:tid 22296] [client 4.255.247.224:55746] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 281"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFPruEVuTj3a_UBfAN-wAAAJA"]
[Thu Nov 13 06:07:59.317650 2025] [:error] [pid 22223:tid 22254] [client 4.255.247.224:55797] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFP96it_tNBGH9EAEhpAAAAEE"]
[Thu Nov 13 06:07:59.317791 2025] [:error] [pid 22223:tid 22254] [client 4.255.247.224:55797] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 282"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFP96it_tNBGH9EAEhpAAAAEE"]
[Thu Nov 13 06:08:00.005765 2025] [:error] [pid 22222:tid 22231] [client 4.255.247.224:55837] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFQDL-5qXvQuZkA4GsngAAAAU"]
[Thu Nov 13 06:08:00.005887 2025] [:error] [pid 22222:tid 22231] [client 4.255.247.224:55837] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 283"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFQDL-5qXvQuZkA4GsngAAAAU"]
[Thu Nov 13 06:08:00.693614 2025] [:error] [pid 22224:tid 22285] [client 4.255.247.224:55876] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFQLuEVuTj3a_UBfAOBwAAAIU"]
[Thu Nov 13 06:08:00.693733 2025] [:error] [pid 22224:tid 22285] [client 4.255.247.224:55876] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 284"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFQLuEVuTj3a_UBfAOBwAAAIU"]
[Thu Nov 13 06:08:01.386462 2025] [:error] [pid 22223:tid 22271] [client 4.255.247.224:55926] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFQd6it_tNBGH9EAEhrQAAAFI"]
[Thu Nov 13 06:08:01.386692 2025] [:error] [pid 22223:tid 22271] [client 4.255.247.224:55926] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 285"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFQd6it_tNBGH9EAEhrQAAAFI"]
[Thu Nov 13 06:08:02.073340 2025] [:error] [pid 22224:tid 22301] [client 4.255.247.224:55971] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFQruEVuTj3a_UBfAODQAAAJU"]
[Thu Nov 13 06:08:02.073466 2025] [:error] [pid 22224:tid 22301] [client 4.255.247.224:55971] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 286"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFQruEVuTj3a_UBfAODQAAAJU"]
[Thu Nov 13 06:08:02.769067 2025] [:error] [pid 22307:tid 22326] [client 4.255.247.224:56015] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFQqr7fLMQQanZ_9yFXgAAANE"]
[Thu Nov 13 06:08:02.769276 2025] [:error] [pid 22307:tid 22326] [client 4.255.247.224:56015] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 287"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFQqr7fLMQQanZ_9yFXgAAANE"]
[Thu Nov 13 06:08:03.456547 2025] [:error] [pid 22307:tid 22318] [client 4.255.247.224:56060] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFQ6r7fLMQQanZ_9yFZAAAAMk"]
[Thu Nov 13 06:08:03.456721 2025] [:error] [pid 22307:tid 22318] [client 4.255.247.224:56060] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 288"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFQ6r7fLMQQanZ_9yFZAAAAMk"]
[Thu Nov 13 06:08:04.143739 2025] [:error] [pid 22566:tid 22591] [client 4.255.247.224:56099] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFRDfdqWaUbu3e06-bQAAAARc"]
[Thu Nov 13 06:08:04.143969 2025] [:error] [pid 22566:tid 22591] [client 4.255.247.224:56099] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 289"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFRDfdqWaUbu3e06-bQAAAARc"]
[Thu Nov 13 06:08:04.830168 2025] [:error] [pid 22566:tid 22570] [client 4.255.247.224:56147] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFRDfdqWaUbu3e06-bQwAAAQI"]
[Thu Nov 13 06:08:04.830324 2025] [:error] [pid 22566:tid 22570] [client 4.255.247.224:56147] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 290"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFRDfdqWaUbu3e06-bQwAAAQI"]
[Thu Nov 13 06:08:05.518706 2025] [:error] [pid 22307:tid 22330] [client 4.255.247.224:56195] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFRar7fLMQQanZ_9yFdQAAANU"]
[Thu Nov 13 06:08:05.518879 2025] [:error] [pid 22307:tid 22330] [client 4.255.247.224:56195] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 291"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFRar7fLMQQanZ_9yFdQAAANU"]
[Thu Nov 13 06:08:06.205392 2025] [:error] [pid 22566:tid 22588] [client 4.255.247.224:56244] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFRjfdqWaUbu3e06-bTgAAARQ"]
[Thu Nov 13 06:08:06.205533 2025] [:error] [pid 22566:tid 22588] [client 4.255.247.224:56244] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 292"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFRjfdqWaUbu3e06-bTgAAARQ"]
[Thu Nov 13 06:08:06.890697 2025] [:error] [pid 22223:tid 22269] [client 4.255.247.224:56280] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFRt6it_tNBGH9EAEhxgAAAFA"]
[Thu Nov 13 06:08:06.890885 2025] [:error] [pid 22223:tid 22269] [client 4.255.247.224:56280] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 293"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFRt6it_tNBGH9EAEhxgAAAFA"]
[Thu Nov 13 06:08:07.576540 2025] [:error] [pid 22224:tid 22291] [client 4.255.247.224:56317] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFR7uEVuTj3a_UBfAOIAAAAIs"]
[Thu Nov 13 06:08:07.576694 2025] [:error] [pid 22224:tid 22291] [client 4.255.247.224:56317] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 294"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFR7uEVuTj3a_UBfAOIAAAAIs"]
[Thu Nov 13 06:08:08.261207 2025] [:error] [pid 22223:tid 22275] [client 4.255.247.224:56356] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFSN6it_tNBGH9EAEhzAAAAFY"]
[Thu Nov 13 06:08:08.261331 2025] [:error] [pid 22223:tid 22275] [client 4.255.247.224:56356] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 295"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFSN6it_tNBGH9EAEhzAAAAFY"]
[Thu Nov 13 06:08:08.949622 2025] [:error] [pid 22566:tid 22568] [client 4.255.247.224:56393] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFSDfdqWaUbu3e06-bWAAAAQA"]
[Thu Nov 13 06:08:08.949805 2025] [:error] [pid 22566:tid 22568] [client 4.255.247.224:56393] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 296"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFSDfdqWaUbu3e06-bWAAAAQA"]
[Thu Nov 13 06:08:09.639219 2025] [:error] [pid 22307:tid 22311] [client 4.255.247.224:56432] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFSar7fLMQQanZ_9yFiQAAAMI"]
[Thu Nov 13 06:08:09.639344 2025] [:error] [pid 22307:tid 22311] [client 4.255.247.224:56432] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 297"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFSar7fLMQQanZ_9yFiQAAAMI"]
[Thu Nov 13 06:08:10.326180 2025] [:error] [pid 22566:tid 22579] [client 4.255.247.224:56471] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFSjfdqWaUbu3e06-bXAAAAQs"]
[Thu Nov 13 06:08:10.326376 2025] [:error] [pid 22566:tid 22579] [client 4.255.247.224:56471] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 298"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFSjfdqWaUbu3e06-bXAAAAQs"]
[Thu Nov 13 06:08:11.013687 2025] [:error] [pid 22566:tid 22580] [client 4.255.247.224:56512] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFSzfdqWaUbu3e06-bXgAAAQw"]
[Thu Nov 13 06:08:11.013828 2025] [:error] [pid 22566:tid 22580] [client 4.255.247.224:56512] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 299"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFSzfdqWaUbu3e06-bXgAAAQw"]
[Thu Nov 13 06:08:11.698971 2025] [:error] [pid 22224:tid 22302] [client 4.255.247.224:56553] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFS7uEVuTj3a_UBfAOKwAAAJY"]
[Thu Nov 13 06:08:11.699154 2025] [:error] [pid 22224:tid 22302] [client 4.255.247.224:56553] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 300"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFS7uEVuTj3a_UBfAOKwAAAJY"]
[Thu Nov 13 06:08:12.392508 2025] [:error] [pid 22223:tid 22257] [client 4.255.247.224:56599] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFTN6it_tNBGH9EAEh1gAAAEQ"]
[Thu Nov 13 06:08:12.392670 2025] [:error] [pid 22223:tid 22257] [client 4.255.247.224:56599] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 301"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFTN6it_tNBGH9EAEh1gAAAEQ"]
[Thu Nov 13 06:08:13.080461 2025] [:error] [pid 22222:tid 22227] [client 4.255.247.224:56641] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFTTL-5qXvQuZkA4GswgAAAAE"]
[Thu Nov 13 06:08:13.080602 2025] [:error] [pid 22222:tid 22227] [client 4.255.247.224:56641] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 302"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFTTL-5qXvQuZkA4GswgAAAAE"]
[Thu Nov 13 06:08:13.772696 2025] [:error] [pid 22566:tid 22569] [client 4.255.247.224:56691] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFTTfdqWaUbu3e06-begAAAQE"]
[Thu Nov 13 06:08:13.772841 2025] [:error] [pid 22566:tid 22569] [client 4.255.247.224:56691] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 303"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFTTfdqWaUbu3e06-begAAAQE"]
[Thu Nov 13 06:08:14.467819 2025] [:error] [pid 22222:tid 22226] [client 4.255.247.224:56730] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFTjL-5qXvQuZkA4GsxAAAAAA"]
[Thu Nov 13 06:08:14.467954 2025] [:error] [pid 22222:tid 22226] [client 4.255.247.224:56730] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 304"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFTjL-5qXvQuZkA4GsxAAAAAA"]
[Thu Nov 13 06:08:15.158215 2025] [:error] [pid 22222:tid 22248] [client 4.255.247.224:56785] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFTzL-5qXvQuZkA4GsxgAAABY"]
[Thu Nov 13 06:08:15.158388 2025] [:error] [pid 22222:tid 22248] [client 4.255.247.224:56785] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 305"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFTzL-5qXvQuZkA4GsxgAAABY"]
[Thu Nov 13 06:08:15.849985 2025] [:error] [pid 22222:tid 22242] [client 4.255.247.224:56833] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFTzL-5qXvQuZkA4GsyQAAABA"]
[Thu Nov 13 06:08:15.850170 2025] [:error] [pid 22222:tid 22242] [client 4.255.247.224:56833] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 306"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFTzL-5qXvQuZkA4GsyQAAABA"]
[Thu Nov 13 06:08:16.536107 2025] [:error] [pid 22307:tid 22328] [client 4.255.247.224:56879] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFUKr7fLMQQanZ_9yFrgAAANM"]
[Thu Nov 13 06:08:16.536287 2025] [:error] [pid 22307:tid 22328] [client 4.255.247.224:56879] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 307"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFUKr7fLMQQanZ_9yFrgAAANM"]
[Thu Nov 13 06:08:17.222260 2025] [:error] [pid 22224:tid 22292] [client 4.255.247.224:56922] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFUbuEVuTj3a_UBfAOQAAAAIw"]
[Thu Nov 13 06:08:17.222461 2025] [:error] [pid 22224:tid 22292] [client 4.255.247.224:56922] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 308"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFUbuEVuTj3a_UBfAOQAAAAIw"]
[Thu Nov 13 06:08:17.910155 2025] [:error] [pid 22307:tid 22330] [client 4.255.247.224:56967] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFUar7fLMQQanZ_9yFtQAAANU"]
[Thu Nov 13 06:08:17.910338 2025] [:error] [pid 22307:tid 22330] [client 4.255.247.224:56967] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 309"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFUar7fLMQQanZ_9yFtQAAANU"]
[Thu Nov 13 06:08:18.596989 2025] [:error] [pid 22223:tid 22266] [client 4.255.247.224:57015] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFUt6it_tNBGH9EAEh6QAAAE0"]
[Thu Nov 13 06:08:18.597146 2025] [:error] [pid 22223:tid 22266] [client 4.255.247.224:57015] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 310"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFUt6it_tNBGH9EAEh6QAAAE0"]
[Thu Nov 13 06:08:19.288692 2025] [:error] [pid 22307:tid 22323] [client 4.255.247.224:57059] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFU6r7fLMQQanZ_9yFvAAAAM4"]
[Thu Nov 13 06:08:19.288832 2025] [:error] [pid 22307:tid 22323] [client 4.255.247.224:57059] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 311"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFU6r7fLMQQanZ_9yFvAAAAM4"]
[Thu Nov 13 06:08:19.978558 2025] [:error] [pid 22224:tid 22296] [client 4.255.247.224:57102] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFU7uEVuTj3a_UBfAORAAAAJA"]
[Thu Nov 13 06:08:19.978710 2025] [:error] [pid 22224:tid 22296] [client 4.255.247.224:57102] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 312"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFU7uEVuTj3a_UBfAORAAAAJA"]
[Thu Nov 13 06:08:20.670939 2025] [:error] [pid 22223:tid 22262] [client 4.255.247.224:57139] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFVN6it_tNBGH9EAEh8AAAAEk"]
[Thu Nov 13 06:08:20.671077 2025] [:error] [pid 22223:tid 22262] [client 4.255.247.224:57139] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 313"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFVN6it_tNBGH9EAEh8AAAAEk"]
[Thu Nov 13 06:08:21.359680 2025] [:error] [pid 22224:tid 22298] [client 4.255.247.224:57176] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFVbuEVuTj3a_UBfAOSwAAAJI"]
[Thu Nov 13 06:08:21.359820 2025] [:error] [pid 22224:tid 22298] [client 4.255.247.224:57176] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 314"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFVbuEVuTj3a_UBfAOSwAAAJI"]
[Thu Nov 13 06:08:22.048123 2025] [:error] [pid 22224:tid 22286] [client 4.255.247.224:57217] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFVruEVuTj3a_UBfAOTQAAAIY"]
[Thu Nov 13 06:08:22.048375 2025] [:error] [pid 22224:tid 22286] [client 4.255.247.224:57217] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 315"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFVruEVuTj3a_UBfAOTQAAAIY"]
[Thu Nov 13 06:08:22.737337 2025] [:error] [pid 22223:tid 22275] [client 4.255.247.224:57265] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFVt6it_tNBGH9EAEh8wAAAFY"]
[Thu Nov 13 06:08:22.737478 2025] [:error] [pid 22223:tid 22275] [client 4.255.247.224:57265] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 316"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFVt6it_tNBGH9EAEh8wAAAFY"]
[Thu Nov 13 06:08:23.433879 2025] [:error] [pid 22224:tid 22284] [client 4.255.247.224:57300] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFV7uEVuTj3a_UBfAOWAAAAIQ"]
[Thu Nov 13 06:08:23.434020 2025] [:error] [pid 22224:tid 22284] [client 4.255.247.224:57300] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 317"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFV7uEVuTj3a_UBfAOWAAAAIQ"]
[Thu Nov 13 06:08:24.124968 2025] [:error] [pid 22566:tid 22584] [client 4.255.247.224:57345] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFWDfdqWaUbu3e06-bpAAAARA"]
[Thu Nov 13 06:08:24.125155 2025] [:error] [pid 22566:tid 22584] [client 4.255.247.224:57345] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 318"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFWDfdqWaUbu3e06-bpAAAARA"]
[Thu Nov 13 06:08:24.814203 2025] [:error] [pid 22223:tid 22253] [client 4.255.247.224:57391] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFWN6it_tNBGH9EAEh-AAAAEA"]
[Thu Nov 13 06:08:24.814374 2025] [:error] [pid 22223:tid 22253] [client 4.255.247.224:57391] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 319"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFWN6it_tNBGH9EAEh-AAAAEA"]
[Thu Nov 13 06:08:25.504813 2025] [:error] [pid 22224:tid 22287] [client 4.255.247.224:57433] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFWbuEVuTj3a_UBfAOYAAAAIc"]
[Thu Nov 13 06:08:25.504958 2025] [:error] [pid 22224:tid 22287] [client 4.255.247.224:57433] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 320"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFWbuEVuTj3a_UBfAOYAAAAIc"]
[Thu Nov 13 06:08:26.193898 2025] [:error] [pid 22307:tid 22311] [client 4.255.247.224:57481] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFWqr7fLMQQanZ_9yF1wAAAMI"]
[Thu Nov 13 06:08:26.194066 2025] [:error] [pid 22307:tid 22311] [client 4.255.247.224:57481] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 321"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFWqr7fLMQQanZ_9yF1wAAAMI"]
[Thu Nov 13 06:08:26.884815 2025] [:error] [pid 22223:tid 22260] [client 4.255.247.224:57529] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFWt6it_tNBGH9EAEiBAAAAEc"]
[Thu Nov 13 06:08:26.884961 2025] [:error] [pid 22223:tid 22260] [client 4.255.247.224:57529] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 322"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFWt6it_tNBGH9EAEiBAAAAEc"]
[Thu Nov 13 06:08:27.571565 2025] [:error] [pid 22566:tid 22571] [client 4.255.247.224:57567] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFWzfdqWaUbu3e06-brgAAAQM"]
[Thu Nov 13 06:08:27.571717 2025] [:error] [pid 22566:tid 22571] [client 4.255.247.224:57567] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 323"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFWzfdqWaUbu3e06-brgAAAQM"]
[Thu Nov 13 06:08:28.263980 2025] [:error] [pid 22222:tid 22231] [client 4.255.247.224:57603] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFXDL-5qXvQuZkA4Gs7AAAAAU"]
[Thu Nov 13 06:08:28.264175 2025] [:error] [pid 22222:tid 22231] [client 4.255.247.224:57603] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 324"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFXDL-5qXvQuZkA4Gs7AAAAAU"]
[Thu Nov 13 06:08:28.952015 2025] [:error] [pid 22566:tid 22586] [client 4.255.247.224:57644] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFXDfdqWaUbu3e06-bsQAAARI"]
[Thu Nov 13 06:08:28.952201 2025] [:error] [pid 22566:tid 22586] [client 4.255.247.224:57644] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 325"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFXDfdqWaUbu3e06-bsQAAARI"]
[Thu Nov 13 06:08:29.638808 2025] [:error] [pid 22224:tid 22301] [client 4.255.247.224:57683] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFXbuEVuTj3a_UBfAOaAAAAJU"]
[Thu Nov 13 06:08:29.638986 2025] [:error] [pid 22224:tid 22301] [client 4.255.247.224:57683] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 326"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFXbuEVuTj3a_UBfAOaAAAAJU"]
[Thu Nov 13 06:08:30.325530 2025] [:error] [pid 22566:tid 22577] [client 4.255.247.224:57714] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFXjfdqWaUbu3e06-buQAAAQk"]
[Thu Nov 13 06:08:30.325696 2025] [:error] [pid 22566:tid 22577] [client 4.255.247.224:57714] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 327"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFXjfdqWaUbu3e06-buQAAAQk"]
[Thu Nov 13 06:08:31.014128 2025] [:error] [pid 22566:tid 22586] [client 4.255.247.224:57754] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFXzfdqWaUbu3e06-bvwAAARI"]
[Thu Nov 13 06:08:31.014271 2025] [:error] [pid 22566:tid 22586] [client 4.255.247.224:57754] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 328"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFXzfdqWaUbu3e06-bvwAAARI"]
[Thu Nov 13 06:08:31.700938 2025] [:error] [pid 22223:tid 22267] [client 4.255.247.224:57799] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFX96it_tNBGH9EAEiFAAAAE4"]
[Thu Nov 13 06:08:31.701061 2025] [:error] [pid 22223:tid 22267] [client 4.255.247.224:57799] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 329"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFX96it_tNBGH9EAEiFAAAAE4"]
[Thu Nov 13 06:08:32.395338 2025] [:error] [pid 22566:tid 22589] [client 4.255.247.224:57837] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFYDfdqWaUbu3e06-bxwAAARU"]
[Thu Nov 13 06:08:32.395584 2025] [:error] [pid 22566:tid 22589] [client 4.255.247.224:57837] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 330"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFYDfdqWaUbu3e06-bxwAAARU"]
[Thu Nov 13 06:08:33.080211 2025] [:error] [pid 22222:tid 22231] [client 4.255.247.224:57893] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFYTL-5qXvQuZkA4Gs-QAAAAU"]
[Thu Nov 13 06:08:33.080344 2025] [:error] [pid 22222:tid 22231] [client 4.255.247.224:57893] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 331"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFYTL-5qXvQuZkA4Gs-QAAAAU"]
[Thu Nov 13 06:08:33.772692 2025] [:error] [pid 22307:tid 22310] [client 4.255.247.224:57950] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFYar7fLMQQanZ_9yF7QAAAME"]
[Thu Nov 13 06:08:33.772880 2025] [:error] [pid 22307:tid 22310] [client 4.255.247.224:57950] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 332"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFYar7fLMQQanZ_9yF7QAAAME"]
[Thu Nov 13 06:08:34.460154 2025] [:error] [pid 22307:tid 22330] [client 4.255.247.224:57996] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFYqr7fLMQQanZ_9yF8QAAANU"]
[Thu Nov 13 06:08:34.460304 2025] [:error] [pid 22307:tid 22330] [client 4.255.247.224:57996] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 333"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFYqr7fLMQQanZ_9yF8QAAANU"]
[Thu Nov 13 06:08:35.155640 2025] [:error] [pid 22224:tid 22294] [client 4.255.247.224:58045] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFY7uEVuTj3a_UBfAOegAAAI4"]
[Thu Nov 13 06:08:35.155761 2025] [:error] [pid 22224:tid 22294] [client 4.255.247.224:58045] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 334"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFY7uEVuTj3a_UBfAOegAAAI4"]
[Thu Nov 13 06:08:35.841482 2025] [:error] [pid 22224:tid 22290] [client 4.255.247.224:58089] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFY7uEVuTj3a_UBfAOhQAAAIo"]
[Thu Nov 13 06:08:35.841645 2025] [:error] [pid 22224:tid 22290] [client 4.255.247.224:58089] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 335"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFY7uEVuTj3a_UBfAOhQAAAIo"]
[Thu Nov 13 06:08:36.542416 2025] [:error] [pid 22222:tid 22245] [client 4.255.247.224:58136] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFZDL-5qXvQuZkA4GtAAAAABM"]
[Thu Nov 13 06:08:36.542567 2025] [:error] [pid 22222:tid 22245] [client 4.255.247.224:58136] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 336"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFZDL-5qXvQuZkA4GtAAAAABM"]
[Thu Nov 13 06:08:37.231582 2025] [:error] [pid 22223:tid 22256] [client 4.255.247.224:58174] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFZd6it_tNBGH9EAEiHQAAAEM"]
[Thu Nov 13 06:08:37.231774 2025] [:error] [pid 22223:tid 22256] [client 4.255.247.224:58174] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 337"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFZd6it_tNBGH9EAEiHQAAAEM"]
[Thu Nov 13 06:08:37.923798 2025] [:error] [pid 22223:tid 22272] [client 4.255.247.224:58225] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFZd6it_tNBGH9EAEiIQAAAFM"]
[Thu Nov 13 06:08:37.923928 2025] [:error] [pid 22223:tid 22272] [client 4.255.247.224:58225] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 338"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFZd6it_tNBGH9EAEiIQAAAFM"]
[Thu Nov 13 06:08:38.610772 2025] [:error] [pid 22223:tid 22254] [client 4.255.247.224:58263] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFZt6it_tNBGH9EAEiIgAAAEE"]
[Thu Nov 13 06:08:38.610928 2025] [:error] [pid 22223:tid 22254] [client 4.255.247.224:58263] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 339"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFZt6it_tNBGH9EAEiIgAAAEE"]
[Thu Nov 13 06:08:39.306944 2025] [:error] [pid 22222:tid 22250] [client 4.255.247.224:58304] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFZzL-5qXvQuZkA4GtBwAAABg"]
[Thu Nov 13 06:08:39.307114 2025] [:error] [pid 22222:tid 22250] [client 4.255.247.224:58304] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 340"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFZzL-5qXvQuZkA4GtBwAAABg"]
[Thu Nov 13 06:08:39.992977 2025] [:error] [pid 22224:tid 22280] [client 4.255.247.224:58346] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFZ7uEVuTj3a_UBfAOlQAAAIA"]
[Thu Nov 13 06:08:39.993131 2025] [:error] [pid 22224:tid 22280] [client 4.255.247.224:58346] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 341"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFZ7uEVuTj3a_UBfAOlQAAAIA"]
[Thu Nov 13 06:08:40.694752 2025] [:error] [pid 22307:tid 22320] [client 4.255.247.224:58389] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFaKr7fLMQQanZ_9yGCQAAAMs"]
[Thu Nov 13 06:08:40.694887 2025] [:error] [pid 22307:tid 22320] [client 4.255.247.224:58389] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 342"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFaKr7fLMQQanZ_9yGCQAAAMs"]
[Thu Nov 13 06:08:41.391137 2025] [:error] [pid 22223:tid 22263] [client 4.255.247.224:58438] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFad6it_tNBGH9EAEiKAAAAEo"]
[Thu Nov 13 06:08:41.391273 2025] [:error] [pid 22223:tid 22263] [client 4.255.247.224:58438] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 343"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFad6it_tNBGH9EAEiKAAAAEo"]
[Thu Nov 13 06:08:42.102999 2025] [:error] [pid 22223:tid 22276] [client 4.255.247.224:58485] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFat6it_tNBGH9EAEiKwAAAFc"]
[Thu Nov 13 06:08:42.103190 2025] [:error] [pid 22223:tid 22276] [client 4.255.247.224:58485] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 344"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFat6it_tNBGH9EAEiKwAAAFc"]
[Thu Nov 13 06:08:42.789164 2025] [:error] [pid 22223:tid 22255] [client 4.255.247.224:58532] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFat6it_tNBGH9EAEiLgAAAEI"]
[Thu Nov 13 06:08:42.789335 2025] [:error] [pid 22223:tid 22255] [client 4.255.247.224:58532] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 345"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFat6it_tNBGH9EAEiLgAAAEI"]
[Thu Nov 13 06:08:43.483903 2025] [:error] [pid 22223:tid 22262] [client 4.255.247.224:58578] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFa96it_tNBGH9EAEiPAAAAEk"]
[Thu Nov 13 06:08:43.484039 2025] [:error] [pid 22223:tid 22262] [client 4.255.247.224:58578] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 346"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFa96it_tNBGH9EAEiPAAAAEk"]
[Thu Nov 13 06:08:44.172447 2025] [:error] [pid 22223:tid 22266] [client 4.255.247.224:58620] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFbN6it_tNBGH9EAEiQgAAAE0"]
[Thu Nov 13 06:08:44.172634 2025] [:error] [pid 22223:tid 22266] [client 4.255.247.224:58620] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 347"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFbN6it_tNBGH9EAEiQgAAAE0"]
[Thu Nov 13 06:08:44.860461 2025] [:error] [pid 22566:tid 22576] [client 4.255.247.224:58661] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFbDfdqWaUbu3e06-b8wAAAQg"]
[Thu Nov 13 06:08:44.860649 2025] [:error] [pid 22566:tid 22576] [client 4.255.247.224:58661] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 348"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFbDfdqWaUbu3e06-b8wAAAQg"]
[Thu Nov 13 06:08:45.548068 2025] [:error] [pid 22223:tid 22271] [client 4.255.247.224:58713] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFbd6it_tNBGH9EAEiSwAAAFI"]
[Thu Nov 13 06:08:45.548247 2025] [:error] [pid 22223:tid 22271] [client 4.255.247.224:58713] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 349"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFbd6it_tNBGH9EAEiSwAAAFI"]
[Thu Nov 13 06:08:46.235838 2025] [:error] [pid 22224:tid 22283] [client 4.255.247.224:58762] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFbruEVuTj3a_UBfAOowAAAIM"]
[Thu Nov 13 06:08:46.236038 2025] [:error] [pid 22224:tid 22283] [client 4.255.247.224:58762] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 350"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFbruEVuTj3a_UBfAOowAAAIM"]
[Thu Nov 13 06:08:46.922761 2025] [:error] [pid 22566:tid 22586] [client 4.255.247.224:58807] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFbjfdqWaUbu3e06-b_wAAARI"]
[Thu Nov 13 06:08:46.922962 2025] [:error] [pid 22566:tid 22586] [client 4.255.247.224:58807] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 351"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFbjfdqWaUbu3e06-b_wAAARI"]
[Thu Nov 13 06:08:47.609460 2025] [:error] [pid 22566:tid 22571] [client 4.255.247.224:58857] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFbzfdqWaUbu3e06-cBAAAAQM"]
[Thu Nov 13 06:08:47.609611 2025] [:error] [pid 22566:tid 22571] [client 4.255.247.224:58857] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 351"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFbzfdqWaUbu3e06-cBAAAAQM"]
[Thu Nov 13 06:08:48.298296 2025] [:error] [pid 22566:tid 22588] [client 4.255.247.224:58907] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFcDfdqWaUbu3e06-cBwAAARQ"]
[Thu Nov 13 06:08:48.298500 2025] [:error] [pid 22566:tid 22588] [client 4.255.247.224:58907] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 353"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFcDfdqWaUbu3e06-cBwAAARQ"]
[Thu Nov 13 06:08:48.995558 2025] [:error] [pid 22566:tid 22580] [client 4.255.247.224:58944] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFcDfdqWaUbu3e06-cDQAAAQw"]
[Thu Nov 13 06:08:48.995749 2025] [:error] [pid 22566:tid 22580] [client 4.255.247.224:58944] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 354"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFcDfdqWaUbu3e06-cDQAAAQw"]
[Thu Nov 13 06:08:49.682750 2025] [:error] [pid 22223:tid 22266] [client 4.255.247.224:58989] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFcd6it_tNBGH9EAEiTQAAAE0"]
[Thu Nov 13 06:08:49.682888 2025] [:error] [pid 22223:tid 22266] [client 4.255.247.224:58989] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 355"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFcd6it_tNBGH9EAEiTQAAAE0"]
[Thu Nov 13 06:08:50.373113 2025] [:error] [pid 22566:tid 22592] [client 4.255.247.224:59027] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFcjfdqWaUbu3e06-cEgAAARg"]
[Thu Nov 13 06:08:50.373267 2025] [:error] [pid 22566:tid 22592] [client 4.255.247.224:59027] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 356"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFcjfdqWaUbu3e06-cEgAAARg"]
[Thu Nov 13 06:08:51.059151 2025] [:error] [pid 22223:tid 22259] [client 4.255.247.224:59070] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFc96it_tNBGH9EAEiTgAAAEY"]
[Thu Nov 13 06:08:51.059278 2025] [:error] [pid 22223:tid 22259] [client 4.255.247.224:59070] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 356"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFc96it_tNBGH9EAEiTgAAAEY"]
[Thu Nov 13 06:08:51.754856 2025] [:error] [pid 22223:tid 22268] [client 4.255.247.224:59103] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFc96it_tNBGH9EAEiUwAAAE8"]
[Thu Nov 13 06:08:51.755033 2025] [:error] [pid 22223:tid 22268] [client 4.255.247.224:59103] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 358"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFc96it_tNBGH9EAEiUwAAAE8"]
[Thu Nov 13 06:08:52.440893 2025] [:error] [pid 22222:tid 22231] [client 4.255.247.224:59151] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFdDL-5qXvQuZkA4GtLAAAAAU"]
[Thu Nov 13 06:08:52.441065 2025] [:error] [pid 22222:tid 22231] [client 4.255.247.224:59151] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 359"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFdDL-5qXvQuZkA4GtLAAAAAU"]
[Thu Nov 13 06:08:53.142622 2025] [:error] [pid 22307:tid 22321] [client 4.255.247.224:59197] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFdar7fLMQQanZ_9yGLAAAAMw"]
[Thu Nov 13 06:08:53.142813 2025] [:error] [pid 22307:tid 22321] [client 4.255.247.224:59197] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 360"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFdar7fLMQQanZ_9yGLAAAAMw"]
[Thu Nov 13 06:08:53.830005 2025] [:error] [pid 22224:tid 22294] [client 4.255.247.224:59236] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFdbuEVuTj3a_UBfAOuAAAAI4"]
[Thu Nov 13 06:08:53.830136 2025] [:error] [pid 22224:tid 22294] [client 4.255.247.224:59236] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 361"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFdbuEVuTj3a_UBfAOuAAAAI4"]
[Thu Nov 13 06:08:54.522394 2025] [:error] [pid 22307:tid 22324] [client 4.255.247.224:59275] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFdqr7fLMQQanZ_9yGMQAAAM8"]
[Thu Nov 13 06:08:54.522618 2025] [:error] [pid 22307:tid 22324] [client 4.255.247.224:59275] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 362"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFdqr7fLMQQanZ_9yGMQAAAM8"]
[Thu Nov 13 06:08:55.210447 2025] [:error] [pid 22566:tid 22577] [client 4.255.247.224:59319] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFdzfdqWaUbu3e06-cKAAAAQk"]
[Thu Nov 13 06:08:55.210671 2025] [:error] [pid 22566:tid 22577] [client 4.255.247.224:59319] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 363"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFdzfdqWaUbu3e06-cKAAAAQk"]
[Thu Nov 13 06:08:55.901759 2025] [:error] [pid 22224:tid 22288] [client 4.255.247.224:59357] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFd7uEVuTj3a_UBfAOvAAAAIg"]
[Thu Nov 13 06:08:55.901865 2025] [:error] [pid 22224:tid 22288] [client 4.255.247.224:59357] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 364"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFd7uEVuTj3a_UBfAOvAAAAIg"]
[Thu Nov 13 06:08:56.598332 2025] [:error] [pid 22223:tid 22268] [client 4.255.247.224:59393] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFeN6it_tNBGH9EAEiawAAAE8"]
[Thu Nov 13 06:08:56.598437 2025] [:error] [pid 22223:tid 22268] [client 4.255.247.224:59393] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 365"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFeN6it_tNBGH9EAEiawAAAE8"]
[Thu Nov 13 06:08:57.285250 2025] [:error] [pid 22222:tid 22226] [client 4.255.247.224:59439] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFeTL-5qXvQuZkA4GtOAAAAAA"]
[Thu Nov 13 06:08:57.285423 2025] [:error] [pid 22222:tid 22226] [client 4.255.247.224:59439] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 366"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFeTL-5qXvQuZkA4GtOAAAAAA"]
[Thu Nov 13 06:08:57.977970 2025] [:error] [pid 22222:tid 22241] [client 4.255.247.224:59478] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFeTL-5qXvQuZkA4GtOgAAAA8"]
[Thu Nov 13 06:08:57.978105 2025] [:error] [pid 22222:tid 22241] [client 4.255.247.224:59478] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 367"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFeTL-5qXvQuZkA4GtOgAAAA8"]
[Thu Nov 13 06:08:58.671731 2025] [:error] [pid 22223:tid 22264] [client 4.255.247.224:59525] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFet6it_tNBGH9EAEibwAAAEs"]
[Thu Nov 13 06:08:58.671868 2025] [:error] [pid 22223:tid 22264] [client 4.255.247.224:59525] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 368"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFet6it_tNBGH9EAEibwAAAEs"]
[Thu Nov 13 06:08:59.360233 2025] [:error] [pid 22223:tid 22265] [client 4.255.247.224:59574] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFe96it_tNBGH9EAEicQAAAEw"]
[Thu Nov 13 06:08:59.360454 2025] [:error] [pid 22223:tid 22265] [client 4.255.247.224:59574] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 369"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFe96it_tNBGH9EAEicQAAAEw"]
[Thu Nov 13 06:09:00.047511 2025] [:error] [pid 22307:tid 22321] [client 4.255.247.224:59625] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFfKr7fLMQQanZ_9yGQgAAAMw"]
[Thu Nov 13 06:09:00.047694 2025] [:error] [pid 22307:tid 22321] [client 4.255.247.224:59625] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 370"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFfKr7fLMQQanZ_9yGQgAAAMw"]
[Thu Nov 13 06:09:00.736228 2025] [:error] [pid 22223:tid 22259] [client 4.255.247.224:59671] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFfN6it_tNBGH9EAEidAAAAEY"]
[Thu Nov 13 06:09:00.736342 2025] [:error] [pid 22223:tid 22259] [client 4.255.247.224:59671] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 371"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFfN6it_tNBGH9EAEidAAAAEY"]
[Thu Nov 13 06:09:01.421037 2025] [:error] [pid 22223:tid 22267] [client 4.255.247.224:59708] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFfd6it_tNBGH9EAEidgAAAE4"]
[Thu Nov 13 06:09:01.421179 2025] [:error] [pid 22223:tid 22267] [client 4.255.247.224:59708] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 372"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFfd6it_tNBGH9EAEidgAAAE4"]
[Thu Nov 13 06:09:02.105322 2025] [:error] [pid 22307:tid 22316] [client 4.255.247.224:59751] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFfqr7fLMQQanZ_9yGRAAAAMc"]
[Thu Nov 13 06:09:02.105436 2025] [:error] [pid 22307:tid 22316] [client 4.255.247.224:59751] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 373"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFfqr7fLMQQanZ_9yGRAAAAMc"]
[Thu Nov 13 06:09:02.801562 2025] [:error] [pid 22566:tid 22590] [client 4.255.247.224:59799] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFfjfdqWaUbu3e06-cOwAAARY"]
[Thu Nov 13 06:09:02.801680 2025] [:error] [pid 22566:tid 22590] [client 4.255.247.224:59799] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 374"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFfjfdqWaUbu3e06-cOwAAARY"]
[Thu Nov 13 06:09:03.489205 2025] [:error] [pid 22224:tid 22296] [client 4.255.247.224:59842] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFf7uEVuTj3a_UBfAOzgAAAJA"]
[Thu Nov 13 06:09:03.489327 2025] [:error] [pid 22224:tid 22296] [client 4.255.247.224:59842] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 375"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFf7uEVuTj3a_UBfAOzgAAAJA"]
[Thu Nov 13 06:09:04.175480 2025] [:error] [pid 22566:tid 22579] [client 4.255.247.224:59877] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFgDfdqWaUbu3e06-cQAAAAQs"]
[Thu Nov 13 06:09:04.175650 2025] [:error] [pid 22566:tid 22579] [client 4.255.247.224:59877] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 376"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFgDfdqWaUbu3e06-cQAAAAQs"]
[Thu Nov 13 06:09:04.862177 2025] [:error] [pid 22307:tid 22313] [client 4.255.247.224:59918] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFgKr7fLMQQanZ_9yGTAAAAMQ"]
[Thu Nov 13 06:09:04.862323 2025] [:error] [pid 22307:tid 22313] [client 4.255.247.224:59918] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 377"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFgKr7fLMQQanZ_9yGTAAAAMQ"]
[Thu Nov 13 06:09:05.548834 2025] [:error] [pid 22223:tid 22277] [client 4.255.247.224:59957] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFgd6it_tNBGH9EAEigwAAAFg"]
[Thu Nov 13 06:09:05.548997 2025] [:error] [pid 22223:tid 22277] [client 4.255.247.224:59957] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 378"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFgd6it_tNBGH9EAEigwAAAFg"]
[Thu Nov 13 06:09:06.235030 2025] [:error] [pid 22307:tid 22324] [client 4.255.247.224:59996] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFgqr7fLMQQanZ_9yGVQAAAM8"]
[Thu Nov 13 06:09:06.235208 2025] [:error] [pid 22307:tid 22324] [client 4.255.247.224:59996] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 379"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFgqr7fLMQQanZ_9yGVQAAAM8"]
[Thu Nov 13 06:09:06.920965 2025] [:error] [pid 22307:tid 22322] [client 4.255.247.224:60044] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFgqr7fLMQQanZ_9yGXwAAAM0"]
[Thu Nov 13 06:09:06.921183 2025] [:error] [pid 22307:tid 22322] [client 4.255.247.224:60044] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 380"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFgqr7fLMQQanZ_9yGXwAAAM0"]
[Thu Nov 13 06:09:07.607354 2025] [:error] [pid 22566:tid 22568] [client 4.255.247.224:60079] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFgzfdqWaUbu3e06-cSAAAAQA"]
[Thu Nov 13 06:09:07.607563 2025] [:error] [pid 22566:tid 22568] [client 4.255.247.224:60079] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 381"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFgzfdqWaUbu3e06-cSAAAAQA"]
[Thu Nov 13 06:09:08.293668 2025] [:error] [pid 22307:tid 22333] [client 4.255.247.224:60129] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFhKr7fLMQQanZ_9yGdAAAANg"]
[Thu Nov 13 06:09:08.293865 2025] [:error] [pid 22307:tid 22333] [client 4.255.247.224:60129] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 382"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFhKr7fLMQQanZ_9yGdAAAANg"]
[Thu Nov 13 06:09:08.988687 2025] [:error] [pid 22566:tid 22573] [client 4.255.247.224:60163] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFhDfdqWaUbu3e06-cTAAAAQU"]
[Thu Nov 13 06:09:08.988830 2025] [:error] [pid 22566:tid 22573] [client 4.255.247.224:60163] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 383"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFhDfdqWaUbu3e06-cTAAAAQU"]
[Thu Nov 13 06:09:09.675334 2025] [:error] [pid 22224:tid 22281] [client 4.255.247.224:60203] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFhbuEVuTj3a_UBfAO7gAAAIE"]
[Thu Nov 13 06:09:09.675480 2025] [:error] [pid 22224:tid 22281] [client 4.255.247.224:60203] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 384"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFhbuEVuTj3a_UBfAO7gAAAIE"]
[Thu Nov 13 06:09:10.366062 2025] [:error] [pid 22223:tid 22259] [client 4.255.247.224:60237] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFht6it_tNBGH9EAEilwAAAEY"]
[Thu Nov 13 06:09:10.366166 2025] [:error] [pid 22223:tid 22259] [client 4.255.247.224:60237] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 385"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFht6it_tNBGH9EAEilwAAAEY"]
[Thu Nov 13 06:09:11.052970 2025] [:error] [pid 22307:tid 22332] [client 4.255.247.224:60281] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFh6r7fLMQQanZ_9yGegAAANc"]
[Thu Nov 13 06:09:11.053185 2025] [:error] [pid 22307:tid 22332] [client 4.255.247.224:60281] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 386"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFh6r7fLMQQanZ_9yGegAAANc"]
[Thu Nov 13 06:09:11.739030 2025] [:error] [pid 22222:tid 22247] [client 4.255.247.224:60312] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFhzL-5qXvQuZkA4GtWgAAABU"]
[Thu Nov 13 06:09:11.739167 2025] [:error] [pid 22222:tid 22247] [client 4.255.247.224:60312] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 387"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFhzL-5qXvQuZkA4GtWgAAABU"]
[Thu Nov 13 06:09:12.426064 2025] [:error] [pid 22224:tid 22296] [client 4.255.247.224:60356] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFiLuEVuTj3a_UBfAO9QAAAJA"]
[Thu Nov 13 06:09:12.426218 2025] [:error] [pid 22224:tid 22296] [client 4.255.247.224:60356] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 388"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFiLuEVuTj3a_UBfAO9QAAAJA"]
[Thu Nov 13 06:09:13.112597 2025] [:error] [pid 22222:tid 22229] [client 4.255.247.224:60399] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFiTL-5qXvQuZkA4GtXAAAAAM"]
[Thu Nov 13 06:09:13.112691 2025] [:error] [pid 22222:tid 22229] [client 4.255.247.224:60399] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 389"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFiTL-5qXvQuZkA4GtXAAAAAM"]
[Thu Nov 13 06:09:13.813044 2025] [:error] [pid 22566:tid 22578] [client 4.255.247.224:60434] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFiTfdqWaUbu3e06-cYgAAAQo"]
[Thu Nov 13 06:09:13.813201 2025] [:error] [pid 22566:tid 22578] [client 4.255.247.224:60434] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 390"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFiTfdqWaUbu3e06-cYgAAAQo"]
[Thu Nov 13 06:09:14.499156 2025] [:error] [pid 22307:tid 22313] [client 4.255.247.224:60472] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFiqr7fLMQQanZ_9yGgwAAAMQ"]
[Thu Nov 13 06:09:14.499315 2025] [:error] [pid 22307:tid 22313] [client 4.255.247.224:60472] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 391"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFiqr7fLMQQanZ_9yGgwAAAMQ"]
[Thu Nov 13 06:09:15.189517 2025] [:error] [pid 22222:tid 22230] [client 4.255.247.224:60507] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFizL-5qXvQuZkA4GtXwAAAAQ"]
[Thu Nov 13 06:09:15.189692 2025] [:error] [pid 22222:tid 22230] [client 4.255.247.224:60507] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 392"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFizL-5qXvQuZkA4GtXwAAAAQ"]
[Thu Nov 13 06:09:15.875772 2025] [:error] [pid 22307:tid 22314] [client 4.255.247.224:60543] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFi6r7fLMQQanZ_9yGhgAAAMU"]
[Thu Nov 13 06:09:15.875949 2025] [:error] [pid 22307:tid 22314] [client 4.255.247.224:60543] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 393"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFi6r7fLMQQanZ_9yGhgAAAMU"]
[Thu Nov 13 06:09:16.567701 2025] [:error] [pid 22307:tid 22321] [client 4.255.247.224:60582] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFjKr7fLMQQanZ_9yGiAAAAMw"]
[Thu Nov 13 06:09:16.567857 2025] [:error] [pid 22307:tid 22321] [client 4.255.247.224:60582] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 394"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFjKr7fLMQQanZ_9yGiAAAAMw"]
[Thu Nov 13 06:09:17.260333 2025] [:error] [pid 22223:tid 22273] [client 4.255.247.224:60616] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFjd6it_tNBGH9EAEioQAAAFQ"]
[Thu Nov 13 06:09:17.260533 2025] [:error] [pid 22223:tid 22273] [client 4.255.247.224:60616] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 395"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFjd6it_tNBGH9EAEioQAAAFQ"]
[Thu Nov 13 06:09:17.952921 2025] [:error] [pid 22566:tid 22573] [client 4.255.247.224:60657] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFjTfdqWaUbu3e06-cawAAAQU"]
[Thu Nov 13 06:09:17.953126 2025] [:error] [pid 22566:tid 22573] [client 4.255.247.224:60657] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 396"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFjTfdqWaUbu3e06-cawAAAQU"]
[Thu Nov 13 06:09:18.641712 2025] [:error] [pid 22224:tid 22300] [client 4.255.247.224:60708] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFjruEVuTj3a_UBfAPBgAAAJQ"]
[Thu Nov 13 06:09:18.641875 2025] [:error] [pid 22224:tid 22300] [client 4.255.247.224:60708] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 397"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFjruEVuTj3a_UBfAPBgAAAJQ"]
[Thu Nov 13 06:09:19.336700 2025] [:error] [pid 22224:tid 22294] [client 4.255.247.224:60747] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFj7uEVuTj3a_UBfAPCAAAAI4"]
[Thu Nov 13 06:09:19.336861 2025] [:error] [pid 22224:tid 22294] [client 4.255.247.224:60747] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 398"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFj7uEVuTj3a_UBfAPCAAAAI4"]
[Thu Nov 13 06:09:20.024861 2025] [:error] [pid 22223:tid 22266] [client 4.255.247.224:60799] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFkN6it_tNBGH9EAEipwAAAE0"]
[Thu Nov 13 06:09:20.025046 2025] [:error] [pid 22223:tid 22266] [client 4.255.247.224:60799] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 399"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFkN6it_tNBGH9EAEipwAAAE0"]
[Thu Nov 13 06:09:20.720206 2025] [:error] [pid 22224:tid 22281] [client 4.255.247.224:60837] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFkLuEVuTj3a_UBfAPEAAAAIE"]
[Thu Nov 13 06:09:20.720349 2025] [:error] [pid 22224:tid 22281] [client 4.255.247.224:60837] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 400"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFkLuEVuTj3a_UBfAPEAAAAIE"]
[Thu Nov 13 06:09:21.408642 2025] [:error] [pid 22224:tid 22295] [client 4.255.247.224:60880] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFkbuEVuTj3a_UBfAPEwAAAI8"]
[Thu Nov 13 06:09:21.408805 2025] [:error] [pid 22224:tid 22295] [client 4.255.247.224:60880] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 401"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFkbuEVuTj3a_UBfAPEwAAAI8"]
[Thu Nov 13 06:09:22.107501 2025] [:error] [pid 22223:tid 22265] [client 4.255.247.224:60920] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFkt6it_tNBGH9EAEiqgAAAEw"]
[Thu Nov 13 06:09:22.107718 2025] [:error] [pid 22223:tid 22265] [client 4.255.247.224:60920] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 402"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFkt6it_tNBGH9EAEiqgAAAEw"]
[Thu Nov 13 06:09:22.798532 2025] [:error] [pid 22222:tid 22235] [client 4.255.247.224:60963] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFkjL-5qXvQuZkA4GtegAAAAk"]
[Thu Nov 13 06:09:22.798733 2025] [:error] [pid 22222:tid 22235] [client 4.255.247.224:60963] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 403"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFkjL-5qXvQuZkA4GtegAAAAk"]
[Thu Nov 13 06:09:23.500053 2025] [:error] [pid 22222:tid 22226] [client 4.255.247.224:61002] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFkzL-5qXvQuZkA4GtewAAAAA"]
[Thu Nov 13 06:09:23.500212 2025] [:error] [pid 22222:tid 22226] [client 4.255.247.224:61002] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 404"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFkzL-5qXvQuZkA4GtewAAAAA"]
[Thu Nov 13 06:09:24.189630 2025] [:error] [pid 22307:tid 22329] [client 4.255.247.224:61038] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFlKr7fLMQQanZ_9yGmQAAANQ"]
[Thu Nov 13 06:09:24.189804 2025] [:error] [pid 22307:tid 22329] [client 4.255.247.224:61038] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 405"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFlKr7fLMQQanZ_9yGmQAAANQ"]
[Thu Nov 13 06:09:24.887281 2025] [:error] [pid 22566:tid 22576] [client 4.255.247.224:61072] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFlDfdqWaUbu3e06-cdwAAAQg"]
[Thu Nov 13 06:09:24.887418 2025] [:error] [pid 22566:tid 22576] [client 4.255.247.224:61072] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 406"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFlDfdqWaUbu3e06-cdwAAAQg"]
[Thu Nov 13 06:09:25.580636 2025] [:error] [pid 22223:tid 22254] [client 4.255.247.224:61130] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFld6it_tNBGH9EAEitAAAAEE"]
[Thu Nov 13 06:09:25.580789 2025] [:error] [pid 22223:tid 22254] [client 4.255.247.224:61130] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 407"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFld6it_tNBGH9EAEitAAAAEE"]
[Thu Nov 13 06:09:26.273930 2025] [:error] [pid 22224:tid 22294] [client 4.255.247.224:61170] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFlruEVuTj3a_UBfAPGwAAAI4"]
[Thu Nov 13 06:09:26.274146 2025] [:error] [pid 22224:tid 22294] [client 4.255.247.224:61170] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 408"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFlruEVuTj3a_UBfAPGwAAAI4"]
[Thu Nov 13 06:09:26.969680 2025] [:error] [pid 22223:tid 22273] [client 4.255.247.224:61208] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFlt6it_tNBGH9EAEiuQAAAFQ"]
[Thu Nov 13 06:09:26.969834 2025] [:error] [pid 22223:tid 22273] [client 4.255.247.224:61208] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 409"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUFlt6it_tNBGH9EAEiuQAAAFQ"]
[Thu Nov 13 06:11:18.821886 2025] [:error] [pid 22307:tid 22318] [client 4.255.247.224:51100] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGBqr7fLMQQanZ_9yH1gAAAMk"]
[Thu Nov 13 06:11:18.822025 2025] [:error] [pid 22307:tid 22318] [client 4.255.247.224:51100] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 410"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGBqr7fLMQQanZ_9yH1gAAAMk"]
[Thu Nov 13 06:11:19.515431 2025] [:error] [pid 22223:tid 22260] [client 4.255.247.224:51135] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGB96it_tNBGH9EAEj8QAAAEc"]
[Thu Nov 13 06:11:19.515593 2025] [:error] [pid 22223:tid 22260] [client 4.255.247.224:51135] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 411"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGB96it_tNBGH9EAEj8QAAAEc"]
[Thu Nov 13 06:11:20.205481 2025] [:error] [pid 22223:tid 22272] [client 4.255.247.224:51169] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGCN6it_tNBGH9EAEj9AAAAFM"]
[Thu Nov 13 06:11:20.205637 2025] [:error] [pid 22223:tid 22272] [client 4.255.247.224:51169] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 412"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGCN6it_tNBGH9EAEj9AAAAFM"]
[Thu Nov 13 06:11:20.895461 2025] [:error] [pid 22223:tid 22268] [client 4.255.247.224:51206] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGCN6it_tNBGH9EAEj-AAAAE8"]
[Thu Nov 13 06:11:20.895651 2025] [:error] [pid 22223:tid 22268] [client 4.255.247.224:51206] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 413"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGCN6it_tNBGH9EAEj-AAAAE8"]
[Thu Nov 13 06:11:21.584671 2025] [:error] [pid 22566:tid 22585] [client 4.255.247.224:51234] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGCTfdqWaUbu3e06-d_wAAARE"]
[Thu Nov 13 06:11:21.584848 2025] [:error] [pid 22566:tid 22585] [client 4.255.247.224:51234] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 414"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGCTfdqWaUbu3e06-d_wAAARE"]
[Thu Nov 13 06:11:22.276832 2025] [:error] [pid 22307:tid 22326] [client 4.255.247.224:51266] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGCqr7fLMQQanZ_9yH3QAAANE"]
[Thu Nov 13 06:11:22.277033 2025] [:error] [pid 22307:tid 22326] [client 4.255.247.224:51266] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 415"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGCqr7fLMQQanZ_9yH3QAAANE"]
[Thu Nov 13 06:11:22.969087 2025] [:error] [pid 22307:tid 22313] [client 4.255.247.224:51292] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGCqr7fLMQQanZ_9yH4QAAAMQ"]
[Thu Nov 13 06:11:22.969266 2025] [:error] [pid 22307:tid 22313] [client 4.255.247.224:51292] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 416"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGCqr7fLMQQanZ_9yH4QAAAMQ"]
[Thu Nov 13 06:11:56.164768 2025] [:error] [pid 22566:tid 22569] [client 4.255.247.224:52693] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGLDfdqWaUbu3e06-eoAAAAQE"]
[Thu Nov 13 06:11:56.164902 2025] [:error] [pid 22566:tid 22569] [client 4.255.247.224:52693] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 417"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGLDfdqWaUbu3e06-eoAAAAQE"]
[Thu Nov 13 06:11:56.854996 2025] [:error] [pid 22566:tid 22586] [client 4.255.247.224:52864] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGLDfdqWaUbu3e06-epgAAARI"]
[Thu Nov 13 06:11:56.855138 2025] [:error] [pid 22566:tid 22586] [client 4.255.247.224:52864] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 418"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGLDfdqWaUbu3e06-epgAAARI"]
[Thu Nov 13 06:11:57.547226 2025] [:error] [pid 22224:tid 22280] [client 4.255.247.224:52901] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGLbuEVuTj3a_UBfAQ4wAAAIA"]
[Thu Nov 13 06:11:57.547387 2025] [:error] [pid 22224:tid 22280] [client 4.255.247.224:52901] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 419"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGLbuEVuTj3a_UBfAQ4wAAAIA"]
[Thu Nov 13 06:11:58.234615 2025] [:error] [pid 22222:tid 22226] [client 4.255.247.224:52931] [client 4.255.247.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.255.247.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGLjL-5qXvQuZkA4Gu2gAAAAA"]
[Thu Nov 13 06:11:58.234752 2025] [:error] [pid 22222:tid 22226] [client 4.255.247.224:52931] [client 4.255.247.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 4.255.247.224, counter = 420"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRUGLjL-5qXvQuZkA4Gu2gAAAAA"]
[Thu Nov 13 08:29:32.893789 2025] [:error] [pid 34451:tid 34457] [client 106.119.167.146:52873] [client 106.119.167.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRUmbDRcD8KetQb4Raq9YQAAAUQ"]
[Thu Nov 13 11:59:36.662603 2025] [:error] [pid 6086:tid 6093] [client 209.42.16.160:42900] [client 209.42.16.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.42.16.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRVXqH9_6CRZzjZnAe2QKAAAAQQ"]
[Thu Nov 13 11:59:38.301672 2025] [:error] [pid 62215:tid 62234] [client 209.42.16.160:39016] [client 209.42.16.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.42.16.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRVXqkvClof1c6XaOBUtywAAAM8"], referer: http://expressinteriors.com/wp-login.php
[Thu Nov 13 11:59:42.257320 2025] [:error] [pid 62216:tid 62248] [client 209.42.16.160:55764] [client 209.42.16.160] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aRVXrupyFB9M2aVQhwPH0AAAAAE"]
[Thu Nov 13 12:18:43.784410 2025] [:error] [pid 62303:tid 62330] [client 43.159.128.247:41164] [client 43.159.128.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aRVcI7-hlFTtVrZw8jBrQwAAAJc"]
[Thu Nov 13 14:29:13.656933 2025] [:error] [pid 6086:tid 6091] [client 43.135.145.73:42562] [client 43.135.145.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRV6uX9_6CRZzjZnAe3hAwAAAQI"]
[Thu Nov 13 14:40:46.538073 2025] [:error] [pid 62303:tid 62324] [client 182.44.9.147:53776] [client 182.44.9.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aRV9br-hlFTtVrZw8jCrBgAAAJE"]
[Thu Nov 13 17:55:45.922897 2025] [:error] [pid 44354:tid 44382] [client 150.241.107.255:57152] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRWrIXqKopQhy3G4s3l0mQAAAZc"]
[Thu Nov 13 17:55:47.013002 2025] [:error] [pid 62216:tid 62266] [client 150.241.107.255:57724] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aRWrI-pyFB9M2aVQhwM0vQAAABM"]
[Thu Nov 13 18:54:58.800123 2025] [:error] [pid 44245:tid 44253] [client 49.51.166.228:49956] [client 49.51.166.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRW5Aok7r-HKZdqw-dXcswAAAUI"]
[Thu Nov 13 21:17:44.711863 2025] [:error] [pid 62303:tid 62315] [client 180.102.134.69:50633] [client 180.102.134.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRXaeL-hlFTtVrZw8jAQqgAAAIg"]
[Thu Nov 13 22:06:02.379898 2025] [:error] [pid 5086:tid 5097] [client 103.77.139.176:59087] [client 103.77.139.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.77.139.176, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRXlyh_dsYLFCHw574iwUgAAAQg"]
[Thu Nov 13 22:21:00.198688 2025] [:error] [pid 4993:tid 5039] [client 130.195.221.164:31186] [client 130.195.221.164] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 130.195.221.164, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRXpTMl_cC0Js5xNCU1PLAAAAA0"]
[Thu Nov 13 22:21:02.208664 2025] [:error] [pid 4992:tid 5013] [client 130.195.221.164:43769] [client 130.195.221.164] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 130.195.221.164, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRXpTimsutP7nusdj-CNRwAAANE"], referer: https://expressinteriors.com/wp-login.php
[Thu Nov 13 22:28:42.986966 2025] [:error] [pid 4992:tid 5002] [client 188.166.183.87:49140] [client 188.166.183.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.183.87, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRXrGimsutP7nusdj-CPsgAAAMY"]
[Fri Nov 14 02:01:29.314266 2025] [:error] [pid 56496:tid 56549] [client 43.167.239.66:48628] [client 43.167.239.66] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aRYc-eh2ME7eucGJGGLJQwAAABU"]
[Fri Nov 14 02:15:12.248690 2025] [:error] [pid 56495:tid 56520] [client 2.58.56.199:53355] [client 2.58.56.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/postnews.php"] [unique_id "aRYgMFwO8wZZL5WJceXUmgAAANU"]
[Fri Nov 14 02:15:12.780341 2025] [:error] [pid 56586:tid 56594] [client 2.58.56.199:53204] [client 2.58.56.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/postnews.php"] [unique_id "aRYgMK7eYD3G9deYMP5TtgAAAYM"]
[Fri Nov 14 02:15:13.338727 2025] [:error] [pid 56586:tid 56614] [client 2.58.56.199:61602] [client 2.58.56.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/postnews.php"] [unique_id "aRYgMa7eYD3G9deYMP5TuQAAAZc"]
[Fri Nov 14 05:45:25.821487 2025] [:error] [pid 47242:tid 47264] [client 158.69.222.155:35120] [client 158.69.222.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.69.222.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRZRdVPNnvrux3OMagx_1QAAANM"]
[Fri Nov 14 08:29:41.994535 2025] [:error] [pid 47156:tid 47229] [client 13.39.186.137:59618] [client 13.39.186.137] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/Wp/v2/users"] [unique_id "aRZ39djrQX_P-kC7M_44-wAAAI8"]
[Fri Nov 14 08:32:16.010585 2025] [:error] [pid 47156:tid 47231] [client 167.99.1.127:33444] [client 167.99.1.127] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users.json"] [unique_id "aRZ4kNjrQX_P-kC7M_46VwAAAJE"]
[Fri Nov 14 09:12:09.415333 2025] [:error] [pid 47630:tid 47639] [client 136.144.19.196:46303] [client 136.144.19.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "aRaB6cxXXNBfWgpfVJ59tQAAAQc"]
[Fri Nov 14 09:12:09.895366 2025] [:error] [pid 59105:tid 59108] [client 193.36.224.10:37491] [client 193.36.224.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/txets.php"] [unique_id "aRaB6bd-anP1JpNfuSK40wAAAUE"]
[Fri Nov 14 09:12:10.376794 2025] [:error] [pid 47156:tid 47233] [client 193.36.224.17:28187] [client 193.36.224.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/txets.php"] [unique_id "aRaB6tjrQX_P-kC7M_5PaAAAAJM"]
[Fri Nov 14 09:57:15.775276 2025] [:error] [pid 47156:tid 47216] [client 222.79.104.23:33274] [client 222.79.104.23] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRaMe9jrQX_P-kC7M_5oKAAAAII"]
[Fri Nov 14 10:24:38.566752 2025] [:error] [pid 47156:tid 47231] [client 103.77.107.222:51734] [client 103.77.107.222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aRaS5tjrQX_P-kC7M_53qQAAAJE"]
[Fri Nov 14 10:45:33.899388 2025] [:error] [pid 47630:tid 47638] [client 43.166.136.24:43234] [client 43.166.136.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRaXzcxXXNBfWgpfVJ6igAAAAQY"]
[Fri Nov 14 12:13:51.109807 2025] [:error] [pid 16573:tid 16579] [client 146.190.63.229:59444] [client 146.190.63.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.63.229, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRasfyPGexfUk9FDoEIargAAAEE"]
[Fri Nov 14 12:18:37.999897 2025] [:error] [pid 16574:tid 16628] [client 5.101.157.234:16023] [client 5.101.157.234] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style.php"] [unique_id "aRatnf6XQqe4NqaoE9LAhQAAAJU"]
[Fri Nov 14 12:18:44.457364 2025] [:error] [pid 16575:tid 16656] [client 5.101.157.234:17831] [client 5.101.157.234] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style.php"] [unique_id "aRatpO6qT670YxigvbAMXwAAANY"]
[Fri Nov 14 12:26:53.261997 2025] [:error] [pid 16573:tid 16598] [client 66.249.70.170:40679] [client 66.249.70.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/games/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%81%E0%B8%A1.html"] [unique_id "aRavjSPGexfUk9FDoEIgwQAAAFQ"]
[Fri Nov 14 12:27:00.458082 2025] [:error] [pid 16709:tid 16735] [client 66.249.70.170:40377] [client 66.249.70.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xoso/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B9%83%E0%B8%AB%E0%B8%A1%E0%B9%88pg%20%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99.html"] [unique_id "aRavlKNdzfVNC4oipLWx4AAAAVg"]
[Fri Nov 14 12:27:19.009584 2025] [:error] [pid 16709:tid 16712] [client 66.249.70.170:46564] [client 66.249.70.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/news/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.html"] [unique_id "aRavp6NdzfVNC4oipLWyCgAAAUE"]
[Fri Nov 14 12:27:28.598528 2025] [:error] [pid 16574:tid 16619] [client 66.249.70.170:61785] [client 66.249.70.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/betting/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B8%84%E0%B8%99.html"] [unique_id "aRavsP6XQqe4NqaoE9LEEgAAAIw"]
[Fri Nov 14 12:55:02.063397 2025] [:error] [pid 16709:tid 16728] [client 159.65.18.197:41104] [client 159.65.18.197] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aRa2JqNdzfVNC4oipLXC4gAAAVE"]
[Fri Nov 14 12:55:10.792012 2025] [authz_core:error] [pid 16573:tid 16599] [client 159.65.18.197:47528] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Fri Nov 14 12:55:15.204536 2025] [:error] [pid 16574:tid 16609] [client 159.65.18.197:47572] [client 159.65.18.197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aRa2M_6XQqe4NqaoE9LQFQAAAII"]
[Fri Nov 14 12:55:15.932109 2025] [:error] [pid 16574:tid 16618] [client 159.65.18.197:47582] [client 159.65.18.197] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aRa2M_6XQqe4NqaoE9LQGQAAAIs"]
[Fri Nov 14 14:47:59.709881 2025] [:error] [pid 16709:tid 16717] [client 45.77.160.246:60826] [client 45.77.160.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.77.160.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRbQn6NdzfVNC4oipLUEMwAAAUY"]
[Fri Nov 14 16:15:22.471563 2025] [:error] [pid 16573:tid 16590] [client 113.141.91.58:45655] [client 113.141.91.58] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aRblGiPGexfUk9FDoEJ38AAAAEw"]
[Fri Nov 14 17:28:47.510218 2025] [:error] [pid 16575:tid 16634] [client 170.106.192.3:56614] [client 170.106.192.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aRb2T-6qT670YxigvbB8iQAAAMA"]
[Fri Nov 14 18:41:17.061225 2025] [:error] [pid 1170:tid 1184] [client 112.201.131.230:20120] [client 112.201.131.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.201.131.230, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRcHTQ5pkvzCDzzjItRJugAAAAw"]
[Fri Nov 14 18:41:18.887997 2025] [:error] [pid 16573:tid 16595] [client 112.201.131.230:20224] [client 112.201.131.230] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aRcHTiPGexfUk9FDoEKkUQAAAFE"]
[Fri Nov 14 18:43:13.291972 2025] [:error] [pid 16671:tid 16687] [client 112.201.131.230:18193] [client 112.201.131.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.201.131.230, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRcHwTsoHwEAmeIzZXBhQgAAAQo"]
[Fri Nov 14 18:50:45.080975 2025] [:error] [pid 16709:tid 16716] [client 112.201.131.230:20636] [client 112.201.131.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.201.131.230, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRcJhaNdzfVNC4oipLV0KgAAAUU"]
[Fri Nov 14 18:55:49.625434 2025] [:error] [pid 16574:tid 16610] [client 112.201.131.230:18855] [client 112.201.131.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.201.131.230, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRcKtf6XQqe4NqaoE9JBMwAAAIM"]
[Fri Nov 14 19:00:51.442359 2025] [:error] [pid 1170:tid 1185] [client 112.201.131.230:19920] [client 112.201.131.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.201.131.230, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRcL4w5pkvzCDzzjItRRlgAAAA0"]
[Fri Nov 14 19:11:28.580567 2025] [:error] [pid 16671:tid 16696] [client 43.132.214.228:56136] [client 43.132.214.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRcOYDsoHwEAmeIzZXBpXgAAARM"]
[Fri Nov 14 20:37:18.082559 2025] [:error] [pid 16574:tid 16614] [client 50.6.174.16:51292] [client 50.6.174.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.174.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRcifv6XQqe4NqaoE9JbhAAAAIc"]
[Fri Nov 14 20:37:20.070524 2025] [:error] [pid 16671:tid 16686] [client 50.6.174.16:42760] [client 50.6.174.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.174.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRcigDsoHwEAmeIzZXCCDgAAAQk"], referer: http://expressinteriors.com/wp-login.php
[Fri Nov 14 20:37:24.285091 2025] [:error] [pid 16574:tid 16630] [client 50.6.174.16:51312] [client 50.6.174.16] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aRcihP6XQqe4NqaoE9JbjAAAAJc"]
[Fri Nov 14 22:37:22.639327 2025] [:error] [pid 16709:tid 16725] [client 45.153.34.41:33276] [client 45.153.34.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aRc-oqNdzfVNC4oipLW6IQAAAU4"]
[Sat Nov 15 00:12:17.500347 2025] [:error] [pid 45907:tid 45920] [client 5.189.169.82:34472] [client 5.189.169.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.189.169.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRdU4VAqmYxCpnT9gJFm-wAAAUk"]
[Sat Nov 15 00:26:34.289157 2025] [:error] [pid 45995:tid 46003] [client 45.77.160.246:24392] [client 45.77.160.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.77.160.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRdYOsfhZrb6EV4SvFun7gAAAgM"]
[Sat Nov 15 01:14:34.221854 2025] [:error] [pid 45995:tid 46016] [client 4.205.179.237:24562] [client 4.205.179.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/network.php"] [unique_id "aRdjesfhZrb6EV4SvFu9JQAAAhA"]
[Sat Nov 15 01:14:34.714058 2025] [:error] [pid 45995:tid 46024] [client 4.205.179.237:24575] [client 4.205.179.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.205.179.237, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aRdjesfhZrb6EV4SvFu9JgAAAhg"]
[Sat Nov 15 01:14:41.080838 2025] [:error] [pid 45995:tid 46017] [client 4.205.179.237:24575] [client 4.205.179.237] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aRdjgcfhZrb6EV4SvFu9NQAAAhE"]
[Sat Nov 15 01:14:45.662251 2025] [:error] [pid 45995:tid 46023] [client 4.205.179.237:24452] [client 4.205.179.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/about.php"] [unique_id "aRdjhcfhZrb6EV4SvFu9PwAAAhc"]
[Sat Nov 15 01:14:46.110795 2025] [:error] [pid 45995:tid 46024] [client 4.205.179.237:24560] [client 4.205.179.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/about.php"] [unique_id "aRdjhsfhZrb6EV4SvFu9QAAAAhg"]
[Sat Nov 15 01:14:46.525262 2025] [:error] [pid 45995:tid 46002] [client 4.205.179.237:24384] [client 4.205.179.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/about.php"] [unique_id "aRdjhsfhZrb6EV4SvFu9QQAAAgI"]
[Sat Nov 15 01:14:46.986787 2025] [:error] [pid 45995:tid 46013] [client 4.205.179.237:24458] [client 4.205.179.237] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/about.php"] [unique_id "aRdjhsfhZrb6EV4SvFu9RQAAAg0"]
[Sat Nov 15 01:31:53.853903 2025] [:error] [pid 45908:tid 45957] [client 101.35.214.220:57454] [client 101.35.214.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/apps/admin/view/default/layui/images/face/11.gif"] [unique_id "aRdniWWG19mWwZX7KatjtwAAABM"], referer: http://expressinteriors.com/apps/admin/view/default/layui/images/face/11.gif
[Sat Nov 15 03:31:10.752963 2025] [:error] [pid 6937:tid 7012] [client 4.205.254.11:8877] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filei.php"] [unique_id "aReDfvdXqRosT4cnpq8VqAAAAFA"]
[Sat Nov 15 03:31:11.926147 2025] [:error] [pid 7068:tid 7088] [client 4.205.254.11:9005] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filei.php"] [unique_id "aReDf-0tpJf_Mc_fRVniswAAANI"]
[Sat Nov 15 03:31:15.224208 2025] [:error] [pid 6937:tid 7010] [client 4.205.254.11:8991] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filei.php"] [unique_id "aReDg_dXqRosT4cnpq8VsgAAAE4"]
[Sat Nov 15 03:31:17.155339 2025] [:error] [pid 6939:tid 7024] [client 4.205.254.11:8882] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filei.php"] [unique_id "aReDhVzSiVNtJH1G8IRlnwAAAIE"]
[Sat Nov 15 03:31:30.602886 2025] [:error] [pid 7068:tid 7073] [client 4.205.254.11:9027] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2.php"] [unique_id "aReDku0tpJf_Mc_fRVnizwAAAMM"]
[Sat Nov 15 03:31:31.757045 2025] [:error] [pid 8226:tid 8243] [client 4.205.254.11:8962] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2.php"] [unique_id "aReDk36mEy-8f-d3f8r6jgAAAQ0"]
[Sat Nov 15 03:31:34.931397 2025] [:error] [pid 7068:tid 7091] [client 4.205.254.11:9079] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aReDlu0tpJf_Mc_fRVni9wAAANU"]
[Sat Nov 15 03:31:40.277829 2025] [:error] [pid 6935:tid 6974] [client 4.205.254.11:40361] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aReDnFrPljChBX24TpTaagAAAAU"]
[Sat Nov 15 03:31:45.016708 2025] [:error] [pid 6939:tid 7039] [client 4.205.254.11:40369] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aReDoVzSiVNtJH1G8IRl5QAAAJA"]
[Sat Nov 15 03:31:46.362188 2025] [:error] [pid 6935:tid 6973] [client 4.205.254.11:40320] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aReDolrPljChBX24TpTabwAAAAQ"]
[Sat Nov 15 03:31:49.102139 2025] [:error] [pid 6937:tid 7013] [client 4.205.254.11:8999] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aReDpfdXqRosT4cnpq8V5QAAAFE"]
[Sat Nov 15 03:31:50.264111 2025] [:error] [pid 6937:tid 7003] [client 4.205.254.11:8869] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aReDpvdXqRosT4cnpq8V5wAAAEc"]
[Sat Nov 15 03:31:52.242383 2025] [:error] [pid 7068:tid 7080] [client 4.205.254.11:8981] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aReDqO0tpJf_Mc_fRVnjDQAAAMo"]
[Sat Nov 15 03:31:54.040331 2025] [:error] [pid 8226:tid 8243] [client 4.205.254.11:8842] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aReDqn6mEy-8f-d3f8r6qAAAAQ0"]
[Sat Nov 15 03:32:29.072204 2025] [:error] [pid 7068:tid 7084] [client 4.205.254.11:8993] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mo.php"] [unique_id "aReDze0tpJf_Mc_fRVnjRAAAAM4"]
[Sat Nov 15 03:32:29.968665 2025] [:error] [pid 7068:tid 7087] [client 4.205.254.11:8969] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mo.php"] [unique_id "aReDze0tpJf_Mc_fRVnjRQAAANE"]
[Sat Nov 15 03:32:34.608387 2025] [:error] [pid 6935:tid 6992] [client 4.205.254.11:8884] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mo.php"] [unique_id "aReD0lrPljChBX24TpTapwAAABc"]
[Sat Nov 15 03:32:36.050736 2025] [:error] [pid 6939:tid 7029] [client 4.205.254.11:8978] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mo.php"] [unique_id "aReD1FzSiVNtJH1G8IRmCQAAAIY"]
[Sat Nov 15 03:32:44.695096 2025] [:error] [pid 8226:tid 8230] [client 4.205.254.11:9006] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nij.php"] [unique_id "aReD3H6mEy-8f-d3f8r64QAAAQA"]
[Sat Nov 15 03:32:46.539841 2025] [:error] [pid 7068:tid 7092] [client 4.205.254.11:8872] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nij.php"] [unique_id "aReD3u0tpJf_Mc_fRVnjWwAAANY"]
[Sat Nov 15 03:32:49.544629 2025] [:error] [pid 6935:tid 6986] [client 4.205.254.11:40324] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nij.php"] [unique_id "aReD4VrPljChBX24TpTatgAAABE"]
[Sat Nov 15 03:32:54.457908 2025] [:error] [pid 8226:tid 8240] [client 4.205.254.11:8879] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gfile.php"] [unique_id "aReD5n6mEy-8f-d3f8r7AgAAAQo"]
[Sat Nov 15 03:32:55.772685 2025] [:error] [pid 8226:tid 8254] [client 4.205.254.11:9056] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gfile.php"] [unique_id "aReD536mEy-8f-d3f8r7BQAAARg"]
[Sat Nov 15 03:33:30.541811 2025] [:error] [pid 8226:tid 8244] [client 4.205.254.11:8913] [client 4.205.254.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aReECn6mEy-8f-d3f8r7QAAAAQ4"]
[Sat Nov 15 03:33:52.457742 2025] [:error] [pid 8226:tid 8245] [client 4.205.254.11:8927] [client 4.205.254.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.205.254.11, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aReEIH6mEy-8f-d3f8r7cgAAAQ8"]
[Sat Nov 15 03:33:53.205468 2025] [:error] [pid 8226:tid 8254] [client 4.205.254.11:8927] [client 4.205.254.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.205.254.11, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aReEIX6mEy-8f-d3f8r7dQAAARg"]
[Sat Nov 15 03:33:56.735621 2025] [:error] [pid 6935:tid 6987] [client 4.205.254.11:9029] [client 4.205.254.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aReEJFrPljChBX24TpTa_QAAABI"]
[Sat Nov 15 03:34:16.555144 2025] [:error] [pid 6935:tid 6993] [client 4.205.254.11:9177] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/get.php"] [unique_id "aReEOFrPljChBX24TpTbHAAAABg"]
[Sat Nov 15 03:34:19.024837 2025] [:error] [pid 6935:tid 6978] [client 4.205.254.11:8950] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/get.php"] [unique_id "aReEO1rPljChBX24TpTbIAAAAAk"]
[Sat Nov 15 03:34:21.805973 2025] [:error] [pid 6937:tid 7011] [client 4.205.254.11:9063] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/get.php"] [unique_id "aReEPfdXqRosT4cnpq8WbgAAAE8"]
[Sat Nov 15 03:34:22.849045 2025] [:error] [pid 6935:tid 6977] [client 4.205.254.11:8940] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/get.php"] [unique_id "aReEPlrPljChBX24TpTbJAAAAAg"]
[Sat Nov 15 03:34:25.256740 2025] [:error] [pid 6935:tid 6979] [client 4.205.254.11:8596] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3.php"] [unique_id "aReEQVrPljChBX24TpTbKAAAAAo"]
[Sat Nov 15 03:34:26.395681 2025] [:error] [pid 6935:tid 6978] [client 4.205.254.11:9185] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3.php"] [unique_id "aReEQlrPljChBX24TpTbKwAAAAk"]
[Sat Nov 15 03:34:35.350494 2025] [:error] [pid 8226:tid 8244] [client 4.205.254.11:8937] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3.php"] [unique_id "aReES36mEy-8f-d3f8r7sAAAAQ4"]
[Sat Nov 15 03:34:36.848027 2025] [:error] [pid 6939:tid 7033] [client 4.205.254.11:9061] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3.php"] [unique_id "aReETFzSiVNtJH1G8IRmhAAAAIo"]
[Sat Nov 15 03:34:38.793035 2025] [:error] [pid 7068:tid 7081] [client 4.205.254.11:8908] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/ws.php"] [unique_id "aReETu0tpJf_Mc_fRVnj1QAAAMs"]
[Sat Nov 15 03:34:42.895717 2025] [:error] [pid 6937:tid 7019] [client 4.205.254.11:8934] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/ws.php"] [unique_id "aReEUvdXqRosT4cnpq8WhAAAAFc"]
[Sat Nov 15 03:34:44.901218 2025] [:error] [pid 6937:tid 6997] [client 4.205.254.11:8583] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/ws.php"] [unique_id "aReEVPdXqRosT4cnpq8WhgAAAEE"]
[Sat Nov 15 03:34:45.912418 2025] [:error] [pid 6939:tid 7040] [client 4.205.254.11:8586] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/ws.php"] [unique_id "aReEVVzSiVNtJH1G8IRmjwAAAJE"]
[Sat Nov 15 03:34:47.743650 2025] [:error] [pid 8226:tid 8246] [client 4.205.254.11:8939] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wteed.php"] [unique_id "aReEV36mEy-8f-d3f8r7ugAAARA"]
[Sat Nov 15 03:34:49.236732 2025] [:error] [pid 8226:tid 8254] [client 4.205.254.11:9159] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wteed.php"] [unique_id "aReEWX6mEy-8f-d3f8r7uwAAARg"]
[Sat Nov 15 03:34:53.814595 2025] [:error] [pid 6937:tid 7000] [client 4.205.254.11:8959] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wteed.php"] [unique_id "aReEXfdXqRosT4cnpq8WjwAAAEQ"]
[Sat Nov 15 03:34:54.934529 2025] [:error] [pid 6935:tid 6985] [client 4.205.254.11:8576] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wteed.php"] [unique_id "aReEXlrPljChBX24TpTbTAAAABA"]
[Sat Nov 15 03:34:56.553612 2025] [:error] [pid 7068:tid 7082] [client 4.205.254.11:8628] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aReEYO0tpJf_Mc_fRVnj6QAAAMw"]
[Sat Nov 15 03:34:58.548922 2025] [:error] [pid 8226:tid 8236] [client 4.205.254.11:9045] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aReEYn6mEy-8f-d3f8r7zAAAAQY"]
[Sat Nov 15 03:35:01.187508 2025] [:error] [pid 8226:tid 8253] [client 4.205.254.11:8592] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aReEZX6mEy-8f-d3f8r70gAAARc"]
[Sat Nov 15 03:35:04.711513 2025] [:error] [pid 7068:tid 7086] [client 4.205.254.11:8636] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aReEaO0tpJf_Mc_fRVnj7QAAANA"]
[Sat Nov 15 03:35:11.800694 2025] [:error] [pid 8226:tid 8253] [client 4.205.254.11:8603] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ntgn.php"] [unique_id "aReEb36mEy-8f-d3f8r74wAAARc"]
[Sat Nov 15 03:35:12.947120 2025] [:error] [pid 8226:tid 8235] [client 4.205.254.11:8912] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ntgn.php"] [unique_id "aReEcH6mEy-8f-d3f8r76gAAAQU"]
[Sat Nov 15 03:35:14.657147 2025] [:error] [pid 6935:tid 6990] [client 4.205.254.11:8605] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ntgn.php"] [unique_id "aReEclrPljChBX24TpTbVwAAABU"]
[Sat Nov 15 03:35:27.256777 2025] [:error] [pid 6935:tid 6970] [client 4.205.254.11:8929] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/unzip.php"] [unique_id "aReEf1rPljChBX24TpTbfQAAAAE"]
[Sat Nov 15 03:35:27.965522 2025] [:error] [pid 6935:tid 6972] [client 4.205.254.11:9209] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/unzip.php"] [unique_id "aReEf1rPljChBX24TpTbfgAAAAM"]
[Sat Nov 15 03:35:29.074834 2025] [:error] [pid 7068:tid 7077] [client 4.205.254.11:8623] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/unzip.php"] [unique_id "aReEge0tpJf_Mc_fRVnkEgAAAMc"]
[Sat Nov 15 03:35:31.531353 2025] [:error] [pid 8226:tid 8247] [client 4.205.254.11:40382] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/unzip.php"] [unique_id "aReEg36mEy-8f-d3f8r8CQAAARE"]
[Sat Nov 15 03:35:37.525452 2025] [:error] [pid 8226:tid 8237] [client 4.205.254.11:8632] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cool.php"] [unique_id "aReEiX6mEy-8f-d3f8r8FAAAAQc"]
[Sat Nov 15 03:35:38.673436 2025] [:error] [pid 8226:tid 8253] [client 4.205.254.11:8864] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cool.php"] [unique_id "aReEin6mEy-8f-d3f8r8FwAAARc"]
[Sat Nov 15 03:35:39.280264 2025] [:error] [pid 6935:tid 6978] [client 4.205.254.11:9044] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cool.php"] [unique_id "aReEi1rPljChBX24TpTblQAAAAk"]
[Sat Nov 15 03:35:44.769175 2025] [:error] [pid 6937:tid 7010] [client 4.205.254.11:9030] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cool.php"] [unique_id "aReEkPdXqRosT4cnpq8WxAAAAE4"]
[Sat Nov 15 03:35:46.929980 2025] [:error] [pid 8226:tid 8244] [client 4.205.254.11:9208] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/xin1.php"] [unique_id "aReEkn6mEy-8f-d3f8r8KAAAAQ4"]
[Sat Nov 15 03:35:48.600789 2025] [:error] [pid 7068:tid 7088] [client 4.205.254.11:8916] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/xin1.php"] [unique_id "aReElO0tpJf_Mc_fRVnkMQAAANI"]
[Sat Nov 15 03:35:54.439708 2025] [:error] [pid 8226:tid 8243] [client 4.205.254.11:8585] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/xin1.php"] [unique_id "aReEmn6mEy-8f-d3f8r8OgAAAQ0"]
[Sat Nov 15 03:35:58.419432 2025] [:error] [pid 8226:tid 8234] [client 4.205.254.11:8918] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/xin1.php"] [unique_id "aReEnn6mEy-8f-d3f8r8QwAAAQQ"]
[Sat Nov 15 03:36:17.676660 2025] [:error] [pid 44436:tid 44447] [client 4.205.254.11:8634] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aua.php"] [unique_id "aReEsTUs0t-jxzSR5Sg-KAAAAAM"]
[Sat Nov 15 03:36:18.833612 2025] [:error] [pid 44438:tid 44522] [client 4.205.254.11:8598] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aua.php"] [unique_id "aReEsgUQm6jCuPWgJlld8gAAAJg"]
[Sat Nov 15 03:36:19.946995 2025] [:error] [pid 44436:tid 44455] [client 4.205.254.11:8942] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aua.php"] [unique_id "aReEszUs0t-jxzSR5Sg-QwAAAAs"]
[Sat Nov 15 03:36:22.102451 2025] [:error] [pid 44437:tid 44494] [client 4.205.254.11:9059] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aua.php"] [unique_id "aReEturO1g9UNCoZp04RNAAAAFc"]
[Sat Nov 15 03:36:23.728436 2025] [:error] [pid 44436:tid 44448] [client 4.205.254.11:8932] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/c4.php"] [unique_id "aReEtzUs0t-jxzSR5Sg-WgAAAAQ"]
[Sat Nov 15 03:36:38.224375 2025] [:error] [pid 44438:tid 44511] [client 4.205.254.11:8973] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nxac.php"] [unique_id "aReExgUQm6jCuPWgJlleOQAAAI0"]
[Sat Nov 15 03:36:44.805655 2025] [:error] [pid 44436:tid 44467] [client 4.205.254.11:8578] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nxac.php"] [unique_id "aReEzDUs0t-jxzSR5Sg-fwAAABc"]
[Sat Nov 15 03:36:48.262498 2025] [:error] [pid 44527:tid 44542] [client 4.205.254.11:8595] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nxac.php"] [unique_id "aReE0DZn1ZaBElIfEGIBiQAAAMo"]
[Sat Nov 15 03:36:51.997938 2025] [:error] [pid 44527:tid 44545] [client 4.205.254.11:40327] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nxac.php"] [unique_id "aReE0zZn1ZaBElIfEGIBkAAAAM0"]
[Sat Nov 15 03:36:54.204943 2025] [:error] [pid 44436:tid 44452] [client 4.205.254.11:8896] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thh.php"] [unique_id "aReE1jUs0t-jxzSR5Sg-jgAAAAg"]
[Sat Nov 15 03:37:12.727690 2025] [:error] [pid 44438:tid 44503] [client 4.205.254.11:8627] [client 4.205.254.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/buy.php"] [unique_id "aReE6AUQm6jCuPWgJlleXAAAAIU"]
[Sat Nov 15 03:37:16.035936 2025] [:error] [pid 44436:tid 44459] [client 4.205.254.11:8580] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baxa1.phP8"] [unique_id "aReE7DUs0t-jxzSR5Sg-qwAAAA8"]
[Sat Nov 15 03:37:19.603358 2025] [:error] [pid 44437:tid 44477] [client 4.205.254.11:9179] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baxa1.phP8"] [unique_id "aReE7-rO1g9UNCoZp04RwwAAAEY"]
[Sat Nov 15 03:37:21.950874 2025] [:error] [pid 44527:tid 44533] [client 4.205.254.11:9027] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baxa1.phP8"] [unique_id "aReE8TZn1ZaBElIfEGIByQAAAME"]
[Sat Nov 15 03:37:24.203741 2025] [:error] [pid 44437:tid 44483] [client 4.205.254.11:9200] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lo.php"] [unique_id "aReE9OrO1g9UNCoZp04RxwAAAEw"]
[Sat Nov 15 03:37:25.385073 2025] [:error] [pid 44437:tid 44474] [client 4.205.254.11:9039] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lo.php"] [unique_id "aReE9erO1g9UNCoZp04RyQAAAEM"]
[Sat Nov 15 03:37:26.966060 2025] [:error] [pid 44438:tid 44506] [client 4.205.254.11:8637] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lo.php"] [unique_id "aReE9gUQm6jCuPWgJllebgAAAIg"]
[Sat Nov 15 03:37:33.190820 2025] [:error] [pid 44527:tid 44551] [client 4.205.254.11:8922] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lo.php"] [unique_id "aReE_TZn1ZaBElIfEGIB4QAAANM"]
[Sat Nov 15 03:37:35.837289 2025] [:error] [pid 44436:tid 44457] [client 4.205.254.11:8620] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fb.php"] [unique_id "aReE_zUs0t-jxzSR5Sg-zAAAAA0"]
[Sat Nov 15 03:37:36.461806 2025] [:error] [pid 44438:tid 44506] [client 4.205.254.11:9193] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fb.php"] [unique_id "aReFAAUQm6jCuPWgJlledAAAAIg"]
[Sat Nov 15 03:37:47.300324 2025] [:error] [pid 44437:tid 44479] [client 4.205.254.11:8953] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/racs3.php"] [unique_id "aReFC-rO1g9UNCoZp04R5gAAAEg"]
[Sat Nov 15 03:37:58.143969 2025] [:error] [pid 44437:tid 44482] [client 4.205.254.11:8928] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/racs3.php"] [unique_id "aReFFurO1g9UNCoZp04SBgAAAEs"]
[Sat Nov 15 03:38:01.125001 2025] [:error] [pid 44437:tid 44493] [client 4.205.254.11:8902] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/racs3.php"] [unique_id "aReFGerO1g9UNCoZp04SDgAAAFY"]
[Sat Nov 15 03:38:03.803907 2025] [:error] [pid 44527:tid 44535] [client 4.205.254.11:8956] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aReFGzZn1ZaBElIfEGICJgAAAMM"]
[Sat Nov 15 03:38:24.972101 2025] [:error] [pid 44527:tid 44541] [client 4.205.254.11:9155] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lufix.php"] [unique_id "aReFMDZn1ZaBElIfEGICdgAAAMk"]
[Sat Nov 15 03:38:27.416657 2025] [:error] [pid 44437:tid 44487] [client 4.205.254.11:9202] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lufix.php"] [unique_id "aReFM-rO1g9UNCoZp04SLgAAAFA"]
[Sat Nov 15 03:38:38.519502 2025] [:error] [pid 44527:tid 44538] [client 4.205.254.11:9211] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bluejackets.php"] [unique_id "aReFPjZn1ZaBElIfEGICnQAAAMY"]
[Sat Nov 15 03:38:55.992372 2025] [:error] [pid 44438:tid 44522] [client 4.205.254.11:9065] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xo.php"] [unique_id "aReFTwUQm6jCuPWgJlle8gAAAJg"]
[Sat Nov 15 03:38:57.613675 2025] [:error] [pid 44436:tid 44445] [client 4.205.254.11:8558] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xo.php"] [unique_id "aReFUTUs0t-jxzSR5Sg_PgAAAAE"]
[Sat Nov 15 03:38:59.368636 2025] [:error] [pid 44437:tid 44481] [client 4.205.254.11:8557] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xo.php"] [unique_id "aReFU-rO1g9UNCoZp04STQAAAEo"]
[Sat Nov 15 03:39:06.801731 2025] [:error] [pid 44437:tid 44490] [client 4.205.254.11:8593] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xo.php"] [unique_id "aReFWurO1g9UNCoZp04SXwAAAFM"]
[Sat Nov 15 03:39:12.179726 2025] [:error] [pid 44527:tid 44532] [client 4.205.254.11:8576] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggs.php"] [unique_id "aReFYDZn1ZaBElIfEGIC2wAAAMA"]
[Sat Nov 15 03:39:13.966975 2025] [:error] [pid 44437:tid 44490] [client 4.205.254.11:9184] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggs.php"] [unique_id "aReFYerO1g9UNCoZp04SbgAAAFM"]
[Sat Nov 15 03:39:15.409135 2025] [:error] [pid 44436:tid 44468] [client 4.205.254.11:9194] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggs.php"] [unique_id "aReFYzUs0t-jxzSR5Sg_YgAAABg"]
[Sat Nov 15 03:39:18.597349 2025] [:error] [pid 44438:tid 44509] [client 4.205.254.11:8600] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggs.php"] [unique_id "aReFZgUQm6jCuPWgJllfDAAAAIs"]
[Sat Nov 15 03:39:20.039870 2025] [:error] [pid 44437:tid 44479] [client 4.205.254.11:9199] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsr2.php"] [unique_id "aReFaOrO1g9UNCoZp04SdwAAAEg"]
[Sat Nov 15 03:39:22.598922 2025] [:error] [pid 44527:tid 44546] [client 4.205.254.11:8547] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsr2.php"] [unique_id "aReFajZn1ZaBElIfEGIC8gAAAM4"]
[Sat Nov 15 03:39:25.288900 2025] [:error] [pid 44527:tid 44536] [client 4.205.254.11:8560] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsr2.php"] [unique_id "aReFbTZn1ZaBElIfEGIC-QAAAMQ"]
[Sat Nov 15 03:39:26.171393 2025] [:error] [pid 44436:tid 44449] [client 4.205.254.11:9214] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsr2.php"] [unique_id "aReFbjUs0t-jxzSR5Sg_cwAAAAU"]
[Sat Nov 15 03:39:28.373298 2025] [:error] [pid 44527:tid 44543] [client 4.205.254.11:9153] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aReFcDZn1ZaBElIfEGIC_wAAAMs"]
[Sat Nov 15 03:39:31.817071 2025] [:error] [pid 44437:tid 44476] [client 4.205.254.11:8521] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aReFc-rO1g9UNCoZp04ShQAAAEU"]
[Sat Nov 15 03:39:33.648729 2025] [:error] [pid 44437:tid 44485] [client 4.205.254.11:8561] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aReFderO1g9UNCoZp04SiQAAAE4"]
[Sat Nov 15 03:39:35.966103 2025] [:error] [pid 44438:tid 44507] [client 4.205.254.11:8534] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aReFdwUQm6jCuPWgJllfJQAAAIk"]
[Sat Nov 15 03:39:37.623477 2025] [:error] [pid 44436:tid 44461] [client 4.205.254.11:9186] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/wsr2.php"] [unique_id "aReFeTUs0t-jxzSR5Sg_kQAAABE"]
[Sat Nov 15 03:39:40.339519 2025] [:error] [pid 44527:tid 44541] [client 4.205.254.11:40330] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/wsr2.php"] [unique_id "aReFfDZn1ZaBElIfEGIDHwAAAMk"]
[Sat Nov 15 03:39:42.207001 2025] [:error] [pid 44527:tid 44538] [client 4.205.254.11:8323] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/wsr2.php"] [unique_id "aReFfjZn1ZaBElIfEGIDJQAAAMY"]
[Sat Nov 15 03:39:43.812779 2025] [:error] [pid 44527:tid 44539] [client 4.205.254.11:9033] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/wsr2.php"] [unique_id "aReFfzZn1ZaBElIfEGIDLAAAAMc"]
[Sat Nov 15 03:39:47.758941 2025] [:error] [pid 44436:tid 44462] [client 4.205.254.11:9213] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tcp.php"] [unique_id "aReFgzUs0t-jxzSR5Sg_mwAAABI"]
[Sat Nov 15 03:39:48.663826 2025] [:error] [pid 44438:tid 44517] [client 4.205.254.11:9158] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tcp.php"] [unique_id "aReFhAUQm6jCuPWgJllfNQAAAJM"]
[Sat Nov 15 03:39:51.310231 2025] [:error] [pid 44438:tid 44498] [client 4.205.254.11:9165] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tcp.php"] [unique_id "aReFhwUQm6jCuPWgJllfOwAAAIA"]
[Sat Nov 15 03:39:54.669393 2025] [:error] [pid 44438:tid 44511] [client 4.205.254.11:8326] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tcp.php"] [unique_id "aReFigUQm6jCuPWgJllfPwAAAI0"]
[Sat Nov 15 03:39:57.454419 2025] [:error] [pid 44436:tid 44449] [client 4.205.254.11:8370] [client 4.205.254.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aReFjTUs0t-jxzSR5Sg_owAAAAU"]
[Sat Nov 15 03:40:08.008325 2025] [:error] [pid 44436:tid 44453] [client 4.205.254.11:8556] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cfile.php"] [unique_id "aReFmDUs0t-jxzSR5Sg_uwAAAAk"]
[Sat Nov 15 03:40:09.341052 2025] [:error] [pid 44436:tid 44458] [client 4.205.254.11:8577] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cfile.php"] [unique_id "aReFmTUs0t-jxzSR5Sg_vQAAAA4"]
[Sat Nov 15 03:40:12.287120 2025] [:error] [pid 44436:tid 44462] [client 4.205.254.11:8591] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cfile.php"] [unique_id "aReFnDUs0t-jxzSR5Sg_wAAAABI"]
[Sat Nov 15 03:40:13.490442 2025] [:error] [pid 44437:tid 44482] [client 4.205.254.11:8533] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cfile.php"] [unique_id "aReFnerO1g9UNCoZp04S0AAAAEs"]
[Sat Nov 15 03:40:14.378475 2025] [:error] [pid 44527:tid 44555] [client 4.205.254.11:8572] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sder52u.php"] [unique_id "aReFnjZn1ZaBElIfEGIDeAAAANc"]
[Sat Nov 15 03:40:16.806276 2025] [:error] [pid 44437:tid 44491] [client 4.205.254.11:8543] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sder52u.php"] [unique_id "aReFoOrO1g9UNCoZp04S0wAAAFQ"]
[Sat Nov 15 03:40:20.176627 2025] [:error] [pid 44438:tid 44512] [client 4.205.254.11:8570] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sder52u.php"] [unique_id "aReFpAUQm6jCuPWgJllfTgAAAI4"]
[Sat Nov 15 03:40:21.273920 2025] [:error] [pid 44438:tid 44518] [client 4.205.254.11:8339] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sder52u.php"] [unique_id "aReFpQUQm6jCuPWgJllfUgAAAJQ"]
[Sat Nov 15 03:40:22.432032 2025] [:error] [pid 44438:tid 44502] [client 4.205.254.11:8325] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asserter.php"] [unique_id "aReFpgUQm6jCuPWgJllfVQAAAIQ"]
[Sat Nov 15 03:40:24.999073 2025] [:error] [pid 44436:tid 44455] [client 4.205.254.11:8552] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asserter.php"] [unique_id "aReFqDUs0t-jxzSR5Sg_zAAAAAs"]
[Sat Nov 15 03:40:27.292113 2025] [:error] [pid 44436:tid 44454] [client 4.205.254.11:8372] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asserter.php"] [unique_id "aReFqzUs0t-jxzSR5Sg_zgAAAAo"]
[Sat Nov 15 03:40:28.503868 2025] [:error] [pid 44438:tid 44512] [client 4.205.254.11:8542] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asserter.php"] [unique_id "aReFrAUQm6jCuPWgJllfXAAAAI4"]
[Sat Nov 15 03:40:30.743680 2025] [:error] [pid 44527:tid 44539] [client 4.205.254.11:9166] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "aReFrjZn1ZaBElIfEGIDkAAAAMc"]
[Sat Nov 15 03:40:31.700726 2025] [:error] [pid 44438:tid 44516] [client 4.205.254.11:8597] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "aReFrwUQm6jCuPWgJllfYwAAAJI"]
[Sat Nov 15 03:40:35.228729 2025] [:error] [pid 44437:tid 44487] [client 4.205.254.11:8322] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "aReFs-rO1g9UNCoZp04S3QAAAFA"]
[Sat Nov 15 03:40:36.086697 2025] [:error] [pid 44437:tid 44472] [client 4.205.254.11:9156] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "aReFtOrO1g9UNCoZp04S3gAAAEE"]
[Sat Nov 15 03:40:37.585023 2025] [:error] [pid 44438:tid 44514] [client 4.205.254.11:8517] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pass.php"] [unique_id "aReFtQUQm6jCuPWgJllfbwAAAJA"]
[Sat Nov 15 03:40:38.289024 2025] [:error] [pid 44438:tid 44516] [client 4.205.254.11:9187] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pass.php"] [unique_id "aReFtgUQm6jCuPWgJllfcAAAAJI"]
[Sat Nov 15 03:40:40.980706 2025] [:error] [pid 44527:tid 44537] [client 4.205.254.11:8611] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pass.php"] [unique_id "aReFuDZn1ZaBElIfEGIDlgAAAMU"]
[Sat Nov 15 03:40:52.610821 2025] [:error] [pid 44527:tid 44546] [client 4.205.254.11:8526] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/l.php"] [unique_id "aReFxDZn1ZaBElIfEGIDsQAAAM4"]
[Sat Nov 15 03:41:03.177455 2025] [:error] [pid 44436:tid 44465] [client 4.205.254.11:8550] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/l.php"] [unique_id "aReFzzUs0t-jxzSR5ShAAQAAABU"]
[Sat Nov 15 03:41:04.668977 2025] [:error] [pid 44436:tid 44450] [client 4.205.254.11:9177] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/l.php"] [unique_id "aReF0DUs0t-jxzSR5ShAAwAAAAY"]
[Sat Nov 15 03:41:06.595508 2025] [:error] [pid 44438:tid 44501] [client 4.205.254.11:9208] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/l.php"] [unique_id "aReF0gUQm6jCuPWgJllfpAAAAIM"]
[Sat Nov 15 03:41:18.083983 2025] [:error] [pid 44436:tid 44459] [client 4.205.254.11:8612] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aReF3jUs0t-jxzSR5ShAHgAAAA8"]
[Sat Nov 15 03:41:19.248334 2025] [:error] [pid 44438:tid 44502] [client 4.205.254.11:8332] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aReF3wUQm6jCuPWgJllfswAAAIQ"]
[Sat Nov 15 03:41:21.008631 2025] [:error] [pid 44436:tid 44449] [client 4.205.254.11:40362] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aReF4TUs0t-jxzSR5ShAIQAAAAU"]
[Sat Nov 15 03:41:23.920075 2025] [:error] [pid 44436:tid 44468] [client 4.205.254.11:8622] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aReF4zUs0t-jxzSR5ShAJwAAABg"]
[Sat Nov 15 03:41:27.497769 2025] [:error] [pid 44527:tid 44533] [client 4.205.254.11:8538] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-su.php"] [unique_id "aReF5zZn1ZaBElIfEGID7QAAAME"]
[Sat Nov 15 03:41:29.061486 2025] [:error] [pid 44437:tid 44491] [client 4.205.254.11:9195] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-su.php"] [unique_id "aReF6erO1g9UNCoZp04THwAAAFQ"]
[Sat Nov 15 03:41:29.975514 2025] [:error] [pid 44527:tid 44536] [client 4.205.254.11:8381] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-su.php"] [unique_id "aReF6TZn1ZaBElIfEGID8QAAAMQ"]
[Sat Nov 15 03:41:31.214066 2025] [:error] [pid 44437:tid 44478] [client 4.205.254.11:8528] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-su.php"] [unique_id "aReF6-rO1g9UNCoZp04TIwAAAEc"]
[Sat Nov 15 03:41:31.992730 2025] [:error] [pid 44438:tid 44500] [client 4.205.254.11:9201] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t3x.php"] [unique_id "aReF6wUQm6jCuPWgJllfyAAAAII"]
[Sat Nov 15 03:41:34.017615 2025] [:error] [pid 44527:tid 44538] [client 4.205.254.11:8595] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t3x.php"] [unique_id "aReF7jZn1ZaBElIfEGID-gAAAMY"]
[Sat Nov 15 03:41:36.114391 2025] [:error] [pid 44527:tid 44556] [client 4.205.254.11:8357] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t3x.php"] [unique_id "aReF8DZn1ZaBElIfEGID_AAAANg"]
[Sat Nov 15 03:41:38.921106 2025] [:error] [pid 44527:tid 44539] [client 4.205.254.11:8592] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t3x.php"] [unique_id "aReF8jZn1ZaBElIfEGIEBAAAAMc"]
[Sat Nov 15 03:41:40.714788 2025] [:error] [pid 44436:tid 44444] [client 4.205.254.11:8512] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "aReF9DUs0t-jxzSR5ShANAAAAAA"]
[Sat Nov 15 03:41:54.253426 2025] [:error] [pid 44437:tid 44494] [client 4.205.254.11:8569] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "aReGAurO1g9UNCoZp04TSgAAAFc"]
[Sat Nov 15 03:41:55.266354 2025] [:error] [pid 44527:tid 44554] [client 4.205.254.11:8366] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yasnu.php"] [unique_id "aReGAzZn1ZaBElIfEGIELwAAANY"]
[Sat Nov 15 03:42:05.711443 2025] [:error] [pid 44527:tid 44556] [client 4.205.254.11:8360] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yasnu.php"] [unique_id "aReGDTZn1ZaBElIfEGIEXwAAANg"]
[Sat Nov 15 03:42:06.982457 2025] [:error] [pid 44438:tid 44508] [client 4.205.254.11:8375] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yasnu.php"] [unique_id "aReGDgUQm6jCuPWgJllgDQAAAIo"]
[Sat Nov 15 03:42:08.556993 2025] [:error] [pid 44436:tid 44459] [client 4.205.254.11:8518] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yasnu.php"] [unique_id "aReGEDUs0t-jxzSR5ShAdwAAAA8"]
[Sat Nov 15 03:42:30.896612 2025] [:error] [pid 44437:tid 44477] [client 4.205.254.11:8898] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yzkvrell.php"] [unique_id "aReGJurO1g9UNCoZp04TtQAAAEY"]
[Sat Nov 15 03:42:39.543212 2025] [:error] [pid 44437:tid 44477] [client 4.205.254.11:8571] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yzkvrell.php"] [unique_id "aReGL-rO1g9UNCoZp04TvwAAAEY"]
[Sat Nov 15 03:42:42.042588 2025] [:error] [pid 44527:tid 44539] [client 4.205.254.11:8541] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yzkvrell.php"] [unique_id "aReGMjZn1ZaBElIfEGIEyQAAAMc"]
[Sat Nov 15 03:42:54.139190 2025] [:error] [pid 44436:tid 44468] [client 4.205.254.11:9167] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aReGPjUs0t-jxzSR5ShA3gAAABg"]
[Sat Nov 15 03:42:55.806124 2025] [:error] [pid 44437:tid 44477] [client 4.205.254.11:9192] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aReGP-rO1g9UNCoZp04T1AAAAEY"]
[Sat Nov 15 03:43:04.778116 2025] [:error] [pid 44438:tid 44506] [client 4.205.254.11:8519] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aReGSAUQm6jCuPWgJllgpQAAAIg"]
[Sat Nov 15 03:43:05.680278 2025] [:error] [pid 44527:tid 44550] [client 4.205.254.11:8537] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aReGSTZn1ZaBElIfEGIFCQAAANI"]
[Sat Nov 15 03:43:20.226598 2025] [:error] [pid 44438:tid 44518] [client 4.205.254.11:9196] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-749.php"] [unique_id "aReGWAUQm6jCuPWgJllgvgAAAJQ"]
[Sat Nov 15 03:43:29.639520 2025] [:error] [pid 44438:tid 44519] [client 4.205.254.11:9086] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/fm.php"] [unique_id "aReGYQUQm6jCuPWgJllg0gAAAJU"]
[Sat Nov 15 03:44:31.306452 2025] [:error] [pid 10489:tid 10511] [client 4.205.254.11:8367] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/re.php"] [unique_id "aReGn1ckOpF1_1u6OZzADQAAANE"]
[Sat Nov 15 03:44:32.357865 2025] [:error] [pid 10387:tid 10445] [client 4.205.254.11:8605] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/re.php"] [unique_id "aReGoBdNOLyrhC55hYO6agAAAFI"]
[Sat Nov 15 03:44:38.429807 2025] [:error] [pid 10388:tid 10466] [client 4.205.254.11:8382] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/re.php"] [unique_id "aReGps5Taslk19icHk5BtQAAAIw"]
[Sat Nov 15 03:44:40.706082 2025] [:error] [pid 10489:tid 10518] [client 4.205.254.11:8587] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/re.php"] [unique_id "aReGqFckOpF1_1u6OZzAIAAAANg"]
[Sat Nov 15 03:44:43.047508 2025] [:error] [pid 10489:tid 10516] [client 4.205.254.11:9205] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up.php"] [unique_id "aReGq1ckOpF1_1u6OZzAJQAAANY"]
[Sat Nov 15 03:44:44.165227 2025] [:error] [pid 10387:tid 10451] [client 4.205.254.11:8568] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up.php"] [unique_id "aReGrBdNOLyrhC55hYO6cwAAAFg"]
[Sat Nov 15 03:44:44.956623 2025] [:error] [pid 10387:tid 10441] [client 4.205.254.11:8515] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up.php"] [unique_id "aReGrBdNOLyrhC55hYO6dQAAAE4"]
[Sat Nov 15 03:44:46.332204 2025] [:error] [pid 10387:tid 10435] [client 4.205.254.11:9198] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up.php"] [unique_id "aReGrhdNOLyrhC55hYO6eAAAAEg"]
[Sat Nov 15 03:44:49.376249 2025] [:error] [pid 10489:tid 10501] [client 4.205.254.11:9160] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/35.php"] [unique_id "aReGsVckOpF1_1u6OZzAMQAAAMc"]
[Sat Nov 15 03:44:56.469564 2025] [:error] [pid 10387:tid 10427] [client 4.205.254.11:9204] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/35.php"] [unique_id "aReGuBdNOLyrhC55hYO6igAAAEA"]
[Sat Nov 15 03:44:57.759671 2025] [:error] [pid 10489:tid 10507] [client 4.205.254.11:8570] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/35.php"] [unique_id "aReGuVckOpF1_1u6OZzAPQAAAM0"]
[Sat Nov 15 03:45:00.088049 2025] [:error] [pid 10489:tid 10495] [client 4.205.254.11:8546] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/35.php"] [unique_id "aReGvFckOpF1_1u6OZzARQAAAME"]
[Sat Nov 15 03:45:02.384118 2025] [:error] [pid 10388:tid 10478] [client 4.205.254.11:8606] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/witm.php"] [unique_id "aReGvs5Taslk19icHk5B3QAAAJg"]
[Sat Nov 15 03:45:03.722996 2025] [:error] [pid 10489:tid 10495] [client 4.205.254.11:8953] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/witm.php"] [unique_id "aReGv1ckOpF1_1u6OZzAUgAAAME"]
[Sat Nov 15 03:45:06.840256 2025] [:error] [pid 10489:tid 10504] [client 4.205.254.11:8532] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/witm.php"] [unique_id "aReGwlckOpF1_1u6OZzAWwAAAMo"]
[Sat Nov 15 03:45:08.519605 2025] [:error] [pid 10388:tid 10464] [client 4.205.254.11:8341] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/witm.php"] [unique_id "aReGxM5Taslk19icHk5B8QAAAIo"]
[Sat Nov 15 03:45:09.420300 2025] [:error] [pid 10489:tid 10504] [client 4.205.254.11:9164] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aReGxVckOpF1_1u6OZzAZQAAAMo"]
[Sat Nov 15 03:45:11.602717 2025] [:error] [pid 10388:tid 10466] [client 4.205.254.11:8516] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aReGx85Taslk19icHk5B9gAAAIw"]
[Sat Nov 15 03:45:12.549593 2025] [:error] [pid 10388:tid 10464] [client 4.205.254.11:9197] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aReGyM5Taslk19icHk5B-QAAAIo"]
[Sat Nov 15 03:45:13.919853 2025] [:error] [pid 10386:tid 10417] [client 4.205.254.11:8576] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aReGydh9QLimDNE-fblb8wAAABM"]
[Sat Nov 15 03:45:14.696358 2025] [:error] [pid 10387:tid 10427] [client 4.205.254.11:8574] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless2.php"] [unique_id "aReGyhdNOLyrhC55hYO6sAAAAEA"]
[Sat Nov 15 03:45:16.909135 2025] [:error] [pid 10386:tid 10410] [client 4.205.254.11:8524] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless2.php"] [unique_id "aReGzNh9QLimDNE-fblb_QAAAAw"]
[Sat Nov 15 03:45:22.593591 2025] [:error] [pid 10387:tid 10429] [client 4.205.254.11:8584] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless2.php"] [unique_id "aReG0hdNOLyrhC55hYO6vgAAAEI"]
[Sat Nov 15 03:45:23.160140 2025] [:error] [pid 10386:tid 10413] [client 4.205.254.11:8517] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless2.php"] [unique_id "aReG09h9QLimDNE-fblcCwAAAA8"]
[Sat Nov 15 03:45:25.569261 2025] [:error] [pid 10386:tid 10409] [client 4.205.254.11:9154] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "aReG1dh9QLimDNE-fblcXgAAAAs"]
[Sat Nov 15 03:45:28.123127 2025] [:error] [pid 10489:tid 10513] [client 4.205.254.11:8383] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "aReG2FckOpF1_1u6OZzAtQAAANM"]
[Sat Nov 15 03:45:29.495078 2025] [:error] [pid 10489:tid 10510] [client 4.205.254.11:9206] [client 4.205.254.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "aReG2VckOpF1_1u6OZzAvAAAANA"]
[Sat Nov 15 05:12:29.511268 2025] [:error] [pid 27909:tid 27930] [client 182.42.111.213:52389] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aRebPSTfZ6B57n8HepWBMgAAABE"]
[Sat Nov 15 05:32:04.611284 2025] [:error] [pid 27911:tid 27970] [client 103.109.180.104:42004] [client 103.109.180.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.109.180.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRef1MGzUdrhGBIfiKS8IgAAAII"]
[Sat Nov 15 05:32:05.911059 2025] [:error] [pid 27911:tid 27989] [client 103.109.180.104:42004] [client 103.109.180.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.109.180.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRef1cGzUdrhGBIfiKS8JQAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Sat Nov 15 08:49:14.119772 2025] [:error] [pid 37318:tid 37362] [client 79.127.185.202:42136] [client 79.127.185.202] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 79.127.185.202, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRfOCugM1rHoEAqoQDd_bgAAAQA"]
[Sat Nov 15 08:49:15.981627 2025] [:error] [pid 27910:tid 27959] [client 79.127.185.202:36908] [client 79.127.185.202] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 79.127.185.202, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRfOC46e1LusHMYkS7aNWAAAAFI"]
[Sat Nov 15 10:04:49.306500 2025] [:error] [pid 27909:tid 27923] [client 173.239.211.38:53175] [client 173.239.211.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aRffwSTfZ6B57n8HepXXJgAAAAo"]
[Sat Nov 15 10:05:00.183836 2025] [:error] [pid 20346:tid 20361] [client 63.135.161.113:24387] [client 63.135.161.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bk/index.php"] [unique_id "aRffzJ7hsydZdIoVTluscQAAAww"]
[Sat Nov 15 10:05:23.455650 2025] [:error] [pid 27997:tid 28016] [client 173.239.211.54:36077] [client 173.239.211.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aRff49pja_6cDxKbxFl2EgAAANE"]
[Sat Nov 15 10:05:32.203935 2025] [:error] [pid 27909:tid 27914] [client 63.135.161.114:63571] [client 63.135.161.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aRff7CTfZ6B57n8HepXXUAAAAAE"]
[Sat Nov 15 10:05:33.172286 2025] [:error] [pid 19959:tid 19985] [client 173.239.211.54:33371] [client 173.239.211.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/chosen.php"] [unique_id "aRff7cjejiTUP1-IawNj8QAAAZM"]
[Sat Nov 15 10:05:35.769095 2025] [:error] [pid 20654:tid 20670] [client 173.239.211.35:35907] [client 173.239.211.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aRff73cS7eC8vO76_ydCoAAAA40"]
[Sat Nov 15 10:05:44.613352 2025] [:error] [pid 20654:tid 20659] [client 173.239.211.38:42905] [client 173.239.211.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aRff-HcS7eC8vO76_ydCtAAAA4I"]
[Sat Nov 15 10:05:47.991521 2025] [:error] [pid 22765:tid 22788] [client 45.130.83.239:25227] [client 45.130.83.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aRff-6brQzjuZmPIWDaFJgAAApI"]
[Sat Nov 15 10:06:10.351978 2025] [:error] [pid 20654:tid 20670] [client 45.130.83.238:32297] [client 45.130.83.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aRfgEncS7eC8vO76_ydC6wAAA40"]
[Sat Nov 15 10:06:11.395671 2025] [:error] [pid 20654:tid 20669] [client 63.135.161.114:65525] [client 63.135.161.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aRfgE3cS7eC8vO76_ydC7AAAA4w"]
[Sat Nov 15 10:08:07.726744 2025] [:error] [pid 27997:tid 28020] [client 173.239.211.50:37639] [client 173.239.211.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.211.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRfgh9pja_6cDxKbxFl22gAAANU"]
[Sat Nov 15 10:08:47.014918 2025] [autoindex:error] [pid 20346:tid 20351] [client 173.239.211.52:42387] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 15 10:08:49.841021 2025] [autoindex:error] [pid 20346:tid 20373] [client 173.239.211.52:42387] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 15 12:09:26.465855 2025] [:error] [pid 19959:tid 19982] [client 138.197.23.42:64671] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRf89sjejiTUP1-IawOAJgAAAZA"]
[Sat Nov 15 12:09:26.882687 2025] [:error] [pid 20654:tid 20674] [client 138.197.23.42:64824] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRf89ncS7eC8vO76_ydtlgAAA5E"]
[Sat Nov 15 12:09:27.307218 2025] [:error] [pid 27997:tid 28009] [client 138.197.23.42:64975] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRf899pja_6cDxKbxFmOOwAAAMo"]
[Sat Nov 15 12:09:27.729830 2025] [:error] [pid 22613:tid 22639] [client 138.197.23.42:65143] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRf89yoyR3cDsIRGPRl8fwAAAhg"]
[Sat Nov 15 12:09:28.171289 2025] [:error] [pid 20313:tid 20338] [client 138.197.23.42:54185] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRf8-BI9DXIgPadBLUZSRgAAAtY"]
[Sat Nov 15 13:49:55.124322 2025] [:error] [pid 22613:tid 22630] [client 172.166.217.122:46708] [client 172.166.217.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.166.217.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRgUgyoyR3cDsIRGPRmO8AAAAg8"]
[Sat Nov 15 13:49:56.958708 2025] [:error] [pid 20313:tid 20339] [client 172.166.217.122:45266] [client 172.166.217.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.166.217.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRgUhBI9DXIgPadBLUZh5QAAAtc"], referer: http://expressinteriors.com/wp-login.php
[Sat Nov 15 13:49:59.068993 2025] [:error] [pid 20654:tid 20665] [client 172.166.217.122:33072] [client 172.166.217.122] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aRgUh3cS7eC8vO76_yePYgAAA4g"], referer: http://expressinteriors.com/wp-login.php
[Sat Nov 15 13:50:00.038960 2025] [:error] [pid 19959:tid 19990] [client 172.166.217.122:33084] [client 172.166.217.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.166.217.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRgUiMjejiTUP1-IawOYjwAAAZg"], referer: https://expressinteriors.com/wp-login.php?redirect_to=https%3A%2F%2Fexpressinteriors.com%2Fwp-admin%2F
[Sat Nov 15 13:52:52.088229 2025] [:error] [pid 19961:tid 20008] [client 217.138.193.103:22178] [client 217.138.193.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.138.193.103, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRgVNDar7Si-84EApVRHSwAAAc8"]
[Sat Nov 15 15:42:09.429565 2025] [:error] [pid 19961:tid 20017] [client 217.138.193.103:3535] [client 217.138.193.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.138.193.103, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRgu0Tar7Si-84EApVRZywAAAdg"]
[Sat Nov 15 15:50:28.946712 2025] [:error] [pid 20313:tid 20320] [client 106.222.218.117:11495] [client 106.222.218.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.218.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRgwxBI9DXIgPadBLUZ0WAAAAsQ"]
[Sat Nov 15 15:56:55.846232 2025] [:error] [pid 27997:tid 28014] [client 31.217.165.14:25612] [client 31.217.165.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.217.165.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRgyR9pja_6cDxKbxFm6PgAAAM8"]
[Sat Nov 15 17:00:11.700742 2025] [:error] [pid 20346:tid 20356] [client 192.200.210.52:63323] [client 192.200.210.52] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aRhBG57hsydZdIoVTlsasAAAAwc"]
[Sat Nov 15 17:17:50.419395 2025] [:error] [pid 27997:tid 28002] [client 43.153.62.161:38586] [client 43.153.62.161] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRhFPtpja_6cDxKbxFnJGQAAAMM"]
[Sat Nov 15 17:20:45.330157 2025] [autoindex:error] [pid 19959:tid 19987] [client 20.2.83.141:57017] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Nov 15 17:36:58.816582 2025] [:error] [pid 19959:tid 19972] [client 216.26.240.247:38135] [client 216.26.240.247] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.26.240.247, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRhJusjejiTUP1-IawPLsQAAAYY"], referer: https://expressinteriors.com/
[Sat Nov 15 17:37:00.470980 2025] [:error] [pid 22765:tid 22791] [client 216.26.240.247:42691] [client 216.26.240.247] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.26.240.247, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRhJvKbrQzjuZmPIWDbhPgAAApU"], referer: https://expressinteriors.com/wp-login.php?action=register
[Sat Nov 15 17:40:45.439941 2025] [:error] [pid 27909:tid 27923] [client 217.138.193.103:56597] [client 217.138.193.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.138.193.103, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRhKnSTfZ6B57n8HepUkaAAAAAo"]
[Sat Nov 15 17:41:08.683273 2025] [:error] [pid 20313:tid 20323] [client 223.244.35.77:44248] [client 223.244.35.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aRhKtBI9DXIgPadBLUaFpQAAAsc"]
[Sat Nov 15 19:40:54.521095 2025] [:error] [pid 19961:tid 19996] [client 217.138.193.103:1648] [client 217.138.193.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.138.193.103, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRhmxjar7Si-84EApVSAxQAAAcM"]
[Sat Nov 15 20:16:14.313369 2025] [:error] [pid 19959:tid 19987] [client 45.138.16.215:55188] [client 45.138.16.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/postnews.php"] [unique_id "aRhvDsjejiTUP1-IawPsNQAAAZU"]
[Sat Nov 15 20:16:14.871373 2025] [:error] [pid 19959:tid 19975] [client 45.138.16.215:55269] [client 45.138.16.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/postnews.php"] [unique_id "aRhvDsjejiTUP1-IawPsNgAAAYk"]
[Sat Nov 15 20:16:15.421049 2025] [:error] [pid 20654:tid 20666] [client 45.138.16.215:55350] [client 45.138.16.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/postnews.php"] [unique_id "aRhvD3cS7eC8vO76_ycGawAAA4k"]
[Sat Nov 15 20:26:27.999316 2025] [:error] [pid 20346:tid 20353] [client 45.134.79.103:64071] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRhxc57hsydZdIoVTltMzwAAAwQ"]
[Sat Nov 15 20:26:28.656761 2025] [:error] [pid 19961:tid 20014] [client 45.134.79.103:64265] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRhxdDar7Si-84EApVSFtQAAAdU"]
[Sat Nov 15 20:26:29.309776 2025] [:error] [pid 27997:tid 28013] [client 45.134.79.103:64431] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aRhxddpja_6cDxKbxFnrAgAAAM4"]
[Sat Nov 15 21:12:02.072272 2025] [:error] [pid 22613:tid 22622] [client 106.222.218.117:26729] [client 106.222.218.117] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aRh8IioyR3cDsIRGPRnZCQAAAgc"]
[Sat Nov 15 21:13:56.940882 2025] [:error] [pid 22765:tid 22784] [client 106.222.218.117:12211] [client 106.222.218.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.218.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRh8lKbrQzjuZmPIWDYFawAAAo4"]
[Sat Nov 15 21:15:49.193586 2025] [:error] [pid 22765:tid 22783] [client 106.222.218.117:19372] [client 106.222.218.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.218.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRh9BabrQzjuZmPIWDYFqwAAAo0"]
[Sat Nov 15 21:17:37.551893 2025] [:error] [pid 20313:tid 20324] [client 106.222.218.117:24565] [client 106.222.218.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.218.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRh9cRI9DXIgPadBLUajzAAAAsg"]
[Sat Nov 15 21:19:35.060925 2025] [:error] [pid 19961:tid 19996] [client 106.222.218.117:17271] [client 106.222.218.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.218.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRh95zar7Si-84EApVSLwQAAAcM"]
[Sat Nov 15 21:21:46.166736 2025] [:error] [pid 27909:tid 27919] [client 106.222.218.117:18075] [client 106.222.218.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.218.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRh-aiTfZ6B57n8HepVEkgAAAAY"]
[Sat Nov 15 21:43:20.609203 2025] [:error] [pid 20313:tid 20331] [client 217.138.193.103:59635] [client 217.138.193.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.138.193.103, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRiDeBI9DXIgPadBLUamoAAAAs8"]
[Sat Nov 15 22:19:50.448356 2025] [:error] [pid 19959:tid 19976] [client 152.42.200.79:63693] [client 152.42.200.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aRiMBsjejiTUP1-IawP_gwAAAYo"]
[Sat Nov 15 23:02:56.152443 2025] [:error] [pid 27997:tid 28013] [client 188.130.143.204:51261] [client 188.130.143.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.130.143.204, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRiWINpja_6cDxKbxFn_rgAAAM4"], referer: https://expressinteriors.com/
[Sat Nov 15 23:02:59.675768 2025] [:error] [pid 20346:tid 20365] [client 188.130.143.204:40461] [client 188.130.143.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.130.143.204, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRiWI57hsydZdIoVTltpUQAAAxA"], referer: https://expressinteriors.com/wp-login.php?action=register
[Sat Nov 15 23:41:59.422699 2025] [:error] [pid 20654:tid 20671] [client 217.138.193.103:25848] [client 217.138.193.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.138.193.103, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRifR3cS7eC8vO76_ycrWgAAA44"]
[Sun Nov 16 00:41:21.426721 2025] [:error] [pid 22613:tid 22637] [client 36.111.67.189:60624] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRitMSoyR3cDsIRGPRnwRAAAAhY"]
[Sun Nov 16 01:46:20.260192 2025] [:error] [pid 20346:tid 20372] [client 217.138.193.103:64274] [client 217.138.193.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.138.193.103, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRi8bJ7hsydZdIoVTluGdwAAAxc"]
[Sun Nov 16 02:39:12.820430 2025] [:error] [pid 22765:tid 22784] [client 170.106.84.136:54190] [client 170.106.84.136] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRjI0KbrQzjuZmPIWDZP2gAAAo4"]
[Sun Nov 16 03:10:02.963624 2025] [:error] [pid 19961:tid 20012] [client 20.171.157.114:64876] [client 20.171.157.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/network.php"] [unique_id "aRjQCjar7Si-84EApVSw8gAAAdM"]
[Sun Nov 16 03:10:03.312710 2025] [:error] [pid 27909:tid 27926] [client 20.171.157.114:64784] [client 20.171.157.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.171.157.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aRjQCyTfZ6B57n8HepVp1wAAAA0"]
[Sun Nov 16 03:10:09.016406 2025] [:error] [pid 27909:tid 27927] [client 20.171.157.114:64784] [client 20.171.157.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aRjQESTfZ6B57n8HepVp3wAAAA4"]
[Sun Nov 16 03:10:14.678409 2025] [:error] [pid 27997:tid 28010] [client 20.171.157.114:64882] [client 20.171.157.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/about.php"] [unique_id "aRjQFtpja_6cDxKbxFkfTQAAAMs"]
[Sun Nov 16 03:10:15.030325 2025] [:error] [pid 20313:tid 20317] [client 20.171.157.114:64326] [client 20.171.157.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/about.php"] [unique_id "aRjQFxI9DXIgPadBLUbHYwAAAsE"]
[Sun Nov 16 03:10:15.396249 2025] [:error] [pid 19959:tid 19980] [client 20.171.157.114:64827] [client 20.171.157.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/about.php"] [unique_id "aRjQF8jejiTUP1-IawMpBAAAAY4"]
[Sun Nov 16 03:10:15.724750 2025] [:error] [pid 22613:tid 22620] [client 20.171.157.114:64785] [client 20.171.157.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/about.php"] [unique_id "aRjQFyoyR3cDsIRGPRkDNwAAAgU"]
[Sun Nov 16 03:52:44.911873 2025] [:error] [pid 52470:tid 52517] [client 217.138.193.103:65493] [client 217.138.193.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.138.193.103, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRjaDEg9mXF2ZFFtj1W4KgAAAEw"]
[Sun Nov 16 07:01:58.642774 2025] [:error] [pid 52469:tid 52483] [client 182.44.2.148:48844] [client 182.44.2.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aRkGZk6HaXpHeEZ98Z0cRAAAAAY"]
[Sun Nov 16 11:13:43.965000 2025] [:error] [pid 20556:tid 20581] [client 43.130.111.40:42324] [client 43.130.111.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aRlBZ0kbyEckbWtBcCILCQAAARc"]
[Sun Nov 16 12:16:20.061232 2025] [:error] [pid 52469:tid 52499] [client 134.122.28.88:42312] [client 134.122.28.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aRlQFE6HaXpHeEZ98Z1jnwAAABY"]
[Sun Nov 16 12:16:27.653684 2025] [authz_core:error] [pid 52469:tid 52489] [client 134.122.28.88:44656] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Sun Nov 16 12:16:31.641419 2025] [:error] [pid 52469:tid 52501] [client 134.122.28.88:44700] [client 134.122.28.88] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aRlQH06HaXpHeEZ98Z1jsgAAABg"]
[Sun Nov 16 12:16:32.262894 2025] [:error] [pid 20556:tid 20573] [client 134.122.28.88:44714] [client 134.122.28.88] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aRlQIEkbyEckbWtBcCIlTgAAAQ8"]
[Sun Nov 16 13:27:25.856423 2025] [:error] [pid 34301:tid 34309] [client 181.135.248.35:61359] [client 181.135.248.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.135.248.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRlgvbGPoZwUGuFNREuQyAAAAoU"]
[Sun Nov 16 13:35:31.298801 2025] [:error] [pid 34301:tid 34318] [client 180.102.134.69:48617] [client 180.102.134.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRlio7GPoZwUGuFNREuSSgAAAo4"]
[Sun Nov 16 16:12:30.704256 2025] [:error] [pid 52471:tid 52539] [client 43.153.19.83:54044] [client 43.153.19.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aRmHbtmWsFzjR5CEgDU3wgAAAIc"]
[Sun Nov 16 17:53:49.184151 2025] [:error] [pid 34271:tid 34278] [client 45.138.16.215:51373] [client 45.138.16.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/postnews.php"] [unique_id "aRmfLUNmlZhoZZV1BUCzSQAAAkU"]
[Sun Nov 16 17:53:49.722563 2025] [:error] [pid 34271:tid 34290] [client 45.138.16.215:53546] [client 45.138.16.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/postnews.php"] [unique_id "aRmfLUNmlZhoZZV1BUCzTAAAAlE"]
[Sun Nov 16 17:53:50.259982 2025] [:error] [pid 34271:tid 34280] [client 45.138.16.215:54871] [client 45.138.16.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/postnews.php"] [unique_id "aRmfLkNmlZhoZZV1BUCzTgAAAkc"]
[Sun Nov 16 19:01:34.083100 2025] [autoindex:error] [pid 20556:tid 20567] [client 155.94.163.116:58028] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Nov 16 19:24:09.243522 2025] [ssl:error] [pid 34227:tid 34249] [client 46.101.9.216:42548] AH02032: Hostname atipay.com provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup
[Sun Nov 16 22:47:17.554931 2025] [:error] [pid 34227:tid 34245] [client 172.200.56.243:55122] [client 172.200.56.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aRnj9X108zGLYs9eMuhlvAAAAhA"]
[Sun Nov 16 22:47:18.190917 2025] [:error] [pid 52563:tid 52583] [client 172.200.56.243:55325] [client 172.200.56.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aRnj9s-l3ey-hVJ5AuveegAAANE"]
[Sun Nov 16 22:47:18.926381 2025] [:error] [pid 20556:tid 20559] [client 172.200.56.243:55356] [client 172.200.56.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aRnj9kkbyEckbWtBcCLMwQAAAQE"]
[Sun Nov 16 22:47:19.531143 2025] [:error] [pid 20556:tid 20574] [client 172.200.56.243:52487] [client 172.200.56.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aRnj90kbyEckbWtBcCLMxQAAARA"]
[Sun Nov 16 22:57:11.648851 2025] [:error] [pid 34227:tid 34238] [client 103.110.86.217:33112] [client 103.110.86.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.110.86.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRnmR3108zGLYs9eMuhnNQAAAgk"]
[Sun Nov 16 22:57:12.791002 2025] [:error] [pid 52563:tid 52577] [client 103.110.86.217:39344] [client 103.110.86.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.110.86.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRnmSM-l3ey-hVJ5AuvgHQAAAMs"], referer: http://expressinteriors.com/wp-login.php
[Sun Nov 16 22:57:13.870419 2025] [:error] [pid 34164:tid 34168] [client 103.110.86.217:39556] [client 103.110.86.217] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aRnmSe93ccBCLD8-Q4aQFwAAAYA"], referer: http://expressinteriors.com/wp-login.php
[Sun Nov 16 22:57:14.488335 2025] [:error] [pid 34271:tid 34277] [client 103.110.86.217:39678] [client 103.110.86.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.110.86.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRnmSkNmlZhoZZV1BUDsqQAAAkQ"], referer: https://expressinteriors.com/wp-login.php?redirect_to=https%3A%2F%2Fexpressinteriors.com%2Fwp-admin%2F
[Sun Nov 16 22:59:05.105603 2025] [:error] [pid 52469:tid 52481] [client 43.153.19.83:38376] [client 43.153.19.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRnmuU6HaXpHeEZ98Z0xZwAAAAQ"]
[Mon Nov 17 00:47:52.661495 2025] [:error] [pid 55745:tid 55754] [client 46.101.1.225:50752] [client 46.101.1.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/@vite/env"] [unique_id "aRoAOIZk0eT801XQsatuNAAAAEc"]
[Mon Nov 17 00:47:53.388147 2025] [:error] [pid 55745:tid 55751] [client 46.101.1.225:50756] [client 46.101.1.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/actuator/env"] [unique_id "aRoAOYZk0eT801XQsatuNwAAAEQ"]
[Mon Nov 17 00:47:54.114907 2025] [:error] [pid 55657:tid 55733] [client 46.101.1.225:50772] [client 46.101.1.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aRoAOh2pywrNN427_XQ4HgAAAdQ"]
[Mon Nov 17 00:47:54.841525 2025] [:error] [pid 55655:tid 55674] [client 46.101.1.225:50788] [client 46.101.1.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server"] [unique_id "aRoAOiGT_hu1vaVuRSRl5AAAAA8"]
[Mon Nov 17 00:47:55.569147 2025] [:error] [pid 55745:tid 55769] [client 46.101.1.225:50796] [client 46.101.1.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aRoAO4Zk0eT801XQsatuOQAAAFY"]
[Mon Nov 17 00:47:56.293561 2025] [:error] [pid 65480:tid 332] [client 46.101.1.225:50804] [client 46.101.1.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about"] [unique_id "aRoAPA3NjAS-v6ul5QBRJgAAAMo"]
[Mon Nov 17 00:47:57.016838 2025] [:error] [pid 55745:tid 55749] [client 46.101.1.225:50810] [client 46.101.1.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/debug/default/view"] [unique_id "aRoAPYZk0eT801XQsatuOgAAAEI"]
[Mon Nov 17 00:47:57.764866 2025] [:error] [pid 55745:tid 55764] [client 46.101.1.225:50816] [client 46.101.1.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2/_catalog"] [unique_id "aRoAPYZk0eT801XQsatuPAAAAFE"]
[Mon Nov 17 00:47:58.514892 2025] [:error] [pid 55745:tid 55758] [client 46.101.1.225:50832] [client 46.101.1.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aRoAPoZk0eT801XQsatuPgAAAEs"]
[Mon Nov 17 00:47:59.244594 2025] [:error] [pid 55745:tid 55760] [client 46.101.1.225:50840] [client 46.101.1.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server-status"] [unique_id "aRoAP4Zk0eT801XQsatuQgAAAE0"]
[Mon Nov 17 00:47:59.972862 2025] [:error] [pid 65480:tid 328] [client 46.101.1.225:51258] [client 46.101.1.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login.action"] [unique_id "aRoAPw3NjAS-v6ul5QBRLAAAAMc"]
[Mon Nov 17 00:48:00.735372 2025] [:error] [pid 55655:tid 55678] [client 46.101.1.225:51264] [client 46.101.1.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/_all_dbs"] [unique_id "aRoAQCGT_hu1vaVuRSRl7gAAABM"]
[Mon Nov 17 00:48:01.474507 2025] [:error] [pid 55745:tid 55752] [client 46.101.1.225:51280] [client 46.101.1.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.DS_Store"] [unique_id "aRoAQYZk0eT801XQsatuTgAAAEU"]
[Mon Nov 17 00:48:02.238519 2025] [:error] [pid 55745:tid 55748] [client 46.101.1.225:51290] [client 46.101.1.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aRoAQoZk0eT801XQsatuUwAAAEE"]
[Mon Nov 17 00:48:02.970437 2025] [:error] [pid 55655:tid 55673] [client 46.101.1.225:51294] [client 46.101.1.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aRoAQiGT_hu1vaVuRSRl8QAAAA4"]
[Mon Nov 17 00:48:03.707887 2025] [:error] [pid 55657:tid 55731] [client 46.101.1.225:51308] [client 46.101.1.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aRoAQx2pywrNN427_XQ4RwAAAdI"]
[Mon Nov 17 00:48:04.434798 2025] [:error] [pid 55657:tid 55733] [client 46.101.1.225:51320] [client 46.101.1.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aRoARB2pywrNN427_XQ4SQAAAdQ"]
[Mon Nov 17 00:48:05.164021 2025] [:error] [pid 65480:tid 328] [client 46.101.1.225:51332] [client 46.101.1.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/telescope/requests"] [unique_id "aRoARQ3NjAS-v6ul5QBRRwAAAMc"]
[Mon Nov 17 00:48:05.920743 2025] [:error] [pid 55656:tid 55689] [client 46.101.1.225:51346] [client 46.101.1.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aRoARaZDObyEN97tsHBOvgAAAIM"]
[Mon Nov 17 00:48:06.649246 2025] [:error] [pid 55745:tid 55762] [client 46.101.1.225:51352] [client 46.101.1.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRoARoZk0eT801XQsatuXAAAAE8"]
[Mon Nov 17 01:30:40.858614 2025] [:error] [pid 55657:tid 55709] [client 172.200.56.243:9169] [client 172.200.56.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/yanierin/akcc.php"] [unique_id "aRoKQB2pywrNN427_XRFHgAAAcM"]
[Mon Nov 17 01:30:41.325406 2025] [:error] [pid 65480:tid 333] [client 172.200.56.243:9166] [client 172.200.56.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/yanierin/akcc.php"] [unique_id "aRoKQQ3NjAS-v6ul5QBktwAAAMs"]
[Mon Nov 17 01:30:41.750290 2025] [:error] [pid 55656:tid 55708] [client 172.200.56.243:9185] [client 172.200.56.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/yanierin/akcc.php"] [unique_id "aRoKQaZDObyEN97tsHBbKQAAAJI"]
[Mon Nov 17 01:30:42.208560 2025] [:error] [pid 55657:tid 55728] [client 172.200.56.243:9186] [client 172.200.56.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/yanierin/akcc.php"] [unique_id "aRoKQh2pywrNN427_XRFIQAAAc8"]
[Mon Nov 17 01:45:58.867573 2025] [:error] [pid 55745:tid 55758] [client 40.65.231.36:2682] [client 40.65.231.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aRoN1oZk0eT801XQsauEVAAAAEs"]
[Mon Nov 17 01:46:00.152283 2025] [autoindex:error] [pid 55655:tid 55667] [client 40.65.231.36:6481] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 17 01:46:04.584617 2025] [autoindex:error] [pid 55657:tid 55731] [client 40.65.231.36:1058] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 17 01:46:10.123233 2025] [:error] [pid 55655:tid 55661] [client 40.65.231.36:1838] [client 40.65.231.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.65.231.36, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRoN4iGT_hu1vaVuRSR5yQAAAAI"]
[Mon Nov 17 01:46:11.505077 2025] [autoindex:error] [pid 55657:tid 55734] [client 40.65.231.36:1058] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 17 01:46:12.943696 2025] [autoindex:error] [pid 55657:tid 55727] [client 40.65.231.36:1058] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 17 01:46:15.873192 2025] [:error] [pid 55657:tid 55722] [client 40.65.231.36:1058] [client 40.65.231.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/autoload_classmap.php"] [unique_id "aRoN5x2pywrNN427_XRKlAAAAco"]
[Mon Nov 17 01:46:16.830081 2025] [autoindex:error] [pid 55656:tid 55695] [client 40.65.231.36:2518] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 17 01:46:17.525473 2025] [autoindex:error] [pid 55656:tid 55721] [client 40.65.231.36:2518] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 17 01:46:18.110437 2025] [autoindex:error] [pid 55656:tid 55711] [client 40.65.231.36:2518] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 17 01:46:20.541342 2025] [:error] [pid 55656:tid 55702] [client 40.65.231.36:2518] [client 40.65.231.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/file.php"] [unique_id "aRoN7KZDObyEN97tsHBgggAAAI8"]
[Mon Nov 17 01:46:21.854003 2025] [:error] [pid 55655:tid 55667] [client 40.65.231.36:6525] [client 40.65.231.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aRoN7SGT_hu1vaVuRSR52gAAAAg"]
[Mon Nov 17 01:46:25.885471 2025] [autoindex:error] [pid 55745:tid 55762] [client 40.65.231.36:5970] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 17 01:46:26.603043 2025] [autoindex:error] [pid 55745:tid 55765] [client 40.65.231.36:5970] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 17 01:46:29.915147 2025] [:error] [pid 65480:tid 342] [client 40.65.231.36:3407] [client 40.65.231.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.65.231.36, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRoN9Q3NjAS-v6ul5QBtSwAAANE"]
[Mon Nov 17 01:46:34.274469 2025] [autoindex:error] [pid 55745:tid 55764] [client 40.65.231.36:5970] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 17 01:46:36.648815 2025] [:error] [pid 55745:tid 55747] [client 40.65.231.36:5970] [client 40.65.231.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "aRoN_IZk0eT801XQsauEiQAAAEA"]
[Mon Nov 17 01:46:37.656185 2025] [:error] [pid 55655:tid 55671] [client 40.65.231.36:5076] [client 40.65.231.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "aRoN_SGT_hu1vaVuRSR5-AAAAAw"]
[Mon Nov 17 01:46:38.216833 2025] [:error] [pid 65480:tid 326] [client 40.65.231.36:5836] [client 40.65.231.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "aRoN_g3NjAS-v6ul5QBtWgAAAMY"]
[Mon Nov 17 01:46:38.995493 2025] [:error] [pid 65480:tid 349] [client 40.65.231.36:4221] [client 40.65.231.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "aRoN_g3NjAS-v6ul5QBtWwAAANc"]
[Mon Nov 17 02:36:43.134637 2025] [:error] [pid 65480:tid 349] [client 35.234.52.174:49488] [client 35.234.52.174] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aRoZuw3NjAS-v6ul5QCHJAAAANc"]
[Mon Nov 17 02:44:36.148421 2025] [:error] [pid 55657:tid 55734] [client 4.206.136.178:40897] [client 4.206.136.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aRoblB2pywrNN427_XRcRAAAAdU"]
[Mon Nov 17 02:44:36.982807 2025] [autoindex:error] [pid 55656:tid 55721] [client 4.206.136.178:40843] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 17 02:44:39.810850 2025] [autoindex:error] [pid 65480:tid 350] [client 4.206.136.178:40844] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 17 02:44:44.190980 2025] [:error] [pid 55745:tid 55766] [client 4.206.136.178:40841] [client 4.206.136.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.206.136.178, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRobnIZk0eT801XQsauaUwAAAFM"]
[Mon Nov 17 02:44:45.162118 2025] [autoindex:error] [pid 65480:tid 346] [client 4.206.136.178:40844] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 17 02:44:47.638904 2025] [autoindex:error] [pid 65480:tid 329] [client 4.206.136.178:40844] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 17 02:44:50.037644 2025] [:error] [pid 65480:tid 350] [client 4.206.136.178:40844] [client 4.206.136.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/autoload_classmap.php"] [unique_id "aRobog3NjAS-v6ul5QCL7AAAANg"]
[Mon Nov 17 02:44:50.862762 2025] [autoindex:error] [pid 55655:tid 55664] [client 4.206.136.178:40899] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 17 02:44:51.535578 2025] [autoindex:error] [pid 55655:tid 55659] [client 4.206.136.178:40899] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 17 02:44:52.025716 2025] [autoindex:error] [pid 55655:tid 55677] [client 4.206.136.178:40899] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 17 02:44:54.038689 2025] [:error] [pid 55655:tid 55669] [client 4.206.136.178:40899] [client 4.206.136.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/file.php"] [unique_id "aRobpiGT_hu1vaVuRSSNrgAAAAo"]
[Mon Nov 17 02:44:54.807031 2025] [:error] [pid 55745:tid 55755] [client 4.206.136.178:40933] [client 4.206.136.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aRobpoZk0eT801XQsauaYAAAAEg"]
[Mon Nov 17 02:44:57.758861 2025] [autoindex:error] [pid 55745:tid 55760] [client 4.206.136.178:40944] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 17 02:44:58.110339 2025] [autoindex:error] [pid 55745:tid 55757] [client 4.206.136.178:40944] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 17 02:45:01.361873 2025] [:error] [pid 55655:tid 55665] [client 4.206.136.178:40934] [client 4.206.136.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.206.136.178, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRobrSGT_hu1vaVuRSSNwgAAAAY"]
[Mon Nov 17 02:45:04.170243 2025] [autoindex:error] [pid 55745:tid 55770] [client 4.206.136.178:40944] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 17 02:45:07.104316 2025] [:error] [pid 55745:tid 55767] [client 4.206.136.178:40944] [client 4.206.136.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "aRobs4Zk0eT801XQsauaggAAAFQ"]
[Mon Nov 17 02:45:07.741438 2025] [:error] [pid 65480:tid 342] [client 4.206.136.178:40954] [client 4.206.136.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "aRobsw3NjAS-v6ul5QCMJgAAANE"]
[Mon Nov 17 02:45:08.337087 2025] [:error] [pid 55745:tid 55749] [client 4.206.136.178:40906] [client 4.206.136.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "aRobtIZk0eT801XQsauahQAAAEI"]
[Mon Nov 17 02:45:08.962961 2025] [:error] [pid 55655:tid 55682] [client 4.206.136.178:40924] [client 4.206.136.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "aRobtCGT_hu1vaVuRSSNxgAAABc"]
[Mon Nov 17 04:41:12.880403 2025] [:error] [pid 39537:tid 39558] [client 43.133.220.37:34452] [client 43.133.220.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aRo26IZRrh1pcrdcLB-87AAAANI"]
[Mon Nov 17 08:58:35.436391 2025] [:error] [pid 15150:tid 15169] [client 101.33.66.34:39084] [client 101.33.66.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRpzO32DEo_rcsFuxj0RGwAAAZE"]
[Mon Nov 17 09:23:21.892975 2025] [:error] [pid 39537:tid 39547] [client 180.102.134.69:59440] [client 180.102.134.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aRp5CYZRrh1pcrdcLB9BLwAAAMc"]
[Mon Nov 17 11:09:41.951656 2025] [:error] [pid 65302:tid 65309] [client 36.50.162.234:65455] [client 36.50.162.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.50.162.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRqR9QPMSx2v85r8y7yiOgAAAUU"]
[Mon Nov 17 16:00:06.094495 2025] [:error] [pid 30801:tid 30820] [client 123.187.240.242:44076] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRrWBjbGAU49DhMTBD7KdgAAAlE"]
[Mon Nov 17 16:12:26.575268 2025] [:error] [pid 39449:tid 39466] [client 208.109.32.191:42572] [client 208.109.32.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.109.32.191, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRrY6qUCymTA3MDfzLMlHwAAAAw"], referer: https://expressinteriors.com
[Mon Nov 17 16:20:05.136780 2025] [:error] [pid 31419:tid 31440] [client 61.59.6.105:50504] [client 61.59.6.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 61.59.6.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRratQHQ5Sbp7elmDZhr1QAAApM"], referer: https://expressinteriors.com
[Mon Nov 17 16:35:39.488663 2025] [:error] [pid 40548:tid 40554] [client 134.209.118.102:55452] [client 134.209.118.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.209.118.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRreWwM_PykfYnxh-j9NmQAAAQQ"], referer: https://expressinteriors.com
[Mon Nov 17 16:44:05.709994 2025] [:error] [pid 39537:tid 39564] [client 103.149.169.122:50042] [client 103.149.169.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.149.169.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRrgVYZRrh1pcrdcLB-dwgAAANg"], referer: https://expressinteriors.com
[Mon Nov 17 16:52:43.575296 2025] [:error] [pid 31419:tid 31441] [client 192.248.56.1:54708] [client 192.248.56.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.248.56.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRriWwHQ5Sbp7elmDZhwnAAAApQ"], referer: https://expressinteriors.com
[Mon Nov 17 17:01:19.160100 2025] [:error] [pid 20913:tid 20925] [client 134.209.45.239:45002] [client 134.209.45.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.209.45.239, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRrkX-kafGNeN3nY1bc49wAAA0o"], referer: https://expressinteriors.com
[Mon Nov 17 17:27:34.114783 2025] [:error] [pid 40548:tid 40559] [client 115.190.57.183:42080] [client 115.190.57.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.190.57.183, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRrqhgM_PykfYnxh-j9UaAAAAQk"], referer: https://expressinteriors.com
[Mon Nov 17 17:35:59.884496 2025] [:error] [pid 39537:tid 39547] [client 192.248.56.1:39144] [client 192.248.56.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.248.56.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRrsf4ZRrh1pcrdcLB-lBQAAAMc"], referer: https://expressinteriors.com
[Mon Nov 17 17:44:24.154092 2025] [:error] [pid 39451:tid 39521] [client 157.245.109.248:49720] [client 157.245.109.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.109.248, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRrueOfgkqXTS0SO3fAOigAAAI0"], referer: https://expressinteriors.com
[Mon Nov 17 17:52:54.400781 2025] [:error] [pid 30801:tid 30807] [client 213.156.43.111:35702] [client 213.156.43.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.156.43.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRrwdjbGAU49DhMTBD7aJwAAAkQ"], referer: https://expressinteriors.com
[Mon Nov 17 18:01:29.060719 2025] [:error] [pid 39537:tid 39553] [client 217.131.14.13:46682] [client 217.131.14.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.131.14.13, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRryeYZRrh1pcrdcLB-phQAAAM0"], referer: https://expressinteriors.com
[Mon Nov 17 18:10:42.276447 2025] [:error] [pid 20913:tid 20938] [client 85.95.216.149:35690] [client 85.95.216.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.95.216.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRr0oukafGNeN3nY1bdEuwAAA1c"]
[Mon Nov 17 18:18:50.663827 2025] [:error] [pid 30801:tid 30810] [client 159.65.158.125:45732] [client 159.65.158.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.158.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRr2ijbGAU49DhMTBD7erQAAAkc"], referer: https://expressinteriors.com
[Mon Nov 17 18:35:57.971437 2025] [:error] [pid 20913:tid 20923] [client 165.22.240.243:46284] [client 165.22.240.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.240.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRr6jekafGNeN3nY1bdKWwAAA0g"], referer: https://expressinteriors.com
[Mon Nov 17 18:53:15.098634 2025] [:error] [pid 32753:tid 32774] [client 165.227.140.18:34106] [client 165.227.140.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.227.140.18, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRr-m06YNqI5vkht921twQAAA9I"], referer: https://expressinteriors.com
[Mon Nov 17 19:02:25.458467 2025] [:error] [pid 20913:tid 20933] [client 209.38.229.30:59020] [client 209.38.229.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.38.229.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRsAwekafGNeN3nY1bdQKgAAA1I"], referer: https://expressinteriors.com
[Mon Nov 17 19:11:01.892017 2025] [:error] [pid 15888:tid 15900] [client 165.22.223.164:36966] [client 165.22.223.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.223.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRsCxQjAdDTBm4W3qW0wCgAAAck"], referer: https://expressinteriors.com
[Mon Nov 17 19:19:47.897884 2025] [:error] [pid 32753:tid 32768] [client 101.35.56.33:32940] [client 101.35.56.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 101.35.56.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRsE006YNqI5vkht9213FgAAA8w"], referer: https://expressinteriors.com
[Mon Nov 17 19:28:26.773319 2025] [:error] [pid 65302:tid 65318] [client 128.199.163.66:56452] [client 128.199.163.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.163.66, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRsG2gPMSx2v85r8y7z97QAAAU4"], referer: https://expressinteriors.com
[Mon Nov 17 19:37:11.093590 2025] [:error] [pid 65302:tid 65315] [client 139.99.171.55:57458] [client 139.99.171.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.99.171.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRsI5wPMSx2v85r8y7z_mwAAAUs"], referer: https://expressinteriors.com
[Mon Nov 17 19:45:54.377531 2025] [:error] [pid 31419:tid 31441] [client 162.214.78.123:60722] [client 162.214.78.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.214.78.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRsK8gHQ5Sbp7elmDZiWKQAAApQ"], referer: https://expressinteriors.com
[Mon Nov 17 19:54:35.606964 2025] [:error] [pid 39449:tid 39456] [client 160.22.122.134:33034] [client 160.22.122.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.22.122.134, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRsM-6UCymTA3MDfzLNaEwAAAAI"], referer: https://expressinteriors.com
[Mon Nov 17 20:01:55.284598 2025] [:error] [pid 30801:tid 30809] [client 103.186.31.45:57729] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aRsOszbGAU49DhMTBD7wAwAAAkY"]
[Mon Nov 17 20:01:55.541274 2025] [:error] [pid 39449:tid 39467] [client 103.186.31.45:57803] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/style.php"] [unique_id "aRsOs6UCymTA3MDfzLNcDwAAAA0"]
[Mon Nov 17 20:01:55.784496 2025] [:error] [pid 39537:tid 39562] [client 103.186.31.45:57882] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/style.php"] [unique_id "aRsOs4ZRrh1pcrdcLB-9iwAAANY"]
[Mon Nov 17 20:01:56.046093 2025] [:error] [pid 32753:tid 32759] [client 103.186.31.45:57962] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/style.php"] [unique_id "aRsOtE6YNqI5vkht922DmwAAA8M"]
[Mon Nov 17 20:01:56.301978 2025] [:error] [pid 30801:tid 30820] [client 103.186.31.45:58027] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style.php"] [unique_id "aRsOtDbGAU49DhMTBD7wDQAAAlE"]
[Mon Nov 17 20:01:56.572769 2025] [:error] [pid 30801:tid 30807] [client 103.186.31.45:58098] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aRsOtDbGAU49DhMTBD7wDgAAAkQ"]
[Mon Nov 17 20:01:56.820626 2025] [:error] [pid 30801:tid 30804] [client 103.186.31.45:58172] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aRsOtDbGAU49DhMTBD7wFwAAAkE"]
[Mon Nov 17 20:01:57.079026 2025] [:error] [pid 39449:tid 39478] [client 103.186.31.45:58261] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "aRsOtaUCymTA3MDfzLNcIAAAABg"]
[Mon Nov 17 20:01:57.341934 2025] [:error] [pid 31419:tid 31426] [client 103.186.31.45:58465] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aRsOtQHQ5Sbp7elmDZiY7gAAAoU"]
[Mon Nov 17 20:01:57.603004 2025] [:error] [pid 31419:tid 31429] [client 103.186.31.45:58573] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aRsOtQHQ5Sbp7elmDZiY8AAAAog"]
[Mon Nov 17 20:01:57.858613 2025] [:error] [pid 20913:tid 20919] [client 103.186.31.45:58636] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "aRsOtekafGNeN3nY1bdbMwAAA0Q"]
[Mon Nov 17 20:01:58.114242 2025] [:error] [pid 65302:tid 65318] [client 103.186.31.45:58691] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/blurbs.php"] [unique_id "aRsOtgPMSx2v85r8y7wEGQAAAU4"]
[Mon Nov 17 20:01:58.363318 2025] [:error] [pid 32753:tid 32758] [client 103.186.31.45:58759] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "aRsOtk6YNqI5vkht922D2gAAA8I"]
[Mon Nov 17 20:01:58.602338 2025] [:error] [pid 65302:tid 65316] [client 103.186.31.45:58810] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aRsOtgPMSx2v85r8y7wEJAAAAUw"]
[Mon Nov 17 20:01:58.842564 2025] [:error] [pid 32753:tid 32775] [client 103.186.31.45:58872] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/shelp.php"] [unique_id "aRsOtk6YNqI5vkht922D7AAAA9M"]
[Mon Nov 17 20:01:59.086714 2025] [:error] [pid 31419:tid 31431] [client 103.186.31.45:58926] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/cord.php"] [unique_id "aRsOtwHQ5Sbp7elmDZiY_AAAAoo"]
[Mon Nov 17 20:01:59.336535 2025] [:error] [pid 39449:tid 39456] [client 103.186.31.45:58976] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/dex.php"] [unique_id "aRsOt6UCymTA3MDfzLNcPwAAAAI"]
[Mon Nov 17 20:01:59.617477 2025] [:error] [pid 39449:tid 39471] [client 103.186.31.45:59024] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRsOt6UCymTA3MDfzLNcRAAAABE"]
[Mon Nov 17 20:01:59.878451 2025] [:error] [pid 20913:tid 20935] [client 103.186.31.45:59093] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/file2.php"] [unique_id "aRsOt-kafGNeN3nY1bdbPwAAA1Q"]
[Mon Nov 17 20:02:00.139193 2025] [:error] [pid 39537:tid 39550] [client 103.186.31.45:59172] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aRsOuIZRrh1pcrdcLB-9sAAAAMo"]
[Mon Nov 17 20:02:00.388836 2025] [:error] [pid 15888:tid 15895] [client 103.186.31.45:59352] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/zwso.php"] [unique_id "aRsOuAjAdDTBm4W3qW037QAAAcQ"]
[Mon Nov 17 20:02:00.632567 2025] [:error] [pid 20913:tid 20920] [client 103.186.31.45:59402] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "aRsOuOkafGNeN3nY1bdbUQAAA0U"]
[Mon Nov 17 20:02:00.877395 2025] [:error] [pid 39451:tid 39512] [client 103.186.31.45:59464] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aRsOuOfgkqXTS0SO3fAi7QAAAIQ"]
[Mon Nov 17 20:02:01.124875 2025] [:error] [pid 39537:tid 39555] [client 103.186.31.45:59556] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/shlo.php"] [unique_id "aRsOuYZRrh1pcrdcLB-9ugAAAM8"]
[Mon Nov 17 20:02:01.372114 2025] [:error] [pid 39449:tid 39462] [client 103.186.31.45:59613] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/133.php"] [unique_id "aRsOuaUCymTA3MDfzLNcXQAAAAg"]
[Mon Nov 17 20:02:01.620083 2025] [:error] [pid 39449:tid 39476] [client 103.186.31.45:59666] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ahax.php"] [unique_id "aRsOuaUCymTA3MDfzLNcZAAAABY"]
[Mon Nov 17 20:02:01.870512 2025] [:error] [pid 30801:tid 30813] [client 103.186.31.45:59727] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/php8.php"] [unique_id "aRsOuTbGAU49DhMTBD7wWAAAAko"]
[Mon Nov 17 20:02:02.114063 2025] [:error] [pid 39451:tid 39512] [client 103.186.31.45:59874] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/lufix1.php"] [unique_id "aRsOuufgkqXTS0SO3fAi-QAAAIQ"]
[Mon Nov 17 20:02:02.363207 2025] [:error] [pid 32753:tid 32757] [client 103.186.31.45:59932] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/witmm.php"] [unique_id "aRsOuk6YNqI5vkht922ERQAAA8E"]
[Mon Nov 17 20:02:02.624332 2025] [:error] [pid 20913:tid 20938] [client 103.186.31.45:59987] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/index.php"] [unique_id "aRsOuukafGNeN3nY1bdbXgAAA1c"]
[Mon Nov 17 20:02:02.870482 2025] [:error] [pid 39537:tid 39550] [client 103.186.31.45:60043] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aRsOuoZRrh1pcrdcLB-9zQAAAMo"]
[Mon Nov 17 20:02:03.120615 2025] [:error] [pid 32753:tid 32770] [client 103.186.31.45:60113] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aRsOu06YNqI5vkht922EUwAAA84"]
[Mon Nov 17 20:02:03.366582 2025] [:error] [pid 31419:tid 31440] [client 103.186.31.45:60184] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aRsOuwHQ5Sbp7elmDZiZFgAAApM"]
[Mon Nov 17 20:02:03.614653 2025] [:error] [pid 65302:tid 65305] [client 103.186.31.45:60225] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aRsOuwPMSx2v85r8y7wEVAAAAUE"]
[Mon Nov 17 20:02:03.856973 2025] [:error] [pid 40548:tid 40556] [client 103.186.31.45:60258] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aRsOuwM_PykfYnxh-j9segAAAQY"]
[Mon Nov 17 20:02:04.097529 2025] [:error] [pid 39449:tid 39471] [client 103.186.31.45:60308] [client 103.186.31.45] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-editor.php"] [unique_id "aRsOvKUCymTA3MDfzLNcfgAAABE"]
[Mon Nov 17 20:03:49.419789 2025] [:error] [pid 32753:tid 32779] [client 213.136.93.169:36546] [client 213.136.93.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.136.93.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRsPJU6YNqI5vkht922ExwAAA9c"], referer: https://expressinteriors.com
[Mon Nov 17 20:39:28.450511 2025] [:error] [pid 65302:tid 65327] [client 51.255.71.164:58010] [client 51.255.71.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.255.71.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRsXgAPMSx2v85r8y7wJaAAAAVc"], referer: https://expressinteriors.com
[Mon Nov 17 20:45:57.794274 2025] [:error] [pid 15888:tid 15899] [client 20.171.140.78:65057] [client 20.171.140.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen/function.php"] [unique_id "aRsZBQjAdDTBm4W3qW08WQAAAcg"]
[Mon Nov 17 20:45:58.408075 2025] [:error] [pid 32753:tid 32773] [client 20.171.140.78:65127] [client 20.171.140.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen/function.php"] [unique_id "aRsZBk6YNqI5vkht922O6wAAA9E"]
[Mon Nov 17 20:45:58.993887 2025] [:error] [pid 32753:tid 32779] [client 20.171.140.78:65030] [client 20.171.140.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen/function.php"] [unique_id "aRsZBk6YNqI5vkht922O9QAAA9c"]
[Mon Nov 17 20:45:59.554728 2025] [:error] [pid 32753:tid 32775] [client 20.171.140.78:65058] [client 20.171.140.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen/function.php"] [unique_id "aRsZB06YNqI5vkht922O-QAAA9M"]
[Mon Nov 17 20:48:13.753151 2025] [:error] [pid 39449:tid 39470] [client 103.110.84.40:54502] [client 103.110.84.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRsZjaUCymTA3MDfzLNlKgAAABA"], referer: https://expressinteriors.com
[Mon Nov 17 20:57:01.973338 2025] [:error] [pid 31419:tid 31443] [client 185.17.41.205:46518] [client 185.17.41.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.17.41.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRsbnQHQ5Sbp7elmDZihxAAAApY"], referer: https://expressinteriors.com
[Mon Nov 17 21:05:57.198040 2025] [:error] [pid 39451:tid 39529] [client 75.119.155.103:57520] [client 75.119.155.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 75.119.155.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRsdtefgkqXTS0SO3fAqKAAAAJU"], referer: https://expressinteriors.com
[Mon Nov 17 21:14:53.046187 2025] [:error] [pid 30801:tid 30819] [client 47.238.97.17:50032] [client 47.238.97.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.238.97.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRsfzTbGAU49DhMTBD75awAAAlA"], referer: https://expressinteriors.com
[Mon Nov 17 21:32:42.512359 2025] [:error] [pid 32753:tid 32778] [client 34.93.16.66:49024] [client 34.93.16.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.93.16.66, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRsj-k6YNqI5vkht922ZhgAAA9Y"], referer: https://expressinteriors.com
[Mon Nov 17 21:41:38.452944 2025] [:error] [pid 20913:tid 20920] [client 122.51.207.51:41610] [client 122.51.207.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.51.207.51, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRsmEukafGNeN3nY1bdpmwAAA0U"], referer: https://expressinteriors.com
[Mon Nov 17 22:05:55.971650 2025] [:error] [pid 30801:tid 30816] [client 198.54.120.16:59424] [client 198.54.120.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.120.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRsrwzbGAU49DhMTBD4AQAAAAk0"]
[Mon Nov 17 22:08:13.582366 2025] [:error] [pid 31419:tid 31444] [client 75.119.155.103:34096] [client 75.119.155.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 75.119.155.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRssTQHQ5Sbp7elmDZisKwAAApc"], referer: https://expressinteriors.com
[Mon Nov 17 22:26:03.212535 2025] [:error] [pid 65302:tid 65321] [client 209.42.20.53:41324] [client 209.42.20.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.42.20.53, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRswewPMSx2v85r8y7wXtgAAAVE"], referer: https://expressinteriors.com
[Mon Nov 17 22:35:02.232093 2025] [:error] [pid 30801:tid 30809] [client 139.59.189.244:43782] [client 139.59.189.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.59.189.244, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRsyljbGAU49DhMTBD4DogAAAkY"], referer: https://expressinteriors.com
[Mon Nov 17 22:41:01.358561 2025] [:error] [pid 39451:tid 39523] [client 182.42.105.85:49501] [client 182.42.105.85] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aRsz_efgkqXTS0SO3fA0kgAAAI8"]
[Mon Nov 17 22:49:27.265957 2025] [autoindex:error] [pid 39449:tid 39475] [client 20.171.140.78:52197] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Mon Nov 17 22:49:28.264045 2025] [autoindex:error] [pid 39449:tid 39468] [client 20.171.140.78:52197] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Mon Nov 17 22:49:29.342444 2025] [autoindex:error] [pid 39449:tid 39466] [client 20.171.140.78:52197] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Mon Nov 17 22:49:30.923943 2025] [autoindex:error] [pid 39449:tid 39477] [client 20.171.140.78:52197] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Mon Nov 17 22:54:22.798688 2025] [:error] [pid 20913:tid 20925] [client 165.227.140.18:53672] [client 165.227.140.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.227.140.18, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRs3HukafGNeN3nY1bd1BQAAA0o"], referer: https://expressinteriors.com
[Mon Nov 17 23:21:24.371407 2025] [:error] [pid 32753:tid 32779] [client 51.81.207.12:41732] [client 51.81.207.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.81.207.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRs9dE6YNqI5vkht92211QAAA9c"], referer: https://expressinteriors.com
[Mon Nov 17 23:39:10.514420 2025] [:error] [pid 31419:tid 31428] [client 185.225.33.178:16001] [client 185.225.33.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.225.33.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRtBngHQ5Sbp7elmDZi8DAAAAoc"], referer: https://expressinteriors.com
[Tue Nov 18 00:04:52.345033 2025] [:error] [pid 39537:tid 39555] [client 13.93.123.99:60596] [client 13.93.123.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.93.123.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRtHpIZRrh1pcrdcLB_b8wAAAM8"], referer: https://expressinteriors.com
[Tue Nov 18 00:30:52.891344 2025] [:error] [pid 40562:tid 40638] [client 67.20.113.170:32506] [client 67.20.113.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.20.113.170, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRtNvB18kaCmPuHE4a_6VQAAAU8"], referer: https://expressinteriors.com
[Tue Nov 18 00:38:25.937107 2025] [:error] [pid 40562:tid 40630] [client 154.26.139.30:34636] [client 154.26.139.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.26.139.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRtPgR18kaCmPuHE4a_9LgAAAUc"]
[Tue Nov 18 00:38:29.224280 2025] [:error] [pid 40562:tid 40643] [client 154.26.139.30:34636] [client 154.26.139.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.26.139.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRtPhR18kaCmPuHE4a_9LwAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Tue Nov 18 00:38:43.130156 2025] [:error] [pid 40562:tid 40646] [client 64.227.167.65:45408] [client 64.227.167.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.227.167.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRtPkx18kaCmPuHE4a_9TwAAAVc"], referer: https://expressinteriors.com
[Tue Nov 18 00:46:27.136466 2025] [:error] [pid 40793:tid 40857] [client 162.241.218.223:30410] [client 162.241.218.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.218.223, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRtRYwzccxeNeH-NUVgc6QAAAEc"], referer: https://expressinteriors.com
[Tue Nov 18 00:48:55.443944 2025] [:error] [pid 40561:tid 40612] [client 208.109.34.209:51260] [client 208.109.34.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.109.34.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRtR95dU597fIdQPRD-zrQAAANA"]
[Tue Nov 18 00:54:30.954815 2025] [:error] [pid 40562:tid 40639] [client 188.166.62.194:40802] [client 188.166.62.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.62.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRtTRh18kaCmPuHE4a8CmgAAAVA"], referer: https://expressinteriors.com
[Tue Nov 18 01:01:55.265016 2025] [:error] [pid 40561:tid 40612] [client 142.44.138.99:45142] [client 142.44.138.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.44.138.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRtVA5dU597fIdQPRD-4LAAAANA"], referer: https://expressinteriors.com
[Tue Nov 18 01:10:02.517564 2025] [:error] [pid 40561:tid 40613] [client 42.119.152.23:46474] [client 42.119.152.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 42.119.152.23, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRtW6pdU597fIdQPRD-69AAAANE"], referer: https://expressinteriors.com
[Tue Nov 18 01:18:12.800156 2025] [:error] [pid 40561:tid 40617] [client 91.206.169.102:62206] [client 91.206.169.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/postnews.php"] [unique_id "aRtY1JdU597fIdQPRD-9nAAAANU"]
[Tue Nov 18 01:18:14.732598 2025] [:error] [pid 40553:tid 40584] [client 91.206.169.102:49434] [client 91.206.169.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/postnews.php"] [unique_id "aRtY1tuLE1BqoX0RcsLlLAAAAA8"]
[Tue Nov 18 01:18:17.120236 2025] [:error] [pid 39189:tid 39216] [client 91.206.169.102:64554] [client 91.206.169.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/postnews.php"] [unique_id "aRtY2ZJJLi753QwyqGzWmwAAAJc"]
[Tue Nov 18 01:18:18.169363 2025] [:error] [pid 40793:tid 40868] [client 192.144.234.15:35624] [client 192.144.234.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.144.234.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRtY2gzccxeNeH-NUVgpjgAAAFI"], referer: https://expressinteriors.com
[Tue Nov 18 01:34:33.887020 2025] [:error] [pid 40562:tid 40636] [client 162.144.44.81:53450] [client 162.144.44.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.144.44.81, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRtcqR18kaCmPuHE4a8RRwAAAU0"], referer: https://expressinteriors.com
[Tue Nov 18 01:42:41.612405 2025] [:error] [pid 39189:tid 39202] [client 159.223.34.195:60654] [client 159.223.34.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.34.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRtekZJJLi753QwyqGzjBQAAAIk"], referer: https://expressinteriors.com
[Tue Nov 18 01:46:30.253480 2025] [:error] [pid 39189:tid 39202] [client 185.8.176.230:50426] [client 185.8.176.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.8.176.230, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRtfdpJJLi753QwyqGzlFAAAAIk"]
[Tue Nov 18 01:50:05.318530 2025] [:error] [pid 39189:tid 39201] [client 212.127.78.200:46936] [client 212.127.78.200] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.127.78.200, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRtgTZJJLi753QwyqGznCQAAAIg"], referer: https://expressinteriors.com
[Tue Nov 18 01:57:23.014274 2025] [:error] [pid 40562:tid 40628] [client 50.62.183.174:40270] [client 50.62.183.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.62.183.174, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRtiAx18kaCmPuHE4a8bHwAAAUU"], referer: https://expressinteriors.com
[Tue Nov 18 02:05:10.035673 2025] [:error] [pid 40562:tid 40639] [client 106.14.142.78:37958] [client 106.14.142.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.14.142.78, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRtj1h18kaCmPuHE4a8dxAAAAVA"], referer: https://expressinteriors.com
[Tue Nov 18 02:19:38.173155 2025] [:error] [pid 40793:tid 40868] [client 20.172.5.103:55375] [client 20.172.5.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aRtnOgzccxeNeH-NUVhCFgAAAFI"]
[Tue Nov 18 02:19:38.522049 2025] [:error] [pid 39189:tid 39201] [client 20.172.5.103:55393] [client 20.172.5.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aRtnOpJJLi753QwyqGz2EwAAAIg"]
[Tue Nov 18 02:19:38.901846 2025] [:error] [pid 40793:tid 40852] [client 20.172.5.103:55304] [client 20.172.5.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aRtnOgzccxeNeH-NUVhCFwAAAEI"]
[Tue Nov 18 02:19:39.295763 2025] [:error] [pid 39189:tid 39202] [client 20.172.5.103:55384] [client 20.172.5.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aRtnO5JJLi753QwyqGz2GAAAAIk"]
[Tue Nov 18 02:29:32.005080 2025] [:error] [pid 40562:tid 40628] [client 89.46.110.149:22634] [client 89.46.110.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.46.110.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRtpjB18kaCmPuHE4a8k1wAAAUU"], referer: https://expressinteriors.com
[Tue Nov 18 02:44:49.507145 2025] [:error] [pid 25054:tid 25060] [client 61.59.6.105:47896] [client 61.59.6.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 61.59.6.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRttIbkemTDclsD2J9jYrgAAA4M"], referer: https://expressinteriors.com
[Tue Nov 18 02:59:19.583705 2025] [:error] [pid 25055:tid 25085] [client 139.59.253.161:54998] [client 139.59.253.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.59.253.161, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRtwhy1ycIUMyo0DEcLsWAAAA8E"], referer: https://expressinteriors.com
[Tue Nov 18 03:06:51.680053 2025] [:error] [pid 24898:tid 24919] [client 146.83.7.1:54070] [client 146.83.7.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.83.7.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRtyS2Qbwxb61buaxA9ujgAAAlI"], referer: https://expressinteriors.com
[Tue Nov 18 03:14:27.940830 2025] [:error] [pid 24840:tid 24865] [client 178.62.119.222:55020] [client 178.62.119.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.119.222, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRt0E5Rvn8wwYMxA_KWhWwAAAdc"], referer: https://expressinteriors.com
[Tue Nov 18 03:37:42.878050 2025] [:error] [pid 43058:tid 43082] [client 185.17.41.205:55036] [client 185.17.41.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.17.41.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRt5hmOZQYsmibja-vu_UwAAABQ"], referer: https://expressinteriors.com
[Tue Nov 18 03:45:23.112585 2025] [:error] [pid 43058:tid 43066] [client 182.18.239.189:38648] [client 182.18.239.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.18.239.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRt7U2OZQYsmibja-vvBlQAAAAQ"], referer: https://expressinteriors.com
[Tue Nov 18 03:48:26.766161 2025] [:error] [pid 16433:tid 16480] [client 89.43.31.214:59846] [client 89.43.31.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.31.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRt8Clw93sqXL8h98r02XQAAAEY"]
[Tue Nov 18 03:58:48.129541 2025] [:error] [pid 61393:tid 61475] [client 3.128.157.183:52710] [client 3.128.157.183] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.128.157.183, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRt-eGH9XjlbVPv9gQX5uQAAAJM"]
[Tue Nov 18 04:23:36.467029 2025] [:error] [pid 61392:tid 61437] [client 152.53.103.246:41994] [client 152.53.103.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.103.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRuESHSmvb496zZxueKwlQAAAEg"], referer: https://expressinteriors.com
[Tue Nov 18 04:31:46.176510 2025] [:error] [pid 61391:tid 61403] [client 206.189.149.69:37122] [client 206.189.149.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 206.189.149.69, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRuGMowXIKmhlnkP3-dFhAAAAAM"], referer: https://expressinteriors.com
[Tue Nov 18 06:16:02.235168 2025] [:error] [pid 61393:tid 61470] [client 103.214.6.202:41610] [client 103.214.6.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.214.6.202, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRueomH9XjlbVPv9gQUfbAAAAI4"]
[Tue Nov 18 06:30:35.596162 2025] [:error] [pid 61392:tid 61434] [client 172.71.172.130:11134] [client 172.71.172.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aRuiC3Smvb496zZxueLSJQAAAEU"]
[Tue Nov 18 07:25:47.656600 2025] [:error] [pid 61482:tid 61505] [client 14.225.210.33:55686] [client 14.225.210.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 14.225.210.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRuu-_tNHsWZClVWav5h1wAAANI"]
[Tue Nov 18 08:26:23.031219 2025] [:error] [pid 9935:tid 9960] [client 20.225.200.144:44678] [client 20.225.200.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.225.200.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRu9LwWOMXsrZFRF6sj4YwAAAZc"]
[Tue Nov 18 08:26:25.359913 2025] [:error] [pid 9935:tid 9949] [client 20.225.200.144:44678] [client 20.225.200.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.225.200.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRu9MQWOMXsrZFRF6sj4aAAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Tue Nov 18 08:54:58.956834 2025] [:error] [pid 29195:tid 29205] [client 216.24.219.102:52965] [client 216.24.219.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "aRvD4hMeonxy_4yeOTVeyQAAAQg"]
[Tue Nov 18 08:54:59.439072 2025] [:error] [pid 61482:tid 61493] [client 216.24.219.88:34721] [client 216.24.219.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/txets.php"] [unique_id "aRvD4_tNHsWZClVWav53OAAAAMY"]
[Tue Nov 18 08:54:59.917241 2025] [:error] [pid 61482:tid 61511] [client 193.36.224.219:22095] [client 193.36.224.219] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/txets.php"] [unique_id "aRvD4_tNHsWZClVWav53OQAAANg"]
[Tue Nov 18 10:18:46.303185 2025] [:error] [pid 29195:tid 29206] [client 185.102.115.93:60582] [client 185.102.115.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aRvXhhMeonxy_4yeOTVyQAAAAQk"]
[Tue Nov 18 11:17:26.067125 2025] [:error] [pid 61482:tid 61498] [client 111.172.249.49:53993] [client 111.172.249.49] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aRvlRvtNHsWZClVWav6elQAAAMs"]
[Tue Nov 18 11:35:55.433924 2025] [:error] [pid 28635:tid 28648] [client 24.134.170.149:60013] [client 24.134.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 24.134.170.149, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRvpm2B61AnWhG54Xz0JcgAAAco"], referer: https://www.google.com
[Tue Nov 18 11:35:57.141508 2025] [:error] [pid 33282:tid 33303] [client 24.134.170.149:64161] [client 24.134.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 24.134.170.149, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRvpnYQvPz65IdvoMwXoCAAAAlI"], referer: https://www.google.com
[Tue Nov 18 11:47:04.128681 2025] [:error] [pid 9935:tid 9957] [client 24.134.170.149:62258] [client 24.134.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 24.134.170.149, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp/wp-login.php"] [unique_id "aRvsOAWOMXsrZFRF6shJHQAAAZQ"], referer: https://www.google.com
[Tue Nov 18 11:58:06.118513 2025] [:error] [pid 44470:tid 44497] [client 24.134.170.149:64433] [client 24.134.170.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 24.134.170.149, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-login.php"] [unique_id "aRvuzjv-RLYfULjlgDZGKQAAAFY"], referer: https://www.google.com
[Tue Nov 18 12:00:19.029977 2025] [:error] [pid 44470:tid 44498] [client 150.136.36.255:38262] [client 150.136.36.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.136.36.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRvvUzv-RLYfULjlgDZG-gAAAFc"]
[Tue Nov 18 12:04:22.562606 2025] [:error] [pid 44470:tid 44490] [client 24.134.170.149:63543] [client 24.134.170.149] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aRvwRjv-RLYfULjlgDZJ7QAAAE8"]
[Tue Nov 18 12:04:49.595426 2025] [:error] [pid 44471:tid 44504] [client 24.134.170.149:61311] [client 24.134.170.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.134.170.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRvwYe_6m0bQO14XwtPdVwAAAQA"]
[Tue Nov 18 12:05:18.020488 2025] [:error] [pid 44471:tid 44526] [client 24.134.170.149:61831] [client 24.134.170.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.134.170.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRvwfu_6m0bQO14XwtPddAAAARY"]
[Tue Nov 18 12:05:39.756803 2025] [:error] [pid 44624:tid 44630] [client 24.134.170.149:62899] [client 24.134.170.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.134.170.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRvwkyllffozoBluWCXgQgAAAYM"]
[Tue Nov 18 12:06:00.540950 2025] [:error] [pid 44624:tid 44637] [client 24.134.170.149:60153] [client 24.134.170.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.134.170.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRvwqCllffozoBluWCXgTgAAAYo"]
[Tue Nov 18 12:06:21.501498 2025] [:error] [pid 44560:tid 44575] [client 24.134.170.149:59509] [client 24.134.170.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.134.170.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRvwvQnbP7etF3q5-5sCMQAAAMQ"]
[Tue Nov 18 12:42:06.520853 2025] [:error] [pid 44624:tid 44630] [client 50.87.248.44:15962] [client 50.87.248.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.87.248.44, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRv5HillffozoBluWCXu-AAAAYM"]
[Tue Nov 18 15:26:45.401273 2025] [:error] [pid 44472:tid 44534] [client 143.110.186.250:35658] [client 143.110.186.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.110.186.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRwftYKhGwkiLjv8BQy0OgAAAUM"]
[Tue Nov 18 16:48:06.649431 2025] [:error] [pid 44471:tid 44523] [client 198.57.247.134:40788] [client 198.57.247.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.57.247.134, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRwyxu_6m0bQO14XwtM0ugAAARM"]
[Tue Nov 18 18:56:28.776009 2025] [:error] [pid 44470:tid 44487] [client 209.42.21.53:35578] [client 209.42.21.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.42.21.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRxQ3Dv-RLYfULjlgDbQOQAAAEw"]
[Tue Nov 18 18:56:30.028339 2025] [:error] [pid 44470:tid 44498] [client 209.42.21.53:35578] [client 209.42.21.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.42.21.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRxQ3jv-RLYfULjlgDbQOwAAAFc"], referer: https://expressinteriors.com/wp-login.php
[Tue Nov 18 18:57:52.221933 2025] [:error] [pid 44470:tid 44490] [client 162.213.255.32:52732] [client 162.213.255.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.213.255.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRxRMDv-RLYfULjlgDbQkAAAAE8"]
[Tue Nov 18 19:50:03.617225 2025] [:error] [pid 57578:tid 57597] [client 84.247.191.22:60334] [client 84.247.191.22] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "aRxdaz9_jVUQm7Io75PvIgAAAJE"], referer: binance.com
[Tue Nov 18 21:37:31.387490 2025] [:error] [pid 44560:tid 44577] [client 45.134.79.103:53666] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRx2mwnbP7etF3q5-5vI8gAAAMY"]
[Tue Nov 18 21:37:32.014668 2025] [:error] [pid 1387:tid 1408] [client 45.134.79.103:63894] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRx2nEzBvalKyx3hMvWesgAAAA8"]
[Tue Nov 18 21:37:32.684753 2025] [:error] [pid 57578:tid 57599] [client 45.134.79.103:55141] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aRx2nD9_jVUQm7Io75ML5AAAAJM"]
[Tue Nov 18 22:33:01.144469 2025] [:error] [pid 57578:tid 57588] [client 8.218.212.177:53892] [client 8.218.212.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.218.212.177, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRyDnT9_jVUQm7Io75MeMgAAAIg"]
[Tue Nov 18 23:46:59.582065 2025] [:error] [pid 1387:tid 1401] [client 165.101.132.78:64382] [client 165.101.132.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.101.132.78, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRyU80zBvalKyx3hMvXBDAAAAAg"]
[Tue Nov 18 23:47:00.691730 2025] [:error] [pid 1387:tid 1416] [client 165.101.132.78:64382] [client 165.101.132.78] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aRyU9EzBvalKyx3hMvXBDgAAABc"]
[Wed Nov 19 00:03:10.653095 2025] [:error] [pid 44471:tid 44508] [client 81.184.75.53:64179] [client 81.184.75.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.184.75.53, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRyYvu_6m0bQO14XwtOrEAAAAQQ"]
[Wed Nov 19 00:12:26.802036 2025] [:error] [pid 3500:tid 3522] [client 81.184.75.53:54250] [client 81.184.75.53] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aRya6vCbRC7k2D7mjbTbvQAAAdQ"]
[Wed Nov 19 00:13:46.099575 2025] [:error] [pid 44470:tid 44491] [client 81.184.75.53:55656] [client 81.184.75.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.184.75.53, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRybOjv-RLYfULjlgDYv5AAAAFA"]
[Wed Nov 19 00:15:16.215889 2025] [:error] [pid 57578:tid 57600] [client 81.184.75.53:56765] [client 81.184.75.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.184.75.53, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRyblD9_jVUQm7Io75M6iAAAAJQ"]
[Wed Nov 19 00:16:29.147179 2025] [:error] [pid 44471:tid 44515] [client 85.95.216.149:43120] [client 85.95.216.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.95.216.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRyb3e_6m0bQO14XwtOuYAAAAQs"]
[Wed Nov 19 00:16:33.424885 2025] [:error] [pid 3500:tid 3508] [client 81.184.75.53:57913] [client 81.184.75.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.184.75.53, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRyb4fCbRC7k2D7mjbTc7QAAAcY"]
[Wed Nov 19 00:17:47.513238 2025] [:error] [pid 44560:tid 44580] [client 81.184.75.53:58355] [client 81.184.75.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.184.75.53, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRycKwnbP7etF3q5-5vydQAAAMk"]
[Wed Nov 19 00:35:41.033703 2025] [:error] [pid 43880:tid 43909] [client 180.102.134.69:54385] [client 180.102.134.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aRygXe1q1HNbKyNr9SZJNAAAAFg"]
[Wed Nov 19 01:45:36.559529 2025] [:error] [pid 3052:tid 3152] [client 67.23.254.96:59322] [client 67.23.254.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.23.254.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRywwFNM6bOMTTuJnz2GiwAAANc"]
[Wed Nov 19 02:43:30.332331 2025] [:error] [pid 3052:tid 3147] [client 20.168.23.155:17297] [client 20.168.23.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aRy-UlNM6bOMTTuJnz2n8AAAANI"]
[Wed Nov 19 02:43:30.707647 2025] [:error] [pid 44063:tid 44141] [client 20.168.23.155:17391] [client 20.168.23.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aRy-UkVOSC7H33BBqQ0RWgAAAJg"]
[Wed Nov 19 02:43:31.043449 2025] [:error] [pid 3052:tid 3136] [client 20.168.23.155:17282] [client 20.168.23.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aRy-U1NM6bOMTTuJnz2n9AAAAMc"]
[Wed Nov 19 02:43:31.471915 2025] [:error] [pid 43881:tid 43928] [client 20.168.23.155:17387] [client 20.168.23.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aRy-U3_TrIND5buvEyfyxAAAAU8"]
[Wed Nov 19 03:11:37.474546 2025] [:error] [pid 14439:tid 14450] [client 217.18.245.138:32852] [client 217.18.245.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.18.245.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRzE6Vat0cKFYVAxpdD8LQAAAQk"]
[Wed Nov 19 03:12:18.818717 2025] [:error] [pid 3052:tid 3149] [client 52.242.231.141:25804] [client 52.242.231.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.242.231.141, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aRzFElNM6bOMTTuJnz28-gAAANQ"]
[Wed Nov 19 05:54:11.329912 2025] [:error] [pid 6644:tid 6661] [client 162.241.219.158:30398] [client 162.241.219.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.219.158, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aRzrA00i6Rf788MB6sawMgAAAM8"]
[Wed Nov 19 07:19:36.716626 2025] [:error] [pid 6644:tid 6653] [client 43.157.95.131:36348] [client 43.157.95.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aRz_CE0i6Rf788MB6sbUngAAAMc"]
[Wed Nov 19 07:27:38.464339 2025] [:error] [pid 6644:tid 6662] [client 178.249.209.187:59113] [client 178.249.209.187] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aR0A6k0i6Rf788MB6sbYagAAANA"]
[Wed Nov 19 07:27:39.060371 2025] [:error] [pid 6919:tid 6922] [client 178.249.209.187:59175] [client 178.249.209.187] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aR0A60YFdN1s_9xJVUmpHAAAAQA"]
[Wed Nov 19 07:30:39.126686 2025] [:error] [pid 6644:tid 6649] [client 18.191.165.250:56663] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aR0Bn00i6Rf788MB6sbZyQAAAMM"]
[Wed Nov 19 07:30:39.872891 2025] [:error] [pid 26664:tid 26671] [client 18.191.165.250:56755] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aR0Bn4pWc1yoj2P7MeAR5wAAAUQ"]
[Wed Nov 19 07:30:40.275510 2025] [:error] [pid 6554:tid 6559] [client 18.191.165.250:56912] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aR0BoN8rvPWLafJFqmVXAQAAAAA"]
[Wed Nov 19 07:30:40.666150 2025] [:error] [pid 26664:tid 26678] [client 18.191.165.250:57057] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aR0BoIpWc1yoj2P7MeASJQAAAUs"]
[Wed Nov 19 07:30:41.057109 2025] [:error] [pid 6555:tid 6591] [client 18.191.165.250:57175] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aR0BoUbVJm8eMsGMTCON8AAAAEA"]
[Wed Nov 19 07:52:12.040993 2025] [:error] [pid 6554:tid 6569] [client 162.214.205.31:50040] [client 162.214.205.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.214.205.31, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR0GrN8rvPWLafJFqmVbiAAAAAk"]
[Wed Nov 19 08:40:11.626415 2025] [:error] [pid 26664:tid 26667] [client 103.18.204.205:49172] [client 103.18.204.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.18.204.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR0R64pWc1yoj2P7MeAxxwAAAUA"], referer: https://expressinteriors.com
[Wed Nov 19 11:16:16.321427 2025] [:error] [pid 6919:tid 6935] [client 80.71.159.109:60943] [client 80.71.159.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 80.71.159.109, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR02gEYFdN1s_9xJVUkA-AAAAQ0"], referer: https://expressinteriors.com/
[Wed Nov 19 11:16:18.258127 2025] [:error] [pid 26664:tid 26688] [client 80.71.159.109:37755] [client 80.71.159.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 80.71.159.109, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR02gopWc1yoj2P7MeB8egAAAVQ"], referer: https://expressinteriors.com/wp-login.php?action=register
[Wed Nov 19 11:35:15.426452 2025] [:error] [pid 6919:tid 6937] [client 192.185.81.116:14890] [client 192.185.81.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.81.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR0680YFdN1s_9xJVUkIvAAAAQ8"], referer: https://expressinteriors.com
[Wed Nov 19 13:00:21.452935 2025] [:error] [pid 26664:tid 26681] [client 203.33.203.148:52609] [client 203.33.203.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aR1O5YpWc1yoj2P7MeCveQAAAU4"]
[Wed Nov 19 13:03:02.101425 2025] [:error] [pid 6554:tid 6571] [client 162.241.252.215:44510] [client 162.241.252.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.252.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR1Pht8rvPWLafJFqmWzQgAAAAs"], referer: https://expressinteriors.com
[Wed Nov 19 13:53:14.197943 2025] [:error] [pid 12673:tid 12715] [client 103.146.203.227:32884] [client 103.146.203.227] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.146.203.227, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR1bSsab1F0fb062dH0U5QAAAgs"]
[Wed Nov 19 13:53:15.217247 2025] [:error] [pid 6555:tid 6598] [client 103.146.203.227:42248] [client 103.146.203.227] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.146.203.227, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR1bS0bVJm8eMsGMTCP6JwAAAEc"], referer: http://expressinteriors.com/wp-login.php
[Wed Nov 19 13:53:16.152080 2025] [:error] [pid 6556:tid 6641] [client 103.146.203.227:42454] [client 103.146.203.227] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aR1bTJuL7hhgrmdM1mvpUAAAAJc"], referer: http://expressinteriors.com/wp-login.php
[Wed Nov 19 13:53:16.565934 2025] [:error] [pid 12643:tid 12655] [client 103.146.203.227:42538] [client 103.146.203.227] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.146.203.227, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR1bTMaLCNSdLHNAGt6z1AAAAYk"], referer: https://expressinteriors.com/wp-login.php?redirect_to=https%3A%2F%2Fexpressinteriors.com%2Fwp-admin%2F
[Wed Nov 19 13:54:43.532677 2025] [:error] [pid 12643:tid 12668] [client 162.241.217.150:28262] [client 162.241.217.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.217.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR1bo8aLCNSdLHNAGt60BwAAAZY"], referer: https://expressinteriors.com
[Wed Nov 19 15:32:01.137703 2025] [:error] [pid 12673:tid 12704] [client 101.68.43.236:51082] [client 101.68.43.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.68.43.236, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR1yccab1F0fb062dH0sTQAAAgA"], referer: https://expressinteriors.com
[Wed Nov 19 15:51:36.118414 2025] [:error] [pid 12672:tid 12682] [client 143.95.156.62:12286] [client 143.95.156.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.95.156.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR13CP9vojl6X1cc5mX01wAAAcU"], referer: https://expressinteriors.com
[Wed Nov 19 16:09:36.889944 2025] [:error] [pid 12643:tid 12649] [client 109.245.159.218:9818] [client 109.245.159.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.245.159.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR17QMaLCNSdLHNAGt7LGgAAAYM"], referer: https://expressinteriors.com
[Wed Nov 19 16:09:36.891700 2025] [:error] [pid 12643:tid 12649] [client 109.245.159.218:9818] [client 109.245.159.218] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR17QMaLCNSdLHNAGt7LGgAAAYM"], referer: https://expressinteriors.com
[Wed Nov 19 16:09:36.892630 2025] [:error] [pid 12643:tid 12649] [client 109.245.159.218:9818] [client 109.245.159.218] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR17QMaLCNSdLHNAGt7LGgAAAYM"], referer: https://expressinteriors.com
[Wed Nov 19 16:09:39.254703 2025] [:error] [pid 6919:tid 6940] [client 109.245.159.218:14747] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/wp-content/debug.log"] [unique_id "aR17Q0YFdN1s_9xJVUlQgwAAARI"], referer: https://expressinteriors.com
[Wed Nov 19 16:09:39.546999 2025] [:error] [pid 6919:tid 6925] [client 109.245.159.218:14747] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rss-functions.php"] [unique_id "aR17Q0YFdN1s_9xJVUlQhAAAAQM"], referer: https://expressinteriors.com
[Wed Nov 19 16:09:44.541967 2025] [:error] [pid 6555:tid 6605] [client 109.245.159.218:6587] [client 109.245.159.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.245.159.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR17SEbVJm8eMsGMTCMNyQAAAE4"], referer: https://expressinteriors.com
[Wed Nov 19 16:09:45.326758 2025] [:error] [pid 6555:tid 6613] [client 109.245.159.218:6587] [client 109.245.159.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.245.159.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR17SUbVJm8eMsGMTCMNygAAAFY"], referer: https://expressinteriors.com
[Wed Nov 19 16:09:46.122194 2025] [autoindex:error] [pid 6555:tid 6596] [client 109.245.159.218:6587] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://expressinteriors.com
[Wed Nov 19 16:09:47.318600 2025] [:error] [pid 6555:tid 6597] [client 109.245.159.218:6587] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/dump.sql"] [unique_id "aR17S0bVJm8eMsGMTCMNzQAAAEY"], referer: https://expressinteriors.com
[Wed Nov 19 16:09:48.722086 2025] [:error] [pid 6555:tid 6603] [client 109.245.159.218:6587] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/version.php"] [unique_id "aR17TEbVJm8eMsGMTCMN0AAAAEw"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:05.887443 2025] [:error] [pid 12643:tid 12655] [client 109.245.159.218:15145] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/*/README.md"] [unique_id "aR17XcaLCNSdLHNAGt7LOAAAAYk"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:07.062930 2025] [:error] [pid 6556:tid 6623] [client 109.245.159.218:12710] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/*/README.md"] [unique_id "aR17X5uL7hhgrmdM1mv-RwAAAIU"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:08.236034 2025] [:error] [pid 6554:tid 6580] [client 109.245.159.218:13842] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/*/readme.md"] [unique_id "aR17YN8rvPWLafJFqmXUzQAAABQ"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:09.387806 2025] [:error] [pid 6919:tid 6942] [client 109.245.159.218:15148] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/*/Readme.txt"] [unique_id "aR17YUYFdN1s_9xJVUlQrgAAARQ"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:10.601416 2025] [:error] [pid 26664:tid 26691] [client 109.245.159.218:6347] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/readme.txt"] [unique_id "aR17YopWc1yoj2P7MeDanwAAAVc"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:11.759769 2025] [:error] [pid 6644:tid 6659] [client 109.245.159.218:7550] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/elementor/readme.txt"] [unique_id "aR17Y00i6Rf788MB6saAygAAAM0"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:12.922816 2025] [:error] [pid 6919:tid 6946] [client 109.245.159.218:9069] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/elementor/assets/js/admin-feedback.js"] [unique_id "aR17ZEYFdN1s_9xJVUlQrwAAARg"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:14.066532 2025] [:error] [pid 12672:tid 12683] [client 109.245.159.218:10146] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/elementor/assets/css/admin.min.css"] [unique_id "aR17Zv9vojl6X1cc5mX4GAAAAcY"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:15.197713 2025] [:error] [pid 6556:tid 6628] [client 109.245.159.218:11164] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-smushit/readme.txt"] [unique_id "aR17Z5uL7hhgrmdM1mv-SgAAAIo"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:16.346445 2025] [:error] [pid 12673:tid 12719] [client 109.245.159.218:12253] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-smushit/languages/wp-smushit.pot"] [unique_id "aR17aMab1F0fb062dH00gAAAAg8"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:18.807933 2025] [:error] [pid 26664:tid 26688] [client 109.245.159.218:14579] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.wp-config.php.swp"] [unique_id "aR17aopWc1yoj2P7MeDapAAAAVQ"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:18.837872 2025] [:error] [pid 12643:tid 12669] [client 109.245.159.218:14584] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.wp-config.swp"] [unique_id "aR17asaLCNSdLHNAGt7LQgAAAZc"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:18.840091 2025] [:error] [pid 12672:tid 12687] [client 109.245.159.218:14585] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/%23wp-config.php%23"] [unique_id "aR17av9vojl6X1cc5mX4HAAAAco"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:18.901523 2025] [:error] [pid 6644:tid 6666] [client 109.245.159.218:14586] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/backup.wp-config.php"] [unique_id "aR17ak0i6Rf788MB6saAzgAAANQ"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:18.975963 2025] [:error] [pid 12643:tid 12658] [client 109.245.159.218:14589] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.wp-config.php.swo"] [unique_id "aR17asaLCNSdLHNAGt7LQwAAAYw"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:21.359952 2025] [:error] [pid 6554:tid 6578] [client 109.245.159.218:5644] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config"] [unique_id "aR17bd8rvPWLafJFqmXU0QAAABI"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:21.363912 2025] [:error] [pid 6556:tid 6639] [client 109.245.159.218:5991] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config%20-%20Copy.php"] [unique_id "aR17bZuL7hhgrmdM1mv-TAAAAJU"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:21.365821 2025] [:error] [pid 12673:tid 12707] [client 109.245.159.218:5993] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config%20copy.php"] [unique_id "aR17bcab1F0fb062dH00gQAAAgM"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:21.368852 2025] [:error] [pid 6644:tid 6670] [client 109.245.159.218:6003] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config_backup"] [unique_id "aR17bU0i6Rf788MB6saAzwAAANg"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:21.371346 2025] [:error] [pid 6644:tid 6653] [client 109.245.159.218:6004] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config_good"] [unique_id "aR17bU0i6Rf788MB6saA0AAAAMc"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:22.580998 2025] [:error] [pid 6644:tid 6669] [client 109.245.159.218:8177] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config-backup"] [unique_id "aR17bk0i6Rf788MB6saA0gAAANc"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:22.616649 2025] [:error] [pid 6556:tid 6634] [client 109.245.159.218:8185] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config-backup.php"] [unique_id "aR17bpuL7hhgrmdM1mv-TgAAAJA"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:22.788348 2025] [:error] [pid 6644:tid 6659] [client 109.245.159.218:8202] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config-backup.txt"] [unique_id "aR17bk0i6Rf788MB6saA0wAAAM0"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:22.811175 2025] [:error] [pid 12673:tid 12717] [client 109.245.159.218:8204] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config-backup1.txt"] [unique_id "aR17bsab1F0fb062dH00ggAAAg0"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:22.851347 2025] [:error] [pid 6555:tid 6608] [client 109.245.159.218:8205] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config-good"] [unique_id "aR17bkbVJm8eMsGMTCMN4QAAAFE"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:23.782622 2025] [:error] [pid 6554:tid 6560] [client 109.245.159.218:9432] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config-sample.php"] [unique_id "aR17b98rvPWLafJFqmXU0gAAAAE"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:23.847059 2025] [:error] [pid 12643:tid 12668] [client 109.245.159.218:9505] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config-sample.php.bak"] [unique_id "aR17b8aLCNSdLHNAGt7LRAAAAZY"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:24.232956 2025] [:error] [pid 12643:tid 12659] [client 109.245.159.218:9805] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config-sample.php~"] [unique_id "aR17cMaLCNSdLHNAGt7LRQAAAY0"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:24.236085 2025] [:error] [pid 6644:tid 6656] [client 109.245.159.218:9806] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.backup"] [unique_id "aR17cE0i6Rf788MB6saA1AAAAMo"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:24.246864 2025] [:error] [pid 12643:tid 12670] [client 109.245.159.218:9807] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.bak" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.bak"] [unique_id "aR17cMaLCNSdLHNAGt7LRgAAAZg"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:25.300129 2025] [:error] [pid 12643:tid 12660] [client 109.245.159.218:10843] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.cfg"] [unique_id "aR17ccaLCNSdLHNAGt7LRwAAAY4"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:25.301116 2025] [:error] [pid 12673:tid 12725] [client 109.245.159.218:10668] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.bkp"] [unique_id "aR17ccab1F0fb062dH00gwAAAhU"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:25.396852 2025] [:error] [pid 12672:tid 12682] [client 109.245.159.218:11180] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.conf"] [unique_id "aR17cf9vojl6X1cc5mX4HgAAAcU"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:25.396908 2025] [:error] [pid 26664:tid 26692] [client 109.245.159.218:11181] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.data"] [unique_id "aR17cYpWc1yoj2P7MeDaqAAAAVg"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:25.489495 2025] [:error] [pid 12672:tid 12699] [client 109.245.159.218:11182] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.dump"] [unique_id "aR17cf9vojl6X1cc5mX4HwAAAdY"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:26.577110 2025] [:error] [pid 6644:tid 6662] [client 109.245.159.218:12323] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.good"] [unique_id "aR17ck0i6Rf788MB6saA1wAAANA"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:26.579463 2025] [:error] [pid 12672:tid 12692] [client 109.245.159.218:12324] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.htm"] [unique_id "aR17cv9vojl6X1cc5mX4IAAAAc8"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:27.527274 2025] [:error] [pid 12672:tid 12701] [client 109.245.159.218:12821] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.local.php"] [unique_id "aR17c_9vojl6X1cc5mX4IQAAAdg"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:27.527274 2025] [:error] [pid 6555:tid 6594] [client 109.245.159.218:12822] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.inc"] [unique_id "aR17c0bVJm8eMsGMTCMN4gAAAEM"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:27.527279 2025] [:error] [pid 12643:tid 12648] [client 109.245.159.218:12820] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.html"] [unique_id "aR17c8aLCNSdLHNAGt7LSAAAAYI"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:27.846444 2025] [:error] [pid 12672:tid 12690] [client 109.245.159.218:13469] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.old" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.old"] [unique_id "aR17c_9vojl6X1cc5mX4IwAAAc0"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:28.581951 2025] [:error] [pid 12643:tid 12646] [client 109.245.159.218:13468] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.old" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.old.old"] [unique_id "aR17dMaLCNSdLHNAGt7LSQAAAYA"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:28.882709 2025] [:error] [pid 12672:tid 12678] [client 109.245.159.218:14362] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.ORG"] [unique_id "aR17dP9vojl6X1cc5mX4JAAAAcE"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:28.992496 2025] [:error] [pid 12643:tid 12654] [client 109.245.159.218:14363] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.orig"] [unique_id "aR17dMaLCNSdLHNAGt7LSgAAAYg"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:28.997890 2025] [:error] [pid 12643:tid 12664] [client 109.245.159.218:14364] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.original"] [unique_id "aR17dMaLCNSdLHNAGt7LSwAAAZI"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:30.311501 2025] [:error] [pid 26664:tid 26668] [client 109.245.159.218:5251] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_"] [unique_id "aR17dopWc1yoj2P7MeDaqQAAAUE"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:30.311708 2025] [:error] [pid 6644:tid 6657] [client 109.245.159.218:5688] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php______"] [unique_id "aR17dk0i6Rf788MB6saA3gAAAMs"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:30.453497 2025] [:error] [pid 12643:tid 12656] [client 109.245.159.218:5699] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_1"] [unique_id "aR17dsaLCNSdLHNAGt7LTgAAAYo"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:30.611824 2025] [:error] [pid 26664:tid 26672] [client 109.245.159.218:5698] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_backup"] [unique_id "aR17dopWc1yoj2P7MeDaqgAAAUU"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:31.046061 2025] [:error] [pid 6555:tid 6600] [client 109.245.159.218:6369] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_bk"] [unique_id "aR17d0bVJm8eMsGMTCMN5wAAAEk"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:31.527828 2025] [:error] [pid 6644:tid 6661] [client 109.245.159.218:7000] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_new"] [unique_id "aR17d00i6Rf788MB6saA4AAAAM8"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:31.686814 2025] [:error] [pid 12643:tid 12647] [client 109.245.159.218:7153] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_old2017"] [unique_id "aR17d8aLCNSdLHNAGt7LUAAAAYE"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:31.692328 2025] [:error] [pid 6644:tid 6647] [client 109.245.159.218:7200] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_old2018"] [unique_id "aR17d00i6Rf788MB6saA4QAAAME"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:32.126876 2025] [:error] [pid 6554:tid 6564] [client 109.245.159.218:7704] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_old2020"] [unique_id "aR17eN8rvPWLafJFqmXU0wAAAAU"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:32.799783 2025] [:error] [pid 12643:tid 12658] [client 109.245.159.218:7903] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_orig"] [unique_id "aR17eMaLCNSdLHNAGt7LUgAAAYw"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:33.164635 2025] [:error] [pid 12673:tid 12713] [client 109.245.159.218:8732] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php-backup"] [unique_id "aR17ecab1F0fb062dH00iAAAAgk"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:33.166023 2025] [:error] [pid 12643:tid 12668] [client 109.245.159.218:8728] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php-"] [unique_id "aR17ecaLCNSdLHNAGt7LUwAAAZY"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:33.166118 2025] [:error] [pid 12643:tid 12667] [client 109.245.159.218:8381] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_original"] [unique_id "aR17ecaLCNSdLHNAGt7LVAAAAZU"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:34.521043 2025] [:error] [pid 6644:tid 6649] [client 109.245.159.218:9426] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php-bak"] [unique_id "aR17ek0i6Rf788MB6saA5gAAAMM"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:34.835921 2025] [:error] [pid 26664:tid 26690] [client 109.245.159.218:9724] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php-n"] [unique_id "aR17eopWc1yoj2P7MeDargAAAVY"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:34.843159 2025] [:error] [pid 12643:tid 12653] [client 109.245.159.218:10079] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php-o"] [unique_id "aR17esaLCNSdLHNAGt7LVwAAAYc"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:35.065832 2025] [:error] [pid 26664:tid 26685] [client 109.245.159.218:10084] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php-old"] [unique_id "aR17e4pWc1yoj2P7MeDarwAAAVE"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:35.068314 2025] [:error] [pid 6644:tid 6651] [client 109.245.159.218:10085] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php-original"] [unique_id "aR17e00i6Rf788MB6saA5wAAAMU"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:35.881129 2025] [:error] [pid 26664:tid 26675] [client 109.245.159.218:11254] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php-save"] [unique_id "aR17e4pWc1yoj2P7MeDasQAAAUg"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:36.154259 2025] [:error] [pid 26664:tid 26676] [client 109.245.159.218:11545] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php-work"] [unique_id "aR17fIpWc1yoj2P7MeDasgAAAUk"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:36.197206 2025] [:error] [pid 6644:tid 6659] [client 109.245.159.218:11543] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.0"] [unique_id "aR17fE0i6Rf788MB6saA6wAAAM0"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:36.537223 2025] [:error] [pid 6644:tid 6660] [client 109.245.159.218:12016] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.2"] [unique_id "aR17fE0i6Rf788MB6saA7QAAAM4"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:36.538283 2025] [:error] [pid 6556:tid 6641] [client 109.245.159.218:12018] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.1"] [unique_id "aR17fJuL7hhgrmdM1mv-WAAAAJc"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:37.605564 2025] [:error] [pid 6554:tid 6570] [client 109.245.159.218:12576] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.3"] [unique_id "aR17fd8rvPWLafJFqmXU1AAAAAo"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:37.925374 2025] [:error] [pid 12673:tid 12726] [client 109.245.159.218:12916] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.4"] [unique_id "aR17fcab1F0fb062dH00iQAAAhY"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:37.925567 2025] [:error] [pid 6644:tid 6649] [client 109.245.159.218:12917] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.5"] [unique_id "aR17fU0i6Rf788MB6saA7wAAAMM"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:37.926088 2025] [:error] [pid 6919:tid 6927] [client 109.245.159.218:13243] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.6"] [unique_id "aR17fUYFdN1s_9xJVUlQtwAAAQU"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:37.932632 2025] [:error] [pid 6644:tid 6653] [client 109.245.159.218:13256] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.7"] [unique_id "aR17fU0i6Rf788MB6saA8AAAAMc"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:39.411370 2025] [:error] [pid 6919:tid 6922] [client 109.245.159.218:14490] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.8"] [unique_id "aR17f0YFdN1s_9xJVUlQuQAAAQA"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:39.446378 2025] [:error] [pid 12672:tid 12679] [client 109.245.159.218:14863] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.9"] [unique_id "aR17f_9vojl6X1cc5mX4KwAAAcI"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:39.466011 2025] [:error] [pid 12643:tid 12661] [client 109.245.159.218:14862] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.a"] [unique_id "aR17f8aLCNSdLHNAGt7LWwAAAY8"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:39.491630 2025] [:error] [pid 6555:tid 6614] [client 109.245.159.218:14865] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.aws"] [unique_id "aR17f0bVJm8eMsGMTCMN6AAAAFc"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:39.554684 2025] [:error] [pid 6554:tid 6569] [client 109.245.159.218:14866] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.azure"] [unique_id "aR17f98rvPWLafJFqmXU1QAAAAk"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:41.287905 2025] [:error] [pid 26664:tid 26691] [client 109.245.159.218:6547] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.backup"] [unique_id "aR17gYpWc1yoj2P7MeDatQAAAVc"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:41.288018 2025] [:error] [pid 26664:tid 26672] [client 109.245.159.218:6457] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.b"] [unique_id "aR17gYpWc1yoj2P7MeDatAAAAUU"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:42.146666 2025] [:error] [pid 26664:tid 26677] [client 109.245.159.218:7405] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.backup.txt"] [unique_id "aR17gopWc1yoj2P7MeDatgAAAUo"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:42.146803 2025] [:error] [pid 6554:tid 6577] [client 109.245.159.218:7403] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.bak"] [unique_id "aR17gt8rvPWLafJFqmXU1wAAABE"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:42.148753 2025] [:error] [pid 12643:tid 12663] [client 109.245.159.218:7404] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.bak1"] [unique_id "aR17gsaLCNSdLHNAGt7LXgAAAZE"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:42.512155 2025] [:error] [pid 12673:tid 12723] [client 109.245.159.218:8466] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.bk"] [unique_id "aR17gsab1F0fb062dH00igAAAhM"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:43.102006 2025] [:error] [pid 12643:tid 12670] [client 109.245.159.218:8467] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.bkp"] [unique_id "aR17g8aLCNSdLHNAGt7LXwAAAZg"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:43.491216 2025] [:error] [pid 12673:tid 12712] [client 109.245.159.218:9201] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.c"] [unique_id "aR17g8ab1F0fb062dH00iwAAAgg"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:43.492217 2025] [:error] [pid 6644:tid 6655] [client 109.245.159.218:9202] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.com"] [unique_id "aR17g00i6Rf788MB6saA9AAAAMk"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:43.757323 2025] [:error] [pid 12643:tid 12665] [client 109.245.159.218:9200] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.cust"] [unique_id "aR17g8aLCNSdLHNAGt7LYAAAAZM"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:44.451397 2025] [:error] [pid 6644:tid 6667] [client 109.245.159.218:9813] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.dev"] [unique_id "aR17hE0i6Rf788MB6saA9gAAANU"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:44.763878 2025] [:error] [pid 6644:tid 6660] [client 109.245.159.218:10197] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.disabled"] [unique_id "aR17hE0i6Rf788MB6saA9wAAAM4"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:44.766832 2025] [:error] [pid 12672:tid 12693] [client 109.245.159.218:10554] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.dist"] [unique_id "aR17hP9vojl6X1cc5mX4LgAAAdA"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:44.981838 2025] [:error] [pid 12672:tid 12690] [client 109.245.159.218:10553] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.dump"] [unique_id "aR17hP9vojl6X1cc5mX4MAAAAc0"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:45.337695 2025] [:error] [pid 6554:tid 6566] [client 109.245.159.218:11199] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.html"] [unique_id "aR17hd8rvPWLafJFqmXU2AAAAAc"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:45.631324 2025] [:error] [pid 12643:tid 12646] [client 109.245.159.218:11460] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.in"] [unique_id "aR17hcaLCNSdLHNAGt7LYQAAAYA"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:46.106787 2025] [:error] [pid 6644:tid 6652] [client 109.245.159.218:11770] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.local"] [unique_id "aR17hk0i6Rf788MB6saBBQAAAMY"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:46.107051 2025] [:error] [pid 6644:tid 6650] [client 109.245.159.218:11737] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.inc"] [unique_id "aR17hk0i6Rf788MB6saBBgAAAMQ"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:46.504255 2025] [:error] [pid 6556:tid 6622] [client 109.245.159.218:11991] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.maj"] [unique_id "aR17hpuL7hhgrmdM1mv-WgAAAIQ"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:46.981282 2025] [:error] [pid 6644:tid 6668] [client 109.245.159.218:12390] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.new"] [unique_id "aR17hk0i6Rf788MB6saBBwAAANY"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:47.286522 2025] [:error] [pid 12673:tid 12720] [client 109.245.159.218:12841] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.old"] [unique_id "aR17h8ab1F0fb062dH00kgAAAhA"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:47.556414 2025] [:error] [pid 6644:tid 6649] [client 109.245.159.218:13240] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.org"] [unique_id "aR17h00i6Rf788MB6saBCQAAAMM"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:47.556450 2025] [:error] [pid 6644:tid 6663] [client 109.245.159.218:13239] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.orig"] [unique_id "aR17h00i6Rf788MB6saBCAAAANE"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:47.903258 2025] [:error] [pid 6644:tid 6653] [client 109.245.159.218:13708] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.original"] [unique_id "aR17h00i6Rf788MB6saBCwAAAMc"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:48.229737 2025] [:error] [pid 26664:tid 26669] [client 109.245.159.218:13967] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.php-bak"] [unique_id "aR17iIpWc1yoj2P7MeDauwAAAUI"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:48.454767 2025] [:error] [pid 6644:tid 6648] [client 109.245.159.218:14250] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.prod"] [unique_id "aR17iE0i6Rf788MB6saBDAAAAMI"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:48.781329 2025] [:error] [pid 6555:tid 6594] [client 109.245.159.218:14563] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.production"] [unique_id "aR17iEbVJm8eMsGMTCMN7wAAAEM"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:49.131198 2025] [:error] [pid 6555:tid 6599] [client 109.245.159.218:14564] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.sample"] [unique_id "aR17iUbVJm8eMsGMTCMN8AAAAEg"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:49.132383 2025] [:error] [pid 12673:tid 12715] [client 109.245.159.218:14826] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.save"] [unique_id "aR17icab1F0fb062dH00lQAAAgs"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:49.482676 2025] [:error] [pid 12673:tid 12708] [client 109.245.159.218:15122] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.save.1"] [unique_id "aR17icab1F0fb062dH00lgAAAgQ"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:49.941709 2025] [:error] [pid 26664:tid 26674] [client 109.245.159.218:5271] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.stage"] [unique_id "aR17iYpWc1yoj2P7MeDavAAAAUc"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:50.281403 2025] [:error] [pid 26664:tid 26675] [client 109.245.159.218:5738] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.staging"] [unique_id "aR17iopWc1yoj2P7MeDavQAAAUg"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:50.533955 2025] [:error] [pid 6919:tid 6931] [client 109.245.159.218:6190] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.swn"] [unique_id "aR17ikYFdN1s_9xJVUlQvwAAAQk"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:50.579337 2025] [:error] [pid 12672:tid 12683] [client 109.245.159.218:6193] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.swo"] [unique_id "aR17iv9vojl6X1cc5mX4MQAAAcY"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:50.912229 2025] [:error] [pid 6919:tid 6938] [client 109.245.159.218:6755] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.swp"] [unique_id "aR17ikYFdN1s_9xJVUlQwAAAARA"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:51.207659 2025] [:error] [pid 6555:tid 6593] [client 109.245.159.218:7065] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.tar"] [unique_id "aR17i0bVJm8eMsGMTCMN8QAAAEI"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:51.446769 2025] [:error] [pid 6555:tid 6603] [client 109.245.159.218:7312] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.temp"] [unique_id "aR17i0bVJm8eMsGMTCMN8gAAAEw"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:51.853844 2025] [:error] [pid 6556:tid 6628] [client 109.245.159.218:7616] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.tmp"] [unique_id "aR17i5uL7hhgrmdM1mv-YAAAAIo"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:51.858955 2025] [:error] [pid 12673:tid 12712] [client 109.245.159.218:7656] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.txt"] [unique_id "aR17i8ab1F0fb062dH00mAAAAgg"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:52.257635 2025] [:error] [pid 12673:tid 12721] [client 109.245.159.218:7949] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.uk"] [unique_id "aR17jMab1F0fb062dH00mQAAAhE"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:52.606227 2025] [:error] [pid 6919:tid 6945] [client 109.245.159.218:8336] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.us"] [unique_id "aR17jEYFdN1s_9xJVUlQxAAAARc"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:52.931660 2025] [:error] [pid 6555:tid 6615] [client 109.245.159.218:8763] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php="] [unique_id "aR17jEbVJm8eMsGMTCMN8wAAAFg"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:53.344268 2025] [:error] [pid 6919:tid 6924] [client 109.245.159.218:9203] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php~"] [unique_id "aR17jUYFdN1s_9xJVUlQxQAAAQI"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:53.352319 2025] [:error] [pid 6555:tid 6614] [client 109.245.159.218:9204] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php~~~"] [unique_id "aR17jUbVJm8eMsGMTCMN9AAAAFc"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:53.721331 2025] [:error] [pid 6555:tid 6613] [client 109.245.159.218:9511] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php1"] [unique_id "aR17jUbVJm8eMsGMTCMN9QAAAFY"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:54.396837 2025] [:error] [pid 6919:tid 6929] [client 109.245.159.218:9874] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phpa"] [unique_id "aR17jkYFdN1s_9xJVUlQxwAAAQc"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:54.828925 2025] [:error] [pid 26664:tid 26673] [client 109.245.159.218:10648] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phpc"] [unique_id "aR17jopWc1yoj2P7MeDavwAAAUY"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:54.829217 2025] [:error] [pid 6556:tid 6639] [client 109.245.159.218:10644] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phpbak"] [unique_id "aR17jpuL7hhgrmdM1mv-YQAAAJU"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:54.829900 2025] [:error] [pid 26664:tid 26691] [client 109.245.159.218:10238] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phpb"] [unique_id "aR17jopWc1yoj2P7MeDawAAAAVc"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:55.741451 2025] [:error] [pid 6644:tid 6656] [client 109.245.159.218:11507] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phpd"] [unique_id "aR17j00i6Rf788MB6saBEAAAAMo"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:56.032246 2025] [:error] [pid 6644:tid 6661] [client 109.245.159.218:11809] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phpn"] [unique_id "aR17kE0i6Rf788MB6saBEgAAAM8"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:56.045878 2025] [:error] [pid 6554:tid 6571] [client 109.245.159.218:12128] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phpnew"] [unique_id "aR17kN8rvPWLafJFqmXU2QAAAAs"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:56.056334 2025] [:error] [pid 6554:tid 6567] [client 109.245.159.218:12137] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phpold"] [unique_id "aR17kN8rvPWLafJFqmXU2gAAAAg"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:56.301380 2025] [:error] [pid 6555:tid 6597] [client 109.245.159.218:12138] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phporiginal"] [unique_id "aR17kEbVJm8eMsGMTCMN-QAAAEY"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:57.056462 2025] [:error] [pid 6644:tid 6665] [client 109.245.159.218:13092] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phptmp"] [unique_id "aR17kU0i6Rf788MB6saBEwAAANM"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:57.312728 2025] [:error] [pid 6919:tid 6940] [client 109.245.159.218:13312] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.prod.php.txt"] [unique_id "aR17kUYFdN1s_9xJVUlQyAAAARI"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:57.376085 2025] [:error] [pid 6644:tid 6648] [client 109.245.159.218:13337] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.save"] [unique_id "aR17kU0i6Rf788MB6saBFAAAAMI"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:57.691847 2025] [:error] [pid 6644:tid 6657] [client 109.245.159.218:13671] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.tar"] [unique_id "aR17kU0i6Rf788MB6saBFQAAAMs"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:57.693329 2025] [:error] [pid 6556:tid 6642] [client 109.245.159.218:13674] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.temp" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.temp"] [unique_id "aR17kZuL7hhgrmdM1mv-ZAAAAJg"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:58.461361 2025] [:error] [pid 6555:tid 6603] [client 109.245.159.218:14329] [client 109.245.159.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.txt" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.txt"] [unique_id "aR17kkbVJm8eMsGMTCMN-wAAAEw"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:58.636793 2025] [:error] [pid 6554:tid 6578] [client 109.245.159.218:14719] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.zip"] [unique_id "aR17kt8rvPWLafJFqmXU2wAAABI"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:58.636955 2025] [:error] [pid 6554:tid 6560] [client 109.245.159.218:14720] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config~"] [unique_id "aR17kt8rvPWLafJFqmXU3AAAAAE"], referer: https://expressinteriors.com
[Wed Nov 19 16:10:59.014658 2025] [:error] [pid 6644:tid 6650] [client 109.245.159.218:5195] [client 109.245.159.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-configbak"] [unique_id "aR17k00i6Rf788MB6saBFwAAAMQ"], referer: https://expressinteriors.com
[Wed Nov 19 16:32:47.718946 2025] [:error] [pid 12672:tid 12698] [client 162.241.203.52:34208] [client 162.241.203.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.203.52, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR2Ar_9vojl6X1cc5mX7tAAAAdU"]
[Wed Nov 19 18:30:55.008052 2025] [:error] [pid 6556:tid 6631] [client 91.121.34.215:57122] [client 91.121.34.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.121.34.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR2cX5uL7hhgrmdM1msRiAAAAI0"]
[Wed Nov 19 18:49:30.585342 2025] [:error] [pid 6555:tid 6601] [client 66.29.146.47:47490] [client 66.29.146.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.29.146.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR2gukbVJm8eMsGMTCMj9gAAAEo"]
[Wed Nov 19 19:30:05.112090 2025] [:error] [pid 6555:tid 6613] [client 123.187.240.242:34347] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aR2qPUbVJm8eMsGMTCMq5wAAAFY"]
[Wed Nov 19 20:35:58.050786 2025] [:error] [pid 12672:tid 12692] [client 104.196.176.201:58259] [client 104.196.176.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/media/system/js/core.js"] [unique_id "aR25rv9vojl6X1cc5mUu1AAAAc8"]
[Wed Nov 19 20:38:39.834209 2025] [:error] [pid 6556:tid 6628] [client 106.219.194.67:27906] [client 106.219.194.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.194.67, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR26T5uL7hhgrmdM1msn5QAAAIo"]
[Wed Nov 19 20:42:56.085953 2025] [:error] [pid 6554:tid 6565] [client 106.219.194.67:43507] [client 106.219.194.67] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aR27UN8rvPWLafJFqmX8vgAAAAY"]
[Wed Nov 19 20:44:47.640284 2025] [:error] [pid 6919:tid 6939] [client 106.219.194.67:2082] [client 106.219.194.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.194.67, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR27v0YFdN1s_9xJVUmDcQAAARE"]
[Wed Nov 19 20:46:38.437382 2025] [:error] [pid 6644:tid 6669] [client 106.219.194.67:2109] [client 106.219.194.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.194.67, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR28Lk0i6Rf788MB6sbT7QAAANc"]
[Wed Nov 19 20:48:27.663151 2025] [:error] [pid 6644:tid 6658] [client 106.219.194.67:18854] [client 106.219.194.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.194.67, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR28m00i6Rf788MB6sbUVQAAAMw"]
[Wed Nov 19 20:50:24.484686 2025] [:error] [pid 6644:tid 6647] [client 106.219.194.67:18870] [client 106.219.194.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.194.67, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR29EE0i6Rf788MB6sbU7gAAAME"]
[Wed Nov 19 21:09:17.598348 2025] [:error] [pid 6555:tid 6608] [client 43.135.144.126:39198] [client 43.135.144.126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aR3BfUbVJm8eMsGMTCM5xwAAAFE"]
[Wed Nov 19 21:29:18.301343 2025] [:error] [pid 12672:tid 12684] [client 5.135.43.82:43638] [client 5.135.43.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.135.43.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR3GLv9vojl6X1cc5mU4qgAAAcc"]
[Thu Nov 20 00:06:46.406516 2025] [:error] [pid 6919:tid 6944] [client 51.195.41.174:40342] [client 51.195.41.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.195.41.174, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR3rFkYFdN1s_9xJVUmjrAAAARY"]
[Thu Nov 20 02:23:24.373820 2025] [:error] [pid 8365:tid 8390] [client 91.92.242.56:65463] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aR4LHBhyiKKdRMrEbr2sKwAAApU"]
[Thu Nov 20 02:23:24.936779 2025] [:error] [pid 8396:tid 8400] [client 91.92.242.56:49417] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aR4LHIolA09HZQNzyMD1IAAAAsI"]
[Thu Nov 20 02:23:25.501727 2025] [:error] [pid 8396:tid 8407] [client 91.92.242.56:49762] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aR4LHYolA09HZQNzyMD1IgAAAsk"]
[Thu Nov 20 03:07:21.653163 2025] [:error] [pid 8293:tid 8296] [client 115.79.196.94:52608] [client 115.79.196.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.79.196.94, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR4VaSGLhDa8A92KWiIRUAAAAkE"]
[Thu Nov 20 08:09:39.707591 2025] [:error] [pid 55343:tid 55406] [client 23.104.161.126:40153] [client 23.104.161.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.104.161.126, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR5cQ1WlO3EnyVMV7w4dJAAAAIc"], referer: https://expressinteriors.com/
[Thu Nov 20 08:19:43.997393 2025] [:error] [pid 55340:tid 55366] [client 113.219.218.197:59814] [client 113.219.218.197] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aR5en_OxD-NeMydTybDtpgAAABU"]
[Thu Nov 20 09:16:35.626991 2025] [:error] [pid 55342:tid 55380] [client 85.203.23.171:58597] [client 85.203.23.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/advanced-product-fields-for-woocommerce/db.php"] [unique_id "aR5r87g6x32Tvk7fIG9p4gAAAEg"]
[Thu Nov 20 09:16:35.903508 2025] [:error] [pid 55430:tid 55452] [client 85.203.23.173:22425] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/so-pinyin-slugs/inc/main_json.php"] [unique_id "aR5r8_PZXaIMEU4pE7t0UwAAANM"]
[Thu Nov 20 09:16:36.336141 2025] [:error] [pid 55342:tid 55377] [client 85.203.23.215:31305] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/theme-check/main.php"] [unique_id "aR5r9Lg6x32Tvk7fIG9p4wAAAEU"]
[Thu Nov 20 09:16:36.546460 2025] [:error] [pid 55430:tid 55439] [client 85.203.23.186:26749] [client 85.203.23.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/index.php"] [unique_id "aR5r9PPZXaIMEU4pE7t0VAAAAMY"]
[Thu Nov 20 09:16:36.816734 2025] [:error] [pid 55342:tid 55383] [client 85.203.23.197:58505] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/covr-wpcom/assets/fonts/manrope_normal.php"] [unique_id "aR5r9Lg6x32Tvk7fIG9p5AAAAEs"]
[Thu Nov 20 09:16:37.114608 2025] [:error] [pid 34444:tid 34456] [client 85.203.23.216:55139] [client 85.203.23.216] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/222.php"] [unique_id "aR5r9VNEol4jlmmA_GPIiwAAAUo"]
[Thu Nov 20 09:16:37.636796 2025] [:error] [pid 804:tid 846] [client 85.203.23.200:56613] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-parsidate/includes/admin/acf-fields-adyrui.php"] [unique_id "aR5r9faRHpUlPL9O0LkU0gAAAZY"]
[Thu Nov 20 09:16:38.214887 2025] [:error] [pid 55340:tid 55351] [client 85.203.23.169:22879] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/aback.php"] [unique_id "aR5r9vOxD-NeMydTybAHSAAAAAY"]
[Thu Nov 20 09:16:38.769168 2025] [:error] [pid 55342:tid 55386] [client 85.203.23.209:47005] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aR5r9rg6x32Tvk7fIG9p5QAAAE4"]
[Thu Nov 20 09:16:38.952308 2025] [:error] [pid 55430:tid 55453] [client 85.203.23.168:57283] [client 85.203.23.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ad.php"] [unique_id "aR5r9vPZXaIMEU4pE7t0VQAAANQ"]
[Thu Nov 20 09:16:39.248663 2025] [:error] [pid 804:tid 842] [client 85.203.23.169:28713] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/moderation.php"] [unique_id "aR5r9_aRHpUlPL9O0LkU1AAAAZI"]
[Thu Nov 20 09:16:39.441502 2025] [:error] [pid 804:tid 836] [client 85.203.23.219:60269] [client 85.203.23.219] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/classwithtostring.php"] [unique_id "aR5r9_aRHpUlPL9O0LkU1gAAAYw"]
[Thu Nov 20 09:16:40.170985 2025] [:error] [pid 804:tid 845] [client 85.203.23.211:53671] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aR5r-PaRHpUlPL9O0LkU2AAAAZU"]
[Thu Nov 20 09:16:40.543039 2025] [:error] [pid 55340:tid 55348] [client 85.203.23.203:45241] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/jindex.php"] [unique_id "aR5r-POxD-NeMydTybAHSgAAAAM"]
[Thu Nov 20 09:16:41.642683 2025] [:error] [pid 34444:tid 34448] [client 85.203.23.171:25797] [client 85.203.23.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aR5r-VNEol4jlmmA_GPIkAAAAUI"]
[Thu Nov 20 09:16:42.238180 2025] [:error] [pid 34405:tid 34414] [client 85.203.23.173:26885] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/erinyani/default.php"] [unique_id "aR5r-jFpvu8oRK7ATfukVgAAAQc"]
[Thu Nov 20 09:16:42.530721 2025] [:error] [pid 55343:tid 55421] [client 85.203.23.168:34635] [client 85.203.23.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/leaf.php"] [unique_id "aR5r-lWlO3EnyVMV7w4ymwAAAJY"]
[Thu Nov 20 09:16:43.118883 2025] [:error] [pid 55343:tid 55417] [client 85.203.23.216:37341] [client 85.203.23.216] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/mainhosting/default.php"] [unique_id "aR5r-1WlO3EnyVMV7w4ynQAAAJI"]
[Thu Nov 20 09:16:43.352041 2025] [:error] [pid 55342:tid 55381] [client 85.203.23.211:37789] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/about.php"] [unique_id "aR5r-7g6x32Tvk7fIG9p6QAAAEk"]
[Thu Nov 20 09:16:43.559257 2025] [:error] [pid 804:tid 834] [client 85.203.23.169:25289] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/inc.php"] [unique_id "aR5r-_aRHpUlPL9O0LkU3AAAAYo"]
[Thu Nov 20 09:16:49.040927 2025] [:error] [pid 34405:tid 34409] [client 85.203.23.187:35231] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aR5sATFpvu8oRK7ATfukXgAAAQI"]
[Thu Nov 20 09:16:49.650098 2025] [:error] [pid 55343:tid 55412] [client 85.203.23.183:21517] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/sim.php"] [unique_id "aR5sAVWlO3EnyVMV7w4yoQAAAI0"]
[Thu Nov 20 09:16:50.442803 2025] [:error] [pid 804:tid 836] [client 85.203.23.220:37691] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aR5sAvaRHpUlPL9O0LkU4gAAAYw"]
[Thu Nov 20 09:16:51.357257 2025] [:error] [pid 804:tid 808] [client 85.203.23.218:58591] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aR5sA_aRHpUlPL9O0LkU4wAAAYI"]
[Thu Nov 20 09:16:51.814759 2025] [:error] [pid 55342:tid 55373] [client 85.203.23.199:20773] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aR5sA7g6x32Tvk7fIG9p8AAAAEE"]
[Thu Nov 20 09:16:52.352811 2025] [:error] [pid 804:tid 845] [client 85.203.23.199:38051] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aR5sBPaRHpUlPL9O0LkU5gAAAZU"]
[Thu Nov 20 09:16:52.585206 2025] [:error] [pid 55343:tid 55423] [client 85.203.23.177:53615] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xml.php"] [unique_id "aR5sBFWlO3EnyVMV7w4yowAAAJg"]
[Thu Nov 20 09:16:52.811420 2025] [:error] [pid 55342:tid 55378] [client 85.203.23.192:24375] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aR5sBLg6x32Tvk7fIG9p8gAAAEY"]
[Thu Nov 20 09:16:53.033435 2025] [:error] [pid 804:tid 841] [client 85.203.23.193:41043] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/images/class-config.php"] [unique_id "aR5sBfaRHpUlPL9O0LkU6AAAAZE"]
[Thu Nov 20 09:16:53.316457 2025] [:error] [pid 804:tid 834] [client 85.203.23.215:27907] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aR5sBfaRHpUlPL9O0LkU6QAAAYo"]
[Thu Nov 20 09:16:53.852766 2025] [:error] [pid 55342:tid 55389] [client 85.203.23.177:62835] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aR5sBbg6x32Tvk7fIG9p8wAAAFE"]
[Thu Nov 20 09:16:54.325811 2025] [:error] [pid 34405:tid 34418] [client 85.203.23.220:51355] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "aR5sBjFpvu8oRK7ATfukYgAAAQs"]
[Thu Nov 20 09:16:54.519991 2025] [:error] [pid 804:tid 817] [client 85.203.23.196:34681] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/back.php"] [unique_id "aR5sBvaRHpUlPL9O0LkU7AAAAYM"]
[Thu Nov 20 09:16:54.825390 2025] [:error] [pid 55340:tid 55363] [client 85.203.23.200:54221] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aR5sBvOxD-NeMydTybAHXwAAABI"]
[Thu Nov 20 09:16:55.028311 2025] [:error] [pid 55343:tid 55418] [client 85.203.23.222:29347] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aR5sB1WlO3EnyVMV7w4ypwAAAJM"]
[Thu Nov 20 09:16:55.348287 2025] [:error] [pid 55340:tid 55361] [client 85.203.23.187:60465] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/leafmailer2.8.php"] [unique_id "aR5sB_OxD-NeMydTybAHYAAAABA"]
[Thu Nov 20 09:16:55.670398 2025] [:error] [pid 34405:tid 34414] [client 85.203.23.192:21551] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "aR5sBzFpvu8oRK7ATfukYwAAAQc"]
[Thu Nov 20 09:16:55.928613 2025] [:error] [pid 804:tid 833] [client 85.203.23.177:56087] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/up.php"] [unique_id "aR5sB_aRHpUlPL9O0LkU7wAAAYk"]
[Thu Nov 20 09:16:56.247956 2025] [:error] [pid 55340:tid 55350] [client 85.203.23.191:63567] [client 85.203.23.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wsa.php"] [unique_id "aR5sCPOxD-NeMydTybAHYQAAAAU"]
[Thu Nov 20 09:16:56.749751 2025] [:error] [pid 55430:tid 55451] [client 85.203.23.172:50119] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aR5sCPPZXaIMEU4pE7t0VwAAANI"]
[Thu Nov 20 09:16:56.964119 2025] [:error] [pid 34444:tid 34450] [client 85.203.23.215:57123] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-l0gin.php"] [unique_id "aR5sCFNEol4jlmmA_GPInQAAAUQ"]
[Thu Nov 20 09:16:57.180379 2025] [:error] [pid 55342:tid 55395] [client 85.203.23.204:45511] [client 85.203.23.204] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/uploads/index.php"] [unique_id "aR5sCbg6x32Tvk7fIG9p9AAAAFc"]
[Thu Nov 20 09:16:57.499066 2025] [:error] [pid 55342:tid 55384] [client 85.203.23.221:38829] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentyfifteen/shell3.php"] [unique_id "aR5sCbg6x32Tvk7fIG9p9QAAAEw"]
[Thu Nov 20 09:16:57.852407 2025] [:error] [pid 55340:tid 55346] [client 85.203.23.197:48105] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/azusa/inc/wp-host.php"] [unique_id "aR5sCfOxD-NeMydTybAHZAAAAAE"]
[Thu Nov 20 09:16:58.117077 2025] [:error] [pid 55342:tid 55391] [client 85.203.23.223:52043] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/better-wp-security/vendor-prod/composer/autoload.php"] [unique_id "aR5sCrg6x32Tvk7fIG9p-AAAAFM"]
[Thu Nov 20 09:16:58.633717 2025] [:error] [pid 55430:tid 55456] [client 85.203.23.214:39101] [client 85.203.23.214] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce-to-wechatapp/vendor/overtrue/wechat/src/OpenPlatform/Authorizer/MiniProgram/Domain/Current.php"] [unique_id "aR5sCvPZXaIMEU4pE7t0WwAAANc"]
[Thu Nov 20 09:16:59.341147 2025] [:error] [pid 55342:tid 55379] [client 85.203.23.199:53411] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "aR5sC7g6x32Tvk7fIG9p-gAAAEc"]
[Thu Nov 20 09:16:59.629505 2025] [:error] [pid 55340:tid 55356] [client 85.203.23.173:61909] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/ga.php"] [unique_id "aR5sC_OxD-NeMydTybAHZgAAAAs"]
[Thu Nov 20 09:16:59.931210 2025] [:error] [pid 55430:tid 55443] [client 85.203.23.195:44187] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-author-name/index.php"] [unique_id "aR5sC_PZXaIMEU4pE7t0XQAAAMo"]
[Thu Nov 20 09:17:00.130088 2025] [:error] [pid 55430:tid 55450] [client 85.203.23.215:34245] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/list/144.php"] [unique_id "aR5sDPPZXaIMEU4pE7t0XgAAANE"]
[Thu Nov 20 09:17:00.318665 2025] [:error] [pid 55430:tid 55436] [client 85.203.23.204:27679] [client 85.203.23.204] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/mach.php"] [unique_id "aR5sDPPZXaIMEU4pE7t0XwAAAMM"]
[Thu Nov 20 09:17:00.845341 2025] [:error] [pid 34444:tid 34447] [client 85.203.23.212:42953] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aR5sDFNEol4jlmmA_GPInwAAAUE"]
[Thu Nov 20 09:17:01.657526 2025] [:error] [pid 55342:tid 55385] [client 85.203.23.181:38049] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/advanced-llms-txt-generator/assets/css/css_json.php"] [unique_id "aR5sDbg6x32Tvk7fIG9p-wAAAE0"]
[Thu Nov 20 09:17:02.081039 2025] [:error] [pid 55342:tid 55377] [client 85.203.23.183:37703] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/kontol/kiw.php"] [unique_id "aR5sDrg6x32Tvk7fIG9p_AAAAEU"]
[Thu Nov 20 09:17:02.461344 2025] [:error] [pid 55340:tid 55349] [client 85.203.23.219:55841] [client 85.203.23.219] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/theme-check/theme-check.php"] [unique_id "aR5sDvOxD-NeMydTybAHaAAAAAQ"]
[Thu Nov 20 09:17:03.949072 2025] [:error] [pid 55343:tid 55408] [client 85.203.23.212:62027] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/js_composer/include/templates/shortcodes/lock.php"] [unique_id "aR5sD1WlO3EnyVMV7w4yqwAAAIk"]
[Thu Nov 20 09:17:04.432390 2025] [:error] [pid 55342:tid 55386] [client 85.203.23.202:59855] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/autoload_classmap.php"] [unique_id "aR5sELg6x32Tvk7fIG9p_QAAAE4"]
[Thu Nov 20 09:17:05.179702 2025] [:error] [pid 55340:tid 55355] [client 85.203.23.196:47811] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/chosen.php"] [unique_id "aR5sEfOxD-NeMydTybAHaQAAAAo"]
[Thu Nov 20 09:17:05.688516 2025] [:error] [pid 34405:tid 34426] [client 85.203.23.190:63053] [client 85.203.23.190] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "aR5sETFpvu8oRK7ATfukZwAAARM"]
[Thu Nov 20 09:17:05.951863 2025] [:error] [pid 55430:tid 55445] [client 85.203.23.196:42155] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/cloud.php"] [unique_id "aR5sEfPZXaIMEU4pE7t0ZQAAAMw"]
[Thu Nov 20 09:17:06.144634 2025] [:error] [pid 55343:tid 55416] [client 85.203.23.183:50073] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wp-content.php"] [unique_id "aR5sElWlO3EnyVMV7w4yrQAAAJE"]
[Thu Nov 20 09:17:06.388378 2025] [:error] [pid 55340:tid 55345] [client 85.203.23.196:50689] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-post-data.php"] [unique_id "aR5sEvOxD-NeMydTybAHbAAAAAA"]
[Thu Nov 20 09:17:06.594713 2025] [:error] [pid 34405:tid 34428] [client 85.203.23.193:24731] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aR5sEjFpvu8oRK7ATfukaAAAARU"]
[Thu Nov 20 09:17:06.798488 2025] [:error] [pid 55342:tid 55389] [client 85.203.23.223:57271] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/m.php"] [unique_id "aR5sErg6x32Tvk7fIG9p_gAAAFE"]
[Thu Nov 20 09:17:07.279682 2025] [:error] [pid 55342:tid 55382] [client 85.203.23.184:52823] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/coffee/colors_26.php"] [unique_id "aR5sE7g6x32Tvk7fIG9qAAAAAEo"]
[Thu Nov 20 09:17:07.702454 2025] [:error] [pid 55340:tid 55346] [client 85.203.23.209:59989] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/"] [unique_id "aR5sE_OxD-NeMydTybAHcQAAAAE"]
[Thu Nov 20 09:17:08.035380 2025] [:error] [pid 55343:tid 55423] [client 85.203.23.183:56679] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-backing.php"] [unique_id "aR5sFFWlO3EnyVMV7w4yrgAAAJg"]
[Thu Nov 20 09:17:08.286950 2025] [:error] [pid 34405:tid 34425] [client 85.203.23.203:34755] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/wp-backing.php"] [unique_id "aR5sFDFpvu8oRK7ATfukcgAAARI"]
[Thu Nov 20 09:17:08.623938 2025] [:error] [pid 804:tid 824] [client 85.203.23.185:42223] [client 85.203.23.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/covr-wpcom/assets/fonts/manrope.php"] [unique_id "aR5sFPaRHpUlPL9O0LkU8gAAAYg"]
[Thu Nov 20 09:17:09.019204 2025] [:error] [pid 55340:tid 55359] [client 85.203.23.208:50585] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/acxx.php"] [unique_id "aR5sFfOxD-NeMydTybAHdgAAAA4"]
[Thu Nov 20 09:17:09.792958 2025] [:error] [pid 804:tid 846] [client 85.203.23.184:57161] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/modern/about.php"] [unique_id "aR5sFfaRHpUlPL9O0LkU8wAAAZY"]
[Thu Nov 20 09:17:10.347185 2025] [:error] [pid 55430:tid 55440] [client 85.203.23.181:25725] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/class-ftp.php"] [unique_id "aR5sFvPZXaIMEU4pE7t0cwAAAMc"]
[Thu Nov 20 09:17:10.538634 2025] [:error] [pid 55343:tid 55403] [client 85.203.23.218:47411] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/about.php"] [unique_id "aR5sFlWlO3EnyVMV7w4ysAAAAIQ"]
[Thu Nov 20 09:17:15.920418 2025] [:error] [pid 55342:tid 55393] [client 85.203.23.211:51037] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/call-now-button/src/about.php"] [unique_id "aR5sG7g6x32Tvk7fIG9qNAAAAFU"]
[Thu Nov 20 09:17:16.814085 2025] [:error] [pid 55340:tid 55354] [client 85.203.23.219:59061] [client 85.203.23.219] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/about.php"] [unique_id "aR5sHPOxD-NeMydTybAHjQAAAAk"]
[Thu Nov 20 09:17:17.087471 2025] [:error] [pid 55430:tid 55449] [client 85.203.23.170:48957] [client 85.203.23.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/admin/pages/about.php"] [unique_id "aR5sHfPZXaIMEU4pE7t0hQAAANA"]
[Thu Nov 20 09:17:17.382122 2025] [:error] [pid 55340:tid 55345] [client 85.203.23.208:22437] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-mail-smtp/assets/about.php"] [unique_id "aR5sHfOxD-NeMydTybAHjwAAAAA"]
[Thu Nov 20 09:17:17.621140 2025] [:error] [pid 55340:tid 55362] [client 85.203.23.189:47377] [client 85.203.23.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-optimize/vendor/mrclay/minify/static/about.php"] [unique_id "aR5sHfOxD-NeMydTybAHkAAAABE"]
[Thu Nov 20 09:17:17.830035 2025] [:error] [pid 55340:tid 55364] [client 85.203.23.188:27397] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-smushit/_src/js/common/about.php"] [unique_id "aR5sHfOxD-NeMydTybAHkgAAABM"]
[Thu Nov 20 09:17:18.072117 2025] [:error] [pid 34405:tid 34407] [client 85.203.23.203:25329] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-smushit/core/modules/background/about.php"] [unique_id "aR5sHjFpvu8oRK7ATfukngAAAQA"]
[Thu Nov 20 09:17:18.810039 2025] [:error] [pid 55343:tid 55417] [client 85.203.23.216:21531] [client 85.203.23.216] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/about.php"] [unique_id "aR5sHlWlO3EnyVMV7w4ytAAAAJI"]
[Thu Nov 20 09:17:20.932244 2025] [:error] [pid 34444:tid 34470] [client 85.203.23.181:50593] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/inc/blog/about.php"] [unique_id "aR5sIFNEol4jlmmA_GPIqgAAAVg"]
[Thu Nov 20 09:17:21.329269 2025] [:error] [pid 55340:tid 55349] [client 85.203.23.172:24773] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/template-parts/advanced-footer/about.php"] [unique_id "aR5sIfOxD-NeMydTybAHlgAAAAQ"]
[Thu Nov 20 09:17:21.635754 2025] [:error] [pid 34405:tid 34426] [client 85.203.23.217:57689] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/wp-login.php"] [unique_id "aR5sITFpvu8oRK7ATfukoQAAARM"]
[Thu Nov 20 09:17:21.843091 2025] [:error] [pid 55340:tid 55354] [client 85.203.23.168:20449] [client 85.203.23.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/paradox/option-tree/assets/js/vendor/jquery/about.php"] [unique_id "aR5sIfOxD-NeMydTybAHmAAAAAk"]
[Thu Nov 20 09:17:22.052714 2025] [:error] [pid 55340:tid 55345] [client 85.203.23.192:61261] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfive/assets/fonts/roboto-slab/about.php"] [unique_id "aR5sIvOxD-NeMydTybAHmgAAAAA"]
[Thu Nov 20 09:17:22.332940 2025] [:error] [pid 55340:tid 55358] [client 85.203.23.188:40043] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wpseo-import/about.php"] [unique_id "aR5sIvOxD-NeMydTybAHmwAAAA0"]
[Thu Nov 20 09:17:22.957659 2025] [:error] [pid 55430:tid 55437] [client 85.203.23.219:42765] [client 85.203.23.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Cookie/about.php"] [unique_id "aR5sIvPZXaIMEU4pE7t0hgAAAMQ"]
[Thu Nov 20 09:17:23.151649 2025] [:error] [pid 55430:tid 55453] [client 85.203.23.202:43885] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Proxy/about.php"] [unique_id "aR5sI_PZXaIMEU4pE7t0hwAAANQ"]
[Thu Nov 20 09:17:23.417179 2025] [:error] [pid 55343:tid 55399] [client 85.203.23.195:60855] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Utility/about.php"] [unique_id "aR5sI1WlO3EnyVMV7w4yuQAAAIA"]
[Thu Nov 20 09:17:23.733153 2025] [:error] [pid 804:tid 807] [client 85.203.23.197:40363] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comment-date/about.php"] [unique_id "aR5sI_aRHpUlPL9O0LkU-QAAAYE"]
[Thu Nov 20 09:17:24.215528 2025] [:error] [pid 55342:tid 55385] [client 85.203.23.187:38715] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comments-pagination-numbers/about.php"] [unique_id "aR5sJLg6x32Tvk7fIG9qNQAAAE0"]
[Thu Nov 20 09:17:25.258004 2025] [:error] [pid 55340:tid 55357] [client 85.203.23.200:52437] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comments-title/about.php"] [unique_id "aR5sJfOxD-NeMydTybAHnQAAAAw"]
[Thu Nov 20 09:17:25.605648 2025] [:error] [pid 55343:tid 55422] [client 85.203.23.190:39271] [client 85.203.23.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/image/about.php"] [unique_id "aR5sJVWlO3EnyVMV7w4yvAAAAJc"]
[Thu Nov 20 09:17:25.885118 2025] [:error] [pid 34444:tid 34469] [client 85.203.23.209:21543] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/latest-posts/about.php"] [unique_id "aR5sJVNEol4jlmmA_GPIqwAAAVc"]
[Thu Nov 20 09:17:26.518266 2025] [:error] [pid 55343:tid 55409] [client 85.203.23.180:20939] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/more/about.php"] [unique_id "aR5sJlWlO3EnyVMV7w4yvQAAAIo"]
[Thu Nov 20 09:17:26.849800 2025] [:error] [pid 55343:tid 55406] [client 85.203.23.214:32783] [client 85.203.23.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/page-list-item/about.php"] [unique_id "aR5sJlWlO3EnyVMV7w4yvgAAAIc"]
[Thu Nov 20 09:17:27.053969 2025] [:error] [pid 34405:tid 34431] [client 85.203.23.193:21505] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/site-title/about.php"] [unique_id "aR5sJzFpvu8oRK7ATfukpAAAARg"]
[Thu Nov 20 09:17:27.480231 2025] [:error] [pid 55340:tid 55363] [client 85.203.23.183:36505] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/components/index.php"] [unique_id "aR5sJ_OxD-NeMydTybAHpwAAABI"]
[Thu Nov 20 09:17:27.840270 2025] [:error] [pid 55340:tid 55350] [client 85.203.23.215:39559] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/about.php"] [unique_id "aR5sJ_OxD-NeMydTybAHqgAAAAU"]
[Thu Nov 20 09:17:28.190332 2025] [:error] [pid 55343:tid 55416] [client 85.203.23.173:48723] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/wptextpattern/about.php"] [unique_id "aR5sKFWlO3EnyVMV7w4yywAAAJE"]
[Thu Nov 20 09:17:28.783243 2025] [:error] [pid 55340:tid 55367] [client 85.203.23.216:29613] [client 85.203.23.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/wp-login.php"] [unique_id "aR5sKPOxD-NeMydTybAHtQAAABY"]
[Thu Nov 20 09:17:29.313754 2025] [:error] [pid 34405:tid 34415] [client 85.203.23.210:20503] [client 85.203.23.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/av.php"] [unique_id "aR5sKTFpvu8oRK7ATfukpQAAAQg"]
[Thu Nov 20 09:17:29.934213 2025] [:error] [pid 34405:tid 34414] [client 85.203.23.186:20711] [client 85.203.23.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/namespaced/Core/about.php"] [unique_id "aR5sKTFpvu8oRK7ATfukpgAAAQc"]
[Thu Nov 20 09:17:30.429730 2025] [:error] [pid 55340:tid 55360] [client 85.203.23.202:25653] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/new.php"] [unique_id "aR5sKvOxD-NeMydTybAHygAAAA8"]
[Thu Nov 20 09:17:30.815729 2025] [:error] [pid 34405:tid 34412] [client 85.203.23.178:64343] [client 85.203.23.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/block-directory/index.php"] [unique_id "aR5sKjFpvu8oRK7ATfukpwAAAQU"]
[Thu Nov 20 09:17:31.122584 2025] [:error] [pid 34444:tid 34453] [client 85.203.23.206:22655] [client 85.203.23.206] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/back.php"] [unique_id "aR5sK1NEol4jlmmA_GPIrwAAAUc"]
[Thu Nov 20 09:17:31.747527 2025] [:error] [pid 55340:tid 55351] [client 85.203.23.208:44103] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/aves.php"] [unique_id "aR5sK_OxD-NeMydTybAH1gAAAAY"]
[Thu Nov 20 09:17:32.098024 2025] [:error] [pid 55342:tid 55386] [client 85.203.23.195:47085] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aR5sLLg6x32Tvk7fIG9qNwAAAE4"]
[Thu Nov 20 09:17:32.541592 2025] [:error] [pid 34444:tid 34458] [client 85.203.23.212:54739] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aR5sLFNEol4jlmmA_GPIsAAAAUw"]
[Thu Nov 20 09:17:32.791637 2025] [:error] [pid 34444:tid 34450] [client 85.203.23.210:57247] [client 85.203.23.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aR5sLFNEol4jlmmA_GPIsQAAAUQ"]
[Thu Nov 20 09:17:33.022390 2025] [:error] [pid 34444:tid 34448] [client 85.203.23.199:35139] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aR5sLVNEol4jlmmA_GPIsgAAAUI"]
[Thu Nov 20 09:17:33.413067 2025] [:error] [pid 55340:tid 55362] [client 85.203.23.184:20041] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aR5sLfOxD-NeMydTybAH5gAAABE"]
[Thu Nov 20 09:17:33.660270 2025] [:error] [pid 55340:tid 55354] [client 85.203.23.182:41153] [client 85.203.23.182] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aR5sLfOxD-NeMydTybAH5wAAAAk"]
[Thu Nov 20 09:17:34.328176 2025] [:error] [pid 55340:tid 55349] [client 85.203.23.177:20975] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aR5sLvOxD-NeMydTybAH7QAAAAQ"]
[Thu Nov 20 09:17:34.927008 2025] [:error] [pid 55340:tid 55362] [client 85.203.23.183:30443] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aR5sLvOxD-NeMydTybAH9gAAABE"]
[Thu Nov 20 09:17:35.427784 2025] [:error] [pid 804:tid 824] [client 85.203.23.200:33631] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aR5sL_aRHpUlPL9O0LkU_QAAAYg"]
[Thu Nov 20 09:17:35.683694 2025] [:error] [pid 55340:tid 55367] [client 85.203.23.180:20993] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aR5sL_OxD-NeMydTybAH_QAAABY"]
[Thu Nov 20 09:17:35.904098 2025] [:error] [pid 55430:tid 55451] [client 85.203.23.201:31667] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aR5sL_PZXaIMEU4pE7t0igAAANI"]
[Thu Nov 20 09:17:36.166434 2025] [:error] [pid 55340:tid 55363] [client 85.203.23.206:37019] [client 85.203.23.206] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/load.php"] [unique_id "aR5sMPOxD-NeMydTybAIAwAAABI"]
[Thu Nov 20 09:17:36.370150 2025] [:error] [pid 55343:tid 55421] [client 85.203.23.166:41893] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aR5sMFWlO3EnyVMV7w4zCAAAAJY"]
[Thu Nov 20 09:17:36.624159 2025] [:error] [pid 804:tid 820] [client 85.203.23.212:22393] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aR5sMPaRHpUlPL9O0LkU_gAAAYQ"]
[Thu Nov 20 09:17:36.851229 2025] [:error] [pid 34444:tid 34447] [client 85.203.23.205:28459] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aR5sMFNEol4jlmmA_GPIswAAAUE"]
[Thu Nov 20 09:17:37.429970 2025] [:error] [pid 55343:tid 55420] [client 85.203.23.201:49833] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/"] [unique_id "aR5sMVWlO3EnyVMV7w4zCgAAAJU"]
[Thu Nov 20 09:17:37.670030 2025] [:error] [pid 34405:tid 34419] [client 85.203.23.217:20103] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2024/index.php"] [unique_id "aR5sMTFpvu8oRK7ATfukrAAAAQw"]
[Thu Nov 20 09:17:37.867007 2025] [:error] [pid 34405:tid 34426] [client 85.203.23.211:64393] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aR5sMTFpvu8oRK7ATfukrQAAARM"]
[Thu Nov 20 09:17:38.107911 2025] [:error] [pid 34405:tid 34413] [client 85.203.23.208:41353] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/classwithtostring.php"] [unique_id "aR5sMjFpvu8oRK7ATfukrgAAAQY"]
[Thu Nov 20 09:17:38.470684 2025] [:error] [pid 34444:tid 34470] [client 85.203.23.205:50585] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/index.php"] [unique_id "aR5sMlNEol4jlmmA_GPItQAAAVg"]
[Thu Nov 20 09:17:44.621872 2025] [:error] [pid 55342:tid 55380] [client 85.203.23.200:21143] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/admin/index.php"] [unique_id "aR5sOLg6x32Tvk7fIG9qPwAAAEg"]
[Thu Nov 20 09:17:45.470443 2025] [:error] [pid 804:tid 817] [client 85.203.23.219:25469] [client 85.203.23.219] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/about.php"] [unique_id "aR5sOfaRHpUlPL9O0LkU_wAAAYM"]
[Thu Nov 20 09:17:46.275713 2025] [:error] [pid 55343:tid 55422] [client 85.203.23.221:24827] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/admin.php"] [unique_id "aR5sOlWlO3EnyVMV7w4zDAAAAJc"]
[Thu Nov 20 09:17:46.851709 2025] [:error] [pid 55340:tid 55361] [client 85.203.23.225:29077] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aR5sOvOxD-NeMydTybAICgAAABA"]
[Thu Nov 20 09:17:47.068352 2025] [:error] [pid 34405:tid 34414] [client 85.203.23.220:34053] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aR5sOzFpvu8oRK7ATfuktgAAAQc"]
[Thu Nov 20 09:17:48.659808 2025] [:error] [pid 55340:tid 55346] [client 85.203.23.193:22979] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/admin-header.php"] [unique_id "aR5sPPOxD-NeMydTybAIDQAAAAE"]
[Thu Nov 20 09:17:49.608585 2025] [:error] [pid 55340:tid 55360] [client 85.203.23.181:61199] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "aR5sPfOxD-NeMydTybAIDgAAAA8"]
[Thu Nov 20 09:17:50.101876 2025] [:error] [pid 55430:tid 55439] [client 85.203.23.193:30723] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/autoload_classmap/function.php"] [unique_id "aR5sPvPZXaIMEU4pE7t0zwAAAMY"]
[Thu Nov 20 09:17:50.462385 2025] [:error] [pid 55343:tid 55401] [client 85.203.23.170:42357] [client 85.203.23.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "aR5sPlWlO3EnyVMV7w4zDwAAAII"]
[Thu Nov 20 09:17:51.251515 2025] [:error] [pid 55430:tid 55438] [client 85.203.23.210:51539] [client 85.203.23.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/404.php"] [unique_id "aR5sP_PZXaIMEU4pE7t07gAAAMU"]
[Thu Nov 20 09:17:51.694574 2025] [:error] [pid 55340:tid 55364] [client 85.203.23.209:47837] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "aR5sP_OxD-NeMydTybAIDwAAABM"]
[Thu Nov 20 09:17:52.206679 2025] [:error] [pid 55342:tid 55379] [client 85.203.23.204:55169] [client 85.203.23.204] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/class.api.php"] [unique_id "aR5sQLg6x32Tvk7fIG9qQwAAAEc"]
[Thu Nov 20 09:17:52.883099 2025] [:error] [pid 804:tid 836] [client 85.203.23.223:37713] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/index.php"] [unique_id "aR5sQPaRHpUlPL9O0LkVAgAAAYw"]
[Thu Nov 20 09:17:53.389318 2025] [:error] [pid 804:tid 838] [client 85.203.23.221:32087] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/revslider/includes/external/page/index.php"] [unique_id "aR5sQfaRHpUlPL9O0LkVBQAAAY4"]
[Thu Nov 20 09:17:53.591965 2025] [:error] [pid 55343:tid 55418] [client 85.203.23.184:54631] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-config-sample.php"] [unique_id "aR5sQVWlO3EnyVMV7w4zEAAAAJM"]
[Thu Nov 20 09:17:53.954964 2025] [:error] [pid 34444:tid 34453] [client 85.203.23.208:53115] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aR5sQVNEol4jlmmA_GPI1gAAAUc"]
[Thu Nov 20 09:17:54.215794 2025] [:error] [pid 34444:tid 34450] [client 85.203.23.199:63459] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aR5sQlNEol4jlmmA_GPI2AAAAUQ"]
[Thu Nov 20 09:17:54.548789 2025] [:error] [pid 55342:tid 55392] [client 85.203.23.188:55059] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/nav.php"] [unique_id "aR5sQrg6x32Tvk7fIG9qRwAAAFQ"]
[Thu Nov 20 09:17:54.826806 2025] [:error] [pid 34405:tid 34420] [client 85.203.23.189:48895] [client 85.203.23.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/sketch/404.php"] [unique_id "aR5sQjFpvu8oRK7ATfuk0gAAAQ0"]
[Thu Nov 20 09:17:55.048138 2025] [:error] [pid 55340:tid 55367] [client 85.203.23.177:41281] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/files/"] [unique_id "aR5sQ_OxD-NeMydTybAIEgAAABY"]
[Thu Nov 20 09:17:55.314425 2025] [:error] [pid 34444:tid 34448] [client 85.203.23.205:37685] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aR5sQ1NEol4jlmmA_GPI2QAAAUI"]
[Thu Nov 20 09:17:55.720165 2025] [:error] [pid 804:tid 848] [client 85.203.23.196:54649] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aR5sQ_aRHpUlPL9O0LkVBgAAAZg"]
[Thu Nov 20 09:17:56.004401 2025] [:error] [pid 804:tid 847] [client 85.203.23.190:56257] [client 85.203.23.190] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/"] [unique_id "aR5sRPaRHpUlPL9O0LkVBwAAAZc"]
[Thu Nov 20 09:17:56.270380 2025] [:error] [pid 55342:tid 55377] [client 85.203.23.196:25371] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aR5sRLg6x32Tvk7fIG9qSgAAAEU"]
[Thu Nov 20 09:17:56.640384 2025] [:error] [pid 55343:tid 55402] [client 85.203.23.204:23833] [client 85.203.23.204] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aR5sRFWlO3EnyVMV7w4zEgAAAIM"]
[Thu Nov 20 09:17:57.389396 2025] [:error] [pid 804:tid 820] [client 85.203.23.202:28917] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hello.php"] [unique_id "aR5sRfaRHpUlPL9O0LkVCwAAAYQ"]
[Thu Nov 20 09:17:57.716457 2025] [:error] [pid 804:tid 843] [client 85.203.23.224:46975] [client 85.203.23.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/"] [unique_id "aR5sRfaRHpUlPL9O0LkVDQAAAZM"]
[Thu Nov 20 09:17:58.533102 2025] [:error] [pid 55342:tid 55372] [client 85.203.23.203:40099] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aR5sRrg6x32Tvk7fIG9qSwAAAEA"]
[Thu Nov 20 09:17:58.770938 2025] [:error] [pid 34405:tid 34413] [client 85.203.23.208:49545] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/privacy-tools.min.php"] [unique_id "aR5sRjFpvu8oRK7ATfuk1QAAAQY"]
[Thu Nov 20 09:17:59.013986 2025] [:error] [pid 55342:tid 55390] [client 85.203.23.220:38729] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "aR5sR7g6x32Tvk7fIG9qTAAAAFI"]
[Thu Nov 20 09:17:59.321532 2025] [:error] [pid 34405:tid 34428] [client 85.203.23.212:45783] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-links.php"] [unique_id "aR5sRzFpvu8oRK7ATfuk1gAAARU"]
[Thu Nov 20 09:17:59.729090 2025] [:error] [pid 55343:tid 55410] [client 85.203.23.172:45757] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aR5sR1WlO3EnyVMV7w4zEwAAAIs"]
[Thu Nov 20 09:17:59.936976 2025] [:error] [pid 55430:tid 55438] [client 85.203.23.192:46043] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/index.php"] [unique_id "aR5sR_PZXaIMEU4pE7t09AAAAMU"]
[Thu Nov 20 09:18:00.128641 2025] [:error] [pid 34405:tid 34423] [client 85.203.23.223:25873] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-file.php"] [unique_id "aR5sSDFpvu8oRK7ATfuk1wAAARA"]
[Thu Nov 20 09:18:00.433079 2025] [:error] [pid 55342:tid 55382] [client 85.203.23.217:41105] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "aR5sSLg6x32Tvk7fIG9qUAAAAEo"]
[Thu Nov 20 09:18:01.365422 2025] [:error] [pid 55340:tid 55357] [client 85.203.23.182:34865] [client 85.203.23.182] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ws.php"] [unique_id "aR5sSfOxD-NeMydTybAIFQAAAAw"]
[Thu Nov 20 09:18:01.680821 2025] [:error] [pid 55342:tid 55384] [client 85.203.23.178:58085] [client 85.203.23.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ty.php"] [unique_id "aR5sSbg6x32Tvk7fIG9qUQAAAEw"]
[Thu Nov 20 09:18:01.935042 2025] [:error] [pid 55430:tid 55440] [client 85.203.23.192:42491] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aR5sSfPZXaIMEU4pE7t09wAAAMc"]
[Thu Nov 20 09:18:02.156651 2025] [:error] [pid 55340:tid 55347] [client 85.203.23.205:55167] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aR5sSvOxD-NeMydTybAIFwAAAAI"]
[Thu Nov 20 09:18:02.355879 2025] [:error] [pid 34444:tid 34467] [client 85.203.23.191:44817] [client 85.203.23.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aR5sSlNEol4jlmmA_GPI2gAAAVU"]
[Thu Nov 20 09:18:02.543783 2025] [:error] [pid 55340:tid 55348] [client 85.203.23.202:64935] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/license.php"] [unique_id "aR5sSvOxD-NeMydTybAIGAAAAAM"]
[Thu Nov 20 09:18:04.342568 2025] [:error] [pid 55340:tid 55350] [client 85.203.23.168:34011] [client 85.203.23.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/admin-ajax.php"] [unique_id "aR5sTPOxD-NeMydTybAIHgAAAAU"]
[Thu Nov 20 09:18:05.126126 2025] [:error] [pid 55342:tid 55375] [client 85.203.23.210:35435] [client 85.203.23.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/WordPressCore/include.php"] [unique_id "aR5sTbg6x32Tvk7fIG9qVQAAAEM"]
[Thu Nov 20 09:18:05.730569 2025] [:error] [pid 55340:tid 55356] [client 85.203.23.202:28351] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content.php"] [unique_id "aR5sTfOxD-NeMydTybAIHwAAAAs"]
[Thu Nov 20 09:18:05.947851 2025] [:error] [pid 55340:tid 55352] [client 85.203.23.210:36471] [client 85.203.23.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-configs.php"] [unique_id "aR5sTfOxD-NeMydTybAIIAAAAAc"]
[Thu Nov 20 09:18:06.268438 2025] [:error] [pid 55340:tid 55363] [client 85.203.23.212:56215] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aR5sTvOxD-NeMydTybAIIQAAABI"]
[Thu Nov 20 09:18:06.523435 2025] [:error] [pid 55340:tid 55346] [client 85.203.23.203:62213] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aR5sTvOxD-NeMydTybAIIwAAAAE"]
[Thu Nov 20 09:18:06.932395 2025] [:error] [pid 55430:tid 55444] [client 85.203.23.212:44337] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/system.php"] [unique_id "aR5sTvPZXaIMEU4pE7t0-AAAAMs"]
[Thu Nov 20 09:18:07.723950 2025] [:error] [pid 55340:tid 55361] [client 85.203.23.210:53749] [client 85.203.23.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aR5sT_OxD-NeMydTybAIJQAAABA"]
[Thu Nov 20 09:18:08.368720 2025] [:error] [pid 55340:tid 55345] [client 85.203.23.225:63837] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/zasf"] [unique_id "aR5sUPOxD-NeMydTybAIKQAAAAA"]
[Thu Nov 20 09:18:08.852740 2025] [:error] [pid 55430:tid 55435] [client 85.203.23.181:26791] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aR5sUPPZXaIMEU4pE7t0-QAAAMI"]
[Thu Nov 20 09:18:09.229991 2025] [:error] [pid 55430:tid 55452] [client 85.203.23.208:42293] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-json-ajax-session.php"] [unique_id "aR5sUfPZXaIMEU4pE7t0-gAAANM"]
[Thu Nov 20 09:18:09.654656 2025] [:error] [pid 55340:tid 55351] [client 85.203.23.172:38149] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR5sUfOxD-NeMydTybAIKwAAAAY"]
[Thu Nov 20 09:18:10.661436 2025] [:error] [pid 55430:tid 55439] [client 85.203.23.190:29707] [client 85.203.23.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aR5sUvPZXaIMEU4pE7t0-wAAAMY"]
[Thu Nov 20 09:18:10.926682 2025] [:error] [pid 55343:tid 55403] [client 85.203.23.218:60159] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-conflg.php"] [unique_id "aR5sUlWlO3EnyVMV7w4zHAAAAIQ"]
[Thu Nov 20 09:18:11.256660 2025] [:error] [pid 55340:tid 55368] [client 85.203.23.218:31905] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aR5sU_OxD-NeMydTybAILAAAABc"]
[Thu Nov 20 09:18:11.551241 2025] [:error] [pid 55340:tid 55349] [client 85.203.23.189:49407] [client 85.203.23.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/"] [unique_id "aR5sU_OxD-NeMydTybAILQAAAAQ"]
[Thu Nov 20 09:18:11.818753 2025] [:error] [pid 34405:tid 34412] [client 85.203.23.208:36897] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aR5sUzFpvu8oRK7ATfuk2gAAAQU"]
[Thu Nov 20 09:18:12.005238 2025] [:error] [pid 55340:tid 55362] [client 85.203.23.225:64865] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/archives/"] [unique_id "aR5sVPOxD-NeMydTybAILgAAABE"]
[Thu Nov 20 09:18:12.504292 2025] [:error] [pid 55343:tid 55414] [client 85.203.23.177:61843] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "aR5sVFWlO3EnyVMV7w4zHgAAAI8"]
[Thu Nov 20 09:18:18.182982 2025] [:error] [pid 55340:tid 55348] [client 85.203.23.192:54445] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "aR5sWvOxD-NeMydTybAINwAAAAM"]
[Thu Nov 20 09:18:18.579219 2025] [:error] [pid 55343:tid 55420] [client 85.203.23.199:57357] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "aR5sWlWlO3EnyVMV7w4zIwAAAJU"]
[Thu Nov 20 09:18:18.978241 2025] [:error] [pid 55340:tid 55361] [client 85.203.23.169:28667] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/options.php"] [unique_id "aR5sWvOxD-NeMydTybAIOAAAABA"]
[Thu Nov 20 09:18:21.010385 2025] [:error] [pid 804:tid 843] [client 85.203.23.184:38453] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/about.php"] [unique_id "aR5sXfaRHpUlPL9O0LkVFQAAAZM"]
[Thu Nov 20 09:18:22.837664 2025] [:error] [pid 55430:tid 55446] [client 85.203.23.202:34501] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bypass.php"] [unique_id "aR5sXvPZXaIMEU4pE7t1CwAAAM0"]
[Thu Nov 20 09:18:23.525056 2025] [:error] [pid 55340:tid 55359] [client 85.203.23.181:22571] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/shell/index.php"] [unique_id "aR5sX_OxD-NeMydTybAIOgAAAA4"]
[Thu Nov 20 09:18:23.891151 2025] [:error] [pid 55340:tid 55350] [client 85.203.23.214:35671] [client 85.203.23.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/wp-login.php"] [unique_id "aR5sX_OxD-NeMydTybAIOwAAAAU"]
[Thu Nov 20 09:18:24.807917 2025] [:error] [pid 34444:tid 34446] [client 85.203.23.178:39533] [client 85.203.23.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-wolf.php"] [unique_id "aR5sYFNEol4jlmmA_GPI4QAAAUA"]
[Thu Nov 20 09:18:25.046997 2025] [:error] [pid 55340:tid 55355] [client 85.203.23.220:38537] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-signup.php"] [unique_id "aR5sYfOxD-NeMydTybAIPQAAAAo"]
[Thu Nov 20 09:18:25.267740 2025] [:error] [pid 55340:tid 55348] [client 85.203.23.217:62013] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/index.php"] [unique_id "aR5sYfOxD-NeMydTybAIPgAAAAM"]
[Thu Nov 20 09:18:26.016414 2025] [:error] [pid 34444:tid 34458] [client 85.203.23.169:32963] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aR5sYlNEol4jlmmA_GPI4gAAAUw"]
[Thu Nov 20 09:18:28.180754 2025] [:error] [pid 55343:tid 55418] [client 85.203.23.183:61485] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aR5sZFWlO3EnyVMV7w4zJQAAAJM"]
[Thu Nov 20 09:18:28.546070 2025] [:error] [pid 55340:tid 55364] [client 85.203.23.218:43779] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR5sZPOxD-NeMydTybAIPwAAABM"]
[Thu Nov 20 09:18:28.818325 2025] [:error] [pid 55342:tid 55387] [client 85.203.23.220:24845] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aR5sZLg6x32Tvk7fIG9qWQAAAE8"]
[Thu Nov 20 09:18:34.224719 2025] [:error] [pid 55340:tid 55368] [client 85.203.23.180:20607] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "aR5savOxD-NeMydTybAISQAAABc"]
[Thu Nov 20 09:18:34.819728 2025] [:error] [pid 55343:tid 55416] [client 85.203.23.172:28721] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aR5salWlO3EnyVMV7w4zLAAAAJE"]
[Thu Nov 20 09:18:35.372990 2025] [:error] [pid 55342:tid 55394] [client 85.203.23.223:44437] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/"] [unique_id "aR5sa7g6x32Tvk7fIG9qXgAAAFY"]
[Thu Nov 20 09:18:35.927371 2025] [:error] [pid 55340:tid 55360] [client 85.203.23.219:50027] [client 85.203.23.219] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/packed.php"] [unique_id "aR5sa_OxD-NeMydTybAISwAAAA8"]
[Thu Nov 20 09:18:36.241966 2025] [:error] [pid 55342:tid 55375] [client 85.203.23.172:43303] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/admin.php"] [unique_id "aR5sbLg6x32Tvk7fIG9qXwAAAEM"]
[Thu Nov 20 09:18:36.468413 2025] [:error] [pid 804:tid 845] [client 85.203.23.210:31147] [client 85.203.23.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/"] [unique_id "aR5sbPaRHpUlPL9O0LkVFwAAAZU"]
[Thu Nov 20 09:18:36.663884 2025] [:error] [pid 55340:tid 55350] [client 85.203.23.192:22213] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ini.php"] [unique_id "aR5sbPOxD-NeMydTybAITQAAAAU"]
[Thu Nov 20 09:18:37.514122 2025] [:error] [pid 55340:tid 55353] [client 85.203.23.197:29323] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/worksec.php"] [unique_id "aR5sbfOxD-NeMydTybAITgAAAAg"]
[Thu Nov 20 09:18:38.695835 2025] [:error] [pid 34444:tid 34468] [client 85.203.23.215:43585] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "aR5sblNEol4jlmmA_GPI5AAAAVY"]
[Thu Nov 20 09:18:38.991920 2025] [:error] [pid 34405:tid 34408] [client 85.203.23.217:27819] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/index.php"] [unique_id "aR5sbjFpvu8oRK7ATfuk2wAAAQE"]
[Thu Nov 20 09:18:40.023973 2025] [:error] [pid 34405:tid 34420] [client 85.203.23.217:42349] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-signin.php"] [unique_id "aR5scDFpvu8oRK7ATfuk3AAAAQ0"]
[Thu Nov 20 09:18:40.571851 2025] [:error] [pid 55430:tid 55434] [client 85.203.23.193:60303] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aR5scPPZXaIMEU4pE7t1FAAAAME"]
[Thu Nov 20 09:18:41.006605 2025] [:error] [pid 55342:tid 55372] [client 85.203.23.199:53831] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/login.php"] [unique_id "aR5scbg6x32Tvk7fIG9qYQAAAEA"]
[Thu Nov 20 09:18:41.527217 2025] [:error] [pid 34405:tid 34411] [client 85.203.23.187:41369] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aR5scTFpvu8oRK7ATfuk3gAAAQQ"]
[Thu Nov 20 09:18:41.771815 2025] [:error] [pid 55430:tid 55455] [client 85.203.23.208:20875] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/mah.php"] [unique_id "aR5scfPZXaIMEU4pE7t1FgAAANY"]
[Thu Nov 20 09:18:42.041136 2025] [:error] [pid 55430:tid 55456] [client 85.203.23.205:60615] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/index.php"] [unique_id "aR5scvPZXaIMEU4pE7t1FwAAANc"]
[Thu Nov 20 09:18:42.529739 2025] [:error] [pid 55340:tid 55348] [client 85.203.23.188:20835] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aR5scvOxD-NeMydTybAIUwAAAAM"]
[Thu Nov 20 09:18:42.738125 2025] [:error] [pid 804:tid 807] [client 85.203.23.173:52907] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/block-support.php"] [unique_id "aR5scvaRHpUlPL9O0LkVGgAAAYE"]
[Thu Nov 20 09:18:42.930999 2025] [:error] [pid 55340:tid 55349] [client 85.203.23.192:47359] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aR5scvOxD-NeMydTybAIVQAAAAQ"]
[Thu Nov 20 09:18:43.246775 2025] [:error] [pid 55430:tid 55449] [client 85.203.23.215:21855] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aR5sc_PZXaIMEU4pE7t1GAAAANA"]
[Thu Nov 20 09:18:43.458316 2025] [:error] [pid 55342:tid 55385] [client 85.203.23.171:40857] [client 85.203.23.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "aR5sc7g6x32Tvk7fIG9qYwAAAE0"]
[Thu Nov 20 09:18:43.909285 2025] [:error] [pid 34444:tid 34465] [client 85.203.23.199:22309] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/"] [unique_id "aR5sc1NEol4jlmmA_GPI6QAAAVM"]
[Thu Nov 20 09:18:44.208361 2025] [:error] [pid 55340:tid 55364] [client 85.203.23.169:49155] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "aR5sdPOxD-NeMydTybAIVgAAABM"]
[Thu Nov 20 09:18:44.428502 2025] [:error] [pid 55430:tid 55437] [client 85.203.23.214:53853] [client 85.203.23.214] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/buy.php"] [unique_id "aR5sdPPZXaIMEU4pE7t1GgAAAMQ"]
[Thu Nov 20 09:18:44.645034 2025] [:error] [pid 34405:tid 34429] [client 85.203.23.217:62795] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/f.php"] [unique_id "aR5sdDFpvu8oRK7ATfuk3wAAARY"]
[Thu Nov 20 09:18:44.962809 2025] [:error] [pid 55342:tid 55374] [client 85.203.23.201:60135] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-header.php"] [unique_id "aR5sdLg6x32Tvk7fIG9qZAAAAEI"]
[Thu Nov 20 09:18:45.182493 2025] [:error] [pid 34444:tid 34454] [client 85.203.23.187:31273] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aR5sdVNEol4jlmmA_GPI7AAAAUg"]
[Thu Nov 20 09:18:45.623445 2025] [:error] [pid 55343:tid 55411] [client 85.203.23.209:32099] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfour/"] [unique_id "aR5sdVWlO3EnyVMV7w4zNAAAAIw"]
[Thu Nov 20 09:18:46.329062 2025] [:error] [pid 34444:tid 34446] [client 85.203.23.201:61789] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "aR5sdlNEol4jlmmA_GPI7QAAAUA"]
[Thu Nov 20 09:18:46.621629 2025] [:error] [pid 55343:tid 55404] [client 85.203.23.204:46139] [client 85.203.23.204] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/shell3.php"] [unique_id "aR5sdlWlO3EnyVMV7w4zNwAAAIU"]
[Thu Nov 20 09:18:46.850275 2025] [:error] [pid 55430:tid 55447] [client 85.203.23.166:34979] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/admin.php"] [unique_id "aR5sdvPZXaIMEU4pE7t1HgAAAM4"]
[Thu Nov 20 09:18:47.048993 2025] [:error] [pid 55340:tid 55350] [client 85.203.23.218:32689] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aR5sd_OxD-NeMydTybAIVwAAAAU"]
[Thu Nov 20 09:18:47.905220 2025] [:error] [pid 55343:tid 55423] [client 85.203.23.217:38013] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-conflg/function.php"] [unique_id "aR5sd1WlO3EnyVMV7w4zOgAAAJg"]
[Thu Nov 20 09:18:48.143211 2025] [:error] [pid 34405:tid 34421] [client 85.203.23.197:41875] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/uploaded_script.php"] [unique_id "aR5seDFpvu8oRK7ATfuk4gAAAQ4"]
[Thu Nov 20 09:18:48.492860 2025] [:error] [pid 804:tid 837] [client 85.203.23.214:26225] [client 85.203.23.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aR5sePaRHpUlPL9O0LkVHQAAAY0"]
[Thu Nov 20 09:18:48.886851 2025] [:error] [pid 55340:tid 55355] [client 85.203.23.197:47607] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aR5sePOxD-NeMydTybAIWQAAAAo"]
[Thu Nov 20 09:18:49.230070 2025] [:error] [pid 55342:tid 55393] [client 85.203.23.206:28875] [client 85.203.23.206] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/admin.php"] [unique_id "aR5sebg6x32Tvk7fIG9qZgAAAFU"]
[Thu Nov 20 09:18:50.138728 2025] [:error] [pid 55430:tid 55446] [client 85.203.23.166:55587] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aR5sevPZXaIMEU4pE7t1IAAAAM0"]
[Thu Nov 20 09:18:50.437340 2025] [:error] [pid 55343:tid 55403] [client 85.203.23.218:64381] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aR5selWlO3EnyVMV7w4zPwAAAIQ"]
[Thu Nov 20 09:18:50.628698 2025] [:error] [pid 55430:tid 55453] [client 85.203.23.199:28547] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/news-portal/error.php"] [unique_id "aR5sevPZXaIMEU4pE7t1IQAAANQ"]
[Thu Nov 20 09:18:56.036500 2025] [:error] [pid 55340:tid 55362] [client 85.203.23.183:62169] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aR5sgPOxD-NeMydTybAIYQAAABE"]
[Thu Nov 20 09:18:56.336243 2025] [:error] [pid 34405:tid 34424] [client 85.203.23.180:36347] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentyfive/include.php"] [unique_id "aR5sgDFpvu8oRK7ATfuk5gAAARE"]
[Thu Nov 20 09:18:56.615732 2025] [:error] [pid 55340:tid 55366] [client 85.203.23.193:54561] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/index2.php"] [unique_id "aR5sgPOxD-NeMydTybAIYgAAABU"]
[Thu Nov 20 09:18:57.643120 2025] [:error] [pid 55342:tid 55376] [client 85.203.23.210:25783] [client 85.203.23.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "aR5sgbg6x32Tvk7fIG9qaQAAAEQ"]
[Thu Nov 20 09:18:58.025020 2025] [:error] [pid 55340:tid 55351] [client 85.203.23.224:35003] [client 85.203.23.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/options.php"] [unique_id "aR5sgvOxD-NeMydTybAIZgAAAAY"]
[Thu Nov 20 09:18:58.230370 2025] [:error] [pid 55340:tid 55357] [client 85.203.23.216:48253] [client 85.203.23.216] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/s.php"] [unique_id "aR5sgvOxD-NeMydTybAIZwAAAAw"]
[Thu Nov 20 09:18:58.509575 2025] [:error] [pid 55340:tid 55356] [client 85.203.23.223:62243] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/sunrise/index.php"] [unique_id "aR5sgvOxD-NeMydTybAIaQAAAAs"]
[Thu Nov 20 09:18:58.818707 2025] [:error] [pid 55340:tid 55364] [client 85.203.23.195:45185] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aR5sgvOxD-NeMydTybAIawAAABM"]
[Thu Nov 20 09:18:59.136414 2025] [:error] [pid 55343:tid 55413] [client 85.203.23.170:20085] [client 85.203.23.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/"] [unique_id "aR5sg1WlO3EnyVMV7w4zQgAAAI4"]
[Thu Nov 20 09:18:59.377218 2025] [:error] [pid 804:tid 807] [client 85.203.23.222:60691] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-conf.php"] [unique_id "aR5sg_aRHpUlPL9O0LkVJQAAAYE"]
[Thu Nov 20 09:18:59.637024 2025] [:error] [pid 55340:tid 55350] [client 85.203.23.197:32031] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aR5sg_OxD-NeMydTybAIbQAAAAU"]
[Thu Nov 20 09:18:59.932071 2025] [:error] [pid 55340:tid 55352] [client 85.203.23.210:28483] [client 85.203.23.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp.php"] [unique_id "aR5sg_OxD-NeMydTybAIbgAAAAc"]
[Thu Nov 20 09:19:00.338176 2025] [:error] [pid 55343:tid 55400] [client 85.203.23.221:44519] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aR5shFWlO3EnyVMV7w4zQwAAAIE"]
[Thu Nov 20 09:19:00.617005 2025] [:error] [pid 55343:tid 55422] [client 85.203.23.206:32661] [client 85.203.23.206] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-files.php"] [unique_id "aR5shFWlO3EnyVMV7w4zRAAAAJc"]
[Thu Nov 20 09:19:01.897617 2025] [:error] [pid 34444:tid 34465] [client 85.203.23.197:65259] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/"] [unique_id "aR5shVNEol4jlmmA_GPI9AAAAVM"]
[Thu Nov 20 09:19:02.902145 2025] [:error] [pid 55343:tid 55411] [client 85.203.23.202:49041] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/admin.php"] [unique_id "aR5shlWlO3EnyVMV7w4zSAAAAIw"]
[Thu Nov 20 09:19:04.640599 2025] [:error] [pid 55342:tid 55382] [client 85.203.23.190:49141] [client 85.203.23.190] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aR5siLg6x32Tvk7fIG9qbgAAAEo"]
[Thu Nov 20 09:19:05.011051 2025] [:error] [pid 55342:tid 55381] [client 85.203.23.187:23647] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/db.php"] [unique_id "aR5sibg6x32Tvk7fIG9qbwAAAEk"]
[Thu Nov 20 09:19:05.643073 2025] [:error] [pid 34405:tid 34429] [client 85.203.23.166:53331] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/m.php"] [unique_id "aR5siTFpvu8oRK7ATfuk7AAAARY"]
[Thu Nov 20 09:19:05.880567 2025] [:error] [pid 34444:tid 34466] [client 85.203.23.225:45493] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/chosen.php"] [unique_id "aR5siVNEol4jlmmA_GPI9wAAAVQ"]
[Thu Nov 20 09:19:06.264602 2025] [:error] [pid 55340:tid 55353] [client 85.203.23.209:23735] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aR5sivOxD-NeMydTybAIcAAAAAg"]
[Thu Nov 20 09:19:06.600445 2025] [:error] [pid 55340:tid 55348] [client 85.203.23.177:30335] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bk/index.php"] [unique_id "aR5sivOxD-NeMydTybAIcQAAAAM"]
[Thu Nov 20 09:19:07.128682 2025] [:error] [pid 804:tid 837] [client 85.203.23.224:31059] [client 85.203.23.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/log.php"] [unique_id "aR5si_aRHpUlPL9O0LkVKQAAAY0"]
[Thu Nov 20 09:19:07.537609 2025] [:error] [pid 804:tid 843] [client 85.203.23.200:21151] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/navigation/index.php"] [unique_id "aR5si_aRHpUlPL9O0LkVKwAAAZM"]
[Thu Nov 20 09:19:08.129543 2025] [:error] [pid 804:tid 846] [client 85.203.23.171:62717] [client 85.203.23.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "aR5sjPaRHpUlPL9O0LkVLAAAAZY"]
[Thu Nov 20 09:19:08.939328 2025] [:error] [pid 804:tid 808] [client 85.203.23.211:51621] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/"] [unique_id "aR5sjPaRHpUlPL9O0LkVLwAAAYI"]
[Thu Nov 20 09:19:09.350482 2025] [:error] [pid 804:tid 838] [client 85.203.23.191:30215] [client 85.203.23.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/post.php"] [unique_id "aR5sjfaRHpUlPL9O0LkVMgAAAY4"]
[Thu Nov 20 09:19:09.639337 2025] [:error] [pid 34405:tid 34428] [client 85.203.23.205:62259] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aR5sjTFpvu8oRK7ATfuk7gAAARU"]
[Thu Nov 20 09:19:09.852126 2025] [:error] [pid 55430:tid 55448] [client 85.203.23.168:56219] [client 85.203.23.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/contact.php"] [unique_id "aR5sjfPZXaIMEU4pE7t1JAAAAM8"]
[Thu Nov 20 09:19:10.115858 2025] [:error] [pid 55343:tid 55404] [client 85.203.23.173:39939] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aR5sjlWlO3EnyVMV7w4zSgAAAIU"]
[Thu Nov 20 09:19:10.547299 2025] [:error] [pid 55340:tid 55365] [client 85.203.23.223:59901] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/error.php"] [unique_id "aR5sjvOxD-NeMydTybAIhQAAABQ"]
[Thu Nov 20 09:19:11.058926 2025] [:error] [pid 55340:tid 55348] [client 85.203.23.219:29053] [client 85.203.23.219] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/lib/"] [unique_id "aR5sj_OxD-NeMydTybAIhwAAAAM"]
[Thu Nov 20 09:19:11.425524 2025] [:error] [pid 55430:tid 55446] [client 85.203.23.178:28669] [client 85.203.23.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/"] [unique_id "aR5sj_PZXaIMEU4pE7t1MgAAAM0"]
[Thu Nov 20 09:19:12.056466 2025] [:error] [pid 55343:tid 55423] [client 85.203.23.172:63643] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/"] [unique_id "aR5skFWlO3EnyVMV7w4zTQAAAJg"]
[Thu Nov 20 09:19:12.423661 2025] [:error] [pid 55430:tid 55448] [client 85.203.23.186:61243] [client 85.203.23.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/leafmailer.php"] [unique_id "aR5skPPZXaIMEU4pE7t1OgAAAM8"]
[Thu Nov 20 09:19:12.633508 2025] [:error] [pid 55343:tid 55400] [client 85.203.23.171:53005] [client 85.203.23.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aR5skFWlO3EnyVMV7w4zTgAAAIE"]
[Thu Nov 20 09:19:13.214441 2025] [:error] [pid 55343:tid 55422] [client 85.203.23.204:61659] [client 85.203.23.204] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/search/"] [unique_id "aR5skVWlO3EnyVMV7w4zUAAAAJc"]
[Thu Nov 20 09:19:13.436429 2025] [:error] [pid 55340:tid 55367] [client 85.203.23.169:38905] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/index.php"] [unique_id "aR5skfOxD-NeMydTybAIigAAABY"]
[Thu Nov 20 09:19:14.120312 2025] [:error] [pid 55430:tid 55447] [client 85.203.23.204:30681] [client 85.203.23.204] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/images/index.php"] [unique_id "aR5skvPZXaIMEU4pE7t1PwAAAM4"]
[Thu Nov 20 09:19:14.527239 2025] [:error] [pid 34405:tid 34421] [client 85.203.23.203:30243] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/update/function.php"] [unique_id "aR5skjFpvu8oRK7ATfulAAAAAQ4"]
[Thu Nov 20 09:19:14.838334 2025] [:error] [pid 55340:tid 55351] [client 85.203.23.205:40929] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/assets/"] [unique_id "aR5skvOxD-NeMydTybAIkAAAAAY"]
[Thu Nov 20 09:19:15.511246 2025] [:error] [pid 55340:tid 55348] [client 85.203.23.215:62217] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aR5sk_OxD-NeMydTybAIlAAAAAM"]
[Thu Nov 20 09:19:16.145360 2025] [:error] [pid 55343:tid 55418] [client 85.203.23.189:49541] [client 85.203.23.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aR5slFWlO3EnyVMV7w4zUgAAAJM"]
[Thu Nov 20 09:19:16.666069 2025] [:error] [pid 55340:tid 55364] [client 85.203.23.215:30809] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/upload/"] [unique_id "aR5slPOxD-NeMydTybAIlQAAABM"]
[Thu Nov 20 09:19:17.581353 2025] [:error] [pid 55343:tid 55417] [client 85.203.23.192:64715] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/function/function.php"] [unique_id "aR5slVWlO3EnyVMV7w4zVAAAAJI"]
[Thu Nov 20 09:19:17.813333 2025] [:error] [pid 34405:tid 34409] [client 85.203.23.190:52067] [client 85.203.23.190] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aR5slTFpvu8oRK7ATfulAQAAAQI"]
[Thu Nov 20 09:19:18.179475 2025] [:error] [pid 55340:tid 55367] [client 85.203.23.218:37671] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aR5slvOxD-NeMydTybAIlgAAABY"]
[Thu Nov 20 09:19:18.943211 2025] [:error] [pid 55340:tid 55365] [client 85.203.23.218:49049] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/about.php"] [unique_id "aR5slvOxD-NeMydTybAIoAAAABQ"]
[Thu Nov 20 09:19:19.248682 2025] [:error] [pid 34444:tid 34467] [client 85.203.23.196:34247] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aR5sl1NEol4jlmmA_GPJEwAAAVU"]
[Thu Nov 20 09:19:19.654426 2025] [:error] [pid 55342:tid 55391] [client 85.203.23.201:38905] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aR5sl7g6x32Tvk7fIG9qcQAAAFM"]
[Thu Nov 20 09:19:20.213699 2025] [:error] [pid 55430:tid 55437] [client 85.203.23.219:31237] [client 85.203.23.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/wp-login.php"] [unique_id "aR5smPPZXaIMEU4pE7t1WQAAAMQ"]
[Thu Nov 20 09:19:20.490312 2025] [:error] [pid 55430:tid 55438] [client 85.203.23.203:64617] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aR5smPPZXaIMEU4pE7t1WgAAAMU"]
[Thu Nov 20 09:19:20.952298 2025] [:error] [pid 804:tid 807] [client 85.203.23.172:45969] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aR5smPaRHpUlPL9O0LkVQwAAAYE"]
[Thu Nov 20 09:19:21.331718 2025] [:error] [pid 34444:tid 34470] [client 85.203.23.193:30387] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aR5smVNEol4jlmmA_GPJFAAAAVg"]
[Thu Nov 20 09:19:21.660734 2025] [:error] [pid 804:tid 835] [client 85.203.23.205:30851] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/about.php"] [unique_id "aR5smfaRHpUlPL9O0LkVRQAAAYs"]
[Thu Nov 20 09:19:21.920935 2025] [:error] [pid 55340:tid 55349] [client 85.203.23.224:62705] [client 85.203.23.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/themes/"] [unique_id "aR5smfOxD-NeMydTybAIogAAAAQ"]
[Thu Nov 20 09:19:22.138506 2025] [:error] [pid 55340:tid 55364] [client 85.203.23.199:43519] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aR5smvOxD-NeMydTybAIpAAAABM"]
[Thu Nov 20 09:19:22.512146 2025] [:error] [pid 804:tid 837] [client 85.203.23.225:26603] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/function.php"] [unique_id "aR5smvaRHpUlPL9O0LkVRgAAAY0"]
[Thu Nov 20 09:19:22.727289 2025] [:error] [pid 34444:tid 34456] [client 85.203.23.166:37725] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aR5smlNEol4jlmmA_GPJFgAAAUo"]
[Thu Nov 20 09:19:22.921289 2025] [:error] [pid 55430:tid 55435] [client 85.203.23.197:36461] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/chosen/function.php"] [unique_id "aR5smvPZXaIMEU4pE7t1XQAAAMI"]
[Thu Nov 20 09:19:23.135335 2025] [:error] [pid 55340:tid 55362] [client 85.203.23.178:24821] [client 85.203.23.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aR5sm_OxD-NeMydTybAIpQAAABE"]
[Thu Nov 20 09:19:23.422178 2025] [:error] [pid 55342:tid 55380] [client 85.203.23.183:28829] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aR5sm7g6x32Tvk7fIG9qdgAAAEg"]
[Thu Nov 20 09:19:23.645759 2025] [:error] [pid 804:tid 840] [client 85.203.23.173:29779] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aR5sm_aRHpUlPL9O0LkVRwAAAZA"]
[Thu Nov 20 09:19:24.120863 2025] [:error] [pid 55340:tid 55367] [client 85.203.23.180:47695] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/item.php"] [unique_id "aR5snPOxD-NeMydTybAIpgAAABY"]
[Thu Nov 20 09:19:24.869347 2025] [:error] [pid 55340:tid 55354] [client 85.203.23.193:54303] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/index.php"] [unique_id "aR5snPOxD-NeMydTybAIqAAAAAk"]
[Thu Nov 20 09:19:25.258123 2025] [:error] [pid 34444:tid 34461] [client 85.203.23.169:27465] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/include.php"] [unique_id "aR5snVNEol4jlmmA_GPJHgAAAU8"]
[Thu Nov 20 09:19:25.525905 2025] [:error] [pid 55340:tid 55358] [client 85.203.23.193:61161] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/cgi-bin/user/index.php"] [unique_id "aR5snfOxD-NeMydTybAIqQAAAA0"]
[Thu Nov 20 09:19:26.813292 2025] [:error] [pid 55430:tid 55447] [client 85.203.23.181:42477] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfive/assets/fonts/beiruti/index.php"] [unique_id "aR5snvPZXaIMEU4pE7t1YQAAAM4"]
[Thu Nov 20 09:19:27.049328 2025] [:error] [pid 804:tid 820] [client 85.203.23.171:33361] [client 85.203.23.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/plugins/wp-login.php"] [unique_id "aR5sn_aRHpUlPL9O0LkVSQAAAYQ"]
[Thu Nov 20 09:19:27.444366 2025] [:error] [pid 55343:tid 55403] [client 85.203.23.221:32595] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/config.php"] [unique_id "aR5sn1WlO3EnyVMV7w4zcwAAAIQ"]
[Thu Nov 20 09:19:27.951861 2025] [:error] [pid 55343:tid 55416] [client 85.203.23.184:49709] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aR5sn1WlO3EnyVMV7w4zdQAAAJE"]
[Thu Nov 20 09:19:33.245107 2025] [:error] [pid 804:tid 821] [client 85.203.23.225:44235] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aR5spfaRHpUlPL9O0LkVTgAAAYU"]
[Thu Nov 20 09:19:33.441031 2025] [:error] [pid 804:tid 848] [client 85.203.23.173:28485] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/admin.php"] [unique_id "aR5spfaRHpUlPL9O0LkVTwAAAZg"]
[Thu Nov 20 09:19:34.222251 2025] [:error] [pid 34405:tid 34411] [client 85.203.23.180:61187] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-Owl.php"] [unique_id "aR5spjFpvu8oRK7ATfulBgAAAQQ"]
[Thu Nov 20 09:19:34.466592 2025] [:error] [pid 55342:tid 55393] [client 85.203.23.202:32697] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/plugins/about.php"] [unique_id "aR5sprg6x32Tvk7fIG9qegAAAFU"]
[Thu Nov 20 09:19:34.730013 2025] [:error] [pid 55343:tid 55423] [client 85.203.23.187:56913] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aR5splWlO3EnyVMV7w4zfAAAAJg"]
[Thu Nov 20 09:19:34.954586 2025] [:error] [pid 34444:tid 34463] [client 85.203.23.193:43225] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aR5splNEol4jlmmA_GPJIQAAAVE"]
[Thu Nov 20 09:19:35.232045 2025] [:error] [pid 55342:tid 55391] [client 85.203.23.166:21603] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/"] [unique_id "aR5sp7g6x32Tvk7fIG9qewAAAFM"]
[Thu Nov 20 09:19:35.422357 2025] [:error] [pid 55430:tid 55440] [client 85.203.23.204:45045] [client 85.203.23.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/themes.php"] [unique_id "aR5sp_PZXaIMEU4pE7t1ZgAAAMc"]
[Thu Nov 20 09:19:35.627257 2025] [:error] [pid 34444:tid 34465] [client 85.203.23.188:33955] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "aR5sp1NEol4jlmmA_GPJIgAAAVM"]
[Thu Nov 20 09:19:35.837947 2025] [:error] [pid 34405:tid 34429] [client 85.203.23.195:22181] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "aR5spzFpvu8oRK7ATfulBwAAARY"]
[Thu Nov 20 09:19:36.047265 2025] [:error] [pid 55430:tid 55448] [client 85.203.23.220:37077] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aR5sqPPZXaIMEU4pE7t1ZwAAAM8"]
[Thu Nov 20 09:19:36.636463 2025] [:error] [pid 34444:tid 34452] [client 85.203.23.186:56975] [client 85.203.23.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aR5sqFNEol4jlmmA_GPJJAAAAUY"]
[Thu Nov 20 09:19:36.912415 2025] [:error] [pid 34405:tid 34413] [client 85.203.23.188:25049] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aR5sqDFpvu8oRK7ATfulCQAAAQY"]
[Thu Nov 20 09:19:37.120470 2025] [:error] [pid 55340:tid 55361] [client 85.203.23.200:34837] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/wp-login.php"] [unique_id "aR5sqfOxD-NeMydTybAIrgAAABA"]
[Thu Nov 20 09:19:37.640671 2025] [:error] [pid 34444:tid 34466] [client 85.203.23.217:22299] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wander.php"] [unique_id "aR5sqVNEol4jlmmA_GPJJQAAAVQ"]
[Thu Nov 20 09:19:37.931503 2025] [:error] [pid 34444:tid 34451] [client 85.203.23.183:20215] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/version.php"] [unique_id "aR5sqVNEol4jlmmA_GPJJgAAAUU"]
[Thu Nov 20 09:19:38.174485 2025] [:error] [pid 55430:tid 55433] [client 85.203.23.204:58073] [client 85.203.23.204] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/about.php"] [unique_id "aR5sqvPZXaIMEU4pE7t1aQAAAMA"]
[Thu Nov 20 09:19:38.432293 2025] [:error] [pid 55430:tid 55451] [client 85.203.23.170:37381] [client 85.203.23.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aR5sqvPZXaIMEU4pE7t1agAAANI"]
[Thu Nov 20 09:19:38.630471 2025] [:error] [pid 55430:tid 55445] [client 85.203.23.188:56521] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "aR5sqvPZXaIMEU4pE7t1bAAAAMw"]
[Thu Nov 20 09:19:38.836032 2025] [:error] [pid 55342:tid 55373] [client 85.203.23.205:45867] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/product.php"] [unique_id "aR5sqrg6x32Tvk7fIG9qfAAAAEE"]
[Thu Nov 20 09:19:39.043953 2025] [:error] [pid 34444:tid 34468] [client 85.203.23.218:46221] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/chosen.php"] [unique_id "aR5sq1NEol4jlmmA_GPJJwAAAVY"]
[Thu Nov 20 09:19:39.374644 2025] [:error] [pid 34444:tid 34453] [client 85.203.23.224:46013] [client 85.203.23.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aR5sq1NEol4jlmmA_GPJKAAAAUc"]
[Thu Nov 20 09:19:39.566781 2025] [:error] [pid 34405:tid 34421] [client 85.203.23.181:47441] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/yasnu.php"] [unique_id "aR5sqzFpvu8oRK7ATfulCgAAAQ4"]
[Thu Nov 20 09:19:39.761737 2025] [:error] [pid 55343:tid 55416] [client 85.203.23.205:65417] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/"] [unique_id "aR5sq1WlO3EnyVMV7w4zhwAAAJE"]
[Thu Nov 20 09:19:40.110991 2025] [:error] [pid 34444:tid 34467] [client 85.203.23.200:20793] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/classwithtostring.php"] [unique_id "aR5srFNEol4jlmmA_GPJKQAAAVU"]
[Thu Nov 20 09:19:40.337768 2025] [:error] [pid 34444:tid 34470] [client 85.203.23.218:26359] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/"] [unique_id "aR5srFNEol4jlmmA_GPJKwAAAVg"]
[Thu Nov 20 09:19:40.533046 2025] [:error] [pid 804:tid 842] [client 85.203.23.215:41669] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/pki-validation/index.php"] [unique_id "aR5srPaRHpUlPL9O0LkVUAAAAZI"]
[Thu Nov 20 09:19:40.735209 2025] [:error] [pid 804:tid 817] [client 85.203.23.215:25631] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "aR5srPaRHpUlPL9O0LkVUQAAAYM"]
[Thu Nov 20 09:19:40.936669 2025] [:error] [pid 34405:tid 34409] [client 85.203.23.186:39593] [client 85.203.23.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "aR5srDFpvu8oRK7ATfulDAAAAQI"]
[Thu Nov 20 09:19:41.210044 2025] [:error] [pid 34405:tid 34427] [client 85.203.23.171:35171] [client 85.203.23.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/directionality/index.php"] [unique_id "aR5srTFpvu8oRK7ATfulDQAAARQ"]
[Thu Nov 20 09:19:46.447357 2025] [:error] [pid 55343:tid 55413] [client 85.203.23.208:26427] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/wp.php"] [unique_id "aR5sslWlO3EnyVMV7w4ziwAAAI4"]
[Thu Nov 20 09:19:46.708874 2025] [:error] [pid 804:tid 846] [client 85.203.23.182:43419] [client 85.203.23.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/details/about.php"] [unique_id "aR5ssvaRHpUlPL9O0LkVUwAAAZY"]
[Thu Nov 20 09:19:46.927615 2025] [:error] [pid 55342:tid 55380] [client 85.203.23.197:22457] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aR5ssrg6x32Tvk7fIG9qfgAAAEg"]
[Thu Nov 20 09:19:47.121514 2025] [:error] [pid 34405:tid 34410] [client 85.203.23.173:43261] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aR5sszFpvu8oRK7ATfulEAAAAQM"]
[Thu Nov 20 09:19:47.410242 2025] [:error] [pid 34405:tid 34411] [client 85.203.23.211:57947] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aR5sszFpvu8oRK7ATfulEQAAAQQ"]
[Thu Nov 20 09:19:48.340434 2025] [:error] [pid 34405:tid 34430] [client 85.203.23.203:48391] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/wp-admin.php"] [unique_id "aR5stDFpvu8oRK7ATfulEgAAARc"]
[Thu Nov 20 09:19:48.825040 2025] [:error] [pid 34405:tid 34413] [client 85.203.23.223:50401] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/Contrller.php"] [unique_id "aR5stDFpvu8oRK7ATfulFAAAAQY"]
[Thu Nov 20 09:19:49.048859 2025] [:error] [pid 55343:tid 55422] [client 85.203.23.188:35501] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/about-cong.php"] [unique_id "aR5stVWlO3EnyVMV7w4zjAAAAJc"]
[Thu Nov 20 09:19:49.286368 2025] [:error] [pid 55340:tid 55356] [client 85.203.23.206:36401] [client 85.203.23.206] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/app/connect.php"] [unique_id "aR5stfOxD-NeMydTybAItwAAAAs"]
[Thu Nov 20 09:19:49.535940 2025] [:error] [pid 804:tid 806] [client 85.203.23.168:27245] [client 85.203.23.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/assets/images/selam.php"] [unique_id "aR5stfaRHpUlPL9O0LkVVgAAAYA"]
[Thu Nov 20 09:19:49.735624 2025] [:error] [pid 34405:tid 34421] [client 85.203.23.211:47757] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aR5stTFpvu8oRK7ATfulFgAAAQ4"]
[Thu Nov 20 09:19:49.937254 2025] [:error] [pid 804:tid 838] [client 85.203.23.192:53569] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/gfherhfghre/commentsos/vendoyters/index.php"] [unique_id "aR5stfaRHpUlPL9O0LkVVwAAAY4"]
[Thu Nov 20 09:19:50.210584 2025] [:error] [pid 55343:tid 55418] [client 85.203.23.199:34739] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/images/admin.php"] [unique_id "aR5stlWlO3EnyVMV7w4zjQAAAJM"]
[Thu Nov 20 09:19:50.424365 2025] [:error] [pid 804:tid 848] [client 85.203.23.195:60501] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/images/autoload_classmap.php"] [unique_id "aR5stvaRHpUlPL9O0LkVWAAAAZg"]
[Thu Nov 20 09:19:50.736398 2025] [:error] [pid 55343:tid 55411] [client 85.203.23.183:44257] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/images/chosen.php"] [unique_id "aR5stlWlO3EnyVMV7w4zkAAAAIw"]
[Thu Nov 20 09:19:50.925905 2025] [:error] [pid 55340:tid 55349] [client 85.203.23.187:38891] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/let.php"] [unique_id "aR5stvOxD-NeMydTybAIuAAAAAQ"]
[Thu Nov 20 09:19:51.125375 2025] [:error] [pid 55342:tid 55389] [client 85.203.23.197:50933] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/miansha.php"] [unique_id "aR5st7g6x32Tvk7fIG9qfwAAAFE"]
[Thu Nov 20 09:19:51.332259 2025] [:error] [pid 804:tid 834] [client 85.203.23.199:45567] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/newuser.php"] [unique_id "aR5st_aRHpUlPL9O0LkVWgAAAYo"]
[Thu Nov 20 09:19:51.537214 2025] [:error] [pid 804:tid 835] [client 85.203.23.208:60645] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/sama.php"] [unique_id "aR5st_aRHpUlPL9O0LkVWwAAAYs"]
[Thu Nov 20 09:19:51.732729 2025] [:error] [pid 804:tid 847] [client 85.203.23.184:22043] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/user.php"] [unique_id "aR5st_aRHpUlPL9O0LkVXAAAAZc"]
[Thu Nov 20 09:19:52.017737 2025] [:error] [pid 55343:tid 55409] [client 85.203.23.204:47461] [client 85.203.23.204] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-active.php"] [unique_id "aR5suFWlO3EnyVMV7w4zkwAAAIo"]
[Thu Nov 20 09:19:52.437400 2025] [:error] [pid 55340:tid 55350] [client 85.203.23.192:31511] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/about.php"] [unique_id "aR5suPOxD-NeMydTybAIuQAAAAU"]
[Thu Nov 20 09:19:53.006380 2025] [:error] [pid 55343:tid 55423] [client 85.203.23.185:60265] [client 85.203.23.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/fttri.php"] [unique_id "aR5suVWlO3EnyVMV7w4zmAAAAJg"]
[Thu Nov 20 09:19:53.827908 2025] [:error] [pid 34444:tid 34451] [client 85.203.23.192:64073] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/coffee/coffee/about.php"] [unique_id "aR5suVNEol4jlmmA_GPJMAAAAUU"]
[Thu Nov 20 09:19:54.409998 2025] [:error] [pid 34444:tid 34462] [client 85.203.23.181:47375] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/lock.php"] [unique_id "aR5sulNEol4jlmmA_GPJMgAAAVA"]
[Thu Nov 20 09:19:54.657291 2025] [:error] [pid 34444:tid 34464] [client 85.203.23.211:55571] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/index.php"] [unique_id "aR5sulNEol4jlmmA_GPJMwAAAVI"]
[Thu Nov 20 09:19:54.896620 2025] [:error] [pid 55343:tid 55411] [client 85.203.23.172:58777] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/class-walker-category-checklist-hashing.php"] [unique_id "aR5sulWlO3EnyVMV7w4zoAAAAIw"]
[Thu Nov 20 09:19:55.326500 2025] [:error] [pid 55340:tid 55360] [client 85.203.23.218:49357] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/wp-conflg.php"] [unique_id "aR5su_OxD-NeMydTybAIvQAAAA8"]
[Thu Nov 20 09:19:55.643724 2025] [:error] [pid 55343:tid 55414] [client 85.203.23.169:44371] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/techl.php"] [unique_id "aR5su1WlO3EnyVMV7w4zpgAAAI8"]
[Thu Nov 20 09:19:56.340956 2025] [:error] [pid 55342:tid 55384] [client 85.203.23.205:31515] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/link-manager-first.php"] [unique_id "aR5svLg6x32Tvk7fIG9qhgAAAEw"]
[Thu Nov 20 09:19:56.612599 2025] [:error] [pid 34444:tid 34460] [client 85.203.23.195:43239] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/Noname6.php"] [unique_id "aR5svFNEol4jlmmA_GPJNAAAAU4"]
[Thu Nov 20 09:19:56.844170 2025] [:error] [pid 55343:tid 55404] [client 85.203.23.186:40977] [client 85.203.23.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/autoload_classmap.php"] [unique_id "aR5svFWlO3EnyVMV7w4zpwAAAIU"]
[Thu Nov 20 09:19:57.049040 2025] [:error] [pid 55340:tid 55353] [client 85.203.23.220:61427] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/mlex.php"] [unique_id "aR5svfOxD-NeMydTybAIxAAAAAg"]
[Thu Nov 20 09:19:57.425281 2025] [:error] [pid 55343:tid 55422] [client 85.203.23.210:41249] [client 85.203.23.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/plex1.php"] [unique_id "aR5svVWlO3EnyVMV7w4zqQAAAJc"]
[Thu Nov 20 09:19:57.717899 2025] [:error] [pid 34444:tid 34449] [client 85.203.23.172:47283] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/configYFW/about.php"] [unique_id "aR5svVNEol4jlmmA_GPJPQAAAUM"]
[Thu Nov 20 09:19:58.517984 2025] [:error] [pid 34405:tid 34422] [client 85.203.23.184:23059] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/css.php"] [unique_id "aR5svjFpvu8oRK7ATfulHAAAAQ8"]
[Thu Nov 20 09:19:59.615215 2025] [:error] [pid 34444:tid 34462] [client 85.203.23.182:65521] [client 85.203.23.182] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/m.php"] [unique_id "aR5sv1NEol4jlmmA_GPJQQAAAVA"]
[Thu Nov 20 09:20:00.034634 2025] [:error] [pid 55340:tid 55354] [client 85.203.23.177:59953] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/option.php"] [unique_id "aR5swPOxD-NeMydTybAI0QAAAAk"]
[Thu Nov 20 09:20:00.317410 2025] [:error] [pid 55340:tid 55352] [client 85.203.23.218:47277] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/options-privacy-part.php"] [unique_id "aR5swPOxD-NeMydTybAI0wAAAAc"]
[Thu Nov 20 09:20:00.587225 2025] [:error] [pid 55340:tid 55351] [client 85.203.23.206:46583] [client 85.203.23.206] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/wp-conflg.php"] [unique_id "aR5swPOxD-NeMydTybAI1AAAAAY"]
[Thu Nov 20 09:20:00.932616 2025] [:error] [pid 34405:tid 34418] [client 85.203.23.168:42347] [client 85.203.23.168] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/backuply/s.php"] [unique_id "aR5swDFpvu8oRK7ATfulIAAAAQs"]
[Thu Nov 20 09:20:07.245996 2025] [:error] [pid 55342:tid 55378] [client 85.203.23.187:43217] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/class-json.php"] [unique_id "aR5sx7g6x32Tvk7fIG9qjwAAAEY"]
[Thu Nov 20 09:20:07.535204 2025] [:error] [pid 55430:tid 55447] [client 85.203.23.222:52239] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/"] [unique_id "aR5sx_PZXaIMEU4pE7t1dQAAAM4"]
[Thu Nov 20 09:20:07.758023 2025] [:error] [pid 55430:tid 55454] [client 85.203.23.183:32773] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/plugins/prv8.php"] [unique_id "aR5sx_PZXaIMEU4pE7t1dgAAANU"]
[Thu Nov 20 09:20:08.203049 2025] [:error] [pid 55430:tid 55457] [client 85.203.23.223:30945] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/prv8.php"] [unique_id "aR5syPPZXaIMEU4pE7t1dwAAANg"]
[Thu Nov 20 09:20:10.051637 2025] [:error] [pid 34444:tid 34450] [client 85.203.23.180:64473] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/litespeed/about.php"] [unique_id "aR5sylNEol4jlmmA_GPJRAAAAUQ"]
[Thu Nov 20 09:20:11.428963 2025] [:error] [pid 55343:tid 55410] [client 85.203.23.191:30365] [client 85.203.23.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/ngg/modules/photocrati-nextgen_basic_imagebrowser/static/lock.php"] [unique_id "aR5sy1WlO3EnyVMV7w4zxwAAAIs"]
[Thu Nov 20 09:20:12.343064 2025] [:error] [pid 55343:tid 55415] [client 85.203.23.187:35541] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/all-in-one-wp-migration/lib/vendor/about.php"] [unique_id "aR5szFWlO3EnyVMV7w4zyQAAAJA"]
[Thu Nov 20 09:20:12.833702 2025] [:error] [pid 55340:tid 55351] [client 85.203.23.210:24755] [client 85.203.23.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/amp/src/Editor/about.php"] [unique_id "aR5szPOxD-NeMydTybAI8AAAAAY"]
[Thu Nov 20 09:20:13.697458 2025] [:error] [pid 55340:tid 55362] [client 85.203.23.172:23879] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/autoload_classmap.php"] [unique_id "aR5szfOxD-NeMydTybAI-QAAABE"]
[Thu Nov 20 09:20:14.299495 2025] [:error] [pid 55340:tid 55360] [client 85.203.23.192:33897] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/carousel-slider/templates/loop/classwithtostring.php"] [unique_id "aR5szvOxD-NeMydTybAI_QAAAA8"]
[Thu Nov 20 09:20:14.527421 2025] [:error] [pid 55430:tid 55441] [client 85.203.23.170:27755] [client 85.203.23.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/checkout-for-woocommerce/about.php"] [unique_id "aR5szvPZXaIMEU4pE7t1egAAAMg"]
[Thu Nov 20 09:20:14.778745 2025] [:error] [pid 55430:tid 55455] [client 85.203.23.209:60985] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-forms/abc.php"] [unique_id "aR5szvPZXaIMEU4pE7t1fQAAANY"]
[Thu Nov 20 09:20:14.971557 2025] [:error] [pid 55342:tid 55382] [client 85.203.23.218:22139] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/elementor/core/frontend/render-modes/about.php"] [unique_id "aR5szrg6x32Tvk7fIG9qkAAAAEo"]
[Thu Nov 20 09:20:15.166658 2025] [:error] [pid 55343:tid 55409] [client 85.203.23.186:25539] [client 85.203.23.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/elementor/modules/atomic-widgets/prop-types/transform/lock.php"] [unique_id "aR5sz1WlO3EnyVMV7w4zzAAAAIo"]
[Thu Nov 20 09:20:15.384231 2025] [:error] [pid 34444:tid 34457] [client 85.203.23.183:55241] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/elementor/modules/kit-elements-defaults/import-export-customization/lock.php"] [unique_id "aR5sz1NEol4jlmmA_GPJRwAAAUs"]
[Thu Nov 20 09:20:15.924717 2025] [:error] [pid 804:tid 824] [client 85.203.23.209:60467] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/essential-addons-for-elementor-lite/assets/front-end/css/lib-view/code-snippet/lock.php"] [unique_id "aR5sz_aRHpUlPL9O0LkVcQAAAYg"]
[Thu Nov 20 09:20:16.337919 2025] [:error] [pid 55342:tid 55392] [client 85.203.23.210:47415] [client 85.203.23.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/foter.php"] [unique_id "aR5s0Lg6x32Tvk7fIG9qkQAAAFQ"]
[Thu Nov 20 09:20:16.559372 2025] [:error] [pid 34444:tid 34454] [client 85.203.23.170:38223] [client 85.203.23.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/new.php"] [unique_id "aR5s0FNEol4jlmmA_GPJSQAAAUg"]
[Thu Nov 20 09:20:16.772649 2025] [:error] [pid 55343:tid 55407] [client 85.203.23.192:53617] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/nodeinfo/theme.php"] [unique_id "aR5s0FWlO3EnyVMV7w4zzgAAAIg"]
[Thu Nov 20 09:20:17.146967 2025] [:error] [pid 55340:tid 55348] [client 85.203.23.197:44799] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/nux.php"] [unique_id "aR5s0fOxD-NeMydTybAI_wAAAAM"]
[Thu Nov 20 09:20:17.595092 2025] [:error] [pid 55343:tid 55410] [client 85.203.23.205:29447] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/quadmenu/assets/frontend/icons/fontawesome/css/lock.php"] [unique_id "aR5s0VWlO3EnyVMV7w4z0QAAAIs"]
[Thu Nov 20 09:20:18.853261 2025] [:error] [pid 55430:tid 55444] [client 85.203.23.200:64521] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/quadmenu/redux/ReduxCore/inc/themecheck/checks/lock.php"] [unique_id "aR5s0vPZXaIMEU4pE7t1gAAAAMs"]
[Thu Nov 20 09:20:19.501180 2025] [:error] [pid 55430:tid 55457] [client 85.203.23.182:30041] [client 85.203.23.182] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/really-simple-ssl/lets-encrypt/integrations/admin.php"] [unique_id "aR5s0_PZXaIMEU4pE7t1gwAAANg"]
[Thu Nov 20 09:20:19.988566 2025] [:error] [pid 55343:tid 55406] [client 85.203.23.219:48179] [client 85.203.23.219] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/royal-elementor-addons/modules/theme-builder/post-navigation/widgets/lock.php"] [unique_id "aR5s01WlO3EnyVMV7w4z6QAAAIc"]
[Thu Nov 20 09:20:20.742170 2025] [:error] [pid 55343:tid 55415] [client 85.203.23.182:55451] [client 85.203.23.182] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/toxkssp/index.php"] [unique_id "aR5s1FWlO3EnyVMV7w4z6gAAAJA"]
[Thu Nov 20 09:20:21.408485 2025] [:error] [pid 55343:tid 55400] [client 85.203.23.202:63953] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce-advanced-bulk-edit/about.php"] [unique_id "aR5s1VWlO3EnyVMV7w4z6wAAAIE"]
[Thu Nov 20 09:20:21.716889 2025] [:error] [pid 55343:tid 55416] [client 85.203.23.169:21777] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wophq/index.php"] [unique_id "aR5s1VWlO3EnyVMV7w4z7AAAAJE"]
[Thu Nov 20 09:20:21.986165 2025] [:error] [pid 55340:tid 55351] [client 85.203.23.223:48085] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/src/user-profiles-additions/about.php"] [unique_id "aR5s1fOxD-NeMydTybAJEwAAAAY"]
[Thu Nov 20 09:20:22.324628 2025] [:error] [pid 55430:tid 55435] [client 85.203.23.185:46227] [client 85.203.23.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/src/wrappers/about.php"] [unique_id "aR5s1vPZXaIMEU4pE7t1iwAAAMI"]
[Thu Nov 20 09:20:23.057044 2025] [:error] [pid 55340:tid 55356] [client 85.203.23.195:41107] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-all-import-pro/addon-api/about.php"] [unique_id "aR5s1_OxD-NeMydTybAJFQAAAAs"]
[Thu Nov 20 09:20:24.436904 2025] [:error] [pid 55340:tid 55363] [client 85.203.23.173:40625] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wpvivid-backup-mainwp/vendor/psr/cache/lock.php"] [unique_id "aR5s2POxD-NeMydTybAJGgAAABI"]
[Thu Nov 20 09:20:24.784278 2025] [:error] [pid 55342:tid 55388] [client 85.203.23.211:21059] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/botticelli/content-index.php"] [unique_id "aR5s2Lg6x32Tvk7fIG9qlgAAAFA"]
[Thu Nov 20 09:20:25.007878 2025] [:error] [pid 55340:tid 55360] [client 85.203.23.193:35279] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/chosen.php"] [unique_id "aR5s2fOxD-NeMydTybAJGwAAAA8"]
[Thu Nov 20 09:20:25.196812 2025] [:error] [pid 55343:tid 55404] [client 85.203.23.212:29059] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/edit.php"] [unique_id "aR5s2VWlO3EnyVMV7w4z8gAAAIU"]
[Thu Nov 20 09:20:25.431787 2025] [:error] [pid 34405:tid 34424] [client 85.203.23.216:44429] [client 85.203.23.216] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/flatsome-child/images/about.php"] [unique_id "aR5s2TFpvu8oRK7ATfulOQAAARE"]
[Thu Nov 20 09:20:25.636541 2025] [:error] [pid 55430:tid 55456] [client 85.203.23.169:57823] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/flatsome/inc/builder/shortcodes/commons/lock.php"] [unique_id "aR5s2fPZXaIMEU4pE7t1jAAAANc"]
[Thu Nov 20 09:20:25.835664 2025] [:error] [pid 55342:tid 55376] [client 85.203.23.217:34109] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/flex-multi-business/inc/zBaLeMDx.php"] [unique_id "aR5s2bg6x32Tvk7fIG9qlwAAAEQ"]
[Thu Nov 20 09:20:26.050887 2025] [:error] [pid 55430:tid 55442] [client 85.203.23.166:46489] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/intime/assets/index.php"] [unique_id "aR5s2vPZXaIMEU4pE7t1jQAAAMk"]
[Thu Nov 20 09:20:26.261795 2025] [:error] [pid 804:tid 848] [client 85.203.23.223:42091] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/libero/autoload_classmap.php"] [unique_id "aR5s2vaRHpUlPL9O0LkVgQAAAZg"]
[Thu Nov 20 09:20:26.542431 2025] [:error] [pid 34444:tid 34448] [client 85.203.23.206:51499] [client 85.203.23.206] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/maxwin88/inc/metabox/extend-metabox/lock.php"] [unique_id "aR5s2lNEol4jlmmA_GPJfQAAAUI"]
[Thu Nov 20 09:20:26.830192 2025] [:error] [pid 55430:tid 55450] [client 85.203.23.217:48173] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/popularfx/template-parts/index.php"] [unique_id "aR5s2vPZXaIMEU4pE7t1jwAAANE"]
[Thu Nov 20 09:20:27.024077 2025] [:error] [pid 804:tid 834] [client 85.203.23.195:59513] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/rockwell/content-index.php"] [unique_id "aR5s2_aRHpUlPL9O0LkVggAAAYo"]
[Thu Nov 20 09:20:27.228622 2025] [:error] [pid 55340:tid 55348] [client 85.203.23.188:31305] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/rubens-child/content-index.php"] [unique_id "aR5s2_OxD-NeMydTybAJHAAAAAM"]
[Thu Nov 20 09:20:27.446043 2025] [:error] [pid 34405:tid 34422] [client 85.203.23.173:29977] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/ryan/admin/main/inc/callbacks/sanitize_callback/select_faicons/lock.php"] [unique_id "aR5s2zFpvu8oRK7ATfulOgAAAQ8"]
[Thu Nov 20 09:20:27.635730 2025] [:error] [pid 55430:tid 55439] [client 85.203.23.181:34027] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/siara-corporate-business/template-parts/header/styles/lock.php"] [unique_id "aR5s2_PZXaIMEU4pE7t1kAAAAMY"]
[Thu Nov 20 09:20:27.911066 2025] [:error] [pid 55430:tid 55438] [client 85.203.23.185:25623] [client 85.203.23.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/theme-check/new.php"] [unique_id "aR5s2_PZXaIMEU4pE7t1kgAAAMU"]
[Thu Nov 20 09:20:28.128257 2025] [:error] [pid 55430:tid 55446] [client 85.203.23.217:47981] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfive/assets/css/a.php"] [unique_id "aR5s3PPZXaIMEU4pE7t1kwAAAM0"]
[Thu Nov 20 09:20:28.320741 2025] [:error] [pid 55342:tid 55387] [client 85.203.23.172:33079] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyone/assets/sass/05-blocks/latest-comments/poisontalk.php"] [unique_id "aR5s3Lg6x32Tvk7fIG9qnQAAAE8"]
[Thu Nov 20 09:20:28.535352 2025] [:error] [pid 34405:tid 34418] [client 85.203.23.184:24047] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentythree/assets/about.php"] [unique_id "aR5s3DFpvu8oRK7ATfulPgAAAQs"]
[Thu Nov 20 09:20:29.878709 2025] [:error] [pid 55343:tid 55405] [client 85.203.23.189:31223] [client 85.203.23.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentythree/index.php"] [unique_id "aR5s3VWlO3EnyVMV7w4z9AAAAIY"]
[Thu Nov 20 09:20:30.063081 2025] [:error] [pid 55430:tid 55449] [client 85.203.23.181:24989] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/assets/index.php"] [unique_id "aR5s3vPZXaIMEU4pE7t1lwAAANA"]
[Thu Nov 20 09:20:30.292272 2025] [:error] [pid 34444:tid 34469] [client 85.203.23.215:50581] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/acxx.php"] [unique_id "aR5s3lNEol4jlmmA_GPJfwAAAVc"]
[Thu Nov 20 09:20:30.524378 2025] [:error] [pid 55342:tid 55382] [client 85.203.23.208:58805] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/mlex.php"] [unique_id "aR5s3rg6x32Tvk7fIG9qnwAAAEo"]
[Thu Nov 20 09:20:30.753634 2025] [:error] [pid 804:tid 807] [client 85.203.23.223:20161] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/plex1.php"] [unique_id "aR5s3vaRHpUlPL9O0LkVhAAAAYE"]
[Thu Nov 20 09:20:31.062652 2025] [:error] [pid 804:tid 840] [client 85.203.23.202:47423] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-contentar458/themes/ingenioso/front-page/index.php"] [unique_id "aR5s3_aRHpUlPL9O0LkVhgAAAZA"]
[Thu Nov 20 09:20:31.429264 2025] [:error] [pid 55343:tid 55416] [client 85.203.23.177:58639] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-cron-backup.php"] [unique_id "aR5s31WlO3EnyVMV7w4z9gAAAJE"]
[Thu Nov 20 09:20:31.692140 2025] [:error] [pid 55342:tid 55384] [client 85.203.23.212:54081] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-erros.php"] [unique_id "aR5s37g6x32Tvk7fIG9qoQAAAEw"]
[Thu Nov 20 09:20:32.060780 2025] [:error] [pid 55342:tid 55375] [client 85.203.23.187:46361] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aR5s4Lg6x32Tvk7fIG9qogAAAEM"]
[Thu Nov 20 09:20:32.327183 2025] [:error] [pid 55342:tid 55381] [client 85.203.23.173:56821] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aR5s4Lg6x32Tvk7fIG9qpAAAAEk"]
[Thu Nov 20 09:20:32.633096 2025] [:error] [pid 55343:tid 55414] [client 85.203.23.215:32151] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Exception/about.php"] [unique_id "aR5s4FWlO3EnyVMV7w4z-AAAAI8"]
[Thu Nov 20 09:20:32.839885 2025] [:error] [pid 55430:tid 55456] [client 85.203.23.181:32773] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/lock.php"] [unique_id "aR5s4PPZXaIMEU4pE7t1mAAAANc"]
[Thu Nov 20 09:20:34.545969 2025] [:error] [pid 55340:tid 55356] [client 85.203.23.222:27609] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/library/SimplePie/Net/index.php"] [unique_id "aR5s4vOxD-NeMydTybAJHQAAAAs"]
[Thu Nov 20 09:20:34.780653 2025] [:error] [pid 55342:tid 55387] [client 85.203.23.221:28147] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aR5s4rg6x32Tvk7fIG9qqAAAAE8"]
[Thu Nov 20 09:20:35.352937 2025] [:error] [pid 804:tid 833] [client 85.203.23.189:36009] [client 85.203.23.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aR5s4_aRHpUlPL9O0LkVhwAAAYk"]
[Thu Nov 20 09:20:35.825119 2025] [:error] [pid 55342:tid 55374] [client 85.203.23.182:20239] [client 85.203.23.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/chosen.php"] [unique_id "aR5s47g6x32Tvk7fIG9qqwAAAEI"]
[Thu Nov 20 09:20:36.239051 2025] [:error] [pid 55342:tid 55391] [client 85.203.23.205:56559] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/connects.php"] [unique_id "aR5s5Lg6x32Tvk7fIG9qrQAAAFM"]
[Thu Nov 20 09:20:36.444238 2025] [:error] [pid 34405:tid 34425] [client 85.203.23.168:41629] [client 85.203.23.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/v.php"] [unique_id "aR5s5DFpvu8oRK7ATfulQwAAARI"]
[Thu Nov 20 09:20:36.643147 2025] [:error] [pid 34444:tid 34465] [client 85.203.23.224:47679] [client 85.203.23.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/chosen.php"] [unique_id "aR5s5FNEol4jlmmA_GPJggAAAVM"]
[Thu Nov 20 09:20:36.830492 2025] [:error] [pid 804:tid 822] [client 85.203.23.199:51723] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/code/"] [unique_id "aR5s5PaRHpUlPL9O0LkViAAAAYY"]
[Thu Nov 20 09:20:37.077656 2025] [:error] [pid 34405:tid 34414] [client 85.203.23.217:26161] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/column/index.php"] [unique_id "aR5s5TFpvu8oRK7ATfulRAAAAQc"]
[Thu Nov 20 09:20:37.273240 2025] [:error] [pid 804:tid 806] [client 85.203.23.192:40505] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comment-content/about.php"] [unique_id "aR5s5faRHpUlPL9O0LkViQAAAYA"]
[Thu Nov 20 09:20:37.815382 2025] [:error] [pid 55343:tid 55420] [client 85.203.23.188:38481] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/details/wp-wlx.php"] [unique_id "aR5s5VWlO3EnyVMV7w4z_gAAAJU"]
[Thu Nov 20 09:20:38.032948 2025] [:error] [pid 55343:tid 55406] [client 85.203.23.181:53439] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/file/index.php"] [unique_id "aR5s5lWlO3EnyVMV7w4z_wAAAIc"]
[Thu Nov 20 09:20:38.340017 2025] [:error] [pid 34444:tid 34450] [client 85.203.23.166:36195] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/group/index.php"] [unique_id "aR5s5lNEol4jlmmA_GPJgwAAAUQ"]
[Thu Nov 20 09:20:38.548517 2025] [:error] [pid 55343:tid 55400] [client 85.203.23.212:21085] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "aR5s5lWlO3EnyVMV7w40AQAAAIE"]
[Thu Nov 20 09:20:38.770151 2025] [:error] [pid 804:tid 821] [client 85.203.23.180:59989] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/media-text-double.php"] [unique_id "aR5s5vaRHpUlPL9O0LkViwAAAYU"]
[Thu Nov 20 09:20:38.968752 2025] [:error] [pid 55343:tid 55414] [client 85.203.23.212:53671] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/media-text/about.php"] [unique_id "aR5s5lWlO3EnyVMV7w40AgAAAI8"]
[Thu Nov 20 09:20:39.223581 2025] [:error] [pid 804:tid 808] [client 85.203.23.169:20447] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/missing/index.php"] [unique_id "aR5s5_aRHpUlPL9O0LkVjAAAAYI"]
[Thu Nov 20 09:20:39.558281 2025] [:error] [pid 34444:tid 34468] [client 85.203.23.188:55725] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/page-list-item/"] [unique_id "aR5s51NEol4jlmmA_GPJhAAAAVY"]
[Thu Nov 20 09:20:39.840767 2025] [:error] [pid 55340:tid 55366] [client 85.203.23.182:52679] [client 85.203.23.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-comments-form/index.php"] [unique_id "aR5s5_OxD-NeMydTybAJIAAAABU"]
[Thu Nov 20 09:20:40.040785 2025] [:error] [pid 804:tid 845] [client 85.203.23.180:56225] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-excerpt/index.php"] [unique_id "aR5s6PaRHpUlPL9O0LkVjwAAAZU"]
[Thu Nov 20 09:20:40.227423 2025] [:error] [pid 34405:tid 34412] [client 85.203.23.170:30937] [client 85.203.23.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-navigation-link/admin.php"] [unique_id "aR5s6DFpvu8oRK7ATfulRgAAAQU"]
[Thu Nov 20 09:20:40.416303 2025] [:error] [pid 55343:tid 55409] [client 85.203.23.177:33455] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-terms/"] [unique_id "aR5s6FWlO3EnyVMV7w40BAAAAIo"]
[Thu Nov 20 09:20:40.671246 2025] [:error] [pid 34405:tid 34420] [client 85.203.23.196:22521] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/pullquote/"] [unique_id "aR5s6DFpvu8oRK7ATfulRwAAAQ0"]
[Thu Nov 20 09:20:41.024016 2025] [:error] [pid 34444:tid 34453] [client 85.203.23.185:62825] [client 85.203.23.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/query-pagination-previous/about.php"] [unique_id "aR5s6VNEol4jlmmA_GPJhgAAAUc"]
[Thu Nov 20 09:20:41.331008 2025] [:error] [pid 55340:tid 55364] [client 85.203.23.203:46913] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/shortcode/index.php"] [unique_id "aR5s6fOxD-NeMydTybAJIQAAABM"]
[Thu Nov 20 09:20:41.750896 2025] [:error] [pid 804:tid 817] [client 85.203.23.211:34477] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/site-logo/about.php"] [unique_id "aR5s6faRHpUlPL9O0LkVkQAAAYM"]
[Thu Nov 20 09:20:41.941197 2025] [:error] [pid 55343:tid 55401] [client 85.203.23.189:24439] [client 85.203.23.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/site-tagline/"] [unique_id "aR5s6VWlO3EnyVMV7w40BgAAAII"]
[Thu Nov 20 09:20:42.145703 2025] [:error] [pid 804:tid 842] [client 85.203.23.197:48317] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/social-links/"] [unique_id "aR5s6vaRHpUlPL9O0LkVkwAAAZI"]
[Thu Nov 20 09:20:42.331045 2025] [:error] [pid 55343:tid 55404] [client 85.203.23.169:52631] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/spacer/about.php"] [unique_id "aR5s6lWlO3EnyVMV7w40CAAAAIU"]
[Thu Nov 20 09:20:42.519111 2025] [:error] [pid 34444:tid 34462] [client 85.203.23.184:23315] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/index.php"] [unique_id "aR5s6lNEol4jlmmA_GPJhwAAAVA"]
[Thu Nov 20 09:20:42.729959 2025] [:error] [pid 34405:tid 34429] [client 85.203.23.188:20423] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/tag-cloud/about.php"] [unique_id "aR5s6jFpvu8oRK7ATfulTAAAARY"]
[Thu Nov 20 09:20:42.927619 2025] [:error] [pid 34444:tid 34455] [client 85.203.23.190:54905] [client 85.203.23.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/verse/about.php"] [unique_id "aR5s6lNEol4jlmmA_GPJiQAAAUk"]
[Thu Nov 20 09:20:43.414256 2025] [:error] [pid 55343:tid 55410] [client 85.203.23.169:47453] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/video/hexa.php"] [unique_id "aR5s61WlO3EnyVMV7w40CQAAAIs"]
[Thu Nov 20 09:20:43.612536 2025] [:error] [pid 34444:tid 34469] [client 85.203.23.212:37569] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/plugin.php"] [unique_id "aR5s61NEol4jlmmA_GPJjAAAAVc"]
[Thu Nov 20 09:20:43.847122 2025] [:error] [pid 34444:tid 34458] [client 85.203.23.196:20065] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-image-editor-gd-pic.php"] [unique_id "aR5s61NEol4jlmmA_GPJjQAAAUw"]
[Thu Nov 20 09:20:44.044639 2025] [:error] [pid 34444:tid 34459] [client 85.203.23.172:39931] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aR5s7FNEol4jlmmA_GPJjgAAAU0"]
[Thu Nov 20 09:20:44.307451 2025] [:error] [pid 34444:tid 34447] [client 85.203.23.193:52875] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "aR5s7FNEol4jlmmA_GPJjwAAAUE"]
[Thu Nov 20 09:20:44.522845 2025] [:error] [pid 34444:tid 34450] [client 85.203.23.182:48917] [client 85.203.23.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/commands/about.php"] [unique_id "aR5s7FNEol4jlmmA_GPJkAAAAUQ"]
[Thu Nov 20 09:20:44.736344 2025] [:error] [pid 804:tid 822] [client 85.203.23.221:59889] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-site/about.php"] [unique_id "aR5s7PaRHpUlPL9O0LkVlAAAAYY"]
[Thu Nov 20 09:20:45.527479 2025] [:error] [pid 55342:tid 55372] [client 85.203.23.182:57627] [client 85.203.23.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/index.php"] [unique_id "aR5s7bg6x32Tvk7fIG9qsAAAAEA"]
[Thu Nov 20 09:20:46.322613 2025] [:error] [pid 55343:tid 55415] [client 85.203.23.218:21345] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/list-reusable-blocks/index.php"] [unique_id "aR5s7lWlO3EnyVMV7w40DQAAAJA"]
[Thu Nov 20 09:20:46.625187 2025] [:error] [pid 804:tid 823] [client 85.203.23.211:43423] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/wp-conflg.php"] [unique_id "aR5s7vaRHpUlPL9O0LkVlQAAAYc"]
[Thu Nov 20 09:20:46.818117 2025] [:error] [pid 804:tid 848] [client 85.203.23.209:24833] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/autoload_classmap.php"] [unique_id "aR5s7vaRHpUlPL9O0LkVlgAAAZg"]
[Thu Nov 20 09:20:47.135131 2025] [:error] [pid 55343:tid 55414] [client 85.203.23.170:25543] [client 85.203.23.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aR5s71WlO3EnyVMV7w40DgAAAI8"]
[Thu Nov 20 09:20:47.446632 2025] [:error] [pid 55343:tid 55412] [client 85.203.23.219:59325] [client 85.203.23.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "aR5s71WlO3EnyVMV7w40EAAAAI0"]
[Thu Nov 20 09:20:47.823862 2025] [:error] [pid 55430:tid 55434] [client 85.203.23.209:57487] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/option.php"] [unique_id "aR5s7_PZXaIMEU4pE7t1nAAAAME"]
[Thu Nov 20 09:20:48.840602 2025] [:error] [pid 55343:tid 55403] [client 85.203.23.197:60911] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aR5s8FWlO3EnyVMV7w40EgAAAIQ"]
[Thu Nov 20 09:20:49.971702 2025] [:error] [pid 34405:tid 34427] [client 85.203.23.203:59947] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/wrvpmsi/about.php"] [unique_id "aR5s8TFpvu8oRK7ATfulTgAAARQ"]
[Thu Nov 20 09:20:50.373160 2025] [:error] [pid 55343:tid 55418] [client 85.203.23.195:30249] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aR5s8lWlO3EnyVMV7w40FgAAAJM"]
[Thu Nov 20 09:20:51.013131 2025] [:error] [pid 55430:tid 55441] [client 85.203.23.215:20413] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aR5s8_PZXaIMEU4pE7t1ngAAAMg"]
[Thu Nov 20 09:20:51.531392 2025] [:error] [pid 55430:tid 55440] [client 85.203.23.183:52473] [client 85.203.23.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/interactivity-api/autoload_classmap.php"] [unique_id "aR5s8_PZXaIMEU4pE7t1nwAAAMc"]
[Thu Nov 20 09:20:51.956723 2025] [:error] [pid 55340:tid 55365] [client 85.203.23.192:31553] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/autoload_classmap.php"] [unique_id "aR5s8_OxD-NeMydTybAJJQAAABQ"]
[Thu Nov 20 09:20:52.312399 2025] [:error] [pid 55430:tid 55455] [client 85.203.23.197:55679] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/about.php"] [unique_id "aR5s9PPZXaIMEU4pE7t1oQAAANY"]
[Thu Nov 20 09:20:52.723316 2025] [:error] [pid 55430:tid 55444] [client 85.203.23.172:24019] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/development/"] [unique_id "aR5s9PPZXaIMEU4pE7t1owAAAMs"]
[Thu Nov 20 09:20:53.026033 2025] [:error] [pid 55430:tid 55452] [client 85.203.23.193:35425] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/script-modules/block-library/query/index.php"] [unique_id "aR5s9fPZXaIMEU4pE7t1pAAAANM"]
[Thu Nov 20 09:20:53.250454 2025] [:error] [pid 55342:tid 55392] [client 85.203.23.219:26925] [client 85.203.23.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/imgareaselect/index.php"] [unique_id "aR5s9bg6x32Tvk7fIG9qtQAAAFQ"]
[Thu Nov 20 09:20:53.629520 2025] [:error] [pid 55340:tid 55346] [client 85.203.23.180:29045] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aR5s9fOxD-NeMydTybAJJgAAAAE"]
[Thu Nov 20 09:20:53.922189 2025] [:error] [pid 804:tid 817] [client 85.203.23.185:40027] [client 85.203.23.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/mediaelement/admin.php"] [unique_id "aR5s9faRHpUlPL9O0LkVnAAAAYM"]
[Thu Nov 20 09:20:54.213450 2025] [:error] [pid 55340:tid 55352] [client 85.203.23.216:51049] [client 85.203.23.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/mediaelement/renderers/about.php"] [unique_id "aR5s9vOxD-NeMydTybAJJwAAAAc"]
[Thu Nov 20 09:20:59.518891 2025] [:error] [pid 34444:tid 34450] [client 85.203.23.211:53913] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/chosen.php"] [unique_id "aR5s-1NEol4jlmmA_GPJmAAAAUQ"]
[Thu Nov 20 09:20:59.941682 2025] [:error] [pid 55340:tid 55348] [client 85.203.23.191:38119] [client 85.203.23.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/link-template-variable.php"] [unique_id "aR5s-_OxD-NeMydTybAJMgAAAAM"]
[Thu Nov 20 09:21:00.125175 2025] [:error] [pid 55342:tid 55388] [client 85.203.23.210:25393] [client 85.203.23.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/php-compat/wp-conflg.php"] [unique_id "aR5s_Lg6x32Tvk7fIG9qugAAAFA"]
[Thu Nov 20 09:21:00.532562 2025] [:error] [pid 55430:tid 55439] [client 85.203.23.222:49913] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aR5s_PPZXaIMEU4pE7t1qwAAAMY"]
[Thu Nov 20 09:21:00.927917 2025] [:error] [pid 55343:tid 55412] [client 85.203.23.184:46629] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aR5s_FWlO3EnyVMV7w40GwAAAI0"]
[Thu Nov 20 09:21:01.218673 2025] [:error] [pid 55342:tid 55373] [client 85.203.23.225:58811] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/wp-conflg.php"] [unique_id "aR5s_bg6x32Tvk7fIG9qvQAAAEE"]
[Thu Nov 20 09:21:01.472562 2025] [:error] [pid 55343:tid 55411] [client 85.203.23.190:46761] [client 85.203.23.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aR5s_VWlO3EnyVMV7w40HAAAAIw"]
[Thu Nov 20 09:21:01.765314 2025] [:error] [pid 34444:tid 34467] [client 85.203.23.200:58457] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/alfa.php"] [unique_id "aR5s_VNEol4jlmmA_GPJmgAAAVU"]
[Thu Nov 20 09:21:02.601494 2025] [:error] [pid 34444:tid 34470] [client 85.203.23.206:51297] [client 85.203.23.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aR5s_lNEol4jlmmA_GPJmwAAAVg"]
[Thu Nov 20 09:21:03.240659 2025] [:error] [pid 34405:tid 34407] [client 85.203.23.216:40403] [client 85.203.23.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-login.php"] [unique_id "aR5s_zFpvu8oRK7ATfulTwAAAQA"]
[Thu Nov 20 09:21:03.632136 2025] [:error] [pid 55343:tid 55418] [client 85.203.23.212:34419] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xax.php"] [unique_id "aR5s_1WlO3EnyVMV7w40HwAAAJM"]
[Thu Nov 20 09:21:03.865239 2025] [:error] [pid 804:tid 837] [client 85.203.23.218:48919] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xax.php"] [unique_id "aR5s__aRHpUlPL9O0LkVnwAAAY0"]
[Thu Nov 20 12:10:22.536464 2025] [:error] [pid 55343:tid 55409] [client 98.81.111.26:56614] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aR6UrlWlO3EnyVMV7w5lJgAAAIo"]
[Thu Nov 20 12:10:22.946516 2025] [:error] [pid 34405:tid 34431] [client 98.81.111.26:53945] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aR6UrjFpvu8oRK7ATfvJTQAAARg"]
[Thu Nov 20 12:10:23.353543 2025] [:error] [pid 55430:tid 55452] [client 98.81.111.26:60460] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aR6Ur_PZXaIMEU4pE7ug-QAAANM"]
[Thu Nov 20 12:10:23.829593 2025] [:error] [pid 55430:tid 55451] [client 98.81.111.26:55064] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aR6Ur_PZXaIMEU4pE7uhHgAAANI"]
[Thu Nov 20 12:10:24.242569 2025] [:error] [pid 55430:tid 55449] [client 98.81.111.26:56362] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aR6UsPPZXaIMEU4pE7uhSgAAANA"]
[Thu Nov 20 12:15:52.523502 2025] [:error] [pid 34405:tid 34419] [client 98.81.111.26:62860] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aR6V-DFpvu8oRK7ATfvNJgAAAQw"]
[Thu Nov 20 12:15:52.930694 2025] [:error] [pid 804:tid 847] [client 98.81.111.26:65051] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aR6V-PaRHpUlPL9O0Lk5TQAAAZc"]
[Thu Nov 20 12:15:53.342099 2025] [:error] [pid 55343:tid 55412] [client 98.81.111.26:50761] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aR6V-VWlO3EnyVMV7w5o1gAAAI0"]
[Thu Nov 20 12:15:53.752393 2025] [:error] [pid 55340:tid 55364] [client 98.81.111.26:52640] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aR6V-fOxD-NeMydTybBNkwAAABM"]
[Thu Nov 20 12:15:54.158627 2025] [:error] [pid 804:tid 833] [client 98.81.111.26:55294] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aR6V-vaRHpUlPL9O0Lk5YgAAAYk"]
[Thu Nov 20 14:37:16.651063 2025] [:error] [pid 55340:tid 55362] [client 182.42.105.144:57419] [client 182.42.105.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aR63HPOxD-NeMydTybB0BQAAABE"]
[Thu Nov 20 16:56:06.725360 2025] [:error] [pid 40508:tid 40522] [client 106.51.173.214:2518] [client 106.51.173.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.51.173.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR7XpqxXNVCMW_ksxPuAkgAAAow"]
[Thu Nov 20 16:56:08.207006 2025] [:error] [pid 55342:tid 55395] [client 49.207.62.217:5920] [client 49.207.62.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.207.62.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR7XqLg6x32Tvk7fIG_FswAAAFc"]
[Thu Nov 20 17:26:38.589757 2025] [:error] [pid 40445:tid 40495] [client 49.207.62.217:6622] [client 49.207.62.217] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aR7ezlH-MuFcoWRjXpZANwAAAlQ"]
[Thu Nov 20 17:28:39.905868 2025] [:error] [pid 55430:tid 55457] [client 49.207.62.217:5535] [client 49.207.62.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.207.62.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR7fR_PZXaIMEU4pE7vw6wAAANg"]
[Thu Nov 20 17:30:17.702213 2025] [:error] [pid 40445:tid 40495] [client 49.207.62.217:6268] [client 49.207.62.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.207.62.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR7fqVH-MuFcoWRjXpZBGgAAAlQ"]
[Thu Nov 20 17:31:47.934543 2025] [:error] [pid 40508:tid 40528] [client 49.207.62.217:5662] [client 49.207.62.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.207.62.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR7gA6xXNVCMW_ksxPuNYAAAApI"]
[Thu Nov 20 17:33:23.284282 2025] [:error] [pid 40415:tid 40421] [client 49.207.62.217:6313] [client 49.207.62.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.207.62.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR7gY6hjIyLSv09svwOVnwAAAcM"]
[Thu Nov 20 17:47:54.227245 2025] [:error] [pid 40636:tid 40645] [client 216.73.216.87:53045] [client 216.73.216.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.73.216.87, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR7jygK8BWUoW3xq0HABbAAAA4U"]
[Thu Nov 20 18:07:07.219633 2025] [:error] [pid 40415:tid 40423] [client 49.51.204.74:40086] [client 49.51.204.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aR7oS6hjIyLSv09svwOcfgAAAcU"]
[Thu Nov 20 18:18:53.408562 2025] [:error] [pid 55340:tid 55359] [client 154.118.186.3:20264] [client 154.118.186.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.118.186.3, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR7rDfOxD-NeMydTybCXOQAAAA4"]
[Thu Nov 20 18:18:57.210110 2025] [:error] [pid 55340:tid 55355] [client 154.118.186.3:20384] [client 154.118.186.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.118.186.3, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR7rEfOxD-NeMydTybCXPQAAAAo"]
[Thu Nov 20 20:17:21.737175 2025] [:error] [pid 55342:tid 55387] [client 40.123.44.162:5376] [client 40.123.44.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.123.44.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR8G0bg6x32Tvk7fIG_xFwAAAE8"], referer: https://duckduckgo.com/
[Thu Nov 20 20:17:59.595633 2025] [autoindex:error] [pid 40415:tid 40440] [client 40.123.44.162:7327] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Thu Nov 20 20:18:01.195034 2025] [autoindex:error] [pid 40415:tid 40425] [client 40.123.44.162:7327] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Thu Nov 20 20:18:02.634934 2025] [autoindex:error] [pid 40415:tid 40418] [client 40.123.44.162:7327] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Thu Nov 20 20:18:04.661497 2025] [autoindex:error] [pid 40415:tid 40420] [client 40.123.44.162:7327] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Thu Nov 20 20:18:08.378086 2025] [:error] [pid 40415:tid 40427] [client 40.123.44.162:7327] [client 40.123.44.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 40.123.44.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR8HAKhjIyLSv09svwO9BQAAAck"], referer: https://www.google.fr/
[Thu Nov 20 20:18:14.261735 2025] [:error] [pid 40415:tid 40438] [client 40.123.44.162:7327] [client 40.123.44.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aR8HBqhjIyLSv09svwO9DwAAAdQ"], referer: https://www.google.com/
[Thu Nov 20 20:18:26.983757 2025] [:error] [pid 40445:tid 40492] [client 40.123.44.162:2659] [client 40.123.44.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.123.44.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR8HElH-MuFcoWRjXpZ3BQAAAlE"], referer: https://www.yahoo.com/
[Thu Nov 20 20:18:27.809385 2025] [:error] [pid 40445:tid 40478] [client 40.123.44.162:4570] [client 40.123.44.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aR8HE1H-MuFcoWRjXpZ3BgAAAkM"], referer: https://duckduckgo.com/
[Thu Nov 20 20:18:32.585034 2025] [autoindex:error] [pid 40415:tid 40435] [client 40.123.44.162:2651] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Thu Nov 20 20:18:34.164598 2025] [autoindex:error] [pid 40415:tid 40434] [client 40.123.44.162:2651] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Thu Nov 20 20:18:34.375299 2025] [autoindex:error] [pid 40415:tid 40418] [client 40.123.44.162:2651] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Thu Nov 20 20:18:39.132174 2025] [autoindex:error] [pid 40415:tid 40419] [client 40.123.44.162:2651] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Thu Nov 20 20:18:39.347779 2025] [autoindex:error] [pid 40415:tid 40442] [client 40.123.44.162:2651] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Thu Nov 20 20:18:39.555341 2025] [autoindex:error] [pid 40415:tid 40432] [client 40.123.44.162:2651] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Thu Nov 20 20:18:39.757666 2025] [:error] [pid 40415:tid 40429] [client 40.123.44.162:2651] [client 40.123.44.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aR8HH6hjIyLSv09svwO9OwAAAcs"], referer: https://duckduckgo.com/
[Thu Nov 20 20:18:41.417112 2025] [autoindex:error] [pid 55343:tid 55418] [client 40.123.44.162:4603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Thu Nov 20 20:18:41.628040 2025] [autoindex:error] [pid 55343:tid 55406] [client 40.123.44.162:4603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Thu Nov 20 20:18:41.837101 2025] [autoindex:error] [pid 55343:tid 55423] [client 40.123.44.162:4603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Thu Nov 20 20:18:53.779897 2025] [:error] [pid 55343:tid 55399] [client 40.123.44.162:4603] [client 40.123.44.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.123.44.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR8HLVWlO3EnyVMV7w7CGwAAAIA"], referer: https://www.bing.com/
[Thu Nov 20 20:18:55.974768 2025] [:error] [pid 40636:tid 40640] [client 40.123.44.162:6796] [client 40.123.44.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.123.44.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR8HLwK8BWUoW3xq0HAdyQAAA4A"], referer: https://www.bing.com/
[Thu Nov 20 20:19:02.991793 2025] [:error] [pid 40445:tid 40494] [client 40.123.44.162:4378] [client 40.123.44.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.123.44.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR8HNlH-MuFcoWRjXpZ3NwAAAlM"], referer: https://duckduckgo.com/
[Thu Nov 20 20:19:03.672047 2025] [:error] [pid 40445:tid 40496] [client 40.123.44.162:4378] [client 40.123.44.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.123.44.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR8HN1H-MuFcoWRjXpZ3OQAAAlU"], referer: https://duckduckgo.com/
[Thu Nov 20 20:19:07.708374 2025] [:error] [pid 40445:tid 40484] [client 40.123.44.162:4378] [client 40.123.44.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.123.44.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR8HO1H-MuFcoWRjXpZ3OgAAAkk"], referer: https://www.yahoo.com/
[Thu Nov 20 21:06:18.766765 2025] [:error] [pid 55343:tid 55417] [client 4.233.80.63:20462] [client 4.233.80.63] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.233.80.63, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR8SSlWlO3EnyVMV7w7K2AAAAJI"]
[Thu Nov 20 22:18:34.979029 2025] [:error] [pid 55430:tid 55438] [client 106.51.173.214:2543] [client 106.51.173.214] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aR8jOvPZXaIMEU4pE7snLQAAAMU"]
[Thu Nov 20 22:20:10.291892 2025] [:error] [pid 55343:tid 55409] [client 106.51.173.214:1641] [client 106.51.173.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.51.173.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR8jmlWlO3EnyVMV7w7YKQAAAIo"]
[Thu Nov 20 22:21:32.712155 2025] [:error] [pid 40508:tid 40516] [client 106.51.173.214:1603] [client 106.51.173.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.51.173.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR8j7KxXNVCMW_ksxPvrOAAAAoY"]
[Thu Nov 20 22:22:46.016635 2025] [:error] [pid 40415:tid 40431] [client 106.51.173.214:2953] [client 106.51.173.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.51.173.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR8kNqhjIyLSv09svwPZsAAAAc0"]
[Thu Nov 20 22:24:00.977664 2025] [:error] [pid 40445:tid 40486] [client 106.51.173.214:1511] [client 106.51.173.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.51.173.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR8kgFH-MuFcoWRjXpam2QAAAks"]
[Thu Nov 20 22:25:07.694226 2025] [:error] [pid 34405:tid 34409] [client 106.51.173.214:2640] [client 106.51.173.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.51.173.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR8kwzFpvu8oRK7ATftI5AAAAQI"]
[Fri Nov 21 00:09:12.869003 2025] [autoindex:error] [pid 40415:tid 40435] [client 4.233.80.63:3141] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 00:09:14.700928 2025] [:error] [pid 40415:tid 40440] [client 4.233.80.63:3141] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/install.php"] [unique_id "aR89KqhjIyLSv09svwPw6gAAAdY"]
[Fri Nov 21 00:09:17.034283 2025] [:error] [pid 40636:tid 40648] [client 4.233.80.63:3578] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/install.php"] [unique_id "aR89LQK8BWUoW3xq0HBDUAAAA4g"]
[Fri Nov 21 00:09:18.707494 2025] [:error] [pid 55430:tid 55441] [client 4.233.80.63:59593] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/install.php"] [unique_id "aR89LvPZXaIMEU4pE7s8FwAAAMg"]
[Fri Nov 21 00:09:21.054061 2025] [:error] [pid 55342:tid 55383] [client 4.233.80.63:3540] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/install.php"] [unique_id "aR89Mbg6x32Tvk7fIG8gjQAAAEs"]
[Fri Nov 21 00:09:24.101932 2025] [:error] [pid 40415:tid 40439] [client 4.233.80.63:3581] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mpvloi.php"] [unique_id "aR89NKhjIyLSv09svwPw_gAAAdU"]
[Fri Nov 21 00:09:25.322211 2025] [:error] [pid 40415:tid 40423] [client 4.233.80.63:60870] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mpvloi.php"] [unique_id "aR89NahjIyLSv09svwPw_wAAAcU"]
[Fri Nov 21 00:09:26.056031 2025] [:error] [pid 40445:tid 40486] [client 4.233.80.63:60924] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mpvloi.php"] [unique_id "aR89NlH-MuFcoWRjXpbK7QAAAks"]
[Fri Nov 21 00:09:27.485432 2025] [:error] [pid 55342:tid 55377] [client 4.233.80.63:59619] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mpvloi.php"] [unique_id "aR89N7g6x32Tvk7fIG8gmAAAAEU"]
[Fri Nov 21 00:09:29.168054 2025] [:error] [pid 40508:tid 40530] [client 4.233.80.63:3567] [client 4.233.80.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/0.php"] [unique_id "aR89OaxXNVCMW_ksxPsKeQAAApQ"]
[Fri Nov 21 00:09:30.263164 2025] [:error] [pid 40415:tid 40427] [client 4.233.80.63:60881] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/randkeyword.php"] [unique_id "aR89OqhjIyLSv09svwPxBQAAAck"]
[Fri Nov 21 00:09:34.350238 2025] [:error] [pid 55343:tid 55418] [client 4.233.80.63:3579] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/randkeyword.php"] [unique_id "aR89PlWlO3EnyVMV7w7rLgAAAJM"]
[Fri Nov 21 00:09:37.084937 2025] [:error] [pid 40636:tid 40659] [client 4.233.80.63:59614] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/randkeyword.php"] [unique_id "aR89QQK8BWUoW3xq0HBDZAAAA5M"]
[Fri Nov 21 00:09:38.067815 2025] [:error] [pid 40415:tid 40425] [client 4.233.80.63:59589] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/randkeyword.php"] [unique_id "aR89QqhjIyLSv09svwPxDQAAAcc"]
[Fri Nov 21 00:09:39.468400 2025] [:error] [pid 40636:tid 40645] [client 4.233.80.63:60913] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fwe.php"] [unique_id "aR89QwK8BWUoW3xq0HBDZwAAA4U"]
[Fri Nov 21 00:09:40.976469 2025] [:error] [pid 34405:tid 34410] [client 4.233.80.63:3549] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fwe.php"] [unique_id "aR89RDFpvu8oRK7ATftdhAAAAQM"]
[Fri Nov 21 00:09:43.261019 2025] [:error] [pid 40415:tid 40427] [client 4.233.80.63:3530] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fwe.php"] [unique_id "aR89R6hjIyLSv09svwPxEgAAAck"]
[Fri Nov 21 00:09:45.561223 2025] [:error] [pid 55342:tid 55385] [client 4.233.80.63:60895] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fwe.php"] [unique_id "aR89Sbg6x32Tvk7fIG8grgAAAE0"]
[Fri Nov 21 00:09:46.905955 2025] [:error] [pid 55430:tid 55433] [client 4.233.80.63:60909] [client 4.233.80.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/cs.php"] [unique_id "aR89SvPZXaIMEU4pE7s8MAAAAMA"]
[Fri Nov 21 00:09:48.129335 2025] [:error] [pid 40445:tid 40499] [client 4.233.80.63:3143] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wikindex.php"] [unique_id "aR89TFH-MuFcoWRjXpbLZQAAAlg"]
[Fri Nov 21 00:09:49.259790 2025] [:error] [pid 40445:tid 40497] [client 4.233.80.63:60922] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wikindex.php"] [unique_id "aR89TVH-MuFcoWRjXpbLZwAAAlY"]
[Fri Nov 21 00:09:50.212963 2025] [:error] [pid 40636:tid 40654] [client 4.233.80.63:60879] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wikindex.php"] [unique_id "aR89TgK8BWUoW3xq0HBDcQAAA44"]
[Fri Nov 21 00:09:51.560978 2025] [:error] [pid 55342:tid 55372] [client 4.233.80.63:3171] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wikindex.php"] [unique_id "aR89T7g6x32Tvk7fIG8gsAAAAEA"]
[Fri Nov 21 00:09:53.455414 2025] [:error] [pid 55340:tid 55347] [client 4.233.80.63:59607] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/m.php"] [unique_id "aR89UfOxD-NeMydTybDb7QAAAAI"]
[Fri Nov 21 00:09:55.968366 2025] [:error] [pid 40415:tid 40421] [client 4.233.80.63:59604] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/m.php"] [unique_id "aR89U6hjIyLSv09svwPxGwAAAcM"]
[Fri Nov 21 00:09:58.904872 2025] [:error] [pid 55343:tid 55406] [client 4.233.80.63:59639] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/m.php"] [unique_id "aR89VlWlO3EnyVMV7w7rQgAAAIc"]
[Fri Nov 21 00:10:02.716279 2025] [:error] [pid 40537:tid 40556] [client 4.233.80.63:60878] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/m.php"] [unique_id "aR89WqKlsL5kxTa3c1waRgAAAs8"]
[Fri Nov 21 00:10:07.656273 2025] [:error] [pid 55343:tid 55404] [client 4.233.80.63:60917] [client 4.233.80.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/kses.php"] [unique_id "aR89X1WlO3EnyVMV7w7rUQAAAIU"]
[Fri Nov 21 00:10:09.785213 2025] [:error] [pid 40508:tid 40530] [client 4.233.80.63:3177] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jagoan.php"] [unique_id "aR89YaxXNVCMW_ksxPsKvQAAApQ"]
[Fri Nov 21 00:10:12.588204 2025] [:error] [pid 40508:tid 40526] [client 4.233.80.63:59585] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jagoan.php"] [unique_id "aR89ZKxXNVCMW_ksxPsKwQAAApA"]
[Fri Nov 21 00:10:13.666782 2025] [:error] [pid 40636:tid 40647] [client 4.233.80.63:3569] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jagoan.php"] [unique_id "aR89ZQK8BWUoW3xq0HBDiAAAA4c"]
[Fri Nov 21 00:10:18.408640 2025] [proxy_fcgi:error] [pid 55343:tid 55410] [client 4.233.80.63:3528] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 00:10:25.011818 2025] [:error] [pid 55343:tid 55421] [client 4.233.80.63:3528] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w1w.php"] [unique_id "aR89cVWlO3EnyVMV7w7rZgAAAJY"]
[Fri Nov 21 00:10:26.004966 2025] [:error] [pid 40508:tid 40526] [client 4.233.80.63:63495] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w1w.php"] [unique_id "aR89cqxXNVCMW_ksxPsK2gAAApA"]
[Fri Nov 21 00:10:27.355479 2025] [:error] [pid 40537:tid 40558] [client 4.233.80.63:59613] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w1w.php"] [unique_id "aR89c6KlsL5kxTa3c1wasgAAAtE"]
[Fri Nov 21 00:10:29.611183 2025] [:error] [pid 55342:tid 55380] [client 4.233.80.63:3535] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w1w.php"] [unique_id "aR89dbg6x32Tvk7fIG8hUQAAAEg"]
[Fri Nov 21 00:10:30.957574 2025] [:error] [pid 40636:tid 40643] [client 4.233.80.63:59599] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Contrller.php"] [unique_id "aR89dgK8BWUoW3xq0HBDngAAA4M"]
[Fri Nov 21 00:10:32.035486 2025] [:error] [pid 34405:tid 34418] [client 4.233.80.63:60889] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Contrller.php"] [unique_id "aR89eDFpvu8oRK7ATftdxwAAAQs"]
[Fri Nov 21 00:10:33.108797 2025] [:error] [pid 55343:tid 55406] [client 4.233.80.63:59620] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Contrller.php"] [unique_id "aR89eVWlO3EnyVMV7w7rcAAAAIc"]
[Fri Nov 21 00:10:34.973055 2025] [:error] [pid 55430:tid 55442] [client 4.233.80.63:59636] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Contrller.php"] [unique_id "aR89evPZXaIMEU4pE7s8YQAAAMk"]
[Fri Nov 21 00:10:35.837469 2025] [:error] [pid 55340:tid 55355] [client 4.233.80.63:59590] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cafe.php"] [unique_id "aR89e_OxD-NeMydTybDcHAAAAAo"]
[Fri Nov 21 00:10:38.053946 2025] [:error] [pid 55430:tid 55437] [client 4.233.80.63:60908] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cafe.php"] [unique_id "aR89fvPZXaIMEU4pE7s8ZAAAAMQ"]
[Fri Nov 21 00:10:40.081476 2025] [:error] [pid 40445:tid 40477] [client 4.233.80.63:59603] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cafe.php"] [unique_id "aR89gFH-MuFcoWRjXpbMBwAAAkI"]
[Fri Nov 21 00:10:40.985470 2025] [:error] [pid 40636:tid 40654] [client 4.233.80.63:3604] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cafe.php"] [unique_id "aR89gAK8BWUoW3xq0HBDpgAAA44"]
[Fri Nov 21 00:10:42.566502 2025] [:error] [pid 55340:tid 55351] [client 4.233.80.63:60891] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww2.php"] [unique_id "aR89gvOxD-NeMydTybDcIwAAAAY"]
[Fri Nov 21 00:10:45.035385 2025] [:error] [pid 40445:tid 40499] [client 4.233.80.63:3148] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww2.php"] [unique_id "aR89hVH-MuFcoWRjXpbMIwAAAlg"]
[Fri Nov 21 00:10:46.657366 2025] [:error] [pid 55340:tid 55356] [client 4.233.80.63:60900] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww2.php"] [unique_id "aR89hvOxD-NeMydTybDcJQAAAAs"]
[Fri Nov 21 00:10:48.155312 2025] [:error] [pid 40537:tid 40564] [client 4.233.80.63:59611] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww2.php"] [unique_id "aR89iKKlsL5kxTa3c1wazQAAAtc"]
[Fri Nov 21 00:10:49.453941 2025] [:error] [pid 40636:tid 40660] [client 4.233.80.63:59633] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww3.php"] [unique_id "aR89iQK8BWUoW3xq0HBDrQAAA5Q"]
[Fri Nov 21 00:10:50.847128 2025] [:error] [pid 40537:tid 40541] [client 4.233.80.63:3139] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww3.php"] [unique_id "aR89iqKlsL5kxTa3c1wa0wAAAsA"]
[Fri Nov 21 00:10:52.532628 2025] [:error] [pid 40636:tid 40640] [client 4.233.80.63:3573] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww3.php"] [unique_id "aR89jAK8BWUoW3xq0HBDrwAAA4A"]
[Fri Nov 21 00:10:54.056122 2025] [:error] [pid 55342:tid 55385] [client 4.233.80.63:3575] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww3.php"] [unique_id "aR89jrg6x32Tvk7fIG8haAAAAE0"]
[Fri Nov 21 00:10:54.989736 2025] [:error] [pid 55342:tid 55373] [client 4.233.80.63:3556] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww4.php"] [unique_id "aR89jrg6x32Tvk7fIG8hawAAAEE"]
[Fri Nov 21 00:10:57.709643 2025] [:error] [pid 40508:tid 40521] [client 4.233.80.63:59587] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww4.php"] [unique_id "aR89kaxXNVCMW_ksxPsK_QAAAos"]
[Fri Nov 21 00:10:59.126145 2025] [:error] [pid 40537:tid 40542] [client 4.233.80.63:3555] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww4.php"] [unique_id "aR89k6KlsL5kxTa3c1wbAAAAAsE"]
[Fri Nov 21 00:11:04.245637 2025] [:error] [pid 40445:tid 40489] [client 4.233.80.63:59609] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww4.php"] [unique_id "aR89mFH-MuFcoWRjXpbMVQAAAk4"]
[Fri Nov 21 00:11:05.406812 2025] [:error] [pid 40445:tid 40479] [client 4.233.80.63:59623] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aR89mVH-MuFcoWRjXpbMVgAAAkQ"]
[Fri Nov 21 00:11:06.226140 2025] [:error] [pid 55430:tid 55446] [client 4.233.80.63:59591] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aR89mvPZXaIMEU4pE7s8cwAAAM0"]
[Fri Nov 21 00:11:08.231727 2025] [:error] [pid 55342:tid 55393] [client 4.233.80.63:60907] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aR89nLg6x32Tvk7fIG8hdgAAAFU"]
[Fri Nov 21 00:11:12.702302 2025] [:error] [pid 34405:tid 34428] [client 4.233.80.63:3547] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aR89oDFpvu8oRK7ATftd2wAAARU"]
[Fri Nov 21 00:11:16.600911 2025] [:error] [pid 55342:tid 55376] [client 4.233.80.63:59627] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aR89pLg6x32Tvk7fIG8hsQAAAEQ"]
[Fri Nov 21 00:11:17.437657 2025] [:error] [pid 40537:tid 40556] [client 4.233.80.63:3142] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aR89paKlsL5kxTa3c1wbSQAAAs8"]
[Fri Nov 21 00:11:18.323800 2025] [:error] [pid 40636:tid 40640] [client 4.233.80.63:60899] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aR89pgK8BWUoW3xq0HBDygAAA4A"]
[Fri Nov 21 00:11:19.475211 2025] [:error] [pid 40636:tid 40656] [client 4.233.80.63:3546] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aR89pwK8BWUoW3xq0HBDywAAA5A"]
[Fri Nov 21 00:11:21.473264 2025] [:error] [pid 34405:tid 34416] [client 4.233.80.63:60906] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aR89qTFpvu8oRK7ATftd5AAAAQk"]
[Fri Nov 21 00:11:23.169026 2025] [:error] [pid 40508:tid 40526] [client 4.233.80.63:3574] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aR89q6xXNVCMW_ksxPsLEAAAApA"]
[Fri Nov 21 00:11:34.784759 2025] [:error] [pid 40508:tid 40532] [client 4.233.80.63:61522] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aR89tqxXNVCMW_ksxPsLJwAAApY"]
[Fri Nov 21 00:11:36.892619 2025] [:error] [pid 40445:tid 40476] [client 4.233.80.63:3722] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aR89uFH-MuFcoWRjXpbMhgAAAkE"]
[Fri Nov 21 00:11:38.033210 2025] [:error] [pid 40445:tid 40487] [client 4.233.80.63:62856] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aR89ulH-MuFcoWRjXpbMjAAAAkw"]
[Fri Nov 21 00:11:40.696727 2025] [:error] [pid 40445:tid 40483] [client 4.233.80.63:3770] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aR89vFH-MuFcoWRjXpbMoAAAAkg"]
[Fri Nov 21 00:11:46.473545 2025] [:error] [pid 34405:tid 34412] [client 4.233.80.63:62853] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aR89wjFpvu8oRK7ATfteAAAAAQU"]
[Fri Nov 21 00:11:49.681860 2025] [:error] [pid 40508:tid 40515] [client 4.233.80.63:58971] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aR89xaxXNVCMW_ksxPsLNAAAAoU"]
[Fri Nov 21 00:11:52.621795 2025] [:error] [pid 40445:tid 40487] [client 4.233.80.63:63449] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aR89yFH-MuFcoWRjXpbMuQAAAkw"]
[Fri Nov 21 00:11:53.671982 2025] [:error] [pid 40445:tid 40482] [client 4.233.80.63:3919] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aR89yVH-MuFcoWRjXpbMvgAAAkc"]
[Fri Nov 21 00:11:55.317599 2025] [:error] [pid 40415:tid 40435] [client 4.233.80.63:4040] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13k.php"] [unique_id "aR89y6hjIyLSv09svwPxsQAAAdE"]
[Fri Nov 21 00:11:56.728020 2025] [:error] [pid 40508:tid 40520] [client 4.233.80.63:4079] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13k.php"] [unique_id "aR89zKxXNVCMW_ksxPsLPAAAAoo"]
[Fri Nov 21 00:11:58.872039 2025] [:error] [pid 40537:tid 40543] [client 4.233.80.63:65367] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13k.php"] [unique_id "aR89zqKlsL5kxTa3c1wbYAAAAsI"]
[Fri Nov 21 00:12:01.758299 2025] [:error] [pid 55430:tid 55447] [client 4.233.80.63:64121] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13k.php"] [unique_id "aR890fPZXaIMEU4pE7s8pQAAAM4"]
[Fri Nov 21 00:12:02.859294 2025] [:error] [pid 34405:tid 34417] [client 4.233.80.63:65401] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aR890jFpvu8oRK7ATfteCAAAAQo"]
[Fri Nov 21 00:12:04.365665 2025] [:error] [pid 40508:tid 40528] [client 4.233.80.63:64097] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aR891KxXNVCMW_ksxPsLawAAApI"]
[Fri Nov 21 00:12:06.587492 2025] [:error] [pid 40508:tid 40514] [client 4.233.80.63:65378] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aR891qxXNVCMW_ksxPsLbwAAAoQ"]
[Fri Nov 21 00:12:07.799323 2025] [:error] [pid 40415:tid 40428] [client 4.233.80.63:65362] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aR8916hjIyLSv09svwPxxgAAAco"]
[Fri Nov 21 00:12:10.902412 2025] [:error] [pid 55343:tid 55399] [client 4.233.80.63:64094] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "aR892lWlO3EnyVMV7w7rrQAAAIA"]
[Fri Nov 21 00:12:11.790513 2025] [:error] [pid 40508:tid 40533] [client 4.233.80.63:64072] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "aR8926xXNVCMW_ksxPsLeQAAApc"]
[Fri Nov 21 00:12:14.892407 2025] [:error] [pid 40508:tid 40512] [client 4.233.80.63:64105] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "aR893qxXNVCMW_ksxPsLgQAAAoI"]
[Fri Nov 21 00:12:17.959414 2025] [:error] [pid 55430:tid 55449] [client 4.233.80.63:4046] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "aR894fPZXaIMEU4pE7s8twAAANA"]
[Fri Nov 21 00:12:20.348253 2025] [:error] [pid 34405:tid 34430] [client 4.233.80.63:64190] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aR895DFpvu8oRK7ATfteFwAAARc"]
[Fri Nov 21 00:12:22.254041 2025] [:error] [pid 40508:tid 40534] [client 4.233.80.63:65354] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aR895qxXNVCMW_ksxPsLjgAAApg"]
[Fri Nov 21 00:12:25.560617 2025] [:error] [pid 55430:tid 55443] [client 4.233.80.63:62791] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aR896fPZXaIMEU4pE7s8vAAAAMo"]
[Fri Nov 21 00:12:27.765982 2025] [:error] [pid 55340:tid 55357] [client 4.233.80.63:64119] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aR896_OxD-NeMydTybDcdQAAAAw"]
[Fri Nov 21 00:12:29.573674 2025] [:error] [pid 55340:tid 55364] [client 4.233.80.63:62807] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fw.php"] [unique_id "aR897fOxD-NeMydTybDcdgAAABM"]
[Fri Nov 21 00:12:31.091012 2025] [:error] [pid 40415:tid 40418] [client 4.233.80.63:65351] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fw.php"] [unique_id "aR8976hjIyLSv09svwPx3wAAAcA"]
[Fri Nov 21 00:12:38.287125 2025] [:error] [pid 40508:tid 40529] [client 4.233.80.63:65407] [client 4.233.80.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aR899qxXNVCMW_ksxPsLlgAAApM"]
[Fri Nov 21 00:12:47.122362 2025] [:error] [pid 40508:tid 40520] [client 4.233.80.63:64066] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aR89_6xXNVCMW_ksxPsLqAAAAoo"]
[Fri Nov 21 00:12:48.420044 2025] [:error] [pid 40636:tid 40662] [client 4.233.80.63:62813] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aR8-AAK8BWUoW3xq0HBE1QAAA5Y"]
[Fri Nov 21 00:12:50.242450 2025] [:error] [pid 40508:tid 40534] [client 4.233.80.63:64093] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aR8-AqxXNVCMW_ksxPsLqwAAApg"]
[Fri Nov 21 00:12:51.920380 2025] [:error] [pid 55340:tid 55361] [client 4.233.80.63:62815] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aR8-A_OxD-NeMydTybDcfgAAABA"]
[Fri Nov 21 00:12:52.935395 2025] [:error] [pid 55430:tid 55436] [client 4.233.80.63:65392] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aR8-BPPZXaIMEU4pE7s81AAAAMM"]
[Fri Nov 21 00:12:54.982697 2025] [:error] [pid 55430:tid 55438] [client 4.233.80.63:62827] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aR8-BvPZXaIMEU4pE7s82AAAAMU"]
[Fri Nov 21 00:12:56.048790 2025] [:error] [pid 40508:tid 40522] [client 4.233.80.63:62796] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aR8-CKxXNVCMW_ksxPsLtwAAAow"]
[Fri Nov 21 00:12:57.418522 2025] [:error] [pid 55342:tid 55383] [client 4.233.80.63:64135] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aR8-Cbg6x32Tvk7fIG8iRAAAAEs"]
[Fri Nov 21 00:12:59.104736 2025] [:error] [pid 55342:tid 55395] [client 4.233.80.63:62828] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aR8-C7g6x32Tvk7fIG8iRgAAAFc"]
[Fri Nov 21 00:13:00.732427 2025] [:error] [pid 55342:tid 55381] [client 4.233.80.63:65380] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aR8-DLg6x32Tvk7fIG8iSgAAAEk"]
[Fri Nov 21 00:13:02.049501 2025] [:error] [pid 40537:tid 40560] [client 4.233.80.63:65397] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aR8-DqKlsL5kxTa3c1wbfAAAAtM"]
[Fri Nov 21 00:13:03.753335 2025] [:error] [pid 40415:tid 40418] [client 4.233.80.63:64092] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aR8-D6hjIyLSv09svwPx-AAAAcA"]
[Fri Nov 21 00:13:05.161279 2025] [:error] [pid 40415:tid 40438] [client 4.233.80.63:64107] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aR8-EahjIyLSv09svwPx_AAAAdQ"]
[Fri Nov 21 00:13:08.784927 2025] [:error] [pid 40415:tid 40426] [client 4.233.80.63:65375] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aR8-FKhjIyLSv09svwPx_wAAAcg"]
[Fri Nov 21 00:13:10.750490 2025] [:error] [pid 40445:tid 40480] [client 4.233.80.63:64101] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aR8-FlH-MuFcoWRjXpbNVQAAAkU"]
[Fri Nov 21 00:13:11.923481 2025] [:error] [pid 40636:tid 40654] [client 4.233.80.63:62814] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aR8-FwK8BWUoW3xq0HBE5QAAA44"]
[Fri Nov 21 00:13:13.311685 2025] [:error] [pid 40415:tid 40424] [client 4.233.80.63:65386] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aR8-GahjIyLSv09svwPyAwAAAcY"]
[Fri Nov 21 00:13:14.094368 2025] [:error] [pid 40636:tid 40640] [client 4.233.80.63:62840] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aR8-GgK8BWUoW3xq0HBE5gAAA4A"]
[Fri Nov 21 00:13:15.312494 2025] [:error] [pid 55342:tid 55380] [client 4.233.80.63:62801] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aR8-G7g6x32Tvk7fIG8iUgAAAEg"]
[Fri Nov 21 00:13:17.584606 2025] [:error] [pid 55342:tid 55373] [client 4.233.80.63:64076] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aR8-Hbg6x32Tvk7fIG8iVAAAAEE"]
[Fri Nov 21 00:13:20.446147 2025] [:error] [pid 55430:tid 55451] [client 4.233.80.63:64168] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aR8-IPPZXaIMEU4pE7s85QAAANI"]
[Fri Nov 21 00:13:22.457182 2025] [:error] [pid 34405:tid 34431] [client 4.233.80.63:62839] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aR8-IjFpvu8oRK7ATfte6QAAARg"]
[Fri Nov 21 00:13:24.240979 2025] [:error] [pid 55430:tid 55444] [client 4.233.80.63:64083] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aR8-JPPZXaIMEU4pE7s85wAAAMs"]
[Fri Nov 21 00:13:25.895073 2025] [:error] [pid 55340:tid 55348] [client 4.233.80.63:64123] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aR8-JfOxD-NeMydTybDclQAAAAM"]
[Fri Nov 21 00:13:27.500694 2025] [:error] [pid 55343:tid 55402] [client 4.233.80.63:64086] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aR8-J1WlO3EnyVMV7w7smQAAAIM"]
[Fri Nov 21 00:13:28.603564 2025] [:error] [pid 40508:tid 40517] [client 4.233.80.63:64169] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aR8-KKxXNVCMW_ksxPsLzwAAAoc"]
[Fri Nov 21 00:13:32.203890 2025] [:error] [pid 40415:tid 40423] [client 4.233.80.63:62830] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aR8-LKhjIyLSv09svwPyFAAAAcU"]
[Fri Nov 21 00:13:34.033410 2025] [:error] [pid 40508:tid 40528] [client 4.233.80.63:64095] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aR8-LqxXNVCMW_ksxPsL0AAAApI"]
[Fri Nov 21 00:13:36.494608 2025] [:error] [pid 40445:tid 40477] [client 4.233.80.63:65373] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aR8-MFH-MuFcoWRjXpbNdQAAAkI"]
[Fri Nov 21 00:13:38.126934 2025] [:error] [pid 40415:tid 40432] [client 4.233.80.63:64082] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aR8-MqhjIyLSv09svwPyLgAAAc4"]
[Fri Nov 21 00:13:38.973983 2025] [:error] [pid 40636:tid 40641] [client 4.233.80.63:64174] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aR8-MgK8BWUoW3xq0HBE8QAAA4E"]
[Fri Nov 21 00:13:41.049217 2025] [:error] [pid 55430:tid 55435] [client 4.233.80.63:64139] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aR8-NfPZXaIMEU4pE7s87gAAAMI"]
[Fri Nov 21 00:13:43.139442 2025] [:error] [pid 40508:tid 40510] [client 4.233.80.63:64128] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aR8-N6xXNVCMW_ksxPsL1gAAAoA"]
[Fri Nov 21 00:13:44.156042 2025] [:error] [pid 40415:tid 40428] [client 4.233.80.63:64074] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aR8-OKhjIyLSv09svwPyUAAAAco"]
[Fri Nov 21 00:13:45.459755 2025] [:error] [pid 40636:tid 40657] [client 4.233.80.63:64112] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aR8-OQK8BWUoW3xq0HBE9QAAA5E"]
[Fri Nov 21 00:13:56.204331 2025] [:error] [pid 40508:tid 40512] [client 4.233.80.63:64070] [client 4.233.80.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aR8-RKxXNVCMW_ksxPsL5wAAAoI"]
[Fri Nov 21 00:13:59.845511 2025] [:error] [pid 55343:tid 55415] [client 4.233.80.63:62843] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aR8-R1WlO3EnyVMV7w7sqgAAAJA"]
[Fri Nov 21 00:14:00.947195 2025] [:error] [pid 34405:tid 34415] [client 4.233.80.63:65345] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aR8-SDFpvu8oRK7ATftfKgAAAQg"]
[Fri Nov 21 00:14:01.855700 2025] [:error] [pid 40415:tid 40421] [client 4.233.80.63:65368] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aR8-SahjIyLSv09svwPyhQAAAcM"]
[Fri Nov 21 00:14:03.122974 2025] [:error] [pid 40636:tid 40656] [client 4.233.80.63:4083] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aR8-SwK8BWUoW3xq0HBFDAAAA5A"]
[Fri Nov 21 00:14:05.063839 2025] [:error] [pid 40537:tid 40544] [client 4.233.80.63:4085] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aR8-TaKlsL5kxTa3c1wbnwAAAsM"]
[Fri Nov 21 00:14:06.434037 2025] [:error] [pid 40508:tid 40517] [client 4.233.80.63:64098] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aR8-TqxXNVCMW_ksxPsL7QAAAoc"]
[Fri Nov 21 00:14:07.389955 2025] [:error] [pid 40445:tid 40498] [client 4.233.80.63:65356] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aR8-T1H-MuFcoWRjXpbNlAAAAlc"]
[Fri Nov 21 00:14:09.202649 2025] [:error] [pid 55342:tid 55393] [client 4.233.80.63:62838] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aR8-Ubg6x32Tvk7fIG8ilAAAAFU"]
[Fri Nov 21 00:14:10.993247 2025] [:error] [pid 40445:tid 40477] [client 4.233.80.63:64104] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aR8-UlH-MuFcoWRjXpbNnAAAAkI"]
[Fri Nov 21 00:14:12.241254 2025] [:error] [pid 55342:tid 55384] [client 4.233.80.63:62844] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aR8-VLg6x32Tvk7fIG8imQAAAEw"]
[Fri Nov 21 00:14:14.714320 2025] [:error] [pid 55343:tid 55411] [client 4.233.80.63:62823] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aR8-VlWlO3EnyVMV7w7srQAAAIw"]
[Fri Nov 21 00:14:17.577646 2025] [:error] [pid 40445:tid 40485] [client 4.233.80.63:65352] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aR8-WVH-MuFcoWRjXpbNpQAAAko"]
[Fri Nov 21 00:14:18.491918 2025] [:error] [pid 40636:tid 40664] [client 4.233.80.63:64146] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aR8-WgK8BWUoW3xq0HBFEgAAA5g"]
[Fri Nov 21 00:14:20.088774 2025] [:error] [pid 40415:tid 40427] [client 4.233.80.63:64114] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aR8-XKhjIyLSv09svwPy5gAAAck"]
[Fri Nov 21 00:14:21.994297 2025] [:error] [pid 40537:tid 40565] [client 4.233.80.63:62821] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aR8-XaKlsL5kxTa3c1wbpQAAAtg"]
[Fri Nov 21 00:14:23.724018 2025] [:error] [pid 55342:tid 55377] [client 4.233.80.63:65379] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aR8-X7g6x32Tvk7fIG8inQAAAEU"]
[Fri Nov 21 00:14:24.590711 2025] [:error] [pid 55430:tid 55438] [client 4.233.80.63:62842] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aR8-YPPZXaIMEU4pE7s8-wAAAMU"]
[Fri Nov 21 00:14:25.510436 2025] [:error] [pid 40537:tid 40543] [client 4.233.80.63:3922] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aR8-YaKlsL5kxTa3c1wbpwAAAsI"]
[Fri Nov 21 00:14:26.678345 2025] [:error] [pid 40445:tid 40499] [client 4.233.80.63:64084] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aR8-YlH-MuFcoWRjXpbNrAAAAlg"]
[Fri Nov 21 00:14:29.016096 2025] [:error] [pid 40508:tid 40522] [client 4.233.80.63:64120] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aR8-ZaxXNVCMW_ksxPsL9wAAAow"]
[Fri Nov 21 00:14:30.213649 2025] [:error] [pid 55342:tid 55386] [client 4.233.80.63:62803] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/fm.php"] [unique_id "aR8-Zrg6x32Tvk7fIG8inwAAAE4"]
[Fri Nov 21 00:14:32.723897 2025] [:error] [pid 55430:tid 55453] [client 4.233.80.63:64064] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/fm.php"] [unique_id "aR8-aPPZXaIMEU4pE7s8_gAAANQ"]
[Fri Nov 21 00:14:34.118464 2025] [:error] [pid 40636:tid 40654] [client 4.233.80.63:64125] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/fm.php"] [unique_id "aR8-agK8BWUoW3xq0HBFGwAAA44"]
[Fri Nov 21 00:14:35.235214 2025] [:error] [pid 55430:tid 55450] [client 4.233.80.63:64154] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/fm.php"] [unique_id "aR8-a_PZXaIMEU4pE7s9AwAAANE"]
[Fri Nov 21 00:14:37.042116 2025] [:error] [pid 55343:tid 55418] [client 4.233.80.63:62812] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aR8-bVWlO3EnyVMV7w7tDgAAAJM"]
[Fri Nov 21 00:14:38.915237 2025] [:error] [pid 55342:tid 55381] [client 4.233.80.63:64176] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aR8-brg6x32Tvk7fIG8ioQAAAEk"]
[Fri Nov 21 00:14:40.492397 2025] [:error] [pid 40445:tid 40489] [client 4.233.80.63:3915] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aR8-cFH-MuFcoWRjXpbNugAAAk4"]
[Fri Nov 21 00:14:41.503319 2025] [:error] [pid 34405:tid 34429] [client 4.233.80.63:65363] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aR8-cTFpvu8oRK7ATftfOAAAARY"]
[Fri Nov 21 00:14:43.138635 2025] [:error] [pid 55340:tid 55347] [client 4.233.80.63:64143] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/Cache/footer.php"] [unique_id "aR8-c_OxD-NeMydTybDcwgAAAAI"]
[Fri Nov 21 00:14:44.508669 2025] [:error] [pid 40537:tid 40554] [client 4.233.80.63:64127] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/Cache/footer.php"] [unique_id "aR8-dKKlsL5kxTa3c1wbrQAAAs0"]
[Fri Nov 21 00:14:47.887498 2025] [:error] [pid 40445:tid 40495] [client 4.233.80.63:3943] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/Cache/footer.php"] [unique_id "aR8-d1H-MuFcoWRjXpbNwgAAAlQ"]
[Fri Nov 21 00:14:48.964683 2025] [:error] [pid 55340:tid 55360] [client 4.233.80.63:64103] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/Cache/footer.php"] [unique_id "aR8-ePOxD-NeMydTybDcxQAAAA8"]
[Fri Nov 21 00:14:50.787093 2025] [:error] [pid 55430:tid 55450] [client 4.233.80.63:64144] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aR8-evPZXaIMEU4pE7s9QAAAANE"]
[Fri Nov 21 00:14:51.650591 2025] [:error] [pid 55340:tid 55354] [client 4.233.80.63:64159] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aR8-e_OxD-NeMydTybDc5QAAAAk"]
[Fri Nov 21 00:14:52.358528 2025] [:error] [pid 40445:tid 40486] [client 4.233.80.63:62845] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aR8-fFH-MuFcoWRjXpbN5AAAAks"]
[Fri Nov 21 00:14:53.193814 2025] [:error] [pid 40445:tid 40478] [client 4.233.80.63:64141] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aR8-fVH-MuFcoWRjXpbN6AAAAkM"]
[Fri Nov 21 00:14:55.407442 2025] [:error] [pid 40415:tid 40430] [client 4.233.80.63:64131] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aR8-f6hjIyLSv09svwPzCwAAAcw"]
[Fri Nov 21 00:14:56.743943 2025] [:error] [pid 55340:tid 55368] [client 4.233.80.63:64091] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aR8-gPOxD-NeMydTybDc8gAAABc"]
[Fri Nov 21 00:14:57.684219 2025] [:error] [pid 55342:tid 55394] [client 4.233.80.63:4080] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aR8-gbg6x32Tvk7fIG8i5gAAAFY"]
[Fri Nov 21 00:14:58.990454 2025] [:error] [pid 40508:tid 40529] [client 4.233.80.63:62826] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aR8-gqxXNVCMW_ksxPsMIwAAApM"]
[Fri Nov 21 00:15:09.649895 2025] [:error] [pid 40445:tid 40498] [client 4.233.80.63:64134] [client 4.233.80.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aR8-jVH-MuFcoWRjXpbOBQAAAlc"]
[Fri Nov 21 00:15:11.696788 2025] [:error] [pid 40445:tid 40487] [client 4.233.80.63:62824] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aR8-j1H-MuFcoWRjXpbOBgAAAkw"]
[Fri Nov 21 00:15:12.888318 2025] [:error] [pid 55342:tid 55395] [client 4.233.80.63:62805] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aR8-kLg6x32Tvk7fIG8i9QAAAFc"]
[Fri Nov 21 00:15:13.677712 2025] [:error] [pid 55342:tid 55385] [client 4.233.80.63:65349] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aR8-kbg6x32Tvk7fIG8i9wAAAE0"]
[Fri Nov 21 00:15:15.228983 2025] [:error] [pid 55343:tid 55413] [client 4.233.80.63:64138] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aR8-k1WlO3EnyVMV7w7tdQAAAI4"]
[Fri Nov 21 00:15:17.746920 2025] [:error] [pid 40445:tid 40489] [client 4.233.80.63:64089] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aR8-lVH-MuFcoWRjXpbODAAAAk4"]
[Fri Nov 21 00:15:18.787875 2025] [:error] [pid 55430:tid 55442] [client 4.233.80.63:64068] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aR8-lvPZXaIMEU4pE7s9nQAAAMk"]
[Fri Nov 21 00:15:20.345330 2025] [:error] [pid 40445:tid 40476] [client 4.233.80.63:62794] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aR8-mFH-MuFcoWRjXpbOEwAAAkE"]
[Fri Nov 21 00:15:21.173984 2025] [:error] [pid 40508:tid 40525] [client 4.233.80.63:58955] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aR8-maxXNVCMW_ksxPsMNQAAAo8"]
[Fri Nov 21 00:15:22.355297 2025] [:error] [pid 40415:tid 40423] [client 4.233.80.63:62793] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aR8-mqhjIyLSv09svwPzHQAAAcU"]
[Fri Nov 21 00:15:24.301419 2025] [:error] [pid 55343:tid 55423] [client 4.233.80.63:64081] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aR8-nFWlO3EnyVMV7w7tqwAAAJg"]
[Fri Nov 21 00:15:26.006120 2025] [:error] [pid 55340:tid 55369] [client 4.233.80.63:3907] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aR8-nvOxD-NeMydTybDdBAAAABg"]
[Fri Nov 21 00:15:26.980102 2025] [:error] [pid 34405:tid 34423] [client 4.233.80.63:64096] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aR8-njFpvu8oRK7ATftfXAAAARA"]
[Fri Nov 21 00:15:28.702072 2025] [:error] [pid 40445:tid 40482] [client 4.233.80.63:62811] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aR8-oFH-MuFcoWRjXpbOIwAAAkc"]
[Fri Nov 21 00:15:29.981799 2025] [:error] [pid 55340:tid 55364] [client 4.233.80.63:65388] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aR8-ofOxD-NeMydTybDdCwAAABM"]
[Fri Nov 21 00:15:31.794413 2025] [:error] [pid 55340:tid 55355] [client 4.233.80.63:64100] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aR8-o_OxD-NeMydTybDdEQAAAAo"]
[Fri Nov 21 00:15:33.748339 2025] [:error] [pid 40445:tid 40480] [client 4.233.80.63:65390] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aR8-pVH-MuFcoWRjXpbOKgAAAkU"]
[Fri Nov 21 00:15:35.522180 2025] [:error] [pid 55342:tid 55391] [client 4.233.80.63:64186] [client 4.233.80.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aR8-p7g6x32Tvk7fIG8jDQAAAFM"]
[Fri Nov 21 00:15:36.554651 2025] [:error] [pid 40445:tid 40483] [client 4.233.80.63:4064] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aR8-qFH-MuFcoWRjXpbORQAAAkg"]
[Fri Nov 21 00:15:38.298926 2025] [:error] [pid 55340:tid 55350] [client 4.233.80.63:65376] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aR8-qvOxD-NeMydTybDdFAAAAAU"]
[Fri Nov 21 00:15:39.588485 2025] [:error] [pid 40445:tid 40482] [client 4.233.80.63:4042] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aR8-q1H-MuFcoWRjXpbOSwAAAkc"]
[Fri Nov 21 00:15:41.788581 2025] [:error] [pid 40445:tid 40497] [client 4.233.80.63:4095] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aR8-rVH-MuFcoWRjXpbOUwAAAlY"]
[Fri Nov 21 00:15:43.143684 2025] [:error] [pid 55340:tid 55364] [client 4.233.80.63:64109] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aR8-r_OxD-NeMydTybDdGAAAABM"]
[Fri Nov 21 00:15:44.029172 2025] [:error] [pid 40445:tid 40495] [client 4.233.80.63:64136] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aR8-sFH-MuFcoWRjXpbOVQAAAlQ"]
[Fri Nov 21 00:15:45.637757 2025] [:error] [pid 40508:tid 40523] [client 4.233.80.63:65394] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aR8-saxXNVCMW_ksxPsMVgAAAo0"]
[Fri Nov 21 00:15:47.245930 2025] [:error] [pid 40445:tid 40486] [client 4.233.80.63:64113] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aR8-s1H-MuFcoWRjXpbOWwAAAks"]
[Fri Nov 21 00:15:48.262931 2025] [:error] [pid 55430:tid 55457] [client 4.233.80.63:65404] [client 4.233.80.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aR8-tPPZXaIMEU4pE7s9yAAAANg"]
[Fri Nov 21 00:15:49.093972 2025] [:error] [pid 55340:tid 55348] [client 4.233.80.63:4056] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aR8-tfOxD-NeMydTybDdGwAAAAM"]
[Fri Nov 21 00:15:50.497716 2025] [:error] [pid 40445:tid 40479] [client 4.233.80.63:4074] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aR8-tlH-MuFcoWRjXpbOYQAAAkQ"]
[Fri Nov 21 00:15:51.775829 2025] [:error] [pid 40537:tid 40543] [client 4.233.80.63:65353] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aR8-t6KlsL5kxTa3c1wcCQAAAsI"]
[Fri Nov 21 00:15:53.138769 2025] [:error] [pid 40445:tid 40497] [client 4.233.80.63:64162] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aR8-uVH-MuFcoWRjXpbOaAAAAlY"]
[Fri Nov 21 00:15:53.962071 2025] [:error] [pid 40508:tid 40529] [client 4.233.80.63:64156] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filemanager/dialog.php"] [unique_id "aR8-uaxXNVCMW_ksxPsMXQAAApM"]
[Fri Nov 21 00:15:54.894630 2025] [:error] [pid 40537:tid 40561] [client 4.233.80.63:64115] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filemanager/dialog.php"] [unique_id "aR8-uqKlsL5kxTa3c1wcCwAAAtQ"]
[Fri Nov 21 00:15:55.947845 2025] [:error] [pid 40415:tid 40437] [client 4.233.80.63:65382] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filemanager/dialog.php"] [unique_id "aR8-u6hjIyLSv09svwPzPAAAAdM"]
[Fri Nov 21 00:15:58.176339 2025] [:error] [pid 55430:tid 55444] [client 4.233.80.63:64167] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filemanager/dialog.php"] [unique_id "aR8-vvPZXaIMEU4pE7s90AAAAMs"]
[Fri Nov 21 00:15:59.426036 2025] [:error] [pid 34405:tid 34413] [client 4.233.80.63:64077] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aR8-vzFpvu8oRK7ATftfdAAAAQY"]
[Fri Nov 21 00:16:00.923335 2025] [:error] [pid 40636:tid 40659] [client 4.233.80.63:64137] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aR8-wAK8BWUoW3xq0HBFwgAAA5M"]
[Fri Nov 21 00:16:02.258268 2025] [:error] [pid 40508:tid 40533] [client 4.233.80.63:65387] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aR8-wqxXNVCMW_ksxPsMZQAAApc"]
[Fri Nov 21 00:16:03.765332 2025] [:error] [pid 55430:tid 55433] [client 4.233.80.63:62797] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aR8-w_PZXaIMEU4pE7s90wAAAMA"]
[Fri Nov 21 00:16:08.643913 2025] [:error] [pid 40445:tid 40480] [client 4.233.80.63:4037] [client 4.233.80.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Text/admin.php"] [unique_id "aR8-yFH-MuFcoWRjXpbOdwAAAkU"]
[Fri Nov 21 00:16:12.975776 2025] [:error] [pid 40508:tid 40520] [client 4.233.80.63:65385] [client 4.233.80.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aR8-zKxXNVCMW_ksxPsMcAAAAoo"]
[Fri Nov 21 00:16:19.766296 2025] [:error] [pid 40445:tid 40478] [client 4.233.80.63:65389] [client 4.233.80.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "aR8-01H-MuFcoWRjXpbOiAAAAkM"]
[Fri Nov 21 00:16:22.102988 2025] [:error] [pid 40445:tid 40496] [client 4.233.80.63:64087] [client 4.233.80.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aR8-1lH-MuFcoWRjXpbOnAAAAlU"]
[Fri Nov 21 00:16:25.940629 2025] [:error] [pid 55430:tid 55435] [client 4.233.80.63:64102] [client 4.233.80.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aR8-2fPZXaIMEU4pE7s94gAAAMI"]
[Fri Nov 21 00:16:29.774407 2025] [proxy_fcgi:error] [pid 55340:tid 55355] [client 4.233.80.63:3934] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 00:16:37.376051 2025] [:error] [pid 40445:tid 40499] [client 4.233.80.63:4007] [client 4.233.80.63] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.233.80.63, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR8-5VH-MuFcoWRjXpbOsQAAAlg"]
[Fri Nov 21 00:16:38.548782 2025] [autoindex:error] [pid 55340:tid 55353] [client 4.233.80.63:3934] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 00:16:39.465291 2025] [:error] [pid 55340:tid 55364] [client 4.233.80.63:3934] [client 4.233.80.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aR8-5_OxD-NeMydTybDdVQAAABM"]
[Fri Nov 21 00:16:43.728886 2025] [:error] [pid 34405:tid 34410] [client 4.233.80.63:57398] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aR8-6zFpvu8oRK7ATftf9QAAAQM"]
[Fri Nov 21 00:16:44.985214 2025] [:error] [pid 34405:tid 34419] [client 4.233.80.63:62212] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aR8-7DFpvu8oRK7ATftf9gAAAQw"]
[Fri Nov 21 00:16:46.299316 2025] [:error] [pid 55343:tid 55423] [client 4.233.80.63:57358] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aR8-7lWlO3EnyVMV7w7uYAAAAJg"]
[Fri Nov 21 00:16:47.094649 2025] [:error] [pid 40508:tid 40514] [client 4.233.80.63:65436] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aR8-76xXNVCMW_ksxPsMigAAAoQ"]
[Fri Nov 21 00:16:48.628836 2025] [:error] [pid 55430:tid 55439] [client 4.233.80.63:57372] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aR8-8PPZXaIMEU4pE7s97wAAAMY"]
[Fri Nov 21 00:16:49.919647 2025] [:error] [pid 55340:tid 55352] [client 4.233.80.63:65416] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aR8-8fOxD-NeMydTybDdXQAAAAc"]
[Fri Nov 21 00:16:54.317356 2025] [:error] [pid 40415:tid 40428] [client 4.233.80.63:64815] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aR8-9qhjIyLSv09svwPz5wAAAco"]
[Fri Nov 21 00:16:56.999115 2025] [:error] [pid 40508:tid 40520] [client 4.233.80.63:65441] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aR8--KxXNVCMW_ksxPsMlwAAAoo"]
[Fri Nov 21 00:16:58.416633 2025] [:error] [pid 55340:tid 55369] [client 4.233.80.63:64726] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/admin.php"] [unique_id "aR8--vOxD-NeMydTybDdcQAAABg"]
[Fri Nov 21 00:16:59.611264 2025] [:error] [pid 55430:tid 55452] [client 4.233.80.63:64713] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/admin.php"] [unique_id "aR8--_PZXaIMEU4pE7s99AAAANM"]
[Fri Nov 21 00:17:01.002939 2025] [:error] [pid 55343:tid 55421] [client 4.233.80.63:64749] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/admin.php"] [unique_id "aR8-_VWlO3EnyVMV7w7ubQAAAJY"]
[Fri Nov 21 00:17:02.176459 2025] [:error] [pid 40537:tid 40547] [client 4.233.80.63:65424] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/admin.php"] [unique_id "aR8-_qKlsL5kxTa3c1wcMwAAAsY"]
[Fri Nov 21 00:17:03.508758 2025] [:error] [pid 40508:tid 40528] [client 4.233.80.63:64725] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aR8-_6xXNVCMW_ksxPsMrwAAApI"]
[Fri Nov 21 00:17:04.568101 2025] [:error] [pid 40445:tid 40499] [client 4.233.80.63:60234] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aR8_AFH-MuFcoWRjXpbO1AAAAlg"]
[Fri Nov 21 00:17:05.812179 2025] [:error] [pid 40445:tid 40492] [client 4.233.80.63:64712] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aR8_AVH-MuFcoWRjXpbO1gAAAlE"]
[Fri Nov 21 00:17:06.880140 2025] [:error] [pid 40445:tid 40488] [client 4.233.80.63:65429] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aR8_AlH-MuFcoWRjXpbO2AAAAk0"]
[Fri Nov 21 00:17:07.892130 2025] [:error] [pid 40537:tid 40565] [client 4.233.80.63:65464] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "aR8_A6KlsL5kxTa3c1wcNQAAAtg"]
[Fri Nov 21 00:17:09.025569 2025] [:error] [pid 55430:tid 55442] [client 4.233.80.63:65415] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "aR8_BfPZXaIMEU4pE7s-AgAAAMk"]
[Fri Nov 21 00:17:09.835701 2025] [:error] [pid 55430:tid 55454] [client 4.233.80.63:65437] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "aR8_BfPZXaIMEU4pE7s-BAAAANU"]
[Fri Nov 21 00:17:10.889680 2025] [:error] [pid 40415:tid 40418] [client 4.233.80.63:64774] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "aR8_BqhjIyLSv09svwPz9gAAAcA"]
[Fri Nov 21 00:17:11.764625 2025] [:error] [pid 40636:tid 40663] [client 4.233.80.63:64739] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aR8_BwK8BWUoW3xq0HBF9wAAA5c"]
[Fri Nov 21 00:17:13.581368 2025] [:error] [pid 40415:tid 40425] [client 4.233.80.63:65439] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aR8_CahjIyLSv09svwPz-gAAAcc"]
[Fri Nov 21 00:17:14.721432 2025] [:error] [pid 40415:tid 40437] [client 4.233.80.63:65449] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aR8_CqhjIyLSv09svwPz_QAAAdM"]
[Fri Nov 21 00:17:17.836927 2025] [:error] [pid 55430:tid 55433] [client 4.233.80.63:65453] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aR8_DfPZXaIMEU4pE7s-EQAAAMA"]
[Fri Nov 21 00:17:19.237018 2025] [:error] [pid 40537:tid 40555] [client 4.233.80.63:64707] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/log.php"] [unique_id "aR8_D6KlsL5kxTa3c1wcQAAAAs4"]
[Fri Nov 21 00:17:20.255153 2025] [:error] [pid 34405:tid 34423] [client 4.233.80.63:64806] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/log.php"] [unique_id "aR8_EDFpvu8oRK7ATftgFQAAARA"]
[Fri Nov 21 00:17:21.467011 2025] [:error] [pid 40508:tid 40521] [client 4.233.80.63:60225] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/log.php"] [unique_id "aR8_EaxXNVCMW_ksxPsMyQAAAos"]
[Fri Nov 21 00:17:23.546359 2025] [:error] [pid 40537:tid 40554] [client 4.233.80.63:64758] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/log.php"] [unique_id "aR8_E6KlsL5kxTa3c1wcTgAAAs0"]
[Fri Nov 21 00:17:25.127682 2025] [:error] [pid 40415:tid 40442] [client 4.233.80.63:60272] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aR8_FahjIyLSv09svwP0DAAAAdg"]
[Fri Nov 21 00:17:26.167340 2025] [:error] [pid 40636:tid 40643] [client 4.233.80.63:60239] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aR8_FgK8BWUoW3xq0HBGEQAAA4M"]
[Fri Nov 21 00:17:26.925823 2025] [:error] [pid 40537:tid 40550] [client 4.233.80.63:62214] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aR8_FqKlsL5kxTa3c1wcUgAAAsk"]
[Fri Nov 21 00:17:31.556278 2025] [:error] [pid 40508:tid 40517] [client 4.233.80.63:60271] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aR8_G6xXNVCMW_ksxPsM1AAAAoc"]
[Fri Nov 21 00:17:32.692281 2025] [:error] [pid 40445:tid 40493] [client 4.233.80.63:64728] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aR8_HFH-MuFcoWRjXpbO7AAAAlI"]
[Fri Nov 21 00:17:34.250535 2025] [:error] [pid 40537:tid 40560] [client 4.233.80.63:65445] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aR8_HqKlsL5kxTa3c1wcYgAAAtM"]
[Fri Nov 21 00:17:38.896954 2025] [:error] [pid 34405:tid 34422] [client 4.233.80.63:65420] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aR8_IjFpvu8oRK7ATftgSgAAAQ8"]
[Fri Nov 21 00:17:40.699424 2025] [:error] [pid 55343:tid 55411] [client 4.233.80.63:65466] [client 4.233.80.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aR8_JFWlO3EnyVMV7w7umAAAAIw"]
[Fri Nov 21 00:17:42.680735 2025] [:error] [pid 40636:tid 40646] [client 4.233.80.63:65427] [client 4.233.80.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aR8_JgK8BWUoW3xq0HBGGAAAA4Y"]
[Fri Nov 21 00:17:44.142368 2025] [:error] [pid 40537:tid 40554] [client 4.233.80.63:64787] [client 4.233.80.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aR8_KKKlsL5kxTa3c1wcawAAAs0"]
[Fri Nov 21 03:05:23.452309 2025] [:error] [pid 28937:tid 28962] [client 69.62.77.85:41266] [client 69.62.77.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.62.77.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR9mc_tbT10GL1y3DOabIQAAANc"]
[Fri Nov 21 03:49:10.666832 2025] [:error] [pid 13412:tid 13441] [client 182.44.9.147:51980] [client 182.44.9.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aR9wtn3-knz3ZB6HogGMBwAAANg"]
[Fri Nov 21 04:36:58.498684 2025] [:error] [pid 51434:tid 51452] [client 104.234.19.99:65277] [client 104.234.19.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aR976vU96liplEDkw_TQJwAAARA"]
[Fri Nov 21 04:36:59.030744 2025] [:error] [pid 13326:tid 13363] [client 216.24.219.161:60677] [client 216.24.219.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/style.php"] [unique_id "aR9769h942-HkDIkOWrRHwAAAEU"]
[Fri Nov 21 04:37:00.626881 2025] [:error] [pid 13325:tid 13343] [client 216.24.219.113:45653] [client 216.24.219.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/style.php"] [unique_id "aR977CBUXj9tD75On3CQYAAAAA0"]
[Fri Nov 21 04:37:01.156293 2025] [:error] [pid 51434:tid 51436] [client 216.24.219.111:51687] [client 216.24.219.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/style.php"] [unique_id "aR977fU96liplEDkw_TQLgAAAQA"]
[Fri Nov 21 04:37:01.679150 2025] [:error] [pid 13327:tid 13387] [client 104.234.19.99:30507] [client 104.234.19.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style.php"] [unique_id "aR977fBXf-8B6mFkLeOEoAAAAII"]
[Fri Nov 21 04:37:02.260304 2025] [:error] [pid 13326:tid 13370] [client 216.24.219.116:36725] [client 216.24.219.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aR977th942-HkDIkOWrRKQAAAEw"]
[Fri Nov 21 04:37:02.779795 2025] [:error] [pid 51434:tid 51450] [client 216.24.219.110:50171] [client 216.24.219.110] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aR977vU96liplEDkw_TQNgAAAQ4"]
[Fri Nov 21 04:37:03.280529 2025] [:error] [pid 13327:tid 13399] [client 216.24.219.153:20203] [client 216.24.219.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "aR977_BXf-8B6mFkLeOEowAAAI4"]
[Fri Nov 21 07:33:04.366031 2025] [:error] [pid 13325:tid 13351] [client 199.188.200.34:34574] [client 199.188.200.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 199.188.200.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR-lMCBUXj9tD75On3DLwAAAABU"]
[Fri Nov 21 07:37:54.960675 2025] [:error] [pid 13327:tid 13393] [client 20.206.185.109:44294] [client 20.206.185.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.206.185.109, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR-mUvBXf-8B6mFkLeO75AAAAIg"]
[Fri Nov 21 07:37:57.423591 2025] [:error] [pid 51434:tid 51446] [client 20.206.185.109:38224] [client 20.206.185.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.206.185.109, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR-mVfU96liplEDkw_QXiQAAAQo"], referer: http://expressinteriors.com/wp-login.php
[Fri Nov 21 07:37:59.535044 2025] [:error] [pid 13325:tid 13340] [client 20.206.185.109:38656] [client 20.206.185.109] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aR-mVyBUXj9tD75On3DMZwAAAAo"], referer: http://expressinteriors.com/wp-login.php
[Fri Nov 21 07:38:01.671972 2025] [:error] [pid 13412:tid 13428] [client 20.206.185.109:38964] [client 20.206.185.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.206.185.109, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR-mWX3-knz3ZB6HogHirwAAAMs"], referer: https://expressinteriors.com/wp-login.php?redirect_to=https%3A%2F%2Fexpressinteriors.com%2Fwp-admin%2F
[Fri Nov 21 08:08:10.496858 2025] [:error] [pid 13412:tid 13420] [client 162.0.217.123:32970] [client 162.0.217.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.0.217.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR-tan3-knz3ZB6HogHpLQAAAMM"]
[Fri Nov 21 09:22:50.518996 2025] [:error] [pid 17882:tid 17905] [client 199.188.200.191:50254] [client 199.188.200.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.188.200.191, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR--6owFFssEn348h95INAAAAVU"]
[Fri Nov 21 09:22:51.768732 2025] [:error] [pid 17882:tid 17908] [client 199.188.200.191:50254] [client 199.188.200.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.188.200.191, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR--64wFFssEn348h95INwAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Fri Nov 21 09:30:10.794517 2025] [:error] [pid 13326:tid 13362] [client 165.22.249.38:56917] [client 165.22.249.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.249.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR_Aoth942-HkDIkOWodHQAAAEQ"]
[Fri Nov 21 09:30:14.876347 2025] [:error] [pid 17882:tid 17908] [client 165.22.249.38:57279] [client 165.22.249.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.249.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR_ApowFFssEn348h95KcgAAAVg"]
[Fri Nov 21 10:51:35.657013 2025] [:error] [pid 46237:tid 46251] [client 198.54.114.85:60922] [client 198.54.114.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR_Ttyo2qlis7MUDbMIhFQAAAcw"]
[Fri Nov 21 10:51:36.805642 2025] [:error] [pid 46237:tid 46248] [client 198.54.114.85:60922] [client 198.54.114.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.54.114.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR_TuCo2qlis7MUDbMIhGQAAAck"], referer: https://expressinteriors.com/wp-login.php
[Fri Nov 21 11:02:34.815303 2025] [:error] [pid 17882:tid 17885] [client 162.19.58.174:48642] [client 162.19.58.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.19.58.174, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR_WSowFFssEn348h95nVwAAAUE"]
[Fri Nov 21 12:01:18.154521 2025] [:error] [pid 13326:tid 13373] [client 63.250.38.26:58198] [client 63.250.38.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR_kDth942-HkDIkOWpBIQAAAE8"]
[Fri Nov 21 12:01:29.466036 2025] [:error] [pid 46237:tid 46263] [client 63.250.38.26:60046] [client 63.250.38.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.38.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR_kGSo2qlis7MUDbMIsgAAAAdg"], referer: https://expressinteriors.com/wp-login.php
[Fri Nov 21 13:28:48.680758 2025] [:error] [pid 51434:tid 51449] [client 49.145.204.217:39805] [client 49.145.204.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.204.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aR_4kPU96liplEDkw_RSlgAAAQ0"]
[Fri Nov 21 13:45:45.350458 2025] [:error] [pid 13326:tid 13380] [client 205.196.217.56:39622] [client 205.196.217.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 205.196.217.56, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR_8idh942-HkDIkOWpqtgAAAFY"]
[Fri Nov 21 13:46:02.220013 2025] [:error] [pid 46194:tid 46204] [client 205.196.217.56:47574] [client 205.196.217.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 205.196.217.56, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aR_8mpDRPrSqclDqoQECoQAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Fri Nov 21 14:33:42.038779 2025] [:error] [pid 25554:tid 25560] [client 162.241.203.52:39468] [client 162.241.203.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.203.52, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSAHxh-NtB-9AzFZrk4KXAAAAQI"]
[Fri Nov 21 15:07:55.745497 2025] [:error] [pid 25554:tid 25575] [client 185.200.240.65:56952] [client 185.200.240.65] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.200.240.65, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSAPyx-NtB-9AzFZrk4g8QAAARE"]
[Fri Nov 21 15:07:57.489009 2025] [:error] [pid 25554:tid 25560] [client 185.200.240.65:56952] [client 185.200.240.65] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.200.240.65, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSAPzR-NtB-9AzFZrk4g_gAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Fri Nov 21 15:39:37.919477 2025] [:error] [pid 25431:tid 25493] [client 159.89.104.182:37366] [client 159.89.104.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.104.182, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSAXOcklhXxmoIExII0b8QAAAIY"]
[Fri Nov 21 16:11:39.102782 2025] [:error] [pid 25430:tid 25466] [client 49.145.204.217:39217] [client 49.145.204.217] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aSAeu6pnWJcWt_4foXlMEgAAAEY"]
[Fri Nov 21 16:13:19.612199 2025] [:error] [pid 46939:tid 46951] [client 49.145.204.217:40448] [client 49.145.204.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.204.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSAfH-0OmVoxD4VZ_Zl9JwAAAUk"]
[Fri Nov 21 16:14:35.401799 2025] [:error] [pid 25431:tid 25503] [client 49.145.204.217:41126] [client 49.145.204.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.204.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSAfa8klhXxmoIExII0-gAAAAJA"]
[Fri Nov 21 16:15:45.849072 2025] [:error] [pid 25430:tid 25481] [client 49.145.204.217:41379] [client 49.145.204.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.204.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSAfsapnWJcWt_4foXlNtAAAAFU"]
[Fri Nov 21 16:17:00.156343 2025] [:error] [pid 25521:tid 25542] [client 49.145.204.217:41733] [client 49.145.204.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.204.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSAf_PhXnBMilDddn3XzmwAAANM"]
[Fri Nov 21 16:18:13.091916 2025] [:error] [pid 25429:tid 25441] [client 49.145.204.217:38664] [client 49.145.204.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.204.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSAgRT4rZbRSr7vu-NO0AwAAAAg"]
[Fri Nov 21 16:56:24.766345 2025] [:error] [pid 25554:tid 25577] [client 170.106.179.68:53992] [client 170.106.179.68] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aSApOB-NtB-9AzFZrk5sSQAAARM"]
[Fri Nov 21 18:45:36.371625 2025] [:error] [pid 25429:tid 25451] [client 104.28.208.82:50538] [client 104.28.208.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.28.208.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSBC0D4rZbRSr7vu-NPbgwAAABI"]
[Fri Nov 21 19:06:16.708217 2025] [:error] [pid 25431:tid 25494] [client 134.149.18.28:63985] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aSBHqMklhXxmoIExII14CgAAAIc"]
[Fri Nov 21 19:06:30.241784 2025] [:error] [pid 25429:tid 25433] [client 134.149.18.28:60293] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aSBHtj4rZbRSr7vu-NPfewAAAAA"]
[Fri Nov 21 19:06:31.790610 2025] [:error] [pid 46939:tid 46966] [client 134.149.18.28:57813] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aSBHt-0OmVoxD4VZ_ZnLTQAAAVg"]
[Fri Nov 21 19:06:34.059810 2025] [:error] [pid 25521:tid 25536] [client 134.149.18.28:45971] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aSBHuvhXnBMilDddn3UlUgAAAM0"]
[Fri Nov 21 19:06:38.061247 2025] [:error] [pid 25431:tid 25493] [client 134.149.18.28:35468] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aSBHvsklhXxmoIExII14HgAAAIY"]
[Fri Nov 21 19:06:43.709293 2025] [:error] [pid 25521:tid 25530] [client 134.149.18.28:63924] [client 134.149.18.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSBHw_hXnBMilDddn3UlWwAAAMc"]
[Fri Nov 21 19:06:45.763282 2025] [:error] [pid 25521:tid 25535] [client 134.149.18.28:63874] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/BypassBest.php"] [unique_id "aSBHxfhXnBMilDddn3UlXgAAAMw"]
[Fri Nov 21 19:06:47.144117 2025] [:error] [pid 25554:tid 25559] [client 134.149.18.28:57843] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/BypassBest.php"] [unique_id "aSBHxx-NtB-9AzFZrk6Q2QAAAQE"]
[Fri Nov 21 19:06:49.444849 2025] [:error] [pid 25521:tid 25534] [client 134.149.18.28:63882] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/BypassBest.php"] [unique_id "aSBHyfhXnBMilDddn3UlZAAAAMs"]
[Fri Nov 21 19:06:51.022567 2025] [:error] [pid 25554:tid 25579] [client 134.149.18.28:63928] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/BypassBest.php"] [unique_id "aSBHyx-NtB-9AzFZrk6Q3gAAARU"]
[Fri Nov 21 19:06:52.205561 2025] [:error] [pid 46939:tid 46953] [client 134.149.18.28:35492] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aSBHzO0OmVoxD4VZ_ZnLVwAAAUs"]
[Fri Nov 21 19:07:00.013699 2025] [:error] [pid 25554:tid 25564] [client 134.149.18.28:56470] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aSBH1B-NtB-9AzFZrk6Q6AAAAQY"]
[Fri Nov 21 19:07:01.400997 2025] [:error] [pid 25431:tid 25490] [client 134.149.18.28:63930] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aSBH1cklhXxmoIExII14JQAAAIM"]
[Fri Nov 21 19:07:03.085887 2025] [:error] [pid 25521:tid 25530] [client 134.149.18.28:63876] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aSBH1_hXnBMilDddn3UlcgAAAMc"]
[Fri Nov 21 19:07:05.700220 2025] [:error] [pid 25430:tid 25480] [client 134.149.18.28:57820] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSBH2apnWJcWt_4foXl5BAAAAFQ"]
[Fri Nov 21 19:07:07.390960 2025] [:error] [pid 25431:tid 25509] [client 134.149.18.28:63877] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSBH28klhXxmoIExII14KAAAAJY"]
[Fri Nov 21 19:07:09.078411 2025] [:error] [pid 25431:tid 25499] [client 134.149.18.28:63922] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSBH3cklhXxmoIExII14KgAAAIw"]
[Fri Nov 21 19:07:10.477000 2025] [:error] [pid 46939:tid 46942] [client 134.149.18.28:35475] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSBH3u0OmVoxD4VZ_ZnLcAAAAUA"]
[Fri Nov 21 19:07:11.503931 2025] [:error] [pid 25431:tid 25508] [client 134.149.18.28:61649] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aSBH38klhXxmoIExII14LQAAAJU"]
[Fri Nov 21 19:07:12.626247 2025] [:error] [pid 25429:tid 25439] [client 134.149.18.28:63926] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aSBH4D4rZbRSr7vu-NPfqgAAAAY"]
[Fri Nov 21 19:07:14.909265 2025] [:error] [pid 25554:tid 25572] [client 134.149.18.28:35002] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aSBH4h-NtB-9AzFZrk6RAwAAAQ4"]
[Fri Nov 21 19:07:19.257266 2025] [:error] [pid 25431:tid 25501] [client 134.149.18.28:57246] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aSBH58klhXxmoIExII14MAAAAI4"]
[Fri Nov 21 19:07:38.974995 2025] [:error] [pid 25521:tid 25542] [client 134.149.18.28:35634] [client 134.149.18.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/zmFM.php"] [unique_id "aSBH-vhXnBMilDddn3UlsQAAANM"]
[Fri Nov 21 19:07:41.501868 2025] [proxy_fcgi:error] [pid 46939:tid 46942] [client 134.149.18.28:57277] AH01071: Got error 'Primary script unknown'
[Fri Nov 21 19:07:41.757450 2025] [:error] [pid 46939:tid 46963] [client 134.149.18.28:57277] [client 134.149.18.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/0.php"] [unique_id "aSBH_e0OmVoxD4VZ_ZnLjwAAAVU"]
[Fri Nov 21 19:07:47.263701 2025] [:error] [pid 25431:tid 25497] [client 134.149.18.28:35194] [client 134.149.18.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aSBIA8klhXxmoIExII14TAAAAIo"]
[Fri Nov 21 19:07:56.047918 2025] [:error] [pid 25554:tid 25581] [client 134.149.18.28:35586] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aSBIDB-NtB-9AzFZrk6RHAAAARc"]
[Fri Nov 21 19:07:57.141488 2025] [:error] [pid 46939:tid 46945] [client 134.149.18.28:35618] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aSBIDe0OmVoxD4VZ_ZnLmQAAAUM"]
[Fri Nov 21 19:07:58.189779 2025] [:error] [pid 25554:tid 25571] [client 134.149.18.28:35719] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aSBIDh-NtB-9AzFZrk6RHgAAAQ0"]
[Fri Nov 21 19:07:58.880394 2025] [:error] [pid 25521:tid 25547] [client 134.149.18.28:35745] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aSBIDvhXnBMilDddn3UlyAAAANg"]
[Fri Nov 21 19:08:01.407962 2025] [:error] [pid 25429:tid 25437] [client 134.149.18.28:59011] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aSBIET4rZbRSr7vu-NPf1gAAAAQ"]
[Fri Nov 21 19:08:02.726906 2025] [:error] [pid 25554:tid 25558] [client 134.149.18.28:35760] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aSBIEh-NtB-9AzFZrk6RIAAAAQA"]
[Fri Nov 21 19:08:05.210122 2025] [:error] [pid 25429:tid 25452] [client 134.149.18.28:59013] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aSBIFT4rZbRSr7vu-NPf2gAAABM"]
[Fri Nov 21 19:08:07.683620 2025] [:error] [pid 25521:tid 25539] [client 134.149.18.28:59060] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aSBIF_hXnBMilDddn3Ul0QAAANA"]
[Fri Nov 21 19:08:10.688679 2025] [:error] [pid 25521:tid 25528] [client 134.149.18.28:35734] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/fm.php"] [unique_id "aSBIGvhXnBMilDddn3Ul1QAAAMU"]
[Fri Nov 21 19:08:12.637729 2025] [:error] [pid 25554:tid 25560] [client 134.149.18.28:59024] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/fm.php"] [unique_id "aSBIHB-NtB-9AzFZrk6RKQAAAQI"]
[Fri Nov 21 19:08:19.246534 2025] [:error] [pid 25521:tid 25546] [client 134.149.18.28:35057] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/fm.php"] [unique_id "aSBII_hXnBMilDddn3Ul4wAAANc"]
[Fri Nov 21 19:08:20.947044 2025] [:error] [pid 25521:tid 25527] [client 134.149.18.28:35071] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/fm.php"] [unique_id "aSBIJPhXnBMilDddn3Ul6AAAAMQ"]
[Fri Nov 21 19:08:23.057903 2025] [:error] [pid 25429:tid 25440] [client 134.149.18.28:57745] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/17.php"] [unique_id "aSBIJz4rZbRSr7vu-NPf6gAAAAc"]
[Fri Nov 21 19:08:25.358058 2025] [:error] [pid 25521:tid 25526] [client 134.149.18.28:53912] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/17.php"] [unique_id "aSBIKfhXnBMilDddn3Ul-wAAAMM"]
[Fri Nov 21 19:08:27.450512 2025] [:error] [pid 25429:tid 25451] [client 134.149.18.28:35048] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/17.php"] [unique_id "aSBIKz4rZbRSr7vu-NPgCgAAABI"]
[Fri Nov 21 19:08:34.559172 2025] [:error] [pid 25554:tid 25560] [client 134.149.18.28:35066] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/17.php"] [unique_id "aSBIMh-NtB-9AzFZrk6RMgAAAQI"]
[Fri Nov 21 19:08:36.276906 2025] [:error] [pid 25429:tid 25449] [client 134.149.18.28:53938] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aSBIND4rZbRSr7vu-NPgDwAAABA"]
[Fri Nov 21 19:08:42.258097 2025] [:error] [pid 25429:tid 25435] [client 134.149.18.28:51584] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aSBIOj4rZbRSr7vu-NPgFAAAAAI"]
[Fri Nov 21 19:08:47.220404 2025] [:error] [pid 25431:tid 25494] [client 134.149.18.28:35020] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aSBIP8klhXxmoIExII14cAAAAIc"]
[Fri Nov 21 19:08:48.685135 2025] [:error] [pid 25554:tid 25567] [client 134.149.18.28:53888] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aSBIQB-NtB-9AzFZrk6ROAAAAQk"]
[Fri Nov 21 19:08:52.599621 2025] [:error] [pid 25429:tid 25450] [client 134.149.18.28:51585] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/Mailer.php"] [unique_id "aSBIRD4rZbRSr7vu-NPgGgAAABE"]
[Fri Nov 21 19:08:53.904437 2025] [:error] [pid 25431:tid 25510] [client 134.149.18.28:51592] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/Mailer.php"] [unique_id "aSBIRcklhXxmoIExII14dwAAAJc"]
[Fri Nov 21 19:08:54.938314 2025] [:error] [pid 46939:tid 46964] [client 134.149.18.28:35067] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/Mailer.php"] [unique_id "aSBIRu0OmVoxD4VZ_ZnLtwAAAVY"]
[Fri Nov 21 19:08:58.470130 2025] [:error] [pid 25431:tid 25507] [client 134.149.18.28:51597] [client 134.149.18.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSBISsklhXxmoIExII14gwAAAJQ"]
[Fri Nov 21 19:09:09.325710 2025] [autoindex:error] [pid 25429:tid 25447] [client 134.149.18.28:61077] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Nov 21 19:09:10.596895 2025] [:error] [pid 25429:tid 25434] [client 134.149.18.28:61077] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/123.php"] [unique_id "aSBIVj4rZbRSr7vu-NPgOAAAAAE"]
[Fri Nov 21 19:09:12.459052 2025] [:error] [pid 25554:tid 25566] [client 134.149.18.28:62739] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/123.php"] [unique_id "aSBIWB-NtB-9AzFZrk6RUwAAAQg"]
[Fri Nov 21 19:09:14.079624 2025] [:error] [pid 25430:tid 25481] [client 134.149.18.28:35343] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/123.php"] [unique_id "aSBIWqpnWJcWt_4foXl5ZgAAAFU"]
[Fri Nov 21 19:09:14.912778 2025] [:error] [pid 25554:tid 25578] [client 134.149.18.28:35581] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/123.php"] [unique_id "aSBIWh-NtB-9AzFZrk6RVAAAARQ"]
[Fri Nov 21 19:09:16.780082 2025] [:error] [pid 25431:tid 25489] [client 134.149.18.28:35353] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSBIXMklhXxmoIExII14lgAAAII"]
[Fri Nov 21 19:09:22.513657 2025] [:error] [pid 25521:tid 25537] [client 134.149.18.28:62721] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSBIYvhXnBMilDddn3UmQgAAAM4"]
[Fri Nov 21 19:09:24.296527 2025] [:error] [pid 25431:tid 25488] [client 134.149.18.28:62766] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSBIZMklhXxmoIExII14pQAAAIE"]
[Fri Nov 21 19:09:30.392901 2025] [:error] [pid 25521:tid 25542] [client 134.149.18.28:54533] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSBIavhXnBMilDddn3UmRgAAANM"]
[Fri Nov 21 19:09:45.641921 2025] [:error] [pid 25430:tid 25473] [client 134.149.18.28:35574] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "aSBIeapnWJcWt_4foXl5aQAAAE0"]
[Fri Nov 21 19:09:47.052495 2025] [:error] [pid 25430:tid 25475] [client 134.149.18.28:61151] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/multi.php"] [unique_id "aSBIe6pnWJcWt_4foXl5bAAAAE8"]
[Fri Nov 21 19:09:48.041950 2025] [:error] [pid 25521:tid 25539] [client 134.149.18.28:35788] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/multi.php"] [unique_id "aSBIfPhXnBMilDddn3UmSgAAANA"]
[Fri Nov 21 19:09:53.530156 2025] [:error] [pid 25431:tid 25487] [client 134.149.18.28:57307] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/multi.php"] [unique_id "aSBIgcklhXxmoIExII14tAAAAIA"]
[Fri Nov 21 19:09:59.034092 2025] [:error] [pid 25554:tid 25566] [client 134.149.18.28:57286] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/multi.php"] [unique_id "aSBIhx-NtB-9AzFZrk6RcQAAAQg"]
[Fri Nov 21 19:10:02.196320 2025] [:error] [pid 25521:tid 25539] [client 134.149.18.28:57300] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aSBIivhXnBMilDddn3UmVgAAANA"]
[Fri Nov 21 19:10:03.880774 2025] [:error] [pid 25521:tid 25545] [client 134.149.18.28:57294] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aSBIi_hXnBMilDddn3UmWwAAANY"]
[Fri Nov 21 19:10:07.533826 2025] [:error] [pid 25521:tid 25547] [client 134.149.18.28:56555] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aSBIj_hXnBMilDddn3UmXwAAANg"]
[Fri Nov 21 19:10:24.853393 2025] [:error] [pid 25430:tid 25482] [client 134.149.18.28:46060] [client 134.149.18.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.149.18.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSBIoKpnWJcWt_4foXl5dgAAAFY"]
[Fri Nov 21 19:10:34.264110 2025] [:error] [pid 25521:tid 25540] [client 134.149.18.28:35702] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aSBIqvhXnBMilDddn3UmiwAAANE"]
[Fri Nov 21 19:10:41.250693 2025] [:error] [pid 25554:tid 25580] [client 134.149.18.28:60334] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aSBIsR-NtB-9AzFZrk6RhgAAARY"]
[Fri Nov 21 19:10:43.893589 2025] [:error] [pid 25521:tid 25531] [client 134.149.18.28:60318] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aSBIs_hXnBMilDddn3UmpwAAAMg"]
[Fri Nov 21 19:10:46.134516 2025] [:error] [pid 25429:tid 25448] [client 134.149.18.28:60332] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aSBItj4rZbRSr7vu-NPglAAAAA8"]
[Fri Nov 21 19:10:49.682724 2025] [:error] [pid 25521:tid 25528] [client 134.149.18.28:46010] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oo.php"] [unique_id "aSBIufhXnBMilDddn3UmrwAAAMU"]
[Fri Nov 21 19:10:53.287937 2025] [:error] [pid 46939:tid 46943] [client 134.149.18.28:45975] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oo.php"] [unique_id "aSBIve0OmVoxD4VZ_ZnMBQAAAUE"]
[Fri Nov 21 19:10:54.216760 2025] [:error] [pid 25554:tid 25582] [client 134.149.18.28:45997] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oo.php"] [unique_id "aSBIvh-NtB-9AzFZrk6RjwAAARg"]
[Fri Nov 21 19:10:56.738889 2025] [:error] [pid 25431:tid 25499] [client 134.149.18.28:34824] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oo.php"] [unique_id "aSBIwMklhXxmoIExII147gAAAIw"]
[Fri Nov 21 19:10:58.147051 2025] [:error] [pid 46939:tid 46946] [client 134.149.18.28:60333] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfanew.php"] [unique_id "aSBIwu0OmVoxD4VZ_ZnMCgAAAUQ"]
[Fri Nov 21 19:11:00.283133 2025] [:error] [pid 25521:tid 25533] [client 134.149.18.28:34822] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfanew.php"] [unique_id "aSBIxPhXnBMilDddn3UmwgAAAMo"]
[Fri Nov 21 19:11:03.718447 2025] [:error] [pid 25554:tid 25570] [client 134.149.18.28:45965] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfanew.php"] [unique_id "aSBIxx-NtB-9AzFZrk6RkQAAAQw"]
[Fri Nov 21 19:11:05.539634 2025] [:error] [pid 25430:tid 25481] [client 134.149.18.28:34863] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfanew.php"] [unique_id "aSBIyapnWJcWt_4foXl5iAAAAFU"]
[Fri Nov 21 19:11:06.485174 2025] [:error] [pid 46939:tid 46943] [client 134.149.18.28:45994] [client 134.149.18.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aSBIyu0OmVoxD4VZ_ZnMJgAAAUE"]
[Fri Nov 21 19:11:10.374731 2025] [:error] [pid 46939:tid 46963] [client 134.149.18.28:59781] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSBIzu0OmVoxD4VZ_ZnMKAAAAVU"]
[Fri Nov 21 19:11:11.174334 2025] [:error] [pid 25431:tid 25498] [client 134.149.18.28:53964] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSBIz8klhXxmoIExII14_AAAAIs"]
[Fri Nov 21 19:11:13.326714 2025] [:error] [pid 25431:tid 25504] [client 134.149.18.28:56484] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSBI0cklhXxmoIExII15AAAAAJE"]
[Fri Nov 21 19:11:16.772992 2025] [:error] [pid 25521:tid 25525] [client 134.149.18.28:59792] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aSBI1PhXnBMilDddn3Um4QAAAMI"]
[Fri Nov 21 19:11:20.890682 2025] [:error] [pid 46939:tid 46963] [client 134.149.18.28:59868] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ll.php"] [unique_id "aSBI2O0OmVoxD4VZ_ZnMNgAAAVU"]
[Fri Nov 21 19:11:22.245578 2025] [:error] [pid 25554:tid 25576] [client 134.149.18.28:56460] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ll.php"] [unique_id "aSBI2h-NtB-9AzFZrk6RvQAAARI"]
[Fri Nov 21 19:11:25.256810 2025] [:error] [pid 25521:tid 25524] [client 134.149.18.28:56481] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ll.php"] [unique_id "aSBI3fhXnBMilDddn3Um8QAAAME"]
[Fri Nov 21 19:11:28.788475 2025] [:error] [pid 25521:tid 25542] [client 134.149.18.28:53997] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ll.php"] [unique_id "aSBI4PhXnBMilDddn3Um_QAAANM"]
[Fri Nov 21 19:11:40.183018 2025] [:error] [pid 25521:tid 25530] [client 134.149.18.28:56459] [client 134.149.18.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aSBI7PhXnBMilDddn3UnEwAAAMc"]
[Fri Nov 21 19:11:45.482989 2025] [:error] [pid 46939:tid 46961] [client 134.149.18.28:59785] [client 134.149.18.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSBI8e0OmVoxD4VZ_ZnMcwAAAVM"]
[Fri Nov 21 19:11:52.980522 2025] [:error] [pid 46939:tid 46946] [client 134.149.18.28:34830] [client 134.149.18.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSBI-O0OmVoxD4VZ_ZnMjgAAAUQ"]
[Fri Nov 21 19:12:01.429314 2025] [:error] [pid 25429:tid 25440] [client 134.149.18.28:59892] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSBJAT4rZbRSr7vu-NPg4QAAAAc"]
[Fri Nov 21 19:12:03.789765 2025] [:error] [pid 25521:tid 25525] [client 134.149.18.28:60322] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSBJA_hXnBMilDddn3UnTwAAAMI"]
[Fri Nov 21 19:12:04.941980 2025] [:error] [pid 25431:tid 25491] [client 134.149.18.28:60291] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSBJBMklhXxmoIExII15YwAAAIQ"]
[Fri Nov 21 19:12:06.151518 2025] [:error] [pid 25431:tid 25500] [client 134.149.18.28:34836] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSBJBsklhXxmoIExII15ZgAAAI0"]
[Fri Nov 21 19:12:09.371236 2025] [:error] [pid 25554:tid 25564] [client 134.149.18.28:60344] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/usage-file.php"] [unique_id "aSBJCR-NtB-9AzFZrk6R6gAAAQY"]
[Fri Nov 21 19:12:20.649547 2025] [:error] [pid 25430:tid 25463] [client 134.149.18.28:51708] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/usage-file.php"] [unique_id "aSBJFKpnWJcWt_4foXl59gAAAEM"]
[Fri Nov 21 19:12:21.971806 2025] [:error] [pid 25521:tid 25543] [client 134.149.18.28:46051] [client 134.149.18.28] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/assets/js/wp-config.php"] [unique_id "aSBJFfhXnBMilDddn3UnegAAANQ"]
[Fri Nov 21 19:12:46.083490 2025] [:error] [pid 25429:tid 25448] [client 134.149.18.28:54958] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aSBJLj4rZbRSr7vu-NPhCQAAAA8"]
[Fri Nov 21 19:12:48.163449 2025] [:error] [pid 25430:tid 25462] [client 134.149.18.28:35159] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aSBJMKpnWJcWt_4foXl6AgAAAEI"]
[Fri Nov 21 19:12:50.501967 2025] [:error] [pid 25430:tid 25484] [client 134.149.18.28:57228] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aSBJMqpnWJcWt_4foXl6BgAAAFg"]
[Fri Nov 21 19:12:53.143093 2025] [:error] [pid 25554:tid 25581] [client 134.149.18.28:57279] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aSBJNR-NtB-9AzFZrk6SIwAAARc"]
[Fri Nov 21 19:12:54.624045 2025] [:error] [pid 25431:tid 25507] [client 134.149.18.28:35482] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aSBJNsklhXxmoIExII15lAAAAJQ"]
[Fri Nov 21 19:12:56.480979 2025] [:error] [pid 46939:tid 46966] [client 134.149.18.28:34978] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aSBJOO0OmVoxD4VZ_ZnMzwAAAVg"]
[Fri Nov 21 19:12:58.056470 2025] [:error] [pid 46939:tid 46947] [client 134.149.18.28:57833] [client 134.149.18.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aSBJOu0OmVoxD4VZ_ZnM0AAAAUU"]
[Fri Nov 21 19:18:50.031028 2025] [:error] [pid 46939:tid 46953] [client 62.30.229.2:36662] [client 62.30.229.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.30.229.2, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSBKmu0OmVoxD4VZ_ZnO_QAAAUs"]
[Fri Nov 21 19:18:51.530617 2025] [:error] [pid 46939:tid 46946] [client 62.30.229.2:36662] [client 62.30.229.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.30.229.2, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSBKm-0OmVoxD4VZ_ZnO_wAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Nov 21 20:15:57.751372 2025] [:error] [pid 25430:tid 25474] [client 103.130.216.172:7374] [client 103.130.216.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.130.216.172, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSBX_apnWJcWt_4foXmK1gAAAE4"]
[Fri Nov 21 21:50:04.682627 2025] [:error] [pid 25430:tid 25480] [client 80.179.139.13:53390] [client 80.179.139.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.179.139.13, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSBuDKpnWJcWt_4foXmgAgAAAFQ"]
[Fri Nov 21 22:46:32.323395 2025] [:error] [pid 25430:tid 25471] [client 85.8.130.74:63035] [client 85.8.130.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.74, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSB7SKpnWJcWt_4foXmucgAAAEs"]
[Fri Nov 21 23:18:56.139124 2025] [:error] [pid 25521:tid 25535] [client 34.64.218.102:55248] [client 34.64.218.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.64.218.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSCC4PhXnBMilDddn3WKVAAAAMw"]
[Sat Nov 22 00:15:10.681645 2025] [:error] [pid 46939:tid 46963] [client 85.8.130.54:49561] [client 85.8.130.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSCQDu0OmVoxD4VZ_ZklhgAAAVU"]
[Sat Nov 22 00:29:24.884814 2025] [:error] [pid 50057:tid 50075] [client 192.250.235.25:35804] [client 192.250.235.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.235.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSCTZFb9j9fTBoI0sRUx5QAAARA"]
[Sat Nov 22 00:32:59.287109 2025] [:error] [pid 49642:tid 49898] [client 85.8.130.50:38461] [client 85.8.130.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSCUO4OXTPSuQfgUUtV77gAAAIc"]
[Sat Nov 22 00:48:41.814657 2025] [:error] [pid 9180:tid 9205] [client 173.212.197.119:37594] [client 173.212.197.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.212.197.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSCX6brk9msixUFV2i9_UgAAAFc"]
[Sat Nov 22 00:50:57.294518 2025] [:error] [pid 49642:tid 49899] [client 85.8.130.94:61431] [client 85.8.130.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.94, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSCYcYOXTPSuQfgUUtWCSgAAAIg"]
[Sat Nov 22 01:26:27.191609 2025] [:error] [pid 49642:tid 49908] [client 85.8.130.85:58883] [client 85.8.130.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSCgw4OXTPSuQfgUUtWQdAAAAJE"]
[Sat Nov 22 01:44:20.211227 2025] [:error] [pid 49643:tid 49923] [client 85.8.130.94:40669] [client 85.8.130.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.94, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSCk9JwUojIRHhF_fj-UsAAAAMQ"]
[Sat Nov 22 02:02:04.932200 2025] [:error] [pid 49643:tid 49921] [client 85.8.130.71:22617] [client 85.8.130.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSCpHJwUojIRHhF_fj-a5wAAAMI"]
[Sat Nov 22 02:12:38.285521 2025] [:error] [pid 9180:tid 9190] [client 103.132.181.183:59349] [client 103.132.181.183] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.132.181.183, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSCrlrrk9msixUFV2i-spwAAAEg"]
[Sat Nov 22 02:38:33.265975 2025] [:error] [pid 49641:tid 49843] [client 85.8.130.66:33389] [client 85.8.130.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.66, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSCxqVnhuiDak938N_bQEQAAABQ"]
[Sat Nov 22 03:27:07.396063 2025] [:error] [pid 36793:tid 36808] [client 103.174.10.73:47200] [client 103.174.10.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.174.10.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSC9C0esLMRgZFJ9pVUINgAAAAM"]
[Sat Nov 22 03:27:12.564099 2025] [:error] [pid 36793:tid 36816] [client 103.174.10.73:47200] [client 103.174.10.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.174.10.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSC9EEesLMRgZFJ9pVUIOQAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Sat Nov 22 03:35:15.155706 2025] [:error] [pid 8970:tid 9028] [client 85.8.130.61:48199] [client 85.8.130.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSC-85uSBcofSIY3VZB9swAAAFA"]
[Sat Nov 22 03:53:11.699356 2025] [:error] [pid 53566:tid 53572] [client 103.167.150.158:58987] [client 103.167.150.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/media/system/js/core.js"] [unique_id "aSDDJ8bSHDBkRbwMbd7w5wAAAMQ"]
[Sat Nov 22 03:53:12.031502 2025] [:error] [pid 53566:tid 53581] [client 85.8.130.65:63011] [client 85.8.130.65] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.65, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSDDKMbSHDBkRbwMbd7w6AAAAM0"]
[Sat Nov 22 04:29:52.617382 2025] [:error] [pid 25856:tid 25878] [client 85.203.21.46:23399] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/advanced-product-fields-for-woocommerce/db.php"] [unique_id "aSDLwBsTP0wy94zKUvFycAAAARQ"]
[Sat Nov 22 04:29:52.795944 2025] [:error] [pid 53566:tid 53570] [client 85.203.21.5:26349] [client 85.203.21.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/so-pinyin-slugs/inc/main_json.php"] [unique_id "aSDLwMbSHDBkRbwMbd4C3gAAAMI"]
[Sat Nov 22 04:29:52.997892 2025] [:error] [pid 53478:tid 53525] [client 85.203.21.3:46761] [client 85.203.21.3] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/theme-check/main.php"] [unique_id "aSDLwAhUYdXBbQswAdTiFAAAAFA"]
[Sat Nov 22 04:29:53.175645 2025] [:error] [pid 53479:tid 53553] [client 85.203.21.68:56603] [client 85.203.21.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/index.php"] [unique_id "aSDLwW6cicFF3Aas-oRKnwAAAJE"]
[Sat Nov 22 04:29:53.360948 2025] [:error] [pid 25856:tid 25876] [client 85.203.21.25:28251] [client 85.203.21.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/covr-wpcom/assets/fonts/manrope_normal.php"] [unique_id "aSDLwRsTP0wy94zKUvFydAAAARI"]
[Sat Nov 22 04:29:58.539356 2025] [:error] [pid 53479:tid 53560] [client 85.203.21.46:31669] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-parsidate/includes/admin/acf-fields-adyrui.php"] [unique_id "aSDLxm6cicFF3Aas-oRKqwAAAJg"]
[Sat Nov 22 04:29:58.719110 2025] [:error] [pid 53566:tid 53577] [client 85.203.21.37:38843] [client 85.203.21.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/aback.php"] [unique_id "aSDLxsbSHDBkRbwMbd4DDwAAAMk"]
[Sat Nov 22 04:29:58.897693 2025] [:error] [pid 53477:tid 53488] [client 85.203.21.44:64317] [client 85.203.21.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aSDLxn7Lu30Ku9O40aKviAAAAAc"]
[Sat Nov 22 04:30:04.075726 2025] [:error] [pid 25856:tid 25872] [client 85.203.21.18:20923] [client 85.203.21.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/moderation.php"] [unique_id "aSDLzBsTP0wy94zKUvFyqAAAAQ4"]
[Sat Nov 22 04:30:04.258306 2025] [:error] [pid 25856:tid 25859] [client 85.203.21.60:28801] [client 85.203.21.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/classwithtostring.php"] [unique_id "aSDLzBsTP0wy94zKUvFyqQAAAQE"]
[Sat Nov 22 04:30:04.434510 2025] [:error] [pid 25856:tid 25870] [client 85.203.21.8:36627] [client 85.203.21.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aSDLzBsTP0wy94zKUvFyqwAAAQw"]
[Sat Nov 22 04:30:09.610985 2025] [:error] [pid 53478:tid 53511] [client 85.203.21.56:28391] [client 85.203.21.56] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aSDL0QhUYdXBbQswAdTiZwAAAEI"]
[Sat Nov 22 04:30:09.791224 2025] [:error] [pid 53479:tid 53547] [client 85.203.21.19:33897] [client 85.203.21.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/erinyani/default.php"] [unique_id "aSDL0W6cicFF3Aas-oRKwQAAAIs"]
[Sat Nov 22 04:30:09.968073 2025] [:error] [pid 53566:tid 53577] [client 85.203.21.69:37299] [client 85.203.21.69] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/leaf.php"] [unique_id "aSDL0cbSHDBkRbwMbd4DbwAAAMk"]
[Sat Nov 22 04:30:10.145997 2025] [:error] [pid 25856:tid 25875] [client 85.203.21.43:36397] [client 85.203.21.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/mainhosting/default.php"] [unique_id "aSDL0hsTP0wy94zKUvFyxAAAARE"]
[Sat Nov 22 04:30:10.323422 2025] [:error] [pid 53479:tid 53539] [client 85.203.21.34:46907] [client 85.203.21.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/about.php"] [unique_id "aSDL0m6cicFF3Aas-oRKwwAAAIM"]
[Sat Nov 22 04:30:10.500606 2025] [:error] [pid 53566:tid 53589] [client 85.203.21.51:40459] [client 85.203.21.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/inc.php"] [unique_id "aSDL0sbSHDBkRbwMbd4DcQAAANU"]
[Sat Nov 22 04:30:10.683395 2025] [:error] [pid 53566:tid 53570] [client 85.203.21.36:30573] [client 85.203.21.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "aSDL0sbSHDBkRbwMbd4DcwAAAMI"]
[Sat Nov 22 04:30:10.860322 2025] [:error] [pid 53478:tid 53527] [client 85.203.21.17:34997] [client 85.203.21.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aSDL0ghUYdXBbQswAdTicwAAAFI"]
[Sat Nov 22 04:30:11.037393 2025] [:error] [pid 25856:tid 25865] [client 85.203.21.69:51135] [client 85.203.21.69] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/sim.php"] [unique_id "aSDL0xsTP0wy94zKUvFyywAAAQc"]
[Sat Nov 22 04:30:11.216785 2025] [:error] [pid 53479:tid 53549] [client 85.203.21.26:57791] [client 85.203.21.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aSDL026cicFF3Aas-oRKxgAAAI0"]
[Sat Nov 22 04:30:11.394965 2025] [:error] [pid 53479:tid 53552] [client 85.203.21.60:44927] [client 85.203.21.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aSDL026cicFF3Aas-oRKxwAAAJA"]
[Sat Nov 22 04:30:11.571350 2025] [:error] [pid 53477:tid 53486] [client 85.203.21.62:49567] [client 85.203.21.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aSDL037Lu30Ku9O40aKvowAAAAU"]
[Sat Nov 22 04:30:11.748726 2025] [:error] [pid 53566:tid 53571] [client 85.203.21.62:53455] [client 85.203.21.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aSDL08bSHDBkRbwMbd4DdgAAAMM"]
[Sat Nov 22 04:30:11.991578 2025] [:error] [pid 53566:tid 53568] [client 85.203.21.6:29043] [client 85.203.21.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xml.php"] [unique_id "aSDL08bSHDBkRbwMbd4DdwAAAMA"]
[Sat Nov 22 04:30:12.170996 2025] [:error] [pid 25856:tid 25864] [client 85.203.21.64:40427] [client 85.203.21.64] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aSDL1BsTP0wy94zKUvFy0gAAAQY"]
[Sat Nov 22 04:30:12.348510 2025] [:error] [pid 25856:tid 25872] [client 85.203.21.59:57511] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/images/class-config.php"] [unique_id "aSDL1BsTP0wy94zKUvFy1QAAAQ4"]
[Sat Nov 22 04:30:12.526167 2025] [:error] [pid 53477:tid 53497] [client 85.203.21.22:35099] [client 85.203.21.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aSDL1H7Lu30Ku9O40aKvpwAAABA"]
[Sat Nov 22 04:30:22.707543 2025] [:error] [pid 53478:tid 53524] [client 85.203.21.68:21937] [client 85.203.21.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/back.php"] [unique_id "aSDL3ghUYdXBbQswAdTioAAAAE8"]
[Sat Nov 22 04:30:22.885301 2025] [:error] [pid 53566:tid 53587] [client 85.203.21.49:41337] [client 85.203.21.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSDL3sbSHDBkRbwMbd4DlAAAANM"]
[Sat Nov 22 04:30:28.063111 2025] [:error] [pid 53479:tid 53541] [client 85.203.21.49:48749] [client 85.203.21.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/leafmailer2.8.php"] [unique_id "aSDL5G6cicFF3Aas-oRK6gAAAIU"]
[Sat Nov 22 04:30:28.239237 2025] [:error] [pid 25856:tid 25860] [client 85.203.21.48:56521] [client 85.203.21.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "aSDL5BsTP0wy94zKUvFzAwAAAQI"]
[Sat Nov 22 04:30:28.415003 2025] [:error] [pid 53478:tid 53525] [client 85.203.21.46:42267] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/up.php"] [unique_id "aSDL5AhUYdXBbQswAdTiwgAAAFA"]
[Sat Nov 22 04:30:28.600804 2025] [:error] [pid 25856:tid 25869] [client 85.203.21.68:64963] [client 85.203.21.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wsa.php"] [unique_id "aSDL5BsTP0wy94zKUvFzBgAAAQs"]
[Sat Nov 22 04:30:33.779597 2025] [:error] [pid 53479:tid 53560] [client 85.203.21.4:21569] [client 85.203.21.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-l0gin.php"] [unique_id "aSDL6W6cicFF3Aas-oRK8wAAAJg"]
[Sat Nov 22 04:30:33.963264 2025] [:error] [pid 25856:tid 25876] [client 85.203.21.67:65121] [client 85.203.21.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/uploads/index.php"] [unique_id "aSDL6RsTP0wy94zKUvFzIwAAARI"]
[Sat Nov 22 04:30:34.149499 2025] [:error] [pid 25856:tid 25869] [client 85.203.21.8:63873] [client 85.203.21.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentyfifteen/shell3.php"] [unique_id "aSDL6hsTP0wy94zKUvFzJQAAAQs"]
[Sat Nov 22 04:30:34.325259 2025] [:error] [pid 53566:tid 53577] [client 85.203.21.22:29689] [client 85.203.21.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/azusa/inc/wp-host.php"] [unique_id "aSDL6sbSHDBkRbwMbd4DpgAAAMk"]
[Sat Nov 22 04:30:34.503281 2025] [:error] [pid 25856:tid 25863] [client 85.203.21.55:50393] [client 85.203.21.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/better-wp-security/vendor-prod/composer/autoload.php"] [unique_id "aSDL6hsTP0wy94zKUvFzJgAAAQU"]
[Sat Nov 22 04:30:34.680666 2025] [:error] [pid 53479:tid 53558] [client 85.203.21.67:48947] [client 85.203.21.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce-to-wechatapp/vendor/overtrue/wechat/src/OpenPlatform/Authorizer/MiniProgram/Domain/Current.php"] [unique_id "aSDL6m6cicFF3Aas-oRK9QAAAJY"]
[Sat Nov 22 04:30:34.856414 2025] [:error] [pid 25856:tid 25860] [client 85.203.21.3:57077] [client 85.203.21.3] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "aSDL6hsTP0wy94zKUvFzKQAAAQI"]
[Sat Nov 22 04:30:35.033695 2025] [:error] [pid 25856:tid 25864] [client 85.203.21.13:32645] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/ga.php"] [unique_id "aSDL6xsTP0wy94zKUvFzKgAAAQY"]
[Sat Nov 22 04:30:40.214947 2025] [:error] [pid 53479:tid 53540] [client 85.203.21.69:24761] [client 85.203.21.69] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/theme-check/main.php"] [unique_id "aSDL8G6cicFF3Aas-oRLAwAAAIQ"]
[Sat Nov 22 04:30:40.393191 2025] [:error] [pid 25856:tid 25863] [client 85.203.21.5:47899] [client 85.203.21.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/list/144.php"] [unique_id "aSDL8BsTP0wy94zKUvFzNQAAAQU"]
[Sat Nov 22 04:30:40.570923 2025] [:error] [pid 53478:tid 53533] [client 85.203.21.14:36035] [client 85.203.21.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/mach.php"] [unique_id "aSDL8AhUYdXBbQswAdTi9AAAAFg"]
[Sat Nov 22 04:30:40.748219 2025] [:error] [pid 53477:tid 53501] [client 85.203.21.51:41811] [client 85.203.21.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aSDL8H7Lu30Ku9O40aKwCwAAABQ"]
[Sat Nov 22 04:30:40.927354 2025] [:error] [pid 25856:tid 25877] [client 85.203.21.7:59953] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/advanced-llms-txt-generator/assets/css/css_json.php"] [unique_id "aSDL8BsTP0wy94zKUvFzNwAAARM"]
[Sat Nov 22 04:30:41.103634 2025] [:error] [pid 25856:tid 25859] [client 85.203.21.21:63783] [client 85.203.21.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/kontol/kiw.php"] [unique_id "aSDL8RsTP0wy94zKUvFzOQAAAQE"]
[Sat Nov 22 04:30:41.281808 2025] [:error] [pid 25856:tid 25867] [client 85.203.21.11:56983] [client 85.203.21.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/theme-check/theme-check.php"] [unique_id "aSDL8RsTP0wy94zKUvFzOwAAAQk"]
[Sat Nov 22 04:30:46.460775 2025] [:error] [pid 53477:tid 53503] [client 85.203.21.49:27177] [client 85.203.21.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/autoload_classmap.php"] [unique_id "aSDL9n7Lu30Ku9O40aKwLQAAABY"]
[Sat Nov 22 04:30:46.637978 2025] [:error] [pid 53478:tid 53522] [client 85.203.21.15:29281] [client 85.203.21.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/chosen.php"] [unique_id "aSDL9ghUYdXBbQswAdTi_AAAAE0"]
[Sat Nov 22 04:30:46.814270 2025] [:error] [pid 53477:tid 53505] [client 85.203.21.64:62143] [client 85.203.21.64] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "aSDL9n7Lu30Ku9O40aKwLgAAABg"]
[Sat Nov 22 04:30:46.990907 2025] [:error] [pid 53566:tid 53582] [client 85.203.21.49:48565] [client 85.203.21.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/cloud.php"] [unique_id "aSDL9sbSHDBkRbwMbd4D1QAAAM4"]
[Sat Nov 22 04:30:47.171989 2025] [:error] [pid 53479:tid 53551] [client 85.203.21.21:27461] [client 85.203.21.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wp-content.php"] [unique_id "aSDL926cicFF3Aas-oRLDgAAAI8"]
[Sat Nov 22 04:30:47.349151 2025] [:error] [pid 25856:tid 25875] [client 85.203.21.2:62637] [client 85.203.21.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-post-data.php"] [unique_id "aSDL9xsTP0wy94zKUvFzXwAAARE"]
[Sat Nov 22 04:30:47.525849 2025] [:error] [pid 53479:tid 53557] [client 85.203.21.60:20349] [client 85.203.21.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aSDL926cicFF3Aas-oRLDwAAAJU"]
[Sat Nov 22 04:30:47.703352 2025] [:error] [pid 53479:tid 53536] [client 85.203.21.38:20585] [client 85.203.21.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/m.php"] [unique_id "aSDL926cicFF3Aas-oRLEAAAAIA"]
[Sat Nov 22 04:30:47.882864 2025] [:error] [pid 53477:tid 53502] [client 85.203.21.46:51863] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/coffee/colors_26.php"] [unique_id "aSDL937Lu30Ku9O40aKwMQAAABU"]
[Sat Nov 22 04:30:53.061123 2025] [:error] [pid 53566:tid 53579] [client 85.203.21.59:60447] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-backing.php"] [unique_id "aSDL_cbSHDBkRbwMbd4D6QAAAMs"]
[Sat Nov 22 04:30:53.252642 2025] [:error] [pid 53479:tid 53555] [client 85.203.21.8:47825] [client 85.203.21.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/wp-backing.php"] [unique_id "aSDL_W6cicFF3Aas-oRLIAAAAJM"]
[Sat Nov 22 04:30:53.432509 2025] [:error] [pid 25856:tid 25867] [client 85.203.21.5:32791] [client 85.203.21.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/covr-wpcom/assets/fonts/manrope.php"] [unique_id "aSDL_RsTP0wy94zKUvFzeQAAAQk"]
[Sat Nov 22 04:30:53.610614 2025] [:error] [pid 25856:tid 25858] [client 85.203.21.50:42063] [client 85.203.21.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/acxx.php"] [unique_id "aSDL_RsTP0wy94zKUvFzewAAAQA"]
[Sat Nov 22 04:30:53.788467 2025] [:error] [pid 25856:tid 25881] [client 85.203.21.51:56819] [client 85.203.21.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/modern/about.php"] [unique_id "aSDL_RsTP0wy94zKUvFzfAAAARc"]
[Sat Nov 22 04:30:53.967599 2025] [:error] [pid 25856:tid 25874] [client 85.203.21.50:31909] [client 85.203.21.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/class-ftp.php"] [unique_id "aSDL_RsTP0wy94zKUvFzfQAAARA"]
[Sat Nov 22 04:30:59.144618 2025] [:error] [pid 53478:tid 53528] [client 85.203.21.34:43547] [client 85.203.21.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/akismet/_inc/img/about.php"] [unique_id "aSDMAwhUYdXBbQswAdTjFQAAAFM"]
[Sat Nov 22 04:30:59.322827 2025] [:error] [pid 53477:tid 53490] [client 85.203.21.69:20211] [client 85.203.21.69] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/call-now-button/src/about.php"] [unique_id "aSDMA37Lu30Ku9O40aKwVQAAAAk"]
[Sat Nov 22 04:30:59.500322 2025] [:error] [pid 53566:tid 53571] [client 85.203.21.37:40025] [client 85.203.21.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/about.php"] [unique_id "aSDMA8bSHDBkRbwMbd4EAQAAAMM"]
[Sat Nov 22 04:30:59.681626 2025] [:error] [pid 25856:tid 25875] [client 85.203.21.15:39247] [client 85.203.21.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/admin/pages/about.php"] [unique_id "aSDMAxsTP0wy94zKUvFzpQAAARE"]
[Sat Nov 22 04:30:59.858518 2025] [:error] [pid 53477:tid 53500] [client 85.203.21.34:37733] [client 85.203.21.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-mail-smtp/assets/about.php"] [unique_id "aSDMA37Lu30Ku9O40aKwVgAAABM"]
[Sat Nov 22 04:31:05.036501 2025] [:error] [pid 53566:tid 53571] [client 85.203.21.14:51389] [client 85.203.21.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-smushit/_src/js/common/about.php"] [unique_id "aSDMCcbSHDBkRbwMbd4ECwAAAMM"]
[Sat Nov 22 04:31:05.214337 2025] [:error] [pid 53479:tid 53536] [client 85.203.21.15:53801] [client 85.203.21.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-smushit/core/modules/background/about.php"] [unique_id "aSDMCW6cicFF3Aas-oRLLQAAAIA"]
[Sat Nov 22 04:31:05.393648 2025] [:error] [pid 53566:tid 53580] [client 85.203.21.21:54987] [client 85.203.21.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/about.php"] [unique_id "aSDMCcbSHDBkRbwMbd4EDwAAAMw"]
[Sat Nov 22 04:31:05.573091 2025] [:error] [pid 25856:tid 25873] [client 85.203.21.47:54007] [client 85.203.21.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/inc/blog/about.php"] [unique_id "aSDMCRsTP0wy94zKUvFzwgAAAQ8"]
[Sat Nov 22 04:31:05.750660 2025] [:error] [pid 53479:tid 53539] [client 85.203.21.43:51071] [client 85.203.21.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/template-parts/advanced-footer/about.php"] [unique_id "aSDMCW6cicFF3Aas-oRLMQAAAIM"]
[Sat Nov 22 04:31:05.927307 2025] [:error] [pid 53479:tid 53550] [client 85.203.21.43:27635] [client 85.203.21.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/wp-login.php"] [unique_id "aSDMCW6cicFF3Aas-oRLNQAAAI4"]
[Sat Nov 22 04:31:06.103847 2025] [:error] [pid 53479:tid 53537] [client 85.203.21.4:25591] [client 85.203.21.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/paradox/option-tree/assets/js/vendor/jquery/about.php"] [unique_id "aSDMCm6cicFF3Aas-oRLOAAAAIE"]
[Sat Nov 22 04:31:06.280307 2025] [:error] [pid 25856:tid 25858] [client 85.203.21.3:50233] [client 85.203.21.3] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfive/assets/fonts/roboto-slab/about.php"] [unique_id "aSDMChsTP0wy94zKUvFzxAAAAQA"]
[Sat Nov 22 04:31:06.457293 2025] [:error] [pid 53477:tid 53496] [client 85.203.21.42:42627] [client 85.203.21.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wpseo-import/about.php"] [unique_id "aSDMCn7Lu30Ku9O40aKwkgAAAA8"]
[Sat Nov 22 04:31:06.633858 2025] [:error] [pid 53566:tid 53571] [client 85.203.21.7:44353] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Cookie/about.php"] [unique_id "aSDMCsbSHDBkRbwMbd4EHAAAAMM"]
[Sat Nov 22 04:31:06.811458 2025] [:error] [pid 53477:tid 53486] [client 85.203.21.2:46307] [client 85.203.21.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Proxy/about.php"] [unique_id "aSDMCn7Lu30Ku9O40aKwkwAAAAU"]
[Sat Nov 22 04:31:06.988462 2025] [:error] [pid 53478:tid 53523] [client 85.203.21.21:32547] [client 85.203.21.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Utility/about.php"] [unique_id "aSDMCghUYdXBbQswAdTjNgAAAE4"]
[Sat Nov 22 04:31:07.164360 2025] [:error] [pid 53477:tid 53493] [client 85.203.21.30:62827] [client 85.203.21.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comment-date/about.php"] [unique_id "aSDMC37Lu30Ku9O40aKwlQAAAAw"]
[Sat Nov 22 04:31:07.341253 2025] [:error] [pid 53478:tid 53510] [client 85.203.21.7:56045] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comments-pagination-numbers/about.php"] [unique_id "aSDMCwhUYdXBbQswAdTjNwAAAEE"]
[Sat Nov 22 04:31:07.521168 2025] [:error] [pid 53477:tid 53491] [client 85.203.21.37:59413] [client 85.203.21.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comments-title/about.php"] [unique_id "aSDMC37Lu30Ku9O40aKwlwAAAAo"]
[Sat Nov 22 04:31:07.698821 2025] [:error] [pid 53478:tid 53526] [client 85.203.21.50:52893] [client 85.203.21.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/image/about.php"] [unique_id "aSDMCwhUYdXBbQswAdTjOQAAAFE"]
[Sat Nov 22 04:31:07.874698 2025] [:error] [pid 53477:tid 53501] [client 85.203.21.13:33173] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/latest-posts/about.php"] [unique_id "aSDMC37Lu30Ku9O40aKwmAAAABQ"]
[Sat Nov 22 04:31:13.053443 2025] [:error] [pid 25856:tid 25875] [client 85.203.21.42:46913] [client 85.203.21.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/page-list-item/about.php"] [unique_id "aSDMERsTP0wy94zKUvFz7QAAARE"]
[Sat Nov 22 04:31:13.229924 2025] [:error] [pid 53478:tid 53515] [client 85.203.21.56:42271] [client 85.203.21.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/site-title/about.php"] [unique_id "aSDMEQhUYdXBbQswAdTjVQAAAEY"]
[Sat Nov 22 04:31:18.407780 2025] [:error] [pid 25856:tid 25880] [client 85.203.21.59:47625] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/about.php"] [unique_id "aSDMFhsTP0wy94zKUvF0DgAAARY"]
[Sat Nov 22 04:31:18.584255 2025] [:error] [pid 25856:tid 25867] [client 85.203.21.44:34603] [client 85.203.21.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/wptextpattern/about.php"] [unique_id "aSDMFhsTP0wy94zKUvF0DwAAAQk"]
[Sat Nov 22 04:31:23.762790 2025] [:error] [pid 53477:tid 53495] [client 85.203.21.69:58117] [client 85.203.21.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/av.php"] [unique_id "aSDMG37Lu30Ku9O40aKw5AAAAA4"]
[Sat Nov 22 04:31:23.938984 2025] [:error] [pid 25856:tid 25880] [client 85.203.21.26:21389] [client 85.203.21.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/namespaced/Core/about.php"] [unique_id "aSDMGxsTP0wy94zKUvF0MgAAARY"]
[Sat Nov 22 04:31:24.117993 2025] [:error] [pid 53566:tid 53581] [client 85.203.21.36:27143] [client 85.203.21.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/new.php"] [unique_id "aSDMHMbSHDBkRbwMbd4EdgAAAM0"]
[Sat Nov 22 04:31:24.299264 2025] [:error] [pid 25856:tid 25882] [client 85.203.21.50:21565] [client 85.203.21.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/block-directory/index.php"] [unique_id "aSDMHBsTP0wy94zKUvF0NQAAARg"]
[Sat Nov 22 04:31:24.495047 2025] [:error] [pid 53478:tid 53512] [client 85.203.21.19:30849] [client 85.203.21.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/back.php"] [unique_id "aSDMHAhUYdXBbQswAdTjjQAAAEM"]
[Sat Nov 22 04:31:24.672464 2025] [:error] [pid 25856:tid 25866] [client 85.203.21.59:21153] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/aves.php"] [unique_id "aSDMHBsTP0wy94zKUvF0NwAAAQg"]
[Sat Nov 22 04:31:24.847746 2025] [:error] [pid 53477:tid 53481] [client 85.203.21.27:46957] [client 85.203.21.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aSDMHH7Lu30Ku9O40aKw7AAAAAA"]
[Sat Nov 22 04:31:25.025740 2025] [:error] [pid 53479:tid 53537] [client 85.203.21.9:26291] [client 85.203.21.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aSDMHW6cicFF3Aas-oRLcAAAAIE"]
[Sat Nov 22 04:31:25.206034 2025] [:error] [pid 25856:tid 25859] [client 85.203.21.4:45041] [client 85.203.21.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aSDMHRsTP0wy94zKUvF0OwAAAQE"]
[Sat Nov 22 04:31:25.392055 2025] [:error] [pid 53477:tid 53500] [client 85.203.21.9:38223] [client 85.203.21.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aSDMHX7Lu30Ku9O40aKw7gAAABM"]
[Sat Nov 22 04:31:25.568237 2025] [:error] [pid 53478:tid 53533] [client 85.203.21.60:60013] [client 85.203.21.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aSDMHQhUYdXBbQswAdTjlAAAAFg"]
[Sat Nov 22 04:31:25.747357 2025] [:error] [pid 25856:tid 25874] [client 85.203.21.11:55495] [client 85.203.21.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aSDMHRsTP0wy94zKUvF0PQAAARA"]
[Sat Nov 22 04:31:25.925921 2025] [:error] [pid 53479:tid 53552] [client 85.203.21.3:33365] [client 85.203.21.3] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aSDMHW6cicFF3Aas-oRLdgAAAJA"]
[Sat Nov 22 04:31:26.112868 2025] [:error] [pid 53477:tid 53486] [client 85.203.21.42:45587] [client 85.203.21.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSDMHn7Lu30Ku9O40aKw9QAAAAU"]
[Sat Nov 22 04:31:26.291734 2025] [:error] [pid 25856:tid 25880] [client 85.203.21.37:45139] [client 85.203.21.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aSDMHhsTP0wy94zKUvF0PwAAARY"]
[Sat Nov 22 04:31:26.492200 2025] [:error] [pid 53479:tid 53544] [client 85.203.21.13:25931] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aSDMHm6cicFF3Aas-oRLdwAAAIg"]
[Sat Nov 22 04:31:26.671482 2025] [:error] [pid 53477:tid 53494] [client 85.203.21.11:36823] [client 85.203.21.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aSDMHn7Lu30Ku9O40aKw-gAAAA0"]
[Sat Nov 22 04:31:26.849619 2025] [:error] [pid 53477:tid 53493] [client 85.203.21.44:25143] [client 85.203.21.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/load.php"] [unique_id "aSDMHn7Lu30Ku9O40aKw_AAAAAw"]
[Sat Nov 22 04:31:27.031422 2025] [:error] [pid 25856:tid 25882] [client 85.203.21.44:51217] [client 85.203.21.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aSDMHxsTP0wy94zKUvF0QQAAARg"]
[Sat Nov 22 04:31:27.210725 2025] [:error] [pid 53477:tid 53483] [client 85.203.21.22:39179] [client 85.203.21.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aSDMH37Lu30Ku9O40aKxBgAAAAI"]
[Sat Nov 22 04:31:27.401888 2025] [:error] [pid 53478:tid 53521] [client 85.203.21.26:37015] [client 85.203.21.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aSDMHwhUYdXBbQswAdTjmAAAAEw"]
[Sat Nov 22 04:31:27.581495 2025] [:error] [pid 25856:tid 25862] [client 85.203.21.30:57283] [client 85.203.21.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/"] [unique_id "aSDMHxsTP0wy94zKUvF0QwAAAQQ"]
[Sat Nov 22 04:31:27.759149 2025] [:error] [pid 53566:tid 53571] [client 85.203.21.2:45163] [client 85.203.21.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2024/index.php"] [unique_id "aSDMH8bSHDBkRbwMbd4EigAAAMM"]
[Sat Nov 22 04:31:27.936600 2025] [:error] [pid 25856:tid 25875] [client 85.203.21.3:25301] [client 85.203.21.3] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aSDMHxsTP0wy94zKUvF0RAAAARE"]
[Sat Nov 22 04:31:28.114187 2025] [:error] [pid 53477:tid 53500] [client 85.203.21.42:24313] [client 85.203.21.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/classwithtostring.php"] [unique_id "aSDMIH7Lu30Ku9O40aKxEAAAABM"]
[Sat Nov 22 04:31:28.294692 2025] [:error] [pid 53479:tid 53548] [client 85.203.21.12:64115] [client 85.203.21.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/index.php"] [unique_id "aSDMIG6cicFF3Aas-oRLfAAAAIw"]
[Sat Nov 22 04:31:28.470855 2025] [:error] [pid 53479:tid 53559] [client 85.203.21.29:43929] [client 85.203.21.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aSDMIG6cicFF3Aas-oRLfQAAAJc"]
[Sat Nov 22 04:31:33.650531 2025] [:error] [pid 53477:tid 53491] [client 85.203.21.14:60247] [client 85.203.21.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/about.php"] [unique_id "aSDMJX7Lu30Ku9O40aKxLAAAAAo"]
[Sat Nov 22 04:31:33.828956 2025] [:error] [pid 53478:tid 53522] [client 85.203.21.22:65455] [client 85.203.21.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/admin.php"] [unique_id "aSDMJQhUYdXBbQswAdTj3AAAAE0"]
[Sat Nov 22 04:31:34.009682 2025] [:error] [pid 25856:tid 25874] [client 85.203.21.46:53669] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aSDMJhsTP0wy94zKUvF0WgAAARA"]
[Sat Nov 22 04:31:34.186730 2025] [:error] [pid 53479:tid 53552] [client 85.203.21.46:61851] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aSDMJm6cicFF3Aas-oRLlgAAAJA"]
[Sat Nov 22 04:31:34.366317 2025] [:error] [pid 53479:tid 53544] [client 85.203.21.6:36729] [client 85.203.21.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/admin-header.php"] [unique_id "aSDMJm6cicFF3Aas-oRLlwAAAIg"]
[Sat Nov 22 04:31:34.543511 2025] [:error] [pid 25856:tid 25871] [client 85.203.21.21:24845] [client 85.203.21.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "aSDMJhsTP0wy94zKUvF0XgAAAQ0"]
[Sat Nov 22 04:31:39.721003 2025] [:error] [pid 25856:tid 25860] [client 85.203.21.49:33591] [client 85.203.21.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "aSDMKxsTP0wy94zKUvF0kAAAAQI"]
[Sat Nov 22 04:31:41.387743 2025] [:error] [pid 53566:tid 53576] [client 85.203.21.14:31121] [client 85.203.21.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/404.php"] [unique_id "aSDMLcbSHDBkRbwMbd4E2QAAAMg"]
[Sat Nov 22 04:31:41.564940 2025] [:error] [pid 53478:tid 53533] [client 85.203.21.17:59179] [client 85.203.21.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "aSDMLQhUYdXBbQswAdTkBAAAAFg"]
[Sat Nov 22 04:31:51.742184 2025] [:error] [pid 53478:tid 53526] [client 85.203.21.30:21393] [client 85.203.21.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/revslider/includes/external/page/index.php"] [unique_id "aSDMNwhUYdXBbQswAdTkNgAAAFE"]
[Sat Nov 22 04:31:51.921640 2025] [:error] [pid 53477:tid 53487] [client 85.203.21.42:55501] [client 85.203.21.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-config-sample.php"] [unique_id "aSDMN37Lu30Ku9O40aKxkgAAAAY"]
[Sat Nov 22 04:31:52.098448 2025] [:error] [pid 53477:tid 53493] [client 85.203.21.48:53709] [client 85.203.21.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aSDMOH7Lu30Ku9O40aKxlgAAAAw"]
[Sat Nov 22 04:31:52.286505 2025] [:error] [pid 53477:tid 53484] [client 85.203.21.64:31523] [client 85.203.21.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aSDMOH7Lu30Ku9O40aKxmAAAAAM"]
[Sat Nov 22 04:31:52.462739 2025] [:error] [pid 25856:tid 25865] [client 85.203.21.47:23611] [client 85.203.21.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/nav.php"] [unique_id "aSDMOBsTP0wy94zKUvF00QAAAQc"]
[Sat Nov 22 04:31:52.653015 2025] [:error] [pid 25856:tid 25876] [client 85.203.21.4:41985] [client 85.203.21.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/sketch/404.php"] [unique_id "aSDMOBsTP0wy94zKUvF00wAAARI"]
[Sat Nov 22 04:31:52.831420 2025] [:error] [pid 53479:tid 53539] [client 85.203.21.47:31033] [client 85.203.21.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/files/"] [unique_id "aSDMOG6cicFF3Aas-oRLzAAAAIM"]
[Sat Nov 22 04:31:58.009822 2025] [:error] [pid 53479:tid 53550] [client 85.203.21.13:46089] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aSDMPm6cicFF3Aas-oRL9QAAAI4"]
[Sat Nov 22 04:31:58.273716 2025] [:error] [pid 53479:tid 53559] [client 85.203.21.59:28435] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/"] [unique_id "aSDMPm6cicFF3Aas-oRL-AAAAJc"]
[Sat Nov 22 04:32:03.456894 2025] [:error] [pid 25856:tid 25864] [client 85.203.21.6:62467] [client 85.203.21.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aSDMQxsTP0wy94zKUvF05wAAAQY"]
[Sat Nov 22 04:32:08.635823 2025] [:error] [pid 53479:tid 53547] [client 85.203.21.13:51335] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/"] [unique_id "aSDMSG6cicFF3Aas-oRMZQAAAIs"]
[Sat Nov 22 04:32:28.830443 2025] [:error] [pid 53566:tid 53584] [client 85.203.21.48:46263] [client 85.203.21.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aSDMXMbSHDBkRbwMbd4F-gAAANA"]
[Sat Nov 22 04:32:29.098678 2025] [:error] [pid 53478:tid 53523] [client 85.203.21.21:49475] [client 85.203.21.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/index.php"] [unique_id "aSDMXQhUYdXBbQswAdTktAAAAE4"]
[Sat Nov 22 04:32:29.275722 2025] [:error] [pid 25856:tid 25864] [client 85.203.21.34:43827] [client 85.203.21.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-file.php"] [unique_id "aSDMXRsTP0wy94zKUvF1MwAAAQY"]
[Sat Nov 22 04:32:29.455261 2025] [:error] [pid 25856:tid 25858] [client 85.203.21.68:21761] [client 85.203.21.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "aSDMXRsTP0wy94zKUvF1NAAAAQA"]
[Sat Nov 22 04:32:29.633087 2025] [:error] [pid 25856:tid 25877] [client 85.203.21.13:62795] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ws.php"] [unique_id "aSDMXRsTP0wy94zKUvF1NQAAARM"]
[Sat Nov 22 04:32:29.809494 2025] [:error] [pid 25856:tid 25859] [client 85.203.21.37:20767] [client 85.203.21.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ty.php"] [unique_id "aSDMXRsTP0wy94zKUvF1NgAAAQE"]
[Sat Nov 22 04:32:29.987453 2025] [:error] [pid 53477:tid 53503] [client 85.203.21.43:35601] [client 85.203.21.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aSDMXX7Lu30Ku9O40aKx4wAAABY"]
[Sat Nov 22 04:32:30.166025 2025] [:error] [pid 53478:tid 53530] [client 85.203.21.49:47199] [client 85.203.21.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aSDMXghUYdXBbQswAdTkuQAAAFU"]
[Sat Nov 22 04:32:30.343585 2025] [:error] [pid 25856:tid 25880] [client 85.203.21.7:28055] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aSDMXhsTP0wy94zKUvF1OAAAARY"]
[Sat Nov 22 04:32:30.521834 2025] [:error] [pid 53566:tid 53588] [client 85.203.21.13:26571] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/license.php"] [unique_id "aSDMXsbSHDBkRbwMbd4GAgAAANQ"]
[Sat Nov 22 04:32:30.708279 2025] [:error] [pid 53478:tid 53517] [client 85.203.21.43:22637] [client 85.203.21.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/admin-ajax.php"] [unique_id "aSDMXghUYdXBbQswAdTkvQAAAEg"]
[Sat Nov 22 04:32:30.884962 2025] [:error] [pid 53479:tid 53542] [client 85.203.21.43:44235] [client 85.203.21.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/WordPressCore/include.php"] [unique_id "aSDMXm6cicFF3Aas-oRMnwAAAIY"]
[Sat Nov 22 04:32:31.061506 2025] [:error] [pid 25856:tid 25874] [client 85.203.21.25:40283] [client 85.203.21.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content.php"] [unique_id "aSDMXxsTP0wy94zKUvF1OwAAARA"]
[Sat Nov 22 04:32:31.238727 2025] [:error] [pid 25856:tid 25863] [client 85.203.21.27:42781] [client 85.203.21.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-configs.php"] [unique_id "aSDMXxsTP0wy94zKUvF1PgAAAQU"]
[Sat Nov 22 04:32:31.415482 2025] [:error] [pid 53566:tid 53579] [client 85.203.21.69:61317] [client 85.203.21.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aSDMX8bSHDBkRbwMbd4GAwAAAMs"]
[Sat Nov 22 04:32:31.592220 2025] [:error] [pid 53566:tid 53581] [client 85.203.21.51:64115] [client 85.203.21.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/components/index.php"] [unique_id "aSDMX8bSHDBkRbwMbd4GBwAAAM0"]
[Sat Nov 22 04:32:31.768633 2025] [:error] [pid 53477:tid 53492] [client 85.203.21.17:58527] [client 85.203.21.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aSDMX37Lu30Ku9O40aKx5QAAAAs"]
[Sat Nov 22 04:32:36.946564 2025] [:error] [pid 53478:tid 53517] [client 85.203.21.4:37425] [client 85.203.21.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aSDMZAhUYdXBbQswAdTkxwAAAEg"]
[Sat Nov 22 04:32:37.125773 2025] [:error] [pid 53479:tid 53546] [client 85.203.21.12:62831] [client 85.203.21.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/zasf"] [unique_id "aSDMZW6cicFF3Aas-oRMpwAAAIo"]
[Sat Nov 22 04:32:37.305094 2025] [:error] [pid 53479:tid 53537] [client 85.203.21.5:53389] [client 85.203.21.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aSDMZW6cicFF3Aas-oRMqAAAAIE"]
[Sat Nov 22 04:32:37.491478 2025] [:error] [pid 53478:tid 53514] [client 85.203.21.50:56111] [client 85.203.21.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-json-ajax-session.php"] [unique_id "aSDMZQhUYdXBbQswAdTkyAAAAEU"]
[Sat Nov 22 04:32:37.719434 2025] [:error] [pid 53566:tid 53591] [client 85.203.21.69:49477] [client 85.203.21.69] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSDMZcbSHDBkRbwMbd4GIQAAANc"]
[Sat Nov 22 04:32:37.896072 2025] [:error] [pid 53566:tid 53588] [client 85.203.21.25:27925] [client 85.203.21.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aSDMZcbSHDBkRbwMbd4GIwAAANQ"]
[Sat Nov 22 04:32:38.073678 2025] [:error] [pid 25856:tid 25874] [client 85.203.21.59:46461] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-conflg.php"] [unique_id "aSDMZhsTP0wy94zKUvF1WAAAARA"]
[Sat Nov 22 04:32:43.351863 2025] [:error] [pid 53478:tid 53521] [client 85.203.21.7:23017] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/"] [unique_id "aSDMawhUYdXBbQswAdTk1QAAAEw"]
[Sat Nov 22 04:32:48.530881 2025] [:error] [pid 25856:tid 25872] [client 85.203.21.26:26219] [client 85.203.21.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/archives/"] [unique_id "aSDMcBsTP0wy94zKUvF1dAAAAQ4"]
[Sat Nov 22 04:32:48.708901 2025] [:error] [pid 25856:tid 25880] [client 85.203.21.15:60777] [client 85.203.21.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSDMcBsTP0wy94zKUvF1dwAAARY"]
[Sat Nov 22 04:32:48.887366 2025] [:error] [pid 53566:tid 53576] [client 85.203.21.49:62433] [client 85.203.21.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSDMcMbSHDBkRbwMbd4GUwAAAMg"]
[Sat Nov 22 04:32:54.064449 2025] [:error] [pid 53478:tid 53510] [client 85.203.21.34:46243] [client 85.203.21.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "aSDMdghUYdXBbQswAdTk7gAAAEE"]
[Sat Nov 22 04:32:59.248100 2025] [:error] [pid 53477:tid 53504] [client 85.203.21.11:41267] [client 85.203.21.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/about.php"] [unique_id "aSDMe37Lu30Ku9O40aKyFgAAABc"]
[Sat Nov 22 04:33:04.425653 2025] [:error] [pid 53479:tid 53549] [client 85.203.21.25:34097] [client 85.203.21.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/shell/index.php"] [unique_id "aSDMgG6cicFF3Aas-oRM2gAAAI0"]
[Sat Nov 22 04:33:04.603200 2025] [:error] [pid 53477:tid 53496] [client 85.203.21.68:32065] [client 85.203.21.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/wp-login.php"] [unique_id "aSDMgH7Lu30Ku9O40aKyJQAAAA8"]
[Sat Nov 22 04:33:04.780403 2025] [:error] [pid 53479:tid 53559] [client 85.203.21.2:23729] [client 85.203.21.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-wolf.php"] [unique_id "aSDMgG6cicFF3Aas-oRM2wAAAJc"]
[Sat Nov 22 04:33:04.957743 2025] [:error] [pid 53479:tid 53548] [client 85.203.21.3:24111] [client 85.203.21.3] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-signup.php"] [unique_id "aSDMgG6cicFF3Aas-oRM3QAAAIw"]
[Sat Nov 22 04:33:15.145671 2025] [:error] [pid 53566:tid 53582] [client 85.203.21.64:31903] [client 85.203.21.64] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aSDMi8bSHDBkRbwMbd4GpAAAAM4"]
[Sat Nov 22 04:33:15.323027 2025] [:error] [pid 25856:tid 25878] [client 85.203.21.68:29527] [client 85.203.21.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSDMixsTP0wy94zKUvF13gAAARQ"]
[Sat Nov 22 04:33:15.500038 2025] [:error] [pid 53566:tid 53575] [client 85.203.21.62:25595] [client 85.203.21.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aSDMi8bSHDBkRbwMbd4GpgAAAMc"]
[Sat Nov 22 04:33:15.674953 2025] [:error] [pid 53477:tid 53495] [client 85.203.21.42:54319] [client 85.203.21.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aSDMi37Lu30Ku9O40aKyPAAAAA4"]
[Sat Nov 22 04:33:15.851353 2025] [:error] [pid 25856:tid 25871] [client 85.203.21.34:53575] [client 85.203.21.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "aSDMixsTP0wy94zKUvF15QAAAQ0"]
[Sat Nov 22 04:33:16.027221 2025] [:error] [pid 53566:tid 53589] [client 85.203.21.64:29431] [client 85.203.21.64] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSDMjMbSHDBkRbwMbd4GqQAAANU"]
[Sat Nov 22 04:33:21.208381 2025] [:error] [pid 53479:tid 53551] [client 85.203.21.19:43839] [client 85.203.21.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/packed.php"] [unique_id "aSDMkW6cicFF3Aas-oRNBwAAAI8"]
[Sat Nov 22 04:33:21.384061 2025] [:error] [pid 53566:tid 53592] [client 85.203.21.3:57057] [client 85.203.21.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/admin.php"] [unique_id "aSDMkcbSHDBkRbwMbd4GzAAAANg"]
[Sat Nov 22 04:33:21.561509 2025] [:error] [pid 53479:tid 53555] [client 85.203.21.50:51813] [client 85.203.21.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/"] [unique_id "aSDMkW6cicFF3Aas-oRNCAAAAJM"]
[Sat Nov 22 04:33:21.737960 2025] [:error] [pid 25856:tid 25873] [client 85.203.21.14:45065] [client 85.203.21.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ini.php"] [unique_id "aSDMkRsTP0wy94zKUvF1-AAAAQ8"]
[Sat Nov 22 04:33:21.914196 2025] [:error] [pid 53479:tid 53539] [client 85.203.21.9:58415] [client 85.203.21.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/worksec.php"] [unique_id "aSDMkW6cicFF3Aas-oRNCwAAAIM"]
[Sat Nov 22 04:33:27.091003 2025] [:error] [pid 53478:tid 53511] [client 85.203.21.68:40667] [client 85.203.21.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/index.php"] [unique_id "aSDMlwhUYdXBbQswAdTlKwAAAEI"]
[Sat Nov 22 04:33:27.271378 2025] [:error] [pid 53477:tid 53494] [client 85.203.21.69:46327] [client 85.203.21.69] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-signin.php"] [unique_id "aSDMl37Lu30Ku9O40aKyUAAAAA0"]
[Sat Nov 22 04:33:27.449428 2025] [:error] [pid 53479:tid 53553] [client 85.203.21.64:55197] [client 85.203.21.64] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aSDMl26cicFF3Aas-oRNFAAAAJE"]
[Sat Nov 22 04:33:27.624634 2025] [:error] [pid 53566:tid 53574] [client 85.203.21.42:54945] [client 85.203.21.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/login.php"] [unique_id "aSDMl8bSHDBkRbwMbd4HFQAAAMY"]
[Sat Nov 22 04:33:27.800990 2025] [:error] [pid 53566:tid 53575] [client 85.203.21.7:33799] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aSDMl8bSHDBkRbwMbd4HFwAAAMc"]
[Sat Nov 22 04:33:27.979520 2025] [:error] [pid 53566:tid 53580] [client 85.203.21.50:27701] [client 85.203.21.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/mah.php"] [unique_id "aSDMl8bSHDBkRbwMbd4HGgAAAMw"]
[Sat Nov 22 04:33:28.158963 2025] [:error] [pid 53478:tid 53517] [client 85.203.21.22:46661] [client 85.203.21.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/index.php"] [unique_id "aSDMmAhUYdXBbQswAdTlLwAAAEg"]
[Sat Nov 22 04:33:33.336128 2025] [:error] [pid 53566:tid 53570] [client 85.203.21.36:21965] [client 85.203.21.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/block-support.php"] [unique_id "aSDMncbSHDBkRbwMbd4HMwAAAMI"]
[Sat Nov 22 04:33:33.514264 2025] [:error] [pid 25856:tid 25864] [client 85.203.21.26:25419] [client 85.203.21.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aSDMnRsTP0wy94zKUvF2CwAAAQY"]
[Sat Nov 22 04:33:33.696594 2025] [:error] [pid 53477:tid 53498] [client 85.203.21.55:29129] [client 85.203.21.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aSDMnX7Lu30Ku9O40aKyWQAAABE"]
[Sat Nov 22 04:33:33.874625 2025] [:error] [pid 53477:tid 53504] [client 85.203.21.48:63753] [client 85.203.21.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "aSDMnX7Lu30Ku9O40aKyWgAAABc"]
[Sat Nov 22 04:33:34.051814 2025] [:error] [pid 53478:tid 53518] [client 85.203.21.26:61535] [client 85.203.21.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/"] [unique_id "aSDMnghUYdXBbQswAdTlPQAAAEk"]
[Sat Nov 22 04:33:34.229022 2025] [:error] [pid 53566:tid 53574] [client 85.203.21.19:26583] [client 85.203.21.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "aSDMnsbSHDBkRbwMbd4HNQAAAMY"]
[Sat Nov 22 04:33:34.406132 2025] [:error] [pid 53479:tid 53549] [client 85.203.21.69:61933] [client 85.203.21.69] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aSDMnm6cicFF3Aas-oRNGQAAAI0"]
[Sat Nov 22 04:33:34.585599 2025] [:error] [pid 53479:tid 53541] [client 85.203.21.12:32847] [client 85.203.21.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/buy.php"] [unique_id "aSDMnm6cicFF3Aas-oRNGgAAAIU"]
[Sat Nov 22 04:33:34.762679 2025] [:error] [pid 53566:tid 53582] [client 85.203.21.18:65287] [client 85.203.21.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/f.php"] [unique_id "aSDMnsbSHDBkRbwMbd4HOwAAAM4"]
[Sat Nov 22 04:33:34.941658 2025] [:error] [pid 53479:tid 53556] [client 85.203.21.37:41355] [client 85.203.21.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-header.php"] [unique_id "aSDMnm6cicFF3Aas-oRNHQAAAJQ"]
[Sat Nov 22 04:33:35.119844 2025] [:error] [pid 53477:tid 53501] [client 85.203.21.62:44301] [client 85.203.21.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aSDMn37Lu30Ku9O40aKyXgAAABQ"]
[Sat Nov 22 04:33:35.299440 2025] [:error] [pid 53477:tid 53499] [client 85.203.21.46:58205] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfour/"] [unique_id "aSDMn37Lu30Ku9O40aKyXwAAABI"]
[Sat Nov 22 04:33:35.479026 2025] [:error] [pid 53566:tid 53578] [client 85.203.21.6:40401] [client 85.203.21.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "aSDMn8bSHDBkRbwMbd4HQwAAAMo"]
[Sat Nov 22 04:33:35.655270 2025] [:error] [pid 53566:tid 53579] [client 85.203.21.34:57119] [client 85.203.21.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/shell3.php"] [unique_id "aSDMn8bSHDBkRbwMbd4HSAAAAMs"]
[Sat Nov 22 04:33:35.833509 2025] [:error] [pid 53566:tid 53582] [client 85.203.21.5:23311] [client 85.203.21.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/admin.php"] [unique_id "aSDMn8bSHDBkRbwMbd4HSgAAAM4"]
[Sat Nov 22 04:33:36.012641 2025] [:error] [pid 53477:tid 53488] [client 85.203.21.7:49549] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aSDMoH7Lu30Ku9O40aKyYAAAAAc"]
[Sat Nov 22 04:33:36.193462 2025] [:error] [pid 53477:tid 53500] [client 85.203.21.51:45399] [client 85.203.21.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/covr-wpcom/assets/fonts/manrope.php"] [unique_id "aSDMoH7Lu30Ku9O40aKyYQAAABM"]
[Sat Nov 22 04:33:36.371100 2025] [:error] [pid 25856:tid 25881] [client 85.203.21.12:34271] [client 85.203.21.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-conflg/function.php"] [unique_id "aSDMoBsTP0wy94zKUvF2FQAAARc"]
[Sat Nov 22 04:33:36.549144 2025] [:error] [pid 53478:tid 53515] [client 85.203.21.47:37631] [client 85.203.21.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/uploaded_script.php"] [unique_id "aSDMoAhUYdXBbQswAdTlPwAAAEY"]
[Sat Nov 22 04:33:38.338673 2025] [:error] [pid 53477:tid 53483] [client 85.203.21.7:45381] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aSDMon7Lu30Ku9O40aKyYwAAAAI"]
[Sat Nov 22 04:33:38.517953 2025] [:error] [pid 53477:tid 53487] [client 85.203.21.50:34997] [client 85.203.21.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aSDMon7Lu30Ku9O40aKyZAAAAAY"]
[Sat Nov 22 04:33:38.695774 2025] [:error] [pid 53478:tid 53529] [client 85.203.21.51:42387] [client 85.203.21.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/admin.php"] [unique_id "aSDMoghUYdXBbQswAdTlQgAAAFQ"]
[Sat Nov 22 04:33:38.874354 2025] [:error] [pid 53566:tid 53568] [client 85.203.21.25:41129] [client 85.203.21.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aSDMosbSHDBkRbwMbd4HXgAAAMA"]
[Sat Nov 22 04:33:39.051095 2025] [:error] [pid 53478:tid 53511] [client 85.203.21.13:45575] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aSDMowhUYdXBbQswAdTlQwAAAEI"]
[Sat Nov 22 04:33:39.229699 2025] [:error] [pid 53477:tid 53482] [client 85.203.21.13:59123] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/news-portal/error.php"] [unique_id "aSDMo37Lu30Ku9O40aKyZQAAAAE"]
[Sat Nov 22 04:33:39.406937 2025] [:error] [pid 25856:tid 25859] [client 85.203.21.64:64885] [client 85.203.21.64] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "aSDMoxsTP0wy94zKUvF2HwAAAQE"]
[Sat Nov 22 04:33:39.584480 2025] [:error] [pid 25856:tid 25869] [client 85.203.21.37:48447] [client 85.203.21.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aSDMoxsTP0wy94zKUvF2IAAAAQs"]
[Sat Nov 22 04:33:39.762407 2025] [:error] [pid 53477:tid 53504] [client 85.203.21.5:39449] [client 85.203.21.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentyfive/include.php"] [unique_id "aSDMo37Lu30Ku9O40aKyZwAAABc"]
[Sat Nov 22 04:33:39.939181 2025] [:error] [pid 53479:tid 53544] [client 85.203.21.42:48719] [client 85.203.21.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/index2.php"] [unique_id "aSDMo26cicFF3Aas-oRNIwAAAIg"]
[Sat Nov 22 04:33:40.115762 2025] [:error] [pid 25856:tid 25864] [client 85.203.21.62:34277] [client 85.203.21.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "aSDMpBsTP0wy94zKUvF2IwAAAQY"]
[Sat Nov 22 04:33:45.348253 2025] [:error] [pid 53479:tid 53544] [client 85.203.21.44:33007] [client 85.203.21.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/s.php"] [unique_id "aSDMqW6cicFF3Aas-oRNMQAAAIg"]
[Sat Nov 22 04:33:45.529797 2025] [:error] [pid 53566:tid 53592] [client 85.203.21.46:44777] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/sunrise/index.php"] [unique_id "aSDMqcbSHDBkRbwMbd4HkAAAANg"]
[Sat Nov 22 04:33:45.707516 2025] [:error] [pid 53566:tid 53582] [client 85.203.21.64:55093] [client 85.203.21.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSDMqcbSHDBkRbwMbd4HkQAAAM4"]
[Sat Nov 22 04:33:45.885178 2025] [:error] [pid 53566:tid 53580] [client 85.203.21.15:26939] [client 85.203.21.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/"] [unique_id "aSDMqcbSHDBkRbwMbd4HkwAAAMw"]
[Sat Nov 22 04:33:46.063487 2025] [:error] [pid 25856:tid 25868] [client 85.203.21.5:45553] [client 85.203.21.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-conf.php"] [unique_id "aSDMqhsTP0wy94zKUvF2SwAAAQo"]
[Sat Nov 22 04:33:46.242686 2025] [:error] [pid 53478:tid 53533] [client 85.203.21.17:21555] [client 85.203.21.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aSDMqghUYdXBbQswAdTlRwAAAFg"]
[Sat Nov 22 04:33:46.420984 2025] [:error] [pid 25856:tid 25861] [client 85.203.21.4:46363] [client 85.203.21.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp.php"] [unique_id "aSDMqhsTP0wy94zKUvF2UQAAAQM"]
[Sat Nov 22 04:33:46.597731 2025] [:error] [pid 53479:tid 53549] [client 85.203.21.27:20095] [client 85.203.21.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aSDMqm6cicFF3Aas-oRNOQAAAI0"]
[Sat Nov 22 04:33:46.776249 2025] [:error] [pid 53479:tid 53556] [client 85.203.21.47:57545] [client 85.203.21.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-files.php"] [unique_id "aSDMqm6cicFF3Aas-oRNPAAAAJQ"]
[Sat Nov 22 04:33:46.953470 2025] [:error] [pid 53477:tid 53492] [client 85.203.21.13:64457] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/"] [unique_id "aSDMqn7Lu30Ku9O40aKyeAAAAAs"]
[Sat Nov 22 04:33:47.132016 2025] [:error] [pid 53566:tid 53575] [client 85.203.21.34:30079] [client 85.203.21.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/admin.php"] [unique_id "aSDMq8bSHDBkRbwMbd4HlQAAAMc"]
[Sat Nov 22 04:33:47.311403 2025] [:error] [pid 53478:tid 53527] [client 85.203.21.36:57637] [client 85.203.21.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aSDMqwhUYdXBbQswAdTlSQAAAFI"]
[Sat Nov 22 04:33:52.491862 2025] [:error] [pid 53478:tid 53528] [client 85.203.21.67:38033] [client 85.203.21.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/m.php"] [unique_id "aSDMsAhUYdXBbQswAdTlTwAAAFM"]
[Sat Nov 22 04:33:52.669443 2025] [:error] [pid 53566:tid 53587] [client 85.203.21.48:54939] [client 85.203.21.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/chosen.php"] [unique_id "aSDMsMbSHDBkRbwMbd4HoAAAANM"]
[Sat Nov 22 04:33:52.847292 2025] [:error] [pid 53566:tid 53577] [client 85.203.21.26:28733] [client 85.203.21.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aSDMsMbSHDBkRbwMbd4HoQAAAMk"]
[Sat Nov 22 04:33:53.028029 2025] [:error] [pid 53566:tid 53588] [client 85.203.21.8:36981] [client 85.203.21.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bk/index.php"] [unique_id "aSDMscbSHDBkRbwMbd4HogAAANQ"]
[Sat Nov 22 04:33:53.206645 2025] [:error] [pid 53566:tid 53568] [client 85.203.21.68:52799] [client 85.203.21.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/log.php"] [unique_id "aSDMscbSHDBkRbwMbd4HpAAAAMA"]
[Sat Nov 22 04:33:53.384723 2025] [:error] [pid 25856:tid 25881] [client 85.203.21.69:20419] [client 85.203.21.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/navigation/index.php"] [unique_id "aSDMsRsTP0wy94zKUvF2cwAAARc"]
[Sat Nov 22 04:33:53.560956 2025] [:error] [pid 25856:tid 25870] [client 85.203.21.50:45155] [client 85.203.21.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "aSDMsRsTP0wy94zKUvF2dQAAAQw"]
[Sat Nov 22 04:33:53.737738 2025] [:error] [pid 25856:tid 25864] [client 85.203.21.50:62175] [client 85.203.21.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/"] [unique_id "aSDMsRsTP0wy94zKUvF2dgAAAQY"]
[Sat Nov 22 04:33:53.915952 2025] [:error] [pid 53478:tid 53526] [client 85.203.21.18:37231] [client 85.203.21.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/post.php"] [unique_id "aSDMsQhUYdXBbQswAdTlUgAAAFE"]
[Sat Nov 22 04:33:54.093640 2025] [:error] [pid 53478:tid 53523] [client 85.203.21.44:36543] [client 85.203.21.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aSDMsghUYdXBbQswAdTlUwAAAE4"]
[Sat Nov 22 04:33:54.270518 2025] [:error] [pid 53479:tid 53540] [client 85.203.21.19:34037] [client 85.203.21.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/contact.php"] [unique_id "aSDMsm6cicFF3Aas-oRNRwAAAIQ"]
[Sat Nov 22 04:33:54.450629 2025] [:error] [pid 53479:tid 53547] [client 85.203.21.55:31621] [client 85.203.21.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aSDMsm6cicFF3Aas-oRNSQAAAIs"]
[Sat Nov 22 04:33:54.629237 2025] [:error] [pid 25856:tid 25859] [client 85.203.21.62:50347] [client 85.203.21.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/error.php"] [unique_id "aSDMshsTP0wy94zKUvF2eAAAAQE"]
[Sat Nov 22 04:33:54.807089 2025] [:error] [pid 53479:tid 53551] [client 85.203.21.5:65063] [client 85.203.21.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/lib/"] [unique_id "aSDMsm6cicFF3Aas-oRNSgAAAI8"]
[Sat Nov 22 04:33:54.985500 2025] [:error] [pid 53478:tid 53512] [client 85.203.21.67:47835] [client 85.203.21.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/"] [unique_id "aSDMsghUYdXBbQswAdTlVAAAAEM"]
[Sat Nov 22 04:33:56.596006 2025] [:error] [pid 53566:tid 53569] [client 85.203.21.51:35571] [client 85.203.21.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/"] [unique_id "aSDMtMbSHDBkRbwMbd4HqAAAAME"]
[Sat Nov 22 04:33:56.772864 2025] [:error] [pid 25856:tid 25869] [client 85.203.21.6:32833] [client 85.203.21.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/leafmailer.php"] [unique_id "aSDMtBsTP0wy94zKUvF2fAAAAQs"]
[Sat Nov 22 04:34:01.957202 2025] [:error] [pid 53477:tid 53490] [client 85.203.21.3:59909] [client 85.203.21.3] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/search/"] [unique_id "aSDMuX7Lu30Ku9O40aKyiQAAAAk"]
[Sat Nov 22 04:34:02.135207 2025] [:error] [pid 53477:tid 53496] [client 85.203.21.47:51513] [client 85.203.21.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/index.php"] [unique_id "aSDMun7Lu30Ku9O40aKyigAAAA8"]
[Sat Nov 22 04:34:07.314386 2025] [:error] [pid 53477:tid 53487] [client 85.203.21.59:62607] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/update/function.php"] [unique_id "aSDMv37Lu30Ku9O40aKyjwAAAAY"]
[Sat Nov 22 04:34:07.492275 2025] [:error] [pid 53477:tid 53489] [client 85.203.21.47:65357] [client 85.203.21.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/assets/"] [unique_id "aSDMv37Lu30Ku9O40aKykAAAAAg"]
[Sat Nov 22 04:34:07.672743 2025] [:error] [pid 53478:tid 53519] [client 85.203.21.67:44587] [client 85.203.21.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aSDMvwhUYdXBbQswAdTlZgAAAEo"]
[Sat Nov 22 04:34:07.849591 2025] [:error] [pid 25856:tid 25880] [client 85.203.21.50:22637] [client 85.203.21.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aSDMvxsTP0wy94zKUvF2jwAAARY"]
[Sat Nov 22 04:34:08.027564 2025] [:error] [pid 53478:tid 53516] [client 85.203.21.5:20413] [client 85.203.21.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/upload/"] [unique_id "aSDMwAhUYdXBbQswAdTlZwAAAEc"]
[Sat Nov 22 04:34:08.206690 2025] [:error] [pid 53477:tid 53498] [client 85.203.21.67:22601] [client 85.203.21.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/function/function.php"] [unique_id "aSDMwH7Lu30Ku9O40aKykwAAABE"]
[Sat Nov 22 04:34:08.432398 2025] [:error] [pid 53478:tid 53533] [client 85.203.21.25:32595] [client 85.203.21.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aSDMwAhUYdXBbQswAdTlaQAAAFg"]
[Sat Nov 22 04:34:08.610451 2025] [:error] [pid 53478:tid 53520] [client 85.203.21.44:38085] [client 85.203.21.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aSDMwAhUYdXBbQswAdTlagAAAEs"]
[Sat Nov 22 04:34:08.792565 2025] [:error] [pid 25856:tid 25860] [client 85.203.21.67:48727] [client 85.203.21.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/about.php"] [unique_id "aSDMwBsTP0wy94zKUvF2kQAAAQI"]
[Sat Nov 22 04:34:08.970015 2025] [:error] [pid 53479:tid 53549] [client 85.203.21.11:41941] [client 85.203.21.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aSDMwG6cicFF3Aas-oRNWAAAAI0"]
[Sat Nov 22 04:34:09.160120 2025] [:error] [pid 53478:tid 53527] [client 85.203.21.8:59457] [client 85.203.21.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aSDMwQhUYdXBbQswAdTlbAAAAFI"]
[Sat Nov 22 04:34:14.357964 2025] [:error] [pid 53477:tid 53491] [client 85.203.21.37:51049] [client 85.203.21.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aSDMxn7Lu30Ku9O40aKylgAAAAo"]
[Sat Nov 22 04:34:14.536974 2025] [:error] [pid 25856:tid 25880] [client 85.203.21.13:27447] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aSDMxhsTP0wy94zKUvF2mwAAARY"]
[Sat Nov 22 04:34:14.733723 2025] [:error] [pid 25856:tid 25875] [client 85.203.21.25:56199] [client 85.203.21.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aSDMxhsTP0wy94zKUvF2nQAAARE"]
[Sat Nov 22 04:34:19.912653 2025] [:error] [pid 53479:tid 53547] [client 85.203.21.25:63777] [client 85.203.21.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/themes/"] [unique_id "aSDMy26cicFF3Aas-oRNYQAAAIs"]
[Sat Nov 22 04:34:20.092635 2025] [:error] [pid 53479:tid 53557] [client 85.203.21.17:49395] [client 85.203.21.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aSDMzG6cicFF3Aas-oRNYgAAAJU"]
[Sat Nov 22 04:34:20.293584 2025] [:error] [pid 53479:tid 53560] [client 85.203.21.49:36011] [client 85.203.21.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/function.php"] [unique_id "aSDMzG6cicFF3Aas-oRNZAAAAJg"]
[Sat Nov 22 04:34:20.477758 2025] [:error] [pid 53479:tid 53544] [client 85.203.21.59:55221] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aSDMzG6cicFF3Aas-oRNZgAAAIg"]
[Sat Nov 22 04:34:20.656059 2025] [:error] [pid 53566:tid 53583] [client 85.203.21.68:43791] [client 85.203.21.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/chosen/function.php"] [unique_id "aSDMzMbSHDBkRbwMbd4H1AAAAM8"]
[Sat Nov 22 04:34:25.836811 2025] [:error] [pid 53478:tid 53531] [client 85.203.21.47:53801] [client 85.203.21.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSDM0QhUYdXBbQswAdTleAAAAFY"]
[Sat Nov 22 04:34:26.017059 2025] [:error] [pid 25856:tid 25882] [client 85.203.21.3:59149] [client 85.203.21.3] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aSDM0hsTP0wy94zKUvF2uQAAARg"]
[Sat Nov 22 04:34:26.195291 2025] [:error] [pid 25856:tid 25867] [client 85.203.21.4:33775] [client 85.203.21.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/item.php"] [unique_id "aSDM0hsTP0wy94zKUvF2uwAAAQk"]
[Sat Nov 22 04:34:26.375322 2025] [:error] [pid 53479:tid 53552] [client 85.203.21.3:45317] [client 85.203.21.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/index.php"] [unique_id "aSDM0m6cicFF3Aas-oRNagAAAJA"]
[Sat Nov 22 04:34:28.078667 2025] [:error] [pid 25856:tid 25877] [client 85.203.21.27:32353] [client 85.203.21.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/include.php"] [unique_id "aSDM1BsTP0wy94zKUvF2wgAAARM"]
[Sat Nov 22 04:34:28.256590 2025] [:error] [pid 25856:tid 25879] [client 85.203.21.56:43507] [client 85.203.21.56] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/cgi-bin/user/index.php"] [unique_id "aSDM1BsTP0wy94zKUvF2wwAAARU"]
[Sat Nov 22 04:34:28.436206 2025] [:error] [pid 53479:tid 53557] [client 85.203.21.13:23245] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfive/assets/fonts/beiruti/index.php"] [unique_id "aSDM1G6cicFF3Aas-oRNbQAAAJU"]
[Sat Nov 22 04:34:28.616077 2025] [:error] [pid 53566:tid 53568] [client 85.203.21.51:50009] [client 85.203.21.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/plugins/wp-login.php"] [unique_id "aSDM1MbSHDBkRbwMbd4H3wAAAMA"]
[Sat Nov 22 04:34:33.795316 2025] [:error] [pid 53477:tid 53484] [client 85.203.21.12:34181] [client 85.203.21.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aSDM2X7Lu30Ku9O40aKyrAAAAAM"]
[Sat Nov 22 04:34:38.971498 2025] [:error] [pid 53566:tid 53581] [client 85.203.21.55:63991] [client 85.203.21.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSDM3sbSHDBkRbwMbd4H6QAAAM0"]
[Sat Nov 22 04:34:39.147811 2025] [:error] [pid 53478:tid 53522] [client 85.203.21.13:56981] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/admin.php"] [unique_id "aSDM3whUYdXBbQswAdTljQAAAE0"]
[Sat Nov 22 04:34:39.324880 2025] [:error] [pid 53477:tid 53500] [client 85.203.21.15:30025] [client 85.203.21.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-Owl.php"] [unique_id "aSDM337Lu30Ku9O40aKyswAAABM"]
[Sat Nov 22 04:34:44.503164 2025] [:error] [pid 53566:tid 53575] [client 85.203.21.62:56407] [client 85.203.21.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aSDM5MbSHDBkRbwMbd4IAQAAAMc"]
[Sat Nov 22 04:34:44.679790 2025] [:error] [pid 53478:tid 53512] [client 85.203.21.62:59259] [client 85.203.21.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aSDM5AhUYdXBbQswAdTlmAAAAEM"]
[Sat Nov 22 04:34:44.857881 2025] [:error] [pid 53479:tid 53545] [client 85.203.21.21:20409] [client 85.203.21.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/"] [unique_id "aSDM5G6cicFF3Aas-oRNjQAAAIk"]
[Sat Nov 22 04:34:45.047438 2025] [:error] [pid 53478:tid 53522] [client 85.203.21.60:47269] [client 85.203.21.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/themes.php"] [unique_id "aSDM5QhUYdXBbQswAdTlmQAAAE0"]
[Sat Nov 22 04:34:45.227247 2025] [:error] [pid 53566:tid 53579] [client 85.203.21.67:27531] [client 85.203.21.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "aSDM5cbSHDBkRbwMbd4IBgAAAMs"]
[Sat Nov 22 04:34:50.408652 2025] [:error] [pid 53478:tid 53529] [client 85.203.21.2:53767] [client 85.203.21.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aSDM6ghUYdXBbQswAdTlqAAAAFQ"]
[Sat Nov 22 04:34:50.588721 2025] [:error] [pid 53478:tid 53531] [client 85.203.21.48:59651] [client 85.203.21.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aSDM6ghUYdXBbQswAdTlqgAAAFY"]
[Sat Nov 22 04:34:50.765919 2025] [:error] [pid 53566:tid 53592] [client 85.203.21.60:24415] [client 85.203.21.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aSDM6sbSHDBkRbwMbd4IEwAAANg"]
[Sat Nov 22 04:34:50.943975 2025] [:error] [pid 25856:tid 25874] [client 85.203.21.55:52265] [client 85.203.21.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/wp-login.php"] [unique_id "aSDM6hsTP0wy94zKUvF3EQAAARA"]
[Sat Nov 22 04:34:51.122097 2025] [:error] [pid 53477:tid 53481] [client 85.203.21.60:27201] [client 85.203.21.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wander.php"] [unique_id "aSDM637Lu30Ku9O40aKy5wAAAAA"]
[Sat Nov 22 04:34:51.346645 2025] [:error] [pid 53478:tid 53515] [client 85.203.21.7:59151] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/version.php"] [unique_id "aSDM6whUYdXBbQswAdTlrQAAAEY"]
[Sat Nov 22 04:34:51.521970 2025] [:error] [pid 25856:tid 25876] [client 85.203.21.56:25773] [client 85.203.21.56] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/about.php"] [unique_id "aSDM6xsTP0wy94zKUvF3FwAAARI"]
[Sat Nov 22 04:34:51.699481 2025] [:error] [pid 25856:tid 25871] [client 85.203.21.42:39989] [client 85.203.21.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aSDM6xsTP0wy94zKUvF3GQAAAQ0"]
[Sat Nov 22 04:34:51.879254 2025] [:error] [pid 53566:tid 53579] [client 85.203.21.27:43815] [client 85.203.21.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "aSDM68bSHDBkRbwMbd4IFQAAAMs"]
[Sat Nov 22 04:34:52.057028 2025] [:error] [pid 53478:tid 53518] [client 85.203.21.21:24285] [client 85.203.21.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/product.php"] [unique_id "aSDM7AhUYdXBbQswAdTlrgAAAEk"]
[Sat Nov 22 04:34:52.234537 2025] [:error] [pid 25856:tid 25861] [client 85.203.21.25:48879] [client 85.203.21.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/chosen.php"] [unique_id "aSDM7BsTP0wy94zKUvF3GgAAAQM"]
[Sat Nov 22 04:34:52.411932 2025] [:error] [pid 53566:tid 53581] [client 85.203.21.69:41785] [client 85.203.21.69] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aSDM7MbSHDBkRbwMbd4IFwAAAM0"]
[Sat Nov 22 04:34:52.592523 2025] [:error] [pid 53478:tid 53532] [client 85.203.21.47:64529] [client 85.203.21.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/yasnu.php"] [unique_id "aSDM7AhUYdXBbQswAdTlrwAAAFc"]
[Sat Nov 22 04:34:52.770768 2025] [:error] [pid 53566:tid 53585] [client 85.203.21.37:28587] [client 85.203.21.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/"] [unique_id "aSDM7MbSHDBkRbwMbd4IGAAAANE"]
[Sat Nov 22 04:34:52.951401 2025] [:error] [pid 53566:tid 53577] [client 85.203.21.64:57969] [client 85.203.21.64] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/classwithtostring.php"] [unique_id "aSDM7MbSHDBkRbwMbd4IGQAAAMk"]
[Sat Nov 22 04:34:58.130679 2025] [:error] [pid 53566:tid 53590] [client 85.203.21.69:64815] [client 85.203.21.69] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/pki-validation/index.php"] [unique_id "aSDM8sbSHDBkRbwMbd4IMwAAANY"]
[Sat Nov 22 04:34:58.308746 2025] [:error] [pid 53566:tid 53579] [client 85.203.21.14:48633] [client 85.203.21.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "aSDM8sbSHDBkRbwMbd4INwAAAMs"]
[Sat Nov 22 04:34:58.487103 2025] [:error] [pid 25856:tid 25877] [client 85.203.21.37:42903] [client 85.203.21.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "aSDM8hsTP0wy94zKUvF3JwAAARM"]
[Sat Nov 22 04:34:58.667751 2025] [:error] [pid 25856:tid 25870] [client 85.203.21.5:53911] [client 85.203.21.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/directionality/index.php"] [unique_id "aSDM8hsTP0wy94zKUvF3KQAAAQw"]
[Sat Nov 22 04:34:58.845597 2025] [:error] [pid 53477:tid 53496] [client 85.203.21.67:60041] [client 85.203.21.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aSDM8n7Lu30Ku9O40aKzCgAAAA8"]
[Sat Nov 22 04:34:59.023015 2025] [:error] [pid 25856:tid 25866] [client 85.203.21.38:63249] [client 85.203.21.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/wp.php"] [unique_id "aSDM8xsTP0wy94zKUvF3KgAAAQg"]
[Sat Nov 22 04:34:59.200560 2025] [:error] [pid 53479:tid 53559] [client 85.203.21.34:30735] [client 85.203.21.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/details/about.php"] [unique_id "aSDM826cicFF3Aas-oRNmwAAAJc"]
[Sat Nov 22 04:35:04.380917 2025] [:error] [pid 53478:tid 53527] [client 85.203.21.5:25657] [client 85.203.21.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager/tinyfilemanager.php"] [unique_id "aSDM-AhUYdXBbQswAdTlvwAAAFI"]
[Sat Nov 22 04:35:09.559150 2025] [:error] [pid 53566:tid 53571] [client 85.203.21.9:24455] [client 85.203.21.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aSDM_cbSHDBkRbwMbd4IZgAAAMM"]
[Sat Nov 22 04:35:09.736506 2025] [:error] [pid 25856:tid 25870] [client 85.203.21.59:29025] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aSDM_RsTP0wy94zKUvF3RQAAAQw"]
[Sat Nov 22 04:47:12.642426 2025] [:error] [pid 53566:tid 53584] [client 85.8.130.61:21461] [client 85.8.130.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSDP0MbSHDBkRbwMbd4O8gAAANA"]
[Sat Nov 22 04:51:46.820294 2025] [:error] [pid 53566:tid 53572] [client 194.233.90.32:41338] [client 194.233.90.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.233.90.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSDQ4sbSHDBkRbwMbd4RxwAAAMQ"]
[Sat Nov 22 04:55:51.471139 2025] [:error] [pid 53479:tid 53538] [client 194.5.82.125:34973] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSDR126cicFF3Aas-oRYQAAAAII"]
[Sat Nov 22 04:55:54.050267 2025] [:error] [pid 53478:tid 53514] [client 194.5.82.105:44871] [client 194.5.82.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aSDR2ghUYdXBbQswAdTwZgAAAEU"]
[Sat Nov 22 04:55:59.034717 2025] [:error] [pid 53477:tid 53484] [client 194.5.82.127:56455] [client 194.5.82.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aSDR337Lu30Ku9O40aK-lAAAAAM"]
[Sat Nov 22 04:56:02.004022 2025] [:error] [pid 53566:tid 53587] [client 194.5.82.130:61973] [client 194.5.82.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aSDR4sbSHDBkRbwMbd4VDQAAANM"]
[Sat Nov 22 04:56:07.261701 2025] [:error] [pid 25856:tid 25869] [client 194.5.82.152:58473] [client 194.5.82.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aSDR5xsTP0wy94zKUvGHJQAAAQs"]
[Sat Nov 22 04:56:08.391096 2025] [:error] [pid 53477:tid 53504] [client 194.5.82.157:32909] [client 194.5.82.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aSDR6H7Lu30Ku9O40aK-tAAAABc"]
[Sat Nov 22 04:56:08.596527 2025] [:error] [pid 53478:tid 53520] [client 194.5.82.161:45155] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aSDR6AhUYdXBbQswAdTwlgAAAEs"]
[Sat Nov 22 04:56:08.867849 2025] [:error] [pid 53477:tid 53489] [client 194.5.82.156:62053] [client 194.5.82.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aSDR6H7Lu30Ku9O40aK-tQAAAAg"]
[Sat Nov 22 04:56:09.154568 2025] [:error] [pid 53566:tid 53592] [client 194.5.82.170:26189] [client 194.5.82.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aSDR6cbSHDBkRbwMbd4VIwAAANg"]
[Sat Nov 22 04:56:09.360564 2025] [:error] [pid 53477:tid 53486] [client 194.5.82.138:23785] [client 194.5.82.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aSDR6X7Lu30Ku9O40aK-tgAAAAU"]
[Sat Nov 22 04:56:10.331777 2025] [:error] [pid 53478:tid 53517] [client 194.5.82.123:63379] [client 194.5.82.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aSDR6ghUYdXBbQswAdTwnQAAAEg"]
[Sat Nov 22 04:56:11.698457 2025] [:error] [pid 53479:tid 53557] [client 194.5.82.134:46225] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aSDR626cicFF3Aas-oRYpwAAAJU"]
[Sat Nov 22 04:56:13.763108 2025] [:error] [pid 53478:tid 53531] [client 194.5.82.117:48981] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aSDR7QhUYdXBbQswAdTwqgAAAFY"]
[Sat Nov 22 04:56:14.678794 2025] [:error] [pid 25856:tid 25858] [client 194.5.82.124:51363] [client 194.5.82.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aSDR7hsTP0wy94zKUvGHRAAAAQA"]
[Sat Nov 22 04:56:15.833524 2025] [:error] [pid 53478:tid 53519] [client 194.5.82.120:62919] [client 194.5.82.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aSDR7whUYdXBbQswAdTwwwAAAEo"]
[Sat Nov 22 04:56:20.571209 2025] [:error] [pid 53478:tid 53529] [client 194.5.82.127:30875] [client 194.5.82.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aSDR9AhUYdXBbQswAdTxAAAAAFQ"]
[Sat Nov 22 04:56:21.683263 2025] [:error] [pid 53477:tid 53486] [client 194.5.82.137:41495] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aSDR9X7Lu30Ku9O40aK-1AAAAAU"]
[Sat Nov 22 04:56:23.594374 2025] [:error] [pid 53566:tid 53591] [client 194.5.82.136:34505] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/defaults.php"] [unique_id "aSDR98bSHDBkRbwMbd4VTwAAANc"]
[Sat Nov 22 04:56:24.681082 2025] [:error] [pid 53478:tid 53509] [client 194.5.82.123:38853] [client 194.5.82.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aSDR-AhUYdXBbQswAdTxLgAAAEA"]
[Sat Nov 22 04:56:28.132081 2025] [:error] [pid 53477:tid 53503] [client 194.5.82.113:25139] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aSDR_H7Lu30Ku9O40aK-9QAAABY"]
[Sat Nov 22 04:56:29.424333 2025] [:error] [pid 53479:tid 53541] [client 194.5.82.155:30985] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aSDR_W6cicFF3Aas-oRY9wAAAIU"]
[Sat Nov 22 04:56:30.592419 2025] [:error] [pid 53479:tid 53548] [client 194.5.82.150:21415] [client 194.5.82.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aSDR_m6cicFF3Aas-oRY-QAAAIw"]
[Sat Nov 22 04:56:30.920498 2025] [:error] [pid 53478:tid 53514] [client 194.5.82.150:45781] [client 194.5.82.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aSDR_ghUYdXBbQswAdTxhAAAAEU"]
[Sat Nov 22 04:56:31.258719 2025] [:error] [pid 53478:tid 53524] [client 194.5.82.114:42975] [client 194.5.82.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aSDR_whUYdXBbQswAdTxiAAAAE8"]
[Sat Nov 22 04:56:35.169994 2025] [:error] [pid 25856:tid 25861] [client 194.5.82.169:32529] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/info.php"] [unique_id "aSDSAxsTP0wy94zKUvGHiAAAAQM"]
[Sat Nov 22 04:56:35.424597 2025] [:error] [pid 53478:tid 53510] [client 194.5.82.162:35071] [client 194.5.82.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class.api.php"] [unique_id "aSDSAwhUYdXBbQswAdTxsQAAAEE"]
[Sat Nov 22 04:56:35.635514 2025] [:error] [pid 53478:tid 53522] [client 194.5.82.147:55585] [client 194.5.82.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSDSAwhUYdXBbQswAdTxtQAAAE0"]
[Sat Nov 22 04:56:41.850430 2025] [:error] [pid 53478:tid 53528] [client 194.5.82.164:60649] [client 194.5.82.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/admin.php"] [unique_id "aSDSCQhUYdXBbQswAdTx-gAAAFM"]
[Sat Nov 22 04:56:44.685704 2025] [:error] [pid 53478:tid 53528] [client 194.5.82.111:54995] [client 194.5.82.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aSDSDAhUYdXBbQswAdTyDQAAAFM"]
[Sat Nov 22 04:56:53.409030 2025] [:error] [pid 53478:tid 53525] [client 194.5.82.111:54995] [client 194.5.82.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aSDSFQhUYdXBbQswAdTyLAAAAFA"]
[Sat Nov 22 04:56:55.371000 2025] [:error] [pid 53479:tid 53542] [client 194.5.82.138:30739] [client 194.5.82.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aSDSF26cicFF3Aas-oRZLwAAAIY"]
[Sat Nov 22 04:56:57.138126 2025] [:error] [pid 53479:tid 53539] [client 194.5.82.138:30739] [client 194.5.82.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/item.php"] [unique_id "aSDSGW6cicFF3Aas-oRZMwAAAIM"]
[Sat Nov 22 04:57:02.979652 2025] [:error] [pid 53479:tid 53559] [client 194.5.82.147:23167] [client 194.5.82.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aSDSHm6cicFF3Aas-oRZQgAAAJc"]
[Sat Nov 22 04:57:10.886455 2025] [:error] [pid 53477:tid 53490] [client 194.5.82.131:36825] [client 194.5.82.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aSDSJn7Lu30Ku9O40aK_kAAAAAk"]
[Sat Nov 22 04:57:12.839824 2025] [:error] [pid 53478:tid 53519] [client 194.5.82.127:43867] [client 194.5.82.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aSDSKAhUYdXBbQswAdTyswAAAEo"]
[Sat Nov 22 04:57:15.624062 2025] [:error] [pid 53477:tid 53483] [client 194.5.82.155:56239] [client 194.5.82.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.155, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aSDSK37Lu30Ku9O40aK_ogAAAAI"]
[Sat Nov 22 04:57:16.379844 2025] [:error] [pid 53477:tid 53489] [client 194.5.82.155:56239] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aSDSLH7Lu30Ku9O40aK_pgAAAAg"]
[Sat Nov 22 04:57:30.837730 2025] [:error] [pid 25856:tid 25870] [client 194.5.82.113:51019] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aSDSOhsTP0wy94zKUvGINAAAAQw"]
[Sat Nov 22 04:57:33.453600 2025] [:error] [pid 53477:tid 53494] [client 194.5.82.169:44827] [client 194.5.82.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aSDSPX7Lu30Ku9O40aK_yAAAAA0"]
[Sat Nov 22 04:57:36.396216 2025] [:error] [pid 53477:tid 53498] [client 194.5.82.169:44827] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aSDSQH7Lu30Ku9O40aK_0QAAABE"]
[Sat Nov 22 04:57:37.909500 2025] [:error] [pid 25856:tid 25871] [client 194.5.82.155:23587] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/infi.php"] [unique_id "aSDSQRsTP0wy94zKUvGIRwAAAQ0"]
[Sat Nov 22 04:57:39.561853 2025] [:error] [pid 53479:tid 53539] [client 194.5.82.157:51005] [client 194.5.82.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aSDSQ26cicFF3Aas-oRZfAAAAIM"]
[Sat Nov 22 04:57:42.090480 2025] [:error] [pid 53478:tid 53525] [client 194.5.82.124:25605] [client 194.5.82.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aSDSRghUYdXBbQswAdTzCwAAAFA"]
[Sat Nov 22 04:57:42.376015 2025] [:error] [pid 53479:tid 53553] [client 194.5.82.121:24569] [client 194.5.82.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aSDSRm6cicFF3Aas-oRZgQAAAJE"]
[Sat Nov 22 04:57:46.723148 2025] [:error] [pid 53566:tid 53574] [client 194.5.82.143:53231] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aSDSSsbSHDBkRbwMbd4WMwAAAMY"]
[Sat Nov 22 04:57:47.856019 2025] [:error] [pid 53479:tid 53547] [client 194.5.82.161:35213] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "aSDSS26cicFF3Aas-oRZiwAAAIs"]
[Sat Nov 22 04:57:50.297188 2025] [:error] [pid 53566:tid 53574] [client 194.5.82.113:21783] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/edit.php"] [unique_id "aSDSTsbSHDBkRbwMbd4WQQAAAMY"]
[Sat Nov 22 04:57:52.987240 2025] [:error] [pid 53478:tid 53523] [client 194.5.82.117:37637] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aSDSUAhUYdXBbQswAdTzHgAAAE4"]
[Sat Nov 22 04:57:55.380153 2025] [:error] [pid 53477:tid 53485] [client 194.5.82.137:45707] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/click.php"] [unique_id "aSDSU37Lu30Ku9O40aK_9AAAAAQ"]
[Sat Nov 22 04:57:58.119236 2025] [:error] [pid 53478:tid 53514] [client 194.5.82.157:55959] [client 194.5.82.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aSDSVghUYdXBbQswAdTzKQAAAEU"]
[Sat Nov 22 04:58:03.583649 2025] [:error] [pid 25856:tid 25873] [client 194.5.82.137:50401] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aSDSWxsTP0wy94zKUvGIhQAAAQ8"]
[Sat Nov 22 04:58:04.268446 2025] [:error] [pid 53478:tid 53514] [client 194.5.82.116:27143] [client 194.5.82.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/xl2023.php"] [unique_id "aSDSXAhUYdXBbQswAdTzNAAAAEU"]
[Sat Nov 22 04:58:04.456532 2025] [:error] [pid 25856:tid 25858] [client 194.5.82.161:44939] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aSDSXBsTP0wy94zKUvGIhgAAAQA"]
[Sat Nov 22 04:58:04.681962 2025] [:error] [pid 53566:tid 53578] [client 194.5.82.106:36871] [client 194.5.82.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aSDSXMbSHDBkRbwMbd4WbAAAAMo"]
[Sat Nov 22 04:58:05.787145 2025] [:error] [pid 25856:tid 25878] [client 194.5.82.163:41099] [client 194.5.82.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aSDSXRsTP0wy94zKUvGIigAAARQ"]
[Sat Nov 22 04:58:06.043897 2025] [:error] [pid 53477:tid 53481] [client 194.5.82.105:59879] [client 194.5.82.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aSDSXn7Lu30Ku9O40aLABgAAAAA"]
[Sat Nov 22 04:58:07.793490 2025] [:error] [pid 53566:tid 53589] [client 194.5.82.119:59103] [client 194.5.82.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aSDSX8bSHDBkRbwMbd4WdQAAANU"]
[Sat Nov 22 04:58:08.046764 2025] [:error] [pid 53479:tid 53552] [client 194.5.82.137:21541] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSDSYG6cicFF3Aas-oRZogAAAJA"]
[Sat Nov 22 04:58:08.374607 2025] [:error] [pid 53478:tid 53527] [client 194.5.82.107:26365] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aSDSYAhUYdXBbQswAdTzPwAAAFI"]
[Sat Nov 22 04:58:08.562489 2025] [:error] [pid 53477:tid 53495] [client 194.5.82.161:37031] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "aSDSYH7Lu30Ku9O40aLACwAAAA4"]
[Sat Nov 22 04:58:09.695914 2025] [:error] [pid 53477:tid 53487] [client 194.5.82.125:26613] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aSDSYX7Lu30Ku9O40aLADgAAAAY"]
[Sat Nov 22 04:58:09.947465 2025] [proxy_fcgi:error] [pid 25856:tid 25868] [client 194.5.82.105:43819] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function add_action() in /home/expressi/public_html/wp-content/plugins/hello.php:69\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/plugins/hello.php on line 69'
[Sat Nov 22 04:58:11.134288 2025] [:error] [pid 25856:tid 25879] [client 194.5.82.146:61201] [client 194.5.82.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "aSDSYxsTP0wy94zKUvGIlgAAARU"]
[Sat Nov 22 04:58:14.588110 2025] [:error] [pid 53566:tid 53588] [client 194.5.82.106:24691] [client 194.5.82.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aSDSZsbSHDBkRbwMbd4WiQAAANQ"]
[Sat Nov 22 04:58:20.383027 2025] [:error] [pid 53479:tid 53551] [client 194.5.82.155:48173] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/file.php"] [unique_id "aSDSbG6cicFF3Aas-oRZuwAAAI8"]
[Sat Nov 22 04:58:22.918697 2025] [:error] [pid 53478:tid 53533] [client 194.5.82.132:27475] [client 194.5.82.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aSDSbghUYdXBbQswAdTzZAAAAFg"]
[Sat Nov 22 04:58:23.104260 2025] [:error] [pid 53478:tid 53521] [client 194.5.82.119:39019] [client 194.5.82.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aSDSbwhUYdXBbQswAdTzZgAAAEw"]
[Sat Nov 22 04:58:26.152062 2025] [:error] [pid 53479:tid 53540] [client 194.5.82.157:27963] [client 194.5.82.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSDScm6cicFF3Aas-oRZzwAAAIQ"]
[Sat Nov 22 04:58:30.554318 2025] [proxy_fcgi:error] [pid 53477:tid 53488] [client 194.5.82.105:28503] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:58:30.786698 2025] [proxy_fcgi:error] [pid 53477:tid 53504] [client 194.5.82.105:28503] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:58:30.947257 2025] [proxy_fcgi:error] [pid 53477:tid 53493] [client 194.5.82.105:28503] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:58:33.307920 2025] [:error] [pid 53477:tid 53505] [client 194.5.82.105:28503] [client 194.5.82.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSDSeX7Lu30Ku9O40aLAXgAAABg"]
[Sat Nov 22 04:58:33.714258 2025] [:error] [pid 53479:tid 53554] [client 194.5.82.113:24379] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aSDSeW6cicFF3Aas-oRZ3gAAAJI"]
[Sat Nov 22 04:58:33.929658 2025] [:error] [pid 53479:tid 53560] [client 194.5.82.145:49069] [client 194.5.82.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aSDSeW6cicFF3Aas-oRZ3wAAAJg"]
[Sat Nov 22 04:58:34.278605 2025] [:error] [pid 53478:tid 53532] [client 194.5.82.107:36507] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aSDSeghUYdXBbQswAdTzdgAAAFc"]
[Sat Nov 22 04:58:34.476343 2025] [:error] [pid 53566:tid 53580] [client 194.5.82.162:50743] [client 194.5.82.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aSDSesbSHDBkRbwMbd4W0AAAAMw"]
[Sat Nov 22 04:58:34.837250 2025] [:error] [pid 53566:tid 53571] [client 194.5.82.127:59243] [client 194.5.82.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aSDSesbSHDBkRbwMbd4W1gAAAMM"]
[Sat Nov 22 04:58:35.696903 2025] [:error] [pid 53566:tid 53578] [client 194.5.82.144:54453] [client 194.5.82.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "aSDSe8bSHDBkRbwMbd4W4AAAAMo"]
[Sat Nov 22 04:58:35.905102 2025] [:error] [pid 53479:tid 53545] [client 194.5.82.162:54869] [client 194.5.82.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aSDSe26cicFF3Aas-oRZ4gAAAIk"]
[Sat Nov 22 04:58:36.218507 2025] [:error] [pid 53477:tid 53502] [client 194.5.82.141:54961] [client 194.5.82.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aSDSfH7Lu30Ku9O40aLAagAAABU"]
[Sat Nov 22 04:58:36.401659 2025] [:error] [pid 53477:tid 53483] [client 194.5.82.131:61785] [client 194.5.82.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aSDSfH7Lu30Ku9O40aLAbQAAAAI"]
[Sat Nov 22 04:58:38.238506 2025] [:error] [pid 53478:tid 53525] [client 194.5.82.132:34571] [client 194.5.82.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aSDSfghUYdXBbQswAdTzhQAAAFA"]
[Sat Nov 22 04:58:39.176262 2025] [:error] [pid 53478:tid 53532] [client 194.5.82.136:37695] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "aSDSfwhUYdXBbQswAdTzigAAAFc"]
[Sat Nov 22 04:58:40.916099 2025] [:error] [pid 53478:tid 53520] [client 194.5.82.142:52389] [client 194.5.82.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aSDSgAhUYdXBbQswAdTzkQAAAEs"]
[Sat Nov 22 04:58:42.842080 2025] [:error] [pid 25856:tid 25874] [client 194.5.82.107:52513] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/about.php"] [unique_id "aSDSghsTP0wy94zKUvGI8AAAARA"]
[Sat Nov 22 04:58:45.362921 2025] [:error] [pid 25856:tid 25859] [client 194.5.82.125:25253] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aSDShRsTP0wy94zKUvGI-gAAAQE"]
[Sat Nov 22 04:58:48.623047 2025] [:error] [pid 53479:tid 53549] [client 194.5.82.136:49299] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aSDSiG6cicFF3Aas-oRaCQAAAI0"]
[Sat Nov 22 04:58:49.678430 2025] [:error] [pid 53478:tid 53519] [client 194.5.82.153:51067] [client 194.5.82.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aSDSiQhUYdXBbQswAdTzqAAAAEo"]
[Sat Nov 22 04:59:01.211717 2025] [:error] [pid 53566:tid 53579] [client 194.5.82.127:30365] [client 194.5.82.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aSDSlcbSHDBkRbwMbd4XPwAAAMs"]
[Sat Nov 22 04:59:01.462359 2025] [:error] [pid 53478:tid 53513] [client 194.5.82.156:20785] [client 194.5.82.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aSDSlQhUYdXBbQswAdTz0QAAAEQ"]
[Sat Nov 22 04:59:01.765366 2025] [:error] [pid 25856:tid 25863] [client 194.5.82.105:54029] [client 194.5.82.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.105, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSDSlRsTP0wy94zKUvGJHQAAAQU"]
[Sat Nov 22 04:59:05.213908 2025] [:error] [pid 25856:tid 25862] [client 194.5.82.105:54029] [client 194.5.82.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aSDSmRsTP0wy94zKUvGJMAAAAQQ"]
[Sat Nov 22 04:59:07.140951 2025] [:error] [pid 53566:tid 53577] [client 194.5.82.155:49137] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aSDSm8bSHDBkRbwMbd4XVAAAAMk"]
[Sat Nov 22 04:59:07.325908 2025] [:error] [pid 25856:tid 25867] [client 194.5.82.109:49371] [client 194.5.82.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aSDSmxsTP0wy94zKUvGJMwAAAQk"]
[Sat Nov 22 04:59:10.494602 2025] [:error] [pid 53566:tid 53592] [client 194.5.82.114:40743] [client 194.5.82.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aSDSnsbSHDBkRbwMbd4XZAAAANg"]
[Sat Nov 22 04:59:10.811426 2025] [:error] [pid 53479:tid 53551] [client 194.5.82.150:64335] [client 194.5.82.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aSDSnm6cicFF3Aas-oRaLwAAAI8"]
[Sat Nov 22 04:59:15.015480 2025] [:error] [pid 53566:tid 53570] [client 194.5.82.108:41313] [client 194.5.82.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aSDSo8bSHDBkRbwMbd4XfgAAAMI"]
[Sat Nov 22 04:59:16.778797 2025] [proxy_fcgi:error] [pid 53479:tid 53544] [client 194.5.82.156:37233] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 04:59:17.690856 2025] [:error] [pid 53479:tid 53542] [client 194.5.82.156:37233] [client 194.5.82.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/function.php"] [unique_id "aSDSpW6cicFF3Aas-oRaRwAAAIY"]
[Sat Nov 22 04:59:17.980420 2025] [:error] [pid 53477:tid 53487] [client 194.5.82.145:27707] [client 194.5.82.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/plugins.php"] [unique_id "aSDSpX7Lu30Ku9O40aLAugAAAAY"]
[Sat Nov 22 04:59:19.998038 2025] [:error] [pid 53566:tid 53574] [client 194.5.82.125:47173] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "aSDSp8bSHDBkRbwMbd4XjgAAAMY"]
[Sat Nov 22 04:59:20.293282 2025] [:error] [pid 53479:tid 53552] [client 194.5.82.139:23063] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aSDSqG6cicFF3Aas-oRaSwAAAJA"]
[Sat Nov 22 04:59:25.817638 2025] [:error] [pid 53478:tid 53530] [client 194.5.82.132:33305] [client 194.5.82.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/atomlib.php"] [unique_id "aSDSrQhUYdXBbQswAdT0FgAAAFU"]
[Sat Nov 22 04:59:26.010464 2025] [:error] [pid 53478:tid 53522] [client 194.5.82.140:29855] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aSDSrghUYdXBbQswAdT0FwAAAE0"]
[Sat Nov 22 04:59:29.484448 2025] [:error] [pid 53477:tid 53483] [client 194.5.82.162:33433] [client 194.5.82.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aSDSsX7Lu30Ku9O40aLA0wAAAAI"]
[Sat Nov 22 04:59:29.691828 2025] [:error] [pid 25856:tid 25862] [client 194.5.82.135:45177] [client 194.5.82.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSDSsRsTP0wy94zKUvGJaQAAAQQ"]
[Sat Nov 22 04:59:29.887607 2025] [:error] [pid 53566:tid 53579] [client 194.5.82.140:48019] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aSDSscbSHDBkRbwMbd4XqQAAAMs"]
[Sat Nov 22 04:59:34.404659 2025] [:error] [pid 25856:tid 25870] [client 194.5.82.164:61871] [client 194.5.82.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aSDSthsTP0wy94zKUvGJdgAAAQw"]
[Sat Nov 22 04:59:35.563528 2025] [:error] [pid 53479:tid 53544] [client 194.5.82.169:65207] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aSDSt26cicFF3Aas-oRabwAAAIg"]
[Sat Nov 22 04:59:41.446636 2025] [:error] [pid 53566:tid 53587] [client 194.5.82.161:38143] [client 194.5.82.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.161, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/js/wp-login.php"] [unique_id "aSDSvcbSHDBkRbwMbd4X0wAAANM"]
[Sat Nov 22 04:59:46.168943 2025] [:error] [pid 53566:tid 53577] [client 194.5.82.161:38143] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bk/index.php"] [unique_id "aSDSwsbSHDBkRbwMbd4X4QAAAMk"]
[Sat Nov 22 04:59:46.492875 2025] [:error] [pid 53477:tid 53491] [client 194.5.82.157:32229] [client 194.5.82.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.157, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aSDSwn7Lu30Ku9O40aLA6wAAAAo"]
[Sat Nov 22 04:59:54.847219 2025] [proxy_fcgi:error] [pid 53477:tid 53487] [client 194.5.82.157:32229] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 05:00:06.040322 2025] [:error] [pid 53477:tid 53504] [client 194.5.82.157:32229] [client 194.5.82.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/about.php"] [unique_id "aSDS1n7Lu30Ku9O40aLBKgAAABc"]
[Sat Nov 22 05:00:10.039132 2025] [:error] [pid 53479:tid 53560] [client 194.5.82.125:58079] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aSDS2m6cicFF3Aas-oRatwAAAJg"]
[Sat Nov 22 05:00:11.879653 2025] [:error] [pid 53478:tid 53514] [client 194.5.82.140:30675] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aSDS2whUYdXBbQswAdT0jAAAAEU"]
[Sat Nov 22 05:00:21.027632 2025] [:error] [pid 53477:tid 53481] [client 194.5.82.109:48909] [client 194.5.82.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aSDS5X7Lu30Ku9O40aLBTAAAAAA"]
[Sat Nov 22 05:00:22.998077 2025] [:error] [pid 53478:tid 53516] [client 194.5.82.134:33915] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aSDS5ghUYdXBbQswAdT0owAAAEc"]
[Sat Nov 22 05:00:24.168409 2025] [:error] [pid 53477:tid 53492] [client 194.5.82.132:56263] [client 194.5.82.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aSDS6H7Lu30Ku9O40aLBWAAAAAs"]
[Sat Nov 22 05:00:27.487682 2025] [proxy_fcgi:error] [pid 53566:tid 53573] [client 194.5.82.144:24059] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 05:00:27.602814 2025] [proxy_fcgi:error] [pid 53566:tid 53584] [client 194.5.82.144:24059] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 05:00:27.739705 2025] [:error] [pid 53566:tid 53586] [client 194.5.82.144:24059] [client 194.5.82.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aSDS68bSHDBkRbwMbd4YagAAANI"]
[Sat Nov 22 05:00:27.962276 2025] [:error] [pid 25856:tid 25878] [client 194.5.82.155:44607] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aSDS6xsTP0wy94zKUvGJ_gAAARQ"]
[Sat Nov 22 05:00:34.050727 2025] [:error] [pid 25856:tid 25881] [client 194.5.82.140:31915] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aSDS8hsTP0wy94zKUvGKEAAAARc"]
[Sat Nov 22 05:00:35.138849 2025] [:error] [pid 53566:tid 53573] [client 194.5.82.154:45295] [client 194.5.82.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "aSDS88bSHDBkRbwMbd4YgQAAAMU"]
[Sat Nov 22 05:00:38.101105 2025] [:error] [pid 53478:tid 53512] [client 194.5.82.140:26787] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aSDS9ghUYdXBbQswAdT0ygAAAEM"]
[Sat Nov 22 05:00:43.877709 2025] [:error] [pid 53479:tid 53545] [client 194.5.82.154:30669] [client 194.5.82.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aSDS-26cicFF3Aas-oRa-AAAAIk"]
[Sat Nov 22 05:00:44.209313 2025] [proxy_fcgi:error] [pid 25856:tid 25878] [client 194.5.82.117:56501] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 05:00:45.919023 2025] [:error] [pid 25856:tid 25879] [client 194.5.82.117:56501] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aSDS_RsTP0wy94zKUvGKNwAAARU"]
[Sat Nov 22 05:00:50.057850 2025] [proxy_fcgi:error] [pid 53477:tid 53495] [client 194.5.82.121:54735] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 05:00:50.957345 2025] [:error] [pid 53477:tid 53481] [client 194.5.82.121:54735] [client 194.5.82.121] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.121, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aSDTAn7Lu30Ku9O40aLB4wAAAAA"]
[Sat Nov 22 05:00:54.975879 2025] [:error] [pid 53477:tid 53502] [client 194.5.82.121:54735] [client 194.5.82.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aSDTBn7Lu30Ku9O40aLB8AAAABU"]
[Sat Nov 22 05:00:56.195138 2025] [:error] [pid 53479:tid 53537] [client 194.5.82.105:46527] [client 194.5.82.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aSDTCG6cicFF3Aas-oRbDwAAAIE"]
[Sat Nov 22 05:01:00.582843 2025] [:error] [pid 25856:tid 25858] [client 194.5.82.141:53717] [client 194.5.82.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aSDTDBsTP0wy94zKUvGKZAAAAQA"]
[Sat Nov 22 05:01:03.910273 2025] [:error] [pid 53479:tid 53537] [client 194.5.82.143:64971] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aSDTD26cicFF3Aas-oRbIAAAAIE"]
[Sat Nov 22 05:01:05.078694 2025] [:error] [pid 53477:tid 53500] [client 194.5.82.131:55547] [client 194.5.82.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aSDTEX7Lu30Ku9O40aLCAwAAABM"]
[Sat Nov 22 05:01:07.638394 2025] [:error] [pid 25856:tid 25876] [client 194.5.82.150:61025] [client 194.5.82.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aSDTExsTP0wy94zKUvGKfAAAARI"]
[Sat Nov 22 05:01:09.477501 2025] [proxy_fcgi:error] [pid 53566:tid 53577] [client 194.5.82.108:37799] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 05:01:09.599527 2025] [:error] [pid 53566:tid 53582] [client 194.5.82.108:37799] [client 194.5.82.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aSDTFcbSHDBkRbwMbd4YxgAAAM4"]
[Sat Nov 22 05:01:09.883210 2025] [proxy_fcgi:error] [pid 25856:tid 25868] [client 194.5.82.105:34227] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function add_action() in /home/expressi/public_html/wp-content/themes/twentytwentyfour/functions.php:147\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/themes/twentytwentyfour/functions.php on line 147'
[Sat Nov 22 05:01:10.138075 2025] [:error] [pid 53478:tid 53528] [client 194.5.82.107:27643] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/db.php"] [unique_id "aSDTFghUYdXBbQswAdT1VQAAAFM"]
[Sat Nov 22 05:01:10.398105 2025] [:error] [pid 53479:tid 53559] [client 194.5.82.138:42995] [client 194.5.82.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aSDTFm6cicFF3Aas-oRbKwAAAJc"]
[Sat Nov 22 05:01:10.589306 2025] [:error] [pid 53478:tid 53518] [client 194.5.82.147:58705] [client 194.5.82.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aSDTFghUYdXBbQswAdT1VgAAAEk"]
[Sat Nov 22 05:01:10.772904 2025] [:error] [pid 25856:tid 25877] [client 194.5.82.118:59313] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aSDTFhsTP0wy94zKUvGKhAAAARM"]
[Sat Nov 22 05:01:11.118615 2025] [:error] [pid 53477:tid 53493] [client 194.5.82.141:56483] [client 194.5.82.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aSDTF37Lu30Ku9O40aLCGgAAAAw"]
[Sat Nov 22 05:01:11.342303 2025] [:error] [pid 25856:tid 25875] [client 194.5.82.136:29251] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aSDTFxsTP0wy94zKUvGKhwAAARE"]
[Sat Nov 22 05:01:13.154453 2025] [:error] [pid 53477:tid 53505] [client 194.5.82.135:29929] [client 194.5.82.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aSDTGX7Lu30Ku9O40aLCIAAAABg"]
[Sat Nov 22 05:01:13.352600 2025] [:error] [pid 53479:tid 53546] [client 194.5.82.111:57467] [client 194.5.82.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aSDTGW6cicFF3Aas-oRbNAAAAIo"]
[Sat Nov 22 05:01:13.702507 2025] [:error] [pid 53479:tid 53547] [client 194.5.82.130:56921] [client 194.5.82.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aSDTGW6cicFF3Aas-oRbNQAAAIs"]
[Sat Nov 22 05:01:14.520720 2025] [:error] [pid 53477:tid 53488] [client 194.5.82.119:50287] [client 194.5.82.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aSDTGn7Lu30Ku9O40aLCIwAAAAc"]
[Sat Nov 22 05:01:16.409604 2025] [:error] [pid 53479:tid 53560] [client 194.5.82.153:28399] [client 194.5.82.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/options.php"] [unique_id "aSDTHG6cicFF3Aas-oRbQQAAAJg"]
[Sat Nov 22 05:01:16.597967 2025] [proxy_fcgi:error] [pid 53566:tid 53581] [client 194.5.82.145:55377] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 05:01:19.162534 2025] [:error] [pid 53566:tid 53589] [client 194.5.82.145:55377] [client 194.5.82.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.145, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aSDTH8bSHDBkRbwMbd4Y1QAAANU"]
[Sat Nov 22 05:01:25.010590 2025] [:error] [pid 53566:tid 53584] [client 194.5.82.145:55377] [client 194.5.82.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aSDTJcbSHDBkRbwMbd4Y7AAAANA"]
[Sat Nov 22 05:01:25.204043 2025] [:error] [pid 25856:tid 25873] [client 194.5.82.156:39501] [client 194.5.82.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aSDTJRsTP0wy94zKUvGKtAAAAQ8"]
[Sat Nov 22 05:01:37.724919 2025] [:error] [pid 53478:tid 53533] [client 194.5.82.152:42233] [client 194.5.82.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSDTMQhUYdXBbQswAdT1iQAAAFg"]
[Sat Nov 22 05:01:38.046954 2025] [:error] [pid 53479:tid 53556] [client 194.5.82.125:37625] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aSDTMm6cicFF3Aas-oRbdAAAAJQ"]
[Sat Nov 22 05:01:38.266967 2025] [:error] [pid 53479:tid 53560] [client 194.5.82.131:33613] [client 194.5.82.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aSDTMm6cicFF3Aas-oRbdQAAAJg"]
[Sat Nov 22 05:01:44.217450 2025] [:error] [pid 25856:tid 25876] [client 194.5.82.141:58147] [client 194.5.82.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aSDTOBsTP0wy94zKUvGK9QAAARI"]
[Sat Nov 22 05:01:44.527929 2025] [:error] [pid 53479:tid 53544] [client 194.5.82.117:26683] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aSDTOG6cicFF3Aas-oRbfgAAAIg"]
[Sat Nov 22 05:01:44.770014 2025] [:error] [pid 53479:tid 53541] [client 194.5.82.150:65421] [client 194.5.82.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aSDTOG6cicFF3Aas-oRbfwAAAIU"]
[Sat Nov 22 05:01:47.948232 2025] [:error] [pid 53479:tid 53537] [client 194.5.82.107:41173] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aSDTO26cicFF3Aas-oRbiwAAAIE"]
[Sat Nov 22 05:01:49.179408 2025] [:error] [pid 53479:tid 53556] [client 194.5.82.150:52175] [client 194.5.82.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aSDTPW6cicFF3Aas-oRbkAAAAJQ"]
[Sat Nov 22 05:01:51.045127 2025] [:error] [pid 53478:tid 53518] [client 194.5.82.143:25357] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aSDTPwhUYdXBbQswAdT1nQAAAEk"]
[Sat Nov 22 05:01:59.565995 2025] [:error] [pid 53566:tid 53592] [client 194.5.82.107:37301] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aSDTR8bSHDBkRbwMbd4ZOQAAANg"]
[Sat Nov 22 05:02:01.687803 2025] [:error] [pid 53478:tid 53532] [client 194.5.82.109:55233] [client 194.5.82.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/about.php"] [unique_id "aSDTSQhUYdXBbQswAdT1uwAAAFc"]
[Sat Nov 22 05:02:07.374804 2025] [:error] [pid 53478:tid 53533] [client 194.5.82.128:39233] [client 194.5.82.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-sup.php"] [unique_id "aSDTTwhUYdXBbQswAdT10gAAAFg"]
[Sat Nov 22 05:02:09.280182 2025] [:error] [pid 25856:tid 25864] [client 194.5.82.157:61871] [client 194.5.82.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aSDTURsTP0wy94zKUvGLTQAAAQY"]
[Sat Nov 22 05:02:12.478139 2025] [:error] [pid 53478:tid 53518] [client 194.5.82.157:30031] [client 194.5.82.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aSDTVAhUYdXBbQswAdT19AAAAEk"]
[Sat Nov 22 05:02:16.671481 2025] [:error] [pid 53566:tid 53571] [client 194.5.82.127:25711] [client 194.5.82.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aSDTWMbSHDBkRbwMbd4ZagAAAMM"]
[Sat Nov 22 05:02:18.421333 2025] [:error] [pid 53477:tid 53491] [client 194.5.82.128:53785] [client 194.5.82.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aSDTWn7Lu30Ku9O40aLCrAAAAAo"]
[Sat Nov 22 05:02:18.600484 2025] [:error] [pid 25856:tid 25867] [client 194.5.82.117:43025] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aSDTWhsTP0wy94zKUvGLegAAAQk"]
[Sat Nov 22 05:02:22.389710 2025] [:error] [pid 25856:tid 25861] [client 194.5.82.125:53737] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aSDTXhsTP0wy94zKUvGLlAAAAQM"]
[Sat Nov 22 05:02:26.064038 2025] [:error] [pid 53477:tid 53483] [client 194.5.82.153:23349] [client 194.5.82.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aSDTYn7Lu30Ku9O40aLCywAAAAI"]
[Sat Nov 22 05:02:29.254944 2025] [:error] [pid 53478:tid 53513] [client 194.5.82.153:63447] [client 194.5.82.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aSDTZQhUYdXBbQswAdT2FwAAAEQ"]
[Sat Nov 22 05:02:29.451092 2025] [:error] [pid 53566:tid 53576] [client 194.5.82.156:45717] [client 194.5.82.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aSDTZcbSHDBkRbwMbd4ZdwAAAMg"]
[Sat Nov 22 05:02:31.161715 2025] [:error] [pid 53566:tid 53574] [client 194.5.82.138:25847] [client 194.5.82.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aSDTZ8bSHDBkRbwMbd4ZfwAAAMY"]
[Sat Nov 22 05:02:33.582633 2025] [:error] [pid 25856:tid 25864] [client 194.5.82.147:33009] [client 194.5.82.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/install.php"] [unique_id "aSDTaRsTP0wy94zKUvGLwQAAAQY"]
[Sat Nov 22 05:02:33.764333 2025] [:error] [pid 53479:tid 53537] [client 194.5.82.117:40339] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aSDTaW6cicFF3Aas-oRb2gAAAIE"]
[Sat Nov 22 05:02:38.320847 2025] [:error] [pid 53566:tid 53589] [client 194.5.82.121:36285] [client 194.5.82.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/category-double.php"] [unique_id "aSDTbsbSHDBkRbwMbd4ZiwAAANU"]
[Sat Nov 22 05:02:40.073775 2025] [:error] [pid 53477:tid 53497] [client 194.5.82.154:59251] [client 194.5.82.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/db.php"] [unique_id "aSDTcH7Lu30Ku9O40aLC_AAAABA"]
[Sat Nov 22 05:02:40.254044 2025] [:error] [pid 53478:tid 53520] [client 194.5.82.108:37149] [client 194.5.82.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/security.php"] [unique_id "aSDTcAhUYdXBbQswAdT2IwAAAEs"]
[Sat Nov 22 05:02:42.069831 2025] [:error] [pid 53479:tid 53540] [client 194.5.82.122:59343] [client 194.5.82.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aSDTcm6cicFF3Aas-oRb8gAAAIQ"]
[Sat Nov 22 05:02:43.158474 2025] [:error] [pid 53478:tid 53509] [client 194.5.82.144:28359] [client 194.5.82.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aSDTcwhUYdXBbQswAdT2KAAAAEA"]
[Sat Nov 22 05:02:47.066917 2025] [:error] [pid 25856:tid 25861] [client 194.5.82.111:22819] [client 194.5.82.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aSDTdxsTP0wy94zKUvGL7gAAAQM"]
[Sat Nov 22 05:02:48.920154 2025] [:error] [pid 25856:tid 25858] [client 194.5.82.107:27095] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aSDTeBsTP0wy94zKUvGL-QAAAQA"]
[Sat Nov 22 05:02:50.888122 2025] [:error] [pid 53477:tid 53489] [client 194.5.82.155:31253] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aSDTen7Lu30Ku9O40aLDGgAAAAg"]
[Sat Nov 22 05:02:51.968028 2025] [:error] [pid 53566:tid 53574] [client 194.5.82.121:58565] [client 194.5.82.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/as.php"] [unique_id "aSDTe8bSHDBkRbwMbd4ZuQAAAMY"]
[Sat Nov 22 05:02:53.084541 2025] [:error] [pid 53478:tid 53520] [client 194.5.82.155:47111] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aSDTfQhUYdXBbQswAdT2PgAAAEs"]
[Sat Nov 22 05:02:53.271789 2025] [:error] [pid 53566:tid 53590] [client 194.5.82.132:24319] [client 194.5.82.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/install.php"] [unique_id "aSDTfcbSHDBkRbwMbd4ZwgAAANY"]
[Sat Nov 22 05:02:53.454745 2025] [:error] [pid 53478:tid 53511] [client 194.5.82.141:49073] [client 194.5.82.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/db.php"] [unique_id "aSDTfQhUYdXBbQswAdT2QAAAAEI"]
[Sat Nov 22 05:02:58.258124 2025] [:error] [pid 53479:tid 53560] [client 194.5.82.137:40077] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aSDTgm6cicFF3Aas-oRcJQAAAJg"]
[Sat Nov 22 05:03:01.225684 2025] [:error] [pid 53478:tid 53512] [client 194.5.82.164:48171] [client 194.5.82.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rk2.php"] [unique_id "aSDThQhUYdXBbQswAdT2XgAAAEM"]
[Sat Nov 22 05:03:04.755351 2025] [:error] [pid 53479:tid 53550] [client 194.5.82.160:28937] [client 194.5.82.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/past.php"] [unique_id "aSDTiG6cicFF3Aas-oRcRgAAAI4"]
[Sat Nov 22 05:03:07.689971 2025] [:error] [pid 53477:tid 53505] [client 194.5.82.156:46247] [client 194.5.82.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/edit-tags.php"] [unique_id "aSDTi37Lu30Ku9O40aLDXwAAABg"]
[Sat Nov 22 05:03:12.861406 2025] [:error] [pid 53478:tid 53522] [client 194.5.82.139:45325] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aSDTkAhUYdXBbQswAdT2fAAAAE0"]
[Sat Nov 22 05:03:14.104515 2025] [:error] [pid 53478:tid 53511] [client 194.5.82.107:58721] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aSDTkghUYdXBbQswAdT2fgAAAEI"]
[Sat Nov 22 05:03:15.413057 2025] [:error] [pid 53479:tid 53558] [client 194.5.82.136:25291] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aSDTk26cicFF3Aas-oRceAAAAJY"]
[Sat Nov 22 05:03:17.296929 2025] [:error] [pid 53477:tid 53483] [client 194.5.82.122:62439] [client 194.5.82.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aSDTlX7Lu30Ku9O40aLDkQAAAAI"]
[Sat Nov 22 05:03:23.937834 2025] [:error] [pid 25856:tid 25858] [client 194.5.82.131:49915] [client 194.5.82.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aSDTmxsTP0wy94zKUvGMjAAAAQA"]
[Sat Nov 22 05:03:24.125747 2025] [:error] [pid 53566:tid 53585] [client 194.5.82.113:36041] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aSDTnMbSHDBkRbwMbd4adwAAANE"]
[Sat Nov 22 05:03:26.984665 2025] [:error] [pid 53566:tid 53579] [client 194.5.82.118:57013] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aSDTnsbSHDBkRbwMbd4ahwAAAMs"]
[Sat Nov 22 05:03:27.355533 2025] [:error] [pid 53478:tid 53519] [client 194.5.82.170:56007] [client 194.5.82.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aSDTnwhUYdXBbQswAdT2nwAAAEo"]
[Sat Nov 22 05:03:29.282966 2025] [:error] [pid 53478:tid 53518] [client 194.5.82.109:21621] [client 194.5.82.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aSDToQhUYdXBbQswAdT2pwAAAEk"]
[Sat Nov 22 05:03:29.469464 2025] [:error] [pid 53478:tid 53532] [client 194.5.82.159:63373] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ms-file.php"] [unique_id "aSDToQhUYdXBbQswAdT2qQAAAFc"]
[Sat Nov 22 05:03:29.832611 2025] [:error] [pid 25856:tid 25859] [client 194.5.82.164:20565] [client 194.5.82.164] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.164, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aSDToRsTP0wy94zKUvGMpAAAAQE"]
[Sat Nov 22 05:03:29.840613 2025] [proxy_fcgi:error] [pid 25856:tid 25859] [client 194.5.82.164:20565] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 05:03:29.933490 2025] [:error] [pid 25856:tid 25876] [client 194.5.82.164:20565] [client 194.5.82.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/av.php"] [unique_id "aSDToRsTP0wy94zKUvGMpQAAARI"]
[Sat Nov 22 05:03:32.668340 2025] [:error] [pid 53477:tid 53505] [client 194.5.82.125:20925] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSDTpH7Lu30Ku9O40aLD1AAAABg"]
[Sat Nov 22 05:03:32.854516 2025] [:error] [pid 25856:tid 25875] [client 194.5.82.142:62387] [client 194.5.82.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/network.php"] [unique_id "aSDTpBsTP0wy94zKUvGMuQAAARE"]
[Sat Nov 22 05:03:38.819886 2025] [:error] [pid 25856:tid 25880] [client 194.5.82.123:59291] [client 194.5.82.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aSDTqhsTP0wy94zKUvGM6gAAARY"]
[Sat Nov 22 05:03:39.183085 2025] [:error] [pid 53477:tid 53485] [client 194.5.82.117:49695] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/item.php"] [unique_id "aSDTq37Lu30Ku9O40aLD8wAAAAQ"]
[Sat Nov 22 05:03:40.836763 2025] [:error] [pid 53566:tid 53573] [client 194.5.82.170:58169] [client 194.5.82.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aSDTrMbSHDBkRbwMbd4apQAAAMU"]
[Sat Nov 22 05:03:41.084646 2025] [:error] [pid 53477:tid 53498] [client 194.5.82.144:20475] [client 194.5.82.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/install.php"] [unique_id "aSDTrX7Lu30Ku9O40aLEAAAAABE"]
[Sat Nov 22 05:03:41.283449 2025] [proxy_fcgi:error] [pid 53566:tid 53590] [client 194.5.82.132:36329] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 05:03:41.383510 2025] [:error] [pid 53566:tid 53589] [client 194.5.82.132:36329] [client 194.5.82.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.82.132, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aSDTrcbSHDBkRbwMbd4apwAAANU"]
[Sat Nov 22 05:03:43.021451 2025] [:error] [pid 53566:tid 53572] [client 194.5.82.132:36329] [client 194.5.82.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aSDTr8bSHDBkRbwMbd4arQAAAMQ"]
[Sat Nov 22 05:03:47.127226 2025] [:error] [pid 53566:tid 53583] [client 194.5.82.136:30627] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aSDTs8bSHDBkRbwMbd4avgAAAM8"]
[Sat Nov 22 05:03:48.362629 2025] [:error] [pid 53477:tid 53504] [client 194.5.82.154:20851] [client 194.5.82.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aSDTtH7Lu30Ku9O40aLEJgAAABc"]
[Sat Nov 22 05:03:48.569780 2025] [:error] [pid 53478:tid 53510] [client 194.5.82.120:32159] [client 194.5.82.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aSDTtAhUYdXBbQswAdT24QAAAEE"]
[Sat Nov 22 05:03:51.255621 2025] [:error] [pid 25856:tid 25871] [client 194.5.82.137:41603] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aSDTtxsTP0wy94zKUvGNHgAAAQ0"]
[Sat Nov 22 05:03:53.206029 2025] [:error] [pid 25856:tid 25878] [client 194.5.82.135:30625] [client 194.5.82.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "aSDTuRsTP0wy94zKUvGNLQAAARQ"]
[Sat Nov 22 05:03:56.976745 2025] [:error] [pid 53566:tid 53585] [client 194.5.82.155:28957] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aSDTvMbSHDBkRbwMbd4a7gAAANE"]
[Sat Nov 22 05:03:57.194796 2025] [:error] [pid 53478:tid 53511] [client 194.5.82.135:20289] [client 194.5.82.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bypass.php"] [unique_id "aSDTvQhUYdXBbQswAdT2_QAAAEI"]
[Sat Nov 22 05:03:58.537026 2025] [:error] [pid 25856:tid 25866] [client 194.5.82.123:49527] [client 194.5.82.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/count.php"] [unique_id "aSDTvhsTP0wy94zKUvGNQAAAAQg"]
[Sat Nov 22 05:04:04.057402 2025] [:error] [pid 53478:tid 53527] [client 194.5.82.118:35579] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aSDTxAhUYdXBbQswAdT3KgAAAFI"]
[Sat Nov 22 05:04:06.224660 2025] [:error] [pid 25856:tid 25861] [client 194.5.82.155:47853] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "expressinteriors.com"] [uri "/images/stories/themes.php"] [unique_id "aSDTxhsTP0wy94zKUvGNWQAAAQM"]
[Sat Nov 22 05:04:06.359461 2025] [:error] [pid 25856:tid 25872] [client 194.5.82.155:47853] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aSDTxhsTP0wy94zKUvGNWgAAAQ4"]
[Sat Nov 22 05:04:08.304440 2025] [:error] [pid 53477:tid 53489] [client 194.5.82.154:33213] [client 194.5.82.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aSDTyH7Lu30Ku9O40aLEdQAAAAg"]
[Sat Nov 22 05:04:08.574703 2025] [:error] [pid 53478:tid 53524] [client 194.5.82.123:55931] [client 194.5.82.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/vars-soap.php"] [unique_id "aSDTyAhUYdXBbQswAdT3QAAAAE8"]
[Sat Nov 22 05:04:14.219530 2025] [:error] [pid 53479:tid 53558] [client 194.5.82.157:53545] [client 194.5.82.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aSDTzm6cicFF3Aas-oRdNgAAAJY"]
[Sat Nov 22 05:04:16.405113 2025] [:error] [pid 53477:tid 53495] [client 194.5.82.111:48719] [client 194.5.82.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aSDT0H7Lu30Ku9O40aLElgAAAA4"]
[Sat Nov 22 05:04:17.622589 2025] [:error] [pid 53478:tid 53531] [client 194.5.82.160:54973] [client 194.5.82.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aSDT0QhUYdXBbQswAdT3dQAAAFY"]
[Sat Nov 22 05:04:23.391815 2025] [:error] [pid 53477:tid 53498] [client 194.5.82.159:51501] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aSDT137Lu30Ku9O40aLEwQAAABE"]
[Sat Nov 22 05:04:24.785565 2025] [:error] [pid 25856:tid 25872] [client 194.5.82.123:34691] [client 194.5.82.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/colour.php"] [unique_id "aSDT2BsTP0wy94zKUvGNpgAAAQ4"]
[Sat Nov 22 05:04:26.124425 2025] [:error] [pid 53566:tid 53591] [client 194.5.82.161:56477] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aSDT2sbSHDBkRbwMbd4bVwAAANc"]
[Sat Nov 22 05:04:26.322496 2025] [:error] [pid 25856:tid 25861] [client 194.5.82.125:54215] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/include.php"] [unique_id "aSDT2hsTP0wy94zKUvGNrAAAAQM"]
[Sat Nov 22 05:04:28.263304 2025] [:error] [pid 53566:tid 53579] [client 194.5.82.105:60675] [client 194.5.82.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aSDT3MbSHDBkRbwMbd4bXwAAAMs"]
[Sat Nov 22 05:04:32.694599 2025] [:error] [pid 53566:tid 53585] [client 194.5.82.159:60591] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aSDT4MbSHDBkRbwMbd4bbAAAANE"]
[Sat Nov 22 05:04:32.893834 2025] [:error] [pid 25856:tid 25860] [client 194.5.82.161:61309] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about5.php"] [unique_id "aSDT4BsTP0wy94zKUvGNwwAAAQI"]
[Sat Nov 22 05:04:39.000817 2025] [:error] [pid 53478:tid 53532] [client 194.5.82.118:20803] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/db.php"] [unique_id "aSDT5ghUYdXBbQswAdT34gAAAFc"]
[Sat Nov 22 05:04:41.438771 2025] [:error] [pid 53479:tid 53550] [client 194.5.82.170:37561] [client 194.5.82.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aSDT6W6cicFF3Aas-oRdkgAAAI4"]
[Sat Nov 22 05:04:45.106774 2025] [:error] [pid 53479:tid 53541] [client 194.5.82.117:20981] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aSDT7W6cicFF3Aas-oRdngAAAIU"]
[Sat Nov 22 05:04:45.424601 2025] [:error] [pid 25856:tid 25869] [client 194.5.82.159:44043] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aSDT7RsTP0wy94zKUvGN8AAAAQs"]
[Sat Nov 22 05:04:46.822504 2025] [:error] [pid 53478:tid 53518] [client 194.5.82.140:24061] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aSDT7ghUYdXBbQswAdT3_wAAAEk"]
[Sat Nov 22 05:04:49.001622 2025] [:error] [pid 53478:tid 53527] [client 194.5.82.136:28799] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aSDT8QhUYdXBbQswAdT4DAAAAFI"]
[Sat Nov 22 05:04:51.315075 2025] [:error] [pid 53477:tid 53484] [client 194.5.82.159:60541] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aSDT837Lu30Ku9O40aLFCgAAAAM"]
[Sat Nov 22 05:04:51.594904 2025] [:error] [pid 25856:tid 25877] [client 194.5.82.150:30373] [client 194.5.82.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aSDT8xsTP0wy94zKUvGOBAAAARM"]
[Sat Nov 22 05:04:52.927904 2025] [:error] [pid 53478:tid 53509] [client 194.5.82.132:58737] [client 194.5.82.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aSDT9AhUYdXBbQswAdT4GgAAAEA"]
[Sat Nov 22 05:04:53.111431 2025] [:error] [pid 53566:tid 53571] [client 194.5.82.139:26209] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/simi.php"] [unique_id "aSDT9cbSHDBkRbwMbd4blwAAAMM"]
[Sat Nov 22 05:04:55.423834 2025] [:error] [pid 53478:tid 53524] [client 194.5.82.118:22069] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aSDT9whUYdXBbQswAdT4JwAAAE8"]
[Sat Nov 22 05:04:56.434053 2025] [:error] [pid 53566:tid 53574] [client 194.5.82.127:62297] [client 194.5.82.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aSDT-MbSHDBkRbwMbd4bogAAAMY"]
[Sat Nov 22 05:04:56.712564 2025] [:error] [pid 53479:tid 53560] [client 194.5.82.139:56211] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aSDT-G6cicFF3Aas-oRdvAAAAJg"]
[Sat Nov 22 05:04:56.988640 2025] [:error] [pid 53478:tid 53518] [client 194.5.82.170:53213] [client 194.5.82.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aSDT-AhUYdXBbQswAdT4OQAAAEk"]
[Sat Nov 22 05:05:00.103757 2025] [:error] [pid 25856:tid 25873] [client 194.5.82.170:35839] [client 194.5.82.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aSDT_BsTP0wy94zKUvGOKQAAAQ8"]
[Sat Nov 22 05:05:02.359932 2025] [:error] [pid 53478:tid 53523] [client 194.5.82.143:27403] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aSDT_ghUYdXBbQswAdT4YwAAAE4"]
[Sat Nov 22 05:05:03.648778 2025] [:error] [pid 53478:tid 53528] [client 194.5.82.130:30225] [client 194.5.82.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aSDT_whUYdXBbQswAdT4cQAAAFM"]
[Sat Nov 22 05:05:03.905821 2025] [proxy_fcgi:error] [pid 53566:tid 53577] [client 194.5.82.113:35583] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_locale() in /home/expressi/public_html/wp-admin/includes/admin.php:16\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-admin/includes/admin.php on line 16'
[Sat Nov 22 05:05:04.165181 2025] [:error] [pid 53566:tid 53576] [client 194.5.82.125:61887] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aSDUAMbSHDBkRbwMbd4b9gAAAMg"]
[Sat Nov 22 05:05:11.602522 2025] [:error] [pid 53566:tid 53586] [client 194.5.82.118:24127] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/plugin.php"] [unique_id "aSDUB8bSHDBkRbwMbd4cZAAAANI"]
[Sat Nov 22 05:05:11.783821 2025] [:error] [pid 25856:tid 25866] [client 194.5.82.128:33955] [client 194.5.82.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aSDUBxsTP0wy94zKUvGOSAAAAQg"]
[Sat Nov 22 05:05:14.258914 2025] [:error] [pid 53479:tid 53554] [client 194.5.82.156:43635] [client 194.5.82.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aSDUCm6cicFF3Aas-oReCwAAAJI"]
[Sat Nov 22 05:05:18.136466 2025] [:error] [pid 53478:tid 53513] [client 194.5.82.140:43231] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aSDUDghUYdXBbQswAdT4pwAAAEQ"]
[Sat Nov 22 05:05:20.790591 2025] [:error] [pid 53566:tid 53575] [client 194.5.82.152:21271] [client 194.5.82.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aSDUEMbSHDBkRbwMbd4cvwAAAMc"]
[Sat Nov 22 05:05:22.484821 2025] [:error] [pid 53566:tid 53575] [client 194.5.82.161:59785] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aSDUEsbSHDBkRbwMbd4czQAAAMc"]
[Sat Nov 22 05:05:23.928764 2025] [:error] [pid 53478:tid 53528] [client 194.5.82.113:30919] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aSDUEwhUYdXBbQswAdT4vwAAAFM"]
[Sat Nov 22 05:05:25.321796 2025] [:error] [pid 53479:tid 53558] [client 194.5.82.147:52399] [client 194.5.82.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aSDUFW6cicFF3Aas-oReNwAAAJY"]
[Sat Nov 22 05:05:32.019347 2025] [:error] [pid 53477:tid 53489] [client 194.5.82.140:53999] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aSDUHH7Lu30Ku9O40aLFoAAAAAg"]
[Sat Nov 22 05:05:35.384620 2025] [:error] [pid 53566:tid 53569] [client 194.5.82.124:20991] [client 194.5.82.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aSDUH8bSHDBkRbwMbd4dAwAAAME"]
[Sat Nov 22 05:05:35.578384 2025] [proxy_fcgi:error] [pid 25856:tid 25869] [client 194.5.82.170:55891] AH01071: Got error 'Primary script unknown'
[Sat Nov 22 05:05:35.751795 2025] [:error] [pid 25856:tid 25875] [client 194.5.82.170:55891] [client 194.5.82.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aSDUHxsTP0wy94zKUvGPBgAAARE"]
[Sat Nov 22 05:05:35.938611 2025] [:error] [pid 25856:tid 25864] [client 194.5.82.127:60321] [client 194.5.82.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aSDUHxsTP0wy94zKUvGPCQAAAQY"]
[Sat Nov 22 05:05:37.868892 2025] [:error] [pid 53477:tid 53482] [client 194.5.82.150:50263] [client 194.5.82.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aSDUIX7Lu30Ku9O40aLFvQAAAAE"]
[Sat Nov 22 05:05:38.163665 2025] [:error] [pid 53479:tid 53545] [client 194.5.82.155:47589] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aSDUIm6cicFF3Aas-oReXgAAAIk"]
[Sat Nov 22 05:05:44.328036 2025] [:error] [pid 53478:tid 53526] [client 194.5.82.130:49725] [client 194.5.82.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-2019.php"] [unique_id "aSDUKAhUYdXBbQswAdT48AAAAFE"]
[Sat Nov 22 05:05:44.549808 2025] [:error] [pid 53478:tid 53530] [client 194.5.82.169:52697] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aSDUKAhUYdXBbQswAdT48QAAAFU"]
[Sat Nov 22 05:05:45.813144 2025] [:error] [pid 53479:tid 53556] [client 194.5.82.144:21583] [client 194.5.82.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/log.php"] [unique_id "aSDUKW6cicFF3Aas-oReegAAAJQ"]
[Sat Nov 22 05:05:46.064462 2025] [:error] [pid 53477:tid 53493] [client 194.5.82.134:57457] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aSDUKn7Lu30Ku9O40aLF3QAAAAw"]
[Sat Nov 22 05:05:46.359193 2025] [:error] [pid 53479:tid 53558] [client 194.5.82.143:26079] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aSDUKm6cicFF3Aas-oRefQAAAJY"]
[Sat Nov 22 05:05:46.659563 2025] [:error] [pid 53479:tid 53551] [client 194.5.82.131:53953] [client 194.5.82.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/aw.php"] [unique_id "aSDUKm6cicFF3Aas-oRegQAAAI8"]
[Sat Nov 22 05:05:50.683451 2025] [:error] [pid 53566:tid 53583] [client 194.5.82.132:54055] [client 194.5.82.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/db.php"] [unique_id "aSDULsbSHDBkRbwMbd4dPgAAAM8"]
[Sat Nov 22 05:05:50.865756 2025] [:error] [pid 53566:tid 53579] [client 194.5.82.164:54877] [client 194.5.82.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/install.php"] [unique_id "aSDULsbSHDBkRbwMbd4dQQAAAMs"]
[Sat Nov 22 05:05:52.826780 2025] [:error] [pid 53477:tid 53487] [client 194.5.82.162:22213] [client 194.5.82.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aSDUMH7Lu30Ku9O40aLF-QAAAAY"]
[Sat Nov 22 05:05:53.134674 2025] [:error] [pid 53566:tid 53590] [client 194.5.82.147:33035] [client 194.5.82.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aSDUMcbSHDBkRbwMbd4dTgAAANY"]
[Sat Nov 22 05:05:55.090738 2025] [:error] [pid 53479:tid 53544] [client 194.5.82.132:43621] [client 194.5.82.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/template-less.php"] [unique_id "aSDUM26cicFF3Aas-oRepAAAAIg"]
[Sat Nov 22 05:05:55.287937 2025] [:error] [pid 53478:tid 53518] [client 194.5.82.136:55305] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aSDUMwhUYdXBbQswAdT5BwAAAEk"]
[Sat Nov 22 05:06:01.769444 2025] [:error] [pid 53479:tid 53554] [client 194.5.82.143:64417] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/min.php"] [unique_id "aSDUOW6cicFF3Aas-oRewwAAAJI"]
[Sat Nov 22 05:06:01.987709 2025] [:error] [pid 25856:tid 25869] [client 194.5.82.111:32017] [client 194.5.82.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aSDUORsTP0wy94zKUvGPZAAAAQs"]
[Sat Nov 22 05:06:04.428431 2025] [:error] [pid 53477:tid 53498] [client 194.5.82.128:42957] [client 194.5.82.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/file.php"] [unique_id "aSDUPH7Lu30Ku9O40aLGKQAAABE"]
[Sat Nov 22 05:06:05.824453 2025] [:error] [pid 53477:tid 53504] [client 194.5.82.154:54631] [client 194.5.82.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aSDUPX7Lu30Ku9O40aLGLgAAABc"]
[Sat Nov 22 05:06:07.065926 2025] [:error] [pid 25856:tid 25865] [client 194.5.82.152:35411] [client 194.5.82.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/load.php"] [unique_id "aSDUPxsTP0wy94zKUvGPdwAAAQc"]
[Sat Nov 22 05:06:07.257262 2025] [:error] [pid 53478:tid 53532] [client 194.5.82.140:23965] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aSDUPwhUYdXBbQswAdT5eAAAAFc"]
[Sat Nov 22 05:06:07.465624 2025] [:error] [pid 53479:tid 53556] [client 194.5.82.164:35853] [client 194.5.82.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aSDUP26cicFF3Aas-oRezAAAAJQ"]
[Sat Nov 22 05:06:10.471710 2025] [:error] [pid 53478:tid 53522] [client 194.5.82.142:54987] [client 194.5.82.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aSDUQghUYdXBbQswAdT5lwAAAE0"]
[Sat Nov 22 05:06:11.673603 2025] [:error] [pid 53478:tid 53526] [client 194.5.82.134:64873] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aSDUQwhUYdXBbQswAdT5owAAAFE"]
[Sat Nov 22 05:06:15.342843 2025] [:error] [pid 25856:tid 25869] [client 194.5.82.116:59403] [client 194.5.82.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aSDURxsTP0wy94zKUvGPkgAAAQs"]
[Sat Nov 22 05:06:15.526383 2025] [:error] [pid 53566:tid 53591] [client 194.5.82.154:42839] [client 194.5.82.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aSDUR8bSHDBkRbwMbd4ddQAAANc"]
[Sat Nov 22 05:06:16.764990 2025] [:error] [pid 53478:tid 53530] [client 194.5.82.141:45487] [client 194.5.82.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aSDUSAhUYdXBbQswAdT58AAAAFU"]
[Sat Nov 22 05:06:25.597491 2025] [:error] [pid 25856:tid 25871] [client 194.5.82.113:38715] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/system.php"] [unique_id "aSDUURsTP0wy94zKUvGPsAAAAQ0"]
[Sat Nov 22 05:06:26.813517 2025] [:error] [pid 53478:tid 53529] [client 194.5.82.131:26847] [client 194.5.82.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aSDUUghUYdXBbQswAdT6MQAAAFQ"]
[Sat Nov 22 05:06:28.919995 2025] [:error] [pid 53566:tid 53580] [client 194.5.82.122:35523] [client 194.5.82.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aSDUVMbSHDBkRbwMbd4dnwAAAMw"]
[Sat Nov 22 05:06:29.230562 2025] [:error] [pid 53479:tid 53550] [client 194.5.82.113:41451] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aSDUVW6cicFF3Aas-oRe8gAAAI4"]
[Sat Nov 22 05:06:29.485531 2025] [:error] [pid 53477:tid 53481] [client 194.5.82.120:42387] [client 194.5.82.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aSDUVX7Lu30Ku9O40aLGfAAAAAA"]
[Sat Nov 22 05:06:31.197296 2025] [autoindex:error] [pid 53478:tid 53519] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:31.342773 2025] [autoindex:error] [pid 53478:tid 53526] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:33.027052 2025] [autoindex:error] [pid 53478:tid 53510] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:33.140662 2025] [autoindex:error] [pid 53478:tid 53532] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:34.093158 2025] [autoindex:error] [pid 53478:tid 53530] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:34.225211 2025] [autoindex:error] [pid 53478:tid 53531] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:34.380277 2025] [autoindex:error] [pid 53478:tid 53521] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:34.492714 2025] [autoindex:error] [pid 53478:tid 53533] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:34.654199 2025] [autoindex:error] [pid 53478:tid 53512] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:34.748408 2025] [autoindex:error] [pid 53478:tid 53529] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:35.027505 2025] [autoindex:error] [pid 53478:tid 53520] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:35.806697 2025] [autoindex:error] [pid 53478:tid 53531] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:35.906081 2025] [autoindex:error] [pid 53478:tid 53525] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:37.644647 2025] [autoindex:error] [pid 53478:tid 53514] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:37.764061 2025] [autoindex:error] [pid 53478:tid 53515] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:37.936611 2025] [autoindex:error] [pid 53478:tid 53517] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:38.052977 2025] [autoindex:error] [pid 53478:tid 53532] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:39.271840 2025] [autoindex:error] [pid 53478:tid 53519] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:39.368203 2025] [autoindex:error] [pid 53478:tid 53528] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:40.759360 2025] [autoindex:error] [pid 53478:tid 53529] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:42.616631 2025] [autoindex:error] [pid 53478:tid 53516] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:42.712576 2025] [autoindex:error] [pid 53478:tid 53519] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:42.813074 2025] [autoindex:error] [pid 53478:tid 53528] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:45.301835 2025] [autoindex:error] [pid 53478:tid 53524] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:47.632337 2025] [autoindex:error] [pid 53478:tid 53531] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:48.450087 2025] [autoindex:error] [pid 53478:tid 53533] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:48.559306 2025] [autoindex:error] [pid 53478:tid 53529] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:48.865206 2025] [autoindex:error] [pid 53478:tid 53524] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:48.960753 2025] [autoindex:error] [pid 53478:tid 53516] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:49.060112 2025] [autoindex:error] [pid 53478:tid 53530] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:06:52.672721 2025] [autoindex:error] [pid 53478:tid 53523] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:07:17.391478 2025] [autoindex:error] [pid 53478:tid 53531] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:07:17.517453 2025] [autoindex:error] [pid 53478:tid 53525] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:07:17.670625 2025] [autoindex:error] [pid 53478:tid 53524] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:07:17.789425 2025] [autoindex:error] [pid 53478:tid 53530] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:07:19.854876 2025] [autoindex:error] [pid 53478:tid 53510] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:07:19.972451 2025] [autoindex:error] [pid 53478:tid 53528] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:07:21.114180 2025] [autoindex:error] [pid 53478:tid 53533] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:07:22.143525 2025] [autoindex:error] [pid 53478:tid 53528] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:07:22.265239 2025] [autoindex:error] [pid 53478:tid 53531] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:07:22.387348 2025] [autoindex:error] [pid 53478:tid 53525] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:07:23.411924 2025] [autoindex:error] [pid 53478:tid 53533] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:07:23.586479 2025] [autoindex:error] [pid 53478:tid 53526] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:07:23.703705 2025] [autoindex:error] [pid 53478:tid 53523] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:07:23.849442 2025] [autoindex:error] [pid 53478:tid 53513] [client 194.5.82.154:62775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:07:45.634185 2025] [autoindex:error] [pid 53479:tid 53541] [client 194.5.82.136:24027] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:07:56.458786 2025] [autoindex:error] [pid 53479:tid 53553] [client 194.5.82.136:24027] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:07:59.648851 2025] [autoindex:error] [pid 53479:tid 53552] [client 194.5.82.136:24027] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:07:59.785164 2025] [autoindex:error] [pid 53479:tid 53559] [client 194.5.82.136:24027] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:08:03.697299 2025] [autoindex:error] [pid 53479:tid 53552] [client 194.5.82.136:24027] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:08:03.833594 2025] [autoindex:error] [pid 53479:tid 53546] [client 194.5.82.136:24027] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:08:03.929904 2025] [autoindex:error] [pid 53479:tid 53560] [client 194.5.82.136:24027] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:08:04.046154 2025] [autoindex:error] [pid 53479:tid 53548] [client 194.5.82.136:24027] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:08:04.195813 2025] [autoindex:error] [pid 53479:tid 53555] [client 194.5.82.136:24027] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:08:04.350810 2025] [autoindex:error] [pid 53479:tid 53538] [client 194.5.82.136:24027] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:08:04.447382 2025] [autoindex:error] [pid 53479:tid 53543] [client 194.5.82.136:24027] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:08:04.562818 2025] [autoindex:error] [pid 53479:tid 53545] [client 194.5.82.136:24027] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:08:04.723454 2025] [autoindex:error] [pid 53479:tid 53539] [client 194.5.82.136:24027] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:08:20.918500 2025] [autoindex:error] [pid 53479:tid 53556] [client 194.5.82.136:24027] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 05:42:32.087890 2025] [:error] [pid 53566:tid 53571] [client 85.8.130.74:23213] [client 85.8.130.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.74, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSDcyMbSHDBkRbwMbd426wAAAMM"]
[Sat Nov 22 06:38:16.519062 2025] [:error] [pid 53566:tid 53579] [client 85.8.130.51:55209] [client 85.8.130.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSDp2MbSHDBkRbwMbd5ehwAAAMs"]
[Sat Nov 22 06:56:34.307611 2025] [autoindex:error] [pid 53477:tid 53481] [client 212.116.231.26:59140] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:56:34.730848 2025] [autoindex:error] [pid 53477:tid 53489] [client 212.116.231.26:59140] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 06:56:35.153565 2025] [:error] [pid 53477:tid 53492] [client 212.116.231.26:59140] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/"] [unique_id "aSDuI37Lu30Ku9O40aIGeQAAAAs"]
[Sat Nov 22 06:56:35.967341 2025] [:error] [pid 53477:tid 53495] [client 212.116.231.26:59636] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/"] [unique_id "aSDuI37Lu30Ku9O40aIGggAAAA4"]
[Sat Nov 22 06:56:36.777192 2025] [:error] [pid 53478:tid 53530] [client 212.116.231.26:59914] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/"] [unique_id "aSDuJAhUYdXBbQswAdQ_ogAAAFU"]
[Sat Nov 22 06:56:37.587623 2025] [:error] [pid 25856:tid 25866] [client 212.116.231.26:60230] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/"] [unique_id "aSDuJRsTP0wy94zKUvHmyAAAAQg"]
[Sat Nov 22 06:56:38.400111 2025] [:error] [pid 9547:tid 9559] [client 212.116.231.26:60636] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/"] [unique_id "aSDuJtClOR5qk7DoMeGlLgAAAUY"]
[Sat Nov 22 07:15:02.661765 2025] [:error] [pid 9547:tid 9555] [client 85.8.130.51:59239] [client 85.8.130.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSDydtClOR5qk7DoMeGtAAAAAUI"]
[Sat Nov 22 07:32:52.807610 2025] [:error] [pid 53477:tid 53494] [client 85.8.130.72:44945] [client 85.8.130.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSD2pH7Lu30Ku9O40aIP-AAAAA0"]
[Sat Nov 22 09:03:01.263945 2025] [:error] [pid 53477:tid 53484] [client 85.8.130.60:57821] [client 85.8.130.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSELxX7Lu30Ku9O40aIrrQAAAAM"]
[Sat Nov 22 10:30:19.380289 2025] [autoindex:error] [pid 53477:tid 53481] [client 139.59.37.180:52508] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Nov 22 11:34:45.558375 2025] [:error] [pid 53566:tid 53582] [client 182.42.104.32:45665] [client 182.42.104.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aSEvVcbSHDBkRbwMbd7EjAAAAM4"]
[Sat Nov 22 11:52:12.799109 2025] [:error] [pid 53478:tid 53526] [client 85.8.130.62:21541] [client 85.8.130.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSEzbAhUYdXBbQswAdSUoQAAAFE"]
[Sat Nov 22 12:28:55.750998 2025] [:error] [pid 53479:tid 53549] [client 85.8.130.47:31581] [client 85.8.130.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.47, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSE8B26cicFF3Aas-oQCZwAAAI0"]
[Sat Nov 22 12:46:48.996670 2025] [:error] [pid 9547:tid 9567] [client 85.8.130.66:52851] [client 85.8.130.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.66, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSFAONClOR5qk7DoMeE-fwAAAU4"]
[Sat Nov 22 13:05:16.626354 2025] [:error] [pid 53477:tid 53482] [client 85.8.130.63:64597] [client 85.8.130.63] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.63, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSFEjH7Lu30Ku9O40aJnmAAAAAE"]
[Sat Nov 22 13:23:17.359280 2025] [:error] [pid 53479:tid 53557] [client 85.8.130.71:21811] [client 85.8.130.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSFIxW6cicFF3Aas-oQXZAAAAJU"]
[Sat Nov 22 13:46:24.806969 2025] [:error] [pid 9547:tid 9563] [client 85.8.130.66:54747] [client 85.8.130.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.66, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSFOMNClOR5qk7DoMeFQuAAAAUo"]
[Sat Nov 22 14:20:49.548966 2025] [:error] [pid 53479:tid 53556] [client 192.254.229.28:16520] [client 192.254.229.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.254.229.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSFWQW6cicFF3Aas-oQwNgAAAJQ"]
[Sat Nov 22 14:24:56.157564 2025] [:error] [pid 53566:tid 53579] [client 85.8.130.95:24813] [client 85.8.130.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.95, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSFXOMbSHDBkRbwMbd7trwAAAMs"]
[Sat Nov 22 14:43:08.098505 2025] [:error] [pid 53478:tid 53512] [client 85.8.130.55:24311] [client 85.8.130.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.55, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSFbfAhUYdXBbQswAdS8EgAAAEM"]
[Sat Nov 22 15:38:39.919187 2025] [:error] [pid 9547:tid 9560] [client 85.8.130.89:34303] [client 85.8.130.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.89, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSFof9ClOR5qk7DoMeFzjQAAAUc"]
[Sat Nov 22 16:09:06.826149 2025] [:error] [pid 25856:tid 25880] [client 45.128.199.236:44785] [client 45.128.199.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSFvohsTP0wy94zKUvGNFQAAARY"]
[Sat Nov 22 16:09:15.036516 2025] [:error] [pid 53478:tid 53532] [client 45.128.199.156:36725] [client 45.128.199.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bk/index.php"] [unique_id "aSFvqwhUYdXBbQswAdTOawAAAFc"]
[Sat Nov 22 16:09:25.908776 2025] [:error] [pid 9547:tid 9556] [client 45.128.199.219:43825] [client 45.128.199.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aSFvtdClOR5qk7DoMeF8nAAAAUM"]
[Sat Nov 22 16:09:31.315322 2025] [:error] [pid 53479:tid 53557] [client 45.128.199.242:35987] [client 45.128.199.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aSFvu26cicFF3Aas-oRZUQAAAJU"]
[Sat Nov 22 16:09:33.398236 2025] [:error] [pid 25856:tid 25859] [client 45.128.199.239:21127] [client 45.128.199.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/chosen.php"] [unique_id "aSFvvRsTP0wy94zKUvGNMQAAAQE"]
[Sat Nov 22 16:09:34.369710 2025] [:error] [pid 53477:tid 53490] [client 45.8.17.175:60805] [client 45.8.17.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aSFvvn7Lu30Ku9O40aKPgQAAAAk"]
[Sat Nov 22 16:09:41.058902 2025] [:error] [pid 53478:tid 53532] [client 45.128.199.174:48021] [client 45.128.199.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aSFvxQhUYdXBbQswAdTOgwAAAFc"]
[Sat Nov 22 16:09:44.536234 2025] [:error] [pid 53478:tid 53510] [client 45.128.199.167:39717] [client 45.128.199.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aSFvyAhUYdXBbQswAdTOkQAAAEE"]
[Sat Nov 22 16:09:56.833311 2025] [:error] [pid 9547:tid 9566] [client 45.128.199.171:26687] [client 45.128.199.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSFv1NClOR5qk7DoMeF8xgAAAU0"]
[Sat Nov 22 16:09:57.899029 2025] [:error] [pid 53477:tid 53486] [client 45.128.199.70:24727] [client 45.128.199.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aSFv1X7Lu30Ku9O40aKPpAAAAAU"]
[Sat Nov 22 16:11:29.514511 2025] [:error] [pid 53566:tid 53578] [client 45.8.17.192:30415] [client 45.8.17.192] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.192, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSFwMcbSHDBkRbwMbd4EPwAAAMo"]
[Sat Nov 22 16:11:37.601479 2025] [:error] [pid 53566:tid 53578] [client 45.8.17.192:30415] [client 45.8.17.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/modules.php"] [unique_id "aSFwOcbSHDBkRbwMbd4EUwAAAMo"]
[Sat Nov 22 16:11:59.938486 2025] [:error] [pid 53479:tid 53549] [client 45.128.199.187:61707] [client 45.128.199.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/codeboy1877_up.php"] [unique_id "aSFwT26cicFF3Aas-oRaOAAAAI0"]
[Sat Nov 22 16:13:00.972643 2025] [:error] [pid 53477:tid 53497] [client 45.128.199.156:41349] [client 45.128.199.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/lx.php"] [unique_id "aSFwjH7Lu30Ku9O40aKQbgAAABA"]
[Sat Nov 22 16:13:25.148977 2025] [autoindex:error] [pid 25856:tid 25877] [client 45.128.199.205:62827] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:13:27.024052 2025] [autoindex:error] [pid 25856:tid 25869] [client 45.128.199.205:62827] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:13:31.036265 2025] [autoindex:error] [pid 25856:tid 25871] [client 45.128.199.205:62827] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:13:32.996067 2025] [autoindex:error] [pid 25856:tid 25861] [client 45.128.199.205:62827] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:13:34.112714 2025] [autoindex:error] [pid 25856:tid 25880] [client 45.128.199.205:62827] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:13:34.611073 2025] [autoindex:error] [pid 25856:tid 25877] [client 45.128.199.205:62827] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:13:35.132451 2025] [autoindex:error] [pid 25856:tid 25872] [client 45.128.199.205:62827] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:13:35.640163 2025] [autoindex:error] [pid 25856:tid 25862] [client 45.128.199.205:62827] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:13:36.756778 2025] [autoindex:error] [pid 25856:tid 25865] [client 45.128.199.205:62827] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:13:38.191390 2025] [autoindex:error] [pid 25856:tid 25866] [client 45.128.199.205:62827] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:13:38.630350 2025] [autoindex:error] [pid 25856:tid 25859] [client 45.128.199.205:62827] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:13:39.141103 2025] [autoindex:error] [pid 25856:tid 25863] [client 45.128.199.205:62827] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:13:47.010113 2025] [autoindex:error] [pid 25856:tid 25867] [client 45.128.199.205:62827] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:14:40.214485 2025] [autoindex:error] [pid 53478:tid 53516] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:14:40.724536 2025] [autoindex:error] [pid 53478:tid 53530] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:14:41.246981 2025] [autoindex:error] [pid 53478:tid 53529] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:14:41.809313 2025] [autoindex:error] [pid 53478:tid 53532] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:14:42.369790 2025] [autoindex:error] [pid 53478:tid 53517] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:14:42.891062 2025] [autoindex:error] [pid 53478:tid 53522] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:14:43.358142 2025] [autoindex:error] [pid 53478:tid 53531] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:14:48.569933 2025] [autoindex:error] [pid 53478:tid 53531] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:14:49.194139 2025] [autoindex:error] [pid 53478:tid 53527] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:14:51.664406 2025] [autoindex:error] [pid 53478:tid 53528] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:14:58.325848 2025] [autoindex:error] [pid 53478:tid 53512] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:14:58.839032 2025] [autoindex:error] [pid 53478:tid 53510] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:14:59.326497 2025] [autoindex:error] [pid 53478:tid 53514] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:15:01.960442 2025] [autoindex:error] [pid 53478:tid 53512] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:15:02.899971 2025] [autoindex:error] [pid 53478:tid 53523] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:15:03.918027 2025] [autoindex:error] [pid 53478:tid 53514] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:15:04.460815 2025] [autoindex:error] [pid 53478:tid 53520] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:15:04.906091 2025] [autoindex:error] [pid 53478:tid 53524] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:16:12.199728 2025] [autoindex:error] [pid 53478:tid 53524] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:16:39.246925 2025] [autoindex:error] [pid 53478:tid 53521] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:16:49.156405 2025] [autoindex:error] [pid 53478:tid 53525] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:16:49.712870 2025] [autoindex:error] [pid 53478:tid 53523] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:16:58.406254 2025] [autoindex:error] [pid 53478:tid 53530] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:16:58.911050 2025] [autoindex:error] [pid 53478:tid 53531] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:16:59.386814 2025] [autoindex:error] [pid 53478:tid 53529] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:16:59.937845 2025] [autoindex:error] [pid 53478:tid 53521] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:17:01.131553 2025] [autoindex:error] [pid 53478:tid 53525] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:17:02.707244 2025] [autoindex:error] [pid 53478:tid 53519] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:17:03.910062 2025] [autoindex:error] [pid 53478:tid 53527] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:17:04.433365 2025] [autoindex:error] [pid 53478:tid 53509] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:17:06.391043 2025] [autoindex:error] [pid 53478:tid 53511] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:17:07.811733 2025] [autoindex:error] [pid 53478:tid 53516] [client 45.128.199.165:21879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:17:28.577825 2025] [autoindex:error] [pid 25856:tid 25859] [client 45.128.199.173:25673] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:17:51.237027 2025] [autoindex:error] [pid 25856:tid 25879] [client 45.128.199.173:25673] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:17:51.723211 2025] [autoindex:error] [pid 25856:tid 25865] [client 45.128.199.173:25673] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:18:28.096405 2025] [autoindex:error] [pid 25856:tid 25873] [client 45.128.199.173:25673] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/paste/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:18:33.645762 2025] [autoindex:error] [pid 25856:tid 25867] [client 45.128.199.173:25673] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:18:41.790194 2025] [autoindex:error] [pid 25856:tid 25866] [client 45.128.199.173:25673] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:18:44.884516 2025] [autoindex:error] [pid 25856:tid 25861] [client 45.128.199.173:25673] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:18:49.498428 2025] [autoindex:error] [pid 25856:tid 25866] [client 45.128.199.173:25673] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/directionality/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:18:52.153732 2025] [autoindex:error] [pid 25856:tid 25867] [client 45.128.199.173:25673] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/search/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:18:52.641020 2025] [autoindex:error] [pid 25856:tid 25868] [client 45.128.199.173:25673] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/compat3x/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:18:55.085030 2025] [autoindex:error] [pid 25856:tid 25881] [client 45.128.199.173:25673] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:18:57.537002 2025] [autoindex:error] [pid 25856:tid 25866] [client 45.128.199.173:25673] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:19:00.855624 2025] [autoindex:error] [pid 25856:tid 25864] [client 45.128.199.173:25673] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:19:01.340382 2025] [autoindex:error] [pid 25856:tid 25859] [client 45.128.199.173:25673] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/classic-editor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:19:01.838452 2025] [proxy_fcgi:error] [pid 25856:tid 25873] [client 45.128.199.173:25673] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_header() in /home/expressi/public_html/wp-content/themes/twentytwentyone/index.php:17\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/themes/twentytwentyone/index.php on line 17'
[Sat Nov 22 16:19:07.655135 2025] [autoindex:error] [pid 53477:tid 53482] [client 45.128.199.238:51809] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:19:18.406898 2025] [autoindex:error] [pid 53477:tid 53494] [client 45.128.199.238:51809] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/paragraph/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:19:34.151338 2025] [autoindex:error] [pid 53477:tid 53490] [client 45.128.199.238:51809] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/nux/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:19:36.518309 2025] [autoindex:error] [pid 53477:tid 53487] [client 45.128.199.238:51809] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/lists/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:19:37.053629 2025] [autoindex:error] [pid 53477:tid 53504] [client 45.128.199.238:51809] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:20:52.249693 2025] [autoindex:error] [pid 53477:tid 53483] [client 45.128.199.238:51809] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:20:56.922635 2025] [autoindex:error] [pid 53477:tid 53499] [client 45.128.199.238:51809] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/social-links/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:21:37.393753 2025] [autoindex:error] [pid 53477:tid 53498] [client 45.128.199.238:51809] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/src/Core/Curve25519/Ge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Nov 22 16:23:40.357466 2025] [:error] [pid 53478:tid 53529] [client 147.182.149.75:41186] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aSFzDAhUYdXBbQswAdTS0AAAAFQ"]
[Sat Nov 22 16:23:40.784938 2025] [:error] [pid 53566:tid 53589] [client 147.182.149.75:41194] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/graphql"] [unique_id "aSFzDMbSHDBkRbwMbd4HOQAAANU"]
[Sat Nov 22 16:23:41.223687 2025] [:error] [pid 9547:tid 9553] [client 147.182.149.75:41204] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api"] [unique_id "aSFzDdClOR5qk7DoMeGA8QAAAUA"]
[Sat Nov 22 16:23:41.650694 2025] [:error] [pid 53566:tid 53585] [client 147.182.149.75:41214] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api/graphql"] [unique_id "aSFzDcbSHDBkRbwMbd4HOgAAANE"]
[Sat Nov 22 16:23:42.077002 2025] [:error] [pid 9547:tid 9559] [client 147.182.149.75:41220] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/graphql/api"] [unique_id "aSFzDtClOR5qk7DoMeGA8wAAAUY"]
[Sat Nov 22 16:23:42.503637 2025] [:error] [pid 53566:tid 53583] [client 147.182.149.75:41232] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api/gql"] [unique_id "aSFzDsbSHDBkRbwMbd4HPAAAAM8"]
[Sat Nov 22 16:23:42.931259 2025] [:error] [pid 53566:tid 53590] [client 147.182.149.75:41234] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/swagger-ui.html"] [unique_id "aSFzDsbSHDBkRbwMbd4HPQAAANY"]
[Sat Nov 22 16:23:43.359705 2025] [:error] [pid 25856:tid 25872] [client 147.182.149.75:41250] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/swagger/index.html"] [unique_id "aSFzDxsTP0wy94zKUvGRYgAAAQ4"]
[Sat Nov 22 16:23:43.788004 2025] [:error] [pid 25856:tid 25870] [client 147.182.149.75:41266] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/swagger/swagger-ui.html"] [unique_id "aSFzDxsTP0wy94zKUvGRYwAAAQw"]
[Sat Nov 22 16:23:44.215378 2025] [:error] [pid 53477:tid 53505] [client 147.182.149.75:41280] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/webjars/swagger-ui/index.html"] [unique_id "aSFzEH7Lu30Ku9O40aKTgQAAABg"]
[Sat Nov 22 16:23:44.642582 2025] [:error] [pid 53478:tid 53513] [client 147.182.149.75:41290] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/swagger.json"] [unique_id "aSFzEAhUYdXBbQswAdTS1wAAAEQ"]
[Sat Nov 22 16:23:45.070693 2025] [:error] [pid 53478:tid 53533] [client 147.182.149.75:41296] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/swagger/v1/swagger.json"] [unique_id "aSFzEQhUYdXBbQswAdTS2AAAAFg"]
[Sat Nov 22 16:23:45.497979 2025] [:error] [pid 53479:tid 53559] [client 147.182.149.75:41310] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2/api-docs"] [unique_id "aSFzEW6cicFF3Aas-oRfDQAAAJc"]
[Sat Nov 22 16:23:45.926489 2025] [:error] [pid 53478:tid 53525] [client 147.182.149.75:41316] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3/api-docs"] [unique_id "aSFzEQhUYdXBbQswAdTS2gAAAFA"]
[Sat Nov 22 16:23:46.353219 2025] [:error] [pid 53479:tid 53555] [client 147.182.149.75:41328] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api-docs/swagger.json"] [unique_id "aSFzEm6cicFF3Aas-oRfDwAAAJM"]
[Sat Nov 22 16:23:46.782501 2025] [:error] [pid 9547:tid 9560] [client 147.182.149.75:41344] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api/swagger.json"] [unique_id "aSFzEtClOR5qk7DoMeGA-gAAAUc"]
[Sat Nov 22 16:23:47.208543 2025] [:error] [pid 53479:tid 53551] [client 147.182.149.75:41360] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/@vite/env"] [unique_id "aSFzE26cicFF3Aas-oRfEAAAAI8"]
[Sat Nov 22 16:23:47.636048 2025] [:error] [pid 53479:tid 53550] [client 147.182.149.75:41374] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/actuator/env"] [unique_id "aSFzE26cicFF3Aas-oRfEwAAAI4"]
[Sat Nov 22 16:23:48.063097 2025] [:error] [pid 53566:tid 53586] [client 147.182.149.75:41388] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server"] [unique_id "aSFzFMbSHDBkRbwMbd4HQAAAANI"]
[Sat Nov 22 16:23:48.490593 2025] [:error] [pid 9547:tid 9565] [client 147.182.149.75:48984] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aSFzFNClOR5qk7DoMeGA_AAAAUw"]
[Sat Nov 22 16:23:48.917078 2025] [:error] [pid 53477:tid 53501] [client 147.182.149.75:49000] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about"] [unique_id "aSFzFH7Lu30Ku9O40aKThAAAABQ"]
[Sat Nov 22 16:23:49.343221 2025] [:error] [pid 53479:tid 53541] [client 147.182.149.75:49010] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/debug/default/view"] [unique_id "aSFzFW6cicFF3Aas-oRfFQAAAIU"]
[Sat Nov 22 16:23:49.770432 2025] [:error] [pid 53478:tid 53526] [client 147.182.149.75:49016] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2/_catalog"] [unique_id "aSFzFQhUYdXBbQswAdTS2wAAAFE"]
[Sat Nov 22 16:23:50.197764 2025] [:error] [pid 25856:tid 25880] [client 147.182.149.75:49020] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aSFzFhsTP0wy94zKUvGRaAAAARY"]
[Sat Nov 22 16:23:50.624196 2025] [:error] [pid 25856:tid 25859] [client 147.182.149.75:49024] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server-status"] [unique_id "aSFzFhsTP0wy94zKUvGRaQAAAQE"]
[Sat Nov 22 16:23:51.051130 2025] [:error] [pid 53478:tid 53516] [client 147.182.149.75:49032] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login.action"] [unique_id "aSFzFwhUYdXBbQswAdTS3AAAAEc"]
[Sat Nov 22 16:23:51.478401 2025] [:error] [pid 25856:tid 25875] [client 147.182.149.75:49046] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/_all_dbs"] [unique_id "aSFzFxsTP0wy94zKUvGRagAAARE"]
[Sat Nov 22 16:23:51.905315 2025] [:error] [pid 53478:tid 53519] [client 147.182.149.75:49054] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.DS_Store"] [unique_id "aSFzFwhUYdXBbQswAdTS3gAAAEo"]
[Sat Nov 22 16:23:52.331763 2025] [:error] [pid 53479:tid 53540] [client 147.182.149.75:49070] [client 147.182.149.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aSFzGG6cicFF3Aas-oRfGgAAAIQ"]
[Sat Nov 22 16:23:52.758319 2025] [:error] [pid 53478:tid 53529] [client 147.182.149.75:49082] [client 147.182.149.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aSFzGAhUYdXBbQswAdTS4AAAAFQ"]
[Sat Nov 22 16:23:53.185079 2025] [:error] [pid 25856:tid 25868] [client 147.182.149.75:49086] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aSFzGRsTP0wy94zKUvGRbAAAAQo"]
[Sat Nov 22 16:23:53.611832 2025] [:error] [pid 53479:tid 53547] [client 147.182.149.75:49098] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aSFzGW6cicFF3Aas-oRfHAAAAIs"]
[Sat Nov 22 16:23:54.039210 2025] [:error] [pid 53479:tid 53548] [client 147.182.149.75:49100] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/telescope/requests"] [unique_id "aSFzGm6cicFF3Aas-oRfHgAAAIw"]
[Sat Nov 22 16:23:54.466234 2025] [:error] [pid 25856:tid 25876] [client 147.182.149.75:49112] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aSFzGhsTP0wy94zKUvGRbgAAARI"]
[Sat Nov 22 16:23:54.895660 2025] [:error] [pid 53477:tid 53494] [client 147.182.149.75:49114] [client 147.182.149.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aSFzGn7Lu30Ku9O40aKTiwAAAA0"]
[Sat Nov 22 16:32:58.153971 2025] [:error] [pid 9547:tid 9569] [client 85.8.130.62:33963] [client 85.8.130.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSF1OtClOR5qk7DoMeGDfQAAAVA"]
[Sat Nov 22 16:39:39.909982 2025] [:error] [pid 53479:tid 53548] [client 207.154.212.47:36878] [client 207.154.212.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aSF2y26cicFF3Aas-oRmvwAAAIw"]
[Sat Nov 22 16:39:49.957404 2025] [authz_core:error] [pid 53477:tid 53495] [client 207.154.212.47:58680] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Sat Nov 22 16:39:54.271167 2025] [:error] [pid 53477:tid 53501] [client 207.154.212.47:42404] [client 207.154.212.47] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aSF22n7Lu30Ku9O40aKX_wAAABQ"]
[Sat Nov 22 16:39:55.023354 2025] [:error] [pid 53478:tid 53515] [client 207.154.212.47:42410] [client 207.154.212.47] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aSF22whUYdXBbQswAdTXLQAAAEY"]
[Sat Nov 22 16:50:59.520745 2025] [:error] [pid 25856:tid 25858] [client 85.8.130.48:32267] [client 85.8.130.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.48, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSF5cxsTP0wy94zKUvGZnQAAAQA"]
[Sat Nov 22 19:11:27.528266 2025] [:error] [pid 9547:tid 9563] [client 43.153.123.3:51736] [client 43.153.123.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aSGaX9ClOR5qk7DoMeG_zAAAAUo"]
[Sun Nov 23 00:51:10.392838 2025] [:error] [pid 39719:tid 39790] [client 182.44.2.148:43281] [client 182.44.2.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aSHp_hmP4k0tY5Yex-W4gQAAAQ4"]
[Sun Nov 23 02:42:57.823957 2025] [:error] [pid 39713:tid 39721] [client 173.239.254.48:59005] [client 173.239.254.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.48, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSIEMUUgrb325CIAjPq1kwAAAAA"]
[Sun Nov 23 02:55:27.956137 2025] [:error] [pid 39713:tid 39733] [client 216.126.225.91:46782] [client 216.126.225.91] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aSIHH0Ugrb325CIAjPq5dgAAAAw"]
[Sun Nov 23 04:32:43.753506 2025] [:error] [pid 44652:tid 44721] [client 43.155.27.244:39430] [client 43.155.27.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aSId69iQFwsyXQDhwyCtKAAAAQ8"]
[Sun Nov 23 04:53:52.890545 2025] [:error] [pid 38738:tid 38758] [client 20.84.7.202:42368] [client 20.84.7.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.84.7.202, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSIi4Aytc6TL9XavPmO_swAAABA"]
[Sun Nov 23 05:33:28.290007 2025] [:error] [pid 38824:tid 38832] [client 37.97.206.40:45512] [client 37.97.206.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.97.206.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSIsKE8WZjXLvbHTHPfHVgAAAMU"]
[Sun Nov 23 06:09:53.133992 2025] [:error] [pid 38824:tid 38851] [client 65.21.53.7:48264] [client 65.21.53.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.21.53.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSI0sU8WZjXLvbHTHPfSDAAAANg"]
[Sun Nov 23 06:20:44.287805 2025] [:error] [pid 38824:tid 38836] [client 193.37.33.249:42753] [client 193.37.33.249] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.33.249, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSI3PE8WZjXLvbHTHPfU6gAAAMk"]
[Sun Nov 23 06:33:21.042520 2025] [:error] [pid 38824:tid 38833] [client 103.248.74.80:62758] [client 103.248.74.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.248.74.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSI6MU8WZjXLvbHTHPfaHgAAAMY"]
[Sun Nov 23 06:37:02.122638 2025] [:error] [pid 44652:tid 44707] [client 193.37.33.245:52417] [client 193.37.33.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.33.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSI7DtiQFwsyXQDhwyDbrgAAAQE"]
[Sun Nov 23 06:47:34.573181 2025] [:error] [pid 38738:tid 38763] [client 85.203.21.17:59109] [client 85.203.21.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/advanced-product-fields-for-woocommerce/db.php"] [unique_id "aSI9hgytc6TL9XavPmPlXwAAABU"]
[Sun Nov 23 06:47:39.751726 2025] [:error] [pid 38824:tid 38828] [client 85.203.21.64:56289] [client 85.203.21.64] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/theme-check/main.php"] [unique_id "aSI9i08WZjXLvbHTHPffqgAAAME"]
[Sun Nov 23 06:47:39.928961 2025] [:error] [pid 38824:tid 38846] [client 85.203.21.27:62683] [client 85.203.21.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/index.php"] [unique_id "aSI9i08WZjXLvbHTHPffqwAAANM"]
[Sun Nov 23 06:47:40.108004 2025] [:error] [pid 38824:tid 38833] [client 85.203.21.47:32691] [client 85.203.21.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/covr-wpcom/assets/fonts/manrope_normal.php"] [unique_id "aSI9jE8WZjXLvbHTHPffrAAAAMY"]
[Sun Nov 23 06:47:40.285853 2025] [:error] [pid 38740:tid 38819] [client 85.203.21.36:63387] [client 85.203.21.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/222.php"] [unique_id "aSI9jA13QPZSi6O8umWwnQAAAJc"]
[Sun Nov 23 06:47:40.462654 2025] [:error] [pid 38824:tid 38838] [client 85.203.21.10:24149] [client 85.203.21.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-parsidate/includes/admin/acf-fields-adyrui.php"] [unique_id "aSI9jE8WZjXLvbHTHPffrQAAAMs"]
[Sun Nov 23 06:47:40.667050 2025] [:error] [pid 38738:tid 38752] [client 85.203.21.46:64571] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/aback.php"] [unique_id "aSI9jAytc6TL9XavPmPlZQAAAAo"]
[Sun Nov 23 06:47:40.871798 2025] [:error] [pid 38739:tid 38793] [client 85.203.21.37:27603] [client 85.203.21.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aSI9jAdvEgJm2n2cDmoiLAAAAFg"]
[Sun Nov 23 06:47:41.051861 2025] [:error] [pid 38739:tid 38769] [client 85.203.21.59:62421] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ad.php"] [unique_id "aSI9jQdvEgJm2n2cDmoiLQAAAEA"]
[Sun Nov 23 06:47:41.229031 2025] [:error] [pid 38739:tid 38792] [client 85.203.21.7:35965] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/moderation.php"] [unique_id "aSI9jQdvEgJm2n2cDmoiLgAAAFc"]
[Sun Nov 23 06:47:41.408497 2025] [:error] [pid 38824:tid 38844] [client 85.203.21.36:23199] [client 85.203.21.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/classwithtostring.php"] [unique_id "aSI9jU8WZjXLvbHTHPffrwAAANE"]
[Sun Nov 23 06:47:41.587690 2025] [:error] [pid 44652:tid 44722] [client 85.203.21.27:36259] [client 85.203.21.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aSI9jdiQFwsyXQDhwyDgwAAAARA"]
[Sun Nov 23 06:47:46.766443 2025] [:error] [pid 44652:tid 44718] [client 85.203.21.22:21683] [client 85.203.21.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aSI9ktiQFwsyXQDhwyDg1AAAAQw"]
[Sun Nov 23 06:47:46.944898 2025] [:error] [pid 38739:tid 38792] [client 85.203.21.34:44307] [client 85.203.21.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/erinyani/default.php"] [unique_id "aSI9kgdvEgJm2n2cDmoiOwAAAFc"]
[Sun Nov 23 06:47:47.120815 2025] [:error] [pid 38738:tid 38746] [client 85.203.21.7:46119] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/leaf.php"] [unique_id "aSI9kwytc6TL9XavPmPlaAAAAAQ"]
[Sun Nov 23 06:47:47.300754 2025] [:error] [pid 38824:tid 38836] [client 85.203.21.47:44207] [client 85.203.21.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/mainhosting/default.php"] [unique_id "aSI9k08WZjXLvbHTHPfftAAAAMk"]
[Sun Nov 23 06:47:47.478725 2025] [:error] [pid 38738:tid 38757] [client 85.203.21.62:64639] [client 85.203.21.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/about.php"] [unique_id "aSI9kwytc6TL9XavPmPlagAAAA8"]
[Sun Nov 23 06:47:49.158246 2025] [:error] [pid 44652:tid 44712] [client 85.203.21.18:61299] [client 85.203.21.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/inc.php"] [unique_id "aSI9ldiQFwsyXQDhwyDg2wAAAQY"]
[Sun Nov 23 06:47:49.338200 2025] [:error] [pid 38739:tid 38785] [client 85.203.21.63:54571] [client 85.203.21.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "aSI9lQdvEgJm2n2cDmoiPwAAAFA"]
[Sun Nov 23 06:47:49.515536 2025] [:error] [pid 44652:tid 44719] [client 85.203.21.43:43667] [client 85.203.21.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aSI9ldiQFwsyXQDhwyDg3QAAAQ0"]
[Sun Nov 23 06:47:49.693395 2025] [:error] [pid 38739:tid 38790] [client 85.203.21.13:64743] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/sim.php"] [unique_id "aSI9lQdvEgJm2n2cDmoiQAAAAFU"]
[Sun Nov 23 06:47:49.870511 2025] [:error] [pid 38824:tid 38838] [client 85.203.21.68:47239] [client 85.203.21.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aSI9lU8WZjXLvbHTHPffugAAAMs"]
[Sun Nov 23 06:47:50.046545 2025] [:error] [pid 38738:tid 38744] [client 85.203.21.11:64771] [client 85.203.21.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aSI9lgytc6TL9XavPmPlbgAAAAI"]
[Sun Nov 23 06:47:50.225025 2025] [:error] [pid 38739:tid 38784] [client 85.203.21.12:28781] [client 85.203.21.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aSI9lgdvEgJm2n2cDmoiQQAAAE8"]
[Sun Nov 23 06:47:50.403950 2025] [:error] [pid 38740:tid 38797] [client 85.203.21.26:39483] [client 85.203.21.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aSI9lg13QPZSi6O8umWwqQAAAIE"]
[Sun Nov 23 06:47:50.582718 2025] [:error] [pid 38738:tid 38761] [client 85.203.21.53:26813] [client 85.203.21.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xml.php"] [unique_id "aSI9lgytc6TL9XavPmPlbwAAABM"]
[Sun Nov 23 06:47:50.759646 2025] [:error] [pid 38740:tid 38814] [client 85.203.21.42:49153] [client 85.203.21.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aSI9lg13QPZSi6O8umWwqwAAAJI"]
[Sun Nov 23 06:47:50.938793 2025] [:error] [pid 38739:tid 38778] [client 85.203.21.19:63213] [client 85.203.21.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/images/class-config.php"] [unique_id "aSI9lgdvEgJm2n2cDmoiQgAAAEk"]
[Sun Nov 23 06:47:51.121365 2025] [:error] [pid 38739:tid 38769] [client 85.203.21.27:42501] [client 85.203.21.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aSI9lwdvEgJm2n2cDmoiQwAAAEA"]
[Sun Nov 23 06:47:51.298508 2025] [:error] [pid 44652:tid 44723] [client 85.203.21.68:54389] [client 85.203.21.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aSI9l9iQFwsyXQDhwyDg4gAAARE"]
[Sun Nov 23 06:47:51.476598 2025] [:error] [pid 38738:tid 38765] [client 85.203.21.26:45179] [client 85.203.21.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "aSI9lwytc6TL9XavPmPlcAAAABc"]
[Sun Nov 23 06:47:51.654289 2025] [:error] [pid 44652:tid 44711] [client 85.203.21.24:26005] [client 85.203.21.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/back.php"] [unique_id "aSI9l9iQFwsyXQDhwyDg5AAAAQU"]
[Sun Nov 23 06:47:51.834235 2025] [:error] [pid 38824:tid 38844] [client 85.203.21.19:63741] [client 85.203.21.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSI9l08WZjXLvbHTHPffvAAAANE"]
[Sun Nov 23 06:47:52.019045 2025] [:error] [pid 44652:tid 44721] [client 85.203.21.69:58787] [client 85.203.21.69] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aSI9mNiQFwsyXQDhwyDg5QAAAQ8"]
[Sun Nov 23 06:47:52.198681 2025] [:error] [pid 38740:tid 38812] [client 85.203.21.13:65143] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/leafmailer2.8.php"] [unique_id "aSI9mA13QPZSi6O8umWwrwAAAJA"]
[Sun Nov 23 06:47:52.377749 2025] [:error] [pid 38739:tid 38786] [client 85.203.21.51:39703] [client 85.203.21.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "aSI9mAdvEgJm2n2cDmoiRwAAAFE"]
[Sun Nov 23 06:47:52.555357 2025] [:error] [pid 38739:tid 38776] [client 85.203.21.25:57099] [client 85.203.21.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/up.php"] [unique_id "aSI9mAdvEgJm2n2cDmoiSAAAAEc"]
[Sun Nov 23 06:47:52.735150 2025] [:error] [pid 38739:tid 38783] [client 85.203.21.48:32481] [client 85.203.21.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wsa.php"] [unique_id "aSI9mAdvEgJm2n2cDmoiSQAAAE4"]
[Sun Nov 23 06:47:52.913518 2025] [:error] [pid 38738:tid 38755] [client 85.203.21.49:29737] [client 85.203.21.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aSI9mAytc6TL9XavPmPlcwAAAA0"]
[Sun Nov 23 06:47:53.093729 2025] [:error] [pid 44652:tid 44710] [client 85.203.21.51:27363] [client 85.203.21.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-l0gin.php"] [unique_id "aSI9mdiQFwsyXQDhwyDg6gAAAQQ"]
[Sun Nov 23 06:47:54.799807 2025] [:error] [pid 38824:tid 38835] [client 85.203.21.11:51065] [client 85.203.21.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/uploads/index.php"] [unique_id "aSI9mk8WZjXLvbHTHPffwAAAAMg"]
[Sun Nov 23 06:47:54.977501 2025] [:error] [pid 38824:tid 38848] [client 85.203.21.2:55989] [client 85.203.21.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentyfifteen/shell3.php"] [unique_id "aSI9mk8WZjXLvbHTHPffwQAAANU"]
[Sun Nov 23 06:47:55.154323 2025] [:error] [pid 38738:tid 38756] [client 85.203.21.47:38543] [client 85.203.21.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/azusa/inc/wp-host.php"] [unique_id "aSI9mwytc6TL9XavPmPleAAAAA4"]
[Sun Nov 23 06:47:55.333285 2025] [:error] [pid 38738:tid 38757] [client 85.203.21.9:26203] [client 85.203.21.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/better-wp-security/vendor-prod/composer/autoload.php"] [unique_id "aSI9mwytc6TL9XavPmPleQAAAA8"]
[Sun Nov 23 06:47:55.509759 2025] [:error] [pid 38739:tid 38771] [client 85.203.21.68:57373] [client 85.203.21.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce-to-wechatapp/vendor/overtrue/wechat/src/OpenPlatform/Authorizer/MiniProgram/Domain/Current.php"] [unique_id "aSI9mwdvEgJm2n2cDmoiVAAAAEI"]
[Sun Nov 23 06:47:55.697566 2025] [:error] [pid 38738:tid 38761] [client 85.203.21.9:38105] [client 85.203.21.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "aSI9mwytc6TL9XavPmPlewAAABM"]
[Sun Nov 23 06:47:55.874237 2025] [:error] [pid 38738:tid 38751] [client 85.203.21.44:47637] [client 85.203.21.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/ga.php"] [unique_id "aSI9mwytc6TL9XavPmPlfAAAAAk"]
[Sun Nov 23 06:47:56.061997 2025] [:error] [pid 38739:tid 38777] [client 85.203.21.20:32931] [client 85.203.21.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-author-name/index.php"] [unique_id "aSI9nAdvEgJm2n2cDmoiWgAAAEg"]
[Sun Nov 23 06:47:56.239325 2025] [:error] [pid 38824:tid 38850] [client 85.203.21.67:39865] [client 85.203.21.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/list/144.php"] [unique_id "aSI9nE8WZjXLvbHTHPffwwAAANc"]
[Sun Nov 23 06:48:01.418639 2025] [:error] [pid 38824:tid 38844] [client 85.203.21.63:26809] [client 85.203.21.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "aSI9oU8WZjXLvbHTHPffyAAAANE"]
[Sun Nov 23 06:48:01.595816 2025] [:error] [pid 38824:tid 38841] [client 85.203.21.9:64925] [client 85.203.21.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/advanced-llms-txt-generator/assets/css/css_json.php"] [unique_id "aSI9oU8WZjXLvbHTHPffyQAAAM4"]
[Sun Nov 23 06:48:01.774293 2025] [:error] [pid 38824:tid 38835] [client 85.203.21.62:29793] [client 85.203.21.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/kontol/kiw.php"] [unique_id "aSI9oU8WZjXLvbHTHPffygAAAMg"]
[Sun Nov 23 06:48:01.951856 2025] [:error] [pid 38740:tid 38798] [client 85.203.21.13:54459] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/theme-check/theme-check.php"] [unique_id "aSI9oQ13QPZSi6O8umWwsgAAAII"]
[Sun Nov 23 06:48:02.131517 2025] [:error] [pid 38740:tid 38808] [client 85.203.21.44:51981] [client 85.203.21.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/js_composer/include/templates/shortcodes/lock.php"] [unique_id "aSI9og13QPZSi6O8umWwswAAAIw"]
[Sun Nov 23 06:48:02.309986 2025] [:error] [pid 38740:tid 38801] [client 85.203.21.51:41355] [client 85.203.21.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/autoload_classmap.php"] [unique_id "aSI9og13QPZSi6O8umWwtAAAAIU"]
[Sun Nov 23 06:48:02.487804 2025] [:error] [pid 38740:tid 38797] [client 85.203.21.37:53455] [client 85.203.21.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/chosen.php"] [unique_id "aSI9og13QPZSi6O8umWwtQAAAIE"]
[Sun Nov 23 06:48:02.669044 2025] [:error] [pid 38740:tid 38814] [client 85.203.21.5:28861] [client 85.203.21.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "aSI9og13QPZSi6O8umWwtgAAAJI"]
[Sun Nov 23 06:48:02.846506 2025] [:error] [pid 38740:tid 38807] [client 85.203.21.23:22343] [client 85.203.21.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/cloud.php"] [unique_id "aSI9og13QPZSi6O8umWwtwAAAIs"]
[Sun Nov 23 06:48:03.025224 2025] [:error] [pid 38739:tid 38789] [client 85.203.21.43:50405] [client 85.203.21.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wp-content.php"] [unique_id "aSI9owdvEgJm2n2cDmoiewAAAFQ"]
[Sun Nov 23 06:48:03.202937 2025] [:error] [pid 38740:tid 38812] [client 85.203.21.63:55787] [client 85.203.21.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-post-data.php"] [unique_id "aSI9ow13QPZSi6O8umWwugAAAJA"]
[Sun Nov 23 06:48:03.381348 2025] [:error] [pid 38824:tid 38842] [client 85.203.21.5:21199] [client 85.203.21.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aSI9o08WZjXLvbHTHPffzwAAAM8"]
[Sun Nov 23 06:48:03.562896 2025] [:error] [pid 38740:tid 38806] [client 85.203.21.6:26853] [client 85.203.21.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/m.php"] [unique_id "aSI9ow13QPZSi6O8umWwvAAAAIo"]
[Sun Nov 23 06:48:03.742049 2025] [:error] [pid 38824:tid 38838] [client 85.203.21.10:61399] [client 85.203.21.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/coffee/colors_26.php"] [unique_id "aSI9o08WZjXLvbHTHPff0QAAAMs"]
[Sun Nov 23 06:48:03.918624 2025] [:error] [pid 38739:tid 38792] [client 85.203.21.19:39529] [client 85.203.21.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/"] [unique_id "aSI9owdvEgJm2n2cDmoigAAAAFc"]
[Sun Nov 23 06:48:04.096726 2025] [:error] [pid 38824:tid 38833] [client 85.203.21.37:31531] [client 85.203.21.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-backing.php"] [unique_id "aSI9pE8WZjXLvbHTHPff0wAAAMY"]
[Sun Nov 23 06:48:04.273619 2025] [:error] [pid 44652:tid 44729] [client 85.203.21.27:33047] [client 85.203.21.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/wp-backing.php"] [unique_id "aSI9pNiQFwsyXQDhwyDg-gAAARc"]
[Sun Nov 23 06:48:04.451109 2025] [:error] [pid 38739:tid 38769] [client 85.203.21.27:48333] [client 85.203.21.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/covr-wpcom/assets/fonts/manrope.php"] [unique_id "aSI9pAdvEgJm2n2cDmoihAAAAEA"]
[Sun Nov 23 06:48:04.628843 2025] [:error] [pid 38739:tid 38791] [client 85.203.21.17:25121] [client 85.203.21.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/acxx.php"] [unique_id "aSI9pAdvEgJm2n2cDmoihQAAAFY"]
[Sun Nov 23 06:48:04.806218 2025] [:error] [pid 44652:tid 44730] [client 85.203.21.10:33601] [client 85.203.21.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/modern/about.php"] [unique_id "aSI9pNiQFwsyXQDhwyDg-wAAARg"]
[Sun Nov 23 06:48:04.983440 2025] [:error] [pid 44652:tid 44722] [client 85.203.21.6:35103] [client 85.203.21.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/class-ftp.php"] [unique_id "aSI9pNiQFwsyXQDhwyDg_AAAARA"]
[Sun Nov 23 06:48:05.162754 2025] [:error] [pid 44652:tid 44713] [client 85.203.21.11:25853] [client 85.203.21.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/about.php"] [unique_id "aSI9pdiQFwsyXQDhwyDg_QAAAQc"]
[Sun Nov 23 06:48:05.339330 2025] [:error] [pid 44652:tid 44711] [client 85.203.21.7:32087] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/akismet/_inc/img/about.php"] [unique_id "aSI9pdiQFwsyXQDhwyDhAAAAAQU"]
[Sun Nov 23 06:48:05.516719 2025] [:error] [pid 44652:tid 44718] [client 85.203.21.22:48363] [client 85.203.21.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/call-now-button/src/about.php"] [unique_id "aSI9pdiQFwsyXQDhwyDhAQAAAQw"]
[Sun Nov 23 06:48:05.695244 2025] [:error] [pid 38740:tid 38798] [client 85.203.21.25:24377] [client 85.203.21.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/about.php"] [unique_id "aSI9pQ13QPZSi6O8umWwvgAAAII"]
[Sun Nov 23 06:48:05.872944 2025] [:error] [pid 38740:tid 38808] [client 85.203.21.14:45335] [client 85.203.21.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/admin/pages/about.php"] [unique_id "aSI9pQ13QPZSi6O8umWwvwAAAIw"]
[Sun Nov 23 06:48:06.050122 2025] [:error] [pid 38740:tid 38801] [client 85.203.21.9:27717] [client 85.203.21.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-mail-smtp/assets/about.php"] [unique_id "aSI9pg13QPZSi6O8umWwwAAAAIU"]
[Sun Nov 23 06:48:11.228849 2025] [:error] [pid 38738:tid 38747] [client 85.203.21.16:60271] [client 85.203.21.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-smushit/_src/js/common/about.php"] [unique_id "aSI9qwytc6TL9XavPmPliwAAAAU"]
[Sun Nov 23 06:48:11.407282 2025] [:error] [pid 38738:tid 38752] [client 85.203.21.38:63851] [client 85.203.21.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-smushit/core/modules/background/about.php"] [unique_id "aSI9qwytc6TL9XavPmPljQAAAAo"]
[Sun Nov 23 06:48:11.586753 2025] [:error] [pid 38738:tid 38762] [client 85.203.21.17:56279] [client 85.203.21.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/about.php"] [unique_id "aSI9qwytc6TL9XavPmPljgAAABQ"]
[Sun Nov 23 06:48:11.764306 2025] [:error] [pid 38738:tid 38756] [client 85.203.21.13:43279] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/inc/blog/about.php"] [unique_id "aSI9qwytc6TL9XavPmPlkAAAAA4"]
[Sun Nov 23 06:48:11.943092 2025] [:error] [pid 44652:tid 44715] [client 85.203.21.26:46477] [client 85.203.21.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/template-parts/advanced-footer/about.php"] [unique_id "aSI9q9iQFwsyXQDhwyDhHQAAAQk"]
[Sun Nov 23 06:48:12.122741 2025] [:error] [pid 38739:tid 38770] [client 85.203.21.23:28869] [client 85.203.21.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/wp-login.php"] [unique_id "aSI9rAdvEgJm2n2cDmoijQAAAEE"]
[Sun Nov 23 06:48:12.302262 2025] [:error] [pid 38738:tid 38745] [client 85.203.21.67:65515] [client 85.203.21.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/paradox/option-tree/assets/js/vendor/jquery/about.php"] [unique_id "aSI9rAytc6TL9XavPmPlkQAAAAM"]
[Sun Nov 23 06:48:12.478696 2025] [:error] [pid 44652:tid 44725] [client 85.203.21.15:26211] [client 85.203.21.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfive/assets/fonts/roboto-slab/about.php"] [unique_id "aSI9rNiQFwsyXQDhwyDhHwAAARM"]
[Sun Nov 23 06:48:12.655123 2025] [:error] [pid 38738:tid 38750] [client 85.203.21.51:21541] [client 85.203.21.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wpseo-import/about.php"] [unique_id "aSI9rAytc6TL9XavPmPlkgAAAAg"]
[Sun Nov 23 06:48:12.832497 2025] [:error] [pid 38740:tid 38816] [client 85.203.21.23:51057] [client 85.203.21.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Cookie/about.php"] [unique_id "aSI9rA13QPZSi6O8umWwzgAAAJQ"]
[Sun Nov 23 06:48:13.009157 2025] [:error] [pid 38738:tid 38743] [client 85.203.21.53:60823] [client 85.203.21.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Proxy/about.php"] [unique_id "aSI9rQytc6TL9XavPmPlkwAAAAE"]
[Sun Nov 23 06:48:13.186883 2025] [:error] [pid 38738:tid 38754] [client 85.203.21.18:31545] [client 85.203.21.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Utility/about.php"] [unique_id "aSI9rQytc6TL9XavPmPllAAAAAw"]
[Sun Nov 23 06:48:13.365592 2025] [:error] [pid 44652:tid 44710] [client 85.203.21.5:34863] [client 85.203.21.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comment-date/about.php"] [unique_id "aSI9rdiQFwsyXQDhwyDhIAAAAQQ"]
[Sun Nov 23 06:48:13.542147 2025] [:error] [pid 38824:tid 38838] [client 85.203.21.29:56091] [client 85.203.21.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comments-pagination-numbers/about.php"] [unique_id "aSI9rU8WZjXLvbHTHPff2gAAAMs"]
[Sun Nov 23 06:48:13.720726 2025] [:error] [pid 38824:tid 38833] [client 85.203.21.10:38209] [client 85.203.21.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comments-title/about.php"] [unique_id "aSI9rU8WZjXLvbHTHPff2wAAAMY"]
[Sun Nov 23 06:48:13.905992 2025] [:error] [pid 38824:tid 38828] [client 85.203.21.50:61927] [client 85.203.21.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/image/about.php"] [unique_id "aSI9rU8WZjXLvbHTHPff3QAAAME"]
[Sun Nov 23 06:48:14.083907 2025] [:error] [pid 38740:tid 38804] [client 85.203.21.5:46543] [client 85.203.21.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/latest-posts/about.php"] [unique_id "aSI9rg13QPZSi6O8umWw0wAAAIg"]
[Sun Nov 23 06:48:14.260766 2025] [:error] [pid 44652:tid 44721] [client 85.203.21.69:30637] [client 85.203.21.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/more/about.php"] [unique_id "aSI9rtiQFwsyXQDhwyDhIwAAAQ8"]
[Sun Nov 23 06:48:15.883017 2025] [:error] [pid 38738:tid 38752] [client 85.203.21.22:40229] [client 85.203.21.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/page-list-item/about.php"] [unique_id "aSI9rwytc6TL9XavPmPlnAAAAAo"]
[Sun Nov 23 06:48:16.059271 2025] [:error] [pid 44652:tid 44711] [client 85.203.21.14:56389] [client 85.203.21.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/site-title/about.php"] [unique_id "aSI9sNiQFwsyXQDhwyDhJQAAAQU"]
[Sun Nov 23 06:48:16.237028 2025] [:error] [pid 38740:tid 38816] [client 85.203.21.46:47513] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/components/index.php"] [unique_id "aSI9sA13QPZSi6O8umWw2gAAAJQ"]
[Sun Nov 23 06:48:16.417861 2025] [:error] [pid 38740:tid 38799] [client 85.203.21.13:46227] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/about.php"] [unique_id "aSI9sA13QPZSi6O8umWw2wAAAIM"]
[Sun Nov 23 06:48:16.595433 2025] [:error] [pid 38740:tid 38796] [client 85.203.21.50:43173] [client 85.203.21.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/wptextpattern/about.php"] [unique_id "aSI9sA13QPZSi6O8umWw3QAAAIA"]
[Sun Nov 23 06:48:16.773305 2025] [:error] [pid 44652:tid 44722] [client 85.203.21.64:52219] [client 85.203.21.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/wp-login.php"] [unique_id "aSI9sNiQFwsyXQDhwyDhJgAAARA"]
[Sun Nov 23 06:48:16.951515 2025] [:error] [pid 38739:tid 38774] [client 85.203.21.44:39495] [client 85.203.21.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/av.php"] [unique_id "aSI9sAdvEgJm2n2cDmoijgAAAEU"]
[Sun Nov 23 06:48:22.129980 2025] [:error] [pid 38739:tid 38793] [client 85.203.21.42:62225] [client 85.203.21.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/new.php"] [unique_id "aSI9tgdvEgJm2n2cDmoikgAAAFg"]
[Sun Nov 23 06:48:22.321528 2025] [:error] [pid 38738:tid 38764] [client 85.203.21.26:44127] [client 85.203.21.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/block-directory/index.php"] [unique_id "aSI9tgytc6TL9XavPmPluAAAABY"]
[Sun Nov 23 06:48:22.500816 2025] [:error] [pid 38738:tid 38758] [client 85.203.21.62:33103] [client 85.203.21.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/back.php"] [unique_id "aSI9tgytc6TL9XavPmPluQAAABA"]
[Sun Nov 23 06:48:22.679514 2025] [:error] [pid 44652:tid 44721] [client 85.203.21.22:37927] [client 85.203.21.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/aves.php"] [unique_id "aSI9ttiQFwsyXQDhwyDhNAAAAQ8"]
[Sun Nov 23 06:48:22.857726 2025] [:error] [pid 38739:tid 38782] [client 85.203.21.56:47167] [client 85.203.21.56] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aSI9tgdvEgJm2n2cDmoikwAAAE0"]
[Sun Nov 23 06:48:23.035948 2025] [:error] [pid 38738:tid 38761] [client 85.203.21.15:54991] [client 85.203.21.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aSI9twytc6TL9XavPmPlvQAAABM"]
[Sun Nov 23 06:48:23.212961 2025] [:error] [pid 38738:tid 38754] [client 85.203.21.17:34613] [client 85.203.21.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aSI9twytc6TL9XavPmPlvgAAAAw"]
[Sun Nov 23 06:48:23.390841 2025] [:error] [pid 38739:tid 38789] [client 85.203.21.11:42103] [client 85.203.21.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aSI9twdvEgJm2n2cDmoilAAAAFQ"]
[Sun Nov 23 06:48:23.568968 2025] [:error] [pid 38738:tid 38756] [client 85.203.21.24:52095] [client 85.203.21.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aSI9twytc6TL9XavPmPlwAAAAA4"]
[Sun Nov 23 06:48:23.745365 2025] [:error] [pid 38739:tid 38779] [client 85.203.21.19:20565] [client 85.203.21.19] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aSI9twdvEgJm2n2cDmoilwAAAEo"]
[Sun Nov 23 06:48:23.922665 2025] [:error] [pid 38824:tid 38844] [client 85.203.21.14:30943] [client 85.203.21.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aSI9t08WZjXLvbHTHPff_gAAANE"]
[Sun Nov 23 06:48:24.098995 2025] [:error] [pid 38739:tid 38786] [client 85.203.21.24:22655] [client 85.203.21.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSI9uAdvEgJm2n2cDmoimQAAAFE"]
[Sun Nov 23 06:48:24.276770 2025] [:error] [pid 38824:tid 38851] [client 85.203.21.53:34089] [client 85.203.21.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aSI9uE8WZjXLvbHTHPff_wAAANg"]
[Sun Nov 23 06:48:24.458764 2025] [:error] [pid 38739:tid 38775] [client 85.203.21.7:33705] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aSI9uAdvEgJm2n2cDmoimwAAAEY"]
[Sun Nov 23 06:48:24.635752 2025] [:error] [pid 38739:tid 38776] [client 85.203.21.21:52569] [client 85.203.21.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aSI9uAdvEgJm2n2cDmoinAAAAEc"]
[Sun Nov 23 06:48:24.812585 2025] [:error] [pid 38739:tid 38777] [client 85.203.21.67:55389] [client 85.203.21.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/load.php"] [unique_id "aSI9uAdvEgJm2n2cDmoingAAAEg"]
[Sun Nov 23 06:48:24.989474 2025] [:error] [pid 38739:tid 38782] [client 85.203.21.5:52749] [client 85.203.21.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aSI9uAdvEgJm2n2cDmoinwAAAE0"]
[Sun Nov 23 06:48:25.167378 2025] [:error] [pid 38740:tid 38813] [client 85.203.21.9:46781] [client 85.203.21.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aSI9uQ13QPZSi6O8umWw5QAAAJE"]
[Sun Nov 23 06:48:25.345200 2025] [:error] [pid 38740:tid 38810] [client 85.203.21.42:43651] [client 85.203.21.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aSI9uQ13QPZSi6O8umWw5gAAAI4"]
[Sun Nov 23 06:48:25.522918 2025] [:error] [pid 38739:tid 38792] [client 85.203.21.24:61813] [client 85.203.21.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/"] [unique_id "aSI9uQdvEgJm2n2cDmoioQAAAFc"]
[Sun Nov 23 06:48:25.699565 2025] [:error] [pid 38740:tid 38814] [client 85.203.21.23:43555] [client 85.203.21.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2024/index.php"] [unique_id "aSI9uQ13QPZSi6O8umWw5wAAAJI"]
[Sun Nov 23 06:48:25.876299 2025] [:error] [pid 38824:tid 38849] [client 85.203.21.20:57987] [client 85.203.21.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aSI9uU8WZjXLvbHTHPfgAgAAANY"]
[Sun Nov 23 06:48:26.054578 2025] [:error] [pid 44652:tid 44707] [client 85.203.21.59:39709] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/classwithtostring.php"] [unique_id "aSI9utiQFwsyXQDhwyDhNgAAAQE"]
[Sun Nov 23 06:48:26.235159 2025] [:error] [pid 38824:tid 38829] [client 85.203.21.14:43973] [client 85.203.21.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/index.php"] [unique_id "aSI9uk8WZjXLvbHTHPfgBQAAAMI"]
[Sun Nov 23 06:48:26.413991 2025] [:error] [pid 38740:tid 38803] [client 85.203.21.7:24245] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aSI9ug13QPZSi6O8umWw6QAAAIc"]
[Sun Nov 23 06:48:26.590845 2025] [:error] [pid 44652:tid 44718] [client 85.203.21.26:36143] [client 85.203.21.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/admin/index.php"] [unique_id "aSI9utiQFwsyXQDhwyDhNwAAAQw"]
[Sun Nov 23 06:48:26.766935 2025] [:error] [pid 38824:tid 38842] [client 85.203.21.5:44999] [client 85.203.21.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/about.php"] [unique_id "aSI9uk8WZjXLvbHTHPfgBwAAAM8"]
[Sun Nov 23 06:48:26.946229 2025] [:error] [pid 38738:tid 38756] [client 85.203.21.17:53739] [client 85.203.21.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/admin.php"] [unique_id "aSI9ugytc6TL9XavPmPlzQAAAA4"]
[Sun Nov 23 06:48:27.123263 2025] [:error] [pid 38739:tid 38774] [client 85.203.21.14:21141] [client 85.203.21.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aSI9uwdvEgJm2n2cDmoipQAAAEU"]
[Sun Nov 23 06:48:27.301641 2025] [:error] [pid 38738:tid 38764] [client 85.203.21.49:50199] [client 85.203.21.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aSI9uwytc6TL9XavPmPl0AAAABY"]
[Sun Nov 23 06:48:28.962009 2025] [:error] [pid 38738:tid 38765] [client 85.203.21.63:44201] [client 85.203.21.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/admin-header.php"] [unique_id "aSI9vAytc6TL9XavPmPl2gAAABc"]
[Sun Nov 23 06:48:29.140260 2025] [:error] [pid 38740:tid 38812] [client 85.203.21.25:58267] [client 85.203.21.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "aSI9vQ13QPZSi6O8umWw7QAAAJA"]
[Sun Nov 23 06:48:29.319110 2025] [:error] [pid 44652:tid 44715] [client 85.203.21.59:41905] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/autoload_classmap/function.php"] [unique_id "aSI9vdiQFwsyXQDhwyDhOAAAAQk"]
[Sun Nov 23 06:48:29.495843 2025] [:error] [pid 38824:tid 38844] [client 85.203.21.23:62499] [client 85.203.21.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "aSI9vU8WZjXLvbHTHPfgDAAAANE"]
[Sun Nov 23 06:48:29.673230 2025] [:error] [pid 38739:tid 38789] [client 85.203.21.51:41025] [client 85.203.21.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/404.php"] [unique_id "aSI9vQdvEgJm2n2cDmoiqgAAAFQ"]
[Sun Nov 23 06:48:29.852316 2025] [:error] [pid 38740:tid 38807] [client 85.203.21.62:43151] [client 85.203.21.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "aSI9vQ13QPZSi6O8umWw7gAAAIs"]
[Sun Nov 23 06:48:30.032735 2025] [:error] [pid 38824:tid 38848] [client 85.203.21.18:28495] [client 85.203.21.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/class.api.php"] [unique_id "aSI9vk8WZjXLvbHTHPfgDgAAANU"]
[Sun Nov 23 06:48:30.211012 2025] [:error] [pid 44652:tid 44725] [client 85.203.21.43:38671] [client 85.203.21.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/index.php"] [unique_id "aSI9vtiQFwsyXQDhwyDhOQAAARM"]
[Sun Nov 23 06:48:30.389124 2025] [:error] [pid 44652:tid 44729] [client 85.203.21.49:31485] [client 85.203.21.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/revslider/includes/external/page/index.php"] [unique_id "aSI9vtiQFwsyXQDhwyDhOgAAARc"]
[Sun Nov 23 06:48:30.567611 2025] [:error] [pid 44652:tid 44712] [client 85.203.21.46:26381] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-config-sample.php"] [unique_id "aSI9vtiQFwsyXQDhwyDhOwAAAQY"]
[Sun Nov 23 06:48:30.902147 2025] [:error] [pid 44652:tid 44724] [client 85.203.21.22:39625] [client 85.203.21.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aSI9vtiQFwsyXQDhwyDhPQAAARI"]
[Sun Nov 23 06:48:31.201575 2025] [:error] [pid 44652:tid 44730] [client 85.203.21.50:48645] [client 85.203.21.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aSI9v9iQFwsyXQDhwyDhPgAAARg"]
[Sun Nov 23 06:48:31.378953 2025] [:error] [pid 38740:tid 38818] [client 85.203.21.27:60039] [client 85.203.21.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/nav.php"] [unique_id "aSI9vw13QPZSi6O8umWw7wAAAJY"]
[Sun Nov 23 06:48:36.561802 2025] [:error] [pid 38740:tid 38803] [client 85.203.21.15:64011] [client 85.203.21.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/files/"] [unique_id "aSI9xA13QPZSi6O8umWw9AAAAIc"]
[Sun Nov 23 06:48:36.739480 2025] [:error] [pid 38740:tid 38801] [client 85.203.21.6:27805] [client 85.203.21.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aSI9xA13QPZSi6O8umWw9QAAAIU"]
[Sun Nov 23 06:48:36.916996 2025] [:error] [pid 38824:tid 38847] [client 85.203.21.55:34301] [client 85.203.21.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aSI9xE8WZjXLvbHTHPfgGgAAANQ"]
[Sun Nov 23 06:48:42.100499 2025] [:error] [pid 38738:tid 38761] [client 85.203.21.69:53839] [client 85.203.21.69] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aSI9ygytc6TL9XavPmPmAAAAABM"]
[Sun Nov 23 06:48:42.277814 2025] [:error] [pid 38738:tid 38757] [client 85.203.21.56:23753] [client 85.203.21.56] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aSI9ygytc6TL9XavPmPmAgAAAA8"]
[Sun Nov 23 06:48:42.468035 2025] [:error] [pid 38739:tid 38772] [client 85.203.21.21:56517] [client 85.203.21.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hello.php"] [unique_id "aSI9ygdvEgJm2n2cDmoisAAAAEM"]
[Sun Nov 23 06:48:42.670825 2025] [:error] [pid 38738:tid 38760] [client 85.203.21.46:62519] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/"] [unique_id "aSI9ygytc6TL9XavPmPmCAAAABI"]
[Sun Nov 23 06:48:42.848165 2025] [:error] [pid 38739:tid 38773] [client 85.203.21.12:51911] [client 85.203.21.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aSI9ygdvEgJm2n2cDmoisQAAAEQ"]
[Sun Nov 23 06:48:43.025291 2025] [:error] [pid 38824:tid 38830] [client 85.203.21.63:59657] [client 85.203.21.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/privacy-tools.min.php"] [unique_id "aSI9y08WZjXLvbHTHPfgIgAAAMM"]
[Sun Nov 23 06:48:43.203650 2025] [:error] [pid 38739:tid 38789] [client 85.203.21.51:58725] [client 85.203.21.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "aSI9ywdvEgJm2n2cDmoiswAAAFQ"]
[Sun Nov 23 06:48:43.381226 2025] [:error] [pid 38740:tid 38820] [client 85.203.21.34:51635] [client 85.203.21.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-links.php"] [unique_id "aSI9yw13QPZSi6O8umWxAAAAAJg"]
[Sun Nov 23 06:48:43.559161 2025] [:error] [pid 38739:tid 38788] [client 85.203.21.2:54547] [client 85.203.21.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aSI9ywdvEgJm2n2cDmoitAAAAFM"]
[Sun Nov 23 06:48:43.737020 2025] [:error] [pid 44652:tid 44719] [client 85.203.21.38:43243] [client 85.203.21.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/index.php"] [unique_id "aSI9y9iQFwsyXQDhwyDhSgAAAQ0"]
[Sun Nov 23 06:48:43.915594 2025] [:error] [pid 38739:tid 38781] [client 85.203.21.13:46241] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-file.php"] [unique_id "aSI9ywdvEgJm2n2cDmoitgAAAEw"]
[Sun Nov 23 06:48:49.093963 2025] [:error] [pid 44652:tid 44712] [client 85.203.21.9:53499] [client 85.203.21.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ws.php"] [unique_id "aSI90diQFwsyXQDhwyDhUwAAAQY"]
[Sun Nov 23 06:48:49.271307 2025] [:error] [pid 44652:tid 44710] [client 85.203.21.69:52725] [client 85.203.21.69] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ty.php"] [unique_id "aSI90diQFwsyXQDhwyDhVAAAAQQ"]
[Sun Nov 23 06:48:49.448982 2025] [:error] [pid 44652:tid 44724] [client 85.203.21.30:59747] [client 85.203.21.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aSI90diQFwsyXQDhwyDhVQAAARI"]
[Sun Nov 23 06:48:54.637108 2025] [:error] [pid 44652:tid 44717] [client 85.203.21.12:35951] [client 85.203.21.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aSI91tiQFwsyXQDhwyDhZwAAAQs"]
[Sun Nov 23 06:48:54.816474 2025] [:error] [pid 38824:tid 38847] [client 85.203.21.18:20765] [client 85.203.21.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/license.php"] [unique_id "aSI91k8WZjXLvbHTHPfgRAAAANQ"]
[Sun Nov 23 06:48:54.995032 2025] [:error] [pid 38824:tid 38846] [client 85.203.21.69:57909] [client 85.203.21.69] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/admin-ajax.php"] [unique_id "aSI91k8WZjXLvbHTHPfgRQAAANM"]
[Sun Nov 23 06:48:55.173983 2025] [:error] [pid 38738:tid 38745] [client 85.203.21.48:31133] [client 85.203.21.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/WordPressCore/include.php"] [unique_id "aSI91wytc6TL9XavPmPmLAAAAAM"]
[Sun Nov 23 06:48:55.351245 2025] [:error] [pid 38739:tid 38778] [client 85.203.21.6:63333] [client 85.203.21.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content.php"] [unique_id "aSI91wdvEgJm2n2cDmoi2wAAAEk"]
[Sun Nov 23 06:48:55.527831 2025] [:error] [pid 38738:tid 38766] [client 85.203.21.6:49377] [client 85.203.21.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-configs.php"] [unique_id "aSI91wytc6TL9XavPmPmLgAAABg"]
[Sun Nov 23 06:48:55.706277 2025] [:error] [pid 38740:tid 38814] [client 85.203.21.13:44235] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aSI91w13QPZSi6O8umWxGQAAAJI"]
[Sun Nov 23 06:48:55.883803 2025] [:error] [pid 38739:tid 38780] [client 85.203.21.59:41951] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aSI91wdvEgJm2n2cDmoi3AAAAEs"]
[Sun Nov 23 06:48:56.061472 2025] [:error] [pid 44652:tid 44727] [client 85.203.21.62:21353] [client 85.203.21.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/system.php"] [unique_id "aSI92NiQFwsyXQDhwyDhawAAARU"]
[Sun Nov 23 06:49:01.239303 2025] [:error] [pid 38739:tid 38776] [client 85.203.21.20:28207] [client 85.203.21.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/zasf"] [unique_id "aSI93QdvEgJm2n2cDmoi7QAAAEc"]
[Sun Nov 23 06:49:01.417475 2025] [:error] [pid 38739:tid 38779] [client 85.203.21.14:55575] [client 85.203.21.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aSI93QdvEgJm2n2cDmoi7wAAAEo"]
[Sun Nov 23 06:49:01.595494 2025] [:error] [pid 38739:tid 38782] [client 85.203.21.48:63589] [client 85.203.21.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-json-ajax-session.php"] [unique_id "aSI93QdvEgJm2n2cDmoi8AAAAE0"]
[Sun Nov 23 06:49:01.773299 2025] [:error] [pid 38738:tid 38758] [client 85.203.21.21:61245] [client 85.203.21.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSI93Qytc6TL9XavPmPmQQAAABA"]
[Sun Nov 23 06:49:01.952372 2025] [:error] [pid 44652:tid 44730] [client 85.203.21.46:47367] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aSI93diQFwsyXQDhwyDhcwAAARg"]
[Sun Nov 23 06:49:02.134704 2025] [:error] [pid 38740:tid 38806] [client 85.203.21.12:38145] [client 85.203.21.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-conflg.php"] [unique_id "aSI93g13QPZSi6O8umWxIQAAAIo"]
[Sun Nov 23 06:49:02.312128 2025] [:error] [pid 44652:tid 44706] [client 85.203.21.46:29535] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aSI93tiQFwsyXQDhwyDhdAAAAQA"]
[Sun Nov 23 06:49:02.493727 2025] [:error] [pid 38739:tid 38787] [client 85.203.21.15:64941] [client 85.203.21.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/"] [unique_id "aSI93gdvEgJm2n2cDmoi8wAAAFI"]
[Sun Nov 23 06:49:02.671135 2025] [:error] [pid 38824:tid 38846] [client 85.203.21.4:63755] [client 85.203.21.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aSI93k8WZjXLvbHTHPfgTAAAANM"]
[Sun Nov 23 06:49:02.850765 2025] [:error] [pid 38740:tid 38810] [client 85.203.21.49:43427] [client 85.203.21.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/archives/"] [unique_id "aSI93g13QPZSi6O8umWxIgAAAI4"]
[Sun Nov 23 06:49:03.028844 2025] [:error] [pid 38740:tid 38817] [client 85.203.21.9:53781] [client 85.203.21.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSI93w13QPZSi6O8umWxIwAAAJU"]
[Sun Nov 23 06:49:03.209961 2025] [:error] [pid 38738:tid 38761] [client 85.203.21.29:54583] [client 85.203.21.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSI93wytc6TL9XavPmPmRAAAABM"]
[Sun Nov 23 06:49:03.387387 2025] [:error] [pid 38739:tid 38771] [client 85.203.21.22:31929] [client 85.203.21.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "aSI93wdvEgJm2n2cDmoi9AAAAEI"]
[Sun Nov 23 06:49:03.584471 2025] [:error] [pid 38738:tid 38755] [client 85.203.21.37:56473] [client 85.203.21.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "aSI93wytc6TL9XavPmPmRgAAAA0"]
[Sun Nov 23 06:49:03.760920 2025] [:error] [pid 38739:tid 38773] [client 85.203.21.34:24831] [client 85.203.21.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/options.php"] [unique_id "aSI93wdvEgJm2n2cDmoi9wAAAEQ"]
[Sun Nov 23 06:49:03.938439 2025] [:error] [pid 38824:tid 38840] [client 85.203.21.20:55707] [client 85.203.21.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/about.php"] [unique_id "aSI9308WZjXLvbHTHPfgUAAAAM0"]
[Sun Nov 23 06:49:05.665825 2025] [:error] [pid 38824:tid 38849] [client 85.203.21.49:54121] [client 85.203.21.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bypass.php"] [unique_id "aSI94U8WZjXLvbHTHPfgVAAAANY"]
[Sun Nov 23 06:49:05.842683 2025] [:error] [pid 44652:tid 44714] [client 85.203.21.44:52273] [client 85.203.21.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/shell/index.php"] [unique_id "aSI94diQFwsyXQDhwyDheAAAAQg"]
[Sun Nov 23 06:49:06.021878 2025] [:error] [pid 38824:tid 38844] [client 85.203.21.47:40825] [client 85.203.21.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/wp-login.php"] [unique_id "aSI94k8WZjXLvbHTHPfgVgAAANE"]
[Sun Nov 23 06:49:06.199454 2025] [:error] [pid 38740:tid 38807] [client 85.203.21.12:57039] [client 85.203.21.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-wolf.php"] [unique_id "aSI94g13QPZSi6O8umWxKgAAAIs"]
[Sun Nov 23 06:49:06.377309 2025] [:error] [pid 38740:tid 38809] [client 85.203.21.15:42987] [client 85.203.21.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-signup.php"] [unique_id "aSI94g13QPZSi6O8umWxKwAAAI0"]
[Sun Nov 23 06:49:06.556044 2025] [:error] [pid 38824:tid 38847] [client 85.203.21.7:51533] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/index.php"] [unique_id "aSI94k8WZjXLvbHTHPfgVwAAANQ"]
[Sun Nov 23 06:49:06.733688 2025] [:error] [pid 38738:tid 38751] [client 85.203.21.22:51175] [client 85.203.21.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aSI94gytc6TL9XavPmPmSgAAAAk"]
[Sun Nov 23 06:49:06.911373 2025] [:error] [pid 38738:tid 38756] [client 85.203.21.13:22143] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aSI94gytc6TL9XavPmPmSwAAAA4"]
[Sun Nov 23 06:49:07.089942 2025] [:error] [pid 44652:tid 44710] [client 85.203.21.51:47379] [client 85.203.21.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSI949iQFwsyXQDhwyDhewAAAQQ"]
[Sun Nov 23 06:49:07.267099 2025] [:error] [pid 38739:tid 38771] [client 85.203.21.38:28489] [client 85.203.21.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aSI94wdvEgJm2n2cDmojAgAAAEI"]
[Sun Nov 23 06:49:07.443788 2025] [:error] [pid 44652:tid 44728] [client 85.203.21.69:61491] [client 85.203.21.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aSI949iQFwsyXQDhwyDhfAAAARY"]
[Sun Nov 23 06:49:07.625642 2025] [:error] [pid 38738:tid 38743] [client 85.203.21.42:53135] [client 85.203.21.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "aSI94wytc6TL9XavPmPmUAAAAAE"]
[Sun Nov 23 06:49:07.802775 2025] [:error] [pid 38824:tid 38827] [client 85.203.21.10:48301] [client 85.203.21.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSI9408WZjXLvbHTHPfgWAAAAMA"]
[Sun Nov 23 06:49:07.980621 2025] [:error] [pid 38739:tid 38785] [client 85.203.21.2:20013] [client 85.203.21.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/"] [unique_id "aSI94wdvEgJm2n2cDmojBQAAAFA"]
[Sun Nov 23 06:49:08.158606 2025] [:error] [pid 44652:tid 44716] [client 85.203.21.7:48647] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/packed.php"] [unique_id "aSI95NiQFwsyXQDhwyDhfgAAAQo"]
[Sun Nov 23 06:49:08.335785 2025] [:error] [pid 38740:tid 38810] [client 85.203.21.30:57139] [client 85.203.21.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/admin.php"] [unique_id "aSI95A13QPZSi6O8umWxLAAAAI4"]
[Sun Nov 23 06:49:08.511846 2025] [:error] [pid 38738:tid 38748] [client 85.203.21.12:64957] [client 85.203.21.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/"] [unique_id "aSI95Aytc6TL9XavPmPmVAAAAAY"]
[Sun Nov 23 06:49:08.689980 2025] [:error] [pid 38739:tid 38782] [client 85.203.21.68:31367] [client 85.203.21.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ini.php"] [unique_id "aSI95AdvEgJm2n2cDmojCAAAAE0"]
[Sun Nov 23 06:49:08.867804 2025] [:error] [pid 38739:tid 38774] [client 85.203.21.9:54787] [client 85.203.21.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/worksec.php"] [unique_id "aSI95AdvEgJm2n2cDmojCQAAAEU"]
[Sun Nov 23 06:49:09.047619 2025] [:error] [pid 38738:tid 38751] [client 85.203.21.56:45901] [client 85.203.21.56] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "aSI95Qytc6TL9XavPmPmVwAAAAk"]
[Sun Nov 23 06:49:09.227131 2025] [:error] [pid 38739:tid 38786] [client 85.203.21.51:39841] [client 85.203.21.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/index.php"] [unique_id "aSI95QdvEgJm2n2cDmojCgAAAFE"]
[Sun Nov 23 06:49:09.418570 2025] [:error] [pid 44652:tid 44727] [client 85.203.21.7:63587] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-signin.php"] [unique_id "aSI95diQFwsyXQDhwyDhgQAAARU"]
[Sun Nov 23 06:49:14.596292 2025] [:error] [pid 38824:tid 38828] [client 85.203.21.26:60701] [client 85.203.21.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/login.php"] [unique_id "aSI96k8WZjXLvbHTHPfgXQAAAME"]
[Sun Nov 23 06:49:14.775049 2025] [:error] [pid 38824:tid 38849] [client 85.203.21.36:46333] [client 85.203.21.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aSI96k8WZjXLvbHTHPfgXgAAANY"]
[Sun Nov 23 06:49:14.952745 2025] [:error] [pid 44652:tid 44716] [client 85.203.21.59:29981] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/mah.php"] [unique_id "aSI96tiQFwsyXQDhwyDhjAAAAQo"]
[Sun Nov 23 06:49:20.129622 2025] [:error] [pid 38738:tid 38752] [client 85.203.21.51:43193] [client 85.203.21.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aSI98Aytc6TL9XavPmPmdwAAAAo"]
[Sun Nov 23 06:49:25.308770 2025] [:error] [pid 44652:tid 44726] [client 85.203.21.64:56457] [client 85.203.21.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aSI99diQFwsyXQDhwyDhqgAAARQ"]
[Sun Nov 23 06:49:25.491372 2025] [:error] [pid 38739:tid 38788] [client 85.203.21.44:22901] [client 85.203.21.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aSI99QdvEgJm2n2cDmojJgAAAFM"]
[Sun Nov 23 06:49:25.670046 2025] [:error] [pid 38738:tid 38756] [client 85.203.21.59:24593] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "aSI99Qytc6TL9XavPmPmgQAAAA4"]
[Sun Nov 23 06:49:25.847596 2025] [:error] [pid 38740:tid 38800] [client 85.203.21.13:23707] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/"] [unique_id "aSI99Q13QPZSi6O8umWxQQAAAIQ"]
[Sun Nov 23 06:49:26.043113 2025] [:error] [pid 38738:tid 38746] [client 85.203.21.36:43311] [client 85.203.21.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "aSI99gytc6TL9XavPmPmggAAAAQ"]
[Sun Nov 23 06:49:26.220836 2025] [:error] [pid 38740:tid 38801] [client 85.203.21.50:38645] [client 85.203.21.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/buy.php"] [unique_id "aSI99g13QPZSi6O8umWxQgAAAIU"]
[Sun Nov 23 06:49:26.400234 2025] [:error] [pid 38740:tid 38809] [client 85.203.21.53:65197] [client 85.203.21.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/f.php"] [unique_id "aSI99g13QPZSi6O8umWxRAAAAI0"]
[Sun Nov 23 06:49:26.578828 2025] [:error] [pid 44652:tid 44730] [client 85.203.21.29:55235] [client 85.203.21.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-header.php"] [unique_id "aSI99tiQFwsyXQDhwyDhrAAAARg"]
[Sun Nov 23 06:49:26.758668 2025] [:error] [pid 44652:tid 44722] [client 85.203.21.20:45311] [client 85.203.21.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aSI99tiQFwsyXQDhwyDhrgAAARA"]
[Sun Nov 23 06:49:26.935916 2025] [:error] [pid 38824:tid 38838] [client 85.203.21.46:44699] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfour/"] [unique_id "aSI99k8WZjXLvbHTHPfgbwAAAMs"]
[Sun Nov 23 06:49:27.113857 2025] [:error] [pid 38824:tid 38829] [client 85.203.21.26:41759] [client 85.203.21.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "aSI9908WZjXLvbHTHPfgcAAAAMI"]
[Sun Nov 23 06:49:27.294845 2025] [:error] [pid 38738:tid 38749] [client 85.203.21.14:53913] [client 85.203.21.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/shell3.php"] [unique_id "aSI99wytc6TL9XavPmPmhQAAAAc"]
[Sun Nov 23 06:49:29.109041 2025] [:error] [pid 44652:tid 44719] [client 85.203.21.25:32229] [client 85.203.21.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/admin.php"] [unique_id "aSI9-diQFwsyXQDhwyDhtAAAAQ0"]
[Sun Nov 23 06:49:29.288337 2025] [:error] [pid 38738:tid 38760] [client 85.203.21.63:35767] [client 85.203.21.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aSI9-Qytc6TL9XavPmPmjQAAABI"]
[Sun Nov 23 06:49:29.466627 2025] [:error] [pid 38740:tid 38796] [client 85.203.21.25:36445] [client 85.203.21.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-conflg/function.php"] [unique_id "aSI9-Q13QPZSi6O8umWxSQAAAIA"]
[Sun Nov 23 06:49:29.644746 2025] [:error] [pid 38824:tid 38835] [client 85.203.21.9:20163] [client 85.203.21.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/uploaded_script.php"] [unique_id "aSI9-U8WZjXLvbHTHPfgdgAAAMg"]
[Sun Nov 23 06:49:29.829056 2025] [:error] [pid 38824:tid 38841] [client 85.203.21.63:60573] [client 85.203.21.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aSI9-U8WZjXLvbHTHPfgdwAAAM4"]
[Sun Nov 23 06:49:30.011555 2025] [:error] [pid 38738:tid 38756] [client 85.203.21.59:64549] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aSI9-gytc6TL9XavPmPmkgAAAA4"]
[Sun Nov 23 06:49:30.189648 2025] [:error] [pid 38740:tid 38805] [client 85.203.21.51:46531] [client 85.203.21.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/admin.php"] [unique_id "aSI9-g13QPZSi6O8umWxTAAAAIk"]
[Sun Nov 23 06:49:30.369891 2025] [:error] [pid 38824:tid 38832] [client 85.203.21.44:33651] [client 85.203.21.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aSI9-k8WZjXLvbHTHPfgeAAAAMU"]
[Sun Nov 23 06:49:30.548975 2025] [:error] [pid 44652:tid 44713] [client 85.203.21.10:36059] [client 85.203.21.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aSI9-tiQFwsyXQDhwyDhuQAAAQc"]
[Sun Nov 23 06:49:30.854220 2025] [:error] [pid 38739:tid 38780] [client 85.203.21.16:21825] [client 85.203.21.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/news-portal/error.php"] [unique_id "aSI9-gdvEgJm2n2cDmojLwAAAEs"]
[Sun Nov 23 06:49:31.031914 2025] [:error] [pid 38740:tid 38799] [client 85.203.21.29:37461] [client 85.203.21.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "aSI9-w13QPZSi6O8umWxTgAAAIM"]
[Sun Nov 23 06:49:31.210729 2025] [:error] [pid 44652:tid 44723] [client 85.203.21.7:64611] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aSI9-9iQFwsyXQDhwyDhuwAAARE"]
[Sun Nov 23 06:49:31.390672 2025] [:error] [pid 38824:tid 38839] [client 85.203.21.64:30935] [client 85.203.21.64] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentyfive/include.php"] [unique_id "aSI9-08WZjXLvbHTHPfgfAAAAMw"]
[Sun Nov 23 06:49:31.568746 2025] [:error] [pid 44652:tid 44712] [client 85.203.21.50:51045] [client 85.203.21.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/index2.php"] [unique_id "aSI9-9iQFwsyXQDhwyDhvQAAAQY"]
[Sun Nov 23 06:49:31.748907 2025] [:error] [pid 38824:tid 38827] [client 85.203.21.36:38707] [client 85.203.21.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "aSI9-08WZjXLvbHTHPfgfgAAAMA"]
[Sun Nov 23 06:49:31.928074 2025] [:error] [pid 38738:tid 38764] [client 85.203.21.53:53011] [client 85.203.21.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/options.php"] [unique_id "aSI9-wytc6TL9XavPmPmmQAAABY"]
[Sun Nov 23 06:49:32.105166 2025] [:error] [pid 38738:tid 38743] [client 85.203.21.10:45253] [client 85.203.21.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/s.php"] [unique_id "aSI9_Aytc6TL9XavPmPmmgAAAAE"]
[Sun Nov 23 06:49:32.283567 2025] [:error] [pid 44652:tid 44729] [client 85.203.21.2:27077] [client 85.203.21.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/sunrise/index.php"] [unique_id "aSI9_NiQFwsyXQDhwyDhvgAAARc"]
[Sun Nov 23 06:49:32.462234 2025] [:error] [pid 38739:tid 38789] [client 85.203.21.20:62099] [client 85.203.21.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSI9_AdvEgJm2n2cDmojNgAAAFQ"]
[Sun Nov 23 06:49:32.638828 2025] [:error] [pid 38738:tid 38755] [client 85.203.21.37:37083] [client 85.203.21.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/"] [unique_id "aSI9_Aytc6TL9XavPmPmnAAAAA0"]
[Sun Nov 23 06:49:32.817402 2025] [:error] [pid 44652:tid 44708] [client 85.203.21.24:23289] [client 85.203.21.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-conf.php"] [unique_id "aSI9_NiQFwsyXQDhwyDhvwAAAQI"]
[Sun Nov 23 06:49:32.995998 2025] [:error] [pid 38739:tid 38778] [client 85.203.21.46:26109] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aSI9_AdvEgJm2n2cDmojOgAAAEk"]
[Sun Nov 23 06:49:33.178796 2025] [:error] [pid 38740:tid 38798] [client 85.203.21.11:45645] [client 85.203.21.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp.php"] [unique_id "aSI9_Q13QPZSi6O8umWxUAAAAII"]
[Sun Nov 23 06:49:33.358202 2025] [:error] [pid 38738:tid 38752] [client 85.203.21.59:47049] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aSI9_Qytc6TL9XavPmPmoQAAAAo"]
[Sun Nov 23 06:49:33.535569 2025] [:error] [pid 38738:tid 38757] [client 85.203.21.36:54249] [client 85.203.21.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-files.php"] [unique_id "aSI9_Qytc6TL9XavPmPmogAAAA8"]
[Sun Nov 23 06:49:33.715039 2025] [:error] [pid 38740:tid 38807] [client 85.203.21.7:48785] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/"] [unique_id "aSI9_Q13QPZSi6O8umWxUQAAAIs"]
[Sun Nov 23 06:49:33.914627 2025] [:error] [pid 38824:tid 38846] [client 85.203.21.12:48603] [client 85.203.21.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/admin.php"] [unique_id "aSI9_U8WZjXLvbHTHPfgggAAANM"]
[Sun Nov 23 06:49:34.092481 2025] [:error] [pid 38740:tid 38819] [client 85.203.21.43:57379] [client 85.203.21.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aSI9_g13QPZSi6O8umWxUgAAAJc"]
[Sun Nov 23 06:49:34.269917 2025] [:error] [pid 38739:tid 38783] [client 85.203.21.44:43887] [client 85.203.21.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/db.php"] [unique_id "aSI9_gdvEgJm2n2cDmojPQAAAE4"]
[Sun Nov 23 06:49:34.448046 2025] [:error] [pid 38740:tid 38820] [client 85.203.21.59:25373] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/m.php"] [unique_id "aSI9_g13QPZSi6O8umWxUwAAAJg"]
[Sun Nov 23 06:49:34.627817 2025] [:error] [pid 38738:tid 38749] [client 85.203.21.15:56841] [client 85.203.21.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/chosen.php"] [unique_id "aSI9_gytc6TL9XavPmPmpgAAAAc"]
[Sun Nov 23 06:49:34.806558 2025] [:error] [pid 38740:tid 38810] [client 85.203.21.69:50721] [client 85.203.21.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aSI9_g13QPZSi6O8umWxVAAAAI4"]
[Sun Nov 23 06:49:34.984929 2025] [:error] [pid 38824:tid 38844] [client 85.203.21.59:24957] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bk/index.php"] [unique_id "aSI9_k8WZjXLvbHTHPfghgAAANE"]
[Sun Nov 23 06:49:35.165669 2025] [:error] [pid 44652:tid 44720] [client 85.203.21.37:65327] [client 85.203.21.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/log.php"] [unique_id "aSI9_9iQFwsyXQDhwyDhwwAAAQ4"]
[Sun Nov 23 06:49:35.348623 2025] [:error] [pid 38824:tid 38849] [client 85.203.21.64:39655] [client 85.203.21.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/navigation/index.php"] [unique_id "aSI9_08WZjXLvbHTHPfghwAAANY"]
[Sun Nov 23 06:49:35.527495 2025] [:error] [pid 38739:tid 38776] [client 85.203.21.38:45907] [client 85.203.21.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "aSI9_wdvEgJm2n2cDmojQgAAAEc"]
[Sun Nov 23 06:49:35.706130 2025] [:error] [pid 38739:tid 38782] [client 85.203.21.2:56763] [client 85.203.21.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/"] [unique_id "aSI9_wdvEgJm2n2cDmojQwAAAE0"]
[Sun Nov 23 06:49:35.888833 2025] [:error] [pid 44652:tid 44727] [client 85.203.21.7:61657] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/post.php"] [unique_id "aSI9_9iQFwsyXQDhwyDhxAAAARU"]
[Sun Nov 23 06:49:36.067618 2025] [:error] [pid 38738:tid 38761] [client 85.203.21.17:59103] [client 85.203.21.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aSI-AAytc6TL9XavPmPmqwAAABM"]
[Sun Nov 23 06:49:36.246759 2025] [:error] [pid 38740:tid 38805] [client 85.203.21.68:54551] [client 85.203.21.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/contact.php"] [unique_id "aSI-AA13QPZSi6O8umWxVQAAAIk"]
[Sun Nov 23 06:49:36.427757 2025] [:error] [pid 38739:tid 38791] [client 85.203.21.36:59423] [client 85.203.21.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aSI-AAdvEgJm2n2cDmojRgAAAFY"]
[Sun Nov 23 06:49:36.607523 2025] [:error] [pid 44652:tid 44726] [client 85.203.21.24:49431] [client 85.203.21.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/error.php"] [unique_id "aSI-ANiQFwsyXQDhwyDhxgAAARQ"]
[Sun Nov 23 06:49:36.787937 2025] [:error] [pid 44652:tid 44723] [client 85.203.21.43:59743] [client 85.203.21.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/lib/"] [unique_id "aSI-ANiQFwsyXQDhwyDhyQAAARE"]
[Sun Nov 23 06:49:38.359641 2025] [:error] [pid 38740:tid 38815] [client 34.87.28.111:56888] [client 34.87.28.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.87.28.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSI-Ag13QPZSi6O8umWxVwAAAJM"]
[Sun Nov 23 06:49:41.965710 2025] [:error] [pid 38738:tid 38753] [client 85.203.21.29:56941] [client 85.203.21.29] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/"] [unique_id "aSI-BQytc6TL9XavPmPmvAAAAAs"]
[Sun Nov 23 06:49:42.145331 2025] [:error] [pid 38740:tid 38801] [client 85.203.21.64:39869] [client 85.203.21.64] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/leafmailer.php"] [unique_id "aSI-Bg13QPZSi6O8umWxWgAAAIU"]
[Sun Nov 23 06:49:42.322928 2025] [:error] [pid 38738:tid 38745] [client 85.203.21.68:29473] [client 85.203.21.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aSI-Bgytc6TL9XavPmPmvgAAAAM"]
[Sun Nov 23 06:49:42.501981 2025] [:error] [pid 38739:tid 38774] [client 85.203.21.13:26221] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/search/"] [unique_id "aSI-BgdvEgJm2n2cDmojWAAAAEU"]
[Sun Nov 23 06:49:42.679440 2025] [:error] [pid 44652:tid 44715] [client 85.203.21.4:42027] [client 85.203.21.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/index.php"] [unique_id "aSI-BtiQFwsyXQDhwyDhzQAAAQk"]
[Sun Nov 23 06:49:42.856336 2025] [:error] [pid 44652:tid 44719] [client 85.203.21.55:41431] [client 85.203.21.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/images/index.php"] [unique_id "aSI-BtiQFwsyXQDhwyDhzgAAAQ0"]
[Sun Nov 23 06:49:43.034232 2025] [:error] [pid 38739:tid 38784] [client 85.203.21.64:52791] [client 85.203.21.64] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/update/function.php"] [unique_id "aSI-BwdvEgJm2n2cDmojWgAAAE8"]
[Sun Nov 23 06:49:43.219003 2025] [:error] [pid 38740:tid 38802] [client 85.203.21.53:31023] [client 85.203.21.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/assets/"] [unique_id "aSI-Bw13QPZSi6O8umWxXAAAAIY"]
[Sun Nov 23 06:49:43.407693 2025] [:error] [pid 44652:tid 44706] [client 85.203.21.15:56211] [client 85.203.21.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aSI-B9iQFwsyXQDhwyDhzwAAAQA"]
[Sun Nov 23 06:49:43.589002 2025] [:error] [pid 38739:tid 38781] [client 85.203.21.15:29561] [client 85.203.21.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aSI-BwdvEgJm2n2cDmojWwAAAEw"]
[Sun Nov 23 06:49:43.766732 2025] [:error] [pid 38740:tid 38814] [client 85.203.21.15:57803] [client 85.203.21.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/upload/"] [unique_id "aSI-Bw13QPZSi6O8umWxXgAAAJI"]
[Sun Nov 23 06:49:43.945620 2025] [:error] [pid 38740:tid 38806] [client 85.203.21.16:30757] [client 85.203.21.16] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/function/function.php"] [unique_id "aSI-Bw13QPZSi6O8umWxYAAAAIo"]
[Sun Nov 23 06:49:44.126738 2025] [:error] [pid 38824:tid 38849] [client 85.203.21.36:65251] [client 85.203.21.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aSI-CE8WZjXLvbHTHPfglQAAANY"]
[Sun Nov 23 06:49:44.341986 2025] [:error] [pid 38739:tid 38786] [client 85.203.21.49:35795] [client 85.203.21.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aSI-CAdvEgJm2n2cDmojXQAAAFE"]
[Sun Nov 23 06:49:44.520389 2025] [:error] [pid 38824:tid 38847] [client 85.203.21.53:53097] [client 85.203.21.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/about.php"] [unique_id "aSI-CE8WZjXLvbHTHPfglgAAANQ"]
[Sun Nov 23 06:49:44.696201 2025] [:error] [pid 44652:tid 44726] [client 85.203.21.7:52499] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aSI-CNiQFwsyXQDhwyDh0QAAARQ"]
[Sun Nov 23 06:49:44.877173 2025] [:error] [pid 38824:tid 38835] [client 85.203.21.30:45717] [client 85.203.21.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aSI-CE8WZjXLvbHTHPfgmAAAAMg"]
[Sun Nov 23 06:49:45.053173 2025] [:error] [pid 38740:tid 38805] [client 85.203.21.46:62759] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/wp-login.php"] [unique_id "aSI-CQ13QPZSi6O8umWxZAAAAIk"]
[Sun Nov 23 06:49:45.230499 2025] [:error] [pid 38740:tid 38803] [client 85.203.21.23:61565] [client 85.203.21.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aSI-CQ13QPZSi6O8umWxZQAAAIc"]
[Sun Nov 23 06:49:45.407002 2025] [:error] [pid 44652:tid 44723] [client 85.203.21.30:33791] [client 85.203.21.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aSI-CdiQFwsyXQDhwyDh0gAAARE"]
[Sun Nov 23 06:49:45.584981 2025] [:error] [pid 38824:tid 38828] [client 85.203.21.55:57909] [client 85.203.21.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aSI-CU8WZjXLvbHTHPfgmQAAAME"]
[Sun Nov 23 06:49:45.763024 2025] [:error] [pid 44652:tid 44722] [client 85.203.21.16:44253] [client 85.203.21.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/about.php"] [unique_id "aSI-CdiQFwsyXQDhwyDh0wAAARA"]
[Sun Nov 23 06:49:45.940319 2025] [:error] [pid 38824:tid 38833] [client 85.203.21.12:47333] [client 85.203.21.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/themes/"] [unique_id "aSI-CU8WZjXLvbHTHPfgmgAAAMY"]
[Sun Nov 23 06:49:46.117684 2025] [:error] [pid 38824:tid 38830] [client 85.203.21.11:24255] [client 85.203.21.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aSI-Ck8WZjXLvbHTHPfgmwAAAMM"]
[Sun Nov 23 06:49:46.295348 2025] [:error] [pid 38739:tid 38780] [client 85.203.21.24:34801] [client 85.203.21.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/function.php"] [unique_id "aSI-CgdvEgJm2n2cDmojYQAAAEs"]
[Sun Nov 23 06:49:46.473384 2025] [:error] [pid 38739:tid 38769] [client 85.203.21.10:22205] [client 85.203.21.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aSI-CgdvEgJm2n2cDmojYgAAAEA"]
[Sun Nov 23 06:49:46.649184 2025] [:error] [pid 44652:tid 44718] [client 85.203.21.38:28607] [client 85.203.21.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/chosen/function.php"] [unique_id "aSI-CtiQFwsyXQDhwyDh1QAAAQw"]
[Sun Nov 23 06:49:46.826828 2025] [:error] [pid 38739:tid 38770] [client 85.203.21.15:27261] [client 85.203.21.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aSI-CgdvEgJm2n2cDmojYwAAAEE"]
[Sun Nov 23 06:49:47.006238 2025] [:error] [pid 38739:tid 38791] [client 85.203.21.46:62361] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aSI-CwdvEgJm2n2cDmojZAAAAFY"]
[Sun Nov 23 06:49:47.183625 2025] [:error] [pid 38824:tid 38834] [client 85.203.21.48:53435] [client 85.203.21.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aSI-C08WZjXLvbHTHPfgnAAAAMc"]
[Sun Nov 23 06:49:47.361085 2025] [:error] [pid 38824:tid 38836] [client 85.203.21.9:57569] [client 85.203.21.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/item.php"] [unique_id "aSI-C08WZjXLvbHTHPfgnQAAAMk"]
[Sun Nov 23 06:49:47.537761 2025] [:error] [pid 38740:tid 38812] [client 85.203.21.14:43541] [client 85.203.21.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/index.php"] [unique_id "aSI-Cw13QPZSi6O8umWxbQAAAJA"]
[Sun Nov 23 06:49:47.716340 2025] [:error] [pid 38740:tid 38814] [client 85.203.21.4:29259] [client 85.203.21.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/include.php"] [unique_id "aSI-Cw13QPZSi6O8umWxbgAAAJI"]
[Sun Nov 23 06:49:47.892516 2025] [:error] [pid 38739:tid 38785] [client 85.203.21.10:51521] [client 85.203.21.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/cgi-bin/user/index.php"] [unique_id "aSI-CwdvEgJm2n2cDmojaAAAAFA"]
[Sun Nov 23 06:49:58.069258 2025] [:error] [pid 38824:tid 38830] [client 85.203.21.51:21645] [client 85.203.21.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/config.php"] [unique_id "aSI-Fk8WZjXLvbHTHPfgpwAAAMM"]
[Sun Nov 23 06:49:58.246852 2025] [:error] [pid 38824:tid 38846] [client 85.203.21.7:46135] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aSI-Fk8WZjXLvbHTHPfgqgAAANM"]
[Sun Nov 23 06:49:58.424633 2025] [:error] [pid 38739:tid 38769] [client 85.203.21.30:29891] [client 85.203.21.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfour/patterns/wp-good.php"] [unique_id "aSI-FgdvEgJm2n2cDmojiwAAAEA"]
[Sun Nov 23 06:50:03.603262 2025] [:error] [pid 38740:tid 38802] [client 85.203.21.18:38973] [client 85.203.21.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/admin.php"] [unique_id "aSI-Gw13QPZSi6O8umWxlQAAAIY"]
[Sun Nov 23 06:50:03.781793 2025] [:error] [pid 38738:tid 38748] [client 85.203.21.17:51149] [client 85.203.21.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-Owl.php"] [unique_id "aSI-Gwytc6TL9XavPmPm_AAAAAY"]
[Sun Nov 23 06:50:03.959511 2025] [:error] [pid 38739:tid 38789] [client 85.203.21.23:37267] [client 85.203.21.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/plugins/about.php"] [unique_id "aSI-GwdvEgJm2n2cDmojkwAAAFQ"]
[Sun Nov 23 06:50:04.137275 2025] [:error] [pid 38739:tid 38776] [client 85.203.21.21:51819] [client 85.203.21.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aSI-HAdvEgJm2n2cDmojlQAAAEc"]
[Sun Nov 23 06:50:04.315642 2025] [:error] [pid 44652:tid 44706] [client 85.203.21.43:36923] [client 85.203.21.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aSI-HNiQFwsyXQDhwyDiAgAAAQA"]
[Sun Nov 23 06:50:04.491879 2025] [:error] [pid 38824:tid 38830] [client 85.203.21.30:59419] [client 85.203.21.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/"] [unique_id "aSI-HE8WZjXLvbHTHPfgsgAAAMM"]
[Sun Nov 23 06:50:04.668002 2025] [:error] [pid 38740:tid 38811] [client 85.203.21.21:51785] [client 85.203.21.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/themes.php"] [unique_id "aSI-HA13QPZSi6O8umWxlgAAAI8"]
[Sun Nov 23 06:50:04.844882 2025] [:error] [pid 38739:tid 38791] [client 85.203.21.38:52427] [client 85.203.21.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "aSI-HAdvEgJm2n2cDmojlwAAAFY"]
[Sun Nov 23 06:50:05.022112 2025] [:error] [pid 38824:tid 38833] [client 85.203.21.50:28741] [client 85.203.21.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "aSI-HU8WZjXLvbHTHPfgtAAAAMY"]
[Sun Nov 23 06:50:05.200199 2025] [:error] [pid 38738:tid 38756] [client 85.203.21.5:44257] [client 85.203.21.5] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aSI-HQytc6TL9XavPmPnAAAAAA4"]
[Sun Nov 23 06:50:05.379030 2025] [:error] [pid 38740:tid 38797] [client 85.203.21.49:51705] [client 85.203.21.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aSI-HQ13QPZSi6O8umWxmgAAAIE"]
[Sun Nov 23 06:50:05.555091 2025] [:error] [pid 38740:tid 38798] [client 85.203.21.69:28573] [client 85.203.21.69] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aSI-HQ13QPZSi6O8umWxmwAAAII"]
[Sun Nov 23 06:50:05.732375 2025] [:error] [pid 38740:tid 38816] [client 85.203.21.44:47961] [client 85.203.21.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/wp-login.php"] [unique_id "aSI-HQ13QPZSi6O8umWxnAAAAJQ"]
[Sun Nov 23 06:50:05.909188 2025] [:error] [pid 38824:tid 38840] [client 85.203.21.47:29879] [client 85.203.21.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wander.php"] [unique_id "aSI-HU8WZjXLvbHTHPfgtQAAAM0"]
[Sun Nov 23 06:50:06.086724 2025] [:error] [pid 44652:tid 44730] [client 85.203.21.30:45615] [client 85.203.21.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/version.php"] [unique_id "aSI-HtiQFwsyXQDhwyDiAwAAARg"]
[Sun Nov 23 06:50:06.263239 2025] [:error] [pid 44652:tid 44723] [client 85.203.21.30:46487] [client 85.203.21.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/about.php"] [unique_id "aSI-HtiQFwsyXQDhwyDiBAAAARE"]
[Sun Nov 23 06:50:06.452114 2025] [:error] [pid 44652:tid 44722] [client 85.203.21.24:34731] [client 85.203.21.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aSI-HtiQFwsyXQDhwyDiBQAAARA"]
[Sun Nov 23 06:50:06.631295 2025] [:error] [pid 38738:tid 38747] [client 85.203.21.11:26149] [client 85.203.21.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "aSI-Hgytc6TL9XavPmPnCAAAAAU"]
[Sun Nov 23 06:50:06.809951 2025] [:error] [pid 44652:tid 44721] [client 85.203.21.20:21983] [client 85.203.21.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/product.php"] [unique_id "aSI-HtiQFwsyXQDhwyDiCAAAAQ8"]
[Sun Nov 23 06:50:06.987437 2025] [:error] [pid 38824:tid 38832] [client 85.203.21.17:28221] [client 85.203.21.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/chosen.php"] [unique_id "aSI-Hk8WZjXLvbHTHPfgtgAAAMU"]
[Sun Nov 23 06:50:07.165096 2025] [:error] [pid 44652:tid 44717] [client 85.203.21.48:45621] [client 85.203.21.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aSI-H9iQFwsyXQDhwyDiCgAAAQs"]
[Sun Nov 23 06:50:07.342110 2025] [:error] [pid 38824:tid 38837] [client 85.203.21.14:23639] [client 85.203.21.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/yasnu.php"] [unique_id "aSI-H08WZjXLvbHTHPfgtwAAAMo"]
[Sun Nov 23 06:50:07.519760 2025] [:error] [pid 44652:tid 44708] [client 85.203.21.37:42819] [client 85.203.21.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/"] [unique_id "aSI-H9iQFwsyXQDhwyDiCwAAAQI"]
[Sun Nov 23 06:50:07.696721 2025] [:error] [pid 38824:tid 38848] [client 85.203.21.68:54899] [client 85.203.21.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/classwithtostring.php"] [unique_id "aSI-H08WZjXLvbHTHPfguAAAANU"]
[Sun Nov 23 06:50:07.873122 2025] [:error] [pid 44652:tid 44713] [client 85.203.21.27:22701] [client 85.203.21.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/"] [unique_id "aSI-H9iQFwsyXQDhwyDiDAAAAQc"]
[Sun Nov 23 06:50:08.049449 2025] [:error] [pid 38824:tid 38829] [client 85.203.21.53:25939] [client 85.203.21.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/pki-validation/index.php"] [unique_id "aSI-IE8WZjXLvbHTHPfgugAAAMI"]
[Sun Nov 23 06:50:08.224771 2025] [:error] [pid 38740:tid 38809] [client 85.203.21.42:53665] [client 85.203.21.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/about.php"] [unique_id "aSI-IA13QPZSi6O8umWxngAAAI0"]
[Sun Nov 23 06:50:08.402022 2025] [:error] [pid 38740:tid 38804] [client 85.203.21.44:49001] [client 85.203.21.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "aSI-IA13QPZSi6O8umWxnwAAAIg"]
[Sun Nov 23 06:50:13.593154 2025] [:error] [pid 38740:tid 38801] [client 85.203.21.20:23465] [client 85.203.21.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aSI-JQ13QPZSi6O8umWxqAAAAIU"]
[Sun Nov 23 06:50:13.771411 2025] [:error] [pid 44652:tid 44718] [client 85.203.21.42:38647] [client 85.203.21.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/wp.php"] [unique_id "aSI-JdiQFwsyXQDhwyDiFgAAAQw"]
[Sun Nov 23 06:50:13.949169 2025] [:error] [pid 44652:tid 44725] [client 85.203.21.15:24491] [client 85.203.21.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/details/about.php"] [unique_id "aSI-JdiQFwsyXQDhwyDiFwAAARM"]
[Sun Nov 23 06:50:14.129936 2025] [:error] [pid 38739:tid 38783] [client 85.203.21.15:22441] [client 85.203.21.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSI-JgdvEgJm2n2cDmojqgAAAE4"]
[Sun Nov 23 06:50:14.306796 2025] [:error] [pid 38739:tid 38773] [client 85.203.21.68:36629] [client 85.203.21.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aSI-JgdvEgJm2n2cDmojrAAAAEQ"]
[Sun Nov 23 06:50:14.485383 2025] [:error] [pid 38739:tid 38792] [client 85.203.21.18:42157] [client 85.203.21.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aSI-JgdvEgJm2n2cDmojrQAAAFc"]
[Sun Nov 23 06:50:14.663096 2025] [:error] [pid 44652:tid 44714] [client 85.203.21.17:54983] [client 85.203.21.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/wp-admin.php"] [unique_id "aSI-JtiQFwsyXQDhwyDiGAAAAQg"]
[Sun Nov 23 06:50:14.840254 2025] [:error] [pid 38739:tid 38784] [client 85.203.21.6:37335] [client 85.203.21.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/Contrller.php"] [unique_id "aSI-JgdvEgJm2n2cDmojrwAAAE8"]
[Sun Nov 23 06:50:15.017941 2025] [:error] [pid 38740:tid 38809] [client 85.203.21.7:28645] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/about-cong.php"] [unique_id "aSI-Jw13QPZSi6O8umWxqwAAAI0"]
[Sun Nov 23 06:50:15.196627 2025] [:error] [pid 38739:tid 38769] [client 85.203.21.18:49551] [client 85.203.21.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/app/connect.php"] [unique_id "aSI-JwdvEgJm2n2cDmojswAAAEA"]
[Sun Nov 23 06:50:15.386825 2025] [:error] [pid 44652:tid 44706] [client 85.203.21.55:59487] [client 85.203.21.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/assets/images/selam.php"] [unique_id "aSI-J9iQFwsyXQDhwyDiGwAAAQA"]
[Sun Nov 23 06:50:15.593710 2025] [:error] [pid 38824:tid 38839] [client 85.203.21.64:33983] [client 85.203.21.64] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aSI-J08WZjXLvbHTHPfgzAAAAMw"]
[Sun Nov 23 06:50:15.771778 2025] [:error] [pid 44652:tid 44716] [client 85.203.21.7:43605] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/gfherhfghre/commentsos/vendoyters/index.php"] [unique_id "aSI-J9iQFwsyXQDhwyDiHQAAAQo"]
[Sun Nov 23 06:50:15.948163 2025] [:error] [pid 38739:tid 38783] [client 85.203.21.22:53579] [client 85.203.21.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/images/admin.php"] [unique_id "aSI-JwdvEgJm2n2cDmojtgAAAE4"]
[Sun Nov 23 06:50:16.131997 2025] [:error] [pid 38740:tid 38807] [client 85.203.21.63:48183] [client 85.203.21.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/images/autoload_classmap.php"] [unique_id "aSI-KA13QPZSi6O8umWxrgAAAIs"]
[Sun Nov 23 06:50:16.310932 2025] [:error] [pid 44652:tid 44722] [client 85.203.21.55:20399] [client 85.203.21.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/images/chosen.php"] [unique_id "aSI-KNiQFwsyXQDhwyDiHwAAARA"]
[Sun Nov 23 06:50:16.489583 2025] [:error] [pid 38739:tid 38771] [client 85.203.21.63:61941] [client 85.203.21.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/let.php"] [unique_id "aSI-KAdvEgJm2n2cDmojtwAAAEI"]
[Sun Nov 23 06:50:16.667697 2025] [:error] [pid 38824:tid 38827] [client 85.203.21.56:42861] [client 85.203.21.56] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/miansha.php"] [unique_id "aSI-KE8WZjXLvbHTHPfgzQAAAMA"]
[Sun Nov 23 06:50:16.844716 2025] [:error] [pid 38739:tid 38789] [client 85.203.21.13:45875] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/newuser.php"] [unique_id "aSI-KAdvEgJm2n2cDmojugAAAFQ"]
[Sun Nov 23 06:50:17.052457 2025] [:error] [pid 38739:tid 38776] [client 85.203.21.49:39529] [client 85.203.21.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/sama.php"] [unique_id "aSI-KQdvEgJm2n2cDmojuwAAAEc"]
[Sun Nov 23 06:50:17.233360 2025] [:error] [pid 38824:tid 38846] [client 85.203.21.64:37967] [client 85.203.21.64] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/user.php"] [unique_id "aSI-KU8WZjXLvbHTHPfgzwAAANM"]
[Sun Nov 23 06:50:17.411160 2025] [:error] [pid 38738:tid 38751] [client 85.203.21.50:58839] [client 85.203.21.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-active.php"] [unique_id "aSI-KQytc6TL9XavPmPnGAAAAAk"]
[Sun Nov 23 06:50:17.588251 2025] [:error] [pid 38739:tid 38782] [client 85.203.21.56:25025] [client 85.203.21.56] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/about.php"] [unique_id "aSI-KQdvEgJm2n2cDmojvgAAAE0"]
[Sun Nov 23 06:50:17.765429 2025] [:error] [pid 38738:tid 38748] [client 85.203.21.24:56705] [client 85.203.21.24] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/fttri.php"] [unique_id "aSI-KQytc6TL9XavPmPnGwAAAAY"]
[Sun Nov 23 06:50:22.945020 2025] [:error] [pid 44652:tid 44728] [client 85.203.21.50:53355] [client 85.203.21.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/lock.php"] [unique_id "aSI-LtiQFwsyXQDhwyDiKwAAARY"]
[Sun Nov 23 06:50:23.122936 2025] [:error] [pid 38739:tid 38771] [client 85.203.21.62:28821] [client 85.203.21.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/index.php"] [unique_id "aSI-LwdvEgJm2n2cDmojywAAAEI"]
[Sun Nov 23 06:50:23.301762 2025] [:error] [pid 38739:tid 38780] [client 85.203.21.26:44679] [client 85.203.21.26] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/class-walker-category-checklist-hashing.php"] [unique_id "aSI-LwdvEgJm2n2cDmojzAAAAEs"]
[Sun Nov 23 06:50:23.506510 2025] [:error] [pid 38740:tid 38818] [client 85.203.21.55:44651] [client 85.203.21.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/wp-conflg.php"] [unique_id "aSI-Lw13QPZSi6O8umWxwAAAAJY"]
[Sun Nov 23 06:50:23.684158 2025] [:error] [pid 38824:tid 38851] [client 85.203.21.7:26175] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/techl.php"] [unique_id "aSI-L08WZjXLvbHTHPfg1AAAANg"]
[Sun Nov 23 06:50:23.861890 2025] [:error] [pid 38738:tid 38744] [client 85.203.21.55:26297] [client 85.203.21.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/link-manager-first.php"] [unique_id "aSI-Lwytc6TL9XavPmPnJwAAAAI"]
[Sun Nov 23 06:50:24.039680 2025] [:error] [pid 38740:tid 38797] [client 85.203.21.46:53021] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/Noname6.php"] [unique_id "aSI-MA13QPZSi6O8umWxwQAAAIE"]
[Sun Nov 23 06:50:24.216462 2025] [:error] [pid 44652:tid 44712] [client 85.203.21.38:28949] [client 85.203.21.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/autoload_classmap.php"] [unique_id "aSI-MNiQFwsyXQDhwyDiLgAAAQY"]
[Sun Nov 23 06:50:24.399710 2025] [:error] [pid 38739:tid 38770] [client 85.203.21.59:37211] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/mlex.php"] [unique_id "aSI-MAdvEgJm2n2cDmojzgAAAEE"]
[Sun Nov 23 06:50:24.586827 2025] [:error] [pid 38739:tid 38781] [client 85.203.21.25:41379] [client 85.203.21.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/plex1.php"] [unique_id "aSI-MAdvEgJm2n2cDmoj0AAAAEw"]
[Sun Nov 23 06:50:24.766228 2025] [:error] [pid 44652:tid 44711] [client 85.203.21.4:64809] [client 85.203.21.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/configYFW/about.php"] [unique_id "aSI-MNiQFwsyXQDhwyDiMAAAAQU"]
[Sun Nov 23 06:50:24.945034 2025] [:error] [pid 38739:tid 38786] [client 85.203.21.68:45321] [client 85.203.21.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/css.php"] [unique_id "aSI-MAdvEgJm2n2cDmoj0gAAAFE"]
[Sun Nov 23 06:50:25.122098 2025] [:error] [pid 38738:tid 38742] [client 85.203.21.7:62341] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/m.php"] [unique_id "aSI-MQytc6TL9XavPmPnLQAAAAA"]
[Sun Nov 23 06:50:25.303484 2025] [:error] [pid 44652:tid 44707] [client 85.203.21.2:58155] [client 85.203.21.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/option.php"] [unique_id "aSI-MdiQFwsyXQDhwyDiMwAAAQE"]
[Sun Nov 23 06:50:25.479424 2025] [:error] [pid 38824:tid 38844] [client 85.203.21.20:21535] [client 85.203.21.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/options-privacy-part.php"] [unique_id "aSI-MU8WZjXLvbHTHPfg1QAAANE"]
[Sun Nov 23 06:50:25.657535 2025] [:error] [pid 38824:tid 38835] [client 85.203.21.25:63999] [client 85.203.21.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/wp-conflg.php"] [unique_id "aSI-MU8WZjXLvbHTHPfg1wAAAMg"]
[Sun Nov 23 06:50:25.843208 2025] [:error] [pid 38739:tid 38783] [client 85.203.21.38:36393] [client 85.203.21.38] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/backuply/s.php"] [unique_id "aSI-MQdvEgJm2n2cDmoj1AAAAE4"]
[Sun Nov 23 06:50:26.023381 2025] [:error] [pid 38739:tid 38785] [client 85.203.21.17:36033] [client 85.203.21.17] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/chosen.php"] [unique_id "aSI-MgdvEgJm2n2cDmoj1QAAAFA"]
[Sun Nov 23 06:50:26.199641 2025] [:error] [pid 44652:tid 44728] [client 85.203.21.4:36927] [client 85.203.21.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/class-json.php"] [unique_id "aSI-MtiQFwsyXQDhwyDiNwAAARY"]
[Sun Nov 23 06:50:31.377746 2025] [:error] [pid 38738:tid 38750] [client 85.203.21.49:38193] [client 85.203.21.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/plugins/prv8.php"] [unique_id "aSI-Nwytc6TL9XavPmPnMwAAAAg"]
[Sun Nov 23 06:50:31.557613 2025] [:error] [pid 38738:tid 38757] [client 85.203.21.23:53289] [client 85.203.21.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/prv8.php"] [unique_id "aSI-Nwytc6TL9XavPmPnNQAAAA8"]
[Sun Nov 23 06:50:31.739763 2025] [:error] [pid 38739:tid 38769] [client 85.203.21.64:46413] [client 85.203.21.64] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/litespeed/about.php"] [unique_id "aSI-NwdvEgJm2n2cDmoj3QAAAEA"]
[Sun Nov 23 06:50:36.940050 2025] [:error] [pid 38739:tid 38781] [client 85.203.21.10:64431] [client 85.203.21.10] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/all-in-one-wp-migration/lib/vendor/about.php"] [unique_id "aSI-PAdvEgJm2n2cDmoj5QAAAEw"]
[Sun Nov 23 06:50:37.117007 2025] [:error] [pid 38738:tid 38752] [client 85.203.21.44:50337] [client 85.203.21.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/amp/src/Editor/about.php"] [unique_id "aSI-PQytc6TL9XavPmPnPQAAAAo"]
[Sun Nov 23 06:50:37.293565 2025] [:error] [pid 38739:tid 38784] [client 85.203.21.53:29823] [client 85.203.21.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/autoload_classmap.php"] [unique_id "aSI-PQdvEgJm2n2cDmoj5gAAAE8"]
[Sun Nov 23 06:50:37.491649 2025] [:error] [pid 38824:tid 38832] [client 85.203.21.27:48127] [client 85.203.21.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/carousel-slider/templates/loop/classwithtostring.php"] [unique_id "aSI-PU8WZjXLvbHTHPfg-gAAAMU"]
[Sun Nov 23 06:50:37.669585 2025] [:error] [pid 44652:tid 44712] [client 85.203.21.27:59139] [client 85.203.21.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/checkout-for-woocommerce/about.php"] [unique_id "aSI-PdiQFwsyXQDhwyDiTAAAAQY"]
[Sun Nov 23 06:50:37.846894 2025] [:error] [pid 38739:tid 38773] [client 85.203.21.49:32305] [client 85.203.21.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-forms/abc.php"] [unique_id "aSI-PQdvEgJm2n2cDmoj5wAAAEQ"]
[Sun Nov 23 06:50:38.022797 2025] [:error] [pid 38739:tid 38775] [client 85.203.21.55:38705] [client 85.203.21.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/elementor/core/frontend/render-modes/about.php"] [unique_id "aSI-PgdvEgJm2n2cDmoj6QAAAEY"]
[Sun Nov 23 06:50:38.200007 2025] [:error] [pid 38740:tid 38803] [client 85.203.21.18:59029] [client 85.203.21.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/elementor/modules/atomic-widgets/prop-types/transform/lock.php"] [unique_id "aSI-Pg13QPZSi6O8umWx4AAAAIc"]
[Sun Nov 23 06:50:38.377369 2025] [:error] [pid 44652:tid 44706] [client 85.203.21.13:28543] [client 85.203.21.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/elementor/modules/kit-elements-defaults/import-export-customization/lock.php"] [unique_id "aSI-PtiQFwsyXQDhwyDiTQAAAQA"]
[Sun Nov 23 06:50:38.553514 2025] [:error] [pid 38740:tid 38807] [client 85.203.21.51:49029] [client 85.203.21.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/essential-addons-for-elementor-lite/assets/front-end/css/lib-view/code-snippet/lock.php"] [unique_id "aSI-Pg13QPZSi6O8umWx4QAAAIs"]
[Sun Nov 23 06:50:38.735581 2025] [:error] [pid 38740:tid 38813] [client 85.203.21.21:34803] [client 85.203.21.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/foter.php"] [unique_id "aSI-Pg13QPZSi6O8umWx4wAAAJE"]
[Sun Nov 23 06:50:38.917745 2025] [:error] [pid 38738:tid 38762] [client 85.203.21.9:40503] [client 85.203.21.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/new.php"] [unique_id "aSI-Pgytc6TL9XavPmPnQAAAABQ"]
[Sun Nov 23 06:50:39.097672 2025] [:error] [pid 38740:tid 38819] [client 85.203.21.48:43765] [client 85.203.21.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/nodeinfo/theme.php"] [unique_id "aSI-Pw13QPZSi6O8umWx5wAAAJc"]
[Sun Nov 23 06:50:39.275459 2025] [:error] [pid 44652:tid 44719] [client 85.203.21.49:61119] [client 85.203.21.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/nux.php"] [unique_id "aSI-P9iQFwsyXQDhwyDiUAAAAQ0"]
[Sun Nov 23 06:50:39.455979 2025] [:error] [pid 44652:tid 44722] [client 85.203.21.4:45905] [client 85.203.21.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/quadmenu/assets/frontend/icons/fontawesome/css/lock.php"] [unique_id "aSI-P9iQFwsyXQDhwyDiUQAAARA"]
[Sun Nov 23 06:50:39.633706 2025] [:error] [pid 38739:tid 38771] [client 85.203.21.36:44829] [client 85.203.21.36] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/quadmenu/redux/ReduxCore/inc/themecheck/checks/lock.php"] [unique_id "aSI-PwdvEgJm2n2cDmoj7QAAAEI"]
[Sun Nov 23 06:50:39.822173 2025] [:error] [pid 38739:tid 38774] [client 85.203.21.56:36645] [client 85.203.21.56] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/really-simple-ssl/lets-encrypt/integrations/admin.php"] [unique_id "aSI-PwdvEgJm2n2cDmoj8gAAAEU"]
[Sun Nov 23 06:50:40.005210 2025] [:error] [pid 38739:tid 38781] [client 85.203.21.48:38831] [client 85.203.21.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/royal-elementor-addons/modules/theme-builder/post-navigation/widgets/lock.php"] [unique_id "aSI-QAdvEgJm2n2cDmoj8wAAAEw"]
[Sun Nov 23 06:50:40.187251 2025] [:error] [pid 38740:tid 38805] [client 85.203.21.30:63911] [client 85.203.21.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/toxkssp/index.php"] [unique_id "aSI-QA13QPZSi6O8umWx7AAAAIk"]
[Sun Nov 23 06:50:40.368467 2025] [:error] [pid 38740:tid 38808] [client 85.203.21.2:59845] [client 85.203.21.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce-advanced-bulk-edit/about.php"] [unique_id "aSI-QA13QPZSi6O8umWx7wAAAIw"]
[Sun Nov 23 06:50:40.546670 2025] [:error] [pid 38740:tid 38800] [client 85.203.21.46:23983] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wophq/index.php"] [unique_id "aSI-QA13QPZSi6O8umWx8gAAAIQ"]
[Sun Nov 23 06:50:40.725090 2025] [:error] [pid 44652:tid 44714] [client 85.203.21.4:45201] [client 85.203.21.4] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/src/user-profiles-additions/about.php"] [unique_id "aSI-QNiQFwsyXQDhwyDiVQAAAQg"]
[Sun Nov 23 06:50:40.901731 2025] [:error] [pid 44652:tid 44709] [client 85.203.21.27:27141] [client 85.203.21.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/src/wrappers/about.php"] [unique_id "aSI-QNiQFwsyXQDhwyDiVgAAAQM"]
[Sun Nov 23 06:50:41.078892 2025] [:error] [pid 38738:tid 38747] [client 85.203.21.47:39513] [client 85.203.21.47] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-all-import-pro/addon-api/about.php"] [unique_id "aSI-QQytc6TL9XavPmPnRAAAAAU"]
[Sun Nov 23 06:50:41.259609 2025] [:error] [pid 38739:tid 38772] [client 85.203.21.11:41401] [client 85.203.21.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wpvivid-backup-mainwp/vendor/psr/cache/lock.php"] [unique_id "aSI-QQdvEgJm2n2cDmoj9wAAAEM"]
[Sun Nov 23 06:50:41.440699 2025] [:error] [pid 38740:tid 38812] [client 85.203.21.6:26207] [client 85.203.21.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/botticelli/content-index.php"] [unique_id "aSI-QQ13QPZSi6O8umWx9gAAAJA"]
[Sun Nov 23 06:50:41.617511 2025] [:error] [pid 44652:tid 44711] [client 85.203.21.21:47121] [client 85.203.21.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/chosen.php"] [unique_id "aSI-QdiQFwsyXQDhwyDiVwAAAQU"]
[Sun Nov 23 06:50:41.796185 2025] [:error] [pid 38824:tid 38836] [client 85.203.21.2:31807] [client 85.203.21.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/edit.php"] [unique_id "aSI-QU8WZjXLvbHTHPfg_QAAAMk"]
[Sun Nov 23 06:50:41.977384 2025] [:error] [pid 38739:tid 38769] [client 85.203.21.22:22577] [client 85.203.21.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/flatsome-child/images/about.php"] [unique_id "aSI-QQdvEgJm2n2cDmoj-QAAAEA"]
[Sun Nov 23 06:50:42.153587 2025] [:error] [pid 38738:tid 38756] [client 85.203.21.48:43135] [client 85.203.21.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/flatsome/inc/builder/shortcodes/commons/lock.php"] [unique_id "aSI-Qgytc6TL9XavPmPnSAAAAA4"]
[Sun Nov 23 06:50:42.331926 2025] [:error] [pid 38824:tid 38847] [client 85.203.21.64:46617] [client 85.203.21.64] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/flex-multi-business/inc/zBaLeMDx.php"] [unique_id "aSI-Qk8WZjXLvbHTHPfhAAAAANQ"]
[Sun Nov 23 06:50:42.510874 2025] [:error] [pid 38738:tid 38752] [client 85.203.21.43:37231] [client 85.203.21.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/intime/assets/index.php"] [unique_id "aSI-Qgytc6TL9XavPmPnSQAAAAo"]
[Sun Nov 23 06:50:42.688757 2025] [:error] [pid 38738:tid 38745] [client 85.203.21.30:46237] [client 85.203.21.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/libero/autoload_classmap.php"] [unique_id "aSI-Qgytc6TL9XavPmPnSgAAAAM"]
[Sun Nov 23 06:50:42.866489 2025] [:error] [pid 38739:tid 38770] [client 85.203.21.53:21007] [client 85.203.21.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/maxwin88/inc/metabox/extend-metabox/lock.php"] [unique_id "aSI-QgdvEgJm2n2cDmoj-wAAAEE"]
[Sun Nov 23 06:50:43.045393 2025] [:error] [pid 38738:tid 38746] [client 85.203.21.53:33155] [client 85.203.21.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/popularfx/template-parts/index.php"] [unique_id "aSI-Qwytc6TL9XavPmPnTQAAAAQ"]
[Sun Nov 23 06:50:43.231957 2025] [:error] [pid 38824:tid 38846] [client 85.203.21.63:53453] [client 85.203.21.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/rockwell/content-index.php"] [unique_id "aSI-Q08WZjXLvbHTHPfhAQAAANM"]
[Sun Nov 23 06:50:43.409439 2025] [:error] [pid 38738:tid 38753] [client 85.203.21.20:38323] [client 85.203.21.20] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/rubens-child/content-index.php"] [unique_id "aSI-Qwytc6TL9XavPmPnTwAAAAs"]
[Sun Nov 23 06:50:43.587415 2025] [:error] [pid 38740:tid 38808] [client 85.203.21.6:40831] [client 85.203.21.6] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/ryan/admin/main/inc/callbacks/sanitize_callback/select_faicons/lock.php"] [unique_id "aSI-Qw13QPZSi6O8umWyAAAAAIw"]
[Sun Nov 23 06:50:43.767392 2025] [:error] [pid 38740:tid 38800] [client 85.203.21.23:50315] [client 85.203.21.23] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/siara-corporate-business/template-parts/header/styles/lock.php"] [unique_id "aSI-Qw13QPZSi6O8umWyAgAAAIQ"]
[Sun Nov 23 06:50:43.944240 2025] [:error] [pid 38738:tid 38754] [client 85.203.21.55:62447] [client 85.203.21.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/theme-check/new.php"] [unique_id "aSI-Qwytc6TL9XavPmPnUgAAAAw"]
[Sun Nov 23 06:50:49.120119 2025] [:error] [pid 38739:tid 38780] [client 85.203.21.25:42667] [client 85.203.21.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyone/assets/sass/05-blocks/latest-comments/poisontalk.php"] [unique_id "aSI-SQdvEgJm2n2cDmokBQAAAEs"]
[Sun Nov 23 06:50:49.298166 2025] [:error] [pid 38824:tid 38839] [client 85.203.21.14:54297] [client 85.203.21.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentythree/assets/about.php"] [unique_id "aSI-SU8WZjXLvbHTHPfhCQAAAMw"]
[Sun Nov 23 06:50:54.477566 2025] [:error] [pid 38738:tid 38762] [client 85.203.21.55:35077] [client 85.203.21.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/assets/index.php"] [unique_id "aSI-Tgytc6TL9XavPmPnZQAAABQ"]
[Sun Nov 23 06:50:54.656038 2025] [:error] [pid 38739:tid 38786] [client 85.203.21.68:43929] [client 85.203.21.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/acxx.php"] [unique_id "aSI-TgdvEgJm2n2cDmokEQAAAFE"]
[Sun Nov 23 06:50:54.834501 2025] [:error] [pid 38738:tid 38765] [client 85.203.21.37:33943] [client 85.203.21.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/mlex.php"] [unique_id "aSI-Tgytc6TL9XavPmPnZwAAABc"]
[Sun Nov 23 06:50:55.011227 2025] [:error] [pid 38740:tid 38817] [client 85.203.21.7:26529] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/plex1.php"] [unique_id "aSI-Tw13QPZSi6O8umWyFQAAAJU"]
[Sun Nov 23 06:50:55.192942 2025] [:error] [pid 38739:tid 38789] [client 85.203.21.12:27399] [client 85.203.21.12] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-contentar458/themes/ingenioso/front-page/index.php"] [unique_id "aSI-TwdvEgJm2n2cDmokFQAAAFQ"]
[Sun Nov 23 06:50:55.369478 2025] [:error] [pid 38824:tid 38828] [client 85.203.21.44:46593] [client 85.203.21.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-cron-backup.php"] [unique_id "aSI-T08WZjXLvbHTHPfhDgAAAME"]
[Sun Nov 23 06:50:55.548311 2025] [:error] [pid 38740:tid 38799] [client 85.203.21.11:42501] [client 85.203.21.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-erros.php"] [unique_id "aSI-Tw13QPZSi6O8umWyFgAAAIM"]
[Sun Nov 23 06:50:55.725878 2025] [:error] [pid 38738:tid 38744] [client 85.203.21.6:50097] [client 85.203.21.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aSI-Twytc6TL9XavPmPnagAAAAI"]
[Sun Nov 23 06:50:55.912887 2025] [:error] [pid 38824:tid 38832] [client 85.203.21.12:20239] [client 85.203.21.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aSI-T08WZjXLvbHTHPfhDwAAAMU"]
[Sun Nov 23 06:50:56.089830 2025] [:error] [pid 38824:tid 38834] [client 85.203.21.23:27791] [client 85.203.21.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Exception/about.php"] [unique_id "aSI-UE8WZjXLvbHTHPfhEAAAAMc"]
[Sun Nov 23 06:50:56.270794 2025] [:error] [pid 38740:tid 38811] [client 85.203.21.63:26827] [client 85.203.21.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/lock.php"] [unique_id "aSI-UA13QPZSi6O8umWyGAAAAI8"]
[Sun Nov 23 06:50:56.449960 2025] [:error] [pid 44652:tid 44719] [client 85.203.21.64:42451] [client 85.203.21.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/library/SimplePie/Net/index.php"] [unique_id "aSI-UNiQFwsyXQDhwyDigAAAAQ0"]
[Sun Nov 23 06:50:56.627784 2025] [:error] [pid 44652:tid 44722] [client 85.203.21.9:21607] [client 85.203.21.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aSI-UNiQFwsyXQDhwyDigQAAARA"]
[Sun Nov 23 06:50:56.804380 2025] [:error] [pid 38738:tid 38766] [client 85.203.21.15:46181] [client 85.203.21.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aSI-UAytc6TL9XavPmPnawAAABg"]
[Sun Nov 23 06:50:56.995735 2025] [:error] [pid 44652:tid 44710] [client 85.203.21.56:31291] [client 85.203.21.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/chosen.php"] [unique_id "aSI-UNiQFwsyXQDhwyDigwAAAQQ"]
[Sun Nov 23 06:50:57.180313 2025] [:error] [pid 38739:tid 38785] [client 85.203.21.2:34607] [client 85.203.21.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/connects.php"] [unique_id "aSI-UQdvEgJm2n2cDmokGgAAAFA"]
[Sun Nov 23 06:50:57.357948 2025] [:error] [pid 38824:tid 38838] [client 85.203.21.7:46417] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/v.php"] [unique_id "aSI-UU8WZjXLvbHTHPfhEwAAAMs"]
[Sun Nov 23 06:50:57.535636 2025] [:error] [pid 38824:tid 38848] [client 85.203.21.4:55205] [client 85.203.21.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/chosen.php"] [unique_id "aSI-UU8WZjXLvbHTHPfhFAAAANU"]
[Sun Nov 23 06:50:57.713648 2025] [:error] [pid 44652:tid 44709] [client 85.203.21.15:37083] [client 85.203.21.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/code/"] [unique_id "aSI-UdiQFwsyXQDhwyDihQAAAQM"]
[Sun Nov 23 06:50:57.891512 2025] [:error] [pid 38739:tid 38772] [client 85.203.21.20:45271] [client 85.203.21.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/column/index.php"] [unique_id "aSI-UQdvEgJm2n2cDmokHAAAAEM"]
[Sun Nov 23 06:50:58.066592 2025] [:error] [pid 38738:tid 38742] [client 85.203.21.38:59501] [client 85.203.21.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comment-content/about.php"] [unique_id "aSI-Ugytc6TL9XavPmPnbwAAAAA"]
[Sun Nov 23 06:50:58.248279 2025] [:error] [pid 38739:tid 38783] [client 85.203.21.5:37113] [client 85.203.21.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/details/wp-wlx.php"] [unique_id "aSI-UgdvEgJm2n2cDmokHgAAAE4"]
[Sun Nov 23 06:50:58.426531 2025] [:error] [pid 38738:tid 38756] [client 85.203.21.47:22537] [client 85.203.21.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/file/index.php"] [unique_id "aSI-Ugytc6TL9XavPmPncAAAAA4"]
[Sun Nov 23 06:50:58.604559 2025] [:error] [pid 38739:tid 38780] [client 85.203.21.59:21025] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/group/index.php"] [unique_id "aSI-UgdvEgJm2n2cDmokIgAAAEs"]
[Sun Nov 23 06:50:58.781699 2025] [:error] [pid 38738:tid 38745] [client 85.203.21.37:57005] [client 85.203.21.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "aSI-Ugytc6TL9XavPmPncgAAAAM"]
[Sun Nov 23 06:50:58.958715 2025] [:error] [pid 38824:tid 38836] [client 85.203.21.20:21455] [client 85.203.21.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/media-text-double.php"] [unique_id "aSI-Uk8WZjXLvbHTHPfhFQAAAMk"]
[Sun Nov 23 06:50:59.136106 2025] [:error] [pid 38738:tid 38762] [client 85.203.21.29:28655] [client 85.203.21.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/media-text/about.php"] [unique_id "aSI-Uwytc6TL9XavPmPncwAAABQ"]
[Sun Nov 23 06:50:59.313143 2025] [:error] [pid 44652:tid 44727] [client 85.203.21.14:52881] [client 85.203.21.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/missing/index.php"] [unique_id "aSI-U9iQFwsyXQDhwyDiiQAAARU"]
[Sun Nov 23 06:50:59.491497 2025] [:error] [pid 38740:tid 38801] [client 85.203.21.8:32681] [client 85.203.21.8] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/page-list-item/"] [unique_id "aSI-Uw13QPZSi6O8umWyHQAAAIU"]
[Sun Nov 23 06:50:59.669372 2025] [:error] [pid 38739:tid 38779] [client 85.203.21.18:48719] [client 85.203.21.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-comments-form/index.php"] [unique_id "aSI-UwdvEgJm2n2cDmokJAAAAEo"]
[Sun Nov 23 06:50:59.848222 2025] [:error] [pid 38739:tid 38776] [client 85.203.21.38:58673] [client 85.203.21.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-excerpt/index.php"] [unique_id "aSI-UwdvEgJm2n2cDmokJQAAAEc"]
[Sun Nov 23 06:51:00.029977 2025] [:error] [pid 38740:tid 38798] [client 85.203.21.36:47617] [client 85.203.21.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-navigation-link/admin.php"] [unique_id "aSI-VA13QPZSi6O8umWyHwAAAII"]
[Sun Nov 23 06:51:00.221594 2025] [:error] [pid 44652:tid 44706] [client 85.203.21.30:27983] [client 85.203.21.30] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-terms/"] [unique_id "aSI-VNiQFwsyXQDhwyDiiwAAAQA"]
[Sun Nov 23 06:51:00.408565 2025] [:error] [pid 38824:tid 38847] [client 85.203.21.53:28775] [client 85.203.21.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/pullquote/"] [unique_id "aSI-VE8WZjXLvbHTHPfhGAAAANQ"]
[Sun Nov 23 06:51:00.587795 2025] [:error] [pid 38824:tid 38844] [client 85.203.21.43:46471] [client 85.203.21.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/query-pagination-previous/about.php"] [unique_id "aSI-VE8WZjXLvbHTHPfhGQAAANE"]
[Sun Nov 23 06:51:00.884585 2025] [:error] [pid 38824:tid 38846] [client 85.203.21.29:62083] [client 85.203.21.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/shortcode/index.php"] [unique_id "aSI-VE8WZjXLvbHTHPfhGgAAANM"]
[Sun Nov 23 06:51:01.068458 2025] [:error] [pid 44652:tid 44724] [client 85.203.21.49:20191] [client 85.203.21.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/site-logo/about.php"] [unique_id "aSI-VdiQFwsyXQDhwyDijwAAARI"]
[Sun Nov 23 06:51:01.245741 2025] [:error] [pid 38740:tid 38796] [client 85.203.21.53:41431] [client 85.203.21.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/site-tagline/"] [unique_id "aSI-VQ13QPZSi6O8umWyIgAAAIA"]
[Sun Nov 23 06:51:01.425912 2025] [:error] [pid 38824:tid 38827] [client 85.203.21.59:55347] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/social-links/"] [unique_id "aSI-VU8WZjXLvbHTHPfhGwAAAMA"]
[Sun Nov 23 06:51:01.604809 2025] [:error] [pid 38738:tid 38747] [client 85.203.21.62:57137] [client 85.203.21.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/spacer/about.php"] [unique_id "aSI-VQytc6TL9XavPmPneQAAAAU"]
[Sun Nov 23 06:51:01.783959 2025] [:error] [pid 38738:tid 38755] [client 85.203.21.59:46373] [client 85.203.21.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/index.php"] [unique_id "aSI-VQytc6TL9XavPmPnegAAAA0"]
[Sun Nov 23 06:51:01.965348 2025] [:error] [pid 38824:tid 38851] [client 85.203.21.21:63803] [client 85.203.21.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/tag-cloud/about.php"] [unique_id "aSI-VU8WZjXLvbHTHPfhHQAAANg"]
[Sun Nov 23 06:51:02.145049 2025] [:error] [pid 38824:tid 38849] [client 85.203.21.56:62531] [client 85.203.21.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/verse/about.php"] [unique_id "aSI-Vk8WZjXLvbHTHPfhHgAAANY"]
[Sun Nov 23 06:51:02.321300 2025] [:error] [pid 38824:tid 38831] [client 85.203.21.26:25639] [client 85.203.21.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/video/hexa.php"] [unique_id "aSI-Vk8WZjXLvbHTHPfhHwAAAMQ"]
[Sun Nov 23 06:51:02.498871 2025] [:error] [pid 38739:tid 38779] [client 85.203.21.11:23961] [client 85.203.21.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/plugin.php"] [unique_id "aSI-VgdvEgJm2n2cDmokMQAAAEo"]
[Sun Nov 23 06:51:02.677407 2025] [:error] [pid 38824:tid 38837] [client 85.203.21.56:56153] [client 85.203.21.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-image-editor-gd-pic.php"] [unique_id "aSI-Vk8WZjXLvbHTHPfhIQAAAMo"]
[Sun Nov 23 06:51:02.855180 2025] [:error] [pid 38739:tid 38771] [client 85.203.21.19:41089] [client 85.203.21.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aSI-VgdvEgJm2n2cDmokNQAAAEI"]
[Sun Nov 23 06:51:03.034098 2025] [:error] [pid 38824:tid 38839] [client 85.203.21.34:62107] [client 85.203.21.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "aSI-V08WZjXLvbHTHPfhIgAAAMw"]
[Sun Nov 23 06:51:03.211914 2025] [:error] [pid 38824:tid 38836] [client 85.203.21.24:65261] [client 85.203.21.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/commands/about.php"] [unique_id "aSI-V08WZjXLvbHTHPfhIwAAAMk"]
[Sun Nov 23 06:51:03.388047 2025] [:error] [pid 38740:tid 38816] [client 85.203.21.5:59657] [client 85.203.21.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-site/about.php"] [unique_id "aSI-Vw13QPZSi6O8umWyJAAAAJQ"]
[Sun Nov 23 06:51:03.571833 2025] [:error] [pid 38738:tid 38759] [client 85.203.21.30:37783] [client 85.203.21.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/index.php"] [unique_id "aSI-Vwytc6TL9XavPmPnfQAAABE"]
[Sun Nov 23 06:51:08.750300 2025] [:error] [pid 44652:tid 44711] [client 85.203.21.51:48815] [client 85.203.21.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/wp-conflg.php"] [unique_id "aSI-XNiQFwsyXQDhwyDilwAAAQU"]
[Sun Nov 23 06:51:08.929019 2025] [:error] [pid 38738:tid 38761] [client 85.203.21.43:58281] [client 85.203.21.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/autoload_classmap.php"] [unique_id "aSI-XAytc6TL9XavPmPnhwAAABM"]
[Sun Nov 23 06:51:09.107498 2025] [:error] [pid 38824:tid 38832] [client 85.203.21.67:55671] [client 85.203.21.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aSI-XU8WZjXLvbHTHPfhKwAAAMU"]
[Sun Nov 23 06:51:09.287804 2025] [:error] [pid 38738:tid 38763] [client 85.203.21.34:38655] [client 85.203.21.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "aSI-XQytc6TL9XavPmPniAAAABU"]
[Sun Nov 23 06:51:09.465589 2025] [:error] [pid 38824:tid 38831] [client 85.203.21.48:38219] [client 85.203.21.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/option.php"] [unique_id "aSI-XU8WZjXLvbHTHPfhLAAAAMQ"]
[Sun Nov 23 06:51:09.644942 2025] [:error] [pid 38824:tid 38837] [client 85.203.21.14:61961] [client 85.203.21.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aSI-XU8WZjXLvbHTHPfhLQAAAMo"]
[Sun Nov 23 06:51:09.827272 2025] [:error] [pid 38738:tid 38759] [client 85.203.21.18:42005] [client 85.203.21.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/wrvpmsi/about.php"] [unique_id "aSI-XQytc6TL9XavPmPniwAAABE"]
[Sun Nov 23 06:51:10.005181 2025] [:error] [pid 38824:tid 38843] [client 85.203.21.25:27615] [client 85.203.21.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aSI-Xk8WZjXLvbHTHPfhLwAAANA"]
[Sun Nov 23 06:51:10.183383 2025] [:error] [pid 38738:tid 38765] [client 85.203.21.43:59409] [client 85.203.21.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aSI-Xgytc6TL9XavPmPnjwAAABc"]
[Sun Nov 23 06:51:10.360647 2025] [:error] [pid 38824:tid 38835] [client 85.203.21.25:24167] [client 85.203.21.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/interactivity-api/autoload_classmap.php"] [unique_id "aSI-Xk8WZjXLvbHTHPfhMAAAAMg"]
[Sun Nov 23 06:51:10.539105 2025] [:error] [pid 38824:tid 38850] [client 85.203.21.11:57631] [client 85.203.21.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/autoload_classmap.php"] [unique_id "aSI-Xk8WZjXLvbHTHPfhMQAAANc"]
[Sun Nov 23 06:51:10.716891 2025] [:error] [pid 38740:tid 38810] [client 85.203.21.67:58017] [client 85.203.21.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/about.php"] [unique_id "aSI-Xg13QPZSi6O8umWyOAAAAI4"]
[Sun Nov 23 06:51:10.894706 2025] [:error] [pid 38738:tid 38760] [client 85.203.21.42:43023] [client 85.203.21.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/development/"] [unique_id "aSI-Xgytc6TL9XavPmPnkQAAABI"]
[Sun Nov 23 06:51:11.071082 2025] [:error] [pid 44652:tid 44728] [client 85.203.21.38:43193] [client 85.203.21.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/script-modules/block-library/query/index.php"] [unique_id "aSI-X9iQFwsyXQDhwyDioQAAARY"]
[Sun Nov 23 06:51:11.250921 2025] [:error] [pid 38740:tid 38803] [client 85.203.21.46:63893] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/imgareaselect/index.php"] [unique_id "aSI-Xw13QPZSi6O8umWyOgAAAIc"]
[Sun Nov 23 06:51:11.428062 2025] [:error] [pid 44652:tid 44720] [client 85.203.21.48:41579] [client 85.203.21.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aSI-X9iQFwsyXQDhwyDiogAAAQ4"]
[Sun Nov 23 06:51:11.604641 2025] [:error] [pid 38740:tid 38804] [client 85.203.21.14:24003] [client 85.203.21.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/mediaelement/admin.php"] [unique_id "aSI-Xw13QPZSi6O8umWyOwAAAIg"]
[Sun Nov 23 06:51:11.782910 2025] [:error] [pid 44652:tid 44721] [client 85.203.21.17:49935] [client 85.203.21.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/mediaelement/renderers/about.php"] [unique_id "aSI-X9iQFwsyXQDhwyDipQAAAQ8"]
[Sun Nov 23 06:51:11.958669 2025] [:error] [pid 44652:tid 44718] [client 85.203.21.47:38285] [client 85.203.21.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/thickbox/index.php"] [unique_id "aSI-X9iQFwsyXQDhwyDipgAAAQw"]
[Sun Nov 23 06:51:12.136632 2025] [:error] [pid 38739:tid 38769] [client 85.203.21.42:45099] [client 85.203.21.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/chosen.php"] [unique_id "aSI-YAdvEgJm2n2cDmokOQAAAEA"]
[Sun Nov 23 06:51:12.314095 2025] [:error] [pid 38739:tid 38789] [client 85.203.21.15:32293] [client 85.203.21.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/link-template-variable.php"] [unique_id "aSI-YAdvEgJm2n2cDmokOgAAAFQ"]
[Sun Nov 23 06:51:12.491202 2025] [:error] [pid 44652:tid 44727] [client 85.203.21.12:21993] [client 85.203.21.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/php-compat/wp-conflg.php"] [unique_id "aSI-YNiQFwsyXQDhwyDiqAAAARU"]
[Sun Nov 23 06:51:12.668440 2025] [:error] [pid 38738:tid 38747] [client 85.203.21.27:42171] [client 85.203.21.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aSI-YAytc6TL9XavPmPnlAAAAAU"]
[Sun Nov 23 06:51:17.844279 2025] [:error] [pid 38739:tid 38783] [client 85.203.21.6:59751] [client 85.203.21.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/wp-conflg.php"] [unique_id "aSI-ZQdvEgJm2n2cDmokRQAAAE4"]
[Sun Nov 23 06:51:23.021735 2025] [:error] [pid 44652:tid 44724] [client 85.203.21.2:51143] [client 85.203.21.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/alfa.php"] [unique_id "aSI-a9iQFwsyXQDhwyDiuQAAARI"]
[Sun Nov 23 06:51:23.200333 2025] [:error] [pid 44652:tid 44723] [client 85.203.21.14:34849] [client 85.203.21.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aSI-a9iQFwsyXQDhwyDiugAAARE"]
[Sun Nov 23 06:51:23.379023 2025] [:error] [pid 44652:tid 44728] [client 85.203.21.34:54403] [client 85.203.21.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-login.php"] [unique_id "aSI-a9iQFwsyXQDhwyDivAAAARY"]
[Sun Nov 23 06:51:23.556790 2025] [:error] [pid 38738:tid 38745] [client 85.203.21.7:61213] [client 85.203.21.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xax.php"] [unique_id "aSI-awytc6TL9XavPmPnrwAAAAM"]
[Sun Nov 23 06:51:23.737449 2025] [:error] [pid 38738:tid 38742] [client 85.203.21.46:31781] [client 85.203.21.46] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xax.php"] [unique_id "aSI-awytc6TL9XavPmPnsAAAAAA"]
[Sun Nov 23 06:51:30.764270 2025] [:error] [pid 38740:tid 38816] [client 173.239.254.74:35097] [client 173.239.254.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.74, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSI-cg13QPZSi6O8umWyeAAAAJQ"]
[Sun Nov 23 07:07:01.630152 2025] [:error] [pid 38824:tid 38846] [client 173.239.254.63:35221] [client 173.239.254.63] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.63, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSJCFU8WZjXLvbHTHPfnsgAAANM"]
[Sun Nov 23 07:18:54.042234 2025] [:error] [pid 44652:tid 44712] [client 173.252.167.150:55662] [client 173.252.167.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.252.167.150, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSJE3tiQFwsyXQDhwyDuFQAAAQY"]
[Sun Nov 23 07:27:04.365131 2025] [:error] [pid 44652:tid 44716] [client 188.34.161.164:56228] [client 188.34.161.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.34.161.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSJGyNiQFwsyXQDhwyDxvgAAAQo"]
[Sun Nov 23 07:36:22.881837 2025] [:error] [pid 38824:tid 38832] [client 193.37.33.247:59519] [client 193.37.33.247] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.33.247, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSJI9k8WZjXLvbHTHPfypQAAAMU"]
[Sun Nov 23 07:49:59.725108 2025] [:error] [pid 38739:tid 38782] [client 173.239.254.76:33101] [client 173.239.254.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.76, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSJMJwdvEgJm2n2cDmpDLwAAAE0"]
[Sun Nov 23 08:03:10.178238 2025] [:error] [pid 38738:tid 38748] [client 173.239.254.79:59131] [client 173.239.254.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.79, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSJPPgytc6TL9XavPmMF_QAAAAY"]
[Sun Nov 23 08:04:05.293741 2025] [:error] [pid 44652:tid 44714] [client 52.40.26.157:55194] [client 52.40.26.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.40.26.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSJPddiQFwsyXQDhwyD9YwAAAQg"]
[Sun Nov 23 08:16:18.759952 2025] [:error] [pid 38740:tid 38810] [client 173.239.254.46:33739] [client 173.239.254.46] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.46, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSJSUg13QPZSi6O8umXP_AAAAI4"]
[Sun Nov 23 08:31:29.080110 2025] [:error] [pid 38738:tid 38761] [client 173.239.254.80:45213] [client 173.239.254.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSJV4Qytc6TL9XavPmMQOQAAABM"]
[Sun Nov 23 08:38:00.195980 2025] [:error] [pid 38824:tid 38845] [client 64.31.40.162:57682] [client 64.31.40.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.31.40.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSJXaE8WZjXLvbHTHPcF_QAAANI"]
[Sun Nov 23 08:41:16.699078 2025] [:error] [pid 44652:tid 44717] [client 91.219.84.32:56482] [client 91.219.84.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.219.84.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSJYLNiQFwsyXQDhwyAIswAAAQs"]
[Sun Nov 23 08:44:21.316733 2025] [:error] [pid 38739:tid 38780] [client 173.239.254.75:50713] [client 173.239.254.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.75, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSJY5QdvEgJm2n2cDmpeZQAAAEs"]
[Sun Nov 23 08:49:53.082490 2025] [:error] [pid 38738:tid 38748] [client 151.106.48.162:49336] [client 151.106.48.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 151.106.48.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSJaMQytc6TL9XavPmMYSAAAAAY"]
[Sun Nov 23 09:09:42.378032 2025] [:error] [pid 38738:tid 38752] [client 173.239.254.56:28527] [client 173.239.254.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.56, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSJe1gytc6TL9XavPmMfmAAAAAo"]
[Sun Nov 23 09:18:49.741676 2025] [:error] [pid 44652:tid 44708] [client 94.102.211.121:35532] [client 94.102.211.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.102.211.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSJg-diQFwsyXQDhwyATjgAAAQI"]
[Sun Nov 23 09:22:26.364678 2025] [:error] [pid 38738:tid 38748] [client 85.8.130.40:39715] [client 85.8.130.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.40, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSJh0gytc6TL9XavPmMkBgAAAAY"]
[Sun Nov 23 09:32:49.957824 2025] [:error] [pid 44652:tid 44723] [client 45.138.16.215:51821] [client 45.138.16.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/postnews.php"] [unique_id "aSJkQdiQFwsyXQDhwyAY9gAAARE"]
[Sun Nov 23 09:32:50.491499 2025] [:error] [pid 38740:tid 38801] [client 45.138.16.215:51871] [client 45.138.16.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/postnews.php"] [unique_id "aSJkQg13QPZSi6O8umXoYwAAAIU"]
[Sun Nov 23 09:32:51.019804 2025] [:error] [pid 38738:tid 38743] [client 45.138.16.215:51907] [client 45.138.16.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/postnews.php"] [unique_id "aSJkQwytc6TL9XavPmMn6AAAAAE"]
[Sun Nov 23 09:35:38.499871 2025] [:error] [pid 38824:tid 38844] [client 54.226.125.235:38578] [client 54.226.125.235] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aSJk6k8WZjXLvbHTHPcZ7QAAANE"]
[Sun Nov 23 09:47:42.903874 2025] [:error] [pid 38824:tid 38849] [client 173.239.254.55:58703] [client 173.239.254.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.55, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSJnvk8WZjXLvbHTHPccmgAAANY"]
[Sun Nov 23 10:02:35.498979 2025] [:error] [pid 38740:tid 38806] [client 209.42.22.188:47546] [client 209.42.22.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.42.22.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSJrOw13QPZSi6O8umXw-AAAAIo"]
[Sun Nov 23 10:26:05.789493 2025] [:error] [pid 38740:tid 38807] [client 173.239.254.66:52421] [client 173.239.254.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.66, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSJwvQ13QPZSi6O8umX2SwAAAIs"]
[Sun Nov 23 10:40:14.293187 2025] [:error] [pid 38738:tid 38763] [client 45.77.32.106:50908] [client 45.77.32.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.77.32.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSJ0Dgytc6TL9XavPmM9JgAAABU"]
[Sun Nov 23 10:51:41.872188 2025] [:error] [pid 44652:tid 44714] [client 173.239.254.68:49589] [client 173.239.254.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSJ2vdiQFwsyXQDhwyAstQAAAQg"]
[Sun Nov 23 11:03:22.411285 2025] [:error] [pid 38824:tid 38845] [client 142.93.225.152:61672] [client 142.93.225.152] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.93.225.152, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSJ5ek8WZjXLvbHTHPcxyQAAANI"]
[Sun Nov 23 11:19:02.259033 2025] [:error] [pid 38739:tid 38777] [client 144.217.252.106:33864] [client 144.217.252.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.217.252.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSJ9JgdvEgJm2n2cDmqg9wAAAEg"]
[Sun Nov 23 11:30:10.237564 2025] [:error] [pid 38739:tid 38780] [client 85.8.130.41:31673] [client 85.8.130.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.41, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSJ_wgdvEgJm2n2cDmqlkQAAAEs"]
[Sun Nov 23 11:42:55.907132 2025] [:error] [pid 38824:tid 38831] [client 173.239.254.66:62713] [client 173.239.254.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.66, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSKCv08WZjXLvbHTHPc9QwAAAMQ"]
[Sun Nov 23 11:55:36.969285 2025] [:error] [pid 38824:tid 38851] [client 85.8.130.43:58021] [client 85.8.130.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSKFuE8WZjXLvbHTHPdA6AAAANg"]
[Sun Nov 23 12:01:12.860766 2025] [:error] [pid 38740:tid 38804] [client 5.189.165.17:57632] [client 5.189.165.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.189.165.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSKHCA13QPZSi6O8umURUAAAAIg"]
[Sun Nov 23 12:20:53.132166 2025] [:error] [pid 44652:tid 44709] [client 159.223.217.167:52586] [client 159.223.217.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.217.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSKLpdiQFwsyXQDhwyBDtAAAAQM"]
[Sun Nov 23 12:41:46.841133 2025] [:error] [pid 38739:tid 38786] [client 117.55.202.159:53242] [client 117.55.202.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.55.202.159, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSKQigdvEgJm2n2cDmq6bAAAAFE"]
[Sun Nov 23 13:12:31.280203 2025] [:error] [pid 38738:tid 38759] [client 173.239.254.65:47907] [client 173.239.254.65] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.65, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSKXvwytc6TL9XavPmN2wQAAABE"]
[Sun Nov 23 13:18:34.058545 2025] [:error] [pid 44652:tid 44725] [client 92.205.187.137:34228] [client 92.205.187.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.187.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSKZKtiQFwsyXQDhwyBSugAAARM"]
[Sun Nov 23 13:23:36.464202 2025] [:error] [pid 38824:tid 38841] [client 54.226.125.235:44302] [client 54.226.125.235] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aSKaWE8WZjXLvbHTHPdXVQAAAM4"]
[Sun Nov 23 13:25:25.453445 2025] [:error] [pid 44652:tid 44719] [client 173.239.254.64:64805] [client 173.239.254.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.64, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSKaxdiQFwsyXQDhwyBUigAAAQ0"]
[Sun Nov 23 13:50:59.363685 2025] [:error] [pid 44652:tid 44717] [client 173.239.254.56:46109] [client 173.239.254.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.56, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSKgw9iQFwsyXQDhwyBacAAAAQs"]
[Sun Nov 23 14:03:46.445767 2025] [:error] [pid 38824:tid 38851] [client 193.37.33.247:64587] [client 193.37.33.247] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.33.247, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSKjwk8WZjXLvbHTHPdhRwAAANg"]
[Sun Nov 23 14:16:27.282977 2025] [:error] [pid 44652:tid 44729] [client 193.37.33.248:37589] [client 193.37.33.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.33.248, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSKmu9iQFwsyXQDhwyBg2gAAARc"]
[Sun Nov 23 14:24:51.150732 2025] [:error] [pid 38824:tid 38839] [client 103.248.74.80:61687] [client 103.248.74.80] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aSKos08WZjXLvbHTHPdngQAAAMw"]
[Sun Nov 23 14:26:36.803999 2025] [:error] [pid 38740:tid 38796] [client 103.248.74.80:61641] [client 103.248.74.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.248.74.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSKpHA13QPZSi6O8umU-RQAAAIA"]
[Sun Nov 23 14:28:06.339724 2025] [:error] [pid 38824:tid 38839] [client 103.248.74.80:62962] [client 103.248.74.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.248.74.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSKpdk8WZjXLvbHTHPdobQAAAMw"]
[Sun Nov 23 14:29:10.136501 2025] [:error] [pid 38824:tid 38844] [client 173.239.254.63:25129] [client 173.239.254.63] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.63, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSKptk8WZjXLvbHTHPdo-AAAANE"]
[Sun Nov 23 14:29:39.580743 2025] [:error] [pid 38739:tid 38776] [client 103.248.74.80:62975] [client 103.248.74.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.248.74.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSKp0wdvEgJm2n2cDmracgAAAEc"]
[Sun Nov 23 14:31:13.480764 2025] [:error] [pid 38738:tid 38746] [client 103.248.74.80:62856] [client 103.248.74.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.248.74.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSKqMQytc6TL9XavPmOXCgAAAAQ"]
[Sun Nov 23 14:32:52.526375 2025] [:error] [pid 38738:tid 38753] [client 103.248.74.80:63139] [client 103.248.74.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.248.74.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSKqlAytc6TL9XavPmOXtAAAAAs"]
[Sun Nov 23 14:41:58.124130 2025] [:error] [pid 38738:tid 38757] [client 173.239.254.74:26759] [client 173.239.254.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.74, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSKstgytc6TL9XavPmOa9wAAAA8"]
[Sun Nov 23 14:42:51.837749 2025] [:error] [pid 38739:tid 38787] [client 15.235.141.194:58348] [client 15.235.141.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.141.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSKs6wdvEgJm2n2cDmreYAAAAFI"]
[Sun Nov 23 15:20:29.363291 2025] [:error] [pid 38738:tid 38755] [client 173.239.254.63:40141] [client 173.239.254.63] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.63, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSK1vQytc6TL9XavPmOqVgAAAA0"]
[Sun Nov 23 15:24:59.979287 2025] [:error] [pid 38739:tid 38787] [client 35.196.16.163:52819] [client 35.196.16.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.196.16.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSK2ywdvEgJm2n2cDmrpFgAAAFI"]
[Sun Nov 23 15:25:02.290671 2025] [:error] [pid 38739:tid 38779] [client 35.196.16.163:52819] [client 35.196.16.163] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aSK2zgdvEgJm2n2cDmrpGgAAAEo"]
[Sun Nov 23 15:25:02.499831 2025] [:error] [pid 38739:tid 38771] [client 35.196.16.163:52819] [client 35.196.16.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.196.16.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSK2zgdvEgJm2n2cDmrpGwAAAEI"]
[Sun Nov 23 15:25:03.917252 2025] [:error] [pid 38739:tid 38791] [client 35.196.16.163:52152] [client 35.196.16.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.196.16.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSK2zwdvEgJm2n2cDmrpHQAAAFY"]
[Sun Nov 23 15:25:05.410863 2025] [:error] [pid 38824:tid 38845] [client 35.196.16.163:65132] [client 35.196.16.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.196.16.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSK20U8WZjXLvbHTHPd2rwAAANI"]
[Sun Nov 23 15:25:06.976638 2025] [:error] [pid 38739:tid 38785] [client 35.196.16.163:55989] [client 35.196.16.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.196.16.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSK20gdvEgJm2n2cDmrpLwAAAFA"]
[Sun Nov 23 15:25:06.981152 2025] [:error] [pid 38739:tid 38785] [client 35.196.16.163:55989] [client 35.196.16.163] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/usr/local/apache/modsecurity-cwaf/rules/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 35.196.16.163 (+1 hits since last alert)|expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSK20gdvEgJm2n2cDmrpLwAAAFA"]
[Sun Nov 23 15:33:13.116564 2025] [:error] [pid 38738:tid 38746] [client 173.239.254.71:20689] [client 173.239.254.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSK4uQytc6TL9XavPmOvLQAAAAQ"]
[Sun Nov 23 15:36:10.197291 2025] [:error] [pid 38740:tid 38805] [client 34.58.6.134:51080] [client 34.58.6.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.58.6.134, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSK5ag13QPZSi6O8umVS9AAAAIk"]
[Sun Nov 23 15:36:13.137667 2025] [:error] [pid 38740:tid 38813] [client 34.58.6.134:51080] [client 34.58.6.134] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aSK5bQ13QPZSi6O8umVS-wAAAJE"]
[Sun Nov 23 15:36:13.349797 2025] [:error] [pid 38740:tid 38806] [client 34.58.6.134:51080] [client 34.58.6.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.58.6.134, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSK5bQ13QPZSi6O8umVS_QAAAIo"]
[Sun Nov 23 15:36:14.772140 2025] [:error] [pid 38740:tid 38816] [client 34.58.6.134:54299] [client 34.58.6.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.58.6.134, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSK5bg13QPZSi6O8umVTAAAAAJQ"]
[Sun Nov 23 15:36:14.776210 2025] [:error] [pid 38740:tid 38816] [client 34.58.6.134:54299] [client 34.58.6.134] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/usr/local/apache/modsecurity-cwaf/rules/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 34.58.6.134 (+1 hits since last alert)|expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSK5bg13QPZSi6O8umVTAAAAAJQ"]
[Sun Nov 23 15:45:54.411899 2025] [:error] [pid 38739:tid 38780] [client 173.239.254.45:48213] [client 173.239.254.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.45, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSK7sgdvEgJm2n2cDmrtVAAAAEs"]
[Sun Nov 23 16:04:53.667871 2025] [:error] [pid 38824:tid 38837] [client 37.60.237.82:60140] [client 37.60.237.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.60.237.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSLAJU8WZjXLvbHTHPd--QAAAMo"]
[Sun Nov 23 16:14:23.036509 2025] [:error] [pid 38739:tid 38785] [client 193.37.33.243:41989] [client 193.37.33.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.33.243, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSLCXwdvEgJm2n2cDmr1fwAAAFA"]
[Sun Nov 23 16:16:59.514131 2025] [:error] [pid 44652:tid 44722] [client 134.199.167.205:58339] [client 134.199.167.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.199.167.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSLC-9iQFwsyXQDhwyB-HwAAARA"]
[Sun Nov 23 16:17:00.175992 2025] [:error] [pid 38824:tid 38851] [client 134.199.167.205:49618] [client 134.199.167.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.199.167.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSLC_E8WZjXLvbHTHPeDRgAAANg"]
[Sun Nov 23 16:37:07.125176 2025] [:error] [pid 38739:tid 38782] [client 134.199.167.205:53255] [client 134.199.167.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.199.167.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSLHswdvEgJm2n2cDmoNOwAAAE0"]
[Sun Nov 23 16:44:23.671633 2025] [:error] [pid 38738:tid 38746] [client 140.99.1.39:61417] [client 140.99.1.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aSLJZwytc6TL9XavPmMCjAAAAAQ"]
[Sun Nov 23 16:45:00.904474 2025] [:error] [pid 38824:tid 38834] [client 134.199.167.205:64905] [client 134.199.167.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.199.167.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSLJjE8WZjXLvbHTHPe9uQAAAMc"]
[Sun Nov 23 16:45:30.259109 2025] [:error] [pid 16066:tid 16071] [client 85.186.88.250:33454] [client 85.186.88.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.186.88.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSLJqvq-c47Q5mW5E9F3FwAAAYI"]
[Sun Nov 23 16:46:50.223702 2025] [autoindex:error] [pid 38824:tid 38840] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:46:50.368100 2025] [autoindex:error] [pid 38824:tid 38850] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:46:50.493212 2025] [autoindex:error] [pid 38824:tid 38836] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:46:50.649279 2025] [autoindex:error] [pid 38824:tid 38851] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:46:59.556345 2025] [autoindex:error] [pid 38824:tid 38842] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:46:59.672023 2025] [autoindex:error] [pid 38824:tid 38830] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:46:59.896247 2025] [autoindex:error] [pid 38824:tid 38848] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:47:00.061484 2025] [autoindex:error] [pid 38824:tid 38834] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:47:00.260325 2025] [autoindex:error] [pid 38824:tid 38850] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:47:00.427270 2025] [autoindex:error] [pid 38824:tid 38845] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:47:00.764472 2025] [autoindex:error] [pid 38824:tid 38837] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:47:07.923376 2025] [autoindex:error] [pid 38824:tid 38843] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:47:08.034061 2025] [autoindex:error] [pid 38824:tid 38832] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:47:22.842474 2025] [autoindex:error] [pid 38824:tid 38832] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:47:22.976208 2025] [autoindex:error] [pid 38824:tid 38847] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:47:23.122648 2025] [autoindex:error] [pid 38824:tid 38834] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:47:23.264724 2025] [autoindex:error] [pid 38824:tid 38841] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:47:27.785239 2025] [autoindex:error] [pid 38824:tid 38845] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:47:27.994716 2025] [autoindex:error] [pid 38824:tid 38851] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:47:34.122034 2025] [autoindex:error] [pid 38824:tid 38850] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:47:42.635474 2025] [autoindex:error] [pid 38824:tid 38846] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:47:42.805455 2025] [autoindex:error] [pid 38824:tid 38842] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:47:42.946222 2025] [autoindex:error] [pid 38824:tid 38828] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:47:53.676770 2025] [autoindex:error] [pid 38824:tid 38841] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:48:04.685067 2025] [autoindex:error] [pid 38824:tid 38832] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:48:08.483602 2025] [autoindex:error] [pid 38824:tid 38828] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:48:08.688028 2025] [autoindex:error] [pid 38824:tid 38842] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:48:09.079986 2025] [autoindex:error] [pid 38824:tid 38849] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:48:09.302158 2025] [autoindex:error] [pid 38824:tid 38850] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:48:09.456594 2025] [autoindex:error] [pid 38824:tid 38832] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:48:22.458415 2025] [autoindex:error] [pid 38824:tid 38830] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:49:34.017290 2025] [autoindex:error] [pid 38824:tid 38851] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:49:34.123389 2025] [autoindex:error] [pid 38824:tid 38828] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:49:34.233345 2025] [autoindex:error] [pid 38824:tid 38841] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:49:34.366929 2025] [autoindex:error] [pid 38824:tid 38831] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:49:39.151341 2025] [autoindex:error] [pid 38824:tid 38851] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:49:39.247405 2025] [autoindex:error] [pid 38824:tid 38829] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:49:40.890157 2025] [autoindex:error] [pid 38824:tid 38831] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:49:43.182289 2025] [autoindex:error] [pid 38824:tid 38846] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:49:43.298430 2025] [autoindex:error] [pid 38824:tid 38845] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:49:43.479604 2025] [autoindex:error] [pid 38824:tid 38833] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:49:45.753822 2025] [autoindex:error] [pid 38824:tid 38838] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:49:45.870214 2025] [autoindex:error] [pid 38824:tid 38829] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:49:45.990764 2025] [autoindex:error] [pid 38824:tid 38849] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:49:46.136019 2025] [autoindex:error] [pid 38824:tid 38828] [client 140.99.1.17:44711] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:50:34.055568 2025] [autoindex:error] [pid 17534:tid 17539] [client 140.99.1.68:57597] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:50:53.609405 2025] [autoindex:error] [pid 17534:tid 17557] [client 140.99.1.68:57597] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:50:59.715040 2025] [autoindex:error] [pid 17534:tid 17539] [client 140.99.1.68:57597] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:50:59.918108 2025] [autoindex:error] [pid 17534:tid 17559] [client 140.99.1.68:57597] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:51:07.615213 2025] [autoindex:error] [pid 17534:tid 17558] [client 140.99.1.68:57597] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:51:07.712515 2025] [autoindex:error] [pid 17534:tid 17542] [client 140.99.1.68:57597] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:51:07.817184 2025] [autoindex:error] [pid 17534:tid 17549] [client 140.99.1.68:57597] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:51:07.931929 2025] [autoindex:error] [pid 17534:tid 17536] [client 140.99.1.68:57597] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:51:08.108774 2025] [autoindex:error] [pid 17534:tid 17551] [client 140.99.1.68:57597] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:51:08.276886 2025] [autoindex:error] [pid 17534:tid 17546] [client 140.99.1.68:57597] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:51:08.382064 2025] [autoindex:error] [pid 17534:tid 17557] [client 140.99.1.68:57597] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:51:08.513071 2025] [autoindex:error] [pid 17534:tid 17540] [client 140.99.1.68:57597] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:51:08.618920 2025] [autoindex:error] [pid 17534:tid 17554] [client 140.99.1.68:57597] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:51:34.987289 2025] [autoindex:error] [pid 17534:tid 17547] [client 140.99.1.68:57597] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 16:53:21.361189 2025] [:error] [pid 44652:tid 44710] [client 134.199.167.205:59005] [client 134.199.167.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.199.167.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSLLgdiQFwsyXQDhwyDSzQAAAQQ"]
[Sun Nov 23 17:33:00.260156 2025] [:error] [pid 38824:tid 38831] [client 212.227.169.22:41920] [client 212.227.169.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.227.169.22, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSLUzE8WZjXLvbHTHPffZgAAAMQ"]
[Sun Nov 23 18:11:21.941480 2025] [:error] [pid 44652:tid 44728] [client 45.151.217.191:34640] [client 45.151.217.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.151.217.191, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSLdydiQFwsyXQDhwyDu-AAAARY"]
[Sun Nov 23 18:58:14.385454 2025] [:error] [pid 17534:tid 17539] [client 91.245.210.195:51408] [client 91.245.210.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.245.210.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSLoxnPX9nXBrhgM8sx42QAAAcM"]
[Sun Nov 23 19:37:09.498632 2025] [:error] [pid 38824:tid 38841] [client 194.67.109.194:50048] [client 194.67.109.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.67.109.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSLx5U8WZjXLvbHTHPf1NgAAAM4"]
[Sun Nov 23 19:41:56.478860 2025] [:error] [pid 38739:tid 38786] [client 176.65.132.18:59922] [client 176.65.132.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aSLzBAdvEgJm2n2cDmptzQAAAFE"]
[Sun Nov 23 20:18:17.345564 2025] [:error] [pid 8036:tid 8061] [client 135.181.77.28:41924] [client 135.181.77.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 135.181.77.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSL7idBT69EcgFwgTmpkzQAAAg4"]
[Sun Nov 23 20:28:46.360829 2025] [autoindex:error] [pid 8036:tid 8051] [client 144.124.251.18:58179] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 20:28:47.431200 2025] [autoindex:error] [pid 8036:tid 8065] [client 144.124.251.18:58179] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 20:28:47.690995 2025] [autoindex:error] [pid 8036:tid 8068] [client 144.124.251.18:58179] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 20:28:47.955091 2025] [autoindex:error] [pid 8036:tid 8052] [client 144.124.251.18:58179] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 20:28:48.218021 2025] [autoindex:error] [pid 8036:tid 8063] [client 144.124.251.18:58179] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 20:28:50.631288 2025] [autoindex:error] [pid 8036:tid 8056] [client 144.124.251.18:58179] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentythree/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 20:28:55.039420 2025] [autoindex:error] [pid 8036:tid 8068] [client 144.124.251.18:58179] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/contact-form-7/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 20:28:56.103122 2025] [autoindex:error] [pid 8036:tid 8063] [client 144.124.251.18:58179] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Nov 23 21:03:05.855379 2025] [:error] [pid 8036:tid 8047] [client 91.189.127.4:36046] [client 91.189.127.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.189.127.4, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSMGCdBT69EcgFwgTmptkQAAAgA"]
[Sun Nov 23 21:08:41.262407 2025] [:error] [pid 38738:tid 38748] [client 64.31.40.162:53472] [client 64.31.40.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.31.40.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSMHWQytc6TL9XavPmNP7gAAAAY"]
[Sun Nov 23 21:46:58.550134 2025] [:error] [pid 16066:tid 16093] [client 109.199.108.120:33800] [client 109.199.108.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.199.108.120, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSMQUvq-c47Q5mW5E9HPLQAAAZg"]
[Sun Nov 23 21:53:09.304784 2025] [:error] [pid 8036:tid 8055] [client 139.59.37.240:55924] [client 139.59.37.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.59.37.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSMRxdBT69EcgFwgTmp7JwAAAgg"]
[Sun Nov 23 22:29:45.710052 2025] [:error] [pid 38824:tid 38851] [client 65.109.158.238:33990] [client 65.109.158.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.109.158.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSMaWU8WZjXLvbHTHPcM_QAAANg"]
[Sun Nov 23 23:10:33.917481 2025] [:error] [pid 38738:tid 38765] [client 157.245.154.48:49344] [client 157.245.154.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.154.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSMj6Qytc6TL9XavPmNfuAAAABc"]
[Sun Nov 23 23:58:22.530057 2025] [:error] [pid 44652:tid 44714] [client 34.61.22.11:60440] [client 34.61.22.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.61.22.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSMvHtiQFwsyXQDhwyBMEwAAAQg"]
[Sun Nov 23 23:58:24.678098 2025] [:error] [pid 44652:tid 44711] [client 34.61.22.11:60440] [client 34.61.22.11] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aSMvINiQFwsyXQDhwyBMGQAAAQU"]
[Sun Nov 23 23:58:24.876777 2025] [:error] [pid 44652:tid 44708] [client 34.61.22.11:60440] [client 34.61.22.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.61.22.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSMvINiQFwsyXQDhwyBMGgAAAQI"]
[Sun Nov 23 23:58:26.240156 2025] [:error] [pid 8036:tid 8054] [client 34.61.22.11:59695] [client 34.61.22.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.61.22.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSMvItBT69EcgFwgTmqTaQAAAgc"]
[Sun Nov 23 23:58:27.625557 2025] [:error] [pid 38739:tid 38784] [client 34.61.22.11:59929] [client 34.61.22.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.61.22.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSMvIwdvEgJm2n2cDmqNwwAAAE8"]
[Sun Nov 23 23:58:28.976349 2025] [:error] [pid 14602:tid 14635] [client 34.61.22.11:50635] [client 34.61.22.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.61.22.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSMvJB-I77jdD81pU-kEpgAAAU4"]
[Sun Nov 23 23:58:30.357680 2025] [:error] [pid 8036:tid 8066] [client 34.61.22.11:57940] [client 34.61.22.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.61.22.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSMvJtBT69EcgFwgTmqTagAAAhM"]
[Sun Nov 23 23:58:30.357838 2025] [:error] [pid 8036:tid 8066] [client 34.61.22.11:57940] [client 34.61.22.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.61.22.11, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSMvJtBT69EcgFwgTmqTagAAAhM"]
[Mon Nov 24 00:00:24.849507 2025] [:error] [pid 38740:tid 38803] [client 89.163.209.235:43952] [client 89.163.209.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.163.209.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSMvmA13QPZSi6O8umUNKAAAAIc"]
[Mon Nov 24 00:22:11.369688 2025] [:error] [pid 38739:tid 38771] [client 51.79.166.146:33936] [client 51.79.166.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.79.166.146, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSM0swdvEgJm2n2cDmqR7wAAAEI"]
[Mon Nov 24 00:47:06.430389 2025] [:error] [pid 1452:tid 1466] [client 173.212.218.121:37484] [client 173.212.218.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.212.218.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSM6ihKZkEEyVNVXr_m8SAAAAEk"]
[Mon Nov 24 00:50:01.521941 2025] [:error] [pid 1589:tid 1603] [client 143.110.190.80:57522] [client 143.110.190.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.110.190.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSM7OYI2fvripjU0EatujwAAAUw"]
[Mon Nov 24 00:50:20.696616 2025] [:error] [pid 1589:tid 1603] [client 188.165.95.76:48158] [client 188.165.95.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.165.95.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSM7TII2fvripjU0Eatu2wAAAUw"]
[Mon Nov 24 01:32:36.192101 2025] [:error] [pid 8337:tid 8361] [client 47.244.90.157:58798] [client 47.244.90.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.244.90.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSNFNOSmps4S2j95D5h8bwAAABY"]
[Mon Nov 24 02:06:47.541819 2025] [:error] [pid 1454:tid 1523] [client 34.48.13.209:54871] [client 34.48.13.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.13.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSNNN7eh4NH3skJ5n4SA8wAAAMs"]
[Mon Nov 24 02:06:49.821332 2025] [:error] [pid 1454:tid 1518] [client 34.48.13.209:54871] [client 34.48.13.209] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aSNNObeh4NH3skJ5n4SA-QAAAMY"]
[Mon Nov 24 02:06:50.037115 2025] [:error] [pid 1454:tid 1530] [client 34.48.13.209:54871] [client 34.48.13.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.13.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSNNOreh4NH3skJ5n4SA-gAAANI"]
[Mon Nov 24 02:06:51.499334 2025] [:error] [pid 1454:tid 1513] [client 34.48.13.209:55601] [client 34.48.13.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.13.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSNNO7eh4NH3skJ5n4SA_AAAAME"]
[Mon Nov 24 02:06:52.916558 2025] [:error] [pid 1453:tid 1505] [client 34.48.13.209:63976] [client 34.48.13.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.13.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSNNPBUBCt7LU0bO_GBa3gAAAJQ"]
[Mon Nov 24 02:06:54.466833 2025] [:error] [pid 1589:tid 1602] [client 34.48.13.209:60738] [client 34.48.13.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.13.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSNNPoI2fvripjU0EauLUQAAAUs"]
[Mon Nov 24 02:06:55.920260 2025] [:error] [pid 1452:tid 1469] [client 34.48.13.209:56701] [client 34.48.13.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.13.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSNNPxKZkEEyVNVXr_nQ1wAAAEw"]
[Mon Nov 24 02:06:55.920406 2025] [:error] [pid 1452:tid 1469] [client 34.48.13.209:56701] [client 34.48.13.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.48.13.209, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSNNPxKZkEEyVNVXr_nQ1wAAAEw"]
[Mon Nov 24 02:15:22.355450 2025] [:error] [pid 1452:tid 1460] [client 213.192.239.72:57064] [client 213.192.239.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.192.239.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSNPOhKZkEEyVNVXr_nSSQAAAEM"]
[Mon Nov 24 02:23:26.526483 2025] [:error] [pid 8337:tid 8354] [client 193.37.33.86:32821] [client 193.37.33.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.33.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSNRHuSmps4S2j95D5iUgQAAAA8"]
[Mon Nov 24 02:35:39.812286 2025] [:error] [pid 1454:tid 1535] [client 36.111.67.189:54310] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aSNT-7eh4NH3skJ5n4SIogAAANc"]
[Mon Nov 24 03:03:29.355338 2025] [:error] [pid 8337:tid 8353] [client 13.239.161.156:43128] [client 13.239.161.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.239.161.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSNageSmps4S2j95D5il-AAAAA4"]
[Mon Nov 24 03:44:02.428688 2025] [:error] [pid 1452:tid 1472] [client 35.234.37.132:42770] [client 35.234.37.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.234.37.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSNkAhKZkEEyVNVXr_noKAAAAE8"]
[Mon Nov 24 04:06:55.075498 2025] [:error] [pid 60055:tid 60068] [client 176.65.132.18:53468] [client 176.65.132.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aSNpXxl8e1zyNdXjTg8jmwAAAMs"]
[Mon Nov 24 04:30:38.395040 2025] [:error] [pid 12911:tid 12957] [client 213.136.87.238:42950] [client 213.136.87.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.136.87.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSNu7kDMbk9464jnIl7WmgAAAE8"]
[Mon Nov 24 04:56:21.063166 2025] [:error] [pid 12999:tid 13004] [client 43.166.224.244:38782] [client 43.166.224.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aSN09Vtj_teEYJ8vu7EBhQAAAME"]
[Mon Nov 24 05:13:00.164266 2025] [:error] [pid 12912:tid 12986] [client 45.195.75.44:56080] [client 45.195.75.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.195.75.44, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSN43JMj_Lgt36UonYK2JgAAAJE"]
[Mon Nov 24 05:28:03.389029 2025] [:error] [pid 12910:tid 12928] [client 193.37.33.61:42727] [client 193.37.33.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.33.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSN8Y2kWgvzAF2Nei2VtYwAAAA0"]
[Mon Nov 24 05:35:02.094668 2025] [:error] [pid 12999:tid 13011] [client 203.86.122.1:47144] [client 203.86.122.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.86.122.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSN-Bltj_teEYJ8vu7EPZgAAAMg"]
[Mon Nov 24 05:45:02.564318 2025] [:error] [pid 53508:tid 53521] [client 193.37.33.64:29895] [client 193.37.33.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.33.64, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSOAXm639qxbKCcL09y7MgAAAQs"]
[Mon Nov 24 06:02:32.700957 2025] [:error] [pid 53508:tid 53521] [client 134.90.137.88:33754] [client 134.90.137.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.90.137.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSOEeG639qxbKCcL09zCJAAAAQs"]
[Mon Nov 24 06:13:34.552180 2025] [:error] [pid 12999:tid 13005] [client 107.158.116.141:32841] [client 107.158.116.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.158.116.141, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSOHDltj_teEYJ8vu7Ea_wAAAMI"]
[Mon Nov 24 06:13:38.346976 2025] [:error] [pid 53508:tid 53525] [client 107.158.116.141:33449] [client 107.158.116.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.158.116.141, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSOHEm639qxbKCcL09zGiAAAAQ8"], referer: http://expressinteriors.com/wp-login.php
[Mon Nov 24 06:13:40.575861 2025] [:error] [pid 12911:tid 12948] [client 107.158.116.141:51251] [client 107.158.116.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.158.116.141, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSOHFEDMbk9464jnIl7xxAAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Mon Nov 24 06:18:22.902220 2025] [:error] [pid 12910:tid 12916] [client 67.23.254.96:54206] [client 67.23.254.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.23.254.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSOILmkWgvzAF2Nei2V78QAAAAE"]
[Mon Nov 24 06:18:24.994644 2025] [:error] [pid 53508:tid 53529] [client 67.23.254.96:54222] [client 67.23.254.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.23.254.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSOIMG639qxbKCcL09zKLgAAARM"]
[Mon Nov 24 06:43:35.879879 2025] [:error] [pid 12912:tid 12989] [client 51.91.51.27:56886] [client 51.91.51.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.91.51.27, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSOOF5Mj_Lgt36UonYLV_QAAAJQ"]
[Mon Nov 24 08:11:46.413735 2025] [:error] [pid 45172:tid 45186] [client 173.212.218.121:54964] [client 173.212.218.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.212.218.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSOiwvmwCGRoQtRCWUEIJwAAAUg"]
[Mon Nov 24 08:12:00.233399 2025] [:error] [pid 12911:tid 12952] [client 163.61.112.5:60010] [client 163.61.112.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.61.112.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSOi0EDMbk9464jnIl4gKQAAAEo"]
[Mon Nov 24 08:17:52.676727 2025] [:error] [pid 48601:tid 48666] [client 103.65.237.124:57821] [client 103.65.237.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aSOkMIMM4MaVTk74-AYnTAAAAgk"]
[Mon Nov 24 08:42:01.724512 2025] [:error] [pid 48688:tid 48692] [client 182.42.111.213:45161] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aSOp2Rm2q1FkzLam7A0hbwAAAkA"]
[Mon Nov 24 09:00:23.663222 2025] [:error] [pid 49900:tid 49908] [client 64.227.167.218:45756] [client 64.227.167.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.227.167.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSOuJzCyPLrvg06aorl_rQAAAAY"]
[Mon Nov 24 09:29:22.741500 2025] [:error] [pid 48601:tid 48658] [client 34.42.100.231:36435] [client 34.42.100.231] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aSO08oMM4MaVTk74-AZNPgAAAgE"]
[Mon Nov 24 09:29:50.167876 2025] [:error] [pid 48688:tid 48706] [client 157.66.46.84:49824] [client 157.66.46.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.46.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSO1Dhm2q1FkzLam7A0_9QAAAk4"]
[Mon Nov 24 09:45:24.678207 2025] [:error] [pid 48601:tid 48668] [client 116.203.27.22:44666] [client 116.203.27.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.203.27.22, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSO4tIMM4MaVTk74-AZUcgAAAgs"]
[Mon Nov 24 11:15:35.871103 2025] [:error] [pid 16549:tid 16552] [client 13.229.190.9:37110] [client 13.229.190.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.229.190.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSPN16eWW19A99PUw_cFlQAAAUA"]
[Mon Nov 24 11:23:42.064000 2025] [autoindex:error] [pid 9630:tid 9656] [client 134.209.221.235:62124] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Nov 24 12:23:17.754327 2025] [:error] [pid 9630:tid 9635] [client 18.188.88.138:55490] [client 18.188.88.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 18.188.88.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSPdtSrSgUgPGkizt2qiKwAAAEM"]
[Mon Nov 24 12:24:32.097517 2025] [:error] [pid 9630:tid 9632] [client 20.253.155.235:20038] [client 20.253.155.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.253.155.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSPeACrSgUgPGkizt2qiZQAAAEA"]
[Mon Nov 24 12:24:34.159153 2025] [:error] [pid 48688:tid 48695] [client 20.253.155.235:20074] [client 20.253.155.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.253.155.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSPeAhm2q1FkzLam7A1qywAAAkM"]
[Mon Nov 24 12:49:37.330166 2025] [:error] [pid 16516:tid 16535] [client 23.239.25.95:60838] [client 23.239.25.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.239.25.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSPj4fqZbniwaNwL8XnAlAAAARA"]
[Mon Nov 24 12:52:17.577854 2025] [:error] [pid 9630:tid 9646] [client 18.198.136.112:51172] [client 18.198.136.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 18.198.136.112, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSPkgSrSgUgPGkizt2qrIwAAAE4"]
[Mon Nov 24 12:54:51.874819 2025] [:error] [pid 48688:tid 48704] [client 5.189.145.165:53032] [client 5.189.145.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.189.145.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSPlGxm2q1FkzLam7A1wdAAAAkw"]
[Mon Nov 24 13:39:36.477347 2025] [:error] [pid 49900:tid 49902] [client 85.239.234.122:57498] [client 85.239.234.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.239.234.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSPvmDCyPLrvg06aorneSAAAAAA"]
[Mon Nov 24 14:33:39.346002 2025] [:error] [pid 16516:tid 16519] [client 157.245.42.243:44362] [client 157.245.42.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.42.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSP8Q_qZbniwaNwL8XnNkwAAAQA"]
[Mon Nov 24 14:35:39.470364 2025] [:error] [pid 9630:tid 9648] [client 85.237.194.86:41425] [client 85.237.194.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSP8uyrSgUgPGkizt2rFxAAAAFA"]
[Mon Nov 24 14:35:48.789081 2025] [:error] [pid 48599:tid 48624] [client 85.237.194.100:62591] [client 85.237.194.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bk/index.php"] [unique_id "aSP8xJzvu6PDJiRKE3IIeAAAAZU"]
[Mon Nov 24 14:36:20.107309 2025] [:error] [pid 16441:tid 16464] [client 85.237.194.55:47397] [client 85.237.194.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aSP85Iq_bc5MOa9Hfln8EwAAAJQ"]
[Mon Nov 24 14:36:27.489432 2025] [:error] [pid 48599:tid 48622] [client 181.215.65.79:61731] [client 181.215.65.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aSP865zvu6PDJiRKE3IImQAAAZM"]
[Mon Nov 24 14:36:29.459492 2025] [:error] [pid 16441:tid 16444] [client 85.237.194.145:44333] [client 85.237.194.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/chosen.php"] [unique_id "aSP87Yq_bc5MOa9Hfln8RgAAAIA"]
[Mon Nov 24 14:36:30.910780 2025] [:error] [pid 9630:tid 9635] [client 181.215.65.75:23489] [client 181.215.65.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aSP87irSgUgPGkizt2rF4wAAAEM"]
[Mon Nov 24 14:36:40.393252 2025] [:error] [pid 9630:tid 9633] [client 181.215.65.71:32357] [client 181.215.65.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aSP8-CrSgUgPGkizt2rF8wAAAEE"]
[Mon Nov 24 14:36:44.898150 2025] [:error] [pid 9630:tid 9646] [client 85.237.194.54:56187] [client 85.237.194.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aSP8_CrSgUgPGkizt2rF9wAAAE4"]
[Mon Nov 24 14:37:07.500330 2025] [:error] [pid 16441:tid 16457] [client 104.234.32.4:34673] [client 104.234.32.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSP9E4q_bc5MOa9Hfln8qgAAAI0"]
[Mon Nov 24 14:37:11.290222 2025] [:error] [pid 16516:tid 16541] [client 104.234.32.4:20869] [client 104.234.32.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aSP9F_qZbniwaNwL8XnODAAAARY"]
[Mon Nov 24 14:39:10.569191 2025] [:error] [pid 16441:tid 16465] [client 85.237.194.104:51761] [client 85.237.194.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.237.194.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSP9joq_bc5MOa9Hfln9mwAAAJU"]
[Mon Nov 24 14:39:23.484323 2025] [:error] [pid 16441:tid 16468] [client 85.237.194.104:51761] [client 85.237.194.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/modules.php"] [unique_id "aSP9m4q_bc5MOa9Hfln90QAAAJg"]
[Mon Nov 24 14:40:28.887396 2025] [autoindex:error] [pid 49900:tid 49920] [client 181.215.65.67:39945] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:40:34.595077 2025] [autoindex:error] [pid 49900:tid 49922] [client 181.215.65.67:39945] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:40:50.904878 2025] [autoindex:error] [pid 48599:tid 48623] [client 85.237.194.61:53933] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:40:59.062256 2025] [autoindex:error] [pid 48600:tid 48644] [client 85.237.194.100:46871] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:40:59.700056 2025] [autoindex:error] [pid 48600:tid 48641] [client 85.237.194.100:46871] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:41:00.388959 2025] [autoindex:error] [pid 48600:tid 48632] [client 85.237.194.100:46871] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:41:01.083759 2025] [autoindex:error] [pid 48600:tid 48633] [client 85.237.194.100:46871] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:41:01.876190 2025] [autoindex:error] [pid 48600:tid 48634] [client 85.237.194.100:46871] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:41:05.089862 2025] [autoindex:error] [pid 48600:tid 48638] [client 85.237.194.100:46871] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:41:05.972650 2025] [autoindex:error] [pid 48600:tid 48648] [client 85.237.194.100:46871] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:41:06.678022 2025] [autoindex:error] [pid 48600:tid 48650] [client 85.237.194.100:46871] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:41:07.288852 2025] [autoindex:error] [pid 48600:tid 48646] [client 85.237.194.100:46871] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:41:24.275954 2025] [autoindex:error] [pid 48600:tid 48647] [client 85.237.194.100:46871] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:43:11.097193 2025] [autoindex:error] [pid 48599:tid 48624] [client 104.234.32.1:53593] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:43:11.775834 2025] [autoindex:error] [pid 48599:tid 48620] [client 104.234.32.1:53593] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:43:12.471668 2025] [autoindex:error] [pid 48599:tid 48612] [client 104.234.32.1:53593] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:43:13.169841 2025] [autoindex:error] [pid 48599:tid 48614] [client 104.234.32.1:53593] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:43:13.874049 2025] [autoindex:error] [pid 48599:tid 48608] [client 104.234.32.1:53593] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:43:14.516643 2025] [autoindex:error] [pid 48599:tid 48619] [client 104.234.32.1:53593] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:43:15.180004 2025] [autoindex:error] [pid 48599:tid 48617] [client 104.234.32.1:53593] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:43:23.177696 2025] [autoindex:error] [pid 48599:tid 48625] [client 104.234.32.1:53593] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:43:23.884652 2025] [autoindex:error] [pid 48599:tid 48626] [client 104.234.32.1:53593] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:43:29.486808 2025] [autoindex:error] [pid 48599:tid 48609] [client 104.234.32.1:53593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:43:35.785566 2025] [autoindex:error] [pid 48599:tid 48615] [client 104.234.32.1:53593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:43:36.397501 2025] [autoindex:error] [pid 48599:tid 48621] [client 104.234.32.1:53593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:43:37.093356 2025] [autoindex:error] [pid 48599:tid 48606] [client 104.234.32.1:53593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:43:42.886295 2025] [autoindex:error] [pid 48599:tid 48604] [client 104.234.32.1:53593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:43:43.581819 2025] [autoindex:error] [pid 48599:tid 48627] [client 104.234.32.1:53593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:43:44.277834 2025] [autoindex:error] [pid 48599:tid 48613] [client 104.234.32.1:53593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:43:44.981233 2025] [autoindex:error] [pid 48599:tid 48616] [client 104.234.32.1:53593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:43:45.683004 2025] [autoindex:error] [pid 48599:tid 48605] [client 104.234.32.1:53593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:45:33.089867 2025] [autoindex:error] [pid 48599:tid 48606] [client 85.237.194.38:54291] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:46:11.982158 2025] [autoindex:error] [pid 9630:tid 9639] [client 85.237.194.61:38175] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:46:24.478451 2025] [autoindex:error] [pid 9630:tid 9647] [client 85.237.194.61:38175] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:46:25.184048 2025] [autoindex:error] [pid 9630:tid 9653] [client 85.237.194.61:38175] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:46:35.378033 2025] [autoindex:error] [pid 9630:tid 9654] [client 85.237.194.61:38175] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:46:36.081761 2025] [autoindex:error] [pid 9630:tid 9644] [client 85.237.194.61:38175] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:46:36.801808 2025] [autoindex:error] [pid 9630:tid 9656] [client 85.237.194.61:38175] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:46:37.499991 2025] [autoindex:error] [pid 9630:tid 9643] [client 85.237.194.61:38175] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:46:38.278497 2025] [autoindex:error] [pid 9630:tid 9640] [client 85.237.194.61:38175] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:46:39.003791 2025] [autoindex:error] [pid 9630:tid 9636] [client 85.237.194.61:38175] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:46:47.083789 2025] [autoindex:error] [pid 16549:tid 16558] [client 85.237.194.110:40769] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:46:47.789518 2025] [autoindex:error] [pid 16549:tid 16560] [client 85.237.194.110:40769] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:46:48.480187 2025] [autoindex:error] [pid 16549:tid 16552] [client 85.237.194.110:40769] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:46:49.204217 2025] [autoindex:error] [pid 16549:tid 16557] [client 85.237.194.110:40769] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:47:17.776025 2025] [autoindex:error] [pid 16549:tid 16557] [client 85.237.194.110:40769] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:48:08.395652 2025] [autoindex:error] [pid 16441:tid 16454] [client 85.237.194.145:26159] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:48:09.082914 2025] [autoindex:error] [pid 16441:tid 16458] [client 85.237.194.145:26159] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:49:09.300739 2025] [autoindex:error] [pid 16441:tid 16463] [client 85.237.194.145:26159] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/paste/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 14:49:20.400759 2025] [autoindex:error] [pid 16441:tid 16446] [client 85.237.194.145:26159] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Nov 24 15:19:07.620971 2025] [:error] [pid 16549:tid 16554] [client 34.73.73.46:55834] [client 34.73.73.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.73.73.46, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSQG66eWW19A99PUw_coGwAAAUI"]
[Mon Nov 24 15:41:56.073614 2025] [:error] [pid 49900:tid 49905] [client 15.228.100.230:56240] [client 15.228.100.230] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aSQMRDCyPLrvg06aorn4XwAAAAM"]
[Mon Nov 24 15:52:29.315218 2025] [:error] [pid 48599:tid 48609] [client 35.87.225.64:55400] [client 35.87.225.64] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aSQOvZzvu6PDJiRKE3IUBQAAAYY"]
[Mon Nov 24 15:56:36.448751 2025] [:error] [pid 16593:tid 16606] [client 130.193.77.35:60096] [client 130.193.77.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.193.77.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSQPtBVGznHBJI2LKpQwZQAAAos"]
[Mon Nov 24 16:19:08.247387 2025] [:error] [pid 48599:tid 48619] [client 68.183.180.73:47108] [client 68.183.180.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aSQU_Jzvu6PDJiRKE3IYIwAAAZA"]
[Mon Nov 24 16:19:12.938388 2025] [authz_core:error] [pid 16441:tid 16465] [client 68.183.180.73:47190] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Mon Nov 24 16:19:15.291431 2025] [:error] [pid 16593:tid 16610] [client 68.183.180.73:47224] [client 68.183.180.73] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aSQVAxVGznHBJI2LKpQ0GgAAAo8"]
[Mon Nov 24 16:19:15.483473 2025] [:error] [pid 48688:tid 48704] [client 68.183.180.73:47234] [client 68.183.180.73] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aSQVAxm2q1FkzLam7A2ROAAAAkw"]
[Mon Nov 24 16:28:53.978440 2025] [:error] [pid 48601:tid 48664] [client 62.219.78.162:40790] [client 62.219.78.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.219.78.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSQXRYMM4MaVTk74-AapXgAAAgc"]
[Mon Nov 24 16:43:54.490217 2025] [:error] [pid 48688:tid 48703] [client 194.233.90.32:38784] [client 194.233.90.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.233.90.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSQayhm2q1FkzLam7A2VLwAAAks"]
[Mon Nov 24 16:58:49.668731 2025] [:error] [pid 16593:tid 16615] [client 5.35.249.176:34448] [client 5.35.249.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.35.249.176, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSQeSRVGznHBJI2LKpQ6SAAAApQ"]
[Mon Nov 24 17:24:05.101606 2025] [:error] [pid 49900:tid 49917] [client 23.104.161.126:58187] [client 23.104.161.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.104.161.126, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSQkNTCyPLrvg06aorkNtAAAAA8"], referer: https://expressinteriors.com/
[Mon Nov 24 17:25:52.153058 2025] [:error] [pid 48599:tid 48615] [client 101.32.208.70:59026] [client 101.32.208.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aSQkoJzvu6PDJiRKE3IjowAAAYw"]
[Mon Nov 24 17:30:28.885958 2025] [:error] [pid 9630:tid 9638] [client 198.244.228.164:34292] [client 198.244.228.164] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/index.php/wp-json/wp/v2/users"] [unique_id "aSQltCrSgUgPGkizt2rzuQAAAEY"]
[Mon Nov 24 17:33:00.364251 2025] [:error] [pid 16441:tid 16460] [client 103.248.25.138:35726] [client 103.248.25.138] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/Wp/v2/users"] [unique_id "aSQmTIq_bc5MOa9Hflk3OAAAAJA"]
[Mon Nov 24 17:36:06.822679 2025] [:error] [pid 9630:tid 9650] [client 103.153.42.48:41116] [client 103.153.42.48] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aSQnBirSgUgPGkizt2r17QAAAFI"]
[Mon Nov 24 18:53:05.045046 2025] [:error] [pid 16441:tid 16444] [client 82.145.127.83:47650] [client 82.145.127.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.145.127.83, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSQ5EYq_bc5MOa9HfllUeAAAAIA"]
[Mon Nov 24 19:21:10.462815 2025] [:error] [pid 48600:tid 48644] [client 194.67.109.194:44898] [client 194.67.109.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.67.109.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSQ_pvtOzSUAQvWVjBeNEQAAAc4"]
[Mon Nov 24 19:21:53.735755 2025] [:error] [pid 9630:tid 9655] [client 157.230.24.5:59600] [client 157.230.24.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.24.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSQ_0SrSgUgPGkizt2oS-AAAAFc"]
[Mon Nov 24 19:32:43.290816 2025] [:error] [pid 9630:tid 9632] [client 157.90.79.58:40458] [client 157.90.79.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.90.79.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSRCWyrSgUgPGkizt2oWXAAAAEA"]
[Mon Nov 24 20:19:59.136714 2025] [:error] [pid 48600:tid 48638] [client 211.21.61.225:47300] [client 211.21.61.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.225, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSRNb_tOzSUAQvWVjBeWHQAAAcg"]
[Mon Nov 24 21:15:00.280044 2025] [:error] [pid 16516:tid 16533] [client 46.105.76.214:25851] [client 46.105.76.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.76.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSRaVPqZbniwaNwL8XkH_AAAAQ4"]
[Mon Nov 24 21:25:36.723665 2025] [:error] [pid 16593:tid 16595] [client 167.86.80.181:37600] [client 167.86.80.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.80.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSRc0BVGznHBJI2LKpRpFgAAAoA"]
[Mon Nov 24 21:45:38.443609 2025] [:error] [pid 16593:tid 16597] [client 193.32.126.212:54537] [client 193.32.126.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aSRhghVGznHBJI2LKpRr9AAAAoI"]
[Mon Nov 24 21:45:38.939173 2025] [:error] [pid 48600:tid 48652] [client 193.32.126.212:55170] [client 193.32.126.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aSRhgvtOzSUAQvWVjBeiFwAAAdY"]
[Mon Nov 24 21:45:39.433486 2025] [:error] [pid 16549:tid 16564] [client 193.32.126.212:55670] [client 193.32.126.212] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aSRhg6eWW19A99PUw_doEQAAAUw"]
[Mon Nov 24 21:49:44.424994 2025] [:error] [pid 48601:tid 48661] [client 182.42.105.144:58788] [client 182.42.105.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aSRieIMM4MaVTk74-Abn_wAAAgQ"]
[Mon Nov 24 22:06:55.983060 2025] [:error] [pid 48688:tid 48715] [client 5.35.249.176:58102] [client 5.35.249.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.35.249.176, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSRmfxm2q1FkzLam7A3ULwAAAlc"]
[Mon Nov 24 22:58:13.753688 2025] [:error] [pid 9630:tid 9643] [client 159.203.169.232:54728] [client 159.203.169.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.169.232, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSRyhSrSgUgPGkizt2pLpgAAAEs"]
[Tue Nov 25 00:07:00.742708 2025] [:error] [pid 49900:tid 49905] [client 5.35.249.176:39618] [client 5.35.249.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.35.249.176, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSSCpDCyPLrvg06aorlpBgAAAAM"]
[Tue Nov 25 00:54:46.254479 2025] [:error] [pid 49900:tid 49924] [client 162.214.205.31:50498] [client 162.214.205.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.214.205.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSSN1jCyPLrvg06aorlzzQAAABY"]
[Tue Nov 25 00:54:47.790634 2025] [:error] [pid 48600:tid 48643] [client 162.214.205.31:50626] [client 162.214.205.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.214.205.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSSN1_tOzSUAQvWVjBe7bwAAAc0"]
[Tue Nov 25 01:03:53.540210 2025] [:error] [pid 16516:tid 16523] [client 164.90.224.127:16838] [client 164.90.224.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.90.224.127, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSSP-fqZbniwaNwL8XkqcgAAAQQ"]
[Tue Nov 25 01:06:06.679974 2025] [:error] [pid 48601:tid 48657] [client 3.86.214.214:60632] [client 3.86.214.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aSSQfoMM4MaVTk74-AYOyAAAAgA"]
[Tue Nov 25 04:11:30.418611 2025] [:error] [pid 14076:tid 14100] [client 116.202.13.21:57386] [client 116.202.13.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.202.13.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSS78nsB4Gz6Qw-pvBv53QAAABM"]
[Tue Nov 25 04:21:02.574543 2025] [:error] [pid 14076:tid 14105] [client 125.94.144.102:33184] [client 125.94.144.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aSS-LnsB4Gz6Qw-pvBv78wAAABg"]
[Tue Nov 25 05:04:30.533685 2025] [:error] [pid 14077:tid 14118] [client 54.208.245.72:42620] [client 54.208.245.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.208.245.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSTIXhG9n7UHEkwDTyhLxgAAAEg"]
[Tue Nov 25 05:23:56.144698 2025] [:error] [pid 1103:tid 1123] [client 20.242.70.1:4202] [client 20.242.70.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aSTM7I0LETdqOlq63sT3NAAAAU4"]
[Tue Nov 25 05:24:02.550759 2025] [:error] [pid 14688:tid 14714] [client 20.242.70.1:1467] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aSTM8m9vYrBoEsiDnizjuwAAARg"]
[Tue Nov 25 05:24:04.575209 2025] [:error] [pid 1103:tid 1131] [client 20.242.70.1:4509] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aSTM9I0LETdqOlq63sT3RgAAAVY"]
[Tue Nov 25 05:24:06.106391 2025] [:error] [pid 14688:tid 14713] [client 20.242.70.1:4673] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aSTM9m9vYrBoEsiDnizjvAAAARc"]
[Tue Nov 25 05:24:07.027619 2025] [:error] [pid 14688:tid 14708] [client 20.242.70.1:6675] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aSTM929vYrBoEsiDnizjvwAAARI"]
[Tue Nov 25 05:24:09.712142 2025] [:error] [pid 14077:tid 14133] [client 20.242.70.1:2263] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aSTM-RG9n7UHEkwDTyhRQQAAAFc"]
[Tue Nov 25 05:24:12.471698 2025] [:error] [pid 14688:tid 14710] [client 20.242.70.1:6770] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aSTM_G9vYrBoEsiDnizj2QAAARQ"]
[Tue Nov 25 05:24:15.792752 2025] [:error] [pid 14078:tid 14148] [client 20.242.70.1:3709] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aSTM_9VXYbb0ii_rVoJL3wAAAIs"]
[Tue Nov 25 05:24:17.521442 2025] [:error] [pid 14168:tid 14178] [client 20.242.70.1:4418] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aSTNAfR-ZDU0QEgAIItxVAAAAMc"]
[Tue Nov 25 05:24:19.003626 2025] [:error] [pid 14168:tid 14178] [client 20.242.70.1:1639] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aSTNA_R-ZDU0QEgAIItxXgAAAMc"]
[Tue Nov 25 05:24:21.753617 2025] [:error] [pid 14688:tid 14697] [client 20.242.70.1:2200] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aSTNBW9vYrBoEsiDnizj_gAAAQc"]
[Tue Nov 25 05:24:26.771272 2025] [:error] [pid 14688:tid 14694] [client 20.242.70.1:6169] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aSTNCm9vYrBoEsiDnizkCgAAAQQ"]
[Tue Nov 25 05:24:28.394867 2025] [:error] [pid 1103:tid 1128] [client 20.242.70.1:8833] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aSTNDI0LETdqOlq63sT3jQAAAVM"]
[Tue Nov 25 05:24:29.376588 2025] [:error] [pid 14077:tid 14128] [client 20.242.70.1:3731] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless2.php"] [unique_id "aSTNDRG9n7UHEkwDTyhRcAAAAFI"]
[Tue Nov 25 05:24:31.869325 2025] [:error] [pid 1103:tid 1113] [client 20.242.70.1:4167] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless2.php"] [unique_id "aSTND40LETdqOlq63sT3kAAAAUQ"]
[Tue Nov 25 05:24:34.789852 2025] [:error] [pid 14076:tid 14104] [client 20.242.70.1:3503] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless2.php"] [unique_id "aSTNEnsB4Gz6Qw-pvBsMFwAAABc"]
[Tue Nov 25 05:24:37.627345 2025] [:error] [pid 14688:tid 14694] [client 20.242.70.1:1836] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless2.php"] [unique_id "aSTNFW9vYrBoEsiDnizkFAAAAQQ"]
[Tue Nov 25 05:24:40.250712 2025] [:error] [pid 1103:tid 1121] [client 20.242.70.1:2047] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aSTNGI0LETdqOlq63sT3lwAAAUw"]
[Tue Nov 25 05:24:42.406217 2025] [:error] [pid 14076:tid 14096] [client 20.242.70.1:1831] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aSTNGnsB4Gz6Qw-pvBsMIwAAAA8"]
[Tue Nov 25 05:24:44.197015 2025] [:error] [pid 14077:tid 14115] [client 20.242.70.1:2035] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aSTNHBG9n7UHEkwDTyhRfwAAAEU"]
[Tue Nov 25 05:24:50.938475 2025] [:error] [pid 1103:tid 1109] [client 20.242.70.1:4392] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aSTNIo0LETdqOlq63sT3oAAAAUA"]
[Tue Nov 25 05:24:55.892951 2025] [:error] [pid 1103:tid 1124] [client 20.242.70.1:7665] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-class.php"] [unique_id "aSTNJ40LETdqOlq63sT3pQAAAU8"]
[Tue Nov 25 05:24:58.072390 2025] [:error] [pid 14077:tid 14113] [client 20.242.70.1:7642] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-class.php"] [unique_id "aSTNKhG9n7UHEkwDTyhRhQAAAEM"]
[Tue Nov 25 05:25:15.391361 2025] [:error] [pid 14076:tid 14091] [client 20.242.70.1:6892] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "aSTNO3sB4Gz6Qw-pvBsMTwAAAAo"]
[Tue Nov 25 05:25:18.074118 2025] [:error] [pid 14078:tid 14148] [client 20.242.70.1:5727] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "aSTNPtVXYbb0ii_rVoJMTAAAAIs"]
[Tue Nov 25 05:25:28.153739 2025] [:error] [pid 14078:tid 14147] [client 20.242.70.1:1586] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "aSTNSNVXYbb0ii_rVoJMTQAAAIo"]
[Tue Nov 25 05:25:29.564924 2025] [:error] [pid 14168:tid 14171] [client 20.242.70.1:6532] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aSTNSfR-ZDU0QEgAIItxnQAAAMA"]
[Tue Nov 25 05:25:31.568204 2025] [:error] [pid 14077:tid 14120] [client 20.242.70.1:8610] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aSTNSxG9n7UHEkwDTyhRvQAAAEo"]
[Tue Nov 25 05:25:32.424223 2025] [:error] [pid 14078:tid 14157] [client 20.242.70.1:3665] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aSTNTNVXYbb0ii_rVoJMVAAAAJQ"]
[Tue Nov 25 05:25:33.743024 2025] [:error] [pid 14078:tid 14156] [client 20.242.70.1:8547] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aSTNTdVXYbb0ii_rVoJMVQAAAJM"]
[Tue Nov 25 05:25:35.602875 2025] [:error] [pid 14078:tid 14145] [client 20.242.70.1:5970] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aSTNT9VXYbb0ii_rVoJMWAAAAIg"]
[Tue Nov 25 05:25:36.553677 2025] [:error] [pid 14076:tid 14090] [client 20.242.70.1:8562] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aSTNUHsB4Gz6Qw-pvBsMVAAAAAk"]
[Tue Nov 25 05:25:38.679812 2025] [:error] [pid 14168:tid 14175] [client 20.242.70.1:8565] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aSTNUvR-ZDU0QEgAIItxoAAAAMQ"]
[Tue Nov 25 05:25:39.871071 2025] [:error] [pid 1103:tid 1118] [client 20.242.70.1:2821] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aSTNU40LETdqOlq63sT32AAAAUk"]
[Tue Nov 25 05:25:43.897874 2025] [:error] [pid 14688:tid 14714] [client 20.242.70.1:1359] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aSTNV29vYrBoEsiDnizkeAAAARg"]
[Tue Nov 25 05:25:44.552752 2025] [:error] [pid 14688:tid 14698] [client 20.242.70.1:5578] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aSTNWG9vYrBoEsiDnizkeQAAAQg"]
[Tue Nov 25 05:25:48.723784 2025] [:error] [pid 14078:tid 14144] [client 20.242.70.1:6639] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aSTNXNVXYbb0ii_rVoJMXAAAAIc"]
[Tue Nov 25 05:25:50.290730 2025] [:error] [pid 14077:tid 14110] [client 20.242.70.1:6914] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aSTNXhG9n7UHEkwDTyhRxQAAAEA"]
[Tue Nov 25 05:25:51.449176 2025] [:error] [pid 14078:tid 14157] [client 20.242.70.1:2079] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/build.php"] [unique_id "aSTNX9VXYbb0ii_rVoJMYAAAAJQ"]
[Tue Nov 25 05:25:54.372311 2025] [:error] [pid 14688:tid 14705] [client 20.242.70.1:6952] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/build.php"] [unique_id "aSTNYm9vYrBoEsiDnizkfgAAAQ8"]
[Tue Nov 25 05:25:56.755271 2025] [:error] [pid 14076:tid 14100] [client 20.242.70.1:1344] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/build.php"] [unique_id "aSTNZHsB4Gz6Qw-pvBsMWAAAABM"]
[Tue Nov 25 05:25:57.625002 2025] [:error] [pid 14688:tid 14701] [client 20.242.70.1:3757] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/build.php"] [unique_id "aSTNZW9vYrBoEsiDnizkgAAAAQs"]
[Tue Nov 25 05:25:58.491653 2025] [:error] [pid 1103:tid 1117] [client 20.242.70.1:4554] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ot.php"] [unique_id "aSTNZo0LETdqOlq63sT34QAAAUg"]
[Tue Nov 25 05:26:02.005161 2025] [:error] [pid 14076:tid 14101] [client 20.242.70.1:8003] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ot.php"] [unique_id "aSTNansB4Gz6Qw-pvBsMWgAAABQ"]
[Tue Nov 25 05:26:05.004254 2025] [:error] [pid 1103:tid 1116] [client 20.242.70.1:8456] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ot.php"] [unique_id "aSTNbY0LETdqOlq63sT36QAAAUc"]
[Tue Nov 25 05:26:06.575697 2025] [:error] [pid 14077:tid 14112] [client 20.242.70.1:4396] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ot.php"] [unique_id "aSTNbhG9n7UHEkwDTyhRzAAAAEI"]
[Tue Nov 25 05:26:08.945168 2025] [:error] [pid 14076:tid 14081] [client 20.242.70.1:4374] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lc.php"] [unique_id "aSTNcHsB4Gz6Qw-pvBsMXAAAAAA"]
[Tue Nov 25 05:26:10.149014 2025] [:error] [pid 14076:tid 14105] [client 20.242.70.1:5596] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lc.php"] [unique_id "aSTNcnsB4Gz6Qw-pvBsMXwAAABg"]
[Tue Nov 25 05:26:21.905151 2025] [:error] [pid 14168:tid 14191] [client 20.242.70.1:2216] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pepe.php"] [unique_id "aSTNffR-ZDU0QEgAIItxyAAAANQ"]
[Tue Nov 25 05:26:22.633120 2025] [:error] [pid 14168:tid 14177] [client 20.242.70.1:7101] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pepe.php"] [unique_id "aSTNfvR-ZDU0QEgAIItxywAAAMY"]
[Tue Nov 25 05:26:24.443193 2025] [:error] [pid 14168:tid 14171] [client 20.242.70.1:3171] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pepe.php"] [unique_id "aSTNgPR-ZDU0QEgAIItxzQAAAMA"]
[Tue Nov 25 05:26:25.887348 2025] [:error] [pid 14077:tid 14112] [client 20.242.70.1:4253] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pepe.php"] [unique_id "aSTNgRG9n7UHEkwDTyhR1wAAAEI"]
[Tue Nov 25 05:26:27.338390 2025] [:error] [pid 14688:tid 14698] [client 20.242.70.1:8166] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aSTNg29vYrBoEsiDnizkjwAAAQg"]
[Tue Nov 25 05:26:28.363255 2025] [:error] [pid 1103:tid 1126] [client 20.242.70.1:3383] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aSTNhI0LETdqOlq63sT3-QAAAVE"]
[Tue Nov 25 05:26:29.800732 2025] [:error] [pid 14168:tid 14179] [client 20.242.70.1:7067] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aSTNhfR-ZDU0QEgAIItx0QAAAMg"]
[Tue Nov 25 05:26:30.820304 2025] [:error] [pid 1103:tid 1110] [client 20.242.70.1:3330] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aSTNho0LETdqOlq63sT3_gAAAUE"]
[Tue Nov 25 05:26:32.580708 2025] [:error] [pid 1103:tid 1126] [client 20.242.70.1:3337] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aSTNiI0LETdqOlq63sT4BAAAAVE"]
[Tue Nov 25 05:26:34.455523 2025] [:error] [pid 14168:tid 14190] [client 20.242.70.1:5791] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aSTNivR-ZDU0QEgAIItx2QAAANM"]
[Tue Nov 25 05:26:36.315637 2025] [:error] [pid 14077:tid 14122] [client 20.242.70.1:3145] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aSTNjBG9n7UHEkwDTyhR3AAAAEw"]
[Tue Nov 25 05:26:37.040501 2025] [:error] [pid 1103:tid 1119] [client 20.242.70.1:1678] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aSTNjY0LETdqOlq63sT4BwAAAUo"]
[Tue Nov 25 05:26:40.945915 2025] [:error] [pid 14168:tid 14181] [client 20.242.70.1:5602] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aSTNkPR-ZDU0QEgAIItx4gAAAMo"]
[Tue Nov 25 05:26:43.104925 2025] [:error] [pid 14688:tid 14695] [client 20.242.70.1:6321] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aSTNk29vYrBoEsiDnizklwAAAQU"]
[Tue Nov 25 05:26:44.394470 2025] [:error] [pid 14076:tid 14088] [client 20.242.70.1:5581] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aSTNlHsB4Gz6Qw-pvBsMeQAAAAc"]
[Tue Nov 25 05:26:45.514643 2025] [:error] [pid 1103:tid 1129] [client 20.242.70.1:1311] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aSTNlY0LETdqOlq63sT4GQAAAVQ"]
[Tue Nov 25 05:26:48.574231 2025] [:error] [pid 1103:tid 1124] [client 20.242.70.1:7504] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/faq.php"] [unique_id "aSTNmI0LETdqOlq63sT4OwAAAU8"]
[Tue Nov 25 05:26:49.710167 2025] [:error] [pid 1103:tid 1117] [client 20.242.70.1:2369] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/faq.php"] [unique_id "aSTNmY0LETdqOlq63sT4RwAAAUg"]
[Tue Nov 25 05:26:50.484734 2025] [:error] [pid 14168:tid 14195] [client 20.242.70.1:8905] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/faq.php"] [unique_id "aSTNmvR-ZDU0QEgAIItx-wAAANg"]
[Tue Nov 25 05:26:52.553962 2025] [:error] [pid 14076:tid 14092] [client 20.242.70.1:2810] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/faq.php"] [unique_id "aSTNnHsB4Gz6Qw-pvBsMhwAAAAs"]
[Tue Nov 25 05:26:55.057692 2025] [:error] [pid 14078:tid 14142] [client 20.242.70.1:2792] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aSTNn9VXYbb0ii_rVoJMjAAAAIU"]
[Tue Nov 25 05:26:56.499942 2025] [:error] [pid 14077:tid 14112] [client 20.242.70.1:4790] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aSTNoBG9n7UHEkwDTyhR4QAAAEI"]
[Tue Nov 25 05:26:58.864268 2025] [:error] [pid 14078:tid 14149] [client 20.242.70.1:7714] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aSTNotVXYbb0ii_rVoJMjgAAAIw"]
[Tue Nov 25 05:27:01.089872 2025] [:error] [pid 14078:tid 14143] [client 20.242.70.1:3743] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aSTNpdVXYbb0ii_rVoJMkQAAAIY"]
[Tue Nov 25 05:27:02.729218 2025] [:error] [pid 14077:tid 14119] [client 20.242.70.1:5938] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CLA.php"] [unique_id "aSTNphG9n7UHEkwDTyhR5gAAAEk"]
[Tue Nov 25 05:27:07.005596 2025] [:error] [pid 1103:tid 1110] [client 20.242.70.1:3932] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CLA.php"] [unique_id "aSTNq40LETdqOlq63sT4SwAAAUE"]
[Tue Nov 25 05:27:09.196290 2025] [:error] [pid 14078:tid 14148] [client 20.242.70.1:3942] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CLA.php"] [unique_id "aSTNrdVXYbb0ii_rVoJMlQAAAIs"]
[Tue Nov 25 05:27:09.913712 2025] [:error] [pid 14688:tid 14705] [client 20.242.70.1:7381] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CLA.php"] [unique_id "aSTNrW9vYrBoEsiDnizkowAAAQ8"]
[Tue Nov 25 05:27:10.975213 2025] [:error] [pid 14077:tid 14111] [client 20.242.70.1:3753] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aSTNrhG9n7UHEkwDTyhR6gAAAEE"]
[Tue Nov 25 05:27:12.760235 2025] [:error] [pid 14168:tid 14183] [client 20.242.70.1:7263] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aSTNsPR-ZDU0QEgAIItyBAAAAMw"]
[Tue Nov 25 05:27:13.941498 2025] [:error] [pid 14688:tid 14707] [client 20.242.70.1:5910] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aSTNsW9vYrBoEsiDnizkpwAAARE"]
[Tue Nov 25 05:27:17.658719 2025] [:error] [pid 1103:tid 1129] [client 20.242.70.1:7948] [client 20.242.70.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aSTNtY0LETdqOlq63sT4UAAAAVQ"]
[Tue Nov 25 05:37:52.599773 2025] [:error] [pid 14078:tid 14147] [client 3.86.214.214:50968] [client 3.86.214.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aSTQMNVXYbb0ii_rVoJOnwAAAIo"]
[Tue Nov 25 05:57:36.060839 2025] [:error] [pid 1103:tid 1118] [client 89.200.174.238:34202] [client 89.200.174.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.200.174.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSTU0I0LETdqOlq63sQCSQAAAUk"]
[Tue Nov 25 06:49:07.188000 2025] [:error] [pid 14077:tid 14125] [client 150.109.180.208:37388] [client 150.109.180.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.109.180.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSTg4xG9n7UHEkwDTyhkKQAAAE8"]
[Tue Nov 25 07:43:53.837272 2025] [:error] [pid 14076:tid 14091] [client 212.132.70.123:49674] [client 212.132.70.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.132.70.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSTtuXsB4Gz6Qw-pvBsqkgAAAAo"]
[Tue Nov 25 08:41:38.858797 2025] [:error] [pid 14168:tid 14174] [client 91.189.127.4:46396] [client 91.189.127.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.189.127.4, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aST7QvR-ZDU0QEgAIIupYAAAAMM"]
[Tue Nov 25 09:10:13.507103 2025] [:error] [pid 14688:tid 14708] [client 172.64.223.128:12348] [client 172.64.223.128] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aSUB9W9vYrBoEsiDniwfiAAAARI"]
[Tue Nov 25 09:41:40.654102 2025] [:error] [pid 14078:tid 14152] [client 137.74.192.205:33470] [client 137.74.192.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.74.192.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSUJVNVXYbb0ii_rVoKRvwAAAI8"]
[Tue Nov 25 10:42:34.815206 2025] [:error] [pid 14076:tid 14105] [client 146.190.155.17:34006] [client 146.190.155.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.155.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSUXmnsB4Gz6Qw-pvBtY-gAAABg"]
[Tue Nov 25 11:40:02.711031 2025] [:error] [pid 14078:tid 14159] [client 85.186.88.250:46464] [client 85.186.88.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.186.88.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSUlEtVXYbb0ii_rVoKzfwAAAJY"]
[Tue Nov 25 12:38:40.741158 2025] [:error] [pid 14076:tid 14089] [client 164.68.115.151:44896] [client 164.68.115.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.68.115.151, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSUy0HsB4Gz6Qw-pvBuQuwAAAAg"]
[Tue Nov 25 13:38:01.292108 2025] [:error] [pid 28740:tid 28800] [client 50.87.249.50:12970] [client 50.87.249.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.249.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSVAuVppQCoYxWW6V0UeTAAAAkk"]
[Tue Nov 25 13:38:04.211115 2025] [:error] [pid 14077:tid 14111] [client 50.87.249.50:13958] [client 50.87.249.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.249.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSVAvBG9n7UHEkwDTyjuZAAAAEE"]
[Tue Nov 25 13:38:11.168749 2025] [:error] [pid 14077:tid 14120] [client 95.168.208.102:34602] [client 95.168.208.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.168.208.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSVAwxG9n7UHEkwDTyjubAAAAEo"]
[Tue Nov 25 14:36:47.723354 2025] [:error] [pid 14076:tid 14086] [client 95.223.75.153:48186] [client 95.223.75.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.223.75.153, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSVOf3sB4Gz6Qw-pvBvFLQAAAAU"]
[Tue Nov 25 14:50:29.718250 2025] [:error] [pid 14077:tid 14124] [client 209.50.169.33:55817] [client 209.50.169.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/HEAD"] [unique_id "aSVRtRG9n7UHEkwDTygSPAAAAE4"]
[Tue Nov 25 14:50:32.769325 2025] [:error] [pid 14688:tid 14704] [client 104.207.58.36:36453] [client 104.207.58.36] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aSVRuG9vYrBoEsiDnix5oAAAAQ4"]
[Tue Nov 25 14:50:34.401973 2025] [:error] [pid 14077:tid 14112] [client 154.213.165.223:13647] [client 154.213.165.223] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.svn/wc.db"] [unique_id "aSVRuhG9n7UHEkwDTygSQgAAAEI"]
[Tue Nov 25 14:59:08.847377 2025] [:error] [pid 14077:tid 14122] [client 20.119.245.174:7299] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "aSVTvBG9n7UHEkwDTygV5wAAAEw"]
[Tue Nov 25 14:59:12.993391 2025] [:error] [pid 14168:tid 14187] [client 20.119.245.174:3638] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "aSVTwPR-ZDU0QEgAIIsnYAAAANA"]
[Tue Nov 25 14:59:17.634340 2025] [:error] [pid 14077:tid 14124] [client 20.119.245.174:7099] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "aSVTxRG9n7UHEkwDTygWAAAAAE4"]
[Tue Nov 25 14:59:19.073517 2025] [:error] [pid 14077:tid 14120] [client 20.119.245.174:5029] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "aSVTxxG9n7UHEkwDTygWGAAAAEo"]
[Tue Nov 25 14:59:20.356599 2025] [:error] [pid 14076:tid 14094] [client 20.119.245.174:7067] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d2.php"] [unique_id "aSVTyHsB4Gz6Qw-pvBvMbwAAAA0"]
[Tue Nov 25 14:59:22.096422 2025] [:error] [pid 28609:tid 28629] [client 20.119.245.174:1381] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d2.php"] [unique_id "aSVTyiGGdT-nZJVs3x2FKAAAAYs"]
[Tue Nov 25 14:59:23.369817 2025] [:error] [pid 28609:tid 28627] [client 20.119.245.174:3612] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d2.php"] [unique_id "aSVTyyGGdT-nZJVs3x2FLQAAAYk"]
[Tue Nov 25 14:59:24.788271 2025] [:error] [pid 28609:tid 28623] [client 20.119.245.174:3592] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d2.php"] [unique_id "aSVTzCGGdT-nZJVs3x2FLgAAAYU"]
[Tue Nov 25 14:59:25.687631 2025] [:error] [pid 28740:tid 28797] [client 20.119.245.174:4210] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/snus.php"] [unique_id "aSVTzVppQCoYxWW6V0UuEQAAAkY"]
[Tue Nov 25 14:59:28.684900 2025] [:error] [pid 14077:tid 14122] [client 20.119.245.174:8200] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/snus.php"] [unique_id "aSVT0BG9n7UHEkwDTygWKwAAAEw"]
[Tue Nov 25 14:59:29.579590 2025] [:error] [pid 28836:tid 29008] [client 20.119.245.174:3520] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/snus.php"] [unique_id "aSVT0ZwNRsoxcLQGkTeAJAAAAtI"]
[Tue Nov 25 14:59:31.624972 2025] [:error] [pid 14688:tid 14706] [client 20.119.245.174:1605] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/snus.php"] [unique_id "aSVT029vYrBoEsiDnix7ugAAARA"]
[Tue Nov 25 14:59:34.069283 2025] [:error] [pid 14078:tid 14150] [client 20.119.245.174:4205] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/011i.php"] [unique_id "aSVT1tVXYbb0ii_rVoL3iAAAAI0"]
[Tue Nov 25 14:59:35.535922 2025] [:error] [pid 28740:tid 28813] [client 20.119.245.174:1645] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/011i.php"] [unique_id "aSVT11ppQCoYxWW6V0UuFgAAAlY"]
[Tue Nov 25 14:59:39.389902 2025] [:error] [pid 14688:tid 14704] [client 20.119.245.174:8650] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/011i.php"] [unique_id "aSVT229vYrBoEsiDnix7wgAAAQ4"]
[Tue Nov 25 14:59:48.386765 2025] [:error] [pid 14077:tid 14110] [client 20.119.245.174:6064] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/disaos.php"] [unique_id "aSVT5BG9n7UHEkwDTygWQQAAAEA"]
[Tue Nov 25 14:59:49.432988 2025] [:error] [pid 14076:tid 14083] [client 20.119.245.174:1646] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/disaos.php"] [unique_id "aSVT5XsB4Gz6Qw-pvBvMjAAAAAI"]
[Tue Nov 25 14:59:50.687116 2025] [:error] [pid 14077:tid 14127] [client 20.119.245.174:6529] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/disaos.php"] [unique_id "aSVT5hG9n7UHEkwDTygWRQAAAFE"]
[Tue Nov 25 14:59:55.711256 2025] [:error] [pid 28842:tid 28995] [client 20.119.245.174:8691] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/disaos.php"] [unique_id "aSVT69NmoaPf6T4-6C00rQAAA0U"]
[Tue Nov 25 14:59:58.261667 2025] [:error] [pid 14168:tid 14191] [client 20.119.245.174:7631] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gdn.php"] [unique_id "aSVT7vR-ZDU0QEgAIIsnngAAANQ"]
[Tue Nov 25 15:00:03.770857 2025] [:error] [pid 14688:tid 14702] [client 20.119.245.174:1980] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gdn.php"] [unique_id "aSVT829vYrBoEsiDnix7yQAAAQw"]
[Tue Nov 25 15:00:04.673945 2025] [:error] [pid 14077:tid 14121] [client 20.119.245.174:7619] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gdn.php"] [unique_id "aSVT9BG9n7UHEkwDTygWegAAAEs"]
[Tue Nov 25 15:00:23.137597 2025] [:error] [pid 28739:tid 28773] [client 20.119.245.174:9175] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/naxc.php"] [unique_id "aSVUBxxGpKmlkG4FexQ89AAAAgs"]
[Tue Nov 25 15:00:25.715736 2025] [:error] [pid 14077:tid 14133] [client 20.119.245.174:4494] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/naxc.php"] [unique_id "aSVUCRG9n7UHEkwDTygW8wAAAFc"]
[Tue Nov 25 15:00:27.942533 2025] [:error] [pid 14078:tid 14149] [client 20.119.245.174:3267] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/naxc.php"] [unique_id "aSVUC9VXYbb0ii_rVoL4DAAAAIw"]
[Tue Nov 25 15:00:29.174035 2025] [:error] [pid 28609:tid 28631] [client 20.119.245.174:1297] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/naxc.php"] [unique_id "aSVUDSGGdT-nZJVs3x2FmgAAAY0"]
[Tue Nov 25 15:00:30.855342 2025] [:error] [pid 14076:tid 14097] [client 20.119.245.174:4801] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aSVUDnsB4Gz6Qw-pvBvNPwAAABA"]
[Tue Nov 25 15:00:32.018469 2025] [:error] [pid 14076:tid 14101] [client 20.119.245.174:4501] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aSVUEHsB4Gz6Qw-pvBvNRgAAABQ"]
[Tue Nov 25 15:00:33.527816 2025] [:error] [pid 14077:tid 14132] [client 20.119.245.174:8939] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aSVUERG9n7UHEkwDTygXBwAAAFY"]
[Tue Nov 25 15:00:40.753277 2025] [:error] [pid 28836:tid 28958] [client 20.119.245.174:4717] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aSVUGJwNRsoxcLQGkTeATAAAAsM"]
[Tue Nov 25 15:00:45.426370 2025] [:error] [pid 28836:tid 29007] [client 20.119.245.174:7992] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/size.php"] [unique_id "aSVUHZwNRsoxcLQGkTeATwAAAtE"]
[Tue Nov 25 15:00:51.578936 2025] [:error] [pid 14077:tid 14134] [client 20.119.245.174:9703] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/size.php"] [unique_id "aSVUIxG9n7UHEkwDTygXGgAAAFg"]
[Tue Nov 25 15:00:54.167214 2025] [:error] [pid 14168:tid 14176] [client 20.119.245.174:6105] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/size.php"] [unique_id "aSVUJvR-ZDU0QEgAIIsnuQAAAMU"]
[Tue Nov 25 15:00:55.481988 2025] [:error] [pid 28739:tid 28780] [client 20.119.245.174:10259] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/size.php"] [unique_id "aSVUJxxGpKmlkG4FexQ8-wAAAhI"]
[Tue Nov 25 15:00:58.708951 2025] [:error] [pid 28609:tid 28635] [client 20.119.245.174:10265] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rsjlrria.php"] [unique_id "aSVUKiGGdT-nZJVs3x2FpwAAAZE"]
[Tue Nov 25 15:01:03.051524 2025] [:error] [pid 14077:tid 14111] [client 20.119.245.174:6274] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rsjlrria.php"] [unique_id "aSVULxG9n7UHEkwDTygXMQAAAEE"]
[Tue Nov 25 15:01:04.457792 2025] [:error] [pid 14168:tid 14185] [client 20.119.245.174:2300] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rsjlrria.php"] [unique_id "aSVUMPR-ZDU0QEgAIIsnvgAAAM4"]
[Tue Nov 25 15:01:06.109096 2025] [:error] [pid 14077:tid 14115] [client 20.119.245.174:6107] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rsjlrria.php"] [unique_id "aSVUMhG9n7UHEkwDTygXNgAAAEU"]
[Tue Nov 25 15:01:08.461081 2025] [:error] [pid 14076:tid 14092] [client 20.119.245.174:9056] [client 20.119.245.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aSVUNHsB4Gz6Qw-pvBvNZgAAAAs"]
[Tue Nov 25 15:01:11.498138 2025] [:error] [pid 28739:tid 28763] [client 20.119.245.174:2248] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gec.php"] [unique_id "aSVUNxxGpKmlkG4FexQ9AwAAAgE"]
[Tue Nov 25 15:01:12.462319 2025] [:error] [pid 28740:tid 28793] [client 20.119.245.174:1528] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gec.php"] [unique_id "aSVUOFppQCoYxWW6V0UuSAAAAkI"]
[Tue Nov 25 15:01:14.222649 2025] [:error] [pid 14077:tid 14120] [client 20.119.245.174:1695] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gec.php"] [unique_id "aSVUOhG9n7UHEkwDTygXTAAAAEo"]
[Tue Nov 25 15:01:15.929023 2025] [:error] [pid 28836:tid 28964] [client 20.119.245.174:6418] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gec.php"] [unique_id "aSVUO5wNRsoxcLQGkTeAYAAAAsk"]
[Tue Nov 25 15:01:19.379248 2025] [:error] [pid 28609:tid 28618] [client 20.119.245.174:8572] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/gec.php"] [unique_id "aSVUPyGGdT-nZJVs3x2FtgAAAYA"]
[Tue Nov 25 15:01:20.713879 2025] [:error] [pid 14078:tid 14143] [client 20.119.245.174:8515] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/gec.php"] [unique_id "aSVUQNVXYbb0ii_rVoL4NwAAAIY"]
[Tue Nov 25 15:01:34.819888 2025] [:error] [pid 28739:tid 28782] [client 20.119.245.174:5229] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e56.php"] [unique_id "aSVUThxGpKmlkG4FexQ9GwAAAhQ"]
[Tue Nov 25 15:01:35.814531 2025] [:error] [pid 14077:tid 14116] [client 20.119.245.174:2878] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e56.php"] [unique_id "aSVUTxG9n7UHEkwDTygXbgAAAEY"]
[Tue Nov 25 15:01:38.659281 2025] [:error] [pid 14688:tid 14703] [client 20.119.245.174:7560] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e56.php"] [unique_id "aSVUUm9vYrBoEsiDnix78gAAAQ0"]
[Tue Nov 25 15:01:43.035050 2025] [:error] [pid 28842:tid 29024] [client 20.119.245.174:3161] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e56.php"] [unique_id "aSVUV9NmoaPf6T4-6C01CAAAA1Y"]
[Tue Nov 25 15:01:50.663896 2025] [:error] [pid 14076:tid 14098] [client 20.119.245.174:5671] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-x.php"] [unique_id "aSVUXnsB4Gz6Qw-pvBvNjQAAABE"]
[Tue Nov 25 15:01:51.546624 2025] [:error] [pid 28609:tid 28629] [client 20.119.245.174:10413] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-x.php"] [unique_id "aSVUXyGGdT-nZJVs3x2FyAAAAYs"]
[Tue Nov 25 15:01:53.632509 2025] [:error] [pid 14078:tid 14155] [client 20.119.245.174:3977] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-x.php"] [unique_id "aSVUYdVXYbb0ii_rVoL4WAAAAJI"]
[Tue Nov 25 15:02:00.041269 2025] [:error] [pid 14077:tid 14118] [client 20.119.245.174:8827] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aSVUaBG9n7UHEkwDTygXugAAAEg"]
[Tue Nov 25 15:02:07.195835 2025] [:error] [pid 28609:tid 28628] [client 20.119.245.174:4587] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aSVUbyGGdT-nZJVs3x2GIQAAAYo"]
[Tue Nov 25 15:02:08.368530 2025] [:error] [pid 28609:tid 28630] [client 20.119.245.174:5443] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aSVUcCGGdT-nZJVs3x2GJwAAAYw"]
[Tue Nov 25 15:02:11.411650 2025] [:error] [pid 28740:tid 28814] [client 20.119.245.174:9483] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aSVUc1ppQCoYxWW6V0UukgAAAlc"]
[Tue Nov 25 15:02:13.230153 2025] [:error] [pid 14077:tid 14112] [client 20.119.245.174:4571] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aSVUdRG9n7UHEkwDTygXxAAAAEI"]
[Tue Nov 25 15:02:20.051852 2025] [:error] [pid 14078:tid 14153] [client 20.119.245.174:1996] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aSVUfNVXYbb0ii_rVoL4yQAAAJA"]
[Tue Nov 25 15:02:24.088048 2025] [:error] [pid 28609:tid 28625] [client 20.119.245.174:5515] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aSVUgCGGdT-nZJVs3x2GLwAAAYc"]
[Tue Nov 25 15:02:26.322644 2025] [:error] [pid 14077:tid 14116] [client 20.119.245.174:3245] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aSVUghG9n7UHEkwDTygX0wAAAEY"]
[Tue Nov 25 15:02:57.395141 2025] [:error] [pid 14168:tid 14173] [client 20.119.245.174:4122] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aSVUofR-ZDU0QEgAIIsobwAAAMI"]
[Tue Nov 25 15:02:58.500971 2025] [:error] [pid 14076:tid 14103] [client 20.119.245.174:9575] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aSVUonsB4Gz6Qw-pvBvN1wAAABY"]
[Tue Nov 25 15:03:00.124612 2025] [:error] [pid 28609:tid 28639] [client 20.119.245.174:8041] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aSVUpCGGdT-nZJVs3x2GOwAAAZU"]
[Tue Nov 25 15:03:02.034158 2025] [:error] [pid 14076:tid 14085] [client 20.119.245.174:4634] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aSVUpnsB4Gz6Qw-pvBvN3AAAAAQ"]
[Tue Nov 25 15:03:04.154214 2025] [:error] [pid 28842:tid 28997] [client 20.119.245.174:9818] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "aSVUqNNmoaPf6T4-6C01PgAAA0c"]
[Tue Nov 25 15:03:05.775902 2025] [:error] [pid 14078:tid 14158] [client 20.119.245.174:9619] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "aSVUqdVXYbb0ii_rVoL45AAAAJU"]
[Tue Nov 25 15:03:09.689997 2025] [:error] [pid 28842:tid 28994] [client 20.119.245.174:6769] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "aSVUrdNmoaPf6T4-6C01RAAAA0Q"]
[Tue Nov 25 15:03:15.979496 2025] [:error] [pid 14076:tid 14096] [client 20.119.245.174:6762] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "aSVUs3sB4Gz6Qw-pvBvN4gAAAA8"]
[Tue Nov 25 15:03:18.082074 2025] [:error] [pid 14168:tid 14193] [client 20.119.245.174:4902] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NewFile.php"] [unique_id "aSVUtvR-ZDU0QEgAIIsofgAAANY"]
[Tue Nov 25 15:03:19.267675 2025] [:error] [pid 14076:tid 14091] [client 20.119.245.174:9827] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NewFile.php"] [unique_id "aSVUt3sB4Gz6Qw-pvBvN8wAAAAo"]
[Tue Nov 25 15:03:23.056531 2025] [:error] [pid 14077:tid 14131] [client 20.119.245.174:7356] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NewFile.php"] [unique_id "aSVUuxG9n7UHEkwDTygYKwAAAFU"]
[Tue Nov 25 15:03:24.079651 2025] [:error] [pid 14168:tid 14185] [client 20.119.245.174:9792] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NewFile.php"] [unique_id "aSVUvPR-ZDU0QEgAIIsogQAAAM4"]
[Tue Nov 25 15:03:25.023414 2025] [:error] [pid 14076:tid 14091] [client 20.119.245.174:9835] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t.php"] [unique_id "aSVUvXsB4Gz6Qw-pvBvN9gAAAAo"]
[Tue Nov 25 15:03:33.343992 2025] [:error] [pid 28739:tid 28769] [client 20.119.245.174:3936] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t.php"] [unique_id "aSVUxRxGpKmlkG4FexQ9iwAAAgc"]
[Tue Nov 25 15:03:38.890082 2025] [:error] [pid 28609:tid 28626] [client 20.119.245.174:7313] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t.php"] [unique_id "aSVUyiGGdT-nZJVs3x2GVwAAAYg"]
[Tue Nov 25 15:03:42.658047 2025] [:error] [pid 14078:tid 14154] [client 20.119.245.174:4996] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ee.php"] [unique_id "aSVUztVXYbb0ii_rVoL48AAAAJE"]
[Tue Nov 25 15:03:46.834134 2025] [:error] [pid 28836:tid 28955] [client 20.119.245.174:6007] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ee.php"] [unique_id "aSVU0pwNRsoxcLQGkTeBAwAAAsA"]
[Tue Nov 25 15:03:49.440001 2025] [:error] [pid 14076:tid 14101] [client 20.119.245.174:6003] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ee.php"] [unique_id "aSVU1XsB4Gz6Qw-pvBvOBgAAABQ"]
[Tue Nov 25 15:03:50.694826 2025] [:error] [pid 14076:tid 14102] [client 20.119.245.174:9341] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ee.php"] [unique_id "aSVU1nsB4Gz6Qw-pvBvOCAAAABU"]
[Tue Nov 25 15:03:54.914446 2025] [:error] [pid 28740:tid 28814] [client 20.119.245.174:9800] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aSVU2lppQCoYxWW6V0UuugAAAlc"]
[Tue Nov 25 15:04:07.440586 2025] [:error] [pid 28836:tid 28966] [client 20.119.245.174:6979] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aSVU55wNRsoxcLQGkTeBHAAAAss"]
[Tue Nov 25 15:04:14.753495 2025] [:error] [pid 28609:tid 28618] [client 20.119.245.174:6049] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aSVU7iGGdT-nZJVs3x2GcQAAAYA"]
[Tue Nov 25 15:04:15.691442 2025] [:error] [pid 14688:tid 14714] [client 20.119.245.174:6897] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aSVU729vYrBoEsiDnix8ZwAAARg"]
[Tue Nov 25 15:04:18.622526 2025] [:error] [pid 14168:tid 14181] [client 20.119.245.174:8654] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aSVU8vR-ZDU0QEgAIIsopAAAAMo"]
[Tue Nov 25 15:04:19.590201 2025] [:error] [pid 28842:tid 29022] [client 20.119.245.174:8209] [client 20.119.245.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aSVU89NmoaPf6T4-6C01bQAAA1Q"]
[Tue Nov 25 15:04:20.373995 2025] [:error] [pid 28842:tid 29021] [client 20.119.245.174:6553] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "aSVU9NNmoaPf6T4-6C01cQAAA1M"]
[Tue Nov 25 15:04:23.864848 2025] [:error] [pid 28740:tid 28800] [client 20.119.245.174:7228] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "aSVU91ppQCoYxWW6V0Uu1gAAAkk"]
[Tue Nov 25 15:04:26.867450 2025] [:error] [pid 14077:tid 14116] [client 20.119.245.174:8682] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "aSVU-hG9n7UHEkwDTygYggAAAEY"]
[Tue Nov 25 15:04:28.278445 2025] [:error] [pid 14078:tid 14147] [client 20.119.245.174:6854] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "aSVU_NVXYbb0ii_rVoL5FAAAAIo"]
[Tue Nov 25 15:04:29.075839 2025] [:error] [pid 14077:tid 14114] [client 20.119.245.174:1787] [client 20.119.245.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aSVU_RG9n7UHEkwDTygYkwAAAEQ"]
[Tue Nov 25 15:04:32.130676 2025] [:error] [pid 14078:tid 14143] [client 20.119.245.174:2472] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/license.php"] [unique_id "aSVVANVXYbb0ii_rVoL5FgAAAIY"]
[Tue Nov 25 15:04:35.009695 2025] [:error] [pid 14168:tid 14180] [client 20.119.245.174:2480] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/license.php"] [unique_id "aSVVA_R-ZDU0QEgAIIsovAAAAMk"]
[Tue Nov 25 15:04:41.331534 2025] [:error] [pid 28842:tid 29004] [client 20.119.245.174:9182] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/license.php"] [unique_id "aSVVCdNmoaPf6T4-6C01kgAAA04"]
[Tue Nov 25 15:04:43.591654 2025] [:error] [pid 14168:tid 14186] [client 20.119.245.174:5940] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aSVVC_R-ZDU0QEgAIIsowQAAAM8"]
[Tue Nov 25 15:04:47.411909 2025] [:error] [pid 14078:tid 14160] [client 20.119.245.174:5946] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aSVVD9VXYbb0ii_rVoL5KgAAAJc"]
[Tue Nov 25 15:04:50.621928 2025] [:error] [pid 28842:tid 28994] [client 20.119.245.174:8898] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aSVVEtNmoaPf6T4-6C01kwAAA0Q"]
[Tue Nov 25 15:04:57.971128 2025] [:error] [pid 14076:tid 14090] [client 20.119.245.174:5830] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aSVVGXsB4Gz6Qw-pvBvOQAAAAAk"]
[Tue Nov 25 15:05:00.819202 2025] [:error] [pid 14688:tid 14706] [client 20.119.245.174:9879] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aSVVHG9vYrBoEsiDnix8kgAAARA"]
[Tue Nov 25 15:05:02.036958 2025] [:error] [pid 14168:tid 14175] [client 20.119.245.174:1064] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aSVVHvR-ZDU0QEgAIIso7AAAAMQ"]
[Tue Nov 25 15:05:05.833193 2025] [:error] [pid 28739:tid 28778] [client 20.119.245.174:9718] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aSVVIRxGpKmlkG4FexQ91QAAAhA"]
[Tue Nov 25 15:05:14.923438 2025] [:error] [pid 28836:tid 28958] [client 20.119.245.174:4673] [client 20.119.245.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aSVVKpwNRsoxcLQGkTeBagAAAsM"]
[Tue Nov 25 15:05:17.921657 2025] [autoindex:error] [pid 28842:tid 28995] [client 20.119.245.174:7970] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 25 15:05:21.939927 2025] [:error] [pid 28842:tid 29002] [client 20.119.245.174:7970] [client 20.119.245.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSVVMdNmoaPf6T4-6C011wAAA0w"]
[Tue Nov 25 15:05:29.702420 2025] [:error] [pid 28740:tid 28796] [client 20.119.245.174:8462] [client 20.119.245.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.119.245.174, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSVVOVppQCoYxWW6V0UvBgAAAkU"]
[Tue Nov 25 15:05:32.159635 2025] [:error] [pid 14077:tid 14111] [client 20.119.245.174:8495] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aSVVPBG9n7UHEkwDTygZEwAAAEE"]
[Tue Nov 25 15:05:33.923686 2025] [:error] [pid 28836:tid 29007] [client 20.119.245.174:9085] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aSVVPZwNRsoxcLQGkTeBiAAAAtE"]
[Tue Nov 25 15:05:35.048325 2025] [:error] [pid 14168:tid 14183] [client 20.119.245.174:9356] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aSVVP_R-ZDU0QEgAIIspDQAAAMw"]
[Tue Nov 25 15:05:39.629501 2025] [:error] [pid 14077:tid 14112] [client 20.119.245.174:5314] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aSVVQxG9n7UHEkwDTygZIQAAAEI"]
[Tue Nov 25 15:05:41.037705 2025] [:error] [pid 14076:tid 14084] [client 20.119.245.174:6135] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aSVVRXsB4Gz6Qw-pvBvOjQAAAAM"]
[Tue Nov 25 15:05:41.548487 2025] [:error] [pid 28739:tid 28769] [client 20.119.245.174:6122] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aSVVRRxGpKmlkG4FexQ95wAAAgc"]
[Tue Nov 25 15:05:43.500323 2025] [:error] [pid 28739:tid 28768] [client 20.119.245.174:9044] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aSVVRxxGpKmlkG4FexQ96gAAAgY"]
[Tue Nov 25 15:05:46.623236 2025] [:error] [pid 14076:tid 14103] [client 20.119.245.174:3755] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aSVVSnsB4Gz6Qw-pvBvOkgAAABY"]
[Tue Nov 25 15:05:47.908056 2025] [:error] [pid 14077:tid 14120] [client 20.119.245.174:4738] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aSVVSxG9n7UHEkwDTygZMQAAAEo"]
[Tue Nov 25 15:05:51.205495 2025] [:error] [pid 28739:tid 28779] [client 20.119.245.174:9061] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aSVVTxxGpKmlkG4FexQ97wAAAhE"]
[Tue Nov 25 15:05:54.517511 2025] [:error] [pid 14077:tid 14123] [client 20.119.245.174:4782] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aSVVUhG9n7UHEkwDTygZXAAAAE0"]
[Tue Nov 25 15:05:56.263466 2025] [:error] [pid 14688:tid 14693] [client 20.119.245.174:1231] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aSVVVG9vYrBoEsiDnix8tAAAAQM"]
[Tue Nov 25 15:05:57.971733 2025] [:error] [pid 28842:tid 28992] [client 20.119.245.174:4740] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aSVVVdNmoaPf6T4-6C018QAAA0I"]
[Tue Nov 25 15:05:58.611918 2025] [:error] [pid 14077:tid 14130] [client 20.119.245.174:6437] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aSVVVhG9n7UHEkwDTygZbwAAAFQ"]
[Tue Nov 25 15:06:02.474803 2025] [:error] [pid 28740:tid 28801] [client 20.119.245.174:8533] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aSVVWlppQCoYxWW6V0UvIgAAAko"]
[Tue Nov 25 15:06:04.368241 2025] [:error] [pid 14078:tid 14142] [client 20.119.245.174:5164] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aSVVXNVXYbb0ii_rVoL5jwAAAIU"]
[Tue Nov 25 15:06:05.929991 2025] [:error] [pid 14076:tid 14085] [client 20.119.245.174:7377] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cron.php"] [unique_id "aSVVXXsB4Gz6Qw-pvBvOxwAAAAQ"]
[Tue Nov 25 15:06:07.054168 2025] [:error] [pid 28836:tid 28956] [client 20.119.245.174:5146] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cron.php"] [unique_id "aSVVX5wNRsoxcLQGkTeBpgAAAsE"]
[Tue Nov 25 15:06:08.605941 2025] [:error] [pid 28609:tid 28634] [client 20.119.245.174:5141] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cron.php"] [unique_id "aSVVYCGGdT-nZJVs3x2G8wAAAZA"]
[Tue Nov 25 15:06:10.164687 2025] [:error] [pid 14168:tid 14179] [client 20.119.245.174:3138] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cron.php"] [unique_id "aSVVYvR-ZDU0QEgAIIspMgAAAMg"]
[Tue Nov 25 15:06:22.122617 2025] [:error] [pid 14076:tid 14081] [client 20.119.245.174:1423] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yanz.php"] [unique_id "aSVVbnsB4Gz6Qw-pvBvO5gAAAAA"]
[Tue Nov 25 15:06:25.438976 2025] [:error] [pid 14077:tid 14123] [client 20.119.245.174:1162] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yanz.php"] [unique_id "aSVVcRG9n7UHEkwDTygZiAAAAE0"]
[Tue Nov 25 15:06:41.799322 2025] [:error] [pid 14688:tid 14705] [client 20.119.245.174:7243] [client 20.119.245.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aSVVgW9vYrBoEsiDnix8zQAAAQ8"]
[Tue Nov 25 15:06:43.485960 2025] [:error] [pid 14168:tid 14194] [client 20.119.245.174:5811] [client 20.119.245.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aSVVg_R-ZDU0QEgAIIspZwAAANc"]
[Tue Nov 25 15:06:49.780739 2025] [:error] [pid 14168:tid 14171] [client 20.119.245.174:7844] [client 20.119.245.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "aSVVifR-ZDU0QEgAIIspbwAAAMA"]
[Tue Nov 25 15:06:57.745531 2025] [proxy_fcgi:error] [pid 14077:tid 14127] [client 20.119.245.174:6347] AH01071: Got error 'Primary script unknown'
[Tue Nov 25 15:06:58.902023 2025] [:error] [pid 14077:tid 14134] [client 20.119.245.174:6347] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/pwnd/as.php"] [unique_id "aSVVkhG9n7UHEkwDTygZ1QAAAFg"]
[Tue Nov 25 15:07:00.044523 2025] [:error] [pid 14076:tid 14084] [client 20.119.245.174:1826] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/pwnd/as.php"] [unique_id "aSVVlHsB4Gz6Qw-pvBvPEgAAAAM"]
[Tue Nov 25 15:07:04.337024 2025] [:error] [pid 14688:tid 14710] [client 20.119.245.174:2014] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/pwnd/as.php"] [unique_id "aSVVmG9vYrBoEsiDnix81QAAARQ"]
[Tue Nov 25 15:07:05.581089 2025] [:error] [pid 14168:tid 14177] [client 20.119.245.174:3234] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/pwnd/as.php"] [unique_id "aSVVmfR-ZDU0QEgAIIspiAAAAMY"]
[Tue Nov 25 15:07:08.966309 2025] [:error] [pid 14078:tid 14142] [client 20.119.245.174:7875] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-configs.php"] [unique_id "aSVVnNVXYbb0ii_rVoL55AAAAIU"]
[Tue Nov 25 15:07:11.407504 2025] [:error] [pid 28740:tid 28795] [client 20.119.245.174:9479] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-configs.php"] [unique_id "aSVVn1ppQCoYxWW6V0UvVAAAAkQ"]
[Tue Nov 25 15:07:13.055195 2025] [:error] [pid 28842:tid 29024] [client 20.119.245.174:8084] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-configs.php"] [unique_id "aSVVodNmoaPf6T4-6C02MwAAA1Y"]
[Tue Nov 25 15:07:18.048455 2025] [:error] [pid 14077:tid 14129] [client 20.119.245.174:8102] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-configs.php"] [unique_id "aSVVphG9n7UHEkwDTygaEAAAAFM"]
[Tue Nov 25 15:07:19.518833 2025] [:error] [pid 14077:tid 14130] [client 20.119.245.174:5725] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSVVpxG9n7UHEkwDTygaGQAAAFQ"]
[Tue Nov 25 15:07:23.363741 2025] [:error] [pid 14076:tid 14102] [client 20.119.245.174:4071] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSVVq3sB4Gz6Qw-pvBvPKwAAABU"]
[Tue Nov 25 15:07:24.359722 2025] [:error] [pid 28842:tid 29020] [client 20.119.245.174:6773] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSVVrNNmoaPf6T4-6C02NwAAA1I"]
[Tue Nov 25 15:07:27.815447 2025] [:error] [pid 28739:tid 28776] [client 20.119.245.174:5733] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSVVrxxGpKmlkG4FexQ-RgAAAg4"]
[Tue Nov 25 15:07:29.271841 2025] [:error] [pid 14077:tid 14130] [client 20.119.245.174:5716] [client 20.119.245.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/zmFM.php"] [unique_id "aSVVsRG9n7UHEkwDTygaKwAAAFQ"]
[Tue Nov 25 15:07:30.205439 2025] [:error] [pid 14078:tid 14151] [client 20.119.245.174:8061] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aSVVstVXYbb0ii_rVoL5-wAAAI4"]
[Tue Nov 25 15:07:31.585692 2025] [:error] [pid 14688:tid 14692] [client 20.119.245.174:6734] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aSVVs29vYrBoEsiDnix83wAAAQI"]
[Tue Nov 25 15:07:36.008324 2025] [:error] [pid 14077:tid 14116] [client 20.119.245.174:5751] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aSVVuBG9n7UHEkwDTygaPAAAAEY"]
[Tue Nov 25 15:07:40.043838 2025] [:error] [pid 14688:tid 14708] [client 20.119.245.174:8003] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/fucku.php"] [unique_id "aSVVvG9vYrBoEsiDnix85gAAARI"]
[Tue Nov 25 15:07:44.455342 2025] [:error] [pid 14078:tid 14156] [client 20.119.245.174:6164] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/fucku.php"] [unique_id "aSVVwNVXYbb0ii_rVoL6BQAAAJM"]
[Tue Nov 25 15:07:49.301492 2025] [:error] [pid 28842:tid 29022] [client 20.119.245.174:1872] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/fucku.php"] [unique_id "aSVVxdNmoaPf6T4-6C02QgAAA1Q"]
[Tue Nov 25 15:07:50.510634 2025] [:error] [pid 14688:tid 14711] [client 20.119.245.174:7314] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/fucku.php"] [unique_id "aSVVxm9vYrBoEsiDnix87gAAARU"]
[Tue Nov 25 15:07:55.692973 2025] [:error] [pid 28836:tid 29009] [client 20.119.245.174:9734] [client 20.119.245.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/wp-info.php"] [unique_id "aSVVy5wNRsoxcLQGkTeB-AAAAtM"]
[Tue Nov 25 15:08:03.240026 2025] [proxy_fcgi:error] [pid 28740:tid 28797] [client 20.119.245.174:9554] AH01071: Got error 'Primary script unknown'
[Tue Nov 25 15:39:06.030425 2025] [:error] [pid 28836:tid 28960] [client 185.215.180.158:48552] [client 185.215.180.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.215.180.158, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSVdGpwNRsoxcLQGkTeMHAAAAsU"]
[Tue Nov 25 15:54:00.131014 2025] [:error] [pid 2987:tid 3008] [client 162.241.224.119:53376] [client 162.241.224.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.224.119, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSVgmM-djEt-pTzPxnxnBwAAAVM"]
[Tue Nov 25 15:54:01.622060 2025] [:error] [pid 28739:tid 28782] [client 162.241.224.119:53392] [client 162.241.224.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.224.119, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSVgmRxGpKmlkG4FexRLegAAAhQ"]
[Tue Nov 25 16:44:04.175862 2025] [:error] [pid 28836:tid 29011] [client 194.67.109.194:57158] [client 194.67.109.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.67.109.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSVsVJwNRsoxcLQGkTeZzgAAAtU"]
[Tue Nov 25 17:03:32.584026 2025] [:error] [pid 14077:tid 14127] [client 123.187.240.242:59322] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aSVw5BG9n7UHEkwDTyhOEQAAAFE"]
[Tue Nov 25 17:44:57.698639 2025] [:error] [pid 14077:tid 14131] [client 51.91.186.167:18807] [client 51.91.186.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.91.186.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSV6mRG9n7UHEkwDTyhe3gAAAFU"]
[Tue Nov 25 18:35:45.060744 2025] [:error] [pid 14076:tid 14086] [client 4.251.107.128:22798] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "aSWGgXsB4Gz6Qw-pvBsFTAAAAAU"]
[Tue Nov 25 18:35:49.188160 2025] [:error] [pid 14077:tid 14131] [client 4.251.107.128:22834] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "aSWGhRG9n7UHEkwDTyh2EgAAAFU"]
[Tue Nov 25 18:35:51.426574 2025] [:error] [pid 14077:tid 14134] [client 4.251.107.128:22815] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "aSWGhxG9n7UHEkwDTyh2FAAAAFg"]
[Tue Nov 25 18:36:01.000350 2025] [:error] [pid 14078:tid 14158] [client 4.251.107.128:22863] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d2.php"] [unique_id "aSWGkNVXYbb0ii_rVoIyzQAAAJU"]
[Tue Nov 25 18:36:01.919669 2025] [:error] [pid 28739:tid 28779] [client 4.251.107.128:22857] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d2.php"] [unique_id "aSWGkRxGpKmlkG4FexRsDAAAAhE"]
[Tue Nov 25 18:36:09.871697 2025] [:error] [pid 2987:tid 2995] [client 4.251.107.128:22827] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d2.php"] [unique_id "aSWGmc-djEt-pTzPxnyPaAAAAUY"]
[Tue Nov 25 18:36:12.409227 2025] [:error] [pid 14076:tid 14092] [client 4.251.107.128:22837] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d2.php"] [unique_id "aSWGnHsB4Gz6Qw-pvBsFuQAAAAs"]
[Tue Nov 25 18:36:15.131784 2025] [:error] [pid 14076:tid 14101] [client 4.251.107.128:22818] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/snus.php"] [unique_id "aSWGn3sB4Gz6Qw-pvBsFuwAAABQ"]
[Tue Nov 25 18:36:16.388359 2025] [:error] [pid 28739:tid 28777] [client 4.251.107.128:22791] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/snus.php"] [unique_id "aSWGoBxGpKmlkG4FexRsHgAAAg8"]
[Tue Nov 25 18:36:18.043692 2025] [:error] [pid 14078:tid 14147] [client 4.251.107.128:22864] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/snus.php"] [unique_id "aSWGotVXYbb0ii_rVoIy1AAAAIo"]
[Tue Nov 25 18:36:21.069898 2025] [:error] [pid 14078:tid 14148] [client 4.251.107.128:22787] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/snus.php"] [unique_id "aSWGpdVXYbb0ii_rVoIy2QAAAIs"]
[Tue Nov 25 18:36:25.109926 2025] [:error] [pid 28609:tid 28630] [client 4.251.107.128:22819] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/011i.php"] [unique_id "aSWGqSGGdT-nZJVs3x21XQAAAYw"]
[Tue Nov 25 18:36:26.587298 2025] [:error] [pid 2987:tid 3012] [client 4.251.107.128:22823] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/011i.php"] [unique_id "aSWGqs-djEt-pTzPxnyPbwAAAVc"]
[Tue Nov 25 18:36:30.217865 2025] [:error] [pid 28842:tid 29021] [client 4.251.107.128:22918] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/011i.php"] [unique_id "aSWGrtNmoaPf6T4-6C1-QQAAA1M"]
[Tue Nov 25 18:36:32.445271 2025] [:error] [pid 28842:tid 29002] [client 4.251.107.128:22817] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/011i.php"] [unique_id "aSWGsNNmoaPf6T4-6C1-QgAAA0w"]
[Tue Nov 25 18:36:41.435945 2025] [:error] [pid 14078:tid 14149] [client 4.251.107.128:22856] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/disaos.php"] [unique_id "aSWGudVXYbb0ii_rVoIy3gAAAIw"]
[Tue Nov 25 18:37:10.897324 2025] [:error] [pid 14168:tid 14191] [client 4.251.107.128:22838] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "aSWG1vR-ZDU0QEgAIItYGAAAANQ"]
[Tue Nov 25 18:37:22.531076 2025] [:error] [pid 14077:tid 14122] [client 4.251.107.128:22840] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "aSWG4hG9n7UHEkwDTyh2mAAAAEw"]
[Tue Nov 25 18:37:30.709721 2025] [:error] [pid 28836:tid 28964] [client 4.251.107.128:22801] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/naxc.php"] [unique_id "aSWG6pwNRsoxcLQGkTeywQAAAsk"]
[Tue Nov 25 18:37:32.070501 2025] [:error] [pid 28740:tid 28799] [client 4.251.107.128:22836] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/naxc.php"] [unique_id "aSWG7FppQCoYxWW6V0VtcgAAAkg"]
[Tue Nov 25 18:38:24.185758 2025] [:error] [pid 14076:tid 14088] [client 4.251.107.128:22825] [client 4.251.107.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aSWHIHsB4Gz6Qw-pvBsGVwAAAAc"]
[Tue Nov 25 18:38:40.238798 2025] [:error] [pid 14168:tid 14179] [client 4.251.107.128:22867] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aSWHMPR-ZDU0QEgAIItYfwAAAMg"]
[Tue Nov 25 18:38:43.022745 2025] [:error] [pid 14168:tid 14189] [client 4.251.107.128:22835] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aSWHM_R-ZDU0QEgAIItYgQAAANI"]
[Tue Nov 25 18:38:44.360161 2025] [:error] [pid 28739:tid 28772] [client 4.251.107.128:22941] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aSWHNBxGpKmlkG4FexRsdAAAAgo"]
[Tue Nov 25 18:38:45.996653 2025] [:error] [pid 28739:tid 28771] [client 4.251.107.128:22852] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aSWHNRxGpKmlkG4FexRsdwAAAgk"]
[Tue Nov 25 18:39:05.079983 2025] [:error] [pid 2987:tid 2991] [client 4.251.107.128:22792] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/product.php"] [unique_id "aSWHSc-djEt-pTzPxnyPzQAAAUI"]
[Tue Nov 25 18:39:09.377037 2025] [:error] [pid 28842:tid 28996] [client 4.251.107.128:22832] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/product.php"] [unique_id "aSWHTdNmoaPf6T4-6C1--gAAA0Y"]
[Tue Nov 25 18:39:10.707357 2025] [:error] [pid 28609:tid 28630] [client 4.251.107.128:22822] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/product.php"] [unique_id "aSWHTiGGdT-nZJVs3x211gAAAYw"]
[Tue Nov 25 18:39:17.520321 2025] [:error] [pid 14077:tid 14112] [client 4.251.107.128:22850] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/product.php"] [unique_id "aSWHVRG9n7UHEkwDTyh3DQAAAEI"]
[Tue Nov 25 18:39:27.739214 2025] [:error] [pid 28842:tid 28994] [client 4.251.107.128:22871] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e56.php"] [unique_id "aSWHX9NmoaPf6T4-6C1_AQAAA0Q"]
[Tue Nov 25 18:39:31.901655 2025] [:error] [pid 28740:tid 28809] [client 4.251.107.128:22803] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e56.php"] [unique_id "aSWHY1ppQCoYxWW6V0VuOAAAAlI"]
[Tue Nov 25 18:39:33.933381 2025] [:error] [pid 14077:tid 14115] [client 4.251.107.128:22915] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-x.php"] [unique_id "aSWHZRG9n7UHEkwDTyh3HQAAAEU"]
[Tue Nov 25 18:39:53.974751 2025] [:error] [pid 14168:tid 14178] [client 4.251.107.128:22876] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aSWHefR-ZDU0QEgAIItYxAAAAMc"]
[Tue Nov 25 18:39:57.066656 2025] [:error] [pid 14077:tid 14124] [client 4.251.107.128:22794] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aSWHfRG9n7UHEkwDTyh3OQAAAE4"]
[Tue Nov 25 18:39:58.475412 2025] [:error] [pid 28739:tid 28769] [client 4.251.107.128:22808] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aSWHfhxGpKmlkG4FexRspgAAAgc"]
[Tue Nov 25 18:40:03.943367 2025] [:error] [pid 14077:tid 14119] [client 4.251.107.128:22865] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aSWHgxG9n7UHEkwDTyh3XgAAAEk"]
[Tue Nov 25 18:40:08.942908 2025] [:error] [pid 28739:tid 28768] [client 4.251.107.128:22814] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r.php"] [unique_id "aSWHiBxGpKmlkG4FexRsrgAAAgY"]
[Tue Nov 25 18:40:10.090989 2025] [:error] [pid 28740:tid 28792] [client 4.251.107.128:22834] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r.php"] [unique_id "aSWHilppQCoYxWW6V0VuWwAAAkE"]
[Tue Nov 25 18:40:15.941932 2025] [:error] [pid 28740:tid 28795] [client 4.251.107.128:22858] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r.php"] [unique_id "aSWHj1ppQCoYxWW6V0VuXwAAAkQ"]
[Tue Nov 25 18:40:26.296945 2025] [:error] [pid 28836:tid 28963] [client 4.251.107.128:22860] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v4.php"] [unique_id "aSWHmpwNRsoxcLQGkTeziAAAAsg"]
[Tue Nov 25 18:41:17.752787 2025] [:error] [pid 28836:tid 29011] [client 4.251.107.128:22820] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aSWHzZwNRsoxcLQGkTezwAAAAtU"]
[Tue Nov 25 18:41:19.713148 2025] [:error] [pid 14076:tid 14091] [client 4.251.107.128:22862] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aSWHz3sB4Gz6Qw-pvBsG-QAAAAo"]
[Tue Nov 25 18:41:45.672469 2025] [:error] [pid 14168:tid 14172] [client 4.251.107.128:22839] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/go.php"] [unique_id "aSWH6fR-ZDU0QEgAIItZLwAAAME"]
[Tue Nov 25 18:41:50.864164 2025] [:error] [pid 28842:tid 28991] [client 4.251.107.128:22864] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "aSWH7tNmoaPf6T4-6C1_kgAAA0E"]
[Tue Nov 25 18:41:52.388030 2025] [:error] [pid 14077:tid 14117] [client 4.251.107.128:22866] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "aSWH8BG9n7UHEkwDTyh4FAAAAEc"]
[Tue Nov 25 18:41:55.021963 2025] [:error] [pid 14078:tid 14151] [client 4.251.107.128:22827] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "aSWH89VXYbb0ii_rVoI0MgAAAI4"]
[Tue Nov 25 18:42:03.520039 2025] [:error] [pid 14078:tid 14152] [client 4.251.107.128:22848] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "aSWH-9VXYbb0ii_rVoI0PAAAAI8"]
[Tue Nov 25 18:42:08.448647 2025] [:error] [pid 28740:tid 28812] [client 4.251.107.128:22826] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aSWIAFppQCoYxWW6V0VuwQAAAlU"]
[Tue Nov 25 18:42:26.377750 2025] [:error] [pid 14078:tid 14137] [client 4.251.107.128:22818] [client 4.251.107.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aSWIEtVXYbb0ii_rVoI0TQAAAIA"]
[Tue Nov 25 18:42:31.741733 2025] [:error] [pid 28739:tid 28762] [client 4.251.107.128:22813] [client 4.251.107.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aSWIFxxGpKmlkG4FexRtowAAAgA"]
[Tue Nov 25 18:42:42.807145 2025] [:error] [pid 14078:tid 14155] [client 4.251.107.128:22833] [client 4.251.107.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aSWIItVXYbb0ii_rVoI0dgAAAJI"]
[Tue Nov 25 18:42:46.535738 2025] [autoindex:error] [pid 28609:tid 28632] [client 4.251.107.128:22805] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 25 18:42:48.859031 2025] [:error] [pid 28609:tid 28626] [client 4.251.107.128:22805] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aSWIKCGGdT-nZJVs3x22iQAAAYg"]
[Tue Nov 25 18:42:53.006052 2025] [:error] [pid 14168:tid 14178] [client 4.251.107.128:22829] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aSWILfR-ZDU0QEgAIItZUQAAAMc"]
[Tue Nov 25 18:42:54.920033 2025] [:error] [pid 14077:tid 14117] [client 4.251.107.128:22836] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aSWILhG9n7UHEkwDTyh4VQAAAEc"]
[Tue Nov 25 18:42:56.717718 2025] [:error] [pid 28740:tid 28801] [client 4.251.107.128:22787] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aSWIMFppQCoYxWW6V0VvGQAAAko"]
[Tue Nov 25 18:42:59.511836 2025] [:error] [pid 14077:tid 14132] [client 4.251.107.128:22854] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSWIMxG9n7UHEkwDTyh4YQAAAFY"]
[Tue Nov 25 18:43:02.459633 2025] [:error] [pid 14168:tid 14191] [client 4.251.107.128:22825] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSWINvR-ZDU0QEgAIItZWwAAANQ"]
[Tue Nov 25 18:43:05.088079 2025] [:error] [pid 28609:tid 28636] [client 4.251.107.128:22918] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSWIOSGGdT-nZJVs3x22kgAAAZI"]
[Tue Nov 25 18:43:07.452138 2025] [:error] [pid 28842:tid 29023] [client 4.251.107.128:22801] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aSWIO9NmoaPf6T4-6C1_1wAAA1U"]
[Tue Nov 25 18:43:08.845097 2025] [:error] [pid 14076:tid 14096] [client 4.251.107.128:22931] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/marijuana.php"] [unique_id "aSWIPHsB4Gz6Qw-pvBsHtgAAAA8"]
[Tue Nov 25 18:43:11.498235 2025] [:error] [pid 28739:tid 28776] [client 4.251.107.128:22870] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/marijuana.php"] [unique_id "aSWIPxxGpKmlkG4FexRtuQAAAg4"]
[Tue Nov 25 18:43:16.613833 2025] [:error] [pid 28740:tid 28796] [client 4.251.107.128:22821] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/marijuana.php"] [unique_id "aSWIRFppQCoYxWW6V0VvKAAAAkU"]
[Tue Nov 25 18:43:20.349816 2025] [:error] [pid 14076:tid 14100] [client 4.251.107.128:22846] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/marijuana.php"] [unique_id "aSWISHsB4Gz6Qw-pvBsHuQAAABM"]
[Tue Nov 25 18:43:22.925456 2025] [:error] [pid 28836:tid 29013] [client 4.251.107.128:22835] [client 4.251.107.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSWISpwNRsoxcLQGkTe0EAAAAtc"]
[Tue Nov 25 18:43:27.090562 2025] [:error] [pid 14168:tid 14187] [client 4.251.107.128:22795] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/403.php"] [unique_id "aSWIT_R-ZDU0QEgAIItZagAAANA"]
[Tue Nov 25 18:43:34.150472 2025] [:error] [pid 2987:tid 2993] [client 4.251.107.128:22800] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/403.php"] [unique_id "aSWIVs-djEt-pTzPxnyRIgAAAUQ"]
[Tue Nov 25 18:43:42.835219 2025] [:error] [pid 28609:tid 28639] [client 4.251.107.128:22851] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aSWIXiGGdT-nZJVs3x22tQAAAZU"]
[Tue Nov 25 18:43:44.205044 2025] [:error] [pid 28740:tid 28795] [client 4.251.107.128:22844] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aSWIYFppQCoYxWW6V0VvSwAAAkQ"]
[Tue Nov 25 18:43:45.438029 2025] [:error] [pid 28740:tid 28807] [client 4.251.107.128:22855] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aSWIYVppQCoYxWW6V0VvTgAAAlA"]
[Tue Nov 25 18:43:51.921205 2025] [:error] [pid 14077:tid 14119] [client 4.251.107.128:22832] [client 4.251.107.128] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.251.107.128, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSWIZxG9n7UHEkwDTyh42AAAAEk"]
[Tue Nov 25 18:44:03.459034 2025] [:error] [pid 14168:tid 14176] [client 4.251.107.128:22798] [client 4.251.107.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aSWIc_R-ZDU0QEgAIItZnQAAAMU"]
[Tue Nov 25 18:44:05.843991 2025] [:error] [pid 28842:tid 28991] [client 4.251.107.128:22856] [client 4.251.107.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aSWIddNmoaPf6T4-6C2ANgAAA0E"]
[Tue Nov 25 18:44:07.082456 2025] [:error] [pid 28836:tid 28965] [client 4.251.107.128:22793] [client 4.251.107.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "aSWId5wNRsoxcLQGkTe0OQAAAso"]
[Tue Nov 25 18:44:10.606345 2025] [:error] [pid 14077:tid 14120] [client 4.251.107.128:22884] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock.php"] [unique_id "aSWIehG9n7UHEkwDTyh46wAAAEo"]
[Tue Nov 25 18:44:13.940965 2025] [:error] [pid 2987:tid 3002] [client 4.251.107.128:22914] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock.php"] [unique_id "aSWIfc-djEt-pTzPxnyROgAAAU0"]
[Tue Nov 25 18:44:19.482581 2025] [:error] [pid 14076:tid 14095] [client 4.251.107.128:22794] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock.php"] [unique_id "aSWIg3sB4Gz6Qw-pvBsH6wAAAA4"]
[Tue Nov 25 18:44:47.051726 2025] [:error] [pid 28740:tid 28800] [client 4.251.107.128:22853] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aSWIn1ppQCoYxWW6V0VvjgAAAkk"]
[Tue Nov 25 18:44:48.271340 2025] [:error] [pid 28739:tid 28769] [client 4.251.107.128:22791] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aSWIoBxGpKmlkG4FexRt_gAAAgc"]
[Tue Nov 25 18:44:53.312959 2025] [:error] [pid 2987:tid 3011] [client 4.251.107.128:22882] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aSWIpc-djEt-pTzPxnyRUwAAAVY"]
[Tue Nov 25 18:45:08.291703 2025] [proxy_fcgi:error] [pid 28842:tid 29001] [client 4.251.107.128:22822] AH01071: Got error 'Primary script unknown'
[Tue Nov 25 18:45:12.335993 2025] [:error] [pid 28842:tid 29026] [client 4.251.107.128:22822] [client 4.251.107.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSWIuNNmoaPf6T4-6C2AigAAA1g"]
[Tue Nov 25 18:45:14.233254 2025] [:error] [pid 14076:tid 14087] [client 4.251.107.128:22790] [client 4.251.107.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/zmFM.php"] [unique_id "aSWIunsB4Gz6Qw-pvBsIBwAAAAY"]
[Tue Nov 25 18:45:15.970973 2025] [autoindex:error] [pid 28842:tid 29023] [client 4.251.107.128:22954] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Nov 25 18:45:19.675528 2025] [proxy_fcgi:error] [pid 28842:tid 29005] [client 4.251.107.128:22954] AH01071: Got error 'Primary script unknown'
[Tue Nov 25 18:47:03.892403 2025] [:error] [pid 14077:tid 14126] [client 178.33.40.189:50578] [client 178.33.40.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.33.40.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSWJJxG9n7UHEkwDTyh6DwAAAFA"]
[Tue Nov 25 18:53:07.174751 2025] [:error] [pid 14077:tid 14133] [client 138.199.60.187:44914] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKkxG9n7UHEkwDTyh-AgAAAFc"]
[Tue Nov 25 18:53:07.426057 2025] [:error] [pid 14077:tid 14117] [client 138.199.60.187:45088] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKkxG9n7UHEkwDTyh-CAAAAEc"]
[Tue Nov 25 18:53:07.909485 2025] [:error] [pid 2987:tid 2994] [client 138.199.60.187:51016] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKk8-djEt-pTzPxnyT5gAAAUU"]
[Tue Nov 25 18:53:08.192758 2025] [:error] [pid 14077:tid 14130] [client 138.199.60.187:51192] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKlBG9n7UHEkwDTyh-EgAAAFQ"]
[Tue Nov 25 18:53:08.492820 2025] [:error] [pid 14077:tid 14128] [client 138.199.60.187:51362] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKlBG9n7UHEkwDTyh-FQAAAFI"]
[Tue Nov 25 18:58:20.586077 2025] [:error] [pid 28740:tid 28814] [client 136.144.43.131:57987] [client 136.144.43.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.144.43.131, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSWLzFppQCoYxWW6V0V0rAAAAlc"], referer: https://www.google.com/
[Tue Nov 25 18:58:21.361740 2025] [:error] [pid 14077:tid 14115] [client 136.144.43.134:56303] [client 136.144.43.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.144.43.134, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSWLzRG9n7UHEkwDTyiA-AAAAEU"], referer: https://www.google.com/
[Tue Nov 25 18:58:22.682585 2025] [:error] [pid 28739:tid 28785] [client 136.144.43.136:24005] [client 136.144.43.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.144.43.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSWLzhxGpKmlkG4FexRxqgAAAhc"], referer: https://www.google.com/
[Tue Nov 25 18:58:24.024808 2025] [:error] [pid 28740:tid 28815] [client 136.144.43.143:24219] [client 136.144.43.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.144.43.143, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSWL0FppQCoYxWW6V0V0sAAAAlg"], referer: https://www.google.com/
[Tue Nov 25 18:58:25.379211 2025] [:error] [pid 14077:tid 14110] [client 136.144.43.146:46745] [client 136.144.43.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.144.43.146, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSWL0RG9n7UHEkwDTyiBAAAAAEA"], referer: https://www.google.com/
[Tue Nov 25 18:58:26.747638 2025] [:error] [pid 28836:tid 29008] [client 136.144.43.132:45411] [client 136.144.43.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.144.43.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSWL0pwNRsoxcLQGkTe5JwAAAtI"], referer: https://www.google.com/
[Tue Nov 25 18:58:29.147488 2025] [:error] [pid 14076:tid 14105] [client 136.144.43.146:43975] [client 136.144.43.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.144.43.146, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSWL1XsB4Gz6Qw-pvBsL8wAAABg"], referer: https://www.google.com/
[Tue Nov 25 18:58:30.502653 2025] [:error] [pid 14077:tid 14117] [client 136.144.43.124:47345] [client 136.144.43.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.144.43.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSWL1hG9n7UHEkwDTyiBBAAAAEc"], referer: https://www.google.com/
[Tue Nov 25 18:58:31.818891 2025] [:error] [pid 14077:tid 14125] [client 136.144.43.129:63419] [client 136.144.43.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.144.43.129, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSWL1xG9n7UHEkwDTyiBBgAAAE8"], referer: https://www.google.com/
[Tue Nov 25 18:58:33.229632 2025] [:error] [pid 28739:tid 28769] [client 136.144.43.130:25975] [client 136.144.43.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.144.43.130, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSWL2RxGpKmlkG4FexRxygAAAgc"], referer: https://www.google.com/
[Tue Nov 25 18:58:35.729949 2025] [:error] [pid 14077:tid 14113] [client 136.144.43.146:28395] [client 136.144.43.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.144.43.146, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSWL2xG9n7UHEkwDTyiBEgAAAEM"], referer: https://www.google.com/
[Tue Nov 25 18:59:07.090461 2025] [:error] [pid 28836:tid 29012] [client 136.144.43.128:23807] [client 136.144.43.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.144.43.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSWL-5wNRsoxcLQGkTe5ZQAAAtY"], referer: https://www.google.com/
[Tue Nov 25 19:48:47.211779 2025] [:error] [pid 14168:tid 14180] [client 211.159.153.20:38824] [client 211.159.153.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.159.153.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSWXn_R-ZDU0QEgAIItpfQAAAMk"]
[Tue Nov 25 20:24:01.712561 2025] [:error] [pid 28740:tid 28792] [client 98.89.29.83:55976] [client 98.89.29.83] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aSWf4VppQCoYxWW6V0WVdAAAAkE"]
[Tue Nov 25 20:26:37.713542 2025] [:error] [pid 28836:tid 29011] [client 52.233.62.220:40957] [client 52.233.62.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.233.62.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSWgfZwNRsoxcLQGkTfRLgAAAtU"]
[Tue Nov 25 20:58:43.065734 2025] [:error] [pid 14168:tid 14179] [client 82.64.81.82:45204] [client 82.64.81.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.64.81.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSWoA_R-ZDU0QEgAIIt_xAAAAMg"]
[Tue Nov 25 22:02:21.790276 2025] [:error] [pid 14077:tid 14134] [client 128.199.48.21:22248] [client 128.199.48.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.48.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSW27RG9n7UHEkwDTyjUlQAAAFg"]
[Tue Nov 25 22:36:18.726465 2025] [:error] [pid 14078:tid 14145] [client 3.222.221.187:59176] [client 3.222.221.187] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.222.221.187, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSW-4tVXYbb0ii_rVoKbpAAAAIg"]
[Tue Nov 25 22:36:20.425536 2025] [:error] [pid 2987:tid 3004] [client 3.222.221.187:59184] [client 3.222.221.187] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.222.221.187, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSW-5M-djEt-pTzPxnzcuQAAAU8"]
[Tue Nov 25 23:08:37.923177 2025] [:error] [pid 14076:tid 14093] [client 89.233.105.224:38816] [client 89.233.105.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.233.105.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSXGdXsB4Gz6Qw-pvBtflwAAAAw"]
[Tue Nov 25 23:22:21.294459 2025] [autoindex:error] [pid 14076:tid 14091] [client 139.59.30.253:59734] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Nov 25 23:27:49.512341 2025] [:error] [pid 14078:tid 14144] [client 49.36.209.161:58204] [client 49.36.209.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.209.161, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSXK9dVXYbb0ii_rVoKynQAAAIc"]
[Tue Nov 25 23:31:12.438687 2025] [:error] [pid 14077:tid 14110] [client 105.115.9.135:9762] [client 105.115.9.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.115.9.135, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSXLwBG9n7UHEkwDTyjt2QAAAEA"]
[Tue Nov 25 23:32:49.067383 2025] [:error] [pid 14078:tid 14158] [client 49.36.209.161:62935] [client 49.36.209.161] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aSXMIdVXYbb0ii_rVoK1DgAAAJU"]
[Tue Nov 25 23:34:48.260432 2025] [:error] [pid 28609:tid 28626] [client 49.36.209.161:65291] [client 49.36.209.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.209.161, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSXMmCGGdT-nZJVs3x0RSAAAAYg"]
[Tue Nov 25 23:36:29.098888 2025] [:error] [pid 28609:tid 28622] [client 49.36.209.161:50881] [client 49.36.209.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.209.161, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSXM_SGGdT-nZJVs3x0RwwAAAYQ"]
[Tue Nov 25 23:38:13.640222 2025] [:error] [pid 14168:tid 14194] [client 49.36.209.161:52863] [client 49.36.209.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.209.161, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSXNZfR-ZDU0QEgAIIusPAAAANc"]
[Tue Nov 25 23:39:57.356012 2025] [:error] [pid 28836:tid 28956] [client 49.36.209.161:54880] [client 49.36.209.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.209.161, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSXNzZwNRsoxcLQGkTcJdwAAAsE"]
[Tue Nov 25 23:45:16.212353 2025] [:error] [pid 43981:tid 43990] [client 4.251.107.128:53073] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aSXPDAgZn97m_qh_RaGJAgAAAwc"]
[Tue Nov 25 23:45:18.420056 2025] [:error] [pid 2987:tid 3006] [client 4.251.107.128:53336] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aSXPDs-djEt-pTzPxnztpgAAAVE"]
[Tue Nov 25 23:45:21.033627 2025] [:error] [pid 43843:tid 43868] [client 4.251.107.128:53375] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aSXPERhx4v3NUNdMKDMToAAAAdc"]
[Tue Nov 25 23:45:22.353404 2025] [:error] [pid 43843:tid 43849] [client 4.251.107.128:53109] [client 4.251.107.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aSXPEhhx4v3NUNdMKDMTogAAAcQ"]
[Wed Nov 26 00:13:13.912152 2025] [:error] [pid 14076:tid 14097] [client 116.202.13.21:58746] [client 116.202.13.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.202.13.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSXVmXsB4Gz6Qw-pvBty_AAAABA"]
[Wed Nov 26 00:24:49.752776 2025] [:error] [pid 43981:tid 44004] [client 20.36.171.210:63942] [client 20.36.171.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "aSXYUQgZn97m_qh_RaGRMAAAAxU"]
[Wed Nov 26 00:24:53.757007 2025] [:error] [pid 14078:tid 14153] [client 20.36.171.210:65224] [client 20.36.171.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSXYVdVXYbb0ii_rVoLMHwAAAJA"]
[Wed Nov 26 00:24:59.530286 2025] [:error] [pid 14078:tid 14150] [client 20.36.171.210:65160] [client 20.36.171.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSXYW9VXYbb0ii_rVoLMKgAAAI0"]
[Wed Nov 26 00:25:05.722430 2025] [autoindex:error] [pid 14078:tid 14152] [client 20.36.171.210:63883] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Nov 26 00:25:05.948656 2025] [:error] [pid 14078:tid 14153] [client 20.36.171.210:63883] [client 20.36.171.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aSXYYdVXYbb0ii_rVoLMPAAAAJA"]
[Wed Nov 26 00:25:12.864204 2025] [:error] [pid 43843:tid 43851] [client 20.36.171.210:65154] [client 20.36.171.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.36.171.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSXYaBhx4v3NUNdMKDMbrgAAAcY"]
[Wed Nov 26 00:25:26.275997 2025] [:error] [pid 28836:tid 28957] [client 20.36.171.210:65243] [client 20.36.171.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.36.171.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSXYdpwNRsoxcLQGkTcUkgAAAsI"]
[Wed Nov 26 00:48:11.864272 2025] [:error] [pid 2987:tid 2999] [client 34.83.201.203:60741] [client 34.83.201.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.83.201.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSXdy8-djEt-pTzPxnz9FwAAAUo"]
[Wed Nov 26 00:48:13.934159 2025] [:error] [pid 2987:tid 2989] [client 34.83.201.203:60741] [client 34.83.201.203] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aSXdzc-djEt-pTzPxnz9HQAAAUA"]
[Wed Nov 26 00:48:14.151161 2025] [:error] [pid 2987:tid 2994] [client 34.83.201.203:60741] [client 34.83.201.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.83.201.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSXdzs-djEt-pTzPxnz9HgAAAUU"]
[Wed Nov 26 00:48:15.597028 2025] [:error] [pid 28836:tid 28956] [client 34.83.201.203:56590] [client 34.83.201.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.83.201.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSXdz5wNRsoxcLQGkTcawQAAAsE"]
[Wed Nov 26 00:48:16.018831 2025] [:error] [pid 28836:tid 28955] [client 43.166.129.247:40426] [client 43.166.129.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aSXd0JwNRsoxcLQGkTcawgAAAsA"]
[Wed Nov 26 00:48:16.972720 2025] [:error] [pid 28836:tid 28959] [client 34.83.201.203:62589] [client 34.83.201.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.83.201.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSXd0JwNRsoxcLQGkTcaxQAAAsQ"]
[Wed Nov 26 00:48:18.283105 2025] [:error] [pid 2987:tid 3000] [client 34.83.201.203:64376] [client 34.83.201.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.83.201.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSXd0s-djEt-pTzPxnz9IAAAAUs"]
[Wed Nov 26 00:48:19.582456 2025] [:error] [pid 14168:tid 14185] [client 34.83.201.203:55511] [client 34.83.201.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.83.201.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSXd0_R-ZDU0QEgAIIu64gAAAM4"]
[Wed Nov 26 00:48:19.582673 2025] [:error] [pid 14168:tid 14185] [client 34.83.201.203:55511] [client 34.83.201.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.83.201.203, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSXd0_R-ZDU0QEgAIIu64gAAAM4"]
[Wed Nov 26 01:00:42.799696 2025] [:error] [pid 14168:tid 14179] [client 45.92.229.49:61525] [client 45.92.229.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.92.229.49, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSXguvR-ZDU0QEgAIIu-PAAAAMg"]
[Wed Nov 26 01:00:44.655243 2025] [:error] [pid 28609:tid 28627] [client 216.73.161.193:60431] [client 216.73.161.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.161.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSXgvCGGdT-nZJVs3x0roAAAAYk"]
[Wed Nov 26 01:17:34.034153 2025] [:error] [pid 28609:tid 28630] [client 90.156.142.31:53898] [client 90.156.142.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 90.156.142.31, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSXkriGGdT-nZJVs3x0uygAAAYw"]
[Wed Nov 26 02:26:48.585704 2025] [:error] [pid 14078:tid 14145] [client 185.199.223.27:53276] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSX06NVXYbb0ii_rVoL-GwAAAIg"]
[Wed Nov 26 03:01:01.806377 2025] [:error] [pid 28609:tid 28623] [client 34.168.29.160:63870] [client 34.168.29.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.168.29.160, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSX87SGGdT-nZJVs3x1BVgAAAYU"]
[Wed Nov 26 03:01:04.275279 2025] [:error] [pid 28609:tid 28619] [client 34.168.29.160:63870] [client 34.168.29.160] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aSX88CGGdT-nZJVs3x1BXQAAAYE"]
[Wed Nov 26 03:01:04.439843 2025] [:error] [pid 28609:tid 28627] [client 34.168.29.160:63870] [client 34.168.29.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.168.29.160, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSX88CGGdT-nZJVs3x1BXgAAAYk"]
[Wed Nov 26 03:01:05.860888 2025] [:error] [pid 2987:tid 2995] [client 34.168.29.160:59586] [client 34.168.29.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.168.29.160, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSX88c-djEt-pTzPxnwV8QAAAUY"]
[Wed Nov 26 03:01:07.256589 2025] [:error] [pid 2987:tid 3003] [client 34.168.29.160:58128] [client 34.168.29.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.168.29.160, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSX888-djEt-pTzPxnwV8gAAAU4"]
[Wed Nov 26 03:01:08.605816 2025] [:error] [pid 14076:tid 14085] [client 34.168.29.160:62061] [client 34.168.29.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.168.29.160, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSX89HsB4Gz6Qw-pvBucJwAAAAQ"]
[Wed Nov 26 03:01:10.091673 2025] [:error] [pid 28609:tid 28623] [client 34.168.29.160:54097] [client 34.168.29.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.168.29.160, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSX89iGGdT-nZJVs3x1BZAAAAYU"]
[Wed Nov 26 03:01:10.091853 2025] [:error] [pid 28609:tid 28623] [client 34.168.29.160:54097] [client 34.168.29.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.168.29.160, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSX89iGGdT-nZJVs3x1BZAAAAYU"]
[Wed Nov 26 03:53:31.316426 2025] [:error] [pid 3011:tid 3051] [client 90.156.142.31:44486] [client 90.156.142.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 90.156.142.31, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSYJO0b0BA3GljiGlI6mhgAAAEk"]
[Wed Nov 26 04:31:33.735174 2025] [autoindex:error] [pid 3097:tid 3108] [client 143.244.142.41:50492] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Nov 26 05:47:41.728250 2025] [:error] [pid 3193:tid 3215] [client 156.67.31.208:37258] [client 156.67.31.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.67.31.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSYj_XuQoDIKTNoWPJU87QAAA9Q"]
[Wed Nov 26 06:13:35.336530 2025] [:error] [pid 3012:tid 3084] [client 182.44.10.67:36002] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aSYqD0fo8Sm1Un9NK6g8-wAAAI8"]
[Wed Nov 26 06:55:23.756406 2025] [:error] [pid 3012:tid 3075] [client 185.199.223.39:40682] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSYz20fo8Sm1Un9NK6hGLgAAAIY"]
[Wed Nov 26 07:24:42.092025 2025] [:error] [pid 34830:tid 34848] [client 216.73.160.32:46637] [client 216.73.160.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.32, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSY6ukukvkWgWN6jCR1PkwAAABA"]
[Wed Nov 26 07:50:55.154644 2025] [:error] [pid 34830:tid 34834] [client 216.73.160.26:46379] [client 216.73.160.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSZA30ukvkWgWN6jCR1ZWgAAAAI"]
[Wed Nov 26 08:16:50.795353 2025] [:error] [pid 45901:tid 45923] [client 216.73.160.36:49413] [client 216.73.160.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.36, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSZG8iunQ1SpfPRNrtxNuAAAARQ"]
[Wed Nov 26 08:42:28.195655 2025] [:error] [pid 34742:tid 34750] [client 216.73.160.44:59113] [client 216.73.160.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSZM9JSuLNwpQF_jzAcCiAAAAEI"]
[Wed Nov 26 09:05:54.373641 2025] [:error] [pid 45836:tid 45856] [client 43.166.224.244:33040] [client 43.166.224.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aSZScpfrnOGqL-seZAz3qwAAAMo"]
[Wed Nov 26 09:08:10.711289 2025] [:error] [pid 45836:tid 45869] [client 216.73.160.27:44283] [client 216.73.160.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSZS-pfrnOGqL-seZAz4QQAAANc"]
[Wed Nov 26 09:08:17.705032 2025] [:error] [pid 45836:tid 45855] [client 185.21.112.38:55620] [client 185.21.112.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.21.112.38, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSZTAZfrnOGqL-seZAz4RwAAAMk"]
[Wed Nov 26 09:34:35.228705 2025] [:error] [pid 34830:tid 34838] [client 216.73.160.34:39189] [client 216.73.160.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.34, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSZZK0ukvkWgWN6jCR11NgAAAAY"]
[Wed Nov 26 10:00:51.618657 2025] [:error] [pid 10383:tid 10397] [client 216.73.160.41:58029] [client 216.73.160.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.41, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSZfU60RJ-zjhOVjD899pQAAAcs"]
[Wed Nov 26 10:14:30.336730 2025] [:error] [pid 35540:tid 35558] [client 109.73.211.121:33728] [client 109.73.211.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.73.211.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSZihsGrIq2A6SZSnkI4qgAAAIw"]
[Wed Nov 26 10:27:31.906383 2025] [:error] [pid 34830:tid 34832] [client 216.73.160.185:25239] [client 216.73.160.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSZlk0ukvkWgWN6jCR2A2QAAAAA"]
[Wed Nov 26 10:55:27.121175 2025] [:error] [pid 45901:tid 45924] [client 216.73.160.37:20677] [client 216.73.160.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.37, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSZsHyunQ1SpfPRNrtyABQAAARU"]
[Wed Nov 26 11:23:38.388397 2025] [:error] [pid 35540:tid 35566] [client 216.73.160.35:56645] [client 216.73.160.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSZyusGrIq2A6SZSnkJQEQAAAJQ"]
[Wed Nov 26 11:51:19.590285 2025] [:error] [pid 10383:tid 10398] [client 216.73.160.23:64857] [client 216.73.160.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSZ5N60RJ-zjhOVjD8-rxAAAAcw"]
[Wed Nov 26 11:54:52.054017 2025] [:error] [pid 35540:tid 35547] [client 162.241.224.200:25698] [client 162.241.224.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.224.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSZ6DMGrIq2A6SZSnkJbNAAAAIE"]
[Wed Nov 26 11:54:53.619943 2025] [:error] [pid 35540:tid 35567] [client 162.241.224.200:25710] [client 162.241.224.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.224.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSZ6DcGrIq2A6SZSnkJbOAAAAJU"]
[Wed Nov 26 12:19:10.696163 2025] [:error] [pid 10383:tid 10398] [client 216.73.160.43:38243] [client 216.73.160.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSZ_vq0RJ-zjhOVjD8-2jgAAAcw"]
[Wed Nov 26 12:30:07.712837 2025] [:error] [pid 34743:tid 34795] [client 35.203.25.31:55086] [client 35.203.25.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.203.25.31, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSaCTwvyX7Q5oU7_mByPpAAAAVM"]
[Wed Nov 26 12:47:10.594042 2025] [:error] [pid 35540:tid 35569] [client 216.73.160.23:28259] [client 216.73.160.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSaGTsGrIq2A6SZSnkJsiQAAAJc"]
[Wed Nov 26 13:15:10.682476 2025] [:error] [pid 10383:tid 10386] [client 216.73.160.184:33955] [client 216.73.160.184] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.184, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSaM3q0RJ-zjhOVjD8_J7gAAAcA"]
[Wed Nov 26 13:37:46.161850 2025] [:error] [pid 45901:tid 45905] [client 91.226.10.36:60116] [client 91.226.10.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.226.10.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSaSKiunQ1SpfPRNrtyoWgAAAQI"]
[Wed Nov 26 13:42:35.170455 2025] [:error] [pid 34744:tid 34819] [client 216.73.160.179:25859] [client 216.73.160.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSaTS0tgOvVbhyALkTT_BgAAAZA"]
[Wed Nov 26 14:08:38.255888 2025] [:error] [pid 34830:tid 34843] [client 216.73.160.32:63891] [client 216.73.160.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.32, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSaZZkukvkWgWN6jCR2ruAAAAAs"]
[Wed Nov 26 14:10:10.765301 2025] [:error] [pid 35540:tid 35549] [client 31.47.46.37:42212] [client 31.47.46.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.47.46.37, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSaZwsGrIq2A6SZSnkKCCwAAAIM"]
[Wed Nov 26 14:10:12.641214 2025] [:error] [pid 34743:tid 34785] [client 31.47.46.37:42226] [client 31.47.46.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.47.46.37, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSaZxAvyX7Q5oU7_mByfzgAAAUk"]
[Wed Nov 26 14:11:55.435537 2025] [:error] [pid 34830:tid 34842] [client 139.59.30.253:57687] [client 139.59.30.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "aSaaK0ukvkWgWN6jCR2sJwAAAAo"], referer: binance.com
[Wed Nov 26 14:34:31.473491 2025] [:error] [pid 34742:tid 34772] [client 216.73.160.32:63841] [client 216.73.160.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.32, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSafd5SuLNwpQF_jzAdL9wAAAFg"]
[Wed Nov 26 14:45:12.410187 2025] [:error] [pid 35540:tid 35557] [client 66.94.123.12:48660] [client 66.94.123.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.94.123.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSah-MGrIq2A6SZSnkKMIAAAAIs"]
[Wed Nov 26 15:00:13.926475 2025] [:error] [pid 45901:tid 45908] [client 216.73.160.180:23987] [client 216.73.160.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.180, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSalfSunQ1SpfPRNrty5VgAAAQU"]
[Wed Nov 26 15:26:49.529766 2025] [:error] [pid 45684:tid 45727] [client 216.73.160.189:54521] [client 216.73.160.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSarufg5LMxwI4-PD1f3ggAAAAw"]
[Wed Nov 26 15:53:48.486928 2025] [:error] [pid 45684:tid 45716] [client 216.73.160.27:62809] [client 216.73.160.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSayDPg5LMxwI4-PD1f-QwAAAAE"]
[Wed Nov 26 15:55:23.932804 2025] [:error] [pid 46443:tid 46457] [client 103.1.187.190:36304] [client 103.1.187.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.1.187.190, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSaya8LmDsnHrj-QFB-URgAAAEw"]
[Wed Nov 26 16:21:19.584908 2025] [:error] [pid 45769:tid 45773] [client 216.73.160.177:22535] [client 216.73.160.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSa4f1dG5Eht9c3yy4Py0wAAAcE"]
[Wed Nov 26 16:48:51.772500 2025] [:error] [pid 45769:tid 45774] [client 216.73.160.35:29589] [client 216.73.160.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSa-81dG5Eht9c3yy4P9ZQAAAcI"]
[Wed Nov 26 17:05:55.936398 2025] [:error] [pid 6471:tid 6491] [client 109.228.37.48:58994] [client 109.228.37.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.228.37.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbC8-h3Z9TZLlRuTiNmsQAAAJE"]
[Wed Nov 26 17:16:43.455728 2025] [:error] [pid 46443:tid 46456] [client 216.73.160.17:33411] [client 216.73.160.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSbFe8LmDsnHrj-QFB-3XgAAAEs"]
[Wed Nov 26 17:44:35.220180 2025] [:error] [pid 45685:tid 45765] [client 216.73.160.29:47325] [client 216.73.160.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSbMA1j3f_NRdgU0DQ7CCAAAARc"]
[Wed Nov 26 17:56:48.094978 2025] [:error] [pid 46443:tid 46447] [client 157.245.61.90:55268] [client 157.245.61.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aSbO4MLmDsnHrj-QFB_C6wAAAEI"]
[Wed Nov 26 17:59:03.247004 2025] [:error] [pid 46443:tid 46450] [client 216.126.239.203:58520] [client 216.126.239.203] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aSbPZ8LmDsnHrj-QFB_DTgAAAEU"]
[Wed Nov 26 18:12:44.453069 2025] [:error] [pid 20733:tid 20753] [client 216.73.160.191:63915] [client 216.73.160.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.191, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSbSnAV9EP2HuRvnH8dH6gAAANI"]
[Wed Nov 26 18:13:16.665663 2025] [:error] [pid 45685:tid 45761] [client 98.159.37.37:29659] [client 98.159.37.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.159.37.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbSvFj3f_NRdgU0DQ7IwwAAARM"], referer: https://www.google.com/
[Wed Nov 26 18:13:17.910671 2025] [:error] [pid 6471:tid 6495] [client 216.24.210.101:62259] [client 216.24.210.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.24.210.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbSveh3Z9TZLlRuTiN7MQAAAJU"], referer: https://www.google.com/
[Wed Nov 26 18:13:19.166866 2025] [:error] [pid 6471:tid 6493] [client 98.159.37.34:34305] [client 98.159.37.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.159.37.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbSv-h3Z9TZLlRuTiN7MgAAAJM"], referer: https://www.google.com/
[Wed Nov 26 18:13:20.412833 2025] [:error] [pid 45683:tid 45708] [client 98.159.37.31:31829] [client 98.159.37.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.159.37.31, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbSwBX1gQgNFW_222qbFwAAAVQ"], referer: https://www.google.com/
[Wed Nov 26 18:13:21.726529 2025] [:error] [pid 20733:tid 20753] [client 216.24.210.98:64013] [client 216.24.210.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.24.210.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbSwQV9EP2HuRvnH8dIEgAAANI"], referer: https://www.google.com/
[Wed Nov 26 18:13:22.976892 2025] [:error] [pid 45685:tid 45759] [client 216.24.210.120:51645] [client 216.24.210.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.24.210.120, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbSwlj3f_NRdgU0DQ7IyQAAARE"], referer: https://www.google.com/
[Wed Nov 26 18:13:24.260396 2025] [:error] [pid 45769:tid 45780] [client 98.159.37.30:56437] [client 98.159.37.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.159.37.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbSxFdG5Eht9c3yy4MUJQAAAcg"], referer: https://www.google.com/
[Wed Nov 26 18:13:25.502678 2025] [:error] [pid 45684:tid 45735] [client 216.24.210.242:59079] [client 216.24.210.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.24.210.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbSxfg5LMxwI4-PD1cslgAAABQ"], referer: https://www.google.com/
[Wed Nov 26 18:13:26.759610 2025] [:error] [pid 6471:tid 6490] [client 98.159.37.36:22523] [client 98.159.37.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.159.37.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbSxuh3Z9TZLlRuTiN7OgAAAJA"], referer: https://www.google.com/
[Wed Nov 26 18:13:28.004640 2025] [:error] [pid 6471:tid 6487] [client 98.159.37.39:42915] [client 98.159.37.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.159.37.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbSyOh3Z9TZLlRuTiN7PQAAAI0"], referer: https://www.google.com/
[Wed Nov 26 18:13:29.313878 2025] [:error] [pid 45769:tid 45794] [client 216.24.210.49:65191] [client 216.24.210.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.24.210.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbSyVdG5Eht9c3yy4MUJwAAAdY"], referer: https://www.google.com/
[Wed Nov 26 18:13:30.557073 2025] [:error] [pid 45684:tid 45732] [client 98.159.37.45:47799] [client 98.159.37.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.159.37.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbSyvg5LMxwI4-PD1csngAAABE"], referer: https://www.google.com/
[Wed Nov 26 18:13:31.807180 2025] [:error] [pid 45685:tid 45747] [client 98.159.37.26:27827] [client 98.159.37.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.159.37.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbSy1j3f_NRdgU0DQ7I0wAAAQU"], referer: https://www.google.com/
[Wed Nov 26 18:13:33.073773 2025] [:error] [pid 45684:tid 45739] [client 216.24.210.99:35465] [client 216.24.210.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.24.210.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbSzfg5LMxwI4-PD1csoAAAABg"], referer: https://www.google.com/
[Wed Nov 26 18:13:34.318273 2025] [:error] [pid 45685:tid 45765] [client 98.159.37.30:45717] [client 98.159.37.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.159.37.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbSzlj3f_NRdgU0DQ7I1AAAARc"], referer: https://www.google.com/
[Wed Nov 26 18:13:35.555081 2025] [:error] [pid 45769:tid 45774] [client 216.24.210.112:45113] [client 216.24.210.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.24.210.112, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbSz1dG5Eht9c3yy4MUNQAAAcI"], referer: https://www.google.com/
[Wed Nov 26 18:13:36.799659 2025] [:error] [pid 6471:tid 6492] [client 98.159.37.26:25895] [client 98.159.37.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.159.37.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbS0Oh3Z9TZLlRuTiN7QgAAAJI"], referer: https://www.google.com/
[Wed Nov 26 18:13:38.075590 2025] [:error] [pid 45683:tid 45697] [client 216.24.210.99:50973] [client 216.24.210.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.24.210.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbS0hX1gQgNFW_222qbIwAAAUk"], referer: https://www.google.com/
[Wed Nov 26 18:13:39.349378 2025] [:error] [pid 45684:tid 45730] [client 98.159.37.45:40707] [client 98.159.37.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.159.37.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbS0_g5LMxwI4-PD1cspQAAAA8"], referer: https://www.google.com/
[Wed Nov 26 18:13:40.598323 2025] [:error] [pid 45684:tid 45720] [client 98.159.37.36:47111] [client 98.159.37.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.159.37.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbS1Pg5LMxwI4-PD1csqAAAAAU"], referer: https://www.google.com/
[Wed Nov 26 18:13:41.837989 2025] [:error] [pid 45684:tid 45727] [client 216.24.210.111:61667] [client 216.24.210.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.24.210.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbS1fg5LMxwI4-PD1csrAAAAAw"], referer: https://www.google.com/
[Wed Nov 26 18:13:43.087674 2025] [:error] [pid 45685:tid 45743] [client 98.159.37.41:23727] [client 98.159.37.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.159.37.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbS11j3f_NRdgU0DQ7I3wAAAQE"], referer: https://www.google.com/
[Wed Nov 26 18:13:44.321500 2025] [:error] [pid 45684:tid 45716] [client 216.24.210.120:33271] [client 216.24.210.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.24.210.120, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbS2Pg5LMxwI4-PD1cssQAAAAE"], referer: https://www.google.com/
[Wed Nov 26 18:13:45.583155 2025] [:error] [pid 6471:tid 6494] [client 216.24.210.113:36481] [client 216.24.210.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.24.210.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbS2eh3Z9TZLlRuTiN7UgAAAJQ"], referer: https://www.google.com/
[Wed Nov 26 18:13:46.819647 2025] [:error] [pid 46443:tid 46452] [client 98.159.37.25:44801] [client 98.159.37.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.159.37.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbS2sLmDsnHrj-QFB_KHwAAAEc"], referer: https://www.google.com/
[Wed Nov 26 18:13:48.048806 2025] [:error] [pid 20733:tid 20759] [client 98.159.37.42:49043] [client 98.159.37.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.159.37.42, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbS3AV9EP2HuRvnH8dIOQAAANg"], referer: https://www.google.com/
[Wed Nov 26 18:13:49.282563 2025] [:error] [pid 20733:tid 20738] [client 98.159.37.40:24689] [client 98.159.37.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.159.37.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbS3QV9EP2HuRvnH8dIOwAAAMM"], referer: https://www.google.com/
[Wed Nov 26 18:13:50.534138 2025] [:error] [pid 45769:tid 45785] [client 216.24.210.120:23003] [client 216.24.210.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.24.210.120, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbS3ldG5Eht9c3yy4MUWAAAAc0"], referer: https://www.google.com/
[Wed Nov 26 18:13:51.902423 2025] [:error] [pid 46443:tid 46448] [client 98.159.37.39:48237] [client 98.159.37.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.159.37.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbS38LmDsnHrj-QFB_KKwAAAEM"], referer: https://www.google.com/
[Wed Nov 26 18:13:53.146593 2025] [:error] [pid 45685:tid 45747] [client 216.24.210.49:35451] [client 216.24.210.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.24.210.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbS4Vj3f_NRdgU0DQ7I5QAAAQU"], referer: https://www.google.com/
[Wed Nov 26 18:42:49.386886 2025] [:error] [pid 45684:tid 45732] [client 216.73.160.41:56725] [client 216.73.160.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.41, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSbZqfg5LMxwI4-PD1c7ZgAAABE"]
[Wed Nov 26 18:50:28.794247 2025] [:error] [pid 20733:tid 20749] [client 180.110.203.108:36364] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aSbbdAV9EP2HuRvnH8dR9QAAAM4"]
[Wed Nov 26 19:12:13.167314 2025] [:error] [pid 45684:tid 45727] [client 216.73.160.21:59915] [client 216.73.160.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSbgjfg5LMxwI4-PD1dG5gAAAAw"]
[Wed Nov 26 19:19:16.124912 2025] [:error] [pid 45685:tid 45748] [client 59.125.102.142:50288] [client 59.125.102.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbiNFj3f_NRdgU0DQ7XCwAAAQY"]
[Wed Nov 26 19:41:46.104953 2025] [:error] [pid 6471:tid 6480] [client 216.73.160.43:36003] [client 216.73.160.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSbneuh3Z9TZLlRuTiOT8AAAAIY"]
[Wed Nov 26 20:11:04.461011 2025] [:error] [pid 45685:tid 45760] [client 216.73.160.187:29465] [client 216.73.160.187] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.187, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSbuWFj3f_NRdgU0DQ7jsAAAARI"]
[Wed Nov 26 20:26:22.135929 2025] [:error] [pid 46443:tid 46450] [client 64.227.70.2:44092] [client 64.227.70.2] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aSbx7sLmDsnHrj-QFB_2IAAAAEU"]
[Wed Nov 26 20:26:39.355324 2025] [authz_core:error] [pid 45683:tid 45704] [client 64.227.70.2:49524] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Wed Nov 26 20:26:48.422754 2025] [:error] [pid 46443:tid 46449] [client 64.227.70.2:32794] [client 64.227.70.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aSbyCMLmDsnHrj-QFB_2PwAAAEQ"]
[Wed Nov 26 20:26:50.403093 2025] [:error] [pid 6471:tid 6475] [client 64.227.70.2:32868] [client 64.227.70.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aSbyCuh3Z9TZLlRuTiOffwAAAIE"]
[Wed Nov 26 20:28:00.955310 2025] [:error] [pid 45685:tid 45747] [client 5.35.249.176:34224] [client 5.35.249.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.35.249.176, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSbyUFj3f_NRdgU0DQ7nRAAAAQU"]
[Wed Nov 26 20:41:27.012165 2025] [:error] [pid 45684:tid 45731] [client 216.73.160.22:57749] [client 216.73.160.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSb1d_g5LMxwI4-PD1dq2QAAABA"]
[Wed Nov 26 21:10:46.397077 2025] [:error] [pid 45683:tid 45697] [client 216.73.160.36:20151] [client 216.73.160.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.36, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSb8VhX1gQgNFW_222rDJQAAAUk"]
[Wed Nov 26 21:39:16.037451 2025] [:error] [pid 20733:tid 20735] [client 216.73.160.181:26549] [client 216.73.160.181] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.181, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aScDBAV9EP2HuRvnH8dzGQAAAMA"]
[Wed Nov 26 22:08:25.771294 2025] [:error] [pid 45685:tid 45753] [client 216.73.160.185:38095] [client 216.73.160.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aScJ2Vj3f_NRdgU0DQ77vAAAAQs"]
[Wed Nov 26 22:37:23.966565 2025] [:error] [pid 46443:tid 46455] [client 216.73.160.185:53799] [client 216.73.160.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.160.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aScQo8LmDsnHrj-QFB8f0wAAAEo"]
[Wed Nov 26 22:43:59.706382 2025] [:error] [pid 45683:tid 45700] [client 211.21.61.244:44458] [client 211.21.61.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.244, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aScSLxX1gQgNFW_222rYXgAAAUw"]
[Wed Nov 26 23:52:03.587951 2025] [:error] [pid 45769:tid 45788] [client 178.62.226.48:33728] [client 178.62.226.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.226.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSciI1dG5Eht9c3yy4NY3gAAAdA"]
[Thu Nov 27 00:49:48.439296 2025] [:error] [pid 8184:tid 8257] [client 103.77.107.57:54230] [client 103.77.107.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aScvrL-M2IHkRYVrcbN5vwAAAFM"]
[Thu Nov 27 01:04:35.735850 2025] [:error] [pid 8184:tid 8239] [client 13.239.161.156:36758] [client 13.239.161.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.239.161.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSczI7-M2IHkRYVrcbN-8AAAAEM"]
[Thu Nov 27 02:16:23.666056 2025] [:error] [pid 25180:tid 25188] [client 125.23.86.26:53236] [client 125.23.86.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 125.23.86.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSdD97-owhtiwMHXYlzg5gAAAYY"]
[Thu Nov 27 02:25:59.853182 2025] [:error] [pid 25262:tid 25323] [client 136.114.199.181:52373] [client 136.114.199.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.114.199.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSdGN03p81VU3bYILBVQxAAAAgI"]
[Thu Nov 27 02:26:02.365645 2025] [:error] [pid 25262:tid 25343] [client 136.114.199.181:52373] [client 136.114.199.181] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aSdGOk3p81VU3bYILBVQxwAAAhY"]
[Thu Nov 27 02:26:02.784888 2025] [:error] [pid 25262:tid 25333] [client 136.114.199.181:52373] [client 136.114.199.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.114.199.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSdGOk3p81VU3bYILBVQyAAAAgw"]
[Thu Nov 27 02:26:04.211402 2025] [:error] [pid 54723:tid 54740] [client 136.114.199.181:59467] [client 136.114.199.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.114.199.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSdGPA2CEg7QoyDosdIJDwAAAAo"]
[Thu Nov 27 02:26:04.218356 2025] [:error] [pid 54723:tid 54740] [client 136.114.199.181:59467] [client 136.114.199.181] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/usr/local/apache/modsecurity-cwaf/rules/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 136.114.199.181 (+1 hits since last alert)|expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSdGPA2CEg7QoyDosdIJDwAAAAo"]
[Thu Nov 27 03:25:32.826110 2025] [:error] [pid 50951:tid 50966] [client 82.64.81.82:41456] [client 82.64.81.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.64.81.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSdULKS051oFUkMn6w_F8gAAAQk"]
[Thu Nov 27 04:53:53.733584 2025] [:error] [pid 21017:tid 21082] [client 188.165.95.76:55258] [client 188.165.95.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.165.95.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSdo4aZA663ub03MMQuDeQAAARc"]
[Thu Nov 27 05:48:36.252094 2025] [:error] [pid 6290:tid 6309] [client 152.53.164.187:40534] [client 152.53.164.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.164.187, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSd1tIqL4zye-zKr6sunNAAAAM8"]
[Thu Nov 27 05:58:55.527243 2025] [:error] [pid 6290:tid 6300] [client 34.124.147.91:40258] [client 34.124.147.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.124.147.91, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSd4H4qL4zye-zKr6sutKQAAAMY"]
[Thu Nov 27 06:52:41.068349 2025] [:error] [pid 48928:tid 48952] [client 50.116.31.125:53696] [client 50.116.31.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.116.31.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSeEuXzpQoF8PVTquqYq7AAAAE0"]
[Thu Nov 27 07:46:21.189755 2025] [:error] [pid 61341:tid 61350] [client 206.189.227.177:61165] [client 206.189.227.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.189.227.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSeRTTZZwqfZ5AbcfrYz4AAAAQI"]
[Thu Nov 27 07:46:22.645446 2025] [:error] [pid 61346:tid 61404] [client 206.189.227.177:61386] [client 206.189.227.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.189.227.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aSeRTk9mWooMi3Qmrw2E6AAAAAE"]
[Thu Nov 27 08:06:13.755502 2025] [:error] [pid 11948:tid 11966] [client 34.151.198.67:53592] [client 34.151.198.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.151.198.67, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aSeV9VRlqxYLiwd-HXOVJAAAANA"]
[Mon Dec 08 20:18:02.963697 2025] [:error] [pid 48482:tid 48523] [client 159.223.132.86:47380] [client 159.223.132.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/actuator/env"] [unique_id "aTbB-n23gV7gRu3vn81mTgAAAIs"]
[Mon Dec 08 20:18:03.975743 2025] [:error] [pid 48573:tid 48588] [client 159.223.132.86:47390] [client 159.223.132.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aTbB-1Iayuqwlm3CEkZhiwAAAU0"]
[Mon Dec 08 20:18:04.954705 2025] [:error] [pid 48481:tid 48504] [client 159.223.132.86:47404] [client 159.223.132.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server"] [unique_id "aTbB_Ce0pzx5KCi3S0L9PAAAANM"]
[Mon Dec 08 20:18:05.967729 2025] [:error] [pid 48541:tid 48553] [client 159.223.132.86:47418] [client 159.223.132.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aTbB_QSNhJPArxLCdWHbrAAAAQo"]
[Mon Dec 08 20:18:07.978887 2025] [:error] [pid 48482:tid 48531] [client 159.223.132.86:47434] [client 159.223.132.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about"] [unique_id "aTbB_323gV7gRu3vn81mUgAAAJM"]
[Mon Dec 08 20:18:08.720137 2025] [:error] [pid 48482:tid 48534] [client 54.253.134.31:50485] [client 54.253.134.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.253.134.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTbCAH23gV7gRu3vn81mVgAAAJY"]
[Mon Dec 08 20:18:08.963754 2025] [:error] [pid 48481:tid 48498] [client 159.223.132.86:47442] [client 159.223.132.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/debug/default/view"] [unique_id "aTbCACe0pzx5KCi3S0L9PwAAAM0"]
[Mon Dec 08 20:18:09.926015 2025] [:error] [pid 48573:tid 48575] [client 54.253.134.31:29610] [client 54.253.134.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.253.134.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTbCAVIayuqwlm3CEkZhrAAAAUA"]
[Mon Dec 08 20:18:09.963508 2025] [:error] [pid 48541:tid 48559] [client 159.223.132.86:44318] [client 159.223.132.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2/_catalog"] [unique_id "aTbCAQSNhJPArxLCdWHbwAAAARA"]
[Mon Dec 08 20:18:10.970464 2025] [:error] [pid 48482:tid 48526] [client 159.223.132.86:44332] [client 159.223.132.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aTbCAn23gV7gRu3vn81mbgAAAI4"]
[Mon Dec 08 20:18:11.976558 2025] [:error] [pid 48541:tid 48546] [client 159.223.132.86:44344] [client 159.223.132.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server-status"] [unique_id "aTbCAwSNhJPArxLCdWHbywAAAQM"]
[Mon Dec 08 20:18:12.983238 2025] [:error] [pid 48573:tid 48575] [client 159.223.132.86:44350] [client 159.223.132.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login.action"] [unique_id "aTbCBFIayuqwlm3CEkZhvwAAAUA"]
[Mon Dec 08 20:18:13.965130 2025] [:error] [pid 48482:tid 48531] [client 159.223.132.86:44358] [client 159.223.132.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/_all_dbs"] [unique_id "aTbCBX23gV7gRu3vn81mcgAAAJM"]
[Mon Dec 08 20:18:14.967376 2025] [:error] [pid 48541:tid 48553] [client 159.223.132.86:44368] [client 159.223.132.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.DS_Store"] [unique_id "aTbCBgSNhJPArxLCdWHb0AAAAQo"]
[Mon Dec 08 20:18:15.972909 2025] [:error] [pid 48573:tid 48598] [client 159.223.132.86:44376] [client 159.223.132.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aTbCB1Iayuqwlm3CEkZh0QAAAVc"]
[Mon Dec 08 20:18:17.967245 2025] [:error] [pid 48573:tid 48583] [client 159.223.132.86:44380] [client 159.223.132.86] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aTbCCVIayuqwlm3CEkZh2wAAAUg"]
[Mon Dec 08 20:18:18.983409 2025] [:error] [pid 48541:tid 48548] [client 159.223.132.86:44386] [client 159.223.132.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aTbCCgSNhJPArxLCdWHb2wAAAQU"]
[Mon Dec 08 20:18:19.981563 2025] [:error] [pid 48481:tid 48498] [client 159.223.132.86:35804] [client 159.223.132.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aTbCCye0pzx5KCi3S0L9UAAAAM0"]
[Mon Dec 08 20:18:20.986243 2025] [:error] [pid 48541:tid 48551] [client 159.223.132.86:35818] [client 159.223.132.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/telescope/requests"] [unique_id "aTbCDASNhJPArxLCdWHb4AAAAQg"]
[Mon Dec 08 20:18:21.980080 2025] [:error] [pid 48481:tid 48494] [client 159.223.132.86:35828] [client 159.223.132.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aTbCDSe0pzx5KCi3S0L9UwAAAMk"]
[Mon Dec 08 20:18:22.981634 2025] [:error] [pid 48481:tid 48489] [client 159.223.132.86:35832] [client 159.223.132.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aTbCDie0pzx5KCi3S0L9WQAAAMQ"]
[Mon Dec 08 20:45:07.636327 2025] [:error] [pid 48482:tid 48518] [client 104.164.168.10:56695] [client 104.164.168.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.164.168.10, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTbIU323gV7gRu3vn8106gAAAIY"]
[Mon Dec 08 21:25:22.549036 2025] [:error] [pid 48541:tid 48544] [client 180.102.134.69:45133] [client 180.102.134.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aTbRwgSNhJPArxLCdWH-MQAAAQE"]
[Mon Dec 08 21:59:53.868732 2025] [proxy_fcgi:error] [pid 48573:tid 48584] [client 4.189.110.40:2030] AH01071: Got error 'Primary script unknown', referer: https://www.google.fr/
[Mon Dec 08 21:59:53.982613 2025] [:error] [pid 48573:tid 48599] [client 4.189.110.40:2030] [client 4.189.110.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.189.110.40, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aTbZ2VIayuqwlm3CEkaWEgAAAVg"], referer: https://www.google.co.uk/
[Mon Dec 08 21:59:53.987507 2025] [proxy_fcgi:error] [pid 48573:tid 48599] [client 4.189.110.40:2030] AH01071: Got error 'Primary script unknown', referer: https://www.google.co.uk/
[Mon Dec 08 22:00:25.636429 2025] [autoindex:error] [pid 48573:tid 48590] [client 4.189.110.40:2030] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Mon Dec 08 22:00:26.512111 2025] [autoindex:error] [pid 48573:tid 48578] [client 4.189.110.40:2030] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Mon Dec 08 22:00:35.496905 2025] [:error] [pid 48482:tid 48531] [client 4.189.110.40:2027] [client 4.189.110.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.189.110.40, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTbaA323gV7gRu3vn82QMAAAAJM"], referer: https://www.google.fr/
[Mon Dec 08 22:00:39.742906 2025] [:error] [pid 48482:tid 48525] [client 4.189.110.40:2027] [client 4.189.110.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.189.110.40, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTbaB323gV7gRu3vn82QOgAAAI0"], referer: https://www.google.de/
[Mon Dec 08 22:00:48.737845 2025] [autoindex:error] [pid 48541:tid 48554] [client 4.189.110.40:1998] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentythree/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Mon Dec 08 22:00:50.300812 2025] [:error] [pid 48541:tid 48561] [client 4.189.110.40:1998] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aTbaEgSNhJPArxLCdWEK2QAAARI"], referer: https://www.google.de/
[Mon Dec 08 22:00:51.499921 2025] [:error] [pid 48481:tid 48486] [client 4.189.110.40:2010] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aTbaEye0pzx5KCi3S0IoawAAAME"], referer: https://www.google.de/
[Mon Dec 08 22:00:52.338677 2025] [:error] [pid 48482:tid 48530] [client 4.189.110.40:2016] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aTbaFH23gV7gRu3vn82QTgAAAJI"], referer: https://www.google.fr/
[Mon Dec 08 22:00:53.211915 2025] [:error] [pid 48482:tid 48533] [client 4.189.110.40:1996] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aTbaFX23gV7gRu3vn82QTwAAAJU"], referer: https://www.google.fr/
[Mon Dec 08 22:00:54.151923 2025] [:error] [pid 48541:tid 48552] [client 4.189.110.40:2025] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aTbaFgSNhJPArxLCdWEK4gAAAQk"], referer: https://www.google.fr/
[Mon Dec 08 22:00:54.832673 2025] [:error] [pid 48482:tid 48516] [client 4.189.110.40:2037] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aTbaFn23gV7gRu3vn82QUgAAAIQ"], referer: https://www.google.co.uk/
[Mon Dec 08 22:00:56.388942 2025] [:error] [pid 48482:tid 48526] [client 4.189.110.40:2040] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aTbaGH23gV7gRu3vn82QVQAAAI4"], referer: https://www.google.co.uk/
[Mon Dec 08 22:00:57.552084 2025] [:error] [pid 50569:tid 50577] [client 4.189.110.40:1991] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aTbaGfHhZxyKreYmWzLDrgAAAAU"], referer: https://www.bing.com/
[Mon Dec 08 22:00:58.601739 2025] [:error] [pid 48573:tid 48575] [client 4.189.110.40:1976] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aTbaGlIayuqwlm3CEkaWfwAAAUA"], referer: https://www.google.co.uk/
[Mon Dec 08 22:00:59.457098 2025] [:error] [pid 48482:tid 48521] [client 4.189.110.40:1943] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/xwx1.php"] [unique_id "aTbaG323gV7gRu3vn82QWgAAAIk"], referer: https://www.bing.com/
[Mon Dec 08 22:01:00.058676 2025] [:error] [pid 48482:tid 48531] [client 4.189.110.40:1940] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aTbaHH23gV7gRu3vn82QXQAAAJM"], referer: https://www.google.de/
[Mon Dec 08 22:01:01.258688 2025] [:error] [pid 48573:tid 48590] [client 4.189.110.40:1989] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aTbaHVIayuqwlm3CEkaWgQAAAU8"], referer: https://www.bing.com/
[Mon Dec 08 22:01:02.114088 2025] [:error] [pid 48573:tid 48578] [client 4.189.110.40:2014] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bk/index.php"] [unique_id "aTbaHlIayuqwlm3CEkaWhQAAAUM"], referer: https://www.google.de/
[Mon Dec 08 22:01:03.051834 2025] [:error] [pid 50569:tid 50595] [client 4.189.110.40:1944] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/radio.php"] [unique_id "aTbaH_HhZxyKreYmWzLDvAAAABc"], referer: https://www.google.com/
[Mon Dec 08 22:01:03.767790 2025] [:error] [pid 48541:tid 48560] [client 4.189.110.40:2000] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aTbaHwSNhJPArxLCdWEK7QAAARE"], referer: https://www.bing.com/
[Mon Dec 08 22:01:04.624191 2025] [:error] [pid 48573:tid 48585] [client 4.189.110.40:1990] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-locale-switcher-less.php"] [unique_id "aTbaIFIayuqwlm3CEkaWiQAAAUo"], referer: https://duckduckgo.com/
[Mon Dec 08 22:01:05.419076 2025] [:error] [pid 50569:tid 50592] [client 4.189.110.40:2038] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aTbaIfHhZxyKreYmWzLDwQAAABQ"], referer: https://www.bing.com/
[Mon Dec 08 22:01:06.007654 2025] [:error] [pid 50569:tid 50581] [client 4.189.110.40:2020] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aTbaIvHhZxyKreYmWzLDxQAAAAk"], referer: https://www.google.co.uk/
[Mon Dec 08 22:01:06.476287 2025] [:error] [pid 50569:tid 50572] [client 4.189.110.40:2023] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-media-icon-control.php"] [unique_id "aTbaIvHhZxyKreYmWzLDxwAAAAA"], referer: https://www.google.com/
[Mon Dec 08 22:01:07.457189 2025] [:error] [pid 50569:tid 50589] [client 4.189.110.40:2047] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aTbaI_HhZxyKreYmWzLDygAAABE"], referer: https://www.google.fr/
[Mon Dec 08 22:01:08.561733 2025] [:error] [pid 48541:tid 48555] [client 4.189.110.40:2034] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/sx.php"] [unique_id "aTbaJASNhJPArxLCdWEK8QAAAQw"], referer: https://www.google.fr/
[Mon Dec 08 22:01:09.799232 2025] [:error] [pid 48481:tid 48509] [client 4.189.110.40:1955] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/admin.php"] [unique_id "aTbaJSe0pzx5KCi3S0IoqgAAANg"], referer: https://www.google.fr/
[Mon Dec 08 22:01:10.904490 2025] [:error] [pid 48541:tid 48550] [client 4.189.110.40:2008] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aTbaJgSNhJPArxLCdWEK8wAAAQc"], referer: https://duckduckgo.com/
[Mon Dec 08 22:01:12.106041 2025] [:error] [pid 48573:tid 48595] [client 4.189.110.40:1922] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aTbaKFIayuqwlm3CEkaWkwAAAVQ"], referer: https://www.google.de/
[Mon Dec 08 22:01:13.012023 2025] [:error] [pid 48573:tid 48597] [client 4.189.110.40:1997] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aTbaKVIayuqwlm3CEkaWlQAAAVY"], referer: https://www.google.fr/
[Mon Dec 08 22:01:13.750004 2025] [:error] [pid 48541:tid 48552] [client 4.189.110.40:1935] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aTbaKQSNhJPArxLCdWEK-gAAAQk"], referer: https://www.bing.com/
[Mon Dec 08 22:01:14.510405 2025] [:error] [pid 48481:tid 48500] [client 4.189.110.40:1988] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aTbaKie0pzx5KCi3S0IorgAAAM8"], referer: https://www.google.de/
[Mon Dec 08 22:01:15.089330 2025] [:error] [pid 48573:tid 48587] [client 4.189.110.40:2006] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aTbaK1Iayuqwlm3CEkaWmQAAAUw"], referer: https://duckduckgo.com/
[Mon Dec 08 22:01:15.903171 2025] [:error] [pid 48481:tid 48493] [client 4.189.110.40:2018] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aTbaKye0pzx5KCi3S0IosAAAAMg"], referer: https://www.google.de/
[Mon Dec 08 22:01:16.418416 2025] [:error] [pid 48573:tid 48595] [client 4.189.110.40:1965] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aTbaLFIayuqwlm3CEkaWmwAAAVQ"], referer: https://www.google.de/
[Mon Dec 08 22:01:16.945500 2025] [:error] [pid 50569:tid 50590] [client 4.189.110.40:1868] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aTbaLPHhZxyKreYmWzLD2gAAABI"], referer: https://www.bing.com/
[Mon Dec 08 22:01:17.809092 2025] [:error] [pid 48573:tid 48582] [client 4.189.110.40:1930] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-db-array.php"] [unique_id "aTbaLVIayuqwlm3CEkaWnQAAAUc"], referer: https://www.google.fr/
[Mon Dec 08 22:01:25.950475 2025] [:error] [pid 48481:tid 48499] [client 4.189.110.40:2022] [client 4.189.110.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.189.110.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTbaNSe0pzx5KCi3S0IowwAAAM4"], referer: https://www.google.com/
[Mon Dec 08 22:01:45.620881 2025] [:error] [pid 48573:tid 48585] [client 4.189.110.40:2017] [client 4.189.110.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.189.110.40, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTbaSVIayuqwlm3CEkaW8QAAAUo"], referer: https://www.google.co.uk/
[Mon Dec 08 22:01:48.120989 2025] [autoindex:error] [pid 48481:tid 48487] [client 4.189.110.40:2022] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Mon Dec 08 22:01:48.263282 2025] [autoindex:error] [pid 48481:tid 48506] [client 4.189.110.40:2022] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Mon Dec 08 22:01:49.272091 2025] [autoindex:error] [pid 48481:tid 48498] [client 4.189.110.40:2022] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Mon Dec 08 22:01:49.465117 2025] [:error] [pid 48481:tid 48488] [client 4.189.110.40:2022] [client 4.189.110.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.189.110.40, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aTbaTSe0pzx5KCi3S0IpEgAAAMM"], referer: https://duckduckgo.com/
[Mon Dec 08 22:01:50.917601 2025] [autoindex:error] [pid 48481:tid 48489] [client 4.189.110.40:2022] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Mon Dec 08 22:01:51.035620 2025] [autoindex:error] [pid 48481:tid 48492] [client 4.189.110.40:2022] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Mon Dec 08 22:01:51.333646 2025] [autoindex:error] [pid 48481:tid 48487] [client 4.189.110.40:2022] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Mon Dec 08 22:01:55.677513 2025] [autoindex:error] [pid 48481:tid 48490] [client 4.189.110.40:2022] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Mon Dec 08 22:02:03.626834 2025] [autoindex:error] [pid 48481:tid 48508] [client 4.189.110.40:2022] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Mon Dec 08 22:02:03.877852 2025] [autoindex:error] [pid 48481:tid 48509] [client 4.189.110.40:2022] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Mon Dec 08 22:02:04.081512 2025] [autoindex:error] [pid 48481:tid 48495] [client 4.189.110.40:2022] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Mon Dec 08 22:02:04.202517 2025] [autoindex:error] [pid 48481:tid 48502] [client 4.189.110.40:2022] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Mon Dec 08 22:02:04.326116 2025] [autoindex:error] [pid 48481:tid 48504] [client 4.189.110.40:2022] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Mon Dec 08 22:02:04.599313 2025] [autoindex:error] [pid 48481:tid 48486] [client 4.189.110.40:2022] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Mon Dec 08 22:02:04.718435 2025] [autoindex:error] [pid 48481:tid 48498] [client 4.189.110.40:2022] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Mon Dec 08 22:02:04.837268 2025] [autoindex:error] [pid 48481:tid 48503] [client 4.189.110.40:2022] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Mon Dec 08 22:02:04.976399 2025] [autoindex:error] [pid 48481:tid 48491] [client 4.189.110.40:2022] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Mon Dec 08 22:02:05.315145 2025] [autoindex:error] [pid 48481:tid 48494] [client 4.189.110.40:2022] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Mon Dec 08 22:02:05.434806 2025] [autoindex:error] [pid 48481:tid 48500] [client 4.189.110.40:2022] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Mon Dec 08 22:02:05.555938 2025] [autoindex:error] [pid 48481:tid 48501] [client 4.189.110.40:2022] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Mon Dec 08 22:02:05.673770 2025] [autoindex:error] [pid 48481:tid 48485] [client 4.189.110.40:2022] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Mon Dec 08 22:02:05.880508 2025] [:error] [pid 48481:tid 48490] [client 4.189.110.40:2022] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/autoload_classmap.php"] [unique_id "aTbaXSe0pzx5KCi3S0IpRgAAAMU"], referer: https://www.google.fr/
[Mon Dec 08 22:02:06.481453 2025] [:error] [pid 50569:tid 50580] [client 4.189.110.40:1873] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/chosen.php"] [unique_id "aTbaXvHhZxyKreYmWzLESwAAAAg"], referer: https://www.google.de/
[Mon Dec 08 22:02:07.316858 2025] [:error] [pid 48482:tid 48519] [client 4.189.110.40:2036] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aTbaX323gV7gRu3vn82QvAAAAIc"], referer: https://duckduckgo.com/
[Mon Dec 08 22:02:07.980261 2025] [:error] [pid 50569:tid 50582] [client 4.189.110.40:2028] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aTbaX_HhZxyKreYmWzLETQAAAAo"], referer: https://duckduckgo.com/
[Mon Dec 08 22:02:08.643917 2025] [:error] [pid 48573:tid 48591] [client 4.189.110.40:1954] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aTbaYFIayuqwlm3CEkaXLAAAAVA"], referer: https://www.bing.com/
[Mon Dec 08 22:02:10.017982 2025] [autoindex:error] [pid 48573:tid 48577] [client 4.189.110.40:1985] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Mon Dec 08 22:02:10.138265 2025] [autoindex:error] [pid 48573:tid 48578] [client 4.189.110.40:1985] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Mon Dec 08 22:02:10.255944 2025] [:error] [pid 48573:tid 48592] [client 4.189.110.40:1985] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/search/index.php"] [unique_id "aTbaYlIayuqwlm3CEkaXMAAAAVE"], referer: https://www.bing.com/
[Mon Dec 08 22:02:11.102231 2025] [:error] [pid 50569:tid 50573] [client 4.189.110.40:1932] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aTbaY_HhZxyKreYmWzLEVQAAAAE"], referer: https://www.google.fr/
[Mon Dec 08 22:02:12.221732 2025] [:error] [pid 48482:tid 48519] [client 4.189.110.40:2042] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aTbaZH23gV7gRu3vn82QwQAAAIc"], referer: https://duckduckgo.com/
[Mon Dec 08 22:02:12.836790 2025] [:error] [pid 50569:tid 50575] [client 4.189.110.40:1999] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aTbaZPHhZxyKreYmWzLEWAAAAAM"], referer: https://www.google.com/
[Mon Dec 08 22:02:13.863388 2025] [autoindex:error] [pid 48573:tid 48584] [client 4.189.110.40:2035] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Mon Dec 08 22:02:13.999378 2025] [:error] [pid 48573:tid 48596] [client 4.189.110.40:2035] [client 4.189.110.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aTbaZVIayuqwlm3CEkaXNAAAAVU"], referer: https://www.yahoo.com/
[Mon Dec 08 22:02:16.126905 2025] [autoindex:error] [pid 48573:tid 48578] [client 4.189.110.40:2012] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Mon Dec 08 22:02:16.415732 2025] [autoindex:error] [pid 48573:tid 48592] [client 4.189.110.40:2012] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Mon Dec 08 22:02:16.600965 2025] [autoindex:error] [pid 48573:tid 48583] [client 4.189.110.40:2012] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Mon Dec 08 22:02:17.003227 2025] [autoindex:error] [pid 48573:tid 48582] [client 4.189.110.40:2012] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Mon Dec 08 22:02:17.140259 2025] [autoindex:error] [pid 48573:tid 48588] [client 4.189.110.40:2012] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Mon Dec 08 22:02:21.133540 2025] [:error] [pid 48541:tid 48545] [client 4.189.110.40:1935] [client 4.189.110.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.189.110.40, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTbabQSNhJPArxLCdWELXAAAAQI"], referer: https://www.google.co.uk/
[Mon Dec 08 22:02:23.244680 2025] [:error] [pid 48541:tid 48550] [client 4.189.110.40:1935] [client 4.189.110.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.189.110.40, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTbabwSNhJPArxLCdWELYQAAAQc"], referer: https://www.google.de/
[Mon Dec 08 22:02:24.225645 2025] [autoindex:error] [pid 48573:tid 48594] [client 4.189.110.40:2012] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Mon Dec 08 22:02:24.344633 2025] [autoindex:error] [pid 48573:tid 48579] [client 4.189.110.40:2012] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Mon Dec 08 22:06:15.645928 2025] [autoindex:error] [pid 48481:tid 48496] [client 13.70.2.1:24689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Dec 08 22:06:16.986458 2025] [autoindex:error] [pid 48481:tid 48489] [client 13.70.2.1:24689] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Dec 08 22:06:23.287272 2025] [:error] [pid 50569:tid 50595] [client 13.70.2.1:24661] [client 13.70.2.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 13.70.2.1, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTbbX_HhZxyKreYmWzLGzwAAABc"]
[Mon Dec 08 22:06:40.184334 2025] [:error] [pid 48481:tid 48509] [client 13.70.2.1:24690] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/"] [unique_id "aTbbcCe0pzx5KCi3S0IqgQAAANg"]
[Mon Dec 08 22:06:40.453996 2025] [:error] [pid 48573:tid 48595] [client 13.70.2.1:24661] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/"] [unique_id "aTbbcFIayuqwlm3CEkaYlQAAAVQ"]
[Mon Dec 08 22:06:41.018115 2025] [:error] [pid 50569:tid 50590] [client 13.70.2.1:24577] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/"] [unique_id "aTbbcfHhZxyKreYmWzLG4gAAABI"]
[Mon Dec 08 22:06:41.773815 2025] [:error] [pid 50569:tid 50572] [client 13.70.2.1:24590] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/"] [unique_id "aTbbcfHhZxyKreYmWzLG5QAAAAA"]
[Mon Dec 08 22:06:42.711497 2025] [:error] [pid 48541:tid 48547] [client 13.70.2.1:24598] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "aTbbcgSNhJPArxLCdWEM_QAAAQQ"]
[Mon Dec 08 22:06:43.364920 2025] [:error] [pid 48482:tid 48532] [client 13.70.2.1:24696] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "aTbbc323gV7gRu3vn82SAwAAAJQ"]
[Mon Dec 08 22:06:44.135528 2025] [:error] [pid 48573:tid 48593] [client 13.70.2.1:24672] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "aTbbdFIayuqwlm3CEkaYlgAAAVI"]
[Mon Dec 08 22:06:45.128429 2025] [:error] [pid 48482:tid 48525] [client 13.70.2.1:24660] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "aTbbdX23gV7gRu3vn82SBQAAAI0"]
[Mon Dec 08 22:06:45.639144 2025] [:error] [pid 48481:tid 48504] [client 13.70.2.1:24584] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/"] [unique_id "aTbbdSe0pzx5KCi3S0IqgwAAANM"]
[Mon Dec 08 22:06:46.237288 2025] [:error] [pid 48482:tid 48536] [client 13.70.2.1:24699] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/"] [unique_id "aTbbdn23gV7gRu3vn82SBwAAAJg"]
[Mon Dec 08 22:06:46.980170 2025] [:error] [pid 48573:tid 48595] [client 13.70.2.1:24589] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/"] [unique_id "aTbbdlIayuqwlm3CEkaYnAAAAVQ"]
[Mon Dec 08 22:06:48.296477 2025] [:error] [pid 48482:tid 48531] [client 13.70.2.1:24665] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/"] [unique_id "aTbbeH23gV7gRu3vn82SCwAAAJM"]
[Mon Dec 08 22:06:48.618265 2025] [:error] [pid 48481:tid 48500] [client 13.70.2.1:24695] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "aTbbeCe0pzx5KCi3S0IqhgAAAM8"]
[Mon Dec 08 22:06:48.989082 2025] [:error] [pid 48481:tid 48506] [client 13.70.2.1:24625] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "aTbbeCe0pzx5KCi3S0IqhwAAANU"]
[Mon Dec 08 22:06:49.511328 2025] [:error] [pid 48573:tid 48591] [client 13.70.2.1:24576] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "aTbbeVIayuqwlm3CEkaYpQAAAVA"]
[Mon Dec 08 22:06:50.189225 2025] [:error] [pid 50569:tid 50580] [client 13.70.2.1:24676] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "aTbbevHhZxyKreYmWzLG9gAAAAg"]
[Mon Dec 08 22:06:51.017610 2025] [:error] [pid 48541:tid 48564] [client 13.70.2.1:24679] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/"] [unique_id "aTbbewSNhJPArxLCdWENAwAAARU"]
[Mon Dec 08 22:06:52.480897 2025] [:error] [pid 48482:tid 48529] [client 13.70.2.1:24594] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/"] [unique_id "aTbbfH23gV7gRu3vn82SDgAAAJE"]
[Mon Dec 08 22:06:53.364724 2025] [:error] [pid 50569:tid 50573] [client 13.70.2.1:24597] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/"] [unique_id "aTbbffHhZxyKreYmWzLG-wAAAAE"]
[Mon Dec 08 22:06:54.524311 2025] [:error] [pid 48573:tid 48579] [client 13.70.2.1:24605] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/"] [unique_id "aTbbflIayuqwlm3CEkaYqAAAAUQ"]
[Mon Dec 08 22:06:55.333823 2025] [:error] [pid 48573:tid 48595] [client 13.70.2.1:24604] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-knownold/"] [unique_id "aTbbf1Iayuqwlm3CEkaYqQAAAVQ"]
[Mon Dec 08 22:06:55.878245 2025] [:error] [pid 50569:tid 50586] [client 13.70.2.1:4034] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-knownold/"] [unique_id "aTbbf_HhZxyKreYmWzLHAQAAAA4"]
[Mon Dec 08 22:06:56.202311 2025] [:error] [pid 48482:tid 48525] [client 13.70.2.1:4044] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-knownold/"] [unique_id "aTbbgH23gV7gRu3vn82SFAAAAI0"]
[Mon Dec 08 22:06:57.004306 2025] [:error] [pid 48481:tid 48491] [client 13.70.2.1:24582] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-knownold/"] [unique_id "aTbbgSe0pzx5KCi3S0IqjQAAAMY"]
[Mon Dec 08 22:06:58.076854 2025] [:error] [pid 48481:tid 48497] [client 13.70.2.1:24580] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/"] [unique_id "aTbbgie0pzx5KCi3S0IqlAAAAMw"]
[Mon Dec 08 22:06:59.659190 2025] [:error] [pid 48573:tid 48582] [client 13.70.2.1:24691] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/"] [unique_id "aTbbg1Iayuqwlm3CEkaYswAAAUc"]
[Mon Dec 08 22:07:02.382370 2025] [:error] [pid 48482:tid 48513] [client 13.70.2.1:24650] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/"] [unique_id "aTbbhn23gV7gRu3vn82SGAAAAIE"]
[Mon Dec 08 22:07:03.656120 2025] [:error] [pid 48573:tid 48592] [client 13.70.2.1:24680] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/"] [unique_id "aTbbh1Iayuqwlm3CEkaYvwAAAVE"]
[Mon Dec 08 22:07:04.836654 2025] [:error] [pid 48541:tid 48558] [client 13.70.2.1:24693] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/"] [unique_id "aTbbiASNhJPArxLCdWENLAAAAQ8"]
[Mon Dec 08 22:07:06.660040 2025] [:error] [pid 48541:tid 48566] [client 13.70.2.1:24602] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/"] [unique_id "aTbbigSNhJPArxLCdWENLwAAARc"]
[Mon Dec 08 22:07:08.401267 2025] [:error] [pid 48481:tid 48507] [client 13.70.2.1:24687] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/"] [unique_id "aTbbjCe0pzx5KCi3S0IqqgAAANY"]
[Mon Dec 08 22:07:11.409715 2025] [:error] [pid 48482:tid 48535] [client 13.70.2.1:24641] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/"] [unique_id "aTbbj323gV7gRu3vn82SIwAAAJc"]
[Mon Dec 08 22:07:13.236037 2025] [:error] [pid 50569:tid 50585] [client 13.70.2.1:24644] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/"] [unique_id "aTbbkfHhZxyKreYmWzLHHwAAAA0"]
[Mon Dec 08 22:07:14.360839 2025] [:error] [pid 50569:tid 50592] [client 13.70.2.1:24653] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/"] [unique_id "aTbbkvHhZxyKreYmWzLHIgAAABQ"]
[Mon Dec 08 22:07:15.763684 2025] [:error] [pid 48573:tid 48582] [client 13.70.2.1:24617] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/"] [unique_id "aTbbk1Iayuqwlm3CEkaYxAAAAUc"]
[Mon Dec 08 22:07:18.153691 2025] [:error] [pid 48482:tid 48515] [client 13.70.2.1:24616] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/"] [unique_id "aTbbln23gV7gRu3vn82SKgAAAIM"]
[Mon Dec 08 22:07:20.908195 2025] [:error] [pid 48573:tid 48591] [client 13.70.2.1:24613] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tmp/"] [unique_id "aTbbmFIayuqwlm3CEkaYygAAAVA"]
[Mon Dec 08 22:07:23.544528 2025] [:error] [pid 48541:tid 48544] [client 13.70.2.1:24659] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tmp/"] [unique_id "aTbbmwSNhJPArxLCdWENNgAAAQE"]
[Mon Dec 08 22:07:24.616957 2025] [:error] [pid 48541:tid 48543] [client 13.70.2.1:24702] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tmp/"] [unique_id "aTbbnASNhJPArxLCdWENOAAAAQA"]
[Mon Dec 08 22:07:25.303144 2025] [:error] [pid 48573:tid 48594] [client 13.70.2.1:24685] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tmp/"] [unique_id "aTbbnVIayuqwlm3CEkaY0AAAAVM"]
[Mon Dec 08 22:07:26.401370 2025] [:error] [pid 48541:tid 48563] [client 13.70.2.1:24591] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "aTbbngSNhJPArxLCdWENPgAAARQ"]
[Mon Dec 08 22:07:27.429321 2025] [:error] [pid 48541:tid 48549] [client 13.70.2.1:24627] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "aTbbnwSNhJPArxLCdWENQAAAAQY"]
[Mon Dec 08 22:07:29.207914 2025] [:error] [pid 48541:tid 48560] [client 13.70.2.1:24654] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "aTbboQSNhJPArxLCdWENRQAAARE"]
[Mon Dec 08 22:07:30.412418 2025] [:error] [pid 48541:tid 48548] [client 13.70.2.1:24621] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "aTbbogSNhJPArxLCdWENRwAAAQU"]
[Mon Dec 08 22:07:31.653280 2025] [:error] [pid 50569:tid 50581] [client 13.70.2.1:4040] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/"] [unique_id "aTbbo_HhZxyKreYmWzLHMgAAAAk"]
[Mon Dec 08 22:07:33.264373 2025] [:error] [pid 48481:tid 48485] [client 13.70.2.1:24643] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/"] [unique_id "aTbbpSe0pzx5KCi3S0IqwQAAAMA"]
[Mon Dec 08 22:07:34.368475 2025] [:error] [pid 48541:tid 48560] [client 13.70.2.1:24657] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/"] [unique_id "aTbbpgSNhJPArxLCdWENSgAAARE"]
[Mon Dec 08 22:07:35.738430 2025] [:error] [pid 48541:tid 48557] [client 13.70.2.1:24698] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/"] [unique_id "aTbbpwSNhJPArxLCdWENTAAAAQ4"]
[Mon Dec 08 22:07:37.228299 2025] [:error] [pid 50569:tid 50575] [client 13.70.2.1:3968] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/"] [unique_id "aTbbqfHhZxyKreYmWzLHOQAAAAM"]
[Mon Dec 08 22:07:38.255006 2025] [:error] [pid 48573:tid 48585] [client 13.70.2.1:24678] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/"] [unique_id "aTbbqlIayuqwlm3CEkaY3AAAAUo"]
[Mon Dec 08 22:07:45.435612 2025] [:error] [pid 48573:tid 48576] [client 13.70.2.1:24673] [client 13.70.2.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 13.70.2.1, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTbbsVIayuqwlm3CEkaY5AAAAUE"]
[Mon Dec 08 22:07:54.116395 2025] [autoindex:error] [pid 48481:tid 48488] [client 13.70.2.1:24583] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Dec 08 22:07:54.238096 2025] [autoindex:error] [pid 48481:tid 48502] [client 13.70.2.1:24583] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Dec 08 22:07:54.361237 2025] [autoindex:error] [pid 48481:tid 48494] [client 13.70.2.1:24583] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Dec 08 22:07:54.492963 2025] [autoindex:error] [pid 48481:tid 48500] [client 13.70.2.1:24583] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Dec 08 22:07:55.318175 2025] [:error] [pid 48481:tid 48489] [client 13.70.2.1:24583] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-knownold/"] [unique_id "aTbbuye0pzx5KCi3S0Iq4QAAAMQ"]
[Mon Dec 08 22:07:56.194014 2025] [:error] [pid 48481:tid 48504] [client 13.70.2.1:24646] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-knownold/"] [unique_id "aTbbvCe0pzx5KCi3S0Iq4wAAANM"]
[Mon Dec 08 22:07:56.568098 2025] [:error] [pid 48481:tid 48487] [client 13.70.2.1:24630] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-knownold/"] [unique_id "aTbbvCe0pzx5KCi3S0Iq5AAAAMI"]
[Mon Dec 08 22:07:57.013500 2025] [:error] [pid 48481:tid 48501] [client 13.70.2.1:24593] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-knownold/"] [unique_id "aTbbvSe0pzx5KCi3S0Iq5gAAANA"]
[Mon Dec 08 22:07:57.382742 2025] [:error] [pid 48481:tid 48492] [client 13.70.2.1:24703] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/"] [unique_id "aTbbvSe0pzx5KCi3S0Iq6AAAAMc"]
[Mon Dec 08 22:07:58.419987 2025] [:error] [pid 48573:tid 48592] [client 13.70.2.1:24636] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/"] [unique_id "aTbbvlIayuqwlm3CEkaY9wAAAVE"]
[Mon Dec 08 22:07:58.775881 2025] [:error] [pid 48541:tid 48554] [client 13.70.2.1:24669] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/"] [unique_id "aTbbvgSNhJPArxLCdWENgQAAAQs"]
[Mon Dec 08 22:07:59.371336 2025] [:error] [pid 48573:tid 48590] [client 13.70.2.1:4089] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/"] [unique_id "aTbbv1Iayuqwlm3CEkaY-gAAAU8"]
[Mon Dec 08 22:08:00.095834 2025] [:error] [pid 50569:tid 50579] [client 13.70.2.1:24640] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/"] [unique_id "aTbbwPHhZxyKreYmWzLHUAAAAAc"]
[Mon Dec 08 22:08:00.964476 2025] [:error] [pid 48573:tid 48595] [client 13.70.2.1:24606] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/"] [unique_id "aTbbwFIayuqwlm3CEkaY_QAAAVQ"]
[Mon Dec 08 22:08:01.722799 2025] [:error] [pid 48573:tid 48596] [client 13.70.2.1:24692] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/"] [unique_id "aTbbwVIayuqwlm3CEkaY_gAAAVU"]
[Mon Dec 08 22:08:02.598980 2025] [:error] [pid 48482:tid 48517] [client 13.70.2.1:3988] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/"] [unique_id "aTbbwn23gV7gRu3vn82SigAAAIU"]
[Mon Dec 08 22:08:04.711418 2025] [:error] [pid 48481:tid 48485] [client 13.70.2.1:24700] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aTbbxCe0pzx5KCi3S0Iq9gAAAMA"]
[Mon Dec 08 22:08:05.955135 2025] [:error] [pid 48481:tid 48495] [client 13.70.2.1:24600] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aTbbxSe0pzx5KCi3S0Iq-QAAAMo"]
[Mon Dec 08 22:08:06.405793 2025] [:error] [pid 48481:tid 48505] [client 13.70.2.1:24578] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aTbbxie0pzx5KCi3S0Iq-wAAANQ"]
[Mon Dec 08 22:08:06.977585 2025] [:error] [pid 48481:tid 48499] [client 13.70.2.1:24663] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aTbbxie0pzx5KCi3S0Iq_wAAAM4"]
[Mon Dec 08 22:08:07.769287 2025] [:error] [pid 48541:tid 48548] [client 13.70.2.1:24579] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aTbbxwSNhJPArxLCdWENjgAAAQU"]
[Mon Dec 08 22:08:08.773177 2025] [:error] [pid 48481:tid 48491] [client 13.70.2.1:24587] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aTbbyCe0pzx5KCi3S0IrBwAAAMY"]
[Mon Dec 08 22:08:09.506336 2025] [:error] [pid 48481:tid 48507] [client 13.70.2.1:24683] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aTbbySe0pzx5KCi3S0IrCgAAANY"]
[Mon Dec 08 22:08:10.554569 2025] [:error] [pid 48541:tid 48550] [client 13.70.2.1:4050] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aTbbygSNhJPArxLCdWENkQAAAQc"]
[Mon Dec 08 22:08:11.783723 2025] [:error] [pid 50569:tid 50587] [client 13.70.2.1:4035] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aTbby_HhZxyKreYmWzLHVAAAAA8"]
[Mon Dec 08 22:08:12.982752 2025] [:error] [pid 48573:tid 48592] [client 13.70.2.1:4078] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aTbbzFIayuqwlm3CEkaZCQAAAVE"]
[Mon Dec 08 22:08:14.523745 2025] [:error] [pid 48573:tid 48590] [client 13.70.2.1:24629] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aTbbzlIayuqwlm3CEkaZCwAAAU8"]
[Mon Dec 08 22:08:15.820943 2025] [:error] [pid 48482:tid 48524] [client 13.70.2.1:24656] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aTbbz323gV7gRu3vn82SrwAAAIw"]
[Mon Dec 08 22:08:16.494615 2025] [:error] [pid 48482:tid 48523] [client 13.70.2.1:24585] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "aTbb0H23gV7gRu3vn82SsAAAAIs"]
[Mon Dec 08 22:08:16.910703 2025] [:error] [pid 48481:tid 48490] [client 13.70.2.1:4032] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "aTbb0Ce0pzx5KCi3S0IrEQAAAMU"]
[Mon Dec 08 22:08:17.385539 2025] [:error] [pid 48481:tid 48504] [client 13.70.2.1:24612] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "aTbb0Se0pzx5KCi3S0IrEgAAANM"]
[Mon Dec 08 22:08:17.929561 2025] [:error] [pid 48573:tid 48584] [client 13.70.2.1:24588] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "aTbb0VIayuqwlm3CEkaZEQAAAUk"]
[Mon Dec 08 22:08:19.244162 2025] [:error] [pid 50569:tid 50572] [client 13.70.2.1:24664] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aTbb0_HhZxyKreYmWzLHXgAAAAA"]
[Mon Dec 08 22:08:20.621616 2025] [:error] [pid 48541:tid 48567] [client 13.70.2.1:24618] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aTbb1ASNhJPArxLCdWENowAAARg"]
[Mon Dec 08 22:08:21.539035 2025] [:error] [pid 48481:tid 48503] [client 13.70.2.1:4051] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aTbb1Se0pzx5KCi3S0IrGAAAANI"]
[Mon Dec 08 22:08:22.331999 2025] [:error] [pid 48573:tid 48595] [client 13.70.2.1:4042] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aTbb1lIayuqwlm3CEkaZFgAAAVQ"]
[Mon Dec 08 22:08:23.159049 2025] [:error] [pid 48573:tid 48588] [client 13.70.2.1:4045] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aTbb11Iayuqwlm3CEkaZGwAAAU0"]
[Mon Dec 08 22:08:24.012931 2025] [:error] [pid 48482:tid 48516] [client 13.70.2.1:24603] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aTbb2H23gV7gRu3vn82SugAAAIQ"]
[Mon Dec 08 22:08:24.989487 2025] [:error] [pid 48481:tid 48490] [client 13.70.2.1:4056] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aTbb2Ce0pzx5KCi3S0IrOAAAAMU"]
[Mon Dec 08 22:08:26.084103 2025] [:error] [pid 48541:tid 48560] [client 13.70.2.1:4071] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aTbb2gSNhJPArxLCdWENxgAAARE"]
[Mon Dec 08 22:08:27.634358 2025] [:error] [pid 50569:tid 50580] [client 13.70.2.1:4070] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ini.php"] [unique_id "aTbb2_HhZxyKreYmWzLHYwAAAAg"]
[Mon Dec 08 22:08:29.358441 2025] [:error] [pid 48573:tid 48579] [client 13.70.2.1:4067] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ini.php"] [unique_id "aTbb3VIayuqwlm3CEkaZMAAAAUQ"]
[Mon Dec 08 22:08:30.539987 2025] [:error] [pid 48573:tid 48575] [client 13.70.2.1:24658] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ini.php"] [unique_id "aTbb3lIayuqwlm3CEkaZNgAAAUA"]
[Mon Dec 08 22:08:31.608130 2025] [:error] [pid 48541:tid 48550] [client 13.70.2.1:24592] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ini.php"] [unique_id "aTbb3wSNhJPArxLCdWEN0QAAAQc"]
[Mon Dec 08 22:08:33.504468 2025] [:error] [pid 48481:tid 48508] [client 13.70.2.1:4091] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php"] [unique_id "aTbb4Se0pzx5KCi3S0IrSAAAANc"]
[Mon Dec 08 22:08:35.654653 2025] [:error] [pid 48482:tid 48527] [client 13.70.2.1:24633] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php"] [unique_id "aTbb4323gV7gRu3vn82SwAAAAI8"]
[Mon Dec 08 22:08:37.421304 2025] [:error] [pid 48481:tid 48489] [client 13.70.2.1:24647] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php"] [unique_id "aTbb5Se0pzx5KCi3S0IrVQAAAMQ"]
[Mon Dec 08 22:08:38.601947 2025] [:error] [pid 48541:tid 48557] [client 13.70.2.1:4046] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php"] [unique_id "aTbb5gSNhJPArxLCdWEN-QAAAQ4"]
[Mon Dec 08 22:08:39.502116 2025] [:error] [pid 50569:tid 50596] [client 13.70.2.1:24635] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aTbb5_HhZxyKreYmWzLHdgAAABg"]
[Mon Dec 08 22:08:40.614526 2025] [:error] [pid 48573:tid 48583] [client 13.70.2.1:3970] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aTbb6FIayuqwlm3CEkaZSgAAAUg"]
[Mon Dec 08 22:08:41.955235 2025] [:error] [pid 48482:tid 48514] [client 13.70.2.1:4063] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aTbb6X23gV7gRu3vn82SxQAAAII"]
[Mon Dec 08 22:08:43.231589 2025] [:error] [pid 48482:tid 48521] [client 13.70.2.1:24686] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aTbb6323gV7gRu3vn82SywAAAIk"]
[Mon Dec 08 22:08:45.285415 2025] [:error] [pid 48482:tid 48530] [client 13.70.2.1:24701] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aTbb7X23gV7gRu3vn82S0AAAAJI"]
[Mon Dec 08 22:08:47.039964 2025] [:error] [pid 48541:tid 48561] [client 13.70.2.1:24601] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aTbb7wSNhJPArxLCdWEOBwAAARI"]
[Mon Dec 08 22:08:48.459778 2025] [:error] [pid 48541:tid 48562] [client 13.70.2.1:24667] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aTbb8ASNhJPArxLCdWEODAAAARM"]
[Mon Dec 08 22:08:49.089263 2025] [:error] [pid 48573:tid 48592] [client 13.70.2.1:24619] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aTbb8VIayuqwlm3CEkaZWwAAAVE"]
[Mon Dec 08 22:08:50.268148 2025] [:error] [pid 48541:tid 48560] [client 13.70.2.1:24624] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aTbb8gSNhJPArxLCdWEOEAAAARE"]
[Mon Dec 08 22:08:51.527946 2025] [:error] [pid 48573:tid 48593] [client 13.70.2.1:24642] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aTbb81Iayuqwlm3CEkaZbAAAAVI"]
[Mon Dec 08 22:08:53.055433 2025] [:error] [pid 48573:tid 48598] [client 13.70.2.1:24631] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aTbb9VIayuqwlm3CEkaZcgAAAVc"]
[Mon Dec 08 22:09:00.454242 2025] [:error] [pid 48573:tid 48599] [client 13.70.2.1:24651] [client 13.70.2.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aTbb_FIayuqwlm3CEkaZhgAAAVg"]
[Mon Dec 08 22:09:06.643406 2025] [:error] [pid 48541:tid 48543] [client 13.70.2.1:4059] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "aTbcAgSNhJPArxLCdWEOkwAAAQA"]
[Mon Dec 08 22:09:07.955222 2025] [:error] [pid 50569:tid 50583] [client 13.70.2.1:24611] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "aTbcA_HhZxyKreYmWzLHwAAAAAs"]
[Mon Dec 08 22:09:08.589108 2025] [:error] [pid 50569:tid 50588] [client 13.70.2.1:4054] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "aTbcBPHhZxyKreYmWzLHwQAAABA"]
[Mon Dec 08 22:09:09.200402 2025] [:error] [pid 48573:tid 48593] [client 13.70.2.1:24607] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "aTbcBVIayuqwlm3CEkaZogAAAVI"]
[Mon Dec 08 22:09:09.941054 2025] [:error] [pid 48541:tid 48566] [client 13.70.2.1:24623] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aTbcBQSNhJPArxLCdWEOlAAAARc"]
[Mon Dec 08 22:09:10.675494 2025] [:error] [pid 48482:tid 48518] [client 13.70.2.1:4055] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aTbcBn23gV7gRu3vn82S-wAAAIY"]
[Mon Dec 08 22:09:11.616335 2025] [:error] [pid 50569:tid 50572] [client 13.70.2.1:24697] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aTbcB_HhZxyKreYmWzLHzAAAAAA"]
[Mon Dec 08 22:09:12.253192 2025] [:error] [pid 48573:tid 48595] [client 13.70.2.1:4074] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aTbcCFIayuqwlm3CEkaZpAAAAVQ"]
[Mon Dec 08 22:09:12.858951 2025] [:error] [pid 48482:tid 48521] [client 13.70.2.1:4014] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/he.php"] [unique_id "aTbcCH23gV7gRu3vn82S_AAAAIk"]
[Mon Dec 08 22:09:13.212633 2025] [:error] [pid 48482:tid 48513] [client 13.70.2.1:24666] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/he.php"] [unique_id "aTbcCX23gV7gRu3vn82S_QAAAIE"]
[Mon Dec 08 22:09:13.627199 2025] [:error] [pid 50569:tid 50583] [client 13.70.2.1:3998] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/he.php"] [unique_id "aTbcCfHhZxyKreYmWzLH3QAAAAs"]
[Mon Dec 08 22:09:14.406585 2025] [:error] [pid 50569:tid 50576] [client 13.70.2.1:24673] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/he.php"] [unique_id "aTbcCvHhZxyKreYmWzLH4gAAAAQ"]
[Mon Dec 08 22:09:15.328961 2025] [:error] [pid 48482:tid 48527] [client 13.70.2.1:4062] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plss3.php"] [unique_id "aTbcC323gV7gRu3vn82TAAAAAI8"]
[Mon Dec 08 22:09:16.424807 2025] [:error] [pid 48481:tid 48487] [client 13.70.2.1:4072] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plss3.php"] [unique_id "aTbcDCe0pzx5KCi3S0IrpQAAAMI"]
[Mon Dec 08 22:09:17.740487 2025] [:error] [pid 48541:tid 48556] [client 13.70.2.1:4088] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plss3.php"] [unique_id "aTbcDQSNhJPArxLCdWEOpQAAAQ0"]
[Mon Dec 08 22:09:18.763315 2025] [:error] [pid 48482:tid 48534] [client 13.70.2.1:24668] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plss3.php"] [unique_id "aTbcDn23gV7gRu3vn82TDQAAAJY"]
[Mon Dec 08 22:09:21.130471 2025] [:error] [pid 48482:tid 48518] [client 13.70.2.1:4043] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "aTbcEX23gV7gRu3vn82TDgAAAIY"]
[Mon Dec 08 22:09:21.980897 2025] [:error] [pid 48573:tid 48589] [client 13.70.2.1:4038] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "aTbcEVIayuqwlm3CEkaZvAAAAU4"]
[Mon Dec 08 22:09:23.062959 2025] [:error] [pid 50569:tid 50578] [client 13.70.2.1:4009] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "aTbcE_HhZxyKreYmWzLIBwAAAAY"]
[Mon Dec 08 22:09:24.397952 2025] [:error] [pid 48541:tid 48565] [client 13.70.2.1:4066] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "aTbcFASNhJPArxLCdWEOxQAAARY"]
[Mon Dec 08 22:09:28.812371 2025] [:error] [pid 48541:tid 48550] [client 13.70.2.1:24581] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nfile.php"] [unique_id "aTbcGASNhJPArxLCdWEO6wAAAQc"]
[Mon Dec 08 22:09:29.115531 2025] [:error] [pid 48481:tid 48487] [client 13.70.2.1:24688] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nfile.php"] [unique_id "aTbcGSe0pzx5KCi3S0IrvwAAAMI"]
[Mon Dec 08 22:09:29.604227 2025] [:error] [pid 48541:tid 48554] [client 13.70.2.1:24614] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nfile.php"] [unique_id "aTbcGQSNhJPArxLCdWEO8QAAAQs"]
[Mon Dec 08 22:09:30.983986 2025] [:error] [pid 48541:tid 48549] [client 13.70.2.1:24649] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nfile.php"] [unique_id "aTbcGgSNhJPArxLCdWEO-gAAAQY"]
[Mon Dec 08 22:09:32.707511 2025] [:error] [pid 48481:tid 48494] [client 13.70.2.1:24593] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ffile.php"] [unique_id "aTbcHCe0pzx5KCi3S0IrxQAAAMk"]
[Mon Dec 08 22:09:34.327527 2025] [:error] [pid 48481:tid 48503] [client 13.70.2.1:24681] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ffile.php"] [unique_id "aTbcHie0pzx5KCi3S0IryQAAANI"]
[Mon Dec 08 22:09:35.530030 2025] [:error] [pid 48541:tid 48551] [client 13.70.2.1:4093] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ffile.php"] [unique_id "aTbcHwSNhJPArxLCdWEPAwAAAQg"]
[Mon Dec 08 22:09:36.842090 2025] [:error] [pid 50569:tid 50596] [client 13.70.2.1:4010] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ffile.php"] [unique_id "aTbcIPHhZxyKreYmWzLINgAAABg"]
[Mon Dec 08 22:09:37.799606 2025] [:error] [pid 50569:tid 50576] [client 13.70.2.1:24608] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "aTbcIfHhZxyKreYmWzLIOwAAAAQ"]
[Mon Dec 08 22:09:38.882964 2025] [:error] [pid 48573:tid 48582] [client 13.70.2.1:4033] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "aTbcIlIayuqwlm3CEkaaFgAAAUc"]
[Mon Dec 08 22:09:39.546496 2025] [:error] [pid 50569:tid 50575] [client 13.70.2.1:4058] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "aTbcI_HhZxyKreYmWzLIQgAAAAM"]
[Mon Dec 08 22:09:40.871775 2025] [:error] [pid 48573:tid 48584] [client 13.70.2.1:24638] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "aTbcJFIayuqwlm3CEkaaGwAAAUk"]
[Mon Dec 08 22:09:41.798086 2025] [:error] [pid 50569:tid 50585] [client 13.70.2.1:3996] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file21.php"] [unique_id "aTbcJfHhZxyKreYmWzLITAAAAA0"]
[Mon Dec 08 22:09:42.820265 2025] [:error] [pid 48541:tid 48562] [client 13.70.2.1:24684] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file21.php"] [unique_id "aTbcJgSNhJPArxLCdWEPEQAAARM"]
[Mon Dec 08 22:09:43.599423 2025] [:error] [pid 50569:tid 50587] [client 13.70.2.1:3991] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file21.php"] [unique_id "aTbcJ_HhZxyKreYmWzLIVAAAAA8"]
[Mon Dec 08 22:09:45.054715 2025] [:error] [pid 48541:tid 48564] [client 13.70.2.1:4019] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file21.php"] [unique_id "aTbcKQSNhJPArxLCdWEPFAAAARU"]
[Mon Dec 08 22:09:46.632546 2025] [:error] [pid 48573:tid 48576] [client 13.70.2.1:3999] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "aTbcKlIayuqwlm3CEkaaIwAAAUE"]
[Mon Dec 08 22:09:47.755840 2025] [:error] [pid 48481:tid 48500] [client 13.70.2.1:24675] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "aTbcKye0pzx5KCi3S0Ir5wAAAM8"]
[Mon Dec 08 22:09:48.746545 2025] [:error] [pid 50569:tid 50579] [client 13.70.2.1:4095] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "aTbcLPHhZxyKreYmWzLIZAAAAAc"]
[Mon Dec 08 22:09:50.421880 2025] [:error] [pid 50569:tid 50585] [client 13.70.2.1:4048] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "aTbcLvHhZxyKreYmWzLIagAAAA0"]
[Mon Dec 08 22:09:51.561303 2025] [:error] [pid 48541:tid 48558] [client 13.70.2.1:4047] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file1.php"] [unique_id "aTbcLwSNhJPArxLCdWEPLgAAAQ8"]
[Mon Dec 08 22:09:52.356340 2025] [:error] [pid 48541:tid 48547] [client 13.70.2.1:24586] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file1.php"] [unique_id "aTbcMASNhJPArxLCdWEPOAAAAQQ"]
[Mon Dec 08 22:09:53.011752 2025] [:error] [pid 48573:tid 48581] [client 13.70.2.1:3971] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file1.php"] [unique_id "aTbcMVIayuqwlm3CEkaaNwAAAUY"]
[Mon Dec 08 22:09:53.584476 2025] [:error] [pid 48482:tid 48521] [client 13.70.2.1:3975] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file1.php"] [unique_id "aTbcMX23gV7gRu3vn82TagAAAIk"]
[Mon Dec 08 22:09:54.843649 2025] [:error] [pid 48482:tid 48514] [client 13.70.2.1:4052] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geck.php"] [unique_id "aTbcMn23gV7gRu3vn82TbgAAAII"]
[Mon Dec 08 22:09:55.662994 2025] [:error] [pid 48541:tid 48552] [client 13.70.2.1:4049] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geck.php"] [unique_id "aTbcMwSNhJPArxLCdWEPQAAAAQk"]
[Mon Dec 08 22:09:56.745480 2025] [:error] [pid 48573:tid 48598] [client 13.70.2.1:4026] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geck.php"] [unique_id "aTbcNFIayuqwlm3CEkaaQQAAAVc"]
[Mon Dec 08 22:09:57.260238 2025] [:error] [pid 50569:tid 50585] [client 13.70.2.1:4077] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geck.php"] [unique_id "aTbcNfHhZxyKreYmWzLIdwAAAA0"]
[Mon Dec 08 22:09:57.842054 2025] [:error] [pid 50569:tid 50589] [client 13.70.2.1:4079] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "aTbcNfHhZxyKreYmWzLIeAAAABE"]
[Mon Dec 08 22:09:58.647090 2025] [:error] [pid 48573:tid 48591] [client 13.70.2.1:4064] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "aTbcNlIayuqwlm3CEkaaQgAAAVA"]
[Mon Dec 08 22:09:59.840928 2025] [:error] [pid 50569:tid 50594] [client 13.70.2.1:24626] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "aTbcN_HhZxyKreYmWzLIggAAABY"]
[Mon Dec 08 22:10:00.684632 2025] [:error] [pid 48541:tid 48546] [client 13.70.2.1:24596] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "aTbcOASNhJPArxLCdWEPUAAAAQM"]
[Mon Dec 08 22:10:02.027743 2025] [:error] [pid 48541:tid 48564] [client 13.70.2.1:24674] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file88.php"] [unique_id "aTbcOgSNhJPArxLCdWEPUwAAARU"]
[Mon Dec 08 22:10:03.067180 2025] [:error] [pid 48481:tid 48497] [client 13.70.2.1:4061] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file88.php"] [unique_id "aTbcOye0pzx5KCi3S0IsCAAAAMw"]
[Mon Dec 08 22:10:04.308234 2025] [:error] [pid 48573:tid 48599] [client 13.70.2.1:3983] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file88.php"] [unique_id "aTbcPFIayuqwlm3CEkaaSQAAAVg"]
[Mon Dec 08 22:10:12.515048 2025] [:error] [pid 50569:tid 50579] [client 13.70.2.1:4055] [client 13.70.2.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 13.70.2.1, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTbcRPHhZxyKreYmWzLIywAAAAc"]
[Mon Dec 08 22:10:13.854392 2025] [:error] [pid 50569:tid 50591] [client 13.70.2.1:3905] [client 13.70.2.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/mah.php"] [unique_id "aTbcRfHhZxyKreYmWzLI0QAAABM"]
[Mon Dec 08 22:10:14.804961 2025] [:error] [pid 48541:tid 48554] [client 13.70.2.1:24648] [client 13.70.2.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/install.php"] [unique_id "aTbcRgSNhJPArxLCdWEPmAAAAQs"]
[Mon Dec 08 22:10:15.525508 2025] [:error] [pid 48541:tid 48553] [client 13.70.2.1:4003] [client 13.70.2.1] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/packed.php"] [unique_id "aTbcRwSNhJPArxLCdWEPnAAAAQo"]
[Mon Dec 08 22:10:21.528108 2025] [:error] [pid 48573:tid 48580] [client 13.70.2.1:4037] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsox.php"] [unique_id "aTbcTVIayuqwlm3CEkaahgAAAUU"]
[Mon Dec 08 22:10:22.338252 2025] [:error] [pid 48541:tid 48548] [client 13.70.2.1:24634] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsox.php"] [unique_id "aTbcTgSNhJPArxLCdWEPuQAAAQU"]
[Mon Dec 08 22:10:23.151474 2025] [:error] [pid 48481:tid 48494] [client 13.70.2.1:24645] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsox.php"] [unique_id "aTbcTye0pzx5KCi3S0IsQQAAAMk"]
[Mon Dec 08 22:10:23.731720 2025] [:error] [pid 48541:tid 48559] [client 13.70.2.1:4027] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsox.php"] [unique_id "aTbcTwSNhJPArxLCdWEPvAAAARA"]
[Mon Dec 08 22:10:24.379980 2025] [:error] [pid 48541:tid 48551] [client 13.70.2.1:4085] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classgoto24.php"] [unique_id "aTbcUASNhJPArxLCdWEPvgAAAQg"]
[Mon Dec 08 22:10:25.457133 2025] [:error] [pid 48541:tid 48547] [client 13.70.2.1:24615] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classgoto24.php"] [unique_id "aTbcUQSNhJPArxLCdWEPxgAAAQQ"]
[Mon Dec 08 22:10:26.359469 2025] [:error] [pid 48541:tid 48552] [client 13.70.2.1:4087] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classgoto24.php"] [unique_id "aTbcUgSNhJPArxLCdWEPyQAAAQk"]
[Mon Dec 08 22:10:26.893869 2025] [:error] [pid 48541:tid 48556] [client 13.70.2.1:24682] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classgoto24.php"] [unique_id "aTbcUgSNhJPArxLCdWEPywAAAQ0"]
[Mon Dec 08 22:10:27.812186 2025] [:error] [pid 48482:tid 48533] [client 13.70.2.1:24622] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inde.php"] [unique_id "aTbcU323gV7gRu3vn82UEwAAAJU"]
[Mon Dec 08 22:10:28.481322 2025] [:error] [pid 48481:tid 48509] [client 13.70.2.1:4053] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inde.php"] [unique_id "aTbcVCe0pzx5KCi3S0IsTQAAANg"]
[Mon Dec 08 22:10:29.196103 2025] [:error] [pid 48482:tid 48513] [client 13.70.2.1:24595] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inde.php"] [unique_id "aTbcVX23gV7gRu3vn82UHwAAAIE"]
[Mon Dec 08 22:10:30.038662 2025] [:error] [pid 48482:tid 48529] [client 13.70.2.1:24599] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inde.php"] [unique_id "aTbcVn23gV7gRu3vn82UIgAAAJE"]
[Mon Dec 08 22:10:30.378959 2025] [:error] [pid 48541:tid 48546] [client 13.70.2.1:3997] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akk.php"] [unique_id "aTbcVgSNhJPArxLCdWEP2wAAAQM"]
[Mon Dec 08 22:10:30.908606 2025] [:error] [pid 48541:tid 48544] [client 13.70.2.1:24677] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akk.php"] [unique_id "aTbcVgSNhJPArxLCdWEP4QAAAQE"]
[Mon Dec 08 22:10:31.706102 2025] [:error] [pid 48541:tid 48551] [client 13.70.2.1:3969] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akk.php"] [unique_id "aTbcVwSNhJPArxLCdWEP5AAAAQg"]
[Mon Dec 08 22:10:32.213362 2025] [:error] [pid 48541:tid 48567] [client 13.70.2.1:24652] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akk.php"] [unique_id "aTbcWASNhJPArxLCdWEP6AAAARg"]
[Mon Dec 08 22:10:33.377439 2025] [:error] [pid 48573:tid 48592] [client 13.70.2.1:24639] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpa.php"] [unique_id "aTbcWVIayuqwlm3CEkaatAAAAVE"]
[Mon Dec 08 22:10:33.879059 2025] [:error] [pid 48541:tid 48546] [client 13.70.2.1:4060] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpa.php"] [unique_id "aTbcWQSNhJPArxLCdWEP7wAAAQM"]
[Mon Dec 08 22:10:34.972258 2025] [:error] [pid 48481:tid 48504] [client 13.70.2.1:3919] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpa.php"] [unique_id "aTbcWie0pzx5KCi3S0IsVwAAANM"]
[Mon Dec 08 22:10:36.214728 2025] [:error] [pid 48573:tid 48584] [client 13.70.2.1:3927] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpa.php"] [unique_id "aTbcXFIayuqwlm3CEkaavwAAAUk"]
[Mon Dec 08 22:10:36.757239 2025] [:error] [pid 48573:tid 48588] [client 13.70.2.1:4073] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/finny.php"] [unique_id "aTbcXFIayuqwlm3CEkaaxwAAAU0"]
[Mon Dec 08 22:10:37.398376 2025] [:error] [pid 48482:tid 48512] [client 13.70.2.1:3922] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/finny.php"] [unique_id "aTbcXX23gV7gRu3vn82UJgAAAIA"]
[Mon Dec 08 22:10:38.442529 2025] [:error] [pid 48481:tid 48498] [client 13.70.2.1:3948] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/finny.php"] [unique_id "aTbcXie0pzx5KCi3S0IsWwAAAM0"]
[Mon Dec 08 22:10:40.163773 2025] [:error] [pid 48541:tid 48558] [client 13.70.2.1:4075] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/finny.php"] [unique_id "aTbcYASNhJPArxLCdWEQBwAAAQ8"]
[Mon Dec 08 22:10:41.846743 2025] [:error] [pid 48482:tid 48529] [client 13.70.2.1:4083] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file15.php"] [unique_id "aTbcYX23gV7gRu3vn82ULQAAAJE"]
[Mon Dec 08 22:10:42.386739 2025] [:error] [pid 48573:tid 48597] [client 13.70.2.1:4068] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file15.php"] [unique_id "aTbcYlIayuqwlm3CEkaa1QAAAVY"]
[Mon Dec 08 22:10:44.066727 2025] [:error] [pid 48573:tid 48593] [client 13.70.2.1:24610] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file15.php"] [unique_id "aTbcZFIayuqwlm3CEkaa2QAAAVI"]
[Mon Dec 08 22:10:45.376999 2025] [:error] [pid 48573:tid 48591] [client 13.70.2.1:24655] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file15.php"] [unique_id "aTbcZVIayuqwlm3CEkaa3wAAAVA"]
[Mon Dec 08 22:10:46.702806 2025] [:error] [pid 48482:tid 48517] [client 13.70.2.1:3993] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x0x.php"] [unique_id "aTbcZn23gV7gRu3vn82UQAAAAIU"]
[Mon Dec 08 22:10:48.114905 2025] [:error] [pid 48541:tid 48560] [client 13.70.2.1:3989] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x0x.php"] [unique_id "aTbcaASNhJPArxLCdWEQIAAAARE"]
[Mon Dec 08 22:10:49.038459 2025] [:error] [pid 48573:tid 48597] [client 13.70.2.1:4005] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x0x.php"] [unique_id "aTbcaVIayuqwlm3CEkaa8wAAAVY"]
[Mon Dec 08 22:10:49.664246 2025] [:error] [pid 50569:tid 50596] [client 13.70.2.1:4090] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x0x.php"] [unique_id "aTbcafHhZxyKreYmWzLJKAAAABg"]
[Mon Dec 08 22:10:50.366636 2025] [:error] [pid 48573:tid 48587] [client 13.70.2.1:3982] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2clas.php"] [unique_id "aTbcalIayuqwlm3CEkaa9AAAAUw"]
[Mon Dec 08 22:10:51.439887 2025] [:error] [pid 48481:tid 48488] [client 13.70.2.1:24670] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2clas.php"] [unique_id "aTbcaye0pzx5KCi3S0IscQAAAMM"]
[Mon Dec 08 22:10:52.059497 2025] [:error] [pid 50569:tid 50591] [client 13.70.2.1:3917] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2clas.php"] [unique_id "aTbcbPHhZxyKreYmWzLJLQAAABM"]
[Mon Dec 08 22:10:52.509684 2025] [:error] [pid 48573:tid 48589] [client 13.70.2.1:4007] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2clas.php"] [unique_id "aTbcbFIayuqwlm3CEkaa9gAAAU4"]
[Mon Dec 08 22:10:53.062100 2025] [:error] [pid 48481:tid 48493] [client 13.70.2.1:4024] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aTbcbSe0pzx5KCi3S0IsdgAAAMg"]
[Mon Dec 08 22:10:53.519957 2025] [:error] [pid 48481:tid 48485] [client 13.70.2.1:24609] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aTbcbSe0pzx5KCi3S0IseAAAAMA"]
[Mon Dec 08 22:10:54.217234 2025] [:error] [pid 50569:tid 50592] [client 13.70.2.1:3920] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aTbcbvHhZxyKreYmWzLJNQAAABQ"]
[Mon Dec 08 22:10:54.780208 2025] [:error] [pid 48573:tid 48580] [client 13.70.2.1:4057] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aTbcblIayuqwlm3CEkaa_gAAAUU"]
[Mon Dec 08 22:10:55.177154 2025] [:error] [pid 50569:tid 50577] [client 13.70.2.1:24620] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "aTbcb_HhZxyKreYmWzLJOgAAAAU"]
[Mon Dec 08 22:10:55.595495 2025] [:error] [pid 50569:tid 50588] [client 13.70.2.1:4039] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "aTbcb_HhZxyKreYmWzLJOwAAABA"]
[Mon Dec 08 22:10:55.954864 2025] [:error] [pid 48482:tid 48535] [client 13.70.2.1:4030] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "aTbcb323gV7gRu3vn82UUAAAAJc"]
[Mon Dec 08 22:10:56.428910 2025] [:error] [pid 48481:tid 48503] [client 13.70.2.1:4002] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "aTbccCe0pzx5KCi3S0IsewAAANI"]
[Mon Dec 08 22:10:57.296439 2025] [:error] [pid 48481:tid 48500] [client 13.70.2.1:4036] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ilex.php"] [unique_id "aTbccSe0pzx5KCi3S0IsfAAAAM8"]
[Mon Dec 08 22:10:58.035278 2025] [:error] [pid 48541:tid 48550] [client 13.70.2.1:3980] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ilex.php"] [unique_id "aTbccgSNhJPArxLCdWEQNQAAAQc"]
[Mon Dec 08 22:10:58.515595 2025] [:error] [pid 48541:tid 48554] [client 13.70.2.1:3946] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ilex.php"] [unique_id "aTbccgSNhJPArxLCdWEQOQAAAQs"]
[Mon Dec 08 22:10:58.845667 2025] [:error] [pid 48573:tid 48591] [client 13.70.2.1:3985] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ilex.php"] [unique_id "aTbcclIayuqwlm3CEkabGgAAAVA"]
[Mon Dec 08 22:10:59.301884 2025] [:error] [pid 48573:tid 48577] [client 13.70.2.1:24632] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tor.php"] [unique_id "aTbcc1Iayuqwlm3CEkabHQAAAUI"]
[Mon Dec 08 22:11:00.311429 2025] [:error] [pid 48573:tid 48575] [client 13.70.2.1:24689] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tor.php"] [unique_id "aTbcdFIayuqwlm3CEkabJgAAAUA"]
[Mon Dec 08 22:11:01.062880 2025] [:error] [pid 48482:tid 48530] [client 13.70.2.1:4004] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tor.php"] [unique_id "aTbcdX23gV7gRu3vn82UXAAAAJI"]
[Mon Dec 08 22:11:01.629284 2025] [:error] [pid 48482:tid 48512] [client 13.70.2.1:4041] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tor.php"] [unique_id "aTbcdX23gV7gRu3vn82UXwAAAIA"]
[Mon Dec 08 22:11:02.741341 2025] [:error] [pid 48481:tid 48507] [client 13.70.2.1:3938] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/klex.php"] [unique_id "aTbcdie0pzx5KCi3S0IsgAAAANY"]
[Mon Dec 08 22:11:03.471557 2025] [:error] [pid 48481:tid 48489] [client 13.70.2.1:4011] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/klex.php"] [unique_id "aTbcdye0pzx5KCi3S0IshAAAAMQ"]
[Mon Dec 08 22:11:04.281765 2025] [:error] [pid 48573:tid 48578] [client 13.70.2.1:4081] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/klex.php"] [unique_id "aTbceFIayuqwlm3CEkabMgAAAUM"]
[Mon Dec 08 22:11:04.967882 2025] [:error] [pid 48482:tid 48533] [client 13.70.2.1:24637] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/klex.php"] [unique_id "aTbceH23gV7gRu3vn82UZgAAAJU"]
[Mon Dec 08 22:11:05.698236 2025] [:error] [pid 50569:tid 50581] [client 13.70.2.1:3914] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bge.php"] [unique_id "aTbcefHhZxyKreYmWzLJTQAAAAk"]
[Mon Dec 08 22:11:06.229889 2025] [:error] [pid 48481:tid 48490] [client 13.70.2.1:3906] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bge.php"] [unique_id "aTbceie0pzx5KCi3S0IsjwAAAMU"]
[Mon Dec 08 22:11:06.729060 2025] [:error] [pid 50569:tid 50592] [client 13.70.2.1:4080] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bge.php"] [unique_id "aTbcevHhZxyKreYmWzLJTwAAABQ"]
[Mon Dec 08 22:11:07.114477 2025] [:error] [pid 48541:tid 48551] [client 13.70.2.1:24696] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bge.php"] [unique_id "aTbcewSNhJPArxLCdWEQQwAAAQg"]
[Mon Dec 08 22:11:07.555064 2025] [:error] [pid 48541:tid 48555] [client 13.70.2.1:4028] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ifm.php"] [unique_id "aTbcewSNhJPArxLCdWEQRAAAAQw"]
[Mon Dec 08 22:11:07.938658 2025] [:error] [pid 48541:tid 48554] [client 13.70.2.1:3915] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ifm.php"] [unique_id "aTbcewSNhJPArxLCdWEQRgAAAQs"]
[Mon Dec 08 22:11:08.514519 2025] [:error] [pid 50569:tid 50577] [client 13.70.2.1:3984] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ifm.php"] [unique_id "aTbcfPHhZxyKreYmWzLJUgAAAAU"]
[Mon Dec 08 22:11:08.773117 2025] [:error] [pid 48573:tid 48575] [client 13.70.2.1:3992] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ifm.php"] [unique_id "aTbcfFIayuqwlm3CEkabNAAAAUA"]
[Mon Dec 08 22:11:09.248386 2025] [:error] [pid 48541:tid 48566] [client 13.70.2.1:3908] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aTbcfQSNhJPArxLCdWEQSgAAARc"]
[Mon Dec 08 22:11:09.743649 2025] [:error] [pid 48482:tid 48531] [client 13.70.2.1:24584] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aTbcfX23gV7gRu3vn82UaAAAAJM"]
[Mon Dec 08 22:11:10.040456 2025] [:error] [pid 48482:tid 48526] [client 13.70.2.1:3960] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aTbcfn23gV7gRu3vn82UaQAAAI4"]
[Mon Dec 08 22:11:10.354977 2025] [:error] [pid 48482:tid 48517] [client 13.70.2.1:4016] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aTbcfn23gV7gRu3vn82UawAAAIU"]
[Mon Dec 08 22:11:10.828594 2025] [:error] [pid 48481:tid 48497] [client 13.70.2.1:4013] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eagle.php"] [unique_id "aTbcfie0pzx5KCi3S0IslwAAAMw"]
[Mon Dec 08 22:11:11.325173 2025] [:error] [pid 48573:tid 48585] [client 13.70.2.1:3972] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eagle.php"] [unique_id "aTbcf1Iayuqwlm3CEkabNwAAAUo"]
[Mon Dec 08 22:11:12.028370 2025] [:error] [pid 48573:tid 48576] [client 13.70.2.1:3986] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eagle.php"] [unique_id "aTbcgFIayuqwlm3CEkabOAAAAUE"]
[Mon Dec 08 22:11:12.467975 2025] [:error] [pid 48482:tid 48514] [client 13.70.2.1:24590] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eagle.php"] [unique_id "aTbcgH23gV7gRu3vn82UbQAAAII"]
[Mon Dec 08 22:11:13.028505 2025] [:error] [pid 48573:tid 48579] [client 13.70.2.1:4000] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/upload/css.php"] [unique_id "aTbcgVIayuqwlm3CEkabOgAAAUQ"]
[Mon Dec 08 22:11:13.361891 2025] [:error] [pid 48573:tid 48578] [client 13.70.2.1:24662] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/upload/css.php"] [unique_id "aTbcgVIayuqwlm3CEkabPgAAAUM"]
[Mon Dec 08 22:11:13.697564 2025] [:error] [pid 50569:tid 50595] [client 13.70.2.1:3861] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/upload/css.php"] [unique_id "aTbcgfHhZxyKreYmWzLJWAAAABc"]
[Mon Dec 08 22:11:13.984765 2025] [:error] [pid 50569:tid 50576] [client 13.70.2.1:3923] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/upload/css.php"] [unique_id "aTbcgfHhZxyKreYmWzLJWQAAAAQ"]
[Mon Dec 08 22:11:14.287528 2025] [:error] [pid 48482:tid 48512] [client 13.70.2.1:24690] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index.html"] [unique_id "aTbcgn23gV7gRu3vn82UcAAAAIA"]
[Mon Dec 08 22:11:14.759790 2025] [:error] [pid 48482:tid 48535] [client 13.70.2.1:3848] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index.html"] [unique_id "aTbcgn23gV7gRu3vn82UcQAAAJc"]
[Mon Dec 08 22:11:15.056660 2025] [:error] [pid 48541:tid 48544] [client 13.70.2.1:3939] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index.html"] [unique_id "aTbcgwSNhJPArxLCdWEQUQAAAQE"]
[Mon Dec 08 22:11:15.557749 2025] [:error] [pid 50569:tid 50574] [client 13.70.2.1:3990] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index.html"] [unique_id "aTbcg_HhZxyKreYmWzLJXwAAAAI"]
[Mon Dec 08 22:11:16.145740 2025] [:error] [pid 48482:tid 48520] [client 13.70.2.1:24598] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aTbchH23gV7gRu3vn82UcgAAAIg"]
[Mon Dec 08 22:11:16.481910 2025] [:error] [pid 48541:tid 48554] [client 13.70.2.1:4001] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aTbchASNhJPArxLCdWEQUgAAAQs"]
[Mon Dec 08 22:11:16.994652 2025] [:error] [pid 48573:tid 48592] [client 13.70.2.1:24679] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aTbchFIayuqwlm3CEkabRQAAAVE"]
[Mon Dec 08 22:11:17.730760 2025] [:error] [pid 48541:tid 48543] [client 13.70.2.1:4076] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aTbchQSNhJPArxLCdWEQVAAAAQA"]
[Mon Dec 08 22:11:18.585006 2025] [:error] [pid 48481:tid 48491] [client 13.70.2.1:3924] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.api.php"] [unique_id "aTbchie0pzx5KCi3S0IsmwAAAMY"]
[Mon Dec 08 22:11:19.423059 2025] [:error] [pid 50569:tid 50581] [client 13.70.2.1:3976] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.api.php"] [unique_id "aTbch_HhZxyKreYmWzLJZgAAAAk"]
[Mon Dec 08 22:11:19.858418 2025] [:error] [pid 48482:tid 48529] [client 13.70.2.1:4015] [client 13.70.2.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.api.php"] [unique_id "aTbch323gV7gRu3vn82UegAAAJE"]
[Mon Dec 08 22:13:04.106013 2025] [:error] [pid 48541:tid 48547] [client 34.208.19.227:40840] [client 34.208.19.227] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aTbc8ASNhJPArxLCdWERXwAAAQQ"]
[Mon Dec 08 23:07:23.677627 2025] [autoindex:error] [pid 50569:tid 50584] [client 139.59.62.176:56769] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Dec 09 00:13:19.063789 2025] [:error] [pid 17587:tid 17607] [client 104.164.168.4:40937] [client 104.164.168.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.164.168.4, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTb5H5JbuGn8bV7YLq9E6gAAAM8"]
[Tue Dec 09 00:23:35.764704 2025] [:error] [pid 57134:tid 57182] [client 104.164.168.9:27851] [client 104.164.168.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.164.168.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTb7h1n7_Hlbg-DXKIvr-AAAAEg"]
[Tue Dec 09 00:23:35.766409 2025] [:error] [pid 57134:tid 57182] [client 104.164.168.9:27851] [client 104.164.168.9] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||expressinteriors.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /wp-login.php"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTb7h1n7_Hlbg-DXKIvr-AAAAEg"]
[Tue Dec 09 00:35:00.001452 2025] [:error] [pid 17588:tid 17640] [client 104.164.168.10:55189] [client 104.164.168.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.164.168.10, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTb-NDfolJgrovDIxbRUBQAAAJQ"]
[Tue Dec 09 01:20:40.873843 2025] [:error] [pid 17587:tid 17594] [client 101.201.227.219:39564] [client 101.201.227.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/plugins/Ueditor/dialogs/attachment/fileTypeImages/icon_psd.gif"] [unique_id "aTcI6JJbuGn8bV7YLq9cAQAAAMI"], referer: http://expressinteriors.com/public/plugins/Ueditor/dialogs/attachment/fileTypeImages/icon_psd.gif
[Tue Dec 09 03:44:33.700570 2025] [:error] [pid 13985:tid 14038] [client 4.194.144.102:6099] [client 4.194.144.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.194.144.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTcqoaZCyhTsnJcC7XiE2QAAAFc"], referer: https://www.bing.com/
[Tue Dec 09 03:44:40.712320 2025] [autoindex:error] [pid 13985:tid 14019] [client 4.194.144.102:6120] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentythree/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Tue Dec 09 03:44:42.204374 2025] [:error] [pid 13985:tid 14015] [client 4.194.144.102:6120] [client 4.194.144.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aTcqqqZCyhTsnJcC7XiE6wAAAEA"], referer: https://www.google.co.uk/
[Tue Dec 09 03:44:42.385301 2025] [:error] [pid 13985:tid 14016] [client 4.194.144.102:6141] [client 4.194.144.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aTcqqqZCyhTsnJcC7XiE7AAAAEE"], referer: https://www.google.fr/
[Tue Dec 09 06:41:48.336223 2025] [:error] [pid 62041:tid 62103] [client 77.239.108.81:60060] [client 77.239.108.81] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aTdULPOmnJGvfaNPxPNfIAAAAIY"]
[Tue Dec 09 09:08:46.792271 2025] [:error] [pid 34783:tid 34803] [client 117.62.235.53:57416] [client 117.62.235.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aTd2nq17odLapL7SFcxgqAAAAVI"]
[Tue Dec 09 09:52:25.904124 2025] [:error] [pid 62039:tid 62062] [client 37.140.223.43:60317] [client 37.140.223.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTeA2a-WdjFepfLrlW7UOAAAABM"]
[Tue Dec 09 09:55:24.116800 2025] [:error] [pid 6097:tid 6120] [client 45.86.202.115:47685] [client 45.86.202.115] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aTeBjOY9nDD1R9gHO2ThjwAAAdU"]
[Tue Dec 09 09:55:34.783672 2025] [:error] [pid 62039:tid 62053] [client 45.86.202.114:25601] [client 45.86.202.114] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.local"] [unique_id "aTeBlq-WdjFepfLrlW7VfAAAAAo"]
[Tue Dec 09 09:55:35.462602 2025] [:error] [pid 62041:tid 62102] [client 45.86.202.146:61203] [client 45.86.202.146] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.backup"] [unique_id "aTeBl_OmnJGvfaNPxPOI6gAAAIU"]
[Tue Dec 09 09:55:36.129423 2025] [:error] [pid 6097:tid 6111] [client 45.86.202.130:61249] [client 45.86.202.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/config/.env"] [unique_id "aTeBmOY9nDD1R9gHO2ThlAAAAcw"]
[Tue Dec 09 10:05:46.615960 2025] [:error] [pid 62124:tid 62140] [client 37.140.223.43:23461] [client 37.140.223.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTeD-lraBX51GaCVVuV8qQAAAM0"]
[Tue Dec 09 10:18:18.515926 2025] [:error] [pid 62040:tid 62086] [client 193.36.225.180:58841] [client 193.36.225.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.180, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTeG6vkSVjwLGqZL-9Ka1AAAAFA"]
[Tue Dec 09 10:31:01.212286 2025] [:error] [pid 26689:tid 26744] [client 37.140.223.43:44193] [client 37.140.223.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTeJ5dkbfj8nyBvIyRCBjwAAAQk"]
[Tue Dec 09 10:43:56.810111 2025] [:error] [pid 6053:tid 6056] [client 37.140.223.41:37127] [client 37.140.223.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.41, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTeM7CHz_Tnml8kdMwz1HQAAAYE"]
[Tue Dec 09 10:57:46.535636 2025] [:error] [pid 62040:tid 62080] [client 37.140.223.42:25667] [client 37.140.223.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.42, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTeQKvkSVjwLGqZL-9KiFAAAAEo"]
[Tue Dec 09 11:01:52.771382 2025] [:error] [pid 62039:tid 62055] [client 66.45.23.30:45728] [client 66.45.23.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.45.23.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTeRIK-WdjFepfLrlW7tUQAAAAw"]
[Tue Dec 09 11:01:56.515245 2025] [:error] [pid 62039:tid 62060] [client 66.45.23.30:45728] [client 66.45.23.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.45.23.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTeRJK-WdjFepfLrlW7tigAAABE"], referer: https://expressinteriors.com/wp-login.php
[Tue Dec 09 11:11:34.607849 2025] [:error] [pid 62041:tid 62119] [client 193.36.225.176:62915] [client 193.36.225.176] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.176, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTeTZvOmnJGvfaNPxPOYRAAAAJY"]
[Tue Dec 09 11:21:34.222889 2025] [:error] [pid 62040:tid 62076] [client 45.138.16.233:49273] [client 45.138.16.233] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/postnews.php"] [unique_id "aTeVvvkSVjwLGqZL-9KmugAAAEY"]
[Tue Dec 09 11:21:34.817387 2025] [:error] [pid 26689:tid 26750] [client 45.138.16.233:49353] [client 45.138.16.233] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/postnews.php"] [unique_id "aTeVvtkbfj8nyBvIyRCMyQAAAQ4"]
[Tue Dec 09 11:21:35.416146 2025] [:error] [pid 6053:tid 6060] [client 45.138.16.233:49452] [client 45.138.16.233] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/postnews.php"] [unique_id "aTeVvyHz_Tnml8kdMwz-RwAAAYU"]
[Tue Dec 09 11:25:31.574830 2025] [:error] [pid 62040:tid 62088] [client 37.140.223.57:45523] [client 37.140.223.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTeWq_kSVjwLGqZL-9KnzwAAAFI"]
[Tue Dec 09 11:39:32.613761 2025] [:error] [pid 6097:tid 6104] [client 193.36.225.176:51885] [client 193.36.225.176] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.176, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTeZ9OY9nDD1R9gHO2T_hwAAAcU"]
[Tue Dec 09 11:53:36.969038 2025] [:error] [pid 62124:tid 62135] [client 136.144.33.18:59245] [client 136.144.33.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.18, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTedQFraBX51GaCVVuWTLgAAAMg"]
[Tue Dec 09 12:07:47.170179 2025] [:error] [pid 7382:tid 7418] [client 193.36.225.176:40699] [client 193.36.225.176] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.176, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTegkydEXhamGkzwq-j4qQAAAdg"]
[Tue Dec 09 12:22:09.154137 2025] [:error] [pid 12069:tid 12077] [client 193.36.225.175:40439] [client 193.36.225.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.175, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTej8WwNDNgPF6LHYDSXbgAAAEY"]
[Tue Dec 09 12:36:19.022445 2025] [:error] [pid 12069:tid 12076] [client 193.36.225.159:50361] [client 193.36.225.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.159, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTenQ2wNDNgPF6LHYDSekAAAAEU"]
[Tue Dec 09 12:50:39.098602 2025] [:error] [pid 7287:tid 7309] [client 37.140.223.57:35457] [client 37.140.223.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTeqn_3UQf3HGDaVS5PbNQAAABQ"]
[Tue Dec 09 13:04:57.893529 2025] [:error] [pid 12069:tid 12092] [client 172.245.102.16:48529] [client 172.245.102.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTet-WwNDNgPF6LHYDSurgAAAFU"]
[Tue Dec 09 13:19:32.137853 2025] [:error] [pid 12069:tid 12089] [client 37.140.223.42:25051] [client 37.140.223.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.42, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTexZGwNDNgPF6LHYDS25wAAAFI"]
[Tue Dec 09 13:33:57.188877 2025] [:error] [pid 7287:tid 7302] [client 193.36.225.160:34921] [client 193.36.225.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTe0xf3UQf3HGDaVS5PoYAAAAA0"]
[Tue Dec 09 14:03:18.126680 2025] [:error] [pid 7287:tid 7296] [client 193.36.225.175:41763] [client 193.36.225.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.175, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTe7pv3UQf3HGDaVS5Pw1AAAAAc"]
[Tue Dec 09 14:18:09.582270 2025] [:error] [pid 59388:tid 59394] [client 136.144.33.18:57251] [client 136.144.33.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.18, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTe_Id7acjYK4IXwCBWSHwAAAIQ"]
[Tue Dec 09 14:33:12.035794 2025] [:error] [pid 7324:tid 7330] [client 37.140.223.45:26279] [client 37.140.223.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.45, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTfCqOf70zXc9zH4rTLNlAAAAUE"]
[Tue Dec 09 14:48:02.538969 2025] [:error] [pid 7324:tid 7352] [client 37.140.223.52:29061] [client 37.140.223.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.52, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTfGIuf70zXc9zH4rTLQigAAAVc"]
[Tue Dec 09 14:50:45.727795 2025] [:error] [pid 7324:tid 7347] [client 103.77.106.81:64345] [client 103.77.106.81] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aTfGxef70zXc9zH4rTLRuAAAAVI"]
[Tue Dec 09 14:52:34.319923 2025] [:error] [pid 7324:tid 7346] [client 45.138.16.233:54692] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aTfHMuf70zXc9zH4rTLSyAAAAVE"]
[Tue Dec 09 14:52:34.320002 2025] [:error] [pid 7325:tid 7375] [client 45.138.16.233:54695] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-plain.php"] [unique_id "aTfHMgqEQlZnpyQAsW1Y9wAAAZM"], referer: www.google.com
[Tue Dec 09 14:52:34.324169 2025] [:error] [pid 7324:tid 7349] [client 45.138.16.233:54693] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aTfHMuf70zXc9zH4rTLSyQAAAVQ"], referer: www.google.com
[Tue Dec 09 14:52:34.330771 2025] [:error] [pid 7325:tid 7366] [client 45.138.16.233:54700] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aTfHMgqEQlZnpyQAsW1Y-AAAAYo"], referer: www.google.com
[Tue Dec 09 14:52:34.922830 2025] [:error] [pid 7287:tid 7298] [client 45.138.16.233:53992] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-plain.php"] [unique_id "aTfHMv3UQf3HGDaVS5P8VwAAAAk"], referer: www.google.com
[Tue Dec 09 14:52:34.925140 2025] [:error] [pid 7324:tid 7330] [client 45.138.16.233:53995] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aTfHMuf70zXc9zH4rTLSywAAAUE"], referer: www.google.com
[Tue Dec 09 14:52:34.932092 2025] [:error] [pid 7287:tid 7312] [client 45.138.16.233:53998] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aTfHMv3UQf3HGDaVS5P8WAAAABc"], referer: www.google.com
[Tue Dec 09 14:52:34.932442 2025] [:error] [pid 7287:tid 7294] [client 45.138.16.233:53997] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aTfHMv3UQf3HGDaVS5P8WQAAAAU"]
[Tue Dec 09 14:52:35.516096 2025] [:error] [pid 7382:tid 7413] [client 45.138.16.233:56114] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-plain.php"] [unique_id "aTfHMydEXhamGkzwq-gwngAAAdM"], referer: www.google.com
[Tue Dec 09 14:52:35.524487 2025] [:error] [pid 7382:tid 7405] [client 45.138.16.233:56115] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aTfHMydEXhamGkzwq-gwnwAAAcs"], referer: www.google.com
[Tue Dec 09 14:52:35.533273 2025] [:error] [pid 59388:tid 59406] [client 45.138.16.233:61781] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aTfHM97acjYK4IXwCBWgowAAAJA"]
[Tue Dec 09 14:52:35.533594 2025] [:error] [pid 59388:tid 59403] [client 45.138.16.233:61782] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aTfHM97acjYK4IXwCBWgpAAAAI0"], referer: www.google.com
[Tue Dec 09 14:52:36.110806 2025] [:error] [pid 59388:tid 59402] [client 45.138.16.233:64903] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-plain.php"] [unique_id "aTfHNN7acjYK4IXwCBWgpQAAAIw"], referer: www.google.com
[Tue Dec 09 14:52:36.127317 2025] [:error] [pid 7325:tid 7377] [client 45.138.16.233:55175] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aTfHNAqEQlZnpyQAsW1Y_gAAAZU"], referer: www.google.com
[Tue Dec 09 14:52:36.132483 2025] [:error] [pid 7382:tid 7406] [client 45.138.16.233:55475] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aTfHNCdEXhamGkzwq-gwpAAAAcw"], referer: www.google.com
[Tue Dec 09 14:52:36.132964 2025] [:error] [pid 7382:tid 7411] [client 45.138.16.233:55458] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aTfHNCdEXhamGkzwq-gwpQAAAdE"]
[Tue Dec 09 14:52:36.411170 2025] [:error] [pid 7324:tid 7344] [client 45.138.16.233:54697] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-plain.php"] [unique_id "aTfHNOf70zXc9zH4rTLSzQAAAU8"], referer: www.google.com
[Tue Dec 09 14:52:36.730702 2025] [:error] [pid 7325:tid 7373] [client 45.138.16.233:54641] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aTfHNAqEQlZnpyQAsW1ZBAAAAZE"], referer: www.google.com
[Tue Dec 09 14:52:36.733236 2025] [:error] [pid 7382:tid 7404] [client 45.138.16.233:54678] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aTfHNCdEXhamGkzwq-gwqAAAAco"], referer: www.google.com
[Tue Dec 09 14:52:36.737642 2025] [:error] [pid 7324:tid 7342] [client 45.138.16.233:54698] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aTfHNOf70zXc9zH4rTLS0AAAAU0"]
[Tue Dec 09 14:52:37.926845 2025] [:error] [pid 7382:tid 7402] [client 45.138.16.233:54675] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aTfHNSdEXhamGkzwq-gwsAAAAcg"], referer: www.google.com
[Tue Dec 09 14:52:37.927897 2025] [:error] [pid 7382:tid 7412] [client 45.138.16.233:54678] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aTfHNSdEXhamGkzwq-gwsQAAAdI"], referer: www.google.com
[Tue Dec 09 14:52:39.141024 2025] [:error] [pid 12069:tid 12073] [client 45.138.16.233:54381] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aTfHN2wNDNgPF6LHYDTbPQAAAEI"], referer: www.google.com
[Tue Dec 09 14:52:39.145593 2025] [:error] [pid 59388:tid 59396] [client 45.138.16.233:54385] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aTfHN97acjYK4IXwCBWgqQAAAIY"], referer: www.google.com
[Tue Dec 09 14:52:40.366923 2025] [:error] [pid 59388:tid 59404] [client 45.138.16.233:56736] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aTfHON7acjYK4IXwCBWgrAAAAI4"], referer: www.google.com
[Tue Dec 09 14:52:40.366936 2025] [:error] [pid 59388:tid 59401] [client 45.138.16.233:56735] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aTfHON7acjYK4IXwCBWgrQAAAIs"], referer: www.google.com
[Tue Dec 09 14:52:41.604974 2025] [:error] [pid 59388:tid 59391] [client 45.138.16.233:54066] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aTfHOd7acjYK4IXwCBWgtgAAAIE"], referer: www.google.com
[Tue Dec 09 14:52:41.606245 2025] [:error] [pid 59388:tid 59395] [client 45.138.16.233:54054] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aTfHOd7acjYK4IXwCBWgtwAAAIU"], referer: www.google.com
[Tue Dec 09 14:52:42.818880 2025] [:error] [pid 7325:tid 7372] [client 45.138.16.233:53767] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aTfHOgqEQlZnpyQAsW1ZEwAAAZA"], referer: www.google.com
[Tue Dec 09 14:52:42.854976 2025] [:error] [pid 59388:tid 59393] [client 45.138.16.233:55938] [client 45.138.16.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aTfHOt7acjYK4IXwCBWgvQAAAIM"], referer: www.google.com
[Tue Dec 09 15:02:48.532388 2025] [:error] [pid 12069:tid 12087] [client 193.36.225.188:27611] [client 193.36.225.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTfJmGwNDNgPF6LHYDTg_QAAAFA"]
[Tue Dec 09 15:05:19.823563 2025] [:error] [pid 7324:tid 7337] [client 122.51.236.174:39430] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aTfKL-f70zXc9zH4rTLYXAAAAUg"]
[Tue Dec 09 15:39:02.879992 2025] [:error] [pid 7382:tid 7415] [client 45.95.146.83:55997] [client 45.95.146.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.95.146.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTfSFidEXhamGkzwq-g-hAAAAdU"], referer: https://expressinteriors.com/
[Tue Dec 09 15:39:05.849139 2025] [:error] [pid 7325:tid 7364] [client 45.95.146.83:56130] [client 45.95.146.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.95.146.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTfSGQqEQlZnpyQAsW1kvwAAAYg"], referer: https://expressinteriors.com/wp-login.php?action=register
[Tue Dec 09 16:03:38.864012 2025] [:error] [pid 30500:tid 30565] [client 193.36.225.178:54315] [client 193.36.225.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.178, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTfX2q2eIIK3JPWHCXVwHAAAAYg"]
[Tue Dec 09 16:28:50.161488 2025] [:error] [pid 30591:tid 30594] [client 37.140.223.19:51055] [client 37.140.223.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTfdwhG-g76drVdWQUUnVQAAAEA"]
[Tue Dec 09 16:43:58.498895 2025] [:error] [pid 30591:tid 30608] [client 37.140.223.53:28959] [client 37.140.223.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTfhThG-g76drVdWQUUtPQAAAE4"]
[Tue Dec 09 16:59:12.939965 2025] [:error] [pid 36456:tid 36473] [client 37.140.223.41:40859] [client 37.140.223.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.41, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTfk4B0pAnOyfXl_v43XkgAAAI8"]
[Tue Dec 09 17:14:24.731480 2025] [:error] [pid 30500:tid 30562] [client 193.36.225.178:58073] [client 193.36.225.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.178, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTfocK2eIIK3JPWHCXWIeAAAAYU"]
[Tue Dec 09 17:29:30.421810 2025] [:error] [pid 30500:tid 30561] [client 193.36.225.163:43953] [client 193.36.225.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTfr-q2eIIK3JPWHCXWNmgAAAYQ"]
[Tue Dec 09 17:44:42.464299 2025] [:error] [pid 30498:tid 30518] [client 37.140.223.47:21719] [client 37.140.223.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.47, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTfvih2mcZJQ5qP_RC0DgAAAABA"]
[Tue Dec 09 17:59:45.231169 2025] [:error] [pid 36456:tid 36475] [client 193.36.225.162:57415] [client 193.36.225.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTfzER0pAnOyfXl_v43zZQAAAJE"]
[Tue Dec 09 18:15:19.324688 2025] [:error] [pid 36456:tid 36466] [client 37.140.223.52:59645] [client 37.140.223.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.52, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTf2tx0pAnOyfXl_v438dwAAAIg"]
[Tue Dec 09 18:30:49.165433 2025] [:error] [pid 30591:tid 30608] [client 172.245.102.15:45717] [client 172.245.102.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.15, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTf6WRG-g76drVdWQUVS4QAAAE4"]
[Tue Dec 09 18:45:57.777005 2025] [:error] [pid 36456:tid 36460] [client 172.245.102.14:56093] [client 172.245.102.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTf95R0pAnOyfXl_v40LYgAAAII"]
[Tue Dec 09 18:52:04.566282 2025] [:error] [pid 36456:tid 36470] [client 136.111.143.167:54894] [client 136.111.143.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.143.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTf_VB0pAnOyfXl_v40NjwAAAIw"]
[Tue Dec 09 18:52:06.996223 2025] [:error] [pid 36456:tid 36472] [client 136.111.143.167:54894] [client 136.111.143.167] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aTf_Vh0pAnOyfXl_v40NkgAAAI4"]
[Tue Dec 09 18:52:07.208868 2025] [:error] [pid 36456:tid 36468] [client 136.111.143.167:54894] [client 136.111.143.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.143.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTf_Vx0pAnOyfXl_v40NkwAAAIo"]
[Tue Dec 09 18:52:08.929737 2025] [:error] [pid 30500:tid 30580] [client 136.111.143.167:56683] [client 136.111.143.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.143.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTf_WK2eIIK3JPWHCXWutwAAAZc"]
[Tue Dec 09 18:52:10.583277 2025] [:error] [pid 30498:tid 30511] [client 136.111.143.167:50772] [client 136.111.143.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.143.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTf_Wh2mcZJQ5qP_RC0XjQAAAAk"]
[Tue Dec 09 18:52:11.996097 2025] [:error] [pid 30500:tid 30566] [client 136.111.143.167:62362] [client 136.111.143.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.143.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTf_W62eIIK3JPWHCXWuvQAAAYk"]
[Tue Dec 09 18:52:13.364423 2025] [:error] [pid 30498:tid 30519] [client 136.111.143.167:55479] [client 136.111.143.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.143.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTf_XR2mcZJQ5qP_RC0XjwAAABE"]
[Tue Dec 09 18:52:14.754625 2025] [:error] [pid 36456:tid 36458] [client 136.111.143.167:57227] [client 136.111.143.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.143.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTf_Xh0pAnOyfXl_v40NmAAAAIA"]
[Tue Dec 09 18:52:14.754797 2025] [:error] [pid 36456:tid 36458] [client 136.111.143.167:57227] [client 136.111.143.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 136.111.143.167, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTf_Xh0pAnOyfXl_v40NmAAAAIA"]
[Tue Dec 09 19:00:58.071744 2025] [:error] [pid 30591:tid 30605] [client 172.245.102.13:64251] [client 172.245.102.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.13, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTgBahG-g76drVdWQUVd8QAAAEs"]
[Tue Dec 09 19:16:11.717781 2025] [:error] [pid 5276:tid 5290] [client 193.36.225.173:20925] [client 193.36.225.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.173, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTgE-0tSXwbewdwyu-1ZiQAAAMw"]
[Tue Dec 09 19:31:30.775809 2025] [:error] [pid 30499:tid 30545] [client 37.140.223.52:21089] [client 37.140.223.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.52, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTgIkk0x3OqZTOPp7cndywAAAU8"]
[Tue Dec 09 19:47:21.977333 2025] [:error] [pid 36456:tid 36475] [client 37.140.223.53:58917] [client 37.140.223.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTgMSR0pAnOyfXl_v40bTAAAAJE"]
[Tue Dec 09 19:53:50.071112 2025] [:error] [pid 30500:tid 30580] [client 35.192.77.233:64073] [client 35.192.77.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aTgNzq2eIIK3JPWHCXXMTQAAAZc"]
[Tue Dec 09 19:53:50.477958 2025] [:error] [pid 30498:tid 30502] [client 35.192.77.233:60962] [client 35.192.77.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aTgNzh2mcZJQ5qP_RC0m-wAAAAA"]
[Tue Dec 09 19:53:50.878874 2025] [:error] [pid 30499:tid 30540] [client 35.192.77.233:60727] [client 35.192.77.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aTgNzk0x3OqZTOPp7cnmPwAAAUo"]
[Tue Dec 09 20:02:35.596753 2025] [:error] [pid 30591:tid 30608] [client 172.245.102.16:59601] [client 172.245.102.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTgP2xG-g76drVdWQUVvowAAAE4"]
[Tue Dec 09 20:17:56.728382 2025] [:error] [pid 5276:tid 5297] [client 172.245.102.15:64803] [client 172.245.102.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.15, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTgTdEtSXwbewdwyu-1o8QAAANM"]
[Tue Dec 09 20:38:18.769443 2025] [:error] [pid 30500:tid 30580] [client 172.245.102.11:51627] [client 172.245.102.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.11, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTgYOq2eIIK3JPWHCXXlRwAAAZc"]
[Tue Dec 09 20:39:06.367718 2025] [:error] [pid 30500:tid 30567] [client 35.195.150.191:54877] [client 35.195.150.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.195.150.191, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTgYaq2eIIK3JPWHCXXlgQAAAYo"]
[Tue Dec 09 20:39:08.761238 2025] [:error] [pid 30500:tid 30575] [client 35.195.150.191:54877] [client 35.195.150.191] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aTgYbK2eIIK3JPWHCXXlhQAAAZI"]
[Tue Dec 09 20:39:09.035812 2025] [:error] [pid 30500:tid 30574] [client 35.195.150.191:54877] [client 35.195.150.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.195.150.191, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTgYba2eIIK3JPWHCXXlhgAAAZE"]
[Tue Dec 09 20:39:10.908365 2025] [:error] [pid 30591:tid 30615] [client 35.195.150.191:58164] [client 35.195.150.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.195.150.191, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTgYbhG-g76drVdWQUV9WgAAAFU"]
[Tue Dec 09 20:39:12.605657 2025] [:error] [pid 36456:tid 36473] [client 35.195.150.191:64974] [client 35.195.150.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.195.150.191, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTgYcB0pAnOyfXl_v40tEQAAAI8"]
[Tue Dec 09 20:39:14.321620 2025] [:error] [pid 36456:tid 36469] [client 35.195.150.191:59353] [client 35.195.150.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.195.150.191, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTgYch0pAnOyfXl_v40tFAAAAIs"]
[Tue Dec 09 20:39:16.134171 2025] [:error] [pid 30500:tid 30563] [client 35.195.150.191:50525] [client 35.195.150.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.195.150.191, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTgYdK2eIIK3JPWHCXXlkQAAAYY"]
[Tue Dec 09 20:39:16.134311 2025] [:error] [pid 30500:tid 30563] [client 35.195.150.191:50525] [client 35.195.150.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.195.150.191, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTgYdK2eIIK3JPWHCXXlkQAAAYY"]
[Tue Dec 09 20:53:34.428445 2025] [:error] [pid 30591:tid 30602] [client 136.144.33.19:62249] [client 136.144.33.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTgbzhG-g76drVdWQUWBVwAAAEg"]
[Tue Dec 09 21:08:49.897367 2025] [:error] [pid 30500:tid 30578] [client 193.36.225.162:54163] [client 193.36.225.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTgfYa2eIIK3JPWHCXX4kAAAAZU"]
[Tue Dec 09 21:24:23.009286 2025] [:error] [pid 30591:tid 30596] [client 193.36.225.161:65051] [client 193.36.225.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.161, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTgjBxG-g76drVdWQUWNkQAAAEI"]
[Tue Dec 09 21:39:46.173931 2025] [:error] [pid 30591:tid 30598] [client 193.36.225.177:51597] [client 193.36.225.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTgmohG-g76drVdWQUWSuQAAAEQ"]
[Tue Dec 09 21:55:09.445504 2025] [:error] [pid 30500:tid 30572] [client 37.140.223.57:59671] [client 37.140.223.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTgqPa2eIIK3JPWHCXUJ9AAAAY8"]
[Tue Dec 09 22:10:26.183981 2025] [:error] [pid 36456:tid 36478] [client 37.140.223.42:40199] [client 37.140.223.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.42, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTgt0h0pAnOyfXl_v41V9QAAAJQ"]
[Tue Dec 09 22:29:35.189651 2025] [:error] [pid 30500:tid 30558] [client 192.250.229.40:55666] [client 192.250.229.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.250.229.40, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTgyT62eIIK3JPWHCXUUOwAAAYE"]
[Tue Dec 09 22:29:36.572627 2025] [:error] [pid 30500:tid 30577] [client 192.250.229.40:55666] [client 192.250.229.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.250.229.40, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTgyUK2eIIK3JPWHCXUURgAAAZQ"], referer: https://expressinteriors.com/wp-login.php
[Tue Dec 09 22:40:48.511634 2025] [:error] [pid 36456:tid 36473] [client 37.140.223.45:54449] [client 37.140.223.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.45, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTg08B0pAnOyfXl_v41mIgAAAI8"]
[Tue Dec 09 22:55:20.650983 2025] [:error] [pid 36456:tid 36464] [client 193.36.225.160:51691] [client 193.36.225.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTg4WB0pAnOyfXl_v41ungAAAIY"]
[Tue Dec 09 23:10:20.497228 2025] [:error] [pid 30500:tid 30558] [client 193.36.225.188:62137] [client 193.36.225.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTg73K2eIIK3JPWHCXUltQAAAYE"]
[Tue Dec 09 23:25:22.960688 2025] [:error] [pid 30500:tid 30572] [client 193.36.225.165:52501] [client 193.36.225.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTg_Yq2eIIK3JPWHCXUs_wAAAY8"]
[Tue Dec 09 23:30:23.508763 2025] [:error] [pid 5276:tid 5293] [client 103.98.76.5:44854] [client 103.98.76.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.98.76.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aThAj0tSXwbewdwyu-2m8gAAAM8"]
[Tue Dec 09 23:31:00.028962 2025] [:error] [pid 36456:tid 36459] [client 103.98.76.5:59696] [client 103.98.76.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.98.76.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aThAtB0pAnOyfXl_v42EeAAAAIE"]
[Tue Dec 09 23:55:21.250847 2025] [:error] [pid 30499:tid 30550] [client 172.245.102.14:42265] [client 172.245.102.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aThGaU0x3OqZTOPp7ck_wQAAAVQ"]
[Wed Dec 10 00:08:01.711088 2025] [:error] [pid 30498:tid 30515] [client 45.148.10.250:44164] [client 45.148.10.250] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aThJYR2mcZJQ5qP_RC14ZgAAAA0"]
[Wed Dec 10 00:10:35.338480 2025] [:error] [pid 30591:tid 30595] [client 172.245.102.14:58747] [client 172.245.102.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aThJ-xG-g76drVdWQUXHzQAAAEE"]
[Wed Dec 10 00:25:55.992860 2025] [:error] [pid 2279:tid 2321] [client 37.140.223.51:42369] [client 37.140.223.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aThNk1mpdQscMcJOElWNZQAAAUs"]
[Wed Dec 10 00:56:35.591414 2025] [:error] [pid 2277:tid 2285] [client 193.36.225.181:64317] [client 193.36.225.181] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.181, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aThUw4WGo731r6eS-w5HwAAAAAM"]
[Wed Dec 10 01:11:46.024376 2025] [:error] [pid 2366:tid 2373] [client 193.36.225.166:48799] [client 193.36.225.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.166, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aThYUkAeBjkmsNRkd1NXKAAAAMU"]
[Wed Dec 10 01:21:09.726966 2025] [:error] [pid 2279:tid 2329] [client 35.229.126.9:55628] [client 35.229.126.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.229.126.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aThahVmpdQscMcJOElWtHwAAAVM"]
[Wed Dec 10 01:21:11.980321 2025] [:error] [pid 2279:tid 2323] [client 35.229.126.9:55628] [client 35.229.126.9] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aThah1mpdQscMcJOElWtJwAAAU0"]
[Wed Dec 10 01:21:12.192818 2025] [:error] [pid 2279:tid 2314] [client 35.229.126.9:55628] [client 35.229.126.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.229.126.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aThaiFmpdQscMcJOElWtKQAAAUQ"]
[Wed Dec 10 01:21:13.611628 2025] [:error] [pid 2280:tid 2358] [client 35.229.126.9:55068] [client 35.229.126.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.229.126.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aThaiXcqIB-8ALgw4ZpPXwAAAJU"]
[Wed Dec 10 01:21:15.066237 2025] [:error] [pid 2280:tid 2350] [client 35.229.126.9:61572] [client 35.229.126.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.229.126.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aThai3cqIB-8ALgw4ZpPZAAAAI0"]
[Wed Dec 10 01:21:16.514973 2025] [:error] [pid 37041:tid 37048] [client 35.229.126.9:62651] [client 35.229.126.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.229.126.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aThajLuffDW8UzBwa1aqyQAAAEU"]
[Wed Dec 10 01:21:18.032489 2025] [:error] [pid 2366:tid 2374] [client 35.229.126.9:50085] [client 35.229.126.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.229.126.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aThajkAeBjkmsNRkd1NeOgAAAMY"]
[Wed Dec 10 01:21:18.032677 2025] [:error] [pid 2366:tid 2374] [client 35.229.126.9:50085] [client 35.229.126.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.229.126.9, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aThajkAeBjkmsNRkd1NeOgAAAMY"]
[Wed Dec 10 01:25:37.044447 2025] [:error] [pid 2279:tid 2314] [client 34.182.66.248:61620] [client 34.182.66.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.182.66.248, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aThbkVmpdQscMcJOElWwiAAAAUQ"]
[Wed Dec 10 01:25:39.521971 2025] [:error] [pid 2279:tid 2328] [client 34.182.66.248:61620] [client 34.182.66.248] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aThbk1mpdQscMcJOElWwkAAAAVI"]
[Wed Dec 10 01:25:39.698872 2025] [:error] [pid 2279:tid 2333] [client 34.182.66.248:61620] [client 34.182.66.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.182.66.248, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aThbk1mpdQscMcJOElWwkQAAAVc"]
[Wed Dec 10 01:25:40.993491 2025] [:error] [pid 2366:tid 2379] [client 34.182.66.248:61850] [client 34.182.66.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.182.66.248, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aThblEAeBjkmsNRkd1NgvQAAAMs"]
[Wed Dec 10 01:25:42.259798 2025] [:error] [pid 37041:tid 37048] [client 34.182.66.248:53466] [client 34.182.66.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.182.66.248, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aThblruffDW8UzBwa1as3gAAAEU"]
[Wed Dec 10 01:25:43.542234 2025] [:error] [pid 2277:tid 2285] [client 34.182.66.248:50224] [client 34.182.66.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.182.66.248, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aThbl4WGo731r6eS-w5WfwAAAAM"]
[Wed Dec 10 01:25:44.824028 2025] [:error] [pid 2277:tid 2284] [client 34.182.66.248:61344] [client 34.182.66.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.182.66.248, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aThbmIWGo731r6eS-w5WggAAAAI"]
[Wed Dec 10 01:25:44.824150 2025] [:error] [pid 2277:tid 2284] [client 34.182.66.248:61344] [client 34.182.66.248] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.182.66.248, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aThbmIWGo731r6eS-w5WggAAAAI"]
[Wed Dec 10 01:26:56.476214 2025] [:error] [pid 2279:tid 2331] [client 193.36.225.181:44803] [client 193.36.225.181] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.181, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aThb4FmpdQscMcJOElWxBAAAAVU"]
[Wed Dec 10 02:31:11.378645 2025] [:error] [pid 2366:tid 2386] [client 193.36.225.175:20463] [client 193.36.225.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.175, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aThq70AeBjkmsNRkd1OKWQAAANI"]
[Wed Dec 10 03:08:09.508742 2025] [:error] [pid 2366:tid 2388] [client 182.44.10.67:40698] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aThzmUAeBjkmsNRkd1Ol6wAAANQ"]
[Wed Dec 10 03:24:46.425187 2025] [:error] [pid 28638:tid 28710] [client 37.140.223.19:41999] [client 37.140.223.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTh3fkTRfKqIz-zeH0qNYgAAAIc"]
[Wed Dec 10 03:55:27.430216 2025] [:error] [pid 11267:tid 11298] [client 187.55.16.206:55236] [client 187.55.16.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.55.16.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTh-r4Y2npWNIVl2IDxmYwAAAEE"]
[Wed Dec 10 04:14:29.218729 2025] [:error] [pid 11268:tid 11326] [client 193.36.225.188:61225] [client 193.36.225.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTiDJbbpLcj9WqyQndzhnQAAAII"]
[Wed Dec 10 05:04:15.411024 2025] [:error] [pid 11267:tid 11307] [client 45.148.10.154:56958] [client 45.148.10.154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aTiOz4Y2npWNIVl2IDyCTwAAAEo"]
[Wed Dec 10 05:43:22.041842 2025] [:error] [pid 11354:tid 11379] [client 187.55.16.206:58183] [client 187.55.16.206] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aTiX-u2TFO6mVSqWP8QN8QAAANY"]
[Wed Dec 10 05:44:56.527280 2025] [:error] [pid 4155:tid 4181] [client 187.55.16.206:59152] [client 187.55.16.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.55.16.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTiYWBaQ_NfzxmAbMq5DEAAAARg"]
[Wed Dec 10 05:46:17.556342 2025] [:error] [pid 11267:tid 11298] [client 187.55.16.206:60069] [client 187.55.16.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.55.16.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTiYqYY2npWNIVl2IDySXgAAAEE"]
[Wed Dec 10 05:47:24.812720 2025] [:error] [pid 11268:tid 11337] [client 187.55.16.206:60929] [client 187.55.16.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.55.16.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTiY7LbpLcj9WqyQndwK1AAAAI0"]
[Wed Dec 10 05:48:37.718960 2025] [:error] [pid 4155:tid 4174] [client 187.55.16.206:61843] [client 187.55.16.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.55.16.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTiZNRaQ_NfzxmAbMq5FcgAAARE"]
[Wed Dec 10 05:49:49.304740 2025] [:error] [pid 11267:tid 11317] [client 187.55.16.206:62777] [client 187.55.16.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.55.16.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTiZfYY2npWNIVl2IDyTzQAAAFQ"]
[Wed Dec 10 06:31:20.408916 2025] [:error] [pid 16566:tid 16578] [client 208.113.188.105:49024] [client 208.113.188.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.113.188.105, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTijOCEgzB1153EFuAbMaQAAAUo"]
[Wed Dec 10 06:31:39.870818 2025] [:error] [pid 11354:tid 11369] [client 208.113.188.105:40028] [client 208.113.188.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.113.188.105, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTijS-2TFO6mVSqWP8Qh0AAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 10 06:33:30.960756 2025] [:error] [pid 16597:tid 16627] [client 193.36.225.162:20309] [client 193.36.225.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTijum4Hlu0QtpUGkRRESAAAAcA"]
[Wed Dec 10 06:58:36.567494 2025] [:error] [pid 16596:tid 16620] [client 178.18.254.253:50032] [client 178.18.254.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.18.254.253, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTipnHBe21fHOHH2RQoOggAAAZQ"]
[Wed Dec 10 07:52:30.857199 2025] [:error] [pid 16596:tid 16604] [client 173.244.55.96:43491] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aTi2PnBe21fHOHH2RQocdwAAAYQ"]
[Wed Dec 10 07:52:37.612091 2025] [:error] [pid 11354:tid 11368] [client 173.244.55.98:43469] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aTi2Re2TFO6mVSqWP8Qv7AAAAMs"]
[Wed Dec 10 07:52:48.951093 2025] [:error] [pid 21327:tid 21348] [client 173.244.55.99:60765] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aTi2UNuj_E2YnwjFG09gXwAAApM"]
[Wed Dec 10 07:52:55.641823 2025] [:error] [pid 11266:tid 11294] [client 173.244.55.96:44581] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aTi2VyXL_Qb0Ip3FW3mwiwAAABg"]
[Wed Dec 10 07:53:07.251029 2025] [:error] [pid 16596:tid 16617] [client 173.244.55.99:61861] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aTi2Y3Be21fHOHH2RQocrgAAAZE"]
[Wed Dec 10 07:53:10.890085 2025] [:error] [pid 16596:tid 16600] [client 173.244.55.96:49811] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aTi2ZnBe21fHOHH2RQoctAAAAYA"]
[Wed Dec 10 07:53:12.275082 2025] [:error] [pid 21356:tid 21378] [client 173.244.55.96:26847] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aTi2aKfG7wIA5S25SldlgwAAAtM"]
[Wed Dec 10 07:53:13.657904 2025] [:error] [pid 16596:tid 16612] [client 173.244.55.97:36767] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aTi2aXBe21fHOHH2RQoctgAAAYw"]
[Wed Dec 10 07:53:15.032506 2025] [:error] [pid 21255:tid 21259] [client 173.244.55.97:30175] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aTi2a_Ow-vgCwe7hEWEk7gAAAgE"]
[Wed Dec 10 07:53:16.421938 2025] [:error] [pid 11266:tid 11291] [client 173.244.55.97:28663] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aTi2bCXL_Qb0Ip3FW3mwlwAAABU"]
[Wed Dec 10 07:53:19.070917 2025] [:error] [pid 21356:tid 21383] [client 173.244.55.97:63075] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aTi2b6fG7wIA5S25SldlkwAAAtg"]
[Wed Dec 10 07:53:23.453038 2025] [:error] [pid 16596:tid 16604] [client 173.244.55.97:62721] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aTi2c3Be21fHOHH2RQocyAAAAYQ"]
[Wed Dec 10 07:53:28.899494 2025] [:error] [pid 21255:tid 21273] [client 173.244.55.97:26871] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aTi2ePOw-vgCwe7hEWElDQAAAg8"]
[Wed Dec 10 07:53:31.621486 2025] [:error] [pid 16597:tid 16645] [client 173.244.55.99:59841] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aTi2e24Hlu0QtpUGkRRS7QAAAdI"]
[Wed Dec 10 07:53:35.301421 2025] [:error] [pid 16566:tid 16583] [client 173.244.55.99:36805] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aTi2fyEgzB1153EFuAbctgAAAU8"]
[Wed Dec 10 07:53:46.474764 2025] [:error] [pid 11354:tid 11378] [client 173.244.55.98:52091] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aTi2iu2TFO6mVSqWP8QwKgAAANU"]
[Wed Dec 10 07:53:50.153806 2025] [:error] [pid 11268:tid 11337] [client 173.244.55.98:60815] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aTi2jrbpLcj9WqyQndwreAAAAI0"]
[Wed Dec 10 07:53:55.690295 2025] [:error] [pid 16596:tid 16621] [client 173.244.55.99:20509] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/defaults.php"] [unique_id "aTi2k3Be21fHOHH2RQoc5QAAAZU"]
[Wed Dec 10 07:54:00.331451 2025] [:error] [pid 16596:tid 16601] [client 173.244.55.97:56285] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aTi2mHBe21fHOHH2RQoc6QAAAYE"]
[Wed Dec 10 07:54:08.975655 2025] [:error] [pid 21255:tid 21275] [client 173.244.55.97:62665] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aTi2oPOw-vgCwe7hEWEldQAAAhE"]
[Wed Dec 10 07:54:12.680008 2025] [:error] [pid 16597:tid 16632] [client 173.244.55.96:36187] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aTi2pG4Hlu0QtpUGkRRTGAAAAcU"]
[Wed Dec 10 07:54:16.368660 2025] [:error] [pid 21255:tid 21279] [client 173.244.55.97:42931] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aTi2qPOw-vgCwe7hEWElfwAAAhU"]
[Wed Dec 10 07:54:17.754391 2025] [:error] [pid 11268:tid 11342] [client 173.244.55.96:48779] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aTi2qbbpLcj9WqyQndwriQAAAJI"]
[Wed Dec 10 07:54:19.138353 2025] [:error] [pid 11266:tid 11285] [client 173.244.55.97:40903] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aTi2qyXL_Qb0Ip3FW3mwwwAAAA8"]
[Wed Dec 10 07:54:26.072698 2025] [:error] [pid 16596:tid 16603] [client 173.244.55.99:58241] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/info.php"] [unique_id "aTi2snBe21fHOHH2RQoc-gAAAYM"]
[Wed Dec 10 07:54:27.457756 2025] [:error] [pid 21255:tid 21269] [client 173.244.55.99:28757] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class.api.php"] [unique_id "aTi2s_Ow-vgCwe7hEWEljwAAAgs"]
[Wed Dec 10 07:54:28.833537 2025] [:error] [pid 11268:tid 11336] [client 173.244.55.96:32141] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aTi2tLbpLcj9WqyQndwrkQAAAIw"]
[Wed Dec 10 07:54:43.527149 2025] [:error] [pid 21356:tid 21374] [client 173.244.55.98:53487] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/admin.php"] [unique_id "aTi2w6fG7wIA5S25Sldl2AAAAs8"]
[Wed Dec 10 07:54:50.141149 2025] [:error] [pid 16566:tid 16570] [client 173.244.55.98:51507] [client 173.244.55.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.98, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aTi2yiEgzB1153EFuAbc9wAAAUI"]
[Wed Dec 10 07:55:09.403098 2025] [:error] [pid 16566:tid 16577] [client 173.244.55.98:51507] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aTi23SEgzB1153EFuAbdEwAAAUk"]
[Wed Dec 10 07:55:15.142455 2025] [:error] [pid 11266:tid 11275] [client 173.244.55.98:21727] [client 173.244.55.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.98, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aTi24yXL_Qb0Ip3FW3mxCgAAAAU"]
[Wed Dec 10 07:55:18.327746 2025] [:error] [pid 11266:tid 11273] [client 173.244.55.98:21727] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/item.php"] [unique_id "aTi25iXL_Qb0Ip3FW3mxDAAAAAM"]
[Wed Dec 10 07:55:32.437646 2025] [:error] [pid 16596:tid 16610] [client 173.244.55.98:29527] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aTi29HBe21fHOHH2RQodhQAAAYo"]
[Wed Dec 10 07:55:47.712988 2025] [:error] [pid 16597:tid 16632] [client 173.244.55.99:41691] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aTi3A24Hlu0QtpUGkRRTgQAAAcU"]
[Wed Dec 10 07:55:53.228861 2025] [:error] [pid 21255:tid 21275] [client 173.244.55.96:23949] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aTi3CfOw-vgCwe7hEWEmHAAAAhE"]
[Wed Dec 10 07:56:00.150491 2025] [:error] [pid 21327:tid 21345] [client 173.244.55.96:27109] [client 173.244.55.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aTi3ENuj_E2YnwjFG09g7gAAApA"]
[Wed Dec 10 07:56:01.878049 2025] [:error] [pid 21327:tid 21341] [client 173.244.55.96:27109] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aTi3Eduj_E2YnwjFG09hAAAAAow"]
[Wed Dec 10 07:56:31.012385 2025] [:error] [pid 11268:tid 11334] [client 173.244.55.98:58065] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aTi3L7bpLcj9WqyQndwsQQAAAIo"]
[Wed Dec 10 07:56:36.699152 2025] [:error] [pid 21327:tid 21337] [client 173.244.55.98:44505] [client 173.244.55.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.98, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aTi3NNuj_E2YnwjFG09hcQAAAog"]
[Wed Dec 10 07:56:43.616154 2025] [:error] [pid 21356:tid 21359] [client 173.244.55.97:23263] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aTi3O6fG7wIA5S25SldmVgAAAsA"]
[Wed Dec 10 07:56:47.279453 2025] [:error] [pid 11268:tid 11341] [client 173.244.55.96:36317] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/infi.php"] [unique_id "aTi3P7bpLcj9WqyQndwsUAAAAJE"]
[Wed Dec 10 07:56:52.147820 2025] [:error] [pid 21255:tid 21282] [client 173.244.55.96:35101] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aTi3RPOw-vgCwe7hEWEmYgAAAhg"]
[Wed Dec 10 07:56:58.760869 2025] [:error] [pid 16566:tid 16576] [client 173.244.55.97:62423] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aTi3SiEgzB1153EFuAbdlQAAAUg"]
[Wed Dec 10 07:57:00.145460 2025] [:error] [pid 11266:tid 11287] [client 173.244.55.97:58071] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aTi3TCXL_Qb0Ip3FW3mxXwAAABE"]
[Wed Dec 10 07:57:10.247679 2025] [:error] [pid 21356:tid 21361] [client 173.244.55.99:54945] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aTi3VqfG7wIA5S25SldmbwAAAsI"]
[Wed Dec 10 07:57:13.907955 2025] [:error] [pid 11268:tid 11345] [client 173.244.55.99:33779] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "aTi3WbbpLcj9WqyQndwsXgAAAJU"]
[Wed Dec 10 07:57:20.805442 2025] [:error] [pid 11354:tid 11374] [client 173.244.55.96:46061] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/edit.php"] [unique_id "aTi3YO2TFO6mVSqWP8QxnwAAANE"]
[Wed Dec 10 07:57:27.808481 2025] [:error] [pid 21356:tid 21373] [client 173.244.55.96:35543] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aTi3Z6fG7wIA5S25SldmkgAAAs4"]
[Wed Dec 10 07:57:33.074251 2025] [:error] [pid 11354:tid 11369] [client 173.244.55.98:28945] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/click.php"] [unique_id "aTi3be2TFO6mVSqWP8QxqQAAAMw"]
[Wed Dec 10 07:57:39.927957 2025] [:error] [pid 11268:tid 11347] [client 173.244.55.99:55483] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aTi3c7bpLcj9WqyQndwsbAAAAJc"]
[Wed Dec 10 07:57:52.283902 2025] [:error] [pid 16597:tid 16647] [client 173.244.55.96:64811] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aTi3gG4Hlu0QtpUGkRRT8QAAAdQ"]
[Wed Dec 10 07:57:53.662228 2025] [:error] [pid 21255:tid 21270] [client 173.244.55.97:24871] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/xl2023.php"] [unique_id "aTi3gfOw-vgCwe7hEWEmmgAAAgw"]
[Wed Dec 10 07:57:55.049223 2025] [:error] [pid 21255:tid 21275] [client 173.244.55.98:34945] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aTi3g_Ow-vgCwe7hEWEmmwAAAhE"]
[Wed Dec 10 07:57:56.429763 2025] [:error] [pid 11268:tid 11328] [client 173.244.55.97:30371] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aTi3hLbpLcj9WqyQndwscwAAAIQ"]
[Wed Dec 10 07:58:00.077172 2025] [:error] [pid 16566:tid 16589] [client 173.244.55.99:58797] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aTi3iCEgzB1153EFuAbdwgAAAVU"]
[Wed Dec 10 07:58:01.462757 2025] [:error] [pid 21356:tid 21362] [client 173.244.55.99:38405] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aTi3iafG7wIA5S25SldmqAAAAsM"]
[Wed Dec 10 07:58:06.885131 2025] [:error] [pid 21327:tid 21332] [client 173.244.55.96:51403] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aTi3jtuj_E2YnwjFG09hvgAAAoM"]
[Wed Dec 10 07:58:08.270728 2025] [:error] [pid 21356:tid 21382] [client 173.244.55.99:35749] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aTi3kKfG7wIA5S25SldmrgAAAtc"]
[Wed Dec 10 07:58:09.646527 2025] [:error] [pid 21327:tid 21343] [client 173.244.55.99:49291] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aTi3kduj_E2YnwjFG09hxAAAAo4"]
[Wed Dec 10 07:58:11.035490 2025] [:error] [pid 21356:tid 21360] [client 173.244.55.98:46997] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "aTi3k6fG7wIA5S25SldmsQAAAsE"]
[Wed Dec 10 07:58:14.722403 2025] [:error] [pid 21356:tid 21383] [client 173.244.55.99:63713] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aTi3lqfG7wIA5S25SldmugAAAtg"]
[Wed Dec 10 07:58:16.119908 2025] [proxy_fcgi:error] [pid 16597:tid 16649] [client 173.244.55.98:42681] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function add_action() in /home/expressi/public_html/wp-content/plugins/hello.php:69\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/plugins/hello.php on line 69'
[Wed Dec 10 07:58:19.805284 2025] [:error] [pid 21356:tid 21367] [client 173.244.55.97:30103] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "aTi3m6fG7wIA5S25SldmwAAAAsg"]
[Wed Dec 10 07:58:27.780520 2025] [:error] [pid 16596:tid 16612] [client 173.244.55.98:45487] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aTi3o3Be21fHOHH2RQoeOwAAAYw"]
[Wed Dec 10 07:58:40.835797 2025] [:error] [pid 21291:tid 21310] [client 173.244.55.97:61119] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/file.php"] [unique_id "aTi3sJreiUgLUUTTKJdQTgAAAlE"]
[Wed Dec 10 07:58:47.226104 2025] [:error] [pid 16597:tid 16627] [client 173.244.55.96:34141] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aTi3t24Hlu0QtpUGkRRUFgAAAcA"]
[Wed Dec 10 07:58:48.603611 2025] [:error] [pid 11266:tid 11294] [client 173.244.55.96:26607] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aTi3uCXL_Qb0Ip3FW3mxqwAAABg"]
[Wed Dec 10 07:58:56.649986 2025] [:error] [pid 11354:tid 11360] [client 173.244.55.96:39263] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aTi3wO2TFO6mVSqWP8Qx_QAAAMM"]
[Wed Dec 10 07:59:03.939041 2025] [proxy_fcgi:error] [pid 11268:tid 11347] [client 173.244.55.99:23583] AH01071: Got error 'Primary script unknown'
[Wed Dec 10 07:59:04.649091 2025] [proxy_fcgi:error] [pid 11268:tid 11326] [client 173.244.55.99:23583] AH01071: Got error 'Primary script unknown'
[Wed Dec 10 07:59:05.358635 2025] [proxy_fcgi:error] [pid 11268:tid 11346] [client 173.244.55.99:23583] AH01071: Got error 'Primary script unknown'
[Wed Dec 10 07:59:11.042400 2025] [:error] [pid 21291:tid 21306] [client 173.244.55.99:30063] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aTi3z5reiUgLUUTTKJdQWwAAAk0"]
[Wed Dec 10 07:59:12.424057 2025] [:error] [pid 11266:tid 11278] [client 173.244.55.99:57317] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aTi30CXL_Qb0Ip3FW3mxuQAAAAg"]
[Wed Dec 10 07:59:13.804958 2025] [:error] [pid 21291:tid 21301] [client 173.244.55.97:56921] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aTi30ZreiUgLUUTTKJdQXQAAAkg"]
[Wed Dec 10 07:59:15.182956 2025] [:error] [pid 11266:tid 11281] [client 173.244.55.98:22509] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aTi30yXL_Qb0Ip3FW3mxvgAAAAs"]
[Wed Dec 10 07:59:16.570705 2025] [:error] [pid 16597:tid 16632] [client 173.244.55.98:25685] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aTi31G4Hlu0QtpUGkRRUKQAAAcU"]
[Wed Dec 10 07:59:17.948324 2025] [:error] [pid 11266:tid 11275] [client 173.244.55.97:45485] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aTi31SXL_Qb0Ip3FW3mxwgAAAAU"]
[Wed Dec 10 07:59:20.737799 2025] [:error] [pid 21327:tid 21341] [client 173.244.55.96:54067] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "aTi32Nuj_E2YnwjFG09iAgAAAow"]
[Wed Dec 10 07:59:22.117142 2025] [:error] [pid 16597:tid 16648] [client 173.244.55.98:28875] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aTi32m4Hlu0QtpUGkRRULAAAAdU"]
[Wed Dec 10 07:59:23.493782 2025] [:error] [pid 11268:tid 11334] [client 173.244.55.98:39901] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aTi327bpLcj9WqyQndwstQAAAIo"]
[Wed Dec 10 07:59:24.908165 2025] [:error] [pid 21255:tid 21275] [client 173.244.55.96:23253] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aTi33POw-vgCwe7hEWEm-AAAAhE"]
[Wed Dec 10 07:59:29.891236 2025] [:error] [pid 16596:tid 16624] [client 173.244.55.99:39477] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aTi34XBe21fHOHH2RQoeaAAAAZg"]
[Wed Dec 10 07:59:32.489071 2025] [:error] [pid 21356:tid 21380] [client 173.244.55.96:53897] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "aTi35KfG7wIA5S25SldnAQAAAtU"]
[Wed Dec 10 07:59:37.892106 2025] [:error] [pid 16597:tid 16651] [client 173.244.55.97:51653] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aTi36W4Hlu0QtpUGkRRUPAAAAdg"]
[Wed Dec 10 07:59:43.203245 2025] [:error] [pid 11268:tid 11327] [client 173.244.55.99:29825] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/about.php"] [unique_id "aTi377bpLcj9WqyQndwsvQAAAIM"]
[Wed Dec 10 07:59:50.095632 2025] [:error] [pid 11354:tid 11374] [client 173.244.55.97:20573] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aTi39u2TFO6mVSqWP8QyGQAAANE"]
[Wed Dec 10 07:59:58.338769 2025] [:error] [pid 11268:tid 11340] [client 173.244.55.98:45711] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aTi3_rbpLcj9WqyQndws6gAAAJA"]
[Wed Dec 10 08:00:02.173165 2025] [:error] [pid 16596:tid 16609] [client 173.244.55.98:63977] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aTi4AnBe21fHOHH2RQoefwAAAYk"]
[Wed Dec 10 08:00:28.848500 2025] [:error] [pid 21356:tid 21362] [client 173.244.55.98:44159] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aTi4HKfG7wIA5S25SldnRQAAAsM"]
[Wed Dec 10 08:00:30.235398 2025] [:error] [pid 11266:tid 11270] [client 173.244.55.99:44669] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aTi4HiXL_Qb0Ip3FW3myGAAAAAA"]
[Wed Dec 10 08:00:31.609443 2025] [:error] [pid 11266:tid 11277] [client 173.244.55.96:56619] [client 173.244.55.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTi4HyXL_Qb0Ip3FW3myGgAAAAc"]
[Wed Dec 10 08:00:35.089628 2025] [:error] [pid 11266:tid 11285] [client 173.244.55.96:56619] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aTi4IyXL_Qb0Ip3FW3myHgAAAA8"]
[Wed Dec 10 08:00:42.301991 2025] [:error] [pid 16566:tid 16592] [client 173.244.55.97:31269] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aTi4KiEgzB1153EFuAbekgAAAVg"]
[Wed Dec 10 08:00:43.690466 2025] [:error] [pid 16566:tid 16588] [client 173.244.55.96:46093] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aTi4KyEgzB1153EFuAbelgAAAVQ"]
[Wed Dec 10 08:00:52.285211 2025] [:error] [pid 16596:tid 16607] [client 173.244.55.98:60755] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aTi4NHBe21fHOHH2RQoeqwAAAYc"]
[Wed Dec 10 08:00:53.671603 2025] [:error] [pid 16566:tid 16589] [client 173.244.55.99:58125] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aTi4NSEgzB1153EFuAberAAAAVU"]
[Wed Dec 10 08:01:03.587782 2025] [:error] [pid 21356:tid 21383] [client 173.244.55.97:48757] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aTi4P6fG7wIA5S25SldnYAAAAtg"]
[Wed Dec 10 08:01:08.562684 2025] [proxy_fcgi:error] [pid 16597:tid 16647] [client 173.244.55.99:54479] AH01071: Got error 'Primary script unknown'
[Wed Dec 10 08:01:10.908564 2025] [:error] [pid 16597:tid 16641] [client 173.244.55.99:54479] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/function.php"] [unique_id "aTi4Rm4Hlu0QtpUGkRRUeAAAAc4"]
[Wed Dec 10 08:01:12.316248 2025] [:error] [pid 16596:tid 16600] [client 173.244.55.96:46505] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/plugins.php"] [unique_id "aTi4SHBe21fHOHH2RQoexgAAAYA"]
[Wed Dec 10 08:01:17.593250 2025] [:error] [pid 21291:tid 21293] [client 173.244.55.99:62505] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "aTi4TZreiUgLUUTTKJdQlQAAAkA"]
[Wed Dec 10 08:01:18.981083 2025] [:error] [pid 16566:tid 16592] [client 173.244.55.97:37955] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aTi4TiEgzB1153EFuAbevwAAAVg"]
[Wed Dec 10 08:01:31.788343 2025] [:error] [pid 21255:tid 21260] [client 173.244.55.98:52131] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/atomlib.php"] [unique_id "aTi4W_Ow-vgCwe7hEWEnvgAAAgI"]
[Wed Dec 10 08:01:33.176767 2025] [:error] [pid 21291:tid 21307] [client 173.244.55.97:29383] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aTi4XZreiUgLUUTTKJdQnAAAAk4"]
[Wed Dec 10 08:01:41.587980 2025] [:error] [pid 11268:tid 11335] [client 173.244.55.97:26345] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aTi4ZbbpLcj9WqyQndwtLQAAAIs"]
[Wed Dec 10 08:01:42.973448 2025] [:error] [pid 21291:tid 21295] [client 173.244.55.99:23555] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aTi4ZpreiUgLUUTTKJdQoQAAAkI"]
[Wed Dec 10 08:01:44.359964 2025] [:error] [pid 11354:tid 11376] [client 173.244.55.98:27509] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aTi4aO2TFO6mVSqWP8QyUQAAANM"]
[Wed Dec 10 08:01:54.813529 2025] [:error] [pid 11266:tid 11291] [client 173.244.55.98:43211] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aTi4ciXL_Qb0Ip3FW3mybAAAABU"]
[Wed Dec 10 08:01:58.461886 2025] [:error] [pid 16597:tid 16645] [client 173.244.55.98:62549] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aTi4dm4Hlu0QtpUGkRRUnwAAAdI"]
[Wed Dec 10 08:02:10.280710 2025] [:error] [pid 16566:tid 16569] [client 173.244.55.96:52087] [client 173.244.55.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/js/wp-login.php"] [unique_id "aTi4giEgzB1153EFuAbe8gAAAUE"]
[Wed Dec 10 08:02:20.571411 2025] [:error] [pid 16566:tid 16590] [client 173.244.55.96:52087] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bk/index.php"] [unique_id "aTi4jCEgzB1153EFuAbfAAAAAVY"]
[Wed Dec 10 08:02:21.959973 2025] [:error] [pid 21327:tid 21347] [client 173.244.55.96:42649] [client 173.244.55.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aTi4jduj_E2YnwjFG09ilQAAApI"]
[Wed Dec 10 08:02:39.723102 2025] [proxy_fcgi:error] [pid 21327:tid 21347] [client 173.244.55.96:42649] AH01071: Got error 'Primary script unknown'
[Wed Dec 10 08:03:08.963823 2025] [:error] [pid 21255:tid 21269] [client 173.244.55.98:47221] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/about.php"] [unique_id "aTi4vPOw-vgCwe7hEWEoTwAAAgs"]
[Wed Dec 10 08:03:16.026920 2025] [:error] [pid 16597:tid 16641] [client 173.244.55.99:65147] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aTi4xG4Hlu0QtpUGkRRU0wAAAc4"]
[Wed Dec 10 08:03:21.507196 2025] [:error] [pid 21356:tid 21373] [client 173.244.55.98:33199] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aTi4yafG7wIA5S25SldnowAAAs4"]
[Wed Dec 10 08:03:37.812679 2025] [:error] [pid 21291:tid 21293] [client 173.244.55.96:22737] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aTi42ZreiUgLUUTTKJdRBgAAAkA"]
[Wed Dec 10 08:03:43.087321 2025] [:error] [pid 16596:tid 16602] [client 173.244.55.96:60177] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aTi433Be21fHOHH2RQofUgAAAYI"]
[Wed Dec 10 08:03:46.843044 2025] [:error] [pid 16566:tid 16575] [client 173.244.55.97:42261] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aTi44iEgzB1153EFuAbfPgAAAUc"]
[Wed Dec 10 08:03:55.413999 2025] [proxy_fcgi:error] [pid 21255:tid 21265] [client 173.244.55.99:42169] AH01071: Got error 'Primary script unknown'
[Wed Dec 10 08:03:56.113270 2025] [proxy_fcgi:error] [pid 21255:tid 21259] [client 173.244.55.99:42169] AH01071: Got error 'Primary script unknown'
[Wed Dec 10 08:03:56.805468 2025] [:error] [pid 21255:tid 21266] [client 173.244.55.99:42169] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aTi47POw-vgCwe7hEWEoqwAAAgg"]
[Wed Dec 10 08:03:58.190374 2025] [:error] [pid 11354:tid 11375] [client 173.244.55.97:63867] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aTi47u2TFO6mVSqWP8QynwAAANI"]
[Wed Dec 10 08:04:11.401049 2025] [:error] [pid 16596:tid 16616] [client 173.244.55.98:50701] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aTi4-3Be21fHOHH2RQofaQAAAZA"]
[Wed Dec 10 08:04:15.071440 2025] [:error] [pid 11354:tid 11367] [client 173.244.55.96:51049] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "aTi4_-2TFO6mVSqWP8QyxgAAAMo"]
[Wed Dec 10 08:04:22.090053 2025] [:error] [pid 16597:tid 16639] [client 173.244.55.99:33971] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aTi5Bm4Hlu0QtpUGkRRVDAAAAcw"]
[Wed Dec 10 08:04:35.381884 2025] [:error] [pid 11354:tid 11374] [client 173.244.55.99:53061] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aTi5E-2TFO6mVSqWP8Qy2AAAANE"]
[Wed Dec 10 08:04:36.765831 2025] [proxy_fcgi:error] [pid 16596:tid 16608] [client 173.244.55.96:24361] AH01071: Got error 'Primary script unknown'
[Wed Dec 10 08:04:41.325984 2025] [:error] [pid 16596:tid 16618] [client 173.244.55.96:24361] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aTi5GXBe21fHOHH2RQofjgAAAZI"]
[Wed Dec 10 08:04:50.927443 2025] [proxy_fcgi:error] [pid 16596:tid 16611] [client 173.244.55.96:28339] AH01071: Got error 'Primary script unknown'
[Wed Dec 10 08:04:53.116976 2025] [:error] [pid 16596:tid 16617] [client 173.244.55.96:28339] [client 173.244.55.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aTi5JXBe21fHOHH2RQoflwAAAZE"]
[Wed Dec 10 08:05:00.955334 2025] [:error] [pid 16596:tid 16618] [client 173.244.55.96:28339] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aTi5LHBe21fHOHH2RQofoQAAAZI"]
[Wed Dec 10 08:05:04.726801 2025] [:error] [pid 21356:tid 21363] [client 173.244.55.99:20677] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aTi5MKfG7wIA5S25Sldn6wAAAsQ"]
[Wed Dec 10 08:05:12.948052 2025] [:error] [pid 21255:tid 21258] [client 173.244.55.99:63443] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aTi5OPOw-vgCwe7hEWEpDwAAAgA"]
[Wed Dec 10 08:05:21.076062 2025] [:error] [pid 11354:tid 11359] [client 173.244.55.99:41527] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aTi5Qe2TFO6mVSqWP8Qy7QAAAMI"]
[Wed Dec 10 08:05:24.743906 2025] [:error] [pid 11354:tid 11368] [client 173.244.55.98:62473] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aTi5RO2TFO6mVSqWP8Qy7wAAAMs"]
[Wed Dec 10 08:05:31.568345 2025] [:error] [pid 16597:tid 16645] [client 173.244.55.99:22113] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aTi5S24Hlu0QtpUGkRRVLwAAAdI"]
[Wed Dec 10 08:05:36.902887 2025] [proxy_fcgi:error] [pid 11354:tid 11360] [client 173.244.55.97:30709] AH01071: Got error 'Primary script unknown'
[Wed Dec 10 08:05:38.514056 2025] [:error] [pid 11354:tid 11372] [client 173.244.55.97:30709] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aTi5Uu2TFO6mVSqWP8Qy-AAAAM8"]
[Wed Dec 10 08:05:39.908006 2025] [proxy_fcgi:error] [pid 11268:tid 11347] [client 173.244.55.98:22013] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function add_action() in /home/expressi/public_html/wp-content/themes/twentytwentyfour/functions.php:147\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/themes/twentytwentyfour/functions.php on line 147'
[Wed Dec 10 08:05:42.336952 2025] [:error] [pid 11268:tid 11326] [client 173.244.55.96:28333] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/db.php"] [unique_id "aTi5VrbpLcj9WqyQndwt4AAAAII"]
[Wed Dec 10 08:05:43.712428 2025] [:error] [pid 16566:tid 16592] [client 173.244.55.99:36371] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aTi5VyEgzB1153EFuAbfnwAAAVg"]
[Wed Dec 10 08:05:45.096091 2025] [:error] [pid 21255:tid 21272] [client 173.244.55.96:62665] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aTi5WfOw-vgCwe7hEWEpLwAAAg4"]
[Wed Dec 10 08:05:46.477149 2025] [:error] [pid 21255:tid 21271] [client 173.244.55.97:41087] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aTi5WvOw-vgCwe7hEWEpMQAAAg0"]
[Wed Dec 10 08:05:47.867173 2025] [:error] [pid 11266:tid 11276] [client 173.244.55.99:39773] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aTi5WyXL_Qb0Ip3FW3mzKgAAAAY"]
[Wed Dec 10 08:05:49.242606 2025] [:error] [pid 16596:tid 16602] [client 173.244.55.97:51055] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aTi5XXBe21fHOHH2RQofzAAAAYI"]
[Wed Dec 10 08:05:54.606236 2025] [:error] [pid 21291:tid 21308] [client 173.244.55.97:38881] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aTi5YpreiUgLUUTTKJdRRAAAAk8"]
[Wed Dec 10 08:05:55.994481 2025] [:error] [pid 16596:tid 16600] [client 173.244.55.99:50319] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aTi5Y3Be21fHOHH2RQofzQAAAYA"]
[Wed Dec 10 08:05:57.400049 2025] [:error] [pid 21255:tid 21274] [client 173.244.55.97:64217] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aTi5ZfOw-vgCwe7hEWEpNgAAAhA"]
[Wed Dec 10 08:06:00.110034 2025] [:error] [pid 11268:tid 11332] [client 173.244.55.98:61731] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aTi5aLbpLcj9WqyQndwt6gAAAIg"]
[Wed Dec 10 08:06:05.539567 2025] [:error] [pid 11268:tid 11347] [client 173.244.55.97:61165] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/options.php"] [unique_id "aTi5bbbpLcj9WqyQndwt8AAAAJc"]
[Wed Dec 10 08:06:06.928804 2025] [proxy_fcgi:error] [pid 21291:tid 21313] [client 173.244.55.98:40175] AH01071: Got error 'Primary script unknown'
[Wed Dec 10 08:06:13.227187 2025] [:error] [pid 21291:tid 21307] [client 173.244.55.98:40175] [client 173.244.55.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.98, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aTi5dZreiUgLUUTTKJdRVgAAAk4"]
[Wed Dec 10 08:06:22.503895 2025] [:error] [pid 21291:tid 21316] [client 173.244.55.98:40175] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aTi5fpreiUgLUUTTKJdRXwAAAlc"]
[Wed Dec 10 08:06:23.885622 2025] [:error] [pid 11266:tid 11286] [client 173.244.55.96:34309] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aTi5fyXL_Qb0Ip3FW3mzTgAAABA"]
[Wed Dec 10 08:06:51.692708 2025] [:error] [pid 11266:tid 11293] [client 173.244.55.96:50033] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aTi5myXL_Qb0Ip3FW3mzZQAAABc"]
[Wed Dec 10 08:06:53.083405 2025] [:error] [pid 21255:tid 21270] [client 173.244.55.98:64295] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aTi5nfOw-vgCwe7hEWEpewAAAgw"]
[Wed Dec 10 08:06:54.464613 2025] [:error] [pid 16597:tid 16634] [client 173.244.55.97:46883] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aTi5nm4Hlu0QtpUGkRRVUgAAAcc"]
[Wed Dec 10 08:07:06.276799 2025] [:error] [pid 16596:tid 16606] [client 173.244.55.98:29953] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aTi5qnBe21fHOHH2RQogCQAAAYY"]
[Wed Dec 10 08:07:07.662647 2025] [:error] [pid 21327:tid 21335] [client 173.244.55.97:47231] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aTi5q9uj_E2YnwjFG09jIQAAAoY"]
[Wed Dec 10 08:07:09.055103 2025] [:error] [pid 11268:tid 11343] [client 173.244.55.97:50405] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aTi5rbbpLcj9WqyQndwuFQAAAJM"]
[Wed Dec 10 08:07:17.375703 2025] [:error] [pid 21327:tid 21333] [client 173.244.55.99:47033] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aTi5tduj_E2YnwjFG09jOQAAAoQ"]
[Wed Dec 10 08:07:21.010539 2025] [:error] [pid 11268:tid 11347] [client 173.244.55.96:50835] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aTi5ubbpLcj9WqyQndwuIgAAAJc"]
[Wed Dec 10 08:07:26.605143 2025] [:error] [pid 21356:tid 21365] [client 173.244.55.96:38741] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aTi5vqfG7wIA5S25SldoPQAAAsY"]
[Wed Dec 10 08:07:45.785677 2025] [:error] [pid 21327:tid 21341] [client 173.244.55.99:42003] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aTi50duj_E2YnwjFG09jVAAAAow"]
[Wed Dec 10 08:07:51.190438 2025] [:error] [pid 21255:tid 21277] [client 173.244.55.97:26457] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/about.php"] [unique_id "aTi51_Ow-vgCwe7hEWEpwQAAAhM"]
[Wed Dec 10 08:08:03.565080 2025] [:error] [pid 21356:tid 21383] [client 173.244.55.98:53101] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-sup.php"] [unique_id "aTi546fG7wIA5S25SldoTwAAAtg"]
[Wed Dec 10 08:08:08.961489 2025] [:error] [pid 11266:tid 11270] [client 173.244.55.96:21527] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aTi56CXL_Qb0Ip3FW3mzlgAAAAA"]
[Wed Dec 10 08:08:17.532309 2025] [:error] [pid 11266:tid 11271] [client 173.244.55.96:58615] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aTi58SXL_Qb0Ip3FW3mznQAAAAE"]
[Wed Dec 10 08:08:27.482414 2025] [:error] [pid 11266:tid 11284] [client 173.244.55.96:55827] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aTi5-yXL_Qb0Ip3FW3mzqAAAAA4"]
[Wed Dec 10 08:08:32.843386 2025] [:error] [pid 11354:tid 11374] [client 173.244.55.97:20517] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aTi6AO2TFO6mVSqWP8QzVgAAANE"]
[Wed Dec 10 08:08:34.230280 2025] [:error] [pid 11268:tid 11345] [client 173.244.55.98:34151] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aTi6ArbpLcj9WqyQndwudwAAAJU"]
[Wed Dec 10 08:08:44.207313 2025] [:error] [pid 11266:tid 11289] [client 173.244.55.99:44127] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aTi6DCXL_Qb0Ip3FW3mzxgAAABM"]
[Wed Dec 10 08:08:53.524977 2025] [:error] [pid 21356:tid 21382] [client 173.244.55.99:32755] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aTi6FafG7wIA5S25SldocAAAAtc"]
[Wed Dec 10 08:09:01.831962 2025] [:error] [pid 21291:tid 21294] [client 173.244.55.96:20495] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aTi6HZreiUgLUUTTKJdRywAAAkE"]
[Wed Dec 10 08:09:03.226322 2025] [:error] [pid 16597:tid 16646] [client 173.244.55.99:42471] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aTi6H24Hlu0QtpUGkRRVsgAAAdM"]
[Wed Dec 10 08:09:08.579014 2025] [:error] [pid 16596:tid 16621] [client 173.244.55.99:52933] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aTi6JHBe21fHOHH2RQogugAAAZU"]
[Wed Dec 10 08:09:15.140008 2025] [:error] [pid 16596:tid 16622] [client 173.244.55.99:47241] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/install.php"] [unique_id "aTi6K3Be21fHOHH2RQogwQAAAZY"]
[Wed Dec 10 08:09:16.516709 2025] [:error] [pid 11266:tid 11282] [client 173.244.55.97:49227] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aTi6LCXL_Qb0Ip3FW3mzzgAAAAw"]
[Wed Dec 10 08:09:27.918878 2025] [:error] [pid 11266:tid 11273] [client 173.244.55.98:56319] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/category-double.php"] [unique_id "aTi6NyXL_Qb0Ip3FW3mz4QAAAAM"]
[Wed Dec 10 08:09:33.242504 2025] [:error] [pid 21255:tid 21260] [client 173.244.55.99:62073] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/db.php"] [unique_id "aTi6PfOw-vgCwe7hEWEqGQAAAgI"]
[Wed Dec 10 08:09:34.623363 2025] [:error] [pid 16596:tid 16613] [client 173.244.55.96:38073] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/security.php"] [unique_id "aTi6PnBe21fHOHH2RQog0AAAAY0"]
[Wed Dec 10 08:09:39.895633 2025] [:error] [pid 21327:tid 21347] [client 173.244.55.97:48305] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aTi6Q9uj_E2YnwjFG09jiQAAApI"]
[Wed Dec 10 08:09:43.627875 2025] [:error] [pid 21255:tid 21261] [client 173.244.55.98:35989] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aTi6R_Ow-vgCwe7hEWEqIwAAAgM"]
[Wed Dec 10 08:09:53.324972 2025] [:error] [pid 11354:tid 11358] [client 173.244.55.96:49305] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aTi6Ue2TFO6mVSqWP8QzgwAAAME"]
[Wed Dec 10 08:09:58.551624 2025] [:error] [pid 16596:tid 16609] [client 173.244.55.99:65453] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aTi6VnBe21fHOHH2RQog7gAAAYk"]
[Wed Dec 10 08:10:04.121702 2025] [:error] [pid 11266:tid 11293] [client 173.244.55.96:24137] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aTi6XCXL_Qb0Ip3FW3mz_QAAABc"]
[Wed Dec 10 08:10:07.865160 2025] [:error] [pid 16597:tid 16630] [client 173.244.55.96:35771] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/as.php"] [unique_id "aTi6X24Hlu0QtpUGkRRVxwAAAcM"]
[Wed Dec 10 08:10:11.539845 2025] [:error] [pid 16597:tid 16634] [client 173.244.55.98:30131] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aTi6Y24Hlu0QtpUGkRRVyQAAAcc"]
[Wed Dec 10 08:10:12.924364 2025] [:error] [pid 11268:tid 11346] [client 173.244.55.97:29597] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/install.php"] [unique_id "aTi6ZLbpLcj9WqyQndwupwAAAJY"]
[Wed Dec 10 08:10:14.312741 2025] [:error] [pid 21255:tid 21271] [client 173.244.55.99:53933] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/db.php"] [unique_id "aTi6ZvOw-vgCwe7hEWEqTQAAAg0"]
[Wed Dec 10 08:10:25.538090 2025] [:error] [pid 11266:tid 11292] [client 173.244.55.99:62905] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aTi6cSXL_Qb0Ip3FW3m0GAAAABY"]
[Wed Dec 10 08:10:32.354654 2025] [:error] [pid 16596:tid 16600] [client 173.244.55.98:49559] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rk2.php"] [unique_id "aTi6eHBe21fHOHH2RQohBgAAAYA"]
[Wed Dec 10 08:10:38.897620 2025] [:error] [pid 16566:tid 16570] [client 173.244.55.97:49021] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/past.php"] [unique_id "aTi6fiEgzB1153EFuAbgmQAAAUI"]
[Wed Dec 10 08:10:45.767839 2025] [:error] [pid 11266:tid 11273] [client 173.244.55.97:50317] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/edit-tags.php"] [unique_id "aTi6hSXL_Qb0Ip3FW3m0JAAAAAM"]
[Wed Dec 10 08:10:56.903654 2025] [:error] [pid 21327:tid 21350] [client 173.244.55.97:58695] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aTi6kNuj_E2YnwjFG09jtgAAApU"]
[Wed Dec 10 08:11:00.514947 2025] [:error] [pid 16596:tid 16607] [client 173.244.55.96:36479] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aTi6lHBe21fHOHH2RQohGgAAAYc"]
[Wed Dec 10 08:11:04.172750 2025] [:error] [pid 16596:tid 16613] [client 173.244.55.97:59465] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aTi6mHBe21fHOHH2RQohOAAAAY0"]
[Wed Dec 10 08:11:09.478909 2025] [:error] [pid 16566:tid 16578] [client 173.244.55.97:42269] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aTi6nSEgzB1153EFuAbgpwAAAUo"]
[Wed Dec 10 08:11:23.969095 2025] [:error] [pid 21255:tid 21273] [client 173.244.55.96:42029] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aTi6q_Ow-vgCwe7hEWEqnwAAAg8"]
[Wed Dec 10 08:11:25.358084 2025] [:error] [pid 16596:tid 16613] [client 173.244.55.99:42725] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aTi6rXBe21fHOHH2RQohUQAAAY0"]
[Wed Dec 10 08:11:31.891175 2025] [:error] [pid 16597:tid 16643] [client 173.244.55.97:35843] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aTi6s24Hlu0QtpUGkRRV-QAAAdA"]
[Wed Dec 10 08:11:33.612657 2025] [:error] [pid 21356:tid 21369] [client 173.244.55.97:23459] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aTi6tafG7wIA5S25SldosAAAAso"]
[Wed Dec 10 08:11:38.927301 2025] [:error] [pid 21255:tid 21282] [client 173.244.55.98:25609] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aTi6uvOw-vgCwe7hEWEqsgAAAhg"]
[Wed Dec 10 08:11:40.316854 2025] [:error] [pid 21255:tid 21279] [client 173.244.55.98:42479] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ms-file.php"] [unique_id "aTi6vPOw-vgCwe7hEWEqtwAAAhU"]
[Wed Dec 10 08:11:41.700985 2025] [:error] [pid 21255:tid 21262] [client 173.244.55.99:44879] [client 173.244.55.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aTi6vfOw-vgCwe7hEWEquQAAAgQ"]
[Wed Dec 10 08:11:41.705014 2025] [proxy_fcgi:error] [pid 21255:tid 21262] [client 173.244.55.99:44879] AH01071: Got error 'Primary script unknown'
[Wed Dec 10 08:11:42.440735 2025] [:error] [pid 21255:tid 21282] [client 173.244.55.99:44879] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/av.php"] [unique_id "aTi6vvOw-vgCwe7hEWEqvQAAAhg"]
[Wed Dec 10 08:11:49.089340 2025] [:error] [pid 16596:tid 16621] [client 173.244.55.99:26555] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aTi6xXBe21fHOHH2RQohbwAAAZU"]
[Wed Dec 10 08:11:50.466047 2025] [:error] [pid 11266:tid 11273] [client 173.244.55.98:27035] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/network.php"] [unique_id "aTi6xiXL_Qb0Ip3FW3m0UAAAAAM"]
[Wed Dec 10 08:12:03.498910 2025] [:error] [pid 16597:tid 16649] [client 173.244.55.98:49885] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aTi6024Hlu0QtpUGkRRWFQAAAdY"]
[Wed Dec 10 08:12:04.880104 2025] [:error] [pid 21327:tid 21347] [client 173.244.55.99:34675] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/item.php"] [unique_id "aTi61Nuj_E2YnwjFG09j6gAAApI"]
[Wed Dec 10 08:12:08.925128 2025] [:error] [pid 21356:tid 21382] [client 173.244.55.98:57115] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aTi62KfG7wIA5S25SldoygAAAtc"]
[Wed Dec 10 08:12:10.313719 2025] [:error] [pid 16597:tid 16629] [client 173.244.55.97:22773] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/install.php"] [unique_id "aTi62m4Hlu0QtpUGkRRWGgAAAcI"]
[Wed Dec 10 08:12:11.709282 2025] [proxy_fcgi:error] [pid 21291:tid 21313] [client 173.244.55.97:64053] AH01071: Got error 'Primary script unknown'
[Wed Dec 10 08:12:12.400426 2025] [:error] [pid 21291:tid 21309] [client 173.244.55.97:64053] [client 173.244.55.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.97, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aTi63JreiUgLUUTTKJdSMwAAAlA"]
[Wed Dec 10 08:12:16.447875 2025] [:error] [pid 21291:tid 21298] [client 173.244.55.97:64053] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aTi64JreiUgLUUTTKJdSUQAAAkU"]
[Wed Dec 10 08:12:24.644434 2025] [:error] [pid 16566:tid 16592] [client 173.244.55.96:52103] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aTi66CEgzB1153EFuAbg7gAAAVg"]
[Wed Dec 10 08:12:28.317266 2025] [:error] [pid 16566:tid 16578] [client 173.244.55.99:37073] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aTi67CEgzB1153EFuAbg8wAAAUo"]
[Wed Dec 10 08:12:29.703511 2025] [:error] [pid 11354:tid 11360] [client 173.244.55.98:61939] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aTi67e2TFO6mVSqWP8Qz2wAAAMM"]
[Wed Dec 10 08:12:36.749167 2025] [:error] [pid 16596:tid 16605] [client 173.244.55.99:54669] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aTi69HBe21fHOHH2RQohrwAAAYU"]
[Wed Dec 10 08:12:42.219614 2025] [:error] [pid 11266:tid 11286] [client 173.244.55.99:28397] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "aTi6-iXL_Qb0Ip3FW3m0dAAAABA"]
[Wed Dec 10 08:12:50.807676 2025] [:error] [pid 11354:tid 11380] [client 173.244.55.96:58477] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aTi7Au2TFO6mVSqWP8Qz9gAAANc"]
[Wed Dec 10 08:12:52.187424 2025] [:error] [pid 21327:tid 21332] [client 173.244.55.96:49493] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bypass.php"] [unique_id "aTi7BNuj_E2YnwjFG09kPAAAAoM"]
[Wed Dec 10 08:12:55.817106 2025] [:error] [pid 11268:tid 11330] [client 173.244.55.97:38501] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/count.php"] [unique_id "aTi7B7bpLcj9WqyQndwvJgAAAIY"]
[Wed Dec 10 08:13:07.410437 2025] [:error] [pid 16596:tid 16618] [client 173.244.55.97:47071] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aTi7E3Be21fHOHH2RQoh0AAAAZI"]
[Wed Dec 10 08:13:12.722719 2025] [:error] [pid 21255:tid 21266] [client 173.244.55.99:32187] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "expressinteriors.com"] [uri "/images/stories/themes.php"] [unique_id "aTi7GPOw-vgCwe7hEWErHgAAAgg"]
[Wed Dec 10 08:13:13.416608 2025] [:error] [pid 21255:tid 21261] [client 173.244.55.99:32187] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aTi7GfOw-vgCwe7hEWErHwAAAgM"]
[Wed Dec 10 08:13:18.647647 2025] [:error] [pid 16596:tid 16611] [client 173.244.55.99:42951] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aTi7HnBe21fHOHH2RQoh2QAAAYs"]
[Wed Dec 10 08:13:20.041976 2025] [:error] [pid 11354:tid 11363] [client 173.244.55.98:36257] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/vars-soap.php"] [unique_id "aTi7IO2TFO6mVSqWP8Q0AwAAAMY"]
[Wed Dec 10 08:13:32.958275 2025] [:error] [pid 16597:tid 16628] [client 173.244.55.97:48665] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aTi7LG4Hlu0QtpUGkRRWVgAAAcE"]
[Wed Dec 10 08:13:38.241025 2025] [:error] [pid 21356:tid 21382] [client 173.244.55.97:44377] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aTi7MqfG7wIA5S25Sldo9gAAAtc"]
[Wed Dec 10 08:13:41.879945 2025] [:error] [pid 11268:tid 11335] [client 173.244.55.99:60457] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aTi7NbbpLcj9WqyQndwvSwAAAIs"]
[Wed Dec 10 08:13:52.190770 2025] [:error] [pid 11354:tid 11356] [client 173.244.55.98:61995] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aTi7QO2TFO6mVSqWP8Q0HwAAAMA"]
[Wed Dec 10 08:13:55.860604 2025] [:error] [pid 16597:tid 16635] [client 173.244.55.97:33759] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/colour.php"] [unique_id "aTi7Q24Hlu0QtpUGkRRWXQAAAcg"]
[Wed Dec 10 08:13:59.499566 2025] [:error] [pid 11266:tid 11292] [client 173.244.55.96:56931] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aTi7RyXL_Qb0Ip3FW3m0xwAAABY"]
[Wed Dec 10 08:14:00.893466 2025] [:error] [pid 21356:tid 21382] [client 173.244.55.97:24139] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/include.php"] [unique_id "aTi7SKfG7wIA5S25Sldo_wAAAtc"]
[Wed Dec 10 08:14:06.365124 2025] [:error] [pid 21291:tid 21313] [client 173.244.55.98:24031] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aTi7TpreiUgLUUTTKJdSfwAAAlQ"]
[Wed Dec 10 08:14:14.819237 2025] [:error] [pid 16566:tid 16571] [client 173.244.55.99:53795] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aTi7ViEgzB1153EFuAbhNQAAAUM"]
[Wed Dec 10 08:14:16.203214 2025] [:error] [pid 21291:tid 21309] [client 173.244.55.98:24479] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about5.php"] [unique_id "aTi7WJreiUgLUUTTKJdSgwAAAlA"]
[Wed Dec 10 08:14:25.889120 2025] [:error] [pid 21356:tid 21364] [client 173.244.55.98:62735] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/db.php"] [unique_id "aTi7YafG7wIA5S25SldpDgAAAsU"]
[Wed Dec 10 08:14:31.351465 2025] [:error] [pid 21327:tid 21343] [client 173.244.55.96:34099] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aTi7Z9uj_E2YnwjFG09kZAAAAo4"]
[Wed Dec 10 08:14:38.433667 2025] [:error] [pid 16566:tid 16587] [client 173.244.55.96:40441] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aTi7biEgzB1153EFuAbhQwAAAVM"]
[Wed Dec 10 08:14:39.817349 2025] [:error] [pid 21327:tid 21350] [client 173.244.55.98:58303] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aTi7b9uj_E2YnwjFG09kaAAAApU"]
[Wed Dec 10 08:14:43.497409 2025] [:error] [pid 16597:tid 16644] [client 173.244.55.96:26609] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aTi7c24Hlu0QtpUGkRRWtQAAAdE"]
[Wed Dec 10 08:14:48.857411 2025] [:error] [pid 11266:tid 11278] [client 173.244.55.98:36583] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aTi7eCXL_Qb0Ip3FW3m1JgAAAAg"]
[Wed Dec 10 08:14:54.186468 2025] [:error] [pid 11268:tid 11344] [client 173.244.55.98:32623] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aTi7frbpLcj9WqyQndwvdwAAAJQ"]
[Wed Dec 10 08:14:55.568815 2025] [:error] [pid 21255:tid 21281] [client 173.244.55.99:41859] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aTi7f_Ow-vgCwe7hEWErggAAAhc"]
[Wed Dec 10 08:14:59.335607 2025] [:error] [pid 11266:tid 11283] [client 173.244.55.97:24969] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aTi7gyXL_Qb0Ip3FW3m1MQAAAA0"]
[Wed Dec 10 08:15:00.720939 2025] [:error] [pid 21356:tid 21372] [client 173.244.55.99:42693] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/simi.php"] [unique_id "aTi7hKfG7wIA5S25SldpHwAAAs0"]
[Wed Dec 10 08:15:06.244099 2025] [:error] [pid 21291:tid 21293] [client 173.244.55.97:21321] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aTi7ipreiUgLUUTTKJdSmAAAAkA"]
[Wed Dec 10 08:15:10.741529 2025] [:error] [pid 21255:tid 21262] [client 173.244.55.97:25355] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aTi7jvOw-vgCwe7hEWErnwAAAgQ"]
[Wed Dec 10 08:15:12.139621 2025] [:error] [pid 21291:tid 21300] [client 173.244.55.98:62427] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aTi7kJreiUgLUUTTKJdSowAAAkc"]
[Wed Dec 10 08:15:15.010098 2025] [:error] [pid 16596:tid 16606] [client 173.244.55.99:30865] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aTi7k3Be21fHOHH2RQoiGgAAAYY"]
[Wed Dec 10 08:15:22.096360 2025] [:error] [pid 11354:tid 11362] [client 173.244.55.98:51055] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aTi7mu2TFO6mVSqWP8Q0YAAAAMU"]
[Wed Dec 10 08:15:27.456566 2025] [:error] [pid 11268:tid 11347] [client 173.244.55.97:43853] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aTi7n7bpLcj9WqyQndwvmQAAAJc"]
[Wed Dec 10 08:15:31.110502 2025] [:error] [pid 16596:tid 16618] [client 173.244.55.97:45613] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aTi7o3Be21fHOHH2RQoiJgAAAZI"]
[Wed Dec 10 08:15:32.488533 2025] [proxy_fcgi:error] [pid 21327:tid 21343] [client 173.244.55.98:27557] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_locale() in /home/expressi/public_html/wp-admin/includes/admin.php:16\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-admin/includes/admin.php on line 16'
[Wed Dec 10 08:15:33.864436 2025] [:error] [pid 16596:tid 16623] [client 173.244.55.98:31759] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aTi7pXBe21fHOHH2RQoiKAAAAZc"]
[Wed Dec 10 08:15:46.117238 2025] [:error] [pid 16596:tid 16601] [client 173.244.55.98:63721] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/plugin.php"] [unique_id "aTi7snBe21fHOHH2RQoiNwAAAYE"]
[Wed Dec 10 08:15:47.508595 2025] [:error] [pid 16596:tid 16616] [client 173.244.55.96:63595] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aTi7s3Be21fHOHH2RQoiOAAAAZA"]
[Wed Dec 10 08:15:52.700002 2025] [:error] [pid 21327:tid 21332] [client 173.244.55.98:61071] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aTi7uNuj_E2YnwjFG09kjQAAAoM"]
[Wed Dec 10 08:16:00.640154 2025] [:error] [pid 11266:tid 11279] [client 173.244.55.99:27267] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aTi7wCXL_Qb0Ip3FW3m1VgAAAAk"]
[Wed Dec 10 08:16:05.926341 2025] [:error] [pid 21356:tid 21382] [client 173.244.55.96:28641] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aTi7xafG7wIA5S25SldpPAAAAtc"]
[Wed Dec 10 08:16:12.316312 2025] [:error] [pid 11354:tid 11379] [client 173.244.55.98:43519] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aTi7zO2TFO6mVSqWP8Q0cgAAANY"]
[Wed Dec 10 08:16:15.915442 2025] [:error] [pid 16596:tid 16603] [client 173.244.55.99:48737] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aTi7z3Be21fHOHH2RQoiTQAAAYM"]
[Wed Dec 10 08:16:19.529451 2025] [:error] [pid 11266:tid 11281] [client 173.244.55.98:32505] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aTi70yXL_Qb0Ip3FW3m1WwAAAAs"]
[Wed Dec 10 08:16:28.068123 2025] [:error] [pid 16596:tid 16621] [client 173.244.55.96:53033] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aTi73HBe21fHOHH2RQoiWAAAAZU"]
[Wed Dec 10 08:16:34.607898 2025] [:error] [pid 11266:tid 11288] [client 173.244.55.96:55159] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aTi74iXL_Qb0Ip3FW3m1ZAAAABI"]
[Wed Dec 10 08:16:35.986200 2025] [proxy_fcgi:error] [pid 21356:tid 21361] [client 173.244.55.99:64563] AH01071: Got error 'Primary script unknown'
[Wed Dec 10 08:16:36.689655 2025] [:error] [pid 21356:tid 21383] [client 173.244.55.99:64563] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aTi75KfG7wIA5S25SldpRAAAAtg"]
[Wed Dec 10 08:16:38.074961 2025] [:error] [pid 11266:tid 11272] [client 173.244.55.99:31011] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aTi75iXL_Qb0Ip3FW3m1ZgAAAAI"]
[Wed Dec 10 08:16:43.386776 2025] [:error] [pid 11268:tid 11348] [client 173.244.55.99:44575] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aTi767bpLcj9WqyQndwv-AAAAJg"]
[Wed Dec 10 08:16:44.774869 2025] [:error] [pid 11268:tid 11330] [client 173.244.55.96:53843] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aTi77LbpLcj9WqyQndwv_wAAAIY"]
[Wed Dec 10 08:16:55.930961 2025] [:error] [pid 16596:tid 16623] [client 173.244.55.96:46605] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-2019.php"] [unique_id "aTi793Be21fHOHH2RQoiZgAAAZc"]
[Wed Dec 10 08:16:57.317584 2025] [:error] [pid 16566:tid 16588] [client 173.244.55.97:25799] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aTi7-SEgzB1153EFuAbhfgAAAVQ"]
[Wed Dec 10 08:17:00.992757 2025] [:error] [pid 16596:tid 16622] [client 173.244.55.98:32053] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/log.php"] [unique_id "aTi7_HBe21fHOHH2RQoiaQAAAZY"]
[Wed Dec 10 08:17:02.387690 2025] [:error] [pid 16597:tid 16648] [client 173.244.55.98:58727] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aTi7_m4Hlu0QtpUGkRRW8wAAAdU"]
[Wed Dec 10 08:17:03.786381 2025] [:error] [pid 11266:tid 11282] [client 173.244.55.96:23403] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aTi7_yXL_Qb0Ip3FW3m1cAAAAAw"]
[Wed Dec 10 08:17:05.164714 2025] [:error] [pid 21291:tid 21296] [client 173.244.55.96:37221] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/aw.php"] [unique_id "aTi8AZreiUgLUUTTKJdSzAAAAkM"]
[Wed Dec 10 08:17:13.565517 2025] [:error] [pid 21327:tid 21330] [client 173.244.55.96:36059] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/db.php"] [unique_id "aTi8Cduj_E2YnwjFG09kqQAAAoE"]
[Wed Dec 10 08:17:14.943004 2025] [:error] [pid 11354:tid 11356] [client 173.244.55.96:27771] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/install.php"] [unique_id "aTi8Cu2TFO6mVSqWP8Q0iQAAAMA"]
[Wed Dec 10 08:17:19.803251 2025] [:error] [pid 11354:tid 11376] [client 173.244.55.99:59553] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aTi8D-2TFO6mVSqWP8Q0jAAAANM"]
[Wed Dec 10 08:17:21.188648 2025] [:error] [pid 21291:tid 21315] [client 173.244.55.99:42797] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aTi8EZreiUgLUUTTKJdSzgAAAlY"]
[Wed Dec 10 08:17:26.465135 2025] [:error] [pid 11354:tid 11367] [client 173.244.55.98:64297] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/template-less.php"] [unique_id "aTi8Fu2TFO6mVSqWP8Q0kAAAAMo"]
[Wed Dec 10 08:17:27.840354 2025] [:error] [pid 16566:tid 16574] [client 173.244.55.97:36007] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aTi8FyEgzB1153EFuAbhnAAAAUY"]
[Wed Dec 10 08:17:42.463241 2025] [:error] [pid 21255:tid 21269] [client 173.244.55.98:32879] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/min.php"] [unique_id "aTi8JvOw-vgCwe7hEWEsDAAAAgs"]
[Wed Dec 10 08:17:43.842112 2025] [:error] [pid 21255:tid 21279] [client 173.244.55.99:25799] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aTi8J_Ow-vgCwe7hEWEsDgAAAhU"]
[Wed Dec 10 08:17:49.089056 2025] [:error] [pid 16566:tid 16589] [client 173.244.55.97:28623] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/file.php"] [unique_id "aTi8LSEgzB1153EFuAbhqgAAAVU"]
[Wed Dec 10 08:17:52.691718 2025] [:error] [pid 21255:tid 21270] [client 173.244.55.96:20725] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aTi8MPOw-vgCwe7hEWEsFAAAAgw"]
[Wed Dec 10 08:17:56.314010 2025] [:error] [pid 21291:tid 21317] [client 173.244.55.98:25917] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/load.php"] [unique_id "aTi8NJreiUgLUUTTKJdS2wAAAlg"]
[Wed Dec 10 08:17:57.705510 2025] [:error] [pid 16597:tid 16637] [client 173.244.55.98:35817] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aTi8NW4Hlu0QtpUGkRRXCAAAAco"]
[Wed Dec 10 08:17:59.091205 2025] [:error] [pid 11268:tid 11348] [client 173.244.55.97:65221] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aTi8N7bpLcj9WqyQndwweAAAAJg"]
[Wed Dec 10 08:18:05.891835 2025] [:error] [pid 21327:tid 21343] [client 173.244.55.98:54281] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aTi8Pduj_E2YnwjFG09kuwAAAo4"]
[Wed Dec 10 08:18:09.586041 2025] [:error] [pid 11266:tid 11278] [client 173.244.55.99:51309] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aTi8QSXL_Qb0Ip3FW3m1ugAAAAg"]
[Wed Dec 10 08:18:16.462450 2025] [:error] [pid 21255:tid 21274] [client 173.244.55.99:47443] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aTi8SPOw-vgCwe7hEWEsIAAAAhA"]
[Wed Dec 10 08:18:17.847828 2025] [:error] [pid 11268:tid 11337] [client 173.244.55.98:57017] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aTi8SbbpLcj9WqyQndwwfwAAAI0"]
[Wed Dec 10 08:18:21.476692 2025] [:error] [pid 21356:tid 21383] [client 173.244.55.98:49489] [client 173.244.55.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aTi8TafG7wIA5S25SldpeAAAAtg"]
[Wed Dec 10 08:18:37.245049 2025] [:error] [pid 21291:tid 21298] [client 173.244.55.99:26283] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/system.php"] [unique_id "aTi8XZreiUgLUUTTKJdS7AAAAkU"]
[Wed Dec 10 08:18:39.902969 2025] [:error] [pid 16597:tid 16648] [client 173.244.55.96:27367] [client 173.244.55.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aTi8X24Hlu0QtpUGkRRXFQAAAdU"]
[Wed Dec 10 08:18:45.160698 2025] [:error] [pid 21291:tid 21299] [client 173.244.55.97:54527] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aTi8ZZreiUgLUUTTKJdS8AAAAkY"]
[Wed Dec 10 08:18:46.547658 2025] [:error] [pid 21255:tid 21281] [client 173.244.55.99:44775] [client 173.244.55.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aTi8ZvOw-vgCwe7hEWEsMgAAAhc"]
[Wed Dec 10 08:18:47.939741 2025] [:error] [pid 16597:tid 16650] [client 173.244.55.97:39345] [client 173.244.55.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aTi8Z24Hlu0QtpUGkRRXGAAAAdc"]
[Wed Dec 10 08:18:51.573987 2025] [autoindex:error] [pid 21356:tid 21370] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:18:52.283232 2025] [autoindex:error] [pid 21356:tid 21381] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:18:52.980504 2025] [autoindex:error] [pid 21356:tid 21368] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:18:53.683751 2025] [autoindex:error] [pid 21356:tid 21359] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:18:55.974697 2025] [autoindex:error] [pid 21356:tid 21371] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:18:56.672368 2025] [autoindex:error] [pid 21356:tid 21379] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:18:57.370842 2025] [autoindex:error] [pid 21356:tid 21380] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:18:58.072946 2025] [autoindex:error] [pid 21356:tid 21361] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:18:58.772577 2025] [autoindex:error] [pid 21356:tid 21362] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:18:59.472120 2025] [autoindex:error] [pid 21356:tid 21364] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:19:00.875751 2025] [autoindex:error] [pid 21356:tid 21368] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:19:02.864792 2025] [autoindex:error] [pid 21356:tid 21380] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:19:03.561950 2025] [autoindex:error] [pid 21356:tid 21361] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:19:07.359641 2025] [autoindex:error] [pid 21356:tid 21365] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:19:09.179356 2025] [autoindex:error] [pid 21356:tid 21362] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:19:09.878822 2025] [autoindex:error] [pid 21356:tid 21364] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:19:10.576656 2025] [autoindex:error] [pid 21356:tid 21363] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:19:12.793000 2025] [autoindex:error] [pid 21356:tid 21364] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:19:13.492353 2025] [autoindex:error] [pid 21356:tid 21363] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:19:15.724044 2025] [autoindex:error] [pid 21356:tid 21383] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:19:19.515519 2025] [autoindex:error] [pid 21356:tid 21379] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:19:20.216736 2025] [autoindex:error] [pid 21356:tid 21359] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:19:20.914868 2025] [autoindex:error] [pid 21356:tid 21382] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:19:26.045065 2025] [autoindex:error] [pid 21356:tid 21365] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:19:31.293805 2025] [autoindex:error] [pid 21356:tid 21383] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:19:33.511386 2025] [autoindex:error] [pid 21356:tid 21375] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:19:34.219718 2025] [autoindex:error] [pid 21356:tid 21368] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:19:36.314566 2025] [autoindex:error] [pid 21356:tid 21380] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:19:37.013505 2025] [autoindex:error] [pid 21356:tid 21369] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:19:37.713654 2025] [autoindex:error] [pid 21356:tid 21359] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:19:44.537595 2025] [autoindex:error] [pid 21356:tid 21365] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:20:27.161805 2025] [autoindex:error] [pid 21356:tid 21373] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:20:27.864227 2025] [autoindex:error] [pid 21356:tid 21367] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:20:28.565143 2025] [autoindex:error] [pid 21356:tid 21377] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:20:29.262973 2025] [autoindex:error] [pid 21356:tid 21370] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:20:32.968491 2025] [autoindex:error] [pid 21356:tid 21360] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:20:33.673462 2025] [autoindex:error] [pid 21356:tid 21383] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:20:35.897347 2025] [autoindex:error] [pid 21356:tid 21371] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:20:38.070666 2025] [autoindex:error] [pid 21356:tid 21359] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:20:38.771932 2025] [autoindex:error] [pid 21356:tid 21361] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:20:39.468791 2025] [autoindex:error] [pid 21356:tid 21362] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:20:41.681722 2025] [autoindex:error] [pid 21356:tid 21365] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:20:42.378892 2025] [autoindex:error] [pid 21356:tid 21366] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:20:43.076623 2025] [autoindex:error] [pid 21356:tid 21372] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:20:43.774812 2025] [autoindex:error] [pid 21356:tid 21374] [client 173.244.55.99:63821] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:21:22.080755 2025] [autoindex:error] [pid 21255:tid 21276] [client 173.244.55.98:59493] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:21:40.119911 2025] [autoindex:error] [pid 21255:tid 21270] [client 173.244.55.98:59493] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:21:47.761050 2025] [autoindex:error] [pid 21255:tid 21265] [client 173.244.55.98:59493] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:21:48.458189 2025] [autoindex:error] [pid 21255:tid 21275] [client 173.244.55.98:59493] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:21:55.192287 2025] [autoindex:error] [pid 21255:tid 21273] [client 173.244.55.98:59493] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:21:55.889928 2025] [autoindex:error] [pid 21255:tid 21264] [client 173.244.55.98:59493] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:21:56.588493 2025] [autoindex:error] [pid 21255:tid 21279] [client 173.244.55.98:59493] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:21:57.293646 2025] [autoindex:error] [pid 21255:tid 21270] [client 173.244.55.98:59493] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:21:57.990344 2025] [autoindex:error] [pid 21255:tid 21274] [client 173.244.55.98:59493] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:21:58.690305 2025] [autoindex:error] [pid 21255:tid 21271] [client 173.244.55.98:59493] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:21:59.387448 2025] [autoindex:error] [pid 21255:tid 21278] [client 173.244.55.98:59493] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:22:00.087968 2025] [autoindex:error] [pid 21255:tid 21276] [client 173.244.55.98:59493] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:22:00.786567 2025] [autoindex:error] [pid 21255:tid 21280] [client 173.244.55.98:59493] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:22:29.823711 2025] [autoindex:error] [pid 21255:tid 21269] [client 173.244.55.98:59493] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 10 08:22:52.204321 2025] [:error] [pid 21255:tid 21270] [client 173.244.55.98:59493] [client 173.244.55.98] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "173.244.55.96_6ff433984ead67b368dec33e0e3e699096ee01fa"): Internal error (specific information not available) [hostname "expressinteriors.com"] [uri "/index.php"] [unique_id "aTi9WPOw-vgCwe7hEWEtZwAAAgw"]
[Wed Dec 10 08:42:59.549754 2025] [:error] [pid 11354:tid 11363] [client 123.187.240.242:57198] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aTjCE-2TFO6mVSqWP8Q5vAAAAMY"]
[Wed Dec 10 12:50:48.381135 2025] [:error] [pid 16596:tid 16608] [client 46.224.43.216:43800] [client 46.224.43.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.224.43.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTj8KHBe21fHOHH2RQp0gQAAAYg"]
[Wed Dec 10 12:50:50.564009 2025] [:error] [pid 16596:tid 16616] [client 46.224.43.216:43800] [client 46.224.43.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.224.43.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTj8KnBe21fHOHH2RQp0hQAAAZA"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 10 14:38:31.012007 2025] [:error] [pid 11268:tid 11335] [client 121.229.185.160:60115] [client 121.229.185.160] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aTkVZ7bpLcj9WqyQndx5HAAAAIs"]
[Wed Dec 10 19:04:26.334267 2025] [:error] [pid 49095:tid 49108] [client 37.140.223.188:58171] [client 37.140.223.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTlTusorr4Jt2Tfx_EbLLgAAAUs"]
[Wed Dec 10 19:43:35.245630 2025] [:error] [pid 37062:tid 37071] [client 37.140.223.92:31667] [client 37.140.223.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTlc5zB0I62HCw8Z5BRNZwAAAAc"]
[Wed Dec 10 19:43:35.247345 2025] [:error] [pid 37062:tid 37071] [client 37.140.223.92:31667] [client 37.140.223.92] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||expressinteriors.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /wp-login.php"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTlc5zB0I62HCw8Z5BRNZwAAAAc"]
[Wed Dec 10 20:36:01.277323 2025] [:error] [pid 37062:tid 37080] [client 137.184.0.117:65152] [client 137.184.0.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.0.117, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTlpMTB0I62HCw8Z5BRa2QAAABA"]
[Wed Dec 10 20:36:02.593261 2025] [:error] [pid 36976:tid 37014] [client 137.184.0.117:65270] [client 137.184.0.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.184.0.117, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTlpMiSpHW5KVaY9tJmn5gAAAMc"]
[Wed Dec 10 20:40:52.859775 2025] [:error] [pid 36975:tid 36990] [client 182.42.105.85:57037] [client 182.42.105.85] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aTlqVN_ZNQ3zMmb38BFsFQAAAIo"]
[Wed Dec 10 21:17:50.772406 2025] [:error] [pid 37062:tid 37074] [client 77.90.185.12:51227] [client 77.90.185.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTly_jB0I62HCw8Z5BRlvQAAAAo"], referer: https://www.google.com/search?q=wordpress
[Wed Dec 10 21:18:01.995942 2025] [:error] [pid 37062:tid 37078] [client 77.90.185.12:51227] [client 77.90.185.12] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aTlzCTB0I62HCw8Z5BRl1QAAAA4"], referer: https://www.google.com/
[Wed Dec 10 21:18:03.397049 2025] [:error] [pid 37062:tid 37085] [client 77.90.185.12:51227] [client 77.90.185.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTlzCzB0I62HCw8Z5BRl2gAAABU"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 10 21:18:05.341925 2025] [:error] [pid 37062:tid 37065] [client 77.90.185.12:51227] [client 77.90.185.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTlzDTB0I62HCw8Z5BRl3gAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 10 21:18:06.210912 2025] [:error] [pid 37062:tid 37084] [client 77.90.185.12:51227] [client 77.90.185.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTlzDjB0I62HCw8Z5BRl4AAAABQ"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 10 21:18:07.944485 2025] [:error] [pid 37062:tid 37078] [client 77.90.185.12:51227] [client 77.90.185.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTlzDzB0I62HCw8Z5BRl4gAAAA4"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 10 21:18:08.809713 2025] [:error] [pid 37062:tid 37071] [client 77.90.185.12:51227] [client 77.90.185.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTlzEDB0I62HCw8Z5BRl5QAAAAc"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 10 21:18:10.522643 2025] [:error] [pid 37062:tid 37070] [client 77.90.185.12:51227] [client 77.90.185.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTlzEjB0I62HCw8Z5BRl6QAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 10 21:18:11.354863 2025] [:error] [pid 37062:tid 37081] [client 77.90.185.12:51227] [client 77.90.185.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTlzEzB0I62HCw8Z5BRl7AAAABE"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 10 21:18:13.070504 2025] [:error] [pid 37062:tid 37084] [client 77.90.185.12:51227] [client 77.90.185.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.90.185.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTlzFTB0I62HCw8Z5BRl7wAAABQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 11 02:00:48.330793 2025] [:error] [pid 10434:tid 10470] [client 34.125.237.15:49678] [client 34.125.237.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.125.237.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTm1UGbAnZFInxx5bO-7xQAAAEM"]
[Thu Dec 11 02:00:51.908987 2025] [:error] [pid 10434:tid 10468] [client 34.125.237.15:49678] [client 34.125.237.15] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aTm1U2bAnZFInxx5bO-7ywAAAEE"]
[Thu Dec 11 02:00:52.067640 2025] [:error] [pid 10434:tid 10483] [client 34.125.237.15:49678] [client 34.125.237.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.125.237.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTm1VGbAnZFInxx5bO-7zAAAAFA"]
[Thu Dec 11 02:00:53.452802 2025] [:error] [pid 27893:tid 27900] [client 34.125.237.15:60938] [client 34.125.237.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.125.237.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTm1VVAm_ScxuQGtQnR1BQAAAIU"]
[Thu Dec 11 02:00:54.785567 2025] [:error] [pid 10433:tid 10450] [client 34.125.237.15:60118] [client 34.125.237.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.125.237.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTm1VmfQ1q-Ic7huYoUDXgAAAM0"]
[Thu Dec 11 02:00:56.277338 2025] [:error] [pid 10434:tid 10490] [client 34.125.237.15:52665] [client 34.125.237.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.125.237.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTm1WGbAnZFInxx5bO-7zgAAAFc"]
[Thu Dec 11 02:00:57.703274 2025] [:error] [pid 27893:tid 27912] [client 34.125.237.15:63814] [client 34.125.237.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.125.237.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTm1WVAm_ScxuQGtQnR1BgAAAJE"]
[Thu Dec 11 02:00:57.703440 2025] [:error] [pid 27893:tid 27912] [client 34.125.237.15:63814] [client 34.125.237.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.125.237.15, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTm1WVAm_ScxuQGtQnR1BgAAAJE"]
[Thu Dec 11 02:20:13.152059 2025] [:error] [pid 10434:tid 10486] [client 34.29.201.104:51345] [client 34.29.201.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.29.201.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTm53WbAnZFInxx5bO_DNgAAAFM"]
[Thu Dec 11 02:20:15.401451 2025] [:error] [pid 10434:tid 10487] [client 34.29.201.104:51345] [client 34.29.201.104] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aTm532bAnZFInxx5bO_DPgAAAFQ"]
[Thu Dec 11 02:20:15.599227 2025] [:error] [pid 10434:tid 10491] [client 34.29.201.104:51345] [client 34.29.201.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.29.201.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTm532bAnZFInxx5bO_DPwAAAFg"]
[Thu Dec 11 02:20:16.973323 2025] [:error] [pid 10520:tid 10529] [client 34.29.201.104:59007] [client 34.29.201.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.29.201.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTm54ENrVZZksrD9M7EpswAAAQc"]
[Thu Dec 11 02:20:18.413505 2025] [:error] [pid 10435:tid 10505] [client 34.29.201.104:53196] [client 34.29.201.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.29.201.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTm54o5HZq66Rpdj2aKM-AAAAAs"]
[Thu Dec 11 02:20:19.832093 2025] [:error] [pid 42065:tid 42089] [client 34.29.201.104:49250] [client 34.29.201.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.29.201.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTm54_kj8kMSvqJobVUWMAAAAVY"]
[Thu Dec 11 02:20:21.212648 2025] [:error] [pid 27893:tid 27898] [client 34.29.201.104:60578] [client 34.29.201.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.29.201.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTm55VAm_ScxuQGtQnR5xQAAAIM"]
[Thu Dec 11 02:20:21.212831 2025] [:error] [pid 27893:tid 27898] [client 34.29.201.104:60578] [client 34.29.201.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.29.201.104, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTm55VAm_ScxuQGtQnR5xQAAAIM"]
[Thu Dec 11 02:24:19.654716 2025] [:error] [pid 27893:tid 27906] [client 92.205.101.169:45320] [client 92.205.101.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.101.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTm601Am_ScxuQGtQnR6TwAAAIs"]
[Thu Dec 11 02:24:24.475911 2025] [:error] [pid 27893:tid 27917] [client 92.205.101.169:45320] [client 92.205.101.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.101.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTm62FAm_ScxuQGtQnR6UQAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 11 02:56:51.602716 2025] [:error] [pid 27893:tid 27908] [client 172.191.197.110:60208] [client 172.191.197.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.191.197.110, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTnCc1Am_ScxuQGtQnR_AwAAAI0"]
[Thu Dec 11 02:56:56.133973 2025] [:error] [pid 27893:tid 27909] [client 172.191.197.110:60208] [client 172.191.197.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.191.197.110, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTnCeFAm_ScxuQGtQnR_BwAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 11 03:29:24.216068 2025] [:error] [pid 10520:tid 10538] [client 68.218.18.4:62569] [client 68.218.18.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.218.18.4, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTnKFENrVZZksrD9M7FAxwAAARA"], referer: https://www.bing.com/
[Thu Dec 11 03:29:25.347830 2025] [autoindex:error] [pid 10435:tid 10508] [client 68.218.18.4:64103] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Thu Dec 11 03:29:25.981005 2025] [autoindex:error] [pid 10435:tid 10495] [client 68.218.18.4:64103] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Thu Dec 11 03:29:26.521982 2025] [autoindex:error] [pid 10435:tid 10504] [client 68.218.18.4:64103] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Thu Dec 11 03:29:27.676580 2025] [autoindex:error] [pid 10435:tid 10515] [client 68.218.18.4:64103] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Thu Dec 11 03:29:28.804747 2025] [:error] [pid 10520:tid 10534] [client 68.218.18.4:62569] [client 68.218.18.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.218.18.4, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTnKGENrVZZksrD9M7FAzAAAAQw"], referer: https://www.google.com/
[Thu Dec 11 03:29:29.346130 2025] [autoindex:error] [pid 10435:tid 10503] [client 68.218.18.4:64103] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Thu Dec 11 03:29:29.896469 2025] [autoindex:error] [pid 10435:tid 10517] [client 68.218.18.4:64103] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Thu Dec 11 03:29:29.921221 2025] [autoindex:error] [pid 10435:tid 10509] [client 68.218.18.4:64103] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Thu Dec 11 03:29:31.083202 2025] [:error] [pid 10520:tid 10523] [client 68.218.18.4:62569] [client 68.218.18.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.218.18.4, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTnKG0NrVZZksrD9M7FAzwAAAQE"], referer: https://www.google.com/
[Thu Dec 11 03:54:56.556492 2025] [:error] [pid 41606:tid 41622] [client 171.111.192.222:47674] [client 171.111.192.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 171.111.192.222, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTnQEIdr0n9zsTz_WYJdwwAAAQ4"]
[Thu Dec 11 03:58:17.489805 2025] [:error] [pid 41205:tid 41253] [client 105.234.174.136:5578] [client 105.234.174.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.234.174.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTnQ2VezGYcsM3x1mMdDRwAAAFE"]
[Thu Dec 11 04:02:58.438866 2025] [:error] [pid 13984:tid 14025] [client 40.85.143.207:10759] [client 40.85.143.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aTnR8uwrRXz2NiDdz_6tfwAAABY"]
[Thu Dec 11 04:03:03.670494 2025] [:error] [pid 13984:tid 14010] [client 40.85.143.207:4481] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dejavu.php"] [unique_id "aTnR9-wrRXz2NiDdz_6thQAAAAc"]
[Thu Dec 11 04:03:04.396349 2025] [:error] [pid 14092:tid 14105] [client 40.85.143.207:7471] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dejavu.php"] [unique_id "aTnR-G1yJs96znfXT9P5fAAAAMo"]
[Thu Dec 11 04:03:04.929864 2025] [:error] [pid 13984:tid 14012] [client 40.85.143.207:1178] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dejavu.php"] [unique_id "aTnR-OwrRXz2NiDdz_6thwAAAAk"]
[Thu Dec 11 04:03:05.582625 2025] [:error] [pid 14092:tid 14108] [client 40.85.143.207:3010] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dejavu.php"] [unique_id "aTnR-W1yJs96znfXT9P5hgAAAM0"]
[Thu Dec 11 04:03:06.754146 2025] [:error] [pid 14092:tid 14110] [client 40.85.143.207:4520] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index.php"] [unique_id "aTnR-m1yJs96znfXT9P5mwAAAM8"]
[Thu Dec 11 04:03:07.480365 2025] [:error] [pid 13986:tid 14066] [client 40.85.143.207:3954] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index.php"] [unique_id "aTnR--HONL35_h3rQ33VmwAAAIk"]
[Thu Dec 11 04:03:07.999286 2025] [:error] [pid 13985:tid 14039] [client 40.85.143.207:4339] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index.php"] [unique_id "aTnR--gR5X0x1Es1SY484wAAAEk"]
[Thu Dec 11 04:03:08.709107 2025] [:error] [pid 14092:tid 14111] [client 40.85.143.207:8215] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index.php"] [unique_id "aTnR_G1yJs96znfXT9P5rwAAANA"]
[Thu Dec 11 04:03:09.230203 2025] [:error] [pid 13986:tid 14072] [client 40.85.143.207:8094] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pepe.php"] [unique_id "aTnR_eHONL35_h3rQ33VpgAAAI8"]
[Thu Dec 11 04:03:09.743889 2025] [:error] [pid 13986:tid 14068] [client 40.85.143.207:14586] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pepe.php"] [unique_id "aTnR_eHONL35_h3rQ33VpwAAAIs"]
[Thu Dec 11 04:03:10.312676 2025] [:error] [pid 13984:tid 14008] [client 40.85.143.207:1173] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pepe.php"] [unique_id "aTnR_uwrRXz2NiDdz_6tkwAAAAU"]
[Thu Dec 11 04:03:11.027975 2025] [:error] [pid 13986:tid 14071] [client 40.85.143.207:13689] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pepe.php"] [unique_id "aTnR_-HONL35_h3rQ33VrQAAAI4"]
[Thu Dec 11 04:03:11.600039 2025] [:error] [pid 14092:tid 14112] [client 40.85.143.207:6371] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/z.php"] [unique_id "aTnR_21yJs96znfXT9P5twAAANE"]
[Thu Dec 11 04:03:12.597971 2025] [:error] [pid 13986:tid 14058] [client 40.85.143.207:4318] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/z.php"] [unique_id "aTnSAOHONL35_h3rQ33VswAAAIE"]
[Thu Dec 11 04:03:13.586260 2025] [:error] [pid 13985:tid 14035] [client 40.85.143.207:14998] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/z.php"] [unique_id "aTnSAegR5X0x1Es1SY488gAAAEU"]
[Thu Dec 11 04:03:14.121903 2025] [:error] [pid 14092:tid 14113] [client 40.85.143.207:6348] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/z.php"] [unique_id "aTnSAm1yJs96znfXT9P5ugAAANI"]
[Thu Dec 11 04:03:14.625721 2025] [:error] [pid 13985:tid 14036] [client 40.85.143.207:8915] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aTnSAugR5X0x1Es1SY489QAAAEY"]
[Thu Dec 11 04:03:15.215199 2025] [:error] [pid 13986:tid 14057] [client 40.85.143.207:1168] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aTnSA-HONL35_h3rQ33VtwAAAIA"]
[Thu Dec 11 04:03:15.725128 2025] [:error] [pid 13985:tid 14047] [client 40.85.143.207:8119] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aTnSA-gR5X0x1Es1SY489wAAAFE"]
[Thu Dec 11 04:03:16.298500 2025] [:error] [pid 13985:tid 14037] [client 40.85.143.207:13695] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aTnSBOgR5X0x1Es1SY48-gAAAEc"]
[Thu Dec 11 04:03:16.828997 2025] [:error] [pid 13986:tid 14058] [client 40.85.143.207:6368] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aTnSBOHONL35_h3rQ33VugAAAIE"]
[Thu Dec 11 04:03:17.457485 2025] [:error] [pid 13986:tid 14072] [client 40.85.143.207:4540] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aTnSBeHONL35_h3rQ33VvwAAAI8"]
[Thu Dec 11 04:03:17.999517 2025] [:error] [pid 13985:tid 14032] [client 40.85.143.207:4811] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aTnSBegR5X0x1Es1SY48_gAAAEI"]
[Thu Dec 11 04:03:18.550122 2025] [:error] [pid 13984:tid 14003] [client 40.85.143.207:4812] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aTnSBuwrRXz2NiDdz_6tpgAAAAA"]
[Thu Dec 11 04:03:19.130533 2025] [:error] [pid 13984:tid 14023] [client 40.85.143.207:4508] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aTnSB-wrRXz2NiDdz_6tqAAAABQ"]
[Thu Dec 11 04:03:19.685598 2025] [:error] [pid 14092:tid 14105] [client 40.85.143.207:15133] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aTnSB21yJs96znfXT9P5wAAAAMo"]
[Thu Dec 11 04:03:20.225746 2025] [:error] [pid 13984:tid 14027] [client 40.85.143.207:4496] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aTnSCOwrRXz2NiDdz_6trgAAABg"]
[Thu Dec 11 04:03:20.750924 2025] [:error] [pid 13984:tid 14019] [client 40.85.143.207:11409] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aTnSCOwrRXz2NiDdz_6tsQAAABA"]
[Thu Dec 11 04:03:21.474367 2025] [:error] [pid 13986:tid 14081] [client 40.85.143.207:4841] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/build.php"] [unique_id "aTnSCeHONL35_h3rQ33VxgAAAJg"]
[Thu Dec 11 04:03:22.287463 2025] [:error] [pid 13984:tid 14005] [client 40.85.143.207:4265] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/build.php"] [unique_id "aTnSCuwrRXz2NiDdz_6ttQAAAAI"]
[Thu Dec 11 04:03:22.993279 2025] [:error] [pid 13985:tid 14045] [client 40.85.143.207:7952] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/build.php"] [unique_id "aTnSCugR5X0x1Es1SY49AgAAAE8"]
[Thu Dec 11 04:03:23.549448 2025] [:error] [pid 13985:tid 14032] [client 40.85.143.207:6399] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/build.php"] [unique_id "aTnSC-gR5X0x1Es1SY49AwAAAEI"]
[Thu Dec 11 04:03:24.361691 2025] [:error] [pid 13984:tid 14017] [client 40.85.143.207:1163] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.php"] [unique_id "aTnSDOwrRXz2NiDdz_6tuAAAAA4"]
[Thu Dec 11 04:03:25.188629 2025] [:error] [pid 13986:tid 14064] [client 40.85.143.207:11408] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.php"] [unique_id "aTnSDeHONL35_h3rQ33VygAAAIc"]
[Thu Dec 11 04:03:26.329927 2025] [:error] [pid 14092:tid 14102] [client 40.85.143.207:4333] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.php"] [unique_id "aTnSDm1yJs96znfXT9P52gAAAMc"]
[Thu Dec 11 04:03:26.858230 2025] [:error] [pid 13985:tid 14037] [client 40.85.143.207:13685] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.php"] [unique_id "aTnSDugR5X0x1Es1SY49DQAAAEc"]
[Thu Dec 11 04:03:27.393330 2025] [:error] [pid 13985:tid 14045] [client 40.85.143.207:15026] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "aTnSD-gR5X0x1Es1SY49EQAAAE8"]
[Thu Dec 11 04:03:27.935496 2025] [:error] [pid 13984:tid 14011] [client 40.85.143.207:11415] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "aTnSD-wrRXz2NiDdz_6tygAAAAg"]
[Thu Dec 11 04:03:29.333694 2025] [:error] [pid 13984:tid 14022] [client 40.85.143.207:8938] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "aTnSEewrRXz2NiDdz_6t1wAAABM"]
[Thu Dec 11 04:03:30.279682 2025] [:error] [pid 13985:tid 14033] [client 40.85.143.207:4139] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "aTnSEugR5X0x1Es1SY49FwAAAEM"]
[Thu Dec 11 04:03:30.952693 2025] [:error] [pid 14092:tid 14102] [client 40.85.143.207:10895] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ot.php"] [unique_id "aTnSEm1yJs96znfXT9P6AgAAAMc"]
[Thu Dec 11 04:03:32.296890 2025] [:error] [pid 14092:tid 14102] [client 40.85.143.207:3157] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ot.php"] [unique_id "aTnSFG1yJs96znfXT9P6FAAAAMc"]
[Thu Dec 11 04:03:32.944163 2025] [:error] [pid 13986:tid 14059] [client 40.85.143.207:12311] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ot.php"] [unique_id "aTnSFOHONL35_h3rQ33V7wAAAII"]
[Thu Dec 11 04:03:33.759097 2025] [:error] [pid 14092:tid 14118] [client 40.85.143.207:7964] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ot.php"] [unique_id "aTnSFW1yJs96znfXT9P6KwAAANc"]
[Thu Dec 11 04:03:34.539317 2025] [:error] [pid 14092:tid 14116] [client 40.85.143.207:7431] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aTnSFm1yJs96znfXT9P6NwAAANU"]
[Thu Dec 11 04:03:35.041374 2025] [:error] [pid 13984:tid 14019] [client 40.85.143.207:12289] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aTnSF-wrRXz2NiDdz_6t-QAAABA"]
[Thu Dec 11 04:03:35.609271 2025] [:error] [pid 13984:tid 14022] [client 40.85.143.207:14025] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aTnSF-wrRXz2NiDdz_6t_AAAABM"]
[Thu Dec 11 04:03:36.294299 2025] [:error] [pid 13985:tid 14031] [client 40.85.143.207:7969] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aTnSGOgR5X0x1Es1SY49HQAAAEE"]
[Thu Dec 11 04:03:36.871231 2025] [:error] [pid 13986:tid 14063] [client 40.85.143.207:4115] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aTnSGOHONL35_h3rQ33WEAAAAIY"]
[Thu Dec 11 04:03:37.373071 2025] [:error] [pid 13986:tid 14059] [client 40.85.143.207:8937] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aTnSGeHONL35_h3rQ33WFQAAAII"]
[Thu Dec 11 04:03:38.551715 2025] [:error] [pid 13985:tid 14041] [client 40.85.143.207:7484] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aTnSGugR5X0x1Es1SY49IQAAAEs"]
[Thu Dec 11 04:03:39.448395 2025] [:error] [pid 13985:tid 14034] [client 40.85.143.207:14055] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aTnSG-gR5X0x1Es1SY49IwAAAEQ"]
[Thu Dec 11 04:03:40.337863 2025] [:error] [pid 13986:tid 14059] [client 40.85.143.207:3484] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aTnSHOHONL35_h3rQ33WKgAAAII"]
[Thu Dec 11 04:03:41.840458 2025] [:error] [pid 14092:tid 14095] [client 40.85.143.207:1314] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aTnSHW1yJs96znfXT9P6iAAAAMA"]
[Thu Dec 11 04:03:43.377692 2025] [:error] [pid 13986:tid 14073] [client 40.85.143.207:7452] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aTnSH-HONL35_h3rQ33WPwAAAJA"]
[Thu Dec 11 04:03:44.526638 2025] [:error] [pid 13986:tid 14067] [client 40.85.143.207:11400] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aTnSIOHONL35_h3rQ33WSQAAAIo"]
[Thu Dec 11 04:03:45.996397 2025] [:error] [pid 14092:tid 14104] [client 40.85.143.207:4251] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aTnSIW1yJs96znfXT9P6xgAAAMk"]
[Thu Dec 11 04:03:46.925377 2025] [:error] [pid 13986:tid 14058] [client 40.85.143.207:1178] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aTnSIuHONL35_h3rQ33WZAAAAIE"]
[Thu Dec 11 04:03:47.661627 2025] [:error] [pid 14092:tid 14107] [client 40.85.143.207:14535] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aTnSI21yJs96znfXT9P62wAAAMw"]
[Thu Dec 11 04:03:48.419170 2025] [:error] [pid 13985:tid 14037] [client 40.85.143.207:1311] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aTnSJOgR5X0x1Es1SY49QwAAAEc"]
[Thu Dec 11 04:03:49.731710 2025] [:error] [pid 14092:tid 14106] [client 40.85.143.207:2976] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aTnSJW1yJs96znfXT9P67AAAAMs"]
[Thu Dec 11 04:03:50.301344 2025] [:error] [pid 14092:tid 14117] [client 40.85.143.207:3026] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aTnSJm1yJs96znfXT9P68wAAANY"]
[Thu Dec 11 04:03:51.116165 2025] [:error] [pid 13985:tid 14042] [client 40.85.143.207:1189] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aTnSJ-gR5X0x1Es1SY49TAAAAEw"]
[Thu Dec 11 04:03:51.805888 2025] [:error] [pid 13986:tid 14061] [client 40.85.143.207:7948] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aTnSJ-HONL35_h3rQ33WhAAAAIQ"]
[Thu Dec 11 04:03:52.423835 2025] [:error] [pid 13986:tid 14060] [client 40.85.143.207:6388] [client 40.85.143.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aTnSKOHONL35_h3rQ33WiwAAAIM"]
[Thu Dec 11 04:03:53.261653 2025] [:error] [pid 14092:tid 14098] [client 40.85.143.207:1338] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aTnSKW1yJs96znfXT9P7DQAAAMM"]
[Thu Dec 11 04:03:54.605848 2025] [:error] [pid 14092:tid 14102] [client 40.85.143.207:3495] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aTnSKm1yJs96znfXT9P7FwAAAMc"]
[Thu Dec 11 04:03:55.253326 2025] [:error] [pid 14092:tid 14105] [client 40.85.143.207:10046] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aTnSK21yJs96znfXT9P7HQAAAMo"]
[Thu Dec 11 04:03:56.177035 2025] [:error] [pid 13985:tid 14048] [client 40.85.143.207:8975] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aTnSLOgR5X0x1Es1SY49UAAAAFI"]
[Thu Dec 11 04:03:56.843529 2025] [:error] [pid 13986:tid 14062] [client 40.85.143.207:3892] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aTnSLOHONL35_h3rQ33WpwAAAIU"]
[Thu Dec 11 04:03:57.454875 2025] [:error] [pid 13984:tid 14016] [client 40.85.143.207:3163] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aTnSLewrRXz2NiDdz_6uYgAAAA0"]
[Thu Dec 11 04:03:58.189820 2025] [:error] [pid 14092:tid 14114] [client 40.85.143.207:3168] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aTnSLm1yJs96znfXT9P7NgAAANM"]
[Thu Dec 11 04:03:59.065923 2025] [:error] [pid 13984:tid 14019] [client 40.85.143.207:6372] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aTnSL-wrRXz2NiDdz_6uYwAAABA"]
[Thu Dec 11 04:03:59.715112 2025] [:error] [pid 13986:tid 14064] [client 40.85.143.207:14031] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "aTnSL-HONL35_h3rQ33WwAAAAIc"]
[Thu Dec 11 04:04:00.518507 2025] [:error] [pid 13985:tid 14052] [client 40.85.143.207:13158] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "aTnSMOgR5X0x1Es1SY49WAAAAFY"]
[Thu Dec 11 04:04:01.391048 2025] [:error] [pid 13986:tid 14070] [client 40.85.143.207:16034] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "aTnSMeHONL35_h3rQ33W1AAAAI0"]
[Thu Dec 11 04:04:13.687619 2025] [:error] [pid 13985:tid 14034] [client 40.85.143.207:3493] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/habhan.php"] [unique_id "aTnSPegR5X0x1Es1SY49oQAAAEQ"]
[Thu Dec 11 04:04:14.191732 2025] [:error] [pid 14092:tid 14098] [client 40.85.143.207:12238] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/habhan.php"] [unique_id "aTnSPm1yJs96znfXT9P7ywAAAMM"]
[Thu Dec 11 04:04:14.953421 2025] [:error] [pid 13984:tid 14023] [client 40.85.143.207:2964] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/habhan.php"] [unique_id "aTnSPuwrRXz2NiDdz_6utgAAABQ"]
[Thu Dec 11 04:04:15.514306 2025] [:error] [pid 13986:tid 14064] [client 40.85.143.207:15842] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/habhan.php"] [unique_id "aTnSP-HONL35_h3rQ33XOgAAAIc"]
[Thu Dec 11 04:04:16.070837 2025] [:error] [pid 13984:tid 14018] [client 40.85.143.207:4723] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mans.php"] [unique_id "aTnSQOwrRXz2NiDdz_6uuAAAAA8"]
[Thu Dec 11 04:04:16.715885 2025] [:error] [pid 13986:tid 14079] [client 40.85.143.207:4107] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mans.php"] [unique_id "aTnSQOHONL35_h3rQ33XSAAAAJY"]
[Thu Dec 11 04:04:17.245814 2025] [:error] [pid 13985:tid 14046] [client 40.85.143.207:1157] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mans.php"] [unique_id "aTnSQegR5X0x1Es1SY49twAAAFA"]
[Thu Dec 11 04:04:18.113375 2025] [:error] [pid 13986:tid 14069] [client 40.85.143.207:11323] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mans.php"] [unique_id "aTnSQuHONL35_h3rQ33XUwAAAIw"]
[Thu Dec 11 04:04:18.803886 2025] [:error] [pid 14092:tid 14112] [client 40.85.143.207:3003] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mah.php"] [unique_id "aTnSQm1yJs96znfXT9P76gAAANE"]
[Thu Dec 11 04:04:19.444499 2025] [:error] [pid 13985:tid 14031] [client 40.85.143.207:6891] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mah.php"] [unique_id "aTnSQ-gR5X0x1Es1SY49wwAAAEE"]
[Thu Dec 11 04:04:19.954623 2025] [:error] [pid 13986:tid 14066] [client 40.85.143.207:12340] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "aTnSQ-HONL35_h3rQ33XWwAAAIk"]
[Thu Dec 11 04:04:20.471376 2025] [:error] [pid 13985:tid 14033] [client 40.85.143.207:4681] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "aTnSROgR5X0x1Es1SY49zAAAAEM"]
[Thu Dec 11 04:04:20.999426 2025] [:error] [pid 13986:tid 14060] [client 40.85.143.207:10004] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "aTnSROHONL35_h3rQ33XZAAAAIM"]
[Thu Dec 11 04:04:21.579688 2025] [:error] [pid 13984:tid 14025] [client 40.85.143.207:4701] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "aTnSRewrRXz2NiDdz_6uxAAAABY"]
[Thu Dec 11 04:04:22.196532 2025] [:error] [pid 14092:tid 14117] [client 40.85.143.207:10014] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "aTnSRm1yJs96znfXT9P77gAAANY"]
[Thu Dec 11 04:04:22.818068 2025] [:error] [pid 14092:tid 14115] [client 40.85.143.207:15836] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "aTnSRm1yJs96znfXT9P77wAAANQ"]
[Thu Dec 11 04:04:23.556343 2025] [:error] [pid 13985:tid 14044] [client 40.85.143.207:14882] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "aTnSR-gR5X0x1Es1SY495AAAAE4"]
[Thu Dec 11 04:04:24.167020 2025] [:error] [pid 13986:tid 14065] [client 40.85.143.207:11272] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "aTnSSOHONL35_h3rQ33XgwAAAIg"]
[Thu Dec 11 04:04:25.323704 2025] [:error] [pid 13985:tid 14047] [client 40.85.143.207:4721] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aTnSSegR5X0x1Es1SY499gAAAFE"]
[Thu Dec 11 04:04:26.325819 2025] [:error] [pid 14092:tid 14107] [client 40.85.143.207:11308] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aTnSSm1yJs96znfXT9P79QAAAMw"]
[Thu Dec 11 04:04:27.231323 2025] [:error] [pid 14092:tid 14116] [client 40.85.143.207:15837] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aTnSS21yJs96znfXT9P79wAAANU"]
[Thu Dec 11 04:04:28.025435 2025] [:error] [pid 13984:tid 14003] [client 40.85.143.207:4696] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aTnSTOwrRXz2NiDdz_6u0wAAAAA"]
[Thu Dec 11 04:04:28.689619 2025] [:error] [pid 14092:tid 14117] [client 40.85.143.207:2059] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "aTnSTG1yJs96znfXT9P7_wAAANY"]
[Thu Dec 11 04:04:29.294126 2025] [:error] [pid 13985:tid 14030] [client 40.85.143.207:10444] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "aTnSTegR5X0x1Es1SY4-HQAAAEA"]
[Thu Dec 11 04:04:29.816670 2025] [:error] [pid 14092:tid 14119] [client 40.85.143.207:10462] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "aTnSTW1yJs96znfXT9P8BQAAANg"]
[Thu Dec 11 04:04:30.574495 2025] [:error] [pid 14092:tid 14095] [client 40.85.143.207:15597] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "aTnSTm1yJs96znfXT9P8BgAAAMA"]
[Thu Dec 11 04:04:31.457889 2025] [:error] [pid 13986:tid 14070] [client 40.85.143.207:10460] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "aTnST-HONL35_h3rQ33XxwAAAI0"]
[Thu Dec 11 04:04:32.106333 2025] [:error] [pid 13986:tid 14079] [client 40.85.143.207:4000] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "aTnSUOHONL35_h3rQ33X0gAAAJY"]
[Thu Dec 11 04:04:32.913219 2025] [:error] [pid 13986:tid 14065] [client 40.85.143.207:14868] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "aTnSUOHONL35_h3rQ33X4AAAAIg"]
[Thu Dec 11 04:04:33.572476 2025] [:error] [pid 13984:tid 14004] [client 40.85.143.207:1246] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "aTnSUewrRXz2NiDdz_6u3AAAAAE"]
[Thu Dec 11 04:04:34.355515 2025] [:error] [pid 22481:tid 22493] [client 40.85.143.207:13698] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blox.php"] [unique_id "aTnSUvtycPGu8rNL1qy_oAAAAQE"]
[Thu Dec 11 04:04:35.054547 2025] [:error] [pid 14092:tid 14108] [client 40.85.143.207:1270] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blox.php"] [unique_id "aTnSU21yJs96znfXT9P8GwAAAM0"]
[Thu Dec 11 04:04:36.027009 2025] [:error] [pid 22481:tid 22501] [client 40.85.143.207:2925] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blox.php"] [unique_id "aTnSVPtycPGu8rNL1qy_qAAAAQk"]
[Thu Dec 11 04:04:36.982786 2025] [:error] [pid 13984:tid 14020] [client 40.85.143.207:12272] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blox.php"] [unique_id "aTnSVOwrRXz2NiDdz_6u5QAAABE"]
[Thu Dec 11 04:04:37.815022 2025] [:error] [pid 13984:tid 14018] [client 40.85.143.207:13746] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/scx.php7"] [unique_id "aTnSVewrRXz2NiDdz_6u6wAAAA8"]
[Thu Dec 11 04:04:38.334144 2025] [:error] [pid 13986:tid 14069] [client 40.85.143.207:12245] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/scx.php7"] [unique_id "aTnSVuHONL35_h3rQ33YEQAAAIw"]
[Thu Dec 11 04:04:39.548644 2025] [:error] [pid 22481:tid 22509] [client 40.85.143.207:13168] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/scx.php7"] [unique_id "aTnSV_tycPGu8rNL1qy_vQAAARA"]
[Thu Dec 11 04:04:40.489801 2025] [:error] [pid 22481:tid 22516] [client 40.85.143.207:15809] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/scx.php7"] [unique_id "aTnSWPtycPGu8rNL1qy_wwAAARc"]
[Thu Dec 11 04:04:41.319654 2025] [:error] [pid 13985:tid 14043] [client 40.85.143.207:11140] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/siln.php"] [unique_id "aTnSWegR5X0x1Es1SY4-bQAAAE0"]
[Thu Dec 11 04:04:43.003845 2025] [:error] [pid 13986:tid 14078] [client 40.85.143.207:13722] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/siln.php"] [unique_id "aTnSW-HONL35_h3rQ33YLAAAAJU"]
[Thu Dec 11 04:04:44.216422 2025] [:error] [pid 14092:tid 14111] [client 40.85.143.207:4014] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/siln.php"] [unique_id "aTnSXG1yJs96znfXT9P8cwAAANA"]
[Thu Dec 11 04:04:45.100039 2025] [:error] [pid 13984:tid 14026] [client 40.85.143.207:3992] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/siln.php"] [unique_id "aTnSXewrRXz2NiDdz_6u_AAAABc"]
[Thu Dec 11 04:04:45.663011 2025] [:error] [pid 14092:tid 14104] [client 40.85.143.207:3648] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mtvcrew.php"] [unique_id "aTnSXW1yJs96znfXT9P8dgAAAMk"]
[Thu Dec 11 04:04:46.348086 2025] [:error] [pid 13984:tid 14011] [client 40.85.143.207:10026] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mtvcrew.php"] [unique_id "aTnSXuwrRXz2NiDdz_6vBQAAAAg"]
[Thu Dec 11 04:04:46.964447 2025] [:error] [pid 13984:tid 14007] [client 40.85.143.207:6877] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mtvcrew.php"] [unique_id "aTnSXuwrRXz2NiDdz_6vCQAAAAQ"]
[Thu Dec 11 04:04:47.494378 2025] [:error] [pid 22481:tid 22496] [client 40.85.143.207:3238] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mtvcrew.php"] [unique_id "aTnSX_tycPGu8rNL1qy_zgAAAQQ"]
[Thu Dec 11 04:04:48.086228 2025] [:error] [pid 22481:tid 22504] [client 40.85.143.207:3710] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "aTnSYPtycPGu8rNL1qy_zwAAAQw"]
[Thu Dec 11 04:04:48.813713 2025] [:error] [pid 22481:tid 22511] [client 40.85.143.207:16454] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "aTnSYPtycPGu8rNL1qy_1AAAARI"]
[Thu Dec 11 04:04:49.336675 2025] [:error] [pid 13986:tid 14077] [client 40.85.143.207:14861] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "aTnSYeHONL35_h3rQ33YRwAAAJQ"]
[Thu Dec 11 04:04:49.918522 2025] [:error] [pid 22481:tid 22495] [client 40.85.143.207:2110] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "aTnSYftycPGu8rNL1qy_2QAAAQM"]
[Thu Dec 11 04:04:50.645839 2025] [:error] [pid 13986:tid 14074] [client 40.85.143.207:3692] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/raw.php"] [unique_id "aTnSYuHONL35_h3rQ33YUQAAAJE"]
[Thu Dec 11 04:04:51.208706 2025] [:error] [pid 13986:tid 14070] [client 40.85.143.207:15582] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/raw.php"] [unique_id "aTnSY-HONL35_h3rQ33YWAAAAI0"]
[Thu Dec 11 04:04:51.798234 2025] [:error] [pid 13984:tid 14017] [client 40.85.143.207:13749] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/raw.php"] [unique_id "aTnSY-wrRXz2NiDdz_6vMQAAAA4"]
[Thu Dec 11 04:04:52.311818 2025] [:error] [pid 13986:tid 14078] [client 40.85.143.207:3203] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/raw.php"] [unique_id "aTnSZOHONL35_h3rQ33YYgAAAJU"]
[Thu Dec 11 04:04:52.812621 2025] [:error] [pid 13984:tid 14007] [client 40.85.143.207:2235] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/great.php"] [unique_id "aTnSZOwrRXz2NiDdz_6vPgAAAAQ"]
[Thu Dec 11 04:04:53.415996 2025] [:error] [pid 13986:tid 14070] [client 40.85.143.207:1680] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/great.php"] [unique_id "aTnSZeHONL35_h3rQ33YaAAAAI0"]
[Thu Dec 11 04:04:54.036584 2025] [:error] [pid 22481:tid 22495] [client 40.85.143.207:10600] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/great.php"] [unique_id "aTnSZvtycPGu8rNL1qy_6gAAAQM"]
[Thu Dec 11 04:04:54.699831 2025] [:error] [pid 14092:tid 14095] [client 40.85.143.207:8865] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/great.php"] [unique_id "aTnSZm1yJs96znfXT9P8igAAAMA"]
[Thu Dec 11 04:04:55.790635 2025] [:error] [pid 13986:tid 14065] [client 40.85.143.207:2037] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "aTnSZ-HONL35_h3rQ33YewAAAIg"]
[Thu Dec 11 04:04:56.676001 2025] [:error] [pid 14092:tid 14104] [client 40.85.143.207:2036] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "aTnSaG1yJs96znfXT9P8kAAAAMk"]
[Thu Dec 11 04:04:57.245582 2025] [:error] [pid 13986:tid 14075] [client 40.85.143.207:10990] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "aTnSaeHONL35_h3rQ33YhgAAAJI"]
[Thu Dec 11 04:04:57.781462 2025] [:error] [pid 13985:tid 14033] [client 40.85.143.207:15563] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "aTnSaegR5X0x1Es1SY4-oAAAAEM"]
[Thu Dec 11 04:04:58.308923 2025] [:error] [pid 22481:tid 22493] [client 40.85.143.207:16483] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "aTnSavtycPGu8rNL1qy_8gAAAQE"]
[Thu Dec 11 04:04:58.814658 2025] [:error] [pid 13984:tid 14023] [client 40.85.143.207:3696] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "aTnSauwrRXz2NiDdz_6vcAAAABQ"]
[Thu Dec 11 04:04:59.385874 2025] [:error] [pid 22481:tid 22495] [client 40.85.143.207:13553] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "aTnSa_tycPGu8rNL1qy_9wAAAQM"]
[Thu Dec 11 04:05:00.231975 2025] [:error] [pid 13986:tid 14058] [client 40.85.143.207:13520] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "aTnSbOHONL35_h3rQ33YlAAAAIE"]
[Thu Dec 11 04:05:00.830689 2025] [:error] [pid 13986:tid 14079] [client 40.85.143.207:13736] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aTnSbOHONL35_h3rQ33YlwAAAJY"]
[Thu Dec 11 04:05:01.500220 2025] [:error] [pid 13986:tid 14078] [client 40.85.143.207:3671] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aTnSbeHONL35_h3rQ33YmwAAAJU"]
[Thu Dec 11 04:05:02.079199 2025] [:error] [pid 13986:tid 14070] [client 40.85.143.207:15094] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aTnSbuHONL35_h3rQ33YnwAAAI0"]
[Thu Dec 11 04:05:02.629220 2025] [:error] [pid 13986:tid 14065] [client 40.85.143.207:14105] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aTnSbuHONL35_h3rQ33YpAAAAIg"]
[Thu Dec 11 04:05:03.179770 2025] [:error] [pid 14092:tid 14101] [client 40.85.143.207:8849] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shoha.php"] [unique_id "aTnSb21yJs96znfXT9P8kgAAAMY"]
[Thu Dec 11 04:05:03.706620 2025] [:error] [pid 13984:tid 14016] [client 40.85.143.207:16464] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shoha.php"] [unique_id "aTnSb-wrRXz2NiDdz_6vnQAAAA0"]
[Thu Dec 11 04:05:04.237258 2025] [:error] [pid 22481:tid 22496] [client 40.85.143.207:9132] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shoha.php"] [unique_id "aTnScPtycPGu8rNL1qy__QAAAQQ"]
[Thu Dec 11 04:05:04.762597 2025] [:error] [pid 14092:tid 14116] [client 40.85.143.207:13730] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shoha.php"] [unique_id "aTnScG1yJs96znfXT9P8lAAAANU"]
[Thu Dec 11 04:05:05.293508 2025] [:error] [pid 13985:tid 14042] [client 40.85.143.207:14119] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aTnScegR5X0x1Es1SY4-twAAAEw"]
[Thu Dec 11 04:05:05.926104 2025] [:error] [pid 22481:tid 22513] [client 40.85.143.207:9110] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aTnScftycPGu8rNL1qzABAAAARQ"]
[Thu Dec 11 04:05:06.544904 2025] [:error] [pid 14092:tid 14104] [client 40.85.143.207:14119] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aTnScm1yJs96znfXT9P8lQAAAMk"]
[Thu Dec 11 04:05:07.104874 2025] [:error] [pid 14092:tid 14096] [client 40.85.143.207:8581] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aTnSc21yJs96znfXT9P8lwAAAME"]
[Thu Dec 11 04:05:07.720714 2025] [:error] [pid 14092:tid 14108] [client 40.85.143.207:2177] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sallu.php"] [unique_id "aTnSc21yJs96znfXT9P8mQAAAM0"]
[Thu Dec 11 04:05:08.222127 2025] [:error] [pid 14092:tid 14106] [client 40.85.143.207:13704] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sallu.php"] [unique_id "aTnSdG1yJs96znfXT9P8mwAAAMs"]
[Thu Dec 11 04:05:08.806076 2025] [:error] [pid 22481:tid 22511] [client 40.85.143.207:1195] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sallu.php"] [unique_id "aTnSdPtycPGu8rNL1qzAGAAAARI"]
[Thu Dec 11 04:05:09.337971 2025] [:error] [pid 14092:tid 14115] [client 40.85.143.207:7307] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sallu.php"] [unique_id "aTnSdW1yJs96znfXT9P8qAAAANQ"]
[Thu Dec 11 04:05:09.987261 2025] [:error] [pid 13985:tid 14038] [client 40.85.143.207:13540] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aTnSdegR5X0x1Es1SY4-xgAAAEg"]
[Thu Dec 11 04:05:10.584363 2025] [:error] [pid 22481:tid 22511] [client 40.85.143.207:14129] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aTnSdvtycPGu8rNL1qzAKgAAARI"]
[Thu Dec 11 04:05:11.206032 2025] [:error] [pid 14092:tid 14118] [client 40.85.143.207:8841] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aTnSd21yJs96znfXT9P8tQAAANc"]
[Thu Dec 11 04:05:11.881062 2025] [:error] [pid 14092:tid 14095] [client 40.85.143.207:10064] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aTnSd21yJs96znfXT9P8twAAAMA"]
[Thu Dec 11 04:05:24.232082 2025] [:error] [pid 13986:tid 14064] [client 40.85.143.207:7847] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js.php"] [unique_id "aTnShOHONL35_h3rQ33Y1gAAAIc"]
[Thu Dec 11 04:05:24.744665 2025] [:error] [pid 13986:tid 14078] [client 40.85.143.207:9665] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js.php"] [unique_id "aTnShOHONL35_h3rQ33Y2AAAAJU"]
[Thu Dec 11 04:05:25.272158 2025] [:error] [pid 14092:tid 14098] [client 40.85.143.207:10706] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js.php"] [unique_id "aTnShW1yJs96znfXT9P84gAAAMM"]
[Thu Dec 11 04:05:25.809131 2025] [:error] [pid 22481:tid 22508] [client 40.85.143.207:8637] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js.php"] [unique_id "aTnShftycPGu8rNL1qzA0QAAAQ8"]
[Thu Dec 11 04:05:26.434820 2025] [:error] [pid 13985:tid 14047] [client 40.85.143.207:7815] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aTnShugR5X0x1Es1SY4--QAAAFE"]
[Thu Dec 11 04:05:26.983249 2025] [:error] [pid 13986:tid 14074] [client 40.85.143.207:10132] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aTnShuHONL35_h3rQ33Y2wAAAJE"]
[Thu Dec 11 04:05:27.526958 2025] [:error] [pid 13985:tid 14043] [client 40.85.143.207:15306] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aTnSh-gR5X0x1Es1SY4-_gAAAE0"]
[Thu Dec 11 04:05:28.053526 2025] [:error] [pid 13984:tid 14025] [client 40.85.143.207:9112] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aTnSiOwrRXz2NiDdz_6v8QAAABY"]
[Thu Dec 11 04:05:28.946238 2025] [:error] [pid 14092:tid 14105] [client 40.85.143.207:15303] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aTnSiG1yJs96znfXT9P88gAAAMo"]
[Thu Dec 11 04:05:29.502351 2025] [:error] [pid 14092:tid 14116] [client 40.85.143.207:10150] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aTnSiW1yJs96znfXT9P89gAAANU"]
[Thu Dec 11 04:05:30.348689 2025] [:error] [pid 13985:tid 14039] [client 40.85.143.207:11109] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aTnSiugR5X0x1Es1SY4_BwAAAEk"]
[Thu Dec 11 04:05:30.913147 2025] [:error] [pid 14092:tid 14096] [client 40.85.143.207:10091] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aTnSim1yJs96znfXT9P9AAAAAME"]
[Thu Dec 11 04:05:31.852782 2025] [:error] [pid 13985:tid 14047] [client 40.85.143.207:14097] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hello.php"] [unique_id "aTnSi-gR5X0x1Es1SY4_DgAAAFE"]
[Thu Dec 11 04:05:32.710315 2025] [:error] [pid 22481:tid 22504] [client 40.85.143.207:13082] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hello.php"] [unique_id "aTnSjPtycPGu8rNL1qzBGgAAAQw"]
[Thu Dec 11 04:05:33.325192 2025] [:error] [pid 13984:tid 14021] [client 40.85.143.207:7813] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hello.php"] [unique_id "aTnSjewrRXz2NiDdz_6wBwAAABI"]
[Thu Dec 11 04:05:33.992885 2025] [:error] [pid 14092:tid 14111] [client 40.85.143.207:9114] [client 40.85.143.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hello.php"] [unique_id "aTnSjW1yJs96znfXT9P9DgAAANA"]
[Thu Dec 11 04:48:55.469999 2025] [:error] [pid 57991:tid 58028] [client 92.205.49.84:59762] [client 92.205.49.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.49.84, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTnct6PyGmNXA2ZsETbZKAAAAEY"]
[Thu Dec 11 05:53:41.524841 2025] [:error] [pid 58099:tid 58120] [client 104.234.19.113:46655] [client 104.234.19.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.19.113, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTnr5cKZVSF_bdPFqRg6wAAAANM"]
[Thu Dec 11 06:23:29.603068 2025] [:error] [pid 27459:tid 27476] [client 169.150.203.197:59616] [client 169.150.203.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.150.203.197, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTny4VhPEXihPBKMpRN7vgAAAQ8"]
[Thu Dec 11 06:23:31.823902 2025] [:error] [pid 27459:tid 27468] [client 169.150.203.197:59616] [client 169.150.203.197] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aTny41hPEXihPBKMpRN7xAAAAQc"]
[Thu Dec 11 06:23:31.980951 2025] [:error] [pid 27459:tid 27480] [client 169.150.203.197:59616] [client 169.150.203.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.150.203.197, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTny41hPEXihPBKMpRN7xQAAARM"]
[Thu Dec 11 06:23:33.291359 2025] [:error] [pid 48261:tid 48272] [client 169.150.203.197:47322] [client 169.150.203.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.150.203.197, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTny5eyPI4WU-4JmiQOMNgAAAYg"]
[Thu Dec 11 06:23:34.522639 2025] [:error] [pid 48261:tid 48279] [client 169.150.203.197:47336] [client 169.150.203.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.150.203.197, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTny5uyPI4WU-4JmiQOMNwAAAY8"]
[Thu Dec 11 06:23:35.751406 2025] [:error] [pid 57992:tid 58053] [client 169.150.203.197:47350] [client 169.150.203.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.150.203.197, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTny5-Ueau0BMFF2vHnt8QAAAIQ"]
[Thu Dec 11 06:23:37.004852 2025] [:error] [pid 35112:tid 35115] [client 169.150.203.197:47362] [client 169.150.203.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.150.203.197, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTny6Z9ZpQ0WIeJhsJd6_AAAAUE"]
[Thu Dec 11 06:23:37.004985 2025] [:error] [pid 35112:tid 35115] [client 169.150.203.197:47362] [client 169.150.203.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 169.150.203.197, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTny6Z9ZpQ0WIeJhsJd6_AAAAUE"]
[Thu Dec 11 06:34:47.941264 2025] [proxy_fcgi:error] [pid 35112:tid 35126] [client 104.215.29.97:23008] AH01071: Got error 'Primary script unknown', referer: https://www.bing.com/
[Thu Dec 11 06:34:48.934936 2025] [:error] [pid 35112:tid 35118] [client 104.215.29.97:23008] [client 104.215.29.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.215.29.97, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aTn1iJ9ZpQ0WIeJhsJd93gAAAUQ"], referer: https://www.google.fr/
[Thu Dec 11 06:34:48.939745 2025] [proxy_fcgi:error] [pid 35112:tid 35118] [client 104.215.29.97:23008] AH01071: Got error 'Primary script unknown', referer: https://www.google.fr/
[Thu Dec 11 06:35:27.645809 2025] [autoindex:error] [pid 35112:tid 35115] [client 104.215.29.97:23008] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Thu Dec 11 06:35:28.878810 2025] [autoindex:error] [pid 35112:tid 35127] [client 104.215.29.97:23008] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Thu Dec 11 06:35:31.334496 2025] [:error] [pid 57990:tid 58015] [client 104.215.29.97:23026] [client 104.215.29.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.215.29.97, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTn1swqZT_dc36fQdXHEDwAAABQ"], referer: https://www.google.de/
[Thu Dec 11 06:35:33.737873 2025] [:error] [pid 57990:tid 58000] [client 104.215.29.97:23026] [client 104.215.29.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.215.29.97, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTn1tQqZT_dc36fQdXHEGwAAAAU"], referer: https://www.google.com/
[Thu Dec 11 06:35:44.403336 2025] [autoindex:error] [pid 35112:tid 35135] [client 104.215.29.97:23008] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentythree/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Thu Dec 11 06:35:47.473992 2025] [:error] [pid 35112:tid 35117] [client 104.215.29.97:23008] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aTn1w59ZpQ0WIeJhsJd-NQAAAUM"], referer: https://www.google.de/
[Thu Dec 11 06:35:48.981294 2025] [:error] [pid 57990:tid 57997] [client 104.215.29.97:23057] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aTn1xAqZT_dc36fQdXHEKwAAAAI"], referer: https://duckduckgo.com/
[Thu Dec 11 06:35:49.768910 2025] [:error] [pid 57992:tid 58052] [client 104.215.29.97:22977] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aTn1xeUeau0BMFF2vHnwdAAAAIM"], referer: https://www.google.com/
[Thu Dec 11 06:35:50.881956 2025] [:error] [pid 48261:tid 48267] [client 104.215.29.97:22988] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aTn1xuyPI4WU-4JmiQOQVgAAAYM"], referer: https://www.google.fr/
[Thu Dec 11 06:35:52.401041 2025] [:error] [pid 35112:tid 35118] [client 104.215.29.97:22979] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aTn1yJ9ZpQ0WIeJhsJd-NwAAAUQ"], referer: https://www.google.fr/
[Thu Dec 11 06:35:53.764139 2025] [:error] [pid 57991:tid 58046] [client 104.215.29.97:23044] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aTn1yaPyGmNXA2ZsETbxRgAAAFg"], referer: https://www.google.com/
[Thu Dec 11 06:35:55.908362 2025] [:error] [pid 57991:tid 58026] [client 104.215.29.97:23036] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aTn1y6PyGmNXA2ZsETbxSAAAAEQ"], referer: https://www.google.fr/
[Thu Dec 11 06:35:57.981244 2025] [:error] [pid 27459:tid 27476] [client 104.215.29.97:23002] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aTn1zVhPEXihPBKMpRN_uQAAAQ8"], referer: https://www.google.com/
[Thu Dec 11 06:35:59.108208 2025] [:error] [pid 57991:tid 58036] [client 104.215.29.97:23005] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aTn1z6PyGmNXA2ZsETbxSgAAAE4"], referer: https://duckduckgo.com/
[Thu Dec 11 06:36:01.616707 2025] [:error] [pid 35112:tid 35133] [client 104.215.29.97:23022] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/xwx1.php"] [unique_id "aTn10Z9ZpQ0WIeJhsJd-OwAAAVM"], referer: https://www.google.co.uk/
[Thu Dec 11 06:36:03.785454 2025] [:error] [pid 57991:tid 58038] [client 104.215.29.97:23083] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aTn106PyGmNXA2ZsETbxUQAAAFA"], referer: https://www.bing.com/
[Thu Dec 11 06:36:05.366666 2025] [:error] [pid 58099:tid 58107] [client 104.215.29.97:23000] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aTn11cKZVSF_bdPFqRhDhAAAAMY"], referer: https://www.google.de/
[Thu Dec 11 06:36:07.301011 2025] [:error] [pid 35112:tid 35123] [client 104.215.29.97:23032] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bk/index.php"] [unique_id "aTn1159ZpQ0WIeJhsJd-QQAAAUk"], referer: https://www.yahoo.com/
[Thu Dec 11 06:36:08.333748 2025] [:error] [pid 35112:tid 35130] [client 104.215.29.97:23052] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/radio.php"] [unique_id "aTn12J9ZpQ0WIeJhsJd-RAAAAVA"], referer: https://www.google.de/
[Thu Dec 11 06:36:09.947471 2025] [:error] [pid 27459:tid 27482] [client 104.215.29.97:22986] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aTn12VhPEXihPBKMpRN_xgAAARU"], referer: https://www.google.de/
[Thu Dec 11 06:36:11.444936 2025] [:error] [pid 57991:tid 58038] [client 104.215.29.97:23007] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-locale-switcher-less.php"] [unique_id "aTn126PyGmNXA2ZsETbxVgAAAFA"], referer: https://www.google.com/
[Thu Dec 11 06:36:15.419953 2025] [:error] [pid 57992:tid 58061] [client 104.215.29.97:22989] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aTn13-Ueau0BMFF2vHnwgQAAAIw"], referer: https://www.yahoo.com/
[Thu Dec 11 06:36:16.668818 2025] [:error] [pid 57990:tid 58013] [client 104.215.29.97:23045] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aTn14AqZT_dc36fQdXHEOAAAABI"], referer: https://www.google.co.uk/
[Thu Dec 11 06:36:18.048925 2025] [:error] [pid 57991:tid 58026] [client 104.215.29.97:23053] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-media-icon-control.php"] [unique_id "aTn14qPyGmNXA2ZsETbxXAAAAEQ"], referer: https://www.yahoo.com/
[Thu Dec 11 06:36:19.657456 2025] [:error] [pid 57991:tid 58036] [client 104.215.29.97:22994] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aTn146PyGmNXA2ZsETbxXwAAAE4"], referer: https://www.google.de/
[Thu Dec 11 06:36:22.265673 2025] [:error] [pid 57992:tid 58069] [client 104.215.29.97:23033] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/sx.php"] [unique_id "aTn15uUeau0BMFF2vHnwgwAAAJQ"], referer: https://www.google.fr/
[Thu Dec 11 06:36:25.050023 2025] [:error] [pid 58099:tid 58108] [client 104.215.29.97:22998] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/admin.php"] [unique_id "aTn16cKZVSF_bdPFqRhDngAAAMc"], referer: https://www.google.com/
[Thu Dec 11 06:36:32.548692 2025] [:error] [pid 57990:tid 58001] [client 104.215.29.97:23023] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aTn18AqZT_dc36fQdXHEQAAAAAY"], referer: https://www.yahoo.com/
[Thu Dec 11 06:36:32.905662 2025] [:error] [pid 35112:tid 35114] [client 104.215.29.97:23903] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aTn18J9ZpQ0WIeJhsJd-agAAAUA"], referer: https://www.google.com/
[Thu Dec 11 06:36:35.790085 2025] [:error] [pid 57991:tid 58023] [client 104.215.29.97:23037] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aTn186PyGmNXA2ZsETbxdgAAAEE"], referer: https://duckduckgo.com/
[Thu Dec 11 06:36:37.288708 2025] [:error] [pid 35112:tid 35115] [client 104.215.29.97:23034] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aTn19Z9ZpQ0WIeJhsJd-bAAAAUE"], referer: https://www.google.co.uk/
[Thu Dec 11 06:36:38.474272 2025] [:error] [pid 58099:tid 58114] [client 104.215.29.97:23881] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aTn19sKZVSF_bdPFqRhDqgAAAM0"], referer: https://www.google.co.uk/
[Thu Dec 11 06:36:39.304518 2025] [:error] [pid 35112:tid 35117] [client 104.215.29.97:23041] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aTn1959ZpQ0WIeJhsJd-bQAAAUM"], referer: https://www.google.co.uk/
[Thu Dec 11 06:36:40.334903 2025] [:error] [pid 35112:tid 35128] [client 104.215.29.97:23018] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aTn1-J9ZpQ0WIeJhsJd-bgAAAU4"], referer: https://www.google.com/
[Thu Dec 11 06:36:41.258751 2025] [:error] [pid 48261:tid 48269] [client 104.215.29.97:23060] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aTn1-eyPI4WU-4JmiQOQmQAAAYU"], referer: https://www.google.com/
[Thu Dec 11 06:36:42.525972 2025] [:error] [pid 48261:tid 48286] [client 104.215.29.97:23015] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aTn1-uyPI4WU-4JmiQOQmwAAAZY"], referer: https://www.google.co.uk/
[Thu Dec 11 06:36:43.591269 2025] [:error] [pid 57991:tid 58023] [client 104.215.29.97:23028] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-db-array.php"] [unique_id "aTn1-6PyGmNXA2ZsETbxhgAAAEE"], referer: https://duckduckgo.com/
[Thu Dec 11 06:36:53.029376 2025] [:error] [pid 27459:tid 27482] [client 104.215.29.97:22996] [client 104.215.29.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.215.29.97, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTn2BVhPEXihPBKMpRN_7wAAARU"], referer: https://www.google.com/
[Thu Dec 11 06:37:14.738979 2025] [:error] [pid 35112:tid 35123] [client 104.215.29.97:23058] [client 104.215.29.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.215.29.97, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTn2Gp9ZpQ0WIeJhsJd-lQAAAUk"], referer: https://www.google.com/
[Thu Dec 11 06:37:17.252397 2025] [autoindex:error] [pid 27459:tid 27472] [client 104.215.29.97:22996] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Thu Dec 11 06:37:17.413133 2025] [autoindex:error] [pid 27459:tid 27465] [client 104.215.29.97:22996] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Thu Dec 11 06:37:18.296895 2025] [autoindex:error] [pid 27459:tid 27483] [client 104.215.29.97:22996] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Thu Dec 11 06:37:18.887780 2025] [:error] [pid 27459:tid 27480] [client 104.215.29.97:22996] [client 104.215.29.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.215.29.97, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aTn2HlhPEXihPBKMpROAGQAAARM"], referer: https://www.google.com/
[Thu Dec 11 06:37:20.588890 2025] [autoindex:error] [pid 27459:tid 27476] [client 104.215.29.97:22996] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Thu Dec 11 06:37:20.750557 2025] [autoindex:error] [pid 27459:tid 27464] [client 104.215.29.97:22996] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Thu Dec 11 06:37:20.876224 2025] [autoindex:error] [pid 27459:tid 27485] [client 104.215.29.97:22996] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Thu Dec 11 06:37:25.097254 2025] [autoindex:error] [pid 27459:tid 27462] [client 104.215.29.97:22996] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Thu Dec 11 06:37:34.927346 2025] [autoindex:error] [pid 27459:tid 27472] [client 104.215.29.97:22996] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Thu Dec 11 06:37:35.059280 2025] [autoindex:error] [pid 27459:tid 27473] [client 104.215.29.97:22996] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Thu Dec 11 06:37:35.220005 2025] [autoindex:error] [pid 27459:tid 27483] [client 104.215.29.97:22996] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Thu Dec 11 06:37:35.363366 2025] [autoindex:error] [pid 27459:tid 27468] [client 104.215.29.97:22996] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Thu Dec 11 06:37:36.156736 2025] [autoindex:error] [pid 27459:tid 27466] [client 104.215.29.97:22996] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Thu Dec 11 06:37:36.288209 2025] [autoindex:error] [pid 27459:tid 27471] [client 104.215.29.97:22996] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Thu Dec 11 06:37:37.143384 2025] [autoindex:error] [pid 27459:tid 27470] [client 104.215.29.97:22996] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Thu Dec 11 06:37:37.326901 2025] [autoindex:error] [pid 27459:tid 27480] [client 104.215.29.97:22996] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Thu Dec 11 06:37:37.485983 2025] [autoindex:error] [pid 27459:tid 27476] [client 104.215.29.97:22996] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Thu Dec 11 06:37:37.746441 2025] [autoindex:error] [pid 27459:tid 27467] [client 104.215.29.97:22996] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Thu Dec 11 06:37:38.589813 2025] [autoindex:error] [pid 27459:tid 27482] [client 104.215.29.97:22996] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Thu Dec 11 06:37:38.715325 2025] [autoindex:error] [pid 27459:tid 27477] [client 104.215.29.97:22996] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Thu Dec 11 06:37:38.846685 2025] [autoindex:error] [pid 27459:tid 27465] [client 104.215.29.97:22996] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Thu Dec 11 06:37:38.968098 2025] [:error] [pid 27459:tid 27461] [client 104.215.29.97:22996] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/autoload_classmap.php"] [unique_id "aTn2MlhPEXihPBKMpROAQgAAAQA"], referer: https://www.google.de/
[Thu Dec 11 06:37:40.213217 2025] [:error] [pid 57990:tid 58000] [client 104.215.29.97:23047] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/chosen.php"] [unique_id "aTn2NAqZT_dc36fQdXHEbAAAAAU"], referer: https://www.google.co.uk/
[Thu Dec 11 06:37:42.103068 2025] [:error] [pid 48261:tid 48265] [client 104.215.29.97:23026] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aTn2NuyPI4WU-4JmiQOQ3QAAAYE"], referer: https://www.google.de/
[Thu Dec 11 06:37:43.413757 2025] [:error] [pid 58099:tid 58104] [client 104.215.29.97:23051] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aTn2N8KZVSF_bdPFqRhD3AAAAMM"], referer: https://www.google.fr/
[Thu Dec 11 06:37:44.712252 2025] [:error] [pid 48261:tid 48275] [client 104.215.29.97:23013] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aTn2OOyPI4WU-4JmiQOQ4gAAAYs"], referer: https://www.google.co.uk/
[Thu Dec 11 06:37:47.187201 2025] [autoindex:error] [pid 57990:tid 58016] [client 104.215.29.97:23061] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Thu Dec 11 06:37:47.379820 2025] [autoindex:error] [pid 57990:tid 58019] [client 104.215.29.97:23061] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Thu Dec 11 06:37:48.129848 2025] [:error] [pid 57990:tid 58004] [client 104.215.29.97:23061] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/search/index.php"] [unique_id "aTn2PAqZT_dc36fQdXHEcgAAAAk"], referer: https://www.google.de/
[Thu Dec 11 06:37:50.062674 2025] [:error] [pid 27459:tid 27463] [client 104.215.29.97:23011] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aTn2PlhPEXihPBKMpROASgAAAQI"], referer: https://www.google.co.uk/
[Thu Dec 11 06:37:53.466867 2025] [:error] [pid 35112:tid 35116] [client 104.215.29.97:23030] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aTn2QZ9ZpQ0WIeJhsJd-vQAAAUI"], referer: https://duckduckgo.com/
[Thu Dec 11 06:37:56.314159 2025] [:error] [pid 27459:tid 27474] [client 104.215.29.97:23001] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aTn2RFhPEXihPBKMpROATAAAAQ0"], referer: https://www.google.fr/
[Thu Dec 11 06:37:58.182408 2025] [autoindex:error] [pid 57992:tid 58073] [client 104.215.29.97:23049] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Thu Dec 11 06:37:58.335435 2025] [:error] [pid 57992:tid 58057] [client 104.215.29.97:23049] [client 104.215.29.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aTn2RuUeau0BMFF2vHnwtQAAAIg"], referer: https://duckduckgo.com/
[Thu Dec 11 06:38:01.806325 2025] [autoindex:error] [pid 48261:tid 48276] [client 104.215.29.97:23070] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Thu Dec 11 06:38:01.973657 2025] [autoindex:error] [pid 48261:tid 48271] [client 104.215.29.97:23070] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Thu Dec 11 06:38:02.107604 2025] [autoindex:error] [pid 48261:tid 48288] [client 104.215.29.97:23070] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Thu Dec 11 06:38:02.257887 2025] [autoindex:error] [pid 48261:tid 48269] [client 104.215.29.97:23070] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Thu Dec 11 06:38:02.805792 2025] [autoindex:error] [pid 48261:tid 48266] [client 104.215.29.97:23070] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Thu Dec 11 06:38:07.019896 2025] [:error] [pid 48261:tid 48269] [client 104.215.29.97:23022] [client 104.215.29.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.215.29.97, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTn2T-yPI4WU-4JmiQOQ_QAAAYU"], referer: https://www.google.de/
[Thu Dec 11 06:38:09.365125 2025] [:error] [pid 48261:tid 48272] [client 104.215.29.97:23022] [client 104.215.29.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.215.29.97, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTn2UeyPI4WU-4JmiQORAAAAAYg"], referer: https://duckduckgo.com/
[Thu Dec 11 06:38:11.349076 2025] [autoindex:error] [pid 48261:tid 48288] [client 104.215.29.97:23070] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Thu Dec 11 06:38:11.475927 2025] [autoindex:error] [pid 48261:tid 48285] [client 104.215.29.97:23070] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Thu Dec 11 06:38:15.376640 2025] [autoindex:error] [pid 48261:tid 48268] [client 104.215.29.97:23070] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Thu Dec 11 07:20:28.148491 2025] [:error] [pid 57992:tid 58073] [client 171.25.193.81:49766] [client 171.25.193.81] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/expres.sql"] [unique_id "aToAPOUeau0BMFF2vHn7xAAAAJg"]
[Thu Dec 11 07:20:29.808015 2025] [:error] [pid 58099:tid 58115] [client 192.42.116.201:45199] [client 192.42.116.201] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/expressinterio.sql"] [unique_id "aToAPcKZVSF_bdPFqRhPoAAAAM4"]
[Thu Dec 11 07:20:32.529502 2025] [:error] [pid 27459:tid 27472] [client 193.26.115.61:17634] [client 193.26.115.61] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/expressinteriors.sql"] [unique_id "aToAQFhPEXihPBKMpROMxQAAAQs"]
[Thu Dec 11 07:20:39.832989 2025] [:error] [pid 35112:tid 35129] [client 192.42.116.215:60684] [client 192.42.116.215] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/ressinteriors.sql"] [unique_id "aToAR59ZpQ0WIeJhsJeM5AAAAU8"]
[Thu Dec 11 07:20:49.455646 2025] [:error] [pid 57990:tid 58018] [client 45.84.107.200:32870] [client 45.84.107.200] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xpressinteriors.sql"] [unique_id "aToAUQqZT_dc36fQdXHNagAAABc"]
[Thu Dec 11 07:20:52.205218 2025] [:error] [pid 57992:tid 58061] [client 109.70.100.66:54880] [client 109.70.100.66] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/interiors.sql"] [unique_id "aToAVOUeau0BMFF2vHn7zAAAAIw"]
[Thu Dec 11 07:20:53.713279 2025] [:error] [pid 48261:tid 48283] [client 193.189.100.200:2431] [client 193.189.100.200] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/e.sql"] [unique_id "aToAVeyPI4WU-4JmiQOiKQAAAZM"]
[Thu Dec 11 07:20:54.834306 2025] [:error] [pid 57991:tid 58029] [client 185.220.101.59:24811] [client 185.220.101.59] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/teriors.sql"] [unique_id "aToAVqPyGmNXA2ZsETb8TAAAAEc"]
[Thu Dec 11 07:20:56.186077 2025] [:error] [pid 35112:tid 35136] [client 124.198.131.133:14428] [client 124.198.131.133] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/ex.sql"] [unique_id "aToAWJ9ZpQ0WIeJhsJeM_QAAAVY"]
[Thu Dec 11 07:21:01.764581 2025] [:error] [pid 35112:tid 35125] [client 23.129.64.161:56484] [client 23.129.64.161] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/express.sql"] [unique_id "aToAXZ9ZpQ0WIeJhsJeNBAAAAUs"]
[Thu Dec 11 07:21:02.730452 2025] [:error] [pid 35112:tid 35124] [client 107.189.8.133:40618] [client 107.189.8.133] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/ssinteriors.sql"] [unique_id "aToAXp9ZpQ0WIeJhsJeNBgAAAUo"]
[Thu Dec 11 07:21:05.497158 2025] [:error] [pid 58099:tid 58123] [client 45.141.215.169:15226] [client 45.141.215.169] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/expressinter.sql"] [unique_id "aToAYcKZVSF_bdPFqRhP-wAAANY"]
[Thu Dec 11 08:46:29.700056 2025] [:error] [pid 58099:tid 58117] [client 223.244.35.77:56395] [client 223.244.35.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aToUZcKZVSF_bdPFqRhjSwAAANA"]
[Thu Dec 11 09:09:51.894430 2025] [:error] [pid 57990:tid 57996] [client 104.28.214.115:38896] [client 104.28.214.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aToZ3wqZT_dc36fQdXHkhAAAAAE"]
[Thu Dec 11 09:09:52.311851 2025] [:error] [pid 58099:tid 58108] [client 104.28.214.115:36213] [client 104.28.214.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/style.php"] [unique_id "aToZ4MKZVSF_bdPFqRho-QAAAMc"]
[Thu Dec 11 09:32:27.062468 2025] [:error] [pid 35112:tid 35135] [client 216.24.219.193:39959] [client 216.24.219.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.219.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTofK59ZpQ0WIeJhsJewxwAAAVU"]
[Thu Dec 11 10:14:55.688362 2025] [:error] [pid 57990:tid 58015] [client 216.24.219.230:55689] [client 216.24.219.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.219.230, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTopHwqZT_dc36fQdXHzzQAAABQ"]
[Thu Dec 11 10:41:29.043282 2025] [:error] [pid 48261:tid 48274] [client 45.128.199.187:55133] [client 45.128.199.187] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.187, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTovWeyPI4WU-4JmiQPpgwAAAYo"]
[Thu Dec 11 10:45:12.100493 2025] [:error] [pid 35112:tid 35119] [client 104.234.19.113:60633] [client 104.234.19.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.19.113, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTowOJ9ZpQ0WIeJhsJfDPwAAAUU"]
[Thu Dec 11 11:15:05.857124 2025] [:error] [pid 57990:tid 58018] [client 104.234.19.117:60861] [client 104.234.19.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.19.117, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTo3OQqZT_dc36fQdXEBWwAAABc"]
[Thu Dec 11 11:40:14.993570 2025] [:error] [pid 58099:tid 58109] [client 64.20.52.162:33426] [client 64.20.52.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.20.52.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTo9HsKZVSF_bdPFqRiO7QAAAMg"]
[Thu Dec 11 14:33:23.006484 2025] [:error] [pid 57992:tid 58055] [client 193.148.48.25:55858] [client 193.148.48.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "![!+ ]\\\\[\\\\]" at ARGS:0. [file "/usr/local/apache/modsecurity-cwaf/rules/07_XSS_XSS.conf"] [line "173"] [id "213070"] [rev "1"] [msg "COMODO WAF: JSFuck / Hieroglyphy obfuscation detected||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aTplsuUeau0BMFF2vHlcqwAAAIY"]
[Thu Dec 11 14:54:11.638967 2025] [:error] [pid 57991:tid 58031] [client 45.128.199.195:29285] [client 45.128.199.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTpqk6PyGmNXA2ZsETZgaQAAAEk"]
[Thu Dec 11 14:54:11.641398 2025] [:error] [pid 57991:tid 58031] [client 45.128.199.195:29285] [client 45.128.199.195] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||expressinteriors.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /wp-login.php"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTpqk6PyGmNXA2ZsETZgaQAAAEk"]
[Thu Dec 11 14:58:58.488773 2025] [:error] [pid 57991:tid 58035] [client 175.6.217.4:36325] [client 175.6.217.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aTprsqPyGmNXA2ZsETZhYgAAAE0"]
[Thu Dec 11 15:12:11.053371 2025] [:error] [pid 48261:tid 48269] [client 45.128.199.160:44143] [client 45.128.199.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTpuy-yPI4WU-4JmiQNSUgAAAYU"]
[Thu Dec 11 15:22:09.632441 2025] [:error] [pid 48261:tid 48284] [client 103.28.36.189:42124] [client 103.28.36.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTpxIeyPI4WU-4JmiQNWTgAAAZQ"]
[Thu Dec 11 15:22:11.051980 2025] [:error] [pid 48261:tid 48264] [client 103.28.36.189:42124] [client 103.28.36.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTpxI-yPI4WU-4JmiQNWUQAAAYA"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 11 16:43:18.478047 2025] [:error] [pid 48261:tid 48271] [client 45.128.199.147:54565] [client 45.128.199.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTqEJuyPI4WU-4JmiQN3-AAAAYc"]
[Thu Dec 11 19:10:17.892165 2025] [:error] [pid 57991:tid 58034] [client 94.247.172.129:64004] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aTqmmaPyGmNXA2ZsETagygAAAEw"]
[Thu Dec 11 19:12:27.482165 2025] [:error] [pid 58814:tid 58825] [client 45.128.199.159:65137] [client 45.128.199.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.159, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTqnG9iz0l9AD_3pkMwThwAAAck"]
[Thu Dec 11 19:31:41.755654 2025] [:error] [pid 48261:tid 48286] [client 45.128.199.157:35025] [client 45.128.199.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.157, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTqrneyPI4WU-4JmiQOyzwAAAZY"]
[Thu Dec 11 19:55:35.402734 2025] [:error] [pid 48261:tid 48277] [client 185.125.27.120:60108] [client 185.125.27.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.125.27.120, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTqxN-yPI4WU-4JmiQO4VAAAAY0"]
[Thu Dec 11 21:04:55.587442 2025] [:error] [pid 57992:tid 58063] [client 185.177.72.10:50212] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aTrBd-Ueau0BMFF2vHm1PAAAAI4"]
[Thu Dec 11 21:07:09.090917 2025] [:error] [pid 58099:tid 58117] [client 49.235.136.28:35554] [client 49.235.136.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aTrB_cKZVSF_bdPFqRgdgwAAANA"]
[Thu Dec 11 21:41:14.483625 2025] [:error] [pid 35112:tid 35138] [client 65.21.53.225:55424] [client 65.21.53.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.21.53.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTrJ-p9ZpQ0WIeJhsJdzVgAAAVg"]
[Thu Dec 11 21:41:19.282665 2025] [:error] [pid 35112:tid 35127] [client 65.21.53.225:55424] [client 65.21.53.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.21.53.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTrJ_59ZpQ0WIeJhsJdzVwAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 11 22:59:56.719643 2025] [:error] [pid 4911:tid 4915] [client 34.77.157.218:65489] [client 34.77.157.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.77.157.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTrcbA-tKegTX9jNpJkaKgAAAUE"]
[Thu Dec 11 22:59:59.462460 2025] [:error] [pid 4911:tid 4917] [client 34.77.157.218:65489] [client 34.77.157.218] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aTrcbw-tKegTX9jNpJkaMAAAAUM"]
[Thu Dec 11 22:59:59.733056 2025] [:error] [pid 4911:tid 4925] [client 34.77.157.218:65489] [client 34.77.157.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.77.157.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTrcbw-tKegTX9jNpJkaMQAAAUs"]
[Thu Dec 11 23:00:01.514687 2025] [:error] [pid 4564:tid 4588] [client 34.77.157.218:63444] [client 34.77.157.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.77.157.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTrccZjzC8Q_-qV1DxWfvwAAANU"]
[Thu Dec 11 23:00:03.233316 2025] [:error] [pid 4911:tid 4918] [client 34.77.157.218:56658] [client 34.77.157.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.77.157.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTrccw-tKegTX9jNpJkaNQAAAUQ"]
[Thu Dec 11 23:00:05.017935 2025] [:error] [pid 4463:tid 4519] [client 34.77.157.218:50424] [client 34.77.157.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.77.157.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTrcdcWRoGq8qZybgKXmswAAAFc"]
[Thu Dec 11 23:00:06.917032 2025] [:error] [pid 4564:tid 4582] [client 34.77.157.218:52525] [client 34.77.157.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.77.157.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTrcdpjzC8Q_-qV1DxWf4AAAAM8"]
[Thu Dec 11 23:00:06.917267 2025] [:error] [pid 4564:tid 4582] [client 34.77.157.218:52525] [client 34.77.157.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.77.157.218, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTrcdpjzC8Q_-qV1DxWf4AAAAM8"]
[Thu Dec 11 23:23:00.251500 2025] [:error] [pid 4864:tid 4883] [client 185.177.72.10:34284] [client 185.177.72.10] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aTrh1GVhcrADVU33AP4xfAAAARE"]
[Thu Dec 11 23:46:16.385293 2025] [:error] [pid 4464:tid 4531] [client 34.59.143.185:60637] [client 34.59.143.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.59.143.185, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTrnSE74RHTpQwGFIyZddgAAAIU"]
[Thu Dec 11 23:46:19.254566 2025] [:error] [pid 4464:tid 4529] [client 34.59.143.185:60637] [client 34.59.143.185] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aTrnS074RHTpQwGFIyZdfAAAAIM"]
[Thu Dec 11 23:46:19.454445 2025] [:error] [pid 4464:tid 4546] [client 34.59.143.185:60637] [client 34.59.143.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.59.143.185, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTrnS074RHTpQwGFIyZdfQAAAJQ"]
[Thu Dec 11 23:46:20.921872 2025] [:error] [pid 4463:tid 4515] [client 34.59.143.185:55396] [client 34.59.143.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.59.143.185, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTrnTMWRoGq8qZybgKXxKgAAAFM"]
[Thu Dec 11 23:46:22.452721 2025] [:error] [pid 4463:tid 4502] [client 34.59.143.185:61474] [client 34.59.143.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.59.143.185, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTrnTsWRoGq8qZybgKXxMwAAAEY"]
[Thu Dec 11 23:46:23.907850 2025] [:error] [pid 4462:tid 4491] [client 34.59.143.185:51950] [client 34.59.143.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.59.143.185, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTrnT8xEbl7Af0FrMT-d8wAAABY"]
[Thu Dec 11 23:46:25.363515 2025] [:error] [pid 4564:tid 4571] [client 34.59.143.185:55323] [client 34.59.143.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.59.143.185, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTrnUZjzC8Q_-qV1DxWsggAAAMQ"]
[Thu Dec 11 23:46:25.363786 2025] [:error] [pid 4564:tid 4571] [client 34.59.143.185:55323] [client 34.59.143.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.59.143.185, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTrnUZjzC8Q_-qV1DxWsggAAAMQ"]
[Fri Dec 12 00:37:41.240625 2025] [:error] [pid 53522:tid 53524] [client 45.8.17.125:27987] [client 45.8.17.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTrzVQ73fYFRtoUtdzEJAgAAAYA"]
[Fri Dec 12 01:03:56.579573 2025] [:error] [pid 53464:tid 53469] [client 34.73.244.234:59344] [client 34.73.244.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.73.244.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTr5fI6Oxa1m77UpSzk5qAAAAME"]
[Fri Dec 12 01:03:58.939452 2025] [:error] [pid 53464:tid 53480] [client 34.73.244.234:59344] [client 34.73.244.234] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aTr5fo6Oxa1m77UpSzk5sQAAAMw"]
[Fri Dec 12 01:03:59.148318 2025] [:error] [pid 53464:tid 53474] [client 34.73.244.234:59344] [client 34.73.244.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.73.244.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTr5f46Oxa1m77UpSzk5swAAAMY"]
[Fri Dec 12 01:04:00.647599 2025] [:error] [pid 53522:tid 53539] [client 34.73.244.234:58974] [client 34.73.244.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.73.244.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTr5gA73fYFRtoUtdzESFwAAAY8"]
[Fri Dec 12 01:04:02.170356 2025] [:error] [pid 53552:tid 53563] [client 34.73.244.234:61069] [client 34.73.244.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.73.244.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTr5ggRA1W2830SPmKbKfQAAAAk"]
[Fri Dec 12 01:04:03.627718 2025] [:error] [pid 53522:tid 53526] [client 34.73.244.234:60392] [client 34.73.244.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.73.244.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTr5gw73fYFRtoUtdzESIQAAAYI"]
[Fri Dec 12 01:04:05.059866 2025] [:error] [pid 53464:tid 53489] [client 34.73.244.234:54685] [client 34.73.244.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.73.244.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTr5hY6Oxa1m77UpSzk5xAAAANU"]
[Fri Dec 12 01:04:05.060048 2025] [:error] [pid 53464:tid 53489] [client 34.73.244.234:54685] [client 34.73.244.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.73.244.234, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTr5hY6Oxa1m77UpSzk5xAAAANU"]
[Fri Dec 12 02:45:30.450456 2025] [:error] [pid 65374:tid 65380] [client 45.128.199.22:64313] [client 45.128.199.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTsRSvwxTYxIt4J3Weo33QAAAEI"]
[Fri Dec 12 02:55:02.669152 2025] [:error] [pid 53465:tid 53495] [client 46.8.106.205:41997] [client 46.8.106.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.8.106.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTsThuV5ilx5SpOsBcIHMgAAAQA"], referer: https://expressinteriors.com/
[Fri Dec 12 02:55:06.082189 2025] [:error] [pid 53552:tid 53565] [client 46.8.106.205:59045] [client 46.8.106.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.8.106.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTsTigRA1W2830SPmKbj-AAAAAs"], referer: https://expressinteriors.com/wp-login.php?action=register
[Fri Dec 12 04:02:52.715912 2025] [:error] [pid 26607:tid 26611] [client 195.178.110.223:36286] [client 195.178.110.223] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aTsjbMb_b0tOEWTL2KnGHAAAAMI"]
[Fri Dec 12 04:15:44.543129 2025] [:error] [pid 26521:tid 26593] [client 195.178.110.223:37212] [client 195.178.110.223] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aTsmcJdhcAPU617AKTBINQAAAI4"]
[Fri Dec 12 04:28:59.389038 2025] [:error] [pid 26607:tid 26624] [client 196.118.67.56:60088] [client 196.118.67.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.118.67.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTspi8b_b0tOEWTL2KnPRgAAAM8"]
[Fri Dec 12 04:33:42.804583 2025] [:error] [pid 26519:tid 26528] [client 45.128.199.11:30659] [client 45.128.199.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.11, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTsqps8TRgSGOeWqEhdG6QAAAAU"]
[Fri Dec 12 04:40:00.386171 2025] [:error] [pid 26519:tid 26524] [client 45.128.199.178:24737] [client 45.128.199.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.178, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTssIM8TRgSGOeWqEhdIwwAAAAE"]
[Fri Dec 12 04:40:00.388193 2025] [:error] [pid 26519:tid 26524] [client 45.128.199.178:24737] [client 45.128.199.178] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||expressinteriors.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /wp-login.php"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTssIM8TRgSGOeWqEhdIwwAAAAE"]
[Fri Dec 12 04:46:35.725776 2025] [:error] [pid 26521:tid 26598] [client 45.128.199.253:55075] [client 45.128.199.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.253, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTstq5dhcAPU617AKTBOvQAAAJM"]
[Fri Dec 12 04:59:17.513195 2025] [:error] [pid 60649:tid 60653] [client 45.128.199.20:45433] [client 45.128.199.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.20, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTswpVOcUGKU3sgfHP9CWAAAAQE"]
[Fri Dec 12 04:59:17.514821 2025] [:error] [pid 60649:tid 60653] [client 45.128.199.20:45433] [client 45.128.199.20] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||expressinteriors.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /wp-login.php"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTswpVOcUGKU3sgfHP9CWAAAAQE"]
[Fri Dec 12 05:05:50.114832 2025] [:error] [pid 26521:tid 26591] [client 45.128.199.11:28491] [client 45.128.199.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.11, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTsyLpdhcAPU617AKTBTEgAAAIw"]
[Fri Dec 12 05:12:29.323759 2025] [:error] [pid 26520:tid 26560] [client 45.128.199.7:65363] [client 45.128.199.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.7, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTszvUG_frlY5vNXu_BXfAAAAEg"]
[Fri Dec 12 05:13:35.767440 2025] [:error] [pid 26519:tid 26526] [client 196.118.67.56:53566] [client 196.118.67.56] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aTsz_88TRgSGOeWqEhdP8wAAAAM"]
[Fri Dec 12 05:15:12.059988 2025] [:error] [pid 26521:tid 26592] [client 196.118.67.56:61111] [client 196.118.67.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.118.67.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTs0YJdhcAPU617AKTBW3QAAAI0"]
[Fri Dec 12 05:16:27.680628 2025] [:error] [pid 60649:tid 60667] [client 196.118.67.56:63206] [client 196.118.67.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.118.67.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTs0q1OcUGKU3sgfHP9GawAAAQ8"]
[Fri Dec 12 05:17:47.692206 2025] [:error] [pid 26607:tid 26623] [client 196.118.67.56:51740] [client 196.118.67.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.118.67.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTs0-8b_b0tOEWTL2Knb5wAAAM4"]
[Fri Dec 12 05:18:55.367750 2025] [:error] [pid 26521:tid 26582] [client 196.118.67.56:50746] [client 196.118.67.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.118.67.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aTs1P5dhcAPU617AKTBXvQAAAIM"]
[Fri Dec 12 05:18:55.806916 2025] [:error] [pid 26521:tid 26595] [client 45.128.199.179:23417] [client 45.128.199.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTs1P5dhcAPU617AKTBXvwAAAJA"]
[Fri Dec 12 05:25:42.802166 2025] [:error] [pid 60649:tid 60673] [client 45.128.199.15:32575] [client 45.128.199.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.15, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTs21lOcUGKU3sgfHP9IvgAAARU"]
[Fri Dec 12 05:32:14.251329 2025] [:error] [pid 26521:tid 26593] [client 45.128.199.11:32135] [client 45.128.199.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.11, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTs4XpdhcAPU617AKTBb_QAAAI4"]
[Fri Dec 12 05:38:39.388341 2025] [:error] [pid 26519:tid 26534] [client 45.128.199.29:32349] [client 45.128.199.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTs5388TRgSGOeWqEhdVtwAAAAs"]
[Fri Dec 12 05:51:43.164783 2025] [:error] [pid 26607:tid 26629] [client 45.128.199.191:61181] [client 45.128.199.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.191, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTs878b_b0tOEWTL2KnlLAAAANQ"]
[Fri Dec 12 05:58:17.788537 2025] [:error] [pid 60649:tid 60661] [client 45.128.199.191:31213] [client 45.128.199.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.191, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTs-eVOcUGKU3sgfHP9QMwAAAQk"]
[Fri Dec 12 06:04:52.327646 2025] [:error] [pid 26521:tid 26580] [client 45.128.199.16:21305] [client 45.128.199.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtABJdhcAPU617AKTBnwgAAAIE"]
[Fri Dec 12 06:11:14.353918 2025] [:error] [pid 60649:tid 60655] [client 45.128.199.5:20089] [client 45.128.199.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtBglOcUGKU3sgfHP9TOwAAAQM"]
[Fri Dec 12 06:17:49.277787 2025] [:error] [pid 26607:tid 26633] [client 45.128.199.9:38065] [client 45.128.199.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtDDcb_b0tOEWTL2KnrYAAAANg"]
[Fri Dec 12 06:24:20.320998 2025] [:error] [pid 26519:tid 26543] [client 45.128.199.8:31893] [client 45.128.199.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtElM8TRgSGOeWqEhdf1QAAABQ"]
[Fri Dec 12 06:30:49.578510 2025] [:error] [pid 60649:tid 60661] [client 45.128.199.19:52793] [client 45.128.199.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtGGVOcUGKU3sgfHP9XVgAAAQk"]
[Fri Dec 12 06:37:16.218487 2025] [:error] [pid 26607:tid 26624] [client 45.128.199.177:40155] [client 45.128.199.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtHnMb_b0tOEWTL2KnxNQAAAM8"]
[Fri Dec 12 06:43:53.148303 2025] [:error] [pid 27950:tid 27966] [client 45.128.199.194:43111] [client 45.128.199.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtJKYVLRvkrdsSc1F3ScAAAAU4"]
[Fri Dec 12 06:50:24.281508 2025] [:error] [pid 26521:tid 26598] [client 45.128.199.32:20313] [client 45.128.199.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.32, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtKsJdhcAPU617AKTB2rQAAAJM"]
[Fri Dec 12 06:57:02.962402 2025] [:error] [pid 27950:tid 27966] [client 45.128.199.32:44325] [client 45.128.199.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.32, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtMPoVLRvkrdsSc1F3V3QAAAU4"]
[Fri Dec 12 07:03:34.915430 2025] [:error] [pid 26519:tid 26527] [client 45.128.199.225:28915] [client 45.128.199.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtNxs8TRgSGOeWqEhdnBAAAAAQ"]
[Fri Dec 12 07:10:10.745776 2025] [:error] [pid 26520:tid 26566] [client 45.128.199.177:60993] [client 45.128.199.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtPUkG_frlY5vNXu_BuiwAAAE4"]
[Fri Dec 12 07:16:44.660658 2025] [:error] [pid 26521:tid 26600] [client 45.128.199.27:46081] [client 45.128.199.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtQ3JdhcAPU617AKTB9DwAAAJU"]
[Fri Dec 12 07:23:11.441744 2025] [:error] [pid 27950:tid 27969] [client 45.128.199.32:29085] [client 45.128.199.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.32, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtSX4VLRvkrdsSc1F3bdgAAAVE"]
[Fri Dec 12 07:29:45.587343 2025] [:error] [pid 60649:tid 60661] [client 45.128.199.27:23205] [client 45.128.199.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtT6VOcUGKU3sgfHP9i7QAAAQk"]
[Fri Dec 12 07:38:47.171811 2025] [:error] [pid 60649:tid 60658] [client 45.8.17.133:33525] [client 45.8.17.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtWB1OcUGKU3sgfHP9k5AAAAQY"]
[Fri Dec 12 07:45:33.034693 2025] [:error] [pid 26521:tid 26600] [client 45.8.17.196:59681] [client 45.8.17.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.196, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtXnZdhcAPU617AKTCG4AAAAJU"]
[Fri Dec 12 07:52:04.173681 2025] [:error] [pid 26521:tid 26584] [client 45.8.17.86:56325] [client 45.8.17.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtZJJdhcAPU617AKTCIiAAAAIU"]
[Fri Dec 12 07:58:43.667642 2025] [:error] [pid 60649:tid 60659] [client 45.8.17.93:46011] [client 45.8.17.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtas1OcUGKU3sgfHP9oNwAAAQc"]
[Fri Dec 12 08:05:16.524960 2025] [:error] [pid 26521:tid 26581] [client 45.8.17.92:39233] [client 45.8.17.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtcPJdhcAPU617AKTCMeAAAAII"]
[Fri Dec 12 08:11:54.503661 2025] [:error] [pid 27950:tid 27960] [client 45.128.199.146:49645] [client 45.128.199.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtdyoVLRvkrdsSc1F3nHQAAAUg"]
[Fri Dec 12 08:18:34.510513 2025] [:error] [pid 26519:tid 26540] [client 45.8.17.92:50161] [client 45.8.17.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtfWs8TRgSGOeWqEhdzPwAAABE"]
[Fri Dec 12 08:25:18.953751 2025] [:error] [pid 26521:tid 26595] [client 45.8.17.88:45865] [client 45.8.17.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.88, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtg7pdhcAPU617AKTCSjgAAAJA"]
[Fri Dec 12 08:32:03.298027 2025] [:error] [pid 60649:tid 60663] [client 45.8.17.83:37523] [client 45.8.17.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtig1OcUGKU3sgfHP9udwAAAQs"]
[Fri Dec 12 08:38:47.772256 2025] [:error] [pid 26607:tid 26613] [client 45.8.17.76:62141] [client 45.8.17.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.76, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtkF8b_b0tOEWTL2KkKPAAAAMQ"]
[Fri Dec 12 08:45:28.912194 2025] [:error] [pid 60649:tid 60661] [client 45.8.17.190:28503] [client 45.8.17.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtlqFOcUGKU3sgfHP9wcgAAAQk"]
[Fri Dec 12 08:52:08.943632 2025] [:error] [pid 26519:tid 26539] [client 45.8.17.54:50729] [client 45.8.17.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtnOM8TRgSGOeWqEhd4KwAAABA"]
[Fri Dec 12 08:58:54.114719 2025] [:error] [pid 26521:tid 26603] [client 45.8.17.54:34585] [client 45.8.17.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtozpdhcAPU617AKTCboAAAAJg"]
[Fri Dec 12 09:04:16.455373 2025] [:error] [pid 26519:tid 26524] [client 182.44.10.67:45703] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aTtqEM8TRgSGOeWqEhd6GwAAAAE"]
[Fri Dec 12 09:05:43.223045 2025] [:error] [pid 26521:tid 26599] [client 45.8.17.238:62293] [client 45.8.17.238] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.238, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtqZ5dhcAPU617AKTCdjgAAAJQ"]
[Fri Dec 12 09:12:27.356431 2025] [:error] [pid 26521:tid 26586] [client 45.8.17.86:61025] [client 45.8.17.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtr-5dhcAPU617AKTCf_wAAAIc"]
[Fri Dec 12 09:19:05.856343 2025] [:error] [pid 26519:tid 26524] [client 45.8.17.71:39951] [client 45.8.17.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTttic8TRgSGOeWqEhd8hgAAAAE"]
[Fri Dec 12 09:25:44.470906 2025] [:error] [pid 26521:tid 26591] [client 45.8.17.78:54469] [client 45.8.17.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtvGJdhcAPU617AKTCi2wAAAIw"]
[Fri Dec 12 09:32:25.719722 2025] [:error] [pid 27950:tid 27960] [client 45.8.17.120:46323] [client 45.8.17.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.120, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtwqYVLRvkrdsSc1F34oAAAAUg"]
[Fri Dec 12 09:38:56.587974 2025] [:error] [pid 27950:tid 27963] [client 45.8.17.92:40629] [client 45.8.17.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtyMIVLRvkrdsSc1F358gAAAUs"]
[Fri Dec 12 09:45:32.905250 2025] [:error] [pid 60649:tid 60662] [client 45.128.199.210:35083] [client 45.128.199.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTtzvFOcUGKU3sgfHP96dgAAAQo"]
[Fri Dec 12 09:52:16.243888 2025] [:error] [pid 27950:tid 27974] [client 45.128.199.210:39547] [client 45.128.199.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTt1UIVLRvkrdsSc1F39PQAAAVY"]
[Fri Dec 12 09:58:44.535832 2025] [:error] [pid 26521:tid 26600] [client 45.8.17.198:53081] [client 45.8.17.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.198, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTt21JdhcAPU617AKTCqzgAAAJU"]
[Fri Dec 12 10:05:34.440615 2025] [:error] [pid 26521:tid 26591] [client 45.8.17.78:39651] [client 45.8.17.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTt4bpdhcAPU617AKTCs4gAAAIw"]
[Fri Dec 12 10:12:10.440403 2025] [:error] [pid 27950:tid 27958] [client 45.8.17.67:48555] [client 45.8.17.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.67, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTt5-oVLRvkrdsSc1F0BYwAAAUY"]
[Fri Dec 12 10:18:39.440848 2025] [:error] [pid 27950:tid 27952] [client 45.8.17.77:23269] [client 45.8.17.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTt7f4VLRvkrdsSc1F0DRwAAAUA"]
[Fri Dec 12 10:25:15.656638 2025] [:error] [pid 26521:tid 26586] [client 45.8.17.205:26317] [client 45.8.17.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTt9C5dhcAPU617AKTCzYwAAAIc"]
[Fri Dec 12 10:31:49.651769 2025] [:error] [pid 60649:tid 60673] [client 45.8.17.87:23213] [client 45.8.17.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.87, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTt-lVOcUGKU3sgfHP-CogAAARU"]
[Fri Dec 12 10:33:27.816017 2025] [:error] [pid 26519:tid 26541] [client 81.12.27.190:35654] [client 81.12.27.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.12.27.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTt-988TRgSGOeWqEheHKgAAABI"]
[Fri Dec 12 10:38:21.069136 2025] [:error] [pid 26607:tid 26614] [client 45.8.17.87:20259] [client 45.8.17.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.87, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuAHcb_b0tOEWTL2KkgvQAAAMU"]
[Fri Dec 12 10:45:03.966074 2025] [:error] [pid 26521:tid 26592] [client 45.8.17.94:60033] [client 45.8.17.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.94, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuBr5dhcAPU617AKTC5ngAAAI0"]
[Fri Dec 12 10:51:48.161229 2025] [:error] [pid 26520:tid 26552] [client 45.8.17.81:55525] [client 45.8.17.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuDREG_frlY5vNXu_CSZwAAAEA"]
[Fri Dec 12 10:58:15.734270 2025] [:error] [pid 27950:tid 27970] [client 45.8.17.92:51989] [client 45.8.17.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuEx4VLRvkrdsSc1F0NDgAAAVI"]
[Fri Dec 12 11:04:49.280137 2025] [:error] [pid 27950:tid 27972] [client 45.8.17.81:56795] [client 45.8.17.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuGUYVLRvkrdsSc1F0P0AAAAVQ"]
[Fri Dec 12 11:05:54.982619 2025] [:error] [pid 60649:tid 60653] [client 37.140.254.87:58859] [client 37.140.254.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aTuGklOcUGKU3sgfHP-I-gAAAQE"]
[Fri Dec 12 11:06:00.331372 2025] [:error] [pid 60649:tid 60674] [client 37.140.254.64:42075] [client 37.140.254.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aTuGmFOcUGKU3sgfHP-JAAAAARY"]
[Fri Dec 12 11:06:09.857705 2025] [:error] [pid 60649:tid 60661] [client 37.140.254.60:44311] [client 37.140.254.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aTuGoVOcUGKU3sgfHP-JDgAAAQk"]
[Fri Dec 12 11:06:15.393363 2025] [:error] [pid 26607:tid 26613] [client 37.140.254.74:31047] [client 37.140.254.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aTuGp8b_b0tOEWTL2KkoAAAAAMQ"]
[Fri Dec 12 11:06:24.903806 2025] [:error] [pid 26607:tid 26610] [client 37.140.254.80:64035] [client 37.140.254.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aTuGsMb_b0tOEWTL2KkoDQAAAME"]
[Fri Dec 12 11:06:35.832671 2025] [autoindex:error] [pid 26521:tid 26600] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:06:36.350545 2025] [autoindex:error] [pid 26521:tid 26584] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:06:36.815682 2025] [autoindex:error] [pid 26521:tid 26582] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:06:37.284223 2025] [autoindex:error] [pid 26521:tid 26603] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:06:39.935507 2025] [autoindex:error] [pid 26521:tid 26602] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:06:40.470444 2025] [autoindex:error] [pid 26521:tid 26592] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:06:40.995872 2025] [autoindex:error] [pid 26521:tid 26594] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:06:41.497983 2025] [autoindex:error] [pid 26521:tid 26584] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:06:42.054830 2025] [autoindex:error] [pid 26521:tid 26590] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:06:42.524488 2025] [autoindex:error] [pid 26521:tid 26581] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:06:43.534132 2025] [autoindex:error] [pid 26521:tid 26579] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:06:46.069944 2025] [autoindex:error] [pid 26521:tid 26602] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:06:47.138349 2025] [autoindex:error] [pid 26521:tid 26581] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:06:50.794371 2025] [autoindex:error] [pid 26521:tid 26593] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:06:51.259535 2025] [autoindex:error] [pid 26521:tid 26597] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:06:51.733945 2025] [autoindex:error] [pid 26521:tid 26584] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:06:52.282865 2025] [autoindex:error] [pid 26521:tid 26586] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:06:53.972539 2025] [autoindex:error] [pid 26521:tid 26598] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:06:54.481882 2025] [autoindex:error] [pid 26521:tid 26590] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:06:56.229292 2025] [autoindex:error] [pid 26521:tid 26592] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:06:59.260213 2025] [autoindex:error] [pid 26521:tid 26583] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:06:59.814879 2025] [autoindex:error] [pid 26521:tid 26597] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:07:00.282377 2025] [autoindex:error] [pid 26521:tid 26584] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:07:05.709168 2025] [autoindex:error] [pid 26521:tid 26581] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:07:10.042680 2025] [autoindex:error] [pid 26521:tid 26583] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:07:11.857905 2025] [autoindex:error] [pid 26521:tid 26594] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:07:12.432532 2025] [autoindex:error] [pid 26521:tid 26590] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:07:13.850111 2025] [autoindex:error] [pid 26521:tid 26579] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:07:14.325031 2025] [autoindex:error] [pid 26521:tid 26582] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:07:14.813287 2025] [autoindex:error] [pid 26521:tid 26580] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:07:20.288524 2025] [autoindex:error] [pid 26521:tid 26587] [client 37.140.254.110:39955] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:08:03.084971 2025] [autoindex:error] [pid 26521:tid 26601] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:08:03.551438 2025] [autoindex:error] [pid 26521:tid 26589] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:08:04.070087 2025] [autoindex:error] [pid 26521:tid 26586] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:08:04.555081 2025] [autoindex:error] [pid 26521:tid 26581] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:08:08.629678 2025] [autoindex:error] [pid 26521:tid 26579] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:08:09.128035 2025] [autoindex:error] [pid 26521:tid 26603] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:08:10.975372 2025] [autoindex:error] [pid 26521:tid 26589] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:08:12.723370 2025] [autoindex:error] [pid 26521:tid 26595] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:08:13.280713 2025] [autoindex:error] [pid 26521:tid 26586] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:08:13.753449 2025] [autoindex:error] [pid 26521:tid 26594] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:08:15.555726 2025] [autoindex:error] [pid 26521:tid 26593] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:08:16.018048 2025] [autoindex:error] [pid 26521:tid 26579] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:08:16.512058 2025] [autoindex:error] [pid 26521:tid 26583] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:08:17.051462 2025] [autoindex:error] [pid 26521:tid 26588] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:08:54.494660 2025] [autoindex:error] [pid 26521:tid 26594] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:09:11.317949 2025] [autoindex:error] [pid 26521:tid 26591] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:09:17.826198 2025] [autoindex:error] [pid 26521:tid 26595] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:09:18.326254 2025] [autoindex:error] [pid 26521:tid 26581] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:09:25.467705 2025] [autoindex:error] [pid 26521:tid 26579] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:09:25.932783 2025] [autoindex:error] [pid 26521:tid 26586] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:09:26.395745 2025] [autoindex:error] [pid 26521:tid 26588] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:09:26.862774 2025] [autoindex:error] [pid 26521:tid 26580] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:09:27.352915 2025] [autoindex:error] [pid 26521:tid 26585] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:09:27.880305 2025] [autoindex:error] [pid 26521:tid 26579] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:09:28.366525 2025] [autoindex:error] [pid 26521:tid 26583] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:09:28.870861 2025] [autoindex:error] [pid 26521:tid 26580] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:09:29.437214 2025] [autoindex:error] [pid 26521:tid 26603] [client 37.140.254.165:61471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:09:58.595279 2025] [autoindex:error] [pid 27950:tid 27957] [client 37.140.254.81:25421] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 12 11:11:25.561303 2025] [:error] [pid 60649:tid 60656] [client 45.128.199.57:22207] [client 45.128.199.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuH3VOcUGKU3sgfHP-LOQAAAQQ"]
[Fri Dec 12 11:17:56.234688 2025] [:error] [pid 27950:tid 27962] [client 45.8.17.83:46379] [client 45.8.17.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuJZIVLRvkrdsSc1F0TkQAAAUo"]
[Fri Dec 12 11:24:35.755448 2025] [:error] [pid 26519:tid 26524] [client 45.8.17.198:30073] [client 45.8.17.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.198, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuK888TRgSGOeWqEheRVgAAAAE"]
[Fri Dec 12 11:31:14.006460 2025] [:error] [pid 26519:tid 26543] [client 45.8.17.77:45609] [client 45.8.17.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuMgs8TRgSGOeWqEheS4gAAABQ"]
[Fri Dec 12 11:37:49.160002 2025] [:error] [pid 26607:tid 26618] [client 45.8.17.78:23733] [client 45.8.17.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuODcb_b0tOEWTL2Kkv9gAAAMk"]
[Fri Dec 12 11:49:21.588958 2025] [:error] [pid 26519:tid 26545] [client 45.8.17.77:63801] [client 45.8.17.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuQwc8TRgSGOeWqEheXWQAAABY"]
[Fri Dec 12 11:56:00.475683 2025] [:error] [pid 26521:tid 26594] [client 45.8.17.198:61419] [client 45.8.17.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.198, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuSUJdhcAPU617AKTDYxwAAAI8"]
[Fri Dec 12 12:02:39.130332 2025] [:error] [pid 27950:tid 27966] [client 45.8.17.143:35639] [client 45.8.17.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.143, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuT34VLRvkrdsSc1F0ivgAAAU4"]
[Fri Dec 12 12:15:57.943686 2025] [:error] [pid 26521:tid 26593] [client 45.8.17.84:39637] [client 45.8.17.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.84, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuW_ZdhcAPU617AKTDgZAAAAI4"]
[Fri Dec 12 12:22:24.452203 2025] [:error] [pid 27950:tid 27963] [client 45.8.17.83:39803] [client 45.8.17.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuYgIVLRvkrdsSc1F0oawAAAUs"]
[Fri Dec 12 12:28:59.595411 2025] [:error] [pid 27950:tid 27962] [client 45.8.17.83:65469] [client 45.8.17.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuaC4VLRvkrdsSc1F0rFAAAAUo"]
[Fri Dec 12 12:35:41.724226 2025] [:error] [pid 60649:tid 60674] [client 45.8.17.205:47549] [client 45.8.17.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTubnVOcUGKU3sgfHP-gxwAAARY"]
[Fri Dec 12 12:42:14.691267 2025] [:error] [pid 26607:tid 26632] [client 45.8.17.70:59797] [client 45.8.17.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTudJsb_b0tOEWTL2KlAGwAAANc"]
[Fri Dec 12 12:48:54.177317 2025] [:error] [pid 26520:tid 26553] [client 45.8.17.77:23309] [client 45.8.17.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuetkG_frlY5vNXu_CurgAAAEE"]
[Fri Dec 12 13:08:42.118772 2025] [:error] [pid 27950:tid 27971] [client 45.8.17.92:49983] [client 45.8.17.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTujWoVLRvkrdsSc1F02cwAAAVM"]
[Fri Dec 12 13:15:16.817480 2025] [:error] [pid 26519:tid 26525] [client 45.8.17.111:53107] [client 45.8.17.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuk5M8TRgSGOeWqEhepoQAAAAI"]
[Fri Dec 12 13:21:50.311033 2025] [:error] [pid 26521:tid 26596] [client 45.8.17.74:51615] [client 45.8.17.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.74, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTumbpdhcAPU617AKTD5ywAAAJE"]
[Fri Dec 12 13:28:31.750632 2025] [:error] [pid 26520:tid 26575] [client 45.8.17.91:64331] [client 45.8.17.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.91, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTun_0G_frlY5vNXu_C3CgAAAFc"]
[Fri Dec 12 13:35:09.986959 2025] [:error] [pid 27950:tid 27965] [client 45.8.17.79:64841] [client 45.8.17.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.79, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTupjYVLRvkrdsSc1F08pQAAAU0"]
[Fri Dec 12 13:41:44.067467 2025] [:error] [pid 26519:tid 26528] [client 45.8.17.109:25559] [client 45.8.17.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.109, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTurGM8TRgSGOeWqEheupgAAAAU"]
[Fri Dec 12 13:48:19.641639 2025] [:error] [pid 26607:tid 26612] [client 45.8.17.196:65201] [client 45.8.17.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.196, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuso8b_b0tOEWTL2KlPOAAAAMM"]
[Fri Dec 12 13:55:00.772915 2025] [:error] [pid 26521:tid 26592] [client 45.8.17.67:27731] [client 45.8.17.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.67, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuuNJdhcAPU617AKTADtgAAAI0"]
[Fri Dec 12 14:01:38.447150 2025] [:error] [pid 27950:tid 27964] [client 45.8.17.67:34203] [client 45.8.17.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.67, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuvwoVLRvkrdsSc1F1DJAAAAUw"]
[Fri Dec 12 14:08:19.459648 2025] [:error] [pid 26520:tid 26573] [client 45.8.17.100:60649] [client 45.8.17.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.100, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuxU0G_frlY5vNXu_C94QAAAFU"]
[Fri Dec 12 14:15:08.014936 2025] [:error] [pid 60649:tid 60665] [client 45.8.17.97:47841] [client 45.8.17.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.97, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTuy7FOcUGKU3sgfHP-2_gAAAQ0"]
[Fri Dec 12 14:21:51.772087 2025] [:error] [pid 26520:tid 26553] [client 45.8.17.100:32639] [client 45.8.17.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.100, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTu0f0G_frlY5vNXu_DA2wAAAEE"]
[Fri Dec 12 14:35:26.451882 2025] [:error] [pid 26521:tid 26591] [client 45.8.17.120:43933] [client 45.8.17.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.120, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTu3rpdhcAPU617AKTARDgAAAIw"]
[Fri Dec 12 14:42:06.691003 2025] [:error] [pid 60649:tid 60663] [client 45.8.17.77:24967] [client 45.8.17.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTu5PlOcUGKU3sgfHP-7hAAAAQs"]
[Fri Dec 12 14:48:53.168360 2025] [:error] [pid 60649:tid 60663] [client 45.8.17.111:41841] [client 45.8.17.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTu61VOcUGKU3sgfHP-8wgAAAQs"]
[Fri Dec 12 14:55:39.761817 2025] [:error] [pid 27950:tid 27954] [client 45.8.17.75:41209] [client 45.8.17.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.75, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTu8a4VLRvkrdsSc1F1RUwAAAUI"]
[Fri Dec 12 15:09:03.838622 2025] [:error] [pid 60649:tid 60672] [client 45.8.17.143:46667] [client 45.8.17.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.143, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTu_j1OcUGKU3sgfHP-_wAAAARQ"]
[Fri Dec 12 15:35:53.428866 2025] [:error] [pid 26521:tid 26596] [client 45.8.17.84:53231] [client 45.8.17.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.84, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTvF2ZdhcAPU617AKTAgwwAAAJE"]
[Fri Dec 12 15:42:38.088007 2025] [:error] [pid 27950:tid 27976] [client 45.8.17.74:30439] [client 45.8.17.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.74, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTvHboVLRvkrdsSc1F1aYwAAAVg"]
[Fri Dec 12 16:02:59.887270 2025] [:error] [pid 26519:tid 26543] [client 45.8.17.100:41429] [client 45.8.17.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.100, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTvMM88TRgSGOeWqEhfDYAAAABQ"]
[Fri Dec 12 16:30:22.857729 2025] [:error] [pid 60649:tid 60673] [client 45.8.17.143:52571] [client 45.8.17.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.143, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTvSnlOcUGKU3sgfHP_JvAAAARU"]
[Fri Dec 12 16:37:07.528630 2025] [:error] [pid 26520:tid 26571] [client 45.8.17.66:57919] [client 45.8.17.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.66, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTvUM0G_frlY5vNXu_DSsgAAAFM"]
[Fri Dec 12 16:40:17.665199 2025] [:error] [pid 26521:tid 26593] [client 192.241.135.45:33154] [client 192.241.135.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.241.135.45, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTvU8ZdhcAPU617AKTAvQwAAAI4"]
[Fri Dec 12 16:40:21.025530 2025] [:error] [pid 26521:tid 26602] [client 192.241.135.45:33154] [client 192.241.135.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.241.135.45, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTvU9ZdhcAPU617AKTAvRwAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 12 16:50:38.419466 2025] [:error] [pid 26521:tid 26595] [client 45.8.17.70:26839] [client 45.8.17.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTvXXpdhcAPU617AKTAypAAAAJA"]
[Fri Dec 12 16:54:48.597123 2025] [:error] [pid 26607:tid 26631] [client 50.28.48.144:39506] [client 50.28.48.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.28.48.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTvYWMb_b0tOEWTL2KlwHgAAANY"]
[Fri Dec 12 16:57:24.489590 2025] [:error] [pid 26607:tid 26632] [client 45.8.17.100:36933] [client 45.8.17.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.100, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTvY9Mb_b0tOEWTL2KlwaQAAANc"]
[Fri Dec 12 17:01:26.322451 2025] [:error] [pid 60649:tid 60666] [client 138.122.71.215:39940] [client 138.122.71.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.122.71.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTvZ5lOcUGKU3sgfHP_NRAAAAQ4"]
[Fri Dec 12 17:04:08.919209 2025] [:error] [pid 26607:tid 26620] [client 45.8.17.98:38927] [client 45.8.17.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.98, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTvaiMb_b0tOEWTL2KlxIQAAAMs"]
[Fri Dec 12 17:10:55.325020 2025] [:error] [pid 26521:tid 26586] [client 45.8.17.190:53257] [client 45.8.17.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTvcH5dhcAPU617AKTA3WQAAAIc"]
[Fri Dec 12 17:17:47.651563 2025] [:error] [pid 27950:tid 27952] [client 45.8.17.198:34231] [client 45.8.17.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.198, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTvdu4VLRvkrdsSc1F1qHAAAAUA"]
[Fri Dec 12 17:24:31.969716 2025] [:error] [pid 26521:tid 26590] [client 45.8.17.89:58339] [client 45.8.17.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.89, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTvfT5dhcAPU617AKTA6lAAAAIs"]
[Fri Dec 12 17:31:23.366524 2025] [:error] [pid 27950:tid 27964] [client 45.8.17.80:47409] [client 45.8.17.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTvg64VLRvkrdsSc1F1tEwAAAUw"]
[Fri Dec 12 17:51:43.571837 2025] [:error] [pid 26521:tid 26598] [client 45.8.17.55:21287] [client 45.8.17.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.55, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTvlr5dhcAPU617AKTBCFAAAAJM"]
[Fri Dec 12 17:58:31.037347 2025] [:error] [pid 26521:tid 26593] [client 45.8.17.111:22691] [client 45.8.17.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTvnR5dhcAPU617AKTBEWwAAAI4"]
[Fri Dec 12 18:25:35.030229 2025] [:error] [pid 26521:tid 26600] [client 45.8.17.77:56953] [client 45.8.17.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTvtn5dhcAPU617AKTBLewAAAJU"]
[Fri Dec 12 18:38:18.374450 2025] [:error] [pid 55760:tid 55785] [client 160.22.122.105:53376] [client 160.22.122.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 160.22.122.105, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTvwmlObDQlftFDyGazpewAAAZc"]
[Fri Dec 12 18:39:09.211050 2025] [:error] [pid 26521:tid 26600] [client 45.8.17.111:34821] [client 45.8.17.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTvwzZdhcAPU617AKTBPfgAAAJU"]
[Fri Dec 12 18:59:45.613714 2025] [:error] [pid 27950:tid 27964] [client 195.250.26.105:46764] [client 195.250.26.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.250.26.105, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTv1oYVLRvkrdsSc1F19pwAAAUw"]
[Fri Dec 12 18:59:47.998021 2025] [:error] [pid 27950:tid 27967] [client 195.250.26.105:46764] [client 195.250.26.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.250.26.105, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTv1o4VLRvkrdsSc1F19qgAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 12 20:27:43.167385 2025] [:error] [pid 26519:tid 26542] [client 45.8.17.80:48659] [client 45.8.17.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTwKP88TRgSGOeWqEhft-gAAABM"]
[Fri Dec 12 20:41:04.231323 2025] [:error] [pid 27950:tid 27960] [client 45.8.17.70:43373] [client 45.8.17.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTwNYIVLRvkrdsSc1F2a9gAAAUg"]
[Fri Dec 12 20:57:27.332493 2025] [:error] [pid 26519:tid 26539] [client 130.33.54.142:15163] [client 130.33.54.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aTwRN88TRgSGOeWqEhfytQAAABA"]
[Fri Dec 12 20:57:29.203567 2025] [:error] [pid 55760:tid 55763] [client 130.33.54.142:15143] [client 130.33.54.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aTwROVObDQlftFDyGawPcgAAAYE"]
[Fri Dec 12 20:57:32.242389 2025] [:error] [pid 26607:tid 26611] [client 130.33.54.142:15166] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aTwRPMb_b0tOEWTL2KmbggAAAMI"]
[Fri Dec 12 20:57:32.690226 2025] [:error] [pid 26521:tid 26589] [client 130.33.54.142:14528] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aTwRPJdhcAPU617AKTB87AAAAIo"]
[Fri Dec 12 20:57:33.335988 2025] [:error] [pid 26520:tid 26554] [client 130.33.54.142:15131] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aTwRPUG_frlY5vNXu_D6BAAAAEI"]
[Fri Dec 12 20:57:33.666569 2025] [:error] [pid 27950:tid 27970] [client 130.33.54.142:15146] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aTwRPYVLRvkrdsSc1F2diQAAAVI"]
[Fri Dec 12 20:57:34.015888 2025] [:error] [pid 55760:tid 55785] [client 130.33.54.142:15121] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aTwRPlObDQlftFDyGawPdQAAAZc"]
[Fri Dec 12 20:57:34.368910 2025] [:error] [pid 26607:tid 26624] [client 130.33.54.142:14532] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aTwRPsb_b0tOEWTL2KmbhgAAAM8"]
[Fri Dec 12 20:57:34.638649 2025] [:error] [pid 55760:tid 55767] [client 130.33.54.142:15155] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aTwRPlObDQlftFDyGawPdwAAAYU"]
[Fri Dec 12 20:57:34.897402 2025] [:error] [pid 26519:tid 26534] [client 130.33.54.142:14556] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aTwRPs8TRgSGOeWqEhfywQAAAAs"]
[Fri Dec 12 20:57:35.308232 2025] [:error] [pid 26519:tid 26538] [client 130.33.54.142:15145] [client 130.33.54.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aTwRP88TRgSGOeWqEhfyxAAAAA8"]
[Fri Dec 12 20:57:35.785936 2025] [:error] [pid 60649:tid 60656] [client 130.33.54.142:15105] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/index.php"] [unique_id "aTwRP1OcUGKU3sgfHP_4VgAAAQQ"]
[Fri Dec 12 20:57:36.114854 2025] [:error] [pid 55760:tid 55776] [client 130.33.54.142:15119] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/index.php"] [unique_id "aTwRQFObDQlftFDyGawPeQAAAY4"]
[Fri Dec 12 20:57:36.355051 2025] [:error] [pid 26519:tid 26523] [client 130.33.54.142:15116] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/index.php"] [unique_id "aTwRQM8TRgSGOeWqEhfyxQAAAAA"]
[Fri Dec 12 20:57:36.627214 2025] [:error] [pid 60649:tid 60659] [client 130.33.54.142:14534] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "aTwRQFOcUGKU3sgfHP_4VwAAAQc"]
[Fri Dec 12 20:57:37.140772 2025] [:error] [pid 26519:tid 26540] [client 130.33.54.142:15151] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "aTwRQc8TRgSGOeWqEhfyyAAAABE"]
[Fri Dec 12 20:57:37.445845 2025] [:error] [pid 26519:tid 26543] [client 130.33.54.142:14541] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "aTwRQc8TRgSGOeWqEhfyyQAAABQ"]
[Fri Dec 12 20:57:37.708582 2025] [:error] [pid 27950:tid 27973] [client 130.33.54.142:15164] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "aTwRQYVLRvkrdsSc1F2dlwAAAVU"]
[Fri Dec 12 20:57:38.118446 2025] [:error] [pid 26607:tid 26626] [client 130.33.54.142:14529] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aTwRQsb_b0tOEWTL2KmbigAAANE"]
[Fri Dec 12 20:57:38.615263 2025] [:error] [pid 27950:tid 27968] [client 130.33.54.142:15132] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aTwRQoVLRvkrdsSc1F2dmgAAAVA"]
[Fri Dec 12 20:57:38.919926 2025] [:error] [pid 26519:tid 26541] [client 130.33.54.142:15149] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aTwRQs8TRgSGOeWqEhfyzgAAABI"]
[Fri Dec 12 20:57:39.243797 2025] [:error] [pid 26607:tid 26610] [client 130.33.54.142:14550] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aTwRQ8b_b0tOEWTL2KmbjwAAAME"]
[Fri Dec 12 20:57:39.528379 2025] [:error] [pid 60649:tid 60658] [client 130.33.54.142:15140] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aTwRQ1OcUGKU3sgfHP_4WwAAAQY"]
[Fri Dec 12 20:57:39.955469 2025] [:error] [pid 60649:tid 60672] [client 130.33.54.142:14530] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aTwRQ1OcUGKU3sgfHP_4XAAAARQ"]
[Fri Dec 12 20:57:40.347756 2025] [:error] [pid 60649:tid 60674] [client 130.33.54.142:14566] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aTwRRFOcUGKU3sgfHP_4YAAAARY"]
[Fri Dec 12 20:57:40.940973 2025] [:error] [pid 26519:tid 26531] [client 130.33.54.142:15128] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aTwRRM8TRgSGOeWqEhfy0wAAAAg"]
[Fri Dec 12 20:57:41.404788 2025] [:error] [pid 27950:tid 27952] [client 130.33.54.142:14536] [client 130.33.54.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aTwRRYVLRvkrdsSc1F2dngAAAUA"]
[Fri Dec 12 20:57:41.685936 2025] [:error] [pid 60649:tid 60655] [client 130.33.54.142:15129] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/403.php"] [unique_id "aTwRRVOcUGKU3sgfHP_4YgAAAQM"]
[Fri Dec 12 20:57:41.977109 2025] [:error] [pid 55760:tid 55764] [client 130.33.54.142:15110] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/403.php"] [unique_id "aTwRRVObDQlftFDyGawPegAAAYI"]
[Fri Dec 12 20:57:42.417849 2025] [:error] [pid 26521:tid 26584] [client 130.33.54.142:15148] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/403.php"] [unique_id "aTwRRpdhcAPU617AKTB89QAAAIU"]
[Fri Dec 12 20:57:42.826787 2025] [:error] [pid 60649:tid 60664] [client 130.33.54.142:15118] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/403.php"] [unique_id "aTwRRlOcUGKU3sgfHP_4ZAAAAQw"]
[Fri Dec 12 20:57:43.088295 2025] [:error] [pid 26521:tid 26590] [client 130.33.54.142:15126] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aTwRR5dhcAPU617AKTB8-AAAAIs"]
[Fri Dec 12 20:57:43.495919 2025] [:error] [pid 26607:tid 26633] [client 130.33.54.142:14538] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aTwRR8b_b0tOEWTL2KmblQAAANg"]
[Fri Dec 12 20:57:43.839453 2025] [:error] [pid 26519:tid 26546] [client 130.33.54.142:15152] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aTwRR88TRgSGOeWqEhfy2gAAABc"]
[Fri Dec 12 20:57:44.170104 2025] [:error] [pid 26521:tid 26580] [client 130.33.54.142:15106] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aTwRSJdhcAPU617AKTB8-wAAAIE"]
[Fri Dec 12 20:57:44.521625 2025] [:error] [pid 26521:tid 26593] [client 130.33.54.142:14545] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aTwRSJdhcAPU617AKTB8_gAAAI4"]
[Fri Dec 12 20:57:44.967525 2025] [:error] [pid 26519:tid 26537] [client 130.33.54.142:14535] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aTwRSM8TRgSGOeWqEhfy3QAAAA4"]
[Fri Dec 12 20:57:45.274504 2025] [:error] [pid 60649:tid 60670] [client 130.33.54.142:15138] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aTwRSVOcUGKU3sgfHP_4aAAAARI"]
[Fri Dec 12 20:57:45.704692 2025] [:error] [pid 26520:tid 26576] [client 130.33.54.142:14555] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aTwRSUG_frlY5vNXu_D6DAAAAFg"]
[Fri Dec 12 20:57:46.081790 2025] [:error] [pid 26519:tid 26534] [client 130.33.54.142:14551] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aTwRSs8TRgSGOeWqEhfy4gAAAAs"]
[Fri Dec 12 20:57:46.419862 2025] [:error] [pid 26521:tid 26599] [client 130.33.54.142:14533] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aTwRSpdhcAPU617AKTB9BAAAAJQ"]
[Fri Dec 12 20:57:46.814530 2025] [:error] [pid 26520:tid 26555] [client 130.33.54.142:14548] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aTwRSkG_frlY5vNXu_D6DgAAAEM"]
[Fri Dec 12 20:57:47.095918 2025] [:error] [pid 26519:tid 26533] [client 130.33.54.142:14579] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aTwRS88TRgSGOeWqEhfy5AAAAAo"]
[Fri Dec 12 20:57:47.445999 2025] [:error] [pid 60649:tid 60667] [client 130.33.54.142:15147] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aTwRS1OcUGKU3sgfHP_4bgAAAQ8"]
[Fri Dec 12 20:57:47.882152 2025] [:error] [pid 26607:tid 26617] [client 130.33.54.142:14865] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aTwRS8b_b0tOEWTL2KmbngAAAMg"]
[Fri Dec 12 20:57:48.609768 2025] [:error] [pid 26607:tid 26626] [client 130.33.54.142:15165] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aTwRTMb_b0tOEWTL2KmbpQAAANE"]
[Fri Dec 12 20:57:48.866224 2025] [:error] [pid 26607:tid 26614] [client 130.33.54.142:15157] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aTwRTMb_b0tOEWTL2KmbqgAAAMU"]
[Fri Dec 12 20:57:49.231517 2025] [:error] [pid 60649:tid 60653] [client 130.33.54.142:15127] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aTwRTVOcUGKU3sgfHP_4igAAAQE"]
[Fri Dec 12 20:57:49.581459 2025] [:error] [pid 26607:tid 26623] [client 130.33.54.142:15130] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aTwRTcb_b0tOEWTL2KmbrgAAAM4"]
[Fri Dec 12 20:57:50.061842 2025] [:error] [pid 55760:tid 55771] [client 130.33.54.142:15142] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aTwRTlObDQlftFDyGawPggAAAYk"]
[Fri Dec 12 20:57:50.307716 2025] [:error] [pid 26521:tid 26585] [client 130.33.54.142:14877] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aTwRTpdhcAPU617AKTB9MgAAAIY"]
[Fri Dec 12 20:57:50.583754 2025] [:error] [pid 55760:tid 55762] [client 130.33.54.142:15136] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aTwRTlObDQlftFDyGawPhQAAAYA"]
[Fri Dec 12 20:57:51.282996 2025] [:error] [pid 26607:tid 26629] [client 130.33.54.142:15120] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aTwRT8b_b0tOEWTL2KmbsAAAANQ"]
[Fri Dec 12 20:57:51.666470 2025] [:error] [pid 27950:tid 27957] [client 130.33.54.142:14855] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aTwRT4VLRvkrdsSc1F2dqQAAAUU"]
[Fri Dec 12 20:57:51.928531 2025] [:error] [pid 26520:tid 26553] [client 130.33.54.142:15150] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aTwRT0G_frlY5vNXu_D6FwAAAEE"]
[Fri Dec 12 20:57:52.266471 2025] [:error] [pid 60649:tid 60661] [client 130.33.54.142:14572] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aTwRUFOcUGKU3sgfHP_4owAAAQk"]
[Fri Dec 12 20:57:52.529150 2025] [:error] [pid 60649:tid 60676] [client 130.33.54.142:14581] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aTwRUFOcUGKU3sgfHP_4pQAAARg"]
[Fri Dec 12 20:57:52.968895 2025] [:error] [pid 26519:tid 26524] [client 130.33.54.142:15167] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aTwRUM8TRgSGOeWqEhfzNAAAAAE"]
[Fri Dec 12 20:57:53.382927 2025] [:error] [pid 55760:tid 55785] [client 130.33.54.142:14544] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aTwRUVObDQlftFDyGawPhwAAAZc"]
[Fri Dec 12 20:57:53.664010 2025] [:error] [pid 27950:tid 27976] [client 130.33.54.142:14560] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aTwRUYVLRvkrdsSc1F2drAAAAVg"]
[Fri Dec 12 20:57:53.901647 2025] [:error] [pid 60649:tid 60665] [client 130.33.54.142:15117] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aTwRUVOcUGKU3sgfHP_4pwAAAQ0"]
[Fri Dec 12 20:57:54.184842 2025] [:error] [pid 27950:tid 27963] [client 130.33.54.142:14557] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aTwRUoVLRvkrdsSc1F2drwAAAUs"]
[Fri Dec 12 20:57:54.533698 2025] [:error] [pid 26521:tid 26583] [client 130.33.54.142:14554] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aTwRUpdhcAPU617AKTB9OAAAAIQ"]
[Fri Dec 12 20:57:54.983567 2025] [:error] [pid 26519:tid 26535] [client 130.33.54.142:14540] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cron.php"] [unique_id "aTwRUs8TRgSGOeWqEhfzNQAAAAw"]
[Fri Dec 12 20:57:55.302197 2025] [:error] [pid 27950:tid 27962] [client 130.33.54.142:14875] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cron.php"] [unique_id "aTwRU4VLRvkrdsSc1F2dswAAAUo"]
[Fri Dec 12 20:57:55.627157 2025] [:error] [pid 26521:tid 26594] [client 130.33.54.142:14851] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cron.php"] [unique_id "aTwRU5dhcAPU617AKTB9OgAAAI8"]
[Fri Dec 12 20:57:55.923236 2025] [:error] [pid 26521:tid 26596] [client 130.33.54.142:14856] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cron.php"] [unique_id "aTwRU5dhcAPU617AKTB9OwAAAJE"]
[Fri Dec 12 20:57:56.244115 2025] [:error] [pid 26519:tid 26537] [client 130.33.54.142:14558] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yanz.php"] [unique_id "aTwRVM8TRgSGOeWqEhfzNwAAAA4"]
[Fri Dec 12 20:57:56.567355 2025] [:error] [pid 26521:tid 26580] [client 130.33.54.142:15162] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yanz.php"] [unique_id "aTwRVJdhcAPU617AKTB9PQAAAIE"]
[Fri Dec 12 20:57:56.884687 2025] [:error] [pid 26519:tid 26545] [client 130.33.54.142:14889] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yanz.php"] [unique_id "aTwRVM8TRgSGOeWqEhfzOQAAABY"]
[Fri Dec 12 20:57:57.128527 2025] [:error] [pid 26521:tid 26595] [client 130.33.54.142:14589] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yanz.php"] [unique_id "aTwRVZdhcAPU617AKTB9QAAAAJA"]
[Fri Dec 12 20:57:57.379725 2025] [:error] [pid 55760:tid 55776] [client 130.33.54.142:14899] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.php"] [unique_id "aTwRVVObDQlftFDyGawPjAAAAY4"]
[Fri Dec 12 20:57:57.768520 2025] [:error] [pid 55760:tid 55764] [client 130.33.54.142:14549] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.php"] [unique_id "aTwRVVObDQlftFDyGawPjQAAAYI"]
[Fri Dec 12 20:57:58.413242 2025] [:error] [pid 26519:tid 26531] [client 130.33.54.142:15114] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.php"] [unique_id "aTwRVs8TRgSGOeWqEhfzPAAAAAg"]
[Fri Dec 12 20:57:58.820591 2025] [:error] [pid 26607:tid 26614] [client 130.33.54.142:14573] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.php"] [unique_id "aTwRVsb_b0tOEWTL2KmbtwAAAMU"]
[Fri Dec 12 20:57:59.115950 2025] [:error] [pid 26607:tid 26616] [client 130.33.54.142:15115] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/network.php"] [unique_id "aTwRV8b_b0tOEWTL2KmbuQAAAMc"]
[Fri Dec 12 20:57:59.395561 2025] [:error] [pid 55760:tid 55772] [client 130.33.54.142:15109] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/network.php"] [unique_id "aTwRV1ObDQlftFDyGawPjwAAAYo"]
[Fri Dec 12 20:57:59.730808 2025] [:error] [pid 55760:tid 55771] [client 130.33.54.142:15159] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/network.php"] [unique_id "aTwRV1ObDQlftFDyGawPkAAAAYk"]
[Fri Dec 12 20:58:00.035695 2025] [:error] [pid 26520:tid 26555] [client 130.33.54.142:14577] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/network.php"] [unique_id "aTwRWEG_frlY5vNXu_D6HAAAAEM"]
[Fri Dec 12 20:58:00.352844 2025] [:error] [pid 26519:tid 26547] [client 130.33.54.142:14574] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-2019.php"] [unique_id "aTwRWM8TRgSGOeWqEhfzPwAAABg"]
[Fri Dec 12 20:58:00.776474 2025] [:error] [pid 26521:tid 26601] [client 130.33.54.142:14848] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-2019.php"] [unique_id "aTwRWJdhcAPU617AKTB9SAAAAJY"]
[Fri Dec 12 20:58:01.176399 2025] [:error] [pid 26519:tid 26542] [client 130.33.54.142:14562] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-2019.php"] [unique_id "aTwRWc8TRgSGOeWqEhfzQAAAABM"]
[Fri Dec 12 20:58:01.525437 2025] [:error] [pid 26607:tid 26623] [client 130.33.54.142:14531] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-2019.php"] [unique_id "aTwRWcb_b0tOEWTL2KmbuwAAAM4"]
[Fri Dec 12 20:58:01.895894 2025] [:error] [pid 26521:tid 26584] [client 130.33.54.142:14569] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bypass.php"] [unique_id "aTwRWZdhcAPU617AKTB9TQAAAIU"]
[Fri Dec 12 20:58:02.230330 2025] [:error] [pid 26521:tid 26581] [client 130.33.54.142:14854] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bypass.php"] [unique_id "aTwRWpdhcAPU617AKTB9TwAAAII"]
[Fri Dec 12 20:58:02.617953 2025] [:error] [pid 26519:tid 26532] [client 130.33.54.142:14801] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bypass.php"] [unique_id "aTwRWs8TRgSGOeWqEhfzQgAAAAk"]
[Fri Dec 12 20:58:02.946302 2025] [:error] [pid 26520:tid 26554] [client 130.33.54.142:15107] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bypass.php"] [unique_id "aTwRWkG_frlY5vNXu_D6HQAAAEI"]
[Fri Dec 12 20:58:03.246040 2025] [:error] [pid 26519:tid 26528] [client 130.33.54.142:14850] [client 130.33.54.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aTwRW88TRgSGOeWqEhfzQwAAAAU"]
[Fri Dec 12 20:58:03.532513 2025] [:error] [pid 26607:tid 26619] [client 130.33.54.142:14588] [client 130.33.54.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aTwRW8b_b0tOEWTL2KmbwAAAAMo"]
[Fri Dec 12 20:58:03.878893 2025] [:error] [pid 26607:tid 26618] [client 130.33.54.142:14559] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "aTwRW8b_b0tOEWTL2KmbwgAAAMk"]
[Fri Dec 12 20:58:04.215125 2025] [:error] [pid 26521:tid 26598] [client 130.33.54.142:15158] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "aTwRXJdhcAPU617AKTB9UgAAAJM"]
[Fri Dec 12 20:58:04.451677 2025] [:error] [pid 26607:tid 26615] [client 130.33.54.142:14879] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "aTwRXMb_b0tOEWTL2KmbwwAAAMY"]
[Fri Dec 12 20:58:04.784607 2025] [:error] [pid 26519:tid 26543] [client 130.33.54.142:14571] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock.php"] [unique_id "aTwRXM8TRgSGOeWqEhfzRgAAABQ"]
[Fri Dec 12 20:58:05.079216 2025] [:error] [pid 26521:tid 26601] [client 130.33.54.142:14859] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock.php"] [unique_id "aTwRXZdhcAPU617AKTB9UwAAAJY"]
[Fri Dec 12 20:58:05.394679 2025] [:error] [pid 26521:tid 26602] [client 130.33.54.142:15112] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock.php"] [unique_id "aTwRXZdhcAPU617AKTB9VAAAAJc"]
[Fri Dec 12 20:58:05.723410 2025] [:error] [pid 26607:tid 26627] [client 130.33.54.142:14784] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock.php"] [unique_id "aTwRXcb_b0tOEWTL2KmbxAAAANI"]
[Fri Dec 12 20:58:06.100655 2025] [:error] [pid 26521:tid 26580] [client 130.33.54.142:15160] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aTwRXpdhcAPU617AKTB9VgAAAIE"]
[Fri Dec 12 20:58:06.411342 2025] [:error] [pid 27950:tid 27952] [client 130.33.54.142:15111] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aTwRXoVLRvkrdsSc1F2duQAAAUA"]
[Fri Dec 12 20:58:06.780287 2025] [:error] [pid 26521:tid 26603] [client 130.33.54.142:14590] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aTwRXpdhcAPU617AKTB9VwAAAJg"]
[Fri Dec 12 20:58:07.057826 2025] [:error] [pid 27950:tid 27961] [client 130.33.54.142:14863] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aTwRX4VLRvkrdsSc1F2dvAAAAUk"]
[Fri Dec 12 20:58:07.379839 2025] [:error] [pid 26607:tid 26622] [client 130.33.54.142:14910] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/system_log.php"] [unique_id "aTwRX8b_b0tOEWTL2KmbxgAAAM0"]
[Fri Dec 12 20:58:07.720101 2025] [:error] [pid 27950:tid 27954] [client 130.33.54.142:14895] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/system_log.php"] [unique_id "aTwRX4VLRvkrdsSc1F2dvgAAAUI"]
[Fri Dec 12 20:58:08.132808 2025] [:error] [pid 27950:tid 27968] [client 130.33.54.142:15153] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/system_log.php"] [unique_id "aTwRYIVLRvkrdsSc1F2dvwAAAVA"]
[Fri Dec 12 20:58:08.466984 2025] [:error] [pid 27950:tid 27972] [client 130.33.54.142:14583] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/system_log.php"] [unique_id "aTwRYIVLRvkrdsSc1F2dwQAAAVQ"]
[Fri Dec 12 20:58:08.835868 2025] [:error] [pid 26607:tid 26619] [client 130.33.54.142:14538] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aTwRYMb_b0tOEWTL2KmbyQAAAMo"]
[Fri Dec 12 20:58:09.115891 2025] [:error] [pid 26521:tid 26589] [client 130.33.54.142:14564] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aTwRYZdhcAPU617AKTB9WgAAAIo"]
[Fri Dec 12 20:58:09.403036 2025] [:error] [pid 60649:tid 60668] [client 130.33.54.142:15124] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aTwRYVOcUGKU3sgfHP_4sgAAARA"]
[Fri Dec 12 20:58:09.664333 2025] [:error] [pid 26521:tid 26596] [client 130.33.54.142:14803] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aTwRYZdhcAPU617AKTB9XAAAAJE"]
[Fri Dec 12 20:58:09.935229 2025] [:error] [pid 26519:tid 26533] [client 130.33.54.142:15161] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aTwRYc8TRgSGOeWqEhfzSAAAAAo"]
[Fri Dec 12 20:58:10.225709 2025] [:error] [pid 26607:tid 26620] [client 130.33.54.142:15144] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aTwRYsb_b0tOEWTL2KmbzAAAAMs"]
[Fri Dec 12 20:58:10.563661 2025] [:error] [pid 27950:tid 27973] [client 130.33.54.142:14870] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aTwRYoVLRvkrdsSc1F2dxAAAAVU"]
[Fri Dec 12 20:58:10.845965 2025] [:error] [pid 26520:tid 26566] [client 130.33.54.142:14537] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aTwRYkG_frlY5vNXu_D6JwAAAE4"]
[Fri Dec 12 20:58:11.152358 2025] [:error] [pid 60649:tid 60675] [client 130.33.54.142:14554] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aTwRY1OcUGKU3sgfHP_4tgAAARc"]
[Fri Dec 12 20:58:11.404194 2025] [:error] [pid 26607:tid 26632] [client 130.33.54.142:14567] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aTwRY8b_b0tOEWTL2KmbzQAAANc"]
[Fri Dec 12 20:58:11.718328 2025] [:error] [pid 27950:tid 27976] [client 130.33.54.142:14586] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aTwRY4VLRvkrdsSc1F2dxgAAAVg"]
[Fri Dec 12 20:58:11.988890 2025] [:error] [pid 27950:tid 27963] [client 130.33.54.142:14878] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aTwRY4VLRvkrdsSc1F2dygAAAUs"]
[Fri Dec 12 20:58:12.407934 2025] [:error] [pid 26519:tid 26547] [client 130.33.54.142:15133] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aTwRZM8TRgSGOeWqEhfzSwAAABg"]
[Fri Dec 12 20:58:12.730117 2025] [:error] [pid 26607:tid 26618] [client 130.33.54.142:14852] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aTwRZMb_b0tOEWTL2KmbzwAAAMk"]
[Fri Dec 12 20:58:13.054184 2025] [:error] [pid 26520:tid 26573] [client 130.33.54.142:14563] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aTwRZUG_frlY5vNXu_D6KwAAAFU"]
[Fri Dec 12 20:58:13.376747 2025] [:error] [pid 26519:tid 26523] [client 130.33.54.142:14902] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-pridmag/init.php"] [unique_id "aTwRZc8TRgSGOeWqEhfzTAAAAAA"]
[Fri Dec 12 20:58:13.777973 2025] [:error] [pid 26519:tid 26529] [client 130.33.54.142:14893] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aTwRZc8TRgSGOeWqEhfzTQAAAAY"]
[Fri Dec 12 20:58:14.028792 2025] [:error] [pid 26520:tid 26562] [client 130.33.54.142:14862] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aTwRZkG_frlY5vNXu_D6LwAAAEo"]
[Fri Dec 12 20:58:14.516779 2025] [:error] [pid 26519:tid 26542] [client 130.33.54.142:14542] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aTwRZs8TRgSGOeWqEhfzTgAAABM"]
[Fri Dec 12 20:58:14.885811 2025] [:error] [pid 26519:tid 26532] [client 130.33.54.142:14815] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aTwRZs8TRgSGOeWqEhfzTwAAAAk"]
[Fri Dec 12 20:58:15.214815 2025] [:error] [pid 26521:tid 26580] [client 130.33.54.142:14823] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/pwnd/as.php"] [unique_id "aTwRZ5dhcAPU617AKTB9YQAAAIE"]
[Fri Dec 12 20:58:15.530603 2025] [:error] [pid 55760:tid 55767] [client 130.33.54.142:14858] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/pwnd/as.php"] [unique_id "aTwRZ1ObDQlftFDyGawPnwAAAYU"]
[Fri Dec 12 20:58:15.854222 2025] [:error] [pid 60649:tid 60669] [client 130.33.54.142:14570] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/pwnd/as.php"] [unique_id "aTwRZ1OcUGKU3sgfHP_4ugAAARE"]
[Fri Dec 12 20:58:16.151466 2025] [:error] [pid 55760:tid 55776] [client 130.33.54.142:14539] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/pwnd/as.php"] [unique_id "aTwRaFObDQlftFDyGawPoQAAAY4"]
[Fri Dec 12 20:58:16.531594 2025] [:error] [pid 27950:tid 27972] [client 130.33.54.142:14565] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-configs.php"] [unique_id "aTwRaIVLRvkrdsSc1F2dzwAAAVQ"]
[Fri Dec 12 20:58:16.900268 2025] [:error] [pid 55760:tid 55779] [client 130.33.54.142:14834] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-configs.php"] [unique_id "aTwRaFObDQlftFDyGawPowAAAZE"]
[Fri Dec 12 20:58:17.210069 2025] [:error] [pid 26521:tid 26581] [client 130.33.54.142:14464] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-configs.php"] [unique_id "aTwRaZdhcAPU617AKTB9YwAAAII"]
[Fri Dec 12 20:58:17.592898 2025] [:error] [pid 60649:tid 60666] [client 130.33.54.142:14824] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-configs.php"] [unique_id "aTwRaVOcUGKU3sgfHP_4vQAAAQ4"]
[Fri Dec 12 20:58:17.936913 2025] [:error] [pid 60649:tid 60662] [client 130.33.54.142:14585] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aTwRaVOcUGKU3sgfHP_4vgAAAQo"]
[Fri Dec 12 20:58:18.480211 2025] [:error] [pid 26607:tid 26610] [client 130.33.54.142:14853] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aTwRasb_b0tOEWTL2Kmb1wAAAME"]
[Fri Dec 12 20:58:18.886170 2025] [:error] [pid 26521:tid 26579] [client 130.33.54.142:14546] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aTwRapdhcAPU617AKTB9ZgAAAIA"]
[Fri Dec 12 20:58:19.236031 2025] [:error] [pid 26519:tid 26544] [client 130.33.54.142:15108] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aTwRa88TRgSGOeWqEhfzWAAAABU"]
[Fri Dec 12 20:58:19.510608 2025] [:error] [pid 55760:tid 55778] [client 130.33.54.142:15137] [client 130.33.54.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/zmFM.php"] [unique_id "aTwRa1ObDQlftFDyGawPpwAAAZA"]
[Fri Dec 12 20:58:19.841525 2025] [:error] [pid 26521:tid 26590] [client 130.33.54.142:14578] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aTwRa5dhcAPU617AKTB9ZwAAAIs"]
[Fri Dec 12 20:58:20.123587 2025] [:error] [pid 26520:tid 26576] [client 130.33.54.142:14787] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aTwRbEG_frlY5vNXu_D6MwAAAFg"]
[Fri Dec 12 20:58:20.499242 2025] [:error] [pid 26519:tid 26541] [client 130.33.54.142:14904] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aTwRbM8TRgSGOeWqEhfzWQAAABI"]
[Fri Dec 12 20:58:20.813058 2025] [:error] [pid 26521:tid 26589] [client 130.33.54.142:14884] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/fucku.php"] [unique_id "aTwRbJdhcAPU617AKTB9aAAAAIo"]
[Fri Dec 12 20:58:21.113848 2025] [:error] [pid 26607:tid 26624] [client 130.33.54.142:14866] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/fucku.php"] [unique_id "aTwRbcb_b0tOEWTL2Kmb2gAAAM8"]
[Fri Dec 12 20:58:21.443397 2025] [:error] [pid 27950:tid 27974] [client 130.33.54.142:14552] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/fucku.php"] [unique_id "aTwRbYVLRvkrdsSc1F2d1QAAAVY"]
[Fri Dec 12 20:58:22.079611 2025] [:error] [pid 26521:tid 26588] [client 130.33.54.142:14811] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/fucku.php"] [unique_id "aTwRbpdhcAPU617AKTB9bAAAAIk"]
[Fri Dec 12 20:58:22.349667 2025] [:error] [pid 26521:tid 26592] [client 130.33.54.142:14896] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/wp-info.php"] [unique_id "aTwRbpdhcAPU617AKTB9bQAAAI0"]
[Fri Dec 12 20:58:22.942989 2025] [:error] [pid 26607:tid 26627] [client 130.33.54.142:14849] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/wp-info.php"] [unique_id "aTwRbsb_b0tOEWTL2Kmb3AAAANI"]
[Fri Dec 12 20:58:23.375840 2025] [:error] [pid 60649:tid 60659] [client 130.33.54.142:14883] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/wp-info.php"] [unique_id "aTwRb1OcUGKU3sgfHP_4wQAAAQc"]
[Fri Dec 12 20:58:23.751047 2025] [:error] [pid 26607:tid 26630] [client 130.33.54.142:14798] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/wp-info.php"] [unique_id "aTwRb8b_b0tOEWTL2Kmb4AAAANU"]
[Fri Dec 12 20:58:24.025492 2025] [:error] [pid 60649:tid 60665] [client 130.33.54.142:14799] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/post.php"] [unique_id "aTwRcFOcUGKU3sgfHP_4wwAAAQ0"]
[Fri Dec 12 20:58:24.305666 2025] [:error] [pid 60649:tid 60671] [client 130.33.54.142:14908] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/post.php"] [unique_id "aTwRcFOcUGKU3sgfHP_4xAAAARM"]
[Fri Dec 12 20:58:24.583597 2025] [:error] [pid 26520:tid 26572] [client 130.33.54.142:14582] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/post.php"] [unique_id "aTwRcEG_frlY5vNXu_D6OQAAAFQ"]
[Fri Dec 12 20:58:24.945341 2025] [:error] [pid 26607:tid 26614] [client 130.33.54.142:15135] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/post.php"] [unique_id "aTwRcMb_b0tOEWTL2Kmb5QAAAMU"]
[Fri Dec 12 20:58:25.373912 2025] [:error] [pid 26519:tid 26540] [client 130.33.54.142:14900] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aTwRcc8TRgSGOeWqEhfzXQAAABE"]
[Fri Dec 12 20:58:25.649648 2025] [:error] [pid 26521:tid 26599] [client 130.33.54.142:14821] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aTwRcZdhcAPU617AKTB9fgAAAJQ"]
[Fri Dec 12 20:58:25.950178 2025] [:error] [pid 26607:tid 26618] [client 130.33.54.142:15109] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aTwRccb_b0tOEWTL2Kmb7wAAAMk"]
[Fri Dec 12 20:58:26.225254 2025] [:error] [pid 26519:tid 26530] [client 130.33.54.142:14894] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aTwRcs8TRgSGOeWqEhfzXwAAAAc"]
[Fri Dec 12 20:58:26.618714 2025] [:error] [pid 26607:tid 26627] [client 130.33.54.142:14575] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/loads.PhP"] [unique_id "aTwRcsb_b0tOEWTL2Kmb8AAAANI"]
[Fri Dec 12 20:58:26.906710 2025] [:error] [pid 26520:tid 26567] [client 130.33.54.142:14888] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/loads.PhP"] [unique_id "aTwRckG_frlY5vNXu_D6PAAAAE8"]
[Fri Dec 12 20:58:27.155379 2025] [:error] [pid 26520:tid 26568] [client 130.33.54.142:14797] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/loads.PhP"] [unique_id "aTwRc0G_frlY5vNXu_D6PQAAAFA"]
[Fri Dec 12 20:58:27.424339 2025] [:error] [pid 27950:tid 27960] [client 130.33.54.142:14839] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/loads.PhP"] [unique_id "aTwRc4VLRvkrdsSc1F2d1wAAAUg"]
[Fri Dec 12 20:58:27.684264 2025] [:error] [pid 27950:tid 27973] [client 130.33.54.142:14864] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mj.php"] [unique_id "aTwRc4VLRvkrdsSc1F2d2QAAAVU"]
[Fri Dec 12 20:58:27.996571 2025] [:error] [pid 27950:tid 27971] [client 130.33.54.142:14871] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mj.php"] [unique_id "aTwRc4VLRvkrdsSc1F2d3AAAAVM"]
[Fri Dec 12 20:58:28.303562 2025] [:error] [pid 26520:tid 26557] [client 130.33.54.142:14891] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mj.php"] [unique_id "aTwRdEG_frlY5vNXu_D6QQAAAEU"]
[Fri Dec 12 20:58:28.542499 2025] [:error] [pid 26521:tid 26581] [client 130.33.54.142:14845] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mj.php"] [unique_id "aTwRdJdhcAPU617AKTB9hAAAAII"]
[Fri Dec 12 20:58:28.771312 2025] [:error] [pid 26521:tid 26591] [client 130.33.54.142:14813] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dichku.php"] [unique_id "aTwRdJdhcAPU617AKTB9hgAAAIw"]
[Fri Dec 12 20:58:29.134697 2025] [:error] [pid 60649:tid 60667] [client 130.33.54.142:14812] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dichku.php"] [unique_id "aTwRdVOcUGKU3sgfHP_45QAAAQ8"]
[Fri Dec 12 20:58:29.369460 2025] [:error] [pid 27950:tid 27974] [client 130.33.54.142:14897] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dichku.php"] [unique_id "aTwRdYVLRvkrdsSc1F2d3wAAAVY"]
[Fri Dec 12 20:58:29.655567 2025] [:error] [pid 27950:tid 27975] [client 130.33.54.142:15141] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dichku.php"] [unique_id "aTwRdYVLRvkrdsSc1F2d4gAAAVc"]
[Fri Dec 12 20:58:29.966866 2025] [:error] [pid 26520:tid 26553] [client 130.33.54.142:14867] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zsz.php"] [unique_id "aTwRdUG_frlY5vNXu_D6RwAAAEE"]
[Fri Dec 12 20:58:30.260774 2025] [:error] [pid 60649:tid 60652] [client 130.33.54.142:15104] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zsz.php"] [unique_id "aTwRdlOcUGKU3sgfHP_45wAAAQA"]
[Fri Dec 12 20:58:30.546572 2025] [:error] [pid 26521:tid 26596] [client 130.33.54.142:14468] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zsz.php"] [unique_id "aTwRdpdhcAPU617AKTB9iAAAAJE"]
[Fri Dec 12 20:58:30.888251 2025] [:error] [pid 26521:tid 26588] [client 130.33.54.142:14561] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zsz.php"] [unique_id "aTwRdpdhcAPU617AKTB9igAAAIk"]
[Fri Dec 12 20:58:39.998063 2025] [:error] [pid 60649:tid 60668] [client 130.33.54.142:14499] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aTwRf1OcUGKU3sgfHP_5BAAAARA"]
[Fri Dec 12 20:58:40.271760 2025] [:error] [pid 27950:tid 27962] [client 130.33.54.142:14480] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aTwRgIVLRvkrdsSc1F2d6QAAAUo"]
[Fri Dec 12 20:58:40.549767 2025] [:error] [pid 26519:tid 26541] [client 130.33.54.142:14493] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aTwRgM8TRgSGOeWqEhfzbgAAABI"]
[Fri Dec 12 20:58:40.905284 2025] [:error] [pid 27950:tid 27952] [client 130.33.54.142:14810] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aTwRgIVLRvkrdsSc1F2d6wAAAUA"]
[Fri Dec 12 20:58:41.299406 2025] [:error] [pid 26520:tid 26568] [client 130.33.54.142:14553] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mc.php"] [unique_id "aTwRgUG_frlY5vNXu_D6UQAAAFA"]
[Fri Dec 12 20:58:41.703582 2025] [:error] [pid 26521:tid 26584] [client 130.33.54.142:14802] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mc.php"] [unique_id "aTwRgZdhcAPU617AKTB9mgAAAIU"]
[Fri Dec 12 20:58:42.175615 2025] [:error] [pid 55760:tid 55769] [client 130.33.54.142:14880] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mc.php"] [unique_id "aTwRglObDQlftFDyGawPuwAAAYc"]
[Fri Dec 12 20:58:42.506055 2025] [:error] [pid 55760:tid 55777] [client 130.33.54.142:14892] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mc.php"] [unique_id "aTwRglObDQlftFDyGawPvAAAAY8"]
[Fri Dec 12 20:58:42.760942 2025] [:error] [pid 27950:tid 27972] [client 130.33.54.142:14800] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/article.php"] [unique_id "aTwRgoVLRvkrdsSc1F2d7AAAAVQ"]
[Fri Dec 12 20:58:43.082661 2025] [:error] [pid 55760:tid 55781] [client 130.33.54.142:14869] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/article.php"] [unique_id "aTwRg1ObDQlftFDyGawPwAAAAZM"]
[Fri Dec 12 20:58:43.352874 2025] [:error] [pid 26520:tid 26554] [client 130.33.54.142:14822] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/article.php"] [unique_id "aTwRg0G_frlY5vNXu_D6VAAAAEI"]
[Fri Dec 12 20:58:43.683827 2025] [:error] [pid 26521:tid 26586] [client 130.33.54.142:15115] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/article.php"] [unique_id "aTwRg5dhcAPU617AKTB9ogAAAIc"]
[Fri Dec 12 20:58:44.311783 2025] [:error] [pid 26521:tid 26602] [client 130.33.54.142:14580] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aTwRhJdhcAPU617AKTB9pQAAAJc"]
[Fri Dec 12 20:58:44.908321 2025] [:error] [pid 55760:tid 55767] [client 130.33.54.142:14795] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aTwRhFObDQlftFDyGawPwgAAAYU"]
[Fri Dec 12 20:58:45.411994 2025] [:error] [pid 60649:tid 60675] [client 130.33.54.142:14806] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aTwRhVOcUGKU3sgfHP_5BwAAARc"]
[Fri Dec 12 20:58:45.754683 2025] [:error] [pid 26521:tid 26603] [client 130.33.54.142:14568] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aTwRhZdhcAPU617AKTB9qAAAAJg"]
[Fri Dec 12 20:58:46.035953 2025] [:error] [pid 60649:tid 60671] [client 130.33.54.142:14846] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff.php"] [unique_id "aTwRhlOcUGKU3sgfHP_5CAAAARM"]
[Fri Dec 12 20:58:46.377983 2025] [:error] [pid 55760:tid 55775] [client 130.33.54.142:14827] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff.php"] [unique_id "aTwRhlObDQlftFDyGawPxQAAAY0"]
[Fri Dec 12 20:58:46.724329 2025] [:error] [pid 26520:tid 26560] [client 130.33.54.142:14837] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff.php"] [unique_id "aTwRhkG_frlY5vNXu_D6VwAAAEg"]
[Fri Dec 12 20:58:47.100266 2025] [:error] [pid 26521:tid 26591] [client 130.33.54.142:15134] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff.php"] [unique_id "aTwRh5dhcAPU617AKTB9rgAAAIw"]
[Fri Dec 12 20:58:47.391425 2025] [:error] [pid 26521:tid 26590] [client 130.33.54.142:14861] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/if.php"] [unique_id "aTwRh5dhcAPU617AKTB9sAAAAIs"]
[Fri Dec 12 20:58:47.838893 2025] [:error] [pid 60649:tid 60663] [client 130.33.54.142:14807] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/if.php"] [unique_id "aTwRh1OcUGKU3sgfHP_5CwAAAQs"]
[Fri Dec 12 20:58:48.172664 2025] [:error] [pid 26607:tid 26618] [client 130.33.54.142:14901] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/if.php"] [unique_id "aTwRiMb_b0tOEWTL2KmcAgAAAMk"]
[Fri Dec 12 20:58:48.490776 2025] [:error] [pid 27950:tid 27976] [client 130.33.54.142:15123] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/if.php"] [unique_id "aTwRiIVLRvkrdsSc1F2d7wAAAVg"]
[Fri Dec 12 20:58:48.823794 2025] [:error] [pid 55760:tid 55774] [client 130.33.54.142:14874] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aTwRiFObDQlftFDyGawPyQAAAYw"]
[Fri Dec 12 20:58:49.134714 2025] [:error] [pid 27950:tid 27974] [client 130.33.54.142:14489] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aTwRiYVLRvkrdsSc1F2d8AAAAVY"]
[Fri Dec 12 20:58:49.430992 2025] [:error] [pid 55760:tid 55771] [client 130.33.54.142:14788] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aTwRiVObDQlftFDyGawPywAAAYk"]
[Fri Dec 12 20:58:49.756985 2025] [:error] [pid 55760:tid 55762] [client 130.33.54.142:14473] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aTwRiVObDQlftFDyGawPzQAAAYA"]
[Fri Dec 12 20:58:50.149445 2025] [:error] [pid 26519:tid 26540] [client 130.33.54.142:14543] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ini.php"] [unique_id "aTwRis8TRgSGOeWqEhfzcwAAABE"]
[Fri Dec 12 20:58:50.533623 2025] [:error] [pid 60649:tid 60658] [client 130.33.54.142:14890] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ini.php"] [unique_id "aTwRilOcUGKU3sgfHP_5DQAAAQY"]
[Fri Dec 12 20:58:50.805676 2025] [:error] [pid 60649:tid 60673] [client 130.33.54.142:14344] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ini.php"] [unique_id "aTwRilOcUGKU3sgfHP_5DgAAARU"]
[Fri Dec 12 20:58:51.181154 2025] [:error] [pid 26521:tid 26589] [client 130.33.54.142:14847] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ini.php"] [unique_id "aTwRi5dhcAPU617AKTB9twAAAIo"]
[Fri Dec 12 20:58:51.433727 2025] [:error] [pid 26521:tid 26587] [client 130.33.54.142:14829] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geck.php"] [unique_id "aTwRi5dhcAPU617AKTB9uQAAAIg"]
[Fri Dec 12 20:58:51.754505 2025] [:error] [pid 55760:tid 55766] [client 130.33.54.142:14857] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geck.php"] [unique_id "aTwRi1ObDQlftFDyGawP0QAAAYQ"]
[Fri Dec 12 20:58:52.118683 2025] [:error] [pid 26521:tid 26592] [client 130.33.54.142:15156] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geck.php"] [unique_id "aTwRjJdhcAPU617AKTB9uwAAAI0"]
[Fri Dec 12 20:58:52.464898 2025] [:error] [pid 26519:tid 26543] [client 130.33.54.142:14860] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geck.php"] [unique_id "aTwRjM8TRgSGOeWqEhfzdwAAABQ"]
[Fri Dec 12 20:58:52.889448 2025] [:error] [pid 26520:tid 26570] [client 130.33.54.142:14547] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/avaa.php"] [unique_id "aTwRjEG_frlY5vNXu_D6WgAAAFI"]
[Fri Dec 12 20:58:53.179092 2025] [:error] [pid 55760:tid 55775] [client 130.33.54.142:14786] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/avaa.php"] [unique_id "aTwRjVObDQlftFDyGawP0wAAAY0"]
[Fri Dec 12 20:58:53.472629 2025] [:error] [pid 55760:tid 55784] [client 130.33.54.142:14517] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/avaa.php"] [unique_id "aTwRjVObDQlftFDyGawP1AAAAZY"]
[Fri Dec 12 20:58:53.734087 2025] [:error] [pid 26521:tid 26589] [client 130.33.54.142:14881] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/avaa.php"] [unique_id "aTwRjZdhcAPU617AKTB9vgAAAIo"]
[Fri Dec 12 20:58:54.027516 2025] [:error] [pid 26519:tid 26545] [client 130.33.54.142:14816] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yanz.php"] [unique_id "aTwRjs8TRgSGOeWqEhfzeQAAABY"]
[Fri Dec 12 20:58:54.381387 2025] [:error] [pid 27950:tid 27954] [client 130.33.54.142:14909] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yanz.php"] [unique_id "aTwRjoVLRvkrdsSc1F2d8wAAAUI"]
[Fri Dec 12 20:58:54.874444 2025] [:error] [pid 60649:tid 60652] [client 130.33.54.142:14484] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yanz.php"] [unique_id "aTwRjlOcUGKU3sgfHP_5EQAAAQA"]
[Fri Dec 12 20:58:55.236108 2025] [:error] [pid 27950:tid 27958] [client 130.33.54.142:14868] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yanz.php"] [unique_id "aTwRj4VLRvkrdsSc1F2d9gAAAUY"]
[Fri Dec 12 20:58:55.590022 2025] [:error] [pid 26521:tid 26590] [client 130.33.54.142:15122] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bypass.php"] [unique_id "aTwRj5dhcAPU617AKTB9wAAAAIs"]
[Fri Dec 12 20:58:55.875054 2025] [:error] [pid 26521:tid 26583] [client 130.33.54.142:14479] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bypass.php"] [unique_id "aTwRj5dhcAPU617AKTB9wQAAAIQ"]
[Fri Dec 12 20:58:56.446917 2025] [:error] [pid 26521:tid 26592] [client 130.33.54.142:15161] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bypass.php"] [unique_id "aTwRkJdhcAPU617AKTB9wwAAAI0"]
[Fri Dec 12 20:58:56.804260 2025] [:error] [pid 26607:tid 26610] [client 130.33.54.142:14505] [client 130.33.54.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bypass.php"] [unique_id "aTwRkMb_b0tOEWTL2KmcDQAAAME"]
[Fri Dec 12 20:58:57.316015 2025] [:error] [pid 60649:tid 60668] [client 130.33.54.142:14514] [client 130.33.54.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rk2.php"] [unique_id "aTwRkVOcUGKU3sgfHP_5FAAAARA"]
[Fri Dec 12 20:58:57.793273 2025] [:error] [pid 26521:tid 26580] [client 130.33.54.142:14814] [client 130.33.54.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/js420.php"] [unique_id "aTwRkZdhcAPU617AKTB9yAAAAIE"]
[Fri Dec 12 21:01:26.053871 2025] [:error] [pid 26521:tid 26581] [client 45.8.17.90:22951] [client 45.8.17.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTwSJpdhcAPU617AKTB-mgAAAII"]
[Fri Dec 12 21:28:40.366492 2025] [:error] [pid 55760:tid 55773] [client 45.8.17.80:47785] [client 45.8.17.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTwYiFObDQlftFDyGawXxQAAAYs"]
[Fri Dec 12 22:09:11.659663 2025] [:error] [pid 26520:tid 26559] [client 45.8.17.196:58975] [client 45.8.17.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.196, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTwiB0G_frlY5vNXu_AHhAAAAEc"]
[Fri Dec 12 23:03:34.220152 2025] [:error] [pid 26519:tid 26536] [client 45.8.17.149:56051] [client 45.8.17.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.149, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTwuxs8TRgSGOeWqEhcHjAAAAA0"]
[Fri Dec 12 23:37:25.983348 2025] [:error] [pid 26607:tid 26633] [client 45.8.17.70:33135] [client 45.8.17.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTw2tcb_b0tOEWTL2Km_PQAAANg"]
[Fri Dec 12 23:44:10.190070 2025] [:error] [pid 26520:tid 26552] [client 45.8.17.98:44261] [client 45.8.17.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.98, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTw4SkG_frlY5vNXu_AcdgAAAEA"]
[Sat Dec 13 00:16:46.208976 2025] [:error] [pid 26521:tid 26579] [client 81.88.49.11:31315] [client 81.88.49.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.88.49.11, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTw_7pdhcAPU617AKTDJzAAAAIA"]
[Sat Dec 13 00:16:47.412194 2025] [:error] [pid 26521:tid 26599] [client 81.88.49.11:31315] [client 81.88.49.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.88.49.11, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTw_75dhcAPU617AKTDJzgAAAJQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 00:57:31.458055 2025] [:error] [pid 26607:tid 26629] [client 45.8.17.190:32371] [client 45.8.17.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTxJe8b_b0tOEWTL2KnPsgAAANQ"]
[Sat Dec 13 01:30:48.311405 2025] [:error] [pid 26519:tid 26527] [client 68.178.245.62:42840] [client 68.178.245.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.245.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTxRSM8TRgSGOeWqEhckwQAAAAQ"]
[Sat Dec 13 01:30:50.256534 2025] [:error] [pid 26519:tid 26533] [client 68.178.245.62:42840] [client 68.178.245.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.245.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTxRSs8TRgSGOeWqEhckxwAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 01:38:31.286144 2025] [:error] [pid 26521:tid 26595] [client 45.8.17.190:55207] [client 45.8.17.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTxTF5dhcAPU617AKTDfQAAAAJA"]
[Sat Dec 13 01:45:16.371961 2025] [:error] [pid 27950:tid 27958] [client 45.8.17.75:30143] [client 45.8.17.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.75, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTxUrIVLRvkrdsSc1F3hlAAAAUY"]
[Sat Dec 13 02:30:36.422526 2025] [:error] [pid 61026:tid 61032] [client 103.174.10.147:45478] [client 103.174.10.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.174.10.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTxfTPuRR7v2iVXoj1NzhAAAAgM"]
[Sat Dec 13 02:30:37.737320 2025] [:error] [pid 61026:tid 61037] [client 103.174.10.147:45478] [client 103.174.10.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.174.10.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTxfTfuRR7v2iVXoj1NzhQAAAgg"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 02:39:28.704897 2025] [:error] [pid 61026:tid 61051] [client 45.8.17.96:21007] [client 45.8.17.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTxhYPuRR7v2iVXoj1N0qQAAAhY"]
[Sat Dec 13 02:45:51.676120 2025] [:error] [pid 26521:tid 26579] [client 161.248.188.171:36008] [client 161.248.188.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.248.188.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTxi35dhcAPU617AKTDohwAAAIA"]
[Sat Dec 13 02:45:52.816019 2025] [:error] [pid 26521:tid 26584] [client 161.248.188.171:36008] [client 161.248.188.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.248.188.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTxi4JdhcAPU617AKTDoiAAAAIU"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 02:59:35.747082 2025] [:error] [pid 55760:tid 55774] [client 45.8.17.190:39097] [client 45.8.17.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTxmF1ObDQlftFDyGaxorwAAAYw"]
[Sat Dec 13 03:00:09.813684 2025] [:error] [pid 26607:tid 26624] [client 103.68.62.175:58104] [client 103.68.62.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.68.62.175, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTxmOcb_b0tOEWTL2KnqHAAAAM8"]
[Sat Dec 13 03:00:11.359542 2025] [:error] [pid 26607:tid 26609] [client 103.68.62.175:58104] [client 103.68.62.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.68.62.175, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTxmO8b_b0tOEWTL2KnqHQAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 03:06:18.596969 2025] [:error] [pid 26607:tid 26615] [client 45.8.17.53:44579] [client 45.8.17.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTxnqsb_b0tOEWTL2Knq0gAAAMY"]
[Sat Dec 13 03:13:59.239199 2025] [:error] [pid 26519:tid 26536] [client 93.89.225.129:57614] [client 93.89.225.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 93.89.225.129, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTxpd88TRgSGOeWqEhc2HQAAAA0"]
[Sat Dec 13 03:14:00.281199 2025] [:error] [pid 26519:tid 26530] [client 93.89.225.129:57614] [client 93.89.225.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 93.89.225.129, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTxpeM8TRgSGOeWqEhc2HgAAAAc"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 03:19:40.964084 2025] [:error] [pid 27950:tid 27954] [client 45.8.17.79:40347] [client 45.8.17.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.79, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTxqzIVLRvkrdsSc1F3rcAAAAUI"]
[Sat Dec 13 03:37:29.769936 2025] [:error] [pid 26519:tid 26530] [client 38.97.60.82:64757] [client 38.97.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "aTxu-c8TRgSGOeWqEhc6cQAAAAc"], referer: binance.com
[Sat Dec 13 03:45:10.522701 2025] [:error] [pid 23327:tid 23480] [client 20.27.218.61:41929] [client 20.27.218.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.27.218.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTxwxlvcP-wxXlFbs6R4AQAAAIs"]
[Sat Dec 13 03:45:11.248829 2025] [:error] [pid 23327:tid 23482] [client 20.27.218.61:41929] [client 20.27.218.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.27.218.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTxwx1vcP-wxXlFbs6R4BAAAAI0"]
[Sat Dec 13 03:45:16.113816 2025] [:error] [pid 23515:tid 23530] [client 20.27.218.61:9530] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aTxwzOjEsibkOTPKggXyHgAAAMs"]
[Sat Dec 13 03:45:16.633380 2025] [:error] [pid 23515:tid 23543] [client 20.27.218.61:9502] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aTxwzOjEsibkOTPKggXyHwAAANg"]
[Sat Dec 13 03:45:17.097788 2025] [:error] [pid 23322:tid 23412] [client 20.27.218.61:39258] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aTxwzeGkmarhEO9bjcj11AAAAAY"]
[Sat Dec 13 03:45:17.503116 2025] [:error] [pid 23515:tid 23542] [client 20.27.218.61:44521] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aTxwzejEsibkOTPKggXyIQAAANc"]
[Sat Dec 13 03:45:17.831316 2025] [:error] [pid 23324:tid 23452] [client 20.27.218.61:9767] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/minik.php"] [unique_id "aTxwzXghQ59IefnB6COs2wAAAEs"]
[Sat Dec 13 03:45:18.132416 2025] [:error] [pid 23322:tid 23408] [client 20.27.218.61:39282] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/minik.php"] [unique_id "aTxwzuGkmarhEO9bjcj11gAAAAI"]
[Sat Dec 13 03:45:18.494494 2025] [:error] [pid 23515:tid 23529] [client 20.27.218.61:41969] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/minik.php"] [unique_id "aTxwzujEsibkOTPKggXyIwAAAMo"]
[Sat Dec 13 03:45:18.836631 2025] [:error] [pid 23324:tid 23453] [client 20.27.218.61:9529] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/minik.php"] [unique_id "aTxwznghQ59IefnB6COs3AAAAEw"]
[Sat Dec 13 03:45:19.159196 2025] [:error] [pid 23322:tid 23417] [client 20.27.218.61:9508] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/OK.php"] [unique_id "aTxwz-GkmarhEO9bjcj12gAAAAs"]
[Sat Dec 13 03:45:19.499062 2025] [:error] [pid 23322:tid 23421] [client 20.27.218.61:41940] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/OK.php"] [unique_id "aTxwz-GkmarhEO9bjcj12wAAAA8"]
[Sat Dec 13 03:45:20.044028 2025] [:error] [pid 23324:tid 23447] [client 20.27.218.61:9476] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/OK.php"] [unique_id "aTxw0HghQ59IefnB6COs3gAAAEY"]
[Sat Dec 13 03:45:20.367612 2025] [:error] [pid 23322:tid 23423] [client 20.27.218.61:41945] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/OK.php"] [unique_id "aTxw0OGkmarhEO9bjcj13QAAABE"]
[Sat Dec 13 03:45:20.878131 2025] [:error] [pid 23322:tid 23424] [client 20.27.218.61:39236] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfanew.php"] [unique_id "aTxw0OGkmarhEO9bjcj13gAAABI"]
[Sat Dec 13 03:45:21.213729 2025] [:error] [pid 23515:tid 23526] [client 20.27.218.61:9751] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfanew.php"] [unique_id "aTxw0ejEsibkOTPKggXyJQAAAMc"]
[Sat Dec 13 03:45:21.506322 2025] [:error] [pid 23515:tid 23522] [client 20.27.218.61:39288] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfanew.php"] [unique_id "aTxw0ejEsibkOTPKggXyJwAAAMM"]
[Sat Dec 13 03:45:21.976248 2025] [:error] [pid 23515:tid 23528] [client 20.27.218.61:44513] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfanew.php"] [unique_id "aTxw0ejEsibkOTPKggXyKAAAAMk"]
[Sat Dec 13 03:45:22.409699 2025] [:error] [pid 23327:tid 23478] [client 20.27.218.61:9788] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zsec.php"] [unique_id "aTxw0lvcP-wxXlFbs6R4BwAAAIk"]
[Sat Dec 13 03:45:22.921076 2025] [:error] [pid 23327:tid 23477] [client 20.27.218.61:9518] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zsec.php"] [unique_id "aTxw0lvcP-wxXlFbs6R4CgAAAIg"]
[Sat Dec 13 03:45:23.234047 2025] [:error] [pid 23324:tid 23458] [client 20.27.218.61:44498] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zsec.php"] [unique_id "aTxw03ghQ59IefnB6COs3wAAAFE"]
[Sat Dec 13 03:45:23.682075 2025] [:error] [pid 23515:tid 23525] [client 20.27.218.61:39266] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zsec.php"] [unique_id "aTxw0-jEsibkOTPKggXyKgAAAMY"]
[Sat Dec 13 03:45:24.158017 2025] [:error] [pid 23324:tid 23456] [client 20.27.218.61:41982] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/arig.php"] [unique_id "aTxw1HghQ59IefnB6COs4AAAAE8"]
[Sat Dec 13 03:45:24.526525 2025] [:error] [pid 23327:tid 23493] [client 20.27.218.61:39276] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/arig.php"] [unique_id "aTxw1FvcP-wxXlFbs6R4DAAAAJg"]
[Sat Dec 13 03:45:24.826649 2025] [:error] [pid 23324:tid 23461] [client 20.27.218.61:44538] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/arig.php"] [unique_id "aTxw1HghQ59IefnB6COs4gAAAFQ"]
[Sat Dec 13 03:45:25.160882 2025] [:error] [pid 23327:tid 23484] [client 20.27.218.61:41954] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/arig.php"] [unique_id "aTxw1VvcP-wxXlFbs6R4DQAAAI8"]
[Sat Dec 13 03:45:25.451689 2025] [:error] [pid 23324:tid 23464] [client 20.27.218.61:41983] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin1.php"] [unique_id "aTxw1XghQ59IefnB6COs5AAAAFc"]
[Sat Dec 13 03:45:26.151144 2025] [:error] [pid 23515:tid 23538] [client 20.27.218.61:39234] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin1.php"] [unique_id "aTxw1ujEsibkOTPKggXyKwAAANM"]
[Sat Dec 13 03:45:26.490177 2025] [:error] [pid 23324:tid 23442] [client 20.27.218.61:41973] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin1.php"] [unique_id "aTxw1nghQ59IefnB6COs5gAAAEE"]
[Sat Dec 13 03:45:27.232983 2025] [:error] [pid 23515:tid 23539] [client 20.27.218.61:39259] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin1.php"] [unique_id "aTxw1-jEsibkOTPKggXyLAAAANQ"]
[Sat Dec 13 03:45:28.054669 2025] [:error] [pid 23515:tid 23534] [client 20.27.218.61:39247] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aTxw2OjEsibkOTPKggXyLgAAAM8"]
[Sat Dec 13 03:45:29.101970 2025] [:error] [pid 23324:tid 23443] [client 20.27.218.61:9734] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aTxw2XghQ59IefnB6COs6gAAAEI"]
[Sat Dec 13 03:45:29.579836 2025] [:error] [pid 23327:tid 23476] [client 20.27.218.61:39291] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aTxw2VvcP-wxXlFbs6R4EAAAAIc"]
[Sat Dec 13 03:45:29.957743 2025] [:error] [pid 23327:tid 23492] [client 20.27.218.61:44522] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aTxw2VvcP-wxXlFbs6R4EQAAAJc"]
[Sat Dec 13 03:45:30.256195 2025] [:error] [pid 23322:tid 23414] [client 20.27.218.61:41941] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/af32.php"] [unique_id "aTxw2uGkmarhEO9bjcj14QAAAAg"]
[Sat Dec 13 03:45:30.804716 2025] [:error] [pid 23322:tid 23409] [client 20.27.218.61:44541] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/af32.php"] [unique_id "aTxw2uGkmarhEO9bjcj14gAAAAM"]
[Sat Dec 13 03:45:31.059673 2025] [:error] [pid 23327:tid 23490] [client 20.27.218.61:39251] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/af32.php"] [unique_id "aTxw21vcP-wxXlFbs6R4EwAAAJU"]
[Sat Dec 13 03:45:31.740061 2025] [:error] [pid 23327:tid 23489] [client 20.27.218.61:9517] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/af32.php"] [unique_id "aTxw21vcP-wxXlFbs6R4FAAAAJQ"]
[Sat Dec 13 03:45:32.184496 2025] [:error] [pid 23515:tid 23543] [client 20.27.218.61:41950] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rz.php"] [unique_id "aTxw3OjEsibkOTPKggXyMAAAANg"]
[Sat Dec 13 03:45:32.503296 2025] [:error] [pid 23515:tid 23521] [client 20.27.218.61:9747] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rz.php"] [unique_id "aTxw3OjEsibkOTPKggXyMQAAAMI"]
[Sat Dec 13 03:45:32.786348 2025] [:error] [pid 23515:tid 23542] [client 20.27.218.61:44492] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rz.php"] [unique_id "aTxw3OjEsibkOTPKggXyMgAAANc"]
[Sat Dec 13 03:45:33.182654 2025] [:error] [pid 23515:tid 23520] [client 20.27.218.61:41926] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rz.php"] [unique_id "aTxw3ejEsibkOTPKggXyMwAAAME"]
[Sat Dec 13 03:45:33.619308 2025] [:error] [pid 23324:tid 23446] [client 20.27.218.61:9499] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/let.php"] [unique_id "aTxw3XghQ59IefnB6COs7AAAAEU"]
[Sat Dec 13 03:45:33.949735 2025] [:error] [pid 23515:tid 23527] [client 20.27.218.61:44500] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/let.php"] [unique_id "aTxw3ejEsibkOTPKggXyNAAAAMg"]
[Sat Dec 13 03:45:34.236254 2025] [:error] [pid 23515:tid 23519] [client 20.27.218.61:9532] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/let.php"] [unique_id "aTxw3ujEsibkOTPKggXyNQAAAMA"]
[Sat Dec 13 03:45:34.499804 2025] [:error] [pid 23322:tid 23413] [client 20.27.218.61:44542] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/let.php"] [unique_id "aTxw3uGkmarhEO9bjcj15AAAAAc"]
[Sat Dec 13 03:45:34.798464 2025] [:error] [pid 23322:tid 23408] [client 20.27.218.61:9478] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aTxw3uGkmarhEO9bjcj15gAAAAI"]
[Sat Dec 13 03:45:35.074251 2025] [:error] [pid 23322:tid 23417] [client 20.27.218.61:9785] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aTxw3-GkmarhEO9bjcj16AAAAAs"]
[Sat Dec 13 03:45:35.356841 2025] [:error] [pid 23327:tid 23472] [client 20.27.218.61:41953] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aTxw31vcP-wxXlFbs6R4IAAAAIM"]
[Sat Dec 13 03:45:35.691585 2025] [:error] [pid 23322:tid 23424] [client 20.27.218.61:9752] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aTxw3-GkmarhEO9bjcj16QAAABI"]
[Sat Dec 13 03:45:35.978472 2025] [:error] [pid 23515:tid 23531] [client 20.27.218.61:9773] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aTxw3-jEsibkOTPKggXyOAAAAMw"]
[Sat Dec 13 03:45:36.283156 2025] [:error] [pid 23324:tid 23450] [client 20.27.218.61:41936] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aTxw4HghQ59IefnB6COs7QAAAEk"]
[Sat Dec 13 03:45:36.629602 2025] [:error] [pid 23515:tid 23541] [client 20.27.218.61:46392] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aTxw4OjEsibkOTPKggXyOQAAANY"]
[Sat Dec 13 03:45:36.905229 2025] [:error] [pid 23324:tid 23451] [client 20.27.218.61:9765] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aTxw4HghQ59IefnB6COs7gAAAEo"]
[Sat Dec 13 03:45:37.165885 2025] [:error] [pid 23322:tid 23422] [client 20.27.218.61:46372] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aTxw4eGkmarhEO9bjcj17gAAABA"]
[Sat Dec 13 03:45:37.440774 2025] [:error] [pid 23327:tid 23490] [client 20.27.218.61:39269] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aTxw4VvcP-wxXlFbs6R4JQAAAJU"]
[Sat Dec 13 03:45:37.740762 2025] [:error] [pid 23327:tid 23489] [client 20.27.218.61:41939] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aTxw4VvcP-wxXlFbs6R4JgAAAJQ"]
[Sat Dec 13 03:45:38.089444 2025] [:error] [pid 23327:tid 23485] [client 20.27.218.61:44510] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aTxw4lvcP-wxXlFbs6R4KAAAAJA"]
[Sat Dec 13 03:45:38.340319 2025] [:error] [pid 23515:tid 23523] [client 20.27.218.61:41965] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aTxw4ujEsibkOTPKggXyPAAAAMQ"]
[Sat Dec 13 03:45:38.648058 2025] [:error] [pid 23515:tid 23535] [client 20.27.218.61:41931] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aTxw4ujEsibkOTPKggXyPQAAANA"]
[Sat Dec 13 03:45:38.914241 2025] [:error] [pid 23324:tid 23447] [client 20.27.218.61:9519] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aTxw4nghQ59IefnB6COs8QAAAEY"]
[Sat Dec 13 03:45:39.201272 2025] [:error] [pid 23324:tid 23449] [client 20.27.218.61:44501] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aTxw43ghQ59IefnB6COs8gAAAEg"]
[Sat Dec 13 03:45:39.496510 2025] [:error] [pid 23324:tid 23454] [client 20.27.218.61:39286] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abe.php"] [unique_id "aTxw43ghQ59IefnB6COs8wAAAE0"]
[Sat Dec 13 03:45:39.826789 2025] [:error] [pid 23322:tid 23411] [client 20.27.218.61:41920] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abe.php"] [unique_id "aTxw4-GkmarhEO9bjcj17wAAAAU"]
[Sat Dec 13 03:45:40.096084 2025] [:error] [pid 23327:tid 23480] [client 20.27.218.61:44518] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abe.php"] [unique_id "aTxw5FvcP-wxXlFbs6R4MQAAAIs"]
[Sat Dec 13 03:45:40.341738 2025] [:error] [pid 23515:tid 23540] [client 20.27.218.61:41966] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abe.php"] [unique_id "aTxw5OjEsibkOTPKggXyPwAAANU"]
[Sat Dec 13 03:45:40.595079 2025] [:error] [pid 23515:tid 23534] [client 20.27.218.61:9475] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aTxw5OjEsibkOTPKggXyQQAAAM8"]
[Sat Dec 13 03:45:40.907267 2025] [:error] [pid 23515:tid 23532] [client 20.27.218.61:39232] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aTxw5OjEsibkOTPKggXyQgAAAM0"]
[Sat Dec 13 03:45:41.171257 2025] [:error] [pid 23515:tid 23530] [client 20.27.218.61:9483] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aTxw5ejEsibkOTPKggXyQwAAAMs"]
[Sat Dec 13 03:45:41.444884 2025] [:error] [pid 23515:tid 23543] [client 20.27.218.61:46338] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aTxw5ejEsibkOTPKggXyRAAAANg"]
[Sat Dec 13 03:45:41.732740 2025] [:error] [pid 23515:tid 23521] [client 20.27.218.61:44495] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aTxw5ejEsibkOTPKggXyRQAAAMI"]
[Sat Dec 13 03:45:42.027467 2025] [:error] [pid 23322:tid 23415] [client 20.27.218.61:9498] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aTxw5uGkmarhEO9bjcj18wAAAAk"]
[Sat Dec 13 03:45:42.271107 2025] [:error] [pid 23515:tid 23542] [client 20.27.218.61:39281] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aTxw5ujEsibkOTPKggXyRgAAANc"]
[Sat Dec 13 03:45:42.632842 2025] [:error] [pid 23515:tid 23527] [client 20.27.218.61:9755] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aTxw5ujEsibkOTPKggXyRwAAAMg"]
[Sat Dec 13 03:45:42.899950 2025] [:error] [pid 23324:tid 23458] [client 20.27.218.61:41964] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aTxw5nghQ59IefnB6COs9AAAAFE"]
[Sat Dec 13 03:45:43.152957 2025] [:error] [pid 23324:tid 23456] [client 20.27.218.61:46375] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aTxw53ghQ59IefnB6COs9QAAAE8"]
[Sat Dec 13 03:45:43.404095 2025] [:error] [pid 23515:tid 23537] [client 20.27.218.61:46351] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aTxw5-jEsibkOTPKggXySgAAANI"]
[Sat Dec 13 03:45:43.647920 2025] [:error] [pid 23324:tid 23461] [client 20.27.218.61:41957] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aTxw53ghQ59IefnB6COs9gAAAFQ"]
[Sat Dec 13 03:45:43.900739 2025] [:error] [pid 23322:tid 23408] [client 20.27.218.61:44535] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cloud.php"] [unique_id "aTxw5-GkmarhEO9bjcj19QAAAAI"]
[Sat Dec 13 03:45:44.141628 2025] [:error] [pid 23515:tid 23541] [client 20.27.218.61:39275] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cloud.php"] [unique_id "aTxw6OjEsibkOTPKggXyTAAAANY"]
[Sat Dec 13 03:45:44.387685 2025] [:error] [pid 23324:tid 23442] [client 20.27.218.61:44490] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cloud.php"] [unique_id "aTxw6HghQ59IefnB6COs-gAAAEE"]
[Sat Dec 13 03:45:44.632256 2025] [:error] [pid 23327:tid 23485] [client 20.27.218.61:54634] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cloud.php"] [unique_id "aTxw6FvcP-wxXlFbs6R4MwAAAJA"]
[Sat Dec 13 03:45:44.874659 2025] [:error] [pid 23515:tid 23523] [client 20.27.218.61:41955] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aTxw6OjEsibkOTPKggXyTwAAAMQ"]
[Sat Dec 13 03:45:45.147987 2025] [:error] [pid 23324:tid 23448] [client 20.27.218.61:9523] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aTxw6XghQ59IefnB6COs-wAAAEc"]
[Sat Dec 13 03:45:45.390525 2025] [:error] [pid 23322:tid 23417] [client 20.27.218.61:39262] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aTxw6eGkmarhEO9bjcj19wAAAAs"]
[Sat Dec 13 03:45:45.656876 2025] [:error] [pid 23324:tid 23443] [client 20.27.218.61:9761] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aTxw6XghQ59IefnB6COs_AAAAEI"]
[Sat Dec 13 03:45:45.902927 2025] [:error] [pid 23327:tid 23492] [client 20.27.218.61:9749] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aTxw6VvcP-wxXlFbs6R4NAAAAJc"]
[Sat Dec 13 03:45:46.143708 2025] [:error] [pid 23324:tid 23457] [client 20.27.218.61:9521] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aTxw6nghQ59IefnB6COs_QAAAFA"]
[Sat Dec 13 03:45:46.383758 2025] [:error] [pid 23322:tid 23424] [client 20.27.218.61:9487] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aTxw6uGkmarhEO9bjcj1-AAAABI"]
[Sat Dec 13 03:45:46.624141 2025] [:error] [pid 23515:tid 23534] [client 20.27.218.61:46337] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aTxw6ujEsibkOTPKggXyUgAAAM8"]
[Sat Dec 13 03:45:46.864802 2025] [:error] [pid 23515:tid 23530] [client 20.27.218.61:9488] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aTxw6ujEsibkOTPKggXyUwAAAMs"]
[Sat Dec 13 03:45:47.147945 2025] [:error] [pid 23515:tid 23521] [client 20.27.218.61:39253] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aTxw6-jEsibkOTPKggXyVQAAAMI"]
[Sat Dec 13 03:45:47.404243 2025] [:error] [pid 23515:tid 23525] [client 20.27.218.61:41929] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aTxw6-jEsibkOTPKggXyVgAAAMY"]
[Sat Dec 13 03:45:47.645773 2025] [:error] [pid 23515:tid 23537] [client 20.27.218.61:44529] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aTxw6-jEsibkOTPKggXyVwAAANI"]
[Sat Dec 13 03:45:47.887136 2025] [:error] [pid 23515:tid 23531] [client 20.27.218.61:9496] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aTxw6-jEsibkOTPKggXyWAAAAMw"]
[Sat Dec 13 03:45:48.131849 2025] [:error] [pid 23322:tid 23420] [client 20.27.218.61:39256] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aTxw7OGkmarhEO9bjcj1-QAAAA4"]
[Sat Dec 13 03:45:48.391820 2025] [:error] [pid 23324:tid 23462] [client 20.27.218.61:39257] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aTxw7HghQ59IefnB6COs_gAAAFU"]
[Sat Dec 13 03:45:48.633792 2025] [:error] [pid 23515:tid 23519] [client 20.27.218.61:44488] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aTxw7OjEsibkOTPKggXyXAAAAMA"]
[Sat Dec 13 03:45:48.875927 2025] [:error] [pid 23515:tid 23522] [client 20.27.218.61:9784] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aTxw7OjEsibkOTPKggXyXQAAAMM"]
[Sat Dec 13 03:45:49.117661 2025] [:error] [pid 23327:tid 23483] [client 20.27.218.61:39248] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aTxw7VvcP-wxXlFbs6R4NwAAAI4"]
[Sat Dec 13 03:45:49.365015 2025] [:error] [pid 23327:tid 23469] [client 20.27.218.61:41934] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aTxw7VvcP-wxXlFbs6R4OAAAAIA"]
[Sat Dec 13 03:45:49.611565 2025] [:error] [pid 23515:tid 23528] [client 20.27.218.61:41970] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aTxw7ejEsibkOTPKggXyXgAAAMk"]
[Sat Dec 13 03:45:49.855593 2025] [:error] [pid 23515:tid 23523] [client 20.27.218.61:41958] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aTxw7ejEsibkOTPKggXyXwAAAMQ"]
[Sat Dec 13 03:45:50.100869 2025] [:error] [pid 23515:tid 23524] [client 20.27.218.61:39773] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aTxw7ujEsibkOTPKggXyYAAAAMU"]
[Sat Dec 13 03:45:50.346981 2025] [:error] [pid 23515:tid 23539] [client 20.27.218.61:44507] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aTxw7ujEsibkOTPKggXyYQAAANQ"]
[Sat Dec 13 03:45:50.588689 2025] [:error] [pid 23327:tid 23482] [client 20.27.218.61:39261] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aTxw7lvcP-wxXlFbs6R4OQAAAI0"]
[Sat Dec 13 03:45:50.830750 2025] [:error] [pid 23515:tid 23540] [client 20.27.218.61:44486] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "aTxw7ujEsibkOTPKggXyYgAAANU"]
[Sat Dec 13 03:45:51.073757 2025] [:error] [pid 23322:tid 23426] [client 20.27.218.61:44528] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "aTxw7-GkmarhEO9bjcj1-gAAABQ"]
[Sat Dec 13 03:45:51.362768 2025] [:error] [pid 23327:tid 23471] [client 20.27.218.61:44480] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "aTxw71vcP-wxXlFbs6R4OwAAAII"]
[Sat Dec 13 03:45:51.508487 2025] [:error] [pid 23515:tid 23541] [client 85.206.169.20:35540] [client 85.206.169.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.206.169.20, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTxw7-jEsibkOTPKggXyZAAAANY"]
[Sat Dec 13 03:45:51.604832 2025] [:error] [pid 23327:tid 23479] [client 20.27.218.61:44484] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "aTxw71vcP-wxXlFbs6R4PAAAAIo"]
[Sat Dec 13 03:45:51.844140 2025] [:error] [pid 23322:tid 23416] [client 20.27.218.61:46390] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aTxw7-GkmarhEO9bjcj1-wAAAAo"]
[Sat Dec 13 03:45:52.101251 2025] [:error] [pid 23515:tid 23521] [client 20.27.218.61:44523] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aTxw8OjEsibkOTPKggXyZQAAAMI"]
[Sat Dec 13 03:45:52.343917 2025] [:error] [pid 23322:tid 23425] [client 20.27.218.61:9534] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aTxw8OGkmarhEO9bjcj1_gAAABM"]
[Sat Dec 13 03:45:52.584808 2025] [:error] [pid 23327:tid 23477] [client 20.27.218.61:46359] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aTxw8FvcP-wxXlFbs6R4PQAAAIg"]
[Sat Dec 13 03:45:52.829103 2025] [:error] [pid 23327:tid 23487] [client 20.27.218.61:39797] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aTxw8FvcP-wxXlFbs6R4PwAAAJI"]
[Sat Dec 13 03:45:53.071347 2025] [:error] [pid 23322:tid 23430] [client 20.27.218.61:9791] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aTxw8eGkmarhEO9bjcj2AAAAABg"]
[Sat Dec 13 03:45:53.136242 2025] [:error] [pid 23515:tid 23525] [client 85.206.169.20:35540] [client 85.206.169.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.206.169.20, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTxw8ejEsibkOTPKggXyaAAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 03:45:53.328628 2025] [:error] [pid 23322:tid 23415] [client 20.27.218.61:39263] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aTxw8eGkmarhEO9bjcj2AQAAAAk"]
[Sat Dec 13 03:45:53.569062 2025] [:error] [pid 23327:tid 23493] [client 20.27.218.61:9503] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aTxw8VvcP-wxXlFbs6R4QAAAAJg"]
[Sat Dec 13 03:45:53.818367 2025] [:error] [pid 23322:tid 23414] [client 20.27.218.61:46381] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aTxw8eGkmarhEO9bjcj2AgAAAAg"]
[Sat Dec 13 03:45:54.063171 2025] [:error] [pid 23327:tid 23474] [client 20.27.218.61:9486] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aTxw8lvcP-wxXlFbs6R4QgAAAIU"]
[Sat Dec 13 03:45:54.316538 2025] [:error] [pid 23515:tid 23531] [client 20.27.218.61:46388] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aTxw8ujEsibkOTPKggXyaQAAAMw"]
[Sat Dec 13 03:45:54.559182 2025] [:error] [pid 23515:tid 23519] [client 20.27.218.61:44540] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aTxw8ujEsibkOTPKggXyawAAAMA"]
[Sat Dec 13 03:45:54.830113 2025] [:error] [pid 23327:tid 23480] [client 20.27.218.61:39796] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aTxw8lvcP-wxXlFbs6R4QwAAAIs"]
[Sat Dec 13 03:45:55.071322 2025] [:error] [pid 23327:tid 23476] [client 20.27.218.61:44497] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aTxw81vcP-wxXlFbs6R4RAAAAIc"]
[Sat Dec 13 03:45:55.313268 2025] [:error] [pid 23515:tid 23523] [client 20.27.218.61:9789] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aTxw8-jEsibkOTPKggXybAAAAMQ"]
[Sat Dec 13 03:45:55.559296 2025] [:error] [pid 23515:tid 23529] [client 20.27.218.61:9528] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aTxw8-jEsibkOTPKggXybQAAAMo"]
[Sat Dec 13 03:45:55.809742 2025] [:error] [pid 23327:tid 23478] [client 20.27.218.61:46398] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uana.php"] [unique_id "aTxw81vcP-wxXlFbs6R4RwAAAIk"]
[Sat Dec 13 03:45:56.054186 2025] [:error] [pid 23515:tid 23535] [client 20.27.218.61:45792] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uana.php"] [unique_id "aTxw9OjEsibkOTPKggXybgAAANA"]
[Sat Dec 13 03:45:56.300800 2025] [:error] [pid 23322:tid 23429] [client 20.27.218.61:46346] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uana.php"] [unique_id "aTxw9OGkmarhEO9bjcj2BQAAABc"]
[Sat Dec 13 03:45:56.550800 2025] [:error] [pid 23515:tid 23524] [client 20.27.218.61:41933] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uana.php"] [unique_id "aTxw9OjEsibkOTPKggXybwAAAMU"]
[Sat Dec 13 03:45:56.806587 2025] [:error] [pid 23515:tid 23540] [client 20.27.218.61:41977] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aTxw9OjEsibkOTPKggXycAAAANU"]
[Sat Dec 13 03:45:57.052614 2025] [:error] [pid 23322:tid 23408] [client 20.27.218.61:39778] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aTxw9eGkmarhEO9bjcj2CAAAAAI"]
[Sat Dec 13 03:45:57.294466 2025] [:error] [pid 23515:tid 23532] [client 20.27.218.61:54601] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aTxw9ejEsibkOTPKggXycQAAAM0"]
[Sat Dec 13 03:45:57.536108 2025] [:error] [pid 23515:tid 23530] [client 20.27.218.61:9760] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aTxw9ejEsibkOTPKggXycgAAAMs"]
[Sat Dec 13 03:45:57.776221 2025] [:error] [pid 23515:tid 23543] [client 20.27.218.61:46347] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aTxw9ejEsibkOTPKggXydAAAANg"]
[Sat Dec 13 03:45:58.016595 2025] [:error] [pid 23322:tid 23419] [client 20.27.218.61:39244] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aTxw9uGkmarhEO9bjcj2CgAAAA0"]
[Sat Dec 13 03:45:58.258507 2025] [:error] [pid 23515:tid 23521] [client 20.27.218.61:41923] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aTxw9ujEsibkOTPKggXydQAAAMI"]
[Sat Dec 13 03:45:58.502667 2025] [:error] [pid 23322:tid 23421] [client 20.27.218.61:44494] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aTxw9uGkmarhEO9bjcj2DAAAAA8"]
[Sat Dec 13 03:45:58.745894 2025] [:error] [pid 23327:tid 23485] [client 20.27.218.61:41948] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api.php"] [unique_id "aTxw9lvcP-wxXlFbs6R4SQAAAJA"]
[Sat Dec 13 03:45:58.995092 2025] [:error] [pid 23515:tid 23525] [client 20.27.218.61:39252] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api.php"] [unique_id "aTxw9ujEsibkOTPKggXydwAAAMY"]
[Sat Dec 13 03:45:59.236476 2025] [:error] [pid 23327:tid 23475] [client 20.27.218.61:9531] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api.php"] [unique_id "aTxw91vcP-wxXlFbs6R4SgAAAIY"]
[Sat Dec 13 03:45:59.484087 2025] [:error] [pid 23324:tid 23446] [client 20.27.218.61:9524] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api.php"] [unique_id "aTxw93ghQ59IefnB6COtAAAAAEU"]
[Sat Dec 13 03:45:59.732191 2025] [:error] [pid 23327:tid 23469] [client 20.27.218.61:44517] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inc.php"] [unique_id "aTxw91vcP-wxXlFbs6R4SwAAAIA"]
[Sat Dec 13 03:45:59.978486 2025] [:error] [pid 23515:tid 23522] [client 20.27.218.61:39267] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inc.php"] [unique_id "aTxw9-jEsibkOTPKggXyeQAAAMM"]
[Sat Dec 13 03:46:00.229134 2025] [:error] [pid 23515:tid 23526] [client 20.27.218.61:44485] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inc.php"] [unique_id "aTxw-OjEsibkOTPKggXyewAAAMc"]
[Sat Dec 13 03:46:00.496975 2025] [:error] [pid 23327:tid 23491] [client 20.27.218.61:44526] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inc.php"] [unique_id "aTxw-FvcP-wxXlFbs6R4TAAAAJY"]
[Sat Dec 13 03:46:00.737651 2025] [:error] [pid 23322:tid 23426] [client 20.27.218.61:41978] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aTxw-OGkmarhEO9bjcj2DgAAABQ"]
[Sat Dec 13 03:46:00.983740 2025] [:error] [pid 23327:tid 23479] [client 20.27.218.61:39768] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aTxw-FvcP-wxXlFbs6R4TgAAAIo"]
[Sat Dec 13 03:46:01.256114 2025] [:error] [pid 23322:tid 23407] [client 20.27.218.61:9786] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aTxw-eGkmarhEO9bjcj2EAAAAAE"]
[Sat Dec 13 03:46:01.498957 2025] [:error] [pid 23322:tid 23425] [client 20.27.218.61:46355] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aTxw-eGkmarhEO9bjcj2EQAAABM"]
[Sat Dec 13 03:46:01.754429 2025] [:error] [pid 23322:tid 23411] [client 20.27.218.61:41974] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-rex4.php7"] [unique_id "aTxw-eGkmarhEO9bjcj2EgAAAAU"]
[Sat Dec 13 03:46:02.002242 2025] [:error] [pid 23515:tid 23528] [client 20.27.218.61:54622] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-rex4.php7"] [unique_id "aTxw-ujEsibkOTPKggXyfAAAAMk"]
[Sat Dec 13 03:46:02.246572 2025] [:error] [pid 23322:tid 23415] [client 20.27.218.61:41946] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-rex4.php7"] [unique_id "aTxw-uGkmarhEO9bjcj2FAAAAAk"]
[Sat Dec 13 03:46:02.512653 2025] [:error] [pid 23327:tid 23484] [client 20.27.218.61:9746] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-rex4.php7"] [unique_id "aTxw-lvcP-wxXlFbs6R4UAAAAI8"]
[Sat Dec 13 03:46:02.776851 2025] [:error] [pid 23322:tid 23414] [client 20.27.218.61:39758] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aTxw-uGkmarhEO9bjcj2FQAAAAg"]
[Sat Dec 13 03:46:03.040675 2025] [:error] [pid 23515:tid 23529] [client 20.27.218.61:41927] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aTxw--jEsibkOTPKggXyfgAAAMo"]
[Sat Dec 13 03:46:03.287303 2025] [:error] [pid 23327:tid 23481] [client 20.27.218.61:9501] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aTxw-1vcP-wxXlFbs6R4VAAAAIw"]
[Sat Dec 13 03:46:03.529755 2025] [:error] [pid 23515:tid 23535] [client 20.27.218.61:41968] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aTxw--jEsibkOTPKggXyfwAAANA"]
[Sat Dec 13 03:46:03.806520 2025] [:error] [pid 23322:tid 23412] [client 20.27.218.61:44491] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "aTxw--GkmarhEO9bjcj2GAAAAAY"]
[Sat Dec 13 03:46:04.055047 2025] [:error] [pid 23327:tid 23480] [client 20.27.218.61:9507] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "aTxw_FvcP-wxXlFbs6R4VQAAAIs"]
[Sat Dec 13 03:46:04.300468 2025] [:error] [pid 23327:tid 23476] [client 20.27.218.61:54631] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "aTxw_FvcP-wxXlFbs6R4VgAAAIc"]
[Sat Dec 13 03:46:04.554036 2025] [:error] [pid 23515:tid 23539] [client 20.27.218.61:39786] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "aTxw_OjEsibkOTPKggXygQAAANQ"]
[Sat Dec 13 03:46:04.799236 2025] [:error] [pid 23515:tid 23527] [client 20.27.218.61:9768] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/warm.PhP7"] [unique_id "aTxw_OjEsibkOTPKggXyhAAAAMg"]
[Sat Dec 13 03:46:05.063794 2025] [:error] [pid 23324:tid 23452] [client 20.27.218.61:46343] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/warm.PhP7"] [unique_id "aTxw_XghQ59IefnB6COtBAAAAEs"]
[Sat Dec 13 03:46:05.322386 2025] [:error] [pid 23327:tid 23490] [client 20.27.218.61:44514] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/warm.PhP7"] [unique_id "aTxw_VvcP-wxXlFbs6R4VwAAAJU"]
[Sat Dec 13 03:46:05.591941 2025] [:error] [pid 23327:tid 23485] [client 20.27.218.61:41942] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/warm.PhP7"] [unique_id "aTxw_VvcP-wxXlFbs6R4WAAAAJA"]
[Sat Dec 13 03:46:05.835470 2025] [:error] [pid 23327:tid 23492] [client 20.27.218.61:44524] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php7"] [unique_id "aTxw_VvcP-wxXlFbs6R4WQAAAJc"]
[Sat Dec 13 03:46:06.115195 2025] [:error] [pid 23322:tid 23410] [client 20.27.218.61:39245] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php7"] [unique_id "aTxw_uGkmarhEO9bjcj2GwAAAAQ"]
[Sat Dec 13 03:46:06.364176 2025] [:error] [pid 23322:tid 23417] [client 20.27.218.61:39756] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php7"] [unique_id "aTxw_uGkmarhEO9bjcj2HAAAAAs"]
[Sat Dec 13 03:46:06.638224 2025] [:error] [pid 23324:tid 23447] [client 20.27.218.61:9480] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php7"] [unique_id "aTxw_nghQ59IefnB6COtBgAAAEY"]
[Sat Dec 13 03:46:06.903944 2025] [:error] [pid 23327:tid 23486] [client 20.27.218.61:9494] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rss.php"] [unique_id "aTxw_lvcP-wxXlFbs6R4WwAAAJE"]
[Sat Dec 13 03:46:07.184339 2025] [:error] [pid 23327:tid 23483] [client 20.27.218.61:9740] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rss.php"] [unique_id "aTxw_1vcP-wxXlFbs6R4XAAAAI4"]
[Sat Dec 13 03:46:07.425899 2025] [:error] [pid 23324:tid 23449] [client 20.27.218.61:46389] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rss.php"] [unique_id "aTxw_3ghQ59IefnB6COtBwAAAEg"]
[Sat Dec 13 03:46:07.673092 2025] [:error] [pid 23324:tid 23456] [client 20.27.218.61:9513] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rss.php"] [unique_id "aTxw_3ghQ59IefnB6COtCgAAAE8"]
[Sat Dec 13 03:46:07.944498 2025] [:error] [pid 23327:tid 23469] [client 20.27.218.61:9680] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pekok.php"] [unique_id "aTxw_1vcP-wxXlFbs6R4XQAAAIA"]
[Sat Dec 13 03:46:08.210216 2025] [:error] [pid 23327:tid 23482] [client 20.27.218.61:44482] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pekok.php"] [unique_id "aTxxAFvcP-wxXlFbs6R4XgAAAI0"]
[Sat Dec 13 03:46:08.466190 2025] [:error] [pid 23322:tid 23421] [client 20.27.218.61:54597] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pekok.php"] [unique_id "aTxxAOGkmarhEO9bjcj2HgAAAA8"]
[Sat Dec 13 03:46:08.742431 2025] [:error] [pid 23322:tid 23423] [client 20.27.218.61:39255] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pekok.php"] [unique_id "aTxxAOGkmarhEO9bjcj2IAAAABE"]
[Sat Dec 13 03:46:09.011008 2025] [:error] [pid 23515:tid 23543] [client 20.27.218.61:9512] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aTxxAejEsibkOTPKggXyiQAAANg"]
[Sat Dec 13 03:46:09.251292 2025] [:error] [pid 23515:tid 23533] [client 20.27.218.61:44502] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aTxxAejEsibkOTPKggXyigAAAM4"]
[Sat Dec 13 03:46:09.494524 2025] [:error] [pid 23515:tid 23519] [client 20.27.218.61:39787] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aTxxAejEsibkOTPKggXyiwAAAMA"]
[Sat Dec 13 03:46:09.759315 2025] [:error] [pid 23324:tid 23463] [client 20.27.218.61:46362] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aTxxAXghQ59IefnB6COtDQAAAFY"]
[Sat Dec 13 03:46:10.008714 2025] [:error] [pid 23322:tid 23422] [client 20.27.218.61:9688] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aa.php"] [unique_id "aTxxAuGkmarhEO9bjcj2IQAAABA"]
[Sat Dec 13 03:46:10.252564 2025] [:error] [pid 23327:tid 23481] [client 20.27.218.61:44504] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aa.php"] [unique_id "aTxxAlvcP-wxXlFbs6R4ZQAAAIw"]
[Sat Dec 13 03:46:10.499975 2025] [:error] [pid 23322:tid 23420] [client 20.27.218.61:39295] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aa.php"] [unique_id "aTxxAuGkmarhEO9bjcj2IgAAAA4"]
[Sat Dec 13 03:46:10.743994 2025] [:error] [pid 23322:tid 23426] [client 20.27.218.61:9479] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aa.php"] [unique_id "aTxxAuGkmarhEO9bjcj2IwAAABQ"]
[Sat Dec 13 03:46:11.042718 2025] [:error] [pid 23322:tid 23416] [client 20.27.218.61:44503] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cart.php"] [unique_id "aTxxA-GkmarhEO9bjcj2JAAAAAo"]
[Sat Dec 13 03:46:11.318511 2025] [:error] [pid 23327:tid 23488] [client 20.27.218.61:46379] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cart.php"] [unique_id "aTxxA1vcP-wxXlFbs6R4aAAAAJM"]
[Sat Dec 13 03:46:11.567598 2025] [:error] [pid 23327:tid 23492] [client 20.27.218.61:39790] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cart.php"] [unique_id "aTxxA1vcP-wxXlFbs6R4aQAAAJc"]
[Sat Dec 13 03:46:11.818006 2025] [:error] [pid 23515:tid 23534] [client 20.27.218.61:9766] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cart.php"] [unique_id "aTxxA-jEsibkOTPKggXykAAAAM8"]
[Sat Dec 13 03:46:12.064622 2025] [:error] [pid 23327:tid 23475] [client 20.27.218.61:46364] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/compare.php"] [unique_id "aTxxBFvcP-wxXlFbs6R4agAAAIY"]
[Sat Dec 13 03:46:12.327346 2025] [:error] [pid 23515:tid 23527] [client 20.27.218.61:9491] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/compare.php"] [unique_id "aTxxBOjEsibkOTPKggXykgAAAMg"]
[Sat Dec 13 03:46:12.652343 2025] [:error] [pid 23515:tid 23536] [client 20.27.218.61:54614] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/compare.php"] [unique_id "aTxxBOjEsibkOTPKggXykwAAANE"]
[Sat Dec 13 03:46:12.900828 2025] [:error] [pid 23322:tid 23430] [client 20.27.218.61:9743] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/compare.php"] [unique_id "aTxxBOGkmarhEO9bjcj2JQAAABg"]
[Sat Dec 13 03:46:13.189674 2025] [:error] [pid 23515:tid 23531] [client 20.27.218.61:41976] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aTxxBejEsibkOTPKggXylgAAAMw"]
[Sat Dec 13 03:46:13.479345 2025] [:error] [pid 23515:tid 23538] [client 20.27.218.61:9504] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aTxxBejEsibkOTPKggXylwAAANM"]
[Sat Dec 13 03:46:13.747826 2025] [:error] [pid 23324:tid 23460] [client 20.27.218.61:9526] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aTxxBXghQ59IefnB6COtDwAAAFM"]
[Sat Dec 13 03:46:14.008679 2025] [:error] [pid 23327:tid 23469] [client 20.27.218.61:54602] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aTxxBlvcP-wxXlFbs6R4bAAAAIA"]
[Sat Dec 13 03:46:14.263207 2025] [:error] [pid 23322:tid 23415] [client 20.27.218.61:39757] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api.php"] [unique_id "aTxxBuGkmarhEO9bjcj2JgAAAAk"]
[Sat Dec 13 03:46:14.572705 2025] [:error] [pid 23515:tid 23542] [client 20.27.218.61:41967] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api.php"] [unique_id "aTxxBujEsibkOTPKggXymgAAANc"]
[Sat Dec 13 03:46:14.859153 2025] [:error] [pid 23322:tid 23418] [client 20.27.218.61:41959] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api.php"] [unique_id "aTxxBuGkmarhEO9bjcj2JwAAAAw"]
[Sat Dec 13 03:46:24.796382 2025] [:error] [pid 23515:tid 23520] [client 20.27.218.61:41938] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aTxxEOjEsibkOTPKggXyrgAAAME"]
[Sat Dec 13 03:46:25.047179 2025] [:error] [pid 23322:tid 23410] [client 20.27.218.61:54617] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aTxxEeGkmarhEO9bjcj2KwAAAAQ"]
[Sat Dec 13 03:46:25.294771 2025] [:error] [pid 23322:tid 23417] [client 20.27.218.61:9671] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aTxxEeGkmarhEO9bjcj2LQAAAAs"]
[Sat Dec 13 03:46:25.572172 2025] [:error] [pid 23322:tid 23423] [client 20.27.218.61:9520] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aTxxEeGkmarhEO9bjcj2LgAAABE"]
[Sat Dec 13 03:46:25.819971 2025] [:error] [pid 23322:tid 23427] [client 20.27.218.61:44511] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f.php"] [unique_id "aTxxEeGkmarhEO9bjcj2MAAAABU"]
[Sat Dec 13 03:46:26.060986 2025] [:error] [pid 23324:tid 23455] [client 20.27.218.61:46357] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f.php"] [unique_id "aTxxEnghQ59IefnB6COtEwAAAE4"]
[Sat Dec 13 03:46:26.314198 2025] [:error] [pid 23324:tid 23447] [client 20.27.218.61:9506] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f.php"] [unique_id "aTxxEnghQ59IefnB6COtFAAAAEY"]
[Sat Dec 13 03:46:26.568740 2025] [:error] [pid 23324:tid 23454] [client 20.27.218.61:41949] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f.php"] [unique_id "aTxxEnghQ59IefnB6COtFQAAAE0"]
[Sat Dec 13 03:46:26.811039 2025] [:error] [pid 23322:tid 23416] [client 20.27.218.61:39762] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/max.php"] [unique_id "aTxxEuGkmarhEO9bjcj2MgAAAAo"]
[Sat Dec 13 03:46:27.052641 2025] [:error] [pid 23515:tid 23530] [client 20.27.218.61:44506] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/max.php"] [unique_id "aTxxE-jEsibkOTPKggXysQAAAMs"]
[Sat Dec 13 03:46:27.295854 2025] [:error] [pid 23515:tid 23537] [client 20.27.218.61:9664] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/max.php"] [unique_id "aTxxE-jEsibkOTPKggXysgAAANI"]
[Sat Dec 13 03:46:27.536357 2025] [:error] [pid 23515:tid 23531] [client 20.27.218.61:44527] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/max.php"] [unique_id "aTxxE-jEsibkOTPKggXyswAAAMw"]
[Sat Dec 13 03:46:27.812618 2025] [:error] [pid 23515:tid 23532] [client 20.27.218.61:9772] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aTxxE-jEsibkOTPKggXytAAAAM0"]
[Sat Dec 13 03:46:28.054298 2025] [:error] [pid 23515:tid 23519] [client 20.27.218.61:44515] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aTxxFOjEsibkOTPKggXytgAAAMA"]
[Sat Dec 13 03:46:28.296542 2025] [:error] [pid 23515:tid 23542] [client 20.27.218.61:39125] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aTxxFOjEsibkOTPKggXytwAAANc"]
[Sat Dec 13 03:46:28.538630 2025] [:error] [pid 23324:tid 23458] [client 20.27.218.61:45767] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aTxxFHghQ59IefnB6COtFgAAAFE"]
[Sat Dec 13 03:46:28.814559 2025] [:error] [pid 23324:tid 23456] [client 20.27.218.61:41971] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aTxxFHghQ59IefnB6COtFwAAAE8"]
[Sat Dec 13 03:46:29.054533 2025] [:error] [pid 23324:tid 23464] [client 20.27.218.61:9750] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aTxxFXghQ59IefnB6COtGAAAAFc"]
[Sat Dec 13 03:46:29.325015 2025] [:error] [pid 23324:tid 23459] [client 20.27.218.61:41963] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aTxxFXghQ59IefnB6COtGQAAAFI"]
[Sat Dec 13 03:46:29.572736 2025] [:error] [pid 23324:tid 23443] [client 20.27.218.61:44532] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aTxxFXghQ59IefnB6COtGgAAAEI"]
[Sat Dec 13 03:46:29.836065 2025] [:error] [pid 23324:tid 23457] [client 20.27.218.61:9775] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "aTxxFXghQ59IefnB6COtHAAAAFA"]
[Sat Dec 13 03:46:30.097318 2025] [:error] [pid 23322:tid 23424] [client 20.27.218.61:45794] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "aTxxFuGkmarhEO9bjcj2NAAAABI"]
[Sat Dec 13 03:46:30.350181 2025] [:error] [pid 23515:tid 23528] [client 20.27.218.61:46356] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "aTxxFujEsibkOTPKggXyuQAAAMk"]
[Sat Dec 13 03:46:30.637889 2025] [:error] [pid 23322:tid 23414] [client 20.27.218.61:44509] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "aTxxFuGkmarhEO9bjcj2NQAAAAg"]
[Sat Dec 13 03:46:30.946236 2025] [:error] [pid 23327:tid 23469] [client 20.27.218.61:9736] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aTxxFlvcP-wxXlFbs6R4cgAAAIA"]
[Sat Dec 13 03:46:31.244835 2025] [:error] [pid 23327:tid 23482] [client 20.27.218.61:9485] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aTxxF1vcP-wxXlFbs6R4cwAAAI0"]
[Sat Dec 13 03:46:31.487866 2025] [:error] [pid 23515:tid 23521] [client 20.27.218.61:54605] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aTxxF-jEsibkOTPKggXyugAAAMI"]
[Sat Dec 13 03:46:31.734335 2025] [:error] [pid 23515:tid 23526] [client 20.27.218.61:46345] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aTxxF-jEsibkOTPKggXyuwAAAMc"]
[Sat Dec 13 03:46:31.991127 2025] [:error] [pid 23515:tid 23520] [client 20.27.218.61:39265] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vv.php"] [unique_id "aTxxF-jEsibkOTPKggXyvAAAAME"]
[Sat Dec 13 03:46:32.293899 2025] [:error] [pid 23324:tid 23465] [client 20.27.218.61:39285] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vv.php"] [unique_id "aTxxGHghQ59IefnB6COtHgAAAFg"]
[Sat Dec 13 03:46:32.552405 2025] [:error] [pid 23515:tid 23523] [client 20.27.218.61:44520] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vv.php"] [unique_id "aTxxGOjEsibkOTPKggXyvQAAAMQ"]
[Sat Dec 13 03:46:32.819244 2025] [:error] [pid 23327:tid 23471] [client 20.27.218.61:54607] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vv.php"] [unique_id "aTxxGFvcP-wxXlFbs6R4dAAAAII"]
[Sat Dec 13 03:46:33.197460 2025] [:error] [pid 23515:tid 23540] [client 20.27.218.61:9473] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aTxxGejEsibkOTPKggXyvgAAANU"]
[Sat Dec 13 03:46:33.447875 2025] [:error] [pid 23515:tid 23539] [client 20.27.218.61:44508] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aTxxGejEsibkOTPKggXyvwAAANQ"]
[Sat Dec 13 03:46:33.723167 2025] [:error] [pid 23324:tid 23452] [client 20.27.218.61:54644] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aTxxGXghQ59IefnB6COtIQAAAEs"]
[Sat Dec 13 03:46:33.980170 2025] [:error] [pid 23322:tid 23417] [client 20.27.218.61:45761] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aTxxGeGkmarhEO9bjcj2OQAAAAs"]
[Sat Dec 13 03:46:34.225163 2025] [:error] [pid 23515:tid 23533] [client 20.27.218.61:44496] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aTxxGujEsibkOTPKggXywQAAAM4"]
[Sat Dec 13 03:46:34.467937 2025] [:error] [pid 23515:tid 23527] [client 20.27.218.61:44539] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aTxxGujEsibkOTPKggXywgAAAMg"]
[Sat Dec 13 03:46:34.834089 2025] [:error] [pid 23515:tid 23534] [client 20.27.218.61:9774] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aTxxGujEsibkOTPKggXyxAAAAM8"]
[Sat Dec 13 03:46:35.243013 2025] [:error] [pid 23515:tid 23530] [client 20.27.218.61:54636] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aTxxG-jEsibkOTPKggXyxQAAAMs"]
[Sat Dec 13 03:46:35.570768 2025] [:error] [pid 23322:tid 23421] [client 20.27.218.61:44489] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aTxxG-GkmarhEO9bjcj2OgAAAA8"]
[Sat Dec 13 03:46:35.811280 2025] [:error] [pid 23327:tid 23473] [client 20.27.218.61:39278] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aTxxG1vcP-wxXlFbs6R4dwAAAIQ"]
[Sat Dec 13 03:46:36.083534 2025] [:error] [pid 23515:tid 23537] [client 20.27.218.61:26928] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aTxxHOjEsibkOTPKggXyxgAAANI"]
[Sat Dec 13 03:46:36.352993 2025] [:error] [pid 23515:tid 23536] [client 20.27.218.61:9757] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aTxxHOjEsibkOTPKggXyxwAAANE"]
[Sat Dec 13 03:46:36.597707 2025] [:error] [pid 23322:tid 23427] [client 20.27.218.61:9776] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aTxxHOGkmarhEO9bjcj2OwAAABU"]
[Sat Dec 13 03:46:36.890983 2025] [:error] [pid 23515:tid 23538] [client 20.27.218.61:9742] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aTxxHOjEsibkOTPKggXyyAAAANM"]
[Sat Dec 13 03:46:37.206400 2025] [:error] [pid 23515:tid 23519] [client 20.27.218.61:39801] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aTxxHejEsibkOTPKggXyyQAAAMA"]
[Sat Dec 13 03:46:37.586458 2025] [:error] [pid 23324:tid 23449] [client 20.27.218.61:44531] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aTxxHXghQ59IefnB6COtIwAAAEg"]
[Sat Dec 13 03:46:37.836945 2025] [:error] [pid 23324:tid 23458] [client 20.27.218.61:9702] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aTxxHXghQ59IefnB6COtJAAAAFE"]
[Sat Dec 13 03:46:38.116435 2025] [:error] [pid 23322:tid 23408] [client 20.27.218.61:9715] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aTxxHuGkmarhEO9bjcj2PQAAAAI"]
[Sat Dec 13 03:46:38.441687 2025] [:error] [pid 23327:tid 23474] [client 20.27.218.61:45808] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aTxxHlvcP-wxXlFbs6R4eAAAAIU"]
[Sat Dec 13 03:46:38.691635 2025] [:error] [pid 23322:tid 23416] [client 20.27.218.61:54641] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aTxxHuGkmarhEO9bjcj2PwAAAAo"]
[Sat Dec 13 03:46:39.016240 2025] [:error] [pid 23322:tid 23407] [client 20.27.218.61:9693] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aTxxH-GkmarhEO9bjcj2QAAAAAE"]
[Sat Dec 13 03:46:39.325731 2025] [:error] [pid 23515:tid 23542] [client 20.27.218.61:45762] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aTxxH-jEsibkOTPKggXyywAAANc"]
[Sat Dec 13 03:46:39.609354 2025] [:error] [pid 23515:tid 23543] [client 20.27.218.61:39158] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aTxxH-jEsibkOTPKggXyzAAAANg"]
[Sat Dec 13 03:46:39.900324 2025] [:error] [pid 23515:tid 23529] [client 20.27.218.61:41930] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aTxxH-jEsibkOTPKggXyzQAAAMo"]
[Sat Dec 13 03:46:40.142378 2025] [:error] [pid 23327:tid 23479] [client 20.27.218.61:46368] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aTxxIFvcP-wxXlFbs6R4egAAAIo"]
[Sat Dec 13 03:46:40.433253 2025] [:error] [pid 23324:tid 23456] [client 20.27.218.61:46384] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aTxxIHghQ59IefnB6COtJQAAAE8"]
[Sat Dec 13 03:46:40.760268 2025] [:error] [pid 23322:tid 23425] [client 20.27.218.61:44483] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aTxxIOGkmarhEO9bjcj2QQAAABM"]
[Sat Dec 13 03:46:41.091750 2025] [:error] [pid 23327:tid 23488] [client 20.27.218.61:39264] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aTxxIVvcP-wxXlFbs6R4fAAAAJM"]
[Sat Dec 13 03:46:41.376884 2025] [:error] [pid 23324:tid 23443] [client 20.27.218.61:54642] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aTxxIXghQ59IefnB6COtKQAAAEI"]
[Sat Dec 13 03:46:41.623908 2025] [:error] [pid 23515:tid 23524] [client 20.27.218.61:9777] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aTxxIejEsibkOTPKggXyzwAAAMU"]
[Sat Dec 13 03:46:41.872470 2025] [:error] [pid 23322:tid 23411] [client 20.27.218.61:39774] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aTxxIeGkmarhEO9bjcj2QgAAAAU"]
[Sat Dec 13 03:46:42.180350 2025] [:error] [pid 23322:tid 23430] [client 20.27.218.61:41961] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aTxxIuGkmarhEO9bjcj2QwAAABg"]
[Sat Dec 13 03:46:42.504051 2025] [:error] [pid 23515:tid 23526] [client 20.27.218.61:9735] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/go.php"] [unique_id "aTxxIujEsibkOTPKggXy0QAAAMc"]
[Sat Dec 13 03:46:42.838830 2025] [:error] [pid 23515:tid 23520] [client 20.27.218.61:9492] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/go.php"] [unique_id "aTxxIujEsibkOTPKggXy0gAAAME"]
[Sat Dec 13 03:46:43.105750 2025] [:error] [pid 23324:tid 23448] [client 20.27.218.61:39798] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/go.php"] [unique_id "aTxxI3ghQ59IefnB6COtKgAAAEc"]
[Sat Dec 13 03:46:43.410966 2025] [:error] [pid 23327:tid 23478] [client 20.27.218.61:45793] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/go.php"] [unique_id "aTxxI1vcP-wxXlFbs6R4fwAAAIk"]
[Sat Dec 13 03:46:43.726802 2025] [:error] [pid 23322:tid 23415] [client 20.27.218.61:45776] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aTxxI-GkmarhEO9bjcj2RAAAAAk"]
[Sat Dec 13 03:46:44.016770 2025] [:error] [pid 23322:tid 23418] [client 20.27.218.61:39274] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aTxxJOGkmarhEO9bjcj2RQAAAAw"]
[Sat Dec 13 03:46:44.297067 2025] [:error] [pid 23322:tid 23419] [client 20.27.218.61:39802] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aTxxJOGkmarhEO9bjcj2RwAAAA0"]
[Sat Dec 13 03:46:44.599159 2025] [:error] [pid 23515:tid 23534] [client 20.27.218.61:46396] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aTxxJOjEsibkOTPKggXy1AAAAM8"]
[Sat Dec 13 03:46:44.881069 2025] [:error] [pid 23322:tid 23428] [client 20.27.218.61:9748] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aTxxJOGkmarhEO9bjcj2SAAAABY"]
[Sat Dec 13 03:46:45.195638 2025] [:error] [pid 23322:tid 23409] [client 20.27.218.61:9535] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aTxxJeGkmarhEO9bjcj2SQAAAAM"]
[Sat Dec 13 03:46:45.587618 2025] [:error] [pid 23324:tid 23465] [client 20.27.218.61:9687] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aTxxJXghQ59IefnB6COtLQAAAFg"]
[Sat Dec 13 03:46:45.830838 2025] [:error] [pid 23322:tid 23412] [client 20.27.218.61:54599] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aTxxJeGkmarhEO9bjcj2SgAAAAY"]
[Sat Dec 13 03:46:46.133908 2025] [:error] [pid 23324:tid 23460] [client 20.27.218.61:46377] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conflg.php"] [unique_id "aTxxJnghQ59IefnB6COtLgAAAFM"]
[Sat Dec 13 03:46:46.450243 2025] [:error] [pid 23324:tid 23445] [client 20.27.218.61:9500] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conflg.php"] [unique_id "aTxxJnghQ59IefnB6COtLwAAAEQ"]
[Sat Dec 13 03:46:46.722460 2025] [:error] [pid 23324:tid 23450] [client 20.27.218.61:46341] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conflg.php"] [unique_id "aTxxJnghQ59IefnB6COtMAAAAEk"]
[Sat Dec 13 03:46:46.965456 2025] [:error] [pid 23327:tid 23491] [client 20.27.218.61:44505] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conflg.php"] [unique_id "aTxxJlvcP-wxXlFbs6R4ggAAAJY"]
[Sat Dec 13 03:46:47.289691 2025] [:error] [pid 23515:tid 23530] [client 20.27.218.61:54612] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aTxxJ-jEsibkOTPKggXy1QAAAMs"]
[Sat Dec 13 03:46:47.594221 2025] [:error] [pid 23327:tid 23483] [client 20.27.218.61:45772] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aTxxJ1vcP-wxXlFbs6R4hAAAAI4"]
[Sat Dec 13 03:46:47.865993 2025] [:error] [pid 23515:tid 23537] [client 20.27.218.61:54609] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aTxxJ-jEsibkOTPKggXy1gAAANI"]
[Sat Dec 13 03:46:48.182581 2025] [:error] [pid 23515:tid 23525] [client 20.27.218.61:44519] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aTxxKOjEsibkOTPKggXy2wAAAMY"]
[Sat Dec 13 03:46:48.556155 2025] [:error] [pid 23515:tid 23522] [client 20.27.218.61:39750] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asas.php"] [unique_id "aTxxKOjEsibkOTPKggXy3AAAAMM"]
[Sat Dec 13 03:46:48.813687 2025] [:error] [pid 23515:tid 23535] [client 20.27.218.61:9527] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asas.php"] [unique_id "aTxxKOjEsibkOTPKggXy3QAAANA"]
[Sat Dec 13 03:46:49.088756 2025] [:error] [pid 23322:tid 23417] [client 20.27.218.61:45773] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asas.php"] [unique_id "aTxxKeGkmarhEO9bjcj2SwAAAAs"]
[Sat Dec 13 03:46:49.439825 2025] [:error] [pid 23322:tid 23421] [client 20.27.218.61:9477] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asas.php"] [unique_id "aTxxKeGkmarhEO9bjcj2TAAAAA8"]
[Sat Dec 13 03:46:49.738465 2025] [:error] [pid 23515:tid 23542] [client 20.27.218.61:54643] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aTxxKejEsibkOTPKggXy3gAAANc"]
[Sat Dec 13 03:46:50.031916 2025] [:error] [pid 23515:tid 23543] [client 20.27.218.61:39794] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aTxxKujEsibkOTPKggXy3wAAANg"]
[Sat Dec 13 03:46:50.356529 2025] [:error] [pid 23515:tid 23524] [client 20.27.218.61:54649] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aTxxKujEsibkOTPKggXy4AAAAMU"]
[Sat Dec 13 03:46:50.636073 2025] [:error] [pid 23322:tid 23427] [client 20.27.218.61:39289] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aTxxKuGkmarhEO9bjcj2TgAAABU"]
[Sat Dec 13 03:46:50.909098 2025] [:error] [pid 23324:tid 23458] [client 20.27.218.61:39789] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aTxxKnghQ59IefnB6COtNQAAAFE"]
[Sat Dec 13 03:46:51.157484 2025] [:error] [pid 23515:tid 23526] [client 20.27.218.61:41928] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aTxxK-jEsibkOTPKggXy4gAAAMc"]
[Sat Dec 13 03:46:51.403339 2025] [:error] [pid 23322:tid 23408] [client 20.27.218.61:46352] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aTxxK-GkmarhEO9bjcj2TwAAAAI"]
[Sat Dec 13 03:46:51.654973 2025] [:error] [pid 23324:tid 23456] [client 20.27.218.61:9676] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aTxxK3ghQ59IefnB6COtNgAAAE8"]
[Sat Dec 13 03:46:51.945470 2025] [:error] [pid 23515:tid 23523] [client 20.27.218.61:39249] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "aTxxK-jEsibkOTPKggXy5AAAAMQ"]
[Sat Dec 13 03:46:52.256693 2025] [:error] [pid 23515:tid 23521] [client 20.27.218.61:54592] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "aTxxLOjEsibkOTPKggXy5QAAAMI"]
[Sat Dec 13 03:46:52.531191 2025] [:error] [pid 23515:tid 23539] [client 20.27.218.61:39260] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "aTxxLOjEsibkOTPKggXy5gAAANQ"]
[Sat Dec 13 03:46:52.788591 2025] [:error] [pid 23515:tid 23541] [client 20.27.218.61:54610] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "aTxxLOjEsibkOTPKggXy6AAAANY"]
[Sat Dec 13 03:46:53.129643 2025] [:error] [pid 23515:tid 23527] [client 20.27.218.61:26912] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aTxxLejEsibkOTPKggXy6QAAAMg"]
[Sat Dec 13 03:46:53.403909 2025] [:error] [pid 23515:tid 23537] [client 20.27.218.61:39269] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aTxxLejEsibkOTPKggXy6gAAANI"]
[Sat Dec 13 03:46:53.736287 2025] [:error] [pid 23322:tid 23407] [client 20.27.218.61:46350] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aTxxLeGkmarhEO9bjcj2UgAAAAE"]
[Sat Dec 13 03:46:54.060643 2025] [:error] [pid 23322:tid 23425] [client 20.27.218.61:9710] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aTxxLuGkmarhEO9bjcj2VAAAABM"]
[Sat Dec 13 03:46:54.372704 2025] [:error] [pid 23322:tid 23411] [client 20.27.218.61:39793] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r.php"] [unique_id "aTxxLuGkmarhEO9bjcj2VQAAAAU"]
[Sat Dec 13 03:46:54.634683 2025] [:error] [pid 23327:tid 23486] [client 20.27.218.61:39785] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r.php"] [unique_id "aTxxLlvcP-wxXlFbs6R4hQAAAJE"]
[Sat Dec 13 03:46:54.880830 2025] [:error] [pid 23515:tid 23519] [client 20.27.218.61:39240] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r.php"] [unique_id "aTxxLujEsibkOTPKggXy8AAAAMA"]
[Sat Dec 13 03:46:55.164812 2025] [:error] [pid 23327:tid 23471] [client 20.27.218.61:9667] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r.php"] [unique_id "aTxxL1vcP-wxXlFbs6R4hgAAAII"]
[Sat Dec 13 03:46:55.413595 2025] [:error] [pid 23515:tid 23522] [client 20.27.218.61:9672] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aTxxL-jEsibkOTPKggXy8QAAAMM"]
[Sat Dec 13 03:46:55.659983 2025] [:error] [pid 23515:tid 23535] [client 20.27.218.61:9699] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aTxxL-jEsibkOTPKggXy8gAAANA"]
[Sat Dec 13 03:46:55.901155 2025] [:error] [pid 23515:tid 23524] [client 20.27.218.61:46399] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aTxxL-jEsibkOTPKggXy9AAAAMU"]
[Sat Dec 13 03:46:56.195502 2025] [:error] [pid 23322:tid 23430] [client 20.27.218.61:39280] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aTxxMOGkmarhEO9bjcj2VgAAABg"]
[Sat Dec 13 03:46:56.442470 2025] [:error] [pid 23322:tid 23424] [client 20.27.218.61:44516] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js.php"] [unique_id "aTxxMOGkmarhEO9bjcj2VwAAABI"]
[Sat Dec 13 03:46:56.707334 2025] [:error] [pid 23327:tid 23484] [client 20.27.218.61:25359] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js.php"] [unique_id "aTxxMFvcP-wxXlFbs6R4iAAAAI8"]
[Sat Dec 13 03:46:56.949390 2025] [:error] [pid 23322:tid 23428] [client 20.27.218.61:26939] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js.php"] [unique_id "aTxxMOGkmarhEO9bjcj2WwAAABY"]
[Sat Dec 13 03:46:57.190519 2025] [:error] [pid 23322:tid 23409] [client 20.27.218.61:46367] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js.php"] [unique_id "aTxxMeGkmarhEO9bjcj2XAAAAAM"]
[Sat Dec 13 03:46:57.456172 2025] [:error] [pid 23515:tid 23520] [client 20.27.218.61:54640] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file1.php"] [unique_id "aTxxMejEsibkOTPKggXy9QAAAME"]
[Sat Dec 13 03:46:57.702028 2025] [:error] [pid 23515:tid 23523] [client 20.27.218.61:39294] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file1.php"] [unique_id "aTxxMejEsibkOTPKggXy9gAAAMQ"]
[Sat Dec 13 03:46:57.975664 2025] [:error] [pid 23324:tid 23446] [client 20.27.218.61:45820] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file1.php"] [unique_id "aTxxMXghQ59IefnB6COtOwAAAEU"]
[Sat Dec 13 03:46:58.221880 2025] [:error] [pid 23324:tid 23465] [client 20.27.218.61:54638] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file1.php"] [unique_id "aTxxMnghQ59IefnB6COtPAAAAFg"]
[Sat Dec 13 03:46:58.478472 2025] [:error] [pid 23322:tid 23427] [client 20.27.218.61:9754] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "aTxxMuGkmarhEO9bjcj2YAAAABU"]
[Sat Dec 13 03:46:58.720821 2025] [:error] [pid 23322:tid 23408] [client 20.27.218.61:44537] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "aTxxMuGkmarhEO9bjcj2YQAAAAI"]
[Sat Dec 13 03:46:58.990189 2025] [:error] [pid 23515:tid 23527] [client 20.27.218.61:39112] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "aTxxMujEsibkOTPKggXy9wAAAMg"]
[Sat Dec 13 03:46:59.235071 2025] [:error] [pid 23324:tid 23445] [client 20.27.218.61:9685] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "aTxxM3ghQ59IefnB6COtPgAAAEQ"]
[Sat Dec 13 03:46:59.476923 2025] [:error] [pid 23322:tid 23425] [client 20.27.218.61:39272] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/123.php"] [unique_id "aTxxM-GkmarhEO9bjcj2YwAAABM"]
[Sat Dec 13 03:46:59.724341 2025] [:error] [pid 23322:tid 23411] [client 20.27.218.61:9733] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/123.php"] [unique_id "aTxxM-GkmarhEO9bjcj2ZAAAAAU"]
[Sat Dec 13 03:46:59.966271 2025] [:error] [pid 23515:tid 23534] [client 20.27.218.61:44493] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/123.php"] [unique_id "aTxxM-jEsibkOTPKggXy-gAAAM8"]
[Sat Dec 13 03:47:00.236534 2025] [:error] [pid 23322:tid 23430] [client 20.27.218.61:39766] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/123.php"] [unique_id "aTxxNOGkmarhEO9bjcj2ZwAAABg"]
[Sat Dec 13 03:47:00.491330 2025] [:error] [pid 23322:tid 23420] [client 20.27.218.61:39241] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/321.php"] [unique_id "aTxxNOGkmarhEO9bjcj2aAAAAA4"]
[Sat Dec 13 03:47:00.734865 2025] [:error] [pid 23515:tid 23537] [client 20.27.218.61:9493] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/321.php"] [unique_id "aTxxNOjEsibkOTPKggXy-wAAANI"]
[Sat Dec 13 03:47:00.981167 2025] [:error] [pid 23324:tid 23453] [client 20.27.218.61:45813] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/321.php"] [unique_id "aTxxNHghQ59IefnB6COtQQAAAEw"]
[Sat Dec 13 03:47:01.228136 2025] [:error] [pid 23324:tid 23455] [client 20.27.218.61:46358] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/321.php"] [unique_id "aTxxNXghQ59IefnB6COtQwAAAE4"]
[Sat Dec 13 03:47:01.473260 2025] [:error] [pid 23515:tid 23531] [client 20.27.218.61:45769] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aTxxNejEsibkOTPKggXy_AAAAMw"]
[Sat Dec 13 03:47:01.742462 2025] [:error] [pid 23322:tid 23424] [client 20.27.218.61:39277] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aTxxNeGkmarhEO9bjcj2aQAAABI"]
[Sat Dec 13 03:47:01.986329 2025] [:error] [pid 23322:tid 23413] [client 20.27.218.61:9674] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aTxxNeGkmarhEO9bjcj2agAAAAc"]
[Sat Dec 13 03:47:02.227733 2025] [:error] [pid 23322:tid 23419] [client 20.27.218.61:39116] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aTxxNuGkmarhEO9bjcj2awAAAA0"]
[Sat Dec 13 03:47:02.479901 2025] [:error] [pid 23515:tid 23536] [client 20.27.218.61:46354] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aTxxNujEsibkOTPKggXy_gAAANE"]
[Sat Dec 13 03:47:02.722076 2025] [:error] [pid 23515:tid 23538] [client 20.27.218.61:9726] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aTxxNujEsibkOTPKggXy_wAAANM"]
[Sat Dec 13 03:47:02.963441 2025] [:error] [pid 23322:tid 23428] [client 20.27.218.61:41980] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aTxxNuGkmarhEO9bjcj2bAAAABY"]
[Sat Dec 13 03:47:03.216798 2025] [:error] [pid 23322:tid 23409] [client 20.27.218.61:9516] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aTxxN-GkmarhEO9bjcj2bQAAAAM"]
[Sat Dec 13 03:47:03.458800 2025] [:error] [pid 23322:tid 23417] [client 20.27.218.61:39760] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/al.php"] [unique_id "aTxxN-GkmarhEO9bjcj2bwAAAAs"]
[Sat Dec 13 03:47:03.699605 2025] [:error] [pid 23322:tid 23427] [client 20.27.218.61:39800] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/al.php"] [unique_id "aTxxN-GkmarhEO9bjcj2cAAAABU"]
[Sat Dec 13 03:47:03.940483 2025] [:error] [pid 23327:tid 23487] [client 20.27.218.61:9787] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/al.php"] [unique_id "aTxxN1vcP-wxXlFbs6R4igAAAJI"]
[Sat Dec 13 03:47:04.183323 2025] [:error] [pid 23327:tid 23473] [client 20.27.218.61:41921] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/al.php"] [unique_id "aTxxOFvcP-wxXlFbs6R4iwAAAIQ"]
[Sat Dec 13 03:47:04.437045 2025] [:error] [pid 23327:tid 23474] [client 20.27.218.61:9514] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aTxxOFvcP-wxXlFbs6R4jAAAAIU"]
[Sat Dec 13 03:47:04.681045 2025] [:error] [pid 23327:tid 23472] [client 20.27.218.61:39273] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aTxxOFvcP-wxXlFbs6R4jQAAAIM"]
[Sat Dec 13 03:47:04.949112 2025] [:error] [pid 23327:tid 23476] [client 20.27.218.61:26895] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aTxxOFvcP-wxXlFbs6R4jwAAAIc"]
[Sat Dec 13 03:47:05.189476 2025] [:error] [pid 23324:tid 23458] [client 20.27.218.61:39782] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aTxxOXghQ59IefnB6COtRQAAAFE"]
[Sat Dec 13 03:47:05.447741 2025] [:error] [pid 23327:tid 23470] [client 20.27.218.61:9725] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "aTxxOVvcP-wxXlFbs6R4kAAAAIE"]
[Sat Dec 13 03:47:05.753774 2025] [:error] [pid 23322:tid 23425] [client 20.27.218.61:9515] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "aTxxOeGkmarhEO9bjcj2cwAAABM"]
[Sat Dec 13 03:47:05.994247 2025] [:error] [pid 23322:tid 23430] [client 20.27.218.61:46339] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "aTxxOeGkmarhEO9bjcj2dQAAABg"]
[Sat Dec 13 03:47:06.241223 2025] [:error] [pid 23515:tid 23543] [client 20.27.218.61:39159] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "aTxxOujEsibkOTPKggXzBAAAANg"]
[Sat Dec 13 03:47:06.533735 2025] [:error] [pid 23515:tid 23529] [client 20.27.218.61:9497] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "aTxxOujEsibkOTPKggXzBQAAAMo"]
[Sat Dec 13 03:47:06.775993 2025] [:error] [pid 23515:tid 23526] [client 20.27.218.61:39788] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "aTxxOujEsibkOTPKggXzBgAAAMc"]
[Sat Dec 13 03:47:07.017046 2025] [:error] [pid 23327:tid 23491] [client 20.27.218.61:9729] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "aTxxO1vcP-wxXlFbs6R4kwAAAJY"]
[Sat Dec 13 03:47:07.259793 2025] [:error] [pid 23327:tid 23475] [client 20.27.218.61:39746] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "aTxxO1vcP-wxXlFbs6R4lAAAAIY"]
[Sat Dec 13 03:47:07.503828 2025] [:error] [pid 23324:tid 23457] [client 20.27.218.61:54650] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ty.php"] [unique_id "aTxxO3ghQ59IefnB6COtRgAAAFA"]
[Sat Dec 13 03:47:07.750799 2025] [:error] [pid 23322:tid 23424] [client 20.27.218.61:44487] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ty.php"] [unique_id "aTxxO-GkmarhEO9bjcj2dgAAABI"]
[Sat Dec 13 03:47:07.996492 2025] [:error] [pid 23515:tid 23523] [client 20.27.218.61:9677] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ty.php"] [unique_id "aTxxO-jEsibkOTPKggXzCAAAAMQ"]
[Sat Dec 13 03:47:08.263213 2025] [:error] [pid 23515:tid 23541] [client 20.27.218.61:9744] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ty.php"] [unique_id "aTxxPOjEsibkOTPKggXzCQAAANY"]
[Sat Dec 13 03:47:08.505189 2025] [:error] [pid 23515:tid 23534] [client 20.27.218.61:9703] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "aTxxPOjEsibkOTPKggXzCgAAAM8"]
[Sat Dec 13 03:47:08.752621 2025] [:error] [pid 23515:tid 23530] [client 20.27.218.61:45785] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "aTxxPOjEsibkOTPKggXzCwAAAMs"]
[Sat Dec 13 03:47:09.016566 2025] [:error] [pid 23322:tid 23428] [client 20.27.218.61:39791] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "aTxxPeGkmarhEO9bjcj2eAAAABY"]
[Sat Dec 13 03:47:09.274035 2025] [:error] [pid 23515:tid 23538] [client 20.27.218.61:45778] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "aTxxPejEsibkOTPKggXzDQAAANM"]
[Sat Dec 13 03:47:09.526056 2025] [:error] [pid 23322:tid 23421] [client 20.27.218.61:54595] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aTxxPeGkmarhEO9bjcj2fAAAAA8"]
[Sat Dec 13 03:47:09.781859 2025] [:error] [pid 23515:tid 23525] [client 20.27.218.61:9782] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aTxxPejEsibkOTPKggXzDwAAAMY"]
[Sat Dec 13 03:47:10.049393 2025] [:error] [pid 23515:tid 23519] [client 20.27.218.61:9727] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aTxxPujEsibkOTPKggXzEQAAAMA"]
[Sat Dec 13 03:47:10.298973 2025] [:error] [pid 23327:tid 23469] [client 20.27.218.61:9495] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aTxxPlvcP-wxXlFbs6R4lgAAAIA"]
[Sat Dec 13 03:47:10.575106 2025] [:error] [pid 23322:tid 23410] [client 20.27.218.61:46398] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/c.php"] [unique_id "aTxxPuGkmarhEO9bjcj2fQAAAAQ"]
[Sat Dec 13 03:47:10.915283 2025] [:error] [pid 23322:tid 23408] [client 20.27.218.61:39759] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/c.php"] [unique_id "aTxxPuGkmarhEO9bjcj2fgAAAAI"]
[Sat Dec 13 03:47:11.188816 2025] [:error] [pid 23322:tid 23429] [client 20.27.218.61:39769] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/c.php"] [unique_id "aTxxP-GkmarhEO9bjcj2fwAAABc"]
[Sat Dec 13 03:47:11.534395 2025] [:error] [pid 23327:tid 23471] [client 20.27.218.61:46397] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/c.php"] [unique_id "aTxxP1vcP-wxXlFbs6R4mAAAAII"]
[Sat Dec 13 03:47:11.803494 2025] [:error] [pid 23322:tid 23425] [client 20.27.218.61:39745] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xo.php"] [unique_id "aTxxP-GkmarhEO9bjcj2gQAAABM"]
[Sat Dec 13 03:47:12.045650 2025] [:error] [pid 23327:tid 23493] [client 20.27.218.61:46370] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xo.php"] [unique_id "aTxxQFvcP-wxXlFbs6R4mgAAAJg"]
[Sat Dec 13 03:47:12.288155 2025] [:error] [pid 23327:tid 23473] [client 20.27.218.61:39744] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xo.php"] [unique_id "aTxxQFvcP-wxXlFbs6R4mwAAAIQ"]
[Sat Dec 13 03:47:12.562103 2025] [:error] [pid 23515:tid 23526] [client 20.27.218.61:39776] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xo.php"] [unique_id "aTxxQOjEsibkOTPKggXzFAAAAMc"]
[Sat Dec 13 03:47:12.833308 2025] [:error] [pid 23327:tid 23488] [client 20.27.218.61:9684] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dlu.php"] [unique_id "aTxxQFvcP-wxXlFbs6R4ngAAAJM"]
[Sat Dec 13 03:47:13.100406 2025] [:error] [pid 23322:tid 23411] [client 20.27.218.61:9705] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dlu.php"] [unique_id "aTxxQeGkmarhEO9bjcj2ggAAAAU"]
[Sat Dec 13 03:47:13.369068 2025] [:error] [pid 23322:tid 23420] [client 20.27.218.61:9732] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dlu.php"] [unique_id "aTxxQeGkmarhEO9bjcj2hAAAAA4"]
[Sat Dec 13 03:47:13.671201 2025] [:error] [pid 23322:tid 23428] [client 20.27.218.61:26929] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dlu.php"] [unique_id "aTxxQeGkmarhEO9bjcj2hQAAABY"]
[Sat Dec 13 03:47:14.006613 2025] [:error] [pid 23322:tid 23414] [client 20.27.218.61:39165] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rk2.php"] [unique_id "aTxxQuGkmarhEO9bjcj2iAAAAAg"]
[Sat Dec 13 03:47:14.309755 2025] [:error] [pid 23324:tid 23446] [client 20.27.218.61:26885] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rk2.php"] [unique_id "aTxxQnghQ59IefnB6COtSAAAAEU"]
[Sat Dec 13 03:47:14.604247 2025] [:error] [pid 23515:tid 23520] [client 20.27.218.61:44534] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rk2.php"] [unique_id "aTxxQujEsibkOTPKggXzFQAAAME"]
[Sat Dec 13 03:47:14.972716 2025] [:error] [pid 23324:tid 23465] [client 20.27.218.61:26921] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rk2.php"] [unique_id "aTxxQnghQ59IefnB6COtSQAAAFg"]
[Sat Dec 13 03:47:15.220696 2025] [:error] [pid 23322:tid 23423] [client 20.27.218.61:46394] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aTxxQ-GkmarhEO9bjcj2iwAAABE"]
[Sat Dec 13 03:47:15.499078 2025] [:error] [pid 23322:tid 23427] [client 20.27.218.61:9779] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aTxxQ-GkmarhEO9bjcj2jAAAABU"]
[Sat Dec 13 03:47:15.756202 2025] [:error] [pid 23322:tid 23412] [client 20.27.218.61:39775] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aTxxQ-GkmarhEO9bjcj2jQAAAAY"]
[Sat Dec 13 03:47:16.069422 2025] [:error] [pid 23324:tid 23445] [client 20.27.218.61:25394] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aTxxRHghQ59IefnB6COtSgAAAEQ"]
[Sat Dec 13 03:47:16.318042 2025] [:error] [pid 23322:tid 23408] [client 20.27.218.61:9778] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aTxxROGkmarhEO9bjcj2jgAAAAI"]
[Sat Dec 13 03:47:16.575656 2025] [:error] [pid 23324:tid 23450] [client 20.27.218.61:39780] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aTxxRHghQ59IefnB6COtSwAAAEk"]
[Sat Dec 13 03:47:16.892489 2025] [:error] [pid 23327:tid 23480] [client 20.27.218.61:39143] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aTxxRFvcP-wxXlFbs6R4oQAAAIs"]
[Sat Dec 13 03:47:17.158568 2025] [:error] [pid 23327:tid 23485] [client 20.27.218.61:45770] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aTxxRVvcP-wxXlFbs6R4ogAAAJA"]
[Sat Dec 13 03:47:17.527532 2025] [:error] [pid 23515:tid 23532] [client 20.27.218.61:9753] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aTxxRejEsibkOTPKggXzGgAAAM0"]
[Sat Dec 13 03:47:17.842916 2025] [:error] [pid 23327:tid 23483] [client 20.27.218.61:9482] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aTxxRVvcP-wxXlFbs6R4pAAAAI4"]
[Sat Dec 13 03:47:18.160938 2025] [:error] [pid 23327:tid 23469] [client 20.27.218.61:39128] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aTxxRlvcP-wxXlFbs6R4pQAAAIA"]
[Sat Dec 13 03:47:18.418968 2025] [:error] [pid 23327:tid 23486] [client 20.27.218.61:9723] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aTxxRlvcP-wxXlFbs6R4pgAAAJE"]
[Sat Dec 13 03:47:18.728440 2025] [:error] [pid 23327:tid 23477] [client 20.27.218.61:26900] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aTxxRlvcP-wxXlFbs6R4qgAAAIg"]
[Sat Dec 13 03:47:18.996240 2025] [:error] [pid 23515:tid 23543] [client 20.27.218.61:39803] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aTxxRujEsibkOTPKggXzHAAAANg"]
[Sat Dec 13 03:47:19.329152 2025] [:error] [pid 23327:tid 23487] [client 20.27.218.61:46399] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aTxxR1vcP-wxXlFbs6R4rAAAAJI"]
[Sat Dec 13 03:47:19.624778 2025] [:error] [pid 23324:tid 23451] [client 20.27.218.61:9682] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aTxxR3ghQ59IefnB6COtTgAAAEo"]
[Sat Dec 13 03:47:19.876529 2025] [:error] [pid 23324:tid 23447] [client 20.27.218.61:45768] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/406.php"] [unique_id "aTxxR3ghQ59IefnB6COtUAAAAEY"]
[Sat Dec 13 03:47:20.130174 2025] [:error] [pid 23324:tid 23454] [client 20.27.218.61:45780] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/406.php"] [unique_id "aTxxSHghQ59IefnB6COtUQAAAE0"]
[Sat Dec 13 03:47:20.396641 2025] [:error] [pid 23327:tid 23473] [client 20.27.218.61:54594] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/406.php"] [unique_id "aTxxSFvcP-wxXlFbs6R4rQAAAIQ"]
[Sat Dec 13 03:47:20.771154 2025] [:error] [pid 23327:tid 23474] [client 20.27.218.61:9525] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/406.php"] [unique_id "aTxxSFvcP-wxXlFbs6R4rgAAAIU"]
[Sat Dec 13 03:47:21.026200 2025] [:error] [pid 23324:tid 23456] [client 20.27.218.61:9738] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mariju.php"] [unique_id "aTxxSXghQ59IefnB6COtUwAAAE8"]
[Sat Dec 13 03:47:21.425817 2025] [:error] [pid 23327:tid 23479] [client 20.27.218.61:46342] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mariju.php"] [unique_id "aTxxSVvcP-wxXlFbs6R4rwAAAIo"]
[Sat Dec 13 03:47:21.668781 2025] [:error] [pid 23327:tid 23488] [client 20.27.218.61:9737] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mariju.php"] [unique_id "aTxxSVvcP-wxXlFbs6R4sAAAAJM"]
[Sat Dec 13 03:47:21.955214 2025] [:error] [pid 23327:tid 23470] [client 20.27.218.61:39293] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mariju.php"] [unique_id "aTxxSVvcP-wxXlFbs6R4sQAAAIE"]
[Sat Dec 13 03:47:22.251220 2025] [:error] [pid 23515:tid 23524] [client 20.27.218.61:41937] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aTxxSujEsibkOTPKggXzHgAAAMU"]
[Sat Dec 13 03:47:22.499435 2025] [:error] [pid 23515:tid 23528] [client 20.27.218.61:41944] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aTxxSujEsibkOTPKggXzHwAAAMk"]
[Sat Dec 13 03:47:22.750353 2025] [:error] [pid 23327:tid 23480] [client 20.27.218.61:39155] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aTxxSlvcP-wxXlFbs6R4sgAAAIs"]
[Sat Dec 13 03:47:22.992773 2025] [:error] [pid 23327:tid 23485] [client 20.27.218.61:9505] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aTxxSlvcP-wxXlFbs6R4swAAAJA"]
[Sat Dec 13 03:47:23.236736 2025] [:error] [pid 23322:tid 23418] [client 20.27.218.61:26926] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cache.php"] [unique_id "aTxxS-GkmarhEO9bjcj2kQAAAAw"]
[Sat Dec 13 03:47:23.538737 2025] [:error] [pid 23515:tid 23521] [client 20.27.218.61:45771] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cache.php"] [unique_id "aTxxS-jEsibkOTPKggXzIgAAAMI"]
[Sat Dec 13 03:47:23.831376 2025] [:error] [pid 23324:tid 23443] [client 20.27.218.61:45783] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cache.php"] [unique_id "aTxxS3ghQ59IefnB6COtVQAAAEI"]
[Sat Dec 13 03:47:30.682082 2025] [:error] [pid 23324:tid 23447] [client 20.27.218.61:25344] [client 20.27.218.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aTxxUnghQ59IefnB6COtYwAAAEY"]
[Sat Dec 13 03:47:35.072082 2025] [:error] [pid 23515:tid 23521] [client 20.27.218.61:26943] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aTxxV-jEsibkOTPKggXzLwAAAMI"]
[Sat Dec 13 03:47:35.379102 2025] [:error] [pid 23515:tid 23523] [client 20.27.218.61:9758] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aTxxV-jEsibkOTPKggXzMAAAAMQ"]
[Sat Dec 13 03:47:35.653650 2025] [:error] [pid 23515:tid 23537] [client 20.27.218.61:45788] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aTxxV-jEsibkOTPKggXzMQAAANI"]
[Sat Dec 13 03:47:35.897838 2025] [:error] [pid 23515:tid 23520] [client 20.27.218.61:25400] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aTxxV-jEsibkOTPKggXzMwAAAME"]
[Sat Dec 13 03:47:36.149455 2025] [:error] [pid 23324:tid 23451] [client 20.27.218.61:41922] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aTxxWHghQ59IefnB6COtbAAAAEo"]
[Sat Dec 13 03:47:36.423903 2025] [:error] [pid 23322:tid 23424] [client 20.27.218.61:9681] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aTxxWOGkmarhEO9bjcj2lgAAABI"]
[Sat Dec 13 03:47:36.666134 2025] [:error] [pid 23324:tid 23462] [client 20.27.218.61:9762] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aTxxWHghQ59IefnB6COtbQAAAFU"]
[Sat Dec 13 03:47:36.919286 2025] [:error] [pid 23515:tid 23531] [client 20.27.218.61:26916] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aTxxWOjEsibkOTPKggXzNQAAAMw"]
[Sat Dec 13 03:47:37.208965 2025] [:error] [pid 23322:tid 23429] [client 20.27.218.61:54616] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mpvloi.php"] [unique_id "aTxxWeGkmarhEO9bjcj2lwAAABc"]
[Sat Dec 13 03:47:37.457334 2025] [:error] [pid 23327:tid 23473] [client 20.27.218.61:39270] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mpvloi.php"] [unique_id "aTxxWVvcP-wxXlFbs6R4uQAAAIQ"]
[Sat Dec 13 03:47:37.698460 2025] [:error] [pid 23327:tid 23474] [client 20.27.218.61:9721] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mpvloi.php"] [unique_id "aTxxWVvcP-wxXlFbs6R4ugAAAIU"]
[Sat Dec 13 03:47:37.939401 2025] [:error] [pid 23515:tid 23533] [client 20.27.218.61:45812] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mpvloi.php"] [unique_id "aTxxWejEsibkOTPKggXzNgAAAM4"]
[Sat Dec 13 03:47:38.184766 2025] [:error] [pid 23327:tid 23488] [client 20.27.218.61:45760] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v1.php"] [unique_id "aTxxWlvcP-wxXlFbs6R4vAAAAJM"]
[Sat Dec 13 03:47:38.430154 2025] [:error] [pid 23515:tid 23525] [client 20.27.218.61:46353] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v1.php"] [unique_id "aTxxWujEsibkOTPKggXzNwAAAMY"]
[Sat Dec 13 03:47:38.673306 2025] [:error] [pid 23515:tid 23534] [client 20.27.218.61:9719] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v1.php"] [unique_id "aTxxWujEsibkOTPKggXzOQAAAM8"]
[Sat Dec 13 03:47:38.916164 2025] [:error] [pid 23327:tid 23470] [client 20.27.218.61:10068] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v1.php"] [unique_id "aTxxWlvcP-wxXlFbs6R4vQAAAIE"]
[Sat Dec 13 03:47:39.160849 2025] [:error] [pid 23327:tid 23472] [client 20.27.218.61:26890] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2.php"] [unique_id "aTxxW1vcP-wxXlFbs6R4vgAAAIM"]
[Sat Dec 13 03:47:39.402735 2025] [:error] [pid 23515:tid 23532] [client 20.27.218.61:45784] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2.php"] [unique_id "aTxxW-jEsibkOTPKggXzOgAAAM0"]
[Sat Dec 13 03:47:39.647186 2025] [:error] [pid 23322:tid 23425] [client 20.27.218.61:46349] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2.php"] [unique_id "aTxxW-GkmarhEO9bjcj2mAAAABM"]
[Sat Dec 13 03:47:39.888592 2025] [:error] [pid 23515:tid 23527] [client 20.27.218.61:9490] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2.php"] [unique_id "aTxxW-jEsibkOTPKggXzOwAAAMg"]
[Sat Dec 13 03:47:40.134726 2025] [:error] [pid 23515:tid 23519] [client 20.27.218.61:41960] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dex.php"] [unique_id "aTxxXOjEsibkOTPKggXzPAAAAMA"]
[Sat Dec 13 03:47:40.376166 2025] [:error] [pid 23322:tid 23409] [client 20.27.218.61:25367] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dex.php"] [unique_id "aTxxXOGkmarhEO9bjcj2mgAAAAM"]
[Sat Dec 13 03:47:40.617226 2025] [:error] [pid 23327:tid 23478] [client 20.27.218.61:39783] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dex.php"] [unique_id "aTxxXFvcP-wxXlFbs6R4wAAAAIk"]
[Sat Dec 13 03:47:40.860451 2025] [:error] [pid 23515:tid 23542] [client 20.27.218.61:25376] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dex.php"] [unique_id "aTxxXOjEsibkOTPKggXzPQAAANc"]
[Sat Dec 13 03:47:41.103967 2025] [:error] [pid 23322:tid 23416] [client 20.27.218.61:41952] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/angelV2.php"] [unique_id "aTxxXeGkmarhEO9bjcj2mwAAAAo"]
[Sat Dec 13 03:47:41.344624 2025] [:error] [pid 23327:tid 23480] [client 20.27.218.61:26899] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/angelV2.php"] [unique_id "aTxxXVvcP-wxXlFbs6R4wQAAAIs"]
[Sat Dec 13 03:47:41.585594 2025] [:error] [pid 23322:tid 23420] [client 20.27.218.61:45774] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/angelV2.php"] [unique_id "aTxxXeGkmarhEO9bjcj2nQAAAA4"]
[Sat Dec 13 03:47:41.826778 2025] [:error] [pid 23327:tid 23485] [client 20.27.218.61:39121] [client 20.27.218.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/angelV2.php"] [unique_id "aTxxXVvcP-wxXlFbs6R4wgAAAJA"]
[Sat Dec 13 04:12:37.848031 2025] [:error] [pid 64354:tid 64400] [client 38.97.60.82:50639] [client 38.97.60.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "aTx3NWmYRhyd1x4hQJUA1gAAAEA"], referer: binance.com
[Sat Dec 13 04:27:29.780837 2025] [:error] [pid 43747:tid 43767] [client 45.8.17.70:49077] [client 45.8.17.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTx6sZYw3twBd_JQEHiOEwAAABA"]
[Sat Dec 13 04:53:08.989867 2025] [:error] [pid 43836:tid 43840] [client 81.88.49.8:59428] [client 81.88.49.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.88.49.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTyAtGAEOBirsxb11nZwVwAAAMI"]
[Sat Dec 13 04:53:09.989563 2025] [:error] [pid 43836:tid 43846] [client 81.88.49.8:59428] [client 81.88.49.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.88.49.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTyAtWAEOBirsxb11nZwWAAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 05:09:02.828134 2025] [:error] [pid 43748:tid 43787] [client 66.175.44.61:41036] [client 66.175.44.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTyEbqrTT0VzE3gYjcAr6AAAAEg"]
[Sat Dec 13 05:09:04.068982 2025] [:error] [pid 43748:tid 43781] [client 66.175.44.61:41036] [client 66.175.44.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTyEcKrTT0VzE3gYjcAr6wAAAEI"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 05:21:02.650605 2025] [:error] [pid 43836:tid 43860] [client 185.125.27.120:44782] [client 185.125.27.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.125.27.120, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTyHPmAEOBirsxb11nZ47wAAANY"]
[Sat Dec 13 05:21:04.264101 2025] [:error] [pid 43836:tid 43853] [client 185.125.27.120:44782] [client 185.125.27.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.125.27.120, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTyHQGAEOBirsxb11nZ49gAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 06:28:40.266215 2025] [:error] [pid 43747:tid 43757] [client 45.8.17.80:24895] [client 45.8.17.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTyXGJYw3twBd_JQEHirSwAAAAY"]
[Sat Dec 13 06:42:00.431045 2025] [:error] [pid 43748:tid 43791] [client 45.8.17.80:57841] [client 45.8.17.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTyaOKrTT0VzE3gYjcBAOAAAAEw"]
[Sat Dec 13 07:24:46.592189 2025] [:error] [pid 43749:tid 43824] [client 45.134.182.107:51687] [client 45.134.182.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.134.182.107, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTykPnOk7VNylTjPi3ykPwAAAJI"], referer: https://expressinteriors.com/
[Sat Dec 13 07:24:49.723816 2025] [:error] [pid 43748:tid 43793] [client 45.134.182.107:44651] [client 45.134.182.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.134.182.107, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTykQarTT0VzE3gYjcBJXQAAAE4"], referer: https://expressinteriors.com/wp-login.php?action=register
[Sat Dec 13 07:28:46.854215 2025] [:error] [pid 43748:tid 43804] [client 45.8.17.70:61349] [client 45.8.17.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTylLqrTT0VzE3gYjcBKZAAAAFg"]
[Sat Dec 13 07:59:21.176111 2025] [:error] [pid 55037:tid 55039] [client 173.201.178.72:50750] [client 173.201.178.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.201.178.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTysWRyx7iFaaIMvMOEqtwAAAUA"]
[Sat Dec 13 07:59:22.185341 2025] [:error] [pid 55037:tid 55041] [client 173.201.178.72:50750] [client 173.201.178.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.201.178.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTysWhyx7iFaaIMvMOEquQAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 08:54:48.001534 2025] [:error] [pid 55037:tid 55063] [client 45.8.17.75:48265] [client 45.8.17.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.75, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTy5WByx7iFaaIMvMOExTAAAAVg"]
[Sat Dec 13 09:08:00.881372 2025] [:error] [pid 39287:tid 39308] [client 45.8.17.80:39529] [client 45.8.17.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTy8cDBwBW1JRRoCYqZDaQAAARM"]
[Sat Dec 13 09:16:23.969633 2025] [:error] [pid 43749:tid 43811] [client 185.104.44.83:4928] [client 185.104.44.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.104.44.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTy-Z3Ok7VNylTjPi3yyugAAAIU"]
[Sat Dec 13 09:16:25.106323 2025] [:error] [pid 43749:tid 43827] [client 185.104.44.83:4928] [client 185.104.44.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.104.44.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTy-aXOk7VNylTjPi3yyuwAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 09:52:16.567950 2025] [:error] [pid 43748:tid 43788] [client 43.155.27.244:37930] [client 43.155.27.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aTzG0KrTT0VzE3gYjcBg7AAAAEk"]
[Sat Dec 13 10:13:27.373640 2025] [:error] [pid 55037:tid 55055] [client 173.236.193.45:45784] [client 173.236.193.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.193.45, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTzLxxyx7iFaaIMvMOE6nAAAAVA"]
[Sat Dec 13 10:13:29.682059 2025] [:error] [pid 55037:tid 55048] [client 173.236.193.45:45784] [client 173.236.193.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.193.45, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTzLyRyx7iFaaIMvMOE6ngAAAUk"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 11:01:52.604901 2025] [:error] [pid 43836:tid 43854] [client 130.61.174.112:45820] [client 130.61.174.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 130.61.174.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTzXIGAEOBirsxb11nbCQgAAANA"]
[Sat Dec 13 11:01:53.853313 2025] [:error] [pid 43836:tid 43839] [client 130.61.174.112:45820] [client 130.61.174.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 130.61.174.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTzXIWAEOBirsxb11nbCQwAAAME"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 11:16:50.124430 2025] [:error] [pid 39287:tid 39311] [client 107.180.115.119:46888] [client 107.180.115.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.115.119, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTzaojBwBW1JRRoCYqZT5wAAARY"]
[Sat Dec 13 11:49:47.319627 2025] [:error] [pid 43836:tid 43861] [client 45.8.17.85:41233] [client 45.8.17.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTziW2AEOBirsxb11nbI4QAAANc"]
[Sat Dec 13 11:56:31.073611 2025] [:error] [pid 55037:tid 55051] [client 45.8.17.85:33039] [client 45.8.17.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTzj7xyx7iFaaIMvMOFIwQAAAUw"]
[Sat Dec 13 12:57:07.424258 2025] [:error] [pid 43749:tid 43818] [client 15.235.140.141:59278] [client 15.235.140.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.235.140.141, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTzyI3Ok7VNylTjPi3zccgAAAIw"]
[Sat Dec 13 12:57:09.705769 2025] [:error] [pid 43749:tid 43810] [client 15.235.140.141:59278] [client 15.235.140.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.235.140.141, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTzyJXOk7VNylTjPi3zcdQAAAIQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 13:00:41.511560 2025] [:error] [pid 43748:tid 43793] [client 45.154.98.18:55230] [client 45.154.98.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aTzy-arTT0VzE3gYjcCIPQAAAE4"]
[Sat Dec 13 13:00:42.082254 2025] [:error] [pid 43748:tid 43800] [client 45.154.98.18:55408] [client 45.154.98.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aTzy-qrTT0VzE3gYjcCISgAAAFU"]
[Sat Dec 13 13:00:42.638172 2025] [:error] [pid 8242:tid 8260] [client 45.154.98.18:55640] [client 45.154.98.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aTzy-iNKA7vSGNUfnOEV1QAAAkw"]
[Sat Dec 13 13:00:43.196831 2025] [:error] [pid 39287:tid 39307] [client 45.154.98.18:55793] [client 45.154.98.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aTzy-zBwBW1JRRoCYqZi8AAAARI"]
[Sat Dec 13 13:09:07.110205 2025] [:error] [pid 8243:tid 8291] [client 38.246.32.89:54799] [client 38.246.32.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.246.32.89, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTz08yIrGC80ajIR9nJO_QAAAo8"]
[Sat Dec 13 13:37:28.500852 2025] [:error] [pid 39287:tid 39292] [client 200.10.154.10:6388] [client 200.10.154.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 200.10.154.10, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTz7mDBwBW1JRRoCYqZorAAAAQM"]
[Sat Dec 13 13:37:30.262354 2025] [:error] [pid 39287:tid 39300] [client 200.10.154.10:6388] [client 200.10.154.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 200.10.154.10, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aTz7mjBwBW1JRRoCYqZorQAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 14:00:06.930137 2025] [:error] [pid 3418:tid 3442] [client 43.153.119.119:43124] [client 43.153.119.119] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aT0A5it8_IWm3g-eIu5MxgAAAdU"]
[Sat Dec 13 15:21:35.247887 2025] [:error] [pid 20799:tid 20805] [client 82.165.86.108:52826] [client 82.165.86.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.165.86.108, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT0T_6Pz3eVRUTzZpOJbhAAAAsQ"]
[Sat Dec 13 15:21:36.458262 2025] [:error] [pid 20799:tid 20821] [client 82.165.86.108:52826] [client 82.165.86.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.165.86.108, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT0UAKPz3eVRUTzZpOJbhgAAAtQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 15:37:05.673508 2025] [:error] [pid 23013:tid 23034] [client 121.33.4.207:52384] [client 121.33.4.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 121.33.4.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT0Xoas9bDNWPQXUW1Z8uwAAA9M"]
[Sat Dec 13 15:37:07.424694 2025] [:error] [pid 23013:tid 23026] [client 121.33.4.207:52384] [client 121.33.4.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 121.33.4.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT0Xo6s9bDNWPQXUW1Z8wAAAA8s"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 16:36:16.771325 2025] [:error] [pid 43747:tid 43774] [client 136.107.74.33:50926] [client 136.107.74.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.107.74.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT0lgJYw3twBd_JQEHgQsAAAABc"]
[Sat Dec 13 16:36:20.034263 2025] [:error] [pid 43747:tid 43763] [client 136.107.74.33:50926] [client 136.107.74.33] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aT0lhJYw3twBd_JQEHgQtAAAAAw"]
[Sat Dec 13 16:36:20.248890 2025] [:error] [pid 43747:tid 43768] [client 136.107.74.33:50926] [client 136.107.74.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.107.74.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT0lhJYw3twBd_JQEHgQtQAAABE"]
[Sat Dec 13 16:36:21.811732 2025] [:error] [pid 55071:tid 55091] [client 136.107.74.33:63616] [client 136.107.74.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.107.74.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT0lhcHSpNduhEZ_mje75AAAAZI"]
[Sat Dec 13 16:36:23.439005 2025] [:error] [pid 43836:tid 43861] [client 136.107.74.33:64828] [client 136.107.74.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.107.74.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT0lh2AEOBirsxb11nbo7gAAANc"]
[Sat Dec 13 16:36:25.038035 2025] [:error] [pid 39287:tid 39290] [client 136.107.74.33:64521] [client 136.107.74.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.107.74.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT0liTBwBW1JRRoCYqZ2twAAAQE"]
[Sat Dec 13 16:36:26.648138 2025] [:error] [pid 8242:tid 8266] [client 136.107.74.33:51205] [client 136.107.74.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.107.74.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT0liiNKA7vSGNUfnOEnlAAAAlI"]
[Sat Dec 13 16:36:26.648324 2025] [:error] [pid 8242:tid 8266] [client 136.107.74.33:51205] [client 136.107.74.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 136.107.74.33, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT0liiNKA7vSGNUfnOEnlAAAAlI"]
[Sat Dec 13 16:38:09.523622 2025] [:error] [pid 39287:tid 39313] [client 15.235.140.141:46494] [client 15.235.140.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.235.140.141, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT0l8TBwBW1JRRoCYqZ2xwAAARg"]
[Sat Dec 13 16:38:10.594847 2025] [:error] [pid 39287:tid 39304] [client 15.235.140.141:46494] [client 15.235.140.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.235.140.141, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT0l8jBwBW1JRRoCYqZ2yAAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 16:45:37.319697 2025] [:error] [pid 8242:tid 8257] [client 43.153.86.78:48744] [client 43.153.86.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aT0nsSNKA7vSGNUfnOEoTAAAAkk"]
[Sat Dec 13 17:10:00.789127 2025] [:error] [pid 8242:tid 8252] [client 45.8.17.80:63145] [client 45.8.17.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT0taCNKA7vSGNUfnOEpsQAAAkQ"]
[Sat Dec 13 18:30:56.932068 2025] [:error] [pid 21342:tid 21365] [client 45.77.14.133:51534] [client 45.77.14.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.77.14.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT1AYPBL0VVSMIEvqstdngAAAxM"]
[Sat Dec 13 18:31:00.271700 2025] [:error] [pid 43836:tid 43849] [client 45.77.14.133:59976] [client 45.77.14.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.77.14.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT1AZGAEOBirsxb11nbzGAAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 19:50:18.609093 2025] [:error] [pid 43836:tid 43862] [client 66.175.44.57:60594] [client 66.175.44.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT1S-mAEOBirsxb11nb6nQAAANg"]
[Sat Dec 13 20:02:32.133501 2025] [:error] [pid 22505:tid 22509] [client 66.175.44.32:47056] [client 66.175.44.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.32, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT1V2DvNI-35hW16TnUZuwAAA4I"]
[Sat Dec 13 20:02:34.238365 2025] [:error] [pid 22505:tid 22528] [client 66.175.44.32:47056] [client 66.175.44.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.32, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT1V2jvNI-35hW16TnUZvAAAA5U"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 20:30:05.960464 2025] [:error] [pid 22505:tid 22508] [client 124.156.225.181:58206] [client 124.156.225.181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aT1cTTvNI-35hW16TnUb-AAAA4E"]
[Sat Dec 13 20:38:15.991387 2025] [:error] [pid 20799:tid 20820] [client 103.177.150.24:64079] [client 103.177.150.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.177.150.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT1eN6Pz3eVRUTzZpOKAEAAAAtM"]
[Sat Dec 13 21:50:00.859358 2025] [:error] [pid 55071:tid 55080] [client 61.219.140.50:43670] [client 61.219.140.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 61.219.140.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT1vCMHSpNduhEZ_mjff3QAAAYc"]
[Sat Dec 13 21:50:05.746404 2025] [:error] [pid 55071:tid 55089] [client 61.219.140.50:43670] [client 61.219.140.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 61.219.140.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT1vDcHSpNduhEZ_mjff4gAAAZA"], referer: https://expressinteriors.com/wp-login.php
[Sat Dec 13 23:01:08.921017 2025] [:error] [pid 20799:tid 20816] [client 49.51.183.15:54956] [client 49.51.183.15] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aT1_tKPz3eVRUTzZpOKWGQAAAs8"]
[Sat Dec 13 23:24:33.449858 2025] [:error] [pid 55071:tid 55090] [client 45.8.17.75:63973] [client 45.8.17.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.75, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT2FMcHSpNduhEZ_mjfvkgAAAZE"]
[Sat Dec 13 23:46:20.488086 2025] [:error] [pid 43747:tid 43770] [client 45.8.17.80:54619] [client 45.8.17.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT2KTJYw3twBd_JQEHhcUgAAABM"]
[Sun Dec 14 00:38:08.531728 2025] [:error] [pid 14654:tid 14660] [client 195.178.110.242:35574] [client 195.178.110.242] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aT2WcDqZP_N7tgSGeZccmgAAAAM"]
[Sun Dec 14 00:38:08.534121 2025] [:error] [pid 14654:tid 14666] [client 195.178.110.242:35572] [client 195.178.110.242] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aT2WcDqZP_N7tgSGeZccmwAAAAk"]
[Sun Dec 14 01:04:05.355236 2025] [:error] [pid 14689:tid 14716] [client 46.101.216.165:54190] [client 46.101.216.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.101.216.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT2chUEcifvaa9I7SnlyTgAAAVc"]
[Sun Dec 14 01:56:07.188093 2025] [:error] [pid 14689:tid 14695] [client 45.8.17.75:55555] [client 45.8.17.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.75, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT2ot0Ecifvaa9I7SnmFZgAAAUI"]
[Sun Dec 14 02:06:19.180421 2025] [:error] [pid 14654:tid 14658] [client 38.246.33.195:54559] [client 38.246.33.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.246.33.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT2rGzqZP_N7tgSGeZc3hQAAAAE"]
[Sun Dec 14 02:10:21.523932 2025] [:error] [pid 3720:tid 3740] [client 45.8.17.53:46269] [client 45.8.17.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT2sDe7_sgsCEY5RMYroIQAAAJI"]
[Sun Dec 14 02:17:27.777517 2025] [:error] [pid 3720:tid 3723] [client 45.8.17.80:50827] [client 45.8.17.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT2tt-7_sgsCEY5RMYrpXwAAAIE"]
[Sun Dec 14 02:50:04.091457 2025] [:error] [pid 14689:tid 14707] [client 43.130.26.3:55730] [client 43.130.26.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aT21XEEcifvaa9I7SnmY2QAAAU4"]
[Sun Dec 14 03:04:05.695245 2025] [:error] [pid 3635:tid 3686] [client 38.246.32.248:57954] [client 38.246.32.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.246.32.248, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT24pTqfhzW7OpfKxKz6vAAAANU"]
[Sun Dec 14 03:25:00.445432 2025] [:error] [pid 14689:tid 14715] [client 4.214.48.19:25325] [client 4.214.48.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.214.48.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT29jEEcifvaa9I7SnmjYAAAAVY"]
[Sun Dec 14 03:25:01.101829 2025] [:error] [pid 14689:tid 14712] [client 4.214.48.19:25325] [client 4.214.48.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.214.48.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT29jUEcifvaa9I7SnmjYgAAAVM"]
[Sun Dec 14 03:25:05.857821 2025] [:error] [pid 14689:tid 14710] [client 4.214.48.19:25223] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aT29kUEcifvaa9I7SnmjbQAAAVE"]
[Sun Dec 14 03:25:07.718480 2025] [:error] [pid 14654:tid 14660] [client 4.214.48.19:25324] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aT29kzqZP_N7tgSGeZdLcwAAAAM"]
[Sun Dec 14 03:25:09.326984 2025] [:error] [pid 14689:tid 14702] [client 4.214.48.19:25282] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aT29lUEcifvaa9I7SnmjbwAAAUk"]
[Sun Dec 14 03:25:10.141118 2025] [:error] [pid 3634:tid 3658] [client 4.214.48.19:25319] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aT29lobt-wTl4d7Q7qqRBQAAAFQ"]
[Sun Dec 14 03:25:10.658678 2025] [:error] [pid 3635:tid 3685] [client 4.214.48.19:25244] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/minik.php"] [unique_id "aT29ljqfhzW7OpfKxKz-IQAAANQ"]
[Sun Dec 14 03:25:11.084907 2025] [:error] [pid 14689:tid 14706] [client 4.214.48.19:25341] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/minik.php"] [unique_id "aT29l0Ecifvaa9I7SnmjdAAAAU0"]
[Sun Dec 14 03:25:11.481100 2025] [:error] [pid 3634:tid 3641] [client 4.214.48.19:25310] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/minik.php"] [unique_id "aT29l4bt-wTl4d7Q7qqRBgAAAEM"]
[Sun Dec 14 03:25:11.788665 2025] [:error] [pid 3636:tid 3703] [client 4.214.48.19:25235] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/minik.php"] [unique_id "aT29l94pNg3LXPqKgeZOcQAAAQs"]
[Sun Dec 14 03:25:12.372050 2025] [:error] [pid 3636:tid 3712] [client 4.214.48.19:25305] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/OK.php"] [unique_id "aT29mN4pNg3LXPqKgeZOcwAAARQ"]
[Sun Dec 14 03:25:13.160021 2025] [:error] [pid 14689:tid 14697] [client 4.214.48.19:25339] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/OK.php"] [unique_id "aT29mUEcifvaa9I7SnmjeQAAAUQ"]
[Sun Dec 14 03:25:14.472838 2025] [:error] [pid 3635:tid 3665] [client 4.214.48.19:25284] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/OK.php"] [unique_id "aT29mjqfhzW7OpfKxKz-JQAAAMA"]
[Sun Dec 14 03:25:15.385166 2025] [:error] [pid 3634:tid 3650] [client 4.214.48.19:25301] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/OK.php"] [unique_id "aT29m4bt-wTl4d7Q7qqRFAAAAEw"]
[Sun Dec 14 03:25:15.756926 2025] [:error] [pid 14654:tid 14668] [client 4.214.48.19:25297] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfanew.php"] [unique_id "aT29mzqZP_N7tgSGeZdLeAAAAAs"]
[Sun Dec 14 03:25:16.262837 2025] [:error] [pid 3634:tid 3660] [client 4.214.48.19:25256] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfanew.php"] [unique_id "aT29nIbt-wTl4d7Q7qqRFgAAAFY"]
[Sun Dec 14 03:25:16.799408 2025] [:error] [pid 14689:tid 14694] [client 4.214.48.19:12255] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfanew.php"] [unique_id "aT29nEEcifvaa9I7SnmjggAAAUE"]
[Sun Dec 14 03:25:17.049175 2025] [:error] [pid 3634:tid 3639] [client 4.214.48.19:25288] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfanew.php"] [unique_id "aT29nYbt-wTl4d7Q7qqRFwAAAEE"]
[Sun Dec 14 03:25:17.365821 2025] [:error] [pid 14654:tid 14678] [client 4.214.48.19:25336] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zsec.php"] [unique_id "aT29nTqZP_N7tgSGeZdLfgAAABU"]
[Sun Dec 14 03:25:17.686334 2025] [:error] [pid 14654:tid 14680] [client 4.214.48.19:25266] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zsec.php"] [unique_id "aT29nTqZP_N7tgSGeZdLfwAAABc"]
[Sun Dec 14 03:25:18.482952 2025] [:error] [pid 14654:tid 14658] [client 4.214.48.19:25224] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zsec.php"] [unique_id "aT29njqZP_N7tgSGeZdLgQAAAAE"]
[Sun Dec 14 03:25:19.173354 2025] [:error] [pid 3634:tid 3659] [client 4.214.48.19:25312] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zsec.php"] [unique_id "aT29n4bt-wTl4d7Q7qqRHwAAAFU"]
[Sun Dec 14 03:25:19.604433 2025] [:error] [pid 3634:tid 3644] [client 4.214.48.19:25304] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/arig.php"] [unique_id "aT29n4bt-wTl4d7Q7qqRJQAAAEY"]
[Sun Dec 14 03:25:20.084841 2025] [:error] [pid 14689:tid 14698] [client 4.214.48.19:25331] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/arig.php"] [unique_id "aT29oEEcifvaa9I7SnmjjQAAAUU"]
[Sun Dec 14 03:25:20.649914 2025] [:error] [pid 14689:tid 14699] [client 4.214.48.19:25221] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/arig.php"] [unique_id "aT29oEEcifvaa9I7SnmjkwAAAUY"]
[Sun Dec 14 03:25:21.259285 2025] [:error] [pid 14654:tid 14660] [client 4.214.48.19:25326] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/arig.php"] [unique_id "aT29oTqZP_N7tgSGeZdLmAAAAAM"]
[Sun Dec 14 03:25:21.602002 2025] [:error] [pid 14654:tid 14671] [client 4.214.48.19:25280] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin1.php"] [unique_id "aT29oTqZP_N7tgSGeZdLmQAAAA4"]
[Sun Dec 14 03:25:22.094993 2025] [:error] [pid 14689:tid 14704] [client 4.214.48.19:25238] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin1.php"] [unique_id "aT29okEcifvaa9I7SnmjmgAAAUs"]
[Sun Dec 14 03:25:22.830898 2025] [:error] [pid 14689:tid 14697] [client 4.214.48.19:25276] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin1.php"] [unique_id "aT29okEcifvaa9I7SnmjmwAAAUQ"]
[Sun Dec 14 03:25:23.620381 2025] [:error] [pid 14654:tid 14676] [client 4.214.48.19:12236] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin1.php"] [unique_id "aT29ozqZP_N7tgSGeZdLnAAAABM"]
[Sun Dec 14 03:25:24.193584 2025] [:error] [pid 14654:tid 14657] [client 4.214.48.19:25243] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aT29pDqZP_N7tgSGeZdLnwAAAAA"]
[Sun Dec 14 03:25:24.696285 2025] [:error] [pid 14654:tid 14669] [client 4.214.48.19:25236] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aT29pDqZP_N7tgSGeZdLoAAAAAw"]
[Sun Dec 14 03:25:25.171607 2025] [:error] [pid 14654:tid 14678] [client 4.214.48.19:25220] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aT29pTqZP_N7tgSGeZdLogAAABU"]
[Sun Dec 14 03:25:25.471401 2025] [:error] [pid 3635:tid 3679] [client 4.214.48.19:25308] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aT29pTqfhzW7OpfKxKz-NwAAAM4"]
[Sun Dec 14 03:25:25.738495 2025] [:error] [pid 3720:tid 3742] [client 4.214.48.19:25316] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/af32.php"] [unique_id "aT29pe7_sgsCEY5RMYr5HgAAAJQ"]
[Sun Dec 14 03:25:26.107340 2025] [:error] [pid 14689:tid 14714] [client 4.214.48.19:25337] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/af32.php"] [unique_id "aT29pkEcifvaa9I7SnmjnQAAAVU"]
[Sun Dec 14 03:25:26.626415 2025] [:error] [pid 3636:tid 3696] [client 4.214.48.19:25313] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/af32.php"] [unique_id "aT29pt4pNg3LXPqKgeZOdQAAAQQ"]
[Sun Dec 14 03:25:26.983366 2025] [:error] [pid 3720:tid 3743] [client 4.214.48.19:25340] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/af32.php"] [unique_id "aT29pu7_sgsCEY5RMYr5HwAAAJU"]
[Sun Dec 14 03:25:27.289065 2025] [:error] [pid 14654:tid 14673] [client 4.214.48.19:25303] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rz.php"] [unique_id "aT29pzqZP_N7tgSGeZdLqQAAABA"]
[Sun Dec 14 03:25:27.756099 2025] [:error] [pid 14654:tid 14672] [client 4.214.48.19:25292] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rz.php"] [unique_id "aT29pzqZP_N7tgSGeZdLqwAAAA8"]
[Sun Dec 14 03:25:28.162223 2025] [:error] [pid 14689:tid 14698] [client 4.214.48.19:12248] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rz.php"] [unique_id "aT29qEEcifvaa9I7SnmjngAAAUU"]
[Sun Dec 14 03:25:28.788824 2025] [:error] [pid 14654:tid 14669] [client 4.214.48.19:25317] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rz.php"] [unique_id "aT29qDqZP_N7tgSGeZdLsQAAAAw"]
[Sun Dec 14 03:25:29.189040 2025] [:error] [pid 3634:tid 3652] [client 4.214.48.19:25239] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/let.php"] [unique_id "aT29qYbt-wTl4d7Q7qqRMgAAAE4"]
[Sun Dec 14 03:25:29.681842 2025] [:error] [pid 3634:tid 3644] [client 4.214.48.19:25219] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/let.php"] [unique_id "aT29qYbt-wTl4d7Q7qqRMwAAAEY"]
[Sun Dec 14 03:25:29.958507 2025] [:error] [pid 14689:tid 14707] [client 4.214.48.19:25231] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/let.php"] [unique_id "aT29qUEcifvaa9I7SnmjnwAAAU4"]
[Sun Dec 14 03:25:30.275039 2025] [:error] [pid 14689:tid 14699] [client 4.214.48.19:25327] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/let.php"] [unique_id "aT29qkEcifvaa9I7SnmjoQAAAUY"]
[Sun Dec 14 03:25:30.557104 2025] [:error] [pid 14689:tid 14703] [client 4.214.48.19:12247] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aT29qkEcifvaa9I7SnmjogAAAUo"]
[Sun Dec 14 03:25:30.901842 2025] [:error] [pid 14654:tid 14658] [client 4.214.48.19:25296] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aT29qjqZP_N7tgSGeZdLswAAAAE"]
[Sun Dec 14 03:25:31.231031 2025] [:error] [pid 14654:tid 14660] [client 4.214.48.19:25218] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aT29qzqZP_N7tgSGeZdLtAAAAAM"]
[Sun Dec 14 03:25:31.589066 2025] [:error] [pid 14654:tid 14677] [client 4.214.48.19:25237] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aT29qzqZP_N7tgSGeZdLtQAAABQ"]
[Sun Dec 14 03:25:32.385993 2025] [:error] [pid 3720:tid 3724] [client 4.214.48.19:25247] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aT29rO7_sgsCEY5RMYr5IQAAAII"]
[Sun Dec 14 03:25:32.927721 2025] [:error] [pid 3634:tid 3655] [client 4.214.48.19:25216] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aT29rIbt-wTl4d7Q7qqRNgAAAFE"]
[Sun Dec 14 03:25:33.331747 2025] [:error] [pid 3634:tid 3650] [client 4.214.48.19:25269] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aT29rYbt-wTl4d7Q7qqROQAAAEw"]
[Sun Dec 14 03:25:34.072247 2025] [:error] [pid 3634:tid 3639] [client 4.214.48.19:25314] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aT29robt-wTl4d7Q7qqRPAAAAEE"]
[Sun Dec 14 03:25:35.135874 2025] [:error] [pid 14654:tid 14673] [client 4.214.48.19:25229] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aT29rzqZP_N7tgSGeZdLugAAABA"]
[Sun Dec 14 03:25:35.595519 2025] [:error] [pid 3720:tid 3729] [client 4.214.48.19:25271] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aT29r-7_sgsCEY5RMYr5IwAAAIc"]
[Sun Dec 14 03:25:36.148336 2025] [:error] [pid 3720:tid 3736] [client 4.214.48.19:12262] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aT29sO7_sgsCEY5RMYr5JAAAAI4"]
[Sun Dec 14 03:25:36.823263 2025] [:error] [pid 3634:tid 3646] [client 4.214.48.19:25343] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aT29sIbt-wTl4d7Q7qqRQgAAAEg"]
[Sun Dec 14 03:25:37.096606 2025] [:error] [pid 14689:tid 14704] [client 4.214.48.19:25318] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aT29sUEcifvaa9I7SnmjqQAAAUs"]
[Sun Dec 14 03:25:37.425153 2025] [:error] [pid 14689:tid 14697] [client 4.214.48.19:12239] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aT29sUEcifvaa9I7SnmjqgAAAUQ"]
[Sun Dec 14 03:25:37.967837 2025] [:error] [pid 14689:tid 14712] [client 4.214.48.19:25234] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aT29sUEcifvaa9I7SnmjrAAAAVM"]
[Sun Dec 14 03:25:38.369700 2025] [:error] [pid 14654:tid 14664] [client 4.214.48.19:25315] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aT29sjqZP_N7tgSGeZdLuwAAAAc"]
[Sun Dec 14 03:25:39.106422 2025] [:error] [pid 14689:tid 14700] [client 4.214.48.19:25334] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abe.php"] [unique_id "aT29s0Ecifvaa9I7SnmjsAAAAUc"]
[Sun Dec 14 03:25:39.874505 2025] [:error] [pid 14654:tid 14657] [client 4.214.48.19:12271] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abe.php"] [unique_id "aT29szqZP_N7tgSGeZdLvQAAAAA"]
[Sun Dec 14 03:25:40.224405 2025] [:error] [pid 3634:tid 3650] [client 4.214.48.19:25251] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abe.php"] [unique_id "aT29tIbt-wTl4d7Q7qqRSgAAAEw"]
[Sun Dec 14 03:25:40.602982 2025] [:error] [pid 3635:tid 3684] [client 4.214.48.19:25228] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abe.php"] [unique_id "aT29tDqfhzW7OpfKxKz-PQAAANM"]
[Sun Dec 14 03:25:40.938585 2025] [:error] [pid 14689:tid 14699] [client 4.214.48.19:25307] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aT29tEEcifvaa9I7SnmjswAAAUY"]
[Sun Dec 14 03:25:41.622593 2025] [:error] [pid 3634:tid 3660] [client 4.214.48.19:25342] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aT29tYbt-wTl4d7Q7qqRTAAAAFY"]
[Sun Dec 14 03:25:42.167326 2025] [:error] [pid 3634:tid 3646] [client 4.214.48.19:25302] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aT29tobt-wTl4d7Q7qqRTwAAAEg"]
[Sun Dec 14 03:25:42.447189 2025] [:error] [pid 3634:tid 3645] [client 4.214.48.19:25286] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aT29tobt-wTl4d7Q7qqRUgAAAEc"]
[Sun Dec 14 03:25:43.063780 2025] [:error] [pid 3634:tid 3643] [client 4.214.48.19:12230] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aT29t4bt-wTl4d7Q7qqRVQAAAEU"]
[Sun Dec 14 03:25:43.777730 2025] [:error] [pid 3634:tid 3642] [client 4.214.48.19:25328] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aT29t4bt-wTl4d7Q7qqRVwAAAEQ"]
[Sun Dec 14 03:25:44.047010 2025] [:error] [pid 3634:tid 3641] [client 4.214.48.19:25281] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aT29uIbt-wTl4d7Q7qqRWAAAAEM"]
[Sun Dec 14 03:25:44.326763 2025] [:error] [pid 3634:tid 3654] [client 4.214.48.19:25329] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aT29uIbt-wTl4d7Q7qqRWgAAAFA"]
[Sun Dec 14 03:25:44.592412 2025] [:error] [pid 14689:tid 14695] [client 4.214.48.19:25261] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aT29uEEcifvaa9I7SnmjtgAAAUI"]
[Sun Dec 14 03:25:45.205797 2025] [:error] [pid 3634:tid 3655] [client 4.214.48.19:25300] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aT29uYbt-wTl4d7Q7qqRXQAAAFE"]
[Sun Dec 14 03:25:45.477987 2025] [:error] [pid 3635:tid 3678] [client 4.214.48.19:25227] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aT29uTqfhzW7OpfKxKz-PgAAAM0"]
[Sun Dec 14 03:25:46.153088 2025] [:error] [pid 3634:tid 3639] [client 4.214.48.19:25260] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aT29uobt-wTl4d7Q7qqRYAAAAEE"]
[Sun Dec 14 03:25:46.525213 2025] [:error] [pid 3635:tid 3666] [client 4.214.48.19:25270] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cloud.php"] [unique_id "aT29ujqfhzW7OpfKxKz-PwAAAME"]
[Sun Dec 14 03:25:47.040801 2025] [:error] [pid 14689:tid 14705] [client 4.214.48.19:25262] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cloud.php"] [unique_id "aT29u0Ecifvaa9I7SnmjuAAAAUw"]
[Sun Dec 14 03:25:47.594445 2025] [:error] [pid 3636:tid 3708] [client 4.214.48.19:25299] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cloud.php"] [unique_id "aT29u94pNg3LXPqKgeZOgAAAARA"]
[Sun Dec 14 03:25:48.382110 2025] [:error] [pid 14689:tid 14710] [client 4.214.48.19:25232] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cloud.php"] [unique_id "aT29vEEcifvaa9I7SnmjuwAAAVE"]
[Sun Dec 14 03:25:49.154065 2025] [:error] [pid 14654:tid 14679] [client 4.214.48.19:25332] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aT29vTqZP_N7tgSGeZdLwgAAABY"]
[Sun Dec 14 03:25:50.523406 2025] [:error] [pid 3720:tid 3732] [client 4.214.48.19:25233] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aT29vu7_sgsCEY5RMYr5KQAAAIo"]
[Sun Dec 14 03:25:51.381780 2025] [:error] [pid 3720:tid 3738] [client 4.214.48.19:25242] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aT29v-7_sgsCEY5RMYr5KwAAAJA"]
[Sun Dec 14 03:25:51.972890 2025] [:error] [pid 14654:tid 14670] [client 4.214.48.19:12269] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aT29vzqZP_N7tgSGeZdLxgAAAA0"]
[Sun Dec 14 03:25:52.337918 2025] [:error] [pid 3634:tid 3644] [client 4.214.48.19:25265] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aT29wIbt-wTl4d7Q7qqRYgAAAEY"]
[Sun Dec 14 03:25:53.110254 2025] [:error] [pid 3636:tid 3699] [client 4.214.48.19:25277] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aT29wd4pNg3LXPqKgeZOiAAAAQc"]
[Sun Dec 14 03:25:53.796595 2025] [:error] [pid 3634:tid 3642] [client 4.214.48.19:25217] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aT29wYbt-wTl4d7Q7qqRZAAAAEQ"]
[Sun Dec 14 03:25:54.478806 2025] [:error] [pid 14689:tid 14715] [client 4.214.48.19:25246] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aT29wkEcifvaa9I7SnmjwAAAAVY"]
[Sun Dec 14 03:25:55.450856 2025] [:error] [pid 3634:tid 3651] [client 4.214.48.19:25240] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aT29w4bt-wTl4d7Q7qqRZgAAAE0"]
[Sun Dec 14 03:25:55.818760 2025] [:error] [pid 3634:tid 3654] [client 4.214.48.19:25338] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aT29w4bt-wTl4d7Q7qqRZwAAAFA"]
[Sun Dec 14 03:25:56.367063 2025] [:error] [pid 14689:tid 14698] [client 4.214.48.19:25291] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aT29xEEcifvaa9I7SnmjwgAAAUU"]
[Sun Dec 14 03:25:56.950241 2025] [:error] [pid 14689:tid 14707] [client 4.214.48.19:25225] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aT29xEEcifvaa9I7SnmjwwAAAU4"]
[Sun Dec 14 03:25:57.555925 2025] [:error] [pid 3636:tid 3692] [client 4.214.48.19:12284] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aT29xd4pNg3LXPqKgeZOigAAAQA"]
[Sun Dec 14 03:26:00.579650 2025] [:error] [pid 3634:tid 3650] [client 4.214.48.19:25311] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aT29yIbt-wTl4d7Q7qqRbAAAAEw"]
[Sun Dec 14 03:26:00.818022 2025] [:error] [pid 14654:tid 14681] [client 4.214.48.19:25275] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aT29yDqZP_N7tgSGeZdLzAAAABg"]
[Sun Dec 14 03:26:01.303380 2025] [:error] [pid 3720:tid 3735] [client 4.214.48.19:25253] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aT29ye7_sgsCEY5RMYr5NAAAAI0"]
[Sun Dec 14 03:26:01.789997 2025] [:error] [pid 3720:tid 3736] [client 4.214.48.19:12281] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aT29ye7_sgsCEY5RMYr5NgAAAI4"]
[Sun Dec 14 03:26:02.597146 2025] [:error] [pid 3720:tid 3746] [client 4.214.48.19:25248] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aT29yu7_sgsCEY5RMYr5OQAAAJg"]
[Sun Dec 14 03:26:03.170721 2025] [:error] [pid 3720:tid 3739] [client 4.214.48.19:25273] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aT29y-7_sgsCEY5RMYr5OwAAAJE"]
[Sun Dec 14 03:26:04.064407 2025] [:error] [pid 14689:tid 14710] [client 4.214.48.19:25267] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aT29zEEcifvaa9I7SnmjygAAAVE"]
[Sun Dec 14 03:26:04.787825 2025] [:error] [pid 3720:tid 3732] [client 4.214.48.19:25230] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aT29zO7_sgsCEY5RMYr5PQAAAIo"]
[Sun Dec 14 03:26:13.539790 2025] [:error] [pid 14654:tid 14669] [client 4.214.48.19:25295] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aT291TqZP_N7tgSGeZdL4QAAAAw"]
[Sun Dec 14 03:26:14.515734 2025] [:error] [pid 14689:tid 14694] [client 4.214.48.19:12228] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aT291kEcifvaa9I7Snmj1QAAAUE"]
[Sun Dec 14 03:26:15.486913 2025] [:error] [pid 3636:tid 3699] [client 4.214.48.19:25283] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aT29194pNg3LXPqKgeZOmQAAAQc"]
[Sun Dec 14 03:26:16.527737 2025] [:error] [pid 3635:tid 3687] [client 4.214.48.19:25279] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aT292DqfhzW7OpfKxKz-QQAAANY"]
[Sun Dec 14 03:26:18.261916 2025] [:error] [pid 3720:tid 3736] [client 4.214.48.19:25289] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-rex4.php7"] [unique_id "aT292u7_sgsCEY5RMYr5SQAAAI4"]
[Sun Dec 14 03:26:19.516119 2025] [:error] [pid 14689:tid 14703] [client 4.214.48.19:12226] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-rex4.php7"] [unique_id "aT2920Ecifvaa9I7Snmj6gAAAUo"]
[Sun Dec 14 03:26:20.201747 2025] [:error] [pid 3634:tid 3661] [client 4.214.48.19:12235] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-rex4.php7"] [unique_id "aT293Ibt-wTl4d7Q7qqRcwAAAFc"]
[Sun Dec 14 03:26:20.635084 2025] [:error] [pid 3720:tid 3744] [client 4.214.48.19:12250] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-rex4.php7"] [unique_id "aT293O7_sgsCEY5RMYr5SgAAAJY"]
[Sun Dec 14 03:26:21.842446 2025] [:error] [pid 14689:tid 14715] [client 4.214.48.19:25309] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aT293UEcifvaa9I7Snmj8AAAAVY"]
[Sun Dec 14 03:26:23.233643 2025] [:error] [pid 3720:tid 3746] [client 4.214.48.19:25294] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aT293-7_sgsCEY5RMYr5SwAAAJg"]
[Sun Dec 14 03:26:23.857588 2025] [:error] [pid 3634:tid 3654] [client 4.214.48.19:25323] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aT2934bt-wTl4d7Q7qqRdQAAAFA"]
[Sun Dec 14 03:26:24.268676 2025] [:error] [pid 3636:tid 3713] [client 4.214.48.19:12241] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aT294N4pNg3LXPqKgeZOnQAAARU"]
[Sun Dec 14 03:26:24.872116 2025] [:error] [pid 3636:tid 3712] [client 4.214.48.19:25224] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "aT294N4pNg3LXPqKgeZOngAAARQ"]
[Sun Dec 14 03:26:25.367142 2025] [:error] [pid 3635:tid 3667] [client 4.214.48.19:12242] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "aT294TqfhzW7OpfKxKz-QwAAAMI"]
[Sun Dec 14 03:26:25.623356 2025] [:error] [pid 3635:tid 3683] [client 4.214.48.19:12254] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "aT294TqfhzW7OpfKxKz-RQAAANI"]
[Sun Dec 14 03:26:26.015461 2025] [:error] [pid 3634:tid 3640] [client 4.214.48.19:12211] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "aT294obt-wTl4d7Q7qqReQAAAEI"]
[Sun Dec 14 03:26:26.563839 2025] [:error] [pid 3636:tid 3697] [client 4.214.48.19:12227] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/warm.PhP7"] [unique_id "aT294t4pNg3LXPqKgeZOoQAAAQU"]
[Sun Dec 14 03:26:26.885727 2025] [:error] [pid 3636:tid 3708] [client 4.214.48.19:12225] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/warm.PhP7"] [unique_id "aT294t4pNg3LXPqKgeZOogAAARA"]
[Sun Dec 14 03:26:27.184420 2025] [:error] [pid 14689:tid 14693] [client 4.214.48.19:25245] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/warm.PhP7"] [unique_id "aT2940Ecifvaa9I7Snmj-QAAAUA"]
[Sun Dec 14 03:26:27.533313 2025] [:error] [pid 3636:tid 3702] [client 4.214.48.19:25333] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/warm.PhP7"] [unique_id "aT29494pNg3LXPqKgeZOpwAAAQo"]
[Sun Dec 14 03:26:27.817922 2025] [:error] [pid 3636:tid 3698] [client 4.214.48.19:25264] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php7"] [unique_id "aT29494pNg3LXPqKgeZOqAAAAQY"]
[Sun Dec 14 03:26:28.121429 2025] [:error] [pid 3636:tid 3704] [client 4.214.48.19:25241] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php7"] [unique_id "aT295N4pNg3LXPqKgeZOqgAAAQw"]
[Sun Dec 14 03:26:28.540913 2025] [:error] [pid 14654:tid 14667] [client 4.214.48.19:25252] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php7"] [unique_id "aT295DqZP_N7tgSGeZdL5AAAAAo"]
[Sun Dec 14 03:26:29.359392 2025] [:error] [pid 3635:tid 3679] [client 4.214.48.19:12275] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php7"] [unique_id "aT295TqfhzW7OpfKxKz-SQAAAM4"]
[Sun Dec 14 03:26:29.965141 2025] [:error] [pid 3635:tid 3671] [client 4.214.48.19:12273] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rss.php"] [unique_id "aT295TqfhzW7OpfKxKz-SwAAAMY"]
[Sun Dec 14 03:26:30.463111 2025] [:error] [pid 3634:tid 3653] [client 4.214.48.19:25321] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rss.php"] [unique_id "aT295obt-wTl4d7Q7qqRfAAAAE8"]
[Sun Dec 14 03:26:30.835649 2025] [:error] [pid 3636:tid 3706] [client 4.214.48.19:25268] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rss.php"] [unique_id "aT295t4pNg3LXPqKgeZOqwAAAQ4"]
[Sun Dec 14 03:26:31.562020 2025] [:error] [pid 3635:tid 3682] [client 4.214.48.19:12200] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rss.php"] [unique_id "aT295zqfhzW7OpfKxKz-TAAAANE"]
[Sun Dec 14 03:26:32.595526 2025] [:error] [pid 3634:tid 3646] [client 4.214.48.19:12258] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pekok.php"] [unique_id "aT296Ibt-wTl4d7Q7qqRfwAAAEg"]
[Sun Dec 14 03:26:33.483874 2025] [:error] [pid 3720:tid 3726] [client 4.214.48.19:25226] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pekok.php"] [unique_id "aT296e7_sgsCEY5RMYr5VAAAAIQ"]
[Sun Dec 14 03:26:33.897453 2025] [:error] [pid 3634:tid 3647] [client 4.214.48.19:12176] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pekok.php"] [unique_id "aT296Ybt-wTl4d7Q7qqRgAAAAEk"]
[Sun Dec 14 03:26:34.667288 2025] [:error] [pid 3636:tid 3708] [client 4.214.48.19:12231] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pekok.php"] [unique_id "aT296t4pNg3LXPqKgeZOsQAAARA"]
[Sun Dec 14 03:26:35.168003 2025] [:error] [pid 3720:tid 3742] [client 4.214.48.19:12203] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aT296-7_sgsCEY5RMYr5VQAAAJQ"]
[Sun Dec 14 03:26:35.975688 2025] [:error] [pid 14689:tid 14702] [client 4.214.48.19:12106] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aT2960Ecifvaa9I7SnmkAgAAAUk"]
[Sun Dec 14 03:26:36.851051 2025] [:error] [pid 14689:tid 14693] [client 4.214.48.19:12233] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aT297EEcifvaa9I7SnmkBQAAAUA"]
[Sun Dec 14 03:26:37.600513 2025] [:error] [pid 3636:tid 3698] [client 4.214.48.19:25330] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aT297d4pNg3LXPqKgeZOtAAAAQY"]
[Sun Dec 14 03:26:38.058893 2025] [:error] [pid 3636:tid 3709] [client 4.214.48.19:12278] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aa.php"] [unique_id "aT297t4pNg3LXPqKgeZOtQAAARE"]
[Sun Dec 14 03:26:38.655898 2025] [:error] [pid 3720:tid 3736] [client 4.214.48.19:12249] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aa.php"] [unique_id "aT297u7_sgsCEY5RMYr5WwAAAI4"]
[Sun Dec 14 03:26:39.179181 2025] [:error] [pid 14689:tid 14710] [client 4.214.48.19:12183] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aa.php"] [unique_id "aT2970Ecifvaa9I7SnmkDAAAAVE"]
[Sun Dec 14 03:26:39.950352 2025] [:error] [pid 14689:tid 14716] [client 4.214.48.19:12201] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aa.php"] [unique_id "aT2970Ecifvaa9I7SnmkDQAAAVc"]
[Sun Dec 14 03:26:40.351799 2025] [:error] [pid 14689:tid 14709] [client 4.214.48.19:12189] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cart.php"] [unique_id "aT298EEcifvaa9I7SnmkDwAAAVA"]
[Sun Dec 14 03:26:41.100263 2025] [:error] [pid 3720:tid 3746] [client 4.214.48.19:12234] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cart.php"] [unique_id "aT298e7_sgsCEY5RMYr5XwAAAJg"]
[Sun Dec 14 03:26:41.954872 2025] [:error] [pid 14689:tid 14708] [client 4.214.48.19:12161] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cart.php"] [unique_id "aT298UEcifvaa9I7SnmkGAAAAU8"]
[Sun Dec 14 03:26:42.517081 2025] [:error] [pid 14689:tid 14705] [client 4.214.48.19:12252] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cart.php"] [unique_id "aT298kEcifvaa9I7SnmkGQAAAUw"]
[Sun Dec 14 03:26:43.126446 2025] [:error] [pid 14689:tid 14703] [client 4.214.48.19:25278] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/compare.php"] [unique_id "aT2980Ecifvaa9I7SnmkHAAAAUo"]
[Sun Dec 14 03:26:43.655796 2025] [:error] [pid 3634:tid 3642] [client 4.214.48.19:12282] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/compare.php"] [unique_id "aT2984bt-wTl4d7Q7qqRhAAAAEQ"]
[Sun Dec 14 03:26:44.179179 2025] [:error] [pid 3635:tid 3684] [client 4.214.48.19:12184] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/compare.php"] [unique_id "aT299DqfhzW7OpfKxKz-UQAAANM"]
[Sun Dec 14 03:26:44.622963 2025] [:error] [pid 3636:tid 3700] [client 4.214.48.19:12267] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/compare.php"] [unique_id "aT299N4pNg3LXPqKgeZOvAAAAQg"]
[Sun Dec 14 03:26:44.911036 2025] [:error] [pid 3636:tid 3694] [client 4.214.48.19:12162] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aT299N4pNg3LXPqKgeZOvQAAAQI"]
[Sun Dec 14 03:26:45.398717 2025] [:error] [pid 3635:tid 3675] [client 4.214.48.19:12104] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aT299TqfhzW7OpfKxKz-UgAAAMo"]
[Sun Dec 14 03:26:45.772297 2025] [:error] [pid 3635:tid 3678] [client 4.214.48.19:25255] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aT299TqfhzW7OpfKxKz-UwAAAM0"]
[Sun Dec 14 03:26:46.046620 2025] [:error] [pid 3634:tid 3661] [client 4.214.48.19:12266] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aT299obt-wTl4d7Q7qqRhgAAAFc"]
[Sun Dec 14 03:26:46.748212 2025] [:error] [pid 3636:tid 3704] [client 4.214.48.19:12260] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api.php"] [unique_id "aT299t4pNg3LXPqKgeZOvwAAAQw"]
[Sun Dec 14 03:26:47.017184 2025] [:error] [pid 3634:tid 3651] [client 4.214.48.19:12256] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api.php"] [unique_id "aT2994bt-wTl4d7Q7qqRhwAAAE0"]
[Sun Dec 14 03:26:47.282749 2025] [:error] [pid 3635:tid 3687] [client 4.214.48.19:12287] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api.php"] [unique_id "aT299zqfhzW7OpfKxKz-VAAAANY"]
[Sun Dec 14 03:26:47.604878 2025] [:error] [pid 3635:tid 3665] [client 4.214.48.19:12195] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api.php"] [unique_id "aT299zqfhzW7OpfKxKz-VgAAAMA"]
[Sun Dec 14 03:26:48.257775 2025] [:error] [pid 3635:tid 3668] [client 4.214.48.19:12257] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aT29-DqfhzW7OpfKxKz-VwAAAMM"]
[Sun Dec 14 03:26:48.678352 2025] [:error] [pid 3636:tid 3696] [client 4.214.48.19:25263] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aT29-N4pNg3LXPqKgeZOwQAAAQQ"]
[Sun Dec 14 03:26:49.003755 2025] [:error] [pid 3720:tid 3722] [client 4.214.48.19:25254] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aT29-e7_sgsCEY5RMYr5YwAAAIA"]
[Sun Dec 14 03:26:49.471646 2025] [:error] [pid 3720:tid 3724] [client 4.214.48.19:12263] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aT29-e7_sgsCEY5RMYr5ZQAAAII"]
[Sun Dec 14 03:26:49.746013 2025] [:error] [pid 14654:tid 14673] [client 4.214.48.19:12193] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atom.php"] [unique_id "aT29-TqZP_N7tgSGeZdL5wAAABA"]
[Sun Dec 14 03:26:49.989872 2025] [:error] [pid 14654:tid 14672] [client 4.214.48.19:12232] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atom.php"] [unique_id "aT29-TqZP_N7tgSGeZdL6AAAAA8"]
[Sun Dec 14 03:26:50.255043 2025] [:error] [pid 14654:tid 14662] [client 4.214.48.19:12251] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atom.php"] [unique_id "aT29-jqZP_N7tgSGeZdL6gAAAAU"]
[Sun Dec 14 03:26:50.572216 2025] [:error] [pid 3635:tid 3669] [client 4.214.48.19:12167] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atom.php"] [unique_id "aT29-jqfhzW7OpfKxKz-WQAAAMQ"]
[Sun Dec 14 03:26:50.991087 2025] [:error] [pid 14654:tid 14671] [client 4.214.48.19:12277] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/case.php"] [unique_id "aT29-jqZP_N7tgSGeZdL6wAAAA4"]
[Sun Dec 14 03:26:51.630471 2025] [:error] [pid 14689:tid 14715] [client 4.214.48.19:12237] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/case.php"] [unique_id "aT29-0Ecifvaa9I7SnmkJgAAAVY"]
[Sun Dec 14 03:26:52.075048 2025] [:error] [pid 14689:tid 14704] [client 4.214.48.19:12190] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/case.php"] [unique_id "aT29_EEcifvaa9I7SnmkKAAAAUs"]
[Sun Dec 14 03:26:52.566195 2025] [:error] [pid 3634:tid 3655] [client 4.214.48.19:12217] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/case.php"] [unique_id "aT29_Ibt-wTl4d7Q7qqRigAAAFE"]
[Sun Dec 14 03:26:52.862278 2025] [:error] [pid 3720:tid 3736] [client 4.214.48.19:12166] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/docs.php"] [unique_id "aT29_O7_sgsCEY5RMYr5ZwAAAI4"]
[Sun Dec 14 03:26:53.293221 2025] [:error] [pid 3635:tid 3685] [client 4.214.48.19:25274] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/docs.php"] [unique_id "aT29_TqfhzW7OpfKxKz-XQAAANQ"]
[Sun Dec 14 03:26:53.901218 2025] [:error] [pid 14689:tid 14699] [client 4.214.48.19:25335] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/docs.php"] [unique_id "aT29_UEcifvaa9I7SnmkKwAAAUY"]
[Sun Dec 14 03:26:54.601700 2025] [:error] [pid 3634:tid 3640] [client 4.214.48.19:25306] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/docs.php"] [unique_id "aT29_obt-wTl4d7Q7qqRjAAAAEI"]
[Sun Dec 14 03:26:55.198488 2025] [:error] [pid 14689:tid 14698] [client 4.214.48.19:12253] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ios.php"] [unique_id "aT29_0Ecifvaa9I7SnmkLgAAAUU"]
[Sun Dec 14 03:26:55.555410 2025] [:error] [pid 3636:tid 3714] [client 4.214.48.19:25272] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ios.php"] [unique_id "aT29_94pNg3LXPqKgeZOxgAAARY"]
[Sun Dec 14 03:26:55.990144 2025] [:error] [pid 3634:tid 3649] [client 4.214.48.19:12261] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ios.php"] [unique_id "aT29_4bt-wTl4d7Q7qqRjwAAAEs"]
[Sun Dec 14 03:26:56.293906 2025] [:error] [pid 14654:tid 14661] [client 4.214.48.19:12274] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ios.php"] [unique_id "aT2-ADqZP_N7tgSGeZdL7QAAAAQ"]
[Sun Dec 14 03:26:56.635268 2025] [:error] [pid 3720:tid 3729] [client 4.214.48.19:12109] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aT2-AO7_sgsCEY5RMYr5awAAAIc"]
[Sun Dec 14 03:26:57.188688 2025] [:error] [pid 14654:tid 14678] [client 4.214.48.19:12215] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aT2-ATqZP_N7tgSGeZdL7wAAABU"]
[Sun Dec 14 03:26:57.460657 2025] [:error] [pid 14689:tid 14693] [client 4.214.48.19:25298] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aT2-AUEcifvaa9I7SnmkMQAAAUA"]
[Sun Dec 14 03:26:58.063767 2025] [:error] [pid 14689:tid 14711] [client 4.214.48.19:12244] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aT2-AkEcifvaa9I7SnmkNwAAAVI"]
[Sun Dec 14 03:26:58.570818 2025] [:error] [pid 14689:tid 14703] [client 4.214.48.19:12053] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aT2-AkEcifvaa9I7SnmkOQAAAUo"]
[Sun Dec 14 03:26:58.848563 2025] [:error] [pid 14689:tid 14714] [client 4.214.48.19:25249] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aT2-AkEcifvaa9I7SnmkOwAAAVU"]
[Sun Dec 14 03:26:59.579854 2025] [:error] [pid 14654:tid 14668] [client 4.214.48.19:25325] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aT2-AzqZP_N7tgSGeZdL8QAAAAs"]
[Sun Dec 14 03:27:00.008241 2025] [:error] [pid 14654:tid 14679] [client 4.214.48.19:12270] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aT2-BDqZP_N7tgSGeZdL8wAAABY"]
[Sun Dec 14 03:27:00.614508 2025] [:error] [pid 3636:tid 3697] [client 4.214.48.19:12222] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aT2-BN4pNg3LXPqKgeZOyAAAAQU"]
[Sun Dec 14 03:27:01.283072 2025] [:error] [pid 3636:tid 3700] [client 4.214.48.19:25257] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aT2-Bd4pNg3LXPqKgeZOygAAAQg"]
[Sun Dec 14 03:27:02.241479 2025] [:error] [pid 14654:tid 14672] [client 4.214.48.19:12224] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aT2-BjqZP_N7tgSGeZdL_AAAAA8"]
[Sun Dec 14 03:27:02.738114 2025] [:error] [pid 14689:tid 14713] [client 4.214.48.19:12218] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aT2-BkEcifvaa9I7SnmkQAAAAVQ"]
[Sun Dec 14 03:27:03.429957 2025] [:error] [pid 14689:tid 14693] [client 4.214.48.19:12044] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aT2-B0Ecifvaa9I7SnmkQgAAAUA"]
[Sun Dec 14 03:27:04.171887 2025] [:error] [pid 14689:tid 14697] [client 4.214.48.19:12191] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aT2-CEEcifvaa9I7SnmkQwAAAUQ"]
[Sun Dec 14 03:27:04.640986 2025] [:error] [pid 3635:tid 3689] [client 4.214.48.19:12124] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aT2-CDqfhzW7OpfKxKz-YgAAANg"]
[Sun Dec 14 03:27:05.353284 2025] [:error] [pid 3635:tid 3672] [client 4.214.48.19:12238] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aT2-CTqfhzW7OpfKxKz-YwAAAMc"]
[Sun Dec 14 03:27:05.736485 2025] [:error] [pid 3636:tid 3710] [client 4.214.48.19:12123] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aT2-Cd4pNg3LXPqKgeZOzQAAARI"]
[Sun Dec 14 03:27:06.112634 2025] [:error] [pid 14689:tid 14701] [client 4.214.48.19:25258] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aT2-CkEcifvaa9I7SnmkSAAAAUg"]
[Sun Dec 14 03:27:07.248531 2025] [:error] [pid 14689:tid 14712] [client 4.214.48.19:12163] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aT2-C0Ecifvaa9I7SnmkTgAAAVM"]
[Sun Dec 14 03:27:08.291605 2025] [:error] [pid 3635:tid 3686] [client 4.214.48.19:25250] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aT2-DDqfhzW7OpfKxKz-cQAAANU"]
[Sun Dec 14 03:27:09.589340 2025] [:error] [pid 14654:tid 14667] [client 4.214.48.19:12152] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aT2-DTqZP_N7tgSGeZdMDgAAAAo"]
[Sun Dec 14 03:27:10.152945 2025] [:error] [pid 14654:tid 14675] [client 4.214.48.19:25287] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aT2-DjqZP_N7tgSGeZdMEQAAABI"]
[Sun Dec 14 03:27:11.013750 2025] [:error] [pid 3636:tid 3698] [client 4.214.48.19:12276] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aT2-D94pNg3LXPqKgeZOzgAAAQY"]
[Sun Dec 14 03:27:11.405035 2025] [:error] [pid 14689:tid 14716] [client 4.214.48.19:12186] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aT2-D0Ecifvaa9I7SnmkWgAAAVc"]
[Sun Dec 14 03:27:11.861492 2025] [:error] [pid 14689:tid 14709] [client 4.214.48.19:12181] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f.php"] [unique_id "aT2-D0Ecifvaa9I7SnmkXgAAAVA"]
[Sun Dec 14 03:27:21.496227 2025] [:error] [pid 3634:tid 3649] [client 4.214.48.19:12240] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aT2-GYbt-wTl4d7Q7qqRrwAAAEs"]
[Sun Dec 14 03:27:22.636106 2025] [:error] [pid 14654:tid 14679] [client 4.214.48.19:12117] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aT2-GjqZP_N7tgSGeZdMGwAAABY"]
[Sun Dec 14 03:27:23.280621 2025] [:error] [pid 3635:tid 3688] [client 4.214.48.19:12192] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aT2-GzqfhzW7OpfKxKz-ewAAANc"]
[Sun Dec 14 03:27:24.041346 2025] [:error] [pid 14689:tid 14714] [client 4.214.48.19:12170] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aT2-HEEcifvaa9I7SnmkqQAAAVU"]
[Sun Dec 14 03:27:24.276960 2025] [:error] [pid 14689:tid 14715] [client 4.214.48.19:12108] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aT2-HEEcifvaa9I7SnmkuQAAAVY"]
[Sun Dec 14 03:27:24.702478 2025] [:error] [pid 3720:tid 3725] [client 4.214.48.19:12172] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aT2-HO7_sgsCEY5RMYr5hQAAAIM"]
[Sun Dec 14 03:27:25.091597 2025] [:error] [pid 14689:tid 14711] [client 4.214.48.19:12096] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aT2-HUEcifvaa9I7SnmkuwAAAVI"]
[Sun Dec 14 03:27:25.587291 2025] [:error] [pid 3635:tid 3670] [client 4.214.48.19:12130] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aT2-HTqfhzW7OpfKxKz-gAAAAMU"]
[Sun Dec 14 03:27:25.999076 2025] [:error] [pid 3635:tid 3680] [client 4.214.48.19:12141] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aT2-HTqfhzW7OpfKxKz-gQAAAM8"]
[Sun Dec 14 03:27:26.416045 2025] [:error] [pid 14654:tid 14675] [client 4.214.48.19:12212] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aT2-HjqZP_N7tgSGeZdMHgAAABI"]
[Sun Dec 14 03:27:27.133669 2025] [:error] [pid 14654:tid 14664] [client 4.214.48.19:12115] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aT2-HzqZP_N7tgSGeZdMIgAAAAc"]
[Sun Dec 14 03:27:27.702280 2025] [:error] [pid 14654:tid 14662] [client 4.214.48.19:12185] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aT2-HzqZP_N7tgSGeZdMJAAAAAU"]
[Sun Dec 14 03:27:28.132524 2025] [:error] [pid 3636:tid 3702] [client 4.214.48.19:12247] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aT2-IN4pNg3LXPqKgeZO_wAAAQo"]
[Sun Dec 14 03:27:28.412736 2025] [:error] [pid 3636:tid 3708] [client 4.214.48.19:12243] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aT2-IN4pNg3LXPqKgeZPAAAAARA"]
[Sun Dec 14 03:27:28.693343 2025] [:error] [pid 3634:tid 3645] [client 4.214.48.19:12280] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aT2-IIbt-wTl4d7Q7qqRsgAAAEc"]
[Sun Dec 14 03:27:28.970634 2025] [:error] [pid 14689:tid 14703] [client 4.214.48.19:25222] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aT2-IEEcifvaa9I7SnmkwwAAAUo"]
[Sun Dec 14 03:27:29.411683 2025] [:error] [pid 3634:tid 3661] [client 4.214.48.19:12103] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/go.php"] [unique_id "aT2-IYbt-wTl4d7Q7qqRtAAAAFc"]
[Sun Dec 14 03:27:29.909262 2025] [:error] [pid 14689:tid 14697] [client 4.214.48.19:12229] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/go.php"] [unique_id "aT2-IUEcifvaa9I7SnmkxAAAAUQ"]
[Sun Dec 14 03:27:30.358082 2025] [:error] [pid 3636:tid 3696] [client 4.214.48.19:12097] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/go.php"] [unique_id "aT2-It4pNg3LXPqKgeZPAgAAAQQ"]
[Sun Dec 14 03:27:30.974263 2025] [:error] [pid 3636:tid 3707] [client 4.214.48.19:12264] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/go.php"] [unique_id "aT2-It4pNg3LXPqKgeZPAwAAAQ8"]
[Sun Dec 14 03:27:31.509476 2025] [:error] [pid 3634:tid 3641] [client 4.214.48.19:12259] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aT2-I4bt-wTl4d7Q7qqRuAAAAEM"]
[Sun Dec 14 03:27:32.246671 2025] [:error] [pid 14654:tid 14678] [client 4.214.48.19:12037] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aT2-JDqZP_N7tgSGeZdMJwAAABU"]
[Sun Dec 14 03:27:33.174222 2025] [:error] [pid 3720:tid 3722] [client 4.214.48.19:12178] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aT2-Je7_sgsCEY5RMYr5igAAAIA"]
[Sun Dec 14 03:27:33.658099 2025] [:error] [pid 14654:tid 14679] [client 4.214.48.19:12144] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aT2-JTqZP_N7tgSGeZdMKgAAABY"]
[Sun Dec 14 03:27:34.988329 2025] [:error] [pid 3635:tid 3665] [client 4.214.48.19:12157] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aT2-JjqfhzW7OpfKxKz-hwAAAMA"]
[Sun Dec 14 03:27:35.657831 2025] [:error] [pid 3635:tid 3668] [client 4.214.48.19:25309] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aT2-JzqfhzW7OpfKxKz-iAAAAMM"]
[Sun Dec 14 03:27:36.499632 2025] [:error] [pid 14689:tid 14701] [client 4.214.48.19:12210] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aT2-KEEcifvaa9I7SnmkzAAAAUg"]
[Sun Dec 14 03:27:38.130691 2025] [:error] [pid 3635:tid 3666] [client 4.214.48.19:12120] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aT2-KjqfhzW7OpfKxKz-iQAAAME"]
[Sun Dec 14 03:27:39.068635 2025] [:error] [pid 3634:tid 3640] [client 4.214.48.19:12265] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conflg.php"] [unique_id "aT2-K4bt-wTl4d7Q7qqRvAAAAEI"]
[Sun Dec 14 03:27:39.589414 2025] [:error] [pid 3720:tid 3736] [client 4.214.48.19:12187] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conflg.php"] [unique_id "aT2-K-7_sgsCEY5RMYr5jgAAAI4"]
[Sun Dec 14 03:27:40.158025 2025] [:error] [pid 3720:tid 3738] [client 4.214.48.19:12245] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conflg.php"] [unique_id "aT2-LO7_sgsCEY5RMYr5kQAAAJA"]
[Sun Dec 14 03:27:40.484934 2025] [:error] [pid 3634:tid 3656] [client 4.214.48.19:12042] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conflg.php"] [unique_id "aT2-LIbt-wTl4d7Q7qqRvgAAAFI"]
[Sun Dec 14 03:27:41.201243 2025] [:error] [pid 14689:tid 14697] [client 4.214.48.19:12204] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aT2-LUEcifvaa9I7Snmk1AAAAUQ"]
[Sun Dec 14 03:27:41.749053 2025] [:error] [pid 14689:tid 14705] [client 4.214.48.19:12214] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aT2-LUEcifvaa9I7Snmk1wAAAUw"]
[Sun Dec 14 03:27:42.882012 2025] [:error] [pid 3634:tid 3648] [client 4.214.48.19:25285] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aT2-Lobt-wTl4d7Q7qqRwQAAAEo"]
[Sun Dec 14 03:27:43.176776 2025] [:error] [pid 3634:tid 3653] [client 4.214.48.19:12182] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aT2-L4bt-wTl4d7Q7qqRwgAAAE8"]
[Sun Dec 14 03:27:43.703603 2025] [:error] [pid 14689:tid 14702] [client 4.214.48.19:12174] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asas.php"] [unique_id "aT2-L0Ecifvaa9I7Snmk2AAAAUk"]
[Sun Dec 14 03:27:44.452491 2025] [:error] [pid 3634:tid 3647] [client 4.214.48.19:12119] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asas.php"] [unique_id "aT2-MIbt-wTl4d7Q7qqRxwAAAEk"]
[Sun Dec 14 03:27:45.106186 2025] [:error] [pid 14689:tid 14717] [client 4.214.48.19:12221] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asas.php"] [unique_id "aT2-MUEcifvaa9I7Snmk2gAAAVg"]
[Sun Dec 14 03:27:45.491423 2025] [:error] [pid 14689:tid 14700] [client 4.214.48.19:12196] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asas.php"] [unique_id "aT2-MUEcifvaa9I7Snmk3AAAAUc"]
[Sun Dec 14 03:27:45.966870 2025] [:error] [pid 14689:tid 14710] [client 4.214.48.19:12102] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aT2-MUEcifvaa9I7Snmk3wAAAVE"]
[Sun Dec 14 03:27:46.229193 2025] [:error] [pid 3634:tid 3660] [client 4.214.48.19:12160] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aT2-Mobt-wTl4d7Q7qqRyQAAAFY"]
[Sun Dec 14 03:27:46.799495 2025] [:error] [pid 14689:tid 14696] [client 4.214.48.19:12285] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aT2-MkEcifvaa9I7Snmk4QAAAUM"]
[Sun Dec 14 03:27:47.294324 2025] [:error] [pid 14689:tid 14707] [client 4.214.48.19:12045] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aT2-M0Ecifvaa9I7Snmk4gAAAU4"]
[Sun Dec 14 03:27:47.992926 2025] [:error] [pid 3635:tid 3667] [client 4.214.48.19:12055] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aT2-MzqfhzW7OpfKxKz-jAAAAMI"]
[Sun Dec 14 03:27:48.691270 2025] [:error] [pid 14689:tid 14703] [client 4.214.48.19:12169] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aT2-NEEcifvaa9I7Snmk5AAAAUo"]
[Sun Dec 14 03:27:49.466484 2025] [:error] [pid 3636:tid 3709] [client 4.214.48.19:12173] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aT2-Nd4pNg3LXPqKgeZPCAAAARE"]
[Sun Dec 14 03:27:50.303822 2025] [:error] [pid 14689:tid 14695] [client 4.214.48.19:12197] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aT2-NkEcifvaa9I7Snmk5wAAAUI"]
[Sun Dec 14 03:27:51.511936 2025] [:error] [pid 3636:tid 3715] [client 4.214.48.19:12207] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "aT2-N94pNg3LXPqKgeZPCgAAARc"]
[Sun Dec 14 03:27:54.475888 2025] [:error] [pid 14689:tid 14717] [client 4.214.48.19:12134] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "aT2-OkEcifvaa9I7Snmk6wAAAVg"]
[Sun Dec 14 03:27:55.576630 2025] [:error] [pid 3634:tid 3653] [client 4.214.48.19:12122] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "aT2-O4bt-wTl4d7Q7qqR1gAAAE8"]
[Sun Dec 14 03:27:56.979495 2025] [:error] [pid 3635:tid 3685] [client 4.214.48.19:25293] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "aT2-PDqfhzW7OpfKxKz-jgAAANQ"]
[Sun Dec 14 03:27:58.036318 2025] [:error] [pid 14689:tid 14704] [client 4.214.48.19:12116] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aT2-PkEcifvaa9I7Snmk9AAAAUs"]
[Sun Dec 14 03:27:58.624811 2025] [:error] [pid 14689:tid 14703] [client 4.214.48.19:12164] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aT2-PkEcifvaa9I7Snmk9QAAAUo"]
[Sun Dec 14 03:27:58.997275 2025] [:error] [pid 14689:tid 14695] [client 4.214.48.19:12158] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aT2-PkEcifvaa9I7Snmk9gAAAUI"]
[Sun Dec 14 03:27:59.396063 2025] [:error] [pid 3634:tid 3645] [client 4.214.48.19:12268] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aT2-P4bt-wTl4d7Q7qqR2AAAAEc"]
[Sun Dec 14 03:28:00.601742 2025] [:error] [pid 3720:tid 3731] [client 4.214.48.19:12081] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r.php"] [unique_id "aT2-QO7_sgsCEY5RMYr5nAAAAIk"]
[Sun Dec 14 03:28:02.786581 2025] [:error] [pid 3634:tid 3655] [client 4.214.48.19:12246] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r.php"] [unique_id "aT2-Qobt-wTl4d7Q7qqR3AAAAFE"]
[Sun Dec 14 03:28:03.361382 2025] [:error] [pid 14654:tid 14679] [client 4.214.48.19:12121] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r.php"] [unique_id "aT2-QzqZP_N7tgSGeZdMNwAAABY"]
[Sun Dec 14 03:28:04.238119 2025] [:error] [pid 3720:tid 3744] [client 4.214.48.19:12216] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r.php"] [unique_id "aT2-RO7_sgsCEY5RMYr5owAAAJY"]
[Sun Dec 14 03:28:04.834036 2025] [:error] [pid 14654:tid 14664] [client 4.214.48.19:12205] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aT2-RDqZP_N7tgSGeZdMOwAAAAc"]
[Sun Dec 14 03:28:05.403919 2025] [:error] [pid 14689:tid 14709] [client 4.214.48.19:12142] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aT2-RUEcifvaa9I7Snmk-QAAAVA"]
[Sun Dec 14 03:28:05.937733 2025] [:error] [pid 14654:tid 14658] [client 4.214.48.19:12052] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aT2-RTqZP_N7tgSGeZdMPAAAAAE"]
[Sun Dec 14 03:28:06.365972 2025] [:error] [pid 14654:tid 14662] [client 4.214.48.19:12198] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aT2-RjqZP_N7tgSGeZdMPQAAAAU"]
[Sun Dec 14 03:28:06.814781 2025] [:error] [pid 3720:tid 3741] [client 4.214.48.19:12126] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js.php"] [unique_id "aT2-Ru7_sgsCEY5RMYr5pQAAAJM"]
[Sun Dec 14 03:28:07.588205 2025] [:error] [pid 3720:tid 3740] [client 4.214.48.19:25290] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js.php"] [unique_id "aT2-R-7_sgsCEY5RMYr5pgAAAJI"]
[Sun Dec 14 03:28:07.909094 2025] [:error] [pid 3636:tid 3701] [client 4.214.48.19:12179] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js.php"] [unique_id "aT2-R94pNg3LXPqKgeZPFAAAAQk"]
[Sun Dec 14 03:28:08.278083 2025] [:error] [pid 14654:tid 14671] [client 4.214.48.19:12087] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js.php"] [unique_id "aT2-SDqZP_N7tgSGeZdMQQAAAA4"]
[Sun Dec 14 03:28:08.589061 2025] [:error] [pid 14689:tid 14704] [client 4.214.48.19:12111] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file1.php"] [unique_id "aT2-SEEcifvaa9I7SnmlAwAAAUs"]
[Sun Dec 14 03:28:08.915375 2025] [:error] [pid 3634:tid 3638] [client 4.214.48.19:12145] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file1.php"] [unique_id "aT2-SIbt-wTl4d7Q7qqR4gAAAEA"]
[Sun Dec 14 03:28:09.322067 2025] [:error] [pid 3634:tid 3656] [client 4.214.48.19:12113] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file1.php"] [unique_id "aT2-SYbt-wTl4d7Q7qqR4wAAAFI"]
[Sun Dec 14 03:28:09.831530 2025] [:error] [pid 14689:tid 14714] [client 4.214.48.19:12064] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file1.php"] [unique_id "aT2-SUEcifvaa9I7SnmlCQAAAVU"]
[Sun Dec 14 03:28:10.130028 2025] [:error] [pid 14689:tid 14699] [client 4.214.48.19:12271] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "aT2-SkEcifvaa9I7SnmlDQAAAUY"]
[Sun Dec 14 03:28:10.436081 2025] [:error] [pid 14689:tid 14706] [client 4.214.48.19:12150] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "aT2-SkEcifvaa9I7SnmlEAAAAU0"]
[Sun Dec 14 03:28:10.709180 2025] [:error] [pid 14689:tid 14711] [client 4.214.48.19:12188] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "aT2-SkEcifvaa9I7SnmlEQAAAVI"]
[Sun Dec 14 03:28:10.944607 2025] [:error] [pid 14689:tid 14704] [client 4.214.48.19:12199] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "aT2-SkEcifvaa9I7SnmlEgAAAUs"]
[Sun Dec 14 03:28:11.257251 2025] [:error] [pid 3720:tid 3733] [client 4.214.48.19:11972] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/123.php"] [unique_id "aT2-S-7_sgsCEY5RMYr5qAAAAIs"]
[Sun Dec 14 03:28:11.740438 2025] [:error] [pid 14689:tid 14695] [client 4.214.48.19:12153] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/123.php"] [unique_id "aT2-S0Ecifvaa9I7SnmlFQAAAUI"]
[Sun Dec 14 03:28:12.061814 2025] [:error] [pid 14654:tid 14678] [client 4.214.48.19:12146] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/123.php"] [unique_id "aT2-TDqZP_N7tgSGeZdMQwAAABU"]
[Sun Dec 14 03:28:12.499316 2025] [:error] [pid 14689:tid 14693] [client 4.214.48.19:12131] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/123.php"] [unique_id "aT2-TEEcifvaa9I7SnmlGAAAAUA"]
[Sun Dec 14 03:28:12.817873 2025] [:error] [pid 14689:tid 14702] [client 4.214.48.19:12036] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/321.php"] [unique_id "aT2-TEEcifvaa9I7SnmlGwAAAUk"]
[Sun Dec 14 03:28:13.409993 2025] [:error] [pid 14689:tid 14706] [client 4.214.48.19:12049] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/321.php"] [unique_id "aT2-TUEcifvaa9I7SnmlIAAAAU0"]
[Sun Dec 14 03:28:14.223529 2025] [:error] [pid 14654:tid 14661] [client 4.214.48.19:12099] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/321.php"] [unique_id "aT2-TjqZP_N7tgSGeZdMRAAAAAQ"]
[Sun Dec 14 03:28:14.703967 2025] [:error] [pid 14654:tid 14676] [client 4.214.48.19:12133] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/321.php"] [unique_id "aT2-TjqZP_N7tgSGeZdMRQAAABM"]
[Sun Dec 14 03:28:15.188728 2025] [:error] [pid 3720:tid 3731] [client 4.214.48.19:12129] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aT2-T-7_sgsCEY5RMYr5qwAAAIk"]
[Sun Dec 14 03:28:15.681831 2025] [:error] [pid 3634:tid 3661] [client 4.214.48.19:11988] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aT2-T4bt-wTl4d7Q7qqR5gAAAFc"]
[Sun Dec 14 03:28:16.290603 2025] [:error] [pid 3720:tid 3729] [client 4.214.48.19:12180] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aT2-UO7_sgsCEY5RMYr5rAAAAIc"]
[Sun Dec 14 03:28:16.576896 2025] [:error] [pid 3634:tid 3643] [client 4.214.48.19:25261] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aT2-UIbt-wTl4d7Q7qqR6QAAAEU"]
[Sun Dec 14 03:28:16.986817 2025] [:error] [pid 3634:tid 3652] [client 4.214.48.19:12050] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aT2-UIbt-wTl4d7Q7qqR6wAAAE4"]
[Sun Dec 14 03:28:17.859168 2025] [:error] [pid 14654:tid 14679] [client 4.214.48.19:12147] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aT2-UTqZP_N7tgSGeZdMSAAAABY"]
[Sun Dec 14 03:28:18.831615 2025] [:error] [pid 3636:tid 3715] [client 4.214.48.19:12132] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aT2-Ut4pNg3LXPqKgeZPHAAAARc"]
[Sun Dec 14 03:28:19.662285 2025] [:error] [pid 14654:tid 14673] [client 4.214.48.19:12168] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aT2-UzqZP_N7tgSGeZdMSgAAABA"]
[Sun Dec 14 03:28:30.939590 2025] [:error] [pid 14689:tid 14714] [client 4.214.48.19:12143] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aT2-XkEcifvaa9I7SnmlSgAAAVU"]
[Sun Dec 14 03:28:31.757210 2025] [:error] [pid 3634:tid 3661] [client 4.214.48.19:12171] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aT2-X4bt-wTl4d7Q7qqR-wAAAFc"]
[Sun Dec 14 03:28:32.366919 2025] [:error] [pid 14689:tid 14700] [client 4.214.48.19:12155] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aT2-YEEcifvaa9I7SnmlTQAAAUc"]
[Sun Dec 14 03:28:32.680681 2025] [:error] [pid 14689:tid 14717] [client 4.214.48.19:12058] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aT2-YEEcifvaa9I7SnmlUAAAAVg"]
[Sun Dec 14 03:28:32.908603 2025] [:error] [pid 14689:tid 14710] [client 4.214.48.19:12110] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aT2-YEEcifvaa9I7SnmlUQAAAVE"]
[Sun Dec 14 03:28:33.474802 2025] [:error] [pid 14654:tid 14661] [client 4.214.48.19:12279] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aT2-YTqZP_N7tgSGeZdMUgAAAAQ"]
[Sun Dec 14 03:28:33.839630 2025] [:error] [pid 3634:tid 3643] [client 4.214.48.19:12063] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aT2-YYbt-wTl4d7Q7qqR_QAAAEU"]
[Sun Dec 14 03:28:34.243451 2025] [:error] [pid 3636:tid 3713] [client 4.214.48.19:11994] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aT2-Yt4pNg3LXPqKgeZPKgAAARU"]
[Sun Dec 14 03:28:34.615443 2025] [:error] [pid 14689:tid 14702] [client 4.214.48.19:12194] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aT2-YkEcifvaa9I7SnmlVwAAAUk"]
[Sun Dec 14 03:28:34.950099 2025] [:error] [pid 14689:tid 14714] [client 4.214.48.19:12139] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aT2-YkEcifvaa9I7SnmlWQAAAVU"]
[Sun Dec 14 03:28:35.245845 2025] [:error] [pid 14654:tid 14679] [client 4.214.48.19:12213] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aT2-YzqZP_N7tgSGeZdMVQAAABY"]
[Sun Dec 14 03:28:35.657668 2025] [:error] [pid 3635:tid 3668] [client 4.214.48.19:12095] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aT2-YzqfhzW7OpfKxKz-mAAAAMM"]
[Sun Dec 14 03:28:36.014046 2025] [:error] [pid 3635:tid 3666] [client 4.214.48.19:12209] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aT2-ZDqfhzW7OpfKxKz-mQAAAME"]
[Sun Dec 14 03:28:36.457732 2025] [:error] [pid 3634:tid 3662] [client 4.214.48.19:12066] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aT2-ZIbt-wTl4d7Q7qqR_wAAAFg"]
[Sun Dec 14 03:28:37.125992 2025] [:error] [pid 3720:tid 3742] [client 4.214.48.19:12069] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aT2-Ze7_sgsCEY5RMYr5swAAAJQ"]
[Sun Dec 14 03:28:37.957616 2025] [:error] [pid 3635:tid 3673] [client 4.214.48.19:12072] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aT2-ZTqfhzW7OpfKxKz-nQAAAMg"]
[Sun Dec 14 03:28:38.700626 2025] [:error] [pid 3636:tid 3714] [client 4.214.48.19:12135] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/406.php"] [unique_id "aT2-Zt4pNg3LXPqKgeZPLQAAARY"]
[Sun Dec 14 03:28:39.163927 2025] [:error] [pid 14689:tid 14713] [client 4.214.48.19:12223] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/406.php"] [unique_id "aT2-Z0Ecifvaa9I7SnmlXQAAAVQ"]
[Sun Dec 14 03:28:39.598084 2025] [:error] [pid 3635:tid 3688] [client 4.214.48.19:12202] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/406.php"] [unique_id "aT2-ZzqfhzW7OpfKxKz-ngAAANc"]
[Sun Dec 14 03:28:40.033173 2025] [:error] [pid 3635:tid 3686] [client 4.214.48.19:12114] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/406.php"] [unique_id "aT2-aDqfhzW7OpfKxKz-nwAAANU"]
[Sun Dec 14 03:28:40.462017 2025] [:error] [pid 3720:tid 3743] [client 4.214.48.19:12033] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mariju.php"] [unique_id "aT2-aO7_sgsCEY5RMYr5uQAAAJU"]
[Sun Dec 14 03:28:41.011484 2025] [:error] [pid 3720:tid 3736] [client 4.214.48.19:12140] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mariju.php"] [unique_id "aT2-ae7_sgsCEY5RMYr5vAAAAI4"]
[Sun Dec 14 03:28:41.764036 2025] [:error] [pid 3720:tid 3728] [client 4.214.48.19:12073] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mariju.php"] [unique_id "aT2-ae7_sgsCEY5RMYr5wQAAAIY"]
[Sun Dec 14 03:28:42.563977 2025] [:error] [pid 3720:tid 3744] [client 4.214.48.19:12057] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mariju.php"] [unique_id "aT2-au7_sgsCEY5RMYr5xAAAAJY"]
[Sun Dec 14 03:28:43.308194 2025] [:error] [pid 14689:tid 14710] [client 4.214.48.19:12149] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aT2-a0Ecifvaa9I7SnmlYAAAAVE"]
[Sun Dec 14 03:28:44.257321 2025] [:error] [pid 3634:tid 3640] [client 4.214.48.19:12098] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aT2-bIbt-wTl4d7Q7qqSBAAAAEI"]
[Sun Dec 14 03:28:44.947786 2025] [:error] [pid 3634:tid 3654] [client 4.214.48.19:12275] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aT2-bIbt-wTl4d7Q7qqSBgAAAFA"]
[Sun Dec 14 03:28:45.391748 2025] [:error] [pid 3634:tid 3659] [client 4.214.48.19:12038] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aT2-bYbt-wTl4d7Q7qqSCAAAAFU"]
[Sun Dec 14 03:28:46.362976 2025] [:error] [pid 14689:tid 14694] [client 4.214.48.19:12177] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cache.php"] [unique_id "aT2-bkEcifvaa9I7SnmlYwAAAUE"]
[Sun Dec 14 03:28:47.001426 2025] [:error] [pid 14689:tid 14708] [client 4.214.48.19:12148] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cache.php"] [unique_id "aT2-b0Ecifvaa9I7SnmlZAAAAU8"]
[Sun Dec 14 03:28:47.584031 2025] [:error] [pid 3634:tid 3656] [client 4.214.48.19:11998] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cache.php"] [unique_id "aT2-b4bt-wTl4d7Q7qqSCwAAAFI"]
[Sun Dec 14 03:28:48.354435 2025] [:error] [pid 3634:tid 3645] [client 4.214.48.19:12046] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cache.php"] [unique_id "aT2-cIbt-wTl4d7Q7qqSDgAAAEc"]
[Sun Dec 14 03:28:48.607302 2025] [:error] [pid 14689:tid 14693] [client 4.214.48.19:12136] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zfile.php"] [unique_id "aT2-cEEcifvaa9I7SnmlZQAAAUA"]
[Sun Dec 14 03:28:49.167237 2025] [:error] [pid 3720:tid 3722] [client 4.214.48.19:12137] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zfile.php"] [unique_id "aT2-ce7_sgsCEY5RMYr5ygAAAIA"]
[Sun Dec 14 03:28:49.823301 2025] [:error] [pid 14689:tid 14695] [client 4.214.48.19:12075] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zfile.php"] [unique_id "aT2-cUEcifvaa9I7SnmlZwAAAUI"]
[Sun Dec 14 03:28:50.432187 2025] [:error] [pid 14654:tid 14672] [client 4.214.48.19:11978] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zfile.php"] [unique_id "aT2-cjqZP_N7tgSGeZdMWwAAAA8"]
[Sun Dec 14 03:28:50.769687 2025] [:error] [pid 14654:tid 14658] [client 4.214.48.19:12082] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NewFile.php"] [unique_id "aT2-cjqZP_N7tgSGeZdMXQAAAAE"]
[Sun Dec 14 03:28:51.893580 2025] [:error] [pid 14654:tid 14665] [client 4.214.48.19:12101] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NewFile.php"] [unique_id "aT2-czqZP_N7tgSGeZdMYAAAAAg"]
[Sun Dec 14 03:28:52.220204 2025] [:error] [pid 14689:tid 14701] [client 4.214.48.19:25320] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NewFile.php"] [unique_id "aT2-dEEcifvaa9I7SnmlagAAAUg"]
[Sun Dec 14 03:28:52.972740 2025] [:error] [pid 3636:tid 3711] [client 4.214.48.19:12206] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NewFile.php"] [unique_id "aT2-dN4pNg3LXPqKgeZPNwAAARM"]
[Sun Dec 14 03:28:53.826050 2025] [:error] [pid 3636:tid 3707] [client 4.214.48.19:12286] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/des.php"] [unique_id "aT2-dd4pNg3LXPqKgeZPOAAAAQ8"]
[Sun Dec 14 03:28:54.710982 2025] [:error] [pid 3635:tid 3675] [client 4.214.48.19:12183] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/des.php"] [unique_id "aT2-djqfhzW7OpfKxKz-pgAAAMo"]
[Sun Dec 14 03:28:55.720638 2025] [:error] [pid 14654:tid 14669] [client 4.214.48.19:12118] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/des.php"] [unique_id "aT2-dzqZP_N7tgSGeZdMZgAAAAw"]
[Sun Dec 14 03:28:56.167108 2025] [:error] [pid 14654:tid 14679] [client 4.214.48.19:11981] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/des.php"] [unique_id "aT2-eDqZP_N7tgSGeZdMZwAAABY"]
[Sun Dec 14 03:28:56.496936 2025] [:error] [pid 3634:tid 3644] [client 4.214.48.19:12070] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ant.php"] [unique_id "aT2-eIbt-wTl4d7Q7qqSEQAAAEY"]
[Sun Dec 14 03:28:56.857620 2025] [:error] [pid 3636:tid 3695] [client 4.214.48.19:12127] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ant.php"] [unique_id "aT2-eN4pNg3LXPqKgeZPPQAAAQM"]
[Sun Dec 14 03:28:57.381072 2025] [:error] [pid 3635:tid 3687] [client 4.214.48.19:12105] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ant.php"] [unique_id "aT2-eTqfhzW7OpfKxKz-qgAAANY"]
[Sun Dec 14 03:28:58.327154 2025] [:error] [pid 14689:tid 14696] [client 4.214.48.19:12138] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ant.php"] [unique_id "aT2-ekEcifvaa9I7SnmlcQAAAUM"]
[Sun Dec 14 03:28:58.905645 2025] [:error] [pid 14689:tid 14712] [client 4.214.48.19:12034] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "aT2-ekEcifvaa9I7SnmlcwAAAVM"]
[Sun Dec 14 03:28:59.575007 2025] [:error] [pid 14689:tid 14710] [client 4.214.48.19:12083] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "aT2-e0Ecifvaa9I7SnmldQAAAVE"]
[Sun Dec 14 03:28:59.950880 2025] [:error] [pid 3636:tid 3694] [client 4.214.48.19:12088] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "aT2-e94pNg3LXPqKgeZPQQAAAQI"]
[Sun Dec 14 03:29:00.354122 2025] [:error] [pid 3636:tid 3697] [client 4.214.48.19:12165] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "aT2-fN4pNg3LXPqKgeZPQgAAAQU"]
[Sun Dec 14 03:29:00.738125 2025] [:error] [pid 3720:tid 3737] [client 4.214.48.19:12039] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "aT2-fO7_sgsCEY5RMYr5zwAAAI8"]
[Sun Dec 14 03:29:01.157650 2025] [:error] [pid 3635:tid 3682] [client 4.214.48.19:12068] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "aT2-fTqfhzW7OpfKxKz-sQAAANE"]
[Sun Dec 14 03:29:01.880228 2025] [:error] [pid 14654:tid 14660] [client 4.214.48.19:25259] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "aT2-fTqZP_N7tgSGeZdMawAAAAM"]
[Sun Dec 14 03:29:02.892883 2025] [:error] [pid 3636:tid 3710] [client 4.214.48.19:11977] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "aT2-ft4pNg3LXPqKgeZPRAAAARI"]
[Sun Dec 14 03:29:04.031684 2025] [:error] [pid 14689:tid 14712] [client 4.214.48.19:12040] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aT2-gEEcifvaa9I7SnmlgwAAAVM"]
[Sun Dec 14 03:29:04.935840 2025] [:error] [pid 3634:tid 3655] [client 4.214.48.19:12100] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aT2-gIbt-wTl4d7Q7qqSEwAAAFE"]
[Sun Dec 14 03:29:06.226228 2025] [:error] [pid 14689:tid 14695] [client 4.214.48.19:12015] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aT2-gkEcifvaa9I7SnmligAAAUI"]
[Sun Dec 14 03:29:06.871936 2025] [:error] [pid 3636:tid 3698] [client 4.214.48.19:12272] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aT2-gt4pNg3LXPqKgeZPRwAAAQY"]
[Sun Dec 14 03:29:07.479868 2025] [:error] [pid 14689:tid 14707] [client 4.214.48.19:12219] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aT2-g0Ecifvaa9I7SnmlkAAAAU4"]
[Sun Dec 14 03:29:08.251596 2025] [:error] [pid 3636:tid 3711] [client 4.214.48.19:12208] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aT2-hN4pNg3LXPqKgeZPSgAAARM"]
[Sun Dec 14 03:29:09.163844 2025] [:error] [pid 3720:tid 3725] [client 4.214.48.19:11971] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aT2-he7_sgsCEY5RMYr50gAAAIM"]
[Sun Dec 14 03:29:10.189390 2025] [:error] [pid 3634:tid 3662] [client 4.214.48.19:12061] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aT2-hobt-wTl4d7Q7qqSFQAAAFg"]
[Sun Dec 14 03:29:10.874154 2025] [:error] [pid 3636:tid 3705] [client 4.214.48.19:25329] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpc.php"] [unique_id "aT2-ht4pNg3LXPqKgeZPTQAAAQ0"]
[Sun Dec 14 03:29:11.783168 2025] [:error] [pid 14689:tid 14713] [client 4.214.48.19:12001] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpc.php"] [unique_id "aT2-h0Ecifvaa9I7SnmllgAAAVQ"]
[Sun Dec 14 03:29:12.714030 2025] [:error] [pid 3635:tid 3674] [client 4.214.48.19:12016] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpc.php"] [unique_id "aT2-iDqfhzW7OpfKxKz-ugAAAMk"]
[Sun Dec 14 03:29:13.460253 2025] [:error] [pid 14689:tid 14703] [client 4.214.48.19:12093] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpc.php"] [unique_id "aT2-iUEcifvaa9I7SnmlmQAAAUo"]
[Sun Dec 14 03:29:13.732939 2025] [:error] [pid 3636:tid 3695] [client 4.214.48.19:12107] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lc.php"] [unique_id "aT2-id4pNg3LXPqKgeZPUwAAAQM"]
[Sun Dec 14 03:29:14.242022 2025] [:error] [pid 14689:tid 14708] [client 4.214.48.19:11979] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lc.php"] [unique_id "aT2-ikEcifvaa9I7SnmlnAAAAU8"]
[Sun Dec 14 03:29:14.879097 2025] [:error] [pid 14689:tid 14702] [client 4.214.48.19:11976] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lc.php"] [unique_id "aT2-ikEcifvaa9I7SnmlnwAAAUk"]
[Sun Dec 14 03:29:15.518491 2025] [:error] [pid 3635:tid 3668] [client 4.214.48.19:25340] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lc.php"] [unique_id "aT2-izqfhzW7OpfKxKz-vQAAAMM"]
[Sun Dec 14 03:29:15.841140 2025] [:error] [pid 14654:tid 14658] [client 4.214.48.19:12021] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mlex.php"] [unique_id "aT2-izqZP_N7tgSGeZdMbgAAAAE"]
[Sun Dec 14 03:29:16.224351 2025] [:error] [pid 14689:tid 14694] [client 4.214.48.19:11992] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mlex.php"] [unique_id "aT2-jEEcifvaa9I7SnmloQAAAUE"]
[Sun Dec 14 03:29:16.562424 2025] [:error] [pid 3636:tid 3692] [client 4.214.48.19:12170] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mlex.php"] [unique_id "aT2-jN4pNg3LXPqKgeZPVwAAAQA"]
[Sun Dec 14 03:29:17.431968 2025] [:error] [pid 3635:tid 3683] [client 4.214.48.19:12094] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mlex.php"] [unique_id "aT2-jTqfhzW7OpfKxKz-vgAAANI"]
[Sun Dec 14 03:29:18.528331 2025] [:error] [pid 14689:tid 14697] [client 4.214.48.19:12077] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aT2-jkEcifvaa9I7SnmlqAAAAUQ"]
[Sun Dec 14 03:29:20.669467 2025] [:error] [pid 3635:tid 3686] [client 4.214.48.19:12283] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aT2-kDqfhzW7OpfKxKz-wgAAANU"]
[Sun Dec 14 03:29:21.707749 2025] [:error] [pid 14654:tid 14672] [client 4.214.48.19:25218] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aT2-kTqZP_N7tgSGeZdMfQAAAA8"]
[Sun Dec 14 03:29:22.460898 2025] [:error] [pid 14689:tid 14705] [client 4.214.48.19:12041] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aT2-kkEcifvaa9I7SnmlsgAAAUw"]
[Sun Dec 14 03:29:23.467387 2025] [:error] [pid 14689:tid 14709] [client 4.214.48.19:11974] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aT2-k0Ecifvaa9I7SnmluAAAAVA"]
[Sun Dec 14 03:29:24.480128 2025] [:error] [pid 14689:tid 14711] [client 4.214.48.19:12012] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aT2-lEEcifvaa9I7SnmlvQAAAVI"]
[Sun Dec 14 03:29:25.178238 2025] [:error] [pid 14689:tid 14708] [client 4.214.48.19:12035] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aT2-lUEcifvaa9I7SnmlvgAAAU8"]
[Sun Dec 14 03:29:26.104597 2025] [:error] [pid 14689:tid 14705] [client 4.214.48.19:12065] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aT2-lkEcifvaa9I7SnmlwwAAAUw"]
[Sun Dec 14 03:29:26.577114 2025] [:error] [pid 14654:tid 14678] [client 4.214.48.19:11986] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mpvloi.php"] [unique_id "aT2-ljqZP_N7tgSGeZdMhwAAABU"]
[Sun Dec 14 03:29:27.222374 2025] [:error] [pid 3720:tid 3730] [client 4.214.48.19:11989] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mpvloi.php"] [unique_id "aT2-l-7_sgsCEY5RMYr55gAAAIg"]
[Sun Dec 14 03:29:27.886534 2025] [:error] [pid 14689:tid 14701] [client 4.214.48.19:11999] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mpvloi.php"] [unique_id "aT2-l0Ecifvaa9I7SnmlzwAAAUg"]
[Sun Dec 14 03:29:28.230920 2025] [:error] [pid 14654:tid 14679] [client 4.214.48.19:12091] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mpvloi.php"] [unique_id "aT2-mDqZP_N7tgSGeZdMiQAAABY"]
[Sun Dec 14 03:29:28.878846 2025] [:error] [pid 14689:tid 14694] [client 4.214.48.19:12060] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v1.php"] [unique_id "aT2-mEEcifvaa9I7Snml1gAAAUE"]
[Sun Dec 14 03:29:29.423269 2025] [:error] [pid 3634:tid 3661] [client 4.214.48.19:11912] [client 4.214.48.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v1.php"] [unique_id "aT2-mYbt-wTl4d7Q7qqSIAAAAFc"]
[Sun Dec 14 04:02:17.226910 2025] [:error] [pid 57846:tid 57884] [client 38.246.33.215:52246] [client 38.246.33.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.246.33.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT3GSbjKdsq0WIWdcBXZyQAAAEE"]
[Sun Dec 14 04:53:51.662916 2025] [autoindex:error] [pid 41600:tid 41604] [client 20.196.91.230:41213] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Sun Dec 14 04:53:54.889163 2025] [autoindex:error] [pid 41600:tid 41620] [client 20.196.91.230:41213] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Sun Dec 14 04:54:01.237409 2025] [autoindex:error] [pid 41600:tid 41603] [client 20.196.91.230:41213] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Sun Dec 14 04:54:01.544396 2025] [autoindex:error] [pid 41600:tid 41613] [client 20.196.91.230:41213] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Sun Dec 14 04:54:11.341258 2025] [:error] [pid 41600:tid 41612] [client 20.196.91.230:41213] [client 20.196.91.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aT3Sc9FLTBZjcwNd_VvRKAAAAQk"], referer: https://www.google.de/
[Sun Dec 14 04:54:11.807464 2025] [autoindex:error] [pid 39524:tid 39559] [client 20.196.91.230:39904] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Sun Dec 14 04:54:11.954760 2025] [:error] [pid 39524:tid 39567] [client 20.196.91.230:39904] [client 20.196.91.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/index.php"] [unique_id "aT3Sc2rVGpbDzFtDE9P_xwAAAEs"], referer: https://www.google.com/
[Sun Dec 14 04:54:12.410594 2025] [autoindex:error] [pid 41600:tid 41618] [client 20.196.91.230:39268] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Sun Dec 14 04:54:21.848814 2025] [:error] [pid 39524:tid 39576] [client 20.196.91.230:41732] [client 20.196.91.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.196.91.230, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT3SfWrVGpbDzFtDE9P_0AAAAFQ"], referer: https://www.google.de/
[Sun Dec 14 04:54:23.451007 2025] [autoindex:error] [pid 41600:tid 41606] [client 20.196.91.230:39268] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Sun Dec 14 04:54:25.219150 2025] [autoindex:error] [pid 41600:tid 41625] [client 20.196.91.230:39268] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Sun Dec 14 04:54:26.251050 2025] [autoindex:error] [pid 41600:tid 41612] [client 20.196.91.230:39268] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Sun Dec 14 04:54:30.272393 2025] [autoindex:error] [pid 41600:tid 41605] [client 20.196.91.230:39268] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Sun Dec 14 04:54:30.587199 2025] [autoindex:error] [pid 41600:tid 41623] [client 20.196.91.230:39268] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Sun Dec 14 04:54:30.891788 2025] [autoindex:error] [pid 41600:tid 41606] [client 20.196.91.230:39268] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Sun Dec 14 04:54:31.039385 2025] [:error] [pid 41600:tid 41604] [client 20.196.91.230:39268] [client 20.196.91.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aT3Sh9FLTBZjcwNd_VvRYwAAAQE"], referer: https://www.google.co.uk/
[Sun Dec 14 04:54:31.333693 2025] [:error] [pid 41600:tid 41625] [client 20.196.91.230:42382] [client 20.196.91.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aT3Sh9FLTBZjcwNd_VvRZAAAARY"], referer: https://www.google.de/
[Sun Dec 14 04:54:31.800078 2025] [autoindex:error] [pid 39524:tid 39573] [client 20.196.91.230:41806] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Sun Dec 14 04:54:32.102905 2025] [autoindex:error] [pid 39524:tid 39560] [client 20.196.91.230:41806] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Sun Dec 14 04:54:32.250161 2025] [:error] [pid 39524:tid 39562] [client 20.196.91.230:41806] [client 20.196.91.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/index.php"] [unique_id "aT3SiGrVGpbDzFtDE9P_1wAAAEY"], referer: https://duckduckgo.com/
[Sun Dec 14 04:54:32.704269 2025] [autoindex:error] [pid 39524:tid 39578] [client 20.196.91.230:40490] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Sun Dec 14 04:54:33.009874 2025] [autoindex:error] [pid 39524:tid 39577] [client 20.196.91.230:40490] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Sun Dec 14 04:54:33.157163 2025] [:error] [pid 39524:tid 39569] [client 20.196.91.230:40490] [client 20.196.91.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aT3SiWrVGpbDzFtDE9P_3gAAAE0"], referer: https://www.google.com/
[Sun Dec 14 04:54:33.452345 2025] [:error] [pid 41600:tid 41605] [client 20.196.91.230:42443] [client 20.196.91.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/index.php"] [unique_id "aT3SidFLTBZjcwNd_VvRawAAAQI"], referer: https://www.yahoo.com/
[Sun Dec 14 04:54:33.745711 2025] [:error] [pid 39614:tid 39617] [client 20.196.91.230:40483] [client 20.196.91.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aT3SifxybG8-9MflbDd6IQAAAME"], referer: https://www.google.com/
[Sun Dec 14 04:54:34.049286 2025] [:error] [pid 41600:tid 41606] [client 20.196.91.230:42494] [client 20.196.91.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/development/index.php"] [unique_id "aT3SitFLTBZjcwNd_VvRbAAAAQM"], referer: https://www.google.de/
[Sun Dec 14 04:54:34.343864 2025] [:error] [pid 39525:tid 39598] [client 20.196.91.230:40450] [client 20.196.91.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aT3Sik1fX_pB_BrvE_5q8wAAAI8"], referer: https://www.bing.com/
[Sun Dec 14 04:54:34.791727 2025] [autoindex:error] [pid 39614:tid 39629] [client 20.196.91.230:41825] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Sun Dec 14 04:54:34.940235 2025] [:error] [pid 39614:tid 39628] [client 20.196.91.230:41825] [client 20.196.91.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aT3SivxybG8-9MflbDd6JgAAAMw"], referer: https://duckduckgo.com/
[Sun Dec 14 04:54:35.388829 2025] [autoindex:error] [pid 39614:tid 39639] [client 20.196.91.230:41155] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Sun Dec 14 04:59:35.263504 2025] [:error] [pid 39525:tid 39607] [client 164.92.235.123:60534] [client 164.92.235.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 164.92.235.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT3Tt01fX_pB_BrvE_5r5wAAAJg"]
[Sun Dec 14 05:26:53.800664 2025] [:error] [pid 39614:tid 39634] [client 43.224.124.253:31255] [client 43.224.124.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.224.124.253, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT3aHfxybG8-9MflbDeCcgAAANI"]
[Sun Dec 14 05:26:56.322729 2025] [:error] [pid 39614:tid 39636] [client 43.224.124.253:31255] [client 43.224.124.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.224.124.253, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT3aIPxybG8-9MflbDeCdQAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Dec 14 05:45:55.013857 2025] [:error] [pid 41600:tid 41605] [client 45.144.212.58:36734] [client 45.144.212.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aT3ek9FLTBZjcwNd_VvoXAAAAQI"]
[Sun Dec 14 05:47:48.674300 2025] [:error] [pid 39525:tid 39599] [client 45.8.17.83:32737] [client 45.8.17.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT3fBE1fX_pB_BrvE_57FgAAAJA"]
[Sun Dec 14 05:57:21.786672 2025] [:error] [pid 39523:tid 39534] [client 165.227.169.147:51056] [client 165.227.169.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.169.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT3hQTQTQH1raAj2lkgrTwAAAAY"]
[Sun Dec 14 06:16:01.295990 2025] [:error] [pid 39614:tid 39636] [client 45.8.17.80:30391] [client 45.8.17.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT3lofxybG8-9MflbDeRqwAAANQ"]
[Sun Dec 14 06:23:03.369853 2025] [:error] [pid 39523:tid 39533] [client 45.8.17.80:42451] [client 45.8.17.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT3nRzQTQH1raAj2lkgwtgAAAAU"]
[Sun Dec 14 06:37:12.886302 2025] [:error] [pid 41600:tid 41610] [client 45.8.17.70:27077] [client 45.8.17.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT3qmNFLTBZjcwNd_Vv7LgAAAQc"]
[Sun Dec 14 06:47:06.899500 2025] [:error] [pid 39523:tid 39545] [client 155.133.142.66:43656] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 155.133.142.66, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT3s6jQTQH1raAj2lkg2NwAAABE"]
[Sun Dec 14 06:47:08.327027 2025] [:error] [pid 39523:tid 39538] [client 155.133.142.66:43656] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 155.133.142.66, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT3s7DQTQH1raAj2lkg2OAAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Sun Dec 14 06:51:42.740638 2025] [:error] [pid 39524:tid 39566] [client 45.8.17.71:37359] [client 45.8.17.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT3t_mrVGpbDzFtDE9Md0gAAAEo"]
[Sun Dec 14 06:57:25.588926 2025] [:error] [pid 39524:tid 39565] [client 38.246.33.200:52937] [client 38.246.33.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.246.33.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT3vVWrVGpbDzFtDE9MfCAAAAEk"]
[Sun Dec 14 07:05:56.807929 2025] [:error] [pid 41600:tid 41620] [client 45.8.17.75:64601] [client 45.8.17.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.75, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT3xVNFLTBZjcwNd_VsHrgAAARE"]
[Sun Dec 14 07:12:55.676725 2025] [:error] [pid 39614:tid 39617] [client 45.8.17.70:23819] [client 45.8.17.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT3y9_xybG8-9MflbDeiVwAAAME"]
[Sun Dec 14 07:41:13.275710 2025] [:error] [pid 39525:tid 39595] [client 45.8.17.205:44453] [client 45.8.17.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT35mU1fX_pB_BrvE_6W-AAAAIw"]
[Sun Dec 14 07:43:20.864738 2025] [:error] [pid 41600:tid 41615] [client 208.109.173.77:40804] [client 208.109.173.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.173.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT36GNFLTBZjcwNd_VsTOAAAAQw"]
[Sun Dec 14 07:43:21.843251 2025] [:error] [pid 41600:tid 41606] [client 208.109.173.77:40804] [client 208.109.173.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.173.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT36GdFLTBZjcwNd_VsTOQAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Sun Dec 14 07:55:17.197647 2025] [:error] [pid 41600:tid 41620] [client 45.8.17.99:28385] [client 45.8.17.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT385dFLTBZjcwNd_VsXFAAAARE"]
[Sun Dec 14 07:59:09.871332 2025] [:error] [pid 39524:tid 39561] [client 38.246.33.3:62264] [client 38.246.33.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.246.33.3, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT39zWrVGpbDzFtDE9MrmgAAAEU"]
[Sun Dec 14 08:09:41.915641 2025] [:error] [pid 39525:tid 39607] [client 45.8.17.81:29949] [client 45.8.17.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT4ARU1fX_pB_BrvE_6csgAAAJg"]
[Sun Dec 14 08:24:04.220698 2025] [:error] [pid 39524:tid 39565] [client 45.8.17.238:37563] [client 45.8.17.238] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.238, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT4DpGrVGpbDzFtDE9MvdwAAAEk"]
[Sun Dec 14 08:31:05.471123 2025] [:error] [pid 39525:tid 39597] [client 45.8.17.53:21889] [client 45.8.17.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT4FSU1fX_pB_BrvE_6gGQAAAI4"]
[Sun Dec 14 08:37:58.244236 2025] [:error] [pid 39523:tid 39545] [client 45.8.17.80:43521] [client 45.8.17.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT4G5jQTQH1raAj2lkhKbAAAABE"]
[Sun Dec 14 08:44:59.106874 2025] [:error] [pid 41600:tid 41615] [client 45.8.17.238:40549] [client 45.8.17.238] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.238, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT4Ii9FLTBZjcwNd_Vsl_AAAAQw"]
[Sun Dec 14 08:52:04.050897 2025] [:error] [pid 39614:tid 39638] [client 45.8.17.80:20107] [client 45.8.17.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT4KNPxybG8-9MflbDe4mAAAANY"]
[Sun Dec 14 08:59:03.162904 2025] [:error] [pid 39614:tid 39636] [client 45.8.17.86:51871] [client 45.8.17.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT4L1_xybG8-9MflbDe5tQAAANQ"]
[Sun Dec 14 08:59:54.752498 2025] [:error] [pid 39524:tid 39563] [client 38.246.32.67:55641] [client 38.246.32.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.246.32.67, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT4MCmrVGpbDzFtDE9M16QAAAEc"]
[Sun Dec 14 09:27:40.399479 2025] [:error] [pid 39614:tid 39617] [client 45.8.17.70:55261] [client 45.8.17.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT4SjPxybG8-9MflbDe_lwAAAME"]
[Sun Dec 14 09:35:48.187756 2025] [:error] [pid 39614:tid 39623] [client 45.82.13.170:33178] [client 45.82.13.170] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aT4UdPxybG8-9MflbDfBDAAAAMc"]
[Sun Dec 14 09:56:27.707315 2025] [:error] [pid 39523:tid 39538] [client 45.8.17.238:48409] [client 45.8.17.238] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.238, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT4ZSzQTQH1raAj2lkhXXAAAAAo"]
[Sun Dec 14 10:00:16.913653 2025] [:error] [pid 39614:tid 39632] [client 208.115.224.232:59288] [client 208.115.224.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.115.224.232, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT4aMPxybG8-9MflbDfF7AAAANA"]
[Sun Dec 14 10:11:06.187751 2025] [:error] [pid 41600:tid 41619] [client 45.8.17.205:21475] [client 45.8.17.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT4cutFLTBZjcwNd_Vs_TAAAARA"]
[Sun Dec 14 11:00:20.989812 2025] [:error] [pid 39524:tid 39570] [client 38.246.32.70:59733] [client 38.246.32.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.246.32.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT4oRGrVGpbDzFtDE9NOrgAAAE4"]
[Sun Dec 14 11:15:53.001693 2025] [:error] [pid 39523:tid 39531] [client 45.8.17.97:45453] [client 45.8.17.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.97, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT4r6TQTQH1raAj2lkhpEQAAAAM"]
[Sun Dec 14 11:21:33.020532 2025] [:error] [pid 40596:tid 40645] [client 49.7.227.204:46136] [client 49.7.227.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aT4tPWvZZo4N2X7WoLzGDwAAAdM"]
[Sun Dec 14 11:37:11.931512 2025] [:error] [pid 39525:tid 39590] [client 45.8.17.82:30685] [client 45.8.17.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT4w501fX_pB_BrvE_7IhQAAAIc"]
[Sun Dec 14 11:58:40.886747 2025] [:error] [pid 39614:tid 39624] [client 45.8.17.86:31781] [client 45.8.17.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT418PxybG8-9MflbDfirgAAAMg"]
[Sun Dec 14 12:02:16.679282 2025] [:error] [pid 39524:tid 39572] [client 38.246.33.185:56883] [client 38.246.33.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.246.33.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT42yGrVGpbDzFtDE9NXWQAAAFA"]
[Sun Dec 14 12:05:20.344810 2025] [:error] [pid 40561:tid 40577] [client 150.95.110.113:56474] [client 150.95.110.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 150.95.110.113, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT43gIY6r869zoqRQkQ7jwAAAUw"]
[Sun Dec 14 12:05:21.694903 2025] [:error] [pid 40596:tid 40627] [client 150.95.110.113:51726] [client 150.95.110.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 150.95.110.113, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT43gWvZZo4N2X7WoLzQhQAAAcE"], referer: http://expressinteriors.com/wp-login.php
[Sun Dec 14 12:05:22.936744 2025] [:error] [pid 39525:tid 39598] [client 150.95.110.113:52454] [client 150.95.110.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 150.95.110.113, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT43gk1fX_pB_BrvE_7MOwAAAI8"]
[Sun Dec 14 12:05:24.070883 2025] [:error] [pid 40595:tid 40612] [client 150.95.110.113:53046] [client 150.95.110.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 150.95.110.113, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT43hPjrht6y4RN-xKR7ZgAAAY0"]
[Sun Dec 14 12:05:49.036099 2025] [:error] [pid 39614:tid 39616] [client 45.8.17.86:46399] [client 45.8.17.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT43nfxybG8-9MflbDfjFgAAAMA"]
[Sun Dec 14 12:13:00.782753 2025] [:error] [pid 40561:tid 40570] [client 45.128.199.146:26109] [client 45.128.199.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT45TIY6r869zoqRQkQ8hAAAAUU"]
[Sun Dec 14 12:20:11.194462 2025] [:error] [pid 39525:tid 39603] [client 45.8.17.89:61839] [client 45.8.17.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.89, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT46-01fX_pB_BrvE_7OOgAAAJQ"]
[Sun Dec 14 12:41:56.946780 2025] [:error] [pid 39614:tid 39623] [client 45.8.17.88:43355] [client 45.8.17.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.88, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5AFPxybG8-9MflbDfoWQAAAMc"]
[Sun Dec 14 12:49:06.463375 2025] [:error] [pid 39523:tid 39547] [client 45.8.17.97:23181] [client 45.8.17.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.97, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5BwjQTQH1raAj2lkhz3QAAABM"]
[Sun Dec 14 12:56:19.628490 2025] [:error] [pid 41600:tid 41603] [client 45.8.17.82:25779] [client 45.8.17.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5Dc9FLTBZjcwNd_VtosgAAAQA"]
[Sun Dec 14 13:03:30.567887 2025] [:error] [pid 39614:tid 39624] [client 38.246.32.85:52363] [client 38.246.32.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.246.32.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5FIvxybG8-9MflbDfqfwAAAMg"]
[Sun Dec 14 13:10:53.609301 2025] [:error] [pid 39525:tid 39583] [client 45.8.17.70:34663] [client 45.8.17.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5G3U1fX_pB_BrvE_7VAQAAAIA"]
[Sun Dec 14 13:25:26.610090 2025] [:error] [pid 39524:tid 39562] [client 45.8.17.53:52821] [client 45.8.17.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5KRmrVGpbDzFtDE9NhCgAAAEY"]
[Sun Dec 14 13:39:56.867220 2025] [:error] [pid 39524:tid 39573] [client 45.8.17.88:51909] [client 45.8.17.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.88, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5NrGrVGpbDzFtDE9NiCgAAAFE"]
[Sun Dec 14 13:47:00.548497 2025] [:error] [pid 41600:tid 41615] [client 45.8.17.100:43633] [client 45.8.17.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.100, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5PVNFLTBZjcwNd_VtumQAAAQw"]
[Sun Dec 14 13:48:58.606218 2025] [:error] [pid 39525:tid 39588] [client 104.28.159.108:24485] [client 104.28.159.108] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aT5Pyk1fX_pB_BrvE_7YuAAAAIU"]
[Sun Dec 14 13:54:16.148266 2025] [:error] [pid 40596:tid 40634] [client 45.8.17.93:61657] [client 45.8.17.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5RCGvZZo4N2X7WoLzqwwAAAcg"]
[Sun Dec 14 14:01:12.366006 2025] [:error] [pid 39614:tid 39618] [client 38.246.32.24:61678] [client 38.246.32.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.246.32.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5SqPxybG8-9MflbDfvxQAAAMI"]
[Sun Dec 14 14:01:21.961850 2025] [:error] [pid 40596:tid 40628] [client 45.8.17.55:64009] [client 45.8.17.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.55, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5SsWvZZo4N2X7WoLztPAAAAcI"]
[Sun Dec 14 14:08:25.193883 2025] [:error] [pid 41600:tid 41622] [client 45.128.199.146:60425] [client 45.128.199.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5UWdFLTBZjcwNd_VtwhwAAARM"]
[Sun Dec 14 14:15:39.333529 2025] [:error] [pid 40596:tid 40636] [client 45.8.17.54:48783] [client 45.8.17.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5WC2vZZo4N2X7WoLzvYwAAAco"]
[Sun Dec 14 14:30:07.981902 2025] [:error] [pid 39525:tid 39584] [client 45.8.17.94:60269] [client 45.8.17.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.94, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5Zb01fX_pB_BrvE_7dJAAAAIE"]
[Sun Dec 14 14:44:30.837426 2025] [:error] [pid 40596:tid 40637] [client 45.8.17.50:41703] [client 45.8.17.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5czmvZZo4N2X7WoLz2YAAAAcs"]
[Sun Dec 14 14:45:57.832567 2025] [:error] [pid 40596:tid 40634] [client 115.79.196.94:39486] [client 115.79.196.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 115.79.196.94, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5dJWvZZo4N2X7WoLz24AAAAcg"]
[Sun Dec 14 14:45:59.183934 2025] [:error] [pid 39524:tid 39578] [client 115.79.196.94:36170] [client 115.79.196.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 115.79.196.94, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5dJ2rVGpbDzFtDE9NpeAAAAFY"], referer: http://expressinteriors.com/wp-login.php
[Sun Dec 14 14:46:00.457640 2025] [:error] [pid 40596:tid 40643] [client 115.79.196.94:36180] [client 115.79.196.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 115.79.196.94, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5dKGvZZo4N2X7WoLz24wAAAdE"]
[Sun Dec 14 14:46:01.736461 2025] [:error] [pid 39525:tid 39584] [client 115.79.196.94:36194] [client 115.79.196.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 115.79.196.94, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5dKU1fX_pB_BrvE_7fNQAAAIE"]
[Sun Dec 14 14:51:40.838508 2025] [:error] [pid 39523:tid 39543] [client 45.8.17.196:58177] [client 45.8.17.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.196, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5efDQTQH1raAj2lkh__QAAAA8"]
[Sun Dec 14 14:58:54.446200 2025] [:error] [pid 40596:tid 40632] [client 45.8.17.92:58289] [client 45.8.17.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5gLmvZZo4N2X7WoLz6ggAAAcY"]
[Sun Dec 14 15:01:04.961631 2025] [:error] [pid 39525:tid 39601] [client 162.240.239.64:42046] [client 162.240.239.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.239.64, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5gsE1fX_pB_BrvE_7gwwAAAJI"]
[Sun Dec 14 15:01:06.554590 2025] [:error] [pid 40596:tid 40648] [client 162.240.239.64:58322] [client 162.240.239.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.239.64, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5gsmvZZo4N2X7WoLz6zwAAAdY"], referer: http://expressinteriors.com/wp-login.php
[Sun Dec 14 15:01:08.023920 2025] [:error] [pid 40596:tid 40647] [client 162.240.239.64:59511] [client 162.240.239.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.239.64, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5gtGvZZo4N2X7WoLz60QAAAdU"]
[Sun Dec 14 15:01:09.329689 2025] [:error] [pid 40596:tid 40633] [client 162.240.239.64:60155] [client 162.240.239.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.239.64, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5gtWvZZo4N2X7WoLz60gAAAcc"]
[Sun Dec 14 15:01:34.259867 2025] [:error] [pid 40595:tid 40617] [client 38.246.32.216:60719] [client 38.246.32.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.246.32.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5gzvjrht6y4RN-xKSaCgAAAZI"]
[Sun Dec 14 15:06:26.048862 2025] [:error] [pid 39614:tid 39620] [client 45.8.17.238:31905] [client 45.8.17.238] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.238, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5h8vxybG8-9MflbDf23gAAAMQ"]
[Sun Dec 14 15:14:09.358858 2025] [:error] [pid 39524:tid 39562] [client 45.8.17.87:25757] [client 45.8.17.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.87, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5jwWrVGpbDzFtDE9Ns0AAAAEY"]
[Sun Dec 14 15:21:39.038007 2025] [:error] [pid 39525:tid 39594] [client 45.8.17.82:60791] [client 45.8.17.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5lg01fX_pB_BrvE_7jKQAAAIs"]
[Sun Dec 14 15:29:02.597631 2025] [:error] [pid 40596:tid 40641] [client 45.128.199.210:40197] [client 45.128.199.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5nPmvZZo4N2X7WoLwCQQAAAc8"]
[Sun Dec 14 15:36:21.672162 2025] [:error] [pid 39614:tid 39616] [client 45.8.17.53:27203] [client 45.8.17.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5o9fxybG8-9MflbDf7kwAAAMA"]
[Sun Dec 14 15:51:10.613529 2025] [:error] [pid 40596:tid 40637] [client 45.8.17.92:53267] [client 45.8.17.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5sbmvZZo4N2X7WoLwJpQAAAcs"]
[Sun Dec 14 15:58:18.572853 2025] [:error] [pid 41600:tid 41620] [client 45.8.17.55:26057] [client 45.8.17.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.55, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5uGtFLTBZjcwNd_VuA3gAAARE"]
[Sun Dec 14 15:59:22.015789 2025] [:error] [pid 40561:tid 40569] [client 38.246.33.212:56402] [client 38.246.33.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.246.33.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5uWoY6r869zoqRQkRfjAAAAUQ"]
[Sun Dec 14 16:05:36.436680 2025] [:error] [pid 39614:tid 39635] [client 45.8.17.78:54937] [client 45.8.17.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5v0PxybG8-9MflbDf_YwAAANM"]
[Sun Dec 14 16:12:50.906129 2025] [:error] [pid 39525:tid 39595] [client 45.8.17.92:31913] [client 45.8.17.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5xgk1fX_pB_BrvE_7qZQAAAIw"]
[Sun Dec 14 16:20:00.717695 2025] [:error] [pid 39525:tid 39584] [client 45.8.17.90:35829] [client 45.8.17.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5zME1fX_pB_BrvE_7sXgAAAIE"]
[Sun Dec 14 16:27:16.777336 2025] [:error] [pid 40596:tid 40630] [client 45.8.17.111:57121] [client 45.8.17.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT505GvZZo4N2X7WoLwYHgAAAcQ"]
[Sun Dec 14 16:34:37.069661 2025] [:error] [pid 40595:tid 40618] [client 45.128.199.146:44877] [client 45.128.199.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT52nfjrht6y4RN-xKSxowAAAZM"]
[Sun Dec 14 16:41:53.493251 2025] [:error] [pid 39523:tid 39550] [client 45.8.17.109:41967] [client 45.8.17.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.109, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT54UTQTQH1raAj2lkiQigAAABY"]
[Sun Dec 14 16:49:03.296494 2025] [:error] [pid 39614:tid 39638] [client 45.8.17.55:26653] [client 45.8.17.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.55, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT55__xybG8-9MflbDcIjgAAANY"]
[Sun Dec 14 16:49:45.416317 2025] [:error] [pid 40596:tid 40644] [client 51.195.41.174:60902] [client 51.195.41.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.195.41.174, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT56KWvZZo4N2X7WoLwmTQAAAdI"]
[Sun Dec 14 16:49:48.606328 2025] [:error] [pid 40596:tid 40647] [client 51.195.41.174:43272] [client 51.195.41.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.195.41.174, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT56LGvZZo4N2X7WoLwmdwAAAdU"], referer: http://expressinteriors.com/wp-login.php
[Sun Dec 14 16:49:56.372525 2025] [:error] [pid 40595:tid 40614] [client 51.195.41.174:34610] [client 51.195.41.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.195.41.174, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT56NPjrht6y4RN-xKS4RwAAAY8"]
[Sun Dec 14 16:56:22.880328 2025] [:error] [pid 39524:tid 39562] [client 45.8.17.53:64861] [client 45.8.17.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT57tmrVGpbDzFtDE9OCrAAAAEY"]
[Sun Dec 14 16:59:32.257493 2025] [:error] [pid 40595:tid 40623] [client 185.230.124.215:50626] [client 185.230.124.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.230.124.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT58dPjrht6y4RN-xKS_iAAAAZg"]
[Sun Dec 14 17:11:10.472170 2025] [:error] [pid 40561:tid 40574] [client 45.8.17.53:65507] [client 45.8.17.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT5_LoY6r869zoqRQkR8EgAAAUk"]
[Sun Dec 14 17:18:44.196828 2025] [:error] [pid 41600:tid 41609] [client 45.8.17.69:25597] [client 45.8.17.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.69, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6A9NFLTBZjcwNd_VufVAAAAQY"]
[Sun Dec 14 17:26:14.259782 2025] [:error] [pid 39524:tid 39576] [client 45.8.17.81:25513] [client 45.8.17.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6CtmrVGpbDzFtDE9OOmwAAAFQ"]
[Sun Dec 14 17:33:38.866891 2025] [:error] [pid 39523:tid 39532] [client 45.8.17.111:38807] [client 45.8.17.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6EcjQTQH1raAj2lkimugAAAAQ"]
[Sun Dec 14 17:41:06.437806 2025] [:error] [pid 39614:tid 39621] [client 45.128.199.146:38931] [client 45.128.199.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6GMvxybG8-9MflbDcjpgAAAMU"]
[Sun Dec 14 17:47:38.542916 2025] [:error] [pid 39524:tid 39576] [client 111.172.249.49:50457] [client 111.172.249.49] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aT6HumrVGpbDzFtDE9OZhgAAAFQ"]
[Sun Dec 14 17:48:28.090110 2025] [:error] [pid 40595:tid 40617] [client 45.8.17.67:25147] [client 45.8.17.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.67, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6H7Pjrht6y4RN-xKThEAAAAZI"]
[Sun Dec 14 18:04:43.073388 2025] [:error] [pid 40595:tid 40615] [client 146.70.74.147:51408] [client 146.70.74.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.70.74.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6Lu_jrht6y4RN-xKTqDAAAAZA"]
[Sun Dec 14 18:06:17.662292 2025] [:error] [pid 39523:tid 39545] [client 45.8.17.198:44831] [client 45.8.17.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.198, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6MGTQTQH1raAj2lki2VwAAABE"]
[Sun Dec 14 18:13:30.507352 2025] [:error] [pid 39614:tid 39632] [client 45.8.17.93:33449] [client 45.8.17.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6NyvxybG8-9MflbDc1wgAAANA"]
[Sun Dec 14 18:20:43.902609 2025] [:error] [pid 40595:tid 40612] [client 45.8.17.89:25919] [client 45.8.17.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.89, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6Pe_jrht6y4RN-xKTx_QAAAY0"]
[Sun Dec 14 18:39:21.126030 2025] [:error] [pid 40561:tid 40570] [client 34.38.90.254:51377] [client 34.38.90.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.90.254, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT6T2YY6r869zoqRQkSuLgAAAUU"]
[Sun Dec 14 18:39:23.768377 2025] [:error] [pid 40561:tid 40583] [client 34.38.90.254:51377] [client 34.38.90.254] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aT6T24Y6r869zoqRQkSuMQAAAVI"]
[Sun Dec 14 18:39:24.041734 2025] [:error] [pid 40561:tid 40580] [client 34.38.90.254:51377] [client 34.38.90.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.90.254, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT6T3IY6r869zoqRQkSuMgAAAU8"]
[Sun Dec 14 18:39:25.809504 2025] [:error] [pid 39523:tid 39551] [client 34.38.90.254:63810] [client 34.38.90.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.90.254, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT6T3TQTQH1raAj2lkjCZwAAABc"]
[Sun Dec 14 18:39:27.528829 2025] [:error] [pid 39614:tid 39624] [client 34.38.90.254:53569] [client 34.38.90.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.90.254, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT6T3_xybG8-9MflbDdEEgAAAMg"]
[Sun Dec 14 18:39:29.742067 2025] [:error] [pid 13799:tid 13824] [client 34.38.90.254:59232] [client 34.38.90.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.90.254, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT6T4XjPEin01ElFTNYXGgAAAhY"]
[Sun Dec 14 18:39:31.438687 2025] [:error] [pid 40596:tid 40639] [client 34.38.90.254:64611] [client 34.38.90.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.90.254, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT6T42vZZo4N2X7WoLxsGgAAAc0"]
[Sun Dec 14 18:39:31.438892 2025] [:error] [pid 40596:tid 40639] [client 34.38.90.254:64611] [client 34.38.90.254] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.38.90.254, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT6T42vZZo4N2X7WoLxsGgAAAc0"]
[Sun Dec 14 18:43:21.921949 2025] [:error] [pid 41600:tid 41613] [client 45.8.17.55:29781] [client 45.8.17.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.55, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6UydFLTBZjcwNd_VvWkAAAAQo"]
[Sun Dec 14 18:51:37.837644 2025] [:error] [pid 40561:tid 40577] [client 45.8.17.78:38651] [client 45.8.17.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6WuYY6r869zoqRQkSyUAAAAUw"]
[Sun Dec 14 18:59:57.749615 2025] [:error] [pid 40595:tid 40621] [client 45.8.17.238:62639] [client 45.8.17.238] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.238, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6Yrfjrht6y4RN-xKQArAAAAZY"]
[Sun Dec 14 19:22:16.575455 2025] [:error] [pid 39523:tid 39532] [client 45.8.17.54:40969] [client 45.8.17.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6d6DQTQH1raAj2lkjSfAAAAAQ"]
[Sun Dec 14 19:24:42.042452 2025] [:error] [pid 39524:tid 39571] [client 51.222.156.110:57556] [client 51.222.156.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.222.156.110, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6eemrVGpbDzFtDE9PSFwAAAE8"]
[Sun Dec 14 19:24:43.038887 2025] [:error] [pid 39524:tid 39570] [client 51.222.156.110:57556] [client 51.222.156.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.222.156.110, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6ee2rVGpbDzFtDE9PSGQAAAE4"], referer: https://expressinteriors.com/wp-login.php
[Sun Dec 14 19:29:20.432155 2025] [:error] [pid 39523:tid 39551] [client 45.8.17.74:60447] [client 45.8.17.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.74, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6fkDQTQH1raAj2lkjVPQAAABc"]
[Sun Dec 14 19:36:32.129076 2025] [:error] [pid 39525:tid 39595] [client 45.8.17.97:30179] [client 45.8.17.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.97, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6hQE1fX_pB_BrvE_5AhgAAAIw"]
[Sun Dec 14 19:37:38.887307 2025] [:error] [pid 40595:tid 40614] [client 185.92.25.17:45551] [client 185.92.25.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aT6hgvjrht6y4RN-xKQTWgAAAY8"]
[Sun Dec 14 19:37:43.294801 2025] [:error] [pid 39523:tid 39541] [client 91.230.225.83:41155] [client 91.230.225.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aT6hhzQTQH1raAj2lkjZVQAAAA0"]
[Sun Dec 14 19:37:55.829666 2025] [:error] [pid 39614:tid 39618] [client 185.192.71.111:44525] [client 185.192.71.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aT6hk_xybG8-9MflbDdhhAAAAMI"]
[Sun Dec 14 19:38:00.559917 2025] [:error] [pid 39523:tid 39541] [client 185.92.25.6:44717] [client 185.92.25.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aT6hmDQTQH1raAj2lkjZaAAAAA0"]
[Sun Dec 14 19:38:08.321155 2025] [:error] [pid 39614:tid 39634] [client 185.92.25.15:21165] [client 185.92.25.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aT6hoPxybG8-9MflbDdhlgAAANI"]
[Sun Dec 14 19:38:10.428344 2025] [:error] [pid 39524:tid 39557] [client 185.192.71.118:58765] [client 185.192.71.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aT6homrVGpbDzFtDE9PZNgAAAEE"]
[Sun Dec 14 19:38:11.059008 2025] [:error] [pid 39524:tid 39563] [client 91.230.225.79:60143] [client 91.230.225.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aT6ho2rVGpbDzFtDE9PZNwAAAEc"]
[Sun Dec 14 19:38:11.598353 2025] [:error] [pid 40595:tid 40623] [client 91.230.225.73:64719] [client 91.230.225.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aT6ho_jrht6y4RN-xKQThwAAAZg"]
[Sun Dec 14 19:38:13.477743 2025] [:error] [pid 39523:tid 39539] [client 185.92.25.7:47389] [client 185.92.25.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aT6hpTQTQH1raAj2lkjZagAAAAs"]
[Sun Dec 14 19:38:14.057252 2025] [:error] [pid 39614:tid 39629] [client 185.92.25.10:62977] [client 185.92.25.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aT6hpvxybG8-9MflbDdhmwAAAM0"]
[Sun Dec 14 19:38:15.511628 2025] [:error] [pid 40595:tid 40620] [client 185.192.71.109:53907] [client 185.192.71.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aT6hp_jrht6y4RN-xKQTiQAAAZU"]
[Sun Dec 14 19:38:17.986471 2025] [:error] [pid 40595:tid 40606] [client 185.192.71.107:23847] [client 185.192.71.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aT6hqfjrht6y4RN-xKQTjQAAAYc"]
[Sun Dec 14 19:38:22.313060 2025] [:error] [pid 13799:tid 13819] [client 91.230.225.81:28325] [client 91.230.225.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aT6hrnjPEin01ElFTNYv9AAAAhE"]
[Sun Dec 14 19:38:30.847661 2025] [:error] [pid 39524:tid 39578] [client 185.92.25.14:61527] [client 185.92.25.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aT6htmrVGpbDzFtDE9PZRgAAAFY"]
[Sun Dec 14 19:38:32.876051 2025] [:error] [pid 40561:tid 40586] [client 185.192.71.120:50635] [client 185.192.71.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aT6huIY6r869zoqRQkTHqQAAAVU"]
[Sun Dec 14 19:38:40.013530 2025] [:error] [pid 40596:tid 40640] [client 91.230.225.80:26553] [client 91.230.225.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aT6hwGvZZo4N2X7WoLyHTQAAAc4"]
[Sun Dec 14 19:38:42.129798 2025] [:error] [pid 40561:tid 40566] [client 185.192.71.108:20769] [client 185.192.71.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aT6hwoY6r869zoqRQkTHrQAAAUE"]
[Sun Dec 14 19:38:46.497415 2025] [:error] [pid 13799:tid 13819] [client 185.192.71.109:46857] [client 185.192.71.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/defaults.php"] [unique_id "aT6hxnjPEin01ElFTNYwAQAAAhE"]
[Sun Dec 14 19:38:48.688898 2025] [:error] [pid 41600:tid 41619] [client 185.192.71.113:38127] [client 185.192.71.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aT6hyNFLTBZjcwNd_Vv6vQAAARA"]
[Sun Dec 14 19:38:54.572469 2025] [:error] [pid 13799:tid 13805] [client 185.92.25.16:53053] [client 185.92.25.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aT6hznjPEin01ElFTNYwCAAAAgM"]
[Sun Dec 14 19:38:56.675025 2025] [:error] [pid 40596:tid 40628] [client 185.192.71.104:59121] [client 185.192.71.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aT6h0GvZZo4N2X7WoLyHYwAAAcI"]
[Sun Dec 14 19:38:59.797633 2025] [:error] [pid 39524:tid 39571] [client 185.192.71.102:53577] [client 185.192.71.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aT6h02rVGpbDzFtDE9PZrgAAAE8"]
[Sun Dec 14 19:39:00.368194 2025] [:error] [pid 39524:tid 39575] [client 185.92.25.5:50117] [client 185.92.25.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aT6h1GrVGpbDzFtDE9PZrwAAAFM"]
[Sun Dec 14 19:39:01.106010 2025] [:error] [pid 41600:tid 41605] [client 185.92.25.11:62475] [client 185.92.25.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aT6h1dFLTBZjcwNd_Vv6xgAAAQI"]
[Sun Dec 14 19:39:07.195486 2025] [:error] [pid 39525:tid 39592] [client 185.92.25.17:35125] [client 185.92.25.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/info.php"] [unique_id "aT6h201fX_pB_BrvE_5BXwAAAIk"]
[Sun Dec 14 19:39:07.794375 2025] [:error] [pid 39614:tid 39634] [client 91.230.225.84:50323] [client 91.230.225.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class.api.php"] [unique_id "aT6h2_xybG8-9MflbDdhtAAAANI"]
[Sun Dec 14 19:39:08.550027 2025] [:error] [pid 13799:tid 13819] [client 91.230.225.83:23875] [client 91.230.225.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aT6h3HjPEin01ElFTNYwDQAAAhE"]
[Sun Dec 14 19:39:18.101817 2025] [:error] [pid 41600:tid 41603] [client 185.92.25.110:41541] [client 185.92.25.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/admin.php"] [unique_id "aT6h5tFLTBZjcwNd_Vv64wAAAQA"]
[Sun Dec 14 19:39:23.551031 2025] [:error] [pid 40561:tid 40587] [client 91.230.225.78:22995] [client 91.230.225.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.230.225.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aT6h64Y6r869zoqRQkTHwAAAAVY"]
[Sun Dec 14 19:39:36.465609 2025] [:error] [pid 40561:tid 40575] [client 91.230.225.78:22995] [client 91.230.225.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aT6h-IY6r869zoqRQkTHzgAAAUo"]
[Sun Dec 14 19:39:39.531584 2025] [:error] [pid 40595:tid 40599] [client 185.192.71.109:52699] [client 185.192.71.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.192.71.109, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aT6h-_jrht6y4RN-xKQTtAAAAYA"]
[Sun Dec 14 19:39:41.350348 2025] [:error] [pid 40595:tid 40616] [client 185.192.71.109:52699] [client 185.192.71.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/item.php"] [unique_id "aT6h_fjrht6y4RN-xKQTtgAAAZE"]
[Sun Dec 14 19:39:50.408961 2025] [:error] [pid 39614:tid 39635] [client 185.92.25.4:35711] [client 185.92.25.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aT6iBvxybG8-9MflbDdh5QAAANM"]
[Sun Dec 14 19:39:59.982480 2025] [:error] [pid 41600:tid 41609] [client 91.230.225.74:34181] [client 91.230.225.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aT6iD9FLTBZjcwNd_Vv7FQAAAQY"]
[Sun Dec 14 19:40:02.946462 2025] [:error] [pid 39524:tid 39563] [client 185.192.71.103:46347] [client 185.192.71.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aT6iEmrVGpbDzFtDE9PZ9gAAAEc"]
[Sun Dec 14 19:40:06.924829 2025] [:error] [pid 40561:tid 40589] [client 185.192.71.105:30671] [client 185.192.71.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.192.71.105, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aT6iFoY6r869zoqRQkTH2gAAAVg"]
[Sun Dec 14 19:40:08.787498 2025] [:error] [pid 40561:tid 40571] [client 185.192.71.105:30671] [client 185.192.71.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aT6iGIY6r869zoqRQkTH3gAAAUY"]
[Sun Dec 14 19:40:28.700971 2025] [:error] [pid 13799:tid 13818] [client 91.230.225.73:27111] [client 91.230.225.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aT6iLHjPEin01ElFTNYwXQAAAhA"]
[Sun Dec 14 19:40:33.665922 2025] [:error] [pid 40595:tid 40605] [client 91.230.225.82:31011] [client 91.230.225.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.230.225.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aT6iMfjrht6y4RN-xKQT_AAAAYY"]
[Sun Dec 14 19:40:37.949669 2025] [:error] [pid 40595:tid 40599] [client 91.230.225.82:31011] [client 91.230.225.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aT6iNfjrht6y4RN-xKQUBQAAAYA"]
[Sun Dec 14 19:40:40.050442 2025] [:error] [pid 39525:tid 39595] [client 185.192.71.119:50563] [client 185.192.71.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/infi.php"] [unique_id "aT6iOE1fX_pB_BrvE_5B3wAAAIw"]
[Sun Dec 14 19:40:43.123933 2025] [:error] [pid 39525:tid 39597] [client 185.192.71.117:23093] [client 185.192.71.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aT6iO01fX_pB_BrvE_5B6QAAAI4"]
[Sun Dec 14 19:40:47.556764 2025] [:error] [pid 40595:tid 40610] [client 185.192.71.120:30401] [client 185.192.71.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aT6iP_jrht6y4RN-xKQUXwAAAYs"]
[Sun Dec 14 19:40:48.206043 2025] [:error] [pid 39524:tid 39565] [client 185.192.71.114:39143] [client 185.192.71.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aT6iQGrVGpbDzFtDE9PaZQAAAEk"]
[Sun Dec 14 19:40:54.149351 2025] [:error] [pid 39614:tid 39628] [client 185.92.25.11:53213] [client 185.92.25.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aT6iRvxybG8-9MflbDdihAAAAMw"]
[Sun Dec 14 19:40:56.383612 2025] [:error] [pid 13799:tid 13813] [client 185.192.71.101:46395] [client 185.192.71.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "aT6iSHjPEin01ElFTNYwiAAAAgs"]
[Sun Dec 14 19:41:00.311973 2025] [:error] [pid 13799:tid 13809] [client 91.230.225.74:33399] [client 91.230.225.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/edit.php"] [unique_id "aT6iTHjPEin01ElFTNYwjgAAAgc"]
[Sun Dec 14 19:41:04.930676 2025] [:error] [pid 40596:tid 40630] [client 185.92.25.17:29693] [client 185.92.25.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aT6iUGvZZo4N2X7WoLyIWAAAAcQ"]
[Sun Dec 14 19:41:09.213649 2025] [:error] [pid 13799:tid 13815] [client 91.230.225.80:61355] [client 91.230.225.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/click.php"] [unique_id "aT6iVXjPEin01ElFTNYwlQAAAg0"]
[Sun Dec 14 19:41:13.426936 2025] [:error] [pid 39614:tid 39632] [client 185.92.25.5:36577] [client 185.92.25.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aT6iWfxybG8-9MflbDdilgAAANA"]
[Sun Dec 14 19:41:22.347089 2025] [:error] [pid 39614:tid 39634] [client 185.92.25.15:30401] [client 185.92.25.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aT6iYvxybG8-9MflbDdisAAAANI"]
[Sun Dec 14 19:41:25.957157 2025] [:error] [pid 39524:tid 39580] [client 185.92.25.9:35043] [client 185.92.25.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/xl2023.php"] [unique_id "aT6iZWrVGpbDzFtDE9PamgAAAFg"]
[Sun Dec 14 19:41:26.509668 2025] [:error] [pid 40561:tid 40583] [client 185.192.71.111:31595] [client 185.192.71.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aT6iZoY6r869zoqRQkTIQQAAAVI"]
[Sun Dec 14 19:41:27.055626 2025] [:error] [pid 40596:tid 40636] [client 185.92.25.120:53389] [client 185.92.25.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aT6iZ2vZZo4N2X7WoLyIgAAAAco"]
[Sun Dec 14 19:41:30.435427 2025] [:error] [pid 13799:tid 13806] [client 91.230.225.73:48729] [client 91.230.225.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aT6ianjPEin01ElFTNYwsAAAAgQ"]
[Sun Dec 14 19:41:31.139347 2025] [:error] [pid 39523:tid 39531] [client 185.92.25.4:49461] [client 185.92.25.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aT6iazQTQH1raAj2lkjZ9QAAAAM"]
[Sun Dec 14 19:41:36.340830 2025] [:error] [pid 40596:tid 40633] [client 185.192.71.117:33421] [client 185.192.71.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aT6icGvZZo4N2X7WoLyIiQAAAcc"]
[Sun Dec 14 19:41:36.966210 2025] [:error] [pid 39523:tid 39530] [client 185.192.71.113:62341] [client 185.192.71.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aT6icDQTQH1raAj2lkjZ9wAAAAI"]
[Sun Dec 14 19:41:37.522648 2025] [:error] [pid 39524:tid 39573] [client 185.192.71.112:49097] [client 185.192.71.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aT6icWrVGpbDzFtDE9PaoQAAAFE"]
[Sun Dec 14 19:41:39.141518 2025] [:error] [pid 39614:tid 39625] [client 185.192.71.116:42763] [client 185.192.71.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "aT6ic_xybG8-9MflbDdi0AAAAMk"]
[Sun Dec 14 19:41:41.342399 2025] [:error] [pid 39523:tid 39546] [client 185.192.71.112:33021] [client 185.192.71.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aT6idTQTQH1raAj2lkjZ-QAAABI"]
[Sun Dec 14 19:41:51.956109 2025] [autoindex:error] [pid 39525:tid 39601] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:41:52.300369 2025] [autoindex:error] [pid 39525:tid 39583] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:41:52.651569 2025] [autoindex:error] [pid 39525:tid 39602] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:41:53.013191 2025] [autoindex:error] [pid 39525:tid 39592] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:41:54.815762 2025] [autoindex:error] [pid 39525:tid 39595] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:41:55.112686 2025] [autoindex:error] [pid 39525:tid 39586] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:41:55.429380 2025] [autoindex:error] [pid 39525:tid 39596] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:41:55.713127 2025] [autoindex:error] [pid 39525:tid 39600] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:41:56.288438 2025] [autoindex:error] [pid 39525:tid 39599] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:41:56.587646 2025] [autoindex:error] [pid 39525:tid 39594] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:41:57.206777 2025] [autoindex:error] [pid 39525:tid 39584] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:41:58.440184 2025] [autoindex:error] [pid 39525:tid 39598] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:41:58.724498 2025] [autoindex:error] [pid 39525:tid 39591] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:01.138349 2025] [autoindex:error] [pid 39525:tid 39583] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:01.462217 2025] [autoindex:error] [pid 39525:tid 39602] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:01.755341 2025] [autoindex:error] [pid 39525:tid 39593] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:02.074722 2025] [autoindex:error] [pid 39525:tid 39589] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:03.484230 2025] [autoindex:error] [pid 39525:tid 39595] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:03.774805 2025] [autoindex:error] [pid 39525:tid 39586] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:05.276066 2025] [autoindex:error] [pid 39525:tid 39596] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:09.638701 2025] [autoindex:error] [pid 39525:tid 39589] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:09.927338 2025] [autoindex:error] [pid 39525:tid 39607] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:10.445694 2025] [autoindex:error] [pid 39525:tid 39596] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:15.240611 2025] [autoindex:error] [pid 39525:tid 39591] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:18.608870 2025] [autoindex:error] [pid 39525:tid 39585] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:20.245350 2025] [autoindex:error] [pid 39525:tid 39602] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:20.566664 2025] [autoindex:error] [pid 39525:tid 39603] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:21.814999 2025] [autoindex:error] [pid 39525:tid 39586] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:22.100556 2025] [autoindex:error] [pid 39525:tid 39604] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:22.442398 2025] [autoindex:error] [pid 39525:tid 39600] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:26.951690 2025] [autoindex:error] [pid 39525:tid 39593] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:56.147186 2025] [autoindex:error] [pid 39525:tid 39605] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:56.477628 2025] [autoindex:error] [pid 39525:tid 39597] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:56.788002 2025] [autoindex:error] [pid 39525:tid 39591] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:42:57.072964 2025] [autoindex:error] [pid 39525:tid 39584] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:00.147424 2025] [autoindex:error] [pid 39525:tid 39602] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:00.512023 2025] [autoindex:error] [pid 39525:tid 39585] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:02.268253 2025] [autoindex:error] [pid 39525:tid 39587] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:03.579296 2025] [autoindex:error] [pid 39525:tid 39606] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:03.898859 2025] [autoindex:error] [pid 39525:tid 39601] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:04.226503 2025] [autoindex:error] [pid 39525:tid 39585] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:05.696339 2025] [autoindex:error] [pid 39525:tid 39589] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:06.000165 2025] [autoindex:error] [pid 39525:tid 39603] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:06.313349 2025] [autoindex:error] [pid 39525:tid 39586] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:06.897025 2025] [autoindex:error] [pid 39525:tid 39595] [client 91.230.225.78:23009] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:33.244145 2025] [autoindex:error] [pid 40561:tid 40578] [client 185.192.71.107:62833] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:38.785816 2025] [:error] [pid 39524:tid 39566] [client 45.8.17.70:42177] [client 45.8.17.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6i6mrVGpbDzFtDE9Pb3AAAAEo"]
[Sun Dec 14 19:43:46.916057 2025] [autoindex:error] [pid 40561:tid 40568] [client 185.192.71.107:62833] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:51.611086 2025] [autoindex:error] [pid 40561:tid 40569] [client 185.192.71.107:62833] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:51.930180 2025] [autoindex:error] [pid 40561:tid 40580] [client 185.192.71.107:62833] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:56.556467 2025] [autoindex:error] [pid 40561:tid 40573] [client 185.192.71.107:62833] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:56.835355 2025] [autoindex:error] [pid 40561:tid 40588] [client 185.192.71.107:62833] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:57.191646 2025] [autoindex:error] [pid 40561:tid 40584] [client 185.192.71.107:62833] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:57.466261 2025] [autoindex:error] [pid 40561:tid 40586] [client 185.192.71.107:62833] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:57.767658 2025] [autoindex:error] [pid 40561:tid 40579] [client 185.192.71.107:62833] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:58.088870 2025] [autoindex:error] [pid 40561:tid 40567] [client 185.192.71.107:62833] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:58.694367 2025] [autoindex:error] [pid 40561:tid 40574] [client 185.192.71.107:62833] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:59.307995 2025] [autoindex:error] [pid 40561:tid 40571] [client 185.192.71.107:62833] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:43:59.581616 2025] [autoindex:error] [pid 40561:tid 40568] [client 185.192.71.107:62833] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:44:20.511861 2025] [autoindex:error] [pid 40561:tid 40580] [client 185.192.71.107:62833] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 14 19:57:46.324798 2025] [:error] [pid 40561:tid 40568] [client 45.8.17.55:30545] [client 45.8.17.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.55, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6mOoY6r869zoqRQkTOgAAAAUM"]
[Sun Dec 14 20:04:52.832663 2025] [:error] [pid 39525:tid 39601] [client 45.8.17.74:37179] [client 45.8.17.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.74, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6n5E1fX_pB_BrvE_5ImgAAAJI"]
[Sun Dec 14 20:08:26.438777 2025] [:error] [pid 40561:tid 40578] [client 208.85.23.172:62181] [client 208.85.23.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.85.23.172, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6ouoY6r869zoqRQkTSdAAAAU0"]
[Sun Dec 14 20:11:54.916005 2025] [:error] [pid 41600:tid 41608] [client 45.8.17.109:22627] [client 45.8.17.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.109, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6pitFLTBZjcwNd_VsLwAAAAQU"]
[Sun Dec 14 20:26:00.144615 2025] [:error] [pid 39614:tid 39620] [client 45.8.17.87:26385] [client 45.8.17.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.87, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6s2PxybG8-9MflbDdwoAAAAMQ"]
[Sun Dec 14 20:33:16.048024 2025] [:error] [pid 39525:tid 39597] [client 45.8.17.68:26013] [client 45.8.17.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6ujE1fX_pB_BrvE_5O9wAAAI4"]
[Sun Dec 14 20:40:25.988298 2025] [:error] [pid 39524:tid 39568] [client 45.8.17.80:29619] [client 45.8.17.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6wOWrVGpbDzFtDE9PyIwAAAEw"]
[Sun Dec 14 20:44:46.133895 2025] [:error] [pid 39524:tid 39570] [client 162.241.252.224:30030] [client 162.241.252.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.252.224, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6xPmrVGpbDzFtDE9Pz5wAAAE4"]
[Sun Dec 14 20:44:47.174692 2025] [:error] [pid 39524:tid 39564] [client 162.241.252.224:30030] [client 162.241.252.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.252.224, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6xP2rVGpbDzFtDE9Pz6AAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Sun Dec 14 20:47:35.300331 2025] [:error] [pid 41600:tid 41604] [client 34.61.85.126:60880] [client 34.61.85.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.61.85.126, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT6x59FLTBZjcwNd_Vse2AAAAQE"]
[Sun Dec 14 20:47:37.639485 2025] [:error] [pid 41600:tid 41619] [client 34.61.85.126:60880] [client 34.61.85.126] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aT6x6dFLTBZjcwNd_Vse3QAAARA"]
[Sun Dec 14 20:47:37.837260 2025] [:error] [pid 41600:tid 41624] [client 34.61.85.126:60880] [client 34.61.85.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.61.85.126, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT6x6dFLTBZjcwNd_Vse3gAAARU"]
[Sun Dec 14 20:47:38.489654 2025] [:error] [pid 39614:tid 39616] [client 45.8.17.55:55193] [client 45.8.17.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.55, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6x6vxybG8-9MflbDd4UQAAAMA"]
[Sun Dec 14 20:47:39.379736 2025] [:error] [pid 39524:tid 39565] [client 34.61.85.126:56132] [client 34.61.85.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.61.85.126, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT6x62rVGpbDzFtDE9P0kgAAAEk"]
[Sun Dec 14 20:47:40.820433 2025] [:error] [pid 41600:tid 41621] [client 34.61.85.126:59679] [client 34.61.85.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.61.85.126, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT6x7NFLTBZjcwNd_Vse5wAAARI"]
[Sun Dec 14 20:47:42.494023 2025] [:error] [pid 40595:tid 40603] [client 34.61.85.126:55217] [client 34.61.85.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.61.85.126, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT6x7vjrht6y4RN-xKQnswAAAYQ"]
[Sun Dec 14 20:47:44.271284 2025] [:error] [pid 40561:tid 40581] [client 34.61.85.126:55773] [client 34.61.85.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.61.85.126, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT6x8IY6r869zoqRQkTdrAAAAVA"]
[Sun Dec 14 20:47:44.271462 2025] [:error] [pid 40561:tid 40581] [client 34.61.85.126:55773] [client 34.61.85.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.61.85.126, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT6x8IY6r869zoqRQkTdrAAAAVA"]
[Sun Dec 14 20:54:46.562037 2025] [:error] [pid 13799:tid 13815] [client 45.8.17.74:51705] [client 45.8.17.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.74, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6zlnjPEin01ElFTNZI1QAAAg0"]
[Sun Dec 14 21:07:35.017121 2025] [:error] [pid 41600:tid 41604] [client 104.197.2.113:51268] [client 104.197.2.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.197.2.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT62l9FLTBZjcwNd_VspSwAAAQE"]
[Sun Dec 14 21:07:37.319913 2025] [:error] [pid 41600:tid 41620] [client 104.197.2.113:51268] [client 104.197.2.113] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aT62mdFLTBZjcwNd_VspUAAAARE"]
[Sun Dec 14 21:07:37.519066 2025] [:error] [pid 41600:tid 41627] [client 104.197.2.113:51268] [client 104.197.2.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.197.2.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT62mdFLTBZjcwNd_VspUgAAARg"]
[Sun Dec 14 21:07:39.004007 2025] [:error] [pid 13799:tid 13802] [client 104.197.2.113:52854] [client 104.197.2.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.197.2.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT62m3jPEin01ElFTNZNlQAAAgA"]
[Sun Dec 14 21:07:40.424260 2025] [:error] [pid 39524:tid 39567] [client 104.197.2.113:63391] [client 104.197.2.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.197.2.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT62nGrVGpbDzFtDE9P80wAAAEs"]
[Sun Dec 14 21:07:41.812871 2025] [:error] [pid 40561:tid 40587] [client 104.197.2.113:53282] [client 104.197.2.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.197.2.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT62nYY6r869zoqRQkTkWwAAAVY"]
[Sun Dec 14 21:07:43.242009 2025] [:error] [pid 40595:tid 40620] [client 104.197.2.113:52359] [client 104.197.2.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.197.2.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT62n_jrht6y4RN-xKQuwAAAAZU"]
[Sun Dec 14 21:07:43.242222 2025] [:error] [pid 40595:tid 40620] [client 104.197.2.113:52359] [client 104.197.2.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 104.197.2.113, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT62n_jrht6y4RN-xKQuwAAAAZU"]
[Sun Dec 14 21:09:09.295653 2025] [:error] [pid 39525:tid 39605] [client 45.8.17.54:40425] [client 45.8.17.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT629U1fX_pB_BrvE_5Z1wAAAJY"]
[Sun Dec 14 21:16:21.111812 2025] [:error] [pid 40595:tid 40613] [client 45.8.17.96:63681] [client 45.8.17.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT64pfjrht6y4RN-xKQxkgAAAY4"]
[Sun Dec 14 21:23:36.118435 2025] [:error] [pid 40595:tid 40622] [client 45.8.17.67:29373] [client 45.8.17.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.67, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT66WPjrht6y4RN-xKQ04AAAAZc"]
[Sun Dec 14 21:44:42.662274 2025] [:error] [pid 39525:tid 39588] [client 45.8.17.96:58863] [client 45.8.17.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT6_Sk1fX_pB_BrvE_5j2QAAAIU"]
[Sun Dec 14 21:51:43.504857 2025] [:error] [pid 40596:tid 40635] [client 45.8.17.143:40469] [client 45.8.17.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.143, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7A72vZZo4N2X7WoLysdQAAAck"]
[Sun Dec 14 21:58:42.281520 2025] [:error] [pid 40596:tid 40635] [client 45.8.17.111:34967] [client 45.8.17.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7CkmvZZo4N2X7WoLyuFgAAAck"]
[Sun Dec 14 22:05:42.917494 2025] [:error] [pid 40595:tid 40623] [client 45.8.17.93:29421] [client 45.8.17.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7ENvjrht6y4RN-xKQ-SgAAAZg"]
[Sun Dec 14 22:12:39.496452 2025] [:error] [pid 39524:tid 39559] [client 45.8.17.196:39905] [client 45.8.17.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.196, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7F12rVGpbDzFtDE9MTDQAAAEM"]
[Sun Dec 14 22:16:30.134934 2025] [:error] [pid 39614:tid 39622] [client 98.98.171.39:51675] [client 98.98.171.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.98.171.39, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7GvvxybG8-9MflbDeRAwAAAMY"]
[Sun Dec 14 22:19:36.866933 2025] [:error] [pid 39524:tid 39567] [client 45.8.17.88:26995] [client 45.8.17.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.88, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7HeGrVGpbDzFtDE9MU3AAAAEs"]
[Sun Dec 14 22:26:40.874179 2025] [:error] [pid 41600:tid 41618] [client 45.8.17.93:42987] [client 45.8.17.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7JINFLTBZjcwNd_VtLyQAAAQ8"]
[Sun Dec 14 22:33:33.570948 2025] [:error] [pid 39524:tid 39566] [client 45.8.17.69:35727] [client 45.8.17.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.69, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7KvWrVGpbDzFtDE9MZSgAAAEo"]
[Sun Dec 14 22:40:42.288379 2025] [:error] [pid 41600:tid 41606] [client 45.8.17.53:65221] [client 45.8.17.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7MatFLTBZjcwNd_VtRggAAAQM"]
[Sun Dec 14 22:54:58.381678 2025] [:error] [pid 13799:tid 13817] [client 45.128.199.146:51725] [client 45.128.199.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.199.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7PwnjPEin01ElFTNZpQgAAAg8"]
[Sun Dec 14 23:02:06.470828 2025] [:error] [pid 39525:tid 39602] [client 45.8.17.89:62569] [client 45.8.17.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.89, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7Rbk1fX_pB_BrvE_5y9AAAAJM"]
[Sun Dec 14 23:09:20.802739 2025] [:error] [pid 40561:tid 40583] [client 45.8.17.111:38133] [client 45.8.17.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7TIIY6r869zoqRQkQALwAAAVI"]
[Sun Dec 14 23:16:34.841303 2025] [:error] [pid 39614:tid 39620] [client 45.8.17.84:23549] [client 45.8.17.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.84, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7U0vxybG8-9MflbDehrgAAAMQ"]
[Sun Dec 14 23:21:33.139143 2025] [:error] [pid 39614:tid 39639] [client 65.20.110.191:56999] [client 65.20.110.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.20.110.191, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7V_fxybG8-9MflbDeiiwAAANc"]
[Sun Dec 14 23:31:01.584031 2025] [:error] [pid 40561:tid 40584] [client 45.8.17.143:48897] [client 45.8.17.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.143, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7YNYY6r869zoqRQkQDsgAAAVM"]
[Sun Dec 14 23:45:19.298776 2025] [:error] [pid 41600:tid 41620] [client 45.8.17.205:60105] [client 45.8.17.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7bj9FLTBZjcwNd_VtqRwAAARE"]
[Sun Dec 14 23:52:33.991322 2025] [:error] [pid 13799:tid 13805] [client 45.8.17.97:40123] [client 45.8.17.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.97, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7dQXjPEin01ElFTNZ1lgAAAgM"]
[Sun Dec 14 23:59:36.911767 2025] [:error] [pid 39614:tid 39623] [client 45.8.17.84:46299] [client 45.8.17.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.84, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7e6PxybG8-9MflbDetewAAAMc"]
[Mon Dec 15 00:06:45.583440 2025] [:error] [pid 40596:tid 40626] [client 45.8.17.111:41081] [client 45.8.17.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7glWvZZo4N2X7WoLzIlwAAAcA"]
[Mon Dec 15 00:13:43.194704 2025] [:error] [pid 8339:tid 8345] [client 45.8.17.205:25671] [client 45.8.17.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7iN7lqE6mJc-Y6giMeawAAAAI"]
[Mon Dec 15 00:22:55.322569 2025] [:error] [pid 9009:tid 9012] [client 49.7.227.204:59266] [client 49.7.227.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aT7kXwhxwdgwYWQ8h8V3vAAAAQE"]
[Mon Dec 15 00:26:20.764911 2025] [:error] [pid 9009:tid 9012] [client 98.98.171.99:54648] [client 98.98.171.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.98.171.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7lLAhxwdgwYWQ8h8V5FQAAAQE"]
[Mon Dec 15 00:28:11.487086 2025] [:error] [pid 8339:tid 8353] [client 45.8.17.98:32087] [client 45.8.17.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.98, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7lm7lqE6mJc-Y6giMj2AAAAAo"]
[Mon Dec 15 00:35:26.034158 2025] [:error] [pid 9009:tid 9022] [client 45.8.17.205:20281] [client 45.8.17.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7nTghxwdgwYWQ8h8V93gAAAQs"]
[Mon Dec 15 00:36:30.134498 2025] [:error] [pid 8341:tid 8407] [client 43.131.45.213:59564] [client 43.131.45.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aT7njhOat6dLvzj8EhTP-AAAAIk"]
[Mon Dec 15 00:51:46.734520 2025] [:error] [pid 9009:tid 9025] [client 45.8.17.111:20859] [client 45.8.17.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7rIghxwdgwYWQ8h8WFFgAAAQ4"]
[Mon Dec 15 00:58:56.619005 2025] [:error] [pid 9009:tid 9018] [client 45.8.17.67:21945] [client 45.8.17.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.8.17.67, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7s0AhxwdgwYWQ8h8WIPQAAAQc"]
[Mon Dec 15 01:26:22.807930 2025] [:error] [pid 9009:tid 9017] [client 208.85.23.213:54432] [client 208.85.23.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.85.23.213, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT7zPghxwdgwYWQ8h8WUiQAAAQY"]
[Mon Dec 15 02:22:14.457446 2025] [:error] [pid 8341:tid 8411] [client 173.201.188.177:44828] [client 173.201.188.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.201.188.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT8AVhOat6dLvzj8EhTpFQAAAI0"]
[Mon Dec 15 02:22:15.897462 2025] [:error] [pid 8341:tid 8398] [client 173.201.188.177:44828] [client 173.201.188.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.201.188.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT8AVxOat6dLvzj8EhTpFgAAAIA"], referer: https://expressinteriors.com/wp-login.php
[Mon Dec 15 02:31:58.465720 2025] [:error] [pid 56645:tid 56669] [client 65.20.111.34:64720] [client 65.20.111.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.20.111.34, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT8Cnq__GSueqKs4nBnUqgAAAVU"]
[Mon Dec 15 03:19:08.126437 2025] [:error] [pid 8430:tid 8438] [client 4.241.176.161:2907] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aT8NrFk7yXaRc6dQclhK8wAAAMU"]
[Mon Dec 15 03:19:08.356093 2025] [:error] [pid 8339:tid 8360] [client 4.241.176.161:2888] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aT8NrLlqE6mJc-Y6giNePQAAABE"]
[Mon Dec 15 03:19:08.590883 2025] [:error] [pid 8339:tid 8358] [client 4.241.176.161:2994] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aT8NrLlqE6mJc-Y6giNePgAAAA8"]
[Mon Dec 15 03:19:08.819741 2025] [:error] [pid 8339:tid 8361] [client 4.241.176.161:2882] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aT8NrLlqE6mJc-Y6giNeQAAAABI"]
[Mon Dec 15 03:19:09.048687 2025] [:error] [pid 8430:tid 8445] [client 4.241.176.161:2958] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s121ws2s.php"] [unique_id "aT8NrVk7yXaRc6dQclhK9AAAAMw"]
[Mon Dec 15 03:19:09.276791 2025] [:error] [pid 8341:tid 8416] [client 4.241.176.161:2948] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s121ws2s.php"] [unique_id "aT8NrROat6dLvzj8EhT0ZwAAAJI"]
[Mon Dec 15 03:19:09.524906 2025] [:error] [pid 9009:tid 9028] [client 4.241.176.161:2906] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s121ws2s.php"] [unique_id "aT8NrQhxwdgwYWQ8h8WwvQAAARE"]
[Mon Dec 15 03:19:09.767665 2025] [:error] [pid 8430:tid 8450] [client 4.241.176.161:2898] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s121ws2s.php"] [unique_id "aT8NrVk7yXaRc6dQclhK9QAAANE"]
[Mon Dec 15 03:19:09.994434 2025] [:error] [pid 8341:tid 8419] [client 4.241.176.161:2906] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww1.php"] [unique_id "aT8NrROat6dLvzj8EhT0aQAAAJU"]
[Mon Dec 15 03:19:10.224955 2025] [:error] [pid 8339:tid 8353] [client 4.241.176.161:2903] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww1.php"] [unique_id "aT8NrrlqE6mJc-Y6giNeRAAAAAo"]
[Mon Dec 15 03:19:10.453101 2025] [:error] [pid 9009:tid 9029] [client 4.241.176.161:2947] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww1.php"] [unique_id "aT8NrghxwdgwYWQ8h8WwvgAAARI"]
[Mon Dec 15 03:19:10.683268 2025] [:error] [pid 56645:tid 56668] [client 4.241.176.161:2993] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww1.php"] [unique_id "aT8Nrq__GSueqKs4nBneWwAAAVQ"]
[Mon Dec 15 03:19:10.909923 2025] [:error] [pid 8430:tid 8455] [client 4.241.176.161:2967] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aT8Nrlk7yXaRc6dQclhK-gAAANY"]
[Mon Dec 15 03:19:11.153754 2025] [:error] [pid 9009:tid 9035] [client 4.241.176.161:2902] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aT8NrwhxwdgwYWQ8h8WwwQAAARg"]
[Mon Dec 15 03:19:11.416029 2025] [:error] [pid 8430:tid 8439] [client 4.241.176.161:2924] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aT8Nr1k7yXaRc6dQclhK_gAAAMY"]
[Mon Dec 15 03:19:11.654932 2025] [:error] [pid 56645:tid 56670] [client 4.241.176.161:2881] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aT8Nr6__GSueqKs4nBneXAAAAVY"]
[Mon Dec 15 03:19:11.889034 2025] [:error] [pid 56645:tid 56669] [client 4.241.176.161:2963] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww3.php"] [unique_id "aT8Nr6__GSueqKs4nBneXQAAAVU"]
[Mon Dec 15 03:19:12.121538 2025] [:error] [pid 9009:tid 9034] [client 4.241.176.161:2911] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww3.php"] [unique_id "aT8NsAhxwdgwYWQ8h8WwxgAAARc"]
[Mon Dec 15 03:19:12.361169 2025] [:error] [pid 8339:tid 8365] [client 4.241.176.161:2885] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww3.php"] [unique_id "aT8NsLlqE6mJc-Y6giNeSgAAABY"]
[Mon Dec 15 03:19:12.614070 2025] [:error] [pid 8339:tid 8349] [client 4.241.176.161:2890] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww3.php"] [unique_id "aT8NsLlqE6mJc-Y6giNeSwAAAAY"]
[Mon Dec 15 03:19:12.840859 2025] [:error] [pid 8341:tid 8410] [client 4.241.176.161:2949] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/783de.php"] [unique_id "aT8NsBOat6dLvzj8EhT0awAAAIw"]
[Mon Dec 15 03:19:13.090105 2025] [:error] [pid 8341:tid 8401] [client 4.241.176.161:2892] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/783de.php"] [unique_id "aT8NsROat6dLvzj8EhT0bAAAAIM"]
[Mon Dec 15 03:19:13.318377 2025] [:error] [pid 56645:tid 56651] [client 4.241.176.161:2966] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/783de.php"] [unique_id "aT8Nsa__GSueqKs4nBneXwAAAUM"]
[Mon Dec 15 03:19:13.546405 2025] [:error] [pid 9009:tid 9015] [client 4.241.176.161:2887] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/783de.php"] [unique_id "aT8NsQhxwdgwYWQ8h8WwyAAAAQQ"]
[Mon Dec 15 03:19:13.774705 2025] [:error] [pid 8340:tid 8390] [client 4.241.176.161:2969] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lm15.php"] [unique_id "aT8NsYIT4nh2qy-Ry9pwwwAAAFM"]
[Mon Dec 15 03:19:14.001800 2025] [:error] [pid 8340:tid 8375] [client 4.241.176.161:2964] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lm15.php"] [unique_id "aT8NsoIT4nh2qy-Ry9pwxAAAAEQ"]
[Mon Dec 15 03:19:14.228259 2025] [:error] [pid 8430:tid 8437] [client 4.241.176.161:2996] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lm15.php"] [unique_id "aT8Nslk7yXaRc6dQclhLAwAAAMQ"]
[Mon Dec 15 03:19:14.456250 2025] [:error] [pid 56645:tid 56659] [client 4.241.176.161:2965] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lm15.php"] [unique_id "aT8Nsq__GSueqKs4nBneYgAAAUs"]
[Mon Dec 15 03:19:14.685235 2025] [:error] [pid 9009:tid 9019] [client 4.241.176.161:2999] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gdn.php"] [unique_id "aT8NsghxwdgwYWQ8h8WwyQAAAQg"]
[Mon Dec 15 03:19:14.914921 2025] [:error] [pid 8340:tid 8388] [client 4.241.176.161:2968] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gdn.php"] [unique_id "aT8NsoIT4nh2qy-Ry9pwxgAAAFE"]
[Mon Dec 15 03:19:15.148098 2025] [:error] [pid 8341:tid 8412] [client 4.241.176.161:2500] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gdn.php"] [unique_id "aT8NsxOat6dLvzj8EhT0bQAAAI4"]
[Mon Dec 15 03:19:15.386930 2025] [:error] [pid 8340:tid 8387] [client 4.241.176.161:2886] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gdn.php"] [unique_id "aT8Ns4IT4nh2qy-Ry9pwxwAAAFA"]
[Mon Dec 15 03:19:15.659092 2025] [:error] [pid 8341:tid 8403] [client 4.241.176.161:2913] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file5.php"] [unique_id "aT8NsxOat6dLvzj8EhT0bwAAAIU"]
[Mon Dec 15 03:19:15.887012 2025] [:error] [pid 8341:tid 8398] [client 4.241.176.161:2904] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file5.php"] [unique_id "aT8NsxOat6dLvzj8EhT0cAAAAIA"]
[Mon Dec 15 03:19:16.114015 2025] [:error] [pid 8341:tid 8400] [client 4.241.176.161:2944] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file5.php"] [unique_id "aT8NtBOat6dLvzj8EhT0cQAAAII"]
[Mon Dec 15 03:19:16.345320 2025] [:error] [pid 8430:tid 8445] [client 4.241.176.161:2940] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file5.php"] [unique_id "aT8NtFk7yXaRc6dQclhLBwAAAMw"]
[Mon Dec 15 03:19:16.574452 2025] [:error] [pid 9009:tid 9025] [client 4.241.176.161:2952] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3i8som87avh59dosfymtvCakc.php"] [unique_id "aT8NtAhxwdgwYWQ8h8WwywAAAQ4"]
[Mon Dec 15 03:19:16.801239 2025] [:error] [pid 8341:tid 8422] [client 4.241.176.161:2900] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3i8som87avh59dosfymtvCakc.php"] [unique_id "aT8NtBOat6dLvzj8EhT0cgAAAJg"]
[Mon Dec 15 03:19:17.028094 2025] [:error] [pid 8341:tid 8409] [client 4.241.176.161:2961] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3i8som87avh59dosfymtvCakc.php"] [unique_id "aT8NtROat6dLvzj8EhT0cwAAAIs"]
[Mon Dec 15 03:19:17.257662 2025] [:error] [pid 8340:tid 8383] [client 4.241.176.161:3001] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3i8som87avh59dosfymtvCakc.php"] [unique_id "aT8NtYIT4nh2qy-Ry9pwyAAAAEw"]
[Mon Dec 15 03:19:17.484088 2025] [:error] [pid 8340:tid 8379] [client 4.241.176.161:2984] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rzki.php"] [unique_id "aT8NtYIT4nh2qy-Ry9pwyQAAAEg"]
[Mon Dec 15 03:19:17.710621 2025] [:error] [pid 56645:tid 56650] [client 4.241.176.161:2926] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rzki.php"] [unique_id "aT8Nta__GSueqKs4nBneYwAAAUI"]
[Mon Dec 15 03:19:17.936935 2025] [:error] [pid 8339:tid 8363] [client 4.241.176.161:2509] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rzki.php"] [unique_id "aT8NtblqE6mJc-Y6giNeTgAAABQ"]
[Mon Dec 15 03:19:18.163969 2025] [:error] [pid 8339:tid 8347] [client 4.241.176.161:2959] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rzki.php"] [unique_id "aT8NtrlqE6mJc-Y6giNeTwAAAAQ"]
[Mon Dec 15 03:19:18.392304 2025] [:error] [pid 8340:tid 8373] [client 4.241.176.161:2526] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aT8NtoIT4nh2qy-Ry9pwygAAAEI"]
[Mon Dec 15 03:19:18.628134 2025] [:error] [pid 9009:tid 9020] [client 4.241.176.161:2978] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aT8NtghxwdgwYWQ8h8WwzgAAAQk"]
[Mon Dec 15 03:19:18.857197 2025] [:error] [pid 8341:tid 8399] [client 4.241.176.161:2899] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aT8NthOat6dLvzj8EhT0dQAAAIE"]
[Mon Dec 15 03:19:19.085290 2025] [:error] [pid 8340:tid 8384] [client 4.241.176.161:2932] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aT8Nt4IT4nh2qy-Ry9pwzQAAAE0"]
[Mon Dec 15 03:19:19.322439 2025] [:error] [pid 8340:tid 8392] [client 4.241.176.161:2901] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aT8Nt4IT4nh2qy-Ry9pwzgAAAFU"]
[Mon Dec 15 03:19:19.550629 2025] [:error] [pid 8339:tid 8346] [client 4.241.176.161:2945] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aT8Nt7lqE6mJc-Y6giNeUAAAAAM"]
[Mon Dec 15 03:19:19.787062 2025] [:error] [pid 8339:tid 8356] [client 4.241.176.161:3003] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aT8Nt7lqE6mJc-Y6giNeUQAAAA0"]
[Mon Dec 15 03:19:20.015732 2025] [:error] [pid 8339:tid 8353] [client 4.241.176.161:2974] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aT8NuLlqE6mJc-Y6giNeUwAAAAo"]
[Mon Dec 15 03:19:20.244778 2025] [:error] [pid 8339:tid 8359] [client 4.241.176.161:2910] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-729.php"] [unique_id "aT8NuLlqE6mJc-Y6giNeVAAAABA"]
[Mon Dec 15 03:19:20.476227 2025] [:error] [pid 8341:tid 8404] [client 4.241.176.161:2897] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-729.php"] [unique_id "aT8NuBOat6dLvzj8EhT0dgAAAIY"]
[Mon Dec 15 03:19:20.703063 2025] [:error] [pid 8340:tid 8386] [client 4.241.176.161:2891] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-729.php"] [unique_id "aT8NuIIT4nh2qy-Ry9pwzwAAAE8"]
[Mon Dec 15 03:19:20.930137 2025] [:error] [pid 8340:tid 8378] [client 4.241.176.161:2972] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-729.php"] [unique_id "aT8NuIIT4nh2qy-Ry9pw0QAAAEc"]
[Mon Dec 15 03:19:21.157259 2025] [:error] [pid 56645:tid 56662] [client 4.241.176.161:2991] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "aT8Nua__GSueqKs4nBneZgAAAU4"]
[Mon Dec 15 03:19:21.383862 2025] [:error] [pid 8340:tid 8380] [client 4.241.176.161:2954] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "aT8NuYIT4nh2qy-Ry9pw0gAAAEk"]
[Mon Dec 15 03:19:21.631051 2025] [:error] [pid 56645:tid 56648] [client 4.241.176.161:3005] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "aT8Nua__GSueqKs4nBneaQAAAUA"]
[Mon Dec 15 03:19:21.857910 2025] [:error] [pid 8339:tid 8355] [client 4.241.176.161:2540] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "aT8NublqE6mJc-Y6giNeVwAAAAw"]
[Mon Dec 15 03:19:22.086550 2025] [:error] [pid 9009:tid 9029] [client 4.241.176.161:2979] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rp8zi.php"] [unique_id "aT8NughxwdgwYWQ8h8Ww0AAAARI"]
[Mon Dec 15 03:19:22.314876 2025] [:error] [pid 8430:tid 8451] [client 4.241.176.161:2956] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rp8zi.php"] [unique_id "aT8Nulk7yXaRc6dQclhLCQAAANI"]
[Mon Dec 15 03:19:22.544326 2025] [:error] [pid 9009:tid 9021] [client 4.241.176.161:2931] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rp8zi.php"] [unique_id "aT8NughxwdgwYWQ8h8Ww0QAAAQo"]
[Mon Dec 15 03:19:22.781969 2025] [:error] [pid 8341:tid 8417] [client 4.241.176.161:2884] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rp8zi.php"] [unique_id "aT8NuhOat6dLvzj8EhT0egAAAJM"]
[Mon Dec 15 03:19:23.010396 2025] [:error] [pid 8430:tid 8435] [client 4.241.176.161:2997] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc3.php"] [unique_id "aT8Nu1k7yXaRc6dQclhLDAAAAMI"]
[Mon Dec 15 03:19:23.294515 2025] [:error] [pid 56645:tid 56667] [client 4.241.176.161:2518] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc3.php"] [unique_id "aT8Nu6__GSueqKs4nBneawAAAVM"]
[Mon Dec 15 03:19:23.522062 2025] [:error] [pid 8339:tid 8366] [client 4.241.176.161:2988] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc3.php"] [unique_id "aT8Nu7lqE6mJc-Y6giNeWAAAABc"]
[Mon Dec 15 03:19:23.749253 2025] [:error] [pid 9009:tid 9014] [client 4.241.176.161:2946] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc3.php"] [unique_id "aT8NuwhxwdgwYWQ8h8Ww0wAAAQM"]
[Mon Dec 15 03:19:23.979884 2025] [:error] [pid 56645:tid 56651] [client 4.241.176.161:2908] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aT8Nu6__GSueqKs4nBnebQAAAUM"]
[Mon Dec 15 03:19:24.207659 2025] [:error] [pid 56645:tid 56659] [client 4.241.176.161:2962] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aT8NvK__GSueqKs4nBnecAAAAUs"]
[Mon Dec 15 03:19:24.438517 2025] [:error] [pid 56645:tid 56655] [client 4.241.176.161:2970] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aT8NvK__GSueqKs4nBnecQAAAUc"]
[Mon Dec 15 03:19:24.665716 2025] [:error] [pid 56645:tid 56671] [client 4.241.176.161:2992] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aT8NvK__GSueqKs4nBnecgAAAVc"]
[Mon Dec 15 03:19:24.923981 2025] [:error] [pid 8341:tid 8410] [client 4.241.176.161:2917] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wps.php"] [unique_id "aT8NvBOat6dLvzj8EhT0fAAAAIw"]
[Mon Dec 15 03:19:25.153182 2025] [:error] [pid 9009:tid 9030] [client 4.241.176.161:2504] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wps.php"] [unique_id "aT8NvQhxwdgwYWQ8h8Ww1AAAARM"]
[Mon Dec 15 03:19:25.381603 2025] [:error] [pid 8341:tid 8401] [client 4.241.176.161:2510] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wps.php"] [unique_id "aT8NvROat6dLvzj8EhT0fQAAAIM"]
[Mon Dec 15 03:19:25.609837 2025] [:error] [pid 9009:tid 9034] [client 4.241.176.161:2893] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wps.php"] [unique_id "aT8NvQhxwdgwYWQ8h8Ww1QAAARc"]
[Mon Dec 15 03:19:25.840441 2025] [:error] [pid 8339:tid 8361] [client 4.241.176.161:2497] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qV9GbcJwZgK.php"] [unique_id "aT8NvblqE6mJc-Y6giNeXwAAABI"]
[Mon Dec 15 03:19:26.076654 2025] [:error] [pid 8430:tid 8446] [client 4.241.176.161:2909] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qV9GbcJwZgK.php"] [unique_id "aT8Nvlk7yXaRc6dQclhLDgAAAM0"]
[Mon Dec 15 03:19:26.308660 2025] [:error] [pid 9009:tid 9026] [client 4.241.176.161:2959] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qV9GbcJwZgK.php"] [unique_id "aT8NvghxwdgwYWQ8h8Ww1gAAAQ8"]
[Mon Dec 15 03:19:26.535659 2025] [:error] [pid 8341:tid 8403] [client 4.241.176.161:2533] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qV9GbcJwZgK.php"] [unique_id "aT8NvhOat6dLvzj8EhT0fwAAAIU"]
[Mon Dec 15 03:19:26.763633 2025] [:error] [pid 9009:tid 9012] [client 4.241.176.161:2880] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qsntqiho.php"] [unique_id "aT8NvghxwdgwYWQ8h8Ww1wAAAQE"]
[Mon Dec 15 03:19:26.991062 2025] [:error] [pid 9009:tid 9033] [client 4.241.176.161:2894] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qsntqiho.php"] [unique_id "aT8NvghxwdgwYWQ8h8Ww2AAAARY"]
[Mon Dec 15 03:19:27.218954 2025] [:error] [pid 8339:tid 8362] [client 4.241.176.161:2980] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qsntqiho.php"] [unique_id "aT8Nv7lqE6mJc-Y6giNeYAAAABM"]
[Mon Dec 15 03:19:27.450623 2025] [:error] [pid 9009:tid 9017] [client 4.241.176.161:2975] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qsntqiho.php"] [unique_id "aT8NvwhxwdgwYWQ8h8Ww2QAAAQY"]
[Mon Dec 15 03:19:27.679249 2025] [:error] [pid 8339:tid 8356] [client 4.241.176.161:2995] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qjaqjahu.php"] [unique_id "aT8Nv7lqE6mJc-Y6giNeYQAAAA0"]
[Mon Dec 15 03:19:27.907113 2025] [:error] [pid 9009:tid 9019] [client 4.241.176.161:2981] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qjaqjahu.php"] [unique_id "aT8NvwhxwdgwYWQ8h8Ww2wAAAQg"]
[Mon Dec 15 03:19:28.147065 2025] [:error] [pid 8430:tid 8438] [client 4.241.176.161:2935] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qjaqjahu.php"] [unique_id "aT8NwFk7yXaRc6dQclhLDwAAAMU"]
[Mon Dec 15 03:19:28.373750 2025] [:error] [pid 56645:tid 56658] [client 4.241.176.161:2501] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qjaqjahu.php"] [unique_id "aT8NwK__GSueqKs4nBnedQAAAUo"]
[Mon Dec 15 03:19:28.600696 2025] [:error] [pid 9009:tid 9016] [client 4.241.176.161:2895] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qhLaGswd9DS.php"] [unique_id "aT8NwAhxwdgwYWQ8h8Ww3AAAAQU"]
[Mon Dec 15 03:19:28.826471 2025] [:error] [pid 8340:tid 8374] [client 4.241.176.161:2998] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qhLaGswd9DS.php"] [unique_id "aT8NwIIT4nh2qy-Ry9pw0wAAAEM"]
[Mon Dec 15 03:19:29.053543 2025] [:error] [pid 9009:tid 9022] [client 4.241.176.161:2895] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qhLaGswd9DS.php"] [unique_id "aT8NwQhxwdgwYWQ8h8Ww3wAAAQs"]
[Mon Dec 15 03:19:29.281290 2025] [:error] [pid 9009:tid 9028] [client 4.241.176.161:2960] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qhLaGswd9DS.php"] [unique_id "aT8NwQhxwdgwYWQ8h8Ww4QAAARE"]
[Mon Dec 15 03:19:29.511184 2025] [:error] [pid 9009:tid 9021] [client 4.241.176.161:2314] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pwyjwrfr.php"] [unique_id "aT8NwQhxwdgwYWQ8h8Ww4gAAAQo"]
[Mon Dec 15 03:19:29.739056 2025] [:error] [pid 9009:tid 9035] [client 4.241.176.161:2936] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pwyjwrfr.php"] [unique_id "aT8NwQhxwdgwYWQ8h8Ww4wAAARg"]
[Mon Dec 15 03:19:29.965875 2025] [:error] [pid 9009:tid 9023] [client 4.241.176.161:2922] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pwyjwrfr.php"] [unique_id "aT8NwQhxwdgwYWQ8h8Ww5gAAAQw"]
[Mon Dec 15 03:19:30.193689 2025] [:error] [pid 9009:tid 9034] [client 4.241.176.161:2915] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pwyjwrfr.php"] [unique_id "aT8NwghxwdgwYWQ8h8Ww5wAAARc"]
[Mon Dec 15 03:19:30.432626 2025] [:error] [pid 8341:tid 8415] [client 4.241.176.161:2941] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pNRzcP6wtYy.php"] [unique_id "aT8NwhOat6dLvzj8EhT0ggAAAJE"]
[Mon Dec 15 03:19:30.660891 2025] [:error] [pid 9009:tid 9033] [client 4.241.176.161:2983] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pNRzcP6wtYy.php"] [unique_id "aT8NwghxwdgwYWQ8h8Ww6QAAARY"]
[Mon Dec 15 03:19:30.895317 2025] [:error] [pid 8341:tid 8404] [client 4.241.176.161:2553] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pNRzcP6wtYy.php"] [unique_id "aT8NwhOat6dLvzj8EhT0gwAAAIY"]
[Mon Dec 15 03:19:31.124941 2025] [:error] [pid 56645:tid 56668] [client 4.241.176.161:3006] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pNRzcP6wtYy.php"] [unique_id "aT8Nw6__GSueqKs4nBneeAAAAVQ"]
[Mon Dec 15 03:19:31.380182 2025] [:error] [pid 56645:tid 56663] [client 4.241.176.161:2536] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ox8xhkkw.php"] [unique_id "aT8Nw6__GSueqKs4nBneegAAAU8"]
[Mon Dec 15 03:19:31.612875 2025] [:error] [pid 56645:tid 56651] [client 4.241.176.161:3007] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ox8xhkkw.php"] [unique_id "aT8Nw6__GSueqKs4nBneewAAAUM"]
[Mon Dec 15 03:19:31.843803 2025] [:error] [pid 8339:tid 8349] [client 4.241.176.161:2511] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ox8xhkkw.php"] [unique_id "aT8Nw7lqE6mJc-Y6giNeaAAAAAY"]
[Mon Dec 15 03:19:32.076581 2025] [:error] [pid 9009:tid 9016] [client 4.241.176.161:2499] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ox8xhkkw.php"] [unique_id "aT8NxAhxwdgwYWQ8h8Ww7QAAAQU"]
[Mon Dec 15 03:19:32.315491 2025] [:error] [pid 8430:tid 8439] [client 4.241.176.161:2329] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oc460l3x.php"] [unique_id "aT8NxFk7yXaRc6dQclhLFgAAAMY"]
[Mon Dec 15 03:19:32.562493 2025] [:error] [pid 8340:tid 8375] [client 4.241.176.161:2307] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oc460l3x.php"] [unique_id "aT8NxIIT4nh2qy-Ry9pw1wAAAEQ"]
[Mon Dec 15 03:19:32.792769 2025] [:error] [pid 8430:tid 8444] [client 4.241.176.161:2933] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oc460l3x.php"] [unique_id "aT8NxFk7yXaRc6dQclhLFwAAAMs"]
[Mon Dec 15 03:19:33.054501 2025] [:error] [pid 8430:tid 8448] [client 4.241.176.161:3004] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oc460l3x.php"] [unique_id "aT8NxVk7yXaRc6dQclhLGAAAAM8"]
[Mon Dec 15 03:19:33.285753 2025] [:error] [pid 8341:tid 8418] [client 4.241.176.161:2914] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NWqz649FIe7.php"] [unique_id "aT8NxROat6dLvzj8EhT0igAAAJQ"]
[Mon Dec 15 03:19:33.521706 2025] [:error] [pid 8339:tid 8358] [client 4.241.176.161:2545] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NWqz649FIe7.php"] [unique_id "aT8NxblqE6mJc-Y6giNeagAAAA8"]
[Mon Dec 15 03:19:33.752634 2025] [:error] [pid 8340:tid 8388] [client 4.241.176.161:2927] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NWqz649FIe7.php"] [unique_id "aT8NxYIT4nh2qy-Ry9pw2AAAAFE"]
[Mon Dec 15 03:19:33.979663 2025] [:error] [pid 8339:tid 8364] [client 4.241.176.161:2929] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NWqz649FIe7.php"] [unique_id "aT8NxblqE6mJc-Y6giNebAAAABU"]
[Mon Dec 15 03:19:34.211080 2025] [:error] [pid 8341:tid 8402] [client 4.241.176.161:2512] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nucqsqeg.php"] [unique_id "aT8NxhOat6dLvzj8EhT0iwAAAIQ"]
[Mon Dec 15 03:19:34.442221 2025] [:error] [pid 8340:tid 8394] [client 4.241.176.161:2498] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nucqsqeg.php"] [unique_id "aT8NxoIT4nh2qy-Ry9pw2gAAAFc"]
[Mon Dec 15 03:19:34.681537 2025] [:error] [pid 8340:tid 8379] [client 4.241.176.161:2503] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nucqsqeg.php"] [unique_id "aT8NxoIT4nh2qy-Ry9pw2wAAAEg"]
[Mon Dec 15 03:19:34.913401 2025] [:error] [pid 8430:tid 8434] [client 4.241.176.161:2505] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nucqsqeg.php"] [unique_id "aT8Nxlk7yXaRc6dQclhLGwAAAME"]
[Mon Dec 15 03:19:35.142198 2025] [:error] [pid 56645:tid 56672] [client 4.241.176.161:2928] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mhpglaje.php"] [unique_id "aT8Nx6__GSueqKs4nBnefQAAAVg"]
[Mon Dec 15 03:19:35.372069 2025] [:error] [pid 8341:tid 8407] [client 4.241.176.161:2506] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mhpglaje.php"] [unique_id "aT8NxxOat6dLvzj8EhT0jAAAAIk"]
[Mon Dec 15 03:19:35.601058 2025] [:error] [pid 8340:tid 8373] [client 4.241.176.161:2539] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mhpglaje.php"] [unique_id "aT8Nx4IT4nh2qy-Ry9pw3AAAAEI"]
[Mon Dec 15 03:19:35.835672 2025] [:error] [pid 8340:tid 8384] [client 4.241.176.161:2942] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mhpglaje.php"] [unique_id "aT8Nx4IT4nh2qy-Ry9pw3QAAAE0"]
[Mon Dec 15 03:19:36.064409 2025] [:error] [pid 8430:tid 8443] [client 4.241.176.161:2559] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/LvCBeZWaSgQ.php"] [unique_id "aT8NyFk7yXaRc6dQclhLHQAAAMo"]
[Mon Dec 15 03:19:36.293968 2025] [:error] [pid 56645:tid 56666] [client 4.241.176.161:2532] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/LvCBeZWaSgQ.php"] [unique_id "aT8NyK__GSueqKs4nBnefgAAAVI"]
[Mon Dec 15 03:19:36.523672 2025] [:error] [pid 56645:tid 56655] [client 4.241.176.161:3000] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/LvCBeZWaSgQ.php"] [unique_id "aT8NyK__GSueqKs4nBnefwAAAUc"]
[Mon Dec 15 03:19:36.755910 2025] [:error] [pid 8339:tid 8363] [client 4.241.176.161:2535] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/LvCBeZWaSgQ.php"] [unique_id "aT8NyLlqE6mJc-Y6giNebwAAABQ"]
[Mon Dec 15 03:19:36.985606 2025] [:error] [pid 9009:tid 9035] [client 4.241.176.161:2346] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/KV7EGJmhHzX.php"] [unique_id "aT8NyAhxwdgwYWQ8h8Ww9QAAARg"]
[Mon Dec 15 03:19:37.214320 2025] [:error] [pid 8430:tid 8445] [client 4.241.176.161:2976] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/KV7EGJmhHzX.php"] [unique_id "aT8NyVk7yXaRc6dQclhLHwAAAMw"]
[Mon Dec 15 03:19:37.441564 2025] [:error] [pid 8339:tid 8345] [client 4.241.176.161:2521] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/KV7EGJmhHzX.php"] [unique_id "aT8NyblqE6mJc-Y6giNecQAAAAI"]
[Mon Dec 15 03:19:37.670844 2025] [:error] [pid 8340:tid 8378] [client 4.241.176.161:3002] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/KV7EGJmhHzX.php"] [unique_id "aT8NyYIT4nh2qy-Ry9pw4QAAAEc"]
[Mon Dec 15 03:19:37.896604 2025] [:error] [pid 8340:tid 8380] [client 4.241.176.161:2310] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ijNdPI1Orya.php"] [unique_id "aT8NyYIT4nh2qy-Ry9pw4gAAAEk"]
[Mon Dec 15 03:19:38.121320 2025] [:error] [pid 8341:tid 8400] [client 4.241.176.161:2528] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ijNdPI1Orya.php"] [unique_id "aT8NyhOat6dLvzj8EhT0kAAAAII"]
[Mon Dec 15 03:19:38.354743 2025] [:error] [pid 9009:tid 9023] [client 4.241.176.161:2905] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ijNdPI1Orya.php"] [unique_id "aT8NyghxwdgwYWQ8h8Ww9gAAAQw"]
[Mon Dec 15 03:19:38.580618 2025] [:error] [pid 9009:tid 9024] [client 4.241.176.161:2325] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ijNdPI1Orya.php"] [unique_id "aT8NyghxwdgwYWQ8h8Ww-AAAAQ0"]
[Mon Dec 15 03:19:38.812293 2025] [:error] [pid 8430:tid 8454] [client 4.241.176.161:2541] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/HPum4ZEBJRC.php"] [unique_id "aT8Nylk7yXaRc6dQclhLJQAAANU"]
[Mon Dec 15 03:19:39.038444 2025] [:error] [pid 8430:tid 8439] [client 4.241.176.161:2525] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/HPum4ZEBJRC.php"] [unique_id "aT8Ny1k7yXaRc6dQclhLJwAAAMY"]
[Mon Dec 15 03:19:39.271386 2025] [:error] [pid 56645:tid 56670] [client 4.241.176.161:2982] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/HPum4ZEBJRC.php"] [unique_id "aT8Ny6__GSueqKs4nBnehgAAAVY"]
[Mon Dec 15 03:19:39.504241 2025] [:error] [pid 56645:tid 56657] [client 4.241.176.161:2987] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/HPum4ZEBJRC.php"] [unique_id "aT8Ny6__GSueqKs4nBneiAAAAUk"]
[Mon Dec 15 03:19:39.731374 2025] [:error] [pid 56645:tid 56663] [client 4.241.176.161:2515] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aT8Ny6__GSueqKs4nBneigAAAU8"]
[Mon Dec 15 03:19:39.959149 2025] [:error] [pid 8430:tid 8453] [client 4.241.176.161:2516] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aT8Ny1k7yXaRc6dQclhLLAAAANQ"]
[Mon Dec 15 03:19:40.185877 2025] [:error] [pid 8430:tid 8437] [client 4.241.176.161:2508] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aT8NzFk7yXaRc6dQclhLLgAAAMQ"]
[Mon Dec 15 03:19:55.220593 2025] [:error] [pid 14810:tid 14817] [client 4.241.176.161:2957] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BMjXQkgwpeb.php"] [unique_id "aT8N2zDFQKs2CmZaA9HuZAAAAAI"]
[Mon Dec 15 03:19:55.467616 2025] [:error] [pid 14810:tid 14825] [client 4.241.176.161:2555] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BMjXQkgwpeb.php"] [unique_id "aT8N2zDFQKs2CmZaA9HuawAAAAo"]
[Mon Dec 15 03:19:55.699422 2025] [:error] [pid 14812:tid 14869] [client 4.241.176.161:2531] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BMjXQkgwpeb.php"] [unique_id "aT8N28VoL5GaAtVDXtqIAgAAAIA"]
[Mon Dec 15 03:19:55.929581 2025] [:error] [pid 14810:tid 14830] [client 4.241.176.161:2323] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BMjXQkgwpeb.php"] [unique_id "aT8N2zDFQKs2CmZaA9HucgAAAA8"]
[Mon Dec 15 03:19:56.156480 2025] [:error] [pid 14810:tid 14835] [client 4.241.176.161:2852] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/FSCMNvnjPX4.php"] [unique_id "aT8N3DDFQKs2CmZaA9HueAAAABQ"]
[Mon Dec 15 03:19:56.385975 2025] [:error] [pid 14811:tid 14842] [client 4.241.176.161:2344] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/FSCMNvnjPX4.php"] [unique_id "aT8N3Hf37IXtfLNjhQ30qwAAAEA"]
[Mon Dec 15 03:19:56.614201 2025] [:error] [pid 14812:tid 14872] [client 4.241.176.161:2973] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/FSCMNvnjPX4.php"] [unique_id "aT8N3MVoL5GaAtVDXtqIBAAAAIM"]
[Mon Dec 15 03:19:56.844217 2025] [:error] [pid 14810:tid 14818] [client 4.241.176.161:2977] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/FSCMNvnjPX4.php"] [unique_id "aT8N3DDFQKs2CmZaA9HufwAAAAM"]
[Mon Dec 15 03:19:57.076272 2025] [:error] [pid 14810:tid 14823] [client 4.241.176.161:2937] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aT8N3TDFQKs2CmZaA9HuggAAAAg"]
[Mon Dec 15 03:19:57.327648 2025] [:error] [pid 14810:tid 14828] [client 4.241.176.161:2538] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aT8N3TDFQKs2CmZaA9HuhgAAAA0"]
[Mon Dec 15 03:19:57.567434 2025] [:error] [pid 14811:tid 14843] [client 4.241.176.161:2986] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aT8N3Xf37IXtfLNjhQ30rAAAAEE"]
[Mon Dec 15 03:19:57.799955 2025] [:error] [pid 14811:tid 14844] [client 4.241.176.161:2831] [client 4.241.176.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aT8N3Xf37IXtfLNjhQ30rQAAAEI"]
[Mon Dec 15 03:34:02.316123 2025] [:error] [pid 52529:tid 52586] [client 146.70.180.20:65071] [client 146.70.180.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.70.180.20, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT8RKj92TzD0l6yCdTDICAAAAFc"]
[Mon Dec 15 04:33:05.589737 2025] [:error] [pid 35021:tid 35099] [client 208.76.221.149:61112] [client 208.76.221.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.76.221.149, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT8fAS9sSwxVqtYnS1t52AAAAJY"]
[Mon Dec 15 05:01:29.426070 2025] [:error] [pid 9882:tid 9896] [client 190.92.174.30:40346] [client 190.92.174.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.92.174.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT8lqXNmFf4TNOnZQ06-zAAAAQw"]
[Mon Dec 15 05:01:32.030175 2025] [:error] [pid 35020:tid 35071] [client 190.92.174.30:43720] [client 190.92.174.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.92.174.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT8lrCBMuWbtFfQIRIbcrgAAAFU"], referer: https://expressinteriors.com/wp-login.php
[Mon Dec 15 05:30:54.112287 2025] [:error] [pid 35019:tid 35030] [client 65.20.110.113:56792] [client 65.20.110.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.20.110.113, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT8sjq2LAdKSfjdLIKKLQAAAAAc"]
[Mon Dec 15 05:33:46.802283 2025] [autoindex:error] [pid 35019:tid 35047] [client 74.225.204.92:29902] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Mon Dec 15 05:33:50.316060 2025] [autoindex:error] [pid 35019:tid 35026] [client 74.225.204.92:29902] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Mon Dec 15 05:33:57.969814 2025] [autoindex:error] [pid 35019:tid 35030] [client 74.225.204.92:29902] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Mon Dec 15 05:33:58.255296 2025] [autoindex:error] [pid 35019:tid 35034] [client 74.225.204.92:29902] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Mon Dec 15 05:34:11.007730 2025] [:error] [pid 35019:tid 35044] [client 74.225.204.92:29902] [client 74.225.204.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aT8tU62LAdKSfjdLIKKM8QAAABU"], referer: https://www.google.co.uk/
[Mon Dec 15 05:34:11.432000 2025] [autoindex:error] [pid 35019:tid 35041] [client 74.225.204.92:33317] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Mon Dec 15 05:34:11.568498 2025] [:error] [pid 35019:tid 35037] [client 74.225.204.92:33317] [client 74.225.204.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/index.php"] [unique_id "aT8tU62LAdKSfjdLIKKM9QAAAA4"], referer: https://www.bing.com/
[Mon Dec 15 05:34:11.991007 2025] [autoindex:error] [pid 35020:tid 35073] [client 74.225.204.92:32353] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Mon Dec 15 05:34:22.365110 2025] [:error] [pid 9882:tid 9893] [client 74.225.204.92:34583] [client 74.225.204.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.225.204.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT8tXnNmFf4TNOnZQ07MVAAAAQk"], referer: https://www.google.de/
[Mon Dec 15 05:34:24.138316 2025] [autoindex:error] [pid 35020:tid 35065] [client 74.225.204.92:32353] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Mon Dec 15 05:34:27.652196 2025] [autoindex:error] [pid 35020:tid 35069] [client 74.225.204.92:32353] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Mon Dec 15 05:34:28.753884 2025] [autoindex:error] [pid 35020:tid 35073] [client 74.225.204.92:32353] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Mon Dec 15 05:34:33.249833 2025] [autoindex:error] [pid 35020:tid 35067] [client 74.225.204.92:32353] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Mon Dec 15 05:34:33.538107 2025] [autoindex:error] [pid 35020:tid 35069] [client 74.225.204.92:32353] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Mon Dec 15 05:34:33.829955 2025] [autoindex:error] [pid 35020:tid 35053] [client 74.225.204.92:32353] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Mon Dec 15 05:34:33.966900 2025] [:error] [pid 35020:tid 35051] [client 74.225.204.92:32353] [client 74.225.204.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aT8taSBMuWbtFfQIRIbr-wAAAEE"], referer: https://www.google.fr/
[Mon Dec 15 05:34:34.242169 2025] [:error] [pid 35021:tid 35082] [client 74.225.204.92:21246] [client 74.225.204.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aT8tai9sSwxVqtYnS1uQHwAAAIU"], referer: https://www.google.de/
[Mon Dec 15 05:34:34.668959 2025] [autoindex:error] [pid 35020:tid 35071] [client 74.225.204.92:20775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Mon Dec 15 05:34:34.956093 2025] [autoindex:error] [pid 35020:tid 35058] [client 74.225.204.92:20775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Mon Dec 15 05:34:35.127752 2025] [:error] [pid 35020:tid 35060] [client 74.225.204.92:20775] [client 74.225.204.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/index.php"] [unique_id "aT8tayBMuWbtFfQIRIbsAwAAAEo"], referer: https://duckduckgo.com/
[Mon Dec 15 05:34:35.551997 2025] [autoindex:error] [pid 35020:tid 35069] [client 74.225.204.92:21187] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Mon Dec 15 05:34:35.836415 2025] [autoindex:error] [pid 35020:tid 35057] [client 74.225.204.92:21187] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Mon Dec 15 05:34:35.973412 2025] [:error] [pid 35020:tid 35073] [client 74.225.204.92:21187] [client 74.225.204.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aT8tayBMuWbtFfQIRIbsCAAAAFc"], referer: https://www.google.fr/
[Mon Dec 15 05:34:36.247815 2025] [:error] [pid 35019:tid 35047] [client 74.225.204.92:28291] [client 74.225.204.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/index.php"] [unique_id "aT8tbK2LAdKSfjdLIKKNCgAAABg"], referer: https://www.google.co.uk/
[Mon Dec 15 05:34:36.523225 2025] [:error] [pid 35019:tid 35033] [client 74.225.204.92:30740] [client 74.225.204.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aT8tbK2LAdKSfjdLIKKNCwAAAAo"], referer: https://www.google.fr/
[Mon Dec 15 05:34:36.797317 2025] [:error] [pid 9882:tid 9905] [client 74.225.204.92:34563] [client 74.225.204.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/development/index.php"] [unique_id "aT8tbHNmFf4TNOnZQ07MYAAAARU"], referer: https://duckduckgo.com/
[Mon Dec 15 05:34:37.072449 2025] [:error] [pid 35104:tid 35123] [client 74.225.204.92:19779] [client 74.225.204.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aT8tbaWpPfWnBdEuPp4-FwAAANA"], referer: https://www.google.co.uk/
[Mon Dec 15 05:34:39.009605 2025] [autoindex:error] [pid 9882:tid 9889] [client 74.225.204.92:57895] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Mon Dec 15 05:34:39.148314 2025] [:error] [pid 9882:tid 9890] [client 74.225.204.92:57895] [client 74.225.204.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aT8tb3NmFf4TNOnZQ07MZgAAAQY"], referer: https://www.google.com/
[Mon Dec 15 05:34:39.573194 2025] [autoindex:error] [pid 9882:tid 9887] [client 74.225.204.92:28294] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Mon Dec 15 05:54:54.336018 2025] [:error] [pid 35104:tid 35129] [client 81.88.49.24:53620] [client 81.88.49.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.88.49.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT8yLqWpPfWnBdEuPp5EoAAAANY"]
[Mon Dec 15 05:54:55.408650 2025] [:error] [pid 35104:tid 35114] [client 81.88.49.24:53620] [client 81.88.49.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.88.49.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT8yL6WpPfWnBdEuPp5EoQAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Mon Dec 15 06:08:52.998925 2025] [:error] [pid 35020:tid 35053] [client 94.183.184.90:41660] [client 94.183.184.90] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:[\\\\x22'`](?:;? ?\\\\b(?:having|select|union)\\\\b ?[^\\\\s]| ?! ?[\\\\x22'`\\\\w])|\\\\b(?:c(?:onnection_id|urrent_user)|database)\\\\b ?\\\\(|\\\\bunion\\\\b[\\\\w(\\\\s]*?select\\\\b|\\\\buser ?\\\\(|\\\\bschema ?\\\\(|\\\\bselect.{0,399}?\\\\w?\\\\buser ?\\\\(|\\\\binto[\\\\s+]+(?:dump|o ..." at MATCHED_VAR. [file "/usr/local/apache/modsecurity-cwaf/rules/22_SQL_SQLi.conf"] [line "27"] [id "211650"] [rev "12"] [msg "COMODO WAF: Detects MSSQL code execution and information gathering attempts||expressinteriors.com|F|2"] [data "Matched Data: 1' UNION SELECT null,null,null found within MATCHED_VAR: 1' UNION SELECT null,null,null"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aT81dCBMuWbtFfQIRIb7PgAAAEM"]
[Mon Dec 15 06:09:03.703513 2025] [:error] [pid 35019:tid 35045] [client 94.183.184.90:59126] [client 94.183.184.90] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||expressinteriors.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /?file=../../../../etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aT81f62LAdKSfjdLIKKexQAAABY"]
[Mon Dec 15 06:09:07.314592 2025] [:error] [pid 35020:tid 35071] [client 94.183.184.90:59128] [client 94.183.184.90] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||expressinteriors.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /?file=....//....//....//etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aT81gyBMuWbtFfQIRIb7TAAAAFU"]
[Mon Dec 15 06:09:10.357371 2025] [:error] [pid 9882:tid 9893] [client 94.183.184.90:47272] [client 94.183.184.90] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||expressinteriors.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /?file=/etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aT81hnNmFf4TNOnZQ07YFAAAAQk"]
[Mon Dec 15 06:29:47.702575 2025] [:error] [pid 35104:tid 35123] [client 185.230.124.243:54556] [client 185.230.124.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.230.124.243, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT86W6WpPfWnBdEuPp5SegAAANA"]
[Mon Dec 15 07:34:22.859507 2025] [:error] [pid 35021:tid 35101] [client 98.98.171.86:52857] [client 98.98.171.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.98.171.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT9Jfi9sSwxVqtYnS1u6mwAAAJg"]
[Mon Dec 15 09:14:08.209245 2025] [:error] [pid 35021:tid 35077] [client 38.154.90.11:43144] [client 38.154.90.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aT9g4C9sSwxVqtYnS1vblwAAAIA"]
[Mon Dec 15 09:14:08.229156 2025] [:error] [pid 63653:tid 63671] [client 38.154.90.11:45087] [client 38.154.90.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/robots.txt"] [unique_id "aT9g4MvHkJ_6ffg4W-_gVgAAAVA"]
[Mon Dec 15 09:14:08.229156 2025] [:error] [pid 35019:tid 35038] [client 38.154.90.11:45524] [client 38.154.90.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/sitemap.xml"] [unique_id "aT9g4K2LAdKSfjdLIKL_nwAAAA8"]
[Mon Dec 15 09:14:09.657741 2025] [:error] [pid 35019:tid 35047] [client 38.154.90.11:51334] [client 38.154.90.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/sitemap.xml"] [unique_id "aT9g4a2LAdKSfjdLIKL_oAAAABg"]
[Mon Dec 15 09:14:09.662438 2025] [:error] [pid 63653:tid 63667] [client 38.154.90.11:52463] [client 38.154.90.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/robots.txt"] [unique_id "aT9g4cvHkJ_6ffg4W-_gWQAAAUw"]
[Mon Dec 15 12:04:55.899775 2025] [:error] [pid 39828:tid 39882] [client 167.71.250.126:60926] [client 167.71.250.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.250.126, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT-I5-0Kj9XWFkRmVbTiLAAAANg"]
[Mon Dec 15 12:04:57.573358 2025] [:error] [pid 39914:tid 39928] [client 167.71.250.126:61051] [client 167.71.250.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.250.126, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aT-I6V247O4ulGRu1dMwaAAAAAs"]
[Mon Dec 15 12:28:36.713951 2025] [:error] [pid 44555:tid 44561] [client 182.42.105.144:59324] [client 182.42.105.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aT-OdGDHW0g-e9AKPr7OdwAAAEQ"]
[Mon Dec 15 15:40:53.469740 2025] [:error] [pid 44555:tid 44557] [client 103.97.126.116:40182] [client 103.97.126.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.97.126.116, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT-7hWDHW0g-e9AKPr4jNAAAAEA"]
[Mon Dec 15 16:29:30.967775 2025] [:error] [pid 39828:tid 39882] [client 74.7.243.196:36100] [client 74.7.243.196] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "aT_G6u0Kj9XWFkRmVbQvawAAANg"]
[Mon Dec 15 16:29:35.460864 2025] [:error] [pid 39828:tid 39875] [client 74.7.243.196:36100] [client 74.7.243.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.7.243.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT_G7-0Kj9XWFkRmVbQvdAAAANE"]
[Mon Dec 15 18:23:35.937302 2025] [:error] [pid 31459:tid 31475] [client 146.190.140.214:59416] [client 146.190.140.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.140.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aT_hpzqerS0TDpViRzsjgwAAAA4"]
[Mon Dec 15 18:35:40.812088 2025] [:error] [pid 31374:tid 31451] [client 182.44.10.67:34386] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aT_kfJzSh8b7uk6RWiEtmQAAAFM"]
[Mon Dec 15 20:37:43.426028 2025] [:error] [pid 31374:tid 31437] [client 198.211.125.40:57340] [client 198.211.125.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.211.125.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUABF5zSh8b7uk6RWiFgQQAAAEU"]
[Mon Dec 15 20:40:34.670798 2025] [:error] [pid 52155:tid 52170] [client 18.169.91.125:51920] [client 18.169.91.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.169.91.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUABwhaJK6javjid3xy0-gAAAQw"]
[Tue Dec 16 01:02:16.129868 2025] [:error] [pid 31566:tid 31588] [client 106.222.209.117:19082] [client 106.222.209.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.209.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUA_GPp1NDLK4uehYB9Y-QAAAJI"]
[Tue Dec 16 01:02:18.127672 2025] [:error] [pid 34411:tid 34475] [client 106.222.209.117:16869] [client 106.222.209.117] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aUA_Gh05Egz6aV0buEyyNgAAAAc"]
[Tue Dec 16 01:02:57.638529 2025] [:error] [pid 34410:tid 34458] [client 106.222.209.117:26041] [client 106.222.209.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.209.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUA_QcWDXTJsXAHPFUmgjwAAAFE"]
[Tue Dec 16 01:05:03.097021 2025] [:error] [pid 34410:tid 34453] [client 125.75.66.97:43424] [client 125.75.66.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUA_v8WDXTJsXAHPFUmhFwAAAEw"]
[Tue Dec 16 01:17:32.617315 2025] [:error] [pid 34410:tid 34456] [client 106.222.209.117:20993] [client 106.222.209.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.209.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUBCrMWDXTJsXAHPFUmlqgAAAE8"]
[Tue Dec 16 01:24:22.195139 2025] [:error] [pid 34411:tid 34481] [client 106.222.209.117:17636] [client 106.222.209.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.209.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUBERh05Egz6aV0buEy7PQAAAA0"]
[Tue Dec 16 01:35:33.023879 2025] [:error] [pid 34495:tid 34514] [client 106.222.209.117:16820] [client 106.222.209.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.209.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUBG5WZCUf_mSR4srxuD1AAAAVE"]
[Tue Dec 16 01:52:47.928730 2025] [:error] [pid 34411:tid 34487] [client 209.141.48.80:27109] [client 209.141.48.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.48.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUBK7x05Egz6aV0buEzGsAAAABM"]
[Tue Dec 16 01:54:58.937974 2025] [:error] [pid 34495:tid 34513] [client 209.141.48.80:43123] [client 209.141.48.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.48.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUBLcmZCUf_mSR4srxuL3QAAAVA"]
[Tue Dec 16 02:04:02.107237 2025] [:error] [pid 34411:tid 34487] [client 208.112.26.138:55544] [client 208.112.26.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.112.26.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUBNkh05Egz6aV0buEzMQAAAABM"]
[Tue Dec 16 04:00:18.373415 2025] [:error] [pid 61482:tid 61490] [client 162.241.252.188:31722] [client 162.241.252.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.252.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUBo0mrDRwTEq_4DgVmO-QAAAMY"]
[Tue Dec 16 04:00:24.274933 2025] [:error] [pid 61482:tid 61507] [client 162.241.252.188:31722] [client 162.241.252.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.252.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUBo2GrDRwTEq_4DgVmPBgAAANc"], referer: https://expressinteriors.com/wp-login.php
[Tue Dec 16 06:58:43.438731 2025] [:error] [pid 18323:tid 18355] [client 36.111.67.189:46108] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aUCSozJB6UFxIutsA8ZYRAAAAEI"]
[Tue Dec 16 09:52:43.435126 2025] [:error] [pid 18324:tid 18388] [client 74.7.242.20:47360] [client 74.7.242.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.7.242.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUC7a6G4um2mD1VpJHL0SgAAAIg"]
[Tue Dec 16 09:58:16.019075 2025] [:error] [pid 35998:tid 36002] [client 13.74.149.244:12558] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pu.php"] [unique_id "aUC8uBKnhGuuhGxBSLMpEQAAAUE"]
[Tue Dec 16 09:58:16.553281 2025] [:error] [pid 18324:tid 18401] [client 13.74.149.244:8590] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pu.php"] [unique_id "aUC8uKG4um2mD1VpJHL1mgAAAJU"]
[Tue Dec 16 09:58:17.087812 2025] [:error] [pid 12330:tid 12358] [client 13.74.149.244:11572] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pu.php"] [unique_id "aUC8uV6iIQEVCIh8V1m-zAAAAZg"]
[Tue Dec 16 09:58:17.622418 2025] [:error] [pid 35998:tid 36009] [client 13.74.149.244:12605] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aUC8uRKnhGuuhGxBSLMpEwAAAUg"]
[Tue Dec 16 09:58:18.155564 2025] [:error] [pid 18408:tid 18417] [client 13.74.149.244:3228] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aUC8uji2Gr8pDzjrVBBcFAAAAMc"]
[Tue Dec 16 09:58:18.689670 2025] [:error] [pid 35998:tid 36017] [client 13.74.149.244:5275] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aUC8uhKnhGuuhGxBSLMpFQAAAVA"]
[Tue Dec 16 09:58:19.224175 2025] [:error] [pid 18408:tid 18421] [client 13.74.149.244:16801] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aUC8uzi2Gr8pDzjrVBBcFgAAAMs"]
[Tue Dec 16 09:58:19.758083 2025] [:error] [pid 51991:tid 52000] [client 13.74.149.244:5298] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sfcl.php"] [unique_id "aUC8u67zKCVJSuwV1xa_yAAAAQc"]
[Tue Dec 16 09:58:20.293635 2025] [:error] [pid 35998:tid 36019] [client 13.74.149.244:9925] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sfcl.php"] [unique_id "aUC8vBKnhGuuhGxBSLMpFgAAAVI"]
[Tue Dec 16 09:58:20.829017 2025] [:error] [pid 18322:tid 18349] [client 13.74.149.244:6176] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sfcl.php"] [unique_id "aUC8vJsCeWBjrw28XtxliQAAABc"]
[Tue Dec 16 09:58:21.364533 2025] [:error] [pid 12330:tid 12350] [client 13.74.149.244:1457] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sfcl.php"] [unique_id "aUC8vV6iIQEVCIh8V1m-0wAAAZA"]
[Tue Dec 16 12:10:14.932396 2025] [:error] [pid 53940:tid 53967] [client 49.51.47.100:58476] [client 49.51.47.100] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aUDbpl91PNbcXLVkpR6AhQAAAdg"]
[Tue Dec 16 13:43:24.223323 2025] [:error] [pid 35998:tid 36011] [client 167.71.81.114:36648] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2/api-docs"] [unique_id "aUDxfBKnhGuuhGxBSLNj4AAAAUo"]
[Tue Dec 16 13:43:25.228357 2025] [:error] [pid 51991:tid 51994] [client 167.71.81.114:36658] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3/api-docs"] [unique_id "aUDxfa7zKCVJSuwV1xYXQwAAAQE"]
[Tue Dec 16 13:43:26.227849 2025] [:error] [pid 51991:tid 51996] [client 167.71.81.114:36664] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api-docs/swagger.json"] [unique_id "aUDxfq7zKCVJSuwV1xYXRQAAAQM"]
[Tue Dec 16 13:43:27.229031 2025] [:error] [pid 12330:tid 12345] [client 167.71.81.114:36676] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api/swagger.json"] [unique_id "aUDxf16iIQEVCIh8V1kZ8QAAAYs"]
[Tue Dec 16 13:43:28.228195 2025] [:error] [pid 18323:tid 18360] [client 167.71.81.114:36684] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/@vite/env"] [unique_id "aUDxgDJB6UFxIutsA8bYQwAAAEc"]
[Tue Dec 16 13:43:29.220142 2025] [:error] [pid 18322:tid 18328] [client 167.71.81.114:55476] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/actuator/env"] [unique_id "aUDxgZsCeWBjrw28XtywiwAAAAI"]
[Tue Dec 16 13:43:30.229028 2025] [:error] [pid 53940:tid 53949] [client 167.71.81.114:55488] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aUDxgl91PNbcXLVkpR6ZAAAAAcY"]
[Tue Dec 16 13:43:31.229405 2025] [:error] [pid 18322:tid 18346] [client 167.71.81.114:55490] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server"] [unique_id "aUDxg5sCeWBjrw28XtywkQAAABQ"]
[Tue Dec 16 13:43:32.231047 2025] [:error] [pid 18322:tid 18348] [client 167.71.81.114:55502] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aUDxhJsCeWBjrw28XtywlQAAABY"]
[Tue Dec 16 13:43:34.220827 2025] [:error] [pid 18324:tid 18382] [client 167.71.81.114:55506] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about"] [unique_id "aUDxhqG4um2mD1VpJHI5PgAAAII"]
[Tue Dec 16 13:43:35.221962 2025] [:error] [pid 51991:tid 52015] [client 167.71.81.114:55508] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/debug/default/view"] [unique_id "aUDxh67zKCVJSuwV1xYXSgAAARY"]
[Tue Dec 16 13:43:36.231402 2025] [:error] [pid 35998:tid 36014] [client 167.71.81.114:55512] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2/_catalog"] [unique_id "aUDxiBKnhGuuhGxBSLNj5QAAAU0"]
[Tue Dec 16 13:43:37.233340 2025] [:error] [pid 18324:tid 18380] [client 167.71.81.114:55516] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aUDxiaG4um2mD1VpJHI5QwAAAIA"]
[Tue Dec 16 13:43:38.234212 2025] [:error] [pid 18324:tid 18396] [client 167.71.81.114:55524] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server-status"] [unique_id "aUDxiqG4um2mD1VpJHI5RgAAAJA"]
[Tue Dec 16 13:43:39.225931 2025] [:error] [pid 12330:tid 12354] [client 167.71.81.114:53536] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login.action"] [unique_id "aUDxi16iIQEVCIh8V1kZ-gAAAZQ"]
[Tue Dec 16 13:43:40.236626 2025] [:error] [pid 51991:tid 52005] [client 167.71.81.114:53540] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/_all_dbs"] [unique_id "aUDxjK7zKCVJSuwV1xYXTgAAAQw"]
[Tue Dec 16 13:43:41.251008 2025] [:error] [pid 51991:tid 51999] [client 167.71.81.114:53546] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.DS_Store"] [unique_id "aUDxja7zKCVJSuwV1xYXTwAAAQY"]
[Tue Dec 16 13:43:42.236146 2025] [:error] [pid 12330:tid 12350] [client 167.71.81.114:53554] [client 167.71.81.114] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aUDxjl6iIQEVCIh8V1kaAgAAAZA"]
[Tue Dec 16 13:43:44.230198 2025] [:error] [pid 51991:tid 51993] [client 167.71.81.114:53558] [client 167.71.81.114] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aUDxkK7zKCVJSuwV1xYXUwAAAQA"]
[Tue Dec 16 13:43:45.240969 2025] [:error] [pid 12330:tid 12353] [client 167.71.81.114:53566] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aUDxkV6iIQEVCIh8V1kaBQAAAZM"]
[Tue Dec 16 13:43:46.233524 2025] [:error] [pid 12330:tid 12352] [client 167.71.81.114:53578] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aUDxkl6iIQEVCIh8V1kaBgAAAZI"]
[Tue Dec 16 13:43:47.241381 2025] [:error] [pid 12330:tid 12356] [client 167.71.81.114:53590] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/telescope/requests"] [unique_id "aUDxk16iIQEVCIh8V1kaCAAAAZY"]
[Tue Dec 16 13:43:48.243737 2025] [:error] [pid 51991:tid 52006] [client 167.71.81.114:53604] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aUDxlK7zKCVJSuwV1xYXWgAAAQ0"]
[Tue Dec 16 13:43:49.243345 2025] [:error] [pid 12330:tid 12336] [client 167.71.81.114:43196] [client 167.71.81.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUDxlV6iIQEVCIh8V1kaCgAAAYI"]
[Tue Dec 16 14:59:46.827447 2025] [:error] [pid 53940:tid 53951] [client 167.172.232.142:54750] [client 167.172.232.142] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aUEDYl91PNbcXLVkpR6tlwAAAcg"]
[Tue Dec 16 14:59:56.041734 2025] [authz_core:error] [pid 18322:tid 18332] [client 167.172.232.142:37844] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Tue Dec 16 15:00:00.355685 2025] [:error] [pid 18408:tid 18420] [client 167.172.232.142:57758] [client 167.172.232.142] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aUEDcDi2Gr8pDzjrVBDBhQAAAMo"]
[Tue Dec 16 15:00:02.362347 2025] [:error] [pid 53940:tid 53950] [client 167.172.232.142:57766] [client 167.172.232.142] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aUEDcl91PNbcXLVkpR6tpQAAAcc"]
[Tue Dec 16 15:30:34.571466 2025] [:error] [pid 18323:tid 18358] [client 69.50.95.141:46188] [client 69.50.95.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.50.95.141, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUEKmjJB6UFxIutsA8b3VQAAAEU"]
[Tue Dec 16 15:30:40.106469 2025] [:error] [pid 18323:tid 18355] [client 69.50.95.141:46188] [client 69.50.95.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.50.95.141, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUEKoDJB6UFxIutsA8b3cwAAAEI"], referer: https://expressinteriors.com/wp-login.php
[Tue Dec 16 15:33:00.235357 2025] [:error] [pid 35998:tid 36017] [client 188.166.177.77:63509] [client 188.166.177.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.177.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUELLBKnhGuuhGxBSLN-7wAAAVA"]
[Tue Dec 16 15:33:03.027793 2025] [:error] [pid 35998:tid 36024] [client 188.166.177.77:63509] [client 188.166.177.77] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aUELLxKnhGuuhGxBSLN-8wAAAVc"]
[Tue Dec 16 15:33:03.200217 2025] [:error] [pid 35998:tid 36010] [client 188.166.177.77:63509] [client 188.166.177.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.177.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUELLxKnhGuuhGxBSLN-9AAAAUk"]
[Tue Dec 16 15:33:04.684096 2025] [:error] [pid 18324:tid 18401] [client 188.166.177.77:58776] [client 188.166.177.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.177.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUELMKG4um2mD1VpJHJbGAAAAJU"]
[Tue Dec 16 15:33:05.983196 2025] [:error] [pid 51991:tid 52002] [client 188.166.177.77:61512] [client 188.166.177.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.177.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUELMa7zKCVJSuwV1xZLGQAAAQk"]
[Tue Dec 16 15:33:07.286754 2025] [:error] [pid 18324:tid 18383] [client 188.166.177.77:58231] [client 188.166.177.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.177.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUELM6G4um2mD1VpJHJbHgAAAIM"]
[Tue Dec 16 15:33:08.603542 2025] [:error] [pid 18323:tid 18376] [client 188.166.177.77:50954] [client 188.166.177.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.177.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUELNDJB6UFxIutsA8b34AAAAFc"]
[Tue Dec 16 15:33:08.603758 2025] [:error] [pid 18323:tid 18376] [client 188.166.177.77:50954] [client 188.166.177.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 188.166.177.77, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUELNDJB6UFxIutsA8b34AAAAFc"]
[Tue Dec 16 15:41:22.252802 2025] [:error] [pid 18322:tid 18329] [client 209.97.180.8:50136] [client 209.97.180.8] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aUENIpsCeWBjrw28XtzT4wAAAAM"]
[Tue Dec 16 15:41:30.700641 2025] [authz_core:error] [pid 53940:tid 53958] [client 209.97.180.8:33366] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Tue Dec 16 15:41:34.717536 2025] [:error] [pid 18324:tid 18382] [client 209.97.180.8:33400] [client 209.97.180.8] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aUENLqG4um2mD1VpJHJeVQAAAII"]
[Tue Dec 16 15:41:36.705027 2025] [:error] [pid 35998:tid 36003] [client 209.97.180.8:33406] [client 209.97.180.8] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aUENMBKnhGuuhGxBSLOBbwAAAUI"]
[Tue Dec 16 17:34:58.264983 2025] [:error] [pid 51991:tid 51996] [client 143.110.213.72:57138] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2/api-docs"] [unique_id "aUEnwq7zKCVJSuwV1xZ-igAAAQM"]
[Tue Dec 16 17:34:59.263213 2025] [:error] [pid 18408:tid 18415] [client 143.110.213.72:57140] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3/api-docs"] [unique_id "aUEnwzi2Gr8pDzjrVBD3zwAAAMU"]
[Tue Dec 16 17:35:00.265589 2025] [:error] [pid 18324:tid 18394] [client 143.110.213.72:57150] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api-docs/swagger.json"] [unique_id "aUEnxKG4um2mD1VpJHJ_ngAAAI4"]
[Tue Dec 16 17:35:01.264107 2025] [:error] [pid 35998:tid 36025] [client 143.110.213.72:57164] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api/swagger.json"] [unique_id "aUEnxRKnhGuuhGxBSLOaDwAAAVg"]
[Tue Dec 16 17:35:02.266047 2025] [:error] [pid 18324:tid 18397] [client 143.110.213.72:57178] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/@vite/env"] [unique_id "aUEnxqG4um2mD1VpJHJ_owAAAJE"]
[Tue Dec 16 17:35:03.266297 2025] [:error] [pid 18324:tid 18400] [client 143.110.213.72:57186] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/actuator/env"] [unique_id "aUEnx6G4um2mD1VpJHJ_pgAAAJQ"]
[Tue Dec 16 17:35:04.269315 2025] [:error] [pid 18322:tid 18333] [client 143.110.213.72:57202] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aUEnyJsCeWBjrw28XtzunAAAAAc"]
[Tue Dec 16 17:35:05.267904 2025] [:error] [pid 12330:tid 12354] [client 143.110.213.72:34284] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server"] [unique_id "aUEnyV6iIQEVCIh8V1lhgwAAAZQ"]
[Tue Dec 16 17:35:06.268018 2025] [:error] [pid 51991:tid 52010] [client 143.110.213.72:34300] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aUEnyq7zKCVJSuwV1xZ-jQAAARE"]
[Tue Dec 16 17:35:08.274344 2025] [:error] [pid 51991:tid 52011] [client 143.110.213.72:34310] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about"] [unique_id "aUEnzK7zKCVJSuwV1xZ-lAAAARI"]
[Tue Dec 16 17:35:09.268997 2025] [:error] [pid 51991:tid 52005] [client 143.110.213.72:34326] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/debug/default/view"] [unique_id "aUEnza7zKCVJSuwV1xZ-lQAAAQw"]
[Tue Dec 16 17:35:10.288685 2025] [:error] [pid 51991:tid 51993] [client 143.110.213.72:34330] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2/_catalog"] [unique_id "aUEnzq7zKCVJSuwV1xZ-mAAAAQA"]
[Tue Dec 16 17:35:11.272175 2025] [:error] [pid 51991:tid 52002] [client 143.110.213.72:34340] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aUEnz67zKCVJSuwV1xZ-mgAAAQk"]
[Tue Dec 16 17:35:12.269724 2025] [:error] [pid 51991:tid 52014] [client 143.110.213.72:34350] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server-status"] [unique_id "aUEn0K7zKCVJSuwV1xZ-ngAAARU"]
[Tue Dec 16 17:35:13.270922 2025] [:error] [pid 18323:tid 18370] [client 143.110.213.72:34356] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login.action"] [unique_id "aUEn0TJB6UFxIutsA8YTSQAAAFE"]
[Tue Dec 16 17:35:14.271135 2025] [:error] [pid 18324:tid 18402] [client 143.110.213.72:34368] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/_all_dbs"] [unique_id "aUEn0qG4um2mD1VpJHJ_rgAAAJY"]
[Tue Dec 16 17:35:15.272055 2025] [:error] [pid 18324:tid 18389] [client 143.110.213.72:52664] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.DS_Store"] [unique_id "aUEn06G4um2mD1VpJHJ_rwAAAIk"]
[Tue Dec 16 17:35:16.270275 2025] [:error] [pid 51991:tid 51995] [client 143.110.213.72:52680] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aUEn1K7zKCVJSuwV1xZ-qQAAAQI"]
[Tue Dec 16 17:35:18.272856 2025] [:error] [pid 12330:tid 12340] [client 143.110.213.72:52690] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aUEn1l6iIQEVCIh8V1lhlAAAAYY"]
[Tue Dec 16 17:35:19.277913 2025] [:error] [pid 18322:tid 18349] [client 143.110.213.72:52702] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aUEn15sCeWBjrw28XtzuoQAAABc"]
[Tue Dec 16 17:35:20.275166 2025] [:error] [pid 51991:tid 52004] [client 143.110.213.72:52706] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aUEn2K7zKCVJSuwV1xZ-swAAAQs"]
[Tue Dec 16 17:35:21.275183 2025] [:error] [pid 18408:tid 18412] [client 143.110.213.72:52720] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/telescope/requests"] [unique_id "aUEn2Ti2Gr8pDzjrVBD38AAAAMI"]
[Tue Dec 16 17:35:22.274911 2025] [:error] [pid 53940:tid 53957] [client 143.110.213.72:52734] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aUEn2l91PNbcXLVkpR7UZwAAAc4"]
[Tue Dec 16 17:35:23.274717 2025] [:error] [pid 18408:tid 18422] [client 143.110.213.72:52742] [client 143.110.213.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUEn2zi2Gr8pDzjrVBD39gAAAMw"]
[Tue Dec 16 21:02:16.312291 2025] [:error] [pid 35998:tid 36021] [client 170.106.161.78:59654] [client 170.106.161.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUFYWBKnhGuuhGxBSLO_xwAAAVQ"]
[Tue Dec 16 21:53:40.283378 2025] [:error] [pid 51991:tid 52003] [client 106.222.209.165:16029] [client 106.222.209.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.209.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUFkZK7zKCVJSuwV1xbd6wAAAQo"]
[Tue Dec 16 22:00:12.483254 2025] [:error] [pid 35998:tid 36018] [client 106.222.209.165:32991] [client 106.222.209.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.209.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUFl7BKnhGuuhGxBSLPMJwAAAVE"]
[Tue Dec 16 22:15:41.836770 2025] [:error] [pid 53940:tid 53960] [client 106.222.209.165:1175] [client 106.222.209.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.209.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUFpjV91PNbcXLVkpR4QkQAAAdE"]
[Tue Dec 16 22:23:37.900935 2025] [:error] [pid 18408:tid 18412] [client 106.222.209.165:27390] [client 106.222.209.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.209.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUFraTi2Gr8pDzjrVBBPZwAAAMI"]
[Tue Dec 16 22:32:07.809743 2025] [:error] [pid 18408:tid 18417] [client 106.222.209.165:6576] [client 106.222.209.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.209.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUFtZzi2Gr8pDzjrVBBSmQAAAMc"]
[Tue Dec 16 23:28:08.679582 2025] [:error] [pid 18324:tid 18398] [client 103.68.23.43:59861] [client 103.68.23.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.68.23.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUF6iKG4um2mD1VpJHLTZgAAAJI"]
[Tue Dec 16 23:33:00.645775 2025] [:error] [pid 35998:tid 36003] [client 194.26.192.221:51997] [client 194.26.192.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUF7rBKnhGuuhGxBSLPe1gAAAUI"]
[Tue Dec 16 23:33:02.230332 2025] [:error] [pid 18408:tid 18423] [client 194.26.192.221:61640] [client 194.26.192.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUF7rji2Gr8pDzjrVBBq2wAAAM0"]
[Tue Dec 16 23:33:03.454930 2025] [:error] [pid 18323:tid 18366] [client 194.26.192.221:55478] [client 194.26.192.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUF7rzJB6UFxIutsA8ZfOAAAAE0"]
[Tue Dec 16 23:33:04.850445 2025] [:error] [pid 18408:tid 18433] [client 194.26.192.221:51332] [client 194.26.192.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUF7sDi2Gr8pDzjrVBBq7AAAANc"]
[Tue Dec 16 23:33:06.012044 2025] [:error] [pid 18323:tid 18360] [client 194.26.192.221:57825] [client 194.26.192.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUF7sjJB6UFxIutsA8ZfPQAAAEc"]
[Tue Dec 16 23:51:21.683212 2025] [:error] [pid 53940:tid 53965] [client 103.68.23.43:54433] [client 103.68.23.43] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aUF_-V91PNbcXLVkpR4khQAAAdY"]
[Tue Dec 16 23:53:08.734483 2025] [:error] [pid 18408:tid 18419] [client 103.68.23.43:62088] [client 103.68.23.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.68.23.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUGAZDi2Gr8pDzjrVBBw9QAAAMk"]
[Tue Dec 16 23:54:37.293000 2025] [:error] [pid 53940:tid 53965] [client 103.68.23.43:65491] [client 103.68.23.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.68.23.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUGAvV91PNbcXLVkpR4lHQAAAdY"]
[Tue Dec 16 23:55:57.936800 2025] [:error] [pid 18408:tid 18425] [client 103.68.23.43:64964] [client 103.68.23.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.68.23.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUGBDTi2Gr8pDzjrVBBxuwAAAM8"]
[Tue Dec 16 23:57:19.091820 2025] [:error] [pid 18322:tid 18330] [client 103.68.23.43:54672] [client 103.68.23.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.68.23.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUGBX5sCeWBjrw28XtxC2AAAAAQ"]
[Wed Dec 17 00:12:34.971714 2025] [:error] [pid 64835:tid 64857] [client 34.135.184.128:64230] [client 34.135.184.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.135.184.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUGE8u0_iNx32Sz58MK5aQAAABI"]
[Wed Dec 17 00:12:37.288597 2025] [:error] [pid 64835:tid 64860] [client 34.135.184.128:64230] [client 34.135.184.128] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aUGE9e0_iNx32Sz58MK5cgAAABU"]
[Wed Dec 17 00:12:37.490685 2025] [:error] [pid 64835:tid 64858] [client 34.135.184.128:64230] [client 34.135.184.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.135.184.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUGE9e0_iNx32Sz58MK5cwAAABM"]
[Wed Dec 17 00:12:38.984564 2025] [:error] [pid 64837:tid 64902] [client 34.135.184.128:56090] [client 34.135.184.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.135.184.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUGE9roJEzr5Ydl6WcQf7wAAAIg"]
[Wed Dec 17 00:12:40.458537 2025] [:error] [pid 64922:tid 64937] [client 34.135.184.128:63241] [client 34.135.184.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.135.184.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUGE-A70DhirJ6vYR3H3OgAAAM0"]
[Wed Dec 17 00:12:41.849901 2025] [:error] [pid 64837:tid 64899] [client 34.135.184.128:60221] [client 34.135.184.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.135.184.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUGE-boJEzr5Ydl6WcQf9QAAAIU"]
[Wed Dec 17 00:12:43.267811 2025] [:error] [pid 64835:tid 64840] [client 34.135.184.128:60682] [client 34.135.184.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.135.184.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUGE--0_iNx32Sz58MK5gQAAAAE"]
[Wed Dec 17 00:12:43.268015 2025] [:error] [pid 64835:tid 64840] [client 34.135.184.128:60682] [client 34.135.184.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.135.184.128, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUGE--0_iNx32Sz58MK5gQAAAAE"]
[Wed Dec 17 01:01:52.923851 2025] [:error] [pid 7514:tid 7537] [client 43.153.119.119:51224] [client 43.153.119.119] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aUGQgEJ2oigi4i7K2nCOTAAAARU"]
[Wed Dec 17 02:44:12.199581 2025] [:error] [pid 64836:tid 64867] [client 104.7.227.11:55486] [client 104.7.227.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.7.227.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUGofJiNb_9YvA0mnRBb0QAAAEA"]
[Wed Dec 17 02:44:37.084432 2025] [:error] [pid 7514:tid 7518] [client 167.172.79.172:50340] [client 167.172.79.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.79.172, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUGolUJ2oigi4i7K2nDGmAAAAQI"]
[Wed Dec 17 06:47:23.039064 2025] [:error] [pid 7715:tid 7722] [client 43.135.183.82:46330] [client 43.135.183.82] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUHhe5AcSlSgZepNKb-1qQAAAQU"]
[Wed Dec 17 07:08:28.699281 2025] [:error] [pid 13215:tid 13242] [client 195.24.236.93:54880] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-plain.php"] [unique_id "aUHmbHpS_Sk4Oyp_UPFm3gAAABY"], referer: www.google.com
[Wed Dec 17 07:08:28.700165 2025] [:error] [pid 13215:tid 13238] [client 195.24.236.93:54310] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUHmbHpS_Sk4Oyp_UPFm3wAAABI"]
[Wed Dec 17 07:08:28.776635 2025] [:error] [pid 13302:tid 13311] [client 195.24.236.93:55206] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUHmbBDfKV-_W5RvJZ-zggAAAMc"], referer: www.google.com
[Wed Dec 17 07:08:28.777116 2025] [:error] [pid 13302:tid 13306] [client 195.24.236.93:54072] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUHmbBDfKV-_W5RvJZ-zgwAAAMI"], referer: www.google.com
[Wed Dec 17 07:08:29.414021 2025] [:error] [pid 13215:tid 13224] [client 195.24.236.93:52102] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-plain.php"] [unique_id "aUHmbXpS_Sk4Oyp_UPFm5QAAAAQ"], referer: www.google.com
[Wed Dec 17 07:08:29.422408 2025] [:error] [pid 13216:tid 13255] [client 195.24.236.93:49285] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUHmbdkjYVDtADMjze48VAAAAEg"], referer: www.google.com
[Wed Dec 17 07:08:29.449896 2025] [:error] [pid 7715:tid 7728] [client 195.24.236.93:50355] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUHmbZAcSlSgZepNKb_CrQAAAQs"], referer: www.google.com
[Wed Dec 17 07:08:29.454906 2025] [:error] [pid 13302:tid 13312] [client 195.24.236.93:51259] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUHmbRDfKV-_W5RvJZ-zjQAAAMg"]
[Wed Dec 17 07:08:30.100318 2025] [:error] [pid 13216:tid 13272] [client 195.24.236.93:50791] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-plain.php"] [unique_id "aUHmbtkjYVDtADMjze48YQAAAFY"], referer: www.google.com
[Wed Dec 17 07:08:30.136586 2025] [:error] [pid 7715:tid 7717] [client 195.24.236.93:58812] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUHmbpAcSlSgZepNKb_CsgAAAQA"], referer: www.google.com
[Wed Dec 17 07:08:30.208059 2025] [:error] [pid 13217:tid 13270] [client 195.24.236.93:55036] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUHmbrKPEDQzeQkr6QJBcgAAAIE"]
[Wed Dec 17 07:08:30.230721 2025] [:error] [pid 7715:tid 7739] [client 195.24.236.93:64715] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUHmbpAcSlSgZepNKb_CtQAAARY"], referer: www.google.com
[Wed Dec 17 07:08:30.788435 2025] [:error] [pid 13216:tid 13258] [client 195.24.236.93:61562] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-plain.php"] [unique_id "aUHmbtkjYVDtADMjze48cQAAAEs"], referer: www.google.com
[Wed Dec 17 07:08:30.886525 2025] [:error] [pid 13302:tid 13327] [client 195.24.236.93:63977] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUHmbhDfKV-_W5RvJZ-zpgAAANc"], referer: www.google.com
[Wed Dec 17 07:08:30.930386 2025] [:error] [pid 13302:tid 13324] [client 195.24.236.93:51323] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUHmbhDfKV-_W5RvJZ-zqQAAANQ"], referer: www.google.com
[Wed Dec 17 07:08:30.940275 2025] [:error] [pid 13216:tid 13266] [client 195.24.236.93:57236] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUHmbtkjYVDtADMjze48cgAAAFI"]
[Wed Dec 17 07:08:31.138060 2025] [:error] [pid 13302:tid 13308] [client 195.24.236.93:55350] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-plain.php"] [unique_id "aUHmbxDfKV-_W5RvJZ-zrQAAAMQ"], referer: www.google.com
[Wed Dec 17 07:08:31.515415 2025] [:error] [pid 7715:tid 7740] [client 195.24.236.93:49342] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUHmb5AcSlSgZepNKb_CugAAARc"], referer: www.google.com
[Wed Dec 17 07:08:31.569156 2025] [:error] [pid 7715:tid 7724] [client 195.24.236.93:57211] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUHmb5AcSlSgZepNKb_CvgAAAQc"]
[Wed Dec 17 07:08:31.571679 2025] [:error] [pid 13217:tid 13287] [client 195.24.236.93:63448] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUHmb7KPEDQzeQkr6QJBfQAAAI0"], referer: www.google.com
[Wed Dec 17 07:08:32.826739 2025] [:error] [pid 13302:tid 13307] [client 195.24.236.93:61575] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUHmcBDfKV-_W5RvJZ-zxAAAAMM"], referer: www.google.com
[Wed Dec 17 07:08:32.989751 2025] [:error] [pid 7715:tid 7723] [client 195.24.236.93:54831] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUHmcJAcSlSgZepNKb_C0AAAAQY"], referer: www.google.com
[Wed Dec 17 07:08:34.166783 2025] [:error] [pid 7715:tid 7725] [client 195.24.236.93:50911] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUHmcpAcSlSgZepNKb_C4QAAAQg"], referer: www.google.com
[Wed Dec 17 07:08:35.469297 2025] [:error] [pid 7715:tid 7730] [client 195.24.236.93:56009] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUHmc5AcSlSgZepNKb_C7gAAAQ0"], referer: www.google.com
[Wed Dec 17 07:08:35.690941 2025] [:error] [pid 13217:tid 13294] [client 195.24.236.93:58565] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUHmc7KPEDQzeQkr6QJBpgAAAJQ"], referer: www.google.com
[Wed Dec 17 07:08:36.786138 2025] [:error] [pid 13302:tid 13324] [client 195.24.236.93:62936] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUHmdBDfKV-_W5RvJZ-z0wAAANQ"], referer: www.google.com
[Wed Dec 17 07:08:37.122692 2025] [:error] [pid 13302:tid 13307] [client 195.24.236.93:53244] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUHmdRDfKV-_W5RvJZ-z2AAAAMM"], referer: www.google.com
[Wed Dec 17 07:08:38.195583 2025] [:error] [pid 13216:tid 13265] [client 195.24.236.93:54988] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUHmdtkjYVDtADMjze48qAAAAFE"], referer: www.google.com
[Wed Dec 17 07:08:38.520630 2025] [:error] [pid 13302:tid 13324] [client 195.24.236.93:61431] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aUHmdhDfKV-_W5RvJZ-z7wAAANQ"], referer: www.google.com
[Wed Dec 17 07:08:39.519045 2025] [:error] [pid 13216:tid 13267] [client 195.24.236.93:50470] [client 195.24.236.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aUHmd9kjYVDtADMjze48xAAAAFM"], referer: www.google.com
[Wed Dec 17 07:08:53.787305 2025] [:error] [pid 7715:tid 7740] [client 13.74.182.201:12388] [client 13.74.182.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mans.php"] [unique_id "aUHmhZAcSlSgZepNKb_DPwAAARc"]
[Wed Dec 17 07:08:54.285748 2025] [:error] [pid 13217:tid 13279] [client 13.74.182.201:11944] [client 13.74.182.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mans.php"] [unique_id "aUHmhrKPEDQzeQkr6QJB3AAAAIU"]
[Wed Dec 17 07:08:54.794646 2025] [:error] [pid 13217:tid 13285] [client 13.74.182.201:2952] [client 13.74.182.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "aUHmhrKPEDQzeQkr6QJB3gAAAIs"]
[Wed Dec 17 07:08:55.290932 2025] [:error] [pid 7715:tid 7726] [client 13.74.182.201:14501] [client 13.74.182.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "aUHmh5AcSlSgZepNKb_DQgAAAQk"]
[Wed Dec 17 07:08:55.790200 2025] [:error] [pid 13216:tid 13247] [client 13.74.182.201:12037] [client 13.74.182.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "aUHmh9kjYVDtADMjze485AAAAEA"]
[Wed Dec 17 07:08:56.290109 2025] [:error] [pid 13302:tid 13321] [client 13.74.182.201:4192] [client 13.74.182.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "aUHmiBDfKV-_W5RvJZ-0GgAAANE"]
[Wed Dec 17 07:08:56.788525 2025] [:error] [pid 13217:tid 13282] [client 13.74.182.201:3922] [client 13.74.182.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "aUHmiLKPEDQzeQkr6QJB4wAAAIg"]
[Wed Dec 17 07:08:57.316616 2025] [:error] [pid 7715:tid 7733] [client 13.74.182.201:3947] [client 13.74.182.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "aUHmiZAcSlSgZepNKb_DSAAAARA"]
[Wed Dec 17 07:08:57.830531 2025] [:error] [pid 7715:tid 7724] [client 13.74.182.201:12082] [client 13.74.182.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aUHmiZAcSlSgZepNKb_DSgAAAQc"]
[Wed Dec 17 07:08:58.331255 2025] [:error] [pid 13302:tid 13320] [client 13.74.182.201:12034] [client 13.74.182.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aUHmihDfKV-_W5RvJZ-0HQAAANA"]
[Wed Dec 17 07:08:58.829976 2025] [:error] [pid 7715:tid 7717] [client 13.74.182.201:11739] [client 13.74.182.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aUHmipAcSlSgZepNKb_DUgAAAQA"]
[Wed Dec 17 07:08:59.328261 2025] [:error] [pid 13215:tid 13232] [client 13.74.182.201:12147] [client 13.74.182.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aUHmi3pS_Sk4Oyp_UPFnUwAAAAw"]
[Wed Dec 17 07:08:59.831204 2025] [:error] [pid 13215:tid 13234] [client 13.74.182.201:10353] [client 13.74.182.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid3.php"] [unique_id "aUHmi3pS_Sk4Oyp_UPFnVAAAAA4"]
[Wed Dec 17 07:09:00.345861 2025] [:error] [pid 13215:tid 13237] [client 13.74.182.201:2987] [client 13.74.182.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid3.php"] [unique_id "aUHmjHpS_Sk4Oyp_UPFnVQAAABE"]
[Wed Dec 17 07:09:00.848179 2025] [:error] [pid 7715:tid 7721] [client 13.74.182.201:2376] [client 13.74.182.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid3.php"] [unique_id "aUHmjJAcSlSgZepNKb_DWgAAAQQ"]
[Wed Dec 17 07:09:01.359164 2025] [:error] [pid 13216:tid 13250] [client 13.74.182.201:9237] [client 13.74.182.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid3.php"] [unique_id "aUHmjdkjYVDtADMjze486gAAAEM"]
[Wed Dec 17 07:09:01.891661 2025] [:error] [pid 13216:tid 13257] [client 13.74.182.201:9246] [client 13.74.182.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "aUHmjdkjYVDtADMjze486wAAAEo"]
[Wed Dec 17 07:09:02.398992 2025] [:error] [pid 13215:tid 13240] [client 13.74.182.201:14763] [client 13.74.182.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxin.php"] [unique_id "aUHmjnpS_Sk4Oyp_UPFnWwAAABQ"]
[Wed Dec 17 07:32:53.516703 2025] [:error] [pid 7715:tid 7735] [client 84.54.33.138:60760] [client 84.54.33.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aUHsJZAcSlSgZepNKb_TSAAAARI"]
[Wed Dec 17 07:43:17.182845 2025] [:error] [pid 13215:tid 13221] [client 182.44.2.148:38674] [client 182.44.2.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aUHulXpS_Sk4Oyp_UPF0vAAAAAE"]
[Wed Dec 17 08:07:50.703216 2025] [:error] [pid 7715:tid 7721] [client 185.138.88.25:42402] [client 185.138.88.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.138.88.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUH0VpAcSlSgZepNKb_k0wAAAQQ"], referer: https://expressinteriors.com/xmlrpc.php?rsd
[Wed Dec 17 20:19:17.770326 2025] [:error] [pid 11733:tid 11736] [client 4.218.22.35:12499] [client 4.218.22.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.218.22.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUKfxTzmtBRXExJb1PEmuAAAAQE"]
[Wed Dec 17 20:19:18.411669 2025] [:error] [pid 11733:tid 11755] [client 4.218.22.35:12499] [client 4.218.22.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.218.22.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUKfxjzmtBRXExJb1PEmuQAAARQ"]
[Wed Dec 17 20:19:22.724780 2025] [:error] [pid 45531:tid 45582] [client 4.218.22.35:12486] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aUKfyojuE-Fd-sBWjvWMVgAAAFM"]
[Wed Dec 17 20:19:23.023395 2025] [:error] [pid 16746:tid 16765] [client 4.218.22.35:12495] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aUKfy4-UihQezEh5cyO4CgAAAg0"]
[Wed Dec 17 20:19:23.361900 2025] [:error] [pid 16577:tid 16596] [client 4.218.22.35:12502] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aUKfy-OuBdGpNNQaNL40rgAAAUg"]
[Wed Dec 17 20:19:23.661610 2025] [:error] [pid 16746:tid 16754] [client 4.218.22.35:12529] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aUKfy4-UihQezEh5cyO4CwAAAgI"]
[Wed Dec 17 20:19:23.947762 2025] [:error] [pid 16666:tid 16671] [client 4.218.22.35:12433] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/minik.php"] [unique_id "aUKfy1AThvYvBwbndYLo8gAAAYI"]
[Wed Dec 17 20:19:24.263884 2025] [:error] [pid 16666:tid 16677] [client 4.218.22.35:12422] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/minik.php"] [unique_id "aUKfzFAThvYvBwbndYLo9AAAAYg"]
[Wed Dec 17 20:19:24.575261 2025] [:error] [pid 11733:tid 11749] [client 4.218.22.35:12482] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/minik.php"] [unique_id "aUKfzDzmtBRXExJb1PEmugAAAQ4"]
[Wed Dec 17 20:19:24.874870 2025] [:error] [pid 16666:tid 16676] [client 4.218.22.35:12443] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/minik.php"] [unique_id "aUKfzFAThvYvBwbndYLo9QAAAYc"]
[Wed Dec 17 20:19:25.199852 2025] [:error] [pid 16746:tid 16764] [client 4.218.22.35:12520] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/OK.php"] [unique_id "aUKfzY-UihQezEh5cyO4DQAAAgw"]
[Wed Dec 17 20:19:25.586379 2025] [:error] [pid 45530:tid 45539] [client 4.218.22.35:3035] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/OK.php"] [unique_id "aUKfzW4IsXcKlf7LWf8zJAAAAAQ"]
[Wed Dec 17 20:19:25.914445 2025] [:error] [pid 16788:tid 16805] [client 4.218.22.35:3022] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/OK.php"] [unique_id "aUKfzSEJyT-03u9UZWO78QAAAk8"]
[Wed Dec 17 20:19:26.312829 2025] [:error] [pid 45531:tid 45574] [client 4.218.22.35:12492] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/OK.php"] [unique_id "aUKfzojuE-Fd-sBWjvWMXgAAAEs"]
[Wed Dec 17 20:19:26.688463 2025] [:error] [pid 45621:tid 45637] [client 4.218.22.35:12509] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfanew.php"] [unique_id "aUKfzuVNGQfJ1rR90pSJ4wAAAMs"]
[Wed Dec 17 20:19:27.064530 2025] [:error] [pid 45530:tid 45556] [client 4.218.22.35:12516] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfanew.php"] [unique_id "aUKfz24IsXcKlf7LWf8zJwAAABU"]
[Wed Dec 17 20:19:27.407869 2025] [:error] [pid 16704:tid 16713] [client 4.218.22.35:12442] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfanew.php"] [unique_id "aUKfz6Anp3ottQtykbRgxQAAAcQ"]
[Wed Dec 17 20:19:27.685391 2025] [:error] [pid 16577:tid 16612] [client 4.218.22.35:12541] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfanew.php"] [unique_id "aUKfz-OuBdGpNNQaNL40sQAAAVg"]
[Wed Dec 17 20:19:27.976989 2025] [:error] [pid 16577:tid 16600] [client 4.218.22.35:12543] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zsec.php"] [unique_id "aUKfz-OuBdGpNNQaNL40sgAAAUw"]
[Wed Dec 17 20:19:28.266337 2025] [:error] [pid 16704:tid 16709] [client 4.218.22.35:12511] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zsec.php"] [unique_id "aUKf0KAnp3ottQtykbRgxgAAAcA"]
[Wed Dec 17 20:19:28.601465 2025] [:error] [pid 45621:tid 45641] [client 4.218.22.35:12496] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zsec.php"] [unique_id "aUKf0OVNGQfJ1rR90pSJ6AAAAM8"]
[Wed Dec 17 20:19:28.927455 2025] [:error] [pid 45621:tid 45646] [client 4.218.22.35:12523] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zsec.php"] [unique_id "aUKf0OVNGQfJ1rR90pSJ6QAAANQ"]
[Wed Dec 17 20:19:29.248410 2025] [:error] [pid 16577:tid 16589] [client 4.218.22.35:12501] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/arig.php"] [unique_id "aUKf0eOuBdGpNNQaNL40swAAAUE"]
[Wed Dec 17 20:19:29.601115 2025] [:error] [pid 16577:tid 16594] [client 4.218.22.35:12439] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/arig.php"] [unique_id "aUKf0eOuBdGpNNQaNL40tQAAAUY"]
[Wed Dec 17 20:19:29.971031 2025] [:error] [pid 45530:tid 45537] [client 4.218.22.35:12484] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/arig.php"] [unique_id "aUKf0W4IsXcKlf7LWf8zLAAAAAI"]
[Wed Dec 17 20:19:30.297279 2025] [:error] [pid 45621:tid 45630] [client 4.218.22.35:12518] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/arig.php"] [unique_id "aUKf0uVNGQfJ1rR90pSJ7QAAAMQ"]
[Wed Dec 17 20:19:30.683421 2025] [:error] [pid 45530:tid 45559] [client 4.218.22.35:3017] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin1.php"] [unique_id "aUKf0m4IsXcKlf7LWf8zLQAAABg"]
[Wed Dec 17 20:19:31.013316 2025] [:error] [pid 45621:tid 45649] [client 4.218.22.35:12527] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin1.php"] [unique_id "aUKf0-VNGQfJ1rR90pSJ7wAAANc"]
[Wed Dec 17 20:19:31.355719 2025] [:error] [pid 45621:tid 45629] [client 4.218.22.35:12488] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin1.php"] [unique_id "aUKf0-VNGQfJ1rR90pSJ8QAAAMM"]
[Wed Dec 17 20:19:31.702330 2025] [:error] [pid 45531:tid 45586] [client 4.218.22.35:12426] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin1.php"] [unique_id "aUKf04juE-Fd-sBWjvWMZAAAAFc"]
[Wed Dec 17 20:19:32.225483 2025] [:error] [pid 16577:tid 16593] [client 4.218.22.35:12437] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aUKf1OOuBdGpNNQaNL40tgAAAUU"]
[Wed Dec 17 20:19:32.535237 2025] [:error] [pid 16861:tid 16901] [client 4.218.22.35:12503] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aUKf1Fmas3wxi8EVIZq6ZQAAAo4"]
[Wed Dec 17 20:19:33.152221 2025] [:error] [pid 16861:tid 16894] [client 4.218.22.35:12424] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aUKf1Vmas3wxi8EVIZq6aAAAAoc"]
[Wed Dec 17 20:19:33.519954 2025] [:error] [pid 16666:tid 16680] [client 4.218.22.35:12435] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aUKf1VAThvYvBwbndYLo-wAAAYs"]
[Wed Dec 17 20:19:33.880081 2025] [:error] [pid 16861:tid 16895] [client 4.218.22.35:12481] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/af32.php"] [unique_id "aUKf1Vmas3wxi8EVIZq6aQAAAog"]
[Wed Dec 17 20:19:34.191444 2025] [:error] [pid 16666:tid 16688] [client 4.218.22.35:12467] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/af32.php"] [unique_id "aUKf1lAThvYvBwbndYLpAAAAAZM"]
[Wed Dec 17 20:19:34.521167 2025] [:error] [pid 45621:tid 45628] [client 4.218.22.35:12522] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/af32.php"] [unique_id "aUKf1uVNGQfJ1rR90pSJ-AAAAMI"]
[Wed Dec 17 20:19:34.937900 2025] [:error] [pid 45621:tid 45633] [client 4.218.22.35:12510] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/af32.php"] [unique_id "aUKf1uVNGQfJ1rR90pSJ-QAAAMc"]
[Wed Dec 17 20:19:35.351085 2025] [:error] [pid 16577:tid 16601] [client 4.218.22.35:12466] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rz.php"] [unique_id "aUKf1-OuBdGpNNQaNL40twAAAU0"]
[Wed Dec 17 20:19:35.698051 2025] [:error] [pid 45530:tid 45542] [client 4.218.22.35:12421] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rz.php"] [unique_id "aUKf124IsXcKlf7LWf8zLwAAAAc"]
[Wed Dec 17 20:19:36.209117 2025] [:error] [pid 16861:tid 16897] [client 4.218.22.35:12506] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rz.php"] [unique_id "aUKf2Fmas3wxi8EVIZq6bAAAAoo"]
[Wed Dec 17 20:19:36.721459 2025] [:error] [pid 16788:tid 16790] [client 4.218.22.35:12539] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rz.php"] [unique_id "aUKf2CEJyT-03u9UZWO79QAAAkA"]
[Wed Dec 17 20:19:37.068930 2025] [:error] [pid 16577:tid 16599] [client 4.218.22.35:12444] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hugo.php"] [unique_id "aUKf2eOuBdGpNNQaNL40uQAAAUs"]
[Wed Dec 17 20:19:37.397072 2025] [:error] [pid 16577:tid 16595] [client 4.218.22.35:3034] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hugo.php"] [unique_id "aUKf2eOuBdGpNNQaNL40ugAAAUc"]
[Wed Dec 17 20:19:37.755564 2025] [:error] [pid 16577:tid 16610] [client 4.218.22.35:12418] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hugo.php"] [unique_id "aUKf2eOuBdGpNNQaNL40vAAAAVY"]
[Wed Dec 17 20:19:38.036298 2025] [:error] [pid 16577:tid 16591] [client 4.218.22.35:3049] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hugo.php"] [unique_id "aUKf2uOuBdGpNNQaNL40vQAAAUM"]
[Wed Dec 17 20:19:38.348454 2025] [:error] [pid 16577:tid 16604] [client 4.218.22.35:12416] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ava.php"] [unique_id "aUKf2uOuBdGpNNQaNL40vgAAAVA"]
[Wed Dec 17 20:19:38.649612 2025] [:error] [pid 16746:tid 16763] [client 4.218.22.35:12438] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ava.php"] [unique_id "aUKf2o-UihQezEh5cyO4EgAAAgs"]
[Wed Dec 17 20:19:38.998954 2025] [:error] [pid 16577:tid 16605] [client 4.218.22.35:12494] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ava.php"] [unique_id "aUKf2uOuBdGpNNQaNL40wAAAAVE"]
[Wed Dec 17 20:19:39.392510 2025] [:error] [pid 16704:tid 16729] [client 4.218.22.35:12531] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ava.php"] [unique_id "aUKf26Anp3ottQtykbRgyQAAAdQ"]
[Wed Dec 17 20:19:39.705050 2025] [:error] [pid 16788:tid 16795] [client 4.218.22.35:3024] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lzyrj.php"] [unique_id "aUKf2yEJyT-03u9UZWO7_gAAAkU"]
[Wed Dec 17 20:19:39.986379 2025] [:error] [pid 16746:tid 16759] [client 4.218.22.35:12515] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lzyrj.php"] [unique_id "aUKf24-UihQezEh5cyO4FgAAAgc"]
[Wed Dec 17 20:19:40.286818 2025] [:error] [pid 16746:tid 16767] [client 4.218.22.35:12534] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lzyrj.php"] [unique_id "aUKf3I-UihQezEh5cyO4FwAAAg8"]
[Wed Dec 17 20:19:40.560428 2025] [:error] [pid 16746:tid 16754] [client 4.218.22.35:12521] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lzyrj.php"] [unique_id "aUKf3I-UihQezEh5cyO4GwAAAgI"]
[Wed Dec 17 20:19:40.859404 2025] [:error] [pid 16746:tid 16769] [client 4.218.22.35:12480] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/laudq.php"] [unique_id "aUKf3I-UihQezEh5cyO4HAAAAhE"]
[Wed Dec 17 20:19:41.162766 2025] [:error] [pid 16788:tid 16808] [client 4.218.22.35:3036] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/laudq.php"] [unique_id "aUKf3SEJyT-03u9UZWO8AwAAAlI"]
[Wed Dec 17 20:19:41.500168 2025] [:error] [pid 16788:tid 16790] [client 4.218.22.35:12487] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/laudq.php"] [unique_id "aUKf3SEJyT-03u9UZWO8BQAAAkA"]
[Wed Dec 17 20:19:42.046536 2025] [:error] [pid 16861:tid 16902] [client 4.218.22.35:12535] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/laudq.php"] [unique_id "aUKf3lmas3wxi8EVIZq6dwAAAo8"]
[Wed Dec 17 20:19:42.356811 2025] [:error] [pid 16788:tid 16806] [client 4.218.22.35:12425] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/anjay.php"] [unique_id "aUKf3iEJyT-03u9UZWO8CgAAAlA"]
[Wed Dec 17 20:19:42.824408 2025] [:error] [pid 16788:tid 16793] [client 4.218.22.35:12526] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/anjay.php"] [unique_id "aUKf3iEJyT-03u9UZWO8DgAAAkM"]
[Wed Dec 17 20:19:43.099203 2025] [:error] [pid 11733:tid 11738] [client 4.218.22.35:3014] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/anjay.php"] [unique_id "aUKf3zzmtBRXExJb1PEmwQAAAQM"]
[Wed Dec 17 20:19:43.432911 2025] [:error] [pid 16788:tid 16790] [client 4.218.22.35:12458] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/anjay.php"] [unique_id "aUKf3yEJyT-03u9UZWO8EAAAAkA"]
[Wed Dec 17 20:19:43.924677 2025] [:error] [pid 16746:tid 16767] [client 4.218.22.35:2739] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/let.php"] [unique_id "aUKf34-UihQezEh5cyO4JgAAAg8"]
[Wed Dec 17 20:19:44.279758 2025] [:error] [pid 45531:tid 45579] [client 4.218.22.35:12499] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/let.php"] [unique_id "aUKf4IjuE-Fd-sBWjvWMZwAAAFA"]
[Wed Dec 17 20:19:44.622390 2025] [:error] [pid 16861:tid 16893] [client 4.218.22.35:3044] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/let.php"] [unique_id "aUKf4Fmas3wxi8EVIZq6egAAAoY"]
[Wed Dec 17 20:19:44.976122 2025] [:error] [pid 45531:tid 45580] [client 4.218.22.35:12446] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/let.php"] [unique_id "aUKf4IjuE-Fd-sBWjvWMaAAAAFE"]
[Wed Dec 17 20:19:45.266408 2025] [:error] [pid 16746:tid 16754] [client 4.218.22.35:3023] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aUKf4Y-UihQezEh5cyO4KAAAAgI"]
[Wed Dec 17 20:19:45.627320 2025] [:error] [pid 16746:tid 16761] [client 4.218.22.35:12432] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aUKf4Y-UihQezEh5cyO4KQAAAgk"]
[Wed Dec 17 20:19:45.927397 2025] [:error] [pid 45530:tid 45547] [client 4.218.22.35:12431] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aUKf4W4IsXcKlf7LWf8zMwAAAAw"]
[Wed Dec 17 20:19:46.234598 2025] [:error] [pid 16704:tid 16732] [client 4.218.22.35:12445] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aUKf4qAnp3ottQtykbRgzAAAAdc"]
[Wed Dec 17 20:19:46.572517 2025] [:error] [pid 16704:tid 16716] [client 4.218.22.35:12457] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aUKf4qAnp3ottQtykbRgzQAAAcc"]
[Wed Dec 17 20:19:46.886470 2025] [:error] [pid 16666:tid 16678] [client 4.218.22.35:12540] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aUKf4lAThvYvBwbndYLpDAAAAYk"]
[Wed Dec 17 20:19:47.213879 2025] [:error] [pid 16666:tid 16685] [client 4.218.22.35:12512] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aUKf41AThvYvBwbndYLpEAAAAZA"]
[Wed Dec 17 20:19:47.508524 2025] [:error] [pid 16666:tid 16687] [client 4.218.22.35:12459] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aUKf41AThvYvBwbndYLpEQAAAZI"]
[Wed Dec 17 20:19:47.868155 2025] [:error] [pid 16666:tid 16690] [client 4.218.22.35:12423] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aUKf41AThvYvBwbndYLpEwAAAZU"]
[Wed Dec 17 20:19:48.181855 2025] [:error] [pid 16666:tid 16674] [client 4.218.22.35:12465] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aUKf5FAThvYvBwbndYLpFAAAAYU"]
[Wed Dec 17 20:19:48.550933 2025] [:error] [pid 16704:tid 16720] [client 4.218.22.35:12449] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aUKf5KAnp3ottQtykbRg0AAAAcs"]
[Wed Dec 17 20:19:48.865774 2025] [:error] [pid 16666:tid 16679] [client 4.218.22.35:12429] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aUKf5FAThvYvBwbndYLpFgAAAYo"]
[Wed Dec 17 20:19:49.244083 2025] [:error] [pid 16704:tid 16719] [client 4.218.22.35:12441] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aUKf5aAnp3ottQtykbRg0gAAAco"]
[Wed Dec 17 20:19:49.777249 2025] [:error] [pid 16704:tid 16731] [client 4.218.22.35:12463] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aUKf5aAnp3ottQtykbRg1AAAAdY"]
[Wed Dec 17 20:19:50.057752 2025] [:error] [pid 16666:tid 16680] [client 4.218.22.35:12536] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aUKf5lAThvYvBwbndYLpHAAAAYs"]
[Wed Dec 17 20:19:50.357708 2025] [:error] [pid 16666:tid 16677] [client 4.218.22.35:2702] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aUKf5lAThvYvBwbndYLpHQAAAYg"]
[Wed Dec 17 20:19:50.657877 2025] [:error] [pid 16666:tid 16676] [client 4.218.22.35:2717] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abe.php"] [unique_id "aUKf5lAThvYvBwbndYLpHgAAAYc"]
[Wed Dec 17 20:19:50.949060 2025] [:error] [pid 16666:tid 16685] [client 4.218.22.35:3031] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abe.php"] [unique_id "aUKf5lAThvYvBwbndYLpHwAAAZA"]
[Wed Dec 17 20:19:51.277415 2025] [:error] [pid 16861:tid 16899] [client 4.218.22.35:3030] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abe.php"] [unique_id "aUKf51mas3wxi8EVIZq6ggAAAow"]
[Wed Dec 17 20:19:51.616256 2025] [:error] [pid 16704:tid 16729] [client 4.218.22.35:12452] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abe.php"] [unique_id "aUKf56Anp3ottQtykbRg2QAAAdQ"]
[Wed Dec 17 20:19:51.945838 2025] [:error] [pid 45621:tid 45650] [client 4.218.22.35:12517] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aUKf5-VNGQfJ1rR90pSJ_wAAANg"]
[Wed Dec 17 20:19:52.323807 2025] [:error] [pid 45621:tid 45635] [client 4.218.22.35:3039] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aUKf6OVNGQfJ1rR90pSKAgAAAMk"]
[Wed Dec 17 20:19:52.653488 2025] [:error] [pid 45621:tid 45643] [client 4.218.22.35:3052] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aUKf6OVNGQfJ1rR90pSKBQAAANE"]
[Wed Dec 17 20:19:52.994751 2025] [:error] [pid 45531:tid 45582] [client 4.218.22.35:12507] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aUKf6IjuE-Fd-sBWjvWMaQAAAFM"]
[Wed Dec 17 20:19:53.370701 2025] [:error] [pid 16861:tid 16903] [client 4.218.22.35:3019] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aUKf6Vmas3wxi8EVIZq6hAAAApA"]
[Wed Dec 17 20:19:53.756505 2025] [:error] [pid 16861:tid 16908] [client 4.218.22.35:12530] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aUKf6Vmas3wxi8EVIZq6hQAAApU"]
[Wed Dec 17 20:19:54.057269 2025] [:error] [pid 45531:tid 45586] [client 4.218.22.35:2701] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aUKf6ojuE-Fd-sBWjvWMagAAAFc"]
[Wed Dec 17 20:19:54.345404 2025] [:error] [pid 16704:tid 16720] [client 4.218.22.35:12473] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aUKf6qAnp3ottQtykbRg4gAAAcs"]
[Wed Dec 17 20:19:54.640761 2025] [:error] [pid 45531:tid 45563] [client 4.218.22.35:12508] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aUKf6ojuE-Fd-sBWjvWMawAAAEA"]
[Wed Dec 17 20:19:54.969123 2025] [:error] [pid 45531:tid 45573] [client 4.218.22.35:12455] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aUKf6ojuE-Fd-sBWjvWMbQAAAEo"]
[Wed Dec 17 20:19:55.306156 2025] [:error] [pid 45531:tid 45569] [client 4.218.22.35:12447] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aUKf64juE-Fd-sBWjvWMbwAAAEY"]
[Wed Dec 17 20:19:55.663937 2025] [:error] [pid 45621:tid 45648] [client 4.218.22.35:12497] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aUKf6-VNGQfJ1rR90pSKCwAAANY"]
[Wed Dec 17 20:19:55.985519 2025] [:error] [pid 16704:tid 16722] [client 4.218.22.35:3026] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cloud.php"] [unique_id "aUKf66Anp3ottQtykbRg6gAAAc0"]
[Wed Dec 17 20:19:56.286159 2025] [:error] [pid 45531:tid 45585] [client 4.218.22.35:3064] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cloud.php"] [unique_id "aUKf7IjuE-Fd-sBWjvWMcQAAAFY"]
[Wed Dec 17 20:19:56.618489 2025] [:error] [pid 45530:tid 45535] [client 4.218.22.35:2748] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cloud.php"] [unique_id "aUKf7G4IsXcKlf7LWf8zNwAAAAA"]
[Wed Dec 17 20:19:56.924168 2025] [:error] [pid 16704:tid 16732] [client 4.218.22.35:12532] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cloud.php"] [unique_id "aUKf7KAnp3ottQtykbRg6wAAAdc"]
[Wed Dec 17 20:19:57.248340 2025] [:error] [pid 45531:tid 45581] [client 4.218.22.35:3041] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aUKf7YjuE-Fd-sBWjvWMdAAAAFI"]
[Wed Dec 17 20:19:57.595499 2025] [:error] [pid 16577:tid 16609] [client 4.218.22.35:12537] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aUKf7eOuBdGpNNQaNL40xgAAAVU"]
[Wed Dec 17 20:19:57.989167 2025] [:error] [pid 16577:tid 16599] [client 4.218.22.35:12489] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aUKf7eOuBdGpNNQaNL40xwAAAUs"]
[Wed Dec 17 20:19:58.321134 2025] [:error] [pid 45531:tid 45572] [client 4.218.22.35:12453] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aUKf7ojuE-Fd-sBWjvWMdwAAAEk"]
[Wed Dec 17 20:19:58.656744 2025] [:error] [pid 16577:tid 16598] [client 4.218.22.35:12490] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aUKf7uOuBdGpNNQaNL40yAAAAUo"]
[Wed Dec 17 20:19:58.982619 2025] [:error] [pid 11733:tid 11753] [client 4.218.22.35:2690] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aUKf7jzmtBRXExJb1PEmwwAAARI"]
[Wed Dec 17 20:19:59.352442 2025] [:error] [pid 45530:tid 45543] [client 4.218.22.35:12461] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aUKf724IsXcKlf7LWf8zOQAAAAg"]
[Wed Dec 17 20:19:59.671039 2025] [:error] [pid 45530:tid 45551] [client 4.218.22.35:3020] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aUKf724IsXcKlf7LWf8zOgAAABA"]
[Wed Dec 17 20:19:59.962460 2025] [:error] [pid 45530:tid 45546] [client 4.218.22.35:3042] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aUKf724IsXcKlf7LWf8zOwAAAAs"]
[Wed Dec 17 20:20:00.306501 2025] [:error] [pid 45530:tid 45539] [client 4.218.22.35:12460] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aUKf8G4IsXcKlf7LWf8zPQAAAAQ"]
[Wed Dec 17 20:20:00.610800 2025] [:error] [pid 16666:tid 16682] [client 4.218.22.35:2741] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aUKf8FAThvYvBwbndYLpKQAAAY0"]
[Wed Dec 17 20:20:00.903571 2025] [:error] [pid 16577:tid 16591] [client 4.218.22.35:2719] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aUKf8OOuBdGpNNQaNL40yQAAAUM"]
[Wed Dec 17 20:20:01.206787 2025] [:error] [pid 16704:tid 16729] [client 4.218.22.35:12498] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aUKf8aAnp3ottQtykbRg8AAAAdQ"]
[Wed Dec 17 20:20:01.519712 2025] [:error] [pid 16577:tid 16604] [client 4.218.22.35:12430] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aUKf8eOuBdGpNNQaNL40ygAAAVA"]
[Wed Dec 17 20:20:01.854255 2025] [:error] [pid 11733:tid 11752] [client 4.218.22.35:12538] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aUKf8TzmtBRXExJb1PEmxQAAARE"]
[Wed Dec 17 20:20:02.172780 2025] [:error] [pid 11733:tid 11749] [client 4.218.22.35:3045] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aUKf8jzmtBRXExJb1PEmxgAAAQ4"]
[Wed Dec 17 20:20:02.593275 2025] [:error] [pid 45530:tid 45541] [client 4.218.22.35:3056] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aUKf8m4IsXcKlf7LWf8zPwAAAAY"]
[Wed Dec 17 20:20:02.919049 2025] [:error] [pid 16788:tid 16798] [client 4.218.22.35:12542] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aUKf8iEJyT-03u9UZWO8GAAAAkg"]
[Wed Dec 17 20:20:03.209338 2025] [:error] [pid 16746:tid 16772] [client 4.218.22.35:3066] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aUKf84-UihQezEh5cyO4MQAAAhI"]
[Wed Dec 17 20:20:03.507530 2025] [:error] [pid 16746:tid 16757] [client 4.218.22.35:12428] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aUKf84-UihQezEh5cyO4MgAAAgU"]
[Wed Dec 17 20:20:03.819652 2025] [:error] [pid 16746:tid 16778] [client 4.218.22.35:12475] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aUKf84-UihQezEh5cyO4MwAAAhg"]
[Wed Dec 17 20:20:04.237851 2025] [:error] [pid 11733:tid 11756] [client 4.218.22.35:12420] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aUKf9DzmtBRXExJb1PEmywAAARU"]
[Wed Dec 17 20:20:04.549922 2025] [:error] [pid 16746:tid 16774] [client 4.218.22.35:12419] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aUKf9I-UihQezEh5cyO4NwAAAhQ"]
[Wed Dec 17 20:20:04.856580 2025] [:error] [pid 11733:tid 11740] [client 4.218.22.35:3028] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aUKf9DzmtBRXExJb1PEmzAAAAQU"]
[Wed Dec 17 20:20:05.205733 2025] [:error] [pid 45621:tid 45642] [client 4.218.22.35:12427] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "aUKf9eVNGQfJ1rR90pSKDgAAANA"]
[Wed Dec 17 20:20:05.504055 2025] [:error] [pid 11733:tid 11743] [client 4.218.22.35:3054] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "aUKf9TzmtBRXExJb1PEmzQAAAQg"]
[Wed Dec 17 20:20:05.808828 2025] [:error] [pid 11733:tid 11739] [client 4.218.22.35:12514] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "aUKf9TzmtBRXExJb1PEmzwAAAQQ"]
[Wed Dec 17 20:20:06.143240 2025] [:error] [pid 11733:tid 11759] [client 4.218.22.35:12505] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "aUKf9jzmtBRXExJb1PEm0AAAARg"]
[Wed Dec 17 20:20:06.499096 2025] [:error] [pid 16666:tid 16690] [client 4.218.22.35:3029] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aUKf9lAThvYvBwbndYLpLQAAAZU"]
[Wed Dec 17 20:20:06.891945 2025] [:error] [pid 16666:tid 16673] [client 4.218.22.35:2705] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aUKf9lAThvYvBwbndYLpLwAAAYQ"]
[Wed Dec 17 20:20:07.255097 2025] [:error] [pid 16704:tid 16730] [client 4.218.22.35:12440] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aUKf96Anp3ottQtykbRg8QAAAdU"]
[Wed Dec 17 20:20:07.558959 2025] [:error] [pid 16788:tid 16793] [client 4.218.22.35:2714] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aUKf9yEJyT-03u9UZWO8HwAAAkM"]
[Wed Dec 17 20:20:07.901762 2025] [:error] [pid 16788:tid 16797] [client 4.218.22.35:12468] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aUKf9yEJyT-03u9UZWO8IAAAAkc"]
[Wed Dec 17 20:20:08.192366 2025] [:error] [pid 16788:tid 16809] [client 4.218.22.35:12474] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aUKf-CEJyT-03u9UZWO8IQAAAlM"]
[Wed Dec 17 20:20:08.491525 2025] [:error] [pid 16746:tid 16773] [client 4.218.22.35:2720] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aUKf-I-UihQezEh5cyO4PAAAAhM"]
[Wed Dec 17 20:20:08.819836 2025] [:error] [pid 45531:tid 45568] [client 4.218.22.35:12436] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aUKf-IjuE-Fd-sBWjvWMfgAAAEU"]
[Wed Dec 17 20:20:09.124161 2025] [:error] [pid 16666:tid 16678] [client 4.218.22.35:12524] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aUKf-VAThvYvBwbndYLpMwAAAYk"]
[Wed Dec 17 20:20:09.436801 2025] [:error] [pid 16666:tid 16689] [client 4.218.22.35:12500] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aUKf-VAThvYvBwbndYLpNAAAAZQ"]
[Wed Dec 17 20:20:09.720522 2025] [:error] [pid 45621:tid 45630] [client 4.218.22.35:12528] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aUKf-eVNGQfJ1rR90pSKEwAAAMQ"]
[Wed Dec 17 20:20:10.077918 2025] [:error] [pid 11733:tid 11753] [client 4.218.22.35:3057] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aUKf-jzmtBRXExJb1PEm0wAAARI"]
[Wed Dec 17 20:20:10.387854 2025] [:error] [pid 16704:tid 16714] [client 4.218.22.35:12525] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aUKf-qAnp3ottQtykbRg8gAAAcU"]
[Wed Dec 17 20:20:10.769647 2025] [:error] [pid 11733:tid 11735] [client 4.218.22.35:12471] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aUKf-jzmtBRXExJb1PEm1QAAAQA"]
[Wed Dec 17 20:20:11.060964 2025] [:error] [pid 45530:tid 45552] [client 4.218.22.35:12477] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aUKf-24IsXcKlf7LWf8zRgAAABE"]
[Wed Dec 17 20:20:11.356001 2025] [:error] [pid 45531:tid 45576] [client 4.218.22.35:2750] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aUKf-4juE-Fd-sBWjvWMgAAAAE0"]
[Wed Dec 17 20:20:11.676801 2025] [:error] [pid 16577:tid 16606] [client 4.218.22.35:3011] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uana.php"] [unique_id "aUKf--OuBdGpNNQaNL40zQAAAVI"]
[Wed Dec 17 20:20:12.001370 2025] [:error] [pid 16746:tid 16760] [client 4.218.22.35:12464] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uana.php"] [unique_id "aUKf_I-UihQezEh5cyO4PgAAAgg"]
[Wed Dec 17 20:20:12.390627 2025] [:error] [pid 16666:tid 16671] [client 4.218.22.35:3025] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uana.php"] [unique_id "aUKf_FAThvYvBwbndYLpOAAAAYI"]
[Wed Dec 17 20:20:12.744120 2025] [:error] [pid 16577:tid 16612] [client 4.218.22.35:3013] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uana.php"] [unique_id "aUKf_OOuBdGpNNQaNL40zgAAAVg"]
[Wed Dec 17 20:20:13.029537 2025] [:error] [pid 11733:tid 11751] [client 4.218.22.35:12448] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aUKf_TzmtBRXExJb1PEm1gAAARA"]
[Wed Dec 17 20:20:13.372724 2025] [:error] [pid 16861:tid 16899] [client 4.218.22.35:2691] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aUKf_Vmas3wxi8EVIZq6kgAAAow"]
[Wed Dec 17 20:20:13.653559 2025] [:error] [pid 16861:tid 16905] [client 4.218.22.35:3032] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aUKf_Vmas3wxi8EVIZq6kwAAApI"]
[Wed Dec 17 20:20:13.983370 2025] [:error] [pid 16666:tid 16687] [client 4.218.22.35:12450] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aUKf_VAThvYvBwbndYLpOwAAAZI"]
[Wed Dec 17 20:20:14.329432 2025] [:error] [pid 11733:tid 11748] [client 4.218.22.35:2995] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aUKf_jzmtBRXExJb1PEm1wAAAQ0"]
[Wed Dec 17 20:20:14.613272 2025] [:error] [pid 45530:tid 45551] [client 4.218.22.35:12470] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aUKf_m4IsXcKlf7LWf8zSQAAABA"]
[Wed Dec 17 20:20:14.906328 2025] [:error] [pid 11733:tid 11754] [client 4.218.22.35:3043] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aUKf_jzmtBRXExJb1PEm2AAAARM"]
[Wed Dec 17 20:20:15.285561 2025] [:error] [pid 45531:tid 45583] [client 4.218.22.35:2737] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aUKf_4juE-Fd-sBWjvWMiAAAAFQ"]
[Wed Dec 17 20:20:15.571114 2025] [:error] [pid 11733:tid 11756] [client 4.218.22.35:3051] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api.php"] [unique_id "aUKf_zzmtBRXExJb1PEm2QAAARU"]
[Wed Dec 17 20:20:15.851337 2025] [:error] [pid 16666:tid 16689] [client 4.218.22.35:2949] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api.php"] [unique_id "aUKf_1AThvYvBwbndYLpPgAAAZQ"]
[Wed Dec 17 20:20:16.203540 2025] [:error] [pid 45531:tid 45585] [client 4.218.22.35:12476] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api.php"] [unique_id "aUKgAIjuE-Fd-sBWjvWMjAAAAFY"]
[Wed Dec 17 20:20:16.498379 2025] [:error] [pid 45531:tid 45574] [client 4.218.22.35:3063] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api.php"] [unique_id "aUKgAIjuE-Fd-sBWjvWMjgAAAEs"]
[Wed Dec 17 20:20:16.777396 2025] [:error] [pid 45621:tid 45641] [client 4.218.22.35:2694] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inc.php"] [unique_id "aUKgAOVNGQfJ1rR90pSKFQAAAM8"]
[Wed Dec 17 20:20:17.157377 2025] [:error] [pid 16577:tid 16589] [client 4.218.22.35:3069] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inc.php"] [unique_id "aUKgAeOuBdGpNNQaNL400AAAAUE"]
[Wed Dec 17 20:20:17.459986 2025] [:error] [pid 45621:tid 45632] [client 4.218.22.35:2709] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inc.php"] [unique_id "aUKgAeVNGQfJ1rR90pSKFwAAAMY"]
[Wed Dec 17 20:20:17.780080 2025] [:error] [pid 45621:tid 45647] [client 4.218.22.35:3033] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inc.php"] [unique_id "aUKgAeVNGQfJ1rR90pSKGAAAANU"]
[Wed Dec 17 20:20:18.072415 2025] [:error] [pid 16861:tid 16906] [client 4.218.22.35:12472] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aUKgAlmas3wxi8EVIZq6mgAAApM"]
[Wed Dec 17 20:20:18.371115 2025] [:error] [pid 16666:tid 16669] [client 4.218.22.35:12430] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aUKgAlAThvYvBwbndYLpQwAAAYA"]
[Wed Dec 17 20:20:18.762191 2025] [:error] [pid 45530:tid 45538] [client 4.218.22.35:2740] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aUKgAm4IsXcKlf7LWf8zTAAAAAM"]
[Wed Dec 17 20:20:19.064331 2025] [:error] [pid 16861:tid 16893] [client 4.218.22.35:3058] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aUKgA1mas3wxi8EVIZq6nAAAAoY"]
[Wed Dec 17 20:20:19.381543 2025] [:error] [pid 11733:tid 11739] [client 4.218.22.35:2704] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-rex4.php7"] [unique_id "aUKgAzzmtBRXExJb1PEm2gAAAQQ"]
[Wed Dec 17 20:20:19.759356 2025] [:error] [pid 45531:tid 45581] [client 4.218.22.35:12478] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-rex4.php7"] [unique_id "aUKgA4juE-Fd-sBWjvWMkQAAAFI"]
[Wed Dec 17 20:20:20.090733 2025] [:error] [pid 16861:tid 16900] [client 4.218.22.35:12456] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-rex4.php7"] [unique_id "aUKgBFmas3wxi8EVIZq6ngAAAo0"]
[Wed Dec 17 20:20:20.419739 2025] [:error] [pid 11733:tid 11759] [client 4.218.22.35:2710] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-rex4.php7"] [unique_id "aUKgBDzmtBRXExJb1PEm3AAAARg"]
[Wed Dec 17 20:20:20.745111 2025] [:error] [pid 45621:tid 45649] [client 4.218.22.35:12513] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aUKgBOVNGQfJ1rR90pSKGgAAANc"]
[Wed Dec 17 20:20:30.055427 2025] [:error] [pid 11733:tid 11758] [client 4.218.22.35:12434] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api.php"] [unique_id "aUKgDjzmtBRXExJb1PEnAQAAARc"]
[Wed Dec 17 20:20:30.463495 2025] [:error] [pid 16704:tid 16710] [client 4.218.22.35:2892] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api.php"] [unique_id "aUKgDqAnp3ottQtykbRhBQAAAcE"]
[Wed Dec 17 20:20:31.219300 2025] [:error] [pid 11733:tid 11749] [client 4.218.22.35:3040] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api.php"] [unique_id "aUKgDzzmtBRXExJb1PEnAwAAAQ4"]
[Wed Dec 17 20:20:31.807585 2025] [:error] [pid 16666:tid 16673] [client 4.218.22.35:3021] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api.php"] [unique_id "aUKgD1AThvYvBwbndYLpVwAAAYQ"]
[Wed Dec 17 20:20:32.139177 2025] [:error] [pid 16746:tid 16752] [client 4.218.22.35:3060] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aUKgEI-UihQezEh5cyO4UwAAAgA"]
[Wed Dec 17 20:20:32.477091 2025] [:error] [pid 16746:tid 16759] [client 4.218.22.35:2697] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aUKgEI-UihQezEh5cyO4VAAAAgc"]
[Wed Dec 17 20:20:32.797636 2025] [:error] [pid 16577:tid 16594] [client 4.218.22.35:2693] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aUKgEOOuBdGpNNQaNL402wAAAUY"]
[Wed Dec 17 20:20:33.103485 2025] [:error] [pid 11733:tid 11740] [client 4.218.22.35:2980] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aUKgETzmtBRXExJb1PEnBwAAAQU"]
[Wed Dec 17 20:20:33.624497 2025] [:error] [pid 16746:tid 16762] [client 4.218.22.35:2954] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atom.php"] [unique_id "aUKgEY-UihQezEh5cyO4VwAAAgo"]
[Wed Dec 17 20:20:33.996618 2025] [:error] [pid 16746:tid 16765] [client 4.218.22.35:12462] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atom.php"] [unique_id "aUKgEY-UihQezEh5cyO4WAAAAg0"]
[Wed Dec 17 20:20:34.373364 2025] [:error] [pid 16746:tid 16761] [client 4.218.22.35:3027] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atom.php"] [unique_id "aUKgEo-UihQezEh5cyO4WQAAAgk"]
[Wed Dec 17 20:20:34.714897 2025] [:error] [pid 16704:tid 16728] [client 4.218.22.35:3047] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atom.php"] [unique_id "aUKgEqAnp3ottQtykbRhCQAAAdM"]
[Wed Dec 17 20:20:35.003238 2025] [:error] [pid 16704:tid 16720] [client 4.218.22.35:3065] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/case.php"] [unique_id "aUKgE6Anp3ottQtykbRhCgAAAcs"]
[Wed Dec 17 20:20:35.388431 2025] [:error] [pid 16704:tid 16712] [client 4.218.22.35:3067] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/case.php"] [unique_id "aUKgE6Anp3ottQtykbRhCwAAAcM"]
[Wed Dec 17 20:20:35.717244 2025] [:error] [pid 16861:tid 16911] [client 4.218.22.35:2696] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/case.php"] [unique_id "aUKgE1mas3wxi8EVIZq6uQAAApg"]
[Wed Dec 17 20:20:36.166194 2025] [:error] [pid 16704:tid 16714] [client 4.218.22.35:3059] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/case.php"] [unique_id "aUKgFKAnp3ottQtykbRhDgAAAcU"]
[Wed Dec 17 20:20:36.593135 2025] [:error] [pid 45530:tid 45559] [client 4.218.22.35:3016] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/docs.php"] [unique_id "aUKgFG4IsXcKlf7LWf8zUwAAABg"]
[Wed Dec 17 20:20:37.098162 2025] [:error] [pid 16861:tid 16899] [client 4.218.22.35:2749] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/docs.php"] [unique_id "aUKgFVmas3wxi8EVIZq6vgAAAow"]
[Wed Dec 17 20:20:37.467422 2025] [:error] [pid 45531:tid 45585] [client 4.218.22.35:2692] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/docs.php"] [unique_id "aUKgFYjuE-Fd-sBWjvWMqwAAAFY"]
[Wed Dec 17 20:20:37.873035 2025] [:error] [pid 45531:tid 45564] [client 4.218.22.35:2708] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/docs.php"] [unique_id "aUKgFYjuE-Fd-sBWjvWMrQAAAEE"]
[Wed Dec 17 20:20:38.238038 2025] [:error] [pid 16861:tid 16888] [client 4.218.22.35:3038] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ios.php"] [unique_id "aUKgFlmas3wxi8EVIZq6wQAAAoE"]
[Wed Dec 17 20:20:38.896057 2025] [:error] [pid 16861:tid 16893] [client 4.218.22.35:2712] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ios.php"] [unique_id "aUKgFlmas3wxi8EVIZq6wwAAAoY"]
[Wed Dec 17 20:20:39.188944 2025] [:error] [pid 16746:tid 16766] [client 4.218.22.35:3046] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ios.php"] [unique_id "aUKgF4-UihQezEh5cyO4YAAAAg4"]
[Wed Dec 17 20:20:39.795650 2025] [:error] [pid 16704:tid 16733] [client 4.218.22.35:2721] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ios.php"] [unique_id "aUKgF6Anp3ottQtykbRhFwAAAdg"]
[Wed Dec 17 20:20:40.122837 2025] [:error] [pid 45530:tid 45552] [client 4.218.22.35:2699] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aUKgGG4IsXcKlf7LWf8zVQAAABE"]
[Wed Dec 17 20:20:40.467303 2025] [:error] [pid 16704:tid 16715] [client 4.218.22.35:3055] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aUKgGKAnp3ottQtykbRhGQAAAcY"]
[Wed Dec 17 20:20:40.786125 2025] [:error] [pid 45530:tid 45535] [client 4.218.22.35:12417] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aUKgGG4IsXcKlf7LWf8zVgAAAAA"]
[Wed Dec 17 20:20:41.132973 2025] [:error] [pid 16746:tid 16757] [client 4.218.22.35:2963] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aUKgGY-UihQezEh5cyO4ZAAAAgU"]
[Wed Dec 17 20:20:41.669231 2025] [:error] [pid 11733:tid 11752] [client 4.218.22.35:2707] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aUKgGTzmtBRXExJb1PEnFQAAARE"]
[Wed Dec 17 20:20:42.054994 2025] [:error] [pid 16666:tid 16669] [client 4.218.22.35:2887] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aUKgGlAThvYvBwbndYLpXgAAAYA"]
[Wed Dec 17 20:20:42.477358 2025] [:error] [pid 16704:tid 16718] [client 4.218.22.35:3018] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aUKgGqAnp3ottQtykbRhHgAAAck"]
[Wed Dec 17 20:20:42.812115 2025] [:error] [pid 16861:tid 16898] [client 4.218.22.35:2945] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aUKgGlmas3wxi8EVIZq6xwAAAos"]
[Wed Dec 17 20:20:43.157878 2025] [:error] [pid 16861:tid 16899] [client 4.218.22.35:3012] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aUKgG1mas3wxi8EVIZq6yAAAAow"]
[Wed Dec 17 20:20:43.447751 2025] [:error] [pid 16861:tid 16906] [client 4.218.22.35:2698] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aUKgG1mas3wxi8EVIZq6yQAAApM"]
[Wed Dec 17 20:20:43.849411 2025] [:error] [pid 16704:tid 16719] [client 4.218.22.35:2733] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aUKgG6Anp3ottQtykbRhIAAAAco"]
[Wed Dec 17 20:20:44.166038 2025] [:error] [pid 16704:tid 16710] [client 4.218.22.35:2944] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aUKgHKAnp3ottQtykbRhIgAAAcE"]
[Wed Dec 17 20:20:44.521834 2025] [:error] [pid 16861:tid 16888] [client 4.218.22.35:2743] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aUKgHFmas3wxi8EVIZq6ywAAAoE"]
[Wed Dec 17 20:20:44.944300 2025] [:error] [pid 16666:tid 16682] [client 4.218.22.35:2958] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aUKgHFAThvYvBwbndYLpYgAAAY0"]
[Wed Dec 17 20:20:45.293898 2025] [:error] [pid 16666:tid 16691] [client 4.218.22.35:3068] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aUKgHVAThvYvBwbndYLpZgAAAZY"]
[Wed Dec 17 20:20:45.596873 2025] [:error] [pid 16666:tid 16686] [client 4.218.22.35:2968] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aUKgHVAThvYvBwbndYLpaQAAAZE"]
[Wed Dec 17 20:20:45.931380 2025] [:error] [pid 45531:tid 45567] [client 4.218.22.35:2891] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aUKgHYjuE-Fd-sBWjvWMrgAAAEQ"]
[Wed Dec 17 20:20:46.258439 2025] [:error] [pid 16788:tid 16811] [client 4.218.22.35:12451] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aUKgHiEJyT-03u9UZWO8NwAAAlU"]
[Wed Dec 17 20:20:46.609063 2025] [:error] [pid 16746:tid 16778] [client 4.218.22.35:2732] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aUKgHo-UihQezEh5cyO4aAAAAhg"]
[Wed Dec 17 20:20:47.206252 2025] [:error] [pid 11733:tid 11759] [client 4.218.22.35:3008] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aUKgHzzmtBRXExJb1PEnHQAAARg"]
[Wed Dec 17 20:20:47.550698 2025] [:error] [pid 16666:tid 16669] [client 4.218.22.35:2727] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aUKgH1AThvYvBwbndYLpdgAAAYA"]
[Wed Dec 17 20:20:47.878048 2025] [:error] [pid 16577:tid 16597] [client 4.218.22.35:2959] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aUKgH-OuBdGpNNQaNL407AAAAUk"]
[Wed Dec 17 20:20:48.292024 2025] [:error] [pid 16666:tid 16682] [client 4.218.22.35:2730] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aUKgIFAThvYvBwbndYLpdwAAAY0"]
[Wed Dec 17 20:20:48.744335 2025] [:error] [pid 16746:tid 16777] [client 4.218.22.35:2731] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aUKgII-UihQezEh5cyO4aQAAAhc"]
[Wed Dec 17 20:20:49.097254 2025] [:error] [pid 16861:tid 16907] [client 4.218.22.35:2947] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f.php"] [unique_id "aUKgIVmas3wxi8EVIZq60gAAApQ"]
[Wed Dec 17 20:20:49.732663 2025] [:error] [pid 16577:tid 16607] [client 4.218.22.35:12479] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f.php"] [unique_id "aUKgIeOuBdGpNNQaNL407QAAAVM"]
[Wed Dec 17 20:20:50.366182 2025] [:error] [pid 16577:tid 16606] [client 4.218.22.35:2746] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f.php"] [unique_id "aUKgIuOuBdGpNNQaNL407gAAAVI"]
[Wed Dec 17 20:20:50.873958 2025] [:error] [pid 16746:tid 16767] [client 4.218.22.35:2735] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f.php"] [unique_id "aUKgIo-UihQezEh5cyO4bAAAAg8"]
[Wed Dec 17 20:20:51.724930 2025] [:error] [pid 45531:tid 45563] [client 4.218.22.35:12533] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/max.php"] [unique_id "aUKgI4juE-Fd-sBWjvWMsQAAAEA"]
[Wed Dec 17 20:20:52.331518 2025] [:error] [pid 45621:tid 45629] [client 4.218.22.35:2884] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/max.php"] [unique_id "aUKgJOVNGQfJ1rR90pSKKwAAAMM"]
[Wed Dec 17 20:20:52.822332 2025] [:error] [pid 16666:tid 16673] [client 4.218.22.35:2961] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/max.php"] [unique_id "aUKgJFAThvYvBwbndYLpfwAAAYQ"]
[Wed Dec 17 20:20:53.337589 2025] [:error] [pid 16666:tid 16669] [client 4.218.22.35:3010] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/max.php"] [unique_id "aUKgJVAThvYvBwbndYLpgQAAAYA"]
[Wed Dec 17 20:20:53.678341 2025] [:error] [pid 45621:tid 45630] [client 4.218.22.35:2713] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aUKgJeVNGQfJ1rR90pSKLAAAAMQ"]
[Wed Dec 17 20:20:54.169637 2025] [:error] [pid 45621:tid 45645] [client 4.218.22.35:2895] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aUKgJuVNGQfJ1rR90pSKLQAAANM"]
[Wed Dec 17 20:20:54.917098 2025] [:error] [pid 45530:tid 45547] [client 4.218.22.35:2974] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aUKgJm4IsXcKlf7LWf8zXwAAAAw"]
[Wed Dec 17 20:20:55.792357 2025] [:error] [pid 16666:tid 16678] [client 4.218.22.35:2989] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aUKgJ1AThvYvBwbndYLphAAAAYk"]
[Wed Dec 17 20:20:56.344383 2025] [:error] [pid 45531:tid 45569] [client 4.218.22.35:2973] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aUKgKIjuE-Fd-sBWjvWMswAAAEY"]
[Wed Dec 17 20:20:56.766379 2025] [:error] [pid 16577:tid 16593] [client 4.218.22.35:2881] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aUKgKOOuBdGpNNQaNL409gAAAUU"]
[Wed Dec 17 20:20:57.385536 2025] [:error] [pid 16666:tid 16688] [client 4.218.22.35:3050] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aUKgKVAThvYvBwbndYLpiAAAAZM"]
[Wed Dec 17 20:20:57.902814 2025] [:error] [pid 16746:tid 16774] [client 4.218.22.35:12519] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aUKgKY-UihQezEh5cyO4cAAAAhQ"]
[Wed Dec 17 20:20:58.469975 2025] [:error] [pid 16704:tid 16720] [client 4.218.22.35:2726] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "aUKgKqAnp3ottQtykbRhJAAAAcs"]
[Wed Dec 17 20:20:58.857740 2025] [:error] [pid 16861:tid 16893] [client 4.218.22.35:2703] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "aUKgKlmas3wxi8EVIZq61gAAAoY"]
[Wed Dec 17 20:20:59.172164 2025] [:error] [pid 16666:tid 16687] [client 4.218.22.35:12469] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "aUKgK1AThvYvBwbndYLpiwAAAZI"]
[Wed Dec 17 20:20:59.546107 2025] [:error] [pid 16577:tid 16596] [client 4.218.22.35:2744] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "aUKgK-OuBdGpNNQaNL40-QAAAUg"]
[Wed Dec 17 20:20:59.969892 2025] [:error] [pid 16861:tid 16902] [client 4.218.22.35:12504] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aUKgK1mas3wxi8EVIZq61wAAAo8"]
[Wed Dec 17 20:21:00.361755 2025] [:error] [pid 16861:tid 16904] [client 4.218.22.35:2967] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aUKgLFmas3wxi8EVIZq62AAAApE"]
[Wed Dec 17 20:21:00.707213 2025] [:error] [pid 16861:tid 16901] [client 4.218.22.35:2728] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aUKgLFmas3wxi8EVIZq62QAAAo4"]
[Wed Dec 17 20:21:00.994286 2025] [:error] [pid 16746:tid 16778] [client 4.218.22.35:2688] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aUKgLI-UihQezEh5cyO4cgAAAhg"]
[Wed Dec 17 20:21:01.329337 2025] [:error] [pid 16666:tid 16679] [client 4.218.22.35:2953] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vv.php"] [unique_id "aUKgLVAThvYvBwbndYLpjQAAAYo"]
[Wed Dec 17 20:21:01.651541 2025] [:error] [pid 16861:tid 16892] [client 4.218.22.35:2982] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vv.php"] [unique_id "aUKgLVmas3wxi8EVIZq63AAAAoU"]
[Wed Dec 17 20:21:01.959854 2025] [:error] [pid 45621:tid 45647] [client 4.218.22.35:2964] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vv.php"] [unique_id "aUKgLeVNGQfJ1rR90pSKMQAAANU"]
[Wed Dec 17 20:21:02.305338 2025] [:error] [pid 16577:tid 16602] [client 4.218.22.35:2747] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vv.php"] [unique_id "aUKgLuOuBdGpNNQaNL40-wAAAU4"]
[Wed Dec 17 20:21:02.584871 2025] [:error] [pid 16746:tid 16763] [client 4.218.22.35:3048] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aUKgLo-UihQezEh5cyO4dQAAAgs"]
[Wed Dec 17 20:21:02.890383 2025] [:error] [pid 16704:tid 16731] [client 4.218.22.35:2715] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aUKgLqAnp3ottQtykbRhKgAAAdY"]
[Wed Dec 17 20:21:03.187811 2025] [:error] [pid 16746:tid 16777] [client 4.218.22.35:2976] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aUKgL4-UihQezEh5cyO4dgAAAhc"]
[Wed Dec 17 20:21:03.529669 2025] [:error] [pid 45531:tid 45565] [client 4.218.22.35:2991] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aUKgL4juE-Fd-sBWjvWMuAAAAEI"]
[Wed Dec 17 20:21:03.872672 2025] [:error] [pid 45530:tid 45539] [client 4.218.22.35:2897] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aUKgL24IsXcKlf7LWf8zZwAAAAQ"]
[Wed Dec 17 20:21:04.198189 2025] [:error] [pid 16746:tid 16759] [client 4.218.22.35:2955] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aUKgMI-UihQezEh5cyO4eAAAAgc"]
[Wed Dec 17 20:21:04.502602 2025] [:error] [pid 45531:tid 45568] [client 4.218.22.35:3070] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aUKgMIjuE-Fd-sBWjvWMuQAAAEU"]
[Wed Dec 17 20:21:04.814824 2025] [:error] [pid 16746:tid 16773] [client 4.218.22.35:2981] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aUKgMI-UihQezEh5cyO4eQAAAhM"]
[Wed Dec 17 20:21:05.325282 2025] [:error] [pid 11733:tid 11758] [client 4.218.22.35:2946] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aUKgMTzmtBRXExJb1PEnJwAAARc"]
[Wed Dec 17 20:21:05.721118 2025] [:error] [pid 11733:tid 11738] [client 4.218.22.35:2998] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aUKgMTzmtBRXExJb1PEnKAAAAQM"]
[Wed Dec 17 20:21:06.006291 2025] [:error] [pid 45531:tid 45571] [client 4.218.22.35:2966] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aUKgMojuE-Fd-sBWjvWMuwAAAEg"]
[Wed Dec 17 20:21:06.343932 2025] [:error] [pid 45621:tid 45630] [client 4.218.22.35:3071] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aUKgMuVNGQfJ1rR90pSKNwAAAMQ"]
[Wed Dec 17 20:21:06.776877 2025] [:error] [pid 16666:tid 16686] [client 4.218.22.35:2718] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aUKgMlAThvYvBwbndYLpjwAAAZE"]
[Wed Dec 17 20:21:07.063518 2025] [:error] [pid 16577:tid 16592] [client 4.218.22.35:2885] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aUKgM-OuBdGpNNQaNL40_AAAAUQ"]
[Wed Dec 17 20:21:07.558209 2025] [:error] [pid 11733:tid 11747] [client 4.218.22.35:2972] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aUKgMzzmtBRXExJb1PEnLAAAAQw"]
[Wed Dec 17 20:21:07.890725 2025] [:error] [pid 45530:tid 45557] [client 4.218.22.35:12448] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aUKgM24IsXcKlf7LWf8zagAAABY"]
[Wed Dec 17 20:21:08.197225 2025] [:error] [pid 11733:tid 11752] [client 4.218.22.35:2927] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aUKgNDzmtBRXExJb1PEnLwAAARE"]
[Wed Dec 17 20:21:08.499946 2025] [:error] [pid 11733:tid 11744] [client 4.218.22.35:2951] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aUKgNDzmtBRXExJb1PEnMAAAAQk"]
[Wed Dec 17 20:21:08.772250 2025] [:error] [pid 11733:tid 11740] [client 4.218.22.35:2987] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aUKgNDzmtBRXExJb1PEnMQAAAQU"]
[Wed Dec 17 20:21:09.121360 2025] [:error] [pid 16704:tid 16714] [client 4.218.22.35:2979] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aUKgNaAnp3ottQtykbRhLgAAAcU"]
[Wed Dec 17 20:21:09.482259 2025] [:error] [pid 45530:tid 45559] [client 4.218.22.35:3015] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aUKgNW4IsXcKlf7LWf8zbAAAABg"]
[Wed Dec 17 20:21:09.799987 2025] [:error] [pid 16704:tid 16730] [client 4.218.22.35:12453] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aUKgNaAnp3ottQtykbRhLwAAAdU"]
[Wed Dec 17 20:21:10.119408 2025] [:error] [pid 16704:tid 16709] [client 4.218.22.35:2745] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aUKgNqAnp3ottQtykbRhMAAAAcA"]
[Wed Dec 17 20:21:10.422077 2025] [:error] [pid 16704:tid 16721] [client 4.218.22.35:3062] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aUKgNqAnp3ottQtykbRhMgAAAcw"]
[Wed Dec 17 20:21:10.831427 2025] [:error] [pid 16704:tid 16711] [client 4.218.22.35:3037] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aUKgNqAnp3ottQtykbRhNAAAAcI"]
[Wed Dec 17 20:21:11.144300 2025] [:error] [pid 16704:tid 16718] [client 4.218.22.35:2729] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aUKgN6Anp3ottQtykbRhNQAAAck"]
[Wed Dec 17 20:21:11.451836 2025] [:error] [pid 16746:tid 16753] [client 4.218.22.35:2848] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aUKgN4-UihQezEh5cyO4fQAAAgE"]
[Wed Dec 17 20:21:11.746768 2025] [:error] [pid 16861:tid 16897] [client 4.218.22.35:2906] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aUKgN1mas3wxi8EVIZq65gAAAoo"]
[Wed Dec 17 20:21:12.057984 2025] [:error] [pid 16704:tid 16713] [client 4.218.22.35:2990] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aUKgOKAnp3ottQtykbRhNgAAAcQ"]
[Wed Dec 17 20:21:12.375982 2025] [:error] [pid 45530:tid 45548] [client 4.218.22.35:2926] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aUKgOG4IsXcKlf7LWf8zbgAAAA0"]
[Wed Dec 17 20:21:12.683678 2025] [:error] [pid 16704:tid 16726] [client 4.218.22.35:3061] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aUKgOKAnp3ottQtykbRhNwAAAdE"]
[Wed Dec 17 20:21:13.019636 2025] [:error] [pid 16788:tid 16813] [client 4.218.22.35:2818] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aUKgOSEJyT-03u9UZWO8QgAAAlc"]
[Wed Dec 17 20:21:13.350812 2025] [:error] [pid 16788:tid 16806] [client 4.218.22.35:2817] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/go.php"] [unique_id "aUKgOSEJyT-03u9UZWO8RAAAAlA"]
[Wed Dec 17 20:21:13.641675 2025] [:error] [pid 16704:tid 16731] [client 4.218.22.35:2723] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/go.php"] [unique_id "aUKgOaAnp3ottQtykbRhOQAAAdY"]
[Wed Dec 17 20:21:14.016290 2025] [:error] [pid 16704:tid 16719] [client 4.218.22.35:2957] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/go.php"] [unique_id "aUKgOqAnp3ottQtykbRhOwAAAco"]
[Wed Dec 17 20:21:14.395352 2025] [:error] [pid 16704:tid 16724] [client 4.218.22.35:3006] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/go.php"] [unique_id "aUKgOqAnp3ottQtykbRhPAAAAc8"]
[Wed Dec 17 20:21:14.722225 2025] [:error] [pid 16704:tid 16710] [client 4.218.22.35:2742] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aUKgOqAnp3ottQtykbRhPgAAAcE"]
[Wed Dec 17 20:21:15.060665 2025] [:error] [pid 16746:tid 16752] [client 4.218.22.35:2943] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aUKgO4-UihQezEh5cyO4gAAAAgA"]
[Wed Dec 17 20:21:15.348825 2025] [:error] [pid 16788:tid 16812] [client 4.218.22.35:2975] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aUKgOyEJyT-03u9UZWO8SgAAAlY"]
[Wed Dec 17 20:21:15.686136 2025] [:error] [pid 16666:tid 16689] [client 4.218.22.35:2939] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aUKgO1AThvYvBwbndYLpkwAAAZQ"]
[Wed Dec 17 20:21:15.984664 2025] [:error] [pid 16704:tid 16716] [client 4.218.22.35:12454] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aUKgO6Anp3ottQtykbRhQQAAAcc"]
[Wed Dec 17 20:21:16.328094 2025] [:error] [pid 16704:tid 16729] [client 4.218.22.35:3009] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aUKgPKAnp3ottQtykbRhQgAAAdQ"]
[Wed Dec 17 20:21:16.713625 2025] [:error] [pid 16704:tid 16714] [client 4.218.22.35:2929] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aUKgPKAnp3ottQtykbRhRAAAAcU"]
[Wed Dec 17 20:21:17.109830 2025] [:error] [pid 16788:tid 16814] [client 4.218.22.35:2900] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aUKgPSEJyT-03u9UZWO8SwAAAlg"]
[Wed Dec 17 20:21:17.475217 2025] [:error] [pid 16666:tid 16685] [client 4.218.22.35:2689] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conflg.php"] [unique_id "aUKgPVAThvYvBwbndYLplQAAAZA"]
[Wed Dec 17 20:21:17.830964 2025] [:error] [pid 16666:tid 16669] [client 4.218.22.35:3000] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conflg.php"] [unique_id "aUKgPVAThvYvBwbndYLplgAAAYA"]
[Wed Dec 17 20:21:18.140086 2025] [:error] [pid 16746:tid 16776] [client 4.218.22.35:2888] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conflg.php"] [unique_id "aUKgPo-UihQezEh5cyO4igAAAhY"]
[Wed Dec 17 20:21:18.448740 2025] [:error] [pid 16746:tid 16765] [client 4.218.22.35:2997] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conflg.php"] [unique_id "aUKgPo-UihQezEh5cyO4iwAAAg0"]
[Wed Dec 17 20:21:18.821615 2025] [:error] [pid 16788:tid 16807] [client 4.218.22.35:2992] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aUKgPiEJyT-03u9UZWO8TQAAAlE"]
[Wed Dec 17 20:21:19.306660 2025] [:error] [pid 16788:tid 16809] [client 4.218.22.35:2882] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aUKgPyEJyT-03u9UZWO8TgAAAlM"]
[Wed Dec 17 20:21:19.655629 2025] [:error] [pid 16704:tid 16718] [client 4.218.22.35:2914] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aUKgP6Anp3ottQtykbRhSQAAAck"]
[Wed Dec 17 20:21:20.108045 2025] [:error] [pid 16666:tid 16682] [client 4.218.22.35:2994] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aUKgQFAThvYvBwbndYLpmAAAAY0"]
[Wed Dec 17 20:21:20.643059 2025] [:error] [pid 11733:tid 11738] [client 4.218.22.35:2896] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asas.php"] [unique_id "aUKgQDzmtBRXExJb1PEnMwAAAQM"]
[Wed Dec 17 20:21:20.974720 2025] [:error] [pid 16704:tid 16719] [client 4.218.22.35:2722] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asas.php"] [unique_id "aUKgQKAnp3ottQtykbRhSwAAAco"]
[Wed Dec 17 20:21:21.482689 2025] [:error] [pid 16861:tid 16899] [client 4.218.22.35:2734] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asas.php"] [unique_id "aUKgQVmas3wxi8EVIZq66wAAAow"]
[Wed Dec 17 20:21:22.241477 2025] [:error] [pid 16704:tid 16710] [client 4.218.22.35:2999] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asas.php"] [unique_id "aUKgQqAnp3ottQtykbRhTAAAAcE"]
[Wed Dec 17 20:21:22.945136 2025] [:error] [pid 16704:tid 16733] [client 4.218.22.35:2925] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aUKgQqAnp3ottQtykbRhTQAAAdg"]
[Wed Dec 17 20:21:23.255734 2025] [:error] [pid 16577:tid 16593] [client 4.218.22.35:2978] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aUKgQ-OuBdGpNNQaNL40_wAAAUU"]
[Wed Dec 17 20:21:23.754896 2025] [:error] [pid 11733:tid 11744] [client 4.218.22.35:2725] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aUKgQzzmtBRXExJb1PEnPgAAAQk"]
[Wed Dec 17 20:21:24.243576 2025] [:error] [pid 16704:tid 16729] [client 4.218.22.35:12491] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aUKgRKAnp3ottQtykbRhTwAAAdQ"]
[Wed Dec 17 20:21:24.659614 2025] [:error] [pid 16577:tid 16609] [client 4.218.22.35:2928] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aUKgROOuBdGpNNQaNL41AQAAAVU"]
[Wed Dec 17 20:21:24.950284 2025] [:error] [pid 11733:tid 11743] [client 4.218.22.35:2736] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aUKgRDzmtBRXExJb1PEnRQAAAQg"]
[Wed Dec 17 20:21:25.479919 2025] [:error] [pid 45621:tid 45626] [client 4.218.22.35:2917] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aUKgReVNGQfJ1rR90pSKPwAAAMA"]
[Wed Dec 17 20:21:25.770968 2025] [:error] [pid 16704:tid 16713] [client 4.218.22.35:2915] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aUKgRaAnp3ottQtykbRhVAAAAcQ"]
[Wed Dec 17 20:21:26.137103 2025] [:error] [pid 16666:tid 16692] [client 4.218.22.35:2977] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "aUKgRlAThvYvBwbndYLpnQAAAZc"]
[Wed Dec 17 20:21:26.743544 2025] [:error] [pid 11733:tid 11758] [client 4.218.22.35:2899] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "aUKgRjzmtBRXExJb1PEnSQAAARc"]
[Wed Dec 17 20:21:27.357178 2025] [:error] [pid 16577:tid 16604] [client 4.218.22.35:2695] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "aUKgR-OuBdGpNNQaNL41BQAAAVA"]
[Wed Dec 17 20:21:27.861744 2025] [:error] [pid 16704:tid 16726] [client 4.218.22.35:2711] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "aUKgR6Anp3ottQtykbRhVgAAAdE"]
[Wed Dec 17 20:21:28.535967 2025] [:error] [pid 16577:tid 16596] [client 4.218.22.35:2709] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aUKgSOOuBdGpNNQaNL41BwAAAUg"]
[Wed Dec 17 20:21:28.943133 2025] [:error] [pid 16861:tid 16906] [client 4.218.22.35:2839] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aUKgSFmas3wxi8EVIZq67AAAApM"]
[Wed Dec 17 20:21:39.059132 2025] [:error] [pid 11733:tid 11758] [client 4.218.22.35:2948] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aUKgUzzmtBRXExJb1PEnXAAAARc"]
[Wed Dec 17 20:21:39.384999 2025] [:error] [pid 16666:tid 16677] [client 4.218.22.35:2904] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aUKgU1AThvYvBwbndYLpuQAAAYg"]
[Wed Dec 17 20:21:39.717749 2025] [:error] [pid 16746:tid 16752] [client 4.218.22.35:2760] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aUKgU4-UihQezEh5cyO4mAAAAgA"]
[Wed Dec 17 20:21:40.070499 2025] [:error] [pid 16746:tid 16772] [client 4.218.22.35:2919] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aUKgVI-UihQezEh5cyO4mQAAAhI"]
[Wed Dec 17 20:21:40.370312 2025] [:error] [pid 16666:tid 16685] [client 4.218.22.35:2716] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "aUKgVFAThvYvBwbndYLpvQAAAZA"]
[Wed Dec 17 20:21:40.714489 2025] [:error] [pid 45621:tid 45643] [client 4.218.22.35:2988] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "aUKgVOVNGQfJ1rR90pSKRAAAANE"]
[Wed Dec 17 20:21:41.003994 2025] [:error] [pid 45621:tid 45647] [client 4.218.22.35:2971] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "aUKgVeVNGQfJ1rR90pSKRQAAANU"]
[Wed Dec 17 20:21:41.295874 2025] [:error] [pid 45530:tid 45543] [client 4.218.22.35:2920] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "aUKgVW4IsXcKlf7LWf8zdAAAAAg"]
[Wed Dec 17 20:21:41.632929 2025] [:error] [pid 45621:tid 45635] [client 4.218.22.35:2969] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "aUKgVeVNGQfJ1rR90pSKRwAAAMk"]
[Wed Dec 17 20:21:42.057968 2025] [:error] [pid 16788:tid 16799] [client 4.218.22.35:12483] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "aUKgViEJyT-03u9UZWO8UQAAAkk"]
[Wed Dec 17 20:21:42.463089 2025] [:error] [pid 16788:tid 16813] [client 4.218.22.35:2933] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "aUKgViEJyT-03u9UZWO8UgAAAlc"]
[Wed Dec 17 20:21:42.876576 2025] [:error] [pid 16788:tid 16800] [client 4.218.22.35:2838] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "aUKgViEJyT-03u9UZWO8VAAAAko"]
[Wed Dec 17 20:21:43.255834 2025] [:error] [pid 11733:tid 11741] [client 4.218.22.35:2825] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ty.php"] [unique_id "aUKgVzzmtBRXExJb1PEnXQAAAQY"]
[Wed Dec 17 20:21:43.585789 2025] [:error] [pid 45530:tid 45540] [client 4.218.22.35:2857] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ty.php"] [unique_id "aUKgV24IsXcKlf7LWf8zdgAAAAU"]
[Wed Dec 17 20:21:43.883428 2025] [:error] [pid 11733:tid 11756] [client 4.218.22.35:2889] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ty.php"] [unique_id "aUKgVzzmtBRXExJb1PEnXwAAARU"]
[Wed Dec 17 20:21:44.307481 2025] [:error] [pid 16577:tid 16602] [client 4.218.22.35:2952] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ty.php"] [unique_id "aUKgWOOuBdGpNNQaNL41DwAAAU4"]
[Wed Dec 17 20:21:44.603905 2025] [:error] [pid 16704:tid 16717] [client 4.218.22.35:2962] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "aUKgWKAnp3ottQtykbRhaQAAAcg"]
[Wed Dec 17 20:21:44.898517 2025] [:error] [pid 45530:tid 45542] [client 4.218.22.35:2828] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "aUKgWG4IsXcKlf7LWf8zeAAAAAc"]
[Wed Dec 17 20:21:45.241660 2025] [:error] [pid 16704:tid 16718] [client 4.218.22.35:2965] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "aUKgWaAnp3ottQtykbRhagAAAck"]
[Wed Dec 17 20:21:45.630017 2025] [:error] [pid 16704:tid 16724] [client 4.218.22.35:12493] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "aUKgWaAnp3ottQtykbRhawAAAc8"]
[Wed Dec 17 20:21:45.953456 2025] [:error] [pid 16861:tid 16888] [client 4.218.22.35:2773] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aUKgWVmas3wxi8EVIZq6-AAAAoE"]
[Wed Dec 17 20:21:46.317139 2025] [:error] [pid 16666:tid 16691] [client 4.218.22.35:2822] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aUKgWlAThvYvBwbndYLpxgAAAZY"]
[Wed Dec 17 20:21:46.596532 2025] [:error] [pid 45530:tid 45537] [client 4.218.22.35:2858] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aUKgWm4IsXcKlf7LWf8zeQAAAAI"]
[Wed Dec 17 20:21:46.901800 2025] [:error] [pid 45530:tid 45550] [client 4.218.22.35:2905] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aUKgWm4IsXcKlf7LWf8zegAAAA8"]
[Wed Dec 17 20:21:47.212453 2025] [:error] [pid 45621:tid 45627] [client 4.218.22.35:2985] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/c.php"] [unique_id "aUKgW-VNGQfJ1rR90pSKSAAAAME"]
[Wed Dec 17 20:21:47.543056 2025] [:error] [pid 45530:tid 45536] [client 4.218.22.35:2833] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/c.php"] [unique_id "aUKgW24IsXcKlf7LWf8zgQAAAAE"]
[Wed Dec 17 20:21:47.845711 2025] [:error] [pid 16861:tid 16893] [client 4.218.22.35:2784] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/c.php"] [unique_id "aUKgW1mas3wxi8EVIZq6-QAAAoY"]
[Wed Dec 17 20:21:48.166623 2025] [:error] [pid 16666:tid 16679] [client 4.218.22.35:2824] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/c.php"] [unique_id "aUKgXFAThvYvBwbndYLpyAAAAYo"]
[Wed Dec 17 20:21:48.529658 2025] [:error] [pid 16666:tid 16673] [client 4.218.22.35:2916] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xo.php"] [unique_id "aUKgXFAThvYvBwbndYLpygAAAYQ"]
[Wed Dec 17 20:21:48.890480 2025] [:error] [pid 16666:tid 16669] [client 4.218.22.35:2986] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xo.php"] [unique_id "aUKgXFAThvYvBwbndYLpywAAAYA"]
[Wed Dec 17 20:21:49.209795 2025] [:error] [pid 16861:tid 16900] [client 4.218.22.35:2940] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xo.php"] [unique_id "aUKgXVmas3wxi8EVIZq6-gAAAo0"]
[Wed Dec 17 20:21:49.562150 2025] [:error] [pid 16666:tid 16676] [client 4.218.22.35:2840] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xo.php"] [unique_id "aUKgXVAThvYvBwbndYLpzAAAAYc"]
[Wed Dec 17 20:21:49.852795 2025] [:error] [pid 16666:tid 16680] [client 4.218.22.35:2844] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dlu.php"] [unique_id "aUKgXVAThvYvBwbndYLpzwAAAYs"]
[Wed Dec 17 20:21:50.157074 2025] [:error] [pid 45531:tid 45586] [client 4.218.22.35:2893] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dlu.php"] [unique_id "aUKgXojuE-Fd-sBWjvWMxgAAAFc"]
[Wed Dec 17 20:21:50.521097 2025] [:error] [pid 45531:tid 45572] [client 4.218.22.35:2837] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dlu.php"] [unique_id "aUKgXojuE-Fd-sBWjvWMxwAAAEk"]
[Wed Dec 17 20:21:50.790792 2025] [:error] [pid 16577:tid 16590] [client 4.218.22.35:2950] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dlu.php"] [unique_id "aUKgXuOuBdGpNNQaNL41EgAAAUI"]
[Wed Dec 17 20:21:51.132304 2025] [:error] [pid 45621:tid 45644] [client 4.218.22.35:2898] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rk2.php"] [unique_id "aUKgX-VNGQfJ1rR90pSKTAAAANI"]
[Wed Dec 17 20:21:51.424838 2025] [:error] [pid 45530:tid 45535] [client 4.218.22.35:2983] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rk2.php"] [unique_id "aUKgX24IsXcKlf7LWf8zgwAAAAA"]
[Wed Dec 17 20:21:51.739939 2025] [:error] [pid 45530:tid 45554] [client 4.218.22.35:2883] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rk2.php"] [unique_id "aUKgX24IsXcKlf7LWf8zhQAAABM"]
[Wed Dec 17 20:21:52.027874 2025] [:error] [pid 16746:tid 16752] [client 4.218.22.35:2894] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rk2.php"] [unique_id "aUKgYI-UihQezEh5cyO4oAAAAgA"]
[Wed Dec 17 20:21:52.313371 2025] [:error] [pid 16577:tid 16588] [client 4.218.22.35:2902] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aUKgYOOuBdGpNNQaNL41EwAAAUA"]
[Wed Dec 17 20:21:52.651383 2025] [:error] [pid 16746:tid 16772] [client 4.218.22.35:2934] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aUKgYI-UihQezEh5cyO4oQAAAhI"]
[Wed Dec 17 20:21:52.955627 2025] [:error] [pid 16704:tid 16721] [client 4.218.22.35:2912] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aUKgYKAnp3ottQtykbRhdQAAAcw"]
[Wed Dec 17 20:21:53.251712 2025] [:error] [pid 16666:tid 16670] [client 4.218.22.35:2847] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aUKgYVAThvYvBwbndYLp1wAAAYE"]
[Wed Dec 17 20:21:53.549284 2025] [:error] [pid 16666:tid 16687] [client 4.218.22.35:2738] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aUKgYVAThvYvBwbndYLp2AAAAZI"]
[Wed Dec 17 20:21:53.829285 2025] [:error] [pid 16577:tid 16603] [client 4.218.22.35:2835] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aUKgYeOuBdGpNNQaNL41FwAAAU8"]
[Wed Dec 17 20:21:54.129458 2025] [:error] [pid 16577:tid 16609] [client 4.218.22.35:3002] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aUKgYuOuBdGpNNQaNL41GAAAAVU"]
[Wed Dec 17 20:21:54.458910 2025] [:error] [pid 16666:tid 16689] [client 4.218.22.35:2816] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aUKgYlAThvYvBwbndYLp3AAAAZQ"]
[Wed Dec 17 20:21:54.870597 2025] [:error] [pid 16861:tid 16902] [client 4.218.22.35:2826] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aUKgYlmas3wxi8EVIZq6-wAAAo8"]
[Wed Dec 17 20:21:55.187254 2025] [:error] [pid 16861:tid 16895] [client 4.218.22.35:3004] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aUKgY1mas3wxi8EVIZq6_QAAAog"]
[Wed Dec 17 20:21:55.484043 2025] [:error] [pid 16788:tid 16801] [client 4.218.22.35:2956] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aUKgYyEJyT-03u9UZWO8WAAAAks"]
[Wed Dec 17 20:21:55.780481 2025] [:error] [pid 16577:tid 16598] [client 4.218.22.35:2909] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aUKgY-OuBdGpNNQaNL41HAAAAUo"]
[Wed Dec 17 20:21:56.085676 2025] [:error] [pid 16861:tid 16892] [client 4.218.22.35:2876] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aUKgZFmas3wxi8EVIZq6_wAAAoU"]
[Wed Dec 17 20:21:56.374221 2025] [:error] [pid 16666:tid 16684] [client 4.218.22.35:2931] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aUKgZFAThvYvBwbndYLp4gAAAY8"]
[Wed Dec 17 20:21:56.650931 2025] [:error] [pid 16666:tid 16671] [client 4.218.22.35:2762] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aUKgZFAThvYvBwbndYLp4wAAAYI"]
[Wed Dec 17 20:21:57.006532 2025] [:error] [pid 45530:tid 45547] [client 4.218.22.35:2907] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aUKgZW4IsXcKlf7LWf8zhwAAAAw"]
[Wed Dec 17 20:21:57.295154 2025] [:error] [pid 16746:tid 16776] [client 4.218.22.35:2706] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/406.php"] [unique_id "aUKgZY-UihQezEh5cyO4owAAAhY"]
[Wed Dec 17 20:21:57.615535 2025] [:error] [pid 16746:tid 16765] [client 4.218.22.35:2908] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/406.php"] [unique_id "aUKgZY-UihQezEh5cyO4pAAAAg0"]
[Wed Dec 17 20:21:58.013364 2025] [:error] [pid 16861:tid 16901] [client 4.218.22.35:2730] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/406.php"] [unique_id "aUKgZlmas3wxi8EVIZq7AAAAAo4"]
[Wed Dec 17 20:21:58.292836 2025] [:error] [pid 16704:tid 16727] [client 4.218.22.35:2877] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/406.php"] [unique_id "aUKgZqAnp3ottQtykbRhfgAAAdI"]
[Wed Dec 17 20:21:58.638949 2025] [:error] [pid 16746:tid 16762] [client 4.218.22.35:2764] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mariju.php"] [unique_id "aUKgZo-UihQezEh5cyO4pgAAAgo"]
[Wed Dec 17 20:21:58.932878 2025] [:error] [pid 11733:tid 11757] [client 4.218.22.35:2849] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mariju.php"] [unique_id "aUKgZjzmtBRXExJb1PEnaQAAARY"]
[Wed Dec 17 20:21:59.255403 2025] [:error] [pid 45530:tid 45553] [client 4.218.22.35:2821] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mariju.php"] [unique_id "aUKgZ24IsXcKlf7LWf8zjgAAABI"]
[Wed Dec 17 20:21:59.541432 2025] [:error] [pid 16788:tid 16798] [client 4.218.22.35:2724] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mariju.php"] [unique_id "aUKgZyEJyT-03u9UZWO8XAAAAkg"]
[Wed Dec 17 20:21:59.846268 2025] [:error] [pid 16666:tid 16688] [client 4.218.22.35:2846] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aUKgZ1AThvYvBwbndYLp6gAAAZM"]
[Wed Dec 17 20:22:00.179399 2025] [:error] [pid 16788:tid 16791] [client 4.218.22.35:2970] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aUKgaCEJyT-03u9UZWO8XQAAAkE"]
[Wed Dec 17 20:22:00.486340 2025] [:error] [pid 16788:tid 16803] [client 4.218.22.35:2770] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aUKgaCEJyT-03u9UZWO8XgAAAk0"]
[Wed Dec 17 20:22:00.784432 2025] [:error] [pid 45531:tid 45580] [client 4.218.22.35:2754] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aUKgaIjuE-Fd-sBWjvWMzAAAAFE"]
[Wed Dec 17 20:22:01.067482 2025] [:error] [pid 16577:tid 16611] [client 4.218.22.35:2901] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cache.php"] [unique_id "aUKgaeOuBdGpNNQaNL41HwAAAVc"]
[Wed Dec 17 20:22:01.383988 2025] [:error] [pid 16746:tid 16777] [client 4.218.22.35:2795] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cache.php"] [unique_id "aUKgaY-UihQezEh5cyO4qAAAAhc"]
[Wed Dec 17 20:22:01.706975 2025] [:error] [pid 16666:tid 16692] [client 4.218.22.35:2922] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cache.php"] [unique_id "aUKgaVAThvYvBwbndYLp7AAAAZc"]
[Wed Dec 17 20:22:02.063210 2025] [:error] [pid 16788:tid 16800] [client 4.218.22.35:12485] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cache.php"] [unique_id "aUKgaiEJyT-03u9UZWO8ZQAAAko"]
[Wed Dec 17 20:22:02.372472 2025] [:error] [pid 16704:tid 16730] [client 4.218.22.35:3001] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zfile.php"] [unique_id "aUKgaqAnp3ottQtykbRhggAAAdU"]
[Wed Dec 17 20:22:02.703171 2025] [:error] [pid 16788:tid 16794] [client 4.218.22.35:2866] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zfile.php"] [unique_id "aUKgaiEJyT-03u9UZWO8ZwAAAkQ"]
[Wed Dec 17 20:22:03.035122 2025] [:error] [pid 16704:tid 16711] [client 4.218.22.35:2867] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zfile.php"] [unique_id "aUKga6Anp3ottQtykbRhhAAAAcI"]
[Wed Dec 17 20:22:03.360245 2025] [:error] [pid 16577:tid 16588] [client 4.218.22.35:3005] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zfile.php"] [unique_id "aUKga-OuBdGpNNQaNL41IAAAAUA"]
[Wed Dec 17 20:22:03.681682 2025] [:error] [pid 16788:tid 16814] [client 4.218.22.35:2903] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NewFile.php"] [unique_id "aUKgayEJyT-03u9UZWO8agAAAlg"]
[Wed Dec 17 20:22:03.976984 2025] [:error] [pid 16704:tid 16726] [client 4.218.22.35:2868] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NewFile.php"] [unique_id "aUKga6Anp3ottQtykbRhhwAAAdE"]
[Wed Dec 17 20:22:04.270812 2025] [:error] [pid 45530:tid 45551] [client 4.218.22.35:2845] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NewFile.php"] [unique_id "aUKgbG4IsXcKlf7LWf8zkQAAABA"]
[Wed Dec 17 20:22:04.552726 2025] [:error] [pid 45621:tid 45647] [client 4.218.22.35:2843] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NewFile.php"] [unique_id "aUKgbOVNGQfJ1rR90pSKUQAAANU"]
[Wed Dec 17 20:22:04.888049 2025] [:error] [pid 45530:tid 45542] [client 4.218.22.35:2880] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/des.php"] [unique_id "aUKgbG4IsXcKlf7LWf8zkgAAAAc"]
[Wed Dec 17 20:22:05.185518 2025] [:error] [pid 16666:tid 16685] [client 4.218.22.35:2984] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/des.php"] [unique_id "aUKgbVAThvYvBwbndYLp7gAAAZA"]
[Wed Dec 17 20:22:05.470528 2025] [:error] [pid 11733:tid 11735] [client 4.218.22.35:2842] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/des.php"] [unique_id "aUKgbTzmtBRXExJb1PEnbwAAAQA"]
[Wed Dec 17 20:22:05.767755 2025] [:error] [pid 16577:tid 16603] [client 4.218.22.35:2910] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/des.php"] [unique_id "aUKgbeOuBdGpNNQaNL41IwAAAU8"]
[Wed Dec 17 20:22:06.084661 2025] [:error] [pid 16746:tid 16761] [client 4.218.22.35:2996] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ant.php"] [unique_id "aUKgbo-UihQezEh5cyO4qwAAAgk"]
[Wed Dec 17 20:22:06.400469 2025] [:error] [pid 11733:tid 11753] [client 4.218.22.35:2841] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ant.php"] [unique_id "aUKgbjzmtBRXExJb1PEncAAAARI"]
[Wed Dec 17 20:22:06.730091 2025] [:error] [pid 16577:tid 16591] [client 4.218.22.35:3007] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ant.php"] [unique_id "aUKgbuOuBdGpNNQaNL41JwAAAUM"]
[Wed Dec 17 20:22:07.047673 2025] [:error] [pid 45531:tid 45583] [client 4.218.22.35:2960] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ant.php"] [unique_id "aUKgb4juE-Fd-sBWjvWM1QAAAFQ"]
[Wed Dec 17 20:22:07.375122 2025] [:error] [pid 45530:tid 45559] [client 4.218.22.35:2797] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "aUKgb24IsXcKlf7LWf8zlAAAABg"]
[Wed Dec 17 20:22:07.689654 2025] [:error] [pid 11733:tid 11740] [client 4.218.22.35:2831] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "aUKgbzzmtBRXExJb1PEncwAAAQU"]
[Wed Dec 17 20:22:07.973956 2025] [:error] [pid 11733:tid 11739] [client 4.218.22.35:2879] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "aUKgbzzmtBRXExJb1PEndgAAAQQ"]
[Wed Dec 17 20:22:08.267591 2025] [:error] [pid 11733:tid 11743] [client 4.218.22.35:2794] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "aUKgcDzmtBRXExJb1PEndwAAAQg"]
[Wed Dec 17 20:22:08.632019 2025] [:error] [pid 16704:tid 16723] [client 4.218.22.35:2755] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "aUKgcKAnp3ottQtykbRhiAAAAc4"]
[Wed Dec 17 20:22:08.947965 2025] [:error] [pid 16861:tid 16890] [client 4.218.22.35:2865] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "aUKgcFmas3wxi8EVIZq7BAAAAoM"]
[Wed Dec 17 20:22:09.248559 2025] [:error] [pid 16746:tid 16778] [client 4.218.22.35:2832] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "aUKgcY-UihQezEh5cyO4rQAAAhg"]
[Wed Dec 17 20:22:09.542720 2025] [:error] [pid 16788:tid 16813] [client 4.218.22.35:2860] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "aUKgcSEJyT-03u9UZWO8cQAAAlc"]
[Wed Dec 17 20:22:09.842489 2025] [:error] [pid 16746:tid 16760] [client 4.218.22.35:2829] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aUKgcY-UihQezEh5cyO4rwAAAgg"]
[Wed Dec 17 20:22:10.130757 2025] [:error] [pid 16704:tid 16733] [client 4.218.22.35:2757] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aUKgcqAnp3ottQtykbRhiQAAAdg"]
[Wed Dec 17 20:22:10.427498 2025] [:error] [pid 16577:tid 16604] [client 4.218.22.35:3003] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aUKgcuOuBdGpNNQaNL41LQAAAVA"]
[Wed Dec 17 20:22:10.737452 2025] [:error] [pid 16746:tid 16763] [client 4.218.22.35:2911] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aUKgco-UihQezEh5cyO4sQAAAgs"]
[Wed Dec 17 20:22:11.016094 2025] [:error] [pid 16861:tid 16889] [client 4.218.22.35:2441] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aUKgc1mas3wxi8EVIZq7CAAAAoI"]
[Wed Dec 17 20:22:11.348880 2025] [:error] [pid 16704:tid 16729] [client 4.218.22.35:2930] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aUKgc6Anp3ottQtykbRhjAAAAdQ"]
[Wed Dec 17 20:22:11.628596 2025] [:error] [pid 16861:tid 16888] [client 4.218.22.35:2830] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aUKgc1mas3wxi8EVIZq7CgAAAoE"]
[Wed Dec 17 20:22:11.925890 2025] [:error] [pid 45530:tid 45553] [client 4.218.22.35:2815] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aUKgc24IsXcKlf7LWf8zmAAAABI"]
[Wed Dec 17 20:22:12.209453 2025] [:error] [pid 45530:tid 45558] [client 4.218.22.35:2886] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpc.php"] [unique_id "aUKgdG4IsXcKlf7LWf8zmQAAABc"]
[Wed Dec 17 20:22:12.491994 2025] [:error] [pid 45530:tid 45555] [client 4.218.22.35:2751] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpc.php"] [unique_id "aUKgdG4IsXcKlf7LWf8zmgAAABQ"]
[Wed Dec 17 20:22:12.780867 2025] [:error] [pid 45531:tid 45573] [client 4.218.22.35:2819] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpc.php"] [unique_id "aUKgdIjuE-Fd-sBWjvWM4AAAAEo"]
[Wed Dec 17 20:22:13.108709 2025] [:error] [pid 16861:tid 16904] [client 4.218.22.35:2993] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpc.php"] [unique_id "aUKgdVmas3wxi8EVIZq7DgAAApE"]
[Wed Dec 17 20:22:13.423074 2025] [:error] [pid 16577:tid 16592] [client 4.218.22.35:2810] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lc.php"] [unique_id "aUKgdeOuBdGpNNQaNL41LwAAAUQ"]
[Wed Dec 17 20:22:13.731879 2025] [:error] [pid 16746:tid 16754] [client 4.218.22.35:3053] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lc.php"] [unique_id "aUKgdY-UihQezEh5cyO4tgAAAgI"]
[Wed Dec 17 20:22:14.011423 2025] [:error] [pid 16666:tid 16689] [client 4.218.22.35:2855] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lc.php"] [unique_id "aUKgdlAThvYvBwbndYLp-AAAAZQ"]
[Wed Dec 17 20:22:14.334096 2025] [:error] [pid 16746:tid 16766] [client 4.218.22.35:2776] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lc.php"] [unique_id "aUKgdo-UihQezEh5cyO4uAAAAg4"]
[Wed Dec 17 20:22:14.684596 2025] [:error] [pid 16577:tid 16600] [client 4.218.22.35:2859] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mlex.php"] [unique_id "aUKgduOuBdGpNNQaNL41MgAAAUw"]
[Wed Dec 17 20:22:14.990883 2025] [:error] [pid 45530:tid 45539] [client 4.218.22.35:2814] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mlex.php"] [unique_id "aUKgdm4IsXcKlf7LWf8znQAAAAQ"]
[Wed Dec 17 20:22:15.308449 2025] [:error] [pid 16746:tid 16775] [client 4.218.22.35:2827] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mlex.php"] [unique_id "aUKgd4-UihQezEh5cyO4ugAAAhU"]
[Wed Dec 17 20:22:15.594291 2025] [:error] [pid 16788:tid 16803] [client 4.218.22.35:2442] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mlex.php"] [unique_id "aUKgdyEJyT-03u9UZWO8eAAAAk0"]
[Wed Dec 17 20:22:15.975927 2025] [:error] [pid 16861:tid 16911] [client 4.218.22.35:2836] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aUKgd1mas3wxi8EVIZq7EAAAApg"]
[Wed Dec 17 20:22:16.295978 2025] [:error] [pid 16746:tid 16764] [client 4.218.22.35:2759] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aUKgeI-UihQezEh5cyO4vAAAAgw"]
[Wed Dec 17 20:22:16.662742 2025] [:error] [pid 16577:tid 16593] [client 4.218.22.35:2820] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aUKgeOOuBdGpNNQaNL41MwAAAUU"]
[Wed Dec 17 20:22:16.987565 2025] [:error] [pid 16666:tid 16690] [client 4.218.22.35:2856] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aUKgeFAThvYvBwbndYLp_QAAAZU"]
[Wed Dec 17 20:22:17.316322 2025] [:error] [pid 16577:tid 16603] [client 4.218.22.35:2851] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aUKgeeOuBdGpNNQaNL41NAAAAU8"]
[Wed Dec 17 20:22:17.619247 2025] [:error] [pid 16666:tid 16673] [client 4.218.22.35:2769] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aUKgeVAThvYvBwbndYLqAAAAAYQ"]
[Wed Dec 17 20:22:17.924080 2025] [:error] [pid 16577:tid 16609] [client 4.218.22.35:2890] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aUKgeeOuBdGpNNQaNL41NQAAAVU"]
[Wed Dec 17 20:22:18.253686 2025] [:error] [pid 45530:tid 45537] [client 4.218.22.35:2774] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aUKgem4IsXcKlf7LWf8zoAAAAAI"]
[Wed Dec 17 20:22:18.563170 2025] [:error] [pid 45530:tid 45547] [client 4.218.22.35:2864] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mpvloi.php"] [unique_id "aUKgem4IsXcKlf7LWf8zogAAAAw"]
[Wed Dec 17 20:22:18.868833 2025] [:error] [pid 45530:tid 45544] [client 4.218.22.35:2767] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mpvloi.php"] [unique_id "aUKgem4IsXcKlf7LWf8zowAAAAk"]
[Wed Dec 17 20:22:19.145586 2025] [:error] [pid 45530:tid 45557] [client 4.218.22.35:2870] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mpvloi.php"] [unique_id "aUKge24IsXcKlf7LWf8zpAAAABY"]
[Wed Dec 17 20:22:19.437803 2025] [:error] [pid 16704:tid 16711] [client 4.218.22.35:2753] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mpvloi.php"] [unique_id "aUKge6Anp3ottQtykbRhkQAAAcI"]
[Wed Dec 17 20:22:19.718586 2025] [:error] [pid 16788:tid 16795] [client 4.218.22.35:2941] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v1.php"] [unique_id "aUKgeyEJyT-03u9UZWO8fgAAAkU"]
[Wed Dec 17 20:22:20.003174 2025] [:error] [pid 16861:tid 16894] [client 4.218.22.35:2761] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v1.php"] [unique_id "aUKgfFmas3wxi8EVIZq7EQAAAoc"]
[Wed Dec 17 20:22:20.326450 2025] [:error] [pid 16861:tid 16905] [client 4.218.22.35:2873] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v1.php"] [unique_id "aUKgfFmas3wxi8EVIZq7EwAAApI"]
[Wed Dec 17 20:22:20.621514 2025] [:error] [pid 16861:tid 16888] [client 4.218.22.35:2449] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v1.php"] [unique_id "aUKgfFmas3wxi8EVIZq7FAAAAoE"]
[Wed Dec 17 20:22:20.907637 2025] [:error] [pid 11733:tid 11748] [client 4.218.22.35:2461] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2.php"] [unique_id "aUKgfDzmtBRXExJb1PEneQAAAQ0"]
[Wed Dec 17 20:22:21.212119 2025] [:error] [pid 16704:tid 16725] [client 4.218.22.35:2771] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2.php"] [unique_id "aUKgfaAnp3ottQtykbRhkgAAAdA"]
[Wed Dec 17 20:22:21.507053 2025] [:error] [pid 16704:tid 16713] [client 4.218.22.35:2777] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2.php"] [unique_id "aUKgfaAnp3ottQtykbRhkwAAAcQ"]
[Wed Dec 17 20:22:21.821468 2025] [:error] [pid 16704:tid 16726] [client 4.218.22.35:2913] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2.php"] [unique_id "aUKgfaAnp3ottQtykbRhlAAAAdE"]
[Wed Dec 17 20:22:22.117114 2025] [:error] [pid 45621:tid 45636] [client 4.218.22.35:2878] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dex.php"] [unique_id "aUKgfuVNGQfJ1rR90pSKVwAAAMo"]
[Wed Dec 17 20:22:22.410735 2025] [:error] [pid 16666:tid 16690] [client 4.218.22.35:2871] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dex.php"] [unique_id "aUKgflAThvYvBwbndYLqDQAAAZU"]
[Wed Dec 17 20:22:22.737794 2025] [:error] [pid 16666:tid 16673] [client 4.218.22.35:2788] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dex.php"] [unique_id "aUKgflAThvYvBwbndYLqEAAAAYQ"]
[Wed Dec 17 20:22:23.113794 2025] [:error] [pid 16861:tid 16895] [client 4.218.22.35:2806] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dex.php"] [unique_id "aUKgf1mas3wxi8EVIZq7GAAAAog"]
[Wed Dec 17 20:22:23.435460 2025] [:error] [pid 16746:tid 16755] [client 4.218.22.35:2444] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/angelV2.php"] [unique_id "aUKgf4-UihQezEh5cyO4wgAAAgM"]
[Wed Dec 17 20:22:23.714498 2025] [:error] [pid 16861:tid 16892] [client 4.218.22.35:2778] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/angelV2.php"] [unique_id "aUKgf1mas3wxi8EVIZq7GgAAAoU"]
[Wed Dec 17 20:22:24.021999 2025] [:error] [pid 16861:tid 16909] [client 4.218.22.35:2780] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/angelV2.php"] [unique_id "aUKggFmas3wxi8EVIZq7HAAAApY"]
[Wed Dec 17 20:22:24.297774 2025] [:error] [pid 16861:tid 16911] [client 4.218.22.35:2652] [client 4.218.22.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/angelV2.php"] [unique_id "aUKggFmas3wxi8EVIZq7HQAAApg"]
[Wed Dec 17 21:45:35.357447 2025] [:error] [pid 16666:tid 16678] [client 106.222.209.12:27469] [client 106.222.209.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.209.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUKz_1AThvYvBwbndYID7wAAAYk"]
[Wed Dec 17 21:54:04.611723 2025] [:error] [pid 45530:tid 45537] [client 106.222.209.12:9952] [client 106.222.209.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.209.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUK1_G4IsXcKlf7LWf9AzQAAAAI"]
[Wed Dec 17 22:02:59.835923 2025] [:error] [pid 16788:tid 16806] [client 106.222.209.12:15810] [client 106.222.209.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.209.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUK4EyEJyT-03u9UZWPNhQAAAlA"]
[Wed Dec 17 22:23:18.164935 2025] [:error] [pid 16666:tid 16690] [client 106.222.209.12:7881] [client 106.222.209.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.209.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUK81lAThvYvBwbndYIPIwAAAZU"]
[Wed Dec 17 22:36:04.364620 2025] [:error] [pid 16577:tid 16611] [client 106.222.209.12:7092] [client 106.222.209.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.222.209.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUK_1OOuBdGpNNQaNL5K5wAAAVc"]
[Wed Dec 17 23:36:36.710270 2025] [:error] [pid 16788:tid 16807] [client 179.222.238.185:4175] [client 179.222.238.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.222.238.185, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aULOBCEJyT-03u9UZWPb2wAAAlE"]
[Wed Dec 17 23:44:05.984544 2025] [:error] [pid 16746:tid 16772] [client 179.222.238.185:4368] [client 179.222.238.185] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aULPxY-UihQezEh5cyPSxgAAAhI"]
[Wed Dec 17 23:50:35.690316 2025] [:error] [pid 45621:tid 45648] [client 179.222.238.185:30787] [client 179.222.238.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.222.238.185, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aULRS-VNGQfJ1rR90pSlAwAAANY"]
[Wed Dec 17 23:52:40.951357 2025] [:error] [pid 16666:tid 16681] [client 179.222.238.185:4210] [client 179.222.238.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.222.238.185, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aULRyFAThvYvBwbndYIm4gAAAYw"]
[Wed Dec 17 23:54:38.733353 2025] [:error] [pid 45530:tid 45540] [client 179.222.238.185:30850] [client 179.222.238.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.222.238.185, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aULSPm4IsXcKlf7LWf9PSQAAAAU"]
[Wed Dec 17 23:56:36.641987 2025] [:error] [pid 16861:tid 16906] [client 179.222.238.185:4304] [client 179.222.238.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.222.238.185, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aULStFmas3wxi8EVIZrrNwAAApM"]
[Thu Dec 18 00:22:35.463513 2025] [:error] [pid 43494:tid 43539] [client 193.36.224.61:45227] [client 193.36.224.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "aULYy-pvK2pzfvdDETprBQAAAEw"]
[Thu Dec 18 00:22:35.938173 2025] [:error] [pid 43495:tid 43567] [client 193.36.224.41:50103] [client 193.36.224.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/txets.php"] [unique_id "aULYy5PwJsDLQYFUP-Y47wAAAM0"]
[Thu Dec 18 00:22:36.412751 2025] [:error] [pid 43495:tid 43562] [client 193.36.224.76:31171] [client 193.36.224.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/txets.php"] [unique_id "aULYzJPwJsDLQYFUP-Y48AAAAMg"]
[Thu Dec 18 06:52:28.113228 2025] [:error] [pid 25357:tid 25379] [client 193.19.109.176:38053] [client 193.19.109.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "aUM0LIaT7bsEXnJVfJdQQQAAAdQ"]
[Thu Dec 18 06:53:22.004451 2025] [:error] [pid 25357:tid 25363] [client 193.19.109.201:51791] [client 193.19.109.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aUM0YoaT7bsEXnJVfJdSeAAAAcQ"]
[Thu Dec 18 06:53:34.348018 2025] [:error] [pid 23645:tid 23661] [client 193.19.109.200:60345] [client 193.19.109.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aUM0bjf_Rx0Y0ao_QJiSvgAAAI4"]
[Thu Dec 18 06:53:57.413561 2025] [:error] [pid 24433:tid 24443] [client 193.19.109.198:61463] [client 193.19.109.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aUM0hZ4pN9ycmipm8TgotgAAAQc"]
[Thu Dec 18 06:54:07.895487 2025] [:error] [pid 23557:tid 23593] [client 193.19.109.205:65167] [client 193.19.109.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aUM0jxYcs6rFVxbdP_k8TwAAAEU"]
[Thu Dec 18 06:54:31.301561 2025] [:error] [pid 24958:tid 24980] [client 193.19.109.172:47927] [client 193.19.109.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aUM0p8kDOrUkd0wNm2EV1QAAAZM"]
[Thu Dec 18 06:54:35.793769 2025] [:error] [pid 23558:tid 23633] [client 193.19.109.199:63319] [client 193.19.109.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aUM0q-Ham9NbgPQa9uY_xgAAANI"]
[Thu Dec 18 06:54:36.551596 2025] [:error] [pid 23558:tid 23633] [client 193.19.109.168:64127] [client 193.19.109.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aUM0rOHam9NbgPQa9uY_2gAAANI"]
[Thu Dec 18 06:54:37.268999 2025] [:error] [pid 25357:tid 25373] [client 193.19.109.200:44137] [client 193.19.109.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aUM0rYaT7bsEXnJVfJdVLAAAAc4"]
[Thu Dec 18 06:54:38.967100 2025] [:error] [pid 23557:tid 23604] [client 193.19.109.181:23051] [client 193.19.109.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aUM0rhYcs6rFVxbdP_k9DgAAAFA"]
[Thu Dec 18 06:54:39.683848 2025] [:error] [pid 23556:tid 23576] [client 193.19.109.208:62135] [client 193.19.109.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aUM0rxnmLlk3u5yt9kEQgAAAABA"]
[Thu Dec 18 06:54:44.584462 2025] [:error] [pid 23556:tid 23584] [client 193.19.109.200:46325] [client 193.19.109.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aUM0tBnmLlk3u5yt9kEQrwAAABg"]
[Thu Dec 18 06:54:52.492989 2025] [:error] [pid 23556:tid 23577] [client 193.19.109.204:61251] [client 193.19.109.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aUM0vBnmLlk3u5yt9kEQ1gAAABE"]
[Thu Dec 18 06:55:02.419387 2025] [:error] [pid 25357:tid 25359] [client 193.19.109.169:37991] [client 193.19.109.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aUM0xoaT7bsEXnJVfJdWWQAAAcA"]
[Thu Dec 18 06:55:05.098129 2025] [:error] [pid 25357:tid 25375] [client 193.19.109.177:20269] [client 193.19.109.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aUM0yYaT7bsEXnJVfJdWbwAAAdA"]
[Thu Dec 18 06:55:08.018445 2025] [:error] [pid 24542:tid 24556] [client 193.37.33.230:32601] [client 193.37.33.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aUM0zEtQz4H2oS3NrDYeTAAAAUw"]
[Thu Dec 18 06:55:24.299724 2025] [:error] [pid 24958:tid 24968] [client 193.19.109.202:41003] [client 193.19.109.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aUM03MkDOrUkd0wNm2EXLgAAAYc"]
[Thu Dec 18 06:55:28.275051 2025] [:error] [pid 25357:tid 25367] [client 193.19.109.207:57289] [client 193.19.109.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aUM04IaT7bsEXnJVfJdXSgAAAcg"]
[Thu Dec 18 06:55:32.819468 2025] [:error] [pid 24958:tid 24985] [client 193.19.109.207:44283] [client 193.19.109.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/defaults.php"] [unique_id "aUM05MkDOrUkd0wNm2EXegAAAZg"]
[Thu Dec 18 06:55:36.318979 2025] [:error] [pid 24958:tid 24985] [client 193.19.109.176:60465] [client 193.19.109.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aUM06MkDOrUkd0wNm2EXhwAAAZg"]
[Thu Dec 18 06:55:47.106147 2025] [:error] [pid 23645:tid 23653] [client 193.19.109.209:43313] [client 193.19.109.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aUM08zf_Rx0Y0ao_QJiVzgAAAIY"]
[Thu Dec 18 06:55:50.098659 2025] [:error] [pid 23645:tid 23657] [client 193.19.109.191:61995] [client 193.19.109.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aUM09jf_Rx0Y0ao_QJiV5gAAAIo"]
[Thu Dec 18 06:55:53.379684 2025] [:error] [pid 23556:tid 23568] [client 193.19.109.173:48453] [client 193.19.109.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aUM0-RnmLlk3u5yt9kESUgAAAAg"]
[Thu Dec 18 06:55:54.112376 2025] [:error] [pid 23645:tid 23658] [client 193.19.109.210:41671] [client 193.19.109.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aUM0-jf_Rx0Y0ao_QJiWFAAAAIs"]
[Thu Dec 18 06:55:54.872852 2025] [:error] [pid 23645:tid 23657] [client 193.19.109.165:48701] [client 193.19.109.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aUM0-jf_Rx0Y0ao_QJiWIQAAAIo"]
[Thu Dec 18 06:56:04.022592 2025] [:error] [pid 25357:tid 25364] [client 193.19.109.201:43343] [client 193.19.109.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/info.php"] [unique_id "aUM1BIaT7bsEXnJVfJdYXAAAAcU"]
[Thu Dec 18 06:56:04.770040 2025] [:error] [pid 24433:tid 24437] [client 193.19.109.165:40437] [client 193.19.109.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class.api.php"] [unique_id "aUM1BJ4pN9ycmipm8TgscwAAAQE"]
[Thu Dec 18 06:56:05.468331 2025] [:error] [pid 24433:tid 24447] [client 193.19.109.179:37271] [client 193.19.109.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUM1BZ4pN9ycmipm8TgsewAAAQs"]
[Thu Dec 18 06:56:23.172664 2025] [:error] [pid 23556:tid 23577] [client 193.19.109.169:41211] [client 193.19.109.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/admin.php"] [unique_id "aUM1FxnmLlk3u5yt9kETCAAAABE"]
[Thu Dec 18 06:56:29.218978 2025] [:error] [pid 23557:tid 23600] [client 193.19.109.176:21143] [client 193.19.109.176] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.176, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aUM1HRYcs6rFVxbdP_k_2QAAAEw"]
[Thu Dec 18 06:56:45.886276 2025] [:error] [pid 23557:tid 23594] [client 193.19.109.176:21143] [client 193.19.109.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aUM1LRYcs6rFVxbdP_lAUAAAAEY"]
[Thu Dec 18 06:56:49.699764 2025] [:error] [pid 23558:tid 23624] [client 193.37.33.230:43593] [client 193.37.33.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.33.230, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aUM1MeHam9NbgPQa9uZDJgAAAMk"]
[Thu Dec 18 06:56:52.865766 2025] [:error] [pid 23558:tid 23628] [client 193.37.33.230:43593] [client 193.37.33.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/item.php"] [unique_id "aUM1NOHam9NbgPQa9uZDMgAAAM0"]
[Thu Dec 18 06:57:09.790240 2025] [:error] [pid 25357:tid 25372] [client 193.19.109.163:39077] [client 193.19.109.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aUM1RYaT7bsEXnJVfJdacwAAAc0"]
[Thu Dec 18 06:57:32.503455 2025] [:error] [pid 24542:tid 24556] [client 193.19.109.169:38595] [client 193.19.109.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aUM1XEtQz4H2oS3NrDYiLQAAAUw"]
[Thu Dec 18 06:57:37.909803 2025] [:error] [pid 24542:tid 24553] [client 193.19.109.191:45051] [client 193.19.109.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aUM1YUtQz4H2oS3NrDYiXQAAAUk"]
[Thu Dec 18 06:57:43.782707 2025] [:error] [pid 24958:tid 24968] [client 193.19.109.169:33183] [client 193.19.109.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aUM1Z8kDOrUkd0wNm2EcYwAAAYc"]
[Thu Dec 18 06:57:45.999415 2025] [:error] [pid 24958:tid 24964] [client 193.19.109.169:33183] [client 193.19.109.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aUM1ackDOrUkd0wNm2EcbQAAAYM"]
[Thu Dec 18 06:58:24.490251 2025] [:error] [pid 24433:tid 24457] [client 193.19.109.182:48201] [client 193.19.109.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aUM1kJ4pN9ycmipm8TgwRAAAARU"]
[Thu Dec 18 06:58:30.507753 2025] [:error] [pid 24958:tid 24981] [client 193.37.33.230:42899] [client 193.37.33.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.33.230, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aUM1lskDOrUkd0wNm2EdggAAAZQ"]
[Thu Dec 18 06:58:39.415213 2025] [:error] [pid 24958:tid 24961] [client 193.37.33.230:42899] [client 193.37.33.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aUM1n8kDOrUkd0wNm2EdugAAAYA"]
[Thu Dec 18 06:58:44.170658 2025] [:error] [pid 24433:tid 24448] [client 193.19.109.184:65419] [client 193.19.109.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/infi.php"] [unique_id "aUM1pJ4pN9ycmipm8TgwrwAAAQw"]
[Thu Dec 18 06:58:50.275815 2025] [:error] [pid 25357:tid 25368] [client 193.19.109.189:26321] [client 193.19.109.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aUM1qoaT7bsEXnJVfJdc3wAAAck"]
[Thu Dec 18 06:58:58.178796 2025] [:error] [pid 24542:tid 24547] [client 193.19.109.171:32377] [client 193.19.109.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aUM1sktQz4H2oS3NrDYlFQAAAUM"]
[Thu Dec 18 06:58:58.958807 2025] [:error] [pid 25357:tid 25366] [client 193.19.109.197:60937] [client 193.19.109.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aUM1soaT7bsEXnJVfJddEwAAAcc"]
[Thu Dec 18 06:59:12.696989 2025] [:error] [pid 23558:tid 23629] [client 193.19.109.189:31327] [client 193.19.109.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aUM1wOHam9NbgPQa9uZGPgAAAM4"]
[Thu Dec 18 06:59:16.593393 2025] [:error] [pid 25357:tid 25383] [client 193.19.109.181:30387] [client 193.19.109.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "aUM1xIaT7bsEXnJVfJddmAAAAdg"]
[Thu Dec 18 06:59:22.395721 2025] [:error] [pid 25357:tid 25366] [client 193.19.109.209:50641] [client 193.19.109.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/edit.php"] [unique_id "aUM1yoaT7bsEXnJVfJddugAAAcc"]
[Thu Dec 18 06:59:33.265189 2025] [autoindex:error] [pid 24958:tid 24976] [client 193.19.109.179:22427] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:33.677861 2025] [autoindex:error] [pid 24958:tid 24966] [client 193.19.109.179:22427] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:34.091160 2025] [autoindex:error] [pid 24958:tid 24962] [client 193.19.109.179:22427] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:34.475625 2025] [autoindex:error] [pid 24958:tid 24980] [client 193.19.109.179:22427] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:35.663460 2025] [autoindex:error] [pid 23645:tid 23658] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:36.107019 2025] [autoindex:error] [pid 23645:tid 23656] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:36.487013 2025] [autoindex:error] [pid 23645:tid 23668] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:36.875734 2025] [autoindex:error] [pid 23645:tid 23665] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:37.376267 2025] [autoindex:error] [pid 23645:tid 23654] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:37.721457 2025] [autoindex:error] [pid 23645:tid 23670] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:38.480310 2025] [autoindex:error] [pid 23645:tid 23671] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:40.115836 2025] [autoindex:error] [pid 23645:tid 23648] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:41.853790 2025] [autoindex:error] [pid 23645:tid 23650] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:45.073557 2025] [autoindex:error] [pid 23645:tid 23659] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:45.467776 2025] [autoindex:error] [pid 23645:tid 23668] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:45.809867 2025] [autoindex:error] [pid 23645:tid 23654] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:46.277081 2025] [autoindex:error] [pid 23645:tid 23663] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:47.769054 2025] [autoindex:error] [pid 23645:tid 23667] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:48.189654 2025] [autoindex:error] [pid 23645:tid 23669] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:49.704792 2025] [autoindex:error] [pid 23645:tid 23655] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:52.606432 2025] [autoindex:error] [pid 23645:tid 23662] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:52.996732 2025] [autoindex:error] [pid 23645:tid 23652] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:53.389639 2025] [autoindex:error] [pid 23645:tid 23657] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 06:59:57.512762 2025] [autoindex:error] [pid 23645:tid 23655] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:00:01.440349 2025] [autoindex:error] [pid 23645:tid 23661] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:00:04.047428 2025] [autoindex:error] [pid 23645:tid 23663] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:00:04.394046 2025] [autoindex:error] [pid 23645:tid 23662] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:00:05.584298 2025] [autoindex:error] [pid 23645:tid 23664] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:00:05.942760 2025] [autoindex:error] [pid 23645:tid 23668] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:00:06.303661 2025] [autoindex:error] [pid 23645:tid 23651] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:00:14.905027 2025] [autoindex:error] [pid 23645:tid 23654] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:00:54.082630 2025] [autoindex:error] [pid 23645:tid 23660] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:00:54.479540 2025] [autoindex:error] [pid 23645:tid 23666] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:00:54.830446 2025] [autoindex:error] [pid 23645:tid 23656] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:00:55.201988 2025] [autoindex:error] [pid 23645:tid 23660] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:00:58.009232 2025] [autoindex:error] [pid 23645:tid 23669] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:00:58.402156 2025] [autoindex:error] [pid 23645:tid 23666] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:01:00.073732 2025] [autoindex:error] [pid 23645:tid 23671] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:01:01.692944 2025] [autoindex:error] [pid 23645:tid 23659] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:01:02.099131 2025] [autoindex:error] [pid 23645:tid 23670] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:01:02.487765 2025] [autoindex:error] [pid 23645:tid 23648] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:01:04.409086 2025] [autoindex:error] [pid 23645:tid 23651] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:01:04.802091 2025] [autoindex:error] [pid 23645:tid 23670] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:01:05.205671 2025] [autoindex:error] [pid 23645:tid 23660] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:01:05.592696 2025] [autoindex:error] [pid 23645:tid 23663] [client 193.19.109.198:33707] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:01:36.120086 2025] [autoindex:error] [pid 23556:tid 23560] [client 193.19.109.191:32301] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:01:50.885064 2025] [autoindex:error] [pid 23556:tid 23584] [client 193.19.109.191:32301] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:01:56.398227 2025] [autoindex:error] [pid 23556:tid 23561] [client 193.19.109.191:32301] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:01:56.795217 2025] [autoindex:error] [pid 23556:tid 23571] [client 193.19.109.191:32301] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:02:02.693206 2025] [autoindex:error] [pid 23556:tid 23576] [client 193.19.109.191:32301] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:02:03.090693 2025] [autoindex:error] [pid 23556:tid 23574] [client 193.19.109.191:32301] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:02:03.483112 2025] [autoindex:error] [pid 23556:tid 23560] [client 193.19.109.191:32301] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:02:03.878257 2025] [autoindex:error] [pid 23556:tid 23580] [client 193.19.109.191:32301] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:02:04.272145 2025] [autoindex:error] [pid 23556:tid 23568] [client 193.19.109.191:32301] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:02:04.625257 2025] [autoindex:error] [pid 23556:tid 23578] [client 193.19.109.191:32301] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:02:04.989771 2025] [autoindex:error] [pid 23556:tid 23581] [client 193.19.109.191:32301] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:02:05.373903 2025] [autoindex:error] [pid 23556:tid 23564] [client 193.19.109.191:32301] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:02:05.723145 2025] [autoindex:error] [pid 23556:tid 23567] [client 193.19.109.191:32301] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 07:02:33.211945 2025] [autoindex:error] [pid 23556:tid 23568] [client 193.19.109.191:32301] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 10:01:14.843819 2025] [:error] [pid 24433:tid 24438] [client 43.135.138.128:56426] [client 43.135.138.128] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUNgap4pN9ycmipm8ThbNQAAAQI"]
[Thu Dec 18 12:39:13.853017 2025] [:error] [pid 25357:tid 25361] [client 186.226.58.115:36798] [client 186.226.58.115] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.local"] [unique_id "aUOFcYaT7bsEXnJVfJfcvgAAAcI"]
[Thu Dec 18 12:39:13.853425 2025] [:error] [pid 12035:tid 12044] [client 186.226.58.115:36790] [client 186.226.58.115] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/api/.env"] [unique_id "aUOFcbcVHrNSHjCo-0o95AAAAgI"]
[Thu Dec 18 12:39:13.854325 2025] [:error] [pid 25357:tid 25372] [client 186.226.58.115:36782] [client 186.226.58.115] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/app/.env"] [unique_id "aUOFcYaT7bsEXnJVfJfcvwAAAc0"]
[Thu Dec 18 12:39:13.858259 2025] [:error] [pid 24542:tid 24544] [client 186.226.58.115:36792] [client 186.226.58.115] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/app/.env"] [unique_id "aUOFcUtQz4H2oS3NrDZ29wAAAUA"]
[Thu Dec 18 12:39:13.860467 2025] [:error] [pid 25357:tid 25377] [client 186.226.58.115:36800] [client 186.226.58.115] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/api/.env"] [unique_id "aUOFcYaT7bsEXnJVfJfcwAAAAdI"]
[Thu Dec 18 12:39:13.860909 2025] [:error] [pid 25357:tid 25380] [client 186.226.58.115:36796] [client 186.226.58.115] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aUOFcYaT7bsEXnJVfJfcwQAAAdU"]
[Thu Dec 18 12:39:13.861707 2025] [:error] [pid 24958:tid 24965] [client 186.226.58.115:36784] [client 186.226.58.115] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aUOFcckDOrUkd0wNm2FwMwAAAYQ"]
[Thu Dec 18 12:39:13.862842 2025] [:error] [pid 23556:tid 23565] [client 186.226.58.115:36786] [client 186.226.58.115] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/core/.env"] [unique_id "aUOFcRnmLlk3u5yt9kFvyQAAAAU"]
[Thu Dec 18 12:39:13.867406 2025] [:error] [pid 12383:tid 12394] [client 186.226.58.115:36794] [client 186.226.58.115] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/core/.env"] [unique_id "aUOFcfdgllo9h1cyxGZkkQAAAsg"]
[Thu Dec 18 12:39:13.868259 2025] [:error] [pid 12035:tid 12049] [client 186.226.58.115:36788] [client 186.226.58.115] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.local"] [unique_id "aUOFcbcVHrNSHjCo-0o95QAAAgc"]
[Thu Dec 18 14:16:01.643943 2025] [:error] [pid 12383:tid 12393] [client 182.44.8.254:44460] [client 182.44.8.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUOcIfdgllo9h1cyxGZ5WwAAAsc"]
[Thu Dec 18 15:10:51.344389 2025] [:error] [pid 23558:tid 23627] [client 101.33.81.73:37924] [client 101.33.81.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aUOo--Ham9NbgPQa9uas_QAAAMw"]
[Thu Dec 18 16:00:07.904751 2025] [:error] [pid 12035:tid 12059] [client 34.48.227.63:51126] [client 34.48.227.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.227.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUO0h7cVHrNSHjCo-0phiwAAAhA"]
[Thu Dec 18 16:00:11.030503 2025] [:error] [pid 12035:tid 12046] [client 34.48.227.63:51126] [client 34.48.227.63] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aUO0i7cVHrNSHjCo-0phkAAAAgQ"]
[Thu Dec 18 16:00:11.247342 2025] [:error] [pid 12035:tid 12054] [client 34.48.227.63:51126] [client 34.48.227.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.227.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUO0i7cVHrNSHjCo-0phkQAAAgs"]
[Thu Dec 18 16:00:13.014227 2025] [:error] [pid 23645:tid 23667] [client 34.48.227.63:52565] [client 34.48.227.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.227.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUO0jTf_Rx0Y0ao_QJgcUgAAAJQ"]
[Thu Dec 18 16:00:14.775299 2025] [:error] [pid 12035:tid 12049] [client 34.48.227.63:54987] [client 34.48.227.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.227.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUO0jrcVHrNSHjCo-0phlAAAAgc"]
[Thu Dec 18 16:00:16.536449 2025] [:error] [pid 25357:tid 25363] [client 34.48.227.63:61164] [client 34.48.227.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.227.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUO0kIaT7bsEXnJVfJcg5gAAAcQ"]
[Thu Dec 18 16:00:18.168819 2025] [:error] [pid 12239:tid 12259] [client 34.48.227.63:58479] [client 34.48.227.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.227.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUO0ktNnXxfGIuWO6anFXwAAAo8"]
[Thu Dec 18 16:00:18.168976 2025] [:error] [pid 12239:tid 12259] [client 34.48.227.63:58479] [client 34.48.227.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.48.227.63, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUO0ktNnXxfGIuWO6anFXwAAAo8"]
[Thu Dec 18 16:47:59.692645 2025] [:error] [pid 23558:tid 23620] [client 57.130.20.252:25059] [client 57.130.20.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 57.130.20.252, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUO_v-Ham9NbgPQa9ubUwQAAAMU"]
[Thu Dec 18 16:48:00.679824 2025] [:error] [pid 23558:tid 23626] [client 57.130.20.252:25059] [client 57.130.20.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 57.130.20.252, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUO_wOHam9NbgPQa9ubUyQAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 16:55:28.036742 2025] [:error] [pid 24542:tid 24551] [client 103.178.231.51:46804] [client 103.178.231.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.178.231.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPBgEtQz4H2oS3NrDa7igAAAUc"]
[Thu Dec 18 16:55:30.743786 2025] [:error] [pid 23558:tid 23632] [client 103.178.231.51:46808] [client 103.178.231.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.178.231.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPBguHam9NbgPQa9ubXHQAAANE"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 16:59:21.798986 2025] [:error] [pid 24542:tid 24564] [client 154.12.240.245:49232] [client 154.12.240.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.12.240.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPCaUtQz4H2oS3NrDa8xQAAAVQ"]
[Thu Dec 18 16:59:23.963564 2025] [:error] [pid 24433:tid 24460] [client 154.12.240.245:49238] [client 154.12.240.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.12.240.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPCa54pN9ycmipm8TioKQAAARg"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 17:03:52.165773 2025] [:error] [pid 12035:tid 12060] [client 51.81.14.24:37314] [client 51.81.14.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.81.14.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPDeLcVHrNSHjCo-0psDgAAAhE"]
[Thu Dec 18 17:03:53.101246 2025] [:error] [pid 12035:tid 12061] [client 51.81.14.24:37314] [client 51.81.14.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.81.14.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPDebcVHrNSHjCo-0psEgAAAhI"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 17:07:58.938953 2025] [:error] [pid 24542:tid 24548] [client 208.109.231.205:45884] [client 208.109.231.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.231.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPEbktQz4H2oS3NrDa_TAAAAUQ"]
[Thu Dec 18 17:08:00.048243 2025] [:error] [pid 24542:tid 24565] [client 208.109.231.205:45884] [client 208.109.231.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.231.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPEcEtQz4H2oS3NrDa_UAAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 17:12:05.789469 2025] [:error] [pid 24542:tid 24551] [client 103.178.231.51:41444] [client 103.178.231.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.178.231.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPFZUtQz4H2oS3NrDbA5wAAAUc"]
[Thu Dec 18 17:12:06.895518 2025] [:error] [pid 24542:tid 24564] [client 103.178.231.51:41444] [client 103.178.231.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.178.231.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPFZktQz4H2oS3NrDbA6AAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 17:25:03.819430 2025] [:error] [pid 23558:tid 23618] [client 191.233.136.135:40066] [client 191.233.136.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 191.233.136.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPIb-Ham9NbgPQa9ubf6QAAAMM"]
[Thu Dec 18 17:25:07.255634 2025] [:error] [pid 23645:tid 23648] [client 191.233.136.135:40072] [client 191.233.136.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 191.233.136.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPIczf_Rx0Y0ao_QJguNAAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 17:29:31.806233 2025] [:error] [pid 12035:tid 12043] [client 143.110.222.122:48456] [client 143.110.222.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.222.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPJe7cVHrNSHjCo-0pwgQAAAgE"]
[Thu Dec 18 17:29:33.911506 2025] [:error] [pid 12035:tid 12048] [client 143.110.222.122:48476] [client 143.110.222.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.222.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPJfbcVHrNSHjCo-0pwgwAAAgY"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 17:43:17.550859 2025] [:error] [pid 12239:tid 12253] [client 92.205.55.71:47020] [client 92.205.55.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.55.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPMtdNnXxfGIuWO6anb_QAAAok"]
[Thu Dec 18 17:43:18.741774 2025] [:error] [pid 12239:tid 12258] [client 92.205.55.71:47020] [client 92.205.55.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.55.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPMttNnXxfGIuWO6ancAAAAAo4"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 17:56:38.216338 2025] [:error] [pid 23558:tid 23620] [client 192.185.81.213:60708] [client 192.185.81.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.81.213, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPP1uHam9NbgPQa9ubofAAAAMU"]
[Thu Dec 18 17:56:39.173147 2025] [:error] [pid 23558:tid 23631] [client 192.185.81.213:60708] [client 192.185.81.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.81.213, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPP1-Ham9NbgPQa9ubofwAAANA"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 18:07:16.627835 2025] [:error] [pid 25357:tid 25360] [client 191.233.136.135:43520] [client 191.233.136.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 191.233.136.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPSVIaT7bsEXnJVfJc9bQAAAcE"]
[Thu Dec 18 18:07:18.572954 2025] [:error] [pid 25357:tid 25363] [client 191.233.136.135:43520] [client 191.233.136.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 191.233.136.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPSVoaT7bsEXnJVfJc9bgAAAcQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 18:16:33.466445 2025] [:error] [pid 12239:tid 12249] [client 185.177.152.233:55060] [client 185.177.152.233] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.177.152.233, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPUgdNnXxfGIuWO6anl3QAAAoU"]
[Thu Dec 18 18:16:34.521316 2025] [:error] [pid 12239:tid 12261] [client 185.177.152.233:55060] [client 185.177.152.233] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.177.152.233, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPUgtNnXxfGIuWO6anl3wAAApE"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 18:21:37.905177 2025] [:error] [pid 12035:tid 12055] [client 197.242.158.15:48792] [client 197.242.158.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 197.242.158.15, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPVsbcVHrNSHjCo-0p5sQAAAgw"]
[Thu Dec 18 18:21:39.675347 2025] [:error] [pid 12035:tid 12052] [client 197.242.158.15:48792] [client 197.242.158.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 197.242.158.15, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPVs7cVHrNSHjCo-0p5sgAAAgo"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 18:26:19.141403 2025] [:error] [pid 12383:tid 12398] [client 20.120.241.165:41522] [client 20.120.241.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.120.241.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPWy_dgllo9h1cyxGanWwAAAsw"]
[Thu Dec 18 18:26:21.284327 2025] [:error] [pid 24433:tid 24439] [client 20.120.241.165:50544] [client 20.120.241.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.120.241.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPWzZ4pN9ycmipm8Ti5gQAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 18:30:56.319728 2025] [:error] [pid 24542:tid 24555] [client 185.23.117.23:38958] [client 185.23.117.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.23.117.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPX4EtQz4H2oS3NrDbeSAAAAUs"]
[Thu Dec 18 18:30:57.342217 2025] [:error] [pid 24542:tid 24549] [client 185.23.117.23:38958] [client 185.23.117.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.23.117.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPX4UtQz4H2oS3NrDbeSQAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 18:35:33.206809 2025] [:error] [pid 12239:tid 12245] [client 95.217.134.239:40724] [client 95.217.134.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.217.134.239, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPY9dNnXxfGIuWO6anqkwAAAoE"]
[Thu Dec 18 18:35:34.312560 2025] [:error] [pid 12239:tid 12252] [client 95.217.134.239:40724] [client 95.217.134.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.217.134.239, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPY9tNnXxfGIuWO6anqlQAAAog"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 18:40:13.835133 2025] [:error] [pid 23558:tid 23626] [client 208.109.34.85:55312] [client 208.109.34.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.34.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPaDeHam9NbgPQa9ub3KQAAAMs"]
[Thu Dec 18 18:40:14.926625 2025] [:error] [pid 23558:tid 23629] [client 208.109.34.85:55312] [client 208.109.34.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.34.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPaDuHam9NbgPQa9ub3MgAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 18:44:44.599391 2025] [:error] [pid 24542:tid 24564] [client 148.66.155.24:40134] [client 148.66.155.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.66.155.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPbHEtQz4H2oS3NrDbkQwAAAVQ"]
[Thu Dec 18 18:44:45.590272 2025] [:error] [pid 24542:tid 24553] [client 148.66.155.24:40134] [client 148.66.155.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.66.155.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPbHUtQz4H2oS3NrDbkSwAAAUk"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 18:58:10.197720 2025] [:error] [pid 24433:tid 24454] [client 208.109.34.85:53632] [client 208.109.34.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.34.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPeQp4pN9ycmipm8TjAVAAAARI"]
[Thu Dec 18 18:58:11.401249 2025] [:error] [pid 24433:tid 24458] [client 208.109.34.85:53632] [client 208.109.34.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.34.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUPeQ54pN9ycmipm8TjAVwAAARY"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 19:47:09.865116 2025] [:error] [pid 12239:tid 12254] [client 93.92.233.214:33756] [client 93.92.233.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.92.233.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUPpvdNnXxfGIuWO6an95QAAAoo"]
[Thu Dec 18 20:05:09.887596 2025] [:error] [pid 23558:tid 23635] [client 65.181.111.160:39670] [client 65.181.111.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.181.111.160, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUPt9eHam9NbgPQa9uYOwwAAANQ"]
[Thu Dec 18 20:26:21.190437 2025] [:error] [pid 23558:tid 23634] [client 142.93.129.190:41264] [client 142.93.129.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aUPy7eHam9NbgPQa9uYVzAAAANM"]
[Thu Dec 18 20:26:31.334889 2025] [authz_core:error] [pid 23556:tid 23573] [client 142.93.129.190:57170] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Thu Dec 18 20:26:34.577495 2025] [:error] [pid 12035:tid 12066] [client 182.44.2.148:51320] [client 182.44.2.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aUPy-rcVHrNSHjCo-0qO4gAAAhc"]
[Thu Dec 18 20:26:36.178763 2025] [:error] [pid 12239:tid 12248] [client 142.93.129.190:57450] [client 142.93.129.190] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aUPy_NNnXxfGIuWO6akGvAAAAoQ"]
[Thu Dec 18 20:26:38.170029 2025] [:error] [pid 24542:tid 24545] [client 142.93.129.190:57454] [client 142.93.129.190] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aUPy_ktQz4H2oS3NrDYKrwAAAUE"]
[Thu Dec 18 20:56:54.402373 2025] [:error] [pid 12035:tid 12054] [client 87.121.113.61:52506] [client 87.121.113.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.121.113.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUP6FrcVHrNSHjCo-0qUnQAAAgs"]
[Thu Dec 18 21:18:10.380149 2025] [:error] [pid 12239:tid 12251] [client 4.194.154.207:20733] [client 4.194.154.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/about.php"] [unique_id "aUP_EtNnXxfGIuWO6akWPgAAAoc"]
[Thu Dec 18 21:18:15.143570 2025] [:error] [pid 25357:tid 25359] [client 4.194.154.207:20636] [client 4.194.154.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/zxl.php"] [unique_id "aUP_F4aT7bsEXnJVfJdqzAAAAcA"]
[Thu Dec 18 21:18:19.003941 2025] [:error] [pid 23645:tid 23659] [client 4.194.154.207:20704] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aUP_Gzf_Rx0Y0ao_QJhedAAAAIw"]
[Thu Dec 18 21:18:21.397714 2025] [:error] [pid 23558:tid 23624] [client 4.194.154.207:20618] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aUP_HeHam9NbgPQa9uYlfQAAAMk"]
[Thu Dec 18 21:18:22.200952 2025] [:error] [pid 23558:tid 23616] [client 4.194.154.207:20699] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aUP_HuHam9NbgPQa9uYlfgAAAME"]
[Thu Dec 18 21:18:23.190811 2025] [:error] [pid 23645:tid 23651] [client 4.194.154.207:20702] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aUP_Hzf_Rx0Y0ao_QJheeAAAAIQ"]
[Thu Dec 18 21:18:25.112867 2025] [:error] [pid 12383:tid 12410] [client 4.194.154.207:20686] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pu.php"] [unique_id "aUP_Ifdgllo9h1cyxGbGjAAAAtg"]
[Thu Dec 18 21:18:27.223869 2025] [:error] [pid 12035:tid 12058] [client 4.194.154.207:20714] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pu.php"] [unique_id "aUP_I7cVHrNSHjCo-0qYzAAAAg8"]
[Thu Dec 18 21:18:32.700597 2025] [:error] [pid 24542:tid 24560] [client 4.194.154.207:20730] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pu.php"] [unique_id "aUP_KEtQz4H2oS3NrDYflQAAAVA"]
[Thu Dec 18 21:18:34.593684 2025] [:error] [pid 24542:tid 24568] [client 4.194.154.207:20711] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pu.php"] [unique_id "aUP_KktQz4H2oS3NrDYfmgAAAVg"]
[Thu Dec 18 21:18:38.479250 2025] [:error] [pid 12383:tid 12401] [client 4.194.154.207:20735] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sfcl.php"] [unique_id "aUP_Lvdgllo9h1cyxGbGqwAAAs8"]
[Thu Dec 18 21:18:45.914482 2025] [:error] [pid 24433:tid 24459] [client 4.194.154.207:20705] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sfcl.php"] [unique_id "aUP_NZ4pN9ycmipm8TjapQAAARc"]
[Thu Dec 18 21:18:48.071927 2025] [:error] [pid 25357:tid 25364] [client 4.194.154.207:20673] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sfcl.php"] [unique_id "aUP_OIaT7bsEXnJVfJdq7AAAAcU"]
[Thu Dec 18 21:18:49.680264 2025] [:error] [pid 24433:tid 24437] [client 4.194.154.207:20611] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sfcl.php"] [unique_id "aUP_OZ4pN9ycmipm8TjaqwAAAQE"]
[Thu Dec 18 21:18:58.263736 2025] [:error] [pid 24542:tid 24546] [client 4.194.154.207:20608] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/npcs7k.php"] [unique_id "aUP_QktQz4H2oS3NrDYftwAAAUI"]
[Thu Dec 18 21:18:59.281052 2025] [:error] [pid 24433:tid 24458] [client 4.194.154.207:20619] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/npcs7k.php"] [unique_id "aUP_Q54pN9ycmipm8TjasQAAARY"]
[Thu Dec 18 21:19:00.351659 2025] [:error] [pid 12239:tid 12249] [client 4.194.154.207:20710] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/npcs7k.php"] [unique_id "aUP_RNNnXxfGIuWO6akWjwAAAoU"]
[Thu Dec 18 21:19:02.391766 2025] [:error] [pid 24433:tid 24459] [client 4.194.154.207:20615] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/npcs7k.php"] [unique_id "aUP_Rp4pN9ycmipm8TjatAAAARc"]
[Thu Dec 18 21:19:03.763268 2025] [:error] [pid 24542:tid 24553] [client 4.194.154.207:20690] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/galex.php"] [unique_id "aUP_R0tQz4H2oS3NrDYfwAAAAUk"]
[Thu Dec 18 21:19:05.499889 2025] [:error] [pid 23558:tid 23628] [client 4.194.154.207:20682] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/galex.php"] [unique_id "aUP_SeHam9NbgPQa9uYluQAAAM0"]
[Thu Dec 18 21:19:07.068317 2025] [:error] [pid 23558:tid 23621] [client 4.194.154.207:20635] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/galex.php"] [unique_id "aUP_S-Ham9NbgPQa9uYlvAAAAMY"]
[Thu Dec 18 21:19:13.368470 2025] [:error] [pid 25357:tid 25382] [client 4.194.154.207:14300] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/galex.php"] [unique_id "aUP_UYaT7bsEXnJVfJdq_gAAAdc"]
[Thu Dec 18 21:19:14.418823 2025] [:error] [pid 23558:tid 23629] [client 4.194.154.207:20712] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cro.php"] [unique_id "aUP_UuHam9NbgPQa9uYlyAAAAM4"]
[Thu Dec 18 21:19:15.575832 2025] [:error] [pid 24433:tid 24459] [client 4.194.154.207:14297] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cro.php"] [unique_id "aUP_U54pN9ycmipm8TjaxgAAARc"]
[Thu Dec 18 21:19:22.079187 2025] [:error] [pid 12383:tid 12395] [client 4.194.154.207:20616] [client 4.194.154.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aUP_Wvdgllo9h1cyxGbGxAAAAsk"]
[Thu Dec 18 21:19:29.018957 2025] [:error] [pid 23556:tid 23571] [client 4.194.154.207:20697] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aUP_YRnmLlk3u5yt9kHp6gAAAAs"]
[Thu Dec 18 21:19:32.818004 2025] [:error] [pid 23645:tid 23659] [client 4.194.154.207:20632] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aUP_ZDf_Rx0Y0ao_QJheugAAAIw"]
[Thu Dec 18 21:19:33.653179 2025] [:error] [pid 25357:tid 25376] [client 4.194.154.207:20674] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aUP_ZYaT7bsEXnJVfJdrFQAAAdE"]
[Thu Dec 18 21:19:38.410522 2025] [:error] [pid 12239:tid 12245] [client 4.194.154.207:20691] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aUP_atNnXxfGIuWO6akWzwAAAoE"]
[Thu Dec 18 21:19:42.003743 2025] [:error] [pid 12239:tid 12256] [client 4.194.154.207:20706] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aUP_btNnXxfGIuWO6akW0AAAAow"]
[Thu Dec 18 21:19:47.184188 2025] [:error] [pid 12035:tid 12043] [client 4.194.154.207:20626] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aUP_c7cVHrNSHjCo-0qZCwAAAgE"]
[Thu Dec 18 21:19:48.607023 2025] [:error] [pid 12239:tid 12254] [client 4.194.154.207:20720] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aUP_dNNnXxfGIuWO6akW1AAAAoo"]
[Thu Dec 18 21:19:52.060504 2025] [:error] [pid 24542:tid 24554] [client 4.194.154.207:20718] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aUP_eEtQz4H2oS3NrDYf5gAAAUo"]
[Thu Dec 18 21:19:54.880866 2025] [:error] [pid 12239:tid 12244] [client 4.194.154.207:20693] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aves.php"] [unique_id "aUP_etNnXxfGIuWO6akW5QAAAoA"]
[Thu Dec 18 21:20:00.836626 2025] [:error] [pid 23556:tid 23580] [client 4.194.154.207:20642] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aves.php"] [unique_id "aUP_gBnmLlk3u5yt9kHp-AAAABQ"]
[Thu Dec 18 21:20:02.539663 2025] [:error] [pid 23645:tid 23667] [client 4.194.154.207:20650] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aves.php"] [unique_id "aUP_gjf_Rx0Y0ao_QJhe0gAAAJQ"]
[Thu Dec 18 21:20:08.579301 2025] [:error] [pid 23556:tid 23577] [client 4.194.154.207:20648] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/chosen.php"] [unique_id "aUP_iBnmLlk3u5yt9kHp_gAAABE"]
[Thu Dec 18 21:20:11.114634 2025] [:error] [pid 23558:tid 23623] [client 4.194.154.207:20614] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/chosen.php"] [unique_id "aUP_i-Ham9NbgPQa9uYmDgAAAMg"]
[Thu Dec 18 21:20:17.293696 2025] [:error] [pid 24542:tid 24559] [client 4.194.154.207:20700] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/chosen.php"] [unique_id "aUP_kUtQz4H2oS3NrDYf_AAAAU8"]
[Thu Dec 18 21:20:19.081310 2025] [:error] [pid 12239:tid 12250] [client 4.194.154.207:20610] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/chosen.php"] [unique_id "aUP_k9NnXxfGIuWO6akXGAAAAoY"]
[Thu Dec 18 21:20:21.037329 2025] [:error] [pid 24542:tid 24556] [client 4.194.154.207:20625] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aUP_lUtQz4H2oS3NrDYgCAAAAUw"]
[Thu Dec 18 21:20:26.037475 2025] [:error] [pid 24542:tid 24548] [client 4.194.154.207:20613] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aUP_mktQz4H2oS3NrDYgGAAAAUQ"]
[Thu Dec 18 21:20:27.369997 2025] [:error] [pid 24542:tid 24562] [client 4.194.154.207:20732] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aUP_m0tQz4H2oS3NrDYgHgAAAVI"]
[Thu Dec 18 21:20:34.248384 2025] [autoindex:error] [pid 24542:tid 24549] [client 4.194.154.207:20726] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 21:20:40.380167 2025] [:error] [pid 24542:tid 24548] [client 4.194.154.207:20726] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/packed.php"] [unique_id "aUP_qEtQz4H2oS3NrDYgNQAAAUQ"]
[Thu Dec 18 21:20:42.258117 2025] [:error] [pid 24542:tid 24556] [client 4.194.154.207:20668] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/packed.php"] [unique_id "aUP_qktQz4H2oS3NrDYgNwAAAUw"]
[Thu Dec 18 21:20:43.496326 2025] [:error] [pid 12239:tid 12259] [client 4.194.154.207:20725] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/packed.php"] [unique_id "aUP_q9NnXxfGIuWO6akXOwAAAo8"]
[Thu Dec 18 21:20:45.702588 2025] [:error] [pid 23645:tid 23649] [client 4.194.154.207:20645] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/packed.php"] [unique_id "aUP_rTf_Rx0Y0ao_QJhe_AAAAII"]
[Thu Dec 18 21:20:47.674947 2025] [:error] [pid 12239:tid 12255] [client 4.194.154.207:20709] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aUP_r9NnXxfGIuWO6akXRwAAAos"]
[Thu Dec 18 21:20:48.306647 2025] [:error] [pid 25357:tid 25381] [client 4.194.154.207:14308] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aUP_sIaT7bsEXnJVfJdrWQAAAdY"]
[Thu Dec 18 21:20:50.815458 2025] [:error] [pid 12383:tid 12393] [client 4.194.154.207:14307] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aUP_svdgllo9h1cyxGbHKwAAAsc"]
[Thu Dec 18 21:20:53.214631 2025] [:error] [pid 24958:tid 24983] [client 4.194.154.207:20713] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aUP_tckDOrUkd0wNm2HOjgAAAZY"]
[Thu Dec 18 21:20:54.596082 2025] [:error] [pid 24958:tid 24970] [client 4.194.154.207:20701] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/usep.php"] [unique_id "aUP_tskDOrUkd0wNm2HOkQAAAYk"]
[Thu Dec 18 21:20:59.626096 2025] [:error] [pid 23556:tid 23576] [client 4.194.154.207:20641] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/usep.php"] [unique_id "aUP_uxnmLlk3u5yt9kHqHQAAABA"]
[Thu Dec 18 21:21:00.160246 2025] [:error] [pid 12035:tid 12052] [client 4.194.154.207:14282] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/usep.php"] [unique_id "aUP_vLcVHrNSHjCo-0qZXAAAAgo"]
[Thu Dec 18 21:21:00.998828 2025] [:error] [pid 12383:tid 12403] [client 4.194.154.207:14306] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/usep.php"] [unique_id "aUP_vPdgllo9h1cyxGbHLwAAAtE"]
[Thu Dec 18 21:21:02.438562 2025] [:error] [pid 12239:tid 12256] [client 4.194.154.207:20694] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aUP_vtNnXxfGIuWO6akXTwAAAow"]
[Thu Dec 18 21:21:03.784839 2025] [:error] [pid 24958:tid 24980] [client 4.194.154.207:20722] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aUP_v8kDOrUkd0wNm2HOnwAAAZM"]
[Thu Dec 18 21:21:07.503460 2025] [:error] [pid 23558:tid 23637] [client 4.194.154.207:20715] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aUP_w-Ham9NbgPQa9uYmKAAAANY"]
[Thu Dec 18 21:21:09.600431 2025] [:error] [pid 23645:tid 23658] [client 4.194.154.207:20687] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aUP_xTf_Rx0Y0ao_QJhfHwAAAIs"]
[Thu Dec 18 21:21:10.783520 2025] [:error] [pid 23556:tid 23584] [client 4.194.154.207:20696] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd67.php"] [unique_id "aUP_xhnmLlk3u5yt9kHqJQAAABg"]
[Thu Dec 18 21:21:11.416804 2025] [:error] [pid 23558:tid 23630] [client 4.194.154.207:14310] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd67.php"] [unique_id "aUP_x-Ham9NbgPQa9uYmKwAAAM8"]
[Thu Dec 18 21:21:13.194060 2025] [:error] [pid 24542:tid 24547] [client 4.194.154.207:14277] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd67.php"] [unique_id "aUP_yUtQz4H2oS3NrDYgUgAAAUM"]
[Thu Dec 18 21:21:15.663250 2025] [:error] [pid 23556:tid 23569] [client 4.194.154.207:20623] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd67.php"] [unique_id "aUP_yxnmLlk3u5yt9kHqKAAAAAk"]
[Thu Dec 18 21:21:17.155142 2025] [:error] [pid 12383:tid 12394] [client 4.194.154.207:20654] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aUP_zfdgllo9h1cyxGbHNwAAAsg"]
[Thu Dec 18 21:21:18.476296 2025] [:error] [pid 12239:tid 12244] [client 4.194.154.207:20657] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aUP_ztNnXxfGIuWO6akXbQAAAoA"]
[Thu Dec 18 21:21:20.528054 2025] [:error] [pid 12035:tid 12049] [client 4.194.154.207:20612] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aUP_0LcVHrNSHjCo-0qZaQAAAgc"]
[Thu Dec 18 21:21:21.667813 2025] [:error] [pid 12035:tid 12052] [client 4.194.154.207:20639] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aUP_0bcVHrNSHjCo-0qZbQAAAgo"]
[Thu Dec 18 21:21:25.425720 2025] [:error] [pid 12239:tid 12251] [client 4.194.154.207:20666] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rss.php"] [unique_id "aUP_1dNnXxfGIuWO6akXdgAAAoc"]
[Thu Dec 18 21:21:28.328096 2025] [:error] [pid 24542:tid 24563] [client 4.194.154.207:20734] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rss.php"] [unique_id "aUP_2EtQz4H2oS3NrDYgZQAAAVM"]
[Thu Dec 18 21:21:31.091171 2025] [:error] [pid 24542:tid 24561] [client 4.194.154.207:20659] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rss.php"] [unique_id "aUP_20tQz4H2oS3NrDYgaQAAAVE"]
[Thu Dec 18 21:21:32.096513 2025] [:error] [pid 25357:tid 25377] [client 4.194.154.207:20649] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rss.php"] [unique_id "aUP_3IaT7bsEXnJVfJdrdQAAAdI"]
[Thu Dec 18 21:21:34.965236 2025] [:error] [pid 24433:tid 24443] [client 4.194.154.207:20717] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpls.php"] [unique_id "aUP_3p4pN9ycmipm8TjbLAAAAQc"]
[Thu Dec 18 21:21:37.083469 2025] [:error] [pid 23556:tid 23569] [client 4.194.154.207:14290] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpls.php"] [unique_id "aUP_4RnmLlk3u5yt9kHqNQAAAAk"]
[Thu Dec 18 21:21:37.591670 2025] [:error] [pid 23556:tid 23567] [client 4.194.154.207:14284] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpls.php"] [unique_id "aUP_4RnmLlk3u5yt9kHqNgAAAAc"]
[Thu Dec 18 21:21:48.916700 2025] [autoindex:error] [pid 24433:tid 24444] [client 4.194.154.207:20621] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 21:21:50.528160 2025] [:error] [pid 24433:tid 24438] [client 4.194.154.207:20621] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aUP_7p4pN9ycmipm8TjbQQAAAQI"]
[Thu Dec 18 21:21:52.311082 2025] [:error] [pid 12383:tid 12387] [client 4.194.154.207:20671] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aUP_8Pdgllo9h1cyxGbHPwAAAsE"]
[Thu Dec 18 21:21:54.705984 2025] [:error] [pid 23645:tid 23652] [client 4.194.154.207:14225] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aUP_8jf_Rx0Y0ao_QJhfNgAAAIU"]
[Thu Dec 18 21:21:57.584266 2025] [:error] [pid 12035:tid 12066] [client 4.194.154.207:14294] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp-conflg.php"] [unique_id "aUP_9bcVHrNSHjCo-0qZiQAAAhc"]
[Thu Dec 18 21:22:01.817980 2025] [:error] [pid 12239:tid 12268] [client 4.194.154.207:20644] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aUP_-dNnXxfGIuWO6akXxwAAApg"]
[Thu Dec 18 21:22:04.840027 2025] [:error] [pid 12239:tid 12245] [client 4.194.154.207:20651] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aUP__NNnXxfGIuWO6akXywAAAoE"]
[Thu Dec 18 21:22:07.581320 2025] [:error] [pid 12239:tid 12248] [client 4.194.154.207:14279] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aUP__9NnXxfGIuWO6akXzAAAAoQ"]
[Thu Dec 18 21:22:09.046345 2025] [:error] [pid 12239:tid 12262] [client 4.194.154.207:14307] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aUQAAdNnXxfGIuWO6akXzwAAApI"]
[Thu Dec 18 21:22:10.558857 2025] [:error] [pid 25357:tid 25362] [client 4.194.154.207:20672] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/json.php"] [unique_id "aUQAAoaT7bsEXnJVfJdrjAAAAcM"]
[Thu Dec 18 21:22:12.480820 2025] [:error] [pid 12035:tid 12054] [client 4.194.154.207:14208] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/json.php"] [unique_id "aUQABLcVHrNSHjCo-0qZkgAAAgs"]
[Thu Dec 18 21:22:13.413919 2025] [:error] [pid 25357:tid 25365] [client 4.194.154.207:20631] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/json.php"] [unique_id "aUQABYaT7bsEXnJVfJdrjwAAAcY"]
[Thu Dec 18 21:22:15.790718 2025] [:error] [pid 24433:tid 24442] [client 4.194.154.207:14320] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/json.php"] [unique_id "aUQAB54pN9ycmipm8TjbTQAAAQY"]
[Thu Dec 18 21:22:20.450053 2025] [:error] [pid 23645:tid 23657] [client 4.194.154.207:20677] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aUQADDf_Rx0Y0ao_QJhfQAAAAIo"]
[Thu Dec 18 21:22:30.933520 2025] [:error] [pid 24542:tid 24559] [client 4.194.154.207:20629] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aUQAFktQz4H2oS3NrDYgsgAAAU8"]
[Thu Dec 18 21:22:31.815750 2025] [:error] [pid 24542:tid 24560] [client 4.194.154.207:20660] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUQAF0tQz4H2oS3NrDYgswAAAVA"]
[Thu Dec 18 21:22:32.763503 2025] [:error] [pid 12383:tid 12389] [client 4.194.154.207:20637] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUQAGPdgllo9h1cyxGbHYwAAAsM"]
[Thu Dec 18 21:22:34.056630 2025] [:error] [pid 24542:tid 24550] [client 4.194.154.207:14295] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUQAGktQz4H2oS3NrDYgtgAAAUY"]
[Thu Dec 18 21:22:35.005008 2025] [:error] [pid 23558:tid 23629] [client 4.194.154.207:20720] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUQAG-Ham9NbgPQa9uYmUwAAAM4"]
[Thu Dec 18 21:22:44.496903 2025] [:error] [pid 25357:tid 25373] [client 4.194.154.207:20622] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "aUQAJIaT7bsEXnJVfJdrvQAAAc4"]
[Thu Dec 18 21:22:47.637702 2025] [:error] [pid 12239:tid 12248] [client 4.194.154.207:20680] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "aUQAJ9NnXxfGIuWO6akX9wAAAoQ"]
[Thu Dec 18 21:22:54.400971 2025] [autoindex:error] [pid 12239:tid 12244] [client 4.194.154.207:20731] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Dec 18 21:22:59.681153 2025] [:error] [pid 24433:tid 24446] [client 4.194.154.207:20721] [client 4.194.154.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.194.154.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQAM54pN9ycmipm8TjbggAAAQo"]
[Thu Dec 18 21:23:02.956874 2025] [:error] [pid 12239:tid 12263] [client 4.194.154.207:20731] [client 4.194.154.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.194.154.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/cgi-bin/wp-login.php"] [unique_id "aUQANtNnXxfGIuWO6akYJQAAApM"]
[Thu Dec 18 21:23:06.543434 2025] [:error] [pid 12239:tid 12260] [client 4.194.154.207:20731] [client 4.194.154.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aUQAOtNnXxfGIuWO6akYUgAAApA"]
[Thu Dec 18 21:23:09.151237 2025] [:error] [pid 24542:tid 24553] [client 4.194.154.207:14318] [client 4.194.154.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.194.154.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQAPUtQz4H2oS3NrDYhEQAAAUk"]
[Thu Dec 18 21:23:10.890654 2025] [:error] [pid 25357:tid 25372] [client 4.194.154.207:20704] [client 4.194.154.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.194.154.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQAPoaT7bsEXnJVfJdryAAAAc0"]
[Thu Dec 18 21:23:13.354076 2025] [:error] [pid 24542:tid 24567] [client 4.194.154.207:14318] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/index.php"] [unique_id "aUQAQUtQz4H2oS3NrDYhGwAAAVc"]
[Thu Dec 18 21:23:14.676886 2025] [:error] [pid 12035:tid 12050] [client 4.194.154.207:20653] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/index.php"] [unique_id "aUQAQrcVHrNSHjCo-0qZwQAAAgg"]
[Thu Dec 18 21:23:16.529949 2025] [:error] [pid 12239:tid 12267] [client 4.194.154.207:20638] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/index.php"] [unique_id "aUQARNNnXxfGIuWO6akYXgAAApc"]
[Thu Dec 18 21:23:17.422242 2025] [:error] [pid 23645:tid 23647] [client 4.194.154.207:14273] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/index.php"] [unique_id "aUQARTf_Rx0Y0ao_QJhfkQAAAIA"]
[Thu Dec 18 21:23:19.753959 2025] [:error] [pid 23645:tid 23667] [client 4.194.154.207:20719] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geck.php"] [unique_id "aUQARzf_Rx0Y0ao_QJhflAAAAJQ"]
[Thu Dec 18 21:23:21.127877 2025] [:error] [pid 24433:tid 24437] [client 4.194.154.207:14289] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geck.php"] [unique_id "aUQASZ4pN9ycmipm8TjbigAAAQE"]
[Thu Dec 18 21:23:22.700069 2025] [:error] [pid 23556:tid 23572] [client 4.194.154.207:20733] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geck.php"] [unique_id "aUQAShnmLlk3u5yt9kHqlwAAAAw"]
[Thu Dec 18 21:23:24.657435 2025] [:error] [pid 24433:tid 24450] [client 4.194.154.207:14329] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geck.php"] [unique_id "aUQATJ4pN9ycmipm8TjbjAAAAQ4"]
[Thu Dec 18 21:23:25.478865 2025] [:error] [pid 24542:tid 24545] [client 4.194.154.207:14233] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aUQATUtQz4H2oS3NrDYhIQAAAUE"]
[Thu Dec 18 21:23:26.513586 2025] [:error] [pid 23645:tid 23652] [client 4.194.154.207:20695] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aUQATjf_Rx0Y0ao_QJhflgAAAIU"]
[Thu Dec 18 21:23:27.947229 2025] [:error] [pid 24958:tid 24964] [client 4.194.154.207:20723] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aUQAT8kDOrUkd0wNm2HPBgAAAYM"]
[Thu Dec 18 21:23:29.973135 2025] [:error] [pid 23645:tid 23671] [client 4.194.154.207:20730] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aUQAUTf_Rx0Y0ao_QJhfmgAAAJg"]
[Thu Dec 18 21:23:31.929198 2025] [:error] [pid 23558:tid 23630] [client 4.194.154.207:20634] [client 4.194.154.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUQAU-Ham9NbgPQa9uYmjwAAAM8"]
[Thu Dec 18 21:23:33.414688 2025] [:error] [pid 23558:tid 23638] [client 4.194.154.207:20735] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qlex1.php"] [unique_id "aUQAVeHam9NbgPQa9uYmkgAAANc"]
[Thu Dec 18 21:23:34.124077 2025] [:error] [pid 12035:tid 12048] [client 4.194.154.207:20684] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qlex1.php"] [unique_id "aUQAVrcVHrNSHjCo-0qZzQAAAgY"]
[Thu Dec 18 21:23:38.013705 2025] [:error] [pid 23556:tid 23564] [client 4.194.154.207:20692] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qlex1.php"] [unique_id "aUQAWhnmLlk3u5yt9kHqpQAAAAQ"]
[Thu Dec 18 21:23:39.786483 2025] [:error] [pid 23558:tid 23620] [client 4.194.154.207:20721] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qlex1.php"] [unique_id "aUQAW-Ham9NbgPQa9uYmnwAAAMU"]
[Thu Dec 18 21:23:41.043047 2025] [:error] [pid 24542:tid 24549] [client 4.194.154.207:20640] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aUQAXUtQz4H2oS3NrDYhLAAAAUU"]
[Thu Dec 18 21:23:41.918990 2025] [:error] [pid 12383:tid 12410] [client 4.194.154.207:14317] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aUQAXfdgllo9h1cyxGbH3AAAAtg"]
[Thu Dec 18 21:23:44.651294 2025] [:error] [pid 24433:tid 24450] [client 4.194.154.207:20714] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aUQAYJ4pN9ycmipm8TjbmgAAAQ4"]
[Thu Dec 18 21:23:45.489396 2025] [:error] [pid 12035:tid 12052] [client 4.194.154.207:20633] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aUQAYbcVHrNSHjCo-0qZ0gAAAgo"]
[Thu Dec 18 21:23:48.358908 2025] [:error] [pid 24433:tid 24454] [client 4.194.154.207:14313] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/autoload_classmap.php"] [unique_id "aUQAZJ4pN9ycmipm8TjbmwAAARI"]
[Thu Dec 18 21:23:48.927602 2025] [:error] [pid 23558:tid 23629] [client 4.194.154.207:20685] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/autoload_classmap.php"] [unique_id "aUQAZOHam9NbgPQa9uYmsAAAAM4"]
[Thu Dec 18 21:23:50.730731 2025] [:error] [pid 12239:tid 12256] [client 4.194.154.207:20635] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/autoload_classmap.php"] [unique_id "aUQAZtNnXxfGIuWO6akYgAAAAow"]
[Thu Dec 18 21:23:51.269851 2025] [:error] [pid 12239:tid 12261] [client 4.194.154.207:20704] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/autoload_classmap.php"] [unique_id "aUQAZ9NnXxfGIuWO6akYgQAAApE"]
[Thu Dec 18 21:23:55.336162 2025] [:error] [pid 12239:tid 12249] [client 4.194.154.207:20728] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aUQAa9NnXxfGIuWO6akYjQAAAoU"]
[Thu Dec 18 21:23:58.157271 2025] [:error] [pid 12239:tid 12247] [client 4.194.154.207:20663] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aUQAbtNnXxfGIuWO6akYkwAAAoM"]
[Thu Dec 18 21:24:00.807359 2025] [:error] [pid 25357:tid 25381] [client 4.194.154.207:20681] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aUQAcIaT7bsEXnJVfJdr7gAAAdY"]
[Thu Dec 18 21:24:03.144482 2025] [:error] [pid 24433:tid 24451] [client 4.194.154.207:14324] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aUQAc54pN9ycmipm8TjboQAAAQ8"]
[Thu Dec 18 21:24:05.296277 2025] [:error] [pid 23558:tid 23637] [client 4.194.154.207:20679] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aUQAdeHam9NbgPQa9uYm3QAAANY"]
[Thu Dec 18 21:24:07.834880 2025] [:error] [pid 12239:tid 12259] [client 4.194.154.207:20675] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aUQAd9NnXxfGIuWO6akYnwAAAo8"]
[Thu Dec 18 21:24:08.568353 2025] [:error] [pid 24433:tid 24459] [client 4.194.154.207:20617] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aUQAeJ4pN9ycmipm8TjbvQAAARc"]
[Thu Dec 18 21:24:09.866327 2025] [:error] [pid 12383:tid 12403] [client 4.194.154.207:20655] [client 4.194.154.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aUQAefdgllo9h1cyxGbH6AAAAtE"]
[Thu Dec 18 21:24:11.299531 2025] [:error] [pid 12239:tid 12249] [client 4.194.154.207:14276] [client 4.194.154.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/mah.php"] [unique_id "aUQAe9NnXxfGIuWO6akYowAAAoU"]
[Thu Dec 18 21:58:10.901713 2025] [:error] [pid 12383:tid 12397] [client 168.232.229.167:43616] [client 168.232.229.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.232.229.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUQIcvdgllo9h1cyxGbPUgAAAss"]
[Thu Dec 18 22:26:21.928869 2025] [:error] [pid 24542:tid 24562] [client 192.241.135.45:51442] [client 192.241.135.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.241.135.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUQPDUtQz4H2oS3NrDYyGQAAAVI"]
[Thu Dec 18 22:34:34.781346 2025] [:error] [pid 25357:tid 25375] [client 93.92.233.214:47164] [client 93.92.233.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.92.233.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUQQ-oaT7bsEXnJVfJd8wgAAAdA"]
[Thu Dec 18 22:44:38.063495 2025] [:error] [pid 24433:tid 24453] [client 103.15.50.124:59866] [client 103.15.50.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.15.50.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQTVp4pN9ycmipm8TjqLwAAARE"]
[Thu Dec 18 22:44:41.857694 2025] [:error] [pid 24433:tid 24456] [client 103.15.50.124:59866] [client 103.15.50.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.15.50.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQTWZ4pN9ycmipm8TjqOAAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 22:45:03.915962 2025] [:error] [pid 24542:tid 24551] [client 69.163.140.5:37132] [client 69.163.140.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.163.140.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQTb0tQz4H2oS3NrDY34QAAAUc"]
[Thu Dec 18 22:45:05.242772 2025] [:error] [pid 24542:tid 24546] [client 69.163.140.5:37132] [client 69.163.140.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.163.140.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQTcUtQz4H2oS3NrDY37wAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 22:45:19.366890 2025] [:error] [pid 24542:tid 24550] [client 192.241.135.45:35964] [client 192.241.135.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.241.135.45, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQTf0tQz4H2oS3NrDY4DgAAAUY"]
[Thu Dec 18 22:45:20.255685 2025] [:error] [pid 24542:tid 24564] [client 192.241.135.45:35964] [client 192.241.135.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.241.135.45, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQTgEtQz4H2oS3NrDY4EAAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 22:45:26.595495 2025] [:error] [pid 24958:tid 24971] [client 217.182.237.51:60324] [client 217.182.237.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.182.237.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQThskDOrUkd0wNm2HcFQAAAYo"]
[Thu Dec 18 22:45:28.122271 2025] [:error] [pid 24958:tid 24974] [client 217.182.237.51:60324] [client 217.182.237.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.182.237.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQTiMkDOrUkd0wNm2HcFgAAAY0"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 22:48:13.066028 2025] [:error] [pid 23558:tid 23637] [client 61.219.140.50:52948] [client 61.219.140.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 61.219.140.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQULeHam9NbgPQa9uY8BQAAANY"]
[Thu Dec 18 22:48:41.327573 2025] [:error] [pid 12035:tid 12052] [client 193.181.210.95:49512] [client 193.181.210.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.181.210.95, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQUSbcVHrNSHjCo-0qmiwAAAgo"]
[Thu Dec 18 22:48:43.419651 2025] [:error] [pid 12035:tid 12046] [client 193.181.210.95:49512] [client 193.181.210.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.181.210.95, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQUS7cVHrNSHjCo-0qmjAAAAgQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 22:49:05.931144 2025] [:error] [pid 24958:tid 24982] [client 42.96.37.226:45568] [client 42.96.37.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 42.96.37.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQUYckDOrUkd0wNm2HcrQAAAZU"]
[Thu Dec 18 22:49:07.689875 2025] [:error] [pid 24958:tid 24979] [client 42.96.37.226:45568] [client 42.96.37.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 42.96.37.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQUY8kDOrUkd0wNm2HcrgAAAZI"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 22:49:34.428363 2025] [:error] [pid 12383:tid 12404] [client 185.193.19.102:50434] [client 185.193.19.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.193.19.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQUfvdgllo9h1cyxGbWOwAAAtI"]
[Thu Dec 18 22:49:36.370415 2025] [:error] [pid 12383:tid 12407] [client 185.193.19.102:50434] [client 185.193.19.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.193.19.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQUgPdgllo9h1cyxGbWPQAAAtU"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 22:50:04.534720 2025] [:error] [pid 23556:tid 23561] [client 50.28.48.144:48252] [client 50.28.48.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.28.48.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQUnBnmLlk3u5yt9kH8ugAAAAE"]
[Thu Dec 18 22:50:06.522013 2025] [:error] [pid 23556:tid 23564] [client 50.28.48.144:48252] [client 50.28.48.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.28.48.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQUnhnmLlk3u5yt9kH8uwAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 22:51:22.729505 2025] [:error] [pid 25357:tid 25374] [client 193.181.210.95:40658] [client 193.181.210.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.181.210.95, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQU6oaT7bsEXnJVfJd-8AAAAc8"]
[Thu Dec 18 22:51:24.702569 2025] [:error] [pid 25357:tid 25378] [client 193.181.210.95:40658] [client 193.181.210.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.181.210.95, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQU7IaT7bsEXnJVfJd-8QAAAdM"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 22:52:00.959249 2025] [:error] [pid 23558:tid 23622] [client 103.216.119.243:46840] [client 103.216.119.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.216.119.243, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQVEOHam9NbgPQa9uY8ugAAAMc"]
[Thu Dec 18 22:52:01.985026 2025] [:error] [pid 23558:tid 23632] [client 103.216.119.243:46840] [client 103.216.119.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.216.119.243, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQVEeHam9NbgPQa9uY8vgAAANE"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 22:52:59.511590 2025] [:error] [pid 24542:tid 24553] [client 180.93.137.9:33984] [client 180.93.137.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 180.93.137.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQVS0tQz4H2oS3NrDY55gAAAUk"]
[Thu Dec 18 22:53:26.362372 2025] [:error] [pid 23556:tid 23582] [client 217.160.244.17:55224] [client 217.160.244.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.160.244.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQVZhnmLlk3u5yt9kH9KgAAABY"]
[Thu Dec 18 22:53:28.446218 2025] [:error] [pid 23556:tid 23561] [client 217.160.244.17:55224] [client 217.160.244.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.160.244.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQVaBnmLlk3u5yt9kH9LQAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 22:53:32.471715 2025] [:error] [pid 24433:tid 24436] [client 157.230.144.245:58286] [client 157.230.144.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.144.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQVbJ4pN9ycmipm8TjrVgAAAQA"]
[Thu Dec 18 22:53:33.363700 2025] [:error] [pid 24433:tid 24455] [client 157.230.144.245:58286] [client 157.230.144.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.144.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQVbZ4pN9ycmipm8TjrWAAAARM"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 22:53:52.261199 2025] [:error] [pid 24542:tid 24549] [client 103.20.213.171:27774] [client 103.20.213.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.20.213.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQVgEtQz4H2oS3NrDY6FgAAAUU"]
[Thu Dec 18 22:53:54.318011 2025] [:error] [pid 24542:tid 24545] [client 103.20.213.171:27774] [client 103.20.213.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.20.213.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQVgktQz4H2oS3NrDY6IgAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 22:55:08.250359 2025] [:error] [pid 24958:tid 24970] [client 103.187.168.138:56362] [client 103.187.168.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.187.168.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQVzMkDOrUkd0wNm2HdZAAAAYk"]
[Thu Dec 18 22:55:09.346037 2025] [:error] [pid 24958:tid 24968] [client 103.187.168.138:56362] [client 103.187.168.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.187.168.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQVzckDOrUkd0wNm2HdZgAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:01:10.021294 2025] [:error] [pid 24433:tid 24453] [client 50.28.48.144:47278] [client 50.28.48.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.28.48.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQXNp4pN9ycmipm8TjsXAAAARE"]
[Thu Dec 18 23:01:10.992832 2025] [:error] [pid 24433:tid 24440] [client 50.28.48.144:47278] [client 50.28.48.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.28.48.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQXNp4pN9ycmipm8TjsXQAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:01:45.620756 2025] [:error] [pid 24433:tid 24450] [client 185.193.19.102:57256] [client 185.193.19.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.193.19.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQXWZ4pN9ycmipm8TjsdgAAAQ4"]
[Thu Dec 18 23:01:46.785605 2025] [:error] [pid 24433:tid 24441] [client 185.193.19.102:57256] [client 185.193.19.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.193.19.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQXWp4pN9ycmipm8TjsewAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:02:00.163199 2025] [:error] [pid 12239:tid 12267] [client 66.175.56.126:55574] [client 66.175.56.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.56.126, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQXaNNnXxfGIuWO6ak12QAAApc"]
[Thu Dec 18 23:02:01.174686 2025] [:error] [pid 12239:tid 12252] [client 66.175.56.126:55574] [client 66.175.56.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.56.126, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQXadNnXxfGIuWO6ak13gAAAog"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:02:35.490744 2025] [:error] [pid 24433:tid 24459] [client 213.32.28.66:43827] [client 213.32.28.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.32.28.66, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUQXi54pN9ycmipm8TjslQAAARc"]
[Thu Dec 18 23:02:57.456456 2025] [:error] [pid 12239:tid 12259] [client 220.158.232.73:54404] [client 220.158.232.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 220.158.232.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQXodNnXxfGIuWO6ak2CAAAAo8"]
[Thu Dec 18 23:02:58.488824 2025] [:error] [pid 12239:tid 12244] [client 220.158.232.73:54404] [client 220.158.232.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 220.158.232.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQXotNnXxfGIuWO6ak2CQAAAoA"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:04:18.728992 2025] [:error] [pid 12035:tid 12064] [client 64.90.50.77:56688] [client 64.90.50.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.90.50.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQX8rcVHrNSHjCo-0qoJgAAAhU"]
[Thu Dec 18 23:04:19.696048 2025] [:error] [pid 12035:tid 12055] [client 64.90.50.77:56688] [client 64.90.50.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.90.50.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQX87cVHrNSHjCo-0qoKQAAAgw"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:06:02.974740 2025] [:error] [pid 23645:tid 23651] [client 103.20.213.171:52148] [client 103.20.213.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.20.213.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQYWjf_Rx0Y0ao_QJhzEAAAAIQ"]
[Thu Dec 18 23:06:04.112326 2025] [:error] [pid 23645:tid 23654] [client 103.20.213.171:52148] [client 103.20.213.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.20.213.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQYXDf_Rx0Y0ao_QJhzEQAAAIc"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:06:07.781851 2025] [:error] [pid 12035:tid 12043] [client 92.205.212.128:46782] [client 92.205.212.128] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.212.128, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQYX7cVHrNSHjCo-0qoVAAAAgE"]
[Thu Dec 18 23:06:08.661621 2025] [:error] [pid 12035:tid 12052] [client 92.205.212.128:46782] [client 92.205.212.128] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.212.128, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQYYLcVHrNSHjCo-0qoVQAAAgo"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:11:10.665631 2025] [:error] [pid 23556:tid 23578] [client 194.233.68.122:48076] [client 194.233.68.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.233.68.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQZjhnmLlk3u5yt9kH_bwAAABI"]
[Thu Dec 18 23:11:11.850151 2025] [:error] [pid 23556:tid 23569] [client 194.233.68.122:48076] [client 194.233.68.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.233.68.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQZjxnmLlk3u5yt9kH_dQAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:11:27.097783 2025] [:error] [pid 24542:tid 24549] [client 125.228.47.114:46484] [client 125.228.47.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 125.228.47.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQZn0tQz4H2oS3NrDY-MQAAAUU"]
[Thu Dec 18 23:11:28.112705 2025] [:error] [pid 24542:tid 24567] [client 125.228.47.114:46484] [client 125.228.47.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 125.228.47.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQZoEtQz4H2oS3NrDY-MwAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:11:33.311031 2025] [:error] [pid 24958:tid 24978] [client 103.158.108.3:51956] [client 103.158.108.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.158.108.3, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQZpckDOrUkd0wNm2HfAwAAAZE"]
[Thu Dec 18 23:11:34.424127 2025] [:error] [pid 24958:tid 24982] [client 103.158.108.3:51956] [client 103.158.108.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.158.108.3, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQZpskDOrUkd0wNm2HfBAAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:12:08.299899 2025] [:error] [pid 12035:tid 12063] [client 103.185.74.28:41422] [client 103.185.74.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.185.74.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQZyLcVHrNSHjCo-0qo9AAAAhQ"]
[Thu Dec 18 23:12:09.388262 2025] [:error] [pid 12035:tid 12048] [client 103.185.74.28:41422] [client 103.185.74.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.185.74.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQZybcVHrNSHjCo-0qo9QAAAgY"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:12:13.769324 2025] [:error] [pid 23556:tid 23562] [client 103.216.119.243:52252] [client 103.216.119.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.216.119.243, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQZzRnmLlk3u5yt9kH_owAAAAI"]
[Thu Dec 18 23:12:14.732687 2025] [:error] [pid 23556:tid 23573] [client 103.216.119.243:52252] [client 103.216.119.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.216.119.243, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQZzhnmLlk3u5yt9kH_pAAAAA0"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:12:18.692066 2025] [:error] [pid 25357:tid 25365] [client 103.216.119.243:34816] [client 103.216.119.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.216.119.243, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQZ0oaT7bsEXnJVfJeCDwAAAcY"]
[Thu Dec 18 23:12:19.787496 2025] [:error] [pid 25357:tid 25373] [client 103.216.119.243:34816] [client 103.216.119.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.216.119.243, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQZ04aT7bsEXnJVfJeCEAAAAc4"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:12:49.317203 2025] [:error] [pid 24433:tid 24456] [client 45.119.81.168:55072] [client 45.119.81.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.119.81.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQZ8Z4pN9ycmipm8TjtswAAARQ"]
[Thu Dec 18 23:12:50.389663 2025] [:error] [pid 24433:tid 24443] [client 45.119.81.168:55072] [client 45.119.81.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.119.81.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQZ8p4pN9ycmipm8TjttQAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:12:53.663399 2025] [:error] [pid 24542:tid 24546] [client 192.250.229.42:46230] [client 192.250.229.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.250.229.42, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQZ9UtQz4H2oS3NrDY-cQAAAUI"]
[Thu Dec 18 23:12:54.566108 2025] [:error] [pid 24542:tid 24554] [client 192.250.229.42:46230] [client 192.250.229.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.250.229.42, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQZ9ktQz4H2oS3NrDY-cgAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:13:07.696857 2025] [:error] [pid 23645:tid 23660] [client 144.91.126.63:48322] [client 144.91.126.63] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 144.91.126.63, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQaAzf_Rx0Y0ao_QJhz-QAAAI0"]
[Thu Dec 18 23:13:08.567873 2025] [:error] [pid 23645:tid 23650] [client 144.91.126.63:48322] [client 144.91.126.63] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 144.91.126.63, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQaBDf_Rx0Y0ao_QJhz-gAAAIM"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:17:36.552185 2025] [:error] [pid 12239:tid 12251] [client 20.253.155.235:1236] [client 20.253.155.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.253.155.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQbENNnXxfGIuWO6ak4swAAAoc"]
[Thu Dec 18 23:17:37.554634 2025] [:error] [pid 12239:tid 12249] [client 20.253.155.235:1236] [client 20.253.155.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.253.155.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQbEdNnXxfGIuWO6ak4tAAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:18:01.016876 2025] [:error] [pid 23556:tid 23574] [client 24.199.123.177:33584] [client 24.199.123.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 24.199.123.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQbKRnmLlk3u5yt9kEAQAAAAA4"]
[Thu Dec 18 23:18:01.971931 2025] [:error] [pid 23556:tid 23579] [client 24.199.123.177:33584] [client 24.199.123.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 24.199.123.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQbKRnmLlk3u5yt9kEAQgAAABM"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:22:05.219644 2025] [:error] [pid 24433:tid 24440] [client 185.193.19.102:53682] [client 185.193.19.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.193.19.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQcHZ4pN9ycmipm8TjvFQAAAQQ"]
[Thu Dec 18 23:22:06.935964 2025] [:error] [pid 24433:tid 24448] [client 185.193.19.102:53682] [client 185.193.19.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.193.19.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQcHp4pN9ycmipm8TjvFwAAAQw"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:23:58.935661 2025] [:error] [pid 23558:tid 23628] [client 27.254.134.98:53726] [client 27.254.134.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 27.254.134.98, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQcjuHam9NbgPQa9uZCFAAAAM0"]
[Thu Dec 18 23:24:00.733156 2025] [:error] [pid 23558:tid 23620] [client 27.254.134.98:53726] [client 27.254.134.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 27.254.134.98, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQckOHam9NbgPQa9uZCFgAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:25:36.394136 2025] [:error] [pid 23556:tid 23567] [client 103.187.168.138:40664] [client 103.187.168.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.187.168.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQc8BnmLlk3u5yt9kEBrwAAAAc"]
[Thu Dec 18 23:25:37.568416 2025] [:error] [pid 23556:tid 23570] [client 103.187.168.138:40664] [client 103.187.168.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.187.168.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQc8RnmLlk3u5yt9kEBsAAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:26:04.044371 2025] [:error] [pid 12035:tid 12063] [client 103.171.92.209:40554] [client 103.171.92.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.171.92.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQdDLcVHrNSHjCo-0qqwgAAAhQ"]
[Thu Dec 18 23:26:05.831990 2025] [:error] [pid 12035:tid 12042] [client 103.171.92.209:40554] [client 103.171.92.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.171.92.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQdDbcVHrNSHjCo-0qqxQAAAgA"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:29:15.488661 2025] [:error] [pid 23558:tid 23637] [client 130.193.77.35:60936] [client 130.193.77.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 130.193.77.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQdy-Ham9NbgPQa9uZC5AAAANY"]
[Thu Dec 18 23:29:16.609626 2025] [:error] [pid 23558:tid 23629] [client 130.193.77.35:60936] [client 130.193.77.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 130.193.77.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQdzOHam9NbgPQa9uZC5QAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:30:11.468140 2025] [:error] [pid 12239:tid 12252] [client 101.53.147.194:54554] [client 101.53.147.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.53.147.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQeA9NnXxfGIuWO6ak8iQAAAog"]
[Thu Dec 18 23:30:12.514089 2025] [:error] [pid 12239:tid 12257] [client 101.53.147.194:54554] [client 101.53.147.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.53.147.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQeBNNnXxfGIuWO6ak8igAAAo0"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:31:07.714484 2025] [:error] [pid 12383:tid 12391] [client 118.139.166.19:39340] [client 118.139.166.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 118.139.166.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQeO_dgllo9h1cyxGbbWwAAAsU"]
[Thu Dec 18 23:31:09.376100 2025] [:error] [pid 12383:tid 12390] [client 118.139.166.19:39340] [client 118.139.166.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 118.139.166.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQePfdgllo9h1cyxGbbYwAAAsQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:31:13.111143 2025] [:error] [pid 23558:tid 23625] [client 103.57.220.209:51106] [client 103.57.220.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.57.220.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQeQeHam9NbgPQa9uZDSwAAAMo"]
[Thu Dec 18 23:31:14.222651 2025] [:error] [pid 23558:tid 23630] [client 103.57.220.209:51106] [client 103.57.220.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.57.220.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQeQuHam9NbgPQa9uZDTAAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:34:52.267512 2025] [:error] [pid 23556:tid 23566] [client 192.250.234.71:58090] [client 192.250.234.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.250.234.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQfHBnmLlk3u5yt9kEDlAAAAAY"]
[Thu Dec 18 23:34:53.160495 2025] [:error] [pid 23556:tid 23563] [client 192.250.234.71:58090] [client 192.250.234.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.250.234.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQfHRnmLlk3u5yt9kEDlQAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:34:57.281543 2025] [:error] [pid 24433:tid 24451] [client 191.233.136.135:32952] [client 191.233.136.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 191.233.136.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQfIZ4pN9ycmipm8TjxVAAAAQ8"]
[Thu Dec 18 23:34:58.317232 2025] [:error] [pid 24433:tid 24440] [client 191.233.136.135:32952] [client 191.233.136.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 191.233.136.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQfIp4pN9ycmipm8TjxVQAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:35:38.747385 2025] [:error] [pid 23556:tid 23569] [client 154.0.175.200:59550] [client 154.0.175.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.0.175.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQfShnmLlk3u5yt9kEDtAAAAAk"]
[Thu Dec 18 23:35:39.960422 2025] [:error] [pid 23556:tid 23560] [client 154.0.175.200:59550] [client 154.0.175.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.0.175.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQfSxnmLlk3u5yt9kEDtQAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:36:04.436408 2025] [:error] [pid 25357:tid 25383] [client 103.148.212.23:55106] [client 103.148.212.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.148.212.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQfZIaT7bsEXnJVfJeGVgAAAdg"]
[Thu Dec 18 23:36:05.759896 2025] [:error] [pid 25357:tid 25367] [client 103.148.212.23:55106] [client 103.148.212.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.148.212.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQfZYaT7bsEXnJVfJeGWAAAAcg"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:37:11.958474 2025] [:error] [pid 24542:tid 24546] [client 220.158.232.73:53720] [client 220.158.232.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 220.158.232.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQfp0tQz4H2oS3NrDZEEwAAAUI"]
[Thu Dec 18 23:37:13.013267 2025] [:error] [pid 24542:tid 24556] [client 220.158.232.73:53720] [client 220.158.232.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 220.158.232.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQfqUtQz4H2oS3NrDZEFAAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:37:36.772157 2025] [:error] [pid 12035:tid 12056] [client 103.57.220.209:48480] [client 103.57.220.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.57.220.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQfwLcVHrNSHjCo-0qscwAAAg0"]
[Thu Dec 18 23:37:37.771161 2025] [:error] [pid 12035:tid 12054] [client 103.57.220.209:48480] [client 103.57.220.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.57.220.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQfwbcVHrNSHjCo-0qsdAAAAgs"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:38:44.309885 2025] [:error] [pid 24958:tid 24969] [client 41.185.8.76:53380] [client 41.185.8.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.185.8.76, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQgBMkDOrUkd0wNm2HjOAAAAYg"]
[Thu Dec 18 23:38:45.524815 2025] [:error] [pid 24958:tid 24979] [client 41.185.8.76:53380] [client 41.185.8.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.185.8.76, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQgBckDOrUkd0wNm2HjOQAAAZI"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:39:27.555846 2025] [:error] [pid 12383:tid 12389] [client 103.74.116.186:46424] [client 103.74.116.186] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.74.116.186, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQgL_dgllo9h1cyxGbdkQAAAsM"]
[Thu Dec 18 23:41:18.526148 2025] [:error] [pid 12383:tid 12410] [client 24.199.123.177:34830] [client 24.199.123.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 24.199.123.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQgnvdgllo9h1cyxGbdvwAAAtg"]
[Thu Dec 18 23:41:19.458837 2025] [:error] [pid 12383:tid 12408] [client 24.199.123.177:34830] [client 24.199.123.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 24.199.123.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQgn_dgllo9h1cyxGbdwQAAAtY"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:45:52.694369 2025] [:error] [pid 24433:tid 24438] [client 154.50.24.78:58370] [client 154.50.24.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.50.24.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQhsJ4pN9ycmipm8TjymAAAAQI"]
[Thu Dec 18 23:45:54.505670 2025] [:error] [pid 24433:tid 24437] [client 154.50.24.78:58370] [client 154.50.24.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.50.24.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQhsp4pN9ycmipm8TjymQAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:48:42.316561 2025] [:error] [pid 23558:tid 23622] [client 173.236.201.116:34288] [client 173.236.201.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.201.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQiWuHam9NbgPQa9uZHdQAAAMc"]
[Thu Dec 18 23:48:43.286589 2025] [:error] [pid 23558:tid 23633] [client 173.236.201.116:34288] [client 173.236.201.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.201.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQiW-Ham9NbgPQa9uZHdgAAANI"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:49:22.384990 2025] [:error] [pid 12239:tid 12254] [client 171.244.32.203:39268] [client 171.244.32.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 171.244.32.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQigtNnXxfGIuWO6alClgAAAoo"]
[Thu Dec 18 23:50:38.220133 2025] [:error] [pid 24433:tid 24446] [client 27.254.134.98:52712] [client 27.254.134.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 27.254.134.98, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQizp4pN9ycmipm8Tjy7AAAAQo"]
[Thu Dec 18 23:51:26.768695 2025] [:error] [pid 24542:tid 24555] [client 103.187.168.138:43664] [client 103.187.168.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.187.168.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQi_ktQz4H2oS3NrDZGswAAAUs"]
[Thu Dec 18 23:51:27.794124 2025] [:error] [pid 24542:tid 24562] [client 103.187.168.138:43664] [client 103.187.168.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.187.168.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQi_0tQz4H2oS3NrDZGtQAAAVI"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:52:48.774413 2025] [:error] [pid 12239:tid 12250] [client 101.53.147.194:37912] [client 101.53.147.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.53.147.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQjUNNnXxfGIuWO6alDywAAAoY"]
[Thu Dec 18 23:52:49.832679 2025] [:error] [pid 12239:tid 12257] [client 101.53.147.194:37912] [client 101.53.147.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.53.147.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQjUdNnXxfGIuWO6alDzwAAAo0"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:55:45.656117 2025] [:error] [pid 24542:tid 24567] [client 151.237.138.152:45414] [client 151.237.138.152] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 151.237.138.152, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQkAUtQz4H2oS3NrDZHYgAAAVc"]
[Thu Dec 18 23:55:46.769900 2025] [:error] [pid 24542:tid 24557] [client 151.237.138.152:45414] [client 151.237.138.152] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 151.237.138.152, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQkAktQz4H2oS3NrDZHZwAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:56:01.806323 2025] [:error] [pid 25357:tid 25362] [client 154.50.24.78:40498] [client 154.50.24.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.50.24.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQkEYaT7bsEXnJVfJeI5QAAAcM"]
[Thu Dec 18 23:56:05.314447 2025] [:error] [pid 25357:tid 25374] [client 154.50.24.78:40498] [client 154.50.24.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.50.24.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQkFYaT7bsEXnJVfJeI7AAAAc8"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:56:26.261173 2025] [:error] [pid 23645:tid 23654] [client 104.155.117.95:32743] [client 104.155.117.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.155.117.95, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQkKjf_Rx0Y0ao_QJh6rAAAAIc"]
[Thu Dec 18 23:56:34.418893 2025] [:error] [pid 24542:tid 24567] [client 68.183.25.188:39612] [client 68.183.25.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.183.25.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQkMktQz4H2oS3NrDZHzgAAAVc"]
[Thu Dec 18 23:56:35.362314 2025] [:error] [pid 24542:tid 24552] [client 68.183.25.188:39612] [client 68.183.25.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.183.25.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQkM0tQz4H2oS3NrDZH4QAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 18 23:56:39.799672 2025] [:error] [pid 24542:tid 24558] [client 103.15.50.124:52278] [client 103.15.50.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.15.50.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQkN0tQz4H2oS3NrDZH6wAAAU4"]
[Thu Dec 18 23:56:40.909023 2025] [:error] [pid 24542:tid 24560] [client 103.15.50.124:52278] [client 103.15.50.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.15.50.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQkOEtQz4H2oS3NrDZH7AAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:00:21.232149 2025] [:error] [pid 12383:tid 12399] [client 103.42.58.162:37808] [client 103.42.58.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.42.58.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQlFfdgllo9h1cyxGbgNAAAAs0"]
[Fri Dec 19 00:00:22.336634 2025] [:error] [pid 12383:tid 12386] [client 103.42.58.162:37808] [client 103.42.58.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.42.58.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQlFvdgllo9h1cyxGbgNgAAAsA"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:00:48.094221 2025] [:error] [pid 12239:tid 12250] [client 72.53.210.82:38068] [client 72.53.210.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 72.53.210.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQlMNNnXxfGIuWO6alGQQAAAoY"]
[Fri Dec 19 00:00:49.145047 2025] [:error] [pid 12239:tid 12256] [client 72.53.210.82:38068] [client 72.53.210.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 72.53.210.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQlMdNnXxfGIuWO6alGQwAAAow"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:04:21.041747 2025] [:error] [pid 23556:tid 23581] [client 20.25.250.19:25586] [client 20.25.250.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.25.250.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQmBRnmLlk3u5yt9kEIZwAAABU"]
[Fri Dec 19 00:04:22.837001 2025] [:error] [pid 23556:tid 23580] [client 20.25.250.19:25586] [client 20.25.250.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.25.250.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQmBhnmLlk3u5yt9kEIcAAAABQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:04:26.366774 2025] [:error] [pid 12035:tid 12051] [client 198.38.87.150:44334] [client 198.38.87.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.38.87.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQmCrcVHrNSHjCo-0qvzQAAAgk"]
[Fri Dec 19 00:04:27.343897 2025] [:error] [pid 12035:tid 12066] [client 198.38.87.150:44334] [client 198.38.87.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.38.87.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQmC7cVHrNSHjCo-0qvzgAAAhc"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:09:49.205836 2025] [:error] [pid 45737:tid 45755] [client 212.56.36.122:35606] [client 212.56.36.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.56.36.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQnTVAGdb8SXm6CLHh78wAAAA4"]
[Fri Dec 19 00:09:50.553390 2025] [:error] [pid 45737:tid 45761] [client 212.56.36.122:35606] [client 212.56.36.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.56.36.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQnTlAGdb8SXm6CLHh79QAAABQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:10:51.311869 2025] [:error] [pid 45825:tid 45851] [client 101.53.147.194:44946] [client 101.53.147.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.53.147.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQni9ES1ifyzuzFwz_8cAAAAFg"]
[Fri Dec 19 00:10:52.414333 2025] [:error] [pid 45825:tid 45847] [client 101.53.147.194:44946] [client 101.53.147.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.53.147.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQnjNES1ifyzuzFwz_8fgAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:11:49.807375 2025] [:error] [pid 45737:tid 45747] [client 203.86.122.1:57654] [client 203.86.122.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.86.122.1, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQnxVAGdb8SXm6CLHh8aQAAAAY"]
[Fri Dec 19 00:11:50.840225 2025] [:error] [pid 45737:tid 45761] [client 203.86.122.1:57654] [client 203.86.122.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.86.122.1, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQnxlAGdb8SXm6CLHh8awAAABQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:13:11.613754 2025] [:error] [pid 45737:tid 45755] [client 203.86.122.1:44934] [client 203.86.122.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.86.122.1, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQoF1AGdb8SXm6CLHh8sQAAAA4"]
[Fri Dec 19 00:13:14.034959 2025] [:error] [pid 45737:tid 45763] [client 203.86.122.1:44934] [client 203.86.122.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.86.122.1, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQoGlAGdb8SXm6CLHh8swAAABY"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:13:18.993789 2025] [:error] [pid 45739:tid 45795] [client 80.241.214.201:58624] [client 80.241.214.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 80.241.214.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQoHuIfOvWlLwqW0X3WbgAAAQA"]
[Fri Dec 19 00:13:19.904826 2025] [:error] [pid 45739:tid 45811] [client 80.241.214.201:58624] [client 80.241.214.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 80.241.214.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQoH-IfOvWlLwqW0X3WbwAAARA"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:14:32.719065 2025] [:error] [pid 45825:tid 45851] [client 198.38.87.150:41396] [client 198.38.87.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.38.87.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQoaNES1ifyzuzFwz_-hwAAAFg"]
[Fri Dec 19 00:14:33.745022 2025] [:error] [pid 45825:tid 45837] [client 198.38.87.150:41396] [client 198.38.87.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.38.87.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQoadES1ifyzuzFwz_-iwAAAEo"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:14:37.546867 2025] [:error] [pid 45825:tid 45847] [client 90.158.160.18:59862] [client 90.158.160.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 90.158.160.18, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQobdES1ifyzuzFwz_-lgAAAFQ"]
[Fri Dec 19 00:14:38.594517 2025] [:error] [pid 45825:tid 45837] [client 90.158.160.18:59862] [client 90.158.160.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 90.158.160.18, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQobtES1ifyzuzFwz_-nQAAAEo"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:15:03.419493 2025] [:error] [pid 45737:tid 45747] [client 20.25.250.19:25155] [client 20.25.250.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.25.250.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQoh1AGdb8SXm6CLHh9WAAAAAY"]
[Fri Dec 19 00:15:04.504771 2025] [:error] [pid 45737:tid 45749] [client 20.25.250.19:25155] [client 20.25.250.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.25.250.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQoiFAGdb8SXm6CLHh9XAAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:15:07.639794 2025] [:error] [pid 45825:tid 45850] [client 172.93.219.170:40744] [client 172.93.219.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.93.219.170, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQoi9ES1ifyzuzFwz_-3wAAAFc"]
[Fri Dec 19 00:15:08.624513 2025] [:error] [pid 45825:tid 45835] [client 172.93.219.170:40744] [client 172.93.219.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.93.219.170, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQojNES1ifyzuzFwz_-5QAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:15:23.703187 2025] [:error] [pid 45825:tid 45841] [client 132.226.228.67:45794] [client 132.226.228.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 132.226.228.67, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQom9ES1ifyzuzFwz__DwAAAE4"]
[Fri Dec 19 00:15:24.765346 2025] [:error] [pid 45825:tid 45848] [client 132.226.228.67:45794] [client 132.226.228.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 132.226.228.67, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQonNES1ifyzuzFwz__EAAAAFU"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:15:39.327725 2025] [:error] [pid 45825:tid 45847] [client 51.17.27.254:57456] [client 51.17.27.254] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.17.27.254, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQoq9ES1ifyzuzFwz__NgAAAFQ"]
[Fri Dec 19 00:15:40.297644 2025] [:error] [pid 45825:tid 45841] [client 51.17.27.254:57456] [client 51.17.27.254] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.17.27.254, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQorNES1ifyzuzFwz__PgAAAE4"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:18:44.311714 2025] [:error] [pid 45738:tid 45787] [client 160.30.160.240:60940] [client 160.30.160.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.30.160.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUQpZHnw52b7ekJTIU2xxQAAANM"]
[Fri Dec 19 00:21:30.539928 2025] [:error] [pid 45737:tid 45743] [client 212.56.36.122:36336] [client 212.56.36.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.56.36.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQqClAGdb8SXm6CLHiASgAAAAI"]
[Fri Dec 19 00:21:32.352627 2025] [:error] [pid 45737:tid 45751] [client 212.56.36.122:36336] [client 212.56.36.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.56.36.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQqDFAGdb8SXm6CLHiATwAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:24:23.784085 2025] [:error] [pid 65011:tid 65063] [client 148.66.155.24:39834] [client 148.66.155.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.66.155.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQqt9qlBhOfWMNHM-6y1gAAAVI"]
[Fri Dec 19 00:24:24.880751 2025] [:error] [pid 65011:tid 65044] [client 148.66.155.24:39834] [client 148.66.155.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.66.155.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQquNqlBhOfWMNHM-6y2QAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:26:46.593070 2025] [:error] [pid 45739:tid 45805] [client 103.117.180.206:38576] [client 103.117.180.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.117.180.206, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQrRuIfOvWlLwqW0X3btQAAAQo"]
[Fri Dec 19 00:26:48.311460 2025] [:error] [pid 45739:tid 45795] [client 103.117.180.206:38576] [client 103.117.180.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.117.180.206, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQrSOIfOvWlLwqW0X3btgAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:26:54.098804 2025] [:error] [pid 45737:tid 45759] [client 42.96.37.226:52808] [client 42.96.37.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 42.96.37.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQrTlAGdb8SXm6CLHiC0gAAABI"]
[Fri Dec 19 00:26:55.055021 2025] [:error] [pid 45737:tid 45755] [client 42.96.37.226:52808] [client 42.96.37.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 42.96.37.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQrT1AGdb8SXm6CLHiC1AAAAA4"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:28:04.152587 2025] [:error] [pid 45739:tid 45803] [client 72.29.178.86:47642] [client 72.29.178.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.29.178.86, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUQrlOIfOvWlLwqW0X3b5AAAAQg"]
[Fri Dec 19 00:28:08.957248 2025] [:error] [pid 37418:tid 37433] [client 42.96.37.226:40584] [client 42.96.37.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 42.96.37.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQrmK0VAcRIm10Onoyy2AAAAI0"]
[Fri Dec 19 00:28:09.918558 2025] [:error] [pid 37418:tid 37440] [client 42.96.37.226:40584] [client 42.96.37.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 42.96.37.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQrma0VAcRIm10Onoyy2QAAAJQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:29:35.841946 2025] [:error] [pid 45825:tid 45834] [client 103.42.58.162:40286] [client 103.42.58.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.42.58.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQr79ES1ifyzuzFwz8F3wAAAEc"]
[Fri Dec 19 00:29:36.867849 2025] [:error] [pid 45825:tid 45833] [client 103.42.58.162:40286] [client 103.42.58.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.42.58.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQr8NES1ifyzuzFwz8F4AAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:30:00.796003 2025] [:error] [pid 65011:tid 65051] [client 217.160.244.17:47552] [client 217.160.244.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.160.244.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQsCNqlBhOfWMNHM-60LQAAAUY"]
[Fri Dec 19 00:30:01.792384 2025] [:error] [pid 65011:tid 65045] [client 217.160.244.17:47552] [client 217.160.244.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.160.244.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQsCdqlBhOfWMNHM-60LgAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:31:35.187851 2025] [:error] [pid 45739:tid 45806] [client 203.86.122.1:52378] [client 203.86.122.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.86.122.1, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQsZ-IfOvWlLwqW0X3ctQAAAQs"]
[Fri Dec 19 00:31:36.545446 2025] [:error] [pid 45739:tid 45812] [client 203.86.122.1:52378] [client 203.86.122.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.86.122.1, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQsaOIfOvWlLwqW0X3ctwAAARE"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:36:12.252256 2025] [:error] [pid 45737:tid 45763] [client 24.199.123.177:36046] [client 24.199.123.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 24.199.123.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQtfFAGdb8SXm6CLHiFSQAAABY"]
[Fri Dec 19 00:36:13.516435 2025] [:error] [pid 45737:tid 45760] [client 24.199.123.177:36046] [client 24.199.123.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 24.199.123.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQtfVAGdb8SXm6CLHiFTAAAABM"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:41:40.954490 2025] [:error] [pid 45737:tid 45763] [client 115.75.215.166:57367] [client 115.75.215.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 115.75.215.166, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQuxFAGdb8SXm6CLHiGrAAAABY"]
[Fri Dec 19 00:41:43.437909 2025] [:error] [pid 45737:tid 45743] [client 115.75.215.166:57367] [client 115.75.215.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 115.75.215.166, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQux1AGdb8SXm6CLHiGwgAAAAI"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:42:10.888574 2025] [:error] [pid 45737:tid 45760] [client 149.12.65.135:60544] [client 149.12.65.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.12.65.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQu4lAGdb8SXm6CLHiG7gAAABM"]
[Fri Dec 19 00:43:40.265908 2025] [:error] [pid 45738:tid 45791] [client 146.190.81.111:49970] [client 146.190.81.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.190.81.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQvPHnw52b7ekJTIU23uAAAANc"]
[Fri Dec 19 00:43:44.325156 2025] [:error] [pid 45738:tid 45781] [client 146.190.81.111:49970] [client 146.190.81.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.190.81.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQvQHnw52b7ekJTIU23vQAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:45:01.780848 2025] [:error] [pid 45738:tid 45780] [client 141.148.202.33:52448] [client 141.148.202.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.148.202.33, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQvjXnw52b7ekJTIU24DwAAAMw"]
[Fri Dec 19 00:45:47.548488 2025] [:error] [pid 45737:tid 45756] [client 216.225.194.245:59288] [client 216.225.194.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.225.194.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQvu1AGdb8SXm6CLHiIHQAAAA8"]
[Fri Dec 19 00:45:51.623986 2025] [:error] [pid 45737:tid 45757] [client 216.225.194.245:59288] [client 216.225.194.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.225.194.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQvv1AGdb8SXm6CLHiIJgAAABA"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:46:37.104802 2025] [:error] [pid 37418:tid 37440] [client 69.163.140.5:33804] [client 69.163.140.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.163.140.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQv7a0VAcRIm10Onoy3XgAAAJQ"]
[Fri Dec 19 00:46:38.212306 2025] [:error] [pid 37418:tid 37439] [client 69.163.140.5:33804] [client 69.163.140.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.163.140.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQv7q0VAcRIm10Onoy3YQAAAJM"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:49:12.731384 2025] [:error] [pid 37418:tid 37442] [client 92.205.212.128:58728] [client 92.205.212.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.212.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUQwiK0VAcRIm10Onoy4AAAAAJY"]
[Fri Dec 19 00:51:49.166036 2025] [:error] [pid 45825:tid 45850] [client 69.163.140.5:43828] [client 69.163.140.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.163.140.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQxJdES1ifyzuzFwz8PKwAAAFc"]
[Fri Dec 19 00:51:51.336656 2025] [:error] [pid 45825:tid 45840] [client 69.163.140.5:43828] [client 69.163.140.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.163.140.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQxJ9ES1ifyzuzFwz8PMAAAAE0"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:58:37.395078 2025] [:error] [pid 65011:tid 65052] [client 51.17.27.254:45980] [client 51.17.27.254] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.17.27.254, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQyvdqlBhOfWMNHM-68EQAAAUc"]
[Fri Dec 19 00:58:38.730705 2025] [:error] [pid 65011:tid 65056] [client 51.17.27.254:45980] [client 51.17.27.254] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.17.27.254, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQyvtqlBhOfWMNHM-68EwAAAUs"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:58:42.631435 2025] [:error] [pid 45737:tid 45758] [client 151.237.138.152:37980] [client 151.237.138.152] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 151.237.138.152, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQywlAGdb8SXm6CLHiM1QAAABE"]
[Fri Dec 19 00:58:45.036062 2025] [:error] [pid 45737:tid 45748] [client 151.237.138.152:37980] [client 151.237.138.152] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 151.237.138.152, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQyxVAGdb8SXm6CLHiM2QAAAAc"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:59:06.922124 2025] [:error] [pid 45738:tid 45774] [client 103.2.226.132:40262] [client 103.2.226.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.2.226.132, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQy2nnw52b7ekJTIU275AAAAMY"]
[Fri Dec 19 00:59:08.379679 2025] [:error] [pid 45738:tid 45783] [client 103.2.226.132:40262] [client 103.2.226.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.2.226.132, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQy3Hnw52b7ekJTIU275QAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 00:59:12.223265 2025] [:error] [pid 45737:tid 45750] [client 151.237.138.152:41062] [client 151.237.138.152] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 151.237.138.152, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQy4FAGdb8SXm6CLHiM-wAAAAk"]
[Fri Dec 19 00:59:13.229366 2025] [:error] [pid 45737:tid 45746] [client 151.237.138.152:41062] [client 151.237.138.152] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 151.237.138.152, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQy4VAGdb8SXm6CLHiM_gAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:00:57.309913 2025] [:error] [pid 45737:tid 45752] [client 34.142.133.16:10241] [client 34.142.133.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.142.133.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQzSVAGdb8SXm6CLHiN0wAAAAs"]
[Fri Dec 19 01:02:13.907657 2025] [:error] [pid 45737:tid 45751] [client 194.233.68.122:33136] [client 194.233.68.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.233.68.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQzlVAGdb8SXm6CLHiOLQAAAAo"]
[Fri Dec 19 01:02:15.004897 2025] [:error] [pid 45737:tid 45761] [client 194.233.68.122:33136] [client 194.233.68.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.233.68.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQzl1AGdb8SXm6CLHiOLgAAABQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:03:59.315697 2025] [:error] [pid 45825:tid 45844] [client 103.185.74.28:54938] [client 103.185.74.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.185.74.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQz_9ES1ifyzuzFwz8UQgAAAFE"]
[Fri Dec 19 01:04:02.792632 2025] [:error] [pid 45825:tid 45838] [client 103.185.74.28:54938] [client 103.185.74.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.185.74.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ0AtES1ifyzuzFwz8URgAAAEs"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:06:41.071339 2025] [:error] [pid 45825:tid 45843] [client 68.183.25.188:44098] [client 68.183.25.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.183.25.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ0odES1ifyzuzFwz8VWQAAAFA"]
[Fri Dec 19 01:06:44.421809 2025] [:error] [pid 45825:tid 45848] [client 68.183.25.188:44098] [client 68.183.25.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.183.25.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ0pNES1ifyzuzFwz8VXgAAAFU"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:07:09.621664 2025] [:error] [pid 45739:tid 45802] [client 157.230.144.245:43516] [client 157.230.144.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.144.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ0veIfOvWlLwqW0X3lZgAAAQc"]
[Fri Dec 19 01:07:12.687730 2025] [:error] [pid 45739:tid 45804] [client 157.230.144.245:43516] [client 157.230.144.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.144.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ0wOIfOvWlLwqW0X3lagAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:10:33.493784 2025] [:error] [pid 45737:tid 45744] [client 148.72.211.168:46688] [client 148.72.211.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.72.211.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ1iVAGdb8SXm6CLHiQSwAAAAM"]
[Fri Dec 19 01:10:34.611697 2025] [:error] [pid 45737:tid 45764] [client 148.72.211.168:46688] [client 148.72.211.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.72.211.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ1ilAGdb8SXm6CLHiQTQAAABc"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:11:29.053563 2025] [:error] [pid 45739:tid 45816] [client 149.12.65.135:55062] [client 149.12.65.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.12.65.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ1weIfOvWlLwqW0X3mjgAAARU"]
[Fri Dec 19 01:11:30.624150 2025] [:error] [pid 45739:tid 45796] [client 149.12.65.135:55062] [client 149.12.65.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.12.65.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ1wuIfOvWlLwqW0X3mkQAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:11:36.371500 2025] [:error] [pid 45738:tid 45784] [client 90.158.160.18:47152] [client 90.158.160.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 90.158.160.18, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ1yHnw52b7ekJTIU2_JgAAANA"]
[Fri Dec 19 01:11:37.314667 2025] [:error] [pid 45738:tid 45776] [client 90.158.160.18:47152] [client 90.158.160.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 90.158.160.18, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ1yXnw52b7ekJTIU2_KQAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:11:54.073702 2025] [:error] [pid 45737:tid 45746] [client 216.225.194.245:57114] [client 216.225.194.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.225.194.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ12lAGdb8SXm6CLHiQ2QAAAAU"]
[Fri Dec 19 01:11:56.522466 2025] [:error] [pid 45737:tid 45765] [client 216.225.194.245:57114] [client 216.225.194.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.225.194.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ13FAGdb8SXm6CLHiQ2gAAABg"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:13:33.806608 2025] [:error] [pid 37418:tid 37427] [client 103.42.58.162:51950] [client 103.42.58.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.42.58.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ2Pa0VAcRIm10Onoy-SAAAAIc"]
[Fri Dec 19 01:13:36.448176 2025] [:error] [pid 37418:tid 37434] [client 103.42.58.162:51950] [client 103.42.58.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.42.58.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ2QK0VAcRIm10Onoy-TgAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:15:34.412579 2025] [:error] [pid 45825:tid 45828] [client 148.72.211.168:55438] [client 148.72.211.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.72.211.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ2ttES1ifyzuzFwz8YcwAAAEE"]
[Fri Dec 19 01:15:35.516144 2025] [:error] [pid 45825:tid 45844] [client 148.72.211.168:55438] [client 148.72.211.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.72.211.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ2t9ES1ifyzuzFwz8YdAAAAFE"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:15:58.981193 2025] [:error] [pid 45737:tid 45762] [client 185.200.240.65:41162] [client 185.200.240.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.200.240.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUQ2zlAGdb8SXm6CLHiR0QAAABU"]
[Fri Dec 19 01:16:52.773873 2025] [:error] [pid 45737:tid 45757] [client 51.17.27.254:56972] [client 51.17.27.254] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.17.27.254, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ3BFAGdb8SXm6CLHiSHgAAABA"]
[Fri Dec 19 01:16:53.832296 2025] [:error] [pid 45737:tid 45749] [client 51.17.27.254:56972] [client 51.17.27.254] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.17.27.254, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ3BVAGdb8SXm6CLHiSIAAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:19:22.276879 2025] [:error] [pid 37418:tid 37444] [client 130.193.77.35:49850] [client 130.193.77.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 130.193.77.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ3mq0VAcRIm10Onoy_eQAAAJg"]
[Fri Dec 19 01:19:23.542452 2025] [:error] [pid 37418:tid 37424] [client 130.193.77.35:49850] [client 130.193.77.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 130.193.77.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ3m60VAcRIm10Onoy_egAAAIQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:20:24.579854 2025] [:error] [pid 65011:tid 65062] [client 103.2.226.132:55014] [client 103.2.226.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.2.226.132, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ32NqlBhOfWMNHM-7CUQAAAVE"]
[Fri Dec 19 01:26:21.780204 2025] [:error] [pid 45825:tid 45829] [client 202.92.5.25:32786] [client 202.92.5.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.92.5.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ5PdES1ifyzuzFwz8dNQAAAEI"]
[Fri Dec 19 01:26:23.944053 2025] [:error] [pid 45825:tid 45837] [client 202.92.5.25:32786] [client 202.92.5.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.92.5.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ5P9ES1ifyzuzFwz8dOAAAAEo"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:27:33.597997 2025] [:error] [pid 65011:tid 65050] [client 31.186.11.171:55722] [client 31.186.11.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.186.11.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ5hdqlBhOfWMNHM-7EeAAAAUU"]
[Fri Dec 19 01:27:37.432927 2025] [:error] [pid 65011:tid 65053] [client 31.186.11.171:55722] [client 31.186.11.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.186.11.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ5idqlBhOfWMNHM-7EgAAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:28:27.130709 2025] [:error] [pid 45737:tid 45764] [client 103.42.58.162:51788] [client 103.42.58.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.42.58.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ5u1AGdb8SXm6CLHiVqwAAABc"]
[Fri Dec 19 01:28:29.145635 2025] [:error] [pid 45737:tid 45761] [client 103.42.58.162:51788] [client 103.42.58.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.42.58.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ5vVAGdb8SXm6CLHiVrwAAABQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:30:47.030984 2025] [:error] [pid 45739:tid 45796] [client 103.2.226.132:38062] [client 103.2.226.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.2.226.132, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ6R-IfOvWlLwqW0X3quAAAAQE"]
[Fri Dec 19 01:30:49.291073 2025] [:error] [pid 45739:tid 45819] [client 103.2.226.132:38062] [client 103.2.226.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.2.226.132, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ6SeIfOvWlLwqW0X3quQAAARg"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:32:12.694841 2025] [:error] [pid 45738:tid 45782] [client 143.110.222.122:46966] [client 143.110.222.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.222.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ6nHnw52b7ekJTIU3D6wAAAM4"]
[Fri Dec 19 01:32:13.656621 2025] [:error] [pid 45738:tid 45784] [client 143.110.222.122:46966] [client 143.110.222.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.222.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ6nXnw52b7ekJTIU3D7AAAANA"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:37:45.336493 2025] [:error] [pid 65011:tid 65047] [client 173.236.201.116:45062] [client 173.236.201.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.201.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ76dqlBhOfWMNHM-7HmQAAAUM"]
[Fri Dec 19 01:37:46.384667 2025] [:error] [pid 65011:tid 65046] [client 173.236.201.116:45062] [client 173.236.201.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.201.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ76tqlBhOfWMNHM-7HnQAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:38:50.746501 2025] [:error] [pid 65011:tid 65047] [client 103.117.180.206:46092] [client 103.117.180.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.117.180.206, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ8KtqlBhOfWMNHM-7H3AAAAUM"]
[Fri Dec 19 01:38:52.104339 2025] [:error] [pid 65011:tid 65065] [client 103.117.180.206:46092] [client 103.117.180.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.117.180.206, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ8LNqlBhOfWMNHM-7H3QAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:39:39.515564 2025] [:error] [pid 37418:tid 37434] [client 141.148.202.33:36402] [client 141.148.202.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.148.202.33, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ8W60VAcRIm10OnozEsQAAAI4"]
[Fri Dec 19 01:39:40.573246 2025] [:error] [pid 37418:tid 37431] [client 141.148.202.33:36402] [client 141.148.202.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.148.202.33, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ8XK0VAcRIm10OnozEtQAAAIs"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:45:32.158324 2025] [:error] [pid 65011:tid 65062] [client 142.93.209.196:47480] [client 142.93.209.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.93.209.196, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ9vNqlBhOfWMNHM-7KgwAAAVE"]
[Fri Dec 19 01:45:33.497127 2025] [:error] [pid 65011:tid 65046] [client 142.93.209.196:47480] [client 142.93.209.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.93.209.196, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ9vdqlBhOfWMNHM-7KhQAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:45:50.104447 2025] [:error] [pid 45825:tid 45850] [client 202.92.5.25:59768] [client 202.92.5.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.92.5.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ9ztES1ifyzuzFwz8maAAAAFc"]
[Fri Dec 19 01:45:51.029928 2025] [:error] [pid 45825:tid 45846] [client 202.92.5.25:59768] [client 202.92.5.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.92.5.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUQ9z9ES1ifyzuzFwz8magAAAFM"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 01:47:56.429442 2025] [:error] [pid 45825:tid 45828] [client 46.101.217.74:57286] [client 46.101.217.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.101.217.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUQ-TNES1ifyzuzFwz8nOgAAAEE"]
[Fri Dec 19 01:56:27.214845 2025] [:error] [pid 45737:tid 45745] [client 103.148.212.23:59268] [client 103.148.212.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.148.212.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURAS1AGdb8SXm6CLHifywAAAAQ"]
[Fri Dec 19 01:56:28.533064 2025] [:error] [pid 45737:tid 45763] [client 103.148.212.23:59268] [client 103.148.212.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.148.212.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURATFAGdb8SXm6CLHifzgAAABY"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 02:10:01.202673 2025] [:error] [pid 37418:tid 37423] [client 198.251.84.200:40318] [client 198.251.84.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.251.84.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURDea0VAcRIm10OnozNMwAAAIM"]
[Fri Dec 19 02:10:02.358314 2025] [:error] [pid 37418:tid 37429] [client 198.251.84.200:40318] [client 198.251.84.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.251.84.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURDeq0VAcRIm10OnozNNAAAAIk"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 02:11:45.563360 2025] [:error] [pid 65011:tid 65052] [client 103.15.50.124:59406] [client 103.15.50.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.15.50.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURD4dqlBhOfWMNHM-7RFQAAAUc"]
[Fri Dec 19 02:11:49.748221 2025] [:error] [pid 65011:tid 65055] [client 103.15.50.124:59406] [client 103.15.50.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.15.50.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURD5dqlBhOfWMNHM-7RGwAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 02:13:42.367671 2025] [:error] [pid 65011:tid 65056] [client 175.117.144.122:42062] [client 175.117.144.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 175.117.144.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUREVtqlBhOfWMNHM-7RbgAAAUs"]
[Fri Dec 19 02:13:45.335374 2025] [:error] [pid 65011:tid 65053] [client 175.117.144.122:42062] [client 175.117.144.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 175.117.144.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUREWdqlBhOfWMNHM-7RcQAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 02:26:41.282638 2025] [:error] [pid 37418:tid 37433] [client 103.117.180.206:49348] [client 103.117.180.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.117.180.206, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURHYa0VAcRIm10OnozRrAAAAI0"]
[Fri Dec 19 02:27:22.706596 2025] [:error] [pid 45737:tid 45753] [client 162.19.69.214:33395] [client 162.19.69.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.19.69.214, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURHilAGdb8SXm6CLHiouQAAAAw"]
[Fri Dec 19 02:27:26.630221 2025] [:error] [pid 45737:tid 45754] [client 162.19.69.214:33395] [client 162.19.69.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.19.69.214, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURHjlAGdb8SXm6CLHiozAAAAA0"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 02:28:06.987376 2025] [:error] [pid 37418:tid 37421] [client 162.19.69.214:17103] [client 162.19.69.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.19.69.214, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURHtq0VAcRIm10OnozSNgAAAIE"]
[Fri Dec 19 02:28:10.536496 2025] [:error] [pid 37418:tid 37427] [client 162.19.69.214:17103] [client 162.19.69.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.19.69.214, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURHuq0VAcRIm10OnozSOAAAAIc"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 02:30:29.109616 2025] [:error] [pid 45737:tid 45742] [client 157.230.144.245:56674] [client 157.230.144.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.144.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURIRVAGdb8SXm6CLHip0wAAAAE"]
[Fri Dec 19 02:30:30.066112 2025] [:error] [pid 45737:tid 45759] [client 157.230.144.245:56674] [client 157.230.144.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.144.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURIRlAGdb8SXm6CLHip1QAAABI"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 02:38:50.438849 2025] [:error] [pid 37418:tid 37420] [client 130.193.77.35:40280] [client 130.193.77.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 130.193.77.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURKOq0VAcRIm10OnozUfgAAAIA"]
[Fri Dec 19 02:38:51.772591 2025] [:error] [pid 37418:tid 37435] [client 130.193.77.35:40280] [client 130.193.77.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 130.193.77.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURKO60VAcRIm10OnozUgQAAAI8"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 02:53:39.289822 2025] [:error] [pid 45825:tid 45847] [client 103.15.50.124:57892] [client 103.15.50.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.15.50.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURNs9ES1ifyzuzFwz9CcwAAAFQ"]
[Fri Dec 19 02:53:41.483092 2025] [:error] [pid 45825:tid 45849] [client 103.15.50.124:57892] [client 103.15.50.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.15.50.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURNtdES1ifyzuzFwz9CdAAAAFY"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 02:53:45.286365 2025] [:error] [pid 37418:tid 37434] [client 109.234.161.53:49648] [client 109.234.161.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.234.161.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURNua0VAcRIm10OnozZPAAAAI4"]
[Fri Dec 19 02:53:46.337503 2025] [:error] [pid 37418:tid 37442] [client 109.234.161.53:49648] [client 109.234.161.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.234.161.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURNuq0VAcRIm10OnozZPgAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 03:09:24.218919 2025] [:error] [pid 45825:tid 45850] [client 154.0.175.200:45366] [client 154.0.175.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.0.175.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURRZNES1ifyzuzFwz9InAAAAFc"]
[Fri Dec 19 03:09:25.805681 2025] [:error] [pid 45825:tid 45839] [client 154.0.175.200:45366] [client 154.0.175.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.0.175.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURRZdES1ifyzuzFwz9IngAAAEw"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 03:12:13.132102 2025] [:error] [pid 45825:tid 45830] [client 40.118.230.174:35603] [client 40.118.230.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.118.230.174, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURSDdES1ifyzuzFwz9JLQAAAEM"]
[Fri Dec 19 03:12:14.128469 2025] [:error] [pid 45825:tid 45843] [client 40.118.230.174:35603] [client 40.118.230.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.118.230.174, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURSDtES1ifyzuzFwz9JLwAAAFA"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 03:12:38.688123 2025] [:error] [pid 37418:tid 37420] [client 185.23.117.23:45786] [client 185.23.117.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.23.117.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURSJq0VAcRIm10OnozdTgAAAIA"]
[Fri Dec 19 03:12:39.848979 2025] [:error] [pid 37418:tid 37442] [client 185.23.117.23:45786] [client 185.23.117.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.23.117.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURSJ60VAcRIm10OnozdUgAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 03:20:46.192422 2025] [:error] [pid 42689:tid 42777] [client 81.88.49.20:31892] [client 81.88.49.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aURUDptsApEetHq6DgKO5QAAAAs"]
[Fri Dec 19 03:22:40.499954 2025] [:error] [pid 42698:tid 42844] [client 69.163.162.219:55490] [client 69.163.162.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.163.162.219, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURUgDYr2s2YOU40wXlyEQAAAJc"]
[Fri Dec 19 03:22:41.910709 2025] [:error] [pid 42698:tid 42843] [client 69.163.162.219:55490] [client 69.163.162.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.163.162.219, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURUgTYr2s2YOU40wXlyEwAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 03:28:52.319957 2025] [:error] [pid 15099:tid 15159] [client 68.178.161.65:40840] [client 68.178.161.65] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.161.65, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURV9G9X86sdxdNGvfqkIwAAAIA"]
[Fri Dec 19 03:28:53.423728 2025] [:error] [pid 15099:tid 15180] [client 68.178.161.65:40840] [client 68.178.161.65] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.161.65, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURV9W9X86sdxdNGvfqkJAAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 03:31:01.386257 2025] [:error] [pid 45352:tid 45366] [client 185.59.44.60:57302] [client 185.59.44.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.59.44.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURWdYzIKESYVHWAWa1EYQAAAMw"]
[Fri Dec 19 03:31:02.711654 2025] [:error] [pid 45352:tid 45373] [client 185.59.44.60:57302] [client 185.59.44.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.59.44.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURWdozIKESYVHWAWa1EYwAAANM"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 03:32:42.146339 2025] [:error] [pid 45259:tid 45304] [client 173.236.201.116:58384] [client 173.236.201.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.201.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURW2jd0pMbxR7NNLuoBcQAAAE4"]
[Fri Dec 19 03:32:43.597885 2025] [:error] [pid 45259:tid 45299] [client 173.236.201.116:58384] [client 173.236.201.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.201.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURW2zd0pMbxR7NNLuoBdQAAAEk"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 03:43:27.916930 2025] [:error] [pid 18001:tid 18039] [client 167.172.79.172:57730] [client 167.172.79.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.79.172, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURZXxYOQaCEJ5mpZM0MmgAAAEI"]
[Fri Dec 19 03:44:15.151498 2025] [:error] [pid 26308:tid 26334] [client 194.233.89.173:54370] [client 194.233.89.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.233.89.173, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURZj4c_OZFIItn2uH9IkgAAAQw"]
[Fri Dec 19 03:44:16.548067 2025] [:error] [pid 26308:tid 26329] [client 194.233.89.173:54370] [client 194.233.89.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.233.89.173, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURZkIc_OZFIItn2uH9IlQAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 03:44:54.644580 2025] [:error] [pid 18002:tid 18070] [client 81.88.49.4:38137] [client 81.88.49.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.88.49.4, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURZtuRci3IGgoecsZYCNgAAAIY"]
[Fri Dec 19 03:44:55.686814 2025] [:error] [pid 18002:tid 18078] [client 81.88.49.4:38137] [client 81.88.49.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.88.49.4, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURZt-Rci3IGgoecsZYCNwAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 03:46:36.132918 2025] [:error] [pid 26308:tid 26339] [client 103.117.180.206:53966] [client 103.117.180.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.117.180.206, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURaHIc_OZFIItn2uH9J7AAAARE"]
[Fri Dec 19 03:53:14.706880 2025] [:error] [pid 61921:tid 61938] [client 184.168.123.167:45052] [client 184.168.123.167] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 184.168.123.167, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURbqiI5bruBgrPWiCCmJAAAAA0"]
[Fri Dec 19 03:53:16.835011 2025] [:error] [pid 61921:tid 61926] [client 184.168.123.167:45052] [client 184.168.123.167] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 184.168.123.167, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURbrCI5bruBgrPWiCCmJwAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 03:59:21.541251 2025] [:error] [pid 61923:tid 62002] [client 194.233.89.173:47464] [client 194.233.89.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.233.89.173, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURdGeIJyAkgoURyh1i7TAAAAJc"]
[Fri Dec 19 03:59:22.785980 2025] [:error] [pid 61923:tid 61990] [client 194.233.89.173:47464] [client 194.233.89.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.233.89.173, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURdGuIJyAkgoURyh1i7TwAAAIs"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 04:00:12.099596 2025] [:error] [pid 61922:tid 61978] [client 103.129.148.48:49184] [client 103.129.148.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.129.148.48, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURdTBsDXYvsvN0FFlAaFQAAAFc"]
[Fri Dec 19 04:00:13.369342 2025] [:error] [pid 61922:tid 61958] [client 103.129.148.48:49184] [client 103.129.148.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.129.148.48, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURdTRsDXYvsvN0FFlAaGgAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 04:04:41.040503 2025] [:error] [pid 62008:tid 62027] [client 157.230.144.245:57802] [client 157.230.144.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.144.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUReWZJCOG7NAlbm_OQ_dwAAANA"]
[Fri Dec 19 04:04:44.895659 2025] [:error] [pid 62008:tid 62012] [client 157.230.144.245:57802] [client 157.230.144.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.144.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUReXJJCOG7NAlbm_OQ_fQAAAME"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 04:04:53.259052 2025] [:error] [pid 61923:tid 62003] [client 154.0.175.200:45682] [client 154.0.175.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.0.175.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUReZeIJyAkgoURyh1i-HgAAAJg"]
[Fri Dec 19 04:04:54.616833 2025] [:error] [pid 61923:tid 61991] [client 154.0.175.200:45682] [client 154.0.175.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.0.175.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUReZuIJyAkgoURyh1i-HwAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 04:09:03.289472 2025] [:error] [pid 64979:tid 64990] [client 92.205.8.235:25838] [client 92.205.8.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.8.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURfX8Tf9GnU9RkPzittgQAAAQk"]
[Fri Dec 19 04:09:04.322161 2025] [:error] [pid 64979:tid 65001] [client 92.205.8.235:25838] [client 92.205.8.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.8.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURfYMTf9GnU9RkPzitthAAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 04:12:46.240254 2025] [:error] [pid 61923:tid 61986] [client 162.243.244.193:31764] [client 162.243.244.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.243.244.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURgPuIJyAkgoURyh1i_aAAAAIc"]
[Fri Dec 19 04:12:47.226955 2025] [:error] [pid 61923:tid 61994] [client 162.243.244.193:31764] [client 162.243.244.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.243.244.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURgP-IJyAkgoURyh1i_aQAAAI8"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 04:14:46.375055 2025] [:error] [pid 61922:tid 61957] [client 130.61.174.112:34408] [client 130.61.174.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 130.61.174.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURgthsDXYvsvN0FFlAdVAAAAEU"]
[Fri Dec 19 04:21:43.568589 2025] [:error] [pid 62008:tid 62021] [client 157.230.144.245:36246] [client 157.230.144.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.144.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURiV5JCOG7NAlbm_OREUQAAAMo"]
[Fri Dec 19 04:21:44.843089 2025] [:error] [pid 62008:tid 62027] [client 157.230.144.245:36246] [client 157.230.144.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.144.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURiWJJCOG7NAlbm_OREUgAAANA"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 04:25:42.710784 2025] [:error] [pid 61922:tid 61974] [client 34.179.177.28:35140] [client 34.179.177.28] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/index.php/wp-json/wp/v2/users"] [unique_id "aURjRhsDXYvsvN0FFlAfLQAAAFU"]
[Fri Dec 19 04:26:20.694677 2025] [:error] [pid 61923:tid 61992] [client 43.224.124.253:7727] [client 43.224.124.253] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/Wp/v2/users"] [unique_id "aURjbOIJyAkgoURyh1jCWwAAAI0"]
[Fri Dec 19 04:26:37.320432 2025] [:error] [pid 61921:tid 61945] [client 103.129.148.48:34024] [client 103.129.148.48] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/Wp/v2/users"] [unique_id "aURjfSI5bruBgrPWiCCutQAAABQ"]
[Fri Dec 19 04:29:19.450831 2025] [:error] [pid 62008:tid 62022] [client 162.243.244.193:49896] [client 162.243.244.193] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users.json"] [unique_id "aURkH5JCOG7NAlbm_ORG0gAAAMs"]
[Fri Dec 19 04:43:17.584331 2025] [:error] [pid 61921:tid 61943] [client 104.155.117.95:15209] [client 104.155.117.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.155.117.95, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURnZSI5bruBgrPWiCC1MgAAABI"]
[Fri Dec 19 04:43:22.601050 2025] [:error] [pid 61921:tid 61930] [client 104.155.117.95:15209] [client 104.155.117.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.155.117.95, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURnaiI5bruBgrPWiCC1MwAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 04:46:20.918858 2025] [:error] [pid 61921:tid 61940] [client 180.93.137.9:41742] [client 180.93.137.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 180.93.137.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURoHCI5bruBgrPWiCC1_wAAAA8"]
[Fri Dec 19 04:46:23.759803 2025] [:error] [pid 61921:tid 61949] [client 180.93.137.9:41742] [client 180.93.137.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 180.93.137.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURoHyI5bruBgrPWiCC2SQAAABg"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 04:46:38.505606 2025] [:error] [pid 62008:tid 62014] [client 45.119.87.125:55756] [client 45.119.87.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.119.87.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURoLpJCOG7NAlbm_ORP8AAAAMM"]
[Fri Dec 19 04:46:39.499307 2025] [:error] [pid 62008:tid 62016] [client 45.119.87.125:55756] [client 45.119.87.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.119.87.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURoL5JCOG7NAlbm_ORP8QAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 04:50:21.878909 2025] [:error] [pid 62008:tid 62013] [client 165.22.98.144:57445] [client 165.22.98.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.98.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aURpDZJCOG7NAlbm_ORQ-wAAAMI"]
[Fri Dec 19 04:50:24.862873 2025] [:error] [pid 62008:tid 62031] [client 165.22.98.144:57445] [client 165.22.98.144] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aURpEJJCOG7NAlbm_ORRBQAAANQ"]
[Fri Dec 19 04:50:25.057974 2025] [:error] [pid 62008:tid 62017] [client 165.22.98.144:57445] [client 165.22.98.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.98.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aURpEZJCOG7NAlbm_ORRBwAAAMY"]
[Fri Dec 19 04:50:26.441237 2025] [:error] [pid 64979:tid 64999] [client 165.22.98.144:62807] [client 165.22.98.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.98.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aURpEsTf9GnU9RkPziuFaAAAARI"]
[Fri Dec 19 04:50:27.826449 2025] [:error] [pid 62008:tid 62032] [client 165.22.98.144:50663] [client 165.22.98.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.98.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aURpE5JCOG7NAlbm_ORRCAAAANU"]
[Fri Dec 19 04:50:29.204513 2025] [:error] [pid 64979:tid 64993] [client 165.22.98.144:50086] [client 165.22.98.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.98.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aURpFcTf9GnU9RkPziuFcQAAAQw"]
[Fri Dec 19 04:50:30.631508 2025] [:error] [pid 61923:tid 61977] [client 165.22.98.144:55265] [client 165.22.98.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.98.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aURpFuIJyAkgoURyh1jMQwAAAIE"]
[Fri Dec 19 04:50:30.631715 2025] [:error] [pid 61923:tid 61977] [client 165.22.98.144:55265] [client 165.22.98.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 165.22.98.144, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aURpFuIJyAkgoURyh1jMQwAAAIE"]
[Fri Dec 19 04:51:46.353419 2025] [:error] [pid 61921:tid 61925] [client 162.243.244.193:47434] [client 162.243.244.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.243.244.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURpYiI5bruBgrPWiCC4SwAAAAA"]
[Fri Dec 19 04:51:47.340293 2025] [:error] [pid 61921:tid 61949] [client 162.243.244.193:47434] [client 162.243.244.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.243.244.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURpYyI5bruBgrPWiCC4TwAAABg"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 04:52:39.867060 2025] [:error] [pid 64979:tid 64987] [client 103.57.220.209:56646] [client 103.57.220.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.57.220.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURpl8Tf9GnU9RkPziuGTgAAAQY"]
[Fri Dec 19 04:52:42.892718 2025] [:error] [pid 64979:tid 64993] [client 103.57.220.209:56646] [client 103.57.220.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.57.220.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURpmsTf9GnU9RkPziuGcwAAAQw"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 04:54:08.519568 2025] [:error] [pid 64979:tid 65004] [client 109.234.164.79:47890] [client 109.234.164.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.234.164.79, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURp8MTf9GnU9RkPziuHNAAAARc"]
[Fri Dec 19 04:54:09.619316 2025] [:error] [pid 64979:tid 64999] [client 109.234.164.79:47890] [client 109.234.164.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.234.164.79, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURp8cTf9GnU9RkPziuHOAAAARI"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 05:00:38.989938 2025] [:error] [pid 61922:tid 61959] [client 104.155.117.95:39874] [client 104.155.117.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.155.117.95, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURrdhsDXYvsvN0FFlArkgAAAEc"]
[Fri Dec 19 05:00:40.889692 2025] [:error] [pid 61922:tid 61958] [client 104.155.117.95:39874] [client 104.155.117.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.155.117.95, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURreBsDXYvsvN0FFlArkwAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 05:16:58.721688 2025] [:error] [pid 62008:tid 62017] [client 157.230.144.245:50272] [client 157.230.144.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.144.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURvSpJCOG7NAlbm_ORZtwAAAMY"]
[Fri Dec 19 05:17:01.235874 2025] [:error] [pid 62008:tid 62027] [client 157.230.144.245:50272] [client 157.230.144.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.144.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURvTZJCOG7NAlbm_ORZuQAAANA"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 05:17:08.798496 2025] [:error] [pid 61923:tid 61993] [client 103.57.220.209:36836] [client 103.57.220.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.57.220.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURvVOIJyAkgoURyh1jUQgAAAI4"]
[Fri Dec 19 05:17:09.942754 2025] [:error] [pid 61923:tid 61976] [client 103.57.220.209:36836] [client 103.57.220.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.57.220.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURvVeIJyAkgoURyh1jURAAAAIA"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 05:19:48.684624 2025] [:error] [pid 61921:tid 61944] [client 103.117.180.206:47510] [client 103.117.180.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.117.180.206, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURv9CI5bruBgrPWiCC-OQAAABM"]
[Fri Dec 19 05:19:52.553794 2025] [:error] [pid 61921:tid 61933] [client 103.117.180.206:47510] [client 103.117.180.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.117.180.206, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURv-CI5bruBgrPWiCC-RAAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 05:25:34.206205 2025] [:error] [pid 47035:tid 47046] [client 103.148.212.23:39172] [client 103.148.212.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.148.212.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURxToy3wL45ZxTVK_UNZAAAAYk"]
[Fri Dec 19 05:25:35.860972 2025] [:error] [pid 47035:tid 47050] [client 103.148.212.23:39172] [client 103.148.212.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.148.212.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURxT4y3wL45ZxTVK_UNaAAAAY0"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 05:28:28.084829 2025] [:error] [pid 61923:tid 62003] [client 15.235.203.43:36990] [client 15.235.203.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.235.203.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURx_OIJyAkgoURyh1jWLQAAAJg"]
[Fri Dec 19 05:28:29.202949 2025] [:error] [pid 61923:tid 62002] [client 15.235.203.43:36990] [client 15.235.203.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.235.203.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURx_eIJyAkgoURyh1jWLgAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 05:30:22.844004 2025] [:error] [pid 62008:tid 62015] [client 103.57.220.209:58262] [client 103.57.220.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.57.220.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURybpJCOG7NAlbm_OReRwAAAMQ"]
[Fri Dec 19 05:30:24.295273 2025] [:error] [pid 62008:tid 62029] [client 103.57.220.209:58262] [client 103.57.220.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.57.220.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURycJJCOG7NAlbm_OReTwAAANI"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 05:31:31.226460 2025] [:error] [pid 62008:tid 62032] [client 45.119.87.125:39338] [client 45.119.87.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.119.87.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURys5JCOG7NAlbm_ORfEgAAANU"]
[Fri Dec 19 05:31:32.256531 2025] [:error] [pid 62008:tid 62028] [client 45.119.87.125:39338] [client 45.119.87.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.119.87.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aURytJJCOG7NAlbm_ORfHwAAANE"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 05:41:47.167820 2025] [:error] [pid 61922:tid 61954] [client 74.222.168.76:37452] [client 74.222.168.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.222.168.76, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUR1GxsDXYvsvN0FFlA0sAAAAEI"]
[Fri Dec 19 05:41:48.286813 2025] [:error] [pid 61922:tid 61975] [client 74.222.168.76:37452] [client 74.222.168.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.222.168.76, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUR1HBsDXYvsvN0FFlA0sQAAAFY"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 05:51:21.608617 2025] [:error] [pid 62008:tid 62029] [client 103.158.108.3:40426] [client 103.158.108.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.158.108.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUR3WZJCOG7NAlbm_ORnNwAAANI"]
[Fri Dec 19 05:57:03.724614 2025] [:error] [pid 61922:tid 61957] [client 43.166.136.24:37686] [client 43.166.136.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aUR4rxsDXYvsvN0FFlA5ngAAAEU"]
[Fri Dec 19 06:13:58.052872 2025] [:error] [pid 61922:tid 61953] [client 152.228.211.92:14526] [client 152.228.211.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.228.211.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUR8phsDXYvsvN0FFlA9kgAAAEE"]
[Fri Dec 19 06:13:59.077315 2025] [:error] [pid 61922:tid 61969] [client 152.228.211.92:14526] [client 152.228.211.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.228.211.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUR8pxsDXYvsvN0FFlA9kwAAAFE"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 06:20:38.560683 2025] [:error] [pid 61921:tid 61937] [client 103.129.148.48:35482] [client 103.129.148.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.129.148.48, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUR-NiI5bruBgrPWiCDLCgAAAAw"]
[Fri Dec 19 06:20:39.965240 2025] [:error] [pid 61921:tid 61938] [client 103.129.148.48:35482] [client 103.129.148.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.129.148.48, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUR-NyI5bruBgrPWiCDLDAAAAA0"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 06:20:43.760396 2025] [:error] [pid 61922:tid 61960] [client 198.251.84.200:54048] [client 198.251.84.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.251.84.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUR-OxsDXYvsvN0FFlA_VwAAAEg"]
[Fri Dec 19 06:20:44.776299 2025] [:error] [pid 61922:tid 61968] [client 198.251.84.200:54048] [client 198.251.84.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.251.84.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUR-PBsDXYvsvN0FFlA_WAAAAFA"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 06:26:02.993945 2025] [:error] [pid 61921:tid 61932] [client 152.228.211.92:56169] [client 152.228.211.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.228.211.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUR_eiI5bruBgrPWiCDMZQAAAAc"]
[Fri Dec 19 06:26:03.953878 2025] [:error] [pid 61921:tid 61938] [client 152.228.211.92:56169] [client 152.228.211.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.228.211.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUR_eyI5bruBgrPWiCDMZgAAAA0"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 06:27:24.347278 2025] [:error] [pid 62008:tid 62021] [client 180.93.137.9:57612] [client 180.93.137.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 180.93.137.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUR_zJJCOG7NAlbm_OR4WwAAAMo"]
[Fri Dec 19 06:27:29.727564 2025] [:error] [pid 62008:tid 62028] [client 180.93.137.9:57612] [client 180.93.137.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 180.93.137.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUR_0ZJCOG7NAlbm_OR4XwAAANE"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 06:45:21.084625 2025] [:error] [pid 62008:tid 62029] [client 173.236.201.116:56848] [client 173.236.201.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.201.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUSEAZJCOG7NAlbm_OR_fwAAANI"]
[Fri Dec 19 06:45:23.212118 2025] [:error] [pid 62008:tid 62021] [client 173.236.201.116:56848] [client 173.236.201.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.201.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUSEA5JCOG7NAlbm_OR_hgAAAMo"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 06:49:52.021906 2025] [:error] [pid 61923:tid 61995] [client 171.244.32.203:40568] [client 171.244.32.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 171.244.32.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUSFEOIJyAkgoURyh1jp5QAAAJA"]
[Fri Dec 19 06:49:54.220181 2025] [:error] [pid 61923:tid 61999] [client 171.244.32.203:40568] [client 171.244.32.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 171.244.32.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUSFEuIJyAkgoURyh1jp5gAAAJQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Dec 19 07:02:03.033351 2025] [:error] [pid 61921:tid 61930] [client 170.64.176.145:4214] [client 170.64.176.145] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aUSH6yI5bruBgrPWiCDTTAAAAAU"]
[Fri Dec 19 07:02:18.391713 2025] [:error] [pid 64979:tid 65000] [client 170.64.176.145:15314] [client 170.64.176.145] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aUSH-sTf9GnU9RkPziutFwAAARM"]
[Fri Dec 19 15:07:48.563688 2025] [:error] [pid 20675:tid 20705] [client 182.44.12.37:38171] [client 182.44.12.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUT5xLMyJ3XqeDRsbQkI4wAAARE"]
[Fri Dec 19 15:49:02.206437 2025] [:error] [pid 20675:tid 20705] [client 129.226.213.145:45580] [client 129.226.213.145] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUUDbrMyJ3XqeDRsbQkWngAAARE"]
[Fri Dec 19 18:17:24.449512 2025] [:error] [pid 20675:tid 20690] [client 68.218.8.118:20812] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abouta.php"] [unique_id "aUUmNLMyJ3XqeDRsbQlYAQAAAQI"]
[Fri Dec 19 18:17:24.541871 2025] [:error] [pid 20582:tid 20646] [client 68.218.8.118:20762] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abouta.php"] [unique_id "aUUmNMpAnrkQKZ4b5gYB8QAAAMQ"]
[Fri Dec 19 18:17:24.642940 2025] [:error] [pid 20582:tid 20661] [client 68.218.8.118:20863] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abouta.php"] [unique_id "aUUmNMpAnrkQKZ4b5gYB8gAAANM"]
[Fri Dec 19 18:17:24.744670 2025] [:error] [pid 20582:tid 20645] [client 68.218.8.118:20830] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abouta.php"] [unique_id "aUUmNMpAnrkQKZ4b5gYB8wAAAMM"]
[Fri Dec 19 18:17:24.875447 2025] [:error] [pid 20582:tid 20665] [client 68.218.8.118:20857] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fclas.php"] [unique_id "aUUmNMpAnrkQKZ4b5gYB9AAAANc"]
[Fri Dec 19 18:17:24.990042 2025] [:error] [pid 20582:tid 20648] [client 68.218.8.118:20847] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fclas.php"] [unique_id "aUUmNMpAnrkQKZ4b5gYB9QAAAMY"]
[Fri Dec 19 18:17:25.075854 2025] [:error] [pid 20675:tid 20705] [client 68.218.8.118:20828] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fclas.php"] [unique_id "aUUmNbMyJ3XqeDRsbQlYAwAAARE"]
[Fri Dec 19 18:17:25.123092 2025] [:error] [pid 41451:tid 41466] [client 68.218.8.118:20862] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fclas.php"] [unique_id "aUUmNQYXFn-DbZghZBGk7AAAAAw"]
[Fri Dec 19 18:17:25.156829 2025] [:error] [pid 20582:tid 20664] [client 68.218.8.118:20744] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/File.php"] [unique_id "aUUmNcpAnrkQKZ4b5gYB9gAAANY"]
[Fri Dec 19 18:17:25.187616 2025] [:error] [pid 41451:tid 41459] [client 68.218.8.118:20760] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/File.php"] [unique_id "aUUmNQYXFn-DbZghZBGk7QAAAAU"]
[Fri Dec 19 18:17:25.216885 2025] [:error] [pid 20582:tid 20654] [client 68.218.8.118:20829] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/File.php"] [unique_id "aUUmNcpAnrkQKZ4b5gYB9wAAAMw"]
[Fri Dec 19 18:17:25.255829 2025] [:error] [pid 41451:tid 41471] [client 68.218.8.118:20801] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/File.php"] [unique_id "aUUmNQYXFn-DbZghZBGk7gAAABE"]
[Fri Dec 19 18:17:25.294917 2025] [:error] [pid 41451:tid 41462] [client 68.218.8.118:20743] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/all.php"] [unique_id "aUUmNQYXFn-DbZghZBGk7wAAAAg"]
[Fri Dec 19 18:17:25.325360 2025] [:error] [pid 20675:tid 20707] [client 68.218.8.118:20861] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/all.php"] [unique_id "aUUmNbMyJ3XqeDRsbQlYBgAAARM"]
[Fri Dec 19 18:17:25.357093 2025] [:error] [pid 41451:tid 41457] [client 68.218.8.118:20763] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/all.php"] [unique_id "aUUmNQYXFn-DbZghZBGk8AAAAAM"]
[Fri Dec 19 18:17:25.395280 2025] [:error] [pid 41451:tid 41467] [client 68.218.8.118:20836] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/all.php"] [unique_id "aUUmNQYXFn-DbZghZBGk8QAAAA0"]
[Fri Dec 19 18:17:25.436592 2025] [:error] [pid 41451:tid 41456] [client 68.218.8.118:20831] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bbn.php"] [unique_id "aUUmNQYXFn-DbZghZBGk8gAAAAI"]
[Fri Dec 19 18:17:25.471693 2025] [:error] [pid 20580:tid 20593] [client 68.218.8.118:20839] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bbn.php"] [unique_id "aUUmNUmd1op_YdAdgR1skgAAAEc"]
[Fri Dec 19 18:17:25.508035 2025] [:error] [pid 20580:tid 20595] [client 68.218.8.118:20835] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bbn.php"] [unique_id "aUUmNUmd1op_YdAdgR1skwAAAEk"]
[Fri Dec 19 18:17:25.546741 2025] [:error] [pid 41451:tid 41455] [client 68.218.8.118:20738] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bbn.php"] [unique_id "aUUmNQYXFn-DbZghZBGk8wAAAAE"]
[Fri Dec 19 18:17:25.577656 2025] [:error] [pid 20675:tid 20692] [client 68.218.8.118:20765] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/berlin.php"] [unique_id "aUUmNbMyJ3XqeDRsbQlYCQAAAQQ"]
[Fri Dec 19 18:17:25.627289 2025] [:error] [pid 20580:tid 20592] [client 68.218.8.118:20761] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/berlin.php"] [unique_id "aUUmNUmd1op_YdAdgR1slAAAAEY"]
[Fri Dec 19 18:17:25.659731 2025] [:error] [pid 20582:tid 20652] [client 68.218.8.118:20745] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/berlin.php"] [unique_id "aUUmNcpAnrkQKZ4b5gYB-QAAAMo"]
[Fri Dec 19 18:17:25.692327 2025] [:error] [pid 41451:tid 41475] [client 68.218.8.118:20747] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/berlin.php"] [unique_id "aUUmNQYXFn-DbZghZBGk9AAAABU"]
[Fri Dec 19 18:17:25.727504 2025] [:error] [pid 20675:tid 20712] [client 68.218.8.118:20786] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "aUUmNbMyJ3XqeDRsbQlYDAAAARg"]
[Fri Dec 19 18:17:25.761191 2025] [:error] [pid 20675:tid 20691] [client 68.218.8.118:20837] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "aUUmNbMyJ3XqeDRsbQlYDQAAAQM"]
[Fri Dec 19 18:17:25.807599 2025] [:error] [pid 41451:tid 41454] [client 68.218.8.118:20754] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "aUUmNQYXFn-DbZghZBGk9QAAAAA"]
[Fri Dec 19 18:17:25.868435 2025] [:error] [pid 20582:tid 20657] [client 68.218.8.118:20753] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "aUUmNcpAnrkQKZ4b5gYB-gAAAM8"]
[Fri Dec 19 18:17:25.939060 2025] [:error] [pid 20675:tid 20710] [client 68.218.8.118:20787] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api2.php"] [unique_id "aUUmNbMyJ3XqeDRsbQlYDgAAARY"]
[Fri Dec 19 18:17:26.009567 2025] [:error] [pid 41451:tid 41476] [client 68.218.8.118:20846] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api2.php"] [unique_id "aUUmNgYXFn-DbZghZBGk9gAAABY"]
[Fri Dec 19 18:17:26.069545 2025] [:error] [pid 20675:tid 20694] [client 68.218.8.118:20853] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api2.php"] [unique_id "aUUmNrMyJ3XqeDRsbQlYEAAAAQY"]
[Fri Dec 19 18:17:26.148842 2025] [:error] [pid 20675:tid 20700] [client 68.218.8.118:20758] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api2.php"] [unique_id "aUUmNrMyJ3XqeDRsbQlYEQAAAQw"]
[Fri Dec 19 18:17:26.200604 2025] [:error] [pid 20675:tid 20699] [client 68.218.8.118:20821] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xz89.php"] [unique_id "aUUmNrMyJ3XqeDRsbQlYEgAAAQs"]
[Fri Dec 19 18:17:26.234900 2025] [:error] [pid 20675:tid 20702] [client 68.218.8.118:20823] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xz89.php"] [unique_id "aUUmNrMyJ3XqeDRsbQlYFAAAAQ4"]
[Fri Dec 19 18:17:26.298968 2025] [:error] [pid 20582:tid 20656] [client 68.218.8.118:20822] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xz89.php"] [unique_id "aUUmNspAnrkQKZ4b5gYB-wAAAM4"]
[Fri Dec 19 18:17:26.340595 2025] [:error] [pid 20582:tid 20653] [client 68.218.8.118:20844] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xz89.php"] [unique_id "aUUmNspAnrkQKZ4b5gYB_AAAAMs"]
[Fri Dec 19 18:17:26.375907 2025] [:error] [pid 20582:tid 20647] [client 68.218.8.118:20764] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thai.php"] [unique_id "aUUmNspAnrkQKZ4b5gYB_QAAAMU"]
[Fri Dec 19 18:17:26.412934 2025] [:error] [pid 20582:tid 20642] [client 68.218.8.118:20850] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thai.php"] [unique_id "aUUmNspAnrkQKZ4b5gYB_gAAAMA"]
[Fri Dec 19 18:17:26.455558 2025] [:error] [pid 41451:tid 41458] [client 68.218.8.118:20798] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thai.php"] [unique_id "aUUmNgYXFn-DbZghZBGk9wAAAAQ"]
[Fri Dec 19 18:17:26.498847 2025] [:error] [pid 41451:tid 41468] [client 68.218.8.118:20802] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thai.php"] [unique_id "aUUmNgYXFn-DbZghZBGk-AAAAA4"]
[Fri Dec 19 18:17:26.537230 2025] [:error] [pid 41451:tid 41472] [client 68.218.8.118:20750] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lopst.php"] [unique_id "aUUmNgYXFn-DbZghZBGk-QAAABI"]
[Fri Dec 19 18:17:26.570626 2025] [:error] [pid 20582:tid 20658] [client 68.218.8.118:20766] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lopst.php"] [unique_id "aUUmNspAnrkQKZ4b5gYCAAAAANA"]
[Fri Dec 19 18:17:26.612353 2025] [:error] [pid 20580:tid 20596] [client 68.218.8.118:20841] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lopst.php"] [unique_id "aUUmNkmd1op_YdAdgR1slgAAAEo"]
[Fri Dec 19 18:17:26.652733 2025] [:error] [pid 20582:tid 20650] [client 68.218.8.118:20741] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lopst.php"] [unique_id "aUUmNspAnrkQKZ4b5gYCAQAAAMg"]
[Fri Dec 19 18:17:26.689403 2025] [:error] [pid 20582:tid 20644] [client 68.218.8.118:11244] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wft.php"] [unique_id "aUUmNspAnrkQKZ4b5gYCAgAAAMI"]
[Fri Dec 19 18:17:26.722322 2025] [:error] [pid 41451:tid 41473] [client 68.218.8.118:20742] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wft.php"] [unique_id "aUUmNgYXFn-DbZghZBGk-wAAABM"]
[Fri Dec 19 18:17:26.760072 2025] [:error] [pid 41451:tid 41463] [client 68.218.8.118:11225] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wft.php"] [unique_id "aUUmNgYXFn-DbZghZBGk_AAAAAk"]
[Fri Dec 19 18:17:26.790141 2025] [:error] [pid 41451:tid 41461] [client 68.218.8.118:20810] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wft.php"] [unique_id "aUUmNgYXFn-DbZghZBGk_QAAAAc"]
[Fri Dec 19 18:17:26.828572 2025] [:error] [pid 41451:tid 41460] [client 68.218.8.118:20818] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws28.php"] [unique_id "aUUmNgYXFn-DbZghZBGk_gAAAAY"]
[Fri Dec 19 18:17:26.874200 2025] [:error] [pid 41451:tid 41477] [client 68.218.8.118:20809] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws28.php"] [unique_id "aUUmNgYXFn-DbZghZBGk_wAAABc"]
[Fri Dec 19 18:17:26.907192 2025] [:error] [pid 41451:tid 41469] [client 68.218.8.118:20749] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws28.php"] [unique_id "aUUmNgYXFn-DbZghZBGlAAAAAA8"]
[Fri Dec 19 18:17:26.944881 2025] [:error] [pid 41451:tid 41466] [client 68.218.8.118:20768] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws28.php"] [unique_id "aUUmNgYXFn-DbZghZBGlAQAAAAw"]
[Fri Dec 19 18:17:26.989441 2025] [:error] [pid 41451:tid 41459] [client 68.218.8.118:20858] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsheet1.php"] [unique_id "aUUmNgYXFn-DbZghZBGlAgAAAAU"]
[Fri Dec 19 18:17:27.021340 2025] [:error] [pid 20675:tid 20698] [client 68.218.8.118:11214] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsheet1.php"] [unique_id "aUUmN7MyJ3XqeDRsbQlYFwAAAQo"]
[Fri Dec 19 18:17:27.054249 2025] [:error] [pid 20675:tid 20705] [client 68.218.8.118:11253] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsheet1.php"] [unique_id "aUUmN7MyJ3XqeDRsbQlYGAAAARE"]
[Fri Dec 19 18:17:27.085625 2025] [:error] [pid 20675:tid 20695] [client 68.218.8.118:20793] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsheet1.php"] [unique_id "aUUmN7MyJ3XqeDRsbQlYGQAAAQc"]
[Fri Dec 19 18:17:27.119027 2025] [:error] [pid 20675:tid 20711] [client 68.218.8.118:11203] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsvvs.php"] [unique_id "aUUmN7MyJ3XqeDRsbQlYGgAAARc"]
[Fri Dec 19 18:17:27.156764 2025] [:error] [pid 20582:tid 20649] [client 68.218.8.118:20752] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsvvs.php"] [unique_id "aUUmN8pAnrkQKZ4b5gYCBAAAAMc"]
[Fri Dec 19 18:17:27.194202 2025] [:error] [pid 41451:tid 41462] [client 68.218.8.118:20755] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsvvs.php"] [unique_id "aUUmNwYXFn-DbZghZBGlAwAAAAg"]
[Fri Dec 19 18:17:27.248788 2025] [:error] [pid 41451:tid 41457] [client 68.218.8.118:20748] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsvvs.php"] [unique_id "aUUmNwYXFn-DbZghZBGlBAAAAAM"]
[Fri Dec 19 18:17:27.310865 2025] [:error] [pid 41451:tid 41467] [client 68.218.8.118:11237] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vbbn.php"] [unique_id "aUUmNwYXFn-DbZghZBGlBQAAAA0"]
[Fri Dec 19 18:17:27.392434 2025] [:error] [pid 20675:tid 20701] [client 68.218.8.118:20814] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vbbn.php"] [unique_id "aUUmN7MyJ3XqeDRsbQlYHAAAAQ0"]
[Fri Dec 19 18:17:27.463433 2025] [:error] [pid 20675:tid 20712] [client 68.218.8.118:20806] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vbbn.php"] [unique_id "aUUmN7MyJ3XqeDRsbQlYHgAAARg"]
[Fri Dec 19 18:17:27.508899 2025] [:error] [pid 20675:tid 20691] [client 68.218.8.118:11228] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vbbn.php"] [unique_id "aUUmN7MyJ3XqeDRsbQlYHwAAAQM"]
[Fri Dec 19 18:17:27.553449 2025] [:error] [pid 41451:tid 41455] [client 68.218.8.118:20854] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aUUmNwYXFn-DbZghZBGlBwAAAAE"]
[Fri Dec 19 18:17:27.608146 2025] [:error] [pid 41451:tid 41454] [client 68.218.8.118:20827] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aUUmNwYXFn-DbZghZBGlCAAAAAA"]
[Fri Dec 19 18:17:27.655404 2025] [:error] [pid 20580:tid 20608] [client 68.218.8.118:20860] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aUUmN0md1op_YdAdgR1smAAAAFY"]
[Fri Dec 19 18:17:27.723736 2025] [:error] [pid 20675:tid 20710] [client 68.218.8.118:11243] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aUUmN7MyJ3XqeDRsbQlYIQAAARY"]
[Fri Dec 19 18:17:27.789890 2025] [:error] [pid 20675:tid 20694] [client 68.218.8.118:20784] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fz.php"] [unique_id "aUUmN7MyJ3XqeDRsbQlYIgAAAQY"]
[Fri Dec 19 18:17:27.872264 2025] [:error] [pid 20580:tid 20601] [client 68.218.8.118:20859] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fz.php"] [unique_id "aUUmN0md1op_YdAdgR1smQAAAE8"]
[Fri Dec 19 18:17:27.954467 2025] [:error] [pid 20580:tid 20590] [client 68.218.8.118:20740] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fz.php"] [unique_id "aUUmN0md1op_YdAdgR1smwAAAEQ"]
[Fri Dec 19 18:17:28.044075 2025] [:error] [pid 20580:tid 20610] [client 68.218.8.118:20759] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fz.php"] [unique_id "aUUmOEmd1op_YdAdgR1snAAAAFg"]
[Fri Dec 19 18:17:28.138458 2025] [:error] [pid 20580:tid 20603] [client 68.218.8.118:11236] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sang.php"] [unique_id "aUUmOEmd1op_YdAdgR1snQAAAFE"]
[Fri Dec 19 18:17:28.184215 2025] [:error] [pid 20580:tid 20599] [client 68.218.8.118:20840] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sang.php"] [unique_id "aUUmOEmd1op_YdAdgR1sngAAAE0"]
[Fri Dec 19 18:17:28.215493 2025] [:error] [pid 20580:tid 20588] [client 68.218.8.118:20834] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sang.php"] [unique_id "aUUmOEmd1op_YdAdgR1snwAAAEI"]
[Fri Dec 19 18:17:28.246940 2025] [:error] [pid 20580:tid 20605] [client 68.218.8.118:20736] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sang.php"] [unique_id "aUUmOEmd1op_YdAdgR1soAAAAFM"]
[Fri Dec 19 18:17:28.278165 2025] [:error] [pid 20580:tid 20586] [client 68.218.8.118:20779] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0o0.php"] [unique_id "aUUmOEmd1op_YdAdgR1soQAAAEA"]
[Fri Dec 19 18:17:28.314708 2025] [:error] [pid 20580:tid 20602] [client 68.218.8.118:11219] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0o0.php"] [unique_id "aUUmOEmd1op_YdAdgR1sogAAAFA"]
[Fri Dec 19 18:17:28.380945 2025] [:error] [pid 20580:tid 20593] [client 68.218.8.118:11233] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0o0.php"] [unique_id "aUUmOEmd1op_YdAdgR1spAAAAEc"]
[Fri Dec 19 18:17:28.411657 2025] [:error] [pid 20675:tid 20699] [client 68.218.8.118:11201] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0o0.php"] [unique_id "aUUmOLMyJ3XqeDRsbQlYJQAAAQs"]
[Fri Dec 19 18:17:28.454608 2025] [:error] [pid 20675:tid 20706] [client 68.218.8.118:11205] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aUUmOLMyJ3XqeDRsbQlYJgAAARI"]
[Fri Dec 19 18:17:28.495156 2025] [:error] [pid 20580:tid 20595] [client 68.218.8.118:20843] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aUUmOEmd1op_YdAdgR1spQAAAEk"]
[Fri Dec 19 18:17:28.527204 2025] [:error] [pid 20675:tid 20703] [client 68.218.8.118:11242] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aUUmOLMyJ3XqeDRsbQlYJwAAAQ8"]
[Fri Dec 19 18:17:28.558894 2025] [:error] [pid 20675:tid 20693] [client 68.218.8.118:20817] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aUUmOLMyJ3XqeDRsbQlYKAAAAQU"]
[Fri Dec 19 18:17:28.595586 2025] [:error] [pid 20675:tid 20697] [client 68.218.8.118:20800] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aUUmOLMyJ3XqeDRsbQlYKQAAAQk"]
[Fri Dec 19 18:17:28.633864 2025] [:error] [pid 20675:tid 20704] [client 68.218.8.118:20819] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aUUmOLMyJ3XqeDRsbQlYKgAAARA"]
[Fri Dec 19 18:17:28.678001 2025] [:error] [pid 20675:tid 20709] [client 68.218.8.118:11250] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aUUmOLMyJ3XqeDRsbQlYKwAAARU"]
[Fri Dec 19 18:17:28.708106 2025] [:error] [pid 20675:tid 20690] [client 68.218.8.118:20773] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aUUmOLMyJ3XqeDRsbQlYLAAAAQI"]
[Fri Dec 19 18:17:28.739141 2025] [:error] [pid 20580:tid 20598] [client 68.218.8.118:11208] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aUUmOEmd1op_YdAdgR1spwAAAEw"]
[Fri Dec 19 18:17:28.771342 2025] [:error] [pid 20580:tid 20591] [client 68.218.8.118:11202] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aUUmOEmd1op_YdAdgR1sqAAAAEU"]
[Fri Dec 19 18:17:28.803274 2025] [:error] [pid 20582:tid 20651] [client 68.218.8.118:20791] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aUUmOMpAnrkQKZ4b5gYCBgAAAMk"]
[Fri Dec 19 18:17:28.834066 2025] [:error] [pid 20581:tid 20623] [client 68.218.8.118:20756] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aUUmOPxEv7WXNhnFD1lX9QAAAIg"]
[Fri Dec 19 18:17:28.869948 2025] [:error] [pid 20581:tid 20619] [client 68.218.8.118:11164] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aUUmOPxEv7WXNhnFD1lX9gAAAIQ"]
[Fri Dec 19 18:17:28.909848 2025] [:error] [pid 20581:tid 20635] [client 68.218.8.118:11207] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aUUmOPxEv7WXNhnFD1lX9wAAAJQ"]
[Fri Dec 19 18:17:28.940077 2025] [:error] [pid 20581:tid 20630] [client 68.218.8.118:20792] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aUUmOPxEv7WXNhnFD1lX-AAAAI8"]
[Fri Dec 19 18:17:28.970881 2025] [:error] [pid 20581:tid 20639] [client 68.218.8.118:11241] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aUUmOPxEv7WXNhnFD1lX-QAAAJg"]
[Fri Dec 19 18:17:29.014121 2025] [:error] [pid 20581:tid 20629] [client 68.218.8.118:20849] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aUUmOfxEv7WXNhnFD1lX-gAAAI4"]
[Fri Dec 19 18:17:29.047923 2025] [:error] [pid 20581:tid 20636] [client 68.218.8.118:11229] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aUUmOfxEv7WXNhnFD1lX-wAAAJU"]
[Fri Dec 19 18:17:29.082297 2025] [:error] [pid 20580:tid 20596] [client 68.218.8.118:20805] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aUUmOUmd1op_YdAdgR1sqQAAAEo"]
[Fri Dec 19 18:17:29.127189 2025] [:error] [pid 20581:tid 20617] [client 68.218.8.118:20788] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aUUmOfxEv7WXNhnFD1lX_AAAAII"]
[Fri Dec 19 18:17:29.159791 2025] [:error] [pid 20582:tid 20646] [client 68.218.8.118:11223] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aUUmOcpAnrkQKZ4b5gYCBwAAAMQ"]
[Fri Dec 19 18:17:29.194416 2025] [:error] [pid 20582:tid 20660] [client 68.218.8.118:11179] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aUUmOcpAnrkQKZ4b5gYCCAAAANI"]
[Fri Dec 19 18:17:29.231280 2025] [:error] [pid 20581:tid 20638] [client 68.218.8.118:20767] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aUUmOfxEv7WXNhnFD1lX_QAAAJc"]
[Fri Dec 19 18:17:29.268521 2025] [:error] [pid 20581:tid 20622] [client 68.218.8.118:20855] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aUUmOfxEv7WXNhnFD1lX_wAAAIc"]
[Fri Dec 19 18:17:29.310648 2025] [:error] [pid 20581:tid 20628] [client 68.218.8.118:20780] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/randkeyword.php"] [unique_id "aUUmOfxEv7WXNhnFD1lYAAAAAI0"]
[Fri Dec 19 18:17:29.351322 2025] [:error] [pid 20581:tid 20625] [client 68.218.8.118:20771] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/randkeyword.php"] [unique_id "aUUmOfxEv7WXNhnFD1lYAQAAAIo"]
[Fri Dec 19 18:17:29.385868 2025] [:error] [pid 41451:tid 41472] [client 68.218.8.118:20739] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/randkeyword.php"] [unique_id "aUUmOQYXFn-DbZghZBGlDAAAABI"]
[Fri Dec 19 18:17:29.417151 2025] [:error] [pid 20581:tid 20616] [client 68.218.8.118:20824] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/randkeyword.php"] [unique_id "aUUmOfxEv7WXNhnFD1lYAgAAAIE"]
[Fri Dec 19 18:17:29.450345 2025] [:error] [pid 20675:tid 20695] [client 68.218.8.118:11144] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fwe.php"] [unique_id "aUUmObMyJ3XqeDRsbQlYLwAAAQc"]
[Fri Dec 19 18:17:29.486282 2025] [:error] [pid 41451:tid 41474] [client 68.218.8.118:11232] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fwe.php"] [unique_id "aUUmOQYXFn-DbZghZBGlDQAAABQ"]
[Fri Dec 19 18:17:29.519735 2025] [:error] [pid 20675:tid 20711] [client 68.218.8.118:20816] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fwe.php"] [unique_id "aUUmObMyJ3XqeDRsbQlYMAAAARc"]
[Fri Dec 19 18:17:29.555124 2025] [:error] [pid 41451:tid 41463] [client 68.218.8.118:11217] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fwe.php"] [unique_id "aUUmOQYXFn-DbZghZBGlDgAAAAk"]
[Fri Dec 19 18:17:29.586542 2025] [:error] [pid 20675:tid 20701] [client 68.218.8.118:11211] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aUUmObMyJ3XqeDRsbQlYMQAAAQ0"]
[Fri Dec 19 18:17:29.618704 2025] [:error] [pid 20675:tid 20692] [client 68.218.8.118:20852] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aUUmObMyJ3XqeDRsbQlYMgAAAQQ"]
[Fri Dec 19 18:17:29.651997 2025] [:error] [pid 20675:tid 20712] [client 68.218.8.118:11216] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aUUmObMyJ3XqeDRsbQlYMwAAARg"]
[Fri Dec 19 18:17:29.683222 2025] [:error] [pid 41451:tid 41461] [client 68.218.8.118:20746] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aUUmOQYXFn-DbZghZBGlDwAAAAc"]
[Fri Dec 19 18:17:29.717203 2025] [:error] [pid 41451:tid 41460] [client 68.218.8.118:11212] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx1.php"] [unique_id "aUUmOQYXFn-DbZghZBGlEAAAAAY"]
[Fri Dec 19 18:17:29.754909 2025] [:error] [pid 20580:tid 20587] [client 68.218.8.118:20845] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx1.php"] [unique_id "aUUmOUmd1op_YdAdgR1sqwAAAEE"]
[Fri Dec 19 18:17:29.794187 2025] [:error] [pid 20580:tid 20608] [client 68.218.8.118:11213] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx1.php"] [unique_id "aUUmOUmd1op_YdAdgR1srAAAAFY"]
[Fri Dec 19 18:17:29.825315 2025] [:error] [pid 20675:tid 20691] [client 68.218.8.118:20774] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx1.php"] [unique_id "aUUmObMyJ3XqeDRsbQlYNAAAAQM"]
[Fri Dec 19 18:17:29.855336 2025] [:error] [pid 41451:tid 41465] [client 68.218.8.118:11221] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aUUmOQYXFn-DbZghZBGlEQAAAAs"]
[Fri Dec 19 18:17:29.894776 2025] [:error] [pid 20675:tid 20696] [client 68.218.8.118:20795] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aUUmObMyJ3XqeDRsbQlYNQAAAQg"]
[Fri Dec 19 18:17:29.936475 2025] [:error] [pid 41451:tid 41477] [client 68.218.8.118:20807] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aUUmOQYXFn-DbZghZBGlEgAAABc"]
[Fri Dec 19 18:17:29.969247 2025] [:error] [pid 20675:tid 20710] [client 68.218.8.118:20820] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aUUmObMyJ3XqeDRsbQlYNgAAARY"]
[Fri Dec 19 18:17:30.000515 2025] [:error] [pid 20582:tid 20645] [client 68.218.8.118:11263] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "aUUmOcpAnrkQKZ4b5gYCCQAAAMM"]
[Fri Dec 19 18:17:30.032210 2025] [:error] [pid 41451:tid 41469] [client 68.218.8.118:11226] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "aUUmOgYXFn-DbZghZBGlEwAAAA8"]
[Fri Dec 19 18:17:30.064608 2025] [:error] [pid 20580:tid 20590] [client 68.218.8.118:11167] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "aUUmOkmd1op_YdAdgR1srgAAAEQ"]
[Fri Dec 19 18:17:30.094777 2025] [:error] [pid 20580:tid 20594] [client 68.218.8.118:20803] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "aUUmOkmd1op_YdAdgR1srwAAAEg"]
[Fri Dec 19 18:17:30.125641 2025] [:error] [pid 20580:tid 20609] [client 68.218.8.118:11209] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aUUmOkmd1op_YdAdgR1ssAAAAFc"]
[Fri Dec 19 18:17:30.155444 2025] [:error] [pid 20580:tid 20603] [client 68.218.8.118:11140] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aUUmOkmd1op_YdAdgR1ssQAAAFE"]
[Fri Dec 19 18:17:30.188307 2025] [:error] [pid 20582:tid 20665] [client 68.218.8.118:20775] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aUUmOspAnrkQKZ4b5gYCCgAAANc"]
[Fri Dec 19 18:17:30.221380 2025] [:error] [pid 20581:tid 20633] [client 68.218.8.118:20776] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aUUmOvxEv7WXNhnFD1lYBAAAAJI"]
[Fri Dec 19 18:17:30.260542 2025] [:error] [pid 20580:tid 20588] [client 68.218.8.118:20794] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aUUmOkmd1op_YdAdgR1ssgAAAEI"]
[Fri Dec 19 18:17:30.291895 2025] [:error] [pid 20581:tid 20627] [client 68.218.8.118:11235] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aUUmOvxEv7WXNhnFD1lYBQAAAIw"]
[Fri Dec 19 18:17:30.325986 2025] [:error] [pid 20580:tid 20586] [client 68.218.8.118:20838] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aUUmOkmd1op_YdAdgR1sswAAAEA"]
[Fri Dec 19 18:17:30.366959 2025] [:error] [pid 20582:tid 20648] [client 68.218.8.118:11206] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aUUmOspAnrkQKZ4b5gYCCwAAAMY"]
[Fri Dec 19 18:17:30.396781 2025] [:error] [pid 20582:tid 20664] [client 68.218.8.118:20757] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "aUUmOspAnrkQKZ4b5gYCDAAAANY"]
[Fri Dec 19 18:17:30.427295 2025] [:error] [pid 20582:tid 20643] [client 68.218.8.118:11170] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "aUUmOspAnrkQKZ4b5gYCDQAAAME"]
[Fri Dec 19 18:17:30.466341 2025] [:error] [pid 20581:tid 20626] [client 68.218.8.118:11255] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "aUUmOvxEv7WXNhnFD1lYBgAAAIs"]
[Fri Dec 19 18:17:30.496575 2025] [:error] [pid 20582:tid 20657] [client 68.218.8.118:11249] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "aUUmOspAnrkQKZ4b5gYCDgAAAM8"]
[Fri Dec 19 18:17:30.548203 2025] [:error] [pid 20582:tid 20656] [client 68.218.8.118:11146] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aUUmOspAnrkQKZ4b5gYCDwAAAM4"]
[Fri Dec 19 18:17:30.581105 2025] [:error] [pid 20581:tid 20621] [client 68.218.8.118:20825] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aUUmOvxEv7WXNhnFD1lYBwAAAIY"]
[Fri Dec 19 18:17:30.617433 2025] [:error] [pid 20582:tid 20653] [client 68.218.8.118:11157] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aUUmOspAnrkQKZ4b5gYCEAAAAMs"]
[Fri Dec 19 18:17:30.648088 2025] [:error] [pid 41451:tid 41466] [client 68.218.8.118:11224] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aUUmOgYXFn-DbZghZBGlFAAAAAw"]
[Fri Dec 19 18:17:30.679386 2025] [:error] [pid 20675:tid 20694] [client 68.218.8.118:20842] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aUUmOrMyJ3XqeDRsbQlYNwAAAQY"]
[Fri Dec 19 18:17:30.718248 2025] [:error] [pid 41451:tid 41459] [client 68.218.8.118:20856] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aUUmOgYXFn-DbZghZBGlFQAAAAU"]
[Fri Dec 19 18:17:30.749547 2025] [:error] [pid 41451:tid 41471] [client 68.218.8.118:11178] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aUUmOgYXFn-DbZghZBGlFgAAABE"]
[Fri Dec 19 18:17:30.781602 2025] [:error] [pid 20582:tid 20647] [client 68.218.8.118:20772] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aUUmOspAnrkQKZ4b5gYCEgAAAMU"]
[Fri Dec 19 18:17:30.812483 2025] [:error] [pid 41451:tid 41470] [client 68.218.8.118:20781] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gtc.php"] [unique_id "aUUmOgYXFn-DbZghZBGlFwAAABA"]
[Fri Dec 19 18:17:30.845321 2025] [:error] [pid 20675:tid 20688] [client 68.218.8.118:11230] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gtc.php"] [unique_id "aUUmOrMyJ3XqeDRsbQlYOAAAAQA"]
[Fri Dec 19 18:17:30.875346 2025] [:error] [pid 41451:tid 41462] [client 68.218.8.118:11141] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gtc.php"] [unique_id "aUUmOgYXFn-DbZghZBGlGAAAAAg"]
[Fri Dec 19 18:17:30.907466 2025] [:error] [pid 20675:tid 20700] [client 68.218.8.118:11076] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gtc.php"] [unique_id "aUUmOrMyJ3XqeDRsbQlYOQAAAQw"]
[Fri Dec 19 18:17:30.941041 2025] [:error] [pid 20675:tid 20699] [client 68.218.8.118:20785] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atx.php"] [unique_id "aUUmOrMyJ3XqeDRsbQlYOgAAAQs"]
[Fri Dec 19 18:17:30.973909 2025] [:error] [pid 20675:tid 20706] [client 68.218.8.118:11168] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atx.php"] [unique_id "aUUmOrMyJ3XqeDRsbQlYOwAAARI"]
[Fri Dec 19 18:17:31.012284 2025] [:error] [pid 41451:tid 41457] [client 68.218.8.118:11247] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atx.php"] [unique_id "aUUmOwYXFn-DbZghZBGlGQAAAAM"]
[Fri Dec 19 18:17:31.044401 2025] [:error] [pid 41451:tid 41467] [client 68.218.8.118:11126] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atx.php"] [unique_id "aUUmOwYXFn-DbZghZBGlGgAAAA0"]
[Fri Dec 19 18:17:31.080943 2025] [:error] [pid 41451:tid 41456] [client 68.218.8.118:11163] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aUUmOwYXFn-DbZghZBGlGwAAAAI"]
[Fri Dec 19 18:17:31.114967 2025] [:error] [pid 20582:tid 20663] [client 68.218.8.118:11078] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aUUmO8pAnrkQKZ4b5gYCEwAAANU"]
[Fri Dec 19 18:17:31.150132 2025] [:error] [pid 20582:tid 20650] [client 68.218.8.118:20789] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aUUmO8pAnrkQKZ4b5gYCFQAAAMg"]
[Fri Dec 19 18:17:31.183842 2025] [:error] [pid 41451:tid 41455] [client 68.218.8.118:11248] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aUUmOwYXFn-DbZghZBGlHAAAAAE"]
[Fri Dec 19 18:17:31.216814 2025] [:error] [pid 20582:tid 20644] [client 68.218.8.118:11239] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aUUmO8pAnrkQKZ4b5gYCFgAAAMI"]
[Fri Dec 19 18:17:31.250504 2025] [:error] [pid 20581:tid 20615] [client 68.218.8.118:11156] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aUUmO_xEv7WXNhnFD1lYCAAAAIA"]
[Fri Dec 19 18:17:31.284919 2025] [:error] [pid 41451:tid 41454] [client 68.218.8.118:11139] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aUUmOwYXFn-DbZghZBGlHQAAAAA"]
[Fri Dec 19 18:17:31.326704 2025] [:error] [pid 41451:tid 41464] [client 68.218.8.118:11158] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aUUmOwYXFn-DbZghZBGlHgAAAAo"]
[Fri Dec 19 18:17:31.357008 2025] [:error] [pid 20675:tid 20703] [client 68.218.8.118:11256] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aUUmO7MyJ3XqeDRsbQlYPAAAAQ8"]
[Fri Dec 19 18:17:31.390440 2025] [:error] [pid 41451:tid 41476] [client 68.218.8.118:11186] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aUUmOwYXFn-DbZghZBGlHwAAABY"]
[Fri Dec 19 18:17:31.421275 2025] [:error] [pid 20581:tid 20632] [client 68.218.8.118:20832] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aUUmO_xEv7WXNhnFD1lYCQAAAJE"]
[Fri Dec 19 18:17:31.454792 2025] [:error] [pid 20580:tid 20598] [client 68.218.8.118:20799] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aUUmO0md1op_YdAdgR1stwAAAEw"]
[Fri Dec 19 18:17:31.491935 2025] [:error] [pid 20582:tid 20649] [client 68.218.8.118:11204] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aUUmO8pAnrkQKZ4b5gYCFwAAAMc"]
[Fri Dec 19 18:17:31.524846 2025] [:error] [pid 20675:tid 20697] [client 68.218.8.118:11166] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aUUmO7MyJ3XqeDRsbQlYPQAAAQk"]
[Fri Dec 19 18:17:31.555148 2025] [:error] [pid 41451:tid 41458] [client 68.218.8.118:11234] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aUUmOwYXFn-DbZghZBGlIQAAAAQ"]
[Fri Dec 19 18:17:31.592034 2025] [:error] [pid 20675:tid 20704] [client 68.218.8.118:20777] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aUUmO7MyJ3XqeDRsbQlYPgAAARA"]
[Fri Dec 19 18:17:31.623452 2025] [:error] [pid 20675:tid 20690] [client 68.218.8.118:20811] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aUUmO7MyJ3XqeDRsbQlYPwAAAQI"]
[Fri Dec 19 18:17:31.654165 2025] [:error] [pid 20675:tid 20702] [client 68.218.8.118:11110] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aUUmO7MyJ3XqeDRsbQlYQAAAAQ4"]
[Fri Dec 19 18:17:31.684707 2025] [:error] [pid 20675:tid 20698] [client 68.218.8.118:11143] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aUUmO7MyJ3XqeDRsbQlYQQAAAQo"]
[Fri Dec 19 18:17:31.716991 2025] [:error] [pid 20580:tid 20597] [client 68.218.8.118:20796] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aUUmO0md1op_YdAdgR1suAAAAEs"]
[Fri Dec 19 18:17:31.749431 2025] [:error] [pid 41451:tid 41468] [client 68.218.8.118:11153] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aUUmOwYXFn-DbZghZBGlIgAAAA4"]
[Fri Dec 19 18:17:31.782748 2025] [:error] [pid 20580:tid 20607] [client 68.218.8.118:11252] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aUUmO0md1op_YdAdgR1suQAAAFU"]
[Fri Dec 19 18:17:31.813605 2025] [:error] [pid 41451:tid 41472] [client 68.218.8.118:11159] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aUUmOwYXFn-DbZghZBGlIwAAABI"]
[Fri Dec 19 18:17:31.846588 2025] [:error] [pid 20580:tid 20596] [client 68.218.8.118:11137] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aUUmO0md1op_YdAdgR1sugAAAEo"]
[Fri Dec 19 18:17:31.877917 2025] [:error] [pid 41451:tid 41474] [client 68.218.8.118:11188] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aUUmOwYXFn-DbZghZBGlJAAAABQ"]
[Fri Dec 19 18:17:31.909993 2025] [:error] [pid 41451:tid 41473] [client 68.218.8.118:20778] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aUUmOwYXFn-DbZghZBGlJQAAABM"]
[Fri Dec 19 18:17:31.942945 2025] [:error] [pid 41451:tid 41463] [client 68.218.8.118:11142] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aUUmOwYXFn-DbZghZBGlJgAAAAk"]
[Fri Dec 19 18:17:31.974068 2025] [:error] [pid 20581:tid 20620] [client 68.218.8.118:11109] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aUUmO_xEv7WXNhnFD1lYCgAAAIU"]
[Fri Dec 19 18:17:32.006922 2025] [:error] [pid 41451:tid 41461] [client 68.218.8.118:20815] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aUUmPAYXFn-DbZghZBGlJwAAAAc"]
[Fri Dec 19 18:17:32.040579 2025] [:error] [pid 41451:tid 41460] [client 68.218.8.118:11075] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aUUmPAYXFn-DbZghZBGlKAAAAAY"]
[Fri Dec 19 18:17:32.082069 2025] [:error] [pid 20581:tid 20634] [client 68.218.8.118:11260] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aUUmPPxEv7WXNhnFD1lYCwAAAJM"]
[Fri Dec 19 18:17:32.113896 2025] [:error] [pid 20581:tid 20619] [client 68.218.8.118:11095] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aUUmPPxEv7WXNhnFD1lYDAAAAIQ"]
[Fri Dec 19 18:17:32.145675 2025] [:error] [pid 20582:tid 20646] [client 68.218.8.118:20751] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aUUmPMpAnrkQKZ4b5gYCGAAAAMQ"]
[Fri Dec 19 18:17:32.182540 2025] [:error] [pid 41451:tid 41465] [client 68.218.8.118:11200] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aUUmPAYXFn-DbZghZBGlKQAAAAs"]
[Fri Dec 19 18:17:32.213983 2025] [:error] [pid 41451:tid 41477] [client 68.218.8.118:11180] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aUUmPAYXFn-DbZghZBGlKgAAABc"]
[Fri Dec 19 18:17:32.246228 2025] [:error] [pid 20581:tid 20630] [client 68.218.8.118:11020] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aUUmPPxEv7WXNhnFD1lYDQAAAI8"]
[Fri Dec 19 18:17:32.276985 2025] [:error] [pid 20581:tid 20629] [client 68.218.8.118:20851] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aUUmPPxEv7WXNhnFD1lYDwAAAI4"]
[Fri Dec 19 18:17:32.309604 2025] [:error] [pid 41451:tid 41469] [client 68.218.8.118:11155] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aUUmPAYXFn-DbZghZBGlKwAAAA8"]
[Fri Dec 19 18:17:32.344235 2025] [:error] [pid 20581:tid 20636] [client 68.218.8.118:11196] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aUUmPPxEv7WXNhnFD1lYEAAAAJU"]
[Fri Dec 19 18:17:32.376233 2025] [:error] [pid 41451:tid 41466] [client 68.218.8.118:11199] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aUUmPAYXFn-DbZghZBGlLAAAAAw"]
[Fri Dec 19 18:17:32.416400 2025] [:error] [pid 20580:tid 20587] [client 68.218.8.118:11222] [client 68.218.8.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aUUmPEmd1op_YdAdgR1suwAAAEE"]
[Fri Dec 19 18:17:32.447903 2025] [:error] [pid 20581:tid 20638] [client 68.218.8.118:11107] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aUUmPPxEv7WXNhnFD1lYEQAAAJc"]
[Fri Dec 19 18:17:32.478377 2025] [:error] [pid 20581:tid 20622] [client 68.218.8.118:20737] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aUUmPPxEv7WXNhnFD1lYEgAAAIc"]
[Fri Dec 19 18:17:32.516937 2025] [:error] [pid 20582:tid 20660] [client 68.218.8.118:11077] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aUUmPMpAnrkQKZ4b5gYCGwAAANI"]
[Fri Dec 19 18:17:32.551227 2025] [:error] [pid 20581:tid 20628] [client 68.218.8.118:11181] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aUUmPPxEv7WXNhnFD1lYFAAAAI0"]
[Fri Dec 19 18:17:32.583673 2025] [:error] [pid 20675:tid 20708] [client 68.218.8.118:11189] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aUUmPLMyJ3XqeDRsbQlYRAAAARQ"]
[Fri Dec 19 18:17:32.616219 2025] [:error] [pid 20581:tid 20625] [client 68.218.8.118:11160] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aUUmPPxEv7WXNhnFD1lYFQAAAIo"]
[Fri Dec 19 18:17:32.648981 2025] [:error] [pid 20581:tid 20631] [client 68.218.8.118:11081] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aUUmPPxEv7WXNhnFD1lYFgAAAJA"]
[Fri Dec 19 18:17:32.682434 2025] [:error] [pid 20581:tid 20616] [client 68.218.8.118:11165] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aUUmPPxEv7WXNhnFD1lYFwAAAIE"]
[Fri Dec 19 18:17:32.713927 2025] [:error] [pid 20582:tid 20665] [client 68.218.8.118:11245] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aUUmPMpAnrkQKZ4b5gYCHQAAANc"]
[Fri Dec 19 18:17:32.756273 2025] [:error] [pid 20581:tid 20637] [client 68.218.8.118:11098] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aUUmPPxEv7WXNhnFD1lYGAAAAJY"]
[Fri Dec 19 18:17:32.786686 2025] [:error] [pid 20581:tid 20633] [client 68.218.8.118:11148] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aUUmPPxEv7WXNhnFD1lYGQAAAJI"]
[Fri Dec 19 18:17:32.816683 2025] [:error] [pid 20581:tid 20627] [client 68.218.8.118:11220] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aUUmPPxEv7WXNhnFD1lYGgAAAIw"]
[Fri Dec 19 18:17:32.853452 2025] [:error] [pid 20581:tid 20623] [client 68.218.8.118:11210] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aUUmPPxEv7WXNhnFD1lYGwAAAIg"]
[Fri Dec 19 18:17:32.888974 2025] [:error] [pid 20582:tid 20654] [client 68.218.8.118:11080] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aUUmPMpAnrkQKZ4b5gYCHwAAAMw"]
[Fri Dec 19 18:17:32.933700 2025] [:error] [pid 41451:tid 41459] [client 68.218.8.118:11185] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aUUmPAYXFn-DbZghZBGlLQAAAAU"]
[Fri Dec 19 18:17:32.985199 2025] [:error] [pid 20581:tid 20624] [client 68.218.8.118:11254] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aUUmPPxEv7WXNhnFD1lYHAAAAIk"]
[Fri Dec 19 18:17:33.029449 2025] [:error] [pid 20581:tid 20618] [client 68.218.8.118:20826] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYHQAAAIM"]
[Fri Dec 19 18:17:33.062122 2025] [:error] [pid 20581:tid 20632] [client 68.218.8.118:11123] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYHgAAAJE"]
[Fri Dec 19 18:17:33.094790 2025] [:error] [pid 20581:tid 20620] [client 68.218.8.118:11010] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYHwAAAIU"]
[Fri Dec 19 18:17:33.127396 2025] [:error] [pid 20581:tid 20634] [client 68.218.8.118:11192] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYIAAAAJM"]
[Fri Dec 19 18:17:33.161639 2025] [:error] [pid 20580:tid 20594] [client 68.218.8.118:11154] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aUUmPUmd1op_YdAdgR1svAAAAEg"]
[Fri Dec 19 18:17:33.199514 2025] [:error] [pid 20581:tid 20619] [client 68.218.8.118:11215] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYIQAAAIQ"]
[Fri Dec 19 18:17:33.231417 2025] [:error] [pid 20581:tid 20630] [client 68.218.8.118:11069] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYIgAAAI8"]
[Fri Dec 19 18:17:33.263046 2025] [:error] [pid 20580:tid 20609] [client 68.218.8.118:20804] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aUUmPUmd1op_YdAdgR1svgAAAFc"]
[Fri Dec 19 18:17:33.294659 2025] [:error] [pid 20582:tid 20655] [client 68.218.8.118:11184] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aUUmPcpAnrkQKZ4b5gYCIAAAAM0"]
[Fri Dec 19 18:17:33.326832 2025] [:error] [pid 20581:tid 20629] [client 68.218.8.118:20783] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYIwAAAI4"]
[Fri Dec 19 18:17:33.361713 2025] [:error] [pid 20581:tid 20636] [client 68.218.8.118:11194] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYJAAAAJU"]
[Fri Dec 19 18:17:33.394747 2025] [:error] [pid 20581:tid 20639] [client 68.218.8.118:11240] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYJQAAAJg"]
[Fri Dec 19 18:17:33.425461 2025] [:error] [pid 20581:tid 20617] [client 68.218.8.118:11103] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYJgAAAII"]
[Fri Dec 19 18:17:33.457244 2025] [:error] [pid 20581:tid 20638] [client 68.218.8.118:20782] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYKQAAAJc"]
[Fri Dec 19 18:17:33.488388 2025] [:error] [pid 20581:tid 20622] [client 68.218.8.118:11089] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYKgAAAIc"]
[Fri Dec 19 18:17:33.525349 2025] [:error] [pid 20581:tid 20628] [client 68.218.8.118:11121] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYKwAAAI0"]
[Fri Dec 19 18:17:33.555807 2025] [:error] [pid 20581:tid 20631] [client 68.218.8.118:11092] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYLAAAAJA"]
[Fri Dec 19 18:17:33.587297 2025] [:error] [pid 20581:tid 20616] [client 68.218.8.118:11238] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYLgAAAIE"]
[Fri Dec 19 18:17:33.617926 2025] [:error] [pid 20581:tid 20637] [client 68.218.8.118:11099] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYLwAAAJY"]
[Fri Dec 19 18:17:33.651866 2025] [:error] [pid 20581:tid 20633] [client 68.218.8.118:11231] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYMAAAAJI"]
[Fri Dec 19 18:17:33.685443 2025] [:error] [pid 20581:tid 20627] [client 68.218.8.118:11131] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYMQAAAIw"]
[Fri Dec 19 18:17:33.715246 2025] [:error] [pid 20581:tid 20623] [client 68.218.8.118:11193] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYMgAAAIg"]
[Fri Dec 19 18:17:33.747456 2025] [:error] [pid 20581:tid 20624] [client 68.218.8.118:11191] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYMwAAAIk"]
[Fri Dec 19 18:17:33.779614 2025] [:error] [pid 20582:tid 20657] [client 68.218.8.118:11090] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aUUmPcpAnrkQKZ4b5gYCIQAAAM8"]
[Fri Dec 19 18:17:33.811445 2025] [:error] [pid 20581:tid 20618] [client 68.218.8.118:11108] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYNAAAAIM"]
[Fri Dec 19 18:17:33.843125 2025] [:error] [pid 20581:tid 20632] [client 68.218.8.118:11093] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYNQAAAJE"]
[Fri Dec 19 18:17:33.883189 2025] [:error] [pid 20581:tid 20620] [client 68.218.8.118:20797] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYNwAAAIU"]
[Fri Dec 19 18:17:33.918532 2025] [:error] [pid 20581:tid 20634] [client 68.218.8.118:11218] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYOAAAAJM"]
[Fri Dec 19 18:17:33.949883 2025] [:error] [pid 20581:tid 20619] [client 68.218.8.118:11025] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYOQAAAIQ"]
[Fri Dec 19 18:17:33.985286 2025] [:error] [pid 20581:tid 20630] [client 68.218.8.118:11118] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aUUmPfxEv7WXNhnFD1lYOgAAAI8"]
[Fri Dec 19 18:17:34.016184 2025] [:error] [pid 20581:tid 20636] [client 68.218.8.118:20833] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aUUmPvxEv7WXNhnFD1lYPAAAAJU"]
[Fri Dec 19 18:17:34.048838 2025] [:error] [pid 20581:tid 20639] [client 68.218.8.118:11169] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aUUmPvxEv7WXNhnFD1lYPQAAAJg"]
[Fri Dec 19 18:17:34.095984 2025] [:error] [pid 20581:tid 20617] [client 68.218.8.118:11257] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aUUmPvxEv7WXNhnFD1lYPgAAAII"]
[Fri Dec 19 18:17:34.127121 2025] [:error] [pid 20581:tid 20638] [client 68.218.8.118:11161] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aUUmPvxEv7WXNhnFD1lYPwAAAJc"]
[Fri Dec 19 18:17:34.157327 2025] [:error] [pid 20581:tid 20628] [client 68.218.8.118:10955] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aUUmPvxEv7WXNhnFD1lYQAAAAI0"]
[Fri Dec 19 18:17:34.190188 2025] [:error] [pid 20581:tid 20635] [client 68.218.8.118:11106] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aUUmPvxEv7WXNhnFD1lYQQAAAJQ"]
[Fri Dec 19 18:17:34.220350 2025] [:error] [pid 20581:tid 20615] [client 68.218.8.118:11251] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aUUmPvxEv7WXNhnFD1lYQgAAAIA"]
[Fri Dec 19 18:17:34.252315 2025] [:error] [pid 20582:tid 20656] [client 68.218.8.118:11051] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aUUmPspAnrkQKZ4b5gYCIgAAAM4"]
[Fri Dec 19 18:17:34.282943 2025] [:error] [pid 20675:tid 20711] [client 68.218.8.118:11026] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aUUmPrMyJ3XqeDRsbQlYRQAAARc"]
[Fri Dec 19 18:17:34.313119 2025] [:error] [pid 20675:tid 20701] [client 68.218.8.118:20848] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about3.php"] [unique_id "aUUmPrMyJ3XqeDRsbQlYRgAAAQ0"]
[Fri Dec 19 18:17:34.346306 2025] [:error] [pid 20675:tid 20692] [client 68.218.8.118:11052] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about3.php"] [unique_id "aUUmPrMyJ3XqeDRsbQlYRwAAAQQ"]
[Fri Dec 19 18:17:34.377422 2025] [:error] [pid 20675:tid 20712] [client 68.218.8.118:11114] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about3.php"] [unique_id "aUUmPrMyJ3XqeDRsbQlYSAAAARg"]
[Fri Dec 19 18:17:34.408013 2025] [:error] [pid 20675:tid 20691] [client 68.218.8.118:11182] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about3.php"] [unique_id "aUUmPrMyJ3XqeDRsbQlYSQAAAQM"]
[Fri Dec 19 18:17:34.444691 2025] [:error] [pid 20675:tid 20696] [client 68.218.8.118:11013] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aUUmPrMyJ3XqeDRsbQlYSgAAAQg"]
[Fri Dec 19 18:17:34.477680 2025] [:error] [pid 41451:tid 41471] [client 68.218.8.118:11045] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aUUmPgYXFn-DbZghZBGlLgAAABE"]
[Fri Dec 19 18:17:34.511361 2025] [:error] [pid 20581:tid 20616] [client 68.218.8.118:11105] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aUUmPvxEv7WXNhnFD1lYQwAAAIE"]
[Fri Dec 19 18:17:34.553428 2025] [:error] [pid 20581:tid 20637] [client 68.218.8.118:11097] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aUUmPvxEv7WXNhnFD1lYRAAAAJY"]
[Fri Dec 19 18:17:34.585805 2025] [:error] [pid 20581:tid 20627] [client 68.218.8.118:20808] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aUUmPvxEv7WXNhnFD1lYRQAAAIw"]
[Fri Dec 19 18:17:34.617573 2025] [:error] [pid 20581:tid 20626] [client 68.218.8.118:11151] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aUUmPvxEv7WXNhnFD1lYRgAAAIs"]
[Fri Dec 19 18:17:34.658063 2025] [:error] [pid 20581:tid 20624] [client 68.218.8.118:11031] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aUUmPvxEv7WXNhnFD1lYRwAAAIk"]
[Fri Dec 19 18:17:34.688088 2025] [:error] [pid 20581:tid 20632] [client 68.218.8.118:11086] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aUUmPvxEv7WXNhnFD1lYSAAAAJE"]
[Fri Dec 19 18:17:34.718679 2025] [:error] [pid 20580:tid 20603] [client 68.218.8.118:11094] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aUUmPkmd1op_YdAdgR1svwAAAFE"]
[Fri Dec 19 18:17:34.750258 2025] [:error] [pid 20675:tid 20710] [client 68.218.8.118:11262] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aUUmPrMyJ3XqeDRsbQlYSwAAARY"]
[Fri Dec 19 18:17:34.783394 2025] [:error] [pid 20675:tid 20688] [client 68.218.8.118:20790] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aUUmPrMyJ3XqeDRsbQlYTAAAAQA"]
[Fri Dec 19 18:17:34.820566 2025] [:error] [pid 20675:tid 20700] [client 68.218.8.118:11197] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aUUmPrMyJ3XqeDRsbQlYTQAAAQw"]
[Fri Dec 19 18:17:34.851010 2025] [:error] [pid 20580:tid 20589] [client 68.218.8.118:11138] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aUUmPkmd1op_YdAdgR1swAAAAEM"]
[Fri Dec 19 18:17:34.881591 2025] [:error] [pid 41451:tid 41470] [client 68.218.8.118:11117] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aUUmPgYXFn-DbZghZBGlLwAAABA"]
[Fri Dec 19 18:17:34.912701 2025] [:error] [pid 20580:tid 20600] [client 68.218.8.118:11036] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aUUmPkmd1op_YdAdgR1swQAAAE4"]
[Fri Dec 19 18:17:34.943114 2025] [:error] [pid 41451:tid 41462] [client 68.218.8.118:20770] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aUUmPgYXFn-DbZghZBGlMAAAAAg"]
[Fri Dec 19 18:17:34.974732 2025] [:error] [pid 20582:tid 20653] [client 68.218.8.118:11149] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aUUmPspAnrkQKZ4b5gYCIwAAAMs"]
[Fri Dec 19 18:17:35.007491 2025] [:error] [pid 20582:tid 20647] [client 68.218.8.118:11073] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aUUmP8pAnrkQKZ4b5gYCJAAAAMU"]
[Fri Dec 19 18:17:35.038630 2025] [:error] [pid 20582:tid 20652] [client 68.218.8.118:11084] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aUUmP8pAnrkQKZ4b5gYCJQAAAMo"]
[Fri Dec 19 18:17:35.069833 2025] [:error] [pid 20580:tid 20605] [client 68.218.8.118:11039] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aUUmP0md1op_YdAdgR1swgAAAFM"]
[Fri Dec 19 18:17:35.100870 2025] [:error] [pid 20582:tid 20642] [client 68.218.8.118:11066] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aUUmP8pAnrkQKZ4b5gYCJgAAAMA"]
[Fri Dec 19 18:17:35.133905 2025] [:error] [pid 20675:tid 20699] [client 68.218.8.118:20813] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aUUmP7MyJ3XqeDRsbQlYTgAAAQs"]
[Fri Dec 19 18:17:35.165001 2025] [:error] [pid 20675:tid 20706] [client 68.218.8.118:11195] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aUUmP7MyJ3XqeDRsbQlYUAAAARI"]
[Fri Dec 19 18:17:35.196925 2025] [:error] [pid 20581:tid 20630] [client 68.218.8.118:10946] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aUUmP_xEv7WXNhnFD1lYTQAAAI8"]
[Fri Dec 19 18:17:35.235488 2025] [:error] [pid 20580:tid 20586] [client 68.218.8.118:20769] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aUUmP0md1op_YdAdgR1swwAAAEA"]
[Fri Dec 19 18:17:35.267811 2025] [:error] [pid 20582:tid 20663] [client 68.218.8.118:11091] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aUUmP8pAnrkQKZ4b5gYCJwAAANU"]
[Fri Dec 19 18:17:35.302525 2025] [:error] [pid 20580:tid 20602] [client 68.218.8.118:11096] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aUUmP0md1op_YdAdgR1sxAAAAFA"]
[Fri Dec 19 18:17:35.341785 2025] [:error] [pid 20580:tid 20593] [client 68.218.8.118:11175] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aUUmP0md1op_YdAdgR1sxQAAAEc"]
[Fri Dec 19 18:17:35.374282 2025] [:error] [pid 20580:tid 20599] [client 68.218.8.118:11172] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aUUmP0md1op_YdAdgR1sxgAAAE0"]
[Fri Dec 19 18:17:35.404748 2025] [:error] [pid 20580:tid 20604] [client 68.218.8.118:11030] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aUUmP0md1op_YdAdgR1sxwAAAFI"]
[Fri Dec 19 18:17:35.444534 2025] [:error] [pid 20582:tid 20650] [client 68.218.8.118:11115] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aUUmP8pAnrkQKZ4b5gYCKAAAAMg"]
[Fri Dec 19 18:17:35.480860 2025] [:error] [pid 20581:tid 20636] [client 68.218.8.118:11104] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aUUmP_xEv7WXNhnFD1lYTwAAAJU"]
[Fri Dec 19 18:17:35.516372 2025] [:error] [pid 20582:tid 20644] [client 68.218.8.118:11174] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aUUmP8pAnrkQKZ4b5gYCKQAAAMI"]
[Fri Dec 19 18:17:35.548039 2025] [:error] [pid 20581:tid 20639] [client 68.218.8.118:11177] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aUUmP_xEv7WXNhnFD1lYUAAAAJg"]
[Fri Dec 19 18:17:35.581188 2025] [:error] [pid 20582:tid 20646] [client 68.218.8.118:11124] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aUUmP8pAnrkQKZ4b5gYCKwAAAMQ"]
[Fri Dec 19 18:17:35.613122 2025] [:error] [pid 20582:tid 20660] [client 68.218.8.118:11259] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aUUmP8pAnrkQKZ4b5gYCLAAAANI"]
[Fri Dec 19 18:17:35.643754 2025] [:error] [pid 20675:tid 20703] [client 68.218.8.118:11050] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "aUUmP7MyJ3XqeDRsbQlYUQAAAQ8"]
[Fri Dec 19 18:17:35.674754 2025] [:error] [pid 20581:tid 20617] [client 68.218.8.118:10964] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "aUUmP_xEv7WXNhnFD1lYUQAAAII"]
[Fri Dec 19 18:17:35.706330 2025] [:error] [pid 20580:tid 20595] [client 68.218.8.118:11147] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "aUUmP0md1op_YdAdgR1syAAAAEk"]
[Fri Dec 19 18:17:35.739427 2025] [:error] [pid 20580:tid 20606] [client 68.218.8.118:11145] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "aUUmP0md1op_YdAdgR1syQAAAFQ"]
[Fri Dec 19 18:17:35.787240 2025] [:error] [pid 20581:tid 20622] [client 68.218.8.118:10887] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aUUmP_xEv7WXNhnFD1lYUgAAAIc"]
[Fri Dec 19 18:17:35.829448 2025] [:error] [pid 20580:tid 20592] [client 68.218.8.118:11074] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aUUmP0md1op_YdAdgR1sygAAAEY"]
[Fri Dec 19 18:17:35.861815 2025] [:error] [pid 20581:tid 20628] [client 68.218.8.118:10983] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aUUmP_xEv7WXNhnFD1lYUwAAAI0"]
[Fri Dec 19 18:17:35.902476 2025] [:error] [pid 20580:tid 20591] [client 68.218.8.118:11125] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aUUmP0md1op_YdAdgR1sywAAAEU"]
[Fri Dec 19 18:17:35.941633 2025] [:error] [pid 20581:tid 20631] [client 68.218.8.118:11173] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aUUmP_xEv7WXNhnFD1lYVAAAAJA"]
[Fri Dec 19 18:17:35.972292 2025] [:error] [pid 20580:tid 20610] [client 68.218.8.118:11152] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aUUmP0md1op_YdAdgR1szAAAAFg"]
[Fri Dec 19 18:17:36.004386 2025] [:error] [pid 20580:tid 20607] [client 68.218.8.118:11246] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aUUmQEmd1op_YdAdgR1szQAAAFU"]
[Fri Dec 19 18:17:36.037395 2025] [:error] [pid 20580:tid 20596] [client 68.218.8.118:11176] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aUUmQEmd1op_YdAdgR1szgAAAEo"]
[Fri Dec 19 18:17:36.075777 2025] [:error] [pid 20580:tid 20587] [client 68.218.8.118:11133] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/index.php"] [unique_id "aUUmQEmd1op_YdAdgR1szwAAAEE"]
[Fri Dec 19 18:17:36.118295 2025] [:error] [pid 20580:tid 20608] [client 68.218.8.118:11150] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/index.php"] [unique_id "aUUmQEmd1op_YdAdgR1s0AAAAFY"]
[Fri Dec 19 18:17:36.151293 2025] [:error] [pid 20581:tid 20635] [client 68.218.8.118:11068] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/index.php"] [unique_id "aUUmQPxEv7WXNhnFD1lYVQAAAJQ"]
[Fri Dec 19 18:17:36.184556 2025] [:error] [pid 20580:tid 20601] [client 68.218.8.118:11132] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/index.php"] [unique_id "aUUmQEmd1op_YdAdgR1s0gAAAE8"]
[Fri Dec 19 18:17:36.227655 2025] [:error] [pid 20581:tid 20615] [client 68.218.8.118:11087] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aUUmQPxEv7WXNhnFD1lYVgAAAIA"]
[Fri Dec 19 18:17:36.259176 2025] [:error] [pid 20580:tid 20594] [client 68.218.8.118:11038] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aUUmQEmd1op_YdAdgR1s0wAAAEg"]
[Fri Dec 19 18:17:36.290525 2025] [:error] [pid 41451:tid 41457] [client 68.218.8.118:11187] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aUUmQAYXFn-DbZghZBGlMQAAAAM"]
[Fri Dec 19 18:17:36.321318 2025] [:error] [pid 41451:tid 41467] [client 68.218.8.118:11119] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aUUmQAYXFn-DbZghZBGlMgAAAA0"]
[Fri Dec 19 18:17:36.352637 2025] [:error] [pid 41451:tid 41456] [client 68.218.8.118:11129] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aUUmQAYXFn-DbZghZBGlMwAAAAI"]
[Fri Dec 19 18:17:36.384108 2025] [:error] [pid 41451:tid 41455] [client 68.218.8.118:11127] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aUUmQAYXFn-DbZghZBGlNAAAAAE"]
[Fri Dec 19 18:17:36.419646 2025] [:error] [pid 41451:tid 41454] [client 68.218.8.118:11046] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aUUmQAYXFn-DbZghZBGlNQAAAAA"]
[Fri Dec 19 18:17:36.456347 2025] [:error] [pid 20581:tid 20616] [client 68.218.8.118:11082] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aUUmQPxEv7WXNhnFD1lYVwAAAIE"]
[Fri Dec 19 18:17:36.512861 2025] [:error] [pid 20582:tid 20645] [client 68.218.8.118:11065] [client 68.218.8.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aUUmQMpAnrkQKZ4b5gYCLQAAAMM"]
[Fri Dec 19 18:17:36.549677 2025] [:error] [pid 20581:tid 20637] [client 68.218.8.118:11060] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aUUmQPxEv7WXNhnFD1lYWAAAAJY"]
[Fri Dec 19 18:17:36.589859 2025] [:error] [pid 41451:tid 41464] [client 68.218.8.118:11116] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aUUmQAYXFn-DbZghZBGlNgAAAAo"]
[Fri Dec 19 18:17:36.620752 2025] [:error] [pid 20581:tid 20627] [client 68.218.8.118:11079] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aUUmQPxEv7WXNhnFD1lYWQAAAIw"]
[Fri Dec 19 18:17:36.651925 2025] [:error] [pid 41451:tid 41476] [client 68.218.8.118:11122] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aUUmQAYXFn-DbZghZBGlNwAAABY"]
[Fri Dec 19 18:17:36.691275 2025] [:error] [pid 41451:tid 41458] [client 68.218.8.118:10966] [client 68.218.8.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aUUmQAYXFn-DbZghZBGlOAAAAAQ"]
[Fri Dec 19 18:17:36.723986 2025] [:error] [pid 41451:tid 41474] [client 68.218.8.118:11042] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aUUmQAYXFn-DbZghZBGlOQAAABQ"]
[Fri Dec 19 18:17:36.756290 2025] [:error] [pid 20582:tid 20665] [client 68.218.8.118:11032] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aUUmQMpAnrkQKZ4b5gYCLwAAANc"]
[Fri Dec 19 18:17:36.803979 2025] [:error] [pid 20580:tid 20605] [client 68.218.8.118:11027] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aUUmQEmd1op_YdAdgR1s1QAAAFM"]
[Fri Dec 19 18:17:36.841742 2025] [:error] [pid 20581:tid 20626] [client 68.218.8.118:10948] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aUUmQPxEv7WXNhnFD1lYWgAAAIs"]
[Fri Dec 19 18:17:36.872706 2025] [:error] [pid 20580:tid 20586] [client 68.218.8.118:11101] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aUUmQEmd1op_YdAdgR1s1gAAAEA"]
[Fri Dec 19 18:17:36.910020 2025] [:error] [pid 20582:tid 20666] [client 68.218.8.118:11072] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aUUmQMpAnrkQKZ4b5gYCMAAAANg"]
[Fri Dec 19 18:17:36.953204 2025] [:error] [pid 20581:tid 20624] [client 68.218.8.118:11022] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aUUmQPxEv7WXNhnFD1lYWwAAAIk"]
[Fri Dec 19 18:17:36.985396 2025] [:error] [pid 20580:tid 20602] [client 68.218.8.118:11043] [client 68.218.8.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aUUmQEmd1op_YdAdgR1s1wAAAFA"]
[Fri Dec 19 18:17:37.025403 2025] [:error] [pid 20581:tid 20632] [client 68.218.8.118:11112] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "aUUmQfxEv7WXNhnFD1lYXAAAAJE"]
[Fri Dec 19 18:17:37.060735 2025] [:error] [pid 20582:tid 20661] [client 68.218.8.118:11083] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "aUUmQcpAnrkQKZ4b5gYCMgAAANM"]
[Fri Dec 19 18:17:37.092580 2025] [:error] [pid 20581:tid 20633] [client 68.218.8.118:10987] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "aUUmQfxEv7WXNhnFD1lYXQAAAJI"]
[Fri Dec 19 18:17:37.146002 2025] [:error] [pid 20580:tid 20604] [client 68.218.8.118:11258] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/autoload_classmap.php"] [unique_id "aUUmQUmd1op_YdAdgR1s2AAAAFI"]
[Fri Dec 19 18:17:37.198832 2025] [:error] [pid 20580:tid 20595] [client 68.218.8.118:11012] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/autoload_classmap.php"] [unique_id "aUUmQUmd1op_YdAdgR1s2QAAAEk"]
[Fri Dec 19 18:17:37.240539 2025] [:error] [pid 20581:tid 20620] [client 68.218.8.118:11048] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/autoload_classmap.php"] [unique_id "aUUmQfxEv7WXNhnFD1lYXgAAAIU"]
[Fri Dec 19 18:17:37.272908 2025] [:error] [pid 20580:tid 20606] [client 68.218.8.118:10982] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/autoload_classmap.php"] [unique_id "aUUmQUmd1op_YdAdgR1s2gAAAFQ"]
[Fri Dec 19 18:17:37.304691 2025] [:error] [pid 20581:tid 20618] [client 68.218.8.118:10963] [client 68.218.8.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aUUmQfxEv7WXNhnFD1lYXwAAAIM"]
[Fri Dec 19 18:17:37.337174 2025] [:error] [pid 20580:tid 20592] [client 68.218.8.118:11016] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww1.php"] [unique_id "aUUmQUmd1op_YdAdgR1s2wAAAEY"]
[Fri Dec 19 18:17:37.368774 2025] [:error] [pid 20581:tid 20630] [client 68.218.8.118:11088] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww1.php"] [unique_id "aUUmQfxEv7WXNhnFD1lYYAAAAI8"]
[Fri Dec 19 18:17:37.399761 2025] [:error] [pid 20581:tid 20629] [client 68.218.8.118:10921] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww1.php"] [unique_id "aUUmQfxEv7WXNhnFD1lYYQAAAI4"]
[Fri Dec 19 18:17:37.430680 2025] [:error] [pid 20581:tid 20625] [client 68.218.8.118:11014] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aUUmQfxEv7WXNhnFD1lYYgAAAIo"]
[Fri Dec 19 18:17:37.460878 2025] [:error] [pid 20582:tid 20657] [client 68.218.8.118:11183] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aUUmQcpAnrkQKZ4b5gYCMwAAAM8"]
[Fri Dec 19 18:17:37.492679 2025] [:error] [pid 20581:tid 20636] [client 68.218.8.118:10981] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aUUmQfxEv7WXNhnFD1lYYwAAAJU"]
[Fri Dec 19 18:17:37.525407 2025] [:error] [pid 20582:tid 20653] [client 68.218.8.118:11070] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aUUmQcpAnrkQKZ4b5gYCNAAAAMs"]
[Fri Dec 19 18:17:37.560765 2025] [:error] [pid 20581:tid 20634] [client 68.218.8.118:11008] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aUUmQfxEv7WXNhnFD1lYZAAAAJM"]
[Fri Dec 19 18:17:37.592015 2025] [:error] [pid 20580:tid 20591] [client 68.218.8.118:10912] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aUUmQUmd1op_YdAdgR1s3AAAAEU"]
[Fri Dec 19 18:17:37.624390 2025] [:error] [pid 20582:tid 20647] [client 68.218.8.118:11018] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aUUmQcpAnrkQKZ4b5gYCNQAAAMU"]
[Fri Dec 19 18:17:37.668879 2025] [:error] [pid 20581:tid 20638] [client 68.218.8.118:10970] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aUUmQfxEv7WXNhnFD1lYZQAAAJc"]
[Fri Dec 19 18:17:37.722497 2025] [:error] [pid 20580:tid 20610] [client 68.218.8.118:11017] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aUUmQUmd1op_YdAdgR1s3QAAAFg"]
[Fri Dec 19 18:17:37.755316 2025] [:error] [pid 20582:tid 20652] [client 68.218.8.118:11021] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aUUmQcpAnrkQKZ4b5gYCNgAAAMo"]
[Fri Dec 19 18:17:37.787720 2025] [:error] [pid 20582:tid 20642] [client 68.218.8.118:11011] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aUUmQcpAnrkQKZ4b5gYCNwAAAMA"]
[Fri Dec 19 18:17:37.837342 2025] [:error] [pid 20580:tid 20607] [client 68.218.8.118:10953] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aUUmQUmd1op_YdAdgR1s3gAAAFU"]
[Fri Dec 19 18:17:37.867539 2025] [:error] [pid 20580:tid 20596] [client 68.218.8.118:10975] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/colors/blue/index.php"] [unique_id "aUUmQUmd1op_YdAdgR1s3wAAAEo"]
[Fri Dec 19 18:17:37.899894 2025] [:error] [pid 20675:tid 20690] [client 68.218.8.118:11002] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/colors/blue/index.php"] [unique_id "aUUmQbMyJ3XqeDRsbQlYUgAAAQI"]
[Fri Dec 19 18:17:37.939493 2025] [:error] [pid 20581:tid 20622] [client 68.218.8.118:10998] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/colors/blue/index.php"] [unique_id "aUUmQfxEv7WXNhnFD1lYZgAAAIc"]
[Fri Dec 19 18:17:37.971990 2025] [:error] [pid 20582:tid 20663] [client 68.218.8.118:11041] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/colors/blue/index.php"] [unique_id "aUUmQcpAnrkQKZ4b5gYCOgAAANU"]
[Fri Dec 19 18:17:38.002955 2025] [:error] [pid 20582:tid 20658] [client 68.218.8.118:10958] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/security.php"] [unique_id "aUUmQspAnrkQKZ4b5gYCOwAAANA"]
[Fri Dec 19 18:17:38.034432 2025] [:error] [pid 20582:tid 20650] [client 68.218.8.118:11056] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/security.php"] [unique_id "aUUmQspAnrkQKZ4b5gYCPAAAAMg"]
[Fri Dec 19 18:17:38.078184 2025] [:error] [pid 20580:tid 20587] [client 68.218.8.118:11028] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/security.php"] [unique_id "aUUmQkmd1op_YdAdgR1s4AAAAEE"]
[Fri Dec 19 18:17:38.115923 2025] [:error] [pid 20582:tid 20644] [client 68.218.8.118:11171] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/security.php"] [unique_id "aUUmQspAnrkQKZ4b5gYCPQAAAMI"]
[Fri Dec 19 18:17:38.158462 2025] [:error] [pid 20580:tid 20608] [client 68.218.8.118:11227] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aUUmQkmd1op_YdAdgR1s4QAAAFY"]
[Fri Dec 19 18:17:38.191000 2025] [:error] [pid 41451:tid 41463] [client 68.218.8.118:11005] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aUUmQgYXFn-DbZghZBGlOgAAAAk"]
[Fri Dec 19 18:17:38.225648 2025] [:error] [pid 41451:tid 41461] [client 68.218.8.118:10980] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aUUmQgYXFn-DbZghZBGlOwAAAAc"]
[Fri Dec 19 18:17:38.257841 2025] [:error] [pid 41451:tid 41460] [client 68.218.8.118:10951] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aUUmQgYXFn-DbZghZBGlPAAAAAY"]
[Fri Dec 19 18:17:38.292419 2025] [:error] [pid 41451:tid 41465] [client 68.218.8.118:10962] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aUUmQgYXFn-DbZghZBGlPQAAAAs"]
[Fri Dec 19 18:17:38.323475 2025] [:error] [pid 41451:tid 41477] [client 68.218.8.118:11134] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aUUmQgYXFn-DbZghZBGlPgAAABc"]
[Fri Dec 19 18:17:38.356010 2025] [:error] [pid 41451:tid 41469] [client 68.218.8.118:11102] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aUUmQgYXFn-DbZghZBGlPwAAAA8"]
[Fri Dec 19 18:17:38.404214 2025] [:error] [pid 20580:tid 20597] [client 68.218.8.118:10820] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aUUmQkmd1op_YdAdgR1s4wAAAEs"]
[Fri Dec 19 18:17:38.450468 2025] [:error] [pid 20675:tid 20702] [client 68.218.8.118:10988] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUUmQrMyJ3XqeDRsbQlYUwAAAQ4"]
[Fri Dec 19 18:17:38.493688 2025] [:error] [pid 20675:tid 20698] [client 68.218.8.118:10990] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUUmQrMyJ3XqeDRsbQlYVQAAAQo"]
[Fri Dec 19 18:17:38.533515 2025] [:error] [pid 20675:tid 20693] [client 68.218.8.118:11035] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUUmQrMyJ3XqeDRsbQlYVgAAAQU"]
[Fri Dec 19 18:17:38.564781 2025] [:error] [pid 20675:tid 20705] [client 68.218.8.118:11130] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/about.php"] [unique_id "aUUmQrMyJ3XqeDRsbQlYVwAAARE"]
[Fri Dec 19 18:17:38.602970 2025] [:error] [pid 20675:tid 20689] [client 68.218.8.118:11033] [client 68.218.8.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aUUmQrMyJ3XqeDRsbQlYWAAAAQE"]
[Fri Dec 19 18:17:38.640982 2025] [:error] [pid 20581:tid 20628] [client 68.218.8.118:11135] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aUUmQvxEv7WXNhnFD1lYZwAAAI0"]
[Fri Dec 19 18:17:38.671798 2025] [:error] [pid 20581:tid 20631] [client 68.218.8.118:11128] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aUUmQvxEv7WXNhnFD1lYaAAAAJA"]
[Fri Dec 19 18:17:38.701626 2025] [:error] [pid 20675:tid 20695] [client 68.218.8.118:10977] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aUUmQrMyJ3XqeDRsbQlYWQAAAQc"]
[Fri Dec 19 18:17:38.734199 2025] [:error] [pid 20581:tid 20615] [client 68.218.8.118:11055] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUUmQvxEv7WXNhnFD1lYaQAAAIA"]
[Fri Dec 19 18:17:38.767468 2025] [:error] [pid 20581:tid 20623] [client 68.218.8.118:10984] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUUmQvxEv7WXNhnFD1lYagAAAIg"]
[Fri Dec 19 18:17:38.800114 2025] [:error] [pid 20580:tid 20609] [client 68.218.8.118:11015] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUUmQkmd1op_YdAdgR1s5QAAAFc"]
[Fri Dec 19 18:17:38.841532 2025] [:error] [pid 20582:tid 20645] [client 68.218.8.118:10979] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUUmQspAnrkQKZ4b5gYCPwAAAMM"]
[Fri Dec 19 18:17:38.889263 2025] [:error] [pid 20582:tid 20665] [client 68.218.8.118:11053] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/admin.php"] [unique_id "aUUmQspAnrkQKZ4b5gYCQAAAANc"]
[Fri Dec 19 18:17:38.928053 2025] [:error] [pid 20580:tid 20603] [client 68.218.8.118:11059] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/admin.php"] [unique_id "aUUmQkmd1op_YdAdgR1s5gAAAFE"]
[Fri Dec 19 18:17:38.962580 2025] [:error] [pid 20582:tid 20659] [client 68.218.8.118:11062] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/admin.php"] [unique_id "aUUmQspAnrkQKZ4b5gYCQQAAANE"]
[Fri Dec 19 18:17:39.002788 2025] [:error] [pid 20582:tid 20648] [client 68.218.8.118:11004] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/admin.php"] [unique_id "aUUmQ8pAnrkQKZ4b5gYCQwAAAMY"]
[Fri Dec 19 18:17:39.041316 2025] [:error] [pid 20580:tid 20588] [client 68.218.8.118:11044] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aUUmQ0md1op_YdAdgR1s5wAAAEI"]
[Fri Dec 19 18:17:39.077937 2025] [:error] [pid 20581:tid 20616] [client 68.218.8.118:10910] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aUUmQ_xEv7WXNhnFD1lYawAAAIE"]
[Fri Dec 19 18:17:39.113500 2025] [:error] [pid 20581:tid 20637] [client 68.218.8.118:11261] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aUUmQ_xEv7WXNhnFD1lYbAAAAJY"]
[Fri Dec 19 18:17:39.146162 2025] [:error] [pid 20580:tid 20600] [client 68.218.8.118:10995] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aUUmQ0md1op_YdAdgR1s6AAAAE4"]
[Fri Dec 19 18:17:39.190014 2025] [:error] [pid 20581:tid 20627] [client 68.218.8.118:11019] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "aUUmQ_xEv7WXNhnFD1lYbQAAAIw"]
[Fri Dec 19 18:17:39.227155 2025] [:error] [pid 20582:tid 20664] [client 68.218.8.118:10949] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "aUUmQ8pAnrkQKZ4b5gYCRAAAANY"]
[Fri Dec 19 18:17:39.259839 2025] [:error] [pid 20582:tid 20654] [client 68.218.8.118:11034] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "aUUmQ8pAnrkQKZ4b5gYCRQAAAMw"]
[Fri Dec 19 18:17:39.303465 2025] [:error] [pid 20580:tid 20605] [client 68.218.8.118:10959] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "aUUmQ0md1op_YdAdgR1s6gAAAFM"]
[Fri Dec 19 18:17:39.339326 2025] [:error] [pid 20580:tid 20602] [client 68.218.8.118:10956] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aUUmQ0md1op_YdAdgR1s7AAAAFA"]
[Fri Dec 19 18:17:39.369912 2025] [:error] [pid 20580:tid 20593] [client 68.218.8.118:10960] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aUUmQ0md1op_YdAdgR1s7QAAAEc"]
[Fri Dec 19 18:17:39.404643 2025] [:error] [pid 20580:tid 20599] [client 68.218.8.118:11111] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aUUmQ0md1op_YdAdgR1s7gAAAE0"]
[Fri Dec 19 18:17:39.435143 2025] [:error] [pid 20580:tid 20604] [client 68.218.8.118:10901] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aUUmQ0md1op_YdAdgR1s7wAAAFI"]
[Fri Dec 19 18:17:39.467884 2025] [:error] [pid 20582:tid 20653] [client 68.218.8.118:11136] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aUUmQ8pAnrkQKZ4b5gYCRgAAAMs"]
[Fri Dec 19 18:17:39.512968 2025] [:error] [pid 20582:tid 20647] [client 68.218.8.118:11049] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aUUmQ8pAnrkQKZ4b5gYCRwAAAMU"]
[Fri Dec 19 18:17:39.542996 2025] [:error] [pid 20582:tid 20652] [client 68.218.8.118:10999] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aUUmQ8pAnrkQKZ4b5gYCSAAAAMo"]
[Fri Dec 19 18:17:39.587993 2025] [:error] [pid 20580:tid 20606] [client 68.218.8.118:10883] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aUUmQ0md1op_YdAdgR1s8AAAAFQ"]
[Fri Dec 19 18:17:39.631920 2025] [:error] [pid 20582:tid 20642] [client 68.218.8.118:10985] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless5.php"] [unique_id "aUUmQ8pAnrkQKZ4b5gYCSgAAAMA"]
[Fri Dec 19 18:17:39.661717 2025] [:error] [pid 20580:tid 20610] [client 68.218.8.118:11067] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless5.php"] [unique_id "aUUmQ0md1op_YdAdgR1s8QAAAFg"]
[Fri Dec 19 18:17:39.697135 2025] [:error] [pid 20580:tid 20607] [client 68.218.8.118:10904] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless5.php"] [unique_id "aUUmQ0md1op_YdAdgR1s8gAAAFU"]
[Fri Dec 19 18:17:39.738431 2025] [:error] [pid 20580:tid 20587] [client 68.218.8.118:10972] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless5.php"] [unique_id "aUUmQ0md1op_YdAdgR1s8wAAAEE"]
[Fri Dec 19 18:17:39.768475 2025] [:error] [pid 20582:tid 20663] [client 68.218.8.118:10971] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aUUmQ8pAnrkQKZ4b5gYCSwAAANU"]
[Fri Dec 19 18:17:39.803163 2025] [:error] [pid 20582:tid 20658] [client 68.218.8.118:10896] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aUUmQ8pAnrkQKZ4b5gYCTAAAANA"]
[Fri Dec 19 18:17:39.835075 2025] [:error] [pid 20582:tid 20650] [client 68.218.8.118:10895] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aUUmQ8pAnrkQKZ4b5gYCTQAAAMg"]
[Fri Dec 19 18:17:39.882942 2025] [:error] [pid 20582:tid 20656] [client 68.218.8.118:11190] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aUUmQ8pAnrkQKZ4b5gYCTgAAAM4"]
[Fri Dec 19 18:17:39.914674 2025] [:error] [pid 20580:tid 20608] [client 68.218.8.118:10906] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aUUmQ0md1op_YdAdgR1s9QAAAFY"]
[Fri Dec 19 18:17:39.946927 2025] [:error] [pid 20580:tid 20594] [client 68.218.8.118:10976] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aUUmQ0md1op_YdAdgR1s9gAAAEg"]
[Fri Dec 19 18:17:39.989445 2025] [:error] [pid 20580:tid 20598] [client 68.218.8.118:10974] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aUUmQ0md1op_YdAdgR1s9wAAAEw"]
[Fri Dec 19 18:17:40.021448 2025] [:error] [pid 20582:tid 20644] [client 68.218.8.118:10965] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aUUmRMpAnrkQKZ4b5gYCTwAAAMI"]
[Fri Dec 19 18:17:40.054909 2025] [:error] [pid 20580:tid 20597] [client 68.218.8.118:10828] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aUUmREmd1op_YdAdgR1s-AAAAEs"]
[Fri Dec 19 18:17:40.088559 2025] [:error] [pid 20580:tid 20603] [client 68.218.8.118:11071] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aUUmREmd1op_YdAdgR1s-QAAAFE"]
[Fri Dec 19 18:17:40.129399 2025] [:error] [pid 41451:tid 41475] [client 68.218.8.118:11063] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aUUmRAYXFn-DbZghZBGlQAAAABU"]
[Fri Dec 19 18:17:40.180819 2025] [:error] [pid 20580:tid 20588] [client 68.218.8.118:10822] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aUUmREmd1op_YdAdgR1s-wAAAEI"]
[Fri Dec 19 18:17:40.216214 2025] [:error] [pid 20580:tid 20596] [client 68.218.8.118:10993] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aUUmREmd1op_YdAdgR1s_AAAAEo"]
[Fri Dec 19 18:17:40.247171 2025] [:error] [pid 20582:tid 20649] [client 68.218.8.118:10891] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aUUmRMpAnrkQKZ4b5gYCUAAAAMc"]
[Fri Dec 19 18:17:40.277848 2025] [:error] [pid 41451:tid 41459] [client 68.218.8.118:10905] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aUUmRAYXFn-DbZghZBGlQQAAAAU"]
[Fri Dec 19 18:17:40.314868 2025] [:error] [pid 20582:tid 20646] [client 68.218.8.118:11120] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aUUmRMpAnrkQKZ4b5gYCUQAAAMQ"]
[Fri Dec 19 18:17:40.345928 2025] [:error] [pid 41451:tid 41478] [client 68.218.8.118:10882] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aUUmRAYXFn-DbZghZBGlQgAAABg"]
[Fri Dec 19 18:17:40.376464 2025] [:error] [pid 20675:tid 20701] [client 68.218.8.118:10885] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aUUmRLMyJ3XqeDRsbQlYWgAAAQ0"]
[Fri Dec 19 18:17:40.406605 2025] [:error] [pid 20582:tid 20651] [client 68.218.8.118:10952] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aUUmRMpAnrkQKZ4b5gYCUgAAAMk"]
[Fri Dec 19 18:17:40.436826 2025] [:error] [pid 20675:tid 20692] [client 68.218.8.118:10816] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aUUmRLMyJ3XqeDRsbQlYWwAAAQQ"]
[Fri Dec 19 18:17:40.467848 2025] [:error] [pid 20582:tid 20645] [client 68.218.8.118:10900] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aUUmRMpAnrkQKZ4b5gYCVAAAAMM"]
[Fri Dec 19 18:17:40.502748 2025] [:error] [pid 20581:tid 20639] [client 68.218.8.118:10902] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aUUmRPxEv7WXNhnFD1lYcAAAAJg"]
[Fri Dec 19 18:17:40.543921 2025] [:error] [pid 20581:tid 20620] [client 68.218.8.118:10950] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aUUmRPxEv7WXNhnFD1lYcQAAAIU"]
[Fri Dec 19 18:17:40.574604 2025] [:error] [pid 20581:tid 20618] [client 68.218.8.118:10853] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aUUmRPxEv7WXNhnFD1lYcgAAAIM"]
[Fri Dec 19 18:17:40.608415 2025] [:error] [pid 20675:tid 20696] [client 68.218.8.118:10968] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aUUmRLMyJ3XqeDRsbQlYXQAAAQg"]
[Fri Dec 19 18:17:40.652223 2025] [:error] [pid 20675:tid 20710] [client 68.218.8.118:11029] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aUUmRLMyJ3XqeDRsbQlYXgAAARY"]
[Fri Dec 19 18:17:40.684963 2025] [:error] [pid 41451:tid 41470] [client 68.218.8.118:11064] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aUUmRAYXFn-DbZghZBGlQwAAABA"]
[Fri Dec 19 18:17:40.717949 2025] [:error] [pid 20675:tid 20688] [client 68.218.8.118:10944] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aUUmRLMyJ3XqeDRsbQlYYAAAAQA"]
[Fri Dec 19 18:17:40.757213 2025] [:error] [pid 20582:tid 20665] [client 68.218.8.118:10835] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aUUmRMpAnrkQKZ4b5gYCVQAAANc"]
[Fri Dec 19 18:17:40.788460 2025] [:error] [pid 20675:tid 20700] [client 68.218.8.118:10932] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aUUmRLMyJ3XqeDRsbQlYYQAAAQw"]
[Fri Dec 19 18:17:40.818963 2025] [:error] [pid 20675:tid 20699] [client 68.218.8.118:10914] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aUUmRLMyJ3XqeDRsbQlYYgAAAQs"]
[Fri Dec 19 18:17:40.849348 2025] [:error] [pid 20675:tid 20706] [client 68.218.8.118:11040] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aUUmRLMyJ3XqeDRsbQlYYwAAARI"]
[Fri Dec 19 18:17:40.879718 2025] [:error] [pid 41451:tid 41462] [client 68.218.8.118:10911] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aUUmRAYXFn-DbZghZBGlRAAAAAg"]
[Fri Dec 19 18:17:40.916991 2025] [:error] [pid 20675:tid 20703] [client 68.218.8.118:10909] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aUUmRLMyJ3XqeDRsbQlYZAAAAQ8"]
[Fri Dec 19 18:17:40.950224 2025] [:error] [pid 20675:tid 20697] [client 68.218.8.118:11057] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aUUmRLMyJ3XqeDRsbQlYZQAAAQk"]
[Fri Dec 19 18:17:40.990500 2025] [:error] [pid 20675:tid 20698] [client 68.218.8.118:10881] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aUUmRLMyJ3XqeDRsbQlYZgAAAQo"]
[Fri Dec 19 18:17:41.020935 2025] [:error] [pid 20675:tid 20693] [client 68.218.8.118:10903] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aUUmRbMyJ3XqeDRsbQlYZwAAAQU"]
[Fri Dec 19 18:17:41.057212 2025] [:error] [pid 20675:tid 20705] [client 68.218.8.118:10761] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aUUmRbMyJ3XqeDRsbQlYaAAAARE"]
[Fri Dec 19 18:17:41.099252 2025] [:error] [pid 20675:tid 20689] [client 68.218.8.118:10849] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aUUmRbMyJ3XqeDRsbQlYaQAAAQE"]
[Fri Dec 19 18:17:41.134403 2025] [:error] [pid 20675:tid 20694] [client 68.218.8.118:10945] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aUUmRbMyJ3XqeDRsbQlYagAAAQY"]
[Fri Dec 19 18:17:41.165773 2025] [:error] [pid 20675:tid 20709] [client 68.218.8.118:11100] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aUUmRbMyJ3XqeDRsbQlYawAAARU"]
[Fri Dec 19 18:17:41.196906 2025] [:error] [pid 20675:tid 20695] [client 68.218.8.118:11113] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aUUmRbMyJ3XqeDRsbQlYbAAAAQc"]
[Fri Dec 19 18:17:41.238836 2025] [:error] [pid 41451:tid 41457] [client 68.218.8.118:20748] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aUUmRQYXFn-DbZghZBGlRgAAAAM"]
[Fri Dec 19 18:17:41.279416 2025] [:error] [pid 20582:tid 20659] [client 68.218.8.118:10922] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aUUmRcpAnrkQKZ4b5gYCVgAAANE"]
[Fri Dec 19 18:17:41.309882 2025] [:error] [pid 41451:tid 41467] [client 68.218.8.118:10992] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aUUmRQYXFn-DbZghZBGlRwAAAA0"]
[Fri Dec 19 18:17:41.349373 2025] [:error] [pid 20675:tid 20707] [client 68.218.8.118:10937] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aUUmRbMyJ3XqeDRsbQlYbQAAARM"]
[Fri Dec 19 18:17:41.385007 2025] [:error] [pid 41451:tid 41456] [client 68.218.8.118:11162] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aUUmRQYXFn-DbZghZBGlSAAAAAI"]
[Fri Dec 19 18:17:41.418509 2025] [:error] [pid 20675:tid 20701] [client 68.218.8.118:10851] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aUUmRbMyJ3XqeDRsbQlYbwAAAQ0"]
[Fri Dec 19 18:17:41.449779 2025] [:error] [pid 20675:tid 20692] [client 68.218.8.118:11198] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUUmRbMyJ3XqeDRsbQlYcAAAAQQ"]
[Fri Dec 19 18:17:41.494692 2025] [:error] [pid 20675:tid 20712] [client 68.218.8.118:10954] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUUmRbMyJ3XqeDRsbQlYcQAAARg"]
[Fri Dec 19 18:17:41.524618 2025] [:error] [pid 20675:tid 20691] [client 68.218.8.118:10986] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUUmRbMyJ3XqeDRsbQlYcgAAAQM"]
[Fri Dec 19 18:17:41.565594 2025] [:error] [pid 20581:tid 20629] [client 68.218.8.118:10918] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aUUmRfxEv7WXNhnFD1lYcwAAAI4"]
[Fri Dec 19 18:17:41.596007 2025] [:error] [pid 20675:tid 20710] [client 68.218.8.118:20860] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aUUmRbMyJ3XqeDRsbQlYcwAAARY"]
[Fri Dec 19 18:17:41.628325 2025] [:error] [pid 41451:tid 41454] [client 68.218.8.118:10825] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aUUmRQYXFn-DbZghZBGlSQAAAAA"]
[Fri Dec 19 18:17:41.660634 2025] [:error] [pid 20675:tid 20704] [client 68.218.8.118:10823] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aUUmRbMyJ3XqeDRsbQlYdAAAARA"]
[Fri Dec 19 18:17:41.693757 2025] [:error] [pid 20580:tid 20605] [client 68.218.8.118:10947] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aUUmRUmd1op_YdAdgR1s_QAAAFM"]
[Fri Dec 19 18:17:41.727682 2025] [:error] [pid 20675:tid 20688] [client 68.218.8.118:11037] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aUUmRbMyJ3XqeDRsbQlYdQAAAQA"]
[Fri Dec 19 18:17:41.786008 2025] [:error] [pid 20675:tid 20700] [client 68.218.8.118:11085] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aUUmRbMyJ3XqeDRsbQlYdgAAAQw"]
[Fri Dec 19 18:17:41.818513 2025] [:error] [pid 20675:tid 20699] [client 68.218.8.118:10880] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aUUmRbMyJ3XqeDRsbQlYdwAAAQs"]
[Fri Dec 19 18:17:41.849234 2025] [:error] [pid 20675:tid 20706] [client 68.218.8.118:10829] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aUUmRbMyJ3XqeDRsbQlYeAAAARI"]
[Fri Dec 19 18:17:41.899281 2025] [:error] [pid 20675:tid 20703] [client 68.218.8.118:10836] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aUUmRbMyJ3XqeDRsbQlYeQAAAQ8"]
[Fri Dec 19 18:17:41.929767 2025] [:error] [pid 20581:tid 20617] [client 68.218.8.118:10926] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aUUmRfxEv7WXNhnFD1lYdAAAAII"]
[Fri Dec 19 18:17:41.959819 2025] [:error] [pid 20675:tid 20697] [client 68.218.8.118:10930] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aUUmRbMyJ3XqeDRsbQlYegAAAQk"]
[Fri Dec 19 18:17:41.990526 2025] [:error] [pid 20580:tid 20602] [client 68.218.8.118:11047] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aUUmRUmd1op_YdAdgR1s_gAAAFA"]
[Fri Dec 19 18:17:42.027162 2025] [:error] [pid 20581:tid 20625] [client 68.218.8.118:11236] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aUUmRvxEv7WXNhnFD1lYdQAAAIo"]
[Fri Dec 19 18:17:42.063931 2025] [:error] [pid 41451:tid 41464] [client 68.218.8.118:10768] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aUUmRgYXFn-DbZghZBGlSgAAAAo"]
[Fri Dec 19 18:17:42.097553 2025] [:error] [pid 20581:tid 20636] [client 68.218.8.118:11003] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aUUmRvxEv7WXNhnFD1lYdgAAAJU"]
[Fri Dec 19 18:17:42.135685 2025] [:error] [pid 20675:tid 20698] [client 68.218.8.118:10961] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aUUmRrMyJ3XqeDRsbQlYfAAAAQo"]
[Fri Dec 19 18:17:42.171671 2025] [:error] [pid 41451:tid 41476] [client 68.218.8.118:10978] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aUUmRgYXFn-DbZghZBGlSwAAABY"]
[Fri Dec 19 18:17:42.213317 2025] [:error] [pid 20582:tid 20664] [client 68.218.8.118:11007] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aUUmRspAnrkQKZ4b5gYCVwAAANY"]
[Fri Dec 19 18:17:42.252921 2025] [:error] [pid 20582:tid 20654] [client 68.218.8.118:10931] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aUUmRspAnrkQKZ4b5gYCWAAAAMw"]
[Fri Dec 19 18:17:42.333751 2025] [:error] [pid 41451:tid 41458] [client 68.218.8.118:10894] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aUUmRgYXFn-DbZghZBGlTAAAAAQ"]
[Fri Dec 19 18:17:42.429628 2025] [:error] [pid 41451:tid 41468] [client 68.218.8.118:10989] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aUUmRgYXFn-DbZghZBGlTQAAAA4"]
[Fri Dec 19 18:17:42.491227 2025] [:error] [pid 41451:tid 41472] [client 68.218.8.118:10915] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aUUmRgYXFn-DbZghZBGlTgAAABI"]
[Fri Dec 19 18:17:42.544248 2025] [:error] [pid 41451:tid 41473] [client 68.218.8.118:10884] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aUUmRgYXFn-DbZghZBGlTwAAABM"]
[Fri Dec 19 18:17:42.628620 2025] [:error] [pid 20675:tid 20694] [client 68.218.8.118:10913] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aUUmRrMyJ3XqeDRsbQlYfgAAAQY"]
[Fri Dec 19 18:17:42.716906 2025] [:error] [pid 20675:tid 20708] [client 68.218.8.118:10886] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aUUmRrMyJ3XqeDRsbQlYfwAAARQ"]
[Fri Dec 19 18:17:42.804312 2025] [:error] [pid 20675:tid 20707] [client 68.218.8.118:10839] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aUUmRrMyJ3XqeDRsbQlYgAAAARM"]
[Fri Dec 19 18:17:42.891229 2025] [:error] [pid 41451:tid 41463] [client 68.218.8.118:10941] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aUUmRgYXFn-DbZghZBGlUAAAAAk"]
[Fri Dec 19 18:17:42.990073 2025] [:error] [pid 20675:tid 20701] [client 68.218.8.118:10804] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aUUmRrMyJ3XqeDRsbQlYggAAAQ0"]
[Fri Dec 19 18:17:43.077935 2025] [:error] [pid 41451:tid 41460] [client 68.218.8.118:10973] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aUUmRwYXFn-DbZghZBGlUgAAAAY"]
[Fri Dec 19 18:17:43.143911 2025] [:error] [pid 41451:tid 41465] [client 68.218.8.118:10852] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aUUmRwYXFn-DbZghZBGlUwAAAAs"]
[Fri Dec 19 18:17:43.221479 2025] [:error] [pid 20675:tid 20691] [client 68.218.8.118:10848] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aUUmR7MyJ3XqeDRsbQlYgwAAAQM"]
[Fri Dec 19 18:17:43.315050 2025] [:error] [pid 41451:tid 41466] [client 68.218.8.118:10796] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aUUmRwYXFn-DbZghZBGlVAAAAAw"]
[Fri Dec 19 18:17:43.424204 2025] [:error] [pid 41451:tid 41478] [client 68.218.8.118:10834] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aUUmRwYXFn-DbZghZBGlVgAAABg"]
[Fri Dec 19 18:17:43.531284 2025] [:error] [pid 41451:tid 41470] [client 68.218.8.118:10893] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aUUmRwYXFn-DbZghZBGlVwAAABA"]
[Fri Dec 19 18:17:43.629019 2025] [:error] [pid 41451:tid 41462] [client 68.218.8.118:11061] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aUUmRwYXFn-DbZghZBGlWAAAAAg"]
[Fri Dec 19 18:17:43.732523 2025] [:error] [pid 20581:tid 20634] [client 68.218.8.118:10929] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aUUmR_xEv7WXNhnFD1lYdwAAAJM"]
[Fri Dec 19 18:17:43.839841 2025] [:error] [pid 41451:tid 41471] [client 68.218.8.118:11054] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aUUmRwYXFn-DbZghZBGlWgAAABE"]
[Fri Dec 19 18:17:43.947588 2025] [:error] [pid 41451:tid 41457] [client 68.218.8.118:10846] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aUUmRwYXFn-DbZghZBGlWwAAAAM"]
[Fri Dec 19 18:17:44.070359 2025] [:error] [pid 20581:tid 20638] [client 68.218.8.118:10878] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aUUmSPxEv7WXNhnFD1lYeAAAAJc"]
[Fri Dec 19 18:17:44.181939 2025] [:error] [pid 20581:tid 20622] [client 68.218.8.118:10821] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aUUmSPxEv7WXNhnFD1lYeQAAAIc"]
[Fri Dec 19 18:17:44.300023 2025] [:error] [pid 20675:tid 20700] [client 68.218.8.118:11000] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/galex.php"] [unique_id "aUUmSLMyJ3XqeDRsbQlYhgAAAQw"]
[Fri Dec 19 18:17:44.399414 2025] [:error] [pid 20675:tid 20699] [client 68.218.8.118:10919] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/galex.php"] [unique_id "aUUmSLMyJ3XqeDRsbQlYiAAAAQs"]
[Fri Dec 19 18:17:44.462973 2025] [:error] [pid 41451:tid 41456] [client 68.218.8.118:10994] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/galex.php"] [unique_id "aUUmSAYXFn-DbZghZBGlXgAAAAI"]
[Fri Dec 19 18:17:44.571163 2025] [:error] [pid 20675:tid 20706] [client 68.218.8.118:10890] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/galex.php"] [unique_id "aUUmSLMyJ3XqeDRsbQlYiQAAARI"]
[Fri Dec 19 18:17:44.691352 2025] [:error] [pid 41451:tid 41454] [client 68.218.8.118:10892] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aUUmSAYXFn-DbZghZBGlXwAAAAA"]
[Fri Dec 19 18:17:44.770938 2025] [:error] [pid 41451:tid 41464] [client 68.218.8.118:10854] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aUUmSAYXFn-DbZghZBGlYAAAAAo"]
[Fri Dec 19 18:17:44.814639 2025] [:error] [pid 41451:tid 41458] [client 68.218.8.118:10817] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aUUmSAYXFn-DbZghZBGlYQAAAAQ"]
[Fri Dec 19 18:17:44.855787 2025] [:error] [pid 41451:tid 41468] [client 68.218.8.118:10856] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aUUmSAYXFn-DbZghZBGlYwAAAA4"]
[Fri Dec 19 18:17:44.944583 2025] [:error] [pid 41451:tid 41472] [client 68.218.8.118:10934] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aUUmSAYXFn-DbZghZBGlZAAAABI"]
[Fri Dec 19 18:17:45.055675 2025] [:error] [pid 41451:tid 41473] [client 68.218.8.118:10943] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aUUmSQYXFn-DbZghZBGlZQAAABM"]
[Fri Dec 19 18:17:45.169654 2025] [:error] [pid 20675:tid 20702] [client 68.218.8.118:10783] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aUUmSbMyJ3XqeDRsbQlYiwAAAQ4"]
[Fri Dec 19 18:17:45.275014 2025] [:error] [pid 20675:tid 20693] [client 68.218.8.118:10847] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aUUmSbMyJ3XqeDRsbQlYjAAAAQU"]
[Fri Dec 19 18:17:45.381082 2025] [:error] [pid 20675:tid 20689] [client 68.218.8.118:10889] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aUUmSbMyJ3XqeDRsbQlYjQAAAQE"]
[Fri Dec 19 18:17:45.496818 2025] [:error] [pid 20675:tid 20694] [client 68.218.8.118:10831] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aUUmSbMyJ3XqeDRsbQlYjgAAAQY"]
[Fri Dec 19 18:17:45.596327 2025] [:error] [pid 41451:tid 41460] [client 68.218.8.118:11009] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aUUmSQYXFn-DbZghZBGlZwAAAAY"]
[Fri Dec 19 18:17:45.718608 2025] [:error] [pid 20675:tid 20695] [client 68.218.8.118:11001] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aUUmSbMyJ3XqeDRsbQlYjwAAAQc"]
[Fri Dec 19 18:17:45.839609 2025] [:error] [pid 41451:tid 41474] [client 68.218.8.118:10928] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aUUmSQYXFn-DbZghZBGlaAAAABQ"]
[Fri Dec 19 18:17:45.894869 2025] [:error] [pid 41451:tid 41465] [client 68.218.8.118:10927] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aUUmSQYXFn-DbZghZBGlaQAAAAs"]
[Fri Dec 19 18:17:45.942371 2025] [:error] [pid 20675:tid 20691] [client 68.218.8.118:10967] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aUUmSbMyJ3XqeDRsbQlYkQAAAQM"]
[Fri Dec 19 18:17:45.998422 2025] [:error] [pid 20675:tid 20692] [client 68.218.8.118:10957] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aUUmSbMyJ3XqeDRsbQlYlAAAAQQ"]
[Fri Dec 19 18:17:46.097816 2025] [:error] [pid 20675:tid 20710] [client 68.218.8.118:10942] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aUUmSrMyJ3XqeDRsbQlYlQAAARY"]
[Fri Dec 19 18:17:46.197939 2025] [:error] [pid 20675:tid 20709] [client 68.218.8.118:10897] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aUUmSrMyJ3XqeDRsbQlYlgAAARU"]
[Fri Dec 19 18:17:46.236607 2025] [:error] [pid 20582:tid 20653] [client 68.218.8.118:10908] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aUUmSspAnrkQKZ4b5gYCWQAAAMs"]
[Fri Dec 19 18:17:46.267284 2025] [:error] [pid 41451:tid 41475] [client 68.218.8.118:11023] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aUUmSgYXFn-DbZghZBGlagAAABU"]
[Fri Dec 19 18:17:46.308962 2025] [:error] [pid 20581:tid 20628] [client 68.218.8.118:10996] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aUUmSvxEv7WXNhnFD1lYegAAAI0"]
[Fri Dec 19 18:17:46.347002 2025] [:error] [pid 20581:tid 20631] [client 68.218.8.118:10844] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aUUmSvxEv7WXNhnFD1lYewAAAJA"]
[Fri Dec 19 18:17:46.378125 2025] [:error] [pid 20581:tid 20623] [client 68.218.8.118:11006] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aUUmSvxEv7WXNhnFD1lYfAAAAIg"]
[Fri Dec 19 18:17:46.416165 2025] [:error] [pid 20581:tid 20616] [client 68.218.8.118:10920] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aUUmSvxEv7WXNhnFD1lYfQAAAIE"]
[Fri Dec 19 18:17:46.448270 2025] [:error] [pid 20581:tid 20637] [client 68.218.8.118:10938] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xse25.php"] [unique_id "aUUmSvxEv7WXNhnFD1lYfgAAAJY"]
[Fri Dec 19 18:17:46.480841 2025] [:error] [pid 20581:tid 20627] [client 68.218.8.118:10857] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xse25.php"] [unique_id "aUUmSvxEv7WXNhnFD1lYfwAAAIw"]
[Fri Dec 19 18:17:46.512448 2025] [:error] [pid 41451:tid 41470] [client 68.218.8.118:10868] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xse25.php"] [unique_id "aUUmSgYXFn-DbZghZBGlawAAABA"]
[Fri Dec 19 18:17:46.543651 2025] [:error] [pid 41451:tid 41461] [client 68.218.8.118:20811] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xse25.php"] [unique_id "aUUmSgYXFn-DbZghZBGlbAAAAAc"]
[Fri Dec 19 18:17:46.573729 2025] [:error] [pid 20580:tid 20604] [client 68.218.8.118:10791] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/index.php"] [unique_id "aUUmSkmd1op_YdAdgR1tAQAAAFI"]
[Fri Dec 19 18:17:46.606258 2025] [:error] [pid 41451:tid 41457] [client 68.218.8.118:10841] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/index.php"] [unique_id "aUUmSgYXFn-DbZghZBGlbQAAAAM"]
[Fri Dec 19 18:17:46.642625 2025] [:error] [pid 41451:tid 41477] [client 68.218.8.118:10766] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/index.php"] [unique_id "aUUmSgYXFn-DbZghZBGlbgAAABc"]
[Fri Dec 19 18:17:46.672746 2025] [:error] [pid 20580:tid 20592] [client 68.218.8.118:10819] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/index.php"] [unique_id "aUUmSkmd1op_YdAdgR1tAgAAAEY"]
[Fri Dec 19 18:17:46.705665 2025] [:error] [pid 41451:tid 41456] [client 68.218.8.118:10858] [client 68.218.8.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aUUmSgYXFn-DbZghZBGlbwAAAAI"]
[Fri Dec 19 18:17:46.755849 2025] [:error] [pid 41451:tid 41464] [client 68.218.8.118:10863] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-signin.php"] [unique_id "aUUmSgYXFn-DbZghZBGlcAAAAAo"]
[Fri Dec 19 18:17:46.785817 2025] [:error] [pid 20580:tid 20591] [client 68.218.8.118:10870] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-signin.php"] [unique_id "aUUmSkmd1op_YdAdgR1tAwAAAEU"]
[Fri Dec 19 18:17:46.815889 2025] [:error] [pid 20580:tid 20610] [client 68.218.8.118:10879] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-signin.php"] [unique_id "aUUmSkmd1op_YdAdgR1tBAAAAFg"]
[Fri Dec 19 18:17:46.848173 2025] [:error] [pid 20580:tid 20587] [client 68.218.8.118:10925] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shoyo.php"] [unique_id "aUUmSkmd1op_YdAdgR1tBQAAAEE"]
[Fri Dec 19 18:17:46.881732 2025] [:error] [pid 41451:tid 41458] [client 68.218.8.118:10837] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shoyo.php"] [unique_id "aUUmSgYXFn-DbZghZBGlcQAAAAQ"]
[Fri Dec 19 18:17:46.915315 2025] [:error] [pid 20580:tid 20595] [client 68.218.8.118:10936] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shoyo.php"] [unique_id "aUUmSkmd1op_YdAdgR1tBgAAAEk"]
[Fri Dec 19 18:17:46.945436 2025] [:error] [pid 41451:tid 41468] [client 68.218.8.118:10939] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shoyo.php"] [unique_id "aUUmSgYXFn-DbZghZBGlcgAAAA4"]
[Fri Dec 19 18:17:46.992821 2025] [:error] [pid 41451:tid 41472] [client 68.218.8.118:10991] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "aUUmSgYXFn-DbZghZBGlcwAAABI"]
[Fri Dec 19 18:17:47.024184 2025] [:error] [pid 41451:tid 41473] [client 68.218.8.118:10790] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "aUUmSwYXFn-DbZghZBGldAAAABM"]
[Fri Dec 19 18:17:47.056491 2025] [:error] [pid 41451:tid 41476] [client 68.218.8.118:10923] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "aUUmSwYXFn-DbZghZBGldQAAABY"]
[Fri Dec 19 18:17:47.089350 2025] [:error] [pid 20580:tid 20598] [client 68.218.8.118:10759] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "aUUmS0md1op_YdAdgR1tBwAAAEw"]
[Fri Dec 19 18:17:47.121363 2025] [:error] [pid 20580:tid 20597] [client 68.218.8.118:10801] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/waq.php"] [unique_id "aUUmS0md1op_YdAdgR1tCAAAAEs"]
[Fri Dec 19 18:17:47.153962 2025] [:error] [pid 41451:tid 41463] [client 68.218.8.118:10833] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/waq.php"] [unique_id "aUUmSwYXFn-DbZghZBGldgAAAAk"]
[Fri Dec 19 18:17:47.185056 2025] [:error] [pid 20580:tid 20609] [client 68.218.8.118:10869] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/waq.php"] [unique_id "aUUmS0md1op_YdAdgR1tCQAAAFc"]
[Fri Dec 19 18:17:47.215609 2025] [:error] [pid 20580:tid 20601] [client 68.218.8.118:10888] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/waq.php"] [unique_id "aUUmS0md1op_YdAdgR1tCgAAAE8"]
[Fri Dec 19 18:17:47.249563 2025] [:error] [pid 20580:tid 20603] [client 68.218.8.118:10997] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wakak.php"] [unique_id "aUUmS0md1op_YdAdgR1tCwAAAFE"]
[Fri Dec 19 18:17:47.279868 2025] [:error] [pid 20580:tid 20588] [client 68.218.8.118:10782] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wakak.php"] [unique_id "aUUmS0md1op_YdAdgR1tDAAAAEI"]
[Fri Dec 19 18:17:47.310260 2025] [:error] [pid 41451:tid 41460] [client 68.218.8.118:10843] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wakak.php"] [unique_id "aUUmSwYXFn-DbZghZBGleAAAAAY"]
[Fri Dec 19 18:17:47.343734 2025] [:error] [pid 41451:tid 41474] [client 68.218.8.118:10935] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wakak.php"] [unique_id "aUUmSwYXFn-DbZghZBGleQAAABQ"]
[Fri Dec 19 18:17:47.382081 2025] [:error] [pid 20581:tid 20626] [client 68.218.8.118:10830] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aUUmS_xEv7WXNhnFD1lYgQAAAIs"]
[Fri Dec 19 18:17:47.431603 2025] [:error] [pid 20581:tid 20624] [client 68.218.8.118:10872] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aUUmS_xEv7WXNhnFD1lYggAAAIk"]
[Fri Dec 19 18:17:47.481987 2025] [:error] [pid 20580:tid 20589] [client 68.218.8.118:10940] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aUUmS0md1op_YdAdgR1tDQAAAEM"]
[Fri Dec 19 18:17:47.539658 2025] [:error] [pid 41451:tid 41465] [client 68.218.8.118:10874] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aUUmSwYXFn-DbZghZBGlegAAAAs"]
[Fri Dec 19 18:17:47.577344 2025] [:error] [pid 20581:tid 20635] [client 68.218.8.118:10924] [client 68.218.8.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aUUmS_xEv7WXNhnFD1lYhAAAAJQ"]
[Fri Dec 19 18:17:47.641483 2025] [:error] [pid 20580:tid 20600] [client 68.218.8.118:10916] [client 68.218.8.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/index.php"] [unique_id "aUUmS0md1op_YdAdgR1tDwAAAE4"]
[Fri Dec 19 18:17:47.708220 2025] [:error] [pid 20581:tid 20620] [client 68.218.8.118:10818] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "aUUmS_xEv7WXNhnFD1lYhQAAAIU"]
[Fri Dec 19 18:17:47.778522 2025] [:error] [pid 20581:tid 20618] [client 68.218.8.118:11024] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "aUUmS_xEv7WXNhnFD1lYhgAAAIM"]
[Fri Dec 19 18:17:47.852162 2025] [:error] [pid 41451:tid 41478] [client 68.218.8.118:10756] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "aUUmSwYXFn-DbZghZBGlewAAABg"]
[Fri Dec 19 18:17:47.934516 2025] [:error] [pid 20580:tid 20586] [client 68.218.8.118:10933] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cwclass.php"] [unique_id "aUUmS0md1op_YdAdgR1tEQAAAEA"]
[Fri Dec 19 18:17:48.008264 2025] [:error] [pid 20580:tid 20593] [client 68.218.8.118:10793] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cwclass.php"] [unique_id "aUUmTEmd1op_YdAdgR1tEgAAAEc"]
[Fri Dec 19 18:17:48.080437 2025] [:error] [pid 41451:tid 41459] [client 68.218.8.118:10754] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cwclass.php"] [unique_id "aUUmTAYXFn-DbZghZBGlfAAAAAU"]
[Fri Dec 19 18:17:48.156627 2025] [:error] [pid 20580:tid 20604] [client 68.218.8.118:10827] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cwclass.php"] [unique_id "aUUmTEmd1op_YdAdgR1tEwAAAFI"]
[Fri Dec 19 18:17:48.233721 2025] [:error] [pid 41451:tid 41470] [client 68.218.8.118:10767] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah24.php"] [unique_id "aUUmTAYXFn-DbZghZBGlfQAAABA"]
[Fri Dec 19 18:17:48.316151 2025] [:error] [pid 20580:tid 20587] [client 68.218.8.118:10787] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah24.php"] [unique_id "aUUmTEmd1op_YdAdgR1tFQAAAEE"]
[Fri Dec 19 18:17:48.385981 2025] [:error] [pid 20675:tid 20697] [client 68.218.8.118:10859] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah24.php"] [unique_id "aUUmTLMyJ3XqeDRsbQlYmAAAAQk"]
[Fri Dec 19 18:17:48.435480 2025] [:error] [pid 41451:tid 41462] [client 68.218.8.118:10898] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah24.php"] [unique_id "aUUmTAYXFn-DbZghZBGlfwAAAAg"]
[Fri Dec 19 18:17:48.465201 2025] [:error] [pid 41451:tid 41461] [client 68.218.8.118:10832] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rtx.php"] [unique_id "aUUmTAYXFn-DbZghZBGlgAAAAAc"]
[Fri Dec 19 18:17:48.497377 2025] [:error] [pid 41451:tid 41457] [client 68.218.8.118:20783] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rtx.php"] [unique_id "aUUmTAYXFn-DbZghZBGlgQAAAAM"]
[Fri Dec 19 18:17:48.535503 2025] [:error] [pid 41451:tid 41477] [client 68.218.8.118:10855] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rtx.php"] [unique_id "aUUmTAYXFn-DbZghZBGlggAAABc"]
[Fri Dec 19 18:17:48.566295 2025] [:error] [pid 41451:tid 41456] [client 68.218.8.118:10755] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rtx.php"] [unique_id "aUUmTAYXFn-DbZghZBGlgwAAAAI"]
[Fri Dec 19 18:17:48.617459 2025] [:error] [pid 41451:tid 41464] [client 68.218.8.118:10899] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bipas.php"] [unique_id "aUUmTAYXFn-DbZghZBGlhAAAAAo"]
[Fri Dec 19 18:17:48.655445 2025] [:error] [pid 41451:tid 41468] [client 68.218.8.118:10760] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bipas.php"] [unique_id "aUUmTAYXFn-DbZghZBGlhQAAAA4"]
[Fri Dec 19 18:17:48.699496 2025] [:error] [pid 20581:tid 20619] [client 68.218.8.118:10907] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bipas.php"] [unique_id "aUUmTPxEv7WXNhnFD1lYhwAAAIQ"]
[Fri Dec 19 18:17:48.730422 2025] [:error] [pid 20580:tid 20597] [client 68.218.8.118:10867] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bipas.php"] [unique_id "aUUmTEmd1op_YdAdgR1tFwAAAEs"]
[Fri Dec 19 18:17:48.763862 2025] [:error] [pid 20581:tid 20630] [client 68.218.8.118:10795] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conte.php"] [unique_id "aUUmTPxEv7WXNhnFD1lYiAAAAI8"]
[Fri Dec 19 18:17:48.794598 2025] [:error] [pid 41451:tid 41473] [client 68.218.8.118:10845] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conte.php"] [unique_id "aUUmTAYXFn-DbZghZBGlhwAAABM"]
[Fri Dec 19 18:17:48.828716 2025] [:error] [pid 20580:tid 20601] [client 68.218.8.118:10625] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conte.php"] [unique_id "aUUmTEmd1op_YdAdgR1tGAAAAE8"]
[Fri Dec 19 18:17:48.860197 2025] [:error] [pid 41451:tid 41463] [client 68.218.8.118:10696] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conte.php"] [unique_id "aUUmTAYXFn-DbZghZBGliAAAAAk"]
[Fri Dec 19 18:17:48.893384 2025] [:error] [pid 20580:tid 20603] [client 68.218.8.118:10861] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class3.php"] [unique_id "aUUmTEmd1op_YdAdgR1tGQAAAFE"]
[Fri Dec 19 18:17:48.928083 2025] [:error] [pid 20675:tid 20696] [client 68.218.8.118:10815] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class3.php"] [unique_id "aUUmTLMyJ3XqeDRsbQlYmQAAAQg"]
[Fri Dec 19 18:17:48.960996 2025] [:error] [pid 20675:tid 20698] [client 68.218.8.118:11090] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class3.php"] [unique_id "aUUmTLMyJ3XqeDRsbQlYmgAAAQo"]
[Fri Dec 19 18:17:48.992925 2025] [:error] [pid 20675:tid 20702] [client 68.218.8.118:10638] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class3.php"] [unique_id "aUUmTLMyJ3XqeDRsbQlYmwAAAQ4"]
[Fri Dec 19 18:17:49.049564 2025] [:error] [pid 20582:tid 20647] [client 68.218.8.118:10824] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blurbs18.php"] [unique_id "aUUmTcpAnrkQKZ4b5gYCWgAAAMU"]
[Fri Dec 19 18:17:49.080259 2025] [:error] [pid 20582:tid 20652] [client 68.218.8.118:20797] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blurbs18.php"] [unique_id "aUUmTcpAnrkQKZ4b5gYCWwAAAMo"]
[Fri Dec 19 18:17:49.113022 2025] [:error] [pid 41451:tid 41471] [client 68.218.8.118:10862] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blurbs18.php"] [unique_id "aUUmTQYXFn-DbZghZBGligAAABE"]
[Fri Dec 19 18:17:49.145772 2025] [:error] [pid 20675:tid 20705] [client 68.218.8.118:10826] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blurbs18.php"] [unique_id "aUUmTbMyJ3XqeDRsbQlYnAAAARE"]
[Fri Dec 19 18:17:49.181063 2025] [:error] [pid 20675:tid 20689] [client 68.218.8.118:10860] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/claa.php"] [unique_id "aUUmTbMyJ3XqeDRsbQlYnQAAAQE"]
[Fri Dec 19 18:17:49.212706 2025] [:error] [pid 20581:tid 20629] [client 68.218.8.118:10698] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/claa.php"] [unique_id "aUUmTfxEv7WXNhnFD1lYigAAAI4"]
[Fri Dec 19 18:17:49.248348 2025] [:error] [pid 20582:tid 20666] [client 68.218.8.118:10735] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/claa.php"] [unique_id "aUUmTcpAnrkQKZ4b5gYCXAAAANg"]
[Fri Dec 19 18:17:49.281527 2025] [:error] [pid 20580:tid 20588] [client 68.218.8.118:10752] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/claa.php"] [unique_id "aUUmTUmd1op_YdAdgR1tGgAAAEI"]
[Fri Dec 19 18:17:49.312427 2025] [:error] [pid 20582:tid 20642] [client 68.218.8.118:10699] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/AL.php"] [unique_id "aUUmTcpAnrkQKZ4b5gYCXQAAAMA"]
[Fri Dec 19 18:17:49.345241 2025] [:error] [pid 20582:tid 20663] [client 68.218.8.118:10806] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/AL.php"] [unique_id "aUUmTcpAnrkQKZ4b5gYCXgAAANU"]
[Fri Dec 19 18:17:49.378712 2025] [:error] [pid 20582:tid 20658] [client 68.218.8.118:10777] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/AL.php"] [unique_id "aUUmTcpAnrkQKZ4b5gYCXwAAANA"]
[Fri Dec 19 18:17:49.415870 2025] [:error] [pid 20582:tid 20656] [client 68.218.8.118:10785] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/AL.php"] [unique_id "aUUmTcpAnrkQKZ4b5gYCYAAAAM4"]
[Fri Dec 19 18:17:49.450841 2025] [:error] [pid 20582:tid 20644] [client 68.218.8.118:10865] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/little.php"] [unique_id "aUUmTcpAnrkQKZ4b5gYCYQAAAMI"]
[Fri Dec 19 18:17:49.501371 2025] [:error] [pid 20582:tid 20643] [client 68.218.8.118:10727] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/little.php"] [unique_id "aUUmTcpAnrkQKZ4b5gYCYgAAAME"]
[Fri Dec 19 18:17:49.531912 2025] [:error] [pid 20582:tid 20646] [client 68.218.8.118:10850] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/little.php"] [unique_id "aUUmTcpAnrkQKZ4b5gYCYwAAAMQ"]
[Fri Dec 19 18:17:49.564835 2025] [:error] [pid 41451:tid 41478] [client 68.218.8.118:10758] [client 68.218.8.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/little.php"] [unique_id "aUUmTQYXFn-DbZghZBGljgAAABg"]
[Fri Dec 19 18:58:08.740966 2025] [:error] [pid 20675:tid 20688] [client 13.234.49.2:36780] [client 13.234.49.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.234.49.2, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUUvwLMyJ3XqeDRsbQlwCwAAAQA"]
[Fri Dec 19 19:50:53.477838 2025] [:error] [pid 20582:tid 20664] [client 43.165.135.242:50240] [client 43.165.135.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aUU8HcpAnrkQKZ4b5gYkdQAAANY"]
[Fri Dec 19 20:17:18.928422 2025] [:error] [pid 20581:tid 20636] [client 185.223.152.125:21765] [client 185.223.152.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUVCTvxEv7WXNhnFD1mBJgAAAJU"]
[Fri Dec 19 21:33:30.176978 2025] [:error] [pid 20580:tid 20610] [client 123.187.240.242:33004] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aUVUKkmd1op_YdAdgR2rVQAAAFg"]
[Fri Dec 19 21:54:54.775327 2025] [:error] [pid 20675:tid 20709] [client 4.197.218.162:62256] [client 4.197.218.162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php"] [unique_id "aUVZLrMyJ3XqeDRsbQmufAAAARU"]
[Fri Dec 19 21:54:57.723297 2025] [:error] [pid 18438:tid 18456] [client 4.197.218.162:49759] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/er.php"] [unique_id "aUVZMZRArClWV1iij_Sq8AAAAY8"]
[Fri Dec 19 21:55:05.349444 2025] [:error] [pid 20581:tid 20626] [client 4.197.218.162:64940] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/er.php"] [unique_id "aUVZOfxEv7WXNhnFD1mVsgAAAIs"]
[Fri Dec 19 21:55:09.731865 2025] [:error] [pid 20582:tid 20652] [client 4.197.218.162:64947] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/er.php"] [unique_id "aUVZPcpAnrkQKZ4b5gZL4wAAAMo"]
[Fri Dec 19 21:55:10.423861 2025] [:error] [pid 20580:tid 20607] [client 4.197.218.162:64953] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/er.php"] [unique_id "aUVZPkmd1op_YdAdgR2wTwAAAFU"]
[Fri Dec 19 21:56:14.721511 2025] [:error] [pid 16026:tid 16051] [client 4.197.218.162:41702] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conf.php"] [unique_id "aUVZfkLVfhf4Jb3enmNLkQAAAVY"]
[Fri Dec 19 21:56:22.772641 2025] [:error] [pid 20582:tid 20665] [client 4.197.218.162:46662] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conf.php"] [unique_id "aUVZhspAnrkQKZ4b5gZM1gAAANc"]
[Fri Dec 19 21:56:23.017240 2025] [:error] [pid 16026:tid 16044] [client 4.197.218.162:41694] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conf.php"] [unique_id "aUVZh0LVfhf4Jb3enmNLmQAAAU8"]
[Fri Dec 19 21:56:26.947392 2025] [:error] [pid 20675:tid 20703] [client 4.197.218.162:48766] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conf.php"] [unique_id "aUVZirMyJ3XqeDRsbQmvAwAAAQ8"]
[Fri Dec 19 21:56:28.933808 2025] [:error] [pid 18438:tid 18451] [client 4.197.218.162:35757] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aUVZjJRArClWV1iij_SrwwAAAYo"]
[Fri Dec 19 21:56:30.900637 2025] [:error] [pid 20582:tid 20645] [client 4.197.218.162:44945] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aUVZjspAnrkQKZ4b5gZM5QAAAMM"]
[Fri Dec 19 21:56:32.683761 2025] [:error] [pid 20580:tid 20601] [client 4.197.218.162:48746] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aUVZkEmd1op_YdAdgR2w0QAAAE8"]
[Fri Dec 19 21:56:38.486010 2025] [:error] [pid 18438:tid 18457] [client 4.197.218.162:44998] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aUVZlpRArClWV1iij_SrzAAAAZA"]
[Fri Dec 19 21:56:43.622368 2025] [:error] [pid 20580:tid 20605] [client 4.197.218.162:37373] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/newsletter_signup.php"] [unique_id "aUVZm0md1op_YdAdgR2w3AAAAFM"]
[Fri Dec 19 21:56:48.577640 2025] [:error] [pid 41451:tid 41458] [client 4.197.218.162:48733] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/newsletter_signup.php"] [unique_id "aUVZoAYXFn-DbZghZBHtuAAAAAQ"]
[Fri Dec 19 21:56:49.243846 2025] [:error] [pid 41451:tid 41465] [client 4.197.218.162:45001] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/newsletter_signup.php"] [unique_id "aUVZoQYXFn-DbZghZBHtuQAAAAs"]
[Fri Dec 19 21:57:07.502259 2025] [:error] [pid 20675:tid 20691] [client 4.197.218.162:60874] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index-2.php"] [unique_id "aUVZs7MyJ3XqeDRsbQmvKQAAAQM"]
[Fri Dec 19 21:57:12.306466 2025] [:error] [pid 18438:tid 18463] [client 4.197.218.162:10037] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/card.php"] [unique_id "aUVZuJRArClWV1iij_Sr9wAAAZY"]
[Fri Dec 19 21:57:30.757097 2025] [:error] [pid 20582:tid 20664] [client 4.197.218.162:41659] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer-4.7.0.php"] [unique_id "aUVZyspAnrkQKZ4b5gZNLAAAANY"]
[Fri Dec 19 21:57:31.495731 2025] [:error] [pid 20582:tid 20643] [client 4.197.218.162:37641] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer-4.7.0.php"] [unique_id "aUVZy8pAnrkQKZ4b5gZNLQAAAME"]
[Fri Dec 19 21:57:32.217782 2025] [:error] [pid 41451:tid 41478] [client 4.197.218.162:9368] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer-4.7.0.php"] [unique_id "aUVZzAYXFn-DbZghZBHtzQAAABg"]
[Fri Dec 19 21:57:33.869989 2025] [:error] [pid 20581:tid 20619] [client 4.197.218.162:50477] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer-4.7.0.php"] [unique_id "aUVZzfxEv7WXNhnFD1mWOAAAAIQ"]
[Fri Dec 19 21:57:37.647932 2025] [:error] [pid 16026:tid 16048] [client 4.197.218.162:9631] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/loginfailed.php"] [unique_id "aUVZ0ULVfhf4Jb3enmNLugAAAVM"]
[Fri Dec 19 21:57:40.069965 2025] [:error] [pid 20675:tid 20708] [client 4.197.218.162:39586] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/loginfailed.php"] [unique_id "aUVZ1LMyJ3XqeDRsbQmvPgAAARQ"]
[Fri Dec 19 21:57:44.018129 2025] [:error] [pid 20582:tid 20662] [client 4.197.218.162:50474] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/loginfailed.php"] [unique_id "aUVZ2MpAnrkQKZ4b5gZNOAAAANQ"]
[Fri Dec 19 21:57:53.874219 2025] [:error] [pid 16026:tid 16041] [client 4.197.218.162:9257] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/logins.php"] [unique_id "aUVZ4ULVfhf4Jb3enmNLyAAAAUw"]
[Fri Dec 19 21:57:57.947266 2025] [:error] [pid 18438:tid 18464] [client 4.197.218.162:37851] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/logins.php"] [unique_id "aUVZ5ZRArClWV1iij_SsVgAAAZc"]
[Fri Dec 19 21:57:58.884993 2025] [:error] [pid 20581:tid 20634] [client 4.197.218.162:36976] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/logins.php"] [unique_id "aUVZ5vxEv7WXNhnFD1mWTgAAAJM"]
[Fri Dec 19 21:58:01.796488 2025] [:error] [pid 18438:tid 18463] [client 4.197.218.162:55311] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/logins.php"] [unique_id "aUVZ6ZRArClWV1iij_SsXQAAAZY"]
[Fri Dec 19 21:58:06.371100 2025] [:error] [pid 20581:tid 20628] [client 4.197.218.162:48179] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pac.php"] [unique_id "aUVZ7vxEv7WXNhnFD1mWWAAAAI0"]
[Fri Dec 19 21:58:10.225698 2025] [:error] [pid 41451:tid 41471] [client 4.197.218.162:45584] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pac.php"] [unique_id "aUVZ8gYXFn-DbZghZBHt8AAAABE"]
[Fri Dec 19 21:58:11.164177 2025] [:error] [pid 18438:tid 18443] [client 4.197.218.162:41294] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pac.php"] [unique_id "aUVZ85RArClWV1iij_SscQAAAYI"]
[Fri Dec 19 21:58:13.740838 2025] [:error] [pid 20582:tid 20662] [client 4.197.218.162:40163] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pac.php"] [unique_id "aUVZ9cpAnrkQKZ4b5gZNVQAAANQ"]
[Fri Dec 19 21:58:17.469489 2025] [:error] [pid 20582:tid 20651] [client 4.197.218.162:40151] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer-4.7.1.php"] [unique_id "aUVZ-cpAnrkQKZ4b5gZNYwAAAMk"]
[Fri Dec 19 21:58:18.907568 2025] [:error] [pid 20675:tid 20700] [client 4.197.218.162:9496] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer-4.7.1.php"] [unique_id "aUVZ-rMyJ3XqeDRsbQmvWgAAAQw"]
[Fri Dec 19 21:58:21.437940 2025] [:error] [pid 16026:tid 16044] [client 4.197.218.162:9482] [client 4.197.218.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer-4.7.1.php"] [unique_id "aUVZ_ULVfhf4Jb3enmNMAgAAAU8"]
[Fri Dec 19 22:23:54.311510 2025] [:error] [pid 18438:tid 18446] [client 49.51.33.159:35844] [client 49.51.33.159] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUVf-pRArClWV1iij_S3CAAAAYU"]
[Fri Dec 19 23:39:34.122864 2025] [:error] [pid 16026:tid 16030] [client 185.223.152.179:27319] [client 185.223.152.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUVxtkLVfhf4Jb3enmNxUgAAAUE"]
[Fri Dec 19 23:53:33.961373 2025] [:error] [pid 41451:tid 41475] [client 185.223.152.197:21303] [client 185.223.152.197] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.197, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUV0_QYXFn-DbZghZBEQQwAAABU"]
[Fri Dec 19 23:53:33.964351 2025] [:error] [pid 41451:tid 41475] [client 185.223.152.197:21303] [client 185.223.152.197] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||expressinteriors.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /wp-login.php"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUV0_QYXFn-DbZghZBEQQwAAABU"]
[Sat Dec 20 00:07:43.893506 2025] [:error] [pid 16026:tid 16036] [client 185.223.152.184:44197] [client 185.223.152.184] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.184, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUV4T0LVfhf4Jb3enmN_kQAAAUc"]
[Sat Dec 20 00:21:50.264826 2025] [:error] [pid 35711:tid 35734] [client 185.223.152.182:64405] [client 185.223.152.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.182, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUV7nixTWUmlILwAM_eciAAAABU"]
[Sat Dec 20 00:35:47.017744 2025] [:error] [pid 35625:tid 35657] [client 185.223.152.198:36003] [client 185.223.152.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.198, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUV-4412VmSu4NX34PTNkgAAAII"]
[Sat Dec 20 00:35:47.019558 2025] [:error] [pid 35625:tid 35657] [client 185.223.152.198:36003] [client 185.223.152.198] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||expressinteriors.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /wp-login.php"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUV-4412VmSu4NX34PTNkgAAAII"]
[Sat Dec 20 00:51:05.713678 2025] [:error] [pid 35711:tid 35736] [client 185.223.152.189:62317] [client 185.223.152.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUWCeSxTWUmlILwAM_eowQAAABc"]
[Sat Dec 20 00:51:09.652788 2025] [autoindex:error] [pid 35625:tid 35661] [client 185.249.225.220:49380] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Dec 20 01:05:41.395003 2025] [:error] [pid 35711:tid 35722] [client 185.223.152.196:20697] [client 185.223.152.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.196, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUWF5SxTWUmlILwAM_ev8AAAAAk"]
[Sat Dec 20 01:20:07.297815 2025] [:error] [pid 35711:tid 35737] [client 185.223.152.186:62741] [client 185.223.152.186] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.186, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUWJRyxTWUmlILwAM_e1YgAAABg"]
[Sat Dec 20 01:34:50.998893 2025] [:error] [pid 35711:tid 35719] [client 185.223.152.184:43327] [client 185.223.152.184] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.184, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUWMuixTWUmlILwAM_e5ygAAAAY"]
[Sat Dec 20 01:49:33.824373 2025] [:error] [pid 39268:tid 39320] [client 173.239.218.99:38445] [client 173.239.218.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUWQLeTCMRSRXPuXZF8V6QAAAQo"]
[Sat Dec 20 02:04:25.027125 2025] [:error] [pid 35711:tid 35736] [client 173.239.218.8:43677] [client 173.239.218.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUWTqSxTWUmlILwAM_fAEwAAABc"]
[Sat Dec 20 02:19:15.425973 2025] [:error] [pid 39268:tid 39323] [client 173.239.218.122:37969] [client 173.239.218.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUWXI-TCMRSRXPuXZF8fqAAAAQ0"]
[Sat Dec 20 02:34:06.086856 2025] [:error] [pid 35711:tid 35729] [client 173.239.218.112:52891] [client 173.239.218.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUWanixTWUmlILwAM_fH-gAAABA"]
[Sat Dec 20 02:48:47.000022 2025] [:error] [pid 35626:tid 35683] [client 173.239.218.92:41215] [client 173.239.218.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUWeDhzVxeBEODU8mCCQoQAAAME"]
[Sat Dec 20 03:03:21.926310 2025] [:error] [pid 35626:tid 35706] [client 173.239.218.92:54427] [client 173.239.218.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUWheRzVxeBEODU8mCCT5wAAANg"]
[Sat Dec 20 03:18:09.457921 2025] [:error] [pid 35711:tid 35717] [client 173.239.218.114:35901] [client 173.239.218.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUWk8SxTWUmlILwAM_fVBQAAAAQ"]
[Sat Dec 20 03:32:57.161801 2025] [:error] [pid 19559:tid 19568] [client 173.239.218.119:25695] [client 173.239.218.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.119, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUWoacPL0OToJqSXnPD5uAAAAMc"]
[Sat Dec 20 03:47:48.333444 2025] [:error] [pid 62922:tid 62931] [client 173.239.218.77:44493] [client 173.239.218.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUWr5D0cC9HdiRhhLkAkbAAAAQE"]
[Sat Dec 20 04:02:27.841398 2025] [:error] [pid 60200:tid 60222] [client 173.239.218.93:57253] [client 173.239.218.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUWvUwS8U6punC6XcnKhAgAAANQ"]
[Sat Dec 20 04:03:26.566981 2025] [:error] [pid 60078:tid 60175] [client 192.144.148.122:43704] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUWvjjZPwKHi_tn7pBpHigAAAJc"]
[Sat Dec 20 04:17:24.730306 2025] [:error] [pid 39577:tid 39601] [client 173.239.218.112:48821] [client 173.239.218.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUWy1LviRnt1rJiSOfxeNAAAANY"]
[Sat Dec 20 04:32:13.577009 2025] [:error] [pid 39492:tid 39523] [client 173.239.218.92:59415] [client 173.239.218.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUW2TYs_ZYP1UQNM9hZmvwAAAEE"]
[Sat Dec 20 04:47:04.527530 2025] [:error] [pid 39577:tid 39602] [client 173.239.218.126:63875] [client 173.239.218.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.126, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUW5yLviRnt1rJiSOfxqhQAAANc"]
[Sat Dec 20 05:01:55.595004 2025] [:error] [pid 14286:tid 14290] [client 173.239.218.118:47581] [client 173.239.218.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUW9Q57rbXIrw6rGSdaNFgAAAUA"]
[Sat Dec 20 05:04:39.713145 2025] [autoindex:error] [pid 14247:tid 14249] [client 20.78.176.13:12235] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Sat Dec 20 05:04:43.129126 2025] [autoindex:error] [pid 14247:tid 14267] [client 20.78.176.13:12235] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Sat Dec 20 05:04:50.063752 2025] [autoindex:error] [pid 14247:tid 14267] [client 20.78.176.13:12235] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Sat Dec 20 05:04:50.404024 2025] [autoindex:error] [pid 14247:tid 14257] [client 20.78.176.13:12235] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Sat Dec 20 05:05:00.700265 2025] [:error] [pid 14247:tid 14251] [client 20.78.176.13:12235] [client 20.78.176.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aUW9_CDv9TtKKdJQn9k43gAAAQI"], referer: https://www.yahoo.com/
[Sat Dec 20 05:05:01.187403 2025] [autoindex:error] [pid 14286:tid 14294] [client 20.78.176.13:12256] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Sat Dec 20 05:05:01.349712 2025] [:error] [pid 14286:tid 14313] [client 20.78.176.13:12256] [client 20.78.176.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/index.php"] [unique_id "aUW9_Z7rbXIrw6rGSdaPMAAAAVc"], referer: https://www.yahoo.com/
[Sat Dec 20 05:05:01.838111 2025] [autoindex:error] [pid 39492:tid 39545] [client 20.78.176.13:12231] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Sat Dec 20 05:05:12.347535 2025] [:error] [pid 39577:tid 39598] [client 20.78.176.13:12235] [client 20.78.176.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.78.176.13, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUW-CLviRnt1rJiSOfxxVAAAANM"], referer: https://www.google.com/
[Sat Dec 20 05:05:13.970434 2025] [autoindex:error] [pid 39492:tid 39539] [client 20.78.176.13:12231] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Sat Dec 20 05:05:15.831171 2025] [autoindex:error] [pid 39492:tid 39522] [client 20.78.176.13:12231] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Sat Dec 20 05:05:16.962143 2025] [autoindex:error] [pid 39492:tid 39538] [client 20.78.176.13:12231] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Sat Dec 20 05:05:21.199370 2025] [autoindex:error] [pid 39492:tid 39537] [client 20.78.176.13:12231] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Sat Dec 20 05:05:21.527484 2025] [autoindex:error] [pid 39492:tid 39540] [client 20.78.176.13:12231] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Sat Dec 20 05:05:21.837475 2025] [autoindex:error] [pid 39492:tid 39539] [client 20.78.176.13:12231] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Sat Dec 20 05:05:21.992724 2025] [:error] [pid 39492:tid 39525] [client 20.78.176.13:12231] [client 20.78.176.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aUW-EYs_ZYP1UQNM9hZx8wAAAEM"], referer: https://www.bing.com/
[Sat Dec 20 05:05:22.304391 2025] [:error] [pid 39491:tid 39505] [client 20.78.176.13:12169] [client 20.78.176.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aUW-Eltw2ggYvDxu2ECxDwAAAAo"], referer: https://www.yahoo.com/
[Sat Dec 20 05:05:22.774522 2025] [autoindex:error] [pid 39493:tid 39555] [client 20.78.176.13:12241] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Sat Dec 20 05:05:23.091674 2025] [autoindex:error] [pid 39493:tid 39562] [client 20.78.176.13:12241] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Sat Dec 20 05:05:23.255742 2025] [:error] [pid 39493:tid 39551] [client 20.78.176.13:12241] [client 20.78.176.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/index.php"] [unique_id "aUW-E2hjL2VG_FmIHqD4eQAAAII"], referer: https://www.yahoo.com/
[Sat Dec 20 05:05:23.739915 2025] [autoindex:error] [pid 14286:tid 14295] [client 20.78.176.13:12277] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Sat Dec 20 05:05:24.064910 2025] [autoindex:error] [pid 14286:tid 14308] [client 20.78.176.13:12277] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Sat Dec 20 05:05:24.223817 2025] [:error] [pid 14286:tid 14313] [client 20.78.176.13:12277] [client 20.78.176.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aUW-FJ7rbXIrw6rGSdaPZQAAAVc"], referer: https://www.bing.com/
[Sat Dec 20 05:05:24.538074 2025] [:error] [pid 39491:tid 39501] [client 20.78.176.13:12249] [client 20.78.176.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/index.php"] [unique_id "aUW-FFtw2ggYvDxu2ECxEwAAAAY"], referer: https://www.google.de/
[Sat Dec 20 05:05:24.848116 2025] [:error] [pid 39492:tid 39545] [client 20.78.176.13:12164] [client 20.78.176.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aUW-FIs_ZYP1UQNM9hZyBAAAAFc"], referer: https://duckduckgo.com/
[Sat Dec 20 05:05:25.156427 2025] [:error] [pid 14286:tid 14294] [client 20.78.176.13:12105] [client 20.78.176.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/development/index.php"] [unique_id "aUW-FZ7rbXIrw6rGSdaPZgAAAUQ"], referer: https://www.google.de/
[Sat Dec 20 05:05:25.474433 2025] [:error] [pid 14286:tid 14302] [client 20.78.176.13:12247] [client 20.78.176.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aUW-FZ7rbXIrw6rGSdaPZwAAAUw"], referer: https://www.google.de/
[Sat Dec 20 05:05:25.972963 2025] [autoindex:error] [pid 14286:tid 14296] [client 20.78.176.13:12164] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Sat Dec 20 05:05:26.135015 2025] [:error] [pid 14286:tid 14297] [client 20.78.176.13:12164] [client 20.78.176.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aUW-Fp7rbXIrw6rGSdaPawAAAUc"], referer: https://www.google.co.uk/
[Sat Dec 20 05:05:26.641954 2025] [autoindex:error] [pid 14286:tid 14305] [client 20.78.176.13:12106] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Sat Dec 20 05:16:47.552199 2025] [:error] [pid 18807:tid 18811] [client 173.239.218.101:22697] [client 173.239.218.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.101, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUXAv2RP9n5OCTllYeXUAAAAAYI"]
[Sat Dec 20 05:31:58.305365 2025] [:error] [pid 39492:tid 39527] [client 173.239.218.111:57353] [client 173.239.218.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUXETos_ZYP1UQNM9hZ2oQAAAEU"]
[Sat Dec 20 05:47:04.412683 2025] [:error] [pid 14286:tid 14306] [client 173.239.218.94:41479] [client 173.239.218.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.94, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUXH2J7rbXIrw6rGSdaaHwAAAVA"]
[Sat Dec 20 06:02:05.775735 2025] [:error] [pid 18807:tid 18814] [client 173.239.218.119:27491] [client 173.239.218.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.119, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUXLXWRP9n5OCTllYeXjAwAAAYU"]
[Sat Dec 20 06:17:12.503486 2025] [:error] [pid 39492:tid 39525] [client 173.239.218.91:46913] [client 173.239.218.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.91, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUXO6Is_ZYP1UQNM9haDUgAAAEM"]
[Sat Dec 20 06:31:57.367964 2025] [:error] [pid 39577:tid 39601] [client 173.239.218.115:28771] [client 173.239.218.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.115, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUXSXbviRnt1rJiSOfyDeQAAANY"]
[Sat Dec 20 06:42:44.940742 2025] [:error] [pid 39493:tid 39560] [client 203.171.29.49:39102] [client 203.171.29.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.171.29.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUXU5GhjL2VG_FmIHqAMfwAAAIs"]
[Sat Dec 20 06:46:47.892284 2025] [:error] [pid 39491:tid 39497] [client 173.239.218.101:23803] [client 173.239.218.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.101, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUXV11tw2ggYvDxu2EDECgAAAAI"]
[Sat Dec 20 07:01:55.269174 2025] [:error] [pid 18807:tid 18819] [client 173.239.218.99:45299] [client 173.239.218.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUXZY2RP9n5OCTllYeX1LwAAAYo"]
[Sat Dec 20 07:17:04.910897 2025] [:error] [pid 39493:tid 39569] [client 173.239.218.119:47363] [client 173.239.218.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.119, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUXc8GhjL2VG_FmIHqAXqQAAAJQ"]
[Sat Dec 20 07:33:07.876789 2025] [:error] [pid 39492:tid 39533] [client 173.239.218.86:44991] [client 173.239.218.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUXgs4s_ZYP1UQNM9hakcwAAAEs"]
[Sat Dec 20 07:38:49.084513 2025] [autoindex:error] [pid 39493:tid 39555] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:38:49.441238 2025] [autoindex:error] [pid 39493:tid 39559] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:38:49.776377 2025] [autoindex:error] [pid 39493:tid 39560] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:38:50.083535 2025] [autoindex:error] [pid 39493:tid 39551] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:38:55.825563 2025] [autoindex:error] [pid 39493:tid 39553] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:38:56.113672 2025] [autoindex:error] [pid 39493:tid 39559] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:38:56.410766 2025] [autoindex:error] [pid 39493:tid 39565] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:38:56.705516 2025] [autoindex:error] [pid 39493:tid 39564] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:38:57.020206 2025] [autoindex:error] [pid 39493:tid 39571] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:38:57.336692 2025] [autoindex:error] [pid 39493:tid 39569] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:38:57.977304 2025] [autoindex:error] [pid 39493:tid 39564] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:39:02.060913 2025] [autoindex:error] [pid 39493:tid 39572] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:39:02.583308 2025] [autoindex:error] [pid 39493:tid 39562] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:39:10.189417 2025] [autoindex:error] [pid 39493:tid 39558] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:39:10.485624 2025] [autoindex:error] [pid 39493:tid 39573] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:39:10.820195 2025] [autoindex:error] [pid 39493:tid 39556] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:39:11.121428 2025] [autoindex:error] [pid 39493:tid 39550] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:39:16.157024 2025] [autoindex:error] [pid 39493:tid 39562] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:39:16.443510 2025] [autoindex:error] [pid 39493:tid 39559] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:39:22.552226 2025] [autoindex:error] [pid 39493:tid 39571] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:39:32.851206 2025] [autoindex:error] [pid 39493:tid 39555] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:39:33.144259 2025] [autoindex:error] [pid 39493:tid 39565] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:39:33.451718 2025] [autoindex:error] [pid 39493:tid 39563] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:39:44.875508 2025] [autoindex:error] [pid 39493:tid 39563] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:40:06.817634 2025] [autoindex:error] [pid 39493:tid 39568] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:40:11.000922 2025] [autoindex:error] [pid 39493:tid 39564] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:40:11.319594 2025] [autoindex:error] [pid 39493:tid 39554] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:40:12.370470 2025] [autoindex:error] [pid 39493:tid 39573] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:40:12.753685 2025] [autoindex:error] [pid 39493:tid 39559] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:40:13.086480 2025] [autoindex:error] [pid 39493:tid 39557] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:40:33.649358 2025] [autoindex:error] [pid 39493:tid 39553] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:42:46.687662 2025] [autoindex:error] [pid 39493:tid 39556] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:42:47.026271 2025] [autoindex:error] [pid 39493:tid 39572] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:42:47.352654 2025] [autoindex:error] [pid 39493:tid 39558] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:42:47.657626 2025] [autoindex:error] [pid 39493:tid 39564] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:42:54.425804 2025] [autoindex:error] [pid 39493:tid 39566] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:42:54.736413 2025] [autoindex:error] [pid 39493:tid 39558] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:42:59.678593 2025] [autoindex:error] [pid 39493:tid 39572] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:43:02.331954 2025] [autoindex:error] [pid 39493:tid 39564] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:43:02.663178 2025] [autoindex:error] [pid 39493:tid 39563] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:43:02.989365 2025] [autoindex:error] [pid 39493:tid 39571] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:43:06.792176 2025] [:error] [pid 39493:tid 39570] [client 45.86.202.96:21635] [client 45.86.202.96] ModSecurity: collection_store: Failed to access DBM file "/tmp/ip": Resource deadlock avoided [hostname "expressinteriors.com"] [uri "/index.php"] [unique_id "aUXjB2hjL2VG_FmIHqAy0AAAAJU"]
[Sat Dec 20 07:43:07.128882 2025] [autoindex:error] [pid 39493:tid 39553] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:43:07.450698 2025] [autoindex:error] [pid 39493:tid 39555] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:43:11.741798 2025] [autoindex:error] [pid 39493:tid 39573] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:43:12.051957 2025] [autoindex:error] [pid 39493:tid 39559] [client 45.86.202.96:21635] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:44:56.137375 2025] [autoindex:error] [pid 14286:tid 14294] [client 45.86.202.57:60035] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:45:37.124250 2025] [autoindex:error] [pid 14286:tid 14310] [client 45.86.202.57:60035] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:45:48.660793 2025] [autoindex:error] [pid 14286:tid 14302] [client 45.86.202.57:60035] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:45:48.972275 2025] [autoindex:error] [pid 14286:tid 14301] [client 45.86.202.57:60035] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:45:59.856177 2025] [autoindex:error] [pid 14286:tid 14292] [client 45.86.202.57:60035] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:46:00.152828 2025] [autoindex:error] [pid 14286:tid 14299] [client 45.86.202.57:60035] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:46:00.467759 2025] [autoindex:error] [pid 14286:tid 14290] [client 45.86.202.57:60035] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:46:00.896089 2025] [autoindex:error] [pid 14286:tid 14298] [client 45.86.202.57:60035] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:46:01.212892 2025] [autoindex:error] [pid 14286:tid 14297] [client 45.86.202.57:60035] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:46:01.515450 2025] [autoindex:error] [pid 14286:tid 14292] [client 45.86.202.57:60035] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:46:01.824445 2025] [autoindex:error] [pid 14286:tid 14300] [client 45.86.202.57:60035] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:46:02.123178 2025] [autoindex:error] [pid 14286:tid 14313] [client 45.86.202.57:60035] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:46:02.417115 2025] [autoindex:error] [pid 14286:tid 14312] [client 45.86.202.57:60035] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:46:55.435041 2025] [autoindex:error] [pid 14286:tid 14297] [client 45.86.202.57:60035] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 07:48:47.206882 2025] [:error] [pid 39491:tid 39499] [client 173.239.218.80:58155] [client 173.239.218.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUXkX1tw2ggYvDxu2ED7-AAAAAQ"]
[Sat Dec 20 08:05:00.590439 2025] [:error] [pid 18807:tid 18824] [client 173.239.218.86:55547] [client 173.239.218.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUXoLGRP9n5OCTllYeUzfQAAAY8"]
[Sat Dec 20 08:20:14.935330 2025] [:error] [pid 14286:tid 14293] [client 173.239.218.94:45747] [client 173.239.218.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.94, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUXrvp7rbXIrw6rGSdbq3QAAAUM"]
[Sat Dec 20 08:35:12.026326 2025] [:error] [pid 14286:tid 14304] [client 173.239.218.105:38225] [client 173.239.218.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.105, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUXvQJ7rbXIrw6rGSdbtUgAAAU4"]
[Sat Dec 20 08:50:17.154560 2025] [:error] [pid 39492:tid 39528] [client 173.239.218.115:38875] [client 173.239.218.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.115, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUXyyYs_ZYP1UQNM9hbcKAAAAEY"]
[Sat Dec 20 09:05:31.298780 2025] [:error] [pid 18807:tid 18821] [client 173.239.218.114:50393] [client 173.239.218.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUX2W2RP9n5OCTllYeVGFgAAAYw"]
[Sat Dec 20 09:12:40.697016 2025] [:error] [pid 39577:tid 39593] [client 14.225.206.40:48830] [client 14.225.206.40] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/Wp/v2/users"] [unique_id "aUX4CLviRnt1rJiSOfzOAAAAAM4"]
[Sat Dec 20 09:13:12.191969 2025] [:error] [pid 39577:tid 39591] [client 172.245.79.111:34698] [client 172.245.79.111] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/usErs"] [unique_id "aUX4KLviRnt1rJiSOfzOEAAAAMw"]
[Sat Dec 20 09:14:43.723385 2025] [:error] [pid 39493:tid 39556] [client 121.33.148.213:43454] [client 121.33.148.213] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users.json"] [unique_id "aUX4g2hjL2VG_FmIHqBYCwAAAIc"]
[Sat Dec 20 09:20:42.162604 2025] [:error] [pid 14247:tid 14251] [client 173.239.218.101:60865] [client 173.239.218.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.101, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUX56iDv9TtKKdJQn9mWIwAAAQI"]
[Sat Dec 20 09:35:49.204661 2025] [:error] [pid 39491:tid 39497] [client 173.239.218.77:25495] [client 173.239.218.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUX9dVtw2ggYvDxu2EANCAAAAAI"]
[Sat Dec 20 09:41:08.689454 2025] [:error] [pid 39492:tid 39528] [client 43.165.65.75:56226] [client 43.165.65.75] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUX-tIs_ZYP1UQNM9hbk9AAAAEY"]
[Sat Dec 20 09:50:55.483884 2025] [:error] [pid 14247:tid 14268] [client 173.239.218.87:64881] [client 173.239.218.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.87, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUYA_yDv9TtKKdJQn9mavgAAARM"]
[Sat Dec 20 10:05:54.214434 2025] [:error] [pid 14247:tid 14263] [client 173.239.218.79:59555] [client 173.239.218.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.79, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUYEgiDv9TtKKdJQn9mdHwAAAQ4"]
[Sat Dec 20 10:20:57.136379 2025] [:error] [pid 14247:tid 14272] [client 173.239.218.126:39863] [client 173.239.218.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.126, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUYICSDv9TtKKdJQn9mfvwAAARc"]
[Sat Dec 20 10:36:13.879361 2025] [:error] [pid 39577:tid 39580] [client 173.239.218.114:62455] [client 173.239.218.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUYLnbviRnt1rJiSOfzfJgAAAME"]
[Sat Dec 20 10:51:46.785999 2025] [:error] [pid 39492:tid 39537] [client 173.239.218.92:40955] [client 173.239.218.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUYPQos_ZYP1UQNM9hbwAAAAAE8"]
[Sat Dec 20 11:06:57.270481 2025] [:error] [pid 39492:tid 39534] [client 173.239.218.102:40941] [client 173.239.218.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUYS0Ys_ZYP1UQNM9hbybAAAAEw"]
[Sat Dec 20 11:22:03.272732 2025] [:error] [pid 39493:tid 39567] [client 173.239.218.95:24611] [client 173.239.218.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.95, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUYWW2hjL2VG_FmIHqB1PQAAAJI"]
[Sat Dec 20 11:37:16.277986 2025] [:error] [pid 39491:tid 39515] [client 173.239.218.82:37623] [client 173.239.218.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUYZ7Ftw2ggYvDxu2EAf4gAAABQ"]
[Sat Dec 20 11:52:34.421405 2025] [:error] [pid 39493:tid 39564] [client 173.239.218.78:30203] [client 173.239.218.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUYdgmhjL2VG_FmIHqB8GgAAAI8"]
[Sat Dec 20 12:07:38.758769 2025] [:error] [pid 39491:tid 39495] [client 173.239.218.75:58225] [client 173.239.218.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.75, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUYhCltw2ggYvDxu2EAkjgAAAAA"]
[Sat Dec 20 12:22:42.255711 2025] [:error] [pid 14247:tid 14257] [client 173.239.218.90:49775] [client 173.239.218.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUYkkiDv9TtKKdJQn9m1ZgAAAQg"]
[Sat Dec 20 12:37:45.438540 2025] [:error] [pid 39577:tid 39580] [client 173.239.218.118:25321] [client 173.239.218.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUYoGbviRnt1rJiSOfz3kwAAAME"]
[Sat Dec 20 12:52:54.136292 2025] [:error] [pid 18807:tid 18826] [client 173.239.218.115:28545] [client 173.239.218.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.115, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUYrpmRP9n5OCTllYeWNnQAAAZE"]
[Sat Dec 20 13:07:58.258286 2025] [:error] [pid 39492:tid 39531] [client 173.239.218.115:25607] [client 173.239.218.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.115, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUYvLos_ZYP1UQNM9hYGBgAAAEk"]
[Sat Dec 20 13:23:02.260570 2025] [:error] [pid 39493:tid 39554] [client 173.239.218.111:21823] [client 173.239.218.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUYytmhjL2VG_FmIHqCSRgAAAIU"]
[Sat Dec 20 13:38:12.693860 2025] [:error] [pid 18807:tid 18809] [client 194.5.52.24:45783] [client 194.5.52.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.52.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUY2RGRP9n5OCTllYeWavQAAAYA"]
[Sat Dec 20 13:53:19.373329 2025] [:error] [pid 39493:tid 39554] [client 173.239.218.111:20739] [client 173.239.218.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUY5z2hjL2VG_FmIHqCZiwAAAIU"]
[Sat Dec 20 14:08:38.454995 2025] [:error] [pid 39577:tid 39579] [client 173.239.218.118:56111] [client 173.239.218.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUY9ZrviRnt1rJiSOfwKpwAAAMA"]
[Sat Dec 20 14:23:43.613741 2025] [:error] [pid 18807:tid 18833] [client 173.239.218.98:27881] [client 173.239.218.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.98, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUZA72RP9n5OCTllYeWo0AAAAZg"]
[Sat Dec 20 14:40:09.064468 2025] [:error] [pid 39577:tid 39594] [client 173.239.218.89:20193] [client 173.239.218.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.89, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUZEybviRnt1rJiSOfwQEQAAAM8"]
[Sat Dec 20 14:55:17.064922 2025] [:error] [pid 39492:tid 39542] [client 173.239.218.104:29125] [client 173.239.218.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUZIVYs_ZYP1UQNM9hYWpQAAAFQ"]
[Sat Dec 20 15:10:19.621115 2025] [:error] [pid 39493:tid 39560] [client 173.239.218.103:38037] [client 173.239.218.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.103, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUZL22hjL2VG_FmIHqCpWAAAAIs"]
[Sat Dec 20 15:26:22.535518 2025] [:error] [pid 14247:tid 14272] [client 173.239.218.121:21171] [client 173.239.218.121] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.121, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUZPniDv9TtKKdJQn9nUowAAARc"]
[Sat Dec 20 15:30:17.046327 2025] [:error] [pid 39577:tid 39588] [client 170.106.152.218:47848] [client 170.106.152.218] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aUZQibviRnt1rJiSOfwZfgAAAMk"]
[Sat Dec 20 15:41:41.420340 2025] [:error] [pid 14247:tid 14262] [client 173.239.218.115:49465] [client 173.239.218.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.115, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUZTNSDv9TtKKdJQn9nXlAAAAQ0"]
[Sat Dec 20 15:55:41.670840 2025] [:error] [pid 39491:tid 39497] [client 128.199.182.55:39556] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2/api-docs"] [unique_id "aUZWfVtw2ggYvDxu2EBEVAAAAAI"]
[Sat Dec 20 15:55:42.686094 2025] [:error] [pid 39493:tid 39555] [client 128.199.182.55:39566] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3/api-docs"] [unique_id "aUZWfmhjL2VG_FmIHqCzBQAAAIY"]
[Sat Dec 20 15:55:43.764102 2025] [:error] [pid 14247:tid 14268] [client 128.199.182.55:39574] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api-docs/swagger.json"] [unique_id "aUZWfyDv9TtKKdJQn9nafwAAARM"]
[Sat Dec 20 15:55:44.739882 2025] [:error] [pid 39492:tid 39537] [client 128.199.182.55:39590] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api/swagger.json"] [unique_id "aUZWgIs_ZYP1UQNM9hYfeQAAAE8"]
[Sat Dec 20 15:55:45.748984 2025] [:error] [pid 39492:tid 39525] [client 128.199.182.55:39596] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/@vite/env"] [unique_id "aUZWgYs_ZYP1UQNM9hYffAAAAEM"]
[Sat Dec 20 15:55:46.757030 2025] [:error] [pid 14247:tid 14257] [client 128.199.182.55:39606] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/actuator/env"] [unique_id "aUZWgiDv9TtKKdJQn9nagwAAAQg"]
[Sat Dec 20 15:55:47.740413 2025] [:error] [pid 39577:tid 39581] [client 128.199.182.55:39608] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aUZWg7viRnt1rJiSOfweTwAAAMI"]
[Sat Dec 20 15:55:48.746996 2025] [:error] [pid 14247:tid 14263] [client 128.199.182.55:39614] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server"] [unique_id "aUZWhCDv9TtKKdJQn9nahAAAAQ4"]
[Sat Dec 20 15:55:49.709003 2025] [:error] [pid 14286:tid 14299] [client 128.199.182.55:39618] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aUZWhZ7rbXIrw6rGSdY3TwAAAUk"]
[Sat Dec 20 15:55:51.734329 2025] [:error] [pid 18807:tid 18821] [client 128.199.182.55:45432] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about"] [unique_id "aUZWh2RP9n5OCTllYeXCQAAAAYw"]
[Sat Dec 20 15:55:52.738627 2025] [:error] [pid 39577:tid 39598] [client 128.199.182.55:45436] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/debug/default/view"] [unique_id "aUZWiLviRnt1rJiSOfweVAAAANM"]
[Sat Dec 20 15:55:53.732678 2025] [:error] [pid 18807:tid 18811] [client 128.199.182.55:45448] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2/_catalog"] [unique_id "aUZWiWRP9n5OCTllYeXCQwAAAYI"]
[Sat Dec 20 15:55:54.717386 2025] [:error] [pid 14247:tid 14265] [client 128.199.182.55:45464] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aUZWiiDv9TtKKdJQn9naiQAAARA"]
[Sat Dec 20 15:55:55.705714 2025] [:error] [pid 14247:tid 14273] [client 128.199.182.55:45478] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server-status"] [unique_id "aUZWiyDv9TtKKdJQn9naiwAAARg"]
[Sat Dec 20 15:55:56.754599 2025] [:error] [pid 39492:tid 39543] [client 128.199.182.55:45484] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login.action"] [unique_id "aUZWjIs_ZYP1UQNM9hYfgwAAAFU"]
[Sat Dec 20 15:55:57.694100 2025] [:error] [pid 14247:tid 14253] [client 128.199.182.55:45492] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/_all_dbs"] [unique_id "aUZWjSDv9TtKKdJQn9najQAAAQQ"]
[Sat Dec 20 15:55:58.754565 2025] [:error] [pid 14286:tid 14309] [client 128.199.182.55:45500] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.DS_Store"] [unique_id "aUZWjp7rbXIrw6rGSdY3VAAAAVM"]
[Sat Dec 20 15:55:59.757641 2025] [:error] [pid 14247:tid 14268] [client 128.199.182.55:45508] [client 128.199.182.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aUZWjyDv9TtKKdJQn9najgAAARM"]
[Sat Dec 20 15:56:01.729155 2025] [:error] [pid 39492:tid 39537] [client 128.199.182.55:34558] [client 128.199.182.55] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aUZWkYs_ZYP1UQNM9hYfhgAAAE8"]
[Sat Dec 20 15:56:02.681377 2025] [:error] [pid 39492:tid 39525] [client 128.199.182.55:34564] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aUZWkos_ZYP1UQNM9hYfiQAAAEM"]
[Sat Dec 20 15:56:03.693634 2025] [:error] [pid 39491:tid 39506] [client 128.199.182.55:34566] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aUZWk1tw2ggYvDxu2EBEWwAAAAs"]
[Sat Dec 20 15:56:04.682366 2025] [:error] [pid 39493:tid 39553] [client 128.199.182.55:34582] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/telescope/requests"] [unique_id "aUZWlGhjL2VG_FmIHqCzDgAAAIQ"]
[Sat Dec 20 15:56:05.684866 2025] [:error] [pid 18807:tid 18821] [client 128.199.182.55:34584] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aUZWlWRP9n5OCTllYeXCWQAAAYw"]
[Sat Dec 20 15:56:06.692616 2025] [:error] [pid 14286:tid 14305] [client 128.199.182.55:34598] [client 128.199.182.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUZWlp7rbXIrw6rGSdY3WAAAAU8"]
[Sat Dec 20 15:56:45.692145 2025] [:error] [pid 39491:tid 39519] [client 173.239.218.100:48279] [client 173.239.218.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.100, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUZWvVtw2ggYvDxu2EBEcwAAABg"]
[Sat Dec 20 16:11:53.488626 2025] [:error] [pid 18807:tid 18815] [client 173.239.218.114:31561] [client 173.239.218.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUZaSWRP9n5OCTllYeXGOAAAAYY"]
[Sat Dec 20 16:27:06.654164 2025] [:error] [pid 39491:tid 39499] [client 173.239.218.100:56001] [client 173.239.218.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.100, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUZd2ltw2ggYvDxu2EBJMwAAAAQ"]
[Sat Dec 20 16:42:26.973786 2025] [:error] [pid 39493:tid 39564] [client 173.239.218.81:22693] [client 173.239.218.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUZhcmhjL2VG_FmIHqC87wAAAI8"]
[Sat Dec 20 16:57:35.943142 2025] [:error] [pid 18807:tid 18832] [client 173.239.218.119:40179] [client 173.239.218.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.119, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUZk_2RP9n5OCTllYeXTfAAAAZc"]
[Sat Dec 20 17:12:49.928750 2025] [:error] [pid 39577:tid 39594] [client 173.239.218.78:43087] [client 173.239.218.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUZokbviRnt1rJiSOfwsXgAAAM8"]
[Sat Dec 20 17:28:08.764772 2025] [:error] [pid 14286:tid 14304] [client 173.239.218.83:48363] [client 173.239.218.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUZsKJ7rbXIrw6rGSdZFhAAAAU4"]
[Sat Dec 20 17:43:33.343595 2025] [:error] [pid 18807:tid 18812] [client 173.239.218.111:42767] [client 173.239.218.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUZvxWRP9n5OCTllYeXfoQAAAYM"]
[Sat Dec 20 17:58:50.432387 2025] [:error] [pid 18807:tid 18826] [client 173.239.218.125:63619] [client 173.239.218.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUZzWmRP9n5OCTllYeXkaQAAAZE"]
[Sat Dec 20 18:14:14.724426 2025] [:error] [pid 39577:tid 39603] [client 173.239.218.116:60001] [client 173.239.218.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUZ29rviRnt1rJiSOfw4BAAAANg"]
[Sat Dec 20 18:29:32.075740 2025] [:error] [pid 14286:tid 14298] [client 173.239.218.104:45619] [client 173.239.218.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUZ6jJ7rbXIrw6rGSdZP1wAAAUg"]
[Sat Dec 20 18:45:04.278545 2025] [:error] [pid 18807:tid 18831] [client 194.5.52.25:28309] [client 194.5.52.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.5.52.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUZ-MGRP9n5OCTllYeX1IwAAAZY"]
[Sat Dec 20 19:00:34.217969 2025] [:error] [pid 18807:tid 18816] [client 173.239.218.116:51295] [client 173.239.218.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUaB0mRP9n5OCTllYeX5hAAAAYc"]
[Sat Dec 20 19:15:39.660436 2025] [:error] [pid 14286:tid 14309] [client 173.239.218.81:42819] [client 173.239.218.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUaFW57rbXIrw6rGSdZaiAAAAVM"]
[Sat Dec 20 19:31:02.511602 2025] [:error] [pid 18807:tid 18832] [client 173.239.218.115:34017] [client 173.239.218.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.115, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUaI9mRP9n5OCTllYeX9xAAAAZc"]
[Sat Dec 20 19:46:57.105768 2025] [:error] [pid 39577:tid 39592] [client 173.239.218.80:50577] [client 173.239.218.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUaMsbviRnt1rJiSOfxJ7wAAAM0"]
[Sat Dec 20 20:02:08.717935 2025] [:error] [pid 33570:tid 33585] [client 173.239.218.102:24425] [client 173.239.218.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUaQQITNveA-c6YcSrL80wAAAck"]
[Sat Dec 20 20:17:54.735287 2025] [:error] [pid 33844:tid 33857] [client 173.239.218.96:23093] [client 173.239.218.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUaT8iaNtwGsyqqVmQHltwAAAws"]
[Sat Dec 20 20:33:13.254743 2025] [:error] [pid 39577:tid 39588] [client 173.239.218.117:56821] [client 173.239.218.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.117, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUaXibviRnt1rJiSOfxSBwAAAMk"]
[Sat Dec 20 20:46:15.114039 2025] [:error] [pid 14247:tid 14272] [client 157.245.113.227:49716] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2/api-docs"] [unique_id "aUaalyDv9TtKKdJQn9kJfAAAARc"]
[Sat Dec 20 20:46:16.146178 2025] [:error] [pid 33793:tid 33799] [client 157.245.113.227:49732] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3/api-docs"] [unique_id "aUaamFSicyB0BFmbRMzIVgAAAsQ"]
[Sat Dec 20 20:46:17.135888 2025] [:error] [pid 33793:tid 33805] [client 157.245.113.227:38240] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api-docs/swagger.json"] [unique_id "aUaamVSicyB0BFmbRMzIVwAAAso"]
[Sat Dec 20 20:46:18.132373 2025] [:error] [pid 33687:tid 33691] [client 157.245.113.227:38254] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api/swagger.json"] [unique_id "aUaamjYMR4qK1N4g7vjCYwAAAkE"]
[Sat Dec 20 20:46:19.125036 2025] [:error] [pid 33749:tid 33755] [client 157.245.113.227:38262] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/@vite/env"] [unique_id "aUaam9oInXJnb96wei9HIwAAAoQ"]
[Sat Dec 20 20:46:20.094693 2025] [:error] [pid 39493:tid 39573] [client 157.245.113.227:38266] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/actuator/env"] [unique_id "aUaanGhjL2VG_FmIHqDsxQAAAJg"]
[Sat Dec 20 20:46:21.092087 2025] [:error] [pid 62124:tid 62128] [client 157.245.113.227:38278] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aUaanVs94zPA9ULQOjlv8gAAAAI"]
[Sat Dec 20 20:46:22.094588 2025] [:error] [pid 18807:tid 18813] [client 157.245.113.227:38280] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server"] [unique_id "aUaanmRP9n5OCTllYeUJcgAAAYQ"]
[Sat Dec 20 20:46:23.112470 2025] [:error] [pid 62124:tid 62134] [client 157.245.113.227:38288] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aUaan1s94zPA9ULQOjlv9AAAAAg"]
[Sat Dec 20 20:46:25.175979 2025] [:error] [pid 33844:tid 33865] [client 157.245.113.227:38296] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about"] [unique_id "aUaaoSaNtwGsyqqVmQHqCgAAAxM"]
[Sat Dec 20 20:46:26.146638 2025] [:error] [pid 14286:tid 14295] [client 157.245.113.227:38298] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/debug/default/view"] [unique_id "aUaaop7rbXIrw6rGSdZu2QAAAUU"]
[Sat Dec 20 20:46:27.156133 2025] [:error] [pid 39493:tid 39571] [client 157.245.113.227:33620] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2/_catalog"] [unique_id "aUaao2hjL2VG_FmIHqDsyAAAAJY"]
[Sat Dec 20 20:46:28.141988 2025] [:error] [pid 14286:tid 14294] [client 157.245.113.227:33632] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aUaapJ7rbXIrw6rGSdZu3wAAAUQ"]
[Sat Dec 20 20:46:29.159353 2025] [:error] [pid 39577:tid 39585] [client 157.245.113.227:33640] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server-status"] [unique_id "aUaapbviRnt1rJiSOfxUkwAAAMY"]
[Sat Dec 20 20:46:30.139288 2025] [:error] [pid 33793:tid 33805] [client 157.245.113.227:33652] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login.action"] [unique_id "aUaaplSicyB0BFmbRMzIYgAAAso"]
[Sat Dec 20 20:46:31.134408 2025] [:error] [pid 33749:tid 33760] [client 157.245.113.227:33660] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/_all_dbs"] [unique_id "aUaap9oInXJnb96wei9HMgAAAok"]
[Sat Dec 20 20:46:32.145836 2025] [:error] [pid 33844:tid 33856] [client 157.245.113.227:33666] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.DS_Store"] [unique_id "aUaaqCaNtwGsyqqVmQHqEQAAAwo"]
[Sat Dec 20 20:46:33.140595 2025] [:error] [pid 39577:tid 39593] [client 157.245.113.227:33672] [client 157.245.113.227] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aUaaqbviRnt1rJiSOfxUlgAAAM4"]
[Sat Dec 20 20:46:35.166761 2025] [:error] [pid 18807:tid 18829] [client 157.245.113.227:33688] [client 157.245.113.227] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aUaaq2RP9n5OCTllYeUJiAAAAZQ"]
[Sat Dec 20 20:46:36.146892 2025] [:error] [pid 62124:tid 62148] [client 157.245.113.227:33692] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aUaarFs94zPA9ULQOjlv_AAAABY"]
[Sat Dec 20 20:46:37.135360 2025] [:error] [pid 33793:tid 33802] [client 157.245.113.227:39552] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aUaarVSicyB0BFmbRMzIZQAAAsc"]
[Sat Dec 20 20:46:38.133437 2025] [:error] [pid 33793:tid 33796] [client 157.245.113.227:39564] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/telescope/requests"] [unique_id "aUaarlSicyB0BFmbRMzIZwAAAsE"]
[Sat Dec 20 20:46:39.174730 2025] [:error] [pid 33749:tid 33757] [client 157.245.113.227:39574] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aUaar9oInXJnb96wei9HPQAAAoY"]
[Sat Dec 20 20:46:40.153725 2025] [:error] [pid 18807:tid 18823] [client 157.245.113.227:39584] [client 157.245.113.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUaasGRP9n5OCTllYeUJjwAAAY4"]
[Sat Dec 20 21:51:32.832648 2025] [:error] [pid 14286:tid 14297] [client 85.203.34.24:31991] [client 85.203.34.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aUap5J7rbXIrw6rGSdaacAAAAUc"]
[Sat Dec 20 21:51:38.824915 2025] [:error] [pid 33570:tid 33596] [client 85.203.34.2:63665] [client 85.203.34.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bk/index.php"] [unique_id "aUap6oTNveA-c6YcSrIiWAAAAdQ"]
[Sat Dec 20 21:52:13.122150 2025] [:error] [pid 33687:tid 33698] [client 85.203.34.15:55657] [client 85.203.34.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aUaqDTYMR4qK1N4g7vjkEwAAAkg"]
[Sat Dec 20 21:52:24.156499 2025] [:error] [pid 33749:tid 33767] [client 85.203.34.5:44407] [client 85.203.34.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aUaqGNoInXJnb96wei-HmQAAApA"]
[Sat Dec 20 21:52:24.760482 2025] [:error] [pid 39577:tid 39596] [client 85.203.34.15:38801] [client 85.203.34.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/chosen.php"] [unique_id "aUaqGLviRnt1rJiSOfyAEAAAANE"]
[Sat Dec 20 21:52:25.353841 2025] [:error] [pid 33570:tid 33586] [client 85.203.34.25:48585] [client 85.203.34.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aUaqGYTNveA-c6YcSrIjoAAAAco"]
[Sat Dec 20 21:52:34.327650 2025] [:error] [pid 39577:tid 39585] [client 85.203.34.19:28291] [client 85.203.34.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aUaqIrviRnt1rJiSOfyAbwAAAMY"]
[Sat Dec 20 21:52:41.215942 2025] [:error] [pid 33570:tid 33584] [client 85.203.34.32:22723] [client 85.203.34.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aUaqKYTNveA-c6YcSrIkIwAAAcg"]
[Sat Dec 20 21:52:46.678543 2025] [:error] [pid 33570:tid 33598] [client 85.203.34.43:37751] [client 85.203.34.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/templates/natural.php"] [unique_id "aUaqLoTNveA-c6YcSrIkQQAAAdY"]
[Sat Dec 20 21:53:14.968136 2025] [:error] [pid 33749:tid 33756] [client 85.203.34.34:50367] [client 85.203.34.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aUaqStoInXJnb96wei-KcQAAAoU"]
[Sat Dec 20 21:53:15.616955 2025] [:error] [pid 39493:tid 39561] [client 85.203.34.32:51387] [client 85.203.34.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aUaqS2hjL2VG_FmIHqAT-gAAAIw"]
[Sat Dec 20 21:56:11.962724 2025] [:error] [pid 33687:tid 33708] [client 85.203.34.28:57451] [client 85.203.34.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUaq-zYMR4qK1N4g7vjqLAAAAlI"]
[Sat Dec 20 21:56:31.778657 2025] [:error] [pid 33687:tid 33702] [client 85.203.34.28:57451] [client 85.203.34.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/modules.php"] [unique_id "aUarDzYMR4qK1N4g7vjqnQAAAkw"]
[Sat Dec 20 21:57:26.293441 2025] [:error] [pid 33844:tid 33849] [client 85.203.34.2:24711] [client 85.203.34.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/codeboy1877_up.php"] [unique_id "aUarRiaNtwGsyqqVmQETuwAAAwM"]
[Sat Dec 20 21:59:20.699815 2025] [:error] [pid 14286:tid 14308] [client 85.203.34.30:43307] [client 85.203.34.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/lx.php"] [unique_id "aUaruJ7rbXIrw6rGSdaoUwAAAVI"]
[Sat Dec 20 22:02:22.945998 2025] [:error] [pid 39493:tid 39566] [client 85.203.34.33:63249] [client 85.203.34.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/F0x.php"] [unique_id "aUasbmhjL2VG_FmIHqAdvQAAAJE"]
[Sat Dec 20 22:03:59.242625 2025] [:error] [pid 14286:tid 14309] [client 85.203.34.5:41475] [client 85.203.34.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aUasz57rbXIrw6rGSdarqAAAAVM"]
[Sat Dec 20 22:03:59.902434 2025] [:error] [pid 14286:tid 14292] [client 85.203.34.13:40447] [client 85.203.34.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.203.34.13, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUasz57rbXIrw6rGSdarqgAAAUI"]
[Sat Dec 20 22:04:12.470807 2025] [:error] [pid 14286:tid 14297] [client 85.203.34.13:40447] [client 85.203.34.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aUas3J7rbXIrw6rGSdarxwAAAUc"]
[Sat Dec 20 22:04:44.471411 2025] [:error] [pid 33749:tid 33766] [client 85.203.34.13:30247] [client 85.203.34.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aUas_NoInXJnb96wei-WngAAAo8"]
[Sat Dec 20 22:05:34.599522 2025] [:error] [pid 39493:tid 39570] [client 85.203.34.45:64905] [client 85.203.34.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aUatLmhjL2VG_FmIHqAe9QAAAJU"]
[Sat Dec 20 22:05:35.165395 2025] [:error] [pid 33749:tid 33751] [client 85.203.34.11:51077] [client 85.203.34.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUatL9oInXJnb96wei-W8QAAAoA"]
[Sat Dec 20 22:05:35.717429 2025] [:error] [pid 39577:tid 39597] [client 85.203.34.30:50351] [client 85.203.34.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/about.php"] [unique_id "aUatL7viRnt1rJiSOfyNOwAAANI"]
[Sat Dec 20 22:05:36.321002 2025] [:error] [pid 39493:tid 39549] [client 85.203.34.50:22473] [client 85.203.34.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/about.php"] [unique_id "aUatMGhjL2VG_FmIHqAe-AAAAIA"]
[Sat Dec 20 22:05:45.048600 2025] [:error] [pid 39577:tid 39601] [client 85.203.34.36:21379] [client 85.203.34.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.36, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/wp-login.php"] [unique_id "aUatObviRnt1rJiSOfyNSgAAANY"]
[Sat Dec 20 22:06:31.271443 2025] [:error] [pid 39577:tid 39582] [client 85.203.34.36:21379] [client 85.203.34.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aUatZ7viRnt1rJiSOfyNrwAAAMM"]
[Sat Dec 20 22:06:40.797421 2025] [:error] [pid 33844:tid 33854] [client 85.203.34.12:59579] [client 85.203.34.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aUatcCaNtwGsyqqVmQEW7QAAAwg"]
[Sat Dec 20 22:07:09.276821 2025] [:error] [pid 33844:tid 33865] [client 85.203.34.12:59579] [client 85.203.34.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/makeasmtp.php"] [unique_id "aUatjSaNtwGsyqqVmQEXFwAAAxM"]
[Sat Dec 20 22:07:10.923478 2025] [:error] [pid 14247:tid 14251] [client 85.203.34.28:41587] [client 85.203.34.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/about.php"] [unique_id "aUatjiDv9TtKKdJQn9k0wwAAAQI"]
[Sat Dec 20 22:07:19.117872 2025] [proxy_fcgi:error] [pid 14247:tid 14254] [client 85.203.34.50:60599] AH01071: Got error 'Primary script unknown'
[Sat Dec 20 22:07:41.022829 2025] [proxy_fcgi:error] [pid 14247:tid 14258] [client 85.203.34.50:60599] AH01071: Got error 'Primary script unknown'
[Sat Dec 20 22:08:11.404735 2025] [:error] [pid 14247:tid 14273] [client 85.203.34.50:60599] [client 85.203.34.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aUatyyDv9TtKKdJQn9k1QwAAARg"]
[Sat Dec 20 22:08:28.401442 2025] [:error] [pid 33687:tid 33713] [client 85.203.34.20:47697] [client 85.203.34.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bak.php"] [unique_id "aUat3DYMR4qK1N4g7vjvvwAAAlc"]
[Sat Dec 20 22:08:32.564569 2025] [:error] [pid 39577:tid 39580] [client 85.203.34.2:49531] [client 85.203.34.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aUat4LviRnt1rJiSOfyOlAAAAME"]
[Sat Dec 20 22:08:48.409923 2025] [:error] [pid 62124:tid 62142] [client 85.203.34.28:30137] [client 85.203.34.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aUat8Fs94zPA9ULQOjmmFQAAABA"]
[Sat Dec 20 22:08:49.020414 2025] [:error] [pid 14247:tid 14273] [client 85.203.34.19:33397] [client 85.203.34.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aUat8SDv9TtKKdJQn9k1igAAARg"]
[Sat Dec 20 22:08:49.401006 2025] [:error] [pid 33687:tid 33708] [client 54.189.121.223:39404] [client 54.189.121.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.189.121.223, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUat8TYMR4qK1N4g7vjv4wAAAlI"]
[Sat Dec 20 22:08:49.632379 2025] [:error] [pid 33793:tid 33805] [client 85.203.34.4:33685] [client 85.203.34.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.34.4, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aUat8VSicyB0BFmbRMz0JAAAAso"]
[Sat Dec 20 22:08:58.333494 2025] [:error] [pid 33793:tid 33796] [client 85.203.34.4:33685] [client 85.203.34.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/themes.php"] [unique_id "aUat-lSicyB0BFmbRMz0KQAAAsE"]
[Sat Dec 20 22:09:21.530559 2025] [autoindex:error] [pid 33793:tid 33802] [client 85.203.34.44:41029] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:09:24.784914 2025] [autoindex:error] [pid 33793:tid 33804] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:09:33.846410 2025] [autoindex:error] [pid 33793:tid 33815] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:09:37.464306 2025] [autoindex:error] [pid 33793:tid 33805] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:09:37.766745 2025] [autoindex:error] [pid 33793:tid 33818] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:09:38.085714 2025] [autoindex:error] [pid 33793:tid 33816] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:09:38.409639 2025] [autoindex:error] [pid 33793:tid 33804] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:09:38.738457 2025] [autoindex:error] [pid 33793:tid 33819] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:09:39.391586 2025] [autoindex:error] [pid 33793:tid 33806] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:09:39.731418 2025] [autoindex:error] [pid 33793:tid 33801] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:09:40.033094 2025] [autoindex:error] [pid 33793:tid 33814] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:09:40.351212 2025] [autoindex:error] [pid 33793:tid 33803] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:09:55.497518 2025] [autoindex:error] [pid 33793:tid 33809] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:11:08.720249 2025] [autoindex:error] [pid 33793:tid 33816] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:11:09.055760 2025] [autoindex:error] [pid 33793:tid 33803] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:11:11.962651 2025] [:error] [pid 33793:tid 33803] [client 85.203.34.44:41029] [client 85.203.34.44] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "85.203.34.44_92777f268ca7948dd0b63b7c1eeff6915a72a3b5"): Internal error (specific information not available) [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/light/"] [unique_id "aUaufVSicyB0BFmbRMz05QAAAsg"]
[Sat Dec 20 22:11:11.973317 2025] [autoindex:error] [pid 33793:tid 33802] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:11:12.284630 2025] [autoindex:error] [pid 33793:tid 33806] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:11:12.590993 2025] [autoindex:error] [pid 33793:tid 33797] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:11:12.910056 2025] [autoindex:error] [pid 33793:tid 33804] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:11:13.445194 2025] [autoindex:error] [pid 33793:tid 33805] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:11:17.983223 2025] [autoindex:error] [pid 33793:tid 33809] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:11:18.314499 2025] [autoindex:error] [pid 33793:tid 33802] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:11:21.246051 2025] [autoindex:error] [pid 33793:tid 33808] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:11:23.870851 2025] [autoindex:error] [pid 33793:tid 33795] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:11:24.208366 2025] [autoindex:error] [pid 33793:tid 33814] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:11:24.540400 2025] [autoindex:error] [pid 33793:tid 33810] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:11:27.009043 2025] [autoindex:error] [pid 33793:tid 33819] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:11:27.349068 2025] [autoindex:error] [pid 33793:tid 33811] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:11:27.642709 2025] [autoindex:error] [pid 33793:tid 33807] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:11:27.965479 2025] [autoindex:error] [pid 33793:tid 33809] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:11:28.272700 2025] [autoindex:error] [pid 33793:tid 33800] [client 85.203.34.44:41029] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:12:29.214356 2025] [autoindex:error] [pid 14286:tid 14292] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:13:01.136046 2025] [autoindex:error] [pid 14286:tid 14313] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:13:11.691672 2025] [autoindex:error] [pid 14286:tid 14299] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:13:12.012581 2025] [autoindex:error] [pid 14286:tid 14300] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:13:19.449656 2025] [autoindex:error] [pid 14286:tid 14309] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:13:19.781807 2025] [autoindex:error] [pid 14286:tid 14297] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:13:20.129218 2025] [autoindex:error] [pid 14286:tid 14312] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:13:20.486226 2025] [autoindex:error] [pid 14286:tid 14308] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:13:20.801017 2025] [autoindex:error] [pid 14286:tid 14290] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:13:21.098836 2025] [autoindex:error] [pid 14286:tid 14295] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:13:21.433058 2025] [autoindex:error] [pid 14286:tid 14291] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:13:21.983716 2025] [autoindex:error] [pid 14286:tid 14304] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:13:22.333931 2025] [autoindex:error] [pid 14286:tid 14299] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:13:22.645433 2025] [autoindex:error] [pid 14286:tid 14311] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:13:42.925752 2025] [autoindex:error] [pid 14286:tid 14310] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:14:12.539967 2025] [autoindex:error] [pid 14286:tid 14308] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:14:12.909137 2025] [autoindex:error] [pid 14286:tid 14309] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:14:45.675924 2025] [autoindex:error] [pid 14286:tid 14296] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/paste/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:14:50.011056 2025] [autoindex:error] [pid 14286:tid 14293] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:14:57.890589 2025] [autoindex:error] [pid 14286:tid 14309] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:14:59.717884 2025] [autoindex:error] [pid 14286:tid 14301] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:15:04.898642 2025] [autoindex:error] [pid 14286:tid 14293] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/directionality/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:15:07.872978 2025] [autoindex:error] [pid 14286:tid 14314] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/search/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:15:08.262664 2025] [autoindex:error] [pid 14286:tid 14307] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/compat3x/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:15:10.767964 2025] [autoindex:error] [pid 14286:tid 14311] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:15:13.051242 2025] [autoindex:error] [pid 14286:tid 14300] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:15:15.346185 2025] [autoindex:error] [pid 14286:tid 14304] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:15:15.687918 2025] [autoindex:error] [pid 14286:tid 14302] [client 85.203.34.9:57945] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/classic-editor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:15:16.037614 2025] [proxy_fcgi:error] [pid 14286:tid 14308] [client 85.203.34.9:57945] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_header() in /home/expressi/public_html/wp-content/themes/twentytwentyone/index.php:17\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/themes/twentytwentyone/index.php on line 17'
[Sat Dec 20 22:15:22.976997 2025] [autoindex:error] [pid 62124:tid 62142] [client 85.203.34.30:29767] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:15:36.189980 2025] [autoindex:error] [pid 62124:tid 62150] [client 85.203.34.30:29767] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/paragraph/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:15:45.148641 2025] [autoindex:error] [pid 62124:tid 62141] [client 85.203.34.30:29767] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/nux/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:15:46.983783 2025] [autoindex:error] [pid 62124:tid 62131] [client 85.203.34.30:29767] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/lists/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:15:47.324601 2025] [autoindex:error] [pid 62124:tid 62149] [client 85.203.34.30:29767] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:16:44.208846 2025] [autoindex:error] [pid 62124:tid 62149] [client 85.203.34.30:29767] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:16:49.062401 2025] [autoindex:error] [pid 62124:tid 62142] [client 85.203.34.30:29767] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/social-links/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:17:18.381358 2025] [autoindex:error] [pid 62124:tid 62137] [client 85.203.34.30:29767] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/src/Core/Curve25519/Ge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Dec 20 22:39:37.722191 2025] [:error] [pid 33793:tid 33803] [client 117.62.235.53:39951] [client 117.62.235.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aUa1KVSicyB0BFmbRMz4wwAAAsg"]
[Sun Dec 21 00:43:01.109988 2025] [:error] [pid 8641:tid 8688] [client 134.209.25.199:58030] [client 134.209.25.199] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aUbSFXE703usYSvQGLRPKgAAAMo"]
[Sun Dec 21 00:43:11.516100 2025] [authz_core:error] [pid 8641:tid 8709] [client 134.209.25.199:44532] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Sun Dec 21 00:43:16.240831 2025] [:error] [pid 8640:tid 8656] [client 134.209.25.199:44562] [client 134.209.25.199] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aUbSJPVclzlEWWhvYtlYOgAAAIY"]
[Sun Dec 21 00:43:18.293653 2025] [:error] [pid 8640:tid 8660] [client 134.209.25.199:46326] [client 134.209.25.199] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aUbSJvVclzlEWWhvYtlYQAAAAIo"]
[Sun Dec 21 01:13:57.719267 2025] [:error] [pid 8641:tid 8702] [client 45.88.186.197:58414] [client 45.88.186.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUbZVXE703usYSvQGLRX2AAAANQ"]
[Sun Dec 21 01:13:58.138178 2025] [:error] [pid 8751:tid 8775] [client 45.88.186.197:58580] [client 45.88.186.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUbZVmvrnuGjNP7vtDQXngAAABY"]
[Sun Dec 21 01:13:58.545520 2025] [:error] [pid 8641:tid 8679] [client 45.88.186.197:58752] [client 45.88.186.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUbZVnE703usYSvQGLRYEQAAAME"]
[Sun Dec 21 01:13:58.959485 2025] [:error] [pid 8751:tid 8761] [client 45.88.186.197:58914] [client 45.88.186.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUbZVmvrnuGjNP7vtDQX9AAAAAg"]
[Sun Dec 21 01:13:59.375676 2025] [:error] [pid 8751:tid 8767] [client 45.88.186.197:59070] [client 45.88.186.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUbZV2vrnuGjNP7vtDQYGQAAAA4"]
[Sun Dec 21 01:20:37.322109 2025] [:error] [pid 8640:tid 8662] [client 4.194.193.179:17155] [client 4.194.193.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.194.193.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUba5fVclzlEWWhvYtlirQAAAIw"], referer: https://www.yahoo.com/
[Sun Dec 21 01:20:38.588920 2025] [autoindex:error] [pid 8641:tid 8707] [client 4.194.193.179:17158] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Sun Dec 21 01:20:39.360206 2025] [autoindex:error] [pid 8641:tid 8692] [client 4.194.193.179:17158] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Sun Dec 21 01:20:40.026414 2025] [autoindex:error] [pid 8641:tid 8684] [client 4.194.193.179:17158] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Sun Dec 21 01:20:41.377389 2025] [autoindex:error] [pid 8641:tid 8686] [client 4.194.193.179:17158] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Sun Dec 21 01:20:42.683479 2025] [:error] [pid 8640:tid 8672] [client 4.194.193.179:17155] [client 4.194.193.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.194.193.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUba6vVclzlEWWhvYtlisgAAAJY"], referer: https://www.google.co.uk/
[Sun Dec 21 01:20:43.275795 2025] [autoindex:error] [pid 8641:tid 8696] [client 4.194.193.179:17158] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Sun Dec 21 01:20:43.973510 2025] [autoindex:error] [pid 8641:tid 8687] [client 4.194.193.179:17158] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Sun Dec 21 01:20:44.066670 2025] [autoindex:error] [pid 8641:tid 8694] [client 4.194.193.179:17158] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Sun Dec 21 01:20:45.398070 2025] [:error] [pid 8640:tid 8667] [client 4.194.193.179:17155] [client 4.194.193.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.194.193.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUba7fVclzlEWWhvYtlitQAAAJE"], referer: https://www.yahoo.com/
[Sun Dec 21 01:20:56.036717 2025] [autoindex:error] [pid 8641:tid 8690] [client 4.194.193.179:17158] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Sun Dec 21 01:20:56.128244 2025] [autoindex:error] [pid 8641:tid 8693] [client 4.194.193.179:17158] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Sun Dec 21 01:20:56.222942 2025] [autoindex:error] [pid 8641:tid 8696] [client 4.194.193.179:17158] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Sun Dec 21 01:20:56.907737 2025] [autoindex:error] [pid 8641:tid 8703] [client 4.194.193.179:17158] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Sun Dec 21 01:20:57.663272 2025] [autoindex:error] [pid 8641:tid 8705] [client 4.194.193.179:17158] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Sun Dec 21 01:20:57.750200 2025] [:error] [pid 8641:tid 8682] [client 4.194.193.179:17158] [client 4.194.193.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aUba-XE703usYSvQGLRawgAAAMQ"], referer: https://www.google.fr/
[Sun Dec 21 01:20:57.939251 2025] [autoindex:error] [pid 8641:tid 8687] [client 4.194.193.179:13833] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Sun Dec 21 01:20:58.026532 2025] [:error] [pid 8641:tid 8688] [client 4.194.193.179:13833] [client 4.194.193.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aUba-nE703usYSvQGLRaxAAAAMo"], referer: https://www.google.fr/
[Sun Dec 21 01:20:58.209683 2025] [:error] [pid 22338:tid 22393] [client 4.194.193.179:13504] [client 4.194.193.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aUba-nGYQSUt-opKpSIPhwAAAEk"], referer: https://www.yahoo.com/
[Sun Dec 21 01:20:58.387109 2025] [:error] [pid 22338:tid 22396] [client 4.194.193.179:64955] [client 4.194.193.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/autoload_classmap.php"] [unique_id "aUba-nGYQSUt-opKpSIPiAAAAEs"], referer: https://www.bing.com/
[Sun Dec 21 01:20:58.573072 2025] [:error] [pid 8751:tid 8767] [client 4.194.193.179:13538] [client 4.194.193.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aUba-mvrnuGjNP7vtDQc-AAAAA4"], referer: https://www.yahoo.com/
[Sun Dec 21 01:20:58.751723 2025] [autoindex:error] [pid 8751:tid 8755] [client 4.194.193.179:13525] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Sun Dec 21 01:20:58.858318 2025] [autoindex:error] [pid 8751:tid 8775] [client 4.194.193.179:13525] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Sun Dec 21 01:20:58.946299 2025] [:error] [pid 8751:tid 8754] [client 4.194.193.179:13525] [client 4.194.193.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aUba-mvrnuGjNP7vtDQc_QAAAAE"], referer: https://www.google.com/
[Sun Dec 21 01:20:59.120972 2025] [:error] [pid 22338:tid 22385] [client 4.194.193.179:64373] [client 4.194.193.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aUba-3GYQSUt-opKpSIPiwAAAEE"], referer: https://www.google.de/
[Sun Dec 21 01:20:59.295948 2025] [:error] [pid 8642:tid 8718] [client 4.194.193.179:17211] [client 4.194.193.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bk/index.php"] [unique_id "aUba-yJkiik8k41igp0KogAAAQ0"], referer: https://www.google.fr/
[Sun Dec 21 01:20:59.475338 2025] [autoindex:error] [pid 8642:tid 8713] [client 4.194.193.179:64357] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Sun Dec 21 01:20:59.567059 2025] [autoindex:error] [pid 8642:tid 8697] [client 4.194.193.179:64357] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Sun Dec 21 01:20:59.658819 2025] [autoindex:error] [pid 8642:tid 8717] [client 4.194.193.179:64357] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Sun Dec 21 01:20:59.750435 2025] [autoindex:error] [pid 8642:tid 8706] [client 4.194.193.179:64357] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Sun Dec 21 01:20:59.837128 2025] [:error] [pid 8642:tid 8720] [client 4.194.193.179:64357] [client 4.194.193.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aUba-yJkiik8k41igp0KqAAAAQ8"], referer: https://www.google.co.uk/
[Sun Dec 21 01:21:00.013473 2025] [:error] [pid 8751:tid 8770] [client 4.194.193.179:13768] [client 4.194.193.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aUba_GvrnuGjNP7vtDQdBQAAABE"], referer: https://www.google.fr/
[Sun Dec 21 01:21:00.189527 2025] [:error] [pid 8642:tid 8724] [client 4.194.193.179:13510] [client 4.194.193.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/index.php"] [unique_id "aUba_CJkiik8k41igp0KqQAAARM"], referer: https://www.bing.com/
[Sun Dec 21 01:21:00.372507 2025] [autoindex:error] [pid 8642:tid 8723] [client 4.194.193.179:64912] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Sun Dec 21 01:21:00.459862 2025] [:error] [pid 8642:tid 8725] [client 4.194.193.179:64912] [client 4.194.193.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aUba_CJkiik8k41igp0KqwAAARQ"], referer: https://www.bing.com/
[Sun Dec 21 01:21:00.636366 2025] [:error] [pid 8751:tid 8763] [client 4.194.193.179:64939] [client 4.194.193.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aUba_GvrnuGjNP7vtDQdBwAAAAo"], referer: https://www.google.fr/
[Sun Dec 21 01:21:00.818961 2025] [autoindex:error] [pid 8642:tid 8701] [client 4.194.193.179:13773] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Sun Dec 21 01:21:00.922116 2025] [autoindex:error] [pid 8642:tid 8714] [client 4.194.193.179:13773] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Sun Dec 21 01:21:01.014754 2025] [autoindex:error] [pid 8642:tid 8728] [client 4.194.193.179:13773] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Sun Dec 21 01:21:01.103221 2025] [:error] [pid 8642:tid 8711] [client 4.194.193.179:13773] [client 4.194.193.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aUba_SJkiik8k41igp0KsAAAAQc"], referer: https://www.google.fr/
[Sun Dec 21 01:21:01.280402 2025] [:error] [pid 8641:tid 8684] [client 4.194.193.179:64901] [client 4.194.193.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aUba_XE703usYSvQGLRaxQAAAMY"], referer: https://www.google.com/
[Sun Dec 21 01:21:01.455019 2025] [:error] [pid 22338:tid 22386] [client 4.194.193.179:17170] [client 4.194.193.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/random_compat/index.php"] [unique_id "aUba_XGYQSUt-opKpSIPjQAAAEI"], referer: https://www.yahoo.com/
[Sun Dec 21 01:21:01.635749 2025] [autoindex:error] [pid 8751:tid 8773] [client 4.194.193.179:13782] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Sun Dec 21 01:21:01.723374 2025] [:error] [pid 8751:tid 8777] [client 4.194.193.179:13782] [client 4.194.193.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aUba_WvrnuGjNP7vtDQdEAAAABg"], referer: https://www.google.de/
[Sun Dec 21 01:21:01.915002 2025] [:error] [pid 8640:tid 8671] [client 4.194.193.179:65017] [client 4.194.193.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aUba_fVclzlEWWhvYtlixwAAAJU"], referer: https://www.yahoo.com/
[Sun Dec 21 01:21:02.088927 2025] [:error] [pid 8640:tid 8651] [client 4.194.193.179:64377] [client 4.194.193.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aUba_vVclzlEWWhvYtliyAAAAIE"], referer: https://duckduckgo.com/
[Sun Dec 21 01:21:02.313379 2025] [:error] [pid 8640:tid 8672] [client 4.194.193.179:13850] [client 4.194.193.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aUba_vVclzlEWWhvYtliygAAAJY"], referer: https://www.google.de/
[Sun Dec 21 01:21:02.495342 2025] [:error] [pid 8642:tid 8719] [client 4.194.193.179:17198] [client 4.194.193.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aUba_iJkiik8k41igp0KsQAAAQ4"], referer: https://www.google.de/
[Sun Dec 21 01:21:02.684560 2025] [autoindex:error] [pid 8642:tid 8713] [client 4.194.193.179:64982] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Sun Dec 21 01:21:02.771490 2025] [:error] [pid 8642:tid 8697] [client 4.194.193.179:64982] [client 4.194.193.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.194.193.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUba_iJkiik8k41igp0KswAAAQA"], referer: https://www.google.de/
[Sun Dec 21 01:21:03.645102 2025] [:error] [pid 8641:tid 8685] [client 4.194.193.179:13512] [client 4.194.193.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.194.193.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUba_3E703usYSvQGLRayQAAAMc"], referer: https://www.google.de/
[Sun Dec 21 01:21:07.359923 2025] [:error] [pid 8642:tid 8715] [client 4.194.193.179:64982] [client 4.194.193.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.194.193.179, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUbbAyJkiik8k41igp0KuwAAAQo"], referer: https://www.google.co.uk/
[Sun Dec 21 01:21:52.084877 2025] [:error] [pid 8641:tid 8694] [client 43.153.107.22:41274] [client 43.153.107.22] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUbbMHE703usYSvQGLRbFgAAAM8"]
[Sun Dec 21 02:12:40.821395 2025] [:error] [pid 8640:tid 8661] [client 13.74.149.244:14614] [client 13.74.149.244] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 13.74.149.244, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUbnGPVclzlEWWhvYtl2eQAAAIs"]
[Sun Dec 21 02:12:42.384455 2025] [:error] [pid 22338:tid 22409] [client 13.74.149.244:6321] [client 13.74.149.244] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 13.74.149.244, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUbnGnGYQSUt-opKpSIrngAAAFg"]
[Sun Dec 21 02:12:51.630641 2025] [:error] [pid 8640:tid 8662] [client 13.74.149.244:14614] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/weblinks.php"] [unique_id "aUbnI_VclzlEWWhvYtl2nQAAAIw"]
[Sun Dec 21 02:12:52.138594 2025] [:error] [pid 8641:tid 8680] [client 13.74.149.244:7441] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/weblinks.php"] [unique_id "aUbnJHE703usYSvQGLRt6AAAAMI"]
[Sun Dec 21 02:12:52.638382 2025] [:error] [pid 8640:tid 8665] [client 13.74.149.244:5839] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/weblinks.php"] [unique_id "aUbnJPVclzlEWWhvYtl2ngAAAI8"]
[Sun Dec 21 02:12:53.136625 2025] [:error] [pid 8751:tid 8770] [client 13.74.149.244:2858] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/weblinks.php"] [unique_id "aUbnJWvrnuGjNP7vtDQ_CQAAABE"]
[Sun Dec 21 02:12:53.635111 2025] [:error] [pid 8751:tid 8762] [client 13.74.149.244:10006] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index.php"] [unique_id "aUbnJWvrnuGjNP7vtDQ_CwAAAAk"]
[Sun Dec 21 02:12:54.135467 2025] [:error] [pid 8641:tid 8688] [client 13.74.149.244:7991] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index.php"] [unique_id "aUbnJnE703usYSvQGLRt7QAAAMo"]
[Sun Dec 21 02:12:54.635120 2025] [:error] [pid 8641:tid 8681] [client 13.74.149.244:6989] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index.php"] [unique_id "aUbnJnE703usYSvQGLRt8AAAAMM"]
[Sun Dec 21 02:12:55.134432 2025] [:error] [pid 8640:tid 8671] [client 13.74.149.244:9991] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/logins.php"] [unique_id "aUbnJ_VclzlEWWhvYtl2owAAAJU"]
[Sun Dec 21 02:12:55.632343 2025] [:error] [pid 22338:tid 22386] [client 13.74.149.244:7007] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/logins.php"] [unique_id "aUbnJ3GYQSUt-opKpSIrswAAAEI"]
[Sun Dec 21 02:12:56.134248 2025] [:error] [pid 8642:tid 8720] [client 13.74.149.244:6984] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-is.php"] [unique_id "aUbnKCJkiik8k41igp0eZAAAAQ8"]
[Sun Dec 21 02:12:56.635038 2025] [:error] [pid 22338:tid 22390] [client 13.74.149.244:2846] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-is.php"] [unique_id "aUbnKHGYQSUt-opKpSIruAAAAEY"]
[Sun Dec 21 02:12:57.134283 2025] [:error] [pid 8641:tid 8709] [client 13.74.149.244:6295] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-is.php"] [unique_id "aUbnKXE703usYSvQGLRt8gAAANg"]
[Sun Dec 21 02:12:57.632948 2025] [:error] [pid 22338:tid 22405] [client 13.74.149.244:7425] [client 13.74.149.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-is.php"] [unique_id "aUbnKXGYQSUt-opKpSIrvgAAAFQ"]
[Sun Dec 21 02:36:25.356376 2025] [:error] [pid 8642:tid 8711] [client 31.171.130.129:46473] [client 31.171.130.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aUbsqSJkiik8k41igp0wqwAAAQc"]
[Sun Dec 21 02:36:36.742630 2025] [:error] [pid 43680:tid 43706] [client 31.171.130.135:51117] [client 31.171.130.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aUbstEDkAAJVjNqC6UW7ggAAAVY"]
[Sun Dec 21 02:37:01.671133 2025] [:error] [pid 22338:tid 22390] [client 31.171.130.120:65273] [client 31.171.130.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aUbszXGYQSUt-opKpSJBVAAAAEY"]
[Sun Dec 21 02:37:11.970156 2025] [:error] [pid 8642:tid 8722] [client 31.171.130.138:43555] [client 31.171.130.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aUbs1yJkiik8k41igp0yPAAAARE"]
[Sun Dec 21 02:37:32.811788 2025] [:error] [pid 8642:tid 8713] [client 31.171.130.113:46383] [client 31.171.130.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aUbs7CJkiik8k41igp0y7QAAAQg"]
[Sun Dec 21 02:37:36.863761 2025] [:error] [pid 8640:tid 8663] [client 31.171.130.131:35133] [client 31.171.130.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aUbs8PVclzlEWWhvYtmJkQAAAI0"]
[Sun Dec 21 02:37:37.505440 2025] [:error] [pid 43680:tid 43690] [client 31.171.130.110:20041] [client 31.171.130.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aUbs8UDkAAJVjNqC6UW-LAAAAUY"]
[Sun Dec 21 02:37:38.159121 2025] [:error] [pid 43680:tid 43698] [client 31.171.130.146:37035] [client 31.171.130.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aUbs8kDkAAJVjNqC6UW-MAAAAU4"]
[Sun Dec 21 02:37:38.764730 2025] [:error] [pid 8751:tid 8766] [client 31.171.130.158:60797] [client 31.171.130.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aUbs8mvrnuGjNP7vtDRcjAAAAA0"]
[Sun Dec 21 02:37:39.339374 2025] [:error] [pid 8641:tid 8695] [client 31.171.130.130:30097] [client 31.171.130.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aUbs83E703usYSvQGLSC7gAAANA"]
[Sun Dec 21 02:37:43.796816 2025] [:error] [pid 8641:tid 8681] [client 31.171.130.134:45301] [client 31.171.130.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aUbs93E703usYSvQGLSDGQAAAMM"]
[Sun Dec 21 02:37:48.109988 2025] [:error] [pid 8642:tid 8697] [client 31.171.130.119:25475] [client 31.171.130.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aUbs_CJkiik8k41igp0zawAAAQA"]
[Sun Dec 21 02:37:54.270750 2025] [:error] [pid 8642:tid 8727] [client 31.171.130.139:40087] [client 31.171.130.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aUbtAiJkiik8k41igp0zmgAAARY"]
[Sun Dec 21 02:37:57.957257 2025] [:error] [pid 8640:tid 8658] [client 31.171.130.160:32425] [client 31.171.130.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aUbtBfVclzlEWWhvYtmKDwAAAIg"]
[Sun Dec 21 02:38:04.035134 2025] [:error] [pid 8751:tid 8761] [client 31.171.130.116:47179] [client 31.171.130.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aUbtDGvrnuGjNP7vtDRdWQAAAAg"]
[Sun Dec 21 02:38:24.568770 2025] [:error] [pid 44515:tid 44521] [client 31.171.130.151:36021] [client 31.171.130.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aUbtIJZAdBRP9gwGvJ5OngAAAYM"]
[Sun Dec 21 02:38:28.044714 2025] [:error] [pid 44515:tid 44528] [client 31.171.130.145:60761] [client 31.171.130.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aUbtJJZAdBRP9gwGvJ5OuAAAAYo"]
[Sun Dec 21 02:38:35.375517 2025] [:error] [pid 22338:tid 22403] [client 31.171.130.138:31941] [client 31.171.130.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/defaults.php"] [unique_id "aUbtK3GYQSUt-opKpSJD6wAAAFI"]
[Sun Dec 21 02:38:39.798418 2025] [:error] [pid 8640:tid 8672] [client 31.171.130.110:50145] [client 31.171.130.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aUbtL_VclzlEWWhvYtmL0wAAAJY"]
[Sun Dec 21 02:38:51.090629 2025] [:error] [pid 44515:tid 44528] [client 31.171.130.140:61109] [client 31.171.130.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aUbtO5ZAdBRP9gwGvJ5PzwAAAYo"]
[Sun Dec 21 02:38:54.217410 2025] [:error] [pid 8640:tid 8655] [client 31.171.130.136:38515] [client 31.171.130.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aUbtPvVclzlEWWhvYtmMaAAAAIU"]
[Sun Dec 21 02:39:00.761872 2025] [:error] [pid 8640:tid 8669] [client 31.171.130.135:31061] [client 31.171.130.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aUbtRPVclzlEWWhvYtmMmgAAAJM"]
[Sun Dec 21 02:39:02.393558 2025] [:error] [pid 8640:tid 8659] [client 31.171.130.147:50775] [client 31.171.130.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aUbtRvVclzlEWWhvYtmMpAAAAIk"]
[Sun Dec 21 02:39:02.987883 2025] [:error] [pid 43680:tid 43701] [client 31.171.130.164:26629] [client 31.171.130.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aUbtRkDkAAJVjNqC6UXBUAAAAVE"]
[Sun Dec 21 02:39:16.721415 2025] [:error] [pid 8641:tid 8687] [client 31.171.130.138:55547] [client 31.171.130.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/info.php"] [unique_id "aUbtVHE703usYSvQGLSFuQAAAMk"]
[Sun Dec 21 02:39:17.347834 2025] [:error] [pid 44515:tid 44527] [client 31.171.130.119:38817] [client 31.171.130.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class.api.php"] [unique_id "aUbtVZZAdBRP9gwGvJ5QrQAAAYk"]
[Sun Dec 21 02:39:17.999530 2025] [:error] [pid 44515:tid 44518] [client 31.171.130.143:60107] [client 31.171.130.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUbtVZZAdBRP9gwGvJ5QtAAAAYA"]
[Sun Dec 21 02:39:44.116858 2025] [:error] [pid 8751:tid 8753] [client 31.171.130.115:31807] [client 31.171.130.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/admin.php"] [unique_id "aUbtcGvrnuGjNP7vtDRg0wAAAAA"]
[Sun Dec 21 02:39:51.452698 2025] [:error] [pid 8641:tid 8694] [client 31.171.130.147:55767] [client 31.171.130.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aUbtd3E703usYSvQGLSG0AAAAM8"]
[Sun Dec 21 02:40:22.884764 2025] [:error] [pid 8641:tid 8685] [client 31.171.130.147:55767] [client 31.171.130.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aUbtlnE703usYSvQGLSHyAAAAMc"]
[Sun Dec 21 02:40:29.771679 2025] [:error] [pid 8641:tid 8689] [client 31.171.130.115:62781] [client 31.171.130.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.115, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aUbtnXE703usYSvQGLSH_wAAAMs"]
[Sun Dec 21 02:40:35.264467 2025] [:error] [pid 8641:tid 8694] [client 31.171.130.115:62781] [client 31.171.130.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/item.php"] [unique_id "aUbto3E703usYSvQGLSIKQAAAM8"]
[Sun Dec 21 02:40:58.751924 2025] [:error] [pid 8642:tid 8701] [client 31.171.130.107:47721] [client 31.171.130.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aUbtuiJkiik8k41igp05LwAAAQI"]
[Sun Dec 21 02:41:21.675453 2025] [:error] [pid 22338:tid 22392] [client 31.171.130.158:22385] [client 31.171.130.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aUbt0XGYQSUt-opKpSJIwwAAAEg"]
[Sun Dec 21 02:41:26.113070 2025] [:error] [pid 22338:tid 22402] [client 31.171.130.113:25379] [client 31.171.130.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aUbt1nGYQSUt-opKpSJI2QAAAFE"]
[Sun Dec 21 02:41:36.408627 2025] [:error] [pid 8640:tid 8664] [client 31.171.130.147:59215] [client 31.171.130.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aUbt4PVclzlEWWhvYtmP7wAAAI4"]
[Sun Dec 21 02:41:39.366339 2025] [:error] [pid 8640:tid 8665] [client 31.171.130.147:59215] [client 31.171.130.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aUbt4_VclzlEWWhvYtmP9AAAAI8"]
[Sun Dec 21 02:42:26.721128 2025] [:error] [pid 8641:tid 8692] [client 31.171.130.115:34275] [client 31.171.130.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aUbuEnE703usYSvQGLSLJQAAAM0"]
[Sun Dec 21 02:42:37.434809 2025] [:error] [pid 43680:tid 43691] [client 31.171.130.122:50427] [client 31.171.130.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aUbuHUDkAAJVjNqC6UXGvQAAAUc"]
[Sun Dec 21 02:42:51.837271 2025] [:error] [pid 43680:tid 43695] [client 31.171.130.122:50427] [client 31.171.130.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aUbuK0DkAAJVjNqC6UXHCAAAAUs"]
[Sun Dec 21 02:42:57.382558 2025] [:error] [pid 8641:tid 8689] [client 31.171.130.118:51841] [client 31.171.130.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/infi.php"] [unique_id "aUbuMXE703usYSvQGLSL7gAAAMs"]
[Sun Dec 21 02:43:03.962774 2025] [:error] [pid 8640:tid 8654] [client 31.171.130.108:40133] [client 31.171.130.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aUbuN_VclzlEWWhvYtmRpQAAAIQ"]
[Sun Dec 21 02:43:14.625565 2025] [:error] [pid 22338:tid 22392] [client 31.171.130.160:28573] [client 31.171.130.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aUbuQnGYQSUt-opKpSJLlQAAAEg"]
[Sun Dec 21 02:43:15.369831 2025] [:error] [pid 43680:tid 43684] [client 31.171.130.158:64227] [client 31.171.130.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aUbuQ0DkAAJVjNqC6UXHkwAAAUA"]
[Sun Dec 21 02:43:31.464321 2025] [:error] [pid 22338:tid 22402] [client 31.171.130.116:46255] [client 31.171.130.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aUbuU3GYQSUt-opKpSJL8QAAAFE"]
[Sun Dec 21 02:43:36.142378 2025] [:error] [pid 44515:tid 44526] [client 31.171.130.110:37357] [client 31.171.130.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "aUbuWJZAdBRP9gwGvJ5aVAAAAYg"]
[Sun Dec 21 02:43:46.426508 2025] [:error] [pid 43680:tid 43696] [client 31.171.130.112:63607] [client 31.171.130.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/edit.php"] [unique_id "aUbuYkDkAAJVjNqC6UXITQAAAUw"]
[Sun Dec 21 02:43:57.752457 2025] [:error] [pid 44515:tid 44523] [client 31.171.130.143:33077] [client 31.171.130.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aUbubZZAdBRP9gwGvJ5bTwAAAYU"]
[Sun Dec 21 02:44:05.942281 2025] [:error] [pid 8642:tid 8710] [client 31.171.130.163:45067] [client 31.171.130.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/click.php"] [unique_id "aUbudSJkiik8k41igp09hQAAAQY"]
[Sun Dec 21 02:44:17.588421 2025] [:error] [pid 44515:tid 44527] [client 31.171.130.144:30335] [client 31.171.130.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aUbugZZAdBRP9gwGvJ5cDAAAAYk"]
[Sun Dec 21 02:44:41.355835 2025] [:error] [pid 44515:tid 44519] [client 31.171.130.134:54449] [client 31.171.130.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aUbumZZAdBRP9gwGvJ5dEAAAAYE"]
[Sun Dec 21 02:44:41.963908 2025] [:error] [pid 43680:tid 43685] [client 31.171.130.158:62603] [client 31.171.130.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/xl2023.php"] [unique_id "aUbumUDkAAJVjNqC6UXJogAAAUE"]
[Sun Dec 21 02:44:42.526311 2025] [:error] [pid 8642:tid 8726] [client 31.171.130.116:51065] [client 31.171.130.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aUbumiJkiik8k41igp0-HQAAARU"]
[Sun Dec 21 02:44:43.155606 2025] [:error] [pid 8641:tid 8678] [client 31.171.130.131:21289] [client 31.171.130.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aUbum3E703usYSvQGLSOtwAAAMA"]
[Sun Dec 21 02:44:47.163622 2025] [:error] [pid 8641:tid 8709] [client 31.171.130.123:31691] [client 31.171.130.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aUbun3E703usYSvQGLSO1gAAANg"]
[Sun Dec 21 02:44:47.763440 2025] [:error] [pid 8642:tid 8727] [client 31.171.130.145:57765] [client 31.171.130.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aUbunyJkiik8k41igp0-MwAAARY"]
[Sun Dec 21 02:44:54.246382 2025] [:error] [pid 8642:tid 8704] [client 31.171.130.149:29803] [client 31.171.130.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aUbupiJkiik8k41igp0-ZAAAAQM"]
[Sun Dec 21 02:44:54.919984 2025] [:error] [pid 22338:tid 22391] [client 31.171.130.149:25727] [client 31.171.130.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aUbupnGYQSUt-opKpSJNxgAAAEc"]
[Sun Dec 21 02:44:55.585363 2025] [:error] [pid 8640:tid 8661] [client 31.171.130.111:48019] [client 31.171.130.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aUbup_VclzlEWWhvYtmUpgAAAIs"]
[Sun Dec 21 02:44:56.225488 2025] [:error] [pid 44515:tid 44528] [client 31.171.130.159:62827] [client 31.171.130.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "aUbuqJZAdBRP9gwGvJ5dnAAAAYo"]
[Sun Dec 21 02:44:59.549459 2025] [:error] [pid 8641:tid 8688] [client 31.171.130.159:49993] [client 31.171.130.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aUbuq3E703usYSvQGLSPCAAAAMo"]
[Sun Dec 21 02:45:00.444624 2025] [proxy_fcgi:error] [pid 8751:tid 8766] [client 31.171.130.164:20685] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function add_action() in /home/expressi/public_html/wp-content/plugins/hello.php:69\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/plugins/hello.php on line 69'
[Sun Dec 21 02:45:04.881468 2025] [:error] [pid 44515:tid 44519] [client 31.171.130.163:29121] [client 31.171.130.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "aUbusJZAdBRP9gwGvJ5d5AAAAYE"]
[Sun Dec 21 02:45:18.806563 2025] [:error] [pid 8642:tid 8725] [client 31.171.130.142:49795] [client 31.171.130.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aUbuviJkiik8k41igp0-0AAAARQ"]
[Sun Dec 21 02:45:38.531297 2025] [:error] [pid 8641:tid 8681] [client 31.171.130.143:23857] [client 31.171.130.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/file.php"] [unique_id "aUbu0nE703usYSvQGLSPqAAAAMM"]
[Sun Dec 21 02:45:46.074447 2025] [:error] [pid 43680:tid 43700] [client 31.171.130.134:42703] [client 31.171.130.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aUbu2kDkAAJVjNqC6UXK4wAAAVA"]
[Sun Dec 21 02:45:47.880817 2025] [:error] [pid 8642:tid 8725] [client 31.171.130.136:38043] [client 31.171.130.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aUbu2yJkiik8k41igp0_dgAAARQ"]
[Sun Dec 21 02:45:59.594503 2025] [:error] [pid 43680:tid 43688] [client 31.171.130.161:52875] [client 31.171.130.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aUbu50DkAAJVjNqC6UXLPQAAAUQ"]
[Sun Dec 21 02:46:11.682600 2025] [proxy_fcgi:error] [pid 8642:tid 8714] [client 31.171.130.110:41703] AH01071: Got error 'Primary script unknown'
[Sun Dec 21 02:46:11.983599 2025] [proxy_fcgi:error] [pid 8642:tid 8728] [client 31.171.130.110:41703] AH01071: Got error 'Primary script unknown'
[Sun Dec 21 02:46:12.282780 2025] [proxy_fcgi:error] [pid 8642:tid 8729] [client 31.171.130.110:41703] AH01071: Got error 'Primary script unknown'
[Sun Dec 21 02:46:19.364130 2025] [:error] [pid 8642:tid 8727] [client 31.171.130.110:41703] [client 31.171.130.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aUbu-yJkiik8k41igp1ArQAAARY"]
[Sun Dec 21 02:46:20.009240 2025] [:error] [pid 22338:tid 22401] [client 31.171.130.109:59107] [client 31.171.130.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aUbu_HGYQSUt-opKpSJQEQAAAFA"]
[Sun Dec 21 02:46:20.582400 2025] [:error] [pid 22338:tid 22396] [client 31.171.130.163:61593] [client 31.171.130.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aUbu_HGYQSUt-opKpSJQFwAAAEs"]
[Sun Dec 21 02:46:21.228657 2025] [:error] [pid 22338:tid 22407] [client 31.171.130.159:43777] [client 31.171.130.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aUbu_XGYQSUt-opKpSJQHQAAAFY"]
[Sun Dec 21 02:46:21.787808 2025] [:error] [pid 44515:tid 44538] [client 31.171.130.163:38525] [client 31.171.130.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aUbu_ZZAdBRP9gwGvJ5ftQAAAZQ"]
[Sun Dec 21 02:46:22.461454 2025] [:error] [pid 43680:tid 43696] [client 31.171.130.143:21785] [client 31.171.130.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aUbu_kDkAAJVjNqC6UXLrgAAAUw"]
[Sun Dec 21 02:46:25.329658 2025] [:error] [pid 8751:tid 8759] [client 31.171.130.109:56033] [client 31.171.130.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "aUbvAWvrnuGjNP7vtDRrcwAAAAY"]
[Sun Dec 21 02:46:25.936486 2025] [:error] [pid 44515:tid 44536] [client 31.171.130.111:64527] [client 31.171.130.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aUbvAZZAdBRP9gwGvJ5f4AAAAZI"]
[Sun Dec 21 02:46:26.532816 2025] [:error] [pid 8641:tid 8698] [client 31.171.130.165:49841] [client 31.171.130.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aUbvAnE703usYSvQGLSQ4AAAANI"]
[Sun Dec 21 02:46:27.125422 2025] [:error] [pid 8640:tid 8656] [client 31.171.130.119:48815] [client 31.171.130.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aUbvA_VclzlEWWhvYtmW_AAAAIY"]
[Sun Dec 21 02:46:33.010594 2025] [:error] [pid 8642:tid 8719] [client 31.171.130.164:61297] [client 31.171.130.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aUbvCSJkiik8k41igp1A9QAAAQ4"]
[Sun Dec 21 02:46:36.652431 2025] [:error] [pid 43680:tid 43688] [client 31.171.130.149:43677] [client 31.171.130.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "aUbvDEDkAAJVjNqC6UXMIQAAAUQ"]
[Sun Dec 21 02:46:42.633428 2025] [:error] [pid 43680:tid 43708] [client 31.171.130.129:23927] [client 31.171.130.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aUbvEkDkAAJVjNqC6UXMSQAAAVg"]
[Sun Dec 21 02:46:49.799379 2025] [:error] [pid 44515:tid 44519] [client 31.171.130.107:50389] [client 31.171.130.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/about.php"] [unique_id "aUbvGZZAdBRP9gwGvJ5g1wAAAYE"]
[Sun Dec 21 02:46:58.314410 2025] [:error] [pid 8640:tid 8665] [client 31.171.130.140:47627] [client 31.171.130.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aUbvIvVclzlEWWhvYtmX-wAAAI8"]
[Sun Dec 21 02:47:09.070336 2025] [:error] [pid 43680:tid 43697] [client 31.171.130.136:22163] [client 31.171.130.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aUbvLUDkAAJVjNqC6UXNKQAAAU0"]
[Sun Dec 21 02:47:13.400330 2025] [:error] [pid 8642:tid 8726] [client 31.171.130.116:55727] [client 31.171.130.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aUbvMSJkiik8k41igp1B8gAAARU"]
[Sun Dec 21 02:47:50.288493 2025] [:error] [pid 8640:tid 8653] [client 31.171.130.149:24913] [client 31.171.130.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aUbvVvVclzlEWWhvYtmZVAAAAIM"]
[Sun Dec 21 02:47:50.909450 2025] [:error] [pid 22338:tid 22395] [client 31.171.130.113:30655] [client 31.171.130.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aUbvVnGYQSUt-opKpSJTQwAAAEo"]
[Sun Dec 21 02:47:51.493004 2025] [:error] [pid 22338:tid 22391] [client 31.171.130.114:58859] [client 31.171.130.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUbvV3GYQSUt-opKpSJTRgAAAEc"]
[Sun Dec 21 02:47:56.077375 2025] [:error] [pid 22338:tid 22387] [client 31.171.130.114:58859] [client 31.171.130.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aUbvXHGYQSUt-opKpSJTYwAAAEM"]
[Sun Dec 21 02:48:01.115709 2025] [:error] [pid 8751:tid 8758] [client 31.171.130.157:46911] [client 31.171.130.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aUbvYWvrnuGjNP7vtDRubQAAAAU"]
[Sun Dec 21 02:48:01.729525 2025] [:error] [pid 44515:tid 44528] [client 31.171.130.148:37891] [client 31.171.130.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aUbvYZZAdBRP9gwGvJ5jugAAAYo"]
[Sun Dec 21 02:48:10.827478 2025] [:error] [pid 44515:tid 44535] [client 31.171.130.114:44443] [client 31.171.130.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aUbvapZAdBRP9gwGvJ5kBgAAAZE"]
[Sun Dec 21 02:48:11.760599 2025] [:error] [pid 8641:tid 8705] [client 31.171.130.120:36491] [client 31.171.130.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aUbva3E703usYSvQGLSTuAAAANY"]
[Sun Dec 21 02:48:24.351020 2025] [:error] [pid 22338:tid 22399] [client 31.171.130.142:54409] [client 31.171.130.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aUbveHGYQSUt-opKpSJUaAAAAE4"]
[Sun Dec 21 02:48:29.592624 2025] [proxy_fcgi:error] [pid 43680:tid 43704] [client 31.171.130.152:55677] AH01071: Got error 'Primary script unknown'
[Sun Dec 21 02:48:32.232488 2025] [:error] [pid 43680:tid 43691] [client 31.171.130.152:55677] [client 31.171.130.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/function.php"] [unique_id "aUbvgEDkAAJVjNqC6UXP4wAAAUc"]
[Sun Dec 21 02:48:32.819315 2025] [:error] [pid 8751:tid 8758] [client 31.171.130.134:48277] [client 31.171.130.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/plugins.php"] [unique_id "aUbvgGvrnuGjNP7vtDRvfQAAAAU"]
[Sun Dec 21 02:48:38.102916 2025] [:error] [pid 8641:tid 8678] [client 31.171.130.114:24071] [client 31.171.130.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "aUbvhnE703usYSvQGLSUbwAAAMA"]
[Sun Dec 21 02:48:38.683385 2025] [:error] [pid 8642:tid 8716] [client 31.171.130.148:65291] [client 31.171.130.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aUbvhiJkiik8k41igp1EVwAAAQs"]
[Sun Dec 21 02:48:50.650440 2025] [:error] [pid 8640:tid 8657] [client 31.171.130.132:23567] [client 31.171.130.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/atomlib.php"] [unique_id "aUbvkvVclzlEWWhvYtmbiAAAAIc"]
[Sun Dec 21 02:48:51.236622 2025] [:error] [pid 43680:tid 43703] [client 31.171.130.147:33663] [client 31.171.130.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aUbvk0DkAAJVjNqC6UXQ7wAAAVM"]
[Sun Dec 21 02:49:00.642327 2025] [:error] [pid 43680:tid 43692] [client 31.171.130.134:60247] [client 31.171.130.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aUbvnEDkAAJVjNqC6UXRbwAAAUg"]
[Sun Dec 21 02:49:01.474476 2025] [:error] [pid 22338:tid 22398] [client 31.171.130.109:28349] [client 31.171.130.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aUbvnXGYQSUt-opKpSJVswAAAE0"]
[Sun Dec 21 02:49:02.216745 2025] [:error] [pid 8640:tid 8660] [client 31.171.130.142:44971] [client 31.171.130.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aUbvnvVclzlEWWhvYtmb2QAAAIo"]
[Sun Dec 21 02:49:12.789486 2025] [autoindex:error] [pid 8641:tid 8681] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:13.105658 2025] [autoindex:error] [pid 8641:tid 8695] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:13.420268 2025] [autoindex:error] [pid 8641:tid 8703] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:13.735874 2025] [autoindex:error] [pid 8641:tid 8696] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:17.423337 2025] [autoindex:error] [pid 8641:tid 8681] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:17.747224 2025] [autoindex:error] [pid 8641:tid 8702] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:18.063991 2025] [autoindex:error] [pid 8641:tid 8679] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:18.369308 2025] [autoindex:error] [pid 8641:tid 8689] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:18.687407 2025] [autoindex:error] [pid 8641:tid 8684] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:19.003732 2025] [autoindex:error] [pid 8641:tid 8688] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:19.660190 2025] [autoindex:error] [pid 8641:tid 8700] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:21.219473 2025] [autoindex:error] [pid 8641:tid 8683] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:21.509464 2025] [autoindex:error] [pid 8641:tid 8694] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:24.881746 2025] [autoindex:error] [pid 8641:tid 8692] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:25.174868 2025] [autoindex:error] [pid 8641:tid 8702] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:25.459147 2025] [autoindex:error] [pid 8641:tid 8685] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:25.769996 2025] [autoindex:error] [pid 8641:tid 8690] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:27.864294 2025] [autoindex:error] [pid 8641:tid 8679] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:28.147961 2025] [autoindex:error] [pid 8641:tid 8687] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:30.899069 2025] [autoindex:error] [pid 8641:tid 8702] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:36.231063 2025] [autoindex:error] [pid 8641:tid 8687] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:36.537905 2025] [autoindex:error] [pid 8641:tid 8703] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:36.840463 2025] [autoindex:error] [pid 8641:tid 8695] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:46.294568 2025] [autoindex:error] [pid 8641:tid 8692] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:51.947763 2025] [autoindex:error] [pid 8641:tid 8682] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:54.137322 2025] [autoindex:error] [pid 8641:tid 8682] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:54.441426 2025] [autoindex:error] [pid 8641:tid 8686] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:55.360459 2025] [autoindex:error] [pid 8641:tid 8687] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:55.663222 2025] [autoindex:error] [pid 8641:tid 8700] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:49:55.964655 2025] [autoindex:error] [pid 8641:tid 8694] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:50:02.737827 2025] [autoindex:error] [pid 8641:tid 8692] [client 31.171.130.131:59919] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:50:42.676586 2025] [:error] [pid 8641:tid 8692] [client 31.171.130.131:59919] [client 31.171.130.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tmps/"] [unique_id "aUbwAnE703usYSvQGLSYcAAAAM0"]
[Sun Dec 21 02:50:46.599153 2025] [autoindex:error] [pid 8641:tid 8685] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:50:47.138418 2025] [autoindex:error] [pid 8641:tid 8683] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:50:47.464619 2025] [autoindex:error] [pid 8641:tid 8705] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:50:47.748706 2025] [autoindex:error] [pid 8641:tid 8690] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:50:51.765299 2025] [autoindex:error] [pid 8641:tid 8693] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:50:52.051827 2025] [autoindex:error] [pid 8641:tid 8688] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:50:54.453984 2025] [autoindex:error] [pid 8641:tid 8690] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:50:56.475145 2025] [autoindex:error] [pid 8641:tid 8687] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:50:58.097022 2025] [autoindex:error] [pid 8641:tid 8685] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:50:58.437319 2025] [autoindex:error] [pid 8641:tid 8682] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:51:01.003207 2025] [autoindex:error] [pid 8641:tid 8703] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:51:01.384972 2025] [autoindex:error] [pid 8641:tid 8692] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:51:01.694900 2025] [autoindex:error] [pid 8641:tid 8681] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:51:01.984032 2025] [autoindex:error] [pid 8641:tid 8695] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:51:43.560963 2025] [autoindex:error] [pid 8641:tid 8683] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:52:01.524186 2025] [autoindex:error] [pid 8641:tid 8694] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:52:08.350233 2025] [autoindex:error] [pid 8641:tid 8703] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:52:08.652412 2025] [autoindex:error] [pid 8641:tid 8688] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:52:15.666960 2025] [autoindex:error] [pid 8641:tid 8689] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:52:15.973094 2025] [autoindex:error] [pid 8641:tid 8678] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:52:16.279661 2025] [autoindex:error] [pid 8641:tid 8707] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:52:16.591061 2025] [autoindex:error] [pid 8641:tid 8685] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:52:16.883334 2025] [autoindex:error] [pid 8641:tid 8679] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:52:17.172742 2025] [autoindex:error] [pid 8641:tid 8703] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:52:17.468216 2025] [autoindex:error] [pid 8641:tid 8678] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:52:17.777950 2025] [autoindex:error] [pid 8641:tid 8693] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:52:18.077485 2025] [autoindex:error] [pid 8641:tid 8698] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 02:52:48.637500 2025] [autoindex:error] [pid 8641:tid 8686] [client 31.171.130.143:41251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 21 03:06:13.794104 2025] [:error] [pid 8640:tid 8657] [client 45.135.232.178:65389] [client 45.135.232.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.135.232.178, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUbzpfVclzlEWWhvYtmqhgAAAIc"], referer: https://expressinteriors.com/wp-login.php
[Sun Dec 21 03:06:21.202872 2025] [:error] [pid 8642:tid 8704] [client 45.135.232.178:50676] [client 45.135.232.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.135.232.178, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUbzrCJkiik8k41igp1W6AAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Sun Dec 21 06:41:07.852339 2025] [:error] [pid 12191:tid 12207] [client 103.65.236.149:62628] [client 103.65.236.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aUcmAwM0m463UZmqdiD_vgAAAQ4"]
[Sun Dec 21 06:46:39.629841 2025] [:error] [pid 16016:tid 16023] [client 101.33.81.73:59136] [client 101.33.81.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aUcnT8HQ_KQh3iINaCOhOAAAAUU"]
[Sun Dec 21 10:44:38.928545 2025] [:error] [pid 16016:tid 16028] [client 106.54.62.156:42718] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aUdfFsHQ_KQh3iINaCPp_QAAAUo"]
[Sun Dec 21 11:23:08.549395 2025] [autoindex:error] [pid 20760:tid 20763] [client 144.91.111.74:53697] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Dec 21 12:52:08.180377 2025] [:error] [pid 20676:tid 20739] [client 34.127.70.13:56428] [client 34.127.70.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.127.70.13, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUd8-KpSa967F4pOO5wcngAAAIY"]
[Sun Dec 21 12:52:10.260451 2025] [:error] [pid 20676:tid 20741] [client 34.127.70.13:56428] [client 34.127.70.13] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aUd8-qpSa967F4pOO5wcpgAAAIg"]
[Sun Dec 21 12:52:10.437516 2025] [:error] [pid 20676:tid 20749] [client 34.127.70.13:56428] [client 34.127.70.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.127.70.13, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUd8-qpSa967F4pOO5wcpwAAAJA"]
[Sun Dec 21 12:52:11.756359 2025] [:error] [pid 12191:tid 12206] [client 34.127.70.13:63857] [client 34.127.70.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.127.70.13, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUd8-wM0m463UZmqdiBj2AAAAQ0"]
[Sun Dec 21 12:52:13.022608 2025] [:error] [pid 20676:tid 20754] [client 34.127.70.13:60431] [client 34.127.70.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.127.70.13, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUd8_apSa967F4pOO5wcqQAAAJU"]
[Sun Dec 21 12:52:14.265536 2025] [:error] [pid 12191:tid 12193] [client 34.127.70.13:64247] [client 34.127.70.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.127.70.13, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUd8_gM0m463UZmqdiBj3gAAAQA"]
[Sun Dec 21 12:52:15.570565 2025] [:error] [pid 16016:tid 16038] [client 34.127.70.13:54506] [client 34.127.70.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.127.70.13, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUd8_8HQ_KQh3iINaCMaogAAAVQ"]
[Sun Dec 21 12:52:15.570743 2025] [:error] [pid 16016:tid 16038] [client 34.127.70.13:54506] [client 34.127.70.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.127.70.13, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUd8_8HQ_KQh3iINaCMaogAAAVQ"]
[Sun Dec 21 15:27:20.039474 2025] [:error] [pid 20675:tid 20730] [client 213.238.183.60:43422] [client 213.238.183.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.238.183.60, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUehWLyUvZnd3bHSR3aEGAAAAFg"]
[Sun Dec 21 17:09:15.289418 2025] [:error] [pid 16016:tid 16021] [client 49.234.192.248:46712] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUe5O8HQ_KQh3iINaCNjMQAAAUM"]
[Sun Dec 21 17:36:32.424797 2025] [:error] [pid 60191:tid 60215] [client 34.148.185.128:49271] [client 34.148.185.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.148.185.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUe_oKklhK29C3vVvLWC5QAAAZY"]
[Sun Dec 21 17:36:34.597385 2025] [:error] [pid 60191:tid 60195] [client 34.148.185.128:49271] [client 34.148.185.128] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aUe_oqklhK29C3vVvLWC6AAAAYI"]
[Sun Dec 21 17:36:34.805934 2025] [:error] [pid 60191:tid 60197] [client 34.148.185.128:49271] [client 34.148.185.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.148.185.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUe_oqklhK29C3vVvLWC6QAAAYQ"]
[Sun Dec 21 17:36:36.233020 2025] [:error] [pid 20760:tid 20784] [client 34.148.185.128:55599] [client 34.148.185.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.148.185.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUe_pOXEVvRTAtWo3gletAAAANU"]
[Sun Dec 21 17:36:37.728226 2025] [:error] [pid 60191:tid 60201] [client 34.148.185.128:54357] [client 34.148.185.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.148.185.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUe_paklhK29C3vVvLWC6wAAAYg"]
[Sun Dec 21 17:36:39.187184 2025] [:error] [pid 12191:tid 12206] [client 34.148.185.128:63834] [client 34.148.185.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.148.185.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUe_pwM0m463UZmqdiDGlgAAAQ0"]
[Sun Dec 21 17:36:40.662771 2025] [:error] [pid 20676:tid 20746] [client 34.148.185.128:57477] [client 34.148.185.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.148.185.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUe_qKpSa967F4pOO5x4QwAAAI0"]
[Sun Dec 21 17:36:40.662934 2025] [:error] [pid 20676:tid 20746] [client 34.148.185.128:57477] [client 34.148.185.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.148.185.128, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUe_qKpSa967F4pOO5x4QwAAAI0"]
[Sun Dec 21 17:38:21.421757 2025] [:error] [pid 20760:tid 20775] [client 216.250.12.125:49202] [client 216.250.12.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.250.12.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUfADeXEVvRTAtWo3glfdAAAAMw"]
[Sun Dec 21 17:38:23.267500 2025] [:error] [pid 20760:tid 20770] [client 216.250.12.125:49202] [client 216.250.12.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.250.12.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUfAD-XEVvRTAtWo3glfdQAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Sun Dec 21 17:42:08.399513 2025] [:error] [pid 60191:tid 60213] [client 213.32.31.140:31173] [client 213.32.31.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.32.31.140, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUfA8KklhK29C3vVvLWEKQAAAZQ"]
[Sun Dec 21 18:03:16.938388 2025] [:error] [pid 59158:tid 59166] [client 160.250.186.250:34326] [client 160.250.186.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.186.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfF5I7NvyNF8ab5VgXYggAAAMY"]
[Sun Dec 21 18:03:18.847371 2025] [:error] [pid 59068:tid 59109] [client 160.250.186.250:34342] [client 160.250.186.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.186.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfF5hmLyLqWUlrjwyctMAAAAEg"]
[Sun Dec 21 18:03:20.607675 2025] [:error] [pid 59070:tid 59144] [client 160.250.186.250:34354] [client 160.250.186.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.186.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfF6H3dhXne9KX1kgLGjQAAAJA"]
[Sun Dec 21 18:03:22.158440 2025] [:error] [pid 59068:tid 59125] [client 173.212.219.7:47886] [client 173.212.219.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.212.219.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfF6hmLyLqWUlrjwyctOgAAAFg"]
[Sun Dec 21 18:03:25.428902 2025] [:error] [pid 59068:tid 59114] [client 173.212.219.7:49354] [client 173.212.219.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.212.219.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfF7RmLyLqWUlrjwyctQgAAAE0"]
[Sun Dec 21 18:03:28.356852 2025] [:error] [pid 59068:tid 59123] [client 173.212.219.7:51094] [client 173.212.219.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.212.219.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfF8BmLyLqWUlrjwyctSQAAAFY"]
[Sun Dec 21 18:04:46.075266 2025] [:error] [pid 59067:tid 59095] [client 88.198.14.6:52234] [client 88.198.14.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.198.14.6, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfGPstpsOP1NfIK_qIDlAAAABU"]
[Sun Dec 21 18:04:48.426176 2025] [:error] [pid 59070:tid 59139] [client 88.198.14.6:52240] [client 88.198.14.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.198.14.6, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfGQH3dhXne9KX1kgLHtAAAAIs"]
[Sun Dec 21 18:04:51.022184 2025] [:error] [pid 59070:tid 59139] [client 88.198.14.6:52242] [client 88.198.14.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.198.14.6, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfGQ33dhXne9KX1kgLHvAAAAIs"]
[Sun Dec 21 18:15:08.012759 2025] [:error] [pid 59158:tid 59174] [client 162.213.255.98:37634] [client 162.213.255.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.213.255.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfIrI7NvyNF8ab5VgXe8QAAAM4"]
[Sun Dec 21 18:15:10.198995 2025] [:error] [pid 59068:tid 59113] [client 162.213.255.98:38136] [client 162.213.255.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.213.255.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfIrhmLyLqWUlrjwyc0wgAAAEw"]
[Sun Dec 21 18:15:12.049793 2025] [:error] [pid 59070:tid 59136] [client 162.213.255.98:38150] [client 162.213.255.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.213.255.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfIsH3dhXne9KX1kgLPdwAAAIg"]
[Sun Dec 21 18:15:47.953282 2025] [:error] [pid 59158:tid 59166] [client 198.54.114.54:37052] [client 198.54.114.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfI047NvyNF8ab5VgXfIQAAAMY"]
[Sun Dec 21 18:15:49.734534 2025] [:error] [pid 59067:tid 59076] [client 116.118.49.45:42060] [client 116.118.49.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.118.49.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfI1ctpsOP1NfIK_qIKpQAAAAI"]
[Sun Dec 21 18:15:49.774488 2025] [:error] [pid 59068:tid 59113] [client 198.54.114.54:37060] [client 198.54.114.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfI1RmLyLqWUlrjwyc1GgAAAEw"]
[Sun Dec 21 18:15:51.827651 2025] [:error] [pid 59068:tid 59115] [client 198.54.114.54:37068] [client 198.54.114.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfI1xmLyLqWUlrjwyc1HAAAAE4"]
[Sun Dec 21 18:15:52.995283 2025] [:error] [pid 59158:tid 59182] [client 116.118.49.45:42966] [client 116.118.49.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.118.49.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfI2I7NvyNF8ab5VgXfJwAAANY"]
[Sun Dec 21 18:15:54.781403 2025] [:error] [pid 59068:tid 59117] [client 116.118.49.45:43296] [client 116.118.49.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.118.49.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfI2hmLyLqWUlrjwyc1JwAAAFA"]
[Sun Dec 21 18:17:55.344272 2025] [:error] [pid 59158:tid 59169] [client 160.25.7.215:37680] [client 160.25.7.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.25.7.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfJU47NvyNF8ab5VgXgPgAAAMk"]
[Sun Dec 21 18:19:27.111212 2025] [:error] [pid 59067:tid 59097] [client 66.175.56.94:53058] [client 66.175.56.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.56.94, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUfJr8tpsOP1NfIK_qIMfwAAABc"]
[Sun Dec 21 18:19:30.357044 2025] [:error] [pid 59067:tid 59080] [client 66.175.56.94:53058] [client 66.175.56.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.56.94, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUfJsstpsOP1NfIK_qIMhgAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Sun Dec 21 20:18:32.040477 2025] [:error] [pid 59068:tid 59107] [client 104.161.60.216:59028] [client 104.161.60.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.161.60.216, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUflmBmLyLqWUlrjwyd5kwAAAEY"]
[Sun Dec 21 20:18:33.694728 2025] [:error] [pid 59067:tid 59093] [client 104.161.60.216:59034] [client 104.161.60.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.161.60.216, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUflmctpsOP1NfIK_qJLMQAAABM"]
[Sun Dec 21 20:18:35.352107 2025] [:error] [pid 59068:tid 59122] [client 104.161.60.216:52696] [client 104.161.60.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.161.60.216, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUflmxmLyLqWUlrjwyd5mQAAAFU"]
[Sun Dec 21 20:19:00.439141 2025] [:error] [pid 30183:tid 30204] [client 203.161.43.55:38540] [client 203.161.43.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.161.43.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfltOCmP2zCzk_WZcXnDAAAARM"]
[Sun Dec 21 20:19:02.282314 2025] [:error] [pid 59070:tid 59130] [client 203.161.43.55:38556] [client 203.161.43.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.161.43.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfltn3dhXne9KX1kgIxZQAAAII"]
[Sun Dec 21 20:19:03.994922 2025] [:error] [pid 30183:tid 30193] [client 203.161.43.55:54872] [client 203.161.43.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.161.43.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUflt-CmP2zCzk_WZcXnEwAAAQg"]
[Sun Dec 21 20:19:05.235046 2025] [:error] [pid 30183:tid 30199] [client 75.119.153.221:53098] [client 75.119.153.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 75.119.153.221, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUflueCmP2zCzk_WZcXnFgAAAQ4"]
[Sun Dec 21 20:19:13.452290 2025] [:error] [pid 30183:tid 30202] [client 75.119.153.221:53542] [client 75.119.153.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 75.119.153.221, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUflweCmP2zCzk_WZcXnKAAAARE"]
[Sun Dec 21 20:19:15.848151 2025] [:error] [pid 59158:tid 59174] [client 75.119.153.221:53660] [client 75.119.153.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 75.119.153.221, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUflw47NvyNF8ab5VgUoHQAAAM4"]
[Sun Dec 21 20:19:28.391811 2025] [:error] [pid 59070:tid 59146] [client 109.199.114.14:52808] [client 109.199.114.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.199.114.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfl0H3dhXne9KX1kgIx5wAAAJI"]
[Sun Dec 21 20:19:31.007491 2025] [:error] [pid 59158:tid 59166] [client 109.199.114.14:53134] [client 109.199.114.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.199.114.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfl047NvyNF8ab5VgUoKQAAAMY"]
[Sun Dec 21 20:19:33.274000 2025] [:error] [pid 30183:tid 30203] [client 109.199.114.14:53594] [client 109.199.114.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.199.114.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUfl1eCmP2zCzk_WZcXnbQAAARI"]
[Sun Dec 21 21:24:32.844663 2025] [:error] [pid 59067:tid 59098] [client 167.235.180.18:48532] [client 167.235.180.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.235.180.18, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUf1EMtpsOP1NfIK_qJmywAAABg"]
[Sun Dec 21 21:24:35.393519 2025] [:error] [pid 30183:tid 30201] [client 167.235.180.18:52598] [client 167.235.180.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.235.180.18, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUf1E-CmP2zCzk_WZcUMxwAAARA"]
[Sun Dec 21 21:24:37.494623 2025] [:error] [pid 59067:tid 59096] [client 167.235.180.18:52600] [client 167.235.180.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.235.180.18, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUf1FctpsOP1NfIK_qJm0wAAABY"]
[Sun Dec 21 21:25:05.755807 2025] [:error] [pid 59070:tid 59128] [client 194.181.228.70:49700] [client 194.181.228.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.181.228.70, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUf1MX3dhXne9KX1kgJPWAAAAIA"]
[Sun Dec 21 21:25:08.006279 2025] [:error] [pid 30183:tid 30199] [client 194.181.228.70:49716] [client 194.181.228.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.181.228.70, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUf1NOCmP2zCzk_WZcUNFQAAAQ4"]
[Sun Dec 21 21:25:10.213512 2025] [:error] [pid 59158:tid 59175] [client 194.181.228.70:37780] [client 194.181.228.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.181.228.70, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUf1No7NvyNF8ab5VgVEEQAAAM8"]
[Sun Dec 21 21:25:29.686747 2025] [:error] [pid 30183:tid 30194] [client 82.64.124.218:51160] [client 82.64.124.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.64.124.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUf1SeCmP2zCzk_WZcUNUgAAAQk"]
[Sun Dec 21 21:25:32.646134 2025] [:error] [pid 42755:tid 42758] [client 82.64.124.218:51170] [client 82.64.124.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.64.124.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUf1TOW0XvxgXMTJJbvP2wAAAUE"]
[Sun Dec 21 21:25:57.627055 2025] [:error] [pid 59068:tid 59108] [client 148.72.58.107:40858] [client 148.72.58.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.58.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUf1ZRmLyLqWUlrjwyeU3AAAAEc"]
[Sun Dec 21 21:25:59.044325 2025] [:error] [pid 59067:tid 59098] [client 148.72.58.107:40864] [client 148.72.58.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.58.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUf1Z8tpsOP1NfIK_qJnsAAAABg"]
[Sun Dec 21 21:26:00.410431 2025] [:error] [pid 59158:tid 59172] [client 148.72.58.107:40866] [client 148.72.58.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.58.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUf1aI7NvyNF8ab5VgVE-gAAAMw"]
[Sun Dec 21 21:37:39.971975 2025] [:error] [pid 59068:tid 59106] [client 136.114.39.1:63399] [client 136.114.39.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.114.39.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUf4IxmLyLqWUlrjwyeabgAAAEU"]
[Sun Dec 21 21:37:42.266474 2025] [:error] [pid 59068:tid 59125] [client 136.114.39.1:63399] [client 136.114.39.1] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aUf4JhmLyLqWUlrjwyeadAAAAFg"]
[Sun Dec 21 21:37:42.466507 2025] [:error] [pid 59068:tid 59119] [client 136.114.39.1:63399] [client 136.114.39.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.114.39.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUf4JhmLyLqWUlrjwyeadQAAAFI"]
[Sun Dec 21 21:37:43.900366 2025] [:error] [pid 59068:tid 59112] [client 136.114.39.1:52111] [client 136.114.39.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.114.39.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUf4JxmLyLqWUlrjwyeadgAAAEs"]
[Sun Dec 21 21:37:45.275197 2025] [:error] [pid 59070:tid 59136] [client 136.114.39.1:54842] [client 136.114.39.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.114.39.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUf4KX3dhXne9KX1kgJV1gAAAIg"]
[Sun Dec 21 21:47:04.158202 2025] [:error] [pid 59070:tid 59144] [client 136.118.100.6:62353] [client 136.118.100.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.118.100.6, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUf6WH3dhXne9KX1kgJZiAAAAJA"]
[Sun Dec 21 21:47:06.979942 2025] [:error] [pid 59070:tid 59128] [client 136.118.100.6:62353] [client 136.118.100.6] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aUf6Wn3dhXne9KX1kgJZjwAAAIA"]
[Sun Dec 21 21:47:07.155395 2025] [:error] [pid 59070:tid 59142] [client 136.118.100.6:62353] [client 136.118.100.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.118.100.6, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUf6W33dhXne9KX1kgJZkAAAAI4"]
[Sun Dec 21 21:47:08.485609 2025] [:error] [pid 59067:tid 59079] [client 136.118.100.6:56218] [client 136.118.100.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.118.100.6, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUf6XMtpsOP1NfIK_qJxgAAAAAU"]
[Sun Dec 21 21:47:09.842542 2025] [:error] [pid 30183:tid 30208] [client 136.118.100.6:58539] [client 136.118.100.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.118.100.6, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUf6XeCmP2zCzk_WZcUYMwAAARc"]
[Sun Dec 21 21:47:09.842713 2025] [:error] [pid 30183:tid 30208] [client 136.118.100.6:58539] [client 136.118.100.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 136.118.100.6, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUf6XeCmP2zCzk_WZcUYMwAAARc"]
[Sun Dec 21 22:59:38.139856 2025] [:error] [pid 65237:tid 65259] [client 101.46.50.116:37022] [client 101.46.50.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 101.46.50.116, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUgLWlVJYjxIpnUJfgJoLQAAAZQ"]
[Sun Dec 21 22:59:40.512703 2025] [:error] [pid 42755:tid 42757] [client 101.46.50.116:37026] [client 101.46.50.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 101.46.50.116, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUgLXOW0XvxgXMTJJbv_-gAAAUA"]
[Sun Dec 21 22:59:42.719763 2025] [:error] [pid 59070:tid 59129] [client 101.46.50.116:36926] [client 101.46.50.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 101.46.50.116, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUgLXn3dhXne9KX1kgJ5fgAAAIE"]
[Sun Dec 21 23:00:31.293219 2025] [:error] [pid 42755:tid 42757] [client 65.109.110.20:59226] [client 65.109.110.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.109.110.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUgLj-W0XvxgXMTJJbsAWQAAAUA"]
[Sun Dec 21 23:00:33.358367 2025] [:error] [pid 59068:tid 59117] [client 65.109.110.20:59228] [client 65.109.110.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.109.110.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUgLkRmLyLqWUlrjwye4ygAAAFA"]
[Sun Dec 21 23:00:35.348007 2025] [:error] [pid 59158:tid 59172] [client 65.109.110.20:59242] [client 65.109.110.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.109.110.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUgLk47NvyNF8ab5VgVyYwAAAMw"]
[Sun Dec 21 23:12:05.599887 2025] [:error] [pid 59068:tid 59112] [client 49.12.82.48:56720] [client 49.12.82.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 49.12.82.48, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUgORRmLyLqWUlrjwye7tQAAAEs"]
[Sun Dec 21 23:12:06.796817 2025] [:error] [pid 59068:tid 59107] [client 49.12.82.48:56720] [client 49.12.82.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 49.12.82.48, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUgORhmLyLqWUlrjwye7tgAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Sun Dec 21 23:14:39.586030 2025] [:error] [pid 59067:tid 59076] [client 159.75.126.74:49750] [client 159.75.126.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.75.126.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUgO38tpsOP1NfIK_qKRHgAAAAI"]
[Sun Dec 21 23:14:43.062626 2025] [:error] [pid 59067:tid 59091] [client 159.75.126.74:48514] [client 159.75.126.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.75.126.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUgO48tpsOP1NfIK_qKRJAAAABE"]
[Sun Dec 21 23:14:47.855455 2025] [:error] [pid 59068:tid 59105] [client 159.75.126.74:48526] [client 159.75.126.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.75.126.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUgO5xmLyLqWUlrjwye8aQAAAEQ"]
[Sun Dec 21 23:15:02.580306 2025] [:error] [pid 59068:tid 59122] [client 217.195.202.5:36454] [client 217.195.202.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.195.202.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUgO9hmLyLqWUlrjwye8dAAAAFU"]
[Sun Dec 21 23:15:04.807644 2025] [:error] [pid 65237:tid 65249] [client 217.195.202.5:40580] [client 217.195.202.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.195.202.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUgO-FVJYjxIpnUJfgJsRAAAAYo"]
[Sun Dec 21 23:15:07.131572 2025] [:error] [pid 42755:tid 42758] [client 217.195.202.5:40586] [client 217.195.202.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.195.202.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUgO--W0XvxgXMTJJbsFMAAAAUE"]
[Mon Dec 22 00:50:09.678412 2025] [:error] [pid 46403:tid 46422] [client 103.28.37.47:39534] [client 103.28.37.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.28.37.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUglQVuzQIlydmAwinpWKgAAAZE"]
[Mon Dec 22 00:50:12.012308 2025] [:error] [pid 45308:tid 45346] [client 103.28.37.47:39612] [client 103.28.37.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.28.37.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUglRGQKrTzAeGeriX3CpgAAAII"]
[Mon Dec 22 00:50:13.967732 2025] [:error] [pid 45309:tid 45375] [client 103.28.37.47:39702] [client 103.28.37.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.28.37.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUglRYitmFVpLjGlR3i6sAAAAMQ"]
[Mon Dec 22 00:50:24.322911 2025] [:error] [pid 45308:tid 45363] [client 147.50.228.209:41822] [client 147.50.228.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.50.228.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUglUGQKrTzAeGeriX3CxwAAAJM"]
[Mon Dec 22 00:50:26.881656 2025] [:error] [pid 45308:tid 45362] [client 147.50.228.209:42002] [client 147.50.228.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.50.228.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUglUmQKrTzAeGeriX3CzQAAAJI"]
[Mon Dec 22 00:50:29.019282 2025] [:error] [pid 45308:tid 45350] [client 147.50.228.209:42142] [client 147.50.228.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.50.228.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUglVWQKrTzAeGeriX3C1QAAAIY"]
[Mon Dec 22 00:51:42.062408 2025] [:error] [pid 46403:tid 46429] [client 185.88.152.215:13630] [client 185.88.152.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.88.152.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUglnluzQIlydmAwinpWYgAAAZg"]
[Mon Dec 22 00:51:44.765314 2025] [:error] [pid 46343:tid 46352] [client 185.88.152.215:13638] [client 185.88.152.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.88.152.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUgloBzbW_u_EvstJwQhvAAAAAY"]
[Mon Dec 22 00:51:47.310762 2025] [:error] [pid 45306:tid 45323] [client 185.88.152.215:13648] [client 185.88.152.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.88.152.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUglo9sL27CzxZxVWqQpMwAAAEc"]
[Mon Dec 22 01:41:40.837449 2025] [:error] [pid 45309:tid 45373] [client 31.217.165.166:20037] [client 31.217.165.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.217.165.166, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUgxVIitmFVpLjGlR3jJBgAAAMI"]
[Mon Dec 22 01:42:08.726351 2025] [:error] [pid 45308:tid 45368] [client 177.105.82.243:23906] [client 177.105.82.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.105.82.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUgxcGQKrTzAeGeriX3UwgAAAJg"]
[Mon Dec 22 02:39:21.936060 2025] [:error] [pid 45308:tid 45366] [client 82.165.80.242:36694] [client 82.165.80.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.80.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUg-2WQKrTzAeGeriX3nxQAAAJY"]
[Mon Dec 22 02:39:24.365464 2025] [:error] [pid 45308:tid 45351] [client 82.165.80.242:36700] [client 82.165.80.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.80.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUg-3GQKrTzAeGeriX3nywAAAIc"]
[Mon Dec 22 02:39:26.115773 2025] [:error] [pid 46403:tid 46419] [client 194.36.191.196:44012] [client 194.36.191.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.36.191.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUg-3luzQIlydmAwinpt_QAAAY4"]
[Mon Dec 22 02:39:26.709621 2025] [:error] [pid 45308:tid 45358] [client 82.165.80.242:36710] [client 82.165.80.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.80.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUg-3mQKrTzAeGeriX3n0wAAAI4"]
[Mon Dec 22 02:39:28.084377 2025] [:error] [pid 46403:tid 46426] [client 194.36.191.196:44150] [client 194.36.191.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.36.191.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUg-4FuzQIlydmAwinpuAAAAAZU"]
[Mon Dec 22 02:39:30.058238 2025] [:error] [pid 46374:tid 46400] [client 194.36.191.196:44252] [client 194.36.191.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.36.191.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUg-4hLD7sK-wqrnXHUrwAAAAVg"]
[Mon Dec 22 02:39:45.700274 2025] [:error] [pid 45309:tid 45377] [client 51.83.184.21:33254] [client 51.83.184.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.184.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUg-8YitmFVpLjGlR3jX_AAAAMY"]
[Mon Dec 22 02:39:48.489702 2025] [:error] [pid 45309:tid 45379] [client 51.83.184.21:33266] [client 51.83.184.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.184.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUg-9IitmFVpLjGlR3jX_gAAAMg"]
[Mon Dec 22 02:39:51.332538 2025] [:error] [pid 45399:tid 45406] [client 51.83.184.21:33278] [client 51.83.184.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.184.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUg-9zHbaarUHjCTA4uZSgAAAQU"]
[Mon Dec 22 02:42:20.222620 2025] [:error] [pid 46403:tid 46409] [client 177.105.82.243:23699] [client 177.105.82.243] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aUg_jFuzQIlydmAwinpujQAAAYQ"]
[Mon Dec 22 02:43:50.638797 2025] [:error] [pid 45308:tid 45364] [client 177.105.82.243:23881] [client 177.105.82.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.105.82.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUg_5mQKrTzAeGeriX3o2gAAAJQ"]
[Mon Dec 22 02:45:02.206691 2025] [:error] [pid 46343:tid 46355] [client 177.105.82.243:24374] [client 177.105.82.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.105.82.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhALhzbW_u_EvstJwQ3pwAAAAk"]
[Mon Dec 22 02:46:09.913025 2025] [:error] [pid 45399:tid 45412] [client 177.105.82.243:23849] [client 177.105.82.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.105.82.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhAcTHbaarUHjCTA4uatAAAAQs"]
[Mon Dec 22 02:47:23.024811 2025] [:error] [pid 45399:tid 45416] [client 177.105.82.243:24202] [client 177.105.82.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.105.82.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhAuzHbaarUHjCTA4ua8AAAAQ8"]
[Mon Dec 22 02:48:34.241974 2025] [:error] [pid 46374:tid 46382] [client 177.105.82.243:24130] [client 177.105.82.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.105.82.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhBAhLD7sK-wqrnXHUtTAAAAUY"]
[Mon Dec 22 03:29:00.080740 2025] [:error] [pid 45399:tid 45422] [client 119.23.233.229:34484] [client 119.23.233.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 119.23.233.229, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhKfDHbaarUHjCTA4ulmAAAARU"]
[Mon Dec 22 03:29:04.683125 2025] [:error] [pid 45308:tid 45350] [client 119.23.233.229:34644] [client 119.23.233.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 119.23.233.229, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhKgGQKrTzAeGeriX34LgAAAIY"]
[Mon Dec 22 03:29:13.081545 2025] [:error] [pid 46374:tid 46399] [client 44.196.195.110:33898] [client 44.196.195.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 44.196.195.110, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhKiRLD7sK-wqrnXHU1pgAAAVc"]
[Mon Dec 22 03:29:14.646479 2025] [:error] [pid 45399:tid 45421] [client 44.196.195.110:47606] [client 44.196.195.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 44.196.195.110, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhKijHbaarUHjCTA4ulmwAAARQ"]
[Mon Dec 22 03:29:16.216422 2025] [:error] [pid 45308:tid 45353] [client 44.196.195.110:47610] [client 44.196.195.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 44.196.195.110, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhKjGQKrTzAeGeriX34PAAAAIk"]
[Mon Dec 22 03:29:17.719980 2025] [:error] [pid 45309:tid 45377] [client 119.23.233.229:34654] [client 119.23.233.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 119.23.233.229, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhKjYitmFVpLjGlR3jlNQAAAMY"]
[Mon Dec 22 03:30:42.166662 2025] [:error] [pid 45309:tid 45393] [client 47.52.209.228:55236] [client 47.52.209.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.52.209.228, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhK4oitmFVpLjGlR3jlwAAAANY"]
[Mon Dec 22 03:30:43.709400 2025] [:error] [pid 46343:tid 46365] [client 47.52.209.228:55294] [client 47.52.209.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.52.209.228, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhK4xzbW_u_EvstJwRAqQAAABM"]
[Mon Dec 22 03:30:45.116073 2025] [:error] [pid 45308:tid 45351] [client 47.52.209.228:55316] [client 47.52.209.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.52.209.228, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhK5WQKrTzAeGeriX347gAAAIc"]
[Mon Dec 22 03:31:12.117769 2025] [:error] [pid 46343:tid 46370] [client 51.83.184.21:56304] [client 51.83.184.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.184.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhLABzbW_u_EvstJwRAugAAABg"]
[Mon Dec 22 03:31:14.448248 2025] [:error] [pid 46403:tid 46419] [client 51.83.184.21:35480] [client 51.83.184.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.184.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhLAluzQIlydmAwinp5IgAAAY4"]
[Mon Dec 22 03:31:16.515668 2025] [:error] [pid 45308:tid 45347] [client 51.83.184.21:35486] [client 51.83.184.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.184.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhLBGQKrTzAeGeriX35HAAAAIM"]
[Mon Dec 22 03:31:21.715864 2025] [:error] [pid 46403:tid 46414] [client 116.118.49.45:44206] [client 116.118.49.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.118.49.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhLCVuzQIlydmAwinp5KQAAAYk"]
[Mon Dec 22 03:31:23.459870 2025] [:error] [pid 45308:tid 45360] [client 116.118.49.45:44388] [client 116.118.49.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.118.49.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhLC2QKrTzAeGeriX35IAAAAJA"]
[Mon Dec 22 03:31:25.269166 2025] [:error] [pid 46374:tid 46393] [client 116.118.49.45:44588] [client 116.118.49.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.118.49.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhLDRLD7sK-wqrnXHU2KwAAAVE"]
[Mon Dec 22 03:31:40.287780 2025] [:error] [pid 46374:tid 46393] [client 45.76.22.255:54830] [client 45.76.22.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.76.22.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhLHBLD7sK-wqrnXHU2NwAAAVE"]
[Mon Dec 22 03:31:42.589939 2025] [:error] [pid 46343:tid 46356] [client 45.76.22.255:37482] [client 45.76.22.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.76.22.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhLHhzbW_u_EvstJwRA3gAAAAo"]
[Mon Dec 22 03:31:44.070625 2025] [:error] [pid 46403:tid 46413] [client 45.76.22.255:37486] [client 45.76.22.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.76.22.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhLIFuzQIlydmAwinp5QgAAAYg"]
[Mon Dec 22 03:41:52.603984 2025] [:error] [pid 38256:tid 38258] [client 162.241.218.100:16000] [client 162.241.218.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.218.100, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhNgE-Ean7_bmDFZvKZKwAAAMA"]
[Mon Dec 22 05:18:02.606913 2025] [:error] [pid 33565:tid 33596] [client 83.166.133.68:47458] [client 83.166.133.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.166.133.68, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhkCtOWX69q8T0m_yJt6QAAAkI"]
[Mon Dec 22 05:18:05.157191 2025] [:error] [pid 33440:tid 33456] [client 83.166.133.68:47466] [client 83.166.133.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.166.133.68, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhkDZOsUWKqgxu6QTResAAAAQ4"]
[Mon Dec 22 05:18:07.315696 2025] [:error] [pid 58078:tid 58103] [client 83.166.133.68:47480] [client 83.166.133.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.166.133.68, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhkD5WKg9Bf8njHlB5jwgAAABQ"]
[Mon Dec 22 05:41:52.347946 2025] [:error] [pid 33471:tid 33474] [client 49.7.227.204:33700] [client 49.7.227.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUhpoL5BeNE7regJ7ix7JgAAAUA"]
[Mon Dec 22 06:00:26.620078 2025] [:error] [pid 33440:tid 33460] [client 168.232.228.224:58632] [client 168.232.228.224] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aUht-pOsUWKqgxu6QTRl-gAAARI"]
[Mon Dec 22 06:02:05.660784 2025] [:error] [pid 33535:tid 33561] [client 168.232.228.224:59826] [client 168.232.228.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.232.228.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhuXWOCI8D9Xtn-n7TivgAAAdg"]
[Mon Dec 22 06:03:33.814032 2025] [:error] [pid 33535:tid 33543] [client 168.232.228.224:59454] [client 168.232.228.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.232.228.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhutWOCI8D9Xtn-n7TjEgAAAcY"]
[Mon Dec 22 06:05:06.402879 2025] [:error] [pid 33565:tid 33608] [client 168.232.228.224:57550] [client 168.232.228.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.232.228.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhvEtOWX69q8T0m_yJ2_AAAAk4"]
[Mon Dec 22 06:06:21.807486 2025] [:error] [pid 33471:tid 33481] [client 168.232.228.224:59111] [client 168.232.228.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.232.228.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhvXb5BeNE7regJ7iyA-wAAAUc"]
[Mon Dec 22 06:07:41.615668 2025] [:error] [pid 58079:tid 58131] [client 168.232.228.224:57035] [client 168.232.228.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.232.228.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUhvrXxLB7WYaNS5A7jI5AAAAFI"]
[Mon Dec 22 06:39:41.085101 2025] [:error] [pid 33564:tid 33578] [client 31.214.178.111:37876] [client 31.214.178.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.214.178.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUh3LQSHeG6oLmMnKY6y3gAAAgs"]
[Mon Dec 22 06:39:43.807310 2025] [:error] [pid 33440:tid 33466] [client 31.214.178.111:37260] [client 31.214.178.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.214.178.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUh3L5OsUWKqgxu6QTRtIwAAARg"]
[Mon Dec 22 07:01:34.616105 2025] [:error] [pid 33472:tid 33508] [client 185.221.182.158:7427] [client 185.221.182.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.221.182.158, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUh8Tp5p2WQpPIK8HAkphQAAAYc"]
[Mon Dec 22 07:01:36.772991 2025] [:error] [pid 58078:tid 58101] [client 185.221.182.158:5896] [client 185.221.182.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.221.182.158, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUh8UJWKg9Bf8njHlB56QAAAABI"]
[Mon Dec 22 07:01:38.907961 2025] [:error] [pid 33472:tid 33521] [client 185.221.182.158:53215] [client 185.221.182.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.221.182.158, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUh8Up5p2WQpPIK8HAkpiAAAAZQ"]
[Mon Dec 22 07:16:38.213542 2025] [:error] [pid 33565:tid 33614] [client 31.217.165.166:51995] [client 31.217.165.166] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aUh_1tOWX69q8T0m_yKCwgAAAlQ"]
[Mon Dec 22 07:17:52.886387 2025] [:error] [pid 33564:tid 33568] [client 31.217.165.166:61326] [client 31.217.165.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.217.165.166, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUiAIASHeG6oLmMnKY6-tAAAAgE"]
[Mon Dec 22 07:19:12.482878 2025] [:error] [pid 58078:tid 58091] [client 31.217.165.166:7631] [client 31.217.165.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.217.165.166, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUiAcJWKg9Bf8njHlB59vQAAAAg"]
[Mon Dec 22 07:20:23.368213 2025] [:error] [pid 33440:tid 33455] [client 31.217.165.166:56928] [client 31.217.165.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.217.165.166, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUiAt5OsUWKqgxu6QTR0cAAAAQ0"]
[Mon Dec 22 07:21:32.205296 2025] [:error] [pid 33440:tid 33457] [client 31.217.165.166:24734] [client 31.217.165.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.217.165.166, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUiA_JOsUWKqgxu6QTR0mAAAAQ8"]
[Mon Dec 22 07:22:36.515484 2025] [:error] [pid 33535:tid 33550] [client 31.217.165.166:65289] [client 31.217.165.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.217.165.166, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUiBPGOCI8D9Xtn-n7T1qwAAAc0"]
[Mon Dec 22 07:37:04.448405 2025] [:error] [pid 33471:tid 33477] [client 125.253.125.105:50440] [client 125.253.125.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 125.253.125.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUiEoL5BeNE7regJ7iyZaQAAAUM"]
[Mon Dec 22 07:37:06.406227 2025] [:error] [pid 33440:tid 33462] [client 125.253.125.105:50442] [client 125.253.125.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 125.253.125.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUiEopOsUWKqgxu6QTR3SwAAARQ"]
[Mon Dec 22 07:37:08.217255 2025] [:error] [pid 33471:tid 33498] [client 125.253.125.105:50444] [client 125.253.125.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 125.253.125.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUiEpL5BeNE7regJ7iyZbAAAAVg"]
[Mon Dec 22 07:37:33.710073 2025] [:error] [pid 58172:tid 58197] [client 52.13.171.147:52772] [client 52.13.171.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUiEveSVKDT5jWOcnSUJAQAAANc"]
[Mon Dec 22 07:37:34.507935 2025] [:error] [pid 33535:tid 33542] [client 52.13.171.147:62194] [client 52.13.171.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aUiEvmOCI8D9Xtn-n7T5XgAAAcU"]
[Mon Dec 22 07:37:41.057095 2025] [:error] [pid 58079:tid 58119] [client 167.99.85.231:42266] [client 167.99.85.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.85.231, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUiExXxLB7WYaNS5A7ja4AAAAEY"]
[Mon Dec 22 07:37:43.398706 2025] [:error] [pid 33535:tid 33548] [client 167.99.85.231:42280] [client 167.99.85.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.85.231, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUiEx2OCI8D9Xtn-n7T5ewAAAcs"]
[Mon Dec 22 07:37:45.596977 2025] [:error] [pid 33535:tid 33550] [client 167.99.85.231:58854] [client 167.99.85.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.85.231, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUiEyWOCI8D9Xtn-n7T5fQAAAc0"]
[Mon Dec 22 07:57:06.976719 2025] [:error] [pid 33471:tid 33477] [client 38.100.119.103:43376] [client 38.100.119.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.100.119.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUiJUr5BeNE7regJ7iygIQAAAUM"]
[Mon Dec 22 07:57:08.799618 2025] [:error] [pid 33564:tid 33585] [client 38.100.119.103:54832] [client 38.100.119.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.100.119.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUiJVASHeG6oLmMnKY7P5AAAAhI"]
[Mon Dec 22 07:57:10.646694 2025] [:error] [pid 58172:tid 58182] [client 38.100.119.103:54840] [client 38.100.119.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.100.119.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUiJVuSVKDT5jWOcnSUMYAAAAMg"]
[Mon Dec 22 07:57:20.010731 2025] [:error] [pid 33471:tid 33477] [client 91.206.200.163:17220] [client 91.206.200.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.206.200.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUiJX75BeNE7regJ7iygLQAAAUM"]
[Mon Dec 22 07:57:22.603304 2025] [:error] [pid 33564:tid 33579] [client 91.206.200.163:17222] [client 91.206.200.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.206.200.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUiJYgSHeG6oLmMnKY7P9QAAAgw"]
[Mon Dec 22 07:57:25.211058 2025] [:error] [pid 33472:tid 33506] [client 91.206.200.163:17226] [client 91.206.200.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.206.200.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUiJZJ5p2WQpPIK8HAk0LQAAAYU"]
[Mon Dec 22 09:50:51.811529 2025] [:error] [pid 58079:tid 58127] [client 147.50.228.209:56370] [client 147.50.228.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.50.228.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUij-3xLB7WYaNS5A7jyygAAAE4"]
[Mon Dec 22 09:50:54.474951 2025] [:error] [pid 33440:tid 33464] [client 147.50.228.209:56588] [client 147.50.228.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.50.228.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUij_pOsUWKqgxu6QTSPpQAAARY"]
[Mon Dec 22 09:50:57.267807 2025] [:error] [pid 33472:tid 33506] [client 147.50.228.209:56790] [client 147.50.228.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.50.228.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUikAZ5p2WQpPIK8HAlLcAAAAYU"]
[Mon Dec 22 10:21:46.833852 2025] [:error] [pid 58078:tid 58094] [client 103.131.74.10:60745] [client 103.131.74.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.131.74.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUirOpWKg9Bf8njHlB6nKAAAAAs"]
[Mon Dec 22 10:21:50.559324 2025] [:error] [pid 33471:tid 33494] [client 103.131.74.10:60793] [client 103.131.74.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.131.74.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUirPr5BeNE7regJ7izHAAAAAVQ"]
[Mon Dec 22 10:21:52.977373 2025] [:error] [pid 33535:tid 33553] [client 103.131.74.10:60847] [client 103.131.74.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.131.74.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUirQGOCI8D9Xtn-n7QdogAAAdA"]
[Mon Dec 22 10:22:41.981809 2025] [:error] [pid 33471:tid 33485] [client 103.110.85.91:55818] [client 103.110.85.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.85.91, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUircb5BeNE7regJ7izHFwAAAUs"]
[Mon Dec 22 10:22:43.709429 2025] [:error] [pid 56155:tid 56244] [client 103.110.85.91:55908] [client 103.110.85.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.85.91, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUirc2G8a3wQucsuN657UgAAA5Y"]
[Mon Dec 22 10:22:45.249941 2025] [:error] [pid 33440:tid 33444] [client 103.110.85.91:55998] [client 103.110.85.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.85.91, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUirdZOsUWKqgxu6QTSXLgAAAQI"]
[Mon Dec 22 10:23:19.867828 2025] [:error] [pid 33471:tid 33478] [client 185.213.165.10:11624] [client 185.213.165.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.213.165.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUirl75BeNE7regJ7izHMAAAAUQ"]
[Mon Dec 22 10:23:24.016801 2025] [:error] [pid 33472:tid 33512] [client 185.213.165.10:11630] [client 185.213.165.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.213.165.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUirnJ5p2WQpPIK8HAlUDQAAAYs"]
[Mon Dec 22 10:23:27.417771 2025] [:error] [pid 56044:tid 56055] [client 185.213.165.10:38782] [client 185.213.165.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.213.165.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUirn-60uUaieriJqP3u0QAAAIc"]
[Mon Dec 22 13:14:17.318965 2025] [:error] [pid 33471:tid 33498] [client 197.159.69.253:54570] [client 197.159.69.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.159.69.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUjTqL5BeNE7regJ7izrwwAAAVg"]
[Mon Dec 22 13:14:20.359166 2025] [:error] [pid 33564:tid 33583] [client 197.159.69.253:54574] [client 197.159.69.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.159.69.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUjTqwSHeG6oLmMnKY4yTgAAAhA"]
[Mon Dec 22 13:14:23.375290 2025] [:error] [pid 33440:tid 33466] [client 197.159.69.253:54584] [client 197.159.69.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.159.69.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUjTrpOsUWKqgxu6QTTExAAAARg"]
[Mon Dec 22 13:14:34.514207 2025] [:error] [pid 33564:tid 33568] [client 118.190.215.162:45218] [client 118.190.215.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.190.215.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUjTugSHeG6oLmMnKY4yXgAAAgE"]
[Mon Dec 22 13:14:45.460522 2025] [:error] [pid 33440:tid 33465] [client 118.190.215.162:45334] [client 118.190.215.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.190.215.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUjTxZOsUWKqgxu6QTTE0AAAARc"]
[Mon Dec 22 13:14:49.218023 2025] [:error] [pid 33472:tid 33512] [client 118.190.215.162:45394] [client 118.190.215.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.190.215.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUjTyZ5p2WQpPIK8HAmfggAAAYs"]
[Mon Dec 22 15:27:37.067698 2025] [:error] [pid 33535:tid 33556] [client 117.4.254.166:37190] [client 117.4.254.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.4.254.166, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUjy6WOCI8D9Xtn-n7RvyAAAAdM"]
[Mon Dec 22 15:27:39.143579 2025] [:error] [pid 33535:tid 33553] [client 117.4.254.166:37206] [client 117.4.254.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.4.254.166, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUjy62OCI8D9Xtn-n7RvzQAAAdA"]
[Mon Dec 22 15:27:41.623473 2025] [:error] [pid 33535:tid 33547] [client 117.4.254.166:38180] [client 117.4.254.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.4.254.166, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUjy7WOCI8D9Xtn-n7Rv0QAAAco"]
[Mon Dec 22 15:27:45.828107 2025] [:error] [pid 56044:tid 56061] [client 51.79.229.102:58118] [client 51.79.229.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.79.229.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUjy8e60uUaieriJqP0pcAAAAI0"]
[Mon Dec 22 15:27:47.251988 2025] [:error] [pid 33564:tid 33570] [client 51.79.229.102:58124] [client 51.79.229.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.79.229.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUjy8wSHeG6oLmMnKY5RhAAAAgM"]
[Mon Dec 22 15:27:48.689977 2025] [:error] [pid 33564:tid 33580] [client 51.79.229.102:58136] [client 51.79.229.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.79.229.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUjy9ASHeG6oLmMnKY5RiAAAAg0"]
[Mon Dec 22 16:56:02.155072 2025] [:error] [pid 58078:tid 58094] [client 43.130.110.130:35312] [client 43.130.110.130] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aUkHopWKg9Bf8njHlB7wzgAAAAs"]
[Mon Dec 22 17:03:13.193658 2025] [:error] [pid 33564:tid 33578] [client 178.254.44.29:47480] [client 178.254.44.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.254.44.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUkJUQSHeG6oLmMnKY54NwAAAgs"]
[Mon Dec 22 17:03:15.862507 2025] [:error] [pid 33471:tid 33478] [client 178.254.44.29:47486] [client 178.254.44.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.254.44.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUkJU75BeNE7regJ7iwanwAAAUQ"]
[Mon Dec 22 17:03:18.030332 2025] [:error] [pid 58172:tid 58178] [client 178.254.44.29:47488] [client 178.254.44.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.254.44.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUkJVuSVKDT5jWOcnSWk4QAAAMQ"]
[Mon Dec 22 18:46:37.229724 2025] [:error] [pid 33440:tid 33459] [client 202.95.15.60:59058] [client 202.95.15.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.95.15.60, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUkhjZOsUWKqgxu6QTQXYQAAARE"]
[Mon Dec 22 18:46:39.440901 2025] [:error] [pid 33535:tid 33538] [client 202.95.15.60:59206] [client 202.95.15.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.95.15.60, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUkhj2OCI8D9Xtn-n7Sk7AAAAcE"]
[Mon Dec 22 18:46:41.463755 2025] [:error] [pid 33564:tid 33582] [client 202.95.15.60:59352] [client 202.95.15.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.95.15.60, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUkhkQSHeG6oLmMnKY6hqgAAAg8"]
[Mon Dec 22 18:47:53.889694 2025] [:error] [pid 58172:tid 58180] [client 185.175.198.237:4414] [client 185.175.198.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.175.198.237, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUkh2eSVKDT5jWOcnSXJPwAAAMY"]
[Mon Dec 22 18:47:56.211187 2025] [:error] [pid 56155:tid 56228] [client 185.175.198.237:28750] [client 185.175.198.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.175.198.237, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUkh3GG8a3wQucsuN67bPAAAA4Y"]
[Mon Dec 22 18:47:58.469695 2025] [:error] [pid 33564:tid 33580] [client 185.175.198.237:28760] [client 185.175.198.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.175.198.237, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUkh3gSHeG6oLmMnKY6iFAAAAg0"]
[Mon Dec 22 20:48:16.872501 2025] [:error] [pid 58172:tid 58186] [client 103.65.236.153:62898] [client 103.65.236.153] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aUk-EOSVKDT5jWOcnSXzqgAAAMw"]
[Mon Dec 22 20:57:42.034923 2025] [:error] [pid 56044:tid 56058] [client 104.234.134.18:41050] [client 104.234.134.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.134.18, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUlARu60uUaieriJqP1wvAAAAIo"]
[Mon Dec 22 20:57:42.998705 2025] [:error] [pid 56044:tid 56048] [client 104.234.134.18:41050] [client 104.234.134.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.134.18, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUlARu60uUaieriJqP1wvgAAAIA"], referer: https://expressinteriors.com/wp-login.php
[Mon Dec 22 21:56:32.998438 2025] [:error] [pid 33471:tid 33479] [client 84.16.76.227:51946] [client 84.16.76.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.16.76.227, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUlOEL5BeNE7regJ7ixYDQAAAUU"]
[Mon Dec 22 21:56:35.158983 2025] [:error] [pid 58172:tid 58174] [client 84.16.76.227:52182] [client 84.16.76.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.16.76.227, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUlOE-SVKDT5jWOcnSUIQAAAAMA"]
[Mon Dec 22 21:56:37.209974 2025] [:error] [pid 56155:tid 56245] [client 84.16.76.227:52344] [client 84.16.76.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.16.76.227, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUlOFWG8a3wQucsuN64B8wAAA5c"]
[Mon Dec 22 22:42:21.418210 2025] [:error] [pid 58078:tid 58101] [client 161.248.201.51:45376] [client 161.248.201.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.248.201.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUlYzZWKg9Bf8njHlB5zLAAAABI"]
[Mon Dec 22 22:42:25.953780 2025] [:error] [pid 56155:tid 56224] [client 161.248.201.51:56108] [client 161.248.201.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.248.201.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUlY0WG8a3wQucsuN64I0QAAA4I"], referer: https://expressinteriors.com/wp-login.php
[Tue Dec 23 01:14:25.270448 2025] [:error] [pid 40361:tid 40384] [client 161.248.201.51:56828] [client 161.248.201.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.248.201.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUl8cexiDEK95vL2EDq7ggAAAFU"]
[Tue Dec 23 01:14:26.390255 2025] [:error] [pid 40361:tid 40370] [client 161.248.201.51:56828] [client 161.248.201.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.248.201.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUl8cuxiDEK95vL2EDq7hQAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Tue Dec 23 01:23:18.435895 2025] [:error] [pid 40268:tid 40311] [client 65.109.226.46:43568] [client 65.109.226.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.109.226.46, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUl-hpWtCyS5tdJAiFxQ9AAAAMk"]
[Tue Dec 23 01:23:21.644538 2025] [:error] [pid 40267:tid 40293] [client 65.109.226.46:44258] [client 65.109.226.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.109.226.46, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUl-ieTPWWVt2GkrftBhGQAAABQ"]
[Tue Dec 23 01:23:24.357484 2025] [:error] [pid 40267:tid 40291] [client 65.109.226.46:44262] [client 65.109.226.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.109.226.46, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUl-jOTPWWVt2GkrftBhGwAAABI"]
[Tue Dec 23 01:56:20.017282 2025] [:error] [pid 40267:tid 40287] [client 103.56.237.252:15732] [client 103.56.237.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.56.237.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUmGROTPWWVt2GkrftByEQAAAA4"]
[Tue Dec 23 02:01:19.300651 2025] [:error] [pid 40269:tid 40329] [client 103.56.237.252:15996] [client 103.56.237.252] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aUmHby06Z11fTcfdsqTtGAAAAQA"]
[Tue Dec 23 02:02:55.018595 2025] [:error] [pid 40269:tid 40338] [client 103.56.237.252:56686] [client 103.56.237.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.56.237.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUmHzy06Z11fTcfdsqTtswAAAQk"]
[Tue Dec 23 02:04:28.008815 2025] [:error] [pid 40361:tid 40373] [client 103.56.237.252:15583] [client 103.56.237.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.56.237.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUmILOxiDEK95vL2EDrdiQAAAEo"]
[Tue Dec 23 02:05:52.765459 2025] [:error] [pid 40267:tid 40297] [client 103.56.237.252:15740] [client 103.56.237.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.56.237.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUmIgOTPWWVt2GkrftB2vgAAABg"]
[Tue Dec 23 02:07:24.404077 2025] [:error] [pid 40269:tid 40332] [client 103.56.237.252:15568] [client 103.56.237.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.56.237.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUmI3C06Z11fTcfdsqTv3wAAAQM"]
[Tue Dec 23 02:17:00.202760 2025] [:error] [pid 40361:tid 40374] [client 104.219.248.74:33410] [client 104.219.248.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.219.248.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUmLHOxiDEK95vL2EDrltQAAAEs"]
[Tue Dec 23 02:17:01.816939 2025] [:error] [pid 40268:tid 40322] [client 110.41.168.129:55016] [client 110.41.168.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.41.168.129, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUmLHZWtCyS5tdJAiFxpFgAAANQ"]
[Tue Dec 23 02:17:02.068814 2025] [:error] [pid 40267:tid 40279] [client 104.219.248.74:33424] [client 104.219.248.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.219.248.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUmLHuTPWWVt2GkrftB9DgAAAAY"]
[Tue Dec 23 02:17:03.836505 2025] [:error] [pid 40361:tid 40366] [client 104.219.248.74:33432] [client 104.219.248.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.219.248.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUmLH-xiDEK95vL2EDrlwAAAAEM"]
[Tue Dec 23 02:17:04.790282 2025] [:error] [pid 40361:tid 40376] [client 110.41.168.129:46810] [client 110.41.168.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.41.168.129, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUmLIOxiDEK95vL2EDrlxgAAAE0"]
[Tue Dec 23 02:17:08.598357 2025] [:error] [pid 40267:tid 40274] [client 110.41.168.129:46820] [client 110.41.168.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.41.168.129, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUmLJOTPWWVt2GkrftB9HwAAAAE"]
[Tue Dec 23 02:18:51.700887 2025] [:error] [pid 40269:tid 40337] [client 149.88.70.71:59100] [client 149.88.70.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.88.70.71, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUmLiy06Z11fTcfdsqT1dAAAAQg"]
[Tue Dec 23 02:18:53.435314 2025] [:error] [pid 40267:tid 40286] [client 149.88.70.71:59125] [client 149.88.70.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.88.70.71, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUmLjeTPWWVt2GkrftB-CAAAAA0"]
[Tue Dec 23 02:18:55.094024 2025] [:error] [pid 40267:tid 40288] [client 149.88.70.71:59148] [client 149.88.70.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.88.70.71, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUmLj-TPWWVt2GkrftB-CgAAAA8"]
[Tue Dec 23 02:19:22.674399 2025] [:error] [pid 40268:tid 40318] [client 5.75.166.124:35104] [client 5.75.166.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.75.166.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUmLqpWtCyS5tdJAiFxqNwAAANA"]
[Tue Dec 23 02:19:25.437634 2025] [:error] [pid 40269:tid 40335] [client 5.75.166.124:40598] [client 5.75.166.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.75.166.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUmLrS06Z11fTcfdsqT2KAAAAQY"]
[Tue Dec 23 02:19:28.339106 2025] [:error] [pid 40269:tid 40346] [client 5.75.166.124:40610] [client 5.75.166.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.75.166.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUmLsC06Z11fTcfdsqT2MAAAARE"]
[Tue Dec 23 02:19:42.237130 2025] [:error] [pid 40268:tid 40323] [client 87.107.172.205:36124] [client 87.107.172.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.107.172.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUmLvpWtCyS5tdJAiFxqjQAAANU"]
[Tue Dec 23 02:19:47.081066 2025] [:error] [pid 40268:tid 40307] [client 87.107.172.205:36274] [client 87.107.172.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.107.172.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUmLw5WtCyS5tdJAiFxqtgAAAMU"]
[Tue Dec 23 02:19:51.007592 2025] [:error] [pid 40267:tid 40278] [client 87.107.172.205:36400] [client 87.107.172.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.107.172.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUmLx-TPWWVt2GkrftB_0wAAAAU"]
[Tue Dec 23 02:48:52.053678 2025] [:error] [pid 40361:tid 40372] [client 195.24.236.147:56099] [client 195.24.236.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUmSlOxiDEK95vL2EDr4qwAAAEk"]
[Tue Dec 23 02:48:52.710613 2025] [:error] [pid 40361:tid 40372] [client 195.24.236.147:56249] [client 195.24.236.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUmSlOxiDEK95vL2EDr4yAAAAEk"]
[Tue Dec 23 02:48:53.356298 2025] [:error] [pid 40361:tid 40368] [client 195.24.236.147:56383] [client 195.24.236.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUmSlexiDEK95vL2EDr45QAAAEU"]
[Tue Dec 23 02:48:54.070712 2025] [:error] [pid 40268:tid 40308] [client 195.24.236.147:56527] [client 195.24.236.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUmSlpWtCyS5tdJAiFx1sQAAAMY"]
[Tue Dec 23 02:48:54.733192 2025] [:error] [pid 40269:tid 40348] [client 195.24.236.147:56660] [client 195.24.236.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUmSli06Z11fTcfdsqQCxAAAARM"]
[Tue Dec 23 02:58:12.412714 2025] [:error] [pid 40268:tid 40307] [client 103.255.134.61:52226] [client 103.255.134.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.255.134.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUmUxJWtCyS5tdJAiFx52AAAAMU"]
[Tue Dec 23 02:58:18.015824 2025] [:error] [pid 40361:tid 40375] [client 103.255.134.61:48834] [client 103.255.134.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.255.134.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUmUyuxiDEK95vL2EDoAqAAAAEw"], referer: https://expressinteriors.com/wp-login.php
[Tue Dec 23 05:24:36.796378 2025] [:error] [pid 49150:tid 49162] [client 43.155.73.192:55754] [client 43.155.73.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.155.73.192, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUm3FEuL91O4jNPzb4FrngAAAMo"]
[Tue Dec 23 05:24:38.220964 2025] [:error] [pid 49150:tid 49157] [client 43.155.73.192:55786] [client 43.155.73.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.155.73.192, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUm3FkuL91O4jNPzb4FrqQAAAMU"]
[Tue Dec 23 05:24:39.616643 2025] [:error] [pid 49150:tid 49169] [client 43.155.73.192:55816] [client 43.155.73.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.155.73.192, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUm3F0uL91O4jNPzb4FrrAAAANE"]
[Tue Dec 23 05:37:04.067710 2025] [:error] [pid 49061:tid 49095] [client 200.58.109.77:35838] [client 200.58.109.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.58.109.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUm6AGRtvGWfzuDz6nQzogAAAEM"]
[Tue Dec 23 05:37:06.623199 2025] [:error] [pid 49062:tid 49127] [client 200.58.109.77:36008] [client 200.58.109.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.58.109.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUm6Av_oMXBKdV37va2nxAAAAIg"]
[Tue Dec 23 05:37:09.057305 2025] [:error] [pid 49150:tid 49176] [client 200.58.109.77:36126] [client 200.58.109.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.58.109.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUm6BUuL91O4jNPzb4F0tAAAANg"]
[Tue Dec 23 05:37:21.148634 2025] [:error] [pid 49062:tid 49139] [client 116.62.197.107:50340] [client 116.62.197.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.62.197.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUm6Ef_oMXBKdV37va2n3wAAAJQ"]
[Tue Dec 23 05:37:25.632705 2025] [:error] [pid 49061:tid 49097] [client 57.129.73.56:39224] [client 57.129.73.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 57.129.73.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUm6FWRtvGWfzuDz6nQz2gAAAEU"]
[Tue Dec 23 05:37:27.385157 2025] [:error] [pid 49060:tid 49079] [client 82.65.33.99:2913] [client 82.65.33.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.65.33.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUm6F_vdpPyXg0aYbMVZ1QAAAA8"]
[Tue Dec 23 05:37:28.613923 2025] [:error] [pid 49150:tid 49173] [client 57.129.73.56:56280] [client 57.129.73.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 57.129.73.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUm6GEuL91O4jNPzb4F0xwAAANU"]
[Tue Dec 23 05:37:29.346625 2025] [:error] [pid 49150:tid 49158] [client 82.65.33.99:2920] [client 82.65.33.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.65.33.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUm6GUuL91O4jNPzb4F0ywAAAMY"]
[Tue Dec 23 05:37:31.161691 2025] [:error] [pid 49060:tid 49064] [client 57.129.73.56:56284] [client 57.129.73.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 57.129.73.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUm6G_vdpPyXg0aYbMVZ2QAAAAA"]
[Tue Dec 23 05:37:31.376674 2025] [:error] [pid 49060:tid 49086] [client 82.65.33.99:2928] [client 82.65.33.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.65.33.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUm6G_vdpPyXg0aYbMVZ2gAAABY"]
[Tue Dec 23 05:37:44.007820 2025] [:error] [pid 49061:tid 49106] [client 116.62.197.107:50888] [client 116.62.197.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.62.197.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUm6KGRtvGWfzuDz6nQz-AAAAE4"]
[Tue Dec 23 05:47:06.084050 2025] [:error] [pid 49061:tid 49114] [client 120.76.99.214:52796] [client 120.76.99.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.76.99.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUm8WmRtvGWfzuDz6nQ4EgAAAFY"]
[Tue Dec 23 05:47:08.658483 2025] [:error] [pid 49060:tid 49085] [client 120.76.99.214:52808] [client 120.76.99.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.76.99.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUm8XPvdpPyXg0aYbMVdNAAAABU"]
[Tue Dec 23 05:47:10.579768 2025] [:error] [pid 49062:tid 49128] [client 120.76.99.214:52818] [client 120.76.99.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.76.99.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUm8Xv_oMXBKdV37va2sSAAAAIk"]
[Tue Dec 23 06:16:59.348685 2025] [:error] [pid 49060:tid 49068] [client 192.3.24.135:40918] [client 192.3.24.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.3.24.135, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUnDW_vdpPyXg0aYbMVr_AAAAAQ"]
[Tue Dec 23 06:37:34.458842 2025] [:error] [pid 49062:tid 49127] [client 4.230.44.236:4048] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aUnILv_oMXBKdV37va3JkwAAAIg"]
[Tue Dec 23 06:37:35.350634 2025] [:error] [pid 49150:tid 49175] [client 4.230.44.236:4093] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aUnIL0uL91O4jNPzb4GkDwAAANc"]
[Tue Dec 23 06:37:35.968159 2025] [:error] [pid 49062:tid 49140] [client 4.230.44.236:4091] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aUnIL__oMXBKdV37va3JmAAAAJU"]
[Tue Dec 23 06:37:36.692869 2025] [:error] [pid 49150:tid 49169] [client 4.230.44.236:4057] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aUnIMEuL91O4jNPzb4GkFAAAANE"]
[Tue Dec 23 06:37:37.433027 2025] [:error] [pid 49150:tid 49175] [client 4.230.44.236:4034] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aUnIMUuL91O4jNPzb4GkGgAAANc"]
[Tue Dec 23 06:37:38.166078 2025] [:error] [pid 49150:tid 49167] [client 4.230.44.236:4078] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aUnIMkuL91O4jNPzb4GkHwAAAM8"]
[Tue Dec 23 06:37:39.099357 2025] [:error] [pid 49061:tid 49093] [client 4.230.44.236:3986] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aUnIM2RtvGWfzuDz6nRP2AAAAEE"]
[Tue Dec 23 06:37:39.936788 2025] [:error] [pid 49062:tid 49133] [client 4.230.44.236:4090] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aUnIM__oMXBKdV37va3JmwAAAI4"]
[Tue Dec 23 06:37:41.327971 2025] [:error] [pid 49062:tid 49136] [client 4.230.44.236:3974] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aUnINf_oMXBKdV37va3JnwAAAJE"]
[Tue Dec 23 06:37:41.943252 2025] [:error] [pid 49060:tid 49073] [client 4.230.44.236:4083] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aUnINfvdpPyXg0aYbMV1TwAAAAk"]
[Tue Dec 23 06:37:43.248762 2025] [:error] [pid 49062:tid 49138] [client 4.230.44.236:4084] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aUnIN__oMXBKdV37va3JqAAAAJM"]
[Tue Dec 23 06:37:44.167967 2025] [:error] [pid 49061:tid 49103] [client 4.230.44.236:3917] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aUnIOGRtvGWfzuDz6nRP5wAAAEs"]
[Tue Dec 23 06:37:45.244858 2025] [:error] [pid 49062:tid 49142] [client 4.230.44.236:4053] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aUnIOf_oMXBKdV37va3JrgAAAJc"]
[Tue Dec 23 06:37:46.682668 2025] [:error] [pid 49060:tid 49072] [client 4.230.44.236:4036] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aUnIOvvdpPyXg0aYbMV1VQAAAAg"]
[Tue Dec 23 06:37:47.568096 2025] [:error] [pid 49060:tid 49087] [client 4.230.44.236:3970] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aUnIO_vdpPyXg0aYbMV1VwAAABc"]
[Tue Dec 23 06:37:49.012115 2025] [:error] [pid 49061:tid 49100] [client 4.230.44.236:4047] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aUnIPWRtvGWfzuDz6nRP7gAAAEg"]
[Tue Dec 23 06:37:49.803194 2025] [:error] [pid 49150:tid 49176] [client 4.230.44.236:4065] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aUnIPUuL91O4jNPzb4GkKgAAANg"]
[Tue Dec 23 06:37:50.530300 2025] [:error] [pid 49060:tid 49088] [client 4.230.44.236:3969] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aUnIPvvdpPyXg0aYbMV1WQAAABg"]
[Tue Dec 23 06:37:51.810654 2025] [:error] [pid 49150:tid 49156] [client 4.230.44.236:4038] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aUnIP0uL91O4jNPzb4GkLgAAAMQ"]
[Tue Dec 23 06:37:55.083847 2025] [:error] [pid 49150:tid 49162] [client 4.230.44.236:4081] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aUnIQ0uL91O4jNPzb4GkMwAAAMo"]
[Tue Dec 23 06:37:56.255669 2025] [:error] [pid 49150:tid 49174] [client 4.230.44.236:4079] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conflg.php"] [unique_id "aUnIREuL91O4jNPzb4GkOQAAANY"]
[Tue Dec 23 06:37:57.961282 2025] [:error] [pid 49150:tid 49157] [client 4.230.44.236:4088] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conflg.php"] [unique_id "aUnIRUuL91O4jNPzb4GkPgAAAMU"]
[Tue Dec 23 06:37:59.164143 2025] [:error] [pid 49061:tid 49096] [client 4.230.44.236:4032] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conflg.php"] [unique_id "aUnIR2RtvGWfzuDz6nRP9wAAAEQ"]
[Tue Dec 23 06:38:00.407026 2025] [:error] [pid 49060:tid 49076] [client 4.230.44.236:4039] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conflg.php"] [unique_id "aUnISPvdpPyXg0aYbMV1YgAAAAw"]
[Tue Dec 23 06:38:01.044869 2025] [:error] [pid 49150:tid 49154] [client 4.230.44.236:3981] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/db.php"] [unique_id "aUnISUuL91O4jNPzb4GkSQAAAMI"]
[Tue Dec 23 06:38:01.561005 2025] [:error] [pid 49062:tid 49139] [client 4.230.44.236:3968] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/db.php"] [unique_id "aUnISf_oMXBKdV37va3JwwAAAJQ"]
[Tue Dec 23 06:38:02.463224 2025] [:error] [pid 49060:tid 49073] [client 4.230.44.236:4044] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/db.php"] [unique_id "aUnISvvdpPyXg0aYbMV1aAAAAAk"]
[Tue Dec 23 06:38:02.964308 2025] [:error] [pid 49061:tid 49110] [client 4.230.44.236:4087] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/db.php"] [unique_id "aUnISmRtvGWfzuDz6nRP_AAAAFI"]
[Tue Dec 23 06:38:03.921334 2025] [:error] [pid 49062:tid 49126] [client 4.230.44.236:3987] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "aUnIS__oMXBKdV37va3JyAAAAIc"]
[Tue Dec 23 06:38:04.481569 2025] [:error] [pid 49062:tid 49141] [client 4.230.44.236:4059] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "aUnITP_oMXBKdV37va3JygAAAJY"]
[Tue Dec 23 06:38:05.737207 2025] [:error] [pid 49060:tid 49088] [client 4.230.44.236:3998] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "aUnITfvdpPyXg0aYbMV1bgAAABg"]
[Tue Dec 23 06:38:06.493623 2025] [:error] [pid 49150:tid 49174] [client 4.230.44.236:4060] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "aUnITkuL91O4jNPzb4GkTwAAANY"]
[Tue Dec 23 06:38:07.126432 2025] [:error] [pid 49062:tid 49124] [client 4.230.44.236:3991] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "aUnIT__oMXBKdV37va3JzgAAAIU"]
[Tue Dec 23 06:38:07.718892 2025] [:error] [pid 49060:tid 49080] [client 4.230.44.236:4014] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "aUnIT_vdpPyXg0aYbMV1cgAAABA"]
[Tue Dec 23 06:38:08.548898 2025] [:error] [pid 49060:tid 49068] [client 4.230.44.236:3988] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "aUnIUPvdpPyXg0aYbMV1dgAAAAQ"]
[Tue Dec 23 06:38:08.888846 2025] [:error] [pid 49062:tid 49133] [client 4.230.44.236:4072] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "aUnIUP_oMXBKdV37va3J0QAAAI4"]
[Tue Dec 23 06:38:09.266731 2025] [:error] [pid 49150:tid 49170] [client 4.230.44.236:4070] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aUnIUUuL91O4jNPzb4GkVQAAANI"]
[Tue Dec 23 06:38:10.054566 2025] [:error] [pid 49061:tid 49100] [client 4.230.44.236:4055] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aUnIUmRtvGWfzuDz6nRQBAAAAEg"]
[Tue Dec 23 06:38:11.469561 2025] [:error] [pid 49150:tid 49164] [client 4.230.44.236:4085] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aUnIU0uL91O4jNPzb4GkWwAAAMw"]
[Tue Dec 23 06:38:13.262368 2025] [:error] [pid 49062:tid 49124] [client 4.230.44.236:4073] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aUnIVf_oMXBKdV37va3J1wAAAIU"]
[Tue Dec 23 06:38:14.076177 2025] [:error] [pid 49061:tid 49115] [client 4.230.44.236:3993] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aUnIVmRtvGWfzuDz6nRQCQAAAFc"]
[Tue Dec 23 06:38:14.564119 2025] [:error] [pid 49060:tid 49078] [client 4.230.44.236:3994] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aUnIVvvdpPyXg0aYbMV1ewAAAA4"]
[Tue Dec 23 06:38:15.230837 2025] [:error] [pid 49060:tid 49087] [client 4.230.44.236:4023] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aUnIV_vdpPyXg0aYbMV1fQAAABc"]
[Tue Dec 23 06:38:16.335806 2025] [:error] [pid 49150:tid 49173] [client 4.230.44.236:3980] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aUnIWEuL91O4jNPzb4GkaAAAANU"]
[Tue Dec 23 06:38:17.244345 2025] [:error] [pid 49062:tid 49119] [client 4.230.44.236:4041] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "aUnIWf_oMXBKdV37va3J2gAAAIA"]
[Tue Dec 23 06:38:18.165433 2025] [:error] [pid 49061:tid 49102] [client 4.230.44.236:4054] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "aUnIWmRtvGWfzuDz6nRQEgAAAEo"]
[Tue Dec 23 06:38:18.796342 2025] [:error] [pid 49061:tid 49092] [client 4.230.44.236:3999] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "aUnIWmRtvGWfzuDz6nRQFAAAAEA"]
[Tue Dec 23 06:38:20.299887 2025] [:error] [pid 49150:tid 49152] [client 4.230.44.236:4075] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "aUnIXEuL91O4jNPzb4GkcQAAAMA"]
[Tue Dec 23 06:38:20.961854 2025] [:error] [pid 49061:tid 49095] [client 4.230.44.236:4068] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aUnIXGRtvGWfzuDz6nRQGAAAAEM"]
[Tue Dec 23 06:38:22.058449 2025] [:error] [pid 49060:tid 49081] [client 4.230.44.236:3935] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aUnIXvvdpPyXg0aYbMV1hwAAABE"]
[Tue Dec 23 06:38:22.670492 2025] [:error] [pid 49150:tid 49175] [client 4.230.44.236:4001] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aUnIXkuL91O4jNPzb4GkeQAAANc"]
[Tue Dec 23 06:38:23.742934 2025] [:error] [pid 49061:tid 49104] [client 4.230.44.236:4092] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aUnIX2RtvGWfzuDz6nRQHgAAAEw"]
[Tue Dec 23 06:38:24.320883 2025] [:error] [pid 49150:tid 49172] [client 4.230.44.236:4077] [client 4.230.44.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aUnIYEuL91O4jNPzb4GkfgAAANQ"]
[Tue Dec 23 06:38:24.770725 2025] [:error] [pid 49060:tid 49086] [client 4.230.44.236:4015] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aUnIYPvdpPyXg0aYbMV1iQAAABY"]
[Tue Dec 23 06:38:25.667313 2025] [:error] [pid 49062:tid 49133] [client 4.230.44.236:4030] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aUnIYf_oMXBKdV37va3J4wAAAI4"]
[Tue Dec 23 06:38:26.998293 2025] [:error] [pid 49061:tid 49100] [client 4.230.44.236:4074] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aUnIYmRtvGWfzuDz6nRQJAAAAEg"]
[Tue Dec 23 06:38:27.418406 2025] [:error] [pid 49060:tid 49067] [client 4.230.44.236:4016] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aUnIY_vdpPyXg0aYbMV1iwAAAAM"]
[Tue Dec 23 06:38:27.881043 2025] [:error] [pid 49062:tid 49140] [client 4.230.44.236:4071] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aUnIY__oMXBKdV37va3J5QAAAJU"]
[Tue Dec 23 06:38:28.417428 2025] [:error] [pid 49062:tid 49122] [client 4.230.44.236:4069] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aUnIZP_oMXBKdV37va3J5gAAAIM"]
[Tue Dec 23 06:38:29.733588 2025] [:error] [pid 49150:tid 49162] [client 4.230.44.236:4042] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aUnIZUuL91O4jNPzb4GkhwAAAMo"]
[Tue Dec 23 06:38:30.516621 2025] [:error] [pid 49061:tid 49104] [client 4.230.44.236:3982] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aUnIZmRtvGWfzuDz6nRQKAAAAEw"]
[Tue Dec 23 06:38:31.410097 2025] [:error] [pid 49150:tid 49157] [client 4.230.44.236:4086] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aUnIZ0uL91O4jNPzb4GkjQAAAMU"]
[Tue Dec 23 06:38:31.779591 2025] [:error] [pid 49060:tid 49064] [client 4.230.44.236:3906] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aUnIZ_vdpPyXg0aYbMV1jgAAAAA"]
[Tue Dec 23 06:38:32.774493 2025] [:error] [pid 49150:tid 49162] [client 4.230.44.236:4020] [client 4.230.44.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aUnIaEuL91O4jNPzb4GkkQAAAMo"]
[Tue Dec 23 07:31:16.450912 2025] [:error] [pid 49150:tid 49168] [client 192.250.235.90:44056] [client 192.250.235.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.250.235.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUnUxEuL91O4jNPzb4HAuwAAANA"]
[Tue Dec 23 07:31:17.868445 2025] [:error] [pid 49150:tid 49154] [client 192.250.235.90:44056] [client 192.250.235.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.250.235.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUnUxUuL91O4jNPzb4HAvQAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Tue Dec 23 07:43:25.675830 2025] [:error] [pid 49061:tid 49109] [client 198.251.89.157:57600] [client 198.251.89.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.251.89.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUnXnWRtvGWfzuDz6nRorwAAAFE"]
[Tue Dec 23 07:43:28.409023 2025] [:error] [pid 49062:tid 49141] [client 198.251.89.157:57604] [client 198.251.89.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.251.89.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUnXoP_oMXBKdV37va3lQQAAAJY"]
[Tue Dec 23 07:43:30.807834 2025] [:error] [pid 49150:tid 49168] [client 198.251.89.157:47212] [client 198.251.89.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.251.89.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUnXokuL91O4jNPzb4HIdgAAANA"]
[Tue Dec 23 10:10:20.422040 2025] [autoindex:error] [pid 19535:tid 19548] [client 62.171.148.101:60265] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Dec 23 10:24:02.211752 2025] [:error] [pid 49061:tid 49101] [client 191.252.83.220:54648] [client 191.252.83.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.252.83.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUn9QmRtvGWfzuDz6nSXaQAAAEk"]
[Tue Dec 23 10:24:06.001534 2025] [:error] [pid 19535:tid 19542] [client 191.252.83.220:9982] [client 191.252.83.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.252.83.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUn9RoL6JRtAT6bUw7mcywAAAQU"]
[Tue Dec 23 10:24:09.701260 2025] [:error] [pid 30142:tid 30154] [client 191.252.83.220:9992] [client 191.252.83.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.252.83.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUn9SWJwwguepS_rObnAhQAAAUo"]
[Tue Dec 23 10:36:42.607521 2025] [:error] [pid 30142:tid 30167] [client 177.52.160.19:57000] [client 177.52.160.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 177.52.160.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUoAOmJwwguepS_rObnFUQAAAVc"]
[Tue Dec 23 10:36:44.284428 2025] [:error] [pid 30142:tid 30154] [client 177.52.160.19:57000] [client 177.52.160.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 177.52.160.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUoAPGJwwguepS_rObnFUgAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Tue Dec 23 11:12:30.596035 2025] [:error] [pid 30142:tid 30149] [client 192.3.24.135:45130] [client 192.3.24.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.3.24.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUoInmJwwguepS_rObnUpAAAAUU"]
[Tue Dec 23 13:13:28.217588 2025] [:error] [pid 3405:tid 3438] [client 107.189.10.79:34852] [client 107.189.10.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.189.10.79, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUok-LdHHpIDpQ39rwnMtgAAAAE"]
[Tue Dec 23 13:14:40.277407 2025] [:error] [pid 3405:tid 3456] [client 107.189.10.79:8585] [client 107.189.10.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.189.10.79, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUolQLdHHpIDpQ39rwnM7QAAABM"]
[Tue Dec 23 14:17:28.790627 2025] [:error] [pid 11812:tid 11821] [client 107.172.32.149:42106] [client 107.172.32.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.172.32.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUoz-LBkIQ4nTXm4A3W5ZQAAAIc"]
[Tue Dec 23 14:17:31.997166 2025] [:error] [pid 3405:tid 3459] [client 107.172.32.149:42368] [client 107.172.32.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.172.32.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUoz-7dHHpIDpQ39rwna0wAAABY"]
[Tue Dec 23 14:17:34.111302 2025] [:error] [pid 3406:tid 3466] [client 107.172.32.149:42606] [client 107.172.32.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.172.32.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUoz_vn8DLWxW7TPzpFwLQAAAEI"]
[Tue Dec 23 14:17:41.017734 2025] [:error] [pid 11812:tid 11814] [client 80.240.24.54:47100] [client 80.240.24.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.240.24.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUo0BbBkIQ4nTXm4A3W5tQAAAIA"]
[Tue Dec 23 14:17:43.117101 2025] [:error] [pid 11812:tid 11832] [client 80.240.24.54:47104] [client 80.240.24.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.240.24.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUo0B7BkIQ4nTXm4A3W5vgAAAJI"]
[Tue Dec 23 14:17:45.302305 2025] [:error] [pid 3406:tid 3481] [client 80.240.24.54:41874] [client 80.240.24.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.240.24.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUo0Cfn8DLWxW7TPzpFwagAAAFE"]
[Tue Dec 23 14:18:25.578208 2025] [:error] [pid 3497:tid 3512] [client 47.130.62.74:57778] [client 47.130.62.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.130.62.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUo0MezUE6hZ8LJecSu7IgAAAMw"]
[Tue Dec 23 14:18:27.062724 2025] [:error] [pid 3404:tid 3417] [client 47.130.62.74:59168] [client 47.130.62.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.130.62.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUo0M8JGbPWZNlrhVJf37wAAAcg"]
[Tue Dec 23 14:18:28.494841 2025] [:error] [pid 3406:tid 3467] [client 47.130.62.74:59176] [client 47.130.62.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.130.62.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUo0NPn8DLWxW7TPzpFw1gAAAEM"]
[Tue Dec 23 17:00:47.280862 2025] [:error] [pid 11812:tid 11828] [client 173.249.15.33:58366] [client 173.249.15.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.15.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUpaP7BkIQ4nTXm4A3XobgAAAI4"]
[Tue Dec 23 17:00:50.405107 2025] [:error] [pid 25976:tid 25982] [client 173.249.15.33:58406] [client 173.249.15.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.15.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUpaQrF6LaWzQScE-xNQ0gAAAQQ"]
[Tue Dec 23 17:00:58.214166 2025] [:error] [pid 49993:tid 49998] [client 173.249.15.33:58510] [client 173.249.15.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.249.15.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUpaSqjLOkLOc-I9e9t59QAAAUI"]
[Tue Dec 23 17:01:43.846854 2025] [:error] [pid 49993:tid 50013] [client 47.95.0.90:54894] [client 47.95.0.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.95.0.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUpad6jLOkLOc-I9e9t6IgAAAVE"]
[Tue Dec 23 17:01:46.866134 2025] [:error] [pid 49993:tid 49998] [client 47.95.0.90:54906] [client 47.95.0.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.95.0.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUpaeqjLOkLOc-I9e9t6JAAAAUI"]
[Tue Dec 23 17:01:52.681145 2025] [:error] [pid 3405:tid 3447] [client 47.95.0.90:54914] [client 47.95.0.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.95.0.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUpagLdHHpIDpQ39rwkAlgAAAAo"]
[Tue Dec 23 17:02:40.639884 2025] [:error] [pid 49993:tid 50006] [client 125.23.86.26:50696] [client 125.23.86.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 125.23.86.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUpasKjLOkLOc-I9e9t6MAAAAUo"]
[Tue Dec 23 17:02:44.430782 2025] [:error] [pid 3497:tid 3509] [client 125.23.86.26:50706] [client 125.23.86.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 125.23.86.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUpatOzUE6hZ8LJecSvjFwAAAMk"]
[Tue Dec 23 17:02:47.637765 2025] [:error] [pid 11812:tid 11834] [client 125.23.86.26:50718] [client 125.23.86.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 125.23.86.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUpat7BkIQ4nTXm4A3XosAAAAJQ"]
[Tue Dec 23 18:15:09.298695 2025] [:error] [pid 25976:tid 26002] [client 192.3.24.135:60760] [client 192.3.24.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.3.24.135, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUprrbF6LaWzQScE-xNdEAAAARg"]
[Wed Dec 24 01:16:33.268710 2025] [:error] [pid 17591:tid 17616] [client 106.119.167.146:36549] [client 106.119.167.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aUrOcZH0gxj6Q9MQR2IGJAAAAJY"]
[Wed Dec 24 01:19:59.742156 2025] [:error] [pid 17495:tid 17572] [client 197.240.37.106:53837] [client 197.240.37.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.240.37.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUrPPyX1bYzs2kDzvLW8fwAAAFU"]
[Wed Dec 24 01:23:51.606624 2025] [:error] [pid 17494:tid 17548] [client 197.240.37.106:63478] [client 197.240.37.106] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aUrQJ6RJtN8zpyW4DmQC4AAAABg"]
[Wed Dec 24 01:24:57.918605 2025] [:error] [pid 17493:tid 17510] [client 197.240.37.106:56396] [client 197.240.37.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.240.37.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUrQaSaAz9_qXyVO9KNsOQAAAc0"]
[Wed Dec 24 01:26:08.064501 2025] [:error] [pid 17493:tid 17506] [client 197.240.37.106:57536] [client 197.240.37.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.240.37.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUrQsCaAz9_qXyVO9KNsfAAAAck"]
[Wed Dec 24 01:27:08.961105 2025] [:error] [pid 17494:tid 17539] [client 197.240.37.106:58406] [client 197.240.37.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.240.37.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUrQ7KRJtN8zpyW4DmQDgQAAAA8"]
[Wed Dec 24 01:28:08.908324 2025] [:error] [pid 10374:tid 10389] [client 197.240.37.106:56865] [client 197.240.37.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.240.37.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUrRKPgeiZmmnSvZBQ033AAAAM0"]
[Wed Dec 24 01:37:20.763421 2025] [:error] [pid 17495:tid 17563] [client 185.196.10.89:57667] [client 185.196.10.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/archive.zip"] [unique_id "aUrTUCX1bYzs2kDzvLXB_AAAAEw"]
[Wed Dec 24 01:37:21.369457 2025] [:error] [pid 17494:tid 17528] [client 185.196.10.89:58331] [client 185.196.10.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/archive.zip"] [unique_id "aUrTUaRJtN8zpyW4DmQHWwAAAAQ"]
[Wed Dec 24 01:37:21.975191 2025] [:error] [pid 10374:tid 10380] [client 185.196.10.89:58358] [client 185.196.10.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/expressinteriors.com.zip"] [unique_id "aUrTUfgeiZmmnSvZBQ07pAAAAMQ"]
[Wed Dec 24 01:37:22.581722 2025] [:error] [pid 10374:tid 10377] [client 185.196.10.89:58393] [client 185.196.10.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/expressinteriors.zip"] [unique_id "aUrTUvgeiZmmnSvZBQ07pwAAAME"]
[Wed Dec 24 10:49:29.040828 2025] [:error] [pid 16467:tid 16520] [client 63.135.161.48:53559] [client 63.135.161.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aUtUuY0TJMcBxX5slgrbgwAAAFc"]
[Wed Dec 24 10:49:45.295247 2025] [:error] [pid 16550:tid 16553] [client 63.135.161.54:59339] [client 63.135.161.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aUtUyaYYcdD-LuO7vrBkEgAAAME"]
[Wed Dec 24 10:50:10.876135 2025] [:error] [pid 16467:tid 16510] [client 63.135.161.51:35997] [client 63.135.161.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aUtU4o0TJMcBxX5slgreFAAAAE0"]
[Wed Dec 24 10:50:25.827479 2025] [:error] [pid 16550:tid 16576] [client 63.135.161.73:25549] [client 63.135.161.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aUtU8aYYcdD-LuO7vrBoQQAAANg"]
[Wed Dec 24 10:50:53.592764 2025] [:error] [pid 16466:tid 16473] [client 104.234.53.207:56077] [client 104.234.53.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aUtVDbu0JcuKJMjJn6zDvgAAAAM"]
[Wed Dec 24 10:50:59.249975 2025] [:error] [pid 16550:tid 16561] [client 104.234.53.207:51917] [client 104.234.53.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aUtVE6YYcdD-LuO7vrBsawAAAMk"]
[Wed Dec 24 10:50:59.684401 2025] [:error] [pid 28777:tid 28785] [client 63.135.161.76:64803] [client 63.135.161.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aUtVE5BVBcZ34cSqz8rEgQAAAYY"]
[Wed Dec 24 10:51:00.135089 2025] [:error] [pid 28777:tid 28787] [client 63.135.161.53:46745] [client 63.135.161.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aUtVFJBVBcZ34cSqz8rEhgAAAYg"]
[Wed Dec 24 10:51:00.571526 2025] [:error] [pid 16550:tid 16565] [client 104.234.53.226:28691] [client 104.234.53.226] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aUtVFKYYcdD-LuO7vrBstAAAAM0"]
[Wed Dec 24 10:51:01.015405 2025] [:error] [pid 16550:tid 16570] [client 104.234.53.218:35089] [client 104.234.53.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aUtVFaYYcdD-LuO7vrBswgAAANI"]
[Wed Dec 24 10:51:05.157809 2025] [:error] [pid 16468:tid 16526] [client 63.135.161.49:32101] [client 63.135.161.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aUtVGYdyfuSTFLkCbP8lyQAAAII"]
[Wed Dec 24 10:51:11.733616 2025] [:error] [pid 16467:tid 16503] [client 63.135.161.70:40271] [client 63.135.161.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aUtVH40TJMcBxX5slgriyQAAAEY"]
[Wed Dec 24 10:51:18.102281 2025] [:error] [pid 28777:tid 28780] [client 63.135.161.60:31239] [client 63.135.161.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aUtVJpBVBcZ34cSqz8rFcQAAAYE"]
[Wed Dec 24 10:51:20.973564 2025] [:error] [pid 16467:tid 16507] [client 63.135.161.59:21535] [client 63.135.161.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aUtVKI0TJMcBxX5slgrjlgAAAEo"]
[Wed Dec 24 10:51:24.555665 2025] [:error] [pid 54139:tid 54151] [client 104.234.53.220:50987] [client 104.234.53.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aUtVLMrYCZenIDzgXuIE_AAAAQo"]
[Wed Dec 24 10:51:43.447290 2025] [:error] [pid 28777:tid 28780] [client 104.234.53.223:63065] [client 104.234.53.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "aUtVP5BVBcZ34cSqz8rHdwAAAYE"]
[Wed Dec 24 10:51:47.383590 2025] [:error] [pid 28777:tid 28802] [client 63.135.161.50:40629] [client 63.135.161.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aUtVQ5BVBcZ34cSqz8rHswAAAZc"]
[Wed Dec 24 10:51:50.020878 2025] [:error] [pid 16468:tid 16527] [client 63.135.161.63:35173] [client 63.135.161.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aUtVRodyfuSTFLkCbP8pXgAAAIM"]
[Wed Dec 24 10:51:58.747756 2025] [:error] [pid 28777:tid 28799] [client 104.234.53.212:43725] [client 104.234.53.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/defaults.php"] [unique_id "aUtVTpBVBcZ34cSqz8rIeQAAAZQ"]
[Wed Dec 24 10:52:03.940051 2025] [:error] [pid 16550:tid 16570] [client 104.234.53.222:43609] [client 104.234.53.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aUtVU6YYcdD-LuO7vrBzZAAAANI"]
[Wed Dec 24 10:52:17.253783 2025] [:error] [pid 28777:tid 28802] [client 63.135.161.62:54429] [client 63.135.161.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aUtVYZBVBcZ34cSqz8rJ-wAAAZc"]
[Wed Dec 24 10:52:20.737801 2025] [:error] [pid 29371:tid 29389] [client 104.234.53.224:59653] [client 104.234.53.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aUtVZHs-DlKLysSq5L8dnwAAAdA"]
[Wed Dec 24 10:52:25.503078 2025] [:error] [pid 28777:tid 28794] [client 104.234.53.215:43341] [client 104.234.53.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aUtVaZBVBcZ34cSqz8rKlwAAAY8"]
[Wed Dec 24 10:52:25.939632 2025] [:error] [pid 16550:tid 16562] [client 63.135.161.55:38347] [client 63.135.161.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aUtVaaYYcdD-LuO7vrB1dwAAAMo"]
[Wed Dec 24 10:52:27.383388 2025] [:error] [pid 29371:tid 29384] [client 63.135.161.54:30327] [client 63.135.161.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aUtVa3s-DlKLysSq5L8eXgAAAcs"]
[Wed Dec 24 10:52:37.495165 2025] [:error] [pid 16467:tid 16518] [client 104.234.53.221:43713] [client 104.234.53.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/info.php"] [unique_id "aUtVdY0TJMcBxX5slgro2AAAAFU"]
[Wed Dec 24 10:52:38.975663 2025] [:error] [pid 16550:tid 16565] [client 63.135.161.53:51383] [client 63.135.161.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class.api.php"] [unique_id "aUtVdqYYcdD-LuO7vrB2wgAAAM0"]
[Wed Dec 24 10:52:39.460483 2025] [:error] [pid 28405:tid 28426] [client 63.135.161.59:53661] [client 63.135.161.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aUtVd8KkTWlhmfdXFqby7gAAAVA"]
[Wed Dec 24 10:53:06.485946 2025] [:error] [pid 29371:tid 29378] [client 104.234.53.221:38473] [client 104.234.53.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/admin.php"] [unique_id "aUtVkns-DlKLysSq5L8hogAAAcU"]
[Wed Dec 24 10:53:17.203003 2025] [:error] [pid 16468:tid 16542] [client 104.234.53.219:24309] [client 104.234.53.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.219, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aUtVnYdyfuSTFLkCbP8wPgAAAJI"]
[Wed Dec 24 10:53:45.630170 2025] [:error] [pid 16468:tid 16544] [client 104.234.53.219:24309] [client 104.234.53.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/light/profile.php"] [unique_id "aUtVuYdyfuSTFLkCbP8xxAAAAJQ"]
[Wed Dec 24 10:53:55.393446 2025] [:error] [pid 29371:tid 29385] [client 104.234.53.222:56815] [client 104.234.53.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aUtVw3s-DlKLysSq5L8kwwAAAcw"]
[Wed Dec 24 10:54:03.139785 2025] [:error] [pid 16550:tid 16565] [client 104.234.53.210:45271] [client 104.234.53.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aUtVy6YYcdD-LuO7vrB9aAAAAM0"]
[Wed Dec 24 10:54:08.109473 2025] [:error] [pid 16550:tid 16570] [client 104.234.53.210:45271] [client 104.234.53.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/item.php"] [unique_id "aUtV0KYYcdD-LuO7vrB9kAAAANI"]
[Wed Dec 24 10:54:25.409261 2025] [:error] [pid 16467:tid 16515] [client 104.234.53.224:56265] [client 104.234.53.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aUtV4Y0TJMcBxX5slgrvSwAAAFI"]
[Wed Dec 24 10:54:50.830793 2025] [:error] [pid 29371:tid 29373] [client 63.135.161.72:41073] [client 63.135.161.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aUtV-ns-DlKLysSq5L8o6gAAAcA"]
[Wed Dec 24 10:54:58.728294 2025] [:error] [pid 28405:tid 28431] [client 63.135.161.76:27095] [client 63.135.161.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aUtWAsKkTWlhmfdXFqb6zQAAAVU"]
[Wed Dec 24 10:55:08.817956 2025] [:error] [pid 16467:tid 16518] [client 63.135.161.55:47235] [client 63.135.161.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.135.161.55, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aUtWDI0TJMcBxX5slgrw-QAAAFU"]
[Wed Dec 24 10:55:11.180197 2025] [:error] [pid 16467:tid 16497] [client 63.135.161.55:47235] [client 63.135.161.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aUtWD40TJMcBxX5slgrxEAAAAEA"]
[Wed Dec 24 10:55:50.190481 2025] [:error] [pid 29371:tid 29383] [client 63.135.161.72:51507] [client 63.135.161.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aUtWNns-DlKLysSq5L8rTAAAAco"]
[Wed Dec 24 10:55:59.772729 2025] [:error] [pid 54139:tid 54148] [client 104.234.53.212:44241] [client 104.234.53.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aUtWP8rYCZenIDzgXuITKgAAAQc"]
[Wed Dec 24 10:56:11.609463 2025] [:error] [pid 54139:tid 54142] [client 104.234.53.212:44241] [client 104.234.53.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aUtWS8rYCZenIDzgXuITVQAAAQE"]
[Wed Dec 24 10:56:14.677739 2025] [:error] [pid 29371:tid 29379] [client 104.234.53.215:61133] [client 104.234.53.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/infi.php"] [unique_id "aUtWTns-DlKLysSq5L8rpgAAAcY"]
[Wed Dec 24 10:56:19.756453 2025] [:error] [pid 29371:tid 29381] [client 63.135.161.61:54723] [client 63.135.161.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aUtWU3s-DlKLysSq5L8r0gAAAcg"]
[Wed Dec 24 10:56:31.477511 2025] [:error] [pid 16467:tid 16514] [client 63.135.161.67:22455] [client 63.135.161.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aUtWX40TJMcBxX5slgryTQAAAFE"]
[Wed Dec 24 10:56:31.977728 2025] [:error] [pid 16466:tid 16485] [client 63.135.161.70:65527] [client 63.135.161.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aUtWX7u0JcuKJMjJn6zUNgAAAA8"]
[Wed Dec 24 10:56:46.007896 2025] [:error] [pid 16467:tid 16505] [client 63.135.161.50:60595] [client 63.135.161.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aUtWbo0TJMcBxX5slgryigAAAEg"]
[Wed Dec 24 10:56:47.922440 2025] [:error] [pid 16467:tid 16511] [client 104.234.53.213:23949] [client 104.234.53.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "aUtWb40TJMcBxX5slgrykwAAAE4"]
[Wed Dec 24 10:56:54.797838 2025] [:error] [pid 16550:tid 16555] [client 63.135.161.59:56541] [client 63.135.161.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/edit.php"] [unique_id "aUtWdqYYcdD-LuO7vrCEuQAAAMM"]
[Wed Dec 24 10:57:01.432493 2025] [:error] [pid 54139:tid 54159] [client 104.234.53.207:41013] [client 104.234.53.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aUtWfcrYCZenIDzgXuIUPwAAARI"]
[Wed Dec 24 10:57:04.864664 2025] [:error] [pid 54139:tid 54159] [client 104.234.53.216:50403] [client 104.234.53.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/click.php"] [unique_id "aUtWgMrYCZenIDzgXuIUSwAAARI"]
[Wed Dec 24 10:57:12.177509 2025] [:error] [pid 28405:tid 28427] [client 63.135.161.65:37321] [client 63.135.161.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aUtWiMKkTWlhmfdXFqb8xgAAAVE"]
[Wed Dec 24 10:57:27.204329 2025] [:error] [pid 29371:tid 29378] [client 104.234.53.226:38421] [client 104.234.53.226] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aUtWl3s-DlKLysSq5L8svgAAAcU"]
[Wed Dec 24 10:57:27.639492 2025] [:error] [pid 16467:tid 16500] [client 63.135.161.52:55403] [client 63.135.161.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/xl2023.php"] [unique_id "aUtWl40TJMcBxX5slgrzEAAAAEM"]
[Wed Dec 24 10:57:28.093481 2025] [:error] [pid 29371:tid 29387] [client 63.135.161.63:29545] [client 63.135.161.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aUtWmHs-DlKLysSq5L8swwAAAc4"]
[Wed Dec 24 10:57:28.528839 2025] [:error] [pid 54139:tid 54148] [client 104.234.53.220:58281] [client 104.234.53.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aUtWmMrYCZenIDzgXuIUqAAAAQc"]
[Wed Dec 24 10:57:31.140423 2025] [:error] [pid 29371:tid 29378] [client 63.135.161.53:52803] [client 63.135.161.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aUtWm3s-DlKLysSq5L8sywAAAcU"]
[Wed Dec 24 10:57:31.584455 2025] [:error] [pid 29371:tid 29373] [client 63.135.161.48:20289] [client 63.135.161.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aUtWm3s-DlKLysSq5L8szQAAAcA"]
[Wed Dec 24 10:57:37.787632 2025] [:error] [pid 28777:tid 28792] [client 63.135.161.48:48651] [client 63.135.161.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aUtWoZBVBcZ34cSqz8rXOQAAAY0"]
[Wed Dec 24 10:57:38.282127 2025] [:error] [pid 29371:tid 29375] [client 104.234.53.208:21733] [client 104.234.53.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aUtWons-DlKLysSq5L8s4gAAAcI"]
[Wed Dec 24 10:57:38.713059 2025] [:error] [pid 16550:tid 16567] [client 63.135.161.66:26269] [client 63.135.161.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aUtWoqYYcdD-LuO7vrCE5wAAAM8"]
[Wed Dec 24 10:57:49.169231 2025] [autoindex:error] [pid 28777:tid 28800] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:57:49.391291 2025] [autoindex:error] [pid 28777:tid 28780] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:57:49.609713 2025] [autoindex:error] [pid 28777:tid 28783] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:57:49.833172 2025] [autoindex:error] [pid 28777:tid 28782] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:57:52.919734 2025] [autoindex:error] [pid 28777:tid 28780] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:57:53.136433 2025] [autoindex:error] [pid 28777:tid 28783] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:57:53.351490 2025] [autoindex:error] [pid 28777:tid 28782] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:57:53.569219 2025] [autoindex:error] [pid 28777:tid 28799] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:57:53.801751 2025] [autoindex:error] [pid 28777:tid 28786] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:57:54.026565 2025] [autoindex:error] [pid 28777:tid 28789] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:57:54.467697 2025] [autoindex:error] [pid 28777:tid 28780] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:57:57.544908 2025] [autoindex:error] [pid 28777:tid 28800] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:57:57.760424 2025] [autoindex:error] [pid 28777:tid 28782] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:01.557118 2025] [autoindex:error] [pid 28777:tid 28780] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:01.772251 2025] [autoindex:error] [pid 28777:tid 28782] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:01.988338 2025] [autoindex:error] [pid 28777:tid 28790] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:02.211972 2025] [autoindex:error] [pid 28777:tid 28783] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:03.804596 2025] [autoindex:error] [pid 28777:tid 28795] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:04.022536 2025] [autoindex:error] [pid 28777:tid 28781] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:05.578722 2025] [autoindex:error] [pid 28777:tid 28801] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:08.057111 2025] [autoindex:error] [pid 28777:tid 28781] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:08.317676 2025] [autoindex:error] [pid 28777:tid 28798] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:08.540874 2025] [autoindex:error] [pid 28777:tid 28784] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:13.553876 2025] [autoindex:error] [pid 28777:tid 28784] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:17.259898 2025] [autoindex:error] [pid 28777:tid 28790] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:18.693989 2025] [autoindex:error] [pid 28777:tid 28780] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:18.912117 2025] [autoindex:error] [pid 28777:tid 28801] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:19.558950 2025] [autoindex:error] [pid 28777:tid 28791] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:19.793910 2025] [autoindex:error] [pid 28777:tid 28787] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:20.008617 2025] [autoindex:error] [pid 28777:tid 28779] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:24.378928 2025] [autoindex:error] [pid 28777:tid 28796] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:51.773053 2025] [autoindex:error] [pid 28777:tid 28794] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:51.990024 2025] [autoindex:error] [pid 28777:tid 28789] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:52.204921 2025] [autoindex:error] [pid 28777:tid 28796] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:52.420375 2025] [autoindex:error] [pid 28777:tid 28779] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:54.486357 2025] [autoindex:error] [pid 28777:tid 28784] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:54.702521 2025] [autoindex:error] [pid 28777:tid 28793] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:55.861466 2025] [autoindex:error] [pid 28777:tid 28786] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:56.963488 2025] [autoindex:error] [pid 28777:tid 28801] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:57.179197 2025] [autoindex:error] [pid 28777:tid 28797] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:57.395343 2025] [autoindex:error] [pid 28777:tid 28799] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:58.583291 2025] [autoindex:error] [pid 28777:tid 28791] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:58.799681 2025] [autoindex:error] [pid 28777:tid 28793] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:59.022737 2025] [autoindex:error] [pid 28777:tid 28788] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:58:59.237071 2025] [autoindex:error] [pid 28777:tid 28782] [client 104.234.53.220:44965] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:59:22.090279 2025] [autoindex:error] [pid 16468:tid 16535] [client 63.135.161.72:59025] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:59:31.964207 2025] [autoindex:error] [pid 16468:tid 16540] [client 63.135.161.72:59025] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:59:35.804420 2025] [autoindex:error] [pid 16468:tid 16531] [client 63.135.161.72:59025] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:59:36.046753 2025] [autoindex:error] [pid 16468:tid 16546] [client 63.135.161.72:59025] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:59:39.739768 2025] [autoindex:error] [pid 16468:tid 16548] [client 63.135.161.72:59025] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:59:39.987599 2025] [autoindex:error] [pid 16468:tid 16529] [client 63.135.161.72:59025] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:59:40.219256 2025] [autoindex:error] [pid 16468:tid 16525] [client 63.135.161.72:59025] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:59:40.474744 2025] [autoindex:error] [pid 16468:tid 16527] [client 63.135.161.72:59025] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:59:40.720237 2025] [autoindex:error] [pid 16468:tid 16526] [client 63.135.161.72:59025] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:59:40.952305 2025] [autoindex:error] [pid 16468:tid 16541] [client 63.135.161.72:59025] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:59:41.205022 2025] [autoindex:error] [pid 16468:tid 16532] [client 63.135.161.72:59025] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:59:41.448118 2025] [autoindex:error] [pid 16468:tid 16545] [client 63.135.161.72:59025] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:59:41.717440 2025] [autoindex:error] [pid 16468:tid 16533] [client 63.135.161.72:59025] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 10:59:58.056723 2025] [autoindex:error] [pid 16468:tid 16533] [client 63.135.161.72:59025] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Dec 24 13:15:26.104386 2025] [:error] [pid 16467:tid 16500] [client 192.144.148.122:33126] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aUt27o0TJMcBxX5slgoJZgAAAEM"]
[Wed Dec 24 15:45:14.816830 2025] [:error] [pid 28405:tid 28424] [client 138.197.191.87:56472] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2/api-docs"] [unique_id "aUuaCsKkTWlhmfdXFqYxCwAAAU4"]
[Wed Dec 24 15:45:15.777890 2025] [:error] [pid 16467:tid 16514] [client 138.197.191.87:56480] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3/api-docs"] [unique_id "aUuaC40TJMcBxX5slgoh1AAAAFE"]
[Wed Dec 24 15:45:16.755099 2025] [:error] [pid 54139:tid 54155] [client 138.197.191.87:56482] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api-docs/swagger.json"] [unique_id "aUuaDMrYCZenIDzgXuJl3gAAAQ4"]
[Wed Dec 24 15:45:17.748161 2025] [:error] [pid 16468:tid 16531] [client 138.197.191.87:56496] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api/swagger.json"] [unique_id "aUuaDYdyfuSTFLkCbP9m0QAAAIc"]
[Wed Dec 24 15:45:18.766201 2025] [:error] [pid 29371:tid 29388] [client 138.197.191.87:56512] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/@vite/env"] [unique_id "aUuaDns-DlKLysSq5L9rHwAAAc8"]
[Wed Dec 24 15:45:19.742658 2025] [:error] [pid 28777:tid 28784] [client 138.197.191.87:58864] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/actuator/env"] [unique_id "aUuaD5BVBcZ34cSqz8oOWQAAAYU"]
[Wed Dec 24 15:45:20.752177 2025] [:error] [pid 16467:tid 16497] [client 138.197.191.87:58872] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aUuaEI0TJMcBxX5slgoh2wAAAEA"]
[Wed Dec 24 15:45:21.762394 2025] [:error] [pid 16467:tid 16501] [client 138.197.191.87:58874] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server"] [unique_id "aUuaEY0TJMcBxX5slgoh3QAAAEQ"]
[Wed Dec 24 15:45:22.779542 2025] [:error] [pid 54139:tid 54161] [client 138.197.191.87:58880] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aUuaEsrYCZenIDzgXuJl6QAAARQ"]
[Wed Dec 24 15:45:24.795189 2025] [:error] [pid 29371:tid 29387] [client 138.197.191.87:58892] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about"] [unique_id "aUuaFHs-DlKLysSq5L9rJwAAAc4"]
[Wed Dec 24 15:45:25.793102 2025] [:error] [pid 16467:tid 16506] [client 138.197.191.87:58894] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/debug/default/view"] [unique_id "aUuaFY0TJMcBxX5slgoh4wAAAEk"]
[Wed Dec 24 15:45:26.796922 2025] [:error] [pid 29371:tid 29381] [client 138.197.191.87:58908] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2/_catalog"] [unique_id "aUuaFns-DlKLysSq5L9rLgAAAcg"]
[Wed Dec 24 15:45:27.816843 2025] [:error] [pid 28777:tid 28780] [client 138.197.191.87:58920] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aUuaF5BVBcZ34cSqz8oOZgAAAYE"]
[Wed Dec 24 15:45:28.787690 2025] [:error] [pid 28405:tid 28424] [client 138.197.191.87:58932] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server-status"] [unique_id "aUuaGMKkTWlhmfdXFqYxJgAAAU4"]
[Wed Dec 24 15:45:29.781629 2025] [:error] [pid 16468:tid 16545] [client 138.197.191.87:39868] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login.action"] [unique_id "aUuaGYdyfuSTFLkCbP9m7gAAAJU"]
[Wed Dec 24 15:45:30.791701 2025] [:error] [pid 16550:tid 16572] [client 138.197.191.87:39874] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/_all_dbs"] [unique_id "aUuaGqYYcdD-LuO7vrDNzgAAANQ"]
[Wed Dec 24 15:45:31.761330 2025] [:error] [pid 16468:tid 16526] [client 138.197.191.87:39880] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.DS_Store"] [unique_id "aUuaG4dyfuSTFLkCbP9m8QAAAII"]
[Wed Dec 24 15:45:32.776652 2025] [:error] [pid 16550:tid 16553] [client 138.197.191.87:39886] [client 138.197.191.87] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aUuaHKYYcdD-LuO7vrDN0wAAAME"]
[Wed Dec 24 15:45:34.773008 2025] [:error] [pid 16468:tid 16531] [client 138.197.191.87:39894] [client 138.197.191.87] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aUuaHodyfuSTFLkCbP9m8wAAAIc"]
[Wed Dec 24 15:45:35.794351 2025] [:error] [pid 54139:tid 54159] [client 138.197.191.87:39906] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aUuaH8rYCZenIDzgXuJmCgAAARI"]
[Wed Dec 24 15:45:36.777202 2025] [:error] [pid 28777:tid 28801] [client 138.197.191.87:39910] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aUuaIJBVBcZ34cSqz8oOcAAAAZY"]
[Wed Dec 24 15:45:37.784628 2025] [:error] [pid 29371:tid 29395] [client 138.197.191.87:39912] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/telescope/requests"] [unique_id "aUuaIXs-DlKLysSq5L9rQAAAAdY"]
[Wed Dec 24 15:45:38.775855 2025] [:error] [pid 28405:tid 28412] [client 138.197.191.87:39924] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aUuaIsKkTWlhmfdXFqYxMwAAAUM"]
[Wed Dec 24 15:45:39.859654 2025] [:error] [pid 16468:tid 16524] [client 138.197.191.87:36982] [client 138.197.191.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUuaI4dyfuSTFLkCbP9m-QAAAIA"]
[Wed Dec 24 21:11:32.285519 2025] [:error] [pid 28405:tid 28427] [client 139.162.52.201:37762] [client 139.162.52.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.162.52.201, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUvmhMKkTWlhmfdXFqai5gAAAVE"]
[Wed Dec 24 21:19:36.301427 2025] [:error] [pid 16466:tid 16471] [client 161.35.64.73:46890] [client 161.35.64.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.35.64.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUvoaLu0JcuKJMjJn6xaBAAAAAE"]
[Wed Dec 24 21:22:50.611928 2025] [:error] [pid 29371:tid 29378] [client 78.142.18.43:58899] [client 78.142.18.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.142.18.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUvpKns-DlKLysSq5L-v1AAAAcU"]
[Wed Dec 24 21:22:58.214360 2025] [:error] [pid 29371:tid 29380] [client 78.142.18.43:58899] [client 78.142.18.43] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aUvpMns-DlKLysSq5L-v2wAAAcc"]
[Wed Dec 24 21:22:58.559057 2025] [:error] [pid 29371:tid 29384] [client 78.142.18.43:58899] [client 78.142.18.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.142.18.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUvpMns-DlKLysSq5L-v3AAAAcs"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 24 21:23:00.265676 2025] [:error] [pid 29371:tid 29388] [client 78.142.18.43:58899] [client 78.142.18.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.142.18.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUvpNHs-DlKLysSq5L-v3gAAAc8"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 24 21:23:01.118703 2025] [:error] [pid 29371:tid 29379] [client 78.142.18.43:58899] [client 78.142.18.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.142.18.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUvpNXs-DlKLysSq5L-v3wAAAcY"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 24 21:23:02.833731 2025] [:error] [pid 29371:tid 29387] [client 78.142.18.43:58899] [client 78.142.18.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.142.18.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUvpNns-DlKLysSq5L-v4QAAAc4"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 24 21:23:03.653277 2025] [:error] [pid 29371:tid 29390] [client 78.142.18.43:58899] [client 78.142.18.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.142.18.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUvpN3s-DlKLysSq5L-v4gAAAdE"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 24 21:23:05.385967 2025] [:error] [pid 29371:tid 29395] [client 78.142.18.43:58899] [client 78.142.18.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.142.18.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUvpOXs-DlKLysSq5L-v5AAAAdY"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 24 21:23:06.246150 2025] [:error] [pid 29371:tid 29377] [client 78.142.18.43:58899] [client 78.142.18.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.142.18.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUvpOns-DlKLysSq5L-v5QAAAcQ"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 24 21:23:07.940190 2025] [:error] [pid 29371:tid 29385] [client 78.142.18.43:58899] [client 78.142.18.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.142.18.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUvpO3s-DlKLysSq5L-v5wAAAcw"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 24 21:23:08.785939 2025] [:error] [pid 29371:tid 29375] [client 78.142.18.43:58899] [client 78.142.18.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.142.18.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUvpPHs-DlKLysSq5L-v6AAAAcI"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 24 21:23:10.485788 2025] [:error] [pid 29371:tid 29383] [client 78.142.18.43:58899] [client 78.142.18.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.142.18.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUvpPns-DlKLysSq5L-v6gAAAco"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 24 21:23:11.374943 2025] [:error] [pid 29371:tid 29389] [client 78.142.18.43:58899] [client 78.142.18.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.142.18.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUvpP3s-DlKLysSq5L-v6wAAAdA"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 24 21:23:13.040737 2025] [:error] [pid 29371:tid 29378] [client 78.142.18.43:58899] [client 78.142.18.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.142.18.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUvpQXs-DlKLysSq5L-v7QAAAcU"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 24 21:23:13.886499 2025] [:error] [pid 29371:tid 29392] [client 78.142.18.43:58899] [client 78.142.18.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.142.18.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUvpQXs-DlKLysSq5L-v7gAAAdM"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 24 21:23:15.565620 2025] [:error] [pid 29371:tid 29381] [client 78.142.18.43:58899] [client 78.142.18.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.142.18.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUvpQ3s-DlKLysSq5L-v8AAAAcg"], referer: https://expressinteriors.com/wp-login.php
[Wed Dec 24 21:24:00.037334 2025] [:error] [pid 16467:tid 16504] [client 45.95.173.39:50986] [client 45.95.173.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.95.173.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUvpcI0TJMcBxX5slgph_QAAAEc"]
[Wed Dec 24 21:30:29.652063 2025] [:error] [pid 29371:tid 29377] [client 18.222.155.77:38612] [client 18.222.155.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 18.222.155.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUvq9Xs-DlKLysSq5L-xygAAAcQ"]
[Wed Dec 24 21:31:04.400277 2025] [:error] [pid 28777:tid 28781] [client 185.133.207.56:57520] [client 185.133.207.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.133.207.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUvrGJBVBcZ34cSqz8pPbQAAAYI"]
[Wed Dec 24 21:31:26.740963 2025] [:error] [pid 16550:tid 16571] [client 185.133.207.56:55270] [client 185.133.207.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.133.207.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUvrLqYYcdD-LuO7vrAaAwAAANM"]
[Wed Dec 24 22:30:51.982533 2025] [:error] [pid 16468:tid 16544] [client 85.13.149.164:56982] [client 85.13.149.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.13.149.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUv5G4dyfuSTFLkCbP-zfAAAAJQ"]
[Wed Dec 24 22:35:36.295263 2025] [:error] [pid 16468:tid 16527] [client 101.53.147.26:45372] [client 101.53.147.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 101.53.147.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUv6OIdyfuSTFLkCbP-0PgAAAIM"]
[Wed Dec 24 23:24:00.649807 2025] [:error] [pid 16468:tid 16541] [client 4.217.187.220:3401] [client 4.217.187.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.217.187.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUwFkIdyfuSTFLkCbP-7lgAAAJE"]
[Wed Dec 24 23:24:01.326850 2025] [:error] [pid 16468:tid 16536] [client 4.217.187.220:3401] [client 4.217.187.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.217.187.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aUwFkYdyfuSTFLkCbP-7lwAAAIw"]
[Wed Dec 24 23:24:05.998332 2025] [:error] [pid 29371:tid 29384] [client 4.217.187.220:3764] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cord.php"] [unique_id "aUwFlXs-DlKLysSq5L_IDwAAAcs"]
[Wed Dec 24 23:24:08.467962 2025] [:error] [pid 16466:tid 16471] [client 4.217.187.220:49194] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cord.php"] [unique_id "aUwFmLu0JcuKJMjJn6x4hAAAAAE"]
[Wed Dec 24 23:24:09.547688 2025] [:error] [pid 16466:tid 16473] [client 4.217.187.220:3237] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cord.php"] [unique_id "aUwFmbu0JcuKJMjJn6x4iAAAAAM"]
[Wed Dec 24 23:24:11.066307 2025] [:error] [pid 16550:tid 16557] [client 4.217.187.220:3144] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cord.php"] [unique_id "aUwFm6YYcdD-LuO7vrAxVQAAAMU"]
[Wed Dec 24 23:24:12.822763 2025] [:error] [pid 28405:tid 28433] [client 4.217.187.220:47548] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "aUwFnMKkTWlhmfdXFqbQFAAAAVc"]
[Wed Dec 24 23:24:14.060202 2025] [:error] [pid 29371:tid 29393] [client 4.217.187.220:3158] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "aUwFnns-DlKLysSq5L_IEAAAAdQ"]
[Wed Dec 24 23:24:15.322761 2025] [:error] [pid 28405:tid 28426] [client 4.217.187.220:42677] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "aUwFn8KkTWlhmfdXFqbQGQAAAVA"]
[Wed Dec 24 23:24:16.188848 2025] [:error] [pid 28405:tid 28413] [client 4.217.187.220:42658] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "aUwFoMKkTWlhmfdXFqbQHAAAAUQ"]
[Wed Dec 24 23:24:16.889695 2025] [:error] [pid 28405:tid 28433] [client 4.217.187.220:49178] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aUwFoMKkTWlhmfdXFqbQHwAAAVc"]
[Wed Dec 24 23:24:18.049295 2025] [:error] [pid 16466:tid 16471] [client 4.217.187.220:3251] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aUwForu0JcuKJMjJn6x4kAAAAAE"]
[Wed Dec 24 23:24:19.178334 2025] [:error] [pid 16467:tid 16501] [client 4.217.187.220:60307] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aUwFo40TJMcBxX5slgp1_QAAAEQ"]
[Wed Dec 24 23:24:19.915388 2025] [:error] [pid 29371:tid 29388] [client 4.217.187.220:47502] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aUwFo3s-DlKLysSq5L_IFQAAAc8"]
[Wed Dec 24 23:24:21.426423 2025] [:error] [pid 28405:tid 28432] [client 4.217.187.220:46066] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/minik.php"] [unique_id "aUwFpcKkTWlhmfdXFqbQIgAAAVY"]
[Wed Dec 24 23:24:23.181729 2025] [:error] [pid 16467:tid 16517] [client 4.217.187.220:47172] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/minik.php"] [unique_id "aUwFp40TJMcBxX5slgp2BAAAAFQ"]
[Wed Dec 24 23:24:23.626835 2025] [:error] [pid 16466:tid 16482] [client 4.217.187.220:44745] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/minik.php"] [unique_id "aUwFp7u0JcuKJMjJn6x4kgAAAAw"]
[Wed Dec 24 23:24:25.107010 2025] [:error] [pid 16466:tid 16490] [client 4.217.187.220:49183] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/minik.php"] [unique_id "aUwFqbu0JcuKJMjJn6x4kwAAABQ"]
[Wed Dec 24 23:24:25.626417 2025] [:error] [pid 16468:tid 16540] [client 4.217.187.220:44783] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/OK.php"] [unique_id "aUwFqYdyfuSTFLkCbP-7nwAAAJA"]
[Wed Dec 24 23:24:26.513327 2025] [:error] [pid 16467:tid 16518] [client 4.217.187.220:47538] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/OK.php"] [unique_id "aUwFqo0TJMcBxX5slgp2BQAAAFU"]
[Wed Dec 24 23:24:28.433963 2025] [:error] [pid 16550:tid 16572] [client 4.217.187.220:53201] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/OK.php"] [unique_id "aUwFrKYYcdD-LuO7vrAxWQAAANQ"]
[Wed Dec 24 23:24:30.152825 2025] [:error] [pid 16468:tid 16524] [client 4.217.187.220:49185] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/OK.php"] [unique_id "aUwFrodyfuSTFLkCbP-7owAAAIA"]
[Wed Dec 24 23:24:31.455154 2025] [:error] [pid 16466:tid 16475] [client 4.217.187.220:3814] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfanew.php"] [unique_id "aUwFr7u0JcuKJMjJn6x4mwAAAAU"]
[Wed Dec 24 23:24:32.414378 2025] [:error] [pid 28405:tid 28415] [client 4.217.187.220:49213] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfanew.php"] [unique_id "aUwFsMKkTWlhmfdXFqbQJwAAAUY"]
[Wed Dec 24 23:24:34.012078 2025] [:error] [pid 16466:tid 16479] [client 4.217.187.220:49494] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfanew.php"] [unique_id "aUwFsru0JcuKJMjJn6x4nQAAAAk"]
[Wed Dec 24 23:24:35.321146 2025] [:error] [pid 16468:tid 16537] [client 4.217.187.220:49878] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfanew.php"] [unique_id "aUwFs4dyfuSTFLkCbP-7pgAAAI0"]
[Wed Dec 24 23:24:36.372724 2025] [:error] [pid 16550:tid 16564] [client 4.217.187.220:45226] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zsec.php"] [unique_id "aUwFtKYYcdD-LuO7vrAxYQAAAMw"]
[Wed Dec 24 23:24:37.388093 2025] [:error] [pid 16468:tid 16547] [client 4.217.187.220:3185] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zsec.php"] [unique_id "aUwFtYdyfuSTFLkCbP-7qAAAAJc"]
[Wed Dec 24 23:24:38.081607 2025] [:error] [pid 16468:tid 16530] [client 4.217.187.220:49523] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zsec.php"] [unique_id "aUwFtodyfuSTFLkCbP-7qQAAAIY"]
[Wed Dec 24 23:24:39.390450 2025] [:error] [pid 16550:tid 16555] [client 4.217.187.220:45197] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zsec.php"] [unique_id "aUwFt6YYcdD-LuO7vrAxZAAAAMM"]
[Wed Dec 24 23:24:40.578424 2025] [:error] [pid 28405:tid 28421] [client 4.217.187.220:55108] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/arig.php"] [unique_id "aUwFuMKkTWlhmfdXFqbQMAAAAUs"]
[Wed Dec 24 23:24:42.296608 2025] [:error] [pid 29371:tid 29397] [client 4.217.187.220:3577] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/arig.php"] [unique_id "aUwFuns-DlKLysSq5L_IFwAAAdg"]
[Wed Dec 24 23:24:43.537313 2025] [:error] [pid 28777:tid 28783] [client 4.217.187.220:48016] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/arig.php"] [unique_id "aUwFu5BVBcZ34cSqz8pjYwAAAYQ"]
[Wed Dec 24 23:24:45.273641 2025] [:error] [pid 16467:tid 16504] [client 4.217.187.220:55971] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/arig.php"] [unique_id "aUwFvY0TJMcBxX5slgp2DAAAAEc"]
[Wed Dec 24 23:24:46.893860 2025] [:error] [pid 28405:tid 28433] [client 4.217.187.220:55497] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin1.php"] [unique_id "aUwFvsKkTWlhmfdXFqbQNgAAAVc"]
[Wed Dec 24 23:24:48.015046 2025] [:error] [pid 28405:tid 28410] [client 4.217.187.220:55527] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin1.php"] [unique_id "aUwFwMKkTWlhmfdXFqbQOQAAAUE"]
[Wed Dec 24 23:24:49.778308 2025] [:error] [pid 54139:tid 54164] [client 4.217.187.220:56328] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin1.php"] [unique_id "aUwFwcrYCZenIDzgXuLV7AAAARc"]
[Wed Dec 24 23:24:50.646255 2025] [:error] [pid 28405:tid 28434] [client 4.217.187.220:3553] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin1.php"] [unique_id "aUwFwsKkTWlhmfdXFqbQQwAAAVg"]
[Wed Dec 24 23:24:51.269750 2025] [:error] [pid 28405:tid 28424] [client 4.217.187.220:3545] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aUwFw8KkTWlhmfdXFqbQRAAAAU4"]
[Wed Dec 24 23:24:51.902094 2025] [:error] [pid 28777:tid 28782] [client 4.217.187.220:58007] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aUwFw5BVBcZ34cSqz8pjZQAAAYM"]
[Wed Dec 24 23:24:53.102792 2025] [:error] [pid 28405:tid 28422] [client 4.217.187.220:55110] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aUwFxcKkTWlhmfdXFqbQRQAAAUw"]
[Wed Dec 24 23:24:55.055459 2025] [:error] [pid 28405:tid 28430] [client 4.217.187.220:42143] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aUwFx8KkTWlhmfdXFqbQSwAAAVQ"]
[Wed Dec 24 23:24:56.508863 2025] [:error] [pid 28405:tid 28414] [client 4.217.187.220:43856] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/af32.php"] [unique_id "aUwFyMKkTWlhmfdXFqbQTQAAAUU"]
[Wed Dec 24 23:24:57.366147 2025] [:error] [pid 28777:tid 28801] [client 4.217.187.220:56362] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/af32.php"] [unique_id "aUwFyZBVBcZ34cSqz8pjaAAAAZY"]
[Wed Dec 24 23:24:59.493570 2025] [:error] [pid 16550:tid 16562] [client 4.217.187.220:56265] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/af32.php"] [unique_id "aUwFy6YYcdD-LuO7vrAxbQAAAMo"]
[Wed Dec 24 23:25:01.778668 2025] [:error] [pid 16468:tid 16544] [client 4.217.187.220:42706] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/af32.php"] [unique_id "aUwFzYdyfuSTFLkCbP-7tAAAAJQ"]
[Wed Dec 24 23:25:03.249477 2025] [:error] [pid 28777:tid 28803] [client 4.217.187.220:42740] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rz.php"] [unique_id "aUwFz5BVBcZ34cSqz8pjbAAAAZg"]
[Wed Dec 24 23:25:15.894440 2025] [:error] [pid 54139:tid 54142] [client 4.217.187.220:55989] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abe.php"] [unique_id "aUwF28rYCZenIDzgXuLWFgAAAQE"]
[Wed Dec 24 23:25:17.086407 2025] [:error] [pid 16467:tid 16499] [client 4.217.187.220:46006] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abe.php"] [unique_id "aUwF3Y0TJMcBxX5slgp2FQAAAEI"]
[Wed Dec 24 23:25:22.600940 2025] [:error] [pid 28405:tid 28429] [client 4.217.187.220:47006] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abe.php"] [unique_id "aUwF4sKkTWlhmfdXFqbQagAAAVM"]
[Wed Dec 24 23:25:22.985792 2025] [:error] [pid 16550:tid 16564] [client 4.217.187.220:60242] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abe.php"] [unique_id "aUwF4qYYcdD-LuO7vrAxewAAAMw"]
[Wed Dec 24 23:25:24.022040 2025] [:error] [pid 54139:tid 54165] [client 4.217.187.220:46988] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aUwF5MrYCZenIDzgXuLWGwAAARg"]
[Wed Dec 24 23:25:27.652606 2025] [:error] [pid 16466:tid 16484] [client 4.217.187.220:45980] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aUwF57u0JcuKJMjJn6x4rgAAAA4"]
[Wed Dec 24 23:25:31.421510 2025] [:error] [pid 28405:tid 28428] [client 4.217.187.220:45262] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aUwF68KkTWlhmfdXFqbQbQAAAVI"]
[Wed Dec 24 23:25:32.089216 2025] [:error] [pid 54139:tid 54160] [client 4.217.187.220:48819] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aUwF7MrYCZenIDzgXuLWHwAAARM"]
[Wed Dec 24 23:25:35.051877 2025] [:error] [pid 29371:tid 29385] [client 4.217.187.220:55565] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aUwF73s-DlKLysSq5L_ILQAAAcw"]
[Wed Dec 24 23:25:38.943025 2025] [:error] [pid 16466:tid 16490] [client 4.217.187.220:3337] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aUwF8ru0JcuKJMjJn6x4vAAAABQ"]
[Wed Dec 24 23:25:41.825723 2025] [:error] [pid 16466:tid 16477] [client 4.217.187.220:3361] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aUwF9bu0JcuKJMjJn6x4vwAAAAc"]
[Wed Dec 24 23:25:44.539708 2025] [:error] [pid 28405:tid 28420] [client 4.217.187.220:3344] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aUwF-MKkTWlhmfdXFqbQcgAAAUo"]
[Wed Dec 24 23:25:46.019094 2025] [:error] [pid 16466:tid 16472] [client 4.217.187.220:3603] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aUwF-ru0JcuKJMjJn6x4xgAAAAI"]
[Wed Dec 24 23:25:47.406472 2025] [:error] [pid 54139:tid 54154] [client 4.217.187.220:48776] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aUwF-8rYCZenIDzgXuLWLAAAAQ0"]
[Wed Dec 24 23:25:48.001481 2025] [:error] [pid 16466:tid 16474] [client 4.217.187.220:3357] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aUwF_Lu0JcuKJMjJn6x4yQAAAAQ"]
[Wed Dec 24 23:25:48.893189 2025] [:error] [pid 54139:tid 54150] [client 4.217.187.220:55555] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aUwF_MrYCZenIDzgXuLWLQAAAQk"]
[Wed Dec 24 23:25:49.571477 2025] [:error] [pid 54139:tid 54143] [client 4.217.187.220:49552] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cloud.php"] [unique_id "aUwF_crYCZenIDzgXuLWLwAAAQI"]
[Wed Dec 24 23:25:50.620246 2025] [:error] [pid 54139:tid 54161] [client 4.217.187.220:3602] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cloud.php"] [unique_id "aUwF_srYCZenIDzgXuLWMQAAARQ"]
[Wed Dec 24 23:25:51.054089 2025] [:error] [pid 16466:tid 16477] [client 4.217.187.220:4054] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cloud.php"] [unique_id "aUwF_7u0JcuKJMjJn6x4ywAAAAc"]
[Wed Dec 24 23:25:51.857398 2025] [:error] [pid 16550:tid 16557] [client 4.217.187.220:3380] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cloud.php"] [unique_id "aUwF_6YYcdD-LuO7vrAxkgAAAMU"]
[Wed Dec 24 23:25:52.567513 2025] [:error] [pid 28405:tid 28422] [client 4.217.187.220:49574] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aUwGAMKkTWlhmfdXFqbQdgAAAUw"]
[Wed Dec 24 23:25:53.293022 2025] [:error] [pid 16467:tid 16510] [client 4.217.187.220:45306] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aUwGAY0TJMcBxX5slgp2KgAAAE0"]
[Wed Dec 24 23:25:53.774414 2025] [:error] [pid 16466:tid 16483] [client 4.217.187.220:55613] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aUwGAbu0JcuKJMjJn6x4zQAAAA0"]
[Wed Dec 24 23:25:54.857245 2025] [:error] [pid 29371:tid 29381] [client 4.217.187.220:49578] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aUwGAns-DlKLysSq5L_INQAAAcg"]
[Wed Dec 24 23:25:55.798907 2025] [:error] [pid 16467:tid 16502] [client 4.217.187.220:51896] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aUwGA40TJMcBxX5slgp2KwAAAEU"]
[Wed Dec 24 23:25:56.447423 2025] [:error] [pid 28405:tid 28428] [client 4.217.187.220:49537] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aUwGBMKkTWlhmfdXFqbQewAAAVI"]
[Wed Dec 24 23:25:57.470891 2025] [:error] [pid 54139:tid 54160] [client 4.217.187.220:50901] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aUwGBcrYCZenIDzgXuLWMwAAARM"]
[Wed Dec 24 23:25:58.470885 2025] [:error] [pid 28777:tid 28799] [client 4.217.187.220:4042] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aUwGBpBVBcZ34cSqz8pjgwAAAZQ"]
[Wed Dec 24 23:25:59.447451 2025] [:error] [pid 28405:tid 28420] [client 4.217.187.220:50921] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aUwGB8KkTWlhmfdXFqbQfQAAAUo"]
[Wed Dec 24 23:26:00.410506 2025] [:error] [pid 28405:tid 28434] [client 4.217.187.220:50471] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aUwGCMKkTWlhmfdXFqbQfwAAAVg"]
[Wed Dec 24 23:26:00.852370 2025] [:error] [pid 29371:tid 29392] [client 4.217.187.220:48321] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aUwGCHs-DlKLysSq5L_IOgAAAdM"]
[Wed Dec 24 23:26:02.446240 2025] [:error] [pid 28405:tid 28427] [client 4.217.187.220:46802] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aUwGCsKkTWlhmfdXFqbQhQAAAVE"]
[Wed Dec 24 23:26:03.150823 2025] [:error] [pid 16550:tid 16559] [client 4.217.187.220:46570] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aUwGC6YYcdD-LuO7vrAxmQAAAMc"]
[Wed Dec 24 23:26:03.913703 2025] [:error] [pid 28777:tid 28791] [client 4.217.187.220:46537] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aUwGC5BVBcZ34cSqz8pjhwAAAYw"]
[Wed Dec 24 23:26:05.381134 2025] [:error] [pid 16466:tid 16490] [client 4.217.187.220:46814] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aUwGDbu0JcuKJMjJn6x40wAAABQ"]
[Wed Dec 24 23:26:06.373634 2025] [:error] [pid 28777:tid 28801] [client 4.217.187.220:46579] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aUwGDpBVBcZ34cSqz8pjigAAAZY"]
[Wed Dec 24 23:26:07.716984 2025] [:error] [pid 16467:tid 16512] [client 4.217.187.220:51852] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aUwGD40TJMcBxX5slgp2LgAAAE8"]
[Wed Dec 24 23:26:08.182260 2025] [:error] [pid 16550:tid 16557] [client 4.217.187.220:46797] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aUwGEKYYcdD-LuO7vrAxngAAAMU"]
[Wed Dec 24 23:26:08.950658 2025] [:error] [pid 28405:tid 28417] [client 4.217.187.220:49587] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aUwGEMKkTWlhmfdXFqbQiAAAAUg"]
[Wed Dec 24 23:26:09.387597 2025] [:error] [pid 16466:tid 16487] [client 4.217.187.220:54930] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aUwGEbu0JcuKJMjJn6x42gAAABE"]
[Wed Dec 24 23:26:10.169128 2025] [:error] [pid 16466:tid 16472] [client 4.217.187.220:46536] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aUwGEru0JcuKJMjJn6x42wAAAAI"]
[Wed Dec 24 23:26:11.670134 2025] [:error] [pid 16466:tid 16490] [client 4.217.187.220:50927] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aUwGE7u0JcuKJMjJn6x43gAAABQ"]
[Wed Dec 24 23:26:12.700669 2025] [:error] [pid 16466:tid 16473] [client 4.217.187.220:50930] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aUwGFLu0JcuKJMjJn6x44QAAAAM"]
[Wed Dec 24 23:26:13.977016 2025] [:error] [pid 28405:tid 28425] [client 4.217.187.220:49585] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aUwGFcKkTWlhmfdXFqbQkAAAAU8"]
[Wed Dec 24 23:26:24.488416 2025] [:error] [pid 28777:tid 28800] [client 4.217.187.220:46827] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-rex4.php7"] [unique_id "aUwGIJBVBcZ34cSqz8pjnwAAAZU"]
[Wed Dec 24 23:26:26.057124 2025] [:error] [pid 54139:tid 54144] [client 4.217.187.220:42945] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-rex4.php7"] [unique_id "aUwGIsrYCZenIDzgXuLWPwAAAQM"]
[Wed Dec 24 23:26:27.216307 2025] [:error] [pid 16466:tid 16480] [client 4.217.187.220:48348] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-rex4.php7"] [unique_id "aUwGI7u0JcuKJMjJn6x46wAAAAo"]
[Wed Dec 24 23:26:28.024396 2025] [:error] [pid 54139:tid 54159] [client 4.217.187.220:44452] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-rex4.php7"] [unique_id "aUwGJMrYCZenIDzgXuLWQAAAARI"]
[Wed Dec 24 23:26:29.265487 2025] [:error] [pid 16467:tid 16507] [client 4.217.187.220:3130] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aUwGJY0TJMcBxX5slgp2QAAAAEo"]
[Wed Dec 24 23:26:30.719227 2025] [:error] [pid 28405:tid 28431] [client 4.217.187.220:42180] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aUwGJsKkTWlhmfdXFqbQmQAAAVU"]
[Wed Dec 24 23:26:31.667114 2025] [:error] [pid 28405:tid 28411] [client 4.217.187.220:46832] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aUwGJ8KkTWlhmfdXFqbQnAAAAUI"]
[Wed Dec 24 23:26:32.659986 2025] [:error] [pid 28405:tid 28430] [client 4.217.187.220:42202] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aUwGKMKkTWlhmfdXFqbQnwAAAVQ"]
[Wed Dec 24 23:26:34.411301 2025] [:error] [pid 28777:tid 28789] [client 4.217.187.220:48344] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "aUwGKpBVBcZ34cSqz8pjpAAAAYo"]
[Wed Dec 24 23:26:36.169422 2025] [:error] [pid 16467:tid 16503] [client 4.217.187.220:42182] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "aUwGLI0TJMcBxX5slgp2QwAAAEY"]
[Wed Dec 24 23:26:36.927258 2025] [:error] [pid 28777:tid 28793] [client 4.217.187.220:44447] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "aUwGLJBVBcZ34cSqz8pjqQAAAY4"]
[Wed Dec 24 23:26:38.529564 2025] [:error] [pid 16466:tid 16487] [client 4.217.187.220:3372] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "aUwGLru0JcuKJMjJn6x48AAAABE"]
[Wed Dec 24 23:26:40.724309 2025] [:error] [pid 54139:tid 54160] [client 4.217.187.220:46530] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/warm.PhP7"] [unique_id "aUwGMMrYCZenIDzgXuLWSQAAARM"]
[Wed Dec 24 23:26:43.975165 2025] [:error] [pid 54139:tid 54142] [client 4.217.187.220:51818] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/warm.PhP7"] [unique_id "aUwGM8rYCZenIDzgXuLWUAAAAQE"]
[Wed Dec 24 23:26:44.855295 2025] [:error] [pid 16467:tid 16509] [client 4.217.187.220:42921] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/warm.PhP7"] [unique_id "aUwGNI0TJMcBxX5slgp2RwAAAEw"]
[Wed Dec 24 23:26:46.344628 2025] [:error] [pid 16550:tid 16562] [client 4.217.187.220:42933] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/warm.PhP7"] [unique_id "aUwGNqYYcdD-LuO7vrAxqQAAAMo"]
[Wed Dec 24 23:26:47.837539 2025] [:error] [pid 16466:tid 16494] [client 4.217.187.220:42926] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php7"] [unique_id "aUwGN7u0JcuKJMjJn6x49QAAABg"]
[Wed Dec 24 23:26:48.870456 2025] [:error] [pid 54139:tid 54147] [client 4.217.187.220:3074] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php7"] [unique_id "aUwGOMrYCZenIDzgXuLWVgAAAQY"]
[Wed Dec 24 23:26:49.807336 2025] [:error] [pid 54139:tid 54158] [client 4.217.187.220:42234] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php7"] [unique_id "aUwGOcrYCZenIDzgXuLWWQAAARE"]
[Wed Dec 24 23:26:51.620521 2025] [:error] [pid 28405:tid 28424] [client 4.217.187.220:46582] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php7"] [unique_id "aUwGO8KkTWlhmfdXFqbQsQAAAU4"]
[Wed Dec 24 23:26:52.068603 2025] [:error] [pid 16550:tid 16568] [client 4.217.187.220:42214] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rss.php"] [unique_id "aUwGPKYYcdD-LuO7vrAxrAAAANA"]
[Wed Dec 24 23:26:53.096117 2025] [:error] [pid 28405:tid 28427] [client 4.217.187.220:56537] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rss.php"] [unique_id "aUwGPcKkTWlhmfdXFqbQugAAAVE"]
[Wed Dec 24 23:26:54.439026 2025] [:error] [pid 16466:tid 16483] [client 4.217.187.220:56462] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rss.php"] [unique_id "aUwGPru0JcuKJMjJn6x4-QAAAA0"]
[Wed Dec 24 23:26:55.039486 2025] [:error] [pid 16466:tid 16492] [client 4.217.187.220:60013] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rss.php"] [unique_id "aUwGP7u0JcuKJMjJn6x4-wAAABY"]
[Wed Dec 24 23:26:56.452696 2025] [:error] [pid 28405:tid 28434] [client 4.217.187.220:3092] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pekok.php"] [unique_id "aUwGQMKkTWlhmfdXFqbQvwAAAVg"]
[Wed Dec 24 23:26:57.131766 2025] [:error] [pid 16466:tid 16494] [client 4.217.187.220:56539] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pekok.php"] [unique_id "aUwGQbu0JcuKJMjJn6x5AwAAABg"]
[Wed Dec 24 23:26:58.886977 2025] [:error] [pid 16467:tid 16517] [client 4.217.187.220:3103] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pekok.php"] [unique_id "aUwGQo0TJMcBxX5slgp2TAAAAFQ"]
[Wed Dec 24 23:27:00.591045 2025] [:error] [pid 16468:tid 16533] [client 4.217.187.220:54145] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pekok.php"] [unique_id "aUwGRIdyfuSTFLkCbP-71gAAAIk"]
[Wed Dec 24 23:27:01.255654 2025] [:error] [pid 28777:tid 28796] [client 4.217.187.220:42996] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aUwGRZBVBcZ34cSqz8pjqwAAAZE"]
[Wed Dec 24 23:27:01.876593 2025] [:error] [pid 16466:tid 16492] [client 4.217.187.220:44069] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aUwGRbu0JcuKJMjJn6x5CAAAABY"]
[Wed Dec 24 23:27:02.867538 2025] [:error] [pid 29371:tid 29374] [client 4.217.187.220:44094] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aUwGRns-DlKLysSq5L_ITAAAAcE"]
[Wed Dec 24 23:27:04.744811 2025] [:error] [pid 16466:tid 16493] [client 4.217.187.220:47454] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aUwGSLu0JcuKJMjJn6x5CwAAABc"]
[Wed Dec 24 23:27:05.950220 2025] [:error] [pid 16468:tid 16540] [client 4.217.187.220:42911] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aa.php"] [unique_id "aUwGSYdyfuSTFLkCbP-73AAAAJA"]
[Wed Dec 24 23:27:09.873236 2025] [:error] [pid 54139:tid 54147] [client 4.217.187.220:56538] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aa.php"] [unique_id "aUwGTcrYCZenIDzgXuLWYgAAAQY"]
[Wed Dec 24 23:27:12.734711 2025] [:error] [pid 16468:tid 16538] [client 4.217.187.220:55901] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aa.php"] [unique_id "aUwGUIdyfuSTFLkCbP-74QAAAI4"]
[Wed Dec 24 23:27:13.933669 2025] [:error] [pid 16466:tid 16490] [client 4.217.187.220:54369] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aa.php"] [unique_id "aUwGUbu0JcuKJMjJn6x5EAAAABQ"]
[Wed Dec 24 23:27:17.969772 2025] [:error] [pid 16466:tid 16471] [client 4.217.187.220:58340] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cart.php"] [unique_id "aUwGVbu0JcuKJMjJn6x5FAAAAAE"]
[Wed Dec 24 23:27:20.076997 2025] [:error] [pid 54139:tid 54143] [client 4.217.187.220:46483] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cart.php"] [unique_id "aUwGWMrYCZenIDzgXuLWagAAAQI"]
[Wed Dec 24 23:27:20.963166 2025] [:error] [pid 29371:tid 29378] [client 4.217.187.220:46486] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cart.php"] [unique_id "aUwGWHs-DlKLysSq5L_IUQAAAcU"]
[Wed Dec 24 23:27:21.694207 2025] [:error] [pid 54139:tid 54162] [client 4.217.187.220:43615] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cart.php"] [unique_id "aUwGWcrYCZenIDzgXuLWbQAAARU"]
[Wed Dec 24 23:27:32.925603 2025] [:error] [pid 16466:tid 16482] [client 4.217.187.220:52760] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aUwGZLu0JcuKJMjJn6x5KwAAAAw"]
[Wed Dec 24 23:27:34.659640 2025] [:error] [pid 16466:tid 16491] [client 4.217.187.220:53256] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aUwGZru0JcuKJMjJn6x5LQAAABU"]
[Wed Dec 24 23:27:36.080770 2025] [:error] [pid 29371:tid 29378] [client 4.217.187.220:44483] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aUwGaHs-DlKLysSq5L_IagAAAcU"]
[Wed Dec 24 23:27:37.835442 2025] [:error] [pid 16468:tid 16527] [client 4.217.187.220:44987] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aUwGaYdyfuSTFLkCbP-77gAAAIM"]
[Wed Dec 24 23:27:39.051800 2025] [:error] [pid 16468:tid 16542] [client 4.217.187.220:53287] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aUwGa4dyfuSTFLkCbP-78gAAAJI"]
[Wed Dec 24 23:27:39.539544 2025] [:error] [pid 16466:tid 16476] [client 4.217.187.220:48414] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aUwGa7u0JcuKJMjJn6x5MgAAAAY"]
[Wed Dec 24 23:27:40.798122 2025] [:error] [pid 16466:tid 16471] [client 4.217.187.220:48404] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aUwGbLu0JcuKJMjJn6x5NwAAAAE"]
[Wed Dec 24 23:27:41.868705 2025] [:error] [pid 28405:tid 28411] [client 4.217.187.220:43594] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aUwGbcKkTWlhmfdXFqbQ0gAAAUI"]
[Wed Dec 24 23:27:43.263879 2025] [:error] [pid 28405:tid 28433] [client 4.217.187.220:44492] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aUwGb8KkTWlhmfdXFqbQ1AAAAVc"]
[Wed Dec 24 23:27:44.769847 2025] [:error] [pid 16466:tid 16485] [client 4.217.187.220:3661] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aUwGcLu0JcuKJMjJn6x5PAAAAA8"]
[Wed Dec 24 23:27:46.017124 2025] [:error] [pid 29371:tid 29379] [client 4.217.187.220:4029] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aUwGcns-DlKLysSq5L_IbwAAAcY"]
[Wed Dec 24 23:27:47.013208 2025] [:error] [pid 29371:tid 29393] [client 4.217.187.220:3949] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aUwGc3s-DlKLysSq5L_IcQAAAdQ"]
[Wed Dec 24 23:27:51.789130 2025] [:error] [pid 16467:tid 16504] [client 4.217.187.220:3652] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f.php"] [unique_id "aUwGd40TJMcBxX5slgp2agAAAEc"]
[Wed Dec 24 23:27:52.196008 2025] [:error] [pid 16467:tid 16517] [client 4.217.187.220:45592] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f.php"] [unique_id "aUwGeI0TJMcBxX5slgp2awAAAFQ"]
[Wed Dec 24 23:27:52.624584 2025] [:error] [pid 54139:tid 54142] [client 4.217.187.220:55175] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f.php"] [unique_id "aUwGeMrYCZenIDzgXuLWewAAAQE"]
[Wed Dec 24 23:27:54.927586 2025] [:error] [pid 28405:tid 28416] [client 4.217.187.220:53848] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f.php"] [unique_id "aUwGesKkTWlhmfdXFqbQ5gAAAUc"]
[Wed Dec 24 23:27:56.830058 2025] [:error] [pid 16466:tid 16494] [client 4.217.187.220:54584] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/max.php"] [unique_id "aUwGfLu0JcuKJMjJn6x5QgAAABg"]
[Wed Dec 24 23:27:58.146764 2025] [:error] [pid 29371:tid 29374] [client 4.217.187.220:52408] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/max.php"] [unique_id "aUwGfns-DlKLysSq5L_IegAAAcE"]
[Wed Dec 24 23:27:59.431590 2025] [:error] [pid 28405:tid 28415] [client 4.217.187.220:50403] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/max.php"] [unique_id "aUwGf8KkTWlhmfdXFqbQ8gAAAUY"]
[Wed Dec 24 23:28:00.574230 2025] [:error] [pid 28405:tid 28416] [client 4.217.187.220:3674] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/max.php"] [unique_id "aUwGgMKkTWlhmfdXFqbQ9QAAAUc"]
[Wed Dec 24 23:28:03.225322 2025] [:error] [pid 54139:tid 54144] [client 4.217.187.220:45769] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aUwGg8rYCZenIDzgXuLWhwAAAQM"]
[Wed Dec 24 23:28:05.549198 2025] [:error] [pid 28405:tid 28422] [client 4.217.187.220:53509] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aUwGhcKkTWlhmfdXFqbQ_AAAAUw"]
[Wed Dec 24 23:28:07.170878 2025] [:error] [pid 28405:tid 28425] [client 4.217.187.220:3708] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aUwGh8KkTWlhmfdXFqbQ_wAAAU8"]
[Wed Dec 24 23:28:09.079466 2025] [:error] [pid 28777:tid 28791] [client 4.217.187.220:54572] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aUwGiZBVBcZ34cSqz8pjvwAAAYw"]
[Wed Dec 24 23:28:09.776937 2025] [:error] [pid 28405:tid 28430] [client 4.217.187.220:43157] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aUwGicKkTWlhmfdXFqbRBgAAAVQ"]
[Wed Dec 24 23:28:10.801869 2025] [:error] [pid 54139:tid 54152] [client 4.217.187.220:3394] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aUwGisrYCZenIDzgXuLWjAAAAQs"]
[Wed Dec 24 23:28:12.526835 2025] [:error] [pid 29371:tid 29374] [client 4.217.187.220:45656] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aUwGjHs-DlKLysSq5L_IhAAAAcE"]
[Wed Dec 24 23:28:13.521693 2025] [:error] [pid 29371:tid 29379] [client 4.217.187.220:3420] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aUwGjXs-DlKLysSq5L_IhQAAAcY"]
[Wed Dec 24 23:28:14.691150 2025] [:error] [pid 16550:tid 16570] [client 4.217.187.220:3940] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "aUwGjqYYcdD-LuO7vrAxugAAANI"]
[Wed Dec 24 23:28:15.578687 2025] [:error] [pid 29371:tid 29388] [client 4.217.187.220:43152] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "aUwGj3s-DlKLysSq5L_IigAAAc8"]
[Wed Dec 24 23:28:16.079470 2025] [:error] [pid 16467:tid 16514] [client 4.217.187.220:60074] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "aUwGkI0TJMcBxX5slgp2cwAAAFE"]
[Wed Dec 24 23:28:16.908375 2025] [:error] [pid 29371:tid 29397] [client 4.217.187.220:47772] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "aUwGkHs-DlKLysSq5L_IjAAAAdg"]
[Wed Dec 24 23:28:17.779231 2025] [:error] [pid 29371:tid 29390] [client 4.217.187.220:53524] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aUwGkXs-DlKLysSq5L_IjwAAAdE"]
[Wed Dec 24 23:28:19.095255 2025] [:error] [pid 16467:tid 16518] [client 4.217.187.220:43156] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aUwGk40TJMcBxX5slgp2dwAAAFU"]
[Wed Dec 24 23:28:20.557347 2025] [:error] [pid 29371:tid 29382] [client 4.217.187.220:53561] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aUwGlHs-DlKLysSq5L_IkQAAAck"]
[Wed Dec 24 23:28:21.365047 2025] [:error] [pid 54139:tid 54144] [client 4.217.187.220:60036] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aUwGlcrYCZenIDzgXuLWjwAAAQM"]
[Wed Dec 24 23:28:22.538010 2025] [:error] [pid 28405:tid 28416] [client 4.217.187.220:45646] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vv.php"] [unique_id "aUwGlsKkTWlhmfdXFqbREwAAAUc"]
[Wed Dec 24 23:28:23.257010 2025] [:error] [pid 28405:tid 28432] [client 4.217.187.220:45587] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vv.php"] [unique_id "aUwGl8KkTWlhmfdXFqbRFQAAAVY"]
[Wed Dec 24 23:28:23.770430 2025] [:error] [pid 54139:tid 54155] [client 4.217.187.220:50966] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vv.php"] [unique_id "aUwGl8rYCZenIDzgXuLWkQAAAQ4"]
[Wed Dec 24 23:28:24.498902 2025] [:error] [pid 16466:tid 16476] [client 4.217.187.220:45639] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vv.php"] [unique_id "aUwGmLu0JcuKJMjJn6x5SAAAAAY"]
[Wed Dec 24 23:28:25.207454 2025] [:error] [pid 16466:tid 16472] [client 4.217.187.220:53847] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aUwGmbu0JcuKJMjJn6x5SQAAAAI"]
[Wed Dec 24 23:28:26.375248 2025] [:error] [pid 29371:tid 29393] [client 4.217.187.220:43162] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aUwGmns-DlKLysSq5L_IkwAAAdQ"]
[Wed Dec 24 23:28:28.208669 2025] [:error] [pid 28405:tid 28433] [client 4.217.187.220:50995] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aUwGnMKkTWlhmfdXFqbRGQAAAVc"]
[Wed Dec 24 23:28:30.298948 2025] [:error] [pid 28405:tid 28432] [client 4.217.187.220:54591] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aUwGnsKkTWlhmfdXFqbRHwAAAVY"]
[Wed Dec 24 23:28:31.984822 2025] [:error] [pid 28405:tid 28412] [client 4.217.187.220:56450] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aUwGn8KkTWlhmfdXFqbRIwAAAUM"]
[Wed Dec 24 23:28:44.105853 2025] [:error] [pid 29371:tid 29392] [client 4.217.187.220:3469] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aUwGrHs-DlKLysSq5L_IqwAAAdM"]
[Wed Dec 24 23:28:45.555645 2025] [:error] [pid 28405:tid 28431] [client 4.217.187.220:56497] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aUwGrcKkTWlhmfdXFqbRLAAAAVU"]
[Wed Dec 24 23:28:46.701096 2025] [:error] [pid 29371:tid 29383] [client 4.217.187.220:47215] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aUwGrns-DlKLysSq5L_IrAAAAco"]
[Wed Dec 24 23:28:47.327684 2025] [:error] [pid 28405:tid 28410] [client 4.217.187.220:47804] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aUwGr8KkTWlhmfdXFqbRMgAAAUE"]
[Wed Dec 24 23:28:48.255665 2025] [:error] [pid 28405:tid 28429] [client 4.217.187.220:53551] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asas.php"] [unique_id "aUwGsMKkTWlhmfdXFqbRMwAAAVM"]
[Wed Dec 24 23:28:49.709086 2025] [:error] [pid 16467:tid 16520] [client 4.217.187.220:47175] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asas.php"] [unique_id "aUwGsY0TJMcBxX5slgp2gwAAAFc"]
[Wed Dec 24 23:28:50.512294 2025] [:error] [pid 16550:tid 16563] [client 4.217.187.220:47199] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asas.php"] [unique_id "aUwGsqYYcdD-LuO7vrAxyQAAAMs"]
[Wed Dec 24 23:28:51.992137 2025] [:error] [pid 54139:tid 54160] [client 4.217.187.220:3461] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asas.php"] [unique_id "aUwGs8rYCZenIDzgXuLWmgAAARM"]
[Wed Dec 24 23:28:53.871367 2025] [:error] [pid 29371:tid 29379] [client 4.217.187.220:45570] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aUwGtXs-DlKLysSq5L_IsQAAAcY"]
[Wed Dec 24 23:28:55.809717 2025] [:error] [pid 28777:tid 28779] [client 4.217.187.220:53856] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aUwGt5BVBcZ34cSqz8pj1wAAAYA"]
[Wed Dec 24 23:28:56.958453 2025] [:error] [pid 16466:tid 16480] [client 4.217.187.220:54547] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aUwGuLu0JcuKJMjJn6x5XAAAAAo"]
[Wed Dec 24 23:28:58.224788 2025] [:error] [pid 16467:tid 16521] [client 4.217.187.220:45630] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aUwGuo0TJMcBxX5slgp2hwAAAFg"]
[Wed Dec 24 23:28:59.404110 2025] [:error] [pid 16466:tid 16482] [client 4.217.187.220:54529] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aUwGu7u0JcuKJMjJn6x5YwAAAAw"]
[Wed Dec 24 23:29:01.405365 2025] [:error] [pid 28777:tid 28787] [client 4.217.187.220:45650] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aUwGvZBVBcZ34cSqz8pj2AAAAYg"]
[Wed Dec 24 23:29:03.150054 2025] [:error] [pid 16467:tid 16517] [client 4.217.187.220:45635] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aUwGv40TJMcBxX5slgp2jAAAAFQ"]
[Wed Dec 24 23:29:04.184891 2025] [:error] [pid 29371:tid 29388] [client 4.217.187.220:48704] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aUwGwHs-DlKLysSq5L_ItgAAAc8"]
[Wed Dec 24 23:29:05.611949 2025] [:error] [pid 28777:tid 28790] [client 4.217.187.220:54575] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "aUwGwZBVBcZ34cSqz8pj2wAAAYs"]
[Wed Dec 24 23:29:07.083450 2025] [:error] [pid 54139:tid 54142] [client 4.217.187.220:3650] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "aUwGw8rYCZenIDzgXuLWqgAAAQE"]
[Wed Dec 24 23:29:08.180597 2025] [:error] [pid 16466:tid 16471] [client 4.217.187.220:53826] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "aUwGxLu0JcuKJMjJn6x5bQAAAAE"]
[Wed Dec 24 23:29:09.672515 2025] [:error] [pid 28777:tid 28793] [client 4.217.187.220:53882] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "aUwGxZBVBcZ34cSqz8pj3wAAAY4"]
[Wed Dec 24 23:29:10.313690 2025] [:error] [pid 16466:tid 16482] [client 4.217.187.220:50385] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aUwGxru0JcuKJMjJn6x5cAAAAAw"]
[Wed Dec 24 23:29:11.460122 2025] [:error] [pid 16468:tid 16525] [client 4.217.187.220:50398] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aUwGx4dyfuSTFLkCbP-8EQAAAIE"]
[Wed Dec 24 23:29:12.551746 2025] [:error] [pid 16466:tid 16484] [client 4.217.187.220:3258] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aUwGyLu0JcuKJMjJn6x5cgAAAA4"]
[Wed Dec 24 23:29:12.912719 2025] [:error] [pid 16468:tid 16530] [client 4.217.187.220:4005] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aUwGyIdyfuSTFLkCbP-8EwAAAIY"]
[Wed Dec 24 23:29:13.495693 2025] [:error] [pid 16468:tid 16542] [client 4.217.187.220:48708] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r.php"] [unique_id "aUwGyYdyfuSTFLkCbP-8FQAAAJI"]
[Wed Dec 24 23:29:14.881558 2025] [:error] [pid 28405:tid 28433] [client 4.217.187.220:53829] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r.php"] [unique_id "aUwGysKkTWlhmfdXFqbROAAAAVc"]
[Wed Dec 24 23:29:15.497809 2025] [:error] [pid 16466:tid 16474] [client 4.217.187.220:3952] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r.php"] [unique_id "aUwGy7u0JcuKJMjJn6x5eQAAAAQ"]
[Wed Dec 24 23:29:16.451049 2025] [:error] [pid 16467:tid 16503] [client 4.217.187.220:3962] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r.php"] [unique_id "aUwGzI0TJMcBxX5slgp2jgAAAEY"]
[Wed Dec 24 23:29:17.533496 2025] [:error] [pid 16467:tid 16499] [client 4.217.187.220:3850] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aUwGzY0TJMcBxX5slgp2kQAAAEI"]
[Wed Dec 24 23:29:19.582079 2025] [:error] [pid 16467:tid 16497] [client 4.217.187.220:3229] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aUwGz40TJMcBxX5slgp2lAAAAEA"]
[Wed Dec 24 23:29:21.477200 2025] [:error] [pid 16550:tid 16569] [client 4.217.187.220:3238] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aUwG0aYYcdD-LuO7vrAx2wAAANE"]
[Wed Dec 24 23:29:23.042751 2025] [:error] [pid 28405:tid 28428] [client 4.217.187.220:3245] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aUwG08KkTWlhmfdXFqbRPAAAAVI"]
[Wed Dec 24 23:29:24.970353 2025] [:error] [pid 28777:tid 28803] [client 4.217.187.220:48753] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js.php"] [unique_id "aUwG1JBVBcZ34cSqz8pj5gAAAZg"]
[Wed Dec 24 23:29:26.267370 2025] [:error] [pid 54139:tid 54158] [client 4.217.187.220:53842] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js.php"] [unique_id "aUwG1srYCZenIDzgXuLWtgAAARE"]
[Wed Dec 24 23:29:27.751175 2025] [:error] [pid 54139:tid 54149] [client 4.217.187.220:3394] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js.php"] [unique_id "aUwG18rYCZenIDzgXuLWuwAAAQg"]
[Wed Dec 24 23:29:28.783402 2025] [:error] [pid 54139:tid 54163] [client 4.217.187.220:49950] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js.php"] [unique_id "aUwG2MrYCZenIDzgXuLWvAAAARY"]
[Wed Dec 24 23:29:29.674444 2025] [:error] [pid 28777:tid 28789] [client 4.217.187.220:55224] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file1.php"] [unique_id "aUwG2ZBVBcZ34cSqz8pj6gAAAYo"]
[Wed Dec 24 23:29:31.208369 2025] [:error] [pid 28405:tid 28417] [client 4.217.187.220:3929] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file1.php"] [unique_id "aUwG28KkTWlhmfdXFqbRPwAAAUg"]
[Wed Dec 24 23:29:32.145683 2025] [:error] [pid 29371:tid 29381] [client 4.217.187.220:45617] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file1.php"] [unique_id "aUwG3Hs-DlKLysSq5L_IwwAAAcg"]
[Wed Dec 24 23:29:32.826690 2025] [:error] [pid 29371:tid 29395] [client 4.217.187.220:48762] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file1.php"] [unique_id "aUwG3Hs-DlKLysSq5L_IxQAAAdY"]
[Wed Dec 24 23:29:33.805408 2025] [:error] [pid 29371:tid 29384] [client 4.217.187.220:49941] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "aUwG3Xs-DlKLysSq5L_IyQAAAcs"]
[Wed Dec 24 23:29:35.093182 2025] [:error] [pid 16468:tid 16537] [client 4.217.187.220:60318] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "aUwG34dyfuSTFLkCbP-8HAAAAI0"]
[Wed Dec 24 23:29:35.797867 2025] [:error] [pid 54139:tid 54144] [client 4.217.187.220:55187] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "aUwG38rYCZenIDzgXuLWvwAAAQM"]
[Wed Dec 24 23:29:36.978393 2025] [:error] [pid 16466:tid 16476] [client 4.217.187.220:45588] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "aUwG4Lu0JcuKJMjJn6x5gQAAAAY"]
[Wed Dec 24 23:29:38.672374 2025] [:error] [pid 29371:tid 29396] [client 4.217.187.220:3690] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/123.php"] [unique_id "aUwG4ns-DlKLysSq5L_I0AAAAdc"]
[Wed Dec 24 23:29:40.177925 2025] [:error] [pid 54139:tid 54146] [client 4.217.187.220:3955] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/123.php"] [unique_id "aUwG5MrYCZenIDzgXuLWwgAAAQU"]
[Wed Dec 24 23:29:41.324504 2025] [:error] [pid 16467:tid 16499] [client 4.217.187.220:3659] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/123.php"] [unique_id "aUwG5Y0TJMcBxX5slgp2mwAAAEI"]
[Wed Dec 24 23:29:53.623372 2025] [:error] [pid 16550:tid 16574] [client 4.217.187.220:49962] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/c.php"] [unique_id "aUwG8aYYcdD-LuO7vrAx_AAAANY"]
[Wed Dec 24 23:29:54.503680 2025] [:error] [pid 54139:tid 54158] [client 4.217.187.220:53884] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/c.php"] [unique_id "aUwG8srYCZenIDzgXuLWzgAAARE"]
[Wed Dec 24 23:29:55.760005 2025] [:error] [pid 16466:tid 16470] [client 4.217.187.220:3965] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/c.php"] [unique_id "aUwG87u0JcuKJMjJn6x5kQAAAAA"]
[Wed Dec 24 23:29:56.896026 2025] [:error] [pid 28405:tid 28424] [client 4.217.187.220:44938] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/c.php"] [unique_id "aUwG9MKkTWlhmfdXFqbRSAAAAU4"]
[Wed Dec 24 23:29:58.531365 2025] [:error] [pid 54139:tid 54148] [client 4.217.187.220:50377] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xo.php"] [unique_id "aUwG9srYCZenIDzgXuLW1QAAAQc"]
[Wed Dec 24 23:29:59.329442 2025] [:error] [pid 29371:tid 29397] [client 4.217.187.220:48758] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xo.php"] [unique_id "aUwG93s-DlKLysSq5L_I2QAAAdg"]
[Wed Dec 24 23:30:00.048948 2025] [:error] [pid 28777:tid 28802] [client 4.217.187.220:44929] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xo.php"] [unique_id "aUwG-JBVBcZ34cSqz8pj9QAAAZc"]
[Wed Dec 24 23:30:01.532453 2025] [:error] [pid 16467:tid 16507] [client 4.217.187.220:44984] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xo.php"] [unique_id "aUwG-Y0TJMcBxX5slgp2owAAAEo"]
[Wed Dec 24 23:30:02.930780 2025] [:error] [pid 16467:tid 16499] [client 4.217.187.220:47544] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dlu.php"] [unique_id "aUwG-o0TJMcBxX5slgp2pgAAAEI"]
[Wed Dec 24 23:30:03.523464 2025] [:error] [pid 29371:tid 29373] [client 4.217.187.220:47532] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dlu.php"] [unique_id "aUwG-3s-DlKLysSq5L_I2wAAAcA"]
[Wed Dec 24 23:30:04.608251 2025] [:error] [pid 29371:tid 29388] [client 4.217.187.220:48715] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dlu.php"] [unique_id "aUwG_Hs-DlKLysSq5L_I3AAAAc8"]
[Wed Dec 24 23:30:05.903374 2025] [:error] [pid 28777:tid 28800] [client 4.217.187.220:4001] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dlu.php"] [unique_id "aUwG_ZBVBcZ34cSqz8pj-AAAAZU"]
[Wed Dec 24 23:30:06.811463 2025] [:error] [pid 29371:tid 29383] [client 4.217.187.220:55229] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rk2.php"] [unique_id "aUwG_ns-DlKLysSq5L_I3gAAAco"]
[Wed Dec 24 23:30:07.803175 2025] [:error] [pid 16550:tid 16561] [client 4.217.187.220:15271] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rk2.php"] [unique_id "aUwG_6YYcdD-LuO7vrAx_wAAAMk"]
[Wed Dec 24 23:30:08.690073 2025] [:error] [pid 28405:tid 28426] [client 4.217.187.220:3713] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rk2.php"] [unique_id "aUwHAMKkTWlhmfdXFqbRUQAAAVA"]
[Wed Dec 24 23:30:11.617505 2025] [:error] [pid 54139:tid 54146] [client 4.217.187.220:48740] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rk2.php"] [unique_id "aUwHA8rYCZenIDzgXuLW2wAAAQU"]
[Wed Dec 24 23:30:12.991359 2025] [:error] [pid 16550:tid 16553] [client 4.217.187.220:53297] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aUwHBKYYcdD-LuO7vrAyAAAAAME"]
[Wed Dec 24 23:30:14.118833 2025] [:error] [pid 16466:tid 16482] [client 4.217.187.220:42438] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aUwHBru0JcuKJMjJn6x5nQAAAAw"]
[Wed Dec 24 23:30:14.963789 2025] [:error] [pid 16550:tid 16560] [client 4.217.187.220:53282] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aUwHBqYYcdD-LuO7vrAyAQAAAMg"]
[Wed Dec 24 23:30:16.238599 2025] [:error] [pid 28405:tid 28429] [client 4.217.187.220:43630] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aUwHCMKkTWlhmfdXFqbRVwAAAVM"]
[Wed Dec 24 23:30:17.118610 2025] [:error] [pid 16466:tid 16471] [client 4.217.187.220:52744] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aUwHCbu0JcuKJMjJn6x5nwAAAAE"]
[Wed Dec 24 23:30:18.094925 2025] [:error] [pid 16466:tid 16484] [client 4.217.187.220:44135] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aUwHCru0JcuKJMjJn6x5oAAAAA4"]
[Wed Dec 24 23:30:18.652397 2025] [:error] [pid 16466:tid 16485] [client 4.217.187.220:53254] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aUwHCru0JcuKJMjJn6x5ogAAAA8"]
[Wed Dec 24 23:30:20.220127 2025] [:error] [pid 28405:tid 28412] [client 4.217.187.220:52757] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aUwHDMKkTWlhmfdXFqbRWwAAAUM"]
[Wed Dec 24 23:30:22.869802 2025] [:error] [pid 29371:tid 29392] [client 4.217.187.220:53291] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aUwHDns-DlKLysSq5L_I5wAAAdM"]
[Wed Dec 24 23:30:24.570332 2025] [:error] [pid 28405:tid 28420] [client 4.217.187.220:44107] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aUwHEMKkTWlhmfdXFqbRZQAAAUo"]
[Wed Dec 24 23:30:26.113937 2025] [:error] [pid 16550:tid 16573] [client 4.217.187.220:15277] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aUwHEqYYcdD-LuO7vrAyBgAAANU"]
[Wed Dec 24 23:30:26.466903 2025] [:error] [pid 16466:tid 16476] [client 4.217.187.220:43613] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aUwHEru0JcuKJMjJn6x5pgAAAAY"]
[Wed Dec 24 23:30:26.950671 2025] [:error] [pid 28405:tid 28434] [client 4.217.187.220:48422] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aUwHEsKkTWlhmfdXFqbRaQAAAVg"]
[Wed Dec 24 23:30:27.594860 2025] [:error] [pid 16466:tid 16488] [client 4.217.187.220:42480] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aUwHE7u0JcuKJMjJn6x5qAAAABI"]
[Wed Dec 24 23:30:28.106167 2025] [:error] [pid 16466:tid 16492] [client 4.217.187.220:58334] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aUwHFLu0JcuKJMjJn6x5qQAAABY"]
[Wed Dec 24 23:30:28.946228 2025] [:error] [pid 29371:tid 29386] [client 4.217.187.220:48441] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aUwHFHs-DlKLysSq5L_I6gAAAc0"]
[Wed Dec 24 23:30:30.033693 2025] [:error] [pid 16466:tid 16475] [client 4.217.187.220:43625] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/406.php"] [unique_id "aUwHFru0JcuKJMjJn6x5rQAAAAU"]
[Wed Dec 24 23:30:30.794847 2025] [:error] [pid 16466:tid 16471] [client 4.217.187.220:52736] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/406.php"] [unique_id "aUwHFru0JcuKJMjJn6x5rgAAAAE"]
[Wed Dec 24 23:30:31.973347 2025] [:error] [pid 16467:tid 16514] [client 4.217.187.220:3952] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/406.php"] [unique_id "aUwHF40TJMcBxX5slgp2sgAAAFE"]
[Wed Dec 24 23:30:32.580236 2025] [:error] [pid 54139:tid 54156] [client 4.217.187.220:48395] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/406.php"] [unique_id "aUwHGMrYCZenIDzgXuLW4wAAAQ8"]
[Wed Dec 24 23:30:33.816957 2025] [:error] [pid 28405:tid 28434] [client 4.217.187.220:44505] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mariju.php"] [unique_id "aUwHGcKkTWlhmfdXFqbReQAAAVg"]
[Wed Dec 24 23:30:35.127721 2025] [:error] [pid 28405:tid 28422] [client 4.217.187.220:46491] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mariju.php"] [unique_id "aUwHG8KkTWlhmfdXFqbRfgAAAUw"]
[Wed Dec 24 23:30:36.197567 2025] [:error] [pid 28405:tid 28420] [client 4.217.187.220:46238] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mariju.php"] [unique_id "aUwHHMKkTWlhmfdXFqbRgAAAAUo"]
[Wed Dec 24 23:30:38.042777 2025] [:error] [pid 54139:tid 54158] [client 4.217.187.220:43595] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mariju.php"] [unique_id "aUwHHsrYCZenIDzgXuLW5wAAARE"]
[Wed Dec 24 23:30:39.522447 2025] [:error] [pid 54139:tid 54151] [client 4.217.187.220:46223] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aUwHH8rYCZenIDzgXuLW6QAAAQo"]
[Wed Dec 24 23:30:40.344420 2025] [:error] [pid 28405:tid 28421] [client 4.217.187.220:43638] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aUwHIMKkTWlhmfdXFqbRggAAAUs"]
[Wed Dec 24 23:30:41.443326 2025] [:error] [pid 28405:tid 28434] [client 4.217.187.220:46511] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aUwHIcKkTWlhmfdXFqbRhQAAAVg"]
[Wed Dec 24 23:30:42.956559 2025] [:error] [pid 16550:tid 16561] [client 4.217.187.220:58335] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aUwHIqYYcdD-LuO7vrAyDAAAAMk"]
[Wed Dec 24 23:30:43.671462 2025] [:error] [pid 54139:tid 54165] [client 4.217.187.220:46228] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cache.php"] [unique_id "aUwHI8rYCZenIDzgXuLW7QAAARg"]
[Wed Dec 24 23:30:44.629948 2025] [:error] [pid 29371:tid 29381] [client 4.217.187.220:58095] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cache.php"] [unique_id "aUwHJHs-DlKLysSq5L_I8QAAAcg"]
[Wed Dec 24 23:30:45.969173 2025] [:error] [pid 16467:tid 16511] [client 4.217.187.220:58056] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cache.php"] [unique_id "aUwHJY0TJMcBxX5slgp2vAAAAE4"]
[Wed Dec 24 23:30:48.120968 2025] [:error] [pid 28405:tid 28411] [client 4.217.187.220:53480] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cache.php"] [unique_id "aUwHKMKkTWlhmfdXFqbRkAAAAUI"]
[Wed Dec 24 23:30:48.635063 2025] [:error] [pid 28405:tid 28431] [client 4.217.187.220:58533] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zfile.php"] [unique_id "aUwHKMKkTWlhmfdXFqbRkQAAAVU"]
[Wed Dec 24 23:30:50.648777 2025] [:error] [pid 28777:tid 28797] [client 4.217.187.220:46211] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zfile.php"] [unique_id "aUwHKpBVBcZ34cSqz8pkEQAAAZI"]
[Wed Dec 24 23:30:51.925974 2025] [:error] [pid 16550:tid 16572] [client 4.217.187.220:58556] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zfile.php"] [unique_id "aUwHK6YYcdD-LuO7vrAyEwAAANQ"]
[Wed Dec 24 23:30:59.242580 2025] [:error] [pid 16550:tid 16563] [client 4.217.187.220:55895] [client 4.217.187.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aUwHM6YYcdD-LuO7vrAyJwAAAMs"]
[Wed Dec 24 23:31:06.942291 2025] [:error] [pid 54139:tid 54144] [client 4.217.187.220:54161] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aUwHOsrYCZenIDzgXuLXAQAAAQM"]
[Wed Dec 24 23:31:08.204532 2025] [:error] [pid 28405:tid 28416] [client 4.217.187.220:47709] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aUwHPMKkTWlhmfdXFqbRuQAAAUc"]
[Wed Dec 24 23:31:09.129781 2025] [:error] [pid 28405:tid 28419] [client 4.217.187.220:42884] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aUwHPcKkTWlhmfdXFqbRuwAAAUk"]
[Wed Dec 24 23:31:10.203381 2025] [:error] [pid 54139:tid 54160] [client 4.217.187.220:47722] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aUwHPsrYCZenIDzgXuLXAgAAARM"]
[Wed Dec 24 23:31:12.124848 2025] [:error] [pid 16550:tid 16562] [client 4.217.187.220:51788] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mpvloi.php"] [unique_id "aUwHQKYYcdD-LuO7vrAyKgAAAMo"]
[Wed Dec 24 23:31:13.927003 2025] [:error] [pid 28777:tid 28795] [client 4.217.187.220:42985] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mpvloi.php"] [unique_id "aUwHQZBVBcZ34cSqz8pkJgAAAZA"]
[Wed Dec 24 23:31:14.598979 2025] [:error] [pid 29371:tid 29388] [client 4.217.187.220:47683] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mpvloi.php"] [unique_id "aUwHQns-DlKLysSq5L_JAAAAAc8"]
[Wed Dec 24 23:31:16.034886 2025] [:error] [pid 16466:tid 16487] [client 4.217.187.220:59988] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mpvloi.php"] [unique_id "aUwHRLu0JcuKJMjJn6x5uQAAABE"]
[Wed Dec 24 23:31:17.427206 2025] [:error] [pid 16468:tid 16535] [client 4.217.187.220:54181] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v1.php"] [unique_id "aUwHRYdyfuSTFLkCbP-8PQAAAIs"]
[Wed Dec 24 23:31:19.037771 2025] [:error] [pid 16466:tid 16484] [client 4.217.187.220:47447] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v1.php"] [unique_id "aUwHR7u0JcuKJMjJn6x5uwAAAA4"]
[Wed Dec 24 23:31:20.583292 2025] [:error] [pid 16466:tid 16473] [client 4.217.187.220:48343] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v1.php"] [unique_id "aUwHSLu0JcuKJMjJn6x5vwAAAAM"]
[Wed Dec 24 23:31:22.701256 2025] [:error] [pid 29371:tid 29380] [client 4.217.187.220:42922] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v1.php"] [unique_id "aUwHSns-DlKLysSq5L_JAwAAAcc"]
[Wed Dec 24 23:31:23.925572 2025] [:error] [pid 16467:tid 16497] [client 4.217.187.220:51831] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2.php"] [unique_id "aUwHS40TJMcBxX5slgp2ywAAAEA"]
[Wed Dec 24 23:31:25.922993 2025] [:error] [pid 28405:tid 28434] [client 4.217.187.220:44441] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2.php"] [unique_id "aUwHTcKkTWlhmfdXFqbR1QAAAVg"]
[Wed Dec 24 23:31:26.884911 2025] [:error] [pid 16466:tid 16487] [client 4.217.187.220:60027] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2.php"] [unique_id "aUwHTru0JcuKJMjJn6x5xgAAABE"]
[Wed Dec 24 23:31:28.874849 2025] [:error] [pid 28405:tid 28426] [client 4.217.187.220:48323] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2.php"] [unique_id "aUwHUMKkTWlhmfdXFqbR2AAAAVA"]
[Wed Dec 24 23:31:29.672615 2025] [:error] [pid 28405:tid 28413] [client 4.217.187.220:44448] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dex.php"] [unique_id "aUwHUcKkTWlhmfdXFqbR3AAAAUQ"]
[Wed Dec 24 23:31:30.910848 2025] [:error] [pid 29371:tid 29396] [client 4.217.187.220:48342] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dex.php"] [unique_id "aUwHUns-DlKLysSq5L_JBwAAAdc"]
[Wed Dec 24 23:31:32.954513 2025] [:error] [pid 16468:tid 16542] [client 4.217.187.220:44455] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dex.php"] [unique_id "aUwHVIdyfuSTFLkCbP-8QgAAAJI"]
[Wed Dec 24 23:31:33.950280 2025] [:error] [pid 28405:tid 28409] [client 4.217.187.220:46790] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dex.php"] [unique_id "aUwHVcKkTWlhmfdXFqbR4AAAAUA"]
[Wed Dec 24 23:31:35.414223 2025] [:error] [pid 16550:tid 16573] [client 4.217.187.220:49540] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/angelV2.php"] [unique_id "aUwHV6YYcdD-LuO7vrAyLgAAANU"]
[Wed Dec 24 23:31:38.358269 2025] [:error] [pid 54139:tid 54143] [client 4.217.187.220:51880] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/angelV2.php"] [unique_id "aUwHWsrYCZenIDzgXuLXFgAAAQI"]
[Wed Dec 24 23:31:40.198046 2025] [:error] [pid 28777:tid 28800] [client 4.217.187.220:50928] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/angelV2.php"] [unique_id "aUwHXJBVBcZ34cSqz8pkPQAAAZU"]
[Wed Dec 24 23:31:41.813800 2025] [:error] [pid 54139:tid 54156] [client 4.217.187.220:50449] [client 4.217.187.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/angelV2.php"] [unique_id "aUwHXcrYCZenIDzgXuLXHAAAAQ8"]
[Thu Dec 25 01:30:15.793840 2025] [:error] [pid 38611:tid 38619] [client 106.221.76.58:34590] [client 106.221.76.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.221.76.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aUwjJ-Lzy4v8uFDvXNieqgAAAAM"]
[Thu Dec 25 02:05:45.136803 2025] [:error] [pid 21513:tid 21529] [client 170.106.84.136:45400] [client 170.106.84.136] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUwreWPuOaBlVJ9Har3x0wAAAY4"]
[Thu Dec 25 06:48:42.751990 2025] [:error] [pid 31655:tid 31675] [client 103.221.221.58:54356] [client 103.221.221.58] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "aUxtypozPMk9HPtIJPP_zgAAANI"]
[Thu Dec 25 06:49:45.375741 2025] [:error] [pid 31655:tid 31676] [client 103.28.36.106:40982] [client 103.28.36.106] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/index.php/wp-json/wp/v2/users"] [unique_id "aUxuCZozPMk9HPtIJPMAKgAAANM"]
[Thu Dec 25 06:51:07.358051 2025] [:error] [pid 31655:tid 31680] [client 178.128.201.28:37250] [client 178.128.201.28] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/Wp/v2/users"] [unique_id "aUxuW5ozPMk9HPtIJPMAkAAAANc"]
[Thu Dec 25 06:51:40.376295 2025] [:error] [pid 31571:tid 31645] [client 103.28.36.220:36080] [client 103.28.36.220] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/V2/users"] [unique_id "aUxufO7e_lLK2X5wU8kQdAAAAJI"]
[Thu Dec 25 06:51:58.396851 2025] [:error] [pid 31569:tid 31592] [client 209.142.65.90:33356] [client 209.142.65.90] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/V2/users"] [unique_id "aUxujmiSFBH7Ee_uldX3vgAAABM"]
[Thu Dec 25 06:53:42.022082 2025] [:error] [pid 2996:tid 3012] [client 107.190.140.138:56972] [client 107.190.140.138] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/Wp-JsOn/Wp/V2/UsErS"] [unique_id "aUxu9qrrTp0EWNyhaIRsmQAAAQ4"]
[Thu Dec 25 06:54:59.814801 2025] [:error] [pid 31655:tid 31673] [client 94.130.105.111:41936] [client 94.130.105.111] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users.json"] [unique_id "aUxvQ5ozPMk9HPtIJPMBgQAAANA"]
[Thu Dec 25 06:55:08.282392 2025] [:error] [pid 31569:tid 31586] [client 54.64.91.115:44318] [client 54.64.91.115] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users.json"] [unique_id "aUxvTGiSFBH7Ee_uldX4VQAAAA0"]
[Thu Dec 25 11:43:27.762677 2025] [:error] [pid 31655:tid 31681] [client 72.53.210.82:34984] [client 72.53.210.82] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/Wp/v2/users"] [unique_id "aUyy35ozPMk9HPtIJPM6GgAAANg"]
[Thu Dec 25 11:43:55.695840 2025] [:error] [pid 31570:tid 31607] [client 109.199.112.156:55812] [client 109.199.112.156] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/V2/users"] [unique_id "aUyy-2Py2DpAzW_4a2jlZQAAAEc"]
[Thu Dec 25 11:44:53.429836 2025] [:error] [pid 2996:tid 3006] [client 20.96.70.34:19142] [client 20.96.70.34] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/usErs"] [unique_id "aUyzNarrTp0EWNyhaIS8jAAAAQg"]
[Thu Dec 25 11:45:43.616367 2025] [:error] [pid 31569:tid 31591] [client 167.71.193.139:53696] [client 167.71.193.139] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/Wp-JsOn/Wp/V2/UsErS"] [unique_id "aUyzZ2iSFBH7Ee_uldVUqQAAABI"]
[Thu Dec 25 11:47:58.187277 2025] [:error] [pid 31655:tid 31675] [client 104.199.8.96:52240] [client 104.199.8.96] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users.json"] [unique_id "aUyz7pozPMk9HPtIJPM63wAAANI"]
[Thu Dec 25 12:45:51.128798 2025] [:error] [pid 31569:tid 31590] [client 170.106.193.108:38938] [client 170.106.193.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aUzBf2iSFBH7Ee_uldVr1QAAABE"]
[Thu Dec 25 14:34:33.532385 2025] [:error] [pid 31570:tid 31613] [client 106.54.62.156:41490] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aUza-WPy2DpAzW_4a2gFwQAAAE0"]
[Thu Dec 25 15:18:27.544963 2025] [:error] [pid 31655:tid 31662] [client 43.153.85.46:33540] [client 43.153.85.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aUzlQ5ozPMk9HPtIJPNjgQAAAMU"]
[Thu Dec 25 15:42:43.259400 2025] [:error] [pid 2996:tid 3000] [client 17.22.237.129:54298] [client 17.22.237.129] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "198.186.131.170_65eaf7306597a0b9416730df93b6e70a98a9282a"): Internal error (specific information not available) [hostname "expressinteriors.com"] [uri "/index.php"] [unique_id "aUzq8arrTp0EWNyhaIQCcAAAAQI"]
[Thu Dec 25 18:35:45.742617 2025] [:error] [pid 31570:tid 31619] [client 35.199.32.106:51020] [client 35.199.32.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.199.32.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU0TgWPy2DpAzW_4a2g7mAAAAFM"]
[Thu Dec 25 18:35:47.969352 2025] [:error] [pid 31570:tid 31606] [client 35.199.32.106:51020] [client 35.199.32.106] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aU0Tg2Py2DpAzW_4a2g7nAAAAEY"]
[Thu Dec 25 18:35:48.185275 2025] [:error] [pid 31570:tid 31616] [client 35.199.32.106:51020] [client 35.199.32.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.199.32.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU0ThGPy2DpAzW_4a2g7ngAAAFA"]
[Thu Dec 25 18:35:49.625336 2025] [:error] [pid 31655:tid 31675] [client 35.199.32.106:62955] [client 35.199.32.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.199.32.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU0ThZozPMk9HPtIJPOU8gAAANI"]
[Thu Dec 25 18:35:51.087698 2025] [:error] [pid 31569:tid 31578] [client 35.199.32.106:53136] [client 35.199.32.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.199.32.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU0Th2iSFBH7Ee_uldXQhQAAAAU"]
[Thu Dec 25 18:35:52.536108 2025] [:error] [pid 31571:tid 31637] [client 35.199.32.106:63374] [client 35.199.32.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.199.32.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU0TiO7e_lLK2X5wU8mziAAAAIo"]
[Thu Dec 25 18:35:53.992734 2025] [:error] [pid 31571:tid 31627] [client 35.199.32.106:63087] [client 35.199.32.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.199.32.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU0Tie7e_lLK2X5wU8mziwAAAIA"]
[Thu Dec 25 18:35:53.992874 2025] [:error] [pid 31571:tid 31627] [client 35.199.32.106:63087] [client 35.199.32.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.199.32.106, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU0Tie7e_lLK2X5wU8mziwAAAIA"]
[Thu Dec 25 18:39:36.862464 2025] [:error] [pid 31570:tid 31617] [client 35.188.244.75:59288] [client 35.188.244.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.188.244.75, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU0UaGPy2DpAzW_4a2g8WQAAAFE"]
[Thu Dec 25 18:39:38.969778 2025] [:error] [pid 31570:tid 31609] [client 35.188.244.75:59288] [client 35.188.244.75] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aU0UamPy2DpAzW_4a2g8XAAAAEk"]
[Thu Dec 25 18:39:39.218180 2025] [:error] [pid 31570:tid 31606] [client 35.188.244.75:59288] [client 35.188.244.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.188.244.75, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU0Ua2Py2DpAzW_4a2g8XQAAAEY"]
[Thu Dec 25 18:39:40.812874 2025] [:error] [pid 31655:tid 31666] [client 35.188.244.75:55708] [client 35.188.244.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.188.244.75, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU0UbJozPMk9HPtIJPOVagAAAMk"]
[Thu Dec 25 18:39:42.234497 2025] [:error] [pid 31570:tid 31610] [client 35.188.244.75:56399] [client 35.188.244.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.188.244.75, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU0UbmPy2DpAzW_4a2g8XgAAAEo"]
[Thu Dec 25 18:39:43.652401 2025] [:error] [pid 31655:tid 31658] [client 35.188.244.75:61955] [client 35.188.244.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.188.244.75, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU0Ub5ozPMk9HPtIJPOVbQAAAME"]
[Thu Dec 25 18:39:45.218361 2025] [:error] [pid 31655:tid 31676] [client 35.188.244.75:61440] [client 35.188.244.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.188.244.75, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU0UcZozPMk9HPtIJPOVcAAAANM"]
[Thu Dec 25 18:39:45.218588 2025] [:error] [pid 31655:tid 31676] [client 35.188.244.75:61440] [client 35.188.244.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.188.244.75, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU0UcZozPMk9HPtIJPOVcAAAANM"]
[Thu Dec 25 18:41:06.628216 2025] [:error] [pid 2996:tid 3011] [client 117.2.155.13:43930] [client 117.2.155.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 117.2.155.13, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aU0UwqrrTp0EWNyhaIRKPQAAAQ0"]
[Thu Dec 25 18:41:07.655874 2025] [:error] [pid 2996:tid 3006] [client 117.2.155.13:43930] [client 117.2.155.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 117.2.155.13, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aU0Uw6rrTp0EWNyhaIRKPwAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 25 19:15:39.545426 2025] [:error] [pid 31569:tid 31592] [client 95.217.205.89:41102] [client 95.217.205.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.217.205.89, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aU0c22iSFBH7Ee_uldXewwAAABM"]
[Thu Dec 25 19:15:44.510073 2025] [:error] [pid 31569:tid 31575] [client 95.217.205.89:41102] [client 95.217.205.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.217.205.89, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aU0c4GiSFBH7Ee_uldXeyAAAAAI"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 25 19:45:26.815946 2025] [:error] [pid 64971:tid 64981] [client 188.68.225.50:38564] [client 188.68.225.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.68.225.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aU0j1qqyk1GkxTrDJixNPQAAAkQ"]
[Thu Dec 25 19:45:28.109567 2025] [:error] [pid 64971:tid 65000] [client 188.68.225.50:38564] [client 188.68.225.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.68.225.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aU0j2Kqyk1GkxTrDJixNPgAAAlc"], referer: https://expressinteriors.com/wp-login.php
[Thu Dec 25 21:30:06.559062 2025] [:error] [pid 27869:tid 27894] [client 43.157.142.101:58756] [client 43.157.142.101] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aU08XhNK7_n86kBD7qfHhgAAAJc"]
[Thu Dec 25 21:41:41.315755 2025] [autoindex:error] [pid 22045:tid 22115] [client 174.138.85.139:63063] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Dec 26 01:09:00.045269 2025] [:error] [pid 24864:tid 24925] [client 170.106.35.153:47868] [client 170.106.35.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aU1vrMu59XOK5DpQQdCTIgAAAUU"]
[Fri Dec 26 03:03:29.552881 2025] [:error] [pid 24863:tid 24907] [client 195.178.110.228:49309] [client 195.178.110.228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aU2KgR8SaH2KMpp43vcKwAAAAM4"]
[Fri Dec 26 03:03:47.247748 2025] [:error] [pid 24946:tid 24954] [client 195.178.110.228:62797] [client 195.178.110.228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aU2Kk1fyLYxv3Jn9S71rkwAAAEY"]
[Fri Dec 26 03:21:30.287032 2025] [:error] [pid 24862:tid 24882] [client 111.172.249.49:60070] [client 111.172.249.49] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aU2Ourt-eeEEuo-2JKhQ_QAAABA"]
[Fri Dec 26 03:58:43.909815 2025] [:error] [pid 46850:tid 46867] [client 49.51.178.45:42606] [client 49.51.178.45] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aU2Xczz4ErbKw_tQlY1pfQAAAAw"]
[Fri Dec 26 07:53:09.564827 2025] [:error] [pid 28269:tid 28320] [client 49.145.200.184:14156] [client 49.145.200.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.200.184, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU3OZZ3ZK8bJ-c9-kjNjNQAAAFI"]
[Fri Dec 26 07:57:14.944163 2025] [:error] [pid 28355:tid 28369] [client 49.145.200.184:13708] [client 49.145.200.184] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aU3PWrsFqKXf7ADZcTY6MQAAAMw"]
[Fri Dec 26 07:59:16.340476 2025] [:error] [pid 28269:tid 28309] [client 49.145.200.184:15612] [client 49.145.200.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.200.184, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU3P1J3ZK8bJ-c9-kjNkxgAAAEc"]
[Fri Dec 26 08:01:10.138953 2025] [:error] [pid 28270:tid 28345] [client 49.145.200.184:17133] [client 49.145.200.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.200.184, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU3QRl9Ac79_ckdPN5JpXwAAAJA"]
[Fri Dec 26 08:03:03.758158 2025] [:error] [pid 28268:tid 28283] [client 49.145.200.184:14666] [client 49.145.200.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.200.184, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU3Qt3c_KuO_55-uPTTnoQAAAAg"]
[Fri Dec 26 08:04:51.095771 2025] [:error] [pid 28355:tid 28365] [client 49.145.200.184:16497] [client 49.145.200.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.200.184, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU3RI7sFqKXf7ADZcTY88QAAAMg"]
[Fri Dec 26 09:21:45.128981 2025] [:error] [pid 28268:tid 28283] [client 36.41.75.167:35694] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aU3jKXc_KuO_55-uPTT-7AAAAAg"]
[Fri Dec 26 14:40:36.996613 2025] [:error] [pid 28269:tid 28321] [client 203.159.81.7:32239] [client 203.159.81.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aU4t5J3ZK8bJ-c9-kjPyQgAAAFM"]
[Fri Dec 26 14:40:49.583056 2025] [:error] [pid 28355:tid 28374] [client 203.159.81.10:24231] [client 203.159.81.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aU4t8bsFqKXf7ADZcTbEDwAAANE"]
[Fri Dec 26 14:41:11.926624 2025] [:error] [pid 15063:tid 15080] [client 203.159.81.2:55665] [client 203.159.81.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aU4uB-Dsf_aL46Jy7z-rvQAAAQ8"]
[Fri Dec 26 14:41:27.003604 2025] [:error] [pid 28268:tid 28281] [client 203.159.81.8:49305] [client 203.159.81.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aU4uF3c_KuO_55-uPTReewAAAAY"]
[Fri Dec 26 14:41:50.870263 2025] [:error] [pid 34865:tid 34878] [client 203.159.81.16:48209] [client 203.159.81.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aU4uLqi4zjVVKBdvuTSUEAAAAUs"]
[Fri Dec 26 14:41:55.228606 2025] [:error] [pid 28270:tid 28341] [client 203.159.81.21:37921] [client 203.159.81.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aU4uM19Ac79_ckdPN5IEXgAAAIw"]
[Fri Dec 26 14:41:56.153533 2025] [:error] [pid 28269:tid 28313] [client 203.159.81.39:41921] [client 203.159.81.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aU4uNJ3ZK8bJ-c9-kjP08AAAAEs"]
[Fri Dec 26 14:42:09.920543 2025] [autoindex:error] [pid 34865:tid 34874] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:10.382480 2025] [autoindex:error] [pid 34865:tid 34884] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:10.831754 2025] [autoindex:error] [pid 34865:tid 34889] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:11.307619 2025] [autoindex:error] [pid 34865:tid 34870] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:16.187170 2025] [autoindex:error] [pid 34865:tid 34875] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:16.651389 2025] [autoindex:error] [pid 34865:tid 34890] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:17.108894 2025] [autoindex:error] [pid 34865:tid 34887] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:17.567888 2025] [autoindex:error] [pid 34865:tid 34869] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:17.988994 2025] [autoindex:error] [pid 34865:tid 34886] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:18.866829 2025] [autoindex:error] [pid 34865:tid 34877] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:19.794177 2025] [autoindex:error] [pid 34865:tid 34883] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:23.309272 2025] [autoindex:error] [pid 34865:tid 34871] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:23.770357 2025] [autoindex:error] [pid 34865:tid 34888] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:30.730927 2025] [autoindex:error] [pid 34865:tid 34878] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:31.160153 2025] [autoindex:error] [pid 34865:tid 34877] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:31.683798 2025] [autoindex:error] [pid 34865:tid 34878] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:32.181760 2025] [autoindex:error] [pid 34865:tid 34871] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:35.547228 2025] [autoindex:error] [pid 34865:tid 34874] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:36.023980 2025] [autoindex:error] [pid 34865:tid 34884] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:39.834908 2025] [autoindex:error] [pid 34865:tid 34890] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:49.866239 2025] [autoindex:error] [pid 34865:tid 34874] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:50.633472 2025] [autoindex:error] [pid 34865:tid 34886] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:42:51.089141 2025] [autoindex:error] [pid 34865:tid 34878] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:43:01.466942 2025] [autoindex:error] [pid 34865:tid 34880] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:43:09.296058 2025] [autoindex:error] [pid 34865:tid 34868] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:43:12.981914 2025] [autoindex:error] [pid 34865:tid 34870] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:43:13.450144 2025] [autoindex:error] [pid 34865:tid 34888] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:43:15.246388 2025] [autoindex:error] [pid 34865:tid 34887] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:43:15.691399 2025] [autoindex:error] [pid 34865:tid 34885] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:43:16.244156 2025] [autoindex:error] [pid 34865:tid 34881] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:43:27.297230 2025] [autoindex:error] [pid 34865:tid 34873] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:44:34.551246 2025] [autoindex:error] [pid 34865:tid 34888] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:44:35.008778 2025] [autoindex:error] [pid 34865:tid 34884] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:44:35.465473 2025] [autoindex:error] [pid 34865:tid 34869] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:44:35.955533 2025] [autoindex:error] [pid 34865:tid 34887] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:44:40.844051 2025] [autoindex:error] [pid 34865:tid 34891] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:44:42.647334 2025] [autoindex:error] [pid 34865:tid 34888] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:44:46.613983 2025] [autoindex:error] [pid 34865:tid 34886] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:44:48.975235 2025] [autoindex:error] [pid 34865:tid 34880] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:44:49.442768 2025] [autoindex:error] [pid 34865:tid 34878] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:44:49.896853 2025] [autoindex:error] [pid 34865:tid 34879] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:44:52.216082 2025] [autoindex:error] [pid 34865:tid 34891] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:44:52.698513 2025] [autoindex:error] [pid 34865:tid 34883] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:44:53.171013 2025] [autoindex:error] [pid 34865:tid 34870] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:44:53.636286 2025] [autoindex:error] [pid 34865:tid 34873] [client 203.159.81.44:62349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:45:37.559298 2025] [autoindex:error] [pid 34865:tid 34867] [client 203.159.81.2:51565] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:45:59.372329 2025] [autoindex:error] [pid 34865:tid 34885] [client 203.159.81.2:51565] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:46:07.602192 2025] [autoindex:error] [pid 34865:tid 34867] [client 203.159.81.2:51565] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:46:08.134165 2025] [autoindex:error] [pid 34865:tid 34890] [client 203.159.81.2:51565] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:46:17.768013 2025] [autoindex:error] [pid 34865:tid 34881] [client 203.159.81.2:51565] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:46:18.224767 2025] [autoindex:error] [pid 34865:tid 34891] [client 203.159.81.2:51565] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:46:18.708520 2025] [autoindex:error] [pid 34865:tid 34876] [client 203.159.81.2:51565] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:46:19.157876 2025] [autoindex:error] [pid 34865:tid 34868] [client 203.159.81.2:51565] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:46:19.920678 2025] [autoindex:error] [pid 34865:tid 34875] [client 203.159.81.2:51565] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:46:20.355745 2025] [autoindex:error] [pid 34865:tid 34879] [client 203.159.81.2:51565] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:46:20.823954 2025] [autoindex:error] [pid 34865:tid 34867] [client 203.159.81.2:51565] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:46:21.299878 2025] [autoindex:error] [pid 34865:tid 34888] [client 203.159.81.2:51565] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:46:21.786794 2025] [autoindex:error] [pid 34865:tid 34885] [client 203.159.81.2:51565] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 14:46:51.405038 2025] [autoindex:error] [pid 34865:tid 34871] [client 203.159.81.2:51565] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Dec 26 15:01:11.837042 2025] [:error] [pid 28268:tid 28292] [client 157.230.19.140:36772] [client 157.230.19.140] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aU4yt3c_KuO_55-uPTRocgAAABE"]
[Fri Dec 26 15:01:20.354774 2025] [authz_core:error] [pid 34865:tid 34871] [client 157.230.19.140:48948] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Fri Dec 26 15:01:24.501442 2025] [:error] [pid 34865:tid 34869] [client 157.230.19.140:48978] [client 157.230.19.140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aU4yxKi4zjVVKBdvuTScgAAAAUI"]
[Fri Dec 26 15:01:26.539768 2025] [:error] [pid 28270:tid 28339] [client 157.230.19.140:39014] [client 157.230.19.140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aU4yxl9Ac79_ckdPN5IOtQAAAIo"]
[Fri Dec 26 15:16:05.549809 2025] [:error] [pid 7160:tid 7179] [client 157.230.19.140:35558] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2/api-docs"] [unique_id "aU42New_ihNZR5L8vEUmDgAAAZA"]
[Fri Dec 26 15:16:06.557844 2025] [:error] [pid 28268:tid 28284] [client 157.230.19.140:35562] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3/api-docs"] [unique_id "aU42Nnc_KuO_55-uPTRrdQAAAAk"]
[Fri Dec 26 15:16:07.551237 2025] [:error] [pid 28268:tid 28289] [client 157.230.19.140:35576] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api-docs/swagger.json"] [unique_id "aU42N3c_KuO_55-uPTRreQAAAA4"]
[Fri Dec 26 15:16:08.552188 2025] [:error] [pid 28270:tid 28343] [client 157.230.19.140:35588] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api/swagger.json"] [unique_id "aU42OF9Ac79_ckdPN5IRiQAAAI4"]
[Fri Dec 26 15:16:09.575945 2025] [:error] [pid 28268:tid 28275] [client 157.230.19.140:35602] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/@vite/env"] [unique_id "aU42OXc_KuO_55-uPTRrfAAAAAA"]
[Fri Dec 26 15:16:10.548787 2025] [:error] [pid 28355:tid 28371] [client 157.230.19.140:35606] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/actuator/env"] [unique_id "aU42OrsFqKXf7ADZcTbTewAAAM4"]
[Fri Dec 26 15:16:11.552367 2025] [:error] [pid 15063:tid 15087] [client 157.230.19.140:35620] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aU42O-Dsf_aL46Jy7z-7JQAAARY"]
[Fri Dec 26 15:16:12.554163 2025] [:error] [pid 15063:tid 15068] [client 157.230.19.140:35636] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server"] [unique_id "aU42PODsf_aL46Jy7z-7JwAAAQM"]
[Fri Dec 26 15:16:13.563905 2025] [:error] [pid 28355:tid 28370] [client 157.230.19.140:35638] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aU42PbsFqKXf7ADZcTbTfgAAAM0"]
[Fri Dec 26 15:16:15.554256 2025] [:error] [pid 28268:tid 28277] [client 157.230.19.140:60038] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about"] [unique_id "aU42P3c_KuO_55-uPTRrfwAAAAI"]
[Fri Dec 26 15:16:16.543743 2025] [:error] [pid 28355:tid 28361] [client 157.230.19.140:60048] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/debug/default/view"] [unique_id "aU42QLsFqKXf7ADZcTbTgAAAAMQ"]
[Fri Dec 26 15:16:17.555510 2025] [:error] [pid 34865:tid 34869] [client 157.230.19.140:60050] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2/_catalog"] [unique_id "aU42Qai4zjVVKBdvuTSfsQAAAUI"]
[Fri Dec 26 15:16:18.546819 2025] [:error] [pid 28269:tid 28309] [client 157.230.19.140:60058] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"] [unique_id "aU42Qp3ZK8bJ-c9-kjMCRwAAAEc"]
[Fri Dec 26 15:16:19.567543 2025] [:error] [pid 28355:tid 28379] [client 157.230.19.140:60062] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server-status"] [unique_id "aU42Q7sFqKXf7ADZcTbTggAAANY"]
[Fri Dec 26 15:16:20.567875 2025] [:error] [pid 28355:tid 28367] [client 157.230.19.140:60072] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login.action"] [unique_id "aU42RLsFqKXf7ADZcTbThAAAAMo"]
[Fri Dec 26 15:16:21.560046 2025] [:error] [pid 34865:tid 34890] [client 157.230.19.140:60086] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/_all_dbs"] [unique_id "aU42Rai4zjVVKBdvuTSfswAAAVc"]
[Fri Dec 26 15:16:22.550122 2025] [:error] [pid 28270:tid 28350] [client 157.230.19.140:60092] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.DS_Store"] [unique_id "aU42Rl9Ac79_ckdPN5IRkwAAAJU"]
[Fri Dec 26 15:16:23.548351 2025] [:error] [pid 28268:tid 28298] [client 157.230.19.140:60096] [client 157.230.19.140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aU42R3c_KuO_55-uPTRrhgAAABc"]
[Fri Dec 26 15:16:25.549797 2025] [:error] [pid 28268:tid 28286] [client 157.230.19.140:53966] [client 157.230.19.140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aU42SXc_KuO_55-uPTRriwAAAAs"]
[Fri Dec 26 15:16:26.557488 2025] [:error] [pid 28268:tid 28289] [client 157.230.19.140:53970] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s/4313e2232313e243e2330313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties"] [unique_id "aU42Snc_KuO_55-uPTRrkwAAAA4"]
[Fri Dec 26 15:16:27.550923 2025] [:error] [pid 28270:tid 28340] [client 157.230.19.140:53976] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aU42S19Ac79_ckdPN5IRmgAAAIs"]
[Fri Dec 26 15:16:28.614725 2025] [:error] [pid 28268:tid 28286] [client 157.230.19.140:53988] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/telescope/requests"] [unique_id "aU42THc_KuO_55-uPTRrmQAAAAs"]
[Fri Dec 26 15:16:29.679620 2025] [:error] [pid 15063:tid 15080] [client 157.230.19.140:54004] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aU42TeDsf_aL46Jy7z-7MAAAAQ8"]
[Fri Dec 26 15:16:30.712051 2025] [:error] [pid 28268:tid 28289] [client 157.230.19.140:54016] [client 157.230.19.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aU42Tnc_KuO_55-uPTRrnwAAAA4"]
[Fri Dec 26 15:30:37.903812 2025] [:error] [pid 28269:tid 28308] [client 182.44.12.37:35766] [client 182.44.12.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aU45nZ3ZK8bJ-c9-kjMIawAAAEY"]
[Fri Dec 26 16:21:34.519395 2025] [ssl:error] [pid 28270:tid 28351] [client 159.65.24.22:33696] AH02032: Hostname sanremoweston.com provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup
[Fri Dec 26 17:52:37.763396 2025] [:error] [pid 28355:tid 28366] [client 49.51.178.45:44794] [client 49.51.178.45] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aU5a5bsFqKXf7ADZcTbzzwAAAMk"]
[Fri Dec 26 18:06:05.650386 2025] [:error] [pid 28268:tid 28283] [client 69.57.172.119:43702] [client 69.57.172.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.57.172.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU5eDXc_KuO_55-uPTSQJwAAAAg"]
[Fri Dec 26 18:41:33.178761 2025] [:error] [pid 28270:tid 28353] [client 84.247.168.35:49832] [client 84.247.168.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.247.168.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU5mXV9Ac79_ckdPN5I-ZwAAAJg"]
[Fri Dec 26 19:11:36.313204 2025] [:error] [pid 15063:tid 15085] [client 35.233.122.65:57958] [client 35.233.122.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.233.122.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU5taODsf_aL46Jy7z_2oAAAARQ"]
[Fri Dec 26 19:11:38.789440 2025] [:error] [pid 15063:tid 15077] [client 35.233.122.65:57958] [client 35.233.122.65] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aU5tauDsf_aL46Jy7z_2sAAAAQw"]
[Fri Dec 26 19:11:39.059731 2025] [:error] [pid 15063:tid 15076] [client 35.233.122.65:57958] [client 35.233.122.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.233.122.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU5ta-Dsf_aL46Jy7z_2sgAAAQs"]
[Fri Dec 26 19:11:40.809520 2025] [:error] [pid 28268:tid 28282] [client 35.233.122.65:61918] [client 35.233.122.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.233.122.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU5tbHc_KuO_55-uPTSdfgAAAAc"]
[Fri Dec 26 19:11:42.474630 2025] [:error] [pid 28268:tid 28290] [client 35.233.122.65:58517] [client 35.233.122.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.233.122.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU5tbnc_KuO_55-uPTSdgwAAAA8"]
[Fri Dec 26 19:11:44.098233 2025] [:error] [pid 7160:tid 7174] [client 35.233.122.65:58125] [client 35.233.122.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.233.122.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU5tcOw_ihNZR5L8vEVowwAAAYs"]
[Fri Dec 26 19:11:45.805206 2025] [:error] [pid 28355:tid 28377] [client 35.233.122.65:55416] [client 35.233.122.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.233.122.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU5tcbsFqKXf7ADZcTYG4gAAANQ"]
[Fri Dec 26 19:11:45.805369 2025] [:error] [pid 28355:tid 28377] [client 35.233.122.65:55416] [client 35.233.122.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.233.122.65, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU5tcbsFqKXf7ADZcTYG4gAAANQ"]
[Fri Dec 26 19:44:59.115805 2025] [:error] [pid 28268:tid 28275] [client 31.130.206.52:33356] [client 31.130.206.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.130.206.52, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU51O3c_KuO_55-uPTSn0gAAAAA"]
[Fri Dec 26 20:18:06.586764 2025] [:error] [pid 28269:tid 28314] [client 5.161.103.140:48762] [client 5.161.103.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.161.103.140, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU58_p3ZK8bJ-c9-kjNy8AAAAEw"]
[Fri Dec 26 20:47:48.484397 2025] [:error] [pid 28355:tid 28357] [client 103.185.74.28:8119] [client 103.185.74.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.185.74.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6D9LsFqKXf7ADZcTYcogAAAMA"]
[Fri Dec 26 20:49:47.115440 2025] [:error] [pid 34865:tid 34877] [client 164.90.229.64:60618] [client 164.90.229.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.90.229.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6Ea6i4zjVVKBdvuTTu0wAAAUo"]
[Fri Dec 26 20:50:37.903986 2025] [:error] [pid 28270:tid 28329] [client 68.193.181.207:58004] [client 68.193.181.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.193.181.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6EnV9Ac79_ckdPN5JatwAAAIA"]
[Fri Dec 26 20:52:30.114157 2025] [:error] [pid 34865:tid 34868] [client 31.186.11.171:56050] [client 31.186.11.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.186.11.171, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6FDqi4zjVVKBdvuTTvigAAAUE"]
[Fri Dec 26 21:07:06.764164 2025] [:error] [pid 15063:tid 15071] [client 46.101.217.74:50330] [client 46.101.217.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.101.217.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6IeuDsf_aL46Jy7z8ZQgAAAQY"]
[Fri Dec 26 21:09:23.825192 2025] [:error] [pid 28268:tid 28294] [client 35.233.134.231:56488] [client 35.233.134.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.233.134.231, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6JA3c_KuO_55-uPTS6zgAAABM"]
[Fri Dec 26 21:09:25.871822 2025] [:error] [pid 28268:tid 28286] [client 35.233.134.231:56488] [client 35.233.134.231] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aU6JBXc_KuO_55-uPTS61AAAAAs"]
[Fri Dec 26 21:09:26.067718 2025] [:error] [pid 28268:tid 28279] [client 35.233.134.231:56488] [client 35.233.134.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.233.134.231, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6JBnc_KuO_55-uPTS61QAAAAQ"]
[Fri Dec 26 21:09:27.404951 2025] [:error] [pid 28268:tid 28277] [client 35.233.134.231:51783] [client 35.233.134.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.233.134.231, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6JB3c_KuO_55-uPTS61gAAAAI"]
[Fri Dec 26 21:09:28.743680 2025] [:error] [pid 15063:tid 15074] [client 35.233.134.231:51907] [client 35.233.134.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.233.134.231, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6JCODsf_aL46Jy7z8ZnQAAAQk"]
[Fri Dec 26 21:09:30.157797 2025] [:error] [pid 7160:tid 7173] [client 35.233.134.231:61223] [client 35.233.134.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.233.134.231, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6JCuw_ihNZR5L8vEWOUQAAAYo"]
[Fri Dec 26 21:09:31.584423 2025] [:error] [pid 7160:tid 7175] [client 35.233.134.231:62857] [client 35.233.134.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.233.134.231, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6JC-w_ihNZR5L8vEWOUwAAAYw"]
[Fri Dec 26 21:09:31.584582 2025] [:error] [pid 7160:tid 7175] [client 35.233.134.231:62857] [client 35.233.134.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.233.134.231, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6JC-w_ihNZR5L8vEWOUwAAAYw"]
[Fri Dec 26 21:09:55.744464 2025] [:error] [pid 28269:tid 28317] [client 138.68.142.20:45722] [client 138.68.142.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.68.142.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6JI53ZK8bJ-c9-kjOG7AAAAE8"]
[Fri Dec 26 21:14:52.073467 2025] [:error] [pid 28355:tid 28371] [client 190.107.177.240:37694] [client 190.107.177.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.107.177.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6KTLsFqKXf7ADZcTYjrgAAAM4"]
[Fri Dec 26 21:18:11.925689 2025] [:error] [pid 7160:tid 7171] [client 171.244.17.74:38118] [client 171.244.17.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.244.17.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6LE-w_ihNZR5L8vEWRLQAAAYg"]
[Fri Dec 26 21:24:48.222949 2025] [:error] [pid 28355:tid 28364] [client 98.142.247.144:57330] [client 98.142.247.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.142.247.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6MoLsFqKXf7ADZcTYmFwAAAMc"]
[Fri Dec 26 21:32:28.006563 2025] [:error] [pid 28268:tid 28286] [client 89.45.44.30:60434] [client 89.45.44.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.45.44.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6ObHc_KuO_55-uPTTAGwAAAAs"]
[Fri Dec 26 21:58:58.342854 2025] [:error] [pid 7160:tid 7168] [client 5.9.248.74:33170] [client 5.9.248.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.248.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6Uouw_ihNZR5L8vEWcTgAAAYU"]
[Fri Dec 26 22:01:22.570890 2025] [:error] [pid 15063:tid 15075] [client 154.12.118.230:39406] [client 154.12.118.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.12.118.230, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6VMuDsf_aL46Jy7z8nowAAAQo"]
[Fri Dec 26 22:04:33.388419 2025] [:error] [pid 28269:tid 28307] [client 182.42.105.85:38540] [client 182.42.105.85] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aU6V8Z3ZK8bJ-c9-kjOaKQAAAEU"]
[Fri Dec 26 22:08:32.477416 2025] [:error] [pid 34865:tid 34880] [client 173.231.229.252:43684] [client 173.231.229.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.231.229.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6W4Ki4zjVVKBdvuTQA_QAAAU0"]
[Fri Dec 26 22:23:42.663922 2025] [:error] [pid 34865:tid 34876] [client 31.186.11.171:60934] [client 31.186.11.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.186.11.171, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6abqi4zjVVKBdvuTQDAgAAAUk"]
[Fri Dec 26 22:25:34.116791 2025] [:error] [pid 28269:tid 28323] [client 185.112.84.48:51984] [client 185.112.84.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.112.84.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6a3p3ZK8bJ-c9-kjOfpQAAAFU"]
[Fri Dec 26 22:32:40.282871 2025] [:error] [pid 28355:tid 28381] [client 159.223.61.19:56494] [client 159.223.61.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.61.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6ciLsFqKXf7ADZcTYyowAAANg"]
[Fri Dec 26 22:32:49.744469 2025] [:error] [pid 15063:tid 15074] [client 68.183.25.188:43596] [client 68.183.25.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.25.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6ckeDsf_aL46Jy7z8stAAAAQk"]
[Fri Dec 26 22:36:05.314058 2025] [:error] [pid 7160:tid 7177] [client 138.68.142.20:52548] [client 138.68.142.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.68.142.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6dVew_ihNZR5L8vEWkXAAAAY4"]
[Fri Dec 26 22:40:55.905764 2025] [:error] [pid 7160:tid 7178] [client 15.185.97.242:52348] [client 15.185.97.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.185.97.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6ed-w_ihNZR5L8vEWk_QAAAY8"]
[Fri Dec 26 22:43:28.551036 2025] [:error] [pid 34865:tid 34880] [client 116.118.48.183:48274] [client 116.118.48.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.118.48.183, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6fEKi4zjVVKBdvuTQHCwAAAU0"]
[Fri Dec 26 22:55:06.304072 2025] [:error] [pid 15063:tid 15083] [client 162.241.244.85:45362] [client 162.241.244.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.244.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6hyuDsf_aL46Jy7z8wxAAAARI"]
[Fri Dec 26 23:10:43.728823 2025] [:error] [pid 7160:tid 7178] [client 47.95.35.188:42456] [client 47.95.35.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.95.35.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6lc-w_ihNZR5L8vEWtvgAAAY8"]
[Fri Dec 26 23:11:56.586222 2025] [:error] [pid 15063:tid 15071] [client 182.16.245.210:44638] [client 182.16.245.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.16.245.210, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6lvODsf_aL46Jy7z81XwAAAQY"]
[Fri Dec 26 23:16:31.659160 2025] [:error] [pid 28268:tid 28280] [client 159.203.120.5:47326] [client 159.203.120.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.120.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6mz3c_KuO_55-uPTTTnwAAAAU"]
[Fri Dec 26 23:19:02.346345 2025] [:error] [pid 28268:tid 28279] [client 68.183.25.188:36884] [client 68.183.25.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.25.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6nZnc_KuO_55-uPTTUKwAAAAQ"]
[Fri Dec 26 23:49:44.064409 2025] [:error] [pid 28270:tid 28336] [client 45.228.210.14:32792] [client 45.228.210.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.228.210.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6umF9Ac79_ckdPN5KB_AAAAIc"]
[Sat Dec 27 00:07:12.569770 2025] [:error] [pid 28268:tid 28281] [client 128.65.195.49:55848] [client 128.65.195.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.65.195.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6ysHc_KuO_55-uPTTgxQAAAAY"]
[Sat Dec 27 00:07:14.682896 2025] [:error] [pid 34865:tid 34876] [client 128.65.195.49:56058] [client 128.65.195.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.65.195.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6ysqi4zjVVKBdvuTQgfwAAAUk"]
[Sat Dec 27 00:07:16.695430 2025] [:error] [pid 28355:tid 28364] [client 128.65.195.49:56274] [client 128.65.195.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.65.195.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6ytLsFqKXf7ADZcTZHMgAAAMc"]
[Sat Dec 27 00:07:18.715353 2025] [:error] [pid 28355:tid 28373] [client 128.65.195.49:56484] [client 128.65.195.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.65.195.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6ytrsFqKXf7ADZcTZHNgAAANA"]
[Sat Dec 27 00:07:20.751441 2025] [:error] [pid 15063:tid 15075] [client 128.65.195.49:56650] [client 128.65.195.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.65.195.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6yuODsf_aL46Jy7z9DUAAAAQo"]
[Sat Dec 27 00:07:22.770598 2025] [:error] [pid 34865:tid 34880] [client 128.65.195.49:56898] [client 128.65.195.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.65.195.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6yuqi4zjVVKBdvuTQgjgAAAU0"]
[Sat Dec 27 00:07:22.770760 2025] [:error] [pid 34865:tid 34880] [client 128.65.195.49:56898] [client 128.65.195.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 128.65.195.49, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6yuqi4zjVVKBdvuTQgjgAAAU0"]
[Sat Dec 27 00:29:09.026387 2025] [:error] [pid 34187:tid 34202] [client 217.114.214.248:49466] [client 217.114.214.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.114.214.248, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU631av8srZGEpsIm8Dc9QAAAAo"]
[Sat Dec 27 00:32:27.491793 2025] [:error] [pid 34187:tid 34200] [client 103.42.58.162:54956] [client 103.42.58.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.42.58.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU64m6v8srZGEpsIm8DdpAAAAAg"]
[Sat Dec 27 00:33:07.504914 2025] [:error] [pid 34187:tid 34208] [client 34.7.192.25:56583] [client 34.7.192.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.7.192.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU64w6v8srZGEpsIm8DdxAAAABA"]
[Sat Dec 27 00:33:10.010875 2025] [:error] [pid 34187:tid 34202] [client 34.7.192.25:56583] [client 34.7.192.25] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aU64xqv8srZGEpsIm8DdxwAAAAo"]
[Sat Dec 27 00:33:10.287184 2025] [:error] [pid 34187:tid 34203] [client 34.7.192.25:56583] [client 34.7.192.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.7.192.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU64xqv8srZGEpsIm8DdyAAAAAs"]
[Sat Dec 27 00:33:11.936948 2025] [:error] [pid 34188:tid 34237] [client 34.7.192.25:54645] [client 34.7.192.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.7.192.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU64xw54j0mXgip5BAGOMQAAAFE"]
[Sat Dec 27 00:33:13.641216 2025] [:error] [pid 34188:tid 34234] [client 34.7.192.25:59029] [client 34.7.192.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.7.192.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU64yQ54j0mXgip5BAGONgAAAE4"]
[Sat Dec 27 00:33:15.626673 2025] [:error] [pid 34274:tid 34297] [client 34.7.192.25:61168] [client 34.7.192.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.7.192.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU64y86fabpS0mfhiCHlPAAAANU"]
[Sat Dec 27 00:33:17.421475 2025] [:error] [pid 34274:tid 34287] [client 34.7.192.25:56013] [client 34.7.192.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.7.192.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU64zc6fabpS0mfhiCHlPwAAAMs"]
[Sat Dec 27 00:33:17.421644 2025] [:error] [pid 34274:tid 34287] [client 34.7.192.25:56013] [client 34.7.192.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.7.192.25, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU64zc6fabpS0mfhiCHlPwAAAMs"]
[Sat Dec 27 00:33:55.295501 2025] [:error] [pid 34187:tid 34196] [client 203.171.29.49:36222] [client 203.171.29.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.171.29.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU6486v8srZGEpsIm8Dd_gAAAAQ"]
[Sat Dec 27 00:50:58.273733 2025] [:error] [pid 34274:tid 34292] [client 89.45.44.30:42900] [client 89.45.44.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.45.44.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU688s6fabpS0mfhiCHwXQAAANA"]
[Sat Dec 27 00:50:58.275501 2025] [:error] [pid 34274:tid 34292] [client 89.45.44.30:42900] [client 89.45.44.30] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU688s6fabpS0mfhiCHwXQAAANA"]
[Sat Dec 27 00:50:58.276717 2025] [:error] [pid 34274:tid 34292] [client 89.45.44.30:42900] [client 89.45.44.30] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU688s6fabpS0mfhiCHwXQAAANA"]
[Sat Dec 27 00:52:24.872738 2025] [:error] [pid 34189:tid 34252] [client 20.253.155.235:18946] [client 20.253.155.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.253.155.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU69SAnn007DnMwSsfcQBAAAAIU"]
[Sat Dec 27 00:52:24.874475 2025] [:error] [pid 34189:tid 34252] [client 20.253.155.235:18946] [client 20.253.155.235] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU69SAnn007DnMwSsfcQBAAAAIU"]
[Sat Dec 27 00:52:24.875686 2025] [:error] [pid 34189:tid 34252] [client 20.253.155.235:18946] [client 20.253.155.235] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU69SAnn007DnMwSsfcQBAAAAIU"]
[Sat Dec 27 00:53:06.534541 2025] [:error] [pid 34189:tid 34268] [client 185.243.11.123:33366] [client 185.243.11.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.243.11.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU69cgnn007DnMwSsfcQdwAAAJU"]
[Sat Dec 27 00:53:06.536034 2025] [:error] [pid 34189:tid 34268] [client 185.243.11.123:33366] [client 185.243.11.123] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU69cgnn007DnMwSsfcQdwAAAJU"]
[Sat Dec 27 00:53:06.537266 2025] [:error] [pid 34189:tid 34268] [client 185.243.11.123:33366] [client 185.243.11.123] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU69cgnn007DnMwSsfcQdwAAAJU"]
[Sat Dec 27 00:53:34.742321 2025] [:error] [pid 34187:tid 34200] [client 61.171.113.15:52432] [client 61.171.113.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 61.171.113.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU69jqv8srZGEpsIm8DlrAAAAAg"]
[Sat Dec 27 00:53:34.744498 2025] [:error] [pid 34187:tid 34200] [client 61.171.113.15:52432] [client 61.171.113.15] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU69jqv8srZGEpsIm8DlrAAAAAg"]
[Sat Dec 27 00:53:34.746151 2025] [:error] [pid 34187:tid 34200] [client 61.171.113.15:52432] [client 61.171.113.15] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU69jqv8srZGEpsIm8DlrAAAAAg"]
[Sat Dec 27 01:05:08.643777 2025] [:error] [pid 34274:tid 34294] [client 87.106.229.106:56824] [client 87.106.229.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.106.229.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7ARM6fabpS0mfhiCH3aAAAANI"]
[Sat Dec 27 01:06:51.695617 2025] [:error] [pid 34189:tid 34262] [client 177.234.157.232:36008] [client 177.234.157.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.234.157.232, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7Aqwnn007DnMwSsfcWggAAAI8"]
[Sat Dec 27 01:06:51.697331 2025] [:error] [pid 34189:tid 34262] [client 177.234.157.232:36008] [client 177.234.157.232] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7Aqwnn007DnMwSsfcWggAAAI8"]
[Sat Dec 27 01:06:51.698685 2025] [:error] [pid 34189:tid 34262] [client 177.234.157.232:36008] [client 177.234.157.232] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7Aqwnn007DnMwSsfcWggAAAI8"]
[Sat Dec 27 01:11:06.812500 2025] [:error] [pid 34188:tid 34222] [client 81.88.49.53:58636] [client 81.88.49.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.53, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7Bqg54j0mXgip5BAGeEQAAAEI"]
[Sat Dec 27 01:11:06.814004 2025] [:error] [pid 34188:tid 34222] [client 81.88.49.53:58636] [client 81.88.49.53] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7Bqg54j0mXgip5BAGeEQAAAEI"]
[Sat Dec 27 01:11:06.815147 2025] [:error] [pid 34188:tid 34222] [client 81.88.49.53:58636] [client 81.88.49.53] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7Bqg54j0mXgip5BAGeEQAAAEI"]
[Sat Dec 27 01:11:26.824125 2025] [:error] [pid 34189:tid 34253] [client 160.25.7.215:45730] [client 160.25.7.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.25.7.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7Bvgnn007DnMwSsfcZzAAAAIY"]
[Sat Dec 27 01:11:26.826106 2025] [:error] [pid 34189:tid 34253] [client 160.25.7.215:45730] [client 160.25.7.215] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7Bvgnn007DnMwSsfcZzAAAAIY"]
[Sat Dec 27 01:11:26.827636 2025] [:error] [pid 34189:tid 34253] [client 160.25.7.215:45730] [client 160.25.7.215] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7Bvgnn007DnMwSsfcZzAAAAIY"]
[Sat Dec 27 01:15:32.120984 2025] [:error] [pid 34187:tid 34195] [client 20.253.155.235:10448] [client 20.253.155.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.253.155.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7CtKv8srZGEpsIm8Dt2QAAAAM"]
[Sat Dec 27 01:22:36.822805 2025] [:error] [pid 34274:tid 34300] [client 188.166.178.247:57618] [client 188.166.178.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.178.247, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7EXM6fabpS0mfhiCECXAAAANg"]
[Sat Dec 27 01:35:44.796770 2025] [:error] [pid 47566:tid 47587] [client 213.157.205.208:35342] [client 213.157.205.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.157.205.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7HcKyYgLfR4YwO7bx3QwAAARI"]
[Sat Dec 27 01:46:58.205609 2025] [:error] [pid 34274:tid 34296] [client 45.56.101.223:33442] [client 45.56.101.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.56.101.223, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7KEs6fabpS0mfhiCENMgAAANQ"]
[Sat Dec 27 01:50:22.611246 2025] [:error] [pid 34187:tid 34197] [client 95.169.180.54:54748] [client 95.169.180.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.169.180.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7K3qv8srZGEpsIm8D6cAAAAAU"]
[Sat Dec 27 01:51:18.437624 2025] [:error] [pid 34274:tid 34281] [client 159.223.86.119:55246] [client 159.223.86.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.86.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7LFs6fabpS0mfhiCEPOAAAAMU"]
[Sat Dec 27 01:52:25.978589 2025] [:error] [pid 34189:tid 34268] [client 103.124.95.33:38190] [client 103.124.95.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.124.95.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7LWQnn007DnMwSsfcp9wAAAJU"]
[Sat Dec 27 01:53:41.554717 2025] [:error] [pid 34188:tid 34225] [client 94.141.5.251:48768] [client 94.141.5.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.141.5.251, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7LpQ54j0mXgip5BAGtawAAAEU"]
[Sat Dec 27 02:13:52.608613 2025] [:error] [pid 34274:tid 34294] [client 208.109.212.53:46610] [client 208.109.212.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.109.212.53, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7QYM6fabpS0mfhiCEYuQAAANI"]
[Sat Dec 27 02:20:29.590422 2025] [:error] [pid 34274:tid 34283] [client 88.99.242.15:52520] [client 88.99.242.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.99.242.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7R7c6fabpS0mfhiCEbfAAAAMc"]
[Sat Dec 27 02:24:04.187360 2025] [:error] [pid 34188:tid 34242] [client 160.250.187.4:36506] [client 160.250.187.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.187.4, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7SxA54j0mXgip5BAG4lwAAAFY"]
[Sat Dec 27 02:43:13.095119 2025] [:error] [pid 47566:tid 47570] [client 162.241.218.232:51974] [client 162.241.218.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.218.232, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7XQayYgLfR4YwO7byemgAAAQE"]
[Sat Dec 27 03:07:35.833163 2025] [:error] [pid 34189:tid 34251] [client 203.112.154.60:38546] [client 203.112.154.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.112.154.60, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7c9wnn007DnMwSsfdHBAAAAIQ"]
[Sat Dec 27 03:10:42.566429 2025] [:error] [pid 47566:tid 47586] [client 103.28.37.47:36830] [client 103.28.37.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.28.37.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7dsqyYgLfR4YwO7bys1wAAARE"]
[Sat Dec 27 03:23:10.614538 2025] [:error] [pid 34188:tid 34242] [client 172.191.197.110:42278] [client 172.191.197.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.191.197.110, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7gng54j0mXgip5BAHN_gAAAFY"]
[Sat Dec 27 03:27:38.789627 2025] [:error] [pid 13442:tid 13454] [client 81.88.49.53:21969] [client 81.88.49.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.53, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7hqpwTNumio5Cyhz0cnwAAAMo"]
[Sat Dec 27 03:30:37.018516 2025] [:error] [pid 13442:tid 13459] [client 34.38.119.124:55170] [client 34.38.119.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.119.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7iXZwTNumio5Cyhz0d0AAAAM8"]
[Sat Dec 27 03:30:39.363346 2025] [:error] [pid 13442:tid 13446] [client 34.38.119.124:55170] [client 34.38.119.124] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aU7iX5wTNumio5Cyhz0d1QAAAMI"]
[Sat Dec 27 03:30:39.639093 2025] [:error] [pid 13442:tid 13457] [client 34.38.119.124:55170] [client 34.38.119.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.119.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7iX5wTNumio5Cyhz0d1gAAAM0"]
[Sat Dec 27 03:30:41.315181 2025] [:error] [pid 13270:tid 13383] [client 34.38.119.124:54860] [client 34.38.119.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.119.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7iYROAry4DSumc1lr9xQAAAFc"]
[Sat Dec 27 03:30:43.060637 2025] [:error] [pid 13271:tid 13392] [client 34.38.119.124:49805] [client 34.38.119.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.119.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7iY1kVOSHAabf2ogJxQgAAAIU"]
[Sat Dec 27 03:30:44.706272 2025] [:error] [pid 13271:tid 13400] [client 34.38.119.124:53021] [client 34.38.119.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.119.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7iZFkVOSHAabf2ogJxSQAAAI0"]
[Sat Dec 27 03:30:46.373738 2025] [:error] [pid 13270:tid 13365] [client 34.38.119.124:63778] [client 34.38.119.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.119.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7iZhOAry4DSumc1lr9ygAAAEU"]
[Sat Dec 27 03:30:46.373942 2025] [:error] [pid 13270:tid 13365] [client 34.38.119.124:63778] [client 34.38.119.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.38.119.124, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7iZhOAry4DSumc1lr9ygAAAEU"]
[Sat Dec 27 03:46:47.461736 2025] [:error] [pid 16192:tid 16215] [client 34.247.172.200:59282] [client 34.247.172.200] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.247.172.200, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7mJwoiu8rmimcLXe4bgwAAANU"]
[Sat Dec 27 03:53:10.389930 2025] [:error] [pid 53443:tid 53455] [client 185.74.80.5:46846] [client 185.74.80.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.74.80.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7npovixl-n325_196y5QAAAAI"]
[Sat Dec 27 04:08:09.924224 2025] [:error] [pid 32278:tid 32295] [client 89.45.44.30:38416] [client 89.45.44.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.45.44.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rKX-IfCN2Cy9GcchVUwAAAM8"]
[Sat Dec 27 04:09:06.991520 2025] [:error] [pid 32191:tid 32202] [client 198.54.114.62:34520] [client 198.54.114.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.62, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rYrPNtMgrjVCHIdFicwAAAAc"]
[Sat Dec 27 04:09:08.609882 2025] [:error] [pid 32278:tid 32288] [client 198.54.114.62:34526] [client 198.54.114.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.62, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rZH-IfCN2Cy9GcchVkQAAAMg"]
[Sat Dec 27 04:09:10.174077 2025] [:error] [pid 32193:tid 32258] [client 198.54.114.62:34538] [client 198.54.114.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.62, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rZhgw0eCOc2qYqaLzgwAAAIg"]
[Sat Dec 27 04:09:11.709466 2025] [:error] [pid 32192:tid 32231] [client 198.54.114.62:34544] [client 198.54.114.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.62, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rZy_q0VFe066lbk-gsQAAAEg"]
[Sat Dec 27 04:09:13.262240 2025] [:error] [pid 32278:tid 32299] [client 198.54.114.62:34556] [client 198.54.114.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.62, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7raX-IfCN2Cy9GcchVlgAAANM"]
[Sat Dec 27 04:09:14.825216 2025] [:error] [pid 32192:tid 32233] [client 198.54.114.62:56740] [client 198.54.114.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.62, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rai_q0VFe066lbk-gtQAAAEo"]
[Sat Dec 27 04:09:14.825387 2025] [:error] [pid 32192:tid 32233] [client 198.54.114.62:56740] [client 198.54.114.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 198.54.114.62, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rai_q0VFe066lbk-gtQAAAEo"]
[Sat Dec 27 04:09:15.826113 2025] [:error] [pid 32191:tid 32203] [client 198.54.114.62:56754] [client 198.54.114.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.62, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7ra7PNtMgrjVCHIdFidwAAAAg"]
[Sat Dec 27 04:09:15.826308 2025] [:error] [pid 32191:tid 32203] [client 198.54.114.62:56754] [client 198.54.114.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 198.54.114.62, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7ra7PNtMgrjVCHIdFidwAAAAg"]
[Sat Dec 27 04:09:16.826640 2025] [:error] [pid 32278:tid 32294] [client 198.54.114.62:56760] [client 198.54.114.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.62, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rbH-IfCN2Cy9GcchVnwAAAM4"]
[Sat Dec 27 04:09:16.826826 2025] [:error] [pid 32278:tid 32294] [client 198.54.114.62:56760] [client 198.54.114.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 198.54.114.62, counter = 8"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rbH-IfCN2Cy9GcchVnwAAAM4"]
[Sat Dec 27 04:09:17.826912 2025] [:error] [pid 32278:tid 32299] [client 198.54.114.62:56768] [client 198.54.114.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.62, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rbX-IfCN2Cy9GcchVogAAANM"]
[Sat Dec 27 04:09:17.827088 2025] [:error] [pid 32278:tid 32299] [client 198.54.114.62:56768] [client 198.54.114.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 198.54.114.62, counter = 9"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rbX-IfCN2Cy9GcchVogAAANM"]
[Sat Dec 27 04:09:18.823827 2025] [:error] [pid 32191:tid 32215] [client 198.54.114.62:56776] [client 198.54.114.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.62, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rbrPNtMgrjVCHIdFieQAAABQ"]
[Sat Dec 27 04:09:18.824057 2025] [:error] [pid 32191:tid 32215] [client 198.54.114.62:56776] [client 198.54.114.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 198.54.114.62, counter = 10"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rbrPNtMgrjVCHIdFieQAAABQ"]
[Sat Dec 27 04:10:10.814430 2025] [:error] [pid 32193:tid 32264] [client 89.46.106.211:42836] [client 89.46.106.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.46.106.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rohgw0eCOc2qYqaLzxwAAAI4"]
[Sat Dec 27 04:10:29.099536 2025] [:error] [pid 32191:tid 32219] [client 129.148.21.186:37602] [client 129.148.21.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.148.21.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rtbPNtMgrjVCHIdFi2wAAABg"]
[Sat Dec 27 04:10:31.344498 2025] [:error] [pid 32192:tid 32224] [client 129.148.21.186:37614] [client 129.148.21.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.148.21.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rty_q0VFe066lbk-g_wAAAEE"]
[Sat Dec 27 04:10:33.704522 2025] [:error] [pid 32278:tid 32288] [client 129.148.21.186:37626] [client 129.148.21.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.148.21.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7ruX-IfCN2Cy9GcchWNQAAAMg"]
[Sat Dec 27 04:10:36.069698 2025] [:error] [pid 32193:tid 32264] [client 129.148.21.186:37642] [client 129.148.21.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.148.21.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rvBgw0eCOc2qYqaL0HgAAAI4"]
[Sat Dec 27 04:10:38.422050 2025] [:error] [pid 32278:tid 32281] [client 129.148.21.186:37648] [client 129.148.21.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.148.21.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rvn-IfCN2Cy9GcchWPQAAAME"]
[Sat Dec 27 04:10:40.737499 2025] [:error] [pid 32191:tid 32217] [client 129.148.21.186:35258] [client 129.148.21.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.148.21.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rwLPNtMgrjVCHIdFi8AAAABY"]
[Sat Dec 27 04:10:40.737709 2025] [:error] [pid 32191:tid 32217] [client 129.148.21.186:35258] [client 129.148.21.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 129.148.21.186, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rwLPNtMgrjVCHIdFi8AAAABY"]
[Sat Dec 27 04:10:42.479565 2025] [:error] [pid 32193:tid 32271] [client 129.148.21.186:35260] [client 129.148.21.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.148.21.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rwhgw0eCOc2qYqaL0JAAAAJU"]
[Sat Dec 27 04:10:42.479714 2025] [:error] [pid 32193:tid 32271] [client 129.148.21.186:35260] [client 129.148.21.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 129.148.21.186, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rwhgw0eCOc2qYqaL0JAAAAJU"]
[Sat Dec 27 04:10:44.130959 2025] [:error] [pid 32192:tid 32234] [client 129.148.21.186:35272] [client 129.148.21.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.148.21.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rxC_q0VFe066lbk-hEQAAAEs"]
[Sat Dec 27 04:10:44.131146 2025] [:error] [pid 32192:tid 32234] [client 129.148.21.186:35272] [client 129.148.21.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 129.148.21.186, counter = 8"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7rxC_q0VFe066lbk-hEQAAAEs"]
[Sat Dec 27 04:11:17.609988 2025] [:error] [pid 32193:tid 32261] [client 117.62.235.53:48652] [client 117.62.235.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aU7r5Rgw0eCOc2qYqaL0RQAAAIs"]
[Sat Dec 27 04:18:53.915509 2025] [:error] [pid 32278:tid 32284] [client 103.216.119.243:53860] [client 103.216.119.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.216.119.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7trX-IfCN2Cy9GcchaHAAAAMQ"]
[Sat Dec 27 04:26:36.033602 2025] [:error] [pid 32193:tid 32269] [client 172.191.197.110:54052] [client 172.191.197.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.191.197.110, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7vfBgw0eCOc2qYqaL58gAAAJM"]
[Sat Dec 27 04:33:22.732630 2025] [:error] [pid 32191:tid 32202] [client 20.239.64.62:7568] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aU7xErPNtMgrjVCHIdFqpAAAAAc"]
[Sat Dec 27 04:33:25.441529 2025] [:error] [pid 32278:tid 32295] [client 20.239.64.62:3732] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aU7xFX-IfCN2Cy9GcchicwAAAM8"]
[Sat Dec 27 04:33:28.885671 2025] [:error] [pid 32278:tid 32284] [client 20.239.64.62:1987] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aU7xGH-IfCN2Cy9GcchieAAAAMQ"]
[Sat Dec 27 04:33:31.478406 2025] [:error] [pid 32193:tid 32273] [client 20.239.64.62:2034] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aU7xGxgw0eCOc2qYqaL9HAAAAJc"]
[Sat Dec 27 04:33:33.817094 2025] [:error] [pid 32278:tid 32301] [client 20.239.64.62:5035] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aU7xHX-IfCN2Cy9GcchifwAAANU"]
[Sat Dec 27 04:33:36.266404 2025] [:error] [pid 32278:tid 32285] [client 20.239.64.62:5031] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aU7xIH-IfCN2Cy9GcchigwAAAMU"]
[Sat Dec 27 04:33:38.237544 2025] [:error] [pid 32278:tid 32286] [client 20.239.64.62:2016] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aU7xIn-IfCN2Cy9GcchihwAAAMY"]
[Sat Dec 27 04:33:39.638606 2025] [:error] [pid 32278:tid 32281] [client 20.239.64.62:4391] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aU7xI3-IfCN2Cy9GcchiiAAAAME"]
[Sat Dec 27 04:33:41.795612 2025] [:error] [pid 32193:tid 32268] [client 20.239.64.62:2144] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aU7xJRgw0eCOc2qYqaL9KgAAAJI"]
[Sat Dec 27 04:33:43.854988 2025] [:error] [pid 32193:tid 32266] [client 20.239.64.62:7648] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aU7xJxgw0eCOc2qYqaL9MAAAAJA"]
[Sat Dec 27 04:33:46.330264 2025] [:error] [pid 32193:tid 32267] [client 20.239.64.62:1714] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aU7xKhgw0eCOc2qYqaL9MgAAAJE"]
[Sat Dec 27 04:33:50.389189 2025] [:error] [pid 32192:tid 32247] [client 20.239.64.62:5504] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aU7xLi_q0VFe066lbk-o7gAAAFg"]
[Sat Dec 27 04:33:54.176802 2025] [:error] [pid 32193:tid 32269] [client 20.239.64.62:1049] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aU7xMhgw0eCOc2qYqaL9OgAAAJM"]
[Sat Dec 27 04:33:58.678079 2025] [:error] [pid 32278:tid 32301] [client 20.239.64.62:4806] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aU7xNn-IfCN2Cy9GcchimwAAANU"]
[Sat Dec 27 04:34:01.295609 2025] [:error] [pid 32193:tid 32250] [client 20.239.64.62:2636] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aU7xORgw0eCOc2qYqaL9QAAAAIA"]
[Sat Dec 27 04:34:03.416349 2025] [:error] [pid 32191:tid 32214] [client 20.239.64.62:1029] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aU7xO7PNtMgrjVCHIdFq-QAAABM"]
[Sat Dec 27 04:34:05.883166 2025] [:error] [pid 32193:tid 32272] [client 20.239.64.62:1072] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin2.php"] [unique_id "aU7xPRgw0eCOc2qYqaL9SAAAAJY"]
[Sat Dec 27 04:34:09.186059 2025] [:error] [pid 32278:tid 32302] [client 20.239.64.62:3777] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin2.php"] [unique_id "aU7xQX-IfCN2Cy9GcchiqwAAANY"]
[Sat Dec 27 04:34:12.412105 2025] [:error] [pid 32191:tid 32198] [client 20.239.64.62:3839] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin2.php"] [unique_id "aU7xRLPNtMgrjVCHIdFrAAAAAAM"]
[Sat Dec 27 04:34:14.621553 2025] [:error] [pid 32278:tid 32292] [client 20.239.64.62:2914] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin2.php"] [unique_id "aU7xRn-IfCN2Cy9GcchisQAAAMw"]
[Sat Dec 27 04:34:16.218240 2025] [:error] [pid 32193:tid 32255] [client 20.239.64.62:1921] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "aU7xSBgw0eCOc2qYqaL9UwAAAIU"]
[Sat Dec 27 04:34:18.514049 2025] [:error] [pid 32191:tid 32198] [client 20.239.64.62:1047] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "aU7xSrPNtMgrjVCHIdFrDgAAAAM"]
[Sat Dec 27 04:34:20.613701 2025] [:error] [pid 32193:tid 32262] [client 20.239.64.62:2798] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "aU7xTBgw0eCOc2qYqaL9VAAAAIw"]
[Sat Dec 27 04:34:31.605490 2025] [:error] [pid 32192:tid 32233] [client 20.239.64.62:6466] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-signup.php"] [unique_id "aU7xVy_q0VFe066lbk-pFwAAAEo"]
[Sat Dec 27 04:34:32.885730 2025] [:error] [pid 32193:tid 32266] [client 20.239.64.62:2511] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-signup.php"] [unique_id "aU7xWBgw0eCOc2qYqaL9WQAAAJA"]
[Sat Dec 27 04:34:35.656412 2025] [:error] [pid 32278:tid 32289] [client 20.239.64.62:1379] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-signup.php"] [unique_id "aU7xW3-IfCN2Cy9GcchixAAAAMk"]
[Sat Dec 27 04:34:38.213865 2025] [:error] [pid 32192:tid 32227] [client 20.239.64.62:2933] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-signup.php"] [unique_id "aU7xXi_q0VFe066lbk-pHwAAAEQ"]
[Sat Dec 27 04:34:40.238945 2025] [:error] [pid 32191:tid 32205] [client 20.239.64.62:4065] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "aU7xYLPNtMgrjVCHIdFrHwAAAAo"]
[Sat Dec 27 04:34:42.002991 2025] [:error] [pid 32191:tid 32214] [client 20.239.64.62:2090] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "aU7xYrPNtMgrjVCHIdFrIAAAABM"]
[Sat Dec 27 04:34:44.667005 2025] [:error] [pid 32193:tid 32256] [client 20.239.64.62:3155] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "aU7xZBgw0eCOc2qYqaL9ZAAAAIY"]
[Sat Dec 27 04:34:46.730812 2025] [:error] [pid 32193:tid 32266] [client 20.239.64.62:3192] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "aU7xZhgw0eCOc2qYqaL9agAAAJA"]
[Sat Dec 27 04:34:48.725038 2025] [:error] [pid 32192:tid 32238] [client 20.239.64.62:2065] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-file.php"] [unique_id "aU7xaC_q0VFe066lbk-pIgAAAE8"]
[Sat Dec 27 04:34:51.033766 2025] [:error] [pid 32193:tid 32265] [client 20.239.64.62:4249] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-file.php"] [unique_id "aU7xaxgw0eCOc2qYqaL9cQAAAI8"]
[Sat Dec 27 04:34:52.831886 2025] [:error] [pid 32278:tid 32283] [client 20.239.64.62:3865] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-file.php"] [unique_id "aU7xbH-IfCN2Cy9Gcchi2QAAAMM"]
[Sat Dec 27 04:34:58.285920 2025] [:error] [pid 32278:tid 32301] [client 20.239.64.62:3840] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-file.php"] [unique_id "aU7xcn-IfCN2Cy9Gcchi5QAAANU"]
[Sat Dec 27 04:34:59.970780 2025] [:error] [pid 32193:tid 32273] [client 20.239.64.62:6123] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ty.php"] [unique_id "aU7xcxgw0eCOc2qYqaL9gwAAAJc"]
[Sat Dec 27 04:35:02.618806 2025] [:error] [pid 32278:tid 32289] [client 20.239.64.62:5394] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ty.php"] [unique_id "aU7xdn-IfCN2Cy9Gcchi_gAAAMk"]
[Sat Dec 27 04:35:04.627920 2025] [:error] [pid 32278:tid 32302] [client 20.239.64.62:2437] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ty.php"] [unique_id "aU7xeH-IfCN2Cy9GcchjCAAAANY"]
[Sat Dec 27 04:35:09.847724 2025] [:error] [pid 32278:tid 32289] [client 20.239.64.62:7322] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ty.php"] [unique_id "aU7xfX-IfCN2Cy9GcchjOgAAAMk"]
[Sat Dec 27 04:35:12.493115 2025] [:error] [pid 32278:tid 32280] [client 20.239.64.62:3584] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "aU7xgH-IfCN2Cy9GcchjTQAAAMA"]
[Sat Dec 27 04:35:16.483277 2025] [:error] [pid 32192:tid 32226] [client 20.239.64.62:2445] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "aU7xhC_q0VFe066lbk-pkwAAAEM"]
[Sat Dec 27 04:35:16.881435 2025] [:error] [pid 32192:tid 32225] [client 20.239.64.62:6335] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "aU7xhC_q0VFe066lbk-plQAAAEI"]
[Sat Dec 27 04:35:17.325732 2025] [:error] [pid 32192:tid 32233] [client 20.239.64.62:4958] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "aU7xhS_q0VFe066lbk-plwAAAEo"]
[Sat Dec 27 04:35:18.757051 2025] [:error] [pid 32278:tid 32304] [client 20.239.64.62:7348] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/options.php"] [unique_id "aU7xhn-IfCN2Cy9GcchjWQAAANg"]
[Sat Dec 27 04:35:22.075369 2025] [:error] [pid 32278:tid 32302] [client 20.239.64.62:4939] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/options.php"] [unique_id "aU7xin-IfCN2Cy9GcchjWwAAANY"]
[Sat Dec 27 04:35:23.272067 2025] [:error] [pid 32192:tid 32229] [client 20.239.64.62:4774] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/options.php"] [unique_id "aU7xiy_q0VFe066lbk-pngAAAEY"]
[Sat Dec 27 04:35:25.239891 2025] [:error] [pid 32278:tid 32284] [client 150.230.142.53:41618] [client 150.230.142.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.230.142.53, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7xjX-IfCN2Cy9GcchjXwAAAMQ"]
[Sat Dec 27 04:35:26.533292 2025] [:error] [pid 32193:tid 32257] [client 20.239.64.62:6952] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/options.php"] [unique_id "aU7xjhgw0eCOc2qYqaL9rwAAAIc"]
[Sat Dec 27 04:35:28.212329 2025] [:error] [pid 32192:tid 32225] [client 20.239.64.62:6947] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/brand.php"] [unique_id "aU7xkC_q0VFe066lbk-ppwAAAEI"]
[Sat Dec 27 04:35:39.791224 2025] [:error] [pid 32192:tid 32235] [client 20.239.64.62:5179] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/priv.php"] [unique_id "aU7xmy_q0VFe066lbk-pvQAAAEw"]
[Sat Dec 27 04:35:41.433463 2025] [:error] [pid 32278:tid 32281] [client 20.239.64.62:3989] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/priv.php"] [unique_id "aU7xnX-IfCN2Cy9GcchjcQAAAME"]
[Sat Dec 27 04:35:44.025775 2025] [:error] [pid 32193:tid 32269] [client 20.239.64.62:5332] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/priv.php"] [unique_id "aU7xoBgw0eCOc2qYqaL9yAAAAJM"]
[Sat Dec 27 04:35:45.700299 2025] [:error] [pid 32193:tid 32254] [client 20.239.64.62:5324] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/priv.php"] [unique_id "aU7xoRgw0eCOc2qYqaL9zgAAAIQ"]
[Sat Dec 27 04:35:47.088132 2025] [:error] [pid 32193:tid 32270] [client 20.239.64.62:6232] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/allez.php"] [unique_id "aU7xoxgw0eCOc2qYqaL90wAAAJQ"]
[Sat Dec 27 04:35:50.196231 2025] [:error] [pid 32278:tid 32297] [client 20.239.64.62:1864] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/allez.php"] [unique_id "aU7xpn-IfCN2Cy9GcchjegAAANE"]
[Sat Dec 27 04:35:52.431027 2025] [:error] [pid 32193:tid 32250] [client 20.239.64.62:4628] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/allez.php"] [unique_id "aU7xqBgw0eCOc2qYqaL92wAAAIA"]
[Sat Dec 27 04:35:56.052540 2025] [:error] [pid 32278:tid 32301] [client 20.239.64.62:6222] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/allez.php"] [unique_id "aU7xrH-IfCN2Cy9GcchjjwAAANU"]
[Sat Dec 27 04:35:57.456546 2025] [:error] [pid 32193:tid 32259] [client 20.239.64.62:2199] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aU7xrRgw0eCOc2qYqaL93AAAAIk"]
[Sat Dec 27 04:35:59.122907 2025] [:error] [pid 32278:tid 32299] [client 20.239.64.62:7282] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aU7xr3-IfCN2Cy9GcchjlAAAANM"]
[Sat Dec 27 04:36:02.080375 2025] [:error] [pid 32278:tid 32296] [client 20.239.64.62:5314] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aU7xsn-IfCN2Cy9GcchjnAAAANA"]
[Sat Dec 27 04:36:03.984064 2025] [:error] [pid 32192:tid 32231] [client 20.239.64.62:7377] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aU7xsy_q0VFe066lbk-pzwAAAEg"]
[Sat Dec 27 04:36:06.168126 2025] [:error] [pid 32278:tid 32290] [client 20.239.64.62:7236] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/functions.php"] [unique_id "aU7xtn-IfCN2Cy9GcchjpQAAAMo"]
[Sat Dec 27 04:36:07.322903 2025] [:error] [pid 32193:tid 32270] [client 20.239.64.62:6171] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/functions.php"] [unique_id "aU7xtxgw0eCOc2qYqaL94QAAAJQ"]
[Sat Dec 27 04:36:09.383303 2025] [:error] [pid 32193:tid 32273] [client 20.239.64.62:1732] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/functions.php"] [unique_id "aU7xuRgw0eCOc2qYqaL95gAAAJc"]
[Sat Dec 27 04:36:11.180442 2025] [:error] [pid 32193:tid 32250] [client 20.239.64.62:2978] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/functions.php"] [unique_id "aU7xuxgw0eCOc2qYqaL96QAAAIA"]
[Sat Dec 27 04:36:12.569719 2025] [:error] [pid 32191:tid 32195] [client 20.239.64.62:4215] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aU7xvLPNtMgrjVCHIdFreAAAAAA"]
[Sat Dec 27 04:36:13.821360 2025] [:error] [pid 32193:tid 32260] [client 20.239.64.62:6833] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aU7xvRgw0eCOc2qYqaL99gAAAIo"]
[Sat Dec 27 04:36:14.167606 2025] [:error] [pid 32278:tid 32293] [client 20.239.64.62:2748] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aU7xvn-IfCN2Cy9GcchjsQAAAM0"]
[Sat Dec 27 04:36:15.763089 2025] [:error] [pid 32192:tid 32244] [client 20.239.64.62:3060] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat1.php"] [unique_id "aU7xvy_q0VFe066lbk-p3wAAAFU"]
[Sat Dec 27 04:36:16.724020 2025] [:error] [pid 32193:tid 32263] [client 20.239.64.62:3011] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-envato-market-github.php"] [unique_id "aU7xwBgw0eCOc2qYqaL9_gAAAI0"]
[Sat Dec 27 04:36:18.643496 2025] [:error] [pid 32193:tid 32258] [client 20.239.64.62:6430] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-envato-market-github.php"] [unique_id "aU7xwhgw0eCOc2qYqaL-BAAAAIg"]
[Sat Dec 27 04:36:20.154636 2025] [:error] [pid 32192:tid 32240] [client 20.239.64.62:4175] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-envato-market-github.php"] [unique_id "aU7xxC_q0VFe066lbk-p8gAAAFE"]
[Sat Dec 27 04:36:21.450283 2025] [:error] [pid 32192:tid 32233] [client 20.239.64.62:4120] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-envato-market-github.php"] [unique_id "aU7xxS_q0VFe066lbk-p-gAAAEo"]
[Sat Dec 27 04:36:22.405136 2025] [:error] [pid 32191:tid 32208] [client 20.239.64.62:4187] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsoyanz.php"] [unique_id "aU7xxrPNtMgrjVCHIdFriQAAAA0"]
[Sat Dec 27 04:36:24.417726 2025] [:error] [pid 32278:tid 32302] [client 20.239.64.62:4165] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsoyanz.php"] [unique_id "aU7xyH-IfCN2Cy9GcchjwQAAANY"]
[Sat Dec 27 04:36:26.375978 2025] [:error] [pid 32192:tid 32227] [client 20.239.64.62:5734] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsoyanz.php"] [unique_id "aU7xyi_q0VFe066lbk-qBQAAAEQ"]
[Sat Dec 27 04:36:27.943867 2025] [:error] [pid 32278:tid 32288] [client 20.239.64.62:4123] [client 20.239.64.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsoyanz.php"] [unique_id "aU7xy3-IfCN2Cy9Gcchj1AAAAMg"]
[Sat Dec 27 04:42:56.483085 2025] [:error] [pid 32193:tid 32270] [client 146.190.81.111:59552] [client 146.190.81.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.81.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU7zUBgw0eCOc2qYqaIBswAAAJQ"]
[Sat Dec 27 05:06:22.121873 2025] [:error] [pid 32191:tid 32214] [client 182.16.245.210:48232] [client 182.16.245.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.16.245.210, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU74zrPNtMgrjVCHIdF5OgAAABM"]
[Sat Dec 27 05:15:38.371541 2025] [:error] [pid 32192:tid 32224] [client 95.217.160.4:38580] [client 95.217.160.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.217.160.4, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU76-i_q0VFe066lbk-8YgAAAEE"]
[Sat Dec 27 05:19:51.917854 2025] [proxy_fcgi:error] [pid 32191:tid 32210] [client 20.196.91.24:20621] AH01071: Got error 'Primary script unknown', referer: https://www.yahoo.com/
[Sat Dec 27 05:19:52.052492 2025] [:error] [pid 32191:tid 32201] [client 20.196.91.24:20621] [client 20.196.91.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.196.91.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aU77-LPNtMgrjVCHIdF-7gAAAAY"], referer: https://www.yahoo.com/
[Sat Dec 27 05:19:52.057113 2025] [proxy_fcgi:error] [pid 32191:tid 32201] [client 20.196.91.24:20621] AH01071: Got error 'Primary script unknown', referer: https://www.yahoo.com/
[Sat Dec 27 05:19:56.215595 2025] [:error] [pid 32191:tid 32201] [client 20.196.91.24:20621] [client 20.196.91.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aU77_LPNtMgrjVCHIdF--QAAAAY"], referer: https://www.google.com/
[Sat Dec 27 05:19:56.493117 2025] [:error] [pid 32192:tid 32224] [client 20.196.91.24:20717] [client 20.196.91.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/autoload_classmap.php"] [unique_id "aU77_C_q0VFe066lbk-94AAAAEE"], referer: https://www.yahoo.com/
[Sat Dec 27 05:19:58.159009 2025] [:error] [pid 32192:tid 32228] [client 20.196.91.24:20624] [client 20.196.91.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "aU77_i_q0VFe066lbk-94wAAAEU"], referer: https://duckduckgo.com/
[Sat Dec 27 05:20:00.965319 2025] [:error] [pid 32193:tid 32253] [client 20.196.91.24:20691] [client 20.196.91.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/chosen.php"] [unique_id "aU78ABgw0eCOc2qYqaIVCgAAAIM"], referer: https://www.google.com/
[Sat Dec 27 05:20:01.236249 2025] [:error] [pid 32278:tid 32302] [client 20.196.91.24:20720] [client 20.196.91.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aU78AX-IfCN2Cy9GcciBmwAAANY"], referer: https://www.bing.com/
[Sat Dec 27 05:20:01.509485 2025] [:error] [pid 32191:tid 32200] [client 20.196.91.24:20711] [client 20.196.91.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aU78AbPNtMgrjVCHIdF_AwAAAAU"], referer: https://www.google.co.uk/
[Sat Dec 27 05:20:01.782402 2025] [:error] [pid 32278:tid 32288] [client 20.196.91.24:20567] [client 20.196.91.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aU78AX-IfCN2Cy9GcciBnQAAAMg"], referer: https://www.google.de/
[Sat Dec 27 05:20:02.059837 2025] [:error] [pid 32278:tid 32283] [client 20.196.91.24:20718] [client 20.196.91.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aU78An-IfCN2Cy9GcciBoQAAAMM"], referer: https://www.google.com/
[Sat Dec 27 05:20:02.350787 2025] [:error] [pid 15939:tid 15941] [client 20.196.91.24:20694] [client 20.196.91.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aU78AuZ7qdnFxikanMJK5AAAAQA"], referer: https://www.google.de/
[Sat Dec 27 05:20:47.021905 2025] [:error] [pid 32192:tid 32238] [client 20.196.91.24:20620] [client 20.196.91.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.196.91.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aU78Ly_q0VFe066lbk--TQAAAE8"], referer: https://www.google.de/
[Sat Dec 27 05:20:48.315818 2025] [autoindex:error] [pid 32192:tid 32246] [client 20.196.91.24:20611] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Sat Dec 27 05:20:48.455286 2025] [autoindex:error] [pid 32192:tid 32225] [client 20.196.91.24:20611] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Sat Dec 27 05:20:52.982376 2025] [autoindex:error] [pid 32192:tid 32232] [client 20.196.91.24:20611] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Sat Dec 27 05:20:53.121643 2025] [autoindex:error] [pid 32192:tid 32240] [client 20.196.91.24:20611] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Sat Dec 27 05:20:53.905871 2025] [autoindex:error] [pid 32192:tid 32239] [client 20.196.91.24:20611] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Sat Dec 27 05:20:54.756419 2025] [:error] [pid 32192:tid 32236] [client 20.196.91.24:20611] [client 20.196.91.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aU78Ni_q0VFe066lbk--YAAAAE0"], referer: https://duckduckgo.com/
[Sat Dec 27 05:20:55.039957 2025] [:error] [pid 32193:tid 32262] [client 20.196.91.24:20725] [client 20.196.91.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aU78Nxgw0eCOc2qYqaIVPgAAAIw"], referer: https://www.google.com/
[Sat Dec 27 05:20:55.346351 2025] [:error] [pid 32193:tid 32274] [client 20.196.91.24:20723] [client 20.196.91.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bk/index.php"] [unique_id "aU78Nxgw0eCOc2qYqaIVPwAAAJg"], referer: https://www.google.de/
[Sat Dec 27 05:20:55.637100 2025] [:error] [pid 32191:tid 32215] [client 20.196.91.24:20614] [client 20.196.91.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aU78N7PNtMgrjVCHIdF_IwAAABQ"], referer: https://www.google.co.uk/
[Sat Dec 27 05:20:55.910864 2025] [:error] [pid 32191:tid 32210] [client 20.196.91.24:20626] [client 20.196.91.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aU78N7PNtMgrjVCHIdF_JQAAAA8"], referer: https://www.bing.com/
[Sat Dec 27 05:20:56.184812 2025] [:error] [pid 32193:tid 32272] [client 20.196.91.24:20676] [client 20.196.91.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aU78OBgw0eCOc2qYqaIVQAAAAJY"], referer: https://www.yahoo.com/
[Sat Dec 27 05:20:56.458631 2025] [:error] [pid 32191:tid 32218] [client 20.196.91.24:20729] [client 20.196.91.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aU78OLPNtMgrjVCHIdF_JwAAABc"], referer: https://www.yahoo.com/
[Sat Dec 27 05:20:56.728720 2025] [:error] [pid 15939:tid 15960] [client 20.196.91.24:20709] [client 20.196.91.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/random_compat/index.php"] [unique_id "aU78OOZ7qdnFxikanMJLNgAAARM"], referer: https://www.google.com/
[Sat Dec 27 05:20:57.035454 2025] [:error] [pid 15939:tid 15941] [client 20.196.91.24:20673] [client 20.196.91.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aU78OeZ7qdnFxikanMJLNwAAAQA"], referer: https://www.google.com/
[Sat Dec 27 05:20:57.318507 2025] [:error] [pid 32192:tid 32227] [client 20.196.91.24:20681] [client 20.196.91.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aU78OS_q0VFe066lbk--ZAAAAEQ"], referer: https://www.yahoo.com/
[Sat Dec 27 05:20:57.601198 2025] [:error] [pid 15939:tid 15942] [client 20.196.91.24:20618] [client 20.196.91.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aU78OeZ7qdnFxikanMJLOgAAAQE"], referer: https://www.google.co.uk/
[Sat Dec 27 05:20:59.733676 2025] [:error] [pid 32278:tid 32283] [client 20.196.91.24:20693] [client 20.196.91.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.196.91.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aU78O3-IfCN2Cy9GcciB9QAAAMM"], referer: https://www.yahoo.com/
[Sat Dec 27 05:21:00.417443 2025] [autoindex:error] [pid 32278:tid 32286] [client 20.196.91.24:20571] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Sat Dec 27 05:21:01.238194 2025] [autoindex:error] [pid 32278:tid 32287] [client 20.196.91.24:20571] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Sat Dec 27 05:50:29.327842 2025] [:error] [pid 32191:tid 32198] [client 27.54.133.140:57758] [client 27.54.133.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 27.54.133.140, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU8DJbPNtMgrjVCHIdGFWwAAAAM"]
[Sat Dec 27 06:25:40.775236 2025] [:error] [pid 15939:tid 15961] [client 159.69.118.232:37092] [client 159.69.118.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.69.118.232, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU8LZOZ7qdnFxikanMJcrgAAARQ"]
[Sat Dec 27 06:28:33.790234 2025] [:error] [pid 32191:tid 32210] [client 103.205.208.252:47346] [client 103.205.208.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.205.208.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU8MEbPNtMgrjVCHIdGLuAAAAA8"]
[Sat Dec 27 06:56:08.634494 2025] [:error] [pid 32278:tid 32298] [client 182.16.245.210:41502] [client 182.16.245.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.16.245.210, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU8SiH-IfCN2Cy9GccielAAAANI"]
[Sat Dec 27 07:16:03.327505 2025] [:error] [pid 15939:tid 15964] [client 103.159.85.179:40506] [client 103.159.85.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.159.85.179, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU8XM-Z7qdnFxikanMJqqwAAARc"]
[Sat Dec 27 07:38:18.049479 2025] [:error] [pid 15939:tid 15949] [client 162.250.99.9:33960] [client 162.250.99.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.250.99.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU8cauZ7qdnFxikanMJtsQAAAQg"]
[Sat Dec 27 07:41:57.802039 2025] [:error] [pid 15939:tid 15959] [client 92.205.184.217:47648] [client 92.205.184.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.184.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU8dReZ7qdnFxikanMJuRAAAARI"]
[Sat Dec 27 07:46:39.363706 2025] [:error] [pid 32192:tid 32240] [client 192.250.235.149:45026] [client 192.250.235.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.235.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU8eXy_q0VFe066lbk_c4AAAAFE"]
[Sat Dec 27 07:46:56.510486 2025] [:error] [pid 32278:tid 32296] [client 107.173.25.150:59180] [client 107.173.25.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.173.25.150, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU8ecH-IfCN2Cy9GccircQAAANA"]
[Sat Dec 27 07:47:56.855113 2025] [:error] [pid 45373:tid 45398] [client 170.106.167.214:43938] [client 170.106.167.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aU8erC7p_wFcbpu46HXlzgAAAVc"]
[Sat Dec 27 07:51:20.548871 2025] [:error] [pid 32278:tid 32283] [client 103.117.180.206:60298] [client 103.117.180.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.117.180.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU8feH-IfCN2Cy9GcciscQAAAMM"]
[Sat Dec 27 08:05:29.828296 2025] [:error] [pid 45373:tid 45379] [client 81.88.49.24:46224] [client 81.88.49.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU8iyS7p_wFcbpu46HXpoQAAAUQ"]
[Sat Dec 27 08:56:19.503830 2025] [:error] [pid 32193:tid 32251] [client 18.118.108.129:49284] [client 18.118.108.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 18.118.108.129, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU8usxgw0eCOc2qYqaI_AgAAAIE"]
[Sat Dec 27 09:37:33.461662 2025] [:error] [pid 32192:tid 32234] [client 103.49.70.23:58064] [client 103.49.70.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.49.70.23, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU84XS_q0VFe066lbk_61QAAAEs"]
[Sat Dec 27 09:38:01.640862 2025] [:error] [pid 32193:tid 32252] [client 109.123.249.213:48274] [client 109.123.249.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.123.249.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU84eRgw0eCOc2qYqaJG1gAAAII"]
[Sat Dec 27 09:52:32.312982 2025] [:error] [pid 15939:tid 15943] [client 190.107.177.57:36352] [client 190.107.177.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.107.177.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU874OZ7qdnFxikanMKFtQAAAQI"]
[Sat Dec 27 09:55:08.959392 2025] [:error] [pid 32191:tid 32196] [client 217.15.164.215:46162] [client 217.15.164.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.15.164.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU88fLPNtMgrjVCHIdG07wAAAAE"]
[Sat Dec 27 09:57:39.781836 2025] [:error] [pid 45373:tid 45386] [client 94.74.145.178:60344] [client 94.74.145.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.74.145.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU89Ey7p_wFcbpu46HUBrwAAAUs"]
[Sat Dec 27 10:07:17.447123 2025] [:error] [pid 15939:tid 15957] [client 182.43.70.143:42356] [client 182.43.70.143] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aU8_VeZ7qdnFxikanMKIOQAAARA"]
[Sat Dec 27 10:07:18.730186 2025] [:error] [pid 32192:tid 32236] [client 5.9.248.74:25722] [client 5.9.248.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.248.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU8_Vi_q0VFe066lbk__6gAAAE0"]
[Sat Dec 27 10:12:26.407908 2025] [:error] [pid 32193:tid 32251] [client 52.66.15.140:59990] [client 52.66.15.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.66.15.140, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU9Aihgw0eCOc2qYqaJOeQAAAIE"]
[Sat Dec 27 10:39:27.000021 2025] [:error] [pid 32193:tid 32274] [client 103.82.92.35:51494] [client 103.82.92.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.82.92.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU9G3hgw0eCOc2qYqaJT6QAAAJg"]
[Sat Dec 27 10:49:30.826515 2025] [:error] [pid 32278:tid 32293] [client 68.178.164.217:55238] [client 68.178.164.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.164.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU9JOn-IfCN2Cy9GccjKLgAAAM0"]
[Sat Dec 27 10:59:25.893266 2025] [:error] [pid 32192:tid 32235] [client 106.15.248.16:50688] [client 106.15.248.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.15.248.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU9LjS_q0VFe066lbk8IPwAAAEw"]
[Sat Dec 27 11:00:04.931654 2025] [:error] [pid 32192:tid 32224] [client 106.15.248.16:52620] [client 106.15.248.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.15.248.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU9LtC_q0VFe066lbk8ITAAAAEE"]
[Sat Dec 27 11:14:01.331443 2025] [:error] [pid 45373:tid 45381] [client 192.250.227.238:32796] [client 192.250.227.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.227.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU9O-S7p_wFcbpu46HUUZwAAAUY"]
[Sat Dec 27 11:25:13.783830 2025] [:error] [pid 32192:tid 32226] [client 103.49.131.239:48594] [client 103.49.131.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.49.131.239, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU9RmS_q0VFe066lbk8MqAAAAEM"]
[Sat Dec 27 11:34:44.101880 2025] [:error] [pid 32193:tid 32261] [client 157.66.46.84:8936] [client 157.66.46.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.46.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU9T1Bgw0eCOc2qYqaJfTgAAAIs"]
[Sat Dec 27 12:02:45.738660 2025] [:error] [pid 32191:tid 32215] [client 5.129.215.121:45094] [client 5.129.215.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.129.215.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU9aZbPNtMgrjVCHIdHaRgAAABQ"]
[Sat Dec 27 12:11:04.071990 2025] [:error] [pid 32193:tid 32263] [client 45.61.52.90:33858] [client 45.61.52.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.61.52.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU9cWBgw0eCOc2qYqaJj2QAAAI0"]
[Sat Dec 27 12:14:00.851608 2025] [:error] [pid 15939:tid 15964] [client 24.227.130.24:57376] [client 24.227.130.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.227.130.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU9dCOZ7qdnFxikanMKbHwAAARc"]
[Sat Dec 27 12:15:05.891221 2025] [:error] [pid 32278:tid 32285] [client 92.204.236.147:36490] [client 92.204.236.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.204.236.147, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU9dSX-IfCN2Cy9GccjWzgAAAMU"]
[Sat Dec 27 12:19:52.803611 2025] [:error] [pid 32278:tid 32281] [client 24.227.130.24:32770] [client 24.227.130.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.227.130.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU9eaH-IfCN2Cy9GccjXwwAAAME"]
[Sat Dec 27 12:31:51.187602 2025] [:error] [pid 45373:tid 45397] [client 160.30.160.240:36368] [client 160.30.160.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.30.160.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU9hNy7p_wFcbpu46HUivQAAAVY"]
[Sat Dec 27 12:34:47.936784 2025] [:error] [pid 32191:tid 32208] [client 162.241.224.218:23292] [client 162.241.224.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.224.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU9h57PNtMgrjVCHIdHj8AAAAA0"]
[Sat Dec 27 12:42:45.106157 2025] [:error] [pid 32193:tid 32251] [client 185.199.223.39:35654] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU9jxRgw0eCOc2qYqaJpewAAAIE"]
[Sat Dec 27 13:00:36.770517 2025] [:error] [pid 45373:tid 45378] [client 217.15.164.215:43656] [client 217.15.164.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.15.164.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU9n9C7p_wFcbpu46HUoAwAAAUM"]
[Sat Dec 27 13:20:43.219830 2025] [:error] [pid 45373:tid 45379] [client 192.99.144.176:34862] [client 192.99.144.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.99.144.176, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU9sqy7p_wFcbpu46HUsFAAAAUQ"]
[Sat Dec 27 13:33:28.376261 2025] [:error] [pid 32192:tid 32245] [client 217.15.164.215:49366] [client 217.15.164.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.15.164.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU9vqC_q0VFe066lbk8iSgAAAFY"]
[Sat Dec 27 13:40:43.403731 2025] [:error] [pid 3114:tid 3141] [client 42.96.37.226:53660] [client 42.96.37.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 42.96.37.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU9xW2JGrIkLOdbPpJhhAwAAAZc"]
[Sat Dec 27 13:58:57.610678 2025] [:error] [pid 3114:tid 3120] [client 185.74.80.5:34418] [client 185.74.80.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.74.80.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU91oWJGrIkLOdbPpJhlQwAAAYI"]
[Sat Dec 27 14:07:10.664068 2025] [:error] [pid 32193:tid 32254] [client 81.88.49.15:54371] [client 81.88.49.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU93jhgw0eCOc2qYqaJ5BwAAAIQ"]
[Sat Dec 27 14:37:09.634011 2025] [:error] [pid 32193:tid 32265] [client 81.8.91.201:37398] [client 81.8.91.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.8.91.201, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU9-lRgw0eCOc2qYqaJ9KQAAAI8"]
[Sat Dec 27 14:52:32.356381 2025] [:error] [pid 3114:tid 3126] [client 198.49.74.2:41836] [client 198.49.74.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.49.74.2, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU-CMGJGrIkLOdbPpJhynQAAAYg"]
[Sat Dec 27 14:56:12.355385 2025] [:error] [pid 15939:tid 15965] [client 200.150.96.66:43352] [client 200.150.96.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.150.96.66, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU-DDOZ7qdnFxikanMK06AAAARg"]
[Sat Dec 27 15:19:05.889398 2025] [:error] [pid 32278:tid 32299] [client 147.182.243.3:37838] [client 147.182.243.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.243.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU-IaX-IfCN2Cy9Gccjy3gAAANM"]
[Sat Dec 27 15:58:00.533665 2025] [:error] [pid 15939:tid 15942] [client 85.128.143.136:46990] [client 85.128.143.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU-RiOZ7qdnFxikanMK8pwAAAQE"]
[Sat Dec 27 16:37:21.760919 2025] [:error] [pid 31933:tid 31943] [client 5.78.65.144:40370] [client 5.78.65.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.78.65.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU-awcGr1WIJr39uqaqqywAAAcg"]
[Sat Dec 27 17:59:43.629104 2025] [:error] [pid 32192:tid 32238] [client 140.82.2.37:35424] [client 140.82.2.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 140.82.2.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU-uDy_q0VFe066lbk9GUwAAAE8"]
[Sat Dec 27 18:14:06.250320 2025] [:error] [pid 32191:tid 32197] [client 51.75.116.52:54938] [client 51.75.116.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.75.116.52, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU-xbrPNtMgrjVCHIdEdzAAAAAI"]
[Sat Dec 27 18:39:04.224105 2025] [:error] [pid 31933:tid 31937] [client 51.79.166.146:39790] [client 51.79.166.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.79.166.146, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU-3SMGr1WIJr39uqarJggAAAcI"]
[Sat Dec 27 19:06:13.449192 2025] [:error] [pid 31933:tid 31952] [client 81.88.49.15:48538] [client 81.88.49.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU-9pcGr1WIJr39uqarPrQAAAdE"]
[Sat Dec 27 19:16:50.607407 2025] [:error] [pid 32193:tid 32269] [client 81.88.49.10:29796] [client 81.88.49.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_AIhgw0eCOc2qYqaKj8gAAAJM"]
[Sat Dec 27 19:22:04.548408 2025] [:error] [pid 31933:tid 31936] [client 5.9.40.119:46110] [client 5.9.40.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.40.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_BXMGr1WIJr39uqarUfAAAAcE"]
[Sat Dec 27 19:46:12.484282 2025] [:error] [pid 31933:tid 31958] [client 192.241.135.45:44978] [client 192.241.135.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.241.135.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_HBMGr1WIJr39uqarazAAAAdc"]
[Sat Dec 27 20:08:00.235502 2025] [:error] [pid 45373:tid 45394] [client 5.78.65.144:41212] [client 5.78.65.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.78.65.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_MIC7p_wFcbpu46HV5AAAAAVM"]
[Sat Dec 27 20:34:36.870643 2025] [:error] [pid 15939:tid 15959] [client 81.88.49.15:22071] [client 81.88.49.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_SXOZ7qdnFxikanMLlvAAAARI"]
[Sat Dec 27 20:47:46.403337 2025] [:error] [pid 45373:tid 45376] [client 81.88.49.15:40173] [client 81.88.49.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_Vci7p_wFcbpu46HWAmQAAAUE"]
[Sat Dec 27 21:30:38.577110 2025] [:error] [pid 15939:tid 15955] [client 51.89.19.88:40242] [client 51.89.19.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.89.19.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_ffuZ7qdnFxikanMLt-QAAAQ4"]
[Sat Dec 27 21:43:12.960913 2025] [:error] [pid 32192:tid 32230] [client 160.250.186.135:52658] [client 160.250.186.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.186.135, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_icC_q0VFe066lbk9lMgAAAEc"]
[Sat Dec 27 21:53:24.553750 2025] [:error] [pid 45373:tid 45381] [client 103.74.119.31:50964] [client 103.74.119.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.74.119.31, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_k1C7p_wFcbpu46HWOOQAAAUY"]
[Sat Dec 27 22:34:18.740074 2025] [:error] [pid 32193:tid 32273] [client 160.30.160.240:40902] [client 160.30.160.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.30.160.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_uahgw0eCOc2qYqaLBFwAAAJc"]
[Sat Dec 27 22:39:25.183325 2025] [:error] [pid 31933:tid 31954] [client 103.130.216.65:58430] [client 103.130.216.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.130.216.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_vncGr1WIJr39uqaoMVwAAAdM"]
[Sat Dec 27 22:42:51.161496 2025] [:error] [pid 32192:tid 32236] [client 123.187.240.242:53414] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aU_way_q0VFe066lbk9uBwAAAE0"]
[Sat Dec 27 22:59:28.135026 2025] [:error] [pid 32191:tid 32217] [client 193.176.230.19:59550] [client 193.176.230.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.176.230.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_0ULPNtMgrjVCHIdFL_QAAABY"]
[Sat Dec 27 23:15:50.495761 2025] [:error] [pid 45373:tid 45385] [client 103.173.66.54:51274] [client 103.173.66.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.173.66.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_4Ji7p_wFcbpu46HWgbgAAAUo"]
[Sat Dec 27 23:19:08.555742 2025] [:error] [pid 32193:tid 32250] [client 217.15.164.215:57410] [client 217.15.164.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.15.164.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_47Bgw0eCOc2qYqaLI8gAAAIA"]
[Sat Dec 27 23:19:09.424435 2025] [:error] [pid 31933:tid 31955] [client 171.244.206.65:60126] [client 171.244.206.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.244.206.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_47cGr1WIJr39uqaoXvgAAAdQ"]
[Sat Dec 27 23:23:33.272383 2025] [:error] [pid 32193:tid 32266] [client 45.40.159.169:50660] [client 45.40.159.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.40.159.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_59Rgw0eCOc2qYqaLJcQAAAJA"]
[Sat Dec 27 23:23:35.024775 2025] [:error] [pid 31933:tid 31943] [client 45.40.159.169:50672] [client 45.40.159.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.40.159.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_598Gr1WIJr39uqaoY9QAAAcg"]
[Sat Dec 27 23:23:36.411446 2025] [:error] [pid 32278:tid 32289] [client 45.40.159.169:50680] [client 45.40.159.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.40.159.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_5-H-IfCN2Cy9GcchL3AAAAMk"]
[Sat Dec 27 23:23:37.846447 2025] [:error] [pid 32193:tid 32269] [client 45.40.159.169:42076] [client 45.40.159.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.40.159.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_5-Rgw0eCOc2qYqaLJcgAAAJM"]
[Sat Dec 27 23:23:39.211077 2025] [:error] [pid 32192:tid 32235] [client 45.40.159.169:42082] [client 45.40.159.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.40.159.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_5-y_q0VFe066lbk90hQAAAEw"]
[Sat Dec 27 23:23:40.569727 2025] [:error] [pid 32193:tid 32253] [client 45.40.159.169:42094] [client 45.40.159.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.40.159.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_5_Bgw0eCOc2qYqaLJdAAAAIM"]
[Sat Dec 27 23:23:40.569857 2025] [:error] [pid 32193:tid 32253] [client 45.40.159.169:42094] [client 45.40.159.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 45.40.159.169, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_5_Bgw0eCOc2qYqaLJdAAAAIM"]
[Sat Dec 27 23:23:41.384210 2025] [:error] [pid 32193:tid 32273] [client 45.40.159.169:42100] [client 45.40.159.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.40.159.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_5_Rgw0eCOc2qYqaLJdQAAAJc"]
[Sat Dec 27 23:23:41.384433 2025] [:error] [pid 32193:tid 32273] [client 45.40.159.169:42100] [client 45.40.159.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 45.40.159.169, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_5_Rgw0eCOc2qYqaLJdQAAAJc"]
[Sat Dec 27 23:23:42.197837 2025] [:error] [pid 32191:tid 32206] [client 45.40.159.169:42110] [client 45.40.159.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.40.159.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_5_rPNtMgrjVCHIdFP_wAAAAs"]
[Sat Dec 27 23:23:42.198023 2025] [:error] [pid 32191:tid 32206] [client 45.40.159.169:42110] [client 45.40.159.169] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 45.40.159.169, counter = 8"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_5_rPNtMgrjVCHIdFP_wAAAAs"]
[Sat Dec 27 23:24:42.413355 2025] [:error] [pid 3114:tid 3129] [client 92.204.18.103:40062] [client 92.204.18.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.204.18.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6OmJGrIkLOdbPpJjH2gAAAYs"]
[Sat Dec 27 23:24:43.144283 2025] [:error] [pid 32191:tid 32202] [client 207.246.240.105:58184] [client 207.246.240.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.246.240.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6O7PNtMgrjVCHIdFQEgAAAAc"]
[Sat Dec 27 23:24:44.476600 2025] [:error] [pid 45373:tid 45390] [client 92.204.18.103:40072] [client 92.204.18.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.204.18.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6PC7p_wFcbpu46HWiGAAAAU8"]
[Sat Dec 27 23:24:44.550401 2025] [:error] [pid 32192:tid 32235] [client 207.246.240.105:58198] [client 207.246.240.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.246.240.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6PC_q0VFe066lbk90nwAAAEw"]
[Sat Dec 27 23:24:46.043595 2025] [:error] [pid 32191:tid 32206] [client 207.246.240.105:58208] [client 207.246.240.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.246.240.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6PrPNtMgrjVCHIdFQFQAAAAs"]
[Sat Dec 27 23:24:46.459785 2025] [:error] [pid 3114:tid 3122] [client 92.204.18.103:40080] [client 92.204.18.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.204.18.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6PmJGrIkLOdbPpJjH4AAAAYQ"]
[Sat Dec 27 23:24:47.442405 2025] [:error] [pid 45373:tid 45395] [client 207.246.240.105:58212] [client 207.246.240.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.246.240.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6Py7p_wFcbpu46HWiHAAAAVQ"]
[Sat Dec 27 23:24:48.433634 2025] [:error] [pid 45373:tid 45386] [client 92.204.18.103:40084] [client 92.204.18.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.204.18.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6QC7p_wFcbpu46HWiHQAAAUs"]
[Sat Dec 27 23:24:48.821395 2025] [:error] [pid 32278:tid 32283] [client 207.246.240.105:58220] [client 207.246.240.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.246.240.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6QH-IfCN2Cy9GcchL8gAAAMM"]
[Sat Dec 27 23:24:50.221639 2025] [:error] [pid 31933:tid 31956] [client 207.246.240.105:39478] [client 207.246.240.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.246.240.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6QsGr1WIJr39uqaoZRQAAAdU"]
[Sat Dec 27 23:24:50.221791 2025] [:error] [pid 31933:tid 31956] [client 207.246.240.105:39478] [client 207.246.240.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 207.246.240.105, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6QsGr1WIJr39uqaoZRQAAAdU"]
[Sat Dec 27 23:24:50.380133 2025] [:error] [pid 31933:tid 31951] [client 92.204.18.103:46712] [client 92.204.18.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.204.18.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6QsGr1WIJr39uqaoZRgAAAdA"]
[Sat Dec 27 23:24:51.065565 2025] [:error] [pid 3114:tid 3120] [client 207.246.240.105:39490] [client 207.246.240.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.246.240.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6Q2JGrIkLOdbPpJjH5AAAAYI"]
[Sat Dec 27 23:24:51.065704 2025] [:error] [pid 3114:tid 3120] [client 207.246.240.105:39490] [client 207.246.240.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 207.246.240.105, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6Q2JGrIkLOdbPpJjH5AAAAYI"]
[Sat Dec 27 23:24:51.909422 2025] [:error] [pid 31933:tid 31953] [client 207.246.240.105:39502] [client 207.246.240.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.246.240.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6Q8Gr1WIJr39uqaoZSQAAAdI"]
[Sat Dec 27 23:24:51.909634 2025] [:error] [pid 31933:tid 31953] [client 207.246.240.105:39502] [client 207.246.240.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 207.246.240.105, counter = 8"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6Q8Gr1WIJr39uqaoZSQAAAdI"]
[Sat Dec 27 23:24:52.322122 2025] [:error] [pid 31933:tid 31948] [client 92.204.18.103:46722] [client 92.204.18.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.204.18.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6RMGr1WIJr39uqaoZTAAAAc0"]
[Sat Dec 27 23:24:52.322313 2025] [:error] [pid 31933:tid 31948] [client 92.204.18.103:46722] [client 92.204.18.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 92.204.18.103, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6RMGr1WIJr39uqaoZTAAAAc0"]
[Sat Dec 27 23:24:52.753101 2025] [:error] [pid 31933:tid 31937] [client 207.246.240.105:39506] [client 207.246.240.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.246.240.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6RMGr1WIJr39uqaoZTQAAAcI"]
[Sat Dec 27 23:24:52.753270 2025] [:error] [pid 31933:tid 31937] [client 207.246.240.105:39506] [client 207.246.240.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 207.246.240.105, counter = 8"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6RMGr1WIJr39uqaoZTQAAAcI"]
[Sat Dec 27 23:24:53.749356 2025] [:error] [pid 3114:tid 3121] [client 92.204.18.103:46732] [client 92.204.18.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.204.18.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6RWJGrIkLOdbPpJjH5gAAAYM"]
[Sat Dec 27 23:24:53.749591 2025] [:error] [pid 3114:tid 3121] [client 92.204.18.103:46732] [client 92.204.18.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 92.204.18.103, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6RWJGrIkLOdbPpJjH5gAAAYM"]
[Sat Dec 27 23:27:55.977634 2025] [:error] [pid 32278:tid 32283] [client 103.82.21.169:55722] [client 103.82.21.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.82.21.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_6-3-IfCN2Cy9GcchMiwAAAMM"]
[Sat Dec 27 23:35:47.780758 2025] [:error] [pid 32193:tid 32272] [client 185.193.19.102:36172] [client 185.193.19.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.193.19.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_80xgw0eCOc2qYqaLLHQAAAJY"]
[Sat Dec 27 23:41:14.170047 2025] [:error] [pid 31933:tid 31953] [client 207.180.239.117:34700] [client 207.180.239.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.180.239.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU_-GsGr1WIJr39uqaoeCQAAAdI"]
[Sat Dec 27 23:46:30.223735 2025] [:error] [pid 45373:tid 45386] [client 18.206.29.43:39838] [client 18.206.29.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 18.206.29.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aU__Vi7p_wFcbpu46HWmiQAAAUs"]
[Sat Dec 27 23:53:23.030378 2025] [:error] [pid 45373:tid 45386] [client 41.185.8.55:49922] [client 41.185.8.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.185.8.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAA8y7p_wFcbpu46HWoKwAAAUs"]
[Sun Dec 28 00:28:03.036197 2025] [:error] [pid 46742:tid 46767] [client 81.88.49.35:15710] [client 81.88.49.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAJE-ioIIea_hBqsHdrfwAAANU"]
[Sun Dec 28 00:31:24.882124 2025] [:error] [pid 46654:tid 46699] [client 95.174.29.115:44994] [client 95.174.29.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.174.29.115, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAJ3KyyuBQW4Tqizy51BwAAAE0"]
[Sun Dec 28 00:41:27.748506 2025] [:error] [pid 46742:tid 46746] [client 81.88.49.29:16294] [client 81.88.49.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAMN-ioIIea_hBqsHdxSgAAAME"]
[Sun Dec 28 00:46:20.963546 2025] [:error] [pid 46742:tid 46747] [client 64.176.84.57:47220] [client 64.176.84.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.176.84.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVANXOioIIea_hBqsHd0jgAAAMI"]
[Sun Dec 28 00:56:29.215336 2025] [:error] [pid 46654:tid 46688] [client 81.88.49.29:41147] [client 81.88.49.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAPvayyuBQW4Tqizy59nAAAAEI"]
[Sun Dec 28 01:18:16.683000 2025] [:error] [pid 46653:tid 46659] [client 81.88.49.35:35017] [client 81.88.49.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAU2Lj2DbiG6mG0UTPYYAAAAAI"]
[Sun Dec 28 01:20:51.852286 2025] [:error] [pid 46653:tid 46670] [client 186.194.55.237:59606] [client 186.194.55.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.194.55.237, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAVc7j2DbiG6mG0UTPZLgAAAA0"]
[Sun Dec 28 01:23:01.218167 2025] [:error] [pid 46655:tid 46736] [client 125.99.240.61:38906] [client 125.99.240.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 125.99.240.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAV9RJiIF9AF5FHxvCCMgAAAJc"]
[Sun Dec 28 01:25:38.871107 2025] [:error] [pid 46653:tid 46663] [client 81.88.49.35:18529] [client 81.88.49.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAWkrj2DbiG6mG0UTPaYwAAAAY"]
[Sun Dec 28 01:29:39.007707 2025] [:error] [pid 46653:tid 46661] [client 67.205.6.165:35706] [client 67.205.6.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.6.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAXg7j2DbiG6mG0UTPb1gAAAAQ"]
[Sun Dec 28 01:43:31.117717 2025] [:error] [pid 46655:tid 46717] [client 180.93.137.9:34232] [client 180.93.137.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.93.137.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAawxJiIF9AF5FHxvCLXgAAAIQ"]
[Sun Dec 28 01:49:49.178217 2025] [:error] [pid 46654:tid 46698] [client 103.28.36.66:40810] [client 103.28.36.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.28.36.66, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAcPayyuBQW4Tqizy6Q2AAAAEw"]
[Sun Dec 28 02:01:59.137592 2025] [:error] [pid 46742:tid 46761] [client 167.99.12.50:50192] [client 167.99.12.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.12.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAfF-ioIIea_hBqsHecFQAAAM8"]
[Sun Dec 28 02:03:06.707858 2025] [:error] [pid 46742:tid 46769] [client 104.207.63.172:43937] [client 104.207.63.172] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/HEAD"] [unique_id "aVAfWuioIIea_hBqsHec0AAAANc"]
[Sun Dec 28 02:03:14.789110 2025] [:error] [pid 46742:tid 46755] [client 216.26.241.117:37223] [client 216.26.241.117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aVAfYuioIIea_hBqsHedKgAAAMk"]
[Sun Dec 28 02:03:15.382280 2025] [:error] [pid 46742:tid 46757] [client 209.50.163.12:42183] [client 209.50.163.12] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.svn/wc.db"] [unique_id "aVAfY-ioIIea_hBqsHedMwAAAMs"]
[Sun Dec 28 02:43:59.368481 2025] [:error] [pid 46742:tid 46746] [client 198.71.52.204:44642] [client 198.71.52.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.71.52.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAo7-ioIIea_hBqsHexBAAAAME"]
[Sun Dec 28 02:50:33.836558 2025] [:error] [pid 46742:tid 46760] [client 152.53.241.40:60728] [client 152.53.241.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.241.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAqeeioIIea_hBqsHezqgAAAM4"]
[Sun Dec 28 03:11:46.968238 2025] [:error] [pid 20208:tid 20217] [client 160.30.160.240:49880] [client 160.30.160.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.30.160.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAvciSdB5n866Z-1AiLVAAAAMc"]
[Sun Dec 28 03:13:43.708083 2025] [:error] [pid 20045:tid 20152] [client 66.175.44.20:41266] [client 66.175.44.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.175.44.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAv5_AYR1RiXI4JPThyiwAAAEo"]
[Sun Dec 28 03:14:03.600297 2025] [:error] [pid 20046:tid 20183] [client 163.47.203.76:55510] [client 163.47.203.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.47.203.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAv-9wtxpj-8n9eEUz3RAAAAI4"]
[Sun Dec 28 03:27:08.956924 2025] [:error] [pid 61668:tid 61694] [client 8.218.115.242:51922] [client 8.218.115.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.218.115.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAzDB0DVqnUEB2i-Kpj7AAAABY"]
[Sun Dec 28 03:27:10.831504 2025] [:error] [pid 61668:tid 61693] [client 8.218.115.242:52088] [client 8.218.115.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.218.115.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAzDh0DVqnUEB2i-Kpj7QAAABU"]
[Sun Dec 28 03:27:12.100333 2025] [:error] [pid 61669:tid 61710] [client 8.218.115.242:52164] [client 8.218.115.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.218.115.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAzEAQM4SY6zD5LuH7eegAAAEU"]
[Sun Dec 28 03:27:13.345598 2025] [:error] [pid 61670:tid 61755] [client 8.218.115.242:52246] [client 8.218.115.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.218.115.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAzEcJpQK1CviAqzklQ9QAAAJY"]
[Sun Dec 28 03:27:14.583695 2025] [:error] [pid 61669:tid 61717] [client 8.218.115.242:52392] [client 8.218.115.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.218.115.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAzEgQM4SY6zD5LuH7efAAAAEw"]
[Sun Dec 28 03:27:15.818531 2025] [:error] [pid 61669:tid 61724] [client 8.218.115.242:52488] [client 8.218.115.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.218.115.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAzEwQM4SY6zD5LuH7efQAAAFM"]
[Sun Dec 28 03:27:15.818729 2025] [:error] [pid 61669:tid 61724] [client 8.218.115.242:52488] [client 8.218.115.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 8.218.115.242, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAzEwQM4SY6zD5LuH7efQAAAFM"]
[Sun Dec 28 03:27:16.527729 2025] [:error] [pid 61668:tid 61678] [client 8.218.115.242:52550] [client 8.218.115.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.218.115.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAzFB0DVqnUEB2i-Kpj8QAAAAY"]
[Sun Dec 28 03:27:16.527857 2025] [:error] [pid 61668:tid 61678] [client 8.218.115.242:52550] [client 8.218.115.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 8.218.115.242, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAzFB0DVqnUEB2i-Kpj8QAAAAY"]
[Sun Dec 28 03:27:17.238113 2025] [:error] [pid 61762:tid 61779] [client 8.218.115.242:52600] [client 8.218.115.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.218.115.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAzFZ0bE-lLPCv1v_VNQAAAAM8"]
[Sun Dec 28 03:27:17.238289 2025] [:error] [pid 61762:tid 61779] [client 8.218.115.242:52600] [client 8.218.115.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 8.218.115.242, counter = 8"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAzFZ0bE-lLPCv1v_VNQAAAAM8"]
[Sun Dec 28 03:27:17.946058 2025] [:error] [pid 61762:tid 61781] [client 8.218.115.242:52668] [client 8.218.115.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.218.115.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAzFZ0bE-lLPCv1v_VNQwAAANE"]
[Sun Dec 28 03:27:17.946235 2025] [:error] [pid 61762:tid 61781] [client 8.218.115.242:52668] [client 8.218.115.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 8.218.115.242, counter = 9"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAzFZ0bE-lLPCv1v_VNQwAAANE"]
[Sun Dec 28 03:27:54.585238 2025] [:error] [pid 61670:tid 61744] [client 104.219.248.8:42008] [client 104.219.248.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.219.248.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAzOsJpQK1CviAqzklRDQAAAIs"]
[Sun Dec 28 03:27:56.327170 2025] [:error] [pid 61762:tid 61767] [client 104.219.248.8:42018] [client 104.219.248.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.219.248.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAzPJ0bE-lLPCv1v_VNXAAAAMM"]
[Sun Dec 28 03:27:58.003788 2025] [:error] [pid 61762:tid 61783] [client 104.219.248.8:42022] [client 104.219.248.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.219.248.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAzPp0bE-lLPCv1v_VNXgAAANM"]
[Sun Dec 28 03:27:59.573226 2025] [:error] [pid 61762:tid 61781] [client 104.219.248.8:42034] [client 104.219.248.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.219.248.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAzP50bE-lLPCv1v_VNYQAAANE"]
[Sun Dec 28 03:28:01.214875 2025] [:error] [pid 61670:tid 61746] [client 104.219.248.8:58744] [client 104.219.248.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.219.248.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAzQcJpQK1CviAqzklRDwAAAI0"]
[Sun Dec 28 03:28:02.810834 2025] [:error] [pid 61669:tid 61722] [client 104.219.248.8:58758] [client 104.219.248.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.219.248.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAzQgQM4SY6zD5LuH7eiwAAAFE"]
[Sun Dec 28 03:28:02.810977 2025] [:error] [pid 61669:tid 61722] [client 104.219.248.8:58758] [client 104.219.248.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 104.219.248.8, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAzQgQM4SY6zD5LuH7eiwAAAFE"]
[Sun Dec 28 03:30:28.492346 2025] [:error] [pid 26743:tid 26753] [client 92.205.248.5:40216] [client 92.205.248.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.248.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAz1GwPnMydzIN9niTPLgAAAAU"]
[Sun Dec 28 03:30:30.556221 2025] [:error] [pid 26745:tid 26812] [client 92.205.248.5:40226] [client 92.205.248.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.248.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAz1mKve2Ge5oje3rr8fAAAAIo"]
[Sun Dec 28 03:30:32.537459 2025] [:error] [pid 26744:tid 26779] [client 92.205.248.5:40232] [client 92.205.248.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.248.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAz2F1pqKt_V5jAAn32lwAAAEQ"]
[Sun Dec 28 03:30:34.507421 2025] [:error] [pid 26743:tid 26764] [client 92.205.248.5:40242] [client 92.205.248.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.248.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAz2mwPnMydzIN9niTPMwAAABA"]
[Sun Dec 28 03:30:35.255269 2025] [:error] [pid 26744:tid 26775] [client 128.65.195.253:59638] [client 128.65.195.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.65.195.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAz211pqKt_V5jAAn32mQAAAEA"]
[Sun Dec 28 03:30:36.462920 2025] [:error] [pid 26745:tid 26826] [client 92.205.248.5:40254] [client 92.205.248.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.248.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAz3GKve2Ge5oje3rr8gAAAAJg"]
[Sun Dec 28 03:30:37.267516 2025] [:error] [pid 26743:tid 26754] [client 128.65.195.253:59854] [client 128.65.195.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.65.195.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAz3WwPnMydzIN9niTPNwAAAAY"]
[Sun Dec 28 03:30:38.441470 2025] [:error] [pid 26745:tid 26807] [client 92.205.248.5:41998] [client 92.205.248.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.248.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAz3mKve2Ge5oje3rr8gQAAAIU"]
[Sun Dec 28 03:30:38.441653 2025] [:error] [pid 26745:tid 26807] [client 92.205.248.5:41998] [client 92.205.248.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 92.205.248.5, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAz3mKve2Ge5oje3rr8gQAAAIU"]
[Sun Dec 28 03:30:39.276711 2025] [:error] [pid 26745:tid 26813] [client 128.65.195.253:60024] [client 128.65.195.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.65.195.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAz32Kve2Ge5oje3rr8gwAAAIs"]
[Sun Dec 28 03:30:41.298535 2025] [:error] [pid 26744:tid 26778] [client 128.65.195.253:60192] [client 128.65.195.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.65.195.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAz4V1pqKt_V5jAAn32nQAAAEM"]
[Sun Dec 28 03:30:43.308083 2025] [:error] [pid 26745:tid 26803] [client 128.65.195.253:60354] [client 128.65.195.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.65.195.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAz42Kve2Ge5oje3rr8iAAAAIE"]
[Sun Dec 28 03:30:45.312592 2025] [:error] [pid 26745:tid 26805] [client 128.65.195.253:60598] [client 128.65.195.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.65.195.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAz5WKve2Ge5oje3rr8iQAAAIM"]
[Sun Dec 28 03:30:45.312741 2025] [:error] [pid 26745:tid 26805] [client 128.65.195.253:60598] [client 128.65.195.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 128.65.195.253, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAz5WKve2Ge5oje3rr8iQAAAIM"]
[Sun Dec 28 03:30:46.782501 2025] [:error] [pid 26744:tid 26779] [client 128.65.195.253:60716] [client 128.65.195.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.65.195.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAz5l1pqKt_V5jAAn32oAAAAEQ"]
[Sun Dec 28 03:30:46.782720 2025] [:error] [pid 26744:tid 26779] [client 128.65.195.253:60716] [client 128.65.195.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 128.65.195.253, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAz5l1pqKt_V5jAAn32oAAAAEQ"]
[Sun Dec 28 03:30:48.253962 2025] [:error] [pid 26744:tid 26783] [client 128.65.195.253:60882] [client 128.65.195.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.65.195.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAz6F1pqKt_V5jAAn32owAAAEg"]
[Sun Dec 28 03:30:48.254116 2025] [:error] [pid 26744:tid 26783] [client 128.65.195.253:60882] [client 128.65.195.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 128.65.195.253, counter = 8"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVAz6F1pqKt_V5jAAn32owAAAEg"]
[Sun Dec 28 03:43:01.022182 2025] [:error] [pid 64137:tid 64159] [client 157.230.230.244:59354] [client 157.230.230.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.230.244, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVA2xeqo3j9PF2he08wFHQAAAAI"]
[Sun Dec 28 03:50:10.012853 2025] [autoindex:error] [pid 42292:tid 42307] [client 4.197.218.66:16870] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 28 03:50:10.037492 2025] [:error] [pid 42292:tid 42312] [client 4.197.218.66:16870] [client 4.197.218.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aVA4cpyOrM_vaFx1osa97QAAABA"]
[Sun Dec 28 03:50:11.334683 2025] [:error] [pid 42293:tid 42330] [client 4.197.218.66:16798] [client 4.197.218.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aVA4c8vc9B-5cwN385IH3QAAAEc"]
[Sun Dec 28 03:50:11.463181 2025] [:error] [pid 42292:tid 42311] [client 4.197.218.66:16810] [client 4.197.218.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aVA4c5yOrM_vaFx1osa97gAAAA8"]
[Sun Dec 28 03:50:13.315052 2025] [autoindex:error] [pid 42378:tid 42387] [client 4.197.218.66:16859] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 28 03:50:13.449880 2025] [autoindex:error] [pid 42378:tid 42381] [client 4.197.218.66:16859] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 28 03:50:13.471917 2025] [proxy_fcgi:error] [pid 42378:tid 42397] [client 4.197.218.66:16859] AH01071: Got error 'Primary script unknown'
[Sun Dec 28 03:50:13.487749 2025] [:error] [pid 42378:tid 42404] [client 4.197.218.66:16859] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aVA4dTgtcN-KHAjWrX-NTgAAANg"]
[Sun Dec 28 03:50:13.571279 2025] [:error] [pid 42293:tid 42346] [client 4.197.218.66:16855] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aVA4dcvc9B-5cwN385IH4gAAAFc"]
[Sun Dec 28 03:50:13.657414 2025] [:error] [pid 42294:tid 42365] [client 4.197.218.66:16840] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aVA4ddTE5kYcYCOzl9Ez0QAAAI8"]
[Sun Dec 28 03:50:13.732563 2025] [:error] [pid 42293:tid 42335] [client 4.197.218.66:16775] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aVA4dcvc9B-5cwN385IH4wAAAEw"]
[Sun Dec 28 03:50:13.850930 2025] [:error] [pid 42293:tid 42330] [client 4.197.218.66:16788] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aVA4dcvc9B-5cwN385IH5AAAAEc"]
[Sun Dec 28 03:50:14.007536 2025] [:error] [pid 42293:tid 42323] [client 4.197.218.66:16770] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aVA4dsvc9B-5cwN385IH5QAAAEA"]
[Sun Dec 28 03:50:14.065176 2025] [:error] [pid 42293:tid 42328] [client 4.197.218.66:16886] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aVA4dsvc9B-5cwN385IH5gAAAEU"]
[Sun Dec 28 03:50:14.175295 2025] [:error] [pid 42378:tid 42389] [client 4.197.218.66:16882] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aVA4djgtcN-KHAjWrX-NUAAAAMk"]
[Sun Dec 28 03:50:14.325693 2025] [:error] [pid 42293:tid 42326] [client 4.197.218.66:16793] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVA4dsvc9B-5cwN385IH5wAAAEM"]
[Sun Dec 28 03:50:14.481996 2025] [:error] [pid 42294:tid 42353] [client 4.197.218.66:16796] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVA4dtTE5kYcYCOzl9Ez0wAAAIM"]
[Sun Dec 28 03:50:14.599347 2025] [:error] [pid 43789:tid 43791] [client 4.197.218.66:16787] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVA4dga-tUppni4CcCao6wAAAQA"]
[Sun Dec 28 03:50:14.737359 2025] [:error] [pid 43789:tid 43792] [client 4.197.218.66:16858] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVA4dga-tUppni4CcCao7AAAAQE"]
[Sun Dec 28 03:50:14.817263 2025] [:error] [pid 42293:tid 42338] [client 4.197.218.66:16772] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/about.php"] [unique_id "aVA4dsvc9B-5cwN385IH6AAAAE8"]
[Sun Dec 28 03:50:14.907667 2025] [:error] [pid 42294:tid 42362] [client 4.197.218.66:16768] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/about.php"] [unique_id "aVA4dtTE5kYcYCOzl9Ez1gAAAIw"]
[Sun Dec 28 03:50:15.010604 2025] [:error] [pid 42378:tid 42382] [client 4.197.218.66:16878] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/about.php"] [unique_id "aVA4dzgtcN-KHAjWrX-NUwAAAMI"]
[Sun Dec 28 03:50:15.077625 2025] [:error] [pid 42378:tid 42381] [client 4.197.218.66:16856] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/about.php"] [unique_id "aVA4dzgtcN-KHAjWrX-NVAAAAME"]
[Sun Dec 28 03:50:15.112360 2025] [:error] [pid 42292:tid 42316] [client 4.197.218.66:16839] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aVA4d5yOrM_vaFx1osa97wAAABQ"]
[Sun Dec 28 03:50:15.172228 2025] [:error] [pid 42292:tid 42319] [client 4.197.218.66:16831] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aVA4d5yOrM_vaFx1osa98AAAABc"]
[Sun Dec 28 03:50:15.211593 2025] [:error] [pid 42294:tid 42358] [client 4.197.218.66:16850] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aVA4d9TE5kYcYCOzl9Ez1wAAAIg"]
[Sun Dec 28 03:50:15.253243 2025] [:error] [pid 42378:tid 42397] [client 4.197.218.66:16805] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aVA4dzgtcN-KHAjWrX-NVQAAANE"]
[Sun Dec 28 03:50:15.332612 2025] [:error] [pid 42293:tid 42332] [client 4.197.218.66:16780] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aVA4d8vc9B-5cwN385IH6QAAAEk"]
[Sun Dec 28 03:50:15.392470 2025] [:error] [pid 42378:tid 42404] [client 4.197.218.66:16881] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aVA4dzgtcN-KHAjWrX-NVwAAANg"]
[Sun Dec 28 03:50:15.517887 2025] [:error] [pid 42293:tid 42327] [client 4.197.218.66:16789] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aVA4d8vc9B-5cwN385IH6gAAAEQ"]
[Sun Dec 28 03:50:15.653123 2025] [:error] [pid 42293:tid 42341] [client 4.197.218.66:16895] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aVA4d8vc9B-5cwN385IH7AAAAFI"]
[Sun Dec 28 03:50:15.688581 2025] [:error] [pid 42293:tid 42331] [client 4.197.218.66:16893] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aVA4d8vc9B-5cwN385IH7QAAAEg"]
[Sun Dec 28 03:50:15.751993 2025] [:error] [pid 42293:tid 42336] [client 4.197.218.66:16786] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aVA4d8vc9B-5cwN385IH7gAAAE0"]
[Sun Dec 28 03:50:15.807402 2025] [:error] [pid 42294:tid 42369] [client 4.197.218.66:16836] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aVA4d9TE5kYcYCOzl9Ez2AAAAJM"]
[Sun Dec 28 03:50:15.869899 2025] [:error] [pid 42378:tid 42380] [client 4.197.218.66:16806] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aVA4dzgtcN-KHAjWrX-NWgAAAMA"]
[Sun Dec 28 03:50:16.145476 2025] [:error] [pid 42378:tid 42392] [client 4.197.218.66:5097] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aVA4eDgtcN-KHAjWrX-NWwAAAMw"]
[Sun Dec 28 03:50:16.332754 2025] [:error] [pid 42378:tid 42385] [client 4.197.218.66:16778] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aVA4eDgtcN-KHAjWrX-NXAAAAMU"]
[Sun Dec 28 03:50:16.424876 2025] [:error] [pid 42378:tid 42390] [client 4.197.218.66:16795] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aVA4eDgtcN-KHAjWrX-NXQAAAMo"]
[Sun Dec 28 03:50:16.485156 2025] [:error] [pid 42294:tid 42351] [client 4.197.218.66:16885] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aVA4eNTE5kYcYCOzl9Ez2QAAAIE"]
[Sun Dec 28 03:50:16.636247 2025] [:error] [pid 42378:tid 42393] [client 4.197.218.66:5105] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aVA4eDgtcN-KHAjWrX-NXgAAAM0"]
[Sun Dec 28 03:50:16.716854 2025] [:error] [pid 42294:tid 42374] [client 4.197.218.66:16799] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aVA4eNTE5kYcYCOzl9Ez2wAAAJg"]
[Sun Dec 28 03:50:16.799949 2025] [:error] [pid 42378:tid 42394] [client 4.197.218.66:16832] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aVA4eDgtcN-KHAjWrX-NXwAAAM4"]
[Sun Dec 28 03:50:16.879938 2025] [:error] [pid 42294:tid 42367] [client 4.197.218.66:16808] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aVA4eNTE5kYcYCOzl9Ez3AAAAJE"]
[Sun Dec 28 03:50:17.062810 2025] [:error] [pid 42378:tid 42402] [client 4.197.218.66:5061] [client 4.197.218.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/about.php"] [unique_id "aVA4eTgtcN-KHAjWrX-NYQAAANY"]
[Sun Dec 28 03:50:17.275677 2025] [:error] [pid 42294:tid 42365] [client 4.197.218.66:16868] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aVA4edTE5kYcYCOzl9Ez3QAAAI8"]
[Sun Dec 28 03:50:17.412997 2025] [:error] [pid 42294:tid 42360] [client 4.197.218.66:16853] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aVA4edTE5kYcYCOzl9Ez3wAAAIo"]
[Sun Dec 28 03:50:17.472878 2025] [:error] [pid 42294:tid 42364] [client 4.197.218.66:16797] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aVA4edTE5kYcYCOzl9Ez4AAAAI4"]
[Sun Dec 28 03:50:17.518990 2025] [:error] [pid 42293:tid 42328] [client 4.197.218.66:16874] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aVA4ecvc9B-5cwN385IH7wAAAEU"]
[Sun Dec 28 03:50:17.564411 2025] [:error] [pid 42293:tid 42337] [client 4.197.218.66:16800] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/about.php"] [unique_id "aVA4ecvc9B-5cwN385IH8AAAAE4"]
[Sun Dec 28 03:50:17.659805 2025] [:error] [pid 42378:tid 42381] [client 4.197.218.66:5075] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/about.php"] [unique_id "aVA4eTgtcN-KHAjWrX-NYgAAAME"]
[Sun Dec 28 03:50:17.769952 2025] [:error] [pid 42293:tid 42326] [client 4.197.218.66:5080] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/about.php"] [unique_id "aVA4ecvc9B-5cwN385IH8gAAAEM"]
[Sun Dec 28 03:50:17.827177 2025] [:error] [pid 42293:tid 42338] [client 4.197.218.66:16846] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/about.php"] [unique_id "aVA4ecvc9B-5cwN385IH8wAAAE8"]
[Sun Dec 28 03:50:17.920781 2025] [:error] [pid 42294:tid 42370] [client 4.197.218.66:5067] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/admin.php"] [unique_id "aVA4edTE5kYcYCOzl9Ez4QAAAJQ"]
[Sun Dec 28 03:50:17.995400 2025] [:error] [pid 42378:tid 42397] [client 4.197.218.66:16865] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/admin.php"] [unique_id "aVA4eTgtcN-KHAjWrX-NYwAAANE"]
[Sun Dec 28 03:50:18.043940 2025] [:error] [pid 42294:tid 42350] [client 4.197.218.66:16847] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/admin.php"] [unique_id "aVA4etTE5kYcYCOzl9Ez4gAAAIA"]
[Sun Dec 28 03:50:18.116218 2025] [:error] [pid 42378:tid 42380] [client 4.197.218.66:16769] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/admin.php"] [unique_id "aVA4ejgtcN-KHAjWrX-NZQAAAMA"]
[Sun Dec 28 03:50:18.294583 2025] [:error] [pid 42378:tid 42392] [client 4.197.218.66:5086] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aVA4ejgtcN-KHAjWrX-NZgAAAMw"]
[Sun Dec 28 03:50:18.351922 2025] [:error] [pid 42378:tid 42403] [client 4.197.218.66:16892] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aVA4ejgtcN-KHAjWrX-NaAAAANc"]
[Sun Dec 28 03:50:18.462659 2025] [:error] [pid 42292:tid 42310] [client 4.197.218.66:16842] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aVA4epyOrM_vaFx1osa98QAAAA4"]
[Sun Dec 28 03:50:18.521023 2025] [:error] [pid 42292:tid 42303] [client 4.197.218.66:16872] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/mar.php"] [unique_id "aVA4epyOrM_vaFx1osa98gAAAAc"]
[Sun Dec 28 03:50:18.566029 2025] [:error] [pid 42294:tid 42362] [client 4.197.218.66:16783] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "aVA4etTE5kYcYCOzl9Ez4wAAAIw"]
[Sun Dec 28 03:50:18.672071 2025] [:error] [pid 42293:tid 42342] [client 4.197.218.66:16880] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "aVA4esvc9B-5cwN385IH9QAAAFM"]
[Sun Dec 28 03:50:18.763630 2025] [:error] [pid 42293:tid 42347] [client 4.197.218.66:16790] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "aVA4esvc9B-5cwN385IH9wAAAFg"]
[Sun Dec 28 03:50:18.840249 2025] [:error] [pid 42293:tid 42335] [client 4.197.218.66:16792] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "aVA4esvc9B-5cwN385IH-AAAAEw"]
[Sun Dec 28 03:50:18.933900 2025] [:error] [pid 42293:tid 42330] [client 4.197.218.66:16884] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/press/wp-class.php"] [unique_id "aVA4esvc9B-5cwN385IH-QAAAEc"]
[Sun Dec 28 03:50:19.029425 2025] [:error] [pid 42293:tid 42328] [client 4.197.218.66:16841] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/press/wp-class.php"] [unique_id "aVA4e8vc9B-5cwN385IH-gAAAEU"]
[Sun Dec 28 03:50:19.137558 2025] [:error] [pid 42293:tid 42337] [client 4.197.218.66:16883] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/press/wp-class.php"] [unique_id "aVA4e8vc9B-5cwN385IH-wAAAE4"]
[Sun Dec 28 03:50:19.192572 2025] [:error] [pid 42294:tid 42352] [client 4.197.218.66:5110] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/press/wp-class.php"] [unique_id "aVA4e9TE5kYcYCOzl9Ez5AAAAII"]
[Sun Dec 28 03:50:19.349782 2025] [:error] [pid 42378:tid 42386] [client 4.197.218.66:5084] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVA4ezgtcN-KHAjWrX-NaQAAAMY"]
[Sun Dec 28 03:50:19.407363 2025] [:error] [pid 42378:tid 42382] [client 4.197.218.66:16844] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVA4ezgtcN-KHAjWrX-NawAAAMI"]
[Sun Dec 28 03:50:19.517425 2025] [:error] [pid 42378:tid 42381] [client 4.197.218.66:5102] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVA4ezgtcN-KHAjWrX-NbAAAAME"]
[Sun Dec 28 03:50:19.619511 2025] [:error] [pid 42378:tid 42397] [client 4.197.218.66:16894] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVA4ezgtcN-KHAjWrX-NbQAAANE"]
[Sun Dec 28 03:50:19.681788 2025] [:error] [pid 42378:tid 42380] [client 4.197.218.66:16815] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/shell20211028.php"] [unique_id "aVA4ezgtcN-KHAjWrX-NbgAAAMA"]
[Sun Dec 28 03:50:19.733221 2025] [:error] [pid 42378:tid 42404] [client 4.197.218.66:5109] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/shell20211028.php"] [unique_id "aVA4ezgtcN-KHAjWrX-NbwAAANg"]
[Sun Dec 28 03:50:19.885105 2025] [:error] [pid 43789:tid 43794] [client 4.197.218.66:16837] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/shell20211028.php"] [unique_id "aVA4ewa-tUppni4CcCao7gAAAQM"]
[Sun Dec 28 03:50:19.937642 2025] [:error] [pid 43789:tid 43795] [client 4.197.218.66:16782] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/shell20211028.php"] [unique_id "aVA4ewa-tUppni4CcCao7wAAAQQ"]
[Sun Dec 28 03:50:19.999956 2025] [:error] [pid 42294:tid 42351] [client 4.197.218.66:16888] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aVA4e9TE5kYcYCOzl9Ez6QAAAIE"]
[Sun Dec 28 03:50:20.163677 2025] [:error] [pid 42294:tid 42374] [client 4.197.218.66:16818] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aVA4fNTE5kYcYCOzl9Ez6gAAAJg"]
[Sun Dec 28 03:50:20.244585 2025] [:error] [pid 42293:tid 42341] [client 4.197.218.66:16845] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aVA4fMvc9B-5cwN385IH_QAAAFI"]
[Sun Dec 28 03:50:20.309083 2025] [:error] [pid 42293:tid 42327] [client 4.197.218.66:5093] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aVA4fMvc9B-5cwN385IH_gAAAEQ"]
[Sun Dec 28 03:50:20.401255 2025] [:error] [pid 42378:tid 42390] [client 4.197.218.66:16871] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aVA4fDgtcN-KHAjWrX-NcQAAAMo"]
[Sun Dec 28 03:50:20.511714 2025] [:error] [pid 42294:tid 42365] [client 4.197.218.66:16869] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aVA4fNTE5kYcYCOzl9Ez7AAAAI8"]
[Sun Dec 28 03:50:20.644561 2025] [:error] [pid 42378:tid 42389] [client 4.197.218.66:16862] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aVA4fDgtcN-KHAjWrX-NcgAAAMk"]
[Sun Dec 28 03:50:20.686140 2025] [:error] [pid 42378:tid 42394] [client 4.197.218.66:16867] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aVA4fDgtcN-KHAjWrX-NcwAAAM4"]
[Sun Dec 28 03:50:20.740173 2025] [:error] [pid 42294:tid 42360] [client 4.197.218.66:16835] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aVA4fNTE5kYcYCOzl9Ez7QAAAIo"]
[Sun Dec 28 03:50:20.803566 2025] [:error] [pid 42378:tid 42386] [client 4.197.218.66:16794] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aVA4fDgtcN-KHAjWrX-NdAAAAMY"]
[Sun Dec 28 03:50:20.893157 2025] [:error] [pid 42294:tid 42364] [client 4.197.218.66:16877] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aVA4fNTE5kYcYCOzl9Ez7gAAAI4"]
[Sun Dec 28 03:50:20.963458 2025] [:error] [pid 42378:tid 42402] [client 4.197.218.66:16851] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aVA4fDgtcN-KHAjWrX-NdQAAANY"]
[Sun Dec 28 03:50:21.009974 2025] [:error] [pid 42294:tid 42370] [client 4.197.218.66:5007] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/"] [unique_id "aVA4fdTE5kYcYCOzl9Ez7wAAAJQ"]
[Sun Dec 28 03:50:21.062536 2025] [:error] [pid 42292:tid 42302] [client 4.197.218.66:16864] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/"] [unique_id "aVA4fZyOrM_vaFx1osa99AAAAAY"]
[Sun Dec 28 03:50:21.150803 2025] [:error] [pid 42292:tid 42301] [client 4.197.218.66:16857] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/"] [unique_id "aVA4fZyOrM_vaFx1osa99QAAAAU"]
[Sun Dec 28 03:50:21.234383 2025] [:error] [pid 42292:tid 42300] [client 4.197.218.66:16848] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/"] [unique_id "aVA4fZyOrM_vaFx1osa99gAAAAQ"]
[Sun Dec 28 03:50:21.343872 2025] [:error] [pid 42294:tid 42353] [client 4.197.218.66:16774] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aVA4fdTE5kYcYCOzl9Ez8AAAAIM"]
[Sun Dec 28 03:50:21.392664 2025] [:error] [pid 42294:tid 42367] [client 4.197.218.66:16876] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aVA4fdTE5kYcYCOzl9Ez8QAAAJE"]
[Sun Dec 28 03:50:21.440316 2025] [:error] [pid 42292:tid 42313] [client 4.197.218.66:16802] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aVA4fZyOrM_vaFx1osa99wAAABE"]
[Sun Dec 28 03:50:21.483036 2025] [:error] [pid 42294:tid 42352] [client 4.197.218.66:16873] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aVA4fdTE5kYcYCOzl9Ez8gAAAII"]
[Sun Dec 28 03:50:21.539406 2025] [:error] [pid 42292:tid 42320] [client 4.197.218.66:5118] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "aVA4fZyOrM_vaFx1osa9-AAAABg"]
[Sun Dec 28 03:50:21.593697 2025] [:error] [pid 42294:tid 42351] [client 4.197.218.66:16779] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "aVA4fdTE5kYcYCOzl9Ez8wAAAIE"]
[Sun Dec 28 03:50:21.648787 2025] [:error] [pid 42292:tid 42315] [client 4.197.218.66:16825] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "aVA4fZyOrM_vaFx1osa9-QAAABM"]
[Sun Dec 28 03:50:21.684733 2025] [:error] [pid 42292:tid 42296] [client 4.197.218.66:5119] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "aVA4fZyOrM_vaFx1osa9-gAAAAA"]
[Sun Dec 28 03:50:21.743358 2025] [:error] [pid 42292:tid 42299] [client 4.197.218.66:16890] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/index.php"] [unique_id "aVA4fZyOrM_vaFx1osa9-wAAAAM"]
[Sun Dec 28 03:50:21.775100 2025] [:error] [pid 42292:tid 42317] [client 4.197.218.66:5064] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/index.php"] [unique_id "aVA4fZyOrM_vaFx1osa9_AAAABU"]
[Sun Dec 28 03:50:21.819658 2025] [:error] [pid 42378:tid 42381] [client 4.197.218.66:16824] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/index.php"] [unique_id "aVA4fTgtcN-KHAjWrX-NeAAAAME"]
[Sun Dec 28 03:50:21.902842 2025] [:error] [pid 43789:tid 43796] [client 4.197.218.66:16889] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/index.php"] [unique_id "aVA4fQa-tUppni4CcCao8AAAAQU"]
[Sun Dec 28 03:50:21.945792 2025] [:error] [pid 42292:tid 42297] [client 4.197.218.66:16849] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/about.php"] [unique_id "aVA4fZyOrM_vaFx1osa9_QAAAAE"]
[Sun Dec 28 03:50:21.999148 2025] [:error] [pid 42294:tid 42374] [client 4.197.218.66:5065] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/about.php"] [unique_id "aVA4fdTE5kYcYCOzl9Ez9AAAAJg"]
[Sun Dec 28 03:50:22.049643 2025] [:error] [pid 42294:tid 42360] [client 4.197.218.66:5074] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/about.php"] [unique_id "aVA4ftTE5kYcYCOzl9Ez9wAAAIo"]
[Sun Dec 28 03:50:22.133945 2025] [:error] [pid 42294:tid 42358] [client 4.197.218.66:5003] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/about.php"] [unique_id "aVA4ftTE5kYcYCOzl9Ez-AAAAIg"]
[Sun Dec 28 03:50:22.174782 2025] [:error] [pid 42294:tid 42364] [client 4.197.218.66:5057] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/admin.php"] [unique_id "aVA4ftTE5kYcYCOzl9Ez-QAAAI4"]
[Sun Dec 28 03:50:22.261881 2025] [:error] [pid 42294:tid 42370] [client 4.197.218.66:5108] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/admin.php"] [unique_id "aVA4ftTE5kYcYCOzl9Ez-wAAAJQ"]
[Sun Dec 28 03:50:22.432280 2025] [:error] [pid 42378:tid 42404] [client 4.197.218.66:5079] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/admin.php"] [unique_id "aVA4fjgtcN-KHAjWrX-NegAAANg"]
[Sun Dec 28 03:50:22.529047 2025] [:error] [pid 42378:tid 42403] [client 4.197.218.66:16816] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/admin.php"] [unique_id "aVA4fjgtcN-KHAjWrX-NewAAANc"]
[Sun Dec 28 03:50:22.712874 2025] [:error] [pid 42378:tid 42390] [client 4.197.218.66:16791] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/alera/alpha.php"] [unique_id "aVA4fjgtcN-KHAjWrX-NfAAAAMo"]
[Sun Dec 28 03:50:22.758594 2025] [:error] [pid 42378:tid 42393] [client 4.197.218.66:5091] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/alera/alpha.php"] [unique_id "aVA4fjgtcN-KHAjWrX-NfQAAAM0"]
[Sun Dec 28 03:50:22.811620 2025] [:error] [pid 42292:tid 42318] [client 4.197.218.66:16879] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/alera/alpha.php"] [unique_id "aVA4fpyOrM_vaFx1osa9_wAAABY"]
[Sun Dec 28 03:50:22.947011 2025] [:error] [pid 42378:tid 42389] [client 4.197.218.66:5071] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/alera/alpha.php"] [unique_id "aVA4fjgtcN-KHAjWrX-NfgAAAMk"]
[Sun Dec 28 03:50:22.995793 2025] [:error] [pid 42378:tid 42394] [client 4.197.218.66:16830] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/dropdown.php"] [unique_id "aVA4fjgtcN-KHAjWrX-NfwAAAM4"]
[Sun Dec 28 03:50:23.028354 2025] [:error] [pid 42378:tid 42385] [client 4.197.218.66:16852] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/dropdown.php"] [unique_id "aVA4fzgtcN-KHAjWrX-NgAAAAMU"]
[Sun Dec 28 03:50:23.084352 2025] [:error] [pid 42378:tid 42386] [client 4.197.218.66:5094] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/dropdown.php"] [unique_id "aVA4fzgtcN-KHAjWrX-NgQAAAMY"]
[Sun Dec 28 03:50:23.159467 2025] [:error] [pid 42292:tid 42298] [client 4.197.218.66:16861] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/dropdown.php"] [unique_id "aVA4f5yOrM_vaFx1osa-AAAAAAI"]
[Sun Dec 28 03:50:23.228301 2025] [:error] [pid 42378:tid 42402] [client 4.197.218.66:5117] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "aVA4fzgtcN-KHAjWrX-NggAAANY"]
[Sun Dec 28 03:50:23.287467 2025] [:error] [pid 42378:tid 42396] [client 4.197.218.66:5001] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "aVA4fzgtcN-KHAjWrX-NgwAAANA"]
[Sun Dec 28 03:50:23.494929 2025] [:error] [pid 42378:tid 42382] [client 4.197.218.66:16781] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "aVA4fzgtcN-KHAjWrX-NhAAAAMI"]
[Sun Dec 28 03:50:23.699638 2025] [:error] [pid 42378:tid 42381] [client 4.197.218.66:5030] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "aVA4fzgtcN-KHAjWrX-NhQAAAME"]
[Sun Dec 28 03:50:23.742599 2025] [:error] [pid 42294:tid 42352] [client 4.197.218.66:5103] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aVA4f9TE5kYcYCOzl9Ez_QAAAII"]
[Sun Dec 28 03:50:23.784643 2025] [:error] [pid 42294:tid 42351] [client 4.197.218.66:16827] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aVA4f9TE5kYcYCOzl9Ez_gAAAIE"]
[Sun Dec 28 03:50:23.825709 2025] [:error] [pid 42294:tid 42356] [client 4.197.218.66:5095] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aVA4f9TE5kYcYCOzl9Ez_wAAAIY"]
[Sun Dec 28 03:50:23.859280 2025] [:error] [pid 42293:tid 42335] [client 4.197.218.66:16863] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aVA4f8vc9B-5cwN385IIAAAAAEw"]
[Sun Dec 28 03:50:23.992348 2025] [:error] [pid 42294:tid 42374] [client 4.197.218.66:16838] [client 4.197.218.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aVA4f9TE5kYcYCOzl9E0AAAAAJg"]
[Sun Dec 28 03:50:24.154328 2025] [:error] [pid 42294:tid 42371] [client 4.197.218.66:5039] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aVA4gNTE5kYcYCOzl9E0AQAAAJU"]
[Sun Dec 28 03:50:24.268319 2025] [:error] [pid 42293:tid 42330] [client 4.197.218.66:5085] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aVA4gMvc9B-5cwN385IIAQAAAEc"]
[Sun Dec 28 03:50:24.323335 2025] [:error] [pid 42294:tid 42355] [client 4.197.218.66:5088] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aVA4gNTE5kYcYCOzl9E0AwAAAIU"]
[Sun Dec 28 03:50:24.441566 2025] [:error] [pid 42294:tid 42350] [client 4.197.218.66:16822] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mah.php"] [unique_id "aVA4gNTE5kYcYCOzl9E0BAAAAIA"]
[Sun Dec 28 03:50:24.480502 2025] [:error] [pid 42294:tid 42353] [client 4.197.218.66:5017] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mah.php"] [unique_id "aVA4gNTE5kYcYCOzl9E0BQAAAIM"]
[Sun Dec 28 03:50:24.511918 2025] [:error] [pid 42378:tid 42397] [client 4.197.218.66:5034] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mah.php"] [unique_id "aVA4gDgtcN-KHAjWrX-NhwAAANE"]
[Sun Dec 28 03:50:24.591566 2025] [:error] [pid 42294:tid 42365] [client 4.197.218.66:5100] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mah.php"] [unique_id "aVA4gNTE5kYcYCOzl9E0BgAAAI8"]
[Sun Dec 28 03:50:24.823702 2025] [:error] [pid 43789:tid 43799] [client 4.197.218.66:16771] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sidwso.php"] [unique_id "aVA4gAa-tUppni4CcCao8QAAAQg"]
[Sun Dec 28 03:50:24.975192 2025] [:error] [pid 42293:tid 42326] [client 4.197.218.66:16820] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sidwso.php"] [unique_id "aVA4gMvc9B-5cwN385IIAgAAAEM"]
[Sun Dec 28 03:50:25.084483 2025] [:error] [pid 42294:tid 42352] [client 4.197.218.66:5114] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sidwso.php"] [unique_id "aVA4gdTE5kYcYCOzl9E0CQAAAII"]
[Sun Dec 28 03:50:25.138663 2025] [:error] [pid 42294:tid 42351] [client 4.197.218.66:16777] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sidwso.php"] [unique_id "aVA4gdTE5kYcYCOzl9E0CgAAAIE"]
[Sun Dec 28 03:50:25.363499 2025] [:error] [pid 42292:tid 42311] [client 4.197.218.66:4995] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/index.php"] [unique_id "aVA4gZyOrM_vaFx1osa-AgAAAA8"]
[Sun Dec 28 03:50:25.557320 2025] [:error] [pid 42294:tid 42356] [client 4.197.218.66:5016] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/index.php"] [unique_id "aVA4gdTE5kYcYCOzl9E0CwAAAIY"]
[Sun Dec 28 03:50:25.616416 2025] [:error] [pid 42293:tid 42338] [client 4.197.218.66:5062] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/index.php"] [unique_id "aVA4gcvc9B-5cwN385IIAwAAAE8"]
[Sun Dec 28 03:50:25.678886 2025] [:error] [pid 43789:tid 43801] [client 4.197.218.66:5005] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/index.php"] [unique_id "aVA4gQa-tUppni4CcCao8gAAAQo"]
[Sun Dec 28 03:50:25.738625 2025] [:error] [pid 43789:tid 43802] [client 4.197.218.66:16811] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aVA4gQa-tUppni4CcCao8wAAAQs"]
[Sun Dec 28 03:50:25.787271 2025] [:error] [pid 42378:tid 42403] [client 4.197.218.66:5049] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aVA4gTgtcN-KHAjWrX-NigAAANc"]
[Sun Dec 28 03:50:25.852488 2025] [:error] [pid 43789:tid 43803] [client 4.197.218.66:16887] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aVA4gQa-tUppni4CcCao9AAAAQw"]
[Sun Dec 28 03:50:25.886787 2025] [:error] [pid 42292:tid 42309] [client 4.197.218.66:5106] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aVA4gZyOrM_vaFx1osa-AwAAAA0"]
[Sun Dec 28 03:50:25.923493 2025] [:error] [pid 43789:tid 43804] [client 4.197.218.66:5089] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files/index.php"] [unique_id "aVA4gQa-tUppni4CcCao9QAAAQ0"]
[Sun Dec 28 03:50:25.987387 2025] [:error] [pid 42293:tid 42323] [client 4.197.218.66:16828] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files/index.php"] [unique_id "aVA4gcvc9B-5cwN385IIBAAAAEA"]
[Sun Dec 28 03:50:26.051094 2025] [:error] [pid 43789:tid 43805] [client 4.197.218.66:16784] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files/index.php"] [unique_id "aVA4gga-tUppni4CcCao9gAAAQ4"]
[Sun Dec 28 03:50:26.134112 2025] [:error] [pid 43789:tid 43806] [client 4.197.218.66:4942] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files/index.php"] [unique_id "aVA4gga-tUppni4CcCao9wAAAQ8"]
[Sun Dec 28 03:50:26.244979 2025] [:error] [pid 42378:tid 42390] [client 4.197.218.66:5096] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/classwithtostring.php"] [unique_id "aVA4gjgtcN-KHAjWrX-NiwAAAMo"]
[Sun Dec 28 03:50:26.287169 2025] [:error] [pid 43789:tid 43807] [client 4.197.218.66:5073] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/classwithtostring.php"] [unique_id "aVA4gga-tUppni4CcCao-AAAARA"]
[Sun Dec 28 03:50:26.363231 2025] [:error] [pid 43789:tid 43808] [client 4.197.218.66:5101] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/classwithtostring.php"] [unique_id "aVA4gga-tUppni4CcCao-QAAARE"]
[Sun Dec 28 03:50:26.417389 2025] [:error] [pid 42294:tid 42360] [client 4.197.218.66:5018] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/classwithtostring.php"] [unique_id "aVA4gtTE5kYcYCOzl9E0DQAAAIo"]
[Sun Dec 28 03:50:26.482831 2025] [:error] [pid 42378:tid 42389] [client 4.197.218.66:16814] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "aVA4gjgtcN-KHAjWrX-NjQAAAMk"]
[Sun Dec 28 03:50:26.523869 2025] [:error] [pid 43789:tid 43810] [client 4.197.218.66:5068] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "aVA4gga-tUppni4CcCao-gAAARM"]
[Sun Dec 28 03:50:26.597175 2025] [:error] [pid 43789:tid 43811] [client 4.197.218.66:16858] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "aVA4gga-tUppni4CcCao-wAAARQ"]
[Sun Dec 28 03:50:26.645306 2025] [:error] [pid 42378:tid 42394] [client 4.197.218.66:5066] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "aVA4gjgtcN-KHAjWrX-NjgAAAM4"]
[Sun Dec 28 03:50:26.723825 2025] [:error] [pid 42294:tid 42358] [client 4.197.218.66:16801] [client 4.197.218.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bak.php"] [unique_id "aVA4gtTE5kYcYCOzl9E0DgAAAIg"]
[Sun Dec 28 03:50:26.838596 2025] [:error] [pid 42293:tid 42327] [client 4.197.218.66:16812] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aVA4gsvc9B-5cwN385IIBQAAAEQ"]
[Sun Dec 28 03:50:26.930215 2025] [:error] [pid 42294:tid 42355] [client 4.197.218.66:16785] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aVA4gtTE5kYcYCOzl9E0DwAAAIU"]
[Sun Dec 28 03:50:26.997320 2025] [:error] [pid 42294:tid 42350] [client 4.197.218.66:5025] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aVA4gtTE5kYcYCOzl9E0EAAAAIA"]
[Sun Dec 28 03:50:27.048585 2025] [:error] [pid 42294:tid 42353] [client 4.197.218.66:16823] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aVA4g9TE5kYcYCOzl9E0EQAAAIM"]
[Sun Dec 28 03:50:27.179668 2025] [:error] [pid 42294:tid 42365] [client 4.197.218.66:5060] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-signup.php"] [unique_id "aVA4g9TE5kYcYCOzl9E0EgAAAI8"]
[Sun Dec 28 03:50:27.354695 2025] [:error] [pid 43789:tid 43813] [client 4.197.218.66:16875] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-signup.php"] [unique_id "aVA4gwa-tUppni4CcCao_gAAARY"]
[Sun Dec 28 03:50:27.409664 2025] [:error] [pid 43789:tid 43814] [client 4.197.218.66:16813] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-signup.php"] [unique_id "aVA4gwa-tUppni4CcCao_wAAARc"]
[Sun Dec 28 03:50:27.502720 2025] [:error] [pid 42378:tid 42385] [client 4.197.218.66:5031] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-signup.php"] [unique_id "aVA4gzgtcN-KHAjWrX-NjwAAAMU"]
[Sun Dec 28 03:50:27.580114 2025] [:error] [pid 42292:tid 42319] [client 4.197.218.66:5076] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/autoload_classmap.php"] [unique_id "aVA4g5yOrM_vaFx1osa-BAAAABc"]
[Sun Dec 28 03:50:27.638170 2025] [:error] [pid 42292:tid 42310] [client 4.197.218.66:5004] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/autoload_classmap.php"] [unique_id "aVA4g5yOrM_vaFx1osa-BQAAAA4"]
[Sun Dec 28 03:50:27.694836 2025] [:error] [pid 42292:tid 42303] [client 4.197.218.66:16834] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/autoload_classmap.php"] [unique_id "aVA4g5yOrM_vaFx1osa-BgAAAAc"]
[Sun Dec 28 03:50:27.780371 2025] [:error] [pid 42292:tid 42308] [client 4.197.218.66:4929] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/autoload_classmap.php"] [unique_id "aVA4g5yOrM_vaFx1osa-BwAAAAw"]
[Sun Dec 28 03:50:27.893566 2025] [:error] [pid 43789:tid 43791] [client 4.197.218.66:4993] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-configs.php"] [unique_id "aVA4gwa-tUppni4CcCapAQAAAQA"]
[Sun Dec 28 03:50:27.957881 2025] [:error] [pid 43789:tid 43792] [client 4.197.218.66:4936] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-configs.php"] [unique_id "aVA4gwa-tUppni4CcCapAgAAAQE"]
[Sun Dec 28 03:50:28.020091 2025] [:error] [pid 43789:tid 43793] [client 4.197.218.66:5087] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-configs.php"] [unique_id "aVA4hAa-tUppni4CcCapAwAAAQI"]
[Sun Dec 28 03:50:28.091893 2025] [:error] [pid 43789:tid 43794] [client 4.197.218.66:5092] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-configs.php"] [unique_id "aVA4hAa-tUppni4CcCapBQAAAQM"]
[Sun Dec 28 03:50:28.232157 2025] [:error] [pid 42292:tid 42302] [client 4.197.218.66:4949] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aVA4hJyOrM_vaFx1osa-CQAAAAY"]
[Sun Dec 28 03:50:28.298708 2025] [:error] [pid 42293:tid 42336] [client 4.197.218.66:5023] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aVA4hMvc9B-5cwN385IICAAAAE0"]
[Sun Dec 28 03:50:28.341937 2025] [:error] [pid 42293:tid 42346] [client 4.197.218.66:16821] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aVA4hMvc9B-5cwN385IICQAAAFc"]
[Sun Dec 28 03:50:28.411404 2025] [:error] [pid 43789:tid 43795] [client 4.197.218.66:5115] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aVA4hAa-tUppni4CcCapBgAAAQQ"]
[Sun Dec 28 03:50:28.489099 2025] [:error] [pid 42294:tid 42362] [client 4.197.218.66:5020] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aVA4hNTE5kYcYCOzl9E0FQAAAIw"]
[Sun Dec 28 03:50:28.609023 2025] [:error] [pid 42378:tid 42382] [client 4.197.218.66:16795] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aVA4hDgtcN-KHAjWrX-NkgAAAMI"]
[Sun Dec 28 03:50:28.668380 2025] [:error] [pid 42378:tid 42381] [client 4.197.218.66:5035] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aVA4hDgtcN-KHAjWrX-NkwAAAME"]
[Sun Dec 28 03:50:28.725636 2025] [:error] [pid 42292:tid 42313] [client 4.197.218.66:5104] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aVA4hJyOrM_vaFx1osa-DAAAABE"]
[Sun Dec 28 03:50:28.807916 2025] [:error] [pid 42294:tid 42369] [client 4.197.218.66:5015] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/pki-validation/wp-login.php"] [unique_id "aVA4hNTE5kYcYCOzl9E0FgAAAJM"]
[Sun Dec 28 03:50:28.865864 2025] [:error] [pid 42292:tid 42320] [client 4.197.218.66:5021] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/pki-validation/wp-login.php"] [unique_id "aVA4hJyOrM_vaFx1osa-DQAAABg"]
[Sun Dec 28 03:50:28.932934 2025] [:error] [pid 43789:tid 43799] [client 4.197.218.66:16826] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/pki-validation/wp-login.php"] [unique_id "aVA4hAa-tUppni4CcCapCAAAAQg"]
[Sun Dec 28 03:50:28.971234 2025] [:error] [pid 43789:tid 43800] [client 4.197.218.66:5047] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/pki-validation/wp-login.php"] [unique_id "aVA4hAa-tUppni4CcCapCQAAAQk"]
[Sun Dec 28 03:50:29.017108 2025] [:error] [pid 42378:tid 42397] [client 4.197.218.66:4981] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aVA4hTgtcN-KHAjWrX-NlAAAANE"]
[Sun Dec 28 03:50:29.049027 2025] [:error] [pid 42294:tid 42374] [client 4.197.218.66:4971] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aVA4hdTE5kYcYCOzl9E0FwAAAJg"]
[Sun Dec 28 03:50:29.090842 2025] [:error] [pid 42294:tid 42360] [client 4.197.218.66:5081] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aVA4hdTE5kYcYCOzl9E0GAAAAIo"]
[Sun Dec 28 03:50:29.140682 2025] [:error] [pid 42293:tid 42330] [client 4.197.218.66:5083] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aVA4hcvc9B-5cwN385IIDAAAAEc"]
[Sun Dec 28 03:50:29.284455 2025] [:error] [pid 42292:tid 42296] [client 4.197.218.66:5052] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/sketch/404.php"] [unique_id "aVA4hZyOrM_vaFx1osa-DwAAAAA"]
[Sun Dec 28 03:50:29.419928 2025] [:error] [pid 42294:tid 42355] [client 4.197.218.66:16843] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/sketch/404.php"] [unique_id "aVA4hdTE5kYcYCOzl9E0GwAAAIU"]
[Sun Dec 28 03:50:29.455489 2025] [:error] [pid 42294:tid 42350] [client 4.197.218.66:5009] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/sketch/404.php"] [unique_id "aVA4hdTE5kYcYCOzl9E0HAAAAIA"]
[Sun Dec 28 03:50:29.543897 2025] [:error] [pid 42293:tid 42337] [client 4.197.218.66:5063] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/sketch/404.php"] [unique_id "aVA4hcvc9B-5cwN385IIDQAAAE4"]
[Sun Dec 28 03:50:29.590420 2025] [:error] [pid 42293:tid 42326] [client 4.197.218.66:16803] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "aVA4hcvc9B-5cwN385IIDgAAAEM"]
[Sun Dec 28 03:50:29.657496 2025] [:error] [pid 42294:tid 42365] [client 4.197.218.66:5058] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "aVA4hdTE5kYcYCOzl9E0HgAAAI8"]
[Sun Dec 28 03:50:29.703871 2025] [:error] [pid 42294:tid 42370] [client 4.197.218.66:5056] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "aVA4hdTE5kYcYCOzl9E0HwAAAJQ"]
[Sun Dec 28 03:50:29.820446 2025] [:error] [pid 42293:tid 42338] [client 4.197.218.66:5113] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "aVA4hcvc9B-5cwN385IIDwAAAE8"]
[Sun Dec 28 03:50:29.883069 2025] [:error] [pid 42293:tid 42323] [client 4.197.218.66:5008] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aVA4hcvc9B-5cwN385IIEAAAAEA"]
[Sun Dec 28 03:50:29.990938 2025] [:error] [pid 42293:tid 42341] [client 4.197.218.66:5072] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aVA4hcvc9B-5cwN385IIEQAAAFI"]
[Sun Dec 28 03:50:30.038117 2025] [:error] [pid 42378:tid 42399] [client 4.197.218.66:4996] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aVA4hjgtcN-KHAjWrX-NlgAAANM"]
[Sun Dec 28 03:50:30.088637 2025] [:error] [pid 42378:tid 42392] [client 4.197.218.66:5036] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aVA4hjgtcN-KHAjWrX-NlwAAAMw"]
[Sun Dec 28 03:50:30.147109 2025] [:error] [pid 43789:tid 43805] [client 4.197.218.66:4945] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-file.php"] [unique_id "aVA4hga-tUppni4CcCapCwAAAQ4"]
[Sun Dec 28 03:50:30.210222 2025] [:error] [pid 43789:tid 43807] [client 4.197.218.66:4957] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-file.php"] [unique_id "aVA4hga-tUppni4CcCapDAAAARA"]
[Sun Dec 28 03:50:30.308494 2025] [:error] [pid 43789:tid 43810] [client 4.197.218.66:4999] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-file.php"] [unique_id "aVA4hga-tUppni4CcCapDgAAARM"]
[Sun Dec 28 03:50:30.574815 2025] [:error] [pid 42292:tid 42299] [client 4.197.218.66:5111] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-file.php"] [unique_id "aVA4hpyOrM_vaFx1osa-EAAAAAM"]
[Sun Dec 28 03:50:30.762268 2025] [:error] [pid 42293:tid 42327] [client 4.197.218.66:4939] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/log.php"] [unique_id "aVA4hsvc9B-5cwN385IIEgAAAEQ"]
[Sun Dec 28 03:50:30.795009 2025] [:error] [pid 42292:tid 42317] [client 4.197.218.66:4881] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/log.php"] [unique_id "aVA4hpyOrM_vaFx1osa-EQAAABU"]
[Sun Dec 28 03:50:30.909595 2025] [:error] [pid 42378:tid 42403] [client 4.197.218.66:5048] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/log.php"] [unique_id "aVA4hjgtcN-KHAjWrX-NmQAAANc"]
[Sun Dec 28 03:50:31.000971 2025] [:error] [pid 42293:tid 42342] [client 4.197.218.66:4930] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/log.php"] [unique_id "aVA4h8vc9B-5cwN385IIEwAAAFM"]
[Sun Dec 28 03:50:31.042862 2025] [:error] [pid 42292:tid 42297] [client 4.197.218.66:5029] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aVA4h5yOrM_vaFx1osa-EgAAAAE"]
[Sun Dec 28 03:50:31.083653 2025] [:error] [pid 42292:tid 42318] [client 4.197.218.66:16809] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aVA4h5yOrM_vaFx1osa-EwAAABY"]
[Sun Dec 28 03:50:31.125565 2025] [:error] [pid 42293:tid 42331] [client 4.197.218.66:4947] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aVA4h8vc9B-5cwN385IIFAAAAEg"]
[Sun Dec 28 03:50:31.195692 2025] [:error] [pid 42294:tid 42352] [client 4.197.218.66:4992] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aVA4h9TE5kYcYCOzl9E0IQAAAII"]
[Sun Dec 28 03:50:31.328741 2025] [:error] [pid 42292:tid 42298] [client 4.197.218.66:4966] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "aVA4h5yOrM_vaFx1osa-FAAAAAI"]
[Sun Dec 28 03:50:31.395345 2025] [:error] [pid 42294:tid 42369] [client 4.197.218.66:5046] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "aVA4h9TE5kYcYCOzl9E0IgAAAJM"]
[Sun Dec 28 03:50:31.504577 2025] [:error] [pid 42294:tid 42356] [client 4.197.218.66:4998] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "aVA4h9TE5kYcYCOzl9E0IwAAAIY"]
[Sun Dec 28 03:50:31.568113 2025] [:error] [pid 42292:tid 42307] [client 4.197.218.66:4940] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "aVA4h5yOrM_vaFx1osa-FQAAAAs"]
[Sun Dec 28 03:50:31.768211 2025] [:error] [pid 42293:tid 42336] [client 4.197.218.66:4928] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/admin.php"] [unique_id "aVA4h8vc9B-5cwN385IIFQAAAE0"]
[Sun Dec 28 03:50:31.955468 2025] [:error] [pid 42292:tid 42312] [client 4.197.218.66:4954] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/admin.php"] [unique_id "aVA4h5yOrM_vaFx1osa-FgAAABA"]
[Sun Dec 28 03:50:32.027465 2025] [:error] [pid 42378:tid 42393] [client 4.197.218.66:16833] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/admin.php"] [unique_id "aVA4iDgtcN-KHAjWrX-NnAAAAM0"]
[Sun Dec 28 03:50:32.127670 2025] [:error] [pid 42378:tid 42385] [client 4.197.218.66:16773] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/admin.php"] [unique_id "aVA4iDgtcN-KHAjWrX-NnQAAAMU"]
[Sun Dec 28 03:50:32.253019 2025] [:error] [pid 42292:tid 42306] [client 4.197.218.66:4933] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aVA4iJyOrM_vaFx1osa-FwAAAAo"]
[Sun Dec 28 03:50:32.360252 2025] [:error] [pid 42378:tid 42402] [client 4.197.218.66:4997] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aVA4iDgtcN-KHAjWrX-NoAAAANY"]
[Sun Dec 28 03:50:32.450159 2025] [:error] [pid 42378:tid 42382] [client 4.197.218.66:16818] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aVA4iDgtcN-KHAjWrX-NoQAAAMI"]
[Sun Dec 28 03:50:32.528479 2025] [:error] [pid 43789:tid 43808] [client 4.197.218.66:5019] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aVA4iAa-tUppni4CcCapEgAAARE"]
[Sun Dec 28 03:50:32.613225 2025] [:error] [pid 43789:tid 43791] [client 4.197.218.66:5059] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/index.php"] [unique_id "aVA4iAa-tUppni4CcCapEwAAAQA"]
[Sun Dec 28 03:50:32.820753 2025] [:error] [pid 42294:tid 42360] [client 4.197.218.66:5098] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/index.php"] [unique_id "aVA4iNTE5kYcYCOzl9E0JwAAAIo"]
[Sun Dec 28 03:50:32.972687 2025] [:error] [pid 42294:tid 42364] [client 4.197.218.66:5010] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/index.php"] [unique_id "aVA4iNTE5kYcYCOzl9E0KAAAAI4"]
[Sun Dec 28 03:50:33.054433 2025] [:error] [pid 42294:tid 42358] [client 4.197.218.66:16854] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/index.php"] [unique_id "aVA4idTE5kYcYCOzl9E0KQAAAIg"]
[Sun Dec 28 03:50:33.133332 2025] [:error] [pid 42294:tid 42355] [client 4.197.218.66:5024] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/autoload_classmap.php"] [unique_id "aVA4idTE5kYcYCOzl9E0KwAAAIU"]
[Sun Dec 28 03:50:33.181205 2025] [:error] [pid 42292:tid 42309] [client 4.197.218.66:5070] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/autoload_classmap.php"] [unique_id "aVA4iZyOrM_vaFx1osa-GAAAAA0"]
[Sun Dec 28 03:50:33.256638 2025] [:error] [pid 42293:tid 42347] [client 4.197.218.66:4938] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/autoload_classmap.php"] [unique_id "aVA4icvc9B-5cwN385IIFwAAAFg"]
[Sun Dec 28 03:50:33.310898 2025] [:error] [pid 42293:tid 42335] [client 4.197.218.66:5027] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/autoload_classmap.php"] [unique_id "aVA4icvc9B-5cwN385IIGAAAAEw"]
[Sun Dec 28 03:50:33.433543 2025] [:error] [pid 42293:tid 42330] [client 4.197.218.66:4884] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "aVA4icvc9B-5cwN385IIGQAAAEc"]
[Sun Dec 28 03:50:33.485186 2025] [:error] [pid 42294:tid 42350] [client 4.197.218.66:4937] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "aVA4idTE5kYcYCOzl9E0LAAAAIA"]
[Sun Dec 28 03:50:33.537987 2025] [:error] [pid 42293:tid 42332] [client 4.197.218.66:4985] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "aVA4icvc9B-5cwN385IIGgAAAEk"]
[Sun Dec 28 03:50:33.583350 2025] [:error] [pid 42294:tid 42365] [client 4.197.218.66:4994] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "aVA4idTE5kYcYCOzl9E0LQAAAI8"]
[Sun Dec 28 03:50:33.671334 2025] [:error] [pid 42378:tid 42397] [client 4.197.218.66:16891] [client 4.197.218.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aVA4iTgtcN-KHAjWrX-NogAAANE"]
[Sun Dec 28 03:50:33.733525 2025] [:error] [pid 42294:tid 42353] [client 4.197.218.66:5041] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/web.php"] [unique_id "aVA4idTE5kYcYCOzl9E0LgAAAIM"]
[Sun Dec 28 03:50:33.815969 2025] [:error] [pid 42294:tid 42351] [client 4.197.218.66:5090] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/web.php"] [unique_id "aVA4idTE5kYcYCOzl9E0LwAAAIE"]
[Sun Dec 28 03:50:33.896108 2025] [:error] [pid 42292:tid 42319] [client 4.197.218.66:5000] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/web.php"] [unique_id "aVA4iZyOrM_vaFx1osa-GQAAABc"]
[Sun Dec 28 03:50:33.962057 2025] [:error] [pid 42294:tid 42352] [client 4.197.218.66:4946] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/web.php"] [unique_id "aVA4idTE5kYcYCOzl9E0MAAAAII"]
[Sun Dec 28 03:50:34.133260 2025] [:error] [pid 42294:tid 42369] [client 4.197.218.66:4979] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aVA4itTE5kYcYCOzl9E0MQAAAJM"]
[Sun Dec 28 03:50:34.174055 2025] [:error] [pid 42294:tid 42367] [client 4.197.218.66:16807] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aVA4itTE5kYcYCOzl9E0MgAAAJE"]
[Sun Dec 28 03:50:34.228991 2025] [:error] [pid 43789:tid 43794] [client 4.197.218.66:4935] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aVA4iga-tUppni4CcCapFAAAAQM"]
[Sun Dec 28 03:50:34.275934 2025] [:error] [pid 42292:tid 42310] [client 4.197.218.66:16829] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aVA4ipyOrM_vaFx1osa-GgAAAA4"]
[Sun Dec 28 03:50:34.328034 2025] [:error] [pid 42294:tid 42360] [client 4.197.218.66:5044] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock.php"] [unique_id "aVA4itTE5kYcYCOzl9E0NAAAAIo"]
[Sun Dec 28 03:50:34.392633 2025] [:error] [pid 42292:tid 42303] [client 4.197.218.66:5026] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock.php"] [unique_id "aVA4ipyOrM_vaFx1osa-GwAAAAc"]
[Sun Dec 28 03:50:34.500091 2025] [:error] [pid 42294:tid 42374] [client 4.197.218.66:5078] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock.php"] [unique_id "aVA4itTE5kYcYCOzl9E0NQAAAJg"]
[Sun Dec 28 03:50:34.628445 2025] [:error] [pid 43789:tid 43798] [client 4.197.218.66:4948] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock.php"] [unique_id "aVA4iga-tUppni4CcCapFQAAAQc"]
[Sun Dec 28 03:50:34.697534 2025] [:error] [pid 43789:tid 43809] [client 4.197.218.66:4967] [client 4.197.218.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "aVA4iga-tUppni4CcCapFgAAARI"]
[Sun Dec 28 03:50:34.746311 2025] [:error] [pid 42292:tid 42308] [client 4.197.218.66:5011] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aVA4ipyOrM_vaFx1osa-HAAAAAw"]
[Sun Dec 28 03:50:34.799070 2025] [:error] [pid 42378:tid 42380] [client 4.197.218.66:5037] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aVA4ijgtcN-KHAjWrX-NpAAAAMA"]
[Sun Dec 28 03:50:34.962670 2025] [:error] [pid 42293:tid 42323] [client 4.197.218.66:5069] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aVA4isvc9B-5cwN385IIGwAAAEA"]
[Sun Dec 28 03:50:35.074108 2025] [:error] [pid 42294:tid 42355] [client 4.197.218.66:4963] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/dropdown.php"] [unique_id "aVA4i9TE5kYcYCOzl9E0OAAAAIU"]
[Sun Dec 28 03:50:35.151904 2025] [:error] [pid 42292:tid 42302] [client 4.197.218.66:4968] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/dropdown.php"] [unique_id "aVA4i5yOrM_vaFx1osa-HQAAAAY"]
[Sun Dec 28 03:50:35.240588 2025] [:error] [pid 43789:tid 43799] [client 4.197.218.66:5032] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/dropdown.php"] [unique_id "aVA4iwa-tUppni4CcCapFwAAAQg"]
[Sun Dec 28 03:50:35.374860 2025] [:error] [pid 43789:tid 43800] [client 4.197.218.66:4976] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/dropdown.php"] [unique_id "aVA4iwa-tUppni4CcCapGAAAAQk"]
[Sun Dec 28 03:50:35.518353 2025] [:error] [pid 42294:tid 42371] [client 4.197.218.66:5045] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-signup.php"] [unique_id "aVA4i9TE5kYcYCOzl9E0OgAAAJU"]
[Sun Dec 28 03:50:35.613420 2025] [:error] [pid 42294:tid 42351] [client 4.197.218.66:5112] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-signup.php"] [unique_id "aVA4i9TE5kYcYCOzl9E0OwAAAIE"]
[Sun Dec 28 03:50:35.776269 2025] [:error] [pid 42292:tid 42301] [client 4.197.218.66:4973] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-signup.php"] [unique_id "aVA4i5yOrM_vaFx1osa-HgAAAAU"]
[Sun Dec 28 03:50:35.906661 2025] [:error] [pid 43789:tid 43802] [client 4.197.218.66:16817] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-signup.php"] [unique_id "aVA4iwa-tUppni4CcCapGQAAAQs"]
[Sun Dec 28 03:50:36.005739 2025] [:error] [pid 43789:tid 43805] [client 4.197.218.66:5116] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aVA4jAa-tUppni4CcCapGgAAAQ4"]
[Sun Dec 28 03:50:36.052908 2025] [:error] [pid 43789:tid 43807] [client 4.197.218.66:5038] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aVA4jAa-tUppni4CcCapGwAAARA"]
[Sun Dec 28 03:50:36.186004 2025] [:error] [pid 43789:tid 43803] [client 4.197.218.66:5050] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aVA4jAa-tUppni4CcCapHQAAAQw"]
[Sun Dec 28 03:50:36.269636 2025] [:error] [pid 43789:tid 43811] [client 4.197.218.66:5030] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aVA4jAa-tUppni4CcCapHgAAARQ"]
[Sun Dec 28 03:50:36.391806 2025] [:error] [pid 43789:tid 43801] [client 4.197.218.66:5107] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/envato-market/inc/class-envato-market-github.php"] [unique_id "aVA4jAa-tUppni4CcCapIAAAAQo"]
[Sun Dec 28 03:50:36.471177 2025] [:error] [pid 43789:tid 43806] [client 4.197.218.66:5022] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/envato-market/inc/class-envato-market-github.php"] [unique_id "aVA4jAa-tUppni4CcCapIQAAAQ8"]
[Sun Dec 28 03:50:36.587797 2025] [:error] [pid 42378:tid 42393] [client 4.197.218.66:5006] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/envato-market/inc/class-envato-market-github.php"] [unique_id "aVA4jDgtcN-KHAjWrX-NpgAAAM0"]
[Sun Dec 28 03:50:36.733861 2025] [:error] [pid 42294:tid 42374] [client 4.197.218.66:4877] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/envato-market/inc/class-envato-market-github.php"] [unique_id "aVA4jNTE5kYcYCOzl9E0PwAAAJg"]
[Sun Dec 28 03:50:36.804369 2025] [:error] [pid 42378:tid 42389] [client 4.197.218.66:4869] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aVA4jDgtcN-KHAjWrX-NpwAAAMk"]
[Sun Dec 28 03:50:36.857646 2025] [:error] [pid 42378:tid 42394] [client 4.197.218.66:4895] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aVA4jDgtcN-KHAjWrX-NqQAAAM4"]
[Sun Dec 28 03:50:36.922309 2025] [:error] [pid 42292:tid 42316] [client 4.197.218.66:5043] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aVA4jJyOrM_vaFx1osa-HwAAABQ"]
[Sun Dec 28 03:50:36.971148 2025] [:error] [pid 42378:tid 42382] [client 4.197.218.66:4943] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aVA4jDgtcN-KHAjWrX-NqgAAAMI"]
[Sun Dec 28 03:50:37.050540 2025] [:error] [pid 42294:tid 42355] [client 4.197.218.66:4898] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/file.php"] [unique_id "aVA4jdTE5kYcYCOzl9E0QAAAAIU"]
[Sun Dec 28 03:50:37.145641 2025] [:error] [pid 42294:tid 42353] [client 4.197.218.66:4839] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/file.php"] [unique_id "aVA4jdTE5kYcYCOzl9E0QgAAAIM"]
[Sun Dec 28 03:50:37.236462 2025] [:error] [pid 42294:tid 42351] [client 4.197.218.66:5051] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/file.php"] [unique_id "aVA4jdTE5kYcYCOzl9E0RAAAAIE"]
[Sun Dec 28 03:50:37.392265 2025] [:error] [pid 42378:tid 42381] [client 4.197.218.66:4956] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/file.php"] [unique_id "aVA4jTgtcN-KHAjWrX-NqwAAAME"]
[Sun Dec 28 03:50:37.451434 2025] [:error] [pid 42378:tid 42399] [client 4.197.218.66:5040] [client 4.197.218.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aVA4jTgtcN-KHAjWrX-NrQAAANM"]
[Sun Dec 28 03:50:37.615052 2025] [:error] [pid 42378:tid 42404] [client 4.197.218.66:4864] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aVA4jTgtcN-KHAjWrX-NrgAAANg"]
[Sun Dec 28 03:50:37.663763 2025] [:error] [pid 43789:tid 43792] [client 4.197.218.66:4988] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aVA4jQa-tUppni4CcCapJAAAAQE"]
[Sun Dec 28 03:50:37.742101 2025] [:error] [pid 42378:tid 42390] [client 4.197.218.66:4970] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "aVA4jTgtcN-KHAjWrX-NsQAAAMo"]
[Sun Dec 28 03:50:37.793494 2025] [:error] [pid 42292:tid 42313] [client 4.197.218.66:5014] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aVA4jZyOrM_vaFx1osa-IAAAABE"]
[Sun Dec 28 03:50:37.983741 2025] [:error] [pid 42378:tid 42389] [client 4.197.218.66:4975] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aVA4jTgtcN-KHAjWrX-NswAAAMk"]
[Sun Dec 28 03:50:38.073359 2025] [:error] [pid 42378:tid 42396] [client 4.197.218.66:5053] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aVA4jjgtcN-KHAjWrX-NtAAAANA"]
[Sun Dec 28 03:50:38.135814 2025] [:error] [pid 42378:tid 42382] [client 4.197.218.66:4878] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "aVA4jjgtcN-KHAjWrX-NtQAAAMI"]
[Sun Dec 28 03:50:38.231017 2025] [:error] [pid 42378:tid 42399] [client 4.197.218.66:4983] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aVA4jjgtcN-KHAjWrX-NuAAAANM"]
[Sun Dec 28 03:50:38.333788 2025] [:error] [pid 42378:tid 42380] [client 4.197.218.66:4944] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aVA4jjgtcN-KHAjWrX-NuQAAAMA"]
[Sun Dec 28 03:50:38.376699 2025] [:error] [pid 42292:tid 42320] [client 4.197.218.66:4969] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aVA4jpyOrM_vaFx1osa-IQAAABg"]
[Sun Dec 28 03:50:38.580518 2025] [:error] [pid 42378:tid 42393] [client 4.197.218.66:4873] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aVA4jjgtcN-KHAjWrX-NvAAAAM0"]
[Sun Dec 28 03:50:38.819178 2025] [:error] [pid 42294:tid 42374] [client 4.197.218.66:4931] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwenty/404.php"] [unique_id "aVA4jtTE5kYcYCOzl9E0RwAAAJg"]
[Sun Dec 28 03:50:38.889863 2025] [:error] [pid 42294:tid 42364] [client 4.197.218.66:16819] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwenty/404.php"] [unique_id "aVA4jtTE5kYcYCOzl9E0SAAAAI4"]
[Sun Dec 28 03:50:38.950701 2025] [:error] [pid 42293:tid 42331] [client 4.197.218.66:16860] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwenty/404.php"] [unique_id "aVA4jsvc9B-5cwN385IIHQAAAEg"]
[Sun Dec 28 03:50:39.140485 2025] [:error] [pid 42294:tid 42355] [client 4.197.218.66:4803] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwenty/404.php"] [unique_id "aVA4j9TE5kYcYCOzl9E0SQAAAIU"]
[Sun Dec 28 03:50:39.283842 2025] [:error] [pid 42294:tid 42365] [client 4.197.218.66:5082] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/file.php"] [unique_id "aVA4j9TE5kYcYCOzl9E0SgAAAI8"]
[Sun Dec 28 03:50:39.407291 2025] [:error] [pid 42292:tid 42299] [client 4.197.218.66:4879] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/file.php"] [unique_id "aVA4j5yOrM_vaFx1osa-IwAAAAM"]
[Sun Dec 28 03:50:39.447269 2025] [:error] [pid 43789:tid 43795] [client 4.197.218.66:4888] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/file.php"] [unique_id "aVA4jwa-tUppni4CcCapJwAAAQQ"]
[Sun Dec 28 03:50:39.510139 2025] [:error] [pid 43789:tid 43798] [client 4.197.218.66:4876] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/file.php"] [unique_id "aVA4jwa-tUppni4CcCapKAAAAQc"]
[Sun Dec 28 03:50:39.586688 2025] [:error] [pid 43789:tid 43809] [client 4.197.218.66:4984] [client 4.197.218.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aVA4jwa-tUppni4CcCapKQAAARI"]
[Sun Dec 28 03:50:39.647949 2025] [:error] [pid 43789:tid 43796] [client 4.197.218.66:5002] [client 4.197.218.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-load.php"] [unique_id "aVA4jwa-tUppni4CcCapKgAAAQU"]
[Sun Dec 28 03:50:39.789407 2025] [:error] [pid 42294:tid 42351] [client 4.197.218.66:4934] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade-temp-backup/about.php"] [unique_id "aVA4j9TE5kYcYCOzl9E0SwAAAIE"]
[Sun Dec 28 03:50:39.944009 2025] [:error] [pid 42294:tid 42369] [client 4.197.218.66:5055] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade-temp-backup/about.php"] [unique_id "aVA4j9TE5kYcYCOzl9E0TAAAAJM"]
[Sun Dec 28 03:50:40.044091 2025] [:error] [pid 42294:tid 42356] [client 4.197.218.66:4980] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade-temp-backup/about.php"] [unique_id "aVA4kNTE5kYcYCOzl9E0TQAAAIY"]
[Sun Dec 28 03:50:40.163899 2025] [:error] [pid 42294:tid 42367] [client 4.197.218.66:4886] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aVA4kNTE5kYcYCOzl9E0TwAAAJE"]
[Sun Dec 28 03:50:40.339167 2025] [:error] [pid 42294:tid 42362] [client 4.197.218.66:5077] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aVA4kNTE5kYcYCOzl9E0UAAAAIw"]
[Sun Dec 28 03:50:40.426341 2025] [:error] [pid 42378:tid 42382] [client 4.197.218.66:4960] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aVA4kDgtcN-KHAjWrX-NvQAAAMI"]
[Sun Dec 28 03:50:40.477683 2025] [:error] [pid 43789:tid 43802] [client 4.197.218.66:4953] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aVA4kAa-tUppni4CcCapKwAAAQs"]
[Sun Dec 28 03:50:40.565478 2025] [:error] [pid 43789:tid 43805] [client 4.197.218.66:4821] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/revslider/includes/external/page/index.php"] [unique_id "aVA4kAa-tUppni4CcCapLAAAAQ4"]
[Sun Dec 28 03:50:40.667607 2025] [:error] [pid 43789:tid 43807] [client 4.197.218.66:4823] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/revslider/includes/external/page/index.php"] [unique_id "aVA4kAa-tUppni4CcCapLQAAARA"]
[Sun Dec 28 03:50:40.791958 2025] [:error] [pid 43789:tid 43810] [client 4.197.218.66:4807] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/revslider/includes/external/page/index.php"] [unique_id "aVA4kAa-tUppni4CcCapLgAAARM"]
[Sun Dec 28 03:50:40.860824 2025] [:error] [pid 42292:tid 42297] [client 4.197.218.66:5081] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/revslider/includes/external/page/index.php"] [unique_id "aVA4kJyOrM_vaFx1osa-JQAAAAE"]
[Sun Dec 28 03:50:40.932281 2025] [:error] [pid 43789:tid 43803] [client 4.197.218.66:4868] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aVA4kAa-tUppni4CcCapLwAAAQw"]
[Sun Dec 28 03:50:41.027540 2025] [:error] [pid 43789:tid 43811] [client 4.197.218.66:4882] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aVA4kQa-tUppni4CcCapMAAAARQ"]
[Sun Dec 28 03:50:41.155898 2025] [:error] [pid 43789:tid 43813] [client 4.197.218.66:5009] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aVA4kQa-tUppni4CcCapMQAAARY"]
[Sun Dec 28 03:50:41.303368 2025] [:error] [pid 43789:tid 43804] [client 4.197.218.66:4978] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aVA4kQa-tUppni4CcCapMgAAAQ0"]
[Sun Dec 28 03:50:41.373443 2025] [:error] [pid 42293:tid 42336] [client 4.197.218.66:5012] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/priv.php"] [unique_id "aVA4kcvc9B-5cwN385IIHgAAAE0"]
[Sun Dec 28 03:50:41.410897 2025] [:error] [pid 43789:tid 43812] [client 4.197.218.66:5033] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/priv.php"] [unique_id "aVA4kQa-tUppni4CcCapMwAAARU"]
[Sun Dec 28 03:50:41.494975 2025] [:error] [pid 43789:tid 43806] [client 4.197.218.66:5008] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/priv.php"] [unique_id "aVA4kQa-tUppni4CcCapNQAAAQ8"]
[Sun Dec 28 03:50:41.589999 2025] [:error] [pid 43789:tid 43808] [client 4.197.218.66:4755] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/priv.php"] [unique_id "aVA4kQa-tUppni4CcCapNwAAARE"]
[Sun Dec 28 03:50:41.797276 2025] [:error] [pid 43789:tid 43792] [client 4.197.218.66:4760] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/post.php"] [unique_id "aVA4kQa-tUppni4CcCapOAAAAQE"]
[Sun Dec 28 03:50:41.887781 2025] [:error] [pid 42293:tid 42347] [client 4.197.218.66:4808] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/post.php"] [unique_id "aVA4kcvc9B-5cwN385IIHwAAAFg"]
[Sun Dec 28 03:50:42.032725 2025] [:error] [pid 42294:tid 42364] [client 4.197.218.66:4958] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/post.php"] [unique_id "aVA4ktTE5kYcYCOzl9E0UgAAAI4"]
[Sun Dec 28 03:50:42.259116 2025] [:error] [pid 42293:tid 42335] [client 4.197.218.66:4961] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/post.php"] [unique_id "aVA4ksvc9B-5cwN385IIIAAAAEw"]
[Sun Dec 28 03:50:42.333632 2025] [:error] [pid 42293:tid 42330] [client 4.197.218.66:4883] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-includes/IXR/allez.php"] [unique_id "aVA4ksvc9B-5cwN385IIIQAAAEc"]
[Sun Dec 28 03:50:42.423309 2025] [:error] [pid 42293:tid 42332] [client 4.197.218.66:4959] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-includes/IXR/allez.php"] [unique_id "aVA4ksvc9B-5cwN385IIIgAAAEk"]
[Sun Dec 28 03:50:42.548061 2025] [:error] [pid 42292:tid 42298] [client 4.197.218.66:4871] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-includes/IXR/allez.php"] [unique_id "aVA4kpyOrM_vaFx1osa-JgAAAAI"]
[Sun Dec 28 03:50:42.738823 2025] [:error] [pid 42293:tid 42328] [client 4.197.218.66:16884] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-includes/IXR/allez.php"] [unique_id "aVA4ksvc9B-5cwN385IIIwAAAEU"]
[Sun Dec 28 03:50:42.883540 2025] [:error] [pid 42378:tid 42399] [client 4.197.218.66:4905] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aVA4kjgtcN-KHAjWrX-NvgAAANM"]
[Sun Dec 28 03:50:42.995836 2025] [:error] [pid 42292:tid 42307] [client 4.197.218.66:16804] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aVA4kpyOrM_vaFx1osa-JwAAAAs"]
[Sun Dec 28 03:50:43.116470 2025] [:error] [pid 42292:tid 42304] [client 4.197.218.66:5102] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aVA4k5yOrM_vaFx1osa-KAAAAAg"]
[Sun Dec 28 03:50:43.281328 2025] [:error] [pid 42292:tid 42312] [client 4.197.218.66:4919] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aVA4k5yOrM_vaFx1osa-KQAAABA"]
[Sun Dec 28 03:50:43.467121 2025] [:error] [pid 42293:tid 42326] [client 4.197.218.66:16888] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/404.php"] [unique_id "aVA4k8vc9B-5cwN385IIJAAAAEM"]
[Sun Dec 28 03:50:43.548661 2025] [:error] [pid 42378:tid 42386] [client 4.197.218.66:4989] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/404.php"] [unique_id "aVA4kzgtcN-KHAjWrX-NvwAAAMY"]
[Sun Dec 28 03:50:43.592932 2025] [:error] [pid 42378:tid 42392] [client 4.197.218.66:4987] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/404.php"] [unique_id "aVA4kzgtcN-KHAjWrX-NwAAAAMw"]
[Sun Dec 28 03:50:43.649721 2025] [:error] [pid 42293:tid 42346] [client 4.197.218.66:4907] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/404.php"] [unique_id "aVA4k8vc9B-5cwN385IIJQAAAFc"]
[Sun Dec 28 03:50:43.707374 2025] [:error] [pid 42292:tid 42306] [client 4.197.218.66:4830] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "aVA4k5yOrM_vaFx1osa-KgAAAAo"]
[Sun Dec 28 03:50:43.791464 2025] [:error] [pid 42378:tid 42380] [client 4.197.218.66:4921] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "aVA4kzgtcN-KHAjWrX-NwQAAAMA"]
[Sun Dec 28 03:50:43.826956 2025] [:error] [pid 42378:tid 42404] [client 4.197.218.66:4875] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "aVA4kzgtcN-KHAjWrX-NwgAAANg"]
[Sun Dec 28 03:50:43.920414 2025] [:error] [pid 42378:tid 42394] [client 4.197.218.66:4866] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "aVA4kzgtcN-KHAjWrX-NwwAAAM4"]
[Sun Dec 28 03:50:43.976905 2025] [:error] [pid 42378:tid 42390] [client 4.197.218.66:4962] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVA4kzgtcN-KHAjWrX-NxAAAAMo"]
[Sun Dec 28 03:50:44.033800 2025] [:error] [pid 42378:tid 42403] [client 4.197.218.66:5070] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVA4lDgtcN-KHAjWrX-NxQAAANc"]
[Sun Dec 28 03:50:44.093825 2025] [:error] [pid 42293:tid 42338] [client 4.197.218.66:5028] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVA4lMvc9B-5cwN385IIJwAAAE8"]
[Sun Dec 28 03:50:44.188375 2025] [:error] [pid 42292:tid 42311] [client 4.197.218.66:4964] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVA4lJyOrM_vaFx1osa-KwAAAA8"]
[Sun Dec 28 03:50:44.240745 2025] [:error] [pid 42378:tid 42393] [client 4.197.218.66:4892] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/autoload_classmap.php"] [unique_id "aVA4lDgtcN-KHAjWrX-NxgAAAM0"]
[Sun Dec 28 03:50:44.301869 2025] [:error] [pid 42378:tid 42389] [client 4.197.218.66:4815] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/autoload_classmap.php"] [unique_id "aVA4lDgtcN-KHAjWrX-NxwAAAMk"]
[Sun Dec 28 03:50:44.423991 2025] [:error] [pid 42378:tid 42397] [client 4.197.218.66:4891] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/autoload_classmap.php"] [unique_id "aVA4lDgtcN-KHAjWrX-NyAAAANE"]
[Sun Dec 28 03:50:44.568006 2025] [:error] [pid 43789:tid 43794] [client 4.197.218.66:5054] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/autoload_classmap.php"] [unique_id "aVA4lAa-tUppni4CcCapOwAAAQM"]
[Sun Dec 28 03:50:44.720843 2025] [:error] [pid 42378:tid 42385] [client 4.197.218.66:4899] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/pki-validation/admin.php"] [unique_id "aVA4lDgtcN-KHAjWrX-NyQAAAMU"]
[Sun Dec 28 03:50:44.793170 2025] [:error] [pid 43789:tid 43809] [client 4.197.218.66:4982] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/pki-validation/admin.php"] [unique_id "aVA4lAa-tUppni4CcCapPAAAARI"]
[Sun Dec 28 03:50:44.904490 2025] [:error] [pid 42293:tid 42323] [client 4.197.218.66:4974] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/pki-validation/admin.php"] [unique_id "aVA4lMvc9B-5cwN385IIKAAAAEA"]
[Sun Dec 28 03:50:44.990061 2025] [:error] [pid 42292:tid 42309] [client 4.197.218.66:4986] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/pki-validation/admin.php"] [unique_id "aVA4lJyOrM_vaFx1osa-LAAAAA0"]
[Sun Dec 28 03:50:45.084119 2025] [:error] [pid 42293:tid 42341] [client 4.197.218.66:4851] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/index.php"] [unique_id "aVA4lcvc9B-5cwN385IIKQAAAFI"]
[Sun Dec 28 03:50:45.153489 2025] [:error] [pid 42292:tid 42319] [client 4.197.218.66:4902] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/index.php"] [unique_id "aVA4lZyOrM_vaFx1osa-LQAAABc"]
[Sun Dec 28 03:50:45.221245 2025] [:error] [pid 42293:tid 42342] [client 4.197.218.66:4893] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/index.php"] [unique_id "aVA4lcvc9B-5cwN385IIKgAAAFM"]
[Sun Dec 28 03:50:45.351227 2025] [:error] [pid 42293:tid 42331] [client 4.197.218.66:16776] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/index.php"] [unique_id "aVA4lcvc9B-5cwN385IIKwAAAEg"]
[Sun Dec 28 03:50:45.460943 2025] [:error] [pid 42292:tid 42310] [client 4.197.218.66:4814] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aVA4lZyOrM_vaFx1osa-LgAAAA4"]
[Sun Dec 28 03:50:45.655101 2025] [:error] [pid 42292:tid 42303] [client 4.197.218.66:4918] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aVA4lZyOrM_vaFx1osa-LwAAAAc"]
[Sun Dec 28 03:50:45.796645 2025] [:error] [pid 42378:tid 42382] [client 4.197.218.66:4925] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aVA4lTgtcN-KHAjWrX-NywAAAMI"]
[Sun Dec 28 03:50:45.857509 2025] [:error] [pid 42378:tid 42381] [client 4.197.218.66:4889] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "aVA4lTgtcN-KHAjWrX-NzAAAAME"]
[Sun Dec 28 03:50:45.909845 2025] [:error] [pid 42293:tid 42347] [client 4.197.218.66:4746] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aVA4lcvc9B-5cwN385IILAAAAFg"]
[Sun Dec 28 03:50:45.975666 2025] [:error] [pid 43789:tid 43797] [client 4.197.218.66:4890] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aVA4lQa-tUppni4CcCapPQAAAQY"]
[Sun Dec 28 03:50:46.110120 2025] [:error] [pid 42293:tid 42335] [client 4.197.218.66:4872] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aVA4lsvc9B-5cwN385IILQAAAEw"]
[Sun Dec 28 03:50:46.295374 2025] [:error] [pid 43789:tid 43796] [client 4.197.218.66:4927] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aVA4lga-tUppni4CcCapPgAAAQU"]
[Sun Dec 28 03:50:46.464800 2025] [:error] [pid 42378:tid 42387] [client 4.197.218.66:4865] [client 4.197.218.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/themes.php"] [unique_id "aVA4ljgtcN-KHAjWrX-NzQAAAMc"]
[Sun Dec 28 03:50:46.647077 2025] [:error] [pid 43789:tid 43799] [client 4.197.218.66:4904] [client 4.197.218.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/about.php"] [unique_id "aVA4lga-tUppni4CcCapPwAAAQg"]
[Sun Dec 28 04:02:10.767754 2025] [:error] [pid 42378:tid 42397] [client 46.226.163.110:52760] [client 46.226.163.110] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.expressinteriors.com|F|2"] [data "TX:0=audio/x-ms-wma"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVA7QjgtcN-KHAjWrX-P_wAAANE"]
[Sun Dec 28 04:15:30.953657 2025] [:error] [pid 43789:tid 43796] [client 142.112.61.80:37508] [client 142.112.61.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.112.61.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVA-Yga-tUppni4CcCauaAAAAQU"]
[Sun Dec 28 04:19:52.905380 2025] [:error] [pid 42378:tid 42398] [client 103.82.92.35:34418] [client 103.82.92.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.82.92.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVA_aDgtcN-KHAjWrX-U5wAAANI"]
[Sun Dec 28 04:20:40.955596 2025] [:error] [pid 43789:tid 43799] [client 192.241.176.150:45166] [client 192.241.176.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.241.176.150, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVA_mAa-tUppni4CcCavQQAAAQg"]
[Sun Dec 28 04:31:01.065987 2025] [:error] [pid 42293:tid 42334] [client 209.172.2.20:48554] [client 209.172.2.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.172.2.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBCBcvc9B-5cwN385IPpQAAAEs"]
[Sun Dec 28 04:36:07.220499 2025] [:error] [pid 42292:tid 42306] [client 160.30.160.240:50468] [client 160.30.160.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.30.160.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBDN5yOrM_vaFx1osbFVAAAAAo"]
[Sun Dec 28 04:40:30.668509 2025] [:error] [pid 42294:tid 42355] [client 180.93.137.9:53822] [client 180.93.137.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.93.137.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBEPtTE5kYcYCOzl9E-lgAAAIU"]
[Sun Dec 28 04:53:54.373799 2025] [autoindex:error] [pid 42293:tid 42344] [client 74.225.247.240:24855] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Sun Dec 28 04:53:55.231852 2025] [autoindex:error] [pid 42293:tid 42347] [client 74.225.247.240:24855] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Sun Dec 28 04:53:56.040524 2025] [autoindex:error] [pid 42293:tid 42340] [client 74.225.247.240:24855] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Sun Dec 28 04:53:56.196941 2025] [autoindex:error] [pid 42293:tid 42345] [client 74.225.247.240:24855] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Sun Dec 28 04:54:01.636988 2025] [:error] [pid 42293:tid 42341] [client 74.225.247.240:24855] [client 74.225.247.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.225.247.240, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aVBHacvc9B-5cwN385IW2AAAAFI"], referer: https://www.google.fr/
[Sun Dec 28 04:54:06.519089 2025] [autoindex:error] [pid 42293:tid 42336] [client 74.225.247.240:24855] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Sun Dec 28 04:54:06.707456 2025] [autoindex:error] [pid 42293:tid 42326] [client 74.225.247.240:24855] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Sun Dec 28 04:54:06.898131 2025] [autoindex:error] [pid 42293:tid 42342] [client 74.225.247.240:24855] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Sun Dec 28 04:54:08.500930 2025] [autoindex:error] [pid 42293:tid 42339] [client 74.225.247.240:24855] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Sun Dec 28 04:54:08.655396 2025] [autoindex:error] [pid 42293:tid 42341] [client 74.225.247.240:24855] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Sun Dec 28 04:54:08.808618 2025] [:error] [pid 42293:tid 42331] [client 74.225.247.240:24855] [client 74.225.247.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aVBHcMvc9B-5cwN385IW6QAAAEg"], referer: https://www.google.de/
[Sun Dec 28 04:54:09.113781 2025] [:error] [pid 42294:tid 42367] [client 74.225.247.240:57627] [client 74.225.247.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/alfa-rex.php"] [unique_id "aVBHcdTE5kYcYCOzl9FBAQAAAJE"], referer: https://www.yahoo.com/
[Sun Dec 28 04:54:09.435393 2025] [autoindex:error] [pid 43789:tid 43806] [client 74.225.247.240:30754] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/Cookie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Sun Dec 28 04:54:09.605201 2025] [:error] [pid 43789:tid 43811] [client 74.225.247.240:30754] [client 74.225.247.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aVBHcQa-tUppni4CcCa09gAAARQ"], referer: https://www.google.fr/
[Sun Dec 28 04:54:09.943269 2025] [autoindex:error] [pid 42378:tid 42381] [client 74.225.247.240:60237] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Sun Dec 28 04:54:10.095783 2025] [:error] [pid 42378:tid 42397] [client 74.225.247.240:60237] [client 74.225.247.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aVBHcjgtcN-KHAjWrX-Z6gAAANE"], referer: https://www.bing.com/
[Sun Dec 28 04:54:10.424342 2025] [:error] [pid 42294:tid 42355] [client 74.225.247.240:24879] [client 74.225.247.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/xwx1.php"] [unique_id "aVBHctTE5kYcYCOzl9FBAwAAAIU"], referer: https://www.google.fr/
[Sun Dec 28 04:54:10.744142 2025] [:error] [pid 43789:tid 43815] [client 74.225.247.240:24862] [client 74.225.247.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aVBHcga-tUppni4CcCa0-AAAARg"], referer: https://www.bing.com/
[Sun Dec 28 04:54:11.084379 2025] [autoindex:error] [pid 42294:tid 42358] [client 74.225.247.240:30256] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Sun Dec 28 04:54:11.459540 2025] [:error] [pid 42294:tid 42366] [client 74.225.247.240:30256] [client 74.225.247.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "aVBHc9TE5kYcYCOzl9FBBgAAAJA"], referer: https://duckduckgo.com/
[Sun Dec 28 04:54:11.796388 2025] [autoindex:error] [pid 42293:tid 42333] [client 74.225.247.240:41720] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Sun Dec 28 04:54:11.938358 2025] [:error] [pid 42293:tid 42335] [client 74.225.247.240:41720] [client 74.225.247.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aVBHc8vc9B-5cwN385IW7wAAAEw"], referer: https://www.google.com/
[Sun Dec 28 04:54:12.233698 2025] [:error] [pid 43789:tid 43814] [client 74.225.247.240:54166] [client 74.225.247.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aVBHdAa-tUppni4CcCa0-wAAARc"], referer: https://www.google.de/
[Sun Dec 28 04:54:12.536016 2025] [:error] [pid 42294:tid 42353] [client 74.225.247.240:50571] [client 74.225.247.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "aVBHdNTE5kYcYCOzl9FBCQAAAIM"], referer: https://www.google.com/
[Sun Dec 28 04:54:12.840912 2025] [autoindex:error] [pid 43789:tid 43801] [client 74.225.247.240:54158] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Sun Dec 28 04:54:13.993730 2025] [:error] [pid 43789:tid 43791] [client 74.225.247.240:54158] [client 74.225.247.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.225.247.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBHdQa-tUppni4CcCa1AgAAAQA"], referer: https://duckduckgo.com/
[Sun Dec 28 05:04:49.857362 2025] [:error] [pid 42378:tid 42383] [client 213.55.96.153:44274] [client 213.55.96.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.55.96.153, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBJ8TgtcN-KHAjWrX-bzQAAAMM"]
[Sun Dec 28 05:04:58.813638 2025] [:error] [pid 42378:tid 42390] [client 137.74.192.205:42160] [client 137.74.192.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.74.192.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBJ-jgtcN-KHAjWrX-b0QAAAMo"]
[Sun Dec 28 05:41:46.349240 2025] [:error] [pid 29437:tid 29483] [client 157.66.46.84:33474] [client 157.66.46.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.46.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBSmhhDotAbVk6pZLcg8wAAAdE"]
[Sun Dec 28 05:51:05.581821 2025] [:error] [pid 42293:tid 42344] [client 5.39.65.19:43422] [client 5.39.65.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.39.65.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBUycvc9B-5cwN385In6AAAAFU"]
[Sun Dec 28 06:21:36.745813 2025] [:error] [pid 29388:tid 29414] [client 37.27.62.88:49610] [client 37.27.62.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.27.62.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBb8NoLv2L2zI_SpdVijQAAAVI"]
[Sun Dec 28 06:33:39.651610 2025] [:error] [pid 29436:tid 29446] [client 194.230.72.228:56932] [client 194.230.72.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.230.72.228, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBew7chzOOtNL9VPNJKXgAAAYc"]
[Sun Dec 28 06:53:59.357736 2025] [:error] [pid 29436:tid 29461] [client 5.180.252.164:51778] [client 5.180.252.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.180.252.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBjh7chzOOtNL9VPNJNmwAAAZY"]
[Sun Dec 28 06:57:22.213517 2025] [:error] [pid 42293:tid 42343] [client 190.107.177.240:48466] [client 190.107.177.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.107.177.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBkUsvc9B-5cwN385I2-QAAAFQ"]
[Sun Dec 28 07:08:26.704198 2025] [:error] [pid 42293:tid 42326] [client 173.201.252.65:47004] [client 173.201.252.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.201.252.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBm6svc9B-5cwN385I6LQAAAEM"]
[Sun Dec 28 07:08:28.159477 2025] [:error] [pid 42294:tid 42351] [client 173.201.252.65:47018] [client 173.201.252.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.201.252.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBm7NTE5kYcYCOzl9FVjQAAAIE"]
[Sun Dec 28 07:08:29.536636 2025] [:error] [pid 42293:tid 42347] [client 173.201.252.65:47022] [client 173.201.252.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.201.252.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBm7cvc9B-5cwN385I6LwAAAFg"]
[Sun Dec 28 07:08:30.898879 2025] [:error] [pid 42294:tid 42360] [client 173.201.252.65:47024] [client 173.201.252.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.201.252.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBm7tTE5kYcYCOzl9FVkAAAAIo"]
[Sun Dec 28 07:08:32.335439 2025] [:error] [pid 42293:tid 42325] [client 173.201.252.65:47032] [client 173.201.252.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.201.252.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBm8Mvc9B-5cwN385I6MwAAAEI"]
[Sun Dec 28 07:08:33.689191 2025] [:error] [pid 29437:tid 29476] [client 173.201.252.65:47038] [client 173.201.252.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.201.252.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBm8RhDotAbVk6pZLcxigAAAco"]
[Sun Dec 28 07:08:33.689379 2025] [:error] [pid 29437:tid 29476] [client 173.201.252.65:47038] [client 173.201.252.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 173.201.252.65, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBm8RhDotAbVk6pZLcxigAAAco"]
[Sun Dec 28 07:08:34.527111 2025] [:error] [pid 29388:tid 29400] [client 173.201.252.65:47046] [client 173.201.252.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.201.252.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBm8toLv2L2zI_SpdVowwAAAUQ"]
[Sun Dec 28 07:08:34.527251 2025] [:error] [pid 29388:tid 29400] [client 173.201.252.65:47046] [client 173.201.252.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 173.201.252.65, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBm8toLv2L2zI_SpdVowwAAAUQ"]
[Sun Dec 28 07:08:35.354796 2025] [:error] [pid 43789:tid 43800] [client 173.201.252.65:51202] [client 173.201.252.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.201.252.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBm8wa-tUppni4CcCbJqgAAAQk"]
[Sun Dec 28 07:08:35.354987 2025] [:error] [pid 43789:tid 43800] [client 173.201.252.65:51202] [client 173.201.252.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 173.201.252.65, counter = 8"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBm8wa-tUppni4CcCbJqgAAAQk"]
[Sun Dec 28 07:08:36.179052 2025] [:error] [pid 29388:tid 29411] [client 173.201.252.65:51206] [client 173.201.252.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.201.252.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBm9NoLv2L2zI_SpdVoxAAAAU8"]
[Sun Dec 28 07:08:36.179246 2025] [:error] [pid 29388:tid 29411] [client 173.201.252.65:51206] [client 173.201.252.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 173.201.252.65, counter = 9"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBm9NoLv2L2zI_SpdVoxAAAAU8"]
[Sun Dec 28 07:14:48.930773 2025] [:error] [pid 42294:tid 42362] [client 20.96.70.34:41411] [client 20.96.70.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.96.70.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBoaNTE5kYcYCOzl9FWVgAAAIw"]
[Sun Dec 28 07:14:53.185314 2025] [:error] [pid 29388:tid 29417] [client 20.96.70.34:41412] [client 20.96.70.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.96.70.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBobdoLv2L2zI_SpdVpjAAAAVU"]
[Sun Dec 28 07:14:56.603432 2025] [:error] [pid 42292:tid 42320] [client 20.96.70.34:41410] [client 20.96.70.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.96.70.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBocJyOrM_vaFx1osbfGwAAABg"]
[Sun Dec 28 07:14:58.750069 2025] [:error] [pid 42293:tid 42327] [client 20.96.70.34:41409] [client 20.96.70.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.96.70.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBocsvc9B-5cwN385I7bAAAAEQ"]
[Sun Dec 28 07:15:02.064661 2025] [:error] [pid 42378:tid 42397] [client 20.96.70.34:41416] [client 20.96.70.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.96.70.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBodjgtcN-KHAjWrX-vkAAAANE"]
[Sun Dec 28 07:15:04.783886 2025] [:error] [pid 29437:tid 29473] [client 20.96.70.34:41417] [client 20.96.70.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.96.70.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBoeBhDotAbVk6pZLcy2QAAAcc"]
[Sun Dec 28 07:15:04.784044 2025] [:error] [pid 29437:tid 29473] [client 20.96.70.34:41417] [client 20.96.70.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 20.96.70.34, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBoeBhDotAbVk6pZLcy2QAAAcc"]
[Sun Dec 28 07:15:06.644966 2025] [:error] [pid 29388:tid 29407] [client 20.96.70.34:41419] [client 20.96.70.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.96.70.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBoetoLv2L2zI_SpdVpkQAAAUs"]
[Sun Dec 28 07:15:06.645160 2025] [:error] [pid 29388:tid 29407] [client 20.96.70.34:41419] [client 20.96.70.34] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 20.96.70.34, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBoetoLv2L2zI_SpdVpkQAAAUs"]
[Sun Dec 28 07:15:21.494821 2025] [:error] [pid 29436:tid 29453] [client 207.246.240.107:60478] [client 207.246.240.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.246.240.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBoibchzOOtNL9VPNJQ9AAAAY4"]
[Sun Dec 28 07:15:22.908658 2025] [:error] [pid 42293:tid 42331] [client 207.246.240.107:60480] [client 207.246.240.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.246.240.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBoisvc9B-5cwN385I7fAAAAEg"]
[Sun Dec 28 07:15:24.311828 2025] [:error] [pid 42293:tid 42335] [client 207.246.240.107:60494] [client 207.246.240.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.246.240.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBojMvc9B-5cwN385I7fQAAAEw"]
[Sun Dec 28 07:15:25.687666 2025] [:error] [pid 42293:tid 42345] [client 207.246.240.107:60500] [client 207.246.240.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.246.240.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBojcvc9B-5cwN385I7ggAAAFY"]
[Sun Dec 28 07:15:27.073206 2025] [:error] [pid 42293:tid 42333] [client 207.246.240.107:59146] [client 207.246.240.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.246.240.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBoj8vc9B-5cwN385I7hAAAAEo"]
[Sun Dec 28 07:15:28.536107 2025] [:error] [pid 29388:tid 29409] [client 207.246.240.107:59148] [client 207.246.240.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.246.240.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBokNoLv2L2zI_SpdVpqQAAAU0"]
[Sun Dec 28 07:15:28.536272 2025] [:error] [pid 29388:tid 29409] [client 207.246.240.107:59148] [client 207.246.240.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 207.246.240.107, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBokNoLv2L2zI_SpdVpqQAAAU0"]
[Sun Dec 28 07:15:29.392613 2025] [:error] [pid 29437:tid 29466] [client 207.246.240.107:59152] [client 207.246.240.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.246.240.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBokRhDotAbVk6pZLcy4QAAAcA"]
[Sun Dec 28 07:15:29.392774 2025] [:error] [pid 29437:tid 29466] [client 207.246.240.107:59152] [client 207.246.240.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 207.246.240.107, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBokRhDotAbVk6pZLcy4QAAAcA"]
[Sun Dec 28 07:15:30.260608 2025] [:error] [pid 42292:tid 42312] [client 207.246.240.107:59158] [client 207.246.240.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.246.240.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBokpyOrM_vaFx1osbfMgAAABA"]
[Sun Dec 28 07:15:30.260798 2025] [:error] [pid 42292:tid 42312] [client 207.246.240.107:59158] [client 207.246.240.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 207.246.240.107, counter = 8"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBokpyOrM_vaFx1osbfMgAAABA"]
[Sun Dec 28 07:15:31.118861 2025] [:error] [pid 29437:tid 29487] [client 207.246.240.107:59168] [client 207.246.240.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.246.240.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBokxhDotAbVk6pZLcy5AAAAdU"]
[Sun Dec 28 07:15:31.119049 2025] [:error] [pid 29437:tid 29487] [client 207.246.240.107:59168] [client 207.246.240.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 207.246.240.107, counter = 9"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBokxhDotAbVk6pZLcy5AAAAdU"]
[Sun Dec 28 07:15:31.970141 2025] [:error] [pid 42293:tid 42327] [client 207.246.240.107:59180] [client 207.246.240.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.246.240.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBok8vc9B-5cwN385I7igAAAEQ"]
[Sun Dec 28 07:15:31.970383 2025] [:error] [pid 42293:tid 42327] [client 207.246.240.107:59180] [client 207.246.240.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 207.246.240.107, counter = 10"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBok8vc9B-5cwN385I7igAAAEQ"]
[Sun Dec 28 07:16:06.520458 2025] [:error] [pid 29436:tid 29462] [client 160.30.160.240:47706] [client 160.30.160.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.30.160.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBotrchzOOtNL9VPNJRDQAAAZc"]
[Sun Dec 28 07:21:02.911193 2025] [:error] [pid 43789:tid 43804] [client 20.212.251.69:49958] [client 20.212.251.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.212.251.69, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBp3ga-tUppni4CcCbLLQAAAQ0"]
[Sun Dec 28 07:22:27.150374 2025] [:error] [pid 29437:tid 29470] [client 173.236.255.109:56088] [client 173.236.255.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.236.255.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBqMxhDotAbVk6pZLcz8QAAAcQ"]
[Sun Dec 28 07:29:56.169318 2025] [:error] [pid 42294:tid 42352] [client 213.55.96.153:33418] [client 213.55.96.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.55.96.153, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBr9NTE5kYcYCOzl9FXtAAAAII"]
[Sun Dec 28 07:45:48.172361 2025] [:error] [pid 42292:tid 42302] [client 103.8.127.155:35924] [client 103.8.127.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.8.127.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBvrJyOrM_vaFx1osbjFQAAAAY"]
[Sun Dec 28 08:02:04.460565 2025] [:error] [pid 42378:tid 42390] [client 82.223.55.140:51082] [client 82.223.55.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.55.140, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVBzfDgtcN-KHAjWrX-2xwAAAMo"]
[Sun Dec 28 08:40:50.639782 2025] [:error] [pid 42294:tid 42360] [client 103.187.22.114:60306] [client 103.187.22.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.187.22.114, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVB8ktTE5kYcYCOzl9FgSQAAAIo"]
[Sun Dec 28 08:45:10.732776 2025] [:error] [pid 29437:tid 29481] [client 213.55.96.153:37900] [client 213.55.96.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.55.96.153, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVB9lhhDotAbVk6pZLdBcQAAAc8"]
[Sun Dec 28 08:47:51.360210 2025] [:error] [pid 42294:tid 42370] [client 188.130.26.65:39202] [client 188.130.26.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.130.26.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVB-N9TE5kYcYCOzl9Fg6wAAAJQ"]
[Sun Dec 28 09:28:13.745597 2025] [:error] [pid 42292:tid 42302] [client 206.189.189.76:54714] [client 206.189.189.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 206.189.189.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVCHrZyOrM_vaFx1osbt3AAAAAY"]
[Sun Dec 28 10:04:13.846026 2025] [:error] [pid 29437:tid 29489] [client 89.252.168.200:44230] [client 89.252.168.200] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.252.168.200, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVCQHRhDotAbVk6pZLdLggAAAdc"]
[Sun Dec 28 10:14:24.341820 2025] [:error] [pid 42293:tid 42327] [client 46.105.230.99:61260] [client 46.105.230.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.105.230.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVCSgMvc9B-5cwN385JdkAAAAEQ"]
[Sun Dec 28 10:40:39.198409 2025] [:error] [pid 42292:tid 42300] [client 120.71.59.24:57097] [client 120.71.59.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVCYp5yOrM_vaFx1osb2CQAAAAQ"]
[Sun Dec 28 11:07:00.532250 2025] [autoindex:error] [pid 42378:tid 42402] [client 159.89.181.56:53721] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Dec 28 11:12:31.731973 2025] [:error] [pid 42378:tid 42386] [client 167.235.255.92:38208] [client 167.235.255.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.235.255.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVCgHzgtcN-KHAjWrX_JowAAAMY"]
[Sun Dec 28 11:39:38.048967 2025] [:error] [pid 42292:tid 42310] [client 195.234.138.24:53140] [client 195.234.138.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.234.138.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVCmepyOrM_vaFx1osb91AAAAA4"]
[Sun Dec 28 12:27:13.511058 2025] [:error] [pid 29388:tid 29408] [client 66.179.210.205:43724] [client 66.179.210.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.179.210.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVCxodoLv2L2zI_SpdWRhwAAAUw"]
[Sun Dec 28 13:06:15.231897 2025] [:error] [pid 42292:tid 42314] [client 31.25.90.158:61720] [client 31.25.90.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.25.90.158, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVC6x5yOrM_vaFx1osYIwwAAABI"]
[Sun Dec 28 13:24:19.954000 2025] [:error] [pid 42292:tid 42305] [client 162.43.120.17:50474] [client 162.43.120.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.43.120.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVC_A5yOrM_vaFx1osYKaQAAAAk"]
[Sun Dec 28 13:30:19.088448 2025] [:error] [pid 42294:tid 42373] [client 198.251.89.164:54414] [client 198.251.89.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.251.89.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVDAa9TE5kYcYCOzl9F_xgAAAJc"]
[Sun Dec 28 13:56:33.385589 2025] [:error] [pid 43789:tid 43804] [client 35.226.125.165:35092] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVDGkQa-tUppni4CcCb29AAAAQ0"]
[Sun Dec 28 14:24:33.409197 2025] [:error] [pid 29436:tid 29453] [client 125.212.243.142:35756] [client 125.212.243.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 125.212.243.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVDNIbchzOOtNL9VPNKOJQAAAY4"]
[Sun Dec 28 14:27:14.365790 2025] [:error] [pid 42293:tid 42335] [client 101.33.66.34:40668] [client 101.33.66.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVDNwsvc9B-5cwN385KTPwAAAEw"]
[Sun Dec 28 14:43:57.252483 2025] [:error] [pid 42293:tid 42347] [client 43.163.127.190:40856] [client 43.163.127.190] ModSecurity: Access denied with code 403 (phase 1). Match of "endsWith /wp-cron.php" against "REQUEST_FILENAME" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "103"] [id "217200"] [rev "2"] [msg "COMODO WAF: HTTP/1.1 POST request missing Content-Length Header||expressinteriors.com|F|2"] [data "/"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVDRrcvc9B-5cwN385KWkQAAAFg"]
[Sun Dec 28 14:44:09.085648 2025] [:error] [pid 29388:tid 29409] [client 43.163.127.190:40868] [client 43.163.127.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2/actuator/mappings"] [unique_id "aVDRudoLv2L2zI_SpdWhRQAAAU0"]
[Sun Dec 28 15:14:47.851355 2025] [:error] [pid 29388:tid 29408] [client 192.250.229.40:40478] [client 192.250.229.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.229.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVDY59oLv2L2zI_SpdWlkQAAAUw"]
[Sun Dec 28 15:23:02.152567 2025] [:error] [pid 29436:tid 29462] [client 192.250.235.149:56336] [client 192.250.235.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.235.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVDa1rchzOOtNL9VPNKXfwAAAZc"]
[Sun Dec 28 15:28:40.796307 2025] [:error] [pid 29437:tid 29476] [client 107.175.40.41:36932] [client 107.175.40.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.175.40.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVDcKBhDotAbVk6pZLeD3QAAAco"]
[Sun Dec 28 15:49:39.685206 2025] [:error] [pid 29436:tid 29454] [client 196.51.143.167:33049] [client 196.51.143.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.51.143.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVDhE7chzOOtNL9VPNKdIwAAAY8"], referer: https://expressinteriors.com/
[Sun Dec 28 16:35:35.031224 2025] [:error] [pid 29436:tid 29440] [client 192.250.235.90:50534] [client 192.250.235.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.235.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVDr17chzOOtNL9VPNKmPgAAAYE"]
[Sun Dec 28 16:35:39.356175 2025] [:error] [pid 42378:tid 42393] [client 162.241.217.213:58720] [client 162.241.217.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.217.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVDr2zgtcN-KHAjWrX_weAAAAM0"]
[Sun Dec 28 16:40:34.877900 2025] [:error] [pid 29388:tid 29413] [client 185.110.146.106:40898] [client 185.110.146.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.110.146.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVDtAtoLv2L2zI_SpdWy4AAAAVE"]
[Sun Dec 28 16:50:45.912368 2025] [:error] [pid 42294:tid 42359] [client 182.42.105.144:55749] [client 182.42.105.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVDvZdTE5kYcYCOzl9GWzgAAAIk"]
[Sun Dec 28 17:05:13.086863 2025] [:error] [pid 29388:tid 29396] [client 159.65.130.72:59640] [client 159.65.130.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.130.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVDyydoLv2L2zI_SpdW28wAAAUA"]
[Sun Dec 28 17:36:40.587444 2025] [:error] [pid 42293:tid 42337] [client 94.74.145.178:36544] [client 94.74.145.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.74.145.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVD6KMvc9B-5cwN385K_YAAAAE4"]
[Sun Dec 28 17:55:02.563321 2025] [:error] [pid 43789:tid 43798] [client 103.1.187.190:43966] [client 103.1.187.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.1.187.190, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVD-dga-tUppni4CcCYWsAAAAQc"]
[Sun Dec 28 17:57:54.680617 2025] [:error] [pid 42293:tid 42331] [client 41.185.8.76:59860] [client 41.185.8.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.185.8.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVD_Isvc9B-5cwN385LEuQAAAEg"]
[Sun Dec 28 18:38:03.986093 2025] [:error] [pid 29437:tid 29470] [client 209.136.158.254:38422] [client 209.136.158.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.136.158.254, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVEIixhDotAbVk6pZLeuCAAAAcQ"]
[Sun Dec 28 18:49:06.293454 2025] [:error] [pid 29388:tid 29415] [client 162.241.218.214:39516] [client 162.241.218.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.218.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVELItoLv2L2zI_SpdXOxwAAAVM"]
[Sun Dec 28 18:58:12.321172 2025] [:error] [pid 42378:tid 42397] [client 103.6.196.76:56692] [client 103.6.196.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.6.196.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVENRDgtcN-KHAjWrX8LiAAAANE"]
[Sun Dec 28 19:00:45.590029 2025] [:error] [pid 29436:tid 29462] [client 20.89.211.3:17145] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aVEN3bchzOOtNL9VPNLZ-gAAAZc"]
[Sun Dec 28 19:00:45.830838 2025] [:error] [pid 42294:tid 42369] [client 20.89.211.3:17140] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aVEN3dTE5kYcYCOzl9Gx7gAAAJM"]
[Sun Dec 28 19:00:46.081336 2025] [:error] [pid 29436:tid 29453] [client 20.89.211.3:17133] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aVEN3rchzOOtNL9VPNLZ_AAAAY4"]
[Sun Dec 28 19:00:46.327269 2025] [:error] [pid 29436:tid 29461] [client 20.89.211.3:17138] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aVEN3rchzOOtNL9VPNLZ_gAAAZY"]
[Sun Dec 28 19:00:46.570202 2025] [:error] [pid 43789:tid 43795] [client 20.89.211.3:17028] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp8.php"] [unique_id "aVEN3ga-tUppni4CcCYk1wAAAQQ"]
[Sun Dec 28 19:00:46.812106 2025] [:error] [pid 42292:tid 42302] [client 20.89.211.3:17072] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp8.php"] [unique_id "aVEN3pyOrM_vaFx1osY9cAAAAAY"]
[Sun Dec 28 19:00:47.051055 2025] [:error] [pid 29436:tid 29458] [client 20.89.211.3:17139] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp8.php"] [unique_id "aVEN37chzOOtNL9VPNLaAAAAAZM"]
[Sun Dec 28 19:00:47.291924 2025] [:error] [pid 42294:tid 42361] [client 20.89.211.3:17075] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp8.php"] [unique_id "aVEN39TE5kYcYCOzl9Gx7wAAAIs"]
[Sun Dec 28 19:00:47.537811 2025] [:error] [pid 42378:tid 42380] [client 20.89.211.3:8161] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "aVEN3zgtcN-KHAjWrX8MOQAAAMA"]
[Sun Dec 28 19:00:47.779869 2025] [:error] [pid 42293:tid 42333] [client 20.89.211.3:17118] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "aVEN38vc9B-5cwN385LVQQAAAEo"]
[Sun Dec 28 19:00:48.056452 2025] [:error] [pid 42292:tid 42303] [client 20.89.211.3:17151] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "aVEN4JyOrM_vaFx1osY9cgAAAAc"]
[Sun Dec 28 19:00:48.296936 2025] [:error] [pid 29436:tid 29443] [client 20.89.211.3:17141] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "aVEN4LchzOOtNL9VPNLaAQAAAYQ"]
[Sun Dec 28 19:00:48.539446 2025] [:error] [pid 42378:tid 42387] [client 20.89.211.3:17032] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "aVEN4DgtcN-KHAjWrX8MOwAAAMc"]
[Sun Dec 28 19:00:48.780471 2025] [:error] [pid 29436:tid 29444] [client 20.89.211.3:17123] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "aVEN4LchzOOtNL9VPNLaAgAAAYU"]
[Sun Dec 28 19:00:49.022542 2025] [:error] [pid 29388:tid 29402] [client 20.89.211.3:17132] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "aVEN4doLv2L2zI_SpdXQigAAAUY"]
[Sun Dec 28 19:00:49.278726 2025] [:error] [pid 42294:tid 42368] [client 20.89.211.3:17143] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "aVEN4dTE5kYcYCOzl9Gx9AAAAJI"]
[Sun Dec 28 19:00:49.591291 2025] [:error] [pid 29388:tid 29396] [client 20.89.211.3:17099] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gdn.php"] [unique_id "aVEN4doLv2L2zI_SpdXQiwAAAUA"]
[Sun Dec 28 19:00:49.914884 2025] [:error] [pid 29436:tid 29446] [client 20.89.211.3:17042] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gdn.php"] [unique_id "aVEN4bchzOOtNL9VPNLaBwAAAYc"]
[Sun Dec 28 19:00:50.247410 2025] [:error] [pid 29437:tid 29473] [client 20.89.211.3:17150] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gdn.php"] [unique_id "aVEN4hhDotAbVk6pZLezcAAAAcc"]
[Sun Dec 28 19:00:50.569728 2025] [:error] [pid 29437:tid 29469] [client 20.89.211.3:17117] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gdn.php"] [unique_id "aVEN4hhDotAbVk6pZLezcgAAAcM"]
[Sun Dec 28 19:00:50.910013 2025] [:error] [pid 42293:tid 42341] [client 20.89.211.3:17149] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tebar.php"] [unique_id "aVEN4svc9B-5cwN385LVRQAAAFI"]
[Sun Dec 28 19:00:51.228250 2025] [:error] [pid 42293:tid 42337] [client 20.89.211.3:17101] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tebar.php"] [unique_id "aVEN48vc9B-5cwN385LVSAAAAE4"]
[Sun Dec 28 19:00:51.526062 2025] [:error] [pid 42378:tid 42398] [client 20.89.211.3:17046] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tebar.php"] [unique_id "aVEN4zgtcN-KHAjWrX8MPgAAANI"]
[Sun Dec 28 19:00:51.843525 2025] [:error] [pid 29437:tid 29466] [client 20.89.211.3:17144] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tebar.php"] [unique_id "aVEN4xhDotAbVk6pZLezeAAAAcA"]
[Sun Dec 28 19:00:52.161713 2025] [:error] [pid 42378:tid 42403] [client 20.89.211.3:17091] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ty226.php"] [unique_id "aVEN5DgtcN-KHAjWrX8MQQAAANc"]
[Sun Dec 28 19:00:52.469864 2025] [:error] [pid 42293:tid 42331] [client 20.89.211.3:17103] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ty226.php"] [unique_id "aVEN5Mvc9B-5cwN385LVTgAAAEg"]
[Sun Dec 28 19:00:52.775901 2025] [:error] [pid 42292:tid 42318] [client 20.89.211.3:17105] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ty226.php"] [unique_id "aVEN5JyOrM_vaFx1osY9eAAAABY"]
[Sun Dec 28 19:00:53.108752 2025] [:error] [pid 42293:tid 42339] [client 20.89.211.3:17100] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ty226.php"] [unique_id "aVEN5cvc9B-5cwN385LVVAAAAFA"]
[Sun Dec 28 19:00:53.395298 2025] [:error] [pid 42293:tid 42347] [client 20.89.211.3:17127] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/songsa.php"] [unique_id "aVEN5cvc9B-5cwN385LVVQAAAFg"]
[Sun Dec 28 19:00:53.681207 2025] [:error] [pid 29388:tid 29399] [client 20.89.211.3:17096] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/songsa.php"] [unique_id "aVEN5doLv2L2zI_SpdXQjAAAAUM"]
[Sun Dec 28 19:00:53.993544 2025] [:error] [pid 42378:tid 42386] [client 20.89.211.3:17054] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/songsa.php"] [unique_id "aVEN5TgtcN-KHAjWrX8MRwAAAMY"]
[Sun Dec 28 19:00:54.279839 2025] [:error] [pid 42293:tid 42346] [client 20.89.211.3:17050] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/songsa.php"] [unique_id "aVEN5svc9B-5cwN385LVWgAAAFc"]
[Sun Dec 28 19:00:54.577708 2025] [:error] [pid 42294:tid 42356] [client 20.89.211.3:17049] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qing2.php"] [unique_id "aVEN5tTE5kYcYCOzl9Gx9gAAAIY"]
[Sun Dec 28 19:00:54.845516 2025] [:error] [pid 29388:tid 29398] [client 20.89.211.3:17055] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qing2.php"] [unique_id "aVEN5toLv2L2zI_SpdXQjgAAAUI"]
[Sun Dec 28 19:00:55.124943 2025] [:error] [pid 29388:tid 29414] [client 20.89.211.3:8145] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qing2.php"] [unique_id "aVEN59oLv2L2zI_SpdXQkAAAAVI"]
[Sun Dec 28 19:00:55.388832 2025] [:error] [pid 42378:tid 42400] [client 20.89.211.3:17147] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qing2.php"] [unique_id "aVEN5zgtcN-KHAjWrX8MTAAAANQ"]
[Sun Dec 28 19:00:55.649935 2025] [:error] [pid 42294:tid 42365] [client 20.89.211.3:8132] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/massby2.php"] [unique_id "aVEN59TE5kYcYCOzl9Gx-AAAAI8"]
[Sun Dec 28 19:00:55.913809 2025] [:error] [pid 42378:tid 42380] [client 20.89.211.3:17039] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/massby2.php"] [unique_id "aVEN5zgtcN-KHAjWrX8MTgAAAMA"]
[Sun Dec 28 19:00:56.182791 2025] [:error] [pid 42292:tid 42308] [client 20.89.211.3:17079] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/massby2.php"] [unique_id "aVEN6JyOrM_vaFx1osY9ewAAAAw"]
[Sun Dec 28 19:00:56.470749 2025] [:error] [pid 29437:tid 29474] [client 20.89.211.3:17078] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/massby2.php"] [unique_id "aVEN6BhDotAbVk6pZLezfwAAAcg"]
[Sun Dec 28 19:00:56.749602 2025] [:error] [pid 29436:tid 29449] [client 20.89.211.3:17148] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qual.php"] [unique_id "aVEN6LchzOOtNL9VPNLaEgAAAYo"]
[Sun Dec 28 19:00:57.032049 2025] [:error] [pid 29437:tid 29476] [client 20.89.211.3:17034] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qual.php"] [unique_id "aVEN6RhDotAbVk6pZLezgAAAAco"]
[Sun Dec 28 19:00:57.324481 2025] [:error] [pid 42294:tid 42361] [client 20.89.211.3:17131] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qual.php"] [unique_id "aVEN6dTE5kYcYCOzl9Gx_wAAAIs"]
[Sun Dec 28 19:00:57.605733 2025] [:error] [pid 42292:tid 42319] [client 20.89.211.3:17104] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qual.php"] [unique_id "aVEN6ZyOrM_vaFx1osY9fQAAABc"]
[Sun Dec 28 19:00:57.888319 2025] [:error] [pid 29388:tid 29412] [client 20.89.211.3:8167] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/udnkq.php"] [unique_id "aVEN6doLv2L2zI_SpdXQlQAAAVA"]
[Sun Dec 28 19:00:58.192814 2025] [:error] [pid 42292:tid 42296] [client 20.89.211.3:17029] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/udnkq.php"] [unique_id "aVEN6pyOrM_vaFx1osY9gAAAAAA"]
[Sun Dec 28 19:00:58.433558 2025] [:error] [pid 42292:tid 42310] [client 20.89.211.3:17043] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/udnkq.php"] [unique_id "aVEN6pyOrM_vaFx1osY9gwAAAA4"]
[Sun Dec 28 19:00:58.687757 2025] [:error] [pid 29388:tid 29417] [client 20.89.211.3:17052] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/udnkq.php"] [unique_id "aVEN6toLv2L2zI_SpdXQmAAAAVU"]
[Sun Dec 28 19:00:58.988619 2025] [:error] [pid 29388:tid 29403] [client 20.89.211.3:17087] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "aVEN6toLv2L2zI_SpdXQmQAAAUc"]
[Sun Dec 28 19:00:59.242126 2025] [:error] [pid 42292:tid 42299] [client 20.89.211.3:8162] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "aVEN65yOrM_vaFx1osY9hgAAAAM"]
[Sun Dec 28 19:00:59.503489 2025] [:error] [pid 29437:tid 29487] [client 20.89.211.3:17109] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "aVEN6xhDotAbVk6pZLezhAAAAdU"]
[Sun Dec 28 19:00:59.750285 2025] [:error] [pid 42293:tid 42339] [client 20.89.211.3:8131] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "aVEN68vc9B-5cwN385LVXwAAAFA"]
[Sun Dec 28 19:01:00.011755 2025] [:error] [pid 43789:tid 43806] [client 20.89.211.3:17098] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z4qmm5.php"] [unique_id "aVEN7Aa-tUppni4CcCYk6AAAAQ8"]
[Sun Dec 28 19:01:00.276923 2025] [:error] [pid 43789:tid 43809] [client 20.89.211.3:8166] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z4qmm5.php"] [unique_id "aVEN7Aa-tUppni4CcCYk6QAAARI"]
[Sun Dec 28 19:01:00.517839 2025] [:error] [pid 42292:tid 42307] [client 20.89.211.3:17073] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z4qmm5.php"] [unique_id "aVEN7JyOrM_vaFx1osY9iQAAAAs"]
[Sun Dec 28 19:01:00.758646 2025] [:error] [pid 42292:tid 42309] [client 20.89.211.3:17060] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z4qmm5.php"] [unique_id "aVEN7JyOrM_vaFx1osY9jAAAAA0"]
[Sun Dec 28 19:01:00.999447 2025] [:error] [pid 42292:tid 42311] [client 20.89.211.3:17071] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no3.php"] [unique_id "aVEN7JyOrM_vaFx1osY9jQAAAA8"]
[Sun Dec 28 19:01:01.240291 2025] [:error] [pid 43789:tid 43804] [client 20.89.211.3:17094] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no3.php"] [unique_id "aVEN7Qa-tUppni4CcCYk7QAAAQ0"]
[Sun Dec 28 19:01:01.480638 2025] [:error] [pid 42292:tid 42308] [client 20.89.211.3:17116] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no3.php"] [unique_id "aVEN7ZyOrM_vaFx1osY9jgAAAAw"]
[Sun Dec 28 19:01:01.743047 2025] [:error] [pid 29437:tid 29471] [client 20.89.211.3:8182] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no3.php"] [unique_id "aVEN7RhDotAbVk6pZLezkQAAAcU"]
[Sun Dec 28 19:01:02.012943 2025] [:error] [pid 43789:tid 43799] [client 20.89.211.3:17051] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/om.php"] [unique_id "aVEN7ga-tUppni4CcCYk7gAAAQg"]
[Sun Dec 28 19:01:02.288765 2025] [:error] [pid 43789:tid 43792] [client 20.89.211.3:17024] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/om.php"] [unique_id "aVEN7ga-tUppni4CcCYk8QAAAQE"]
[Sun Dec 28 19:01:02.555141 2025] [:error] [pid 43789:tid 43796] [client 20.89.211.3:17136] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/om.php"] [unique_id "aVEN7ga-tUppni4CcCYk8wAAAQU"]
[Sun Dec 28 19:01:02.802380 2025] [:error] [pid 43789:tid 43797] [client 20.89.211.3:17025] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/om.php"] [unique_id "aVEN7ga-tUppni4CcCYk9gAAAQY"]
[Sun Dec 28 19:01:03.066721 2025] [:error] [pid 43789:tid 43802] [client 20.89.211.3:17108] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/webix.php"] [unique_id "aVEN7wa-tUppni4CcCYk9wAAAQs"]
[Sun Dec 28 19:01:03.334309 2025] [:error] [pid 29388:tid 29397] [client 20.89.211.3:17031] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/webix.php"] [unique_id "aVEN79oLv2L2zI_SpdXQpAAAAUE"]
[Sun Dec 28 19:01:03.637068 2025] [:error] [pid 42293:tid 42338] [client 20.89.211.3:17137] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/webix.php"] [unique_id "aVEN78vc9B-5cwN385LVaQAAAE8"]
[Sun Dec 28 19:01:03.877782 2025] [:error] [pid 42293:tid 42334] [client 20.89.211.3:8148] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/webix.php"] [unique_id "aVEN78vc9B-5cwN385LVagAAAEs"]
[Sun Dec 28 19:01:04.117279 2025] [:error] [pid 43789:tid 43793] [client 20.89.211.3:17129] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aVEN8Aa-tUppni4CcCYk-gAAAQI"]
[Sun Dec 28 19:01:04.378394 2025] [:error] [pid 43789:tid 43806] [client 20.89.211.3:17097] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aVEN8Aa-tUppni4CcCYk_QAAAQ8"]
[Sun Dec 28 19:01:04.640001 2025] [:error] [pid 42292:tid 42296] [client 20.89.211.3:17126] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aVEN8JyOrM_vaFx1osY9kQAAAAA"]
[Sun Dec 28 19:01:04.888380 2025] [:error] [pid 42293:tid 42331] [client 20.89.211.3:17083] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aVEN8Mvc9B-5cwN385LVbgAAAEg"]
[Sun Dec 28 19:01:05.129952 2025] [:error] [pid 43789:tid 43807] [client 20.89.211.3:17084] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cka.php"] [unique_id "aVEN8Qa-tUppni4CcCYlAgAAARA"]
[Sun Dec 28 19:01:05.397063 2025] [:error] [pid 43789:tid 43804] [client 20.89.211.3:17036] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cka.php"] [unique_id "aVEN8Qa-tUppni4CcCYlBAAAAQ0"]
[Sun Dec 28 19:01:05.670872 2025] [:error] [pid 42293:tid 42347] [client 20.89.211.3:17142] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cka.php"] [unique_id "aVEN8cvc9B-5cwN385LVcwAAAFg"]
[Sun Dec 28 19:01:05.941702 2025] [:error] [pid 42292:tid 42304] [client 20.89.211.3:17026] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cka.php"] [unique_id "aVEN8ZyOrM_vaFx1osY9lQAAAAg"]
[Sun Dec 28 19:01:06.202240 2025] [:error] [pid 29437:tid 29466] [client 20.89.211.3:17086] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aVEN8hhDotAbVk6pZLezmwAAAcA"]
[Sun Dec 28 19:01:06.459585 2025] [:error] [pid 29388:tid 29403] [client 20.89.211.3:17093] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aVEN8toLv2L2zI_SpdXQqQAAAUc"]
[Sun Dec 28 19:01:06.704164 2025] [:error] [pid 29437:tid 29470] [client 20.89.211.3:8168] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aVEN8hhDotAbVk6pZLeznwAAAcQ"]
[Sun Dec 28 19:01:06.954721 2025] [:error] [pid 42378:tid 42398] [client 20.89.211.3:17070] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aVEN8jgtcN-KHAjWrX8MUQAAANI"]
[Sun Dec 28 19:01:07.220113 2025] [:error] [pid 43789:tid 43792] [client 20.89.211.3:17122] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aVEN8wa-tUppni4CcCYlBwAAAQE"]
[Sun Dec 28 19:01:07.506564 2025] [:error] [pid 43789:tid 43801] [client 20.89.211.3:17111] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aVEN8wa-tUppni4CcCYlCAAAAQo"]
[Sun Dec 28 19:01:07.807856 2025] [:error] [pid 42293:tid 42344] [client 20.89.211.3:17069] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aVEN88vc9B-5cwN385LVeQAAAFU"]
[Sun Dec 28 19:01:08.064081 2025] [:error] [pid 42294:tid 42371] [client 20.89.211.3:17027] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aVEN9NTE5kYcYCOzl9GyBgAAAJU"]
[Sun Dec 28 19:01:08.305677 2025] [:error] [pid 43789:tid 43797] [client 20.89.211.3:17074] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aVEN9Aa-tUppni4CcCYlDAAAAQY"]
[Sun Dec 28 19:01:08.566518 2025] [:error] [pid 42294:tid 42373] [client 20.89.211.3:17035] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aVEN9NTE5kYcYCOzl9GyCAAAAJc"]
[Sun Dec 28 19:01:08.891775 2025] [:error] [pid 42378:tid 42402] [client 20.89.211.3:8179] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aVEN9DgtcN-KHAjWrX8MVQAAANY"]
[Sun Dec 28 19:01:09.131537 2025] [:error] [pid 42294:tid 42357] [client 20.89.211.3:17092] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aVEN9dTE5kYcYCOzl9GyCgAAAIc"]
[Sun Dec 28 19:01:09.453101 2025] [:error] [pid 42292:tid 42306] [client 20.89.211.3:17047] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aVEN9ZyOrM_vaFx1osY9mAAAAAo"]
[Sun Dec 28 19:01:09.697078 2025] [:error] [pid 29437:tid 29479] [client 20.89.211.3:17146] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aVEN9RhDotAbVk6pZLezoQAAAc0"]
[Sun Dec 28 19:01:10.000519 2025] [:error] [pid 42294:tid 42372] [client 20.89.211.3:8135] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aVEN9dTE5kYcYCOzl9GyDAAAAJY"]
[Sun Dec 28 19:01:10.243874 2025] [:error] [pid 43789:tid 43793] [client 20.89.211.3:17048] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aVEN9ga-tUppni4CcCYlEAAAAQI"]
[Sun Dec 28 19:01:10.506818 2025] [:error] [pid 43789:tid 43806] [client 20.89.211.3:17082] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVEN9ga-tUppni4CcCYlEgAAAQ8"]
[Sun Dec 28 19:01:10.795687 2025] [:error] [pid 42292:tid 42311] [client 20.89.211.3:8147] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVEN9pyOrM_vaFx1osY9nQAAAA8"]
[Sun Dec 28 19:01:11.122654 2025] [:error] [pid 42378:tid 42388] [client 20.89.211.3:17106] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVEN9zgtcN-KHAjWrX8MVwAAAMg"]
[Sun Dec 28 19:01:11.394138 2025] [:error] [pid 42378:tid 42389] [client 20.89.211.3:8159] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVEN9zgtcN-KHAjWrX8MWQAAAMk"]
[Sun Dec 28 19:01:11.664005 2025] [:error] [pid 42378:tid 42380] [client 20.89.211.3:17033] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aVEN9zgtcN-KHAjWrX8MWwAAAMA"]
[Sun Dec 28 19:01:11.949653 2025] [:error] [pid 42378:tid 42396] [client 20.89.211.3:17053] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aVEN9zgtcN-KHAjWrX8MXQAAANA"]
[Sun Dec 28 19:01:12.296698 2025] [:error] [pid 29437:tid 29476] [client 20.89.211.3:17088] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aVEN-BhDotAbVk6pZLezpAAAAco"]
[Sun Dec 28 19:01:12.610708 2025] [:error] [pid 42293:tid 42324] [client 20.89.211.3:8191] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aVEN-Mvc9B-5cwN385LVgwAAAEE"]
[Sun Dec 28 19:01:12.930444 2025] [:error] [pid 42292:tid 42310] [client 20.89.211.3:8068] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aVEN-JyOrM_vaFx1osY9qQAAAA4"]
[Sun Dec 28 19:01:13.253483 2025] [:error] [pid 42293:tid 42330] [client 20.89.211.3:8153] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aVEN-cvc9B-5cwN385LVhAAAAEc"]
[Sun Dec 28 19:01:13.558384 2025] [:error] [pid 42293:tid 42344] [client 20.89.211.3:17128] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aVEN-cvc9B-5cwN385LVhgAAAFU"]
[Sun Dec 28 19:01:13.872757 2025] [:error] [pid 29436:tid 29461] [client 20.89.211.3:17107] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aVEN-bchzOOtNL9VPNLaIgAAAZY"]
[Sun Dec 28 19:01:14.186162 2025] [:error] [pid 42293:tid 42323] [client 20.89.211.3:17115] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aVEN-svc9B-5cwN385LVjQAAAEA"]
[Sun Dec 28 19:01:14.524334 2025] [:error] [pid 29388:tid 29420] [client 20.89.211.3:17090] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aVEN-toLv2L2zI_SpdXQrgAAAVg"]
[Sun Dec 28 19:01:14.816364 2025] [:error] [pid 43789:tid 43798] [client 20.89.211.3:17041] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aVEN-ga-tUppni4CcCYlGAAAAQc"]
[Sun Dec 28 19:01:15.123564 2025] [:error] [pid 43789:tid 43799] [client 20.89.211.3:17044] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aVEN-wa-tUppni4CcCYlGgAAAQg"]
[Sun Dec 28 19:01:15.437002 2025] [:error] [pid 42378:tid 42384] [client 20.89.211.3:8097] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aVEN-zgtcN-KHAjWrX8MYQAAAMQ"]
[Sun Dec 28 19:01:15.768162 2025] [:error] [pid 43789:tid 43812] [client 20.89.211.3:17038] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aVEN-wa-tUppni4CcCYlHwAAARU"]
[Sun Dec 28 19:01:16.053762 2025] [:error] [pid 42292:tid 42306] [client 20.89.211.3:8075] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aVEN_JyOrM_vaFx1osY9sQAAAAo"]
[Sun Dec 28 19:01:16.332759 2025] [:error] [pid 43789:tid 43794] [client 20.89.211.3:8178] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aVEN_Aa-tUppni4CcCYlIgAAAQM"]
[Sun Dec 28 19:01:16.633851 2025] [:error] [pid 29388:tid 29418] [client 20.89.211.3:8189] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "aVEN_NoLv2L2zI_SpdXQtQAAAVY"]
[Sun Dec 28 19:01:16.927760 2025] [:error] [pid 29388:tid 29397] [client 20.89.211.3:17119] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "aVEN_NoLv2L2zI_SpdXQtwAAAUE"]
[Sun Dec 28 19:01:17.228905 2025] [:error] [pid 42378:tid 42391] [client 20.89.211.3:8007] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "aVEN_TgtcN-KHAjWrX8MYgAAAMs"]
[Sun Dec 28 19:01:17.540096 2025] [:error] [pid 42292:tid 42307] [client 20.89.211.3:8173] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "aVEN_ZyOrM_vaFx1osY9swAAAAs"]
[Sun Dec 28 19:01:17.856080 2025] [:error] [pid 43789:tid 43815] [client 20.89.211.3:17120] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aVEN_Qa-tUppni4CcCYlJwAAARg"]
[Sun Dec 28 19:01:18.172169 2025] [:error] [pid 29388:tid 29406] [client 20.89.211.3:8152] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aVEN_toLv2L2zI_SpdXQwgAAAUo"]
[Sun Dec 28 19:01:18.503341 2025] [:error] [pid 43789:tid 43807] [client 20.89.211.3:17130] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aVEN_ga-tUppni4CcCYlKAAAARA"]
[Sun Dec 28 19:01:18.810132 2025] [:error] [pid 29388:tid 29416] [client 20.89.211.3:8149] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aVEN_toLv2L2zI_SpdXQygAAAVQ"]
[Sun Dec 28 19:01:19.127520 2025] [:error] [pid 42292:tid 42308] [client 20.89.211.3:17110] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aVEN_5yOrM_vaFx1osY9tQAAAAw"]
[Sun Dec 28 19:01:19.480035 2025] [:error] [pid 29437:tid 29488] [client 20.89.211.3:8137] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aVEN_xhDotAbVk6pZLezpwAAAdY"]
[Sun Dec 28 19:01:19.793782 2025] [:error] [pid 42292:tid 42300] [client 20.89.211.3:8165] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aVEN_5yOrM_vaFx1osY9twAAAAQ"]
[Sun Dec 28 19:01:20.128495 2025] [:error] [pid 42292:tid 42317] [client 20.89.211.3:8140] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aVEOAJyOrM_vaFx1osY9uQAAABU"]
[Sun Dec 28 19:01:20.462028 2025] [:error] [pid 42292:tid 42310] [client 20.89.211.3:8164] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/juuuu.php"] [unique_id "aVEOAJyOrM_vaFx1osY9vQAAAA4"]
[Sun Dec 28 19:01:20.743709 2025] [:error] [pid 42292:tid 42304] [client 20.89.211.3:8185] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/juuuu.php"] [unique_id "aVEOAJyOrM_vaFx1osY9vgAAAAg"]
[Sun Dec 28 19:01:21.009769 2025] [:error] [pid 42378:tid 42383] [client 20.89.211.3:17030] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/juuuu.php"] [unique_id "aVEOATgtcN-KHAjWrX8MZgAAAMM"]
[Sun Dec 28 19:01:21.316917 2025] [:error] [pid 42378:tid 42390] [client 20.89.211.3:8093] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/juuuu.php"] [unique_id "aVEOATgtcN-KHAjWrX8MZwAAAMo"]
[Sun Dec 28 19:01:21.581316 2025] [:error] [pid 43789:tid 43812] [client 20.89.211.3:8187] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aVEOAQa-tUppni4CcCYlMAAAARU"]
[Sun Dec 28 19:01:21.876661 2025] [:error] [pid 42292:tid 42299] [client 20.89.211.3:8138] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aVEOAZyOrM_vaFx1osY9wgAAAAM"]
[Sun Dec 28 19:01:22.144514 2025] [:error] [pid 42378:tid 42382] [client 20.89.211.3:17045] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aVEOAjgtcN-KHAjWrX8MbAAAAMI"]
[Sun Dec 28 19:01:22.438016 2025] [:error] [pid 29436:tid 29455] [client 20.89.211.3:8160] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aVEOArchzOOtNL9VPNLaKQAAAZA"]
[Sun Dec 28 19:01:22.717759 2025] [:error] [pid 42378:tid 42385] [client 20.89.211.3:8150] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aVEOAjgtcN-KHAjWrX8MbgAAAMU"]
[Sun Dec 28 19:01:23.006930 2025] [:error] [pid 42294:tid 42362] [client 20.89.211.3:8112] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aVEOA9TE5kYcYCOzl9GyJgAAAIw"]
[Sun Dec 28 19:01:23.254950 2025] [:error] [pid 29436:tid 29441] [client 20.89.211.3:17068] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aVEOA7chzOOtNL9VPNLaLQAAAYI"]
[Sun Dec 28 19:01:23.494517 2025] [:error] [pid 42293:tid 42344] [client 20.89.211.3:8103] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aVEOA8vc9B-5cwN385LVlwAAAFU"]
[Sun Dec 28 19:01:23.753865 2025] [:error] [pid 42293:tid 42346] [client 20.89.211.3:17066] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aVEOA8vc9B-5cwN385LVmQAAAFc"]
[Sun Dec 28 19:01:24.029149 2025] [:error] [pid 43789:tid 43810] [client 20.89.211.3:8163] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aVEOBAa-tUppni4CcCYlNAAAARM"]
[Sun Dec 28 19:01:24.294499 2025] [:error] [pid 43789:tid 43795] [client 20.89.211.3:17062] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aVEOBAa-tUppni4CcCYlNQAAAQQ"]
[Sun Dec 28 19:01:24.616946 2025] [:error] [pid 42294:tid 42368] [client 20.89.211.3:8139] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aVEOBNTE5kYcYCOzl9GyKQAAAJI"]
[Sun Dec 28 19:01:24.870092 2025] [:error] [pid 42293:tid 42332] [client 20.89.211.3:8134] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aVEOBMvc9B-5cwN385LVnwAAAEk"]
[Sun Dec 28 19:01:25.153253 2025] [:error] [pid 42293:tid 42326] [client 20.89.211.3:8072] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aVEOBcvc9B-5cwN385LVogAAAEM"]
[Sun Dec 28 19:01:25.425610 2025] [:error] [pid 42293:tid 42339] [client 20.89.211.3:17114] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aVEOBcvc9B-5cwN385LVpQAAAFA"]
[Sun Dec 28 19:01:25.715196 2025] [:error] [pid 42378:tid 42400] [client 20.89.211.3:8022] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aVEOBTgtcN-KHAjWrX8McQAAANQ"]
[Sun Dec 28 19:01:26.015719 2025] [:error] [pid 42292:tid 42309] [client 20.89.211.3:8158] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/about.php"] [unique_id "aVEOBpyOrM_vaFx1osY9xgAAAA0"]
[Sun Dec 28 19:01:26.305763 2025] [:error] [pid 42292:tid 42316] [client 20.89.211.3:8104] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/about.php"] [unique_id "aVEOBpyOrM_vaFx1osY9yQAAABQ"]
[Sun Dec 28 19:01:26.604260 2025] [:error] [pid 29437:tid 29466] [client 20.89.211.3:17067] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/about.php"] [unique_id "aVEOBhhDotAbVk6pZLezrQAAAcA"]
[Sun Dec 28 19:01:26.934209 2025] [:error] [pid 29436:tid 29459] [client 20.89.211.3:8133] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/about.php"] [unique_id "aVEOBrchzOOtNL9VPNLaLwAAAZQ"]
[Sun Dec 28 19:01:27.300838 2025] [:error] [pid 43789:tid 43798] [client 20.89.211.3:17135] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "aVEOBwa-tUppni4CcCYlOQAAAQc"]
[Sun Dec 28 19:01:27.633669 2025] [:error] [pid 42294:tid 42363] [client 20.89.211.3:8181] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "aVEOB9TE5kYcYCOzl9GyLgAAAI0"]
[Sun Dec 28 19:01:27.998815 2025] [:error] [pid 42378:tid 42392] [client 20.89.211.3:8169] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "aVEOBzgtcN-KHAjWrX8MdgAAAMw"]
[Sun Dec 28 19:01:28.289451 2025] [:error] [pid 29436:tid 29460] [client 20.89.211.3:17040] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "aVEOCLchzOOtNL9VPNLaMgAAAZU"]
[Sun Dec 28 19:01:28.548082 2025] [:error] [pid 42378:tid 42398] [client 20.89.211.3:8183] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/04.php"] [unique_id "aVEOCDgtcN-KHAjWrX8MeAAAANI"]
[Sun Dec 28 19:01:28.831962 2025] [:error] [pid 42378:tid 42404] [client 20.89.211.3:8141] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/04.php"] [unique_id "aVEOCDgtcN-KHAjWrX8MfQAAANg"]
[Sun Dec 28 19:01:29.113263 2025] [:error] [pid 42292:tid 42313] [client 20.89.211.3:8117] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/04.php"] [unique_id "aVEOCZyOrM_vaFx1osY92AAAABE"]
[Sun Dec 28 19:01:29.387184 2025] [:error] [pid 43789:tid 43799] [client 20.89.211.3:8170] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/04.php"] [unique_id "aVEOCQa-tUppni4CcCYlOgAAAQg"]
[Sun Dec 28 19:01:29.647684 2025] [:error] [pid 42292:tid 42313] [client 20.89.211.3:17094] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aVEOCZyOrM_vaFx1osY97QAAABE"]
[Sun Dec 28 19:01:29.940026 2025] [:error] [pid 42293:tid 42337] [client 20.89.211.3:8092] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aVEOCcvc9B-5cwN385LVrQAAAE4"]
[Sun Dec 28 19:01:30.236703 2025] [:error] [pid 42294:tid 42359] [client 20.89.211.3:8077] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aVEOCtTE5kYcYCOzl9GyRQAAAIk"]
[Sun Dec 28 19:01:30.529315 2025] [:error] [pid 43789:tid 43791] [client 20.89.211.3:17037] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aVEOCga-tUppni4CcCYlPgAAAQA"]
[Sun Dec 28 19:01:30.816782 2025] [:error] [pid 43789:tid 43792] [client 20.89.211.3:17065] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x56.php"] [unique_id "aVEOCga-tUppni4CcCYlPwAAAQE"]
[Sun Dec 28 19:01:31.129455 2025] [:error] [pid 42293:tid 42323] [client 20.89.211.3:8129] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x56.php"] [unique_id "aVEOC8vc9B-5cwN385LVsAAAAEA"]
[Sun Dec 28 19:01:31.417868 2025] [:error] [pid 42293:tid 42334] [client 20.89.211.3:17063] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x56.php"] [unique_id "aVEOC8vc9B-5cwN385LVsQAAAEs"]
[Sun Dec 28 19:01:31.705117 2025] [:error] [pid 43789:tid 43800] [client 20.89.211.3:17031] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x56.php"] [unique_id "aVEOCwa-tUppni4CcCYlQwAAAQk"]
[Sun Dec 28 19:01:31.956386 2025] [:error] [pid 43789:tid 43810] [client 20.89.211.3:8186] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/index.php"] [unique_id "aVEOCwa-tUppni4CcCYlRQAAARM"]
[Sun Dec 28 19:01:32.215810 2025] [:error] [pid 43789:tid 43805] [client 20.89.211.3:8136] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/index.php"] [unique_id "aVEODAa-tUppni4CcCYlSAAAAQ4"]
[Sun Dec 28 19:01:32.485604 2025] [:error] [pid 43789:tid 43815] [client 20.89.211.3:8087] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/index.php"] [unique_id "aVEODAa-tUppni4CcCYlTAAAARg"]
[Sun Dec 28 19:01:32.848808 2025] [:error] [pid 29436:tid 29457] [client 20.89.211.3:17064] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/index.php"] [unique_id "aVEODLchzOOtNL9VPNLaNgAAAZI"]
[Sun Dec 28 19:01:33.204430 2025] [:error] [pid 42378:tid 42384] [client 20.89.211.3:8086] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aVEODTgtcN-KHAjWrX8MswAAAMQ"]
[Sun Dec 28 19:01:33.542352 2025] [:error] [pid 43789:tid 43808] [client 20.89.211.3:8065] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aVEODQa-tUppni4CcCYlUQAAARE"]
[Sun Dec 28 19:01:33.866633 2025] [:error] [pid 29388:tid 29409] [client 20.89.211.3:17085] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aVEODdoLv2L2zI_SpdXQ2QAAAU0"]
[Sun Dec 28 19:01:34.194301 2025] [:error] [pid 29388:tid 29400] [client 20.89.211.3:8154] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aVEODtoLv2L2zI_SpdXQ2gAAAUQ"]
[Sun Dec 28 19:01:34.556491 2025] [:error] [pid 43789:tid 43811] [client 20.89.211.3:8151] [client 20.89.211.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aVEODga-tUppni4CcCYlUgAAARQ"]
[Sun Dec 28 19:01:34.834889 2025] [:error] [pid 42292:tid 42312] [client 20.89.211.3:8146] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aVEODpyOrM_vaFx1osY9-gAAABA"]
[Sun Dec 28 19:01:35.128097 2025] [:error] [pid 29437:tid 29472] [client 20.89.211.3:17102] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aVEODxhDotAbVk6pZLezswAAAcY"]
[Sun Dec 28 19:01:35.409445 2025] [:error] [pid 42292:tid 42305] [client 20.89.211.3:17076] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aVEOD5yOrM_vaFx1osY9_AAAAAk"]
[Sun Dec 28 19:01:35.733260 2025] [:error] [pid 42292:tid 42320] [client 20.89.211.3:8175] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aVEOD5yOrM_vaFx1osY9_gAAABg"]
[Sun Dec 28 19:01:36.021421 2025] [:error] [pid 29388:tid 29415] [client 20.89.211.3:8048] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aVEOENoLv2L2zI_SpdXQ3AAAAVM"]
[Sun Dec 28 19:01:36.284890 2025] [:error] [pid 29388:tid 29397] [client 20.89.211.3:8190] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aVEOENoLv2L2zI_SpdXQ3QAAAUE"]
[Sun Dec 28 19:01:36.588928 2025] [:error] [pid 29388:tid 29408] [client 20.89.211.3:17089] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aVEOENoLv2L2zI_SpdXQ4AAAAUw"]
[Sun Dec 28 19:01:36.901927 2025] [:error] [pid 29388:tid 29420] [client 20.89.211.3:8174] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aVEOENoLv2L2zI_SpdXQ5QAAAVg"]
[Sun Dec 28 19:01:37.176841 2025] [:error] [pid 29437:tid 29486] [client 20.89.211.3:8070] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aVEOERhDotAbVk6pZLeztwAAAdQ"]
[Sun Dec 28 19:01:37.424711 2025] [:error] [pid 42294:tid 42360] [client 20.89.211.3:8082] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aVEOEdTE5kYcYCOzl9GyTgAAAIo"]
[Sun Dec 28 19:01:37.752087 2025] [:error] [pid 29437:tid 29476] [client 20.89.211.3:8118] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aVEOERhDotAbVk6pZLezugAAAco"]
[Sun Dec 28 19:01:37.993503 2025] [:error] [pid 29436:tid 29454] [client 20.89.211.3:8096] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aVEOEbchzOOtNL9VPNLaOgAAAY8"]
[Sun Dec 28 19:01:38.255884 2025] [:error] [pid 29437:tid 29488] [client 20.89.211.3:8176] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aVEOEhhDotAbVk6pZLezvgAAAdY"]
[Sun Dec 28 19:01:38.574208 2025] [:error] [pid 29388:tid 29414] [client 20.89.211.3:17125] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aVEOEtoLv2L2zI_SpdXQ6wAAAVI"]
[Sun Dec 28 19:01:38.916322 2025] [:error] [pid 29388:tid 29404] [client 20.89.211.3:8127] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aVEOEtoLv2L2zI_SpdXQ7AAAAUg"]
[Sun Dec 28 19:01:39.224940 2025] [:error] [pid 42294:tid 42350] [client 20.89.211.3:8079] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "aVEOE9TE5kYcYCOzl9GyUQAAAIA"]
[Sun Dec 28 19:01:39.550493 2025] [:error] [pid 29437:tid 29487] [client 20.89.211.3:8089] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "aVEOExhDotAbVk6pZLezvwAAAdU"]
[Sun Dec 28 19:01:39.827442 2025] [:error] [pid 43789:tid 43806] [client 20.89.211.3:17113] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "aVEOEwa-tUppni4CcCYlWAAAAQ8"]
[Sun Dec 28 19:01:40.127083 2025] [:error] [pid 42293:tid 42338] [client 20.89.211.3:17081] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "aVEOFMvc9B-5cwN385LVwAAAAE8"]
[Sun Dec 28 19:01:40.420919 2025] [:error] [pid 42293:tid 42323] [client 20.89.211.3:8155] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtz.php"] [unique_id "aVEOFMvc9B-5cwN385LVxAAAAEA"]
[Sun Dec 28 19:01:40.707052 2025] [:error] [pid 29436:tid 29450] [client 20.89.211.3:17056] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtz.php"] [unique_id "aVEOFLchzOOtNL9VPNLaPAAAAYs"]
[Sun Dec 28 19:01:41.005346 2025] [:error] [pid 29436:tid 29442] [client 20.89.211.3:8000] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtz.php"] [unique_id "aVEOFbchzOOtNL9VPNLaPgAAAYM"]
[Sun Dec 28 19:01:41.306500 2025] [:error] [pid 43789:tid 43808] [client 20.89.211.3:8037] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtz.php"] [unique_id "aVEOFQa-tUppni4CcCYlXQAAARE"]
[Sun Dec 28 19:01:41.635501 2025] [:error] [pid 42294:tid 42370] [client 20.89.211.3:8099] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aVEOFdTE5kYcYCOzl9GyVQAAAJQ"]
[Sun Dec 28 19:01:41.959826 2025] [:error] [pid 42293:tid 42331] [client 20.89.211.3:17121] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aVEOFcvc9B-5cwN385LVxQAAAEg"]
[Sun Dec 28 19:01:42.289070 2025] [:error] [pid 29436:tid 29448] [client 20.89.211.3:8069] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aVEOFrchzOOtNL9VPNLaQQAAAYk"]
[Sun Dec 28 19:01:42.619806 2025] [:error] [pid 42294:tid 42356] [client 20.89.211.3:8090] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aVEOFtTE5kYcYCOzl9GyXAAAAIY"]
[Sun Dec 28 19:01:42.943655 2025] [:error] [pid 29437:tid 29485] [client 20.89.211.3:8107] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aVEOFhhDotAbVk6pZLezxQAAAdM"]
[Sun Dec 28 19:01:43.293089 2025] [:error] [pid 29437:tid 29469] [client 20.89.211.3:8023] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aVEOFxhDotAbVk6pZLezxgAAAcM"]
[Sun Dec 28 19:01:43.626599 2025] [:error] [pid 29437:tid 29472] [client 20.89.211.3:8034] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aVEOFxhDotAbVk6pZLezyAAAAcY"]
[Sun Dec 28 19:01:43.920745 2025] [:error] [pid 43789:tid 43797] [client 20.89.211.3:17112] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aVEOFwa-tUppni4CcCYlYAAAAQY"]
[Sun Dec 28 19:01:53.567867 2025] [:error] [pid 42292:tid 42300] [client 20.89.211.3:8062] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aVEOIZyOrM_vaFx1osY-GAAAAAQ"]
[Sun Dec 28 19:01:53.849842 2025] [:error] [pid 42378:tid 42382] [client 20.89.211.3:8054] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aVEOITgtcN-KHAjWrX8M0wAAAMI"]
[Sun Dec 28 19:01:54.164109 2025] [:error] [pid 42293:tid 42329] [client 20.89.211.3:8128] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aVEOIsvc9B-5cwN385LV3AAAAEY"]
[Sun Dec 28 19:01:54.518292 2025] [:error] [pid 42293:tid 42347] [client 20.89.211.3:17095] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aVEOIsvc9B-5cwN385LV3QAAAFg"]
[Sun Dec 28 19:01:54.843378 2025] [:error] [pid 42378:tid 42396] [client 20.89.211.3:8066] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aVEOIjgtcN-KHAjWrX8M2QAAANA"]
[Sun Dec 28 19:01:55.119038 2025] [:error] [pid 42378:tid 42387] [client 20.89.211.3:8083] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aVEOIzgtcN-KHAjWrX8M2wAAAMc"]
[Sun Dec 28 19:01:55.404373 2025] [:error] [pid 29437:tid 29466] [client 20.89.211.3:8076] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aVEOIxhDotAbVk6pZLez1AAAAcA"]
[Sun Dec 28 19:01:55.684418 2025] [:error] [pid 42378:tid 42384] [client 20.89.211.3:8106] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aVEOIzgtcN-KHAjWrX8M3QAAAMQ"]
[Sun Dec 28 19:01:55.966472 2025] [:error] [pid 29436:tid 29458] [client 20.89.211.3:8124] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aVEOI7chzOOtNL9VPNLaWQAAAZM"]
[Sun Dec 28 19:01:56.247882 2025] [:error] [pid 29436:tid 29446] [client 20.89.211.3:8026] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aVEOJLchzOOtNL9VPNLaWgAAAYc"]
[Sun Dec 28 19:01:56.518328 2025] [:error] [pid 43789:tid 43799] [client 20.89.211.3:8157] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aVEOJAa-tUppni4CcCYlbQAAAQg"]
[Sun Dec 28 19:01:56.866300 2025] [:error] [pid 42378:tid 42399] [client 20.89.211.3:8094] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aVEOJDgtcN-KHAjWrX8M3wAAANM"]
[Sun Dec 28 19:01:57.170040 2025] [:error] [pid 42293:tid 42335] [client 20.89.211.3:8043] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aVEOJcvc9B-5cwN385LV5QAAAEw"]
[Sun Dec 28 19:01:57.442114 2025] [:error] [pid 42378:tid 42390] [client 20.89.211.3:8188] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aVEOJTgtcN-KHAjWrX8M4QAAAMo"]
[Sun Dec 28 19:01:57.735359 2025] [:error] [pid 29436:tid 29457] [client 20.89.211.3:8102] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aVEOJbchzOOtNL9VPNLaXAAAAZI"]
[Sun Dec 28 19:01:58.024121 2025] [:error] [pid 43789:tid 43794] [client 20.89.211.3:8170] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aVEOJga-tUppni4CcCYlcQAAAQM"]
[Sun Dec 28 19:01:58.291785 2025] [:error] [pid 42293:tid 42339] [client 20.89.211.3:8088] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xaz.php"] [unique_id "aVEOJsvc9B-5cwN385LV7QAAAFA"]
[Sun Dec 28 19:01:58.560007 2025] [:error] [pid 42378:tid 42404] [client 20.89.211.3:8143] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xaz.php"] [unique_id "aVEOJjgtcN-KHAjWrX8M4wAAANg"]
[Sun Dec 28 19:01:58.836013 2025] [:error] [pid 29388:tid 29411] [client 20.89.211.3:8071] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xaz.php"] [unique_id "aVEOJtoLv2L2zI_SpdXRDgAAAU8"]
[Sun Dec 28 19:01:59.121472 2025] [:error] [pid 42378:tid 42393] [client 20.89.211.3:8036] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xaz.php"] [unique_id "aVEOJzgtcN-KHAjWrX8M5gAAAM0"]
[Sun Dec 28 19:01:59.404565 2025] [:error] [pid 29388:tid 29400] [client 20.89.211.3:8130] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/autoload_classmap.php"] [unique_id "aVEOJ9oLv2L2zI_SpdXREQAAAUQ"]
[Sun Dec 28 19:01:59.717579 2025] [:error] [pid 42378:tid 42381] [client 20.89.211.3:8064] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/autoload_classmap.php"] [unique_id "aVEOJzgtcN-KHAjWrX8M6wAAAME"]
[Sun Dec 28 19:02:00.027573 2025] [:error] [pid 42378:tid 42401] [client 20.89.211.3:8110] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/autoload_classmap.php"] [unique_id "aVEOKDgtcN-KHAjWrX8M7QAAANU"]
[Sun Dec 28 19:02:00.321215 2025] [:error] [pid 43789:tid 43797] [client 20.89.211.3:8101] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/autoload_classmap.php"] [unique_id "aVEOKAa-tUppni4CcCYlcwAAAQY"]
[Sun Dec 28 19:02:00.649979 2025] [:error] [pid 42293:tid 42328] [client 20.89.211.3:8009] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aVEOKMvc9B-5cwN385LV8gAAAEU"]
[Sun Dec 28 19:02:00.943788 2025] [:error] [pid 29388:tid 29417] [client 20.89.211.3:8029] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aVEOKNoLv2L2zI_SpdXRGQAAAVU"]
[Sun Dec 28 19:02:01.238523 2025] [:error] [pid 29388:tid 29401] [client 20.89.211.3:8105] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aVEOKdoLv2L2zI_SpdXRGgAAAUU"]
[Sun Dec 28 19:02:01.537144 2025] [:error] [pid 29437:tid 29472] [client 20.89.211.3:8080] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aVEOKRhDotAbVk6pZLez2gAAAcY"]
[Sun Dec 28 19:02:01.829219 2025] [:error] [pid 42293:tid 42327] [client 20.89.211.3:8013] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x50.php"] [unique_id "aVEOKcvc9B-5cwN385LV9QAAAEQ"]
[Sun Dec 28 19:02:02.125243 2025] [:error] [pid 29436:tid 29439] [client 20.89.211.3:17134] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x50.php"] [unique_id "aVEOKrchzOOtNL9VPNLaZQAAAYA"]
[Sun Dec 28 19:02:02.437488 2025] [:error] [pid 42378:tid 42383] [client 20.89.211.3:8108] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x50.php"] [unique_id "aVEOKjgtcN-KHAjWrX8M9QAAAMM"]
[Sun Dec 28 19:02:02.781987 2025] [:error] [pid 29388:tid 29411] [client 20.89.211.3:8033] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x50.php"] [unique_id "aVEOKtoLv2L2zI_SpdXRHQAAAU8"]
[Sun Dec 28 19:02:03.102469 2025] [:error] [pid 29388:tid 29400] [client 20.89.211.3:7957] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aVEOK9oLv2L2zI_SpdXRIAAAAUQ"]
[Sun Dec 28 19:02:03.401114 2025] [:error] [pid 29388:tid 29418] [client 20.89.211.3:7885] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aVEOK9oLv2L2zI_SpdXRIQAAAVY"]
[Sun Dec 28 19:02:03.673544 2025] [:error] [pid 29388:tid 29404] [client 20.89.211.3:8028] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aVEOK9oLv2L2zI_SpdXRJAAAAUg"]
[Sun Dec 28 19:02:03.944496 2025] [:error] [pid 43789:tid 43799] [client 20.89.211.3:8008] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aVEOKwa-tUppni4CcCYlggAAAQg"]
[Sun Dec 28 19:02:04.254096 2025] [:error] [pid 42378:tid 42382] [client 20.89.211.3:8001] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aVEOLDgtcN-KHAjWrX8M-AAAAMI"]
[Sun Dec 28 19:02:04.547278 2025] [:error] [pid 42293:tid 42339] [client 20.89.211.3:8109] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aVEOLMvc9B-5cwN385LWAQAAAFA"]
[Sun Dec 28 19:02:04.881221 2025] [:error] [pid 29388:tid 29419] [client 20.89.211.3:8184] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aVEOLNoLv2L2zI_SpdXRLAAAAVc"]
[Sun Dec 28 19:02:05.226402 2025] [:error] [pid 29436:tid 29450] [client 20.89.211.3:8006] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aVEOLbchzOOtNL9VPNLadwAAAYs"]
[Sun Dec 28 19:02:05.578505 2025] [:error] [pid 29388:tid 29418] [client 20.89.211.3:17124] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aVEOLdoLv2L2zI_SpdXROAAAAVY"]
[Sun Dec 28 19:02:05.896015 2025] [:error] [pid 42378:tid 42391] [client 20.89.211.3:8017] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aVEOLTgtcN-KHAjWrX8NAAAAAMs"]
[Sun Dec 28 19:02:06.221585 2025] [:error] [pid 42378:tid 42398] [client 20.89.211.3:17061] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aVEOLjgtcN-KHAjWrX8NAQAAANI"]
[Sun Dec 28 19:02:06.557005 2025] [:error] [pid 29437:tid 29489] [client 20.89.211.3:8044] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aVEOLhhDotAbVk6pZLez3gAAAdc"]
[Sun Dec 28 19:02:06.876761 2025] [:error] [pid 42378:tid 42383] [client 20.89.211.3:8085] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aVEOLjgtcN-KHAjWrX8NBAAAAMM"]
[Sun Dec 28 19:02:07.218802 2025] [:error] [pid 42292:tid 42301] [client 20.89.211.3:17059] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aVEOL5yOrM_vaFx1osY-HQAAAAU"]
[Sun Dec 28 19:02:07.531479 2025] [:error] [pid 42378:tid 42388] [client 20.89.211.3:8067] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aVEOLzgtcN-KHAjWrX8NBwAAAMg"]
[Sun Dec 28 19:02:07.847897 2025] [:error] [pid 42378:tid 42397] [client 20.89.211.3:8142] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aVEOLzgtcN-KHAjWrX8NCQAAANE"]
[Sun Dec 28 19:02:08.146075 2025] [:error] [pid 29388:tid 29409] [client 20.89.211.3:8144] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/m.php"] [unique_id "aVEOMNoLv2L2zI_SpdXRRgAAAU0"]
[Sun Dec 28 19:02:08.455072 2025] [:error] [pid 43789:tid 43798] [client 20.89.211.3:8024] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/m.php"] [unique_id "aVEOMAa-tUppni4CcCYllwAAAQc"]
[Sun Dec 28 19:02:08.756535 2025] [:error] [pid 29436:tid 29453] [client 20.89.211.3:7956] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/m.php"] [unique_id "aVEOMLchzOOtNL9VPNLahQAAAY4"]
[Sun Dec 28 19:02:09.081894 2025] [:error] [pid 42293:tid 42334] [client 20.89.211.3:8025] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/m.php"] [unique_id "aVEOMcvc9B-5cwN385LWGQAAAEs"]
[Sun Dec 28 19:02:09.402066 2025] [:error] [pid 29437:tid 29466] [client 20.89.211.3:8116] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aVEOMRhDotAbVk6pZLez5QAAAcA"]
[Sun Dec 28 19:02:09.734871 2025] [:error] [pid 29437:tid 29490] [client 20.89.211.3:8073] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aVEOMRhDotAbVk6pZLez5gAAAdg"]
[Sun Dec 28 19:02:10.051776 2025] [:error] [pid 42292:tid 42307] [client 20.89.211.3:17058] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aVEOMpyOrM_vaFx1osY-IwAAAAs"]
[Sun Dec 28 19:02:10.440616 2025] [:error] [pid 42292:tid 42318] [client 20.89.211.3:8059] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aVEOMpyOrM_vaFx1osY-JAAAABY"]
[Sun Dec 28 19:02:10.743468 2025] [:error] [pid 42293:tid 42335] [client 20.89.211.3:8005] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aVEOMsvc9B-5cwN385LWJgAAAEw"]
[Sun Dec 28 19:02:11.091944 2025] [:error] [pid 42294:tid 42373] [client 20.89.211.3:8057] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aVEOM9TE5kYcYCOzl9GygwAAAJc"]
[Sun Dec 28 19:02:11.431632 2025] [:error] [pid 43789:tid 43801] [client 20.89.211.3:8171] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aVEOMwa-tUppni4CcCYlpQAAAQo"]
[Sun Dec 28 19:02:11.735634 2025] [:error] [pid 42292:tid 42315] [client 20.89.211.3:7977] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aVEOM5yOrM_vaFx1osY-JwAAABM"]
[Sun Dec 28 19:02:12.066114 2025] [:error] [pid 42378:tid 42396] [client 20.89.211.3:8020] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aVEONDgtcN-KHAjWrX8NDQAAANA"]
[Sun Dec 28 19:02:12.381279 2025] [:error] [pid 42378:tid 42389] [client 20.89.211.3:7878] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aVEONDgtcN-KHAjWrX8NDwAAAMk"]
[Sun Dec 28 19:02:12.765879 2025] [:error] [pid 29437:tid 29480] [client 20.89.211.3:7976] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aVEONBhDotAbVk6pZLez9wAAAc4"]
[Sun Dec 28 19:02:13.092273 2025] [:error] [pid 42293:tid 42337] [client 20.89.211.3:8035] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aVEONcvc9B-5cwN385LWLgAAAE4"]
[Sun Dec 28 19:02:13.422216 2025] [:error] [pid 29436:tid 29454] [client 20.89.211.3:8115] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aVEONbchzOOtNL9VPNLapQAAAY8"]
[Sun Dec 28 19:02:13.780533 2025] [:error] [pid 42293:tid 42336] [client 20.89.211.3:17080] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aVEONcvc9B-5cwN385LWMwAAAE0"]
[Sun Dec 28 19:02:14.111324 2025] [:error] [pid 43789:tid 43811] [client 20.89.211.3:7959] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aVEONga-tUppni4CcCYlsAAAARQ"]
[Sun Dec 28 19:02:14.438774 2025] [:error] [pid 42293:tid 42323] [client 20.89.211.3:8114] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aVEONsvc9B-5cwN385LWOAAAAEA"]
[Sun Dec 28 19:02:14.762308 2025] [:error] [pid 42294:tid 42368] [client 20.89.211.3:8011] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/log.php"] [unique_id "aVEONtTE5kYcYCOzl9GyjgAAAJI"]
[Sun Dec 28 19:02:15.080782 2025] [:error] [pid 42378:tid 42394] [client 20.89.211.3:7958] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/log.php"] [unique_id "aVEONzgtcN-KHAjWrX8NEQAAAM4"]
[Sun Dec 28 19:02:15.384792 2025] [:error] [pid 43789:tid 43814] [client 20.89.211.3:8041] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/log.php"] [unique_id "aVEONwa-tUppni4CcCYltwAAARc"]
[Sun Dec 28 19:02:15.660510 2025] [:error] [pid 29437:tid 29469] [client 20.89.211.3:8002] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/log.php"] [unique_id "aVEONxhDotAbVk6pZLez_QAAAcM"]
[Sun Dec 28 19:02:15.949150 2025] [:error] [pid 29436:tid 29444] [client 20.89.211.3:8055] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gtc.php"] [unique_id "aVEON7chzOOtNL9VPNLavwAAAYU"]
[Sun Dec 28 19:02:16.232623 2025] [:error] [pid 43789:tid 43793] [client 20.89.211.3:8061] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gtc.php"] [unique_id "aVEOOAa-tUppni4CcCYluwAAAQI"]
[Sun Dec 28 19:02:16.515631 2025] [:error] [pid 42292:tid 42305] [client 20.89.211.3:7936] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gtc.php"] [unique_id "aVEOOJyOrM_vaFx1osY-MAAAAAk"]
[Sun Dec 28 19:02:16.806619 2025] [:error] [pid 42293:tid 42331] [client 20.89.211.3:8156] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gtc.php"] [unique_id "aVEOOMvc9B-5cwN385LWRAAAAEg"]
[Sun Dec 28 19:02:17.101634 2025] [:error] [pid 43789:tid 43801] [client 20.89.211.3:8120] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1aa.php"] [unique_id "aVEOOQa-tUppni4CcCYlvgAAAQo"]
[Sun Dec 28 19:02:17.400589 2025] [:error] [pid 42294:tid 42372] [client 20.89.211.3:17057] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1aa.php"] [unique_id "aVEOOdTE5kYcYCOzl9GylwAAAJY"]
[Sun Dec 28 19:02:17.686632 2025] [:error] [pid 42294:tid 42361] [client 20.89.211.3:8047] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1aa.php"] [unique_id "aVEOOdTE5kYcYCOzl9GymgAAAIs"]
[Sun Dec 28 19:02:18.090439 2025] [:error] [pid 42378:tid 42388] [client 20.89.211.3:7883] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1aa.php"] [unique_id "aVEOOjgtcN-KHAjWrX8NGAAAAMg"]
[Sun Dec 28 19:02:18.387087 2025] [:error] [pid 29437:tid 29475] [client 20.89.211.3:8098] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aVEOOhhDotAbVk6pZLe0AgAAAck"]
[Sun Dec 28 19:02:18.670078 2025] [:error] [pid 42294:tid 42360] [client 20.89.211.3:8177] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aVEOOtTE5kYcYCOzl9GynAAAAIo"]
[Sun Dec 28 19:02:18.977269 2025] [:error] [pid 29436:tid 29461] [client 20.89.211.3:8049] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aVEOOrchzOOtNL9VPNLaxQAAAZY"]
[Sun Dec 28 19:02:19.300004 2025] [:error] [pid 42293:tid 42338] [client 20.89.211.3:8117] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aVEOO8vc9B-5cwN385LWRgAAAE8"]
[Sun Dec 28 19:02:19.588201 2025] [:error] [pid 29437:tid 29478] [client 20.89.211.3:8113] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aVEOOxhDotAbVk6pZLe0BgAAAcw"]
[Sun Dec 28 19:02:19.881615 2025] [:error] [pid 42294:tid 42374] [client 20.89.211.3:8012] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aVEOO9TE5kYcYCOzl9GynwAAAJg"]
[Sun Dec 28 19:02:20.254145 2025] [:error] [pid 29436:tid 29463] [client 20.89.211.3:8015] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aVEOPLchzOOtNL9VPNLayQAAAZg"]
[Sun Dec 28 19:02:20.568480 2025] [:error] [pid 29388:tid 29405] [client 20.89.211.3:8084] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aVEOPNoLv2L2zI_SpdXRgQAAAUk"]
[Sun Dec 28 19:02:20.854439 2025] [:error] [pid 42293:tid 42326] [client 20.89.211.3:8078] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "aVEOPMvc9B-5cwN385LWSgAAAEM"]
[Sun Dec 28 19:02:21.192412 2025] [:error] [pid 42294:tid 42371] [client 20.89.211.3:8095] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "aVEOPdTE5kYcYCOzl9GypQAAAJU"]
[Sun Dec 28 19:02:21.501520 2025] [:error] [pid 29388:tid 29411] [client 20.89.211.3:8063] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "aVEOPdoLv2L2zI_SpdXRgwAAAU8"]
[Sun Dec 28 19:02:21.835848 2025] [:error] [pid 42378:tid 42390] [client 20.89.211.3:7872] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "aVEOPTgtcN-KHAjWrX8NHAAAAMo"]
[Sun Dec 28 19:02:22.146777 2025] [:error] [pid 29388:tid 29417] [client 20.89.211.3:8014] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bibil.php"] [unique_id "aVEOPtoLv2L2zI_SpdXRhgAAAVU"]
[Sun Dec 28 19:02:22.538294 2025] [:error] [pid 42294:tid 42373] [client 20.89.211.3:7991] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bibil.php"] [unique_id "aVEOPtTE5kYcYCOzl9GypwAAAJc"]
[Sun Dec 28 19:02:22.829491 2025] [:error] [pid 29437:tid 29481] [client 20.89.211.3:8172] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bibil.php"] [unique_id "aVEOPhhDotAbVk6pZLe0DQAAAc8"]
[Sun Dec 28 19:02:23.175154 2025] [:error] [pid 43789:tid 43791] [client 20.89.211.3:8004] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bibil.php"] [unique_id "aVEOPwa-tUppni4CcCYl2gAAAQA"]
[Sun Dec 28 19:02:23.511107 2025] [:error] [pid 43789:tid 43794] [client 20.89.211.3:7973] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aVEOPwa-tUppni4CcCYl2wAAAQM"]
[Sun Dec 28 19:02:23.855914 2025] [:error] [pid 29436:tid 29446] [client 20.89.211.3:8018] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aVEOP7chzOOtNL9VPNLa1AAAAYc"]
[Sun Dec 28 19:02:24.184445 2025] [:error] [pid 29388:tid 29403] [client 20.89.211.3:7962] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aVEOQNoLv2L2zI_SpdXRjQAAAUc"]
[Sun Dec 28 19:02:24.520358 2025] [:error] [pid 42378:tid 42401] [client 20.89.211.3:7995] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aVEOQDgtcN-KHAjWrX8NIwAAANU"]
[Sun Dec 28 19:02:24.833371 2025] [:error] [pid 42378:tid 42381] [client 20.89.211.3:8016] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aVEOQDgtcN-KHAjWrX8NJQAAAME"]
[Sun Dec 28 19:02:25.167466 2025] [:error] [pid 29437:tid 29476] [client 20.89.211.3:7986] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aVEOQRhDotAbVk6pZLe0FgAAAco"]
[Sun Dec 28 19:02:25.504189 2025] [:error] [pid 42292:tid 42296] [client 20.89.211.3:7979] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aVEOQZyOrM_vaFx1osY-QAAAAAA"]
[Sun Dec 28 19:02:25.848895 2025] [:error] [pid 42293:tid 42331] [client 20.89.211.3:7998] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aVEOQcvc9B-5cwN385LWVAAAAEg"]
[Sun Dec 28 19:02:26.167517 2025] [:error] [pid 29388:tid 29398] [client 20.89.211.3:7916] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aVEOQtoLv2L2zI_SpdXRjwAAAUI"]
[Sun Dec 28 19:02:26.422184 2025] [:error] [pid 29388:tid 29419] [client 20.89.211.3:8119] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aVEOQtoLv2L2zI_SpdXRkgAAAVc"]
[Sun Dec 28 19:02:26.747783 2025] [:error] [pid 29436:tid 29461] [client 20.89.211.3:8091] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aVEOQrchzOOtNL9VPNLa2AAAAZY"]
[Sun Dec 28 19:02:27.027145 2025] [:error] [pid 29437:tid 29480] [client 20.89.211.3:8003] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aVEOQxhDotAbVk6pZLe0HAAAAc4"]
[Sun Dec 28 19:02:27.316677 2025] [:error] [pid 29436:tid 29442] [client 20.89.211.3:8122] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aVEOQ7chzOOtNL9VPNLa3gAAAYM"]
[Sun Dec 28 19:02:27.590333 2025] [:error] [pid 29437:tid 29488] [client 20.89.211.3:17077] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aVEOQxhDotAbVk6pZLe0HgAAAdY"]
[Sun Dec 28 19:02:27.877194 2025] [:error] [pid 43789:tid 43793] [client 20.89.211.3:7943] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aVEOQwa-tUppni4CcCYl4AAAAQI"]
[Sun Dec 28 19:02:28.135818 2025] [:error] [pid 42292:tid 42303] [client 20.89.211.3:8081] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aVEORJyOrM_vaFx1osY-SQAAAAc"]
[Sun Dec 28 19:02:28.432171 2025] [:error] [pid 43789:tid 43813] [client 20.89.211.3:7941] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aVEORAa-tUppni4CcCYl4wAAARY"]
[Sun Dec 28 19:02:28.697034 2025] [:error] [pid 42294:tid 42370] [client 20.89.211.3:7913] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aVEORNTE5kYcYCOzl9GytgAAAJQ"]
[Sun Dec 28 19:02:28.968439 2025] [:error] [pid 43789:tid 43797] [client 20.89.211.3:7921] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aVEORAa-tUppni4CcCYl5wAAAQY"]
[Sun Dec 28 19:02:29.258329 2025] [:error] [pid 29436:tid 29444] [client 20.89.211.3:7984] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aVEORbchzOOtNL9VPNLa4wAAAYU"]
[Sun Dec 28 19:02:29.530427 2025] [:error] [pid 42293:tid 42330] [client 20.89.211.3:8056] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/colors/blue/index.php"] [unique_id "aVEORcvc9B-5cwN385LWZAAAAEc"]
[Sun Dec 28 19:02:29.873448 2025] [:error] [pid 29436:tid 29446] [client 20.89.211.3:7907] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/colors/blue/index.php"] [unique_id "aVEORbchzOOtNL9VPNLa5gAAAYc"]
[Sun Dec 28 19:02:30.188702 2025] [:error] [pid 42292:tid 42304] [client 20.89.211.3:7989] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/colors/blue/index.php"] [unique_id "aVEORpyOrM_vaFx1osY-TgAAAAg"]
[Sun Dec 28 19:02:30.523713 2025] [:error] [pid 42378:tid 42398] [client 20.89.211.3:8038] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/colors/blue/index.php"] [unique_id "aVEORjgtcN-KHAjWrX8NKQAAANI"]
[Sun Dec 28 19:02:30.812027 2025] [:error] [pid 29437:tid 29484] [client 20.89.211.3:8058] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "aVEORhhDotAbVk6pZLe0IgAAAdI"]
[Sun Dec 28 19:02:31.097637 2025] [:error] [pid 42293:tid 42334] [client 20.89.211.3:7946] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "aVEOR8vc9B-5cwN385LWZwAAAEs"]
[Sun Dec 28 19:02:31.377955 2025] [:error] [pid 29437:tid 29469] [client 20.89.211.3:7947] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "aVEORxhDotAbVk6pZLe0JgAAAcM"]
[Sun Dec 28 19:02:31.700965 2025] [:error] [pid 42293:tid 42345] [client 20.89.211.3:8039] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "aVEOR8vc9B-5cwN385LWagAAAFY"]
[Sun Dec 28 19:02:31.975605 2025] [:error] [pid 43789:tid 43815] [client 20.89.211.3:7944] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aVEORwa-tUppni4CcCYl9gAAARg"]
[Sun Dec 28 19:02:32.240944 2025] [:error] [pid 29436:tid 29445] [client 20.89.211.3:8126] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aVEOSLchzOOtNL9VPNLa7gAAAYY"]
[Sun Dec 28 19:02:32.528481 2025] [:error] [pid 43789:tid 43791] [client 20.89.211.3:7966] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aVEOSAa-tUppni4CcCYl_gAAAQA"]
[Sun Dec 28 19:02:32.848465 2025] [:error] [pid 43789:tid 43793] [client 20.89.211.3:7953] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aVEOSAa-tUppni4CcCYmAwAAAQI"]
[Sun Dec 28 19:02:33.185683 2025] [:error] [pid 29436:tid 29448] [client 20.89.211.3:8010] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aVEOSbchzOOtNL9VPNLa8AAAAYk"]
[Sun Dec 28 19:02:33.494208 2025] [:error] [pid 29436:tid 29462] [client 20.89.211.3:7981] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aVEOSbchzOOtNL9VPNLa9AAAAZc"]
[Sun Dec 28 19:02:33.791333 2025] [:error] [pid 43789:tid 43808] [client 20.89.211.3:8052] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aVEOSQa-tUppni4CcCYmDAAAARE"]
[Sun Dec 28 19:02:34.107843 2025] [:error] [pid 42294:tid 42373] [client 20.89.211.3:7889] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aVEOStTE5kYcYCOzl9GyvAAAAJc"]
[Sun Dec 28 19:02:34.388419 2025] [:error] [pid 29388:tid 29416] [client 20.89.211.3:8074] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aVEOStoLv2L2zI_SpdXRkwAAAVQ"]
[Sun Dec 28 19:02:34.671316 2025] [:error] [pid 29388:tid 29409] [client 20.89.211.3:8027] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aVEOStoLv2L2zI_SpdXRlQAAAU0"]
[Sun Dec 28 19:02:34.946084 2025] [:error] [pid 29436:tid 29459] [client 20.89.211.3:7894] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aVEOSrchzOOtNL9VPNLa_AAAAZQ"]
[Sun Dec 28 19:02:35.257491 2025] [:error] [pid 29388:tid 29405] [client 20.89.211.3:7939] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aVEOS9oLv2L2zI_SpdXRmAAAAUk"]
[Sun Dec 28 19:02:35.556869 2025] [:error] [pid 29388:tid 29407] [client 20.89.211.3:8040] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx1.php"] [unique_id "aVEOS9oLv2L2zI_SpdXRmgAAAUs"]
[Sun Dec 28 19:02:35.862834 2025] [:error] [pid 29388:tid 29400] [client 20.89.211.3:7906] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx1.php"] [unique_id "aVEOS9oLv2L2zI_SpdXRmwAAAUQ"]
[Sun Dec 28 19:02:36.156355 2025] [:error] [pid 42293:tid 42327] [client 20.89.211.3:7926] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx1.php"] [unique_id "aVEOTMvc9B-5cwN385LWawAAAEQ"]
[Sun Dec 28 19:02:36.435315 2025] [:error] [pid 29436:tid 29452] [client 20.89.211.3:8050] [client 20.89.211.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx1.php"] [unique_id "aVEOTLchzOOtNL9VPNLbAQAAAY0"]
[Sun Dec 28 19:28:56.467975 2025] [:error] [pid 29436:tid 29450] [client 103.1.187.190:57876] [client 103.1.187.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.1.187.190, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVEUeLchzOOtNL9VPNLjcwAAAYs"]
[Sun Dec 28 20:19:31.262471 2025] [:error] [pid 42293:tid 42329] [client 213.168.187.126:57922] [client 213.168.187.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.168.187.126, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVEgU8vc9B-5cwN385LtjwAAAEY"]
[Sun Dec 28 20:40:07.115771 2025] [:error] [pid 42378:tid 42388] [client 149.202.76.92:40122] [client 149.202.76.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.76.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVElJzgtcN-KHAjWrX8kNgAAAMg"]
[Sun Dec 28 21:02:49.020900 2025] [:error] [pid 29436:tid 29443] [client 51.91.13.83:41484] [client 51.91.13.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.91.13.83, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVEqebchzOOtNL9VPNIKIAAAAYQ"]
[Sun Dec 28 21:13:44.063423 2025] [:error] [pid 42378:tid 42397] [client 193.26.157.125:37478] [client 193.26.157.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.26.157.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVEtCDgtcN-KHAjWrX8tGgAAANE"]
[Sun Dec 28 21:14:41.719343 2025] [:error] [pid 29437:tid 29488] [client 109.70.148.45:41748] [client 109.70.148.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.70.148.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVEtQRhDotAbVk6pZLfZ1gAAAdY"]
[Sun Dec 28 21:29:24.282441 2025] [:error] [pid 43789:tid 43815] [client 35.185.127.84:14930] [client 35.185.127.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.185.127.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVEwtAa-tUppni4CcCZLaAAAARg"]
[Sun Dec 28 21:41:29.743981 2025] [:error] [pid 42378:tid 42404] [client 162.241.219.107:53262] [client 162.241.219.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.219.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVEziTgtcN-KHAjWrX80WAAAANg"]
[Sun Dec 28 21:53:04.866629 2025] [:error] [pid 29437:tid 29474] [client 88.99.148.122:60538] [client 88.99.148.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.99.148.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVE2QBhDotAbVk6pZLfjFwAAAcg"]
[Sun Dec 28 22:02:22.280496 2025] [:error] [pid 29388:tid 29419] [client 34.138.63.246:63835] [client 34.138.63.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.138.63.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVE4btoLv2L2zI_SpdUESgAAAVc"]
[Sun Dec 28 22:02:24.577725 2025] [:error] [pid 29388:tid 29398] [client 34.138.63.246:63835] [client 34.138.63.246] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aVE4cNoLv2L2zI_SpdUETgAAAUI"]
[Sun Dec 28 22:02:24.839489 2025] [:error] [pid 29388:tid 29415] [client 34.138.63.246:63835] [client 34.138.63.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.138.63.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVE4cNoLv2L2zI_SpdUETwAAAVM"]
[Sun Dec 28 22:02:26.478734 2025] [:error] [pid 29436:tid 29440] [client 34.138.63.246:56871] [client 34.138.63.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.138.63.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVE4crchzOOtNL9VPNIdNwAAAYE"]
[Sun Dec 28 22:02:28.073485 2025] [:error] [pid 29436:tid 29460] [client 34.138.63.246:63145] [client 34.138.63.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.138.63.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVE4dLchzOOtNL9VPNIdPAAAAZU"]
[Sun Dec 28 22:02:29.875646 2025] [:error] [pid 29437:tid 29473] [client 34.138.63.246:59499] [client 34.138.63.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.138.63.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVE4dRhDotAbVk6pZLflXwAAAcc"]
[Sun Dec 28 22:02:31.424924 2025] [:error] [pid 43789:tid 43808] [client 34.138.63.246:61957] [client 34.138.63.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.138.63.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVE4dwa-tUppni4CcCZTCwAAARE"]
[Sun Dec 28 22:02:31.425096 2025] [:error] [pid 43789:tid 43808] [client 34.138.63.246:61957] [client 34.138.63.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.138.63.246, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVE4dwa-tUppni4CcCZTCwAAARE"]
[Sun Dec 28 22:20:35.897641 2025] [autoindex:error] [pid 29388:tid 29407] [client 143.110.176.174:51391] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Dec 28 23:17:29.487412 2025] [:error] [pid 42378:tid 42395] [client 162.241.219.107:34892] [client 162.241.219.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.219.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVFKCTgtcN-KHAjWrX9CrgAAAM8"]
[Sun Dec 28 23:18:59.323304 2025] [:error] [pid 42294:tid 42359] [client 4.190.193.147:36969] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws29.php"] [unique_id "aVFKY9TE5kYcYCOzl9HlUAAAAIk"]
[Sun Dec 28 23:18:59.911224 2025] [:error] [pid 29436:tid 29463] [client 4.190.193.147:36944] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws29.php"] [unique_id "aVFKY7chzOOtNL9VPNItIwAAAZg"]
[Sun Dec 28 23:19:00.294892 2025] [:error] [pid 42378:tid 42400] [client 4.190.193.147:36975] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws29.php"] [unique_id "aVFKZDgtcN-KHAjWrX9C8wAAANQ"]
[Sun Dec 28 23:19:00.777504 2025] [:error] [pid 29436:tid 29455] [client 4.190.193.147:36928] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws29.php"] [unique_id "aVFKZLchzOOtNL9VPNItJgAAAZA"]
[Sun Dec 28 23:19:01.134300 2025] [:error] [pid 42378:tid 42389] [client 4.190.193.147:36880] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oo.php"] [unique_id "aVFKZTgtcN-KHAjWrX9C9AAAAMk"]
[Sun Dec 28 23:19:01.712387 2025] [:error] [pid 29388:tid 29417] [client 4.190.193.147:36889] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oo.php"] [unique_id "aVFKZdoLv2L2zI_SpdUZ2wAAAVU"]
[Sun Dec 28 23:19:02.209448 2025] [:error] [pid 29436:tid 29456] [client 4.190.193.147:36882] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oo.php"] [unique_id "aVFKZrchzOOtNL9VPNItJwAAAZE"]
[Sun Dec 28 23:19:02.640725 2025] [:error] [pid 29436:tid 29448] [client 4.190.193.147:36929] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oo.php"] [unique_id "aVFKZrchzOOtNL9VPNItKAAAAYk"]
[Sun Dec 28 23:19:03.098251 2025] [:error] [pid 42292:tid 42296] [client 4.190.193.147:36947] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s11.php"] [unique_id "aVFKZ5yOrM_vaFx1osZzYAAAAAA"]
[Sun Dec 28 23:19:03.617941 2025] [:error] [pid 42292:tid 42305] [client 4.190.193.147:36953] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s11.php"] [unique_id "aVFKZ5yOrM_vaFx1osZzYgAAAAk"]
[Sun Dec 28 23:19:04.108519 2025] [:error] [pid 29388:tid 29400] [client 4.190.193.147:36932] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s11.php"] [unique_id "aVFKaNoLv2L2zI_SpdUZ3QAAAUQ"]
[Sun Dec 28 23:19:04.552052 2025] [:error] [pid 42378:tid 42401] [client 4.190.193.147:36978] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s11.php"] [unique_id "aVFKaDgtcN-KHAjWrX9C9gAAANU"]
[Sun Dec 28 23:19:05.004450 2025] [:error] [pid 29437:tid 29468] [client 4.190.193.147:36991] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dir.php"] [unique_id "aVFKaRhDotAbVk6pZLfzOgAAAcI"]
[Sun Dec 28 23:19:05.358360 2025] [:error] [pid 42378:tid 42381] [client 4.190.193.147:36949] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dir.php"] [unique_id "aVFKaTgtcN-KHAjWrX9C9wAAAME"]
[Sun Dec 28 23:19:05.769536 2025] [:error] [pid 42292:tid 42300] [client 4.190.193.147:36876] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dir.php"] [unique_id "aVFKaZyOrM_vaFx1osZzZAAAAAQ"]
[Sun Dec 28 23:19:06.281184 2025] [:error] [pid 29437:tid 29481] [client 4.190.193.147:36967] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dir.php"] [unique_id "aVFKahhDotAbVk6pZLfzPgAAAc8"]
[Sun Dec 28 23:19:07.047340 2025] [:error] [pid 42378:tid 42387] [client 4.190.193.147:36946] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aqw.php"] [unique_id "aVFKazgtcN-KHAjWrX9C-QAAAMc"]
[Sun Dec 28 23:19:07.779353 2025] [:error] [pid 42292:tid 42312] [client 4.190.193.147:36894] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aqw.php"] [unique_id "aVFKa5yOrM_vaFx1osZzZwAAABA"]
[Sun Dec 28 23:19:08.177947 2025] [:error] [pid 42292:tid 42298] [client 4.190.193.147:36895] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aqw.php"] [unique_id "aVFKbJyOrM_vaFx1osZzaAAAAAI"]
[Sun Dec 28 23:19:08.671789 2025] [:error] [pid 42292:tid 42320] [client 4.190.193.147:36930] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aqw.php"] [unique_id "aVFKbJyOrM_vaFx1osZzaQAAABg"]
[Sun Dec 28 23:19:09.088793 2025] [:error] [pid 42294:tid 42367] [client 4.190.193.147:36979] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ca1.php"] [unique_id "aVFKbdTE5kYcYCOzl9HlVwAAAJE"]
[Sun Dec 28 23:19:09.555988 2025] [:error] [pid 42294:tid 42366] [client 4.190.193.147:36931] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ca1.php"] [unique_id "aVFKbdTE5kYcYCOzl9HlWAAAAJA"]
[Sun Dec 28 23:19:10.067676 2025] [:error] [pid 42294:tid 42362] [client 4.190.193.147:36965] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ca1.php"] [unique_id "aVFKbtTE5kYcYCOzl9HlWwAAAIw"]
[Sun Dec 28 23:19:10.494231 2025] [:error] [pid 42294:tid 42368] [client 4.190.193.147:36925] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ca1.php"] [unique_id "aVFKbtTE5kYcYCOzl9HlXgAAAJI"]
[Sun Dec 28 23:19:10.856955 2025] [:error] [pid 42292:tid 42311] [client 4.190.193.147:36984] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file51.php"] [unique_id "aVFKbpyOrM_vaFx1osZzagAAAA8"]
[Sun Dec 28 23:19:11.168369 2025] [:error] [pid 29437:tid 29472] [client 4.190.193.147:36885] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file51.php"] [unique_id "aVFKbxhDotAbVk6pZLfzQQAAAcY"]
[Sun Dec 28 23:19:11.628589 2025] [:error] [pid 42292:tid 42318] [client 4.190.193.147:36935] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file51.php"] [unique_id "aVFKb5yOrM_vaFx1osZzawAAABY"]
[Sun Dec 28 23:19:12.110249 2025] [:error] [pid 43789:tid 43815] [client 4.190.193.147:36957] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file51.php"] [unique_id "aVFKcAa-tUppni4CcCZeiQAAARg"]
[Sun Dec 28 23:19:12.619382 2025] [:error] [pid 42293:tid 42343] [client 4.190.193.147:36877] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abouta.php"] [unique_id "aVFKcMvc9B-5cwN385IX3gAAAFQ"]
[Sun Dec 28 23:19:12.987742 2025] [:error] [pid 42293:tid 42330] [client 4.190.193.147:36911] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abouta.php"] [unique_id "aVFKcMvc9B-5cwN385IX3wAAAEc"]
[Sun Dec 28 23:19:13.317410 2025] [:error] [pid 43789:tid 43793] [client 4.190.193.147:36883] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abouta.php"] [unique_id "aVFKcQa-tUppni4CcCZeigAAAQI"]
[Sun Dec 28 23:19:13.655014 2025] [:error] [pid 29388:tid 29398] [client 4.190.193.147:36948] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abouta.php"] [unique_id "aVFKcdoLv2L2zI_SpdUZ4QAAAUI"]
[Sun Dec 28 23:19:14.105080 2025] [:error] [pid 43789:tid 43808] [client 4.190.193.147:36942] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fclas.php"] [unique_id "aVFKcga-tUppni4CcCZejAAAARE"]
[Sun Dec 28 23:19:14.628337 2025] [:error] [pid 42294:tid 42351] [client 4.190.193.147:36977] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fclas.php"] [unique_id "aVFKctTE5kYcYCOzl9HlYAAAAIE"]
[Sun Dec 28 23:19:14.966407 2025] [:error] [pid 42293:tid 42342] [client 4.190.193.147:7128] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fclas.php"] [unique_id "aVFKcsvc9B-5cwN385IX4gAAAFM"]
[Sun Dec 28 23:19:15.477345 2025] [:error] [pid 43789:tid 43801] [client 4.190.193.147:36985] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fclas.php"] [unique_id "aVFKcwa-tUppni4CcCZejQAAAQo"]
[Sun Dec 28 23:19:15.892735 2025] [:error] [pid 42294:tid 42365] [client 4.190.193.147:36973] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/File.php"] [unique_id "aVFKc9TE5kYcYCOzl9HlYgAAAI8"]
[Sun Dec 28 23:19:16.393623 2025] [:error] [pid 43789:tid 43796] [client 4.190.193.147:36878] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/File.php"] [unique_id "aVFKdAa-tUppni4CcCZejgAAAQU"]
[Sun Dec 28 23:19:16.771243 2025] [:error] [pid 43789:tid 43812] [client 4.190.193.147:36927] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/File.php"] [unique_id "aVFKdAa-tUppni4CcCZekAAAARU"]
[Sun Dec 28 23:19:17.163599 2025] [:error] [pid 43789:tid 43805] [client 4.190.193.147:36892] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/File.php"] [unique_id "aVFKdQa-tUppni4CcCZekQAAAQ4"]
[Sun Dec 28 23:19:17.617484 2025] [:error] [pid 42294:tid 42369] [client 4.190.193.147:36939] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/all.php"] [unique_id "aVFKddTE5kYcYCOzl9HlZQAAAJM"]
[Sun Dec 28 23:19:18.061335 2025] [:error] [pid 29437:tid 29475] [client 4.190.193.147:36881] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/all.php"] [unique_id "aVFKdhhDotAbVk6pZLfzRgAAAck"]
[Sun Dec 28 23:19:18.440172 2025] [:error] [pid 42293:tid 42328] [client 4.190.193.147:36989] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/all.php"] [unique_id "aVFKdsvc9B-5cwN385IX4wAAAEU"]
[Sun Dec 28 23:19:18.913461 2025] [:error] [pid 42293:tid 42327] [client 4.190.193.147:36970] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/all.php"] [unique_id "aVFKdsvc9B-5cwN385IX5QAAAEQ"]
[Sun Dec 28 23:19:19.183085 2025] [:error] [pid 42293:tid 42335] [client 4.190.193.147:36872] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bbn.php"] [unique_id "aVFKd8vc9B-5cwN385IX5wAAAEw"]
[Sun Dec 28 23:19:19.465148 2025] [:error] [pid 42294:tid 42355] [client 4.190.193.147:36963] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bbn.php"] [unique_id "aVFKd9TE5kYcYCOzl9HlZwAAAIU"]
[Sun Dec 28 23:19:19.808498 2025] [:error] [pid 43789:tid 43792] [client 4.190.193.147:36867] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bbn.php"] [unique_id "aVFKdwa-tUppni4CcCZelQAAAQE"]
[Sun Dec 28 23:19:20.126619 2025] [:error] [pid 29388:tid 29420] [client 4.190.193.147:36987] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bbn.php"] [unique_id "aVFKeNoLv2L2zI_SpdUZ4wAAAVg"]
[Sun Dec 28 23:19:20.699174 2025] [:error] [pid 42378:tid 42391] [client 4.190.193.147:36891] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/berlin.php"] [unique_id "aVFKeDgtcN-KHAjWrX9C_gAAAMs"]
[Sun Dec 28 23:19:20.963035 2025] [:error] [pid 42378:tid 42399] [client 4.190.193.147:36988] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/berlin.php"] [unique_id "aVFKeDgtcN-KHAjWrX9C_wAAANM"]
[Sun Dec 28 23:19:21.414532 2025] [:error] [pid 29436:tid 29447] [client 4.190.193.147:36870] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/berlin.php"] [unique_id "aVFKebchzOOtNL9VPNItLQAAAYg"]
[Sun Dec 28 23:19:21.792385 2025] [:error] [pid 43789:tid 43810] [client 4.190.193.147:36896] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/berlin.php"] [unique_id "aVFKeQa-tUppni4CcCZemAAAARM"]
[Sun Dec 28 23:19:22.221614 2025] [:error] [pid 43789:tid 43815] [client 4.190.193.147:36962] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "aVFKega-tUppni4CcCZemgAAARg"]
[Sun Dec 28 23:19:22.681276 2025] [:error] [pid 43789:tid 43798] [client 4.190.193.147:7129] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "aVFKega-tUppni4CcCZemwAAAQc"]
[Sun Dec 28 23:19:23.208547 2025] [:error] [pid 42292:tid 42316] [client 4.190.193.147:36950] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "aVFKe5yOrM_vaFx1osZzbAAAABQ"]
[Sun Dec 28 23:19:23.585513 2025] [:error] [pid 42293:tid 42340] [client 4.190.193.147:36959] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "aVFKe8vc9B-5cwN385IX6gAAAFE"]
[Sun Dec 28 23:19:23.996889 2025] [:error] [pid 29437:tid 29479] [client 4.190.193.147:36884] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xz89.php"] [unique_id "aVFKexhDotAbVk6pZLfzSwAAAc0"]
[Sun Dec 28 23:19:24.323565 2025] [:error] [pid 42293:tid 42329] [client 4.190.193.147:36897] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xz89.php"] [unique_id "aVFKfMvc9B-5cwN385IX6wAAAEY"]
[Sun Dec 28 23:19:24.681487 2025] [:error] [pid 29436:tid 29443] [client 4.190.193.147:7125] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xz89.php"] [unique_id "aVFKfLchzOOtNL9VPNItMAAAAYQ"]
[Sun Dec 28 23:19:25.194051 2025] [:error] [pid 42294:tid 42359] [client 4.190.193.147:36890] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xz89.php"] [unique_id "aVFKfdTE5kYcYCOzl9HlawAAAIk"]
[Sun Dec 28 23:19:25.532508 2025] [:error] [pid 42293:tid 42332] [client 4.190.193.147:36910] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thai.php"] [unique_id "aVFKfcvc9B-5cwN385IX7AAAAEk"]
[Sun Dec 28 23:19:26.204889 2025] [:error] [pid 42292:tid 42313] [client 4.190.193.147:36923] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thai.php"] [unique_id "aVFKfpyOrM_vaFx1osZzbgAAABE"]
[Sun Dec 28 23:19:26.726216 2025] [:error] [pid 42293:tid 42337] [client 4.190.193.147:36980] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thai.php"] [unique_id "aVFKfsvc9B-5cwN385IX7gAAAE4"]
[Sun Dec 28 23:19:27.130593 2025] [:error] [pid 42378:tid 42393] [client 4.190.193.147:36960] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thai.php"] [unique_id "aVFKfzgtcN-KHAjWrX9DBgAAAM0"]
[Sun Dec 28 23:19:27.563726 2025] [:error] [pid 29436:tid 29455] [client 4.190.193.147:7118] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lopst.php"] [unique_id "aVFKf7chzOOtNL9VPNItNQAAAZA"]
[Sun Dec 28 23:19:27.959707 2025] [:error] [pid 42293:tid 42324] [client 4.190.193.147:7121] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lopst.php"] [unique_id "aVFKf8vc9B-5cwN385IX8AAAAEE"]
[Sun Dec 28 23:19:28.645276 2025] [:error] [pid 29436:tid 29445] [client 4.190.193.147:36888] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lopst.php"] [unique_id "aVFKgLchzOOtNL9VPNItNwAAAYY"]
[Sun Dec 28 23:19:29.107425 2025] [:error] [pid 29388:tid 29412] [client 4.190.193.147:7104] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lopst.php"] [unique_id "aVFKgdoLv2L2zI_SpdUZ5wAAAVA"]
[Sun Dec 28 23:19:29.571080 2025] [:error] [pid 29388:tid 29414] [client 4.190.193.147:36974] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wft.php"] [unique_id "aVFKgdoLv2L2zI_SpdUZ6QAAAVI"]
[Sun Dec 28 23:19:29.882261 2025] [:error] [pid 29388:tid 29407] [client 4.190.193.147:7139] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wft.php"] [unique_id "aVFKgdoLv2L2zI_SpdUZ6gAAAUs"]
[Sun Dec 28 23:19:30.407256 2025] [:error] [pid 29388:tid 29400] [client 4.190.193.147:36873] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wft.php"] [unique_id "aVFKgtoLv2L2zI_SpdUZ7QAAAUQ"]
[Sun Dec 28 23:19:30.764091 2025] [:error] [pid 29388:tid 29409] [client 4.190.193.147:36879] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wft.php"] [unique_id "aVFKgtoLv2L2zI_SpdUZ7wAAAU0"]
[Sun Dec 28 23:19:31.299233 2025] [:error] [pid 43789:tid 43801] [client 4.190.193.147:36952] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws28.php"] [unique_id "aVFKgwa-tUppni4CcCZepgAAAQo"]
[Sun Dec 28 23:19:31.582027 2025] [:error] [pid 29388:tid 29402] [client 4.190.193.147:36940] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws28.php"] [unique_id "aVFKg9oLv2L2zI_SpdUZ8AAAAUY"]
[Sun Dec 28 23:19:31.964836 2025] [:error] [pid 42293:tid 42338] [client 4.190.193.147:36941] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws28.php"] [unique_id "aVFKg8vc9B-5cwN385IX9QAAAE8"]
[Sun Dec 28 23:19:32.312520 2025] [:error] [pid 42293:tid 42333] [client 4.190.193.147:36906] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws28.php"] [unique_id "aVFKhMvc9B-5cwN385IX9gAAAEo"]
[Sun Dec 28 23:19:32.713120 2025] [:error] [pid 29388:tid 29398] [client 4.190.193.147:36986] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsvvs.php"] [unique_id "aVFKhNoLv2L2zI_SpdUZ8QAAAUI"]
[Sun Dec 28 23:19:33.107832 2025] [:error] [pid 29436:tid 29463] [client 4.190.193.147:36945] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsvvs.php"] [unique_id "aVFKhbchzOOtNL9VPNItOQAAAZg"]
[Sun Dec 28 23:19:33.408591 2025] [:error] [pid 42293:tid 42332] [client 4.190.193.147:36903] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsvvs.php"] [unique_id "aVFKhcvc9B-5cwN385IX-QAAAEk"]
[Sun Dec 28 23:19:33.741887 2025] [:error] [pid 29437:tid 29470] [client 4.190.193.147:36964] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsvvs.php"] [unique_id "aVFKhRhDotAbVk6pZLfzUQAAAcQ"]
[Sun Dec 28 23:19:34.067921 2025] [:error] [pid 29388:tid 29412] [client 4.190.193.147:7124] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vbbn.php"] [unique_id "aVFKhtoLv2L2zI_SpdUZ9AAAAVA"]
[Sun Dec 28 23:19:34.423025 2025] [:error] [pid 29388:tid 29404] [client 4.190.193.147:36921] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vbbn.php"] [unique_id "aVFKhtoLv2L2zI_SpdUZ9QAAAUg"]
[Sun Dec 28 23:19:34.760690 2025] [:error] [pid 42378:tid 42385] [client 4.190.193.147:36869] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vbbn.php"] [unique_id "aVFKhjgtcN-KHAjWrX9DBwAAAMU"]
[Sun Dec 28 23:19:35.053650 2025] [:error] [pid 42293:tid 42343] [client 4.190.193.147:36901] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vbbn.php"] [unique_id "aVFKh8vc9B-5cwN385IX-wAAAFQ"]
[Sun Dec 28 23:19:35.363068 2025] [:error] [pid 29437:tid 29467] [client 4.190.193.147:36982] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aVFKhxhDotAbVk6pZLfzVAAAAcE"]
[Sun Dec 28 23:19:35.803834 2025] [:error] [pid 42293:tid 42345] [client 4.190.193.147:7140] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aVFKh8vc9B-5cwN385IX_QAAAFY"]
[Sun Dec 28 23:19:36.243973 2025] [:error] [pid 42378:tid 42382] [client 4.190.193.147:7057] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aVFKiDgtcN-KHAjWrX9DCAAAAMI"]
[Sun Dec 28 23:19:36.763659 2025] [:error] [pid 29436:tid 29445] [client 4.190.193.147:36865] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aVFKiLchzOOtNL9VPNItPAAAAYY"]
[Sun Dec 28 23:19:37.137648 2025] [:error] [pid 42378:tid 42394] [client 4.190.193.147:36914] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fz.php"] [unique_id "aVFKiTgtcN-KHAjWrX9DCQAAAM4"]
[Sun Dec 28 23:19:37.541377 2025] [:error] [pid 42378:tid 42388] [client 4.190.193.147:36924] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fz.php"] [unique_id "aVFKiTgtcN-KHAjWrX9DCgAAAMg"]
[Sun Dec 28 23:19:37.862766 2025] [:error] [pid 29437:tid 29479] [client 4.190.193.147:36893] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fz.php"] [unique_id "aVFKiRhDotAbVk6pZLfzVgAAAc0"]
[Sun Dec 28 23:19:38.311659 2025] [:error] [pid 29437:tid 29473] [client 4.190.193.147:36874] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fz.php"] [unique_id "aVFKihhDotAbVk6pZLfzVwAAAcc"]
[Sun Dec 28 23:19:38.572852 2025] [:error] [pid 43789:tid 43814] [client 4.190.193.147:36918] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sang.php"] [unique_id "aVFKiga-tUppni4CcCZeqQAAARc"]
[Sun Dec 28 23:19:38.868667 2025] [:error] [pid 43789:tid 43806] [client 4.190.193.147:7165] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sang.php"] [unique_id "aVFKiga-tUppni4CcCZeqgAAAQ8"]
[Sun Dec 28 23:19:39.186448 2025] [:error] [pid 29436:tid 29458] [client 4.190.193.147:36887] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sang.php"] [unique_id "aVFKi7chzOOtNL9VPNItPgAAAZM"]
[Sun Dec 28 23:19:39.502194 2025] [:error] [pid 43789:tid 43807] [client 4.190.193.147:36955] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sang.php"] [unique_id "aVFKiwa-tUppni4CcCZerAAAARA"]
[Sun Dec 28 23:19:39.754607 2025] [:error] [pid 42378:tid 42403] [client 4.190.193.147:7114] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0o0.php"] [unique_id "aVFKizgtcN-KHAjWrX9DDAAAANc"]
[Sun Dec 28 23:19:40.212818 2025] [:error] [pid 42293:tid 42326] [client 4.190.193.147:36972] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0o0.php"] [unique_id "aVFKjMvc9B-5cwN385IX_wAAAEM"]
[Sun Dec 28 23:19:40.538234 2025] [:error] [pid 42293:tid 42341] [client 4.190.193.147:36981] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0o0.php"] [unique_id "aVFKjMvc9B-5cwN385IYAAAAAFI"]
[Sun Dec 28 23:19:40.803497 2025] [:error] [pid 42292:tid 42310] [client 4.190.193.147:7135] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0o0.php"] [unique_id "aVFKjJyOrM_vaFx1osZzcgAAAA4"]
[Sun Dec 28 23:19:41.214646 2025] [:error] [pid 42292:tid 42297] [client 4.190.193.147:36866] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aVFKjZyOrM_vaFx1osZzcwAAAAE"]
[Sun Dec 28 23:19:41.700949 2025] [:error] [pid 29437:tid 29478] [client 4.190.193.147:7115] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aVFKjRhDotAbVk6pZLfzWwAAAcw"]
[Sun Dec 28 23:19:42.041264 2025] [:error] [pid 29437:tid 29485] [client 4.190.193.147:7044] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aVFKjhhDotAbVk6pZLfzXQAAAdM"]
[Sun Dec 28 23:19:42.414417 2025] [:error] [pid 29437:tid 29476] [client 4.190.193.147:36904] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aVFKjhhDotAbVk6pZLfzYAAAAco"]
[Sun Dec 28 23:19:42.771996 2025] [:error] [pid 29437:tid 29481] [client 4.190.193.147:36868] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aVFKjhhDotAbVk6pZLfzYQAAAc8"]
[Sun Dec 28 23:19:43.350325 2025] [:error] [pid 42292:tid 42314] [client 4.190.193.147:7088] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aVFKj5yOrM_vaFx1osZzdQAAABI"]
[Sun Dec 28 23:19:43.740856 2025] [:error] [pid 42294:tid 42356] [client 4.190.193.147:7150] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aVFKj9TE5kYcYCOzl9HlcwAAAIY"]
[Sun Dec 28 23:19:44.171529 2025] [:error] [pid 42293:tid 42327] [client 4.190.193.147:36898] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aVFKkMvc9B-5cwN385IYAQAAAEQ"]
[Sun Dec 28 23:19:44.559401 2025] [:error] [pid 29436:tid 29459] [client 4.190.193.147:36966] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVFKkLchzOOtNL9VPNItQQAAAZQ"]
[Sun Dec 28 23:19:45.121539 2025] [:error] [pid 42292:tid 42312] [client 4.190.193.147:36922] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVFKkZyOrM_vaFx1osZzdwAAABA"]
[Sun Dec 28 23:19:45.567865 2025] [:error] [pid 42378:tid 42383] [client 4.190.193.147:36951] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVFKkTgtcN-KHAjWrX9DEgAAAMM"]
[Sun Dec 28 23:19:46.143061 2025] [:error] [pid 29388:tid 29409] [client 4.190.193.147:7132] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVFKktoLv2L2zI_SpdUZ_AAAAU0"]
[Sun Dec 28 23:19:46.602832 2025] [:error] [pid 42378:tid 42387] [client 4.190.193.147:7130] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aVFKkjgtcN-KHAjWrX9DFAAAAMc"]
[Sun Dec 28 23:19:46.901782 2025] [:error] [pid 42378:tid 42381] [client 4.190.193.147:7072] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aVFKkjgtcN-KHAjWrX9DFQAAAME"]
[Sun Dec 28 23:19:47.355811 2025] [:error] [pid 42378:tid 42380] [client 4.190.193.147:7109] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aVFKkzgtcN-KHAjWrX9DFgAAAMA"]
[Sun Dec 28 23:19:47.742363 2025] [:error] [pid 42294:tid 42373] [client 4.190.193.147:7046] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aVFKk9TE5kYcYCOzl9HldwAAAJc"]
[Sun Dec 28 23:19:48.200842 2025] [:error] [pid 42294:tid 42358] [client 4.190.193.147:7112] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aVFKlNTE5kYcYCOzl9HleQAAAIg"]
[Sun Dec 28 23:19:48.682651 2025] [:error] [pid 42378:tid 42385] [client 4.190.193.147:7142] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aVFKlDgtcN-KHAjWrX9DGAAAAMU"]
[Sun Dec 28 23:19:49.028782 2025] [:error] [pid 42294:tid 42364] [client 4.190.193.147:36943] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aVFKldTE5kYcYCOzl9HlfQAAAI4"]
[Sun Dec 28 23:19:49.448664 2025] [:error] [pid 42294:tid 42360] [client 4.190.193.147:7148] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aVFKldTE5kYcYCOzl9HlfwAAAIo"]
[Sun Dec 28 23:19:49.965294 2025] [:error] [pid 43789:tid 43813] [client 4.190.193.147:7106] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVFKlQa-tUppni4CcCZerQAAARY"]
[Sun Dec 28 23:19:50.252031 2025] [:error] [pid 42294:tid 42366] [client 4.190.193.147:7075] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVFKltTE5kYcYCOzl9HlgQAAAJA"]
[Sun Dec 28 23:19:50.559727 2025] [:error] [pid 42294:tid 42374] [client 4.190.193.147:36907] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVFKltTE5kYcYCOzl9HlggAAAJg"]
[Sun Dec 28 23:19:50.862981 2025] [:error] [pid 42292:tid 42320] [client 4.190.193.147:36886] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVFKlpyOrM_vaFx1osZzeAAAABg"]
[Sun Dec 28 23:19:51.278821 2025] [:error] [pid 29436:tid 29450] [client 4.190.193.147:7108] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/randkeyword.php"] [unique_id "aVFKl7chzOOtNL9VPNItQwAAAYs"]
[Sun Dec 28 23:19:51.731659 2025] [:error] [pid 29436:tid 29452] [client 4.190.193.147:7151] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/randkeyword.php"] [unique_id "aVFKl7chzOOtNL9VPNItRQAAAY0"]
[Sun Dec 28 23:19:52.060582 2025] [:error] [pid 29436:tid 29439] [client 4.190.193.147:7137] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/randkeyword.php"] [unique_id "aVFKmLchzOOtNL9VPNItRwAAAYA"]
[Sun Dec 28 23:19:52.413615 2025] [:error] [pid 29436:tid 29461] [client 4.190.193.147:7162] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/randkeyword.php"] [unique_id "aVFKmLchzOOtNL9VPNItSAAAAZY"]
[Sun Dec 28 23:19:52.677254 2025] [:error] [pid 42294:tid 42352] [client 4.190.193.147:7146] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fwe.php"] [unique_id "aVFKmNTE5kYcYCOzl9HliAAAAII"]
[Sun Dec 28 23:19:52.969824 2025] [:error] [pid 42294:tid 42360] [client 4.190.193.147:7157] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fwe.php"] [unique_id "aVFKmNTE5kYcYCOzl9HligAAAIo"]
[Sun Dec 28 23:19:53.296371 2025] [:error] [pid 42294:tid 42351] [client 4.190.193.147:7060] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fwe.php"] [unique_id "aVFKmdTE5kYcYCOzl9HliwAAAIE"]
[Sun Dec 28 23:19:53.613687 2025] [:error] [pid 42294:tid 42372] [client 4.190.193.147:36990] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fwe.php"] [unique_id "aVFKmdTE5kYcYCOzl9HljAAAAJY"]
[Sun Dec 28 23:19:54.043432 2025] [:error] [pid 43789:tid 43815] [client 4.190.193.147:7071] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aVFKmga-tUppni4CcCZesAAAARg"]
[Sun Dec 28 23:19:54.387254 2025] [:error] [pid 42292:tid 42315] [client 4.190.193.147:7131] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aVFKmpyOrM_vaFx1osZzegAAABM"]
[Sun Dec 28 23:19:55.137533 2025] [:error] [pid 43789:tid 43798] [client 4.190.193.147:36920] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aVFKmwa-tUppni4CcCZeswAAAQc"]
[Sun Dec 28 23:19:55.446122 2025] [:error] [pid 42293:tid 42338] [client 4.190.193.147:36966] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aVFKm8vc9B-5cwN385IYAwAAAE8"]
[Sun Dec 28 23:19:55.838954 2025] [:error] [pid 42292:tid 42313] [client 4.190.193.147:7138] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx1.php"] [unique_id "aVFKm5yOrM_vaFx1osZzfgAAABE"]
[Sun Dec 28 23:19:56.188714 2025] [:error] [pid 29388:tid 29416] [client 4.190.193.147:36936] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx1.php"] [unique_id "aVFKnNoLv2L2zI_SpdUaAgAAAVQ"]
[Sun Dec 28 23:19:56.556648 2025] [:error] [pid 42292:tid 42302] [client 4.190.193.147:7041] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx1.php"] [unique_id "aVFKnJyOrM_vaFx1osZzfwAAAAY"]
[Sun Dec 28 23:19:57.009862 2025] [:error] [pid 42293:tid 42347] [client 4.190.193.147:7153] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx1.php"] [unique_id "aVFKncvc9B-5cwN385IYBQAAAFg"]
[Sun Dec 28 23:19:57.341748 2025] [:error] [pid 29388:tid 29401] [client 4.190.193.147:36919] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aVFKndoLv2L2zI_SpdUaBgAAAUU"]
[Sun Dec 28 23:19:57.618002 2025] [:error] [pid 29388:tid 29399] [client 4.190.193.147:7163] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aVFKndoLv2L2zI_SpdUaBwAAAUM"]
[Sun Dec 28 23:20:06.145245 2025] [:error] [pid 42292:tid 42310] [client 4.190.193.147:7110] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aVFKppyOrM_vaFx1osZzlAAAAA4"]
[Sun Dec 28 23:20:06.553923 2025] [:error] [pid 29388:tid 29417] [client 4.190.193.147:7079] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aVFKptoLv2L2zI_SpdUaDgAAAVU"]
[Sun Dec 28 23:20:06.927818 2025] [:error] [pid 43789:tid 43808] [client 4.190.193.147:36875] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aVFKpga-tUppni4CcCZe0wAAARE"]
[Sun Dec 28 23:20:07.197207 2025] [:error] [pid 29388:tid 29401] [client 4.190.193.147:36900] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aVFKp9oLv2L2zI_SpdUaEQAAAUU"]
[Sun Dec 28 23:20:07.935083 2025] [:error] [pid 42293:tid 42334] [client 4.190.193.147:36933] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aVFKp8vc9B-5cwN385IYBgAAAEs"]
[Sun Dec 28 23:20:08.729920 2025] [:error] [pid 29388:tid 29409] [client 4.190.193.147:7042] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aVFKqNoLv2L2zI_SpdUaEgAAAU0"]
[Sun Dec 28 23:20:09.281091 2025] [:error] [pid 42293:tid 42331] [client 4.190.193.147:36983] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aVFKqcvc9B-5cwN385IYBwAAAEg"]
[Sun Dec 28 23:20:09.528239 2025] [:error] [pid 29388:tid 29399] [client 4.190.193.147:7134] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aVFKqdoLv2L2zI_SpdUaEwAAAUM"]
[Sun Dec 28 23:20:10.020887 2025] [:error] [pid 29437:tid 29473] [client 4.190.193.147:7045] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aVFKqhhDotAbVk6pZLfzZQAAAcc"]
[Sun Dec 28 23:20:10.629481 2025] [:error] [pid 29388:tid 29398] [client 4.190.193.147:36899] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aVFKqtoLv2L2zI_SpdUaFAAAAUI"]
[Sun Dec 28 23:20:11.091653 2025] [:error] [pid 29437:tid 29471] [client 4.190.193.147:36916] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aVFKqxhDotAbVk6pZLfzZgAAAcU"]
[Sun Dec 28 23:20:11.371196 2025] [:error] [pid 42293:tid 42337] [client 4.190.193.147:36913] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aVFKq8vc9B-5cwN385IYCwAAAE4"]
[Sun Dec 28 23:20:11.843818 2025] [:error] [pid 42378:tid 42397] [client 4.190.193.147:7086] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aVFKqzgtcN-KHAjWrX9DHgAAANE"]
[Sun Dec 28 23:20:12.304253 2025] [:error] [pid 42378:tid 42399] [client 4.190.193.147:7127] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aVFKrDgtcN-KHAjWrX9DHwAAANM"]
[Sun Dec 28 23:20:12.720251 2025] [:error] [pid 29437:tid 29485] [client 4.190.193.147:6986] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aVFKrBhDotAbVk6pZLfzaQAAAdM"]
[Sun Dec 28 23:20:13.032040 2025] [:error] [pid 29437:tid 29476] [client 4.190.193.147:7008] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aVFKrRhDotAbVk6pZLfzbQAAAco"]
[Sun Dec 28 23:20:13.416717 2025] [:error] [pid 29388:tid 29396] [client 4.190.193.147:36871] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aVFKrdoLv2L2zI_SpdUaFgAAAUA"]
[Sun Dec 28 23:20:13.808706 2025] [:error] [pid 42294:tid 42363] [client 4.190.193.147:7117] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aVFKrdTE5kYcYCOzl9HlkQAAAI0"]
[Sun Dec 28 23:20:14.295840 2025] [:error] [pid 29388:tid 29413] [client 4.190.193.147:7087] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aVFKrtoLv2L2zI_SpdUaGAAAAVE"]
[Sun Dec 28 23:20:14.987965 2025] [:error] [pid 29436:tid 29441] [client 4.190.193.147:7126] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aVFKrrchzOOtNL9VPNItUAAAAYI"]
[Sun Dec 28 23:20:15.414742 2025] [:error] [pid 29436:tid 29452] [client 4.190.193.147:7155] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aVFKr7chzOOtNL9VPNItUgAAAY0"]
[Sun Dec 28 23:20:15.787478 2025] [:error] [pid 42378:tid 42383] [client 4.190.193.147:6978] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aVFKrzgtcN-KHAjWrX9DIgAAAMM"]
[Sun Dec 28 23:20:16.294139 2025] [:error] [pid 42293:tid 42345] [client 4.190.193.147:7144] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aVFKsMvc9B-5cwN385IYDgAAAFY"]
[Sun Dec 28 23:20:16.705013 2025] [:error] [pid 42293:tid 42324] [client 4.190.193.147:7067] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aVFKsMvc9B-5cwN385IYEAAAAEE"]
[Sun Dec 28 23:20:17.054937 2025] [:error] [pid 29436:tid 29447] [client 4.190.193.147:6990] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aVFKsbchzOOtNL9VPNItVAAAAYg"]
[Sun Dec 28 23:20:17.444274 2025] [:error] [pid 42378:tid 42385] [client 4.190.193.147:36902] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aVFKsTgtcN-KHAjWrX9DJwAAAMU"]
[Sun Dec 28 23:20:18.075706 2025] [:error] [pid 42293:tid 42333] [client 4.190.193.147:36909] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aVFKssvc9B-5cwN385IYFAAAAEo"]
[Sun Dec 28 23:20:18.394148 2025] [:error] [pid 29437:tid 29469] [client 4.190.193.147:6912] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aVFKshhDotAbVk6pZLfzdAAAAcM"]
[Sun Dec 28 23:20:18.727084 2025] [:error] [pid 42294:tid 42364] [client 4.190.193.147:7122] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aVFKstTE5kYcYCOzl9HllgAAAI4"]
[Sun Dec 28 23:20:19.427208 2025] [:error] [pid 29388:tid 29412] [client 4.190.193.147:36908] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aVFKs9oLv2L2zI_SpdUaLQAAAVA"]
[Sun Dec 28 23:20:19.840064 2025] [:error] [pid 29437:tid 29471] [client 4.190.193.147:36956] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aVFKsxhDotAbVk6pZLfzdwAAAcU"]
[Sun Dec 28 23:20:20.191340 2025] [:error] [pid 29437:tid 29484] [client 4.190.193.147:7055] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aVFKtBhDotAbVk6pZLfzeAAAAdI"]
[Sun Dec 28 23:20:20.543224 2025] [:error] [pid 29437:tid 29480] [client 4.190.193.147:7050] [client 4.190.193.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aVFKtBhDotAbVk6pZLfzeQAAAc4"]
[Sun Dec 28 23:20:22.734037 2025] [:error] [pid 42378:tid 42397] [client 4.190.193.147:7116] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aVFKtjgtcN-KHAjWrX9DLgAAANE"]
[Sun Dec 28 23:20:23.110159 2025] [:error] [pid 29436:tid 29456] [client 4.190.193.147:7090] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aVFKt7chzOOtNL9VPNItVgAAAZE"]
[Sun Dec 28 23:20:23.656706 2025] [:error] [pid 29388:tid 29416] [client 4.190.193.147:7141] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aVFKt9oLv2L2zI_SpdUaRQAAAVQ"]
[Sun Dec 28 23:20:23.972491 2025] [:error] [pid 42292:tid 42313] [client 4.190.193.147:6987] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aVFKt5yOrM_vaFx1osZzngAAABE"]
[Sun Dec 28 23:20:24.346190 2025] [:error] [pid 29388:tid 29409] [client 4.190.193.147:7047] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aVFKuNoLv2L2zI_SpdUaSwAAAU0"]
[Sun Dec 28 23:20:24.685278 2025] [:error] [pid 29436:tid 29454] [client 4.190.193.147:7107] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aVFKuLchzOOtNL9VPNItWQAAAY8"]
[Sun Dec 28 23:20:25.117824 2025] [:error] [pid 29436:tid 29460] [client 4.190.193.147:7000] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aVFKubchzOOtNL9VPNItWgAAAZU"]
[Sun Dec 28 23:20:25.766311 2025] [:error] [pid 29437:tid 29478] [client 4.190.193.147:7068] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aVFKuRhDotAbVk6pZLfzfAAAAcw"]
[Sun Dec 28 23:20:26.034868 2025] [:error] [pid 29437:tid 29486] [client 4.190.193.147:7078] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aVFKuhhDotAbVk6pZLfzfQAAAdQ"]
[Sun Dec 28 23:20:26.594124 2025] [:error] [pid 42293:tid 42343] [client 4.190.193.147:7052] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aVFKusvc9B-5cwN385IYGQAAAFQ"]
[Sun Dec 28 23:20:27.199842 2025] [:error] [pid 29437:tid 29482] [client 4.190.193.147:7063] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aVFKuxhDotAbVk6pZLfzfgAAAdA"]
[Sun Dec 28 23:20:27.632188 2025] [:error] [pid 42293:tid 42345] [client 4.190.193.147:7152] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aVFKu8vc9B-5cwN385IYGgAAAFY"]
[Sun Dec 28 23:20:28.013614 2025] [:error] [pid 29388:tid 29408] [client 4.190.193.147:7002] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aVFKvNoLv2L2zI_SpdUaawAAAUw"]
[Sun Dec 28 23:20:28.435282 2025] [:error] [pid 42293:tid 42323] [client 4.190.193.147:7111] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aVFKvMvc9B-5cwN385IYGwAAAEA"]
[Sun Dec 28 23:20:28.823968 2025] [:error] [pid 29436:tid 29463] [client 4.190.193.147:36912] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aVFKvLchzOOtNL9VPNItYQAAAZg"]
[Sun Dec 28 23:20:29.163194 2025] [:error] [pid 42293:tid 42324] [client 4.190.193.147:6977] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aVFKvcvc9B-5cwN385IYHQAAAEE"]
[Sun Dec 28 23:20:29.660984 2025] [:error] [pid 43789:tid 43800] [client 4.190.193.147:7160] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aVFKvQa-tUppni4CcCZfLAAAAQk"]
[Sun Dec 28 23:20:30.126459 2025] [:error] [pid 43789:tid 43815] [client 4.190.193.147:7043] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aVFKvga-tUppni4CcCZfLQAAARg"]
[Sun Dec 28 23:20:30.527998 2025] [:error] [pid 42294:tid 42353] [client 4.190.193.147:7085] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aVFKvtTE5kYcYCOzl9HlmAAAAIM"]
[Sun Dec 28 23:20:30.908904 2025] [:error] [pid 29436:tid 29456] [client 4.190.193.147:7062] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aVFKvrchzOOtNL9VPNItYwAAAZE"]
[Sun Dec 28 23:20:31.492190 2025] [:error] [pid 43789:tid 43793] [client 4.190.193.147:36905] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aVFKvwa-tUppni4CcCZfMAAAAQI"]
[Sun Dec 28 23:20:31.942777 2025] [:error] [pid 29436:tid 29453] [client 4.190.193.147:7149] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aVFKv7chzOOtNL9VPNItZAAAAY4"]
[Sun Dec 28 23:20:32.747151 2025] [:error] [pid 42293:tid 42327] [client 4.190.193.147:7095] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aVFKwMvc9B-5cwN385IYIAAAAEQ"]
[Sun Dec 28 23:20:33.370818 2025] [:error] [pid 42293:tid 42333] [client 4.190.193.147:7061] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aVFKwcvc9B-5cwN385IYIQAAAEo"]
[Sun Dec 28 23:20:33.862497 2025] [:error] [pid 42293:tid 42339] [client 4.190.193.147:7158] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aVFKwcvc9B-5cwN385IYIgAAAFA"]
[Sun Dec 28 23:20:34.154216 2025] [:error] [pid 42293:tid 42340] [client 4.190.193.147:7010] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aVFKwsvc9B-5cwN385IYIwAAAFE"]
[Sun Dec 28 23:20:34.510535 2025] [:error] [pid 42294:tid 42370] [client 4.190.193.147:7070] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aVFKwtTE5kYcYCOzl9HlnQAAAJQ"]
[Sun Dec 28 23:20:34.895172 2025] [:error] [pid 42294:tid 42367] [client 4.190.193.147:7167] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVFKwtTE5kYcYCOzl9HlngAAAJE"]
[Sun Dec 28 23:20:35.402345 2025] [:error] [pid 29436:tid 29444] [client 4.190.193.147:36938] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVFKw7chzOOtNL9VPNItZwAAAYU"]
[Sun Dec 28 23:20:35.912519 2025] [:error] [pid 43789:tid 43805] [client 4.190.193.147:7083] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVFKwwa-tUppni4CcCZfMwAAAQ4"]
[Sun Dec 28 23:20:36.318527 2025] [:error] [pid 42293:tid 42334] [client 4.190.193.147:7093] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVFKxMvc9B-5cwN385IYJQAAAEs"]
[Sun Dec 28 23:20:36.903502 2025] [:error] [pid 43789:tid 43803] [client 4.190.193.147:7004] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aVFKxAa-tUppni4CcCZfNAAAAQw"]
[Sun Dec 28 23:20:37.478788 2025] [:error] [pid 29388:tid 29411] [client 4.190.193.147:36968] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aVFKxdoLv2L2zI_SpdUabwAAAU8"]
[Sun Dec 28 23:20:38.156419 2025] [:error] [pid 29437:tid 29469] [client 4.190.193.147:7113] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aVFKxhhDotAbVk6pZLfzgwAAAcM"]
[Sun Dec 28 23:20:38.513057 2025] [:error] [pid 42293:tid 42342] [client 4.190.193.147:6919] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aVFKxsvc9B-5cwN385IYKQAAAFM"]
[Sun Dec 28 23:20:39.054033 2025] [:error] [pid 42293:tid 42330] [client 4.190.193.147:6925] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aVFKx8vc9B-5cwN385IYKwAAAEc"]
[Sun Dec 28 23:20:39.939262 2025] [:error] [pid 42294:tid 42358] [client 4.190.193.147:7105] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aVFKx9TE5kYcYCOzl9HloQAAAIg"]
[Sun Dec 28 23:20:40.440065 2025] [:error] [pid 42378:tid 42386] [client 4.190.193.147:6968] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aVFKyDgtcN-KHAjWrX9DMAAAAMY"]
[Sun Dec 28 23:20:41.033256 2025] [:error] [pid 42378:tid 42404] [client 4.190.193.147:36958] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aVFKyTgtcN-KHAjWrX9DMQAAANg"]
[Sun Dec 28 23:20:42.096018 2025] [:error] [pid 29436:tid 29457] [client 4.190.193.147:7077] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aVFKyrchzOOtNL9VPNItawAAAZI"]
[Sun Dec 28 23:20:43.214927 2025] [:error] [pid 42292:tid 42296] [client 4.190.193.147:7092] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aVFKy5yOrM_vaFx1osZzrQAAAAA"]
[Sun Dec 28 23:20:43.579778 2025] [:error] [pid 43789:tid 43813] [client 4.190.193.147:7156] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aVFKywa-tUppni4CcCZfNwAAARY"]
[Sun Dec 28 23:20:44.089930 2025] [:error] [pid 42292:tid 42305] [client 4.190.193.147:7133] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aVFKzJyOrM_vaFx1osZzrgAAAAk"]
[Sun Dec 28 23:20:44.863564 2025] [:error] [pid 42378:tid 42396] [client 4.190.193.147:7154] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aVFKzDgtcN-KHAjWrX9DNgAAANA"]
[Sun Dec 28 23:20:45.663054 2025] [:error] [pid 43789:tid 43791] [client 4.190.193.147:6998] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aVFKzQa-tUppni4CcCZfOAAAAQA"]
[Sun Dec 28 23:20:46.267272 2025] [:error] [pid 42292:tid 42310] [client 4.190.193.147:6985] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aVFKzpyOrM_vaFx1osZzrwAAAA4"]
[Sun Dec 28 23:20:46.942479 2025] [:error] [pid 29436:tid 29453] [client 4.190.193.147:6999] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aVFKzrchzOOtNL9VPNItcQAAAY4"]
[Sun Dec 28 23:20:47.625977 2025] [:error] [pid 43789:tid 43798] [client 4.190.193.147:7009] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aVFKzwa-tUppni4CcCZfPAAAAQc"]
[Sun Dec 28 23:20:48.796535 2025] [:error] [pid 42293:tid 42328] [client 4.190.193.147:7056] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aVFK0Mvc9B-5cwN385IYLQAAAEU"]
[Sun Dec 28 23:20:49.512673 2025] [:error] [pid 42292:tid 42314] [client 4.190.193.147:6923] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aVFK0ZyOrM_vaFx1osZzsQAAABI"]
[Sun Dec 28 23:20:50.469202 2025] [:error] [pid 42294:tid 42365] [client 4.190.193.147:7036] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aVFK0tTE5kYcYCOzl9HlowAAAI8"]
[Sun Dec 28 23:20:51.176186 2025] [:error] [pid 43789:tid 43794] [client 4.190.193.147:7066] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about3.php"] [unique_id "aVFK0wa-tUppni4CcCZfQAAAAQM"]
[Sun Dec 28 23:20:51.641303 2025] [:error] [pid 42292:tid 42308] [client 4.190.193.147:7019] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about3.php"] [unique_id "aVFK05yOrM_vaFx1osZztQAAAAw"]
[Sun Dec 28 23:20:52.114134 2025] [:error] [pid 29388:tid 29409] [client 4.190.193.147:7048] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about3.php"] [unique_id "aVFK1NoLv2L2zI_SpdUacwAAAU0"]
[Sun Dec 28 23:20:52.833731 2025] [:error] [pid 42294:tid 42352] [client 4.190.193.147:6950] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about3.php"] [unique_id "aVFK1NTE5kYcYCOzl9HlpAAAAII"]
[Sun Dec 28 23:20:53.376490 2025] [:error] [pid 42292:tid 42304] [client 4.190.193.147:6991] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aVFK1ZyOrM_vaFx1osZzuAAAAAg"]
[Sun Dec 28 23:20:53.800259 2025] [:error] [pid 42292:tid 42313] [client 4.190.193.147:7145] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aVFK1ZyOrM_vaFx1osZzugAAABE"]
[Sun Dec 28 23:20:54.456553 2025] [:error] [pid 29436:tid 29459] [client 4.190.193.147:36954] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aVFK1rchzOOtNL9VPNItdQAAAZQ"]
[Sun Dec 28 23:20:54.917307 2025] [:error] [pid 43789:tid 43805] [client 4.190.193.147:6994] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "aVFK1ga-tUppni4CcCZfQQAAAQ4"]
[Sun Dec 28 23:20:55.432118 2025] [:error] [pid 43789:tid 43812] [client 4.190.193.147:7025] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aVFK1wa-tUppni4CcCZfQgAAARU"]
[Sun Dec 28 23:20:55.921289 2025] [:error] [pid 42293:tid 42339] [client 4.190.193.147:7161] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aVFK18vc9B-5cwN385IYMQAAAFA"]
[Sun Dec 28 23:20:56.304724 2025] [:error] [pid 42293:tid 42340] [client 4.190.193.147:7102] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aVFK2Mvc9B-5cwN385IYMgAAAFE"]
[Sun Dec 28 23:20:56.845856 2025] [:error] [pid 29436:tid 29457] [client 4.190.193.147:7029] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aVFK2LchzOOtNL9VPNIteAAAAZI"]
[Sun Dec 28 23:20:57.240762 2025] [:error] [pid 42292:tid 42296] [client 4.190.193.147:6944] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aVFK2ZyOrM_vaFx1osZzvQAAAAA"]
[Sun Dec 28 23:20:57.748121 2025] [:error] [pid 42378:tid 42397] [client 4.190.193.147:6872] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aVFK2TgtcN-KHAjWrX9DOwAAANE"]
[Sun Dec 28 23:20:58.289942 2025] [:error] [pid 42293:tid 42329] [client 4.190.193.147:7100] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aVFK2svc9B-5cwN385IYNQAAAEY"]
[Sun Dec 28 23:20:58.889477 2025] [:error] [pid 42378:tid 42386] [client 4.190.193.147:7101] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aVFK2jgtcN-KHAjWrX9DPgAAAMY"]
[Sun Dec 28 23:20:59.315885 2025] [:error] [pid 42378:tid 42401] [client 4.190.193.147:7007] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aVFK2zgtcN-KHAjWrX9DQAAAANU"]
[Sun Dec 28 23:20:59.769089 2025] [:error] [pid 29436:tid 29439] [client 4.190.193.147:7065] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aVFK27chzOOtNL9VPNItegAAAYA"]
[Sun Dec 28 23:21:00.276881 2025] [:error] [pid 29437:tid 29476] [client 4.190.193.147:7039] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aVFK3BhDotAbVk6pZLfziAAAAco"]
[Sun Dec 28 23:21:00.708889 2025] [:error] [pid 29437:tid 29483] [client 4.190.193.147:6989] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aVFK3BhDotAbVk6pZLfziQAAAdE"]
[Sun Dec 28 23:21:00.988321 2025] [:error] [pid 29437:tid 29486] [client 4.190.193.147:6983] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aVFK3BhDotAbVk6pZLfzigAAAdQ"]
[Sun Dec 28 23:21:01.396305 2025] [:error] [pid 42294:tid 42360] [client 4.190.193.147:7143] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aVFK3dTE5kYcYCOzl9HlpgAAAIo"]
[Sun Dec 28 23:21:01.729333 2025] [:error] [pid 42294:tid 42364] [client 4.190.193.147:6920] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aVFK3dTE5kYcYCOzl9HlpwAAAI4"]
[Sun Dec 28 23:21:02.165541 2025] [:error] [pid 42294:tid 42372] [client 4.190.193.147:6948] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aVFK3tTE5kYcYCOzl9HlqAAAAJY"]
[Sun Dec 28 23:21:02.541225 2025] [:error] [pid 42294:tid 42350] [client 4.190.193.147:36976] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aVFK3tTE5kYcYCOzl9HlqwAAAIA"]
[Sun Dec 28 23:21:03.139383 2025] [:error] [pid 29388:tid 29402] [client 4.190.193.147:6943] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aVFK39oLv2L2zI_SpdUaeQAAAUY"]
[Sun Dec 28 23:21:03.524069 2025] [:error] [pid 29437:tid 29468] [client 4.190.193.147:6984] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aVFK3xhDotAbVk6pZLfzjQAAAcI"]
[Sun Dec 28 23:21:04.074161 2025] [:error] [pid 29437:tid 29481] [client 4.190.193.147:6933] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aVFK4BhDotAbVk6pZLfzjgAAAc8"]
[Sun Dec 28 23:21:04.452495 2025] [:error] [pid 42292:tid 42297] [client 4.190.193.147:36917] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aVFK4JyOrM_vaFx1osZzwgAAAAE"]
[Sun Dec 28 23:21:04.907752 2025] [:error] [pid 42294:tid 42356] [client 4.190.193.147:7136] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aVFK4NTE5kYcYCOzl9HlrQAAAIY"]
[Sun Dec 28 23:21:13.065423 2025] [:error] [pid 42293:tid 42335] [client 4.190.193.147:36968] [client 4.190.193.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.190.193.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVFK6cvc9B-5cwN385IYOwAAAEw"]
[Sun Dec 28 23:21:13.720647 2025] [:error] [pid 29437:tid 29483] [client 4.190.193.147:7161] [client 4.190.193.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aVFK6RhDotAbVk6pZLfznAAAAdE"]
[Sun Dec 28 23:21:16.106690 2025] [:error] [pid 42293:tid 42324] [client 4.190.193.147:7027] [client 4.190.193.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aVFK7Mvc9B-5cwN385IYWwAAAEE"]
[Sun Dec 28 23:21:18.147126 2025] [autoindex:error] [pid 29388:tid 29402] [client 4.190.193.147:7159] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 28 23:21:18.297616 2025] [:error] [pid 29388:tid 29403] [client 4.190.193.147:7159] [client 4.190.193.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aVFK7toLv2L2zI_SpdUahgAAAUc"]
[Sun Dec 28 23:21:19.625663 2025] [:error] [pid 29388:tid 29419] [client 4.190.193.147:7013] [client 4.190.193.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aVFK79oLv2L2zI_SpdUaigAAAVc"]
[Sun Dec 28 23:21:21.502068 2025] [:error] [pid 29436:tid 29458] [client 4.190.193.147:6988] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aVFK8bchzOOtNL9VPNItigAAAZM"]
[Sun Dec 28 23:21:21.911429 2025] [:error] [pid 42378:tid 42398] [client 4.190.193.147:7091] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aVFK8TgtcN-KHAjWrX9DUAAAANI"]
[Sun Dec 28 23:21:22.227046 2025] [:error] [pid 42294:tid 42359] [client 4.190.193.147:7096] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aVFK8tTE5kYcYCOzl9HlvwAAAIk"]
[Sun Dec 28 23:21:22.503155 2025] [:error] [pid 29436:tid 29460] [client 4.190.193.147:36937] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aVFK8rchzOOtNL9VPNItjQAAAZU"]
[Sun Dec 28 23:21:22.951169 2025] [:error] [pid 42293:tid 42334] [client 4.190.193.147:7022] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aVFK8svc9B-5cwN385IYYAAAAEs"]
[Sun Dec 28 23:21:23.287844 2025] [:error] [pid 42292:tid 42311] [client 4.190.193.147:7053] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aVFK85yOrM_vaFx1osZzxwAAAA8"]
[Sun Dec 28 23:21:23.674413 2025] [:error] [pid 42293:tid 42342] [client 4.190.193.147:6970] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aVFK88vc9B-5cwN385IYYQAAAFM"]
[Sun Dec 28 23:21:23.928758 2025] [:error] [pid 42292:tid 42296] [client 4.190.193.147:7155] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aVFK85yOrM_vaFx1osZzygAAAAA"]
[Sun Dec 28 23:21:24.234026 2025] [:error] [pid 42293:tid 42344] [client 4.190.193.147:7119] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/colors/blue/index.php"] [unique_id "aVFK9Mvc9B-5cwN385IYYgAAAFU"]
[Sun Dec 28 23:21:24.540013 2025] [:error] [pid 42293:tid 42331] [client 4.190.193.147:6980] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/colors/blue/index.php"] [unique_id "aVFK9Mvc9B-5cwN385IYYwAAAEg"]
[Sun Dec 28 23:21:24.978441 2025] [:error] [pid 29388:tid 29416] [client 4.190.193.147:7058] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/colors/blue/index.php"] [unique_id "aVFK9NoLv2L2zI_SpdUajAAAAVQ"]
[Sun Dec 28 23:21:25.329505 2025] [:error] [pid 42294:tid 42373] [client 4.190.193.147:36926] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/colors/blue/index.php"] [unique_id "aVFK9dTE5kYcYCOzl9HlwQAAAJc"]
[Sun Dec 28 23:21:25.650796 2025] [:error] [pid 29388:tid 29409] [client 4.190.193.147:7005] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/security.php"] [unique_id "aVFK9doLv2L2zI_SpdUajQAAAU0"]
[Sun Dec 28 23:21:25.989131 2025] [:error] [pid 42378:tid 42382] [client 4.190.193.147:7033] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/security.php"] [unique_id "aVFK9TgtcN-KHAjWrX9DUwAAAMI"]
[Sun Dec 28 23:21:26.415147 2025] [:error] [pid 42378:tid 42393] [client 4.190.193.147:36934] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/security.php"] [unique_id "aVFK9jgtcN-KHAjWrX9DVQAAAM0"]
[Sun Dec 28 23:21:26.895805 2025] [:error] [pid 29436:tid 29462] [client 4.190.193.147:6995] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/security.php"] [unique_id "aVFK9rchzOOtNL9VPNItkAAAAZc"]
[Sun Dec 28 23:21:27.322632 2025] [:error] [pid 29388:tid 29410] [client 4.190.193.147:6916] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aVFK99oLv2L2zI_SpdUakAAAAU4"]
[Sun Dec 28 23:21:27.736916 2025] [:error] [pid 42293:tid 42323] [client 4.190.193.147:6881] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aVFK98vc9B-5cwN385IYZgAAAEA"]
[Sun Dec 28 23:21:28.122566 2025] [:error] [pid 29388:tid 29420] [client 4.190.193.147:7023] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aVFK-NoLv2L2zI_SpdUakQAAAVg"]
[Sun Dec 28 23:21:28.625094 2025] [:error] [pid 29388:tid 29418] [client 4.190.193.147:6955] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "aVFK-NoLv2L2zI_SpdUakgAAAVY"]
[Sun Dec 28 23:21:29.018564 2025] [:error] [pid 29388:tid 29402] [client 4.190.193.147:7073] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aVFK-doLv2L2zI_SpdUakwAAAUY"]
[Sun Dec 28 23:21:29.435005 2025] [:error] [pid 29388:tid 29403] [client 4.190.193.147:6979] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aVFK-doLv2L2zI_SpdUalgAAAUc"]
[Sun Dec 28 23:21:29.927679 2025] [:error] [pid 42293:tid 42326] [client 4.190.193.147:7024] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aVFK-cvc9B-5cwN385IYaQAAAEM"]
[Sun Dec 28 23:21:30.328232 2025] [:error] [pid 42293:tid 42332] [client 4.190.193.147:7103] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aVFK-svc9B-5cwN385IYawAAAEk"]
[Sun Dec 28 23:21:30.738236 2025] [:error] [pid 42292:tid 42316] [client 4.190.193.147:7020] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/about.php"] [unique_id "aVFK-pyOrM_vaFx1osZzzQAAABQ"]
[Sun Dec 28 23:21:31.109015 2025] [:error] [pid 29436:tid 29441] [client 4.190.193.147:36864] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/about.php"] [unique_id "aVFK-7chzOOtNL9VPNItkQAAAYI"]
[Sun Dec 28 23:21:31.500878 2025] [:error] [pid 42293:tid 42338] [client 4.190.193.147:7076] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/about.php"] [unique_id "aVFK-8vc9B-5cwN385IYbAAAAE8"]
[Sun Dec 28 23:21:31.828471 2025] [:error] [pid 29388:tid 29411] [client 4.190.193.147:7147] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/about.php"] [unique_id "aVFK-9oLv2L2zI_SpdUamQAAAU8"]
[Sun Dec 28 23:21:32.137001 2025] [:error] [pid 42292:tid 42308] [client 4.190.193.147:7080] [client 4.190.193.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aVFK_JyOrM_vaFx1osZz0QAAAAw"]
[Sun Dec 28 23:21:32.453166 2025] [:error] [pid 42293:tid 42327] [client 4.190.193.147:36915] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aVFK_Mvc9B-5cwN385IYbQAAAEQ"]
[Sun Dec 28 23:21:32.901850 2025] [:error] [pid 42293:tid 42341] [client 4.190.193.147:7031] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aVFK_Mvc9B-5cwN385IYbgAAAFI"]
[Sun Dec 28 23:21:33.272597 2025] [:error] [pid 42293:tid 42347] [client 4.190.193.147:7058] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aVFK_cvc9B-5cwN385IYbwAAAFg"]
[Sun Dec 28 23:21:33.557427 2025] [:error] [pid 42293:tid 42340] [client 4.190.193.147:7064] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aVFK_cvc9B-5cwN385IYcAAAAFE"]
[Sun Dec 28 23:21:33.856971 2025] [:error] [pid 42293:tid 42329] [client 4.190.193.147:7099] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aVFK_cvc9B-5cwN385IYcwAAAEY"]
[Sun Dec 28 23:21:34.342817 2025] [:error] [pid 42293:tid 42336] [client 4.190.193.147:6993] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aVFK_svc9B-5cwN385IYdgAAAE0"]
[Sun Dec 28 23:21:34.832519 2025] [:error] [pid 42292:tid 42299] [client 4.190.193.147:6941] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aVFK_pyOrM_vaFx1osZz1AAAAAM"]
[Sun Dec 28 23:21:35.120939 2025] [:error] [pid 42293:tid 42324] [client 4.190.193.147:7054] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aVFK_8vc9B-5cwN385IYeAAAAEE"]
[Sun Dec 28 23:21:35.428947 2025] [:error] [pid 42292:tid 42313] [client 4.190.193.147:6965] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/admin.php"] [unique_id "aVFK_5yOrM_vaFx1osZz1QAAABE"]
[Sun Dec 28 23:21:35.704021 2025] [:error] [pid 42292:tid 42319] [client 4.190.193.147:7084] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/admin.php"] [unique_id "aVFK_5yOrM_vaFx1osZz1gAAABc"]
[Sun Dec 28 23:21:36.113406 2025] [:error] [pid 43789:tid 43804] [client 4.190.193.147:6976] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/admin.php"] [unique_id "aVFLAAa-tUppni4CcCZfTwAAAQ0"]
[Sun Dec 28 23:21:36.426443 2025] [:error] [pid 29437:tid 29487] [client 4.190.193.147:6921] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/admin.php"] [unique_id "aVFLABhDotAbVk6pZLfzpQAAAdU"]
[Sun Dec 28 23:21:36.761250 2025] [:error] [pid 42294:tid 42352] [client 4.190.193.147:7049] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aVFLANTE5kYcYCOzl9HlwwAAAII"]
[Sun Dec 28 23:21:37.103739 2025] [:error] [pid 29437:tid 29480] [client 4.190.193.147:7081] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aVFLARhDotAbVk6pZLfzpgAAAc4"]
[Sun Dec 28 23:21:37.434170 2025] [:error] [pid 42293:tid 42335] [client 4.190.193.147:36961] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aVFLAcvc9B-5cwN385IYewAAAEw"]
[Sun Dec 28 23:21:37.752521 2025] [:error] [pid 29437:tid 29476] [client 4.190.193.147:6932] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aVFLARhDotAbVk6pZLfzpwAAAco"]
[Sun Dec 28 23:21:38.100995 2025] [:error] [pid 29437:tid 29486] [client 4.190.193.147:7051] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "aVFLAhhDotAbVk6pZLfzqQAAAdQ"]
[Sun Dec 28 23:21:38.463340 2025] [:error] [pid 29437:tid 29482] [client 4.190.193.147:6865] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "aVFLAhhDotAbVk6pZLfzqwAAAdA"]
[Sun Dec 28 23:21:38.741774 2025] [:error] [pid 42293:tid 42347] [client 4.190.193.147:6997] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "aVFLAsvc9B-5cwN385IYfAAAAFg"]
[Sun Dec 28 23:21:39.073424 2025] [:error] [pid 42294:tid 42372] [client 4.190.193.147:7094] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "aVFLA9TE5kYcYCOzl9HlxQAAAJY"]
[Sun Dec 28 23:21:39.386806 2025] [:error] [pid 42292:tid 42320] [client 4.190.193.147:6927] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aVFLA5yOrM_vaFx1osZz2wAAABg"]
[Sun Dec 28 23:21:39.700162 2025] [:error] [pid 42294:tid 42351] [client 4.190.193.147:6937] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aVFLA9TE5kYcYCOzl9HlxgAAAIE"]
[Sun Dec 28 23:21:40.044586 2025] [:error] [pid 29437:tid 29474] [client 4.190.193.147:7164] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aVFLBBhDotAbVk6pZLfzrgAAAcg"]
[Sun Dec 28 23:21:40.411459 2025] [:error] [pid 42292:tid 42300] [client 4.190.193.147:6942] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aVFLBJyOrM_vaFx1osZz3AAAAAQ"]
[Sun Dec 28 23:21:40.762502 2025] [:error] [pid 42294:tid 42374] [client 4.190.193.147:6866] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aVFLBNTE5kYcYCOzl9HlxwAAAJg"]
[Sun Dec 28 23:21:41.154194 2025] [:error] [pid 42292:tid 42312] [client 4.190.193.147:6918] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aVFLBZyOrM_vaFx1osZz3QAAABA"]
[Sun Dec 28 23:21:41.731385 2025] [:error] [pid 29388:tid 29404] [client 4.190.193.147:7097] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aVFLBdoLv2L2zI_SpdUamgAAAUg"]
[Sun Dec 28 23:21:42.042017 2025] [:error] [pid 42294:tid 42354] [client 4.190.193.147:6926] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aVFLBtTE5kYcYCOzl9HlyQAAAIQ"]
[Sun Dec 28 23:21:42.391510 2025] [:error] [pid 29437:tid 29475] [client 4.190.193.147:7012] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless5.php"] [unique_id "aVFLBhhDotAbVk6pZLfzsAAAAck"]
[Sun Dec 28 23:21:42.657579 2025] [:error] [pid 29437:tid 29479] [client 4.190.193.147:6981] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless5.php"] [unique_id "aVFLBhhDotAbVk6pZLfzsQAAAc0"]
[Sun Dec 28 23:21:42.953916 2025] [:error] [pid 29388:tid 29405] [client 4.190.193.147:6879] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless5.php"] [unique_id "aVFLBtoLv2L2zI_SpdUamwAAAUk"]
[Sun Dec 28 23:21:43.230931 2025] [:error] [pid 43789:tid 43808] [client 4.190.193.147:7032] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless5.php"] [unique_id "aVFLBwa-tUppni4CcCZfWQAAARE"]
[Sun Dec 28 23:21:43.659746 2025] [:error] [pid 43789:tid 43796] [client 4.190.193.147:6963] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aVFLBwa-tUppni4CcCZfWwAAAQU"]
[Sun Dec 28 23:21:44.024367 2025] [:error] [pid 42294:tid 42366] [client 4.190.193.147:7059] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aVFLCNTE5kYcYCOzl9HlywAAAJA"]
[Sun Dec 28 23:21:44.341874 2025] [:error] [pid 42294:tid 42361] [client 4.190.193.147:6860] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aVFLCNTE5kYcYCOzl9HlzAAAAIs"]
[Sun Dec 28 23:21:44.677455 2025] [:error] [pid 42292:tid 42299] [client 4.190.193.147:6945] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aVFLCJyOrM_vaFx1osZz4gAAAAM"]
[Sun Dec 28 23:21:44.933318 2025] [:error] [pid 43789:tid 43812] [client 4.190.193.147:6930] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aVFLCAa-tUppni4CcCZfXQAAARU"]
[Sun Dec 28 23:21:45.281066 2025] [:error] [pid 42378:tid 42402] [client 4.190.193.147:6849] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aVFLCTgtcN-KHAjWrX9DVwAAANY"]
[Sun Dec 28 23:21:45.717765 2025] [:error] [pid 42293:tid 42328] [client 4.190.193.147:6992] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aVFLCcvc9B-5cwN385IYhQAAAEU"]
[Sun Dec 28 23:21:46.075250 2025] [:error] [pid 42292:tid 42311] [client 4.190.193.147:6854] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aVFLCpyOrM_vaFx1osZz4wAAAA8"]
[Sun Dec 28 23:21:46.361195 2025] [:error] [pid 42293:tid 42335] [client 4.190.193.147:6931] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aVFLCsvc9B-5cwN385IYhwAAAEw"]
[Sun Dec 28 23:21:46.692213 2025] [:error] [pid 29437:tid 29473] [client 4.190.193.147:7018] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aVFLChhDotAbVk6pZLfzswAAAcc"]
[Sun Dec 28 23:21:46.986949 2025] [:error] [pid 29437:tid 29472] [client 4.190.193.147:6885] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aVFLChhDotAbVk6pZLfztAAAAcY"]
[Sun Dec 28 23:21:47.395136 2025] [:error] [pid 42294:tid 42369] [client 4.190.193.147:7120] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aVFLC9TE5kYcYCOzl9HlzQAAAJM"]
[Sun Dec 28 23:21:47.702663 2025] [:error] [pid 42378:tid 42403] [client 4.190.193.147:6939] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aVFLCzgtcN-KHAjWrX9DWQAAANc"]
[Sun Dec 28 23:21:47.983258 2025] [:error] [pid 42378:tid 42384] [client 4.190.193.147:7035] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aVFLCzgtcN-KHAjWrX9DWgAAAMQ"]
[Sun Dec 28 23:21:48.257805 2025] [:error] [pid 42294:tid 42367] [client 4.190.193.147:6851] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aVFLDNTE5kYcYCOzl9HlzwAAAJE"]
[Sun Dec 28 23:21:48.563614 2025] [:error] [pid 42292:tid 42298] [client 4.190.193.147:7015] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aVFLDJyOrM_vaFx1osZz5gAAAAI"]
[Sun Dec 28 23:21:48.837338 2025] [:error] [pid 42378:tid 42399] [client 4.190.193.147:6873] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aVFLDDgtcN-KHAjWrX9DWwAAANM"]
[Sun Dec 28 23:21:49.148051 2025] [:error] [pid 29436:tid 29461] [client 4.190.193.147:7040] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aVFLDbchzOOtNL9VPNItnQAAAZY"]
[Sun Dec 28 23:21:49.430382 2025] [:error] [pid 42378:tid 42395] [client 4.190.193.147:6917] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aVFLDTgtcN-KHAjWrX9DXAAAAM8"]
[Sun Dec 28 23:21:49.701207 2025] [:error] [pid 42292:tid 42315] [client 4.190.193.147:7006] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aVFLDZyOrM_vaFx1osZz6wAAABM"]
[Sun Dec 28 23:21:49.958884 2025] [:error] [pid 42378:tid 42404] [client 4.190.193.147:6891] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aVFLDTgtcN-KHAjWrX9DXQAAANg"]
[Sun Dec 28 23:21:50.241637 2025] [:error] [pid 42294:tid 42373] [client 4.190.193.147:6996] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aVFLDtTE5kYcYCOzl9Hl0QAAAJc"]
[Sun Dec 28 23:21:50.523008 2025] [:error] [pid 29437:tid 29476] [client 4.190.193.147:6888] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aVFLDhhDotAbVk6pZLfztgAAAco"]
[Sun Dec 28 23:21:50.860859 2025] [:error] [pid 42378:tid 42386] [client 4.190.193.147:6796] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aVFLDjgtcN-KHAjWrX9DXgAAAMY"]
[Sun Dec 28 23:21:51.170096 2025] [:error] [pid 43789:tid 43807] [client 4.190.193.147:6951] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aVFLDwa-tUppni4CcCZfYwAAARA"]
[Sun Dec 28 23:21:51.521649 2025] [:error] [pid 42294:tid 42358] [client 4.190.193.147:6947] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aVFLD9TE5kYcYCOzl9Hl0wAAAIg"]
[Sun Dec 28 23:21:51.799595 2025] [:error] [pid 42378:tid 42400] [client 4.190.193.147:7123] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aVFLDzgtcN-KHAjWrX9DYAAAANQ"]
[Sun Dec 28 23:21:52.103349 2025] [:error] [pid 42294:tid 42365] [client 4.190.193.147:6914] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aVFLENTE5kYcYCOzl9Hl1AAAAI8"]
[Sun Dec 28 23:21:52.495085 2025] [:error] [pid 42294:tid 42352] [client 4.190.193.147:6952] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aVFLENTE5kYcYCOzl9Hl1gAAAII"]
[Sun Dec 28 23:21:52.774725 2025] [:error] [pid 29436:tid 29447] [client 4.190.193.147:36971] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aVFLELchzOOtNL9VPNItoQAAAYg"]
[Sun Dec 28 23:21:53.092255 2025] [:error] [pid 29436:tid 29446] [client 4.190.193.147:7021] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aVFLEbchzOOtNL9VPNItogAAAYc"]
[Sun Dec 28 23:21:53.382229 2025] [:error] [pid 29436:tid 29440] [client 4.190.193.147:6935] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aVFLEbchzOOtNL9VPNItowAAAYE"]
[Sun Dec 28 23:21:53.715918 2025] [:error] [pid 42292:tid 42318] [client 4.190.193.147:7030] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aVFLEZyOrM_vaFx1osZz7QAAABY"]
[Sun Dec 28 23:21:54.008457 2025] [:error] [pid 42378:tid 42381] [client 4.190.193.147:6940] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aVFLEjgtcN-KHAjWrX9DYwAAAME"]
[Sun Dec 28 23:21:54.330491 2025] [:error] [pid 29436:tid 29460] [client 4.190.193.147:6855] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aVFLErchzOOtNL9VPNItpgAAAZU"]
[Sun Dec 28 23:21:54.601974 2025] [:error] [pid 42292:tid 42301] [client 4.190.193.147:6791] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aVFLEpyOrM_vaFx1osZz7wAAAAU"]
[Sun Dec 28 23:21:54.928598 2025] [:error] [pid 42292:tid 42311] [client 4.190.193.147:7089] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aVFLEpyOrM_vaFx1osZz8AAAAA8"]
[Sun Dec 28 23:21:55.227865 2025] [:error] [pid 29388:tid 29398] [client 4.190.193.147:6852] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aVFLE9oLv2L2zI_SpdUanwAAAUI"]
[Sun Dec 28 23:21:55.518924 2025] [:error] [pid 29388:tid 29410] [client 4.190.193.147:6908] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aVFLE9oLv2L2zI_SpdUaoQAAAU4"]
[Sun Dec 28 23:21:55.819935 2025] [:error] [pid 43789:tid 43813] [client 4.190.193.147:6928] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aVFLEwa-tUppni4CcCZfZQAAARY"]
[Sun Dec 28 23:21:56.086146 2025] [:error] [pid 29388:tid 29396] [client 4.190.193.147:6913] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blurbs15.php"] [unique_id "aVFLFNoLv2L2zI_SpdUaogAAAUA"]
[Sun Dec 28 23:21:56.333465 2025] [:error] [pid 42292:tid 42310] [client 4.190.193.147:6934] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blurbs15.php"] [unique_id "aVFLFJyOrM_vaFx1osZz8QAAAA4"]
[Sun Dec 28 23:21:56.584960 2025] [:error] [pid 29388:tid 29402] [client 4.190.193.147:6850] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blurbs15.php"] [unique_id "aVFLFNoLv2L2zI_SpdUaowAAAUY"]
[Sun Dec 28 23:21:56.905365 2025] [:error] [pid 42292:tid 42298] [client 4.190.193.147:6901] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blurbs15.php"] [unique_id "aVFLFJyOrM_vaFx1osZz8wAAAAI"]
[Sun Dec 28 23:21:57.180611 2025] [:error] [pid 42293:tid 42340] [client 4.190.193.147:6924] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aVFLFcvc9B-5cwN385IYiQAAAFE"]
[Sun Dec 28 23:21:57.514353 2025] [:error] [pid 29436:tid 29444] [client 4.190.193.147:6958] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aVFLFbchzOOtNL9VPNItqgAAAYU"]
[Sun Dec 28 23:21:57.803245 2025] [:error] [pid 43789:tid 43796] [client 4.190.193.147:6905] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aVFLFQa-tUppni4CcCZfZwAAAQU"]
[Sun Dec 28 23:21:58.087772 2025] [:error] [pid 29437:tid 29467] [client 4.190.193.147:6971] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aVFLFhhDotAbVk6pZLfzvAAAAcE"]
[Sun Dec 28 23:21:58.385919 2025] [:error] [pid 29436:tid 29455] [client 4.190.193.147:6949] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aVFLFrchzOOtNL9VPNItqwAAAZA"]
[Sun Dec 28 23:21:58.656406 2025] [:error] [pid 43789:tid 43797] [client 4.190.193.147:6870] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aVFLFga-tUppni4CcCZfaQAAAQY"]
[Sun Dec 28 23:21:58.921913 2025] [:error] [pid 42293:tid 42333] [client 4.190.193.147:6896] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aVFLFsvc9B-5cwN385IYigAAAEo"]
[Sun Dec 28 23:21:59.208543 2025] [:error] [pid 29388:tid 29397] [client 4.190.193.147:6960] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aVFLF9oLv2L2zI_SpdUapwAAAUE"]
[Sun Dec 28 23:21:59.459088 2025] [:error] [pid 29388:tid 29404] [client 4.190.193.147:6959] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aVFLF9oLv2L2zI_SpdUaqQAAAUg"]
[Sun Dec 28 23:21:59.739638 2025] [:error] [pid 29388:tid 29415] [client 4.190.193.147:6835] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aVFLF9oLv2L2zI_SpdUaqgAAAVM"]
[Sun Dec 28 23:22:00.059192 2025] [:error] [pid 43789:tid 43794] [client 4.190.193.147:6967] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aVFLGAa-tUppni4CcCZfawAAAQM"]
[Sun Dec 28 23:22:00.391337 2025] [:error] [pid 42378:tid 42403] [client 4.190.193.147:6836] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aVFLGDgtcN-KHAjWrX9DbAAAANc"]
[Sun Dec 28 23:22:00.718955 2025] [:error] [pid 42294:tid 42360] [client 4.190.193.147:7037] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aVFLGNTE5kYcYCOzl9Hl2AAAAIo"]
[Sun Dec 28 23:22:01.046099 2025] [:error] [pid 29388:tid 29398] [client 4.190.193.147:7069] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aVFLGdoLv2L2zI_SpdUargAAAUI"]
[Sun Dec 28 23:22:01.374381 2025] [:error] [pid 42294:tid 42350] [client 4.190.193.147:6954] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aVFLGdTE5kYcYCOzl9Hl2QAAAIA"]
[Sun Dec 28 23:22:01.623396 2025] [:error] [pid 29436:tid 29453] [client 4.190.193.147:6742] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aVFLGbchzOOtNL9VPNItsQAAAY4"]
[Sun Dec 28 23:22:01.959222 2025] [:error] [pid 29388:tid 29396] [client 4.190.193.147:7001] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aVFLGdoLv2L2zI_SpdUasAAAAUA"]
[Sun Dec 28 23:22:02.329477 2025] [:error] [pid 42378:tid 42384] [client 4.190.193.147:6871] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aVFLGjgtcN-KHAjWrX9DbQAAAMQ"]
[Sun Dec 28 23:22:02.720523 2025] [:error] [pid 42378:tid 42399] [client 4.190.193.147:6728] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aVFLGjgtcN-KHAjWrX9DbgAAANM"]
[Sun Dec 28 23:22:03.056297 2025] [:error] [pid 29436:tid 29460] [client 4.190.193.147:6876] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aVFLG7chzOOtNL9VPNIttAAAAZU"]
[Sun Dec 28 23:22:03.313054 2025] [:error] [pid 29436:tid 29454] [client 4.190.193.147:6820] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aVFLG7chzOOtNL9VPNIttQAAAY8"]
[Sun Dec 28 23:22:03.600529 2025] [:error] [pid 29436:tid 29449] [client 4.190.193.147:7016] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aVFLG7chzOOtNL9VPNIttwAAAYo"]
[Sun Dec 28 23:22:03.876909 2025] [:error] [pid 43789:tid 43792] [client 4.190.193.147:7082] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aVFLGwa-tUppni4CcCZfbQAAAQE"]
[Sun Dec 28 23:22:04.140895 2025] [:error] [pid 29388:tid 29415] [client 4.190.193.147:6839] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aVFLHNoLv2L2zI_SpdUavAAAAVM"]
[Sun Dec 28 23:22:04.380965 2025] [:error] [pid 42294:tid 42354] [client 4.190.193.147:6969] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aVFLHNTE5kYcYCOzl9Hl2gAAAIQ"]
[Sun Dec 28 23:22:04.645585 2025] [:error] [pid 42294:tid 42353] [client 4.190.193.147:6869] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aVFLHNTE5kYcYCOzl9Hl2wAAAIM"]
[Sun Dec 28 23:22:04.887354 2025] [:error] [pid 29388:tid 29400] [client 4.190.193.147:6957] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aVFLHNoLv2L2zI_SpdUa1AAAAUQ"]
[Sun Dec 28 23:22:05.163308 2025] [:error] [pid 29436:tid 29462] [client 4.190.193.147:7028] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aVFLHbchzOOtNL9VPNItzgAAAZc"]
[Sun Dec 28 23:22:05.448656 2025] [:error] [pid 42293:tid 42337] [client 4.190.193.147:6956] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aVFLHcvc9B-5cwN385IYjAAAAE4"]
[Sun Dec 28 23:22:05.688264 2025] [:error] [pid 29436:tid 29446] [client 4.190.193.147:7011] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aVFLHbchzOOtNL9VPNIt1gAAAYc"]
[Sun Dec 28 23:22:05.947118 2025] [:error] [pid 42292:tid 42313] [client 4.190.193.147:6915] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aVFLHZyOrM_vaFx1osZz9gAAABE"]
[Sun Dec 28 23:22:06.237837 2025] [:error] [pid 29388:tid 29413] [client 4.190.193.147:7038] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aVFLHtoLv2L2zI_SpdUa7AAAAVE"]
[Sun Dec 28 23:22:06.525950 2025] [:error] [pid 29388:tid 29406] [client 4.190.193.147:6785] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aVFLHtoLv2L2zI_SpdUa7QAAAUo"]
[Sun Dec 28 23:22:06.795189 2025] [:error] [pid 42294:tid 42371] [client 4.190.193.147:6936] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aVFLHtTE5kYcYCOzl9Hl3AAAAJU"]
[Sun Dec 28 23:22:07.044733 2025] [:error] [pid 43789:tid 43810] [client 4.190.193.147:7017] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aVFLHwa-tUppni4CcCZfiAAAARM"]
[Sun Dec 28 23:22:07.367985 2025] [:error] [pid 42293:tid 42342] [client 4.190.193.147:6786] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aVFLH8vc9B-5cwN385IYjgAAAFM"]
[Sun Dec 28 23:22:07.608634 2025] [:error] [pid 29388:tid 29403] [client 4.190.193.147:6723] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aVFLH9oLv2L2zI_SpdUa8AAAAUc"]
[Sun Dec 28 23:22:07.914777 2025] [:error] [pid 43789:tid 43791] [client 4.190.193.147:6787] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aVFLHwa-tUppni4CcCZfiQAAAQA"]
[Sun Dec 28 23:22:08.206095 2025] [:error] [pid 29437:tid 29471] [client 4.190.193.147:6837] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aVFLIBhDotAbVk6pZLfzwAAAAcU"]
[Sun Dec 28 23:22:08.455412 2025] [:error] [pid 29388:tid 29420] [client 4.190.193.147:7164] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aVFLINoLv2L2zI_SpdUa8QAAAVg"]
[Sun Dec 28 23:22:08.752957 2025] [:error] [pid 43789:tid 43800] [client 4.190.193.147:7162] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aVFLIAa-tUppni4CcCZfigAAAQk"]
[Sun Dec 28 23:22:08.998437 2025] [:error] [pid 42293:tid 42330] [client 4.190.193.147:6792] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aVFLIMvc9B-5cwN385IYkAAAAEc"]
[Sun Dec 28 23:22:09.259096 2025] [:error] [pid 29437:tid 29473] [client 4.190.193.147:6864] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aVFLIRhDotAbVk6pZLfzwQAAAcc"]
[Sun Dec 28 23:22:09.517613 2025] [:error] [pid 43789:tid 43815] [client 4.190.193.147:6929] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aVFLIQa-tUppni4CcCZfjAAAARg"]
[Sun Dec 28 23:22:09.764206 2025] [:error] [pid 42378:tid 42392] [client 4.190.193.147:6862] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aVFLITgtcN-KHAjWrX9DpwAAAMw"]
[Sun Dec 28 23:22:10.004447 2025] [:error] [pid 29436:tid 29448] [client 4.190.193.147:6859] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aVFLIrchzOOtNL9VPNIt2wAAAYk"]
[Sun Dec 28 23:22:10.319041 2025] [:error] [pid 42294:tid 42363] [client 4.190.193.147:7074] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aVFLItTE5kYcYCOzl9Hl4AAAAI0"]
[Sun Dec 28 23:22:10.619848 2025] [:error] [pid 29388:tid 29414] [client 4.190.193.147:6895] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aVFLItoLv2L2zI_SpdUa8gAAAVI"]
[Sun Dec 28 23:22:10.874927 2025] [:error] [pid 42294:tid 42359] [client 4.190.193.147:6910] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/galex.php"] [unique_id "aVFLItTE5kYcYCOzl9Hl4QAAAIk"]
[Sun Dec 28 23:22:11.123989 2025] [:error] [pid 29437:tid 29472] [client 4.190.193.147:6861] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/galex.php"] [unique_id "aVFLIxhDotAbVk6pZLfzwgAAAcY"]
[Sun Dec 28 23:22:11.437486 2025] [:error] [pid 29437:tid 29487] [client 4.190.193.147:36965] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/galex.php"] [unique_id "aVFLIxhDotAbVk6pZLfzwwAAAdU"]
[Sun Dec 28 23:22:11.676956 2025] [:error] [pid 29437:tid 29488] [client 4.190.193.147:6878] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/galex.php"] [unique_id "aVFLIxhDotAbVk6pZLfzxgAAAdY"]
[Sun Dec 28 23:22:11.935635 2025] [:error] [pid 29437:tid 29486] [client 4.190.193.147:6801] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aVFLIxhDotAbVk6pZLfzxwAAAdQ"]
[Sun Dec 28 23:22:12.214173 2025] [:error] [pid 42293:tid 42345] [client 4.190.193.147:7098] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aVFLJMvc9B-5cwN385IYkgAAAFY"]
[Sun Dec 28 23:22:12.501458 2025] [:error] [pid 29437:tid 29490] [client 4.190.193.147:7026] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aVFLJBhDotAbVk6pZLfzyQAAAdg"]
[Sun Dec 28 23:22:12.798506 2025] [:error] [pid 43789:tid 43811] [client 4.190.193.147:7166] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aVFLJAa-tUppni4CcCZfjQAAARQ"]
[Sun Dec 28 23:22:13.066644 2025] [:error] [pid 29436:tid 29445] [client 4.190.193.147:6884] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aVFLJbchzOOtNL9VPNIt3QAAAYY"]
[Sun Dec 28 23:22:13.315834 2025] [:error] [pid 42294:tid 42373] [client 4.190.193.147:6832] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aVFLJdTE5kYcYCOzl9Hl4gAAAJc"]
[Sun Dec 28 23:22:13.580319 2025] [:error] [pid 29436:tid 29455] [client 4.190.193.147:6911] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aVFLJbchzOOtNL9VPNIt3wAAAZA"]
[Sun Dec 28 23:22:13.841153 2025] [:error] [pid 43789:tid 43801] [client 4.190.193.147:6810] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aVFLJQa-tUppni4CcCZfjwAAAQo"]
[Sun Dec 28 23:22:14.089388 2025] [:error] [pid 42378:tid 42391] [client 4.190.193.147:6894] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aVFLJjgtcN-KHAjWrX9DqQAAAMs"]
[Sun Dec 28 23:22:14.330169 2025] [:error] [pid 42378:tid 42390] [client 4.190.193.147:6972] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aVFLJjgtcN-KHAjWrX9DqgAAAMo"]
[Sun Dec 28 23:22:14.587054 2025] [:error] [pid 42378:tid 42382] [client 4.190.193.147:6773] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aVFLJjgtcN-KHAjWrX9DrAAAAMI"]
[Sun Dec 28 23:22:14.873614 2025] [:error] [pid 29388:tid 29409] [client 4.190.193.147:6887] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aVFLJtoLv2L2zI_SpdUa9gAAAU0"]
[Sun Dec 28 23:22:15.130411 2025] [:error] [pid 29388:tid 29416] [client 4.190.193.147:6962] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aVFLJ9oLv2L2zI_SpdUa9wAAAVQ"]
[Sun Dec 28 23:22:15.416343 2025] [:error] [pid 42294:tid 42358] [client 4.190.193.147:6822] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aVFLJ9TE5kYcYCOzl9Hl4wAAAIg"]
[Sun Dec 28 23:22:15.726411 2025] [:error] [pid 42293:tid 42328] [client 4.190.193.147:7016] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aVFLJ8vc9B-5cwN385IYlAAAAEU"]
[Sun Dec 28 23:22:16.042488 2025] [:error] [pid 42294:tid 42365] [client 4.190.193.147:6868] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aVFLKNTE5kYcYCOzl9Hl5AAAAI8"]
[Sun Dec 28 23:22:16.483199 2025] [:error] [pid 42294:tid 42357] [client 4.190.193.147:6938] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aVFLKNTE5kYcYCOzl9Hl5QAAAIc"]
[Sun Dec 28 23:22:16.785592 2025] [:error] [pid 42294:tid 42352] [client 4.190.193.147:6671] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aVFLKNTE5kYcYCOzl9Hl5gAAAII"]
[Sun Dec 28 23:22:17.054727 2025] [:error] [pid 42294:tid 42364] [client 4.190.193.147:6805] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aVFLKdTE5kYcYCOzl9Hl6AAAAI4"]
[Sun Dec 28 23:22:17.330971 2025] [:error] [pid 42294:tid 42362] [client 4.190.193.147:6831] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aVFLKdTE5kYcYCOzl9Hl6QAAAIw"]
[Sun Dec 28 23:22:17.591858 2025] [:error] [pid 42294:tid 42360] [client 4.190.193.147:6867] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aVFLKdTE5kYcYCOzl9Hl6gAAAIo"]
[Sun Dec 28 23:22:17.876715 2025] [:error] [pid 42293:tid 42327] [client 4.190.193.147:6874] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aVFLKcvc9B-5cwN385IYlwAAAEQ"]
[Sun Dec 28 23:22:18.135810 2025] [:error] [pid 42293:tid 42347] [client 4.190.193.147:6803] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aVFLKsvc9B-5cwN385IYmQAAAFg"]
[Sun Dec 28 23:22:18.393157 2025] [:error] [pid 42294:tid 42369] [client 4.190.193.147:6880] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aVFLKtTE5kYcYCOzl9Hl8AAAAJM"]
[Sun Dec 28 23:22:18.685432 2025] [:error] [pid 29388:tid 29399] [client 4.190.193.147:6784] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xse25.php"] [unique_id "aVFLKtoLv2L2zI_SpdUa-gAAAUM"]
[Sun Dec 28 23:22:18.947478 2025] [:error] [pid 29388:tid 29406] [client 4.190.193.147:6857] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xse25.php"] [unique_id "aVFLKtoLv2L2zI_SpdUa-wAAAUo"]
[Sun Dec 28 23:22:19.186745 2025] [:error] [pid 29388:tid 29403] [client 4.190.193.147:6797] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xse25.php"] [unique_id "aVFLK9oLv2L2zI_SpdUa_QAAAUc"]
[Sun Dec 28 23:22:19.431982 2025] [:error] [pid 42294:tid 42370] [client 4.190.193.147:6628] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xse25.php"] [unique_id "aVFLK9TE5kYcYCOzl9Hl8wAAAJQ"]
[Sun Dec 28 23:22:19.678909 2025] [:error] [pid 29437:tid 29474] [client 4.190.193.147:6808] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/index.php"] [unique_id "aVFLKxhDotAbVk6pZLfzzAAAAcg"]
[Sun Dec 28 23:22:19.920780 2025] [:error] [pid 42293:tid 42333] [client 4.190.193.147:6909] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/index.php"] [unique_id "aVFLK8vc9B-5cwN385IYmwAAAEo"]
[Sun Dec 28 23:22:20.901232 2025] [autoindex:error] [pid 29437:tid 29478] [client 4.190.193.147:6778] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Dec 28 23:22:21.037016 2025] [:error] [pid 29437:tid 29479] [client 4.190.193.147:6778] [client 4.190.193.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aVFLLRhDotAbVk6pZLfzzwAAAc0"]
[Sun Dec 28 23:22:25.794781 2025] [:error] [pid 29388:tid 29404] [client 4.190.193.147:6903] [client 4.190.193.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aVFLMdoLv2L2zI_SpdUbCAAAAUg"]
[Sun Dec 28 23:22:26.059250 2025] [:error] [pid 29388:tid 29399] [client 4.190.193.147:6973] [client 4.190.193.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/index.php"] [unique_id "aVFLMtoLv2L2zI_SpdUbCgAAAUM"]
[Sun Dec 28 23:22:30.031575 2025] [:error] [pid 42293:tid 42329] [client 4.190.193.147:6721] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conte.php"] [unique_id "aVFLNsvc9B-5cwN385IYqQAAAEY"]
[Sun Dec 28 23:22:30.280542 2025] [:error] [pid 29437:tid 29481] [client 4.190.193.147:6966] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conte.php"] [unique_id "aVFLNhhDotAbVk6pZLfz1wAAAc8"]
[Sun Dec 28 23:22:30.607423 2025] [:error] [pid 42294:tid 42355] [client 4.190.193.147:6807] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conte.php"] [unique_id "aVFLNtTE5kYcYCOzl9Hl9gAAAIU"]
[Sun Dec 28 23:22:30.865508 2025] [:error] [pid 29388:tid 29410] [client 4.190.193.147:6806] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conte.php"] [unique_id "aVFLNtoLv2L2zI_SpdUbDQAAAU4"]
[Sun Dec 28 23:22:31.132855 2025] [:error] [pid 29437:tid 29485] [client 4.190.193.147:6735] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class3.php"] [unique_id "aVFLNxhDotAbVk6pZLfz2gAAAdM"]
[Sun Dec 28 23:22:31.424280 2025] [:error] [pid 29436:tid 29448] [client 4.190.193.147:6906] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class3.php"] [unique_id "aVFLN7chzOOtNL9VPNIt5QAAAYk"]
[Sun Dec 28 23:22:31.677480 2025] [:error] [pid 42294:tid 42364] [client 4.190.193.147:6833] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class3.php"] [unique_id "aVFLN9TE5kYcYCOzl9Hl9wAAAI4"]
[Sun Dec 28 23:22:31.926524 2025] [:error] [pid 29388:tid 29414] [client 4.190.193.147:6845] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class3.php"] [unique_id "aVFLN9oLv2L2zI_SpdUbDgAAAVI"]
[Sun Dec 28 23:22:32.181008 2025] [:error] [pid 29436:tid 29450] [client 4.190.193.147:6982] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blurbs18.php"] [unique_id "aVFLOLchzOOtNL9VPNIt6AAAAYs"]
[Sun Dec 28 23:22:32.432432 2025] [:error] [pid 42294:tid 42360] [client 4.190.193.147:6889] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blurbs18.php"] [unique_id "aVFLONTE5kYcYCOzl9Hl-AAAAIo"]
[Sun Dec 28 23:22:32.701310 2025] [:error] [pid 29436:tid 29449] [client 4.190.193.147:6907] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blurbs18.php"] [unique_id "aVFLOLchzOOtNL9VPNIt6QAAAYo"]
[Sun Dec 28 23:22:32.941946 2025] [:error] [pid 29436:tid 29451] [client 4.190.193.147:6809] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blurbs18.php"] [unique_id "aVFLOLchzOOtNL9VPNIt6gAAAYw"]
[Sun Dec 28 23:22:33.183971 2025] [:error] [pid 29436:tid 29445] [client 4.190.193.147:6892] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/claa.php"] [unique_id "aVFLObchzOOtNL9VPNIt6wAAAYY"]
[Sun Dec 28 23:22:33.463742 2025] [:error] [pid 29388:tid 29412] [client 4.190.193.147:6800] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/claa.php"] [unique_id "aVFLOdoLv2L2zI_SpdUbEAAAAVA"]
[Sun Dec 28 23:22:33.802008 2025] [:error] [pid 43789:tid 43809] [client 4.190.193.147:6825] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/claa.php"] [unique_id "aVFLOQa-tUppni4CcCZflQAAARI"]
[Sun Dec 28 23:22:34.068954 2025] [:error] [pid 29388:tid 29397] [client 4.190.193.147:6975] [client 4.190.193.147] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/claa.php"] [unique_id "aVFLOtoLv2L2zI_SpdUbEgAAAUE"]
[Sun Dec 28 23:23:01.348647 2025] [:error] [pid 29436:tid 29445] [client 57.141.14.72:50296] [client 57.141.14.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 57.141.14.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVFLVbchzOOtNL9VPNIt-AAAAYY"]
[Sun Dec 28 23:29:22.929093 2025] [:error] [pid 42292:tid 42314] [client 66.179.210.205:38186] [client 66.179.210.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.179.210.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVFM0pyOrM_vaFx1osZ0nwAAABI"]
[Sun Dec 28 23:32:39.005455 2025] [:error] [pid 29388:tid 29418] [client 154.12.118.206:34784] [client 154.12.118.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.12.118.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVFNl9oLv2L2zI_SpdUcyQAAAVY"]
[Sun Dec 28 23:38:02.610952 2025] [:error] [pid 29388:tid 29399] [client 188.208.141.29:48120] [client 188.208.141.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.208.141.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVFO2toLv2L2zI_SpdUduAAAAUM"]
[Sun Dec 28 23:40:41.281268 2025] [:error] [pid 42378:tid 42384] [client 162.241.219.107:22864] [client 162.241.219.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.219.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVFPeTgtcN-KHAjWrX9FtwAAAMQ"]
[Sun Dec 28 23:54:02.620521 2025] [:error] [pid 42293:tid 42329] [client 93.89.225.185:38384] [client 93.89.225.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.89.225.185, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVFSmsvc9B-5cwN385IcvgAAAEY"]
[Mon Dec 29 00:08:08.481170 2025] [:error] [pid 42378:tid 42387] [client 80.84.63.203:38806] [client 80.84.63.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.84.63.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVFV6DgtcN-KHAjWrX9IuwAAAMc"]
[Mon Dec 29 00:19:12.395519 2025] [:error] [pid 46622:tid 46633] [client 82.165.19.236:55294] [client 82.165.19.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.19.236, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVFYgCZDJSVZN5_8UUNyUQAAAUk"]
[Mon Dec 29 00:20:40.014255 2025] [:error] [pid 46622:tid 46638] [client 185.104.44.90:35018] [client 185.104.44.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.104.44.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVFY2CZDJSVZN5_8UUNyuwAAAU4"]
[Mon Dec 29 00:31:56.209481 2025] [:error] [pid 46536:tid 46560] [client 162.241.226.202:46826] [client 162.241.226.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.226.202, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVFbfN72_BregW2fmRb5lwAAABQ"]
[Mon Dec 29 00:55:28.623023 2025] [:error] [pid 62278:tid 62298] [client 162.241.219.107:43076] [client 162.241.219.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.219.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVFhALXlQgY5k1TX4Y1ErgAAAFI"]
[Mon Dec 29 01:05:27.479851 2025] [:error] [pid 46622:tid 46624] [client 178.62.32.109:59380] [client 178.62.32.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.32.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVFjVyZDJSVZN5_8UUN5NgAAAUA"]
[Mon Dec 29 01:22:04.448036 2025] [:error] [pid 62317:tid 62326] [client 34.86.208.93:60356] [client 34.86.208.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.86.208.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVFnPDrMrOtzJhli_KVxGAAAAQc"]
[Mon Dec 29 01:22:06.608405 2025] [:error] [pid 62317:tid 62334] [client 34.86.208.93:60356] [client 34.86.208.93] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aVFnPjrMrOtzJhli_KVxHAAAAQ8"]
[Mon Dec 29 01:22:06.932965 2025] [:error] [pid 62317:tid 62328] [client 34.86.208.93:60356] [client 34.86.208.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.86.208.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVFnPjrMrOtzJhli_KVxHQAAAQk"]
[Mon Dec 29 01:22:08.425379 2025] [:error] [pid 13155:tid 13165] [client 34.86.208.93:52248] [client 34.86.208.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.86.208.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVFnQBEwDeBH7maxqIbOCwAAAwg"]
[Mon Dec 29 01:22:09.964446 2025] [:error] [pid 8076:tid 8092] [client 34.86.208.93:52223] [client 34.86.208.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.86.208.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVFnQemk6HKGnPEdvsJ7bwAAAg4"]
[Mon Dec 29 01:22:11.381803 2025] [:error] [pid 8229:tid 8282] [client 34.86.208.93:57515] [client 34.86.208.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.86.208.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVFnQyk6YVu4f2yMJ5ua4AAAAkQ"]
[Mon Dec 29 01:22:12.842420 2025] [:error] [pid 13155:tid 13158] [client 34.86.208.93:50383] [client 34.86.208.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.86.208.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVFnRBEwDeBH7maxqIbODQAAAwE"]
[Mon Dec 29 01:22:12.842641 2025] [:error] [pid 13155:tid 13158] [client 34.86.208.93:50383] [client 34.86.208.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.86.208.93, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVFnRBEwDeBH7maxqIbODQAAAwE"]
[Mon Dec 29 01:56:23.956837 2025] [:error] [pid 46536:tid 46560] [client 134.122.71.153:47616] [client 134.122.71.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.122.71.153, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVFvR972_BregW2fmRYBhAAAABQ"]
[Mon Dec 29 02:39:08.393845 2025] [:error] [pid 46537:tid 46569] [client 162.241.216.134:48442] [client 162.241.216.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.216.134, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVF5TBIwkdHOre8AuwA6VQAAAIE"]
[Mon Dec 29 02:48:07.485531 2025] [:error] [pid 8229:tid 8292] [client 193.176.230.19:58836] [client 193.176.230.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.176.230.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVF7Zyk6YVu4f2yMJ5ujdAAAAk4"]
[Mon Dec 29 02:53:06.721157 2025] [:error] [pid 62278:tid 62296] [client 209.38.73.139:60428] [client 209.38.73.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.38.73.139, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVF8krXlQgY5k1TX4Y1Q4wAAAFA"]
[Mon Dec 29 03:01:23.221564 2025] [:error] [pid 13155:tid 13181] [client 82.167.183.155:60746] [client 82.167.183.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.167.183.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVF-gxEwDeBH7maxqIbZcQAAAxg"]
[Mon Dec 29 03:10:33.921795 2025] [:error] [pid 16210:tid 16332] [client 209.38.73.139:49530] [client 209.38.73.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.38.73.139, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGAqYpdNq3e5XezXcFfGwAAAFc"]
[Mon Dec 29 03:13:01.580667 2025] [:error] [pid 16378:tid 16384] [client 209.38.73.139:46946] [client 209.38.73.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.38.73.139, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGBPcPc037l7YT-mkKaWwAAAMQ"]
[Mon Dec 29 03:36:11.183897 2025] [:error] [pid 42457:tid 42531] [client 178.18.250.206:56314] [client 178.18.250.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.250.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGGqy0z2jy4d_FCc_z9SwAAAJE"]
[Mon Dec 29 03:43:26.452648 2025] [:error] [pid 3390:tid 3402] [client 51.68.152.155:54584] [client 51.68.152.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.68.152.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGIXiA_XZ-Xwkb6jb2_mAAAAMU"]
[Mon Dec 29 03:43:28.590137 2025] [:error] [pid 3289:tid 3342] [client 51.68.152.155:54612] [client 51.68.152.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.68.152.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGIYGhpKN6_NnmFAnb77AAAAFA"]
[Mon Dec 29 03:43:30.635484 2025] [:error] [pid 3289:tid 3330] [client 51.68.152.155:54634] [client 51.68.152.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.68.152.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGIYmhpKN6_NnmFAnb77QAAAEQ"]
[Mon Dec 29 03:43:32.652522 2025] [:error] [pid 3288:tid 3308] [client 51.68.152.155:54658] [client 51.68.152.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.68.152.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGIZDEpMpEkXed2nOBODgAAAAo"]
[Mon Dec 29 03:43:34.688631 2025] [:error] [pid 3290:tid 3366] [client 51.68.152.155:54682] [client 51.68.152.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.68.152.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGIZo8EHu6Ei9K59dO4AQAAAI0"]
[Mon Dec 29 03:43:36.699522 2025] [:error] [pid 3390:tid 3404] [client 51.68.152.155:54704] [client 51.68.152.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.68.152.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGIaCA_XZ-Xwkb6jb2_nQAAAMc"]
[Mon Dec 29 03:43:36.699732 2025] [:error] [pid 3390:tid 3404] [client 51.68.152.155:54704] [client 51.68.152.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 51.68.152.155, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGIaCA_XZ-Xwkb6jb2_nQAAAMc"]
[Mon Dec 29 03:43:38.113057 2025] [:error] [pid 3390:tid 3409] [client 51.68.152.155:54720] [client 51.68.152.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.68.152.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGIaiA_XZ-Xwkb6jb2_nwAAAMw"]
[Mon Dec 29 03:43:38.113256 2025] [:error] [pid 3390:tid 3409] [client 51.68.152.155:54720] [client 51.68.152.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 51.68.152.155, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGIaiA_XZ-Xwkb6jb2_nwAAAMw"]
[Mon Dec 29 03:49:16.537982 2025] [:error] [pid 38925:tid 38927] [client 162.241.219.107:54466] [client 162.241.219.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.219.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGJvJsNsa1H1vMcetKthQAAAMA"]
[Mon Dec 29 04:13:17.523603 2025] [:error] [pid 11453:tid 11527] [client 62.221.199.19:54916] [client 62.221.199.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.221.199.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGPXby-FXnKT7-6pt4mOQAAAJI"]
[Mon Dec 29 04:17:35.586727 2025] [:error] [pid 11453:tid 11515] [client 62.221.199.19:44100] [client 62.221.199.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.221.199.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGQX7y-FXnKT7-6pt4nCwAAAIY"]
[Mon Dec 29 04:28:56.634804 2025] [:error] [pid 11451:tid 11466] [client 173.165.4.61:37880] [client 173.165.4.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.165.4.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGTCJDUmxySx0Vynm9_SwAAAAs"]
[Mon Dec 29 04:39:54.845057 2025] [:error] [pid 11452:tid 11499] [client 162.241.217.213:26220] [client 162.241.217.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.217.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGVmqhBUmuWsliUNqTbwgAAAFE"]
[Mon Dec 29 04:40:46.031577 2025] [proxy_fcgi:error] [pid 11540:tid 11566] [client 4.213.56.161:61193] AH01071: Got error 'Primary script unknown', referer: https://www.google.de/
[Mon Dec 29 04:41:00.230871 2025] [:error] [pid 11540:tid 11562] [client 4.213.56.161:61193] [client 4.213.56.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.213.56.161, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/cgi-bin/wp-login.php"] [unique_id "aVGV3A1izvtkZ6YWaTxCpQAAANQ"], referer: https://duckduckgo.com/
[Mon Dec 29 05:00:53.250419 2025] [:error] [pid 11453:tid 11525] [client 182.16.245.210:43200] [client 182.16.245.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.16.245.210, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGahby-FXnKT7-6pt4v-wAAAJA"]
[Mon Dec 29 05:17:30.585419 2025] [:error] [pid 37389:tid 37468] [client 43.138.68.113:36652] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVGeasEYrQKI4GZ26QaDXwAAAQ4"]
[Mon Dec 29 05:23:00.258106 2025] [autoindex:error] [pid 11540:tid 11551] [client 167.99.61.218:56328] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Dec 29 05:53:30.314354 2025] [:error] [pid 11452:tid 11496] [client 162.241.218.214:59866] [client 162.241.218.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.218.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGm2qhBUmuWsliUNqTrugAAAE4"]
[Mon Dec 29 06:00:31.877172 2025] [:error] [pid 11540:tid 11542] [client 195.35.7.210:50584] [client 195.35.7.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.35.7.210, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGofw1izvtkZ6YWaTxa9AAAAMA"]
[Mon Dec 29 06:25:26.982334 2025] [:error] [pid 11453:tid 11533] [client 162.241.230.74:35146] [client 162.241.230.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.230.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGuVry-FXnKT7-6pt5IhwAAAJg"]
[Mon Dec 29 06:28:56.763570 2025] [:error] [pid 11540:tid 11543] [client 51.75.74.17:48776] [client 51.75.74.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.75.74.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGvKA1izvtkZ6YWaTxjQwAAAME"]
[Mon Dec 29 06:29:23.396971 2025] [:error] [pid 11540:tid 11552] [client 23.99.196.87:20103] [client 23.99.196.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.99.196.87, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGvQw1izvtkZ6YWaTxjXAAAAMo"]
[Mon Dec 29 06:36:52.645738 2025] [:error] [pid 37389:tid 37477] [client 162.241.216.65:31940] [client 162.241.216.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.216.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVGxBMEYrQKI4GZ26QalbQAAARc"]
[Mon Dec 29 07:28:06.252270 2025] [:error] [pid 11451:tid 11469] [client 45.90.14.44:47780] [client 45.90.14.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.90.14.44, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVG9BpDUmxySx0Vynm-qKgAAAA4"]
[Mon Dec 29 07:57:54.263299 2025] [:error] [pid 11451:tid 11477] [client 162.241.217.213:23164] [client 162.241.217.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.217.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVHEApDUmxySx0Vynm-wSAAAABY"]
[Mon Dec 29 08:09:45.083697 2025] [:error] [pid 11451:tid 11469] [client 13.228.228.218:37592] [client 13.228.228.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.228.228.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVHGyZDUmxySx0Vynm-zRgAAAA4"]
[Mon Dec 29 08:32:42.226965 2025] [:error] [pid 11451:tid 11477] [client 103.74.116.120:38640] [client 103.74.116.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.74.116.120, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVHMKpDUmxySx0Vynm-4pgAAABY"]
[Mon Dec 29 09:12:20.888537 2025] [:error] [pid 11451:tid 11462] [client 116.202.13.21:60324] [client 116.202.13.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.202.13.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVHVdJDUmxySx0Vynm_BEgAAAAc"]
[Mon Dec 29 09:15:24.053049 2025] [:error] [pid 42293:tid 42305] [client 107.189.4.209:57960] [client 107.189.4.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.189.4.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVHWLApAkHF7zSWhAzGyPAAAAUo"], referer: https://expressinteriors.com/xmlrpc.php?rsd
[Mon Dec 29 09:47:38.428186 2025] [:error] [pid 11540:tid 11552] [client 66.29.147.6:57318] [client 66.29.147.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.29.147.6, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVHdug1izvtkZ6YWaTyeIgAAAMo"]
[Mon Dec 29 09:59:39.532854 2025] [:error] [pid 11540:tid 11545] [client 217.65.145.79:34002] [client 217.65.145.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.65.145.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVHgiw1izvtkZ6YWaTyhPgAAAMM"]
[Mon Dec 29 10:31:19.019602 2025] [:error] [pid 11540:tid 11552] [client 54.36.181.89:50930] [client 54.36.181.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.181.89, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVHn9w1izvtkZ6YWaTyq1AAAAMo"]
[Mon Dec 29 11:01:21.815467 2025] [:error] [pid 42293:tid 42308] [client 165.22.61.123:60642] [client 165.22.61.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.61.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVHvAQpAkHF7zSWhAzHbXAAAAU0"]
[Mon Dec 29 11:01:22.777743 2025] [:error] [pid 4295:tid 4308] [client 173.201.188.177:38782] [client 173.201.188.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.201.188.177, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVHvAjZaf4wrmKkZkFLcwQAAAYs"]
[Mon Dec 29 11:18:50.021872 2025] [:error] [pid 11452:tid 11504] [client 198.71.53.139:46090] [client 198.71.53.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.71.53.139, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVHzGqhBUmuWsliUNqQ2aQAAAFY"]
[Mon Dec 29 12:48:54.587174 2025] [:error] [pid 4295:tid 4320] [client 66.85.130.254:42528] [client 66.85.130.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.85.130.254, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVIINjZaf4wrmKkZkFIASQAAAZc"]
[Mon Dec 29 12:51:22.348664 2025] [:error] [pid 42293:tid 42296] [client 13.239.161.156:52028] [client 13.239.161.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.239.161.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVIIygpAkHF7zSWhAzH9awAAAUE"]
[Mon Dec 29 13:14:38.217390 2025] [:error] [pid 37389:tid 37460] [client 23.99.196.87:19140] [client 23.99.196.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.99.196.87, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVIOPsEYrQKI4GZ26QYeFgAAAQY"]
[Mon Dec 29 13:19:49.086776 2025] [:error] [pid 11451:tid 11461] [client 162.55.1.240:36896] [client 162.55.1.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.55.1.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVIPdZDUmxySx0Vynm_wkAAAAAY"]
[Mon Dec 29 13:29:52.227280 2025] [:error] [pid 11453:tid 11522] [client 113.20.31.55:43196] [client 113.20.31.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 113.20.31.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVIR0Ly-FXnKT7-6pt6tJQAAAI0"]
[Mon Dec 29 13:36:55.169001 2025] [:error] [pid 24307:tid 24334] [client 74.208.82.207:51342] [client 74.208.82.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.208.82.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVITdy5AURuH8IsFzz5T-wAAAdg"]
[Mon Dec 29 13:46:13.842928 2025] [:error] [pid 37389:tid 37456] [client 66.85.130.254:34960] [client 66.85.130.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.85.130.254, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVIVpcEYrQKI4GZ26QYhvwAAAQI"]
[Mon Dec 29 14:10:31.166918 2025] [:error] [pid 42293:tid 42303] [client 103.49.70.23:42532] [client 103.49.70.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.49.70.23, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVIbVwpAkHF7zSWhAzENkQAAAUg"]
[Mon Dec 29 14:26:28.546155 2025] [:error] [pid 4295:tid 4299] [client 213.192.239.72:36340] [client 213.192.239.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.192.239.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVIfFDZaf4wrmKkZkFILPgAAAYI"]
[Mon Dec 29 14:47:30.800194 2025] [:error] [pid 11453:tid 11528] [client 165.22.61.123:34142] [client 165.22.61.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.61.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVIkAry-FXnKT7-6pt62_QAAAJM"]
[Mon Dec 29 14:51:52.161718 2025] [:error] [pid 11453:tid 11516] [client 89.46.106.139:21418] [client 89.46.106.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.46.106.139, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVIlCLy-FXnKT7-6pt63wAAAAIc"]
[Mon Dec 29 15:05:12.633161 2025] [:error] [pid 42293:tid 42295] [client 217.65.145.79:33776] [client 217.65.145.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.65.145.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVIoKApAkHF7zSWhAzEYxgAAAUA"]
[Mon Dec 29 15:24:16.335469 2025] [:error] [pid 11453:tid 11511] [client 103.69.196.26:60678] [client 103.69.196.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.69.196.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVIsoLy-FXnKT7-6pt67WwAAAII"]
[Mon Dec 29 15:32:14.643953 2025] [:error] [pid 11451:tid 11463] [client 185.30.35.11:49596] [client 185.30.35.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.30.35.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVIufpDUmxySx0Vynm_8rQAAAAg"]
[Mon Dec 29 15:37:06.488479 2025] [:error] [pid 42293:tid 42297] [client 162.241.225.183:17280] [client 162.241.225.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.225.183, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVIvogpAkHF7zSWhAzEgNwAAAUI"]
[Mon Dec 29 16:00:52.781104 2025] [:error] [pid 11453:tid 11514] [client 147.93.107.71:41030] [client 147.93.107.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.93.107.71, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVI1NLy-FXnKT7-6pt6_2gAAAIU"]
[Mon Dec 29 16:49:12.917132 2025] [:error] [pid 24344:tid 24383] [client 31.25.90.158:22850] [client 31.25.90.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.25.90.158, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVJAiE1cesxuccozvjiSpgAAAkg"]
[Mon Dec 29 17:08:22.569362 2025] [:error] [pid 11451:tid 11458] [client 184.22.104.152:41800] [client 184.22.104.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.22.104.152, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVJFBpDUmxySx0Vynm8GMwAAAAM"]
[Mon Dec 29 17:12:07.309528 2025] [:error] [pid 24344:tid 24388] [client 66.135.4.111:34170] [client 66.135.4.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.135.4.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVJF501cesxuccozvjiX8gAAAk0"]
[Mon Dec 29 17:39:43.491149 2025] [:error] [pid 24307:tid 24322] [client 18.236.94.167:52360] [client 18.236.94.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 18.236.94.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVJMXy5AURuH8IsFzz5vhQAAAcw"]
[Mon Dec 29 18:05:44.279746 2025] [:error] [pid 4295:tid 4297] [client 171.244.32.203:36744] [client 171.244.32.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.244.32.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVJSeDZaf4wrmKkZkFImWwAAAYA"]
[Mon Dec 29 18:32:38.052114 2025] [:error] [pid 24307:tid 24323] [client 116.202.3.129:44216] [client 116.202.3.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.202.3.129, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVJYxi5AURuH8IsFzz52CQAAAc0"]
[Mon Dec 29 18:38:36.984814 2025] [:error] [pid 11451:tid 11455] [client 69.163.178.127:52606] [client 69.163.178.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.178.127, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVJaLJDUmxySx0Vynm8OzgAAAAA"]
[Mon Dec 29 19:17:40.925485 2025] [:error] [pid 24343:tid 24352] [client 193.228.90.63:37034] [client 193.228.90.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.228.90.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVJjVMvqvAa0rISAVIRcjQAAAgQ"]
[Mon Dec 29 19:17:43.356288 2025] [:error] [pid 4295:tid 4298] [client 193.228.90.63:37046] [client 193.228.90.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.228.90.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVJjVzZaf4wrmKkZkFIwKwAAAYE"]
[Mon Dec 29 19:17:45.678200 2025] [:error] [pid 24307:tid 24320] [client 193.228.90.63:37062] [client 193.228.90.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.228.90.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVJjWS5AURuH8IsFzz56jwAAAco"]
[Mon Dec 29 19:17:47.994568 2025] [:error] [pid 11453:tid 11532] [client 193.228.90.63:34314] [client 193.228.90.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.228.90.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVJjW7y-FXnKT7-6pt7dQAAAAJc"]
[Mon Dec 29 19:17:50.403197 2025] [:error] [pid 24307:tid 24326] [client 193.228.90.63:34318] [client 193.228.90.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.228.90.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVJjXi5AURuH8IsFzz56kQAAAdA"]
[Mon Dec 29 19:17:52.727503 2025] [:error] [pid 37389:tid 37478] [client 193.228.90.63:34332] [client 193.228.90.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.228.90.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVJjYMEYrQKI4GZ26QZOIAAAARg"]
[Mon Dec 29 19:17:52.727740 2025] [:error] [pid 37389:tid 37478] [client 193.228.90.63:34332] [client 193.228.90.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 193.228.90.63, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVJjYMEYrQKI4GZ26QZOIAAAARg"]
[Mon Dec 29 19:20:24.480073 2025] [:error] [pid 24344:tid 24377] [client 103.148.212.23:60062] [client 103.148.212.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.148.212.23, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVJj-E1cesxuccozvjivpwAAAkI"]
[Mon Dec 29 19:28:51.764046 2025] [:error] [pid 37389:tid 37457] [client 200.6.124.11:51498] [client 200.6.124.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.6.124.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVJl88EYrQKI4GZ26QZPIwAAAQM"]
[Mon Dec 29 19:31:27.200164 2025] [:error] [pid 11540:tid 11565] [client 184.22.104.152:60388] [client 184.22.104.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.22.104.152, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVJmjw1izvtkZ6YWaTzwQgAAANc"]
[Mon Dec 29 20:17:36.697304 2025] [:error] [pid 24344:tid 24376] [client 23.239.25.95:45838] [client 23.239.25.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.239.25.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVJxYE1cesxuccozvji-0wAAAkE"]
[Mon Dec 29 20:53:08.351604 2025] [:error] [pid 37389:tid 37454] [client 34.174.59.167:23462] [client 34.174.59.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.174.59.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVJ5tMEYrQKI4GZ26QZeiwAAAQA"]
[Mon Dec 29 21:06:55.856411 2025] [:error] [pid 11451:tid 11464] [client 5.161.241.92:58596] [client 5.161.241.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.161.241.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVJ875DUmxySx0Vynm8e8gAAAAk"]
[Mon Dec 29 21:11:06.091792 2025] [:error] [pid 24307:tid 24331] [client 212.224.88.239:59392] [client 212.224.88.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.224.88.239, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVJ96i5AURuH8IsFzz6LYwAAAdU"]
[Mon Dec 29 21:26:33.256297 2025] [:error] [pid 37389:tid 37474] [client 188.166.178.247:54628] [client 188.166.178.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.178.247, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVKBicEYrQKI4GZ26QZiPQAAARQ"]
[Mon Dec 29 21:38:50.640166 2025] [:error] [pid 11540:tid 11548] [client 208.109.19.118:63824] [client 208.109.19.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.109.19.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVKEag1izvtkZ6YWaTz_XgAAAMY"]
[Mon Dec 29 21:45:51.046554 2025] [:error] [pid 11452:tid 11500] [client 162.241.244.91:45388] [client 162.241.244.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.244.91, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVKGD6hBUmuWsliUNqR8kAAAAFI"]
[Mon Dec 29 21:49:04.475820 2025] [:error] [pid 24343:tid 24358] [client 217.65.145.79:48764] [client 217.65.145.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.65.145.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVKG0MvqvAa0rISAVIRwJgAAAgo"]
[Mon Dec 29 21:56:09.493030 2025] [:error] [pid 11451:tid 11457] [client 85.128.143.124:60664] [client 85.128.143.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.128.143.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVKIeZDUmxySx0Vynm8itAAAAAI"]
[Mon Dec 29 21:59:28.010504 2025] [:error] [pid 42293:tid 42301] [client 148.113.202.220:54782] [client 148.113.202.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.202.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVKJQApAkHF7zSWhAzFx1QAAAUY"]
[Mon Dec 29 21:59:41.543251 2025] [:error] [pid 24344:tid 24397] [client 68.178.199.26:31592] [client 68.178.199.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.199.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVKJTU1cesxuccozvjjVpAAAAlQ"]
[Mon Dec 29 22:06:50.533940 2025] [:error] [pid 37389:tid 37466] [client 49.12.59.139:40650] [client 49.12.59.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.12.59.139, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVKK-sEYrQKI4GZ26QZmqQAAAQw"]
[Mon Dec 29 22:53:20.637174 2025] [:error] [pid 24344:tid 24395] [client 188.34.161.164:44258] [client 188.34.161.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.34.161.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVKV4E1cesxuccozvjjgPAAAAlI"]
[Mon Dec 29 23:21:25.953502 2025] [:error] [pid 11540:tid 11562] [client 162.241.216.227:32610] [client 162.241.216.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.216.227, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVKcdQ1izvtkZ6YWaTwIxwAAANQ"]
[Mon Dec 29 23:27:39.907538 2025] [:error] [pid 4295:tid 4308] [client 162.241.225.183:15124] [client 162.241.225.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.225.183, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVKd6zZaf4wrmKkZkFJN0gAAAYs"]
[Mon Dec 29 23:29:25.708068 2025] [:error] [pid 24307:tid 24315] [client 171.244.32.203:42104] [client 171.244.32.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.244.32.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVKeVS5AURuH8IsFzz6X6QAAAcU"]
[Mon Dec 29 23:34:58.501005 2025] [:error] [pid 4295:tid 4305] [client 171.244.32.203:56046] [client 171.244.32.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.244.32.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVKfojZaf4wrmKkZkFJOrwAAAYg"]
[Tue Dec 30 00:20:51.973317 2025] [:error] [pid 9043:tid 9076] [client 162.144.176.146:31480] [client 162.144.176.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.144.176.146, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVKqYwpScn3s_Xelo-GTtQAAAEM"]
[Tue Dec 30 00:25:19.041943 2025] [:error] [pid 9128:tid 9132] [client 213.55.96.154:38468] [client 213.55.96.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.55.96.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVKrb8ASbrOSyCr7LVBpBwAAAMI"]
[Tue Dec 30 00:35:22.763155 2025] [:error] [pid 9043:tid 9074] [client 162.241.253.195:32156] [client 162.241.253.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.253.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVKtygpScn3s_Xelo-GXMwAAAEE"]
[Tue Dec 30 00:38:07.262265 2025] [:error] [pid 9043:tid 9079] [client 167.99.128.60:60496] [client 167.99.128.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.128.60, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVKubwpScn3s_Xelo-GXqQAAAEY"]
[Tue Dec 30 00:38:33.367799 2025] [:error] [pid 9042:tid 9062] [client 46.249.40.9:59214] [client 46.249.40.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.249.40.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVKuiTotupvrX8RtYEJrhQAAABA"]
[Tue Dec 30 01:19:21.104991 2025] [:error] [pid 9128:tid 9145] [client 103.8.127.155:45660] [client 103.8.127.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.8.127.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVK4GcASbrOSyCr7LVB16QAAAM8"]
[Tue Dec 30 01:35:19.697260 2025] [:error] [pid 9043:tid 9085] [client 85.31.234.16:33798] [client 85.31.234.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.31.234.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVK71wpScn3s_Xelo-GhnAAAAEw"]
[Tue Dec 30 01:40:13.816277 2025] [:error] [pid 42521:tid 42533] [client 184.168.111.27:43678] [client 184.168.111.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.111.27, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVK8_czHehU4LDeKEzoh8AAAAUk"]
[Tue Dec 30 01:41:02.736795 2025] [:error] [pid 42521:tid 42542] [client 213.168.187.126:43024] [client 213.168.187.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.168.187.126, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVK9LszHehU4LDeKEzoiJAAAAVI"]
[Tue Dec 30 01:50:16.707381 2025] [:error] [pid 57193:tid 57207] [client 173.201.187.142:47694] [client 173.201.187.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.201.187.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVK_WKEzOljppv-JqIq60QAAAYw"]
[Tue Dec 30 01:52:11.123355 2025] [:error] [pid 57193:tid 57202] [client 198.177.120.51:38988] [client 198.177.120.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.177.120.51, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVK_y6EzOljppv-JqIq6_wAAAYc"]
[Tue Dec 30 01:55:16.537215 2025] [:error] [pid 9043:tid 9097] [client 148.72.248.171:44386] [client 148.72.248.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.248.171, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLAhApScn3s_Xelo-GkQAAAAFg"]
[Tue Dec 30 02:12:17.856151 2025] [:error] [pid 9043:tid 9080] [client 72.167.65.237:31970] [client 72.167.65.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.167.65.237, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLEgQpScn3s_Xelo-Gm5QAAAEc"]
[Tue Dec 30 02:28:12.614632 2025] [:error] [pid 57193:tid 57198] [client 213.192.239.72:33994] [client 213.192.239.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.192.239.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLIPKEzOljppv-JqIrAYgAAAYM"]
[Tue Dec 30 02:36:19.381141 2025] [autoindex:error] [pid 57193:tid 57209] [client 4.241.185.64:32626] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Tue Dec 30 02:36:21.005878 2025] [autoindex:error] [pid 57193:tid 57210] [client 4.241.185.64:32626] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Tue Dec 30 02:36:27.682150 2025] [autoindex:error] [pid 57193:tid 57209] [client 4.241.185.64:32626] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Tue Dec 30 02:36:27.918708 2025] [autoindex:error] [pid 57193:tid 57207] [client 4.241.185.64:32626] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Tue Dec 30 02:36:36.659527 2025] [:error] [pid 57193:tid 57210] [client 4.241.185.64:32626] [client 4.241.185.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aVLKNKEzOljppv-JqIrBoAAAAY8"], referer: https://duckduckgo.com/
[Tue Dec 30 02:36:37.012306 2025] [autoindex:error] [pid 57193:tid 57219] [client 4.241.185.64:32580] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Tue Dec 30 02:36:37.126684 2025] [:error] [pid 57193:tid 57214] [client 4.241.185.64:32580] [client 4.241.185.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/index.php"] [unique_id "aVLKNaEzOljppv-JqIrBpgAAAZM"], referer: https://www.yahoo.com/
[Tue Dec 30 02:36:37.476396 2025] [autoindex:error] [pid 9044:tid 9106] [client 4.241.185.64:32614] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Tue Dec 30 02:36:45.675361 2025] [:error] [pid 42521:tid 42530] [client 4.241.185.64:32516] [client 4.241.185.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.241.185.64, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVLKPczHehU4LDeKEzoxqgAAAUY"], referer: https://www.google.com/
[Tue Dec 30 02:36:47.108397 2025] [autoindex:error] [pid 9044:tid 9107] [client 4.241.185.64:32614] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Tue Dec 30 02:36:48.702899 2025] [autoindex:error] [pid 9044:tid 9124] [client 4.241.185.64:32614] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Tue Dec 30 02:36:49.614846 2025] [autoindex:error] [pid 9044:tid 9120] [client 4.241.185.64:32614] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Tue Dec 30 02:36:53.154120 2025] [autoindex:error] [pid 9044:tid 9109] [client 4.241.185.64:32614] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Tue Dec 30 02:36:53.391131 2025] [autoindex:error] [pid 9044:tid 9118] [client 4.241.185.64:32614] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Tue Dec 30 02:36:53.626720 2025] [autoindex:error] [pid 9044:tid 9103] [client 4.241.185.64:32614] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Tue Dec 30 02:36:53.740309 2025] [:error] [pid 9044:tid 9102] [client 4.241.185.64:32614] [client 4.241.185.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aVLKReRAXIotPh9gznT-egAAAII"], referer: https://www.bing.com/
[Tue Dec 30 02:36:53.967923 2025] [:error] [pid 9042:tid 9063] [client 4.241.185.64:32519] [client 4.241.185.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aVLKRTotupvrX8RtYEJ83gAAABE"], referer: https://www.google.com/
[Tue Dec 30 02:36:54.320149 2025] [autoindex:error] [pid 9043:tid 9087] [client 4.241.185.64:32512] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Tue Dec 30 02:36:54.555782 2025] [autoindex:error] [pid 9043:tid 9074] [client 4.241.185.64:32512] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Tue Dec 30 02:36:54.669547 2025] [:error] [pid 9043:tid 9097] [client 4.241.185.64:32512] [client 4.241.185.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/index.php"] [unique_id "aVLKRgpScn3s_Xelo-GqIgAAAFg"], referer: https://www.yahoo.com/
[Tue Dec 30 02:36:55.022348 2025] [autoindex:error] [pid 61009:tid 61018] [client 4.241.185.64:32543] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Tue Dec 30 02:36:55.263494 2025] [autoindex:error] [pid 61009:tid 61021] [client 4.241.185.64:32543] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Tue Dec 30 02:36:55.377791 2025] [:error] [pid 61009:tid 61029] [client 4.241.185.64:32543] [client 4.241.185.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aVLKRxC7RSyMuwnpVqVBkgAAAdI"], referer: https://www.google.fr/
[Tue Dec 30 02:36:55.606022 2025] [:error] [pid 9042:tid 9056] [client 4.241.185.64:32590] [client 4.241.185.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/index.php"] [unique_id "aVLKRzotupvrX8RtYEJ85AAAAAo"], referer: https://www.bing.com/
[Tue Dec 30 02:36:55.835005 2025] [:error] [pid 9042:tid 9052] [client 4.241.185.64:32627] [client 4.241.185.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aVLKRzotupvrX8RtYEJ85QAAAAY"], referer: https://duckduckgo.com/
[Tue Dec 30 02:36:56.062871 2025] [:error] [pid 9042:tid 9049] [client 4.241.185.64:32517] [client 4.241.185.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/development/index.php"] [unique_id "aVLKSDotupvrX8RtYEJ85wAAAAM"], referer: https://www.yahoo.com/
[Tue Dec 30 02:36:56.290803 2025] [:error] [pid 61009:tid 61022] [client 4.241.185.64:32513] [client 4.241.185.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aVLKSBC7RSyMuwnpVqVBlAAAAcs"], referer: https://www.google.com/
[Tue Dec 30 02:36:56.639373 2025] [autoindex:error] [pid 61009:tid 61020] [client 4.241.185.64:32607] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Tue Dec 30 02:36:56.752903 2025] [:error] [pid 61009:tid 61027] [client 4.241.185.64:32607] [client 4.241.185.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aVLKSBC7RSyMuwnpVqVBmQAAAdA"], referer: https://www.google.fr/
[Tue Dec 30 02:36:57.101436 2025] [autoindex:error] [pid 9128:tid 9147] [client 4.241.185.64:32622] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Tue Dec 30 02:44:10.069908 2025] [:error] [pid 57193:tid 57216] [client 162.241.252.32:48498] [client 162.241.252.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.252.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLL-qEzOljppv-JqIrCgAAAAZU"]
[Tue Dec 30 02:47:55.608164 2025] [:error] [pid 57193:tid 57202] [client 20.25.250.19:16223] [client 20.25.250.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.25.250.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLM26EzOljppv-JqIrDcwAAAYc"]
[Tue Dec 30 03:02:57.994328 2025] [:error] [pid 9042:tid 9050] [client 41.185.8.122:45436] [client 41.185.8.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.185.8.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLQYTotupvrX8RtYEKBcwAAAAQ"]
[Tue Dec 30 03:03:33.328601 2025] [:error] [pid 61009:tid 61017] [client 103.217.92.186:38180] [client 103.217.92.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.217.92.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLQhRC7RSyMuwnpVqVHzQAAAcY"]
[Tue Dec 30 03:03:36.132432 2025] [:error] [pid 42521:tid 42528] [client 103.217.92.186:38192] [client 103.217.92.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.217.92.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLQiMzHehU4LDeKEzo5kwAAAUQ"]
[Tue Dec 30 03:03:37.593258 2025] [:error] [pid 57193:tid 57202] [client 103.217.92.186:32968] [client 103.217.92.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.217.92.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLQiaEzOljppv-JqIrGcQAAAYc"]
[Tue Dec 30 03:03:39.053090 2025] [:error] [pid 9043:tid 9091] [client 103.217.92.186:32980] [client 103.217.92.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.217.92.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLQiwpScn3s_Xelo-GvFQAAAFI"]
[Tue Dec 30 03:03:40.512731 2025] [:error] [pid 61009:tid 61026] [client 103.217.92.186:32986] [client 103.217.92.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.217.92.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLQjBC7RSyMuwnpVqVH2AAAAc8"]
[Tue Dec 30 03:03:41.970488 2025] [:error] [pid 9044:tid 9117] [client 103.217.92.186:32992] [client 103.217.92.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.217.92.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLQjeRAXIotPh9gznQC2gAAAJE"]
[Tue Dec 30 03:03:41.970647 2025] [:error] [pid 9044:tid 9117] [client 103.217.92.186:32992] [client 103.217.92.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 103.217.92.186, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLQjeRAXIotPh9gznQC2gAAAJE"]
[Tue Dec 30 03:03:42.898652 2025] [:error] [pid 42521:tid 42533] [client 103.217.92.186:33008] [client 103.217.92.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.217.92.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLQjszHehU4LDeKEzo5mgAAAUk"]
[Tue Dec 30 03:03:42.898851 2025] [:error] [pid 42521:tid 42533] [client 103.217.92.186:33008] [client 103.217.92.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 103.217.92.186, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLQjszHehU4LDeKEzo5mgAAAUk"]
[Tue Dec 30 03:03:43.824020 2025] [:error] [pid 9128:tid 9130] [client 103.217.92.186:33014] [client 103.217.92.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.217.92.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLQj8ASbrOSyCr7LVCF9wAAAMA"]
[Tue Dec 30 03:03:43.824189 2025] [:error] [pid 9128:tid 9130] [client 103.217.92.186:33014] [client 103.217.92.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 103.217.92.186, counter = 8"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLQj8ASbrOSyCr7LVCF9wAAAMA"]
[Tue Dec 30 03:03:44.748186 2025] [:error] [pid 57193:tid 57213] [client 103.217.92.186:33026] [client 103.217.92.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.217.92.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLQkKEzOljppv-JqIrGdwAAAZI"]
[Tue Dec 30 03:03:44.748382 2025] [:error] [pid 57193:tid 57213] [client 103.217.92.186:33026] [client 103.217.92.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 103.217.92.186, counter = 9"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLQkKEzOljppv-JqIrGdwAAAZI"]
[Tue Dec 30 03:03:45.682158 2025] [:error] [pid 42521:tid 42527] [client 103.217.92.186:33038] [client 103.217.92.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.217.92.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLQkczHehU4LDeKEzo5nAAAAUM"]
[Tue Dec 30 03:03:45.682307 2025] [:error] [pid 42521:tid 42527] [client 103.217.92.186:33038] [client 103.217.92.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 103.217.92.186, counter = 10"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLQkczHehU4LDeKEzo5nAAAAUM"]
[Tue Dec 30 03:06:22.482435 2025] [:error] [pid 42521:tid 42541] [client 39.60.237.145:51831] [client 39.60.237.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.60.237.145, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLRLszHehU4LDeKEzo6bAAAAVE"]
[Tue Dec 30 03:10:41.656570 2025] [:error] [pid 9043:tid 9095] [client 213.55.96.154:45218] [client 213.55.96.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.55.96.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLSMQpScn3s_Xelo-GwKgAAAFY"]
[Tue Dec 30 03:11:39.479292 2025] [:error] [pid 42521:tid 42548] [client 39.60.237.145:55488] [client 39.60.237.145] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aVLSa8zHehU4LDeKEzo7mgAAAVg"]
[Tue Dec 30 03:13:44.177267 2025] [:error] [pid 42335:tid 42400] [client 39.60.237.145:50309] [client 39.60.237.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.60.237.145, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLS6JTs64_nkFDMkPypegAAARc"]
[Tue Dec 30 03:25:11.253650 2025] [:error] [pid 42335:tid 42395] [client 72.167.86.200:17472] [client 72.167.86.200] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.167.86.200, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLVl5Ts64_nkFDMkPysVAAAARM"]
[Tue Dec 30 03:25:42.355284 2025] [:error] [pid 57193:tid 57218] [client 72.167.86.200:46916] [client 72.167.86.200] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.167.86.200, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLVtqEzOljppv-JqIrK3gAAAZc"]
[Tue Dec 30 03:32:49.370132 2025] [:error] [pid 61009:tid 61024] [client 4.197.92.48:33294] [client 4.197.92.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/about.php"] [unique_id "aVLXYRC7RSyMuwnpVqVOzAAAAc0"]
[Tue Dec 30 03:32:54.090508 2025] [:error] [pid 61009:tid 61025] [client 4.197.92.48:33369] [client 4.197.92.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/makeasmtp.php"] [unique_id "aVLXZhC7RSyMuwnpVqVO2AAAAc4"]
[Tue Dec 30 03:32:54.128342 2025] [:error] [pid 42335:tid 42392] [client 4.197.92.48:33400] [client 4.197.92.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/makeasmtp.php"] [unique_id "aVLXZpTs64_nkFDMkPyuMQAAARA"]
[Tue Dec 30 03:32:54.217476 2025] [:error] [pid 42335:tid 42396] [client 4.197.92.48:33284] [client 4.197.92.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/makeasmtp.php"] [unique_id "aVLXZpTs64_nkFDMkPyuMgAAARQ"]
[Tue Dec 30 03:32:54.260209 2025] [:error] [pid 9042:tid 9068] [client 4.197.92.48:33292] [client 4.197.92.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/makeasmtp.php"] [unique_id "aVLXZjotupvrX8RtYEKGQgAAABY"]
[Tue Dec 30 03:34:58.538495 2025] [:error] [pid 57193:tid 57207] [client 81.88.49.53:31415] [client 81.88.49.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.53, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLX4qEzOljppv-JqIrM1QAAAYw"]
[Tue Dec 30 03:44:08.628297 2025] [autoindex:error] [pid 57193:tid 57214] [client 4.213.153.145:12611] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Tue Dec 30 03:44:08.922508 2025] [autoindex:error] [pid 57193:tid 57213] [client 4.213.153.145:12611] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Tue Dec 30 03:44:13.679854 2025] [:error] [pid 42521:tid 42528] [client 4.213.153.145:12549] [client 4.213.153.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.213.153.145, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVLaDczHehU4LDeKEzpFYgAAAUQ"], referer: https://www.google.de/
[Tue Dec 30 03:53:08.974867 2025] [:error] [pid 52780:tid 52860] [client 162.241.216.35:22112] [client 162.241.216.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.216.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLcJH461MVgJ0EQrKNRogAAAI4"]
[Tue Dec 30 03:53:38.971893 2025] [:error] [pid 52780:tid 52857] [client 162.241.216.35:48356] [client 162.241.216.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.216.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLcQn461MVgJ0EQrKNRzAAAAIs"]
[Tue Dec 30 03:53:43.522761 2025] [:error] [pid 52778:tid 52798] [client 162.241.216.125:57168] [client 162.241.216.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.216.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLcRy4or8lqKDxAm7DkdwAAAA8"]
[Tue Dec 30 03:54:08.975363 2025] [:error] [pid 52947:tid 52958] [client 162.241.216.35:41828] [client 162.241.216.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.216.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLcYMxUl_PnGTme5hkdaAAAAMI"]
[Tue Dec 30 03:54:35.017391 2025] [:error] [pid 52779:tid 52823] [client 162.241.216.35:11152] [client 162.241.216.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.216.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLce5jnZoZEAOFrYgB0OgAAAEY"]
[Tue Dec 30 04:13:45.775967 2025] [:error] [pid 55827:tid 55835] [client 82.223.128.142:34684] [client 82.223.128.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.128.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLg-TGIC-EorhVIeG_HvAAAAMY"]
[Tue Dec 30 04:15:28.671070 2025] [:error] [pid 55827:tid 55836] [client 167.99.128.60:47878] [client 167.99.128.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.128.60, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLhYDGIC-EorhVIeG_I4gAAAMc"]
[Tue Dec 30 04:25:10.997916 2025] [:error] [pid 21424:tid 21443] [client 184.168.111.27:63228] [client 184.168.111.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.111.27, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLjpv6vZjHcdZm1ozCXXQAAARE"]
[Tue Dec 30 04:39:32.929966 2025] [:error] [pid 21424:tid 21434] [client 173.231.229.252:53680] [client 173.231.229.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.231.229.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLnBP6vZjHcdZm1ozCcJgAAAQg"]
[Tue Dec 30 04:45:25.364403 2025] [:error] [pid 55724:tid 55786] [client 118.139.181.212:61328] [client 118.139.181.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.139.181.212, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLoZf2xaJh1srfKTGRVwwAAAIE"]
[Tue Dec 30 04:49:28.023918 2025] [:error] [pid 55724:tid 55792] [client 162.241.218.100:15728] [client 162.241.218.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.218.100, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLpWP2xaJh1srfKTGRWewAAAIc"]
[Tue Dec 30 04:50:49.972512 2025] [:error] [pid 55722:tid 55782] [client 107.180.118.70:58270] [client 107.180.118.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.118.70, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLpqdAPH64hQFBaDRiLUQAAAFg"]
[Tue Dec 30 04:52:34.844217 2025] [:error] [pid 55724:tid 55789] [client 81.88.49.9:32431] [client 81.88.49.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLqEv2xaJh1srfKTGRXIAAAAIQ"]
[Tue Dec 30 04:54:11.868564 2025] [:error] [pid 21424:tid 21434] [client 185.50.25.16:64677] [client 185.50.25.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.50.25.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLqc_6vZjHcdZm1ozCgBAAAAQg"]
[Tue Dec 30 05:03:52.028076 2025] [:error] [pid 21424:tid 21434] [client 78.47.8.109:56144] [client 78.47.8.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.47.8.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLsuP6vZjHcdZm1ozCitAAAAQg"]
[Tue Dec 30 05:06:54.579664 2025] [:error] [pid 55827:tid 55832] [client 185.66.250.51:39510] [client 185.66.250.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.66.250.51, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLtbjGIC-EorhVIeG_SXwAAAMM"]
[Tue Dec 30 05:11:20.123564 2025] [:error] [pid 55722:tid 55776] [client 137.184.64.22:59500] [client 137.184.64.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.64.22, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLueNAPH64hQFBaDRiOXwAAAFI"]
[Tue Dec 30 05:19:49.502271 2025] [:error] [pid 55827:tid 55831] [client 66.175.235.134:56888] [client 66.175.235.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.175.235.134, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLwdTGIC-EorhVIeG_UgwAAAMI"]
[Tue Dec 30 05:29:46.979758 2025] [:error] [pid 55721:tid 55748] [client 162.241.230.122:50098] [client 162.241.230.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.230.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVLyyj7Pjf1FlL091oWiMwAAABE"]
[Tue Dec 30 05:42:19.853022 2025] [:error] [pid 55827:tid 55831] [client 106.119.167.146:52641] [client 106.119.167.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVL1uzGIC-EorhVIeG_X8QAAAMI"]
[Tue Dec 30 05:57:21.315212 2025] [:error] [pid 55827:tid 55846] [client 141.94.206.106:55056] [client 141.94.206.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.206.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVL5QTGIC-EorhVIeG_cMAAAANE"]
[Tue Dec 30 06:10:17.010325 2025] [:error] [pid 55721:tid 55733] [client 188.166.178.247:59366] [client 188.166.178.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.178.247, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVL8ST7Pjf1FlL091oWrYgAAAAI"]
[Tue Dec 30 06:21:00.711393 2025] [:error] [pid 55722:tid 55759] [client 103.8.127.155:48188] [client 103.8.127.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.8.127.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVL-zNAPH64hQFBaDRibLQAAAEE"]
[Tue Dec 30 06:26:15.447866 2025] [:error] [pid 55722:tid 55759] [client 148.72.119.138:25088] [client 148.72.119.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.119.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVMAB9APH64hQFBaDRibxwAAAEE"]
[Tue Dec 30 06:37:19.231487 2025] [:error] [pid 55722:tid 55761] [client 192.169.145.40:20034] [client 192.169.145.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.169.145.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVMCn9APH64hQFBaDRidlQAAAEM"]
[Tue Dec 30 06:46:36.990759 2025] [:error] [pid 55724:tid 55790] [client 162.241.216.146:40358] [client 162.241.216.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.216.146, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVMEzP2xaJh1srfKTGRxcQAAAIU"]
[Tue Dec 30 06:48:29.437844 2025] [:error] [pid 21424:tid 21444] [client 159.65.202.60:45264] [client 159.65.202.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.202.60, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVMFPf6vZjHcdZm1ozDDNgAAARI"]
[Tue Dec 30 07:09:03.508858 2025] [:error] [pid 55722:tid 55768] [client 171.252.41.213:58208] [client 171.252.41.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.252.41.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVMKD9APH64hQFBaDRijdQAAAEo"]
[Tue Dec 30 07:10:48.061007 2025] [:error] [pid 55827:tid 55849] [client 213.55.96.152:57326] [client 213.55.96.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.55.96.152, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVMKeDGIC-EorhVIeG_vjQAAANQ"]
[Tue Dec 30 07:31:56.647898 2025] [:error] [pid 55722:tid 55767] [client 70.68.224.110:63148] [client 70.68.224.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.68.224.110, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVMPbNAPH64hQFBaDRippAAAAEk"]
[Tue Dec 30 08:06:22.443975 2025] [:error] [pid 21424:tid 21444] [client 192.169.150.120:48564] [client 192.169.150.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.169.150.120, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVMXfv6vZjHcdZm1ozDg-QAAARI"]
[Tue Dec 30 08:16:16.166776 2025] [:error] [pid 55827:tid 55844] [client 103.78.97.230:37523] [client 103.78.97.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.78.97.230, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVMZ0DGIC-EorhVIeG8BlAAAAM8"]
[Tue Dec 30 08:18:19.712626 2025] [:error] [pid 55827:tid 55834] [client 43.153.102.138:48938] [client 43.153.102.138] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVMaSzGIC-EorhVIeG8CMQAAAMU"]
[Tue Dec 30 08:46:17.665211 2025] [:error] [pid 21424:tid 21441] [client 103.75.184.31:53308] [client 103.75.184.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.75.184.31, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVMg2f6vZjHcdZm1ozDwvgAAAQ8"]
[Tue Dec 30 08:56:28.530227 2025] [:error] [pid 55721:tid 55745] [client 185.29.24.253:46530] [client 185.29.24.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.29.24.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVMjPD7Pjf1FlL091oXQZwAAAA4"]
[Tue Dec 30 09:03:40.926425 2025] [:error] [pid 21424:tid 21429] [client 92.52.223.211:64280] [client 92.52.223.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.52.223.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVMk7P6vZjHcdZm1ozD2mAAAAQM"]
[Tue Dec 30 09:15:27.078777 2025] [:error] [pid 55722:tid 55768] [client 171.252.41.213:47380] [client 171.252.41.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.252.41.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVMnr9APH64hQFBaDRjCjAAAAEo"]
[Tue Dec 30 09:35:36.685256 2025] [:error] [pid 28954:tid 28961] [client 92.205.55.71:33716] [client 92.205.55.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.55.71, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVMsaKRZgqk7uuu8M0ynBQAAAAU"]
[Tue Dec 30 10:44:28.056105 2025] [:error] [pid 38777:tid 38803] [client 216.250.12.125:55436] [client 216.250.12.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.250.12.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVM8jGLn9GPxJXPhnHZ25QAAAFc"]
[Tue Dec 30 11:04:28.774717 2025] [:error] [pid 38777:tid 38791] [client 43.133.253.253:34862] [client 43.133.253.253] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVNBPGLn9GPxJXPhnHZ9BgAAAEs"]
[Tue Dec 30 11:53:57.023279 2025] [:error] [pid 28824:tid 28845] [client 160.250.64.132:36804] [client 160.250.64.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.64.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVNM1X8FhtgLvBhuCR3u5AAAAIA"]
[Tue Dec 30 11:53:58.632716 2025] [:error] [pid 38777:tid 38803] [client 195.26.251.124:50632] [client 195.26.251.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.26.251.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVNM1mLn9GPxJXPhnHaOcgAAAFc"]
[Tue Dec 30 12:34:10.714714 2025] [:error] [pid 28954:tid 28978] [client 160.250.64.132:53348] [client 160.250.64.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.64.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVNWQqRZgqk7uuu8M0zaFgAAABY"]
[Tue Dec 30 12:45:12.060439 2025] [:error] [pid 28954:tid 28958] [client 137.74.192.205:41728] [client 137.74.192.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.74.192.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVNY2KRZgqk7uuu8M0zd5wAAAAI"]
[Tue Dec 30 12:47:50.269259 2025] [:error] [pid 38777:tid 38802] [client 162.241.252.17:29264] [client 162.241.252.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.252.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVNZdmLn9GPxJXPhnHalugAAAFY"]
[Tue Dec 30 12:52:02.919958 2025] [:error] [pid 28824:tid 28855] [client 66.175.44.36:43886] [client 66.175.44.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.175.44.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVNacn8FhtgLvBhuCR3-RwAAAIo"]
[Tue Dec 30 13:09:19.979937 2025] [:error] [pid 38777:tid 38788] [client 103.77.107.57:62936] [client 103.77.107.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aVNef2Ln9GPxJXPhnHaufQAAAEg"]
[Tue Dec 30 13:09:20.652211 2025] [:error] [pid 28954:tid 28963] [client 103.77.107.57:63342] [client 103.77.107.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aVNegKRZgqk7uuu8M0zknAAAAAc"]
[Tue Dec 30 13:12:15.939771 2025] [:error] [pid 28826:tid 28914] [client 208.109.20.122:12346] [client 208.109.20.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.109.20.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVNfL_OyQggePm1Ed9tIPAAAAQg"]
[Tue Dec 30 13:24:04.406906 2025] [:error] [pid 28825:tid 28888] [client 81.88.49.14:38418] [client 81.88.49.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVNh9D6dbc1G2hX-KfQQkAAAAMk"]
[Tue Dec 30 13:33:21.332425 2025] [:error] [pid 28954:tid 28975] [client 45.133.117.105:36588] [client 45.133.117.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.133.117.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVNkIaRZgqk7uuu8M0zqCwAAABM"]
[Tue Dec 30 13:43:35.234287 2025] [:error] [pid 28824:tid 28866] [client 81.88.49.28:60200] [client 81.88.49.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVNmh38FhtgLvBhuCR0H2AAAAJU"]
[Tue Dec 30 13:46:58.068158 2025] [:error] [pid 28954:tid 28961] [client 208.109.226.19:63044] [client 208.109.226.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.109.226.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVNnUqRZgqk7uuu8M0ztmQAAAAU"]
[Tue Dec 30 13:48:40.249631 2025] [:error] [pid 28954:tid 28968] [client 190.107.177.36:48936] [client 190.107.177.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.107.177.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVNnuKRZgqk7uuu8M0zuCgAAAAw"]
[Tue Dec 30 13:56:29.578259 2025] [:error] [pid 28954:tid 28967] [client 162.213.209.162:51270] [client 162.213.209.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.213.209.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVNpjaRZgqk7uuu8M0zwWQAAAAs"]
[Tue Dec 30 14:07:44.742879 2025] [:error] [pid 38777:tid 38790] [client 162.241.217.12:36396] [client 162.241.217.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.217.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVNsMGLn9GPxJXPhnHbC7gAAAEo"]
[Tue Dec 30 14:15:42.276464 2025] [:error] [pid 28826:tid 28913] [client 92.205.8.235:34270] [client 92.205.8.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.8.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVNuDvOyQggePm1Ed9tWFgAAAQc"]
[Tue Dec 30 14:25:20.824672 2025] [:error] [pid 38777:tid 38786] [client 159.203.174.123:44522] [client 159.203.174.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.174.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVNwUGLn9GPxJXPhnHbJewAAAEY"]
[Tue Dec 30 14:49:14.377018 2025] [:error] [pid 38777:tid 38801] [client 43.155.188.157:55898] [client 43.155.188.157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVN16mLn9GPxJXPhnHbQxQAAAFU"]
[Tue Dec 30 14:54:09.169085 2025] [:error] [pid 28826:tid 28925] [client 81.88.49.14:54013] [client 81.88.49.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVN3EfOyQggePm1Ed9teXQAAARI"]
[Tue Dec 30 15:10:17.390472 2025] [:error] [pid 28826:tid 28923] [client 92.205.151.24:52236] [client 92.205.151.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.151.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVN62fOyQggePm1Ed9tg1gAAARA"]
[Tue Dec 30 15:16:20.337188 2025] [:error] [pid 28824:tid 28845] [client 31.33.182.48:48723] [client 31.33.182.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.33.182.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVN8RH8FhtgLvBhuCR0Y8AAAAIA"]
[Tue Dec 30 15:36:16.942646 2025] [:error] [pid 28826:tid 28908] [client 103.65.236.149:55221] [client 103.65.236.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aVOA8POyQggePm1Ed9tmvAAAAQI"]
[Tue Dec 30 15:53:46.356617 2025] [:error] [pid 47553:tid 47569] [client 81.88.49.14:54570] [client 81.88.49.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVOFCrvhy9HerwSnwITBsgAAAY4"]
[Tue Dec 30 15:53:59.927193 2025] [:error] [pid 28954:tid 28976] [client 103.191.240.196:33820] [client 103.191.240.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.191.240.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVOFF6RZgqk7uuu8M0wKWwAAABQ"]
[Tue Dec 30 16:06:15.971103 2025] [:error] [pid 38777:tid 38795] [client 66.29.147.6:34154] [client 66.29.147.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.29.147.6, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVOH92Ln9GPxJXPhnHbkIQAAAE8"]
[Tue Dec 30 16:07:45.600707 2025] [:error] [pid 28954:tid 28972] [client 184.168.107.122:63702] [client 184.168.107.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.107.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVOIUaRZgqk7uuu8M0wMnQAAABA"]
[Tue Dec 30 16:08:25.974545 2025] [:error] [pid 47441:tid 47450] [client 162.241.218.214:24556] [client 162.241.218.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.218.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVOIeS6d2esGSN6Ne3MbMwAAAUY"]
[Tue Dec 30 16:19:42.082701 2025] [:error] [pid 47553:tid 47572] [client 50.62.139.47:51190] [client 50.62.139.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.62.139.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVOLHrvhy9HerwSnwITGtAAAAZE"]
[Tue Dec 30 16:32:11.713278 2025] [:error] [pid 47553:tid 47566] [client 209.38.100.31:46038] [client 209.38.100.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.38.100.31, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVOOC7vhy9HerwSnwITJuQAAAYs"]
[Tue Dec 30 16:59:20.636523 2025] [:error] [pid 47553:tid 47558] [client 45.12.18.180:49268] [client 45.12.18.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.12.18.180, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVOUaLvhy9HerwSnwITP0wAAAYM"]
[Tue Dec 30 17:04:19.253048 2025] [:error] [pid 47441:tid 47455] [client 104.28.246.115:61662] [client 104.28.246.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aVOVky6d2esGSN6Ne3Mk2gAAAUs"]
[Tue Dec 30 17:15:34.768546 2025] [:error] [pid 28826:tid 28921] [client 141.98.11.117:37018] [client 141.98.11.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.98.11.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVOYNvOyQggePm1Ed9t12QAAAQ4"]
[Tue Dec 30 17:21:34.010812 2025] [:error] [pid 47441:tid 47464] [client 132.148.177.55:39226] [client 132.148.177.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.177.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVOZni6d2esGSN6Ne3MpKAAAAVQ"]
[Tue Dec 30 17:37:56.537977 2025] [:error] [pid 47441:tid 47449] [client 177.107.162.141:59601] [client 177.107.162.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.107.162.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVOddC6d2esGSN6Ne3MsGQAAAUU"]
[Tue Dec 30 17:53:33.481194 2025] [:error] [pid 38777:tid 38791] [client 89.117.22.139:60692] [client 89.117.22.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.117.22.139, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVOhHWLn9GPxJXPhnHb2eQAAAEs"]
[Tue Dec 30 18:46:49.971262 2025] [:error] [pid 38777:tid 38799] [client 34.124.147.91:36388] [client 34.124.147.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.124.147.91, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVOtmWLn9GPxJXPhnHYAqwAAAFM"]
[Tue Dec 30 19:34:25.449742 2025] [:error] [pid 28824:tid 28866] [client 177.107.162.141:55788] [client 177.107.162.141] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aVO4wX8FhtgLvBhuCR1BygAAAJU"]
[Tue Dec 30 19:35:49.286143 2025] [:error] [pid 47553:tid 47573] [client 177.107.162.141:63067] [client 177.107.162.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.107.162.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVO5Fbvhy9HerwSnwIT-NwAAAZI"]
[Tue Dec 30 19:37:02.691662 2025] [:error] [pid 47441:tid 47456] [client 177.107.162.141:50136] [client 177.107.162.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.107.162.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVO5Xi6d2esGSN6Ne3NIJwAAAUw"]
[Tue Dec 30 19:38:09.064825 2025] [:error] [pid 28825:tid 28892] [client 177.107.162.141:54132] [client 177.107.162.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.107.162.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVO5oT6dbc1G2hX-KfRRPgAAAM0"]
[Tue Dec 30 19:39:15.287004 2025] [:error] [pid 28824:tid 28859] [client 177.107.162.141:54750] [client 177.107.162.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.107.162.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVO5438FhtgLvBhuCR1CxQAAAI4"]
[Tue Dec 30 19:40:16.833764 2025] [:error] [pid 28954:tid 28976] [client 177.107.162.141:61467] [client 177.107.162.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.107.162.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVO6IKRZgqk7uuu8M0wyawAAABQ"]
[Tue Dec 30 20:32:47.648144 2025] [:error] [pid 47441:tid 47467] [client 141.94.206.106:56858] [client 141.94.206.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.94.206.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVPGby6d2esGSN6Ne3NUTQAAAVc"]
[Tue Dec 30 20:54:14.825886 2025] [:error] [pid 28954:tid 28961] [client 103.77.106.57:54046] [client 103.77.106.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/postnews.php"] [unique_id "aVPLdqRZgqk7uuu8M0w-FgAAAAU"]
[Tue Dec 30 20:54:17.533085 2025] [:error] [pid 28824:tid 28848] [client 103.77.106.57:54460] [client 103.77.106.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/postnews.php"] [unique_id "aVPLeX8FhtgLvBhuCR1MyAAAAIM"]
[Tue Dec 30 20:54:20.445438 2025] [:error] [pid 28824:tid 28846] [client 103.77.106.57:54978] [client 103.77.106.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/postnews.php"] [unique_id "aVPLfH8FhtgLvBhuCR1M8AAAAIE"]
[Tue Dec 30 21:12:45.517993 2025] [:error] [pid 38777:tid 38804] [client 70.68.224.110:57836] [client 70.68.224.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.68.224.110, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVPPzWLn9GPxJXPhnHYcVwAAAFg"]
[Tue Dec 30 22:21:32.821631 2025] [:error] [pid 47553:tid 47557] [client 46.62.194.3:40494] [client 46.62.194.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.62.194.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVPf7Lvhy9HerwSnwIQjyAAAAYI"]
[Tue Dec 30 23:16:38.072933 2025] [:error] [pid 28825:tid 28901] [client 82.223.101.71:37336] [client 82.223.101.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.101.71, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVPs1j6dbc1G2hX-KfR02wAAANY"]
[Tue Dec 30 23:47:44.015832 2025] [:error] [pid 47553:tid 47572] [client 223.130.6.246:38194] [client 223.130.6.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.130.6.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVP0ILvhy9HerwSnwIQ4mwAAAZE"]
[Tue Dec 30 23:53:16.560872 2025] [:error] [pid 38777:tid 38794] [client 103.78.97.230:19753] [client 103.78.97.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.78.97.230, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVP1bGLn9GPxJXPhnHY-pgAAAE4"]
[Tue Dec 30 23:56:41.159156 2025] [:error] [pid 47441:tid 47452] [client 148.72.83.206:17800] [client 148.72.83.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.83.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVP2OS6d2esGSN6Ne3ONpQAAAUg"]
[Wed Dec 31 00:09:59.913462 2025] [:error] [pid 50266:tid 50275] [client 95.223.75.153:51424] [client 95.223.75.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.223.75.153, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVP5V_w6SPY9puCUnH9XWgAAAEc"]
[Wed Dec 31 00:11:26.609957 2025] [:error] [pid 49981:tid 49993] [client 14.215.163.132:40278] [client 14.215.163.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVP5rpCCXHPw9uuzhExOrQAAAIg"]
[Wed Dec 31 00:19:34.128299 2025] [:error] [pid 50068:tid 50094] [client 66.175.44.36:56332] [client 66.175.44.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.175.44.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVP7lvJem-CRnWG3ZuxjXgAAABg"]
[Wed Dec 31 00:33:23.902232 2025] [:error] [pid 50068:tid 50081] [client 198.23.217.37:44770] [client 198.23.217.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.23.217.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVP-0_Jem-CRnWG3ZuxqagAAAAs"]
[Wed Dec 31 00:52:56.679222 2025] [:error] [pid 49981:tid 49986] [client 132.148.176.68:50384] [client 132.148.176.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.176.68, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQDaJCCXHPw9uuzhExcbgAAAIE"]
[Wed Dec 31 00:54:23.812716 2025] [:error] [pid 1651:tid 1710] [client 82.165.88.198:49282] [client 82.165.88.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.88.198, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQDv3AnYt-Xi20L7fDjIAAAAVM"]
[Wed Dec 31 01:00:20.789675 2025] [:error] [pid 1651:tid 1691] [client 198.12.236.100:58220] [client 198.12.236.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.12.236.100, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQFJHAnYt-Xi20L7fDlugAAAUA"]
[Wed Dec 31 01:06:26.726251 2025] [:error] [pid 50266:tid 50275] [client 217.125.100.230:57546] [client 217.125.100.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.125.100.230, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQGkvw6SPY9puCUnH9zJwAAAEc"]
[Wed Dec 31 01:12:30.376656 2025] [:error] [pid 49982:tid 50025] [client 45.63.121.33:60296] [client 45.63.121.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.63.121.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQH_iFJSHqasQiscZ7kBAAAAMo"]
[Wed Dec 31 01:18:08.381718 2025] [:error] [pid 49983:tid 50048] [client 198.12.247.6:59538] [client 198.12.247.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.12.247.6, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQJUGiL1pay2WifcvaNtgAAAQY"]
[Wed Dec 31 01:20:49.040865 2025] [:error] [pid 49983:tid 50051] [client 162.0.217.163:38200] [client 162.0.217.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.0.217.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQJ8WiL1pay2WifcvaOTgAAAQk"]
[Wed Dec 31 01:27:51.279354 2025] [:error] [pid 49981:tid 49985] [client 103.57.220.209:42304] [client 103.57.220.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.57.220.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQLl5CCXHPw9uuzhExmwwAAAIA"]
[Wed Dec 31 01:49:38.839208 2025] [:error] [pid 49983:tid 50062] [client 148.72.63.35:54528] [client 148.72.63.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.63.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQQsmiL1pay2WifcvaYGQAAARQ"]
[Wed Dec 31 01:51:33.964659 2025] [:error] [pid 50266:tid 50279] [client 192.169.164.45:50778] [client 192.169.164.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.169.164.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQRJfw6SPY9puCUnH-FZAAAAEs"]
[Wed Dec 31 01:51:33.966470 2025] [:error] [pid 50266:tid 50279] [client 192.169.164.45:50778] [client 192.169.164.45] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQRJfw6SPY9puCUnH-FZAAAAEs"]
[Wed Dec 31 01:51:33.967736 2025] [:error] [pid 50266:tid 50279] [client 192.169.164.45:50778] [client 192.169.164.45] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQRJfw6SPY9puCUnH-FZAAAAEs"]
[Wed Dec 31 02:06:21.608020 2025] [:error] [pid 1651:tid 1692] [client 208.109.19.214:48796] [client 208.109.19.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.109.19.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQUnXAnYt-Xi20L7fAFKQAAAUE"]
[Wed Dec 31 02:06:21.610490 2025] [:error] [pid 1651:tid 1692] [client 208.109.19.214:48796] [client 208.109.19.214] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQUnXAnYt-Xi20L7fAFKQAAAUE"]
[Wed Dec 31 02:06:21.612287 2025] [:error] [pid 1651:tid 1692] [client 208.109.19.214:48796] [client 208.109.19.214] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQUnXAnYt-Xi20L7fAFKQAAAUE"]
[Wed Dec 31 02:12:46.343212 2025] [:error] [pid 49982:tid 50024] [client 148.72.63.35:36320] [client 148.72.63.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.63.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQWHiFJSHqasQiscZ72mAAAAMk"]
[Wed Dec 31 02:14:20.109344 2025] [:error] [pid 50266:tid 50275] [client 160.191.139.197:40746] [client 160.191.139.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.191.139.197, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQWfPw6SPY9puCUnH-NgAAAAEc"]
[Wed Dec 31 02:14:20.110941 2025] [:error] [pid 50266:tid 50275] [client 160.191.139.197:40746] [client 160.191.139.197] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQWfPw6SPY9puCUnH-NgAAAAEc"]
[Wed Dec 31 02:14:20.112080 2025] [:error] [pid 50266:tid 50275] [client 160.191.139.197:40746] [client 160.191.139.197] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQWfPw6SPY9puCUnH-NgAAAAEc"]
[Wed Dec 31 02:30:27.003280 2025] [:error] [pid 50068:tid 50079] [client 69.197.191.106:50280] [client 69.197.191.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.197.191.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQaQ_Jem-CRnWG3ZuyUTgAAAAk"]
[Wed Dec 31 02:30:27.004939 2025] [:error] [pid 50068:tid 50079] [client 69.197.191.106:50280] [client 69.197.191.106] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQaQ_Jem-CRnWG3ZuyUTgAAAAk"]
[Wed Dec 31 02:30:27.006121 2025] [:error] [pid 50068:tid 50079] [client 69.197.191.106:50280] [client 69.197.191.106] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQaQ_Jem-CRnWG3ZuyUTgAAAAk"]
[Wed Dec 31 02:31:21.828110 2025] [:error] [pid 50266:tid 50271] [client 208.109.61.84:60232] [client 208.109.61.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.109.61.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQaefw6SPY9puCUnH-VXwAAAEM"]
[Wed Dec 31 02:31:21.829716 2025] [:error] [pid 50266:tid 50271] [client 208.109.61.84:60232] [client 208.109.61.84] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQaefw6SPY9puCUnH-VXwAAAEM"]
[Wed Dec 31 02:31:21.830967 2025] [:error] [pid 50266:tid 50271] [client 208.109.61.84:60232] [client 208.109.61.84] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQaefw6SPY9puCUnH-VXwAAAEM"]
[Wed Dec 31 02:41:01.626657 2025] [:error] [pid 1651:tid 1701] [client 66.175.44.31:43622] [client 66.175.44.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.175.44.31, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQcvXAnYt-Xi20L7fAWWgAAAUo"]
[Wed Dec 31 02:41:01.628206 2025] [:error] [pid 1651:tid 1701] [client 66.175.44.31:43622] [client 66.175.44.31] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQcvXAnYt-Xi20L7fAWWgAAAUo"]
[Wed Dec 31 02:41:01.629331 2025] [:error] [pid 1651:tid 1701] [client 66.175.44.31:43622] [client 66.175.44.31] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQcvXAnYt-Xi20L7fAWWgAAAUo"]
[Wed Dec 31 02:45:40.288824 2025] [:error] [pid 49983:tid 50054] [client 195.178.110.190:34794] [client 195.178.110.190] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aVQd1GiL1pay2WifcvapUgAAAQw"]
[Wed Dec 31 02:46:13.754488 2025] [:error] [pid 1651:tid 1699] [client 148.72.108.125:56314] [client 148.72.108.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.108.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQd9XAnYt-Xi20L7fAYmQAAAUg"]
[Wed Dec 31 02:46:13.755914 2025] [:error] [pid 1651:tid 1699] [client 148.72.108.125:56314] [client 148.72.108.125] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQd9XAnYt-Xi20L7fAYmQAAAUg"]
[Wed Dec 31 02:46:13.757013 2025] [:error] [pid 1651:tid 1699] [client 148.72.108.125:56314] [client 148.72.108.125] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQd9XAnYt-Xi20L7fAYmQAAAUg"]
[Wed Dec 31 02:50:25.518213 2025] [:error] [pid 49983:tid 50051] [client 141.148.202.33:42570] [client 141.148.202.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.148.202.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQe8WiL1pay2WifcvarWgAAAQk"]
[Wed Dec 31 02:53:10.532056 2025] [:error] [pid 50068:tid 50080] [client 43.130.60.195:49572] [client 43.130.60.195] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVQflvJem-CRnWG3ZuyblQAAAAo"]
[Wed Dec 31 02:53:56.549789 2025] [:error] [pid 49982:tid 50027] [client 148.72.108.125:45974] [client 148.72.108.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.108.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQfxCFJSHqasQiscZ4EkgAAAMw"]
[Wed Dec 31 02:55:13.672910 2025] [:error] [pid 50068:tid 50091] [client 132.148.182.30:44746] [client 132.148.182.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.182.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQgEfJem-CRnWG3ZuycXwAAABU"]
[Wed Dec 31 02:55:13.674760 2025] [:error] [pid 50068:tid 50091] [client 132.148.182.30:44746] [client 132.148.182.30] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQgEfJem-CRnWG3ZuycXwAAABU"]
[Wed Dec 31 02:55:13.676035 2025] [:error] [pid 50068:tid 50091] [client 132.148.182.30:44746] [client 132.148.182.30] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQgEfJem-CRnWG3ZuycXwAAABU"]
[Wed Dec 31 02:56:05.205251 2025] [:error] [pid 1651:tid 1707] [client 198.12.234.195:47048] [client 198.12.234.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.12.234.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQgRXAnYt-Xi20L7fAesgAAAVA"]
[Wed Dec 31 02:56:05.206797 2025] [:error] [pid 1651:tid 1707] [client 198.12.234.195:47048] [client 198.12.234.195] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQgRXAnYt-Xi20L7fAesgAAAVA"]
[Wed Dec 31 02:56:05.208012 2025] [:error] [pid 1651:tid 1707] [client 198.12.234.195:47048] [client 198.12.234.195] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQgRXAnYt-Xi20L7fAesgAAAVA"]
[Wed Dec 31 02:57:58.577249 2025] [autoindex:error] [pid 49983:tid 50042] [client 159.89.181.56:56835] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Dec 31 03:03:16.220741 2025] [:error] [pid 50068:tid 50080] [client 50.63.135.192:44766] [client 50.63.135.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.63.135.192, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQh9PJem-CRnWG3ZuyfGQAAAAo"]
[Wed Dec 31 03:03:45.294692 2025] [:error] [pid 50068:tid 50090] [client 81.88.49.39:16085] [client 81.88.49.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQiEfJem-CRnWG3ZuyfQQAAABQ"]
[Wed Dec 31 03:05:38.706097 2025] [:error] [pid 49982:tid 50029] [client 209.126.127.12:55994] [client 209.126.127.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.126.127.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQigiFJSHqasQiscZ4HvgAAAM4"]
[Wed Dec 31 03:14:39.559730 2025] [:error] [pid 50266:tid 50268] [client 198.12.232.89:37674] [client 198.12.232.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.12.232.89, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQkn_w6SPY9puCUnH-knAAAAEA"]
[Wed Dec 31 03:17:05.226469 2025] [:error] [pid 50068:tid 50083] [client 160.250.64.132:54960] [client 160.250.64.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.64.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQlMfJem-CRnWG3ZuykUwAAAA0"]
[Wed Dec 31 03:21:28.788885 2025] [:error] [pid 50068:tid 50087] [client 160.250.64.132:37408] [client 160.250.64.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.64.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQmOPJem-CRnWG3ZuymNQAAABE"]
[Wed Dec 31 03:36:13.439520 2025] [:error] [pid 29284:tid 29412] [client 141.98.11.117:50210] [client 141.98.11.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.98.11.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQprT9HLrvv2PbL-hu_XgAAAJY"]
[Wed Dec 31 03:37:05.074722 2025] [:error] [pid 29282:tid 29311] [client 72.167.86.200:43850] [client 72.167.86.200] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.167.86.200, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQp4c9cX31LoVGcDynMFwAAAAI"]
[Wed Dec 31 03:41:27.283026 2025] [:error] [pid 2342:tid 2357] [client 92.205.249.200:44468] [client 92.205.249.200] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.249.200, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQq526gs3L1agNQTsus9QAAAM0"]
[Wed Dec 31 03:49:59.460298 2025] [:error] [pid 33004:tid 33085] [client 162.241.226.115:55870] [client 162.241.226.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.226.115, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQs5_ogj9CrK-80KNzrDwAAAJQ"]
[Wed Dec 31 03:50:14.550614 2025] [:error] [pid 33003:tid 33053] [client 148.72.11.52:35206] [client 148.72.11.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.11.52, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQs9rOkdrCgTt0MxWK6eQAAAE8"]
[Wed Dec 31 03:54:43.811757 2025] [:error] [pid 33109:tid 33132] [client 94.23.209.194:54872] [client 94.23.209.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.23.209.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQuA8YN9k_fnLM-n46rowAAANU"]
[Wed Dec 31 04:11:16.684145 2025] [:error] [pid 33109:tid 33131] [client 147.182.200.95:48840] [client 147.182.200.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.200.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQx5MYN9k_fnLM-n460fAAAANQ"]
[Wed Dec 31 04:17:24.812471 2025] [:error] [pid 33003:tid 33058] [client 20.42.220.101:11258] [client 20.42.220.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.42.220.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQzVLOkdrCgTt0MxWLFCQAAAFQ"], referer: https://www.google.com/
[Wed Dec 31 04:17:31.407997 2025] [:error] [pid 33003:tid 33046] [client 20.42.220.101:11223] [client 20.42.220.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.42.220.101, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVQzW7OkdrCgTt0MxWLFGwAAAEg"], referer: https://duckduckgo.com/
[Wed Dec 31 04:17:33.090601 2025] [autoindex:error] [pid 33003:tid 33058] [client 20.42.220.101:11258] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Wed Dec 31 04:17:33.696116 2025] [autoindex:error] [pid 33003:tid 33049] [client 20.42.220.101:11258] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Wed Dec 31 04:17:37.977237 2025] [:error] [pid 33003:tid 33046] [client 20.42.220.101:11258] [client 20.42.220.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/cropper.php"] [unique_id "aVQzYbOkdrCgTt0MxWLFLgAAAEg"], referer: https://www.google.fr/
[Wed Dec 31 04:17:38.030361 2025] [:error] [pid 33003:tid 33042] [client 20.42.220.101:11233] [client 20.42.220.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/thickbox/thickbox.php"] [unique_id "aVQzYrOkdrCgTt0MxWLFLwAAAEQ"], referer: https://www.google.com/
[Wed Dec 31 04:17:39.359480 2025] [autoindex:error] [pid 33002:tid 33028] [client 20.42.220.101:11257] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Wed Dec 31 04:17:40.523558 2025] [:error] [pid 33004:tid 33089] [client 20.42.220.101:11256] [client 20.42.220.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.42.220.101, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVQzZPogj9CrK-80KNz2awAAAJg"], referer: https://www.bing.com/
[Wed Dec 31 04:17:41.628186 2025] [autoindex:error] [pid 33002:tid 33019] [client 20.42.220.101:11257] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Wed Dec 31 04:17:42.259808 2025] [:error] [pid 33002:tid 33013] [client 20.42.220.101:11257] [client 20.42.220.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aVQzZvnsZEcORmTFnriLegAAAAI"], referer: https://www.yahoo.com/
[Wed Dec 31 04:17:42.291090 2025] [:error] [pid 33004:tid 33085] [client 20.42.220.101:11215] [client 20.42.220.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aVQzZvogj9CrK-80KNz2cQAAAJQ"], referer: https://www.google.fr/
[Wed Dec 31 04:17:42.352579 2025] [autoindex:error] [pid 33004:tid 33080] [client 20.42.220.101:11255] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Wed Dec 31 04:17:42.367954 2025] [:error] [pid 33004:tid 33081] [client 20.42.220.101:11255] [client 20.42.220.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aVQzZvogj9CrK-80KNz2dAAAAJA"], referer: https://www.google.de/
[Wed Dec 31 04:17:42.403429 2025] [:error] [pid 33003:tid 33048] [client 20.42.220.101:11238] [client 20.42.220.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aVQzZrOkdrCgTt0MxWLFNAAAAEo"], referer: https://www.google.co.uk/
[Wed Dec 31 04:18:53.097704 2025] [:error] [pid 33004:tid 33073] [client 185.150.190.222:33232] [client 185.150.190.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.150.190.222, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQzrfogj9CrK-80KNz2_QAAAIg"]
[Wed Dec 31 04:19:15.016802 2025] [:error] [pid 33002:tid 33026] [client 107.180.114.28:33724] [client 107.180.114.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.114.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQzw_nsZEcORmTFnriMHQAAAA8"]
[Wed Dec 31 04:30:56.301784 2025] [:error] [pid 33002:tid 33012] [client 104.7.227.11:55072] [client 104.7.227.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.7.227.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQ2gPnsZEcORmTFnriQ0gAAAAE"]
[Wed Dec 31 04:50:26.581975 2025] [:error] [pid 33003:tid 33049] [client 192.169.150.212:62480] [client 192.169.150.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.169.150.212, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQ7ErOkdrCgTt0MxWLRzwAAAEs"]
[Wed Dec 31 04:51:45.544469 2025] [:error] [pid 33004:tid 33065] [client 148.72.106.136:54850] [client 148.72.106.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.106.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQ7Yfogj9CrK-80KNwD1gAAAIA"]
[Wed Dec 31 05:00:32.638425 2025] [:error] [pid 33109:tid 33118] [client 82.165.88.82:58686] [client 82.165.88.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.88.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVQ9cMYN9k_fnLM-n47QLQAAAMc"]
[Wed Dec 31 05:11:37.567581 2025] [:error] [pid 33004:tid 33088] [client 77.238.120.100:55004] [client 77.238.120.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.238.120.100, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRACfogj9CrK-80KNwLCQAAAJc"]
[Wed Dec 31 05:12:20.619283 2025] [:error] [pid 33004:tid 33083] [client 95.169.180.53:39516] [client 95.169.180.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.169.180.53, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRANPogj9CrK-80KNwLLQAAAJI"]
[Wed Dec 31 05:29:50.918064 2025] [:error] [pid 33109:tid 33120] [client 97.74.189.207:37324] [client 97.74.189.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 97.74.189.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRETsYN9k_fnLM-n47gpwAAAMk"]
[Wed Dec 31 05:36:44.464396 2025] [:error] [pid 33003:tid 33058] [client 216.69.167.185:26448] [client 216.69.167.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.69.167.185, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRF7LOkdrCgTt0MxWLipAAAAFQ"]
[Wed Dec 31 05:39:03.044675 2025] [:error] [pid 33109:tid 33128] [client 211.237.0.212:39930] [client 211.237.0.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.237.0.212, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRGd8YN9k_fnLM-n47lKAAAANE"]
[Wed Dec 31 06:07:35.022812 2025] [:error] [pid 33003:tid 33061] [client 203.2.64.59:50425] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVRNJ7OkdrCgTt0MxWLvQwAAAFc"]
[Wed Dec 31 06:31:11.838082 2025] [:error] [pid 33002:tid 33026] [client 57.128.117.142:51752] [client 57.128.117.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 57.128.117.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRSr_nsZEcORmTFnri_gAAAAA8"]
[Wed Dec 31 06:32:16.110508 2025] [:error] [pid 33003:tid 33043] [client 148.72.61.162:35752] [client 148.72.61.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.61.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRS8LOkdrCgTt0MxWL5_QAAAEU"]
[Wed Dec 31 06:37:43.060053 2025] [:error] [pid 26113:tid 26115] [client 66.175.44.24:38968] [client 66.175.44.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.175.44.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRUNyU0NRJ9y9rL1aXTAQAAAQA"]
[Wed Dec 31 06:43:13.589963 2025] [:error] [pid 33004:tid 33070] [client 81.88.49.15:26189] [client 81.88.49.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRVgfogj9CrK-80KNwzRgAAAIU"]
[Wed Dec 31 06:48:09.785255 2025] [:error] [pid 42536:tid 42542] [client 70.68.224.110:60183] [client 70.68.224.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.68.224.110, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVRWqQY1iaVE0V_WQ58_QgAAAUQ"]
[Wed Dec 31 06:49:48.322030 2025] [:error] [pid 42504:tid 42509] [client 61.12.66.2:36140] [client 61.12.66.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 61.12.66.2, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRXDFg0lj8Dy7rLxBDn-QAAAQI"]
[Wed Dec 31 06:50:23.945050 2025] [:error] [pid 42536:tid 42560] [client 68.183.235.102:44490] [client 68.183.235.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.235.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRXLwY1iaVE0V_WQ59AvQAAAVY"]
[Wed Dec 31 06:54:06.667660 2025] [:error] [pid 42410:tid 42448] [client 74.222.168.76:32834] [client 74.222.168.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.222.168.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRYDo88GyeTD4x6y_nR6gAAAIk"]
[Wed Dec 31 06:54:10.370737 2025] [:error] [pid 42504:tid 42531] [client 209.38.73.139:44320] [client 209.38.73.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.38.73.139, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRYElg0lj8Dy7rLxBDqqQAAARg"]
[Wed Dec 31 07:08:18.369091 2025] [:error] [pid 42536:tid 42555] [client 103.191.241.194:40708] [client 103.191.241.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.191.241.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRbYgY1iaVE0V_WQ59LKwAAAVE"]
[Wed Dec 31 07:10:59.353948 2025] [:error] [pid 42536:tid 42555] [client 132.148.176.33:63492] [client 132.148.176.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.176.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRcAwY1iaVE0V_WQ59MowAAAVE"]
[Wed Dec 31 07:24:40.207519 2025] [:error] [pid 42504:tid 42515] [client 104.7.227.11:44636] [client 104.7.227.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.7.227.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRfOFg0lj8Dy7rLxBD3ewAAAQg"]
[Wed Dec 31 07:31:33.257284 2025] [:error] [pid 46814:tid 46838] [client 92.204.19.248:48838] [client 92.204.19.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.204.19.248, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRg1Sb1xN9EDaw4QDvgDwAAABY"]
[Wed Dec 31 07:33:36.068094 2025] [:error] [pid 42410:tid 42445] [client 198.23.217.37:35466] [client 198.23.217.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.23.217.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRhUI88GyeTD4x6y_newQAAAIY"]
[Wed Dec 31 07:44:07.606473 2025] [:error] [pid 57143:tid 57169] [client 92.205.248.83:37820] [client 92.205.248.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.248.83, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRjx5aPGzW-sFdGwAk28AAAANc"]
[Wed Dec 31 07:51:18.961380 2025] [:error] [pid 57070:tid 57082] [client 103.75.184.31:51722] [client 103.75.184.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.75.184.31, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRldmH9Bg9ixJObtDSdqAAAAEo"]
[Wed Dec 31 08:03:40.405601 2025] [:error] [pid 57205:tid 57228] [client 74.249.100.70:56488] [client 74.249.100.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.249.100.70, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRoXN_4-Smo-jE-MHqigAAAABU"]
[Wed Dec 31 08:06:54.967283 2025] [:error] [pid 57144:tid 57195] [client 70.68.224.110:60687] [client 70.68.224.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.68.224.110, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVRpHooIYDHY2wNlFkoOcAAAAVY"]
[Wed Dec 31 08:10:13.751464 2025] [:error] [pid 57143:tid 57156] [client 185.2.4.126:49812] [client 185.2.4.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.2.4.126, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRp5ZaPGzW-sFdGwAlAIAAAAMo"]
[Wed Dec 31 08:17:59.156119 2025] [:error] [pid 57205:tid 57226] [client 72.167.86.200:21992] [client 72.167.86.200] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.167.86.200, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVRrt9_4-Smo-jE-MHqpAQAAABM"]
[Wed Dec 31 08:59:14.727996 2025] [:error] [pid 16684:tid 16705] [client 92.204.22.6:57878] [client 92.204.22.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.204.22.6, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVR1YrZeLeBmAW2ox81_KwAAABM"]
[Wed Dec 31 09:06:28.008629 2025] [:error] [pid 16595:tid 16611] [client 85.214.10.56:41146] [client 85.214.10.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.10.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVR3FB2U4739SwCJDZRbhQAAAEs"]
[Wed Dec 31 09:10:28.230497 2025] [:error] [pid 20453:tid 20468] [client 148.113.35.194:36412] [client 148.113.35.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.35.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVR4BLb_Ay51rPEgph7BPAAAAEw"]
[Wed Dec 31 09:11:40.740741 2025] [:error] [pid 20393:tid 20440] [client 148.72.60.202:38634] [client 148.72.60.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.60.202, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVR4THuGuKBG-pGMRJ60CwAAABE"]
[Wed Dec 31 09:39:22.569748 2025] [:error] [pid 20484:tid 20507] [client 162.241.216.35:41092] [client 162.241.216.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.216.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVR-yphjQxR09ihThyTtNgAAARU"]
[Wed Dec 31 09:43:08.279238 2025] [:error] [pid 20392:tid 20397] [client 213.55.96.153:48024] [client 213.55.96.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.55.96.153, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVR_rCv3LtZlH2fDnmRtEgAAAMI"]
[Wed Dec 31 09:59:01.212446 2025] [:error] [pid 20392:tid 20397] [client 162.241.218.151:41112] [client 162.241.218.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.218.151, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVSDZSv3LtZlH2fDnmRx6QAAAMI"]
[Wed Dec 31 09:59:03.630806 2025] [:error] [pid 20393:tid 20436] [client 137.184.76.185:37402] [client 137.184.76.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.76.185, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVSDZ3uGuKBG-pGMRJ7CRQAAAA0"]
[Wed Dec 31 10:09:01.932233 2025] [:error] [pid 20484:tid 20486] [client 103.28.36.220:59772] [client 103.28.36.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.28.36.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVSFvZhjQxR09ihThyT5_gAAAQA"]
[Wed Dec 31 10:24:53.148560 2025] [:error] [pid 20484:tid 20510] [client 192.250.235.211:56166] [client 192.250.235.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.235.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVSJdZhjQxR09ihThyQAjgAAARg"]
[Wed Dec 31 10:37:56.115847 2025] [:error] [pid 20484:tid 20503] [client 72.60.171.54:33394] [client 72.60.171.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.60.171.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVSMhJhjQxR09ihThyQE8AAAARE"]
[Wed Dec 31 10:38:37.208287 2025] [:error] [pid 20392:tid 20408] [client 92.205.169.162:59370] [client 92.205.169.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.169.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVSMrSv3LtZlH2fDnmR7XAAAAM0"]
[Wed Dec 31 10:41:54.831498 2025] [:error] [pid 20453:tid 20464] [client 103.49.70.23:46790] [client 103.49.70.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.49.70.23, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVSNcrb_Ay51rPEgph7cgQAAAEg"]
[Wed Dec 31 10:46:32.599408 2025] [:error] [pid 20484:tid 20504] [client 192.169.174.117:47534] [client 192.169.174.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.169.174.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVSOiJhjQxR09ihThyQHygAAARI"]
[Wed Dec 31 11:02:20.085763 2025] [:error] [pid 48714:tid 48749] [client 171.244.17.74:44330] [client 171.244.17.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.244.17.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVSSPL9PcChEHWa6VisgkQAAAAQ"]
[Wed Dec 31 11:23:13.681155 2025] [:error] [pid 48713:tid 48735] [client 114.55.74.90:54242] [client 114.55.74.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 114.55.74.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVSXIUyNMVAGtWvMliOI7AAAANE"]
[Wed Dec 31 11:46:18.737768 2025] [:error] [pid 48833:tid 48856] [client 172.104.233.211:13892] [client 172.104.233.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.104.233.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVScimPnRNOqqZ1OQg94MwAAAFU"]
[Wed Dec 31 11:56:23.746265 2025] [:error] [pid 48715:tid 48777] [client 49.51.204.74:48964] [client 49.51.204.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVSe52amQpQY7KfuoW390wAAAIU"]
[Wed Dec 31 12:07:08.173210 2025] [:error] [pid 48713:tid 48726] [client 122.51.236.174:45498] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVShbEyNMVAGtWvMliOTXgAAAMg"]
[Wed Dec 31 12:07:27.146238 2025] [:error] [pid 64406:tid 64418] [client 171.244.17.74:54406] [client 171.244.17.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.244.17.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVShfyLRcJYP7e7OhBaVzQAAAQo"]
[Wed Dec 31 12:19:52.713385 2025] [:error] [pid 48833:tid 48853] [client 72.167.86.200:46486] [client 72.167.86.200] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.167.86.200, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVSkaGPnRNOqqZ1OQg-D_gAAAFI"]
[Wed Dec 31 12:31:10.336532 2025] [:error] [pid 48713:tid 48718] [client 208.74.149.212:45144] [client 208.74.149.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.74.149.212, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVSnDkyNMVAGtWvMliOY2AAAAMA"]
[Wed Dec 31 12:39:42.454991 2025] [:error] [pid 48833:tid 48854] [client 152.53.109.224:58318] [client 152.53.109.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.109.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVSpDmPnRNOqqZ1OQg-LdQAAAFM"]
[Wed Dec 31 12:46:05.167622 2025] [:error] [pid 48713:tid 48725] [client 185.114.234.103:52556] [client 185.114.234.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.114.234.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVSqjUyNMVAGtWvMliOcYwAAAMc"]
[Wed Dec 31 13:08:21.846394 2025] [:error] [pid 48714:tid 48767] [client 37.156.147.245:36932] [client 37.156.147.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.156.147.245, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVSvxb9PcChEHWa6VitArgAAABY"]
[Wed Dec 31 13:41:52.406229 2025] [:error] [pid 48713:tid 48722] [client 217.160.232.17:34434] [client 217.160.232.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.232.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVS3oEyNMVAGtWvMliOpFQAAAMQ"]
[Wed Dec 31 13:59:29.900646 2025] [:error] [pid 48833:tid 48843] [client 148.72.60.95:58228] [client 148.72.60.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.60.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVS7wWPnRNOqqZ1OQg-jjwAAAEg"]
[Wed Dec 31 14:13:47.192987 2025] [:error] [pid 64406:tid 64426] [client 81.88.49.4:45489] [client 81.88.49.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.4, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVS_GyLRcJYP7e7OhBbCnwAAARI"]
[Wed Dec 31 14:25:59.828923 2025] [:error] [pid 64406:tid 64432] [client 37.156.147.245:42872] [client 37.156.147.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.156.147.245, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTB9yLRcJYP7e7OhBbHAQAAARg"]
[Wed Dec 31 14:27:51.485236 2025] [:error] [pid 48714:tid 48767] [client 107.180.113.88:43166] [client 107.180.113.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.113.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTCZ79PcChEHWa6VitSfgAAABY"]
[Wed Dec 31 14:29:02.982601 2025] [:error] [pid 64406:tid 64427] [client 198.58.96.57:38886] [client 198.58.96.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.58.96.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTCriLRcJYP7e7OhBbIXQAAARM"]
[Wed Dec 31 14:43:55.087309 2025] [:error] [pid 48714:tid 48765] [client 132.148.182.30:55248] [client 132.148.182.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.182.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTGK79PcChEHWa6VitU7wAAABQ"]
[Wed Dec 31 14:46:31.420773 2025] [:error] [pid 48715:tid 48786] [client 208.109.21.13:58430] [client 208.109.21.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.109.21.13, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTGx2amQpQY7KfuoW0nXwAAAI4"]
[Wed Dec 31 14:51:50.877254 2025] [:error] [pid 48714:tid 48765] [client 148.72.25.235:39060] [client 148.72.25.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.25.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTIBr9PcChEHWa6VitWHAAAABQ"]
[Wed Dec 31 14:52:57.286749 2025] [:error] [pid 64406:tid 64411] [client 69.163.140.5:39632] [client 69.163.140.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.140.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTISSLRcJYP7e7OhBbPuwAAAQM"]
[Wed Dec 31 15:06:28.907034 2025] [:error] [pid 48713:tid 48739] [client 78.128.81.214:50780] [client 78.128.81.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.128.81.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTLdEyNMVAGtWvMliO5MwAAANU"]
[Wed Dec 31 15:23:14.780511 2025] [:error] [pid 48833:tid 48852] [client 151.80.24.32:42910] [client 151.80.24.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 151.80.24.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTPYmPnRNOqqZ1OQg-4xAAAAFE"]
[Wed Dec 31 15:28:41.467403 2025] [:error] [pid 48713:tid 48734] [client 92.205.171.163:36474] [client 92.205.171.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.171.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTQqUyNMVAGtWvMliO9jgAAANA"]
[Wed Dec 31 15:28:59.553850 2025] [:error] [pid 48833:tid 48844] [client 50.63.135.192:50020] [client 50.63.135.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.63.135.192, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTQu2PnRNOqqZ1OQg-6dwAAAEk"]
[Wed Dec 31 15:29:09.879266 2025] [:error] [pid 64406:tid 64425] [client 92.205.171.163:52496] [client 92.205.171.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.171.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTQxSLRcJYP7e7OhBbcbAAAARE"]
[Wed Dec 31 15:29:34.680042 2025] [:error] [pid 48833:tid 48852] [client 92.205.171.163:58226] [client 92.205.171.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.171.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTQ3mPnRNOqqZ1OQg-6oAAAAFE"]
[Wed Dec 31 15:29:58.276630 2025] [:error] [pid 48714:tid 48766] [client 92.205.171.163:42472] [client 92.205.171.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.171.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTQ9r9PcChEHWa6VitfNwAAABU"]
[Wed Dec 31 15:33:02.911344 2025] [:error] [pid 48713:tid 48718] [client 43.133.139.6:43246] [client 43.133.139.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVTRrkyNMVAGtWvMliO-2gAAAMA"]
[Wed Dec 31 15:44:10.102441 2025] [:error] [pid 48715:tid 48785] [client 198.12.234.195:47994] [client 198.12.234.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.12.234.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTUSmamQpQY7KfuoW02XQAAAI0"]
[Wed Dec 31 16:13:12.224169 2025] [:error] [pid 48715:tid 48778] [client 203.171.29.49:60162] [client 203.171.29.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.171.29.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTbGGamQpQY7KfuoW09sQAAAIY"]
[Wed Dec 31 16:14:27.389690 2025] [:error] [pid 48833:tid 48841] [client 92.204.20.72:60792] [client 92.204.20.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.204.20.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTbY2PnRNOqqZ1OQg_HzgAAAEY"]
[Wed Dec 31 16:16:04.623164 2025] [:error] [pid 48714:tid 48767] [client 138.197.78.152:41556] [client 138.197.78.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.197.78.152, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTbxL9PcChEHWa6VitqYAAAABY"]
[Wed Dec 31 16:20:38.094920 2025] [:error] [pid 64406:tid 64427] [client 69.163.140.5:34252] [client 69.163.140.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.140.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTc1iLRcJYP7e7OhBbwcAAAARM"]
[Wed Dec 31 16:27:30.762264 2025] [:error] [pid 48833:tid 48848] [client 173.252.167.60:53526] [client 173.252.167.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.252.167.60, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTecmPnRNOqqZ1OQg_LrAAAAE0"]
[Wed Dec 31 16:29:20.918637 2025] [:error] [pid 64406:tid 64422] [client 68.178.134.15:20310] [client 68.178.134.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.134.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTe4CLRcJYP7e7OhBby5QAAAQ4"]
[Wed Dec 31 16:51:50.972994 2025] [:error] [pid 64406:tid 64431] [client 138.197.17.1:51387] [client 138.197.17.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "aVTkJiLRcJYP7e7OhBb7ggAAARc"], referer: binance.com
[Wed Dec 31 17:08:56.190787 2025] [:error] [pid 48713:tid 48720] [client 103.82.21.169:58188] [client 103.82.21.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.82.21.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVToKEyNMVAGtWvMliPTlQAAAMI"]
[Wed Dec 31 17:09:21.040775 2025] [:error] [pid 48833:tid 48856] [client 209.126.2.78:58182] [client 209.126.2.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.126.2.78, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVToQWPnRNOqqZ1OQg_XwQAAAFU"]
[Wed Dec 31 17:15:29.004574 2025] [:error] [pid 48713:tid 48722] [client 92.205.169.162:51654] [client 92.205.169.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.169.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTpsUyNMVAGtWvMliPUywAAAMQ"]
[Wed Dec 31 17:28:27.922467 2025] [:error] [pid 48713:tid 48722] [client 132.148.177.55:45598] [client 132.148.177.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.177.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTsu0yNMVAGtWvMliPWhQAAAMQ"]
[Wed Dec 31 17:31:21.899204 2025] [:error] [pid 48713:tid 48723] [client 92.205.169.162:60908] [client 92.205.169.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.169.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTtaUyNMVAGtWvMliPW7QAAAMU"]
[Wed Dec 31 17:34:38.633498 2025] [:error] [pid 48833:tid 48857] [client 50.63.135.192:47604] [client 50.63.135.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.63.135.192, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTuLmPnRNOqqZ1OQg_cZgAAAFY"]
[Wed Dec 31 17:36:27.429815 2025] [:error] [pid 7576:tid 7587] [client 192.250.235.211:44302] [client 192.250.235.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.235.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTum6FUpQkpGJNxC_-aRQAAAUk"]
[Wed Dec 31 17:46:13.213528 2025] [:error] [pid 8068:tid 8091] [client 103.82.21.169:54728] [client 103.82.21.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.82.21.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTw5SSVtzoWnijCxFY_oAAAAdU"]
[Wed Dec 31 17:57:28.987831 2025] [:error] [pid 8068:tid 8085] [client 92.204.20.72:40738] [client 92.204.20.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.204.20.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVTziCSVtzoWnijCxFZCCAAAAc8"]
[Wed Dec 31 18:01:00.245769 2025] [:error] [pid 8068:tid 8090] [client 43.130.110.130:38246] [client 43.130.110.130] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVT0XCSVtzoWnijCxFZCygAAAdQ"]
[Wed Dec 31 18:04:14.557426 2025] [:error] [pid 8068:tid 8094] [client 178.18.250.206:39904] [client 178.18.250.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.250.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVT1HiSVtzoWnijCxFZDtwAAAdg"]
[Wed Dec 31 18:18:54.556049 2025] [:error] [pid 48715:tid 48787] [client 92.204.18.103:54972] [client 92.204.18.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.204.18.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVT4jmamQpQY7KfuoW1TQwAAAI8"]
[Wed Dec 31 18:19:15.903653 2025] [:error] [pid 7576:tid 7597] [client 184.168.104.219:39092] [client 184.168.104.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.104.219, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVT4o6FUpQkpGJNxC_-grAAAAVM"]
[Wed Dec 31 18:56:19.283378 2025] [:error] [pid 7576:tid 7596] [client 40.118.225.132:2564] [client 40.118.225.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 40.118.225.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUBU6FUpQkpGJNxC_-rLAAAAVI"]
[Wed Dec 31 18:56:54.199674 2025] [:error] [pid 48833:tid 48844] [client 91.232.154.200:34044] [client 91.232.154.200] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.232.154.200, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUBdmPnRNOqqZ1OQg_pfQAAAEk"]
[Wed Dec 31 19:15:31.489179 2025] [:error] [pid 7800:tid 7807] [client 107.180.119.249:11392] [client 107.180.119.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.119.249, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUF0yN6RFoECeReAPVavQAAAYQ"]
[Wed Dec 31 19:15:51.034826 2025] [:error] [pid 7800:tid 7822] [client 183.90.241.79:46790] [client 183.90.241.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.90.241.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUF5yN6RFoECeReAPVaygAAAZM"]
[Wed Dec 31 19:20:44.260695 2025] [:error] [pid 7800:tid 7821] [client 183.90.241.79:39470] [client 183.90.241.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.90.241.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUHDCN6RFoECeReAPVbygAAAZI"]
[Wed Dec 31 19:38:56.181456 2025] [:error] [pid 48713:tid 48734] [client 3.6.130.226:46860] [client 3.6.130.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.6.130.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVULUEyNMVAGtWvMliPp8QAAANA"]
[Wed Dec 31 19:43:59.743693 2025] [:error] [pid 48713:tid 48723] [client 183.90.241.79:35388] [client 183.90.241.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.90.241.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUMf0yNMVAGtWvMliPqmgAAAMU"]
[Wed Dec 31 19:47:46.160404 2025] [:error] [pid 48833:tid 48842] [client 109.234.161.199:39218] [client 109.234.161.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.234.161.199, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUNYmPnRNOqqZ1OQg_zBwAAAEc"]
[Wed Dec 31 19:49:57.033351 2025] [:error] [pid 8068:tid 8087] [client 82.165.80.110:43908] [client 82.165.80.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.80.110, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUN5SSVtzoWnijCxFZd8wAAAdE"]
[Wed Dec 31 19:53:20.608816 2025] [:error] [pid 48713:tid 48726] [client 217.160.21.41:33234] [client 217.160.21.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.21.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUOsEyNMVAGtWvMliPregAAAMg"]
[Wed Dec 31 20:14:24.429606 2025] [:error] [pid 7800:tid 7812] [client 109.234.162.139:58566] [client 109.234.162.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.234.162.139, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUToCN6RFoECeReAPVlXwAAAYk"]
[Wed Dec 31 20:20:19.974639 2025] [:error] [pid 64406:tid 64426] [client 107.180.113.88:63704] [client 107.180.113.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.113.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUVAyLRcJYP7e7OhBYiqgAAARI"]
[Wed Dec 31 20:35:47.733282 2025] [:error] [pid 48714:tid 48758] [client 135.181.225.133:49446] [client 135.181.225.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 135.181.225.133, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUYo79PcChEHWa6ViuVKwAAAA0"]
[Wed Dec 31 20:41:17.021678 2025] [:error] [pid 48833:tid 48858] [client 69.163.140.5:33806] [client 69.163.140.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.140.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUZ7WPnRNOqqZ1OQg_6FwAAAFc"]
[Wed Dec 31 20:41:51.112419 2025] [:error] [pid 8068:tid 8075] [client 68.183.235.102:56928] [client 68.183.235.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.235.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUaDySVtzoWnijCxFZoOQAAAcU"]
[Wed Dec 31 20:47:55.687280 2025] [:error] [pid 7576:tid 7602] [client 51.210.190.32:54460] [client 51.210.190.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.190.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUbe6FUpQkpGJNxC__IYgAAAVY"]
[Wed Dec 31 20:53:31.795414 2025] [:error] [pid 64406:tid 64420] [client 148.72.106.136:57844] [client 148.72.106.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.106.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUcyyLRcJYP7e7OhBYngQAAAQw"]
[Wed Dec 31 21:25:16.403255 2025] [:error] [pid 48714:tid 48753] [client 185.114.234.103:56362] [client 185.114.234.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.114.234.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUkPL9PcChEHWa6ViucZgAAAAg"]
[Wed Dec 31 21:27:23.928709 2025] [:error] [pid 48715:tid 48781] [client 146.103.45.9:51192] [client 146.103.45.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.103.45.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUku2amQpQY7KfuoW1u5gAAAIk"]
[Wed Dec 31 21:29:51.133002 2025] [:error] [pid 48714:tid 48754] [client 43.131.243.61:37678] [client 43.131.243.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVUlT79PcChEHWa6ViudBQAAAAk"]
[Wed Dec 31 21:40:13.288787 2025] [:error] [pid 48713:tid 48724] [client 195.154.174.40:35294] [client 195.154.174.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.154.174.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUnvUyNMVAGtWvMliP49AAAAMY"]
[Wed Dec 31 21:48:12.023496 2025] [:error] [pid 8068:tid 8070] [client 173.236.163.157:36306] [client 173.236.163.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.236.163.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUpnCSVtzoWnijCxFZ43wAAAcA"]
[Wed Dec 31 21:48:19.813737 2025] [:error] [pid 7800:tid 7806] [client 173.236.163.157:37124] [client 173.236.163.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.236.163.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUpoyN6RFoECeReAPV0nQAAAYM"]
[Wed Dec 31 21:48:28.828814 2025] [:error] [pid 64406:tid 64428] [client 162.241.216.134:44734] [client 162.241.216.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.216.134, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUprCLRcJYP7e7OhBYvUQAAARQ"]
[Wed Dec 31 22:29:54.623734 2025] [:error] [pid 8068:tid 8079] [client 81.88.49.8:11416] [client 81.88.49.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVUzYiSVtzoWnijCxFaDNQAAAck"]
[Wed Dec 31 22:34:29.952500 2025] [:error] [pid 48714:tid 48764] [client 109.234.165.115:34610] [client 109.234.165.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.234.165.115, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVU0db9PcChEHWa6ViukwQAAABM"]
[Wed Dec 31 22:36:35.237304 2025] [:error] [pid 7800:tid 7817] [client 206.189.189.76:49768] [client 206.189.189.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 206.189.189.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVU08yN6RFoECeReAPV75wAAAY4"]
[Wed Dec 31 22:47:04.411846 2025] [:error] [pid 7576:tid 7583] [client 173.236.163.157:42310] [client 173.236.163.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.236.163.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVU3aKFUpQkpGJNxC__ejgAAAUU"]
[Wed Dec 31 22:49:54.985524 2025] [:error] [pid 48715:tid 48790] [client 68.178.246.186:15638] [client 68.178.246.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.246.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVU4EmamQpQY7KfuoW14ogAAAJI"]
[Wed Dec 31 22:51:43.259732 2025] [:error] [pid 48714:tid 48752] [client 192.169.164.45:58708] [client 192.169.164.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.169.164.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVU4f79PcChEHWa6ViumsgAAAAc"]
[Wed Dec 31 23:16:22.797849 2025] [:error] [pid 8068:tid 8084] [client 89.46.105.238:24772] [client 89.46.105.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.46.105.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVU-RiSVtzoWnijCxFaO8wAAAc4"]
[Wed Dec 31 23:23:09.729829 2025] [:error] [pid 48833:tid 48842] [client 148.72.62.120:45400] [client 148.72.62.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.62.120, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVU_3WPnRNOqqZ1OQg8R0AAAAEc"]
[Thu Jan 01 00:00:49.665581 2026] [:error] [pid 64406:tid 64416] [client 43.156.204.134:56506] [client 43.156.204.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVVIsSLRcJYP7e7OhBZA5AAAAQg"]
[Thu Jan 01 00:07:36.002848 2026] [:error] [pid 7576:tid 7590] [client 81.88.49.20:14008] [client 81.88.49.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVVKSKFUpQkpGJNxC__tEwAAAUw"]
[Thu Jan 01 00:28:29.389481 2026] [:error] [pid 48713:tid 48725] [client 88.99.242.15:55466] [client 88.99.242.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.99.242.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVVPLUyNMVAGtWvMliMMxQAAAMc"]
[Thu Jan 01 00:39:47.552894 2026] [:error] [pid 48833:tid 48838] [client 65.181.111.149:35816] [client 65.181.111.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.181.111.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVVR02PnRNOqqZ1OQg8azAAAAEM"]
[Thu Jan 01 00:49:54.509374 2026] [:error] [pid 7800:tid 7807] [client 37.157.254.122:38926] [client 37.157.254.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.157.254.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVVUMiN6RFoECeReAPWQnAAAAYQ"]
[Thu Jan 01 00:53:59.494260 2026] [:error] [pid 8068:tid 8093] [client 147.93.153.72:35090] [client 147.93.153.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.93.153.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVVVJySVtzoWnijCxFalMAAAAdc"]
[Thu Jan 01 01:06:51.460136 2026] [:error] [pid 7576:tid 7588] [client 81.88.49.20:42445] [client 81.88.49.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVVYK6FUpQkpGJNxC__21AAAAUo"]
[Thu Jan 01 01:11:12.029537 2026] [:error] [pid 48714:tid 48762] [client 82.167.183.179:46825] [client 82.167.183.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.167.183.179, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVVZML9PcChEHWa6Viu3LQAAABE"]
[Thu Jan 01 01:24:32.729963 2026] [:error] [pid 8068:tid 8087] [client 82.223.128.211:50970] [client 82.223.128.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.128.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVVcUCSVtzoWnijCxFasGQAAAdE"]
[Thu Jan 01 01:35:52.011952 2026] [:error] [pid 48714:tid 48753] [client 135.181.225.133:50350] [client 135.181.225.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 135.181.225.133, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVVe-L9PcChEHWa6Viu55QAAAAg"]
[Thu Jan 01 01:52:12.488449 2026] [:error] [pid 8068:tid 8088] [client 107.180.113.88:45868] [client 107.180.113.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.113.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVVizCSVtzoWnijCxFayCgAAAdI"]
[Thu Jan 01 01:53:31.802137 2026] [:error] [pid 7800:tid 7803] [client 208.109.19.118:18274] [client 208.109.19.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.109.19.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVVjGyN6RFoECeReAPWZKAAAAYA"]
[Thu Jan 01 02:17:38.274166 2026] [:error] [pid 7800:tid 7805] [client 5.75.172.230:55506] [client 5.75.172.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.75.172.230, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVVowiN6RFoECeReAPWcnwAAAYI"]
[Thu Jan 01 02:18:06.509673 2026] [:error] [pid 64406:tid 64408] [client 41.185.8.153:44914] [client 41.185.8.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.185.8.153, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVVo3iLRcJYP7e7OhBZTpwAAAQA"]
[Thu Jan 01 02:21:14.345535 2026] [:error] [pid 48713:tid 48734] [client 202.92.5.25:44372] [client 202.92.5.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.92.5.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVVpmkyNMVAGtWvMliMYjAAAANA"]
[Thu Jan 01 02:30:14.625242 2026] [:error] [pid 7800:tid 7811] [client 152.70.215.57:51470] [client 152.70.215.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.70.215.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVVrtiN6RFoECeReAPWe0QAAAYg"]
[Thu Jan 01 02:33:54.042562 2026] [:error] [pid 7800:tid 7822] [client 173.252.167.110:56858] [client 173.252.167.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.252.167.110, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVVskiN6RFoECeReAPWfbwAAAZM"]
[Thu Jan 01 02:37:07.311900 2026] [:error] [pid 48714:tid 48746] [client 128.65.195.33:37110] [client 128.65.195.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.65.195.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVVtU79PcChEHWa6VivBsQAAAAE"]
[Thu Jan 01 02:37:56.583954 2026] [:error] [pid 48715:tid 48795] [client 81.88.49.20:26515] [client 81.88.49.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVVthGamQpQY7KfuoW2UdQAAAJc"]
[Thu Jan 01 02:54:51.967527 2026] [:error] [pid 48714:tid 48756] [client 103.78.97.230:5652] [client 103.78.97.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.78.97.230, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVVxe79PcChEHWa6VivEZQAAAAs"]
[Thu Jan 01 03:15:44.857383 2026] [:error] [pid 28474:tid 28604] [client 159.223.61.19:47396] [client 159.223.61.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.61.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVV2YFXFbDzo2FOp0YQuiwAAAI0"]
[Thu Jan 01 03:18:56.211090 2026] [:error] [pid 28474:tid 28603] [client 148.72.63.214:35204] [client 148.72.63.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.63.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVV3IFXFbDzo2FOp0YQvIQAAAIw"]
[Thu Jan 01 04:31:15.685877 2026] [:error] [pid 58817:tid 58832] [client 81.8.91.201:38936] [client 81.8.91.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.8.91.201, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVWIE1ebWGLeUWiwYf_A1wAAAAY"]
[Thu Jan 01 04:42:17.061104 2026] [:error] [pid 58818:tid 58864] [client 103.177.78.142:33658] [client 103.177.78.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.177.78.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVWKqWr6b3Nsqkrqu8297AAAAEs"]
[Thu Jan 01 05:17:06.779081 2026] [:error] [pid 58818:tid 58864] [client 82.165.86.43:46602] [client 82.165.86.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.86.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVWS0mr6b3Nsqkrqu83GcAAAAEs"]
[Thu Jan 01 05:27:12.850206 2026] [:error] [pid 58818:tid 58860] [client 41.185.8.107:37872] [client 41.185.8.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.185.8.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVWVMGr6b3Nsqkrqu83JWAAAAEc"]
[Thu Jan 01 05:28:02.234260 2026] [:error] [pid 58924:tid 58935] [client 193.176.230.19:49934] [client 193.176.230.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.176.230.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVWVYjYXM8NvhWQPUGudKgAAAMk"]
[Thu Jan 01 05:39:20.251990 2026] [:error] [pid 58924:tid 58944] [client 82.165.87.169:40366] [client 82.165.87.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.87.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVWYCDYXM8NvhWQPUGuhFAAAANI"]
[Thu Jan 01 06:06:16.455764 2026] [:error] [pid 58819:tid 58894] [client 92.205.169.121:54194] [client 92.205.169.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.169.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVWeWBMbLE49waxUJzOq4AAAAI4"]
[Thu Jan 01 06:17:13.504458 2026] [:error] [pid 58817:tid 58841] [client 194.79.221.209:55362] [client 194.79.221.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.79.221.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVWg6VebWGLeUWiwYf_bhAAAAA8"]
[Thu Jan 01 06:19:37.747020 2026] [:error] [pid 58818:tid 58868] [client 193.95.24.115:33940] [client 193.95.24.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.95.24.115, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVWheWr6b3Nsqkrqu83YEgAAAE8"]
[Thu Jan 01 06:23:30.734678 2026] [:error] [pid 58817:tid 58835] [client 36.41.75.167:55686] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVWiYlebWGLeUWiwYf_c0gAAAAk"]
[Thu Jan 01 06:38:16.137499 2026] [:error] [pid 58819:tid 58901] [client 72.167.252.169:46032] [client 72.167.252.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.167.252.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVWl2BMbLE49waxUJzO0qwAAAJU"]
[Thu Jan 01 06:39:46.274482 2026] [:error] [pid 58370:tid 58382] [client 92.204.20.102:40852] [client 92.204.20.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.204.20.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVWmMjkIHVNixymRHHfyEQAAAQo"]
[Thu Jan 01 06:59:46.811126 2026] [:error] [pid 58818:tid 58862] [client 82.165.86.123:39570] [client 82.165.86.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.86.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVWq4mr6b3Nsqkrqu83iOgAAAEk"]
[Thu Jan 01 07:03:10.014796 2026] [:error] [pid 58370:tid 58373] [client 43.157.179.227:45290] [client 43.157.179.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVWrrjkIHVNixymRHHf7NwAAAQE"]
[Thu Jan 01 07:04:26.239492 2026] [:error] [pid 58818:tid 58868] [client 185.223.152.66:48689] [client 185.223.152.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.66, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVWr-mr6b3Nsqkrqu83jRgAAAE8"]
[Thu Jan 01 07:09:06.081761 2026] [:error] [pid 58370:tid 58389] [client 91.226.10.36:55820] [client 91.226.10.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.226.10.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVWtEjkIHVNixymRHHf9rQAAARE"]
[Thu Jan 01 07:13:48.066919 2026] [:error] [pid 58817:tid 58837] [client 109.234.162.139:33756] [client 109.234.162.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.234.162.139, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVWuLFebWGLeUWiwYf_oZQAAAAs"]
[Thu Jan 01 07:24:13.508733 2026] [:error] [pid 58818:tid 58865] [client 203.171.29.49:42998] [client 203.171.29.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.171.29.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVWwnWr6b3Nsqkrqu83oMgAAAEw"]
[Thu Jan 01 07:33:15.960701 2026] [:error] [pid 58817:tid 58848] [client 182.16.245.210:47222] [client 182.16.245.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.16.245.210, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVWyu1ebWGLeUWiwYf_sbQAAABY"]
[Thu Jan 01 07:37:11.805679 2026] [:error] [pid 58370:tid 58384] [client 185.223.152.76:46633] [client 185.223.152.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.76, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVWzpzkIHVNixymRHHcJSQAAAQw"]
[Thu Jan 01 07:37:57.369661 2026] [:error] [pid 58817:tid 58826] [client 103.78.97.230:1333] [client 103.78.97.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.78.97.230, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVWz1VebWGLeUWiwYf_t_wAAAAA"]
[Thu Jan 01 07:43:27.692398 2026] [:error] [pid 58819:tid 58896] [client 185.223.152.78:37557] [client 185.223.152.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVW1HxMbLE49waxUJzPHHgAAAJA"]
[Thu Jan 01 07:49:11.274298 2026] [:error] [pid 58819:tid 58891] [client 185.223.152.84:23461] [client 185.223.152.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.84, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVW2dxMbLE49waxUJzPIPQAAAIs"]
[Thu Jan 01 07:54:44.968890 2026] [:error] [pid 58817:tid 58849] [client 185.223.152.70:58635] [client 185.223.152.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVW3xFebWGLeUWiwYf_w8gAAABc"]
[Thu Jan 01 07:57:05.244984 2026] [:error] [pid 58817:tid 58840] [client 64.92.112.88:35970] [client 64.92.112.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.92.112.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVW4UVebWGLeUWiwYf_xYQAAAA4"]
[Thu Jan 01 08:00:25.207119 2026] [:error] [pid 58818:tid 58875] [client 185.223.152.69:21045] [client 185.223.152.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.69, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVW5GWr6b3Nsqkrqu83wNwAAAFY"]
[Thu Jan 01 08:02:41.077720 2026] [:error] [pid 58818:tid 58855] [client 66.175.44.21:47816] [client 66.175.44.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.175.44.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVW5oWr6b3Nsqkrqu83wpAAAAEI"]
[Thu Jan 01 08:07:29.884398 2026] [:error] [pid 58817:tid 58845] [client 198.58.118.10:48186] [client 198.58.118.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.58.118.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVW6wVebWGLeUWiwYf_zhwAAABM"]
[Thu Jan 01 08:11:46.970056 2026] [:error] [pid 58924:tid 58929] [client 185.223.152.70:60231] [client 185.223.152.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVW7wjYXM8NvhWQPUGvT8gAAAMM"]
[Thu Jan 01 08:17:32.824194 2026] [:error] [pid 58818:tid 58875] [client 185.223.152.75:56163] [client 185.223.152.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.75, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVW9HGr6b3Nsqkrqu83z4QAAAFY"]
[Thu Jan 01 08:23:25.649034 2026] [:error] [pid 58817:tid 58836] [client 185.223.152.4:57965] [client 185.223.152.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.4, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVW-fVebWGLeUWiwYf_3dwAAAAo"]
[Thu Jan 01 08:24:10.485664 2026] [:error] [pid 58818:tid 58877] [client 163.44.198.62:55960] [client 163.44.198.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.44.198.62, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVW-qmr6b3Nsqkrqu831WwAAAFg"]
[Thu Jan 01 08:34:59.301050 2026] [:error] [pid 58818:tid 58854] [client 185.223.152.68:48195] [client 185.223.152.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXBM2r6b3Nsqkrqu833fQAAAEE"]
[Thu Jan 01 08:40:55.846273 2026] [:error] [pid 58818:tid 58858] [client 185.223.152.72:65101] [client 185.223.152.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXCl2r6b3Nsqkrqu8349wAAAEU"]
[Thu Jan 01 08:46:34.905095 2026] [:error] [pid 58817:tid 58838] [client 103.221.221.121:52624] [client 103.221.221.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.221.221.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVXD6lebWGLeUWiwYf_9DQAAAAw"]
[Thu Jan 01 08:47:28.964170 2026] [:error] [pid 58819:tid 58890] [client 185.223.152.4:58517] [client 185.223.152.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.4, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXEIBMbLE49waxUJzPWFAAAAIo"]
[Thu Jan 01 08:54:15.067688 2026] [:error] [pid 58819:tid 58888] [client 185.223.152.82:49897] [client 185.223.152.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXFtxMbLE49waxUJzPXiwAAAIg"]
[Thu Jan 01 09:00:45.498373 2026] [:error] [pid 58818:tid 58865] [client 185.223.152.249:29019] [client 185.223.152.249] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.249, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXHPWr6b3Nsqkrqu8387AAAAEw"]
[Thu Jan 01 09:06:57.053591 2026] [:error] [pid 58818:tid 58872] [client 185.223.152.70:53605] [client 185.223.152.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXIsWr6b3Nsqkrqu80AxwAAAFM"]
[Thu Jan 01 09:12:56.281132 2026] [:error] [pid 58818:tid 58875] [client 185.223.152.86:39509] [client 185.223.152.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXKGGr6b3Nsqkrqu80CfAAAAFY"]
[Thu Jan 01 09:14:11.150157 2026] [:error] [pid 58817:tid 58849] [client 188.166.177.113:39488] [client 188.166.177.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.177.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVXKY1ebWGLeUWiwYf8FbgAAABc"]
[Thu Jan 01 09:16:50.503978 2026] [:error] [pid 58817:tid 58850] [client 159.203.106.212:55198] [client 159.203.106.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.203.106.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXLAlebWGLeUWiwYf8F3gAAABg"]
[Thu Jan 01 09:16:51.948458 2026] [:error] [pid 58819:tid 58894] [client 159.203.106.212:55533] [client 159.203.106.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.203.106.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXLAxMbLE49waxUJzPfVQAAAI4"]
[Thu Jan 01 09:18:47.874779 2026] [:error] [pid 32337:tid 32355] [client 185.223.152.83:60161] [client 185.223.152.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXLd7TSw8DLIoJg6HhcaAAAAVA"]
[Thu Jan 01 09:31:21.615483 2026] [:error] [pid 58817:tid 58848] [client 185.223.152.90:60159] [client 185.223.152.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXOaVebWGLeUWiwYf8I6QAAABY"]
[Thu Jan 01 09:34:49.929576 2026] [:error] [pid 58817:tid 58850] [client 154.12.253.211:55268] [client 154.12.253.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.12.253.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVXPOVebWGLeUWiwYf8JsQAAABg"]
[Thu Jan 01 09:37:17.759297 2026] [:error] [pid 58819:tid 58882] [client 185.223.152.81:29903] [client 185.223.152.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXPzRMbLE49waxUJzPjRAAAAII"]
[Thu Jan 01 09:43:10.976668 2026] [:error] [pid 58817:tid 58834] [client 185.223.152.68:30539] [client 185.223.152.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXRLlebWGLeUWiwYf8MpwAAAAg"]
[Thu Jan 01 09:49:01.036305 2026] [:error] [pid 58817:tid 58834] [client 185.223.152.4:63989] [client 185.223.152.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.4, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXSjVebWGLeUWiwYf8NoAAAAAg"]
[Thu Jan 01 09:51:47.769510 2026] [:error] [pid 58924:tid 58942] [client 195.250.21.230:36306] [client 195.250.21.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.250.21.230, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVXTMzYXM8NvhWQPUGvwYwAAANA"]
[Thu Jan 01 09:54:37.188155 2026] [:error] [pid 32337:tid 32362] [client 45.119.81.168:36712] [client 45.119.81.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.119.81.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVXT3bTSw8DLIoJg6Hho1AAAAVc"]
[Thu Jan 01 09:54:57.451927 2026] [:error] [pid 58819:tid 58898] [client 185.223.152.75:34833] [client 185.223.152.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.75, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXT8RMbLE49waxUJzPmwAAAAJI"]
[Thu Jan 01 10:00:49.222226 2026] [:error] [pid 32337:tid 32353] [client 185.223.152.89:41115] [client 185.223.152.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.89, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXVUbTSw8DLIoJg6Hhq2AAAAU4"]
[Thu Jan 01 10:04:01.078243 2026] [:error] [pid 32337:tid 32355] [client 203.171.29.49:60174] [client 203.171.29.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.171.29.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVXWEbTSw8DLIoJg6HhrsgAAAVA"]
[Thu Jan 01 10:06:50.563277 2026] [:error] [pid 58817:tid 58832] [client 185.223.152.72:44873] [client 185.223.152.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXWulebWGLeUWiwYf8RHgAAAAY"]
[Thu Jan 01 10:12:38.503653 2026] [:error] [pid 32337:tid 32356] [client 185.223.152.4:46261] [client 185.223.152.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.4, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXYFrTSw8DLIoJg6HhuogAAAVE"]
[Thu Jan 01 10:14:32.661512 2026] [:error] [pid 58370:tid 58376] [client 132.148.180.144:24816] [client 132.148.180.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.180.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVXYiDkIHVNixymRHHc6MwAAAQQ"]
[Thu Jan 01 10:23:22.013408 2026] [:error] [pid 58924:tid 58944] [client 68.178.245.62:45140] [client 68.178.245.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.245.62, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVXamjYXM8NvhWQPUGv23gAAANI"]
[Thu Jan 01 10:24:25.630980 2026] [:error] [pid 58817:tid 58839] [client 185.223.152.76:21031] [client 185.223.152.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.76, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXa2VebWGLeUWiwYf8UNAAAAA0"]
[Thu Jan 01 10:30:19.803544 2026] [:error] [pid 32337:tid 32353] [client 185.223.152.91:58437] [client 185.223.152.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.91, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXcO7TSw8DLIoJg6Hh0RQAAAU4"]
[Thu Jan 01 10:36:16.445703 2026] [:error] [pid 58818:tid 58861] [client 185.223.152.71:44027] [client 185.223.152.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXdoGr6b3Nsqkrqu80T_AAAAEg"]
[Thu Jan 01 10:48:36.548576 2026] [:error] [pid 32337:tid 32355] [client 185.223.152.85:55973] [client 185.223.152.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXghLTSw8DLIoJg6Hh5UQAAAVA"]
[Thu Jan 01 10:54:34.394101 2026] [:error] [pid 32337:tid 32343] [client 185.223.152.68:37209] [client 185.223.152.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXh6rTSw8DLIoJg6Hh8KQAAAUQ"]
[Thu Jan 01 11:00:23.284980 2026] [:error] [pid 58819:tid 58890] [client 185.223.152.91:58017] [client 185.223.152.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.91, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXjRxMbLE49waxUJzPxpgAAAIo"]
[Thu Jan 01 11:06:25.497564 2026] [:error] [pid 58818:tid 58858] [client 185.223.152.85:48671] [client 185.223.152.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXksWr6b3Nsqkrqu80bRwAAAEU"]
[Thu Jan 01 11:08:34.743437 2026] [:error] [pid 58819:tid 58891] [client 198.244.177.113:42046] [client 198.244.177.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.244.177.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVXlMhMbLE49waxUJzPzCgAAAIs"]
[Thu Jan 01 11:12:22.105175 2026] [:error] [pid 58924:tid 58943] [client 185.223.152.73:65179] [client 185.223.152.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXmFjYXM8NvhWQPUGsDjwAAANE"]
[Thu Jan 01 11:18:18.078215 2026] [:error] [pid 58817:tid 58828] [client 185.223.152.82:48021] [client 185.223.152.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXnelebWGLeUWiwYf8gAQAAAAI"]
[Thu Jan 01 11:24:26.529431 2026] [:error] [pid 58818:tid 58860] [client 185.223.152.90:54897] [client 185.223.152.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXo6mr6b3Nsqkrqu80hlwAAAEc"]
[Thu Jan 01 11:30:20.268609 2026] [:error] [pid 58370:tid 58377] [client 185.223.152.83:51515] [client 185.223.152.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXqTDkIHVNixymRHHdMIgAAAQU"]
[Thu Jan 01 11:36:26.104094 2026] [:error] [pid 32337:tid 32361] [client 185.223.152.71:38899] [client 185.223.152.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXrurTSw8DLIoJg6HiNmgAAAVY"]
[Thu Jan 01 11:42:22.553256 2026] [:error] [pid 58817:tid 58836] [client 185.223.152.87:22863] [client 185.223.152.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.87, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXtHlebWGLeUWiwYf8lcwAAAAo"]
[Thu Jan 01 11:54:18.286885 2026] [:error] [pid 58370:tid 58393] [client 185.223.152.78:51237] [client 185.223.152.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXv6jkIHVNixymRHHdQjgAAARU"]
[Thu Jan 01 12:00:19.268097 2026] [:error] [pid 32337:tid 32348] [client 185.223.152.71:42863] [client 185.223.152.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXxU7TSw8DLIoJg6HiWVgAAAUk"]
[Thu Jan 01 12:02:42.165526 2026] [:error] [pid 32337:tid 32358] [client 68.183.13.1:34954] [client 68.183.13.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.13.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVXx4rTSw8DLIoJg6HiW6wAAAVM"]
[Thu Jan 01 12:06:23.462738 2026] [:error] [pid 32337:tid 32346] [client 185.223.152.69:23205] [client 185.223.152.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.69, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVXyv7TSw8DLIoJg6HiYSgAAAUc"]
[Thu Jan 01 12:12:15.256646 2026] [:error] [pid 32337:tid 32354] [client 185.223.152.83:31545] [client 185.223.152.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVX0H7TSw8DLIoJg6HiahAAAAU8"]
[Thu Jan 01 12:18:16.666632 2026] [:error] [pid 58818:tid 58866] [client 185.223.152.91:54665] [client 185.223.152.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.91, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVX1iGr6b3Nsqkrqu80twgAAAE0"]
[Thu Jan 01 12:21:32.079203 2026] [:error] [pid 32337:tid 32341] [client 106.227.49.113:33236] [client 106.227.49.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVX2TLTSw8DLIoJg6HidrQAAAUI"]
[Thu Jan 01 12:29:59.770222 2026] [:error] [pid 58818:tid 58876] [client 185.223.152.73:43247] [client 185.223.152.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVX4R2r6b3Nsqkrqu80wiwAAAFc"]
[Thu Jan 01 12:36:08.364528 2026] [:error] [pid 58370:tid 58383] [client 97.74.207.221:34932] [client 97.74.207.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 97.74.207.221, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVX5uDkIHVNixymRHHdXxgAAAQs"]
[Thu Jan 01 12:42:05.033659 2026] [:error] [pid 58370:tid 58388] [client 185.223.152.71:31891] [client 185.223.152.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVX7HTkIHVNixymRHHdZBwAAARA"]
[Thu Jan 01 12:42:10.412606 2026] [:error] [pid 58818:tid 58853] [client 68.178.245.62:44096] [client 68.178.245.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.245.62, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVX7Imr6b3Nsqkrqu80ywQAAAEA"]
[Thu Jan 01 12:48:08.659131 2026] [:error] [pid 32337:tid 32346] [client 185.223.152.68:56851] [client 185.223.152.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVX8iLTSw8DLIoJg6HinCgAAAUc"]
[Thu Jan 01 12:51:43.920159 2026] [:error] [pid 58818:tid 58876] [client 162.241.253.195:42018] [client 162.241.253.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.253.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVX9X2r6b3Nsqkrqu801MwAAAFc"]
[Thu Jan 01 12:54:05.592946 2026] [:error] [pid 58818:tid 58854] [client 185.223.152.86:30279] [client 185.223.152.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVX97Wr6b3Nsqkrqu802RQAAAEE"]
[Thu Jan 01 13:00:04.559964 2026] [:error] [pid 58924:tid 58948] [client 185.223.152.71:65007] [client 185.223.152.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVX_VDYXM8NvhWQPUGse7gAAANY"]
[Thu Jan 01 13:06:04.507292 2026] [:error] [pid 58817:tid 58827] [client 185.223.152.249:55435] [client 185.223.152.249] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.249, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYAvFebWGLeUWiwYf82vAAAAAE"]
[Thu Jan 01 13:11:54.118485 2026] [:error] [pid 58817:tid 58831] [client 185.223.152.78:29603] [client 185.223.152.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYCGlebWGLeUWiwYf84WQAAAAU"]
[Thu Jan 01 13:12:57.371219 2026] [:error] [pid 53873:tid 53895] [client 68.178.245.211:59182] [client 68.178.245.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.245.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVYCWTmhp5IRNxK0rgk2nQAAAZI"]
[Thu Jan 01 13:13:20.113015 2026] [:error] [pid 32337:tid 32339] [client 83.137.145.97:47912] [client 83.137.145.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.137.145.97, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVYCcLTSw8DLIoJg6Hiv1AAAAUA"]
[Thu Jan 01 13:23:49.434190 2026] [:error] [pid 53873:tid 53885] [client 185.223.152.76:32529] [client 185.223.152.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.76, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYE5Tmhp5IRNxK0rgk4-QAAAYg"]
[Thu Jan 01 13:29:03.730044 2026] [:error] [pid 58817:tid 58833] [client 81.88.49.11:12991] [client 81.88.49.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVYGH1ebWGLeUWiwYf87kwAAAAc"]
[Thu Jan 01 13:29:48.053435 2026] [:error] [pid 58924:tid 58940] [client 185.223.152.82:49731] [client 185.223.152.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYGTDYXM8NvhWQPUGsmlQAAAM4"]
[Thu Jan 01 13:35:46.869127 2026] [:error] [pid 58818:tid 58869] [client 185.223.152.73:37823] [client 185.223.152.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYHsmr6b3Nsqkrqu80-yQAAAFA"]
[Thu Jan 01 13:47:53.863265 2026] [:error] [pid 58818:tid 58873] [client 185.223.152.78:20063] [client 185.223.152.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYKiWr6b3Nsqkrqu81AIwAAAFQ"]
[Thu Jan 01 13:52:50.344616 2026] [:error] [pid 54016:tid 54036] [client 159.69.118.232:57514] [client 159.69.118.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.69.118.232, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVYLste606Kc9XfrojF8qQAAAdI"]
[Thu Jan 01 13:56:01.888175 2026] [:error] [pid 58817:tid 58835] [client 43.155.27.244:52752] [client 43.155.27.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVYMcVebWGLeUWiwYf9AHAAAAAk"]
[Thu Jan 01 13:59:55.718407 2026] [:error] [pid 58370:tid 58373] [client 185.223.152.70:22609] [client 185.223.152.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYNWzkIHVNixymRHHdnBAAAAQE"]
[Thu Jan 01 14:05:59.145861 2026] [:error] [pid 58819:tid 58885] [client 185.223.152.81:57519] [client 185.223.152.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYOxxMbLE49waxUJzMUkgAAAIU"]
[Thu Jan 01 14:12:04.288195 2026] [:error] [pid 58370:tid 58385] [client 185.223.152.82:55165] [client 185.223.152.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYQNDkIHVNixymRHHdohQAAAQ0"]
[Thu Jan 01 14:18:17.788420 2026] [:error] [pid 58819:tid 58885] [client 185.223.152.83:30263] [client 185.223.152.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYRqRMbLE49waxUJzMWLQAAAIU"]
[Thu Jan 01 14:24:28.216062 2026] [:error] [pid 58819:tid 58902] [client 185.223.152.78:37801] [client 185.223.152.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYTHBMbLE49waxUJzMW_gAAAJY"]
[Thu Jan 01 14:30:49.887324 2026] [:error] [pid 58370:tid 58382] [client 185.223.152.83:52215] [client 185.223.152.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYUmTkIHVNixymRHHdrrAAAAQo"]
[Thu Jan 01 14:43:26.936731 2026] [:error] [pid 58819:tid 58884] [client 185.223.152.71:59513] [client 185.223.152.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYXjhMbLE49waxUJzMY6QAAAIQ"]
[Thu Jan 01 14:49:43.123481 2026] [:error] [pid 58818:tid 58862] [client 185.223.152.82:54025] [client 185.223.152.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYZB2r6b3Nsqkrqu81JMQAAAEk"]
[Thu Jan 01 14:55:48.636753 2026] [:error] [pid 32337:tid 32341] [client 185.223.152.81:28199] [client 185.223.152.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYadLTSw8DLIoJg6HjBVAAAAUI"]
[Thu Jan 01 14:57:48.866927 2026] [:error] [pid 58924:tid 58938] [client 109.234.160.16:42676] [client 109.234.160.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.234.160.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVYa7DYXM8NvhWQPUGs9lAAAAMw"]
[Thu Jan 01 15:01:53.621475 2026] [:error] [pid 58818:tid 58871] [client 185.223.152.76:57757] [client 185.223.152.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.76, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYb4Wr6b3Nsqkrqu81L6QAAAFI"]
[Thu Jan 01 15:08:10.828903 2026] [:error] [pid 53873:tid 53899] [client 185.223.152.249:23223] [client 185.223.152.249] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.249, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYdWjmhp5IRNxK0rglKmwAAAZY"]
[Thu Jan 01 15:11:17.747678 2026] [:error] [pid 32337:tid 32351] [client 182.16.245.210:35948] [client 182.16.245.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.16.245.210, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVYeFbTSw8DLIoJg6HjDfwAAAUw"]
[Thu Jan 01 15:14:21.186521 2026] [:error] [pid 58370:tid 58376] [client 185.223.152.249:45135] [client 185.223.152.249] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.249, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYezTkIHVNixymRHHdxpAAAAQQ"]
[Thu Jan 01 15:26:17.748512 2026] [:error] [pid 58817:tid 58847] [client 98.98.66.22:55917] [client 98.98.66.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.98.66.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYhmVebWGLeUWiwYf9M7wAAABU"]
[Thu Jan 01 15:26:46.436241 2026] [:error] [pid 58818:tid 58867] [client 185.223.152.83:44363] [client 185.223.152.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYhtmr6b3Nsqkrqu81PWgAAAE4"]
[Thu Jan 01 15:31:02.545531 2026] [:error] [pid 53873:tid 53890] [client 98.98.66.22:63061] [client 98.98.66.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.98.66.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYitjmhp5IRNxK0rglOJgAAAY0"]
[Thu Jan 01 15:33:06.658072 2026] [:error] [pid 58924:tid 58937] [client 185.223.152.90:46263] [client 185.223.152.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYjMjYXM8NvhWQPUGtHRAAAAMs"]
[Thu Jan 01 15:35:34.753931 2026] [:error] [pid 58817:tid 58831] [client 98.98.66.22:57568] [client 98.98.66.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.98.66.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYjxlebWGLeUWiwYf9OJgAAAAU"]
[Thu Jan 01 15:37:37.464919 2026] [:error] [pid 58818:tid 58866] [client 82.165.19.236:57872] [client 82.165.19.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.19.236, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVYkQWr6b3Nsqkrqu81QpQAAAE0"]
[Thu Jan 01 15:39:15.828122 2026] [:error] [pid 26614:tid 26658] [client 185.223.152.249:64947] [client 185.223.152.249] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.249, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYkoxdl23_Mbe-Eo9gTIQAAAIY"]
[Thu Jan 01 15:40:06.386513 2026] [:error] [pid 26615:tid 26688] [client 98.98.66.22:62088] [client 98.98.66.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.98.66.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYk1h_JbAVB_Sll5zn6vQAAAQk"]
[Thu Jan 01 15:41:03.977166 2026] [:error] [pid 26614:tid 26673] [client 95.168.164.34:59098] [client 95.168.164.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.168.164.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVYlDxdl23_Mbe-Eo9gTuQAAAJU"]
[Thu Jan 01 15:45:33.533485 2026] [:error] [pid 26615:tid 26699] [client 185.223.152.69:26065] [client 185.223.152.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.69, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYmHR_JbAVB_Sll5zn8VgAAARQ"]
[Thu Jan 01 15:45:46.596280 2026] [:error] [pid 26614:tid 26674] [client 98.98.66.22:60661] [client 98.98.66.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.98.66.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYmKhdl23_Mbe-Eo9gUywAAAJY"]
[Thu Jan 01 15:50:00.211620 2026] [:error] [pid 26614:tid 26656] [client 68.178.225.144:28584] [client 68.178.225.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.225.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVYnKBdl23_Mbe-Eo9gVyAAAAIQ"]
[Thu Jan 01 15:54:19.854721 2026] [:error] [pid 26614:tid 26657] [client 132.226.228.67:59884] [client 132.226.228.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.226.228.67, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVYoKxdl23_Mbe-Eo9gWugAAAIU"]
[Thu Jan 01 16:04:24.704266 2026] [:error] [pid 26614:tid 26663] [client 185.223.152.76:49641] [client 185.223.152.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.76, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYqiBdl23_Mbe-Eo9gZJAAAAIs"]
[Thu Jan 01 16:09:46.085548 2026] [:error] [pid 26614:tid 26676] [client 66.94.119.146:39802] [client 66.94.119.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.94.119.146, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVYryhdl23_Mbe-Eo9ga5AAAAJg"]
[Thu Jan 01 16:10:36.599832 2026] [:error] [pid 26709:tid 26725] [client 185.223.152.75:53229] [client 185.223.152.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.75, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYr_MkpCuLUGXqghaU2twAAAM4"]
[Thu Jan 01 16:16:43.240343 2026] [:error] [pid 26615:tid 26680] [client 185.223.152.73:52221] [client 185.223.152.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYtax_JbAVB_Sll5zkFFwAAAQE"]
[Thu Jan 01 16:20:44.777909 2026] [:error] [pid 26614:tid 26657] [client 132.226.228.67:41124] [client 132.226.228.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.226.228.67, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVYuXBdl23_Mbe-Eo9geFQAAAIU"]
[Thu Jan 01 16:29:06.002934 2026] [:error] [pid 36395:tid 36414] [client 185.223.152.68:43079] [client 185.223.152.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYwUmQHG4-J0nOXDr7DjAAAABE"]
[Thu Jan 01 16:35:10.315585 2026] [:error] [pid 26614:tid 26665] [client 185.223.152.87:26727] [client 185.223.152.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.87, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYxvhdl23_Mbe-Eo9gjMwAAAI0"]
[Thu Jan 01 16:37:55.264978 2026] [:error] [pid 26614:tid 26674] [client 51.159.99.245:58172] [client 51.159.99.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.99.245, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVYyYxdl23_Mbe-Eo9gj_QAAAJY"]
[Thu Jan 01 16:41:26.429722 2026] [:error] [pid 26709:tid 26719] [client 185.223.152.72:27265] [client 185.223.152.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVYzNskpCuLUGXqghaU_fQAAAMg"]
[Thu Jan 01 16:53:46.064515 2026] [:error] [pid 26613:tid 26633] [client 185.223.152.75:29343] [client 185.223.152.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.75, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVY2GpZHnkJdYNvbC--MFAAAAEs"]
[Thu Jan 01 16:59:56.653835 2026] [:error] [pid 26709:tid 26714] [client 185.223.152.69:49121] [client 185.223.152.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.69, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVY3jMkpCuLUGXqghaVDagAAAMM"]
[Thu Jan 01 17:03:52.077664 2026] [:error] [pid 26709:tid 26720] [client 34.134.144.77:52194] [client 34.134.144.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.134.144.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVY4eMkpCuLUGXqghaVECQAAAMk"]
[Thu Jan 01 17:06:10.087470 2026] [:error] [pid 26614:tid 26667] [client 185.223.152.90:58543] [client 185.223.152.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVY5Ahdl23_Mbe-Eo9gwtQAAAI8"]
[Thu Jan 01 17:18:20.893358 2026] [:error] [pid 26614:tid 26676] [client 185.223.152.69:29347] [client 185.223.152.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.69, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVY73Bdl23_Mbe-Eo9g2LwAAAJg"]
[Thu Jan 01 17:24:28.056385 2026] [:error] [pid 26709:tid 26717] [client 185.223.152.4:56563] [client 185.223.152.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.4, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVY9TMkpCuLUGXqghaVJvQAAAMY"]
[Thu Jan 01 17:30:13.076272 2026] [:error] [pid 26614:tid 26657] [client 148.113.5.85:46476] [client 148.113.5.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.5.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVY-pRdl23_Mbe-Eo9g9XQAAAIU"]
[Thu Jan 01 17:36:32.588414 2026] [:error] [pid 26615:tid 26685] [client 185.223.152.73:22491] [client 185.223.152.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVZAIB_JbAVB_Sll5zkb4AAAAQY"]
[Thu Jan 01 17:37:01.388137 2026] [:error] [pid 26613:tid 26646] [client 184.168.100.170:33998] [client 184.168.100.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.100.170, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZAPZZHnkJdYNvbC--dQgAAAFg"]
[Thu Jan 01 17:42:24.430925 2026] [:error] [pid 26709:tid 26731] [client 184.168.115.196:20960] [client 184.168.115.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.115.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZBgMkpCuLUGXqghaVPswAAANQ"]
[Thu Jan 01 17:42:37.829627 2026] [:error] [pid 26709:tid 26717] [client 185.223.152.70:30711] [client 185.223.152.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVZBjckpCuLUGXqghaVPugAAAMY"]
[Thu Jan 01 17:52:25.964415 2026] [:error] [pid 26614:tid 26672] [client 184.168.101.160:25962] [client 184.168.101.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.101.160, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZD2Rdl23_Mbe-Eo9hFsgAAAJQ"]
[Thu Jan 01 17:52:35.551496 2026] [:error] [pid 26615:tid 26695] [client 43.159.152.187:50458] [client 43.159.152.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVZD4x_JbAVB_Sll5zkhvQAAARA"]
[Thu Jan 01 18:01:01.100114 2026] [:error] [pid 26615:tid 26679] [client 185.223.152.89:35521] [client 185.223.152.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.89, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVZF3R_JbAVB_Sll5zkkrQAAAQA"]
[Thu Jan 01 18:01:48.765722 2026] [:error] [pid 26614:tid 26670] [client 103.130.216.110:17280] [client 103.130.216.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.130.216.110, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZGDBdl23_Mbe-Eo9hIMAAAAJI"]
[Thu Jan 01 18:03:14.488788 2026] [:error] [pid 36395:tid 36418] [client 46.101.0.130:39168] [client 46.101.0.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.101.0.130, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZGYmQHG4-J0nOXDr7e2QAAABU"]
[Thu Jan 01 18:03:45.361180 2026] [:error] [pid 36395:tid 36412] [client 192.250.232.203:33880] [client 192.250.232.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.232.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZGgWQHG4-J0nOXDr7fwgAAAA8"]
[Thu Jan 01 18:07:00.632289 2026] [:error] [pid 26615:tid 26695] [client 185.223.152.69:28743] [client 185.223.152.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.69, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVZHRB_JbAVB_Sll5zkmQQAAARA"]
[Thu Jan 01 18:19:07.442481 2026] [:error] [pid 26615:tid 26689] [client 185.223.152.68:30829] [client 185.223.152.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVZKGx_JbAVB_Sll5zkqGwAAAQo"]
[Thu Jan 01 18:31:22.111938 2026] [:error] [pid 10403:tid 10426] [client 195.250.27.205:33588] [client 195.250.27.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.250.27.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZM-jUgJV1DkumNzlZJ1gAAAFM"]
[Thu Jan 01 18:39:05.274203 2026] [:error] [pid 27102:tid 27114] [client 182.44.67.97:35280] [client 182.44.67.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVZOyebc38dZOUTlKQDhMQAAAIk"]
[Thu Jan 01 18:48:00.585610 2026] [:error] [pid 40110:tid 40135] [client 159.65.87.245:46148] [client 159.65.87.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.87.245, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZQ4CsKa3Qcf0xCaEiobQAAAJY"]
[Thu Jan 01 18:54:50.860537 2026] [:error] [pid 49509:tid 49588] [client 152.70.215.57:56318] [client 152.70.215.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.70.215.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZSej7APjQPiQgd5NL4TAAAANc"]
[Thu Jan 01 18:57:59.654666 2026] [:error] [pid 49507:tid 49528] [client 92.205.6.124:19212] [client 92.205.6.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.6.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZTN9wjNWJD_fDJULqDQwAAARE"]
[Thu Jan 01 18:58:19.967804 2026] [:error] [pid 49507:tid 49523] [client 66.175.56.126:35752] [client 66.175.56.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.175.56.126, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZTS9wjNWJD_fDJULqDVQAAAQw"]
[Thu Jan 01 19:08:19.537730 2026] [:error] [pid 49509:tid 49586] [client 194.233.68.122:53744] [client 194.233.68.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.233.68.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZVoz7APjQPiQgd5NL77AAAANU"]
[Thu Jan 01 19:13:08.591467 2026] [:error] [pid 49508:tid 49553] [client 84.234.98.73:57222] [client 84.234.98.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.234.98.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZWxOcqh3d5yopjaM2iCQAAAE8"]
[Thu Jan 01 19:13:12.777198 2026] [:error] [pid 49508:tid 49554] [client 77.238.120.100:60664] [client 77.238.120.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.238.120.100, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZWyOcqh3d5yopjaM2iCgAAAFA"]
[Thu Jan 01 19:46:21.901844 2026] [:error] [pid 63981:tid 63994] [client 92.205.175.165:21500] [client 92.205.175.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.175.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZejc5Wjyl5tWjDt5KnWAAAAMo"]
[Thu Jan 01 19:59:56.472313 2026] [:error] [pid 63981:tid 63996] [client 81.88.49.9:26680] [client 81.88.49.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZhvM5Wjyl5tWjDt5KqkQAAAMw"]
[Thu Jan 01 20:04:22.124799 2026] [:error] [pid 63981:tid 64005] [client 93.89.225.8:46292] [client 93.89.225.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.89.225.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZixs5Wjyl5tWjDt5KrpgAAANU"]
[Thu Jan 01 20:09:11.813027 2026] [:error] [pid 63889:tid 63950] [client 173.201.189.56:19224] [client 173.201.189.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.201.189.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZj59U3sRpsUcz9MOBnJAAAAAQ"]
[Thu Jan 01 20:09:25.005850 2026] [:error] [pid 995:tid 1006] [client 66.175.44.40:36682] [client 66.175.44.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.175.44.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZj9WJVFefxwdkvFzjg2QAAAQg"]
[Thu Jan 01 20:24:08.368419 2026] [:error] [pid 63981:tid 64001] [client 140.82.2.37:47826] [client 140.82.2.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 140.82.2.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZnaM5Wjyl5tWjDt5KwcAAAANE"]
[Thu Jan 01 20:30:00.000636 2026] [:error] [pid 63889:tid 63954] [client 43.165.70.220:55350] [client 43.165.70.220] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVZox9U3sRpsUcz9MOBr4QAAAAg"]
[Thu Jan 01 20:42:44.800287 2026] [:error] [pid 63887:tid 63912] [client 159.203.76.93:42956] [client 159.203.76.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.76.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZrxDYeTZeQR8aqQeVpmgAAAFU"]
[Thu Jan 01 20:50:20.673294 2026] [:error] [pid 63981:tid 63992] [client 148.113.37.117:57050] [client 148.113.37.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.37.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZtjM5Wjyl5tWjDt5K1vQAAAMg"]
[Thu Jan 01 21:04:08.846426 2026] [:error] [pid 995:tid 998] [client 139.59.33.85:43488] [client 139.59.33.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.59.33.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZwyGJVFefxwdkvFzjyFAAAAQA"]
[Thu Jan 01 21:10:40.715005 2026] [:error] [pid 63889:tid 63968] [client 20.216.189.83:1408] [client 20.216.189.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.216.189.83, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZyUNU3sRpsUcz9MOB0QAAAABY"]
[Thu Jan 01 21:32:00.391151 2026] [:error] [pid 995:tid 998] [client 69.57.172.110:47532] [client 69.57.172.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.57.172.110, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZ3UGJVFefxwdkvFzj8wAAAAQA"]
[Thu Jan 01 21:41:19.787636 2026] [:error] [pid 63981:tid 63989] [client 41.216.185.84:35220] [client 41.216.185.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.216.185.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZ5f85Wjyl5tWjDt5LDdwAAAMU"]
[Thu Jan 01 21:44:30.799021 2026] [:error] [pid 63889:tid 63950] [client 184.168.115.196:24822] [client 184.168.115.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.115.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVZ6PtU3sRpsUcz9MOB8qAAAAAQ"]
[Thu Jan 01 22:09:48.797441 2026] [:error] [pid 63889:tid 63946] [client 185.110.146.106:52764] [client 185.110.146.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.110.146.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVaALNU3sRpsUcz9MOCDHQAAAAA"]
[Thu Jan 01 22:57:58.325195 2026] [:error] [pid 63981:tid 63984] [client 207.180.239.117:33730] [client 207.180.239.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.180.239.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVaLds5Wjyl5tWjDt5LY7QAAAMA"]
[Thu Jan 01 23:05:19.683956 2026] [:error] [pid 995:tid 1009] [client 54.38.195.241:34796] [client 54.38.195.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.195.241, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVaNL2JVFefxwdkvFzgfGAAAAQo"]
[Thu Jan 01 23:33:48.557861 2026] [:error] [pid 995:tid 1003] [client 116.206.202.84:64963] [client 116.206.202.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.206.202.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVaT3GJVFefxwdkvFzgppwAAAQU"]
[Thu Jan 01 23:39:20.026351 2026] [:error] [pid 63981:tid 63998] [client 116.206.202.84:52205] [client 116.206.202.84] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aVaVKM5Wjyl5tWjDt5LkpAAAAM4"]
[Thu Jan 01 23:40:43.864891 2026] [:error] [pid 63888:tid 63934] [client 116.206.202.84:53140] [client 116.206.202.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.206.202.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVaVe9oJ3YkVCYrOT1w11QAAAI8"]
[Thu Jan 01 23:42:10.690646 2026] [:error] [pid 995:tid 1017] [client 116.206.202.84:56664] [client 116.206.202.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.206.202.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVaV0mJVFefxwdkvFzgslgAAARI"]
[Thu Jan 01 23:43:29.466272 2026] [:error] [pid 63889:tid 63947] [client 116.206.202.84:57454] [client 116.206.202.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.206.202.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVaWIdU3sRpsUcz9MOCbmAAAAAE"]
[Thu Jan 01 23:44:25.482522 2026] [:error] [pid 63889:tid 63958] [client 107.180.114.83:64654] [client 107.180.114.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.114.83, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVaWWdU3sRpsUcz9MOCb1AAAAAw"]
[Thu Jan 01 23:44:48.920157 2026] [:error] [pid 63981:tid 64003] [client 116.206.202.84:55333] [client 116.206.202.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.206.202.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVaWcM5Wjyl5tWjDt5LmqQAAANM"]
[Fri Jan 02 00:06:33.439239 2026] [:error] [pid 63887:tid 63897] [client 89.46.106.211:20884] [client 89.46.106.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.46.106.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVabiTYeTZeQR8aqQeWWDwAAAEY"]
[Fri Jan 02 00:12:41.057406 2026] [:error] [pid 19497:tid 19559] [client 43.156.168.214:60242] [client 43.156.168.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVac-azNNNiUujf1d5E7EQAAAMQ"]
[Fri Jan 02 00:15:59.911362 2026] [:error] [pid 19497:tid 19564] [client 171.252.41.213:37356] [client 171.252.41.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.252.41.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVadv6zNNNiUujf1d5E76QAAAMk"]
[Fri Jan 02 00:21:57.735060 2026] [:error] [pid 19496:tid 19544] [client 102.218.215.27:59922] [client 102.218.215.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.218.215.27, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVafJWM9BBPu2JyEzYv-tAAAAJA"]
[Fri Jan 02 00:29:55.310829 2026] [:error] [pid 19497:tid 19555] [client 64.226.95.165:59832] [client 64.226.95.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.226.95.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVahA6zNNNiUujf1d5FAZwAAAMA"]
[Fri Jan 02 00:31:35.334104 2026] [:error] [pid 19496:tid 19539] [client 103.82.21.169:35984] [client 103.82.21.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.82.21.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVahZ2M9BBPu2JyEzYsBkQAAAIs"]
[Fri Jan 02 00:48:49.365729 2026] [:error] [pid 19495:tid 19521] [client 107.180.116.112:20020] [client 107.180.116.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.116.112, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aValccHOHGMziFVGMwAMHAAAAFU"]
[Fri Jan 02 01:08:05.689114 2026] [:error] [pid 19583:tid 19601] [client 66.175.44.25:59614] [client 66.175.44.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.175.44.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVap9StltYb8hAZpm4tSKAAAAQ8"]
[Fri Jan 02 01:08:36.405472 2026] [:error] [pid 51579:tid 51583] [client 103.20.97.76:20888] [client 103.20.97.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.20.97.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVaqFEQ-wUxlj5k_dbmixQAAAAI"]
[Fri Jan 02 01:10:38.217781 2026] [:error] [pid 19497:tid 19569] [client 114.80.36.40:60732] [client 114.80.36.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVaqjqzNNNiUujf1d5FKqAAAAM4"]
[Fri Jan 02 01:12:01.557666 2026] [:error] [pid 19496:tid 19535] [client 208.113.188.235:49548] [client 208.113.188.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.113.188.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVaq4WM9BBPu2JyEzYsKbgAAAIc"]
[Fri Jan 02 01:13:01.768663 2026] [:error] [pid 19497:tid 19567] [client 149.28.156.221:33886] [client 149.28.156.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.28.156.221, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVarHazNNNiUujf1d5FLDwAAAMw"]
[Fri Jan 02 01:15:07.187314 2026] [:error] [pid 19497:tid 19563] [client 154.0.175.202:53438] [client 154.0.175.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.0.175.202, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVarm6zNNNiUujf1d5FLagAAAMg"]
[Fri Jan 02 01:26:34.461623 2026] [:error] [pid 19583:tid 19588] [client 185.88.197.19:48146] [client 185.88.197.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.88.197.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVauSitltYb8hAZpm4tW7wAAAQI"]
[Fri Jan 02 01:53:35.211198 2026] [:error] [pid 19497:tid 19568] [client 192.250.235.211:39674] [client 192.250.235.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.235.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVa0n6zNNNiUujf1d5FTTwAAAM0"]
[Fri Jan 02 02:10:06.056821 2026] [:error] [pid 51579:tid 51604] [client 171.252.41.213:43492] [client 171.252.41.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.252.41.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVa4fkQ-wUxlj5k_dbm2twAAABc"]
[Fri Jan 02 02:28:30.852669 2026] [:error] [pid 19495:tid 19503] [client 13.79.160.12:2352] [client 13.79.160.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aVa8zsHOHGMziFVGMwAgcQAAAEM"]
[Fri Jan 02 02:28:31.360583 2026] [:error] [pid 51579:tid 51582] [client 13.79.160.12:14525] [client 13.79.160.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aVa8z0Q-wUxlj5k_dbm9LwAAAAE"]
[Fri Jan 02 02:28:31.862912 2026] [:error] [pid 19496:tid 19547] [client 13.79.160.12:15036] [client 13.79.160.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aVa8z2M9BBPu2JyEzYsa9gAAAJM"]
[Fri Jan 02 02:28:32.382378 2026] [:error] [pid 51579:tid 51601] [client 13.79.160.12:16218] [client 13.79.160.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aVa80EQ-wUxlj5k_dbm9MgAAABQ"]
[Fri Jan 02 02:28:32.881436 2026] [:error] [pid 19497:tid 19575] [client 13.79.160.12:11008] [client 13.79.160.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aVa80KzNNNiUujf1d5FbQwAAANQ"]
[Fri Jan 02 02:28:33.381045 2026] [:error] [pid 19497:tid 19559] [client 13.79.160.12:9614] [client 13.79.160.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aVa80azNNNiUujf1d5FbRQAAAMQ"]
[Fri Jan 02 02:28:33.881173 2026] [:error] [pid 19497:tid 19564] [client 13.79.160.12:16255] [client 13.79.160.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aVa80azNNNiUujf1d5FbSgAAAMk"]
[Fri Jan 02 02:28:34.381086 2026] [:error] [pid 19496:tid 19535] [client 13.79.160.12:13105] [client 13.79.160.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aVa80mM9BBPu2JyEzYsa_AAAAIc"]
[Fri Jan 02 02:28:34.878569 2026] [:error] [pid 51579:tid 51590] [client 13.79.160.12:2348] [client 13.79.160.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aVa80kQ-wUxlj5k_dbm9NAAAAAk"]
[Fri Jan 02 02:28:35.380012 2026] [:error] [pid 51579:tid 51595] [client 13.79.160.12:8664] [client 13.79.160.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f2f.php"] [unique_id "aVa800Q-wUxlj5k_dbm9NQAAAA4"]
[Fri Jan 02 02:28:35.878701 2026] [:error] [pid 19496:tid 19552] [client 13.79.160.12:3786] [client 13.79.160.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f2f.php"] [unique_id "aVa802M9BBPu2JyEzYsa_gAAAJg"]
[Fri Jan 02 02:28:36.376413 2026] [:error] [pid 19497:tid 19562] [client 13.79.160.12:1307] [client 13.79.160.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f2f.php"] [unique_id "aVa81KzNNNiUujf1d5FbSwAAAMc"]
[Fri Jan 02 02:28:36.877493 2026] [:error] [pid 51579:tid 51582] [client 13.79.160.12:8715] [client 13.79.160.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f2f.php"] [unique_id "aVa81EQ-wUxlj5k_dbm9OgAAAAE"]
[Fri Jan 02 02:28:37.387253 2026] [:error] [pid 51579:tid 51593] [client 13.79.160.12:7338] [client 13.79.160.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "aVa81UQ-wUxlj5k_dbm9PQAAAAw"]
[Fri Jan 02 02:28:37.886081 2026] [:error] [pid 51579:tid 51591] [client 13.79.160.12:7345] [client 13.79.160.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "aVa81UQ-wUxlj5k_dbm9QQAAAAo"]
[Fri Jan 02 02:48:30.262470 2026] [:error] [pid 19583:tid 19588] [client 103.20.97.76:43316] [client 103.20.97.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.20.97.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVbBfitltYb8hAZpm4tqIwAAAQI"]
[Fri Jan 02 02:52:52.261207 2026] [:error] [pid 19583:tid 19595] [client 43.166.128.187:55640] [client 43.166.128.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVbChCtltYb8hAZpm4trZwAAAQk"]
[Fri Jan 02 03:17:54.825018 2026] [:error] [pid 19497:tid 19555] [client 92.204.223.87:15878] [client 92.204.223.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.204.223.87, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVbIYqzNNNiUujf1d5FlMgAAAMA"]
[Fri Jan 02 03:19:42.404726 2026] [:error] [pid 51579:tid 51598] [client 4.189.160.96:2041] [client 4.189.160.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.189.160.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVbIzkQ-wUxlj5k_dbnQFQAAABE"], referer: https://www.google.com/
[Fri Jan 02 03:19:47.977946 2026] [autoindex:error] [pid 51579:tid 51589] [client 4.189.160.96:2011] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Fri Jan 02 03:19:54.227031 2026] [:error] [pid 19583:tid 19588] [client 4.189.160.96:1999] [client 4.189.160.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.189.160.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVbI2itltYb8hAZpm4tyYwAAAQI"], referer: https://www.bing.com/
[Fri Jan 02 03:19:56.220103 2026] [autoindex:error] [pid 51579:tid 51583] [client 4.189.160.96:2011] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Fri Jan 02 03:19:59.694967 2026] [:error] [pid 19583:tid 19596] [client 4.189.160.96:1999] [client 4.189.160.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.189.160.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVbI3ytltYb8hAZpm4tyagAAAQo"], referer: https://duckduckgo.com/
[Fri Jan 02 03:20:01.057615 2026] [:error] [pid 51579:tid 51589] [client 4.189.160.96:2011] [client 4.189.160.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/test1.php"] [unique_id "aVbI4UQ-wUxlj5k_dbnQRAAAAAg"], referer: https://www.yahoo.com/
[Fri Jan 02 03:27:26.386302 2026] [:error] [pid 19495:tid 19524] [client 148.113.5.85:38138] [client 148.113.5.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.5.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVbKnsHOHGMziFVGMwArxAAAAFg"]
[Fri Jan 02 03:43:01.127643 2026] [:error] [pid 32581:tid 32652] [client 104.234.134.18:36306] [client 104.234.134.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.234.134.18, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVbORalMyIfdLlcLJcTWQwAAAI0"]
[Fri Jan 02 03:51:33.651378 2026] [:error] [pid 63208:tid 63222] [client 103.177.150.26:64121] [client 103.177.150.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.177.150.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVbQRXKLI9INGPLzfndKEwAAAMs"]
[Fri Jan 02 03:56:38.435092 2026] [:error] [pid 63208:tid 63223] [client 209.142.65.194:33732] [client 209.142.65.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.142.65.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVbRdnKLI9INGPLzfndMdQAAAMw"]
[Fri Jan 02 04:03:52.330694 2026] [:error] [pid 63099:tid 63140] [client 97.74.207.221:61198] [client 97.74.207.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 97.74.207.221, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVbTKMmCZokRPYUhzvj4EwAAAEY"]
[Fri Jan 02 04:21:26.173868 2026] [:error] [pid 63208:tid 63232] [client 171.244.206.65:51248] [client 171.244.206.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.244.206.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVbXRnKLI9INGPLzfndWAQAAANU"]
[Fri Jan 02 04:40:11.828867 2026] [:error] [pid 63098:tid 63127] [client 69.49.117.151:35126] [client 69.49.117.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.49.117.151, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVbbq8ez9k78gUs48kp9gAAAABQ"]
[Fri Jan 02 04:53:46.386289 2026] [:error] [pid 63208:tid 63231] [client 109.234.164.79:60506] [client 109.234.164.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.234.164.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVbe2nKLI9INGPLzfndjqwAAANQ"]
[Fri Jan 02 05:27:25.221391 2026] [:error] [pid 63100:tid 63161] [client 15.235.163.7:50566] [client 15.235.163.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.163.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVbmvTuUXUKd3KTnKl-MlgAAAIA"]
[Fri Jan 02 05:37:37.458578 2026] [:error] [pid 63208:tid 63215] [client 66.175.44.53:58950] [client 66.175.44.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.175.44.53, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVbpIXKLI9INGPLzfnd2VwAAAMQ"]
[Fri Jan 02 05:43:48.880945 2026] [:error] [pid 63098:tid 63115] [client 208.109.26.191:15120] [client 208.109.26.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.109.26.191, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVbqlMez9k78gUs48kqPggAAAAg"]
[Fri Jan 02 05:51:03.755846 2026] [:error] [pid 63100:tid 63183] [client 171.244.206.65:49136] [client 171.244.206.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.244.206.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVbsRzuUXUKd3KTnKl-VmwAAAJY"]
[Fri Jan 02 05:56:22.041500 2026] [:error] [pid 63099:tid 63136] [client 82.165.88.129:48818] [client 82.165.88.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.88.129, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVbthsmCZokRPYUhzvgYKwAAAEI"]
[Fri Jan 02 05:56:38.793500 2026] [:error] [pid 63098:tid 63118] [client 109.234.164.79:58464] [client 109.234.164.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.234.164.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVbtlsez9k78gUs48kqTrQAAAAs"]
[Fri Jan 02 05:59:44.020317 2026] [:error] [pid 63099:tid 63145] [client 57.141.2.76:38742] [client 57.141.2.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 57.141.2.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVbuUMmCZokRPYUhzvgZvgAAAEs"]
[Fri Jan 02 06:01:15.989077 2026] [:error] [pid 63099:tid 63136] [client 209.142.65.194:57730] [client 209.142.65.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.142.65.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVbuq8mCZokRPYUhzvgaAwAAAEI"]
[Fri Jan 02 06:04:18.759186 2026] [:error] [pid 63208:tid 63216] [client 103.75.185.38:30754] [client 103.75.185.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.75.185.38, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVbvYnKLI9INGPLzfneDUAAAAMU"]
[Fri Jan 02 06:10:27.374030 2026] [:error] [pid 63099:tid 63154] [client 185.182.56.231:56852] [client 185.182.56.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.182.56.231, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVbw08mCZokRPYUhzvgc6QAAAFQ"]
[Fri Jan 02 06:58:16.986185 2026] [:error] [pid 63100:tid 63166] [client 43.165.189.206:56374] [client 43.165.189.206] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVb8CDuUXUKd3KTnKl-yOAAAAIU"]
[Fri Jan 02 07:06:33.345325 2026] [:error] [pid 63098:tid 63115] [client 81.88.49.50:11688] [client 81.88.49.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVb9-cez9k78gUs48kqq_gAAAAg"]
[Fri Jan 02 07:07:52.399631 2026] [:error] [pid 63099:tid 63149] [client 162.241.252.17:54246] [client 162.241.252.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.252.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVb-SMmCZokRPYUhzvgv0wAAAE8"]
[Fri Jan 02 07:15:07.333523 2026] [:error] [pid 63208:tid 63235] [client 66.175.44.53:38022] [client 66.175.44.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.175.44.53, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVb_-3KLI9INGPLzfnen_QAAANg"]
[Fri Jan 02 07:21:52.146074 2026] [:error] [pid 63208:tid 63219] [client 38.246.33.99:63597] [client 38.246.33.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.246.33.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVcBkHKLI9INGPLzfnerFwAAAMg"]
[Fri Jan 02 08:35:19.907957 2026] [:error] [pid 63208:tid 63212] [client 38.246.33.131:64262] [client 38.246.33.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.246.33.131, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVcSx3KLI9INGPLzfnfLzgAAAME"]
[Fri Jan 02 09:04:58.298420 2026] [:error] [pid 63208:tid 63234] [client 72.29.178.86:57428] [client 72.29.178.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.29.178.86, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVcZunKLI9INGPLzfnfS2gAAANc"]
[Fri Jan 02 09:47:53.454787 2026] [:error] [pid 50046:tid 50066] [client 38.246.33.39:58222] [client 38.246.33.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.246.33.39, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVcjySzv7fgIiwkQYNA3eAAAAVI"]
[Fri Jan 02 10:02:36.741955 2026] [:error] [pid 50186:tid 50196] [client 213.192.239.72:49734] [client 213.192.239.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.192.239.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVcnPFXqK_iX4f-S70LQhwAAAYg"]
[Fri Jan 02 10:13:33.922127 2026] [:error] [pid 50046:tid 50050] [client 160.30.179.245:48652] [client 160.30.179.245] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aVcpzSzv7fgIiwkQYNA9gQAAAUI"]
[Fri Jan 02 10:13:33.925314 2026] [:error] [pid 50046:tid 50060] [client 160.30.179.245:48644] [client 160.30.179.245] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/app/.env"] [unique_id "aVcpzSzv7fgIiwkQYNA9ggAAAUw"]
[Fri Jan 02 10:13:33.928340 2026] [:error] [pid 63099:tid 63158] [client 160.30.179.245:48662] [client 160.30.179.245] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.save"] [unique_id "aVcpzcmCZokRPYUhzvhgVwAAAFg"]
[Fri Jan 02 10:13:33.928426 2026] [:error] [pid 63098:tid 63111] [client 160.30.179.245:48658] [client 160.30.179.245] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/core/.env"] [unique_id "aVcpzcez9k78gUs48krbMgAAAAQ"]
[Fri Jan 02 10:13:34.048814 2026] [:error] [pid 50046:tid 50051] [client 160.30.179.245:48710] [client 160.30.179.245] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.save"] [unique_id "aVcpzizv7fgIiwkQYNA9gwAAAUM"]
[Fri Jan 02 10:13:34.081052 2026] [:error] [pid 29316:tid 29335] [client 160.30.179.245:48702] [client 160.30.179.245] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/core/.env"] [unique_id "aVcpztfT9ty-7jZmgf8y4QAAARE"]
[Fri Jan 02 10:13:34.097354 2026] [:error] [pid 29316:tid 29322] [client 160.30.179.245:48696] [client 160.30.179.245] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aVcpztfT9ty-7jZmgf8y4wAAAQQ"]
[Fri Jan 02 10:13:34.141823 2026] [:error] [pid 63099:tid 63141] [client 160.30.179.245:48690] [client 160.30.179.245] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/app/.env"] [unique_id "aVcpzsmCZokRPYUhzvhgWAAAAEc"]
[Fri Jan 02 10:21:28.364006 2026] [:error] [pid 63100:tid 63179] [client 69.163.181.251:57190] [client 69.163.181.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.181.251, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVcrqDuUXUKd3KTnKl_sngAAAJI"]
[Fri Jan 02 10:23:43.797492 2026] [:error] [pid 63098:tid 63110] [client 81.88.49.14:59958] [client 81.88.49.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVcsL8ez9k78gUs48krdHgAAAAM"]
[Fri Jan 02 10:29:11.143226 2026] [:error] [pid 50046:tid 50056] [client 190.92.174.183:53598] [client 190.92.174.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.92.174.183, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVctdyzv7fgIiwkQYNBB9AAAAUg"]
[Fri Jan 02 10:42:57.871497 2026] [:error] [pid 50046:tid 50068] [client 81.88.49.14:62233] [client 81.88.49.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVcwsSzv7fgIiwkQYNBFdwAAAVQ"]
[Fri Jan 02 10:50:23.187720 2026] [:error] [pid 63099:tid 63137] [client 54.236.84.252:34246] [client 54.236.84.252] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aVcyb8mCZokRPYUhzvhmwQAAAEM"]
[Fri Jan 02 10:59:09.594647 2026] [:error] [pid 50186:tid 50205] [client 38.246.32.40:52712] [client 38.246.32.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.246.32.40, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVc0fVXqK_iX4f-S70LjnAAAAZE"]
[Fri Jan 02 11:00:18.284733 2026] [:error] [pid 63099:tid 63142] [client 157.245.42.243:47606] [client 157.245.42.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.42.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVc0wsmCZokRPYUhzvhoaQAAAEg"]
[Fri Jan 02 11:14:49.685516 2026] [:error] [pid 50046:tid 50060] [client 160.250.186.135:43580] [client 160.250.186.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.186.135, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVc4KSzv7fgIiwkQYNBNLAAAAUw"]
[Fri Jan 02 12:10:14.896719 2026] [:error] [pid 29316:tid 29333] [client 208.115.224.229:60638] [client 208.115.224.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.115.224.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVdFJtfT9ty-7jZmgf9K-gAAAQ8"]
[Fri Jan 02 12:14:58.383799 2026] [:error] [pid 63098:tid 63109] [client 103.159.51.214:55640] [client 103.159.51.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.159.51.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVdGQsez9k78gUs48krvEAAAAAI"]
[Fri Jan 02 12:38:56.505580 2026] [:error] [pid 63099:tid 63156] [client 198.199.69.209:43078] [client 198.199.69.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.199.69.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVdL4MmCZokRPYUhzvh3bwAAAFY"]
[Fri Jan 02 12:41:53.608668 2026] [:error] [pid 63208:tid 63213] [client 209.38.214.133:57962] [client 209.38.214.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.38.214.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVdMkXKLI9INGPLzfnf7ygAAAMI"]
[Fri Jan 02 12:41:55.285235 2026] [:error] [pid 63099:tid 63138] [client 209.38.214.133:57109] [client 209.38.214.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.38.214.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVdMk8mCZokRPYUhzvh3xQAAAEQ"]
[Fri Jan 02 13:06:11.607640 2026] [:error] [pid 63208:tid 63235] [client 54.236.84.252:58688] [client 54.236.84.252] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aVdSQ3KLI9INGPLzfncAbgAAANg"]
[Fri Jan 02 13:06:58.596249 2026] [:error] [pid 63100:tid 63168] [client 209.38.214.133:59987] [client 209.38.214.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.38.214.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVdScjuUXUKd3KTnKl8IKgAAAIc"]
[Fri Jan 02 13:08:46.481648 2026] [:error] [pid 43358:tid 43379] [client 138.197.191.238:53930] [client 138.197.191.238] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.197.191.238, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVdS3gncbHK9auzvrA8HIQAAAdM"]
[Fri Jan 02 13:08:48.144406 2026] [:error] [pid 50186:tid 50210] [client 138.197.191.238:54459] [client 138.197.191.238] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.197.191.238, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVdS4FXqK_iX4f-S70IJOwAAAZY"]
[Fri Jan 02 13:13:58.766475 2026] [:error] [pid 29316:tid 29339] [client 209.38.214.133:56054] [client 209.38.214.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.38.214.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVdUFtfT9ty-7jZmgf9XhwAAARU"]
[Fri Jan 02 13:21:46.494915 2026] [:error] [pid 50186:tid 50196] [client 209.38.214.133:52233] [client 209.38.214.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.38.214.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVdV6lXqK_iX4f-S70IMwwAAAYg"]
[Fri Jan 02 13:23:06.196163 2026] [:error] [pid 50186:tid 50190] [client 38.246.33.167:51969] [client 38.246.33.167] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.246.33.167, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVdWOlXqK_iX4f-S70INqAAAAYI"]
[Fri Jan 02 13:52:18.542803 2026] [:error] [pid 63099:tid 63146] [client 43.130.37.243:44070] [client 43.130.37.243] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVddEsmCZokRPYUhzviBeAAAAEw"]
[Fri Jan 02 14:01:59.122896 2026] [:error] [pid 50186:tid 50206] [client 167.99.181.249:59012] [client 167.99.181.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aVdfV1XqK_iX4f-S70IXLQAAAZI"]
[Fri Jan 02 14:02:08.426173 2026] [authz_core:error] [pid 63100:tid 63179] [client 167.99.181.249:59088] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Fri Jan 02 14:02:12.541853 2026] [:error] [pid 63098:tid 63119] [client 167.99.181.249:42258] [client 167.99.181.249] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aVdfZMez9k78gUs48kr_gQAAAAw"]
[Fri Jan 02 14:02:14.535231 2026] [:error] [pid 50186:tid 50193] [client 167.99.181.249:42270] [client 167.99.181.249] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aVdfZlXqK_iX4f-S70IXMAAAAYU"]
[Fri Jan 02 14:03:32.491818 2026] [:error] [pid 50186:tid 50203] [client 20.110.44.193:39752] [client 20.110.44.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.110.44.193, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVdftFXqK_iX4f-S70IXWQAAAY8"]
[Fri Jan 02 14:23:28.906289 2026] [:error] [pid 29316:tid 29329] [client 20.216.189.83:1408] [client 20.216.189.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.216.189.83, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVdkYNfT9ty-7jZmgf9kdAAAAQs"]
[Fri Jan 02 14:41:10.672987 2026] [:error] [pid 63100:tid 63169] [client 38.246.32.247:53924] [client 38.246.32.247] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.246.32.247, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVdohjuUXUKd3KTnKl8U4gAAAIg"]
[Fri Jan 02 14:50:45.943323 2026] [:error] [pid 50186:tid 50204] [client 192.169.145.40:44374] [client 192.169.145.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.169.145.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVdqxVXqK_iX4f-S70IjcwAAAZA"]
[Fri Jan 02 14:51:07.833982 2026] [:error] [pid 43358:tid 43366] [client 192.169.145.40:15404] [client 192.169.145.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.169.145.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVdq2wncbHK9auzvrA8aTgAAAcY"]
[Fri Jan 02 15:50:18.363241 2026] [:error] [pid 29316:tid 29324] [client 162.241.217.222:22208] [client 162.241.217.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.217.222, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVd4utfT9ty-7jZmgf92pAAAAQY"]
[Fri Jan 02 15:54:21.689469 2026] [:error] [pid 50046:tid 50057] [client 162.241.244.10:15142] [client 162.241.244.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.244.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVd5rSzv7fgIiwkQYNB_YwAAAUk"]
[Fri Jan 02 15:56:38.392948 2026] [:error] [pid 63098:tid 63125] [client 107.180.119.149:60080] [client 107.180.119.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.119.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVd6Nsez9k78gUs48koNsAAAABI"]
[Fri Jan 02 15:57:44.556954 2026] [:error] [pid 29316:tid 29339] [client 92.204.18.69:55030] [client 92.204.18.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.204.18.69, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVd6eNfT9ty-7jZmgf93yQAAARU"]
[Fri Jan 02 15:58:40.250265 2026] [:error] [pid 50046:tid 50056] [client 38.246.33.198:60359] [client 38.246.33.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.246.33.198, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVd6sCzv7fgIiwkQYNB_0gAAAUg"]
[Fri Jan 02 16:10:39.417879 2026] [:error] [pid 63099:tid 63136] [client 20.216.189.83:1408] [client 20.216.189.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.216.189.83, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVd9f8mCZokRPYUhzviTaQAAAEI"]
[Fri Jan 02 16:33:15.530190 2026] [:error] [pid 50186:tid 50203] [client 43.135.142.7:55124] [client 43.135.142.7] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVeCy1XqK_iX4f-S70I61wAAAY8"]
[Fri Jan 02 17:06:55.214512 2026] [:error] [pid 63098:tid 63111] [client 74.208.59.89:48166] [client 74.208.59.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.208.59.89, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVeKr8ez9k78gUs48kob1QAAAAQ"]
[Fri Jan 02 17:18:31.714821 2026] [:error] [pid 63099:tid 63155] [client 220.158.233.50:13996] [client 220.158.233.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.158.233.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVeNZ8mCZokRPYUhzvibnQAAAFU"]
[Fri Jan 02 17:22:30.782645 2026] [:error] [pid 50186:tid 50190] [client 104.28.240.85:56823] [client 104.28.240.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.28.240.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVeOVlXqK_iX4f-S70JE7QAAAYI"]
[Fri Jan 02 17:23:31.473419 2026] [:error] [pid 63208:tid 63226] [client 173.201.186.36:57496] [client 173.201.186.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.201.186.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVeOk3KLI9INGPLzfncmhQAAAM8"]
[Fri Jan 02 17:50:44.565736 2026] [:error] [pid 29316:tid 29331] [client 68.178.246.186:47764] [client 68.178.246.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.246.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVeU9NfT9ty-7jZmgf-J0wAAAQ0"]
[Fri Jan 02 18:13:51.152605 2026] [:error] [pid 43358:tid 43361] [client 196.188.57.0:21475] [client 196.188.57.0] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.188.57.0, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVeaXwncbHK9auzvrA83owAAAcE"]
[Fri Jan 02 18:14:16.377592 2026] [:error] [pid 50046:tid 50050] [client 69.163.176.23:39316] [client 69.163.176.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.176.23, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVeaeCzv7fgIiwkQYNCRPAAAAUI"]
[Fri Jan 02 18:16:46.916689 2026] [:error] [pid 63208:tid 63234] [client 156.232.88.2:59700] [client 156.232.88.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.232.88.2, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVebDnKLI9INGPLzfncsYgAAANc"]
[Fri Jan 02 18:39:52.854032 2026] [:error] [pid 43358:tid 43384] [client 98.70.40.140:51594] [client 98.70.40.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.70.40.140, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVegeAncbHK9auzvrA86rwAAAdg"]
[Fri Jan 02 18:45:17.527289 2026] [:error] [pid 43358:tid 43375] [client 98.70.40.140:55034] [client 98.70.40.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.70.40.140, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVehvQncbHK9auzvrA87UgAAAc8"]
[Fri Jan 02 18:49:57.418350 2026] [:error] [pid 50186:tid 50192] [client 20.186.19.24:38556] [client 20.186.19.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.186.19.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVei1VXqK_iX4f-S70JTtAAAAYQ"]
[Fri Jan 02 18:54:36.567705 2026] [:error] [pid 63100:tid 63162] [client 45.128.39.198:54593] [client 45.128.39.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.128.39.198, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVej7DuUXUKd3KTnKl825wAAAIE"]
[Fri Jan 02 19:02:37.426783 2026] [:error] [pid 43358:tid 43361] [client 15.235.163.7:57402] [client 15.235.163.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.163.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVelzQncbHK9auzvrA898gAAAcE"]
[Fri Jan 02 19:22:26.212815 2026] [:error] [pid 43358:tid 43381] [client 107.180.113.40:64466] [client 107.180.113.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.113.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVeqcgncbHK9auzvrA9CVAAAAdU"]
[Fri Jan 02 19:24:17.691873 2026] [:error] [pid 63100:tid 63175] [client 68.178.246.186:34630] [client 68.178.246.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.246.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVeq4TuUXUKd3KTnKl87-QAAAI4"]
[Fri Jan 02 19:31:11.254603 2026] [:error] [pid 50046:tid 50060] [client 184.168.114.114:54222] [client 184.168.114.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.114.114, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVesfyzv7fgIiwkQYNCdCgAAAUw"]
[Fri Jan 02 19:51:28.968428 2026] [:error] [pid 63100:tid 63165] [client 92.204.18.69:51804] [client 92.204.18.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.204.18.69, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVexQDuUXUKd3KTnKl9CNwAAAIQ"]
[Fri Jan 02 19:54:25.117509 2026] [:error] [pid 50186:tid 50192] [client 88.99.148.122:52292] [client 88.99.148.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.99.148.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVex8VXqK_iX4f-S70JkgAAAAYQ"]
[Fri Jan 02 20:14:34.060188 2026] [:error] [pid 29316:tid 29335] [client 146.70.180.55:55533] [client 146.70.180.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.70.180.55, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVe2qtfT9ty-7jZmgf-ktQAAARE"]
[Fri Jan 02 20:53:59.101741 2026] [:error] [pid 63098:tid 63113] [client 38.130.75.26:60400] [client 38.130.75.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.130.75.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVe_58ez9k78gUs48kpasAAAAAY"]
[Fri Jan 02 21:08:28.757833 2026] [:error] [pid 50186:tid 50188] [client 118.139.181.212:27640] [client 118.139.181.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.139.181.212, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVfDTFXqK_iX4f-S70J5gAAAAYA"]
[Fri Jan 02 21:31:55.746801 2026] [:error] [pid 29316:tid 29320] [client 194.187.251.217:49689] [client 194.187.251.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.187.251.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVfIy9fT9ty-7jZmgf-1UwAAAQI"]
[Fri Jan 02 21:57:04.626485 2026] [:error] [pid 63208:tid 63233] [client 144.126.141.154:35588] [client 144.126.141.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.126.141.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVfOsHKLI9INGPLzfndQKAAAANY"]
[Fri Jan 02 22:09:57.952918 2026] [:error] [pid 50046:tid 50060] [client 103.28.36.66:52954] [client 103.28.36.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.28.36.66, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVfRtSzv7fgIiwkQYNC7VQAAAUw"]
[Fri Jan 02 22:11:10.858641 2026] [:error] [pid 29316:tid 29341] [client 208.109.61.195:48600] [client 208.109.61.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.109.61.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVfR_tfT9ty-7jZmgf_AxAAAARc"]
[Fri Jan 02 22:13:46.954704 2026] [:error] [pid 43358:tid 43371] [client 89.116.104.41:49576] [client 89.116.104.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.116.104.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVfSmgncbHK9auzvrA9m6AAAAcs"]
[Fri Jan 02 22:16:14.248952 2026] [:error] [pid 63098:tid 63108] [client 192.169.145.40:29400] [client 192.169.145.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.169.145.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVfTLsez9k78gUs48kp3TgAAAAE"]
[Fri Jan 02 22:49:15.256251 2026] [:error] [pid 63100:tid 63184] [client 103.231.202.90:52692] [client 103.231.202.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.231.202.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVfa6zuUXUKd3KTnKl9lpAAAAJc"]
[Fri Jan 02 23:07:44.191725 2026] [:error] [pid 43358:tid 43370] [client 34.31.240.43:59747] [client 34.31.240.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.31.240.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVffQAncbHK9auzvrA90fwAAAco"]
[Fri Jan 02 23:07:46.758985 2026] [:error] [pid 43358:tid 43381] [client 34.31.240.43:59747] [client 34.31.240.43] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aVffQgncbHK9auzvrA90hAAAAdU"]
[Fri Jan 02 23:07:46.972447 2026] [:error] [pid 43358:tid 43365] [client 34.31.240.43:59747] [client 34.31.240.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.31.240.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVffQgncbHK9auzvrA90hQAAAcU"]
[Fri Jan 02 23:07:48.696647 2026] [:error] [pid 63100:tid 63170] [client 34.31.240.43:62284] [client 34.31.240.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.31.240.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVffRDuUXUKd3KTnKl9pCwAAAIk"]
[Fri Jan 02 23:07:50.103566 2026] [:error] [pid 50186:tid 50189] [client 34.31.240.43:57659] [client 34.31.240.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.31.240.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVffRlXqK_iX4f-S70KblwAAAYE"]
[Fri Jan 02 23:07:51.497487 2026] [:error] [pid 63099:tid 63150] [client 34.31.240.43:60322] [client 34.31.240.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.31.240.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVffR8mCZokRPYUhzvjWIAAAAFA"]
[Fri Jan 02 23:07:52.915897 2026] [:error] [pid 63098:tid 63118] [client 34.31.240.43:51462] [client 34.31.240.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.31.240.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVffSMez9k78gUs48kqIoAAAAAs"]
[Fri Jan 02 23:07:52.916069 2026] [:error] [pid 63098:tid 63118] [client 34.31.240.43:51462] [client 34.31.240.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.31.240.43, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVffSMez9k78gUs48kqIoAAAAAs"]
[Fri Jan 02 23:15:55.837031 2026] [:error] [pid 63098:tid 63113] [client 68.178.220.172:38830] [client 68.178.220.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.220.172, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVfhK8ez9k78gUs48kqLkgAAAAY"]
[Fri Jan 02 23:17:30.954142 2026] [:error] [pid 43358:tid 43379] [client 34.186.29.226:56012] [client 34.186.29.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.186.29.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVfhigncbHK9auzvrA92lwAAAdM"]
[Fri Jan 02 23:17:32.956299 2026] [:error] [pid 43358:tid 43372] [client 34.186.29.226:56012] [client 34.186.29.226] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aVfhjAncbHK9auzvrA92mwAAAcw"]
[Fri Jan 02 23:17:33.114794 2026] [:error] [pid 43358:tid 43363] [client 34.186.29.226:56012] [client 34.186.29.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.186.29.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVfhjQncbHK9auzvrA92nAAAAcM"]
[Fri Jan 02 23:17:34.332896 2026] [:error] [pid 63099:tid 63138] [client 34.186.29.226:52079] [client 34.186.29.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.186.29.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVfhjsmCZokRPYUhzvjXYAAAAEQ"]
[Fri Jan 02 23:17:35.582699 2026] [:error] [pid 50046:tid 50059] [client 34.186.29.226:58147] [client 34.186.29.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.186.29.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVfhjyzv7fgIiwkQYNDMdgAAAUs"]
[Fri Jan 02 23:17:35.586998 2026] [:error] [pid 50046:tid 50059] [client 34.186.29.226:58147] [client 34.186.29.226] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/usr/local/apache/modsecurity-cwaf/rules/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 34.186.29.226 (+1 hits since last alert)|expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVfhjyzv7fgIiwkQYNDMdgAAAUs"]
[Fri Jan 02 23:33:03.916613 2026] [:error] [pid 50186:tid 50195] [client 148.72.107.165:48144] [client 148.72.107.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.107.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVflL1XqK_iX4f-S70KivAAAAYc"]
[Fri Jan 02 23:35:06.393857 2026] [:error] [pid 63098:tid 63116] [client 85.186.88.250:52106] [client 85.186.88.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.186.88.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVflqsez9k78gUs48kqTQgAAAAk"]
[Sat Jan 03 00:08:41.995872 2026] [:error] [pid 50046:tid 50052] [client 72.29.178.86:49274] [client 72.29.178.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.29.178.86, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVftiSzv7fgIiwkQYNDYLAAAAUQ"]
[Sat Jan 03 00:16:21.180567 2026] [:error] [pid 24660:tid 24706] [client 92.205.151.24:24524] [client 92.205.151.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.151.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVfvVWZwWsLNsJ3ZH7atsQAAAE0"]
[Sat Jan 03 00:17:37.145834 2026] [:error] [pid 24661:tid 24726] [client 143.110.218.66:58924] [client 143.110.218.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.218.66, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVfvoRfxsu5kmLDAcZtx-wAAAIY"]
[Sat Jan 03 00:45:47.295728 2026] [:error] [pid 24661:tid 24726] [client 4.196.97.109:16374] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aVf2Oxfxsu5kmLDAcZt98QAAAIY"]
[Sat Jan 03 00:45:47.966032 2026] [:error] [pid 24749:tid 24754] [client 4.196.97.109:16361] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aVf2O0iv6Q9UlqwBJkY_ogAAAMM"]
[Sat Jan 03 00:45:53.217873 2026] [:error] [pid 24749:tid 24775] [client 4.196.97.109:16320] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aVf2QUiv6Q9UlqwBJkY_qgAAANg"]
[Sat Jan 03 00:45:55.647969 2026] [:error] [pid 24660:tid 24717] [client 4.196.97.109:16339] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aVf2Q2ZwWsLNsJ3ZH7a6wwAAAFg"]
[Sat Jan 03 00:46:01.542145 2026] [:error] [pid 24660:tid 24702] [client 4.196.97.109:16274] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an8.php"] [unique_id "aVf2SWZwWsLNsJ3ZH7a64gAAAEk"]
[Sat Jan 03 00:46:03.497965 2026] [:error] [pid 24749:tid 24763] [client 4.196.97.109:16342] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an8.php"] [unique_id "aVf2S0iv6Q9UlqwBJkY_2QAAAMw"]
[Sat Jan 03 00:46:04.257192 2026] [:error] [pid 24661:tid 24735] [client 4.196.97.109:16280] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an8.php"] [unique_id "aVf2TBfxsu5kmLDAcZt-NwAAAI8"]
[Sat Jan 03 00:46:15.998686 2026] [:error] [pid 24749:tid 24773] [client 4.196.97.109:16259] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/esp.php"] [unique_id "aVf2V0iv6Q9UlqwBJkZABwAAANY"]
[Sat Jan 03 00:46:25.916839 2026] [:error] [pid 24749:tid 24763] [client 4.196.97.109:16380] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/esp.php"] [unique_id "aVf2YUiv6Q9UlqwBJkZAMQAAAMw"]
[Sat Jan 03 00:46:38.664024 2026] [:error] [pid 24749:tid 24769] [client 4.196.97.109:16285] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/21x.php"] [unique_id "aVf2bkiv6Q9UlqwBJkZAVQAAANI"]
[Sat Jan 03 00:46:39.162115 2026] [:error] [pid 24749:tid 24754] [client 4.196.97.109:16376] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/21x.php"] [unique_id "aVf2b0iv6Q9UlqwBJkZAWwAAAMM"]
[Sat Jan 03 00:46:44.157759 2026] [:error] [pid 24749:tid 24754] [client 4.196.97.109:16264] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/21x.php"] [unique_id "aVf2dEiv6Q9UlqwBJkZAfQAAAMM"]
[Sat Jan 03 00:46:45.873868 2026] [:error] [pid 24661:tid 24729] [client 4.196.97.109:16267] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/21x.php"] [unique_id "aVf2dRfxsu5kmLDAcZt-aQAAAIk"]
[Sat Jan 03 00:46:53.441853 2026] [:error] [pid 24661:tid 24743] [client 4.196.97.109:16365] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f2f.php"] [unique_id "aVf2fRfxsu5kmLDAcZt-jgAAAJc"]
[Sat Jan 03 00:46:57.000219 2026] [:error] [pid 24659:tid 24680] [client 4.196.97.109:16325] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f2f.php"] [unique_id "aVf2gGucj-rXdFUnVEsi4wAAABA"]
[Sat Jan 03 00:46:58.092754 2026] [:error] [pid 24660:tid 24699] [client 4.196.97.109:16326] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f2f.php"] [unique_id "aVf2gmZwWsLNsJ3ZH7a7YQAAAEY"]
[Sat Jan 03 00:47:05.256352 2026] [:error] [pid 24661:tid 24724] [client 4.196.97.109:16330] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f2f.php"] [unique_id "aVf2iRfxsu5kmLDAcZt-qQAAAIQ"]
[Sat Jan 03 00:47:06.067642 2026] [:error] [pid 24660:tid 24701] [client 4.196.97.109:16364] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ths.php"] [unique_id "aVf2imZwWsLNsJ3ZH7a7dwAAAEg"]
[Sat Jan 03 00:47:07.103490 2026] [:error] [pid 24661:tid 24720] [client 4.196.97.109:16257] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ths.php"] [unique_id "aVf2ixfxsu5kmLDAcZt-rAAAAIA"]
[Sat Jan 03 00:47:09.568054 2026] [:error] [pid 24660:tid 24717] [client 4.196.97.109:16383] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ths.php"] [unique_id "aVf2jWZwWsLNsJ3ZH7a7gQAAAFg"]
[Sat Jan 03 00:47:11.932798 2026] [:error] [pid 24660:tid 24710] [client 4.196.97.109:16276] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ths.php"] [unique_id "aVf2j2ZwWsLNsJ3ZH7a7igAAAFE"]
[Sat Jan 03 00:47:14.047634 2026] [:error] [pid 24659:tid 24669] [client 4.196.97.109:16354] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aVf2kmucj-rXdFUnVEsjCgAAAAU"]
[Sat Jan 03 00:47:15.216273 2026] [:error] [pid 24661:tid 24722] [client 4.196.97.109:16329] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aVf2kxfxsu5kmLDAcZt-wgAAAII"]
[Sat Jan 03 00:47:17.030945 2026] [:error] [pid 24660:tid 24715] [client 4.196.97.109:16273] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aVf2lWZwWsLNsJ3ZH7a7oAAAAFY"]
[Sat Jan 03 00:47:20.052985 2026] [:error] [pid 24749:tid 24763] [client 4.196.97.109:16323] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aVf2mEiv6Q9UlqwBJkZA7gAAAMw"]
[Sat Jan 03 00:47:23.506503 2026] [:error] [pid 24659:tid 24668] [client 4.196.97.109:16382] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/990.php"] [unique_id "aVf2m2ucj-rXdFUnVEsjGQAAAAQ"]
[Sat Jan 03 00:47:24.282342 2026] [:error] [pid 24659:tid 24664] [client 4.196.97.109:16368] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/990.php"] [unique_id "aVf2nGucj-rXdFUnVEsjHgAAAAA"]
[Sat Jan 03 00:47:25.012848 2026] [:error] [pid 24661:tid 24729] [client 4.196.97.109:16377] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/990.php"] [unique_id "aVf2nRfxsu5kmLDAcZt-0QAAAIk"]
[Sat Jan 03 00:47:25.939897 2026] [:error] [pid 24660:tid 24710] [client 4.196.97.109:16322] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/990.php"] [unique_id "aVf2nWZwWsLNsJ3ZH7a7ugAAAFE"]
[Sat Jan 03 00:47:27.065280 2026] [:error] [pid 24659:tid 24676] [client 4.196.97.109:16359] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d996699999.php"] [unique_id "aVf2n2ucj-rXdFUnVEsjKgAAAAw"]
[Sat Jan 03 00:47:28.244993 2026] [:error] [pid 24661:tid 24732] [client 4.196.97.109:16370] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d996699999.php"] [unique_id "aVf2oBfxsu5kmLDAcZt-1gAAAIw"]
[Sat Jan 03 00:47:28.872819 2026] [:error] [pid 24749:tid 24759] [client 4.196.97.109:16283] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d996699999.php"] [unique_id "aVf2oEiv6Q9UlqwBJkZA_wAAAMg"]
[Sat Jan 03 00:47:31.014182 2026] [:error] [pid 24660:tid 24693] [client 4.196.97.109:16192] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d996699999.php"] [unique_id "aVf2o2ZwWsLNsJ3ZH7a7yAAAAEA"]
[Sat Jan 03 00:47:33.835241 2026] [:error] [pid 24659:tid 24684] [client 4.196.97.109:16235] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ierne.php"] [unique_id "aVf2pWucj-rXdFUnVEsjNgAAABQ"]
[Sat Jan 03 00:47:35.338742 2026] [:error] [pid 24660:tid 24716] [client 4.196.97.109:16261] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ierne.php"] [unique_id "aVf2p2ZwWsLNsJ3ZH7a7zQAAAFc"]
[Sat Jan 03 00:47:39.593649 2026] [:error] [pid 24749:tid 24759] [client 4.196.97.109:16271] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ierne.php"] [unique_id "aVf2q0iv6Q9UlqwBJkZBGgAAAMg"]
[Sat Jan 03 00:47:40.718764 2026] [:error] [pid 24661:tid 24731] [client 4.196.97.109:16347] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ierne.php"] [unique_id "aVf2rBfxsu5kmLDAcZt-_gAAAIs"]
[Sat Jan 03 00:47:42.030787 2026] [:error] [pid 24749:tid 24764] [client 4.196.97.109:16199] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xde.php"] [unique_id "aVf2rkiv6Q9UlqwBJkZBIwAAAM0"]
[Sat Jan 03 00:47:43.710905 2026] [:error] [pid 24661:tid 24728] [client 4.196.97.109:16371] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xde.php"] [unique_id "aVf2rxfxsu5kmLDAcZt_CAAAAIg"]
[Sat Jan 03 00:47:44.418236 2026] [:error] [pid 24660:tid 24713] [client 4.196.97.109:16288] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xde.php"] [unique_id "aVf2sGZwWsLNsJ3ZH7a73QAAAFQ"]
[Sat Jan 03 00:47:46.835239 2026] [:error] [pid 24749:tid 24775] [client 4.196.97.109:16333] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xde.php"] [unique_id "aVf2skiv6Q9UlqwBJkZBPAAAANg"]
[Sat Jan 03 00:47:50.335501 2026] [:error] [pid 24749:tid 24759] [client 4.196.97.109:16366] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1yade.php"] [unique_id "aVf2tkiv6Q9UlqwBJkZBQwAAAMg"]
[Sat Jan 03 00:47:51.546297 2026] [:error] [pid 24749:tid 24762] [client 4.196.97.109:16262] [client 4.196.97.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1yade.php"] [unique_id "aVf2t0iv6Q9UlqwBJkZBSQAAAMs"]
[Sat Jan 03 01:39:12.660008 2026] [:error] [pid 24659:tid 24666] [client 194.187.251.245:54872] [client 194.187.251.245] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.187.251.245, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVgCwGucj-rXdFUnVEs22gAAAAI"]
[Sat Jan 03 01:39:23.138432 2026] [:error] [pid 24659:tid 24666] [client 89.46.109.107:24760] [client 89.46.109.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.46.109.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVgCy2ucj-rXdFUnVEs28AAAAAI"]
[Sat Jan 03 01:51:27.297642 2026] [:error] [pid 24661:tid 24728] [client 36.41.75.167:58629] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVgFnxfxsu5kmLDAcZubdQAAAIg"]
[Sat Jan 03 02:12:36.442731 2026] [:error] [pid 47234:tid 47257] [client 107.6.237.74:50859] [client 107.6.237.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.6.237.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVgKlB2w_O5NbPWiWO_XwQAAARU"]
[Sat Jan 03 02:17:34.279459 2026] [:error] [pid 24660:tid 24698] [client 51.161.193.77:46860] [client 51.161.193.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.161.193.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVgLvmZwWsLNsJ3ZH7bjbQAAAEU"]
[Sat Jan 03 02:20:23.655240 2026] [:error] [pid 47234:tid 47236] [client 34.140.76.228:60253] [client 34.140.76.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.140.76.228, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVgMZx2w_O5NbPWiWO_dogAAAQA"]
[Sat Jan 03 02:20:26.310821 2026] [:error] [pid 47234:tid 47237] [client 34.140.76.228:60253] [client 34.140.76.228] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aVgMah2w_O5NbPWiWO_dpwAAAQE"]
[Sat Jan 03 02:20:26.585248 2026] [:error] [pid 47234:tid 47241] [client 34.140.76.228:60253] [client 34.140.76.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.140.76.228, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVgMah2w_O5NbPWiWO_dqQAAAQU"]
[Sat Jan 03 02:20:28.248281 2026] [:error] [pid 24659:tid 24680] [client 34.140.76.228:54675] [client 34.140.76.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.140.76.228, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVgMbGucj-rXdFUnVEtIVwAAABA"]
[Sat Jan 03 02:20:30.161458 2026] [:error] [pid 47234:tid 47245] [client 34.140.76.228:56239] [client 34.140.76.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.140.76.228, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVgMbh2w_O5NbPWiWO_dsAAAAQk"]
[Sat Jan 03 02:20:31.934283 2026] [:error] [pid 24659:tid 24675] [client 34.140.76.228:64971] [client 34.140.76.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.140.76.228, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVgMb2ucj-rXdFUnVEtIXQAAAAs"]
[Sat Jan 03 02:20:33.560219 2026] [:error] [pid 47234:tid 47249] [client 34.140.76.228:49924] [client 34.140.76.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.140.76.228, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVgMcR2w_O5NbPWiWO_dtQAAAQ0"]
[Sat Jan 03 02:20:33.560370 2026] [:error] [pid 47234:tid 47249] [client 34.140.76.228:49924] [client 34.140.76.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.140.76.228, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVgMcR2w_O5NbPWiWO_dtQAAAQ0"]
[Sat Jan 03 02:23:54.841682 2026] [:error] [pid 47234:tid 47238] [client 172.99.189.103:30436] [client 172.99.189.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=video/x-flv"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVgNOh2w_O5NbPWiWO_fIQAAAQI"]
[Sat Jan 03 02:57:04.363535 2026] [:error] [pid 24660:tid 24705] [client 98.98.200.146:54183] [client 98.98.200.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.98.200.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVgVAGZwWsLNsJ3ZH7bxUgAAAEw"]
[Sat Jan 03 03:07:14.886985 2026] [:error] [pid 24660:tid 24715] [client 103.159.51.214:56716] [client 103.159.51.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.159.51.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVgXYmZwWsLNsJ3ZH7b0JQAAAFY"]
[Sat Jan 03 03:33:44.670239 2026] [:error] [pid 2083:tid 2105] [client 69.163.181.251:49918] [client 69.163.181.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.181.251, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVgdmDVlR_BmlMPnhV6eRQAAANQ"]
[Sat Jan 03 03:40:05.652804 2026] [:error] [pid 1931:tid 1993] [client 4.241.216.136:46687] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aVgfFR8Tyw7ZoIdXlcbeuQAAAIA"]
[Sat Jan 03 03:40:10.439041 2026] [:error] [pid 34260:tid 34283] [client 4.241.216.136:24133] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aVgfGkWWhyvZ0O9KNVRvJQAAARU"]
[Sat Jan 03 03:40:12.580883 2026] [:error] [pid 34260:tid 34266] [client 4.241.216.136:24151] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aVgfHEWWhyvZ0O9KNVRvKQAAAQQ"]
[Sat Jan 03 03:40:16.237801 2026] [:error] [pid 1929:tid 1939] [client 4.241.216.136:46667] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aVgfIOcFqdpu6TNsuWq1CAAAAAE"]
[Sat Jan 03 03:40:19.174481 2026] [:error] [pid 1930:tid 1969] [client 4.241.216.136:24139] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an8.php"] [unique_id "aVgfI5P-6mqhfUDa89y93gAAAEM"]
[Sat Jan 03 03:40:21.380325 2026] [:error] [pid 2083:tid 2090] [client 4.241.216.136:46678] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an8.php"] [unique_id "aVgfJTVlR_BmlMPnhV6g2gAAAMU"]
[Sat Jan 03 03:40:23.828389 2026] [:error] [pid 1931:tid 2031] [client 4.241.216.136:46656] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an8.php"] [unique_id "aVgfJx8Tyw7ZoIdXlcbezAAAAIc"]
[Sat Jan 03 03:40:24.762234 2026] [:error] [pid 34260:tid 34267] [client 4.241.216.136:46695] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an8.php"] [unique_id "aVgfKEWWhyvZ0O9KNVRvMgAAAQU"]
[Sat Jan 03 03:40:36.585675 2026] [:error] [pid 34260:tid 34268] [client 4.241.216.136:24153] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/esp.php"] [unique_id "aVgfNEWWhyvZ0O9KNVRvNwAAAQY"]
[Sat Jan 03 03:40:49.843125 2026] [:error] [pid 34260:tid 34280] [client 4.241.216.136:44761] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/21x.php"] [unique_id "aVgfQUWWhyvZ0O9KNVRvOwAAARI"]
[Sat Jan 03 03:40:58.970805 2026] [:error] [pid 34260:tid 34262] [client 4.241.216.136:46662] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/out.php"] [unique_id "aVgfSkWWhyvZ0O9KNVRvSAAAAQA"]
[Sat Jan 03 03:41:15.676855 2026] [:error] [pid 1930:tid 1967] [client 4.241.216.136:46672] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f2f.php"] [unique_id "aVgfW5P-6mqhfUDa89y-BwAAAEE"]
[Sat Jan 03 03:41:20.434576 2026] [:error] [pid 2083:tid 2101] [client 4.241.216.136:46685] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f2f.php"] [unique_id "aVgfYDVlR_BmlMPnhV6hGAAAANA"]
[Sat Jan 03 03:41:20.733908 2026] [:error] [pid 1930:tid 1979] [client 4.241.216.136:46715] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f2f.php"] [unique_id "aVgfYJP-6mqhfUDa89y-CgAAAE0"]
[Sat Jan 03 03:41:21.971487 2026] [:error] [pid 1931:tid 2040] [client 4.241.216.136:24074] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f2f.php"] [unique_id "aVgfYR8Tyw7ZoIdXlcbfAwAAAJA"]
[Sat Jan 03 03:41:23.030938 2026] [:error] [pid 1929:tid 1952] [client 4.241.216.136:44788] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ths.php"] [unique_id "aVgfY-cFqdpu6TNsuWq1KgAAAA4"]
[Sat Jan 03 03:41:25.061644 2026] [:error] [pid 1931:tid 2036] [client 4.241.216.136:44748] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ths.php"] [unique_id "aVgfZR8Tyw7ZoIdXlcbfBwAAAIw"]
[Sat Jan 03 03:41:27.471184 2026] [:error] [pid 1930:tid 1978] [client 4.241.216.136:44789] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ths.php"] [unique_id "aVgfZ5P-6mqhfUDa89y-DgAAAEw"]
[Sat Jan 03 03:41:38.905654 2026] [:error] [pid 34260:tid 34285] [client 4.241.216.136:24169] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aVgfckWWhyvZ0O9KNVRvWQAAARc"]
[Sat Jan 03 03:41:41.304594 2026] [:error] [pid 1931:tid 2048] [client 4.241.216.136:46707] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aVgfdR8Tyw7ZoIdXlcbfDQAAAJg"]
[Sat Jan 03 03:41:42.938384 2026] [:error] [pid 1930:tid 1985] [client 4.241.216.136:46706] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aVgfdpP-6mqhfUDa89y-FwAAAFM"]
[Sat Jan 03 03:41:44.630459 2026] [:error] [pid 1929:tid 1960] [client 4.241.216.136:46701] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aVgfeOcFqdpu6TNsuWq1NAAAABY"]
[Sat Jan 03 03:41:45.950657 2026] [:error] [pid 1929:tid 1950] [client 4.241.216.136:44797] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/990.php"] [unique_id "aVgfeecFqdpu6TNsuWq1NQAAAAw"]
[Sat Jan 03 03:41:47.293675 2026] [:error] [pid 1930:tid 1968] [client 4.241.216.136:46702] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/990.php"] [unique_id "aVgfe5P-6mqhfUDa89y-HAAAAEI"]
[Sat Jan 03 03:41:49.716391 2026] [:error] [pid 1931:tid 2037] [client 4.241.216.136:46700] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/990.php"] [unique_id "aVgffR8Tyw7ZoIdXlcbfEQAAAI0"]
[Sat Jan 03 03:41:51.165579 2026] [:error] [pid 34260:tid 34263] [client 4.241.216.136:44776] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/990.php"] [unique_id "aVgff0WWhyvZ0O9KNVRvXgAAAQE"]
[Sat Jan 03 03:41:53.870950 2026] [:error] [pid 34260:tid 34273] [client 4.241.216.136:24147] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d996699999.php"] [unique_id "aVgfgUWWhyvZ0O9KNVRvZAAAAQs"]
[Sat Jan 03 03:41:55.254152 2026] [:error] [pid 1929:tid 1951] [client 4.241.216.136:24131] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d996699999.php"] [unique_id "aVgfg-cFqdpu6TNsuWq1PgAAAA0"]
[Sat Jan 03 03:41:56.988696 2026] [:error] [pid 34260:tid 34272] [client 4.241.216.136:46696] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d996699999.php"] [unique_id "aVgfhEWWhyvZ0O9KNVRvZgAAAQo"]
[Sat Jan 03 03:41:58.596841 2026] [:error] [pid 34260:tid 34264] [client 4.241.216.136:46694] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d996699999.php"] [unique_id "aVgfhkWWhyvZ0O9KNVRvaQAAAQI"]
[Sat Jan 03 03:42:00.713089 2026] [:error] [pid 1929:tid 1947] [client 4.241.216.136:24146] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ierne.php"] [unique_id "aVgfiOcFqdpu6TNsuWq1RQAAAAk"]
[Sat Jan 03 03:42:10.948346 2026] [:error] [pid 34260:tid 34285] [client 4.241.216.136:46714] [client 4.241.216.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ierne.php"] [unique_id "aVgfkkWWhyvZ0O9KNVRveAAAARc"]
[Sat Jan 03 04:05:58.823945 2026] [:error] [pid 1929:tid 1952] [client 51.159.99.245:51520] [client 51.159.99.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.99.245, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVglJucFqdpu6TNsuWq9twAAAA4"]
[Sat Jan 03 04:19:36.389256 2026] [:error] [pid 1931:tid 2039] [client 142.93.159.160:57234] [client 142.93.159.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.93.159.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVgoWB8Tyw7ZoIdXlcbrugAAAI8"]
[Sat Jan 03 04:55:23.383698 2026] [:error] [pid 1930:tid 1983] [client 45.32.106.158:48586] [client 45.32.106.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.32.106.158, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVgwu5P-6mqhfUDa89zUfAAAAFE"]
[Sat Jan 03 04:57:56.978037 2026] [:error] [pid 1930:tid 1968] [client 78.47.163.152:45146] [client 78.47.163.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.47.163.152, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVgxVJP-6mqhfUDa89zVjgAAAEI"]
[Sat Jan 03 05:13:36.025780 2026] [:error] [pid 34260:tid 34284] [client 208.109.20.122:53936] [client 208.109.20.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.109.20.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVg1AEWWhyvZ0O9KNVSbsAAAARY"]
[Sat Jan 03 05:39:12.963498 2026] [:error] [pid 1929:tid 1952] [client 64.31.27.148:60256] [client 64.31.27.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.31.27.148, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVg7AOcFqdpu6TNsuWrbrgAAAA4"]
[Sat Jan 03 05:49:11.564037 2026] [:error] [pid 1931:tid 2044] [client 4.190.220.252:21146] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aVg9Vx8Tyw7ZoIdXlcYO-gAAAJQ"]
[Sat Jan 03 05:49:12.338841 2026] [:error] [pid 1929:tid 1957] [client 4.190.220.252:21020] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aVg9WOcFqdpu6TNsuWre4QAAABM"]
[Sat Jan 03 05:49:12.936392 2026] [:error] [pid 34260:tid 34267] [client 4.190.220.252:19362] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aVg9WEWWhyvZ0O9KNVSw_QAAAQU"]
[Sat Jan 03 05:49:13.673474 2026] [:error] [pid 1929:tid 1944] [client 4.190.220.252:19913] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aVg9WecFqdpu6TNsuWre4wAAAAY"]
[Sat Jan 03 05:49:14.883438 2026] [:error] [pid 1929:tid 1949] [client 4.190.220.252:19943] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an8.php"] [unique_id "aVg9WucFqdpu6TNsuWre5gAAAAs"]
[Sat Jan 03 05:49:16.016565 2026] [:error] [pid 1929:tid 1955] [client 4.190.220.252:19992] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an8.php"] [unique_id "aVg9XOcFqdpu6TNsuWre6wAAABE"]
[Sat Jan 03 05:49:16.419501 2026] [:error] [pid 34260:tid 34281] [client 4.190.220.252:22081] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an8.php"] [unique_id "aVg9XEWWhyvZ0O9KNVSxBwAAARM"]
[Sat Jan 03 05:49:16.800982 2026] [:error] [pid 34260:tid 34266] [client 4.190.220.252:22291] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an8.php"] [unique_id "aVg9XEWWhyvZ0O9KNVSxCAAAAQQ"]
[Sat Jan 03 05:49:17.313246 2026] [:error] [pid 2083:tid 2100] [client 4.190.220.252:19919] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/esp.php"] [unique_id "aVg9XTVlR_BmlMPnhV7WDAAAAM8"]
[Sat Jan 03 05:49:18.024236 2026] [:error] [pid 1931:tid 2035] [client 4.190.220.252:18860] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/esp.php"] [unique_id "aVg9Xh8Tyw7ZoIdXlcYPNAAAAIs"]
[Sat Jan 03 05:49:18.677918 2026] [:error] [pid 1929:tid 1942] [client 4.190.220.252:63370] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/esp.php"] [unique_id "aVg9XucFqdpu6TNsuWre8QAAAAQ"]
[Sat Jan 03 05:49:19.005513 2026] [:error] [pid 1929:tid 1949] [client 4.190.220.252:24486] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/esp.php"] [unique_id "aVg9X-cFqdpu6TNsuWre9AAAAAs"]
[Sat Jan 03 05:49:19.486285 2026] [:error] [pid 1930:tid 1980] [client 4.190.220.252:20682] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/21x.php"] [unique_id "aVg9X5P-6mqhfUDa89zp2QAAAE4"]
[Sat Jan 03 05:49:19.999828 2026] [:error] [pid 1931:tid 2041] [client 4.190.220.252:1488] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/21x.php"] [unique_id "aVg9Xx8Tyw7ZoIdXlcYPPwAAAJE"]
[Sat Jan 03 05:49:20.901413 2026] [:error] [pid 34260:tid 34276] [client 4.190.220.252:20841] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/21x.php"] [unique_id "aVg9YEWWhyvZ0O9KNVSxMAAAAQ4"]
[Sat Jan 03 05:49:21.604501 2026] [:error] [pid 1931:tid 2031] [client 4.190.220.252:63468] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/21x.php"] [unique_id "aVg9YR8Tyw7ZoIdXlcYPQgAAAIc"]
[Sat Jan 03 05:49:22.356641 2026] [:error] [pid 34260:tid 34272] [client 4.190.220.252:20552] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/out.php"] [unique_id "aVg9YkWWhyvZ0O9KNVSxNgAAAQo"]
[Sat Jan 03 05:49:22.978783 2026] [:error] [pid 1929:tid 1961] [client 4.190.220.252:24293] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/out.php"] [unique_id "aVg9YucFqdpu6TNsuWrfDQAAABc"]
[Sat Jan 03 05:49:23.468594 2026] [:error] [pid 1930:tid 1983] [client 4.190.220.252:1226] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/out.php"] [unique_id "aVg9Y5P-6mqhfUDa89zp3QAAAFE"]
[Sat Jan 03 05:49:23.857483 2026] [:error] [pid 1930:tid 1973] [client 4.190.220.252:20554] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/out.php"] [unique_id "aVg9Y5P-6mqhfUDa89zp3gAAAEc"]
[Sat Jan 03 05:49:24.378388 2026] [:error] [pid 2083:tid 2099] [client 4.190.220.252:21700] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower2.php"] [unique_id "aVg9ZDVlR_BmlMPnhV7WHAAAAM4"]
[Sat Jan 03 05:49:24.819858 2026] [:error] [pid 1929:tid 1941] [client 4.190.220.252:58313] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower2.php"] [unique_id "aVg9ZOcFqdpu6TNsuWrfDgAAAAM"]
[Sat Jan 03 05:49:25.390324 2026] [:error] [pid 34260:tid 34271] [client 4.190.220.252:1920] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower2.php"] [unique_id "aVg9ZUWWhyvZ0O9KNVSxPgAAAQk"]
[Sat Jan 03 05:49:25.845333 2026] [:error] [pid 2083:tid 2093] [client 4.190.220.252:20034] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower2.php"] [unique_id "aVg9ZTVlR_BmlMPnhV7WHgAAAMg"]
[Sat Jan 03 05:49:26.283819 2026] [:error] [pid 34260:tid 34283] [client 4.190.220.252:55586] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/family.php"] [unique_id "aVg9ZkWWhyvZ0O9KNVSxQAAAARU"]
[Sat Jan 03 05:49:26.793201 2026] [:error] [pid 2083:tid 2103] [client 4.190.220.252:55639] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/family.php"] [unique_id "aVg9ZjVlR_BmlMPnhV7WIgAAANI"]
[Sat Jan 03 05:49:27.213120 2026] [:error] [pid 2083:tid 2090] [client 4.190.220.252:20425] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/family.php"] [unique_id "aVg9ZzVlR_BmlMPnhV7WJAAAAMU"]
[Sat Jan 03 05:49:27.928721 2026] [:error] [pid 34260:tid 34265] [client 4.190.220.252:55570] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/family.php"] [unique_id "aVg9Z0WWhyvZ0O9KNVSxRAAAAQM"]
[Sat Jan 03 05:49:28.422095 2026] [:error] [pid 34260:tid 34282] [client 4.190.220.252:21583] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s1.php"] [unique_id "aVg9aEWWhyvZ0O9KNVSxRQAAARQ"]
[Sat Jan 03 05:49:28.974726 2026] [:error] [pid 2083:tid 2096] [client 4.190.220.252:55562] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s1.php"] [unique_id "aVg9aDVlR_BmlMPnhV7WKgAAAMs"]
[Sat Jan 03 05:49:29.412413 2026] [:error] [pid 1929:tid 1957] [client 4.190.220.252:55575] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s1.php"] [unique_id "aVg9aecFqdpu6TNsuWrfFAAAABM"]
[Sat Jan 03 05:49:30.232883 2026] [:error] [pid 1931:tid 2033] [client 4.190.220.252:55630] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s1.php"] [unique_id "aVg9ah8Tyw7ZoIdXlcYPSQAAAIk"]
[Sat Jan 03 05:49:30.634690 2026] [:error] [pid 34260:tid 34274] [client 4.190.220.252:20898] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ma.php"] [unique_id "aVg9akWWhyvZ0O9KNVSxSAAAAQw"]
[Sat Jan 03 05:49:31.062397 2026] [:error] [pid 1931:tid 2031] [client 4.190.220.252:1215] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ma.php"] [unique_id "aVg9ax8Tyw7ZoIdXlcYPSwAAAIc"]
[Sat Jan 03 05:49:31.457467 2026] [:error] [pid 34260:tid 34285] [client 4.190.220.252:20416] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ma.php"] [unique_id "aVg9a0WWhyvZ0O9KNVSxTgAAARc"]
[Sat Jan 03 05:49:31.768120 2026] [:error] [pid 2083:tid 2092] [client 4.190.220.252:20053] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ma.php"] [unique_id "aVg9azVlR_BmlMPnhV7WMAAAAMc"]
[Sat Jan 03 05:49:32.235077 2026] [:error] [pid 2083:tid 2090] [client 4.190.220.252:20064] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aVg9bDVlR_BmlMPnhV7WMgAAAMU"]
[Sat Jan 03 05:49:32.633369 2026] [:error] [pid 1930:tid 1985] [client 4.190.220.252:1170] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aVg9bJP-6mqhfUDa89zp5AAAAFM"]
[Sat Jan 03 05:49:32.944518 2026] [:error] [pid 1929:tid 1942] [client 4.190.220.252:21608] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aVg9bOcFqdpu6TNsuWrfFQAAAAQ"]
[Sat Jan 03 05:49:33.521602 2026] [:error] [pid 2083:tid 2088] [client 4.190.220.252:55675] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aVg9bTVlR_BmlMPnhV7WNwAAAMM"]
[Sat Jan 03 05:49:33.885199 2026] [:error] [pid 34260:tid 34284] [client 4.190.220.252:19617] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lanz.php"] [unique_id "aVg9bUWWhyvZ0O9KNVSxVAAAARY"]
[Sat Jan 03 05:49:34.201449 2026] [:error] [pid 1931:tid 2045] [client 4.190.220.252:20085] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lanz.php"] [unique_id "aVg9bh8Tyw7ZoIdXlcYPTgAAAJU"]
[Sat Jan 03 05:49:34.551946 2026] [:error] [pid 1929:tid 1962] [client 4.190.220.252:1172] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lanz.php"] [unique_id "aVg9bucFqdpu6TNsuWrfGAAAABg"]
[Sat Jan 03 05:49:34.874235 2026] [:error] [pid 2083:tid 2108] [client 4.190.220.252:19638] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lanz.php"] [unique_id "aVg9bjVlR_BmlMPnhV7WOgAAANc"]
[Sat Jan 03 05:49:35.168684 2026] [:error] [pid 34260:tid 34283] [client 4.190.220.252:55613] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xeeex.php"] [unique_id "aVg9b0WWhyvZ0O9KNVSxXAAAARU"]
[Sat Jan 03 05:49:35.624016 2026] [:error] [pid 1930:tid 1970] [client 4.190.220.252:20478] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xeeex.php"] [unique_id "aVg9b5P-6mqhfUDa89zp5gAAAEQ"]
[Sat Jan 03 05:49:36.029584 2026] [:error] [pid 1929:tid 1948] [client 4.190.220.252:20915] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xeeex.php"] [unique_id "aVg9cOcFqdpu6TNsuWrfGgAAAAo"]
[Sat Jan 03 05:49:36.328126 2026] [:error] [pid 1929:tid 1958] [client 4.190.220.252:19776] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xeeex.php"] [unique_id "aVg9cOcFqdpu6TNsuWrfGwAAABQ"]
[Sat Jan 03 05:49:36.620385 2026] [:error] [pid 1929:tid 1956] [client 4.190.220.252:20058] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tons.php"] [unique_id "aVg9cOcFqdpu6TNsuWrfHQAAABI"]
[Sat Jan 03 05:49:37.096404 2026] [:error] [pid 34260:tid 34276] [client 4.190.220.252:55556] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tons.php"] [unique_id "aVg9cUWWhyvZ0O9KNVSxXgAAAQ4"]
[Sat Jan 03 05:49:37.405234 2026] [:error] [pid 1931:tid 2036] [client 4.190.220.252:20911] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tons.php"] [unique_id "aVg9cR8Tyw7ZoIdXlcYPVAAAAIw"]
[Sat Jan 03 05:49:37.777870 2026] [:error] [pid 1930:tid 1990] [client 4.190.220.252:20921] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tons.php"] [unique_id "aVg9cZP-6mqhfUDa89zp7gAAAFg"]
[Sat Jan 03 05:49:38.254087 2026] [:error] [pid 1930:tid 1971] [client 4.190.220.252:19625] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpup.php"] [unique_id "aVg9cpP-6mqhfUDa89zp7wAAAEU"]
[Sat Jan 03 05:49:38.559804 2026] [:error] [pid 1930:tid 1987] [client 4.190.220.252:1164] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpup.php"] [unique_id "aVg9cpP-6mqhfUDa89zp8QAAAFU"]
[Sat Jan 03 05:49:38.861898 2026] [:error] [pid 34260:tid 34271] [client 4.190.220.252:55588] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpup.php"] [unique_id "aVg9ckWWhyvZ0O9KNVSxYgAAAQk"]
[Sat Jan 03 05:49:39.312433 2026] [:error] [pid 1930:tid 1985] [client 4.190.220.252:20459] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpup.php"] [unique_id "aVg9c5P-6mqhfUDa89zp8gAAAFM"]
[Sat Jan 03 05:49:39.807539 2026] [:error] [pid 1929:tid 1947] [client 4.190.220.252:20460] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aVg9c-cFqdpu6TNsuWrfIgAAAAk"]
[Sat Jan 03 05:49:40.233612 2026] [:error] [pid 1929:tid 1961] [client 4.190.220.252:20434] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aVg9dOcFqdpu6TNsuWrfJAAAABc"]
[Sat Jan 03 05:49:40.669084 2026] [:error] [pid 1931:tid 2045] [client 4.190.220.252:21572] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aVg9dB8Tyw7ZoIdXlcYPVwAAAJU"]
[Sat Jan 03 05:49:41.011903 2026] [:error] [pid 2083:tid 2092] [client 4.190.220.252:20909] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aVg9dTVlR_BmlMPnhV7WPgAAAMc"]
[Sat Jan 03 05:49:41.359923 2026] [:error] [pid 1930:tid 1972] [client 4.190.220.252:21582] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f2f.php"] [unique_id "aVg9dZP-6mqhfUDa89zp9gAAAEY"]
[Sat Jan 03 05:49:41.760100 2026] [:error] [pid 1929:tid 1946] [client 4.190.220.252:55638] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f2f.php"] [unique_id "aVg9decFqdpu6TNsuWrfJgAAAAg"]
[Sat Jan 03 05:49:42.249757 2026] [:error] [pid 1930:tid 1967] [client 4.190.220.252:19624] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f2f.php"] [unique_id "aVg9dpP-6mqhfUDa89zp-QAAAEE"]
[Sat Jan 03 05:49:42.676065 2026] [:error] [pid 34260:tid 34285] [client 4.190.220.252:19808] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f2f.php"] [unique_id "aVg9dkWWhyvZ0O9KNVSxawAAARc"]
[Sat Jan 03 05:49:42.935002 2026] [:error] [pid 1930:tid 1974] [client 4.190.220.252:55564] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ths.php"] [unique_id "aVg9dpP-6mqhfUDa89zp_AAAAEg"]
[Sat Jan 03 05:49:43.318790 2026] [:error] [pid 1931:tid 2030] [client 4.190.220.252:20470] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ths.php"] [unique_id "aVg9dx8Tyw7ZoIdXlcYPWAAAAIY"]
[Sat Jan 03 05:49:43.644092 2026] [:error] [pid 1930:tid 1983] [client 4.190.220.252:20430] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ths.php"] [unique_id "aVg9d5P-6mqhfUDa89zp_gAAAFE"]
[Sat Jan 03 05:49:43.952475 2026] [:error] [pid 34260:tid 34268] [client 4.190.220.252:19616] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ths.php"] [unique_id "aVg9d0WWhyvZ0O9KNVSxcAAAAQY"]
[Sat Jan 03 05:49:44.415217 2026] [:error] [pid 1930:tid 1970] [client 4.190.220.252:20443] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aVg9eJP-6mqhfUDa89zp_wAAAEQ"]
[Sat Jan 03 05:49:44.724640 2026] [:error] [pid 34260:tid 34272] [client 4.190.220.252:55665] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aVg9eEWWhyvZ0O9KNVSxcwAAAQo"]
[Sat Jan 03 05:49:45.092879 2026] [:error] [pid 34260:tid 34263] [client 4.190.220.252:20052] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aVg9eUWWhyvZ0O9KNVSxdAAAAQE"]
[Sat Jan 03 05:49:45.446570 2026] [:error] [pid 34260:tid 34262] [client 4.190.220.252:55580] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aVg9eUWWhyvZ0O9KNVSxdQAAAQA"]
[Sat Jan 03 05:49:45.834806 2026] [:error] [pid 34260:tid 34283] [client 4.190.220.252:19819] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/990.php"] [unique_id "aVg9eUWWhyvZ0O9KNVSxeAAAARU"]
[Sat Jan 03 05:49:46.186602 2026] [:error] [pid 34260:tid 34267] [client 4.190.220.252:20080] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/990.php"] [unique_id "aVg9ekWWhyvZ0O9KNVSxeQAAAQU"]
[Sat Jan 03 05:49:46.469819 2026] [:error] [pid 34260:tid 34286] [client 4.190.220.252:21574] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/990.php"] [unique_id "aVg9ekWWhyvZ0O9KNVSxewAAARg"]
[Sat Jan 03 05:49:46.763903 2026] [:error] [pid 1931:tid 2037] [client 4.190.220.252:19835] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/990.php"] [unique_id "aVg9eh8Tyw7ZoIdXlcYPXwAAAI0"]
[Sat Jan 03 05:49:47.116109 2026] [:error] [pid 2083:tid 2102] [client 4.190.220.252:19626] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d996699999.php"] [unique_id "aVg9ezVlR_BmlMPnhV7WQwAAANE"]
[Sat Jan 03 05:49:47.594757 2026] [:error] [pid 1929:tid 1955] [client 4.190.220.252:1192] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d996699999.php"] [unique_id "aVg9e-cFqdpu6TNsuWrfLQAAABE"]
[Sat Jan 03 05:49:47.884711 2026] [:error] [pid 2083:tid 2098] [client 4.190.220.252:20048] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d996699999.php"] [unique_id "aVg9ezVlR_BmlMPnhV7WRAAAAM0"]
[Sat Jan 03 05:49:48.159645 2026] [:error] [pid 1929:tid 1944] [client 4.190.220.252:1993] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d996699999.php"] [unique_id "aVg9fOcFqdpu6TNsuWrfLwAAAAY"]
[Sat Jan 03 05:49:48.517820 2026] [:error] [pid 1930:tid 1990] [client 4.190.220.252:20509] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ierne.php"] [unique_id "aVg9fJP-6mqhfUDa89zqBQAAAFg"]
[Sat Jan 03 05:49:48.980174 2026] [:error] [pid 34260:tid 34282] [client 4.190.220.252:20090] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ierne.php"] [unique_id "aVg9fEWWhyvZ0O9KNVSxggAAARQ"]
[Sat Jan 03 05:49:49.254343 2026] [:error] [pid 1931:tid 2042] [client 4.190.220.252:55655] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ierne.php"] [unique_id "aVg9fR8Tyw7ZoIdXlcYPYAAAAJI"]
[Sat Jan 03 05:49:49.633627 2026] [:error] [pid 34260:tid 34280] [client 4.190.220.252:55583] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ierne.php"] [unique_id "aVg9fUWWhyvZ0O9KNVSxhgAAARI"]
[Sat Jan 03 05:49:49.924964 2026] [:error] [pid 34260:tid 34273] [client 4.190.220.252:19594] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xde.php"] [unique_id "aVg9fUWWhyvZ0O9KNVSxhwAAAQs"]
[Sat Jan 03 05:49:50.237895 2026] [:error] [pid 34260:tid 34270] [client 4.190.220.252:55555] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xde.php"] [unique_id "aVg9fkWWhyvZ0O9KNVSxiwAAAQg"]
[Sat Jan 03 05:49:50.586946 2026] [:error] [pid 34260:tid 34266] [client 4.190.220.252:55557] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xde.php"] [unique_id "aVg9fkWWhyvZ0O9KNVSxjQAAAQQ"]
[Sat Jan 03 05:49:51.056694 2026] [:error] [pid 1930:tid 1983] [client 4.190.220.252:21577] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xde.php"] [unique_id "aVg9f5P-6mqhfUDa89zqCAAAAFE"]
[Sat Jan 03 05:49:51.418985 2026] [:error] [pid 2083:tid 2094] [client 4.190.220.252:20513] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1yade.php"] [unique_id "aVg9fzVlR_BmlMPnhV7WSQAAAMk"]
[Sat Jan 03 05:49:51.838576 2026] [:error] [pid 34260:tid 34265] [client 4.190.220.252:21621] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1yade.php"] [unique_id "aVg9f0WWhyvZ0O9KNVSxkgAAAQM"]
[Sat Jan 03 05:49:52.144068 2026] [:error] [pid 34260:tid 34278] [client 4.190.220.252:20537] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1yade.php"] [unique_id "aVg9gEWWhyvZ0O9KNVSxkwAAARA"]
[Sat Jan 03 05:49:52.470771 2026] [:error] [pid 1931:tid 2038] [client 4.190.220.252:21733] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1yade.php"] [unique_id "aVg9gB8Tyw7ZoIdXlcYPYgAAAI4"]
[Sat Jan 03 05:49:52.931856 2026] [:error] [pid 1930:tid 1966] [client 4.190.220.252:20875] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aVg9gJP-6mqhfUDa89zqDQAAAEA"]
[Sat Jan 03 05:49:53.267767 2026] [:error] [pid 34260:tid 34272] [client 4.190.220.252:20431] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aVg9gUWWhyvZ0O9KNVSxlQAAAQo"]
[Sat Jan 03 05:49:53.599805 2026] [:error] [pid 34260:tid 34270] [client 4.190.220.252:55590] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aVg9gUWWhyvZ0O9KNVSxlgAAAQg"]
[Sat Jan 03 05:49:54.246747 2026] [:error] [pid 1931:tid 2029] [client 4.190.220.252:20500] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aVg9gh8Tyw7ZoIdXlcYPZQAAAIU"]
[Sat Jan 03 05:49:54.744389 2026] [:error] [pid 1931:tid 2039] [client 4.190.220.252:21619] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "aVg9gh8Tyw7ZoIdXlcYPZgAAAI8"]
[Sat Jan 03 05:49:55.117208 2026] [:error] [pid 1930:tid 1983] [client 4.190.220.252:19801] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "aVg9g5P-6mqhfUDa89zqEwAAAFE"]
[Sat Jan 03 05:49:55.487819 2026] [:error] [pid 34260:tid 34277] [client 4.190.220.252:20428] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "aVg9g0WWhyvZ0O9KNVSxmQAAAQ8"]
[Sat Jan 03 05:49:55.748497 2026] [:error] [pid 34260:tid 34280] [client 4.190.220.252:18524] [client 4.190.220.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "aVg9g0WWhyvZ0O9KNVSxnAAAARI"]
[Sat Jan 03 06:06:53.350685 2026] [:error] [pid 2083:tid 2086] [client 167.172.79.172:30372] [client 167.172.79.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.79.172, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVhBfTVlR_BmlMPnhV7dfQAAAME"]
[Sat Jan 03 06:07:52.561644 2026] [:error] [pid 34260:tid 34276] [client 104.199.79.203:56490] [client 104.199.79.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.199.79.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVhBuEWWhyvZ0O9KNVS8-gAAAQ4"]
[Sat Jan 03 06:09:48.749445 2026] [:error] [pid 1929:tid 1938] [client 95.217.206.242:32860] [client 95.217.206.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.217.206.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVhCLOcFqdpu6TNsuWrmIQAAAAA"]
[Sat Jan 03 06:10:53.213960 2026] [:error] [pid 1929:tid 1940] [client 107.180.118.53:47060] [client 107.180.118.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.118.53, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVhCbecFqdpu6TNsuWrmcQAAAAI"]
[Sat Jan 03 06:17:54.152798 2026] [:error] [pid 34260:tid 34279] [client 132.148.216.207:14330] [client 132.148.216.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.216.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVhEEkWWhyvZ0O9KNVTEoAAAARE"]
[Sat Jan 03 06:57:55.695536 2026] [:error] [pid 1929:tid 1938] [client 185.212.169.118:56788] [client 185.212.169.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.212.169.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVhNc-cFqdpu6TNsuWr7wgAAAAA"]
[Sat Jan 03 07:12:13.713607 2026] [:error] [pid 19639:tid 19647] [client 210.245.90.208:36258] [client 210.245.90.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 210.245.90.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVhQzSQ7fWZUytnlHEw3EAAAAUY"]
[Sat Jan 03 07:14:43.874592 2026] [:error] [pid 1929:tid 1962] [client 72.29.178.86:58112] [client 72.29.178.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.29.178.86, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVhRY-cFqdpu6TNsuWoCnQAAABg"]
[Sat Jan 03 07:37:37.862641 2026] [:error] [pid 2083:tid 2094] [client 188.34.161.164:39134] [client 188.34.161.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.34.161.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVhWwTVlR_BmlMPnhV4PeQAAAMk"]
[Sat Jan 03 07:43:34.688100 2026] [:error] [pid 1930:tid 1978] [client 125.94.144.102:57405] [client 125.94.144.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVhYJpP-6mqhfUDa89wgZwAAAEw"]
[Sat Jan 03 08:10:29.615510 2026] [:error] [pid 2083:tid 2108] [client 220.158.233.50:33356] [client 220.158.233.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.158.233.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVhedTVlR_BmlMPnhV4j_QAAANc"]
[Sat Jan 03 08:16:59.130729 2026] [:error] [pid 1929:tid 1956] [client 146.70.89.150:53285] [client 146.70.89.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.70.89.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aVhf--cFqdpu6TNsuWogwgAAABI"]
[Sat Jan 03 08:26:33.658154 2026] [:error] [pid 1931:tid 2036] [client 186.194.55.237:45118] [client 186.194.55.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.194.55.237, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVhiOR8Tyw7ZoIdXlcZQ_AAAAIw"]
[Sat Jan 03 08:42:50.009678 2026] [:error] [pid 2083:tid 2096] [client 107.180.113.150:60952] [client 107.180.113.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.113.150, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVhmCjVlR_BmlMPnhV418QAAAMs"]
[Sat Jan 03 09:22:15.411716 2026] [:error] [pid 1930:tid 1980] [client 165.232.76.25:57182] [client 165.232.76.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.232.76.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVhvR5P-6mqhfUDa89w-KAAAAE4"]
[Sat Jan 03 09:57:13.089973 2026] [:error] [pid 34260:tid 34282] [client 65.181.111.149:37748] [client 65.181.111.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.181.111.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVh3eUWWhyvZ0O9KNVQbwgAAARQ"]
[Sat Jan 03 10:05:28.491893 2026] [:error] [pid 34260:tid 34275] [client 161.132.49.90:33906] [client 161.132.49.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.132.49.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVh5aEWWhyvZ0O9KNVQfWwAAAQ0"]
[Sat Jan 03 10:07:33.418212 2026] [:error] [pid 1929:tid 1958] [client 118.139.178.108:41968] [client 118.139.178.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.139.178.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVh55ecFqdpu6TNsuWpCIQAAABQ"]
[Sat Jan 03 10:21:54.272149 2026] [:error] [pid 1929:tid 1938] [client 20.219.105.83:17230] [client 20.219.105.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.219.105.83, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVh9QucFqdpu6TNsuWpF_gAAAAA"]
[Sat Jan 03 10:54:59.734933 2026] [:error] [pid 34260:tid 34282] [client 103.177.150.26:64372] [client 103.177.150.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.177.150.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aViFA0WWhyvZ0O9KNVQz3wAAARQ"]
[Sat Jan 03 11:00:39.557795 2026] [:error] [pid 19639:tid 19642] [client 184.168.115.49:64700] [client 184.168.115.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.115.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aViGVyQ7fWZUytnlHEx4cwAAAUE"]
[Sat Jan 03 11:14:14.788448 2026] [:error] [pid 34260:tid 34270] [client 170.106.110.146:48040] [client 170.106.110.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aViJhkWWhyvZ0O9KNVQ6uAAAAQg"]
[Sat Jan 03 11:23:44.227732 2026] [:error] [pid 31630:tid 31632] [client 67.205.6.165:57120] [client 67.205.6.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.6.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aViLwPUV_PU2SWgLPujNagAAAYA"]
[Sat Jan 03 11:40:14.128269 2026] [:error] [pid 1930:tid 1980] [client 208.109.56.149:48216] [client 208.109.56.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.109.56.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aViPnpP-6mqhfUDa89xeHQAAAE4"]
[Sat Jan 03 11:44:19.629470 2026] [:error] [pid 2083:tid 2092] [client 69.163.181.251:59016] [client 69.163.181.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.181.251, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aViQkzVlR_BmlMPnhV5vagAAAMc"]
[Sat Jan 03 11:44:40.275011 2026] [:error] [pid 1929:tid 1941] [client 64.23.160.189:38606] [client 64.23.160.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.23.160.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aViQqOcFqdpu6TNsuWpaHQAAAAM"]
[Sat Jan 03 11:53:55.280031 2026] [:error] [pid 34260:tid 34275] [client 146.70.194.126:18643] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aViS00WWhyvZ0O9KNVRH0QAAAQ0"]
[Sat Jan 03 11:53:56.849000 2026] [:error] [pid 19639:tid 19643] [client 146.70.194.126:41037] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.bak"] [unique_id "aViS1CQ7fWZUytnlHEyBiQAAAUI"]
[Sat Jan 03 11:53:58.412509 2026] [:error] [pid 34260:tid 34263] [client 146.70.194.126:60293] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aViS1kWWhyvZ0O9KNVRH1wAAAQE"]
[Sat Jan 03 11:53:59.977786 2026] [:error] [pid 34260:tid 34271] [client 146.70.194.126:33720] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php~"] [unique_id "aViS10WWhyvZ0O9KNVRH2AAAAQk"]
[Sat Jan 03 11:54:01.554662 2026] [:error] [pid 34260:tid 34268] [client 146.70.194.126:18410] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.save"] [unique_id "aViS2UWWhyvZ0O9KNVRH2wAAAQY"]
[Sat Jan 03 11:54:03.128567 2026] [:error] [pid 19639:tid 19660] [client 146.70.194.126:62117] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.old"] [unique_id "aViS2yQ7fWZUytnlHEyBjgAAAVM"]
[Sat Jan 03 11:54:04.692641 2026] [:error] [pid 34260:tid 34284] [client 146.70.194.126:17060] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phpe"] [unique_id "aViS3EWWhyvZ0O9KNVRH3gAAARY"]
[Sat Jan 03 11:54:06.270257 2026] [:error] [pid 31630:tid 31639] [client 146.70.194.126:14474] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_old"] [unique_id "aViS3vUV_PU2SWgLPujTnQAAAYc"]
[Sat Jan 03 11:54:07.829560 2026] [:error] [pid 34260:tid 34281] [client 146.70.194.126:14371] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aViS30WWhyvZ0O9KNVRH5gAAARM"]
[Sat Jan 03 11:54:09.416813 2026] [:error] [pid 19639:tid 19641] [client 146.70.194.126:9026] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phpOLD"] [unique_id "aViS4SQ7fWZUytnlHEyBlAAAAUA"]
[Sat Jan 03 11:54:10.984758 2026] [:error] [pid 19639:tid 19642] [client 146.70.194.126:35524] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_"] [unique_id "aViS4iQ7fWZUytnlHEyBlQAAAUE"]
[Sat Jan 03 11:54:12.555448 2026] [:error] [pid 1929:tid 1959] [client 146.70.194.126:11718] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php1"] [unique_id "aViS5OcFqdpu6TNsuWpcsQAAABU"]
[Sat Jan 03 11:54:14.134101 2026] [:error] [pid 1929:tid 1949] [client 146.70.194.126:29072] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.backup"] [unique_id "aViS5ucFqdpu6TNsuWpcxwAAAAs"]
[Sat Jan 03 11:54:15.706456 2026] [:error] [pid 1930:tid 1979] [client 146.70.194.126:34336] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.org"] [unique_id "aViS55P-6mqhfUDa89xgzwAAAE0"]
[Sat Jan 03 11:54:17.266642 2026] [:error] [pid 1931:tid 2043] [client 146.70.194.126:34294] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/cherry-plugin/admin/import-export/download-content.php"] [unique_id "aViS6R8Tyw7ZoIdXlcZ9ogAAAJM"]
[Sat Jan 03 11:54:20.327049 2026] [:error] [pid 19639:tid 19660] [client 146.70.194.126:1655] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php-old"] [unique_id "aViS7CQ7fWZUytnlHEyBnQAAAVM"]
[Sat Jan 03 11:54:21.903616 2026] [:error] [pid 2083:tid 2105] [client 146.70.194.126:49215] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.old" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.old"] [unique_id "aViS7TVlR_BmlMPnhV5x-QAAANQ"]
[Sat Jan 03 11:54:23.464330 2026] [:error] [pid 2083:tid 2092] [client 146.70.194.126:31967] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.orig"] [unique_id "aViS7zVlR_BmlMPnhV5x-gAAAMc"]
[Sat Jan 03 11:54:25.035067 2026] [:error] [pid 31630:tid 31636] [client 146.70.194.126:29552] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_bak"] [unique_id "aViS8fUV_PU2SWgLPujTtAAAAYQ"]
[Sat Jan 03 11:54:26.584216 2026] [:error] [pid 2083:tid 2109] [client 146.70.194.126:61341] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.bak" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.bak"] [unique_id "aViS8jVlR_BmlMPnhV5x_QAAANg"]
[Sat Jan 03 11:54:28.170105 2026] [:error] [pid 19639:tid 19647] [client 146.70.194.126:60445] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/multi-plugin-installer/mpi_download.php"] [unique_id "aViS9CQ7fWZUytnlHEyBoAAAAUY"]
[Sat Jan 03 11:54:29.738420 2026] [:error] [pid 19639:tid 19650] [client 146.70.194.126:27652] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.bk"] [unique_id "aViS9SQ7fWZUytnlHEyBoQAAAUk"]
[Sat Jan 03 11:54:31.306110 2026] [:error] [pid 19639:tid 19663] [client 146.70.194.126:30941] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php2"] [unique_id "aViS9yQ7fWZUytnlHEyBowAAAVY"]
[Sat Jan 03 11:54:32.849186 2026] [:error] [pid 1931:tid 2040] [client 146.70.194.126:65514] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php"] [unique_id "aViS-B8Tyw7ZoIdXlcZ9rQAAAJA"]
[Sat Jan 03 11:54:34.425288 2026] [:error] [pid 34260:tid 34267] [client 146.70.194.126:52618] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.txt" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.txt"] [unique_id "aViS-kWWhyvZ0O9KNVRIJAAAAQU"]
[Sat Jan 03 11:54:35.997298 2026] [:error] [pid 1931:tid 2037] [client 146.70.194.126:53284] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.bkp"] [unique_id "aViS-x8Tyw7ZoIdXlcZ9sAAAAI0"]
[Sat Jan 03 11:54:37.559368 2026] [:error] [pid 34260:tid 34274] [client 146.70.194.126:20350] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php-bak"] [unique_id "aViS_UWWhyvZ0O9KNVRIJwAAAQw"]
[Sat Jan 03 11:54:39.149145 2026] [:error] [pid 34260:tid 34278] [client 146.70.194.126:17400] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_orig"] [unique_id "aViS_0WWhyvZ0O9KNVRIKgAAARA"]
[Sat Jan 03 11:54:42.203369 2026] [:error] [pid 1930:tid 1983] [client 146.70.194.126:3389] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.txt"] [unique_id "aViTApP-6mqhfUDa89xg4gAAAFE"]
[Sat Jan 03 11:54:43.751991 2026] [:error] [pid 2083:tid 2096] [client 146.70.194.126:11242] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_bk"] [unique_id "aViTAzVlR_BmlMPnhV5yGAAAAMs"]
[Sat Jan 03 11:54:45.324266 2026] [:error] [pid 2083:tid 2102] [client 146.70.194.126:34384] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php__"] [unique_id "aViTBTVlR_BmlMPnhV5yHAAAANE"]
[Sat Jan 03 11:54:46.897212 2026] [:error] [pid 34260:tid 34264] [client 146.70.194.126:35522] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/mTheme-Unus/css/css.php"] [unique_id "aViTBkWWhyvZ0O9KNVRILgAAAQI"]
[Sat Jan 03 11:54:48.473632 2026] [:error] [pid 31630:tid 31637] [client 146.70.194.126:31817] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_original"] [unique_id "aViTCPUV_PU2SWgLPujTywAAAYU"]
[Sat Jan 03 11:54:50.018971 2026] [:error] [pid 34260:tid 34267] [client 146.70.194.126:46744] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_backup"] [unique_id "aViTCkWWhyvZ0O9KNVRIMwAAAQU"]
[Sat Jan 03 11:54:51.578203 2026] [:error] [pid 34260:tid 34262] [client 146.70.194.126:18324] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php-original"] [unique_id "aViTC0WWhyvZ0O9KNVRINQAAAQA"]
[Sat Jan 03 11:54:53.145292 2026] [:error] [pid 1929:tid 1962] [client 146.70.194.126:26408] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.original"] [unique_id "aViTDecFqdpu6TNsuWpc3wAAABg"]
[Sat Jan 03 11:54:54.715172 2026] [:error] [pid 19639:tid 19655] [client 146.70.194.126:37770] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php-"] [unique_id "aViTDiQ7fWZUytnlHEyBtgAAAU4"]
[Sat Jan 03 11:54:56.289616 2026] [:error] [pid 34260:tid 34270] [client 146.70.194.126:21239] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php"] [unique_id "aViTEEWWhyvZ0O9KNVRIQQAAAQg"]
[Sat Jan 03 11:54:57.889906 2026] [:error] [pid 2083:tid 2091] [client 146.70.194.126:57945] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/adaptive-images/adaptive-images-script.php"] [unique_id "aViTETVlR_BmlMPnhV5yLgAAAMY"]
[Sat Jan 03 11:54:59.456646 2026] [:error] [pid 1931:tid 2048] [client 146.70.194.126:24645] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp%E2%80%94admin/admin%E2%80%94ajax.php"] [unique_id "aViTEx8Tyw7ZoIdXlcZ9vAAAAJg"]
[Sat Jan 03 11:55:01.086656 2026] [:error] [pid 1930:tid 1968] [client 146.70.194.126:48651] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aViTFZP-6mqhfUDa89xg6AAAAEI"]
[Sat Jan 03 11:55:02.667091 2026] [:error] [pid 34260:tid 34276] [client 146.70.194.126:21954] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php-backup"] [unique_id "aViTFkWWhyvZ0O9KNVRISQAAAQ4"]
[Sat Jan 03 11:55:04.238565 2026] [:error] [pid 34260:tid 34279] [client 146.70.194.126:28626] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aViTGEWWhyvZ0O9KNVRITQAAARE"]
[Sat Jan 03 11:55:05.818600 2026] [:error] [pid 19639:tid 19650] [client 146.70.194.126:56338] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-admin/tools.php"] [unique_id "aViTGSQ7fWZUytnlHEyBvgAAAUk"]
[Sat Jan 03 11:55:07.401733 2026] [:error] [pid 34260:tid 34274] [client 146.70.194.126:56010] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/google-mp3-audio-player/direct_download.php"] [unique_id "aViTG0WWhyvZ0O9KNVRIWQAAAQw"]
[Sat Jan 03 11:55:10.475322 2026] [:error] [pid 19639:tid 19647] [client 146.70.194.126:33205] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-admin/tools.php"] [unique_id "aViTHiQ7fWZUytnlHEyBxwAAAUY"]
[Sat Jan 03 11:55:12.061325 2026] [:error] [pid 1931:tid 2029] [client 146.70.194.126:25513] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/wp-config.backup"] [unique_id "aViTIB8Tyw7ZoIdXlcZ9wwAAAIU"]
[Sat Jan 03 11:55:12.363022 2026] [:error] [pid 1931:tid 2036] [client 146.70.194.126:25513] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.new"] [unique_id "aViTIB8Tyw7ZoIdXlcZ9xAAAAIw"]
[Sat Jan 03 11:55:13.928484 2026] [:error] [pid 2083:tid 2104] [client 146.70.194.126:15011] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.save.1"] [unique_id "aViTITVlR_BmlMPnhV5ySAAAANM"]
[Sat Jan 03 11:55:16.914222 2026] [:error] [pid 31630:tid 31643] [client 146.70.194.126:48212] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.dist"] [unique_id "aViTJPUV_PU2SWgLPujT3QAAAYs"]
[Sat Jan 03 11:55:18.484267 2026] [:error] [pid 1929:tid 1957] [client 146.70.194.126:19670] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php0"] [unique_id "aViTJucFqdpu6TNsuWpc6AAAABM"]
[Sat Jan 03 11:55:20.040444 2026] [:error] [pid 1929:tid 1954] [client 146.70.194.126:19857] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-post.php"] [unique_id "aViTKOcFqdpu6TNsuWpc7AAAABA"]
[Sat Jan 03 11:55:21.615674 2026] [:error] [pid 34260:tid 34275] [client 146.70.194.126:52801] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phpbak"] [unique_id "aViTKUWWhyvZ0O9KNVRIcAAAAQ0"]
[Sat Jan 03 11:55:23.185390 2026] [:error] [pid 2083:tid 2087] [client 146.70.194.126:58636] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin.php"] [unique_id "aViTKzVlR_BmlMPnhV5yUAAAAMI"]
[Sat Jan 03 11:55:24.764424 2026] [:error] [pid 1931:tid 2031] [client 146.70.194.126:59462] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/authentic/includes/download.php"] [unique_id "aViTLB8Tyw7ZoIdXlcZ9yAAAAIc"]
[Sat Jan 03 11:55:26.333611 2026] [:error] [pid 31630:tid 31643] [client 146.70.194.126:17807] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.1"] [unique_id "aViTLvUV_PU2SWgLPujT5AAAAYs"]
[Sat Jan 03 11:55:29.347712 2026] [:error] [pid 1930:tid 1988] [client 146.70.194.126:37447] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/churchope/lib/downloadlink.php"] [unique_id "aViTMZP-6mqhfUDa89xg-gAAAFY"]
[Sat Jan 03 11:55:30.926619 2026] [:error] [pid 34260:tid 34266] [client 146.70.194.126:57787] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.resetwp_bak"] [unique_id "aViTMkWWhyvZ0O9KNVRIggAAAQQ"]
[Sat Jan 03 11:55:32.528247 2026] [:error] [pid 1931:tid 2027] [client 146.70.194.126:39029] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_1"] [unique_id "aViTNB8Tyw7ZoIdXlcZ9zQAAAIQ"]
[Sat Jan 03 11:55:34.077571 2026] [:error] [pid 34260:tid 34284] [client 146.70.194.126:58677] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_new"] [unique_id "aViTNkWWhyvZ0O9KNVRIhQAAARY"]
[Sat Jan 03 11:55:35.643226 2026] [:error] [pid 19639:tid 19647] [client 146.70.194.126:36644] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phpn"] [unique_id "aViTNyQ7fWZUytnlHEyB4QAAAUY"]
[Sat Jan 03 11:55:38.622210 2026] [:error] [pid 31630:tid 31639] [client 146.70.194.126:46842] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.local"] [unique_id "aViTOvUV_PU2SWgLPujT7gAAAYc"]
[Sat Jan 03 11:55:40.203514 2026] [:error] [pid 34260:tid 34272] [client 146.70.194.126:32942] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.dev"] [unique_id "aViTPEWWhyvZ0O9KNVRIkQAAAQo"]
[Sat Jan 03 11:55:44.076919 2026] [:error] [pid 34260:tid 34271] [client 146.70.194.126:36979] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wpsite-background-takeover/exports/download.php"] [unique_id "aViTQEWWhyvZ0O9KNVRImAAAAQk"]
[Sat Jan 03 11:55:45.623810 2026] [:error] [pid 1931:tid 2039] [client 146.70.194.126:53868] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php."] [unique_id "aViTQR8Tyw7ZoIdXlcZ91gAAAI8"]
[Sat Jan 03 11:55:47.178621 2026] [:error] [pid 1930:tid 1969] [client 146.70.194.126:45479] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phpr"] [unique_id "aViTQ5P-6mqhfUDa89xhAQAAAEM"]
[Sat Jan 03 11:55:48.758490 2026] [:error] [pid 19639:tid 19657] [client 146.70.194.126:26253] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.disabled"] [unique_id "aViTRCQ7fWZUytnlHEyB6AAAAVA"]
[Sat Jan 03 11:55:50.319167 2026] [:error] [pid 31630:tid 31655] [client 146.70.194.126:51540] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/google-document-embedder/libs/pdf.php"] [unique_id "aViTRvUV_PU2SWgLPujT-QAAAZc"]
[Sat Jan 03 11:55:55.031355 2026] [:error] [pid 1930:tid 1981] [client 146.70.194.126:34708] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-hide-security-enhancer/router/file-process.php"] [unique_id "aViTS5P-6mqhfUDa89xhCgAAAE8"]
[Sat Jan 03 11:55:56.607852 2026] [:error] [pid 1931:tid 2039] [client 146.70.194.126:9189] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/wp-config-sample.php.bak"] [unique_id "aViTTB8Tyw7ZoIdXlcZ94AAAAI8"]
[Sat Jan 03 11:55:58.360053 2026] [:error] [pid 1931:tid 1994] [client 146.70.194.126:9189] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/db-backup/download.php"] [unique_id "aViTTh8Tyw7ZoIdXlcZ94gAAAIE"]
[Sat Jan 03 11:55:59.945905 2026] [:error] [pid 2083:tid 2092] [client 146.70.194.126:32128] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/NativeChurch/download/download.php"] [unique_id "aViTTzVlR_BmlMPnhV5ydwAAAMc"]
[Sat Jan 03 11:56:01.520593 2026] [:error] [pid 2083:tid 2085] [client 146.70.194.126:2877] [client 146.70.194.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.new"] [unique_id "aViTUTVlR_BmlMPnhV5yeQAAAMA"]
[Sat Jan 03 11:56:03.078319 2026] [:error] [pid 34260:tid 34269] [client 146.70.194.126:49772] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.copy"] [unique_id "aViTU0WWhyvZ0O9KNVRIwgAAAQc"]
[Sat Jan 03 11:56:04.645797 2026] [:error] [pid 2083:tid 2089] [client 146.70.194.126:30286] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_copy"] [unique_id "aViTVDVlR_BmlMPnhV5yegAAAMQ"]
[Sat Jan 03 11:56:06.216478 2026] [:error] [pid 34260:tid 34274] [client 146.70.194.126:43348] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-filemanager/incl/libfile.php"] [unique_id "aViTVkWWhyvZ0O9KNVRIzgAAAQw"]
[Sat Jan 03 11:56:07.794386 2026] [:error] [pid 2083:tid 2099] [client 146.70.194.126:12217] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.sample"] [unique_id "aViTVzVlR_BmlMPnhV5ygAAAAM4"]
[Sat Jan 03 11:56:09.352687 2026] [:error] [pid 34260:tid 34265] [client 146.70.194.126:37282] [client 146.70.194.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config-sample.php"] [unique_id "aViTWUWWhyvZ0O9KNVRI0wAAAQM"]
[Sat Jan 03 11:56:10.914148 2026] [:error] [pid 1931:tid 2034] [client 146.70.194.126:60383] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php3"] [unique_id "aViTWh8Tyw7ZoIdXlcZ95gAAAIo"]
[Sat Jan 03 11:56:12.487166 2026] [:error] [pid 1931:tid 2027] [client 146.70.194.126:18495] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phpd"] [unique_id "aViTXB8Tyw7ZoIdXlcZ96wAAAIQ"]
[Sat Jan 03 11:56:14.056233 2026] [:error] [pid 2083:tid 2095] [client 146.70.194.126:17883] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.prod"] [unique_id "aViTXjVlR_BmlMPnhV5ygwAAAMo"]
[Sat Jan 03 11:56:15.627564 2026] [:error] [pid 2083:tid 2098] [client 146.70.194.126:60993] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/parallelus-mingle/framework/utilities/download/getfile.php"] [unique_id "aViTXzVlR_BmlMPnhV5yhAAAAM0"]
[Sat Jan 03 11:56:17.199705 2026] [:error] [pid 31630:tid 31636] [client 146.70.194.126:8430] [client 146.70.194.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.save"] [unique_id "aViTYfUV_PU2SWgLPujUEAAAAYQ"]
[Sat Jan 03 11:56:18.771377 2026] [:error] [pid 1931:tid 2042] [client 146.70.194.126:33363] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/sf-booking/lib/downloads.php"] [unique_id "aViTYh8Tyw7ZoIdXlcZ9-AAAAJI"]
[Sat Jan 03 11:56:20.322686 2026] [:error] [pid 1929:tid 1957] [client 146.70.194.126:26462] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.sav"] [unique_id "aViTZOcFqdpu6TNsuWpdEgAAABM"]
[Sat Jan 03 11:56:21.871371 2026] [:error] [pid 1929:tid 1947] [client 146.70.194.126:17240] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phpnew"] [unique_id "aViTZecFqdpu6TNsuWpdFAAAAAk"]
[Sat Jan 03 11:56:23.418203 2026] [:error] [pid 2083:tid 2090] [client 146.70.194.126:45486] [client 146.70.194.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.original"] [unique_id "aViTZzVlR_BmlMPnhV5ykAAAAMU"]
[Sat Jan 03 11:56:24.996879 2026] [:error] [pid 2083:tid 2087] [client 146.70.194.126:59452] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.b"] [unique_id "aViTaDVlR_BmlMPnhV5ylgAAAMI"]
[Sat Jan 03 11:56:26.569285 2026] [:error] [pid 1930:tid 1974] [client 146.70.194.126:33752] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php-save"] [unique_id "aViTapP-6mqhfUDa89xhGAAAAEg"]
[Sat Jan 03 11:56:28.130947 2026] [:error] [pid 1929:tid 1961] [client 146.70.194.126:56757] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.2"] [unique_id "aViTbOcFqdpu6TNsuWpdPQAAABc"]
[Sat Jan 03 11:56:29.686718 2026] [:error] [pid 31630:tid 31637] [client 146.70.194.126:35523] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.bak1"] [unique_id "aViTbfUV_PU2SWgLPujUKQAAAYU"]
[Sat Jan 03 11:56:31.267728 2026] [:error] [pid 31630:tid 31645] [client 146.70.194.126:43974] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.0"] [unique_id "aViTb_UV_PU2SWgLPujUKgAAAY0"]
[Sat Jan 03 11:56:32.848978 2026] [:error] [pid 34260:tid 34265] [client 146.70.194.126:44011] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/site-import/admin/page.php"] [unique_id "aViTcEWWhyvZ0O9KNVRI4gAAAQM"]
[Sat Jan 03 11:56:34.420449 2026] [:error] [pid 34260:tid 34277] [client 146.70.194.126:12860] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aViTckWWhyvZ0O9KNVRI5QAAAQ8"]
[Sat Jan 03 11:56:35.970406 2026] [:error] [pid 19639:tid 19664] [client 146.70.194.126:12577] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.in"] [unique_id "aViTcyQ7fWZUytnlHEyCCwAAAVc"]
[Sat Jan 03 11:56:37.546456 2026] [:error] [pid 1931:tid 2046] [client 146.70.194.126:59649] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php%23"] [unique_id "aViTdR8Tyw7ZoIdXlcZ-DQAAAJY"]
[Sat Jan 03 11:56:39.077140 2026] [:error] [pid 2083:tid 2092] [client 146.70.194.126:36188] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php~"] [unique_id "aViTdzVlR_BmlMPnhV5yoAAAAMc"]
[Sat Jan 03 11:56:40.645351 2026] [:error] [pid 2083:tid 2102] [client 146.70.194.126:9387] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/recent-backups/download-file.php"] [unique_id "aViTeDVlR_BmlMPnhV5yogAAANE"]
[Sat Jan 03 11:56:42.228273 2026] [:error] [pid 1931:tid 2033] [client 146.70.194.126:3891] [client 146.70.194.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.sav"] [unique_id "aViTeh8Tyw7ZoIdXlcZ-DwAAAIk"]
[Sat Jan 03 11:56:43.784023 2026] [:error] [pid 34260:tid 34279] [client 146.70.194.126:8880] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/u_parts/force-download.php"] [unique_id "aViTe0WWhyvZ0O9KNVRI8wAAARE"]
[Sat Jan 03 11:56:45.349018 2026] [:error] [pid 2083:tid 2109] [client 146.70.194.126:21061] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wechat-broadcast/wechat/Image.php"] [unique_id "aViTfTVlR_BmlMPnhV5ypgAAANg"]
[Sat Jan 03 11:56:46.905028 2026] [:error] [pid 2083:tid 2096] [client 146.70.194.126:6882] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.tmp"] [unique_id "aViTfjVlR_BmlMPnhV5yqgAAAMs"]
[Sat Jan 03 11:56:48.468771 2026] [:error] [pid 1931:tid 1993] [client 146.70.194.126:25123] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php~~"] [unique_id "aViTgB8Tyw7ZoIdXlcZ-GAAAAIA"]
[Sat Jan 03 11:56:50.034265 2026] [:error] [pid 2083:tid 2103] [client 146.70.194.126:28372] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_bak/wp-config.php-bak"] [unique_id "aViTgjVlR_BmlMPnhV5yrgAAANI"]
[Sat Jan 03 11:56:51.618303 2026] [:error] [pid 1931:tid 1999] [client 146.70.194.126:47201] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/parallelus-salutation/framework/utilities/download/getfile.php"] [unique_id "aViTgx8Tyw7ZoIdXlcZ-GQAAAIM"]
[Sat Jan 03 11:56:53.189046 2026] [:error] [pid 31630:tid 31638] [client 146.70.194.126:27039] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aViThfUV_PU2SWgLPujUPAAAAYY"]
[Sat Jan 03 11:56:54.751501 2026] [:error] [pid 2083:tid 2105] [client 146.70.194.126:11294] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aViThjVlR_BmlMPnhV5ysgAAANQ"]
[Sat Jan 03 11:56:56.300101 2026] [:error] [pid 1931:tid 2040] [client 146.70.194.126:38932] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-miniaudioplayer/map_download.php"] [unique_id "aViTiB8Tyw7ZoIdXlcZ-HAAAAJA"]
[Sat Jan 03 11:56:57.854393 2026] [:error] [pid 34260:tid 34286] [client 146.70.194.126:42875] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.wp-config.php.old"] [unique_id "aViTiUWWhyvZ0O9KNVRJAAAAARg"]
[Sat Jan 03 11:57:00.962217 2026] [:error] [pid 2083:tid 2098] [client 146.70.194.126:1159] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wptf-image-gallery/lib-mbox/ajax_load.php"] [unique_id "aViTjDVlR_BmlMPnhV5yuQAAAM0"]
[Sat Jan 03 11:57:02.522132 2026] [:error] [pid 1930:tid 1971] [client 146.70.194.126:3938] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.bak" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.wp-config.bak"] [unique_id "aViTjpP-6mqhfUDa89xhNgAAAEU"]
[Sat Jan 03 11:57:04.099811 2026] [:error] [pid 19639:tid 19652] [client 146.70.194.126:5415] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phpa"] [unique_id "aViTkCQ7fWZUytnlHEyCKgAAAUs"]
[Sat Jan 03 11:57:07.171067 2026] [:error] [pid 31630:tid 31633] [client 146.70.194.126:45855] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hb-audio-gallery-lite/gallery/audio-download.php"] [unique_id "aViTk_UV_PU2SWgLPujUWQAAAYE"]
[Sat Jan 03 11:57:11.122677 2026] [:error] [pid 1930:tid 1982] [client 146.70.194.126:20812] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/history-collection/download.php"] [unique_id "aViTl5P-6mqhfUDa89xhVwAAAFA"]
[Sat Jan 03 11:57:12.681724 2026] [:error] [pid 34260:tid 34278] [client 146.70.194.126:65523] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phps"] [unique_id "aViTmEWWhyvZ0O9KNVRJGwAAARA"]
[Sat Jan 03 11:57:14.237393 2026] [:error] [pid 1929:tid 1940] [client 146.70.194.126:63764] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/fluidracountry/download.php"] [unique_id "aViTmucFqdpu6TNsuWpdcAAAAAI"]
[Sat Jan 03 11:57:15.790430 2026] [:error] [pid 34260:tid 34283] [client 146.70.194.126:50523] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phpb"] [unique_id "aViTm0WWhyvZ0O9KNVRJIQAAARU"]
[Sat Jan 03 11:57:17.362645 2026] [:error] [pid 1930:tid 1980] [client 146.70.194.126:21519] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.production"] [unique_id "aViTnZP-6mqhfUDa89xhXAAAAE4"]
[Sat Jan 03 11:57:18.939830 2026] [:error] [pid 19639:tid 19647] [client 146.70.194.126:63386] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.gz"] [unique_id "aViTniQ7fWZUytnlHEyCOgAAAUY"]
[Sat Jan 03 11:57:20.498032 2026] [:error] [pid 1929:tid 1944] [client 146.70.194.126:2895] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-config.php~"] [unique_id "aViToOcFqdpu6TNsuWpddQAAAAY"]
[Sat Jan 03 11:57:22.066488 2026] [:error] [pid 19639:tid 19645] [client 146.70.194.126:54460] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phporiginal"] [unique_id "aViToiQ7fWZUytnlHEyCPAAAAUQ"]
[Sat Jan 03 11:57:23.639304 2026] [:error] [pid 1929:tid 1956] [client 146.70.194.126:40304] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php="] [unique_id "aViTo-cFqdpu6TNsuWpdeQAAABI"]
[Sat Jan 03 11:57:26.617335 2026] [:error] [pid 31630:tid 31656] [client 146.70.194.126:64636] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aViTpvUV_PU2SWgLPujUaAAAAZg"]
[Sat Jan 03 11:57:29.602100 2026] [:error] [pid 31630:tid 31632] [client 146.70.194.126:31408] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php-o"] [unique_id "aViTqfUV_PU2SWgLPujUbAAAAYA"]
[Sat Jan 03 11:57:31.182986 2026] [:error] [pid 2083:tid 2089] [client 146.70.194.126:56643] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aViTqzVlR_BmlMPnhV5y1gAAAMQ"]
[Sat Jan 03 11:57:32.777292 2026] [:error] [pid 34260:tid 34277] [client 146.70.194.126:7659] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.c"] [unique_id "aViTrEWWhyvZ0O9KNVRJLwAAAQ8"]
[Sat Jan 03 11:57:34.361418 2026] [:error] [pid 2083:tid 2086] [client 146.70.194.126:43478] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.bac"] [unique_id "aViTrjVlR_BmlMPnhV5y2QAAAME"]
[Sat Jan 03 11:57:35.923417 2026] [:error] [pid 1931:tid 2039] [client 146.70.194.126:61093] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.tmp" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.tmp"] [unique_id "aViTrx8Tyw7ZoIdXlcZ-SAAAAI8"]
[Sat Jan 03 11:57:38.902370 2026] [:error] [pid 34260:tid 34282] [client 146.70.194.126:36933] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/tinymce-thumbnail-gallery/php/download-image.php"] [unique_id "aViTskWWhyvZ0O9KNVRJNgAAARQ"]
[Sat Jan 03 11:57:40.464972 2026] [:error] [pid 34260:tid 34268] [client 146.70.194.126:17919] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.staging"] [unique_id "aViTtEWWhyvZ0O9KNVRJOgAAAQY"]
[Sat Jan 03 11:57:43.505194 2026] [:error] [pid 31630:tid 31640] [client 146.70.194.126:53024] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pica-photo-gallery/picadownload.php"] [unique_id "aViTt_UV_PU2SWgLPujUcAAAAYg"]
[Sat Jan 03 11:57:45.081936 2026] [:error] [pid 2083:tid 2092] [client 146.70.194.126:56681] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aViTuTVlR_BmlMPnhV5y7QAAAMc"]
[Sat Jan 03 11:57:48.076656 2026] [:error] [pid 1931:tid 2042] [client 146.70.194.126:36643] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/old-post-spinner/logview.php"] [unique_id "aViTvB8Tyw7ZoIdXlcZ-UQAAAJI"]
[Sat Jan 03 11:57:51.021920 2026] [:error] [pid 1931:tid 2048] [client 146.70.194.126:21199] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.temp"] [unique_id "aViTvx8Tyw7ZoIdXlcZ-VgAAAJg"]
[Sat Jan 03 11:57:52.596035 2026] [:error] [pid 31630:tid 31646] [client 146.70.194.126:33948] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/responsive-visual/includes/download.php"] [unique_id "aViTwPUV_PU2SWgLPujUdwAAAY4"]
[Sat Jan 03 11:57:56.395163 2026] [:error] [pid 34260:tid 34273] [client 146.70.194.126:64458] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.phpo"] [unique_id "aViTxEWWhyvZ0O9KNVRJUwAAAQs"]
[Sat Jan 03 11:57:57.954996 2026] [:error] [pid 2083:tid 2103] [client 146.70.194.126:49754] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contus-video-gallery/hdflvplayer/download.php"] [unique_id "aViTxTVlR_BmlMPnhV5y9gAAANI"]
[Sat Jan 03 11:57:59.518393 2026] [:error] [pid 34260:tid 34266] [client 146.70.194.126:40694] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/jsmol2wp/php/jsmol.php"] [unique_id "aViTx0WWhyvZ0O9KNVRJVwAAAQQ"]
[Sat Jan 03 11:58:01.086544 2026] [:error] [pid 1929:tid 1954] [client 146.70.194.126:37685] [client 146.70.194.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config_copy"] [unique_id "aViTyecFqdpu6TNsuWpdnQAAABA"]
[Sat Jan 03 11:58:02.643695 2026] [:error] [pid 2083:tid 2102] [client 146.70.194.126:19870] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/blog/wp-config.php.bak"] [unique_id "aViTyjVlR_BmlMPnhV5y-wAAANE"]
[Sat Jan 03 11:58:04.224751 2026] [:error] [pid 1929:tid 1955] [client 146.70.194.126:51078] [client 146.70.194.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.1"] [unique_id "aViTzOcFqdpu6TNsuWpdoQAAABE"]
[Sat Jan 03 11:58:05.776765 2026] [:error] [pid 19639:tid 19665] [client 146.70.194.126:18705] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/blog/wp-config.php~"] [unique_id "aViTzSQ7fWZUytnlHEyCUAAAAVg"]
[Sat Jan 03 11:58:07.345196 2026] [:error] [pid 34260:tid 34283] [client 146.70.194.126:20613] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin.php"] [unique_id "aViTz0WWhyvZ0O9KNVRJXQAAARU"]
[Sat Jan 03 11:58:08.905075 2026] [:error] [pid 31630:tid 31643] [client 146.70.194.126:10952] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/membership-simplified-for-oap-members-only/download.php"] [unique_id "aViT0PUV_PU2SWgLPujUgQAAAYs"]
[Sat Jan 03 11:58:10.471588 2026] [:error] [pid 2083:tid 2106] [client 146.70.194.126:41713] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.tar"] [unique_id "aViT0jVlR_BmlMPnhV5y_wAAANU"]
[Sat Jan 03 11:58:12.023599 2026] [:error] [pid 1930:tid 1968] [client 146.70.194.126:18105] [client 146.70.194.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.sample"] [unique_id "aViT1JP-6mqhfUDa89xhdQAAAEI"]
[Sat Jan 03 11:58:13.587407 2026] [:error] [pid 19639:tid 19659] [client 146.70.194.126:43350] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-config.php.bak"] [unique_id "aViT1SQ7fWZUytnlHEyCVAAAAVI"]
[Sat Jan 03 11:58:15.177200 2026] [:error] [pid 1929:tid 1940] [client 146.70.194.126:31165] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.tar.gz"] [unique_id "aViT1-cFqdpu6TNsuWpdqAAAAAI"]
[Sat Jan 03 11:58:16.765675 2026] [:error] [pid 1931:tid 2042] [client 146.70.194.126:24959] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php_tmp"] [unique_id "aViT2B8Tyw7ZoIdXlcZ-bAAAAJI"]
[Sat Jan 03 11:58:18.344176 2026] [:error] [pid 34260:tid 34284] [client 146.70.194.126:21610] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/cloudsafe365-for-wp/admin/editor/cs365_edit.php"] [unique_id "aViT2kWWhyvZ0O9KNVRJawAAARY"]
[Sat Jan 03 11:58:19.898508 2026] [:error] [pid 31630:tid 31651] [client 146.70.194.126:10674] [client 146.70.194.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.prod"] [unique_id "aViT2_UV_PU2SWgLPujUiwAAAZM"]
[Sat Jan 03 11:58:21.468243 2026] [:error] [pid 2083:tid 2093] [client 146.70.194.126:26638] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/general.php"] [unique_id "aViT3TVlR_BmlMPnhV5zAQAAAMg"]
[Sat Jan 03 11:58:23.040783 2026] [:error] [pid 2083:tid 2102] [client 146.70.194.126:27910] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/_wp-config.php.bak"] [unique_id "aViT3zVlR_BmlMPnhV5zAgAAANE"]
[Sat Jan 03 11:58:24.606860 2026] [:error] [pid 1929:tid 1960] [client 146.70.194.126:22620] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/storepress/framework/utilities/download/getfile.php"] [unique_id "aViT4OcFqdpu6TNsuWpdsQAAABY"]
[Sat Jan 03 11:58:26.181977 2026] [:error] [pid 1930:tid 1978] [client 146.70.194.126:21697] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.backup.txt"] [unique_id "aViT4pP-6mqhfUDa89xhgwAAAEw"]
[Sat Jan 03 11:58:29.151336 2026] [:error] [pid 34260:tid 34271] [client 146.70.194.126:58562] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php4"] [unique_id "aViT5UWWhyvZ0O9KNVRJggAAAQk"]
[Sat Jan 03 11:58:30.713342 2026] [:error] [pid 31630:tid 31632] [client 146.70.194.126:18196] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.cust"] [unique_id "aViT5vUV_PU2SWgLPujUjwAAAYA"]
[Sat Jan 03 11:58:32.262834 2026] [:error] [pid 31630:tid 31644] [client 146.70.194.126:51169] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/rttheme18/download.php"] [unique_id "aViT6PUV_PU2SWgLPujUlAAAAYw"]
[Sat Jan 03 11:58:33.828381 2026] [:error] [pid 1931:tid 2032] [client 146.70.194.126:2327] [client 146.70.194.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config.bac"] [unique_id "aViT6R8Tyw7ZoIdXlcZ-eAAAAIg"]
[Sat Jan 03 11:58:35.392174 2026] [:error] [pid 2083:tid 2106] [client 146.70.194.126:31111] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.wp-config.php.bak"] [unique_id "aViT6zVlR_BmlMPnhV5zCQAAANU"]
[Sat Jan 03 11:58:36.959740 2026] [:error] [pid 19639:tid 19658] [client 146.70.194.126:51311] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/_wp-config.php"] [unique_id "aViT7CQ7fWZUytnlHEyCWwAAAVE"]
[Sat Jan 03 11:58:38.521266 2026] [:error] [pid 1931:tid 2039] [client 146.70.194.126:34499] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/mac-dock-gallery/macdownload.php"] [unique_id "aViT7h8Tyw7ZoIdXlcZ-fAAAAI8"]
[Sat Jan 03 11:58:40.104251 2026] [:error] [pid 31630:tid 31635] [client 146.70.194.126:43759] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php__olds"] [unique_id "aViT8PUV_PU2SWgLPujUnwAAAYM"]
[Sat Jan 03 11:58:41.674295 2026] [:error] [pid 1931:tid 2036] [client 146.70.194.126:62973] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/MusicMaker/download.php"] [unique_id "aViT8R8Tyw7ZoIdXlcZ-fQAAAIw"]
[Sat Jan 03 11:58:43.248005 2026] [:error] [pid 31630:tid 31640] [client 146.70.194.126:26346] [client 146.70.194.126] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config-sample.bak"] [unique_id "aViT8_UV_PU2SWgLPujUoQAAAYg"]
[Sat Jan 03 11:58:44.796481 2026] [:error] [pid 19639:tid 19642] [client 146.70.194.126:24222] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.a"] [unique_id "aViT9CQ7fWZUytnlHEyCZwAAAUE"]
[Sat Jan 03 11:58:46.369232 2026] [:error] [pid 1931:tid 2046] [client 146.70.194.126:57903] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aViT9h8Tyw7ZoIdXlcZ-gwAAAJY"]
[Sat Jan 03 11:58:47.926331 2026] [:error] [pid 34260:tid 34278] [client 146.70.194.126:32720] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.html"] [unique_id "aViT90WWhyvZ0O9KNVRJkwAAARA"]
[Sat Jan 03 11:58:49.475823 2026] [:error] [pid 34260:tid 34270] [client 146.70.194.126:6189] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/ypo-theme/download.php"] [unique_id "aViT-UWWhyvZ0O9KNVRJmAAAAQg"]
[Sat Jan 03 11:58:51.040365 2026] [:error] [pid 34260:tid 34281] [client 146.70.194.126:59618] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/simple-image-manipulator/controller/download.php"] [unique_id "aViT-0WWhyvZ0O9KNVRJmwAAARM"]
[Sat Jan 03 11:58:52.596775 2026] [:error] [pid 31630:tid 31645] [client 146.70.194.126:45522] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php______"] [unique_id "aViT_PUV_PU2SWgLPujUtAAAAY0"]
[Sat Jan 03 11:58:54.161500 2026] [:error] [pid 34260:tid 34272] [client 146.70.194.126:43081] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/imdb-widget/pic.php"] [unique_id "aViT_kWWhyvZ0O9KNVRJnQAAAQo"]
[Sat Jan 03 11:58:55.723195 2026] [:error] [pid 1930:tid 1984] [client 146.70.194.126:44624] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp/wp-config.php~"] [unique_id "aViT_5P-6mqhfUDa89xhjwAAAFI"]
[Sat Jan 03 11:58:59.730483 2026] [:error] [pid 34260:tid 34264] [client 146.70.194.126:12443] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/s3bubble-amazon-s3-html-5-video-with-adverts/assets/plugins/ultimate/content/downloader.php"] [unique_id "aViUA0WWhyvZ0O9KNVRJpwAAAQI"]
[Sat Jan 03 11:59:01.311186 2026] [:error] [pid 31630:tid 31642] [client 146.70.194.126:51326] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/zip-attachments/download.php"] [unique_id "aViUBfUV_PU2SWgLPujUwgAAAYo"]
[Sat Jan 03 11:59:02.881489 2026] [:error] [pid 19639:tid 19646] [client 146.70.194.126:50774] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/hello-elementor/down.php"] [unique_id "aViUBiQ7fWZUytnlHEyCbAAAAUU"]
[Sat Jan 03 11:59:04.442855 2026] [:error] [pid 34260:tid 34272] [client 146.70.194.126:36844] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php6"] [unique_id "aViUCEWWhyvZ0O9KNVRJsQAAAQo"]
[Sat Jan 03 11:59:06.026032 2026] [:error] [pid 2083:tid 2106] [client 146.70.194.126:40885] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/paypal-currency-converter-basic-for-woocommerce/proxy.php"] [unique_id "aViUCjVlR_BmlMPnhV5zGAAAANU"]
[Sat Jan 03 11:59:07.653128 2026] [:error] [pid 19639:tid 19651] [client 146.70.194.126:18314] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/plugin-newsletter/preview.php"] [unique_id "aViUCyQ7fWZUytnlHEyCdAAAAUo"]
[Sat Jan 03 11:59:09.221287 2026] [:error] [pid 1931:tid 2038] [client 146.70.194.126:25253] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.stage"] [unique_id "aViUDR8Tyw7ZoIdXlcZ-mAAAAI4"]
[Sat Jan 03 11:59:13.115377 2026] [:error] [pid 1931:tid 2032] [client 146.70.194.126:63108] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/mdocs-posts/"] [unique_id "aViUER8Tyw7ZoIdXlcZ-pgAAAIg"]
[Sat Jan 03 11:59:14.686814 2026] [:error] [pid 19639:tid 19662] [client 146.70.194.126:19002] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/simple-download-button-shortcode/simple-download-button_dl.php"] [unique_id "aViUEiQ7fWZUytnlHEyCegAAAVU"]
[Sat Jan 03 11:59:16.218023 2026] [:error] [pid 31630:tid 31640] [client 146.70.194.126:31857] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.zip"] [unique_id "aViUFPUV_PU2SWgLPujUyQAAAYg"]
[Sat Jan 03 11:59:17.776286 2026] [:error] [pid 1929:tid 1939] [client 146.70.194.126:6074] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp/wp-config.php.bak"] [unique_id "aViUFecFqdpu6TNsuWpd1QAAAAE"]
[Sat Jan 03 11:59:19.352282 2026] [:error] [pid 19639:tid 19660] [client 146.70.194.126:47421] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.wp-config.php.swp"] [unique_id "aViUFyQ7fWZUytnlHEyCfwAAAVM"]
[Sat Jan 03 11:59:20.909476 2026] [:error] [pid 19639:tid 19656] [client 146.70.194.126:51449] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/estrutura-basica/scripts/download.php"] [unique_id "aViUGCQ7fWZUytnlHEyCgQAAAU8"]
[Sat Jan 03 11:59:23.923389 2026] [:error] [pid 1931:tid 2041] [client 146.70.194.126:33704] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-publication-archive/includes/openfile.php"] [unique_id "aViUGx8Tyw7ZoIdXlcZ-swAAAJE"]
[Sat Jan 03 11:59:25.486440 2026] [:error] [pid 31630:tid 31645] [client 146.70.194.126:39716] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/antioch/lib/scripts/download.php"] [unique_id "aViUHfUV_PU2SWgLPujU0AAAAY0"]
[Sat Jan 03 11:59:27.039623 2026] [:error] [pid 2083:tid 2106] [client 146.70.194.126:17060] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/sb-download.php"] [unique_id "aViUHzVlR_BmlMPnhV5zTAAAANU"]
[Sat Jan 03 11:59:28.599363 2026] [:error] [pid 31630:tid 31638] [client 146.70.194.126:25546] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-config.php.backup"] [unique_id "aViUIPUV_PU2SWgLPujU1QAAAYY"]
[Sat Jan 03 11:59:32.477789 2026] [:error] [pid 1931:tid 2041] [client 146.70.194.126:61496] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php5"] [unique_id "aViUJB8Tyw7ZoIdXlcZ-uAAAAJE"]
[Sat Jan 03 11:59:34.067325 2026] [:error] [pid 19639:tid 19654] [client 146.70.194.126:46951] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.aws"] [unique_id "aViUJiQ7fWZUytnlHEyChgAAAU0"]
[Sat Jan 03 11:59:35.664125 2026] [:error] [pid 2083:tid 2097] [client 146.70.194.126:3438] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aViUJzVlR_BmlMPnhV5zZAAAAMw"]
[Sat Jan 03 11:59:37.246318 2026] [:error] [pid 1931:tid 2043] [client 146.70.194.126:56215] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.bak" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.bak1"] [unique_id "aViUKR8Tyw7ZoIdXlcZ-uwAAAJM"]
[Sat Jan 03 11:59:38.803895 2026] [:error] [pid 1929:tid 1958] [client 146.70.194.126:65441] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php"] [unique_id "aViUKucFqdpu6TNsuWpd7gAAABQ"]
[Sat Jan 03 11:59:40.380736 2026] [:error] [pid 34260:tid 34272] [client 146.70.194.126:54986] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/urbancity/lib/scripts/download.php"] [unique_id "aViULEWWhyvZ0O9KNVRJ2QAAAQo"]
[Sat Jan 03 11:59:41.942781 2026] [:error] [pid 1930:tid 1981] [client 146.70.194.126:5598] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/linenity/functions/download.php"] [unique_id "aViULZP-6mqhfUDa89xhtgAAAE8"]
[Sat Jan 03 11:59:43.503132 2026] [:error] [pid 1931:tid 2040] [client 146.70.194.126:61571] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/duena/download.php"] [unique_id "aViULx8Tyw7ZoIdXlcZ-xAAAAJA"]
[Sat Jan 03 11:59:45.084340 2026] [:error] [pid 31630:tid 31655] [client 146.70.194.126:23460] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/PlixPro/download.php"] [unique_id "aViUMfUV_PU2SWgLPujU5QAAAZc"]
[Sat Jan 03 11:59:46.719693 2026] [:error] [pid 1930:tid 1967] [client 146.70.194.126:63112] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/wp-config.ini"] [unique_id "aViUMpP-6mqhfUDa89xhtwAAAEE"]
[Sat Jan 03 11:59:47.033623 2026] [:error] [pid 1930:tid 1969] [client 146.70.194.126:63112] [client 146.70.194.126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/codecanyon-5293356-ajax-store-locator-wordpress/sl_file_download.php"] [unique_id "aViUM5P-6mqhfUDa89xhuQAAAEM"]
[Sat Jan 03 12:13:32.166513 2026] [:error] [pid 34260:tid 34263] [client 47.236.244.156:38112] [client 47.236.244.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.236.244.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aViXbEWWhyvZ0O9KNVRPoQAAAQE"]
[Sat Jan 03 12:13:52.922050 2026] [:error] [pid 1931:tid 2039] [client 47.236.244.156:44558] [client 47.236.244.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.236.244.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aViXgB8Tyw7ZoIdXlcaB4AAAAI8"]
[Sat Jan 03 12:43:05.519325 2026] [:error] [pid 34260:tid 34286] [client 200.152.177.16:42586] [client 200.152.177.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.152.177.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVieWUWWhyvZ0O9KNVRcEAAAARg"]
[Sat Jan 03 13:05:46.468451 2026] [:error] [pid 19639:tid 19647] [client 190.107.177.240:34406] [client 190.107.177.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.107.177.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVijqiQ7fWZUytnlHEyRqAAAAUY"]
[Sat Jan 03 13:18:48.984491 2026] [:error] [pid 19639:tid 19647] [client 132.148.179.39:44602] [client 132.148.179.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.179.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVimuCQ7fWZUytnlHEyUgAAAAUY"]
[Sat Jan 03 13:24:12.581864 2026] [:error] [pid 34260:tid 34262] [client 51.38.113.2:54068] [client 51.38.113.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.38.113.2, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVin_EWWhyvZ0O9KNVRrXAAAAQA"]
[Sat Jan 03 13:34:49.839626 2026] [:error] [pid 31630:tid 31642] [client 80.90.87.42:46158] [client 80.90.87.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.90.87.42, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aViqefUV_PU2SWgLPujrIAAAAYo"]
[Sat Jan 03 13:44:59.485888 2026] [:error] [pid 1930:tid 1989] [client 49.7.227.204:35466] [client 49.7.227.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVis25P-6mqhfUDa89x6WwAAAFc"]
[Sat Jan 03 14:16:46.338037 2026] [:error] [pid 2083:tid 2109] [client 178.33.40.189:48058] [client 178.33.40.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.33.40.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVi0TjVlR_BmlMPnhV6avgAAANg"]
[Sat Jan 03 14:57:43.674071 2026] [:error] [pid 34260:tid 34280] [client 184.168.100.57:30316] [client 184.168.100.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.100.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVi950WWhyvZ0O9KNVSQHQAAARI"]
[Sat Jan 03 15:07:52.460425 2026] [:error] [pid 34260:tid 34278] [client 104.37.191.206:36858] [client 104.37.191.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.37.191.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVjASEWWhyvZ0O9KNVSTQgAAARA"]
[Sat Jan 03 16:05:47.995896 2026] [:error] [pid 34260:tid 34276] [client 194.62.54.39:33658] [client 194.62.54.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.62.54.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVjN20WWhyvZ0O9KNVSltwAAAQ4"]
[Sat Jan 03 16:14:59.606491 2026] [:error] [pid 34260:tid 34281] [client 149.255.58.137:52228] [client 149.255.58.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.255.58.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVjQA0WWhyvZ0O9KNVSpmgAAARM"]
[Sat Jan 03 16:30:27.455146 2026] [:error] [pid 2083:tid 2105] [client 43.157.170.126:36632] [client 43.157.170.126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVjTozVlR_BmlMPnhV69HAAAANQ"]
[Sat Jan 03 16:31:32.598468 2026] [:error] [pid 1931:tid 2033] [client 107.180.113.53:35532] [client 107.180.113.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.113.53, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVjT5B8Tyw7ZoIdXlca1XQAAAIk"]
[Sat Jan 03 17:43:18.898166 2026] [:error] [pid 31630:tid 31632] [client 185.50.25.16:64467] [client 185.50.25.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.50.25.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVjktvUV_PU2SWgLPuglQgAAAYA"]
[Sat Jan 03 17:45:25.957919 2026] [:error] [pid 1931:tid 2043] [client 216.219.87.194:45966] [client 216.219.87.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.219.87.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVjlNR8Tyw7ZoIdXlcbFugAAAJM"]
[Sat Jan 03 18:51:29.971409 2026] [:error] [pid 1931:tid 2027] [client 20.246.140.155:7301] [client 20.246.140.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.246.140.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVj0sR8Tyw7ZoIdXlcbWEAAAAIQ"]
[Sat Jan 03 19:19:18.919442 2026] [:error] [pid 19639:tid 19659] [client 49.51.203.164:35716] [client 49.51.203.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVj7NiQ7fWZUytnlHEzfvwAAAVI"]
[Sat Jan 03 19:48:50.488129 2026] [:error] [pid 2083:tid 2109] [client 220.158.233.198:35430] [client 220.158.233.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.158.233.198, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVkCIjVlR_BmlMPnhV79bAAAANg"]
[Sat Jan 03 19:52:30.389463 2026] [:error] [pid 1929:tid 1962] [client 107.180.113.68:53244] [client 107.180.113.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.113.68, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVkC_ucFqdpu6TNsuWrUCgAAABg"]
[Sat Jan 03 20:28:32.570161 2026] [:error] [pid 31630:tid 31648] [client 103.82.21.169:46642] [client 103.82.21.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.82.21.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVkLcPUV_PU2SWgLPuhP4QAAAZA"]
[Sat Jan 03 20:34:47.453766 2026] [:error] [pid 31222:tid 31243] [client 45.227.162.235:56068] [client 45.227.162.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.227.162.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVkM56Hw6nASHXAc2v_NtAAAAdM"]
[Sat Jan 03 20:41:45.860690 2026] [:error] [pid 19639:tid 19665] [client 185.80.130.127:43628] [client 185.80.130.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.80.130.127, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVkOiSQ7fWZUytnlHEzzbQAAAVg"]
[Sat Jan 03 20:51:51.424990 2026] [:error] [pid 31222:tid 31235] [client 148.113.37.117:52590] [client 148.113.37.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.37.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVkQ56Hw6nASHXAc2v_U9gAAAcs"]
[Sat Jan 03 21:08:15.712107 2026] [:error] [pid 31630:tid 31644] [client 159.65.151.212:41358] [client 159.65.151.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.151.212, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVkUv_UV_PU2SWgLPuhZPAAAAYw"]
[Sat Jan 03 21:14:34.787264 2026] [:error] [pid 34260:tid 34277] [client 3.6.130.226:54722] [client 3.6.130.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.6.130.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVkWOkWWhyvZ0O9KNVQeJwAAAQ8"]
[Sat Jan 03 21:25:05.752217 2026] [:error] [pid 34260:tid 34277] [client 66.228.48.175:52564] [client 66.228.48.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.228.48.175, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVkYsUWWhyvZ0O9KNVQiGwAAAQ8"]
[Sat Jan 03 21:36:07.657670 2026] [:error] [pid 34260:tid 34274] [client 162.213.209.162:58026] [client 162.213.209.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.213.209.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVkbR0WWhyvZ0O9KNVQmRgAAAQw"]
[Sat Jan 03 22:11:34.101596 2026] [:error] [pid 31222:tid 31239] [client 198.199.69.209:37548] [client 198.199.69.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.199.69.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVkjlqHw6nASHXAc2v_xkwAAAc8"]
[Sat Jan 03 22:28:23.046365 2026] [:error] [pid 1931:tid 2048] [client 160.250.186.135:60436] [client 160.250.186.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.186.135, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVknhx8Tyw7ZoIdXlcYTgAAAAJg"]
[Sat Jan 03 22:36:18.950668 2026] [:error] [pid 1929:tid 1960] [client 41.193.5.58:50324] [client 41.193.5.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.193.5.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVkpYucFqdpu6TNsuWr9sQAAABY"]
[Sat Jan 03 23:02:23.339037 2026] [:error] [pid 34260:tid 34282] [client 98.70.127.32:19724] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-securitiy.php"] [unique_id "aVkvf0WWhyvZ0O9KNVQ3sQAAARQ"]
[Sat Jan 03 23:02:23.618296 2026] [:error] [pid 1929:tid 1952] [client 98.70.127.32:19802] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-securitiy.php"] [unique_id "aVkvf-cFqdpu6TNsuWoEvAAAAA4"]
[Sat Jan 03 23:02:23.944480 2026] [:error] [pid 31222:tid 31235] [client 98.70.127.32:19801] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-securitiy.php"] [unique_id "aVkvf6Hw6nASHXAc2v_7oAAAAcs"]
[Sat Jan 03 23:02:24.243097 2026] [:error] [pid 1929:tid 1962] [client 98.70.127.32:19726] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-securitiy.php"] [unique_id "aVkvgOcFqdpu6TNsuWoEvgAAABg"]
[Sat Jan 03 23:02:24.557942 2026] [:error] [pid 2083:tid 2102] [client 98.70.127.32:19818] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/o2.php"] [unique_id "aVkvgDVlR_BmlMPnhV4s2AAAANE"]
[Sat Jan 03 23:02:24.902611 2026] [:error] [pid 1930:tid 1989] [client 98.70.127.32:19785] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/o2.php"] [unique_id "aVkvgJP-6mqhfUDa89z22gAAAFc"]
[Sat Jan 03 23:02:25.228033 2026] [:error] [pid 31222:tid 31245] [client 98.70.127.32:19803] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/o2.php"] [unique_id "aVkvgaHw6nASHXAc2v_7ogAAAdU"]
[Sat Jan 03 23:02:25.580780 2026] [:error] [pid 31222:tid 31247] [client 98.70.127.32:19782] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/o2.php"] [unique_id "aVkvgaHw6nASHXAc2v_7owAAAdc"]
[Sat Jan 03 23:02:25.884513 2026] [:error] [pid 1930:tid 1979] [client 98.70.127.32:19723] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/KV7EGJmhHzX.php"] [unique_id "aVkvgZP-6mqhfUDa89z23AAAAE0"]
[Sat Jan 03 23:02:26.181118 2026] [:error] [pid 1931:tid 2041] [client 98.70.127.32:19744] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/KV7EGJmhHzX.php"] [unique_id "aVkvgh8Tyw7ZoIdXlcYeGQAAAJE"]
[Sat Jan 03 23:02:26.456052 2026] [:error] [pid 1931:tid 2037] [client 98.70.127.32:19730] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/KV7EGJmhHzX.php"] [unique_id "aVkvgh8Tyw7ZoIdXlcYeGgAAAI0"]
[Sat Jan 03 23:02:26.729449 2026] [:error] [pid 31222:tid 31225] [client 98.70.127.32:19829] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/KV7EGJmhHzX.php"] [unique_id "aVkvgqHw6nASHXAc2v_7pAAAAcE"]
[Sat Jan 03 23:02:27.002445 2026] [:error] [pid 1931:tid 2032] [client 98.70.127.32:19827] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-104.php"] [unique_id "aVkvgx8Tyw7ZoIdXlcYeHAAAAIg"]
[Sat Jan 03 23:02:27.297853 2026] [:error] [pid 31630:tid 31652] [client 98.70.127.32:19717] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-104.php"] [unique_id "aVkvg_UV_PU2SWgLPuhzlgAAAZQ"]
[Sat Jan 03 23:02:27.597663 2026] [:error] [pid 31630:tid 31632] [client 98.70.127.32:19792] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-104.php"] [unique_id "aVkvg_UV_PU2SWgLPuhzlwAAAYA"]
[Sat Jan 03 23:02:27.872706 2026] [:error] [pid 2083:tid 2103] [client 98.70.127.32:19788] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-104.php"] [unique_id "aVkvgzVlR_BmlMPnhV4s3AAAANI"]
[Sat Jan 03 23:02:28.167618 2026] [:error] [pid 1930:tid 1978] [client 98.70.127.32:19835] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yu.php"] [unique_id "aVkvhJP-6mqhfUDa89z23gAAAEw"]
[Sat Jan 03 23:02:28.458847 2026] [:error] [pid 1931:tid 1996] [client 98.70.127.32:19779] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yu.php"] [unique_id "aVkvhB8Tyw7ZoIdXlcYeHQAAAII"]
[Sat Jan 03 23:02:28.775887 2026] [:error] [pid 1930:tid 1967] [client 98.70.127.32:19806] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yu.php"] [unique_id "aVkvhJP-6mqhfUDa89z24QAAAEE"]
[Sat Jan 03 23:02:29.062563 2026] [:error] [pid 1931:tid 2027] [client 98.70.127.32:19816] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yu.php"] [unique_id "aVkvhR8Tyw7ZoIdXlcYeHwAAAIQ"]
[Sat Jan 03 23:02:29.357885 2026] [:error] [pid 31630:tid 31643] [client 98.70.127.32:19810] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aVkvhfUV_PU2SWgLPuhzmQAAAYs"]
[Sat Jan 03 23:02:29.652890 2026] [:error] [pid 19639:tid 19652] [client 98.70.127.32:19799] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aVkvhSQ7fWZUytnlHEwPQAAAAUs"]
[Sat Jan 03 23:02:29.962966 2026] [:error] [pid 1930:tid 1977] [client 98.70.127.32:19832] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aVkvhZP-6mqhfUDa89z24gAAAEs"]
[Sat Jan 03 23:02:30.262449 2026] [:error] [pid 19639:tid 19663] [client 98.70.127.32:19721] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aVkvhiQ7fWZUytnlHEwPQgAAAVY"]
[Sat Jan 03 23:02:30.625299 2026] [:error] [pid 1931:tid 2045] [client 98.70.127.32:19805] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d12.php"] [unique_id "aVkvhh8Tyw7ZoIdXlcYeIgAAAJU"]
[Sat Jan 03 23:02:30.939526 2026] [:error] [pid 1930:tid 1987] [client 98.70.127.32:19714] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d12.php"] [unique_id "aVkvhpP-6mqhfUDa89z25AAAAFU"]
[Sat Jan 03 23:02:31.226832 2026] [:error] [pid 1930:tid 1969] [client 98.70.127.32:19826] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d12.php"] [unique_id "aVkvh5P-6mqhfUDa89z25QAAAEM"]
[Sat Jan 03 23:02:31.522811 2026] [:error] [pid 1931:tid 2044] [client 98.70.127.32:19807] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d12.php"] [unique_id "aVkvhx8Tyw7ZoIdXlcYeJAAAAJQ"]
[Sat Jan 03 23:02:31.807911 2026] [:error] [pid 1930:tid 1980] [client 98.70.127.32:19781] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tesTyuj.php"] [unique_id "aVkvh5P-6mqhfUDa89z25wAAAE4"]
[Sat Jan 03 23:02:32.101413 2026] [:error] [pid 1930:tid 1971] [client 98.70.127.32:19734] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tesTyuj.php"] [unique_id "aVkviJP-6mqhfUDa89z26AAAAEU"]
[Sat Jan 03 23:02:32.395771 2026] [:error] [pid 1931:tid 2042] [client 98.70.127.32:19743] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tesTyuj.php"] [unique_id "aVkviB8Tyw7ZoIdXlcYeJgAAAJI"]
[Sat Jan 03 23:02:32.668901 2026] [:error] [pid 34260:tid 34274] [client 98.70.127.32:19740] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tesTyuj.php"] [unique_id "aVkviEWWhyvZ0O9KNVQ3tgAAAQw"]
[Sat Jan 03 23:02:32.989145 2026] [:error] [pid 1929:tid 1948] [client 98.70.127.32:14687] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tqloh.php"] [unique_id "aVkviOcFqdpu6TNsuWoExAAAAAo"]
[Sat Jan 03 23:02:33.261937 2026] [:error] [pid 1930:tid 1986] [client 98.70.127.32:19733] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tqloh.php"] [unique_id "aVkviZP-6mqhfUDa89z26gAAAFQ"]
[Sat Jan 03 23:02:33.554323 2026] [:error] [pid 31630:tid 31641] [client 98.70.127.32:19822] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tqloh.php"] [unique_id "aVkvifUV_PU2SWgLPuhznQAAAYk"]
[Sat Jan 03 23:02:33.835456 2026] [:error] [pid 31630:tid 31635] [client 98.70.127.32:19837] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tqloh.php"] [unique_id "aVkvifUV_PU2SWgLPuhzoQAAAYM"]
[Sat Jan 03 23:02:34.118411 2026] [:error] [pid 1931:tid 2037] [client 98.70.127.32:19789] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w3llstore.php"] [unique_id "aVkvih8Tyw7ZoIdXlcYeKgAAAI0"]
[Sat Jan 03 23:02:34.414464 2026] [:error] [pid 34260:tid 34285] [client 98.70.127.32:19817] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w3llstore.php"] [unique_id "aVkvikWWhyvZ0O9KNVQ3uAAAARc"]
[Sat Jan 03 23:02:34.708946 2026] [:error] [pid 31222:tid 31233] [client 98.70.127.32:19731] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w3llstore.php"] [unique_id "aVkviqHw6nASHXAc2v_7qgAAAck"]
[Sat Jan 03 23:02:34.990213 2026] [:error] [pid 1929:tid 1958] [client 98.70.127.32:19722] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w3llstore.php"] [unique_id "aVkviucFqdpu6TNsuWoExwAAABQ"]
[Sat Jan 03 23:02:35.279765 2026] [:error] [pid 31630:tid 31632] [client 98.70.127.32:19808] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ging.php"] [unique_id "aVkvi_UV_PU2SWgLPuhzpQAAAYA"]
[Sat Jan 03 23:02:35.558251 2026] [:error] [pid 19639:tid 19644] [client 98.70.127.32:19780] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ging.php"] [unique_id "aVkviyQ7fWZUytnlHEwPQwAAAUM"]
[Sat Jan 03 23:02:35.843397 2026] [:error] [pid 1931:tid 2030] [client 98.70.127.32:19811] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ging.php"] [unique_id "aVkvix8Tyw7ZoIdXlcYeKwAAAIY"]
[Sat Jan 03 23:02:36.123334 2026] [:error] [pid 31630:tid 31643] [client 98.70.127.32:19736] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ging.php"] [unique_id "aVkvjPUV_PU2SWgLPuhzpwAAAYs"]
[Sat Jan 03 23:02:36.414756 2026] [:error] [pid 1931:tid 2027] [client 98.70.127.32:14667] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fc72f.php"] [unique_id "aVkvjB8Tyw7ZoIdXlcYeLQAAAIQ"]
[Sat Jan 03 23:02:36.739476 2026] [:error] [pid 1931:tid 2031] [client 98.70.127.32:19746] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fc72f.php"] [unique_id "aVkvjB8Tyw7ZoIdXlcYeLwAAAIc"]
[Sat Jan 03 23:02:37.012764 2026] [:error] [pid 1929:tid 1946] [client 98.70.127.32:19790] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fc72f.php"] [unique_id "aVkvjecFqdpu6TNsuWoEyQAAAAg"]
[Sat Jan 03 23:02:37.382693 2026] [:error] [pid 1929:tid 1942] [client 98.70.127.32:19716] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fc72f.php"] [unique_id "aVkvjecFqdpu6TNsuWoEygAAAAQ"]
[Sat Jan 03 23:02:37.707120 2026] [:error] [pid 1930:tid 1989] [client 98.70.127.32:19830] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tt.php"] [unique_id "aVkvjZP-6mqhfUDa89z27AAAAFc"]
[Sat Jan 03 23:02:38.024898 2026] [:error] [pid 1929:tid 1939] [client 98.70.127.32:19735] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tt.php"] [unique_id "aVkvjucFqdpu6TNsuWoEzQAAAAE"]
[Sat Jan 03 23:02:38.299967 2026] [:error] [pid 1929:tid 1952] [client 98.70.127.32:14656] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tt.php"] [unique_id "aVkvjucFqdpu6TNsuWoEzwAAAA4"]
[Sat Jan 03 23:02:38.628235 2026] [:error] [pid 1931:tid 2045] [client 98.70.127.32:14693] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tt.php"] [unique_id "aVkvjh8Tyw7ZoIdXlcYeMgAAAJU"]
[Sat Jan 03 23:02:38.903649 2026] [:error] [pid 1931:tid 2044] [client 98.70.127.32:14657] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aVkvjh8Tyw7ZoIdXlcYeNAAAAJQ"]
[Sat Jan 03 23:02:39.229795 2026] [:error] [pid 1929:tid 1960] [client 98.70.127.32:19770] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aVkvj-cFqdpu6TNsuWoE0gAAABY"]
[Sat Jan 03 23:02:39.525583 2026] [:error] [pid 1930:tid 1975] [client 98.70.127.32:19798] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aVkvj5P-6mqhfUDa89z27QAAAEk"]
[Sat Jan 03 23:02:39.832340 2026] [:error] [pid 1931:tid 2040] [client 98.70.127.32:14669] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aVkvjx8Tyw7ZoIdXlcYeOAAAAJA"]
[Sat Jan 03 23:02:40.118471 2026] [:error] [pid 31222:tid 31232] [client 98.70.127.32:19789] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s12.php"] [unique_id "aVkvkKHw6nASHXAc2v_7rAAAAcg"]
[Sat Jan 03 23:02:40.405124 2026] [:error] [pid 1931:tid 2041] [client 98.70.127.32:14706] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s12.php"] [unique_id "aVkvkB8Tyw7ZoIdXlcYeOwAAAJE"]
[Sat Jan 03 23:02:40.714017 2026] [:error] [pid 31630:tid 31655] [client 98.70.127.32:14635] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s12.php"] [unique_id "aVkvkPUV_PU2SWgLPuhzqQAAAZc"]
[Sat Jan 03 23:02:41.013488 2026] [:error] [pid 31630:tid 31645] [client 98.70.127.32:14699] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s12.php"] [unique_id "aVkvkfUV_PU2SWgLPuhzqgAAAY0"]
[Sat Jan 03 23:02:41.321887 2026] [:error] [pid 34260:tid 34266] [client 98.70.127.32:19770] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/55b76.php"] [unique_id "aVkvkUWWhyvZ0O9KNVQ3uwAAAQQ"]
[Sat Jan 03 23:02:41.597893 2026] [:error] [pid 34260:tid 34276] [client 98.70.127.32:19812] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/55b76.php"] [unique_id "aVkvkUWWhyvZ0O9KNVQ3vAAAAQ4"]
[Sat Jan 03 23:02:41.957181 2026] [:error] [pid 31222:tid 31227] [client 98.70.127.32:14684] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/55b76.php"] [unique_id "aVkvkaHw6nASHXAc2v_7rQAAAcM"]
[Sat Jan 03 23:02:42.258797 2026] [:error] [pid 19639:tid 19643] [client 98.70.127.32:19766] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/55b76.php"] [unique_id "aVkvkiQ7fWZUytnlHEwPRQAAAUI"]
[Sat Jan 03 23:02:42.542459 2026] [:error] [pid 31222:tid 31240] [client 98.70.127.32:19786] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lm18.php"] [unique_id "aVkvkqHw6nASHXAc2v_7rgAAAdA"]
[Sat Jan 03 23:02:42.849085 2026] [:error] [pid 31630:tid 31642] [client 98.70.127.32:14659] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lm18.php"] [unique_id "aVkvkvUV_PU2SWgLPuhzrgAAAYo"]
[Sat Jan 03 23:02:43.134160 2026] [:error] [pid 31630:tid 31646] [client 98.70.127.32:14660] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lm18.php"] [unique_id "aVkvk_UV_PU2SWgLPuhzsAAAAY4"]
[Sat Jan 03 23:02:43.470074 2026] [:error] [pid 19639:tid 19662] [client 98.70.127.32:19791] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lm18.php"] [unique_id "aVkvkyQ7fWZUytnlHEwPRwAAAVU"]
[Sat Jan 03 23:02:43.764866 2026] [:error] [pid 34260:tid 34267] [client 98.70.127.32:19764] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aVkvk0WWhyvZ0O9KNVQ3vgAAAQU"]
[Sat Jan 03 23:02:44.068933 2026] [:error] [pid 1931:tid 2048] [client 98.70.127.32:19809] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aVkvlB8Tyw7ZoIdXlcYeQAAAAJg"]
[Sat Jan 03 23:02:44.432612 2026] [:error] [pid 19639:tid 19661] [client 98.70.127.32:19741] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aVkvlCQ7fWZUytnlHEwPSQAAAVQ"]
[Sat Jan 03 23:02:44.727680 2026] [:error] [pid 1929:tid 1945] [client 98.70.127.32:19794] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aVkvlOcFqdpu6TNsuWoE1wAAAAc"]
[Sat Jan 03 23:02:45.002297 2026] [:error] [pid 1929:tid 1957] [client 98.70.127.32:19739] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVkvlecFqdpu6TNsuWoE2AAAABM"]
[Sat Jan 03 23:02:45.326364 2026] [:error] [pid 1931:tid 1993] [client 98.70.127.32:19759] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVkvlR8Tyw7ZoIdXlcYeQwAAAIA"]
[Sat Jan 03 23:02:45.689738 2026] [:error] [pid 31630:tid 31636] [client 98.70.127.32:19825] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVkvlfUV_PU2SWgLPuhztQAAAYQ"]
[Sat Jan 03 23:02:46.013390 2026] [:error] [pid 31630:tid 31643] [client 98.70.127.32:19769] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVkvlvUV_PU2SWgLPuhztgAAAYs"]
[Sat Jan 03 23:02:46.352467 2026] [:error] [pid 34260:tid 34282] [client 98.70.127.32:19783] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rzki.php"] [unique_id "aVkvlkWWhyvZ0O9KNVQ3wgAAARQ"]
[Sat Jan 03 23:02:46.709592 2026] [:error] [pid 34260:tid 34283] [client 98.70.127.32:19727] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rzki.php"] [unique_id "aVkvlkWWhyvZ0O9KNVQ3wwAAARU"]
[Sat Jan 03 23:02:46.994869 2026] [:error] [pid 34260:tid 34280] [client 98.70.127.32:19719] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rzki.php"] [unique_id "aVkvlkWWhyvZ0O9KNVQ3xAAAARI"]
[Sat Jan 03 23:02:47.310410 2026] [:error] [pid 2083:tid 2101] [client 98.70.127.32:19823] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rzki.php"] [unique_id "aVkvlzVlR_BmlMPnhV4s4wAAANA"]
[Sat Jan 03 23:02:47.624326 2026] [:error] [pid 1931:tid 2043] [client 98.70.127.32:19728] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asa.php"] [unique_id "aVkvlx8Tyw7ZoIdXlcYeRAAAAJM"]
[Sat Jan 03 23:02:47.927727 2026] [:error] [pid 34260:tid 34284] [client 98.70.127.32:14683] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asa.php"] [unique_id "aVkvl0WWhyvZ0O9KNVQ3xgAAARY"]
[Sat Jan 03 23:02:48.277514 2026] [:error] [pid 34260:tid 34269] [client 98.70.127.32:19839] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asa.php"] [unique_id "aVkvmEWWhyvZ0O9KNVQ3xwAAAQc"]
[Sat Jan 03 23:02:48.583473 2026] [:error] [pid 34260:tid 34274] [client 98.70.127.32:19793] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asa.php"] [unique_id "aVkvmEWWhyvZ0O9KNVQ3yAAAAQw"]
[Sat Jan 03 23:02:48.868464 2026] [:error] [pid 1930:tid 1990] [client 98.70.127.32:14682] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/l3gi0n.php"] [unique_id "aVkvmJP-6mqhfUDa89z28AAAAFg"]
[Sat Jan 03 23:02:49.161160 2026] [:error] [pid 34260:tid 34278] [client 98.70.127.32:19833] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/l3gi0n.php"] [unique_id "aVkvmUWWhyvZ0O9KNVQ3yQAAARA"]
[Sat Jan 03 23:02:49.469080 2026] [:error] [pid 31222:tid 31246] [client 98.70.127.32:19813] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/l3gi0n.php"] [unique_id "aVkvmaHw6nASHXAc2v_7sAAAAdY"]
[Sat Jan 03 23:02:49.782313 2026] [:error] [pid 1930:tid 1966] [client 98.70.127.32:19783] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/l3gi0n.php"] [unique_id "aVkvmZP-6mqhfUDa89z28QAAAEA"]
[Sat Jan 03 23:02:50.057594 2026] [:error] [pid 34260:tid 34285] [client 98.70.127.32:19773] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bbn.php"] [unique_id "aVkvmkWWhyvZ0O9KNVQ3ygAAARc"]
[Sat Jan 03 23:02:50.376103 2026] [:error] [pid 31630:tid 31639] [client 98.70.127.32:14694] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bbn.php"] [unique_id "aVkvmvUV_PU2SWgLPuhzuAAAAYc"]
[Sat Jan 03 23:02:50.659163 2026] [:error] [pid 1931:tid 2033] [client 98.70.127.32:14697] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bbn.php"] [unique_id "aVkvmh8Tyw7ZoIdXlcYeRQAAAIk"]
[Sat Jan 03 23:02:50.953854 2026] [:error] [pid 1931:tid 2042] [client 98.70.127.32:19775] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bbn.php"] [unique_id "aVkvmh8Tyw7ZoIdXlcYeRgAAAJI"]
[Sat Jan 03 23:02:51.238496 2026] [:error] [pid 1931:tid 2040] [client 98.70.127.32:14666] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccea.php"] [unique_id "aVkvmx8Tyw7ZoIdXlcYeSAAAAJA"]
[Sat Jan 03 23:02:51.579462 2026] [:error] [pid 31630:tid 31641] [client 98.70.127.32:19737] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccea.php"] [unique_id "aVkvm_UV_PU2SWgLPuhzugAAAYk"]
[Sat Jan 03 23:02:51.894638 2026] [:error] [pid 31630:tid 31655] [client 98.70.127.32:19828] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccea.php"] [unique_id "aVkvm_UV_PU2SWgLPuhzuwAAAZc"]
[Sat Jan 03 23:02:52.220316 2026] [:error] [pid 1930:tid 1974] [client 98.70.127.32:19796] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccea.php"] [unique_id "aVkvnJP-6mqhfUDa89z28wAAAEg"]
[Sat Jan 03 23:02:52.571771 2026] [:error] [pid 19639:tid 19663] [client 98.70.127.32:19797] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-title.php"] [unique_id "aVkvnCQ7fWZUytnlHEwPUwAAAVY"]
[Sat Jan 03 23:02:52.845247 2026] [:error] [pid 31222:tid 31248] [client 98.70.127.32:14701] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-title.php"] [unique_id "aVkvnKHw6nASHXAc2v_7sQAAAdg"]
[Sat Jan 03 23:02:53.138719 2026] [:error] [pid 1931:tid 1994] [client 98.70.127.32:14718] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-title.php"] [unique_id "aVkvnR8Tyw7ZoIdXlcYeSwAAAIE"]
[Sat Jan 03 23:02:53.468275 2026] [:error] [pid 1931:tid 2032] [client 98.70.127.32:19763] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-title.php"] [unique_id "aVkvnR8Tyw7ZoIdXlcYeTgAAAIg"]
[Sat Jan 03 23:02:53.783299 2026] [:error] [pid 1929:tid 1946] [client 98.70.127.32:19787] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-729.php"] [unique_id "aVkvnecFqdpu6TNsuWoE3QAAAAg"]
[Sat Jan 03 23:02:54.056040 2026] [:error] [pid 1929:tid 1942] [client 98.70.127.32:19756] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-729.php"] [unique_id "aVkvnucFqdpu6TNsuWoE3gAAAAQ"]
[Sat Jan 03 23:02:54.346341 2026] [:error] [pid 1931:tid 2031] [client 98.70.127.32:19718] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-729.php"] [unique_id "aVkvnh8Tyw7ZoIdXlcYeUAAAAIc"]
[Sat Jan 03 23:02:54.621059 2026] [:error] [pid 1931:tid 2048] [client 98.70.127.32:19772] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-729.php"] [unique_id "aVkvnh8Tyw7ZoIdXlcYeUQAAAJg"]
[Sat Jan 03 23:02:54.919476 2026] [:error] [pid 1931:tid 2029] [client 98.70.127.32:14695] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ssxsl.php"] [unique_id "aVkvnh8Tyw7ZoIdXlcYeVQAAAIU"]
[Sat Jan 03 23:02:55.232490 2026] [:error] [pid 1931:tid 2034] [client 98.70.127.32:19751] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ssxsl.php"] [unique_id "aVkvnx8Tyw7ZoIdXlcYeVgAAAIo"]
[Sat Jan 03 23:02:55.519741 2026] [:error] [pid 1931:tid 2043] [client 98.70.127.32:14597] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ssxsl.php"] [unique_id "aVkvnx8Tyw7ZoIdXlcYeVwAAAJM"]
[Sat Jan 03 23:02:55.807019 2026] [:error] [pid 2083:tid 2092] [client 98.70.127.32:14658] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ssxsl.php"] [unique_id "aVkvnzVlR_BmlMPnhV4s6AAAAMc"]
[Sat Jan 03 23:02:56.099276 2026] [:error] [pid 1930:tid 1969] [client 98.70.127.32:14716] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/co.php"] [unique_id "aVkvoJP-6mqhfUDa89z29gAAAEM"]
[Sat Jan 03 23:02:56.372177 2026] [:error] [pid 1930:tid 1976] [client 98.70.127.32:14677] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/co.php"] [unique_id "aVkvoJP-6mqhfUDa89z29wAAAEo"]
[Sat Jan 03 23:02:56.724752 2026] [:error] [pid 1929:tid 1952] [client 98.70.127.32:19834] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/co.php"] [unique_id "aVkvoOcFqdpu6TNsuWoE4QAAAA4"]
[Sat Jan 03 23:02:57.006337 2026] [:error] [pid 19639:tid 19657] [client 98.70.127.32:14663] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/co.php"] [unique_id "aVkvoSQ7fWZUytnlHEwPVwAAAVA"]
[Sat Jan 03 23:02:57.279673 2026] [:error] [pid 1929:tid 1947] [client 98.70.127.32:19824] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sikma.php"] [unique_id "aVkvoecFqdpu6TNsuWoE4gAAAAk"]
[Sat Jan 03 23:02:57.598274 2026] [:error] [pid 2083:tid 2108] [client 98.70.127.32:19732] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sikma.php"] [unique_id "aVkvoTVlR_BmlMPnhV4s6QAAANc"]
[Sat Jan 03 23:02:57.919881 2026] [:error] [pid 2083:tid 2100] [client 98.70.127.32:19815] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sikma.php"] [unique_id "aVkvoTVlR_BmlMPnhV4s6gAAAM8"]
[Sat Jan 03 23:02:58.200112 2026] [:error] [pid 1931:tid 2035] [client 98.70.127.32:14596] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sikma.php"] [unique_id "aVkvoh8Tyw7ZoIdXlcYeWQAAAIs"]
[Sat Jan 03 23:02:58.484030 2026] [:error] [pid 2083:tid 2107] [client 98.70.127.32:19819] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "aVkvojVlR_BmlMPnhV4s6wAAANY"]
[Sat Jan 03 23:02:58.834535 2026] [:error] [pid 2083:tid 2105] [client 98.70.127.32:14675] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "aVkvojVlR_BmlMPnhV4s7AAAANQ"]
[Sat Jan 03 23:02:59.135151 2026] [:error] [pid 1930:tid 1971] [client 98.70.127.32:14690] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "aVkvo5P-6mqhfUDa89z2-QAAAEU"]
[Sat Jan 03 23:02:59.434486 2026] [:error] [pid 2083:tid 2099] [client 98.70.127.32:19715] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "aVkvozVlR_BmlMPnhV4s7gAAAM4"]
[Sat Jan 03 23:02:59.726564 2026] [:error] [pid 2083:tid 2088] [client 98.70.127.32:19767] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pwyjwrfr.php"] [unique_id "aVkvozVlR_BmlMPnhV4s8AAAAMM"]
[Sat Jan 03 23:03:00.021852 2026] [:error] [pid 31222:tid 31247] [client 98.70.127.32:19725] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pwyjwrfr.php"] [unique_id "aVkvpKHw6nASHXAc2v_7tAAAAdc"]
[Sat Jan 03 23:03:00.327226 2026] [:error] [pid 1930:tid 1970] [client 98.70.127.32:19758] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pwyjwrfr.php"] [unique_id "aVkvpJP-6mqhfUDa89z2_AAAAEQ"]
[Sat Jan 03 23:03:00.602130 2026] [:error] [pid 2083:tid 2097] [client 98.70.127.32:14637] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pwyjwrfr.php"] [unique_id "aVkvpDVlR_BmlMPnhV4s8QAAAMw"]
[Sat Jan 03 23:03:00.884410 2026] [:error] [pid 31630:tid 31634] [client 98.70.127.32:14604] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clss.php"] [unique_id "aVkvpPUV_PU2SWgLPuhzygAAAYI"]
[Sat Jan 03 23:03:01.157522 2026] [:error] [pid 2083:tid 2094] [client 98.70.127.32:14712] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clss.php"] [unique_id "aVkvpTVlR_BmlMPnhV4s8wAAAMk"]
[Sat Jan 03 23:03:01.433992 2026] [:error] [pid 34260:tid 34272] [client 98.70.127.32:14614] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clss.php"] [unique_id "aVkvpUWWhyvZ0O9KNVQ30gAAAQo"]
[Sat Jan 03 23:03:01.738043 2026] [:error] [pid 31630:tid 31639] [client 98.70.127.32:19713] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clss.php"] [unique_id "aVkvpfUV_PU2SWgLPuhzzgAAAYc"]
[Sat Jan 03 23:03:02.011881 2026] [:error] [pid 2083:tid 2096] [client 98.70.127.32:19820] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aVkvpjVlR_BmlMPnhV4s9QAAAMs"]
[Sat Jan 03 23:03:02.284388 2026] [:error] [pid 2083:tid 2093] [client 98.70.127.32:14719] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aVkvpjVlR_BmlMPnhV4s9gAAAMg"]
[Sat Jan 03 23:03:02.568245 2026] [:error] [pid 31630:tid 31653] [client 98.70.127.32:14650] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aVkvpvUV_PU2SWgLPuhzzwAAAZU"]
[Sat Jan 03 23:03:02.866084 2026] [:error] [pid 1930:tid 1975] [client 98.70.127.32:14662] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aVkvppP-6mqhfUDa89z2_gAAAEk"]
[Sat Jan 03 23:03:03.226396 2026] [:error] [pid 1930:tid 1972] [client 98.70.127.32:14674] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atex1.php"] [unique_id "aVkvp5P-6mqhfUDa89z3AwAAAEY"]
[Sat Jan 03 23:03:03.532241 2026] [:error] [pid 19639:tid 19660] [client 98.70.127.32:19814] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atex1.php"] [unique_id "aVkvpyQ7fWZUytnlHEwPXgAAAVM"]
[Sat Jan 03 23:03:03.844356 2026] [:error] [pid 19639:tid 19649] [client 98.70.127.32:19795] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atex1.php"] [unique_id "aVkvpyQ7fWZUytnlHEwPXwAAAUg"]
[Sat Jan 03 23:03:04.124979 2026] [:error] [pid 31222:tid 31242] [client 98.70.127.32:19771] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atex1.php"] [unique_id "aVkvqKHw6nASHXAc2v_7uwAAAdI"]
[Sat Jan 03 23:03:04.411744 2026] [:error] [pid 1931:tid 2039] [client 98.70.127.32:19753] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenium4x.php"] [unique_id "aVkvqB8Tyw7ZoIdXlcYeXAAAAI8"]
[Sat Jan 03 23:03:04.695094 2026] [:error] [pid 31222:tid 31238] [client 98.70.127.32:14691] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenium4x.php"] [unique_id "aVkvqKHw6nASHXAc2v_7vAAAAc4"]
[Sat Jan 03 23:03:04.994639 2026] [:error] [pid 19639:tid 19655] [client 98.70.127.32:19748] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenium4x.php"] [unique_id "aVkvqCQ7fWZUytnlHEwPYAAAAU4"]
[Sat Jan 03 23:03:05.295017 2026] [:error] [pid 1930:tid 1966] [client 98.70.127.32:19747] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenium4x.php"] [unique_id "aVkvqZP-6mqhfUDa89z3BgAAAEA"]
[Sat Jan 03 23:03:05.603913 2026] [:error] [pid 19639:tid 19652] [client 98.70.127.32:14714] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6kDPjgFTmvS.php"] [unique_id "aVkvqSQ7fWZUytnlHEwPYwAAAUs"]
[Sat Jan 03 23:03:05.902991 2026] [:error] [pid 2083:tid 2090] [client 98.70.127.32:19757] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6kDPjgFTmvS.php"] [unique_id "aVkvqTVlR_BmlMPnhV4s-wAAAMU"]
[Sat Jan 03 23:03:06.204699 2026] [:error] [pid 34260:tid 34284] [client 98.70.127.32:19734] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6kDPjgFTmvS.php"] [unique_id "aVkvqkWWhyvZ0O9KNVQ32wAAARY"]
[Sat Jan 03 23:03:06.506224 2026] [:error] [pid 19639:tid 19648] [client 98.70.127.32:14673] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6kDPjgFTmvS.php"] [unique_id "aVkvqiQ7fWZUytnlHEwPZQAAAUc"]
[Sat Jan 03 23:03:06.879069 2026] [:error] [pid 34260:tid 34269] [client 98.70.127.32:14717] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xopvne.php"] [unique_id "aVkvqkWWhyvZ0O9KNVQ33AAAAQc"]
[Sat Jan 03 23:03:07.244457 2026] [:error] [pid 1930:tid 1967] [client 98.70.127.32:14551] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xopvne.php"] [unique_id "aVkvq5P-6mqhfUDa89z3BwAAAEE"]
[Sat Jan 03 23:03:07.533592 2026] [:error] [pid 31222:tid 31241] [client 98.70.127.32:19745] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xopvne.php"] [unique_id "aVkvq6Hw6nASHXAc2v_7wAAAAdE"]
[Sat Jan 03 23:03:07.823583 2026] [:error] [pid 34260:tid 34274] [client 98.70.127.32:14664] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xopvne.php"] [unique_id "aVkvq0WWhyvZ0O9KNVQ33QAAAQw"]
[Sat Jan 03 23:03:08.127480 2026] [:error] [pid 31222:tid 31240] [client 98.70.127.32:14696] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "aVkvrKHw6nASHXAc2v_7wQAAAdA"]
[Sat Jan 03 23:03:08.424537 2026] [:error] [pid 1930:tid 1974] [client 98.70.127.32:19712] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "aVkvrJP-6mqhfUDa89z3CAAAAEg"]
[Sat Jan 03 23:03:08.733622 2026] [:error] [pid 2083:tid 2108] [client 98.70.127.32:14698] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "aVkvrDVlR_BmlMPnhV4s_wAAANc"]
[Sat Jan 03 23:03:09.056821 2026] [:error] [pid 1931:tid 2031] [client 98.70.127.32:19750] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "aVkvrR8Tyw7ZoIdXlcYeZAAAAIc"]
[Sat Jan 03 23:03:09.334531 2026] [:error] [pid 1929:tid 1946] [client 98.70.127.32:19800] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file5.php"] [unique_id "aVkvrecFqdpu6TNsuWoE8wAAAAg"]
[Sat Jan 03 23:03:09.627016 2026] [:error] [pid 31222:tid 31231] [client 98.70.127.32:14668] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file5.php"] [unique_id "aVkvraHw6nASHXAc2v_7wwAAAcc"]
[Sat Jan 03 23:03:09.911921 2026] [:error] [pid 1931:tid 1999] [client 98.70.127.32:14616] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file5.php"] [unique_id "aVkvrR8Tyw7ZoIdXlcYeZgAAAIM"]
[Sat Jan 03 23:03:10.185233 2026] [:error] [pid 2083:tid 2099] [client 98.70.127.32:19762] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file5.php"] [unique_id "aVkvrjVlR_BmlMPnhV4tAgAAAM4"]
[Sat Jan 03 23:03:10.473459 2026] [:error] [pid 1931:tid 2033] [client 98.70.127.32:14705] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aVkvrh8Tyw7ZoIdXlcYebAAAAIk"]
[Sat Jan 03 23:03:10.761001 2026] [:error] [pid 1931:tid 2039] [client 98.70.127.32:14649] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aVkvrh8Tyw7ZoIdXlcYebwAAAI8"]
[Sat Jan 03 23:03:11.085668 2026] [:error] [pid 19639:tid 19644] [client 98.70.127.32:14613] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aVkvryQ7fWZUytnlHEwPZwAAAUM"]
[Sat Jan 03 23:03:11.358359 2026] [:error] [pid 1931:tid 1994] [client 98.70.127.32:14593] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aVkvrx8Tyw7ZoIdXlcYecQAAAIE"]
[Sat Jan 03 23:03:11.663878 2026] [:error] [pid 1929:tid 1955] [client 98.70.127.32:19776] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kao.php"] [unique_id "aVkvr-cFqdpu6TNsuWoE9QAAABE"]
[Sat Jan 03 23:03:11.942914 2026] [:error] [pid 2083:tid 2103] [client 98.70.127.32:19765] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kao.php"] [unique_id "aVkvrzVlR_BmlMPnhV4tBgAAANI"]
[Sat Jan 03 23:03:12.235707 2026] [:error] [pid 1929:tid 1952] [client 98.70.127.32:19755] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kao.php"] [unique_id "aVkvsOcFqdpu6TNsuWoE-AAAAA4"]
[Sat Jan 03 23:03:12.575639 2026] [:error] [pid 31630:tid 31646] [client 98.70.127.32:14611] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kao.php"] [unique_id "aVkvsPUV_PU2SWgLPuhz1wAAAY4"]
[Sat Jan 03 23:03:12.860577 2026] [:error] [pid 1930:tid 1977] [client 98.70.127.32:19761] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aVkvsJP-6mqhfUDa89z3CgAAAEs"]
[Sat Jan 03 23:03:13.167088 2026] [:error] [pid 19639:tid 19658] [client 98.70.127.32:14661] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aVkvsSQ7fWZUytnlHEwPaQAAAVE"]
[Sat Jan 03 23:03:13.441821 2026] [:error] [pid 1929:tid 1950] [client 98.70.127.32:14602] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aVkvsecFqdpu6TNsuWoE-QAAAAw"]
[Sat Jan 03 23:03:13.721807 2026] [:error] [pid 34260:tid 34272] [client 98.70.127.32:19831] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aVkvsUWWhyvZ0O9KNVQ35wAAAQo"]
[Sat Jan 03 23:03:14.006337 2026] [:error] [pid 34260:tid 34263] [client 98.70.127.32:14626] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vanda.php"] [unique_id "aVkvskWWhyvZ0O9KNVQ36AAAAQE"]
[Sat Jan 03 23:03:14.284680 2026] [:error] [pid 19639:tid 19657] [client 98.70.127.32:19804] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vanda.php"] [unique_id "aVkvsiQ7fWZUytnlHEwPawAAAVA"]
[Sat Jan 03 23:03:14.560426 2026] [:error] [pid 2083:tid 2098] [client 98.70.127.32:14643] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vanda.php"] [unique_id "aVkvsjVlR_BmlMPnhV4tCAAAAM0"]
[Sat Jan 03 23:03:14.834120 2026] [:error] [pid 31630:tid 31651] [client 98.70.127.32:14707] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vanda.php"] [unique_id "aVkvsvUV_PU2SWgLPuhz2QAAAZM"]
[Sat Jan 03 23:03:15.117039 2026] [:error] [pid 31630:tid 31644] [client 98.70.127.32:14594] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ac.php"] [unique_id "aVkvs_UV_PU2SWgLPuhz2gAAAYw"]
[Sat Jan 03 23:03:15.411901 2026] [:error] [pid 19639:tid 19642] [client 98.70.127.32:14618] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ac.php"] [unique_id "aVkvsyQ7fWZUytnlHEwPcAAAAUE"]
[Sat Jan 03 23:03:15.692228 2026] [:error] [pid 31630:tid 31632] [client 98.70.127.32:14703] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ac.php"] [unique_id "aVkvs_UV_PU2SWgLPuhz2wAAAYA"]
[Sat Jan 03 23:03:15.985344 2026] [:error] [pid 1929:tid 1940] [client 98.70.127.32:14686] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ac.php"] [unique_id "aVkvs-cFqdpu6TNsuWoE_wAAAAI"]
[Sat Jan 03 23:03:16.274381 2026] [:error] [pid 34260:tid 34280] [client 98.70.127.32:14642] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test1.php"] [unique_id "aVkvtEWWhyvZ0O9KNVQ37QAAARI"]
[Sat Jan 03 23:03:16.559194 2026] [:error] [pid 1931:tid 1993] [client 98.70.127.32:14632] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test1.php"] [unique_id "aVkvtB8Tyw7ZoIdXlcYedwAAAIA"]
[Sat Jan 03 23:03:16.863286 2026] [:error] [pid 34260:tid 34275] [client 98.70.127.32:14640] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test1.php"] [unique_id "aVkvtEWWhyvZ0O9KNVQ37wAAAQ0"]
[Sat Jan 03 23:03:17.177659 2026] [:error] [pid 1931:tid 1999] [client 98.70.127.32:19754] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test1.php"] [unique_id "aVkvtR8Tyw7ZoIdXlcYeeAAAAIM"]
[Sat Jan 03 23:03:17.494315 2026] [:error] [pid 1931:tid 2043] [client 98.70.127.32:14619] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jjrpo.php"] [unique_id "aVkvtR8Tyw7ZoIdXlcYeegAAAJM"]
[Sat Jan 03 23:03:18.250156 2026] [:error] [pid 1930:tid 1984] [client 98.70.127.32:19738] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jjrpo.php"] [unique_id "aVkvtpP-6mqhfUDa89z3DwAAAFI"]
[Sat Jan 03 23:03:18.529991 2026] [:error] [pid 1930:tid 1986] [client 98.70.127.32:14553] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jjrpo.php"] [unique_id "aVkvtpP-6mqhfUDa89z3EAAAAFQ"]
[Sat Jan 03 23:03:18.875480 2026] [:error] [pid 31630:tid 31634] [client 98.70.127.32:14542] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jjrpo.php"] [unique_id "aVkvtvUV_PU2SWgLPuhz3wAAAYI"]
[Sat Jan 03 23:03:19.165106 2026] [:error] [pid 1930:tid 1970] [client 98.70.127.32:14641] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aVkvt5P-6mqhfUDa89z3EgAAAEQ"]
[Sat Jan 03 23:03:19.444351 2026] [:error] [pid 1929:tid 1941] [client 98.70.127.32:14528] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aVkvt-cFqdpu6TNsuWoFBQAAAAM"]
[Sat Jan 03 23:03:19.719748 2026] [:error] [pid 1931:tid 2040] [client 98.70.127.32:14681] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aVkvtx8Tyw7ZoIdXlcYefgAAAJA"]
[Sat Jan 03 23:03:20.049296 2026] [:error] [pid 31630:tid 31639] [client 98.70.127.32:14680] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aVkvuPUV_PU2SWgLPuhz4wAAAYc"]
[Sat Jan 03 23:03:20.346877 2026] [:error] [pid 1929:tid 1961] [client 98.70.127.32:14665] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin-header.php"] [unique_id "aVkvuOcFqdpu6TNsuWoFBwAAABc"]
[Sat Jan 03 23:03:20.622051 2026] [:error] [pid 31630:tid 31645] [client 98.70.127.32:14689] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin-header.php"] [unique_id "aVkvuPUV_PU2SWgLPuhz5wAAAY0"]
[Sat Jan 03 23:03:20.893499 2026] [:error] [pid 31630:tid 31654] [client 98.70.127.32:14672] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin-header.php"] [unique_id "aVkvuPUV_PU2SWgLPuhz6QAAAZY"]
[Sat Jan 03 23:03:21.180095 2026] [:error] [pid 1931:tid 2038] [client 98.70.127.32:19784] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin-header.php"] [unique_id "aVkvuR8Tyw7ZoIdXlcYegAAAAI4"]
[Sat Jan 03 23:03:21.453126 2026] [:error] [pid 34260:tid 34274] [client 98.70.127.32:14552] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-64wscx6shd.php"] [unique_id "aVkvuUWWhyvZ0O9KNVQ38gAAAQw"]
[Sat Jan 03 23:03:21.745429 2026] [:error] [pid 34260:tid 34286] [client 98.70.127.32:14671] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-64wscx6shd.php"] [unique_id "aVkvuUWWhyvZ0O9KNVQ39gAAARg"]
[Sat Jan 03 23:03:32.702056 2026] [:error] [pid 34260:tid 34268] [client 98.70.127.32:14541] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ce.php"] [unique_id "aVkvxEWWhyvZ0O9KNVQ4DAAAAQY"]
[Sat Jan 03 23:03:33.119831 2026] [:error] [pid 1931:tid 1994] [client 98.70.127.32:14607] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ce.php"] [unique_id "aVkvxR8Tyw7ZoIdXlcYelgAAAIE"]
[Sat Jan 03 23:03:33.414385 2026] [:error] [pid 1929:tid 1953] [client 98.70.127.32:14599] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ce.php"] [unique_id "aVkvxecFqdpu6TNsuWoFEgAAAA8"]
[Sat Jan 03 23:03:33.736106 2026] [:error] [pid 1930:tid 1977] [client 98.70.127.32:19821] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ce.php"] [unique_id "aVkvxZP-6mqhfUDa89z3HQAAAEs"]
[Sat Jan 03 23:03:34.039818 2026] [:error] [pid 31222:tid 31248] [client 98.70.127.32:14630] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pNRzcP6wtYy.php"] [unique_id "aVkvxqHw6nASHXAc2v_72AAAAdg"]
[Sat Jan 03 23:03:34.345184 2026] [:error] [pid 1931:tid 2031] [client 98.70.127.32:14536] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pNRzcP6wtYy.php"] [unique_id "aVkvxh8Tyw7ZoIdXlcYemgAAAIc"]
[Sat Jan 03 23:03:34.635712 2026] [:error] [pid 19639:tid 19663] [client 98.70.127.32:14629] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pNRzcP6wtYy.php"] [unique_id "aVkvxiQ7fWZUytnlHEwPeQAAAVY"]
[Sat Jan 03 23:03:34.913349 2026] [:error] [pid 1931:tid 1993] [client 98.70.127.32:14679] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pNRzcP6wtYy.php"] [unique_id "aVkvxh8Tyw7ZoIdXlcYenAAAAIA"]
[Sat Jan 03 23:03:35.201551 2026] [:error] [pid 34260:tid 34265] [client 98.70.127.32:14655] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd.php"] [unique_id "aVkvx0WWhyvZ0O9KNVQ4EgAAAQM"]
[Sat Jan 03 23:03:35.531544 2026] [:error] [pid 1931:tid 2044] [client 98.70.127.32:14531] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd.php"] [unique_id "aVkvxx8Tyw7ZoIdXlcYenwAAAJQ"]
[Sat Jan 03 23:03:35.853308 2026] [:error] [pid 1931:tid 2035] [client 98.70.127.32:14708] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd.php"] [unique_id "aVkvxx8Tyw7ZoIdXlcYeogAAAIs"]
[Sat Jan 03 23:03:36.131375 2026] [:error] [pid 1930:tid 1985] [client 98.70.127.32:14615] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd.php"] [unique_id "aVkvyJP-6mqhfUDa89z3IAAAAFM"]
[Sat Jan 03 23:03:36.413582 2026] [:error] [pid 1931:tid 2039] [client 98.70.127.32:14534] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh1.php"] [unique_id "aVkvyB8Tyw7ZoIdXlcYepQAAAI8"]
[Sat Jan 03 23:03:36.750054 2026] [:error] [pid 31222:tid 31224] [client 98.70.127.32:19768] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh1.php"] [unique_id "aVkvyKHw6nASHXAc2v_73QAAAcA"]
[Sat Jan 03 23:03:37.030714 2026] [:error] [pid 31630:tid 31641] [client 98.70.127.32:19774] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh1.php"] [unique_id "aVkvyfUV_PU2SWgLPuhz-QAAAYk"]
[Sat Jan 03 23:03:37.313677 2026] [:error] [pid 1930:tid 1980] [client 98.70.127.32:19778] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh1.php"] [unique_id "aVkvyZP-6mqhfUDa89z3IQAAAE4"]
[Sat Jan 03 23:03:37.606942 2026] [:error] [pid 1930:tid 1984] [client 98.70.127.32:14692] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/database.php"] [unique_id "aVkvyZP-6mqhfUDa89z3IwAAAFI"]
[Sat Jan 03 23:03:37.881969 2026] [:error] [pid 31222:tid 31235] [client 98.70.127.32:14538] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/database.php"] [unique_id "aVkvyaHw6nASHXAc2v_74QAAAcs"]
[Sat Jan 03 23:03:38.159597 2026] [:error] [pid 31630:tid 31642] [client 98.70.127.32:14633] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/database.php"] [unique_id "aVkvyvUV_PU2SWgLPuhz-gAAAYo"]
[Sat Jan 03 23:03:38.448934 2026] [:error] [pid 34260:tid 34280] [client 98.70.127.32:14559] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/database.php"] [unique_id "aVkvykWWhyvZ0O9KNVQ4FgAAARI"]
[Sat Jan 03 23:03:38.757950 2026] [:error] [pid 1930:tid 1986] [client 98.70.127.32:14617] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "aVkvypP-6mqhfUDa89z3JAAAAFQ"]
[Sat Jan 03 23:03:39.059488 2026] [:error] [pid 19639:tid 19658] [client 98.70.127.32:19838] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "aVkvyyQ7fWZUytnlHEwPfAAAAVE"]
[Sat Jan 03 23:03:39.331887 2026] [:error] [pid 34260:tid 34270] [client 98.70.127.32:14606] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "aVkvy0WWhyvZ0O9KNVQ4GAAAAQg"]
[Sat Jan 03 23:03:39.635721 2026] [:error] [pid 2083:tid 2101] [client 98.70.127.32:14678] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "aVkvyzVlR_BmlMPnhV4tHgAAANA"]
[Sat Jan 03 23:03:39.933635 2026] [:error] [pid 31222:tid 31240] [client 98.70.127.32:19836] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hehe.php"] [unique_id "aVkvy6Hw6nASHXAc2v_74wAAAdA"]
[Sat Jan 03 23:03:40.228998 2026] [:error] [pid 1930:tid 1982] [client 98.70.127.32:19749] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hehe.php"] [unique_id "aVkvzJP-6mqhfUDa89z3JQAAAFA"]
[Sat Jan 03 23:03:40.518060 2026] [:error] [pid 1929:tid 1958] [client 98.70.127.32:14537] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hehe.php"] [unique_id "aVkvzOcFqdpu6TNsuWoFHgAAABQ"]
[Sat Jan 03 23:03:40.843715 2026] [:error] [pid 1930:tid 1979] [client 98.70.127.32:19742] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hehe.php"] [unique_id "aVkvzJP-6mqhfUDa89z3JwAAAE0"]
[Sat Jan 03 23:03:41.160473 2026] [:error] [pid 1929:tid 1947] [client 98.70.127.32:14709] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4fk6.php"] [unique_id "aVkvzecFqdpu6TNsuWoFIQAAAAk"]
[Sat Jan 03 23:03:41.443197 2026] [:error] [pid 34260:tid 34286] [client 98.70.127.32:14610] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4fk6.php"] [unique_id "aVkvzUWWhyvZ0O9KNVQ4IQAAARg"]
[Sat Jan 03 23:03:41.735626 2026] [:error] [pid 34260:tid 34266] [client 98.70.127.32:14592] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4fk6.php"] [unique_id "aVkvzUWWhyvZ0O9KNVQ4IgAAAQQ"]
[Sat Jan 03 23:03:42.045391 2026] [:error] [pid 1931:tid 1999] [client 98.70.127.32:14715] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4fk6.php"] [unique_id "aVkvzh8Tyw7ZoIdXlcYeqwAAAIM"]
[Sat Jan 03 23:03:42.355268 2026] [:error] [pid 19639:tid 19645] [client 98.70.127.32:14504] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5e0a.php"] [unique_id "aVkvziQ7fWZUytnlHEwPfwAAAUQ"]
[Sat Jan 03 23:03:42.689800 2026] [:error] [pid 1931:tid 2032] [client 98.70.127.32:14702] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5e0a.php"] [unique_id "aVkvzh8Tyw7ZoIdXlcYerAAAAIg"]
[Sat Jan 03 23:03:42.976675 2026] [:error] [pid 1930:tid 1972] [client 98.70.127.32:14620] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5e0a.php"] [unique_id "aVkvzpP-6mqhfUDa89z3KAAAAEY"]
[Sat Jan 03 23:03:43.279057 2026] [:error] [pid 2083:tid 2108] [client 98.70.127.32:14478] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5e0a.php"] [unique_id "aVkvzzVlR_BmlMPnhV4tJQAAANc"]
[Sat Jan 03 23:03:43.553517 2026] [:error] [pid 1930:tid 1973] [client 98.70.127.32:14567] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BMjXQkgwpeb.php"] [unique_id "aVkvz5P-6mqhfUDa89z3KQAAAEc"]
[Sat Jan 03 23:03:43.869854 2026] [:error] [pid 1931:tid 2027] [client 98.70.127.32:14600] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BMjXQkgwpeb.php"] [unique_id "aVkvzx8Tyw7ZoIdXlcYergAAAIQ"]
[Sat Jan 03 23:03:44.165763 2026] [:error] [pid 19639:tid 19665] [client 98.70.127.32:14608] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BMjXQkgwpeb.php"] [unique_id "aVkv0CQ7fWZUytnlHEwPggAAAVg"]
[Sat Jan 03 23:03:44.459729 2026] [:error] [pid 1929:tid 1953] [client 98.70.127.32:19752] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BMjXQkgwpeb.php"] [unique_id "aVkv0OcFqdpu6TNsuWoFJgAAAA8"]
[Sat Jan 03 23:03:44.744108 2026] [:error] [pid 34260:tid 34282] [client 98.70.127.32:19729] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "aVkv0EWWhyvZ0O9KNVQ4JwAAARQ"]
[Sat Jan 03 23:03:45.016254 2026] [:error] [pid 31222:tid 31226] [client 98.70.127.32:14562] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "aVkv0aHw6nASHXAc2v_75wAAAcI"]
[Sat Jan 03 23:03:45.344844 2026] [:error] [pid 1929:tid 1949] [client 98.70.127.32:14558] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "aVkv0ecFqdpu6TNsuWoFKQAAAAs"]
[Sat Jan 03 23:03:45.642505 2026] [:error] [pid 1929:tid 1941] [client 98.70.127.32:14539] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "aVkv0ecFqdpu6TNsuWoFKgAAAAM"]
[Sat Jan 03 23:03:45.941169 2026] [:error] [pid 19639:tid 19647] [client 98.70.127.32:14710] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/56c53.php"] [unique_id "aVkv0SQ7fWZUytnlHEwPgwAAAUY"]
[Sat Jan 03 23:03:46.219721 2026] [:error] [pid 1931:tid 2038] [client 98.70.127.32:14560] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/56c53.php"] [unique_id "aVkv0h8Tyw7ZoIdXlcYeswAAAI4"]
[Sat Jan 03 23:03:46.494133 2026] [:error] [pid 34260:tid 34279] [client 98.70.127.32:14646] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/56c53.php"] [unique_id "aVkv0kWWhyvZ0O9KNVQ4KQAAARE"]
[Sat Jan 03 23:03:46.778802 2026] [:error] [pid 1931:tid 2039] [client 98.70.127.32:14636] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/56c53.php"] [unique_id "aVkv0h8Tyw7ZoIdXlcYetAAAAI8"]
[Sat Jan 03 23:03:47.100299 2026] [:error] [pid 1930:tid 1969] [client 98.70.127.32:14645] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wps.php"] [unique_id "aVkv05P-6mqhfUDa89z3LgAAAEM"]
[Sat Jan 03 23:03:47.405406 2026] [:error] [pid 34260:tid 34273] [client 98.70.127.32:14580] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wps.php"] [unique_id "aVkv00WWhyvZ0O9KNVQ4KgAAAQs"]
[Sat Jan 03 23:03:47.685654 2026] [:error] [pid 19639:tid 19654] [client 98.70.127.32:14563] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wps.php"] [unique_id "aVkv0yQ7fWZUytnlHEwPhgAAAU0"]
[Sat Jan 03 23:03:47.976545 2026] [:error] [pid 31222:tid 31246] [client 98.70.127.32:14533] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wps.php"] [unique_id "aVkv06Hw6nASHXAc2v_77AAAAdY"]
[Sat Jan 03 23:03:48.305128 2026] [:error] [pid 19639:tid 19646] [client 98.70.127.32:14548] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-sid.php"] [unique_id "aVkv1CQ7fWZUytnlHEwPhwAAAUU"]
[Sat Jan 03 23:03:48.604238 2026] [:error] [pid 1929:tid 1939] [client 98.70.127.32:14651] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-sid.php"] [unique_id "aVkv1OcFqdpu6TNsuWoFMAAAAAE"]
[Sat Jan 03 23:03:48.982868 2026] [:error] [pid 31630:tid 31650] [client 98.70.127.32:14623] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-sid.php"] [unique_id "aVkv1PUV_PU2SWgLPuh0BgAAAZI"]
[Sat Jan 03 23:03:49.300832 2026] [:error] [pid 31630:tid 31634] [client 98.70.127.32:14700] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-sid.php"] [unique_id "aVkv1fUV_PU2SWgLPuh0CAAAAYI"]
[Sat Jan 03 23:03:49.619262 2026] [:error] [pid 2083:tid 2104] [client 98.70.127.32:14711] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-Blogs.php"] [unique_id "aVkv1TVlR_BmlMPnhV4tLwAAANM"]
[Sat Jan 03 23:03:49.947101 2026] [:error] [pid 31630:tid 31639] [client 98.70.127.32:14639] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-Blogs.php"] [unique_id "aVkv1fUV_PU2SWgLPuh0DAAAAYc"]
[Sat Jan 03 23:03:50.276199 2026] [:error] [pid 1931:tid 1996] [client 98.70.127.32:14554] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-Blogs.php"] [unique_id "aVkv1h8Tyw7ZoIdXlcYeuAAAAII"]
[Sat Jan 03 23:03:50.615523 2026] [:error] [pid 1931:tid 2047] [client 98.70.127.32:19760] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-Blogs.php"] [unique_id "aVkv1h8Tyw7ZoIdXlcYeuwAAAJc"]
[Sat Jan 03 23:03:50.944312 2026] [:error] [pid 31222:tid 31239] [client 98.70.127.32:14612] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/krypton.php"] [unique_id "aVkv1qHw6nASHXAc2v_77wAAAc8"]
[Sat Jan 03 23:03:51.243112 2026] [:error] [pid 31630:tid 31645] [client 98.70.127.32:14550] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/krypton.php"] [unique_id "aVkv1_UV_PU2SWgLPuh0DgAAAY0"]
[Sat Jan 03 23:03:51.561428 2026] [:error] [pid 2083:tid 2089] [client 98.70.127.32:14471] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/krypton.php"] [unique_id "aVkv1zVlR_BmlMPnhV4tMgAAAMQ"]
[Sat Jan 03 23:03:51.865848 2026] [:error] [pid 31630:tid 31642] [client 98.70.127.32:14644] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/krypton.php"] [unique_id "aVkv1_UV_PU2SWgLPuh0DwAAAYo"]
[Sat Jan 03 23:03:52.186020 2026] [:error] [pid 1929:tid 1950] [client 98.70.127.32:14634] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aVkv2OcFqdpu6TNsuWoFNAAAAAw"]
[Sat Jan 03 23:03:52.480878 2026] [:error] [pid 2083:tid 2095] [client 98.70.127.32:14469] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aVkv2DVlR_BmlMPnhV4tMwAAAMo"]
[Sat Jan 03 23:03:52.791911 2026] [:error] [pid 2083:tid 2091] [client 98.70.127.32:14638] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aVkv2DVlR_BmlMPnhV4tNAAAAMY"]
[Sat Jan 03 23:03:53.071592 2026] [:error] [pid 1929:tid 1954] [client 98.70.127.32:14530] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aVkv2ecFqdpu6TNsuWoFOQAAABA"]
[Sat Jan 03 23:03:53.388465 2026] [:error] [pid 19639:tid 19656] [client 98.70.127.32:14676] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nucqsqeg.php"] [unique_id "aVkv2SQ7fWZUytnlHEwPiAAAAU8"]
[Sat Jan 03 23:03:53.663764 2026] [:error] [pid 2083:tid 2105] [client 98.70.127.32:14609] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nucqsqeg.php"] [unique_id "aVkv2TVlR_BmlMPnhV4tNwAAANQ"]
[Sat Jan 03 23:03:53.960498 2026] [:error] [pid 2083:tid 2099] [client 98.70.127.32:14498] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nucqsqeg.php"] [unique_id "aVkv2TVlR_BmlMPnhV4tOAAAAM4"]
[Sat Jan 03 23:03:54.233960 2026] [:error] [pid 2083:tid 2088] [client 98.70.127.32:19729] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nucqsqeg.php"] [unique_id "aVkv2jVlR_BmlMPnhV4tOQAAAMM"]
[Sat Jan 03 23:03:54.506399 2026] [:error] [pid 31630:tid 31650] [client 98.70.127.32:14603] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jdlqi.php"] [unique_id "aVkv2vUV_PU2SWgLPuh0GgAAAZI"]
[Sat Jan 03 23:03:54.830757 2026] [:error] [pid 1930:tid 1986] [client 98.70.127.32:14622] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jdlqi.php"] [unique_id "aVkv2pP-6mqhfUDa89z3NQAAAFQ"]
[Sat Jan 03 23:03:55.120073 2026] [:error] [pid 19639:tid 19663] [client 98.70.127.32:14685] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jdlqi.php"] [unique_id "aVkv2yQ7fWZUytnlHEwPiwAAAVY"]
[Sat Jan 03 23:03:55.394445 2026] [:error] [pid 1931:tid 1999] [client 98.70.127.32:14468] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jdlqi.php"] [unique_id "aVkv2x8Tyw7ZoIdXlcYevgAAAIM"]
[Sat Jan 03 23:03:55.676490 2026] [:error] [pid 1929:tid 1938] [client 98.70.127.32:14474] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aVkv2-cFqdpu6TNsuWoFQAAAAAA"]
[Sat Jan 03 23:03:55.965130 2026] [:error] [pid 34260:tid 34267] [client 98.70.127.32:14628] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aVkv20WWhyvZ0O9KNVQ4PAAAAQU"]
[Sat Jan 03 23:03:56.246371 2026] [:error] [pid 19639:tid 19650] [client 98.70.127.32:14566] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aVkv3CQ7fWZUytnlHEwPjwAAAUk"]
[Sat Jan 03 23:03:56.540351 2026] [:error] [pid 1931:tid 2046] [client 98.70.127.32:14598] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aVkv3B8Tyw7ZoIdXlcYewwAAAJY"]
[Sat Jan 03 23:03:56.812974 2026] [:error] [pid 1931:tid 2029] [client 98.70.127.32:14648] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-front.php"] [unique_id "aVkv3B8Tyw7ZoIdXlcYeyAAAAIU"]
[Sat Jan 03 23:03:57.104616 2026] [:error] [pid 19639:tid 19660] [client 98.70.127.32:14612] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-front.php"] [unique_id "aVkv3SQ7fWZUytnlHEwPlwAAAVM"]
[Sat Jan 03 23:03:57.377772 2026] [:error] [pid 1931:tid 2030] [client 98.70.127.32:14654] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-front.php"] [unique_id "aVkv3R8Tyw7ZoIdXlcYezAAAAIY"]
[Sat Jan 03 23:03:57.700092 2026] [:error] [pid 19639:tid 19649] [client 98.70.127.32:14544] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-front.php"] [unique_id "aVkv3SQ7fWZUytnlHEwPmwAAAUg"]
[Sat Jan 03 23:03:57.990034 2026] [:error] [pid 1931:tid 2047] [client 98.70.127.32:14508] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenium4.php"] [unique_id "aVkv3R8Tyw7ZoIdXlcYezgAAAJc"]
[Sat Jan 03 23:03:58.277379 2026] [:error] [pid 19639:tid 19656] [client 98.70.127.32:14670] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenium4.php"] [unique_id "aVkv3iQ7fWZUytnlHEwPnQAAAU8"]
[Sat Jan 03 23:03:58.550797 2026] [:error] [pid 19639:tid 19664] [client 98.70.127.32:14653] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenium4.php"] [unique_id "aVkv3iQ7fWZUytnlHEwPngAAAVc"]
[Sat Jan 03 23:03:58.825469 2026] [:error] [pid 1929:tid 1954] [client 98.70.127.32:14477] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenium4.php"] [unique_id "aVkv3ucFqdpu6TNsuWoFTAAAABA"]
[Sat Jan 03 23:03:59.097234 2026] [:error] [pid 19639:tid 19643] [client 98.70.127.32:14470] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid-file.php"] [unique_id "aVkv3yQ7fWZUytnlHEwPogAAAUI"]
[Sat Jan 03 23:03:59.371490 2026] [:error] [pid 1929:tid 1953] [client 98.70.127.32:14704] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid-file.php"] [unique_id "aVkv3-cFqdpu6TNsuWoFUQAAAA8"]
[Sat Jan 03 23:03:59.643282 2026] [:error] [pid 19639:tid 19645] [client 98.70.127.32:14652] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid-file.php"] [unique_id "aVkv3yQ7fWZUytnlHEwPpwAAAUQ"]
[Sat Jan 03 23:04:01.007114 2026] [:error] [pid 1929:tid 1942] [client 98.70.127.32:14466] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid-file.php"] [unique_id "aVkv4ecFqdpu6TNsuWoFWAAAAAQ"]
[Sat Jan 03 23:04:01.313335 2026] [:error] [pid 34260:tid 34270] [client 98.70.127.32:14422] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-user.php"] [unique_id "aVkv4UWWhyvZ0O9KNVQ4QQAAAQg"]
[Sat Jan 03 23:04:01.628486 2026] [:error] [pid 1929:tid 1954] [client 98.70.127.32:14412] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-user.php"] [unique_id "aVkv4ecFqdpu6TNsuWoFXwAAABA"]
[Sat Jan 03 23:04:01.921404 2026] [:error] [pid 34260:tid 34281] [client 98.70.127.32:14633] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-user.php"] [unique_id "aVkv4UWWhyvZ0O9KNVQ4QwAAARM"]
[Sat Jan 03 23:04:02.256914 2026] [:error] [pid 1931:tid 2032] [client 98.70.127.32:14572] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-user.php"] [unique_id "aVkv4h8Tyw7ZoIdXlcYe0wAAAIg"]
[Sat Jan 03 23:04:02.531209 2026] [:error] [pid 34260:tid 34285] [client 98.70.127.32:14514] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aVkv4kWWhyvZ0O9KNVQ4RQAAARc"]
[Sat Jan 03 23:04:02.806596 2026] [:error] [pid 19639:tid 19656] [client 98.70.127.32:14555] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aVkv4iQ7fWZUytnlHEwPsAAAAU8"]
[Sat Jan 03 23:04:03.133324 2026] [:error] [pid 19639:tid 19663] [client 98.70.127.32:14591] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aVkv4yQ7fWZUytnlHEwPswAAAVY"]
[Sat Jan 03 23:04:03.431275 2026] [:error] [pid 1931:tid 2044] [client 98.70.127.32:14489] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aVkv4x8Tyw7ZoIdXlcYe2AAAAJQ"]
[Sat Jan 03 23:04:03.711789 2026] [:error] [pid 1929:tid 1941] [client 98.70.127.32:14624] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/green.php"] [unique_id "aVkv4-cFqdpu6TNsuWoFawAAAAM"]
[Sat Jan 03 23:04:04.017469 2026] [:error] [pid 1931:tid 2042] [client 98.70.127.32:14401] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/green.php"] [unique_id "aVkv5B8Tyw7ZoIdXlcYe2gAAAJI"]
[Sat Jan 03 23:04:04.317942 2026] [:error] [pid 1931:tid 2038] [client 98.70.127.32:14556] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/green.php"] [unique_id "aVkv5B8Tyw7ZoIdXlcYe3QAAAI4"]
[Sat Jan 03 23:04:04.608803 2026] [:error] [pid 1931:tid 2039] [client 98.70.127.32:14503] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/green.php"] [unique_id "aVkv5B8Tyw7ZoIdXlcYe3gAAAI8"]
[Sat Jan 03 23:04:04.899929 2026] [:error] [pid 1931:tid 2041] [client 98.70.127.32:14486] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mhpglaje.php"] [unique_id "aVkv5B8Tyw7ZoIdXlcYe4QAAAJE"]
[Sat Jan 03 23:04:05.172568 2026] [:error] [pid 1930:tid 1967] [client 98.70.127.32:14601] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mhpglaje.php"] [unique_id "aVkv5ZP-6mqhfUDa89z3QQAAAEE"]
[Sat Jan 03 23:04:05.455401 2026] [:error] [pid 1930:tid 1977] [client 98.70.127.32:14549] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mhpglaje.php"] [unique_id "aVkv5ZP-6mqhfUDa89z3QgAAAEs"]
[Sat Jan 03 23:04:05.733412 2026] [:error] [pid 34260:tid 34266] [client 98.70.127.32:14557] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mhpglaje.php"] [unique_id "aVkv5UWWhyvZ0O9KNVQ4TAAAAQQ"]
[Sat Jan 03 23:04:06.027160 2026] [:error] [pid 19639:tid 19645] [client 98.70.127.32:14513] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/LvCBeZWaSgQ.php"] [unique_id "aVkv5iQ7fWZUytnlHEwPtwAAAUQ"]
[Sat Jan 03 23:04:06.303528 2026] [:error] [pid 1931:tid 2043] [client 98.70.127.32:14569] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/LvCBeZWaSgQ.php"] [unique_id "aVkv5h8Tyw7ZoIdXlcYe6QAAAJM"]
[Sat Jan 03 23:04:06.628896 2026] [:error] [pid 34260:tid 34264] [client 98.70.127.32:14511] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/LvCBeZWaSgQ.php"] [unique_id "aVkv5kWWhyvZ0O9KNVQ4TQAAAQI"]
[Sat Jan 03 23:04:06.903540 2026] [:error] [pid 19639:tid 19661] [client 98.70.127.32:14568] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/LvCBeZWaSgQ.php"] [unique_id "aVkv5iQ7fWZUytnlHEwPuQAAAVQ"]
[Sat Jan 03 23:04:07.222049 2026] [:error] [pid 1930:tid 1984] [client 98.70.127.32:14570] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lm15.php"] [unique_id "aVkv55P-6mqhfUDa89z3SAAAAFI"]
[Sat Jan 03 23:04:07.505610 2026] [:error] [pid 1929:tid 1943] [client 98.70.127.32:14527] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lm15.php"] [unique_id "aVkv5-cFqdpu6TNsuWoFcQAAAAU"]
[Sat Jan 03 23:04:07.825431 2026] [:error] [pid 1929:tid 1951] [client 98.70.127.32:14625] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lm15.php"] [unique_id "aVkv5-cFqdpu6TNsuWoFcwAAAA0"]
[Sat Jan 03 23:04:08.097109 2026] [:error] [pid 1931:tid 2042] [client 98.70.127.32:14481] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lm15.php"] [unique_id "aVkv6B8Tyw7ZoIdXlcYe7QAAAJI"]
[Sat Jan 03 23:04:08.408681 2026] [:error] [pid 19639:tid 19652] [client 98.70.127.32:14583] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aVkv6CQ7fWZUytnlHEwPvwAAAUs"]
[Sat Jan 03 23:04:08.688627 2026] [:error] [pid 1931:tid 2038] [client 98.70.127.32:14345] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aVkv6B8Tyw7ZoIdXlcYe7wAAAI4"]
[Sat Jan 03 23:04:08.978826 2026] [:error] [pid 1931:tid 2036] [client 98.70.127.32:14420] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aVkv6B8Tyw7ZoIdXlcYe8AAAAIw"]
[Sat Jan 03 23:04:09.263764 2026] [:error] [pid 1931:tid 2045] [client 98.70.127.32:14579] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aVkv6R8Tyw7ZoIdXlcYe8wAAAJU"]
[Sat Jan 03 23:04:09.560158 2026] [:error] [pid 1931:tid 2030] [client 98.70.127.32:14535] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qaez.php56"] [unique_id "aVkv6R8Tyw7ZoIdXlcYe9QAAAIY"]
[Sat Jan 03 23:04:09.856209 2026] [:error] [pid 31222:tid 31244] [client 98.70.127.32:14423] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qaez.php56"] [unique_id "aVkv6aHw6nASHXAc2v_79AAAAdQ"]
[Sat Jan 03 23:04:10.180211 2026] [:error] [pid 1931:tid 2033] [client 98.70.127.32:14561] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qaez.php56"] [unique_id "aVkv6h8Tyw7ZoIdXlcYe-AAAAIk"]
[Sat Jan 03 23:04:10.453185 2026] [:error] [pid 1930:tid 1975] [client 98.70.127.32:14540] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qaez.php56"] [unique_id "aVkv6pP-6mqhfUDa89z3TAAAAEk"]
[Sat Jan 03 23:04:10.772200 2026] [:error] [pid 34260:tid 34275] [client 98.70.127.32:14586] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ijNdPI1Orya.php"] [unique_id "aVkv6kWWhyvZ0O9KNVQ4VgAAAQ0"]
[Sat Jan 03 23:04:11.045146 2026] [:error] [pid 1930:tid 1972] [client 98.70.127.32:14529] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ijNdPI1Orya.php"] [unique_id "aVkv65P-6mqhfUDa89z3TwAAAEY"]
[Sat Jan 03 23:04:11.341744 2026] [:error] [pid 1930:tid 1966] [client 98.70.127.32:19777] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ijNdPI1Orya.php"] [unique_id "aVkv65P-6mqhfUDa89z3UgAAAEA"]
[Sat Jan 03 23:04:11.616596 2026] [:error] [pid 1931:tid 2032] [client 98.70.127.32:14492] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ijNdPI1Orya.php"] [unique_id "aVkv6x8Tyw7ZoIdXlcYe_AAAAIg"]
[Sat Jan 03 23:04:11.915147 2026] [:error] [pid 1931:tid 2034] [client 98.70.127.32:14439] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "aVkv6x8Tyw7ZoIdXlcYe_QAAAIo"]
[Sat Jan 03 23:04:12.192374 2026] [:error] [pid 1931:tid 1993] [client 98.70.127.32:14581] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "aVkv7B8Tyw7ZoIdXlcYe_wAAAIA"]
[Sat Jan 03 23:04:12.465564 2026] [:error] [pid 1931:tid 2035] [client 98.70.127.32:19720] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "aVkv7B8Tyw7ZoIdXlcYfBAAAAIs"]
[Sat Jan 03 23:04:12.748714 2026] [:error] [pid 1929:tid 1953] [client 98.70.127.32:14532] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "aVkv7OcFqdpu6TNsuWoFeQAAAA8"]
[Sat Jan 03 23:04:13.032816 2026] [:error] [pid 34260:tid 34270] [client 98.70.127.32:14506] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/HPum4ZEBJRC.php"] [unique_id "aVkv7UWWhyvZ0O9KNVQ4WAAAAQg"]
[Sat Jan 03 23:04:13.305648 2026] [:error] [pid 1931:tid 2033] [client 98.70.127.32:14575] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/HPum4ZEBJRC.php"] [unique_id "aVkv7R8Tyw7ZoIdXlcYfDAAAAIk"]
[Sat Jan 03 23:04:13.617381 2026] [:error] [pid 1931:tid 1996] [client 98.70.127.32:14713] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/HPum4ZEBJRC.php"] [unique_id "aVkv7R8Tyw7ZoIdXlcYfDQAAAII"]
[Sat Jan 03 23:04:13.931780 2026] [:error] [pid 1931:tid 2029] [client 98.70.127.32:14402] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/HPum4ZEBJRC.php"] [unique_id "aVkv7R8Tyw7ZoIdXlcYfEAAAAIU"]
[Sat Jan 03 23:04:14.214471 2026] [:error] [pid 1931:tid 2034] [client 98.70.127.32:14464] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aVkv7h8Tyw7ZoIdXlcYfEwAAAIo"]
[Sat Jan 03 23:04:14.507630 2026] [:error] [pid 1931:tid 1993] [client 98.70.127.32:14545] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aVkv7h8Tyw7ZoIdXlcYfFQAAAIA"]
[Sat Jan 03 23:04:14.804522 2026] [:error] [pid 1931:tid 2027] [client 98.70.127.32:14577] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aVkv7h8Tyw7ZoIdXlcYfGgAAAIQ"]
[Sat Jan 03 23:04:15.084869 2026] [:error] [pid 31222:tid 31234] [client 98.70.127.32:14493] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aVkv76Hw6nASHXAc2v_7-gAAAco"]
[Sat Jan 03 23:04:15.369353 2026] [:error] [pid 34260:tid 34274] [client 98.70.127.32:14451] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ox8xhkkw.php"] [unique_id "aVkv70WWhyvZ0O9KNVQ4XQAAAQw"]
[Sat Jan 03 23:04:15.648996 2026] [:error] [pid 19639:tid 19658] [client 98.70.127.32:14488] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ox8xhkkw.php"] [unique_id "aVkv7yQ7fWZUytnlHEwPxQAAAVE"]
[Sat Jan 03 23:04:15.939881 2026] [:error] [pid 1931:tid 2031] [client 98.70.127.32:14565] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ox8xhkkw.php"] [unique_id "aVkv7x8Tyw7ZoIdXlcYfJAAAAIc"]
[Sat Jan 03 23:04:16.218001 2026] [:error] [pid 1931:tid 1993] [client 98.70.127.32:14431] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ox8xhkkw.php"] [unique_id "aVkv8B8Tyw7ZoIdXlcYfJgAAAIA"]
[Sat Jan 03 23:04:16.520967 2026] [:error] [pid 34260:tid 34268] [client 98.70.127.32:14475] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-advaced.php"] [unique_id "aVkv8EWWhyvZ0O9KNVQ4YAAAAQY"]
[Sat Jan 03 23:04:16.798401 2026] [:error] [pid 34260:tid 34264] [client 98.70.127.32:14576] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-advaced.php"] [unique_id "aVkv8EWWhyvZ0O9KNVQ4YwAAAQI"]
[Sat Jan 03 23:04:17.101815 2026] [:error] [pid 1929:tid 1948] [client 98.70.127.32:14405] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-advaced.php"] [unique_id "aVkv8ecFqdpu6TNsuWoFfQAAAAo"]
[Sat Jan 03 23:04:17.378926 2026] [:error] [pid 1929:tid 1957] [client 98.70.127.32:14485] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-advaced.php"] [unique_id "aVkv8ecFqdpu6TNsuWoFfgAAABM"]
[Sat Jan 03 23:04:17.649924 2026] [:error] [pid 1929:tid 1939] [client 98.70.127.32:14688] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aGeTbFjB5Zu.php"] [unique_id "aVkv8ecFqdpu6TNsuWoFgAAAAAE"]
[Sat Jan 03 23:04:17.980653 2026] [:error] [pid 34260:tid 34265] [client 98.70.127.32:14627] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aGeTbFjB5Zu.php"] [unique_id "aVkv8UWWhyvZ0O9KNVQ4ZwAAAQM"]
[Sat Jan 03 23:04:18.299215 2026] [:error] [pid 34260:tid 34267] [client 98.70.127.32:14518] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aGeTbFjB5Zu.php"] [unique_id "aVkv8kWWhyvZ0O9KNVQ4aAAAAQU"]
[Sat Jan 03 23:04:18.579445 2026] [:error] [pid 34260:tid 34273] [client 98.70.127.32:14546] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aGeTbFjB5Zu.php"] [unique_id "aVkv8kWWhyvZ0O9KNVQ4agAAAQs"]
[Sat Jan 03 23:04:18.867766 2026] [:error] [pid 1931:tid 2031] [client 98.70.127.32:14473] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s.php"] [unique_id "aVkv8h8Tyw7ZoIdXlcYfOQAAAIc"]
[Sat Jan 03 23:04:19.184196 2026] [:error] [pid 31630:tid 31643] [client 98.70.127.32:14573] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s.php"] [unique_id "aVkv8_UV_PU2SWgLPuh0OAAAAYs"]
[Sat Jan 03 23:04:19.497236 2026] [:error] [pid 31222:tid 31235] [client 98.70.127.32:14589] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s.php"] [unique_id "aVkv86Hw6nASHXAc2v_7-wAAAcs"]
[Sat Jan 03 23:04:19.776011 2026] [:error] [pid 31630:tid 31654] [client 98.70.127.32:14497] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s.php"] [unique_id "aVkv8_UV_PU2SWgLPuh0OgAAAZY"]
[Sat Jan 03 23:04:20.098361 2026] [:error] [pid 31630:tid 31633] [client 98.70.127.32:14543] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww3.php"] [unique_id "aVkv9PUV_PU2SWgLPuh0OwAAAYE"]
[Sat Jan 03 23:04:20.372618 2026] [:error] [pid 31222:tid 31236] [client 98.70.127.32:14404] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww3.php"] [unique_id "aVkv9KHw6nASHXAc2v_7_QAAAcw"]
[Sat Jan 03 23:04:20.682430 2026] [:error] [pid 19639:tid 19657] [client 98.70.127.32:14512] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww3.php"] [unique_id "aVkv9CQ7fWZUytnlHEwPzgAAAVA"]
[Sat Jan 03 23:04:20.958123 2026] [:error] [pid 19639:tid 19648] [client 98.70.127.32:14438] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww3.php"] [unique_id "aVkv9CQ7fWZUytnlHEwPzwAAAUc"]
[Sat Jan 03 23:04:21.234423 2026] [:error] [pid 31222:tid 31240] [client 98.70.127.32:14413] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dout.php"] [unique_id "aVkv9aHw6nASHXAc2v_8AQAAAdA"]
[Sat Jan 03 23:04:21.529224 2026] [:error] [pid 34260:tid 34268] [client 98.70.127.32:14520] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dout.php"] [unique_id "aVkv9UWWhyvZ0O9KNVQ4dQAAAQY"]
[Sat Jan 03 23:04:21.817175 2026] [:error] [pid 1930:tid 1981] [client 98.70.127.32:14585] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dout.php"] [unique_id "aVkv9ZP-6mqhfUDa89z3ZAAAAE8"]
[Sat Jan 03 23:04:22.115795 2026] [:error] [pid 2083:tid 2102] [client 98.70.127.32:14488] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dout.php"] [unique_id "aVkv9jVlR_BmlMPnhV4tTgAAANE"]
[Sat Jan 03 23:04:22.462519 2026] [:error] [pid 19639:tid 19641] [client 98.70.127.32:14588] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xtt.php"] [unique_id "aVkv9iQ7fWZUytnlHEwP0QAAAUA"]
[Sat Jan 03 23:04:22.831177 2026] [:error] [pid 34260:tid 34264] [client 98.70.127.32:14531] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xtt.php"] [unique_id "aVkv9kWWhyvZ0O9KNVQ4eAAAAQI"]
[Sat Jan 03 23:04:23.199647 2026] [:error] [pid 31222:tid 31241] [client 98.70.127.32:14467] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xtt.php"] [unique_id "aVkv96Hw6nASHXAc2v_8BAAAAdE"]
[Sat Jan 03 23:04:23.567039 2026] [:error] [pid 31222:tid 31231] [client 98.70.127.32:14421] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xtt.php"] [unique_id "aVkv96Hw6nASHXAc2v_8BQAAAcc"]
[Sat Jan 03 23:04:23.944633 2026] [:error] [pid 19639:tid 19653] [client 98.70.127.32:14402] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin836.php"] [unique_id "aVkv9yQ7fWZUytnlHEwP1AAAAUw"]
[Sat Jan 03 23:04:24.350586 2026] [:error] [pid 1930:tid 1983] [client 98.70.127.32:14459] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin836.php"] [unique_id "aVkv-JP-6mqhfUDa89z3ZgAAAFE"]
[Sat Jan 03 23:04:24.772546 2026] [:error] [pid 31222:tid 31245] [client 98.70.127.32:14491] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin836.php"] [unique_id "aVkv-KHw6nASHXAc2v_8CAAAAdU"]
[Sat Jan 03 23:04:25.165292 2026] [:error] [pid 1931:tid 2044] [client 98.70.127.32:14571] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin836.php"] [unique_id "aVkv-R8Tyw7ZoIdXlcYfXgAAAJQ"]
[Sat Jan 03 23:04:25.539806 2026] [:error] [pid 31630:tid 31651] [client 98.70.127.32:14507] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aVkv-fUV_PU2SWgLPuh0QgAAAZM"]
[Sat Jan 03 23:04:25.934021 2026] [:error] [pid 1931:tid 2037] [client 98.70.127.32:14501] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aVkv-R8Tyw7ZoIdXlcYfYwAAAI0"]
[Sat Jan 03 23:04:26.345506 2026] [:error] [pid 1929:tid 1948] [client 98.70.127.32:14499] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aVkv-ucFqdpu6TNsuWoFkwAAAAo"]
[Sat Jan 03 23:04:26.731306 2026] [:error] [pid 34260:tid 34267] [client 98.70.127.32:14425] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aVkv-kWWhyvZ0O9KNVQ4fQAAAQU"]
[Sat Jan 03 23:04:27.034494 2026] [:error] [pid 34260:tid 34279] [client 98.70.127.32:14547] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dng.php"] [unique_id "aVkv-0WWhyvZ0O9KNVQ4gAAAARE"]
[Sat Jan 03 23:04:27.353685 2026] [:error] [pid 1931:tid 2035] [client 98.70.127.32:14416] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dng.php"] [unique_id "aVkv-x8Tyw7ZoIdXlcYfbQAAAIs"]
[Sat Jan 03 23:04:27.718076 2026] [:error] [pid 31222:tid 31243] [client 98.70.127.32:14502] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dng.php"] [unique_id "aVkv-6Hw6nASHXAc2v_8CwAAAdM"]
[Sat Jan 03 23:04:28.014399 2026] [:error] [pid 1929:tid 1961] [client 98.70.127.32:14605] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dng.php"] [unique_id "aVkv_OcFqdpu6TNsuWoFlwAAABc"]
[Sat Jan 03 23:04:28.286212 2026] [:error] [pid 34260:tid 34285] [client 98.70.127.32:14631] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inghl.php"] [unique_id "aVkv_EWWhyvZ0O9KNVQ4hQAAARc"]
[Sat Jan 03 23:04:28.643194 2026] [:error] [pid 1930:tid 1977] [client 98.70.127.32:14595] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inghl.php"] [unique_id "aVkv_JP-6mqhfUDa89z3awAAAEs"]
[Sat Jan 03 23:04:28.963511 2026] [:error] [pid 2083:tid 2089] [client 98.70.127.32:14578] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inghl.php"] [unique_id "aVkv_DVlR_BmlMPnhV4tVwAAAMQ"]
[Sat Jan 03 23:04:29.243819 2026] [:error] [pid 1929:tid 1955] [client 98.70.127.32:14584] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inghl.php"] [unique_id "aVkv_ecFqdpu6TNsuWoFmQAAABE"]
[Sat Jan 03 23:04:29.608719 2026] [:error] [pid 1931:tid 2041] [client 98.70.127.32:14564] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aVkv_R8Tyw7ZoIdXlcYfcwAAAJE"]
[Sat Jan 03 23:04:29.900076 2026] [:error] [pid 1931:tid 1996] [client 98.70.127.32:14484] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aVkv_R8Tyw7ZoIdXlcYfdQAAAII"]
[Sat Jan 03 23:04:30.175623 2026] [:error] [pid 1929:tid 1959] [client 98.70.127.32:14487] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aVkv_ucFqdpu6TNsuWoFmwAAABU"]
[Sat Jan 03 23:04:30.478645 2026] [:error] [pid 34260:tid 34276] [client 98.70.127.32:14336] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aVkv_kWWhyvZ0O9KNVQ4iAAAAQ4"]
[Sat Jan 03 23:04:30.802866 2026] [:error] [pid 1931:tid 2048] [client 98.70.127.32:14526] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blurbs18.php"] [unique_id "aVkv_h8Tyw7ZoIdXlcYfgQAAAJg"]
[Sat Jan 03 23:04:39.286967 2026] [:error] [pid 31630:tid 31652] [client 98.70.127.32:14509] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-loccs.php"] [unique_id "aVkwB_UV_PU2SWgLPuh0WQAAAZQ"]
[Sat Jan 03 23:04:39.559835 2026] [:error] [pid 19639:tid 19661] [client 98.70.127.32:14448] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-loccs.php"] [unique_id "aVkwByQ7fWZUytnlHEwP8QAAAVQ"]
[Sat Jan 03 23:04:39.870599 2026] [:error] [pid 31222:tid 31229] [client 98.70.127.32:14435] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-loccs.php"] [unique_id "aVkwB6Hw6nASHXAc2v_8JQAAAcU"]
[Sat Jan 03 23:04:40.162730 2026] [:error] [pid 19639:tid 19651] [client 98.70.127.32:14341] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-loccs.php"] [unique_id "aVkwCCQ7fWZUytnlHEwP9QAAAUo"]
[Sat Jan 03 23:04:40.457797 2026] [:error] [pid 1931:tid 2031] [client 98.70.127.32:14410] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/okxh.php"] [unique_id "aVkwCB8Tyw7ZoIdXlcYfngAAAIc"]
[Sat Jan 03 23:04:40.828097 2026] [:error] [pid 31222:tid 31235] [client 98.70.127.32:14519] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/okxh.php"] [unique_id "aVkwCKHw6nASHXAc2v_8KAAAAcs"]
[Sat Jan 03 23:04:41.103825 2026] [:error] [pid 31222:tid 31232] [client 98.70.127.32:14495] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/okxh.php"] [unique_id "aVkwCaHw6nASHXAc2v_8KwAAAcg"]
[Sat Jan 03 23:04:41.419820 2026] [:error] [pid 19639:tid 19646] [client 98.70.127.32:14392] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/okxh.php"] [unique_id "aVkwCSQ7fWZUytnlHEwP9wAAAUU"]
[Sat Jan 03 23:04:41.717834 2026] [:error] [pid 19639:tid 19657] [client 98.70.127.32:14442] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ii5file.php"] [unique_id "aVkwCSQ7fWZUytnlHEwP-AAAAVA"]
[Sat Jan 03 23:04:42.037748 2026] [:error] [pid 19639:tid 19649] [client 98.70.127.32:14387] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ii5file.php"] [unique_id "aVkwCiQ7fWZUytnlHEwP-gAAAUg"]
[Sat Jan 03 23:04:42.324900 2026] [:error] [pid 31630:tid 31656] [client 98.70.127.32:14441] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ii5file.php"] [unique_id "aVkwCvUV_PU2SWgLPuh0ZgAAAZg"]
[Sat Jan 03 23:04:42.704164 2026] [:error] [pid 31222:tid 31240] [client 98.70.127.32:14516] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ii5file.php"] [unique_id "aVkwCqHw6nASHXAc2v_8MgAAAdA"]
[Sat Jan 03 23:04:43.000999 2026] [:error] [pid 2083:tid 2085] [client 98.70.127.32:14476] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aVkwCzVlR_BmlMPnhV4thQAAAMA"]
[Sat Jan 03 23:04:43.479763 2026] [:error] [pid 1931:tid 1993] [client 98.70.127.32:14409] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aVkwCx8Tyw7ZoIdXlcYfowAAAIA"]
[Sat Jan 03 23:04:43.780317 2026] [:error] [pid 1931:tid 2045] [client 98.70.127.32:14429] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aVkwCx8Tyw7ZoIdXlcYfqAAAAJU"]
[Sat Jan 03 23:04:44.132037 2026] [:error] [pid 19639:tid 19664] [client 98.70.127.32:14371] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aVkwDCQ7fWZUytnlHEwP_gAAAVc"]
[Sat Jan 03 23:04:44.471608 2026] [:error] [pid 31630:tid 31632] [client 98.70.127.32:14427] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aVkwDPUV_PU2SWgLPuh0agAAAYA"]
[Sat Jan 03 23:04:44.823271 2026] [:error] [pid 1931:tid 2038] [client 98.70.127.32:14430] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aVkwDB8Tyw7ZoIdXlcYfrQAAAI4"]
[Sat Jan 03 23:04:45.141645 2026] [:error] [pid 1930:tid 1973] [client 98.70.127.32:14505] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aVkwDZP-6mqhfUDa89z3kQAAAEc"]
[Sat Jan 03 23:04:45.468978 2026] [:error] [pid 34260:tid 34276] [client 98.70.127.32:14521] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aVkwDUWWhyvZ0O9KNVQ4rAAAAQ4"]
[Sat Jan 03 23:04:45.747221 2026] [:error] [pid 34260:tid 34284] [client 98.70.127.32:14353] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "aVkwDUWWhyvZ0O9KNVQ4rQAAARY"]
[Sat Jan 03 23:04:46.036361 2026] [:error] [pid 31630:tid 31636] [client 98.70.127.32:14647] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "aVkwDvUV_PU2SWgLPuh0bwAAAYQ"]
[Sat Jan 03 23:04:46.325878 2026] [:error] [pid 31630:tid 31639] [client 98.70.127.32:14522] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "aVkwDvUV_PU2SWgLPuh0cgAAAYc"]
[Sat Jan 03 23:04:46.610214 2026] [:error] [pid 1929:tid 1960] [client 98.70.127.32:14433] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "aVkwDucFqdpu6TNsuWoFtwAAABY"]
[Sat Jan 03 23:04:46.964997 2026] [:error] [pid 1929:tid 1958] [client 98.70.127.32:14337] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/FSCMNvnjPX4.php"] [unique_id "aVkwDucFqdpu6TNsuWoFuQAAABQ"]
[Sat Jan 03 23:04:47.263835 2026] [:error] [pid 1929:tid 1952] [client 98.70.127.32:14523] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/FSCMNvnjPX4.php"] [unique_id "aVkwD-cFqdpu6TNsuWoFuwAAAA4"]
[Sat Jan 03 23:04:47.565320 2026] [:error] [pid 31630:tid 31635] [client 98.70.127.32:14378] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/FSCMNvnjPX4.php"] [unique_id "aVkwD_UV_PU2SWgLPuh0cwAAAYM"]
[Sat Jan 03 23:04:47.851092 2026] [:error] [pid 2083:tid 2100] [client 98.70.127.32:14480] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/FSCMNvnjPX4.php"] [unique_id "aVkwDzVlR_BmlMPnhV4tmQAAAM8"]
[Sat Jan 03 23:04:48.144861 2026] [:error] [pid 19639:tid 19660] [client 98.70.127.32:14366] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qjaqjahu.php"] [unique_id "aVkwECQ7fWZUytnlHEwQBwAAAVM"]
[Sat Jan 03 23:04:48.439996 2026] [:error] [pid 34260:tid 34273] [client 98.70.127.32:14411] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qjaqjahu.php"] [unique_id "aVkwEEWWhyvZ0O9KNVQ4uAAAAQs"]
[Sat Jan 03 23:04:48.738901 2026] [:error] [pid 1929:tid 1942] [client 98.70.127.32:14455] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qjaqjahu.php"] [unique_id "aVkwEOcFqdpu6TNsuWoFvgAAAAQ"]
[Sat Jan 03 23:04:49.013101 2026] [:error] [pid 1931:tid 2036] [client 98.70.127.32:14399] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qjaqjahu.php"] [unique_id "aVkwER8Tyw7ZoIdXlcYfvQAAAIw"]
[Sat Jan 03 23:04:49.304828 2026] [:error] [pid 34260:tid 34280] [client 98.70.127.32:14370] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g7y.php"] [unique_id "aVkwEUWWhyvZ0O9KNVQ4uwAAARI"]
[Sat Jan 03 23:04:49.617601 2026] [:error] [pid 31222:tid 31238] [client 98.70.127.32:14472] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g7y.php"] [unique_id "aVkwEaHw6nASHXAc2v_8PAAAAc4"]
[Sat Jan 03 23:04:49.931527 2026] [:error] [pid 31630:tid 31654] [client 98.70.127.32:14373] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g7y.php"] [unique_id "aVkwEfUV_PU2SWgLPuh0egAAAZY"]
[Sat Jan 03 23:04:50.214765 2026] [:error] [pid 31222:tid 31230] [client 98.70.127.32:14414] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g7y.php"] [unique_id "aVkwEqHw6nASHXAc2v_8PwAAAcY"]
[Sat Jan 03 23:04:50.521803 2026] [:error] [pid 31630:tid 31632] [client 98.70.127.32:14483] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/khgdl.php"] [unique_id "aVkwEvUV_PU2SWgLPuh0fAAAAYA"]
[Sat Jan 03 23:04:50.820171 2026] [:error] [pid 1929:tid 1951] [client 98.70.127.32:14426] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/khgdl.php"] [unique_id "aVkwEucFqdpu6TNsuWoFxgAAAA0"]
[Sat Jan 03 23:04:51.146342 2026] [:error] [pid 19639:tid 19655] [client 98.70.127.32:14449] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/khgdl.php"] [unique_id "aVkwEyQ7fWZUytnlHEwQDQAAAU4"]
[Sat Jan 03 23:04:51.476992 2026] [:error] [pid 34260:tid 34262] [client 98.70.127.32:14479] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/khgdl.php"] [unique_id "aVkwE0WWhyvZ0O9KNVQ4vAAAAQA"]
[Sat Jan 03 23:04:51.766622 2026] [:error] [pid 31630:tid 31648] [client 98.70.127.32:14490] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s121ws2s.php"] [unique_id "aVkwE_UV_PU2SWgLPuh0gwAAAZA"]
[Sat Jan 03 23:04:52.064855 2026] [:error] [pid 31630:tid 31649] [client 98.70.127.32:14373] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s121ws2s.php"] [unique_id "aVkwFPUV_PU2SWgLPuh0hQAAAZE"]
[Sat Jan 03 23:04:52.352635 2026] [:error] [pid 1931:tid 2041] [client 98.70.127.32:14432] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s121ws2s.php"] [unique_id "aVkwFB8Tyw7ZoIdXlcYfwwAAAJE"]
[Sat Jan 03 23:04:52.643759 2026] [:error] [pid 1929:tid 1938] [client 98.70.127.32:14278] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s121ws2s.php"] [unique_id "aVkwFOcFqdpu6TNsuWoFygAAAAA"]
[Sat Jan 03 23:04:52.928978 2026] [:error] [pid 31630:tid 31645] [client 98.70.127.32:14525] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ahax.php"] [unique_id "aVkwFPUV_PU2SWgLPuh0iAAAAY0"]
[Sat Jan 03 23:04:53.229639 2026] [:error] [pid 31222:tid 31231] [client 98.70.127.32:14400] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ahax.php"] [unique_id "aVkwFaHw6nASHXAc2v_8QgAAAcc"]
[Sat Jan 03 23:04:53.529820 2026] [:error] [pid 34260:tid 34283] [client 98.70.127.32:14524] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ahax.php"] [unique_id "aVkwFUWWhyvZ0O9KNVQ4wgAAARU"]
[Sat Jan 03 23:04:53.819625 2026] [:error] [pid 34260:tid 34286] [client 98.70.127.32:14458] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ahax.php"] [unique_id "aVkwFUWWhyvZ0O9KNVQ4xAAAARg"]
[Sat Jan 03 23:04:54.108468 2026] [:error] [pid 19639:tid 19642] [client 98.70.127.32:14403] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww3.php"] [unique_id "aVkwFiQ7fWZUytnlHEwQGgAAAUE"]
[Sat Jan 03 23:04:54.402510 2026] [:error] [pid 2083:tid 2102] [client 98.70.127.32:14292] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww3.php"] [unique_id "aVkwFjVlR_BmlMPnhV4tpQAAANE"]
[Sat Jan 03 23:04:54.689309 2026] [:error] [pid 2083:tid 2096] [client 98.70.127.32:14457] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww3.php"] [unique_id "aVkwFjVlR_BmlMPnhV4tpgAAAMs"]
[Sat Jan 03 23:04:54.977613 2026] [:error] [pid 2083:tid 2108] [client 98.70.127.32:14465] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww3.php"] [unique_id "aVkwFjVlR_BmlMPnhV4tqQAAANc"]
[Sat Jan 03 23:04:55.263170 2026] [:error] [pid 31630:tid 31646] [client 98.70.127.32:19802] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ghreshttryu.php"] [unique_id "aVkwF_UV_PU2SWgLPuh0jQAAAY4"]
[Sat Jan 03 23:04:55.549950 2026] [:error] [pid 31222:tid 31243] [client 98.70.127.32:14362] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ghreshttryu.php"] [unique_id "aVkwF6Hw6nASHXAc2v_8SwAAAdM"]
[Sat Jan 03 23:04:55.851504 2026] [:error] [pid 1929:tid 1959] [client 98.70.127.32:14500] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ghreshttryu.php"] [unique_id "aVkwF-cFqdpu6TNsuWoF0wAAABU"]
[Sat Jan 03 23:04:56.141873 2026] [:error] [pid 34260:tid 34280] [client 98.70.127.32:14379] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ghreshttryu.php"] [unique_id "aVkwGEWWhyvZ0O9KNVQ4zQAAARI"]
[Sat Jan 03 23:04:56.426012 2026] [:error] [pid 1931:tid 2038] [client 98.70.127.32:14361] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aVkwGB8Tyw7ZoIdXlcYf0AAAAI4"]
[Sat Jan 03 23:04:56.702318 2026] [:error] [pid 34260:tid 34276] [client 98.70.127.32:14436] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aVkwGEWWhyvZ0O9KNVQ40wAAAQ4"]
[Sat Jan 03 23:04:56.992766 2026] [:error] [pid 2083:tid 2100] [client 98.70.127.32:14391] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aVkwGDVlR_BmlMPnhV4trQAAAM8"]
[Sat Jan 03 23:04:57.279399 2026] [:error] [pid 1931:tid 2041] [client 98.70.127.32:14366] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aVkwGR8Tyw7ZoIdXlcYf1AAAAJE"]
[Sat Jan 03 23:04:57.700515 2026] [:error] [pid 1929:tid 1940] [client 98.70.127.32:14309] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "aVkwGecFqdpu6TNsuWoF2QAAAAI"]
[Sat Jan 03 23:04:58.048957 2026] [:error] [pid 31630:tid 31644] [client 98.70.127.32:14443] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "aVkwGvUV_PU2SWgLPuh0kAAAAYw"]
[Sat Jan 03 23:04:58.427528 2026] [:error] [pid 1930:tid 1969] [client 98.70.127.32:14407] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "aVkwGpP-6mqhfUDa89z3rQAAAEM"]
[Sat Jan 03 23:04:58.744218 2026] [:error] [pid 1930:tid 1971] [client 98.70.127.32:14354] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "aVkwGpP-6mqhfUDa89z3sAAAAEU"]
[Sat Jan 03 23:04:59.112286 2026] [:error] [pid 2083:tid 2088] [client 98.70.127.32:14326] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aVkwGzVlR_BmlMPnhV4tsgAAAMM"]
[Sat Jan 03 23:04:59.438661 2026] [:error] [pid 1931:tid 2043] [client 98.70.127.32:14445] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aVkwGx8Tyw7ZoIdXlcYf2AAAAJM"]
[Sat Jan 03 23:04:59.717694 2026] [:error] [pid 31222:tid 31248] [client 98.70.127.32:14415] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aVkwG6Hw6nASHXAc2v_8WQAAAdg"]
[Sat Jan 03 23:05:00.014408 2026] [:error] [pid 1931:tid 2030] [client 98.70.127.32:14418] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aVkwHB8Tyw7ZoIdXlcYf3QAAAIY"]
[Sat Jan 03 23:05:00.376397 2026] [:error] [pid 1931:tid 2036] [client 98.70.127.32:14299] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc3.php"] [unique_id "aVkwHB8Tyw7ZoIdXlcYf4QAAAIw"]
[Sat Jan 03 23:05:00.663838 2026] [:error] [pid 1931:tid 2039] [client 98.70.127.32:14462] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc3.php"] [unique_id "aVkwHB8Tyw7ZoIdXlcYf4gAAAI8"]
[Sat Jan 03 23:05:01.009385 2026] [:error] [pid 2083:tid 2109] [client 98.70.127.32:14355] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc3.php"] [unique_id "aVkwHTVlR_BmlMPnhV4ttgAAANg"]
[Sat Jan 03 23:05:01.384784 2026] [:error] [pid 34260:tid 34286] [client 98.70.127.32:14419] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc3.php"] [unique_id "aVkwHUWWhyvZ0O9KNVQ46AAAARg"]
[Sat Jan 03 23:05:01.663448 2026] [:error] [pid 19639:tid 19644] [client 98.70.127.32:19745] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3i8som87avh59dosfymtvCakc.php"] [unique_id "aVkwHSQ7fWZUytnlHEwQLQAAAUM"]
[Sat Jan 03 23:05:01.950103 2026] [:error] [pid 31222:tid 31225] [client 98.70.127.32:14517] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3i8som87avh59dosfymtvCakc.php"] [unique_id "aVkwHaHw6nASHXAc2v_8YQAAAcE"]
[Sat Jan 03 23:05:02.260728 2026] [:error] [pid 34260:tid 34263] [client 98.70.127.32:14369] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3i8som87avh59dosfymtvCakc.php"] [unique_id "aVkwHkWWhyvZ0O9KNVQ46wAAAQE"]
[Sat Jan 03 23:05:02.683965 2026] [:error] [pid 19639:tid 19642] [client 98.70.127.32:14382] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3i8som87avh59dosfymtvCakc.php"] [unique_id "aVkwHiQ7fWZUytnlHEwQMgAAAUE"]
[Sat Jan 03 23:05:03.098944 2026] [:error] [pid 31222:tid 31246] [client 98.70.127.32:14381] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aVkwH6Hw6nASHXAc2v_8ZAAAAdY"]
[Sat Jan 03 23:05:03.392558 2026] [:error] [pid 34260:tid 34266] [client 98.70.127.32:14440] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aVkwH0WWhyvZ0O9KNVQ47QAAAQQ"]
[Sat Jan 03 23:05:03.672193 2026] [:error] [pid 31222:tid 31232] [client 98.70.127.32:14385] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aVkwH6Hw6nASHXAc2v_8ZwAAAcg"]
[Sat Jan 03 23:05:04.048083 2026] [:error] [pid 1930:tid 1971] [client 98.70.127.32:14444] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aVkwIJP-6mqhfUDa89z3xQAAAEU"]
[Sat Jan 03 23:05:04.380111 2026] [:error] [pid 34260:tid 34267] [client 98.70.127.32:14452] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/44.php"] [unique_id "aVkwIEWWhyvZ0O9KNVQ49AAAAQU"]
[Sat Jan 03 23:05:04.697978 2026] [:error] [pid 19639:tid 19662] [client 98.70.127.32:14380] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/44.php"] [unique_id "aVkwICQ7fWZUytnlHEwQNwAAAVU"]
[Sat Jan 03 23:05:05.011927 2026] [:error] [pid 1931:tid 2034] [client 98.70.127.32:14496] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/44.php"] [unique_id "aVkwIR8Tyw7ZoIdXlcYgAAAAAIo"]
[Sat Jan 03 23:05:05.381468 2026] [:error] [pid 31222:tid 31231] [client 98.70.127.32:14460] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/44.php"] [unique_id "aVkwIaHw6nASHXAc2v_8bgAAAcc"]
[Sat Jan 03 23:05:05.776522 2026] [:error] [pid 34260:tid 34280] [client 98.70.127.32:14450] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid3.php"] [unique_id "aVkwIUWWhyvZ0O9KNVQ49gAAARI"]
[Sat Jan 03 23:05:06.139807 2026] [:error] [pid 1930:tid 1973] [client 98.70.127.32:14434] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid3.php"] [unique_id "aVkwIpP-6mqhfUDa89z3zQAAAEc"]
[Sat Jan 03 23:05:06.453803 2026] [:error] [pid 1930:tid 1968] [client 98.70.127.32:14343] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid3.php"] [unique_id "aVkwIpP-6mqhfUDa89z3zwAAAEI"]
[Sat Jan 03 23:05:06.753493 2026] [:error] [pid 19639:tid 19652] [client 98.70.127.32:14302] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid3.php"] [unique_id "aVkwIiQ7fWZUytnlHEwQOwAAAUs"]
[Sat Jan 03 23:05:07.061441 2026] [:error] [pid 19639:tid 19664] [client 98.70.127.32:14346] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/re.php"] [unique_id "aVkwIyQ7fWZUytnlHEwQPgAAAVc"]
[Sat Jan 03 23:05:07.456036 2026] [:error] [pid 34260:tid 34284] [client 98.70.127.32:14386] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/re.php"] [unique_id "aVkwI0WWhyvZ0O9KNVQ4_AAAARY"]
[Sat Jan 03 23:05:07.804293 2026] [:error] [pid 34260:tid 34283] [client 98.70.127.32:14323] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/re.php"] [unique_id "aVkwI0WWhyvZ0O9KNVQ4_gAAARU"]
[Sat Jan 03 23:05:08.131367 2026] [:error] [pid 34260:tid 34263] [client 98.70.127.32:14450] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/re.php"] [unique_id "aVkwJEWWhyvZ0O9KNVQ5AgAAAQE"]
[Sat Jan 03 23:05:08.457320 2026] [:error] [pid 1930:tid 1972] [client 98.70.127.32:14342] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qhLaGswd9DS.php"] [unique_id "aVkwJJP-6mqhfUDa89z32AAAAEY"]
[Sat Jan 03 23:05:08.792397 2026] [:error] [pid 34260:tid 34279] [client 98.70.127.32:14461] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qhLaGswd9DS.php"] [unique_id "aVkwJEWWhyvZ0O9KNVQ5BgAAARE"]
[Sat Jan 03 23:05:09.095344 2026] [:error] [pid 19639:tid 19650] [client 98.70.127.32:14363] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qhLaGswd9DS.php"] [unique_id "aVkwJSQ7fWZUytnlHEwQQwAAAUk"]
[Sat Jan 03 23:05:09.383619 2026] [:error] [pid 31222:tid 31242] [client 98.70.127.32:14515] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qhLaGswd9DS.php"] [unique_id "aVkwJaHw6nASHXAc2v_8dwAAAdI"]
[Sat Jan 03 23:05:09.783452 2026] [:error] [pid 31630:tid 31647] [client 98.70.127.32:14582] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/error_log.php"] [unique_id "aVkwJfUV_PU2SWgLPuh0oQAAAY8"]
[Sat Jan 03 23:05:10.105426 2026] [:error] [pid 2083:tid 2105] [client 98.70.127.32:14347] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/error_log.php"] [unique_id "aVkwJjVlR_BmlMPnhV4twAAAANQ"]
[Sat Jan 03 23:05:10.458847 2026] [:error] [pid 1930:tid 1980] [client 98.70.127.32:14507] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/error_log.php"] [unique_id "aVkwJpP-6mqhfUDa89z33AAAAE4"]
[Sat Jan 03 23:05:10.766112 2026] [:error] [pid 1930:tid 1979] [client 98.70.127.32:14356] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/error_log.php"] [unique_id "aVkwJpP-6mqhfUDa89z33wAAAE0"]
[Sat Jan 03 23:05:11.056010 2026] [:error] [pid 1930:tid 1967] [client 98.70.127.32:14482] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "aVkwJ5P-6mqhfUDa89z34wAAAEE"]
[Sat Jan 03 23:05:11.371308 2026] [:error] [pid 1930:tid 1976] [client 98.70.127.32:14389] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "aVkwJ5P-6mqhfUDa89z35QAAAEo"]
[Sat Jan 03 23:05:11.726927 2026] [:error] [pid 31222:tid 31236] [client 98.70.127.32:14352] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "aVkwJ6Hw6nASHXAc2v_8ewAAAcw"]
[Sat Jan 03 23:05:12.039009 2026] [:error] [pid 31222:tid 31230] [client 98.70.127.32:14275] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "aVkwKKHw6nASHXAc2v_8fgAAAcY"]
[Sat Jan 03 23:05:12.355822 2026] [:error] [pid 31630:tid 31654] [client 98.70.127.32:14291] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s.php"] [unique_id "aVkwKPUV_PU2SWgLPuh0pwAAAZY"]
[Sat Jan 03 23:05:12.657525 2026] [:error] [pid 2083:tid 2101] [client 98.70.127.32:14335] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s.php"] [unique_id "aVkwKDVlR_BmlMPnhV4tzAAAANA"]
[Sat Jan 03 23:05:12.950283 2026] [:error] [pid 34260:tid 34280] [client 98.70.127.32:14424] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s.php"] [unique_id "aVkwKEWWhyvZ0O9KNVQ5DQAAARI"]
[Sat Jan 03 23:05:13.263114 2026] [:error] [pid 2083:tid 2108] [client 98.70.127.32:14388] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s.php"] [unique_id "aVkwKTVlR_BmlMPnhV4t0gAAANc"]
[Sat Jan 03 23:05:13.571435 2026] [:error] [pid 19639:tid 19662] [client 98.70.127.32:14289] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVkwKSQ7fWZUytnlHEwQTQAAAVU"]
[Sat Jan 03 23:05:13.863751 2026] [:error] [pid 19639:tid 19652] [client 98.70.127.32:14397] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVkwKSQ7fWZUytnlHEwQUQAAAUs"]
[Sat Jan 03 23:05:14.162302 2026] [:error] [pid 1929:tid 1953] [client 98.70.127.32:14310] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVkwKucFqdpu6TNsuWoF6gAAAA8"]
[Sat Jan 03 23:05:14.456198 2026] [:error] [pid 1931:tid 2039] [client 98.70.127.32:19791] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVkwKh8Tyw7ZoIdXlcYgGQAAAI8"]
[Sat Jan 03 23:05:14.763712 2026] [:error] [pid 2083:tid 2107] [client 98.70.127.32:14236] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dparm.php"] [unique_id "aVkwKjVlR_BmlMPnhV4t2wAAANY"]
[Sat Jan 03 23:05:15.115841 2026] [:error] [pid 19639:tid 19658] [client 98.70.127.32:14300] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dparm.php"] [unique_id "aVkwKyQ7fWZUytnlHEwQWgAAAVE"]
[Sat Jan 03 23:05:15.401353 2026] [:error] [pid 19639:tid 19645] [client 98.70.127.32:14351] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dparm.php"] [unique_id "aVkwKyQ7fWZUytnlHEwQXwAAAUQ"]
[Sat Jan 03 23:05:15.723034 2026] [:error] [pid 1931:tid 1999] [client 98.70.127.32:14359] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dparm.php"] [unique_id "aVkwKx8Tyw7ZoIdXlcYgHgAAAIM"]
[Sat Jan 03 23:05:16.067900 2026] [:error] [pid 1929:tid 1956] [client 98.70.127.32:14367] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "aVkwLOcFqdpu6TNsuWoF7gAAABI"]
[Sat Jan 03 23:05:16.390089 2026] [:error] [pid 19639:tid 19651] [client 98.70.127.32:14219] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "aVkwLCQ7fWZUytnlHEwQYAAAAUo"]
[Sat Jan 03 23:05:16.762121 2026] [:error] [pid 31630:tid 31651] [client 98.70.127.32:14428] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "aVkwLPUV_PU2SWgLPuh0qwAAAZM"]
[Sat Jan 03 23:05:17.097859 2026] [:error] [pid 2083:tid 2090] [client 98.70.127.32:14365] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "aVkwLTVlR_BmlMPnhV4t6QAAAMU"]
[Sat Jan 03 23:05:17.458244 2026] [:error] [pid 2083:tid 2106] [client 98.70.127.32:14334] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/veuntzdf.php"] [unique_id "aVkwLTVlR_BmlMPnhV4t6wAAANU"]
[Sat Jan 03 23:05:17.810622 2026] [:error] [pid 1929:tid 1944] [client 98.70.127.32:14232] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/veuntzdf.php"] [unique_id "aVkwLecFqdpu6TNsuWoF-QAAAAY"]
[Sat Jan 03 23:05:18.161661 2026] [:error] [pid 19639:tid 19646] [client 98.70.127.32:19759] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/veuntzdf.php"] [unique_id "aVkwLiQ7fWZUytnlHEwQYgAAAUU"]
[Sat Jan 03 23:05:18.463942 2026] [:error] [pid 2083:tid 2088] [client 98.70.127.32:14283] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/veuntzdf.php"] [unique_id "aVkwLjVlR_BmlMPnhV4t8QAAAMM"]
[Sat Jan 03 23:05:18.789506 2026] [:error] [pid 1931:tid 2034] [client 98.70.127.32:14447] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qsntqiho.php"] [unique_id "aVkwLh8Tyw7ZoIdXlcYgKwAAAIo"]
[Sat Jan 03 23:05:19.124718 2026] [:error] [pid 1929:tid 1956] [client 98.70.127.32:14394] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qsntqiho.php"] [unique_id "aVkwL-cFqdpu6TNsuWoGAQAAABI"]
[Sat Jan 03 23:05:19.409861 2026] [:error] [pid 34260:tid 34270] [client 98.70.127.32:14372] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qsntqiho.php"] [unique_id "aVkwL0WWhyvZ0O9KNVQ5IwAAAQg"]
[Sat Jan 03 23:05:19.744882 2026] [:error] [pid 1931:tid 2032] [client 98.70.127.32:14384] [client 98.70.127.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qsntqiho.php"] [unique_id "aVkwLx8Tyw7ZoIdXlcYgLQAAAIg"]
[Sat Jan 03 23:12:06.286020 2026] [:error] [pid 31630:tid 31645] [client 49.51.204.74:44112] [client 49.51.204.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVkxxvUV_PU2SWgLPuh2RgAAAY0"]
[Sat Jan 03 23:32:15.010511 2026] [:error] [pid 31630:tid 31637] [client 89.46.110.119:31570] [client 89.46.110.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.46.110.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVk2f_UV_PU2SWgLPuh7CgAAAYU"]
[Sat Jan 03 23:34:33.002706 2026] [:error] [pid 19639:tid 19645] [client 185.141.133.58:35214] [client 185.141.133.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.141.133.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVk3CSQ7fWZUytnlHEwXOQAAAUQ"]
[Sat Jan 03 23:51:01.370255 2026] [:error] [pid 1929:tid 1942] [client 198.12.237.108:60158] [client 198.12.237.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.12.237.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVk65ecFqdpu6TNsuWoUzQAAAAQ"]
[Sun Jan 04 00:03:38.067027 2026] [:error] [pid 1931:tid 2034] [client 190.107.177.240:53508] [client 190.107.177.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.107.177.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVk92h8Tyw7ZoIdXlcY3iwAAAIo"]
[Sun Jan 04 00:24:41.875997 2026] [:error] [pid 49319:tid 49328] [client 103.49.70.23:36812] [client 103.49.70.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.49.70.23, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVlCybcNXYLFZOiX4cQJqQAAAMc"]
[Sun Jan 04 00:36:26.687965 2026] [:error] [pid 49230:tid 49293] [client 173.201.180.210:28408] [client 173.201.180.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.201.180.210, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVlFin2klmw7JRfgM3ii_AAAAIU"]
[Sun Jan 04 00:47:56.546082 2026] [:error] [pid 49228:tid 49239] [client 44.224.60.2:37456] [client 44.224.60.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 44.224.60.2, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVlIPHCPk2c4rRZq2JTlGgAAAAY"]
[Sun Jan 04 01:39:37.000280 2026] [:error] [pid 49229:tid 49274] [client 5.39.65.19:38062] [client 5.39.65.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.39.65.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVlUWFCM4R1akb8JNI6zjAAAAE0"]
[Sun Jan 04 02:01:09.258208 2026] [:error] [pid 49229:tid 49274] [client 4.197.234.159:56695] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aVlZZVCM4R1akb8JNI7A3AAAAE0"]
[Sun Jan 04 02:01:09.498683 2026] [:error] [pid 49230:tid 49309] [client 4.197.234.159:56009] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aVlZZX2klmw7JRfgM3jQfgAAAJU"]
[Sun Jan 04 02:01:09.641049 2026] [:error] [pid 49229:tid 49263] [client 4.197.234.159:62574] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aVlZZVCM4R1akb8JNI7A4AAAAEI"]
[Sun Jan 04 02:01:10.084130 2026] [:error] [pid 49319:tid 49328] [client 4.197.234.159:3008] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aVlZZrcNXYLFZOiX4cRPjAAAAMc"]
[Sun Jan 04 02:01:10.429516 2026] [:error] [pid 49230:tid 49307] [client 4.197.234.159:55992] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f5.php"] [unique_id "aVlZZn2klmw7JRfgM3jQggAAAJM"]
[Sun Jan 04 02:01:10.708633 2026] [:error] [pid 49230:tid 49306] [client 4.197.234.159:55994] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f5.php"] [unique_id "aVlZZn2klmw7JRfgM3jQhAAAAJI"]
[Sun Jan 04 02:01:12.467873 2026] [:error] [pid 49319:tid 49341] [client 4.197.234.159:56671] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f5.php"] [unique_id "aVlZaLcNXYLFZOiX4cRPngAAANQ"]
[Sun Jan 04 02:01:13.322497 2026] [:error] [pid 49319:tid 49325] [client 4.197.234.159:2354] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f5.php"] [unique_id "aVlZabcNXYLFZOiX4cRPqAAAAMQ"]
[Sun Jan 04 02:01:14.044876 2026] [:error] [pid 49319:tid 49332] [client 4.197.234.159:62542] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aVlZarcNXYLFZOiX4cRPrAAAAMs"]
[Sun Jan 04 02:01:14.341171 2026] [:error] [pid 49228:tid 49249] [client 4.197.234.159:55981] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aVlZanCPk2c4rRZq2JQIDgAAABA"]
[Sun Jan 04 02:01:15.107891 2026] [:error] [pid 49319:tid 49327] [client 4.197.234.159:64249] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aVlZa7cNXYLFZOiX4cRPswAAAMY"]
[Sun Jan 04 02:01:15.226965 2026] [:error] [pid 49319:tid 49330] [client 4.197.234.159:62548] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aVlZa7cNXYLFZOiX4cRPtgAAAMk"]
[Sun Jan 04 02:01:15.515010 2026] [:error] [pid 49228:tid 49237] [client 4.197.234.159:2800] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/51.php"] [unique_id "aVlZa3CPk2c4rRZq2JQIFQAAAAQ"]
[Sun Jan 04 02:01:16.661705 2026] [:error] [pid 49230:tid 49295] [client 4.197.234.159:55954] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/51.php"] [unique_id "aVlZbH2klmw7JRfgM3jQlQAAAIc"]
[Sun Jan 04 02:01:16.922090 2026] [:error] [pid 49319:tid 49327] [client 4.197.234.159:64237] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/51.php"] [unique_id "aVlZbLcNXYLFZOiX4cRPwQAAAMY"]
[Sun Jan 04 02:01:17.241148 2026] [:error] [pid 49229:tid 49282] [client 4.197.234.159:64251] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/51.php"] [unique_id "aVlZbVCM4R1akb8JNI7A6AAAAFU"]
[Sun Jan 04 02:01:17.431281 2026] [:error] [pid 49319:tid 49333] [client 4.197.234.159:55977] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "aVlZbbcNXYLFZOiX4cRPxAAAAMw"]
[Sun Jan 04 02:01:17.668513 2026] [:error] [pid 49230:tid 49307] [client 4.197.234.159:3047] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "aVlZbX2klmw7JRfgM3jQmAAAAJM"]
[Sun Jan 04 02:01:17.897595 2026] [:error] [pid 49230:tid 49289] [client 4.197.234.159:2331] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "aVlZbX2klmw7JRfgM3jQmgAAAIE"]
[Sun Jan 04 02:01:18.176117 2026] [:error] [pid 49319:tid 49336] [client 4.197.234.159:64228] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "aVlZbrcNXYLFZOiX4cRPyQAAAM8"]
[Sun Jan 04 02:01:18.519311 2026] [:error] [pid 49319:tid 49334] [client 4.197.234.159:2344] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s1.php"] [unique_id "aVlZbrcNXYLFZOiX4cRPzgAAAM0"]
[Sun Jan 04 02:01:18.813615 2026] [:error] [pid 49319:tid 49343] [client 4.197.234.159:64254] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s1.php"] [unique_id "aVlZbrcNXYLFZOiX4cRP0QAAANY"]
[Sun Jan 04 02:01:19.202265 2026] [:error] [pid 49319:tid 49322] [client 4.197.234.159:2788] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s1.php"] [unique_id "aVlZb7cNXYLFZOiX4cRP1QAAAME"]
[Sun Jan 04 02:01:20.367011 2026] [:error] [pid 49228:tid 49235] [client 4.197.234.159:55999] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s1.php"] [unique_id "aVlZcHCPk2c4rRZq2JQIHgAAAAI"]
[Sun Jan 04 02:01:20.949621 2026] [:error] [pid 49229:tid 49279] [client 4.197.234.159:27267] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f2f.php"] [unique_id "aVlZcFCM4R1akb8JNI7A7AAAAFI"]
[Sun Jan 04 02:01:21.267039 2026] [:error] [pid 49230:tid 49292] [client 4.197.234.159:2518] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f2f.php"] [unique_id "aVlZcX2klmw7JRfgM3jQowAAAIQ"]
[Sun Jan 04 02:01:21.537129 2026] [:error] [pid 49229:tid 49283] [client 4.197.234.159:64239] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f2f.php"] [unique_id "aVlZcVCM4R1akb8JNI7A8wAAAFY"]
[Sun Jan 04 02:01:22.142627 2026] [:error] [pid 49229:tid 49275] [client 4.197.234.159:62529] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f2f.php"] [unique_id "aVlZclCM4R1akb8JNI7A9wAAAE4"]
[Sun Jan 04 02:01:22.759380 2026] [:error] [pid 49230:tid 49312] [client 4.197.234.159:62550] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ths.php"] [unique_id "aVlZcn2klmw7JRfgM3jQpAAAAJg"]
[Sun Jan 04 02:01:23.210837 2026] [:error] [pid 49229:tid 49264] [client 4.197.234.159:3067] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ths.php"] [unique_id "aVlZc1CM4R1akb8JNI7A-QAAAEM"]
[Sun Jan 04 02:01:24.131916 2026] [:error] [pid 49229:tid 49281] [client 4.197.234.159:2771] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ths.php"] [unique_id "aVlZdFCM4R1akb8JNI7BAAAAAFQ"]
[Sun Jan 04 02:01:24.858499 2026] [:error] [pid 49319:tid 49342] [client 4.197.234.159:62589] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ths.php"] [unique_id "aVlZdLcNXYLFZOiX4cRP-AAAANU"]
[Sun Jan 04 02:01:25.311179 2026] [:error] [pid 49319:tid 49322] [client 4.197.234.159:56056] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xw.php"] [unique_id "aVlZdbcNXYLFZOiX4cRP_gAAAME"]
[Sun Jan 04 02:01:25.698426 2026] [:error] [pid 49319:tid 49323] [client 4.197.234.159:27283] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xw.php"] [unique_id "aVlZdbcNXYLFZOiX4cRQBAAAAMI"]
[Sun Jan 04 02:01:25.995831 2026] [:error] [pid 49229:tid 49272] [client 4.197.234.159:27270] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xw.php"] [unique_id "aVlZdVCM4R1akb8JNI7BDAAAAEs"]
[Sun Jan 04 02:01:26.498373 2026] [:error] [pid 49228:tid 49247] [client 4.197.234.159:2811] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xw.php"] [unique_id "aVlZdnCPk2c4rRZq2JQINQAAAA4"]
[Sun Jan 04 02:01:27.377101 2026] [:error] [pid 49228:tid 49241] [client 4.197.234.159:62581] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ma.php"] [unique_id "aVlZd3CPk2c4rRZq2JQIOwAAAAg"]
[Sun Jan 04 02:01:27.923333 2026] [:error] [pid 49319:tid 49333] [client 4.197.234.159:2755] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ma.php"] [unique_id "aVlZd7cNXYLFZOiX4cRQKgAAAMw"]
[Sun Jan 04 02:01:28.278762 2026] [:error] [pid 49230:tid 49301] [client 4.197.234.159:56054] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ma.php"] [unique_id "aVlZeH2klmw7JRfgM3jQvQAAAI0"]
[Sun Jan 04 02:01:28.486280 2026] [:error] [pid 49230:tid 49298] [client 4.197.234.159:3041] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ma.php"] [unique_id "aVlZeH2klmw7JRfgM3jQvgAAAIo"]
[Sun Jan 04 02:01:28.577433 2026] [:error] [pid 49319:tid 49343] [client 4.197.234.159:56048] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lanz.php"] [unique_id "aVlZeLcNXYLFZOiX4cRQNwAAANY"]
[Sun Jan 04 02:01:28.858483 2026] [:error] [pid 49229:tid 49274] [client 4.197.234.159:64236] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lanz.php"] [unique_id "aVlZeFCM4R1akb8JNI7BGQAAAE0"]
[Sun Jan 04 02:01:29.739140 2026] [:error] [pid 49230:tid 49308] [client 4.197.234.159:62585] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lanz.php"] [unique_id "aVlZeX2klmw7JRfgM3jQxgAAAJQ"]
[Sun Jan 04 02:01:30.423287 2026] [:error] [pid 49230:tid 49301] [client 4.197.234.159:56008] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lanz.php"] [unique_id "aVlZen2klmw7JRfgM3jQzAAAAI0"]
[Sun Jan 04 02:01:30.934351 2026] [:error] [pid 49229:tid 49270] [client 4.197.234.159:62563] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tons.php"] [unique_id "aVlZelCM4R1akb8JNI7BKAAAAEk"]
[Sun Jan 04 02:01:31.484733 2026] [:error] [pid 49229:tid 49283] [client 4.197.234.159:2802] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tons.php"] [unique_id "aVlZe1CM4R1akb8JNI7BKwAAAFY"]
[Sun Jan 04 02:01:31.964618 2026] [:error] [pid 49319:tid 49344] [client 4.197.234.159:56032] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tons.php"] [unique_id "aVlZe7cNXYLFZOiX4cRQYwAAANc"]
[Sun Jan 04 02:01:32.638105 2026] [:error] [pid 49230:tid 49306] [client 4.197.234.159:64201] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tons.php"] [unique_id "aVlZfH2klmw7JRfgM3jQ3QAAAJI"]
[Sun Jan 04 02:01:33.083715 2026] [:error] [pid 49228:tid 49249] [client 4.197.234.159:2799] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "aVlZfXCPk2c4rRZq2JQIVAAAABA"]
[Sun Jan 04 02:01:33.384441 2026] [:error] [pid 49228:tid 49246] [client 4.197.234.159:27304] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "aVlZfXCPk2c4rRZq2JQIVwAAAA0"]
[Sun Jan 04 02:01:34.360503 2026] [:error] [pid 49229:tid 49273] [client 4.197.234.159:64192] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "aVlZflCM4R1akb8JNI7BOQAAAEw"]
[Sun Jan 04 02:01:35.244500 2026] [:error] [pid 49228:tid 49254] [client 4.197.234.159:27274] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "aVlZf3CPk2c4rRZq2JQIYQAAABU"]
[Sun Jan 04 02:01:36.825052 2026] [:error] [pid 49229:tid 49283] [client 4.197.234.159:57684] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aVlZgFCM4R1akb8JNI7BSAAAAFY"]
[Sun Jan 04 02:01:37.378437 2026] [:error] [pid 49229:tid 49263] [client 4.197.234.159:64230] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aVlZgVCM4R1akb8JNI7BTgAAAEI"]
[Sun Jan 04 02:01:37.865911 2026] [:error] [pid 49319:tid 49324] [client 4.197.234.159:27324] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aVlZgbcNXYLFZOiX4cRQsgAAAMM"]
[Sun Jan 04 02:01:38.190801 2026] [:error] [pid 49230:tid 49289] [client 4.197.234.159:57694] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aVlZgn2klmw7JRfgM3jRBAAAAIE"]
[Sun Jan 04 02:01:38.885229 2026] [:error] [pid 49229:tid 49285] [client 4.197.234.159:3054] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aVlZglCM4R1akb8JNI7BYwAAAFg"]
[Sun Jan 04 02:01:39.030021 2026] [:error] [pid 49229:tid 49262] [client 4.197.234.159:27293] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aVlZg1CM4R1akb8JNI7BZAAAAEE"]
[Sun Jan 04 02:01:39.195398 2026] [:error] [pid 49229:tid 49276] [client 4.197.234.159:3037] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aVlZg1CM4R1akb8JNI7BaAAAAE8"]
[Sun Jan 04 02:01:39.428765 2026] [:error] [pid 49229:tid 49283] [client 4.197.234.159:56000] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aVlZg1CM4R1akb8JNI7BbwAAAFY"]
[Sun Jan 04 02:01:39.913374 2026] [:error] [pid 49229:tid 49262] [client 4.197.234.159:64233] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f8.php"] [unique_id "aVlZg1CM4R1akb8JNI7BeAAAAEE"]
[Sun Jan 04 02:01:40.092125 2026] [:error] [pid 49230:tid 49295] [client 4.197.234.159:56692] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f8.php"] [unique_id "aVlZhH2klmw7JRfgM3jRDAAAAIc"]
[Sun Jan 04 02:01:40.299006 2026] [:error] [pid 49319:tid 49339] [client 4.197.234.159:56045] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f8.php"] [unique_id "aVlZhLcNXYLFZOiX4cRQxgAAANI"]
[Sun Jan 04 02:01:41.365922 2026] [:error] [pid 49230:tid 49289] [client 4.197.234.159:2776] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f8.php"] [unique_id "aVlZhX2klmw7JRfgM3jREAAAAIE"]
[Sun Jan 04 02:01:42.217170 2026] [:error] [pid 49230:tid 49302] [client 4.197.234.159:2364] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aVlZhn2klmw7JRfgM3jRFAAAAI4"]
[Sun Jan 04 02:01:42.603993 2026] [:error] [pid 49229:tid 49270] [client 4.197.234.159:57859] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aVlZhlCM4R1akb8JNI7BlQAAAEk"]
[Sun Jan 04 02:01:43.160509 2026] [:error] [pid 49319:tid 49321] [client 4.197.234.159:2808] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aVlZh7cNXYLFZOiX4cRQ0QAAAMA"]
[Sun Jan 04 02:01:43.683161 2026] [:error] [pid 49319:tid 49335] [client 4.197.234.159:27305] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aVlZh7cNXYLFZOiX4cRQ1wAAAM4"]
[Sun Jan 04 02:01:43.931134 2026] [:error] [pid 49319:tid 49338] [client 4.197.234.159:57717] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an8.php"] [unique_id "aVlZh7cNXYLFZOiX4cRQ2gAAANE"]
[Sun Jan 04 02:01:44.153401 2026] [:error] [pid 49319:tid 49342] [client 4.197.234.159:27285] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an8.php"] [unique_id "aVlZiLcNXYLFZOiX4cRQ3wAAANU"]
[Sun Jan 04 02:01:44.675535 2026] [:error] [pid 49229:tid 49266] [client 4.197.234.159:57902] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an8.php"] [unique_id "aVlZiFCM4R1akb8JNI7BmAAAAEU"]
[Sun Jan 04 02:01:45.210391 2026] [:error] [pid 49229:tid 49285] [client 4.197.234.159:57885] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an8.php"] [unique_id "aVlZiVCM4R1akb8JNI7BmwAAAFg"]
[Sun Jan 04 02:01:45.715224 2026] [:error] [pid 49228:tid 49249] [client 4.197.234.159:2792] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/esp.php"] [unique_id "aVlZiXCPk2c4rRZq2JQIhQAAABA"]
[Sun Jan 04 02:01:45.867705 2026] [:error] [pid 49228:tid 49245] [client 4.197.234.159:27321] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/esp.php"] [unique_id "aVlZiXCPk2c4rRZq2JQIiAAAAAw"]
[Sun Jan 04 02:01:46.471872 2026] [:error] [pid 49319:tid 49339] [client 4.197.234.159:55943] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/esp.php"] [unique_id "aVlZircNXYLFZOiX4cRQ5wAAANI"]
[Sun Jan 04 02:01:47.149636 2026] [:error] [pid 49230:tid 49305] [client 4.197.234.159:57706] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/esp.php"] [unique_id "aVlZi32klmw7JRfgM3jRHwAAAJE"]
[Sun Jan 04 02:01:47.460482 2026] [:error] [pid 49319:tid 49341] [client 4.197.234.159:64814] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/21x.php"] [unique_id "aVlZi7cNXYLFZOiX4cRQ6gAAANQ"]
[Sun Jan 04 02:01:47.748309 2026] [:error] [pid 49319:tid 49328] [client 4.197.234.159:64810] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/21x.php"] [unique_id "aVlZi7cNXYLFZOiX4cRQ7QAAAMc"]
[Sun Jan 04 02:01:48.290122 2026] [:error] [pid 49319:tid 49323] [client 4.197.234.159:2774] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/21x.php"] [unique_id "aVlZjLcNXYLFZOiX4cRQ8AAAAMI"]
[Sun Jan 04 02:01:48.788509 2026] [:error] [pid 49230:tid 49294] [client 4.197.234.159:2798] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/21x.php"] [unique_id "aVlZjH2klmw7JRfgM3jRIwAAAIY"]
[Sun Jan 04 02:01:49.111090 2026] [:error] [pid 49229:tid 49283] [client 4.197.234.159:57705] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xe.php"] [unique_id "aVlZjVCM4R1akb8JNI7BrQAAAFY"]
[Sun Jan 04 02:01:49.781244 2026] [:error] [pid 49229:tid 49278] [client 4.197.234.159:2762] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xe.php"] [unique_id "aVlZjVCM4R1akb8JNI7BsAAAAFE"]
[Sun Jan 04 02:01:50.420543 2026] [:error] [pid 49319:tid 49341] [client 4.197.234.159:27268] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xe.php"] [unique_id "aVlZjrcNXYLFZOiX4cRQ9wAAANQ"]
[Sun Jan 04 02:01:51.384822 2026] [:error] [pid 49319:tid 49338] [client 4.197.234.159:64800] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xe.php"] [unique_id "aVlZj7cNXYLFZOiX4cRQ_AAAANE"]
[Sun Jan 04 02:01:51.966487 2026] [:error] [pid 49319:tid 49325] [client 4.197.234.159:55957] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower2.php"] [unique_id "aVlZj7cNXYLFZOiX4cRQ_gAAAMQ"]
[Sun Jan 04 02:01:52.295599 2026] [:error] [pid 49230:tid 49290] [client 4.197.234.159:64240] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower2.php"] [unique_id "aVlZkH2klmw7JRfgM3jROQAAAII"]
[Sun Jan 04 02:01:53.255974 2026] [:error] [pid 49228:tid 49240] [client 4.197.234.159:27284] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower2.php"] [unique_id "aVlZkXCPk2c4rRZq2JQItgAAAAc"]
[Sun Jan 04 02:01:53.597722 2026] [:error] [pid 49319:tid 49340] [client 4.197.234.159:54715] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower2.php"] [unique_id "aVlZkbcNXYLFZOiX4cRRAgAAANM"]
[Sun Jan 04 02:01:53.973044 2026] [:error] [pid 49230:tid 49296] [client 4.197.234.159:54665] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws35.php"] [unique_id "aVlZkX2klmw7JRfgM3jRQQAAAIg"]
[Sun Jan 04 02:01:55.019286 2026] [:error] [pid 49230:tid 49294] [client 4.197.234.159:57905] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws35.php"] [unique_id "aVlZk32klmw7JRfgM3jRRgAAAIY"]
[Sun Jan 04 02:01:55.735685 2026] [:error] [pid 49229:tid 49268] [client 4.197.234.159:57692] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws35.php"] [unique_id "aVlZk1CM4R1akb8JNI7BxAAAAEc"]
[Sun Jan 04 02:01:56.043810 2026] [:error] [pid 49228:tid 49250] [client 4.197.234.159:57710] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws35.php"] [unique_id "aVlZlHCPk2c4rRZq2JQI4gAAABE"]
[Sun Jan 04 02:01:56.761965 2026] [:error] [pid 49229:tid 49274] [client 4.197.234.159:64219] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aVlZlFCM4R1akb8JNI7ByAAAAE0"]
[Sun Jan 04 02:01:57.176215 2026] [:error] [pid 49230:tid 49296] [client 4.197.234.159:64819] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aVlZlX2klmw7JRfgM3jRUQAAAIg"]
[Sun Jan 04 02:01:57.875810 2026] [:error] [pid 49319:tid 49329] [client 4.197.234.159:2332] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aVlZlbcNXYLFZOiX4cRRBwAAAMg"]
[Sun Jan 04 02:01:58.148776 2026] [:error] [pid 49319:tid 49333] [client 4.197.234.159:57890] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aVlZlrcNXYLFZOiX4cRRCAAAAMw"]
[Sun Jan 04 02:01:58.740191 2026] [:error] [pid 49229:tid 49265] [client 4.197.234.159:64789] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws13.php"] [unique_id "aVlZllCM4R1akb8JNI7B0gAAAEQ"]
[Sun Jan 04 02:02:00.217534 2026] [:error] [pid 49229:tid 49283] [client 4.197.234.159:64196] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws13.php"] [unique_id "aVlZmFCM4R1akb8JNI7B1gAAAFY"]
[Sun Jan 04 02:02:00.860882 2026] [:error] [pid 49229:tid 49279] [client 4.197.234.159:2793] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws13.php"] [unique_id "aVlZmFCM4R1akb8JNI7B2AAAAFI"]
[Sun Jan 04 02:02:01.314107 2026] [:error] [pid 49230:tid 49301] [client 4.197.234.159:35395] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws13.php"] [unique_id "aVlZmX2klmw7JRfgM3jRagAAAI0"]
[Sun Jan 04 02:02:01.492586 2026] [:error] [pid 49230:tid 49310] [client 4.197.234.159:54704] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss1.php"] [unique_id "aVlZmX2klmw7JRfgM3jRawAAAJY"]
[Sun Jan 04 02:02:01.707027 2026] [:error] [pid 49319:tid 49343] [client 4.197.234.159:54683] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss1.php"] [unique_id "aVlZmbcNXYLFZOiX4cRRGwAAANY"]
[Sun Jan 04 02:02:02.156268 2026] [:error] [pid 49319:tid 49331] [client 4.197.234.159:35446] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss1.php"] [unique_id "aVlZmrcNXYLFZOiX4cRRHAAAAMo"]
[Sun Jan 04 02:02:02.483189 2026] [:error] [pid 49319:tid 49337] [client 4.197.234.159:27295] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss1.php"] [unique_id "aVlZmrcNXYLFZOiX4cRRHgAAANA"]
[Sun Jan 04 02:02:03.555209 2026] [:error] [pid 49230:tid 49307] [client 4.197.234.159:54657] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww7.php"] [unique_id "aVlZm32klmw7JRfgM3jRcgAAAJM"]
[Sun Jan 04 02:02:04.848515 2026] [:error] [pid 49319:tid 49321] [client 4.197.234.159:2768] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww7.php"] [unique_id "aVlZnLcNXYLFZOiX4cRRMQAAAMA"]
[Sun Jan 04 02:02:05.057069 2026] [:error] [pid 49319:tid 49324] [client 4.197.234.159:64779] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww7.php"] [unique_id "aVlZnbcNXYLFZOiX4cRRMgAAAMM"]
[Sun Jan 04 02:02:05.180501 2026] [:error] [pid 49319:tid 49326] [client 4.197.234.159:2784] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww7.php"] [unique_id "aVlZnbcNXYLFZOiX4cRRMwAAAMU"]
[Sun Jan 04 02:02:05.520171 2026] [:error] [pid 49319:tid 49342] [client 4.197.234.159:64778] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "aVlZnbcNXYLFZOiX4cRRNwAAANU"]
[Sun Jan 04 02:02:05.593188 2026] [:error] [pid 49319:tid 49335] [client 4.197.234.159:64828] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "aVlZnbcNXYLFZOiX4cRROAAAAM4"]
[Sun Jan 04 02:02:05.881277 2026] [:error] [pid 49228:tid 49249] [client 4.197.234.159:2773] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "aVlZnXCPk2c4rRZq2JQJIQAAABA"]
[Sun Jan 04 02:02:06.288820 2026] [:error] [pid 49230:tid 49296] [client 4.197.234.159:54677] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "aVlZnn2klmw7JRfgM3jRdgAAAIg"]
[Sun Jan 04 02:02:06.374948 2026] [:error] [pid 49229:tid 49269] [client 4.197.234.159:54702] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lisa.php"] [unique_id "aVlZnlCM4R1akb8JNI7B5AAAAEg"]
[Sun Jan 04 02:02:06.536867 2026] [:error] [pid 49229:tid 49271] [client 4.197.234.159:35438] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lisa.php"] [unique_id "aVlZnlCM4R1akb8JNI7B6AAAAEo"]
[Sun Jan 04 02:02:06.751663 2026] [:error] [pid 49229:tid 49266] [client 4.197.234.159:64804] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lisa.php"] [unique_id "aVlZnlCM4R1akb8JNI7B6gAAAEU"]
[Sun Jan 04 02:02:06.915508 2026] [:error] [pid 49229:tid 49277] [client 4.197.234.159:35415] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lisa.php"] [unique_id "aVlZnlCM4R1akb8JNI7B7AAAAFA"]
[Sun Jan 04 02:02:07.798976 2026] [:error] [pid 49228:tid 49245] [client 4.197.234.159:30858] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/000.php"] [unique_id "aVlZn3CPk2c4rRZq2JQJMwAAAAw"]
[Sun Jan 04 02:02:15.255993 2026] [:error] [pid 49319:tid 49345] [client 4.197.234.159:57884] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "aVlZp7cNXYLFZOiX4cRRiQAAANg"]
[Sun Jan 04 02:02:16.023799 2026] [:error] [pid 49228:tid 49235] [client 4.197.234.159:63628] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "aVlZqHCPk2c4rRZq2JQJVwAAAAI"]
[Sun Jan 04 02:02:16.381960 2026] [:error] [pid 49228:tid 49239] [client 4.197.234.159:61260] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "aVlZqHCPk2c4rRZq2JQJWQAAAAY"]
[Sun Jan 04 02:02:17.798593 2026] [:error] [pid 49319:tid 49330] [client 4.197.234.159:2657] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "aVlZqbcNXYLFZOiX4cRRoQAAAMk"]
[Sun Jan 04 02:02:18.256250 2026] [:error] [pid 49319:tid 49324] [client 4.197.234.159:35423] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/waq.php"] [unique_id "aVlZqrcNXYLFZOiX4cRRpwAAAMM"]
[Sun Jan 04 02:02:18.858278 2026] [:error] [pid 49230:tid 49304] [client 4.197.234.159:63627] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/waq.php"] [unique_id "aVlZqn2klmw7JRfgM3jRnwAAAJA"]
[Sun Jan 04 02:02:19.119230 2026] [:error] [pid 49319:tid 49344] [client 4.197.234.159:61264] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/waq.php"] [unique_id "aVlZq7cNXYLFZOiX4cRRqwAAANc"]
[Sun Jan 04 02:02:20.218479 2026] [:error] [pid 49228:tid 49244] [client 4.197.234.159:30891] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/waq.php"] [unique_id "aVlZrHCPk2c4rRZq2JQJYQAAAAs"]
[Sun Jan 04 02:02:20.703265 2026] [:error] [pid 49229:tid 49270] [client 4.197.234.159:65378] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wakak.php"] [unique_id "aVlZrFCM4R1akb8JNI7CBwAAAEk"]
[Sun Jan 04 02:02:21.730797 2026] [:error] [pid 49229:tid 49266] [client 4.197.234.159:2667] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wakak.php"] [unique_id "aVlZrVCM4R1akb8JNI7CCAAAAEU"]
[Sun Jan 04 02:02:22.513762 2026] [:error] [pid 49319:tid 49334] [client 4.197.234.159:63632] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wakak.php"] [unique_id "aVlZrrcNXYLFZOiX4cRRzAAAAM0"]
[Sun Jan 04 02:02:23.917348 2026] [:error] [pid 49230:tid 49311] [client 4.197.234.159:30881] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wakak.php"] [unique_id "aVlZr32klmw7JRfgM3jRqQAAAJc"]
[Sun Jan 04 02:02:24.082802 2026] [:error] [pid 49319:tid 49322] [client 4.197.234.159:30877] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aVlZsLcNXYLFZOiX4cRR6AAAAME"]
[Sun Jan 04 02:02:25.182516 2026] [:error] [pid 49230:tid 49293] [client 4.197.234.159:65399] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aVlZsX2klmw7JRfgM3jRrQAAAIU"]
[Sun Jan 04 02:02:25.718374 2026] [:error] [pid 49230:tid 49297] [client 4.197.234.159:2652] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aVlZsX2klmw7JRfgM3jRtQAAAIk"]
[Sun Jan 04 02:02:26.090730 2026] [:error] [pid 49319:tid 49324] [client 4.197.234.159:30908] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aVlZsrcNXYLFZOiX4cRSBAAAAMM"]
[Sun Jan 04 02:02:26.926769 2026] [:error] [pid 49228:tid 49246] [client 4.197.234.159:63641] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aVlZsnCPk2c4rRZq2JQJcQAAAA0"]
[Sun Jan 04 02:02:27.241094 2026] [:error] [pid 49319:tid 49321] [client 4.197.234.159:65299] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aVlZs7cNXYLFZOiX4cRSDgAAAMA"]
[Sun Jan 04 02:02:28.193750 2026] [:error] [pid 49228:tid 49234] [client 4.197.234.159:65336] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aVlZtHCPk2c4rRZq2JQJeAAAAAE"]
[Sun Jan 04 02:02:28.637282 2026] [:error] [pid 49230:tid 49294] [client 4.197.234.159:63640] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aVlZtH2klmw7JRfgM3jRvAAAAIY"]
[Sun Jan 04 02:02:30.068443 2026] [:error] [pid 49228:tid 49244] [client 4.197.234.159:59705] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xse25.php"] [unique_id "aVlZtnCPk2c4rRZq2JQJfwAAAAs"]
[Sun Jan 04 02:02:30.554983 2026] [:error] [pid 49230:tid 49300] [client 4.197.234.159:59686] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xse25.php"] [unique_id "aVlZtn2klmw7JRfgM3jRxAAAAIw"]
[Sun Jan 04 02:02:30.768032 2026] [:error] [pid 49228:tid 49256] [client 4.197.234.159:65405] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xse25.php"] [unique_id "aVlZtnCPk2c4rRZq2JQJgwAAABc"]
[Sun Jan 04 02:02:31.383343 2026] [:error] [pid 49229:tid 49281] [client 4.197.234.159:65289] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xse25.php"] [unique_id "aVlZt1CM4R1akb8JNI7CJAAAAFQ"]
[Sun Jan 04 02:02:31.856158 2026] [:error] [pid 49230:tid 49306] [client 4.197.234.159:65333] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aVlZt32klmw7JRfgM3jRzQAAAJI"]
[Sun Jan 04 02:02:32.450966 2026] [:error] [pid 49228:tid 49251] [client 4.197.234.159:65330] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aVlZuHCPk2c4rRZq2JQJjwAAABI"]
[Sun Jan 04 02:02:32.729634 2026] [:error] [pid 49229:tid 49271] [client 4.197.234.159:65309] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aVlZuFCM4R1akb8JNI7CJgAAAEo"]
[Sun Jan 04 02:02:33.388931 2026] [:error] [pid 49319:tid 49327] [client 4.197.234.159:61297] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aVlZubcNXYLFZOiX4cRSJQAAAMY"]
[Sun Jan 04 02:02:34.037275 2026] [:error] [pid 49319:tid 49339] [client 4.197.234.159:2672] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aVlZurcNXYLFZOiX4cRSKAAAANI"]
[Sun Jan 04 02:02:34.362514 2026] [:error] [pid 49229:tid 49281] [client 4.197.234.159:63660] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aVlZulCM4R1akb8JNI7CLQAAAFQ"]
[Sun Jan 04 02:02:34.686371 2026] [:error] [pid 49229:tid 49277] [client 4.197.234.159:63669] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aVlZulCM4R1akb8JNI7CLwAAAFA"]
[Sun Jan 04 02:02:34.916510 2026] [:error] [pid 49230:tid 49306] [client 4.197.234.159:63622] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aVlZun2klmw7JRfgM3jR3gAAAJI"]
[Sun Jan 04 02:02:35.295633 2026] [:error] [pid 49319:tid 49327] [client 4.197.234.159:30875] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aVlZu7cNXYLFZOiX4cRSMgAAAMY"]
[Sun Jan 04 02:02:35.395722 2026] [:error] [pid 49319:tid 49335] [client 4.197.234.159:2686] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aVlZu7cNXYLFZOiX4cRSNgAAAM4"]
[Sun Jan 04 02:02:35.979770 2026] [:error] [pid 49230:tid 49311] [client 4.197.234.159:2666] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aVlZu32klmw7JRfgM3jR4QAAAJc"]
[Sun Jan 04 02:02:36.557982 2026] [:error] [pid 49229:tid 49265] [client 4.197.234.159:2651] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aVlZvFCM4R1akb8JNI7CNQAAAEQ"]
[Sun Jan 04 02:02:36.897585 2026] [:error] [pid 49319:tid 49325] [client 4.197.234.159:65363] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aVlZvLcNXYLFZOiX4cRSPgAAAMQ"]
[Sun Jan 04 02:02:37.146747 2026] [:error] [pid 49229:tid 49263] [client 4.197.234.159:61269] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aVlZvVCM4R1akb8JNI7COQAAAEI"]
[Sun Jan 04 02:02:37.470022 2026] [:error] [pid 49229:tid 49283] [client 4.197.234.159:2676] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aVlZvVCM4R1akb8JNI7COgAAAFY"]
[Sun Jan 04 02:02:37.657725 2026] [:error] [pid 49229:tid 49275] [client 4.197.234.159:65344] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aVlZvVCM4R1akb8JNI7CPQAAAE4"]
[Sun Jan 04 02:02:38.105040 2026] [:error] [pid 49319:tid 49335] [client 4.197.234.159:61309] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aVlZvrcNXYLFZOiX4cRSQQAAAM4"]
[Sun Jan 04 02:02:38.711078 2026] [:error] [pid 49319:tid 49333] [client 4.197.234.159:63667] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aVlZvrcNXYLFZOiX4cRSRAAAAMw"]
[Sun Jan 04 02:02:39.320294 2026] [:error] [pid 49229:tid 49264] [client 4.197.234.159:63663] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aVlZv1CM4R1akb8JNI7CRAAAAEM"]
[Sun Jan 04 02:02:39.519125 2026] [:error] [pid 49230:tid 49299] [client 4.197.234.159:63637] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aVlZv32klmw7JRfgM3jR5gAAAIs"]
[Sun Jan 04 02:02:40.001756 2026] [:error] [pid 49319:tid 49325] [client 4.197.234.159:61284] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aVlZwLcNXYLFZOiX4cRSRwAAAMQ"]
[Sun Jan 04 02:02:41.162934 2026] [:error] [pid 49230:tid 49292] [client 4.197.234.159:59655] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aVlZwX2klmw7JRfgM3jR6wAAAIQ"]
[Sun Jan 04 02:02:41.340155 2026] [:error] [pid 49229:tid 49264] [client 4.197.234.159:30883] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aVlZwVCM4R1akb8JNI7CUwAAAEM"]
[Sun Jan 04 02:02:41.630800 2026] [:error] [pid 49229:tid 49270] [client 4.197.234.159:2665] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aVlZwVCM4R1akb8JNI7CVQAAAEk"]
[Sun Jan 04 02:02:42.205225 2026] [:error] [pid 49230:tid 49300] [client 4.197.234.159:65350] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aVlZwn2klmw7JRfgM3jR7gAAAIw"]
[Sun Jan 04 02:02:42.632748 2026] [:error] [pid 49230:tid 49291] [client 4.197.234.159:63628] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aVlZwn2klmw7JRfgM3jR8QAAAIM"]
[Sun Jan 04 02:02:43.072896 2026] [:error] [pid 49229:tid 49279] [client 4.197.234.159:63646] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aVlZw1CM4R1akb8JNI7CWQAAAFI"]
[Sun Jan 04 02:02:43.692683 2026] [:error] [pid 49319:tid 49342] [client 4.197.234.159:2681] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aVlZw7cNXYLFZOiX4cRSZgAAANU"]
[Sun Jan 04 02:02:43.964892 2026] [:error] [pid 49230:tid 49295] [client 4.197.234.159:59652] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aVlZw32klmw7JRfgM3jR9AAAAIc"]
[Sun Jan 04 02:02:44.309247 2026] [:error] [pid 49230:tid 49294] [client 4.197.234.159:65310] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aVlZxH2klmw7JRfgM3jR9wAAAIY"]
[Sun Jan 04 02:02:45.008188 2026] [:error] [pid 49230:tid 49309] [client 4.197.234.159:63635] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aVlZxX2klmw7JRfgM3jR-wAAAJU"]
[Sun Jan 04 02:02:45.166196 2026] [:error] [pid 49228:tid 49238] [client 4.197.234.159:59700] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aVlZxXCPk2c4rRZq2JQJvQAAAAU"]
[Sun Jan 04 02:02:45.616908 2026] [:error] [pid 49230:tid 49312] [client 4.197.234.159:65320] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/galex.php"] [unique_id "aVlZxX2klmw7JRfgM3jR_wAAAJg"]
[Sun Jan 04 02:02:45.796505 2026] [:error] [pid 49319:tid 49340] [client 4.197.234.159:65400] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/galex.php"] [unique_id "aVlZxbcNXYLFZOiX4cRSbAAAANM"]
[Sun Jan 04 02:02:46.033947 2026] [:error] [pid 49230:tid 49307] [client 4.197.234.159:59696] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/galex.php"] [unique_id "aVlZxn2klmw7JRfgM3jSAAAAAJM"]
[Sun Jan 04 02:02:46.800706 2026] [:error] [pid 49230:tid 49304] [client 4.197.234.159:61303] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/galex.php"] [unique_id "aVlZxn2klmw7JRfgM3jSBgAAAJA"]
[Sun Jan 04 02:02:47.291836 2026] [:error] [pid 49319:tid 49343] [client 4.197.234.159:61311] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aVlZx7cNXYLFZOiX4cRSdgAAANY"]
[Sun Jan 04 02:02:47.928606 2026] [:error] [pid 49228:tid 49243] [client 4.197.234.159:59674] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aVlZx3CPk2c4rRZq2JQJxgAAAAo"]
[Sun Jan 04 02:02:48.347090 2026] [:error] [pid 49229:tid 49267] [client 4.197.234.159:61290] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aVlZyFCM4R1akb8JNI7CYgAAAEY"]
[Sun Jan 04 02:02:49.115823 2026] [:error] [pid 49319:tid 49329] [client 4.197.234.159:65303] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aVlZybcNXYLFZOiX4cRSgQAAAMg"]
[Sun Jan 04 02:02:49.737765 2026] [:error] [pid 49319:tid 49326] [client 4.197.234.159:65353] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aVlZybcNXYLFZOiX4cRShQAAAMU"]
[Sun Jan 04 02:02:50.201496 2026] [:error] [pid 49230:tid 49295] [client 4.197.234.159:54654] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aVlZyn2klmw7JRfgM3jSFgAAAIc"]
[Sun Jan 04 02:02:50.560352 2026] [:error] [pid 49319:tid 49330] [client 4.197.234.159:65387] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aVlZyrcNXYLFZOiX4cRSjAAAAMk"]
[Sun Jan 04 02:02:50.914340 2026] [:error] [pid 49228:tid 49238] [client 4.197.234.159:65286] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aVlZynCPk2c4rRZq2JQJ0QAAAAU"]
[Sun Jan 04 02:02:51.255306 2026] [:error] [pid 49228:tid 49235] [client 4.197.234.159:65294] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aVlZy3CPk2c4rRZq2JQJ0gAAAAI"]
[Sun Jan 04 02:02:51.324232 2026] [:error] [pid 49319:tid 49344] [client 4.197.234.159:2655] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aVlZy7cNXYLFZOiX4cRSkAAAANc"]
[Sun Jan 04 02:02:51.619413 2026] [:error] [pid 49229:tid 49268] [client 4.197.234.159:65306] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aVlZy1CM4R1akb8JNI7CZgAAAEc"]
[Sun Jan 04 02:02:51.897269 2026] [:error] [pid 49319:tid 49322] [client 4.197.234.159:65384] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aVlZy7cNXYLFZOiX4cRSlgAAAME"]
[Sun Jan 04 02:02:52.351108 2026] [:error] [pid 49319:tid 49330] [client 4.197.234.159:54645] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aVlZzLcNXYLFZOiX4cRSmAAAAMk"]
[Sun Jan 04 02:02:52.660775 2026] [:error] [pid 49230:tid 49298] [client 4.197.234.159:65287] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aVlZzH2klmw7JRfgM3jSGAAAAIo"]
[Sun Jan 04 02:02:53.350887 2026] [:error] [pid 49230:tid 49296] [client 4.197.234.159:65298] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aVlZzX2klmw7JRfgM3jSGwAAAIg"]
[Sun Jan 04 02:02:53.634702 2026] [:error] [pid 49228:tid 49242] [client 4.197.234.159:61286] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aVlZzXCPk2c4rRZq2JQJ1gAAAAk"]
[Sun Jan 04 02:02:54.428438 2026] [:error] [pid 49229:tid 49264] [client 4.197.234.159:63634] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless5.php"] [unique_id "aVlZzlCM4R1akb8JNI7CawAAAEM"]
[Sun Jan 04 02:02:54.940584 2026] [:error] [pid 49319:tid 49342] [client 4.197.234.159:2654] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless5.php"] [unique_id "aVlZzrcNXYLFZOiX4cRSngAAANU"]
[Sun Jan 04 02:02:55.315728 2026] [:error] [pid 49229:tid 49270] [client 4.197.234.159:57909] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless5.php"] [unique_id "aVlZz1CM4R1akb8JNI7CbAAAAEk"]
[Sun Jan 04 02:02:55.782440 2026] [:error] [pid 49319:tid 49340] [client 4.197.234.159:61282] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless5.php"] [unique_id "aVlZz7cNXYLFZOiX4cRSoQAAANM"]
[Sun Jan 04 02:02:55.886095 2026] [:error] [pid 49230:tid 49298] [client 4.197.234.159:65302] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aVlZz32klmw7JRfgM3jSIwAAAIo"]
[Sun Jan 04 02:02:56.411023 2026] [:error] [pid 49230:tid 49301] [client 4.197.234.159:65356] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aVlZ0H2klmw7JRfgM3jSKAAAAI0"]
[Sun Jan 04 02:02:57.066182 2026] [:error] [pid 49230:tid 49311] [client 4.197.234.159:63650] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aVlZ0X2klmw7JRfgM3jSLwAAAJc"]
[Sun Jan 04 02:02:57.339109 2026] [:error] [pid 49228:tid 49257] [client 4.197.234.159:54615] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aVlZ0XCPk2c4rRZq2JQJ4wAAABg"]
[Sun Jan 04 02:02:57.797259 2026] [:error] [pid 49230:tid 49292] [client 4.197.234.159:65349] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aVlZ0X2klmw7JRfgM3jSNwAAAIQ"]
[Sun Jan 04 02:02:58.229310 2026] [:error] [pid 49230:tid 49288] [client 4.197.234.159:65396] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aVlZ0n2klmw7JRfgM3jSPQAAAIA"]
[Sun Jan 04 02:02:58.584128 2026] [:error] [pid 49319:tid 49334] [client 4.197.234.159:54643] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aVlZ0rcNXYLFZOiX4cRSpQAAAM0"]
[Sun Jan 04 02:02:58.931372 2026] [:error] [pid 49230:tid 49291] [client 4.197.234.159:2648] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aVlZ0n2klmw7JRfgM3jSQgAAAIM"]
[Sun Jan 04 02:02:59.300961 2026] [:error] [pid 49319:tid 49338] [client 4.197.234.159:54651] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aVlZ07cNXYLFZOiX4cRSpwAAANE"]
[Sun Jan 04 02:02:59.597766 2026] [:error] [pid 49319:tid 49324] [client 4.197.234.159:54677] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aVlZ07cNXYLFZOiX4cRSqAAAAMM"]
[Sun Jan 04 02:03:00.711482 2026] [:error] [pid 49229:tid 49267] [client 4.197.234.159:54690] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aVlZ1FCM4R1akb8JNI7CcwAAAEY"]
[Sun Jan 04 02:03:01.427723 2026] [:error] [pid 49229:tid 49277] [client 4.197.234.159:65345] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aVlZ1VCM4R1akb8JNI7CdgAAAFA"]
[Sun Jan 04 02:03:02.014361 2026] [:error] [pid 49230:tid 49301] [client 4.197.234.159:59669] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aVlZ1n2klmw7JRfgM3jSSgAAAI0"]
[Sun Jan 04 02:03:02.536119 2026] [:error] [pid 49228:tid 49254] [client 4.197.234.159:63678] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aVlZ1nCPk2c4rRZq2JQJ8gAAABU"]
[Sun Jan 04 02:03:03.159428 2026] [:error] [pid 49228:tid 49247] [client 4.197.234.159:54636] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aVlZ13CPk2c4rRZq2JQJ9gAAAA4"]
[Sun Jan 04 02:03:03.264535 2026] [:error] [pid 49319:tid 49334] [client 4.197.234.159:65331] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aVlZ17cNXYLFZOiX4cRSsgAAAM0"]
[Sun Jan 04 02:03:03.884114 2026] [:error] [pid 49319:tid 49324] [client 4.197.234.159:2640] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aVlZ17cNXYLFZOiX4cRStwAAAMM"]
[Sun Jan 04 02:03:04.156829 2026] [:error] [pid 49230:tid 49296] [client 4.197.234.159:59673] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aVlZ2H2klmw7JRfgM3jSTAAAAIg"]
[Sun Jan 04 02:03:04.560796 2026] [:error] [pid 49319:tid 49340] [client 4.197.234.159:30859] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aVlZ2LcNXYLFZOiX4cRSuQAAANM"]
[Sun Jan 04 02:03:04.835502 2026] [:error] [pid 49319:tid 49335] [client 4.197.234.159:61257] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aVlZ2LcNXYLFZOiX4cRSvAAAAM4"]
[Sun Jan 04 02:03:05.023370 2026] [:error] [pid 49230:tid 49304] [client 4.197.234.159:59693] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aVlZ2X2klmw7JRfgM3jSUQAAAJA"]
[Sun Jan 04 02:03:05.109960 2026] [:error] [pid 49319:tid 49325] [client 4.197.234.159:61276] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aVlZ2bcNXYLFZOiX4cRSwAAAAMQ"]
[Sun Jan 04 02:03:05.368448 2026] [:error] [pid 49319:tid 49342] [client 4.197.234.159:65368] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aVlZ2bcNXYLFZOiX4cRSwwAAANU"]
[Sun Jan 04 02:03:06.340239 2026] [:error] [pid 49230:tid 49296] [client 4.197.234.159:61283] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aVlZ2n2klmw7JRfgM3jSVgAAAIg"]
[Sun Jan 04 02:03:06.810992 2026] [:error] [pid 49230:tid 49307] [client 4.197.234.159:59672] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aVlZ2n2klmw7JRfgM3jSWAAAAJM"]
[Sun Jan 04 02:03:07.701048 2026] [:error] [pid 49319:tid 49345] [client 4.197.234.159:65334] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aVlZ27cNXYLFZOiX4cRSywAAANg"]
[Sun Jan 04 02:03:07.939745 2026] [:error] [pid 49319:tid 49332] [client 4.197.234.159:65370] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aVlZ27cNXYLFZOiX4cRSzQAAAMs"]
[Sun Jan 04 02:03:08.548755 2026] [:error] [pid 49319:tid 49343] [client 4.197.234.159:2662] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aVlZ3LcNXYLFZOiX4cRS0AAAANY"]
[Sun Jan 04 02:03:09.179241 2026] [:error] [pid 49319:tid 49334] [client 4.197.234.159:65338] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aVlZ3bcNXYLFZOiX4cRS0gAAAM0"]
[Sun Jan 04 02:03:10.000829 2026] [:error] [pid 49319:tid 49341] [client 4.197.234.159:65359] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aVlZ3bcNXYLFZOiX4cRS1AAAANQ"]
[Sun Jan 04 02:03:10.792967 2026] [:error] [pid 49229:tid 49271] [client 4.197.234.159:61251] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aVlZ3lCM4R1akb8JNI7ClwAAAEo"]
[Sun Jan 04 02:03:11.151477 2026] [:error] [pid 49228:tid 49234] [client 4.197.234.159:30879] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aVlZ33CPk2c4rRZq2JQKCgAAAAE"]
[Sun Jan 04 02:03:11.634493 2026] [:error] [pid 49229:tid 49284] [client 4.197.234.159:63679] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aVlZ31CM4R1akb8JNI7CmgAAAFc"]
[Sun Jan 04 02:03:11.842933 2026] [:error] [pid 49230:tid 49311] [client 4.197.234.159:54641] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aVlZ332klmw7JRfgM3jSZAAAAJc"]
[Sun Jan 04 02:03:12.061021 2026] [:error] [pid 49228:tid 49248] [client 4.197.234.159:57856] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aVlZ4HCPk2c4rRZq2JQKEQAAAA8"]
[Sun Jan 04 02:03:12.322302 2026] [:error] [pid 49229:tid 49262] [client 4.197.234.159:65383] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aVlZ4FCM4R1akb8JNI7CngAAAEE"]
[Sun Jan 04 02:03:12.839446 2026] [:error] [pid 49229:tid 49279] [client 4.197.234.159:59690] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blurbs15.php"] [unique_id "aVlZ4FCM4R1akb8JNI7CoAAAAFI"]
[Sun Jan 04 02:03:13.286644 2026] [:error] [pid 49228:tid 49239] [client 4.197.234.159:2641] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blurbs15.php"] [unique_id "aVlZ4XCPk2c4rRZq2JQKFwAAAAY"]
[Sun Jan 04 02:03:13.668520 2026] [:error] [pid 49228:tid 49253] [client 4.197.234.159:61291] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blurbs15.php"] [unique_id "aVlZ4XCPk2c4rRZq2JQKGQAAABQ"]
[Sun Jan 04 02:03:21.679509 2026] [:error] [pid 49228:tid 49251] [client 4.197.234.159:54609] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aVlZ6XCPk2c4rRZq2JQKOwAAABI"]
[Sun Jan 04 02:03:21.779968 2026] [:error] [pid 49319:tid 49325] [client 4.197.234.159:65317] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aVlZ6bcNXYLFZOiX4cRS7AAAAMQ"]
[Sun Jan 04 02:03:22.001551 2026] [:error] [pid 49229:tid 49276] [client 4.197.234.159:65343] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aVlZ6lCM4R1akb8JNI7CrwAAAE8"]
[Sun Jan 04 02:03:23.139459 2026] [:error] [pid 49319:tid 49323] [client 4.197.234.159:65348] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aVlZ67cNXYLFZOiX4cRS8gAAAMI"]
[Sun Jan 04 02:03:23.278136 2026] [:error] [pid 49319:tid 49345] [client 4.197.234.159:65365] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVlZ67cNXYLFZOiX4cRS8wAAANg"]
[Sun Jan 04 02:03:23.448463 2026] [:error] [pid 49319:tid 49332] [client 4.197.234.159:63740] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVlZ67cNXYLFZOiX4cRS9QAAAMs"]
[Sun Jan 04 02:03:24.030441 2026] [:error] [pid 49230:tid 49304] [client 4.197.234.159:63709] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVlZ7H2klmw7JRfgM3jSggAAAJA"]
[Sun Jan 04 02:03:24.264419 2026] [:error] [pid 49228:tid 49254] [client 4.197.234.159:63718] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVlZ7HCPk2c4rRZq2JQKPwAAABU"]
[Sun Jan 04 02:03:24.783285 2026] [:error] [pid 49319:tid 49338] [client 4.197.234.159:65377] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aVlZ7LcNXYLFZOiX4cRS-QAAANE"]
[Sun Jan 04 02:03:24.988993 2026] [:error] [pid 49229:tid 49267] [client 4.197.234.159:65314] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aVlZ7FCM4R1akb8JNI7CtwAAAEY"]
[Sun Jan 04 02:03:25.206347 2026] [:error] [pid 49319:tid 49334] [client 4.197.234.159:2650] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aVlZ7bcNXYLFZOiX4cRS-wAAAM0"]
[Sun Jan 04 02:03:25.499538 2026] [:error] [pid 49229:tid 49269] [client 4.197.234.159:54592] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aVlZ7VCM4R1akb8JNI7CuQAAAEg"]
[Sun Jan 04 02:03:25.902630 2026] [:error] [pid 49230:tid 49291] [client 4.197.234.159:63674] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aVlZ7X2klmw7JRfgM3jShwAAAIM"]
[Sun Jan 04 02:03:26.144183 2026] [:error] [pid 49229:tid 49271] [client 4.197.234.159:63665] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aVlZ7lCM4R1akb8JNI7CugAAAEo"]
[Sun Jan 04 02:03:26.565069 2026] [:error] [pid 49228:tid 49243] [client 4.197.234.159:64813] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aVlZ7nCPk2c4rRZq2JQKRQAAAAo"]
[Sun Jan 04 02:03:26.754570 2026] [:error] [pid 49229:tid 49275] [client 4.197.234.159:63619] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aVlZ7lCM4R1akb8JNI7CvQAAAE4"]
[Sun Jan 04 02:03:27.438385 2026] [:error] [pid 49319:tid 49327] [client 4.197.234.159:59684] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aVlZ77cNXYLFZOiX4cRTAAAAAMY"]
[Sun Jan 04 02:03:27.791645 2026] [:error] [pid 49229:tid 49270] [client 4.197.234.159:54593] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aVlZ71CM4R1akb8JNI7CvgAAAEk"]
[Sun Jan 04 02:03:28.288869 2026] [:error] [pid 49228:tid 49236] [client 4.197.234.159:59664] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aVlZ8HCPk2c4rRZq2JQKSwAAAAM"]
[Sun Jan 04 02:03:28.474431 2026] [:error] [pid 49230:tid 49293] [client 4.197.234.159:63729] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aVlZ8H2klmw7JRfgM3jSjwAAAIU"]
[Sun Jan 04 02:03:28.781588 2026] [:error] [pid 49229:tid 49280] [client 4.197.234.159:59663] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aVlZ8FCM4R1akb8JNI7CwQAAAFM"]
[Sun Jan 04 02:03:28.983385 2026] [:error] [pid 49319:tid 49340] [client 4.197.234.159:54601] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aVlZ8LcNXYLFZOiX4cRTBgAAANM"]
[Sun Jan 04 02:03:29.458472 2026] [:error] [pid 49228:tid 49237] [client 4.197.234.159:59676] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aVlZ8XCPk2c4rRZq2JQKTwAAAAQ"]
[Sun Jan 04 02:03:29.917846 2026] [:error] [pid 49228:tid 49248] [client 4.197.234.159:59654] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aVlZ8XCPk2c4rRZq2JQKUQAAAA8"]
[Sun Jan 04 02:03:30.151448 2026] [:error] [pid 49228:tid 49249] [client 4.197.234.159:54649] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aVlZ8nCPk2c4rRZq2JQKUwAAABA"]
[Sun Jan 04 02:03:30.396693 2026] [:error] [pid 49230:tid 49310] [client 4.197.234.159:65282] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aVlZ8n2klmw7JRfgM3jSkwAAAJY"]
[Sun Jan 04 02:03:30.971683 2026] [:error] [pid 49230:tid 49289] [client 4.197.234.159:54622] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aVlZ8n2klmw7JRfgM3jSlQAAAIE"]
[Sun Jan 04 02:03:31.262414 2026] [:error] [pid 49319:tid 49336] [client 4.197.234.159:63681] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aVlZ87cNXYLFZOiX4cRTCgAAAM8"]
[Sun Jan 04 02:03:31.658974 2026] [:error] [pid 49230:tid 49292] [client 4.197.234.159:2676] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aVlZ832klmw7JRfgM3jSmwAAAIQ"]
[Sun Jan 04 02:03:32.103675 2026] [:error] [pid 49229:tid 49277] [client 4.197.234.159:65284] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aVlZ9FCM4R1akb8JNI7CyQAAAFA"]
[Sun Jan 04 02:03:32.487918 2026] [:error] [pid 49228:tid 49236] [client 4.197.234.159:2634] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aVlZ9HCPk2c4rRZq2JQKWwAAAAM"]
[Sun Jan 04 02:03:33.007747 2026] [:error] [pid 49319:tid 49339] [client 4.197.234.159:63730] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aVlZ9bcNXYLFZOiX4cRTDwAAANI"]
[Sun Jan 04 02:03:33.548982 2026] [:error] [pid 49228:tid 49233] [client 4.197.234.159:63700] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aVlZ9XCPk2c4rRZq2JQKXQAAAAA"]
[Sun Jan 04 02:03:33.893453 2026] [:error] [pid 49230:tid 49305] [client 4.197.234.159:65374] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aVlZ9X2klmw7JRfgM3jSowAAAJE"]
[Sun Jan 04 02:03:34.159260 2026] [:error] [pid 49229:tid 49276] [client 4.197.234.159:54637] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aVlZ9lCM4R1akb8JNI7CzQAAAE8"]
[Sun Jan 04 02:03:34.547842 2026] [:error] [pid 49228:tid 49235] [client 4.197.234.159:63699] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aVlZ9nCPk2c4rRZq2JQKXwAAAAI"]
[Sun Jan 04 02:03:34.755185 2026] [:error] [pid 49229:tid 49264] [client 4.197.234.159:52544] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aVlZ9lCM4R1akb8JNI7CzwAAAEM"]
[Sun Jan 04 02:03:34.934675 2026] [:error] [pid 49229:tid 49261] [client 4.197.234.159:65342] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aVlZ9lCM4R1akb8JNI7C0AAAAEA"]
[Sun Jan 04 02:03:35.192178 2026] [:error] [pid 49230:tid 49304] [client 4.197.234.159:2653] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aVlZ932klmw7JRfgM3jSqAAAAJA"]
[Sun Jan 04 02:03:35.518020 2026] [:error] [pid 49230:tid 49291] [client 4.197.234.159:30870] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aVlZ932klmw7JRfgM3jSrAAAAIM"]
[Sun Jan 04 02:03:36.325216 2026] [:error] [pid 49230:tid 49302] [client 4.197.234.159:63695] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aVlZ-H2klmw7JRfgM3jSsAAAAI4"]
[Sun Jan 04 02:03:36.759251 2026] [:error] [pid 49319:tid 49336] [client 4.197.234.159:57219] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aVlZ-LcNXYLFZOiX4cRTFAAAAM8"]
[Sun Jan 04 02:03:37.183202 2026] [:error] [pid 49230:tid 49295] [client 4.197.234.159:30857] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aVlZ-X2klmw7JRfgM3jStAAAAIc"]
[Sun Jan 04 02:03:37.550158 2026] [:error] [pid 49229:tid 49274] [client 4.197.234.159:63689] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aVlZ-VCM4R1akb8JNI7C2gAAAE0"]
[Sun Jan 04 02:03:37.768272 2026] [:error] [pid 49319:tid 49339] [client 4.197.234.159:48662] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aVlZ-bcNXYLFZOiX4cRTGgAAANI"]
[Sun Jan 04 02:03:38.549152 2026] [:error] [pid 49230:tid 49292] [client 4.197.234.159:52560] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aVlZ-n2klmw7JRfgM3jSuAAAAIQ"]
[Sun Jan 04 02:03:39.275162 2026] [:error] [pid 49228:tid 49238] [client 4.197.234.159:55957] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aVlZ-3CPk2c4rRZq2JQKZAAAAAU"]
[Sun Jan 04 02:03:39.606028 2026] [:error] [pid 49228:tid 49243] [client 4.197.234.159:54633] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aVlZ-3CPk2c4rRZq2JQKZwAAAAo"]
[Sun Jan 04 02:03:39.998232 2026] [:error] [pid 49230:tid 49310] [client 4.197.234.159:30848] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ma1.php"] [unique_id "aVlZ-32klmw7JRfgM3jSvQAAAJY"]
[Sun Jan 04 02:03:40.423687 2026] [:error] [pid 49229:tid 49276] [client 4.197.234.159:63701] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ma1.php"] [unique_id "aVlZ_FCM4R1akb8JNI7C4AAAAE8"]
[Sun Jan 04 02:03:41.137128 2026] [:error] [pid 49230:tid 49303] [client 4.197.234.159:65332] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ma1.php"] [unique_id "aVlZ_X2klmw7JRfgM3jSvwAAAI8"]
[Sun Jan 04 02:03:41.396338 2026] [:error] [pid 49319:tid 49321] [client 4.197.234.159:57221] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ma1.php"] [unique_id "aVlZ_bcNXYLFZOiX4cRTJwAAAMA"]
[Sun Jan 04 02:03:42.515740 2026] [:error] [pid 49319:tid 49330] [client 4.197.234.159:63734] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aVlZ_rcNXYLFZOiX4cRTLwAAAMk"]
[Sun Jan 04 02:03:43.771425 2026] [:error] [pid 49228:tid 49253] [client 4.197.234.159:65375] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aVlZ_3CPk2c4rRZq2JQKcAAAABQ"]
[Sun Jan 04 02:03:44.019612 2026] [:error] [pid 49230:tid 49293] [client 4.197.234.159:52567] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aVlaAH2klmw7JRfgM3jSywAAAIU"]
[Sun Jan 04 02:03:44.310139 2026] [:error] [pid 49229:tid 49275] [client 4.197.234.159:54616] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aVlaAFCM4R1akb8JNI7C4gAAAE4"]
[Sun Jan 04 02:03:44.675058 2026] [:error] [pid 49229:tid 49282] [client 4.197.234.159:35417] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aVlaAFCM4R1akb8JNI7C5AAAAFU"]
[Sun Jan 04 02:03:45.585991 2026] [:error] [pid 49229:tid 49284] [client 4.197.234.159:48669] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aVlaAVCM4R1akb8JNI7C5QAAAFc"]
[Sun Jan 04 02:03:46.267978 2026] [:error] [pid 49319:tid 49334] [client 4.197.234.159:65402] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aVlaArcNXYLFZOiX4cRTQgAAAM0"]
[Sun Jan 04 02:03:46.755189 2026] [:error] [pid 49229:tid 49280] [client 4.197.234.159:30890] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aVlaAlCM4R1akb8JNI7C5gAAAFM"]
[Sun Jan 04 02:03:47.021020 2026] [:error] [pid 49229:tid 49267] [client 4.197.234.159:63711] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVlaA1CM4R1akb8JNI7C6AAAAEY"]
[Sun Jan 04 02:03:47.220662 2026] [:error] [pid 49230:tid 49289] [client 4.197.234.159:65351] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVlaA32klmw7JRfgM3jS0gAAAIE"]
[Sun Jan 04 02:03:47.388007 2026] [:error] [pid 49228:tid 49234] [client 4.197.234.159:52588] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVlaA3CPk2c4rRZq2JQKdgAAAAE"]
[Sun Jan 04 02:03:47.891737 2026] [:error] [pid 49319:tid 49337] [client 4.197.234.159:54610] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aVlaA7cNXYLFZOiX4cRTSwAAANA"]
[Sun Jan 04 02:03:48.158372 2026] [:error] [pid 49230:tid 49290] [client 4.197.234.159:57229] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fwe.php"] [unique_id "aVlaBH2klmw7JRfgM3jS1QAAAII"]
[Sun Jan 04 02:03:48.316327 2026] [:error] [pid 49230:tid 49308] [client 4.197.234.159:57254] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fwe.php"] [unique_id "aVlaBH2klmw7JRfgM3jS1gAAAJQ"]
[Sun Jan 04 02:03:48.486337 2026] [:error] [pid 49319:tid 49328] [client 4.197.234.159:57236] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fwe.php"] [unique_id "aVlaBLcNXYLFZOiX4cRTTgAAAMc"]
[Sun Jan 04 02:03:48.892040 2026] [:error] [pid 49229:tid 49265] [client 4.197.234.159:65288] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fwe.php"] [unique_id "aVlaBFCM4R1akb8JNI7C6wAAAEQ"]
[Sun Jan 04 02:03:49.066502 2026] [:error] [pid 49319:tid 49342] [client 4.197.234.159:52589] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aVlaBbcNXYLFZOiX4cRTUwAAANU"]
[Sun Jan 04 02:03:49.219743 2026] [:error] [pid 49228:tid 49248] [client 4.197.234.159:65358] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aVlaBXCPk2c4rRZq2JQKeAAAAA8"]
[Sun Jan 04 02:03:50.691029 2026] [:error] [pid 49229:tid 49266] [client 4.197.234.159:54620] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aVlaBlCM4R1akb8JNI7C7gAAAEU"]
[Sun Jan 04 02:03:50.888678 2026] [:error] [pid 49229:tid 49281] [client 4.197.234.159:63724] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aVlaBlCM4R1akb8JNI7C7wAAAFQ"]
[Sun Jan 04 02:03:51.110505 2026] [:error] [pid 49319:tid 49330] [client 4.197.234.159:57250] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx1.php"] [unique_id "aVlaB7cNXYLFZOiX4cRTXQAAAMk"]
[Sun Jan 04 02:03:51.500215 2026] [:error] [pid 49229:tid 49273] [client 4.197.234.159:65307] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx1.php"] [unique_id "aVlaB1CM4R1akb8JNI7C8AAAAEw"]
[Sun Jan 04 02:03:51.787263 2026] [:error] [pid 49228:tid 49245] [client 4.197.234.159:52569] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx1.php"] [unique_id "aVlaB3CPk2c4rRZq2JQKfAAAAAw"]
[Sun Jan 04 02:03:52.070227 2026] [:error] [pid 49228:tid 49250] [client 4.197.234.159:54642] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx1.php"] [unique_id "aVlaCHCPk2c4rRZq2JQKfQAAABE"]
[Sun Jan 04 02:03:52.424507 2026] [:error] [pid 49228:tid 49234] [client 4.197.234.159:63696] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aVlaCHCPk2c4rRZq2JQKfgAAAAE"]
[Sun Jan 04 02:03:52.924203 2026] [:error] [pid 49230:tid 49289] [client 4.197.234.159:65385] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aVlaCH2klmw7JRfgM3jS4gAAAIE"]
[Sun Jan 04 02:03:53.205423 2026] [:error] [pid 49228:tid 49239] [client 4.197.234.159:65340] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aVlaCXCPk2c4rRZq2JQKgAAAAAY"]
[Sun Jan 04 02:03:53.489787 2026] [:error] [pid 49230:tid 49309] [client 4.197.234.159:63644] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aVlaCX2klmw7JRfgM3jS5QAAAJU"]
[Sun Jan 04 02:03:54.002727 2026] [:error] [pid 49230:tid 49290] [client 4.197.234.159:2624] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aVlaCn2klmw7JRfgM3jS5wAAAII"]
[Sun Jan 04 02:03:54.399964 2026] [:error] [pid 49228:tid 49240] [client 4.197.234.159:54678] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aVlaCnCPk2c4rRZq2JQKhAAAAAc"]
[Sun Jan 04 02:03:54.954262 2026] [:error] [pid 49229:tid 49272] [client 4.197.234.159:63686] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aVlaClCM4R1akb8JNI7C-AAAAEs"]
[Sun Jan 04 02:03:56.029640 2026] [:error] [pid 49230:tid 49295] [client 4.197.234.159:59683] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aVlaDH2klmw7JRfgM3jS6gAAAIc"]
[Sun Jan 04 02:03:56.485602 2026] [:error] [pid 49229:tid 49277] [client 4.197.234.159:65401] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aVlaDFCM4R1akb8JNI7C_QAAAFA"]
[Sun Jan 04 02:03:56.604798 2026] [:error] [pid 49230:tid 49292] [client 4.197.234.159:54625] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aVlaDH2klmw7JRfgM3jS7QAAAIQ"]
[Sun Jan 04 02:03:57.012739 2026] [:error] [pid 49230:tid 49296] [client 4.197.234.159:65339] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aVlaDX2klmw7JRfgM3jS7gAAAIg"]
[Sun Jan 04 02:03:57.339992 2026] [:error] [pid 49230:tid 49297] [client 4.197.234.159:48659] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aVlaDX2klmw7JRfgM3jS8AAAAIk"]
[Sun Jan 04 02:03:58.246214 2026] [:error] [pid 49319:tid 49329] [client 4.197.234.159:65322] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aVlaDrcNXYLFZOiX4cRTcgAAAMg"]
[Sun Jan 04 02:03:59.092609 2026] [:error] [pid 49230:tid 49299] [client 4.197.234.159:54638] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aVlaD32klmw7JRfgM3jS9QAAAIs"]
[Sun Jan 04 02:03:59.646318 2026] [:error] [pid 49228:tid 49256] [client 4.197.234.159:52551] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aVlaD3CPk2c4rRZq2JQKjwAAABc"]
[Sun Jan 04 02:04:00.461266 2026] [:error] [pid 49230:tid 49295] [client 4.197.234.159:54640] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aVlaEH2klmw7JRfgM3jS-AAAAIc"]
[Sun Jan 04 02:04:00.750647 2026] [:error] [pid 49230:tid 49308] [client 4.197.234.159:2905] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gtc.php"] [unique_id "aVlaEH2klmw7JRfgM3jS-QAAAJQ"]
[Sun Jan 04 02:04:00.845025 2026] [:error] [pid 49230:tid 49311] [client 4.197.234.159:57243] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gtc.php"] [unique_id "aVlaEH2klmw7JRfgM3jS-gAAAJc"]
[Sun Jan 04 02:04:01.332545 2026] [:error] [pid 49319:tid 49344] [client 4.197.234.159:54647] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gtc.php"] [unique_id "aVlaEbcNXYLFZOiX4cRTgQAAANc"]
[Sun Jan 04 02:04:02.310296 2026] [:error] [pid 49230:tid 49298] [client 4.197.234.159:54635] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gtc.php"] [unique_id "aVlaEn2klmw7JRfgM3jTAgAAAIo"]
[Sun Jan 04 02:04:02.644246 2026] [:error] [pid 49319:tid 49342] [client 4.197.234.159:38038] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atx.php"] [unique_id "aVlaErcNXYLFZOiX4cRTgwAAANU"]
[Sun Jan 04 02:04:03.033231 2026] [:error] [pid 49228:tid 49245] [client 4.197.234.159:63741] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atx.php"] [unique_id "aVlaE3CPk2c4rRZq2JQKmQAAAAw"]
[Sun Jan 04 02:04:03.149603 2026] [:error] [pid 49230:tid 49295] [client 4.197.234.159:48644] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atx.php"] [unique_id "aVlaE32klmw7JRfgM3jTBQAAAIc"]
[Sun Jan 04 02:04:03.475389 2026] [:error] [pid 49319:tid 49343] [client 4.197.234.159:59680] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atx.php"] [unique_id "aVlaE7cNXYLFZOiX4cRThwAAANY"]
[Sun Jan 04 02:04:03.982191 2026] [:error] [pid 49230:tid 49288] [client 4.197.234.159:38061] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aVlaE32klmw7JRfgM3jTBwAAAIA"]
[Sun Jan 04 02:04:04.856823 2026] [:error] [pid 49228:tid 49250] [client 4.197.234.159:57241] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aVlaFHCPk2c4rRZq2JQKnAAAABE"]
[Sun Jan 04 02:04:05.278282 2026] [:error] [pid 49229:tid 49274] [client 4.197.234.159:57257] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aVlaFVCM4R1akb8JNI7DBgAAAE0"]
[Sun Jan 04 02:04:06.698825 2026] [:error] [pid 49229:tid 49284] [client 4.197.234.159:52593] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aVlaFlCM4R1akb8JNI7DCwAAAFc"]
[Sun Jan 04 02:04:06.767906 2026] [:error] [pid 49229:tid 49282] [client 4.197.234.159:26864] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cheka.php"] [unique_id "aVlaFlCM4R1akb8JNI7DDQAAAFU"]
[Sun Jan 04 02:04:06.960180 2026] [:error] [pid 49230:tid 49298] [client 4.197.234.159:2902] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cheka.php"] [unique_id "aVlaFn2klmw7JRfgM3jTDQAAAIo"]
[Sun Jan 04 02:04:07.235338 2026] [:error] [pid 49230:tid 49304] [client 4.197.234.159:2907] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cheka.php"] [unique_id "aVlaF32klmw7JRfgM3jTDgAAAJA"]
[Sun Jan 04 02:04:07.424942 2026] [:error] [pid 49228:tid 49245] [client 4.197.234.159:60587] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cheka.php"] [unique_id "aVlaF3CPk2c4rRZq2JQKpAAAAAw"]
[Sun Jan 04 02:04:07.881675 2026] [:error] [pid 49228:tid 49256] [client 4.197.234.159:57267] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classgoto24.php"] [unique_id "aVlaF3CPk2c4rRZq2JQKpgAAABc"]
[Sun Jan 04 02:04:08.600378 2026] [:error] [pid 49230:tid 49295] [client 4.197.234.159:2943] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classgoto24.php"] [unique_id "aVlaGH2klmw7JRfgM3jTEQAAAIc"]
[Sun Jan 04 02:04:10.221914 2026] [:error] [pid 49230:tid 49294] [client 4.197.234.159:55361] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classgoto24.php"] [unique_id "aVlaGn2klmw7JRfgM3jTGQAAAIY"]
[Sun Jan 04 02:04:11.267438 2026] [:error] [pid 49319:tid 49336] [client 4.197.234.159:33212] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classgoto24.php"] [unique_id "aVlaG7cNXYLFZOiX4cRTkwAAAM8"]
[Sun Jan 04 02:04:11.551494 2026] [:error] [pid 49319:tid 49332] [client 4.197.234.159:27869] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xtride.php"] [unique_id "aVlaG7cNXYLFZOiX4cRTlgAAAMs"]
[Sun Jan 04 02:04:12.086775 2026] [:error] [pid 49319:tid 49323] [client 4.197.234.159:27849] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xtride.php"] [unique_id "aVlaHLcNXYLFZOiX4cRTmAAAAMI"]
[Sun Jan 04 02:04:12.439383 2026] [:error] [pid 49229:tid 49271] [client 4.197.234.159:33194] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xtride.php"] [unique_id "aVlaHFCM4R1akb8JNI7DFwAAAEo"]
[Sun Jan 04 02:04:12.684669 2026] [:error] [pid 49319:tid 49322] [client 4.197.234.159:58382] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xtride.php"] [unique_id "aVlaHLcNXYLFZOiX4cRTnAAAAME"]
[Sun Jan 04 02:04:13.062364 2026] [:error] [pid 49319:tid 49329] [client 4.197.234.159:33162] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws29.php"] [unique_id "aVlaHbcNXYLFZOiX4cRTngAAAMg"]
[Sun Jan 04 02:04:14.631470 2026] [:error] [pid 49319:tid 49327] [client 4.197.234.159:57766] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws29.php"] [unique_id "aVlaHrcNXYLFZOiX4cRTpAAAAMY"]
[Sun Jan 04 02:04:15.114241 2026] [:error] [pid 49228:tid 49256] [client 4.197.234.159:33190] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws29.php"] [unique_id "aVlaH3CPk2c4rRZq2JQKrQAAABc"]
[Sun Jan 04 02:04:15.847827 2026] [:error] [pid 49319:tid 49334] [client 4.197.234.159:60150] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws29.php"] [unique_id "aVlaH7cNXYLFZOiX4cRTqAAAAM0"]
[Sun Jan 04 02:04:17.081148 2026] [:error] [pid 49228:tid 49236] [client 4.197.234.159:57743] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oo.php"] [unique_id "aVlaIXCPk2c4rRZq2JQKtgAAAAM"]
[Sun Jan 04 02:04:17.216066 2026] [:error] [pid 49228:tid 49252] [client 4.197.234.159:57789] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oo.php"] [unique_id "aVlaIXCPk2c4rRZq2JQKtwAAABM"]
[Sun Jan 04 02:04:17.837242 2026] [:error] [pid 49319:tid 49321] [client 4.197.234.159:60141] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oo.php"] [unique_id "aVlaIbcNXYLFZOiX4cRTrQAAAMA"]
[Sun Jan 04 02:04:18.666035 2026] [:error] [pid 49228:tid 49253] [client 4.197.234.159:51814] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oo.php"] [unique_id "aVlaInCPk2c4rRZq2JQKvAAAABQ"]
[Sun Jan 04 02:04:19.087756 2026] [:error] [pid 49228:tid 49233] [client 4.197.234.159:54061] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s11.php"] [unique_id "aVlaI3CPk2c4rRZq2JQKvwAAAAA"]
[Sun Jan 04 02:04:19.704036 2026] [:error] [pid 49229:tid 49277] [client 4.197.234.159:36167] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s11.php"] [unique_id "aVlaI1CM4R1akb8JNI7DHwAAAFA"]
[Sun Jan 04 02:04:20.070420 2026] [:error] [pid 49319:tid 49323] [client 4.197.234.159:54078] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s11.php"] [unique_id "aVlaJLcNXYLFZOiX4cRTtgAAAMI"]
[Sun Jan 04 02:04:20.588887 2026] [:error] [pid 49229:tid 49262] [client 4.197.234.159:61699] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s11.php"] [unique_id "aVlaJFCM4R1akb8JNI7DIQAAAEE"]
[Sun Jan 04 02:04:28.737176 2026] [:error] [pid 49229:tid 49282] [client 4.197.234.159:64875] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aVlaLFCM4R1akb8JNI7DQQAAAFU"]
[Sun Jan 04 02:04:29.466267 2026] [:error] [pid 49319:tid 49326] [client 4.197.234.159:2207] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aVlaLbcNXYLFZOiX4cRT3wAAAMU"]
[Sun Jan 04 02:04:30.130616 2026] [:error] [pid 49319:tid 49324] [client 4.197.234.159:60668] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aVlaLrcNXYLFZOiX4cRT6AAAAMM"]
[Sun Jan 04 02:04:30.430217 2026] [:error] [pid 49319:tid 49342] [client 4.197.234.159:60637] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pn.php"] [unique_id "aVlaLrcNXYLFZOiX4cRT6QAAANU"]
[Sun Jan 04 02:04:30.706745 2026] [:error] [pid 49230:tid 49297] [client 4.197.234.159:57659] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fz.php"] [unique_id "aVlaLn2klmw7JRfgM3jTKwAAAIk"]
[Sun Jan 04 02:04:30.874753 2026] [:error] [pid 49319:tid 49340] [client 4.197.234.159:52529] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fz.php"] [unique_id "aVlaLrcNXYLFZOiX4cRT7AAAANM"]
[Sun Jan 04 02:04:31.000895 2026] [:error] [pid 49319:tid 49341] [client 4.197.234.159:52516] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fz.php"] [unique_id "aVlaL7cNXYLFZOiX4cRT8AAAANQ"]
[Sun Jan 04 02:04:31.108401 2026] [:error] [pid 49230:tid 49294] [client 4.197.234.159:54733] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fz.php"] [unique_id "aVlaL32klmw7JRfgM3jTLgAAAIY"]
[Sun Jan 04 02:04:31.470591 2026] [:error] [pid 49319:tid 49323] [client 4.197.234.159:2203] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sang.php"] [unique_id "aVlaL7cNXYLFZOiX4cRT8wAAAMI"]
[Sun Jan 04 02:04:31.723359 2026] [:error] [pid 49319:tid 49322] [client 4.197.234.159:2222] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sang.php"] [unique_id "aVlaL7cNXYLFZOiX4cRT-AAAAME"]
[Sun Jan 04 02:04:31.981936 2026] [:error] [pid 49319:tid 49336] [client 4.197.234.159:57645] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sang.php"] [unique_id "aVlaL7cNXYLFZOiX4cRT-gAAAM8"]
[Sun Jan 04 02:04:32.208815 2026] [:error] [pid 49230:tid 49304] [client 4.197.234.159:60039] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sang.php"] [unique_id "aVlaMH2klmw7JRfgM3jTMgAAAJA"]
[Sun Jan 04 02:04:32.422009 2026] [:error] [pid 49319:tid 49341] [client 4.197.234.159:60634] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0o0.php"] [unique_id "aVlaMLcNXYLFZOiX4cRUAAAAANQ"]
[Sun Jan 04 02:04:32.519633 2026] [:error] [pid 49228:tid 49252] [client 4.197.234.159:52534] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0o0.php"] [unique_id "aVlaMHCPk2c4rRZq2JQK3AAAABM"]
[Sun Jan 04 02:04:32.647449 2026] [:error] [pid 49228:tid 49236] [client 4.197.234.159:2382] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0o0.php"] [unique_id "aVlaMHCPk2c4rRZq2JQK3QAAAAM"]
[Sun Jan 04 02:04:32.777912 2026] [:error] [pid 49230:tid 49310] [client 4.197.234.159:52505] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0o0.php"] [unique_id "aVlaMH2klmw7JRfgM3jTNQAAAJY"]
[Sun Jan 04 02:04:33.141316 2026] [:error] [pid 49230:tid 49299] [client 4.197.234.159:60660] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aVlaMX2klmw7JRfgM3jTNwAAAIs"]
[Sun Jan 04 02:04:33.300212 2026] [:error] [pid 49230:tid 49288] [client 4.197.234.159:60070] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aVlaMX2klmw7JRfgM3jTOgAAAIA"]
[Sun Jan 04 02:04:33.593635 2026] [:error] [pid 49229:tid 49283] [client 4.197.234.159:52488] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aVlaMVCM4R1akb8JNI7DQwAAAFY"]
[Sun Jan 04 02:04:33.998469 2026] [:error] [pid 49228:tid 49240] [client 4.197.234.159:35888] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxl.php"] [unique_id "aVlaMXCPk2c4rRZq2JQK5AAAAAc"]
[Sun Jan 04 02:04:34.252771 2026] [:error] [pid 49228:tid 49243] [client 4.197.234.159:59103] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aVlaMnCPk2c4rRZq2JQK5gAAAAo"]
[Sun Jan 04 02:04:34.617253 2026] [:error] [pid 49228:tid 49238] [client 4.197.234.159:2375] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aVlaMnCPk2c4rRZq2JQK6gAAAAU"]
[Sun Jan 04 02:04:35.380131 2026] [:error] [pid 49228:tid 49256] [client 4.197.234.159:54087] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aVlaM3CPk2c4rRZq2JQK7QAAABc"]
[Sun Jan 04 02:04:35.768275 2026] [:error] [pid 49228:tid 49248] [client 4.197.234.159:2388] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aVlaM3CPk2c4rRZq2JQK9AAAAA8"]
[Sun Jan 04 02:04:36.230949 2026] [:error] [pid 49230:tid 49307] [client 4.197.234.159:30891] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2clas.php"] [unique_id "aVlaNH2klmw7JRfgM3jTRQAAAJM"]
[Sun Jan 04 02:04:36.588268 2026] [:error] [pid 49230:tid 49303] [client 4.197.234.159:60649] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2clas.php"] [unique_id "aVlaNH2klmw7JRfgM3jTRgAAAI8"]
[Sun Jan 04 02:04:36.751607 2026] [:error] [pid 49230:tid 49291] [client 4.197.234.159:52500] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2clas.php"] [unique_id "aVlaNH2klmw7JRfgM3jTRwAAAIM"]
[Sun Jan 04 02:04:37.173167 2026] [:error] [pid 49230:tid 49301] [client 4.197.234.159:2610] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2clas.php"] [unique_id "aVlaNX2klmw7JRfgM3jTSgAAAI0"]
[Sun Jan 04 02:04:37.379426 2026] [:error] [pid 49319:tid 49326] [client 4.197.234.159:51742] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "aVlaNbcNXYLFZOiX4cRUDQAAAMU"]
[Sun Jan 04 02:04:37.871708 2026] [:error] [pid 49230:tid 49308] [client 4.197.234.159:51751] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "aVlaNX2klmw7JRfgM3jTTQAAAJQ"]
[Sun Jan 04 02:04:38.156542 2026] [:error] [pid 49230:tid 49305] [client 4.197.234.159:2617] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "aVlaNn2klmw7JRfgM3jTUQAAAJE"]
[Sun Jan 04 02:04:38.361383 2026] [:error] [pid 49230:tid 49290] [client 4.197.234.159:2379] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "aVlaNn2klmw7JRfgM3jTUgAAAII"]
[Sun Jan 04 02:04:38.921950 2026] [:error] [pid 49319:tid 49340] [client 4.197.234.159:60666] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aVlaNrcNXYLFZOiX4cRUEwAAANM"]
[Sun Jan 04 02:04:39.159103 2026] [:error] [pid 49319:tid 49337] [client 4.197.234.159:35862] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aVlaN7cNXYLFZOiX4cRUFgAAANA"]
[Sun Jan 04 02:04:39.356989 2026] [:error] [pid 49319:tid 49344] [client 4.197.234.159:2575] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aVlaN7cNXYLFZOiX4cRUGAAAANc"]
[Sun Jan 04 02:04:39.516153 2026] [:error] [pid 49230:tid 49296] [client 4.197.234.159:35846] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aVlaN32klmw7JRfgM3jTVwAAAIg"]
[Sun Jan 04 02:04:39.777848 2026] [:error] [pid 49319:tid 49326] [client 4.197.234.159:35854] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "aVlaN7cNXYLFZOiX4cRUHQAAAMU"]
[Sun Jan 04 02:04:40.092961 2026] [:error] [pid 49319:tid 49339] [client 4.197.234.159:2592] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "aVlaOLcNXYLFZOiX4cRUIgAAANI"]
[Sun Jan 04 02:04:40.173812 2026] [:error] [pid 49228:tid 49251] [client 4.197.234.159:35878] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "aVlaOHCPk2c4rRZq2JQK_gAAABI"]
[Sun Jan 04 02:04:40.343510 2026] [:error] [pid 49319:tid 49330] [client 4.197.234.159:51755] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "aVlaOLcNXYLFZOiX4cRUJQAAAMk"]
[Sun Jan 04 02:04:40.714593 2026] [:error] [pid 49230:tid 49294] [client 4.197.234.159:62495] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/14.php"] [unique_id "aVlaOH2klmw7JRfgM3jTWwAAAIY"]
[Sun Jan 04 02:04:41.109056 2026] [:error] [pid 49230:tid 49300] [client 4.197.234.159:2376] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/14.php"] [unique_id "aVlaOX2klmw7JRfgM3jTXgAAAIw"]
[Sun Jan 04 02:04:41.299047 2026] [:error] [pid 49319:tid 49331] [client 4.197.234.159:2418] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/14.php"] [unique_id "aVlaObcNXYLFZOiX4cRUKQAAAMo"]
[Sun Jan 04 02:04:41.579726 2026] [:error] [pid 49319:tid 49326] [client 4.197.234.159:62469] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/14.php"] [unique_id "aVlaObcNXYLFZOiX4cRULAAAAMU"]
[Sun Jan 04 02:04:41.963089 2026] [:error] [pid 49229:tid 49281] [client 4.197.234.159:51721] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aVlaOVCM4R1akb8JNI7DVgAAAFQ"]
[Sun Jan 04 02:04:42.374112 2026] [:error] [pid 49228:tid 49246] [client 4.197.234.159:35900] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aVlaOnCPk2c4rRZq2JQLBQAAAA0"]
[Sun Jan 04 02:04:42.568065 2026] [:error] [pid 49319:tid 49328] [client 4.197.234.159:51741] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aVlaOrcNXYLFZOiX4cRULwAAAMc"]
[Sun Jan 04 02:04:42.900965 2026] [:error] [pid 49230:tid 49293] [client 4.197.234.159:35890] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aVlaOn2klmw7JRfgM3jTZwAAAIU"]
[Sun Jan 04 02:04:43.100595 2026] [:error] [pid 49228:tid 49236] [client 4.197.234.159:65336] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/enclas.php"] [unique_id "aVlaO3CPk2c4rRZq2JQLDAAAAAM"]
[Sun Jan 04 02:04:43.340496 2026] [:error] [pid 49230:tid 49312] [client 4.197.234.159:51736] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/enclas.php"] [unique_id "aVlaO32klmw7JRfgM3jTaQAAAJg"]
[Sun Jan 04 02:04:43.579773 2026] [:error] [pid 49319:tid 49344] [client 4.197.234.159:2123] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/enclas.php"] [unique_id "aVlaO7cNXYLFZOiX4cRUNgAAANc"]
[Sun Jan 04 02:04:43.785652 2026] [:error] [pid 49230:tid 49292] [client 4.197.234.159:35849] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/enclas.php"] [unique_id "aVlaO32klmw7JRfgM3jTbAAAAIQ"]
[Sun Jan 04 02:04:44.145992 2026] [:error] [pid 49229:tid 49261] [client 4.197.234.159:2126] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/he.php"] [unique_id "aVlaPFCM4R1akb8JNI7DWQAAAEA"]
[Sun Jan 04 02:04:44.674928 2026] [:error] [pid 49319:tid 49336] [client 4.197.234.159:54107] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/he.php"] [unique_id "aVlaPLcNXYLFZOiX4cRUPwAAAM8"]
[Sun Jan 04 02:04:45.238642 2026] [:error] [pid 49228:tid 49238] [client 4.197.234.159:35859] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/he.php"] [unique_id "aVlaPXCPk2c4rRZq2JQLDgAAAAU"]
[Sun Jan 04 02:04:45.360824 2026] [:error] [pid 49230:tid 49301] [client 4.197.234.159:62472] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/he.php"] [unique_id "aVlaPX2klmw7JRfgM3jTcwAAAI0"]
[Sun Jan 04 02:04:45.551628 2026] [:error] [pid 49228:tid 49237] [client 4.197.234.159:59016] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid.php"] [unique_id "aVlaPXCPk2c4rRZq2JQLEgAAAAQ"]
[Sun Jan 04 02:04:45.654070 2026] [:error] [pid 49319:tid 49326] [client 4.197.234.159:35889] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid.php"] [unique_id "aVlaPbcNXYLFZOiX4cRURgAAAMU"]
[Sun Jan 04 02:04:45.792613 2026] [:error] [pid 49319:tid 49336] [client 4.197.234.159:2560] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid.php"] [unique_id "aVlaPbcNXYLFZOiX4cRURwAAAM8"]
[Sun Jan 04 02:04:46.060356 2026] [:error] [pid 49319:tid 49332] [client 4.197.234.159:2112] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid.php"] [unique_id "aVlaPrcNXYLFZOiX4cRUTQAAAMs"]
[Sun Jan 04 02:04:46.435246 2026] [:error] [pid 49319:tid 49329] [client 4.197.234.159:62520] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aVlaPrcNXYLFZOiX4cRUUgAAAMg"]
[Sun Jan 04 02:04:46.653464 2026] [:error] [pid 49319:tid 49345] [client 4.197.234.159:2613] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aVlaPrcNXYLFZOiX4cRUVgAAANg"]
[Sun Jan 04 02:04:46.778205 2026] [:error] [pid 49319:tid 49331] [client 4.197.234.159:54131] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aVlaPrcNXYLFZOiX4cRUWAAAAMo"]
[Sun Jan 04 02:04:47.407423 2026] [:error] [pid 49228:tid 49245] [client 4.197.234.159:2153] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aVlaP3CPk2c4rRZq2JQLFQAAAAw"]
[Sun Jan 04 02:04:47.547511 2026] [:error] [pid 49228:tid 49242] [client 4.197.234.159:35866] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aVlaP3CPk2c4rRZq2JQLGAAAAAk"]
[Sun Jan 04 02:04:47.787310 2026] [:error] [pid 49319:tid 49343] [client 4.197.234.159:2142] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aVlaP7cNXYLFZOiX4cRUXgAAANY"]
[Sun Jan 04 02:04:47.943682 2026] [:error] [pid 49319:tid 49324] [client 4.197.234.159:2608] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aVlaP7cNXYLFZOiX4cRUXwAAAMM"]
[Sun Jan 04 02:04:48.049931 2026] [:error] [pid 49319:tid 49344] [client 4.197.234.159:2618] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aVlaQLcNXYLFZOiX4cRUYwAAANc"]
[Sun Jan 04 02:04:48.273812 2026] [:error] [pid 49319:tid 49321] [client 4.197.234.159:59063] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aVlaQLcNXYLFZOiX4cRUZAAAAMA"]
[Sun Jan 04 02:04:48.480728 2026] [:error] [pid 49319:tid 49341] [client 4.197.234.159:2121] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aVlaQLcNXYLFZOiX4cRUZgAAANQ"]
[Sun Jan 04 02:04:48.695634 2026] [:error] [pid 49229:tid 49279] [client 4.197.234.159:35848] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aVlaQFCM4R1akb8JNI7DXwAAAFI"]
[Sun Jan 04 02:04:48.832138 2026] [:error] [pid 49319:tid 49333] [client 4.197.234.159:2156] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aVlaQLcNXYLFZOiX4cRUagAAAMw"]
[Sun Jan 04 02:04:49.009138 2026] [:error] [pid 49229:tid 49283] [client 4.197.234.159:59034] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aVlaQVCM4R1akb8JNI7DYwAAAFY"]
[Sun Jan 04 02:04:49.300259 2026] [:error] [pid 49228:tid 49233] [client 4.197.234.159:2564] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aVlaQXCPk2c4rRZq2JQLHgAAAAA"]
[Sun Jan 04 02:04:49.596605 2026] [:error] [pid 49229:tid 49276] [client 4.197.234.159:35851] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aVlaQVCM4R1akb8JNI7DZwAAAE8"]
[Sun Jan 04 02:04:49.905392 2026] [:error] [pid 49229:tid 49273] [client 4.197.234.159:59048] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aVlaQVCM4R1akb8JNI7DagAAAEw"]
[Sun Jan 04 02:04:50.151712 2026] [:error] [pid 49228:tid 49237] [client 4.197.234.159:2146] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aVlaQnCPk2c4rRZq2JQLIQAAAAQ"]
[Sun Jan 04 02:04:50.348017 2026] [:error] [pid 49228:tid 49244] [client 4.197.234.159:2152] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aVlaQnCPk2c4rRZq2JQLIgAAAAs"]
[Sun Jan 04 02:04:50.432837 2026] [:error] [pid 49229:tid 49266] [client 4.197.234.159:55375] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aVlaQlCM4R1akb8JNI7DcAAAAEU"]
[Sun Jan 04 02:04:50.557844 2026] [:error] [pid 49229:tid 49283] [client 4.197.234.159:55400] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aVlaQlCM4R1akb8JNI7DcgAAAFY"]
[Sun Jan 04 02:04:50.774244 2026] [:error] [pid 49229:tid 49276] [client 4.197.234.159:59020] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aVlaQlCM4R1akb8JNI7DdAAAAE8"]
[Sun Jan 04 02:04:51.374045 2026] [:error] [pid 49228:tid 49240] [client 4.197.234.159:59039] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aVlaQ3CPk2c4rRZq2JQLJAAAAAc"]
[Sun Jan 04 02:04:51.888039 2026] [:error] [pid 49319:tid 49338] [client 4.197.234.159:51767] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aVlaQ7cNXYLFZOiX4cRUdwAAANE"]
[Sun Jan 04 02:04:52.237117 2026] [:error] [pid 49230:tid 49291] [client 4.197.234.159:61194] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aVlaRH2klmw7JRfgM3jTfgAAAIM"]
[Sun Jan 04 02:04:52.392011 2026] [:error] [pid 49319:tid 49332] [client 4.197.234.159:59026] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aVlaRLcNXYLFZOiX4cRUeAAAAMs"]
[Sun Jan 04 02:04:52.467740 2026] [:error] [pid 49228:tid 49236] [client 4.197.234.159:61200] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aVlaRHCPk2c4rRZq2JQLKAAAAAM"]
[Sun Jan 04 02:04:52.566267 2026] [:error] [pid 49228:tid 49241] [client 4.197.234.159:2115] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aVlaRHCPk2c4rRZq2JQLKQAAAAg"]
[Sun Jan 04 02:04:53.031073 2026] [:error] [pid 49228:tid 49255] [client 4.197.234.159:59074] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aVlaRXCPk2c4rRZq2JQLLQAAABY"]
[Sun Jan 04 02:04:53.369713 2026] [:error] [pid 49319:tid 49330] [client 4.197.234.159:59116] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVlaRbcNXYLFZOiX4cRUfgAAAMk"]
[Sun Jan 04 02:04:53.706591 2026] [:error] [pid 49319:tid 49340] [client 4.197.234.159:55397] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVlaRbcNXYLFZOiX4cRUggAAANM"]
[Sun Jan 04 02:04:53.939021 2026] [:error] [pid 49229:tid 49284] [client 4.197.234.159:2607] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVlaRVCM4R1akb8JNI7DfwAAAFc"]
[Sun Jan 04 02:04:54.345033 2026] [:error] [pid 49230:tid 49312] [client 4.197.234.159:51714] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aVlaRn2klmw7JRfgM3jTgQAAAJg"]
[Sun Jan 04 02:04:54.514706 2026] [:error] [pid 49229:tid 49283] [client 4.197.234.159:55408] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aVlaRlCM4R1akb8JNI7DggAAAFY"]
[Sun Jan 04 02:04:54.727116 2026] [:error] [pid 49228:tid 49240] [client 4.197.234.159:59066] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aVlaRnCPk2c4rRZq2JQLNAAAAAc"]
[Sun Jan 04 02:04:55.187930 2026] [:error] [pid 49319:tid 49329] [client 4.197.234.159:2578] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aVlaR7cNXYLFZOiX4cRUiQAAAMg"]
[Sun Jan 04 02:04:55.557786 2026] [:error] [pid 49229:tid 49276] [client 4.197.234.159:55398] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aVlaR1CM4R1akb8JNI7DhAAAAE8"]
[Sun Jan 04 02:04:55.705668 2026] [:error] [pid 49230:tid 49311] [client 4.197.234.159:2566] [client 4.197.234.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aVlaR32klmw7JRfgM3jThAAAAJc"]
[Sun Jan 04 02:04:55.957477 2026] [:error] [pid 49319:tid 49327] [client 4.197.234.159:2132] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aVlaR7cNXYLFZOiX4cRUjAAAAMY"]
[Sun Jan 04 02:04:56.310373 2026] [:error] [pid 49229:tid 49275] [client 4.197.234.159:55367] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aVlaSFCM4R1akb8JNI7DiAAAAE4"]
[Sun Jan 04 02:04:58.123724 2026] [:error] [pid 49230:tid 49311] [client 4.197.234.159:55364] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aVlaSn2klmw7JRfgM3jTlgAAAJc"]
[Sun Jan 04 02:04:58.532873 2026] [:error] [pid 49228:tid 49246] [client 4.197.234.159:59076] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aVlaSnCPk2c4rRZq2JQLRgAAAA0"]
[Sun Jan 04 02:04:58.991074 2026] [:error] [pid 49228:tid 49254] [client 4.197.234.159:54020] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aVlaSnCPk2c4rRZq2JQLSAAAABU"]
[Sun Jan 04 02:04:59.180066 2026] [:error] [pid 49228:tid 49248] [client 4.197.234.159:54045] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aVlaS3CPk2c4rRZq2JQLSQAAAA8"]
[Sun Jan 04 02:04:59.332912 2026] [:error] [pid 49230:tid 49306] [client 4.197.234.159:2163] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aVlaS32klmw7JRfgM3jTnAAAAJI"]
[Sun Jan 04 02:04:59.685018 2026] [:error] [pid 49229:tid 49270] [client 4.197.234.159:63275] [client 4.197.234.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aVlaS1CM4R1akb8JNI7DlQAAAEk"]
[Sun Jan 04 02:06:10.204275 2026] [:error] [pid 49229:tid 49262] [client 43.165.190.5:45488] [client 43.165.190.5] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVlaklCM4R1akb8JNI7EmQAAAEE"]
[Sun Jan 04 02:11:48.309427 2026] [:error] [pid 49230:tid 49291] [client 192.250.235.149:34328] [client 192.250.235.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.235.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVlb5H2klmw7JRfgM3jXaAAAAIM"]
[Sun Jan 04 02:17:59.598899 2026] [:error] [pid 49230:tid 49308] [client 103.77.106.81:52915] [client 103.77.106.81] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aVldV32klmw7JRfgM3jb1wAAAJQ"]
[Sun Jan 04 02:18:02.634818 2026] [:error] [pid 49319:tid 49344] [client 103.77.106.81:53909] [client 103.77.106.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aVldWrcNXYLFZOiX4cRfqQAAANc"]
[Sun Jan 04 02:34:22.080020 2026] [:error] [pid 11559:tid 11565] [client 152.53.109.224:43574] [client 152.53.109.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.109.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVlhLqYDjvbj8bSHy5rcVAAAAQM"]
[Sun Jan 04 02:37:52.097687 2026] [:error] [pid 11559:tid 11562] [client 154.12.118.230:33402] [client 154.12.118.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.12.118.230, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVliAKYDjvbj8bSHy5reawAAAQA"]
[Sun Jan 04 02:58:24.118994 2026] [:error] [pid 11559:tid 11583] [client 104.28.246.116:46178] [client 104.28.246.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aVlm0KYDjvbj8bSHy5rmbgAAARU"]
[Sun Jan 04 03:05:27.149665 2026] [:error] [pid 49319:tid 49334] [client 107.180.116.112:39840] [client 107.180.116.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.116.112, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVlod7cNXYLFZOiX4cRuuQAAAM0"]
[Sun Jan 04 03:08:48.444599 2026] [:error] [pid 49230:tid 49302] [client 81.88.49.26:14056] [client 81.88.49.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVlpQH2klmw7JRfgM3jqggAAAI4"]
[Sun Jan 04 03:16:07.825354 2026] [:error] [pid 11559:tid 11577] [client 103.82.21.169:53162] [client 103.82.21.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.82.21.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVlq96YDjvbj8bSHy5rulQAAAQ8"]
[Sun Jan 04 03:31:42.076546 2026] [:error] [pid 6680:tid 6699] [client 148.66.155.24:34494] [client 148.66.155.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.66.155.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVlunjJsi9e3ZXgzS2nXxAAAAA8"]
[Sun Jan 04 03:33:30.599681 2026] [:error] [pid 6772:tid 6787] [client 139.150.68.72:41538] [client 139.150.68.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.150.68.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVlvCqbcyhqvUs1SVZxxIgAAAMs"]
[Sun Jan 04 03:34:19.947065 2026] [:error] [pid 6680:tid 6705] [client 116.203.138.147:58564] [client 116.203.138.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.203.138.147, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVlvOzJsi9e3ZXgzS2nYjgAAABU"]
[Sun Jan 04 03:45:51.955507 2026] [:error] [pid 37536:tid 37559] [client 136.158.118.234:48596] [client 136.158.118.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.158.118.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVlx72-iKLialy_3rkvTngAAABM"]
[Sun Jan 04 03:55:48.487601 2026] [:error] [pid 37537:tid 37589] [client 184.168.114.114:24056] [client 184.168.114.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.114.114, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVl0RAjHz7EQ5p_4u2pBAwAAAFA"]
[Sun Jan 04 04:19:29.817046 2026] [:error] [pid 37536:tid 37563] [client 104.234.179.94:45882] [client 104.234.179.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.234.179.94, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVl50W-iKLialy_3rkvc4wAAABc"]
[Sun Jan 04 04:26:50.608390 2026] [:error] [pid 37636:tid 37647] [client 184.168.96.248:51884] [client 184.168.96.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.96.248, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVl7ii3kmZpEf9yy2b0iVwAAAMc"]
[Sun Jan 04 04:33:40.585002 2026] [:error] [pid 37537:tid 37591] [client 139.150.68.72:52704] [client 139.150.68.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.150.68.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVl9JAjHz7EQ5p_4u2pMKwAAAFI"]
[Sun Jan 04 05:06:37.142587 2026] [:error] [pid 37636:tid 37644] [client 209.50.186.66:14981] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php"] [unique_id "aVmE3S3kmZpEf9yy2b01HgAAAMQ"]
[Sun Jan 04 05:06:39.929491 2026] [:error] [pid 37537:tid 37574] [client 209.50.186.66:26283] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.bak"] [unique_id "aVmE3wjHz7EQ5p_4u2pYwgAAAEE"]
[Sun Jan 04 05:06:42.356161 2026] [:error] [pid 37537:tid 37580] [client 209.50.186.66:44945] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php~"] [unique_id "aVmE4gjHz7EQ5p_4u2pYyAAAAEc"]
[Sun Jan 04 05:06:44.405341 2026] [:error] [pid 37538:tid 37601] [client 209.50.186.66:33177] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.save"] [unique_id "aVmE5IzU2j98LiSLQvRFKAAAAIE"]
[Sun Jan 04 05:06:46.505788 2026] [:error] [pid 37538:tid 37600] [client 209.50.186.66:49841] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.old" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.old"] [unique_id "aVmE5ozU2j98LiSLQvRFNQAAAIA"]
[Sun Jan 04 05:06:49.217453 2026] [:error] [pid 37538:tid 37608] [client 209.50.186.66:38809] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.txt" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.txt"] [unique_id "aVmE6YzU2j98LiSLQvRFPwAAAIg"]
[Sun Jan 04 05:06:51.929887 2026] [:error] [pid 37636:tid 37658] [client 209.50.186.66:31495] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.wp-config.php.swp"] [unique_id "aVmE6y3kmZpEf9yy2b01TQAAANI"]
[Sun Jan 04 05:06:54.065263 2026] [:error] [pid 37536:tid 37544] [client 209.50.186.66:60651] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-config.php"] [unique_id "aVmE7m-iKLialy_3rkvrXwAAAAQ"]
[Sun Jan 04 05:06:56.071277 2026] [:error] [pid 37536:tid 37545] [client 209.50.186.66:37197] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp/wp-config.php"] [unique_id "aVmE8G-iKLialy_3rkvrYQAAAAU"]
[Sun Jan 04 05:06:58.214778 2026] [:error] [pid 37537:tid 37590] [client 209.50.186.66:59219] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/blog/wp-config.php"] [unique_id "aVmE8gjHz7EQ5p_4u2pY8AAAAFE"]
[Sun Jan 04 05:07:00.577316 2026] [:error] [pid 37636:tid 37660] [client 209.50.186.66:32541] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/backup/wp-config.php"] [unique_id "aVmE9C3kmZpEf9yy2b01ZAAAANQ"]
[Sun Jan 04 05:07:01.987115 2026] [:error] [pid 37636:tid 37657] [client 209.50.186.66:28649] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php"] [unique_id "aVmE9S3kmZpEf9yy2b01ZQAAANE"]
[Sun Jan 04 05:07:02.866555 2026] [:error] [pid 37536:tid 37545] [client 209.50.186.66:18191] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.bak"] [unique_id "aVmE9m-iKLialy_3rkvrawAAAAU"]
[Sun Jan 04 05:07:04.030625 2026] [:error] [pid 37538:tid 37622] [client 209.50.186.66:48625] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php~"] [unique_id "aVmE-IzU2j98LiSLQvRFYAAAAJY"]
[Sun Jan 04 05:07:05.612006 2026] [:error] [pid 37538:tid 37612] [client 209.50.186.66:28673] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.save"] [unique_id "aVmE-YzU2j98LiSLQvRFZwAAAIw"]
[Sun Jan 04 05:07:06.493915 2026] [:error] [pid 37536:tid 37542] [client 209.50.186.66:9845] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.old" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.old"] [unique_id "aVmE-m-iKLialy_3rkvrdAAAAAI"]
[Sun Jan 04 05:07:07.510355 2026] [:error] [pid 37636:tid 37660] [client 209.50.186.66:28617] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.txt" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.txt"] [unique_id "aVmE-y3kmZpEf9yy2b01agAAANQ"]
[Sun Jan 04 05:07:08.838759 2026] [:error] [pid 37636:tid 37657] [client 209.50.186.66:14395] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.wp-config.php.swp"] [unique_id "aVmE_C3kmZpEf9yy2b01bwAAANE"]
[Sun Jan 04 05:07:09.820695 2026] [:error] [pid 37636:tid 37645] [client 209.50.186.66:14131] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-config.php"] [unique_id "aVmE_S3kmZpEf9yy2b01cwAAAMU"]
[Sun Jan 04 05:07:10.879232 2026] [:error] [pid 37636:tid 37650] [client 209.50.186.66:42141] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp/wp-config.php"] [unique_id "aVmE_i3kmZpEf9yy2b01eAAAAMo"]
[Sun Jan 04 05:07:12.329241 2026] [:error] [pid 37636:tid 37643] [client 209.50.186.66:20429] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/blog/wp-config.php"] [unique_id "aVmFAC3kmZpEf9yy2b01fQAAAMM"]
[Sun Jan 04 05:07:13.589878 2026] [:error] [pid 37537:tid 37575] [client 209.50.186.66:51317] [client 209.50.186.66] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/backup/wp-config.php"] [unique_id "aVmFAQjHz7EQ5p_4u2pZAwAAAEI"]
[Sun Jan 04 05:11:59.517517 2026] [:error] [pid 37536:tid 37548] [client 64.31.47.106:60784] [client 64.31.47.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.31.47.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmGH2-iKLialy_3rkvs5AAAAAg"]
[Sun Jan 04 05:22:02.801614 2026] [:error] [pid 37636:tid 37659] [client 103.77.107.178:50457] [client 103.77.107.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aVmIei3kmZpEf9yy2b08-gAAANM"]
[Sun Jan 04 05:22:03.344630 2026] [:error] [pid 37537:tid 37596] [client 103.77.107.178:50713] [client 103.77.107.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aVmIewjHz7EQ5p_4u2pejwAAAFc"]
[Sun Jan 04 05:40:20.971905 2026] [:error] [pid 37636:tid 37655] [client 195.245.203.9:33352] [client 195.245.203.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.245.203.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmMxC3kmZpEf9yy2b1FogAAAM8"]
[Sun Jan 04 05:44:23.790945 2026] [:error] [pid 37636:tid 37648] [client 136.158.118.234:36048] [client 136.158.118.234] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aVmNty3kmZpEf9yy2b1H7wAAAMg"]
[Sun Jan 04 05:45:37.195954 2026] [:error] [pid 37636:tid 37654] [client 136.158.118.234:36936] [client 136.158.118.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.158.118.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmOAS3kmZpEf9yy2b1IYgAAAM4"]
[Sun Jan 04 05:46:42.739958 2026] [:error] [pid 37636:tid 37664] [client 136.158.118.234:37873] [client 136.158.118.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.158.118.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmOQi3kmZpEf9yy2b1JKwAAANg"]
[Sun Jan 04 05:47:47.926341 2026] [:error] [pid 33650:tid 33668] [client 136.158.118.234:38559] [client 136.158.118.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.158.118.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmOg0zDhphKhMjzf1IMzwAAARA"]
[Sun Jan 04 05:48:50.386301 2026] [:error] [pid 37537:tid 37583] [client 136.158.118.234:39391] [client 136.158.118.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.158.118.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmOwgjHz7EQ5p_4u2ppAwAAAEo"]
[Sun Jan 04 05:49:55.486976 2026] [:error] [pid 37538:tid 37606] [client 136.158.118.234:40202] [client 136.158.118.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.158.118.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmPA4zU2j98LiSLQvRXFwAAAIY"]
[Sun Jan 04 05:56:11.663689 2026] [:error] [pid 33650:tid 33656] [client 31.7.66.235:55076] [client 31.7.66.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.7.66.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmQe0zDhphKhMjzf1IQRAAAAQQ"]
[Sun Jan 04 06:24:07.298442 2026] [:error] [pid 37536:tid 37554] [client 104.219.248.8:34026] [client 104.219.248.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.219.248.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXB2-iKLialy_3rksBWgAAAA4"]
[Sun Jan 04 06:24:09.400585 2026] [:error] [pid 33650:tid 33671] [client 104.219.248.8:34042] [client 104.219.248.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.219.248.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXCUzDhphKhMjzf1IZxAAAARM"]
[Sun Jan 04 06:24:11.001932 2026] [:error] [pid 37636:tid 37663] [client 104.219.248.8:34058] [client 104.219.248.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.219.248.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXCy3kmZpEf9yy2b1UHwAAANc"]
[Sun Jan 04 06:24:12.572904 2026] [:error] [pid 33650:tid 33676] [client 104.219.248.8:34062] [client 104.219.248.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.219.248.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXDEzDhphKhMjzf1IZxQAAARg"]
[Sun Jan 04 06:24:14.226881 2026] [:error] [pid 37536:tid 37558] [client 104.219.248.8:34076] [client 104.219.248.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.219.248.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXDm-iKLialy_3rksBZgAAABI"]
[Sun Jan 04 06:24:15.805803 2026] [:error] [pid 33650:tid 33675] [client 104.219.248.8:34092] [client 104.219.248.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.219.248.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXD0zDhphKhMjzf1IZzQAAARc"]
[Sun Jan 04 06:24:15.805944 2026] [:error] [pid 33650:tid 33675] [client 104.219.248.8:34092] [client 104.219.248.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 104.219.248.8, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXD0zDhphKhMjzf1IZzQAAARc"]
[Sun Jan 04 06:24:16.907507 2026] [:error] [pid 37538:tid 37623] [client 104.219.248.8:56030] [client 104.219.248.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.219.248.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXEIzU2j98LiSLQvRexwAAAJc"]
[Sun Jan 04 06:24:16.907665 2026] [:error] [pid 37538:tid 37623] [client 104.219.248.8:56030] [client 104.219.248.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 104.219.248.8, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXEIzU2j98LiSLQvRexwAAAJc"]
[Sun Jan 04 06:24:18.000317 2026] [:error] [pid 33650:tid 33676] [client 104.219.248.8:56036] [client 104.219.248.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.219.248.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXEUzDhphKhMjzf1IZ1QAAARg"]
[Sun Jan 04 06:24:18.000484 2026] [:error] [pid 33650:tid 33676] [client 104.219.248.8:56036] [client 104.219.248.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 104.219.248.8, counter = 8"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXEUzDhphKhMjzf1IZ1QAAARg"]
[Sun Jan 04 06:24:19.116103 2026] [:error] [pid 37537:tid 37587] [client 104.219.248.8:56038] [client 104.219.248.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.219.248.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXEwjHz7EQ5p_4u2pwfwAAAE4"]
[Sun Jan 04 06:24:19.116259 2026] [:error] [pid 37537:tid 37587] [client 104.219.248.8:56038] [client 104.219.248.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 104.219.248.8, counter = 9"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXEwjHz7EQ5p_4u2pwfwAAAE4"]
[Sun Jan 04 06:25:26.078260 2026] [:error] [pid 37537:tid 37573] [client 69.49.241.96:14896] [client 69.49.241.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.49.241.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXVgjHz7EQ5p_4u2pwuAAAAEA"]
[Sun Jan 04 06:25:27.702081 2026] [:error] [pid 37636:tid 37646] [client 69.49.241.96:14906] [client 69.49.241.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.49.241.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXVy3kmZpEf9yy2b1UZAAAAMY"]
[Sun Jan 04 06:25:29.229733 2026] [:error] [pid 37636:tid 37663] [client 69.49.241.96:14922] [client 69.49.241.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.49.241.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXWS3kmZpEf9yy2b1UaAAAANc"]
[Sun Jan 04 06:25:30.772655 2026] [:error] [pid 37538:tid 37620] [client 69.49.241.96:14928] [client 69.49.241.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.49.241.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXWozU2j98LiSLQvRfAwAAAJQ"]
[Sun Jan 04 06:25:32.326480 2026] [:error] [pid 33650:tid 33667] [client 69.49.241.96:14944] [client 69.49.241.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.49.241.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXXEzDhphKhMjzf1IaNAAAAQ8"]
[Sun Jan 04 06:25:33.853339 2026] [:error] [pid 33650:tid 33653] [client 69.49.241.96:38494] [client 69.49.241.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.49.241.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXXUzDhphKhMjzf1IaNQAAAQE"]
[Sun Jan 04 06:25:33.853509 2026] [:error] [pid 33650:tid 33653] [client 69.49.241.96:38494] [client 69.49.241.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 69.49.241.96, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXXUzDhphKhMjzf1IaNQAAAQE"]
[Sun Jan 04 06:25:34.853082 2026] [:error] [pid 37538:tid 37600] [client 69.49.241.96:38496] [client 69.49.241.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.49.241.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXXozU2j98LiSLQvRfCQAAAIA"]
[Sun Jan 04 06:25:34.853229 2026] [:error] [pid 37538:tid 37600] [client 69.49.241.96:38496] [client 69.49.241.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 69.49.241.96, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmXXozU2j98LiSLQvRfCQAAAIA"]
[Sun Jan 04 06:31:31.366988 2026] [:error] [pid 37536:tid 37545] [client 118.139.178.183:37452] [client 118.139.178.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.139.178.183, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmYw2-iKLialy_3rksC0wAAAAU"]
[Sun Jan 04 06:46:12.870822 2026] [:error] [pid 37536:tid 37547] [client 92.205.170.157:48342] [client 92.205.170.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.170.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmcNG-iKLialy_3rksHAwAAAAc"]
[Sun Jan 04 06:49:55.003654 2026] [:error] [pid 37538:tid 37622] [client 217.125.100.230:44074] [client 217.125.100.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.125.100.230, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmdE4zU2j98LiSLQvRkaAAAAJY"]
[Sun Jan 04 06:53:04.860516 2026] [:error] [pid 33650:tid 33674] [client 173.252.167.110:53890] [client 173.252.167.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.252.167.110, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmd0EzDhphKhMjzf1IlLgAAARY"]
[Sun Jan 04 07:44:44.396124 2026] [:error] [pid 33650:tid 33664] [client 68.183.98.56:53498] [client 68.183.98.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.98.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmp7EzDhphKhMjzf1I8owAAAQw"]
[Sun Jan 04 07:52:09.022827 2026] [:error] [pid 33650:tid 33672] [client 103.28.36.106:47480] [client 103.28.36.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.28.36.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmrqUzDhphKhMjzf1JAFwAAARQ"]
[Sun Jan 04 07:57:44.501407 2026] [:error] [pid 37536:tid 37546] [client 43.157.168.43:55536] [client 43.157.168.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVms-G-iKLialy_3rkscEQAAAAY"]
[Sun Jan 04 08:08:24.162828 2026] [:error] [pid 37538:tid 37619] [client 81.88.49.52:20618] [client 81.88.49.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.52, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVmveIzU2j98LiSLQvR9dgAAAJM"]
[Sun Jan 04 08:15:07.465063 2026] [:error] [pid 37636:tid 37640] [client 49.234.192.248:35854] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVmxCy3kmZpEf9yy2b14yQAAAMA"]
[Sun Jan 04 09:11:14.017402 2026] [:error] [pid 19754:tid 19778] [client 216.69.167.185:30450] [client 216.69.167.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.69.167.185, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVm-Mhxty1Q9YVCrc3vPwAAAANU"]
[Sun Jan 04 09:19:37.715015 2026] [:error] [pid 26030:tid 26097] [client 89.46.109.106:42182] [client 89.46.109.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.46.109.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVnAKeC0XBLe8v5-GnmyEAAAAws"]
[Sun Jan 04 09:22:24.828513 2026] [:error] [pid 10433:tid 10508] [client 184.168.114.28:18886] [client 184.168.114.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.114.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVnA0MnzLQE4NFGPgbCb7AAAAo4"]
[Sun Jan 04 09:42:55.104771 2026] [:error] [pid 26027:tid 26052] [client 103.28.36.224:40756] [client 103.28.36.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.28.36.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVnFn4EKJ8aV6qy2bHuCKgAAAlQ"]
[Sun Jan 04 10:13:49.569507 2026] [:error] [pid 36384:tid 36390] [client 103.152.249.56:43454] [client 103.152.249.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.152.249.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVnM3Qbq792sOvQ75j76bgAAAAQ"]
[Sun Jan 04 11:17:20.898745 2026] [:error] [pid 39676:tid 39692] [client 195.38.126.149:41390] [client 195.38.126.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.38.126.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVnbwK1I9TP5hrLD37zbgQAAAQ0"]
[Sun Jan 04 11:59:30.539440 2026] [:error] [pid 1020:tid 1024] [client 43.133.69.37:55308] [client 43.133.69.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVnlolzz6-t0R3_Ito0BjgAAAUE"]
[Sun Jan 04 12:29:04.102136 2026] [:error] [pid 64248:tid 64258] [client 185.243.11.123:43432] [client 185.243.11.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.243.11.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVnskMZZ_5Iet2g0ae20tgAAAEg"]
[Sun Jan 04 13:07:41.428526 2026] [:error] [pid 4427:tid 4469] [client 178.33.162.49:58964] [client 178.33.162.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.33.162.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVn1nT-T5ydE4nJe9DchbgAAA0w"]
[Sun Jan 04 13:21:56.491347 2026] [:error] [pid 15480:tid 15499] [client 81.88.49.8:62291] [client 81.88.49.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVn49BBWKIu3SdvwTFhzVwAAAJE"]
[Sun Jan 04 13:54:52.700477 2026] [:error] [pid 4426:tid 4451] [client 184.168.100.170:20030] [client 184.168.100.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.100.170, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVoArJAfkrNbrfBUY5UZMAAAAlU"]
[Sun Jan 04 14:25:23.048437 2026] [:error] [pid 4365:tid 4412] [client 81.88.49.50:52489] [client 81.88.49.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVoH08Mi25XHOoMs4mdDoAAAAZE"]
[Sun Jan 04 14:45:15.494838 2026] [:error] [pid 4426:tid 4445] [client 31.7.66.235:47906] [client 31.7.66.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.7.66.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVoMe5AfkrNbrfBUY5UjIAAAAk8"]
[Sun Jan 04 15:07:41.643234 2026] [:error] [pid 4365:tid 4416] [client 163.47.203.76:59618] [client 163.47.203.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.47.203.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVoRvcMi25XHOoMs4mdIeQAAAZU"]
[Sun Jan 04 15:38:35.358477 2026] [:error] [pid 64248:tid 64250] [client 167.99.215.209:57438] [client 167.99.215.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.215.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVoY-8ZZ_5Iet2g0ae3ajQAAAEA"]
[Sun Jan 04 15:56:51.430875 2026] [:error] [pid 4333:tid 4357] [client 37.187.149.168:56956] [client 37.187.149.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.187.149.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVodQzAH-zZWAfquimDltwAAABU"]
[Sun Jan 04 16:08:37.346373 2026] [:error] [pid 15480:tid 15487] [client 209.172.2.20:59972] [client 209.172.2.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.172.2.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVogBRBWKIu3SdvwTFiLogAAAIU"]
[Sun Jan 04 16:26:07.078449 2026] [:error] [pid 4365:tid 4407] [client 184.168.101.160:27868] [client 184.168.101.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.101.160, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVokH8Mi25XHOoMs4mdVxAAAAYw"]
[Sun Jan 04 16:32:16.473174 2026] [:error] [pid 4333:tid 4353] [client 43.157.170.126:51958] [client 43.157.170.126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVolkDAH-zZWAfquimDxZwAAABE"]
[Sun Jan 04 17:40:06.710942 2026] [:error] [pid 59250:tid 59273] [client 202.92.5.25:39592] [client 202.92.5.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.92.5.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVo1dvPJ-KGeNWdqpudW4wAAANI"]
[Sun Jan 04 17:58:36.994093 2026] [:error] [pid 1080:tid 1154] [client 138.197.13.155:57290] [client 138.197.13.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "aVo5zCu2Hm9AcIiqg0q3VwAAA88"], referer: binance.com
[Sun Jan 04 18:00:22.554499 2026] [:error] [pid 4365:tid 4396] [client 132.148.216.207:34666] [client 132.148.216.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.216.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVo6NsMi25XHOoMs4mdlpQAAAYE"]
[Sun Jan 04 18:26:56.088676 2026] [autoindex:error] [pid 47942:tid 47963] [client 134.209.45.58:59794] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Jan 04 19:23:35.404084 2026] [:error] [pid 58433:tid 58474] [client 43.166.244.251:44726] [client 43.166.244.251] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVpNt05m7bkw35zhUNbfIAAAAQo"]
[Sun Jan 04 21:16:05.489204 2026] [:error] [pid 21720:tid 21737] [client 103.13.50.37:59264] [client 103.13.50.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.13.50.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVpoFX5pkDWzwRcldOpRmAAAAI8"]
[Sun Jan 04 21:20:14.980755 2026] [:error] [pid 21720:tid 21743] [client 95.168.164.34:50532] [client 95.168.164.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.168.164.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVppDn5pkDWzwRcldOpS6AAAAJU"]
[Sun Jan 04 21:28:09.215061 2026] [:error] [pid 29351:tid 29389] [client 15.235.15.122:51190] [client 15.235.15.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.15.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVpq6ZtGiMsRmNcKXvo6-gAAAsU"]
[Sun Jan 04 22:01:12.889713 2026] [:error] [pid 43467:tid 43484] [client 162.241.217.222:46184] [client 162.241.217.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.217.222, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVpyqCnfieJppNajUV1QHAAAAI8"]
[Sun Jan 04 22:08:11.761350 2026] [:error] [pid 29351:tid 29396] [client 4.213.62.73:56101] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/anz.php"] [unique_id "aVp0S5tGiMsRmNcKXvpF9gAAAsw"]
[Sun Jan 04 22:08:13.089525 2026] [:error] [pid 43583:tid 43613] [client 4.213.62.73:61394] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/anz.php"] [unique_id "aVp0TeZbrSRUiJ-RX9ZAywAAAVg"]
[Sun Jan 04 22:08:15.160818 2026] [:error] [pid 45949:tid 45966] [client 4.213.62.73:61982] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/anz.php"] [unique_id "aVp0T6WUhIYCdxgkhpBObgAAAgw"]
[Sun Jan 04 22:08:17.572158 2026] [:error] [pid 29351:tid 29399] [client 4.213.62.73:55148] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/anz.php"] [unique_id "aVp0UZtGiMsRmNcKXvpF_AAAAs8"]
[Sun Jan 04 22:08:19.315770 2026] [:error] [pid 29351:tid 29401] [client 4.213.62.73:60890] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bnn_.php"] [unique_id "aVp0U5tGiMsRmNcKXvpF_wAAAtE"]
[Sun Jan 04 22:08:20.246322 2026] [:error] [pid 45949:tid 45969] [client 4.213.62.73:55146] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bnn_.php"] [unique_id "aVp0VKWUhIYCdxgkhpBOegAAAg8"]
[Sun Jan 04 22:08:21.331493 2026] [:error] [pid 37165:tid 37216] [client 4.213.62.73:21393] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bnn_.php"] [unique_id "aVp0VVwRLzfe8wOrQpRiiwAAAlE"]
[Sun Jan 04 22:08:22.628419 2026] [:error] [pid 45950:tid 45992] [client 4.213.62.73:60927] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bnn_.php"] [unique_id "aVp0Vlx-3HUGZIlAI-5QSgAAA4o"]
[Sun Jan 04 22:08:24.170147 2026] [:error] [pid 42665:tid 42674] [client 4.213.62.73:60886] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aVp0WBRwYwWkN__L8BWT6gAAAoU"]
[Sun Jan 04 22:08:24.956208 2026] [:error] [pid 29351:tid 29389] [client 4.213.62.73:56062] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aVp0WJtGiMsRmNcKXvpGBAAAAsU"]
[Sun Jan 04 22:08:27.167401 2026] [:error] [pid 43583:tid 43596] [client 4.213.62.73:55118] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aVp0W-ZbrSRUiJ-RX9ZA1gAAAUc"]
[Sun Jan 04 22:08:27.586855 2026] [:error] [pid 45863:tid 45874] [client 4.213.62.73:52189] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aVp0W1Gr1mgeue1bWvTXEgAAAAk"]
[Sun Jan 04 22:08:28.977677 2026] [:error] [pid 45863:tid 45868] [client 4.213.62.73:60872] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file66.php"] [unique_id "aVp0XFGr1mgeue1bWvTXFgAAAAM"]
[Sun Jan 04 22:08:31.862232 2026] [:error] [pid 42665:tid 42686] [client 4.213.62.73:52176] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file66.php"] [unique_id "aVp0XxRwYwWkN__L8BWT8QAAApE"]
[Sun Jan 04 22:08:32.761032 2026] [:error] [pid 29351:tid 29396] [client 4.213.62.73:21421] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file66.php"] [unique_id "aVp0YJtGiMsRmNcKXvpGCgAAAsw"]
[Sun Jan 04 22:08:34.851006 2026] [:error] [pid 45863:tid 45871] [client 4.213.62.73:52222] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file66.php"] [unique_id "aVp0YlGr1mgeue1bWvTXGQAAAAY"]
[Sun Jan 04 22:08:36.598392 2026] [:error] [pid 42666:tid 42698] [client 4.213.62.73:21435] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kure.php"] [unique_id "aVp0ZPc221c7vwWrOjcTvQAAAwE"]
[Sun Jan 04 22:08:39.080846 2026] [:error] [pid 37165:tid 37203] [client 4.213.62.73:32927] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kure.php"] [unique_id "aVp0Z1wRLzfe8wOrQpRimAAAAkQ"]
[Sun Jan 04 22:08:41.503478 2026] [:error] [pid 45950:tid 46004] [client 4.213.62.73:60873] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kure.php"] [unique_id "aVp0aVx-3HUGZIlAI-5QXQAAA5Y"]
[Sun Jan 04 22:08:42.507607 2026] [:error] [pid 43583:tid 43604] [client 4.213.62.73:56053] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kure.php"] [unique_id "aVp0auZbrSRUiJ-RX9ZA2gAAAU8"]
[Sun Jan 04 22:08:43.929678 2026] [:error] [pid 37165:tid 37208] [client 4.213.62.73:56037] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gaje.php"] [unique_id "aVp0a1wRLzfe8wOrQpRimgAAAkk"]
[Sun Jan 04 22:08:46.918660 2026] [:error] [pid 45950:tid 45988] [client 4.213.62.73:60913] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gaje.php"] [unique_id "aVp0blx-3HUGZIlAI-5QXwAAA4Y"]
[Sun Jan 04 22:08:48.565498 2026] [:error] [pid 30985:tid 31016] [client 4.213.62.73:56061] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gaje.php"] [unique_id "aVp0cEisiM0XfzVcTWCzfAAAAcI"]
[Sun Jan 04 22:08:49.756788 2026] [:error] [pid 29351:tid 29407] [client 4.213.62.73:60125] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gaje.php"] [unique_id "aVp0cZtGiMsRmNcKXvpGFwAAAtc"]
[Sun Jan 04 22:08:50.590803 2026] [:error] [pid 45949:tid 45965] [client 4.213.62.73:60897] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blnux.php"] [unique_id "aVp0cqWUhIYCdxgkhpBOjgAAAgs"]
[Sun Jan 04 22:08:52.402600 2026] [:error] [pid 42665:tid 42670] [client 4.213.62.73:56049] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blnux.php"] [unique_id "aVp0dBRwYwWkN__L8BWT-gAAAoE"]
[Sun Jan 04 22:08:54.549090 2026] [:error] [pid 42666:tid 42720] [client 4.213.62.73:60884] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blnux.php"] [unique_id "aVp0dvc221c7vwWrOjcTxgAAAxc"]
[Sun Jan 04 22:08:56.183805 2026] [:error] [pid 42665:tid 42685] [client 4.213.62.73:60114] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blnux.php"] [unique_id "aVp0eBRwYwWkN__L8BWUAgAAApA"]
[Sun Jan 04 22:09:01.359537 2026] [:error] [pid 37165:tid 37222] [client 4.213.62.73:32934] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fgd.php"] [unique_id "aVp0fVwRLzfe8wOrQpRirAAAAlc"]
[Sun Jan 04 22:09:05.426870 2026] [:error] [pid 42665:tid 42673] [client 4.213.62.73:56016] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fgd.php"] [unique_id "aVp0gRRwYwWkN__L8BWUBwAAAoQ"]
[Sun Jan 04 22:09:08.285002 2026] [:error] [pid 45950:tid 45995] [client 4.213.62.73:65255] [client 4.213.62.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fgd.php"] [unique_id "aVp0hFx-3HUGZIlAI-5QbwAAA40"]
[Sun Jan 04 22:12:48.517629 2026] [:error] [pid 29351:tid 29403] [client 192.250.239.85:55912] [client 192.250.239.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.239.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVp1YJtGiMsRmNcKXvpHFAAAAtM"]
[Sun Jan 04 22:13:01.097747 2026] [:error] [pid 37165:tid 37208] [client 192.169.165.47:25676] [client 192.169.165.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.169.165.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVp1bVwRLzfe8wOrQpRjRwAAAkk"]
[Sun Jan 04 22:16:50.284518 2026] [:error] [pid 45863:tid 45867] [client 103.13.50.37:50258] [client 103.13.50.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.13.50.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVp2UlGr1mgeue1bWvTYgQAAAAI"]
[Sun Jan 04 22:25:21.552916 2026] [:error] [pid 50286:tid 50299] [client 82.167.183.234:45242] [client 82.167.183.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.167.183.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVp4UYsZ42BFbcA1SgEEAAAAAkk"]
[Sun Jan 04 22:48:46.780003 2026] [:error] [pid 48633:tid 48649] [client 167.99.215.209:40432] [client 167.99.215.209] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/index.php/wp-json/wp/v2/users"] [unique_id "aVp9znpmEoQIuLH2aWhNOgAAAE4"]
[Sun Jan 04 22:51:09.786476 2026] [:error] [pid 50288:tid 50362] [client 37.24.161.119:50389] [client 37.24.161.119] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/Wp/v2/users"] [unique_id "aVp-Xa_n0RHxRx0wErHQ-QAAA9I"]
[Sun Jan 04 22:51:12.361379 2026] [:error] [pid 48633:tid 48651] [client 137.184.193.136:52746] [client 137.184.193.136] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/Wp/v2/users"] [unique_id "aVp-YHpmEoQIuLH2aWhNpQAAAFA"]
[Sun Jan 04 22:52:12.203116 2026] [:error] [pid 50229:tid 50237] [client 184.168.114.114:15816] [client 184.168.114.114] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/usErs"] [unique_id "aVp-nKhKBHGV8WZnitt8fAAAAMU"]
[Sun Jan 04 22:52:38.906931 2026] [:error] [pid 48633:tid 48648] [client 31.7.66.235:59026] [client 31.7.66.235] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/Wp-JsOn/Wp/V2/UsErS"] [unique_id "aVp-tnpmEoQIuLH2aWhN3QAAAE0"]
[Sun Jan 04 22:52:45.826690 2026] [:error] [pid 50198:tid 50214] [client 82.167.183.234:24153] [client 82.167.183.234] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/Wp-JsOn/Wp/V2/UsErS"] [unique_id "aVp-vWdhZ-F4hMTchPgRywAAAI4"]
[Sun Jan 04 22:53:09.738512 2026] [:error] [pid 50288:tid 50358] [client 184.168.115.88:37736] [client 184.168.115.88] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aVp-1a_n0RHxRx0wErHRpQAAA84"]
[Sun Jan 04 22:59:11.875479 2026] [:error] [pid 48727:tid 48761] [client 43.166.250.187:58752] [client 43.166.250.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVqAP_gJtUs-E_QT0ibguwAAA0Q"]
[Mon Jan 05 01:39:32.165475 2026] [:error] [pid 7626:tid 7649] [client 170.106.165.186:53234] [client 170.106.165.186] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVql1FjhVzHrevQ2GQzhvwAAAco"]
[Mon Jan 05 02:49:13.720564 2026] [:error] [pid 6937:tid 6984] [client 106.54.62.156:55040] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVq2KQfTYSkMJzNSH4V5EwAAAU8"]
[Mon Jan 05 05:26:17.884416 2026] [:error] [pid 5534:tid 5543] [client 43.131.253.14:53920] [client 43.131.253.14] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVra-ZNs9XmbR6unB0y0QQAAAAA"]
[Mon Jan 05 06:04:28.589266 2026] [:error] [pid 6680:tid 6705] [client 185.132.186.45:45361] [client 185.132.186.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aVrj7KE58uNoazzTmx3jtgAAARc"]
[Mon Jan 05 06:04:34.944900 2026] [:error] [pid 5535:tid 5593] [client 185.132.186.32:32211] [client 185.132.186.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aVrj8mnkedMjhVX0PTWR8AAAAFc"]
[Mon Jan 05 06:04:45.744209 2026] [:error] [pid 6680:tid 6698] [client 185.132.186.33:33415] [client 185.132.186.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aVrj_aE58uNoazzTmx3j4wAAARA"]
[Mon Jan 05 06:04:53.220112 2026] [:error] [pid 5632:tid 5659] [client 185.132.186.36:56989] [client 185.132.186.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aVrkBYN3ZWvlOh-nbt-0swAAAM8"]
[Mon Jan 05 06:05:03.978748 2026] [:error] [pid 6680:tid 6704] [client 185.132.186.4:39463] [client 185.132.186.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aVrkD6E58uNoazzTmx3j-gAAARY"]
[Mon Jan 05 06:05:07.555951 2026] [:error] [pid 5632:tid 5654] [client 185.132.186.48:31823] [client 185.132.186.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aVrkE4N3ZWvlOh-nbt-0wgAAAMo"]
[Mon Jan 05 06:05:08.882591 2026] [:error] [pid 5536:tid 5605] [client 185.132.186.11:53197] [client 185.132.186.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aVrkFARtMZNG6xI8yDzTTQAAAIg"]
[Mon Jan 05 06:05:10.192980 2026] [:error] [pid 5632:tid 5659] [client 185.132.186.12:58849] [client 185.132.186.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aVrkFoN3ZWvlOh-nbt-0ywAAAM8"]
[Mon Jan 05 06:05:11.514350 2026] [:error] [pid 5632:tid 5665] [client 185.132.186.6:52895] [client 185.132.186.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aVrkF4N3ZWvlOh-nbt-0zQAAANU"]
[Mon Jan 05 06:05:12.836975 2026] [:error] [pid 5536:tid 5612] [client 185.132.186.48:53881] [client 185.132.186.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aVrkGARtMZNG6xI8yDzTUQAAAI8"]
[Mon Jan 05 06:05:15.392229 2026] [:error] [pid 5632:tid 5653] [client 185.132.186.48:20031] [client 185.132.186.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aVrkG4N3ZWvlOh-nbt-01AAAAMk"]
[Mon Jan 05 06:05:26.707564 2026] [autoindex:error] [pid 5534:tid 5555] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:27.371564 2026] [autoindex:error] [pid 5534:tid 5551] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:28.033150 2026] [autoindex:error] [pid 5534:tid 5547] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:28.695708 2026] [autoindex:error] [pid 5534:tid 5566] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:31.619389 2026] [autoindex:error] [pid 5534:tid 5544] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:32.278986 2026] [autoindex:error] [pid 5534:tid 5550] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:32.938797 2026] [autoindex:error] [pid 5534:tid 5549] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:33.603776 2026] [autoindex:error] [pid 5534:tid 5559] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:34.269600 2026] [autoindex:error] [pid 5534:tid 5565] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:34.929133 2026] [autoindex:error] [pid 5534:tid 5567] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:36.253519 2026] [autoindex:error] [pid 5534:tid 5563] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:38.328806 2026] [autoindex:error] [pid 5534:tid 5566] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:38.987427 2026] [autoindex:error] [pid 5534:tid 5545] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:42.659668 2026] [autoindex:error] [pid 5534:tid 5548] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:43.320965 2026] [autoindex:error] [pid 5534:tid 5554] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:43.981183 2026] [autoindex:error] [pid 5534:tid 5563] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:44.640187 2026] [autoindex:error] [pid 5534:tid 5558] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:46.658390 2026] [autoindex:error] [pid 5534:tid 5564] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:47.319676 2026] [autoindex:error] [pid 5534:tid 5566] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:49.312864 2026] [autoindex:error] [pid 5534:tid 5546] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:52.627162 2026] [autoindex:error] [pid 5534:tid 5556] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:53.290015 2026] [autoindex:error] [pid 5534:tid 5559] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:53.949763 2026] [autoindex:error] [pid 5534:tid 5565] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:05:58.672053 2026] [autoindex:error] [pid 5534:tid 5561] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:06:04.070599 2026] [autoindex:error] [pid 5534:tid 5558] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:06:06.092616 2026] [autoindex:error] [pid 5534:tid 5564] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:06:06.752697 2026] [autoindex:error] [pid 5534:tid 5566] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:06:08.728813 2026] [autoindex:error] [pid 5534:tid 5543] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:06:09.389628 2026] [autoindex:error] [pid 5534:tid 5565] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:06:10.049442 2026] [autoindex:error] [pid 5534:tid 5549] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:06:16.130507 2026] [autoindex:error] [pid 5534:tid 5554] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:06:51.633889 2026] [autoindex:error] [pid 5534:tid 5551] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:06:52.296634 2026] [autoindex:error] [pid 5534:tid 5566] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:06:52.959285 2026] [autoindex:error] [pid 5534:tid 5552] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:06:53.619454 2026] [autoindex:error] [pid 5534:tid 5543] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:06:56.947951 2026] [autoindex:error] [pid 5534:tid 5563] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:06:57.608896 2026] [autoindex:error] [pid 5534:tid 5565] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:06:59.611930 2026] [autoindex:error] [pid 5534:tid 5561] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:07:01.696241 2026] [autoindex:error] [pid 5534:tid 5564] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:07:02.356510 2026] [autoindex:error] [pid 5534:tid 5552] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:07:03.015778 2026] [autoindex:error] [pid 5534:tid 5546] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:07:05.032143 2026] [autoindex:error] [pid 5534:tid 5560] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:07:05.693463 2026] [autoindex:error] [pid 5534:tid 5549] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:07:06.357774 2026] [autoindex:error] [pid 5534:tid 5559] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:07:07.020306 2026] [autoindex:error] [pid 5534:tid 5555] [client 185.132.186.14:57069] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:07:40.435349 2026] [autoindex:error] [pid 5534:tid 5552] [client 185.132.186.38:46093] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:07:55.769514 2026] [autoindex:error] [pid 5534:tid 5564] [client 185.132.186.38:46093] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:08:01.740378 2026] [autoindex:error] [pid 5534:tid 5553] [client 185.132.186.38:46093] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:08:02.401357 2026] [autoindex:error] [pid 5534:tid 5545] [client 185.132.186.38:46093] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:08:08.507680 2026] [autoindex:error] [pid 5534:tid 5543] [client 185.132.186.38:46093] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:08:09.169226 2026] [autoindex:error] [pid 5534:tid 5554] [client 185.132.186.38:46093] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:08:09.830350 2026] [autoindex:error] [pid 5534:tid 5558] [client 185.132.186.38:46093] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:08:10.490985 2026] [autoindex:error] [pid 5534:tid 5545] [client 185.132.186.38:46093] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:08:11.153429 2026] [autoindex:error] [pid 5534:tid 5552] [client 185.132.186.38:46093] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:08:11.836815 2026] [autoindex:error] [pid 5534:tid 5556] [client 185.132.186.38:46093] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:08:12.496956 2026] [autoindex:error] [pid 5534:tid 5553] [client 185.132.186.38:46093] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:08:13.157587 2026] [autoindex:error] [pid 5534:tid 5557] [client 185.132.186.38:46093] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:08:13.819196 2026] [autoindex:error] [pid 5534:tid 5567] [client 185.132.186.38:46093] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 06:08:42.503342 2026] [autoindex:error] [pid 5534:tid 5547] [client 185.132.186.38:46093] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Jan 05 07:52:31.137374 2026] [:error] [pid 5632:tid 5666] [client 43.166.244.251:52492] [client 43.166.244.251] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVr9P4N3ZWvlOh-nbt_gZgAAANY"]
[Mon Jan 05 08:37:26.959097 2026] [:error] [pid 5535:tid 5591] [client 117.33.163.216:35890] [client 117.33.163.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVsHxmnkedMjhVX0PTXJ9QAAAFU"]
[Mon Jan 05 11:24:58.644797 2026] [:error] [pid 5632:tid 5649] [client 159.223.64.161:64597] [client 159.223.64.161] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aVsvCoN3ZWvlOh-nbt8wjQAAAMU"]
[Mon Jan 05 14:19:32.788845 2026] [:error] [pid 5632:tid 5665] [client 49.51.253.83:55526] [client 49.51.253.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVtX9IN3ZWvlOh-nbt9qDAAAANU"]
[Mon Jan 05 14:48:49.745441 2026] [:error] [pid 5536:tid 5620] [client 101.91.148.219:52640] [client 101.91.148.219] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVte0QRtMZNG6xI8yDx-nQAAAJc"]
[Mon Jan 05 18:26:27.547398 2026] [:error] [pid 6680:tid 6697] [client 20.205.40.135:30317] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/anz.php"] [unique_id "aVuR06E58uNoazzTmx3ScQAAAQ8"]
[Mon Jan 05 18:26:31.166582 2026] [:error] [pid 6680:tid 6683] [client 20.205.40.135:7954] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/anz.php"] [unique_id "aVuR16E58uNoazzTmx3SfgAAAQE"]
[Mon Jan 05 18:26:34.034976 2026] [:error] [pid 5632:tid 5658] [client 20.205.40.135:30276] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/anz.php"] [unique_id "aVuR2oN3ZWvlOh-nbt-rfgAAAM4"]
[Mon Jan 05 18:26:38.641634 2026] [:error] [pid 6680:tid 6705] [client 20.205.40.135:7978] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/anz.php"] [unique_id "aVuR3qE58uNoazzTmx3SiAAAARc"]
[Mon Jan 05 18:26:50.096392 2026] [:error] [pid 5632:tid 5653] [client 20.205.40.135:22761] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bnn_.php"] [unique_id "aVuR6oN3ZWvlOh-nbt-rpQAAAMk"]
[Mon Jan 05 18:26:54.616137 2026] [:error] [pid 5536:tid 5604] [client 20.205.40.135:25003] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aVuR7gRtMZNG6xI8yDzGxwAAAIc"]
[Mon Jan 05 18:26:57.851761 2026] [:error] [pid 5536:tid 5597] [client 20.205.40.135:25046] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aVuR8QRtMZNG6xI8yDzG0AAAAIA"]
[Mon Jan 05 18:26:59.205824 2026] [:error] [pid 5536:tid 5606] [client 20.205.40.135:23463] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aVuR8wRtMZNG6xI8yDzG0QAAAIk"]
[Mon Jan 05 18:27:00.725530 2026] [:error] [pid 54081:tid 54097] [client 20.205.40.135:20248] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aVuR9FL4jLgtF-b9w4dqjwAAAU0"]
[Mon Jan 05 18:27:02.549512 2026] [:error] [pid 5534:tid 5551] [client 20.205.40.135:11586] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file66.php"] [unique_id "aVuR9pNs9XmbR6unB0ycswAAAAg"]
[Mon Jan 05 18:27:04.385098 2026] [:error] [pid 54081:tid 54091] [client 20.205.40.135:2183] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file66.php"] [unique_id "aVuR-FL4jLgtF-b9w4dqkwAAAUc"]
[Mon Jan 05 18:27:10.182292 2026] [:error] [pid 5632:tid 5661] [client 20.205.40.135:19053] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file66.php"] [unique_id "aVuR_oN3ZWvlOh-nbt-ruwAAANE"]
[Mon Jan 05 18:27:10.888517 2026] [:error] [pid 5632:tid 5668] [client 20.205.40.135:31447] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file66.php"] [unique_id "aVuR_oN3ZWvlOh-nbt-rvgAAANg"]
[Mon Jan 05 18:27:15.877625 2026] [:error] [pid 5632:tid 5651] [client 20.205.40.135:11567] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kure.php"] [unique_id "aVuSA4N3ZWvlOh-nbt-rzgAAAMc"]
[Mon Jan 05 18:27:16.635765 2026] [:error] [pid 6680:tid 6699] [client 20.205.40.135:21882] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kure.php"] [unique_id "aVuSBKE58uNoazzTmx3SvQAAARE"]
[Mon Jan 05 18:27:17.379126 2026] [:error] [pid 6680:tid 6692] [client 20.205.40.135:27849] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kure.php"] [unique_id "aVuSBaE58uNoazzTmx3SwAAAAQo"]
[Mon Jan 05 18:27:18.207178 2026] [:error] [pid 5534:tid 5562] [client 20.205.40.135:9632] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kure.php"] [unique_id "aVuSBpNs9XmbR6unB0ycxwAAABM"]
[Mon Jan 05 18:27:19.366134 2026] [:error] [pid 5534:tid 5560] [client 20.205.40.135:21974] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gaje.php"] [unique_id "aVuSB5Ns9XmbR6unB0ycygAAABE"]
[Mon Jan 05 18:27:21.554907 2026] [:error] [pid 5534:tid 5548] [client 20.205.40.135:22035] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gaje.php"] [unique_id "aVuSCZNs9XmbR6unB0yczgAAAAU"]
[Mon Jan 05 18:27:22.546561 2026] [:error] [pid 5534:tid 5563] [client 20.205.40.135:21684] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gaje.php"] [unique_id "aVuSCpNs9XmbR6unB0yc0wAAABQ"]
[Mon Jan 05 18:27:24.582630 2026] [:error] [pid 5534:tid 5555] [client 20.205.40.135:24686] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gaje.php"] [unique_id "aVuSDJNs9XmbR6unB0yc2wAAAAw"]
[Mon Jan 05 18:27:25.015602 2026] [:error] [pid 5534:tid 5543] [client 20.205.40.135:31415] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blnux.php"] [unique_id "aVuSDZNs9XmbR6unB0yc3AAAAAA"]
[Mon Jan 05 18:27:25.713717 2026] [:error] [pid 5536:tid 5608] [client 20.205.40.135:11560] [client 20.205.40.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blnux.php"] [unique_id "aVuSDQRtMZNG6xI8yDzG7AAAAIs"]
[Mon Jan 05 21:57:46.661519 2026] [:error] [pid 5632:tid 5661] [client 34.138.192.115:53623] [client 34.138.192.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.138.192.115, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvDWoN3ZWvlOh-nbt_jGgAAANE"]
[Mon Jan 05 21:57:48.847283 2026] [:error] [pid 5632:tid 5646] [client 34.138.192.115:53623] [client 34.138.192.115] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aVvDXIN3ZWvlOh-nbt_jHQAAAMI"]
[Mon Jan 05 21:57:49.062514 2026] [:error] [pid 5632:tid 5650] [client 34.138.192.115:53623] [client 34.138.192.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.138.192.115, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvDXYN3ZWvlOh-nbt_jHgAAAMY"]
[Mon Jan 05 21:57:50.520878 2026] [:error] [pid 28407:tid 28414] [client 34.138.192.115:56213] [client 34.138.192.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.138.192.115, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvDXtercd3ptydUzM1mqgAAAYQ"]
[Mon Jan 05 21:57:52.001625 2026] [:error] [pid 54081:tid 54100] [client 34.138.192.115:54675] [client 34.138.192.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.138.192.115, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvDYFL4jLgtF-b9w4efdQAAAVA"]
[Mon Jan 05 21:57:52.001735 2026] [:error] [pid 54081:tid 54100] [client 34.138.192.115:54675] [client 34.138.192.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.138.192.115, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvDYFL4jLgtF-b9w4efdQAAAVA"]
[Tue Jan 06 00:36:22.579698 2026] [:error] [pid 60514:tid 60579] [client 34.145.204.214:55569] [client 34.145.204.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.145.204.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvohm70C0kefOIBEs9UhwAAAMQ"]
[Tue Jan 06 00:36:25.018688 2026] [:error] [pid 60514:tid 60583] [client 34.145.204.214:55569] [client 34.145.204.214] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aVvoiW70C0kefOIBEs9UjAAAAMg"]
[Tue Jan 06 00:36:25.255328 2026] [:error] [pid 60514:tid 60599] [client 34.145.204.214:55569] [client 34.145.204.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.145.204.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvoiW70C0kefOIBEs9UjwAAANg"]
[Tue Jan 06 00:36:26.853050 2026] [:error] [pid 60514:tid 60596] [client 34.145.204.214:53959] [client 34.145.204.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.145.204.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvoim70C0kefOIBEs9UkQAAANU"]
[Tue Jan 06 00:36:28.355126 2026] [:error] [pid 60605:tid 60611] [client 34.145.204.214:62505] [client 34.145.204.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.145.204.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvojJGdDsTlcaRtgxQ6jQAAAQQ"]
[Tue Jan 06 00:36:29.903705 2026] [:error] [pid 29187:tid 29189] [client 34.145.204.214:49483] [client 34.145.204.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.145.204.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvojYSYYRtfmMXGZCqBrQAAAAA"]
[Tue Jan 06 00:36:31.360575 2026] [:error] [pid 60514:tid 60587] [client 34.145.204.214:65152] [client 34.145.204.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.145.204.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvoj270C0kefOIBEs9UoQAAAMw"]
[Tue Jan 06 00:36:31.360745 2026] [:error] [pid 60514:tid 60587] [client 34.145.204.214:65152] [client 34.145.204.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.145.204.214, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvoj270C0kefOIBEs9UoQAAAMw"]
[Tue Jan 06 01:08:58.052801 2026] [:error] [pid 60514:tid 60582] [client 34.78.87.113:58977] [client 34.78.87.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.78.87.113, counter = 6"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVvwKm70C0kefOIBEs9eigAAAMc"]
[Tue Jan 06 01:08:58.604017 2026] [:error] [pid 60510:tid 60555] [client 34.78.87.113:51575] [client 34.78.87.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.78.87.113, counter = 6"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVvwKm3HNEkuMRrTL0INUAAAAIc"]
[Tue Jan 06 01:08:59.153998 2026] [:error] [pid 60605:tid 60607] [client 34.78.87.113:53907] [client 34.78.87.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.78.87.113, counter = 6"] [hostname "expressinteriors.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aVvwK5GdDsTlcaRtgxRJlgAAAQA"]
[Tue Jan 06 01:16:41.444974 2026] [:error] [pid 60510:tid 60560] [client 47.237.5.250:45790] [client 47.237.5.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.237.5.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvx-W3HNEkuMRrTL0IPzAAAAIw"]
[Tue Jan 06 01:16:43.123201 2026] [:error] [pid 60510:tid 60564] [client 47.237.5.250:45914] [client 47.237.5.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.237.5.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvx-23HNEkuMRrTL0IP0gAAAJA"]
[Tue Jan 06 01:16:44.568112 2026] [:error] [pid 29187:tid 29200] [client 47.237.5.250:46062] [client 47.237.5.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.237.5.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvx_ISYYRtfmMXGZCqQpgAAAAs"]
[Tue Jan 06 01:17:18.805767 2026] [:error] [pid 60509:tid 60541] [client 95.169.180.53:56054] [client 95.169.180.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.169.180.53, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvyHqBSiT1_wVwKSvQq7AAAAFQ"]
[Tue Jan 06 01:17:22.069619 2026] [:error] [pid 60605:tid 60614] [client 95.169.180.53:56060] [client 95.169.180.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.169.180.53, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvyIpGdDsTlcaRtgxRNPwAAAQc"]
[Tue Jan 06 01:17:25.270437 2026] [:error] [pid 29187:tid 29211] [client 95.169.180.53:56066] [client 95.169.180.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.169.180.53, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvyJYSYYRtfmMXGZCqQ_wAAABY"]
[Tue Jan 06 01:17:53.376338 2026] [:error] [pid 60509:tid 60539] [client 43.241.73.20:56998] [client 43.241.73.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.241.73.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvyQaBSiT1_wVwKSvQrJgAAAFI"]
[Tue Jan 06 01:17:55.203636 2026] [:error] [pid 60510:tid 60570] [client 43.241.73.20:57250] [client 43.241.73.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.241.73.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvyQm3HNEkuMRrTL0IQXQAAAJY"]
[Tue Jan 06 01:17:57.099434 2026] [:error] [pid 60514:tid 60580] [client 43.241.73.20:57496] [client 43.241.73.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.241.73.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvyRG70C0kefOIBEs9hqwAAAMU"]
[Tue Jan 06 01:18:31.950330 2026] [:error] [pid 60514:tid 60589] [client 45.159.149.137:59896] [client 45.159.149.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.159.149.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvyZ270C0kefOIBEs9iBAAAAM4"]
[Tue Jan 06 01:18:35.565332 2026] [:error] [pid 60514:tid 60577] [client 45.159.149.137:59908] [client 45.159.149.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.159.149.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvya270C0kefOIBEs9iEAAAAMI"]
[Tue Jan 06 01:18:38.617130 2026] [:error] [pid 60514:tid 60589] [client 45.159.149.137:59922] [client 45.159.149.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.159.149.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvybm70C0kefOIBEs9iFAAAAM4"]
[Tue Jan 06 01:18:57.964685 2026] [:error] [pid 60509:tid 60527] [client 45.32.113.232:51314] [client 45.32.113.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.32.113.232, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvygaBSiT1_wVwKSvQrjAAAAEY"]
[Tue Jan 06 01:18:59.421762 2026] [:error] [pid 60510:tid 60549] [client 45.32.113.232:51320] [client 45.32.113.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.32.113.232, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvyg23HNEkuMRrTL0IQugAAAIE"]
[Tue Jan 06 01:19:01.155002 2026] [:error] [pid 29187:tid 29189] [client 45.32.113.232:51332] [client 45.32.113.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.32.113.232, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVvyhYSYYRtfmMXGZCqRhwAAAAA"]
[Tue Jan 06 01:49:17.069951 2026] [:error] [pid 60514:tid 60599] [client 34.170.17.20:51850] [client 34.170.17.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.170.17.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVv5nW70C0kefOIBEs9pxwAAANg"]
[Tue Jan 06 01:49:19.302898 2026] [:error] [pid 60514:tid 60590] [client 34.170.17.20:51850] [client 34.170.17.20] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aVv5n270C0kefOIBEs9pywAAAM8"]
[Tue Jan 06 01:49:19.658328 2026] [:error] [pid 60514:tid 60586] [client 34.170.17.20:51850] [client 34.170.17.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.170.17.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVv5n270C0kefOIBEs9pzQAAAMs"]
[Tue Jan 06 01:49:19.662495 2026] [:error] [pid 60514:tid 60586] [client 34.170.17.20:51850] [client 34.170.17.20] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/usr/local/apache/modsecurity-cwaf/rules/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 34.170.17.20 (1+1 hits since last alert)|expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVv5n270C0kefOIBEs9pzQAAAMs"]
[Tue Jan 06 03:33:50.846857 2026] [:error] [pid 42105:tid 42127] [client 182.44.67.97:33656] [client 182.44.67.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVwSHmSRL09ZIIy9dseHaQAAANQ"]
[Tue Jan 06 04:46:12.426613 2026] [:error] [pid 45012:tid 45026] [client 103.172.239.79:48604] [client 103.172.239.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.172.239.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVwjFBaMAxCuju1d0ubnygAAAMw"]
[Tue Jan 06 04:46:14.084761 2026] [:error] [pid 44903:tid 44910] [client 103.172.239.79:48614] [client 103.172.239.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.172.239.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVwjFthHqjs38zbkQPAwIgAAAAM"]
[Tue Jan 06 04:46:15.692744 2026] [:error] [pid 44905:tid 44979] [client 103.172.239.79:48616] [client 103.172.239.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.172.239.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVwjF7u7ufwWVst9EAvVQQAAAIs"]
[Tue Jan 06 04:46:59.605499 2026] [:error] [pid 44903:tid 44907] [client 3.132.7.251:59576] [client 3.132.7.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.132.7.251, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVwjQ9hHqjs38zbkQPAwSQAAAAA"]
[Tue Jan 06 04:47:01.194521 2026] [:error] [pid 44904:tid 44950] [client 3.132.7.251:59586] [client 3.132.7.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.132.7.251, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVwjRTtieuI1BJEZcvdSHAAAAEk"]
[Tue Jan 06 04:47:02.729351 2026] [:error] [pid 44903:tid 44920] [client 3.132.7.251:59598] [client 3.132.7.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.132.7.251, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVwjRthHqjs38zbkQPAwTAAAAA0"]
[Tue Jan 06 04:47:15.710846 2026] [:error] [pid 44904:tid 44954] [client 143.92.33.104:49120] [client 143.92.33.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.92.33.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVwjUztieuI1BJEZcvdSJwAAAE0"]
[Tue Jan 06 04:47:17.004781 2026] [:error] [pid 45012:tid 45032] [client 143.92.33.104:45852] [client 143.92.33.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.92.33.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVwjVRaMAxCuju1d0uboHwAAANI"]
[Tue Jan 06 04:47:19.590707 2026] [:error] [pid 45012:tid 45038] [client 143.92.33.104:45858] [client 143.92.33.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.92.33.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVwjVxaMAxCuju1d0uboIwAAANg"]
[Tue Jan 06 04:48:16.161100 2026] [:error] [pid 44904:tid 44964] [client 103.120.179.248:13624] [client 103.120.179.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.120.179.248, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVwjkDtieuI1BJEZcvdSYAAAAFc"]
[Tue Jan 06 04:48:18.498391 2026] [:error] [pid 44905:tid 44978] [client 103.120.179.248:13759] [client 103.120.179.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.120.179.248, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVwjkru7ufwWVst9EAvVvwAAAIo"]
[Tue Jan 06 04:48:20.781955 2026] [:error] [pid 45012:tid 45024] [client 103.120.179.248:13890] [client 103.120.179.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.120.179.248, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVwjlBaMAxCuju1d0ubofgAAAMo"]
[Tue Jan 06 05:54:05.647955 2026] [:error] [pid 44905:tid 44972] [client 49.51.72.76:45624] [client 49.51.72.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVwy_bu7ufwWVst9EAvr6QAAAIQ"]
[Tue Jan 06 06:06:48.171687 2026] [:error] [pid 44905:tid 44987] [client 51.38.109.223:64131] [client 51.38.109.223] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/cidaas-pro-master/composer.json"] [unique_id "aVw1-Lu7ufwWVst9EAvv_AAAAJM"]
[Tue Jan 06 06:26:55.950451 2026] [:error] [pid 44903:tid 44932] [client 187.189.84.138:23366] [client 187.189.84.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.189.84.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVw6r9hHqjs38zbkQPBN4gAAABc"]
[Tue Jan 06 06:30:14.152414 2026] [:error] [pid 35140:tid 35160] [client 187.189.84.138:23246] [client 187.189.84.138] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aVw7dnoQaIDFMbT-XMwUnAAAARI"]
[Tue Jan 06 06:31:17.475063 2026] [:error] [pid 45012:tid 45019] [client 187.189.84.138:24056] [client 187.189.84.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.189.84.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVw7tRaMAxCuju1d0uYPpQAAAMU"]
[Tue Jan 06 06:32:14.947882 2026] [:error] [pid 44904:tid 44945] [client 187.189.84.138:23656] [client 187.189.84.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.189.84.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVw77jtieuI1BJEZcvdzFgAAAEQ"]
[Tue Jan 06 06:33:19.965658 2026] [:error] [pid 45012:tid 45029] [client 187.189.84.138:24017] [client 187.189.84.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.189.84.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVw8LxaMAxCuju1d0uYQJAAAAM8"]
[Tue Jan 06 06:34:17.244850 2026] [:error] [pid 44905:tid 44991] [client 187.189.84.138:23298] [client 187.189.84.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.189.84.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVw8abu7ufwWVst9EAv4sAAAAJc"]
[Tue Jan 06 08:43:33.376484 2026] [:error] [pid 44905:tid 44971] [client 89.42.211.164:52770] [client 89.42.211.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.42.211.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVxatbu7ufwWVst9EAsZgwAAAIM"]
[Tue Jan 06 08:43:36.176958 2026] [:error] [pid 45012:tid 45019] [client 89.42.211.164:52780] [client 89.42.211.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.42.211.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVxauBaMAxCuju1d0uYsrAAAAMU"]
[Tue Jan 06 08:43:38.586595 2026] [:error] [pid 44903:tid 44930] [client 89.42.211.164:58654] [client 89.42.211.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.42.211.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVxauthHqjs38zbkQPBt9wAAABY"]
[Tue Jan 06 12:11:50.995411 2026] [:error] [pid 44904:tid 44946] [client 43.155.195.141:55048] [client 43.155.195.141] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVyLhjtieuI1BJEZcvfDRwAAAEU"]
[Tue Jan 06 14:34:58.132233 2026] [:error] [pid 35140:tid 35147] [client 62.210.144.129:46850] [client 62.210.144.129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aVytEnoQaIDFMbT-XMyEgAAAAQU"]
[Tue Jan 06 14:38:47.698610 2026] [:error] [pid 45959:tid 45979] [client 108.165.164.193:55335] [client 108.165.164.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new"] [unique_id "aVyt91ajdn8P3hjgMYxWSgAAAVE"]
[Tue Jan 06 14:52:15.877045 2026] [:error] [pid 44903:tid 44911] [client 43.159.143.187:43268] [client 43.159.143.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVyxH9hHqjs38zbkQPDHggAAAAQ"]
[Tue Jan 06 15:35:45.074737 2026] [:error] [pid 45012:tid 45030] [client 125.75.66.97:44140] [client 125.75.66.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVy7URaMAxCuju1d0uahZQAAANA"]
[Tue Jan 06 16:49:08.975542 2026] [:error] [pid 45959:tid 45985] [client 83.167.244.157:45989] [client 83.167.244.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.167.244.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVzMhFajdn8P3hjgMYx5rAAAAVc"]
[Tue Jan 06 16:49:11.819619 2026] [:error] [pid 44904:tid 44942] [client 83.167.244.157:35945] [client 83.167.244.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.167.244.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVzMhztieuI1BJEZcvf6fwAAAEE"]
[Tue Jan 06 16:49:13.989275 2026] [:error] [pid 45012:tid 45032] [client 83.167.244.157:35949] [client 83.167.244.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 83.167.244.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVzMiRaMAxCuju1d0uayxQAAANI"]
[Tue Jan 06 16:50:15.208547 2026] [:error] [pid 45959:tid 45966] [client 77.92.144.132:36208] [client 77.92.144.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.92.144.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVzMx1ajdn8P3hjgMYx59AAAAUQ"]
[Tue Jan 06 16:50:18.222590 2026] [:error] [pid 45012:tid 45034] [client 77.92.144.132:59196] [client 77.92.144.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.92.144.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVzMyhaMAxCuju1d0uay5gAAANQ"]
[Tue Jan 06 16:50:22.155605 2026] [:error] [pid 45959:tid 45970] [client 77.92.144.132:59202] [client 77.92.144.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.92.144.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aVzMzlajdn8P3hjgMYx5-wAAAUg"]
[Tue Jan 06 18:35:11.439048 2026] [:error] [pid 45959:tid 45966] [client 43.130.106.18:46806] [client 43.130.106.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aVzlX1ajdn8P3hjgMYyd8AAAAUQ"]
[Tue Jan 06 19:21:19.638405 2026] [:error] [pid 45012:tid 45021] [client 152.53.142.241:47448] [client 152.53.142.241] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/html"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aVzwLxaMAxCuju1d0ubcxgAAAMc"]
[Tue Jan 06 20:13:49.653019 2026] [:error] [pid 45012:tid 45036] [client 111.68.9.66:52164] [client 111.68.9.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/js/welcome.min.js"] [unique_id "aVz8fRaMAxCuju1d0ubwkQAAANY"]
[Tue Jan 06 20:49:09.370787 2026] [:error] [pid 44904:tid 44952] [client 177.153.49.41:41908] [client 177.153.49.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.153.49.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV0ExTtieuI1BJEZcvcxYgAAAEs"]
[Tue Jan 06 20:49:14.411944 2026] [:error] [pid 44905:tid 44984] [client 177.153.49.41:41998] [client 177.153.49.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.153.49.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV0Eyru7ufwWVst9EAvgdQAAAJA"]
[Tue Jan 06 20:49:18.576999 2026] [:error] [pid 44904:tid 44954] [client 177.153.49.41:42058] [client 177.153.49.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.153.49.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV0EzjtieuI1BJEZcvcxeAAAAE0"]
[Tue Jan 06 20:58:49.305844 2026] [:error] [pid 45959:tid 45973] [client 101.33.80.42:48276] [client 101.33.80.42] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aV0HCVajdn8P3hjgMYzbfwAAAUs"]
[Tue Jan 06 21:47:10.290271 2026] [:error] [pid 44904:tid 44949] [client 117.33.163.216:54666] [client 117.33.163.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aV0SXjtieuI1BJEZcvdBxgAAAEg"]
[Tue Jan 06 23:19:39.285712 2026] [:error] [pid 44903:tid 44923] [client 4.247.167.136:4532] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aV0oC9hHqjs38zbkQPA9igAAABA"]
[Tue Jan 06 23:19:42.057179 2026] [:error] [pid 44904:tid 44956] [client 4.247.167.136:4568] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aV0oDjtieuI1BJEZcvdZugAAAE8"]
[Tue Jan 06 23:19:50.158703 2026] [:error] [pid 44904:tid 44958] [client 4.247.167.136:4976] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aV0oFjtieuI1BJEZcvdaDAAAAFE"]
[Tue Jan 06 23:19:51.168922 2026] [:error] [pid 35140:tid 35142] [client 4.247.167.136:5037] [client 4.247.167.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aV0oF3oQaIDFMbT-XMz2hgAAAQA"]
[Wed Jan 07 00:18:55.110026 2026] [:error] [pid 45959:tid 45964] [client 43.153.36.110:39184] [client 43.153.36.110] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aV0171ajdn8P3hjgMYwzyAAAAUI"]
[Wed Jan 07 00:26:34.000861 2026] [:error] [pid 45012:tid 45031] [client 136.115.4.69:65054] [client 136.115.4.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.115.4.69, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV03uRaMAxCuju1d0uZFHwAAANE"]
[Wed Jan 07 00:26:36.330276 2026] [:error] [pid 45012:tid 45030] [client 136.115.4.69:65054] [client 136.115.4.69] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aV03vBaMAxCuju1d0uZFLAAAANA"]
[Wed Jan 07 00:26:36.592339 2026] [:error] [pid 45012:tid 45035] [client 136.115.4.69:65054] [client 136.115.4.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.115.4.69, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV03vBaMAxCuju1d0uZFLwAAANU"]
[Wed Jan 07 00:26:38.085835 2026] [:error] [pid 44903:tid 44919] [client 136.115.4.69:49397] [client 136.115.4.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.115.4.69, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV03vthHqjs38zbkQPBUEwAAAAw"]
[Wed Jan 07 00:26:39.708485 2026] [:error] [pid 44905:tid 44974] [client 136.115.4.69:60411] [client 136.115.4.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.115.4.69, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV03v7u7ufwWVst9EAskZwAAAIY"]
[Wed Jan 07 00:26:41.247756 2026] [:error] [pid 44905:tid 44984] [client 136.115.4.69:62852] [client 136.115.4.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.115.4.69, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV03wbu7ufwWVst9EAskagAAAJA"]
[Wed Jan 07 00:26:42.674605 2026] [:error] [pid 44905:tid 44991] [client 136.115.4.69:56039] [client 136.115.4.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.115.4.69, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV03wru7ufwWVst9EAskbQAAAJc"]
[Wed Jan 07 00:26:42.674762 2026] [:error] [pid 44905:tid 44991] [client 136.115.4.69:56039] [client 136.115.4.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 136.115.4.69, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV03wru7ufwWVst9EAskbQAAAJc"]
[Wed Jan 07 01:16:40.207889 2026] [:error] [pid 44905:tid 44985] [client 34.168.205.123:56478] [client 34.168.205.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.168.205.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV1DeLu7ufwWVst9EAs4kAAAAJE"]
[Wed Jan 07 01:16:42.300428 2026] [:error] [pid 44905:tid 44992] [client 34.168.205.123:56478] [client 34.168.205.123] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aV1Deru7ufwWVst9EAs4mwAAAJg"]
[Wed Jan 07 01:16:42.489273 2026] [:error] [pid 44905:tid 44986] [client 34.168.205.123:56478] [client 34.168.205.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.168.205.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV1Deru7ufwWVst9EAs4nAAAAJI"]
[Wed Jan 07 01:16:43.716887 2026] [:error] [pid 45959:tid 45979] [client 34.168.205.123:53508] [client 34.168.205.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.168.205.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV1De1ajdn8P3hjgMYxSiAAAAVE"]
[Wed Jan 07 01:16:45.149599 2026] [:error] [pid 44904:tid 44960] [client 34.168.205.123:61846] [client 34.168.205.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.168.205.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV1DfTtieuI1BJEZcveB7gAAAFM"]
[Wed Jan 07 01:16:46.634372 2026] [:error] [pid 44905:tid 44990] [client 34.168.205.123:50620] [client 34.168.205.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.168.205.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV1Dfru7ufwWVst9EAs4owAAAJY"]
[Wed Jan 07 01:16:47.920607 2026] [:error] [pid 44903:tid 44914] [client 34.168.205.123:52297] [client 34.168.205.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.168.205.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV1Df9hHqjs38zbkQPBncAAAAAc"]
[Wed Jan 07 01:16:47.920730 2026] [:error] [pid 44903:tid 44914] [client 34.168.205.123:52297] [client 34.168.205.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.168.205.123, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV1Df9hHqjs38zbkQPBncAAAAAc"]
[Wed Jan 07 01:54:16.598272 2026] [:error] [pid 44903:tid 44917] [client 34.23.6.189:61632] [client 34.23.6.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.23.6.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV1MSNhHqjs38zbkQPBx4wAAAAo"]
[Wed Jan 07 01:54:18.774742 2026] [:error] [pid 44903:tid 44930] [client 34.23.6.189:61632] [client 34.23.6.189] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aV1MSthHqjs38zbkQPBx6gAAABY"]
[Wed Jan 07 01:54:18.984919 2026] [:error] [pid 44903:tid 44915] [client 34.23.6.189:61632] [client 34.23.6.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.23.6.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV1MSthHqjs38zbkQPBx7AAAAAg"]
[Wed Jan 07 01:54:20.497405 2026] [:error] [pid 45959:tid 45985] [client 34.23.6.189:63432] [client 34.23.6.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.23.6.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV1MTFajdn8P3hjgMYxixgAAAVc"]
[Wed Jan 07 01:54:21.969012 2026] [:error] [pid 44904:tid 44965] [client 34.23.6.189:55572] [client 34.23.6.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.23.6.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV1MTTtieuI1BJEZcveM8wAAAFg"]
[Wed Jan 07 01:54:23.426797 2026] [:error] [pid 44903:tid 44909] [client 34.23.6.189:51050] [client 34.23.6.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.23.6.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV1MT9hHqjs38zbkQPBx-AAAAAI"]
[Wed Jan 07 01:54:24.887603 2026] [:error] [pid 44904:tid 44944] [client 34.23.6.189:50716] [client 34.23.6.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.23.6.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV1MUDtieuI1BJEZcveM_AAAAEM"]
[Wed Jan 07 01:54:24.887769 2026] [:error] [pid 44904:tid 44944] [client 34.23.6.189:50716] [client 34.23.6.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.23.6.189, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV1MUDtieuI1BJEZcveM_AAAAEM"]
[Wed Jan 07 02:04:40.838653 2026] [:error] [pid 45959:tid 45982] [client 4.196.115.91:11715] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/racs3.php"] [unique_id "aV1OuFajdn8P3hjgMYxoZgAAAVQ"]
[Wed Jan 07 02:04:42.154746 2026] [:error] [pid 44904:tid 44944] [client 4.196.115.91:14719] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/racs3.php"] [unique_id "aV1OujtieuI1BJEZcveQZAAAAEM"]
[Wed Jan 07 02:04:42.789926 2026] [:error] [pid 44904:tid 44951] [client 4.196.115.91:12639] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/racs3.php"] [unique_id "aV1OujtieuI1BJEZcveQZQAAAEo"]
[Wed Jan 07 02:04:43.915701 2026] [:error] [pid 44905:tid 44992] [client 4.196.115.91:12651] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/racs3.php"] [unique_id "aV1Ou7u7ufwWVst9EAtHMAAAAJg"]
[Wed Jan 07 02:04:44.710132 2026] [:error] [pid 45959:tid 45969] [client 4.196.115.91:11609] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tyasd.php"] [unique_id "aV1OvFajdn8P3hjgMYxobAAAAUc"]
[Wed Jan 07 02:04:46.040089 2026] [:error] [pid 45959:tid 45984] [client 4.196.115.91:13179] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tyasd.php"] [unique_id "aV1Ovlajdn8P3hjgMYxocQAAAVY"]
[Wed Jan 07 02:04:49.650344 2026] [:error] [pid 44904:tid 44942] [client 4.196.115.91:16879] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tyasd.php"] [unique_id "aV1OwTtieuI1BJEZcveQbAAAAEE"]
[Wed Jan 07 02:04:50.489235 2026] [:error] [pid 44904:tid 44946] [client 4.196.115.91:16843] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tyasd.php"] [unique_id "aV1OwjtieuI1BJEZcveQbwAAAEU"]
[Wed Jan 07 02:04:51.326952 2026] [:error] [pid 44904:tid 44959] [client 4.196.115.91:16867] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zz10.php"] [unique_id "aV1OwztieuI1BJEZcveQcwAAAFI"]
[Wed Jan 07 02:04:54.485748 2026] [:error] [pid 35140:tid 35145] [client 4.196.115.91:1301] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zz10.php"] [unique_id "aV1OxnoQaIDFMbT-XMwrdAAAAQM"]
[Wed Jan 07 02:04:58.792759 2026] [:error] [pid 44903:tid 44918] [client 4.196.115.91:13139] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zz10.php"] [unique_id "aV1OythHqjs38zbkQPB1eAAAAAs"]
[Wed Jan 07 02:05:00.764759 2026] [:error] [pid 35140:tid 35159] [client 4.196.115.91:13401] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zz10.php"] [unique_id "aV1OzHoQaIDFMbT-XMwrdgAAARE"]
[Wed Jan 07 02:05:01.754091 2026] [:error] [pid 44905:tid 44972] [client 4.196.115.91:1318] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/al.php"] [unique_id "aV1Ozbu7ufwWVst9EAtHTQAAAIQ"]
[Wed Jan 07 02:05:05.788124 2026] [:error] [pid 44905:tid 44969] [client 4.196.115.91:1327] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/al.php"] [unique_id "aV1O0bu7ufwWVst9EAtHXgAAAIE"]
[Wed Jan 07 02:05:06.889325 2026] [:error] [pid 35140:tid 35145] [client 4.196.115.91:16883] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/al.php"] [unique_id "aV1O0noQaIDFMbT-XMwrgAAAAQM"]
[Wed Jan 07 02:05:09.213449 2026] [:error] [pid 44903:tid 44913] [client 4.196.115.91:15945] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/al.php"] [unique_id "aV1O1dhHqjs38zbkQPB1kgAAAAY"]
[Wed Jan 07 02:05:11.291797 2026] [:error] [pid 45012:tid 45037] [client 4.196.115.91:11630] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1n.php"] [unique_id "aV1O1xaMAxCuju1d0uZuZQAAANc"]
[Wed Jan 07 02:05:11.678160 2026] [:error] [pid 35140:tid 35154] [client 4.196.115.91:11876] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1n.php"] [unique_id "aV1O13oQaIDFMbT-XMwrhwAAAQw"]
[Wed Jan 07 02:05:16.990268 2026] [:error] [pid 35140:tid 35156] [client 4.196.115.91:13142] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1n.php"] [unique_id "aV1O3HoQaIDFMbT-XMwrjQAAAQ4"]
[Wed Jan 07 02:05:18.277167 2026] [:error] [pid 35140:tid 35145] [client 4.196.115.91:11762] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1n.php"] [unique_id "aV1O3noQaIDFMbT-XMwrjwAAAQM"]
[Wed Jan 07 02:05:19.055815 2026] [:error] [pid 45012:tid 45036] [client 4.196.115.91:13214] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jnuqm.php"] [unique_id "aV1O3xaMAxCuju1d0uZudAAAANY"]
[Wed Jan 07 02:05:21.942049 2026] [:error] [pid 45959:tid 45963] [client 4.196.115.91:1972] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jnuqm.php"] [unique_id "aV1O4Vajdn8P3hjgMYxooAAAAUE"]
[Wed Jan 07 02:05:29.865221 2026] [:error] [pid 44904:tid 44946] [client 4.196.115.91:40597] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jnuqm.php"] [unique_id "aV1O6TtieuI1BJEZcveQiwAAAEU"]
[Wed Jan 07 02:05:33.059897 2026] [:error] [pid 44903:tid 44911] [client 4.196.115.91:40550] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jnuqm.php"] [unique_id "aV1O7dhHqjs38zbkQPB1tAAAAAQ"]
[Wed Jan 07 02:05:35.300003 2026] [:error] [pid 44903:tid 44913] [client 4.196.115.91:2045] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php"] [unique_id "aV1O79hHqjs38zbkQPB1tgAAAAY"]
[Wed Jan 07 02:05:36.543477 2026] [:error] [pid 44905:tid 44987] [client 4.196.115.91:15105] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php"] [unique_id "aV1O8Lu7ufwWVst9EAtHfQAAAJM"]
[Wed Jan 07 02:05:37.630211 2026] [:error] [pid 45012:tid 45016] [client 4.196.115.91:1667] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php"] [unique_id "aV1O8RaMAxCuju1d0uZunAAAAMI"]
[Wed Jan 07 02:05:48.095200 2026] [:error] [pid 35140:tid 35149] [client 4.196.115.91:2025] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/iabzy.php"] [unique_id "aV1O_HoQaIDFMbT-XMwrvQAAAQc"]
[Wed Jan 07 02:05:49.866528 2026] [:error] [pid 45012:tid 45036] [client 4.196.115.91:12231] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/iabzy.php"] [unique_id "aV1O_RaMAxCuju1d0uZuqgAAANY"]
[Wed Jan 07 02:05:51.137377 2026] [:error] [pid 44905:tid 44971] [client 4.196.115.91:1657] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/iabzy.php"] [unique_id "aV1O_7u7ufwWVst9EAtHjAAAAIM"]
[Wed Jan 07 02:05:53.638423 2026] [:error] [pid 45959:tid 45982] [client 4.196.115.91:13099] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/iabzy.php"] [unique_id "aV1PAVajdn8P3hjgMYxo2QAAAVQ"]
[Wed Jan 07 02:05:54.253263 2026] [:error] [pid 44905:tid 44988] [client 4.196.115.91:18410] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ytrmp.php"] [unique_id "aV1PAru7ufwWVst9EAtHkgAAAJQ"]
[Wed Jan 07 02:06:02.020258 2026] [:error] [pid 45959:tid 45967] [client 4.196.115.91:35728] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ytrmp.php"] [unique_id "aV1PClajdn8P3hjgMYxo7wAAAUU"]
[Wed Jan 07 02:06:04.386401 2026] [:error] [pid 44904:tid 44957] [client 4.196.115.91:1037] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ytrmp.php"] [unique_id "aV1PDDtieuI1BJEZcveQsAAAAFA"]
[Wed Jan 07 02:06:15.832235 2026] [:error] [pid 45959:tid 45981] [client 4.196.115.91:10144] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xvent2.php"] [unique_id "aV1PF1ajdn8P3hjgMYxo9gAAAVM"]
[Wed Jan 07 02:06:23.160275 2026] [:error] [pid 45959:tid 45978] [client 4.196.115.91:18383] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xvent2.php"] [unique_id "aV1PH1ajdn8P3hjgMYxpAAAAAVA"]
[Wed Jan 07 02:06:28.931894 2026] [:error] [pid 45959:tid 45963] [client 4.196.115.91:9479] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aV1PJFajdn8P3hjgMYxpGQAAAUE"]
[Wed Jan 07 02:06:33.465274 2026] [:error] [pid 45012:tid 45022] [client 4.196.115.91:10031] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aV1PKRaMAxCuju1d0uZu2QAAAMg"]
[Wed Jan 07 02:06:35.782344 2026] [:error] [pid 45012:tid 45017] [client 4.196.115.91:13038] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aV1PKxaMAxCuju1d0uZu3QAAAMM"]
[Wed Jan 07 02:06:36.738035 2026] [:error] [pid 44904:tid 44962] [client 4.196.115.91:9478] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aV1PLDtieuI1BJEZcveQ6gAAAFU"]
[Wed Jan 07 02:06:37.215627 2026] [:error] [pid 44904:tid 44963] [client 4.196.115.91:15224] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nhsba.php"] [unique_id "aV1PLTtieuI1BJEZcveQ6wAAAFY"]
[Wed Jan 07 02:06:38.709040 2026] [:error] [pid 44903:tid 44910] [client 4.196.115.91:13032] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nhsba.php"] [unique_id "aV1PLthHqjs38zbkQPB17gAAAAM"]
[Wed Jan 07 02:06:40.151908 2026] [:error] [pid 44903:tid 44927] [client 4.196.115.91:14921] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nhsba.php"] [unique_id "aV1PMNhHqjs38zbkQPB18wAAABQ"]
[Wed Jan 07 02:06:41.084241 2026] [:error] [pid 35140:tid 35159] [client 4.196.115.91:9489] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nhsba.php"] [unique_id "aV1PMXoQaIDFMbT-XMwr7wAAARE"]
[Wed Jan 07 02:06:41.869492 2026] [:error] [pid 45012:tid 45028] [client 4.196.115.91:13701] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sfsfs.php"] [unique_id "aV1PMRaMAxCuju1d0uZu5QAAAM4"]
[Wed Jan 07 02:06:43.543003 2026] [:error] [pid 45012:tid 45017] [client 4.196.115.91:12118] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sfsfs.php"] [unique_id "aV1PMxaMAxCuju1d0uZu7gAAAMM"]
[Wed Jan 07 02:07:15.379811 2026] [:error] [pid 45012:tid 45037] [client 4.196.115.91:13738] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pu8.php"] [unique_id "aV1PUxaMAxCuju1d0uZvFwAAANc"]
[Wed Jan 07 02:07:15.943045 2026] [:error] [pid 44904:tid 44941] [client 4.196.115.91:13736] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pu8.php"] [unique_id "aV1PUztieuI1BJEZcveREAAAAEA"]
[Wed Jan 07 02:07:16.433883 2026] [:error] [pid 44904:tid 44965] [client 4.196.115.91:13815] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pu8.php"] [unique_id "aV1PVDtieuI1BJEZcveREgAAAFg"]
[Wed Jan 07 02:07:19.180171 2026] [:error] [pid 35140:tid 35154] [client 4.196.115.91:10880] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pu8.php"] [unique_id "aV1PV3oQaIDFMbT-XMwsGQAAAQw"]
[Wed Jan 07 02:07:24.719767 2026] [:error] [pid 35140:tid 35155] [client 4.196.115.91:13295] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ssd.php"] [unique_id "aV1PXHoQaIDFMbT-XMwsKQAAAQ0"]
[Wed Jan 07 02:07:26.137743 2026] [:error] [pid 45959:tid 45967] [client 4.196.115.91:12685] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ssd.php"] [unique_id "aV1PXlajdn8P3hjgMYxpdAAAAUU"]
[Wed Jan 07 02:07:29.440564 2026] [:error] [pid 45012:tid 45023] [client 4.196.115.91:10916] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ssd.php"] [unique_id "aV1PYRaMAxCuju1d0uZvJQAAAMk"]
[Wed Jan 07 02:07:33.176236 2026] [:error] [pid 44903:tid 44909] [client 4.196.115.91:12729] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ssd.php"] [unique_id "aV1PZdhHqjs38zbkQPB2NQAAAAI"]
[Wed Jan 07 02:07:35.544097 2026] [:error] [pid 45959:tid 45980] [client 4.196.115.91:9778] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lx.php"] [unique_id "aV1PZ1ajdn8P3hjgMYxpgwAAAVI"]
[Wed Jan 07 02:07:37.249700 2026] [:error] [pid 45959:tid 45972] [client 4.196.115.91:1478] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lx.php"] [unique_id "aV1PaVajdn8P3hjgMYxphwAAAUo"]
[Wed Jan 07 02:07:38.345688 2026] [:error] [pid 44905:tid 44989] [client 4.196.115.91:13831] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lx.php"] [unique_id "aV1Paru7ufwWVst9EAtH_gAAAJU"]
[Wed Jan 07 02:07:43.973679 2026] [:error] [pid 44904:tid 44959] [client 4.196.115.91:12546] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lx.php"] [unique_id "aV1PbztieuI1BJEZcveRNgAAAFI"]
[Wed Jan 07 02:07:49.960071 2026] [:error] [pid 45959:tid 45974] [client 4.196.115.91:1149] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/boutj.php"] [unique_id "aV1PdVajdn8P3hjgMYxpmQAAAUw"]
[Wed Jan 07 02:07:52.551089 2026] [:error] [pid 44905:tid 44980] [client 4.196.115.91:16177] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/boutj.php"] [unique_id "aV1PeLu7ufwWVst9EAtIDwAAAIw"]
[Wed Jan 07 02:07:54.395719 2026] [:error] [pid 45959:tid 45981] [client 4.196.115.91:11826] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/boutj.php"] [unique_id "aV1Pelajdn8P3hjgMYxpoQAAAVM"]
[Wed Jan 07 02:07:55.606506 2026] [:error] [pid 45959:tid 45967] [client 4.196.115.91:11294] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/boutj.php"] [unique_id "aV1Pe1ajdn8P3hjgMYxppwAAAUU"]
[Wed Jan 07 02:07:56.524966 2026] [:error] [pid 45959:tid 45973] [client 4.196.115.91:11314] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/biyaqllb.php"] [unique_id "aV1PfFajdn8P3hjgMYxpqwAAAUs"]
[Wed Jan 07 02:07:58.117204 2026] [:error] [pid 44903:tid 44911] [client 4.196.115.91:12160] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/biyaqllb.php"] [unique_id "aV1PfthHqjs38zbkQPB2YQAAAAQ"]
[Wed Jan 07 02:07:59.925000 2026] [:error] [pid 35140:tid 35162] [client 4.196.115.91:15259] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/biyaqllb.php"] [unique_id "aV1Pf3oQaIDFMbT-XMwsbQAAARQ"]
[Wed Jan 07 02:08:03.716129 2026] [:error] [pid 44905:tid 44987] [client 4.196.115.91:11573] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/biyaqllb.php"] [unique_id "aV1Pg7u7ufwWVst9EAtIGwAAAJM"]
[Wed Jan 07 02:08:05.527180 2026] [:error] [pid 44904:tid 44958] [client 4.196.115.91:40685] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "aV1PhTtieuI1BJEZcveRYAAAAFE"]
[Wed Jan 07 02:08:06.901582 2026] [:error] [pid 45959:tid 45968] [client 4.196.115.91:14841] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "aV1Phlajdn8P3hjgMYxpzwAAAUY"]
[Wed Jan 07 02:08:09.088128 2026] [:error] [pid 45959:tid 45977] [client 4.196.115.91:15241] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "aV1PiVajdn8P3hjgMYxp1QAAAU8"]
[Wed Jan 07 02:08:09.625430 2026] [:error] [pid 45012:tid 45017] [client 4.196.115.91:12167] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "aV1PiRaMAxCuju1d0uZvZwAAAMM"]
[Wed Jan 07 02:08:10.525581 2026] [:error] [pid 45959:tid 45962] [client 4.196.115.91:11273] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuwno.php"] [unique_id "aV1Pilajdn8P3hjgMYxp2AAAAUA"]
[Wed Jan 07 02:08:10.718770 2026] [:error] [pid 45959:tid 45965] [client 4.196.115.91:14836] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuwno.php"] [unique_id "aV1Pilajdn8P3hjgMYxp2gAAAUM"]
[Wed Jan 07 02:08:11.538893 2026] [:error] [pid 44904:tid 44947] [client 4.196.115.91:11253] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuwno.php"] [unique_id "aV1PiztieuI1BJEZcveRZwAAAEY"]
[Wed Jan 07 02:08:13.325000 2026] [:error] [pid 44905:tid 44978] [client 4.196.115.91:11237] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuwno.php"] [unique_id "aV1Pjbu7ufwWVst9EAtIJwAAAIo"]
[Wed Jan 07 02:08:21.199755 2026] [:error] [pid 45959:tid 45969] [client 4.196.115.91:12451] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gv.php"] [unique_id "aV1PlVajdn8P3hjgMYxqAAAAAUc"]
[Wed Jan 07 02:08:26.944277 2026] [:error] [pid 44904:tid 44956] [client 4.196.115.91:11540] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gv.php"] [unique_id "aV1PmjtieuI1BJEZcveRkgAAAE8"]
[Wed Jan 07 02:08:46.644493 2026] [:error] [pid 45959:tid 45986] [client 4.196.115.91:11994] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an8.php"] [unique_id "aV1Prlajdn8P3hjgMYxqPwAAAVg"]
[Wed Jan 07 02:08:49.164380 2026] [:error] [pid 35140:tid 35166] [client 4.196.115.91:10357] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an8.php"] [unique_id "aV1PsXoQaIDFMbT-XMws7AAAARg"]
[Wed Jan 07 02:08:50.424981 2026] [:error] [pid 45012:tid 45027] [client 4.196.115.91:13372] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an8.php"] [unique_id "aV1PshaMAxCuju1d0uZv6gAAAM0"]
[Wed Jan 07 02:08:52.661744 2026] [:error] [pid 45012:tid 45033] [client 4.196.115.91:12410] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bes.php"] [unique_id "aV1PtBaMAxCuju1d0uZv7QAAANM"]
[Wed Jan 07 02:08:55.744544 2026] [:error] [pid 44905:tid 44991] [client 4.196.115.91:1166] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bes.php"] [unique_id "aV1Pt7u7ufwWVst9EAtIcgAAAJc"]
[Wed Jan 07 02:08:56.212042 2026] [:error] [pid 44903:tid 44920] [client 4.196.115.91:13317] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bes.php"] [unique_id "aV1PuNhHqjs38zbkQPB2ywAAAA0"]
[Wed Jan 07 02:08:57.991208 2026] [:error] [pid 45959:tid 45977] [client 4.196.115.91:9697] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bes.php"] [unique_id "aV1PuVajdn8P3hjgMYxqSwAAAU8"]
[Wed Jan 07 02:08:59.086961 2026] [:error] [pid 35140:tid 35149] [client 4.196.115.91:10350] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xinha.php"] [unique_id "aV1Pu3oQaIDFMbT-XMws-gAAAQc"]
[Wed Jan 07 02:09:00.040244 2026] [:error] [pid 44904:tid 44964] [client 4.196.115.91:10320] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xinha.php"] [unique_id "aV1PvDtieuI1BJEZcveR1QAAAFc"]
[Wed Jan 07 02:09:02.308409 2026] [:error] [pid 45012:tid 45025] [client 4.196.115.91:13889] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xinha.php"] [unique_id "aV1PvhaMAxCuju1d0uZv-QAAAMs"]
[Wed Jan 07 02:09:04.890236 2026] [:error] [pid 44903:tid 44913] [client 4.196.115.91:9714] [client 4.196.115.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xinha.php"] [unique_id "aV1PwNhHqjs38zbkQPB21AAAAAY"]
[Wed Jan 07 02:45:14.729028 2026] [:error] [pid 45959:tid 45977] [client 170.106.192.208:45740] [client 170.106.192.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aV1YOlajdn8P3hjgMYx6swAAAU8"]
[Wed Jan 07 04:02:40.262624 2026] [:error] [pid 6572:tid 6660] [client 182.42.111.156:50259] [client 182.42.111.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aV1qYHVZKKyUNbqWyYIeAQAAAJQ"]
[Wed Jan 07 04:49:29.040170 2026] [:error] [pid 51200:tid 51251] [client 103.172.239.79:46618] [client 103.172.239.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.172.239.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV11WYjhb00oxKSD4leGXgAAAQM"]
[Wed Jan 07 04:49:32.153426 2026] [:error] [pid 6677:tid 6706] [client 103.172.239.79:41176] [client 103.172.239.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.172.239.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV11XH1cbekSFYxHbiMKDwAAAM4"]
[Wed Jan 07 04:49:33.946496 2026] [:error] [pid 51200:tid 51254] [client 103.172.239.79:41190] [client 103.172.239.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.172.239.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV11XYjhb00oxKSD4leGagAAAQY"]
[Wed Jan 07 05:07:10.196377 2026] [:error] [pid 51200:tid 51255] [client 68.218.11.70:31502] [client 68.218.11.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aV15fojhb00oxKSD4leMAAAAAQc"]
[Wed Jan 07 05:07:10.239189 2026] [:error] [pid 6570:tid 6593] [client 68.218.11.70:38799] [client 68.218.11.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aV15fpmjKDvKV_Af0erdpwAAAAc"]
[Wed Jan 07 05:07:10.272852 2026] [:error] [pid 6570:tid 6610] [client 68.218.11.70:7427] [client 68.218.11.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aV15fpmjKDvKV_Af0erdqQAAABg"]
[Wed Jan 07 05:07:10.305912 2026] [:error] [pid 6570:tid 6605] [client 68.218.11.70:29863] [client 68.218.11.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aV15fpmjKDvKV_Af0erdqwAAABM"]
[Wed Jan 07 06:11:38.395234 2026] [:error] [pid 51200:tid 51263] [client 43.159.128.247:43484] [client 43.159.128.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aV2Imojhb00oxKSD4lemYwAAAQ8"]
[Wed Jan 07 08:41:49.130195 2026] [:error] [pid 58294:tid 58300] [client 43.165.65.180:50244] [client 43.165.65.180] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aV2rzVfzA7c0ITpf3nGDHQAAAIQ"]
[Wed Jan 07 08:48:20.141229 2026] [:error] [pid 30634:tid 30701] [client 114.55.73.174:40398] [client 114.55.73.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 114.55.73.174, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV2tVICIPBibObtmZttVcQAAAMs"]
[Wed Jan 07 08:48:22.717825 2026] [:error] [pid 30632:tid 30642] [client 114.55.73.174:40738] [client 114.55.73.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 114.55.73.174, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV2tVud3_LCpBJzo02dzqQAAAAY"]
[Wed Jan 07 08:48:26.287999 2026] [:error] [pid 58330:tid 58338] [client 114.55.73.174:40936] [client 114.55.73.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 114.55.73.174, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV2tWg8kGngKGK7_wnc09QAAAQY"]
[Wed Jan 07 10:08:40.291005 2026] [:error] [pid 30632:tid 30655] [client 49.234.192.248:41204] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aV3AKOd3_LCpBJzo02eH0gAAABM"]
[Wed Jan 07 12:30:31.851263 2026] [:error] [pid 30634:tid 30708] [client 49.51.183.84:41240] [client 49.51.183.84] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aV3hZ4CIPBibObtmZtuMQgAAANI"]
[Wed Jan 07 12:48:09.415503 2026] [:error] [pid 58294:tid 58297] [client 198.54.114.36:39440] [client 198.54.114.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV3liVfzA7c0ITpf3nHI6wAAAIE"]
[Wed Jan 07 12:48:11.508951 2026] [:error] [pid 30634:tid 30699] [client 198.54.114.36:39446] [client 198.54.114.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV3li4CIPBibObtmZtuPaAAAAMk"]
[Wed Jan 07 12:48:13.058032 2026] [:error] [pid 30634:tid 30703] [client 198.54.114.36:39454] [client 198.54.114.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV3ljYCIPBibObtmZtuPaQAAAM0"]
[Wed Jan 07 12:48:51.294230 2026] [:error] [pid 30720:tid 30743] [client 47.113.103.190:53284] [client 47.113.103.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.113.103.190, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV3ls4dgcpQjqzUi9WY0qwAAAVU"]
[Wed Jan 07 12:48:53.113775 2026] [:error] [pid 58294:tid 58313] [client 47.113.103.190:53296] [client 47.113.103.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.113.103.190, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV3ltVfzA7c0ITpf3nHJIAAAAJE"]
[Wed Jan 07 12:48:56.659923 2026] [:error] [pid 30632:tid 30660] [client 47.113.103.190:53300] [client 47.113.103.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.113.103.190, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV3luOd3_LCpBJzo02epQwAAABg"]
[Wed Jan 07 12:50:22.319484 2026] [:error] [pid 58330:tid 58345] [client 103.172.239.79:49970] [client 103.172.239.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.172.239.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV3mDg8kGngKGK7_wneRyQAAAQ0"]
[Wed Jan 07 12:50:24.020597 2026] [:error] [pid 30634:tid 30694] [client 103.172.239.79:49974] [client 103.172.239.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.172.239.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV3mEICIPBibObtmZtuP_AAAAMQ"]
[Wed Jan 07 12:50:25.777659 2026] [:error] [pid 30633:tid 30663] [client 103.172.239.79:49982] [client 103.172.239.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.172.239.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV3mEfZiVWlF7303nMhMEwAAAEA"]
[Wed Jan 07 13:12:31.222237 2026] [:error] [pid 30634:tid 30696] [client 122.161.52.99:13007] [client 122.161.52.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.161.52.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV3rP4CIPBibObtmZtuVoQAAAMY"]
[Wed Jan 07 13:40:07.934610 2026] [:error] [pid 30633:tid 30671] [client 122.161.52.99:30269] [client 122.161.52.99] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aV3xt_ZiVWlF7303nMhWmAAAAEg"]
[Wed Jan 07 13:41:51.569885 2026] [:error] [pid 58330:tid 58346] [client 122.161.52.99:9669] [client 122.161.52.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.161.52.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV3yHw8kGngKGK7_wneiyQAAAQ4"]
[Wed Jan 07 13:43:26.273133 2026] [:error] [pid 30634:tid 30700] [client 122.161.52.99:25812] [client 122.161.52.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.161.52.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV3yfoCIPBibObtmZtuhGwAAAMo"]
[Wed Jan 07 13:45:06.138627 2026] [:error] [pid 30634:tid 30692] [client 122.161.52.99:13027] [client 122.161.52.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.161.52.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV3y4oCIPBibObtmZtuhgwAAAMI"]
[Wed Jan 07 13:46:42.071865 2026] [:error] [pid 30632:tid 30645] [client 122.161.52.99:14965] [client 122.161.52.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.161.52.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV3zQud3_LCpBJzo02e10QAAAAk"]
[Wed Jan 07 15:06:09.062283 2026] [:error] [pid 58294:tid 58312] [client 43.157.62.101:38654] [client 43.157.62.101] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aV4F4VfzA7c0ITpf3nHoIgAAAJA"]
[Wed Jan 07 18:49:25.570882 2026] [:error] [pid 58330:tid 58335] [client 43.130.139.177:50240] [client 43.130.139.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aV46NQ8kGngKGK7_wnfoxgAAAQM"]
[Wed Jan 07 18:58:27.527096 2026] [:error] [pid 58330:tid 58348] [client 34.12.31.90:57347] [client 34.12.31.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.12.31.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV48Uw8kGngKGK7_wnfqVQAAARA"]
[Wed Jan 07 18:58:30.007855 2026] [:error] [pid 58330:tid 58335] [client 34.12.31.90:57347] [client 34.12.31.90] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aV48Vg8kGngKGK7_wnfqXAAAAQM"]
[Wed Jan 07 18:58:30.295432 2026] [:error] [pid 58330:tid 58352] [client 34.12.31.90:57347] [client 34.12.31.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.12.31.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV48Vg8kGngKGK7_wnfqXQAAARQ"]
[Wed Jan 07 18:58:32.242609 2026] [:error] [pid 30632:tid 30657] [client 34.12.31.90:58078] [client 34.12.31.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.12.31.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV48WOd3_LCpBJzo02fuFwAAABU"]
[Wed Jan 07 18:58:33.990473 2026] [:error] [pid 30632:tid 30654] [client 34.12.31.90:57377] [client 34.12.31.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.12.31.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV48Wed3_LCpBJzo02fuGQAAABI"]
[Wed Jan 07 18:58:35.966960 2026] [:error] [pid 30634:tid 30699] [client 34.12.31.90:56327] [client 34.12.31.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.12.31.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV48W4CIPBibObtmZtv2FAAAAMk"]
[Wed Jan 07 18:58:37.668766 2026] [:error] [pid 58294:tid 58301] [client 34.12.31.90:49444] [client 34.12.31.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.12.31.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV48XVfzA7c0ITpf3nEWKQAAAIU"]
[Wed Jan 07 18:58:37.668916 2026] [:error] [pid 58294:tid 58301] [client 34.12.31.90:49444] [client 34.12.31.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.12.31.90, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV48XVfzA7c0ITpf3nEWKQAAAIU"]
[Wed Jan 07 19:34:11.880029 2026] [:error] [pid 30632:tid 30637] [client 167.71.90.72:62846] [client 167.71.90.72] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "aV5Es-d3_LCpBJzo02f39QAAAAE"], referer: binance.com
[Wed Jan 07 21:14:14.656002 2026] [:error] [pid 30720:tid 30739] [client 43.130.74.193:52330] [client 43.130.74.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aV5cJodgcpQjqzUi9WaNgQAAAVE"]
[Wed Jan 07 22:16:41.452905 2026] [:error] [pid 58330:tid 58340] [client 182.253.238.235:53203] [client 182.253.238.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aV5qyQ8kGngKGK7_wncQCAAAAQg"]
[Wed Jan 07 22:16:42.078853 2026] [:error] [pid 50936:tid 50941] [client 182.253.238.235:53978] [client 182.253.238.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aV5qyrDlg80QUdd5qc4akAAAAoM"]
[Wed Jan 07 22:16:42.704761 2026] [:error] [pid 50905:tid 50922] [client 182.253.238.235:54224] [client 182.253.238.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aV5qympNgk5-gt30I7aVsQAAAk8"]
[Wed Jan 07 22:48:28.861190 2026] [:error] [pid 58330:tid 58342] [client 182.44.10.67:39166] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aV5yPA8kGngKGK7_wncT5gAAAQo"]
[Wed Jan 07 23:11:33.452968 2026] [:error] [pid 51128:tid 51137] [client 34.6.47.27:44284] [client 34.6.47.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.6.47.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aV53pUGjtE8U88mrwue4wAAAAYc"]
[Thu Jan 08 01:24:38.386755 2026] [autoindex:error] [pid 51128:tid 51154] [client 138.197.32.240:59435] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu Jan 08 03:51:54.556464 2026] [:error] [pid 15265:tid 15337] [client 49.51.204.74:49998] [client 49.51.204.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aV65WqE6VBKhew2LTFRy1wAAAIs"]
[Thu Jan 08 05:14:55.397618 2026] [:error] [pid 15358:tid 15386] [client 187.189.84.138:23681] [client 187.189.84.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.189.84.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV7MzyoRk9xWJ3toSBK6TQAAANA"]
[Thu Jan 08 05:16:36.665661 2026] [:error] [pid 15358:tid 15388] [client 187.189.84.138:23163] [client 187.189.84.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.189.84.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV7NNCoRk9xWJ3toSBK7dgAAANI"]
[Thu Jan 08 05:18:05.147814 2026] [:error] [pid 15263:tid 15274] [client 187.189.84.138:23853] [client 187.189.84.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.189.84.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV7Njdv61bxum7WG_e9QagAAAAI"]
[Thu Jan 08 05:19:32.918030 2026] [:error] [pid 15265:tid 15329] [client 187.189.84.138:23847] [client 187.189.84.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.189.84.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV7N5KE6VBKhew2LTFSVPAAAAIM"]
[Thu Jan 08 05:20:50.736818 2026] [:error] [pid 15263:tid 15295] [client 187.189.84.138:23489] [client 187.189.84.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.189.84.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV7OMtv61bxum7WG_e9RhQAAABc"]
[Thu Jan 08 06:04:15.028870 2026] [:error] [pid 2424:tid 2430] [client 95.171.5.77:58114] [client 95.171.5.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.171.5.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV7YX7TDJR8aofkBk9RlvAAAAQQ"], referer: https://expressinteriors.com/
[Thu Jan 08 07:46:15.912242 2026] [:error] [pid 2484:tid 2503] [client 101.32.52.164:59792] [client 101.32.52.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aV7wRziDlnlaQQK_AEOmkAAAAU8"]
[Thu Jan 08 08:51:02.655998 2026] [:error] [pid 15263:tid 15274] [client 45.192.103.119:44606] [client 45.192.103.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.192.103.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV7_dtv61bxum7WG_e-IdQAAAAI"]
[Thu Jan 08 08:51:04.749249 2026] [:error] [pid 15263:tid 15272] [client 45.192.103.119:44798] [client 45.192.103.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.192.103.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV7_eNv61bxum7WG_e-IdwAAAAA"]
[Thu Jan 08 08:51:06.662622 2026] [:error] [pid 2424:tid 2445] [client 45.192.103.119:44932] [client 45.192.103.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.192.103.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV7_erTDJR8aofkBk9SFVgAAARM"]
[Thu Jan 08 08:51:51.706375 2026] [:error] [pid 15263:tid 15272] [client 220.158.234.47:48528] [client 220.158.234.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.158.234.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV7_p9v61bxum7WG_e-IrgAAAAA"]
[Thu Jan 08 08:51:53.444445 2026] [:error] [pid 15358:tid 15387] [client 220.158.234.47:48532] [client 220.158.234.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.158.234.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV7_qSoRk9xWJ3toSBLqjQAAANE"]
[Thu Jan 08 08:51:55.228382 2026] [:error] [pid 15263:tid 15286] [client 220.158.234.47:42480] [client 220.158.234.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.158.234.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV7_q9v61bxum7WG_e-ItAAAAA4"]
[Thu Jan 08 08:52:17.801994 2026] [:error] [pid 15264:tid 15306] [client 159.75.126.74:53656] [client 159.75.126.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.75.126.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV7_wYov6_kvS0Owh-qkXAAAAEc"]
[Thu Jan 08 08:52:19.647238 2026] [:error] [pid 15358:tid 15374] [client 159.75.126.74:53672] [client 159.75.126.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.75.126.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV7_wyoRk9xWJ3toSBLqngAAAMQ"]
[Thu Jan 08 08:52:21.468620 2026] [:error] [pid 15265:tid 15338] [client 159.75.126.74:49622] [client 159.75.126.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.75.126.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV7_xaE6VBKhew2LTFTCwQAAAIw"]
[Thu Jan 08 08:52:41.808975 2026] [:error] [pid 15265:tid 15339] [client 47.243.141.65:45830] [client 47.243.141.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.243.141.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV7_2aE6VBKhew2LTFTC2AAAAI0"]
[Thu Jan 08 08:52:43.592662 2026] [:error] [pid 15263:tid 15295] [client 47.243.141.65:46006] [client 47.243.141.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.243.141.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV7_29v61bxum7WG_e-I0AAAABc"]
[Thu Jan 08 08:52:44.844346 2026] [:error] [pid 17404:tid 17419] [client 47.243.141.65:46168] [client 47.243.141.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.243.141.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV7_3GVd_oH193N6AnU9WwAAAY0"]
[Thu Jan 08 08:52:58.694226 2026] [:error] [pid 15358:tid 15371] [client 220.158.234.47:20838] [client 220.158.234.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.158.234.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV7_6ioRk9xWJ3toSBLquAAAAME"]
[Thu Jan 08 08:53:00.419408 2026] [:error] [pid 2484:tid 2494] [client 220.158.234.47:20842] [client 220.158.234.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.158.234.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV7_7DiDlnlaQQK_AEOzGgAAAUc"]
[Thu Jan 08 08:53:02.203351 2026] [:error] [pid 15264:tid 15319] [client 220.158.234.47:20846] [client 220.158.234.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.158.234.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV7_7oov6_kvS0Owh-qkfgAAAFQ"]
[Thu Jan 08 08:53:36.782211 2026] [:error] [pid 15263:tid 15275] [client 118.89.200.37:47888] [client 118.89.200.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.89.200.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV8AENv61bxum7WG_e-JCgAAAAM"]
[Thu Jan 08 08:53:39.839233 2026] [:error] [pid 15358:tid 15376] [client 118.89.200.37:48168] [client 118.89.200.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.89.200.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV8AEyoRk9xWJ3toSBLq1AAAAMY"]
[Thu Jan 08 08:53:42.127029 2026] [:error] [pid 15265:tid 15341] [client 118.89.200.37:48420] [client 118.89.200.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.89.200.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV8AFqE6VBKhew2LTFTC_QAAAI8"]
[Thu Jan 08 10:28:30.722292 2026] [:error] [pid 2424:tid 2430] [client 103.77.107.178:54879] [client 103.77.107.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aV8WTrTDJR8aofkBk9SWEAAAAQQ"]
[Thu Jan 08 10:28:31.260185 2026] [:error] [pid 17404:tid 17427] [client 103.77.107.178:55070] [client 103.77.107.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aV8WT2Vd_oH193N6AnVROQAAAZU"]
[Thu Jan 08 12:53:01.662209 2026] [:error] [pid 17404:tid 17419] [client 39.109.116.19:36544] [client 39.109.116.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.109.116.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV84LWVd_oH193N6AnVxDwAAAY0"]
[Thu Jan 08 12:53:03.603689 2026] [:error] [pid 15264:tid 15322] [client 39.109.116.19:36656] [client 39.109.116.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.109.116.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV84L4ov6_kvS0Owh-rPbwAAAFc"]
[Thu Jan 08 12:53:07.812491 2026] [:error] [pid 15264:tid 15315] [client 39.109.116.19:36970] [client 39.109.116.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.109.116.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV84M4ov6_kvS0Owh-rPcgAAAFA"]
[Thu Jan 08 12:53:09.228076 2026] [:error] [pid 17404:tid 17415] [client 87.236.210.30:43600] [client 87.236.210.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.236.210.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV84NWVd_oH193N6AnVxFwAAAYk"]
[Thu Jan 08 12:53:12.500003 2026] [:error] [pid 2484:tid 2504] [client 87.236.210.30:43604] [client 87.236.210.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.236.210.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV84ODiDlnlaQQK_AEMCBgAAAVA"]
[Thu Jan 08 12:53:14.980488 2026] [:error] [pid 15263:tid 15284] [client 87.236.210.30:43608] [client 87.236.210.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.236.210.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV84Otv61bxum7WG_e-8HwAAAAw"]
[Thu Jan 08 12:53:23.164900 2026] [:error] [pid 15265:tid 15326] [client 160.191.55.144:46414] [client 160.191.55.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.191.55.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV84Q6E6VBKhew2LTFT1rgAAAIA"]
[Thu Jan 08 12:53:24.976580 2026] [:error] [pid 15358:tid 15391] [client 160.191.55.144:46428] [client 160.191.55.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.191.55.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV84RCoRk9xWJ3toSBIhRwAAANU"]
[Thu Jan 08 12:53:26.680738 2026] [:error] [pid 2424:tid 2438] [client 160.191.55.144:46434] [client 160.191.55.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.191.55.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV84RrTDJR8aofkBk9TB3QAAAQw"]
[Thu Jan 08 12:53:43.077907 2026] [:error] [pid 15358:tid 15391] [client 110.164.163.21:49366] [client 110.164.163.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.164.163.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV84VyoRk9xWJ3toSBIhUQAAANU"]
[Thu Jan 08 12:53:45.132674 2026] [:error] [pid 17404:tid 17407] [client 110.164.163.21:49374] [client 110.164.163.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.164.163.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV84WWVd_oH193N6AnVxTwAAAYE"]
[Thu Jan 08 12:53:47.205655 2026] [:error] [pid 2424:tid 2446] [client 110.164.163.21:49378] [client 110.164.163.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.164.163.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV84W7TDJR8aofkBk9TB6AAAARQ"]
[Thu Jan 08 12:54:00.089841 2026] [:error] [pid 2484:tid 2512] [client 144.91.114.175:37060] [client 144.91.114.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.114.175, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV84aDiDlnlaQQK_AEMCggAAAVg"]
[Thu Jan 08 12:54:02.207013 2026] [:error] [pid 2424:tid 2450] [client 144.91.114.175:37066] [client 144.91.114.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.114.175, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV84arTDJR8aofkBk9TB9AAAARg"]
[Thu Jan 08 12:54:04.867642 2026] [:error] [pid 15263:tid 15284] [client 144.91.114.175:37072] [client 144.91.114.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.114.175, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV84bNv61bxum7WG_e-8MQAAAAw"]
[Thu Jan 08 12:54:27.352849 2026] [:error] [pid 7586:tid 7608] [client 144.91.114.175:42764] [client 144.91.114.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.114.175, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV84g8Jyk37GdXP5TmUitgAAAdI"]
[Thu Jan 08 12:54:29.616526 2026] [:error] [pid 2484:tid 2509] [client 144.91.114.175:42772] [client 144.91.114.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.114.175, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV84hTiDlnlaQQK_AEMCmAAAAVU"]
[Thu Jan 08 12:54:31.888336 2026] [:error] [pid 2484:tid 2502] [client 144.91.114.175:42786] [client 144.91.114.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.114.175, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV84hziDlnlaQQK_AEMCmgAAAU4"]
[Thu Jan 08 14:13:44.102121 2026] [:error] [pid 7586:tid 7606] [client 170.106.179.68:55910] [client 170.106.179.68] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aV9LGMJyk37GdXP5TmUuiQAAAdA"]
[Thu Jan 08 14:30:23.396815 2026] [:error] [pid 15358:tid 15371] [client 107.150.18.47:65430] [client 107.150.18.47] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".web.ui.webresource.axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/Telerik.Web.UI.WebResource.axd"] [unique_id "aV9O_yoRk9xWJ3toSBIzZwAAAME"]
[Thu Jan 08 14:56:32.681810 2026] [:error] [pid 2424:tid 2441] [client 107.150.18.47:54500] [client 107.150.18.47] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".web.ui.webresource.axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/Telerik.Web.UI.WebResource.axd"] [unique_id "aV9VILTDJR8aofkBk9TcQwAAAQ8"]
[Thu Jan 08 16:42:20.305962 2026] [:error] [pid 15264:tid 15308] [client 150.60.157.163:23331] [client 150.60.157.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.60.157.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV9t7Iov6_kvS0Owh-ruLgAAAEk"]
[Thu Jan 08 16:42:21.955372 2026] [:error] [pid 15264:tid 15307] [client 150.60.157.163:23420] [client 150.60.157.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.60.157.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV9t7Yov6_kvS0Owh-ruLwAAAEg"]
[Thu Jan 08 16:42:23.227497 2026] [:error] [pid 15264:tid 15317] [client 150.60.157.163:23481] [client 150.60.157.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.60.157.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV9t74ov6_kvS0Owh-ruMAAAAFI"]
[Thu Jan 08 16:43:32.357150 2026] [:error] [pid 15263:tid 15278] [client 160.250.186.121:52620] [client 160.250.186.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.186.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV9uNNv61bxum7WG_e_fIAAAAAY"]
[Thu Jan 08 16:43:34.374628 2026] [:error] [pid 15263:tid 15279] [client 160.250.186.121:52628] [client 160.250.186.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.186.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV9uNtv61bxum7WG_e_fJAAAAAc"]
[Thu Jan 08 16:43:36.447527 2026] [:error] [pid 15358:tid 15390] [client 160.250.186.121:52640] [client 160.250.186.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.186.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV9uOCoRk9xWJ3toSBJN0gAAANQ"]
[Thu Jan 08 16:44:26.489870 2026] [:error] [pid 15265:tid 15330] [client 64.225.20.171:54816] [client 64.225.20.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.225.20.171, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV9uaqE6VBKhew2LTFQfOwAAAIQ"]
[Thu Jan 08 16:44:28.136736 2026] [:error] [pid 15358:tid 15372] [client 64.225.20.171:54822] [client 64.225.20.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.225.20.171, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV9ubCoRk9xWJ3toSBJN5wAAAMI"]
[Thu Jan 08 16:44:29.738667 2026] [:error] [pid 2424:tid 2441] [client 64.225.20.171:54828] [client 64.225.20.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.225.20.171, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV9ubbTDJR8aofkBk9TzLwAAAQ8"]
[Thu Jan 08 17:48:44.144343 2026] [:error] [pid 15263:tid 15272] [client 221.229.106.25:50822] [client 221.229.106.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aV99fNv61bxum7WG_e_omgAAAAA"]
[Fri Jan 09 00:06:01.525527 2026] [:error] [pid 15264:tid 15317] [client 104.243.19.148:41884] [client 104.243.19.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.243.19.148, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV_V6Yov6_kvS0Owh-ouWgAAAFI"]
[Fri Jan 09 00:06:24.233260 2026] [:error] [pid 2484:tid 2486] [client 79.137.71.10:44786] [client 79.137.71.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.137.71.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV_WADiDlnlaQQK_AEO-HgAAAUA"]
[Fri Jan 09 00:06:31.522934 2026] [:error] [pid 15264:tid 15323] [client 185.98.5.160:32838] [client 185.98.5.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.98.5.160, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV_WB4ov6_kvS0Owh-oucQAAAFg"]
[Fri Jan 09 00:52:46.931805 2026] [:error] [pid 2484:tid 2497] [client 20.196.88.199:57339] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-front.php"] [unique_id "aV_g3jiDlnlaQQK_AEPQ5gAAAUo"]
[Fri Jan 09 00:52:47.527269 2026] [:error] [pid 2424:tid 2447] [client 20.196.88.199:57341] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-front.php"] [unique_id "aV_g37TDJR8aofkBk9RhXAAAARU"]
[Fri Jan 09 00:52:49.085004 2026] [:error] [pid 15263:tid 15272] [client 20.196.88.199:22857] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-front.php"] [unique_id "aV_g4dv61bxum7WG_e8tagAAAAA"]
[Fri Jan 09 00:52:49.565194 2026] [:error] [pid 2424:tid 2450] [client 20.196.88.199:15665] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-front.php"] [unique_id "aV_g4bTDJR8aofkBk9RhYAAAARg"]
[Fri Jan 09 00:52:51.161370 2026] [:error] [pid 2484:tid 2486] [client 20.196.88.199:16052] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenium4.php"] [unique_id "aV_g4ziDlnlaQQK_AEPQ6gAAAUA"]
[Fri Jan 09 00:52:52.279146 2026] [:error] [pid 2424:tid 2429] [client 20.196.88.199:22903] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenium4.php"] [unique_id "aV_g5LTDJR8aofkBk9RhYQAAAQM"]
[Fri Jan 09 00:52:53.456521 2026] [:error] [pid 15358:tid 15383] [client 20.196.88.199:64743] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenium4.php"] [unique_id "aV_g5SoRk9xWJ3toSBKvZwAAAM0"]
[Fri Jan 09 00:52:54.199583 2026] [:error] [pid 15264:tid 15299] [client 20.196.88.199:56900] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenium4.php"] [unique_id "aV_g5oov6_kvS0Owh-o4zwAAAEA"]
[Fri Jan 09 00:52:54.970659 2026] [:error] [pid 2484:tid 2503] [client 20.196.88.199:56931] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid-file.php"] [unique_id "aV_g5jiDlnlaQQK_AEPQ7QAAAU8"]
[Fri Jan 09 00:52:55.676579 2026] [:error] [pid 7586:tid 7588] [client 20.196.88.199:25267] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid-file.php"] [unique_id "aV_g58Jyk37GdXP5TmWXgwAAAcA"]
[Fri Jan 09 00:52:56.992733 2026] [:error] [pid 15264:tid 15317] [client 20.196.88.199:16057] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid-file.php"] [unique_id "aV_g6Iov6_kvS0Owh-o41AAAAFI"]
[Fri Jan 09 00:52:58.234191 2026] [:error] [pid 2424:tid 2432] [client 20.196.88.199:22815] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid-file.php"] [unique_id "aV_g6rTDJR8aofkBk9RhbAAAAQY"]
[Fri Jan 09 00:52:59.173401 2026] [:error] [pid 17404:tid 17429] [client 20.196.88.199:17036] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-user.php"] [unique_id "aV_g62Vd_oH193N6AnXrIQAAAZc"]
[Fri Jan 09 00:52:59.798037 2026] [:error] [pid 15358:tid 15387] [client 20.196.88.199:17047] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-user.php"] [unique_id "aV_g6yoRk9xWJ3toSBKvagAAANE"]
[Fri Jan 09 00:53:00.856337 2026] [:error] [pid 15358:tid 15372] [client 20.196.88.199:17068] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-user.php"] [unique_id "aV_g7CoRk9xWJ3toSBKvbQAAAMI"]
[Fri Jan 09 00:53:01.434477 2026] [:error] [pid 17404:tid 17428] [client 20.196.88.199:14877] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-user.php"] [unique_id "aV_g7WVd_oH193N6AnXrIwAAAZY"]
[Fri Jan 09 00:53:02.159777 2026] [:error] [pid 2424:tid 2444] [client 20.196.88.199:18349] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aV_g7rTDJR8aofkBk9RhbQAAARI"]
[Fri Jan 09 00:53:03.409019 2026] [:error] [pid 7586:tid 7594] [client 20.196.88.199:17050] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aV_g78Jyk37GdXP5TmWXiQAAAcY"]
[Fri Jan 09 00:53:05.204165 2026] [:error] [pid 2424:tid 2434] [client 20.196.88.199:18814] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aV_g8bTDJR8aofkBk9RhcQAAAQg"]
[Fri Jan 09 00:53:06.273724 2026] [:error] [pid 15264:tid 15303] [client 20.196.88.199:1741] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aV_g8oov6_kvS0Owh-o42gAAAEQ"]
[Fri Jan 09 00:53:06.721613 2026] [:error] [pid 17404:tid 17420] [client 20.196.88.199:24847] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/green.php"] [unique_id "aV_g8mVd_oH193N6AnXrJgAAAY4"]
[Fri Jan 09 00:53:07.143888 2026] [:error] [pid 2424:tid 2426] [client 20.196.88.199:64819] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/green.php"] [unique_id "aV_g87TDJR8aofkBk9RhdQAAAQA"]
[Fri Jan 09 00:53:07.902082 2026] [:error] [pid 7586:tid 7602] [client 20.196.88.199:23182] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/green.php"] [unique_id "aV_g88Jyk37GdXP5TmWXjAAAAcw"]
[Fri Jan 09 00:53:08.560874 2026] [:error] [pid 15264:tid 15305] [client 20.196.88.199:19473] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/green.php"] [unique_id "aV_g9Iov6_kvS0Owh-o43wAAAEY"]
[Fri Jan 09 00:53:09.155010 2026] [:error] [pid 15265:tid 15342] [client 20.196.88.199:58803] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lm15.php"] [unique_id "aV_g9aE6VBKhew2LTFR3jgAAAJA"]
[Fri Jan 09 00:53:09.807615 2026] [:error] [pid 15358:tid 15394] [client 20.196.88.199:58799] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lm15.php"] [unique_id "aV_g9SoRk9xWJ3toSBKvcwAAANg"]
[Fri Jan 09 00:53:10.405223 2026] [:error] [pid 15265:tid 15330] [client 20.196.88.199:58812] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lm15.php"] [unique_id "aV_g9qE6VBKhew2LTFR3jwAAAIQ"]
[Fri Jan 09 00:53:11.297218 2026] [:error] [pid 2424:tid 2445] [client 20.196.88.199:16110] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lm15.php"] [unique_id "aV_g97TDJR8aofkBk9RhfAAAARM"]
[Fri Jan 09 00:53:12.086996 2026] [:error] [pid 17404:tid 17410] [client 20.196.88.199:55113] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aV_g-GVd_oH193N6AnXrKgAAAYQ"]
[Fri Jan 09 00:53:13.084520 2026] [:error] [pid 2424:tid 2428] [client 20.196.88.199:16081] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aV_g-bTDJR8aofkBk9RhfwAAAQI"]
[Fri Jan 09 00:53:13.946127 2026] [:error] [pid 15265:tid 15345] [client 20.196.88.199:58806] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aV_g-aE6VBKhew2LTFR3lAAAAJM"]
[Fri Jan 09 00:53:14.734005 2026] [:error] [pid 15264:tid 15314] [client 20.196.88.199:55329] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "aV_g-oov6_kvS0Owh-o44gAAAE8"]
[Fri Jan 09 00:53:15.577723 2026] [:error] [pid 15265:tid 15339] [client 20.196.88.199:56455] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qaez.php"] [unique_id "aV_g-6E6VBKhew2LTFR3lgAAAI0"]
[Fri Jan 09 00:53:16.728168 2026] [:error] [pid 15358:tid 15376] [client 20.196.88.199:20180] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qaez.php"] [unique_id "aV_g_CoRk9xWJ3toSBKveAAAAMY"]
[Fri Jan 09 00:53:17.485402 2026] [:error] [pid 7586:tid 7605] [client 20.196.88.199:18392] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qaez.php"] [unique_id "aV_g_cJyk37GdXP5TmWXkQAAAc8"]
[Fri Jan 09 00:53:18.200855 2026] [:error] [pid 7586:tid 7610] [client 20.196.88.199:57003] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qaez.php"] [unique_id "aV_g_sJyk37GdXP5TmWXkgAAAdQ"]
[Fri Jan 09 00:53:19.133602 2026] [:error] [pid 15264:tid 15301] [client 20.196.88.199:17515] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "aV_g_4ov6_kvS0Owh-o45wAAAEI"]
[Fri Jan 09 00:53:20.234277 2026] [:error] [pid 2424:tid 2448] [client 20.196.88.199:24347] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "aV_hALTDJR8aofkBk9RhhAAAARY"]
[Fri Jan 09 00:53:20.947593 2026] [:error] [pid 15263:tid 15283] [client 20.196.88.199:22729] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "aV_hANv61bxum7WG_e8tfwAAAAs"]
[Fri Jan 09 00:53:21.420339 2026] [:error] [pid 17404:tid 17421] [client 20.196.88.199:24367] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "aV_hAWVd_oH193N6AnXrMAAAAY8"]
[Fri Jan 09 00:53:22.704606 2026] [:error] [pid 17404:tid 17429] [client 20.196.88.199:22771] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aV_hAmVd_oH193N6AnXrMgAAAZc"]
[Fri Jan 09 00:53:23.903520 2026] [:error] [pid 15263:tid 15294] [client 20.196.88.199:15748] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aV_hA9v61bxum7WG_e8tgwAAABY"]
[Fri Jan 09 00:53:24.345076 2026] [:error] [pid 15358:tid 15371] [client 20.196.88.199:15764] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aV_hBCoRk9xWJ3toSBKvhgAAAME"]
[Fri Jan 09 00:53:24.876522 2026] [:error] [pid 15264:tid 15323] [client 20.196.88.199:17720] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aV_hBIov6_kvS0Owh-o46wAAAFg"]
[Fri Jan 09 00:53:25.808961 2026] [:error] [pid 15263:tid 15274] [client 20.196.88.199:15747] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ox8xhkkw.php"] [unique_id "aV_hBdv61bxum7WG_e8thQAAAAI"]
[Fri Jan 09 00:53:26.691929 2026] [:error] [pid 2424:tid 2444] [client 20.196.88.199:57939] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ox8xhkkw.php"] [unique_id "aV_hBrTDJR8aofkBk9RhjAAAARI"]
[Fri Jan 09 00:53:27.151180 2026] [:error] [pid 17404:tid 17411] [client 20.196.88.199:29569] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ox8xhkkw.php"] [unique_id "aV_hB2Vd_oH193N6AnXrNgAAAYU"]
[Fri Jan 09 00:53:27.948801 2026] [:error] [pid 15358:tid 15380] [client 20.196.88.199:57957] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ox8xhkkw.php"] [unique_id "aV_hByoRk9xWJ3toSBKvigAAAMo"]
[Fri Jan 09 00:53:28.718937 2026] [:error] [pid 17404:tid 17407] [client 20.196.88.199:1845] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-advaced.php"] [unique_id "aV_hCGVd_oH193N6AnXrPgAAAYE"]
[Fri Jan 09 00:53:29.773963 2026] [:error] [pid 2484:tid 2511] [client 20.196.88.199:1855] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-advaced.php"] [unique_id "aV_hCTiDlnlaQQK_AEPREwAAAVc"]
[Fri Jan 09 00:53:30.356234 2026] [:error] [pid 15263:tid 15296] [client 20.196.88.199:1487] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-advaced.php"] [unique_id "aV_hCtv61bxum7WG_e8tjAAAABg"]
[Fri Jan 09 00:53:30.813195 2026] [:error] [pid 15358:tid 15379] [client 20.196.88.199:24611] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-advaced.php"] [unique_id "aV_hCioRk9xWJ3toSBKvjQAAAMk"]
[Fri Jan 09 00:53:31.798186 2026] [:error] [pid 2424:tid 2434] [client 20.196.88.199:29573] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s.php"] [unique_id "aV_hC7TDJR8aofkBk9RhkgAAAQg"]
[Fri Jan 09 00:53:32.549093 2026] [:error] [pid 15358:tid 15384] [client 20.196.88.199:58033] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s.php"] [unique_id "aV_hDCoRk9xWJ3toSBKvjwAAAM4"]
[Fri Jan 09 00:53:33.361671 2026] [:error] [pid 2484:tid 2504] [client 20.196.88.199:15209] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s.php"] [unique_id "aV_hDTiDlnlaQQK_AEPRFQAAAVA"]
[Fri Jan 09 00:53:33.990349 2026] [:error] [pid 7586:tid 7594] [client 20.196.88.199:57924] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s.php"] [unique_id "aV_hDcJyk37GdXP5TmWXrwAAAcY"]
[Fri Jan 09 00:53:34.539436 2026] [:error] [pid 7586:tid 7603] [client 20.196.88.199:1817] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww3.php"] [unique_id "aV_hDsJyk37GdXP5TmWXsAAAAc0"]
[Fri Jan 09 00:53:35.237387 2026] [:error] [pid 2424:tid 2441] [client 20.196.88.199:20929] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww3.php"] [unique_id "aV_hD7TDJR8aofkBk9RhmQAAAQ8"]
[Fri Jan 09 00:53:36.146545 2026] [:error] [pid 2424:tid 2444] [client 20.196.88.199:1478] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww3.php"] [unique_id "aV_hELTDJR8aofkBk9RhnAAAARI"]
[Fri Jan 09 00:53:36.869995 2026] [:error] [pid 15358:tid 15373] [client 20.196.88.199:24297] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww3.php"] [unique_id "aV_hECoRk9xWJ3toSBKvlQAAAMM"]
[Fri Jan 09 00:53:37.521385 2026] [:error] [pid 17404:tid 17413] [client 20.196.88.199:1490] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dout.php"] [unique_id "aV_hEWVd_oH193N6AnXrSAAAAYc"]
[Fri Jan 09 00:53:38.966708 2026] [:error] [pid 15265:tid 15331] [client 20.196.88.199:15224] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dout.php"] [unique_id "aV_hEqE6VBKhew2LTFR3pQAAAIU"]
[Fri Jan 09 00:53:39.607376 2026] [:error] [pid 2484:tid 2494] [client 20.196.88.199:15206] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dout.php"] [unique_id "aV_hEziDlnlaQQK_AEPRGgAAAUc"]
[Fri Jan 09 00:53:40.026903 2026] [:error] [pid 15263:tid 15296] [client 20.196.88.199:1821] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dout.php"] [unique_id "aV_hFNv61bxum7WG_e8tmQAAABg"]
[Fri Jan 09 00:53:40.505138 2026] [:error] [pid 2484:tid 2510] [client 20.196.88.199:57967] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin836.php"] [unique_id "aV_hFDiDlnlaQQK_AEPRGwAAAVY"]
[Fri Jan 09 00:53:41.042924 2026] [:error] [pid 2484:tid 2497] [client 20.196.88.199:17752] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin836.php"] [unique_id "aV_hFTiDlnlaQQK_AEPRHgAAAUo"]
[Fri Jan 09 00:53:41.401361 2026] [:error] [pid 15264:tid 15313] [client 20.196.88.199:24272] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin836.php"] [unique_id "aV_hFYov6_kvS0Owh-o4-wAAAE4"]
[Fri Jan 09 00:53:43.126607 2026] [:error] [pid 7586:tid 7606] [client 20.196.88.199:24632] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin836.php"] [unique_id "aV_hF8Jyk37GdXP5TmWXtQAAAdA"]
[Fri Jan 09 00:53:43.856251 2026] [:error] [pid 15264:tid 15307] [client 20.196.88.199:24270] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aV_hF4ov6_kvS0Owh-o4_QAAAEg"]
[Fri Jan 09 00:53:44.192536 2026] [:error] [pid 7586:tid 7607] [client 20.196.88.199:17779] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aV_hGMJyk37GdXP5TmWXuAAAAdE"]
[Fri Jan 09 00:53:44.721900 2026] [:error] [pid 7586:tid 7593] [client 20.196.88.199:15190] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aV_hGMJyk37GdXP5TmWXugAAAcU"]
[Fri Jan 09 00:53:45.173322 2026] [:error] [pid 7586:tid 7592] [client 20.196.88.199:57966] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aV_hGcJyk37GdXP5TmWXvAAAAcQ"]
[Fri Jan 09 00:53:45.696422 2026] [:error] [pid 15264:tid 15316] [client 20.196.88.199:57952] [client 20.196.88.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aV_hGYov6_kvS0Owh-o5AQAAAFE"]
[Fri Jan 09 01:26:39.234963 2026] [:error] [pid 2484:tid 2496] [client 134.209.95.224:56804] [client 134.209.95.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.209.95.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV_ozziDlnlaQQK_AEPZAQAAAUk"]
[Fri Jan 09 01:26:41.877183 2026] [:error] [pid 13673:tid 13675] [client 20.57.128.168:56352] [client 20.57.128.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.57.128.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV_o0YD4ue0-noJ7SHO1rQAAAgA"]
[Fri Jan 09 01:26:54.356346 2026] [:error] [pid 15263:tid 15275] [client 154.219.104.78:35214] [client 154.219.104.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.219.104.78, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV_o3tv61bxum7WG_e81ZwAAAAM"]
[Fri Jan 09 01:27:18.997622 2026] [:error] [pid 13673:tid 13688] [client 185.2.5.88:46810] [client 185.2.5.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.2.5.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV_o9oD4ue0-noJ7SHO1xgAAAg0"]
[Fri Jan 09 02:00:06.085271 2026] [:error] [pid 15265:tid 15349] [client 34.125.125.188:65217] [client 34.125.125.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.125.125.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV_wpqE6VBKhew2LTFSKWwAAAJc"]
[Fri Jan 09 02:00:08.293264 2026] [:error] [pid 15265:tid 15350] [client 34.125.125.188:65217] [client 34.125.125.188] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aV_wqKE6VBKhew2LTFSKXgAAAJg"]
[Fri Jan 09 02:00:08.455014 2026] [:error] [pid 15265:tid 15342] [client 34.125.125.188:65217] [client 34.125.125.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.125.125.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV_wqKE6VBKhew2LTFSKXwAAAJA"]
[Fri Jan 09 02:00:09.747590 2026] [:error] [pid 15265:tid 15346] [client 34.125.125.188:55776] [client 34.125.125.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.125.125.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV_wqaE6VBKhew2LTFSKYQAAAJQ"]
[Fri Jan 09 02:00:10.984573 2026] [:error] [pid 2424:tid 2438] [client 34.125.125.188:62752] [client 34.125.125.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.125.125.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV_wqrTDJR8aofkBk9RwiAAAAQw"]
[Fri Jan 09 02:00:12.198145 2026] [:error] [pid 15265:tid 15331] [client 34.125.125.188:56252] [client 34.125.125.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.125.125.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV_wrKE6VBKhew2LTFSKYgAAAIU"]
[Fri Jan 09 02:00:13.449190 2026] [:error] [pid 17404:tid 17416] [client 34.125.125.188:49525] [client 34.125.125.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.125.125.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV_wrWVd_oH193N6AnX86wAAAYo"]
[Fri Jan 09 02:00:13.449366 2026] [:error] [pid 17404:tid 17416] [client 34.125.125.188:49525] [client 34.125.125.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.125.125.188, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV_wrWVd_oH193N6AnX86wAAAYo"]
[Fri Jan 09 02:10:39.508782 2026] [:error] [pid 2424:tid 2448] [client 34.48.235.26:59029] [client 34.48.235.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.235.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV_zH7TDJR8aofkBk9RyWAAAARY"]
[Fri Jan 09 02:10:41.759396 2026] [:error] [pid 2424:tid 2450] [client 34.48.235.26:59029] [client 34.48.235.26] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aV_zIbTDJR8aofkBk9RyYQAAARg"]
[Fri Jan 09 02:10:41.973977 2026] [:error] [pid 2424:tid 2432] [client 34.48.235.26:59029] [client 34.48.235.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.235.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV_zIbTDJR8aofkBk9RyYgAAAQY"]
[Fri Jan 09 02:10:43.535359 2026] [:error] [pid 15263:tid 15287] [client 34.48.235.26:61582] [client 34.48.235.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.235.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV_zI9v61bxum7WG_e8_kQAAAA8"]
[Fri Jan 09 02:10:43.539081 2026] [:error] [pid 15263:tid 15287] [client 34.48.235.26:61582] [client 34.48.235.26] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/usr/local/apache/modsecurity-cwaf/rules/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 34.48.235.26 (+1 hits since last alert)|expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aV_zI9v61bxum7WG_e8_kQAAAA8"]
[Fri Jan 09 02:21:50.655244 2026] [:error] [pid 13673:tid 13682] [client 49.51.252.146:51888] [client 49.51.252.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aV_1voD4ue0-noJ7SHPHHwAAAgc"]
[Fri Jan 09 03:35:05.126359 2026] [:error] [pid 35811:tid 35867] [client 104.28.161.188:32326] [client 104.28.161.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aWAG6W7lx9V0CvYJJf2SwAAAAFQ"]
[Fri Jan 09 04:37:22.604145 2026] [:error] [pid 35916:tid 35933] [client 49.13.90.242:33042] [client 49.13.90.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.13.90.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWAVgvnSLfzabNjOjwyBPQAAAM8"]
[Fri Jan 09 04:37:24.793582 2026] [:error] [pid 10431:tid 10446] [client 49.13.90.242:49736] [client 49.13.90.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.13.90.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWAVhCkUbiVdwQzsJJSu8wAAAQw"]
[Fri Jan 09 04:37:54.863247 2026] [:error] [pid 35810:tid 35832] [client 118.190.217.51:58888] [client 118.190.217.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.190.217.51, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWAVoorJrhH8tOUNM5De7QAAAA0"]
[Fri Jan 09 05:53:10.126858 2026] [:error] [pid 10431:tid 10444] [client 68.183.9.16:52354] [client 68.183.9.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aWAnRikUbiVdwQzsJJTWNAAAAQo"]
[Fri Jan 09 05:53:17.435264 2026] [authz_core:error] [pid 35810:tid 35839] [client 68.183.9.16:41468] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Fri Jan 09 05:53:20.271693 2026] [:error] [pid 35916:tid 35919] [client 68.183.9.16:41500] [client 68.183.9.16] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aWAnUPnSLfzabNjOjwyg1gAAAME"]
[Fri Jan 09 05:55:10.582620 2026] [:error] [pid 35811:tid 35858] [client 103.242.13.14:60084] [client 103.242.13.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.242.13.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWAnvm7lx9V0CvYJJf3A1QAAAEs"]
[Fri Jan 09 05:55:54.901807 2026] [:error] [pid 35810:tid 35824] [client 49.13.90.242:54354] [client 49.13.90.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.13.90.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWAn6orJrhH8tOUNM5D49AAAAAU"]
[Fri Jan 09 07:16:37.682689 2026] [:error] [pid 10431:tid 10437] [client 216.81.248.93:32912] [client 216.81.248.93] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aWA61SkUbiVdwQzsJJQBewAAAQM"]
[Fri Jan 09 07:58:56.773656 2026] [:error] [pid 10431:tid 10443] [client 154.89.149.241:58010] [client 154.89.149.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.89.149.241, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWBEwCkUbiVdwQzsJJQX1QAAAQk"]
[Fri Jan 09 07:59:09.626567 2026] [:error] [pid 35810:tid 35840] [client 154.89.149.241:52226] [client 154.89.149.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.89.149.241, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWBEzYrJrhH8tOUNM5AkAAAAABU"]
[Fri Jan 09 07:59:11.325491 2026] [:error] [pid 35810:tid 35827] [client 144.91.71.252:43278] [client 144.91.71.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 144.91.71.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWBEz4rJrhH8tOUNM5AkBAAAAAg"]
[Fri Jan 09 07:59:33.239155 2026] [:error] [pid 35811:tid 35855] [client 103.85.58.178:60652] [client 103.85.58.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.85.58.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWBE5W7lx9V0CvYJJf3tvQAAAEg"]
[Fri Jan 09 07:59:43.857322 2026] [:error] [pid 35810:tid 35843] [client 103.85.58.178:58114] [client 103.85.58.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.85.58.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWBE74rJrhH8tOUNM5AkVAAAABg"]
[Fri Jan 09 09:22:18.298810 2026] [:error] [pid 30113:tid 30117] [client 184.154.22.90:60557] [client 184.154.22.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.154.22.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWBYSqsz80DbrolLWsHLRAAAAQE"]
[Fri Jan 09 10:29:47.599085 2026] [autoindex:error] [pid 30021:tid 30087] [client 143.244.141.160:51916] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Jan 09 11:12:15.161796 2026] [:error] [pid 44848:tid 44869] [client 152.53.37.34:60930] [client 152.53.37.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.37.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWByD6jajoTJAbEk87w_HgAAAFM"]
[Fri Jan 09 12:05:08.875196 2026] [:error] [pid 1366:tid 1382] [client 159.65.187.122:35596] [client 159.65.187.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.65.187.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWB-dBmasveKu8_ec1XNdAAAAY0"]
[Fri Jan 09 12:29:58.770636 2026] [:error] [pid 44848:tid 44854] [client 13.215.220.218:51602] [client 13.215.220.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 13.215.220.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWCERqjajoTJAbEk87xSRgAAAEQ"]
[Fri Jan 09 12:41:09.743183 2026] [:error] [pid 14770:tid 14777] [client 109.123.238.31:47742] [client 109.123.238.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.123.238.31, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWCG5R5QbaVZ-6newJb0WgAAAgU"]
[Fri Jan 09 12:41:45.384731 2026] [:error] [pid 14831:tid 14855] [client 191.6.208.10:50272] [client 191.6.208.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.6.208.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWCHCfaKOMCmJcAyBm3q2QAAApY"]
[Fri Jan 09 12:41:50.124646 2026] [:error] [pid 30021:tid 30081] [client 5.9.59.157:38640] [client 5.9.59.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.59.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWCHDg_M8aRtsTog5J8_HAAAAMA"]
[Fri Jan 09 12:44:42.833502 2026] [:error] [pid 44848:tid 44863] [client 117.62.235.53:52723] [client 117.62.235.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWCHuqjajoTJAbEk87xWLAAAAE0"]
[Fri Jan 09 12:50:27.347037 2026] [:error] [pid 14801:tid 14816] [client 85.203.21.88:62437] [client 85.203.21.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-confiq.php"] [unique_id "aWCJE98UWXrz_OQYgF0cRgAAAk0"]
[Fri Jan 09 12:50:27.700534 2026] [:error] [pid 14801:tid 14810] [client 85.203.21.153:45373] [client 85.203.21.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/nrhogjyecktixbal0fnt5Cakc.php"] [unique_id "aWCJE98UWXrz_OQYgF0cRwAAAkc"]
[Fri Jan 09 12:50:28.059410 2026] [:error] [pid 30019:tid 30035] [client 85.203.21.112:60741] [client 85.203.21.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aWCJFEz3igHGwX5f7IqQzQAAAAs"]
[Fri Jan 09 12:50:28.413687 2026] [:error] [pid 14770:tid 14772] [client 85.203.21.87:58519] [client 85.203.21.87] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/znv3hcxz6mwjdz1jwxrxiCakc.php"] [unique_id "aWCJFB5QbaVZ-6newJb2KQAAAgA"]
[Fri Jan 09 12:50:28.767774 2026] [:error] [pid 14770:tid 14780] [client 85.203.21.70:62851] [client 85.203.21.70] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aWCJFB5QbaVZ-6newJb2KgAAAgg"]
[Fri Jan 09 12:50:29.115656 2026] [:error] [pid 30019:tid 30029] [client 85.203.21.99:47919] [client 85.203.21.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/form.php"] [unique_id "aWCJFUz3igHGwX5f7IqQ0AAAAAU"]
[Fri Jan 09 12:50:29.461799 2026] [:error] [pid 44848:tid 44863] [client 85.203.21.85:48491] [client 85.203.21.85] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-links-opml.php"] [unique_id "aWCJFajajoTJAbEk87xYnQAAAE0"]
[Fri Jan 09 12:50:29.814608 2026] [:error] [pid 14872:tid 14888] [client 85.203.21.112:23331] [client 85.203.21.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "aWCJFaIUELhgYLNp1sbqRgAAAs4"]
[Fri Jan 09 12:50:30.165092 2026] [:error] [pid 30020:tid 30056] [client 85.203.21.101:32261] [client 85.203.21.101] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aWCJFsrjc66qOisG6L2aNQAAAII"]
[Fri Jan 09 12:50:30.529856 2026] [:error] [pid 30019:tid 30028] [client 85.203.21.150:26759] [client 85.203.21.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/uk5pqv0wksbuaourleCakc.php"] [unique_id "aWCJFkz3igHGwX5f7IqQ0gAAAAQ"]
[Fri Jan 09 12:50:30.895288 2026] [:error] [pid 14739:tid 14758] [client 85.203.21.79:61753] [client 85.203.21.79] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "aWCJFl63M6_PkLt_IJIo1wAAAdE"]
[Fri Jan 09 12:50:31.262865 2026] [:error] [pid 14770:tid 14776] [client 85.203.21.81:62667] [client 85.203.21.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/admin.php"] [unique_id "aWCJFx5QbaVZ-6newJb2LwAAAgQ"]
[Fri Jan 09 12:50:31.618075 2026] [:error] [pid 1366:tid 1383] [client 85.203.21.107:62631] [client 85.203.21.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/shell.php"] [unique_id "aWCJFxmasveKu8_ec1XedAAAAY4"]
[Fri Jan 09 12:50:32.027342 2026] [:error] [pid 44848:tid 44858] [client 85.203.21.100:36017] [client 85.203.21.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aWCJGKjajoTJAbEk87xYowAAAEg"]
[Fri Jan 09 12:50:32.384299 2026] [:error] [pid 30019:tid 30034] [client 85.203.21.109:32523] [client 85.203.21.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aWCJGEz3igHGwX5f7IqQ0wAAAAo"]
[Fri Jan 09 12:50:32.736811 2026] [:error] [pid 14739:tid 14749] [client 85.203.21.85:53175] [client 85.203.21.85] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/test1.php"] [unique_id "aWCJGF63M6_PkLt_IJIo2AAAAcg"]
[Fri Jan 09 12:50:33.084028 2026] [:error] [pid 44848:tid 44869] [client 85.203.21.79:40849] [client 85.203.21.79] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aWCJGajajoTJAbEk87xYpgAAAFM"]
[Fri Jan 09 12:50:33.436885 2026] [:error] [pid 14801:tid 14826] [client 85.203.21.141:56171] [client 85.203.21.141] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "aWCJGd8UWXrz_OQYgF0cSgAAAlc"]
[Fri Jan 09 12:50:33.795683 2026] [:error] [pid 14801:tid 14807] [client 85.203.21.76:54211] [client 85.203.21.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aWCJGd8UWXrz_OQYgF0cTAAAAkQ"]
[Fri Jan 09 12:50:34.144866 2026] [:error] [pid 14801:tid 14820] [client 85.203.21.137:62483] [client 85.203.21.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "aWCJGt8UWXrz_OQYgF0cTQAAAlE"]
[Fri Jan 09 12:50:34.508201 2026] [:error] [pid 1366:tid 1368] [client 85.203.21.76:57831] [client 85.203.21.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/aatdgetgdg/main.php"] [unique_id "aWCJGhmasveKu8_ec1XedgAAAYA"]
[Fri Jan 09 12:50:34.865325 2026] [:error] [pid 14770:tid 14777] [client 85.203.21.88:30425] [client 85.203.21.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aWCJGh5QbaVZ-6newJb2MAAAAgU"]
[Fri Jan 09 12:50:35.220370 2026] [:error] [pid 14770:tid 14788] [client 85.203.21.105:57971] [client 85.203.21.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aWCJGx5QbaVZ-6newJb2MgAAAhA"]
[Fri Jan 09 12:50:35.568394 2026] [:error] [pid 14872:tid 14883] [client 85.203.21.115:45323] [client 85.203.21.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/cache/"] [unique_id "aWCJG6IUELhgYLNp1sbqSAAAAsk"]
[Fri Jan 09 12:50:35.914840 2026] [:error] [pid 30020:tid 30078] [client 85.203.21.138:55523] [client 85.203.21.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aWCJG8rjc66qOisG6L2aOQAAAJg"]
[Fri Jan 09 12:50:36.273699 2026] [:error] [pid 1366:tid 1377] [client 85.203.21.71:27033] [client 85.203.21.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/upload/"] [unique_id "aWCJHBmasveKu8_ec1XedwAAAYg"]
[Fri Jan 09 12:50:36.627770 2026] [:error] [pid 44848:tid 44858] [client 85.203.21.115:58813] [client 85.203.21.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aWCJHKjajoTJAbEk87xYqwAAAEg"]
[Fri Jan 09 12:50:36.984216 2026] [:error] [pid 44848:tid 44870] [client 85.203.21.97:20451] [client 85.203.21.97] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aWCJHKjajoTJAbEk87xYrAAAAFQ"]
[Fri Jan 09 12:50:37.333935 2026] [:error] [pid 1366:tid 1389] [client 85.203.21.75:50369] [client 85.203.21.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "aWCJHRmasveKu8_ec1XeeQAAAZQ"]
[Fri Jan 09 12:50:37.691735 2026] [:error] [pid 30020:tid 30075] [client 85.203.21.112:28107] [client 85.203.21.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aWCJHcrjc66qOisG6L2aPAAAAJU"]
[Fri Jan 09 12:50:38.039014 2026] [:error] [pid 30020:tid 30067] [client 85.203.21.114:44965] [client 85.203.21.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/"] [unique_id "aWCJHsrjc66qOisG6L2aPQAAAI0"]
[Fri Jan 09 12:50:38.394293 2026] [:error] [pid 14770:tid 14786] [client 85.203.21.132:39509] [client 85.203.21.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aWCJHh5QbaVZ-6newJb2NQAAAg4"]
[Fri Jan 09 12:50:38.749486 2026] [:error] [pid 14739:tid 14742] [client 85.203.21.74:63669] [client 85.203.21.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/5PJcpMFsD8B.php"] [unique_id "aWCJHl63M6_PkLt_IJIo3gAAAcE"]
[Fri Jan 09 12:50:39.102187 2026] [:error] [pid 14872:tid 14882] [client 85.203.21.137:53627] [client 85.203.21.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aWCJH6IUELhgYLNp1sbqSQAAAsg"]
[Fri Jan 09 12:50:39.452526 2026] [:error] [pid 44848:tid 44863] [client 85.203.21.120:53043] [client 85.203.21.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aWCJH6jajoTJAbEk87xYrwAAAE0"]
[Fri Jan 09 12:50:39.801784 2026] [:error] [pid 30020:tid 30072] [client 85.203.21.99:65299] [client 85.203.21.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css.php"] [unique_id "aWCJH8rjc66qOisG6L2aQQAAAJI"]
[Fri Jan 09 12:50:40.148615 2026] [:error] [pid 1366:tid 1383] [client 85.203.21.119:43785] [client 85.203.21.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aWCJIBmasveKu8_ec1XefQAAAY4"]
[Fri Jan 09 12:50:40.496818 2026] [:error] [pid 30020:tid 30078] [client 85.203.21.97:26859] [client 85.203.21.97] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/lock360.php"] [unique_id "aWCJIMrjc66qOisG6L2aQwAAAJg"]
[Fri Jan 09 12:50:40.845175 2026] [:error] [pid 14831:tid 14853] [client 85.203.21.135:56353] [client 85.203.21.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/themes.php"] [unique_id "aWCJIPaKOMCmJcAyBm3sigAAApQ"]
[Fri Jan 09 12:50:41.192393 2026] [:error] [pid 44848:tid 44854] [client 85.203.21.101:50269] [client 85.203.21.101] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/updates.php"] [unique_id "aWCJIajajoTJAbEk87xYsgAAAEQ"]
[Fri Jan 09 12:50:43.075903 2026] [:error] [pid 44848:tid 44856] [client 85.203.21.119:43963] [client 85.203.21.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/so-pinyin-slugs/inc/main_json.php"] [unique_id "aWCJI6jajoTJAbEk87xYuAAAAEY"]
[Fri Jan 09 12:50:43.425663 2026] [:error] [pid 14739:tid 14755] [client 85.203.21.116:60531] [client 85.203.21.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/revslider/includes/external/page/"] [unique_id "aWCJI163M6_PkLt_IJIo4AAAAc4"]
[Fri Jan 09 12:50:43.784769 2026] [:error] [pid 44848:tid 44862] [client 85.203.21.85:51827] [client 85.203.21.85] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/code/"] [unique_id "aWCJI6jajoTJAbEk87xYugAAAEw"]
[Fri Jan 09 12:50:44.139827 2026] [:error] [pid 30021:tid 30097] [client 85.203.21.118:34031] [client 85.203.21.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/3PJcpMFsD8B.php"] [unique_id "aWCJJA_M8aRtsTog5J9A8wAAANA"]
[Fri Jan 09 12:50:44.500310 2026] [:error] [pid 1366:tid 1391] [client 85.203.21.72:64387] [client 85.203.21.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/"] [unique_id "aWCJJBmasveKu8_ec1XeggAAAZY"]
[Fri Jan 09 12:50:44.852515 2026] [:error] [pid 14801:tid 14819] [client 85.203.21.100:35141] [client 85.203.21.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/class.api.php"] [unique_id "aWCJJN8UWXrz_OQYgF0cVAAAAlA"]
[Fri Jan 09 12:50:45.208073 2026] [:error] [pid 44848:tid 44858] [client 85.203.21.133:43007] [client 85.203.21.133] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aWCJJajajoTJAbEk87xYvwAAAEg"]
[Fri Jan 09 12:50:45.572610 2026] [:error] [pid 30020:tid 30076] [client 85.203.21.107:31565] [client 85.203.21.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aWCJJcrjc66qOisG6L2aSQAAAJY"]
[Fri Jan 09 12:50:45.920986 2026] [:error] [pid 30020:tid 30063] [client 85.203.21.105:59827] [client 85.203.21.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/"] [unique_id "aWCJJcrjc66qOisG6L2aSgAAAIk"]
[Fri Jan 09 12:50:46.273501 2026] [:error] [pid 44848:tid 44861] [client 85.203.21.75:24141] [client 85.203.21.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "aWCJJqjajoTJAbEk87xYxQAAAEs"]
[Fri Jan 09 12:50:46.620568 2026] [:error] [pid 1366:tid 1381] [client 85.203.21.74:48289] [client 85.203.21.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-config-sample.php"] [unique_id "aWCJJhmasveKu8_ec1XehAAAAYw"]
[Fri Jan 09 12:50:46.974737 2026] [:error] [pid 14770:tid 14792] [client 85.203.21.137:29285] [client 85.203.21.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aWCJJh5QbaVZ-6newJb2NwAAAhQ"]
[Fri Jan 09 12:50:47.333827 2026] [:error] [pid 44848:tid 44873] [client 85.203.21.110:56971] [client 85.203.21.110] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/admin.php"] [unique_id "aWCJJ6jajoTJAbEk87xYyAAAAFc"]
[Fri Jan 09 12:50:47.681743 2026] [:error] [pid 30021:tid 30085] [client 85.203.21.72:20479] [client 85.203.21.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aWCJJw_M8aRtsTog5J9A9QAAAMQ"]
[Fri Jan 09 12:50:48.029132 2026] [:error] [pid 30020:tid 30075] [client 85.203.21.98:27907] [client 85.203.21.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/plugins/"] [unique_id "aWCJKMrjc66qOisG6L2aTwAAAJU"]
[Fri Jan 09 12:50:48.383093 2026] [:error] [pid 30019:tid 30044] [client 85.203.21.120:49465] [client 85.203.21.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/autoload_classmap/function.php"] [unique_id "aWCJKEz3igHGwX5f7IqQ2QAAABQ"]
[Fri Jan 09 12:50:48.728465 2026] [:error] [pid 44848:tid 44868] [client 85.203.21.118:43955] [client 85.203.21.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/posts"] [unique_id "aWCJKKjajoTJAbEk87xYygAAAFI"]
[Fri Jan 09 12:50:49.084429 2026] [:error] [pid 14801:tid 14827] [client 85.203.21.110:61047] [client 85.203.21.110] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/admin.php"] [unique_id "aWCJKd8UWXrz_OQYgF0cVgAAAlg"]
[Fri Jan 09 12:50:49.434477 2026] [:error] [pid 44848:tid 44852] [client 85.203.21.147:63995] [client 85.203.21.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aWCJKajajoTJAbEk87xYzwAAAEI"]
[Fri Jan 09 12:50:49.785687 2026] [:error] [pid 14770:tid 14786] [client 85.203.21.107:63131] [client 85.203.21.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/"] [unique_id "aWCJKR5QbaVZ-6newJb2PAAAAg4"]
[Fri Jan 09 12:50:50.159231 2026] [:error] [pid 44848:tid 44871] [client 85.203.21.133:27333] [client 85.203.21.133] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/test.php"] [unique_id "aWCJKqjajoTJAbEk87xY0gAAAFU"]
[Fri Jan 09 12:50:50.517483 2026] [:error] [pid 44848:tid 44867] [client 85.203.21.76:47855] [client 85.203.21.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aWCJKqjajoTJAbEk87xY1wAAAFE"]
[Fri Jan 09 12:50:50.873532 2026] [:error] [pid 14831:tid 14843] [client 85.203.21.74:37587] [client 85.203.21.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/"] [unique_id "aWCJKvaKOMCmJcAyBm3spgAAAoo"]
[Fri Jan 09 12:50:51.221370 2026] [:error] [pid 44848:tid 44870] [client 85.203.21.87:39475] [client 85.203.21.87] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aWCJK6jajoTJAbEk87xY2AAAAFQ"]
[Fri Jan 09 12:50:51.567824 2026] [:error] [pid 14831:tid 14853] [client 85.203.21.152:64031] [client 85.203.21.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/shell/"] [unique_id "aWCJK_aKOMCmJcAyBm3spwAAApQ"]
[Fri Jan 09 12:50:51.914517 2026] [:error] [pid 30021:tid 30102] [client 85.203.21.137:46365] [client 85.203.21.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/"] [unique_id "aWCJKw_M8aRtsTog5J9A-QAAANU"]
[Fri Jan 09 12:50:57.276682 2026] [:error] [pid 44848:tid 44873] [client 85.203.21.101:56881] [client 85.203.21.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/admin.php"] [unique_id "aWCJMajajoTJAbEk87xY8AAAAFc"]
[Fri Jan 09 12:50:57.624076 2026] [:error] [pid 44848:tid 44850] [client 85.203.21.114:45851] [client 85.203.21.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "aWCJMajajoTJAbEk87xY8QAAAEA"]
[Fri Jan 09 12:50:57.980015 2026] [:error] [pid 30020:tid 30059] [client 85.203.21.135:65103] [client 85.203.21.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/system.php"] [unique_id "aWCJMcrjc66qOisG6L2aVgAAAIU"]
[Fri Jan 09 12:50:58.333722 2026] [:error] [pid 14801:tid 14810] [client 85.203.21.131:39053] [client 85.203.21.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/mah.php"] [unique_id "aWCJMt8UWXrz_OQYgF0cXgAAAkc"]
[Fri Jan 09 12:50:58.690104 2026] [:error] [pid 30021:tid 30097] [client 85.203.21.115:30421] [client 85.203.21.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/"] [unique_id "aWCJMg_M8aRtsTog5J9A_QAAANA"]
[Fri Jan 09 12:50:59.040411 2026] [:error] [pid 14801:tid 14814] [client 85.203.21.95:40813] [client 85.203.21.95] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/network_xo.php"] [unique_id "aWCJM98UWXrz_OQYgF0cXwAAAks"]
[Fri Jan 09 12:50:59.386609 2026] [:error] [pid 14770:tid 14783] [client 85.203.21.152:33925] [client 85.203.21.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aWCJMx5QbaVZ-6newJb2RwAAAgs"]
[Fri Jan 09 12:50:59.739016 2026] [:error] [pid 30021:tid 30101] [client 85.203.21.81:44199] [client 85.203.21.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aWCJMw_M8aRtsTog5J9A_wAAANQ"]
[Fri Jan 09 12:51:00.091282 2026] [:error] [pid 14872:tid 14879] [client 85.203.21.71:30793] [client 85.203.21.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aWCJNKIUELhgYLNp1sbqaQAAAsU"]
[Fri Jan 09 12:51:00.444006 2026] [:error] [pid 30019:tid 30036] [client 85.203.21.81:50287] [client 85.203.21.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-conflg.php"] [unique_id "aWCJNEz3igHGwX5f7IqQ6AAAAAw"]
[Fri Jan 09 12:51:00.800018 2026] [:error] [pid 44848:tid 44874] [client 85.203.21.72:34857] [client 85.203.21.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/chosen.php"] [unique_id "aWCJNKjajoTJAbEk87xY8wAAAFg"]
[Fri Jan 09 12:51:01.153405 2026] [:error] [pid 14801:tid 14817] [client 85.203.21.86:28505] [client 85.203.21.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/classwithtostring.php"] [unique_id "aWCJNd8UWXrz_OQYgF0cYgAAAk4"]
[Fri Jan 09 12:51:01.512803 2026] [:error] [pid 44848:tid 44869] [client 85.203.21.86:51309] [client 85.203.21.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/function/function.php"] [unique_id "aWCJNajajoTJAbEk87xY9AAAAFM"]
[Fri Jan 09 12:51:01.865757 2026] [:error] [pid 14739:tid 14742] [client 85.203.21.94:21217] [client 85.203.21.94] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "aWCJNV63M6_PkLt_IJIo8gAAAcE"]
[Fri Jan 09 12:51:02.218404 2026] [:error] [pid 14739:tid 14741] [client 85.203.21.132:42429] [client 85.203.21.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/"] [unique_id "aWCJNl63M6_PkLt_IJIo8wAAAcA"]
[Fri Jan 09 12:51:02.586883 2026] [:error] [pid 14770:tid 14793] [client 85.203.21.132:33625] [client 85.203.21.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/areak1.php"] [unique_id "aWCJNh5QbaVZ-6newJb2SgAAAhU"]
[Fri Jan 09 12:51:02.933993 2026] [:error] [pid 30021:tid 30082] [client 85.203.21.152:55217] [client 85.203.21.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/"] [unique_id "aWCJNg_M8aRtsTog5J9BAgAAAME"]
[Fri Jan 09 12:51:03.296947 2026] [:error] [pid 30021:tid 30088] [client 85.203.21.112:41437] [client 85.203.21.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ufbngowues/main.php"] [unique_id "aWCJNw_M8aRtsTog5J9BAwAAAMc"]
[Fri Jan 09 12:51:03.645855 2026] [:error] [pid 14872:tid 14874] [client 85.203.21.86:36399] [client 85.203.21.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/shell3.php"] [unique_id "aWCJN6IUELhgYLNp1sbqbQAAAsA"]
[Fri Jan 09 12:51:04.007286 2026] [:error] [pid 30019:tid 30047] [client 85.203.21.109:30457] [client 85.203.21.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/elementor/includes/template-singl-portfolio.php"] [unique_id "aWCJOEz3igHGwX5f7IqQ8QAAABc"]
[Fri Jan 09 12:51:04.362055 2026] [:error] [pid 14801:tid 14819] [client 85.203.21.152:50249] [client 85.203.21.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aWCJON8UWXrz_OQYgF0cZgAAAlA"]
[Fri Jan 09 12:51:04.713931 2026] [:error] [pid 1366:tid 1393] [client 85.203.21.71:31609] [client 85.203.21.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wp-conflg.php"] [unique_id "aWCJOBmasveKu8_ec1XemgAAAZg"]
[Fri Jan 09 12:51:10.072976 2026] [:error] [pid 14872:tid 14876] [client 85.203.21.147:30793] [client 85.203.21.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "aWCJPqIUELhgYLNp1sbqcgAAAsI"]
[Fri Jan 09 12:51:10.418270 2026] [:error] [pid 30021:tid 30093] [client 85.203.21.86:31219] [client 85.203.21.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/worksec.php"] [unique_id "aWCJPg_M8aRtsTog5J9BEwAAAMw"]
[Fri Jan 09 12:51:10.764825 2026] [:error] [pid 1366:tid 1387] [client 85.203.21.138:57837] [client 85.203.21.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aWCJPhmasveKu8_ec1XevgAAAZI"]
[Fri Jan 09 12:51:11.122054 2026] [:error] [pid 14770:tid 14786] [client 85.203.21.100:52531] [client 85.203.21.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aWCJPx5QbaVZ-6newJb2UAAAAg4"]
[Fri Jan 09 12:51:11.471411 2026] [:error] [pid 30019:tid 30044] [client 85.203.21.132:45261] [client 85.203.21.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-signin.php"] [unique_id "aWCJP0z3igHGwX5f7IqRAQAAABQ"]
[Fri Jan 09 12:51:11.818498 2026] [:error] [pid 30021:tid 30085] [client 85.203.21.109:52367] [client 85.203.21.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/library/"] [unique_id "aWCJPw_M8aRtsTog5J9BFAAAAMQ"]
[Fri Jan 09 12:51:12.173120 2026] [:error] [pid 30021:tid 30099] [client 85.203.21.96:63017] [client 85.203.21.96] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/admin-header.php"] [unique_id "aWCJQA_M8aRtsTog5J9BFQAAANI"]
[Fri Jan 09 12:51:12.526405 2026] [:error] [pid 14872:tid 14880] [client 85.203.21.135:40163] [client 85.203.21.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/about.php"] [unique_id "aWCJQKIUELhgYLNp1sbqdAAAAsY"]
[Fri Jan 09 12:51:12.885172 2026] [:error] [pid 30020:tid 30070] [client 85.203.21.88:28537] [client 85.203.21.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/"] [unique_id "aWCJQMrjc66qOisG6L2aZwAAAJA"]
[Fri Jan 09 12:51:13.240373 2026] [:error] [pid 44848:tid 44861] [client 85.203.21.137:30277] [client 85.203.21.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/222.php"] [unique_id "aWCJQajajoTJAbEk87xY_wAAAEs"]
[Fri Jan 09 12:51:13.597347 2026] [:error] [pid 1366:tid 1376] [client 85.203.21.131:59009] [client 85.203.21.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/s.php"] [unique_id "aWCJQRmasveKu8_ec1XexgAAAYc"]
[Fri Jan 09 12:51:13.951291 2026] [:error] [pid 44848:tid 44850] [client 85.203.21.109:22709] [client 85.203.21.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-conflg.php"] [unique_id "aWCJQajajoTJAbEk87xZAgAAAEA"]
[Fri Jan 09 12:51:14.309472 2026] [:error] [pid 44848:tid 44871] [client 85.203.21.150:30863] [client 85.203.21.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "aWCJQqjajoTJAbEk87xZBAAAAFU"]
[Fri Jan 09 12:51:14.654972 2026] [:error] [pid 1366:tid 1373] [client 85.203.21.147:58051] [client 85.203.21.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aWCJQhmasveKu8_ec1XeyAAAAYQ"]
[Fri Jan 09 12:51:14.999895 2026] [:error] [pid 14831:tid 14833] [client 85.203.21.75:52765] [client 85.203.21.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-terms/"] [unique_id "aWCJQvaKOMCmJcAyBm3s9QAAAoA"]
[Fri Jan 09 12:51:15.353190 2026] [:error] [pid 44848:tid 44853] [client 85.203.21.75:40847] [client 85.203.21.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/themes/"] [unique_id "aWCJQ6jajoTJAbEk87xZBwAAAEM"]
[Fri Jan 09 12:51:15.699769 2026] [:error] [pid 1366:tid 1371] [client 85.203.21.112:58293] [client 85.203.21.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/block-library/"] [unique_id "aWCJQxmasveKu8_ec1XezAAAAYM"]
[Fri Jan 09 12:51:21.049769 2026] [:error] [pid 30021:tid 30081] [client 85.203.21.110:48995] [client 85.203.21.110] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/"] [unique_id "aWCJSQ_M8aRtsTog5J9BHQAAAMA"]
[Fri Jan 09 12:51:21.397892 2026] [:error] [pid 14831:tid 14837] [client 85.203.21.95:20857] [client 85.203.21.95] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/packed.php"] [unique_id "aWCJSfaKOMCmJcAyBm3s_QAAAoQ"]
[Fri Jan 09 12:51:21.747964 2026] [:error] [pid 14739:tid 14764] [client 85.203.21.119:28115] [client 85.203.21.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/news-portal/error.php"] [unique_id "aWCJSV63M6_PkLt_IJIpAgAAAdc"]
[Fri Jan 09 12:51:22.099660 2026] [:error] [pid 30021:tid 30084] [client 85.203.21.71:64881] [client 85.203.21.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/404.php"] [unique_id "aWCJSg_M8aRtsTog5J9BHwAAAMM"]
[Fri Jan 09 12:51:22.444684 2026] [:error] [pid 14801:tid 14825] [client 85.203.21.118:30185] [client 85.203.21.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comment-content/"] [unique_id "aWCJSt8UWXrz_OQYgF0cdAAAAlY"]
[Fri Jan 09 12:51:22.797853 2026] [:error] [pid 1366:tid 1379] [client 85.203.21.153:41677] [client 85.203.21.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "aWCJShmasveKu8_ec1Xe0AAAAYo"]
[Fri Jan 09 12:51:23.150321 2026] [:error] [pid 30019:tid 30039] [client 85.203.21.71:24919] [client 85.203.21.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aWCJS0z3igHGwX5f7IqRBAAAAA8"]
[Fri Jan 09 12:51:23.506777 2026] [:error] [pid 14872:tid 14879] [client 85.203.21.139:48719] [client 85.203.21.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aWCJS6IUELhgYLNp1sbqfgAAAsU"]
[Fri Jan 09 12:51:23.859733 2026] [:error] [pid 30019:tid 30025] [client 85.203.21.139:27459] [client 85.203.21.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/"] [unique_id "aWCJS0z3igHGwX5f7IqRBgAAAAE"]
[Fri Jan 09 12:51:24.209856 2026] [:error] [pid 14831:tid 14857] [client 85.203.21.143:61587] [client 85.203.21.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/"] [unique_id "aWCJTPaKOMCmJcAyBm3s_wAAApg"]
[Fri Jan 09 12:51:24.562492 2026] [:error] [pid 14801:tid 14827] [client 85.203.21.97:23933] [client 85.203.21.97] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aWCJTN8UWXrz_OQYgF0ceQAAAlg"]
[Fri Jan 09 12:51:24.925784 2026] [:error] [pid 14872:tid 14880] [client 85.203.21.87:45889] [client 85.203.21.87] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/"] [unique_id "aWCJTKIUELhgYLNp1sbqfwAAAsY"]
[Fri Jan 09 12:51:25.272620 2026] [:error] [pid 30021:tid 30083] [client 85.203.21.93:62227] [client 85.203.21.93] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aWCJTQ_M8aRtsTog5J9BIgAAAMI"]
[Fri Jan 09 12:51:25.620348 2026] [:error] [pid 14872:tid 14894] [client 85.203.21.93:59735] [client 85.203.21.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "aWCJTaIUELhgYLNp1sbqgQAAAtQ"]
[Fri Jan 09 12:51:25.969164 2026] [:error] [pid 14831:tid 14839] [client 85.203.21.70:30489] [client 85.203.21.70] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aWCJTfaKOMCmJcAyBm3tAQAAAoY"]
[Fri Jan 09 12:51:26.320102 2026] [:error] [pid 14872:tid 14897] [client 85.203.21.143:60147] [client 85.203.21.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/search/"] [unique_id "aWCJTqIUELhgYLNp1sbqggAAAtc"]
[Fri Jan 09 12:51:26.682434 2026] [:error] [pid 14872:tid 14878] [client 85.203.21.70:25727] [client 85.203.21.70] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/"] [unique_id "aWCJTqIUELhgYLNp1sbqhAAAAsQ"]
[Fri Jan 09 12:51:27.035895 2026] [:error] [pid 14739:tid 14757] [client 85.203.21.109:36557] [client 85.203.21.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/Iitespeed-cache/157.php"] [unique_id "aWCJT163M6_PkLt_IJIpBwAAAdA"]
[Fri Jan 09 12:51:27.383313 2026] [:error] [pid 14801:tid 14810] [client 85.203.21.114:57883] [client 85.203.21.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/"] [unique_id "aWCJT98UWXrz_OQYgF0cfgAAAkc"]
[Fri Jan 09 12:51:27.736506 2026] [:error] [pid 14801:tid 14803] [client 85.203.21.87:26185] [client 85.203.21.87] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/"] [unique_id "aWCJT98UWXrz_OQYgF0cfwAAAkA"]
[Fri Jan 09 12:51:28.106562 2026] [:error] [pid 14739:tid 14755] [client 85.203.21.103:52809] [client 85.203.21.103] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2024/"] [unique_id "aWCJUF63M6_PkLt_IJIpCAAAAc4"]
[Fri Jan 09 12:51:28.476606 2026] [:error] [pid 14872:tid 14876] [client 85.203.21.139:42153] [client 85.203.21.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/"] [unique_id "aWCJUKIUELhgYLNp1sbqiAAAAsI"]
[Fri Jan 09 12:51:28.823677 2026] [:error] [pid 1366:tid 1368] [client 85.203.21.152:64645] [client 85.203.21.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/cgi-bin/"] [unique_id "aWCJUBmasveKu8_ec1Xe2AAAAYA"]
[Fri Jan 09 12:51:34.181003 2026] [:error] [pid 1366:tid 1373] [client 85.203.21.100:51419] [client 85.203.21.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/theme-check/main.php"] [unique_id "aWCJVhmasveKu8_ec1Xe4wAAAYQ"]
[Fri Jan 09 12:51:34.526891 2026] [:error] [pid 30020:tid 30059] [client 85.203.21.112:42985] [client 85.203.21.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aWCJVsrjc66qOisG6L2abgAAAIU"]
[Fri Jan 09 12:51:34.879862 2026] [:error] [pid 1366:tid 1381] [client 85.203.21.137:41645] [client 85.203.21.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/chosen.php"] [unique_id "aWCJVhmasveKu8_ec1Xe5QAAAYw"]
[Fri Jan 09 12:51:35.225363 2026] [:error] [pid 30020:tid 30075] [client 85.203.21.71:61643] [client 85.203.21.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/archives/"] [unique_id "aWCJV8rjc66qOisG6L2abwAAAJU"]
[Fri Jan 09 12:51:35.573151 2026] [:error] [pid 1366:tid 1386] [client 85.203.21.88:58257] [client 85.203.21.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/nextpage/"] [unique_id "aWCJVxmasveKu8_ec1Xe5gAAAZE"]
[Fri Jan 09 12:51:35.926406 2026] [:error] [pid 30019:tid 30044] [client 85.203.21.111:37351] [client 85.203.21.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/"] [unique_id "aWCJV0z3igHGwX5f7IqREQAAABQ"]
[Fri Jan 09 12:51:36.275690 2026] [:error] [pid 30020:tid 30057] [client 85.203.21.74:41903] [client 85.203.21.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/column/"] [unique_id "aWCJWMrjc66qOisG6L2adAAAAIM"]
[Fri Jan 09 12:51:36.623847 2026] [:error] [pid 30019:tid 30036] [client 85.203.21.100:52411] [client 85.203.21.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/calendar/"] [unique_id "aWCJWEz3igHGwX5f7IqREgAAAAw"]
[Fri Jan 09 12:51:36.979450 2026] [:error] [pid 14872:tid 14891] [client 85.203.21.139:50095] [client 85.203.21.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/"] [unique_id "aWCJWKIUELhgYLNp1sbqiwAAAtE"]
[Fri Jan 09 12:51:37.329898 2026] [:error] [pid 30021:tid 30083] [client 85.203.21.100:63565] [client 85.203.21.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "aWCJWQ_M8aRtsTog5J9BKwAAAMI"]
[Fri Jan 09 12:51:37.681847 2026] [:error] [pid 30019:tid 30029] [client 85.203.21.100:46413] [client 85.203.21.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "aWCJWUz3igHGwX5f7IqREwAAAAU"]
[Fri Jan 09 12:51:38.029523 2026] [:error] [pid 1366:tid 1378] [client 85.203.21.96:36517] [client 85.203.21.96] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWCJWhmasveKu8_ec1Xe6AAAAYk"]
[Fri Jan 09 12:51:38.448113 2026] [:error] [pid 44848:tid 44871] [client 85.203.21.94:59175] [client 85.203.21.94] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "aWCJWqjajoTJAbEk87xZGgAAAFU"]
[Fri Jan 09 12:51:38.847344 2026] [:error] [pid 30019:tid 30033] [client 85.203.21.152:53989] [client 85.203.21.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "aWCJWkz3igHGwX5f7IqRFAAAAAk"]
[Fri Jan 09 12:51:39.197386 2026] [:error] [pid 14801:tid 14805] [client 85.203.21.143:34849] [client 85.203.21.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/block-directory/"] [unique_id "aWCJW98UWXrz_OQYgF0chAAAAkI"]
[Fri Jan 09 12:51:39.561588 2026] [:error] [pid 30020:tid 30070] [client 85.203.21.147:23177] [client 85.203.21.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/"] [unique_id "aWCJW8rjc66qOisG6L2adgAAAJA"]
[Fri Jan 09 12:51:39.914215 2026] [:error] [pid 1366:tid 1382] [client 85.203.21.98:35097] [client 85.203.21.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/phpad/as.php"] [unique_id "aWCJWxmasveKu8_ec1Xe6gAAAY0"]
[Fri Jan 09 12:51:40.262734 2026] [:error] [pid 44848:tid 44862] [client 85.203.21.79:50993] [client 85.203.21.79] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/wp-conflg.php"] [unique_id "aWCJXKjajoTJAbEk87xZHgAAAEw"]
[Fri Jan 09 12:51:40.617601 2026] [:error] [pid 1366:tid 1391] [client 85.203.21.74:34353] [client 85.203.21.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content.php"] [unique_id "aWCJXBmasveKu8_ec1Xe6wAAAZY"]
[Fri Jan 09 12:51:45.972640 2026] [:error] [pid 30021:tid 30096] [client 85.203.21.99:47453] [client 85.203.21.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aWCJYQ_M8aRtsTog5J9BMwAAAM8"]
[Fri Jan 09 12:51:46.320918 2026] [:error] [pid 14801:tid 14805] [client 85.203.21.131:59773] [client 85.203.21.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/classwithtostring.php"] [unique_id "aWCJYt8UWXrz_OQYgF0cjgAAAkI"]
[Fri Jan 09 12:51:46.670206 2026] [:error] [pid 14739:tid 14756] [client 85.203.21.74:64175] [client 85.203.21.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/lib/"] [unique_id "aWCJYl63M6_PkLt_IJIpFAAAAc8"]
[Fri Jan 09 12:51:47.024783 2026] [:error] [pid 14770:tid 14792] [client 85.203.21.112:46703] [client 85.203.21.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-file.php"] [unique_id "aWCJYx5QbaVZ-6newJb2XwAAAhQ"]
[Fri Jan 09 12:51:47.371725 2026] [:error] [pid 14872:tid 14897] [client 85.203.21.97:64717] [client 85.203.21.97] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/"] [unique_id "aWCJY6IUELhgYLNp1sbqkwAAAtc"]
[Fri Jan 09 12:51:47.724922 2026] [:error] [pid 14872:tid 14878] [client 85.203.21.123:21291] [client 85.203.21.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "aWCJY6IUELhgYLNp1sbqlAAAAsQ"]
[Fri Jan 09 12:51:48.079946 2026] [:error] [pid 14739:tid 14753] [client 85.203.21.143:53663] [client 85.203.21.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aWCJZF63M6_PkLt_IJIpFgAAAcw"]
[Fri Jan 09 12:51:48.432689 2026] [:error] [pid 14739:tid 14760] [client 85.203.21.138:50905] [client 85.203.21.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/chosen.php"] [unique_id "aWCJZF63M6_PkLt_IJIpGAAAAdM"]
[Fri Jan 09 12:51:48.780473 2026] [:error] [pid 14770:tid 14785] [client 85.203.21.137:61475] [client 85.203.21.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/covr-wpcom/assets/fonts/manrope_normal.php"] [unique_id "aWCJZB5QbaVZ-6newJb2YgAAAg0"]
[Fri Jan 09 12:51:49.133627 2026] [:error] [pid 1366:tid 1393] [client 85.203.21.76:23131] [client 85.203.21.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/"] [unique_id "aWCJZRmasveKu8_ec1Xe-AAAAZg"]
[Fri Jan 09 12:51:49.489256 2026] [:error] [pid 14831:tid 14833] [client 85.203.21.88:33969] [client 85.203.21.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/"] [unique_id "aWCJZfaKOMCmJcAyBm3tDAAAAoA"]
[Fri Jan 09 12:51:49.839005 2026] [:error] [pid 14872:tid 14877] [client 85.203.21.133:53037] [client 85.203.21.133] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-domain.php"] [unique_id "aWCJZaIUELhgYLNp1sbqmwAAAsM"]
[Fri Jan 09 12:51:50.193910 2026] [:error] [pid 30019:tid 30048] [client 85.203.21.141:36363] [client 85.203.21.141] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-wolf.php"] [unique_id "aWCJZkz3igHGwX5f7IqRJwAAABg"]
[Fri Jan 09 12:51:50.551893 2026] [:error] [pid 14872:tid 14892] [client 85.203.21.99:41819] [client 85.203.21.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/autoload_classmap.php"] [unique_id "aWCJZqIUELhgYLNp1sbqnAAAAtI"]
[Fri Jan 09 12:51:50.900195 2026] [:error] [pid 14872:tid 14882] [client 85.203.21.87:49721] [client 85.203.21.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aWCJZqIUELhgYLNp1sbqnQAAAsg"]
[Fri Jan 09 12:51:51.252659 2026] [:error] [pid 14831:tid 14854] [client 85.203.21.115:33625] [client 85.203.21.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aWCJZ_aKOMCmJcAyBm3tJwAAApU"]
[Fri Jan 09 12:51:51.599215 2026] [:error] [pid 1366:tid 1392] [client 85.203.21.137:24391] [client 85.203.21.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfive/styles/typography/"] [unique_id "aWCJZxmasveKu8_ec1XfFAAAAZc"]
[Fri Jan 09 12:51:51.945935 2026] [:error] [pid 30019:tid 30032] [client 85.203.21.137:64499] [client 85.203.21.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/imgareaselect/"] [unique_id "aWCJZ0z3igHGwX5f7IqRNwAAAAg"]
[Fri Jan 09 12:51:52.295027 2026] [:error] [pid 1366:tid 1373] [client 85.203.21.97:45259] [client 85.203.21.97] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wpforms/"] [unique_id "aWCJaBmasveKu8_ec1XfGAAAAYQ"]
[Fri Jan 09 12:51:52.649421 2026] [:error] [pid 1366:tid 1391] [client 85.203.21.138:33925] [client 85.203.21.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/twenty/function.php"] [unique_id "aWCJaBmasveKu8_ec1XfGwAAAZY"]
[Fri Jan 09 12:51:53.006483 2026] [:error] [pid 1366:tid 1382] [client 85.203.21.99:38287] [client 85.203.21.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aWCJaRmasveKu8_ec1XfHAAAAY0"]
[Fri Jan 09 12:51:53.354833 2026] [:error] [pid 1366:tid 1379] [client 85.203.21.133:44807] [client 85.203.21.133] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/cache/et/"] [unique_id "aWCJaRmasveKu8_ec1XfHgAAAYo"]
[Fri Jan 09 12:51:53.707834 2026] [:error] [pid 1366:tid 1388] [client 85.203.21.147:60499] [client 85.203.21.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwenty/assets/fonts/inter/"] [unique_id "aWCJaRmasveKu8_ec1XfIAAAAZM"]
[Fri Jan 09 12:51:54.055989 2026] [:error] [pid 1366:tid 1369] [client 85.203.21.103:26115] [client 85.203.21.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/wp-conflg.php"] [unique_id "aWCJahmasveKu8_ec1XfIwAAAYE"]
[Fri Jan 09 12:51:54.403039 2026] [:error] [pid 14801:tid 14819] [client 85.203.21.111:60695] [client 85.203.21.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aWCJat8UWXrz_OQYgF0cmAAAAlA"]
[Fri Jan 09 12:51:54.756769 2026] [:error] [pid 44848:tid 44856] [client 85.203.21.109:20735] [client 85.203.21.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/chosen.php"] [unique_id "aWCJaqjajoTJAbEk87xZJQAAAEY"]
[Fri Jan 09 12:51:55.105513 2026] [:error] [pid 14801:tid 14825] [client 85.203.21.123:52883] [client 85.203.21.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "aWCJa98UWXrz_OQYgF0cmgAAAlY"]
[Fri Jan 09 12:51:55.462371 2026] [:error] [pid 30021:tid 30086] [client 85.203.21.74:50365] [client 85.203.21.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/z.php"] [unique_id "aWCJaw_M8aRtsTog5J9BTwAAAMU"]
[Fri Jan 09 12:51:55.818193 2026] [:error] [pid 14770:tid 14777] [client 85.203.21.132:64357] [client 85.203.21.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aWCJax5QbaVZ-6newJb2agAAAgU"]
[Fri Jan 09 12:51:56.171126 2026] [:error] [pid 30021:tid 30094] [client 85.203.21.96:60997] [client 85.203.21.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/chosen.php"] [unique_id "aWCJbA_M8aRtsTog5J9BUwAAAM0"]
[Fri Jan 09 12:51:56.529483 2026] [:error] [pid 30020:tid 30065] [client 85.203.21.95:33853] [client 85.203.21.95] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/"] [unique_id "aWCJbMrjc66qOisG6L2aewAAAIs"]
[Fri Jan 09 12:51:56.883278 2026] [:error] [pid 30020:tid 30070] [client 85.203.21.112:62391] [client 85.203.21.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hello.php"] [unique_id "aWCJbMrjc66qOisG6L2afAAAAJA"]
[Fri Jan 09 12:51:57.237423 2026] [:error] [pid 14831:tid 14847] [client 85.203.21.71:47217] [client 85.203.21.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/"] [unique_id "aWCJbfaKOMCmJcAyBm3tMwAAAo4"]
[Fri Jan 09 12:51:57.585755 2026] [:error] [pid 14872:tid 14880] [client 85.203.21.107:28803] [client 85.203.21.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/chosen.php"] [unique_id "aWCJbaIUELhgYLNp1sbqpQAAAsY"]
[Fri Jan 09 12:51:57.936274 2026] [:error] [pid 14739:tid 14761] [client 85.203.21.93:25589] [client 85.203.21.93] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/mediaelement/"] [unique_id "aWCJbV63M6_PkLt_IJIpQAAAAdQ"]
[Fri Jan 09 12:51:58.289166 2026] [:error] [pid 1366:tid 1378] [client 85.203.21.110:49381] [client 85.203.21.110] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "aWCJbhmasveKu8_ec1XfMwAAAYk"]
[Fri Jan 09 12:51:58.644545 2026] [:error] [pid 44848:tid 44861] [client 85.203.21.100:40167] [client 85.203.21.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/m.php"] [unique_id "aWCJbqjajoTJAbEk87xZMAAAAEs"]
[Fri Jan 09 12:51:58.997372 2026] [:error] [pid 30019:tid 30048] [client 85.203.21.86:63001] [client 85.203.21.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/img/fm.php"] [unique_id "aWCJbkz3igHGwX5f7IqRPAAAABg"]
[Fri Jan 09 12:51:59.352679 2026] [:error] [pid 30021:tid 30093] [client 85.203.21.95:60007] [client 85.203.21.95] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comments-title/"] [unique_id "aWCJbw_M8aRtsTog5J9BVwAAAMw"]
[Fri Jan 09 12:51:59.708699 2026] [:error] [pid 14739:tid 14742] [client 85.203.21.111:64857] [client 85.203.21.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/"] [unique_id "aWCJb163M6_PkLt_IJIpQwAAAcE"]
[Fri Jan 09 12:52:00.063989 2026] [:error] [pid 14831:tid 14846] [client 85.203.21.81:36261] [client 85.203.21.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aWCJcPaKOMCmJcAyBm3tNQAAAo0"]
[Fri Jan 09 12:52:00.419153 2026] [:error] [pid 14739:tid 14764] [client 85.203.21.93:30039] [client 85.203.21.93] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/chosen.php"] [unique_id "aWCJcF63M6_PkLt_IJIpRwAAAdc"]
[Fri Jan 09 12:52:00.769932 2026] [:error] [pid 14872:tid 14894] [client 85.203.21.101:45977] [client 85.203.21.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aWCJcKIUELhgYLNp1sbqqAAAAtQ"]
[Fri Jan 09 12:52:01.120839 2026] [:error] [pid 30019:tid 30044] [client 85.203.21.92:53425] [client 85.203.21.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/chosen.php"] [unique_id "aWCJcUz3igHGwX5f7IqRQQAAABQ"]
[Fri Jan 09 12:52:01.475049 2026] [:error] [pid 14770:tid 14774] [client 85.203.21.96:58765] [client 85.203.21.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/wp-conflg.php"] [unique_id "aWCJcR5QbaVZ-6newJb2dQAAAgI"]
[Fri Jan 09 12:52:01.967186 2026] [:error] [pid 30020:tid 30056] [client 85.203.21.101:29563] [client 85.203.21.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/wp-conflg.php"] [unique_id "aWCJccrjc66qOisG6L2agQAAAII"]
[Fri Jan 09 12:52:02.328407 2026] [:error] [pid 14831:tid 14849] [client 85.203.21.114:29031] [client 85.203.21.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/php-compat/chosen.php"] [unique_id "aWCJcvaKOMCmJcAyBm3tOAAAApA"]
[Fri Jan 09 12:52:02.684797 2026] [:error] [pid 30019:tid 30033] [client 85.203.21.97:35763] [client 85.203.21.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aWCJckz3igHGwX5f7IqRQwAAAAk"]
[Fri Jan 09 12:52:03.054194 2026] [:error] [pid 14831:tid 14836] [client 85.203.21.105:56065] [client 85.203.21.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aWCJc_aKOMCmJcAyBm3tOwAAAoM"]
[Fri Jan 09 12:52:03.410320 2026] [:error] [pid 1366:tid 1388] [client 85.203.21.114:27919] [client 85.203.21.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfive/patterns/template-singl-portfolio.php"] [unique_id "aWCJcxmasveKu8_ec1XfOQAAAZM"]
[Fri Jan 09 12:52:03.766942 2026] [:error] [pid 14831:tid 14851] [client 85.203.21.79:60621] [client 85.203.21.79] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/"] [unique_id "aWCJc_aKOMCmJcAyBm3tPQAAApI"]
[Fri Jan 09 12:52:04.113317 2026] [:error] [pid 30019:tid 30046] [client 85.203.21.101:38197] [client 85.203.21.101] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/database.php"] [unique_id "aWCJdEz3igHGwX5f7IqRTAAAABY"]
[Fri Jan 09 12:52:04.462390 2026] [:error] [pid 30019:tid 30039] [client 85.203.21.81:29963] [client 85.203.21.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/vudel/list.php"] [unique_id "aWCJdEz3igHGwX5f7IqRTgAAAA8"]
[Fri Jan 09 12:52:04.820195 2026] [:error] [pid 14872:tid 14879] [client 85.203.21.93:28515] [client 85.203.21.93] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/filester/assets/css/404.php"] [unique_id "aWCJdKIUELhgYLNp1sbqqgAAAsU"]
[Fri Jan 09 12:52:05.165515 2026] [:error] [pid 14801:tid 14804] [client 85.203.21.99:21483] [client 85.203.21.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/hello-elementor/assets/css/lightbox.php"] [unique_id "aWCJdd8UWXrz_OQYgF0cpgAAAkE"]
[Fri Jan 09 12:52:05.521423 2026] [:error] [pid 1366:tid 1377] [client 85.203.21.132:42763] [client 85.203.21.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/advanced-custom-fields/includes/walkers/about.php"] [unique_id "aWCJdRmasveKu8_ec1XfPAAAAYg"]
[Fri Jan 09 12:52:05.874047 2026] [:error] [pid 14872:tid 14876] [client 85.203.21.137:40171] [client 85.203.21.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/elementor/includes/controls/about.php"] [unique_id "aWCJdaIUELhgYLNp1sbqqwAAAsI"]
[Fri Jan 09 12:52:06.228156 2026] [:error] [pid 14872:tid 14884] [client 85.203.21.132:52703] [client 85.203.21.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/autoload_classmap.php"] [unique_id "aWCJdqIUELhgYLNp1sbqrQAAAso"]
[Fri Jan 09 12:52:06.582970 2026] [:error] [pid 30019:tid 30038] [client 85.203.21.103:28667] [client 85.203.21.103] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/well-known/acme-challenge/c/e/about.php"] [unique_id "aWCJdkz3igHGwX5f7IqRTwAAAA4"]
[Fri Jan 09 12:52:06.936958 2026] [:error] [pid 30019:tid 30034] [client 85.203.21.133:29521] [client 85.203.21.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/chosen.php"] [unique_id "aWCJdkz3igHGwX5f7IqRUAAAAAo"]
[Fri Jan 09 12:52:07.292044 2026] [:error] [pid 30020:tid 30065] [client 85.203.21.115:35625] [client 85.203.21.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/vendor/about.php"] [unique_id "aWCJd8rjc66qOisG6L2ahgAAAIs"]
[Fri Jan 09 12:52:07.640859 2026] [:error] [pid 14872:tid 14878] [client 85.203.21.88:33767] [client 85.203.21.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aWCJd6IUELhgYLNp1sbqtQAAAsQ"]
[Fri Jan 09 12:52:07.991682 2026] [:error] [pid 14739:tid 14759] [client 85.203.21.86:44033] [client 85.203.21.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/library/SimplePie/Content/Type/222.php"] [unique_id "aWCJd163M6_PkLt_IJIpSwAAAdI"]
[Fri Jan 09 12:52:08.345624 2026] [:error] [pid 14801:tid 14816] [client 85.203.21.123:60563] [client 85.203.21.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/man.php"] [unique_id "aWCJeN8UWXrz_OQYgF0crgAAAk0"]
[Fri Jan 09 12:52:08.698981 2026] [:error] [pid 14801:tid 14825] [client 85.203.21.116:20411] [client 85.203.21.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/zoom1.php"] [unique_id "aWCJeN8UWXrz_OQYgF0csAAAAlY"]
[Fri Jan 09 12:52:09.060837 2026] [:error] [pid 14872:tid 14881] [client 85.203.21.79:38997] [client 85.203.21.79] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/inc/compatibility/lifterlms/customizer/sections/"] [unique_id "aWCJeaIUELhgYLNp1sbquQAAAsc"]
[Fri Jan 09 12:52:09.418470 2026] [:error] [pid 14872:tid 14884] [client 85.203.21.153:34469] [client 85.203.21.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/inc/customizer/custom-controls/assets/js/unminified/"] [unique_id "aWCJeaIUELhgYLNp1sbqugAAAso"]
[Fri Jan 09 12:52:09.772680 2026] [:error] [pid 30021:tid 30101] [client 85.203.21.131:39155] [client 85.203.21.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/inc/customizer/custom-controls/assets/css/minified/"] [unique_id "aWCJeQ_M8aRtsTog5J9BYAAAANQ"]
[Fri Jan 09 12:52:10.120626 2026] [:error] [pid 1366:tid 1388] [client 85.203.21.98:26425] [client 85.203.21.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/assets/js/"] [unique_id "aWCJehmasveKu8_ec1XfQgAAAZM"]
[Fri Jan 09 12:52:10.508803 2026] [:error] [pid 14801:tid 14815] [client 85.203.21.86:39797] [client 85.203.21.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/astra-addon/"] [unique_id "aWCJet8UWXrz_OQYgF0ctAAAAkw"]
[Fri Jan 09 12:52:10.857871 2026] [:error] [pid 44848:tid 44862] [client 85.203.21.109:58243] [client 85.203.21.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/wp-mails.php"] [unique_id "aWCJeqjajoTJAbEk87xZOQAAAEw"]
[Fri Jan 09 12:52:11.211916 2026] [:error] [pid 14831:tid 14833] [client 85.203.21.76:42895] [client 85.203.21.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/new.php"] [unique_id "aWCJe_aKOMCmJcAyBm3tPwAAAoA"]
[Fri Jan 09 12:52:11.560759 2026] [:error] [pid 14739:tid 14755] [client 85.203.21.111:40657] [client 85.203.21.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/group/"] [unique_id "aWCJe163M6_PkLt_IJIpTwAAAc4"]
[Fri Jan 09 12:52:11.909107 2026] [:error] [pid 44848:tid 44873] [client 85.203.21.114:23343] [client 85.203.21.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/plugins/js/crd/admin.php"] [unique_id "aWCJe6jajoTJAbEk87xZOgAAAFc"]
[Fri Jan 09 12:52:12.261970 2026] [:error] [pid 14770:tid 14776] [client 85.203.21.94:32021] [client 85.203.21.94] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfour/uploads/isc/"] [unique_id "aWCJfB5QbaVZ-6newJb2egAAAgQ"]
[Fri Jan 09 12:52:12.609291 2026] [:error] [pid 30021:tid 30089] [client 85.203.21.114:35721] [client 85.203.21.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/thickbox/img/docs/includes/data/tmp/klo/aawl/"] [unique_id "aWCJfA_M8aRtsTog5J9BZgAAAMg"]
[Fri Jan 09 12:52:12.961449 2026] [:error] [pid 44848:tid 44860] [client 85.203.21.76:59387] [client 85.203.21.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-pridmag/load.php"] [unique_id "aWCJfKjajoTJAbEk87xZPQAAAEo"]
[Fri Jan 09 12:52:13.316395 2026] [:error] [pid 14831:tid 14836] [client 85.203.21.86:40279] [client 85.203.21.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/"] [unique_id "aWCJffaKOMCmJcAyBm3tQgAAAoM"]
[Fri Jan 09 12:52:13.678143 2026] [:error] [pid 14831:tid 14854] [client 85.203.21.143:33305] [client 85.203.21.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/social-links/"] [unique_id "aWCJffaKOMCmJcAyBm3tRQAAApU"]
[Fri Jan 09 12:52:14.027622 2026] [:error] [pid 14831:tid 14840] [client 85.203.21.114:60773] [client 85.203.21.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/pullquote/"] [unique_id "aWCJfvaKOMCmJcAyBm3tRwAAAoc"]
[Fri Jan 09 12:52:14.381025 2026] [:error] [pid 14770:tid 14796] [client 85.203.21.74:38385] [client 85.203.21.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/list/"] [unique_id "aWCJfh5QbaVZ-6newJb2ewAAAhg"]
[Fri Jan 09 12:52:14.737941 2026] [:error] [pid 14801:tid 14817] [client 85.203.21.75:45405] [client 85.203.21.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/tag-cloud/"] [unique_id "aWCJft8UWXrz_OQYgF0cvgAAAk4"]
[Fri Jan 09 12:52:15.095242 2026] [:error] [pid 30019:tid 30026] [client 85.203.21.137:24877] [client 85.203.21.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/audio/go.php"] [unique_id "aWCJf0z3igHGwX5f7IqRUwAAAAI"]
[Fri Jan 09 12:52:15.448711 2026] [:error] [pid 14739:tid 14756] [client 85.203.21.96:52035] [client 85.203.21.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/imagess.php"] [unique_id "aWCJf163M6_PkLt_IJIpVQAAAc8"]
[Fri Jan 09 12:52:15.797944 2026] [:error] [pid 44848:tid 44865] [client 85.203.21.131:32067] [client 85.203.21.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/imagess.php"] [unique_id "aWCJf6jajoTJAbEk87xZQgAAAE8"]
[Fri Jan 09 12:52:16.146532 2026] [:error] [pid 30021:tid 30103] [client 85.203.21.97:35269] [client 85.203.21.97] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/let.php"] [unique_id "aWCJgA_M8aRtsTog5J9BZwAAANY"]
[Fri Jan 09 12:52:16.502334 2026] [:error] [pid 30021:tid 30090] [client 85.203.21.119:44269] [client 85.203.21.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/go.php"] [unique_id "aWCJgA_M8aRtsTog5J9BaQAAAMk"]
[Fri Jan 09 12:52:16.849633 2026] [:error] [pid 14831:tid 14845] [client 85.203.21.135:38579] [client 85.203.21.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/huan.php"] [unique_id "aWCJgPaKOMCmJcAyBm3tTgAAAow"]
[Fri Jan 09 12:52:17.195778 2026] [:error] [pid 30019:tid 30047] [client 85.203.21.141:41853] [client 85.203.21.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aWCJgUz3igHGwX5f7IqRVgAAABc"]
[Fri Jan 09 12:52:17.549855 2026] [:error] [pid 1366:tid 1388] [client 85.203.21.132:32641] [client 85.203.21.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/chosen.php"] [unique_id "aWCJgRmasveKu8_ec1XfTgAAAZM"]
[Fri Jan 09 12:52:17.897434 2026] [:error] [pid 44848:tid 44856] [client 85.203.21.119:60369] [client 85.203.21.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/autoload_classmap.php"] [unique_id "aWCJgajajoTJAbEk87xZSAAAAEY"]
[Fri Jan 09 12:52:18.251888 2026] [:error] [pid 30019:tid 30038] [client 85.203.21.100:46315] [client 85.203.21.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aWCJgkz3igHGwX5f7IqRWAAAAA4"]
[Fri Jan 09 12:52:18.604515 2026] [:error] [pid 30019:tid 30044] [client 85.203.21.107:53249] [client 85.203.21.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/loarrfh/"] [unique_id "aWCJgkz3igHGwX5f7IqRWQAAABQ"]
[Fri Jan 09 12:52:18.959125 2026] [:error] [pid 30019:tid 30033] [client 85.203.21.86:38367] [client 85.203.21.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/foogallery/foogallery.php"] [unique_id "aWCJgkz3igHGwX5f7IqRWgAAAAk"]
[Fri Jan 09 12:52:19.307619 2026] [:error] [pid 14739:tid 14749] [client 85.203.21.114:28639] [client 85.203.21.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/404-solution/404-solution.php"] [unique_id "aWCJg163M6_PkLt_IJIpVgAAAcg"]
[Fri Jan 09 12:52:19.657635 2026] [:error] [pid 14801:tid 14815] [client 85.203.21.152:33873] [client 85.203.21.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/duplicator/src/moon.php"] [unique_id "aWCJg98UWXrz_OQYgF0cwgAAAkw"]
[Fri Jan 09 12:52:20.012946 2026] [:error] [pid 44848:tid 44855] [client 85.203.21.115:22137] [client 85.203.21.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin-menu-search/admin-menu-search.php"] [unique_id "aWCJhKjajoTJAbEk87xZTQAAAEU"]
[Fri Jan 09 12:52:20.361503 2026] [:error] [pid 14739:tid 14754] [client 85.203.21.70:65185] [client 85.203.21.70] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin-site-enhancements/admin-site-enhancements.php"] [unique_id "aWCJhF63M6_PkLt_IJIpWAAAAc0"]
[Fri Jan 09 12:52:20.709445 2026] [:error] [pid 30021:tid 30092] [client 85.203.21.76:41435] [client 85.203.21.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/members/members.php"] [unique_id "aWCJhA_M8aRtsTog5J9BbQAAAMs"]
[Fri Jan 09 12:52:21.057506 2026] [:error] [pid 14739:tid 14750] [client 85.203.21.111:37521] [client 85.203.21.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/performance-lab/load.php"] [unique_id "aWCJhV63M6_PkLt_IJIpWQAAAck"]
[Fri Jan 09 12:52:21.413139 2026] [:error] [pid 14872:tid 14874] [client 85.203.21.71:54441] [client 85.203.21.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/performance-lab/includes/admin/tags.php"] [unique_id "aWCJhaIUELhgYLNp1sbqxQAAAsA"]
[Fri Jan 09 12:52:21.767174 2026] [:error] [pid 14831:tid 14834] [client 85.203.21.87:28371] [client 85.203.21.87] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/tinymce-advanced/tinymce-advanced.php"] [unique_id "aWCJhfaKOMCmJcAyBm3tUwAAAoE"]
[Fri Jan 09 12:52:27.111901 2026] [:error] [pid 14739:tid 14761] [client 85.203.21.147:35905] [client 85.203.21.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/covr-wpcom/assets/fonts/manrope.php"] [unique_id "aWCJi163M6_PkLt_IJIpYgAAAdQ"]
[Fri Jan 09 12:52:27.464354 2026] [:error] [pid 14872:tid 14877] [client 85.203.21.120:45571] [client 85.203.21.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/hello-elementor/new.php"] [unique_id "aWCJi6IUELhgYLNp1sbqzAAAAsM"]
[Fri Jan 09 12:52:27.818620 2026] [:error] [pid 1366:tid 1385] [client 85.203.21.79:60629] [client 85.203.21.79] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/theme-check/theme-check.php"] [unique_id "aWCJixmasveKu8_ec1XfYQAAAZA"]
[Fri Jan 09 12:52:28.173306 2026] [:error] [pid 44848:tid 44872] [client 85.203.21.95:56047] [client 85.203.21.95] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/advanced-llms-txt-generator/assets/css/css_json.php"] [unique_id "aWCJjKjajoTJAbEk87xZUgAAAFY"]
[Fri Jan 09 12:52:28.526622 2026] [:error] [pid 14801:tid 14808] [client 85.203.21.103:26337] [client 85.203.21.103] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/so-pinyin-slugs/inc/new.php"] [unique_id "aWCJjN8UWXrz_OQYgF0cxwAAAkU"]
[Fri Jan 09 12:52:28.879034 2026] [:error] [pid 1366:tid 1382] [client 85.203.21.70:27413] [client 85.203.21.70] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/Iitespeed-cache/zczv.php"] [unique_id "aWCJjBmasveKu8_ec1XfZAAAAY0"]
[Fri Jan 09 12:52:29.224429 2026] [:error] [pid 1366:tid 1368] [client 85.203.21.131:24835] [client 85.203.21.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/woocommerce_uploads/about.php"] [unique_id "aWCJjRmasveKu8_ec1XfZwAAAYA"]
[Fri Jan 09 12:52:31.041448 2026] [:error] [pid 44848:tid 44869] [client 85.203.21.114:26609] [client 85.203.21.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/carousel-slider/templates/loop/classwithtostring.php"] [unique_id "aWCJj6jajoTJAbEk87xZVQAAAFM"]
[Fri Jan 09 12:52:31.392372 2026] [:error] [pid 30020:tid 30072] [client 85.203.21.116:48881] [client 85.203.21.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/adca.php"] [unique_id "aWCJj8rjc66qOisG6L2algAAAJI"]
[Fri Jan 09 12:52:31.747598 2026] [:error] [pid 1366:tid 1377] [client 85.203.21.147:20943] [client 85.203.21.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/maintenance/bolt.php"] [unique_id "aWCJjxmasveKu8_ec1XfagAAAYg"]
[Fri Jan 09 12:52:32.102538 2026] [:error] [pid 30021:tid 30100] [client 85.203.21.138:30527] [client 85.203.21.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/html-api/about.php"] [unique_id "aWCJkA_M8aRtsTog5J9BdwAAANM"]
[Fri Jan 09 12:52:32.450545 2026] [:error] [pid 30021:tid 30103] [client 85.203.21.114:45503] [client 85.203.21.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/interactivity-api/"] [unique_id "aWCJkA_M8aRtsTog5J9BeAAAANY"]
[Fri Jan 09 12:52:32.798114 2026] [:error] [pid 14872:tid 14887] [client 85.203.21.112:56573] [client 85.203.21.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/siteorigin-panels/"] [unique_id "aWCJkKIUELhgYLNp1sbqzwAAAs0"]
[Fri Jan 09 12:52:33.147024 2026] [:error] [pid 44848:tid 44851] [client 85.203.21.75:28081] [client 85.203.21.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/nav-menu-trigger.php"] [unique_id "aWCJkajajoTJAbEk87xZVgAAAEE"]
[Fri Jan 09 12:52:33.494733 2026] [:error] [pid 1366:tid 1369] [client 85.203.21.119:34183] [client 85.203.21.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/link-template-firewall.php"] [unique_id "aWCJkRmasveKu8_ec1XfbQAAAYE"]
[Fri Jan 09 12:52:33.852159 2026] [:error] [pid 14831:tid 14853] [client 85.203.21.109:20625] [client 85.203.21.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/hello-elementor/assets/"] [unique_id "aWCJkfaKOMCmJcAyBm3tXQAAApQ"]
[Fri Jan 09 12:52:34.211498 2026] [:error] [pid 1366:tid 1386] [client 85.203.21.112:36365] [client 85.203.21.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-author/"] [unique_id "aWCJkhmasveKu8_ec1XfbgAAAZE"]
[Fri Jan 09 12:52:34.571264 2026] [:error] [pid 14831:tid 14847] [client 85.203.21.132:56809] [client 85.203.21.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/namespaced/Core/"] [unique_id "aWCJkvaKOMCmJcAyBm3tYAAAAo4"]
[Fri Jan 09 12:52:34.925811 2026] [:error] [pid 14739:tid 14744] [client 85.203.21.120:59763] [client 85.203.21.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aWCJkl63M6_PkLt_IJIpagAAAcM"]
[Fri Jan 09 12:52:35.283899 2026] [:error] [pid 30021:tid 30098] [client 85.203.21.112:40389] [client 85.203.21.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/lock.php"] [unique_id "aWCJkw_M8aRtsTog5J9BfQAAANE"]
[Fri Jan 09 12:52:35.642913 2026] [:error] [pid 44848:tid 44856] [client 85.203.21.130:31089] [client 85.203.21.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/components/style-rtl.min_42.php"] [unique_id "aWCJk6jajoTJAbEk87xZWAAAAEY"]
[Fri Jan 09 12:52:35.993357 2026] [:error] [pid 44848:tid 44862] [client 85.203.21.138:20687] [client 85.203.21.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/"] [unique_id "aWCJk6jajoTJAbEk87xZWQAAAEw"]
[Fri Jan 09 12:52:36.347586 2026] [:error] [pid 30021:tid 30095] [client 85.203.21.71:22589] [client 85.203.21.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Credit_74.php"] [unique_id "aWCJlA_M8aRtsTog5J9BfwAAAM4"]
[Fri Jan 09 12:52:36.695323 2026] [:error] [pid 30020:tid 30065] [client 85.203.21.116:32725] [client 85.203.21.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/akismet/_40.php"] [unique_id "aWCJlMrjc66qOisG6L2alwAAAIs"]
[Fri Jan 09 12:52:37.060010 2026] [:error] [pid 30019:tid 30036] [client 85.203.21.135:43007] [client 85.203.21.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/coffee/colors_26.php"] [unique_id "aWCJlUz3igHGwX5f7IqRdAAAAAw"]
[Fri Jan 09 12:52:37.407350 2026] [:error] [pid 14770:tid 14782] [client 85.203.21.131:58987] [client 85.203.21.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/wp-conflg.php"] [unique_id "aWCJlR5QbaVZ-6newJb2jQAAAgo"]
[Fri Jan 09 12:52:37.753984 2026] [:error] [pid 14801:tid 14815] [client 85.203.21.137:56663] [client 85.203.21.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/"] [unique_id "aWCJld8UWXrz_OQYgF0cyQAAAkw"]
[Fri Jan 09 12:52:38.104943 2026] [:error] [pid 1366:tid 1376] [client 85.203.21.153:29783] [client 85.203.21.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/autoload_classmap.php"] [unique_id "aWCJlhmasveKu8_ec1XfcQAAAYc"]
[Fri Jan 09 12:52:38.458347 2026] [:error] [pid 30019:tid 30044] [client 85.203.21.110:25507] [client 85.203.21.110] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/video/"] [unique_id "aWCJlkz3igHGwX5f7IqRdQAAABQ"]
[Fri Jan 09 12:52:38.812798 2026] [:error] [pid 14770:tid 14774] [client 85.203.21.98:51445] [client 85.203.21.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-widgets/"] [unique_id "aWCJlh5QbaVZ-6newJb2jgAAAgI"]
[Fri Jan 09 12:52:39.157956 2026] [:error] [pid 30021:tid 30082] [client 85.203.21.123:56105] [client 85.203.21.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/details/"] [unique_id "aWCJlw_M8aRtsTog5J9BhgAAAME"]
[Fri Jan 09 12:52:39.501884 2026] [:error] [pid 30021:tid 30093] [client 85.203.21.88:56981] [client 85.203.21.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/classwithtostring.php"] [unique_id "aWCJlw_M8aRtsTog5J9BhwAAAMw"]
[Fri Jan 09 12:52:39.858656 2026] [:error] [pid 1366:tid 1369] [client 85.203.21.143:31027] [client 85.203.21.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/theme-editor-class.php"] [unique_id "aWCJlxmasveKu8_ec1XfcgAAAYE"]
[Fri Jan 09 12:52:40.228270 2026] [:error] [pid 14739:tid 14750] [client 85.203.21.131:47165] [client 85.203.21.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/LayerSlider/assets/static/codemirror/addon/hint/about.php"] [unique_id "aWCJmF63M6_PkLt_IJIpcAAAAck"]
[Fri Jan 09 12:52:40.581561 2026] [:error] [pid 44848:tid 44872] [client 85.203.21.99:64079] [client 85.203.21.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/LayerSlider/assets/static/layerslider/skins/carousel/about.php"] [unique_id "aWCJmKjajoTJAbEk87xZXQAAAFY"]
[Fri Jan 09 12:52:40.944020 2026] [:error] [pid 14770:tid 14793] [client 85.203.21.147:42645] [client 85.203.21.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/fusion-core/css/about.php"] [unique_id "aWCJmB5QbaVZ-6newJb2kQAAAhU"]
[Fri Jan 09 12:52:41.295029 2026] [:error] [pid 1366:tid 1371] [client 85.203.21.86:33925] [client 85.203.21.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/themely/img/about.php"] [unique_id "aWCJmRmasveKu8_ec1XfdAAAAYM"]
[Fri Jan 09 12:52:41.646646 2026] [:error] [pid 14872:tid 14876] [client 85.203.21.95:39697] [client 85.203.21.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/page-list-item/lock.php"] [unique_id "aWCJmaIUELhgYLNp1sbq2AAAAsI"]
[Fri Jan 09 12:52:41.997875 2026] [:error] [pid 30019:tid 30035] [client 85.203.21.100:42651] [client 85.203.21.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/amp/vendor/ampproject/amp-toolbox/src/Validator/Spec/DescendantTagList/HeaRk.php"] [unique_id "aWCJmUz3igHGwX5f7IqRegAAAAs"]
[Fri Jan 09 12:52:42.353690 2026] [:error] [pid 14770:tid 14784] [client 85.203.21.130:26787] [client 85.203.21.130] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/sql.php"] [unique_id "aWCJmh5QbaVZ-6newJb2kgAAAgw"]
[Fri Jan 09 12:52:42.715240 2026] [:error] [pid 1366:tid 1389] [client 85.203.21.120:60703] [client 85.203.21.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/chosen.php"] [unique_id "aWCJmhmasveKu8_ec1XfdQAAAZQ"]
[Fri Jan 09 12:52:43.064105 2026] [:error] [pid 1366:tid 1383] [client 85.203.21.139:41121] [client 85.203.21.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/prayer_intentions.php"] [unique_id "aWCJmxmasveKu8_ec1XfeAAAAY4"]
[Fri Jan 09 12:52:43.419410 2026] [:error] [pid 44848:tid 44850] [client 85.203.21.120:40741] [client 85.203.21.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/images/data.php"] [unique_id "aWCJm6jajoTJAbEk87xZYQAAAEA"]
[Fri Jan 09 12:52:43.770041 2026] [:error] [pid 1366:tid 1376] [client 85.203.21.87:30071] [client 85.203.21.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aWCJmxmasveKu8_ec1XfewAAAYc"]
[Fri Jan 09 12:52:44.117476 2026] [:error] [pid 1366:tid 1373] [client 85.203.21.138:22659] [client 85.203.21.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/admin.php"] [unique_id "aWCJnBmasveKu8_ec1XffQAAAYQ"]
[Fri Jan 09 12:52:44.471170 2026] [:error] [pid 30020:tid 30063] [client 85.203.21.85:46093] [client 85.203.21.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/lib/v3/dist/build/build/cache.php"] [unique_id "aWCJnMrjc66qOisG6L2angAAAIk"]
[Fri Jan 09 12:52:44.829769 2026] [:error] [pid 14739:tid 14754] [client 85.203.21.109:22605] [client 85.203.21.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/post-views-counter/"] [unique_id "aWCJnF63M6_PkLt_IJIpeAAAAc0"]
[Fri Jan 09 12:52:45.179084 2026] [:error] [pid 30020:tid 30068] [client 85.203.21.116:56649] [client 85.203.21.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/media/dwv/admin.php"] [unique_id "aWCJncrjc66qOisG6L2anwAAAI4"]
[Fri Jan 09 12:52:45.535404 2026] [:error] [pid 30019:tid 30025] [client 85.203.21.97:39023] [client 85.203.21.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/zoom1.php"] [unique_id "aWCJnUz3igHGwX5f7IqRfQAAAAE"]
[Fri Jan 09 12:52:45.882097 2026] [:error] [pid 1366:tid 1378] [client 85.203.21.131:54895] [client 85.203.21.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/fonts/roboto/wp-admins.php"] [unique_id "aWCJnRmasveKu8_ec1XffwAAAYk"]
[Fri Jan 09 12:52:46.234667 2026] [:error] [pid 30019:tid 30024] [client 85.203.21.76:27733] [client 85.203.21.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/flatsome/wp-kgg.php"] [unique_id "aWCJnkz3igHGwX5f7IqRfgAAAAA"]
[Fri Jan 09 12:52:46.582628 2026] [:error] [pid 14739:tid 14760] [client 85.203.21.81:27881] [client 85.203.21.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/news-portal/wp-admins.php"] [unique_id "aWCJnl63M6_PkLt_IJIpfQAAAdM"]
[Fri Jan 09 12:52:46.931458 2026] [:error] [pid 14770:tid 14791] [client 85.203.21.115:20317] [client 85.203.21.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/paragraph/"] [unique_id "aWCJnh5QbaVZ-6newJb2lAAAAhM"]
[Fri Jan 09 12:52:47.283505 2026] [:error] [pid 14770:tid 14786] [client 85.203.21.88:51401] [client 85.203.21.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/commands/"] [unique_id "aWCJnx5QbaVZ-6newJb2lQAAAg4"]
[Fri Jan 09 12:52:47.628324 2026] [:error] [pid 14770:tid 14773] [client 85.203.21.111:59347] [client 85.203.21.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/buy.php"] [unique_id "aWCJnx5QbaVZ-6newJb2mQAAAgE"]
[Fri Jan 09 12:52:47.976033 2026] [:error] [pid 1366:tid 1380] [client 85.203.21.94:30013] [client 85.203.21.94] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/spacious-pro/js/theia-sticky-sidebar/"] [unique_id "aWCJnxmasveKu8_ec1XfhQAAAYs"]
[Fri Jan 09 12:52:48.324286 2026] [:error] [pid 14770:tid 14779] [client 85.203.21.143:59609] [client 85.203.21.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/zxasd.php"] [unique_id "aWCJoB5QbaVZ-6newJb2mwAAAgc"]
[Fri Jan 09 12:52:48.673124 2026] [:error] [pid 14872:tid 14886] [client 85.203.21.87:28475] [client 85.203.21.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/database.php"] [unique_id "aWCJoKIUELhgYLNp1sbq4QAAAsw"]
[Fri Jan 09 12:52:49.026998 2026] [:error] [pid 30020:tid 30061] [client 85.203.21.139:36013] [client 85.203.21.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/sql.php"] [unique_id "aWCJocrjc66qOisG6L2aowAAAIc"]
[Fri Jan 09 12:52:49.372847 2026] [:error] [pid 14872:tid 14887] [client 85.203.21.70:56371] [client 85.203.21.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/ty.php"] [unique_id "aWCJoaIUELhgYLNp1sbq4gAAAs0"]
[Fri Jan 09 12:52:49.732907 2026] [:error] [pid 1366:tid 1377] [client 85.203.21.79:23891] [client 85.203.21.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/ty.php"] [unique_id "aWCJoRmasveKu8_ec1XfhwAAAYg"]
[Fri Jan 09 12:52:50.089102 2026] [:error] [pid 14801:tid 14816] [client 85.203.21.131:33985] [client 85.203.21.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/ty.php"] [unique_id "aWCJot8UWXrz_OQYgF0c0gAAAk0"]
[Fri Jan 09 12:52:50.444680 2026] [:error] [pid 44848:tid 44852] [client 85.203.21.99:39509] [client 85.203.21.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/a1cord.php"] [unique_id "aWCJoqjajoTJAbEk87xZaQAAAEI"]
[Fri Jan 09 12:52:50.791929 2026] [:error] [pid 30019:tid 30039] [client 85.203.21.81:27961] [client 85.203.21.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comment-edit-link/"] [unique_id "aWCJokz3igHGwX5f7IqRgwAAAA8"]
[Fri Jan 09 12:52:51.137515 2026] [:error] [pid 14831:tid 14833] [client 85.203.21.152:21945] [client 85.203.21.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xex.php"] [unique_id "aWCJo_aKOMCmJcAyBm3tagAAAoA"]
[Fri Jan 09 12:52:51.492747 2026] [:error] [pid 14770:tid 14785] [client 85.203.21.96:22561] [client 85.203.21.96] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/edit-wolf.php"] [unique_id "aWCJox5QbaVZ-6newJb2oAAAAg0"]
[Fri Jan 09 12:52:51.845735 2026] [:error] [pid 14872:tid 14885] [client 85.203.21.132:34325] [client 85.203.21.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp_helper_bimfl/shell.php"] [unique_id "aWCJo6IUELhgYLNp1sbq6AAAAss"]
[Fri Jan 09 12:52:52.198434 2026] [:error] [pid 14831:tid 14842] [client 85.203.21.74:61941] [client 85.203.21.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp_helper_avcdl/shell.php"] [unique_id "aWCJpPaKOMCmJcAyBm3tawAAAok"]
[Fri Jan 09 12:52:52.550121 2026] [:error] [pid 14739:tid 14758] [client 85.203.21.130:48537] [client 85.203.21.130] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp_helper_rrvvo/shell.php"] [unique_id "aWCJpF63M6_PkLt_IJIpgQAAAdE"]
[Fri Jan 09 12:52:52.896598 2026] [:error] [pid 14872:tid 14898] [client 85.203.21.110:22353] [client 85.203.21.110] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/wp-contact-form-7.php"] [unique_id "aWCJpKIUELhgYLNp1sbq6gAAAtg"]
[Fri Jan 09 12:52:53.250382 2026] [:error] [pid 44848:tid 44868] [client 85.203.21.123:59757] [client 85.203.21.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp_theme_ahewl/shell.php"] [unique_id "aWCJpajajoTJAbEk87xZawAAAFI"]
[Fri Jan 09 12:52:53.604364 2026] [:error] [pid 14872:tid 14883] [client 85.203.21.147:45889] [client 85.203.21.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comments-pagination-numbers/"] [unique_id "aWCJpaIUELhgYLNp1sbq7AAAAsk"]
[Fri Jan 09 12:52:53.951853 2026] [:error] [pid 44848:tid 44871] [client 85.203.21.143:20269] [client 85.203.21.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jcrop/"] [unique_id "aWCJpajajoTJAbEk87xZbAAAAFU"]
[Fri Jan 09 12:52:54.299197 2026] [:error] [pid 1366:tid 1371] [client 85.203.21.96:37509] [client 85.203.21.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/tx20.php"] [unique_id "aWCJphmasveKu8_ec1XfiAAAAYM"]
[Fri Jan 09 12:52:54.644162 2026] [:error] [pid 30020:tid 30073] [client 85.203.21.88:60053] [client 85.203.21.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ah22.php"] [unique_id "aWCJpsrjc66qOisG6L2apgAAAJM"]
[Fri Jan 09 12:52:54.989404 2026] [:error] [pid 14872:tid 14889] [client 85.203.21.131:33431] [client 85.203.21.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/ooo.php"] [unique_id "aWCJpqIUELhgYLNp1sbq7gAAAs8"]
[Fri Jan 09 12:52:55.335279 2026] [:error] [pid 1366:tid 1388] [client 85.203.21.110:63255] [client 85.203.21.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jcrop/dist/content/pmdwx/xfe/admin.php"] [unique_id "aWCJpxmasveKu8_ec1XfiwAAAZM"]
[Fri Jan 09 12:52:55.681142 2026] [:error] [pid 30019:tid 30033] [client 85.203.21.105:63627] [client 85.203.21.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/resources/dist/includes/img/alw/"] [unique_id "aWCJp0z3igHGwX5f7IqRhwAAAAk"]
[Fri Jan 09 12:52:56.035754 2026] [:error] [pid 1366:tid 1392] [client 85.203.21.81:22737] [client 85.203.21.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/cache/assets/v3/v3/files/akami/admin.php"] [unique_id "aWCJqBmasveKu8_ec1XfjAAAAZc"]
[Fri Jan 09 12:52:56.382080 2026] [:error] [pid 30021:tid 30085] [client 85.203.21.131:34015] [client 85.203.21.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/datate.php"] [unique_id "aWCJqA_M8aRtsTog5J9BoQAAAMQ"]
[Fri Jan 09 12:52:56.735134 2026] [:error] [pid 30021:tid 30091] [client 85.203.21.93:22551] [client 85.203.21.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/chosen.php"] [unique_id "aWCJqA_M8aRtsTog5J9BogAAAMo"]
[Fri Jan 09 12:52:57.088209 2026] [:error] [pid 1366:tid 1376] [client 85.203.21.115:26037] [client 85.203.21.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/autoload_classmap.php"] [unique_id "aWCJqRmasveKu8_ec1XfjgAAAYc"]
[Fri Jan 09 12:52:57.444236 2026] [:error] [pid 1366:tid 1391] [client 85.203.21.143:37915] [client 85.203.21.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/call-now-button/admin.php"] [unique_id "aWCJqRmasveKu8_ec1XfjwAAAZY"]
[Fri Jan 09 12:52:57.798419 2026] [:error] [pid 30021:tid 30098] [client 85.203.21.152:54563] [client 85.203.21.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/rank-math/mmm.php"] [unique_id "aWCJqQ_M8aRtsTog5J9BpQAAANE"]
[Fri Jan 09 12:52:58.144870 2026] [:error] [pid 14872:tid 14892] [client 85.203.21.112:38579] [client 85.203.21.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/maintenance/assets/mmm.php"] [unique_id "aWCJqqIUELhgYLNp1sbq8QAAAtI"]
[Fri Jan 09 12:52:58.490622 2026] [:error] [pid 14872:tid 14886] [client 85.203.21.74:24499] [client 85.203.21.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/menu.php"] [unique_id "aWCJqqIUELhgYLNp1sbq8gAAAsw"]
[Fri Jan 09 12:52:58.836263 2026] [:error] [pid 1366:tid 1378] [client 85.203.21.135:52423] [client 85.203.21.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/menu.php"] [unique_id "aWCJqhmasveKu8_ec1XfkQAAAYk"]
[Fri Jan 09 12:52:59.189506 2026] [:error] [pid 14739:tid 14745] [client 85.203.21.135:21951] [client 85.203.21.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/todpIbcm.php"] [unique_id "aWCJq163M6_PkLt_IJIphQAAAcQ"]
[Fri Jan 09 12:52:59.533504 2026] [:error] [pid 14801:tid 14817] [client 85.203.21.92:23957] [client 85.203.21.92] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/mah/function.php"] [unique_id "aWCJq98UWXrz_OQYgF0c1wAAAk4"]
[Fri Jan 09 12:52:59.887642 2026] [:error] [pid 1366:tid 1369] [client 85.203.21.109:53377] [client 85.203.21.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-2019.php"] [unique_id "aWCJqxmasveKu8_ec1XfkwAAAYE"]
[Fri Jan 09 12:53:00.247345 2026] [:error] [pid 14872:tid 14876] [client 85.203.21.110:60669] [client 85.203.21.110] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/about/autoload_classmap.php"] [unique_id "aWCJrKIUELhgYLNp1sbq9QAAAsI"]
[Fri Jan 09 12:53:00.595196 2026] [:error] [pid 44848:tid 44874] [client 85.203.21.81:36905] [client 85.203.21.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/new/update/chosen.php"] [unique_id "aWCJrKjajoTJAbEk87xZcQAAAFg"]
[Fri Jan 09 12:53:00.972703 2026] [:error] [pid 1366:tid 1387] [client 85.203.21.139:49845] [client 85.203.21.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/new/wp-2019.php"] [unique_id "aWCJrBmasveKu8_ec1XflQAAAZI"]
[Fri Jan 09 12:53:01.326850 2026] [:error] [pid 14801:tid 14818] [client 85.203.21.98:37251] [client 85.203.21.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wp-2019.php"] [unique_id "aWCJrd8UWXrz_OQYgF0c2wAAAk8"]
[Fri Jan 09 12:53:01.680674 2026] [:error] [pid 14831:tid 14846] [client 85.203.21.143:39577] [client 85.203.21.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/zczv.php"] [unique_id "aWCJrfaKOMCmJcAyBm3tcAAAAo0"]
[Fri Jan 09 12:53:02.029452 2026] [:error] [pid 1366:tid 1388] [client 85.203.21.150:48223] [client 85.203.21.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/as/classwithtostring.php"] [unique_id "aWCJrhmasveKu8_ec1XflgAAAZM"]
[Fri Jan 09 12:53:02.389088 2026] [:error] [pid 14770:tid 14783] [client 85.203.21.141:63329] [client 85.203.21.141] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wp-rocket-config/V.php"] [unique_id "aWCJrh5QbaVZ-6newJb2pgAAAgs"]
[Fri Jan 09 12:53:02.736538 2026] [:error] [pid 1366:tid 1384] [client 85.203.21.147:29473] [client 85.203.21.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/wp-conflg.php"] [unique_id "aWCJrhmasveKu8_ec1XflwAAAY8"]
[Fri Jan 09 12:53:03.091420 2026] [:error] [pid 14739:tid 14749] [client 85.203.21.153:29285] [client 85.203.21.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/freeform/"] [unique_id "aWCJr163M6_PkLt_IJIpigAAAcg"]
[Fri Jan 09 12:53:03.446168 2026] [:error] [pid 30020:tid 30062] [client 85.203.21.79:31745] [client 85.203.21.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/autoload_classmap.php"] [unique_id "aWCJr8rjc66qOisG6L2aqwAAAIg"]
[Fri Jan 09 12:53:03.801626 2026] [:error] [pid 14770:tid 14795] [client 85.203.21.99:55887] [client 85.203.21.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/v.php"] [unique_id "aWCJrx5QbaVZ-6newJb2pwAAAhc"]
[Fri Jan 09 12:53:04.156675 2026] [:error] [pid 30020:tid 30066] [client 85.203.21.114:58777] [client 85.203.21.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/chosen.php"] [unique_id "aWCJsMrjc66qOisG6L2arAAAAIw"]
[Fri Jan 09 12:53:04.502869 2026] [:error] [pid 14872:tid 14879] [client 85.203.21.81:24665] [client 85.203.21.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentythree/templates/"] [unique_id "aWCJsKIUELhgYLNp1sbq9wAAAsU"]
[Fri Jan 09 12:53:04.847202 2026] [:error] [pid 44848:tid 44873] [client 85.203.21.118:42793] [client 85.203.21.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/fonts/page.php"] [unique_id "aWCJsKjajoTJAbEk87xZdgAAAFc"]
[Fri Jan 09 12:53:05.203430 2026] [:error] [pid 30019:tid 30026] [client 85.203.21.99:23269] [client 85.203.21.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/separator/"] [unique_id "aWCJsUz3igHGwX5f7IqRkgAAAAI"]
[Fri Jan 09 12:53:05.573600 2026] [:error] [pid 44848:tid 44857] [client 85.203.21.135:27935] [client 85.203.21.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/webix.php"] [unique_id "aWCJsajajoTJAbEk87xZeAAAAEc"]
[Fri Jan 09 12:53:05.928157 2026] [:error] [pid 1366:tid 1391] [client 85.203.21.75:64379] [client 85.203.21.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/template-singl-portfolio.php"] [unique_id "aWCJsRmasveKu8_ec1XfmwAAAZY"]
[Fri Jan 09 12:53:06.282412 2026] [:error] [pid 44848:tid 44860] [client 85.203.21.120:45753] [client 85.203.21.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/wp-conflg.php"] [unique_id "aWCJsqjajoTJAbEk87xZeQAAAEo"]
[Fri Jan 09 12:53:06.640335 2026] [:error] [pid 14831:tid 14856] [client 85.203.21.138:36117] [client 85.203.21.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/chosen.php"] [unique_id "aWCJsvaKOMCmJcAyBm3tcgAAApc"]
[Fri Jan 09 12:53:06.991080 2026] [:error] [pid 14770:tid 14789] [client 85.203.21.72:64987] [client 85.203.21.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/info.php"] [unique_id "aWCJsh5QbaVZ-6newJb2qgAAAhE"]
[Fri Jan 09 12:53:07.343387 2026] [:error] [pid 14801:tid 14821] [client 85.203.21.116:50369] [client 85.203.21.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-style.php"] [unique_id "aWCJs98UWXrz_OQYgF0c4gAAAlI"]
[Fri Jan 09 12:53:07.704312 2026] [:error] [pid 30021:tid 30099] [client 85.203.21.138:38843] [client 85.203.21.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/xp.php"] [unique_id "aWCJsw_M8aRtsTog5J9BqgAAANI"]
[Fri Jan 09 12:53:08.052183 2026] [:error] [pid 1366:tid 1370] [client 85.203.21.110:26169] [client 85.203.21.110] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/assets/admin/skin/base/mixins/about.php"] [unique_id "aWCJtBmasveKu8_ec1XfnAAAAYI"]
[Fri Jan 09 12:53:08.399833 2026] [:error] [pid 1366:tid 1377] [client 85.203.21.70:52133] [client 85.203.21.70] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Content/"] [unique_id "aWCJtBmasveKu8_ec1XfnQAAAYg"]
[Fri Jan 09 12:53:08.750079 2026] [:error] [pid 14872:tid 14893] [client 85.203.21.119:22067] [client 85.203.21.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Auth/"] [unique_id "aWCJtKIUELhgYLNp1sbq-gAAAtM"]
[Fri Jan 09 12:53:09.097338 2026] [:error] [pid 44848:tid 44863] [client 85.203.21.96:60981] [client 85.203.21.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/library/min.php"] [unique_id "aWCJtajajoTJAbEk87xZgQAAAE0"]
[Fri Jan 09 12:53:09.451748 2026] [:error] [pid 30020:tid 30063] [client 85.203.21.88:32707] [client 85.203.21.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/query-title/"] [unique_id "aWCJtcrjc66qOisG6L2asAAAAIk"]
[Fri Jan 09 12:53:09.800639 2026] [:error] [pid 14770:tid 14784] [client 85.203.21.131:46851] [client 85.203.21.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/query-pagination/"] [unique_id "aWCJtR5QbaVZ-6newJb2rQAAAgw"]
[Fri Jan 09 12:53:10.146676 2026] [:error] [pid 30019:tid 30036] [client 85.203.21.115:55355] [client 85.203.21.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/nux/"] [unique_id "aWCJtkz3igHGwX5f7IqRmgAAAAw"]
[Fri Jan 09 12:53:10.528254 2026] [:error] [pid 44848:tid 44851] [client 85.203.21.87:52661] [client 85.203.21.87] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/langs/"] [unique_id "aWCJtqjajoTJAbEk87xZhAAAAEE"]
[Fri Jan 09 12:53:10.882457 2026] [:error] [pid 30019:tid 30044] [client 85.203.21.141:42103] [client 85.203.21.141] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/"] [unique_id "aWCJtkz3igHGwX5f7IqRnAAAABQ"]
[Fri Jan 09 12:53:11.233769 2026] [:error] [pid 30021:tid 30086] [client 85.203.21.93:63347] [client 85.203.21.93] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/datate.php"] [unique_id "aWCJtw_M8aRtsTog5J9BrgAAAMU"]
[Fri Jan 09 12:53:11.581383 2026] [:error] [pid 14831:tid 14836] [client 85.203.21.87:59181] [client 85.203.21.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/lib/lock360.php"] [unique_id "aWCJt_aKOMCmJcAyBm3tcwAAAoM"]
[Fri Jan 09 12:53:11.936201 2026] [:error] [pid 1366:tid 1376] [client 85.203.21.99:43451] [client 85.203.21.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/wp-work.php"] [unique_id "aWCJtxmasveKu8_ec1XfoQAAAYc"]
[Fri Jan 09 12:53:12.282264 2026] [:error] [pid 1366:tid 1375] [client 85.203.21.94:43299] [client 85.203.21.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/search/admin.php"] [unique_id "aWCJuBmasveKu8_ec1XfogAAAYY"]
[Fri Jan 09 12:53:12.669159 2026] [:error] [pid 14831:tid 14849] [client 85.203.21.74:55811] [client 85.203.21.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/lifeempore/content-"] [unique_id "aWCJuPaKOMCmJcAyBm3tdgAAApA"]
[Fri Jan 09 12:53:13.016208 2026] [:error] [pid 30021:tid 30103] [client 85.203.21.98:61019] [client 85.203.21.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/lifeempore-v1/content-"] [unique_id "aWCJuQ_M8aRtsTog5J9BsQAAANY"]
[Fri Jan 09 12:53:13.370438 2026] [:error] [pid 30021:tid 30101] [client 85.203.21.120:51409] [client 85.203.21.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/lifeempore-v2/content-"] [unique_id "aWCJuQ_M8aRtsTog5J9BsgAAANQ"]
[Fri Jan 09 12:53:13.723567 2026] [:error] [pid 30021:tid 30100] [client 85.203.21.114:49079] [client 85.203.21.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentynineteen/content-"] [unique_id "aWCJuQ_M8aRtsTog5J9BtQAAANM"]
[Fri Jan 09 12:53:14.069504 2026] [:error] [pid 30021:tid 30095] [client 85.203.21.135:20875] [client 85.203.21.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-excerpt-constructor.php"] [unique_id "aWCJug_M8aRtsTog5J9BtgAAAM4"]
[Fri Jan 09 12:53:14.424131 2026] [:error] [pid 14801:tid 14827] [client 85.203.21.111:32659] [client 85.203.21.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aWCJut8UWXrz_OQYgF0c5gAAAlg"]
[Fri Jan 09 12:53:14.770450 2026] [:error] [pid 44848:tid 44858] [client 85.203.21.137:39317] [client 85.203.21.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/class-ftp-sockets-more.php"] [unique_id "aWCJuqjajoTJAbEk87xZigAAAEg"]
[Fri Jan 09 12:53:15.122819 2026] [:error] [pid 30019:tid 30037] [client 85.203.21.86:38015] [client 85.203.21.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/options-privacy-pic.php"] [unique_id "aWCJu0z3igHGwX5f7IqRnwAAAA0"]
[Fri Jan 09 12:53:15.479405 2026] [:error] [pid 44848:tid 44853] [client 85.203.21.141:34791] [client 85.203.21.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/post-template-soap.php"] [unique_id "aWCJu6jajoTJAbEk87xZjgAAAEM"]
[Fri Jan 09 12:53:15.851339 2026] [:error] [pid 30019:tid 30025] [client 85.203.21.150:57455] [client 85.203.21.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-conflg.php"] [unique_id "aWCJu0z3igHGwX5f7IqRoAAAAAE"]
[Fri Jan 09 12:53:16.198061 2026] [:error] [pid 14801:tid 14814] [client 85.203.21.96:22999] [client 85.203.21.96] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/privacy-beta.php"] [unique_id "aWCJvN8UWXrz_OQYgF0c6AAAAks"]
[Fri Jan 09 12:53:16.548680 2026] [:error] [pid 30019:tid 30032] [client 85.203.21.131:37693] [client 85.203.21.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/revslider/templates/particle-effect-three/"] [unique_id "aWCJvEz3igHGwX5f7IqRogAAAAg"]
[Fri Jan 09 12:53:16.896037 2026] [:error] [pid 14801:tid 14813] [client 85.203.21.98:36577] [client 85.203.21.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/revslider/templates/magazineposts/"] [unique_id "aWCJvN8UWXrz_OQYgF0c6gAAAko"]
[Fri Jan 09 12:53:17.243309 2026] [:error] [pid 30019:tid 30027] [client 85.203.21.100:60695] [client 85.203.21.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/revslider/templates/landing-page-hero/"] [unique_id "aWCJvUz3igHGwX5f7IqRpAAAAAM"]
[Fri Jan 09 12:53:17.593265 2026] [:error] [pid 44848:tid 44852] [client 85.203.21.118:32283] [client 85.203.21.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/revslider/templates/le-chef-la-carte/"] [unique_id "aWCJvajajoTJAbEk87xZkAAAAEI"]
[Fri Jan 09 12:53:17.954471 2026] [:error] [pid 30021:tid 30086] [client 85.203.21.114:46601] [client 85.203.21.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/flatco/assets/"] [unique_id "aWCJvQ_M8aRtsTog5J9BugAAAMU"]
[Fri Jan 09 12:53:18.408247 2026] [:error] [pid 30019:tid 30042] [client 85.203.21.88:21779] [client 85.203.21.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/flatco/framework/"] [unique_id "aWCJvkz3igHGwX5f7IqRpgAAABI"]
[Fri Jan 09 12:53:18.778062 2026] [:error] [pid 14801:tid 14821] [client 85.203.21.130:56077] [client 85.203.21.130] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/Avada/woocommerce/checkout/"] [unique_id "aWCJvt8UWXrz_OQYgF0c7QAAAlI"]
[Fri Jan 09 12:53:19.138938 2026] [:error] [pid 14831:tid 14846] [client 85.203.21.139:31485] [client 85.203.21.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/Avada/includes/recaptcha/src/ReCaptcha/"] [unique_id "aWCJv_aKOMCmJcAyBm3teQAAAo0"]
[Fri Jan 09 12:53:19.503398 2026] [:error] [pid 14831:tid 14856] [client 85.203.21.138:44161] [client 85.203.21.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/target/admin/"] [unique_id "aWCJv_aKOMCmJcAyBm3tfAAAApc"]
[Fri Jan 09 12:53:24.889338 2026] [:error] [pid 30020:tid 30078] [client 85.203.21.115:54089] [client 85.203.21.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "aWCJxMrjc66qOisG6L2atwAAAJg"]
[Fri Jan 09 12:53:25.242052 2026] [:error] [pid 1366:tid 1379] [client 85.203.21.115:63685] [client 85.203.21.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hello-plus/classes/ehp-sarang.php"] [unique_id "aWCJxRmasveKu8_ec1XfugAAAYo"]
[Fri Jan 09 12:53:25.596750 2026] [:error] [pid 44848:tid 44874] [client 85.203.21.132:23087] [client 85.203.21.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/file1.php"] [unique_id "aWCJxajajoTJAbEk87xZlAAAAFg"]
[Fri Jan 09 12:53:25.979967 2026] [:error] [pid 30019:tid 30027] [client 85.203.21.143:51139] [client 85.203.21.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/"] [unique_id "aWCJxUz3igHGwX5f7IqRrwAAAAM"]
[Fri Jan 09 12:53:26.327876 2026] [:error] [pid 14739:tid 14764] [client 85.203.21.130:60471] [client 85.203.21.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-includes.php"] [unique_id "aWCJxl63M6_PkLt_IJIplAAAAdc"]
[Fri Jan 09 12:53:26.675193 2026] [:error] [pid 30020:tid 30068] [client 85.203.21.98:54125] [client 85.203.21.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wp-rocket-config/wp-login.php"] [unique_id "aWCJxsrjc66qOisG6L2augAAAI4"]
[Fri Jan 09 12:53:27.022912 2026] [:error] [pid 1366:tid 1392] [client 85.203.21.93:59497] [client 85.203.21.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/moon.php"] [unique_id "aWCJxxmasveKu8_ec1XfvAAAAZc"]
[Fri Jan 09 12:53:27.369400 2026] [:error] [pid 44848:tid 44869] [client 85.203.21.76:50831] [client 85.203.21.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/cloud.php"] [unique_id "aWCJx6jajoTJAbEk87xZmQAAAFM"]
[Fri Jan 09 12:53:27.724091 2026] [:error] [pid 1366:tid 1381] [client 85.203.21.81:36239] [client 85.203.21.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/termps.php"] [unique_id "aWCJxxmasveKu8_ec1XfvQAAAYw"]
[Fri Jan 09 12:53:28.075902 2026] [:error] [pid 1366:tid 1393] [client 85.203.21.110:47811] [client 85.203.21.110] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/404.php"] [unique_id "aWCJyBmasveKu8_ec1XfvgAAAZg"]
[Fri Jan 09 12:53:28.423590 2026] [:error] [pid 1366:tid 1390] [client 85.203.21.98:37449] [client 85.203.21.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/social-links/atomlib.php"] [unique_id "aWCJyBmasveKu8_ec1XfvwAAAZU"]
[Fri Jan 09 12:53:28.776417 2026] [:error] [pid 44848:tid 44863] [client 85.203.21.88:62457] [client 85.203.21.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/man.php"] [unique_id "aWCJyKjajoTJAbEk87xZmgAAAE0"]
[Fri Jan 09 12:53:29.128172 2026] [:error] [pid 1366:tid 1381] [client 85.203.21.88:60821] [client 85.203.21.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/images/1.php"] [unique_id "aWCJyRmasveKu8_ec1XfxQAAAYw"]
[Fri Jan 09 12:53:29.506447 2026] [:error] [pid 1366:tid 1388] [client 85.203.21.97:58547] [client 85.203.21.97] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/cherry-plugin-master/includes/makeasmtp.php"] [unique_id "aWCJyRmasveKu8_ec1XfyAAAAZM"]
[Fri Jan 09 12:53:29.876067 2026] [:error] [pid 1366:tid 1380] [client 85.203.21.152:23989] [client 85.203.21.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "aWCJyRmasveKu8_ec1XfywAAAYs"]
[Fri Jan 09 12:53:30.221871 2026] [:error] [pid 14831:tid 14849] [client 85.203.21.92:47985] [client 85.203.21.92] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/lock.php"] [unique_id "aWCJyvaKOMCmJcAyBm3thgAAApA"]
[Fri Jan 09 12:53:30.579885 2026] [:error] [pid 44848:tid 44873] [client 85.203.21.96:34287] [client 85.203.21.96] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/siara-corporate-business/template-parts/header/styles/lock.php"] [unique_id "aWCJyqjajoTJAbEk87xZnAAAAFc"]
[Fri Jan 09 12:53:31.002276 2026] [:error] [pid 14739:tid 14745] [client 85.203.21.96:55033] [client 85.203.21.96] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wtu_gagal.php"] [unique_id "aWCJy163M6_PkLt_IJIpmQAAAcQ"]
[Fri Jan 09 12:53:36.351028 2026] [:error] [pid 44848:tid 44852] [client 85.203.21.98:61755] [client 85.203.21.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/mtodm/"] [unique_id "aWCJ0KjajoTJAbEk87xZoQAAAEI"]
[Fri Jan 09 12:53:36.698770 2026] [:error] [pid 30019:tid 30036] [client 85.203.21.98:49427] [client 85.203.21.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/elementor/modules/atomic-widgets/prop-types/transform/lock.php"] [unique_id "aWCJ0Ez3igHGwX5f7IqRtwAAAAw"]
[Fri Jan 09 12:53:37.057475 2026] [:error] [pid 30021:tid 30085] [client 85.203.21.119:48029] [client 85.203.21.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/elementor/modules/kit-elements-defaults/import-export-customization/lock.php"] [unique_id "aWCJ0Q_M8aRtsTog5J9BygAAAMQ"]
[Fri Jan 09 12:53:37.414970 2026] [:error] [pid 1366:tid 1374] [client 85.203.21.109:53351] [client 85.203.21.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-maiI.php"] [unique_id "aWCJ0RmasveKu8_ec1Xf0AAAAYU"]
[Fri Jan 09 12:53:37.762827 2026] [:error] [pid 44848:tid 44868] [client 85.203.21.133:40221] [client 85.203.21.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/mer_gagal.php"] [unique_id "aWCJ0ajajoTJAbEk87xZogAAAFI"]
[Fri Jan 09 12:53:38.122182 2026] [:error] [pid 14739:tid 14742] [client 85.203.21.101:42665] [client 85.203.21.101] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wophq/"] [unique_id "aWCJ0l63M6_PkLt_IJIpmgAAAcE"]
[Fri Jan 09 12:53:38.473731 2026] [:error] [pid 30021:tid 30092] [client 85.203.21.109:39983] [client 85.203.21.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wadd-wp-bookls.php"] [unique_id "aWCJ0g_M8aRtsTog5J9BzQAAAMs"]
[Fri Jan 09 12:53:38.820992 2026] [:error] [pid 30021:tid 30086] [client 85.203.21.97:38959] [client 85.203.21.97] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo-extended/admin/views/admin.php"] [unique_id "aWCJ0g_M8aRtsTog5J9BzgAAAMU"]
[Fri Jan 09 12:53:39.172505 2026] [:error] [pid 14801:tid 14813] [client 85.203.21.97:24965] [client 85.203.21.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-walker-page-dropdown-first.php"] [unique_id "aWCJ098UWXrz_OQYgF0c_AAAAko"]
[Fri Jan 09 12:53:39.529096 2026] [:error] [pid 1366:tid 1390] [client 85.203.21.93:49473] [client 85.203.21.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-tag-cloud-new.php"] [unique_id "aWCJ0xmasveKu8_ec1Xf1gAAAZU"]
[Fri Jan 09 12:53:39.883769 2026] [:error] [pid 1366:tid 1379] [client 85.203.21.99:59325] [client 85.203.21.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/zer.php"] [unique_id "aWCJ0xmasveKu8_ec1Xf1wAAAYo"]
[Fri Jan 09 12:53:40.232339 2026] [:error] [pid 14770:tid 14782] [client 85.203.21.120:29585] [client 85.203.21.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/autoload_classmap.php"] [unique_id "aWCJ1B5QbaVZ-6newJb2uwAAAgo"]
[Fri Jan 09 12:53:40.584742 2026] [:error] [pid 14801:tid 14821] [client 85.203.21.86:52733] [client 85.203.21.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/screen-event.php"] [unique_id "aWCJ1N8UWXrz_OQYgF0c_wAAAlI"]
[Fri Jan 09 12:53:40.930816 2026] [:error] [pid 30019:tid 30040] [client 85.203.21.93:22013] [client 85.203.21.93] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/site-info-client.php"] [unique_id "aWCJ1Ez3igHGwX5f7IqRvAAAABA"]
[Fri Jan 09 12:53:41.287392 2026] [:error] [pid 30019:tid 30031] [client 85.203.21.74:27325] [client 85.203.21.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-mails.php"] [unique_id "aWCJ1Uz3igHGwX5f7IqRvgAAAAc"]
[Fri Jan 09 12:53:41.643439 2026] [:error] [pid 30021:tid 30097] [client 85.203.21.137:21545] [client 85.203.21.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aWCJ1Q_M8aRtsTog5J9BzwAAANA"]
[Fri Jan 09 12:53:42.009011 2026] [:error] [pid 14872:tid 14896] [client 85.203.21.103:45431] [client 85.203.21.103] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/dofault.php"] [unique_id "aWCJ1qIUELhgYLNp1sbrCgAAAtY"]
[Fri Jan 09 12:53:42.363120 2026] [:error] [pid 30019:tid 30033] [client 85.203.21.75:62417] [client 85.203.21.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/file-manager.php"] [unique_id "aWCJ1kz3igHGwX5f7IqRwAAAAAk"]
[Fri Jan 09 12:53:42.715396 2026] [:error] [pid 14801:tid 14817] [client 85.203.21.153:37239] [client 85.203.21.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/radio.php"] [unique_id "aWCJ1t8UWXrz_OQYgF0dAAAAAk4"]
[Fri Jan 09 12:53:43.062697 2026] [:error] [pid 30019:tid 30028] [client 85.203.21.81:36657] [client 85.203.21.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aWCJ10z3igHGwX5f7IqRwQAAAAQ"]
[Fri Jan 09 12:53:43.410362 2026] [:error] [pid 14801:tid 14818] [client 85.203.21.120:63895] [client 85.203.21.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/zczv.php"] [unique_id "aWCJ198UWXrz_OQYgF0dAQAAAk8"]
[Fri Jan 09 12:53:43.770092 2026] [:error] [pid 14831:tid 14839] [client 85.203.21.76:26049] [client 85.203.21.76] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/Iitespeed-cache/drive.php"] [unique_id "aWCJ1_aKOMCmJcAyBm3tjwAAAoY"]
[Fri Jan 09 12:53:44.128497 2026] [:error] [pid 44848:tid 44861] [client 85.203.21.98:23681] [client 85.203.21.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/assets/images/selam.php"] [unique_id "aWCJ2KjajoTJAbEk87xZqwAAAEs"]
[Fri Jan 09 12:53:44.482450 2026] [:error] [pid 44848:tid 44852] [client 85.203.21.143:48737] [client 85.203.21.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/advanced-product-fields-for-woocommerce/db.php"] [unique_id "aWCJ2KjajoTJAbEk87xZrQAAAEI"]
[Fri Jan 09 12:53:44.832733 2026] [:error] [pid 14801:tid 14808] [client 85.203.21.100:60601] [client 85.203.21.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfour/patterns/template-singl-portfolio.php"] [unique_id "aWCJ2N8UWXrz_OQYgF0dAwAAAkU"]
[Fri Jan 09 13:39:03.148338 2026] [:error] [pid 14801:tid 14819] [client 159.223.226.118:59676] [client 159.223.226.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.226.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWCUd98UWXrz_OQYgF0kaQAAAlA"]
[Fri Jan 09 13:51:51.647494 2026] [:error] [pid 14872:tid 14879] [client 89.74.227.109:4622] [client 89.74.227.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.74.227.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWCXd6IUELhgYLNp1sb2XwAAAsU"]
[Fri Jan 09 14:55:24.743317 2026] [:error] [pid 14831:tid 14840] [client 211.21.61.246:59050] [client 211.21.61.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWCmXPaKOMCmJcAyBm0FhQAAAoc"]
[Fri Jan 09 15:58:58.091130 2026] [:error] [pid 30021:tid 30095] [client 103.163.138.146:46954] [client 103.163.138.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.163.138.146, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWC1Qg_M8aRtsTog5J9sSwAAAM4"]
[Fri Jan 09 15:59:32.039733 2026] [:error] [pid 14801:tid 14818] [client 156.224.140.2:39586] [client 156.224.140.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.224.140.2, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWC1ZN8UWXrz_OQYgF08SAAAAk8"]
[Fri Jan 09 15:59:43.151412 2026] [:error] [pid 14872:tid 14881] [client 43.162.114.156:42006] [client 43.162.114.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.162.114.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWC1b6IUELhgYLNp1sYO9AAAAsc"]
[Fri Jan 09 15:59:46.267239 2026] [:error] [pid 14770:tid 14787] [client 134.209.95.224:44540] [client 134.209.95.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.209.95.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWC1ch5QbaVZ-6newJYWJgAAAg8"]
[Fri Jan 09 16:11:51.431563 2026] [:error] [pid 30020:tid 30063] [client 81.8.91.201:40248] [client 81.8.91.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.8.91.201, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWC4R8rjc66qOisG6L24VQAAAIk"]
[Fri Jan 09 16:24:26.806725 2026] [:error] [pid 30020:tid 30076] [client 162.240.102.83:47866] [client 162.240.102.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.240.102.83, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWC7Osrjc66qOisG6L26AAAAAJY"]
[Fri Jan 09 17:29:33.537318 2026] [:error] [pid 14770:tid 14773] [client 45.33.121.161:34620] [client 45.33.121.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.33.121.161, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWDKfR5QbaVZ-6newJYh6AAAAgE"]
[Fri Jan 09 19:00:14.844797 2026] [:error] [pid 14739:tid 14743] [client 125.94.144.102:60825] [client 125.94.144.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWDfvl63M6_PkLt_IJJcbAAAAcI"]
[Fri Jan 09 19:14:52.858784 2026] [:error] [pid 14801:tid 14825] [client 43.159.139.164:44068] [client 43.159.139.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWDjLN8UWXrz_OQYgF1YkAAAAlY"]
[Fri Jan 09 19:16:45.362927 2026] [:error] [pid 44848:tid 44860] [client 103.110.84.178:44946] [client 103.110.84.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWDjnajajoTJAbEk87y6MwAAAEo"]
[Fri Jan 09 19:17:20.945435 2026] [:error] [pid 14801:tid 14815] [client 168.227.250.223:23398] [client 168.227.250.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.227.250.223, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWDjwN8UWXrz_OQYgF1ZAgAAAkw"]
[Fri Jan 09 19:31:07.429618 2026] [:error] [pid 14801:tid 14803] [client 185.243.218.233:60438] [client 185.243.218.233] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/expres.sql"] [unique_id "aWDm-98UWXrz_OQYgF1bbgAAAkA"]
[Fri Jan 09 19:31:08.531465 2026] [:error] [pid 1366:tid 1385] [client 185.220.100.241:39848] [client 185.220.100.241] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/expressinterior.sql"] [unique_id "aWDm_BmasveKu8_ec1VbFQAAAZA"]
[Fri Jan 09 19:31:10.090862 2026] [:error] [pid 14831:tid 14840] [client 185.241.208.82:38984] [client 185.241.208.82] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/iors_com.sql"] [unique_id "aWDm_vaKOMCmJcAyBm0w7QAAAoc"]
[Fri Jan 09 19:31:10.953687 2026] [:error] [pid 14872:tid 14878] [client 23.129.64.169:47159] [client 23.129.64.169] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/eriors_com.sql"] [unique_id "aWDm_qIUELhgYLNp1sYvKQAAAsQ"]
[Fri Jan 09 19:31:12.587208 2026] [:error] [pid 14872:tid 14880] [client 109.70.100.9:41180] [client 109.70.100.9] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/riors_com.sql"] [unique_id "aWDnAKIUELhgYLNp1sYvLgAAAsY"]
[Fri Jan 09 19:31:14.087062 2026] [:error] [pid 1366:tid 1376] [client 64.190.76.10:45036] [client 64.190.76.10] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/expressinteri.sql"] [unique_id "aWDnAhmasveKu8_ec1VbHgAAAYc"]
[Fri Jan 09 19:31:15.605674 2026] [:error] [pid 14801:tid 14826] [client 203.55.81.2:43684] [client 203.55.81.2] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/.sql"] [unique_id "aWDnA98UWXrz_OQYgF1beAAAAlc"]
[Fri Jan 09 19:31:18.819089 2026] [:error] [pid 30020:tid 30057] [client 185.246.188.149:33698] [client 185.246.188.149] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/expre.sql"] [unique_id "aWDnBsrjc66qOisG6L3RPgAAAIM"]
[Fri Jan 09 19:31:19.843089 2026] [:error] [pid 14770:tid 14784] [client 171.25.193.82:38588] [client 171.25.193.82] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/expressinterio.sql"] [unique_id "aWDnBx5QbaVZ-6newJYzoQAAAgw"]
[Fri Jan 09 19:31:21.127171 2026] [:error] [pid 30020:tid 30065] [client 185.129.61.2:64390] [client 185.129.61.2] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/teriors_com.sql"] [unique_id "aWDnCcrjc66qOisG6L3RQAAAAIs"]
[Fri Jan 09 19:31:22.665080 2026] [:error] [pid 1366:tid 1387] [client 188.239.191.25:51078] [client 188.239.191.25] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/expressinte.sql"] [unique_id "aWDnChmasveKu8_ec1VbMwAAAZI"]
[Fri Jan 09 19:31:24.201029 2026] [:error] [pid 1366:tid 1387] [client 5.253.247.27:56024] [client 5.253.247.27] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/back.sql"] [unique_id "aWDnDBmasveKu8_ec1VbPgAAAZI"]
[Fri Jan 09 19:31:25.302047 2026] [:error] [pid 1366:tid 1378] [client 45.84.107.33:44367] [client 45.84.107.33] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/ssinteriors_com.sql"] [unique_id "aWDnDRmasveKu8_ec1VbRAAAAYk"]
[Fri Jan 09 19:31:28.391525 2026] [:error] [pid 30019:tid 30031] [client 192.42.116.176:38776] [client 192.42.116.176] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/sinteriors_com.sql"] [unique_id "aWDnEEz3igHGwX5f7IreewAAAAc"]
[Fri Jan 09 19:31:37.052509 2026] [:error] [pid 30021:tid 30094] [client 185.220.101.31:32602] [client 185.220.101.31] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/s_com.sql"] [unique_id "aWDnGQ_M8aRtsTog5J-VcgAAAM0"]
[Fri Jan 09 19:31:39.168854 2026] [:error] [pid 30020:tid 30055] [client 176.65.149.186:45650] [client 176.65.149.186] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/expressint.sql"] [unique_id "aWDnG8rjc66qOisG6L3RSwAAAIE"]
[Fri Jan 09 19:31:40.068447 2026] [:error] [pid 44848:tid 44862] [client 192.42.116.177:37629] [client 192.42.116.177] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/pressinteriors_com.sql"] [unique_id "aWDnHKjajoTJAbEk87y-PQAAAEw"]
[Fri Jan 09 19:31:41.440752 2026] [:error] [pid 14831:tid 14854] [client 107.189.8.133:61306] [client 107.189.8.133] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/latest.sql"] [unique_id "aWDnHfaKOMCmJcAyBm0xBQAAApU"]
[Fri Jan 09 19:31:42.340245 2026] [:error] [pid 30021:tid 30081] [client 171.25.193.36:53008] [client 171.25.193.36] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/expressin.sql"] [unique_id "aWDnHg_M8aRtsTog5J-VeQAAAMA"]
[Fri Jan 09 19:31:44.495891 2026] [:error] [pid 14801:tid 14813] [client 171.25.193.79:57652] [client 171.25.193.79] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/express.sql"] [unique_id "aWDnIN8UWXrz_OQYgF1biwAAAko"]
[Fri Jan 09 19:31:45.800517 2026] [:error] [pid 14801:tid 14826] [client 45.84.107.17:42485] [client 45.84.107.17] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/interiors_com.sql"] [unique_id "aWDnId8UWXrz_OQYgF1bjQAAAlc"]
[Fri Jan 09 19:31:46.868068 2026] [:error] [pid 14801:tid 14818] [client 192.42.116.194:46351] [client 192.42.116.194] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/expressi.sql"] [unique_id "aWDnIt8UWXrz_OQYgF1bjwAAAk8"]
[Fri Jan 09 19:31:47.805704 2026] [:error] [pid 44848:tid 44865] [client 192.42.116.176:17996] [client 192.42.116.176] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/dump.sql"] [unique_id "aWDnI6jajoTJAbEk87y-PgAAAE8"]
[Fri Jan 09 19:31:49.488941 2026] [:error] [pid 14872:tid 14887] [client 192.42.116.185:25873] [client 192.42.116.185] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xpressinteriors_com.sql"] [unique_id "aWDnJaIUELhgYLNp1sYvRwAAAs0"]
[Fri Jan 09 19:31:51.075121 2026] [:error] [pid 30020:tid 30069] [client 107.189.8.181:51184] [client 107.189.8.181] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/expressinter.sql"] [unique_id "aWDnJ8rjc66qOisG6L3RUAAAAI8"]
[Fri Jan 09 19:31:52.550119 2026] [:error] [pid 30020:tid 30075] [client 194.32.107.14:60160] [client 194.32.107.14] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/ressinteriors_com.sql"] [unique_id "aWDnKMrjc66qOisG6L3RUQAAAJU"]
[Fri Jan 09 19:31:53.995582 2026] [:error] [pid 14801:tid 14810] [client 89.58.41.156:20918] [client 89.58.41.156] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/nteriors_com.sql"] [unique_id "aWDnKd8UWXrz_OQYgF1blgAAAkc"]
[Fri Jan 09 19:31:55.467936 2026] [:error] [pid 30020:tid 30062] [client 192.42.116.182:54044] [client 192.42.116.182] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/exp.sql"] [unique_id "aWDnK8rjc66qOisG6L3RVAAAAIg"]
[Fri Jan 09 20:16:22.341131 2026] [:error] [pid 44848:tid 44867] [client 5.39.65.19:38414] [client 5.39.65.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.39.65.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWDxlqjajoTJAbEk87zIcQAAAFE"]
[Fri Jan 09 21:37:57.756327 2026] [:error] [pid 14872:tid 14886] [client 159.65.187.122:47266] [client 159.65.187.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.65.187.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWEEtaIUELhgYLNp1sZDGgAAAsw"]
[Fri Jan 09 21:44:36.812956 2026] [:error] [pid 30021:tid 30094] [client 159.65.130.72:54338] [client 159.65.130.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.130.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWEGRA_M8aRtsTog5J-s8QAAAM0"]
[Fri Jan 09 22:42:18.634298 2026] [:error] [pid 1366:tid 1369] [client 68.183.90.82:59475] [client 68.183.90.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.183.90.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWETyhmasveKu8_ec1WSjgAAAYE"]
[Fri Jan 09 22:42:20.224298 2026] [:error] [pid 44848:tid 44854] [client 68.183.90.82:64352] [client 68.183.90.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.183.90.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWETzKjajoTJAbEk87znaQAAAEQ"]
[Fri Jan 09 22:54:28.798723 2026] [:error] [pid 14872:tid 14878] [client 68.183.90.82:57619] [client 68.183.90.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.183.90.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWEWpKIUELhgYLNp1sZRwgAAAsQ"]
[Fri Jan 09 23:03:01.849085 2026] [:error] [pid 1366:tid 1377] [client 68.183.90.82:60651] [client 68.183.90.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.183.90.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWEYpRmasveKu8_ec1WZmgAAAYg"]
[Fri Jan 09 23:12:05.272701 2026] [:error] [pid 14770:tid 14775] [client 146.190.155.17:59046] [client 146.190.155.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.155.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWEaxR5QbaVZ-6newJZXEwAAAgM"]
[Fri Jan 09 23:12:09.335846 2026] [:error] [pid 30021:tid 30097] [client 68.183.90.82:62735] [client 68.183.90.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.183.90.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWEayQ_M8aRtsTog5J--2QAAANA"]
[Sat Jan 10 00:37:13.567565 2026] [:error] [pid 1366:tid 1380] [client 54.38.241.153:54422] [client 54.38.241.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.241.153, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWEuuRmasveKu8_ec1Wv2QAAAYs"]
[Sat Jan 10 00:59:35.701341 2026] [:error] [pid 44848:tid 44852] [client 18.162.124.143:43990] [client 18.162.124.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aWEz96jajoTJAbEk87wA-wAAAEI"]
[Sat Jan 10 00:59:36.293972 2026] [:error] [pid 1366:tid 1373] [client 18.162.124.143:44006] [client 18.162.124.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aWEz-BmasveKu8_ec1W18AAAAYQ"]
[Sat Jan 10 00:59:38.502210 2026] [:error] [pid 14872:tid 14896] [client 18.162.124.143:43302] [client 18.162.124.143] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/backup.sql"] [unique_id "aWEz-qIUELhgYLNp1sZhIgAAAtY"]
[Sat Jan 10 00:59:39.098299 2026] [:error] [pid 30021:tid 30092] [client 18.162.124.143:43312] [client 18.162.124.143] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/debug.log"] [unique_id "aWEz-w_M8aRtsTog5J_NTwAAAMs"]
[Sat Jan 10 00:59:39.691030 2026] [:error] [pid 44848:tid 44855] [client 18.162.124.143:43320] [client 18.162.124.143] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/database.sql"] [unique_id "aWEz-6jajoTJAbEk87wBAgAAAEU"]
[Sat Jan 10 00:59:40.282448 2026] [:error] [pid 1366:tid 1379] [client 18.162.124.143:43332] [client 18.162.124.143] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/storage/logs/laravel.log"] [unique_id "aWEz_BmasveKu8_ec1W19AAAAYo"]
[Sat Jan 10 00:59:46.949639 2026] [:error] [pid 14770:tid 14772] [client 18.162.124.143:54966] [client 18.162.124.143] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/dump.sql"] [unique_id "aWE0Ah5QbaVZ-6newJZjXgAAAgA"]
[Sat Jan 10 00:59:48.980329 2026] [:error] [pid 30021:tid 30086] [client 18.162.124.143:54986] [client 18.162.124.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/api/.env"] [unique_id "aWE0BA_M8aRtsTog5J_NVQAAAMU"]
[Sat Jan 10 00:59:49.577970 2026] [:error] [pid 30019:tid 30031] [client 18.162.124.143:55000] [client 18.162.124.143] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/log/error.log"] [unique_id "aWE0BUz3igHGwX5f7IoXiAAAAAc"]
[Sat Jan 10 00:59:50.172231 2026] [:error] [pid 14831:tid 14856] [client 18.162.124.143:55002] [client 18.162.124.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/backend/.env"] [unique_id "aWE0BvaKOMCmJcAyBm1ftQAAApc"]
[Sat Jan 10 00:59:55.152409 2026] [:error] [pid 1366:tid 1383] [client 18.162.124.143:55046] [client 18.162.124.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.local"] [unique_id "aWE0CxmasveKu8_ec1W1-wAAAY4"]
[Sat Jan 10 00:59:57.200254 2026] [:error] [pid 14739:tid 14760] [client 18.162.124.143:48142] [client 18.162.124.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.production"] [unique_id "aWE0DV63M6_PkLt_IJKLfAAAAdM"]
[Sat Jan 10 00:59:57.796399 2026] [:error] [pid 14831:tid 14848] [client 18.162.124.143:48146] [client 18.162.124.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/admin/.env"] [unique_id "aWE0DfaKOMCmJcAyBm1fuAAAAo8"]
[Sat Jan 10 00:59:58.390589 2026] [:error] [pid 30019:tid 30048] [client 18.162.124.143:48156] [client 18.162.124.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/core/.env"] [unique_id "aWE0Dkz3igHGwX5f7IoXjQAAABg"]
[Sat Jan 10 00:59:58.984038 2026] [:error] [pid 14770:tid 14789] [client 18.162.124.143:48166] [client 18.162.124.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/laravel/.env"] [unique_id "aWE0Dh5QbaVZ-6newJZjZQAAAhE"]
[Sat Jan 10 01:00:01.024328 2026] [:error] [pid 1366:tid 1379] [client 18.162.124.143:48176] [client 18.162.124.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/config/.env"] [unique_id "aWE0ERmasveKu8_ec1W1_wAAAYo"]
[Sat Jan 10 01:00:01.619684 2026] [:error] [pid 14872:tid 14890] [client 18.162.124.143:48192] [client 18.162.124.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/app/.env"] [unique_id "aWE0EaIUELhgYLNp1sZhKQAAAtA"]
[Sat Jan 10 01:00:02.212676 2026] [:error] [pid 14801:tid 14827] [client 18.162.124.143:48204] [client 18.162.124.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/src/.env"] [unique_id "aWE0Et8UWXrz_OQYgF2LMgAAAlg"]
[Sat Jan 10 01:00:02.805746 2026] [:error] [pid 14872:tid 14879] [client 18.162.124.143:48206] [client 18.162.124.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/storage/.env"] [unique_id "aWE0EqIUELhgYLNp1sZhKwAAAsU"]
[Sat Jan 10 01:00:03.398965 2026] [:error] [pid 1366:tid 1392] [client 18.162.124.143:48212] [client 18.162.124.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/vendor/.env"] [unique_id "aWE0ExmasveKu8_ec1W2AAAAAZc"]
[Sat Jan 10 01:36:41.117571 2026] [:error] [pid 14770:tid 14793] [client 34.60.161.41:65433] [client 34.60.161.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.60.161.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWE8qR5QbaVZ-6newJZo4QAAAhU"]
[Sat Jan 10 01:36:43.264151 2026] [:error] [pid 14770:tid 14779] [client 34.60.161.41:65433] [client 34.60.161.41] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aWE8qx5QbaVZ-6newJZo5AAAAgc"]
[Sat Jan 10 01:36:43.464395 2026] [:error] [pid 14770:tid 14775] [client 34.60.161.41:65433] [client 34.60.161.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.60.161.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWE8qx5QbaVZ-6newJZo5QAAAgM"]
[Sat Jan 10 01:36:44.808686 2026] [:error] [pid 30019:tid 30028] [client 34.60.161.41:63862] [client 34.60.161.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.60.161.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWE8rEz3igHGwX5f7IoeBAAAAAQ"]
[Sat Jan 10 01:36:46.163783 2026] [:error] [pid 1366:tid 1376] [client 34.60.161.41:51960] [client 34.60.161.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.60.161.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWE8rhmasveKu8_ec1XBJQAAAYc"]
[Sat Jan 10 01:36:46.168652 2026] [:error] [pid 1366:tid 1376] [client 34.60.161.41:51960] [client 34.60.161.41] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/usr/local/apache/modsecurity-cwaf/rules/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 34.60.161.41 (+1 hits since last alert)|expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWE8rhmasveKu8_ec1XBJQAAAYc"]
[Sat Jan 10 01:36:46.212951 2026] [:error] [pid 44848:tid 44860] [client 106.119.167.146:45945] [client 106.119.167.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWE8rqjajoTJAbEk87wI0QAAAEo"]
[Sat Jan 10 02:05:52.732589 2026] [:error] [pid 30020:tid 30057] [client 181.2.144.58:50384] [client 181.2.144.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.2.144.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWFDgMrjc66qOisG6L0F-gAAAIM"]
[Sat Jan 10 03:33:44.390908 2026] [:error] [pid 30021:tid 30091] [client 51.159.214.31:46368] [client 51.159.214.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.214.31, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWFYGA_M8aRtsTog5J_k5QAAAMo"]
[Sat Jan 10 04:16:21.771319 2026] [:error] [pid 20647:tid 20694] [client 13.229.94.19:60106] [client 13.229.94.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aWFiFavb0x69MarUHzCNjwAAAEw"]
[Sat Jan 10 04:16:22.446031 2026] [:error] [pid 20646:tid 20676] [client 13.229.94.19:60314] [client 13.229.94.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aWFiFiKwdq_UhOM64b6T5gAAABU"]
[Sat Jan 10 04:16:24.831928 2026] [:error] [pid 20744:tid 20779] [client 13.229.94.19:60808] [client 13.229.94.19] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/backup.sql"] [unique_id "aWFiGEA8oR5jvkFpcP8_vQAAANY"]
[Sat Jan 10 04:16:25.510654 2026] [:error] [pid 20744:tid 20763] [client 13.229.94.19:60958] [client 13.229.94.19] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/debug.log"] [unique_id "aWFiGUA8oR5jvkFpcP8_vgAAAMY"]
[Sat Jan 10 04:16:26.191143 2026] [:error] [pid 20744:tid 20769] [client 13.229.94.19:32890] [client 13.229.94.19] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/database.sql"] [unique_id "aWFiGkA8oR5jvkFpcP8_wQAAAMw"]
[Sat Jan 10 04:16:26.866449 2026] [:error] [pid 20744:tid 20761] [client 13.229.94.19:33054] [client 13.229.94.19] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/storage/logs/laravel.log"] [unique_id "aWFiGkA8oR5jvkFpcP8_wgAAAMQ"]
[Sat Jan 10 04:16:33.956778 2026] [:error] [pid 20648:tid 20719] [client 13.229.94.19:34396] [client 13.229.94.19] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/dump.sql"] [unique_id "aWFiITBnnIoBkEBdx9DqoQAAAIo"]
[Sat Jan 10 04:16:36.203296 2026] [:error] [pid 20646:tid 20660] [client 13.229.94.19:34884] [client 13.229.94.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/api/.env"] [unique_id "aWFiJCKwdq_UhOM64b6T7wAAAAU"]
[Sat Jan 10 04:16:36.876309 2026] [:error] [pid 20646:tid 20671] [client 13.229.94.19:35018] [client 13.229.94.19] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/log/error.log"] [unique_id "aWFiJCKwdq_UhOM64b6T8gAAABA"]
[Sat Jan 10 04:16:37.549631 2026] [:error] [pid 20646:tid 20677] [client 13.229.94.19:35144] [client 13.229.94.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/backend/.env"] [unique_id "aWFiJSKwdq_UhOM64b6T8wAAABY"]
[Sat Jan 10 04:16:42.993260 2026] [:error] [pid 20744:tid 20775] [client 13.229.94.19:36722] [client 13.229.94.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.local"] [unique_id "aWFiKkA8oR5jvkFpcP8_3AAAANI"]
[Sat Jan 10 04:16:45.261287 2026] [:error] [pid 20647:tid 20692] [client 13.229.94.19:37198] [client 13.229.94.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.production"] [unique_id "aWFiLavb0x69MarUHzCNpAAAAEo"]
[Sat Jan 10 04:16:45.934614 2026] [:error] [pid 20648:tid 20724] [client 13.229.94.19:37334] [client 13.229.94.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/admin/.env"] [unique_id "aWFiLTBnnIoBkEBdx9DqpwAAAI8"]
[Sat Jan 10 04:16:46.610884 2026] [:error] [pid 20744:tid 20780] [client 13.229.94.19:37472] [client 13.229.94.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/core/.env"] [unique_id "aWFiLkA8oR5jvkFpcP8_5gAAANc"]
[Sat Jan 10 04:16:47.287258 2026] [:error] [pid 20744:tid 20760] [client 13.229.94.19:37582] [client 13.229.94.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/laravel/.env"] [unique_id "aWFiL0A8oR5jvkFpcP8_5wAAAMM"]
[Sat Jan 10 04:16:49.569266 2026] [:error] [pid 20647:tid 20688] [client 13.229.94.19:37968] [client 13.229.94.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/config/.env"] [unique_id "aWFiMavb0x69MarUHzCNqwAAAEY"]
[Sat Jan 10 04:16:50.245536 2026] [:error] [pid 20744:tid 20763] [client 13.229.94.19:38078] [client 13.229.94.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/app/.env"] [unique_id "aWFiMkA8oR5jvkFpcP8_6gAAAMY"]
[Sat Jan 10 04:16:50.919800 2026] [:error] [pid 20648:tid 20719] [client 13.229.94.19:38194] [client 13.229.94.19] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/src/.env"] [unique_id "aWFiMjBnnIoBkEBdx9DqrwAAAIo"]
[Sat Jan 10 04:59:52.495213 2026] [:error] [pid 20647:tid 20705] [client 62.138.0.210:56768] [client 62.138.0.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.138.0.210, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWFsSKvb0x69MarUHzCZygAAAFc"]
[Sat Jan 10 06:23:27.227420 2026] [:error] [pid 20647:tid 20687] [client 62.138.0.210:41212] [client 62.138.0.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.138.0.210, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWF_36vb0x69MarUHzCuNgAAAEU"]
[Sat Jan 10 06:52:53.315179 2026] [:error] [pid 31369:tid 31379] [client 90.156.142.31:14052] [client 90.156.142.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 90.156.142.31, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWGGxbgqeMKgT1uTxuL8TgAAAUg"]
[Sat Jan 10 07:32:55.648759 2026] [:error] [pid 19926:tid 19947] [client 36.41.75.167:60565] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWGQJyS03bq9jOoBYpM-XgAAARM"]
[Sat Jan 10 07:44:20.505756 2026] [:error] [pid 20648:tid 20716] [client 185.110.146.106:39114] [client 185.110.146.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.110.146.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWGS1DBnnIoBkEBdx9Ab8QAAAIc"]
[Sat Jan 10 09:06:37.229844 2026] [:error] [pid 20647:tid 20693] [client 204.48.18.182:56708] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWGmHavb0x69MarUHzDGAgAAAEs"]
[Sat Jan 10 09:43:28.461650 2026] [autoindex:error] [pid 20744:tid 20777] [client 138.199.19.193:48962] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:43:28.792810 2026] [autoindex:error] [pid 20744:tid 20763] [client 138.199.19.193:48962] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:43:29.084409 2026] [autoindex:error] [pid 20744:tid 20766] [client 138.199.19.193:48962] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:43:29.381768 2026] [autoindex:error] [pid 20744:tid 20760] [client 138.199.19.193:48962] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:43:29.681939 2026] [autoindex:error] [pid 20744:tid 20776] [client 138.199.19.193:48962] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:43:30.007588 2026] [autoindex:error] [pid 20744:tid 20761] [client 138.199.19.193:48962] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:43:30.299389 2026] [autoindex:error] [pid 20744:tid 20759] [client 138.199.19.193:48962] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:43:30.590075 2026] [autoindex:error] [pid 20744:tid 20779] [client 138.199.19.193:48962] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:43:35.497874 2026] [autoindex:error] [pid 20744:tid 20771] [client 138.199.19.193:48962] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:43:36.095333 2026] [autoindex:error] [pid 20744:tid 20781] [client 138.199.19.193:48962] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:43:36.395814 2026] [autoindex:error] [pid 20744:tid 20778] [client 138.199.19.193:48962] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:43:36.692611 2026] [autoindex:error] [pid 20744:tid 20774] [client 138.199.19.193:48962] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:43:37.001071 2026] [autoindex:error] [pid 20744:tid 20766] [client 138.199.19.193:48962] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:43:40.414488 2026] [autoindex:error] [pid 20744:tid 20761] [client 138.199.19.193:48962] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:43:44.263487 2026] [:error] [pid 20744:tid 20780] [client 138.199.19.193:48962] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/web/"] [unique_id "aWGu0EA8oR5jvkFpcP-UWwAAANc"]
[Sat Jan 10 09:43:44.881970 2026] [:error] [pid 31369:tid 31388] [client 138.199.19.193:43350] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/web/"] [unique_id "aWGu0LgqeMKgT1uTxuImUgAAAVE"]
[Sat Jan 10 09:43:45.560593 2026] [:error] [pid 31369:tid 31376] [client 138.199.19.193:43366] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/web/"] [unique_id "aWGu0bgqeMKgT1uTxuImUwAAAUU"]
[Sat Jan 10 09:43:46.232136 2026] [:error] [pid 20744:tid 20763] [client 138.199.19.193:43368] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/web/"] [unique_id "aWGu0kA8oR5jvkFpcP-UXQAAAMY"]
[Sat Jan 10 09:43:46.853724 2026] [:error] [pid 20646:tid 20665] [client 138.199.19.193:43374] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/"] [unique_id "aWGu0iKwdq_UhOM64b7PewAAAAo"]
[Sat Jan 10 09:43:47.560341 2026] [:error] [pid 20648:tid 20731] [client 138.199.19.193:43390] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/"] [unique_id "aWGu0zBnnIoBkEBdx9Au_wAAAJY"]
[Sat Jan 10 09:43:48.149792 2026] [:error] [pid 20646:tid 20671] [client 138.199.19.193:43396] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/"] [unique_id "aWGu1CKwdq_UhOM64b7PfQAAABA"]
[Sat Jan 10 09:43:48.755512 2026] [:error] [pid 31369:tid 31378] [client 138.199.19.193:43406] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/"] [unique_id "aWGu1LgqeMKgT1uTxuImVwAAAUc"]
[Sat Jan 10 09:43:49.351048 2026] [:error] [pid 19926:tid 19946] [client 138.199.19.193:43414] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/"] [unique_id "aWGu1SS03bq9jOoBYpNOtQAAARI"]
[Sat Jan 10 09:43:49.945686 2026] [:error] [pid 20646:tid 20662] [client 138.199.19.193:43416] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/"] [unique_id "aWGu1SKwdq_UhOM64b7PfwAAAAc"]
[Sat Jan 10 09:43:50.650087 2026] [:error] [pid 20744:tid 20780] [client 138.199.19.193:59018] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/"] [unique_id "aWGu1kA8oR5jvkFpcP-UbQAAANc"]
[Sat Jan 10 09:43:51.248011 2026] [:error] [pid 31369:tid 31390] [client 138.199.19.193:59032] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/"] [unique_id "aWGu17gqeMKgT1uTxuImZwAAAVM"]
[Sat Jan 10 09:43:51.853440 2026] [:error] [pid 20647:tid 20693] [client 138.199.19.193:59034] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/"] [unique_id "aWGu16vb0x69MarUHzDKDgAAAEs"]
[Sat Jan 10 09:43:52.451790 2026] [:error] [pid 20647:tid 20696] [client 138.199.19.193:59046] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/"] [unique_id "aWGu2Kvb0x69MarUHzDKEwAAAE4"]
[Sat Jan 10 09:43:53.126108 2026] [:error] [pid 20648:tid 20716] [client 138.199.19.193:59052] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/"] [unique_id "aWGu2TBnnIoBkEBdx9AvBAAAAIc"]
[Sat Jan 10 09:43:53.731806 2026] [:error] [pid 20648:tid 20730] [client 138.199.19.193:59056] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/"] [unique_id "aWGu2TBnnIoBkEBdx9AvBgAAAJU"]
[Sat Jan 10 09:43:54.361772 2026] [:error] [pid 31369:tid 31391] [client 138.199.19.193:59062] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Admin/uploads/"] [unique_id "aWGu2rgqeMKgT1uTxuImegAAAVQ"]
[Sat Jan 10 09:43:55.059341 2026] [:error] [pid 20647:tid 20698] [client 138.199.19.193:59066] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Admin/uploads/"] [unique_id "aWGu26vb0x69MarUHzDKFQAAAFA"]
[Sat Jan 10 09:43:55.835850 2026] [:error] [pid 20648:tid 20712] [client 138.199.19.193:59080] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Admin/uploads/"] [unique_id "aWGu2zBnnIoBkEBdx9AvBwAAAIM"]
[Sat Jan 10 09:43:56.524782 2026] [:error] [pid 20648:tid 20727] [client 138.199.19.193:59086] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Admin/uploads/"] [unique_id "aWGu3DBnnIoBkEBdx9AvCQAAAJI"]
[Sat Jan 10 09:43:57.343805 2026] [:error] [pid 31369:tid 31393] [client 138.199.19.193:59090] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/"] [unique_id "aWGu3bgqeMKgT1uTxuImewAAAVY"]
[Sat Jan 10 09:43:58.026237 2026] [:error] [pid 20646:tid 20674] [client 138.199.19.193:59096] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/"] [unique_id "aWGu3iKwdq_UhOM64b7PjwAAABM"]
[Sat Jan 10 09:43:58.732762 2026] [:error] [pid 31369:tid 31375] [client 138.199.19.193:59098] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/"] [unique_id "aWGu3rgqeMKgT1uTxuImfAAAAUQ"]
[Sat Jan 10 09:43:59.639093 2026] [:error] [pid 20744:tid 20760] [client 138.199.19.193:59104] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/"] [unique_id "aWGu30A8oR5jvkFpcP-UiAAAAMM"]
[Sat Jan 10 09:44:00.334628 2026] [:error] [pid 31369:tid 31373] [client 138.199.19.193:47626] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/"] [unique_id "aWGu4LgqeMKgT1uTxuImfwAAAUI"]
[Sat Jan 10 09:44:01.032389 2026] [:error] [pid 20744:tid 20779] [client 138.199.19.193:47632] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/"] [unique_id "aWGu4UA8oR5jvkFpcP-UigAAANY"]
[Sat Jan 10 09:44:01.727662 2026] [:error] [pid 20647:tid 20684] [client 138.199.19.193:47636] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/"] [unique_id "aWGu4avb0x69MarUHzDKGgAAAEI"]
[Sat Jan 10 09:44:02.370218 2026] [:error] [pid 19926:tid 19935] [client 138.199.19.193:47644] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/"] [unique_id "aWGu4iS03bq9jOoBYpNOxQAAAQc"]
[Sat Jan 10 09:44:03.156696 2026] [:error] [pid 19926:tid 19952] [client 138.199.19.193:47650] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/"] [unique_id "aWGu4yS03bq9jOoBYpNOxgAAARg"]
[Sat Jan 10 09:44:03.762125 2026] [:error] [pid 31369:tid 31394] [client 138.199.19.193:47662] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/"] [unique_id "aWGu47gqeMKgT1uTxuImhAAAAVc"]
[Sat Jan 10 09:44:04.360488 2026] [:error] [pid 31369:tid 31376] [client 138.199.19.193:47678] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/"] [unique_id "aWGu5LgqeMKgT1uTxuImhQAAAUU"]
[Sat Jan 10 09:44:05.234220 2026] [:error] [pid 20647:tid 20703] [client 138.199.19.193:47690] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/"] [unique_id "aWGu5avb0x69MarUHzDKHAAAAFU"]
[Sat Jan 10 09:44:05.855426 2026] [:error] [pid 31369:tid 31386] [client 138.199.19.193:47700] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/"] [unique_id "aWGu5bgqeMKgT1uTxuImiAAAAU8"]
[Sat Jan 10 09:44:06.735260 2026] [:error] [pid 31369:tid 31395] [client 138.199.19.193:47704] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/"] [unique_id "aWGu5rgqeMKgT1uTxuImigAAAVg"]
[Sat Jan 10 09:44:07.431916 2026] [:error] [pid 31369:tid 31375] [client 138.199.19.193:47712] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/"] [unique_id "aWGu57gqeMKgT1uTxuImjAAAAUQ"]
[Sat Jan 10 09:44:08.055777 2026] [:error] [pid 31369:tid 31372] [client 138.199.19.193:47718] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/"] [unique_id "aWGu6LgqeMKgT1uTxuImjQAAAUE"]
[Sat Jan 10 09:44:08.728759 2026] [:error] [pid 20646:tid 20668] [client 138.199.19.193:47730] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/image/"] [unique_id "aWGu6CKwdq_UhOM64b7PlAAAAA0"]
[Sat Jan 10 09:44:09.349065 2026] [:error] [pid 19926:tid 19948] [client 138.199.19.193:47744] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/image/"] [unique_id "aWGu6SS03bq9jOoBYpNOyQAAARQ"]
[Sat Jan 10 09:44:10.029908 2026] [:error] [pid 31369:tid 31392] [client 138.199.19.193:49838] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/image/"] [unique_id "aWGu6rgqeMKgT1uTxuImkQAAAVU"]
[Sat Jan 10 09:44:11.025059 2026] [:error] [pid 20648:tid 20715] [client 138.199.19.193:49844] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/image/"] [unique_id "aWGu6zBnnIoBkEBdx9AvCwAAAIY"]
[Sat Jan 10 09:44:11.728181 2026] [:error] [pid 19926:tid 19951] [client 138.199.19.193:49860] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/images/"] [unique_id "aWGu6yS03bq9jOoBYpNOywAAARc"]
[Sat Jan 10 09:44:12.669398 2026] [:error] [pid 31369:tid 31382] [client 138.199.19.193:49862] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/images/"] [unique_id "aWGu7LgqeMKgT1uTxuImlAAAAUs"]
[Sat Jan 10 09:44:13.626500 2026] [:error] [pid 31369:tid 31395] [client 138.199.19.193:49876] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/images/"] [unique_id "aWGu7bgqeMKgT1uTxuImlwAAAVg"]
[Sat Jan 10 09:44:14.367204 2026] [:error] [pid 20648:tid 20716] [client 138.199.19.193:49882] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/images/"] [unique_id "aWGu7jBnnIoBkEBdx9AvEQAAAIc"]
[Sat Jan 10 09:44:15.054915 2026] [:error] [pid 31369:tid 31379] [client 138.199.19.193:49890] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Public/"] [unique_id "aWGu77gqeMKgT1uTxuImnAAAAUg"]
[Sat Jan 10 09:44:15.649612 2026] [:error] [pid 31369:tid 31371] [client 138.199.19.193:49902] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Public/"] [unique_id "aWGu77gqeMKgT1uTxuImnQAAAUA"]
[Sat Jan 10 09:44:16.626983 2026] [:error] [pid 31369:tid 31376] [client 138.199.19.193:49908] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Public/"] [unique_id "aWGu8LgqeMKgT1uTxuImngAAAUU"]
[Sat Jan 10 09:44:17.260685 2026] [:error] [pid 31369:tid 31377] [client 138.199.19.193:49912] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Public/"] [unique_id "aWGu8bgqeMKgT1uTxuImoAAAAUY"]
[Sat Jan 10 09:44:17.868192 2026] [:error] [pid 20648:tid 20728] [client 138.199.19.193:49928] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/"] [unique_id "aWGu8TBnnIoBkEBdx9AvEgAAAJM"]
[Sat Jan 10 09:44:18.656230 2026] [:error] [pid 31369:tid 31374] [client 138.199.19.193:49940] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/"] [unique_id "aWGu8rgqeMKgT1uTxuImoQAAAUM"]
[Sat Jan 10 09:44:19.440780 2026] [:error] [pid 31369:tid 31391] [client 138.199.19.193:49954] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/"] [unique_id "aWGu87gqeMKgT1uTxuImowAAAVQ"]
[Sat Jan 10 09:44:20.366362 2026] [:error] [pid 31369:tid 31372] [client 138.199.19.193:55614] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/"] [unique_id "aWGu9LgqeMKgT1uTxuImpQAAAUE"]
[Sat Jan 10 09:44:20.973916 2026] [:error] [pid 20647:tid 20697] [client 138.199.19.193:55624] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/local/"] [unique_id "aWGu9Kvb0x69MarUHzDKIQAAAE8"]
[Sat Jan 10 09:44:21.578401 2026] [:error] [pid 20647:tid 20691] [client 138.199.19.193:55628] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/local/"] [unique_id "aWGu9avb0x69MarUHzDKIgAAAEk"]
[Sat Jan 10 09:44:22.166129 2026] [:error] [pid 20647:tid 20706] [client 138.199.19.193:55640] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/local/"] [unique_id "aWGu9qvb0x69MarUHzDKIwAAAFg"]
[Sat Jan 10 09:44:22.826376 2026] [:error] [pid 20646:tid 20655] [client 138.199.19.193:55642] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/local/"] [unique_id "aWGu9iKwdq_UhOM64b7PmgAAAAA"]
[Sat Jan 10 09:44:23.426628 2026] [:error] [pid 19926:tid 19928] [client 138.199.19.193:55648] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/modules/"] [unique_id "aWGu9yS03bq9jOoBYpNOzQAAAQA"]
[Sat Jan 10 09:44:24.372044 2026] [:error] [pid 20744:tid 20775] [client 138.199.19.193:55650] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/modules/"] [unique_id "aWGu-EA8oR5jvkFpcP-UkwAAANI"]
[Sat Jan 10 09:44:24.950208 2026] [:error] [pid 20647:tid 20686] [client 138.199.19.193:55654] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/modules/"] [unique_id "aWGu-Kvb0x69MarUHzDKNgAAAEQ"]
[Sat Jan 10 09:44:25.570913 2026] [:error] [pid 20648:tid 20717] [client 138.199.19.193:55666] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/modules/"] [unique_id "aWGu-TBnnIoBkEBdx9AvFQAAAIg"]
[Sat Jan 10 09:44:26.160417 2026] [:error] [pid 20646:tid 20662] [client 138.199.19.193:55674] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Site/"] [unique_id "aWGu-iKwdq_UhOM64b7PogAAAAc"]
[Sat Jan 10 09:44:26.925984 2026] [:error] [pid 20648:tid 20724] [client 138.199.19.193:55676] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Site/"] [unique_id "aWGu-jBnnIoBkEBdx9AvFgAAAI8"]
[Sat Jan 10 09:44:27.567735 2026] [:error] [pid 20646:tid 20672] [client 138.199.19.193:55692] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Site/"] [unique_id "aWGu-yKwdq_UhOM64b7PpAAAABE"]
[Sat Jan 10 09:44:28.275108 2026] [:error] [pid 31369:tid 31391] [client 138.199.19.193:55706] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Site/"] [unique_id "aWGu_LgqeMKgT1uTxuImsQAAAVQ"]
[Sat Jan 10 09:44:28.861985 2026] [:error] [pid 20648:tid 20721] [client 138.199.19.193:55714] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system/"] [unique_id "aWGu_DBnnIoBkEBdx9AvFwAAAIw"]
[Sat Jan 10 09:44:29.532889 2026] [:error] [pid 20648:tid 20710] [client 138.199.19.193:55718] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system/"] [unique_id "aWGu_TBnnIoBkEBdx9AvGAAAAIE"]
[Sat Jan 10 09:44:30.259825 2026] [:error] [pid 19926:tid 19950] [client 138.199.19.193:36684] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system/"] [unique_id "aWGu_iS03bq9jOoBYpNO1QAAARY"]
[Sat Jan 10 09:44:30.927979 2026] [:error] [pid 31369:tid 31393] [client 138.199.19.193:36686] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system/"] [unique_id "aWGu_rgqeMKgT1uTxuImtQAAAVY"]
[Sat Jan 10 09:44:31.569787 2026] [:error] [pid 20646:tid 20673] [client 138.199.19.193:36696] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/template/"] [unique_id "aWGu_yKwdq_UhOM64b7PpQAAABI"]
[Sat Jan 10 09:44:32.356712 2026] [:error] [pid 20648:tid 20731] [client 138.199.19.193:36706] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/template/"] [unique_id "aWGvADBnnIoBkEBdx9AvGgAAAJY"]
[Sat Jan 10 09:44:32.978388 2026] [:error] [pid 31369:tid 31394] [client 138.199.19.193:36710] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/template/"] [unique_id "aWGvALgqeMKgT1uTxuImugAAAVc"]
[Sat Jan 10 09:44:33.633008 2026] [:error] [pid 20647:tid 20689] [client 138.199.19.193:36716] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/template/"] [unique_id "aWGvAavb0x69MarUHzDKPQAAAEc"]
[Sat Jan 10 09:44:34.246075 2026] [:error] [pid 20648:tid 20726] [client 138.199.19.193:36718] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop/"] [unique_id "aWGvAjBnnIoBkEBdx9AvHAAAAJE"]
[Sat Jan 10 09:44:34.864663 2026] [:error] [pid 20744:tid 20769] [client 138.199.19.193:36720] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop/"] [unique_id "aWGvAkA8oR5jvkFpcP-UmAAAAMw"]
[Sat Jan 10 09:44:35.530572 2026] [:error] [pid 19926:tid 19952] [client 138.199.19.193:36730] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop/"] [unique_id "aWGvAyS03bq9jOoBYpNO1wAAARg"]
[Sat Jan 10 09:44:36.153626 2026] [:error] [pid 31369:tid 31380] [client 138.199.19.193:36736] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop/"] [unique_id "aWGvBLgqeMKgT1uTxuImvwAAAUk"]
[Sat Jan 10 09:44:36.763219 2026] [:error] [pid 31369:tid 31392] [client 138.199.19.193:36738] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files/"] [unique_id "aWGvBLgqeMKgT1uTxuImwQAAAVU"]
[Sat Jan 10 09:44:37.365132 2026] [:error] [pid 31369:tid 31379] [client 138.199.19.193:36740] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files/"] [unique_id "aWGvBbgqeMKgT1uTxuImwwAAAUg"]
[Sat Jan 10 09:44:37.965169 2026] [:error] [pid 31369:tid 31376] [client 138.199.19.193:36746] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files/"] [unique_id "aWGvBbgqeMKgT1uTxuImxQAAAUU"]
[Sat Jan 10 09:44:38.581189 2026] [:error] [pid 31369:tid 31384] [client 138.199.19.193:36750] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files/"] [unique_id "aWGvBrgqeMKgT1uTxuImyAAAAU0"]
[Sat Jan 10 09:44:39.325999 2026] [:error] [pid 20646:tid 20658] [client 138.199.19.193:36764] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/editor/"] [unique_id "aWGvByKwdq_UhOM64b7PqAAAAAM"]
[Sat Jan 10 09:44:39.967267 2026] [:error] [pid 19926:tid 19951] [client 138.199.19.193:36772] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/editor/"] [unique_id "aWGvByS03bq9jOoBYpNO2AAAARc"]
[Sat Jan 10 09:44:40.550702 2026] [:error] [pid 20648:tid 20730] [client 138.199.19.193:33202] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/editor/"] [unique_id "aWGvCDBnnIoBkEBdx9AvHwAAAJU"]
[Sat Jan 10 09:44:41.224597 2026] [:error] [pid 19926:tid 19938] [client 138.199.19.193:33208] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/editor/"] [unique_id "aWGvCSS03bq9jOoBYpNO2gAAAQo"]
[Sat Jan 10 09:44:41.833326 2026] [:error] [pid 20744:tid 20774] [client 138.199.19.193:33222] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/include/"] [unique_id "aWGvCUA8oR5jvkFpcP-UnQAAANE"]
[Sat Jan 10 09:44:42.566952 2026] [:error] [pid 20648:tid 20727] [client 138.199.19.193:33228] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/include/"] [unique_id "aWGvCjBnnIoBkEBdx9AvIgAAAJI"]
[Sat Jan 10 09:44:48.279704 2026] [autoindex:error] [pid 20646:tid 20662] [client 138.199.19.193:33230] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:44:50.860201 2026] [autoindex:error] [pid 20646:tid 20673] [client 138.199.19.193:33230] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:44:51.161682 2026] [authz_core:error] [pid 20646:tid 20664] [client 138.199.19.193:33230] AH01630: client denied by server configuration: /home/expressi/public_html/wp-content/plugins/akismet/
[Sat Jan 10 09:44:51.497305 2026] [autoindex:error] [pid 20646:tid 20663] [client 138.199.19.193:33230] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:44:51.786756 2026] [autoindex:error] [pid 20646:tid 20660] [client 138.199.19.193:33230] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:44:52.077787 2026] [autoindex:error] [pid 20646:tid 20659] [client 138.199.19.193:33230] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:44:52.396372 2026] [autoindex:error] [pid 20646:tid 20655] [client 138.199.19.193:33230] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:44:52.698613 2026] [autoindex:error] [pid 20646:tid 20678] [client 138.199.19.193:33230] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:44:52.995620 2026] [autoindex:error] [pid 20646:tid 20675] [client 138.199.19.193:33230] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/php-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:44:53.365711 2026] [autoindex:error] [pid 20646:tid 20674] [client 138.199.19.193:33230] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:44:53.669397 2026] [autoindex:error] [pid 20646:tid 20666] [client 138.199.19.193:33230] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:44:54.870779 2026] [autoindex:error] [pid 20646:tid 20665] [client 138.199.19.193:33230] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:44:55.172732 2026] [autoindex:error] [pid 20646:tid 20669] [client 138.199.19.193:33230] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:44:55.500087 2026] [autoindex:error] [pid 20646:tid 20657] [client 138.199.19.193:33230] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:44:55.798453 2026] [autoindex:error] [pid 20646:tid 20677] [client 138.199.19.193:33230] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:44:56.113104 2026] [autoindex:error] [pid 20646:tid 20673] [client 138.199.19.193:33230] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:44:56.402924 2026] [autoindex:error] [pid 20646:tid 20664] [client 138.199.19.193:33230] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:44:56.705135 2026] [autoindex:error] [pid 20646:tid 20663] [client 138.199.19.193:33230] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:44:56.998248 2026] [autoindex:error] [pid 20646:tid 20660] [client 138.199.19.193:33230] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 09:44:59.870364 2026] [:error] [pid 20646:tid 20676] [client 138.199.19.193:33230] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/controller/extension/extension/"] [unique_id "aWGvGyKwdq_UhOM64b7PzgAAABU"]
[Sat Jan 10 09:45:00.562430 2026] [:error] [pid 31369:tid 31394] [client 138.199.19.193:46990] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/controller/extension/extension/"] [unique_id "aWGvHLgqeMKgT1uTxuIm4wAAAVc"]
[Sat Jan 10 09:45:01.160738 2026] [:error] [pid 20647:tid 20692] [client 138.199.19.193:46992] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/controller/extension/extension/"] [unique_id "aWGvHavb0x69MarUHzDKUQAAAEo"]
[Sat Jan 10 09:45:01.862029 2026] [:error] [pid 20744:tid 20758] [client 138.199.19.193:46996] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/controller/extension/extension/"] [unique_id "aWGvHUA8oR5jvkFpcP-UpwAAAME"]
[Sat Jan 10 09:45:02.533163 2026] [:error] [pid 19926:tid 19939] [client 138.199.19.193:47004] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/"] [unique_id "aWGvHiS03bq9jOoBYpNO4wAAAQs"]
[Sat Jan 10 09:45:03.169418 2026] [:error] [pid 20744:tid 20762] [client 138.199.19.193:47014] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/"] [unique_id "aWGvH0A8oR5jvkFpcP-UqQAAAMU"]
[Sat Jan 10 09:45:04.027132 2026] [:error] [pid 20648:tid 20713] [client 138.199.19.193:47028] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/"] [unique_id "aWGvIDBnnIoBkEBdx9AvLQAAAIQ"]
[Sat Jan 10 09:45:04.827474 2026] [:error] [pid 20646:tid 20667] [client 138.199.19.193:47038] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/modules/mod_simplefileuploadv1.3/elements/"] [unique_id "aWGvICKwdq_UhOM64b7PzwAAAAw"]
[Sat Jan 10 09:45:05.531291 2026] [:error] [pid 20648:tid 20714] [client 138.199.19.193:47046] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/components/"] [unique_id "aWGvITBnnIoBkEBdx9AvLgAAAIU"]
[Sat Jan 10 09:45:06.131201 2026] [:error] [pid 20648:tid 20720] [client 138.199.19.193:47052] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/components/"] [unique_id "aWGvIjBnnIoBkEBdx9AvLwAAAIs"]
[Sat Jan 10 09:45:06.753358 2026] [:error] [pid 20646:tid 20671] [client 138.199.19.193:47066] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/components/"] [unique_id "aWGvIiKwdq_UhOM64b7P0gAAABA"]
[Sat Jan 10 09:45:07.348301 2026] [:error] [pid 20646:tid 20656] [client 138.199.19.193:47074] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/components/"] [unique_id "aWGvIyKwdq_UhOM64b7P0wAAAAE"]
[Sat Jan 10 09:45:07.965983 2026] [:error] [pid 20646:tid 20665] [client 138.199.19.193:47086] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/images/"] [unique_id "aWGvIyKwdq_UhOM64b7P1QAAAAo"]
[Sat Jan 10 09:45:08.647013 2026] [:error] [pid 20647:tid 20706] [client 138.199.19.193:47088] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/images/"] [unique_id "aWGvJKvb0x69MarUHzDKVQAAAFg"]
[Sat Jan 10 09:45:09.264626 2026] [:error] [pid 20648:tid 20725] [client 138.199.19.193:47104] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/images/"] [unique_id "aWGvJTBnnIoBkEBdx9AvMAAAAJA"]
[Sat Jan 10 09:45:09.931492 2026] [:error] [pid 20648:tid 20721] [client 138.199.19.193:47112] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/images/"] [unique_id "aWGvJTBnnIoBkEBdx9AvMgAAAIw"]
[Sat Jan 10 09:45:10.561490 2026] [:error] [pid 20648:tid 20724] [client 138.199.19.193:60722] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/"] [unique_id "aWGvJjBnnIoBkEBdx9AvMwAAAI8"]
[Sat Jan 10 09:45:11.225219 2026] [:error] [pid 19926:tid 19934] [client 138.199.19.193:60724] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/"] [unique_id "aWGvJyS03bq9jOoBYpNO5AAAAQY"]
[Sat Jan 10 09:45:11.826865 2026] [:error] [pid 20648:tid 20722] [client 138.199.19.193:60738] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/"] [unique_id "aWGvJzBnnIoBkEBdx9AvNQAAAI0"]
[Sat Jan 10 09:45:12.437427 2026] [:error] [pid 20648:tid 20718] [client 138.199.19.193:60740] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/"] [unique_id "aWGvKDBnnIoBkEBdx9AvNwAAAIk"]
[Sat Jan 10 09:45:13.171265 2026] [:error] [pid 31369:tid 31375] [client 138.199.19.193:60754] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/fonts/"] [unique_id "aWGvKbgqeMKgT1uTxuIm6AAAAUQ"]
[Sat Jan 10 09:45:13.756950 2026] [:error] [pid 20648:tid 20729] [client 138.199.19.193:60762] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/fonts/"] [unique_id "aWGvKTBnnIoBkEBdx9AvOQAAAJQ"]
[Sat Jan 10 09:45:14.344795 2026] [:error] [pid 20648:tid 20719] [client 138.199.19.193:60770] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/fonts/"] [unique_id "aWGvKjBnnIoBkEBdx9AvOgAAAIo"]
[Sat Jan 10 09:45:15.034904 2026] [:error] [pid 20648:tid 20716] [client 138.199.19.193:60784] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/fonts/"] [unique_id "aWGvKzBnnIoBkEBdx9AvOwAAAIc"]
[Sat Jan 10 09:45:15.645858 2026] [:error] [pid 20744:tid 20764] [client 138.199.19.193:60786] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/admin/js/"] [unique_id "aWGvK0A8oR5jvkFpcP-UrQAAAMc"]
[Sat Jan 10 09:45:16.257127 2026] [:error] [pid 20744:tid 20768] [client 138.199.19.193:60796] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/admin/js/"] [unique_id "aWGvLEA8oR5jvkFpcP-UrgAAAMs"]
[Sat Jan 10 09:45:16.854615 2026] [:error] [pid 20744:tid 20767] [client 138.199.19.193:60800] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/admin/js/"] [unique_id "aWGvLEA8oR5jvkFpcP-UrwAAAMo"]
[Sat Jan 10 09:45:17.446940 2026] [:error] [pid 19926:tid 19950] [client 138.199.19.193:60816] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/admin/js/"] [unique_id "aWGvLSS03bq9jOoBYpNO6gAAARY"]
[Sat Jan 10 09:45:18.073595 2026] [:error] [pid 31369:tid 31387] [client 138.199.19.193:60820] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/"] [unique_id "aWGvLrgqeMKgT1uTxuIm7AAAAVA"]
[Sat Jan 10 09:45:18.750976 2026] [:error] [pid 31369:tid 31383] [client 138.199.19.193:60822] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/"] [unique_id "aWGvLrgqeMKgT1uTxuIm7gAAAUw"]
[Sat Jan 10 09:45:19.382407 2026] [:error] [pid 31369:tid 31373] [client 138.199.19.193:60830] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/"] [unique_id "aWGvL7gqeMKgT1uTxuIm7wAAAUI"]
[Sat Jan 10 09:45:19.974208 2026] [:error] [pid 31369:tid 31385] [client 138.199.19.193:60834] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/"] [unique_id "aWGvL7gqeMKgT1uTxuIm8QAAAU4"]
[Sat Jan 10 09:45:20.650683 2026] [:error] [pid 20744:tid 20769] [client 138.199.19.193:36118] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/"] [unique_id "aWGvMEA8oR5jvkFpcP-UsAAAAMw"]
[Sat Jan 10 09:45:21.259869 2026] [:error] [pid 20744:tid 20770] [client 138.199.19.193:36120] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/"] [unique_id "aWGvMUA8oR5jvkFpcP-UsQAAAM0"]
[Sat Jan 10 09:45:21.866127 2026] [:error] [pid 20744:tid 20780] [client 138.199.19.193:36134] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/"] [unique_id "aWGvMUA8oR5jvkFpcP-UswAAANc"]
[Sat Jan 10 09:45:22.456266 2026] [:error] [pid 20744:tid 20773] [client 138.199.19.193:36150] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/"] [unique_id "aWGvMkA8oR5jvkFpcP-UtAAAANA"]
[Sat Jan 10 09:45:23.133437 2026] [:error] [pid 19926:tid 19937] [client 138.199.19.193:36162] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/"] [unique_id "aWGvMyS03bq9jOoBYpNO6wAAAQk"]
[Sat Jan 10 09:45:23.924331 2026] [:error] [pid 20744:tid 20777] [client 138.199.19.193:36166] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/"] [unique_id "aWGvM0A8oR5jvkFpcP-UtwAAANQ"]
[Sat Jan 10 09:45:24.524820 2026] [:error] [pid 19926:tid 19943] [client 138.199.19.193:36172] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/"] [unique_id "aWGvNCS03bq9jOoBYpNO7AAAAQ8"]
[Sat Jan 10 09:45:25.157520 2026] [:error] [pid 31369:tid 31380] [client 138.199.19.193:36178] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/"] [unique_id "aWGvNbgqeMKgT1uTxuIm9AAAAUk"]
[Sat Jan 10 09:45:25.976710 2026] [:error] [pid 19926:tid 19951] [client 138.199.19.193:36184] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/js/dist/"] [unique_id "aWGvNSS03bq9jOoBYpNO7gAAARc"]
[Sat Jan 10 09:45:26.565800 2026] [:error] [pid 20648:tid 20711] [client 138.199.19.193:36196] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/js/dist/"] [unique_id "aWGvNjBnnIoBkEBdx9AvPAAAAII"]
[Sat Jan 10 09:45:27.274275 2026] [:error] [pid 20646:tid 20676] [client 138.199.19.193:36210] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/js/dist/"] [unique_id "aWGvNyKwdq_UhOM64b7P3QAAABU"]
[Sat Jan 10 09:45:27.872562 2026] [:error] [pid 20648:tid 20728] [client 138.199.19.193:36212] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/js/dist/"] [unique_id "aWGvNzBnnIoBkEBdx9AvPQAAAJM"]
[Sat Jan 10 09:45:28.484187 2026] [:error] [pid 20646:tid 20667] [client 138.199.19.193:36226] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/"] [unique_id "aWGvOCKwdq_UhOM64b7P3gAAAAw"]
[Sat Jan 10 09:45:29.155669 2026] [:error] [pid 20744:tid 20767] [client 138.199.19.193:36238] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/"] [unique_id "aWGvOUA8oR5jvkFpcP-UvwAAAMo"]
[Sat Jan 10 09:45:29.767405 2026] [:error] [pid 31369:tid 31371] [client 138.199.19.193:36252] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/"] [unique_id "aWGvObgqeMKgT1uTxuIm9wAAAUA"]
[Sat Jan 10 09:45:30.378472 2026] [:error] [pid 19926:tid 19934] [client 138.199.19.193:42632] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/"] [unique_id "aWGvOiS03bq9jOoBYpNO8QAAAQY"]
[Sat Jan 10 09:45:30.957597 2026] [:error] [pid 20744:tid 20780] [client 138.199.19.193:42634] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/"] [unique_id "aWGvOkA8oR5jvkFpcP-UwQAAANc"]
[Sat Jan 10 09:45:31.663284 2026] [:error] [pid 19926:tid 19947] [client 138.199.19.193:42646] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/"] [unique_id "aWGvOyS03bq9jOoBYpNO8gAAARM"]
[Sat Jan 10 09:45:32.269940 2026] [:error] [pid 20646:tid 20672] [client 138.199.19.193:42656] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/"] [unique_id "aWGvPCKwdq_UhOM64b7P3wAAABE"]
[Sat Jan 10 09:45:32.858752 2026] [:error] [pid 19926:tid 19948] [client 138.199.19.193:42672] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/"] [unique_id "aWGvPCS03bq9jOoBYpNO8wAAARQ"]
[Sat Jan 10 09:45:33.457414 2026] [:error] [pid 20744:tid 20760] [client 138.199.19.193:42684] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/assets/js/"] [unique_id "aWGvPUA8oR5jvkFpcP-UxQAAAMM"]
[Sat Jan 10 09:45:34.148056 2026] [:error] [pid 20647:tid 20701] [client 138.199.19.193:42696] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/assets/js/"] [unique_id "aWGvPqvb0x69MarUHzDKWQAAAFM"]
[Sat Jan 10 09:45:34.767991 2026] [:error] [pid 20646:tid 20665] [client 138.199.19.193:42702] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/assets/js/"] [unique_id "aWGvPiKwdq_UhOM64b7P4gAAAAo"]
[Sat Jan 10 09:45:35.363106 2026] [:error] [pid 20647:tid 20698] [client 138.199.19.193:42716] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/assets/js/"] [unique_id "aWGvP6vb0x69MarUHzDKWwAAAFA"]
[Sat Jan 10 09:45:36.263824 2026] [:error] [pid 20646:tid 20668] [client 138.199.19.193:42720] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/"] [unique_id "aWGvQCKwdq_UhOM64b7P5AAAAA0"]
[Sat Jan 10 09:45:36.846289 2026] [:error] [pid 20744:tid 20776] [client 138.199.19.193:42734] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/"] [unique_id "aWGvQEA8oR5jvkFpcP-UxwAAANM"]
[Sat Jan 10 09:45:37.634473 2026] [:error] [pid 20744:tid 20768] [client 138.199.19.193:42746] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/"] [unique_id "aWGvQUA8oR5jvkFpcP-UyQAAAMs"]
[Sat Jan 10 09:45:38.355247 2026] [:error] [pid 20646:tid 20657] [client 138.199.19.193:42760] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/"] [unique_id "aWGvQiKwdq_UhOM64b7P5wAAAAI"]
[Sat Jan 10 09:45:39.029817 2026] [:error] [pid 20648:tid 20720] [client 138.199.19.193:42764] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/meta/"] [unique_id "aWGvQzBnnIoBkEBdx9AvQQAAAIs"]
[Sat Jan 10 09:45:39.671605 2026] [:error] [pid 20648:tid 20725] [client 138.199.19.193:42768] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/meta/"] [unique_id "aWGvQzBnnIoBkEBdx9AvQgAAAJA"]
[Sat Jan 10 09:45:40.332475 2026] [:error] [pid 20647:tid 20686] [client 138.199.19.193:60622] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/meta/"] [unique_id "aWGvRKvb0x69MarUHzDKXgAAAEQ"]
[Sat Jan 10 09:45:41.027162 2026] [:error] [pid 20647:tid 20697] [client 138.199.19.193:60638] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/meta/"] [unique_id "aWGvRavb0x69MarUHzDKXwAAAE8"]
[Sat Jan 10 09:45:41.825226 2026] [:error] [pid 20744:tid 20769] [client 138.199.19.193:60644] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/"] [unique_id "aWGvRUA8oR5jvkFpcP-UygAAAMw"]
[Sat Jan 10 09:45:42.532362 2026] [:error] [pid 20648:tid 20726] [client 138.199.19.193:60656] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/"] [unique_id "aWGvRjBnnIoBkEBdx9AvRQAAAJE"]
[Sat Jan 10 09:45:43.156414 2026] [:error] [pid 20648:tid 20718] [client 138.199.19.193:60666] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/"] [unique_id "aWGvRzBnnIoBkEBdx9AvRwAAAIk"]
[Sat Jan 10 09:45:43.751255 2026] [:error] [pid 20646:tid 20667] [client 138.199.19.193:60672] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/"] [unique_id "aWGvRyKwdq_UhOM64b7P7QAAAAw"]
[Sat Jan 10 09:45:44.351782 2026] [:error] [pid 31369:tid 31391] [client 138.199.19.193:60684] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/"] [unique_id "aWGvSLgqeMKgT1uTxuIm_gAAAVQ"]
[Sat Jan 10 09:45:45.034960 2026] [:error] [pid 31369:tid 31378] [client 138.199.19.193:60692] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/"] [unique_id "aWGvSbgqeMKgT1uTxuIm_wAAAUc"]
[Sat Jan 10 09:45:45.727040 2026] [:error] [pid 31369:tid 31376] [client 138.199.19.193:60708] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/"] [unique_id "aWGvSbgqeMKgT1uTxuInAQAAAUU"]
[Sat Jan 10 09:45:46.357983 2026] [:error] [pid 31369:tid 31381] [client 138.199.19.193:60722] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/"] [unique_id "aWGvSrgqeMKgT1uTxuInAgAAAUo"]
[Sat Jan 10 09:45:46.954303 2026] [:error] [pid 31369:tid 31375] [client 138.199.19.193:60736] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aWGvSrgqeMKgT1uTxuInBAAAAUQ"]
[Sat Jan 10 09:45:48.126093 2026] [:error] [pid 31369:tid 31371] [client 138.199.19.193:60750] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aWGvTLgqeMKgT1uTxuInBQAAAUA"]
[Sat Jan 10 09:45:48.823355 2026] [:error] [pid 31369:tid 31386] [client 138.199.19.193:60760] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aWGvTLgqeMKgT1uTxuInCAAAAU8"]
[Sat Jan 10 09:45:49.531124 2026] [:error] [pid 31369:tid 31383] [client 138.199.19.193:60774] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aWGvTbgqeMKgT1uTxuInCwAAAUw"]
[Sat Jan 10 09:45:50.234019 2026] [:error] [pid 31369:tid 31385] [client 138.199.19.193:47088] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/"] [unique_id "aWGvTrgqeMKgT1uTxuInDQAAAU4"]
[Sat Jan 10 09:45:50.864398 2026] [:error] [pid 31369:tid 31394] [client 138.199.19.193:47096] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/"] [unique_id "aWGvTrgqeMKgT1uTxuInDgAAAVc"]
[Sat Jan 10 09:45:51.459577 2026] [:error] [pid 31369:tid 31391] [client 138.199.19.193:47106] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/"] [unique_id "aWGvT7gqeMKgT1uTxuInEgAAAVQ"]
[Sat Jan 10 09:45:52.070723 2026] [:error] [pid 20744:tid 20777] [client 138.199.19.193:47108] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/"] [unique_id "aWGvUEA8oR5jvkFpcP-UzQAAANQ"]
[Sat Jan 10 09:45:52.666862 2026] [:error] [pid 20744:tid 20766] [client 138.199.19.193:47110] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/"] [unique_id "aWGvUEA8oR5jvkFpcP-UzwAAAMk"]
[Sat Jan 10 09:45:53.264058 2026] [:error] [pid 20744:tid 20778] [client 138.199.19.193:47112] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/"] [unique_id "aWGvUUA8oR5jvkFpcP-U0AAAANU"]
[Sat Jan 10 09:45:53.965530 2026] [:error] [pid 31369:tid 31380] [client 138.199.19.193:47126] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/"] [unique_id "aWGvUbgqeMKgT1uTxuInFQAAAUk"]
[Sat Jan 10 09:45:54.587523 2026] [:error] [pid 19926:tid 19940] [client 138.199.19.193:47140] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/"] [unique_id "aWGvUiS03bq9jOoBYpNO-AAAAQw"]
[Sat Jan 10 09:45:55.225419 2026] [:error] [pid 20648:tid 20709] [client 138.199.19.193:47152] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/"] [unique_id "aWGvUzBnnIoBkEBdx9AvSQAAAIA"]
[Sat Jan 10 09:45:55.824018 2026] [:error] [pid 31369:tid 31381] [client 138.199.19.193:47164] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/"] [unique_id "aWGvU7gqeMKgT1uTxuInFwAAAUo"]
[Sat Jan 10 09:45:56.450326 2026] [:error] [pid 20744:tid 20775] [client 138.199.19.193:47176] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/"] [unique_id "aWGvVEA8oR5jvkFpcP-U0wAAANI"]
[Sat Jan 10 09:45:57.169333 2026] [:error] [pid 20744:tid 20757] [client 138.199.19.193:47178] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/"] [unique_id "aWGvVUA8oR5jvkFpcP-U1QAAAMA"]
[Sat Jan 10 09:45:57.800286 2026] [:error] [pid 31369:tid 31383] [client 138.199.19.193:47184] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "aWGvVbgqeMKgT1uTxuInGQAAAUw"]
[Sat Jan 10 09:45:58.458486 2026] [:error] [pid 31369:tid 31392] [client 138.199.19.193:47188] [client 138.199.19.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "aWGvVrgqeMKgT1uTxuInGwAAAVU"]
[Sat Jan 10 09:46:02.171686 2026] [:error] [pid 20647:tid 20698] [client 138.199.19.193:54284] [client 138.199.19.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.199.19.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWGvWqvb0x69MarUHzDKaAAAAFA"]
[Sat Jan 10 09:46:02.997931 2026] [autoindex:error] [pid 20648:tid 20710] [client 138.199.19.193:47196] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 10 10:30:41.727234 2026] [:error] [pid 20744:tid 20775] [client 185.199.223.39:57180] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWG50UA8oR5jvkFpcP-dZAAAANI"]
[Sat Jan 10 11:55:44.030899 2026] [:error] [pid 19926:tid 19938] [client 157.90.79.58:58744] [client 157.90.79.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.90.79.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWHNwCS03bq9jOoBYpNfaQAAAQo"]
[Sat Jan 10 13:15:52.377788 2026] [:error] [pid 1125:tid 1142] [client 137.74.192.205:48768] [client 137.74.192.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.74.192.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWHgiHqAWYc4UwRgeOc7WAAAAE8"]
[Sat Jan 10 13:38:45.733349 2026] [:error] [pid 57088:tid 57095] [client 110.166.71.39:49666] [client 110.166.71.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWHl5UGS_UStbgMYQWjpNgAAAgU"]
[Sat Jan 10 14:42:34.612730 2026] [:error] [pid 1383:tid 1389] [client 82.64.81.82:60578] [client 82.64.81.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.64.81.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWH02iSbzyQbm27sbcIZwwAAA8Q"]
[Sat Jan 10 14:52:48.136487 2026] [:error] [pid 1339:tid 1343] [client 156.67.31.208:57942] [client 156.67.31.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.67.31.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWH3QCcsOJx4B_mSFzkfXAAAA4E"]
[Sat Jan 10 16:08:58.811655 2026] [:error] [pid 1125:tid 1146] [client 31.33.182.48:7998] [client 31.33.182.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.33.182.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWIJGnqAWYc4UwRgeOdNNAAAAFM"]
[Sat Jan 10 17:04:21.510485 2026] [:error] [pid 64621:tid 64640] [client 43.155.195.141:50676] [client 43.155.195.141] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWIWFYa9na_3sfYAP9qWBwAAAxE"]
[Sat Jan 10 17:34:29.362351 2026] [:error] [pid 1339:tid 1351] [client 92.62.236.60:50376] [client 92.62.236.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.62.236.60, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWIdJScsOJx4B_mSFzlB9QAAA4k"]
[Sat Jan 10 18:02:08.315102 2026] [:error] [pid 1296:tid 1307] [client 179.159.35.47:50911] [client 179.159.35.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.159.35.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWIjoCbQW-fowWjMNKB2IgAAAkk"]
[Sat Jan 10 18:02:10.338239 2026] [:error] [pid 57649:tid 57654] [client 179.159.35.47:50943] [client 179.159.35.47] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aWIjolcvIwrych3kBnooCgAAAoM"]
[Sat Jan 10 18:02:38.519293 2026] [:error] [pid 20646:tid 20669] [client 179.159.35.47:51486] [client 179.159.35.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.159.35.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWIjviKwdq_UhOM64b4GVQAAAA4"]
[Sat Jan 10 18:06:01.198538 2026] [autoindex:error] [pid 1339:tid 1353] [client 143.244.141.160:59393] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Jan 10 18:08:49.780212 2026] [:error] [pid 1339:tid 1343] [client 179.159.35.47:57562] [client 179.159.35.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.159.35.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWIlMScsOJx4B_mSFzlGhQAAA4E"]
[Sat Jan 10 18:14:50.346950 2026] [:error] [pid 1125:tid 1143] [client 179.159.35.47:63739] [client 179.159.35.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.159.35.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWImmnqAWYc4UwRgeOdhpQAAAFA"]
[Sat Jan 10 18:20:00.132614 2026] [:error] [pid 1339:tid 1342] [client 179.159.35.47:51719] [client 179.159.35.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.159.35.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWIn0CcsOJx4B_mSFzlItgAAA4A"]
[Sat Jan 10 18:24:25.964156 2026] [:error] [pid 1383:tid 1406] [client 94.247.172.129:50218] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWIo2SSbzyQbm27sbcJX2AAAA9E"]
[Sat Jan 10 20:48:11.164734 2026] [:error] [pid 1339:tid 1356] [client 45.33.121.161:41544] [client 45.33.121.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.33.121.161, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWJKiycsOJx4B_mSFzlXKAAAA44"]
[Sat Jan 10 23:33:49.231558 2026] [:error] [pid 1296:tid 1319] [client 35.226.125.165:49790] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWJxXSbQW-fowWjMNKCyjAAAAlU"]
[Sun Jan 11 01:18:11.920795 2026] [:error] [pid 1249:tid 1276] [client 156.67.31.208:33310] [client 156.67.31.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.67.31.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWKJ00td4KGpcdnrDZW_iwAAANg"]
[Sun Jan 11 02:02:53.853004 2026] [:error] [pid 1249:tid 1260] [client 138.197.13.155:60965] [client 138.197.13.155] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "aWKUTUtd4KGpcdnrDZXC1AAAAMg"], referer: binance.com
[Sun Jan 11 02:34:30.059388 2026] [:error] [pid 1249:tid 1274] [client 182.40.104.255:38288] [client 182.40.104.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWKbtktd4KGpcdnrDZXFVgAAANY"]
[Sun Jan 11 02:35:33.717768 2026] [:error] [pid 20646:tid 20679] [client 45.12.18.180:35282] [client 45.12.18.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.12.18.180, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWKb9SKwdq_UhOM64b5HkgAAABg"]
[Sun Jan 11 03:27:08.555960 2026] [autoindex:error] [pid 1249:tid 1271] [client 104.215.31.164:35257] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Sun Jan 11 03:27:10.448229 2026] [:error] [pid 57649:tid 57664] [client 104.215.31.164:3620] [client 104.215.31.164] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.215.31.164, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWKoDlcvIwrych3kBnpTiAAAAo0"], referer: https://www.yahoo.com/
[Sun Jan 11 03:27:11.678482 2026] [autoindex:error] [pid 1249:tid 1263] [client 104.215.31.164:35257] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Sun Jan 11 03:27:12.415624 2026] [autoindex:error] [pid 1249:tid 1252] [client 104.215.31.164:35257] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Sun Jan 11 03:27:13.565974 2026] [autoindex:error] [pid 1249:tid 1262] [client 104.215.31.164:35257] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Sun Jan 11 03:27:13.686025 2026] [:error] [pid 1249:tid 1256] [client 104.215.31.164:35257] [client 104.215.31.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bk/index.php"] [unique_id "aWKoEUtd4KGpcdnrDZXKIgAAAMQ"], referer: https://www.google.com/
[Sun Jan 11 03:27:13.926565 2026] [:error] [pid 57649:tid 57663] [client 104.215.31.164:31161] [client 104.215.31.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aWKoEVcvIwrych3kBnpTiwAAAow"], referer: https://www.yahoo.com/
[Sun Jan 11 03:27:14.168814 2026] [:error] [pid 57088:tid 57104] [client 104.215.31.164:29067] [client 104.215.31.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/list-item/index.php"] [unique_id "aWKoEkGS_UStbgMYQWg0-wAAAg4"], referer: https://www.bing.com/
[Sun Jan 11 03:27:14.409807 2026] [:error] [pid 1383:tid 1392] [client 104.215.31.164:33799] [client 104.215.31.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aWKoEiSbzyQbm27sbcKkwAAAA8c"], referer: https://duckduckgo.com/
[Sun Jan 11 03:27:14.653370 2026] [:error] [pid 1125:tid 1146] [client 104.215.31.164:35215] [client 104.215.31.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/index.php"] [unique_id "aWKoEnqAWYc4UwRgeOeSxwAAAFM"], referer: https://www.google.fr/
[Sun Jan 11 03:27:14.894734 2026] [:error] [pid 57088:tid 57090] [client 104.215.31.164:35225] [client 104.215.31.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aWKoEkGS_UStbgMYQWg1AwAAAgA"], referer: https://www.google.co.uk/
[Sun Jan 11 03:27:15.134230 2026] [:error] [pid 1383:tid 1412] [client 104.215.31.164:31125] [client 104.215.31.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/index.php"] [unique_id "aWKoEySbzyQbm27sbcKkwQAAA9c"], referer: https://www.google.fr/
[Sun Jan 11 04:07:52.459639 2026] [:error] [pid 5153:tid 5199] [client 157.230.98.69:42504] [client 157.230.98.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.98.69, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWKxmM1QbNSPD9bRi75OmgAAAEo"]
[Sun Jan 11 04:20:42.133528 2026] [:error] [pid 5272:tid 5295] [client 103.27.234.182:50531] [client 103.27.234.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aWK0mlp55bCsukUvYGad1AAAANU"]
[Sun Jan 11 04:20:43.609209 2026] [:error] [pid 5272:tid 5277] [client 103.27.234.182:50559] [client 103.27.234.182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aWK0m1p55bCsukUvYGad2AAAAMM"]
[Sun Jan 11 05:39:10.790270 2026] [:error] [pid 5155:tid 5228] [client 194.182.184.76:44446] [client 194.182.184.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.182.184.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWLG_lgEKFpNs0_zLGmQZQAAAIw"]
[Sun Jan 11 07:10:18.413429 2026] [:error] [pid 5152:tid 5173] [client 54.37.39.241:38474] [client 54.37.39.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.39.241, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWLcWhm0axGMFrpuXHBEoAAAAAs"]
[Sun Jan 11 08:37:52.437289 2026] [:error] [pid 35730:tid 35754] [client 91.245.210.195:43626] [client 91.245.210.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.245.210.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWLw4Di7U_mfHtESQHnqyQAAAdY"]
[Sun Jan 11 10:08:43.887913 2026] [:error] [pid 35977:tid 35992] [client 103.157.204.97:34322] [client 103.157.204.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.157.204.97, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWMGK7DST5RMqStLeP0ODwAAAgw"]
[Sun Jan 11 10:49:03.039648 2026] [:error] [pid 5272:tid 5295] [client 43.153.27.244:57998] [client 43.153.27.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWMPn1p55bCsukUvYGb_MwAAANU"]
[Sun Jan 11 11:36:28.603484 2026] [:error] [pid 36611:tid 36636] [client 192.241.176.150:33166] [client 192.241.176.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.241.176.150, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWMavD8oZoZHsoTdjhggzgAAAlc"]
[Sun Jan 11 14:53:03.328528 2026] [:error] [pid 35730:tid 35740] [client 43.153.48.240:60698] [client 43.153.48.240] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWNIzzi7U_mfHtESQHkOMgAAAcg"]
[Sun Jan 11 16:11:21.403026 2026] [:error] [pid 40191:tid 40209] [client 134.90.137.88:47544] [client 134.90.137.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.90.137.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWNbKUm2BH1CV1p0EUGq-QAAAtA"]
[Sun Jan 11 17:35:22.551597 2026] [:error] [pid 5155:tid 5237] [client 43.164.195.17:45236] [client 43.164.195.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWNu2lgEKFpNs0_zLGn9TAAAAJU"]
[Sun Jan 11 18:42:44.786586 2026] [:error] [pid 11748:tid 11792] [client 74.225.195.179:64441] [client 74.225.195.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aWN-pAC5xybrWOCNnobuMAAAAY4"], referer: https://www.google.de/
[Sun Jan 11 18:42:46.186506 2026] [autoindex:error] [pid 5272:tid 5284] [client 74.225.195.179:63904] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Sun Jan 11 18:42:52.652101 2026] [autoindex:error] [pid 5272:tid 5297] [client 74.225.195.179:63904] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Sun Jan 11 18:42:56.356981 2026] [autoindex:error] [pid 5272:tid 5277] [client 74.225.195.179:63904] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Sun Jan 11 18:42:58.359540 2026] [autoindex:error] [pid 5272:tid 5280] [client 74.225.195.179:63904] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Sun Jan 11 18:43:05.425758 2026] [:error] [pid 11748:tid 11793] [client 74.225.195.179:64965] [client 74.225.195.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.225.195.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWN-uQC5xybrWOCNnobuRwAAAY8"], referer: https://www.google.de/
[Sun Jan 11 18:43:06.965487 2026] [autoindex:error] [pid 5272:tid 5284] [client 74.225.195.179:63904] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Sun Jan 11 18:43:10.278902 2026] [:error] [pid 11748:tid 11800] [client 74.225.195.179:64965] [client 74.225.195.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.225.195.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWN-vgC5xybrWOCNnobuSgAAAZY"], referer: https://www.google.de/
[Sun Jan 11 18:43:11.082574 2026] [autoindex:error] [pid 5272:tid 5276] [client 74.225.195.179:63904] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Sun Jan 11 18:43:12.639897 2026] [:error] [pid 5272:tid 5297] [client 74.225.195.179:63904] [client 74.225.195.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.225.195.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/wp-login.php"] [unique_id "aWN-wFp55bCsukUvYGZcIwAAANc"], referer: https://www.google.fr/
[Sun Jan 11 18:43:14.029079 2026] [:error] [pid 5272:tid 5288] [client 74.225.195.179:63904] [client 74.225.195.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-login.php"] [unique_id "aWN-wlp55bCsukUvYGZcJgAAAM4"], referer: https://www.google.fr/
[Sun Jan 11 18:43:22.538381 2026] [autoindex:error] [pid 11748:tid 11779] [client 74.225.195.179:64399] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Sun Jan 11 18:43:22.684486 2026] [:error] [pid 11748:tid 11801] [client 74.225.195.179:64399] [client 74.225.195.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aWN-ygC5xybrWOCNnobuXAAAAZc"], referer: https://duckduckgo.com/
[Sun Jan 11 18:55:18.084774 2026] [:error] [pid 35977:tid 35999] [client 163.5.241.42:60335] [client 163.5.241.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.5.241.42, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWOBlrDST5RMqStLeP1kVwAAAhM"], referer: https://www.google.com/
[Sun Jan 11 18:55:20.096528 2026] [:error] [pid 36611:tid 36633] [client 194.5.53.61:49429] [client 194.5.53.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.5.53.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWOBmD8oZoZHsoTdjhhStAAAAlQ"], referer: https://www.google.com/
[Sun Jan 11 18:55:22.173454 2026] [:error] [pid 5272:tid 5294] [client 163.5.241.57:49695] [client 163.5.241.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.5.241.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWOBmlp55bCsukUvYGZdsgAAANQ"], referer: https://www.google.com/
[Sun Jan 11 18:55:24.228564 2026] [:error] [pid 35977:tid 36001] [client 163.5.241.60:32037] [client 163.5.241.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.5.241.60, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWOBnLDST5RMqStLeP1kZQAAAhU"], referer: https://www.google.com/
[Sun Jan 11 18:55:26.269310 2026] [:error] [pid 11747:tid 11753] [client 163.5.241.21:23921] [client 163.5.241.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.5.241.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWOBnqRFw84LNpZSk7nS2AAAAUI"], referer: https://www.google.com/
[Sun Jan 11 18:55:28.276911 2026] [:error] [pid 35730:tid 35735] [client 163.5.241.20:25957] [client 163.5.241.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.5.241.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWOBoDi7U_mfHtESQHk85QAAAcM"], referer: https://www.google.com/
[Sun Jan 11 18:55:30.599804 2026] [:error] [pid 35977:tid 36004] [client 163.5.241.40:38897] [client 163.5.241.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.5.241.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWOBorDST5RMqStLeP1kawAAAhg"], referer: https://www.google.com/
[Sun Jan 11 18:55:32.632122 2026] [:error] [pid 5155:tid 5237] [client 163.5.241.64:50287] [client 163.5.241.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.5.241.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWOBpFgEKFpNs0_zLGkKwQAAAJU"], referer: https://www.google.com/
[Sun Jan 11 18:55:34.701730 2026] [:error] [pid 40191:tid 40207] [client 163.5.241.33:65007] [client 163.5.241.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.5.241.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWOBpkm2BH1CV1p0EUHCOAAAAs4"], referer: https://www.google.com/
[Sun Jan 11 18:55:36.698283 2026] [:error] [pid 11748:tid 11790] [client 163.5.241.55:54133] [client 163.5.241.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.5.241.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWOBqAC5xybrWOCNnobwAgAAAYw"], referer: https://www.google.com/
[Sun Jan 11 18:55:38.709321 2026] [:error] [pid 5272:tid 5282] [client 163.5.241.46:57293] [client 163.5.241.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.5.241.46, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWOBqlp55bCsukUvYGZdygAAAMg"], referer: https://www.google.com/
[Sun Jan 11 19:22:10.608754 2026] [:error] [pid 35977:tid 35986] [client 181.2.144.58:59152] [client 181.2.144.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.2.144.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWOH4rDST5RMqStLeP1qawAAAgY"]
[Sun Jan 11 20:05:49.614472 2026] [:error] [pid 40191:tid 40210] [client 159.203.56.112:53041] [client 159.203.56.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.203.56.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWOSHUm2BH1CV1p0EUHNjQAAAtE"]
[Sun Jan 11 20:05:51.080222 2026] [:error] [pid 40191:tid 40202] [client 159.203.56.112:53122] [client 159.203.56.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.203.56.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWOSH0m2BH1CV1p0EUHNkQAAAsk"]
[Sun Jan 11 20:19:46.922994 2026] [:error] [pid 11748:tid 11784] [client 159.203.56.112:53436] [client 159.203.56.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.203.56.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWOVYgC5xybrWOCNnob9qAAAAYY"]
[Sun Jan 11 20:20:26.838880 2026] [:error] [pid 40191:tid 40197] [client 159.203.56.112:57133] [client 159.203.56.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.203.56.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWOVikm2BH1CV1p0EUHQsgAAAsQ"]
[Sun Jan 11 20:20:59.244647 2026] [:error] [pid 11747:tid 11752] [client 159.203.56.112:59867] [client 159.203.56.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.203.56.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWOVq6RFw84LNpZSk7nexgAAAUE"]
[Sun Jan 11 20:51:54.671937 2026] [:error] [pid 35730:tid 35755] [client 123.187.240.242:45190] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWOc6ji7U_mfHtESQHlecQAAAdc"]
[Sun Jan 11 21:08:43.626243 2026] [:error] [pid 40191:tid 40204] [client 43.130.9.111:46948] [client 43.130.9.111] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWOg20m2BH1CV1p0EUHYUAAAAss"]
[Sun Jan 11 23:28:54.748658 2026] [:error] [pid 5153:tid 5194] [client 13.70.39.23:25472] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test.php"] [unique_id "aWPBts1QbNSPD9bRi77fzAAAAEU"]
[Sun Jan 11 23:28:58.427346 2026] [:error] [pid 40191:tid 40193] [client 13.70.39.23:29267] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test.php"] [unique_id "aWPBukm2BH1CV1p0EUHryAAAAsA"]
[Sun Jan 11 23:29:08.091035 2026] [:error] [pid 5152:tid 5166] [client 13.70.39.23:51275] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test.php"] [unique_id "aWPBxBm0axGMFrpuXHCyegAAAAQ"]
[Sun Jan 11 23:29:19.799670 2026] [:error] [pid 40191:tid 40196] [client 13.70.39.23:24201] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aWPBz0m2BH1CV1p0EUHr3gAAAsM"]
[Sun Jan 11 23:29:39.735961 2026] [:error] [pid 5153:tid 5204] [client 13.70.39.23:45167] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/check.php"] [unique_id "aWPB481QbNSPD9bRi77f4wAAAE8"]
[Sun Jan 11 23:30:12.249712 2026] [:error] [pid 40191:tid 40200] [client 13.70.39.23:28731] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aWPCBEm2BH1CV1p0EUHsFgAAAsc"]
[Sun Jan 11 23:30:23.498017 2026] [:error] [pid 11747:tid 11756] [client 13.70.39.23:28733] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aWPCD6RFw84LNpZSk7n37wAAAUU"]
[Sun Jan 11 23:30:25.644513 2026] [:error] [pid 5152:tid 5179] [client 13.70.39.23:28726] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aWPCERm0axGMFrpuXHCy1gAAABE"]
[Sun Jan 11 23:31:08.585792 2026] [:error] [pid 11747:tid 11764] [client 13.70.39.23:31425] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/debug.php"] [unique_id "aWPCPKRFw84LNpZSk7n4AgAAAU0"]
[Sun Jan 11 23:31:24.161080 2026] [:error] [pid 5153:tid 5206] [client 13.70.39.23:6215] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/security.php"] [unique_id "aWPCTM1QbNSPD9bRi77gGgAAAFE"]
[Sun Jan 11 23:31:27.763087 2026] [:error] [pid 5152:tid 5176] [client 13.70.39.23:54196] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/security.php"] [unique_id "aWPCTxm0axGMFrpuXHCzAQAAAA4"]
[Sun Jan 11 23:31:32.128773 2026] [:error] [pid 5272:tid 5289] [client 13.70.39.23:30962] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/security.php"] [unique_id "aWPCVFp55bCsukUvYGaWZgAAAM8"]
[Sun Jan 11 23:31:38.311819 2026] [:error] [pid 5155:tid 5227] [client 13.70.39.23:15678] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/security.php"] [unique_id "aWPCWlgEKFpNs0_zLGk5tQAAAIs"]
[Sun Jan 11 23:31:45.304593 2026] [:error] [pid 36611:tid 36629] [client 13.70.39.23:6562] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aWPCYT8oZoZHsoTdjhh6eAAAAlA"]
[Sun Jan 11 23:31:45.902847 2026] [:error] [pid 35977:tid 35982] [client 13.70.39.23:29652] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aWPCYbDST5RMqStLeP2VcgAAAgI"]
[Sun Jan 11 23:31:46.508605 2026] [:error] [pid 5155:tid 5236] [client 13.70.39.23:3615] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aWPCYlgEKFpNs0_zLGk5uAAAAJQ"]
[Sun Jan 11 23:31:47.828847 2026] [:error] [pid 11747:tid 11765] [client 13.70.39.23:29661] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aWPCY6RFw84LNpZSk7n4GAAAAU4"]
[Sun Jan 11 23:31:54.388482 2026] [:error] [pid 5152:tid 5181] [client 13.70.39.23:3603] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aWPCahm0axGMFrpuXHCzEQAAABM"]
[Sun Jan 11 23:31:57.063511 2026] [:error] [pid 5152:tid 5162] [client 13.70.39.23:3711] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aWPCbRm0axGMFrpuXHCzFQAAAAA"]
[Sun Jan 11 23:32:01.895801 2026] [:error] [pid 5272:tid 5290] [client 13.70.39.23:7092] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aWPCcVp55bCsukUvYGaWbwAAANA"]
[Sun Jan 11 23:32:11.304239 2026] [:error] [pid 5152:tid 5170] [client 13.70.39.23:40689] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up.php"] [unique_id "aWPCexm0axGMFrpuXHCzJgAAAAg"]
[Sun Jan 11 23:32:13.960667 2026] [:error] [pid 5153:tid 5195] [client 192.241.176.150:45296] [client 192.241.176.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.241.176.150, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWPCfc1QbNSPD9bRi77gLAAAAEY"]
[Sun Jan 11 23:32:14.955743 2026] [:error] [pid 5155:tid 5237] [client 13.70.39.23:52821] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up.php"] [unique_id "aWPCflgEKFpNs0_zLGk5vQAAAJU"]
[Sun Jan 11 23:32:15.521688 2026] [:error] [pid 35977:tid 35991] [client 13.70.39.23:31976] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up.php"] [unique_id "aWPCf7DST5RMqStLeP2VgwAAAgs"]
[Sun Jan 11 23:32:17.157442 2026] [:error] [pid 5152:tid 5162] [client 13.70.39.23:51773] [client 13.70.39.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up.php"] [unique_id "aWPCgRm0axGMFrpuXHCzKQAAAAA"]
[Sun Jan 11 23:32:27.664805 2026] [:error] [pid 36611:tid 36619] [client 13.70.39.23:52853] [client 13.70.39.23] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".phpquebecoils.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/info.phpquebecoils.com"] [unique_id "aWPCiz8oZoZHsoTdjhh6nQAAAkY"]
[Sun Jan 11 23:40:57.877511 2026] [:error] [pid 11747:tid 11752] [client 101.33.66.34:50950] [client 101.33.66.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWPEiaRFw84LNpZSk7n4xgAAAUE"]
[Mon Jan 12 01:24:16.381623 2026] [:error] [pid 5152:tid 5171] [client 164.132.53.180:54910] [client 164.132.53.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.53.180, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWPcwBm0axGMFrpuXHDC0gAAAAk"]
[Mon Jan 12 02:09:38.331651 2026] [:error] [pid 40191:tid 40217] [client 213.160.75.126:27690] [client 213.160.75.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.160.75.126, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWPnYkm2BH1CV1p0EUH7MQAAAtg"]
[Mon Jan 12 03:41:18.274228 2026] [:error] [pid 48106:tid 48182] [client 185.199.223.39:36936] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWP83u_rz8jTZY4aXpS6PgAAAI8"]
[Mon Jan 12 04:32:57.714106 2026] [:error] [pid 48104:tid 48116] [client 155.133.142.66:51893] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.142.66, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWQI-U4huT4DhLwu2Vu7JwAAAAM"]
[Mon Jan 12 05:17:12.217605 2026] [:error] [pid 48105:tid 48144] [client 194.164.63.41:58668] [client 194.164.63.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.63.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWQTWDbe4SdLfSmtJe3aBAAAAEQ"]
[Mon Jan 12 05:38:58.711645 2026] [:error] [pid 48104:tid 48137] [client 43.130.67.33:42038] [client 43.130.67.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWQYck4huT4DhLwu2VvKFgAAABg"]
[Mon Jan 12 06:03:12.057116 2026] [:error] [pid 48104:tid 48113] [client 82.65.178.212:49074] [client 82.65.178.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.65.178.212, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWQeIE4huT4DhLwu2VvPdwAAAAA"]
[Mon Jan 12 07:03:15.554467 2026] [:error] [pid 48106:tid 48170] [client 82.223.128.142:52690] [client 82.223.128.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.128.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWQsM-_rz8jTZY4aXpTvvQAAAIM"]
[Mon Jan 12 07:04:42.736273 2026] [:error] [pid 48105:tid 48145] [client 64.23.160.189:41276] [client 64.23.160.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.23.160.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWQsijbe4SdLfSmtJe30BgAAAEU"]
[Mon Jan 12 09:14:09.459978 2026] [:error] [pid 23184:tid 23191] [client 36.41.75.167:51428] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWRK4RKkZNnMA7VuWCG3jQAAAQU"]
[Mon Jan 12 14:53:43.035021 2026] [:error] [pid 51637:tid 51657] [client 43.157.179.227:58994] [client 43.157.179.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWSad3rTvTmO_ovDgVB_igAAAY4"]
[Mon Jan 12 15:24:05.362195 2026] [:error] [pid 51863:tid 51889] [client 110.166.71.39:60302] [client 110.166.71.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWShlT2-QXSEuiZdYYZJ7QAAAhY"]
[Mon Jan 12 20:05:30.443114 2026] [:error] [pid 51896:tid 51900] [client 167.172.235.216:61430] [client 167.172.235.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "aWTjit2Y52W2afNXn_WTRwAAAkE"], referer: binance.com
[Mon Jan 12 21:49:34.217351 2026] [:error] [pid 51896:tid 51923] [client 182.44.9.147:38724] [client 182.44.9.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWT77t2Y52W2afNXn_Wc4wAAAlg"]
[Tue Jan 13 02:15:56.353661 2026] [autoindex:error] [pid 48106:tid 48177] [client 4.217.197.7:22220] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Tue Jan 13 02:15:57.202397 2026] [autoindex:error] [pid 48106:tid 48186] [client 4.217.197.7:22220] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Tue Jan 13 02:15:57.985828 2026] [autoindex:error] [pid 48106:tid 48182] [client 4.217.197.7:22220] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Tue Jan 13 02:15:58.131401 2026] [autoindex:error] [pid 48106:tid 48184] [client 4.217.197.7:22220] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Tue Jan 13 02:16:03.437982 2026] [:error] [pid 48106:tid 48183] [client 4.217.197.7:22220] [client 4.217.197.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.217.197.7, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aWU6Y-_rz8jTZY4aXpSdTwAAAJA"], referer: https://www.google.com/
[Tue Jan 13 02:16:07.081604 2026] [autoindex:error] [pid 48106:tid 48181] [client 4.217.197.7:22220] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Tue Jan 13 02:16:07.225809 2026] [autoindex:error] [pid 48106:tid 48173] [client 4.217.197.7:22220] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Tue Jan 13 02:16:07.367670 2026] [autoindex:error] [pid 48106:tid 48171] [client 4.217.197.7:22220] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Tue Jan 13 02:16:08.985562 2026] [autoindex:error] [pid 48106:tid 48188] [client 4.217.197.7:22220] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Tue Jan 13 02:16:09.135436 2026] [autoindex:error] [pid 48106:tid 48179] [client 4.217.197.7:22220] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Tue Jan 13 02:16:09.272736 2026] [:error] [pid 48106:tid 48174] [client 4.217.197.7:22220] [client 4.217.197.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aWU6ae_rz8jTZY4aXpSdXAAAAIc"], referer: https://www.google.co.uk/
[Tue Jan 13 02:16:09.555060 2026] [:error] [pid 51637:tid 51651] [client 4.217.197.7:22947] [client 4.217.197.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/alfa-rex.php"] [unique_id "aWU6aXrTvTmO_ovDgVAlKQAAAYg"], referer: https://www.google.fr/
[Tue Jan 13 02:16:09.837287 2026] [autoindex:error] [pid 51637:tid 51646] [client 4.217.197.7:13838] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/Cookie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Tue Jan 13 02:16:09.973339 2026] [:error] [pid 51637:tid 51649] [client 4.217.197.7:13838] [client 4.217.197.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aWU6aXrTvTmO_ovDgVAlKwAAAYY"], referer: https://www.google.co.uk/
[Tue Jan 13 02:16:10.260189 2026] [autoindex:error] [pid 51637:tid 51654] [client 4.217.197.7:14113] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Tue Jan 13 02:16:10.396637 2026] [:error] [pid 51637:tid 51659] [client 4.217.197.7:14113] [client 4.217.197.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aWU6anrTvTmO_ovDgVAlLgAAAZA"], referer: https://duckduckgo.com/
[Tue Jan 13 02:16:10.714330 2026] [:error] [pid 51637:tid 51650] [client 4.217.197.7:28295] [client 4.217.197.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/xwx1.php"] [unique_id "aWU6anrTvTmO_ovDgVAlMAAAAYc"], referer: https://www.yahoo.com/
[Tue Jan 13 02:16:11.061816 2026] [:error] [pid 51986:tid 52034] [client 4.217.197.7:21995] [client 4.217.197.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aWU6axiI5CoFGIbwGZaWZAAAA1M"], referer: https://www.bing.com/
[Tue Jan 13 02:16:11.362189 2026] [autoindex:error] [pid 48106:tid 48180] [client 4.217.197.7:18889] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Tue Jan 13 02:16:11.648185 2026] [:error] [pid 48106:tid 48175] [client 4.217.197.7:18889] [client 4.217.197.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "aWU6a-_rz8jTZY4aXpSdXwAAAIg"], referer: https://www.google.de/
[Tue Jan 13 02:16:11.940177 2026] [autoindex:error] [pid 48213:tid 48228] [client 4.217.197.7:25324] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Tue Jan 13 02:16:12.075692 2026] [:error] [pid 48213:tid 48226] [client 4.217.197.7:25324] [client 4.217.197.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aWU6bGRmaItaLCBvAhgsJgAAAMs"], referer: https://www.google.co.uk/
[Tue Jan 13 02:16:12.356142 2026] [:error] [pid 51986:tid 52017] [client 4.217.197.7:25291] [client 4.217.197.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aWU6bBiI5CoFGIbwGZaWZwAAA0I"], referer: https://www.google.fr/
[Tue Jan 13 02:16:12.632122 2026] [:error] [pid 51986:tid 52039] [client 4.217.197.7:29630] [client 4.217.197.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "aWU6bBiI5CoFGIbwGZaWaAAAA1g"], referer: https://www.google.fr/
[Tue Jan 13 02:16:12.909682 2026] [autoindex:error] [pid 51986:tid 52019] [client 4.217.197.7:25307] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Tue Jan 13 02:16:14.048464 2026] [:error] [pid 51986:tid 52035] [client 4.217.197.7:25307] [client 4.217.197.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.217.197.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWU6bhiI5CoFGIbwGZaWawAAA1Q"], referer: https://www.yahoo.com/
[Tue Jan 13 07:38:26.668075 2026] [:error] [pid 57660:tid 57728] [client 43.134.141.244:49282] [client 43.134.141.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWWF8tMDflPZjoqTTeFqqgAAAIs"]
[Tue Jan 13 10:04:24.654799 2026] [:error] [pid 57660:tid 57719] [client 43.135.36.201:38884] [client 43.135.36.201] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWWoKNMDflPZjoqTTeGavwAAAII"]
[Tue Jan 13 11:13:26.459489 2026] [:error] [pid 22426:tid 22477] [client 196.51.119.130:54128] [client 196.51.119.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.51.119.130, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWW4Vty1Q5toryYTHgM-OQAAANM"], referer: https://expressinteriors.com/
[Tue Jan 13 13:17:49.808103 2026] [:error] [pid 22389:tid 22403] [client 43.156.204.134:37480] [client 43.156.204.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWXVfSLIB_8b411qalLq7gAAAUw"]
[Tue Jan 13 13:47:43.426080 2026] [:error] [pid 22485:tid 22490] [client 88.170.43.205:48395] [client 88.170.43.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.170.43.205, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWXcfxzzbghmKib9ie-ZqAAAAYM"], referer: https://wordpress.org/
[Tue Jan 13 13:48:02.049334 2026] [:error] [pid 22485:tid 22492] [client 88.170.43.205:48395] [client 88.170.43.205] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aWXckhzzbghmKib9ie-Z0gAAAYU"]
[Tue Jan 13 13:48:04.199513 2026] [:error] [pid 22485:tid 22505] [client 88.170.43.205:48395] [client 88.170.43.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.170.43.205, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWXclBzzbghmKib9ie-Z2AAAAZI"], referer: https://www.expressinteriors.com/wp-login.php
[Tue Jan 13 13:48:05.996295 2026] [:error] [pid 22485:tid 22511] [client 88.170.43.205:46773] [client 88.170.43.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.170.43.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWXclRzzbghmKib9ie-Z2wAAAZg"], referer: https://www.expressinteriors.com/wp-login.php
[Tue Jan 13 13:48:06.829966 2026] [:error] [pid 22485:tid 22504] [client 88.170.43.205:48395] [client 88.170.43.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.170.43.205, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWXclhzzbghmKib9ie-Z3gAAAZE"], referer: https://www.expressinteriors.com/wp-login.php
[Tue Jan 13 13:48:08.512429 2026] [:error] [pid 22485:tid 22495] [client 88.170.43.205:46773] [client 88.170.43.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.170.43.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWXcmBzzbghmKib9ie-Z4QAAAYg"], referer: https://www.expressinteriors.com/wp-login.php
[Tue Jan 13 13:48:09.388406 2026] [:error] [pid 22485:tid 22500] [client 88.170.43.205:48395] [client 88.170.43.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.170.43.205, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWXcmRzzbghmKib9ie-Z4wAAAY0"], referer: https://www.expressinteriors.com/wp-login.php
[Tue Jan 13 13:48:11.045008 2026] [:error] [pid 22485:tid 22509] [client 88.170.43.205:46773] [client 88.170.43.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.170.43.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWXcmxzzbghmKib9ie-Z5gAAAZY"], referer: https://www.expressinteriors.com/wp-login.php
[Tue Jan 13 13:48:11.891243 2026] [:error] [pid 22485:tid 22487] [client 88.170.43.205:48395] [client 88.170.43.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.170.43.205, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWXcmxzzbghmKib9ie-Z5wAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Tue Jan 13 15:13:05.609951 2026] [autoindex:error] [pid 22426:tid 22463] [client 38.242.213.228:58466] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Jan 13 16:18:26.596436 2026] [:error] [pid 22426:tid 22476] [client 106.119.167.146:52863] [client 106.119.167.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWX_0ty1Q5toryYTHgOH9gAAANI"]
[Tue Jan 13 19:23:05.567937 2026] [:error] [pid 22485:tid 22506] [client 43.157.191.20:39224] [client 43.157.191.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWYrGRzzbghmKib9ie_lvgAAAZM"]
[Tue Jan 13 20:26:16.399624 2026] [:error] [pid 22485:tid 22487] [client 192.42.116.180:38536] [client 192.42.116.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.42.116.180, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWY56BzzbghmKib9ie_yOwAAAYA"], referer: https://expressinteriors.com/xmlrpc.php?rsd
[Tue Jan 13 20:33:01.534603 2026] [:error] [pid 49677:tid 49702] [client 194.238.23.53:33770] [client 194.238.23.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.238.23.53, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWY7ffiKiDrYd_02VZooVQAAAFU"]
[Tue Jan 13 20:41:55.300716 2026] [:error] [pid 49677:tid 49683] [client 217.160.134.16:57956] [client 217.160.134.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.134.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWY9k_iKiDrYd_02VZophQAAAEI"]
[Tue Jan 13 20:46:55.247540 2026] [:error] [pid 22485:tid 22501] [client 54.78.115.243:58118] [client 54.78.115.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.78.115.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWY-vxzzbghmKib9ie_1LwAAAY4"]
[Tue Jan 13 20:51:58.245845 2026] [:error] [pid 27597:tid 27609] [client 66.175.237.46:42576] [client 66.175.237.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.175.237.46, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWY_7j8Db8v8HoJ3n4D_8gAAAAo"]
[Tue Jan 13 20:54:26.913921 2026] [:error] [pid 22425:tid 22446] [client 118.139.181.22:12360] [client 118.139.181.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.139.181.22, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZAgnLEE_SEuOZ0WBT1MQAAAI8"]
[Tue Jan 13 21:01:02.234586 2026] [:error] [pid 22485:tid 22496] [client 74.208.58.137:58636] [client 74.208.58.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.208.58.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZCDhzzbghmKib9ie_3QwAAAYk"]
[Tue Jan 13 21:04:51.819372 2026] [:error] [pid 33727:tid 33746] [client 82.165.88.253:58060] [client 82.165.88.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.88.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZC86HONsygso2w0OPpuAAAARE"]
[Tue Jan 13 21:14:03.772700 2026] [:error] [pid 27597:tid 27621] [client 107.180.112.74:62100] [client 107.180.112.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.112.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZFGz8Db8v8HoJ3n4AFgQAAABY"]
[Tue Jan 13 21:14:10.089404 2026] [:error] [pid 27597:tid 27601] [client 107.180.112.74:15240] [client 107.180.112.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.112.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZFIj8Db8v8HoJ3n4AFhgAAAAI"]
[Tue Jan 13 21:14:25.688391 2026] [:error] [pid 27597:tid 27612] [client 209.235.136.139:33426] [client 209.235.136.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.235.136.139, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZFMT8Db8v8HoJ3n4AFowAAAA0"]
[Tue Jan 13 21:21:33.235208 2026] [:error] [pid 22485:tid 22496] [client 45.32.103.99:49202] [client 45.32.103.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.32.103.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZG3RzzbghmKib9ie_56QAAAYk"]
[Tue Jan 13 21:23:19.501605 2026] [:error] [pid 22389:tid 22391] [client 162.19.11.250:39323] [client 162.19.11.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.19.11.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZHRyLIB_8b411qalJXZgAAAUA"]
[Tue Jan 13 21:32:38.027477 2026] [:error] [pid 27597:tid 27614] [client 82.165.83.244:36160] [client 82.165.83.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.83.244, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZJdj8Db8v8HoJ3n4ALNQAAAA8"]
[Tue Jan 13 21:46:40.252919 2026] [:error] [pid 27597:tid 27619] [client 162.19.58.172:46830] [client 162.19.58.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.19.58.172, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZMwD8Db8v8HoJ3n4AN_wAAABQ"]
[Tue Jan 13 21:47:16.540820 2026] [:error] [pid 33727:tid 33742] [client 49.51.183.84:44100] [client 49.51.183.84] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWZM5KHONsygso2w0OPzFAAAAQ0"]
[Tue Jan 13 22:13:31.631310 2026] [:error] [pid 22426:tid 22476] [client 68.178.145.207:22460] [client 68.178.145.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.145.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZTC9y1Q5toryYTHgPFIAAAANI"]
[Tue Jan 13 22:13:32.223404 2026] [:error] [pid 47987:tid 47997] [client 216.250.113.204:40658] [client 216.250.113.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.250.113.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZTDHpLPQ4HpxlnLJzVqgAAAcc"]
[Tue Jan 13 22:18:48.526835 2026] [:error] [pid 62074:tid 62090] [client 47.112.205.249:39266] [client 47.112.205.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.112.205.249, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZUSJy715lAJUfvubnSwgAAAUw"]
[Tue Jan 13 22:22:43.811656 2026] [:error] [pid 63931:tid 63937] [client 82.165.89.172:38430] [client 82.165.89.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.89.172, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZVM9VnG0cQj3cwmW8CZwAAAAQ"]
[Tue Jan 13 22:24:06.050816 2026] [:error] [pid 63931:tid 63947] [client 66.33.212.6:47280] [client 66.33.212.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.33.212.6, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZVhtVnG0cQj3cwmW8C9AAAAA4"]
[Tue Jan 13 22:35:37.520978 2026] [:error] [pid 63842:tid 63851] [client 45.32.103.99:45882] [client 45.32.103.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.32.103.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZYOW0zPTD54ET7u1n96wAAAUU"]
[Tue Jan 13 22:37:30.280335 2026] [:error] [pid 63931:tid 63954] [client 182.44.8.254:55958] [client 182.44.8.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWZYqtVnG0cQj3cwmW8JDgAAABU"]
[Tue Jan 13 22:38:11.062183 2026] [:error] [pid 63843:tid 63877] [client 51.79.228.86:44550] [client 51.79.228.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.79.228.86, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZY04qxEwB7D1-DxXevOwAAAIM"]
[Tue Jan 13 23:01:54.227975 2026] [:error] [pid 63844:tid 63905] [client 208.109.58.241:51120] [client 208.109.58.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.109.58.241, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZeYkL9rjD8EK1UiLnmlQAAAMQ"]
[Tue Jan 13 23:03:14.491671 2026] [:error] [pid 63843:tid 63883] [client 68.178.231.255:46534] [client 68.178.231.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.231.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZesoqxEwB7D1-DxXe1dQAAAIk"]
[Tue Jan 13 23:07:01.536248 2026] [:error] [pid 63931:tid 63942] [client 72.167.104.186:53918] [client 72.167.104.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.167.104.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZfldVnG0cQj3cwmW8ThQAAAAk"]
[Tue Jan 13 23:23:53.186402 2026] [:error] [pid 63843:tid 63876] [client 69.163.181.251:55326] [client 69.163.181.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.181.251, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZjiYqxEwB7D1-DxXe7YQAAAII"]
[Tue Jan 13 23:29:11.392422 2026] [:error] [pid 63842:tid 63849] [client 107.180.117.1:16444] [client 107.180.117.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.117.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZkx20zPTD54ET7u1kJXAAAAUM"]
[Tue Jan 13 23:32:39.232568 2026] [:error] [pid 63844:tid 63923] [client 31.11.36.89:35022] [client 31.11.36.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.11.36.89, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZll0L9rjD8EK1UiLnvRwAAANY"]
[Tue Jan 13 23:38:12.769481 2026] [:error] [pid 63844:tid 63910] [client 148.72.120.79:17480] [client 148.72.120.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.120.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZm5EL9rjD8EK1UiLnxwAAAAMk"]
[Tue Jan 13 23:40:44.726489 2026] [:error] [pid 63931:tid 63953] [client 132.148.179.104:19990] [client 132.148.179.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.179.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZnfNVnG0cQj3cwmW8jbwAAABQ"]
[Tue Jan 13 23:41:04.334098 2026] [:error] [pid 63843:tid 63883] [client 102.223.7.56:52314] [client 102.223.7.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.223.7.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZnkIqxEwB7D1-DxXfBrgAAAIk"]
[Tue Jan 13 23:44:42.742962 2026] [:error] [pid 63843:tid 63878] [client 173.201.180.187:19062] [client 173.201.180.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.201.180.187, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZoaoqxEwB7D1-DxXfDZgAAAIQ"]
[Tue Jan 13 23:56:23.264742 2026] [:error] [pid 63843:tid 63882] [client 162.241.226.202:42006] [client 162.241.226.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.226.202, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZrJ4qxEwB7D1-DxXfGNQAAAIg"]
[Tue Jan 13 23:56:38.450274 2026] [:error] [pid 63931:tid 63942] [client 162.241.226.202:48388] [client 162.241.226.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.226.202, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZrNtVnG0cQj3cwmW8pJAAAAAk"]
[Wed Jan 14 00:14:30.908383 2026] [:error] [pid 63842:tid 63858] [client 69.58.4.39:35528] [client 69.58.4.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.58.4.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZvZm0zPTD54ET7u1kX4QAAAUw"], referer: https://expressinteriors.com/
[Wed Jan 14 00:16:11.620019 2026] [:error] [pid 25809:tid 25819] [client 72.167.105.170:11478] [client 72.167.105.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.167.105.170, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZvy49SDqNJ9R9VfZDigwAAAEg"]
[Wed Jan 14 00:27:03.985657 2026] [:error] [pid 63931:tid 63933] [client 66.33.212.6:45712] [client 66.33.212.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.33.212.6, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZyV9VnG0cQj3cwmW80QwAAAAA"]
[Wed Jan 14 00:38:58.298110 2026] [:error] [pid 63843:tid 63883] [client 217.160.134.12:52904] [client 217.160.134.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.134.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZ1IoqxEwB7D1-DxXfTqAAAAIk"]
[Wed Jan 14 00:57:48.756696 2026] [:error] [pid 25809:tid 25828] [client 107.180.118.178:11598] [client 107.180.118.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.118.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWZ5jI9SDqNJ9R9VfZD0jgAAAFE"]
[Wed Jan 14 01:10:31.384721 2026] [:error] [pid 63842:tid 63861] [client 43.153.96.233:37970] [client 43.153.96.233] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWZ8h20zPTD54ET7u1kloQAAAU8"]
[Wed Jan 14 01:33:59.895735 2026] [:error] [pid 63842:tid 63857] [client 162.241.252.50:29892] [client 162.241.252.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.252.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWaCB20zPTD54ET7u1kr4AAAAUs"]
[Wed Jan 14 01:34:16.452353 2026] [:error] [pid 63843:tid 63889] [client 162.241.252.50:21960] [client 162.241.252.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.252.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWaCGIqxEwB7D1-DxXfjtgAAAI8"]
[Wed Jan 14 01:57:49.798610 2026] [:error] [pid 25809:tid 25816] [client 162.241.252.50:53282] [client 162.241.252.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.252.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWaHnY9SDqNJ9R9VfZAHVwAAAEU"]
[Wed Jan 14 01:59:49.747642 2026] [:error] [pid 43385:tid 43405] [client 102.223.7.56:34298] [client 102.223.7.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.223.7.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWaIFcFJIMneckmN0mrxiQAAAQo"]
[Wed Jan 14 02:08:20.560521 2026] [:error] [pid 25809:tid 25812] [client 45.32.103.99:48084] [client 45.32.103.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.32.103.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWaKFI9SDqNJ9R9VfZAKXgAAAEE"]
[Wed Jan 14 02:26:51.892836 2026] [:error] [pid 63931:tid 63934] [client 103.227.176.10:41576] [client 103.227.176.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.227.176.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWaOa9VnG0cQj3cwmW9gMAAAAAE"]
[Wed Jan 14 02:28:54.062029 2026] [:error] [pid 43494:tid 43508] [client 216.69.173.59:15018] [client 216.69.173.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.69.173.59, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWaO5siBIyHKw4YELOkU_QAAAYU"]
[Wed Jan 14 02:31:04.733322 2026] [:error] [pid 63931:tid 63944] [client 45.32.103.99:60098] [client 45.32.103.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.32.103.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWaPaNVnG0cQj3cwmW9iIwAAAAs"]
[Wed Jan 14 02:39:02.145630 2026] [:error] [pid 63844:tid 63917] [client 187.106.43.238:15046] [client 187.106.43.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.106.43.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWaRRkL9rjD8EK1UiLkmowAAANA"]
[Wed Jan 14 02:40:38.088865 2026] [:error] [pid 25809:tid 25811] [client 149.255.58.163:52202] [client 149.255.58.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.255.58.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWaRpo9SDqNJ9R9VfZASagAAAEA"]
[Wed Jan 14 02:41:42.460277 2026] [:error] [pid 25809:tid 25813] [client 40.83.79.160:52010] [client 40.83.79.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.83.79.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWaR5o9SDqNJ9R9VfZASmAAAAEI"], referer: https://www.google.fr/
[Wed Jan 14 02:41:43.776604 2026] [autoindex:error] [pid 63842:tid 63856] [client 40.83.79.160:46481] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Wed Jan 14 02:41:43.898923 2026] [autoindex:error] [pid 63842:tid 63860] [client 40.83.79.160:46481] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Wed Jan 14 02:41:44.709138 2026] [autoindex:error] [pid 63842:tid 63863] [client 40.83.79.160:46481] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Wed Jan 14 02:41:44.834020 2026] [autoindex:error] [pid 63842:tid 63862] [client 40.83.79.160:46481] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Wed Jan 14 02:41:45.571544 2026] [autoindex:error] [pid 63842:tid 63861] [client 40.83.79.160:46481] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Wed Jan 14 02:41:45.696673 2026] [autoindex:error] [pid 63842:tid 63847] [client 40.83.79.160:46481] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://duckduckgo.com/
[Wed Jan 14 02:41:47.099815 2026] [:error] [pid 25809:tid 25818] [client 40.83.79.160:52010] [client 40.83.79.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.83.79.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWaR649SDqNJ9R9VfZASnAAAAEc"], referer: https://www.yahoo.com/
[Wed Jan 14 02:41:53.399234 2026] [autoindex:error] [pid 63842:tid 63870] [client 40.83.79.160:46481] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Wed Jan 14 02:41:53.523969 2026] [autoindex:error] [pid 63842:tid 63846] [client 40.83.79.160:46481] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Wed Jan 14 02:41:53.645606 2026] [autoindex:error] [pid 63842:tid 63854] [client 40.83.79.160:46481] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.fr/
[Wed Jan 14 02:41:53.761886 2026] [:error] [pid 63842:tid 63863] [client 40.83.79.160:46481] [client 40.83.79.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aWaR8W0zPTD54ET7u1k7kgAAAVE"], referer: https://www.google.fr/
[Wed Jan 14 02:41:54.005969 2026] [autoindex:error] [pid 63931:tid 63935] [client 40.83.79.160:44463] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Wed Jan 14 02:41:54.123484 2026] [:error] [pid 63931:tid 63948] [client 40.83.79.160:44463] [client 40.83.79.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aWaR8tVnG0cQj3cwmW9nPAAAAA8"], referer: https://www.google.fr/
[Wed Jan 14 02:41:54.362291 2026] [autoindex:error] [pid 43385:tid 43403] [client 40.83.79.160:51997] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.yahoo.com/
[Wed Jan 14 02:41:54.482823 2026] [:error] [pid 43385:tid 43406] [client 40.83.79.160:51997] [client 40.83.79.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/index.php"] [unique_id "aWaR8sFJIMneckmN0mr8dQAAAQs"], referer: https://www.bing.com/
[Wed Jan 14 02:41:54.717135 2026] [:error] [pid 63843:tid 63877] [client 40.83.79.160:44461] [client 40.83.79.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/gallery/index.php"] [unique_id "aWaR8oqxEwB7D1-DxXf3uAAAAIM"], referer: https://www.yahoo.com/
[Wed Jan 14 02:41:54.961036 2026] [autoindex:error] [pid 63843:tid 63881] [client 40.83.79.160:45220] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.com/
[Wed Jan 14 02:41:55.082060 2026] [:error] [pid 63843:tid 63892] [client 40.83.79.160:45220] [client 40.83.79.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aWaR84qxEwB7D1-DxXf3ugAAAJI"], referer: https://www.bing.com/
[Wed Jan 14 02:41:55.317379 2026] [:error] [pid 63843:tid 63875] [client 40.83.79.160:44478] [client 40.83.79.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aWaR84qxEwB7D1-DxXf3uwAAAIE"], referer: https://www.google.de/
[Wed Jan 14 02:41:55.555974 2026] [autoindex:error] [pid 63931:tid 63943] [client 40.83.79.160:44431] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.co.uk/
[Wed Jan 14 02:41:57.228098 2026] [:error] [pid 63931:tid 63946] [client 40.83.79.160:44431] [client 40.83.79.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 40.83.79.160, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWaR9dVnG0cQj3cwmW9nQQAAAA0"], referer: https://www.yahoo.com/
[Wed Jan 14 02:49:26.641233 2026] [:error] [pid 63842:tid 63868] [client 66.175.44.20:54356] [client 66.175.44.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.175.44.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWaTtm0zPTD54ET7u1k9pAAAAVY"]
[Wed Jan 14 02:50:48.528688 2026] [:error] [pid 43494:tid 43510] [client 173.201.252.112:55468] [client 173.201.252.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.201.252.112, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWaUCMiBIyHKw4YELOkZXgAAAYc"]
[Wed Jan 14 02:53:18.329540 2026] [:error] [pid 63844:tid 63905] [client 132.148.180.99:44996] [client 132.148.180.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.180.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWaUnkL9rjD8EK1UiLkpCwAAAMQ"]
[Wed Jan 14 02:59:01.374807 2026] [:error] [pid 63931:tid 63943] [client 66.175.44.70:47152] [client 66.175.44.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.175.44.70, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWaV9dVnG0cQj3cwmW9vagAAAAo"]
[Wed Jan 14 03:00:37.072591 2026] [:error] [pid 25809:tid 25835] [client 36.50.54.19:13458] [client 36.50.54.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.50.54.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWaWVY9SDqNJ9R9VfZAYNAAAAFg"]
[Wed Jan 14 03:00:47.623523 2026] [:error] [pid 25809:tid 25817] [client 36.50.54.19:43640] [client 36.50.54.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.50.54.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWaWX49SDqNJ9R9VfZAYOAAAAEY"]
[Wed Jan 14 03:03:52.360668 2026] [:error] [pid 25809:tid 25835] [client 109.234.162.86:54752] [client 109.234.162.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.234.162.86, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWaXGI9SDqNJ9R9VfZAYuQAAAFg"]
[Wed Jan 14 03:37:22.190181 2026] [:error] [pid 24603:tid 24673] [client 220.158.233.198:21450] [client 220.158.233.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.158.233.198, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWae8pPBJGFGN8VT8_SKnwAAAIg"]
[Wed Jan 14 04:01:26.300872 2026] [:error] [pid 58977:tid 58993] [client 51.79.178.96:57692] [client 51.79.178.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.79.178.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWaklrlT6ggZLRx9QvD3bwAAAg0"]
[Wed Jan 14 04:08:32.837195 2026] [:error] [pid 24602:tid 24657] [client 68.178.145.207:44164] [client 68.178.145.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.145.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWamQEooYwabcb9R9fwwjgAAAFM"]
[Wed Jan 14 04:40:32.787418 2026] [:error] [pid 58901:tid 58947] [client 95.169.180.54:60958] [client 95.169.180.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.169.180.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWatwL3kQSrcqIWtO0ogagAAAdE"]
[Wed Jan 14 04:40:37.669148 2026] [:error] [pid 24710:tid 24724] [client 95.169.180.54:41194] [client 95.169.180.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.169.180.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWatxWXBo5bEhDEEhs1WoAAAAMw"]
[Wed Jan 14 04:58:32.101066 2026] [:error] [pid 59074:tid 59080] [client 82.165.90.95:33234] [client 82.165.90.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.90.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWax-E_KrJ818pzhB3xjCAAAAkQ"]
[Wed Jan 14 05:01:42.554608 2026] [:error] [pid 59074:tid 59087] [client 173.212.196.41:39422] [client 173.212.196.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.212.196.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWaytk_KrJ818pzhB3xjOQAAAks"]
[Wed Jan 14 05:07:44.138225 2026] [:error] [pid 24710:tid 24719] [client 45.92.127.79:44431] [client 45.92.127.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.92.127.79, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWa0IGXBo5bEhDEEhs1f4gAAAMc"], referer: https://expressinteriors.com/
[Wed Jan 14 05:07:46.062205 2026] [:error] [pid 59074:tid 59091] [client 45.92.127.79:58215] [client 45.92.127.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.92.127.79, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWa0Ik_KrJ818pzhB3xkVAAAAk8"], referer: https://expressinteriors.com/wp-login.php?action=register
[Wed Jan 14 05:15:52.582695 2026] [:error] [pid 24603:tid 24674] [client 128.140.68.198:37300] [client 128.140.68.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.140.68.198, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWa2CJPBJGFGN8VT8_SjgQAAAIk"]
[Wed Jan 14 05:28:35.095840 2026] [:error] [pid 24710:tid 24726] [client 173.212.196.41:49176] [client 173.212.196.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.212.196.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWa5A2XBo5bEhDEEhs1knQAAAM4"]
[Wed Jan 14 06:00:06.842629 2026] [:error] [pid 58901:tid 58951] [client 162.241.218.97:28876] [client 162.241.218.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.218.97, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbAZr3kQSrcqIWtO0otZQAAAdU"]
[Wed Jan 14 06:26:40.560371 2026] [:error] [pid 24603:tid 24676] [client 154.30.2.66:37942] [client 154.30.2.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.30.2.66, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbGoJPBJGFGN8VT8_Sw0gAAAIs"]
[Wed Jan 14 06:28:07.671395 2026] [:error] [pid 24601:tid 24615] [client 20.27.218.116:8758] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aWbG90CtWkZ9rlKW5n-KMAAAAAU"]
[Wed Jan 14 06:28:08.139714 2026] [:error] [pid 24603:tid 24670] [client 20.27.218.116:8580] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aWbG-JPBJGFGN8VT8_SxggAAAIU"]
[Wed Jan 14 06:28:08.901400 2026] [:error] [pid 58901:tid 58947] [client 20.27.218.116:8760] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aWbG-L3kQSrcqIWtO0o4hQAAAdE"]
[Wed Jan 14 06:28:09.466246 2026] [:error] [pid 58977:tid 58982] [client 20.27.218.116:8761] [client 20.27.218.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aWbG-blT6ggZLRx9QvALNAAAAgI"]
[Wed Jan 14 06:39:51.240075 2026] [:error] [pid 58901:tid 58948] [client 82.165.84.33:35788] [client 82.165.84.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.84.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbJt73kQSrcqIWtO0o7sgAAAdI"]
[Wed Jan 14 06:40:02.343658 2026] [:error] [pid 58899:tid 58910] [client 82.165.84.33:35802] [client 82.165.84.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.84.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbJwgWViGQd5R44tHF_hQAAAYc"]
[Wed Jan 14 06:51:20.179462 2026] [:error] [pid 58901:tid 58936] [client 149.255.62.144:35704] [client 149.255.62.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.255.62.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbMaL3kQSrcqIWtO0o_XAAAAcY"]
[Wed Jan 14 06:52:44.885046 2026] [:error] [pid 58977:tid 58980] [client 72.167.125.62:55586] [client 72.167.125.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.167.125.62, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbMvLlT6ggZLRx9QvAO0gAAAgA"]
[Wed Jan 14 06:53:16.386222 2026] [:error] [pid 59074:tid 59088] [client 72.167.125.62:52586] [client 72.167.125.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.167.125.62, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbM3E_KrJ818pzhB3xzdAAAAkw"]
[Wed Jan 14 06:55:26.988392 2026] [:error] [pid 24601:tid 24616] [client 178.162.199.81:43118] [client 178.162.199.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.162.199.81, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbNXkCtWkZ9rlKW5n-NwAAAAAY"]
[Wed Jan 14 06:56:05.372645 2026] [:error] [pid 59074:tid 59098] [client 50.63.27.74:48092] [client 50.63.27.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.63.27.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbNhU_KrJ818pzhB3x0RwAAAlY"]
[Wed Jan 14 07:00:09.822149 2026] [:error] [pid 59074:tid 59091] [client 94.130.33.49:41182] [client 94.130.33.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.130.33.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbOeU_KrJ818pzhB3x0zQAAAk8"]
[Wed Jan 14 07:13:18.711852 2026] [:error] [pid 24710:tid 24732] [client 195.250.21.230:37840] [client 195.250.21.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.250.21.230, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbRjmXBo5bEhDEEhs1-oQAAANQ"]
[Wed Jan 14 07:22:14.082807 2026] [:error] [pid 24601:tid 24611] [client 43.158.91.71:53674] [client 43.158.91.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWbTpkCtWkZ9rlKW5n-QlQAAAAE"]
[Wed Jan 14 07:22:40.759465 2026] [:error] [pid 24603:tid 24666] [client 68.178.150.117:37326] [client 68.178.150.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.150.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbTwJPBJGFGN8VT8_S8vgAAAIE"]
[Wed Jan 14 07:51:03.504459 2026] [:error] [pid 58901:tid 58938] [client 198.12.222.72:38238] [client 198.12.222.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.12.222.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbaZ73kQSrcqIWtO0pQpwAAAcg"]
[Wed Jan 14 07:58:45.886163 2026] [:error] [pid 24603:tid 24689] [client 177.52.160.19:43880] [client 177.52.160.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.52.160.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbcNZPBJGFGN8VT8_TCcgAAAJg"]
[Wed Jan 14 08:03:20.860529 2026] [:error] [pid 3186:tid 3210] [client 65.181.111.238:38624] [client 65.181.111.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.181.111.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbdSH57uVot2PAThYgHfAAAAxU"]
[Wed Jan 14 08:06:59.103104 2026] [:error] [pid 24603:tid 24687] [client 45.32.103.99:58884] [client 45.32.103.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.32.103.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbeI5PBJGFGN8VT8_TELgAAAJY"]
[Wed Jan 14 08:09:08.002490 2026] [:error] [pid 58901:tid 58950] [client 102.129.223.92:63396] [client 102.129.223.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.129.223.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbepL3kQSrcqIWtO0pXSgAAAdQ"], referer: https://expressinteriors.com/
[Wed Jan 14 08:27:37.680781 2026] [:error] [pid 19278:tid 19303] [client 84.54.28.113:41656] [client 84.54.28.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.54.28.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbi-VGofyyxZQcTd1U1IgAAABc"]
[Wed Jan 14 08:29:29.504834 2026] [:error] [pid 19188:tid 19234] [client 84.54.28.113:35062] [client 84.54.28.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.54.28.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbjaZ4gjaoWMKiTtXtNywAAAU4"]
[Wed Jan 14 08:31:08.232482 2026] [:error] [pid 19188:tid 19224] [client 66.175.44.21:37088] [client 66.175.44.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.175.44.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbjzJ4gjaoWMKiTtXtOLgAAAUQ"]
[Wed Jan 14 08:46:30.961280 2026] [:error] [pid 19188:tid 19229] [client 162.213.209.162:48352] [client 162.213.209.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.213.209.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbnZp4gjaoWMKiTtXtSEQAAAUk"]
[Wed Jan 14 08:54:05.595166 2026] [:error] [pid 19278:tid 19302] [client 84.54.28.113:47084] [client 84.54.28.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.54.28.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbpLVGofyyxZQcTd1VBUwAAABY"]
[Wed Jan 14 09:12:34.921600 2026] [:error] [pid 19188:tid 19237] [client 176.6.204.64:21213] [client 176.6.204.64] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aWbtgp4gjaoWMKiTtXtaHgAAAVE"], referer: https://www.google.com
[Wed Jan 14 09:12:40.770731 2026] [:error] [pid 19278:tid 19303] [client 176.6.204.64:21331] [client 176.6.204.64] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbtiFGofyyxZQcTd1VHEwAAABc"]
[Wed Jan 14 09:12:40.771032 2026] [:error] [pid 19278:tid 19303] [client 176.6.204.64:21331] [client 176.6.204.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.6.204.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbtiFGofyyxZQcTd1VHEwAAABc"]
[Wed Jan 14 09:12:44.166304 2026] [:error] [pid 19187:tid 19202] [client 176.6.204.64:21353] [client 176.6.204.64] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbtjM9QVhFYhOfPPbPDGAAAAEo"]
[Wed Jan 14 09:12:44.166638 2026] [:error] [pid 19187:tid 19202] [client 176.6.204.64:21353] [client 176.6.204.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.6.204.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbtjM9QVhFYhOfPPbPDGAAAAEo"]
[Wed Jan 14 09:12:47.050830 2026] [:error] [pid 19187:tid 19197] [client 176.6.204.64:21391] [client 176.6.204.64] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbtj89QVhFYhOfPPbPDHAAAAEU"]
[Wed Jan 14 09:12:47.051155 2026] [:error] [pid 19187:tid 19197] [client 176.6.204.64:21391] [client 176.6.204.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.6.204.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbtj89QVhFYhOfPPbPDHAAAAEU"]
[Wed Jan 14 09:12:49.798987 2026] [:error] [pid 36986:tid 37008] [client 176.6.204.64:21392] [client 176.6.204.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.6.204.64, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWbtkde0JvHv1YdpWx7haAAAAJM"], referer: https://www.google.com
[Wed Jan 14 09:12:52.756983 2026] [:error] [pid 19278:tid 19295] [client 174.216.208.246:10109] [client 174.216.208.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 174.216.208.246, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWbtlFGofyyxZQcTd1VHGgAAAA8"], referer: https://expressinteriors.com/wp-login.php
[Wed Jan 14 09:12:58.156463 2026] [:error] [pid 36986:tid 37001] [client 174.216.208.246:11074] [client 174.216.208.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 174.216.208.246, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWbtmte0JvHv1YdpWx7hmQAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Wed Jan 14 09:13:00.366781 2026] [:error] [pid 19278:tid 19291] [client 45.143.143.3:2127] [client 45.143.143.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.143.143.3, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWbtnFGofyyxZQcTd1VHHAAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Wed Jan 14 09:13:05.866621 2026] [:error] [pid 19188:tid 19237] [client 45.143.143.3:40271] [client 45.143.143.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.143.143.3, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWbtoZ4gjaoWMKiTtXtaKAAAAVE"], referer: https://expressinteriors.com/wp-login.php
[Wed Jan 14 09:21:40.107010 2026] [:error] [pid 36986:tid 37007] [client 132.148.182.54:12786] [client 132.148.182.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.182.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbvpNe0JvHv1YdpWx7jYAAAAJI"]
[Wed Jan 14 09:22:24.971303 2026] [:error] [pid 19187:tid 19198] [client 68.183.98.56:35092] [client 68.183.98.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.98.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWbv0M9QVhFYhOfPPbPGJgAAAEY"]
[Wed Jan 14 10:01:32.043986 2026] [:error] [pid 37034:tid 37044] [client 187.106.43.238:14955] [client 187.106.43.238] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aWb4_PpIliqezwCf6Q0jzgAAAMg"]
[Wed Jan 14 10:03:20.449132 2026] [:error] [pid 37225:tid 37252] [client 187.106.43.238:15260] [client 187.106.43.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.106.43.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWb5aOYdRPDSEpBLRUPXYwAAARg"]
[Wed Jan 14 10:04:56.183482 2026] [:error] [pid 19278:tid 19281] [client 187.106.43.238:15141] [client 187.106.43.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.106.43.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWb5yFGofyyxZQcTd1VOyAAAAAE"]
[Wed Jan 14 10:06:24.956971 2026] [:error] [pid 19188:tid 19223] [client 187.106.43.238:21269] [client 187.106.43.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.106.43.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWb6IJ4gjaoWMKiTtXthhgAAAUM"]
[Wed Jan 14 10:07:53.629740 2026] [:error] [pid 37225:tid 37243] [client 187.106.43.238:15302] [client 187.106.43.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.106.43.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWb6eeYdRPDSEpBLRUPZUgAAAQ8"]
[Wed Jan 14 10:09:24.059692 2026] [:error] [pid 19187:tid 19197] [client 187.106.43.238:15187] [client 187.106.43.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.106.43.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWb61M9QVhFYhOfPPbPP4QAAAEU"]
[Wed Jan 14 10:10:17.620039 2026] [:error] [pid 19187:tid 19212] [client 43.164.197.209:38772] [client 43.164.197.209] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWb7Cc9QVhFYhOfPPbPQCwAAAFQ"]
[Wed Jan 14 10:15:03.908734 2026] [:error] [pid 19188:tid 19237] [client 198.12.222.72:50376] [client 198.12.222.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.12.222.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWb8J54gjaoWMKiTtXtjAQAAAVE"]
[Wed Jan 14 10:47:19.576843 2026] [:error] [pid 37225:tid 37249] [client 208.109.173.77:52476] [client 208.109.173.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.109.173.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWcDt-YdRPDSEpBLRUPl3AAAARU"]
[Wed Jan 14 10:47:42.278996 2026] [:error] [pid 19278:tid 19299] [client 208.109.173.77:22264] [client 208.109.173.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.109.173.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWcDzlGofyyxZQcTd1VWIgAAABM"]
[Wed Jan 14 10:49:45.666957 2026] [:error] [pid 37225:tid 37240] [client 132.148.176.115:41642] [client 132.148.176.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.176.115, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWcESeYdRPDSEpBLRUPmOQAAAQw"]
[Wed Jan 14 11:00:01.527899 2026] [:error] [pid 19189:tid 19255] [client 118.139.176.12:44754] [client 118.139.176.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.139.176.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWcGsXCsh382x04yx-0SMAAAAcg"]
[Wed Jan 14 11:01:06.694439 2026] [:error] [pid 19187:tid 19193] [client 173.201.182.241:40906] [client 173.201.182.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.201.182.241, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWcG8s9QVhFYhOfPPbParAAAAEE"]
[Wed Jan 14 11:03:17.280393 2026] [:error] [pid 19278:tid 19292] [client 142.132.248.161:41752] [client 142.132.248.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.132.248.161, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWcHdVGofyyxZQcTd1VYKQAAAAw"]
[Wed Jan 14 11:09:28.886431 2026] [:error] [pid 19188:tid 19241] [client 149.255.62.154:53558] [client 149.255.62.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.255.62.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWcI6J4gjaoWMKiTtXtrrgAAAVU"]
[Wed Jan 14 11:12:18.937614 2026] [:error] [pid 36986:tid 37008] [client 132.148.177.159:53692] [client 132.148.177.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.177.159, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWcJkte0JvHv1YdpWx71VQAAAJM"]
[Wed Jan 14 11:21:42.439691 2026] [:error] [pid 19278:tid 19290] [client 98.80.20.232:35456] [client 98.80.20.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.80.20.232, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWcLxlGofyyxZQcTd1VavgAAAAo"]
[Wed Jan 14 12:35:20.789576 2026] [:error] [pid 19189:tid 19247] [client 148.72.1.37:38456] [client 148.72.1.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.1.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWcdCHCsh382x04yx-0miAAAAcA"]
[Wed Jan 14 12:35:20.790898 2026] [:error] [pid 19189:tid 19247] [client 148.72.1.37:38456] [client 148.72.1.37] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWcdCHCsh382x04yx-0miAAAAcA"]
[Wed Jan 14 12:35:20.792214 2026] [:error] [pid 19189:tid 19247] [client 148.72.1.37:38456] [client 148.72.1.37] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWcdCHCsh382x04yx-0miAAAAcA"]
[Wed Jan 14 13:06:45.400398 2026] [:error] [pid 19188:tid 19230] [client 198.49.66.130:37570] [client 198.49.66.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.49.66.130, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWckZZ4gjaoWMKiTtXt_jwAAAUo"]
[Wed Jan 14 13:39:31.734629 2026] [:error] [pid 19187:tid 19205] [client 107.180.116.4:21298] [client 107.180.116.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.116.4, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWcsE89QVhFYhOfPPbP6fAAAAE0"]
[Wed Jan 14 13:40:40.024042 2026] [:error] [pid 37034:tid 37055] [client 103.26.10.123:39194] [client 103.26.10.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.26.10.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWcsWPpIliqezwCf6Q1ThgAAANM"]
[Wed Jan 14 13:47:13.289694 2026] [:error] [pid 61378:tid 61455] [client 43.166.1.243:48096] [client 43.166.1.243] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWct4RGjJjuJmoPOtlr6XgAAABI"]
[Wed Jan 14 13:59:04.511486 2026] [:error] [pid 61378:tid 61461] [client 66.175.44.62:53576] [client 66.175.44.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.175.44.62, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWcwqBGjJjuJmoPOtlr-5AAAABg"]
[Wed Jan 14 14:00:16.645201 2026] [:error] [pid 61377:tid 61426] [client 192.169.144.1:50104] [client 192.169.144.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.169.144.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWcw8Mx0Xs4tcq6R-WgF8QAAAdA"]
[Wed Jan 14 14:00:16.647672 2026] [:error] [pid 61377:tid 61426] [client 192.169.144.1:50104] [client 192.169.144.1] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWcw8Mx0Xs4tcq6R-WgF8QAAAdA"]
[Wed Jan 14 14:00:16.649469 2026] [:error] [pid 61377:tid 61426] [client 192.169.144.1:50104] [client 192.169.144.1] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWcw8Mx0Xs4tcq6R-WgF8QAAAdA"]
[Wed Jan 14 14:05:30.505982 2026] [:error] [pid 61377:tid 61411] [client 49.212.180.230:58915] [client 49.212.180.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.212.180.230, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWcyKsx0Xs4tcq6R-WgIFgAAAcE"]
[Wed Jan 14 14:36:18.390538 2026] [:error] [pid 7961:tid 7975] [client 162.241.217.102:30448] [client 162.241.217.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.217.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWc5YpjhjzEJ3QX9HubEIQAAAEw"]
[Wed Jan 14 14:40:00.209639 2026] [:error] [pid 61468:tid 61489] [client 34.93.1.77:34502] [client 34.93.1.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.93.1.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWc6QNfEBBL2jp9TJvKKLQAAAJI"]
[Wed Jan 14 15:09:18.512617 2026] [:error] [pid 7961:tid 7972] [client 173.201.178.72:36358] [client 173.201.178.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.201.178.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWdBHpjhjzEJ3QX9HubLzAAAAEk"]
[Wed Jan 14 15:37:28.253058 2026] [:error] [pid 61378:tid 61458] [client 162.19.58.174:47422] [client 162.19.58.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.19.58.174, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWdHuBGjJjuJmoPOtloUAgAAABU"]
[Wed Jan 14 15:47:28.196779 2026] [:error] [pid 21490:tid 21494] [client 162.241.219.137:10760] [client 162.241.219.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.219.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWdKEO26AHzy1muKyucM0wAAAQE"]
[Wed Jan 14 15:51:02.683656 2026] [:error] [pid 21490:tid 21513] [client 159.253.33.92:60836] [client 159.253.33.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.253.33.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWdK5u26AHzy1muKyucNWQAAARQ"]
[Wed Jan 14 15:54:35.544284 2026] [:error] [pid 8057:tid 8081] [client 118.139.177.45:27278] [client 118.139.177.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.139.177.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWdLu7FNJ5k8MCPHoPXh_gAAANY"]
[Wed Jan 14 16:04:08.408270 2026] [:error] [pid 61378:tid 61442] [client 66.175.44.55:47554] [client 66.175.44.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.175.44.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWdN-BGjJjuJmoPOtloXqAAAAAU"]
[Wed Jan 14 16:04:29.952682 2026] [:error] [pid 21490:tid 21500] [client 194.163.174.55:52648] [client 194.163.174.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.163.174.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWdODe26AHzy1muKyucP3QAAAQc"]
[Wed Jan 14 16:14:06.251108 2026] [:error] [pid 61468:tid 61494] [client 124.156.157.91:55680] [client 124.156.157.91] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWdQTtfEBBL2jp9TJvKXnwAAAJc"]
[Wed Jan 14 16:27:39.344579 2026] [:error] [pid 8057:tid 8071] [client 103.28.36.122:42334] [client 103.28.36.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.28.36.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWdTe7FNJ5k8MCPHoPXnkQAAAMw"]
[Wed Jan 14 16:40:06.362413 2026] [:error] [pid 8057:tid 8064] [client 66.85.132.90:36436] [client 66.85.132.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.85.132.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWdWZrFNJ5k8MCPHoPXqLwAAAMU"]
[Wed Jan 14 17:08:56.553629 2026] [:error] [pid 61468:tid 61485] [client 103.26.10.81:32822] [client 103.26.10.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.26.10.81, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWddKNfEBBL2jp9TJvKfRAAAAI4"]
[Wed Jan 14 17:26:12.296666 2026] [:error] [pid 61377:tid 61428] [client 190.92.174.184:50224] [client 190.92.174.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.92.174.184, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWdhNMx0Xs4tcq6R-Wg9mAAAAdI"]
[Wed Jan 14 17:55:22.657380 2026] [:error] [pid 61468:tid 61493] [client 132.148.179.104:45026] [client 132.148.179.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.179.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWdoCtfEBBL2jp9TJvKm1QAAAJY"]
[Wed Jan 14 18:02:09.072836 2026] [:error] [pid 61378:tid 61442] [client 103.154.176.251:54842] [client 103.154.176.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.154.176.251, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWdpoRGjJjuJmoPOtlop3gAAAAU"]
[Wed Jan 14 18:08:10.778525 2026] [:error] [pid 61377:tid 61417] [client 148.72.2.141:38266] [client 148.72.2.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.2.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWdrCsx0Xs4tcq6R-WhIvgAAAcc"]
[Wed Jan 14 18:20:20.751518 2026] [:error] [pid 21490:tid 21497] [client 162.216.9.124:55742] [client 162.216.9.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.216.9.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWdt5O26AHzy1muKyuct3QAAAQQ"]
[Wed Jan 14 18:20:33.995392 2026] [:error] [pid 21490:tid 21510] [client 81.88.49.50:28099] [client 81.88.49.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWdt8e26AHzy1muKyuct5wAAARE"]
[Wed Jan 14 18:20:50.083631 2026] [:error] [pid 61378:tid 61441] [client 81.88.49.50:31590] [client 81.88.49.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWduAhGjJjuJmoPOtlosxAAAAAQ"]
[Wed Jan 14 18:30:34.521309 2026] [:error] [pid 61376:tid 61402] [client 185.249.40.156:54130] [client 185.249.40.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.249.40.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWdwSqjRUNDW2YrxZG5PsgAAAVU"]
[Wed Jan 14 18:36:54.002416 2026] [:error] [pid 61377:tid 61427] [client 185.249.40.156:35016] [client 185.249.40.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.249.40.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWdxxsx0Xs4tcq6R-WhQiQAAAdE"]
[Wed Jan 14 18:51:59.871886 2026] [:error] [pid 61376:tid 61396] [client 103.26.10.81:34162] [client 103.26.10.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.26.10.81, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWd1T6jRUNDW2YrxZG5SawAAAU8"]
[Wed Jan 14 18:54:08.286321 2026] [:error] [pid 61468:tid 61472] [client 114.35.71.166:62086] [client 114.35.71.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 114.35.71.166, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWd10NfEBBL2jp9TJvKwcgAAAIE"]
[Wed Jan 14 19:09:32.850381 2026] [:error] [pid 21490:tid 21502] [client 162.241.230.119:54488] [client 162.241.230.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.230.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWd5bO26AHzy1muKyuc45QAAAQk"]
[Wed Jan 14 19:09:45.060562 2026] [:error] [pid 7961:tid 7968] [client 162.241.230.119:21822] [client 162.241.230.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.230.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWd5eZjhjzEJ3QX9Hub18wAAAEU"]
[Wed Jan 14 19:17:39.471471 2026] [:error] [pid 61377:tid 61426] [client 84.234.98.73:53468] [client 84.234.98.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.234.98.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWd7U8x0Xs4tcq6R-WhcaQAAAdA"]
[Wed Jan 14 19:22:32.973034 2026] [:error] [pid 21490:tid 21507] [client 104.234.134.98:41424] [client 104.234.134.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.234.134.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWd8eO26AHzy1muKyuc8CAAAAQ4"]
[Wed Jan 14 19:24:37.385706 2026] [:error] [pid 8057:tid 8061] [client 220.158.232.94:24712] [client 220.158.232.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.158.232.94, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWd89bFNJ5k8MCPHoPUJrgAAAMI"]
[Wed Jan 14 19:37:44.418247 2026] [:error] [pid 7961:tid 7964] [client 103.154.176.251:48606] [client 103.154.176.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.154.176.251, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWeACJjhjzEJ3QX9Hub65wAAAEE"]
[Wed Jan 14 19:42:24.455408 2026] [:error] [pid 7961:tid 7971] [client 43.130.100.35:48980] [client 43.130.100.35] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWeBIJjhjzEJ3QX9Hub7nwAAAEg"]
[Wed Jan 14 19:46:35.063244 2026] [:error] [pid 21490:tid 21496] [client 149.62.185.217:27832] [client 149.62.185.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.62.185.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWeCG-26AHzy1muKyudB0wAAAQM"]
[Wed Jan 14 19:58:05.074925 2026] [:error] [pid 61377:tid 61425] [client 57.151.82.21:53848] [client 57.151.82.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 57.151.82.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWeEzcx0Xs4tcq6R-WhoCAAAAc8"]
[Wed Jan 14 20:14:27.098373 2026] [:error] [pid 61377:tid 61412] [client 192.169.171.147:52646] [client 192.169.171.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.169.171.147, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWeIo8x0Xs4tcq6R-Whs6QAAAcI"]
[Wed Jan 14 20:20:14.080794 2026] [:error] [pid 61376:tid 61403] [client 185.17.139.206:58948] [client 185.17.139.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.17.139.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWeJ_qjRUNDW2YrxZG5fQgAAAVY"]
[Wed Jan 14 20:30:59.251073 2026] [:error] [pid 61376:tid 61381] [client 162.241.230.119:35042] [client 162.241.230.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.230.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWeMg6jRUNDW2YrxZG5g6AAAAUA"]
[Wed Jan 14 20:41:57.909521 2026] [:error] [pid 61378:tid 61441] [client 64.31.40.162:54796] [client 64.31.40.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.31.40.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWePFRGjJjuJmoPOtlpA9wAAAAQ"]
[Wed Jan 14 21:25:18.471054 2026] [:error] [pid 61376:tid 61390] [client 146.59.70.127:34064] [client 146.59.70.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.59.70.127, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWeZPqjRUNDW2YrxZG5oWgAAAUk"]
[Wed Jan 14 21:50:28.560846 2026] [:error] [pid 21490:tid 21515] [client 43.157.153.236:34484] [client 43.157.153.236] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWefJO26AHzy1muKyudZ6AAAARY"]
[Wed Jan 14 21:51:49.950496 2026] [:error] [pid 61468:tid 61493] [client 208.109.63.229:39380] [client 208.109.63.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.109.63.229, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWefddfEBBL2jp9TJvLMfwAAAJY"]
[Wed Jan 14 21:58:00.284436 2026] [:error] [pid 7961:tid 7964] [client 132.148.181.215:53362] [client 132.148.181.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.181.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWeg6JjhjzEJ3QX9HuYROgAAAEE"]
[Wed Jan 14 22:11:26.701678 2026] [:error] [pid 21490:tid 21493] [client 81.88.49.29:27753] [client 81.88.49.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWekDu26AHzy1muKyudejAAAAQA"]
[Wed Jan 14 22:34:14.405602 2026] [:error] [pid 7961:tid 7968] [client 185.182.56.226:45106] [client 185.182.56.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.182.56.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWepZpjhjzEJ3QX9HuYWKgAAAEU"]
[Wed Jan 14 22:35:24.984298 2026] [:error] [pid 61378:tid 61458] [client 3.107.76.40:57572] [client 3.107.76.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.107.76.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWeprBGjJjuJmoPOtlpRigAAABU"]
[Wed Jan 14 23:18:52.511226 2026] [:error] [pid 61377:tid 61433] [client 154.12.118.230:53830] [client 154.12.118.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.12.118.230, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWez3Mx0Xs4tcq6R-Wie5wAAAdc"]
[Wed Jan 14 23:21:18.412540 2026] [:error] [pid 8057:tid 8083] [client 220.158.232.94:7820] [client 220.158.232.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.158.232.94, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWe0brFNJ5k8MCPHoPUzFwAAANg"]
[Thu Jan 15 00:03:23.890479 2026] [:error] [pid 61378:tid 61457] [client 103.154.176.251:58606] [client 103.154.176.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.154.176.251, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWe-SxGjJjuJmoPOtlpfBQAAABQ"]
[Thu Jan 15 00:23:37.277947 2026] [:error] [pid 25012:tid 25015] [client 109.110.188.195:53384] [client 109.110.188.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.110.188.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWfDCT-ru-9lIsqx5CnloAAAAIA"]
[Thu Jan 15 00:27:23.404037 2026] [:error] [pid 23355:tid 23367] [client 162.241.230.132:54182] [client 162.241.230.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.230.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWfD64gRLUaz7Nmrre2fIQAAAMo"]
[Thu Jan 15 00:39:24.913369 2026] [:error] [pid 25012:tid 25033] [client 86.38.203.148:35024] [client 86.38.203.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.38.203.148, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWfGvD-ru-9lIsqx5CnsiwAAAJI"]
[Thu Jan 15 01:07:53.322616 2026] [:error] [pid 23265:tid 23315] [client 43.153.104.196:52810] [client 43.153.104.196] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWfNaaMIMikX8ofnAA3eawAAABQ"]
[Thu Jan 15 01:22:55.030605 2026] [:error] [pid 23265:tid 23311] [client 3.87.131.118:57234] [client 3.87.131.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.87.131.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWfQ76MIMikX8ofnAA3iCwAAABA"]
[Thu Jan 15 01:43:32.442836 2026] [:error] [pid 25012:tid 25032] [client 167.172.219.235:36604] [client 167.172.219.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.219.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWfVxD-ru-9lIsqx5CkFBAAAAJE"]
[Thu Jan 15 01:46:08.296399 2026] [:error] [pid 23266:tid 23324] [client 64.90.50.17:33698] [client 64.90.50.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.90.50.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWfWYHBtBrkcKkbU8Y6uoQAAAEI"]
[Thu Jan 15 01:47:55.441160 2026] [:error] [pid 25012:tid 25036] [client 167.172.219.235:38312] [client 167.172.219.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.219.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWfWyz-ru-9lIsqx5CkGrAAAAJU"]
[Thu Jan 15 01:47:59.214385 2026] [:error] [pid 23355:tid 23365] [client 173.236.241.59:60888] [client 173.236.241.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.236.241.59, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWfWz4gRLUaz7Nmrre22HQAAAMg"]
[Thu Jan 15 02:11:55.243006 2026] [:error] [pid 23266:tid 23330] [client 103.130.216.36:20616] [client 103.130.216.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.130.216.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWfca3BtBrkcKkbU8Y6zggAAAEg"]
[Thu Jan 15 02:12:42.631565 2026] [:error] [pid 23355:tid 23364] [client 109.110.188.195:36524] [client 109.110.188.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.110.188.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWfcmogRLUaz7Nmrre29QAAAAMc"]
[Thu Jan 15 02:41:42.522179 2026] [:error] [pid 23355:tid 23368] [client 162.241.224.104:12116] [client 162.241.224.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.224.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWfjZogRLUaz7Nmrre3F5wAAAMs"]
[Thu Jan 15 02:48:12.885854 2026] [:error] [pid 36071:tid 36089] [client 3.7.60.163:47994] [client 3.7.60.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.7.60.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWfk7NDjSnMDZbZh45tKOgAAARA"]
[Thu Jan 15 02:55:39.275622 2026] [:error] [pid 23355:tid 23364] [client 162.241.253.213:30296] [client 162.241.253.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.253.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWfmq4gRLUaz7Nmrre3LIwAAAMc"]
[Thu Jan 15 03:03:02.570492 2026] [:error] [pid 38522:tid 38532] [client 128.201.75.82:35916] [client 128.201.75.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.201.75.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWfoZu2HBPsiOcuCCx2VDwAAAcc"]
[Thu Jan 15 03:43:26.611568 2026] [:error] [pid 39607:tid 39691] [client 20.197.2.249:41764] [client 20.197.2.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.197.2.249, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWfx3jHNFMHldnGR8SLg2wAAAJc"]
[Thu Jan 15 03:48:41.422964 2026] [:error] [pid 5291:tid 5327] [client 43.130.16.212:53236] [client 43.130.16.212] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWfzGTp5twZ54fay3RdZjwAAAEA"]
[Thu Jan 15 03:49:32.738393 2026] [:error] [pid 5292:tid 5378] [client 161.248.188.29:42782] [client 161.248.188.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.248.188.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWfzTGWxK-ai3L9DjxbFNwAAAJc"]
[Thu Jan 15 04:13:46.871194 2026] [:error] [pid 5389:tid 5401] [client 107.180.117.1:42700] [client 107.180.117.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.117.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWf4-kkzfklDSWCNrVIXPQAAAMo"]
[Thu Jan 15 05:36:49.513795 2026] [:error] [pid 5389:tid 5391] [client 81.88.49.29:39913] [client 81.88.49.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWgMcUkzfklDSWCNrVI4xQAAAMA"]
[Thu Jan 15 07:14:21.234524 2026] [:error] [pid 5292:tid 5371] [client 107.180.114.28:44080] [client 107.180.114.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.114.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWgjTWWxK-ai3L9DjxYPOgAAAJA"]
[Thu Jan 15 07:30:28.548211 2026] [:error] [pid 51807:tid 51828] [client 203.161.45.22:57370] [client 203.161.45.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.161.45.22, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWgnFMMrH4_ge4gLwN0u5QAAARM"]
[Thu Jan 15 08:36:02.854023 2026] [:error] [pid 5291:tid 5347] [client 162.241.216.119:55088] [client 162.241.216.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.216.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWg2cjp5twZ54fay3RfAcQAAAFQ"]
[Thu Jan 15 09:11:13.189272 2026] [:error] [pid 5290:tid 5303] [client 107.180.114.165:42202] [client 107.180.114.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.114.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWg-sTiQRfcmyoePXPfwdwAAAAQ"]
[Thu Jan 15 09:44:03.705878 2026] [:error] [pid 5291:tid 5334] [client 103.133.215.169:54670] [client 103.133.215.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.133.215.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWhGYzp5twZ54fay3RfYZQAAAEc"]
[Thu Jan 15 09:53:54.418749 2026] [:error] [pid 5389:tid 5399] [client 81.88.49.37:26406] [client 81.88.49.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWhIskkzfklDSWCNrVKjXgAAAMg"]
[Thu Jan 15 10:24:23.541289 2026] [:error] [pid 51857:tid 51861] [client 103.189.49.16:55866] [client 103.189.49.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.189.49.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWhP13DlXoqhkNNyf_yiLgAAAUI"]
[Thu Jan 15 10:33:47.879663 2026] [:error] [pid 5292:tid 5368] [client 132.148.180.216:25470] [client 132.148.180.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.180.216, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWhSC2WxK-ai3L9DjxZNYQAAAI0"]
[Thu Jan 15 10:42:47.135886 2026] [:error] [pid 51807:tid 51815] [client 216.73.216.110:57637] [client 216.73.216.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.73.216.110, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWhUJ8MrH4_ge4gLwN1wCgAAAQY"]
[Thu Jan 15 11:14:47.230935 2026] [:error] [pid 5290:tid 5318] [client 132.148.176.255:48596] [client 132.148.176.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.176.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWhbpziQRfcmyoePXPcX-gAAABM"]
[Thu Jan 15 11:29:30.954191 2026] [:error] [pid 5292:tid 5370] [client 182.42.105.85:58744] [client 182.42.105.85] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWhfGmWxK-ai3L9DjxZdLwAAAI8"]
[Thu Jan 15 11:43:12.661626 2026] [:error] [pid 51857:tid 51878] [client 162.19.58.172:43392] [client 162.19.58.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.19.58.172, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWhiUHDlXoqhkNNyf_zH5QAAAVM"]
[Thu Jan 15 11:50:15.620002 2026] [:error] [pid 51807:tid 51831] [client 81.88.49.37:34434] [client 81.88.49.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWhj98MrH4_ge4gLwN2BKAAAARY"]
[Thu Jan 15 12:40:39.227342 2026] [:error] [pid 5292:tid 5357] [client 103.143.10.5:56022] [client 103.143.10.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.143.10.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWhvx2WxK-ai3L9DjxZx3wAAAII"]
[Thu Jan 15 12:46:44.473415 2026] [:error] [pid 51857:tid 51860] [client 208.97.186.101:55012] [client 208.97.186.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.97.186.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWhxNHDlXoqhkNNyf_zqNAAAAUE"]
[Thu Jan 15 12:47:01.438658 2026] [:error] [pid 5290:tid 5321] [client 208.97.186.101:52814] [client 208.97.186.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.97.186.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWhxRTiQRfcmyoePXPczFgAAABY"]
[Thu Jan 15 12:47:17.499102 2026] [:error] [pid 5291:tid 5328] [client 208.97.186.101:43238] [client 208.97.186.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.97.186.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWhxVTp5twZ54fay3RcW6QAAAEE"]
[Thu Jan 15 12:50:41.165581 2026] [:error] [pid 51857:tid 51877] [client 185.208.172.174:33876] [client 185.208.172.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.208.172.174, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWhyIXDlXoqhkNNyf_zsXgAAAVI"]
[Thu Jan 15 14:27:36.236871 2026] [:error] [pid 51857:tid 51879] [client 80.150.6.150:54462] [client 80.150.6.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.150.6.150, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWiI2HDlXoqhkNNyf_wmqwAAAVQ"]
[Thu Jan 15 14:29:45.812658 2026] [:error] [pid 51857:tid 51868] [client 138.199.35.8:34882] [client 138.199.35.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.199.35.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWiJWXDlXoqhkNNyf_wn4AAAAUk"]
[Thu Jan 15 14:29:47.881659 2026] [:error] [pid 51857:tid 51883] [client 138.199.35.8:34882] [client 138.199.35.8] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aWiJW3DlXoqhkNNyf_wn5AAAAVg"]
[Thu Jan 15 14:29:48.038722 2026] [:error] [pid 51857:tid 51861] [client 138.199.35.8:34882] [client 138.199.35.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.199.35.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWiJXHDlXoqhkNNyf_wn5QAAAUI"]
[Thu Jan 15 14:29:49.220952 2026] [:error] [pid 5291:tid 5329] [client 138.199.35.8:34886] [client 138.199.35.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.199.35.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWiJXTp5twZ54fay3RdBoQAAAEI"]
[Thu Jan 15 14:29:50.414224 2026] [:error] [pid 5389:tid 5411] [client 138.199.35.8:34900] [client 138.199.35.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.199.35.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWiJXkkzfklDSWCNrVIV8AAAANQ"]
[Thu Jan 15 14:29:51.575881 2026] [:error] [pid 5290:tid 5303] [client 138.199.35.8:36972] [client 138.199.35.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.199.35.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWiJXziQRfcmyoePXPdbcAAAAAQ"]
[Thu Jan 15 14:29:52.764387 2026] [:error] [pid 5389:tid 5404] [client 138.199.35.8:37000] [client 138.199.35.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.199.35.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWiJYEkzfklDSWCNrVIV9QAAAM0"]
[Thu Jan 15 14:29:52.764559 2026] [:error] [pid 5389:tid 5404] [client 138.199.35.8:37000] [client 138.199.35.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 138.199.35.8, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWiJYEkzfklDSWCNrVIV9QAAAM0"]
[Thu Jan 15 14:52:50.828669 2026] [:error] [pid 51857:tid 51873] [client 15.235.203.43:42746] [client 15.235.203.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.203.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWiOwnDlXoqhkNNyf_wzvgAAAU4"]
[Thu Jan 15 14:53:38.280197 2026] [:error] [pid 51857:tid 51865] [client 103.3.247.5:38078] [client 103.3.247.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.3.247.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWiO8nDlXoqhkNNyf_w0GwAAAUY"]
[Thu Jan 15 15:00:44.816037 2026] [:error] [pid 51857:tid 51877] [client 89.58.19.242:59652] [client 89.58.19.242] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWiQnHDlXoqhkNNyf_w4CgAAAVI"]
[Thu Jan 15 15:00:46.728056 2026] [:error] [pid 5290:tid 5310] [client 89.58.19.242:59049] [client 89.58.19.242] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "aWiQnjiQRfcmyoePXPdmPgAAAAs"]
[Thu Jan 15 15:00:47.885291 2026] [:error] [pid 5389:tid 5412] [client 89.58.19.242:60268] [client 89.58.19.242] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/media/system/js/core.js"] [unique_id "aWiQn0kzfklDSWCNrVIiiAAAANU"]
[Thu Jan 15 15:13:33.237652 2026] [:error] [pid 51857:tid 51860] [client 103.143.10.5:55878] [client 103.143.10.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.143.10.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWiTnXDlXoqhkNNyf_w-VAAAAUE"]
[Thu Jan 15 15:28:35.921145 2026] [:error] [pid 5290:tid 5319] [client 135.236.141.36:1810] [client 135.236.141.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 135.236.141.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWiXIziQRfcmyoePXPdvggAAABQ"]
[Thu Jan 15 15:56:45.503563 2026] [:error] [pid 5290:tid 5302] [client 109.234.160.16:55190] [client 109.234.160.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.234.160.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWidvTiQRfcmyoePXPd3UwAAAAM"]
[Thu Jan 15 15:57:35.841316 2026] [:error] [pid 5389:tid 5409] [client 148.72.0.91:13832] [client 148.72.0.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.0.91, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWid70kzfklDSWCNrVI0nAAAANI"]
[Thu Jan 15 16:02:48.928361 2026] [:error] [pid 51807:tid 51828] [client 132.148.181.195:62200] [client 132.148.181.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.181.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWifKMMrH4_ge4gLwN3VhAAAARM"]
[Thu Jan 15 16:58:28.124880 2026] [:error] [pid 5292:tid 5374] [client 15.235.203.43:40752] [client 15.235.203.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.203.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWisNGWxK-ai3L9DjxbQAQAAAJM"]
[Thu Jan 15 16:58:47.714587 2026] [:error] [pid 51857:tid 51860] [client 15.235.203.43:51518] [client 15.235.203.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.203.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWisR3DlXoqhkNNyf_xnQAAAAUE"]
[Thu Jan 15 17:28:57.567520 2026] [:error] [pid 5290:tid 5318] [client 64.31.43.162:50292] [client 64.31.43.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.31.43.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWizWTiQRfcmyoePXPeSNAAAABM"]
[Thu Jan 15 18:15:05.335301 2026] [:error] [pid 5291:tid 5331] [client 173.201.180.210:59422] [client 173.201.180.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.201.180.210, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWi-KTp5twZ54fay3RejMwAAAEQ"]
[Thu Jan 15 18:56:07.196233 2026] [:error] [pid 5290:tid 5307] [client 89.252.179.31:53756] [client 89.252.179.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.252.179.31, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWjHxziQRfcmyoePXPesAwAAAAg"]
[Thu Jan 15 19:06:16.808617 2026] [:error] [pid 5292:tid 5370] [client 208.109.213.127:51730] [client 208.109.213.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.109.213.127, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWjKKGWxK-ai3L9DjxYIjwAAAI8"]
[Thu Jan 15 19:06:16.810016 2026] [:error] [pid 5292:tid 5370] [client 208.109.213.127:51730] [client 208.109.213.127] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWjKKGWxK-ai3L9DjxYIjwAAAI8"]
[Thu Jan 15 19:06:16.811143 2026] [:error] [pid 5292:tid 5370] [client 208.109.213.127:51730] [client 208.109.213.127] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWjKKGWxK-ai3L9DjxYIjwAAAI8"]
[Thu Jan 15 19:06:58.180116 2026] [:error] [pid 5292:tid 5377] [client 184.168.112.138:12016] [client 184.168.112.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.112.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWjKUmWxK-ai3L9DjxYIvAAAAJY"]
[Thu Jan 15 19:15:53.171701 2026] [:error] [pid 5292:tid 5356] [client 208.109.213.127:47510] [client 208.109.213.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 208.109.213.127, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWjMaWWxK-ai3L9DjxYNlQAAAIE"]
[Thu Jan 15 19:15:53.172989 2026] [:error] [pid 5292:tid 5356] [client 208.109.213.127:47510] [client 208.109.213.127] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWjMaWWxK-ai3L9DjxYNlQAAAIE"]
[Thu Jan 15 19:15:53.174078 2026] [:error] [pid 5292:tid 5356] [client 208.109.213.127:47510] [client 208.109.213.127] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWjMaWWxK-ai3L9DjxYNlQAAAIE"]
[Thu Jan 15 19:16:29.705051 2026] [:error] [pid 5389:tid 5395] [client 192.250.227.149:56088] [client 192.250.227.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.227.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWjMjUkzfklDSWCNrVJslgAAAMQ"]
[Thu Jan 15 19:37:01.800660 2026] [:error] [pid 51857:tid 51859] [client 81.88.49.43:54380] [client 81.88.49.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWjRXXDlXoqhkNNyf_yWawAAAUA"]
[Thu Jan 15 19:37:01.802359 2026] [:error] [pid 51857:tid 51859] [client 81.88.49.43:54380] [client 81.88.49.43] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWjRXXDlXoqhkNNyf_yWawAAAUA"]
[Thu Jan 15 19:37:01.803562 2026] [:error] [pid 51857:tid 51859] [client 81.88.49.43:54380] [client 81.88.49.43] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWjRXXDlXoqhkNNyf_yWawAAAUA"]
[Thu Jan 15 19:46:15.084278 2026] [:error] [pid 5291:tid 5346] [client 49.51.178.45:55824] [client 49.51.178.45] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWjThzp5twZ54fay3RfBXgAAAFM"]
[Thu Jan 15 21:56:24.013457 2026] [:error] [pid 5292:tid 5372] [client 34.127.83.87:64297] [client 34.127.83.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.127.83.87, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWjyCGWxK-ai3L9DjxY7bQAAAJE"]
[Thu Jan 15 21:56:26.803893 2026] [:error] [pid 5292:tid 5373] [client 34.127.83.87:64297] [client 34.127.83.87] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aWjyCmWxK-ai3L9DjxY7dAAAAJI"]
[Thu Jan 15 21:56:27.054874 2026] [:error] [pid 5292:tid 5357] [client 34.127.83.87:64297] [client 34.127.83.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.127.83.87, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWjyC2WxK-ai3L9DjxY7dQAAAII"]
[Thu Jan 15 21:56:28.415842 2026] [:error] [pid 51857:tid 51879] [client 34.127.83.87:54822] [client 34.127.83.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.127.83.87, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWjyDHDlXoqhkNNyf_y92wAAAVQ"]
[Thu Jan 15 21:56:29.768398 2026] [:error] [pid 51857:tid 51877] [client 34.127.83.87:61350] [client 34.127.83.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.127.83.87, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWjyDXDlXoqhkNNyf_y93gAAAVI"]
[Thu Jan 15 21:56:31.036990 2026] [:error] [pid 51807:tid 51830] [client 34.127.83.87:56446] [client 34.127.83.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.127.83.87, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWjyD8MrH4_ge4gLwN0ydgAAARU"]
[Thu Jan 15 21:56:32.302588 2026] [:error] [pid 5292:tid 5358] [client 34.127.83.87:52490] [client 34.127.83.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.127.83.87, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWjyEGWxK-ai3L9DjxY7fAAAAIM"]
[Thu Jan 15 21:56:32.302725 2026] [:error] [pid 5292:tid 5358] [client 34.127.83.87:52490] [client 34.127.83.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.127.83.87, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWjyEGWxK-ai3L9DjxY7fAAAAIM"]
[Thu Jan 15 21:58:50.136264 2026] [:error] [pid 21666:tid 21676] [client 170.106.11.141:40746] [client 170.106.11.141] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWjymqM9zD2y6IZZ4RRvgwAAAYU"]
[Fri Jan 16 00:10:54.396479 2026] [:error] [pid 51857:tid 51872] [client 182.40.104.255:56528] [client 182.40.104.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWkRjnDlXoqhkNNyf_zr_QAAAU0"]
[Fri Jan 16 04:01:12.775844 2026] [:error] [pid 4657:tid 4739] [client 43.135.130.202:60610] [client 43.135.130.202] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWlHiCTED8rXaYv2tKa-ewAAAJU"]
[Fri Jan 16 04:03:02.449359 2026] [:error] [pid 4657:tid 4718] [client 163.237.217.11:34152] [client 163.237.217.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWlH9iTED8rXaYv2tKa-3AAAAIA"]
[Fri Jan 16 08:02:57.541994 2026] [:error] [pid 4657:tid 4734] [client 43.166.142.76:55472] [client 43.166.142.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWmAMSTED8rXaYv2tKYC_gAAAJA"]
[Fri Jan 16 11:02:02.535152 2026] [:error] [pid 9260:tid 9270] [client 43.130.34.74:54208] [client 43.130.34.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWmqKl3AAooR8oZsCwlPuQAAAAg"]
[Fri Jan 16 12:12:08.899265 2026] [:error] [pid 9169:tid 9183] [client 49.7.227.204:53134] [client 49.7.227.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWm6mPnHNwn4jDwFUqS2FwAAAMo"]
[Fri Jan 16 13:06:51.146846 2026] [:error] [pid 9171:tid 9244] [client 164.90.228.79:55708] [client 164.90.228.79] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aWnHa4J9Drgq4A3ZjfMasQAAAVA"]
[Fri Jan 16 13:07:01.530903 2026] [authz_core:error] [pid 9171:tid 9245] [client 164.90.228.79:36282] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Fri Jan 16 13:07:06.522672 2026] [:error] [pid 9170:tid 9221] [client 164.90.228.79:40122] [client 164.90.228.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aWnHem4MLV83AzbIjkaNpQAAARQ"]
[Fri Jan 16 13:07:08.545653 2026] [:error] [pid 9169:tid 9191] [client 164.90.228.79:40128] [client 164.90.228.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aWnHfPnHNwn4jDwFUqTHzwAAANI"]
[Fri Jan 16 13:38:59.582520 2026] [:error] [pid 29908:tid 29910] [client 159.195.68.135:56571] [client 159.195.68.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWnO82Vs7GIQKAJ2aTW6wgAAAEA"]
[Fri Jan 16 13:39:00.180689 2026] [:error] [pid 6094:tid 6101] [client 159.195.68.135:52401] [client 159.195.68.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "aWnO9KXDCegasQDb2u7tTAAAAIQ"]
[Fri Jan 16 13:39:00.803690 2026] [:error] [pid 9170:tid 9218] [client 159.195.68.135:50264] [client 159.195.68.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/media/system/js/core.js"] [unique_id "aWnO9G4MLV83AzbIjkaYpAAAARE"]
[Fri Jan 16 15:28:40.105264 2026] [:error] [pid 30957:tid 30977] [client 129.150.51.252:55560] [client 129.150.51.252] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWnoqN2pbRtnni7K9w_4ywAAAFE"]
[Fri Jan 16 15:28:40.468797 2026] [:error] [pid 30865:tid 30876] [client 129.150.51.252:60631] [client 129.150.51.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.150.51.252, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWnoqBCR_HCYGnC3FS-NzwAAAUg"]
[Fri Jan 16 15:28:41.709087 2026] [:error] [pid 30957:tid 30966] [client 129.150.51.252:58653] [client 129.150.51.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.150.51.252, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWnoqd2pbRtnni7K9w_40QAAAEY"], referer: http://expressinteriors.com/wp-login.php
[Fri Jan 16 15:28:44.734207 2026] [:error] [pid 30925:tid 30937] [client 129.150.51.252:51440] [client 129.150.51.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.150.51.252, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWnorLPyx6TwF5dNaFp9nQAAAYo"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 16 16:42:18.213043 2026] [:error] [pid 30865:tid 30892] [client 3.220.70.171:26509] [client 3.220.70.171] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "aWn56hCR_HCYGnC3FS-oWAAAAVg"]
[Fri Jan 16 16:56:52.821974 2026] [:error] [pid 30925:tid 30946] [client 129.226.93.214:43024] [client 129.226.93.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWn9VLPyx6TwF5dNaFqgCQAAAZM"]
[Fri Jan 16 17:01:45.359932 2026] [:error] [pid 30957:tid 30963] [client 84.247.169.220:56608] [client 84.247.169.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWn-ed2pbRtnni7K9w8qVAAAAEM"]
[Fri Jan 16 17:01:46.653750 2026] [:error] [pid 30957:tid 30972] [client 84.247.169.220:56733] [client 84.247.169.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-json/wc/v3/payment_gateways"] [unique_id "aWn-et2pbRtnni7K9w8qVwAAAEw"]
[Fri Jan 16 17:01:48.046135 2026] [:error] [pid 30957:tid 30982] [client 84.247.169.220:56875] [client 84.247.169.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-json/wc/v2/payment_gateways"] [unique_id "aWn-fN2pbRtnni7K9w8qXgAAAFY"]
[Fri Jan 16 17:01:49.399031 2026] [:error] [pid 30866:tid 30899] [client 84.247.169.220:57045] [client 84.247.169.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-json/wc/store/v1/cart"] [unique_id "aWn-fSfb83E1Tbd0nr9rUgAAAAQ"]
[Fri Jan 16 17:01:50.814887 2026] [:error] [pid 30925:tid 30928] [client 84.247.169.220:57180] [client 84.247.169.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-json/wc/store/v1/payment_methods"] [unique_id "aWn-frPyx6TwF5dNaFqiVwAAAYE"]
[Fri Jan 16 20:09:31.814462 2026] [:error] [pid 30957:tid 30978] [client 170.106.110.146:36628] [client 170.106.110.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWoqe92pbRtnni7K9w9lwQAAAFI"]
[Fri Jan 16 22:54:53.245824 2026] [:error] [pid 30865:tid 30888] [client 169.40.135.85:64986] [client 169.40.135.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.40.135.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWpRPRCR_HCYGnC3FS9PbwAAAVQ"]
[Fri Jan 16 22:54:54.039226 2026] [:error] [pid 30865:tid 30873] [client 169.40.135.85:64986] [client 169.40.135.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 169.40.135.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWpRPhCR_HCYGnC3FS9PcwAAAUU"]
[Fri Jan 16 22:54:57.193423 2026] [:error] [pid 30865:tid 30874] [client 169.40.135.85:64986] [client 169.40.135.85] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aWpRQRCR_HCYGnC3FS9PfAAAAUY"]
[Fri Jan 16 22:54:57.485238 2026] [:error] [pid 30865:tid 30892] [client 169.40.135.85:64986] [client 169.40.135.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.40.135.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWpRQRCR_HCYGnC3FS9PfgAAAVg"]
[Fri Jan 16 22:54:57.486734 2026] [:error] [pid 30865:tid 30892] [client 169.40.135.85:64986] [client 169.40.135.85] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWpRQRCR_HCYGnC3FS9PfgAAAVg"]
[Fri Jan 16 22:54:57.488039 2026] [:error] [pid 30865:tid 30892] [client 169.40.135.85:64986] [client 169.40.135.85] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWpRQRCR_HCYGnC3FS9PfgAAAVg"]
[Fri Jan 16 22:54:59.262021 2026] [:error] [pid 30957:tid 30982] [client 169.40.135.85:49653] [client 169.40.135.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.40.135.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWpRQ92pbRtnni7K9w-T5AAAAFY"]
[Fri Jan 16 22:54:59.263676 2026] [:error] [pid 30957:tid 30982] [client 169.40.135.85:49653] [client 169.40.135.85] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWpRQ92pbRtnni7K9w-T5AAAAFY"]
[Fri Jan 16 22:54:59.265015 2026] [:error] [pid 30957:tid 30982] [client 169.40.135.85:49653] [client 169.40.135.85] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWpRQ92pbRtnni7K9w-T5AAAAFY"]
[Fri Jan 16 22:55:00.975593 2026] [:error] [pid 30865:tid 30883] [client 169.40.135.85:49861] [client 169.40.135.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.40.135.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWpRRBCR_HCYGnC3FS9PgwAAAU8"]
[Fri Jan 16 22:55:02.740487 2026] [:error] [pid 30925:tid 30938] [client 169.40.135.85:50098] [client 169.40.135.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.40.135.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWpRRrPyx6TwF5dNaFoEmgAAAYs"]
[Fri Jan 16 22:55:04.455842 2026] [:error] [pid 30866:tid 30909] [client 169.40.135.85:50307] [client 169.40.135.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.40.135.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWpRSCfb83E1Tbd0nr_PcAAAAA4"]
[Fri Jan 16 22:55:04.455960 2026] [:error] [pid 30866:tid 30909] [client 169.40.135.85:50307] [client 169.40.135.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 169.40.135.85, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWpRSCfb83E1Tbd0nr_PcAAAAA4"]
[Fri Jan 16 22:55:06.636506 2026] [:error] [pid 30957:tid 30960] [client 169.40.135.85:50448] [client 169.40.135.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 169.40.135.85, counter = 6"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWpRSt2pbRtnni7K9w-T8QAAAEA"], referer: https://expressinteriors.com//wp-login.php
[Fri Jan 16 22:55:07.802899 2026] [:error] [pid 54008:tid 54013] [client 169.40.135.85:50697] [client 169.40.135.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 169.40.135.85, counter = 6"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWpRS8eowS6CyLOmCzMeEQAAAIM"], referer: https://expressinteriors.com//wp-login.php
[Sat Jan 17 00:44:48.322908 2026] [:error] [pid 30925:tid 30929] [client 182.44.10.67:35547] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWprALPyx6TwF5dNaFoa6wAAAYI"]
[Sat Jan 17 03:11:37.477518 2026] [:error] [pid 28861:tid 28881] [client 49.51.203.164:40410] [client 49.51.203.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWqNaZXi4LPhoEtEWaL9WQAAANI"]
[Sat Jan 17 06:44:50.558191 2026] [:error] [pid 31225:tid 31309] [client 203.2.64.59:40050] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWq_Yunu2L2yWFDbzyX6ZwAAAJU"]
[Sat Jan 17 07:48:51.673093 2026] [:error] [pid 31223:tid 31251] [client 43.153.107.22:56614] [client 43.153.107.22] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWrOY0Mnpeq0T1sEOlJrawAAABI"]
[Sat Jan 17 13:35:38.919803 2026] [:error] [pid 31698:tid 31714] [client 43.166.132.142:38096] [client 43.166.132.142] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWsfqrjKZJSxKAfZqrJ-xwAAAQw"]
[Sat Jan 17 13:38:24.858934 2026] [:error] [pid 31322:tid 31354] [client 163.237.217.11:54898] [client 163.237.217.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWsgUHxOW98yk2MBlyqJOAAAANQ"]
[Sat Jan 17 16:19:56.111023 2026] [:error] [pid 31224:tid 31267] [client 43.159.143.187:56982] [client 43.159.143.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWtGLDgpVpEMk8-OQkjpqQAAAEY"]
[Sat Jan 17 20:02:51.441677 2026] [:error] [pid 31322:tid 31355] [client 84.233.212.21:55757] [client 84.233.212.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aWt6a3xOW98yk2MBlyrbYgAAANU"]
[Sat Jan 17 20:02:52.159848 2026] [:error] [pid 31223:tid 31251] [client 84.233.212.21:57184] [client 84.233.212.21] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/db.sql"] [unique_id "aWt6bEMnpeq0T1sEOlLq0gAAABI"]
[Sat Jan 17 20:02:52.878133 2026] [:error] [pid 31224:tid 31272] [client 84.233.212.21:58196] [client 84.233.212.21] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/dump.sql"] [unique_id "aWt6bDgpVpEMk8-OQkgdIgAAAEs"]
[Sat Jan 17 20:02:53.594034 2026] [:error] [pid 31698:tid 31713] [client 84.233.212.21:59236] [client 84.233.212.21] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/database.sql"] [unique_id "aWt6bbjKZJSxKAfZqrLSJQAAAQs"]
[Sat Jan 17 20:02:54.314118 2026] [:error] [pid 31224:tid 31276] [client 84.233.212.21:60219] [client 84.233.212.21] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/backup.sql"] [unique_id "aWt6bjgpVpEMk8-OQkgdIwAAAE8"]
[Sat Jan 17 20:02:55.031530 2026] [:error] [pid 31698:tid 31705] [client 84.233.212.21:61031] [client 84.233.212.21] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/config/db.sql"] [unique_id "aWt6b7jKZJSxKAfZqrLSKQAAAQM"]
[Sat Jan 17 20:02:55.754890 2026] [:error] [pid 31223:tid 31250] [client 84.233.212.21:61828] [client 84.233.212.21] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/sql/db.sql"] [unique_id "aWt6b0Mnpeq0T1sEOlLq1AAAABE"]
[Sat Jan 17 20:02:56.472487 2026] [:error] [pid 31322:tid 31338] [client 84.233.212.21:62513] [client 84.233.212.21] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/data/dump.sql"] [unique_id "aWt6cHxOW98yk2MBlyrbZgAAAMQ"]
[Sat Jan 17 20:02:57.196416 2026] [:error] [pid 31225:tid 31311] [client 84.233.212.21:63378] [client 84.233.212.21] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/backups/database.sql"] [unique_id "aWt6cenu2L2yWFDbzyX6NQAAAJc"]
[Sat Jan 17 20:02:57.914115 2026] [:error] [pid 31225:tid 31295] [client 84.233.212.21:64517] [client 84.233.212.21] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/mysql.sql"] [unique_id "aWt6cenu2L2yWFDbzyX6NwAAAIc"]
[Sat Jan 17 20:02:58.631144 2026] [:error] [pid 31225:tid 31292] [client 84.233.212.21:65439] [client 84.233.212.21] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/db_backup.sql"] [unique_id "aWt6cunu2L2yWFDbzyX6OAAAAIQ"]
[Sat Jan 17 20:41:48.490399 2026] [:error] [pid 31225:tid 31301] [client 104.28.161.73:43174] [client 104.28.161.73] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aWuDjOnu2L2yWFDbzyUH7AAAAI0"]
[Sat Jan 17 21:44:27.634231 2026] [:error] [pid 31224:tid 31281] [client 163.237.217.11:51658] [client 163.237.217.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWuSOzgpVpEMk8-OQkg3gQAAAFQ"]
[Sat Jan 17 22:27:57.917469 2026] [:error] [pid 31224:tid 31277] [client 43.155.26.193:49546] [client 43.155.26.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWucbTgpVpEMk8-OQkhFAwAAAFA"]
[Sun Jan 18 01:47:51.488119 2026] [:error] [pid 31223:tid 31243] [client 161.118.219.168:53456] [client 161.118.219.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.219.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWvLR0Mnpeq0T1sEOlIhwgAAAAo"]
[Sun Jan 18 01:47:57.188425 2026] [:error] [pid 31223:tid 31247] [client 161.118.219.168:53456] [client 161.118.219.168] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aWvLTUMnpeq0T1sEOlIh0AAAAA4"], referer: https://www.facebook.com/
[Sun Jan 18 01:47:58.184177 2026] [:error] [pid 31223:tid 31254] [client 161.118.219.168:53456] [client 161.118.219.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.219.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWvLTkMnpeq0T1sEOlIh1AAAABU"], referer: https://expressinteriors.com/wp-login.php
[Sun Jan 18 01:47:59.675111 2026] [:error] [pid 31223:tid 31257] [client 161.118.219.168:53456] [client 161.118.219.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.219.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWvLT0Mnpeq0T1sEOlIh2AAAABg"], referer: https://expressinteriors.com/wp-login.php
[Sun Jan 18 01:48:00.355735 2026] [:error] [pid 31223:tid 31255] [client 161.118.219.168:53456] [client 161.118.219.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.219.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWvLUEMnpeq0T1sEOlIh2QAAABY"], referer: https://expressinteriors.com/wp-login.php
[Sun Jan 18 01:48:01.735612 2026] [:error] [pid 31223:tid 31245] [client 161.118.219.168:53456] [client 161.118.219.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.219.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWvLUUMnpeq0T1sEOlIh3AAAAAw"], referer: https://expressinteriors.com/wp-login.php
[Sun Jan 18 01:48:02.413460 2026] [:error] [pid 31223:tid 31249] [client 161.118.219.168:53456] [client 161.118.219.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.219.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWvLUkMnpeq0T1sEOlIh3gAAABA"], referer: https://expressinteriors.com/wp-login.php
[Sun Jan 18 01:48:03.801508 2026] [:error] [pid 31223:tid 31256] [client 161.118.219.168:53456] [client 161.118.219.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.219.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWvLU0Mnpeq0T1sEOlIh5AAAABc"], referer: https://expressinteriors.com/wp-login.php
[Sun Jan 18 01:48:05.504737 2026] [:error] [pid 31223:tid 31256] [client 161.118.219.168:53456] [client 161.118.219.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.219.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWvLVUMnpeq0T1sEOlIh5wAAABc"], referer: https://expressinteriors.com/wp-login.php
[Sun Jan 18 05:16:40.374222 2026] [:error] [pid 12924:tid 12968] [client 163.237.217.11:48124] [client 163.237.217.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWv8OCuv3PUo9LR6V6Ya9gAAAEg"]
[Sun Jan 18 05:42:43.599035 2026] [:error] [pid 12923:tid 12952] [client 43.152.72.247:43042] [client 43.152.72.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWwCU-sWURrrC-4Rx5KJwwAAABQ"]
[Sun Jan 18 07:43:35.704464 2026] [:error] [pid 12924:tid 12972] [client 182.42.110.255:48547] [client 182.42.110.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWwepyuv3PUo9LR6V6ZDAAAAAEw"]
[Sun Jan 18 09:13:32.799876 2026] [:error] [pid 13034:tid 13041] [client 163.237.217.11:45796] [client 163.237.217.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWwzvMRGpUu1E8cmbmhpfwAAAMM"]
[Sun Jan 18 10:33:30.129389 2026] [:error] [pid 13034:tid 13036] [client 163.237.217.11:56494] [client 163.237.217.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWxGesRGpUu1E8cmbmiUHwAAAMA"]
[Sun Jan 18 10:46:39.833176 2026] [:error] [pid 13034:tid 13048] [client 43.157.22.57:48780] [client 43.157.22.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWxJj8RGpUu1E8cmbmibBQAAAMo"]
[Sun Jan 18 17:28:24.474308 2026] [:error] [pid 12923:tid 12953] [client 43.157.158.178:57490] [client 43.157.158.178] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aWynuOsWURrrC-4Rx5JdxgAAABU"]
[Sun Jan 18 18:49:45.563358 2026] [:error] [pid 12924:tid 12965] [client 173.236.193.46:50580] [client 173.236.193.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.236.193.46, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWy6ySuv3PUo9LR6V6YkGwAAAEU"]
[Sun Jan 18 18:55:37.262269 2026] [:error] [pid 37885:tid 37898] [client 162.241.226.211:26826] [client 162.241.226.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.226.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWy8KYIjOL7XA82H72V1_wAAAUo"]
[Sun Jan 18 18:55:38.771473 2026] [:error] [pid 37885:tid 37888] [client 162.241.226.211:26826] [client 162.241.226.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.226.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWy8KoIjOL7XA82H72V2AAAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Sun Jan 18 18:59:01.892658 2026] [:error] [pid 37885:tid 37898] [client 15.235.203.43:60626] [client 15.235.203.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.203.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWy89YIjOL7XA82H72V2wQAAAUo"]
[Sun Jan 18 19:10:57.938483 2026] [:error] [pid 13034:tid 13049] [client 57.151.82.21:51338] [client 57.151.82.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 57.151.82.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWy_wcRGpUu1E8cmbmiOlwAAAMs"]
[Sun Jan 18 19:27:13.083502 2026] [:error] [pid 37885:tid 37889] [client 79.133.57.235:44658] [client 79.133.57.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 79.133.57.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWzDkYIjOL7XA82H72WBmQAAAUE"]
[Sun Jan 18 19:27:14.448743 2026] [:error] [pid 37885:tid 37902] [client 79.133.57.235:44658] [client 79.133.57.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 79.133.57.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWzDkoIjOL7XA82H72WBnQAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Sun Jan 18 19:34:03.520671 2026] [:error] [pid 37885:tid 37900] [client 163.237.217.11:56014] [client 163.237.217.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aWzFK4IjOL7XA82H72WEEwAAAUw"]
[Sun Jan 18 19:47:42.719438 2026] [:error] [pid 33494:tid 33512] [client 81.88.49.50:52501] [client 81.88.49.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.49.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWzIXrxmLR_50TtKxDIdYQAAAQ4"]
[Sun Jan 18 19:55:43.541003 2026] [:error] [pid 12924:tid 12964] [client 103.26.10.123:50006] [client 103.26.10.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.26.10.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWzKPyuv3PUo9LR6V6Y0-wAAAEQ"]
[Sun Jan 18 19:55:44.771389 2026] [:error] [pid 12924:tid 12960] [client 103.26.10.123:50006] [client 103.26.10.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.26.10.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWzKQCuv3PUo9LR6V6Y0_AAAAEA"], referer: https://expressinteriors.com/wp-login.php
[Sun Jan 18 20:05:17.155917 2026] [:error] [pid 12923:tid 12935] [client 103.145.51.107:45456] [client 103.145.51.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.145.51.107, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWzMfesWURrrC-4Rx5KJJAAAAAM"]
[Sun Jan 18 20:05:18.263137 2026] [:error] [pid 12923:tid 12942] [client 103.145.51.107:45456] [client 103.145.51.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.145.51.107, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWzMfusWURrrC-4Rx5KJJQAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Sun Jan 18 20:13:18.174195 2026] [:error] [pid 12923:tid 12937] [client 65.181.111.127:33196] [client 65.181.111.127] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.181.111.127, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWzOXusWURrrC-4Rx5KKZQAAAAU"]
[Sun Jan 18 20:13:19.102202 2026] [:error] [pid 12923:tid 12941] [client 65.181.111.127:33196] [client 65.181.111.127] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.181.111.127, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWzOX-sWURrrC-4Rx5KKZwAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sun Jan 18 20:50:36.729788 2026] [:error] [pid 12924:tid 12977] [client 162.241.216.125:48542] [client 162.241.216.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.216.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWzXHCuv3PUo9LR6V6ZANwAAAFE"]
[Sun Jan 18 21:07:54.134240 2026] [:error] [pid 11620:tid 11632] [client 142.93.211.76:50342] [client 142.93.211.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.93.211.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWzbKmCcXLNx7aML8kEw1QAAAco"]
[Sun Jan 18 21:32:44.238099 2026] [:error] [pid 11710:tid 11773] [client 159.65.87.245:45544] [client 159.65.87.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.87.245, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWzg_GCouWwzZ0YcmFZf5AAAAwU"]
[Sun Jan 18 21:48:28.064471 2026] [:error] [pid 11711:tid 11810] [client 163.44.185.54:47158] [client 163.44.185.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 163.44.185.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWzkrOtTMvs-MBCRKgc49wAAA08"]
[Sun Jan 18 21:48:38.686852 2026] [:error] [pid 33494:tid 33500] [client 163.44.185.54:55754] [client 163.44.185.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 163.44.185.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWzktrxmLR_50TtKxDI24AAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Sun Jan 18 22:24:39.885753 2026] [:error] [pid 12923:tid 12937] [client 51.75.171.201:44602] [client 51.75.171.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.75.171.201, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWztJ-sWURrrC-4Rx5KiCgAAAAU"]
[Sun Jan 18 23:17:41.843256 2026] [:error] [pid 11711:tid 11809] [client 14.225.216.240:42900] [client 14.225.216.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 14.225.216.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aWz5letTMvs-MBCRKgdQ2QAAA04"]
[Sun Jan 18 23:42:09.001916 2026] [:error] [pid 11710:tid 11786] [client 193.92.237.129:53054] [client 193.92.237.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.92.237.129, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWz_UWCouWwzZ0YcmFZ7CgAAAxI"], referer: https://expressinteriors.com/wp-login.php
[Sun Jan 18 23:42:10.010518 2026] [:error] [pid 11710:tid 11783] [client 193.92.237.129:53054] [client 193.92.237.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.92.237.129, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aWz_UmCouWwzZ0YcmFZ7DgAAAw8"], referer: https://ld-genealogie.fr/wp-login.php
[Sun Jan 18 23:45:34.600713 2026] [:error] [pid 12925:tid 13000] [client 34.179.177.28:57142] [client 34.179.177.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.179.177.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW0AHvsBL-4pnmSbzih7BgAAAIw"]
[Mon Jan 19 00:21:37.155721 2026] [:error] [pid 11711:tid 11819] [client 202.92.6.80:47472] [client 202.92.6.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.92.6.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW0IketTMvs-MBCRKgdjuQAAA1g"]
[Mon Jan 19 00:37:51.338710 2026] [:error] [pid 7225:tid 7239] [client 109.234.165.115:54880] [client 109.234.165.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.234.165.115, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aW0MXxerEBx_0YV4eGNWbAAAAYw"]
[Mon Jan 19 00:37:52.774601 2026] [:error] [pid 7225:tid 7242] [client 109.234.165.115:54880] [client 109.234.165.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.234.165.115, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aW0MYBerEBx_0YV4eGNWbQAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Mon Jan 19 00:58:00.234095 2026] [:error] [pid 13034:tid 13055] [client 80.240.128.18:38342] [client 80.240.128.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.240.128.18, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW0RGMRGpUu1E8cmbmjRygAAANE"]
[Mon Jan 19 01:12:15.885411 2026] [:error] [pid 12923:tid 12949] [client 69.163.140.7:50352] [client 69.163.140.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.140.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW0Ub-sWURrrC-4Rx5K4sAAAABE"]
[Mon Jan 19 01:12:27.450454 2026] [:error] [pid 11620:tid 11625] [client 69.163.140.7:41500] [client 69.163.140.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.163.140.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW0Ue2CcXLNx7aML8kFiYQAAAcM"]
[Mon Jan 19 01:24:06.836909 2026] [:error] [pid 11620:tid 11628] [client 148.72.74.250:46818] [client 148.72.74.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.72.74.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aW0XNmCcXLNx7aML8kFmVAAAAcY"]
[Mon Jan 19 01:24:09.137483 2026] [:error] [pid 11620:tid 11624] [client 148.72.74.250:46818] [client 148.72.74.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.72.74.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aW0XOWCcXLNx7aML8kFmVgAAAcI"], referer: https://expressinteriors.com/wp-login.php
[Mon Jan 19 01:40:46.185617 2026] [:error] [pid 37885:tid 37911] [client 43.130.154.56:48012] [client 43.130.154.56] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aW0bHoIjOL7XA82H72XFOgAAAVc"]
[Mon Jan 19 02:00:12.120808 2026] [:error] [pid 11710:tid 11773] [client 185.205.19.218:56436] [client 185.205.19.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.205.19.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aW0frGCouWwzZ0YcmFaV_AAAAwU"]
[Mon Jan 19 02:00:14.835796 2026] [:error] [pid 11710:tid 11770] [client 185.205.19.218:56436] [client 185.205.19.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.205.19.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aW0frmCouWwzZ0YcmFaV_QAAAwI"], referer: https://expressinteriors.com/wp-login.php
[Mon Jan 19 02:24:00.710427 2026] [:error] [pid 25906:tid 25931] [client 163.237.217.11:48130] [client 163.237.217.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aW0lQDpQ51c5_inxJIC1hgAAAkk"]
[Mon Jan 19 02:53:36.843547 2026] [:error] [pid 13034:tid 13046] [client 125.212.243.118:41384] [client 125.212.243.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 125.212.243.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW0sMMRGpUu1E8cmbmjm5gAAAMg"]
[Mon Jan 19 03:55:15.383087 2026] [:error] [pid 55203:tid 55218] [client 69.197.191.106:35674] [client 69.197.191.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.197.191.106, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aW06oy-AaXI6_wL-5XwWGQAAAM0"]
[Mon Jan 19 03:55:16.302522 2026] [:error] [pid 55203:tid 55216] [client 69.197.191.106:35674] [client 69.197.191.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.197.191.106, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aW06pC-AaXI6_wL-5XwWHQAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon Jan 19 05:12:16.385460 2026] [:error] [pid 55203:tid 55210] [client 43.130.16.140:52256] [client 43.130.16.140] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aW1MsC-AaXI6_wL-5XwuCgAAAMU"]
[Mon Jan 19 07:20:20.274886 2026] [:error] [pid 55093:tid 55147] [client 69.197.191.106:54388] [client 69.197.191.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.197.191.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW1qtFvejPZGx2OquyUVhAAAAFI"]
[Mon Jan 19 08:50:06.915222 2026] [:error] [pid 55093:tid 55139] [client 41.185.8.76:51260] [client 41.185.8.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.185.8.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW1_vlvejPZGx2OquyUuagAAAEo"]
[Mon Jan 19 09:09:29.976816 2026] [:error] [pid 55092:tid 55121] [client 85.203.47.141:48511] [client 85.203.47.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.203.47.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW2ESc2DE_yLQhxnvwzwMAAAABQ"]
[Mon Jan 19 09:09:32.756529 2026] [:error] [pid 43300:tid 43314] [client 85.203.47.139:50145] [client 85.203.47.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.203.47.139, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW2ETG7A1q4pIUqzBvE9GwAAAUY"]
[Mon Jan 19 09:09:35.501795 2026] [:error] [pid 55092:tid 55115] [client 85.203.47.113:29557] [client 85.203.47.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.203.47.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW2ET82DE_yLQhxnvwzwPwAAAA4"]
[Mon Jan 19 09:09:38.970899 2026] [:error] [pid 43300:tid 43318] [client 85.203.47.128:56573] [client 85.203.47.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.203.47.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW2EUm7A1q4pIUqzBvE9NQAAAUo"]
[Mon Jan 19 09:09:42.673390 2026] [:error] [pid 43300:tid 43322] [client 85.203.47.114:45927] [client 85.203.47.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.203.47.114, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW2EVm7A1q4pIUqzBvE9QgAAAU4"]
[Mon Jan 19 09:09:48.116928 2026] [:error] [pid 43300:tid 43319] [client 85.203.47.154:43423] [client 85.203.47.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.203.47.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW2EXG7A1q4pIUqzBvE9UgAAAUs"]
[Mon Jan 19 09:09:54.970533 2026] [:error] [pid 55092:tid 55103] [client 85.203.47.155:40871] [client 85.203.47.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.203.47.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW2EYs2DE_yLQhxnvwzwjQAAAAI"]
[Mon Jan 19 09:09:59.504199 2026] [:error] [pid 55094:tid 55166] [client 85.203.47.144:55001] [client 85.203.47.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.203.47.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW2EZzQDy8tSKykl7U7S-gAAAIo"]
[Mon Jan 19 09:10:05.103701 2026] [:error] [pid 27680:tid 27694] [client 85.203.47.125:50551] [client 85.203.47.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.203.47.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW2EbT8azMyLC3TiDG0kwAAAAQM"]
[Mon Jan 19 09:10:11.131585 2026] [:error] [pid 47477:tid 47524] [client 85.203.47.154:46555] [client 85.203.47.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.203.47.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW2Ecwyk7fMQliOCELdtrQAAAhE"]
[Mon Jan 19 09:10:14.252961 2026] [:error] [pid 55093:tid 55131] [client 85.203.47.136:39177] [client 85.203.47.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.203.47.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW2EdlvejPZGx2OquyU0MQAAAEI"]
[Mon Jan 19 09:10:19.239089 2026] [:error] [pid 47439:tid 47461] [client 85.203.47.154:37365] [client 85.203.47.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.203.47.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW2Eezr6gGCDmQscGCqZMAAAAZQ"]
[Mon Jan 19 09:50:06.813888 2026] [:error] [pid 1542:tid 1608] [client 173.214.167.46:53287] [client 173.214.167.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "aW2Nzi9AKT0aRaKZVXSeeQAAAIc"]
[Mon Jan 19 11:05:09.649648 2026] [:error] [pid 26516:tid 26588] [client 43.130.72.40:35714] [client 43.130.72.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aW2fZScxkMpglAenpvVQzQAAAI8"]
[Mon Jan 19 12:01:35.583386 2026] [:error] [pid 47089:tid 47092] [client 163.237.217.11:39240] [client 163.237.217.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aW2snxlIzijVNfdIsZ4ZYgAAAQE"]
[Mon Jan 19 12:47:44.051114 2026] [:error] [pid 47089:tid 47100] [client 103.77.106.118:63838] [client 103.77.106.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aW23cBlIzijVNfdIsZ41bAAAAQk"]
[Mon Jan 19 12:47:44.506078 2026] [:error] [pid 45561:tid 45581] [client 103.77.106.118:52244] [client 103.77.106.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aW23cK4ONSZn4nkTayLh6QAAAA8"]
[Mon Jan 19 16:46:17.125858 2026] [:error] [pid 47089:tid 47091] [client 43.132.214.228:54100] [client 43.132.214.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aW3vWRlIzijVNfdIsZ6xdwAAAQA"]
[Mon Jan 19 18:50:33.383717 2026] [:error] [pid 47089:tid 47105] [client 163.237.217.11:55480] [client 163.237.217.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aW4MeRlIzijVNfdIsZ7iXgAAAQ4"]
[Mon Jan 19 18:53:55.031585 2026] [:error] [pid 45561:tid 45587] [client 170.106.187.106:44252] [client 170.106.187.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aW4NQ64ONSZn4nkTayJPHgAAABU"]
[Mon Jan 19 20:40:37.770949 2026] [:error] [pid 45657:tid 45660] [client 49.234.192.248:45136] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aW4mRQ4XFYp2OcwCx-CLzQAAAME"]
[Mon Jan 19 22:03:16.179841 2026] [:error] [pid 45657:tid 45672] [client 43.166.244.192:49920] [client 43.166.244.192] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aW45pA4XFYp2OcwCx-Cd4AAAAM0"]
[Mon Jan 19 22:22:40.424720 2026] [:error] [pid 36216:tid 36227] [client 104.28.246.115:42285] [client 104.28.246.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aW4-MMIpfKKs9fzB-yC9OAAAAUk"]
[Mon Jan 19 22:22:43.266092 2026] [:error] [pid 45563:tid 45622] [client 104.28.246.115:38249] [client 104.28.246.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/style.php"] [unique_id "aW4-M5I4--OKA-PqumzE-AAAAIE"]
[Mon Jan 19 22:22:44.694914 2026] [:error] [pid 45657:tid 45683] [client 104.28.246.115:38252] [client 104.28.246.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/style.php"] [unique_id "aW4-NA4XFYp2OcwCx-Ci_wAAANg"]
[Tue Jan 20 00:15:32.526143 2026] [:error] [pid 45562:tid 45605] [client 43.163.104.54:43378] [client 43.163.104.54] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aW5YpDoUil_kwpvtDW4IxgAAAEs"]
[Tue Jan 20 00:23:06.906599 2026] [:error] [pid 45563:tid 45645] [client 163.237.217.11:51794] [client 163.237.217.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aW5aapI4--OKA-PqumzmtwAAAJg"]
[Tue Jan 20 01:54:52.719238 2026] [:error] [pid 45657:tid 45670] [client 103.78.97.230:54344] [client 103.78.97.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.78.97.230, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aW5v7A4XFYp2OcwCx-DPHQAAAMs"]
[Tue Jan 20 01:54:55.032515 2026] [:error] [pid 45657:tid 45661] [client 103.78.97.230:54344] [client 103.78.97.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.78.97.230, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aW5v7w4XFYp2OcwCx-DPIgAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Tue Jan 20 02:29:55.085891 2026] [:error] [pid 45561:tid 45579] [client 45.138.16.192:57064] [client 45.138.16.192] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.138.16.192, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aW54I64ONSZn4nkTayLD8wAAAA0"]
[Tue Jan 20 02:29:56.833837 2026] [:error] [pid 36216:tid 36238] [client 45.138.16.192:61618] [client 45.138.16.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.138.16.192, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW54JMIpfKKs9fzB-yD_ogAAAVQ"]
[Tue Jan 20 03:11:31.035687 2026] [:error] [pid 45562:tid 45610] [client 163.237.217.11:38382] [client 163.237.217.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aW6B4zoUil_kwpvtDW4jCwAAAFA"]
[Tue Jan 20 05:54:47.696106 2026] [:error] [pid 17728:tid 17752] [client 163.237.217.11:49346] [client 163.237.217.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aW6oJ3HKpzeaRGBjHRxzJQAAANQ"]
[Tue Jan 20 06:14:01.784778 2026] [:error] [pid 17621:tid 17671] [client 43.153.107.22:33522] [client 43.153.107.22] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aW6sqaQxAikbLpJvDI7i1gAAAE0"]
[Tue Jan 20 08:08:54.142431 2026] [:error] [pid 52587:tid 52597] [client 109.70.100.5:43746] [client 109.70.100.5] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aW7Hlm2PXtFnDS0uhjnavQAAAYg"]
[Tue Jan 20 10:39:47.230414 2026] [:error] [pid 10814:tid 10850] [client 161.118.193.239:51228] [client 161.118.193.239] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aW7q8xqBRFvr1Ykq07oEygAAAEY"]
[Tue Jan 20 10:39:50.604662 2026] [:error] [pid 16632:tid 16642] [client 161.118.193.239:54366] [client 161.118.193.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.193.239, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aW7q9lFdPGaNGNrN00uSQwAAAMg"]
[Tue Jan 20 10:39:54.792265 2026] [:error] [pid 10905:tid 10908] [client 161.118.193.239:64783] [client 161.118.193.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.193.239, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aW7q-rxYUgCFtYYVh0V_AwAAAgE"], referer: https://expressinteriors.com/wp-admin/
[Tue Jan 20 10:40:00.061749 2026] [:error] [pid 14749:tid 14764] [client 161.118.193.239:59134] [client 161.118.193.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.193.239, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aW7rANJPSR4gCzvscNRN3QAAAI0"], referer: https://expressinteriors.com/wp-admin/
[Tue Jan 20 10:40:02.294655 2026] [:error] [pid 16669:tid 16691] [client 161.118.193.239:63165] [client 161.118.193.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.193.239, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aW7rAoC1EqGz7QVqAEtl3QAAAVQ"], referer: http://expressinteriors.com/login
[Tue Jan 20 10:40:10.400784 2026] [:error] [pid 10813:tid 10819] [client 161.118.193.239:63581] [client 161.118.193.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.193.239, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aW7rCv8mjqc4Rc0ds2IgwwAAAAI"], referer: http://expressinteriors.com/login
[Tue Jan 20 12:08:44.839046 2026] [:error] [pid 54259:tid 54300] [client 170.106.180.153:48406] [client 170.106.180.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aW7_zA2q1USrePnOoFSmSgAAAJc"]
[Tue Jan 20 13:04:20.645050 2026] [:error] [pid 56360:tid 56366] [client 173.236.250.59:48402] [client 173.236.250.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.236.250.59, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW8M1E1J8CD1rR-wXXv1vQAAAQQ"]
[Tue Jan 20 13:04:35.234796 2026] [:error] [pid 63647:tid 63670] [client 173.236.250.59:32802] [client 173.236.250.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.236.250.59, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aW8M41UaYw1xHOoaFFK8WwAAAhU"]
[Tue Jan 20 13:30:08.827372 2026] [:error] [pid 56326:tid 56328] [client 103.77.107.178:56030] [client 103.77.107.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aW8S4BA6mi8Uwf45Uy_T7gAAAMA"]
[Tue Jan 20 13:30:09.208605 2026] [:error] [pid 54260:tid 54331] [client 103.77.107.178:59088] [client 103.77.107.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aW8S4dg7jS3jmpUN0WDnOwAAAVY"]
[Tue Jan 20 15:21:44.785651 2026] [:error] [pid 54260:tid 54328] [client 157.15.40.62:63366] [client 157.15.40.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "aW8tCNg7jS3jmpUN0WDzXAAAAVQ"]
[Tue Jan 20 15:21:45.369421 2026] [:error] [pid 63647:tid 63655] [client 157.15.40.62:63406] [client 157.15.40.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/txets.php"] [unique_id "aW8tCVUaYw1xHOoaFFLVrgAAAgY"]
[Tue Jan 20 15:21:45.964020 2026] [:error] [pid 56360:tid 56363] [client 157.15.40.62:63446] [client 157.15.40.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/txets.php"] [unique_id "aW8tCU1J8CD1rR-wXXsbFgAAAQE"]
[Tue Jan 20 15:21:46.570450 2026] [:error] [pid 8416:tid 8432] [client 157.15.40.62:63481] [client 157.15.40.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "aW8tCjN6cbQyA2ecQV2pMAAAAw4"]
[Tue Jan 20 15:21:47.184613 2026] [:error] [pid 8416:tid 8419] [client 157.15.40.62:63518] [client 157.15.40.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/schallfuns.php"] [unique_id "aW8tCzN6cbQyA2ecQV2pMQAAAwE"]
[Tue Jan 20 15:21:47.833188 2026] [:error] [pid 8416:tid 8424] [client 157.15.40.62:63591] [client 157.15.40.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/postnews.php"] [unique_id "aW8tCzN6cbQyA2ecQV2pMgAAAwY"]
[Tue Jan 20 15:21:50.386771 2026] [:error] [pid 8455:tid 8470] [client 157.15.40.62:63777] [client 157.15.40.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/postnews.php"] [unique_id "aW8tDoJiHdPVtruynXCAVQAAA00"]
[Tue Jan 20 15:21:53.761794 2026] [:error] [pid 8416:tid 8441] [client 157.15.40.62:63996] [client 157.15.40.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/postnews.php"] [unique_id "aW8tETN6cbQyA2ecQV2pPwAAAxc"]
[Tue Jan 20 15:21:57.359005 2026] [:error] [pid 63647:tid 63655] [client 157.15.40.62:64165] [client 157.15.40.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/postnews.php"] [unique_id "aW8tFVUaYw1xHOoaFFLVywAAAgY"]
[Tue Jan 20 18:00:18.680619 2026] [:error] [pid 8416:tid 8424] [client 43.130.57.46:42850] [client 43.130.57.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aW9SMjN6cbQyA2ecQV27wQAAAwY"]
[Tue Jan 20 18:56:49.837322 2026] [:error] [pid 54261:tid 54353] [client 163.237.217.11:44176] [client 163.237.217.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aW9fcQESZyr5alDl9TvhrAAAAdI"]
[Tue Jan 20 21:18:11.509424 2026] [:error] [pid 8416:tid 8436] [client 223.15.245.170:38256] [client 223.15.245.170] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aW-AkzN6cbQyA2ecQV3bgwAAAxI"]
[Tue Jan 20 22:35:10.996416 2026] [:error] [pid 8455:tid 8478] [client 123.60.129.121:65152] [client 123.60.129.121] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 123.60.129.121, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aW-SnoJiHdPVtruynXDKMgAAA1U"]
[Tue Jan 20 23:35:57.741671 2026] [:error] [pid 54382:tid 54386] [client 124.156.157.91:42074] [client 124.156.157.91] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aW-g3UTJlZ9SJ6sBOEvXZwAAAAE"]
[Wed Jan 21 00:39:01.070829 2026] [:error] [pid 54259:tid 54287] [client 4.217.181.220:16650] [client 4.217.181.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/"] [unique_id "aW-vpQ2q1USrePnOoFQd3gAAAIo"]
[Wed Jan 21 00:39:01.616645 2026] [:error] [pid 54260:tid 54318] [client 4.217.181.220:11660] [client 4.217.181.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/"] [unique_id "aW-vpdg7jS3jmpUN0WBEGQAAAUo"]
[Wed Jan 21 00:39:02.158435 2026] [:error] [pid 54260:tid 54321] [client 4.217.181.220:12970] [client 4.217.181.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/"] [unique_id "aW-vptg7jS3jmpUN0WBEGgAAAU0"]
[Wed Jan 21 00:39:02.699566 2026] [:error] [pid 17340:tid 17371] [client 4.217.181.220:1926] [client 4.217.181.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/"] [unique_id "aW-vpvAsOSYVgw_35t3TXwAAAk8"]
[Wed Jan 21 02:03:15.952109 2026] [:error] [pid 56360:tid 56378] [client 163.237.217.11:40958] [client 163.237.217.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aW_DY01J8CD1rR-wXXuN2QAAARA"]
[Wed Jan 21 04:56:51.895510 2026] [:error] [pid 59863:tid 59889] [client 163.237.217.11:54926] [client 163.237.217.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aW_sE7HQ1zVZ4yLuI-zMMwAAARY"]
[Wed Jan 21 06:03:49.138225 2026] [:error] [pid 21563:tid 21569] [client 103.65.236.149:52891] [client 103.65.236.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aW_7xRZq__dTorabEoyiwgAAAMQ"]
[Wed Jan 21 06:03:49.673998 2026] [:error] [pid 21456:tid 21539] [client 103.65.236.149:53062] [client 103.65.236.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aW_7xQKyVQ9Ob2YxRAqNGgAAAJU"]
[Wed Jan 21 06:23:46.456517 2026] [:error] [pid 21454:tid 21472] [client 163.237.217.11:50458] [client 163.237.217.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXAAcjwp5UZmMFzY2bpjfAAAAAg"]
[Wed Jan 21 06:31:55.957906 2026] [:error] [pid 21454:tid 21465] [client 20.196.90.228:34947] [client 20.196.90.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aXACWzwp5UZmMFzY2bpkvAAAAAE"]
[Wed Jan 21 06:31:56.499513 2026] [:error] [pid 21563:tid 21565] [client 20.196.90.228:50514] [client 20.196.90.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aXACXBZq__dTorabEoyqlAAAAMA"]
[Wed Jan 21 06:31:57.040396 2026] [:error] [pid 59863:tid 59882] [client 20.196.90.228:38102] [client 20.196.90.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aXACXbHQ1zVZ4yLuI-zyfAAAAQ8"]
[Wed Jan 21 06:31:57.582165 2026] [:error] [pid 21455:tid 21510] [client 20.196.90.228:8542] [client 20.196.90.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aXACXYpOKALCSo1URZFTAAAAAFM"]
[Wed Jan 21 07:49:36.177421 2026] [:error] [pid 21456:tid 21539] [client 163.237.217.11:37980] [client 163.237.217.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXAUkAKyVQ9Ob2YxRAqsDAAAAJU"]
[Wed Jan 21 09:00:24.756803 2026] [:error] [pid 21456:tid 21522] [client 117.96.43.204:29574] [client 117.96.43.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.96.43.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXAlKAKyVQ9Ob2YxRAq-vAAAAIQ"]
[Wed Jan 21 09:09:49.744022 2026] [:error] [pid 56352:tid 56366] [client 163.237.217.11:42018] [client 163.237.217.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXAnXdWN6wYNPTU3efWB6gAAAUw"]
[Wed Jan 21 16:55:09.393440 2026] [:error] [pid 4382:tid 4390] [client 35.227.12.41:59779] [client 35.227.12.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.227.12.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXCUbZHg0falVG3JFbAkUgAAAYY"]
[Wed Jan 21 16:55:11.552203 2026] [:error] [pid 4382:tid 4395] [client 35.227.12.41:59779] [client 35.227.12.41] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aXCUb5Hg0falVG3JFbAkVQAAAYs"]
[Wed Jan 21 16:55:11.799729 2026] [:error] [pid 4382:tid 4407] [client 35.227.12.41:59779] [client 35.227.12.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.227.12.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXCUb5Hg0falVG3JFbAkVgAAAZc"]
[Wed Jan 21 16:55:13.431318 2026] [:error] [pid 4382:tid 4408] [client 35.227.12.41:63488] [client 35.227.12.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.227.12.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXCUcZHg0falVG3JFbAkWAAAAZg"]
[Wed Jan 21 16:55:14.851417 2026] [:error] [pid 21456:tid 21540] [client 35.227.12.41:53798] [client 35.227.12.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.227.12.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXCUcgKyVQ9Ob2YxRApN4wAAAJY"]
[Wed Jan 21 16:55:16.337534 2026] [:error] [pid 21456:tid 21542] [client 35.227.12.41:63992] [client 35.227.12.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.227.12.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXCUdAKyVQ9Ob2YxRApN5gAAAJg"]
[Wed Jan 21 16:55:17.809561 2026] [:error] [pid 21455:tid 21502] [client 35.227.12.41:63981] [client 35.227.12.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.227.12.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXCUdYpOKALCSo1URZH44QAAAEs"]
[Wed Jan 21 16:55:17.809745 2026] [:error] [pid 21455:tid 21502] [client 35.227.12.41:63981] [client 35.227.12.41] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.227.12.41, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXCUdYpOKALCSo1URZH44QAAAEs"]
[Wed Jan 21 17:51:52.219577 2026] [:error] [pid 21455:tid 21497] [client 213.232.120.163:46709] [client 213.232.120.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.232.120.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXChuIpOKALCSo1URZEHygAAAEY"]
[Wed Jan 21 17:51:56.817559 2026] [:error] [pid 21455:tid 21514] [client 213.232.120.163:36177] [client 213.232.120.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.232.120.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXChvIpOKALCSo1URZEH0wAAAFc"]
[Wed Jan 21 19:15:14.886957 2026] [:error] [pid 59863:tid 59876] [client 163.237.217.11:41354] [client 163.237.217.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXC1QrHQ1zVZ4yLuI-zC_gAAAQk"]
[Wed Jan 21 20:58:10.031178 2026] [:error] [pid 21455:tid 21491] [client 35.177.224.226:62859] [client 35.177.224.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.177.224.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXDNYopOKALCSo1URZE0IwAAAEA"]
[Wed Jan 21 20:58:11.693475 2026] [:error] [pid 56352:tid 56376] [client 35.177.224.226:62878] [client 35.177.224.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.177.224.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXDNY9WN6wYNPTU3efUUtAAAAVY"]
[Wed Jan 21 20:58:13.309730 2026] [:error] [pid 4382:tid 4395] [client 35.177.224.226:62882] [client 35.177.224.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.177.224.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXDNZZHg0falVG3JFbBUCQAAAYs"]
[Wed Jan 21 20:58:14.895071 2026] [:error] [pid 21455:tid 21504] [client 35.177.224.226:62887] [client 35.177.224.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.177.224.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXDNZopOKALCSo1URZE0LAAAAE0"]
[Wed Jan 21 20:58:16.485025 2026] [:error] [pid 21456:tid 21533] [client 35.177.224.226:62896] [client 35.177.224.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.177.224.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXDNaAKyVQ9Ob2YxRAqX7gAAAI8"]
[Wed Jan 21 20:58:18.059214 2026] [:error] [pid 21454:tid 21488] [client 35.177.224.226:62901] [client 35.177.224.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.177.224.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXDNajwp5UZmMFzY2bpIcAAAABg"]
[Wed Jan 21 20:58:18.059368 2026] [:error] [pid 21454:tid 21488] [client 35.177.224.226:62901] [client 35.177.224.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.177.224.226, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXDNajwp5UZmMFzY2bpIcAAAABg"]
[Wed Jan 21 21:05:03.562513 2026] [:error] [pid 21456:tid 21540] [client 43.133.69.37:50946] [client 43.133.69.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXDO_wKyVQ9Ob2YxRAqZdQAAAJY"]
[Thu Jan 22 00:23:03.820874 2026] [:error] [pid 21563:tid 21588] [client 156.239.223.127:41786] [client 156.239.223.127] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.223.127, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXD9ZxZq__dTorabEozCfQAAANc"]
[Thu Jan 22 00:23:06.916763 2026] [:error] [pid 59863:tid 59874] [client 45.206.72.206:34260] [client 45.206.72.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.206.72.206, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXD9arHQ1zVZ4yLuI-wEwAAAAQc"], referer: http://expressinteriors.com/wp-login.php
[Thu Jan 22 00:23:09.438474 2026] [:error] [pid 21455:tid 21493] [client 156.249.126.59:54808] [client 156.249.126.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aXD9bYpOKALCSo1URZFkBAAAAEI"]
[Thu Jan 22 00:23:11.695885 2026] [:error] [pid 21454:tid 21471] [client 154.199.15.104:46230] [client 154.199.15.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.199.15.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXD9bzwp5UZmMFzY2bpuwQAAAAc"], referer: https://expressinteriors.com/wp-login.php
[Thu Jan 22 00:23:11.700959 2026] [:error] [pid 21454:tid 21471] [client 154.199.15.104:46230] [client 154.199.15.104] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXD9bzwp5UZmMFzY2bpuwQAAAAc"], referer: https://expressinteriors.com/wp-login.php
[Thu Jan 22 00:23:13.253993 2026] [:error] [pid 21455:tid 21511] [client 156.239.215.141:32046] [client 156.239.215.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.215.141, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXD9cYpOKALCSo1URZFkDgAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Jan 22 00:23:13.258278 2026] [:error] [pid 21455:tid 21511] [client 156.239.215.141:32046] [client 156.239.215.141] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXD9cYpOKALCSo1URZFkDgAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Jan 22 00:23:30.031645 2026] [:error] [pid 21456:tid 21540] [client 156.239.156.62:29882] [client 156.239.156.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.156.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXD9ggKyVQ9Ob2YxRArFhQAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Thu Jan 22 00:23:30.034856 2026] [:error] [pid 21456:tid 21540] [client 156.239.156.62:29882] [client 156.239.156.62] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXD9ggKyVQ9Ob2YxRArFhQAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Thu Jan 22 00:23:31.555220 2026] [:error] [pid 21455:tid 21514] [client 156.239.210.26:48594] [client 156.239.210.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.210.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXD9g4pOKALCSo1URZFkIwAAAFc"], referer: https://expressinteriors.com/wp-login.php
[Thu Jan 22 00:23:31.558507 2026] [:error] [pid 21455:tid 21514] [client 156.239.210.26:48594] [client 156.239.210.26] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXD9g4pOKALCSo1URZFkIwAAAFc"], referer: https://expressinteriors.com/wp-login.php
[Thu Jan 22 00:23:33.143580 2026] [:error] [pid 21456:tid 21521] [client 156.249.124.99:11272] [client 156.249.124.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.249.124.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXD9hQKyVQ9Ob2YxRArFhgAAAIM"], referer: https://expressinteriors.com/wp-login.php
[Thu Jan 22 00:23:33.146780 2026] [:error] [pid 21456:tid 21521] [client 156.249.124.99:11272] [client 156.249.124.99] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXD9hQKyVQ9Ob2YxRArFhgAAAIM"], referer: https://expressinteriors.com/wp-login.php
[Thu Jan 22 03:13:06.639135 2026] [:error] [pid 21563:tid 21578] [client 49.51.52.250:50212] [client 49.51.52.250] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXElQhZq__dTorabEozj6QAAAM0"]
[Thu Jan 22 05:57:34.357949 2026] [:error] [pid 52447:tid 52511] [client 43.153.58.28:47088] [client 43.153.58.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXFLznRLA2NsdGqJzos8pAAAAII"]
[Thu Jan 22 08:42:20.669017 2026] [autoindex:error] [pid 52447:tid 52513] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:20.801651 2026] [autoindex:error] [pid 52447:tid 52516] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:20.936684 2026] [autoindex:error] [pid 52447:tid 52515] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:21.056846 2026] [autoindex:error] [pid 52447:tid 52525] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:21.176204 2026] [autoindex:error] [pid 52447:tid 52527] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:21.304738 2026] [autoindex:error] [pid 52447:tid 52522] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:21.436002 2026] [autoindex:error] [pid 52447:tid 52529] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:24.472746 2026] [autoindex:error] [pid 52447:tid 52526] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:25.297187 2026] [autoindex:error] [pid 52447:tid 52533] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:25.416399 2026] [autoindex:error] [pid 52447:tid 52531] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:25.546565 2026] [autoindex:error] [pid 52447:tid 52513] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:25.671669 2026] [autoindex:error] [pid 52447:tid 52515] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:25.796295 2026] [autoindex:error] [pid 52447:tid 52527] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:25.921749 2026] [autoindex:error] [pid 52447:tid 52529] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:26.047308 2026] [autoindex:error] [pid 52447:tid 52519] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:26.178912 2026] [autoindex:error] [pid 52447:tid 52511] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:26.303075 2026] [autoindex:error] [pid 52447:tid 52510] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:29.308882 2026] [autoindex:error] [pid 52447:tid 52533] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:29.563994 2026] [autoindex:error] [pid 52447:tid 52513] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:29.688309 2026] [autoindex:error] [pid 52447:tid 52516] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:29.812613 2026] [autoindex:error] [pid 52447:tid 52515] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:29.943780 2026] [autoindex:error] [pid 52447:tid 52525] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:30.783273 2026] [autoindex:error] [pid 52447:tid 52518] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:30.901805 2026] [autoindex:error] [pid 52447:tid 52512] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:31.022003 2026] [autoindex:error] [pid 52447:tid 52528] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:31.140431 2026] [autoindex:error] [pid 52447:tid 52520] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:31.263347 2026] [autoindex:error] [pid 52447:tid 52523] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:33.628161 2026] [autoindex:error] [pid 52447:tid 52515] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:33.746812 2026] [autoindex:error] [pid 52447:tid 52519] [client 20.89.131.200:39603] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Jan 22 08:42:35.287209 2026] [:error] [pid 52447:tid 52527] [client 20.89.131.200:39603] [client 20.89.131.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Response/"] [unique_id "aXFye3RLA2NsdGqJzouD3wAAAJI"]
[Thu Jan 22 08:42:35.747177 2026] [:error] [pid 52445:tid 52474] [client 20.89.131.200:54241] [client 20.89.131.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Response/"] [unique_id "aXFye-vMmsFgpSSb5L2x2AAAABQ"]
[Thu Jan 22 08:42:36.205449 2026] [:error] [pid 52447:tid 52528] [client 20.89.131.200:50840] [client 20.89.131.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Response/"] [unique_id "aXFyfHRLA2NsdGqJzouD4gAAAJM"]
[Thu Jan 22 08:42:36.662127 2026] [:error] [pid 52447:tid 52520] [client 20.89.131.200:65118] [client 20.89.131.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Response/"] [unique_id "aXFyfHRLA2NsdGqJzouD4wAAAIs"]
[Thu Jan 22 14:47:52.212003 2026] [:error] [pid 27550:tid 27556] [client 223.178.210.64:32787] [client 223.178.210.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.178.210.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXHIGOOQDPzfV5R2LYTurgAAAQQ"]
[Thu Jan 22 14:50:33.278731 2026] [:error] [pid 27550:tid 27576] [client 223.178.210.64:21382] [client 223.178.210.64] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXHIueOQDPzfV5R2LYTvkgAAARg"]
[Thu Jan 22 14:51:58.607300 2026] [:error] [pid 27550:tid 27561] [client 223.178.210.64:19426] [client 223.178.210.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.178.210.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXHJDuOQDPzfV5R2LYTwMAAAAQk"]
[Thu Jan 22 14:53:25.723820 2026] [:error] [pid 52445:tid 52466] [client 223.178.210.64:18431] [client 223.178.210.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.178.210.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXHJZevMmsFgpSSb5L0S-gAAAAw"]
[Thu Jan 22 14:54:44.466391 2026] [:error] [pid 52445:tid 52460] [client 223.178.210.64:29336] [client 223.178.210.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.178.210.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXHJtOvMmsFgpSSb5L0TMwAAAAY"]
[Thu Jan 22 14:56:04.697933 2026] [:error] [pid 36083:tid 36104] [client 223.178.210.64:12138] [client 223.178.210.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.178.210.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXHKBJCng2nQoR5iqwpOcQAAAVI"]
[Thu Jan 22 18:22:26.480425 2026] [:error] [pid 52447:tid 52522] [client 43.157.175.122:45548] [client 43.157.175.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXH6YnRLA2NsdGqJzos48QAAAI0"]
[Thu Jan 22 21:04:31.636188 2026] [:error] [pid 52556:tid 52564] [client 146.19.91.34:9761] [client 146.19.91.34] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXIgX-g4y1NKM4AgfjBvGQAAAMY"]
[Thu Jan 22 21:04:34.654489 2026] [:error] [pid 27550:tid 27566] [client 77.220.193.41:57977] [client 77.220.193.41] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXIgYuOQDPzfV5R2LYRKAwAAAQ4"]
[Thu Jan 22 21:04:42.117737 2026] [:error] [pid 52445:tid 52467] [client 178.20.214.193:55443] [client 178.20.214.193] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXIgauvMmsFgpSSb5L17FQAAAA0"]
[Thu Jan 22 21:05:02.459594 2026] [:error] [pid 52445:tid 52477] [client 45.148.234.60:38839] [client 45.148.234.60] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXIgfuvMmsFgpSSb5L17LAAAABc"]
[Thu Jan 22 21:05:07.956233 2026] [:error] [pid 20418:tid 20439] [client 136.0.108.230:36583] [client 136.0.108.230] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXIggxahoKEa6eS4cSp_2AAAAZE"]
[Thu Jan 22 21:05:12.852381 2026] [:error] [pid 27550:tid 27557] [client 185.96.37.102:30585] [client 185.96.37.102] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXIgiOOQDPzfV5R2LYRKHgAAAQU"]
[Thu Jan 22 21:06:00.896818 2026] [:error] [pid 36083:tid 36109] [client 38.154.206.241:49837] [client 38.154.206.241] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "aXIguJCng2nQoR5iqwqrPQAAAVc"]
[Thu Jan 22 21:06:08.090583 2026] [:error] [pid 36083:tid 36107] [client 193.202.14.251:17379] [client 193.202.14.251] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "aXIgwJCng2nQoR5iqwqrRAAAAVU"]
[Thu Jan 22 21:06:11.209254 2026] [:error] [pid 36083:tid 36090] [client 157.22.124.46:20751] [client 157.22.124.46] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "aXIgw5Cng2nQoR5iqwqrSgAAAUQ"]
[Thu Jan 22 21:38:19.291104 2026] [:error] [pid 36083:tid 36093] [client 38.248.90.56:59296] [client 38.248.90.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.248.90.56, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXIoS5Cng2nQoR5iqwqx_QAAAUc"]
[Thu Jan 22 21:38:21.138446 2026] [:error] [pid 36083:tid 36090] [client 38.248.90.56:59469] [client 38.248.90.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.248.90.56, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXIoTZCng2nQoR5iqwqyBwAAAUQ"]
[Thu Jan 22 22:15:59.035284 2026] [:error] [pid 52447:tid 52514] [client 38.248.90.56:52464] [client 38.248.90.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.248.90.56, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXIxH3RLA2NsdGqJzotydAAAAIU"]
[Thu Jan 22 22:34:28.762565 2026] [:error] [pid 52556:tid 52562] [client 95.216.63.67:55322] [client 95.216.63.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/license.php"] [unique_id "aXI1dOg4y1NKM4AgfjCCuQAAAMQ"], referer: www.google.com
[Thu Jan 22 22:40:21.263774 2026] [:error] [pid 52556:tid 52581] [client 38.248.90.56:65272] [client 38.248.90.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.248.90.56, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXI21eg4y1NKM4AgfjCEhwAAANc"]
[Thu Jan 22 23:10:00.062681 2026] [:error] [pid 36083:tid 36087] [client 38.248.90.56:58755] [client 38.248.90.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.248.90.56, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXI9yJCng2nQoR5iqwrEIAAAAUE"]
[Thu Jan 22 23:36:25.510907 2026] [:error] [pid 34321:tid 34329] [client 95.216.63.67:49959] [client 95.216.63.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce-payments/readme.txt"] [unique_id "aXJD-RLMkukwqSCtKrDKcwAAAcU"], referer: www.google.com
[Thu Jan 22 23:45:59.405976 2026] [:error] [pid 52445:tid 52457] [client 38.248.90.56:65503] [client 38.248.90.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.248.90.56, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXJGN-vMmsFgpSSb5L2k8QAAAAM"]
[Thu Jan 22 23:46:56.950435 2026] [:error] [pid 52447:tid 52528] [client 95.216.63.67:56048] [client 95.216.63.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aXJGcHRLA2NsdGqJzouHFAAAAJM"], referer: www.google.com
[Fri Jan 23 00:20:08.342349 2026] [:error] [pid 52446:tid 52482] [client 38.248.90.56:56369] [client 38.248.90.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.248.90.56, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXJOOLJ6clMw4kdrHYFDdAAAAEA"]
[Fri Jan 23 00:51:23.505654 2026] [:error] [pid 52446:tid 52502] [client 38.248.90.56:65444] [client 38.248.90.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.248.90.56, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXJVi7J6clMw4kdrHYFHeQAAAFQ"]
[Fri Jan 23 01:24:53.652988 2026] [:error] [pid 34321:tid 34339] [client 38.248.90.56:57770] [client 38.248.90.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.248.90.56, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXJdZRLMkukwqSCtKrDpuQAAAc8"]
[Fri Jan 23 02:01:20.046351 2026] [:error] [pid 20418:tid 20444] [client 67.205.145.180:61752] [client 67.205.145.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.205.145.180, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXJl8BahoKEa6eS4cSqz_AAAAZY"]
[Fri Jan 23 02:14:46.855746 2026] [:error] [pid 52445:tid 52463] [client 117.96.43.204:5449] [client 117.96.43.204] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXJpFuvMmsFgpSSb5L3FUQAAAAk"]
[Fri Jan 23 02:16:25.756513 2026] [:error] [pid 34321:tid 34343] [client 117.96.43.204:29247] [client 117.96.43.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.96.43.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXJpeRLMkukwqSCtKrD1ZgAAAdM"]
[Fri Jan 23 02:17:46.541704 2026] [:error] [pid 34321:tid 34326] [client 117.96.43.204:3856] [client 117.96.43.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.96.43.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXJpyhLMkukwqSCtKrD1qgAAAcI"]
[Fri Jan 23 02:19:09.125351 2026] [:error] [pid 27550:tid 27558] [client 117.96.43.204:25725] [client 117.96.43.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.96.43.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXJqHeOQDPzfV5R2LYSG1AAAAQY"]
[Fri Jan 23 02:20:36.591072 2026] [:error] [pid 34321:tid 34347] [client 117.96.43.204:5282] [client 117.96.43.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.96.43.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXJqdBLMkukwqSCtKrD2MQAAAdc"]
[Fri Jan 23 02:26:36.831127 2026] [:error] [pid 52556:tid 52577] [client 67.205.145.180:52895] [client 67.205.145.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.205.145.180, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXJr3Og4y1NKM4AgfjCtegAAANM"]
[Fri Jan 23 02:59:57.234807 2026] [:error] [pid 36083:tid 36099] [client 67.205.145.180:57206] [client 67.205.145.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.205.145.180, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXJzrZCng2nQoR5iqwrq1QAAAU0"]
[Fri Jan 23 03:21:02.651382 2026] [:error] [pid 52446:tid 52498] [client 117.96.43.204:26457] [client 117.96.43.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.96.43.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXJ4nrJ6clMw4kdrHYFf5gAAAFA"]
[Fri Jan 23 03:22:29.001165 2026] [:error] [pid 20418:tid 20435] [client 117.96.43.204:19131] [client 117.96.43.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.96.43.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXJ49RahoKEa6eS4cSrGJQAAAY0"]
[Fri Jan 23 03:23:39.751188 2026] [:error] [pid 34321:tid 34332] [client 117.96.43.204:25728] [client 117.96.43.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.96.43.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXJ5OxLMkukwqSCtKrAB0wAAAcg"]
[Fri Jan 23 03:24:54.393110 2026] [:error] [pid 20418:tid 20430] [client 117.96.43.204:9346] [client 117.96.43.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.96.43.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXJ5hhahoKEa6eS4cSrG-QAAAYg"]
[Fri Jan 23 03:26:11.664260 2026] [:error] [pid 52445:tid 52468] [client 117.96.43.204:3474] [client 117.96.43.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.96.43.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXJ50-vMmsFgpSSb5L3SJQAAAA4"]
[Fri Jan 23 04:59:05.162109 2026] [:error] [pid 11608:tid 11688] [client 123.187.240.242:44739] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXKPmb4alK6RZLlMctpZuwAAAJA"]
[Fri Jan 23 05:32:04.363599 2026] [autoindex:error] [pid 11606:tid 11637] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:04.491380 2026] [autoindex:error] [pid 11606:tid 11616] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:04.619591 2026] [autoindex:error] [pid 11606:tid 11631] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:04.746208 2026] [autoindex:error] [pid 11606:tid 11617] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:04.879888 2026] [autoindex:error] [pid 11606:tid 11633] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:05.005350 2026] [autoindex:error] [pid 11606:tid 11636] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:05.133753 2026] [autoindex:error] [pid 11606:tid 11627] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:08.318451 2026] [autoindex:error] [pid 11606:tid 11624] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:09.182123 2026] [autoindex:error] [pid 11606:tid 11632] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:09.311688 2026] [autoindex:error] [pid 11606:tid 11638] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:09.440457 2026] [autoindex:error] [pid 11606:tid 11616] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:09.568963 2026] [autoindex:error] [pid 11606:tid 11631] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:09.694914 2026] [autoindex:error] [pid 11606:tid 11617] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:09.822310 2026] [autoindex:error] [pid 11606:tid 11633] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:09.952402 2026] [autoindex:error] [pid 11606:tid 11636] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:10.086437 2026] [autoindex:error] [pid 11606:tid 11627] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:10.211778 2026] [autoindex:error] [pid 11606:tid 11622] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:13.394709 2026] [autoindex:error] [pid 11606:tid 11629] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:13.657700 2026] [autoindex:error] [pid 11606:tid 11626] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:13.783759 2026] [autoindex:error] [pid 11606:tid 11632] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:13.909569 2026] [autoindex:error] [pid 11606:tid 11638] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:14.038950 2026] [autoindex:error] [pid 11606:tid 11616] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:15.038274 2026] [autoindex:error] [pid 11606:tid 11627] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:15.171083 2026] [autoindex:error] [pid 11606:tid 11622] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:15.301625 2026] [autoindex:error] [pid 11606:tid 11635] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:15.429507 2026] [autoindex:error] [pid 11606:tid 11628] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:15.556586 2026] [autoindex:error] [pid 11606:tid 11640] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:17.972948 2026] [autoindex:error] [pid 11606:tid 11616] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:19.533632 2026] [autoindex:error] [pid 11606:tid 11628] [client 4.190.195.218:17785] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 05:32:21.138188 2026] [:error] [pid 11606:tid 11636] [client 4.190.195.218:17785] [client 4.190.195.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Response/"] [unique_id "aXKXZVnjAJqfHEQLcsh1tAAAABU"]
[Fri Jan 23 05:32:21.623102 2026] [:error] [pid 11608:tid 11689] [client 4.190.195.218:22998] [client 4.190.195.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Response/"] [unique_id "aXKXZb4alK6RZLlMctpqOgAAAJE"]
[Fri Jan 23 05:32:22.116993 2026] [:error] [pid 11606:tid 11631] [client 4.190.195.218:27884] [client 4.190.195.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Response/"] [unique_id "aXKXZlnjAJqfHEQLcsh1twAAABA"]
[Fri Jan 23 05:32:22.607343 2026] [:error] [pid 11607:tid 11651] [client 4.190.195.218:22976] [client 4.190.195.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Response/"] [unique_id "aXKXZgucTAUsUUzKw5cWUQAAAEc"]
[Fri Jan 23 06:07:12.446179 2026] [:error] [pid 11607:tid 11651] [client 157.245.36.108:39322] [client 157.245.36.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aXKfkAucTAUsUUzKw5claAAAAEc"]
[Fri Jan 23 06:07:21.171053 2026] [authz_core:error] [pid 11732:tid 11753] [client 157.245.36.108:43420] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Fri Jan 23 06:07:25.042756 2026] [:error] [pid 11608:tid 11672] [client 157.245.36.108:43448] [client 157.245.36.108] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aXKfnb4alK6RZLlMctp7IgAAAIA"]
[Fri Jan 23 06:07:27.049154 2026] [:error] [pid 11732:tid 11751] [client 157.245.36.108:43458] [client 157.245.36.108] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aXKfn-fd54xxq04JKuNlkgAAANE"]
[Fri Jan 23 06:46:07.238431 2026] [:error] [pid 11608:tid 11686] [client 43.166.130.123:36706] [client 43.166.130.123] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXKor74alK6RZLlMctqM0wAAAI4"]
[Fri Jan 23 07:37:25.583268 2026] [:error] [pid 11732:tid 11743] [client 199.189.26.212:49489] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXK0tefd54xxq04JKuOdtAAAAMk"]
[Fri Jan 23 07:37:27.114736 2026] [:error] [pid 11607:tid 11656] [client 199.189.26.212:49602] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXK0twucTAUsUUzKw5dLwgAAAEw"]
[Fri Jan 23 08:17:13.638399 2026] [:error] [pid 11606:tid 11629] [client 199.189.26.212:53030] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXK-CVnjAJqfHEQLcsi7NwAAAA4"]
[Fri Jan 23 08:41:53.655956 2026] [:error] [pid 11608:tid 11681] [client 199.189.26.212:53038] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXLD0b4alK6RZLlMctrH7gAAAIk"]
[Fri Jan 23 09:13:03.376242 2026] [:error] [pid 11732:tid 11744] [client 199.189.26.212:61868] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXLLH-fd54xxq04JKuPRrgAAAMo"]
[Fri Jan 23 09:50:04.741822 2026] [:error] [pid 11732:tid 11735] [client 199.189.26.212:53555] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXLTzOfd54xxq04JKuPbZQAAAME"]
[Fri Jan 23 10:28:11.487095 2026] [:error] [pid 64230:tid 64234] [client 199.189.26.212:56012] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXLcu62JXmVjD91caKIpHQAAAUE"]
[Fri Jan 23 11:07:19.132915 2026] [:error] [pid 64912:tid 64916] [client 199.189.26.212:58389] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXLl57em6jVGKqodwtJW4QAAAYI"]
[Fri Jan 23 11:47:39.890657 2026] [:error] [pid 11608:tid 11676] [client 199.189.26.212:59781] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXLvW74alK6RZLlMctoZKQAAAIQ"]
[Fri Jan 23 12:29:08.155605 2026] [:error] [pid 11732:tid 11745] [client 199.189.26.212:59664] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXL5FOfd54xxq04JKuMCNAAAAMs"]
[Fri Jan 23 13:10:41.326112 2026] [:error] [pid 11607:tid 11655] [client 43.135.144.126:40824] [client 43.135.144.126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXMC0QucTAUsUUzKw5ew1AAAAEs"]
[Fri Jan 23 13:11:27.520072 2026] [:error] [pid 11608:tid 11676] [client 199.189.26.212:59529] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMC_74alK6RZLlMctpB2wAAAIQ"]
[Fri Jan 23 13:46:10.118373 2026] [autoindex:error] [pid 11732:tid 11754] [client 91.239.157.187:47800] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:46:10.432821 2026] [autoindex:error] [pid 11732:tid 11755] [client 91.239.157.187:47800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:46:10.732632 2026] [autoindex:error] [pid 11732:tid 11747] [client 91.239.157.187:47800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:46:11.056733 2026] [autoindex:error] [pid 11732:tid 11757] [client 91.239.157.187:47800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:46:11.415693 2026] [autoindex:error] [pid 11732:tid 11744] [client 91.239.157.187:47800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:46:11.727491 2026] [autoindex:error] [pid 11732:tid 11756] [client 91.239.157.187:47800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:46:12.027821 2026] [autoindex:error] [pid 11732:tid 11740] [client 91.239.157.187:47800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:46:12.408493 2026] [autoindex:error] [pid 11732:tid 11734] [client 91.239.157.187:47800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:46:18.616193 2026] [autoindex:error] [pid 11732:tid 11739] [client 91.239.157.187:47800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:46:19.237413 2026] [autoindex:error] [pid 11732:tid 11755] [client 91.239.157.187:47800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:46:19.542580 2026] [autoindex:error] [pid 11732:tid 11752] [client 91.239.157.187:47800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:46:19.882132 2026] [autoindex:error] [pid 11732:tid 11757] [client 91.239.157.187:47800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:46:20.187518 2026] [autoindex:error] [pid 11732:tid 11735] [client 91.239.157.187:47800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:46:23.232308 2026] [autoindex:error] [pid 11732:tid 11737] [client 91.239.157.187:47800] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:46:27.768633 2026] [:error] [pid 11732:tid 11755] [client 91.239.157.187:47800] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/web/"] [unique_id "aXMLM-fd54xxq04JKuMXsgAAANU"]
[Fri Jan 23 13:46:28.367613 2026] [:error] [pid 64230:tid 64240] [client 91.239.157.187:42442] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/web/"] [unique_id "aXMLNK2JXmVjD91caKJmUgAAAUc"]
[Fri Jan 23 13:46:28.961686 2026] [:error] [pid 64230:tid 64239] [client 91.239.157.187:42458] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/web/"] [unique_id "aXMLNK2JXmVjD91caKJmUwAAAUY"]
[Fri Jan 23 13:46:29.552123 2026] [:error] [pid 11606:tid 11617] [client 91.239.157.187:42468] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/web/"] [unique_id "aXMLNVnjAJqfHEQLcsgrjgAAAAI"]
[Fri Jan 23 13:46:30.150884 2026] [:error] [pid 64230:tid 64236] [client 91.239.157.187:42474] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/"] [unique_id "aXMLNq2JXmVjD91caKJmVQAAAUM"]
[Fri Jan 23 13:46:30.749874 2026] [:error] [pid 11607:tid 11649] [client 91.239.157.187:42484] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/"] [unique_id "aXMLNgucTAUsUUzKw5e7-wAAAEU"]
[Fri Jan 23 13:46:31.430963 2026] [:error] [pid 62368:tid 62385] [client 91.239.157.187:42498] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/"] [unique_id "aXMLNyeMzKRnyYLMANMsIAAAAQ4"]
[Fri Jan 23 13:46:32.037347 2026] [:error] [pid 62368:tid 62391] [client 91.239.157.187:42076] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/"] [unique_id "aXMLOCeMzKRnyYLMANMsIQAAARQ"]
[Fri Jan 23 13:46:32.628262 2026] [:error] [pid 64912:tid 64925] [client 91.239.157.187:42078] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/"] [unique_id "aXMLOLem6jVGKqodwtKS3gAAAYs"]
[Fri Jan 23 13:46:33.232219 2026] [:error] [pid 64912:tid 64916] [client 91.239.157.187:42088] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/"] [unique_id "aXMLObem6jVGKqodwtKS4QAAAYI"]
[Fri Jan 23 13:46:33.845850 2026] [:error] [pid 64230:tid 64241] [client 91.239.157.187:42094] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/"] [unique_id "aXMLOa2JXmVjD91caKJmWQAAAUg"]
[Fri Jan 23 13:46:34.468708 2026] [:error] [pid 11732:tid 11745] [client 91.239.157.187:42106] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/"] [unique_id "aXMLOufd54xxq04JKuMXtAAAAMs"]
[Fri Jan 23 13:46:35.070757 2026] [:error] [pid 11732:tid 11734] [client 91.239.157.187:42118] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/"] [unique_id "aXMLO-fd54xxq04JKuMXtgAAAMA"]
[Fri Jan 23 13:46:35.933561 2026] [:error] [pid 11732:tid 11749] [client 91.239.157.187:42124] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/"] [unique_id "aXMLO-fd54xxq04JKuMXtwAAAM8"]
[Fri Jan 23 13:46:36.578770 2026] [:error] [pid 11608:tid 11694] [client 91.239.157.187:42130] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/"] [unique_id "aXMLPL4alK6RZLlMctpR3gAAAJY"]
[Fri Jan 23 13:46:37.204959 2026] [:error] [pid 11607:tid 11668] [client 91.239.157.187:42142] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/"] [unique_id "aXMLPQucTAUsUUzKw5e8AQAAAFc"]
[Fri Jan 23 13:46:37.836868 2026] [:error] [pid 11608:tid 11675] [client 91.239.157.187:42150] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Admin/uploads/"] [unique_id "aXMLPb4alK6RZLlMctpR4gAAAIM"]
[Fri Jan 23 13:46:38.434695 2026] [:error] [pid 64230:tid 64254] [client 91.239.157.187:42160] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Admin/uploads/"] [unique_id "aXMLPq2JXmVjD91caKJmYAAAAVU"]
[Fri Jan 23 13:46:39.038156 2026] [:error] [pid 11606:tid 11622] [client 91.239.157.187:42170] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Admin/uploads/"] [unique_id "aXMLP1njAJqfHEQLcsgrmAAAAAc"]
[Fri Jan 23 13:46:39.657888 2026] [:error] [pid 11606:tid 11620] [client 91.239.157.187:42182] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Admin/uploads/"] [unique_id "aXMLP1njAJqfHEQLcsgrmwAAAAU"]
[Fri Jan 23 13:46:40.249178 2026] [:error] [pid 11606:tid 11626] [client 91.239.157.187:42192] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/"] [unique_id "aXMLQFnjAJqfHEQLcsgrngAAAAs"]
[Fri Jan 23 13:46:40.839501 2026] [:error] [pid 64912:tid 64938] [client 91.239.157.187:42204] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/"] [unique_id "aXMLQLem6jVGKqodwtKS6QAAAZg"]
[Fri Jan 23 13:46:41.434920 2026] [:error] [pid 64912:tid 64915] [client 91.239.157.187:42218] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/"] [unique_id "aXMLQbem6jVGKqodwtKS7AAAAYE"]
[Fri Jan 23 13:46:42.025328 2026] [:error] [pid 11606:tid 11629] [client 91.239.157.187:55986] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/"] [unique_id "aXMLQlnjAJqfHEQLcsgrnwAAAA4"]
[Fri Jan 23 13:46:42.657301 2026] [:error] [pid 62368:tid 62387] [client 91.239.157.187:56000] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/"] [unique_id "aXMLQieMzKRnyYLMANMsKAAAARA"]
[Fri Jan 23 13:46:43.247987 2026] [:error] [pid 11732:tid 11746] [client 91.239.157.187:56004] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/"] [unique_id "aXMLQ-fd54xxq04JKuMXvQAAAMw"]
[Fri Jan 23 13:46:43.839111 2026] [:error] [pid 11732:tid 11747] [client 91.239.157.187:56014] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/"] [unique_id "aXMLQ-fd54xxq04JKuMXvwAAAM0"]
[Fri Jan 23 13:46:44.430907 2026] [:error] [pid 11606:tid 11638] [client 91.239.157.187:56026] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/"] [unique_id "aXMLRFnjAJqfHEQLcsgrpQAAABc"]
[Fri Jan 23 13:46:45.052472 2026] [:error] [pid 11732:tid 11744] [client 91.239.157.187:56042] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/"] [unique_id "aXMLRefd54xxq04JKuMXwAAAAMo"]
[Fri Jan 23 13:46:45.642687 2026] [:error] [pid 11608:tid 11673] [client 91.239.157.187:56046] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/"] [unique_id "aXMLRb4alK6RZLlMctpR6wAAAIE"]
[Fri Jan 23 13:46:46.663829 2026] [:error] [pid 62368:tid 62393] [client 91.239.157.187:56050] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/"] [unique_id "aXMLRieMzKRnyYLMANMsKwAAARY"]
[Fri Jan 23 13:46:47.260445 2026] [:error] [pid 64912:tid 64914] [client 91.239.157.187:56056] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/"] [unique_id "aXMLR7em6jVGKqodwtKS9gAAAYA"]
[Fri Jan 23 13:46:48.077034 2026] [:error] [pid 11606:tid 11626] [client 91.239.157.187:56064] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/"] [unique_id "aXMLSFnjAJqfHEQLcsgrqQAAAAs"]
[Fri Jan 23 13:46:48.667787 2026] [:error] [pid 64230:tid 64236] [client 91.239.157.187:56080] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/"] [unique_id "aXMLSK2JXmVjD91caKJmawAAAUM"]
[Fri Jan 23 13:46:49.260854 2026] [:error] [pid 64230:tid 64248] [client 91.239.157.187:56084] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/"] [unique_id "aXMLSa2JXmVjD91caKJmbAAAAU8"]
[Fri Jan 23 13:46:49.857371 2026] [:error] [pid 64230:tid 64245] [client 91.239.157.187:56100] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/"] [unique_id "aXMLSa2JXmVjD91caKJmbgAAAUw"]
[Fri Jan 23 13:46:50.449693 2026] [:error] [pid 64230:tid 64241] [client 91.239.157.187:56110] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/image/"] [unique_id "aXMLSq2JXmVjD91caKJmbwAAAUg"]
[Fri Jan 23 13:46:51.055904 2026] [:error] [pid 64912:tid 64935] [client 91.239.157.187:56124] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/image/"] [unique_id "aXMLS7em6jVGKqodwtKS_AAAAZU"]
[Fri Jan 23 13:46:51.675312 2026] [:error] [pid 11606:tid 11632] [client 91.239.157.187:38216] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/image/"] [unique_id "aXMLS1njAJqfHEQLcsgrrgAAABE"]
[Fri Jan 23 13:46:52.289455 2026] [:error] [pid 64230:tid 64235] [client 91.239.157.187:38220] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/image/"] [unique_id "aXMLTK2JXmVjD91caKJmcgAAAUI"]
[Fri Jan 23 13:46:52.879852 2026] [:error] [pid 64912:tid 64927] [client 91.239.157.187:38224] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/images/"] [unique_id "aXMLTLem6jVGKqodwtKS_gAAAY0"]
[Fri Jan 23 13:46:53.469632 2026] [:error] [pid 11608:tid 11695] [client 91.239.157.187:38230] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/images/"] [unique_id "aXMLTb4alK6RZLlMctpR-gAAAJc"]
[Fri Jan 23 13:46:54.094575 2026] [:error] [pid 64912:tid 64930] [client 91.239.157.187:38232] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/images/"] [unique_id "aXMLTrem6jVGKqodwtKTAAAAAZA"]
[Fri Jan 23 13:46:55.126423 2026] [:error] [pid 64230:tid 64233] [client 91.239.157.187:38236] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/images/"] [unique_id "aXMLT62JXmVjD91caKJmcwAAAUA"]
[Fri Jan 23 13:46:55.751793 2026] [:error] [pid 64230:tid 64252] [client 91.239.157.187:38252] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Public/"] [unique_id "aXMLT62JXmVjD91caKJmdQAAAVM"]
[Fri Jan 23 13:46:56.344277 2026] [:error] [pid 11607:tid 11664] [client 91.239.157.187:38262] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Public/"] [unique_id "aXMLUAucTAUsUUzKw5e8CAAAAFM"]
[Fri Jan 23 13:46:56.937689 2026] [:error] [pid 64230:tid 64247] [client 91.239.157.187:38274] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Public/"] [unique_id "aXMLUK2JXmVjD91caKJmeAAAAU4"]
[Fri Jan 23 13:46:57.528699 2026] [:error] [pid 11607:tid 11646] [client 91.239.157.187:38282] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Public/"] [unique_id "aXMLUQucTAUsUUzKw5e8DQAAAEI"]
[Fri Jan 23 13:46:58.141361 2026] [:error] [pid 11607:tid 11655] [client 91.239.157.187:38292] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/"] [unique_id "aXMLUgucTAUsUUzKw5e8EQAAAEs"]
[Fri Jan 23 13:46:58.732050 2026] [:error] [pid 11608:tid 11696] [client 91.239.157.187:38302] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/"] [unique_id "aXMLUr4alK6RZLlMctpSAgAAAJg"]
[Fri Jan 23 13:46:59.378409 2026] [:error] [pid 64230:tid 64256] [client 91.239.157.187:38310] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/"] [unique_id "aXMLU62JXmVjD91caKJmeQAAAVc"]
[Fri Jan 23 13:46:59.968656 2026] [:error] [pid 11606:tid 11628] [client 91.239.157.187:38312] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/"] [unique_id "aXMLU1njAJqfHEQLcsgrtAAAAA0"]
[Fri Jan 23 13:47:00.561037 2026] [:error] [pid 11608:tid 11690] [client 91.239.157.187:38322] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/local/"] [unique_id "aXMLVL4alK6RZLlMctpSCAAAAJI"]
[Fri Jan 23 13:47:01.153117 2026] [:error] [pid 64912:tid 64934] [client 91.239.157.187:38334] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/local/"] [unique_id "aXMLVbem6jVGKqodwtKTDQAAAZQ"]
[Fri Jan 23 13:47:01.773116 2026] [:error] [pid 11732:tid 11753] [client 91.239.157.187:54496] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/local/"] [unique_id "aXMLVefd54xxq04JKuMXywAAANM"]
[Fri Jan 23 13:47:02.362361 2026] [:error] [pid 11732:tid 11749] [client 91.239.157.187:54510] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/local/"] [unique_id "aXMLVufd54xxq04JKuMXzAAAAM8"]
[Fri Jan 23 13:47:02.952700 2026] [:error] [pid 11608:tid 11688] [client 91.239.157.187:54524] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/modules/"] [unique_id "aXMLVr4alK6RZLlMctpSCwAAAJA"]
[Fri Jan 23 13:47:03.776787 2026] [:error] [pid 11608:tid 11677] [client 91.239.157.187:54534] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/modules/"] [unique_id "aXMLV74alK6RZLlMctpSEAAAAIU"]
[Fri Jan 23 13:47:04.367371 2026] [:error] [pid 64912:tid 64934] [client 91.239.157.187:54540] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/modules/"] [unique_id "aXMLWLem6jVGKqodwtKTFwAAAZQ"]
[Fri Jan 23 13:47:04.957950 2026] [:error] [pid 11608:tid 11674] [client 91.239.157.187:54542] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/modules/"] [unique_id "aXMLWL4alK6RZLlMctpSFQAAAII"]
[Fri Jan 23 13:47:05.549376 2026] [:error] [pid 11608:tid 11685] [client 91.239.157.187:54552] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Site/"] [unique_id "aXMLWb4alK6RZLlMctpSFwAAAI0"]
[Fri Jan 23 13:47:06.139891 2026] [:error] [pid 11608:tid 11681] [client 91.239.157.187:54568] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Site/"] [unique_id "aXMLWr4alK6RZLlMctpSGwAAAIk"]
[Fri Jan 23 13:47:06.730943 2026] [:error] [pid 11608:tid 11675] [client 91.239.157.187:54582] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Site/"] [unique_id "aXMLWr4alK6RZLlMctpSIQAAAIM"]
[Fri Jan 23 13:47:07.324433 2026] [:error] [pid 64230:tid 64251] [client 91.239.157.187:54586] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Site/"] [unique_id "aXMLW62JXmVjD91caKJmgAAAAVI"]
[Fri Jan 23 13:47:07.917388 2026] [:error] [pid 11608:tid 11672] [client 91.239.157.187:54598] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system/"] [unique_id "aXMLW74alK6RZLlMctpSJwAAAIA"]
[Fri Jan 23 13:47:08.582190 2026] [:error] [pid 11607:tid 11666] [client 91.239.157.187:54614] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system/"] [unique_id "aXMLXAucTAUsUUzKw5e8FQAAAFU"]
[Fri Jan 23 13:47:09.173429 2026] [:error] [pid 64230:tid 64236] [client 91.239.157.187:54628] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system/"] [unique_id "aXMLXa2JXmVjD91caKJmgwAAAUM"]
[Fri Jan 23 13:47:09.784183 2026] [:error] [pid 64230:tid 64244] [client 91.239.157.187:54638] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system/"] [unique_id "aXMLXa2JXmVjD91caKJmhQAAAUs"]
[Fri Jan 23 13:47:10.504877 2026] [:error] [pid 64230:tid 64238] [client 91.239.157.187:54644] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/template/"] [unique_id "aXMLXq2JXmVjD91caKJmhwAAAUU"]
[Fri Jan 23 13:47:11.151504 2026] [:error] [pid 11607:tid 11649] [client 91.239.157.187:54658] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/template/"] [unique_id "aXMLXwucTAUsUUzKw5e8GAAAAEU"]
[Fri Jan 23 13:47:11.741443 2026] [:error] [pid 64912:tid 64929] [client 91.239.157.187:34470] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/template/"] [unique_id "aXMLX7em6jVGKqodwtKTHAAAAY8"]
[Fri Jan 23 13:47:12.340249 2026] [:error] [pid 64912:tid 64933] [client 91.239.157.187:34476] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/template/"] [unique_id "aXMLYLem6jVGKqodwtKTHQAAAZM"]
[Fri Jan 23 13:47:12.937873 2026] [:error] [pid 11608:tid 11673] [client 91.239.157.187:34490] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop/"] [unique_id "aXMLYL4alK6RZLlMctpSLwAAAIE"]
[Fri Jan 23 13:47:13.532983 2026] [:error] [pid 64912:tid 64928] [client 91.239.157.187:34502] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop/"] [unique_id "aXMLYbem6jVGKqodwtKTHwAAAY4"]
[Fri Jan 23 13:47:14.122355 2026] [:error] [pid 64230:tid 64240] [client 91.239.157.187:34514] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop/"] [unique_id "aXMLYq2JXmVjD91caKJmiwAAAUc"]
[Fri Jan 23 13:47:14.715683 2026] [:error] [pid 11607:tid 11659] [client 91.239.157.187:34526] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop/"] [unique_id "aXMLYgucTAUsUUzKw5e8GwAAAE8"]
[Fri Jan 23 13:47:15.419720 2026] [:error] [pid 64230:tid 64247] [client 91.239.157.187:34534] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files/"] [unique_id "aXMLY62JXmVjD91caKJmjgAAAU4"]
[Fri Jan 23 13:47:16.075730 2026] [:error] [pid 64230:tid 64234] [client 91.239.157.187:34548] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files/"] [unique_id "aXMLZK2JXmVjD91caKJmjwAAAUE"]
[Fri Jan 23 13:47:16.667430 2026] [:error] [pid 11607:tid 11665] [client 91.239.157.187:34552] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files/"] [unique_id "aXMLZAucTAUsUUzKw5e8IgAAAFQ"]
[Fri Jan 23 13:47:17.492345 2026] [:error] [pid 11607:tid 11648] [client 91.239.157.187:34564] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files/"] [unique_id "aXMLZQucTAUsUUzKw5e8JwAAAEQ"]
[Fri Jan 23 13:47:18.105322 2026] [:error] [pid 62368:tid 62382] [client 91.239.157.187:34566] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/editor/"] [unique_id "aXMLZieMzKRnyYLMANMsTQAAAQs"]
[Fri Jan 23 13:47:18.697594 2026] [:error] [pid 11608:tid 11682] [client 91.239.157.187:34580] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/editor/"] [unique_id "aXMLZr4alK6RZLlMctpSPgAAAIo"]
[Fri Jan 23 13:47:19.296895 2026] [:error] [pid 11607:tid 11654] [client 91.239.157.187:34582] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/editor/"] [unique_id "aXMLZwucTAUsUUzKw5e8KwAAAEo"]
[Fri Jan 23 13:47:19.898383 2026] [:error] [pid 11607:tid 11662] [client 91.239.157.187:34586] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/editor/"] [unique_id "aXMLZwucTAUsUUzKw5e8LQAAAFE"]
[Fri Jan 23 13:47:20.494227 2026] [:error] [pid 11608:tid 11672] [client 91.239.157.187:34602] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/include/"] [unique_id "aXMLaL4alK6RZLlMctpSQgAAAIA"]
[Fri Jan 23 13:47:21.087761 2026] [:error] [pid 11607:tid 11655] [client 91.239.157.187:34610] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/include/"] [unique_id "aXMLaQucTAUsUUzKw5e8MgAAAEs"]
[Fri Jan 23 13:47:21.678058 2026] [:error] [pid 64912:tid 64931] [client 91.239.157.187:57272] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/include/"] [unique_id "aXMLabem6jVGKqodwtKTMQAAAZE"]
[Fri Jan 23 13:47:22.582183 2026] [:error] [pid 62368:tid 62394] [client 91.239.157.187:57286] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/include/"] [unique_id "aXMLaieMzKRnyYLMANMsUwAAARc"]
[Fri Jan 23 13:47:23.175248 2026] [:error] [pid 62368:tid 62386] [client 91.239.157.187:57300] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Assets/"] [unique_id "aXMLayeMzKRnyYLMANMsVAAAAQ8"]
[Fri Jan 23 13:47:23.766280 2026] [:error] [pid 62368:tid 62389] [client 91.239.157.187:57332] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Assets/"] [unique_id "aXMLayeMzKRnyYLMANMsVgAAARI"]
[Fri Jan 23 13:47:24.413433 2026] [:error] [pid 11608:tid 11675] [client 91.239.157.187:57334] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Assets/"] [unique_id "aXMLbL4alK6RZLlMctpSSAAAAIM"]
[Fri Jan 23 13:47:25.096646 2026] [:error] [pid 64912:tid 64918] [client 91.239.157.187:57352] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Assets/"] [unique_id "aXMLbbem6jVGKqodwtKTRAAAAYQ"]
[Fri Jan 23 13:47:25.691651 2026] [:error] [pid 11732:tid 11735] [client 91.239.157.187:57358] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/stories/"] [unique_id "aXMLbefd54xxq04JKuMX2QAAAME"]
[Fri Jan 23 13:47:29.774343 2026] [autoindex:error] [pid 64912:tid 64932] [client 91.239.157.187:57382] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:47:31.976593 2026] [autoindex:error] [pid 64912:tid 64925] [client 91.239.157.187:57382] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:47:32.287284 2026] [authz_core:error] [pid 64912:tid 64933] [client 91.239.157.187:57382] AH01630: client denied by server configuration: /home/expressi/public_html/wp-content/plugins/akismet/
[Fri Jan 23 13:47:32.652512 2026] [autoindex:error] [pid 64912:tid 64928] [client 91.239.157.187:57382] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:47:32.972272 2026] [autoindex:error] [pid 64912:tid 64915] [client 91.239.157.187:57382] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:47:33.279765 2026] [autoindex:error] [pid 64912:tid 64921] [client 91.239.157.187:57382] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:47:33.604919 2026] [autoindex:error] [pid 64912:tid 64917] [client 91.239.157.187:57382] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:47:33.925184 2026] [autoindex:error] [pid 64912:tid 64920] [client 91.239.157.187:57382] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:47:34.225566 2026] [autoindex:error] [pid 64912:tid 64922] [client 91.239.157.187:57382] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/php-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:47:34.543186 2026] [autoindex:error] [pid 64912:tid 64924] [client 91.239.157.187:57382] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:47:34.875200 2026] [autoindex:error] [pid 64912:tid 64935] [client 91.239.157.187:57382] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:47:36.137726 2026] [autoindex:error] [pid 64912:tid 64929] [client 91.239.157.187:57382] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:47:36.448304 2026] [autoindex:error] [pid 64912:tid 64936] [client 91.239.157.187:57382] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:47:36.749885 2026] [autoindex:error] [pid 64912:tid 64923] [client 91.239.157.187:57382] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:47:37.128870 2026] [autoindex:error] [pid 64912:tid 64927] [client 91.239.157.187:57382] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:47:37.458962 2026] [autoindex:error] [pid 64912:tid 64918] [client 91.239.157.187:57382] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:47:37.765909 2026] [autoindex:error] [pid 64912:tid 64937] [client 91.239.157.187:57382] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:47:38.074140 2026] [autoindex:error] [pid 64912:tid 64938] [client 91.239.157.187:57382] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:47:38.397344 2026] [autoindex:error] [pid 64912:tid 64926] [client 91.239.157.187:57382] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 23 13:47:43.298812 2026] [:error] [pid 64912:tid 64922] [client 91.239.157.187:57382] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/components/"] [unique_id "aXMLf7em6jVGKqodwtKTbQAAAYg"]
[Fri Jan 23 13:47:43.889056 2026] [:error] [pid 62368:tid 62386] [client 91.239.157.187:37184] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/components/"] [unique_id "aXMLfyeMzKRnyYLMANMsZQAAAQ8"]
[Fri Jan 23 13:47:44.486609 2026] [:error] [pid 64230:tid 64247] [client 91.239.157.187:37188] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/components/"] [unique_id "aXMLgK2JXmVjD91caKJmvAAAAU4"]
[Fri Jan 23 13:47:45.077507 2026] [:error] [pid 11732:tid 11752] [client 91.239.157.187:37192] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/components/"] [unique_id "aXMLgefd54xxq04JKuMX7AAAANI"]
[Fri Jan 23 13:47:45.669105 2026] [:error] [pid 11732:tid 11756] [client 91.239.157.187:37202] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/images/"] [unique_id "aXMLgefd54xxq04JKuMX7QAAANY"]
[Fri Jan 23 13:47:46.288981 2026] [:error] [pid 64230:tid 64254] [client 91.239.157.187:37206] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/images/"] [unique_id "aXMLgq2JXmVjD91caKJmvwAAAVU"]
[Fri Jan 23 13:47:46.906812 2026] [:error] [pid 11732:tid 11745] [client 91.239.157.187:37214] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/images/"] [unique_id "aXMLgufd54xxq04JKuMX8AAAAMs"]
[Fri Jan 23 13:47:47.551806 2026] [:error] [pid 11732:tid 11749] [client 91.239.157.187:37228] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/images/"] [unique_id "aXMLg-fd54xxq04JKuMX8QAAAM8"]
[Fri Jan 23 13:47:48.144127 2026] [:error] [pid 11607:tid 11651] [client 91.239.157.187:37240] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/"] [unique_id "aXMLhAucTAUsUUzKw5e8WQAAAEc"]
[Fri Jan 23 13:47:48.735095 2026] [:error] [pid 62368:tid 62380] [client 91.239.157.187:37254] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/"] [unique_id "aXMLhCeMzKRnyYLMANMsawAAAQk"]
[Fri Jan 23 13:47:49.327276 2026] [:error] [pid 64230:tid 64250] [client 91.239.157.187:37268] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/"] [unique_id "aXMLha2JXmVjD91caKJmwAAAAVE"]
[Fri Jan 23 13:47:49.917918 2026] [:error] [pid 64912:tid 64927] [client 91.239.157.187:37282] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/"] [unique_id "aXMLhbem6jVGKqodwtKTdAAAAY0"]
[Fri Jan 23 13:47:50.510786 2026] [:error] [pid 11732:tid 11734] [client 91.239.157.187:37292] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/fonts/"] [unique_id "aXMLhufd54xxq04JKuMX9AAAAMA"]
[Fri Jan 23 13:47:51.159054 2026] [:error] [pid 11732:tid 11741] [client 91.239.157.187:37294] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/fonts/"] [unique_id "aXMLh-fd54xxq04JKuMX9QAAAMc"]
[Fri Jan 23 13:47:51.781349 2026] [:error] [pid 64912:tid 64930] [client 91.239.157.187:33004] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/fonts/"] [unique_id "aXMLh7em6jVGKqodwtKTdQAAAZA"]
[Fri Jan 23 13:47:52.431424 2026] [:error] [pid 11606:tid 11622] [client 91.239.157.187:33008] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/fonts/"] [unique_id "aXMLiFnjAJqfHEQLcsgr8wAAAAc"]
[Fri Jan 23 13:47:53.057762 2026] [:error] [pid 62368:tid 62379] [client 91.239.157.187:33016] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/admin/js/"] [unique_id "aXMLiSeMzKRnyYLMANMscwAAAQg"]
[Fri Jan 23 13:47:53.649194 2026] [:error] [pid 11608:tid 11688] [client 91.239.157.187:33022] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/admin/js/"] [unique_id "aXMLib4alK6RZLlMctpScwAAAJA"]
[Fri Jan 23 13:47:54.241575 2026] [:error] [pid 11606:tid 11630] [client 91.239.157.187:33036] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/admin/js/"] [unique_id "aXMLilnjAJqfHEQLcsgr9wAAAA8"]
[Fri Jan 23 13:47:54.842683 2026] [:error] [pid 11606:tid 11615] [client 91.239.157.187:33044] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/admin/js/"] [unique_id "aXMLilnjAJqfHEQLcsgr-QAAAAA"]
[Fri Jan 23 13:47:55.432129 2026] [:error] [pid 64912:tid 64932] [client 91.239.157.187:33058] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/"] [unique_id "aXMLi7em6jVGKqodwtKTfAAAAZI"]
[Fri Jan 23 13:47:56.023087 2026] [:error] [pid 62368:tid 62392] [client 91.239.157.187:33070] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/"] [unique_id "aXMLjCeMzKRnyYLMANMsdgAAARU"]
[Fri Jan 23 13:47:56.629948 2026] [:error] [pid 62368:tid 62381] [client 91.239.157.187:33074] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/"] [unique_id "aXMLjCeMzKRnyYLMANMsdwAAAQo"]
[Fri Jan 23 13:47:57.221966 2026] [:error] [pid 64912:tid 64927] [client 91.239.157.187:33078] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/"] [unique_id "aXMLjbem6jVGKqodwtKTfwAAAY0"]
[Fri Jan 23 13:47:57.814807 2026] [:error] [pid 62368:tid 62382] [client 91.239.157.187:33080] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/"] [unique_id "aXMLjSeMzKRnyYLMANMsegAAAQs"]
[Fri Jan 23 13:47:58.409071 2026] [:error] [pid 62368:tid 62378] [client 91.239.157.187:33096] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/"] [unique_id "aXMLjieMzKRnyYLMANMsfAAAAQc"]
[Fri Jan 23 13:47:59.023841 2026] [:error] [pid 62368:tid 62377] [client 91.239.157.187:33108] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/"] [unique_id "aXMLjyeMzKRnyYLMANMsfQAAAQY"]
[Fri Jan 23 13:47:59.640723 2026] [:error] [pid 64912:tid 64931] [client 91.239.157.187:33122] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/"] [unique_id "aXMLj7em6jVGKqodwtKThgAAAZE"]
[Fri Jan 23 13:48:00.232267 2026] [:error] [pid 11732:tid 11749] [client 91.239.157.187:33130] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/"] [unique_id "aXMLkOfd54xxq04JKuMX-QAAAM8"]
[Fri Jan 23 13:48:00.823168 2026] [:error] [pid 11732:tid 11740] [client 91.239.157.187:33136] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/"] [unique_id "aXMLkOfd54xxq04JKuMX-wAAAMY"]
[Fri Jan 23 13:48:01.412867 2026] [:error] [pid 62368:tid 62382] [client 91.239.157.187:33144] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/"] [unique_id "aXMLkSeMzKRnyYLMANMsgwAAAQs"]
[Fri Jan 23 13:48:02.105539 2026] [:error] [pid 11732:tid 11748] [client 91.239.157.187:45044] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/"] [unique_id "aXMLkufd54xxq04JKuMX_QAAAM4"]
[Fri Jan 23 13:48:02.714801 2026] [:error] [pid 11608:tid 11691] [client 91.239.157.187:45048] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/js/dist/"] [unique_id "aXMLkr4alK6RZLlMctpSeAAAAJM"]
[Fri Jan 23 13:48:03.305522 2026] [:error] [pid 62368:tid 62371] [client 91.239.157.187:45064] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/js/dist/"] [unique_id "aXMLkyeMzKRnyYLMANMshwAAAQA"]
[Fri Jan 23 13:48:03.897842 2026] [:error] [pid 64230:tid 64249] [client 91.239.157.187:45080] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/js/dist/"] [unique_id "aXMLk62JXmVjD91caKJmygAAAVA"]
[Fri Jan 23 13:48:04.492876 2026] [:error] [pid 64912:tid 64935] [client 91.239.157.187:45090] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/js/dist/"] [unique_id "aXMLlLem6jVGKqodwtKTjAAAAZU"]
[Fri Jan 23 13:48:05.128785 2026] [:error] [pid 64230:tid 64251] [client 91.239.157.187:45096] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/"] [unique_id "aXMLla2JXmVjD91caKJmzQAAAVI"]
[Fri Jan 23 13:48:05.805328 2026] [:error] [pid 62368:tid 62389] [client 91.239.157.187:45102] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/"] [unique_id "aXMLlSeMzKRnyYLMANMsjQAAARI"]
[Fri Jan 23 13:48:06.397359 2026] [:error] [pid 11606:tid 11638] [client 91.239.157.187:45104] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/"] [unique_id "aXMLllnjAJqfHEQLcsgsAAAAABc"]
[Fri Jan 23 13:48:07.012745 2026] [:error] [pid 11732:tid 11742] [client 91.239.157.187:45120] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/"] [unique_id "aXMLl-fd54xxq04JKuMYAAAAAMg"]
[Fri Jan 23 13:48:07.607857 2026] [:error] [pid 62368:tid 62395] [client 91.239.157.187:45136] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/"] [unique_id "aXMLlyeMzKRnyYLMANMskAAAARg"]
[Fri Jan 23 13:48:08.496705 2026] [:error] [pid 11608:tid 11680] [client 91.239.157.187:45140] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/"] [unique_id "aXMLmL4alK6RZLlMctpShAAAAIg"]
[Fri Jan 23 13:48:09.126995 2026] [:error] [pid 64230:tid 64244] [client 91.239.157.187:45144] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/"] [unique_id "aXMLma2JXmVjD91caKJm0QAAAUs"]
[Fri Jan 23 13:48:09.719377 2026] [:error] [pid 11608:tid 11672] [client 91.239.157.187:45150] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/"] [unique_id "aXMLmb4alK6RZLlMctpSiQAAAIA"]
[Fri Jan 23 13:48:10.311638 2026] [:error] [pid 11608:tid 11674] [client 91.239.157.187:45154] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/assets/js/"] [unique_id "aXMLmr4alK6RZLlMctpSjQAAAII"]
[Fri Jan 23 13:48:10.902163 2026] [:error] [pid 64230:tid 64241] [client 91.239.157.187:45170] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/assets/js/"] [unique_id "aXMLmq2JXmVjD91caKJm0gAAAUg"]
[Fri Jan 23 13:48:11.502057 2026] [:error] [pid 11606:tid 11633] [client 91.239.157.187:33238] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/assets/js/"] [unique_id "aXMLm1njAJqfHEQLcsgsBwAAABI"]
[Fri Jan 23 13:48:12.091877 2026] [:error] [pid 64912:tid 64928] [client 91.239.157.187:33252] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/assets/js/"] [unique_id "aXMLnLem6jVGKqodwtKTkwAAAY4"]
[Fri Jan 23 13:48:12.705353 2026] [:error] [pid 11606:tid 11636] [client 91.239.157.187:33268] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/"] [unique_id "aXMLnFnjAJqfHEQLcsgsCAAAABU"]
[Fri Jan 23 13:48:13.295803 2026] [:error] [pid 11608:tid 11693] [client 91.239.157.187:33272] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/"] [unique_id "aXMLnb4alK6RZLlMctpSmAAAAJU"]
[Fri Jan 23 13:48:13.887469 2026] [:error] [pid 11606:tid 11627] [client 91.239.157.187:33282] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/"] [unique_id "aXMLnVnjAJqfHEQLcsgsCQAAAAw"]
[Fri Jan 23 13:48:14.484740 2026] [:error] [pid 11608:tid 11691] [client 91.239.157.187:33294] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/"] [unique_id "aXMLnr4alK6RZLlMctpSmQAAAJM"]
[Fri Jan 23 13:48:15.074924 2026] [:error] [pid 64912:tid 64922] [client 91.239.157.187:33304] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/meta/"] [unique_id "aXMLn7em6jVGKqodwtKTmAAAAYg"]
[Fri Jan 23 13:48:15.665498 2026] [:error] [pid 11608:tid 11696] [client 91.239.157.187:33314] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/meta/"] [unique_id "aXMLn74alK6RZLlMctpSmwAAAJg"]
[Fri Jan 23 13:48:16.267208 2026] [:error] [pid 64912:tid 64932] [client 91.239.157.187:33322] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/meta/"] [unique_id "aXMLoLem6jVGKqodwtKTmgAAAZI"]
[Fri Jan 23 13:48:16.862295 2026] [:error] [pid 62368:tid 62374] [client 91.239.157.187:33326] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/meta/"] [unique_id "aXMLoCeMzKRnyYLMANMslQAAAQM"]
[Fri Jan 23 13:48:17.457880 2026] [:error] [pid 64912:tid 64924] [client 91.239.157.187:33338] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/"] [unique_id "aXMLobem6jVGKqodwtKTnAAAAYo"]
[Fri Jan 23 13:48:18.048099 2026] [:error] [pid 62368:tid 62376] [client 91.239.157.187:33340] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/"] [unique_id "aXMLoieMzKRnyYLMANMsmAAAAQU"]
[Fri Jan 23 13:48:18.855436 2026] [:error] [pid 62368:tid 62372] [client 91.239.157.187:33354] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/"] [unique_id "aXMLoieMzKRnyYLMANMsmgAAAQE"]
[Fri Jan 23 13:48:19.477650 2026] [:error] [pid 11608:tid 11694] [client 91.239.157.187:33362] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/"] [unique_id "aXMLo74alK6RZLlMctpSnQAAAJY"]
[Fri Jan 23 13:48:20.069308 2026] [:error] [pid 62368:tid 62386] [client 91.239.157.187:33378] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/"] [unique_id "aXMLpCeMzKRnyYLMANMsngAAAQ8"]
[Fri Jan 23 13:48:20.777178 2026] [:error] [pid 64912:tid 64922] [client 91.239.157.187:33382] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/"] [unique_id "aXMLpLem6jVGKqodwtKTowAAAYg"]
[Fri Jan 23 13:48:21.376711 2026] [:error] [pid 64912:tid 64921] [client 91.239.157.187:33388] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/"] [unique_id "aXMLpbem6jVGKqodwtKTpAAAAYc"]
[Fri Jan 23 13:48:21.992028 2026] [:error] [pid 64912:tid 64934] [client 91.239.157.187:47120] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/"] [unique_id "aXMLpbem6jVGKqodwtKTpQAAAZQ"]
[Fri Jan 23 13:48:22.636494 2026] [:error] [pid 64912:tid 64930] [client 91.239.157.187:47134] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aXMLprem6jVGKqodwtKTrAAAAZA"]
[Fri Jan 23 13:48:23.240013 2026] [:error] [pid 11608:tid 11692] [client 91.239.157.187:47138] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aXMLp74alK6RZLlMctpSsgAAAJQ"]
[Fri Jan 23 13:48:23.873603 2026] [:error] [pid 11607:tid 11645] [client 91.239.157.187:47150] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aXMLpwucTAUsUUzKw5e8fgAAAEE"]
[Fri Jan 23 13:48:24.493131 2026] [:error] [pid 11607:tid 11669] [client 91.239.157.187:47154] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aXMLqAucTAUsUUzKw5e8fwAAAFg"]
[Fri Jan 23 13:48:25.339079 2026] [:error] [pid 11606:tid 11629] [client 91.239.157.187:47170] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/"] [unique_id "aXMLqVnjAJqfHEQLcsgsEwAAAA4"]
[Fri Jan 23 13:48:26.027236 2026] [:error] [pid 64230:tid 64249] [client 91.239.157.187:47182] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/"] [unique_id "aXMLqq2JXmVjD91caKJm9wAAAVA"]
[Fri Jan 23 13:48:26.617412 2026] [:error] [pid 11608:tid 11683] [client 91.239.157.187:47184] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/"] [unique_id "aXMLqr4alK6RZLlMctpS0gAAAIs"]
[Fri Jan 23 13:48:27.207929 2026] [:error] [pid 64230:tid 64257] [client 91.239.157.187:47188] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/"] [unique_id "aXMLq62JXmVjD91caKJm_AAAAVg"]
[Fri Jan 23 13:48:27.800367 2026] [:error] [pid 64912:tid 64929] [client 91.239.157.187:47194] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/"] [unique_id "aXMLq7em6jVGKqodwtKTtgAAAY8"]
[Fri Jan 23 13:48:28.408480 2026] [:error] [pid 64912:tid 64928] [client 91.239.157.187:47210] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/"] [unique_id "aXMLrLem6jVGKqodwtKTuAAAAY4"]
[Fri Jan 23 13:48:28.997567 2026] [:error] [pid 64912:tid 64938] [client 91.239.157.187:47222] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/"] [unique_id "aXMLrLem6jVGKqodwtKTvQAAAZg"]
[Fri Jan 23 13:48:29.874793 2026] [:error] [pid 64912:tid 64926] [client 91.239.157.187:47226] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/"] [unique_id "aXMLrbem6jVGKqodwtKTwAAAAYw"]
[Fri Jan 23 13:48:30.510189 2026] [:error] [pid 64230:tid 64236] [client 91.239.157.187:47230] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/"] [unique_id "aXMLrq2JXmVjD91caKJm_wAAAUM"]
[Fri Jan 23 13:48:31.133034 2026] [:error] [pid 11606:tid 11635] [client 91.239.157.187:47236] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/"] [unique_id "aXMLr1njAJqfHEQLcsgsGQAAABQ"]
[Fri Jan 23 13:48:31.726719 2026] [:error] [pid 11732:tid 11753] [client 91.239.157.187:51310] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/"] [unique_id "aXMLr-fd54xxq04JKuMYDgAAANM"]
[Fri Jan 23 13:48:32.367973 2026] [:error] [pid 11732:tid 11748] [client 91.239.157.187:51326] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/"] [unique_id "aXMLsOfd54xxq04JKuMYDwAAAM4"]
[Fri Jan 23 13:48:32.969846 2026] [:error] [pid 64230:tid 64251] [client 91.239.157.187:51342] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "aXMLsK2JXmVjD91caKJnAAAAAVI"]
[Fri Jan 23 13:48:33.577717 2026] [:error] [pid 11732:tid 11744] [client 91.239.157.187:51348] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "aXMLsefd54xxq04JKuMYEgAAAMo"]
[Fri Jan 23 13:48:34.185893 2026] [:error] [pid 11607:tid 11647] [client 91.239.157.187:51350] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "aXMLsgucTAUsUUzKw5e8jAAAAEM"]
[Fri Jan 23 13:48:34.790856 2026] [:error] [pid 11732:tid 11751] [client 91.239.157.187:51356] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "aXMLsufd54xxq04JKuMYFQAAANE"]
[Fri Jan 23 13:48:35.381914 2026] [:error] [pid 62368:tid 62380] [client 91.239.157.187:51364] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/"] [unique_id "aXMLsyeMzKRnyYLMANMsrgAAAQk"]
[Fri Jan 23 13:48:35.976967 2026] [:error] [pid 11607:tid 11665] [client 91.239.157.187:51380] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/"] [unique_id "aXMLswucTAUsUUzKw5e8jgAAAFQ"]
[Fri Jan 23 13:48:36.569842 2026] [:error] [pid 11608:tid 11679] [client 91.239.157.187:51392] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/"] [unique_id "aXMLtL4alK6RZLlMctpS2wAAAIc"]
[Fri Jan 23 13:48:37.169576 2026] [:error] [pid 11608:tid 11695] [client 91.239.157.187:51394] [client 91.239.157.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/"] [unique_id "aXMLtb4alK6RZLlMctpS3AAAAJc"]
[Fri Jan 23 13:54:05.744429 2026] [:error] [pid 64230:tid 64250] [client 199.189.26.212:59403] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMM_a2JXmVjD91caKJoYAAAAVE"]
[Fri Jan 23 14:19:29.794450 2026] [:error] [pid 11607:tid 11669] [client 156.239.208.28:52658] [client 156.239.208.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.208.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMS8QucTAUsUUzKw5fECgAAAFg"]
[Fri Jan 23 14:19:31.797469 2026] [:error] [pid 64912:tid 64933] [client 156.239.221.158:17292] [client 156.239.221.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.221.158, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMS87em6jVGKqodwtKfOAAAAZM"], referer: http://expressinteriors.com/wp-login.php
[Fri Jan 23 14:19:34.936077 2026] [:error] [pid 62368:tid 62389] [client 154.82.171.148:19544] [client 154.82.171.148] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aXMS9ieMzKRnyYLMANM0cQAAARI"]
[Fri Jan 23 14:19:37.357002 2026] [:error] [pid 11732:tid 11738] [client 156.242.51.182:20192] [client 156.242.51.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.242.51.182, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMS-efd54xxq04JKuMgCwAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Jan 23 14:19:37.361079 2026] [:error] [pid 11732:tid 11738] [client 156.242.51.182:20192] [client 156.242.51.182] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMS-efd54xxq04JKuMgCwAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Jan 23 14:19:38.937545 2026] [:error] [pid 11608:tid 11687] [client 156.249.126.98:49074] [client 156.249.126.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.249.126.98, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMS-r4alK6RZLlMctphvAAAAI8"], referer: https://expressinteriors.com/wp-login.php
[Fri Jan 23 14:19:38.940820 2026] [:error] [pid 11608:tid 11687] [client 156.249.126.98:49074] [client 156.249.126.98] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMS-r4alK6RZLlMctphvAAAAI8"], referer: https://expressinteriors.com/wp-login.php
[Fri Jan 23 14:19:40.609274 2026] [:error] [pid 62368:tid 62393] [client 154.193.155.99:35374] [client 154.193.155.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.193.155.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMS_CeMzKRnyYLMANM0cwAAARY"], referer: https://expressinteriors.com/wp-login.php
[Fri Jan 23 14:19:40.612566 2026] [:error] [pid 62368:tid 62393] [client 154.193.155.99:35374] [client 154.193.155.99] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMS_CeMzKRnyYLMANM0cwAAARY"], referer: https://expressinteriors.com/wp-login.php
[Fri Jan 23 14:19:42.150351 2026] [:error] [pid 64912:tid 64926] [client 156.249.125.70:55334] [client 156.249.125.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.249.125.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMS_rem6jVGKqodwtKfSwAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Fri Jan 23 14:19:42.153582 2026] [:error] [pid 64912:tid 64926] [client 156.249.125.70:55334] [client 156.249.125.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMS_rem6jVGKqodwtKfSwAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Fri Jan 23 14:19:43.506706 2026] [:error] [pid 11607:tid 11648] [client 154.193.159.16:32900] [client 154.193.159.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.193.159.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMS_wucTAUsUUzKw5fEGwAAAEQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Jan 23 14:19:43.510026 2026] [:error] [pid 11607:tid 11648] [client 154.193.159.16:32900] [client 154.193.159.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMS_wucTAUsUUzKw5fEGwAAAEQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Jan 23 14:36:51.011083 2026] [:error] [pid 11608:tid 11686] [client 199.189.26.212:58939] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMXA74alK6RZLlMctpppgAAAI4"]
[Fri Jan 23 14:48:52.243318 2026] [:error] [pid 62368:tid 62385] [client 18.134.137.96:43526] [client 18.134.137.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 18.134.137.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXMZ1CeMzKRnyYLMANM9QQAAAQ4"]
[Fri Jan 23 14:52:50.126639 2026] [:error] [pid 11607:tid 11652] [client 51.222.156.110:50868] [client 51.222.156.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.222.156.110, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMawgucTAUsUUzKw5fK_AAAAEg"]
[Fri Jan 23 14:52:51.075747 2026] [:error] [pid 11607:tid 11661] [client 51.222.156.110:50868] [client 51.222.156.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.222.156.110, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMawwucTAUsUUzKw5fK_QAAAFA"], referer: https://expressinteriors.com/wp-login.php
[Fri Jan 23 15:04:55.399064 2026] [:error] [pid 11607:tid 11653] [client 167.99.215.209:32936] [client 167.99.215.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.215.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXMdlwucTAUsUUzKw5fNjQAAAEk"]
[Fri Jan 23 15:10:31.779913 2026] [:error] [pid 64912:tid 64921] [client 212.227.175.43:50335] [client 212.227.175.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/postnews.php"] [unique_id "aXMe57em6jVGKqodwtKvTwAAAYc"], referer: www.google.com
[Fri Jan 23 15:17:30.750466 2026] [:error] [pid 11732:tid 11739] [client 207.246.90.78:43596] [client 207.246.90.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 207.246.90.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMgiufd54xxq04JKuMuTAAAAMU"]
[Fri Jan 23 15:17:34.560689 2026] [:error] [pid 11732:tid 11757] [client 207.246.90.78:43596] [client 207.246.90.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 207.246.90.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMgjufd54xxq04JKuMuUgAAANc"], referer: https://expressinteriors.com/wp-login.php
[Fri Jan 23 15:20:30.337648 2026] [:error] [pid 64912:tid 64937] [client 199.189.26.212:58363] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMhPrem6jVGKqodwtKyqwAAAZc"]
[Fri Jan 23 15:33:18.803853 2026] [:error] [pid 11606:tid 11616] [client 160.25.7.215:44960] [client 160.25.7.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 160.25.7.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMkPlnjAJqfHEQLcshGegAAAAE"]
[Fri Jan 23 15:33:37.874890 2026] [:error] [pid 11607:tid 11666] [client 160.25.7.215:52756] [client 160.25.7.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 160.25.7.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMkUQucTAUsUUzKw5fUOAAAAFU"], referer: https://expressinteriors.com/wp-login.php
[Fri Jan 23 16:04:27.009380 2026] [:error] [pid 11608:tid 11693] [client 199.189.26.212:58716] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXMri74alK6RZLlMctqMgwAAAJU"]
[Fri Jan 23 16:48:42.291606 2026] [:error] [pid 11608:tid 11690] [client 199.189.26.212:58279] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXM16r4alK6RZLlMctqYHAAAAJI"]
[Fri Jan 23 17:07:47.618430 2026] [:error] [pid 11606:tid 11615] [client 49.234.192.248:53170] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXM6Y1njAJqfHEQLcshaNgAAAAA"]
[Fri Jan 23 17:12:31.604462 2026] [:error] [pid 11607:tid 11667] [client 66.175.44.56:59286] [client 66.175.44.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.175.44.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXM7fwucTAUsUUzKw5focwAAAFY"]
[Fri Jan 23 17:32:52.983479 2026] [:error] [pid 11606:tid 11634] [client 199.189.26.212:58146] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXNARFnjAJqfHEQLcshfDwAAABM"]
[Fri Jan 23 17:35:05.918712 2026] [:error] [pid 11732:tid 11735] [client 185.181.252.23:39122] [client 185.181.252.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.181.252.23, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXNAyefd54xxq04JKuNQ0gAAAME"]
[Fri Jan 23 17:44:08.001859 2026] [:error] [pid 62368:tid 62377] [client 66.42.61.4:35788] [client 66.42.61.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.42.61.4, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXNC6CeMzKRnyYLMANNpBAAAAQY"]
[Fri Jan 23 17:44:11.754236 2026] [:error] [pid 62368:tid 62385] [client 66.42.61.4:35788] [client 66.42.61.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.42.61.4, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXNC6yeMzKRnyYLMANNpBwAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Fri Jan 23 17:46:16.511161 2026] [:error] [pid 11607:tid 11653] [client 103.28.36.205:45736] [client 103.28.36.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.28.36.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXNDaAucTAUsUUzKw5fvFgAAAEk"]
[Fri Jan 23 17:56:57.981165 2026] [:error] [pid 11608:tid 11695] [client 141.95.86.242:48254] [client 141.95.86.242] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.95.86.242, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXNF6b4alK6RZLlMctqnAgAAAJc"]
[Fri Jan 23 17:57:00.483393 2026] [:error] [pid 11608:tid 11696] [client 141.95.86.242:53744] [client 141.95.86.242] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.95.86.242, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXNF7L4alK6RZLlMctqnBAAAAJg"], referer: https://expressinteriors.com/wp-login.php
[Fri Jan 23 18:16:57.763583 2026] [:error] [pid 11606:tid 11618] [client 199.189.26.212:58056] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXNKmVnjAJqfHEQLcshpIwAAAAM"]
[Fri Jan 23 18:23:15.457316 2026] [:error] [pid 11608:tid 11694] [client 103.195.238.44:35254] [client 103.195.238.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.195.238.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXNME74alK6RZLlMctqs_wAAAJY"]
[Fri Jan 23 18:23:18.732046 2026] [:error] [pid 11608:tid 11692] [client 103.195.238.44:35254] [client 103.195.238.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.195.238.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXNMFr4alK6RZLlMctqtAQAAAJQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Jan 23 19:00:57.775441 2026] [:error] [pid 62368:tid 62395] [client 199.189.26.212:58219] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXNU6SeMzKRnyYLMANN8jwAAARg"]
[Fri Jan 23 19:13:59.566567 2026] [:error] [pid 11606:tid 11630] [client 209.42.21.53:35246] [client 209.42.21.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.42.21.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXNX91njAJqfHEQLcshzxQAAAA8"]
[Fri Jan 23 19:26:08.090983 2026] [:error] [pid 64912:tid 64927] [client 103.178.231.51:47320] [client 103.178.231.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.178.231.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXNa0Lem6jVGKqodwtLrEQAAAY0"]
[Fri Jan 23 19:26:12.732658 2026] [:error] [pid 64912:tid 64930] [client 103.178.231.51:47320] [client 103.178.231.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.178.231.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXNa1Lem6jVGKqodwtLrFQAAAZA"], referer: https://expressinteriors.com/wp-login.php
[Fri Jan 23 19:26:28.284450 2026] [:error] [pid 1517:tid 1535] [client 160.16.58.191:54984] [client 160.16.58.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.16.58.191, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXNa5CZNw8-8ydKHCJtpPgAAAc8"]
[Fri Jan 23 19:44:59.226497 2026] [:error] [pid 11606:tid 11635] [client 199.189.26.212:58269] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXNfO1njAJqfHEQLcsh4fQAAABQ"]
[Fri Jan 23 20:02:41.296499 2026] [:error] [pid 11608:tid 11689] [client 20.253.155.235:16162] [client 20.253.155.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.253.155.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXNjYb4alK6RZLlMctrCHgAAAJE"]
[Fri Jan 23 20:27:19.629561 2026] [:error] [pid 11732:tid 11754] [client 37.99.49.174:36828] [client 37.99.49.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.99.49.174, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXNpJ-fd54xxq04JKuN9YwAAANQ"]
[Fri Jan 23 20:27:21.679809 2026] [:error] [pid 11732:tid 11751] [client 103.77.136.67:50738] [client 103.77.136.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.77.136.67, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXNpKefd54xxq04JKuN9ZgAAANE"]
[Fri Jan 23 20:27:34.157133 2026] [:error] [pid 64912:tid 64922] [client 179.101.170.79:54142] [client 179.101.170.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.101.170.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXNpNrem6jVGKqodwtL3iQAAAYg"]
[Fri Jan 23 20:28:13.423684 2026] [:error] [pid 62368:tid 62378] [client 199.189.26.212:58074] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXNpXSeMzKRnyYLMANOQIwAAAQc"]
[Fri Jan 23 20:30:46.956182 2026] [:error] [pid 11732:tid 11755] [client 37.99.49.174:19698] [client 37.99.49.174] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXNp9ufd54xxq04JKuN-mgAAANU"]
[Fri Jan 23 20:32:03.068296 2026] [:error] [pid 62368:tid 62372] [client 37.99.49.174:57400] [client 37.99.49.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.99.49.174, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXNqQyeMzKRnyYLMANOQ6QAAAQE"]
[Fri Jan 23 20:33:24.292892 2026] [:error] [pid 11606:tid 11627] [client 37.99.49.174:32807] [client 37.99.49.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.99.49.174, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXNqlFnjAJqfHEQLcsiB8gAAAAw"]
[Fri Jan 23 20:34:34.356563 2026] [:error] [pid 11607:tid 11655] [client 37.99.49.174:5217] [client 37.99.49.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.99.49.174, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXNq2gucTAUsUUzKw5cOegAAAEs"]
[Fri Jan 23 20:35:48.177720 2026] [:error] [pid 11606:tid 11633] [client 37.99.49.174:6526] [client 37.99.49.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.99.49.174, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXNrJFnjAJqfHEQLcsiCYwAAABI"]
[Fri Jan 23 20:53:10.774989 2026] [:error] [pid 11608:tid 11686] [client 179.101.170.79:54826] [client 179.101.170.79] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXNvNr4alK6RZLlMctrNugAAAI4"]
[Fri Jan 23 20:54:52.001700 2026] [:error] [pid 64230:tid 64236] [client 179.101.170.79:56306] [client 179.101.170.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.101.170.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXNvnK2JXmVjD91caKLFSwAAAUM"]
[Fri Jan 23 20:56:20.906123 2026] [:error] [pid 11606:tid 11632] [client 179.101.170.79:57736] [client 179.101.170.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.101.170.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXNv9FnjAJqfHEQLcsiGwQAAABE"]
[Fri Jan 23 20:57:46.115472 2026] [:error] [pid 11606:tid 11620] [client 179.101.170.79:59108] [client 179.101.170.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.101.170.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXNwSlnjAJqfHEQLcsiHBQAAAAU"]
[Fri Jan 23 20:59:09.466697 2026] [:error] [pid 11607:tid 11650] [client 179.101.170.79:60345] [client 179.101.170.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.101.170.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXNwnQucTAUsUUzKw5cTSwAAAEY"]
[Fri Jan 23 21:02:11.459639 2026] [:error] [pid 64912:tid 64937] [client 175.100.42.35:48210] [client 175.100.42.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 175.100.42.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXNxU7em6jVGKqodwtL_JQAAAZc"]
[Fri Jan 23 21:02:13.585940 2026] [:error] [pid 64912:tid 64914] [client 175.100.42.35:48210] [client 175.100.42.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 175.100.42.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXNxVbem6jVGKqodwtL_JgAAAYA"], referer: https://expressinteriors.com/wp-login.php
[Fri Jan 23 21:09:14.168235 2026] [:error] [pid 1517:tid 1540] [client 199.189.26.212:58599] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXNy-iZNw8-8ydKHCJuI_QAAAdQ"]
[Fri Jan 23 21:23:03.953722 2026] [:error] [pid 11606:tid 11622] [client 103.82.92.35:33614] [client 103.82.92.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.82.92.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXN2N1njAJqfHEQLcsiLhwAAAAc"]
[Fri Jan 23 21:35:11.726979 2026] [:error] [pid 64230:tid 64255] [client 68.178.173.202:52804] [client 68.178.173.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.173.202, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXN5D62JXmVjD91caKLMDAAAAVY"]
[Fri Jan 23 21:42:41.722136 2026] [:error] [pid 11606:tid 11628] [client 172.245.102.74:50427] [client 172.245.102.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.74, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXN60VnjAJqfHEQLcsiPmwAAAA0"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 21:42:44.361445 2026] [:error] [pid 11606:tid 11622] [client 172.245.102.74:50427] [client 172.245.102.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.74, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXN61FnjAJqfHEQLcsiPoAAAAAc"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 21:42:46.905474 2026] [:error] [pid 1517:tid 1533] [client 37.140.223.151:39811] [client 37.140.223.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXN61iZNw8-8ydKHCJuUAQAAAc0"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 21:42:49.088339 2026] [:error] [pid 1517:tid 1531] [client 37.140.223.151:39811] [client 37.140.223.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXN62SZNw8-8ydKHCJuUCQAAAcs"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 21:43:07.223773 2026] [:error] [pid 1517:tid 1521] [client 37.140.223.155:25563] [client 37.140.223.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.155, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXN66yZNw8-8ydKHCJuUJQAAAcE"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 21:43:09.472069 2026] [:error] [pid 1517:tid 1522] [client 37.140.223.155:25563] [client 37.140.223.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.155, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXN67SZNw8-8ydKHCJuUKQAAAcI"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 21:43:17.587106 2026] [:error] [pid 64230:tid 64238] [client 136.144.33.223:46589] [client 136.144.33.223] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.223, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXN69a2JXmVjD91caKLOmAAAAUU"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 21:43:39.011671 2026] [:error] [pid 1517:tid 1532] [client 37.140.223.110:60547] [client 37.140.223.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.110, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXN7CyZNw8-8ydKHCJuUVAAAAcw"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 21:44:26.162159 2026] [:error] [pid 62368:tid 62386] [client 136.144.33.227:50887] [client 136.144.33.227] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.227, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXN7OieMzKRnyYLMANOhNAAAAQ8"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 21:44:47.449867 2026] [:error] [pid 62368:tid 62382] [client 37.140.223.135:31821] [client 37.140.223.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXN7TyeMzKRnyYLMANOhTgAAAQs"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 21:44:49.649021 2026] [:error] [pid 62368:tid 62383] [client 37.140.223.135:31821] [client 37.140.223.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXN7USeMzKRnyYLMANOhVAAAAQw"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 21:45:16.234467 2026] [:error] [pid 64912:tid 64933] [client 37.140.223.144:28783] [client 37.140.223.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXN7bLem6jVGKqodwtIHlAAAAZM"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 21:45:18.475684 2026] [:error] [pid 64912:tid 64930] [client 37.140.223.144:28783] [client 37.140.223.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXN7brem6jVGKqodwtIHmAAAAZA"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 21:45:43.344059 2026] [:error] [pid 64912:tid 64915] [client 37.140.223.141:61357] [client 37.140.223.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.141, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXN7h7em6jVGKqodwtIHtgAAAYE"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 21:45:45.519615 2026] [:error] [pid 64912:tid 64932] [client 37.140.223.141:61357] [client 37.140.223.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.141, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXN7ibem6jVGKqodwtIHuwAAAZI"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 21:45:57.300664 2026] [:error] [pid 64230:tid 64244] [client 37.140.223.129:34183] [client 37.140.223.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.129, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXN7la2JXmVjD91caKLO-QAAAUs"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 21:47:18.923942 2026] [:error] [pid 11732:tid 11754] [client 136.144.33.246:27667] [client 136.144.33.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.246, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXN75ufd54xxq04JKuOSnAAAANQ"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 21:47:21.188217 2026] [:error] [pid 11732:tid 11740] [client 136.144.33.246:27667] [client 136.144.33.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.246, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXN76efd54xxq04JKuOSoQAAAMY"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 21:47:36.937951 2026] [:error] [pid 11732:tid 11745] [client 37.140.223.144:38261] [client 37.140.223.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXN7-Ofd54xxq04JKuOSswAAAMs"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 21:47:39.091619 2026] [:error] [pid 11732:tid 11755] [client 37.140.223.144:38261] [client 37.140.223.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXN7--fd54xxq04JKuOSuQAAANU"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 21:52:32.413639 2026] [:error] [pid 11606:tid 11621] [client 199.189.26.212:58221] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXN9IFnjAJqfHEQLcsiRGQAAAAY"]
[Fri Jan 23 22:08:50.468496 2026] [:error] [pid 1517:tid 1539] [client 68.178.173.202:53140] [client 68.178.173.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.173.202, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXOA8iZNw8-8ydKHCJua_QAAAdM"]
[Fri Jan 23 22:16:50.255088 2026] [:error] [pid 1517:tid 1538] [client 148.66.155.82:41086] [client 148.66.155.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.66.155.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXOC0iZNw8-8ydKHCJuc1wAAAdI"]
[Fri Jan 23 22:18:10.517942 2026] [:error] [pid 64912:tid 64931] [client 167.99.215.209:50618] [client 167.99.215.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.99.215.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXODIrem6jVGKqodwtINWQAAAZE"]
[Fri Jan 23 22:18:13.946497 2026] [:error] [pid 64912:tid 64932] [client 167.99.215.209:50618] [client 167.99.215.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.99.215.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXODJbem6jVGKqodwtINZAAAAZI"], referer: https://expressinteriors.com/wp-login.php
[Fri Jan 23 22:19:18.691219 2026] [:error] [pid 11606:tid 11640] [client 43.130.57.76:42604] [client 43.130.57.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXODZlnjAJqfHEQLcsiVGAAAABg"]
[Fri Jan 23 22:35:47.246722 2026] [:error] [pid 11608:tid 11683] [client 199.189.26.212:58102] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXOHQ74alK6RZLlMctriDQAAAIs"]
[Fri Jan 23 23:19:06.988793 2026] [:error] [pid 11732:tid 11734] [client 199.189.26.212:57936] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXORaufd54xxq04JKuOl8gAAAMA"]
[Fri Jan 23 23:25:06.471595 2026] [:error] [pid 1517:tid 1523] [client 165.154.238.92:63279] [client 165.154.238.92] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php~"] [unique_id "aXOS0iZNw8-8ydKHCJuvqQAAAcM"]
[Fri Jan 23 23:26:46.344376 2026] [:error] [pid 11607:tid 11661] [client 160.16.58.191:55048] [client 160.16.58.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.16.58.191, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXOTNgucTAUsUUzKw5crrAAAAFA"]
[Fri Jan 23 23:39:06.909450 2026] [:error] [pid 11608:tid 11676] [client 178.128.201.28:40918] [client 178.128.201.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.128.201.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXOWGr4alK6RZLlMctrs0gAAAIQ"]
[Fri Jan 23 23:52:51.216939 2026] [:error] [pid 62368:tid 62371] [client 37.140.223.145:45541] [client 37.140.223.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.145, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXOZUyeMzKRnyYLMANO52AAAAQA"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 23:52:53.503372 2026] [:error] [pid 62368:tid 62380] [client 37.140.223.145:45541] [client 37.140.223.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.145, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXOZVSeMzKRnyYLMANO52wAAAQk"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 23:53:18.469505 2026] [:error] [pid 64912:tid 64932] [client 37.140.223.159:54185] [client 37.140.223.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.159, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXOZbrem6jVGKqodwtIbhgAAAZI"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 23:53:41.068104 2026] [:error] [pid 11732:tid 11749] [client 37.140.223.115:57235] [client 37.140.223.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.115, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXOZhefd54xxq04JKuOuIAAAAM8"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 23:53:43.326227 2026] [:error] [pid 11732:tid 11742] [client 37.140.223.115:57235] [client 37.140.223.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.115, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXOZh-fd54xxq04JKuOuKgAAAMg"], referer: https://expressinteriors.com/wp-admin/
[Fri Jan 23 23:59:09.099089 2026] [:error] [pid 11608:tid 11683] [client 162.19.58.173:57276] [client 162.19.58.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.19.58.173, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXOazb4alK6RZLlMctrwtwAAAIs"]
[Fri Jan 23 23:59:11.498591 2026] [:error] [pid 11608:tid 11690] [client 162.19.58.173:58198] [client 162.19.58.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.19.58.173, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXOaz74alK6RZLlMctrwugAAAJI"], referer: https://expressinteriors.com/wp-login.php
[Sat Jan 24 00:02:36.070335 2026] [:error] [pid 62368:tid 62379] [client 199.189.26.212:57760] [client 199.189.26.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.189.26.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXObnCeMzKRnyYLMANO8AwAAAQg"]
[Sat Jan 24 00:03:37.071170 2026] [:error] [pid 11606:tid 11630] [client 95.216.30.38:46862] [client 95.216.30.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.216.30.38, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXOb2VnjAJqfHEQLcsil0AAAAA8"]
[Sat Jan 24 00:33:28.545674 2026] [:error] [pid 1517:tid 1544] [client 45.32.103.99:50418] [client 45.32.103.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.32.103.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXOi2CZNw8-8ydKHCJvGAwAAAdg"]
[Sat Jan 24 00:33:29.654320 2026] [:error] [pid 1517:tid 1523] [client 45.32.103.99:50418] [client 45.32.103.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.32.103.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXOi2SZNw8-8ydKHCJvGBwAAAcM"], referer: https://expressinteriors.com/wp-login.php
[Sat Jan 24 00:43:48.551511 2026] [:error] [pid 11606:tid 11628] [client 43.130.14.245:32932] [client 43.130.14.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXOlRFnjAJqfHEQLcsisswAAAA0"]
[Sat Jan 24 00:54:05.396467 2026] [:error] [pid 11607:tid 11650] [client 188.166.238.215:42858] [client 188.166.238.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.166.238.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXOnrQucTAUsUUzKw5c6hQAAAEY"]
[Sat Jan 24 00:54:06.756175 2026] [:error] [pid 11607:tid 11669] [client 188.166.238.215:42858] [client 188.166.238.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.166.238.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXOnrgucTAUsUUzKw5c6hwAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Sat Jan 24 01:04:25.408430 2026] [:error] [pid 11732:tid 11740] [client 116.202.145.93:40832] [client 116.202.145.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.202.145.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXOqGefd54xxq04JKuO_twAAAMY"]
[Sat Jan 24 01:04:27.646485 2026] [:error] [pid 11606:tid 11632] [client 116.202.145.93:40834] [client 116.202.145.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.202.145.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXOqG1njAJqfHEQLcsiwqgAAABE"], referer: https://expressinteriors.com/wp-login.php
[Sat Jan 24 01:08:16.427018 2026] [:error] [pid 64230:tid 64239] [client 182.16.245.210:48384] [client 182.16.245.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.16.245.210, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXOrAK2JXmVjD91caKLw-wAAAUY"]
[Sat Jan 24 01:19:01.606116 2026] [:error] [pid 11732:tid 11746] [client 116.202.145.93:53538] [client 116.202.145.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.202.145.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXOthefd54xxq04JKuPDtQAAAMw"]
[Sat Jan 24 02:11:32.309480 2026] [:error] [pid 1517:tid 1530] [client 69.163.181.218:35788] [client 69.163.181.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.163.181.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXO51CZNw8-8ydKHCJvliAAAAco"]
[Sat Jan 24 02:11:37.013372 2026] [:error] [pid 1517:tid 1534] [client 69.163.181.218:35788] [client 69.163.181.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.163.181.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXO52SZNw8-8ydKHCJvljQAAAc4"], referer: https://expressinteriors.com/wp-login.php
[Sat Jan 24 02:23:49.296311 2026] [:error] [pid 62368:tid 62381] [client 162.243.244.193:28132] [client 162.243.244.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.243.244.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXO8tSeMzKRnyYLMANPdjQAAAQo"]
[Sat Jan 24 02:23:50.722894 2026] [:error] [pid 62368:tid 62393] [client 162.243.244.193:28132] [client 162.243.244.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.243.244.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXO8tieMzKRnyYLMANPdkAAAARY"], referer: https://expressinteriors.com/wp-login.php
[Sat Jan 24 02:49:21.505112 2026] [:error] [pid 64912:tid 64925] [client 103.159.85.179:55282] [client 103.159.85.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.159.85.179, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXPCsbem6jVGKqodwtI9zwAAAYs"]
[Sat Jan 24 03:05:21.756768 2026] [:error] [pid 11732:tid 11758] [client 147.182.230.12:35440] [client 147.182.230.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.230.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXPGcefd54xxq04JKuPcpAAAANg"]
[Sat Jan 24 03:17:38.739811 2026] [:error] [pid 10247:tid 10299] [client 178.128.201.28:44208] [client 178.128.201.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.128.201.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXPJUqg6eSOqtnZvXl0mfAAAAFY"]
[Sat Jan 24 04:28:38.066670 2026] [:error] [pid 40902:tid 40931] [client 103.20.96.93:47112] [client 103.20.96.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.20.96.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXPZ9gSCceZpurDgOev0vgAAABM"]
[Sat Jan 24 05:00:04.989071 2026] [:error] [pid 41009:tid 41024] [client 103.143.10.5:54180] [client 103.143.10.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.143.10.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXPhVGrewfoFUDD3TM1fJAAAAM0"]
[Sat Jan 24 05:25:04.789832 2026] [:error] [pid 41009:tid 41011] [client 41.73.194.134:36508] [client 41.73.194.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.73.194.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXPnMGrewfoFUDD3TM1miwAAAMA"]
[Sat Jan 24 05:25:06.481005 2026] [:error] [pid 41009:tid 41015] [client 41.73.194.134:36508] [client 41.73.194.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.73.194.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXPnMmrewfoFUDD3TM1mkQAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Jan 24 05:48:07.581864 2026] [:error] [pid 41009:tid 41027] [client 182.40.104.255:52130] [client 182.40.104.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXPsl2rewfoFUDD3TM1tmwAAANA"]
[Sat Jan 24 06:25:53.573081 2026] [:error] [pid 41009:tid 41021] [client 41.73.194.134:41676] [client 41.73.194.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.73.194.134, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXP1cWrewfoFUDD3TM16SAAAAMo"]
[Sat Jan 24 06:53:17.970232 2026] [:error] [pid 40903:tid 40960] [client 148.113.16.174:45050] [client 148.113.16.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.16.174, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXP73Rxw3xvyqXTcGl_InwAAAFU"]
[Sat Jan 24 07:02:18.047626 2026] [:error] [pid 41009:tid 41019] [client 148.113.16.174:42962] [client 148.113.16.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.16.174, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXP9-mrewfoFUDD3TM2KJQAAAMg"]
[Sat Jan 24 07:11:37.430712 2026] [:error] [pid 40905:tid 40978] [client 103.75.185.38:22767] [client 103.75.185.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.75.185.38, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXQAKV3rUAneNkh7mXAPwgAAAIw"]
[Sat Jan 24 07:21:12.139223 2026] [:error] [pid 41009:tid 41016] [client 147.182.230.12:56376] [client 147.182.230.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.230.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXQCaGrewfoFUDD3TM2RaAAAAMU"]
[Sat Jan 24 08:41:28.420791 2026] [:error] [pid 41009:tid 41018] [client 161.248.188.29:46090] [client 161.248.188.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.248.188.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXQVOGrewfoFUDD3TM21awAAAMc"]
[Sat Jan 24 08:46:20.009784 2026] [:error] [pid 40905:tid 40968] [client 170.205.31.138:60167] [client 170.205.31.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-confiq.php"] [unique_id "aXQWXF3rUAneNkh7mXAqUAAAAII"]
[Sat Jan 24 11:45:34.163338 2026] [:error] [pid 22900:tid 22903] [client 43.166.1.243:54204] [client 43.166.1.243] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXRAXlr6h1PpdlYV7gWYTAAAAQA"]
[Sat Jan 24 11:50:35.519758 2026] [:error] [pid 40903:tid 40956] [client 106.119.167.146:38469] [client 106.119.167.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXRBixxw3xvyqXTcGl8kEwAAAFE"]
[Sat Jan 24 12:13:38.839681 2026] [:error] [pid 40903:tid 40940] [client 167.86.70.33:39778] [client 167.86.70.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.86.70.33, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXRG8hxw3xvyqXTcGl8rmAAAAEE"]
[Sat Jan 24 12:13:40.809904 2026] [:error] [pid 40903:tid 40952] [client 167.86.70.33:45350] [client 167.86.70.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.86.70.33, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXRG9Bxw3xvyqXTcGl8roAAAAE0"], referer: https://expressinteriors.com/wp-login.php
[Sat Jan 24 17:18:21.474089 2026] [:error] [pid 41009:tid 41024] [client 213.32.29.234:38343] [client 213.32.29.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.32.29.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXSOXWrewfoFUDD3TM1z1QAAAM0"]
[Sat Jan 24 18:42:31.740946 2026] [:error] [pid 41009:tid 41023] [client 213.55.96.153:36256] [client 213.55.96.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.55.96.153, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXSiF2rewfoFUDD3TM2Q2wAAAMw"]
[Sat Jan 24 18:54:36.065498 2026] [:error] [pid 22900:tid 22911] [client 205.196.217.56:42958] [client 205.196.217.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 205.196.217.56, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXSk7Fr6h1PpdlYV7gX2NgAAAQg"]
[Sat Jan 24 18:54:45.862117 2026] [:error] [pid 40905:tid 40977] [client 205.196.217.56:47124] [client 205.196.217.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 205.196.217.56, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXSk9V3rUAneNkh7mXC5PwAAAIs"], referer: https://expressinteriors.com/wp-login.php
[Sat Jan 24 22:39:10.869517 2026] [:error] [pid 22900:tid 22906] [client 188.165.54.22:37166] [client 188.165.54.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.165.54.22, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXTZjlr6h1PpdlYV7gUZ9QAAAQM"]
[Sat Jan 24 23:12:44.843791 2026] [:error] [pid 22900:tid 22909] [client 103.124.95.33:40208] [client 103.124.95.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.124.95.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXThbFr6h1PpdlYV7gUfowAAAQY"]
[Sat Jan 24 23:40:45.073517 2026] [:error] [pid 40903:tid 40960] [client 185.15.78.201:37288] [client 185.15.78.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.15.78.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXTn_Rxw3xvyqXTcGl_LyAAAAFU"]
[Sat Jan 24 23:40:47.877161 2026] [:error] [pid 41009:tid 41029] [client 185.15.78.201:44712] [client 185.15.78.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.15.78.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXTn_2rewfoFUDD3TM3nWQAAANI"], referer: https://expressinteriors.com/wp-login.php
[Sat Jan 24 23:46:13.770230 2026] [:error] [pid 14976:tid 14983] [client 51.195.219.160:40744] [client 51.195.219.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.195.219.160, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXTpRWvdigydYOB2KS-SKQAAAYU"]
[Sat Jan 24 23:56:55.530919 2026] [:error] [pid 14976:tid 15001] [client 188.165.54.22:36022] [client 188.165.54.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.165.54.22, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXTrx2vdigydYOB2KS-U2QAAAZc"]
[Sun Jan 25 00:19:09.536810 2026] [:error] [pid 60761:tid 60788] [client 172.93.108.60:55874] [client 172.93.108.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.93.108.60, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXTw_VZQvxLvEbXXh9KZMgAAAVg"]
[Sun Jan 25 00:30:31.815008 2026] [:error] [pid 14976:tid 15000] [client 188.165.54.22:37928] [client 188.165.54.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.165.54.22, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXTzp2vdigydYOB2KS-dWgAAAZY"]
[Sun Jan 25 00:47:53.906800 2026] [:error] [pid 41009:tid 41035] [client 49.51.33.159:52222] [client 49.51.33.159] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXT3uWrewfoFUDD3TM38SQAAANg"]
[Sun Jan 25 00:57:05.621918 2026] [:error] [pid 40905:tid 40968] [client 64.89.163.25:58766] [client 64.89.163.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXT54V3rUAneNkh7mXDzGAAAAII"]
[Sun Jan 25 00:57:06.259098 2026] [:error] [pid 22900:tid 22904] [client 64.89.163.25:59007] [client 64.89.163.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXT54lr6h1PpdlYV7gUxlQAAAQE"]
[Sun Jan 25 00:57:06.895921 2026] [:error] [pid 60761:tid 60769] [client 64.89.163.25:59221] [client 64.89.163.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXT54lZQvxLvEbXXh9KgkAAAAUU"]
[Sun Jan 25 00:57:07.534453 2026] [:error] [pid 40902:tid 40918] [client 64.89.163.25:59467] [client 64.89.163.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXT54wSCceZpurDgOese1QAAAAY"]
[Sun Jan 25 00:57:08.172481 2026] [:error] [pid 60761:tid 60779] [client 64.89.163.25:59670] [client 64.89.163.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXT55FZQvxLvEbXXh9KgvgAAAU8"]
[Sun Jan 25 01:16:14.408127 2026] [:error] [pid 40902:tid 40917] [client 91.121.34.215:33528] [client 91.121.34.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.121.34.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXT-XgSCceZpurDgOesiqAAAAAU"]
[Sun Jan 25 03:10:57.831850 2026] [:error] [pid 44775:tid 44799] [client 194.63.239.143:46740] [client 194.63.239.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.63.239.143, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXUZQTR2_t4RY-opLXsMNAAAANU"]
[Sun Jan 25 03:10:58.625142 2026] [:error] [pid 44775:tid 44799] [client 194.63.239.143:46740] [client 194.63.239.143] ModSecurity: Audit log: Failed to lock global mutex: Invalid argument [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXUZQTR2_t4RY-opLXsMNAAAANU"]
[Sun Jan 25 03:10:58.625357 2026] [:error] [pid 44775:tid 44799] [client 194.63.239.143:46740] [client 194.63.239.143] ModSecurity: Audit log: Failed to unlock global mutex: Invalid argument [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXUZQTR2_t4RY-opLXsMNAAAANU"]
[Sun Jan 25 03:11:02.799104 2026] [:error] [pid 44933:tid 44953] [client 194.63.239.143:58666] [client 194.63.239.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.63.239.143, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXUZRh0DKFBROhmad80iuwAAAE8"], referer: https://expressinteriors.com/wp-login.php
[Sun Jan 25 03:44:42.004144 2026] [:error] [pid 53420:tid 53468] [client 173.236.142.111:56098] [client 173.236.142.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.236.142.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXUhKo5y-t2ZKNqnnbVVzAAAAEw"]
[Sun Jan 25 04:30:58.366456 2026] [:error] [pid 33687:tid 33693] [client 113.160.224.208:43844] [client 113.160.224.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 113.160.224.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXUsAoc6VUyZP5DZSy57owAAAQM"]
[Sun Jan 25 05:45:20.705253 2026] [:error] [pid 53421:tid 53483] [client 194.63.239.143:42656] [client 194.63.239.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.63.239.143, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXU9cJKP_6Rogdk6hdGlIQAAAIA"]
[Sun Jan 25 07:54:30.304956 2026] [:error] [pid 53521:tid 53557] [client 213.55.96.153:52950] [client 213.55.96.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.55.96.153, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXVbtkAzLL1HphkAdX6hLgAAANg"]
[Sun Jan 25 08:51:38.869314 2026] [:error] [pid 33687:tid 33713] [client 43.130.228.73:52028] [client 43.130.228.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXVpGoc6VUyZP5DZSy7sqwAAARc"]
[Sun Jan 25 10:37:24.091067 2026] [:error] [pid 53421:tid 53504] [client 103.77.106.81:59879] [client 103.77.106.81] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aXWB5JKP_6Rogdk6hdELTwAAAJU"]
[Sun Jan 25 10:37:24.461966 2026] [:error] [pid 53421:tid 53495] [client 103.77.106.81:60344] [client 103.77.106.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aXWB5JKP_6Rogdk6hdELUQAAAIw"]
[Sun Jan 25 11:03:47.936791 2026] [:error] [pid 9122:tid 9127] [client 78.142.63.28:43212] [client 78.142.63.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.142.63.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXWIE2gJ3AtoqtQp2gR4dQAAAYM"]
[Sun Jan 25 11:26:39.538911 2026] [:error] [pid 53420:tid 53472] [client 78.142.63.28:59728] [client 78.142.63.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.142.63.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXWNb45y-t2ZKNqnnbXN5QAAAFA"]
[Sun Jan 25 12:34:33.581314 2026] [:error] [pid 33687:tid 33702] [client 103.179.56.102:51242] [client 103.179.56.102] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "aXWdWYc6VUyZP5DZSy47DAAAAQw"]
[Sun Jan 25 16:16:49.680033 2026] [:error] [pid 53421:tid 53496] [client 170.106.82.209:35652] [client 170.106.82.209] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXXRcZKP_6Rogdk6hdFecgAAAI0"]
[Sun Jan 25 16:20:26.204818 2026] [:error] [pid 9070:tid 9094] [client 217.217.248.79:52416] [client 217.217.248.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.217.248.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXXSSrLNl7Vxe1mYetEw8wAAAVY"]
[Sun Jan 25 19:20:06.122720 2026] [:error] [pid 9070:tid 9094] [client 114.80.36.40:53220] [client 114.80.36.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXX8ZrLNl7Vxe1mYetFdVgAAAVY"]
[Sun Jan 25 19:45:35.724771 2026] [:error] [pid 33847:tid 33871] [client 103.179.56.102:48094] [client 103.179.56.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.179.56.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXYCXxb-MBjjiRpV5ScsrgAAAdM"]
[Sun Jan 25 19:45:49.640152 2026] [:error] [pid 53521:tid 53535] [client 103.179.56.102:56684] [client 103.179.56.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.179.56.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXYCbUAzLL1HphkAdX5EmAAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Sun Jan 25 19:59:07.430777 2026] [:error] [pid 9122:tid 9141] [client 43.131.36.84:53630] [client 43.131.36.84] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXYFi2gJ3AtoqtQp2gQ4xQAAAZE"]
[Mon Jan 26 00:40:52.194317 2026] [:error] [pid 48920:tid 49000] [client 171.33.105.206:37628] [client 171.33.105.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 171.33.105.206, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXZHlJsnZS3G6U7VdJMHAQAAARA"], referer: https://cdbdinteriors.com.au/wp-login.php?action=register
[Mon Jan 26 00:52:17.080990 2026] [:error] [pid 48920:tid 49000] [client 103.196.9.20:2224] [client 103.196.9.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.196.9.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/https%3A/expressinteriors.com/xmlrpc.php%3Frsd"] [unique_id "aXZKQZsnZS3G6U7VdJMOnQAAARA"]
[Mon Jan 26 01:00:47.667238 2026] [:error] [pid 49084:tid 49096] [client 91.208.207.105:44832] [client 91.208.207.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.208.207.105, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXZMP5HUOXll3XccoO4aQgAAAUo"], referer: https://www.cdbdinteriors.com.au/wp-login.php?action=register
[Mon Jan 26 01:03:09.522274 2026] [:error] [pid 48918:tid 48932] [client 104.252.191.99:24256] [client 104.252.191.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.252.191.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/https%3A/expressinteriors.com/xmlrpc.php%3Frsd"] [unique_id "aXZMzbFdNV6RkULOt6EmVQAAAIQ"]
[Mon Jan 26 01:14:42.757057 2026] [:error] [pid 6738:tid 6769] [client 104.252.191.226:9544] [client 104.252.191.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.252.191.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/https%3A/expressinteriors.com/xmlrpc.php%3Frsd"] [unique_id "aXZPgmxKUXbdUVtnLFZn3gAAAEc"]
[Mon Jan 26 01:56:16.415029 2026] [:error] [pid 13569:tid 13617] [client 104.209.173.99:35436] [client 104.209.173.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXZZQPjY_vt91DmOz5XR4AAAAYU"]
[Mon Jan 26 04:23:22.863046 2026] [:error] [pid 24557:tid 24614] [client 198.71.229.124:50552] [client 198.71.229.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.71.229.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXZ7uurlG7Vm9pxV14xFfwAAAFQ"]
[Mon Jan 26 04:23:46.078297 2026] [:error] [pid 24556:tid 24570] [client 66.96.183.202:58374] [client 66.96.183.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.96.183.202, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXZ70kyDW1_EbgDa3XJIeAAAAAU"]
[Mon Jan 26 04:23:49.697290 2026] [:error] [pid 24666:tid 24681] [client 103.131.74.10:64861] [client 103.131.74.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.131.74.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXZ71ZmH-L0_jbK3i9EBsgAAAM0"]
[Mon Jan 26 04:23:54.397373 2026] [:error] [pid 24666:tid 24671] [client 103.163.138.23:52548] [client 103.163.138.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.163.138.23, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXZ72pmH-L0_jbK3i9EBxgAAAMM"]
[Mon Jan 26 04:30:15.467957 2026] [:error] [pid 61287:tid 61323] [client 159.203.3.128:64988] [client 159.203.3.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXZ9V9imZOwAM64CfR5eLgAAAYY"]
[Mon Jan 26 04:30:15.904394 2026] [:error] [pid 61252:tid 61272] [client 159.203.3.128:65157] [client 159.203.3.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXZ9V7rGlf8FG2etxUCqpwAAARI"]
[Mon Jan 26 04:30:16.340774 2026] [:error] [pid 61287:tid 61334] [client 159.203.3.128:65350] [client 159.203.3.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aXZ9WNimZOwAM64CfR5eSAAAAZE"]
[Mon Jan 26 04:54:42.013925 2026] [:error] [pid 24666:tid 24676] [client 185.176.40.157:60860] [client 185.176.40.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.176.40.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXaDEpmH-L0_jbK3i9EI1AAAAMg"]
[Mon Jan 26 05:36:52.157307 2026] [:error] [pid 24556:tid 24579] [client 220.158.233.198:62162] [client 220.158.233.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.158.233.198, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXaM9EyDW1_EbgDa3XJVIwAAAA4"]
[Mon Jan 26 08:26:38.736442 2026] [:error] [pid 24556:tid 24574] [client 148.72.107.156:49712] [client 148.72.107.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.107.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXa0vkyDW1_EbgDa3XJ6JAAAAAk"]
[Mon Jan 26 08:26:50.862608 2026] [:error] [pid 61287:tid 61325] [client 198.12.236.94:45106] [client 198.12.236.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.12.236.94, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXa0ytimZOwAM64CfR6tNgAAAYg"]
[Mon Jan 26 08:26:58.549696 2026] [:error] [pid 24558:tid 24621] [client 198.12.236.94:51028] [client 198.12.236.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.12.236.94, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXa00go1PXqeJqIMTQYeOwAAAIA"]
[Mon Jan 26 08:27:20.887111 2026] [:error] [pid 61286:tid 61293] [client 46.101.218.201:57607] [client 46.101.218.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.101.218.201, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXa06MnVt687wYGMPn-FTQAAAUM"]
[Mon Jan 26 08:27:32.893868 2026] [:error] [pid 61287:tid 61331] [client 148.72.18.34:34500] [client 148.72.18.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.72.18.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXa09NimZOwAM64CfR6tcAAAAY4"]
[Mon Jan 26 08:27:50.508899 2026] [:error] [pid 61287:tid 61330] [client 66.96.183.201:38206] [client 66.96.183.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.96.183.201, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXa1BtimZOwAM64CfR6thgAAAY0"]
[Mon Jan 26 08:45:27.660683 2026] [:error] [pid 61287:tid 61325] [client 207.148.30.208:50604] [client 207.148.30.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.148.30.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXa5J9imZOwAM64CfR6z9gAAAYg"]
[Mon Jan 26 10:52:24.296446 2026] [:error] [pid 24558:tid 24625] [client 43.153.10.13:35912] [client 43.153.10.13] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXbW6Ao1PXqeJqIMTQZAfgAAAIQ"]
[Mon Jan 26 11:31:23.445699 2026] [:error] [pid 24556:tid 24573] [client 34.60.99.92:40342] [client 34.60.99.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.60.99.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXbgC0yDW1_EbgDa3XKjGwAAAAg"]
[Mon Jan 26 11:31:30.324416 2026] [:error] [pid 61286:tid 61299] [client 101.46.58.127:20156] [client 101.46.58.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 101.46.58.127, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXbgEsnVt687wYGMPn--qgAAAUk"]
[Mon Jan 26 11:58:41.609212 2026] [:error] [pid 24558:tid 24635] [client 170.64.195.135:54853] [client 170.64.195.135] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aXbmcQo1PXqeJqIMTQZRjgAAAI4"]
[Mon Jan 26 14:15:32.342618 2026] [:error] [pid 61252:tid 61264] [client 43.157.175.122:52584] [client 43.157.175.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXcGhLrGlf8FG2etxUBDdgAAAQo"]
[Mon Jan 26 16:25:02.268650 2026] [:error] [pid 24666:tid 24688] [client 51.79.147.153:46024] [client 51.79.147.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.79.147.153, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXck3pmH-L0_jbK3i9Gf9gAAANQ"]
[Mon Jan 26 16:25:11.207764 2026] [:error] [pid 24558:tid 24634] [client 92.204.18.34:38902] [client 92.204.18.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.204.18.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXck5wo1PXqeJqIMTQaELgAAAI0"]
[Mon Jan 26 16:53:44.209334 2026] [:error] [pid 61287:tid 61329] [client 13.204.110.3:58080] [client 13.204.110.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 13.204.110.3, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXcrmNimZOwAM64CfR4w1wAAAYw"]
[Mon Jan 26 16:53:44.954718 2026] [:error] [pid 61287:tid 61339] [client 13.204.110.3:58080] [client 13.204.110.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 13.204.110.3, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXcrmNimZOwAM64CfR4w2AAAAZY"], referer: https://expressinteriors.com/wp-login.php?action=register
[Mon Jan 26 16:53:53.874537 2026] [:error] [pid 24556:tid 24566] [client 18.221.196.10:50444] [client 18.221.196.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.221.196.10, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXcroUyDW1_EbgDa3XIR9gAAAAE"]
[Mon Jan 26 16:53:54.586735 2026] [:error] [pid 24556:tid 24589] [client 18.221.196.10:50444] [client 18.221.196.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.221.196.10, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXcrokyDW1_EbgDa3XIR-gAAABg"], referer: https://expressinteriors.com/wp-login.php?action=register
[Mon Jan 26 18:39:14.248027 2026] [:error] [pid 61287:tid 61322] [client 34.91.197.111:55968] [client 34.91.197.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.91.197.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXdEUtimZOwAM64CfR5GggAAAYU"]
[Mon Jan 26 18:39:17.104399 2026] [:error] [pid 61287:tid 61338] [client 34.91.197.111:55968] [client 34.91.197.111] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aXdEVdimZOwAM64CfR5GhgAAAZU"]
[Mon Jan 26 18:39:17.388479 2026] [:error] [pid 61287:tid 61336] [client 34.91.197.111:55968] [client 34.91.197.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.91.197.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXdEVdimZOwAM64CfR5GhwAAAZM"]
[Mon Jan 26 18:39:19.120351 2026] [:error] [pid 24558:tid 24635] [client 34.91.197.111:62671] [client 34.91.197.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.91.197.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXdEVwo1PXqeJqIMTQaYsgAAAI4"]
[Mon Jan 26 18:39:20.898420 2026] [:error] [pid 24556:tid 24585] [client 34.91.197.111:55081] [client 34.91.197.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.91.197.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXdEWEyDW1_EbgDa3XI1OgAAABQ"]
[Mon Jan 26 18:39:20.898615 2026] [:error] [pid 24556:tid 24585] [client 34.91.197.111:55081] [client 34.91.197.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.91.197.111, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXdEWEyDW1_EbgDa3XI1OgAAABQ"]
[Mon Jan 26 20:07:41.913177 2026] [:error] [pid 61286:tid 61314] [client 60.188.57.0:34661] [client 60.188.57.0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXdZDcnVt687wYGMPn8b6gAAAVg"]
[Mon Jan 26 20:51:52.903996 2026] [:error] [pid 24558:tid 24622] [client 143.105.233.45:25538] [client 143.105.233.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.105.233.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXdjaAo1PXqeJqIMTQawjwAAAIE"]
[Mon Jan 26 22:16:36.172191 2026] [:error] [pid 61286:tid 61314] [client 43.134.141.244:50762] [client 43.134.141.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXd3RMnVt687wYGMPn8wsgAAAVg"]
[Mon Jan 26 23:14:17.420453 2026] [:error] [pid 24666:tid 24691] [client 45.133.5.55:24561] [client 45.133.5.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.133.5.55, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXeEyZmH-L0_jbK3i9HrowAAANc"]
[Tue Jan 27 02:29:24.889139 2026] [:error] [pid 23303:tid 23312] [client 185.8.106.101:52224] [client 185.8.106.101] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.expressinteriors.com|F|2"] [data "TX:0=application/ld+json"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXeyhJ9-XqTbIalaUZyW3AAAAYc"]
[Tue Jan 27 02:40:58.863579 2026] [:error] [pid 57173:tid 57233] [client 45.133.5.82:59703] [client 45.133.5.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.133.5.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXe1Ok4W-bz8q8pfNmgtUAAAAAE"]
[Tue Jan 27 03:20:50.565475 2026] [:error] [pid 23303:tid 23324] [client 45.133.5.83:42287] [client 45.133.5.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.133.5.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXe-kp9-XqTbIalaUZymNAAAAZM"]
[Tue Jan 27 04:01:12.480368 2026] [:error] [pid 7454:tid 7537] [client 45.133.5.76:50923] [client 45.133.5.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.133.5.76, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXfICJltCoZEfMmfl8A19wAAAJU"]
[Tue Jan 27 06:47:29.807662 2026] [:error] [pid 7452:tid 7465] [client 163.5.159.216:60492] [client 163.5.159.216] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/csv"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXfvAWlXocEpHDB6FUaCFAAAAAQ"]
[Tue Jan 27 06:59:33.577270 2026] [:error] [pid 7454:tid 7522] [client 34.236.189.144:50492] [client 34.236.189.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.236.189.144, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXfx1ZltCoZEfMmfl8CIawAAAIY"]
[Tue Jan 27 06:59:34.332505 2026] [:error] [pid 7452:tid 7462] [client 34.236.189.144:50500] [client 34.236.189.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.236.189.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXfx1mlXocEpHDB6FUaGJgAAAAE"], referer: https://www.expressinteriors.com/wp-login.php?action=register
[Tue Jan 27 06:59:39.235596 2026] [:error] [pid 7561:tid 7584] [client 161.35.27.136:51202] [client 161.35.27.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.27.136, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXfx27XGI6mgvHQqkXwtSQAAANQ"]
[Tue Jan 27 06:59:40.032340 2026] [:error] [pid 41780:tid 41786] [client 161.35.27.136:60168] [client 161.35.27.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.27.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXfx3Fvu-XLQ0TaZ4FF57gAAAQQ"], referer: https://www.expressinteriors.com/wp-login.php?action=register
[Tue Jan 27 08:04:47.838264 2026] [:error] [pid 7452:tid 7472] [client 4.194.18.117:3942] [client 4.194.18.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.194.18.117, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXgBH2lXocEpHDB6FUad7wAAAAs"]
[Tue Jan 27 08:14:27.992874 2026] [:error] [pid 48446:tid 48497] [client 45.133.5.97:43113] [client 45.133.5.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.133.5.97, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXgDY8DRSaZ8F8aaLxn-IgAAAdM"]
[Tue Jan 27 09:37:33.754093 2026] [:error] [pid 48412:tid 48427] [client 165.232.76.25:36296] [client 165.232.76.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.232.76.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXgW3XbJMfAKlln88JFh7wAAAU0"]
[Tue Jan 27 10:21:12.357320 2026] [:error] [pid 48412:tid 48416] [client 43.135.140.225:49272] [client 43.135.140.225] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXghGHbJMfAKlln88JFwMQAAAUI"]
[Tue Jan 27 10:54:20.058564 2026] [:error] [pid 48412:tid 48434] [client 51.38.230.115:45010] [client 51.38.230.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.38.230.115, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXgo3HbJMfAKlln88JF5JAAAAVQ"]
[Tue Jan 27 11:02:58.524766 2026] [:error] [pid 48445:tid 48452] [client 45.133.5.85:59237] [client 45.133.5.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.133.5.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXgq4hFh_QNUhZ0HkzeNLAAAAYM"]
[Tue Jan 27 11:36:25.938246 2026] [:error] [pid 48631:tid 48643] [client 168.227.250.223:18391] [client 168.227.250.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.227.250.223, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXgyuSN5eesHzEogX0z1nQAAAko"]
[Tue Jan 27 11:42:30.234467 2026] [:error] [pid 41780:tid 41782] [client 64.225.49.30:54458] [client 64.225.49.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "aXg0Jlvu-XLQ0TaZ4FHBiQAAAQA"], referer: binance.com
[Tue Jan 27 12:13:47.528360 2026] [:error] [pid 48446:tid 48494] [client 143.244.166.58:40960] [client 143.244.166.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.244.166.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXg7e8DRSaZ8F8aaLxk8vgAAAdA"]
[Tue Jan 27 12:50:47.694531 2026] [:error] [pid 48631:tid 48656] [client 113.161.67.145:45386] [client 113.161.67.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 113.161.67.145, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXhEJyN5eesHzEogX0wEDgAAAlc"]
[Tue Jan 27 12:50:48.388155 2026] [:error] [pid 7453:tid 7509] [client 118.69.109.215:45388] [client 118.69.109.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 118.69.109.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXhEKBfsyA2ws_ADqugxdgAAAFQ"], referer: https://www.expressinteriors.com/wp-login.php?action=register
[Tue Jan 27 12:52:48.831659 2026] [:error] [pid 7561:tid 7576] [client 212.36.76.11:39104] [client 212.36.76.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.36.76.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXhEoLXGI6mgvHQqkXyU3QAAAMw"]
[Tue Jan 27 13:03:09.877981 2026] [:error] [pid 7454:tid 7523] [client 31.186.11.171:35324] [client 31.186.11.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.186.11.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXhHDZltCoZEfMmfl8DlZQAAAIc"]
[Tue Jan 27 13:03:12.783885 2026] [:error] [pid 7454:tid 7536] [client 31.186.11.171:35324] [client 31.186.11.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.186.11.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXhHEJltCoZEfMmfl8DlkwAAAJQ"], referer: https://expressinteriors.com/wp-login.php
[Tue Jan 27 13:06:24.585058 2026] [:error] [pid 48528:tid 48542] [client 152.70.179.80:51844] [client 152.70.179.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.70.179.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXhH0AOGRrquT9N7CZpDJgAAAgw"]
[Tue Jan 27 13:06:25.664567 2026] [:error] [pid 48528:tid 48537] [client 152.70.179.80:51844] [client 152.70.179.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.70.179.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXhH0QOGRrquT9N7CZpDKAAAAgc"], referer: https://expressinteriors.com/wp-login.php
[Tue Jan 27 13:31:03.963946 2026] [:error] [pid 48446:tid 48497] [client 130.51.80.27:16363] [client 130.51.80.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.51.80.27, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXhNl8DRSaZ8F8aaLxlNcgAAAdM"]
[Tue Jan 27 14:38:27.694948 2026] [:error] [pid 7561:tid 7584] [client 143.105.233.45:11861] [client 143.105.233.45] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXhdY7XGI6mgvHQqkXymhgAAANQ"]
[Tue Jan 27 14:40:19.056321 2026] [:error] [pid 7453:tid 7498] [client 143.105.233.45:9799] [client 143.105.233.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.105.233.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXhd0xfsyA2ws_ADquhPxwAAAEk"]
[Tue Jan 27 14:42:11.495070 2026] [:error] [pid 41780:tid 41797] [client 143.105.233.45:31704] [client 143.105.233.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.105.233.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXheQ1vu-XLQ0TaZ4FHhqAAAAQ8"]
[Tue Jan 27 14:42:22.581412 2026] [:error] [pid 41780:tid 41783] [client 14.215.163.132:34700] [client 14.215.163.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXheTlvu-XLQ0TaZ4FHhtQAAAQE"]
[Tue Jan 27 14:44:03.680604 2026] [:error] [pid 7453:tid 7509] [client 143.105.233.45:12800] [client 143.105.233.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.105.233.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXhesxfsyA2ws_ADquhQdAAAAFQ"]
[Tue Jan 27 14:45:51.748516 2026] [:error] [pid 7561:tid 7585] [client 143.105.233.45:33629] [client 143.105.233.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.105.233.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXhfH7XGI6mgvHQqkXynMAAAANU"]
[Tue Jan 27 14:47:35.276694 2026] [:error] [pid 48412:tid 48428] [client 143.105.233.45:16986] [client 143.105.233.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.105.233.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXhfh3bJMfAKlln88JGy-QAAAU4"]
[Tue Jan 27 14:55:36.915721 2026] [:error] [pid 7561:tid 7588] [client 74.208.49.118:56526] [client 74.208.49.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.208.49.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXhhaLXGI6mgvHQqkXyowgAAANg"]
[Tue Jan 27 15:40:33.212505 2026] [:error] [pid 48662:tid 48681] [client 167.99.48.188:60206] [client 167.99.48.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.48.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXhr8eD8iESUP9uRiRPTGAAAAo0"]
[Tue Jan 27 16:23:20.851477 2026] [:error] [pid 7453:tid 7512] [client 50.116.27.55:39156] [client 50.116.27.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.116.27.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXh1-BfsyA2ws_ADquhtWAAAAFc"]
[Tue Jan 27 17:11:05.544750 2026] [:error] [pid 48528:tid 48535] [client 82.223.49.50:58992] [client 82.223.49.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.49.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXiBKQOGRrquT9N7CZpdcQAAAgU"]
[Tue Jan 27 17:48:50.772885 2026] [:error] [pid 48631:tid 48647] [client 121.200.216.6:40188] [client 121.200.216.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.200.216.6, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXiKAiN5eesHzEogX0wucQAAAk4"]
[Tue Jan 27 18:25:31.551656 2026] [ssl:error] [pid 48528:tid 48531] [client 107.172.58.36:46518] AH02032: Hostname www.cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup, referer: http://www.cdbdinteriors.com.au/
[Tue Jan 27 18:28:52.543717 2026] [:error] [pid 48412:tid 48433] [client 104.248.33.228:47314] [client 104.248.33.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.248.33.228, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXiTZHbJMfAKlln88JHjTwAAAVM"]
[Tue Jan 27 19:13:25.913403 2026] [:error] [pid 38987:tid 38990] [client 85.210.92.19:12224] [client 85.210.92.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.210.92.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXid1aTH0bU76Ifu_XcknAAAAAA"]
[Tue Jan 27 19:22:45.702912 2026] [:error] [pid 48446:tid 48491] [client 45.133.4.59:55113] [client 45.133.4.59] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.133.4.59, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXigBcDRSaZ8F8aaLxmSuwAAAc0"]
[Tue Jan 27 19:53:55.204403 2026] [:error] [pid 48446:tid 48496] [client 172.237.101.239:45908] [client 172.237.101.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.237.101.239, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXinU8DRSaZ8F8aaLxmXKAAAAdI"]
[Tue Jan 27 19:58:32.842174 2026] [:error] [pid 48662:tid 48677] [client 177.128.81.65:55973] [client 177.128.81.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.128.81.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXioaOD8iESUP9uRiRPu5gAAAok"]
[Tue Jan 27 20:02:55.421381 2026] [:error] [pid 7453:tid 7490] [client 45.133.4.11:56557] [client 45.133.4.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.133.4.11, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXipbxfsyA2ws_ADquibOgAAAEE"]
[Tue Jan 27 20:13:11.527347 2026] [:error] [pid 7453:tid 7491] [client 177.128.81.65:63618] [client 177.128.81.65] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXir1xfsyA2ws_ADquidewAAAEI"]
[Tue Jan 27 20:14:25.394841 2026] [:error] [pid 39017:tid 39050] [client 177.128.81.65:64263] [client 177.128.81.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.128.81.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXisIc553xt-F_10bG6hvQAAAwI"]
[Tue Jan 27 20:15:28.986411 2026] [:error] [pid 7454:tid 7533] [client 177.128.81.65:64748] [client 177.128.81.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.128.81.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXisYJltCoZEfMmfl8AckAAAAJE"]
[Tue Jan 27 20:16:24.381275 2026] [:error] [pid 7454:tid 7537] [client 177.128.81.65:65129] [client 177.128.81.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.128.81.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXismJltCoZEfMmfl8AcsQAAAJU"]
[Tue Jan 27 20:17:25.109585 2026] [:error] [pid 7453:tid 7496] [client 177.128.81.65:49172] [client 177.128.81.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.128.81.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXis1RfsyA2ws_ADquieSgAAAEc"]
[Tue Jan 27 20:39:27.747499 2026] [:error] [pid 7561:tid 7578] [client 178.128.250.184:53502] [client 178.128.250.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.128.250.184, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXix_7XGI6mgvHQqkXzbWAAAAM4"]
[Tue Jan 27 20:43:24.005669 2026] [:error] [pid 7454:tid 7517] [client 104.28.235.60:11297] [client 104.28.235.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aXiy7JltCoZEfMmfl8Ae5AAAAIE"]
[Tue Jan 27 20:43:24.523563 2026] [:error] [pid 48446:tid 48479] [client 104.28.235.60:65050] [client 104.28.235.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/style.php"] [unique_id "aXiy7MDRSaZ8F8aaLxmeFQAAAcI"]
[Tue Jan 27 21:20:02.394431 2026] [:error] [pid 7453:tid 7493] [client 217.160.232.17:46646] [client 217.160.232.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.160.232.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXi7ghfsyA2ws_ADquinCgAAAEQ"]
[Tue Jan 27 21:27:25.019235 2026] [:error] [pid 7561:tid 7569] [client 45.133.4.42:64755] [client 45.133.4.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.133.4.42, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXi9PbXGI6mgvHQqkXzfygAAAMU"]
[Tue Jan 27 21:38:13.047969 2026] [:error] [pid 48412:tid 48421] [client 13.80.121.26:47858] [client 13.80.121.26] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aXi_xXbJMfAKlln88JEP9gAAAUc"]
[Tue Jan 27 22:09:27.022418 2026] [:error] [pid 48446:tid 48483] [client 3.123.55.144:38410] [client 3.123.55.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.123.55.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXjHF8DRSaZ8F8aaLxmrxwAAAcY"]
[Tue Jan 27 22:10:14.024657 2026] [ssl:error] [pid 39017:tid 39069] [client 15.204.183.221:32192] AH02032: Hostname cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup, referer: http://cdbdinteriors.com.au/
[Tue Jan 27 22:47:08.963475 2026] [:error] [pid 38987:tid 39009] [client 217.11.48.239:52512] [client 217.11.48.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.11.48.239, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXjP7KTH0bU76Ifu_Xc9bAAAABM"]
[Tue Jan 27 22:56:43.226332 2026] [ssl:error] [pid 48446:tid 48483] [client 15.204.183.221:61666] AH02032: Hostname www.cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup, referer: http://www.cdbdinteriors.com.au/
[Tue Jan 27 23:29:12.005447 2026] [:error] [pid 7453:tid 7498] [client 185.237.252.236:58574] [client 185.237.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.237.252.236, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXjZyBfsyA2ws_ADqui-qwAAAEk"]
[Wed Jan 28 00:15:33.042568 2026] [:error] [pid 24511:tid 24526] [client 159.223.176.184:56442] [client 159.223.176.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.176.184, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXjkpWmoieLyDzs0ASToSQAAAIs"]
[Wed Jan 28 00:52:21.346057 2026] [:error] [pid 24425:tid 24447] [client 98.159.233.75:34301] [client 98.159.233.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.233.75, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXjtRR_qUCA3SusVe0t59QAAARE"], referer: https://expressinteriors.com/wp-admin/
[Wed Jan 28 00:52:24.201318 2026] [:error] [pid 24425:tid 24438] [client 98.159.233.75:34301] [client 98.159.233.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.233.75, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXjtSB_qUCA3SusVe0t5_AAAAQg"], referer: https://expressinteriors.com/wp-admin/
[Wed Jan 28 00:52:44.358567 2026] [:error] [pid 41678:tid 41707] [client 98.159.233.58:54419] [client 98.159.233.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.233.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXjtXKja89ZyPVwMdigUqAAAAA4"], referer: https://expressinteriors.com/wp-admin/
[Wed Jan 28 00:52:46.896413 2026] [:error] [pid 41678:tid 41712] [client 98.159.233.58:54419] [client 98.159.233.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.233.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXjtXqja89ZyPVwMdigUrgAAABM"], referer: https://expressinteriors.com/wp-admin/
[Wed Jan 28 00:52:58.368481 2026] [:error] [pid 24511:tid 24535] [client 98.159.233.93:64221] [client 98.159.233.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.233.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXjtammoieLyDzs0AST0NAAAAJQ"], referer: https://expressinteriors.com/wp-admin/
[Wed Jan 28 00:53:00.661396 2026] [:error] [pid 24511:tid 24537] [client 98.159.233.93:64221] [client 98.159.233.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.233.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXjtbGmoieLyDzs0AST0QAAAAJY"], referer: https://expressinteriors.com/wp-admin/
[Wed Jan 28 00:53:19.324818 2026] [:error] [pid 24511:tid 24535] [client 98.159.233.75:54389] [client 98.159.233.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.233.75, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXjtf2moieLyDzs0AST0XQAAAJQ"], referer: https://expressinteriors.com/wp-admin/
[Wed Jan 28 00:53:21.624138 2026] [:error] [pid 24511:tid 24531] [client 98.159.233.75:54389] [client 98.159.233.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.233.75, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXjtgWmoieLyDzs0AST0YgAAAJA"], referer: https://expressinteriors.com/wp-admin/
[Wed Jan 28 00:53:49.898575 2026] [:error] [pid 24427:tid 24509] [client 98.159.233.57:55413] [client 98.159.233.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.233.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXjtnU5-wqSNb5f_hOLy5wAAAZg"], referer: https://expressinteriors.com/wp-admin/
[Wed Jan 28 00:54:09.274363 2026] [:error] [pid 24427:tid 24499] [client 98.159.233.54:36135] [client 98.159.233.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.233.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXjtsU5-wqSNb5f_hOLy_gAAAY4"], referer: https://expressinteriors.com/wp-admin/
[Wed Jan 28 00:54:11.620755 2026] [:error] [pid 24427:tid 24497] [client 98.159.233.54:36135] [client 98.159.233.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.233.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXjts05-wqSNb5f_hOLzBwAAAYw"], referer: https://expressinteriors.com/wp-admin/
[Wed Jan 28 00:54:47.196359 2026] [:error] [pid 24425:tid 24442] [client 98.159.233.85:39227] [client 98.159.233.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.233.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXjt1x_qUCA3SusVe0t61AAAAQw"], referer: https://expressinteriors.com/wp-admin/
[Wed Jan 28 00:54:49.718259 2026] [:error] [pid 24425:tid 24443] [client 98.159.233.85:39227] [client 98.159.233.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.233.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXjt2R_qUCA3SusVe0t62QAAAQ0"], referer: https://expressinteriors.com/wp-admin/
[Wed Jan 28 00:55:25.596271 2026] [:error] [pid 24426:tid 24473] [client 98.159.233.93:64139] [client 98.159.233.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.233.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXjt_fbw8B_M5J5XrXTumgAAAU8"], referer: https://expressinteriors.com/wp-admin/
[Wed Jan 28 00:55:32.264637 2026] [:error] [pid 41678:tid 41696] [client 98.159.233.57:34597] [client 98.159.233.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.233.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXjuBKja89ZyPVwMdigV-AAAAAM"], referer: https://expressinteriors.com/wp-admin/
[Wed Jan 28 00:55:34.534018 2026] [:error] [pid 41678:tid 41701] [client 98.159.233.57:34597] [client 98.159.233.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.233.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXjuBqja89ZyPVwMdigWAwAAAAg"], referer: https://expressinteriors.com/wp-admin/
[Wed Jan 28 00:56:12.141676 2026] [:error] [pid 24426:tid 24467] [client 98.159.233.86:60185] [client 98.159.233.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.233.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXjuLPbw8B_M5J5XrXTuzAAAAUk"], referer: https://expressinteriors.com/wp-admin/
[Wed Jan 28 00:56:57.743228 2026] [:error] [pid 41678:tid 41716] [client 98.159.233.78:49439] [client 98.159.233.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.233.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXjuWaja89ZyPVwMdigWkgAAABc"], referer: https://expressinteriors.com/wp-admin/
[Wed Jan 28 00:57:00.025189 2026] [:error] [pid 41678:tid 41694] [client 98.159.233.78:49439] [client 98.159.233.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.233.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXjuXKja89ZyPVwMdigWlwAAAAE"], referer: https://expressinteriors.com/wp-admin/
[Wed Jan 28 00:57:14.210397 2026] [:error] [pid 24425:tid 24440] [client 98.159.233.77:62935] [client 98.159.233.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.233.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXjuah_qUCA3SusVe0t7bwAAAQo"], referer: https://expressinteriors.com/wp-admin/
[Wed Jan 28 00:57:16.402930 2026] [:error] [pid 24425:tid 24450] [client 98.159.233.77:62935] [client 98.159.233.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.233.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXjubB_qUCA3SusVe0t7dgAAARQ"], referer: https://expressinteriors.com/wp-admin/
[Wed Jan 28 01:02:06.754372 2026] [:error] [pid 41678:tid 41698] [client 45.178.225.205:45682] [client 45.178.225.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.178.225.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXjvjqja89ZyPVwMdigYvwAAAAU"]
[Wed Jan 28 01:07:41.747339 2026] [:error] [pid 41678:tid 41696] [client 74.208.92.254:52280] [client 74.208.92.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.208.92.254, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXjw3aja89ZyPVwMdiga3AAAAAM"]
[Wed Jan 28 01:51:48.202534 2026] [:error] [pid 24427:tid 24508] [client 167.86.71.49:41630] [client 167.86.71.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.71.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXj7NE5-wqSNb5f_hOIGKwAAAZc"]
[Wed Jan 28 01:54:58.703038 2026] [ssl:error] [pid 24511:tid 24521] [client 15.204.161.7:60728] AH02032: Hostname cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup, referer: https://cdbdinteriors.com.au/
[Wed Jan 28 02:28:47.581912 2026] [ssl:error] [pid 24427:tid 24491] [client 15.204.161.7:27958] AH02032: Hostname www.cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup, referer: https://www.cdbdinteriors.com.au/
[Wed Jan 28 02:44:55.170524 2026] [:error] [pid 41678:tid 41696] [client 185.156.42.127:38792] [client 185.156.42.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.156.42.127, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXkHp6ja89ZyPVwMdihJFAAAAAM"]
[Wed Jan 28 03:30:56.704691 2026] [:error] [pid 24425:tid 24446] [client 180.110.203.108:48540] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXkScB_qUCA3SusVe0uk1wAAARA"]
[Wed Jan 28 03:43:08.443601 2026] [:error] [pid 24511:tid 24526] [client 80.120.241.102:51608] [client 80.120.241.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.120.241.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXkVTGmoieLyDzs0ASQp3wAAAIs"]
[Wed Jan 28 03:57:25.678528 2026] [ssl:error] [pid 14117:tid 14213] [client 40.160.16.154:8980] AH02032: Hostname cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup, referer: https://cdbdinteriors.com.au/
[Wed Jan 28 04:24:19.980545 2026] [ssl:error] [pid 17425:tid 17485] [client 40.160.16.154:22550] AH02032: Hostname www.cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup, referer: https://www.cdbdinteriors.com.au/
[Wed Jan 28 04:32:38.579842 2026] [:error] [pid 17535:tid 17552] [client 74.208.194.58:36634] [client 74.208.194.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.208.194.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXkg5q3QiSMgVscnN5LvowAAAM4"]
[Wed Jan 28 05:11:54.801605 2026] [:error] [pid 17425:tid 17478] [client 45.154.138.15:24439] [client 45.154.138.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aXkqGqrcODKH1Dl7aZATSgAAAFA"]
[Wed Jan 28 05:11:58.876785 2026] [:error] [pid 58254:tid 58268] [client 45.154.138.15:58991] [client 45.154.138.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bk/index.php"] [unique_id "aXkqHvF8nSyBg9wOsa_8igAAAQw"]
[Wed Jan 28 05:12:20.667320 2026] [:error] [pid 17535:tid 17547] [client 45.154.138.22:49355] [client 45.154.138.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aXkqNK3QiSMgVscnN5IFBAAAAMk"]
[Wed Jan 28 05:12:27.795651 2026] [:error] [pid 17426:tid 17497] [client 45.154.138.49:47045] [client 45.154.138.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aXkqO08zvf_03BnziRfs7wAAAIg"]
[Wed Jan 28 05:12:28.719277 2026] [:error] [pid 17424:tid 17446] [client 45.154.138.36:32437] [client 45.154.138.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/chosen.php"] [unique_id "aXkqPGRvtDRvGDe-pIs2pgAAAA0"]
[Wed Jan 28 05:12:29.665869 2026] [:error] [pid 64842:tid 64849] [client 45.154.138.6:50699] [client 45.154.138.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aXkqPVuAAQZ5AN_SnDbnwQAAAUU"]
[Wed Jan 28 05:12:34.246305 2026] [:error] [pid 58254:tid 58271] [client 45.154.138.21:36367] [client 45.154.138.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aXkqQvF8nSyBg9wOsa_-oQAAAQ8"]
[Wed Jan 28 05:12:39.448467 2026] [:error] [pid 58254:tid 58264] [client 45.154.138.4:55967] [client 45.154.138.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aXkqR_F8nSyBg9wOsa_-3gAAAQg"]
[Wed Jan 28 05:12:57.343833 2026] [:error] [pid 64842:tid 64856] [client 45.154.138.21:27477] [client 45.154.138.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aXkqWVuAAQZ5AN_SnDbpKAAAAUw"]
[Wed Jan 28 05:12:58.269176 2026] [:error] [pid 64842:tid 64853] [client 45.154.138.12:56915] [client 45.154.138.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aXkqWluAAQZ5AN_SnDbpMQAAAUk"]
[Wed Jan 28 05:13:07.569392 2026] [:error] [pid 17535:tid 17545] [client 170.106.167.214:49258] [client 170.106.167.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXkqY63QiSMgVscnN5IG8QAAAMc"]
[Wed Jan 28 05:15:10.367883 2026] [:error] [pid 17535:tid 17561] [client 45.154.138.9:26659] [client 45.154.138.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.154.138.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXkq3q3QiSMgVscnN5INpwAAANc"]
[Wed Jan 28 05:15:31.687938 2026] [:error] [pid 17535:tid 17545] [client 45.154.138.9:26659] [client 45.154.138.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/modules.php"] [unique_id "aXkq863QiSMgVscnN5IOmgAAAMc"]
[Wed Jan 28 05:16:21.600003 2026] [:error] [pid 17535:tid 17553] [client 45.154.138.30:48881] [client 45.154.138.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/codeboy1877_up.php"] [unique_id "aXkrJa3QiSMgVscnN5IRoAAAAM8"]
[Wed Jan 28 05:19:02.252793 2026] [:error] [pid 17424:tid 17452] [client 45.154.138.12:38699] [client 45.154.138.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/lx.php"] [unique_id "aXkrxmRvtDRvGDe-pItKEAAAABM"]
[Wed Jan 28 05:19:02.290959 2026] [:error] [pid 17425:tid 17474] [client 137.184.237.108:43628] [client 137.184.237.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.237.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXkrxqrcODKH1Dl7aZAnhwAAAEw"]
[Wed Jan 28 05:22:36.312651 2026] [autoindex:error] [pid 64842:tid 64849] [client 45.154.138.9:53795] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:22:40.158504 2026] [autoindex:error] [pid 64842:tid 64850] [client 45.154.138.9:53795] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:22:51.311093 2026] [autoindex:error] [pid 64842:tid 64864] [client 45.154.138.9:53795] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:22:55.241923 2026] [autoindex:error] [pid 64842:tid 64848] [client 45.154.138.9:53795] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:22:55.731798 2026] [autoindex:error] [pid 64842:tid 64849] [client 45.154.138.9:53795] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:22:56.195980 2026] [autoindex:error] [pid 64842:tid 64858] [client 45.154.138.9:53795] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:22:56.662308 2026] [autoindex:error] [pid 64842:tid 64846] [client 45.154.138.9:53795] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:22:57.128589 2026] [autoindex:error] [pid 64842:tid 64844] [client 45.154.138.9:53795] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:22:58.068884 2026] [autoindex:error] [pid 64842:tid 64844] [client 45.154.138.9:53795] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:22:58.540690 2026] [autoindex:error] [pid 64842:tid 64851] [client 45.154.138.9:53795] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:22:59.004211 2026] [autoindex:error] [pid 64842:tid 64864] [client 45.154.138.9:53795] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:22:59.474182 2026] [autoindex:error] [pid 64842:tid 64851] [client 45.154.138.9:53795] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:23:17.561016 2026] [autoindex:error] [pid 64842:tid 64863] [client 45.154.138.9:53795] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:24:52.990530 2026] [proxy_fcgi:error] [pid 64842:tid 64851] [client 45.154.138.9:53795] AH01071: Got error 'PHP message: PHP Warning:  mysqli_query(): (HY000/2006): MySQL server has gone away in /home/expressi/public_html/wp-includes/class-wpdb.php on line 2357'
[Wed Jan 28 05:25:14.280332 2026] [autoindex:error] [pid 64842:tid 64866] [client 45.154.138.33:30803] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:25:14.776789 2026] [autoindex:error] [pid 64842:tid 64860] [client 45.154.138.33:30803] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:25:15.258687 2026] [autoindex:error] [pid 64842:tid 64867] [client 45.154.138.33:30803] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:25:15.744820 2026] [autoindex:error] [pid 64842:tid 64864] [client 45.154.138.33:30803] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:25:16.213626 2026] [autoindex:error] [pid 64842:tid 64867] [client 45.154.138.33:30803] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:25:16.675186 2026] [autoindex:error] [pid 64842:tid 64861] [client 45.154.138.33:30803] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:25:17.145746 2026] [autoindex:error] [pid 64842:tid 64865] [client 45.154.138.33:30803] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:25:25.868977 2026] [autoindex:error] [pid 64842:tid 64863] [client 45.154.138.33:30803] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:25:26.337693 2026] [autoindex:error] [pid 64842:tid 64852] [client 45.154.138.33:30803] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:25:29.771624 2026] [autoindex:error] [pid 64842:tid 64846] [client 45.154.138.33:30803] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:25:33.432154 2026] [autoindex:error] [pid 64842:tid 64865] [client 45.154.138.33:30803] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:25:33.984830 2026] [autoindex:error] [pid 64842:tid 64863] [client 45.154.138.33:30803] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:25:34.476406 2026] [autoindex:error] [pid 64842:tid 64852] [client 45.154.138.33:30803] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:25:40.067725 2026] [autoindex:error] [pid 64842:tid 64855] [client 45.154.138.33:30803] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:25:40.549707 2026] [autoindex:error] [pid 64842:tid 64866] [client 45.154.138.33:30803] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:25:41.052281 2026] [autoindex:error] [pid 64842:tid 64863] [client 45.154.138.33:30803] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:25:41.572729 2026] [autoindex:error] [pid 64842:tid 64847] [client 45.154.138.33:30803] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:25:42.038160 2026] [autoindex:error] [pid 64842:tid 64854] [client 45.154.138.33:30803] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:26:29.364065 2026] [:error] [pid 64842:tid 64857] [client 45.154.138.33:30803] [client 45.154.138.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/db/"] [unique_id "aXkthVuAAQZ5AN_SnDYS9QAAAU0"]
[Wed Jan 28 05:27:38.603432 2026] [autoindex:error] [pid 17424:tid 17437] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:28:20.278496 2026] [autoindex:error] [pid 17424:tid 17445] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:28:35.164993 2026] [autoindex:error] [pid 17424:tid 17445] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:28:35.633091 2026] [autoindex:error] [pid 17424:tid 17452] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:28:43.718476 2026] [autoindex:error] [pid 17424:tid 17434] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:28:44.188469 2026] [autoindex:error] [pid 17424:tid 17449] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:28:44.653476 2026] [autoindex:error] [pid 17424:tid 17447] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:28:45.122185 2026] [autoindex:error] [pid 17424:tid 17443] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:28:45.587617 2026] [autoindex:error] [pid 17424:tid 17457] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:28:46.054026 2026] [autoindex:error] [pid 17424:tid 17438] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:28:46.525897 2026] [autoindex:error] [pid 17424:tid 17457] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:28:46.995587 2026] [autoindex:error] [pid 17424:tid 17439] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:28:47.468482 2026] [autoindex:error] [pid 17424:tid 17457] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:28:47.937346 2026] [autoindex:error] [pid 17424:tid 17433] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:29:16.805279 2026] [autoindex:error] [pid 17424:tid 17455] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:29:56.808514 2026] [autoindex:error] [pid 17424:tid 17445] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:29:57.278417 2026] [autoindex:error] [pid 17424:tid 17433] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:30:42.361187 2026] [autoindex:error] [pid 17424:tid 17441] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/paste/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:30:47.416276 2026] [autoindex:error] [pid 17424:tid 17443] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:30:57.818420 2026] [autoindex:error] [pid 17424:tid 17440] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:31:01.859345 2026] [autoindex:error] [pid 17424:tid 17456] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:31:10.087407 2026] [autoindex:error] [pid 17424:tid 17433] [client 45.154.138.38:54311] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/directionality/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:31:15.425404 2026] [autoindex:error] [pid 17535:tid 17539] [client 45.154.138.27:45133] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/search/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:31:15.889656 2026] [autoindex:error] [pid 17535:tid 17543] [client 45.154.138.27:45133] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/compat3x/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:31:18.969891 2026] [autoindex:error] [pid 17535:tid 17548] [client 45.154.138.27:45133] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:31:24.352854 2026] [autoindex:error] [pid 17535:tid 17550] [client 45.154.138.27:45133] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:31:27.448227 2026] [autoindex:error] [pid 17535:tid 17542] [client 45.154.138.27:45133] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:31:27.927270 2026] [autoindex:error] [pid 17535:tid 17559] [client 45.154.138.27:45133] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/classic-editor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:31:28.414833 2026] [proxy_fcgi:error] [pid 17535:tid 17550] [client 45.154.138.27:45133] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_header() in /home/expressi/public_html/wp-content/themes/twentytwentyone/index.php:17\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/themes/twentytwentyone/index.php on line 17'
[Wed Jan 28 05:31:37.289618 2026] [autoindex:error] [pid 17426:tid 17509] [client 45.154.138.17:39319] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:31:54.561519 2026] [autoindex:error] [pid 17426:tid 17511] [client 45.154.138.17:39319] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/paragraph/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:32:10.621433 2026] [autoindex:error] [pid 17426:tid 17512] [client 45.154.138.17:39319] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/nux/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:32:16.233773 2026] [autoindex:error] [pid 17426:tid 17492] [client 45.154.138.17:39319] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/lists/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:32:16.702907 2026] [autoindex:error] [pid 17426:tid 17494] [client 45.154.138.17:39319] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:33:50.954360 2026] [autoindex:error] [pid 17426:tid 17508] [client 45.154.138.17:39319] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:33:56.540337 2026] [autoindex:error] [pid 17426:tid 17511] [client 45.154.138.17:39319] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/social-links/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:34:41.208314 2026] [autoindex:error] [pid 17426:tid 17504] [client 45.154.138.17:39319] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/src/Core/Curve25519/Ge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Jan 28 05:59:45.198601 2026] [:error] [pid 2454:tid 2481] [client 159.69.28.178:50268] [client 159.69.28.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.69.28.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXk1UZvv4I21Ywd7NNYriQAAAZc"]
[Wed Jan 28 06:48:47.597681 2026] [:error] [pid 17426:tid 17509] [client 88.99.39.252:40700] [client 88.99.39.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.99.39.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXlAz08zvf_03BnziRc9MAAAAJQ"]
[Wed Jan 28 07:09:03.472252 2026] [:error] [pid 26993:tid 27004] [client 141.98.11.239:63231] [client 141.98.11.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.98.11.239, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXlFj2nuZQRiIvPvxUtZ2wAAAcc"]
[Wed Jan 28 07:09:03.472313 2026] [:error] [pid 26993:tid 27004] [client 141.98.11.239:63231] [client 141.98.11.239] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 141.98.11.239 on wp-login.php, counter = 102"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXlFj2nuZQRiIvPvxUtZ2wAAAcc"]
[Wed Jan 28 07:35:29.131018 2026] [:error] [pid 17426:tid 17499] [client 66.29.147.6:36742] [client 66.29.147.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.29.147.6, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXlLwU8zvf_03BnziRdIQAAAAIo"]
[Wed Jan 28 07:35:56.148002 2026] [autoindex:error] [pid 17426:tid 17507] [client 134.122.11.22:54094] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Jan 28 08:16:51.073131 2026] [:error] [pid 17424:tid 17436] [client 82.65.178.212:49638] [client 82.65.178.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.65.178.212, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXlVc2RvtDRvGDe-pIuNJwAAAAM"]
[Wed Jan 28 08:51:20.189859 2026] [:error] [pid 64842:tid 64844] [client 43.135.36.201:47888] [client 43.135.36.201] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXldiFuAAQZ5AN_SnDZPUAAAAUA"]
[Wed Jan 28 09:01:06.070410 2026] [:error] [pid 17426:tid 17508] [client 159.223.226.118:44896] [client 159.223.226.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.226.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXlf0k8zvf_03BnziRdhPgAAAJM"]
[Wed Jan 28 09:50:15.342295 2026] [:error] [pid 64842:tid 64859] [client 65.38.25.38:25598] [client 65.38.25.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.38.25.38, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXlrV1uAAQZ5AN_SnDZdOAAAAU8"]
[Wed Jan 28 11:35:42.483496 2026] [:error] [pid 33490:tid 33528] [client 79.172.225.214:43938] [client 79.172.225.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.172.225.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXmEDmjexcy58gsBPJEAEgAAAEQ"]
[Wed Jan 28 12:16:46.278890 2026] [:error] [pid 33636:tid 33642] [client 159.203.76.93:60170] [client 159.203.76.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.76.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXmNrtIVZAudQH0BSC7KnwAAAgQ"]
[Wed Jan 28 13:08:09.125367 2026] [:error] [pid 42740:tid 42754] [client 103.216.117.42:52602] [client 103.216.117.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.216.117.42, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXmZuVnjAS34srJlXgQ6fQAAAIw"]
[Wed Jan 28 13:58:14.705045 2026] [:error] [pid 24482:tid 24495] [client 161.199.95.100:34360] [client 161.199.95.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 161.199.95.100, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXmldqLaUZr_xWekSHNAlgAAAck"]
[Wed Jan 28 14:26:56.625707 2026] [:error] [pid 33489:tid 33494] [client 93.123.109.58:62357] [client 93.123.109.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aXmsMBZrVZwQUFWC7_8HsQAAAAE"]
[Wed Jan 28 14:57:30.518637 2026] [:error] [pid 24452:tid 24458] [client 165.22.11.210:39214] [client 165.22.11.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.11.210, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXmzWv0RQOh_GmqmVyYOEgAAAYQ"]
[Wed Jan 28 16:06:10.469709 2026] [:error] [pid 33636:tid 33640] [client 103.27.206.168:59598] [client 103.27.206.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.27.206.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXnDctIVZAudQH0BSC4FwAAAAgI"]
[Wed Jan 28 16:26:49.181342 2026] [:error] [pid 24482:tid 24510] [client 190.115.33.85:58186] [client 190.115.33.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.115.33.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXnISaLaUZr_xWekSHNqmQAAAdg"], referer: https://expressinteriors.com/wp-login.php
[Wed Jan 28 16:26:50.665922 2026] [:error] [pid 24482:tid 24506] [client 190.115.33.85:58186] [client 190.115.33.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.115.33.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXnISqLaUZr_xWekSHNqmwAAAdQ"], referer: https://www.magukr.com/wp-login.php
[Wed Jan 28 16:53:54.278084 2026] [:error] [pid 33491:tid 33563] [client 3.22.61.89:41816] [client 3.22.61.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.22.61.89, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXnOomP9UY0x3irkIND2nAAAAMw"]
[Wed Jan 28 17:57:01.151737 2026] [:error] [pid 33489:tid 33516] [client 69.62.81.48:47944] [client 69.62.81.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.62.81.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXndbRZrVZwQUFWC7_8ukQAAABc"]
[Wed Jan 28 17:59:28.912208 2026] [:error] [pid 42740:tid 42761] [client 84.239.47.139:6624] [client 84.239.47.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/robots.txt"] [unique_id "aXneAFnjAS34srJlXgSAagAAAJM"]
[Wed Jan 28 17:59:33.234309 2026] [:error] [pid 33490:tid 33524] [client 84.239.47.139:58430] [client 84.239.47.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXneBWjexcy58gsBPJF1IgAAAEA"]
[Wed Jan 28 17:59:33.667843 2026] [:error] [pid 33490:tid 33532] [client 84.239.47.139:24285] [client 84.239.47.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/robots.txt"] [unique_id "aXneBWjexcy58gsBPJF1IwAAAEg"]
[Wed Jan 28 17:59:35.286076 2026] [:error] [pid 33490:tid 33545] [client 84.239.47.139:24285] [client 84.239.47.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXneB2jexcy58gsBPJF1JQAAAFU"]
[Wed Jan 28 17:59:37.675098 2026] [:error] [pid 33636:tid 33652] [client 84.239.47.139:2195] [client 84.239.47.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXneCdIVZAudQH0BSC4aVwAAAg4"]
[Wed Jan 28 17:59:37.937749 2026] [:error] [pid 33490:tid 33543] [client 84.239.47.139:24285] [client 84.239.47.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXneCWjexcy58gsBPJF1KAAAAFM"]
[Wed Jan 28 17:59:41.661685 2026] [:error] [pid 33490:tid 33536] [client 84.239.47.139:26828] [client 84.239.47.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXneDWjexcy58gsBPJF1XAAAAEw"]
[Wed Jan 28 17:59:44.555142 2026] [:error] [pid 33491:tid 33561] [client 84.239.47.139:54555] [client 84.239.47.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXneEGP9UY0x3irkINAF4AAAAMo"]
[Wed Jan 28 17:59:44.847261 2026] [:error] [pid 33490:tid 33526] [client 84.239.47.139:26828] [client 84.239.47.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXneEGjexcy58gsBPJF1agAAAEI"]
[Wed Jan 28 18:52:02.914469 2026] [:error] [pid 33636:tid 33642] [client 149.224.15.220:63457] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%20888.aspx"] [unique_id "aXnqUtIVZAudQH0BSC4jNQAAAgQ"]
[Wed Jan 28 18:52:05.117697 2026] [:error] [pid 24452:tid 24478] [client 149.224.15.220:60107] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%20chang123.io.aspx"] [unique_id "aXnqVf0RQOh_GmqmVyZPrAAAAZg"]
[Wed Jan 28 18:52:07.524801 2026] [:error] [pid 33636:tid 33660] [client 149.224.15.220:60110] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%20k9win.aspx"] [unique_id "aXnqV9IVZAudQH0BSC4jOQAAAhY"]
[Wed Jan 28 18:52:09.928671 2026] [:error] [pid 33491:tid 33554] [client 149.224.15.220:62404] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87100%20%E0%B8%A3%E0%B8%B1%E0%B8%9A%E0%B8%A7%E0%B8%AD%E0%B8%A5%E0%B9%80%E0%B8%A5%E0%B8%97.aspx"] [unique_id "aXnqWWP9UY0x3irkINARsgAAAMM"]
[Wed Jan 28 18:52:12.187575 2026] [:error] [pid 42740:tid 42753] [client 149.224.15.220:62221] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%99%E0%B8%AD%E0%B8%81%20%E0%B9%83%E0%B8%AB%E0%B8%8D%E0%B9%88%20%E0%B8%97%E0%B8%B5%E0%B9%88%20%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXnqXFnjAS34srJlXgSKXQAAAIs"]
[Wed Jan 28 18:52:14.578683 2026] [:error] [pid 33636:tid 33647] [client 149.224.15.220:64274] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%B9%E0%B8%95%E0%B8%A3%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20pg.aspx"] [unique_id "aXnqXtIVZAudQH0BSC4jPwAAAgk"]
[Wed Jan 28 18:52:16.844100 2026] [:error] [pid 2625:tid 2650] [client 149.224.15.220:64343] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B8%9D%E0%B8%B2%E0%B8%81%2020%20%E0%B8%A3%E0%B8%B1%E0%B8%9A%20100%20%E0%B8%97%E0%B8%B3%E0%B8%A2%E0%B8%AD%E0%B8%94%20200.aspx"] [unique_id "aXnqYFZhY64HvuPd7w1KYwAAAVM"]
[Wed Jan 28 18:52:19.099368 2026] [:error] [pid 33490:tid 33528] [client 149.224.15.220:59767] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXnqY2jexcy58gsBPJGGqAAAAEQ"]
[Wed Jan 28 18:52:21.199920 2026] [:error] [pid 42740:tid 42759] [client 149.224.15.220:59131] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95168.aspx"] [unique_id "aXnqZVnjAS34srJlXgSKaQAAAJE"]
[Wed Jan 28 18:52:23.256774 2026] [:error] [pid 24482:tid 24510] [client 149.224.15.220:63485] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AB%E0%B8%A7%E0%B8%A2%E0%B8%AD%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%A5%E0%B8%99%E0%B9%8C888.aspx"] [unique_id "aXnqZ6LaUZr_xWekSHOIdgAAAdg"]
[Wed Jan 28 18:52:25.365230 2026] [:error] [pid 24452:tid 24461] [client 149.224.15.220:62588] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%81%E0%B8%88%E0%B8%81%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%20%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B9%81%E0%B8%8A%E0%B8%A3%E0%B9%8C%202020.aspx"] [unique_id "aXnqaf0RQOh_GmqmVyZP2AAAAYc"]
[Wed Jan 28 18:52:27.616520 2026] [:error] [pid 33580:tid 33598] [client 149.224.15.220:62947] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%88%E0%B9%8A%E0%B8%81%E0%B9%80%E0%B8%81%E0%B8%AD%E0%B8%A3%E0%B9%8C%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXnqa5lb0QJtwfka8l5GKQAAAQs"]
[Wed Jan 28 18:52:30.359191 2026] [:error] [pid 24482:tid 24493] [client 149.224.15.220:60195] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%88%E0%B9%8A%E0%B8%81%E0%B9%80%E0%B8%81%E0%B8%AD%E0%B8%A3%E0%B9%8C123.aspx"] [unique_id "aXnqbqLaUZr_xWekSHOIhQAAAcc"]
[Wed Jan 28 18:52:32.803134 2026] [:error] [pid 33490:tid 33527] [client 149.224.15.220:64731] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/1234%20superslot.aspx"] [unique_id "aXnqcGjexcy58gsBPJGGugAAAEM"]
[Wed Jan 28 18:52:35.261280 2026] [:error] [pid 24452:tid 24476] [client 149.224.15.220:61535] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/allslot.aspx"] [unique_id "aXnqc_0RQOh_GmqmVyZP3QAAAZY"]
[Wed Jan 28 18:52:37.438595 2026] [:error] [pid 33636:tid 33643] [client 149.224.15.220:59357] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflik%20casino.aspx"] [unique_id "aXnqddIVZAudQH0BSC4jSgAAAgU"]
[Wed Jan 28 18:52:39.800678 2026] [:error] [pid 24482:tid 24486] [client 149.224.15.220:62545] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/fafa168%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXnqd6LaUZr_xWekSHOIiAAAAcA"]
[Wed Jan 28 18:52:42.807458 2026] [:error] [pid 33490:tid 33548] [client 149.224.15.220:60709] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/g2g%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXnqemjexcy58gsBPJGG0QAAAFg"]
[Wed Jan 28 18:52:45.070674 2026] [:error] [pid 2625:tid 2643] [client 149.224.15.220:62836] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/lava%20slot.aspx"] [unique_id "aXnqfVZhY64HvuPd7w1KogAAAUw"]
[Wed Jan 28 18:52:47.483168 2026] [:error] [pid 33490:tid 33541] [client 149.224.15.220:60809] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/miami%20club%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXnqf2jexcy58gsBPJGG2AAAAFE"]
[Wed Jan 28 18:52:49.924409 2026] [:error] [pid 33490:tid 33533] [client 149.224.15.220:62262] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aXnqgWjexcy58gsBPJGG5AAAAEk"]
[Wed Jan 28 18:52:52.771501 2026] [:error] [pid 42740:tid 42743] [client 149.224.15.220:59884] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot%20super%20wallet.aspx"] [unique_id "aXnqhFnjAS34srJlXgSKiQAAAIE"]
[Wed Jan 28 19:11:31.519980 2026] [:error] [pid 33491:tid 33572] [client 178.212.148.253:15712] [client 178.212.148.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.212.148.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXnu42P9UY0x3irkINAV3QAAANU"]
[Wed Jan 28 20:37:26.582993 2026] [:error] [pid 2625:tid 2645] [client 185.196.10.225:22638] [client 185.196.10.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aXoDBlZhY64HvuPd7w1h5QAAAU4"]
[Wed Jan 28 20:54:58.660523 2026] [:error] [pid 24452:tid 24474] [client 92.204.18.34:52388] [client 92.204.18.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.204.18.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXoHIv0RQOh_GmqmVyZ19QAAAZQ"]
[Wed Jan 28 20:55:01.160650 2026] [:error] [pid 2625:tid 2642] [client 92.204.18.34:52404] [client 92.204.18.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.204.18.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXoHJVZhY64HvuPd7w1leQAAAUs"]
[Wed Jan 28 21:37:19.593563 2026] [:error] [pid 33490:tid 33545] [client 52.3.185.211:48888] [client 52.3.185.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.3.185.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXoRD2jexcy58gsBPJHE1QAAAFU"]
[Wed Jan 28 22:49:32.639077 2026] [:error] [pid 33580:tid 33591] [client 143.198.119.177:47316] [client 143.198.119.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.119.177, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXoh_Jlb0QJtwfka8l50jwAAAQQ"]
[Wed Jan 28 23:15:50.950001 2026] [:error] [pid 33489:tid 33500] [client 213.209.159.151:45868] [client 213.209.159.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXooJhZrVZwQUFWC7_9uygAAAAc"]
[Wed Jan 28 23:20:28.225122 2026] [:error] [pid 33490:tid 33525] [client 34.69.179.119:59995] [client 34.69.179.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.179.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXopPGjexcy58gsBPJHrywAAAEE"]
[Wed Jan 28 23:20:30.527513 2026] [:error] [pid 33490:tid 33540] [client 34.69.179.119:59995] [client 34.69.179.119] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aXopPmjexcy58gsBPJHr0gAAAFA"]
[Wed Jan 28 23:20:30.725589 2026] [:error] [pid 33490:tid 33536] [client 34.69.179.119:59995] [client 34.69.179.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.179.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXopPmjexcy58gsBPJHr0wAAAEw"]
[Wed Jan 28 23:20:32.139929 2026] [:error] [pid 24452:tid 24454] [client 34.69.179.119:50419] [client 34.69.179.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.179.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXopQP0RQOh_GmqmVyah1wAAAYA"]
[Wed Jan 28 23:20:33.847294 2026] [:error] [pid 33636:tid 33639] [client 34.69.179.119:56640] [client 34.69.179.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.179.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXopQdIVZAudQH0BSC5c5QAAAgE"]
[Wed Jan 28 23:20:35.246913 2026] [:error] [pid 24482:tid 24493] [client 34.69.179.119:59687] [client 34.69.179.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.179.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXopQ6LaUZr_xWekSHPJOAAAAcc"]
[Wed Jan 28 23:20:36.668512 2026] [:error] [pid 33636:tid 33640] [client 34.69.179.119:63864] [client 34.69.179.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.179.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXopRNIVZAudQH0BSC5c6QAAAgI"]
[Wed Jan 28 23:20:36.668751 2026] [:error] [pid 33636:tid 33640] [client 34.69.179.119:63864] [client 34.69.179.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.69.179.119, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXopRNIVZAudQH0BSC5c6QAAAgI"]
[Thu Jan 29 00:10:52.967399 2026] [:error] [pid 30728:tid 30781] [client 23.239.25.95:35696] [client 23.239.25.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.239.25.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXo1DMON3lWQ9OS6bguL_AAAAFQ"]
[Thu Jan 29 02:46:20.808012 2026] [:error] [pid 64139:tid 64150] [client 141.94.101.142:35554] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87.aspx"] [unique_id "aXpZfE8_llMXywnNBzhSpQAAAwk"]
[Thu Jan 29 02:46:22.995291 2026] [:error] [pid 32598:tid 32618] [client 141.94.101.142:46152] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%9A%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%88%E0%B8%B2%20%E0%B8%AD%E0%B8%B1%E0%B8%99%E0%B8%94%E0%B8%B1%E0%B8%9A1.aspx"] [unique_id "aXpZflY4u2FXFuCu0C4d6AAAAZI"]
[Thu Jan 29 02:46:25.085412 2026] [:error] [pid 30817:tid 30826] [client 141.94.101.142:46162] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%9A%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%88%E0%B8%B2%E0%B8%97%E0%B8%B5%E0%B9%88%E0%B8%84%E0%B8%99%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B9%80%E0%B8%A2%E0%B8%AD%E0%B8%B0%E0%B8%97%E0%B8%B5%E0%B9%88%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXpZgZkL00co11SGgypCiwAAAIY"]
[Thu Jan 29 02:46:26.999940 2026] [:error] [pid 32598:tid 32608] [client 141.94.101.142:46178] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%9A%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%88%E0%B8%B2%E0%B8%AD%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%A5%E0%B8%99%E0%B9%8C.aspx"] [unique_id "aXpZglY4u2FXFuCu0C4d9QAAAYg"]
[Thu Jan 29 02:46:28.921249 2026] [:error] [pid 30727:tid 30736] [client 141.94.101.142:32896] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%9A%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%88%E0%B8%B2.aspx"] [unique_id "aXpZhJ6XAsWrB4DloY_X5QAAAAU"]
[Thu Jan 29 02:46:30.961040 2026] [:error] [pid 32598:tid 32610] [client 141.94.101.142:32910] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%9B%E0%B8%B1%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpZhlY4u2FXFuCu0C4eAAAAAYo"]
[Thu Jan 29 02:46:32.987801 2026] [:error] [pid 30817:tid 30843] [client 141.94.101.142:32920] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%9E%E0%B8%99%E0%B8%B1%E0%B8%99%E0%B8%AD%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%A5%E0%B8%99%E0%B9%8C%20888%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXpZiJkL00co11SGgypCpwAAAJc"]
[Thu Jan 29 02:46:35.028027 2026] [:error] [pid 30727:tid 30736] [client 141.94.101.142:32930] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%9E%E0%B8%99%E0%B8%B1%E0%B8%99%E0%B8%AD%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%A5%E0%B8%99%E0%B9%8C%20ufabet.aspx"] [unique_id "aXpZi56XAsWrB4DloY_X8QAAAAU"]
[Thu Jan 29 02:46:37.201415 2026] [:error] [pid 30817:tid 30842] [client 141.94.101.142:32934] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%9E%E0%B8%99%E0%B8%B1%E0%B8%99%E0%B8%AD%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%A5%E0%B8%99%E0%B9%8C.aspx"] [unique_id "aXpZjZkL00co11SGgypCsQAAAJY"]
[Thu Jan 29 02:46:39.156401 2026] [:error] [pid 32598:tid 32611] [client 141.94.101.142:36596] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%9E%E0%B8%99%E0%B8%B1%E0%B8%99.aspx"] [unique_id "aXpZj1Y4u2FXFuCu0C4eBwAAAYs"]
[Thu Jan 29 02:46:41.151203 2026] [:error] [pid 30727:tid 30742] [client 141.94.101.142:36610] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B8%97%E0%B8%B5%E0%B9%88%20%E0%B8%A1%E0%B8%B5%20%E0%B8%84%E0%B8%99%20%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%20%E0%B8%A1%E0%B8%B2%E0%B8%81%20%E0%B8%97%E0%B8%B5%E0%B9%88%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXpZkZ6XAsWrB4DloY_X-AAAAAs"]
[Thu Jan 29 02:46:43.200802 2026] [:error] [pid 64076:tid 64101] [client 141.94.101.142:36624] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20168%20%E0%B8%9D%E0%B8%B2%E0%B8%81%20%E0%B8%96%E0%B8%AD%E0%B8%99%20true%20wallet.aspx"] [unique_id "aXpZk8gWS9sk7GfiNFeXIgAAApc"]
[Thu Jan 29 02:46:45.198800 2026] [:error] [pid 32895:tid 32911] [client 141.94.101.142:36628] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20168%20%E0%B8%9D%E0%B8%B2%E0%B8%81%E0%B8%96%E0%B8%AD%E0%B8%99%20true%20wallet.aspx"] [unique_id "aXpZlXQ85pgihG9SXurVDgAAAg4"]
[Thu Jan 29 02:46:47.249143 2026] [:error] [pid 32895:tid 32901] [client 141.94.101.142:36644] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20456%20%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%AA%E0%B8%B9%E0%B9%88%E0%B8%A3%E0%B8%B0%E0%B8%9A%E0%B8%9A.aspx"] [unique_id "aXpZl3Q85pgihG9SXurVEgAAAgQ"]
[Thu Jan 29 02:46:49.273761 2026] [:error] [pid 30729:tid 30796] [client 141.94.101.142:52234] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20pg.aspx"] [unique_id "aXpZmYHlkRFkYwysACc6kQAAAMg"]
[Thu Jan 29 02:46:51.387661 2026] [:error] [pid 30729:tid 30802] [client 141.94.101.142:52238] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%95%E0%B8%A3%E0%B8%87%20%E0%B8%97%E0%B8%B1%E0%B9%89%E0%B8%87%E0%B8%AB%E0%B8%A1%E0%B8%94.aspx"] [unique_id "aXpZm4HlkRFkYwysACc6lAAAAM4"]
[Thu Jan 29 02:46:53.433479 2026] [:error] [pid 30729:tid 30795] [client 141.94.101.142:52248] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%95%E0%B8%A3%E0%B8%87%E0%B8%97%E0%B8%B1%E0%B9%89%E0%B8%87%E0%B8%AB%E0%B8%A1%E0%B8%94.aspx"] [unique_id "aXpZnYHlkRFkYwysACc6lgAAAMc"]
[Thu Jan 29 02:47:00.350280 2026] [:error] [pid 32451:tid 32468] [client 141.94.101.142:52254] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%95%E0%B8%A3%E0%B8%87%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%9C%E0%B9%88%E0%B8%B2%E0%B8%99%E0%B9%80%E0%B8%AD%E0%B9%80%E0%B8%A2%E0%B9%88%E0%B8%99%E0%B8%95%E0%B9%8C.aspx"] [unique_id "aXpZpBnhmSN6e0P4d6tUxgAAAU8"]
[Thu Jan 29 02:47:02.314291 2026] [:error] [pid 30727:tid 30755] [client 141.94.101.142:38528] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXpZpp6XAsWrB4DloY_YJwAAABg"]
[Thu Jan 29 02:47:04.247188 2026] [:error] [pid 33151:tid 33216] [client 141.94.101.142:38544] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87.aspx"] [unique_id "aXpZqGtRH8LcJJ0AyU68BAAAAlI"]
[Thu Jan 29 02:47:06.210653 2026] [:error] [pid 32747:tid 32772] [client 141.94.101.142:38558] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%9D%E0%B8%B2%E0%B8%81%E0%B8%96%E0%B8%AD%E0%B8%99%20true%20wallet.aspx"] [unique_id "aXpZqv0et-wQsmVMWlkuMgAAAdc"]
[Thu Jan 29 02:47:08.176491 2026] [:error] [pid 64076:tid 64099] [client 141.94.101.142:47394] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%A7%E0%B8%AD%E0%B9%80%E0%B8%A5%E0%B8%97.aspx"] [unique_id "aXpZrMgWS9sk7GfiNFeXOQAAApU"]
[Thu Jan 29 02:47:10.020901 2026] [:error] [pid 32598:tid 32609] [client 141.94.101.142:47406] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%AD%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%A5%E0%B8%99%E0%B9%8C.aspx"] [unique_id "aXpZrlY4u2FXFuCu0C4ePAAAAYk"]
[Thu Jan 29 02:47:11.949673 2026] [:error] [pid 32747:tid 32769] [client 141.94.101.142:47412] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%AD%E0%B8%B1%E0%B8%99%E0%B8%94%E0%B8%B1%E0%B8%9A%201%20%E0%B8%82%E0%B8%AD%E0%B8%87%E0%B9%82%E0%B8%A5%E0%B8%81.aspx"] [unique_id "aXpZr_0et-wQsmVMWlkuOwAAAdQ"]
[Thu Jan 29 02:47:14.031037 2026] [:error] [pid 30817:tid 30821] [client 141.94.101.142:47426] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXpZspkL00co11SGgypC8QAAAIE"]
[Thu Jan 29 02:47:15.994481 2026] [:error] [pid 33151:tid 33200] [client 141.94.101.142:47436] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%20%E0%B8%84%E0%B9%88%E0%B8%B2%E0%B8%A2%E0%B9%83%E0%B8%AB%E0%B8%8D%E0%B9%88%20%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXpZs2tRH8LcJJ0AyU68IQAAAkM"]
[Thu Jan 29 02:48:09.199818 2026] [:error] [pid 64139:tid 64162] [client 141.94.101.142:41244] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/10%E0%B8%A3%E0%B8%B1%E0%B8%9A100%20wallet%20%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXpZ6U8_llMXywnNBzhTMgAAAxU"]
[Thu Jan 29 02:48:11.228165 2026] [:error] [pid 30727:tid 30744] [client 141.94.101.142:33656] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/10%E0%B8%A3%E0%B8%B1%E0%B8%9A100%20wallet.aspx"] [unique_id "aXpZ656XAsWrB4DloY_YfQAAAA0"]
[Thu Jan 29 02:48:13.266907 2026] [:error] [pid 32747:tid 32773] [client 141.94.101.142:33664] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/10%E0%B8%A3%E0%B8%B1%E0%B8%9A100%E0%B8%AA%E0%B8%A1%E0%B8%B2%E0%B8%8A%E0%B8%B4%E0%B8%81%E0%B9%83%E0%B8%AB%E0%B8%A1%E0%B9%88.aspx"] [unique_id "aXpZ7f0et-wQsmVMWlkuqwAAAdg"]
[Thu Jan 29 02:48:15.252607 2026] [:error] [pid 33151:tid 33199] [client 141.94.101.142:33670] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/1234%20slot.aspx"] [unique_id "aXpZ72tRH8LcJJ0AyU68nAAAAkI"]
[Thu Jan 29 02:48:17.315620 2026] [:error] [pid 32598:tid 32620] [client 141.94.101.142:33676] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/168%20slot.aspx"] [unique_id "aXpZ8VY4u2FXFuCu0C4ewQAAAZQ"]
[Thu Jan 29 02:48:19.469163 2026] [:error] [pid 32451:tid 32453] [client 141.94.101.142:56640] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/168slot.aspx"] [unique_id "aXpZ8xnhmSN6e0P4d6tVRAAAAUA"]
[Thu Jan 29 02:48:21.353632 2026] [:error] [pid 32895:tid 32903] [client 141.94.101.142:56646] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/188bet%20%E0%B8%A1%E0%B8%B7%E0%B8%AD%20%E0%B8%96%E0%B8%B7%E0%B8%AD.aspx"] [unique_id "aXpZ9XQ85pgihG9SXurVfAAAAgY"]
[Thu Jan 29 02:48:23.269061 2026] [:error] [pid 32598:tid 32608] [client 141.94.101.142:56654] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/19%E0%B8%A3%E0%B8%B1%E0%B8%9A100.aspx"] [unique_id "aXpZ91Y4u2FXFuCu0C4eywAAAYg"]
[Thu Jan 29 02:48:25.288247 2026] [:error] [pid 30727:tid 30735] [client 141.94.101.142:56662] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/20%E0%B8%A3%E0%B8%B1%E0%B8%9A100.aspx"] [unique_id "aXpZ-Z6XAsWrB4DloY_YmwAAAAQ"]
[Thu Jan 29 02:48:27.260031 2026] [:error] [pid 33151:tid 33202] [client 141.94.101.142:56672] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/24th%20slot.aspx"] [unique_id "aXpZ-2tRH8LcJJ0AyU68sQAAAkU"]
[Thu Jan 29 02:48:29.351784 2026] [:error] [pid 30817:tid 30841] [client 141.94.101.142:60584] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/2xl%20slot.aspx"] [unique_id "aXpZ_ZkL00co11SGgypDdAAAAJU"]
[Thu Jan 29 02:48:31.405125 2026] [:error] [pid 32598:tid 32616] [client 141.94.101.142:60592] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/365bet%20%E0%B9%84%E0%B8%97%E0%B8%A2.aspx"] [unique_id "aXpZ_1Y4u2FXFuCu0C4e3gAAAZA"]
[Thu Jan 29 02:48:33.512725 2026] [:error] [pid 30729:tid 30809] [client 141.94.101.142:60608] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/369%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpaAYHlkRFkYwysACc7PwAAANU"]
[Thu Jan 29 02:48:35.554030 2026] [:error] [pid 30729:tid 30794] [client 141.94.101.142:60622] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/460bet%20%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%AA%E0%B8%B9%E0%B9%88%E0%B8%A3%E0%B8%B0%E0%B8%9A%E0%B8%9A.aspx"] [unique_id "aXpaA4HlkRFkYwysACc7QQAAAMY"]
[Thu Jan 29 02:48:37.486911 2026] [:error] [pid 64139:tid 64164] [client 141.94.101.142:60634] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/69%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpaBU8_llMXywnNBzhTSQAAAxc"]
[Thu Jan 29 02:48:39.471763 2026] [:error] [pid 32747:tid 32769] [client 141.94.101.142:57790] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/789%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpaB_0et-wQsmVMWlkuyAAAAdQ"]
[Thu Jan 29 02:48:41.576182 2026] [:error] [pid 32747:tid 32765] [client 141.94.101.142:57798] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/789%20slot.aspx"] [unique_id "aXpaCf0et-wQsmVMWlkuygAAAdA"]
[Thu Jan 29 02:48:43.593995 2026] [:error] [pid 64139:tid 64151] [client 141.94.101.142:57810] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/789gbet.aspx"] [unique_id "aXpaC08_llMXywnNBzhTUQAAAwo"]
[Thu Jan 29 02:48:45.539279 2026] [:error] [pid 33151:tid 33213] [client 141.94.101.142:57812] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/888%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpaDWtRH8LcJJ0AyU68zQAAAk8"]
[Thu Jan 29 02:48:47.036311 2026] [:error] [pid 32895:tid 32915] [client 141.94.101.142:57820] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/robots.txt"] [unique_id "aXpaD3Q85pgihG9SXurVjwAAAhI"]
[Thu Jan 29 02:48:47.571859 2026] [:error] [pid 30727:tid 30735] [client 141.94.101.142:57836] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/888%20slot.aspx"] [unique_id "aXpaD56XAsWrB4DloY_YuQAAAAQ"]
[Thu Jan 29 02:48:51.584018 2026] [:error] [pid 32598:tid 32620] [client 141.94.101.142:49136] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/99mb%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpaE1Y4u2FXFuCu0C4e-wAAAZQ"]
[Thu Jan 29 02:48:52.434585 2026] [:error] [pid 64139:tid 64159] [client 141.94.101.142:49138] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/robots.txt"] [unique_id "aXpaFE8_llMXywnNBzhTWwAAAxI"]
[Thu Jan 29 02:48:54.123538 2026] [:error] [pid 30817:tid 30834] [client 141.94.101.142:49152] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/all%20slot.aspx"] [unique_id "aXpaFpkL00co11SGgypDmAAAAI4"]
[Thu Jan 29 02:48:55.975214 2026] [:error] [pid 32598:tid 32622] [client 141.94.101.142:49166] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/allslot%20master%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%AA%E0%B8%B9%E0%B9%88%E0%B8%A3%E0%B8%B0%E0%B8%9A%E0%B8%9A.aspx"] [unique_id "aXpaF1Y4u2FXFuCu0C4fAQAAAZY"]
[Thu Jan 29 02:48:58.032810 2026] [:error] [pid 33151:tid 33214] [client 141.94.101.142:44814] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/allslot%20wallet%20%E0%B8%9F%E0%B8%A3%E0%B8%B5%2050.aspx"] [unique_id "aXpaGmtRH8LcJJ0AyU684QAAAlA"]
[Thu Jan 29 02:49:00.077411 2026] [:error] [pid 32598:tid 32614] [client 141.94.101.142:44828] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/allslot%20wallet%2010%E0%B8%A3%E0%B8%B1%E0%B8%9A100.aspx"] [unique_id "aXpaHFY4u2FXFuCu0C4fCAAAAY4"]
[Thu Jan 29 02:49:02.099456 2026] [:error] [pid 32747:tid 32769] [client 141.94.101.142:44836] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/allslot%20wallet.aspx"] [unique_id "aXpaHv0et-wQsmVMWlku3QAAAdQ"]
[Thu Jan 29 02:49:05.988399 2026] [:error] [pid 32451:tid 32474] [client 141.94.101.142:44838] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/allslot888.aspx"] [unique_id "aXpaIRnhmSN6e0P4d6tVawAAAVU"]
[Thu Jan 29 02:49:58.372590 2026] [:error] [pid 32598:tid 32604] [client 141.94.101.142:55910] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflik%20%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXpaVlY4u2FXFuCu0C4fbgAAAYQ"]
[Thu Jan 29 02:50:00.353587 2026] [:error] [pid 32451:tid 32477] [client 141.94.101.142:48678] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflik%20co.aspx"] [unique_id "aXpaWBnhmSN6e0P4d6tVhAAAAVg"]
[Thu Jan 29 02:50:02.398472 2026] [:error] [pid 32747:tid 32749] [client 141.94.101.142:48694] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflik%20dc.aspx"] [unique_id "aXpaWv0et-wQsmVMWlkvAwAAAcA"]
[Thu Jan 29 02:50:04.423352 2026] [:error] [pid 32895:tid 32919] [client 141.94.101.142:48704] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflik%20original.aspx"] [unique_id "aXpaXHQ85pgihG9SXurVxgAAAhY"]
[Thu Jan 29 02:50:06.437791 2026] [:error] [pid 30817:tid 30835] [client 141.94.101.142:48720] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflik%20slot.aspx"] [unique_id "aXpaXpkL00co11SGgypD8wAAAI8"]
[Thu Jan 29 02:50:08.466741 2026] [:error] [pid 30727:tid 30742] [client 141.94.101.142:33108] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflik%20thailand.aspx"] [unique_id "aXpaYJ6XAsWrB4DloY_ZCgAAAAs"]
[Thu Jan 29 02:50:10.374375 2026] [:error] [pid 64139:tid 64151] [client 141.94.101.142:33122] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXpaYk8_llMXywnNBzhTngAAAwo"]
[Thu Jan 29 02:50:12.403862 2026] [:error] [pid 30729:tid 30800] [client 141.94.101.142:33130] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%AA%E0%B8%B9%E0%B9%88%E0%B8%A3%E0%B8%B0%E0%B8%9A%E0%B8%9A.aspx"] [unique_id "aXpaZIHlkRFkYwysACc7twAAAMw"]
[Thu Jan 29 02:50:14.399573 2026] [:error] [pid 64076:tid 64098] [client 141.94.101.142:33140] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXpaZsgWS9sk7GfiNFeX1wAAApQ"]
[Thu Jan 29 02:50:16.458487 2026] [:error] [pid 33151:tid 33213] [client 141.94.101.142:33148] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20auto.aspx"] [unique_id "aXpaaGtRH8LcJJ0AyU69lwAAAk8"]
[Thu Jan 29 02:50:18.341698 2026] [:error] [pid 64139:tid 64144] [client 141.94.101.142:53264] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20casino.aspx"] [unique_id "aXpaak8_llMXywnNBzhTqAAAAwM"]
[Thu Jan 29 02:50:20.355667 2026] [:error] [pid 64076:tid 64099] [client 141.94.101.142:53276] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20co.aspx"] [unique_id "aXpabMgWS9sk7GfiNFeX2QAAApU"]
[Thu Jan 29 02:50:22.367665 2026] [:error] [pid 32895:tid 32908] [client 141.94.101.142:53282] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20slot.aspx"] [unique_id "aXpabnQ85pgihG9SXurV1gAAAgs"]
[Thu Jan 29 02:50:24.376587 2026] [:error] [pid 32451:tid 32471] [client 141.94.101.142:53298] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20wallet.aspx"] [unique_id "aXpacBnhmSN6e0P4d6tVlwAAAVI"]
[Thu Jan 29 02:50:26.304971 2026] [:error] [pid 30729:tid 30802] [client 141.94.101.142:53312] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix168.aspx"] [unique_id "aXpacoHlkRFkYwysACc7wgAAAM4"]
[Thu Jan 29 02:50:28.318691 2026] [:error] [pid 32747:tid 32749] [client 141.94.101.142:43648] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/bwin%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpadP0et-wQsmVMWlkvIQAAAcA"]
[Thu Jan 29 02:50:30.351460 2026] [:error] [pid 32598:tid 32624] [client 141.94.101.142:43658] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20betflik.aspx"] [unique_id "aXpadlY4u2FXFuCu0C4fgQAAAZg"]
[Thu Jan 29 02:50:32.360173 2026] [:error] [pid 64139:tid 64164] [client 141.94.101.142:43660] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20betflix.aspx"] [unique_id "aXpaeE8_llMXywnNBzhTuwAAAxc"]
[Thu Jan 29 02:50:34.232411 2026] [:error] [pid 32895:tid 32920] [client 141.94.101.142:43672] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20wallet.aspx"] [unique_id "aXpaenQ85pgihG9SXurV6QAAAhc"]
[Thu Jan 29 02:50:36.241681 2026] [:error] [pid 64076:tid 64098] [client 141.94.101.142:43682] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/cat888%20%E0%B8%AB%E0%B8%A7%E0%B8%A2%E0%B8%AD%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%A5%E0%B8%99%E0%B9%8C.aspx"] [unique_id "aXpafMgWS9sk7GfiNFeX8QAAApQ"]
[Thu Jan 29 02:50:38.144756 2026] [:error] [pid 32451:tid 32460] [client 141.94.101.142:35732] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/cat888%20%E0%B8%AB%E0%B8%A7%E0%B8%A2%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%AA%E0%B8%B9%E0%B9%88%E0%B8%A3%E0%B8%B0%E0%B8%9A%E0%B8%9A.aspx"] [unique_id "aXpafhnhmSN6e0P4d6tVpQAAAUc"]
[Thu Jan 29 02:50:40.324533 2026] [:error] [pid 33151:tid 33210] [client 141.94.101.142:35734] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/faw99%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpagGtRH8LcJJ0AyU69swAAAk0"]
[Thu Jan 29 02:50:42.330688 2026] [:error] [pid 32895:tid 32902] [client 141.94.101.142:35750] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/fullslot.aspx"] [unique_id "aXpagnQ85pgihG9SXurV8gAAAgU"]
[Thu Jan 29 02:50:44.337764 2026] [:error] [pid 32895:tid 32911] [client 141.94.101.142:35754] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/fun88%20%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%A3%E0%B8%B0%E0%B8%9A%E0%B8%9A.aspx"] [unique_id "aXpahHQ85pgihG9SXurV9wAAAg4"]
[Thu Jan 29 02:50:46.347693 2026] [:error] [pid 32895:tid 32899] [client 141.94.101.142:35770] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/g2g%20slot.aspx"] [unique_id "aXpahnQ85pgihG9SXurV-gAAAgI"]
[Thu Jan 29 02:50:48.358365 2026] [:error] [pid 32598:tid 32614] [client 141.94.101.142:40542] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/g2g1bet.aspx"] [unique_id "aXpaiFY4u2FXFuCu0C4fsQAAAY4"]
[Thu Jan 29 02:50:50.364865 2026] [:error] [pid 32598:tid 32606] [client 141.94.101.142:40556] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "aXpailY4u2FXFuCu0C4ftgAAAYY"]
[Thu Jan 29 02:50:52.365366 2026] [:error] [pid 30729:tid 30796] [client 141.94.101.142:40568] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "aXpajIHlkRFkYwysACc75QAAAMg"]
[Thu Jan 29 02:50:54.418394 2026] [:error] [pid 30817:tid 30844] [client 141.94.101.142:40574] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20slot.aspx"] [unique_id "aXpajpkL00co11SGgypEKgAAAJg"]
[Thu Jan 29 02:51:47.658453 2026] [:error] [pid 32895:tid 32908] [client 141.94.101.142:40584] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/l86.com%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpaw3Q85pgihG9SXurWVQAAAgs"]
[Thu Jan 29 02:51:49.619878 2026] [:error] [pid 30729:tid 30794] [client 141.94.101.142:57450] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/las%20vegas%20auto%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpaxYHlkRFkYwysACc8HgAAAMY"]
[Thu Jan 29 02:51:51.515686 2026] [:error] [pid 30817:tid 30839] [client 141.94.101.142:57456] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/lava909%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpax5kL00co11SGgypEoQAAAJM"]
[Thu Jan 29 02:51:53.517361 2026] [:error] [pid 32451:tid 32457] [client 141.94.101.142:57462] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/lotto888%20%E0%B8%AB%E0%B8%A7%E0%B8%A2.aspx"] [unique_id "aXpayRnhmSN6e0P4d6tV5gAAAUQ"]
[Thu Jan 29 02:51:55.517071 2026] [:error] [pid 32747:tid 32756] [client 141.94.101.142:57474] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/lottovip%20%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%AA%E0%B8%B9%E0%B9%88%E0%B8%A3%E0%B8%B0%E0%B8%9A%E0%B8%9A.aspx"] [unique_id "aXpay_0et-wQsmVMWlkvhgAAAcc"]
[Thu Jan 29 02:51:57.519247 2026] [:error] [pid 64139:tid 64150] [client 141.94.101.142:57486] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/lsm99%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXpazU8_llMXywnNBzhUDwAAAwk"]
[Thu Jan 29 02:51:59.513655 2026] [:error] [pid 30817:tid 30828] [client 141.94.101.142:35878] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/m24%20wallet%20%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%AA%E0%B8%B9%E0%B9%88%E0%B8%A3%E0%B8%B0%E0%B8%9A%E0%B8%9A.aspx"] [unique_id "aXpaz5kL00co11SGgypErwAAAIg"]
[Thu Jan 29 02:52:01.574955 2026] [:error] [pid 32895:tid 32912] [client 141.94.101.142:35888] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/m24%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpa0XQ85pgihG9SXurWXQAAAg8"]
[Thu Jan 29 02:52:03.611358 2026] [:error] [pid 32451:tid 32464] [client 141.94.101.142:35898] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/m88%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXpa0xnhmSN6e0P4d6tV7gAAAUs"]
[Thu Jan 29 02:52:05.622932 2026] [:error] [pid 30727:tid 30734] [client 141.94.101.142:35906] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/m98%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXpa1Z6XAsWrB4DloY_ZjAAAAAM"]
[Thu Jan 29 02:52:07.485836 2026] [:error] [pid 32451:tid 32457] [client 141.94.101.142:35914] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/m98%20%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%20188.aspx"] [unique_id "aXpa1xnhmSN6e0P4d6tV8wAAAUQ"]
[Thu Jan 29 02:52:09.488149 2026] [:error] [pid 32895:tid 32909] [client 141.94.101.142:54334] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/m98%20bet%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%20%E0%B8%A1%E0%B8%B7%E0%B8%AD%20%E0%B8%96%E0%B8%B7%E0%B8%AD.aspx"] [unique_id "aXpa2XQ85pgihG9SXurWYwAAAgw"]
[Thu Jan 29 02:52:11.482464 2026] [:error] [pid 64076:tid 64093] [client 141.94.101.142:54336] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/mafia%20slot%20%E0%B9%83%E0%B8%AB%E0%B8%A1%E0%B9%88%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXpa28gWS9sk7GfiNFeYSgAAAo8"]
[Thu Jan 29 02:52:13.538876 2026] [:error] [pid 64139:tid 64160] [client 141.94.101.142:54350] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/magnum%204d%20%E0%B8%AB%E0%B8%A7%E0%B8%A2%20%E0%B8%A1%E0%B8%B2%E0%B9%80%E0%B8%A5%20%E0%B8%A2%E0%B9%8C%20%E0%B8%A7%E0%B8%B1%E0%B8%99%E0%B8%99%E0%B8%B5%E0%B9%89.aspx"] [unique_id "aXpa3U8_llMXywnNBzhUJAAAAxM"]
[Thu Jan 29 02:52:15.554334 2026] [:error] [pid 33151:tid 33206] [client 141.94.101.142:54354] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/mega%20slot.aspx"] [unique_id "aXpa32tRH8LcJJ0AyU6-KQAAAkk"]
[Thu Jan 29 02:52:17.554934 2026] [:error] [pid 30727:tid 30731] [client 141.94.101.142:54360] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/megaways%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpa4Z6XAsWrB4DloY_ZkwAAAAA"]
[Thu Jan 29 02:52:19.586592 2026] [:error] [pid 30817:tid 30841] [client 141.94.101.142:51860] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/metal%20slot.aspx"] [unique_id "aXpa45kL00co11SGgypExQAAAJU"]
[Thu Jan 29 02:52:21.566564 2026] [:error] [pid 64139:tid 64159] [client 141.94.101.142:51870] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/miami%201688%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXpa5U8_llMXywnNBzhUMAAAAxI"]
[Thu Jan 29 02:52:23.568875 2026] [:error] [pid 30817:tid 30832] [client 141.94.101.142:51872] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/miami%201688%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpa55kL00co11SGgypEygAAAIw"]
[Thu Jan 29 02:52:25.612024 2026] [:error] [pid 30729:tid 30806] [client 141.94.101.142:51886] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/mm88rich%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXpa6YHlkRFkYwysACc8TAAAANI"]
[Thu Jan 29 02:52:27.599486 2026] [:error] [pid 64139:tid 64146] [client 141.94.101.142:51896] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/myslot.aspx"] [unique_id "aXpa608_llMXywnNBzhUNQAAAwU"]
[Thu Jan 29 02:52:29.618659 2026] [:error] [pid 33151:tid 33217] [client 141.94.101.142:48798] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/n83%20com%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpa7WtRH8LcJJ0AyU6-OQAAAlM"]
[Thu Jan 29 02:52:31.613859 2026] [:error] [pid 32895:tid 32911] [client 141.94.101.142:48802] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/nagaway%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%AA%E0%B8%B9%E0%B9%88%E0%B8%A3%E0%B8%B0%E0%B8%9A%E0%B8%9A.aspx"] [unique_id "aXpa73Q85pgihG9SXurWfAAAAg4"]
[Thu Jan 29 02:52:33.596283 2026] [:error] [pid 30729:tid 30792] [client 141.94.101.142:48814] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/noname%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpa8YHlkRFkYwysACc8XgAAAMQ"]
[Thu Jan 29 02:52:35.622672 2026] [:error] [pid 30817:tid 30839] [client 141.94.101.142:48816] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/oker%20%E0%B9%81%E0%B8%88%E0%B8%81%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B8%9D%E0%B8%B2%E0%B8%81%20%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B9%81%E0%B8%8A%E0%B8%A3%E0%B9%8C.aspx"] [unique_id "aXpa85kL00co11SGgypE6wAAAJM"]
[Thu Jan 29 02:52:37.648587 2026] [:error] [pid 30729:tid 30803] [client 141.94.101.142:48824] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87.aspx"] [unique_id "aXpa9YHlkRFkYwysACc8ZwAAAM8"]
[Thu Jan 29 02:52:39.655139 2026] [:error] [pid 30817:tid 30833] [client 141.94.101.142:39812] [client 141.94.101.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpa95kL00co11SGgypE7wAAAI0"]
[Thu Jan 29 02:55:52.471018 2026] [:error] [pid 33151:tid 33216] [client 155.133.142.66:44997] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.142.66, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXpbuGtRH8LcJJ0AyU6_oAAAAlI"]
[Thu Jan 29 02:55:57.327586 2026] [:error] [pid 32895:tid 32907] [client 54.229.167.40:38170] [client 54.229.167.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.229.167.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXpbvXQ85pgihG9SXurXDgAAAgo"]
[Thu Jan 29 03:33:43.930408 2026] [:error] [pid 15948:tid 15964] [client 47.90.227.150:37880] [client 47.90.227.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXpkl8s8-GxRVq8LLTWd2gAAAAA"]
[Thu Jan 29 03:33:44.339991 2026] [:error] [pid 16050:tid 16061] [client 47.90.227.150:52640] [client 47.90.227.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXpkmOFPpSEbViHfa9KQUQAAAMc"]
[Thu Jan 29 03:35:53.828844 2026] [:error] [pid 15950:tid 16039] [client 217.144.107.183:46644] [client 217.144.107.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.144.107.183, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXplGYJOXwUqBC55abQs_wAAAJQ"]
[Thu Jan 29 03:36:12.832703 2026] [:error] [pid 15949:tid 15999] [client 198.46.253.39:41242] [client 198.46.253.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.46.253.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXplLCUUtCw0-hDUhapOFgAAAEc"]
[Thu Jan 29 03:36:15.086576 2026] [:error] [pid 16050:tid 16075] [client 198.46.253.39:41246] [client 198.46.253.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.46.253.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXplL-FPpSEbViHfa9KSNQAAANU"]
[Thu Jan 29 03:36:16.159974 2026] [:error] [pid 15950:tid 16032] [client 217.144.107.183:52402] [client 217.144.107.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.144.107.183, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXplMIJOXwUqBC55abQtKgAAAI0"]
[Thu Jan 29 03:36:48.040905 2026] [:error] [pid 16050:tid 16076] [client 220.121.103.167:59248] [client 220.121.103.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.121.103.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXplT-FPpSEbViHfa9KSjAAAANY"]
[Thu Jan 29 03:36:49.993149 2026] [:error] [pid 15949:tid 15997] [client 220.121.103.167:59445] [client 220.121.103.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.121.103.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXplUSUUtCw0-hDUhapOZAAAAEU"]
[Thu Jan 29 03:38:27.203264 2026] [:error] [pid 15948:tid 15966] [client 4.193.202.195:56560] [client 4.193.202.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aXpls8s8-GxRVq8LLTWfvgAAAAI"]
[Thu Jan 29 03:38:35.515484 2026] [:error] [pid 16050:tid 16071] [client 4.193.202.195:56519] [client 4.193.202.195] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aXplu-FPpSEbViHfa9KUKQAAANE"]
[Thu Jan 29 04:11:44.391523 2026] [:error] [pid 20580:tid 20674] [client 93.218.117.230:50678] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95pg%E0%B9%81%E0%B8%97%E0%B9%89.aspx"] [unique_id "aXptgJCZ5HHdXPmeL585jwAAAoY"]
[Thu Jan 29 04:11:45.070416 2026] [:error] [pid 20519:tid 20560] [client 93.218.117.230:50689] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95pg%E0%B9%81%E0%B8%97%E0%B9%89.aspx"] [unique_id "aXptgQo4s4fyROrkyRkuCgAAAYw"]
[Thu Jan 29 04:11:47.495184 2026] [:error] [pid 19070:tid 19115] [client 93.218.117.230:50713] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95pg.aspx"] [unique_id "aXptg7ou83lIon_aKgYBjwAAAEk"]
[Thu Jan 29 04:11:49.177377 2026] [:error] [pid 19177:tid 19197] [client 93.218.117.230:50719] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95pg.aspx"] [unique_id "aXpthXipGz0PT8TrQv7dmwAAANI"]
[Thu Jan 29 04:11:51.918789 2026] [:error] [pid 19069:tid 19078] [client 93.218.117.230:63179] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95pg168%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXpth_DHsRM4BJ9a4QtEWgAAAAA"]
[Thu Jan 29 04:11:52.607375 2026] [:error] [pid 20579:tid 20650] [client 93.218.117.230:50776] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95pg168%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXptiDVXNopcNyjJc9VWSQAAAkk"]
[Thu Jan 29 04:11:54.993376 2026] [:error] [pid 19071:tid 19152] [client 93.218.117.230:63207] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95xo%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXptipfa8Ix5wWmtmJyEPAAAAJM"]
[Thu Jan 29 04:11:55.678522 2026] [:error] [pid 19069:tid 19080] [client 93.218.117.230:50817] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95xo%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXpti_DHsRM4BJ9a4QtEXgAAAAI"]
[Thu Jan 29 04:11:57.990630 2026] [:error] [pid 19069:tid 19090] [client 93.218.117.230:50844] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95xo.aspx"] [unique_id "aXptjfDHsRM4BJ9a4QtEYAAAAAw"]
[Thu Jan 29 04:11:58.709878 2026] [:error] [pid 19071:tid 19157] [client 93.218.117.230:63254] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95xo.aspx"] [unique_id "aXptjpfa8Ix5wWmtmJyEQAAAAJg"]
[Thu Jan 29 04:12:01.247529 2026] [:error] [pid 20519:tid 20567] [client 93.218.117.230:50887] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95xo168.aspx"] [unique_id "aXptkQo4s4fyROrkyRkuJAAAAZM"]
[Thu Jan 29 04:12:03.205239 2026] [:error] [pid 20580:tid 20667] [client 93.218.117.230:50915] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95xo168.aspx"] [unique_id "aXptk5CZ5HHdXPmeL585pwAAAoE"]
[Thu Jan 29 04:12:06.461212 2026] [:error] [pid 19070:tid 19125] [client 93.218.117.230:50941] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%89%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXptlrou83lIon_aKgYBmgAAAFM"]
[Thu Jan 29 04:12:07.191049 2026] [:error] [pid 19071:tid 19147] [client 93.218.117.230:50963] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%89%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXptl5fa8Ix5wWmtmJyETQAAAI4"]
[Thu Jan 29 04:12:09.951647 2026] [:error] [pid 20580:tid 20673] [client 93.218.117.230:51020] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%8A%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87.aspx"] [unique_id "aXptmZCZ5HHdXPmeL585sQAAAoU"]
[Thu Jan 29 04:12:10.607773 2026] [:error] [pid 19177:tid 19202] [client 93.218.117.230:51031] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%8A%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87.aspx"] [unique_id "aXptmnipGz0PT8TrQv7dowAAANc"]
[Thu Jan 29 04:12:12.870483 2026] [:error] [pid 20576:tid 20597] [client 93.218.117.230:51061] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%8A%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXptnCrDZws_FlQGi9e-gAAAAcs"]
[Thu Jan 29 04:12:13.536725 2026] [:error] [pid 20519:tid 20552] [client 93.218.117.230:51072] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%8A%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXptnQo4s4fyROrkyRkuMwAAAYQ"]
[Thu Jan 29 04:12:16.904830 2026] [:error] [pid 19177:tid 19183] [client 93.218.117.230:51095] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%B9%E0%B8%95%E0%B8%A3%E0%B8%9A%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%88%E0%B8%B2.aspx"] [unique_id "aXptoHipGz0PT8TrQv7dqwAAAMQ"]
[Thu Jan 29 04:12:17.627947 2026] [:error] [pid 20576:tid 20604] [client 93.218.117.230:51110] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%B9%E0%B8%95%E0%B8%A3%E0%B8%9A%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%88%E0%B8%B2.aspx"] [unique_id "aXptoSrDZws_FlQGi9e-hAAAAdI"]
[Thu Jan 29 04:12:20.837962 2026] [:error] [pid 20578:tid 20628] [client 93.218.117.230:51134] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%B9%E0%B8%95%E0%B8%A3%E0%B8%A2%E0%B8%B5%E0%B9%88%E0%B8%81%E0%B8%B5%20lottovip.aspx"] [unique_id "aXptpA6UX7yOMwQFiydwRgAAAg8"]
[Thu Jan 29 04:12:22.549808 2026] [:error] [pid 19069:tid 19092] [client 93.218.117.230:51151] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%B9%E0%B8%95%E0%B8%A3%E0%B8%A2%E0%B8%B5%E0%B9%88%E0%B8%81%E0%B8%B5%20lottovip.aspx"] [unique_id "aXptpvDHsRM4BJ9a4QtEfwAAAA4"]
[Thu Jan 29 04:12:24.994810 2026] [:error] [pid 20580:tid 20680] [client 93.218.117.230:51189] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%B9%E0%B8%95%E0%B8%A3%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20pg%20%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXptqJCZ5HHdXPmeL585xgAAAow"]
[Thu Jan 29 04:12:25.668662 2026] [:error] [pid 19177:tid 19188] [client 93.218.117.230:63489] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%B9%E0%B8%95%E0%B8%A3%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20pg%20%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXptqXipGz0PT8TrQv7dtAAAAMk"]
[Thu Jan 29 04:12:27.939047 2026] [:error] [pid 19069:tid 19091] [client 93.218.117.230:51224] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%B9%E0%B8%95%E0%B8%A3%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20pg%20%E0%B8%9F%E0%B8%A3%E0%B8%B5%20%E0%B9%83%E0%B8%8A%E0%B9%89%E0%B9%84%E0%B8%94%E0%B9%89%20%E0%B8%88%E0%B8%A3%E0%B8%B4%E0%B8%87%202024.aspx"] [unique_id "aXptq_DHsRM4BJ9a4QtEiwAAAA0"]
[Thu Jan 29 04:12:28.631978 2026] [:error] [pid 20576:tid 20609] [client 93.218.117.230:51240] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%B9%E0%B8%95%E0%B8%A3%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20pg%20%E0%B8%9F%E0%B8%A3%E0%B8%B5%20%E0%B9%83%E0%B8%8A%E0%B9%89%E0%B9%84%E0%B8%94%E0%B9%89%20%E0%B8%88%E0%B8%A3%E0%B8%B4%E0%B8%87%202024.aspx"] [unique_id "aXptrCrDZws_FlQGi9e-jwAAAdc"]
[Thu Jan 29 04:12:32.469934 2026] [:error] [pid 20576:tid 20593] [client 93.218.117.230:51291] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%B9%E0%B8%95%E0%B8%A3%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20pg%20%E0%B8%9F%E0%B8%A3%E0%B8%B5%20%E0%B9%83%E0%B8%8A%E0%B9%89%E0%B9%84%E0%B8%94%E0%B9%89%20%E0%B8%88%E0%B8%A3%E0%B8%B4%E0%B8%87.aspx"] [unique_id "aXptsCrDZws_FlQGi9e-kwAAAcc"]
[Thu Jan 29 04:14:20.595158 2026] [:error] [pid 19071:tid 19147] [client 93.218.117.230:52757] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20888.aspx"] [unique_id "aXpuHJfa8Ix5wWmtmJyFIQAAAI4"]
[Thu Jan 29 04:14:21.322895 2026] [:error] [pid 19069:tid 19090] [client 93.218.117.230:52767] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20888.aspx"] [unique_id "aXpuHfDHsRM4BJ9a4QtFIgAAAAw"]
[Thu Jan 29 04:14:23.683672 2026] [:error] [pid 20519:tid 20557] [client 93.218.117.230:52789] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20k9win.aspx"] [unique_id "aXpuHwo4s4fyROrkyRku-AAAAYk"]
[Thu Jan 29 04:14:24.358177 2026] [:error] [pid 19177:tid 19199] [client 93.218.117.230:52795] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20k9win.aspx"] [unique_id "aXpuIHipGz0PT8TrQv7eQAAAANQ"]
[Thu Jan 29 04:14:27.515542 2026] [:error] [pid 20578:tid 20635] [client 93.218.117.230:52824] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%B5%E0%B9%88%E0%B8%84%E0%B8%B2%E0%B8%AA%E0%B8%B4%E0%B9%82%E0%B8%99%E0%B8%A5%E0%B8%B2%E0%B8%AA%E0%B9%80%E0%B8%A7%E0%B8%81%E0%B8%B1%E0%B8%AA.aspx"] [unique_id "aXpuIw6UX7yOMwQFiydxLwAAAhY"]
[Thu Jan 29 04:14:28.213294 2026] [:error] [pid 20579:tid 20647] [client 93.218.117.230:52830] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%B5%E0%B9%88%E0%B8%84%E0%B8%B2%E0%B8%AA%E0%B8%B4%E0%B9%82%E0%B8%99%E0%B8%A5%E0%B8%B2%E0%B8%AA%E0%B9%80%E0%B8%A7%E0%B8%81%E0%B8%B1%E0%B8%AA.aspx"] [unique_id "aXpuJDVXNopcNyjJc9VXOAAAAkY"]
[Thu Jan 29 04:14:30.684499 2026] [:error] [pid 19071:tid 19137] [client 93.218.117.230:52859] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%AD%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%A5%E0%B8%99%E0%B9%8C.aspx"] [unique_id "aXpuJpfa8Ix5wWmtmJyFOwAAAIQ"]
[Thu Jan 29 04:14:31.380985 2026] [:error] [pid 19069:tid 19084] [client 93.218.117.230:52870] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%AD%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%A5%E0%B8%99%E0%B9%8C.aspx"] [unique_id "aXpuJ_DHsRM4BJ9a4QtFLgAAAAY"]
[Thu Jan 29 04:14:33.827902 2026] [:error] [pid 20580:tid 20667] [client 93.218.117.230:52893] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXpuKZCZ5HHdXPmeL586lAAAAoE"]
[Thu Jan 29 04:14:34.542995 2026] [:error] [pid 19070:tid 19117] [client 93.218.117.230:64527] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXpuKrou83lIon_aKgYCRQAAAEs"]
[Thu Jan 29 04:14:37.214631 2026] [:error] [pid 19069:tid 19100] [client 93.218.117.230:52942] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXpuLfDHsRM4BJ9a4QtFNgAAABY"]
[Thu Jan 29 04:14:37.923767 2026] [:error] [pid 20576:tid 20592] [client 93.218.117.230:52959] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXpuLSrDZws_FlQGi9e_JwAAAcY"]
[Thu Jan 29 04:14:40.459474 2026] [:error] [pid 20576:tid 20597] [client 93.218.117.230:64600] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpuMCrDZws_FlQGi9e_KAAAAcs"]
[Thu Jan 29 04:14:41.111347 2026] [:error] [pid 20519:tid 20555] [client 93.218.117.230:53024] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpuMQo4s4fyROrkyRkvBAAAAYc"]
[Thu Jan 29 04:14:43.786168 2026] [:error] [pid 20576:tid 20605] [client 93.218.117.230:53059] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95777.aspx"] [unique_id "aXpuMyrDZws_FlQGi9e_KgAAAdM"]
[Thu Jan 29 04:14:44.524181 2026] [:error] [pid 20579:tid 20654] [client 93.218.117.230:64635] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95777.aspx"] [unique_id "aXpuNDVXNopcNyjJc9VXSQAAAk0"]
[Thu Jan 29 04:14:47.058913 2026] [:error] [pid 20579:tid 20663] [client 93.218.117.230:64651] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B8%AA%E0%B9%8C%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpuNzVXNopcNyjJc9VXSwAAAlU"]
[Thu Jan 29 04:14:47.715671 2026] [:error] [pid 20579:tid 20661] [client 93.218.117.230:53103] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B8%AA%E0%B9%8C%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpuNzVXNopcNyjJc9VXTQAAAlQ"]
[Thu Jan 29 04:14:49.884456 2026] [:error] [pid 19070:tid 19123] [client 93.218.117.230:64677] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B9%83%E0%B8%AB%E0%B8%A1%E0%B9%88%20pg.aspx"] [unique_id "aXpuObou83lIon_aKgYCVwAAAFE"]
[Thu Jan 29 04:14:50.530514 2026] [:error] [pid 20486:tid 20512] [client 93.218.117.230:53149] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B9%83%E0%B8%AB%E0%B8%A1%E0%B9%88%20pg.aspx"] [unique_id "aXpuOngqSZb6GBx5nnPE8AAAARc"]
[Thu Jan 29 04:14:53.155929 2026] [:error] [pid 20486:tid 20491] [client 93.218.117.230:64719] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20777.aspx"] [unique_id "aXpuPXgqSZb6GBx5nnPE9AAAAQI"]
[Thu Jan 29 04:14:53.823267 2026] [:error] [pid 19070:tid 19130] [client 93.218.117.230:53181] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20777.aspx"] [unique_id "aXpuPbou83lIon_aKgYCYQAAAFg"]
[Thu Jan 29 04:14:56.211474 2026] [:error] [pid 20576:tid 20588] [client 93.218.117.230:64753] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%AA%E0%B8%B9%E0%B9%88%E0%B8%A3%E0%B8%B0%E0%B8%9A%E0%B8%9A%20ufa191.aspx"] [unique_id "aXpuQCrDZws_FlQGi9e_PAAAAcI"]
[Thu Jan 29 04:14:56.907149 2026] [:error] [pid 20576:tid 20590] [client 93.218.117.230:64761] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%AA%E0%B8%B9%E0%B9%88%E0%B8%A3%E0%B8%B0%E0%B8%9A%E0%B8%9A%20ufa191.aspx"] [unique_id "aXpuQCrDZws_FlQGi9e_QQAAAcQ"]
[Thu Jan 29 04:14:59.025923 2026] [:error] [pid 20579:tid 20666] [client 93.218.117.230:53266] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%AA%E0%B8%B9%E0%B9%88%E0%B8%A3%E0%B8%B0%E0%B8%9A%E0%B8%9Ajoker888.aspx"] [unique_id "aXpuQzVXNopcNyjJc9VXWQAAAlc"]
[Thu Jan 29 04:14:59.756545 2026] [:error] [pid 19071:tid 19154] [client 93.218.117.230:64782] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%AA%E0%B8%B9%E0%B9%88%E0%B8%A3%E0%B8%B0%E0%B8%9A%E0%B8%9Ajoker888.aspx"] [unique_id "aXpuQ5fa8Ix5wWmtmJyFUwAAAJU"]
[Thu Jan 29 04:15:02.258113 2026] [:error] [pid 19069:tid 19092] [client 93.218.117.230:53331] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B8%9D%E0%B8%B2%E0%B8%81%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B9%81%E0%B8%8A%E0%B8%A3%E0%B9%8C.aspx"] [unique_id "aXpuRvDHsRM4BJ9a4QtFWgAAAA4"]
[Thu Jan 29 04:15:02.948364 2026] [:error] [pid 20519:tid 20556] [client 93.218.117.230:53339] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B8%9D%E0%B8%B2%E0%B8%81%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B9%81%E0%B8%8A%E0%B8%A3%E0%B9%8C.aspx"] [unique_id "aXpuRgo4s4fyROrkyRkvFAAAAYg"]
[Thu Jan 29 04:15:05.168862 2026] [:error] [pid 20580:tid 20676] [client 93.218.117.230:53365] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%20%E0%B8%9F%E0%B8%A3%E0%B8%B5%20%E0%B9%81%E0%B8%84%E0%B9%88%20%E0%B9%83%E0%B8%AA%E0%B9%88%20%E0%B9%82%E0%B8%84%E0%B9%8A%E0%B8%94%20%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXpuSZCZ5HHdXPmeL586rwAAAog"]
[Thu Jan 29 04:15:06.560783 2026] [:error] [pid 20519:tid 20551] [client 93.218.117.230:53386] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%20%E0%B8%9F%E0%B8%A3%E0%B8%B5%20%E0%B9%81%E0%B8%84%E0%B9%88%20%E0%B9%83%E0%B8%AA%E0%B9%88%20%E0%B9%82%E0%B8%84%E0%B9%8A%E0%B8%94%20%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXpuSgo4s4fyROrkyRkvGQAAAYM"]
[Thu Jan 29 04:15:09.564937 2026] [:error] [pid 20580:tid 20680] [client 93.218.117.230:64880] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%20%E0%B8%81%E0%B8%94%E0%B8%A3%E0%B8%B1%E0%B8%9A%E0%B9%80%E0%B8%AD%E0%B8%87%20%E0%B8%A2%E0%B8%B7%E0%B8%99%E0%B8%A2%E0%B8%B1%E0%B8%99%E0%B9%80%E0%B8%9A%E0%B8%AD%E0%B8%A3%E0%B9%8C%202022.aspx"] [unique_id "aXpuTZCZ5HHdXPmeL586ugAAAow"]
[Thu Jan 29 04:15:10.256456 2026] [:error] [pid 20579:tid 20644] [client 93.218.117.230:53422] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%20%E0%B8%81%E0%B8%94%E0%B8%A3%E0%B8%B1%E0%B8%9A%E0%B9%80%E0%B8%AD%E0%B8%87%20%E0%B8%A2%E0%B8%B7%E0%B8%99%E0%B8%A2%E0%B8%B1%E0%B8%99%E0%B9%80%E0%B8%9A%E0%B8%AD%E0%B8%A3%E0%B9%8C%202022.aspx"] [unique_id "aXpuTjVXNopcNyjJc9VXYQAAAkM"]
[Thu Jan 29 04:15:13.120830 2026] [:error] [pid 19177:tid 19185] [client 93.218.117.230:53451] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%20%E0%B8%81%E0%B8%94%E0%B8%A3%E0%B8%B1%E0%B8%9A%E0%B9%80%E0%B8%AD%E0%B8%87%2030.aspx"] [unique_id "aXpuUXipGz0PT8TrQv7eegAAAMY"]
[Thu Jan 29 04:15:13.772391 2026] [:error] [pid 20486:tid 20492] [client 93.218.117.230:53456] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%20%E0%B8%81%E0%B8%94%E0%B8%A3%E0%B8%B1%E0%B8%9A%E0%B9%80%E0%B8%AD%E0%B8%87%2030.aspx"] [unique_id "aXpuUXgqSZb6GBx5nnPFJwAAAQM"]
[Thu Jan 29 04:17:02.207407 2026] [:error] [pid 20580:tid 20688] [client 93.218.117.230:54213] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B8%A2%E0%B8%B7%E0%B8%99%E0%B8%A2%E0%B8%B1%E0%B8%99%E0%B9%80%E0%B8%9A%E0%B8%AD%E0%B8%A3%E0%B9%8C.aspx"] [unique_id "aXpuvpCZ5HHdXPmeL587XAAAApQ"]
[Thu Jan 29 04:17:02.854700 2026] [:error] [pid 20579:tid 20659] [client 93.218.117.230:54216] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B8%A2%E0%B8%B7%E0%B8%99%E0%B8%A2%E0%B8%B1%E0%B8%99%E0%B9%80%E0%B8%9A%E0%B8%AD%E0%B8%A3%E0%B9%8C.aspx"] [unique_id "aXpuvjVXNopcNyjJc9VX4gAAAlI"]
[Thu Jan 29 04:17:06.039957 2026] [:error] [pid 19069:tid 19102] [client 93.218.117.230:61491] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94%20%E0%B8%81%E0%B8%94%E0%B8%A3%E0%B8%B1%E0%B8%9A%E0%B9%80%E0%B8%AD%E0%B8%87.aspx"] [unique_id "aXpuwvDHsRM4BJ9a4QtF6gAAABg"]
[Thu Jan 29 04:17:06.732410 2026] [:error] [pid 20578:tid 20615] [client 93.218.117.230:54238] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94%20%E0%B8%81%E0%B8%94%E0%B8%A3%E0%B8%B1%E0%B8%9A%E0%B9%80%E0%B8%AD%E0%B8%87.aspx"] [unique_id "aXpuwg6UX7yOMwQFiydyAQAAAgI"]
[Thu Jan 29 04:17:09.814824 2026] [:error] [pid 20519:tid 20548] [client 93.218.117.230:54252] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXpuxQo4s4fyROrkyRkvzAAAAYA"]
[Thu Jan 29 04:17:10.463806 2026] [:error] [pid 20578:tid 20631] [client 93.218.117.230:54257] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXpuxg6UX7yOMwQFiydyBAAAAhI"]
[Thu Jan 29 04:17:13.559395 2026] [:error] [pid 19070:tid 19129] [client 93.218.117.230:54275] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B9%81%E0%B8%84%E0%B9%88%E0%B8%AA%E0%B8%A1%E0%B8%B1%E0%B8%84%E0%B8%A3.aspx"] [unique_id "aXpuybou83lIon_aKgYDEQAAAFc"]
[Thu Jan 29 04:17:14.204736 2026] [:error] [pid 20486:tid 20501] [client 93.218.117.230:54277] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B9%81%E0%B8%84%E0%B9%88%E0%B8%AA%E0%B8%A1%E0%B8%B1%E0%B8%84%E0%B8%A3.aspx"] [unique_id "aXpuyngqSZb6GBx5nnPFuAAAAQw"]
[Thu Jan 29 04:17:17.358255 2026] [:error] [pid 20578:tid 20629] [client 93.218.117.230:54299] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B8%9D%E0%B8%B2%E0%B8%81%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B9%81%E0%B8%8A%E0%B8%A3%E0%B9%8C%202022%20%E0%B8%81%E0%B8%94%E0%B8%A3%E0%B8%B1%E0%B8%9A%E0%B9%80%E0%B8%AD%E0%B8%87.aspx"] [unique_id "aXpuzQ6UX7yOMwQFiydyGgAAAhA"]
[Thu Jan 29 04:17:18.003598 2026] [:error] [pid 20579:tid 20641] [client 93.218.117.230:54301] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B8%9D%E0%B8%B2%E0%B8%81%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B9%81%E0%B8%8A%E0%B8%A3%E0%B9%8C%202022%20%E0%B8%81%E0%B8%94%E0%B8%A3%E0%B8%B1%E0%B8%9A%E0%B9%80%E0%B8%AD%E0%B8%87.aspx"] [unique_id "aXpuzjVXNopcNyjJc9VX7QAAAkA"]
[Thu Jan 29 04:17:21.232391 2026] [:error] [pid 19070:tid 19116] [client 93.218.117.230:54319] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B8%9D%E0%B8%B2%E0%B8%81%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B9%81%E0%B8%8A%E0%B8%A3%E0%B9%8C.aspx"] [unique_id "aXpu0bou83lIon_aKgYDIgAAAEo"]
[Thu Jan 29 04:17:21.921323 2026] [:error] [pid 19069:tid 19088] [client 93.218.117.230:54322] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B8%9D%E0%B8%B2%E0%B8%81%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B9%81%E0%B8%8A%E0%B8%A3%E0%B9%8C.aspx"] [unique_id "aXpu0fDHsRM4BJ9a4QtGBgAAAAo"]
[Thu Jan 29 04:17:25.097013 2026] [:error] [pid 20486:tid 20508] [client 93.218.117.230:54344] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B8%9D%E0%B8%B2%E0%B8%81%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B9%81%E0%B8%8A%E0%B8%A3%E0%B9%8C2021.aspx"] [unique_id "aXpu1XgqSZb6GBx5nnPF1AAAARM"]
[Thu Jan 29 04:17:25.741658 2026] [:error] [pid 20580:tid 20691] [client 93.218.117.230:54348] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B8%9D%E0%B8%B2%E0%B8%81%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B9%81%E0%B8%8A%E0%B8%A3%E0%B9%8C2021.aspx"] [unique_id "aXpu1ZCZ5HHdXPmeL587fgAAApc"]
[Thu Jan 29 04:17:28.930020 2026] [:error] [pid 20576:tid 20603] [client 93.218.117.230:54362] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B8%9D%E0%B8%B2%E0%B8%81.aspx"] [unique_id "aXpu2CrDZws_FlQGi9fAFgAAAdE"]
[Thu Jan 29 04:17:29.619014 2026] [:error] [pid 20486:tid 20497] [client 93.218.117.230:54368] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B8%9D%E0%B8%B2%E0%B8%81.aspx"] [unique_id "aXpu2XgqSZb6GBx5nnPF2wAAAQg"]
[Thu Jan 29 04:17:32.509850 2026] [:error] [pid 20576:tid 20588] [client 93.218.117.230:54381] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXpu3CrDZws_FlQGi9fAHgAAAcI"]
[Thu Jan 29 04:17:33.155948 2026] [:error] [pid 19069:tid 19090] [client 93.218.117.230:54385] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXpu3fDHsRM4BJ9a4QtGEwAAAAw"]
[Thu Jan 29 04:17:36.483726 2026] [:error] [pid 19069:tid 19093] [client 93.218.117.230:54400] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B550%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B8%9D%E0%B8%B2%E0%B8%81%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B9%81%E0%B8%8A%E0%B8%A3%E0%B9%8C.aspx"] [unique_id "aXpu4PDHsRM4BJ9a4QtGGAAAAA8"]
[Thu Jan 29 04:17:37.135609 2026] [:error] [pid 20579:tid 20663] [client 93.218.117.230:54401] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B550%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B8%9D%E0%B8%B2%E0%B8%81%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B9%81%E0%B8%8A%E0%B8%A3%E0%B9%8C.aspx"] [unique_id "aXpu4TVXNopcNyjJc9VYAQAAAlU"]
[Thu Jan 29 04:17:41.125699 2026] [:error] [pid 20578:tid 20617] [client 93.218.117.230:54430] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B550.aspx"] [unique_id "aXpu5Q6UX7yOMwQFiydyNAAAAgQ"]
[Thu Jan 29 04:17:42.832561 2026] [:error] [pid 19071:tid 19147] [client 93.218.117.230:54442] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B550.aspx"] [unique_id "aXpu5pfa8Ix5wWmtmJyGlgAAAI4"]
[Thu Jan 29 04:17:45.655112 2026] [:error] [pid 19071:tid 19147] [client 93.218.117.230:54459] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%8A%E0%B9%87%E0%B8%81%E0%B8%8A%E0%B8%B5%E0%B9%88%E0%B8%9A%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%88%E0%B8%B21688.aspx"] [unique_id "aXpu6Zfa8Ix5wWmtmJyGpAAAAI4"]
[Thu Jan 29 04:17:46.300759 2026] [:error] [pid 20580:tid 20673] [client 93.218.117.230:54463] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%8A%E0%B9%87%E0%B8%81%E0%B8%8A%E0%B8%B5%E0%B9%88%E0%B8%9A%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%88%E0%B8%B21688.aspx"] [unique_id "aXpu6pCZ5HHdXPmeL587mwAAAoU"]
[Thu Jan 29 04:17:49.146885 2026] [:error] [pid 20579:tid 20660] [client 93.218.117.230:61550] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%9A%20%E0%B8%97%20365.aspx"] [unique_id "aXpu7TVXNopcNyjJc9VYFgAAAlM"]
[Thu Jan 29 04:17:49.799981 2026] [:error] [pid 19069:tid 19087] [client 93.218.117.230:54481] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%9A%20%E0%B8%97%20365.aspx"] [unique_id "aXpu7fDHsRM4BJ9a4QtGKAAAAAk"]
[Thu Jan 29 04:17:53.940418 2026] [:error] [pid 20486:tid 20499] [client 93.218.117.230:54496] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%20%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%20%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpu8XgqSZb6GBx5nnPGBQAAAQo"]
[Thu Jan 29 04:17:54.628427 2026] [:error] [pid 19071:tid 19140] [client 93.218.117.230:54500] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%20%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%20%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpu8pfa8Ix5wWmtmJyGswAAAIc"]
[Thu Jan 29 04:19:37.997560 2026] [:error] [pid 19071:tid 19153] [client 93.218.117.230:54949] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%84%E0%B9%89%E0%B8%94%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94%E0%B8%A7%E0%B8%B1%E0%B8%99%E0%B8%99%E0%B8%B5%E0%B9%89.aspx"] [unique_id "aXpvWZfa8Ix5wWmtmJyHWQAAAJQ"]
[Thu Jan 29 04:19:38.687431 2026] [:error] [pid 20579:tid 20658] [client 93.218.117.230:61615] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%84%E0%B9%89%E0%B8%94%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94%E0%B8%A7%E0%B8%B1%E0%B8%99%E0%B8%99%E0%B8%B5%E0%B9%89.aspx"] [unique_id "aXpvWjVXNopcNyjJc9VYhgAAAlE"]
[Thu Jan 29 04:19:41.787694 2026] [:error] [pid 20519:tid 20555] [client 93.218.117.230:54968] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%84%E0%B9%89%E0%B8%94%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXpvXQo4s4fyROrkyRkwPwAAAYc"]
[Thu Jan 29 04:19:42.436480 2026] [:error] [pid 19071:tid 19149] [client 93.218.117.230:54974] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%84%E0%B9%89%E0%B8%94%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXpvXpfa8Ix5wWmtmJyHXwAAAJA"]
[Thu Jan 29 04:19:45.605319 2026] [:error] [pid 19071:tid 19152] [client 93.218.117.230:54989] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%9B%E0%B8%A3%20%E0%B8%97%E0%B8%B8%E0%B8%99%E0%B8%99%E0%B9%89%E0%B8%AD%E0%B8%A2%20%E0%B8%9D%E0%B8%B2%E0%B8%8110%E0%B8%A3%E0%B8%B1%E0%B8%9A100%20%E0%B9%83%E0%B8%AB%E0%B8%A1%E0%B9%88%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXpvYZfa8Ix5wWmtmJyHZQAAAJM"]
[Thu Jan 29 04:19:46.250817 2026] [:error] [pid 19071:tid 19133] [client 93.218.117.230:54990] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%9B%E0%B8%A3%20%E0%B8%97%E0%B8%B8%E0%B8%99%E0%B8%99%E0%B9%89%E0%B8%AD%E0%B8%A2%20%E0%B8%9D%E0%B8%B2%E0%B8%8110%E0%B8%A3%E0%B8%B1%E0%B8%9A100%20%E0%B9%83%E0%B8%AB%E0%B8%A1%E0%B9%88%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXpvYpfa8Ix5wWmtmJyHaQAAAIA"]
[Thu Jan 29 04:19:49.401409 2026] [:error] [pid 19177:tid 19186] [client 93.218.117.230:54998] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%9B%E0%B8%A3%20%E0%B8%9D%E0%B8%B2%E0%B8%8110%E0%B8%A3%E0%B8%B1%E0%B8%9A100%20%E0%B8%96%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%AD%E0%B8%B1%E0%B9%89%E0%B8%99%20%E0%B8%A7%E0%B8%AD%E0%B9%80%E0%B8%A5%E0%B8%97.aspx"] [unique_id "aXpvZXipGz0PT8TrQv7fwQAAAMc"]
[Thu Jan 29 04:19:50.101141 2026] [:error] [pid 20580:tid 20687] [client 93.218.117.230:55001] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%9B%E0%B8%A3%20%E0%B8%9D%E0%B8%B2%E0%B8%8110%E0%B8%A3%E0%B8%B1%E0%B8%9A100%20%E0%B8%96%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%AD%E0%B8%B1%E0%B9%89%E0%B8%99%20%E0%B8%A7%E0%B8%AD%E0%B9%80%E0%B8%A5%E0%B8%97.aspx"] [unique_id "aXpvZpCZ5HHdXPmeL588UAAAApM"]
[Thu Jan 29 04:19:53.704642 2026] [:error] [pid 19070:tid 19107] [client 93.218.117.230:55012] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%9B%E0%B8%A3%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%B8%E0%B8%99%E0%B8%99%E0%B9%89%E0%B8%AD%E0%B8%A2%2020%E0%B8%A3%E0%B8%B1%E0%B8%9A100%202%20%E0%B9%80%E0%B8%97%E0%B9%88%E0%B8%B2.aspx"] [unique_id "aXpvabou83lIon_aKgYD2AAAAEE"]
[Thu Jan 29 04:19:54.354211 2026] [:error] [pid 20576:tid 20593] [client 93.218.117.230:55017] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%9B%E0%B8%A3%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%B8%E0%B8%99%E0%B8%99%E0%B9%89%E0%B8%AD%E0%B8%A2%2020%E0%B8%A3%E0%B8%B1%E0%B8%9A100%202%20%E0%B9%80%E0%B8%97%E0%B9%88%E0%B8%B2.aspx"] [unique_id "aXpvairDZws_FlQGi9fAqwAAAcc"]
[Thu Jan 29 04:19:56.967790 2026] [:error] [pid 19177:tid 19188] [client 93.218.117.230:55031] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%9B%E0%B8%A3%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%B8%E0%B8%99%E0%B8%99%E0%B9%89%E0%B8%AD%E0%B8%A2.aspx"] [unique_id "aXpvbHipGz0PT8TrQv7fyQAAAMk"]
[Thu Jan 29 04:19:57.658872 2026] [:error] [pid 19071:tid 19133] [client 93.218.117.230:55033] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%9B%E0%B8%A3%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%B8%E0%B8%99%E0%B8%99%E0%B9%89%E0%B8%AD%E0%B8%A2.aspx"] [unique_id "aXpvbZfa8Ix5wWmtmJyHiwAAAIA"]
[Thu Jan 29 04:20:00.692750 2026] [:error] [pid 20578:tid 20618] [client 93.218.117.230:55044] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%9B%E0%B8%A3%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%AA%E0%B8%A1%E0%B8%B2%E0%B8%8A%E0%B8%B4%E0%B8%81%E0%B9%83%E0%B8%AB%E0%B8%A1%E0%B9%88%20%E0%B8%9D%E0%B8%B2%E0%B8%8110%E0%B8%A3%E0%B8%B1%E0%B8%9A100%20%E0%B8%A7%E0%B8%AD%20%E0%B9%80%E0%B8%A5%E0%B8%97%202565.aspx"] [unique_id "aXpvcA6UX7yOMwQFiydyvQAAAgU"]
[Thu Jan 29 04:20:01.352635 2026] [:error] [pid 20486:tid 20508] [client 93.218.117.230:55047] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%9B%E0%B8%A3%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%AA%E0%B8%A1%E0%B8%B2%E0%B8%8A%E0%B8%B4%E0%B8%81%E0%B9%83%E0%B8%AB%E0%B8%A1%E0%B9%88%20%E0%B8%9D%E0%B8%B2%E0%B8%8110%E0%B8%A3%E0%B8%B1%E0%B8%9A100%20%E0%B8%A7%E0%B8%AD%20%E0%B9%80%E0%B8%A5%E0%B8%97%202565.aspx"] [unique_id "aXpvcXgqSZb6GBx5nnPGtAAAARM"]
[Thu Jan 29 04:20:04.572149 2026] [:error] [pid 20579:tid 20648] [client 93.218.117.230:55059] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%9B%E0%B8%A3%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%AA%E0%B8%A1%E0%B8%B2%E0%B8%8A%E0%B8%B4%E0%B8%81%E0%B9%83%E0%B8%AB%E0%B8%A1%E0%B9%88%E0%B8%9D%E0%B8%B2%E0%B8%8110%E0%B8%A3%E0%B8%B1%E0%B8%9A100%E0%B8%A7%E0%B8%AD%E0%B9%80%E0%B8%A5%E0%B8%97.aspx"] [unique_id "aXpvdDVXNopcNyjJc9VYmAAAAkc"]
[Thu Jan 29 04:20:05.262905 2026] [:error] [pid 19070:tid 19128] [client 93.218.117.230:55061] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%9B%E0%B8%A3%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%AA%E0%B8%A1%E0%B8%B2%E0%B8%8A%E0%B8%B4%E0%B8%81%E0%B9%83%E0%B8%AB%E0%B8%A1%E0%B9%88%E0%B8%9D%E0%B8%B2%E0%B8%8110%E0%B8%A3%E0%B8%B1%E0%B8%9A100%E0%B8%A7%E0%B8%AD%E0%B9%80%E0%B8%A5%E0%B8%97.aspx"] [unique_id "aXpvdbou83lIon_aKgYD4gAAAFY"]
[Thu Jan 29 04:20:08.263129 2026] [:error] [pid 20580:tid 20681] [client 93.218.117.230:55074] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%9B%E0%B8%A3%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%AA%E0%B8%A1%E0%B8%B2%E0%B8%8A%E0%B8%B4%E0%B8%81%E0%B9%83%E0%B8%AB%E0%B8%A1%E0%B9%88%E0%B8%9D%E0%B8%B2%E0%B8%8110%E0%B8%A3%E0%B8%B1%E0%B8%9A100.aspx"] [unique_id "aXpveJCZ5HHdXPmeL588dgAAAo0"]
[Thu Jan 29 04:20:08.908666 2026] [:error] [pid 20519:tid 20569] [client 93.218.117.230:55076] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%9B%E0%B8%A3%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%AA%E0%B8%A1%E0%B8%B2%E0%B8%8A%E0%B8%B4%E0%B8%81%E0%B9%83%E0%B8%AB%E0%B8%A1%E0%B9%88%E0%B8%9D%E0%B8%B2%E0%B8%8110%E0%B8%A3%E0%B8%B1%E0%B8%9A100.aspx"] [unique_id "aXpveAo4s4fyROrkyRkwWAAAAZU"]
[Thu Jan 29 04:20:12.241164 2026] [:error] [pid 20579:tid 20651] [client 93.218.117.230:55086] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%9B%E0%B8%A3%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpvfDVXNopcNyjJc9VYnAAAAko"]
[Thu Jan 29 04:20:12.930466 2026] [:error] [pid 19177:tid 19199] [client 93.218.117.230:55087] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%82%E0%B8%9B%E0%B8%A3%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpvfHipGz0PT8TrQv7f3QAAANQ"]
[Thu Jan 29 04:20:15.886000 2026] [:error] [pid 20578:tid 20625] [client 93.218.117.230:55102] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%84%E0%B8%97%E0%B8%A2%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpvfw6UX7yOMwQFiydyywAAAgw"]
[Thu Jan 29 04:20:16.577163 2026] [:error] [pid 20486:tid 20504] [client 93.218.117.230:55105] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B9%84%E0%B8%97%E0%B8%A2%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXpvgHgqSZb6GBx5nnPG0AAAAQ8"]
[Thu Jan 29 04:20:19.710628 2026] [:error] [pid 20580:tid 20669] [client 93.218.117.230:55121] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/1%20pg%20slot%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXpvg5CZ5HHdXPmeL588fQAAAoI"]
[Thu Jan 29 04:20:20.359264 2026] [:error] [pid 20486:tid 20495] [client 93.218.117.230:55124] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/1%20pg%20slot%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXpvhHgqSZb6GBx5nnPG1QAAAQY"]
[Thu Jan 29 04:20:23.469498 2026] [:error] [pid 19071:tid 19143] [client 93.218.117.230:55135] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/1%E0%B8%A3%E0%B8%B1%E0%B8%9A100.aspx"] [unique_id "aXpvh5fa8Ix5wWmtmJyHoAAAAIo"]
[Thu Jan 29 04:20:24.158179 2026] [:error] [pid 19070:tid 19116] [client 93.218.117.230:55138] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/1%E0%B8%A3%E0%B8%B1%E0%B8%9A100.aspx"] [unique_id "aXpviLou83lIon_aKgYEAQAAAEo"]
[Thu Jan 29 04:20:27.575093 2026] [:error] [pid 20486:tid 20495] [client 93.218.117.230:55148] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/777slot.aspx"] [unique_id "aXpvi3gqSZb6GBx5nnPG4QAAAQY"]
[Thu Jan 29 04:20:28.221931 2026] [:error] [pid 19071:tid 19144] [client 93.218.117.230:55152] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/777slot.aspx"] [unique_id "aXpvjJfa8Ix5wWmtmJyHqQAAAIs"]
[Thu Jan 29 04:20:31.490349 2026] [:error] [pid 20580:tid 20687] [client 93.218.117.230:55164] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/777superslot.aspx"] [unique_id "aXpvj5CZ5HHdXPmeL588igAAApM"]
[Thu Jan 29 04:22:12.720591 2026] [:error] [pid 20578:tid 20629] [client 93.218.117.230:55542] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXpv9A6UX7yOMwQFiydzSAAAAhA"]
[Thu Jan 29 04:22:13.410050 2026] [:error] [pid 19070:tid 19112] [client 93.218.117.230:55549] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXpv9bou83lIon_aKgYEjAAAAEY"]
[Thu Jan 29 04:22:16.553803 2026] [:error] [pid 19070:tid 19129] [client 93.218.117.230:61658] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%2050.aspx"] [unique_id "aXpv-Lou83lIon_aKgYEkQAAAFc"]
[Thu Jan 29 04:22:17.241966 2026] [:error] [pid 20519:tid 20560] [client 93.218.117.230:55564] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%2050.aspx"] [unique_id "aXpv-Qo4s4fyROrkyRkw3wAAAYw"]
[Thu Jan 29 04:22:20.197790 2026] [:error] [pid 20579:tid 20656] [client 93.218.117.230:55576] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXpv_DVXNopcNyjJc9VZLQAAAk8"]
[Thu Jan 29 04:22:20.843265 2026] [:error] [pid 19071:tid 19139] [client 93.218.117.230:55578] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXpv_Jfa8Ix5wWmtmJyIYwAAAIY"]
[Thu Jan 29 04:22:23.386568 2026] [:error] [pid 19069:tid 19080] [client 93.218.117.230:55585] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%20%E0%B8%AD%E0%B8%B1%E0%B8%99%E0%B8%94%E0%B8%B1%E0%B8%9A%201.aspx"] [unique_id "aXpv__DHsRM4BJ9a4QtHaQAAAAI"]
[Thu Jan 29 04:22:24.030657 2026] [:error] [pid 20486:tid 20495] [client 93.218.117.230:55588] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%20%E0%B8%AD%E0%B8%B1%E0%B8%99%E0%B8%94%E0%B8%B1%E0%B8%9A%201.aspx"] [unique_id "aXpwAHgqSZb6GBx5nnPHigAAAQY"]
[Thu Jan 29 04:22:27.113153 2026] [:error] [pid 20576:tid 20609] [client 93.218.117.230:55602] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXpwAyrDZws_FlQGi9fBHwAAAdc"]
[Thu Jan 29 04:22:27.803633 2026] [:error] [pid 19071:tid 19146] [client 93.218.117.230:55604] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXpwA5fa8Ix5wWmtmJyIdQAAAI0"]
[Thu Jan 29 04:22:31.253507 2026] [:error] [pid 19070:tid 19126] [client 93.218.117.230:55618] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20%E0%B9%83%E0%B8%AB%E0%B8%A1%E0%B9%88%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXpwB7ou83lIon_aKgYEoAAAAFQ"]
[Thu Jan 29 04:22:31.947503 2026] [:error] [pid 20580:tid 20681] [client 93.218.117.230:55622] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20%E0%B9%83%E0%B8%AB%E0%B8%A1%E0%B9%88%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXpwB5CZ5HHdXPmeL5887QAAAo0"]
[Thu Jan 29 04:22:35.229969 2026] [:error] [pid 20519:tid 20563] [client 93.218.117.230:55631] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20auto%20%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXpwCwo4s4fyROrkyRkw6QAAAY8"]
[Thu Jan 29 04:22:35.875450 2026] [:error] [pid 19071:tid 19138] [client 93.218.117.230:55635] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20auto%20%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXpwC5fa8Ix5wWmtmJyIfgAAAIU"]
[Thu Jan 29 04:22:39.265803 2026] [:error] [pid 19069:tid 19078] [client 93.218.117.230:55644] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20auto.aspx"] [unique_id "aXpwD_DHsRM4BJ9a4QtHgwAAAAA"]
[Thu Jan 29 04:22:39.954493 2026] [:error] [pid 19069:tid 19095] [client 93.218.117.230:55645] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20auto.aspx"] [unique_id "aXpwD_DHsRM4BJ9a4QtHhwAAABE"]
[Thu Jan 29 04:22:43.188764 2026] [:error] [pid 19070:tid 19108] [client 93.218.117.230:55657] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20game.aspx"] [unique_id "aXpwE7ou83lIon_aKgYEsQAAAEI"]
[Thu Jan 29 04:22:43.860015 2026] [:error] [pid 19070:tid 19124] [client 93.218.117.230:55661] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20game.aspx"] [unique_id "aXpwE7ou83lIon_aKgYEsgAAAFI"]
[Thu Jan 29 04:22:46.876310 2026] [:error] [pid 20486:tid 20499] [client 93.218.117.230:55666] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20vip.aspx"] [unique_id "aXpwFngqSZb6GBx5nnPHnQAAAQo"]
[Thu Jan 29 04:22:47.521027 2026] [:error] [pid 19070:tid 19111] [client 93.218.117.230:55669] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20vip.aspx"] [unique_id "aXpwF7ou83lIon_aKgYEugAAAEU"]
[Thu Jan 29 04:22:50.519283 2026] [:error] [pid 19070:tid 19126] [client 93.218.117.230:55678] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot.aspx"] [unique_id "aXpwGrou83lIon_aKgYE1AAAAFQ"]
[Thu Jan 29 04:22:51.209031 2026] [:error] [pid 20578:tid 20631] [client 93.218.117.230:55679] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot.aspx"] [unique_id "aXpwGw6UX7yOMwQFiydzYwAAAhI"]
[Thu Jan 29 04:22:54.513646 2026] [:error] [pid 20576:tid 20590] [client 93.218.117.230:55689] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot168.aspx"] [unique_id "aXpwHirDZws_FlQGi9fBLAAAAcQ"]
[Thu Jan 29 04:22:55.202205 2026] [:error] [pid 20576:tid 20589] [client 93.218.117.230:55691] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot168.aspx"] [unique_id "aXpwHyrDZws_FlQGi9fBLQAAAcM"]
[Thu Jan 29 04:22:58.197397 2026] [:error] [pid 19071:tid 19156] [client 93.218.117.230:55700] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot99.aspx"] [unique_id "aXpwIpfa8Ix5wWmtmJyIlAAAAJc"]
[Thu Jan 29 04:22:58.842558 2026] [:error] [pid 19177:tid 19197] [client 93.218.117.230:55706] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot99.aspx"] [unique_id "aXpwInipGz0PT8TrQv7gfwAAANI"]
[Thu Jan 29 04:23:02.123373 2026] [:error] [pid 19177:tid 19186] [client 93.218.117.230:55715] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20soft.aspx"] [unique_id "aXpwJnipGz0PT8TrQv7ghQAAAMc"]
[Thu Jan 29 04:23:02.767964 2026] [:error] [pid 19069:tid 19083] [client 93.218.117.230:55719] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20soft.aspx"] [unique_id "aXpwJvDHsRM4BJ9a4QtHpgAAAAU"]
[Thu Jan 29 04:23:06.051458 2026] [:error] [pid 20576:tid 20596] [client 93.218.117.230:55725] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20th.aspx"] [unique_id "aXpwKirDZws_FlQGi9fBNAAAAco"]
[Thu Jan 29 04:23:06.739240 2026] [:error] [pid 19177:tid 19190] [client 93.218.117.230:55727] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20th.aspx"] [unique_id "aXpwKnipGz0PT8TrQv7glQAAAMs"]
[Thu Jan 29 04:24:46.884511 2026] [:error] [pid 20579:tid 20644] [client 93.218.117.230:56014] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pgneko.aspx"] [unique_id "aXpwjjVXNopcNyjJc9VZ0AAAAkM"]
[Thu Jan 29 04:24:47.529509 2026] [:error] [pid 19177:tid 19186] [client 93.218.117.230:56015] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pgneko.aspx"] [unique_id "aXpwj3ipGz0PT8TrQv7g5gAAAMc"]
[Thu Jan 29 04:24:50.476725 2026] [:error] [pid 19070:tid 19127] [client 93.218.117.230:56027] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pgslot%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXpwkrou83lIon_aKgYFTwAAAFU"]
[Thu Jan 29 04:24:51.163114 2026] [:error] [pid 19070:tid 19107] [client 93.218.117.230:56029] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pgslot%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXpwk7ou83lIon_aKgYFUgAAAEE"]
[Thu Jan 29 04:24:54.082628 2026] [:error] [pid 19070:tid 19130] [client 93.218.117.230:56038] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pgslot%20login.aspx"] [unique_id "aXpwlrou83lIon_aKgYFVQAAAFg"]
[Thu Jan 29 04:24:54.770281 2026] [:error] [pid 20579:tid 20651] [client 93.218.117.230:56039] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pgslot%20login.aspx"] [unique_id "aXpwljVXNopcNyjJc9VZ2gAAAko"]
[Thu Jan 29 04:24:58.004772 2026] [:error] [pid 19071:tid 19145] [client 93.218.117.230:56050] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pgslot.aspx"] [unique_id "aXpwmpfa8Ix5wWmtmJyJKQAAAIw"]
[Thu Jan 29 04:24:58.648042 2026] [:error] [pid 20579:tid 20655] [client 93.218.117.230:56051] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pgslot.aspx"] [unique_id "aXpwmjVXNopcNyjJc9VZ2wAAAk4"]
[Thu Jan 29 04:25:01.659853 2026] [:error] [pid 20519:tid 20552] [client 93.218.117.230:56062] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pgslot99.aspx"] [unique_id "aXpwnQo4s4fyROrkyRkxXwAAAYQ"]
[Thu Jan 29 04:25:02.347167 2026] [:error] [pid 19071:tid 19146] [client 93.218.117.230:56063] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pgslot99.aspx"] [unique_id "aXpwnpfa8Ix5wWmtmJyJLwAAAI0"]
[Thu Jan 29 04:25:05.683559 2026] [:error] [pid 19070:tid 19130] [client 93.218.117.230:56073] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufa700.aspx"] [unique_id "aXpwobou83lIon_aKgYFYQAAAFg"]
[Thu Jan 29 04:25:06.370111 2026] [:error] [pid 19070:tid 19120] [client 93.218.117.230:56076] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufa700.aspx"] [unique_id "aXpworou83lIon_aKgYFZAAAAE4"]
[Thu Jan 29 04:25:09.654917 2026] [:error] [pid 20580:tid 20676] [client 93.218.117.230:56086] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufa747%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXpwpZCZ5HHdXPmeL589pAAAAog"]
[Thu Jan 29 04:25:10.342041 2026] [:error] [pid 19070:tid 19115] [client 93.218.117.230:56087] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufa747%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXpwprou83lIon_aKgYFcgAAAEk"]
[Thu Jan 29 04:25:13.064487 2026] [:error] [pid 19069:tid 19079] [client 93.218.117.230:56095] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufa77.aspx"] [unique_id "aXpwqfDHsRM4BJ9a4QtIYwAAAAE"]
[Thu Jan 29 04:25:13.709921 2026] [:error] [pid 20486:tid 20507] [client 93.218.117.230:56096] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufa77.aspx"] [unique_id "aXpwqXgqSZb6GBx5nnPIpAAAARI"]
[Thu Jan 29 04:25:16.596984 2026] [:error] [pid 20578:tid 20622] [client 93.218.117.230:56098] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufa777%20%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%AA%E0%B8%B9%E0%B9%88%E0%B8%A3%E0%B8%B0%E0%B8%9A%E0%B8%9A.aspx"] [unique_id "aXpwrA6UX7yOMwQFiydz5wAAAgk"]
[Thu Jan 29 04:25:17.241357 2026] [:error] [pid 19069:tid 19099] [client 93.218.117.230:56100] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufa777%20%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%AA%E0%B8%B9%E0%B9%88%E0%B8%A3%E0%B8%B0%E0%B8%9A%E0%B8%9A.aspx"] [unique_id "aXpwrfDHsRM4BJ9a4QtIZwAAABU"]
[Thu Jan 29 04:25:20.112070 2026] [:error] [pid 19177:tid 19193] [client 93.218.117.230:56110] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufa777.aspx"] [unique_id "aXpwsHipGz0PT8TrQv7hAAAAAM4"]
[Thu Jan 29 04:25:20.799950 2026] [:error] [pid 20519:tid 20555] [client 93.218.117.230:56111] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufa777.aspx"] [unique_id "aXpwsAo4s4fyROrkyRkxagAAAYc"]
[Thu Jan 29 04:25:24.087363 2026] [:error] [pid 20580:tid 20673] [client 93.218.117.230:56118] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufa7777.aspx"] [unique_id "aXpwtJCZ5HHdXPmeL589rgAAAoU"]
[Thu Jan 29 04:25:24.733329 2026] [:error] [pid 19069:tid 19095] [client 93.218.117.230:56121] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufa7777.aspx"] [unique_id "aXpwtPDHsRM4BJ9a4QtIbgAAABE"]
[Thu Jan 29 04:25:27.561923 2026] [:error] [pid 20580:tid 20686] [client 93.218.117.230:56123] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufa789.aspx"] [unique_id "aXpwt5CZ5HHdXPmeL589sQAAApI"]
[Thu Jan 29 04:25:28.208274 2026] [:error] [pid 20579:tid 20668] [client 93.218.117.230:56124] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufa789.aspx"] [unique_id "aXpwuDVXNopcNyjJc9VZ8QAAAlg"]
[Thu Jan 29 04:25:31.510135 2026] [:error] [pid 20576:tid 20591] [client 93.218.117.230:56134] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufaauto.aspx"] [unique_id "aXpwuyrDZws_FlQGi9fBtgAAAcU"]
[Thu Jan 29 04:25:32.198374 2026] [:error] [pid 19069:tid 19087] [client 93.218.117.230:56135] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufaauto.aspx"] [unique_id "aXpwvPDHsRM4BJ9a4QtIcgAAAAk"]
[Thu Jan 29 04:25:35.106196 2026] [:error] [pid 19071:tid 19136] [client 93.218.117.230:56142] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufabet%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXpwv5fa8Ix5wWmtmJyJVQAAAIM"]
[Thu Jan 29 04:25:35.751484 2026] [:error] [pid 19071:tid 19140] [client 93.218.117.230:56144] [client 93.218.117.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufabet%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXpwv5fa8Ix5wWmtmJyJVwAAAIc"]
[Thu Jan 29 05:39:52.175686 2026] [:error] [pid 20578:tid 20635] [client 54.38.241.153:43722] [client 54.38.241.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.241.153, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXqCKA6UX7yOMwQFiyeCDQAAAhY"]
[Thu Jan 29 06:38:17.185912 2026] [:error] [pid 20576:tid 20592] [client 149.224.15.220:64236] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%9D%E0%B8%B2%E0%B8%8110%E0%B8%A3%E0%B8%B1%E0%B8%9A100%20%E0%B8%A7%E0%B8%AD%E0%B9%80%E0%B8%A5%E0%B8%97%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXqP2SrDZws_FlQGi9fYvQAAAcY"]
[Thu Jan 29 06:38:19.335993 2026] [:error] [pid 20576:tid 20598] [client 149.224.15.220:64366] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%9D%E0%B8%B2%E0%B8%8110%E0%B8%A3%E0%B8%B1%E0%B8%9A100%20%E0%B8%A7%E0%B8%AD%E0%B9%80%E0%B8%A5%E0%B8%97.aspx"] [unique_id "aXqP2yrDZws_FlQGi9fYvgAAAcw"]
[Thu Jan 29 06:38:21.654521 2026] [:error] [pid 20486:tid 20507] [client 149.224.15.220:62658] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95.aspx"] [unique_id "aXqP3XgqSZb6GBx5nnP2aAAAARI"]
[Thu Jan 29 06:38:24.069336 2026] [:error] [pid 20486:tid 20498] [client 149.224.15.220:61092] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95100.aspx"] [unique_id "aXqP4HgqSZb6GBx5nnP2cAAAAQk"]
[Thu Jan 29 06:38:26.470781 2026] [:error] [pid 19069:tid 19092] [client 149.224.15.220:60915] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%A1%E0%B8%B2%E0%B9%80%E0%B8%9F%E0%B8%B5%E0%B8%A2%20%E0%B8%97%E0%B8%B1%E0%B9%89%E0%B8%87%E0%B8%AB%E0%B8%A1%E0%B8%94.aspx"] [unique_id "aXqP4vDHsRM4BJ9a4Qtm_wAAAA4"]
[Thu Jan 29 06:38:28.899791 2026] [:error] [pid 19177:tid 19196] [client 149.224.15.220:62211] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%A2%E0%B8%B9%E0%B8%9F%E0%B9%88%E0%B8%B2888.aspx"] [unique_id "aXqP5HipGz0PT8TrQv74iQAAANE"]
[Thu Jan 29 06:38:31.258009 2026] [:error] [pid 20486:tid 20499] [client 149.224.15.220:64093] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%A3%E0%B8%B1%E0%B8%9A%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXqP53gqSZb6GBx5nnP2eQAAAQo"]
[Thu Jan 29 06:38:33.820703 2026] [:error] [pid 20576:tid 20609] [client 149.224.15.220:64358] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%A3%E0%B8%B1%E0%B8%9A%E0%B9%82%E0%B8%9B%E0%B8%A3.aspx"] [unique_id "aXqP6SrDZws_FlQGi9fYzAAAAdc"]
[Thu Jan 29 06:38:36.183741 2026] [:error] [pid 19069:tid 19086] [client 149.224.15.220:59274] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%A7%E0%B8%AD%E0%B9%80%E0%B8%A5%E0%B8%97%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXqP7PDHsRM4BJ9a4QtnDAAAAAg"]
[Thu Jan 29 06:38:38.489969 2026] [:error] [pid 19177:tid 19194] [client 149.224.15.220:65084] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%A7%E0%B8%AD%E0%B9%80%E0%B8%A5%E0%B8%97%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXqP7nipGz0PT8TrQv74jAAAAM8"]
[Thu Jan 29 06:38:40.649501 2026] [:error] [pid 20486:tid 20500] [client 149.224.15.220:59275] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%AD%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%A5%E0%B8%99%E0%B9%8C%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95.aspx"] [unique_id "aXqP8HgqSZb6GBx5nnP2lgAAAQs"]
[Thu Jan 29 06:38:42.958447 2026] [:error] [pid 20579:tid 20650] [client 149.224.15.220:59283] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%AD%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%A5%E0%B8%99%E0%B9%8C.aspx"] [unique_id "aXqP8jVXNopcNyjJc9Vz2wAAAkk"]
[Thu Jan 29 06:38:45.100434 2026] [:error] [pid 20578:tid 20628] [client 149.224.15.220:62391] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%20100%20%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B9%81%E0%B8%8A%E0%B8%A3%E0%B9%8C%202024.aspx"] [unique_id "aXqP9Q6UX7yOMwQFiyeNTgAAAg8"]
[Thu Jan 29 06:38:47.572038 2026] [:error] [pid 20486:tid 20495] [client 149.224.15.220:63498] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%20100%20%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B9%81%E0%B8%8A%E0%B8%A3%E0%B9%8C.aspx"] [unique_id "aXqP93gqSZb6GBx5nnP2nQAAAQY"]
[Thu Jan 29 06:38:49.945094 2026] [:error] [pid 20578:tid 20625] [client 149.224.15.220:60862] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%2050%20%E0%B8%9A%E0%B8%B2%E0%B8%97%20%E0%B9%81%E0%B8%84%E0%B9%88%E0%B8%AA%E0%B8%A1%E0%B8%B1%E0%B8%84%E0%B8%A3.aspx"] [unique_id "aXqP-Q6UX7yOMwQFiyeNVQAAAgw"]
[Thu Jan 29 06:38:52.216869 2026] [:error] [pid 19177:tid 19179] [client 149.224.15.220:63918] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%20mukob.aspx"] [unique_id "aXqP_HipGz0PT8TrQv74mwAAAMA"]
[Thu Jan 29 06:38:54.644134 2026] [:error] [pid 19071:tid 19156] [client 149.224.15.220:64898] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXqP_pfa8Ix5wWmtmJyt0wAAAJc"]
[Thu Jan 29 06:38:56.895070 2026] [:error] [pid 20580:tid 20665] [client 149.224.15.220:59557] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B8%9D%E0%B8%B2%E0%B8%81.aspx"] [unique_id "aXqQAJCZ5HHdXPmeL59aAAAAAoA"]
[Thu Jan 29 06:38:59.341628 2026] [:error] [pid 20580:tid 20681] [client 149.224.15.220:63737] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXqQA5CZ5HHdXPmeL59aBQAAAo0"]
[Thu Jan 29 06:39:01.976920 2026] [:error] [pid 19069:tid 19098] [client 149.224.15.220:60481] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%95%E0%B8%B4%E0%B8%A1true%20wallet%20%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%A1%E0%B8%B5%E0%B8%82%E0%B8%B1%E0%B9%89%E0%B8%99%E0%B8%95%E0%B9%88%E0%B9%8D%E0%B8%B22020.aspx"] [unique_id "aXqQBfDHsRM4BJ9a4QtnHwAAABQ"]
[Thu Jan 29 06:39:04.424973 2026] [:error] [pid 20519:tid 20549] [client 149.224.15.220:63514] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%20%E0%B8%9D%E0%B8%B2%E0%B8%81%E0%B8%96%E0%B8%AD%E0%B8%99%20true%20wallet%20%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%A1%E0%B8%B5%20%E0%B8%82%E0%B8%B1%E0%B9%89%E0%B8%99%20%E0%B8%95%E0%B9%88%E0%B9%8D%E0%B8%B2%2010%20%E0%B8%A3%E0%B8%B1%E0%B8%9A%20100.aspx"] [unique_id "aXqQCAo4s4fyROrkyRlJ4gAAAYE"]
[Thu Jan 29 06:39:06.807953 2026] [:error] [pid 20580:tid 20685] [client 149.224.15.220:64631] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%20%E0%B8%9D%E0%B8%B2%E0%B8%81%E0%B8%96%E0%B8%AD%E0%B8%99%20true%20wallet%20%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%A1%E0%B8%B5%20%E0%B8%82%E0%B8%B1%E0%B9%89%E0%B8%99%20%E0%B8%95%E0%B9%88%E0%B9%8D%E0%B8%B2%202024.aspx"] [unique_id "aXqQCpCZ5HHdXPmeL59aDgAAApE"]
[Thu Jan 29 06:39:09.283967 2026] [:error] [pid 20486:tid 20505] [client 149.224.15.220:60179] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%20%E0%B8%9D%E0%B8%B2%E0%B8%81%E0%B8%96%E0%B8%AD%E0%B8%99%20true%20wallet%20%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%A1%E0%B8%B5%20%E0%B8%82%E0%B8%B1%E0%B9%89%E0%B8%99%20%E0%B8%95%E0%B9%88%E0%B9%8D%E0%B8%B2.aspx"] [unique_id "aXqQDXgqSZb6GBx5nnP2ugAAARA"]
[Thu Jan 29 06:39:11.667338 2026] [:error] [pid 20486:tid 20489] [client 149.224.15.220:60589] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%20%E0%B8%9D%E0%B8%B2%E0%B8%81%E0%B8%96%E0%B8%AD%E0%B8%99%20true%20wallet%20%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%A1%E0%B8%B5%E0%B8%82%E0%B8%B1%E0%B9%89%E0%B8%99%20%E0%B8%95%E0%B9%88%E0%B9%8D%E0%B8%B2.aspx"] [unique_id "aXqQD3gqSZb6GBx5nnP2vQAAAQA"]
[Thu Jan 29 06:40:49.647211 2026] [:error] [pid 19177:tid 19180] [client 149.224.15.220:61752] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%81%E0%B8%88%E0%B8%81%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXqQcXipGz0PT8TrQv742gAAAME"]
[Thu Jan 29 06:40:52.220475 2026] [:error] [pid 20519:tid 20550] [client 149.224.15.220:62067] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%81%E0%B8%95%E0%B8%81%E0%B8%87%E0%B9%88%E0%B8%B2%E0%B8%A2.aspx"] [unique_id "aXqQdAo4s4fyROrkyRlKSQAAAYI"]
[Thu Jan 29 06:40:54.798856 2026] [:error] [pid 20486:tid 20511] [client 149.224.15.220:60347] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%81%E0%B8%95%E0%B8%81%E0%B8%94%E0%B8%B5.aspx"] [unique_id "aXqQdngqSZb6GBx5nnP3bgAAARY"]
[Thu Jan 29 06:40:56.924475 2026] [:error] [pid 20580:tid 20684] [client 149.224.15.220:61847] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%81%E0%B8%95%E0%B8%81%E0%B8%AB%E0%B8%99%E0%B8%B1%E0%B8%81.aspx"] [unique_id "aXqQeJCZ5HHdXPmeL59aXQAAApA"]
[Thu Jan 29 06:40:59.406642 2026] [:error] [pid 20486:tid 20504] [client 149.224.15.220:59839] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%82%E0%B8%88%E0%B9%8A%E0%B8%81%E0%B9%80%E0%B8%81%E0%B8%AD%E0%B8%A3%E0%B9%8C.aspx"] [unique_id "aXqQe3gqSZb6GBx5nnP3fgAAAQ8"]
[Thu Jan 29 06:41:01.980360 2026] [:error] [pid 20519:tid 20553] [client 149.224.15.220:59359] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%82%E0%B8%88%E0%B9%8A%E0%B8%81%E0%B9%80%E0%B8%81%E0%B8%AD%E0%B8%A3%E0%B9%8C123.aspx"] [unique_id "aXqQfQo4s4fyROrkyRlKTQAAAYU"]
[Thu Jan 29 06:41:04.307237 2026] [:error] [pid 20486:tid 20511] [client 149.224.15.220:61007] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%82%E0%B8%88%E0%B9%8A%E0%B8%81%E0%B9%80%E0%B8%81%E0%B8%AD%E0%B8%A3%E0%B9%8C168.aspx"] [unique_id "aXqQgHgqSZb6GBx5nnP3hAAAARY"]
[Thu Jan 29 06:41:06.567342 2026] [:error] [pid 19069:tid 19093] [client 149.224.15.220:63523] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%82%E0%B8%88%E0%B9%8A%E0%B8%81%E0%B9%80%E0%B8%81%E0%B8%AD%E0%B8%A3%E0%B9%8C888.aspx"] [unique_id "aXqQgvDHsRM4BJ9a4QtndAAAAA8"]
[Thu Jan 29 06:41:08.866693 2026] [:error] [pid 20578:tid 20630] [client 149.224.15.220:61716] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%82%E0%B8%9B%E0%B8%A310%E0%B8%A3%E0%B8%B1%E0%B8%9A100.aspx"] [unique_id "aXqQhA6UX7yOMwQFiyeNyAAAAhE"]
[Thu Jan 29 06:41:11.045094 2026] [:error] [pid 19070:tid 19106] [client 149.224.15.220:64597] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%A1%E0%B8%B5%E0%B8%82%E0%B8%B1%E0%B9%89%E0%B8%99%E0%B8%95%E0%B9%88%E0%B9%8D%E0%B8%B2.aspx"] [unique_id "aXqQh7ou83lIon_aKgYjTQAAAEA"]
[Thu Jan 29 06:41:13.296383 2026] [:error] [pid 20578:tid 20636] [client 149.224.15.220:63409] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXqQiQ6UX7yOMwQFiyeNzAAAAhc"]
[Thu Jan 29 06:41:15.712760 2026] [:error] [pid 20486:tid 20497] [client 149.224.15.220:60394] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95168%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXqQi3gqSZb6GBx5nnP3iAAAAQg"]
[Thu Jan 29 06:41:18.734988 2026] [:error] [pid 20576:tid 20607] [client 149.224.15.220:64813] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%9520%E0%B8%A3%E0%B8%B1%E0%B8%9A100.aspx"] [unique_id "aXqQjirDZws_FlQGi9fZRgAAAdU"]
[Thu Jan 29 06:41:21.511791 2026] [:error] [pid 20486:tid 20500] [client 149.224.15.220:63471] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%9524.aspx"] [unique_id "aXqQkXgqSZb6GBx5nnP3igAAAQs"]
[Thu Jan 29 06:41:24.171963 2026] [:error] [pid 20519:tid 20564] [client 149.224.15.220:60050] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95333%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXqQlAo4s4fyROrkyRlKWwAAAZA"]
[Thu Jan 29 06:41:26.548609 2026] [:error] [pid 19071:tid 19136] [client 149.224.15.220:63306] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95369.aspx"] [unique_id "aXqQlpfa8Ix5wWmtmJyunAAAAIM"]
[Thu Jan 29 06:41:29.766469 2026] [:error] [pid 20580:tid 20687] [client 149.224.15.220:64420] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95555.aspx"] [unique_id "aXqQmZCZ5HHdXPmeL59aaQAAApM"]
[Thu Jan 29 06:41:32.129393 2026] [:error] [pid 19177:tid 19201] [client 149.224.15.220:61584] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95678.aspx"] [unique_id "aXqQnHipGz0PT8TrQv745gAAANY"]
[Thu Jan 29 06:41:35.101652 2026] [:error] [pid 19069:tid 19082] [client 149.224.15.220:62391] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%9569.aspx"] [unique_id "aXqQn_DHsRM4BJ9a4QtngwAAAAQ"]
[Thu Jan 29 06:41:37.827451 2026] [:error] [pid 20519:tid 20556] [client 149.224.15.220:63667] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95777%20pg.aspx"] [unique_id "aXqQoQo4s4fyROrkyRlKZQAAAYg"]
[Thu Jan 29 06:41:40.358157 2026] [:error] [pid 20579:tid 20666] [client 149.224.15.220:59142] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95777%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXqQpDVXNopcNyjJc9V0YQAAAlc"]
[Thu Jan 29 06:41:42.985778 2026] [:error] [pid 19071:tid 19142] [client 149.224.15.220:63507] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95789.aspx"] [unique_id "aXqQppfa8Ix5wWmtmJyurQAAAIk"]
[Thu Jan 29 06:41:45.888767 2026] [:error] [pid 19069:tid 19085] [client 149.224.15.220:59682] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%9588.aspx"] [unique_id "aXqQqfDHsRM4BJ9a4QtnigAAAAc"]
[Thu Jan 29 06:43:12.092868 2026] [:error] [pid 19071:tid 19157] [client 149.224.15.220:64257] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ruay.%20org%20%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%AA%E0%B8%B9%E0%B9%88%E0%B8%A3%E0%B8%B0%E0%B8%9A%E0%B8%9A.aspx"] [unique_id "aXqRAJfa8Ix5wWmtmJyvFgAAAJg"]
[Thu Jan 29 06:43:14.250880 2026] [:error] [pid 20486:tid 20511] [client 149.224.15.220:61854] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/sbobet%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%20%E0%B8%A1%E0%B8%B7%E0%B8%AD%E0%B8%96%E0%B8%B7%E0%B8%AD.aspx"] [unique_id "aXqRAngqSZb6GBx5nnP4ogAAARY"]
[Thu Jan 29 06:43:16.476961 2026] [:error] [pid 19177:tid 19196] [client 149.224.15.220:61295] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/sbobet%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXqRBHipGz0PT8TrQv75PAAAANE"]
[Thu Jan 29 06:43:18.652768 2026] [:error] [pid 20519:tid 20557] [client 149.224.15.220:61172] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/sbobet%20%E0%B8%A1%E0%B8%B7%E0%B8%AD%E0%B8%96%E0%B8%B7%E0%B8%AD.aspx"] [unique_id "aXqRBgo4s4fyROrkyRlKoQAAAYk"]
[Thu Jan 29 06:43:21.309708 2026] [:error] [pid 20579:tid 20659] [client 149.224.15.220:59243] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/sbobet%20%E0%B8%A1%E0%B8%B7%E0%B8%AD%E0%B8%96%E0%B8%B7%E0%B8%AD777.aspx"] [unique_id "aXqRCTVXNopcNyjJc9V0vAAAAlI"]
[Thu Jan 29 06:43:23.496008 2026] [:error] [pid 20578:tid 20622] [client 149.224.15.220:60786] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/sbobet%20auto.aspx"] [unique_id "aXqRCw6UX7yOMwQFiyeOWgAAAgk"]
[Thu Jan 29 06:43:25.862095 2026] [:error] [pid 19177:tid 19179] [client 149.224.15.220:59753] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/sbobet%20ca.aspx"] [unique_id "aXqRDXipGz0PT8TrQv75SQAAAMA"]
[Thu Jan 29 06:43:28.862557 2026] [:error] [pid 20519:tid 20556] [client 149.224.15.220:60505] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/sbobet.aspx"] [unique_id "aXqREAo4s4fyROrkyRlKqwAAAYg"]
[Thu Jan 29 06:43:31.279613 2026] [:error] [pid 19070:tid 19106] [client 149.224.15.220:64872] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/shorturl%20asia%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXqRE7ou83lIon_aKgYkEAAAAEA"]
[Thu Jan 29 06:43:33.620069 2026] [:error] [pid 20486:tid 20496] [client 149.224.15.220:63115] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/sll%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXqRFXgqSZb6GBx5nnP4ygAAAQc"]
[Thu Jan 29 06:43:36.349835 2026] [:error] [pid 20486:tid 20494] [client 149.224.15.220:59710] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot%20%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87.aspx"] [unique_id "aXqRGHgqSZb6GBx5nnP40gAAAQU"]
[Thu Jan 29 06:43:38.755239 2026] [:error] [pid 20579:tid 20644] [client 149.224.15.220:64834] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot%20demo.aspx"] [unique_id "aXqRGjVXNopcNyjJc9V04wAAAkM"]
[Thu Jan 29 06:43:40.813932 2026] [:error] [pid 20519:tid 20566] [client 149.224.15.220:60839] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot%20free.aspx"] [unique_id "aXqRHAo4s4fyROrkyRlKzAAAAZI"]
[Thu Jan 29 06:43:43.430234 2026] [:error] [pid 20486:tid 20498] [client 149.224.15.220:63166] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot%20joker.aspx"] [unique_id "aXqRH3gqSZb6GBx5nnP46QAAAQk"]
[Thu Jan 29 06:43:46.076389 2026] [:error] [pid 20486:tid 20501] [client 149.224.15.220:64323] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot%20pg%20%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99.aspx"] [unique_id "aXqRIngqSZb6GBx5nnP48AAAAQw"]
[Thu Jan 29 06:43:48.432207 2026] [:error] [pid 20578:tid 20615] [client 149.224.15.220:59152] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot%20pg%20soft.aspx"] [unique_id "aXqRJA6UX7yOMwQFiyeObAAAAgI"]
[Thu Jan 29 06:43:50.970448 2026] [:error] [pid 20519:tid 20557] [client 149.224.15.220:61052] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot%20pg%20vip.aspx"] [unique_id "aXqRJgo4s4fyROrkyRlK2AAAAYk"]
[Thu Jan 29 06:43:53.368749 2026] [:error] [pid 20580:tid 20684] [client 149.224.15.220:61787] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot%20pg%20wallet.aspx"] [unique_id "aXqRKZCZ5HHdXPmeL59bTQAAApA"]
[Thu Jan 29 06:43:55.610100 2026] [:error] [pid 20580:tid 20671] [client 149.224.15.220:64253] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufa168bet.aspx"] [unique_id "aXqRK5CZ5HHdXPmeL59bTgAAAoM"]
[Thu Jan 29 06:43:57.942868 2026] [:error] [pid 19070:tid 19130] [client 149.224.15.220:61105] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufa356%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXqRLbou83lIon_aKgYkRgAAAFg"]
[Thu Jan 29 06:44:00.763663 2026] [:error] [pid 19071:tid 19147] [client 149.224.15.220:63825] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufa365%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXqRMJfa8Ix5wWmtmJyvTQAAAI4"]
[Thu Jan 29 06:44:02.917838 2026] [:error] [pid 20578:tid 20614] [client 149.224.15.220:64050] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufa369%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXqRMg6UX7yOMwQFiyeOeAAAAgE"]
[Thu Jan 29 06:44:05.289620 2026] [:error] [pid 20579:tid 20659] [client 149.224.15.220:63694] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufa369.aspx"] [unique_id "aXqRNTVXNopcNyjJc9V0-QAAAlI"]
[Thu Jan 29 06:45:35.541447 2026] [:error] [pid 19069:tid 19100] [client 149.224.15.220:60417] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufabet%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B9%81%E0%B8%A1%E0%B9%88.aspx"] [unique_id "aXqRj_DHsRM4BJ9a4QtoWAAAABY"]
[Thu Jan 29 06:45:37.788168 2026] [:error] [pid 20579:tid 20652] [client 149.224.15.220:59896] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufabet%20100.aspx"] [unique_id "aXqRkTVXNopcNyjJc9V1YQAAAks"]
[Thu Jan 29 06:45:40.098323 2026] [:error] [pid 19070:tid 19116] [client 149.224.15.220:60354] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufabet%201668.aspx"] [unique_id "aXqRlLou83lIon_aKgYkpQAAAEo"]
[Thu Jan 29 06:45:42.230070 2026] [:error] [pid 19071:tid 19146] [client 149.224.15.220:62511] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufabet%207777.aspx"] [unique_id "aXqRlpfa8Ix5wWmtmJyvoQAAAI0"]
[Thu Jan 29 06:45:44.492961 2026] [:error] [pid 20580:tid 20679] [client 149.224.15.220:59211] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aXqRmJCZ5HHdXPmeL59blAAAAos"]
[Thu Jan 29 06:45:47.293816 2026] [:error] [pid 20578:tid 20623] [client 149.224.15.220:59909] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufabet%20net.aspx"] [unique_id "aXqRmw6UX7yOMwQFiyeOzAAAAgo"]
[Thu Jan 29 06:45:49.895519 2026] [:error] [pid 20578:tid 20617] [client 149.224.15.220:64044] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "aXqRnQ6UX7yOMwQFiyeOzgAAAgQ"]
[Thu Jan 29 06:45:52.726907 2026] [:error] [pid 19177:tid 19202] [client 149.224.15.220:64143] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufabet168%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXqRoHipGz0PT8TrQv75ywAAANc"]
[Thu Jan 29 06:45:54.921480 2026] [:error] [pid 20580:tid 20691] [client 149.224.15.220:60238] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufabet168%20%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%AA%E0%B8%B9%E0%B9%88%E0%B8%A3%E0%B8%B0%E0%B8%9A%E0%B8%9A.aspx"] [unique_id "aXqRopCZ5HHdXPmeL59bqQAAApc"]
[Thu Jan 29 06:45:57.291870 2026] [:error] [pid 20576:tid 20605] [client 149.224.15.220:62571] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufabet1688%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXqRpSrDZws_FlQGi9fZ-gAAAdM"]
[Thu Jan 29 06:45:59.365365 2026] [:error] [pid 19070:tid 19130] [client 149.224.15.220:61715] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufabet365%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXqRp7ou83lIon_aKgYkvgAAAFg"]
[Thu Jan 29 06:46:02.530343 2026] [:error] [pid 19071:tid 19143] [client 149.224.15.220:60803] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufabet777.aspx"] [unique_id "aXqRqpfa8Ix5wWmtmJyvswAAAIo"]
[Thu Jan 29 06:46:05.362220 2026] [:error] [pid 20486:tid 20508] [client 149.224.15.220:59918] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufabet789.aspx"] [unique_id "aXqRrXgqSZb6GBx5nnP56QAAARM"]
[Thu Jan 29 06:46:08.080487 2026] [:error] [pid 19071:tid 19153] [client 149.224.15.220:59275] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufaseven.aspx"] [unique_id "aXqRsJfa8Ix5wWmtmJyvwAAAAJQ"]
[Thu Jan 29 06:46:10.892323 2026] [:error] [pid 20580:tid 20680] [client 149.224.15.220:62497] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufavip.aspx"] [unique_id "aXqRspCZ5HHdXPmeL59bsAAAAow"]
[Thu Jan 29 06:46:13.524447 2026] [:error] [pid 19069:tid 19085] [client 149.224.15.220:59318] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/v9slot.aspx"] [unique_id "aXqRtfDHsRM4BJ9a4QtofQAAAAc"]
[Thu Jan 29 06:46:15.925861 2026] [:error] [pid 19070:tid 19114] [client 149.224.15.220:61797] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/victory%20club%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXqRt7ou83lIon_aKgYk0QAAAEg"]
[Thu Jan 29 06:46:18.418056 2026] [:error] [pid 19071:tid 19154] [client 149.224.15.220:63557] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/w69%20slot%20%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%20188%20%E0%B8%9A%E0%B8%B2%E0%B8%97.aspx"] [unique_id "aXqRupfa8Ix5wWmtmJyvyAAAAJU"]
[Thu Jan 29 06:46:21.163053 2026] [:error] [pid 19069:tid 19079] [client 149.224.15.220:62938] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/w69%20slot.aspx"] [unique_id "aXqRvfDHsRM4BJ9a4QtogwAAAAE"]
[Thu Jan 29 06:46:24.290205 2026] [:error] [pid 19071:tid 19151] [client 149.224.15.220:63385] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/w88%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXqRwJfa8Ix5wWmtmJyvzQAAAJI"]
[Thu Jan 29 06:46:26.666196 2026] [:error] [pid 20519:tid 20564] [client 149.224.15.220:61299] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/wallet%20slot.aspx"] [unique_id "aXqRwgo4s4fyROrkyRlLZAAAAZA"]
[Thu Jan 29 06:46:28.807951 2026] [:error] [pid 19069:tid 19081] [client 149.224.15.220:64109] [client 149.224.15.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/warpufa.aspx"] [unique_id "aXqRxPDHsRM4BJ9a4QtoiwAAAAM"]
[Thu Jan 29 06:51:34.375777 2026] [:error] [pid 19071:tid 19134] [client 79.98.45.16:60926] [client 79.98.45.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.98.45.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXqS9pfa8Ix5wWmtmJyxHQAAAIE"]
[Thu Jan 29 07:58:26.549402 2026] [:error] [pid 20578:tid 20633] [client 104.37.191.206:56184] [client 104.37.191.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.37.191.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXqiog6UX7yOMwQFiyebcQAAAhQ"]
[Thu Jan 29 08:01:10.009409 2026] [:error] [pid 20579:tid 20644] [client 149.40.53.3:40636] [client 149.40.53.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.40.53.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXqjRjVXNopcNyjJc9WDLwAAAkM"]
[Thu Jan 29 08:01:12.089481 2026] [:error] [pid 20579:tid 20643] [client 149.40.53.3:40636] [client 149.40.53.3] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aXqjSDVXNopcNyjJc9WDMwAAAkI"]
[Thu Jan 29 08:01:12.245735 2026] [:error] [pid 20579:tid 20657] [client 149.40.53.3:40636] [client 149.40.53.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.40.53.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXqjSDVXNopcNyjJc9WDNAAAAlA"]
[Thu Jan 29 08:01:13.550008 2026] [:error] [pid 19070:tid 19109] [client 149.40.53.3:47912] [client 149.40.53.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.40.53.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXqjSbou83lIon_aKgY2xwAAAEM"]
[Thu Jan 29 08:01:14.814568 2026] [:error] [pid 19070:tid 19112] [client 149.40.53.3:47928] [client 149.40.53.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.40.53.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXqjSrou83lIon_aKgY2yAAAAEY"]
[Thu Jan 29 08:01:16.048250 2026] [:error] [pid 20486:tid 20513] [client 149.40.53.3:47936] [client 149.40.53.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.40.53.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXqjTHgqSZb6GBx5nnMVawAAARg"]
[Thu Jan 29 08:01:17.264137 2026] [:error] [pid 19071:tid 19154] [client 149.40.53.3:47942] [client 149.40.53.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.40.53.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXqjTZfa8Ix5wWmtmJzDhgAAAJU"]
[Thu Jan 29 08:01:17.264276 2026] [:error] [pid 19071:tid 19154] [client 149.40.53.3:47942] [client 149.40.53.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 149.40.53.3, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXqjTZfa8Ix5wWmtmJzDhgAAAJU"]
[Thu Jan 29 09:02:37.653600 2026] [:error] [pid 20519:tid 20564] [client 178.212.148.253:36856] [client 178.212.148.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.212.148.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXqxrQo4s4fyROrkyRlixAAAAZA"]
[Thu Jan 29 09:10:18.108015 2026] [:error] [pid 19071:tid 19151] [client 43.164.197.177:41308] [client 43.164.197.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXqzepfa8Ix5wWmtmJzXxgAAAJI"]
[Thu Jan 29 09:15:18.932490 2026] [:error] [pid 20519:tid 20572] [client 220.121.103.167:63660] [client 220.121.103.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.121.103.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXq0pgo4s4fyROrkyRllJAAAAZg"]
[Thu Jan 29 09:15:20.869977 2026] [:error] [pid 19177:tid 19190] [client 220.121.103.167:63820] [client 220.121.103.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.121.103.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXq0qHipGz0PT8TrQv4VaAAAAMs"]
[Thu Jan 29 09:16:01.955860 2026] [:error] [pid 20486:tid 20505] [client 59.110.143.128:46856] [client 59.110.143.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.110.143.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXq00XgqSZb6GBx5nnMxjgAAARA"]
[Thu Jan 29 09:16:04.306452 2026] [:error] [pid 20576:tid 20606] [client 59.110.143.128:46862] [client 59.110.143.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.110.143.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXq01CrDZws_FlQGi9f0fgAAAdQ"]
[Thu Jan 29 09:16:51.028825 2026] [:error] [pid 20486:tid 20492] [client 185.2.6.14:43764] [client 185.2.6.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.2.6.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXq1A3gqSZb6GBx5nnMx7wAAAQM"]
[Thu Jan 29 09:16:53.123047 2026] [:error] [pid 19069:tid 19082] [client 185.2.6.14:43768] [client 185.2.6.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.2.6.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXq1BfDHsRM4BJ9a4QuKXgAAAAQ"]
[Thu Jan 29 09:17:28.927894 2026] [:error] [pid 20576:tid 20588] [client 47.99.186.219:37558] [client 47.99.186.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.99.186.219, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXq1KCrDZws_FlQGi9f02AAAAcI"]
[Thu Jan 29 09:17:31.469307 2026] [:error] [pid 19069:tid 19091] [client 47.99.186.219:37570] [client 47.99.186.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.99.186.219, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXq1K_DHsRM4BJ9a4QuKggAAAA0"]
[Thu Jan 29 10:14:23.666961 2026] [:error] [pid 19071:tid 19148] [client 185.237.252.236:45384] [client 185.237.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.237.252.236, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXrCf5fa8Ix5wWmtmJzq5wAAAI8"]
[Thu Jan 29 10:27:10.042186 2026] [:error] [pid 20519:tid 20555] [client 122.51.236.174:42202] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXrFfgo4s4fyROrkyRlyRQAAAYc"]
[Thu Jan 29 10:59:27.647261 2026] [autoindex:error] [pid 20486:tid 20497] [client 207.180.246.239:57076] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu Jan 29 11:29:44.264875 2026] [:error] [pid 20576:tid 20605] [client 171.7.11.20:41324] [client 171.7.11.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 171.7.11.20, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXrUKCrDZws_FlQGi9cMagAAAdM"], referer: https://expressinteriors.com/wp-login.php
[Thu Jan 29 11:29:46.095249 2026] [:error] [pid 20576:tid 20597] [client 171.7.11.20:41324] [client 171.7.11.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 171.7.11.20, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXrUKirDZws_FlQGi9cMbQAAAcs"], referer: https://mylistingexpert.com/wp-login.php
[Thu Jan 29 11:44:09.299821 2026] [:error] [pid 20486:tid 20497] [client 155.94.150.238:51525] [client 155.94.150.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aXrXiXgqSZb6GBx5nnNqNQAAAQg"], referer: www.google.com
[Thu Jan 29 11:44:42.417585 2026] [:error] [pid 20580:tid 20691] [client 155.94.150.238:51696] [client 155.94.150.238] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/jaida/lang.php"] [unique_id "aXrXqpCZ5HHdXPmeL5-adwAAApc"], referer: www.google.com
[Thu Jan 29 12:04:42.479516 2026] [:error] [pid 20486:tid 20511] [client 81.167.26.57:48195] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20xo.aspx"] [unique_id "aXrcWngqSZb6GBx5nnNx0gAAARY"]
[Thu Jan 29 12:04:44.595544 2026] [:error] [pid 20580:tid 20690] [client 81.167.26.57:61888] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%B8%E0%B8%81%E0%B8%84%E0%B9%88%E0%B8%B2%E0%B8%A2%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXrcXJCZ5HHdXPmeL5-fjgAAApY"]
[Thu Jan 29 12:04:46.715121 2026] [:error] [pid 20578:tid 20634] [client 81.167.26.57:38122] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%B8%E0%B8%81%E0%B8%84%E0%B9%88%E0%B8%B2%E0%B8%A2.aspx"] [unique_id "aXrcXg6UX7yOMwQFiyfMQQAAAhU"]
[Thu Jan 29 12:04:48.832526 2026] [:error] [pid 19069:tid 19095] [client 81.167.26.57:29482] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%20%E0%B8%96%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%94%E0%B9%89.aspx"] [unique_id "aXrcYPDHsRM4BJ9a4QuwTwAAABE"]
[Thu Jan 29 12:04:50.945506 2026] [:error] [pid 19069:tid 19090] [client 81.167.26.57:29087] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%20%E0%B9%84%E0%B8%A1%E0%B9%88%20%E0%B8%AA%E0%B8%B0%E0%B8%94%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXrcYvDHsRM4BJ9a4QuwVQAAAAw"]
[Thu Jan 29 12:04:52.917821 2026] [:error] [pid 19069:tid 19082] [client 81.167.26.57:64353] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%202020.aspx"] [unique_id "aXrcZPDHsRM4BJ9a4QuwVgAAAAQ"]
[Thu Jan 29 12:04:55.040926 2026] [:error] [pid 20578:tid 20637] [client 81.167.26.57:23887] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%2088.aspx"] [unique_id "aXrcZw6UX7yOMwQFiyfMRQAAAhg"]
[Thu Jan 29 12:04:57.154650 2026] [:error] [pid 19070:tid 19117] [client 81.167.26.57:17061] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%20joker.aspx"] [unique_id "aXrcabou83lIon_aKgZ2DAAAAEs"]
[Thu Jan 29 12:04:59.273868 2026] [:error] [pid 19177:tid 19191] [client 81.167.26.57:19741] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B8%AA%E0%B8%9B%E0%B8%B4%E0%B8%99.aspx"] [unique_id "aXrca3ipGz0PT8TrQv4zLwAAAMw"]
[Thu Jan 29 12:05:01.384584 2026] [:error] [pid 19071:tid 19149] [client 81.167.26.57:39657] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXrcbZfa8Ix5wWmtmJwMJAAAAJA"]
[Thu Jan 29 12:05:03.510624 2026] [:error] [pid 20580:tid 20686] [client 81.167.26.57:58535] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%A3%E0%B8%A7%E0%B8%A1%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20888.aspx"] [unique_id "aXrcb5CZ5HHdXPmeL5-foAAAApI"]
[Thu Jan 29 12:05:05.625838 2026] [:error] [pid 20576:tid 20600] [client 81.167.26.57:11864] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%A3%E0%B8%A7%E0%B8%A1%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXrccSrDZws_FlQGi9cTFQAAAc4"]
[Thu Jan 29 12:05:07.742324 2026] [:error] [pid 20578:tid 20632] [client 81.167.26.57:61889] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%A3%E0%B8%A7%E0%B8%A2%E0%B8%88%E0%B8%B1%E0%B8%87%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXrccw6UX7yOMwQFiyfMVQAAAhM"]
[Thu Jan 29 12:05:10.017473 2026] [:error] [pid 19069:tid 19088] [client 81.167.26.57:31057] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%A3%E0%B8%B1%E0%B8%9A%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXrcdvDHsRM4BJ9a4QuwcAAAAAo"]
[Thu Jan 29 12:05:11.997337 2026] [:error] [pid 20486:tid 20509] [client 81.167.26.57:64070] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%A7%E0%B8%AD%20%E0%B9%80%E0%B8%A5%E0%B8%97.aspx"] [unique_id "aXrcd3gqSZb6GBx5nnNx8gAAARQ"]
[Thu Jan 29 12:05:14.129444 2026] [:error] [pid 19071:tid 19147] [client 81.167.26.57:50841] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%A7%E0%B8%B4%E0%B8%98%E0%B8%B5%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20pg%20%E0%B9%83%E0%B8%AB%E0%B9%89%20%E0%B9%81%E0%B8%95%E0%B8%81.aspx"] [unique_id "aXrcepfa8Ix5wWmtmJwMNwAAAI4"]
[Thu Jan 29 12:05:16.242943 2026] [:error] [pid 20519:tid 20569] [client 81.167.26.57:14708] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A1%E0%B8%B1%E0%B8%84%E0%B8%A3%20sbobet.aspx"] [unique_id "aXrcfAo4s4fyROrkyRmEZwAAAZU"]
[Thu Jan 29 12:05:18.237350 2026] [:error] [pid 19177:tid 19188] [client 81.167.26.57:5591] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A1%E0%B8%B1%E0%B8%84%E0%B8%A3%E0%B8%9A%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%88%E0%B8%B2.aspx"] [unique_id "aXrcfnipGz0PT8TrQv4zRAAAAMk"]
[Thu Jan 29 12:05:20.227287 2026] [:error] [pid 19069:tid 19097] [client 81.167.26.57:29515] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A1%E0%B8%B1%E0%B8%84%E0%B8%A3%E0%B8%9A%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%88%E0%B8%B2888.aspx"] [unique_id "aXrcgPDHsRM4BJ9a4QuweAAAABM"]
[Thu Jan 29 12:05:22.199411 2026] [:error] [pid 20576:tid 20603] [client 81.167.26.57:13653] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A1%E0%B8%B1%E0%B8%84%E0%B8%A3%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXrcgirDZws_FlQGi9cTKAAAAdE"]
[Thu Jan 29 12:05:24.329915 2026] [:error] [pid 19071:tid 19155] [client 81.167.26.57:53877] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A1%E0%B8%B1%E0%B8%84%E0%B8%A3%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXrchJfa8Ix5wWmtmJwMUQAAAJY"]
[Thu Jan 29 12:05:26.448494 2026] [:error] [pid 20578:tid 20626] [client 81.167.26.57:28618] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A1%E0%B8%B1%E0%B8%84%E0%B8%A3%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXrchg6UX7yOMwQFiyfMZwAAAg0"]
[Thu Jan 29 12:05:28.571910 2026] [:error] [pid 20486:tid 20493] [client 81.167.26.57:16219] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%9F%E0%B8%A3%E0%B8%B5%20%E0%B8%96%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%94%E0%B9%89%20%E0%B8%A7%E0%B8%AD%20%E0%B9%80%E0%B8%A5%E0%B8%97.aspx"] [unique_id "aXrciHgqSZb6GBx5nnNyCAAAAQQ"]
[Thu Jan 29 12:05:30.687410 2026] [:error] [pid 20486:tid 20491] [client 81.167.26.57:6480] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%9F%E0%B8%A3%E0%B8%B5%20%E0%B8%96%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%94%E0%B9%89%20%E0%B9%83%E0%B8%AB%E0%B8%A1%E0%B9%88%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXrcingqSZb6GBx5nnNyCgAAAQI"]
[Thu Jan 29 12:05:32.811368 2026] [:error] [pid 19071:tid 19140] [client 81.167.26.57:48913] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%9F%E0%B8%A3%E0%B8%B5%20100.aspx"] [unique_id "aXrcjJfa8Ix5wWmtmJwMaQAAAIc"]
[Thu Jan 29 12:05:35.539933 2026] [:error] [pid 20580:tid 20673] [client 81.167.26.57:14138] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%9F%E0%B8%A3%E0%B8%B5%20pg.aspx"] [unique_id "aXrcj5CZ5HHdXPmeL5-ftgAAAoU"]
[Thu Jan 29 12:05:37.519807 2026] [:error] [pid 20519:tid 20557] [client 81.167.26.57:1208] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXrckQo4s4fyROrkyRmEhQAAAYk"]
[Thu Jan 29 12:05:39.635488 2026] [:error] [pid 20580:tid 20682] [client 81.167.26.57:24076] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87.aspx"] [unique_id "aXrck5CZ5HHdXPmeL5-fuAAAAo4"]
[Thu Jan 29 12:06:53.640793 2026] [:error] [pid 20578:tid 20625] [client 81.167.26.57:7992] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%20100%20%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B9%81%E0%B8%8A%E0%B8%A3%E0%B9%8C.aspx"] [unique_id "aXrc3Q6UX7yOMwQFiyfMnAAAAgw"]
[Thu Jan 29 12:06:55.763707 2026] [:error] [pid 19070:tid 19108] [client 81.167.26.57:39731] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%2050%20%E0%B8%96%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%94%E0%B9%89%20300.aspx"] [unique_id "aXrc37ou83lIon_aKgZ2jwAAAEI"]
[Thu Jan 29 12:06:57.887815 2026] [:error] [pid 20576:tid 20591] [client 81.167.26.57:12329] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B9%80%E0%B8%95%E0%B8%B4%E0%B8%A1%20true%20wallet%20%E0%B8%9D%E0%B8%B2%E0%B8%81-%E0%B8%96%E0%B8%AD%E0%B8%99%20%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%A1%E0%B8%B5%20%E0%B8%82%E0%B8%B1%E0%B9%89%E0%B8%99%20%E0%B8%95%E0%B9%88%E0%B9%8D%E0%B8%B2%202020.aspx"] [unique_id "aXrc4SrDZws_FlQGi9cTbAAAAcU"]
[Thu Jan 29 12:07:00.013195 2026] [:error] [pid 20486:tid 20510] [client 81.167.26.57:30307] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%20%E0%B8%82%E0%B8%B1%E0%B9%89%E0%B8%99%E0%B8%95%E0%B9%88%E0%B8%B3%201%20%E0%B8%9A%E0%B8%B2%E0%B8%97.aspx"] [unique_id "aXrc5HgqSZb6GBx5nnNyegAAARU"]
[Thu Jan 29 12:07:02.123209 2026] [:error] [pid 20486:tid 20499] [client 81.167.26.57:32829] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%20%E0%B8%A2%E0%B8%B8%E0%B9%82%E0%B8%A3%E0%B8%9B.aspx"] [unique_id "aXrc5ngqSZb6GBx5nnNyfwAAAQo"]
[Thu Jan 29 12:07:04.263783 2026] [:error] [pid 19069:tid 19098] [client 81.167.26.57:9008] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%9C%E0%B9%88%E0%B8%B2%E0%B8%99%E0%B9%80%E0%B8%AD%E0%B9%80%E0%B8%A2%E0%B9%88%E0%B8%99%E0%B8%95%E0%B9%8C%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%A1%E0%B8%B5%E0%B8%82%E0%B8%B1%E0%B9%89%E0%B8%99%E0%B8%95%E0%B9%88%E0%B8%B3.aspx"] [unique_id "aXrc6PDHsRM4BJ9a4QuwywAAABQ"]
[Thu Jan 29 12:07:06.427977 2026] [:error] [pid 19070:tid 19110] [client 81.167.26.57:11898] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXrc6rou83lIon_aKgZ2mgAAAEQ"]
[Thu Jan 29 12:07:08.547845 2026] [:error] [pid 19177:tid 19181] [client 81.167.26.57:26195] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B9%83%E0%B8%AB%E0%B8%8D%E0%B9%88%20pg.aspx"] [unique_id "aXrc7HipGz0PT8TrQv4zewAAAMI"]
[Thu Jan 29 12:07:10.523167 2026] [:error] [pid 20576:tid 20608] [client 81.167.26.57:24632] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B9%84%E0%B8%AB%E0%B8%99%E0%B8%94%E0%B8%B5%20%E0%B9%81%E0%B8%95%E0%B8%81%E0%B8%87%E0%B9%88%E0%B8%B2%E0%B8%A2.aspx"] [unique_id "aXrc7irDZws_FlQGi9cTfQAAAdY"]
[Thu Jan 29 12:07:12.516788 2026] [:error] [pid 19177:tid 19193] [client 81.167.26.57:45614] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B9%81%E0%B8%88%E0%B8%81%E0%B8%97%E0%B8%B8%E0%B8%99%E0%B8%9F%E0%B8%A3%E0%B8%B5%20%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%A1%E0%B8%B5%20%E0%B9%80%E0%B8%87%E0%B8%B7%E0%B9%88%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%82.aspx"] [unique_id "aXrc8HipGz0PT8TrQv4zfgAAAM4"]
[Thu Jan 29 12:07:14.639846 2026] [:error] [pid 20580:tid 20682] [client 81.167.26.57:39138] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20168%20%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXrc8pCZ5HHdXPmeL5-gFwAAAo4"]
[Thu Jan 29 12:07:16.773252 2026] [:error] [pid 19069:tid 19089] [client 81.167.26.57:17539] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%201688%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXrc9PDHsRM4BJ9a4Quw3QAAAAs"]
[Thu Jan 29 12:07:18.894176 2026] [:error] [pid 19069:tid 19082] [client 81.167.26.57:23057] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20777%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%20%E0%B8%A7%E0%B8%AD%E0%B9%80%E0%B8%A5%E0%B8%97.aspx"] [unique_id "aXrc9vDHsRM4BJ9a4Quw4AAAAAQ"]
[Thu Jan 29 12:07:21.041624 2026] [:error] [pid 20580:tid 20688] [client 81.167.26.57:55689] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20777%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%9C%E0%B9%88%E0%B8%B2%E0%B8%99%E0%B9%80%E0%B8%AD%E0%B9%80%E0%B8%A2%E0%B9%88%E0%B8%99%E0%B8%95%E0%B9%8C.aspx"] [unique_id "aXrc-ZCZ5HHdXPmeL5-gGgAAApQ"]
[Thu Jan 29 12:07:23.157480 2026] [:error] [pid 20486:tid 20498] [client 81.167.26.57:36201] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20777%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXrc-3gqSZb6GBx5nnNylAAAAQk"]
[Thu Jan 29 12:07:25.276280 2026] [:error] [pid 19069:tid 19087] [client 81.167.26.57:10644] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20789%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXrc_fDHsRM4BJ9a4Quw6AAAAAk"]
[Thu Jan 29 12:07:27.236368 2026] [:error] [pid 19070:tid 19117] [client 81.167.26.57:17530] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20789.aspx"] [unique_id "aXrc_7ou83lIon_aKgZ2ogAAAEs"]
[Thu Jan 29 12:07:29.228642 2026] [:error] [pid 19177:tid 19195] [client 81.167.26.57:13642] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%2088%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXrdAXipGz0PT8TrQv4zogAAANA"]
[Thu Jan 29 12:07:31.358616 2026] [:error] [pid 20579:tid 20641] [client 81.167.26.57:38812] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%2088.aspx"] [unique_id "aXrdAzVXNopcNyjJc9W0DQAAAkA"]
[Thu Jan 29 12:07:33.484099 2026] [:error] [pid 20580:tid 20682] [client 81.167.26.57:38217] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20888%20%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%2050.aspx"] [unique_id "aXrdBZCZ5HHdXPmeL5-gKQAAAo4"]
[Thu Jan 29 12:07:35.445099 2026] [:error] [pid 20486:tid 20494] [client 81.167.26.57:63902] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20888%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%20%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%9C%E0%B9%88%E0%B8%B2%E0%B8%99%E0%B9%80%E0%B8%AD%E0%B9%80%E0%B8%A2%E0%B9%88%E0%B8%99%E0%B8%95%E0%B9%8C%20%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%A1%E0%B8%B5%20%E0%B8%82%E0%B8%B1%E0%B9%89%E0%B8%99%E0%B8%95%E0%B9%88%E0%B8%B3.aspx"] [unique_id "aXrdB3gqSZb6GBx5nnNymgAAAQU"]
[Thu Jan 29 12:07:37.584438 2026] [:error] [pid 20519:tid 20563] [client 81.167.26.57:57898] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20888.aspx"] [unique_id "aXrdCQo4s4fyROrkyRmE9QAAAY8"]
[Thu Jan 29 12:07:39.570312 2026] [:error] [pid 20580:tid 20675] [client 81.167.26.57:59830] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20g2g.aspx"] [unique_id "aXrdC5CZ5HHdXPmeL5-gQQAAAoc"]
[Thu Jan 29 12:07:41.697976 2026] [:error] [pid 20580:tid 20674] [client 81.167.26.57:33182] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20pg%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%20%E0%B9%81%E0%B8%95%E0%B8%81%E0%B8%AB%E0%B8%99%E0%B8%B1%E0%B8%81%20%E0%B8%9D%E0%B8%B2%E0%B8%81%E0%B8%96%E0%B8%AD%E0%B8%99%20%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%A1%E0%B8%B5%20%E0%B8%82%E0%B8%B1%E0%B9%89%E0%B8%99%20%E0%B8%95%E0%B9%88%E0%B9%8D%E0%B8%B2.aspx"] [unique_id "aXrdDZCZ5HHdXPmeL5-gQwAAAoY"]
[Thu Jan 29 12:07:43.826096 2026] [:error] [pid 19071:tid 19154] [client 81.167.26.57:26837] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20pg%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%20%E0%B9%81%E0%B8%95%E0%B8%81%E0%B8%AB%E0%B8%99%E0%B8%B1%E0%B8%81%20%E0%B8%A7%E0%B8%AD%20%E0%B9%80%E0%B8%A5%E0%B8%97.aspx"] [unique_id "aXrdD5fa8Ix5wWmtmJwNMwAAAJU"]
[Thu Jan 29 12:07:45.956241 2026] [:error] [pid 20486:tid 20501] [client 81.167.26.57:29361] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20pg%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%20%E0%B9%81%E0%B8%95%E0%B8%81%E0%B8%AB%E0%B8%99%E0%B8%B1%E0%B8%81%202024.aspx"] [unique_id "aXrdEXgqSZb6GBx5nnNyowAAAQw"]
[Thu Jan 29 12:07:48.075595 2026] [:error] [pid 19071:tid 19134] [client 81.167.26.57:17564] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20pg%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%20%E0%B9%81%E0%B8%95%E0%B8%81%E0%B8%AB%E0%B8%99%E0%B8%B1%E0%B8%81.aspx"] [unique_id "aXrdFJfa8Ix5wWmtmJwNNwAAAIE"]
[Thu Jan 29 12:08:39.120261 2026] [:error] [pid 20519:tid 20565] [client 81.167.26.57:48752] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20wallet%20%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B550.aspx"] [unique_id "aXrdRwo4s4fyROrkyRmFJQAAAZE"]
[Thu Jan 29 12:08:40.933860 2026] [:error] [pid 19177:tid 19181] [client 81.167.26.57:44243] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20xo%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87%20%E0%B8%9D%E0%B8%B2%E0%B8%81%E0%B8%96%E0%B8%AD%E0%B8%99%20%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%A1%E0%B8%B5%20%E0%B8%82%E0%B8%B1%E0%B9%89%E0%B8%99%E0%B8%95%E0%B9%88%E0%B8%B3.aspx"] [unique_id "aXrdSHipGz0PT8TrQv40BQAAAMI"]
[Thu Jan 29 12:08:43.059681 2026] [:error] [pid 20519:tid 20558] [client 81.167.26.57:33443] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20xo.aspx"] [unique_id "aXrdSwo4s4fyROrkyRmFLQAAAYo"]
[Thu Jan 29 12:08:45.181779 2026] [:error] [pid 19069:tid 19092] [client 81.167.26.57:33307] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%84%E0%B9%88%E0%B8%B2%E0%B8%A2%E0%B9%83%E0%B8%AB%E0%B8%8D%E0%B9%88.aspx"] [unique_id "aXrdTfDHsRM4BJ9a4QuxvwAAAA4"]
[Thu Jan 29 12:08:47.307964 2026] [:error] [pid 20576:tid 20602] [client 81.167.26.57:44129] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%88%E0%B8%B5%E0%B8%84%E0%B8%A5%E0%B8%B1%E0%B8%9A.aspx"] [unique_id "aXrdTyrDZws_FlQGi9cUEQAAAdA"]
[Thu Jan 29 12:08:49.430937 2026] [:error] [pid 19070:tid 19123] [client 81.167.26.57:1860] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%95%E0%B9%88%E0%B8%B2%E0%B8%87%E0%B8%9B%E0%B8%A3%E0%B8%B0%E0%B9%80%E0%B8%97%E0%B8%A8%20%E0%B8%A2%E0%B8%B8%E0%B9%82%E0%B8%A3%E0%B8%9B%20%E0%B9%81%E0%B8%95%E0%B8%81%E0%B8%9A%E0%B9%88%E0%B8%AD%E0%B8%A2.aspx"] [unique_id "aXrdUbou83lIon_aKgZ3JAAAAFE"]
[Thu Jan 29 12:08:51.563689 2026] [:error] [pid 20579:tid 20649] [client 81.167.26.57:45759] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B8%8B%E0%B8%B7%E0%B9%89%E0%B8%AD%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B8%AA%E0%B8%9B%E0%B8%B4%E0%B8%99%E0%B9%84%E0%B8%94%E0%B9%89.aspx"] [unique_id "aXrdUzVXNopcNyjJc9W0UQAAAkg"]
[Thu Jan 29 12:08:53.545152 2026] [:error] [pid 19070:tid 19127] [client 81.167.26.57:17030] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%9F%E0%B8%A3%E0%B8%B5%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXrdVbou83lIon_aKgZ3LwAAAFU"]
[Thu Jan 29 12:08:55.666202 2026] [:error] [pid 19069:tid 19101] [client 81.167.26.57:53512] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%9F%E0%B8%A3%E0%B8%B5%20pg.aspx"] [unique_id "aXrdV_DHsRM4BJ9a4Qux0AAAABc"]
[Thu Jan 29 12:08:57.787151 2026] [:error] [pid 19071:tid 19150] [client 81.167.26.57:65352] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B8%96%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%94%E0%B9%89.aspx"] [unique_id "aXrdWZfa8Ix5wWmtmJwNuAAAAJE"]
[Thu Jan 29 12:08:59.905651 2026] [:error] [pid 20580:tid 20686] [client 81.167.26.57:28585] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B8%97%E0%B8%B8%E0%B8%81%E0%B8%84%E0%B9%88%E0%B8%B2%E0%B8%A2%202024.aspx"] [unique_id "aXrdW5CZ5HHdXPmeL5-gmgAAApI"]
[Thu Jan 29 12:09:01.894409 2026] [:error] [pid 20486:tid 20489] [client 81.167.26.57:22990] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXrdXXgqSZb6GBx5nnNzMQAAAQA"]
[Thu Jan 29 12:09:04.022221 2026] [:error] [pid 20519:tid 20550] [client 81.167.26.57:50746] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99.aspx"] [unique_id "aXrdYAo4s4fyROrkyRmFUAAAAYI"]
[Thu Jan 29 12:09:06.134529 2026] [:error] [pid 19070:tid 19107] [client 81.167.26.57:47061] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99pg.aspx"] [unique_id "aXrdYrou83lIon_aKgZ3SgAAAEE"]
[Thu Jan 29 12:09:08.258396 2026] [:error] [pid 20579:tid 20657] [client 81.167.26.57:12227] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87.aspx"] [unique_id "aXrdZDVXNopcNyjJc9W0ZAAAAlA"]
[Thu Jan 29 12:09:10.384496 2026] [:error] [pid 19071:tid 19150] [client 81.167.26.57:59483] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%8799.aspx"] [unique_id "aXrdZpfa8Ix5wWmtmJwN0AAAAJE"]
[Thu Jan 29 12:09:12.496224 2026] [:error] [pid 19071:tid 19144] [client 81.167.26.57:54390] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot%20true%20wallet.aspx"] [unique_id "aXrdaJfa8Ix5wWmtmJwN4AAAAIs"]
[Thu Jan 29 12:09:14.608236 2026] [:error] [pid 20519:tid 20549] [client 81.167.26.57:40457] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot%20wallet%20777%20auto.aspx"] [unique_id "aXrdago4s4fyROrkyRmFZQAAAYE"]
[Thu Jan 29 12:09:16.721807 2026] [:error] [pid 20486:tid 20510] [client 81.167.26.57:41288] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot%20wallet%20iwallet%20link%20login.aspx"] [unique_id "aXrdbHgqSZb6GBx5nnNzYwAAARU"]
[Thu Jan 29 12:09:18.830397 2026] [:error] [pid 19177:tid 19189] [client 81.167.26.57:62239] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot%20wallet.aspx"] [unique_id "aXrdbnipGz0PT8TrQv40LQAAAMo"]
[Thu Jan 29 12:09:20.950057 2026] [:error] [pid 19070:tid 19126] [client 81.167.26.57:51589] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXrdcLou83lIon_aKgZ3XQAAAFQ"]
[Thu Jan 29 12:09:23.692152 2026] [:error] [pid 19070:tid 19128] [client 81.167.26.57:53879] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot.aspx"] [unique_id "aXrdc7ou83lIon_aKgZ3ZgAAAFY"]
[Thu Jan 29 12:09:25.667418 2026] [:error] [pid 20486:tid 20491] [client 81.167.26.57:10160] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot007.aspx"] [unique_id "aXrddXgqSZb6GBx5nnNzcgAAAQI"]
[Thu Jan 29 12:09:27.793707 2026] [:error] [pid 19069:tid 19097] [client 81.167.26.57:11778] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot1234%20pg.aspx"] [unique_id "aXrdd_DHsRM4BJ9a4QuyAQAAABM"]
[Thu Jan 29 12:09:29.774025 2026] [:error] [pid 19071:tid 19155] [client 81.167.26.57:61101] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot1234.aspx"] [unique_id "aXrdeZfa8Ix5wWmtmJwN-AAAAJY"]
[Thu Jan 29 12:09:31.907168 2026] [:error] [pid 20576:tid 20609] [client 81.167.26.57:8072] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot168.aspx"] [unique_id "aXrdeyrDZws_FlQGi9cUbgAAAdc"]
[Thu Jan 29 12:09:33.879016 2026] [:error] [pid 20519:tid 20552] [client 81.167.26.57:19908] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot24th%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXrdfQo4s4fyROrkyRmFawAAAYQ"]
[Thu Jan 29 12:09:35.856890 2026] [:error] [pid 20576:tid 20599] [client 81.167.26.57:3255] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot24th.aspx"] [unique_id "aXrdfyrDZws_FlQGi9cUcQAAAc0"]
[Thu Jan 29 12:09:37.984146 2026] [:error] [pid 19069:tid 19098] [client 81.167.26.57:57285] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot666.aspx"] [unique_id "aXrdgfDHsRM4BJ9a4QuyCwAAABQ"]
[Thu Jan 29 12:10:07.027823 2026] [:error] [pid 20580:tid 20669] [client 81.167.26.57:61616] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/spg%20slot.aspx"] [unique_id "aXrdn5CZ5HHdXPmeL5-hggAAAoI"]
[Thu Jan 29 12:10:09.156288 2026] [:error] [pid 19070:tid 19124] [client 81.167.26.57:11329] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/spx%20slot.aspx"] [unique_id "aXrdobou83lIon_aKgZ3swAAAFI"]
[Thu Jan 29 12:10:11.287154 2026] [:error] [pid 19071:tid 19148] [client 81.167.26.57:17641] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/superslot%20%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%2050%20%E0%B8%A2%E0%B8%B7%E0%B8%99%E0%B8%A2%E0%B8%B1%E0%B8%99%E0%B9%80%E0%B8%9A%E0%B8%AD%E0%B8%A3%E0%B9%8C%20%E0%B8%A3%E0%B8%B1%E0%B8%9A%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%20%E0%B9%80%E0%B8%A5%E0%B8%A2.aspx"] [unique_id "aXrdo5fa8Ix5wWmtmJwOPAAAAI8"]
[Thu Jan 29 12:10:13.408225 2026] [:error] [pid 19177:tid 19200] [client 81.167.26.57:54180] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/superslot%20%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%2050%20%E0%B8%A3%E0%B8%B1%E0%B8%9A%20otp.aspx"] [unique_id "aXrdpXipGz0PT8TrQv40kgAAANU"]
[Thu Jan 29 12:10:15.540513 2026] [:error] [pid 19070:tid 19109] [client 81.167.26.57:53785] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/superslot%20%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%2050%20%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXrdp7ou83lIon_aKgZ32gAAAEM"]
[Thu Jan 29 12:10:17.526678 2026] [:error] [pid 19071:tid 19136] [client 81.167.26.57:32306] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/superslot%20%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXrdqZfa8Ix5wWmtmJwORgAAAIM"]
[Thu Jan 29 12:10:19.650691 2026] [:error] [pid 19069:tid 19083] [client 81.167.26.57:44657] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/superslot%20%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B550%20%E0%B8%A2%E0%B8%B7%E0%B8%99%E0%B8%A2%E0%B8%B1%E0%B8%99%E0%B9%80%E0%B8%9A%E0%B8%AD%E0%B8%A3%E0%B9%8C.aspx"] [unique_id "aXrdq_DHsRM4BJ9a4QuybwAAAAU"]
[Thu Jan 29 12:10:21.627434 2026] [:error] [pid 20486:tid 20493] [client 81.167.26.57:24413] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/superslot%20%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%9C%E0%B9%88%E0%B8%B2%E0%B8%99%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A.aspx"] [unique_id "aXrdrXgqSZb6GBx5nnN0AQAAAQQ"]
[Thu Jan 29 12:10:23.742130 2026] [:error] [pid 20519:tid 20549] [client 81.167.26.57:36300] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/superslot%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXrdrwo4s4fyROrkyRmFxQAAAYE"]
[Thu Jan 29 12:10:25.923413 2026] [:error] [pid 20576:tid 20610] [client 81.167.26.57:30401] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/superslot%20max%20wallet.aspx"] [unique_id "aXrdsSrDZws_FlQGi9cVBwAAAdg"]
[Thu Jan 29 12:10:28.006539 2026] [:error] [pid 19070:tid 19113] [client 81.167.26.57:4767] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/superslot%20vip.aspx"] [unique_id "aXrdtLou83lIon_aKgZ4LAAAAEc"]
[Thu Jan 29 12:10:30.139561 2026] [:error] [pid 19177:tid 19189] [client 81.167.26.57:56109] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/superslot%20wallet%20net.aspx"] [unique_id "aXrdtnipGz0PT8TrQv40yAAAAMo"]
[Thu Jan 29 12:10:32.268029 2026] [:error] [pid 20578:tid 20615] [client 81.167.26.57:50890] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/superslot%20wallet.aspx"] [unique_id "aXrduA6UX7yOMwQFiyfOMgAAAgI"]
[Thu Jan 29 12:10:34.404299 2026] [:error] [pid 20580:tid 20684] [client 81.167.26.57:61565] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/superslot%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99.aspx"] [unique_id "aXrdupCZ5HHdXPmeL5-huAAAApA"]
[Thu Jan 29 12:10:36.529984 2026] [:error] [pid 20486:tid 20504] [client 81.167.26.57:12111] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/superslot1234%20%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B550%20%E0%B8%A2%E0%B8%B7%E0%B8%99%E0%B8%A2%E0%B8%B1%E0%B8%99%E0%B9%80%E0%B8%9A%E0%B8%AD%E0%B8%A3%E0%B9%8C.aspx"] [unique_id "aXrdvHgqSZb6GBx5nnN0GAAAAQ8"]
[Thu Jan 29 12:10:38.658919 2026] [:error] [pid 20519:tid 20568] [client 81.167.26.57:38436] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/superslot1234.aspx"] [unique_id "aXrdvgo4s4fyROrkyRmF2AAAAZQ"]
[Thu Jan 29 12:10:40.635775 2026] [:error] [pid 19071:tid 19145] [client 81.167.26.57:25659] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/superslot168%20wallet.aspx"] [unique_id "aXrdwJfa8Ix5wWmtmJwOfAAAAIw"]
[Thu Jan 29 12:10:42.764802 2026] [:error] [pid 20519:tid 20565] [client 81.167.26.57:42332] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/superslot168.aspx"] [unique_id "aXrdwgo4s4fyROrkyRmF3QAAAZE"]
[Thu Jan 29 12:10:44.749608 2026] [:error] [pid 20486:tid 20513] [client 81.167.26.57:28241] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/superslot777.aspx"] [unique_id "aXrdxHgqSZb6GBx5nnN0KwAAARg"]
[Thu Jan 29 12:10:46.880646 2026] [:error] [pid 19070:tid 19123] [client 81.167.26.57:2089] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/superslot888.aspx"] [unique_id "aXrdxrou83lIon_aKgZ4OAAAAFE"]
[Thu Jan 29 12:10:49.012152 2026] [:error] [pid 19070:tid 19127] [client 81.167.26.57:45185] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/superslotclub.aspx"] [unique_id "aXrdybou83lIon_aKgZ4OQAAAFU"]
[Thu Jan 29 12:10:50.853799 2026] [:error] [pid 20519:tid 20572] [client 81.167.26.57:50914] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/superslotv9.aspx"] [unique_id "aXrdygo4s4fyROrkyRmF3wAAAZg"]
[Thu Jan 29 12:10:52.979797 2026] [:error] [pid 20580:tid 20671] [client 81.167.26.57:40905] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/tgaslot.aspx"] [unique_id "aXrdzJCZ5HHdXPmeL5-hwQAAAoM"]
[Thu Jan 29 12:10:55.133805 2026] [:error] [pid 19070:tid 19116] [client 81.167.26.57:10360] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/thaislot.aspx"] [unique_id "aXrdz7ou83lIon_aKgZ4QAAAAEo"]
[Thu Jan 29 12:10:57.246966 2026] [:error] [pid 20580:tid 20691] [client 81.167.26.57:54070] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/u31%20%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%2031%20%E0%B8%9A%E0%B8%B2%E0%B8%97.aspx"] [unique_id "aXrd0ZCZ5HHdXPmeL5-hxgAAApc"]
[Thu Jan 29 12:10:59.375182 2026] [:error] [pid 20579:tid 20644] [client 81.167.26.57:18964] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/u31%20game%20%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%AA%E0%B8%B9%E0%B9%88%E0%B8%A3%E0%B8%B0%E0%B8%9A%E0%B8%9A.aspx"] [unique_id "aXrd0zVXNopcNyjJc9W1IQAAAkM"]
[Thu Jan 29 12:11:01.506279 2026] [:error] [pid 20580:tid 20678] [client 81.167.26.57:16328] [client 81.167.26.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufa%20168.aspx"] [unique_id "aXrd1ZCZ5HHdXPmeL5-hxwAAAoo"]
[Thu Jan 29 12:43:10.275704 2026] [:error] [pid 20519:tid 20563] [client 207.154.213.63:39678] [client 207.154.213.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.154.213.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXrlXgo4s4fyROrkyRmMDwAAAY8"]
[Thu Jan 29 13:58:30.735623 2026] [:error] [pid 20578:tid 20620] [client 167.71.32.67:53866] [client 167.71.32.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.71.32.67, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXr3Bg6UX7yOMwQFiyfjbQAAAgc"]
[Thu Jan 29 13:59:25.780793 2026] [:error] [pid 20579:tid 20647] [client 145.239.65.133:59132] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%94%E0%B8%B2%E0%B8%A7%E0%B8%99%E0%B9%8C%E0%B9%82%E0%B8%AB%E0%B8%A5%E0%B8%94joker.aspx"] [unique_id "aXr3PTVXNopcNyjJc9XM5wAAAkY"]
[Thu Jan 29 13:59:27.757134 2026] [:error] [pid 20579:tid 20643] [client 145.239.65.133:32918] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%94%E0%B8%B2%E0%B8%A7%E0%B8%99%E0%B9%8C%E0%B9%82%E0%B8%AB%E0%B8%A5%E0%B8%94slotxoth.aspx"] [unique_id "aXr3PzVXNopcNyjJc9XM6QAAAkI"]
[Thu Jan 29 13:59:29.759524 2026] [:error] [pid 20579:tid 20653] [client 145.239.65.133:32928] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%94%E0%B8%B9%E0%B8%9A%E0%B8%AD%E0%B8%A5%E0%B8%AA%E0%B8%94%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%94%E0%B8%B5%E0%B9%80%E0%B8%A5%E0%B8%A2%E0%B9%8C.aspx"] [unique_id "aXr3QTVXNopcNyjJc9XM7wAAAkw"]
[Thu Jan 29 13:59:31.753229 2026] [:error] [pid 20519:tid 20561] [client 145.239.65.133:32942] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXr3Qwo4s4fyROrkyRmbWAAAAY0"]
[Thu Jan 29 13:59:33.755208 2026] [:error] [pid 19070:tid 19113] [client 145.239.65.133:32956] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%20%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%20%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXr3Rbou83lIon_aKgaTlwAAAEc"]
[Thu Jan 29 13:59:35.770134 2026] [:error] [pid 20486:tid 20501] [client 145.239.65.133:36380] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%20pg.aspx"] [unique_id "aXr3R3gqSZb6GBx5nnObhQAAAQw"]
[Thu Jan 29 13:59:37.760412 2026] [:error] [pid 19070:tid 19106] [client 145.239.65.133:36394] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B8%9A%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%88%E0%B8%B2.aspx"] [unique_id "aXr3Sbou83lIon_aKgaTnwAAAEA"]
[Thu Jan 29 13:59:39.765600 2026] [:error] [pid 19177:tid 19186] [client 145.239.65.133:36410] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B8%9B%E0%B8%B1%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXr3S3ipGz0PT8TrQv5JeQAAAMc"]
[Thu Jan 29 13:59:41.756757 2026] [:error] [pid 19069:tid 19086] [client 145.239.65.133:36424] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B8%A2%E0%B8%B4%E0%B8%87%E0%B8%9B%E0%B8%A5%E0%B8%B2.aspx"] [unique_id "aXr3TfDHsRM4BJ9a4QvROQAAAAg"]
[Thu Jan 29 13:59:43.749698 2026] [:error] [pid 19069:tid 19096] [client 145.239.65.133:36454] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXr3T_DHsRM4BJ9a4QvRQgAAABI"]
[Thu Jan 29 13:59:45.750795 2026] [:error] [pid 20576:tid 20599] [client 145.239.65.133:57454] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%9A%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%88%E0%B8%B2%20sa.aspx"] [unique_id "aXr3USrDZws_FlQGi9cpkwAAAc0"]
[Thu Jan 29 13:59:47.736426 2026] [:error] [pid 19070:tid 19124] [client 145.239.65.133:57466] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%9A%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%88%E0%B8%B2%E0%B8%9F%E0%B8%A3%E0%B8%B5%2010000.aspx"] [unique_id "aXr3U7ou83lIon_aKgaTpQAAAFI"]
[Thu Jan 29 13:59:49.737725 2026] [:error] [pid 19071:tid 19142] [client 145.239.65.133:57470] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%9A%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%88%E0%B8%B2%E0%B8%9F%E0%B8%A3%E0%B8%B5%201000000.aspx"] [unique_id "aXr3VZfa8Ix5wWmtmJwuOAAAAIk"]
[Thu Jan 29 13:59:51.745074 2026] [:error] [pid 20576:tid 20588] [client 145.239.65.133:57482] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%9A%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%88%E0%B8%B2%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXr3VyrDZws_FlQGi9cpmwAAAcI"]
[Thu Jan 29 13:59:53.732763 2026] [:error] [pid 20579:tid 20653] [client 145.239.65.133:57490] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%9A%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%88%E0%B8%B2.aspx"] [unique_id "aXr3WTVXNopcNyjJc9XNBAAAAkw"]
[Thu Jan 29 13:59:55.569897 2026] [:error] [pid 20576:tid 20597] [client 145.239.65.133:40800] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXr3WyrDZws_FlQGi9cpngAAAcs"]
[Thu Jan 29 13:59:57.573262 2026] [:error] [pid 20579:tid 20663] [client 145.239.65.133:40806] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20pg%20%E0%B8%8B%E0%B8%B7%E0%B9%89%E0%B8%AD%20%E0%B8%9F%E0%B8%A3%E0%B8%B5%20%E0%B8%AA%20%E0%B8%9B%E0%B8%B4%20%E0%B8%99%20%E0%B9%84%E0%B8%94%E0%B9%89%20%E0%B9%84%E0%B8%A1%E0%B9%88%20%E0%B9%80%E0%B8%94%E0%B9%89%E0%B8%87.aspx"] [unique_id "aXr3XTVXNopcNyjJc9XNCgAAAlU"]
[Thu Jan 29 13:59:59.586704 2026] [:error] [pid 19177:tid 19194] [client 145.239.65.133:40818] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20pg%20%E0%B8%8B%E0%B8%B7%E0%B9%89%E0%B8%AD%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B8%AA%E0%B8%9B%E0%B8%B4%E0%B8%99%E0%B9%84%E0%B8%94%E0%B9%89%202024.aspx"] [unique_id "aXr3X3ipGz0PT8TrQv5JkQAAAM8"]
[Thu Jan 29 14:00:01.594586 2026] [:error] [pid 19071:tid 19141] [client 145.239.65.133:40826] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20pg%20%E0%B8%8B%E0%B8%B7%E0%B9%89%E0%B8%AD%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B8%AA%E0%B8%9B%E0%B8%B4%E0%B8%99.aspx"] [unique_id "aXr3YZfa8Ix5wWmtmJwuSQAAAIg"]
[Thu Jan 29 14:00:03.600962 2026] [:error] [pid 20578:tid 20630] [client 145.239.65.133:40842] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20pg%20%E0%B8%8B%E0%B8%B7%E0%B9%89%E0%B8%AD%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXr3Yw6UX7yOMwQFiyfjywAAAhE"]
[Thu Jan 29 14:00:05.593053 2026] [:error] [pid 20580:tid 20682] [client 145.239.65.133:35488] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20pg%20%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXr3ZZCZ5HHdXPmeL5-9SwAAAo4"]
[Thu Jan 29 14:00:07.602150 2026] [:error] [pid 19177:tid 19202] [client 145.239.65.133:35494] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20pg%20%E0%B9%80%E0%B8%81%E0%B8%A1%E0%B9%83%E0%B8%AB%E0%B8%A1%E0%B9%88.aspx"] [unique_id "aXr3Z3ipGz0PT8TrQv5JmAAAANc"]
[Thu Jan 29 14:00:09.612429 2026] [:error] [pid 20519:tid 20549] [client 145.239.65.133:35504] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXr3aQo4s4fyROrkyRmbgQAAAYE"]
[Thu Jan 29 14:00:11.597275 2026] [:error] [pid 20519:tid 20565] [client 145.239.65.133:35518] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXr3awo4s4fyROrkyRmbhQAAAZE"]
[Thu Jan 29 14:00:13.602442 2026] [:error] [pid 20519:tid 20555] [client 145.239.65.133:35522] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%82%E0%B8%A3%E0%B8%A1%E0%B9%88%E0%B8%B2%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXr3bQo4s4fyROrkyRmbiQAAAYc"]
[Thu Jan 29 14:00:15.612730 2026] [:error] [pid 19071:tid 19148] [client 145.239.65.133:51338] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%E0%B9%82%E0%B8%A3%E0%B8%A1%E0%B9%88%E0%B8%B2.aspx"] [unique_id "aXr3b5fa8Ix5wWmtmJwuXgAAAI8"]
[Thu Jan 29 14:00:17.626431 2026] [:error] [pid 20519:tid 20566] [client 145.239.65.133:51342] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXr3cQo4s4fyROrkyRmbqAAAAZI"]
[Thu Jan 29 14:00:19.616925 2026] [:error] [pid 19177:tid 19185] [client 145.239.65.133:51358] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%9599.aspx"] [unique_id "aXr3c3ipGz0PT8TrQv5JowAAAMY"]
[Thu Jan 29 14:00:21.616786 2026] [:error] [pid 19071:tid 19147] [client 145.239.65.133:51370] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95pg.aspx"] [unique_id "aXr3dZfa8Ix5wWmtmJwuewAAAI4"]
[Thu Jan 29 14:01:15.212947 2026] [:error] [pid 20578:tid 20616] [client 145.239.65.133:51376] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%20sbobet%20%E0%B8%A1%E0%B8%B7%E0%B8%AD%20%E0%B8%96%E0%B8%B7%E0%B8%AD777.aspx"] [unique_id "aXr3qw6UX7yOMwQFiyfkGAAAAgM"]
[Thu Jan 29 14:01:17.005010 2026] [:error] [pid 19070:tid 19128] [client 145.239.65.133:48928] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%20sbobet%20%E0%B9%83%E0%B8%AB%E0%B8%A1%E0%B9%88%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXr3rbou83lIon_aKgaUKgAAAFY"]
[Thu Jan 29 14:01:18.987266 2026] [:error] [pid 19070:tid 19115] [client 145.239.65.133:48934] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%20sbobet%E0%B9%80%E0%B8%AD%E0%B9%80%E0%B8%8A%E0%B8%B5%E0%B8%A2.aspx"] [unique_id "aXr3rrou83lIon_aKgaUKwAAAEk"]
[Thu Jan 29 14:01:20.967145 2026] [:error] [pid 19071:tid 19140] [client 145.239.65.133:48936] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%20slotxo%20joker%20%E0%B8%AB%E0%B8%99%E0%B9%89%E0%B8%B2%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A.aspx"] [unique_id "aXr3sJfa8Ix5wWmtmJwulQAAAIc"]
[Thu Jan 29 14:01:22.945323 2026] [:error] [pid 19069:tid 19087] [client 145.239.65.133:48950] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%20ufa365%E0%B8%A1%E0%B8%B7%E0%B8%AD%E0%B8%96%E0%B8%B7%E0%B8%AD.aspx"] [unique_id "aXr3svDHsRM4BJ9a4QvR1QAAAAk"]
[Thu Jan 29 14:01:24.943623 2026] [:error] [pid 20519:tid 20558] [client 145.239.65.133:48964] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%20ufabet%20%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%95%E0%B8%A3%E0%B8%87.aspx"] [unique_id "aXr3tAo4s4fyROrkyRmbugAAAYo"]
[Thu Jan 29 14:01:26.936721 2026] [:error] [pid 19069:tid 19088] [client 145.239.65.133:50856] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%20ufabet.aspx"] [unique_id "aXr3tvDHsRM4BJ9a4QvR2wAAAAo"]
[Thu Jan 29 14:01:28.912828 2026] [:error] [pid 20579:tid 20643] [client 145.239.65.133:50872] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%88%E0%B8%B5%E0%B8%84%E0%B8%A5%E0%B8%B1%E0%B8%9A.aspx"] [unique_id "aXr3uDVXNopcNyjJc9XNUAAAAkI"]
[Thu Jan 29 14:01:30.909866 2026] [:error] [pid 19069:tid 19079] [client 145.239.65.133:50874] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%8B%E0%B8%B8%E0%B8%9B%E0%B9%80%E0%B8%9B%E0%B8%AD%E0%B8%A3%E0%B9%8C%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95.aspx"] [unique_id "aXr3uvDHsRM4BJ9a4QvR3wAAAAE"]
[Thu Jan 29 14:01:32.886401 2026] [:error] [pid 19070:tid 19106] [client 145.239.65.133:50886] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%A2%E0%B8%B9%E0%B8%9F%E0%B9%88%E0%B8%B2.aspx"] [unique_id "aXr3vLou83lIon_aKgaUPAAAAEA"]
[Thu Jan 29 14:01:34.714547 2026] [:error] [pid 19069:tid 19102] [client 145.239.65.133:50898] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95168.aspx"] [unique_id "aXr3vvDHsRM4BJ9a4QvR5AAAABg"]
[Thu Jan 29 14:01:36.698767 2026] [:error] [pid 20579:tid 20668] [client 145.239.65.133:45268] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B8%AA%E0%B9%82%E0%B8%9A.aspx"] [unique_id "aXr3wDVXNopcNyjJc9XNWAAAAlg"]
[Thu Jan 29 14:01:38.683516 2026] [:error] [pid 20580:tid 20683] [client 145.239.65.133:45280] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%20pg%20slot.aspx"] [unique_id "aXr3wpCZ5HHdXPmeL5-93gAAAo8"]
[Thu Jan 29 14:01:40.514047 2026] [:error] [pid 20486:tid 20510] [client 145.239.65.133:45286] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99%20slotxo.aspx"] [unique_id "aXr3xHgqSZb6GBx5nnOb5QAAARU"]
[Thu Jan 29 14:01:42.488512 2026] [:error] [pid 19070:tid 19109] [client 145.239.65.133:45298] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99superslot.aspx"] [unique_id "aXr3xrou83lIon_aKgaUQgAAAEM"]
[Thu Jan 29 14:01:44.462459 2026] [:error] [pid 19069:tid 19087] [client 145.239.65.133:45300] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2%E0%B9%82%E0%B8%88%E0%B9%8A%E0%B8%81%E0%B9%80%E0%B8%81%E0%B8%AD%E0%B8%A3%E0%B9%8C.aspx"] [unique_id "aXr3yPDHsRM4BJ9a4QvR8gAAAAk"]
[Thu Jan 29 14:01:46.436378 2026] [:error] [pid 20576:tid 20603] [client 145.239.65.133:46716] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2joker123%20auto%20%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2.aspx"] [unique_id "aXr3yirDZws_FlQGi9cp6AAAAdE"]
[Thu Jan 29 14:01:48.413904 2026] [:error] [pid 19071:tid 19135] [client 145.239.65.133:46728] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2pg%20%E0%B8%A1%E0%B8%B7%E0%B8%AD%E0%B8%96%E0%B8%B7%E0%B8%AD.aspx"] [unique_id "aXr3zJfa8Ix5wWmtmJwupQAAAII"]
[Thu Jan 29 14:01:50.387444 2026] [:error] [pid 19071:tid 19148] [client 145.239.65.133:46730] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2pg%20slot%20auto%20%E0%B8%A1%E0%B8%B7%E0%B8%AD%E0%B8%96%E0%B8%B7%E0%B8%AD.aspx"] [unique_id "aXr3zpfa8Ix5wWmtmJwupwAAAI8"]
[Thu Jan 29 14:01:52.361978 2026] [:error] [pid 19069:tid 19095] [client 145.239.65.133:46732] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2pg%20slot%20auto.aspx"] [unique_id "aXr30PDHsRM4BJ9a4QvR-wAAABE"]
[Thu Jan 29 14:01:54.335702 2026] [:error] [pid 20519:tid 20559] [client 145.239.65.133:46734] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2pg%20soft.aspx"] [unique_id "aXr30go4s4fyROrkyRmbzQAAAYs"]
[Thu Jan 29 14:01:56.318639 2026] [:error] [pid 20519:tid 20563] [client 145.239.65.133:48952] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2pg.aspx"] [unique_id "aXr31Ao4s4fyROrkyRmb0QAAAY8"]
[Thu Jan 29 14:01:58.345870 2026] [:error] [pid 19071:tid 19137] [client 145.239.65.133:48954] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2s%20joker.aspx"] [unique_id "aXr31pfa8Ix5wWmtmJwuqwAAAIQ"]
[Thu Jan 29 14:02:00.288650 2026] [:error] [pid 20580:tid 20689] [client 145.239.65.133:48970] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2slotxo%20joker.aspx"] [unique_id "aXr32JCZ5HHdXPmeL5-9_QAAApU"]
[Thu Jan 29 14:02:02.251899 2026] [:error] [pid 20519:tid 20570] [client 145.239.65.133:48978] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2slotxo.aspx"] [unique_id "aXr32go4s4fyROrkyRmb1QAAAZY"]
[Thu Jan 29 14:02:04.228898 2026] [:error] [pid 20580:tid 20678] [client 145.239.65.133:48982] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2ufabet.aspx"] [unique_id "aXr33JCZ5HHdXPmeL5--BQAAAoo"]
[Thu Jan 29 14:02:06.204603 2026] [:error] [pid 19070:tid 19118] [client 145.239.65.133:51494] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%97%E0%B8%B2%E0%B8%87%E0%B9%80%E0%B8%82%E0%B9%89%E0%B8%B2w88.aspx"] [unique_id "aXr33rou83lIon_aKgaUWgAAAEw"]
[Thu Jan 29 14:02:08.047321 2026] [:error] [pid 19177:tid 19195] [client 145.239.65.133:51506] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%9A%E0%B8%AD%E0%B8%A5%2069.aspx"] [unique_id "aXr34HipGz0PT8TrQv5J6AAAANA"]
[Thu Jan 29 14:02:10.021962 2026] [:error] [pid 19069:tid 19098] [client 145.239.65.133:51520] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%9A%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%88%E0%B8%B2%2099.aspx"] [unique_id "aXr34vDHsRM4BJ9a4QvSCgAAABQ"]
[Thu Jan 29 14:02:11.997447 2026] [:error] [pid 19069:tid 19088] [client 145.239.65.133:51524] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%9A%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%88%E0%B8%B2%E0%B8%97%E0%B8%94%E0%B8%A5%E0%B8%AD%E0%B8%87%E0%B9%80%E0%B8%A5%E0%B9%88%E0%B8%99.aspx"] [unique_id "aXr34_DHsRM4BJ9a4QvSDQAAAAo"]
[Thu Jan 29 14:03:05.246751 2026] [:error] [pid 19070:tid 19121] [client 145.239.65.133:51530] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%9D%E0%B8%B2%E0%B8%8110%E0%B8%A3%E0%B8%B1%E0%B8%9A100.aspx"] [unique_id "aXr4Gbou83lIon_aKgaUhAAAAE8"]
[Thu Jan 29 14:03:07.230556 2026] [:error] [pid 19069:tid 19095] [client 145.239.65.133:56010] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%9E%E0%B8%99%E0%B8%B1%E0%B8%99%E0%B8%AD%E0%B8%AD%E0%B8%99%E0%B9%84%E0%B8%A5%E0%B8%99%E0%B9%8C.aspx"] [unique_id "aXr4G_DHsRM4BJ9a4QvSVgAAABE"]
[Thu Jan 29 14:03:09.171467 2026] [:error] [pid 20519:tid 20560] [client 145.239.65.133:56020] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%9E%E0%B8%B5%E0%B8%88%E0%B8%B5.aspx"] [unique_id "aXr4HQo4s4fyROrkyRmb9gAAAYw"]
[Thu Jan 29 14:03:11.160287 2026] [:error] [pid 19071:tid 19135] [client 145.239.65.133:56036] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95.aspx"] [unique_id "aXr4H5fa8Ix5wWmtmJwu2gAAAII"]
[Thu Jan 29 14:03:13.165953 2026] [:error] [pid 20576:tid 20590] [client 145.239.65.133:56040] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%A2%E0%B8%B7%E0%B8%99%E0%B8%A2%E0%B8%B1%E0%B8%99%20%E0%B8%9A%E0%B8%B1%E0%B8%95%E0%B8%A3%E0%B8%9B%E0%B8%A3%E0%B8%B0%E0%B8%8A%E0%B8%B2%E0%B8%8A%E0%B8%99%20%E0%B8%A3%E0%B8%B1%E0%B8%9A%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%20%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXr4ISrDZws_FlQGi9cqJwAAAcQ"]
[Thu Jan 29 14:03:14.995036 2026] [:error] [pid 19070:tid 19123] [client 145.239.65.133:56044] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%A2%E0%B8%B7%E0%B8%99%E0%B8%A2%E0%B8%B1%E0%B8%99%20otp%20%E0%B8%A3%E0%B8%B1%E0%B8%9A%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXr4Irou83lIon_aKgaUiAAAAFE"]
[Thu Jan 29 14:03:16.980334 2026] [:error] [pid 20576:tid 20610] [client 145.239.65.133:37036] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%A2%E0%B8%B7%E0%B8%99%E0%B8%A2%E0%B8%B1%E0%B8%99%20otp%20%E0%B8%A3%E0%B8%B1%E0%B8%9A%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B550%20%E0%B9%84%E0%B8%A1%E0%B9%88%E0%B8%95%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B9%81%E0%B8%8A%E0%B8%A3%E0%B9%8C.aspx"] [unique_id "aXr4JCrDZws_FlQGi9cqLAAAAdg"]
[Thu Jan 29 14:03:18.966269 2026] [:error] [pid 20578:tid 20626] [client 145.239.65.133:37048] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%A2%E0%B8%B9%20%E0%B8%9F%E0%B9%88%E0%B8%B2%20168%20vip.aspx"] [unique_id "aXr4Jg6UX7yOMwQFiyfkfwAAAg0"]
[Thu Jan 29 14:03:20.942404 2026] [:error] [pid 19069:tid 19099] [client 145.239.65.133:37054] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%A2%E0%B8%B9%E0%B8%9F%E0%B9%88%E0%B8%B2%E0%B9%80%E0%B8%9A%E0%B8%97168%20vip.aspx"] [unique_id "aXr4KPDHsRM4BJ9a4QvSfgAAABU"]
[Thu Jan 29 14:03:22.927003 2026] [:error] [pid 19070:tid 19106] [client 145.239.65.133:37060] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%A2%E0%B8%B9%E0%B8%9F%E0%B9%88%E0%B8%B2168.aspx"] [unique_id "aXr4Krou83lIon_aKgaUkAAAAEA"]
[Thu Jan 29 14:03:24.920799 2026] [:error] [pid 19069:tid 19086] [client 145.239.65.133:37066] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%A2%E0%B8%B9%E0%B8%9F%E0%B9%88%E0%B8%B2888.aspx"] [unique_id "aXr4LPDHsRM4BJ9a4QvSjwAAAAg"]
[Thu Jan 29 14:03:26.897713 2026] [:error] [pid 20580:tid 20679] [client 145.239.65.133:43920] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%A3%E0%B8%A7%E0%B8%A1%20%E0%B9%82%E0%B8%9B%E0%B8%A3%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B8%9D%E0%B8%B2%E0%B8%81%201%20%E0%B8%A3%E0%B8%B1%E0%B8%9A%2050%20%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94.aspx"] [unique_id "aXr4LpCZ5HHdXPmeL5--rAAAAos"]
[Thu Jan 29 14:03:28.714276 2026] [:error] [pid 20579:tid 20666] [client 145.239.65.133:43928] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%A3%E0%B8%A7%E0%B8%A1%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%20betflix.aspx"] [unique_id "aXr4MDVXNopcNyjJc9XNuwAAAlc"]
[Thu Jan 29 14:03:30.688253 2026] [:error] [pid 19070:tid 19113] [client 145.239.65.133:43930] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/%E0%B8%A3%E0%B8%A7%E0%B8%A1%E0%B9%80%E0%B8%A7%E0%B9%87%E0%B8%9A%E0%B8%AA%E0%B8%A5%E0%B9%87%E0%B8%AD%E0%B8%95%20%E0%B8%9D%E0%B8%B2%E0%B8%8110%E0%B8%A3%E0%B8%B1%E0%B8%9A100%20%E0%B8%A5%E0%B9%88%E0%B8%B2%E0%B8%AA%E0%B8%B8%E0%B8%94%202021.aspx"] [unique_id "aXr4Mrou83lIon_aKgaUlwAAAEc"]
[Thu Jan 29 14:03:32.663308 2026] [:error] [pid 20578:tid 20615] [client 145.239.65.133:43940] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/1234%20superslot.aspx"] [unique_id "aXr4NA6UX7yOMwQFiyfknAAAAgI"]
[Thu Jan 29 14:03:34.652751 2026] [:error] [pid 19069:tid 19087] [client 145.239.65.133:43944] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflik%20casino.aspx"] [unique_id "aXr4NvDHsRM4BJ9a4QvSmwAAAAk"]
[Thu Jan 29 14:03:36.623638 2026] [:error] [pid 19070:tid 19108] [client 145.239.65.133:49664] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/lava%20slot.aspx"] [unique_id "aXr4OLou83lIon_aKgaUmAAAAEI"]
[Thu Jan 29 14:03:38.596307 2026] [:error] [pid 20580:tid 20680] [client 145.239.65.133:49678] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pg%20slot%20888th.aspx"] [unique_id "aXr4OpCZ5HHdXPmeL5--ugAAAow"]
[Thu Jan 29 14:03:40.426596 2026] [:error] [pid 20576:tid 20588] [client 145.239.65.133:49686] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot%20super%20wallet.aspx"] [unique_id "aXr4PCrDZws_FlQGi9cqPwAAAcI"]
[Thu Jan 29 14:03:42.405875 2026] [:error] [pid 20576:tid 20599] [client 145.239.65.133:49688] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/yakuza%20slot.aspx"] [unique_id "aXr4PirDZws_FlQGi9cqRwAAAc0"]
[Thu Jan 29 14:03:44.254596 2026] [:error] [pid 20579:tid 20657] [client 145.239.65.133:49698] [client 145.239.65.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/z16%20%E0%B9%80%E0%B8%84%E0%B8%A3%E0%B8%94%E0%B8%B4%E0%B8%95%E0%B8%9F%E0%B8%A3%E0%B8%B5.aspx"] [unique_id "aXr4QDVXNopcNyjJc9XNyQAAAlA"]
[Thu Jan 29 14:08:09.675034 2026] [:error] [pid 20580:tid 20678] [client 41.204.202.51:56462] [client 41.204.202.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.204.202.51, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXr5SZCZ5HHdXPmeL5_ATwAAAoo"]
[Thu Jan 29 15:24:31.652750 2026] [:error] [pid 19069:tid 19085] [client 185.199.223.39:49534] [client 185.199.223.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXsLL_DHsRM4BJ9a4QvwzgAAAAc"]
[Thu Jan 29 16:38:02.322176 2026] [:error] [pid 20576:tid 20586] [client 101.91.148.219:55695] [client 101.91.148.219] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXscairDZws_FlQGi9dGOAAAAcA"]
[Thu Jan 29 16:51:49.727927 2026] [:error] [pid 20576:tid 20602] [client 51.210.190.32:45934] [client 51.210.190.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.190.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXsfpSrDZws_FlQGi9dIWgAAAdA"]
[Thu Jan 29 16:52:29.656447 2026] [:error] [pid 20579:tid 20658] [client 45.79.181.215:49030] [client 45.79.181.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.79.181.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXsfzTVXNopcNyjJc9XuWwAAAlE"]
[Thu Jan 29 18:23:24.334624 2026] [:error] [pid 20579:tid 20654] [client 178.33.40.189:52806] [client 178.33.40.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.33.40.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXs1HDVXNopcNyjJc9X_pgAAAk0"]
[Thu Jan 29 19:51:30.436923 2026] [:error] [pid 20578:tid 20624] [client 51.83.100.230:53174] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflik%20slot.aspx"] [unique_id "aXtJwg6UX7yOMwQFiycqVQAAAgs"]
[Thu Jan 29 19:51:32.318806 2026] [:error] [pid 19069:tid 19101] [client 51.83.100.230:35346] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflik%20thailand.aspx"] [unique_id "aXtJxPDHsRM4BJ9a4QtPgwAAABc"]
[Thu Jan 29 19:51:34.317880 2026] [:error] [pid 20486:tid 20511] [client 51.83.100.230:34502] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20auto.aspx"] [unique_id "aXtJxngqSZb6GBx5nnPt7gAAARY"]
[Thu Jan 29 19:51:36.496853 2026] [:error] [pid 19069:tid 19089] [client 51.83.100.230:34508] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20casino.aspx"] [unique_id "aXtJyPDHsRM4BJ9a4QtPjgAAAAs"]
[Thu Jan 29 19:51:38.470788 2026] [:error] [pid 19177:tid 19179] [client 51.83.100.230:34516] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20co.aspx"] [unique_id "aXtJynipGz0PT8TrQv6HvAAAAMA"]
[Thu Jan 29 19:51:40.602693 2026] [:error] [pid 20579:tid 20666] [client 51.83.100.230:34526] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20slot.aspx"] [unique_id "aXtJzDVXNopcNyjJc9USCQAAAlc"]
[Thu Jan 29 19:51:42.730187 2026] [:error] [pid 19071:tid 19150] [client 51.83.100.230:34540] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20wallet.aspx"] [unique_id "aXtJzpfa8Ix5wWmtmJx-3gAAAJE"]
[Thu Jan 29 19:51:44.911979 2026] [:error] [pid 19070:tid 19106] [client 51.83.100.230:57216] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20betflik.aspx"] [unique_id "aXtJ0Lou83lIon_aKgbdgwAAAEA"]
[Thu Jan 29 19:51:47.277426 2026] [:error] [pid 19071:tid 19157] [client 51.83.100.230:57232] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20betflix.aspx"] [unique_id "aXtJ05fa8Ix5wWmtmJx-5wAAAJg"]
[Thu Jan 29 19:51:49.518148 2026] [:error] [pid 20579:tid 20646] [client 51.83.100.230:57234] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20wallet.aspx"] [unique_id "aXtJ1TVXNopcNyjJc9USFQAAAkU"]
[Thu Jan 29 19:51:51.498728 2026] [:error] [pid 20519:tid 20553] [client 51.83.100.230:57242] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/g2g%20slot.aspx"] [unique_id "aXtJ1wo4s4fyROrkyRnaAgAAAYU"]
[Thu Jan 29 19:51:54.415261 2026] [:error] [pid 19069:tid 19084] [client 51.83.100.230:57250] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "aXtJ2vDHsRM4BJ9a4QtPpwAAAAY"]
[Thu Jan 29 19:51:56.780633 2026] [:error] [pid 20578:tid 20622] [client 51.83.100.230:33644] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "aXtJ3A6UX7yOMwQFiycqdQAAAgk"]
[Thu Jan 29 19:51:58.950868 2026] [:error] [pid 19070:tid 19127] [client 51.83.100.230:33656] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20slot.aspx"] [unique_id "aXtJ3rou83lIon_aKgbdjwAAAFU"]
[Thu Jan 29 19:52:01.081424 2026] [:error] [pid 20579:tid 20664] [client 51.83.100.230:33664] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/mega%20slot.aspx"] [unique_id "aXtJ4TVXNopcNyjJc9USJwAAAlY"]
[Thu Jan 29 19:52:03.034971 2026] [:error] [pid 19071:tid 19152] [client 51.83.100.230:33672] [client 51.83.100.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/metal%20slot.aspx"] [unique_id "aXtJ45fa8Ix5wWmtmJx_EwAAAJM"]
[Thu Jan 29 19:59:20.812142 2026] [:error] [pid 19177:tid 19187] [client 87.233.231.180:20943] [client 87.233.231.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.233.231.180, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXtLmHipGz0PT8TrQv6JtQAAAMg"]
[Thu Jan 29 21:48:43.393861 2026] [:error] [pid 39863:tid 39874] [client 51.38.116.112:36916] [client 51.38.116.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.38.116.112, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXtlO7sHJJGGu8set5_-hwAAAUg"]
[Thu Jan 29 22:28:18.069864 2026] [:error] [pid 20486:tid 20509] [client 47.90.227.150:37670] [client 47.90.227.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXtugngqSZb6GBx5nnMV2gAAARQ"]
[Thu Jan 29 22:28:18.684890 2026] [:error] [pid 20576:tid 20598] [client 47.90.227.150:36716] [client 47.90.227.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXtugirDZws_FlQGi9eG_AAAAcw"]
[Thu Jan 29 23:25:28.464189 2026] [:error] [pid 39863:tid 39871] [client 80.120.241.102:55888] [client 80.120.241.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.120.241.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXt76LsHJJGGu8set58hNgAAAUU"]
[Fri Jan 30 01:29:37.823986 2026] [:error] [pid 39503:tid 39576] [client 104.28.246.114:28559] [client 104.28.246.114] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aXuZATzoHqvQcupFdnb30QAAAQ0"]
[Fri Jan 30 01:29:59.068561 2026] [:error] [pid 39592:tid 39608] [client 104.28.152.248:56668] [client 104.28.152.248] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/style.php"] [unique_id "aXuZF5lnGYODSsJUyHlHhAAAAMs"]
[Fri Jan 30 01:52:15.073507 2026] [:error] [pid 39503:tid 39584] [client 192.42.116.28:58012] [client 192.42.116.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.42.116.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXueTzzoHqvQcupFdnb_3AAAARU"], referer: https://expressinteriors.com/xmlrpc.php?rsd
[Fri Jan 30 02:54:50.197602 2026] [:error] [pid 13797:tid 13816] [client 43.130.78.203:47644] [client 43.130.78.203] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXus-kZz78bylh5pU4SLYgAAAdE"]
[Fri Jan 30 05:03:04.632668 2026] [:error] [pid 46914:tid 46995] [client 88.99.39.252:52876] [client 88.99.39.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.99.39.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXvLCFgSfJ4kZxNKlb-qXAAAAJE"]
[Fri Jan 30 05:19:49.337937 2026] [:error] [pid 24681:tid 24696] [client 110.166.71.39:47552] [client 110.166.71.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXvO9YE368IXQpahn0KxJwAAAQ0"]
[Fri Jan 30 05:36:47.325182 2026] [:error] [pid 24712:tid 24744] [client 5.161.113.246:51296] [client 5.161.113.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.161.113.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXvS74RLQrFiQF3h9-tTJQAAAYM"]
[Fri Jan 30 06:20:39.578839 2026] [:error] [pid 47021:tid 47040] [client 164.90.142.198:57562] [client 164.90.142.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "aXvdN9ap1k13UdZUNSRIxwAAANE"], referer: binance.com
[Fri Jan 30 06:43:54.618705 2026] [:error] [pid 24711:tid 24722] [client 80.120.241.102:45848] [client 80.120.241.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.120.241.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXviqq5Gwh4var6T23JTbAAAAUg"]
[Fri Jan 30 08:07:17.470282 2026] [autoindex:error] [pid 46913:tid 46969] [client 159.65.187.217:53526] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Jan 30 08:16:11.135162 2026] [:error] [pid 46914:tid 46998] [client 84.247.191.234:46356] [client 84.247.191.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.247.191.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXv4S1gSfJ4kZxNKlb_ZbgAAAJQ"]
[Fri Jan 30 09:51:55.120628 2026] [:error] [pid 24711:tid 24720] [client 43.134.141.244:33776] [client 43.134.141.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXwOu65Gwh4var6T23KPTQAAAUY"]
[Fri Jan 30 12:33:58.913537 2026] [:error] [pid 47021:tid 47036] [client 43.153.104.196:56188] [client 43.153.104.196] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXw0ttap1k13UdZUNSTVCQAAAM0"]
[Fri Jan 30 13:03:45.774760 2026] [:error] [pid 24711:tid 24729] [client 93.190.49.83:49204] [client 93.190.49.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.190.49.83, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXw7sa5Gwh4var6T23LwKgAAAU8"]
[Fri Jan 30 13:05:11.680950 2026] [:error] [pid 47021:tid 47039] [client 194.233.87.151:40526] [client 194.233.87.151] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXw8B9ap1k13UdZUNSTefgAAANA"]
[Fri Jan 30 13:10:14.678977 2026] [:error] [pid 38686:tid 38710] [client 51.77.43.178:43004] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/betflix%20co.aspx"] [unique_id "aXw9NgoE8BAjgw1_sAUVdQAAAdQ"]
[Fri Jan 30 13:10:18.314274 2026] [:error] [pid 24711:tid 24715] [client 51.77.43.178:47848] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20casino.aspx"] [unique_id "aXw9Oq5Gwh4var6T23LzTgAAAUE"]
[Fri Jan 30 13:10:19.063546 2026] [:error] [pid 46913:tid 46972] [client 51.77.43.178:47868] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/betflix%20co.aspx"] [unique_id "aXw9OzMWmKL8hOfC3uR-9gAAAFU"]
[Fri Jan 30 13:10:19.072563 2026] [:error] [pid 38686:tid 38690] [client 51.77.43.178:47860] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20slot.aspx"] [unique_id "aXw9OwoE8BAjgw1_sAUVdwAAAcA"]
[Fri Jan 30 13:10:23.690574 2026] [:error] [pid 46914:tid 46981] [client 51.77.43.178:47874] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20wallet.aspx"] [unique_id "aXw9P1gSfJ4kZxNKlb9FeQAAAIM"]
[Fri Jan 30 13:10:25.023840 2026] [:error] [pid 24681:tid 24689] [client 51.77.43.178:47880] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20slot.aspx"] [unique_id "aXw9QYE368IXQpahn0IxuwAAAQY"]
[Fri Jan 30 13:10:25.144659 2026] [:error] [pid 47021:tid 47044] [client 51.77.43.178:47886] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20co.aspx"] [unique_id "aXw9Qdap1k13UdZUNSTgHAAAANU"]
[Fri Jan 30 13:10:26.155199 2026] [:error] [pid 47663:tid 47671] [client 51.77.43.178:49924] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20betflik.aspx"] [unique_id "aXw9QkHGTrgIKCqEYbVMEgAAAkY"]
[Fri Jan 30 13:10:27.254361 2026] [:error] [pid 46914:tid 46988] [client 51.77.43.178:49940] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20wallet.aspx"] [unique_id "aXw9Q1gSfJ4kZxNKlb9FfQAAAIo"]
[Fri Jan 30 13:10:29.224664 2026] [:error] [pid 24681:tid 24698] [client 51.77.43.178:49950] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20slot.aspx"] [unique_id "aXw9RYE368IXQpahn0IxwAAAAQ8"]
[Fri Jan 30 13:10:31.766054 2026] [:error] [pid 24681:tid 24694] [client 51.77.43.178:49968] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20betflix.aspx"] [unique_id "aXw9R4E368IXQpahn0IxxAAAAQs"]
[Fri Jan 30 13:10:31.776772 2026] [:error] [pid 46913:tid 46961] [client 51.77.43.178:49964] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20betflik.aspx"] [unique_id "aXw9RzMWmKL8hOfC3uR--wAAAEo"]
[Fri Jan 30 13:10:34.407962 2026] [:error] [pid 24711:tid 24738] [client 51.77.43.178:49972] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20wallet.aspx"] [unique_id "aXw9Sq5Gwh4var6T23LzXwAAAVg"]
[Fri Jan 30 13:10:34.576199 2026] [:error] [pid 38686:tid 38695] [client 51.77.43.178:49976] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20betflix.aspx"] [unique_id "aXw9SgoE8BAjgw1_sAUVgwAAAcU"]
[Fri Jan 30 13:10:36.974461 2026] [:error] [pid 38980:tid 39006] [client 51.77.43.178:45360] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20wallet.aspx"] [unique_id "aXw9TLYByxUZEaKXdHpMpQAAAhM"]
[Fri Jan 30 13:10:37.713426 2026] [:error] [pid 38686:tid 38699] [client 51.77.43.178:45366] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20betflik.aspx"] [unique_id "aXw9TQoE8BAjgw1_sAUVhgAAAck"]
[Fri Jan 30 13:10:37.734138 2026] [:error] [pid 38980:tid 38995] [client 51.77.43.178:45370] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20wallet.aspx"] [unique_id "aXw9TbYByxUZEaKXdHpMpwAAAgg"]
[Fri Jan 30 13:10:39.194397 2026] [:error] [pid 38980:tid 38994] [client 51.77.43.178:45382] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/g2g%20slot.aspx"] [unique_id "aXw9T7YByxUZEaKXdHpMqgAAAgc"]
[Fri Jan 30 13:10:40.246062 2026] [:error] [pid 46914:tid 46988] [client 51.77.43.178:45392] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/g2g%20slot.aspx"] [unique_id "aXw9UFgSfJ4kZxNKlb9FhAAAAIo"]
[Fri Jan 30 13:10:42.507458 2026] [:error] [pid 46912:tid 46946] [client 51.77.43.178:45404] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "aXw9Uj6yiVW7A9NwFFl_1AAAABY"]
[Fri Jan 30 13:10:42.909729 2026] [:error] [pid 46914:tid 47001] [client 51.77.43.178:45420] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "aXw9UlgSfJ4kZxNKlb9FigAAAJc"]
[Fri Jan 30 13:10:43.708351 2026] [:error] [pid 47021:tid 47024] [client 51.77.43.178:45436] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20betflix.aspx"] [unique_id "aXw9U9ap1k13UdZUNSTgKgAAAME"]
[Fri Jan 30 13:10:47.018714 2026] [:error] [pid 46914:tid 46995] [client 51.77.43.178:51894] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "aXw9V1gSfJ4kZxNKlb9FjAAAAJE"]
[Fri Jan 30 13:10:47.077862 2026] [:error] [pid 46912:tid 46942] [client 51.77.43.178:51910] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20wallet.aspx"] [unique_id "aXw9Vz6yiVW7A9NwFFl_1wAAABI"]
[Fri Jan 30 13:10:47.114142 2026] [:error] [pid 24712:tid 24741] [client 51.77.43.178:51926] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "aXw9V4RLQrFiQF3h9-vX6wAAAYA"]
[Fri Jan 30 13:10:49.230847 2026] [:error] [pid 38686:tid 38690] [client 51.77.43.178:51938] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20slot.aspx"] [unique_id "aXw9WQoE8BAjgw1_sAUVjwAAAcA"]
[Fri Jan 30 13:10:51.417651 2026] [:error] [pid 24711:tid 24724] [client 51.77.43.178:51962] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20slot.aspx"] [unique_id "aXw9W65Gwh4var6T23LzZgAAAUo"]
[Fri Jan 30 13:10:51.462812 2026] [:error] [pid 46914:tid 46997] [client 51.77.43.178:51954] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/mega%20slot.aspx"] [unique_id "aXw9W1gSfJ4kZxNKlb9FkQAAAJM"]
[Fri Jan 30 13:10:52.860095 2026] [:error] [pid 46914:tid 46999] [client 51.77.43.178:51964] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/g2g%20slot.aspx"] [unique_id "aXw9XFgSfJ4kZxNKlb9FlQAAAJU"]
[Fri Jan 30 13:10:53.565662 2026] [:error] [pid 46913:tid 46953] [client 51.77.43.178:51976] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/metal%20slot.aspx"] [unique_id "aXw9XTMWmKL8hOfC3uR_DAAAAEI"]
[Fri Jan 30 13:10:53.800664 2026] [:error] [pid 46914:tid 46993] [client 51.77.43.178:51992] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/mega%20slot.aspx"] [unique_id "aXw9XVgSfJ4kZxNKlb9FlgAAAI8"]
[Fri Jan 30 13:10:56.095353 2026] [:error] [pid 46912:tid 46942] [client 51.77.43.178:35052] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/metal%20slot.aspx"] [unique_id "aXw9YD6yiVW7A9NwFFl_4QAAABI"]
[Fri Jan 30 13:10:57.066789 2026] [:error] [pid 46914:tid 46990] [client 51.77.43.178:35060] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "aXw9YVgSfJ4kZxNKlb9FmAAAAIw"]
[Fri Jan 30 13:11:00.001786 2026] [:error] [pid 46912:tid 46943] [client 51.77.43.178:35066] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "aXw9ZD6yiVW7A9NwFFl_7AAAABM"]
[Fri Jan 30 13:11:06.228639 2026] [:error] [pid 46913:tid 46958] [client 51.77.43.178:54394] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20slot.aspx"] [unique_id "aXw9ajMWmKL8hOfC3uR_HwAAAEc"]
[Fri Jan 30 13:17:55.301967 2026] [:error] [pid 24711:tid 24726] [client 51.77.43.178:33474] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20slot.aspx"] [unique_id "aXw_A65Gwh4var6T23L2OAAAAUw"]
[Fri Jan 30 13:17:55.775155 2026] [:error] [pid 46914:tid 46978] [client 51.77.43.178:38148] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/betflix%20wallet.aspx"] [unique_id "aXw_A1gSfJ4kZxNKlb9IFQAAAIA"]
[Fri Jan 30 13:17:57.235595 2026] [:error] [pid 38980:tid 39010] [client 51.77.43.178:38162] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflik%20thailand.aspx"] [unique_id "aXw_BbYByxUZEaKXdHpOKwAAAhc"]
[Fri Jan 30 13:17:58.626732 2026] [:error] [pid 46912:tid 46927] [client 51.77.43.178:38166] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20betflik.aspx"] [unique_id "aXw_Bj6yiVW7A9NwFFmCGQAAAAM"]
[Fri Jan 30 13:17:59.627122 2026] [:error] [pid 24681:tid 24684] [client 51.77.43.178:38174] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20wallet.aspx"] [unique_id "aXw_B4E368IXQpahn0IzKgAAAQE"]
[Fri Jan 30 13:18:00.237742 2026] [:error] [pid 46914:tid 46987] [client 51.77.43.178:38186] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20auto.aspx"] [unique_id "aXw_CFgSfJ4kZxNKlb9IGAAAAIk"]
[Fri Jan 30 13:18:02.698037 2026] [:error] [pid 24681:tid 24704] [client 51.77.43.178:38196] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20betflix.aspx"] [unique_id "aXw_CoE368IXQpahn0IzNgAAARU"]
[Fri Jan 30 13:18:03.578493 2026] [:error] [pid 24711:tid 24717] [client 51.77.43.178:38212] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20casino.aspx"] [unique_id "aXw_C65Gwh4var6T23L2SAAAAUM"]
[Fri Jan 30 13:18:04.189866 2026] [:error] [pid 46914:tid 46980] [client 51.77.43.178:38216] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20betflik.aspx"] [unique_id "aXw_DFgSfJ4kZxNKlb9IGwAAAII"]
[Fri Jan 30 13:18:04.905351 2026] [:error] [pid 38686:tid 38702] [client 51.77.43.178:38230] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20wallet.aspx"] [unique_id "aXw_DAoE8BAjgw1_sAUXNgAAAcw"]
[Fri Jan 30 13:18:09.063271 2026] [:error] [pid 38980:tid 38992] [client 51.77.43.178:46090] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20betflix.aspx"] [unique_id "aXw_EbYByxUZEaKXdHpOMgAAAgU"]
[Fri Jan 30 13:18:09.986291 2026] [:error] [pid 24711:tid 24719] [client 51.77.43.178:46100] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/g2g%20slot.aspx"] [unique_id "aXw_Ea5Gwh4var6T23L2UAAAAUU"]
[Fri Jan 30 13:18:10.326321 2026] [:error] [pid 24681:tid 24699] [client 51.77.43.178:46108] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20co.aspx"] [unique_id "aXw_EoE368IXQpahn0IzPwAAARA"]
[Fri Jan 30 13:18:11.477894 2026] [:error] [pid 47663:tid 47665] [client 51.77.43.178:46114] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20wallet.aspx"] [unique_id "aXw_E0HGTrgIKCqEYbVNzgAAAkA"]
[Fri Jan 30 13:18:12.513636 2026] [:error] [pid 47021:tid 47045] [client 51.77.43.178:46124] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "aXw_FNap1k13UdZUNSTifQAAANY"]
[Fri Jan 30 13:18:14.089891 2026] [:error] [pid 24711:tid 24715] [client 51.77.43.178:46138] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/g2g%20slot.aspx"] [unique_id "aXw_Fq5Gwh4var6T23L2WwAAAUE"]
[Fri Jan 30 13:18:14.886929 2026] [:error] [pid 38686:tid 38700] [client 51.77.43.178:46140] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20slot.aspx"] [unique_id "aXw_FgoE8BAjgw1_sAUXRQAAAco"]
[Fri Jan 30 13:18:17.429543 2026] [:error] [pid 24712:tid 24748] [client 51.77.43.178:49124] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "aXw_GYRLQrFiQF3h9-vaXgAAAYc"]
[Fri Jan 30 13:18:17.965882 2026] [:error] [pid 38686:tid 38706] [client 51.77.43.178:49134] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "aXw_GQoE8BAjgw1_sAUXSgAAAdA"]
[Fri Jan 30 13:18:18.566504 2026] [:error] [pid 46914:tid 47002] [client 51.77.43.178:49144] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/betflix%20wallet.aspx"] [unique_id "aXw_GlgSfJ4kZxNKlb9IOAAAAJg"]
[Fri Jan 30 13:18:20.303028 2026] [:error] [pid 24681:tid 24694] [client 51.77.43.178:49160] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20slot.aspx"] [unique_id "aXw_HIE368IXQpahn0IzRAAAAQs"]
[Fri Jan 30 13:18:22.416702 2026] [:error] [pid 38686:tid 38708] [client 51.77.43.178:49174] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "aXw_HgoE8BAjgw1_sAUXUAAAAdI"]
[Fri Jan 30 13:18:25.446270 2026] [:error] [pid 46912:tid 46931] [client 51.77.43.178:49176] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20betflik.aspx"] [unique_id "aXw_IT6yiVW7A9NwFFmCKwAAAAc"]
[Fri Jan 30 13:18:27.778163 2026] [:error] [pid 38980:tid 39004] [client 51.77.43.178:60538] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20slot.aspx"] [unique_id "aXw_I7YByxUZEaKXdHpOQwAAAhE"]
[Fri Jan 30 13:18:28.513602 2026] [:error] [pid 38686:tid 38711] [client 51.77.43.178:60542] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/mega%20slot.aspx"] [unique_id "aXw_JAoE8BAjgw1_sAUXVQAAAdU"]
[Fri Jan 30 13:18:28.973783 2026] [:error] [pid 46914:tid 46997] [client 51.77.43.178:60554] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20betflix.aspx"] [unique_id "aXw_JFgSfJ4kZxNKlb9IVQAAAJM"]
[Fri Jan 30 13:18:30.242266 2026] [:error] [pid 46914:tid 46981] [client 51.77.43.178:60570] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/mega%20slot.aspx"] [unique_id "aXw_JlgSfJ4kZxNKlb9IXwAAAIM"]
[Fri Jan 30 13:18:31.266563 2026] [:error] [pid 46912:tid 46947] [client 51.77.43.178:60582] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/metal%20slot.aspx"] [unique_id "aXw_Jz6yiVW7A9NwFFmCdwAAABc"]
[Fri Jan 30 13:18:34.011076 2026] [:error] [pid 46913:tid 46956] [client 51.77.43.178:60588] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/casino%20wallet.aspx"] [unique_id "aXw_KjMWmKL8hOfC3uSA1QAAAEU"]
[Fri Jan 30 13:18:34.784220 2026] [:error] [pid 47021:tid 47047] [client 51.77.43.178:60596] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/metal%20slot.aspx"] [unique_id "aXw_Ktap1k13UdZUNSTiuQAAANg"]
[Fri Jan 30 13:18:37.298866 2026] [:error] [pid 24711:tid 24734] [client 51.77.43.178:36286] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/g2g%20slot.aspx"] [unique_id "aXw_La5Gwh4var6T23L2fQAAAVQ"]
[Fri Jan 30 13:18:41.766570 2026] [:error] [pid 46912:tid 46932] [client 51.77.43.178:36290] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "aXw_MT6yiVW7A9NwFFmCjAAAAAg"]
[Fri Jan 30 13:18:47.012512 2026] [:error] [pid 38980:tid 38996] [client 51.77.43.178:42322] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "aXw_N7YByxUZEaKXdHpOXAAAAgk"]
[Fri Jan 30 13:18:50.703003 2026] [:error] [pid 46913:tid 46957] [client 51.77.43.178:42326] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20slot.aspx"] [unique_id "aXw_OjMWmKL8hOfC3uSBCgAAAEY"]
[Fri Jan 30 13:23:45.068249 2026] [:error] [pid 24711:tid 24738] [client 51.77.43.178:34590] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20auto%20slot.aspx"] [unique_id "aXxAYa5Gwh4var6T23L4-AAAAVg"]
[Fri Jan 30 13:23:51.001436 2026] [:error] [pid 46913:tid 46973] [client 51.77.43.178:38876] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "aXxAZzMWmKL8hOfC3uSCFAAAAFY"]
[Fri Jan 30 13:23:55.994212 2026] [:error] [pid 46914:tid 46995] [client 51.77.43.178:40508] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20slot.aspx"] [unique_id "aXxAa1gSfJ4kZxNKlb9KHAAAAJE"]
[Fri Jan 30 13:23:59.127527 2026] [:error] [pid 47021:tid 47029] [client 51.77.43.178:40522] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/mega%20slot.aspx"] [unique_id "aXxAb9ap1k13UdZUNSTkKwAAAMY"]
[Fri Jan 30 13:24:01.661276 2026] [:error] [pid 38686:tid 38707] [client 51.77.43.178:40530] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/metal%20slot.aspx"] [unique_id "aXxAcQoE8BAjgw1_sAUYiQAAAdE"]
[Fri Jan 30 13:41:45.620034 2026] [:error] [pid 24712:tid 24760] [client 145.249.115.111:40688] [client 145.249.115.111] ModSecurity: Multipart parsing error (init): Multipart: Boundary not found in C-T. [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXxEmYRLQrFiQF3h9-vh7wAAAZI"]
[Fri Jan 30 13:41:45.621160 2026] [:error] [pid 24712:tid 24760] [client 145.249.115.111:40688] [client 145.249.115.111] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||www.expressinteriors.com|F|2"] [data "Multipart: Boundary not found in C-T."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXxEmYRLQrFiQF3h9-vh7wAAAZI"]
[Fri Jan 30 13:41:45.621245 2026] [:error] [pid 24712:tid 24760] [client 145.249.115.111:40688] [client 145.249.115.111] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 0, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||www.expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aXxEmYRLQrFiQF3h9-vh7wAAAZI"]
[Fri Jan 30 13:49:50.435871 2026] [:error] [pid 47663:tid 47674] [client 51.77.43.178:45106] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20bet%20slot.aspx"] [unique_id "aXxGfkHGTrgIKCqEYbVUjQAAAkk"]
[Fri Jan 30 13:49:53.815584 2026] [:error] [pid 47021:tid 47031] [client 51.77.43.178:45122] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/galaxy%20slot.aspx"] [unique_id "aXxGgdap1k13UdZUNSTrowAAAMg"]
[Fri Jan 30 13:49:57.823314 2026] [:error] [pid 38980:tid 38988] [client 51.77.43.178:54196] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/mega%20slot.aspx"] [unique_id "aXxGhbYByxUZEaKXdHpVdQAAAgE"]
[Fri Jan 30 13:50:01.958517 2026] [:error] [pid 24712:tid 24742] [client 51.77.43.178:54202] [client 51.77.43.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/metal%20slot.aspx"] [unique_id "aXxGiYRLQrFiQF3h9-vkJQAAAYE"]
[Fri Jan 30 15:04:46.838889 2026] [:error] [pid 46912:tid 46947] [client 44.220.80.169:48090] [client 44.220.80.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 44.220.80.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXxYDj6yiVW7A9NwFFmaIQAAABc"]
[Fri Jan 30 16:10:55.119217 2026] [:error] [pid 24681:tid 24693] [client 91.217.249.185:34581] [client 91.217.249.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.217.249.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXxnj4E368IXQpahn0JS_AAAAQo"]
[Fri Jan 30 18:33:26.540069 2026] [:error] [pid 46912:tid 46948] [client 91.217.249.189:22975] [client 91.217.249.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.217.249.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXyI9j6yiVW7A9NwFFnFwgAAABg"]
[Fri Jan 30 18:56:48.009849 2026] [:error] [pid 47663:tid 47666] [client 170.106.193.108:55286] [client 170.106.193.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aXyOcEHGTrgIKCqEYbWFsgAAAkE"]
[Fri Jan 30 19:47:58.651623 2026] [:error] [pid 47021:tid 47042] [client 91.217.249.189:41797] [client 91.217.249.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.217.249.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXyabtap1k13UdZUNSQ4WQAAANM"]
[Fri Jan 30 20:22:55.498004 2026] [:error] [pid 24711:tid 24738] [client 47.244.90.157:56562] [client 47.244.90.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.244.90.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXyin65Gwh4var6T23KLZQAAAVg"]
[Fri Jan 30 20:58:45.377014 2026] [:error] [pid 24711:tid 24733] [client 91.217.249.212:65227] [client 91.217.249.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.217.249.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXyrBa5Gwh4var6T23KWCwAAAVM"]
[Fri Jan 30 21:16:11.898875 2026] [:error] [pid 38686:tid 38704] [client 193.202.110.29:45418] [client 193.202.110.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.202.110.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXyvGwoE8BAjgw1_sAVqugAAAc4"]
[Fri Jan 30 21:16:17.864519 2026] [:error] [pid 47021:tid 47023] [client 31.193.196.44:54492] [client 31.193.196.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.193.196.44, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXyvIdap1k13UdZUNSRJJAAAAMA"]
[Fri Jan 30 21:16:53.412148 2026] [:error] [pid 46914:tid 46994] [client 178.128.239.177:50936] [client 178.128.239.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.128.239.177, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXyvRVgSfJ4kZxNKlb_MQwAAAJA"]
[Fri Jan 30 21:17:07.713589 2026] [:error] [pid 47021:tid 47034] [client 31.186.11.162:54988] [client 31.186.11.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.186.11.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXyvU9ap1k13UdZUNSRJQwAAAMs"]
[Fri Jan 30 21:17:31.205795 2026] [:error] [pid 24712:tid 24742] [client 211.149.230.55:52374] [client 211.149.230.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.149.230.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXyva4RLQrFiQF3h9-tNQwAAAYE"]
[Fri Jan 30 22:10:27.246810 2026] [:error] [pid 46914:tid 46981] [client 91.217.249.182:37467] [client 91.217.249.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.217.249.182, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXy701gSfJ4kZxNKlb_d7AAAAIM"]
[Fri Jan 30 22:12:21.718007 2026] [:error] [pid 46912:tid 46940] [client 45.137.126.45:45885] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aXy8RT6yiVW7A9NwFFn3BQAAABA"]
[Fri Jan 30 22:12:35.660425 2026] [:error] [pid 46912:tid 46945] [client 45.137.126.53:50593] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aXy8Uz6yiVW7A9NwFFn3bQAAABU"]
[Fri Jan 30 22:13:01.921010 2026] [:error] [pid 47021:tid 47043] [client 45.137.126.46:47541] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aXy8bdap1k13UdZUNSRdnwAAANQ"]
[Fri Jan 30 22:13:13.247049 2026] [:error] [pid 38980:tid 38994] [client 45.137.126.29:34147] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aXy8ebYByxUZEaKXdHq3-AAAAgc"]
[Fri Jan 30 22:13:35.680397 2026] [:error] [pid 47021:tid 47047] [client 45.137.126.3:58473] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aXy8j9ap1k13UdZUNSRfNgAAANg"]
[Fri Jan 30 22:13:43.274985 2026] [:error] [pid 24712:tid 24766] [client 45.137.126.20:32773] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aXy8l4RLQrFiQF3h9-tiggAAAZg"]
[Fri Jan 30 22:13:44.369661 2026] [:error] [pid 38980:tid 38999] [client 45.137.126.7:43043] [client 45.137.126.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aXy8mLYByxUZEaKXdHq5PQAAAgw"]
[Fri Jan 30 22:13:45.480002 2026] [:error] [pid 38686:tid 38704] [client 45.137.126.43:39527] [client 45.137.126.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aXy8mQoE8BAjgw1_sAV-WQAAAc4"]
[Fri Jan 30 22:13:46.573712 2026] [:error] [pid 47021:tid 47027] [client 45.137.126.29:62217] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aXy8mtap1k13UdZUNSRflQAAAMQ"]
[Fri Jan 30 22:13:47.686282 2026] [:error] [pid 46912:tid 46933] [client 45.137.126.14:20965] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aXy8mz6yiVW7A9NwFFn5wwAAAAk"]
[Fri Jan 30 22:13:51.536899 2026] [:error] [pid 47021:tid 47031] [client 45.137.126.14:44805] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aXy8n9ap1k13UdZUNSRf2QAAAMg"]
[Fri Jan 30 22:13:52.659907 2026] [:error] [pid 38686:tid 38703] [client 45.137.126.18:20307] [client 45.137.126.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inc.php"] [unique_id "aXy8oAoE8BAjgw1_sAV-fAAAAc0"]
[Fri Jan 30 22:13:59.113771 2026] [:error] [pid 24711:tid 24734] [client 45.137.126.53:37307] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aXy8p65Gwh4var6T23K7eQAAAVQ"]
[Fri Jan 30 22:14:15.989099 2026] [autoindex:error] [pid 47021:tid 47043] [client 45.137.126.52:25331] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:14:16.559647 2026] [autoindex:error] [pid 47021:tid 47033] [client 45.137.126.52:25331] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:14:17.158527 2026] [autoindex:error] [pid 47021:tid 47039] [client 45.137.126.52:25331] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:14:17.726396 2026] [autoindex:error] [pid 47021:tid 47028] [client 45.137.126.52:25331] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:14:23.992736 2026] [autoindex:error] [pid 47021:tid 47024] [client 45.137.126.52:25331] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:14:24.576874 2026] [autoindex:error] [pid 47021:tid 47046] [client 45.137.126.52:25331] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:14:25.165720 2026] [autoindex:error] [pid 47021:tid 47034] [client 45.137.126.52:25331] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:14:25.723774 2026] [autoindex:error] [pid 47021:tid 47047] [client 45.137.126.52:25331] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:14:26.324474 2026] [autoindex:error] [pid 47021:tid 47025] [client 45.137.126.52:25331] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:14:26.878236 2026] [autoindex:error] [pid 47021:tid 47038] [client 45.137.126.52:25331] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:14:28.054487 2026] [autoindex:error] [pid 47021:tid 47046] [client 45.137.126.52:25331] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:14:33.864398 2026] [autoindex:error] [pid 47021:tid 47025] [client 45.137.126.52:25331] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:14:34.427272 2026] [autoindex:error] [pid 47021:tid 47026] [client 45.137.126.52:25331] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:14:48.673139 2026] [autoindex:error] [pid 47021:tid 47025] [client 45.137.126.52:25331] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:14:49.276150 2026] [autoindex:error] [pid 47021:tid 47029] [client 45.137.126.52:25331] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:14:49.833086 2026] [autoindex:error] [pid 47021:tid 47028] [client 45.137.126.52:25331] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:14:50.414319 2026] [autoindex:error] [pid 47021:tid 47043] [client 45.137.126.52:25331] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:14:59.566087 2026] [autoindex:error] [pid 47021:tid 47029] [client 45.137.126.52:25331] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:15:00.132752 2026] [autoindex:error] [pid 47021:tid 47042] [client 45.137.126.52:25331] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:15:06.460146 2026] [:error] [pid 47021:tid 47046] [client 45.137.126.52:25331] [client 45.137.126.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/"] [unique_id "aXy86tap1k13UdZUNSRi8gAAANc"]
[Fri Jan 30 22:15:07.577365 2026] [autoindex:error] [pid 46912:tid 46927] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:15:18.478243 2026] [autoindex:error] [pid 46912:tid 46934] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:15:19.032037 2026] [autoindex:error] [pid 46912:tid 46938] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:15:19.594070 2026] [autoindex:error] [pid 46912:tid 46932] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:15:33.144483 2026] [autoindex:error] [pid 46912:tid 46937] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:15:45.481441 2026] [autoindex:error] [pid 46912:tid 46939] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:15:48.985381 2026] [autoindex:error] [pid 46912:tid 46937] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:15:49.542119 2026] [autoindex:error] [pid 46912:tid 46947] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:15:51.235041 2026] [autoindex:error] [pid 46912:tid 46936] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:15:51.796363 2026] [autoindex:error] [pid 46912:tid 46934] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:15:52.348214 2026] [autoindex:error] [pid 46912:tid 46942] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:16:13.673608 2026] [autoindex:error] [pid 46912:tid 46926] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:17:27.585187 2026] [autoindex:error] [pid 46912:tid 46937] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:17:28.140083 2026] [autoindex:error] [pid 46912:tid 46939] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:17:28.697326 2026] [autoindex:error] [pid 46912:tid 46928] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:17:29.249021 2026] [autoindex:error] [pid 46912:tid 46944] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:17:33.508375 2026] [autoindex:error] [pid 46912:tid 46938] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:17:34.059431 2026] [autoindex:error] [pid 46912:tid 46945] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:17:36.492066 2026] [autoindex:error] [pid 46912:tid 46948] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:17:38.705990 2026] [autoindex:error] [pid 46912:tid 46939] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:17:39.263204 2026] [autoindex:error] [pid 46912:tid 46934] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:17:39.823231 2026] [autoindex:error] [pid 46912:tid 46936] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:17:41.930337 2026] [autoindex:error] [pid 46912:tid 46946] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:17:42.483789 2026] [autoindex:error] [pid 46912:tid 46934] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:17:43.050119 2026] [autoindex:error] [pid 46912:tid 46929] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:17:43.619881 2026] [autoindex:error] [pid 46912:tid 46922] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:18:37.024147 2026] [autoindex:error] [pid 46912:tid 46944] [client 45.137.126.36:57593] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:19:03.313357 2026] [autoindex:error] [pid 38686:tid 38707] [client 45.137.126.50:62217] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:19:12.161276 2026] [autoindex:error] [pid 38686:tid 38699] [client 45.137.126.50:62217] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:19:12.721125 2026] [autoindex:error] [pid 38686:tid 38713] [client 45.137.126.50:62217] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:19:20.105028 2026] [autoindex:error] [pid 38686:tid 38706] [client 45.137.126.50:62217] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:19:20.657097 2026] [autoindex:error] [pid 38686:tid 38714] [client 45.137.126.50:62217] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:19:21.216412 2026] [autoindex:error] [pid 38686:tid 38707] [client 45.137.126.50:62217] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:19:21.777089 2026] [autoindex:error] [pid 38686:tid 38699] [client 45.137.126.50:62217] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:19:22.329126 2026] [autoindex:error] [pid 38686:tid 38693] [client 45.137.126.50:62217] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:19:22.908790 2026] [autoindex:error] [pid 38686:tid 38710] [client 45.137.126.50:62217] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:19:23.473880 2026] [autoindex:error] [pid 38686:tid 38711] [client 45.137.126.50:62217] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:19:24.024489 2026] [autoindex:error] [pid 38686:tid 38708] [client 45.137.126.50:62217] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:19:24.583703 2026] [autoindex:error] [pid 38686:tid 38701] [client 45.137.126.50:62217] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:19:59.969239 2026] [autoindex:error] [pid 38686:tid 38710] [client 45.137.126.50:62217] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Jan 30 22:28:49.396820 2026] [:error] [pid 46912:tid 46927] [client 81.8.91.201:56304] [client 81.8.91.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.8.91.201, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXzAIT6yiVW7A9NwFFkLYQAAAAM"]
[Fri Jan 30 23:18:09.365830 2026] [:error] [pid 24711:tid 24714] [client 20.240.47.47:17603] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doko.php"] [unique_id "aXzLsa5Gwh4var6T23LYsAAAAUA"]
[Fri Jan 30 23:18:13.739060 2026] [:error] [pid 46912:tid 46933] [client 20.240.47.47:28646] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doko.php"] [unique_id "aXzLtT6yiVW7A9NwFFkdAwAAAAk"]
[Fri Jan 30 23:18:16.819816 2026] [:error] [pid 38980:tid 39010] [client 20.240.47.47:37465] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doko.php"] [unique_id "aXzLuLYByxUZEaKXdHrNUgAAAhc"]
[Fri Jan 30 23:18:18.664070 2026] [:error] [pid 46913:tid 46971] [client 20.240.47.47:9530] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doko.php"] [unique_id "aXzLujMWmKL8hOfC3uTzggAAAFQ"]
[Fri Jan 30 23:18:20.170159 2026] [:error] [pid 24711:tid 24724] [client 20.240.47.47:28594] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sst.php"] [unique_id "aXzLvK5Gwh4var6T23LYtQAAAUo"]
[Fri Jan 30 23:18:21.420714 2026] [:error] [pid 24711:tid 24738] [client 20.240.47.47:9515] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sst.php"] [unique_id "aXzLva5Gwh4var6T23LYuAAAAVg"]
[Fri Jan 30 23:18:30.961024 2026] [:error] [pid 46913:tid 46974] [client 20.240.47.47:18175] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sst.php"] [unique_id "aXzLxjMWmKL8hOfC3uTziQAAAFc"]
[Fri Jan 30 23:19:33.335381 2026] [:error] [pid 38980:tid 38991] [client 20.240.47.47:30603] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aXzMBbYByxUZEaKXdHrNlwAAAgQ"]
[Fri Jan 30 23:19:35.182616 2026] [:error] [pid 47663:tid 47689] [client 20.240.47.47:28633] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aXzMB0HGTrgIKCqEYbW9WwAAAlg"]
[Fri Jan 30 23:19:38.926610 2026] [:error] [pid 38686:tid 38692] [client 20.240.47.47:37479] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aXzMCgoE8BAjgw1_sAWUKAAAAcI"]
[Fri Jan 30 23:19:41.437324 2026] [:error] [pid 47021:tid 47026] [client 20.240.47.47:9487] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aXzMDdap1k13UdZUNSR34wAAAMM"]
[Fri Jan 30 23:19:42.491544 2026] [:error] [pid 46914:tid 46993] [client 20.240.47.47:9061] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ty.php"] [unique_id "aXzMDlgSfJ4kZxNKlb_-EgAAAI8"]
[Fri Jan 30 23:19:44.080028 2026] [:error] [pid 24712:tid 24753] [client 20.240.47.47:37488] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ty.php"] [unique_id "aXzMEIRLQrFiQF3h9-t6vQAAAYw"]
[Fri Jan 30 23:19:48.331365 2026] [:error] [pid 46912:tid 46948] [client 20.240.47.47:28668] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ty.php"] [unique_id "aXzMFD6yiVW7A9NwFFkdPgAAABg"]
[Fri Jan 30 23:19:50.590763 2026] [:error] [pid 47021:tid 47045] [client 20.240.47.47:8225] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ty.php"] [unique_id "aXzMFtap1k13UdZUNSR37AAAANY"]
[Fri Jan 30 23:19:52.233017 2026] [:error] [pid 24711:tid 24737] [client 20.240.47.47:18081] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/RIP.php"] [unique_id "aXzMGK5Gwh4var6T23LY8gAAAVc"]
[Fri Jan 30 23:19:58.034329 2026] [:error] [pid 47663:tid 47666] [client 20.240.47.47:18051] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/RIP.php"] [unique_id "aXzMHkHGTrgIKCqEYbW9cAAAAkE"]
[Fri Jan 30 23:20:09.923542 2026] [:error] [pid 24681:tid 24686] [client 20.240.47.47:28560] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bayss.php"] [unique_id "aXzMKYE368IXQpahn0KoPAAAAQM"]
[Fri Jan 30 23:20:12.740157 2026] [:error] [pid 46913:tid 46951] [client 20.240.47.47:9037] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bayss.php"] [unique_id "aXzMLDMWmKL8hOfC3uTztAAAAEA"]
[Fri Jan 30 23:20:15.061521 2026] [:error] [pid 47021:tid 47043] [client 20.240.47.47:10565] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bayss.php"] [unique_id "aXzML9ap1k13UdZUNSR38wAAANQ"]
[Fri Jan 30 23:20:17.127606 2026] [:error] [pid 46914:tid 46999] [client 20.240.47.47:18106] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bayss.php"] [unique_id "aXzMMVgSfJ4kZxNKlb_-IAAAAJU"]
[Fri Jan 30 23:20:18.872600 2026] [:error] [pid 38686:tid 38709] [client 20.240.47.47:17653] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w1.php"] [unique_id "aXzMMgoE8BAjgw1_sAWUMwAAAdM"]
[Fri Jan 30 23:20:22.895565 2026] [:error] [pid 47021:tid 47034] [client 20.240.47.47:37463] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w1.php"] [unique_id "aXzMNtap1k13UdZUNSR3-QAAAMs"]
[Fri Jan 30 23:20:24.895178 2026] [:error] [pid 47021:tid 47032] [client 20.240.47.47:9596] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w1.php"] [unique_id "aXzMONap1k13UdZUNSR3_QAAAMk"]
[Fri Jan 30 23:20:30.920938 2026] [:error] [pid 46914:tid 46988] [client 20.240.47.47:17615] [client 20.240.47.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w1.php"] [unique_id "aXzMPlgSfJ4kZxNKlb_-KQAAAIo"]
[Fri Jan 30 23:22:36.124187 2026] [:error] [pid 24711:tid 24724] [client 45.86.202.206:55917] [client 45.86.202.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.206, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXzMvK5Gwh4var6T23LZSwAAAUo"]
[Sat Jan 31 00:38:42.454844 2026] [:error] [pid 59661:tid 59699] [client 91.217.249.206:62735] [client 91.217.249.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.217.249.206, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXzekpw_qINw5Uk-43XHHAAAAEg"]
[Sat Jan 31 00:42:21.042950 2026] [:error] [pid 59748:tid 59761] [client 5.253.0.94:43432] [client 5.253.0.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.253.0.94, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXzfbWlxTen-ziDxotRxGwAAAMo"]
[Sat Jan 31 00:51:14.972645 2026] [:error] [pid 59748:tid 59770] [client 203.59.224.59:61475] [client 203.59.224.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.59.224.59, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXzhgmlxTen-ziDxotR0CgAAANM"]
[Sat Jan 31 00:51:23.358775 2026] [:error] [pid 59660:tid 59665] [client 50.6.35.18:24918] [client 50.6.35.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.6.35.18, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXzhiywTX33V6TPUqxPb5gAAAAE"]
[Sat Jan 31 00:51:36.760358 2026] [:error] [pid 60001:tid 60004] [client 103.163.138.82:59500] [client 103.163.138.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.163.138.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXzhmKM2ziQ7JN4IjDxFAgAAAQE"]
[Sat Jan 31 00:52:06.244493 2026] [:error] [pid 59661:tid 59709] [client 34.70.133.56:45082] [client 34.70.133.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.70.133.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXzhtpw_qINw5Uk-43XMFgAAAFI"]
[Sat Jan 31 02:03:20.242804 2026] [:error] [pid 8386:tid 8404] [client 91.217.249.209:42777] [client 91.217.249.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.217.249.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aXzyaNZVZWDVqOkRRiJZ_AAAAdA"]
[Sat Jan 31 02:09:08.470332 2026] [ssl:error] [pid 59660:tid 59674] [client 107.172.58.36:48870] AH02032: Hostname www.cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup, referer: http://www.cdbdinteriors.com.au/
[Sat Jan 31 02:54:39.480922 2026] [:error] [pid 60001:tid 60015] [client 35.198.41.118:36546] [client 35.198.41.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.198.41.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aXz-b6M2ziQ7JN4IjDxlVwAAAQw"]
[Sat Jan 31 03:24:45.263354 2026] [:error] [pid 35605:tid 35741] [client 91.217.249.220:54585] [client 91.217.249.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.217.249.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX0FfUE0LGv7vurmDzdptQAAAJY"]
[Sat Jan 31 04:45:12.989413 2026] [autoindex:error] [pid 39243:tid 39288] [client 52.140.123.244:18051] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 31 04:45:13.137408 2026] [autoindex:error] [pid 39243:tid 39285] [client 52.140.123.244:18051] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 31 04:45:13.285768 2026] [autoindex:error] [pid 39243:tid 39306] [client 52.140.123.244:18051] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 31 04:45:13.428932 2026] [autoindex:error] [pid 39243:tid 39297] [client 52.140.123.244:18051] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 31 04:45:17.572965 2026] [authz_core:error] [pid 39243:tid 39282] [client 52.140.123.244:18051] AH01630: client denied by server configuration: /home/expressi/public_html/wp-content/plugins/akismet/
[Sat Jan 31 04:45:18.461071 2026] [autoindex:error] [pid 39243:tid 39290] [client 52.140.123.244:18051] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentythree/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 31 04:45:18.603269 2026] [autoindex:error] [pid 39243:tid 39303] [client 52.140.123.244:18051] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 31 04:45:18.744692 2026] [autoindex:error] [pid 39243:tid 39288] [client 52.140.123.244:18051] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 31 04:45:20.335627 2026] [autoindex:error] [pid 39243:tid 39297] [client 52.140.123.244:18051] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/thickbox/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 31 04:45:20.477337 2026] [autoindex:error] [pid 39243:tid 39296] [client 52.140.123.244:18051] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 31 04:45:20.618616 2026] [autoindex:error] [pid 39243:tid 39291] [client 52.140.123.244:18051] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 31 04:45:20.760937 2026] [autoindex:error] [pid 39243:tid 39304] [client 52.140.123.244:18051] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 31 04:45:20.906428 2026] [autoindex:error] [pid 39243:tid 39286] [client 52.140.123.244:18051] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 31 04:45:21.060425 2026] [autoindex:error] [pid 39243:tid 39293] [client 52.140.123.244:18051] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 31 04:45:22.743756 2026] [autoindex:error] [pid 39243:tid 39298] [client 52.140.123.244:18051] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 31 04:45:23.624460 2026] [autoindex:error] [pid 39243:tid 39282] [client 52.140.123.244:18051] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/contact-form-7/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 31 04:46:03.357299 2026] [:error] [pid 20210:tid 20220] [client 91.217.249.186:22417] [client 91.217.249.186] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.217.249.186, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX0Yi3Ky7OGBlTY8MCehZAAAAQg"]
[Sat Jan 31 05:09:05.849614 2026] [:error] [pid 39244:tid 39326] [client 5.135.142.201:42072] [client 5.135.142.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.135.142.201, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX0d8Xo-KRTvg3jHEDzOKgAAAJA"]
[Sat Jan 31 05:14:46.368565 2026] [:error] [pid 39244:tid 39323] [client 167.235.156.214:58848] [client 167.235.156.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.235.156.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX0fRno-KRTvg3jHEDzP-gAAAI0"]
[Sat Jan 31 05:14:46.967507 2026] [:error] [pid 39244:tid 39334] [client 47.121.189.155:39382] [client 47.121.189.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.121.189.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX0fRno-KRTvg3jHEDzP-wAAAJg"]
[Sat Jan 31 05:15:08.852358 2026] [:error] [pid 39242:tid 39255] [client 47.109.143.1:35566] [client 47.109.143.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.109.143.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX0fXNOgXnkKGGSSCINmlwAAAAE"]
[Sat Jan 31 05:44:13.633961 2026] [:error] [pid 20836:tid 20859] [client 147.135.252.182:34544] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufabet%207777.aspx"] [unique_id "aX0mLYACllgWRWVrYITl9QAAAVI"]
[Sat Jan 31 05:44:15.810256 2026] [:error] [pid 39243:tid 39306] [client 147.135.252.182:34556] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufabet%20auto%20wallet.aspx"] [unique_id "aX0mLxBW1k4JK8a4v0ZJ2AAAAFg"]
[Sat Jan 31 05:44:17.951097 2026] [:error] [pid 39339:tid 39359] [client 147.135.252.182:60330] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufabet%20net.aspx"] [unique_id "aX0mMcWi-IjigR3oHY6Z_wAAANI"]
[Sat Jan 31 05:44:20.185387 2026] [:error] [pid 39243:tid 39297] [client 147.135.252.182:60344] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufabet%20wallet%20777.aspx"] [unique_id "aX0mNBBW1k4JK8a4v0ZJ3wAAAE8"]
[Sat Jan 31 05:44:22.303825 2026] [:error] [pid 39244:tid 39333] [client 147.135.252.182:60354] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/w69%20slot.aspx"] [unique_id "aX0mNno-KRTvg3jHEDzaOwAAAJc"]
[Sat Jan 31 05:44:24.517855 2026] [:error] [pid 20210:tid 20218] [client 147.135.252.182:60360] [client 147.135.252.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/wallet%20slot.aspx"] [unique_id "aX0mOHKy7OGBlTY8MCe4mwAAAQY"]
[Sat Jan 31 06:04:55.926565 2026] [:error] [pid 39243:tid 39288] [client 91.217.249.196:41983] [client 91.217.249.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.217.249.196, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX0rBxBW1k4JK8a4v0ZP1AAAAEY"]
[Sat Jan 31 06:44:55.945327 2026] [:error] [pid 20836:tid 20855] [client 122.51.236.174:54328] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aX00Z4ACllgWRWVrYIT8iAAAAU4"]
[Sat Jan 31 07:22:58.895077 2026] [:error] [pid 52415:tid 52422] [client 91.217.249.186:45827] [client 91.217.249.186] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.217.249.186, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX09Up-DUxb_li2fU6IYOgAAAYU"]
[Sat Jan 31 08:40:12.893132 2026] [:error] [pid 52415:tid 52436] [client 163.47.203.79:35460] [client 163.47.203.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.47.203.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX1PbJ-DUxb_li2fU6IwUAAAAZM"]
[Sat Jan 31 08:40:18.608909 2026] [:error] [pid 52451:tid 52465] [client 163.61.182.29:57982] [client 163.61.182.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.61.182.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX1PcnubVy7MGYWM2NY6DAAAAcs"]
[Sat Jan 31 08:40:37.363147 2026] [:error] [pid 52415:tid 52440] [client 31.186.11.162:50918] [client 31.186.11.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.186.11.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX1PhZ-DUxb_li2fU6IwmAAAAZc"]
[Sat Jan 31 08:40:48.237046 2026] [:error] [pid 20836:tid 20862] [client 94.138.202.200:54714] [client 94.138.202.200] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.138.202.200, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX1PkIACllgWRWVrYIQSGwAAAVU"]
[Sat Jan 31 08:40:51.852239 2026] [:error] [pid 39339:tid 39365] [client 36.129.24.60:45778] [client 36.129.24.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.129.24.60, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX1Pk8Wi-IjigR3oHY7A6gAAANg"]
[Sat Jan 31 08:41:07.609795 2026] [:error] [pid 39244:tid 39309] [client 188.34.181.211:54260] [client 188.34.181.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.34.181.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX1Po3o-KRTvg3jHEDwCEQAAAIA"]
[Sat Jan 31 08:45:24.307341 2026] [:error] [pid 39243:tid 39297] [client 91.217.249.196:27697] [client 91.217.249.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.217.249.196, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX1QpBBW1k4JK8a4v0Z5wAAAAE8"]
[Sat Jan 31 08:59:11.330787 2026] [autoindex:error] [pid 52520:tid 52531] [client 20.46.176.183:38307] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 31 08:59:21.021197 2026] [autoindex:error] [pid 52520:tid 52528] [client 20.46.176.183:38307] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 31 08:59:22.639521 2026] [autoindex:error] [pid 52520:tid 52539] [client 20.46.176.183:38307] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 31 08:59:22.761262 2026] [autoindex:error] [pid 52520:tid 52536] [client 20.46.176.183:38307] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Jan 31 08:59:23.599129 2026] [:error] [pid 52520:tid 52524] [client 20.46.176.183:38307] [client 20.46.176.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/"] [unique_id "aX1T62S_bInnwm0xKSrR_wAAAkI"]
[Sat Jan 31 08:59:24.057311 2026] [:error] [pid 39244:tid 39320] [client 20.46.176.183:44040] [client 20.46.176.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/"] [unique_id "aX1T7Ho-KRTvg3jHEDwHJAAAAIo"]
[Sat Jan 31 08:59:24.515881 2026] [:error] [pid 52451:tid 52459] [client 20.46.176.183:42088] [client 20.46.176.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/"] [unique_id "aX1T7HubVy7MGYWM2NZAIAAAAcU"]
[Sat Jan 31 08:59:24.971682 2026] [:error] [pid 52451:tid 52466] [client 20.46.176.183:49356] [client 20.46.176.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/"] [unique_id "aX1T7HubVy7MGYWM2NZAIgAAAcw"]
[Sat Jan 31 09:33:12.785751 2026] [:error] [pid 52415:tid 52418] [client 65.111.23.250:31375] [client 65.111.23.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.111.23.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX1b2J-DUxb_li2fU6JGYgAAAYE"], referer: https://expressinteriors.com/
[Sat Jan 31 09:33:15.335501 2026] [:error] [pid 39244:tid 39330] [client 65.111.23.250:58233] [client 65.111.23.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.111.23.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX1b23o-KRTvg3jHEDwRugAAAJQ"], referer: https://expressinteriors.com/wp-login.php?action=register
[Sat Jan 31 10:08:25.648261 2026] [:error] [pid 39243:tid 39290] [client 91.217.249.221:42217] [client 91.217.249.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.217.249.221, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX1kGRBW1k4JK8a4v0aVpAAAAEg"]
[Sat Jan 31 10:31:29.136399 2026] [:error] [pid 39244:tid 39331] [client 185.237.252.236:60706] [client 185.237.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.237.252.236, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX1pgXo-KRTvg3jHEDwmCAAAAJU"]
[Sat Jan 31 10:39:31.035847 2026] [:error] [pid 39242:tid 39275] [client 66.235.175.246:53834] [client 66.235.175.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.235.175.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX1rY9OgXnkKGGSSCIO7GQAAABU"]
[Sat Jan 31 11:29:57.966633 2026] [:error] [pid 52484:tid 52488] [client 91.217.249.188:24327] [client 91.217.249.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.217.249.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX13NUpwiaulxucQh7UdbgAAAgI"]
[Sat Jan 31 12:21:04.591482 2026] [:error] [pid 52520:tid 52522] [client 138.122.43.166:58198] [client 138.122.43.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.122.43.166, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX2DMGS_bInnwm0xKSos2gAAAkA"]
[Sat Jan 31 12:50:47.101459 2026] [:error] [pid 20836:tid 20842] [client 91.217.249.217:38555] [client 91.217.249.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.217.249.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX2KJ4ACllgWRWVrYIRSnAAAAUE"]
[Sat Jan 31 13:00:47.387596 2026] [:error] [pid 59581:tid 59599] [client 136.109.217.131:59748] [client 136.109.217.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.109.217.131, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX2Mf7pwqlqnnPNSmoGeYAAAA48"]
[Sat Jan 31 13:11:49.689587 2026] [:error] [pid 59582:tid 59623] [client 47.113.225.5:38480] [client 47.113.225.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.113.225.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX2PFY5dwpvvp1Lc6f0v7wAAA8w"]
[Sat Jan 31 13:12:09.425028 2026] [:error] [pid 59581:tid 59595] [client 163.223.13.96:42686] [client 163.223.13.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.223.13.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX2PKbpwqlqnnPNSmoGgSAAAA4s"]
[Sat Jan 31 13:12:15.750733 2026] [:error] [pid 59438:tid 59463] [client 59.110.143.128:55236] [client 59.110.143.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.110.143.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX2PL5bUN6UcGMChdB3iTAAAApc"]
[Sat Jan 31 13:19:45.454429 2026] [:error] [pid 52451:tid 52456] [client 43.165.70.220:46708] [client 43.165.70.220] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aX2Q8XubVy7MGYWM2NaDYgAAAcI"]
[Sat Jan 31 14:15:12.413666 2026] [:error] [pid 13863:tid 13891] [client 82.180.145.164:51724] [client 82.180.145.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.180.145.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX2d8ObxuFqFYLV42hTVzwAAARg"]
[Sat Jan 31 15:10:51.626806 2026] [:error] [pid 18773:tid 18784] [client 45.86.202.190:55409] [client 45.86.202.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX2q-9Hy21j24IPrB1W-BAAAAYk"]
[Sat Jan 31 16:39:32.769332 2026] [:error] [pid 31430:tid 31445] [client 51.38.135.40:42144] [client 51.38.135.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.38.135.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX2_xMcb14YPxXg_g5Ek9wAAAEs"]
[Sat Jan 31 18:41:50.417062 2026] [:error] [pid 31465:tid 31516] [client 45.86.202.190:54547] [client 45.86.202.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX3cbjkaGp475ez0mlzi0QAAAlY"]
[Sat Jan 31 18:51:41.494521 2026] [:error] [pid 44532:tid 44539] [client 103.39.132.40:58520] [client 103.39.132.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.39.132.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX3evcH-68uYbAtfrZ120QAAAUM"]
[Sat Jan 31 18:52:27.159812 2026] [:error] [pid 18803:tid 18807] [client 185.2.5.88:39214] [client 185.2.5.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.2.5.88, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX3e6y2kTcRk9EBIxOF2zwAAAgE"]
[Sat Jan 31 18:52:28.141882 2026] [:error] [pid 18803:tid 18814] [client 185.2.5.88:39214] [client 185.2.5.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.2.5.88, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX3e7C2kTcRk9EBIxOF20QAAAgg"], referer: https://expressinteriors.com/wp-login.php
[Sat Jan 31 19:21:43.282633 2026] [:error] [pid 44532:tid 44550] [client 43.138.68.113:59220] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aX3lx8H-68uYbAtfrZ17PgAAAU4"]
[Sat Jan 31 20:20:39.202151 2026] [:error] [pid 18803:tid 18826] [client 43.166.246.180:51684] [client 43.166.246.180] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aX3zly2kTcRk9EBIxOGJagAAAhQ"]
[Sat Jan 31 20:41:36.124383 2026] [:error] [pid 39242:tid 39275] [client 209.142.65.156:60304] [client 209.142.65.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.142.65.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX34gNOgXnkKGGSSCIM7vgAAABU"]
[Sat Jan 31 20:56:50.659602 2026] [:error] [pid 39339:tid 39361] [client 45.86.202.204:39185] [client 45.86.202.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.204, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX38EsWi-IjigR3oHY583wAAANQ"]
[Sat Jan 31 20:58:00.025106 2026] [:error] [pid 44533:tid 44564] [client 95.217.198.42:56390] [client 95.217.198.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.217.198.42, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX38WINjc98kHMNVmntHxgAAAcE"]
[Sat Jan 31 21:13:38.562409 2026] [:error] [pid 59523:tid 59547] [client 103.253.125.191:44244] [client 103.253.125.191] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.253.125.191, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX4AApEkxOIGmVhqUWKFXwAAAxQ"]
[Sat Jan 31 21:20:36.413336 2026] [:error] [pid 44533:tid 44571] [client 65.21.12.180:43384] [client 65.21.12.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.21.12.180, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX4BpINjc98kHMNVmntLYgAAAcg"]
[Sat Jan 31 21:20:37.686086 2026] [:error] [pid 44533:tid 44575] [client 65.21.12.180:43384] [client 65.21.12.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.21.12.180, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX4BpYNjc98kHMNVmntLYwAAAcw"], referer: https://expressinteriors.com/wp-login.php
[Sat Jan 31 21:27:42.593362 2026] [:error] [pid 44532:tid 44538] [client 52.178.68.120:59172] [client 52.178.68.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.178.68.120, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX4DTsH-68uYbAtfrZ2QAwAAAUI"]
[Sat Jan 31 21:46:11.524183 2026] [:error] [pid 59582:tid 59631] [client 148.251.116.77:48666] [client 148.251.116.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.116.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX4Ho45dwpvvp1Lc6f2BCQAAA9I"]
[Sat Jan 31 22:18:44.830193 2026] [:error] [pid 39339:tid 39364] [client 194.163.166.21:43850] [client 194.163.166.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.163.166.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX4PRMWi-IjigR3oHY6P9AAAANc"]
[Sat Jan 31 22:55:16.158864 2026] [:error] [pid 39242:tid 39273] [client 45.86.202.173:38623] [client 45.86.202.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.173, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX4X1NOgXnkKGGSSCINUSQAAABM"]
[Sat Jan 31 23:29:38.522925 2026] [:error] [pid 44533:tid 44575] [client 104.28.214.115:20870] [client 104.28.214.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aX4f4oNjc98kHMNVmnthUQAAAcw"]
[Sat Jan 31 23:29:45.980986 2026] [:error] [pid 59582:tid 59626] [client 104.28.214.115:53976] [client 104.28.214.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/style.php"] [unique_id "aX4f6Y5dwpvvp1Lc6f2PowAAA88"]
[Sat Jan 31 23:30:56.262290 2026] [:error] [pid 59523:tid 59550] [client 82.165.88.211:45748] [client 82.165.88.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.165.88.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX4gMJEkxOIGmVhqUWKZZAAAAxc"]
[Sat Jan 31 23:56:45.372310 2026] [:error] [pid 31430:tid 31439] [client 43.130.141.193:41626] [client 43.130.141.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aX4mPccb14YPxXg_g5FnMQAAAEU"]
[Sun Feb 01 00:05:35.232214 2026] [:error] [pid 31465:tid 31512] [client 87.106.28.217:33108] [client 87.106.28.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.106.28.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX4oTzkaGp475ez0mlxDCAAAAlI"]
[Sun Feb 01 00:16:03.888084 2026] [:error] [pid 18803:tid 18830] [client 209.50.227.124:49054] [client 209.50.227.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.50.227.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX4qwy2kTcRk9EBIxOG4AwAAAhg"]
[Sun Feb 01 00:22:41.802622 2026] [:error] [pid 31465:tid 31514] [client 154.205.9.196:60461] [client 154.205.9.196] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aX4sUTkaGp475ez0mlxIdgAAAlQ"]
[Sun Feb 01 00:42:22.775446 2026] [:error] [pid 31465:tid 31496] [client 87.106.28.217:50960] [client 87.106.28.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.106.28.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX4w7jkaGp475ez0mlxOhQAAAkI"]
[Sun Feb 01 00:43:55.800568 2026] [:error] [pid 39339:tid 39355] [client 45.86.202.179:23635] [client 45.86.202.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX4xS8Wi-IjigR3oHY6w6gAAAM4"]
[Sun Feb 01 00:45:28.836560 2026] [:error] [pid 59523:tid 59550] [client 47.82.118.63:57598] [client 47.82.118.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.82.118.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX4xqJEkxOIGmVhqUWKkagAAAxc"]
[Sun Feb 01 00:45:40.375441 2026] [:error] [pid 59582:tid 59627] [client 122.155.21.176:59468] [client 122.155.21.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.155.21.176, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX4xtI5dwpvvp1Lc6f2amgAAA9A"]
[Sun Feb 01 00:45:51.318986 2026] [:error] [pid 59523:tid 59532] [client 95.216.34.89:58536] [client 95.216.34.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.216.34.89, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX4xv5EkxOIGmVhqUWKkdAAAAwU"]
[Sun Feb 01 00:45:54.616885 2026] [:error] [pid 31465:tid 31496] [client 104.244.79.40:60624] [client 104.244.79.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.244.79.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX4xwjkaGp475ez0mlxPkQAAAkI"]
[Sun Feb 01 00:46:00.501467 2026] [:error] [pid 44532:tid 44541] [client 72.29.178.86:35550] [client 72.29.178.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.29.178.86, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX4xyMH-68uYbAtfrZ2vFgAAAUU"]
[Sun Feb 01 01:37:16.393731 2026] [:error] [pid 59523:tid 59541] [client 138.122.71.215:43092] [client 138.122.71.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.122.71.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX49zJEkxOIGmVhqUWKsCwAAAw4"]
[Sun Feb 01 02:21:33.681069 2026] [:error] [pid 59582:tid 59611] [client 45.86.202.166:64825] [client 45.86.202.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.166, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX5ILY5dwpvvp1Lc6f2oNgAAA8A"]
[Sun Feb 01 02:33:40.670720 2026] [:error] [pid 44533:tid 44578] [client 140.99.130.65:54956] [client 140.99.130.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 140.99.130.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX5LBINjc98kHMNVmnuCDQAAAc8"]
[Sun Feb 01 02:35:03.620322 2026] [:error] [pid 59582:tid 59620] [client 92.204.53.188:38062] [client 92.204.53.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.204.53.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX5LV45dwpvvp1Lc6f2qBQAAA8k"]
[Sun Feb 01 02:52:38.969244 2026] [:error] [pid 59582:tid 59625] [client 79.189.139.4:48442] [client 79.189.139.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.189.139.4, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX5Pdo5dwpvvp1Lc6f2tMAAAA84"]
[Sun Feb 01 03:10:08.981907 2026] [:error] [pid 59582:tid 59626] [client 138.122.71.215:38764] [client 138.122.71.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.122.71.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX5TkI5dwpvvp1Lc6f2wIAAAA88"]
[Sun Feb 01 03:10:10.670318 2026] [:error] [pid 59582:tid 59629] [client 138.122.71.215:38764] [client 138.122.71.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.122.71.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX5Tko5dwpvvp1Lc6f2wJAAAA9E"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 01 04:00:15.443654 2026] [:error] [pid 44244:tid 44302] [client 45.86.202.174:32567] [client 45.86.202.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.174, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX5fT4PSq3nq-MvU696CMAAAAAg"]
[Sun Feb 01 04:09:38.771473 2026] [:error] [pid 44633:tid 44679] [client 88.134.110.36:60601] [client 88.134.110.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/pgzeed%20gold.aspx"] [unique_id "aX5hgnuTUPGZZ-3IcUgsbAAAAEk"]
[Sun Feb 01 04:09:40.793717 2026] [:error] [pid 44634:tid 44702] [client 88.134.110.36:46447] [client 88.134.110.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/riches777%20pg.aspx"] [unique_id "aX5hhF_6Vo-O9L12m3BcPwAAAIU"]
[Sun Feb 01 04:09:42.859606 2026] [:error] [pid 44728:tid 44751] [client 88.134.110.36:4419] [client 88.134.110.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/royal%20slot.aspx"] [unique_id "aX5hhk5Fiuef9BcjMql8bAAAANU"]
[Sun Feb 01 04:09:44.868058 2026] [:error] [pid 44633:tid 44671] [client 88.134.110.36:16569] [client 88.134.110.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/sa%20casino.aspx"] [unique_id "aX5hiHuTUPGZZ-3IcUgsdgAAAEE"]
[Sun Feb 01 04:09:46.921267 2026] [:error] [pid 44728:tid 44754] [client 88.134.110.36:4754] [client 88.134.110.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot%20777.aspx"] [unique_id "aX5hik5Fiuef9BcjMql8dgAAANg"]
[Sun Feb 01 04:09:48.977756 2026] [:error] [pid 44633:tid 44684] [client 88.134.110.36:10305] [client 88.134.110.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot%20888.aspx"] [unique_id "aX5hjHuTUPGZZ-3IcUgsegAAAE4"]
[Sun Feb 01 04:09:50.959512 2026] [:error] [pid 44632:tid 44667] [client 88.134.110.36:2781] [client 88.134.110.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot%2099.aspx"] [unique_id "aX5hjmNFkMAIyXS-zpPoSwAAABg"]
[Sun Feb 01 04:09:53.045435 2026] [:error] [pid 44632:tid 44649] [client 88.134.110.36:57072] [client 88.134.110.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot%20auto.aspx"] [unique_id "aX5hkWNFkMAIyXS-zpPoTwAAAAY"]
[Sun Feb 01 04:09:55.179472 2026] [:error] [pid 44632:tid 44656] [client 88.134.110.36:52318] [client 88.134.110.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot%20game%20666.aspx"] [unique_id "aX5hk2NFkMAIyXS-zpPoVgAAAA0"]
[Sun Feb 01 04:09:57.127733 2026] [:error] [pid 44632:tid 44647] [client 88.134.110.36:51087] [client 88.134.110.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/slot%20online.aspx"] [unique_id "aX5hlWNFkMAIyXS-zpPoWQAAAAQ"]
[Sun Feb 01 04:09:59.437871 2026] [:error] [pid 44728:tid 44744] [client 88.134.110.36:43762] [client 88.134.110.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/super%20slot.aspx"] [unique_id "aX5hl05Fiuef9BcjMql8jwAAAM4"]
[Sun Feb 01 04:10:01.519832 2026] [:error] [pid 44634:tid 44699] [client 88.134.110.36:53281] [client 88.134.110.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufa%20slot.aspx"] [unique_id "aX5hmV_6Vo-O9L12m3BcZAAAAII"]
[Sun Feb 01 04:10:03.482426 2026] [:error] [pid 44728:tid 44742] [client 88.134.110.36:37298] [client 88.134.110.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufabet%20auto.aspx"] [unique_id "aX5hm05Fiuef9BcjMql8mwAAAMw"]
[Sun Feb 01 04:10:05.553667 2026] [:error] [pid 44633:tid 44684] [client 88.134.110.36:59094] [client 88.134.110.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/we88%20slot.aspx"] [unique_id "aX5hnXuTUPGZZ-3IcUgsjQAAAE4"]
[Sun Feb 01 04:10:07.790324 2026] [:error] [pid 44633:tid 44685] [client 88.134.110.36:50052] [client 88.134.110.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aX5hn3uTUPGZZ-3IcUgskQAAAE8"]
[Sun Feb 01 04:21:16.532655 2026] [:error] [pid 10509:tid 10573] [client 92.205.213.177:42574] [client 92.205.213.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.213.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX5kPFMNpJBihOJgwVu7mwAAAII"]
[Sun Feb 01 04:21:32.932568 2026] [:error] [pid 10509:tid 10590] [client 92.205.213.177:38554] [client 92.205.213.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.213.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX5kTFMNpJBihOJgwVu7vAAAAJM"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 01 05:01:24.103624 2026] [:error] [pid 10509:tid 10585] [client 135.125.181.4:36838] [client 135.125.181.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 135.125.181.4, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX5tpFMNpJBihOJgwVvMTQAAAI4"]
[Sun Feb 01 05:01:26.622640 2026] [:error] [pid 10506:tid 10518] [client 135.125.181.4:36852] [client 135.125.181.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 135.125.181.4, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX5tpq32IC2Db4uwFyOKSgAAAAI"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 01 05:13:25.001340 2026] [:error] [pid 10508:tid 10566] [client 128.140.71.121:55996] [client 128.140.71.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.140.71.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX5wdQFwdoMQv5EWp9tURgAAAFY"]
[Sun Feb 01 05:13:26.991425 2026] [:error] [pid 10616:tid 10637] [client 185.187.50.43:47238] [client 185.187.50.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.187.50.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX5wdmd8pZdmVx6pUp7DhgAAANE"]
[Sun Feb 01 05:14:22.849447 2026] [:error] [pid 10506:tid 10524] [client 103.69.96.39:50514] [client 103.69.96.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.69.96.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX5wrq32IC2Db4uwFyOOcwAAAAg"]
[Sun Feb 01 05:14:24.237493 2026] [:error] [pid 10506:tid 10525] [client 103.87.69.8:57348] [client 103.87.69.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.87.69.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX5wsK32IC2Db4uwFyOOdgAAAAk"]
[Sun Feb 01 05:14:31.584827 2026] [:error] [pid 10509:tid 10574] [client 34.89.56.14:50720] [client 34.89.56.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.89.56.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX5wt1MNpJBihOJgwVvRzgAAAIM"]
[Sun Feb 01 05:14:34.731958 2026] [:error] [pid 10616:tid 10644] [client 185.125.27.114:37720] [client 185.125.27.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.125.27.114, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX5wumd8pZdmVx6pUp7D7wAAANg"]
[Sun Feb 01 05:24:12.487094 2026] [:error] [pid 10506:tid 10540] [client 103.75.184.15:51336] [client 103.75.184.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.75.184.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX5y_K32IC2Db4uwFyORxAAAABg"]
[Sun Feb 01 05:28:30.272414 2026] [:error] [pid 10509:tid 10580] [client 217.154.24.77:55840] [client 217.154.24.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.154.24.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX5z_lMNpJBihOJgwVvXWAAAAIk"]
[Sun Feb 01 05:28:42.832783 2026] [:error] [pid 10616:tid 10623] [client 217.154.24.77:52966] [client 217.154.24.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.154.24.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX50Cmd8pZdmVx6pUp7LnQAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 01 05:39:44.531640 2026] [:error] [pid 10506:tid 10527] [client 45.86.202.199:28201] [client 45.86.202.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.199, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX52oK32IC2Db4uwFyOWxwAAAAs"]
[Sun Feb 01 05:42:49.691033 2026] [:error] [pid 10509:tid 10574] [client 217.154.24.77:38446] [client 217.154.24.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.154.24.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX53WVMNpJBihOJgwVvcmgAAAIM"]
[Sun Feb 01 05:42:51.343621 2026] [:error] [pid 10509:tid 10588] [client 217.154.24.77:38446] [client 217.154.24.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.154.24.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX53W1MNpJBihOJgwVvcnAAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 01 05:43:20.112966 2026] [:error] [pid 10509:tid 10590] [client 212.227.234.170:35772] [client 212.227.234.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.227.234.170, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX53eFMNpJBihOJgwVvcwgAAAJM"]
[Sun Feb 01 05:50:02.850402 2026] [:error] [pid 10508:tid 10557] [client 160.250.76.27:60518] [client 160.250.76.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.76.27, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX55CgFwdoMQv5EWp9tgnQAAAE0"]
[Sun Feb 01 06:01:52.187658 2026] [:error] [pid 10509:tid 10579] [client 67.222.26.187:58886] [client 67.222.26.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.222.26.187, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX570FMNpJBihOJgwVvkHwAAAIg"]
[Sun Feb 01 06:35:48.369869 2026] [:error] [pid 10616:tid 10620] [client 5.161.99.57:55066] [client 5.161.99.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.161.99.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX6DxGd8pZdmVx6pUp7rxwAAAMA"]
[Sun Feb 01 06:42:09.382048 2026] [:error] [pid 2033:tid 2037] [client 15.235.218.86:42070] [client 15.235.218.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.235.218.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX6FQfF7B4oR5nK3T_MLdgAAAQI"]
[Sun Feb 01 06:42:11.368828 2026] [:error] [pid 2033:tid 2035] [client 15.235.218.86:42070] [client 15.235.218.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.235.218.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX6FQ_F7B4oR5nK3T_MLeQAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 01 07:21:22.067923 2026] [:error] [pid 2033:tid 2045] [client 45.86.202.194:31779] [client 45.86.202.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX6OcvF7B4oR5nK3T_MeWQAAAQo"]
[Sun Feb 01 07:49:47.770431 2026] [:error] [pid 10508:tid 10548] [client 217.11.48.239:57798] [client 217.11.48.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.11.48.239, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX6VGwFwdoMQv5EWp9uFZAAAAEQ"]
[Sun Feb 01 08:46:24.883780 2026] [:error] [pid 10508:tid 10547] [client 217.154.24.77:34398] [client 217.154.24.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.24.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX6iYAFwdoMQv5EWp9uXugAAAEM"]
[Sun Feb 01 08:58:32.206812 2026] [:error] [pid 10508:tid 10552] [client 45.86.202.195:42127] [client 45.86.202.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX6lOAFwdoMQv5EWp9ubbAAAAEg"]
[Sun Feb 01 09:05:55.538944 2026] [:error] [pid 2033:tid 2060] [client 216.251.35.203:35928] [client 216.251.35.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.251.35.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX6m8_F7B4oR5nK3T_NQIQAAARU"]
[Sun Feb 01 09:10:25.269919 2026] [:error] [pid 2033:tid 2044] [client 192.64.112.17:40030] [client 192.64.112.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.64.112.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX6oAfF7B4oR5nK3T_NSJQAAAQk"]
[Sun Feb 01 09:10:32.604125 2026] [:error] [pid 10616:tid 10638] [client 103.28.36.205:60112] [client 103.28.36.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.28.36.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX6oCGd8pZdmVx6pUp4qCQAAANI"]
[Sun Feb 01 09:10:35.127671 2026] [:error] [pid 10506:tid 10518] [client 31.186.11.162:62251] [client 31.186.11.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.186.11.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX6oC632IC2Db4uwFyPTYQAAAAI"]
[Sun Feb 01 09:10:45.225693 2026] [:error] [pid 2033:tid 2063] [client 172.211.184.239:2434] [client 172.211.184.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.211.184.239, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX6oFfF7B4oR5nK3T_NSQgAAARY"]
[Sun Feb 01 09:10:51.678634 2026] [:error] [pid 10616:tid 10620] [client 118.27.125.50:41916] [client 118.27.125.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.27.125.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX6oG2d8pZdmVx6pUp4qIwAAAMA"]
[Sun Feb 01 09:11:22.275170 2026] [:error] [pid 10509:tid 10585] [client 118.27.100.24:41788] [client 118.27.100.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.27.100.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX6oOlMNpJBihOJgwVshxwAAAI4"]
[Sun Feb 01 09:50:42.640766 2026] [:error] [pid 51610:tid 51638] [client 212.7.160.138:60676] [client 212.7.160.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.7.160.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX6xct7GFdNFAqImMQBpJwAAAVg"]
[Sun Feb 01 10:31:02.554910 2026] [:error] [pid 10616:tid 10639] [client 62.60.211.239:60890] [client 62.60.211.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.211.239, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX665md8pZdmVx6pUp5GTwAAANM"]
[Sun Feb 01 10:44:18.035030 2026] [:error] [pid 10506:tid 10523] [client 45.86.202.194:49245] [client 45.86.202.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.202.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX6-Aq32IC2Db4uwFyPtIgAAAAc"]
[Sun Feb 01 11:30:51.634323 2026] [:error] [pid 51610:tid 51633] [client 43.130.150.80:36702] [client 43.130.150.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aX7I697GFdNFAqImMQCMqAAAAVM"]
[Sun Feb 01 11:57:58.432068 2026] [:error] [pid 10508:tid 10547] [client 62.146.235.89:37026] [client 62.146.235.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.146.235.89, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX7PRgFwdoMQv5EWp9vINwAAAEM"]
[Sun Feb 01 12:18:50.191953 2026] [:error] [pid 10506:tid 10535] [client 45.155.68.139:50674] [client 45.155.68.139] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aX7UKq32IC2Db4uwFyMIjgAAABM"]
[Sun Feb 01 13:14:11.579488 2026] [:error] [pid 10509:tid 10591] [client 154.219.104.78:53974] [client 154.219.104.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.219.104.78, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX7hI1MNpJBihOJgwVtnoQAAAJQ"]
[Sun Feb 01 13:14:20.028471 2026] [:error] [pid 10506:tid 10516] [client 220.158.233.50:24260] [client 220.158.233.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.158.233.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX7hLK32IC2Db4uwFyMZhwAAAAA"]
[Sun Feb 01 13:14:25.805880 2026] [:error] [pid 10508:tid 10559] [client 120.55.126.102:47058] [client 120.55.126.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.55.126.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX7hMQFwdoMQv5EWp9veDwAAAE8"]
[Sun Feb 01 13:14:36.760486 2026] [:error] [pid 10616:tid 10624] [client 217.154.179.111:34034] [client 217.154.179.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.179.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX7hPGd8pZdmVx6pUp6L-AAAAMQ"]
[Sun Feb 01 13:14:51.668236 2026] [:error] [pid 10616:tid 10643] [client 47.88.48.42:45726] [client 47.88.48.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.88.48.42, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX7hS2d8pZdmVx6pUp6MCwAAANc"]
[Sun Feb 01 14:13:48.869371 2026] [:error] [pid 10509:tid 10594] [client 59.125.102.226:51524] [client 59.125.102.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX7vHFMNpJBihOJgwVuBvwAAAJc"]
[Sun Feb 01 14:43:57.399933 2026] [:error] [pid 10509:tid 10589] [client 104.28.152.248:65464] [client 104.28.152.248] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aX72LVMNpJBihOJgwVuN4wAAAJI"]
[Sun Feb 01 15:30:57.440662 2026] [:error] [pid 10508:tid 10565] [client 43.133.14.237:40788] [client 43.133.14.237] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aX8BMQFwdoMQv5EWp9sIHgAAAFU"]
[Sun Feb 01 16:55:51.124442 2026] [:error] [pid 29578:tid 29589] [client 185.88.197.19:61183] [client 185.88.197.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.88.197.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX8VF0wa4IUBrS8Q04FhcQAAAYc"]
[Sun Feb 01 17:15:24.944150 2026] [:error] [pid 10508:tid 10565] [client 99.198.97.74:54334] [client 99.198.97.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 99.198.97.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX8ZrAFwdoMQv5EWp9spWAAAAFU"]
[Sun Feb 01 17:15:26.981889 2026] [:error] [pid 29578:tid 29592] [client 47.161.210.72:33456] [client 47.161.210.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.161.210.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX8Zrkwa4IUBrS8Q04FqZAAAAYo"]
[Sun Feb 01 17:15:36.958434 2026] [:error] [pid 2033:tid 2057] [client 34.135.221.121:49550] [client 34.135.221.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.135.221.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX8ZuPF7B4oR5nK3T_PjBQAAARQ"]
[Sun Feb 01 17:16:02.800243 2026] [:error] [pid 10508:tid 10558] [client 46.242.243.207:62301] [client 46.242.243.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.242.243.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX8Z0gFwdoMQv5EWp9spkwAAAE4"]
[Sun Feb 01 17:38:25.620812 2026] [:error] [pid 10508:tid 10548] [client 202.184.74.88:65044] [client 202.184.74.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.184.74.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX8fEQFwdoMQv5EWp9swxQAAAEQ"]
[Sun Feb 01 18:09:09.960637 2026] [:error] [pid 10508:tid 10562] [client 43.159.141.150:48622] [client 43.159.141.150] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aX8mRQFwdoMQv5EWp9s5QAAAAFI"]
[Sun Feb 01 18:50:16.416804 2026] [:error] [pid 10506:tid 10518] [client 165.22.224.174:50193] [client 165.22.224.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.224.174, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX8v6K32IC2Db4uwFyOBOwAAAAI"]
[Sun Feb 01 18:50:18.084188 2026] [:error] [pid 10509:tid 10571] [client 165.22.224.174:50259] [client 165.22.224.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.224.174, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX8v6lMNpJBihOJgwVvdawAAAIA"]
[Sun Feb 01 18:55:17.284608 2026] [:error] [pid 10509:tid 10575] [client 165.22.224.174:59182] [client 165.22.224.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.224.174, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX8xFVMNpJBihOJgwVvfCwAAAIQ"]
[Sun Feb 01 18:56:03.177947 2026] [:error] [pid 29578:tid 29601] [client 165.22.224.174:63119] [client 165.22.224.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.224.174, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX8xQ0wa4IUBrS8Q04GQlAAAAZM"]
[Sun Feb 01 18:56:49.596654 2026] [:error] [pid 51610:tid 51636] [client 165.22.224.174:50388] [client 165.22.224.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.224.174, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aX8xcd7GFdNFAqImMQAHPAAAAVY"]
[Sun Feb 01 20:02:16.713334 2026] [:error] [pid 2033:tid 2038] [client 45.77.168.83:53556] [client 45.77.168.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.77.168.83, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX9AyPF7B4oR5nK3T_MJowAAAQM"]
[Sun Feb 01 21:15:50.338417 2026] [:error] [pid 10616:tid 10636] [client 185.125.27.183:43774] [client 185.125.27.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.125.27.183, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX9SBmd8pZdmVx6pUp77ZQAAANA"]
[Sun Feb 01 21:16:05.481832 2026] [:error] [pid 10506:tid 10517] [client 198.54.120.17:33816] [client 198.54.120.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.120.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX9SFa32IC2Db4uwFyO1jgAAAAE"]
[Sun Feb 01 21:16:13.694816 2026] [:error] [pid 10509:tid 10571] [client 47.98.99.190:53123] [client 47.98.99.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.98.99.190, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX9SHVMNpJBihOJgwVsAPwAAAIA"]
[Sun Feb 01 21:16:23.712972 2026] [:error] [pid 10506:tid 10540] [client 35.192.100.98:48664] [client 35.192.100.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.192.100.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX9SJ632IC2Db4uwFyO1qQAAABg"]
[Sun Feb 01 21:33:22.598266 2026] [:error] [pid 51610:tid 51617] [client 147.135.213.38:46952] [client 147.135.213.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/ufabet%20auto.aspx"] [unique_id "aX9WIt7GFdNFAqImMQAp9gAAAUM"]
[Sun Feb 01 21:33:25.361208 2026] [:error] [pid 10616:tid 10625] [client 147.135.213.38:46960] [client 147.135.213.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/we88%20slot.aspx"] [unique_id "aX9WJWd8pZdmVx6pUp7-7gAAAMU"]
[Sun Feb 01 21:33:29.970798 2026] [:error] [pid 10616:tid 10643] [client 147.135.213.38:54568] [client 147.135.213.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/www%20ufabet%20com.aspx"] [unique_id "aX9WKWd8pZdmVx6pUp7-8AAAANc"]
[Sun Feb 01 23:15:31.580470 2026] [:error] [pid 10506:tid 10535] [client 94.136.187.150:40076] [client 94.136.187.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.136.187.150, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX9uE632IC2Db4uwFyPO1AAAABM"]
[Sun Feb 01 23:57:33.267060 2026] [:error] [pid 10509:tid 10573] [client 187.37.10.106:38067] [client 187.37.10.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.37.10.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX937VMNpJBihOJgwVswRgAAAII"]
[Mon Feb 02 00:07:18.137005 2026] [:error] [pid 8877:tid 8895] [client 43.153.35.128:41348] [client 43.153.35.128] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aX96NljWRgIEkmjg6oubDQAAAs4"]
[Mon Feb 02 01:20:38.754773 2026] [:error] [pid 10509:tid 10573] [client 111.230.47.77:54238] [client 111.230.47.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 111.230.47.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX-LZlMNpJBihOJgwVs_PwAAAII"]
[Mon Feb 02 02:23:39.678301 2026] [:error] [pid 51610:tid 51633] [client 165.22.11.210:35182] [client 165.22.11.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.11.210, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX-aK97GFdNFAqImMQBcGAAAAVM"]
[Mon Feb 02 03:46:47.445247 2026] [:error] [pid 32377:tid 32401] [client 182.44.8.254:54162] [client 182.44.8.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aX-tp9SQdUKshKTcmyQ1VAAAANQ"]
[Mon Feb 02 03:51:44.901621 2026] [:error] [pid 63153:tid 63174] [client 20.53.251.127:10478] [client 20.53.251.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aX-u0HC9GXHnmLkdgdmJjgAAAM0"]
[Mon Feb 02 03:51:46.268519 2026] [:error] [pid 63153:tid 63168] [client 20.53.251.127:21938] [client 20.53.251.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aX-u0nC9GXHnmLkdgdmJlAAAAMc"]
[Mon Feb 02 03:51:47.033732 2026] [:error] [pid 63153:tid 63177] [client 20.53.251.127:18552] [client 20.53.251.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aX-u03C9GXHnmLkdgdmJmAAAANA"]
[Mon Feb 02 03:51:49.429440 2026] [:error] [pid 63033:tid 63097] [client 20.53.251.127:7054] [client 20.53.251.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aX-u1feMX2QyIh3K16oBvgAAAEY"]
[Mon Feb 02 03:51:49.944484 2026] [:error] [pid 63153:tid 63184] [client 20.53.251.127:18508] [client 20.53.251.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit-tags.php"] [unique_id "aX-u1XC9GXHnmLkdgdmJoQAAANc"]
[Mon Feb 02 03:51:54.360692 2026] [:error] [pid 63033:tid 63115] [client 20.53.251.127:18529] [client 20.53.251.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit-tags.php"] [unique_id "aX-u2veMX2QyIh3K16oBzgAAAFg"]
[Mon Feb 02 03:51:55.962934 2026] [:error] [pid 63032:tid 63081] [client 20.53.251.127:18504] [client 20.53.251.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit-tags.php"] [unique_id "aX-u23yEQ1PkpebvdRj6mAAAABI"]
[Mon Feb 02 03:51:56.726091 2026] [:error] [pid 63033:tid 63102] [client 20.53.251.127:21912] [client 20.53.251.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit-tags.php"] [unique_id "aX-u3PeMX2QyIh3K16oB0wAAAEs"]
[Mon Feb 02 03:51:57.773812 2026] [:error] [pid 63032:tid 63077] [client 20.53.251.127:10253] [client 20.53.251.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bk.php"] [unique_id "aX-u3XyEQ1PkpebvdRj6mwAAAA4"]
[Mon Feb 02 03:51:59.249404 2026] [:error] [pid 63034:tid 63129] [client 20.53.251.127:21934] [client 20.53.251.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bk.php"] [unique_id "aX-u3-KXlgw75_wfbHr5xQAAAIs"]
[Mon Feb 02 03:52:00.977242 2026] [:error] [pid 63153:tid 63181] [client 20.53.251.127:22965] [client 20.53.251.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bk.php"] [unique_id "aX-u4HC9GXHnmLkdgdmJtQAAANQ"]
[Mon Feb 02 03:52:01.787922 2026] [:error] [pid 63032:tid 63087] [client 20.53.251.127:9522] [client 20.53.251.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bk.php"] [unique_id "aX-u4XyEQ1PkpebvdRj6nQAAABg"]
[Mon Feb 02 03:52:02.990702 2026] [:error] [pid 63033:tid 63093] [client 20.53.251.127:7064] [client 20.53.251.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "aX-u4veMX2QyIh3K16oB3AAAAEI"]
[Mon Feb 02 03:52:12.273318 2026] [:error] [pid 63153:tid 63168] [client 20.53.251.127:18828] [client 20.53.251.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "aX-u7HC9GXHnmLkdgdmJ0QAAAMc"]
[Mon Feb 02 03:52:23.933639 2026] [:error] [pid 63034:tid 63139] [client 20.53.251.127:10301] [client 20.53.251.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws53.php"] [unique_id "aX-u9-KXlgw75_wfbHr59AAAAJU"]
[Mon Feb 02 03:52:25.319700 2026] [:error] [pid 63153:tid 63165] [client 20.53.251.127:10461] [client 20.53.251.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws53.php"] [unique_id "aX-u-XC9GXHnmLkdgdmJ4QAAAMQ"]
[Mon Feb 02 03:52:31.955276 2026] [:error] [pid 63032:tid 63070] [client 20.53.251.127:22925] [client 20.53.251.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws53.php"] [unique_id "aX-u_3yEQ1PkpebvdRj6uAAAAAc"]
[Mon Feb 02 03:52:43.401695 2026] [:error] [pid 63034:tid 63130] [client 20.53.251.127:10491] [client 20.53.251.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/revealability.php"] [unique_id "aX-vC-KXlgw75_wfbHr6CAAAAIw"]
[Mon Feb 02 04:46:29.738776 2026] [:error] [pid 63032:tid 63067] [client 99.198.97.74:58947] [client 99.198.97.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 99.198.97.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX-7pXyEQ1PkpebvdRgNkgAAAAQ"]
[Mon Feb 02 04:46:33.951566 2026] [:error] [pid 63032:tid 63078] [client 31.177.95.217:37734] [client 31.177.95.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.177.95.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX-7qXyEQ1PkpebvdRgNmAAAAA8"]
[Mon Feb 02 04:46:41.297031 2026] [:error] [pid 63153:tid 63180] [client 42.112.21.205:60218] [client 42.112.21.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 42.112.21.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX-7sXC9GXHnmLkdgdmiWAAAANM"]
[Mon Feb 02 04:46:45.186858 2026] [:error] [pid 63032:tid 63072] [client 47.161.210.72:40724] [client 47.161.210.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.161.210.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX-7tXyEQ1PkpebvdRgNpQAAAAk"]
[Mon Feb 02 04:47:08.080746 2026] [:error] [pid 63032:tid 63077] [client 203.162.234.20:47210] [client 203.162.234.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.162.234.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX-7zHyEQ1PkpebvdRgNvgAAAA4"]
[Mon Feb 02 04:47:10.419325 2026] [:error] [pid 33612:tid 33615] [client 191.6.210.119:57816] [client 191.6.210.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.6.210.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX-7zstFn80qQEmo5QonIwAAAQE"]
[Mon Feb 02 04:47:29.514527 2026] [:error] [pid 63033:tid 63104] [client 45.130.83.165:53897] [client 45.130.83.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.83.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX-74feMX2QyIh3K16oVaQAAAE0"]
[Mon Feb 02 04:47:34.792676 2026] [:error] [pid 63033:tid 63100] [client 45.130.83.162:26625] [client 45.130.83.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aX-75veMX2QyIh3K16oVrwAAAEk"]
[Mon Feb 02 04:47:35.025303 2026] [:error] [pid 63033:tid 63103] [client 45.130.83.165:53897] [client 45.130.83.165] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aX-75_eMX2QyIh3K16oVtgAAAEw"]
[Mon Feb 02 04:47:35.322571 2026] [:error] [pid 63033:tid 63108] [client 45.130.83.165:53897] [client 45.130.83.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.83.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX-75_eMX2QyIh3K16oVugAAAFE"]
[Mon Feb 02 04:47:35.324273 2026] [:error] [pid 63033:tid 63108] [client 45.130.83.165:53897] [client 45.130.83.165] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX-75_eMX2QyIh3K16oVugAAAFE"]
[Mon Feb 02 04:47:35.325423 2026] [:error] [pid 63033:tid 63108] [client 45.130.83.165:53897] [client 45.130.83.165] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX-75_eMX2QyIh3K16oVugAAAFE"]
[Mon Feb 02 04:47:36.015588 2026] [:error] [pid 33612:tid 33629] [client 45.130.83.167:20635] [client 45.130.83.167] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aX-76MtFn80qQEmo5QonzQAAAQ8"]
[Mon Feb 02 04:47:38.252165 2026] [:error] [pid 63032:tid 63082] [client 45.130.83.161:42699] [client 45.130.83.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.83.161, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX-76nyEQ1PkpebvdRgOigAAABM"]
[Mon Feb 02 04:47:38.260204 2026] [:error] [pid 63032:tid 63082] [client 45.130.83.161:42699] [client 45.130.83.161] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX-76nyEQ1PkpebvdRgOigAAABM"]
[Mon Feb 02 04:47:38.261862 2026] [:error] [pid 63032:tid 63082] [client 45.130.83.161:42699] [client 45.130.83.161] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX-76nyEQ1PkpebvdRgOigAAABM"]
[Mon Feb 02 04:47:41.250727 2026] [:error] [pid 63034:tid 63121] [client 45.130.83.157:21309] [client 45.130.83.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.83.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX-77eKXlgw75_wfbHoRTgAAAIM"]
[Mon Feb 02 08:00:36.901708 2026] [:error] [pid 63033:tid 63095] [client 104.247.160.227:52387] [client 104.247.160.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.247.160.227, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX_pJPeMX2QyIh3K16pIvAAAAEQ"]
[Mon Feb 02 08:16:43.723772 2026] [:error] [pid 63033:tid 63107] [client 138.91.34.29:62099] [client 138.91.34.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bk.php"] [unique_id "aX_s6_eMX2QyIh3K16pPXgAAAFA"]
[Mon Feb 02 08:16:45.158272 2026] [:error] [pid 62826:tid 62841] [client 138.91.34.29:57382] [client 138.91.34.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bk.php"] [unique_id "aX_s7YF6vPvg_C5dUL-1CwAAAY0"]
[Mon Feb 02 08:16:46.834725 2026] [:error] [pid 63153:tid 63161] [client 138.91.34.29:47884] [client 138.91.34.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bk.php"] [unique_id "aX_s7nC9GXHnmLkdgdnq7QAAAMA"]
[Mon Feb 02 08:16:47.862435 2026] [:error] [pid 8507:tid 8526] [client 138.91.34.29:54034] [client 138.91.34.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bk.php"] [unique_id "aX_s79k9kluqaCHoCymV1gAAAdE"]
[Mon Feb 02 08:16:50.524630 2026] [:error] [pid 63032:tid 63066] [client 138.91.34.29:42455] [client 138.91.34.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "aX_s8nyEQ1PkpebvdRg9VQAAAAM"]
[Mon Feb 02 08:17:02.565431 2026] [:error] [pid 63034:tid 63127] [client 138.91.34.29:57361] [client 138.91.34.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "aX_s_uKXlgw75_wfbHpCxwAAAIk"]
[Mon Feb 02 08:17:13.587708 2026] [:error] [pid 63034:tid 63130] [client 138.91.34.29:41796] [client 138.91.34.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws53.php"] [unique_id "aX_tCeKXlgw75_wfbHpC1QAAAIw"]
[Mon Feb 02 08:17:17.269012 2026] [:error] [pid 62826:tid 62837] [client 138.91.34.29:41823] [client 138.91.34.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws53.php"] [unique_id "aX_tDYF6vPvg_C5dUL-1IgAAAYk"]
[Mon Feb 02 08:17:19.952337 2026] [:error] [pid 33612:tid 33628] [client 138.91.34.29:17889] [client 138.91.34.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws53.php"] [unique_id "aX_tD8tFn80qQEmo5QptfgAAAQ4"]
[Mon Feb 02 08:17:24.249330 2026] [:error] [pid 63033:tid 63112] [client 138.91.34.29:41825] [client 138.91.34.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/revealability.php"] [unique_id "aX_tFPeMX2QyIh3K16pPfQAAAFU"]
[Mon Feb 02 08:17:28.148357 2026] [:error] [pid 63033:tid 63093] [client 138.91.34.29:57429] [client 138.91.34.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/revealability.php"] [unique_id "aX_tGPeMX2QyIh3K16pPgwAAAEI"]
[Mon Feb 02 08:17:35.475798 2026] [:error] [pid 46008:tid 46031] [client 138.91.34.29:13747] [client 138.91.34.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/revealability.php"] [unique_id "aX_tHyRa52iYn7SlSMkD4gAAAVQ"]
[Mon Feb 02 09:10:02.629321 2026] [:error] [pid 63153:tid 63181] [client 187.45.193.215:33850] [client 187.45.193.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.45.193.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX_5anC9GXHnmLkdgdn69QAAANQ"]
[Mon Feb 02 09:10:07.158872 2026] [:error] [pid 33612:tid 33637] [client 103.172.239.79:54838] [client 103.172.239.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.172.239.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX_5b8tFn80qQEmo5Qp-oQAAARc"]
[Mon Feb 02 09:10:12.080427 2026] [:error] [pid 63153:tid 63184] [client 47.242.170.212:43576] [client 47.242.170.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.242.170.212, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aX_5dHC9GXHnmLkdgdn6_gAAANc"]
[Mon Feb 02 09:55:10.415103 2026] [:error] [pid 57021:tid 57042] [client 23.251.49.194:32913] [client 23.251.49.194] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=image/jpeg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYAD_v7AEpx7VcmYK3GVigAAAlE"]
[Mon Feb 02 09:55:13.172040 2026] [:error] [pid 57021:tid 57046] [client 23.251.49.194:32913] [client 23.251.49.194] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=image/jpeg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYAEAf7AEpx7VcmYK3GViwAAAlU"]
[Mon Feb 02 10:17:06.195110 2026] [:error] [pid 57080:tid 57101] [client 45.88.106.230:35274] [client 45.88.106.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.88.106.230, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYAJIo9Utn0ZlfnF10PU-AAAAs4"]
[Mon Feb 02 11:28:12.442128 2026] [:error] [pid 56989:tid 57005] [client 103.74.116.239:40580] [client 103.74.116.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.74.116.239, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYAZzEp44HnChN-GZlhlzQAAAg4"]
[Mon Feb 02 11:28:13.594517 2026] [:error] [pid 56989:tid 57002] [client 103.74.116.239:40580] [client 103.74.116.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.74.116.239, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYAZzUp44HnChN-GZlhl0QAAAgs"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 02 11:48:57.595660 2026] [:error] [pid 57081:tid 57117] [client 89.43.17.214:55146] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYAeqWvouJ2Jkm6HfBjX_QAAAwI"]
[Mon Feb 02 11:48:57.901831 2026] [:error] [pid 57080:tid 57106] [client 38.58.224.32:1710] [client 38.58.224.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.58.224.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYAeqY9Utn0ZlfnF10PviwAAAtM"]
[Mon Feb 02 11:49:01.401229 2026] [:error] [pid 46008:tid 46013] [client 116.103.108.158:39144] [client 116.103.108.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.103.108.158, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYAerSRa52iYn7SlSMk39AAAAUM"]
[Mon Feb 02 11:49:13.721871 2026] [:error] [pid 57022:tid 57071] [client 185.241.211.8:64361] [client 185.241.211.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYAeuRnEgLMzfcurxfn0NAAAApM"]
[Mon Feb 02 11:49:14.167322 2026] [:error] [pid 57081:tid 57136] [client 185.241.211.8:64532] [client 185.241.211.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYAeumvouJ2Jkm6HfBjYDwAAAxU"]
[Mon Feb 02 11:49:14.600714 2026] [:error] [pid 63034:tid 63124] [client 185.241.211.8:64724] [client 185.241.211.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYAeuuKXlgw75_wfbHpx4gAAAIY"]
[Mon Feb 02 11:49:15.036293 2026] [:error] [pid 63153:tid 63165] [client 185.241.211.8:64923] [client 185.241.211.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYAeu3C9GXHnmLkdgdkZxgAAAMQ"]
[Mon Feb 02 11:49:15.467857 2026] [:error] [pid 57080:tid 57096] [client 185.241.211.8:65099] [client 185.241.211.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYAeu49Utn0ZlfnF10Pv6wAAAsk"]
[Mon Feb 02 11:50:03.279047 2026] [:error] [pid 57022:tid 57072] [client 101.46.58.127:33316] [client 101.46.58.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 101.46.58.127, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYAe6xnEgLMzfcurxfn0tAAAApQ"]
[Mon Feb 02 11:50:33.116606 2026] [:error] [pid 57022:tid 57064] [client 175.100.42.35:44766] [client 175.100.42.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.100.42.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYAfCRnEgLMzfcurxfn0uwAAAow"]
[Mon Feb 02 12:16:40.931670 2026] [:error] [pid 63032:tid 63072] [client 43.166.131.228:47732] [client 43.166.131.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYAlKHyEQ1PkpebvdRiALQAAAAk"]
[Mon Feb 02 12:35:25.792702 2026] [:error] [pid 46008:tid 46033] [client 155.133.142.66:41293] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.142.66, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYApjSRa52iYn7SlSMlEawAAAVY"]
[Mon Feb 02 15:40:15.211519 2026] [:error] [pid 56989:tid 57011] [client 185.199.223.27:35782] [client 185.199.223.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.27, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYBU30p44HnChN-GZli98QAAAhQ"]
[Mon Feb 02 15:50:09.375684 2026] [:error] [pid 57021:tid 57040] [client 124.156.225.181:53784] [client 124.156.225.181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYBXMf7AEpx7VcmYK3HONAAAAk8"]
[Mon Feb 02 16:16:02.301292 2026] [:error] [pid 57021:tid 57030] [client 220.158.233.50:27004] [client 220.158.233.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.158.233.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYBdQv7AEpx7VcmYK3HUkgAAAkU"]
[Mon Feb 02 16:16:39.137400 2026] [:error] [pid 63153:tid 63162] [client 198.60.193.12:54984] [client 198.60.193.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.60.193.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYBdZ3C9GXHnmLkdgdlIogAAAME"]
[Mon Feb 02 16:16:58.195564 2026] [:error] [pid 33612:tid 33624] [client 93.89.225.199:34626] [client 93.89.225.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.89.225.199, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYBdestFn80qQEmo5QrY7wAAAQo"]
[Mon Feb 02 16:19:52.855542 2026] [:error] [pid 33612:tid 33615] [client 159.26.108.45:36089] [client 159.26.108.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.26.108.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYBeKMtFn80qQEmo5QrZYwAAAQE"]
[Mon Feb 02 16:19:55.533162 2026] [:error] [pid 33612:tid 33621] [client 159.26.108.45:36089] [client 159.26.108.45] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYBeK8tFn80qQEmo5QrZZgAAAQc"]
[Mon Feb 02 16:19:55.939115 2026] [:error] [pid 33612:tid 33626] [client 159.26.108.45:36089] [client 159.26.108.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.26.108.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYBeK8tFn80qQEmo5QrZaAAAAQw"]
[Mon Feb 02 16:19:58.118530 2026] [:error] [pid 46008:tid 46033] [client 159.26.108.45:6884] [client 159.26.108.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.26.108.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYBeLiRa52iYn7SlSMl3MwAAAVY"]
[Mon Feb 02 16:20:00.416045 2026] [:error] [pid 63153:tid 63165] [client 159.26.108.45:36594] [client 159.26.108.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.26.108.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYBeMHC9GXHnmLkdgdlJaQAAAMQ"]
[Mon Feb 02 16:20:02.682908 2026] [:error] [pid 56989:tid 57008] [client 159.26.108.45:48091] [client 159.26.108.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.26.108.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYBeMkp44HnChN-GZljMRQAAAhE"]
[Mon Feb 02 16:37:10.585601 2026] [:error] [pid 57081:tid 57134] [client 34.59.150.232:54257] [client 34.59.150.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.59.150.232, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYBiNmvouJ2Jkm6HfBgPsAAAAxM"]
[Mon Feb 02 16:37:12.761898 2026] [:error] [pid 57081:tid 57116] [client 34.59.150.232:54257] [client 34.59.150.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYBiOGvouJ2Jkm6HfBgPuQAAAwE"]
[Mon Feb 02 16:37:12.960727 2026] [:error] [pid 57081:tid 57123] [client 34.59.150.232:54257] [client 34.59.150.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.59.150.232, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYBiOGvouJ2Jkm6HfBgPugAAAwg"]
[Mon Feb 02 16:37:14.313663 2026] [:error] [pid 33612:tid 33628] [client 34.59.150.232:65455] [client 34.59.150.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.59.150.232, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYBiOstFn80qQEmo5Qrb5QAAAQ4"]
[Mon Feb 02 16:37:14.320146 2026] [:error] [pid 33612:tid 33628] [client 34.59.150.232:65455] [client 34.59.150.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/usr/local/apache/modsecurity-cwaf/rules/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 34.59.150.232 (+1 hits since last alert)|expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYBiOstFn80qQEmo5Qrb5QAAAQ4"]
[Mon Feb 02 18:12:35.608975 2026] [:error] [pid 63032:tid 63075] [client 43.166.253.94:39828] [client 43.166.253.94] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYB4k3yEQ1PkpebvdRjKbQAAAAw"]
[Mon Feb 02 18:14:02.785115 2026] [:error] [pid 63032:tid 63077] [client 102.222.188.10:46432] [client 102.222.188.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.222.188.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYB46nyEQ1PkpebvdRjKrwAAAA4"]
[Mon Feb 02 18:41:40.427460 2026] [:error] [pid 63153:tid 63185] [client 222.154.250.222:48158] [client 222.154.250.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 222.154.250.222, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYB_ZHC9GXHnmLkdgdlpygAAANg"], referer: https://expressinteriors.com/
[Mon Feb 02 19:06:47.111736 2026] [:error] [pid 56989:tid 56998] [client 103.20.213.90:52614] [client 103.20.213.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.20.213.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYCFR0p44HnChN-GZlj78gAAAgc"]
[Mon Feb 02 19:06:54.723079 2026] [:error] [pid 63034:tid 63126] [client 198.54.114.54:47968] [client 198.54.114.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYCFTuKXlgw75_wfbHrNiAAAAIg"]
[Mon Feb 02 19:06:58.665732 2026] [:error] [pid 57021:tid 57049] [client 103.69.96.39:44486] [client 103.69.96.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.69.96.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYCFUv7AEpx7VcmYK3HwVAAAAlg"]
[Mon Feb 02 19:07:11.787052 2026] [:error] [pid 57081:tid 57138] [client 139.59.110.28:50108] [client 139.59.110.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.59.110.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYCFX2vouJ2Jkm6HfBgtSAAAAxc"]
[Mon Feb 02 19:07:14.733840 2026] [:error] [pid 57080:tid 57101] [client 192.64.112.17:40192] [client 192.64.112.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.64.112.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYCFYo9Utn0ZlfnF10NOiAAAAs4"]
[Mon Feb 02 19:07:26.735154 2026] [:error] [pid 56989:tid 56996] [client 104.244.79.40:36940] [client 104.244.79.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.244.79.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYCFbkp44HnChN-GZlj8PQAAAgU"]
[Mon Feb 02 19:07:36.127778 2026] [:error] [pid 63032:tid 63070] [client 213.134.106.120:41700] [client 213.134.106.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.134.106.120, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYCFeHyEQ1PkpebvdRjUuQAAAAc"]
[Mon Feb 02 20:25:56.424977 2026] [:error] [pid 57021:tid 57046] [client 220.158.233.50:57718] [client 220.158.233.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.158.233.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYCX1P7AEpx7VcmYK3H9MgAAAlU"]
[Mon Feb 02 20:25:57.046678 2026] [:error] [pid 57080:tid 57097] [client 195.88.82.88:49724] [client 195.88.82.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.88.82.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYCX1Y9Utn0ZlfnF10NaXgAAAso"]
[Mon Feb 02 20:26:54.160903 2026] [:error] [pid 63153:tid 63171] [client 111.230.47.77:57858] [client 111.230.47.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 111.230.47.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYCYDnC9GXHnmLkdgdmJmQAAAMo"]
[Mon Feb 02 20:26:59.890679 2026] [:error] [pid 57021:tid 57040] [client 42.112.21.205:39226] [client 42.112.21.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 42.112.21.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYCYE_7AEpx7VcmYK3H9tAAAAk8"]
[Mon Feb 02 21:23:05.524908 2026] [:error] [pid 63034:tid 63132] [client 46.183.121.47:33850] [client 46.183.121.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.183.121.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYClOeKXlgw75_wfbHrnsAAAAI4"]
[Mon Feb 02 22:30:54.583646 2026] [ssl:error] [pid 57021:tid 57037] [client 104.168.98.195:60070] AH02032: Hostname www.cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup, referer: http://www.cdbdinteriors.com.au/
[Mon Feb 02 22:35:10.163659 2026] [:error] [pid 56989:tid 56995] [client 34.9.209.12:60736] [client 34.9.209.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.9.209.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYC2Hkp44HnChN-GZlgt7wAAAgQ"]
[Mon Feb 02 22:35:12.301449 2026] [:error] [pid 56989:tid 56997] [client 34.9.209.12:60736] [client 34.9.209.12] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYC2IEp44HnChN-GZlgt9QAAAgY"]
[Mon Feb 02 22:35:12.527128 2026] [:error] [pid 56989:tid 57006] [client 34.9.209.12:60736] [client 34.9.209.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.9.209.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYC2IEp44HnChN-GZlgt9gAAAg8"]
[Mon Feb 02 22:35:13.911518 2026] [:error] [pid 57021:tid 57034] [client 34.9.209.12:52851] [client 34.9.209.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.9.209.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYC2If7AEpx7VcmYK3ESIAAAAkk"]
[Mon Feb 02 22:35:13.915382 2026] [:error] [pid 57021:tid 57034] [client 34.9.209.12:52851] [client 34.9.209.12] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/usr/local/apache/modsecurity-cwaf/rules/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 34.9.209.12 (+1 hits since last alert)|expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYC2If7AEpx7VcmYK3ESIAAAAkk"]
[Mon Feb 02 23:08:02.489109 2026] [:error] [pid 57022:tid 57058] [client 202.61.202.166:42608] [client 202.61.202.166] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=application/ld+json"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYC90hnEgLMzfcurxfllQAAAAoY"]
[Mon Feb 02 23:54:47.517737 2026] [:error] [pid 57022:tid 57058] [client 43.157.179.227:33846] [client 43.157.179.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYDIxxnEgLMzfcurxflrggAAAoY"]
[Tue Feb 03 01:00:46.279182 2026] [:error] [pid 56989:tid 57015] [client 159.69.118.232:57354] [client 159.69.118.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.69.118.232, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYDYPkp44HnChN-GZlhPUAAAAhg"]
[Tue Feb 03 02:33:51.537278 2026] [:error] [pid 57080:tid 57094] [client 45.130.83.40:58981] [client 45.130.83.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.83.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYDuD49Utn0ZlfnF10OSPQAAAsc"]
[Tue Feb 03 02:33:54.079684 2026] [:error] [pid 57081:tid 57137] [client 45.92.229.166:33691] [client 45.92.229.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.92.229.166, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYDuEmvouJ2Jkm6HfBh8kQAAAxY"]
[Tue Feb 03 02:33:56.022614 2026] [:error] [pid 57080:tid 57107] [client 45.92.229.181:29457] [client 45.92.229.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.92.229.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYDuFI9Utn0ZlfnF10OSQwAAAtQ"]
[Tue Feb 03 02:33:57.799738 2026] [:error] [pid 57022:tid 57054] [client 45.130.83.49:44443] [client 45.130.83.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.83.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYDuFRnEgLMzfcurxfmCJwAAAoI"]
[Tue Feb 03 02:33:59.659526 2026] [:error] [pid 46008:tid 46031] [client 45.130.83.51:24453] [client 45.130.83.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.83.51, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYDuFyRa52iYn7SlSMnqFwAAAVQ"]
[Tue Feb 03 02:34:01.440793 2026] [:error] [pid 63032:tid 63084] [client 45.130.83.42:46033] [client 45.130.83.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.83.42, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYDuGXyEQ1PkpebvdRgr0AAAABU"]
[Tue Feb 03 02:34:03.359058 2026] [:error] [pid 46008:tid 46023] [client 45.130.83.46:40059] [client 45.130.83.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.83.46, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYDuGyRa52iYn7SlSMnqHAAAAUw"]
[Tue Feb 03 02:34:05.593763 2026] [:error] [pid 57080:tid 57093] [client 45.92.229.181:29051] [client 45.92.229.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.92.229.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYDuHY9Utn0ZlfnF10OSTAAAAsY"]
[Tue Feb 03 02:34:07.409110 2026] [:error] [pid 63032:tid 63064] [client 45.130.83.47:55873] [client 45.130.83.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.83.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYDuH3yEQ1PkpebvdRgr2wAAAAE"]
[Tue Feb 03 02:34:09.256972 2026] [:error] [pid 63153:tid 63181] [client 45.130.83.30:40027] [client 45.130.83.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.83.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYDuIXC9GXHnmLkdgdnzUwAAANQ"]
[Tue Feb 03 02:34:11.359596 2026] [:error] [pid 63034:tid 63137] [client 45.130.83.50:29739] [client 45.130.83.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.83.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYDuI-KXlgw75_wfbHogrAAAAJM"]
[Tue Feb 03 02:34:11.359762 2026] [:error] [pid 63034:tid 63137] [client 45.130.83.50:29739] [client 45.130.83.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 45.130.83.50, counter = 8"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYDuI-KXlgw75_wfbHogrAAAAJM"]
[Tue Feb 03 02:34:12.519638 2026] [:error] [pid 63034:tid 63134] [client 45.130.83.50:23723] [client 45.130.83.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.83.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYDuJOKXlgw75_wfbHogrgAAAJA"]
[Tue Feb 03 02:34:12.519798 2026] [:error] [pid 63034:tid 63134] [client 45.130.83.50:23723] [client 45.130.83.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 45.130.83.50, counter = 9"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYDuJOKXlgw75_wfbHogrgAAAJA"]
[Tue Feb 03 02:34:13.707149 2026] [:error] [pid 63034:tid 63140] [client 45.92.229.175:20883] [client 45.92.229.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.92.229.175, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYDuJeKXlgw75_wfbHogswAAAJY"]
[Tue Feb 03 02:34:13.707346 2026] [:error] [pid 63034:tid 63140] [client 45.92.229.175:20883] [client 45.92.229.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 45.92.229.175, counter = 8"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYDuJeKXlgw75_wfbHogswAAAJY"]
[Tue Feb 03 03:00:26.180798 2026] [:error] [pid 63153:tid 63168] [client 45.130.83.57:46707] [client 45.130.83.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.83.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYD0SnC9GXHnmLkdgdn4sgAAAMc"]
[Tue Feb 03 03:11:23.581046 2026] [:error] [pid 46008:tid 46033] [client 45.130.83.57:56681] [client 45.130.83.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.83.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYD22yRa52iYn7SlSMn14wAAAVY"]
[Tue Feb 03 03:51:47.311228 2026] [:error] [pid 39809:tid 39892] [client 34.11.225.148:40984] [client 34.11.225.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.11.225.148, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYEAU5lAO0hVnU_wyPV7XQAAAEc"]
[Tue Feb 03 04:05:11.461000 2026] [:error] [pid 43028:tid 43041] [client 20.93.54.24:25408] [client 20.93.54.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.93.54.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYEDd1nHWnJD4cJC5DtWdwAAAMs"]
[Tue Feb 03 07:13:26.019709 2026] [:error] [pid 42920:tid 42939] [client 178.128.250.184:39580] [client 178.128.250.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.128.250.184, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYEvliix3YKltG4EU0mqvgAAAAo"]
[Tue Feb 03 08:18:46.374035 2026] [:error] [pid 42920:tid 42937] [client 103.77.107.204:63975] [client 103.77.107.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aYE-5iix3YKltG4EU0nCOAAAAAg"]
[Tue Feb 03 09:14:19.765668 2026] [:error] [pid 42920:tid 42935] [client 43.130.3.120:51336] [client 43.130.3.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYFL6yix3YKltG4EU0nTuAAAAAY"]
[Tue Feb 03 09:48:28.540949 2026] [:error] [pid 5229:tid 5253] [client 192.241.176.150:52732] [client 192.241.176.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.241.176.150, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYFT7EKmEgmJub93yUru-AAAAZY"]
[Tue Feb 03 12:15:26.547683 2026] [:error] [pid 5229:tid 5243] [client 148.113.180.195:57076] [client 148.113.180.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.180.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYF2XkKmEgmJub93yUoyCQAAAYw"]
[Tue Feb 03 13:14:20.026380 2026] [:error] [pid 5148:tid 5158] [client 103.77.107.204:50555] [client 103.77.107.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYGELL83HCHLtUIbS7JZcAAAAUc"]
[Tue Feb 03 15:02:44.765362 2026] [:error] [pid 43028:tid 43030] [client 115.147.38.123:60854] [client 115.147.38.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.147.38.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYGdlFnHWnJD4cJC5Ds8ngAAAMA"]
[Tue Feb 03 15:06:58.316764 2026] [:error] [pid 5148:tid 5151] [client 43.166.134.114:40418] [client 43.166.134.114] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYGekr83HCHLtUIbS7J_WAAAAUA"]
[Tue Feb 03 15:08:41.034968 2026] [:error] [pid 42921:tid 42967] [client 157.66.27.55:54858] [client 157.66.27.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYGe-YblShffGl-01ockJgAAAEk"]
[Tue Feb 03 16:08:29.160298 2026] [:error] [pid 42921:tid 42964] [client 134.90.137.88:51410] [client 134.90.137.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.90.137.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYGs_YblShffGl-01oczBwAAAEY"]
[Tue Feb 03 17:33:57.725262 2026] [:error] [pid 42920:tid 42933] [client 101.32.208.70:42670] [client 101.32.208.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYHBBSix3YKltG4EU0lQygAAAAQ"]
[Tue Feb 03 17:39:37.622017 2026] [autoindex:error] [pid 42921:tid 42980] [client 185.193.157.161:39272] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:39:37.902641 2026] [autoindex:error] [pid 42921:tid 42967] [client 185.193.157.161:39272] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:39:38.582225 2026] [autoindex:error] [pid 42921:tid 42974] [client 185.193.157.161:39272] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:39:38.869317 2026] [autoindex:error] [pid 42921:tid 42959] [client 185.193.157.161:39272] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:39:39.150326 2026] [autoindex:error] [pid 42921:tid 42982] [client 185.193.157.161:39272] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:39:39.461597 2026] [autoindex:error] [pid 42921:tid 42976] [client 185.193.157.161:39272] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:39:39.749278 2026] [autoindex:error] [pid 42921:tid 42966] [client 185.193.157.161:39272] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:39:40.033049 2026] [autoindex:error] [pid 42921:tid 42970] [client 185.193.157.161:39272] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:39:45.691148 2026] [autoindex:error] [pid 42921:tid 42960] [client 185.193.157.161:39272] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:39:46.262788 2026] [autoindex:error] [pid 42921:tid 42959] [client 185.193.157.161:39272] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:39:46.544245 2026] [autoindex:error] [pid 42921:tid 42982] [client 185.193.157.161:39272] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:39:47.164028 2026] [autoindex:error] [pid 42921:tid 42976] [client 185.193.157.161:39272] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:39:47.447413 2026] [autoindex:error] [pid 42921:tid 42966] [client 185.193.157.161:39272] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:39:50.699761 2026] [autoindex:error] [pid 42921:tid 42963] [client 185.193.157.161:39272] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:39:54.862643 2026] [:error] [pid 42921:tid 42972] [client 185.193.157.161:39272] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/web/"] [unique_id "aYHCaoblShffGl-01odF0wAAAE4"]
[Tue Feb 03 17:39:55.417065 2026] [:error] [pid 5148:tid 5164] [client 185.193.157.161:40388] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/web/"] [unique_id "aYHCa783HCHLtUIbS7KpsAAAAU0"]
[Tue Feb 03 17:39:55.969120 2026] [:error] [pid 28720:tid 28725] [client 185.193.157.161:40394] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/web/"] [unique_id "aYHCa2mRXm2bmr_sYiab2QAAAQM"]
[Tue Feb 03 17:39:56.522793 2026] [:error] [pid 5148:tid 5170] [client 185.193.157.161:40400] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/web/"] [unique_id "aYHCbL83HCHLtUIbS7KpsgAAAVM"]
[Tue Feb 03 17:39:57.099884 2026] [:error] [pid 28720:tid 28726] [client 185.193.157.161:40414] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/"] [unique_id "aYHCbWmRXm2bmr_sYiab2gAAAQQ"]
[Tue Feb 03 17:39:57.669522 2026] [:error] [pid 42921:tid 42970] [client 185.193.157.161:40422] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/"] [unique_id "aYHCbYblShffGl-01odF1AAAAEw"]
[Tue Feb 03 17:39:58.222029 2026] [:error] [pid 43028:tid 43054] [client 185.193.157.161:40428] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/"] [unique_id "aYHCblnHWnJD4cJC5DthZQAAANg"]
[Tue Feb 03 17:39:58.774932 2026] [:error] [pid 5148:tid 5172] [client 185.193.157.161:40440] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/"] [unique_id "aYHCbr83HCHLtUIbS7KptQAAAVU"]
[Tue Feb 03 17:39:59.331375 2026] [:error] [pid 43028:tid 43047] [client 185.193.157.161:40446] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/"] [unique_id "aYHCb1nHWnJD4cJC5DthaQAAANE"]
[Tue Feb 03 17:39:59.884169 2026] [:error] [pid 5148:tid 5169] [client 185.193.157.161:40458] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/"] [unique_id "aYHCb783HCHLtUIbS7KptwAAAVI"]
[Tue Feb 03 17:40:00.499240 2026] [:error] [pid 42920:tid 42930] [client 185.193.157.161:40324] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/"] [unique_id "aYHCcCix3YKltG4EU0lSHgAAAAE"]
[Tue Feb 03 17:40:01.060589 2026] [:error] [pid 5148:tid 5164] [client 185.193.157.161:40338] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/"] [unique_id "aYHCcb83HCHLtUIbS7KpvwAAAU0"]
[Tue Feb 03 17:40:01.686902 2026] [:error] [pid 5229:tid 5243] [client 185.193.157.161:40352] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/"] [unique_id "aYHCcUKmEgmJub93yUqyOgAAAYw"]
[Tue Feb 03 17:40:02.239090 2026] [:error] [pid 5229:tid 5245] [client 185.193.157.161:40368] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/"] [unique_id "aYHCckKmEgmJub93yUqyQAAAAY4"]
[Tue Feb 03 17:40:02.821343 2026] [:error] [pid 5148:tid 5158] [client 185.193.157.161:40378] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/"] [unique_id "aYHCcr83HCHLtUIbS7Kp1QAAAUc"]
[Tue Feb 03 17:40:03.374378 2026] [:error] [pid 28720:tid 28746] [client 185.193.157.161:40392] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/"] [unique_id "aYHCc2mRXm2bmr_sYiab4AAAARg"]
[Tue Feb 03 17:40:03.928756 2026] [:error] [pid 42920:tid 42941] [client 185.193.157.161:40394] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Admin/uploads/"] [unique_id "aYHCcyix3YKltG4EU0lSJQAAAAw"]
[Tue Feb 03 17:40:04.492634 2026] [:error] [pid 43028:tid 43047] [client 185.193.157.161:40404] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Admin/uploads/"] [unique_id "aYHCdFnHWnJD4cJC5DthdgAAANE"]
[Tue Feb 03 17:40:05.122441 2026] [:error] [pid 43028:tid 43039] [client 185.193.157.161:40416] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Admin/uploads/"] [unique_id "aYHCdVnHWnJD4cJC5DtheQAAAMk"]
[Tue Feb 03 17:40:05.761489 2026] [:error] [pid 42920:tid 42929] [client 185.193.157.161:40422] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Admin/uploads/"] [unique_id "aYHCdSix3YKltG4EU0lSKgAAAAA"]
[Tue Feb 03 17:40:06.314695 2026] [:error] [pid 42921:tid 42979] [client 185.193.157.161:40434] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/"] [unique_id "aYHCdoblShffGl-01odF4AAAAFU"]
[Tue Feb 03 17:40:07.212057 2026] [:error] [pid 28720:tid 28723] [client 185.193.157.161:40438] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/"] [unique_id "aYHCd2mRXm2bmr_sYiab6QAAAQE"]
[Tue Feb 03 17:40:07.768780 2026] [:error] [pid 5148:tid 5159] [client 185.193.157.161:40446] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/"] [unique_id "aYHCd783HCHLtUIbS7Kp5wAAAUg"]
[Tue Feb 03 17:40:08.324197 2026] [:error] [pid 42920:tid 42935] [client 185.193.157.161:40460] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/"] [unique_id "aYHCeCix3YKltG4EU0lSKwAAAAY"]
[Tue Feb 03 17:40:08.941758 2026] [:error] [pid 5148:tid 5154] [client 185.193.157.161:40468] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/"] [unique_id "aYHCeL83HCHLtUIbS7Kp7QAAAUM"]
[Tue Feb 03 17:40:09.511543 2026] [:error] [pid 28720:tid 28739] [client 185.193.157.161:40480] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/"] [unique_id "aYHCeWmRXm2bmr_sYiab6wAAARE"]
[Tue Feb 03 17:40:10.088500 2026] [:error] [pid 5229:tid 5250] [client 185.193.157.161:40490] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/"] [unique_id "aYHCekKmEgmJub93yUqyVQAAAZM"]
[Tue Feb 03 17:40:10.897866 2026] [:error] [pid 28720:tid 28746] [client 185.193.157.161:45854] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/"] [unique_id "aYHCemmRXm2bmr_sYiab7AAAARg"]
[Tue Feb 03 17:40:11.507917 2026] [:error] [pid 28720:tid 28737] [client 185.193.157.161:45860] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/"] [unique_id "aYHCe2mRXm2bmr_sYiab7gAAAQ8"]
[Tue Feb 03 17:40:12.311606 2026] [:error] [pid 28720:tid 28734] [client 185.193.157.161:45874] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/"] [unique_id "aYHCfGmRXm2bmr_sYiab8QAAAQw"]
[Tue Feb 03 17:40:12.875418 2026] [:error] [pid 42921:tid 42970] [client 185.193.157.161:45882] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/"] [unique_id "aYHCfIblShffGl-01odF5wAAAEw"]
[Tue Feb 03 17:40:13.450211 2026] [:error] [pid 42922:tid 43005] [client 185.193.157.161:45896] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/"] [unique_id "aYHCfWazX4WPS_dQRkhnowAAAJQ"]
[Tue Feb 03 17:40:14.139993 2026] [:error] [pid 42922:tid 42990] [client 185.193.157.161:45908] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/"] [unique_id "aYHCfmazX4WPS_dQRkhnpgAAAIU"]
[Tue Feb 03 17:40:14.694566 2026] [:error] [pid 42922:tid 42993] [client 185.193.157.161:45920] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/"] [unique_id "aYHCfmazX4WPS_dQRkhnpwAAAIg"]
[Tue Feb 03 17:40:15.346837 2026] [:error] [pid 5229:tid 5234] [client 185.193.157.161:45926] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/"] [unique_id "aYHCf0KmEgmJub93yUqyWQAAAYM"]
[Tue Feb 03 17:40:15.899718 2026] [:error] [pid 5229:tid 5253] [client 185.193.157.161:45934] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/"] [unique_id "aYHCf0KmEgmJub93yUqyWgAAAZY"]
[Tue Feb 03 17:40:16.475780 2026] [:error] [pid 42921:tid 42960] [client 185.193.157.161:45950] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/image/"] [unique_id "aYHCgIblShffGl-01odF9AAAAEI"]
[Tue Feb 03 17:40:17.113881 2026] [:error] [pid 5148:tid 5153] [client 185.193.157.161:45952] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/image/"] [unique_id "aYHCgb83HCHLtUIbS7Kp8AAAAUI"]
[Tue Feb 03 17:40:17.692116 2026] [:error] [pid 5229:tid 5251] [client 185.193.157.161:45960] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/image/"] [unique_id "aYHCgUKmEgmJub93yUqyYgAAAZQ"]
[Tue Feb 03 17:40:18.357425 2026] [:error] [pid 5229:tid 5233] [client 185.193.157.161:45974] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/image/"] [unique_id "aYHCgkKmEgmJub93yUqyZQAAAYI"]
[Tue Feb 03 17:40:18.915653 2026] [:error] [pid 42922:tid 42989] [client 185.193.157.161:45978] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/images/"] [unique_id "aYHCgmazX4WPS_dQRkhnsgAAAIQ"]
[Tue Feb 03 17:40:19.483417 2026] [:error] [pid 42922:tid 42992] [client 185.193.157.161:45980] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/images/"] [unique_id "aYHCg2azX4WPS_dQRkhnswAAAIc"]
[Tue Feb 03 17:40:20.037933 2026] [:error] [pid 42921:tid 42966] [client 185.193.157.161:45994] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/images/"] [unique_id "aYHChIblShffGl-01odF9wAAAEg"]
[Tue Feb 03 17:40:20.426447 2026] [:error] [pid 5229:tid 5233] [client 185.193.157.161:45974] [client 185.193.157.161] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "114.119.156.190_2f20390f4bf2c71a212308cf7c6fbb784b1f8cbf"): Internal error (specific information not available) [hostname "expressinteriors.com"] [uri "/upload/image/"] [unique_id "aYHCgkKmEgmJub93yUqyZQAAAYI"]
[Tue Feb 03 17:40:20.589441 2026] [:error] [pid 5229:tid 5248] [client 185.193.157.161:38096] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/images/"] [unique_id "aYHChEKmEgmJub93yUqyagAAAZE"]
[Tue Feb 03 17:40:21.143373 2026] [:error] [pid 28720:tid 28730] [client 185.193.157.161:38112] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Public/"] [unique_id "aYHChWmRXm2bmr_sYiab9wAAAQg"]
[Tue Feb 03 17:40:21.705592 2026] [:error] [pid 28720:tid 28728] [client 185.193.157.161:38124] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Public/"] [unique_id "aYHChWmRXm2bmr_sYiab-gAAAQY"]
[Tue Feb 03 17:40:22.444734 2026] [:error] [pid 28720:tid 28725] [client 185.193.157.161:38136] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Public/"] [unique_id "aYHChmmRXm2bmr_sYiab_wAAAQM"]
[Tue Feb 03 17:40:22.997373 2026] [:error] [pid 42922:tid 43002] [client 185.193.157.161:38152] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Public/"] [unique_id "aYHChmazX4WPS_dQRkhnuwAAAJE"]
[Tue Feb 03 17:40:23.565892 2026] [:error] [pid 5148:tid 5170] [client 185.193.157.161:38166] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/"] [unique_id "aYHCh783HCHLtUIbS7Kp_AAAAVM"]
[Tue Feb 03 17:40:24.159394 2026] [:error] [pid 28720:tid 28746] [client 185.193.157.161:38178] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/"] [unique_id "aYHCiGmRXm2bmr_sYiacAwAAARg"]
[Tue Feb 03 17:40:24.712251 2026] [:error] [pid 42922:tid 42990] [client 185.193.157.161:38192] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/"] [unique_id "aYHCiGazX4WPS_dQRkhnvwAAAIU"]
[Tue Feb 03 17:40:25.600202 2026] [:error] [pid 5229:tid 5250] [client 185.193.157.161:38194] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vendor/"] [unique_id "aYHCiUKmEgmJub93yUqydgAAAZM"]
[Tue Feb 03 17:40:26.193586 2026] [:error] [pid 5148:tid 5166] [client 185.193.157.161:38204] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/local/"] [unique_id "aYHCir83HCHLtUIbS7KqAQAAAU8"]
[Tue Feb 03 17:40:26.806475 2026] [:error] [pid 42920:tid 42953] [client 185.193.157.161:38220] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/local/"] [unique_id "aYHCiiix3YKltG4EU0lSLwAAABg"]
[Tue Feb 03 17:40:27.658738 2026] [:error] [pid 5229:tid 5234] [client 185.193.157.161:38232] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/local/"] [unique_id "aYHCi0KmEgmJub93yUqydwAAAYM"]
[Tue Feb 03 17:40:28.227714 2026] [:error] [pid 42921:tid 42977] [client 185.193.157.161:38242] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/local/"] [unique_id "aYHCjIblShffGl-01odGAQAAAFM"]
[Tue Feb 03 17:40:28.787787 2026] [:error] [pid 5148:tid 5174] [client 185.193.157.161:38248] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/modules/"] [unique_id "aYHCjL83HCHLtUIbS7KqAgAAAVc"]
[Tue Feb 03 17:40:29.459703 2026] [:error] [pid 42920:tid 42931] [client 185.193.157.161:38260] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/modules/"] [unique_id "aYHCjSix3YKltG4EU0lSNQAAAAI"]
[Tue Feb 03 17:40:30.238058 2026] [:error] [pid 42920:tid 42932] [client 185.193.157.161:38266] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/modules/"] [unique_id "aYHCjiix3YKltG4EU0lSOQAAAAM"]
[Tue Feb 03 17:40:31.003572 2026] [:error] [pid 42920:tid 42933] [client 185.193.157.161:37770] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/modules/"] [unique_id "aYHCjyix3YKltG4EU0lSOwAAAAQ"]
[Tue Feb 03 17:40:31.574259 2026] [:error] [pid 43028:tid 43037] [client 185.193.157.161:37780] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Site/"] [unique_id "aYHCj1nHWnJD4cJC5DthigAAAMc"]
[Tue Feb 03 17:40:32.573479 2026] [:error] [pid 42920:tid 42946] [client 185.193.157.161:37784] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Site/"] [unique_id "aYHCkCix3YKltG4EU0lSQAAAABE"]
[Tue Feb 03 17:40:33.127995 2026] [:error] [pid 5148:tid 5157] [client 185.193.157.161:37796] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Site/"] [unique_id "aYHCkb83HCHLtUIbS7KqBgAAAUY"]
[Tue Feb 03 17:40:33.685563 2026] [:error] [pid 5148:tid 5167] [client 185.193.157.161:37806] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Site/"] [unique_id "aYHCkb83HCHLtUIbS7KqBwAAAVA"]
[Tue Feb 03 17:40:34.242107 2026] [:error] [pid 42921:tid 42974] [client 185.193.157.161:37808] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system/"] [unique_id "aYHCkoblShffGl-01odGBQAAAFA"]
[Tue Feb 03 17:40:34.794122 2026] [:error] [pid 5148:tid 5165] [client 185.193.157.161:37816] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system/"] [unique_id "aYHCkr83HCHLtUIbS7KqCQAAAU4"]
[Tue Feb 03 17:40:35.378984 2026] [:error] [pid 42920:tid 42952] [client 185.193.157.161:37828] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system/"] [unique_id "aYHCkyix3YKltG4EU0lSQwAAABc"]
[Tue Feb 03 17:40:35.986423 2026] [:error] [pid 5229:tid 5248] [client 185.193.157.161:37830] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system/"] [unique_id "aYHCk0KmEgmJub93yUqyggAAAZE"]
[Tue Feb 03 17:40:36.539724 2026] [:error] [pid 42921:tid 42976] [client 185.193.157.161:37838] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/template/"] [unique_id "aYHClIblShffGl-01odGBgAAAFI"]
[Tue Feb 03 17:40:37.106618 2026] [:error] [pid 5229:tid 5251] [client 185.193.157.161:37844] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/template/"] [unique_id "aYHClUKmEgmJub93yUqyhwAAAZQ"]
[Tue Feb 03 17:40:37.659403 2026] [:error] [pid 5148:tid 5159] [client 185.193.157.161:37858] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/template/"] [unique_id "aYHClb83HCHLtUIbS7KqCwAAAUg"]
[Tue Feb 03 17:40:38.211606 2026] [:error] [pid 42922:tid 42986] [client 185.193.157.161:37868] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/template/"] [unique_id "aYHClmazX4WPS_dQRkhnzgAAAIE"]
[Tue Feb 03 17:40:38.769358 2026] [:error] [pid 5229:tid 5238] [client 185.193.157.161:37870] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop/"] [unique_id "aYHClkKmEgmJub93yUqyigAAAYc"]
[Tue Feb 03 17:40:39.347128 2026] [:error] [pid 5229:tid 5253] [client 185.193.157.161:37880] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop/"] [unique_id "aYHCl0KmEgmJub93yUqyiwAAAZY"]
[Tue Feb 03 17:40:39.899973 2026] [:error] [pid 5229:tid 5241] [client 185.193.157.161:37882] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop/"] [unique_id "aYHCl0KmEgmJub93yUqykAAAAYo"]
[Tue Feb 03 17:40:40.478435 2026] [:error] [pid 5148:tid 5173] [client 185.193.157.161:45930] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop/"] [unique_id "aYHCmL83HCHLtUIbS7KqDgAAAVY"]
[Tue Feb 03 17:40:41.031664 2026] [:error] [pid 28720:tid 28731] [client 185.193.157.161:45934] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files/"] [unique_id "aYHCmWmRXm2bmr_sYiacFgAAAQk"]
[Tue Feb 03 17:40:41.583229 2026] [:error] [pid 5148:tid 5164] [client 185.193.157.161:45938] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files/"] [unique_id "aYHCmb83HCHLtUIbS7KqDwAAAU0"]
[Tue Feb 03 17:40:42.533334 2026] [:error] [pid 42920:tid 42934] [client 185.193.157.161:45944] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files/"] [unique_id "aYHCmiix3YKltG4EU0lSRgAAAAU"]
[Tue Feb 03 17:40:43.102939 2026] [:error] [pid 5229:tid 5231] [client 185.193.157.161:45946] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files/"] [unique_id "aYHCm0KmEgmJub93yUqylgAAAYA"]
[Tue Feb 03 17:40:43.656229 2026] [:error] [pid 5148:tid 5168] [client 185.193.157.161:45958] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/editor/"] [unique_id "aYHCm783HCHLtUIbS7KqGAAAAVE"]
[Tue Feb 03 17:40:44.212828 2026] [:error] [pid 43028:tid 43037] [client 185.193.157.161:45966] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/editor/"] [unique_id "aYHCnFnHWnJD4cJC5DthmgAAAMc"]
[Tue Feb 03 17:40:45.798840 2026] [:error] [pid 42921:tid 42971] [client 185.193.157.161:45970] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/editor/"] [unique_id "aYHCnYblShffGl-01odGCQAAAE0"]
[Tue Feb 03 17:40:46.450546 2026] [:error] [pid 43028:tid 43054] [client 185.193.157.161:45986] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/editor/"] [unique_id "aYHCnlnHWnJD4cJC5DthnwAAANg"]
[Tue Feb 03 17:40:47.085721 2026] [:error] [pid 42920:tid 42935] [client 185.193.157.161:45998] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/include/"] [unique_id "aYHCnyix3YKltG4EU0lSTAAAAAY"]
[Tue Feb 03 17:40:47.641404 2026] [:error] [pid 42920:tid 42945] [client 185.193.157.161:46010] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/include/"] [unique_id "aYHCnyix3YKltG4EU0lSTgAAABA"]
[Tue Feb 03 17:40:48.194586 2026] [:error] [pid 42920:tid 42948] [client 185.193.157.161:46020] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/include/"] [unique_id "aYHCoCix3YKltG4EU0lSUAAAABM"]
[Tue Feb 03 17:40:48.746936 2026] [:error] [pid 42921:tid 42975] [client 185.193.157.161:46032] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/include/"] [unique_id "aYHCoIblShffGl-01odGCgAAAFE"]
[Tue Feb 03 17:40:49.300054 2026] [:error] [pid 5148:tid 5166] [client 185.193.157.161:46044] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Assets/"] [unique_id "aYHCob83HCHLtUIbS7KqHwAAAU8"]
[Tue Feb 03 17:40:49.855107 2026] [:error] [pid 42922:tid 42988] [client 185.193.157.161:46056] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Assets/"] [unique_id "aYHCoWazX4WPS_dQRkhn1QAAAIM"]
[Tue Feb 03 17:40:50.407310 2026] [:error] [pid 5229:tid 5253] [client 185.193.157.161:33756] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Assets/"] [unique_id "aYHCokKmEgmJub93yUqynwAAAZY"]
[Tue Feb 03 17:40:50.989724 2026] [:error] [pid 42922:tid 42998] [client 185.193.157.161:33772] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Assets/"] [unique_id "aYHComazX4WPS_dQRkhn1wAAAI0"]
[Tue Feb 03 17:40:51.543005 2026] [:error] [pid 5229:tid 5248] [client 185.193.157.161:33776] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/stories/"] [unique_id "aYHCo0KmEgmJub93yUqyoAAAAZE"]
[Tue Feb 03 17:40:52.095916 2026] [:error] [pid 5229:tid 5233] [client 185.193.157.161:33778] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/stories/"] [unique_id "aYHCpEKmEgmJub93yUqyogAAAYI"]
[Tue Feb 03 17:40:52.648254 2026] [:error] [pid 42920:tid 42952] [client 185.193.157.161:33792] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/stories/"] [unique_id "aYHCpCix3YKltG4EU0lSVwAAABc"]
[Tue Feb 03 17:40:56.491699 2026] [autoindex:error] [pid 42922:tid 42992] [client 185.193.157.161:33800] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:40:58.753872 2026] [autoindex:error] [pid 42922:tid 43008] [client 185.193.157.161:33800] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:40:59.058024 2026] [authz_core:error] [pid 42922:tid 42987] [client 185.193.157.161:33800] AH01630: client denied by server configuration: /home/expressi/public_html/wp-content/plugins/akismet/
[Tue Feb 03 17:40:59.342310 2026] [autoindex:error] [pid 42922:tid 42988] [client 185.193.157.161:33800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:40:59.626414 2026] [autoindex:error] [pid 42922:tid 42998] [client 185.193.157.161:33800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:40:59.989653 2026] [autoindex:error] [pid 42922:tid 42996] [client 185.193.157.161:33800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:41:00.309771 2026] [autoindex:error] [pid 42922:tid 43005] [client 185.193.157.161:33800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:41:00.594152 2026] [autoindex:error] [pid 42922:tid 42991] [client 185.193.157.161:33800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:41:00.889709 2026] [autoindex:error] [pid 42922:tid 43006] [client 185.193.157.161:33800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/php-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:41:01.178933 2026] [autoindex:error] [pid 42922:tid 42990] [client 185.193.157.161:33800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:41:01.493216 2026] [autoindex:error] [pid 42922:tid 42986] [client 185.193.157.161:33800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:41:02.753859 2026] [autoindex:error] [pid 42922:tid 42997] [client 185.193.157.161:33800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:41:03.033687 2026] [autoindex:error] [pid 42922:tid 42985] [client 185.193.157.161:33800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:41:03.316969 2026] [autoindex:error] [pid 42922:tid 43004] [client 185.193.157.161:33800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:41:03.599967 2026] [autoindex:error] [pid 42922:tid 42987] [client 185.193.157.161:33800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:41:03.928129 2026] [autoindex:error] [pid 42922:tid 43002] [client 185.193.157.161:33800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:41:04.254694 2026] [autoindex:error] [pid 42922:tid 43009] [client 185.193.157.161:33800] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:41:04.553263 2026] [autoindex:error] [pid 42922:tid 42998] [client 185.193.157.161:33800] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:41:04.840291 2026] [autoindex:error] [pid 42922:tid 43005] [client 185.193.157.161:33800] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 17:41:09.868823 2026] [:error] [pid 42922:tid 43009] [client 185.193.157.161:33800] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/components/"] [unique_id "aYHCtWazX4WPS_dQRkhoDgAAAJg"]
[Tue Feb 03 17:41:10.425658 2026] [:error] [pid 5148:tid 5168] [client 185.193.157.161:35664] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/components/"] [unique_id "aYHCtr83HCHLtUIbS7KqNAAAAVE"]
[Tue Feb 03 17:41:10.979431 2026] [:error] [pid 5148:tid 5165] [client 185.193.157.161:35672] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/components/"] [unique_id "aYHCtr83HCHLtUIbS7KqOQAAAU4"]
[Tue Feb 03 17:41:11.532536 2026] [:error] [pid 5229:tid 5240] [client 185.193.157.161:35676] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/components/"] [unique_id "aYHCt0KmEgmJub93yUqyvAAAAYk"]
[Tue Feb 03 17:41:12.087405 2026] [:error] [pid 43028:tid 43032] [client 185.193.157.161:35686] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/images/"] [unique_id "aYHCuFnHWnJD4cJC5DthwAAAAMI"]
[Tue Feb 03 17:41:12.640833 2026] [:error] [pid 5229:tid 5248] [client 185.193.157.161:35688] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/images/"] [unique_id "aYHCuEKmEgmJub93yUqywAAAAZE"]
[Tue Feb 03 17:41:13.193565 2026] [:error] [pid 5148:tid 5162] [client 185.193.157.161:35696] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/images/"] [unique_id "aYHCub83HCHLtUIbS7KqTAAAAUs"]
[Tue Feb 03 17:41:13.747363 2026] [:error] [pid 42922:tid 43004] [client 185.193.157.161:35702] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/images/"] [unique_id "aYHCuWazX4WPS_dQRkhoEwAAAJM"]
[Tue Feb 03 17:41:14.305115 2026] [:error] [pid 42922:tid 43001] [client 185.193.157.161:35704] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/"] [unique_id "aYHCumazX4WPS_dQRkhoFAAAAJA"]
[Tue Feb 03 17:41:14.859438 2026] [:error] [pid 42922:tid 43009] [client 185.193.157.161:35718] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/"] [unique_id "aYHCumazX4WPS_dQRkhoFgAAAJg"]
[Tue Feb 03 17:41:15.455641 2026] [:error] [pid 28720:tid 28729] [client 185.193.157.161:35730] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/"] [unique_id "aYHCu2mRXm2bmr_sYiacRwAAAQc"]
[Tue Feb 03 17:41:16.011647 2026] [:error] [pid 5148:tid 5158] [client 185.193.157.161:35732] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/"] [unique_id "aYHCvL83HCHLtUIbS7KqUgAAAUc"]
[Tue Feb 03 17:41:16.583665 2026] [:error] [pid 42922:tid 43006] [client 185.193.157.161:35746] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/fonts/"] [unique_id "aYHCvGazX4WPS_dQRkhoGgAAAJU"]
[Tue Feb 03 17:41:17.136100 2026] [:error] [pid 42920:tid 42945] [client 185.193.157.161:35762] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/fonts/"] [unique_id "aYHCvSix3YKltG4EU0lSaAAAABA"]
[Tue Feb 03 17:41:17.686601 2026] [:error] [pid 28720:tid 28740] [client 185.193.157.161:35766] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/fonts/"] [unique_id "aYHCvWmRXm2bmr_sYiacSQAAARI"]
[Tue Feb 03 17:41:18.238603 2026] [:error] [pid 43028:tid 43053] [client 185.193.157.161:35768] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/fonts/"] [unique_id "aYHCvlnHWnJD4cJC5DthyAAAANc"]
[Tue Feb 03 17:41:18.796936 2026] [:error] [pid 28720:tid 28741] [client 185.193.157.161:35780] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/admin/js/"] [unique_id "aYHCvmmRXm2bmr_sYiacTAAAARM"]
[Tue Feb 03 17:41:19.349354 2026] [:error] [pid 5148:tid 5161] [client 185.193.157.161:35796] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/admin/js/"] [unique_id "aYHCv783HCHLtUIbS7KqVgAAAUo"]
[Tue Feb 03 17:41:19.904257 2026] [:error] [pid 5229:tid 5253] [client 185.193.157.161:35802] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/admin/js/"] [unique_id "aYHCv0KmEgmJub93yUqyygAAAZY"]
[Tue Feb 03 17:41:20.464258 2026] [:error] [pid 5148:tid 5158] [client 185.193.157.161:60818] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/admin/js/"] [unique_id "aYHCwL83HCHLtUIbS7KqWAAAAUc"]
[Tue Feb 03 17:41:21.046347 2026] [:error] [pid 28720:tid 28727] [client 185.193.157.161:60820] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/"] [unique_id "aYHCwWmRXm2bmr_sYiacTgAAAQU"]
[Tue Feb 03 17:41:21.597981 2026] [:error] [pid 5229:tid 5238] [client 185.193.157.161:60830] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/"] [unique_id "aYHCwUKmEgmJub93yUqyzwAAAYc"]
[Tue Feb 03 17:41:22.199484 2026] [:error] [pid 43028:tid 43031] [client 185.193.157.161:60832] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/"] [unique_id "aYHCwlnHWnJD4cJC5DthzgAAAME"]
[Tue Feb 03 17:41:22.786490 2026] [:error] [pid 42920:tid 42944] [client 185.193.157.161:60844] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/"] [unique_id "aYHCwiix3YKltG4EU0lSawAAAA8"]
[Tue Feb 03 17:41:23.354799 2026] [:error] [pid 5229:tid 5252] [client 185.193.157.161:60854] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/"] [unique_id "aYHCw0KmEgmJub93yUqy0QAAAZU"]
[Tue Feb 03 17:41:23.907468 2026] [:error] [pid 5148:tid 5168] [client 185.193.157.161:60856] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/"] [unique_id "aYHCw783HCHLtUIbS7KqXAAAAVE"]
[Tue Feb 03 17:41:24.460033 2026] [:error] [pid 28720:tid 28729] [client 185.193.157.161:60870] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/"] [unique_id "aYHCxGmRXm2bmr_sYiacUgAAAQc"]
[Tue Feb 03 17:41:25.012880 2026] [:error] [pid 43028:tid 43051] [client 185.193.157.161:60878] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/"] [unique_id "aYHCxVnHWnJD4cJC5Dth0gAAANU"]
[Tue Feb 03 17:41:25.565040 2026] [:error] [pid 5148:tid 5162] [client 185.193.157.161:60884] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/"] [unique_id "aYHCxb83HCHLtUIbS7KqXgAAAUs"]
[Tue Feb 03 17:41:26.120394 2026] [:error] [pid 5229:tid 5250] [client 185.193.157.161:60896] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/"] [unique_id "aYHCxkKmEgmJub93yUqy1gAAAZM"]
[Tue Feb 03 17:41:26.674994 2026] [:error] [pid 42920:tid 42940] [client 185.193.157.161:60910] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/"] [unique_id "aYHCxiix3YKltG4EU0lSbAAAAAs"]
[Tue Feb 03 17:41:27.229947 2026] [:error] [pid 42921:tid 42981] [client 185.193.157.161:60920] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/"] [unique_id "aYHCx4blShffGl-01odGYgAAAFc"]
[Tue Feb 03 17:41:27.846352 2026] [:error] [pid 42921:tid 42959] [client 185.193.157.161:60936] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/js/dist/"] [unique_id "aYHCx4blShffGl-01odGZAAAAEE"]
[Tue Feb 03 17:41:28.398998 2026] [:error] [pid 5229:tid 5252] [client 185.193.157.161:60942] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/js/dist/"] [unique_id "aYHCyEKmEgmJub93yUqy3AAAAZU"]
[Tue Feb 03 17:41:28.971950 2026] [:error] [pid 42920:tid 42947] [client 185.193.157.161:60948] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/js/dist/"] [unique_id "aYHCyCix3YKltG4EU0lScQAAABI"]
[Tue Feb 03 17:41:29.523615 2026] [:error] [pid 28720:tid 28727] [client 185.193.157.161:60952] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/js/dist/"] [unique_id "aYHCyWmRXm2bmr_sYiacWwAAAQU"]
[Tue Feb 03 17:41:30.159665 2026] [:error] [pid 42922:tid 43004] [client 185.193.157.161:60966] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/"] [unique_id "aYHCymazX4WPS_dQRkhoJAAAAJM"]
[Tue Feb 03 17:41:30.712026 2026] [:error] [pid 28720:tid 28745] [client 185.193.157.161:47010] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/"] [unique_id "aYHCymmRXm2bmr_sYiacXQAAARc"]
[Tue Feb 03 17:41:31.267234 2026] [:error] [pid 42922:tid 43003] [client 185.193.157.161:47018] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/"] [unique_id "aYHCy2azX4WPS_dQRkhoJwAAAJI"]
[Tue Feb 03 17:41:31.823074 2026] [:error] [pid 5148:tid 5162] [client 185.193.157.161:47030] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/"] [unique_id "aYHCy783HCHLtUIbS7KqZwAAAUs"]
[Tue Feb 03 17:41:32.942664 2026] [:error] [pid 5229:tid 5243] [client 185.193.157.161:47038] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/"] [unique_id "aYHCzEKmEgmJub93yUqy4AAAAYw"]
[Tue Feb 03 17:41:33.572961 2026] [:error] [pid 43028:tid 43039] [client 185.193.157.161:47046] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/"] [unique_id "aYHCzVnHWnJD4cJC5Dth2AAAAMk"]
[Tue Feb 03 17:41:34.126533 2026] [:error] [pid 42922:tid 42989] [client 185.193.157.161:47060] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/"] [unique_id "aYHCzmazX4WPS_dQRkhoKwAAAIQ"]
[Tue Feb 03 17:41:34.679072 2026] [:error] [pid 5148:tid 5169] [client 185.193.157.161:47072] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/"] [unique_id "aYHCzr83HCHLtUIbS7KqbAAAAVI"]
[Tue Feb 03 17:41:35.289760 2026] [:error] [pid 42920:tid 42941] [client 185.193.157.161:47084] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/assets/js/"] [unique_id "aYHCzyix3YKltG4EU0lSdwAAAAw"]
[Tue Feb 03 17:41:35.843195 2026] [:error] [pid 5229:tid 5252] [client 185.193.157.161:47090] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/assets/js/"] [unique_id "aYHCz0KmEgmJub93yUqy4wAAAZU"]
[Tue Feb 03 17:41:36.447854 2026] [:error] [pid 28720:tid 28739] [client 185.193.157.161:47106] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/assets/js/"] [unique_id "aYHC0GmRXm2bmr_sYiacYAAAARE"]
[Tue Feb 03 17:41:37.066325 2026] [:error] [pid 42920:tid 42939] [client 185.193.157.161:47112] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/assets/js/"] [unique_id "aYHC0Six3YKltG4EU0lSfgAAAAo"]
[Tue Feb 03 17:41:37.624342 2026] [:error] [pid 28720:tid 28740] [client 185.193.157.161:47120] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/"] [unique_id "aYHC0WmRXm2bmr_sYiacYQAAARI"]
[Tue Feb 03 17:41:38.176188 2026] [:error] [pid 43028:tid 43054] [client 185.193.157.161:47134] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/"] [unique_id "aYHC0lnHWnJD4cJC5Dth2wAAANg"]
[Tue Feb 03 17:41:39.123120 2026] [:error] [pid 5229:tid 5240] [client 185.193.157.161:47140] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/"] [unique_id "aYHC00KmEgmJub93yUqy6gAAAYk"]
[Tue Feb 03 17:41:39.675903 2026] [:error] [pid 5229:tid 5235] [client 185.193.157.161:47142] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/"] [unique_id "aYHC00KmEgmJub93yUqy7AAAAYQ"]
[Tue Feb 03 17:41:40.272622 2026] [:error] [pid 5229:tid 5251] [client 185.193.157.161:55916] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/meta/"] [unique_id "aYHC1EKmEgmJub93yUqy7wAAAZQ"]
[Tue Feb 03 17:41:40.859515 2026] [:error] [pid 43028:tid 43052] [client 185.193.157.161:55918] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/meta/"] [unique_id "aYHC1FnHWnJD4cJC5Dth3gAAANY"]
[Tue Feb 03 17:41:41.411727 2026] [:error] [pid 5148:tid 5151] [client 185.193.157.161:55930] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/meta/"] [unique_id "aYHC1b83HCHLtUIbS7KqcQAAAUA"]
[Tue Feb 03 17:41:41.990064 2026] [:error] [pid 42921:tid 42981] [client 185.193.157.161:55946] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/meta/"] [unique_id "aYHC1YblShffGl-01odGbAAAAFc"]
[Tue Feb 03 17:41:42.542723 2026] [:error] [pid 42921:tid 42960] [client 185.193.157.161:55954] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/"] [unique_id "aYHC1oblShffGl-01odGbgAAAEI"]
[Tue Feb 03 17:41:43.101711 2026] [:error] [pid 28720:tid 28726] [client 185.193.157.161:55968] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/"] [unique_id "aYHC12mRXm2bmr_sYiacaAAAAQQ"]
[Tue Feb 03 17:41:44.655182 2026] [:error] [pid 28720:tid 28742] [client 185.193.157.161:55974] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/"] [unique_id "aYHC2GmRXm2bmr_sYiacbQAAARQ"]
[Tue Feb 03 17:41:45.229134 2026] [:error] [pid 42921:tid 42979] [client 185.193.157.161:55984] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/"] [unique_id "aYHC2YblShffGl-01odGcQAAAFU"]
[Tue Feb 03 17:41:45.795670 2026] [:error] [pid 43028:tid 43051] [client 185.193.157.161:55996] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/"] [unique_id "aYHC2VnHWnJD4cJC5Dth5QAAANU"]
[Tue Feb 03 17:41:46.348459 2026] [:error] [pid 42920:tid 42952] [client 185.193.157.161:56000] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/"] [unique_id "aYHC2iix3YKltG4EU0lSgwAAABc"]
[Tue Feb 03 17:41:46.900495 2026] [:error] [pid 42922:tid 42989] [client 185.193.157.161:56012] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/"] [unique_id "aYHC2mazX4WPS_dQRkhoMwAAAIQ"]
[Tue Feb 03 17:41:47.462398 2026] [:error] [pid 42921:tid 42976] [client 185.193.157.161:56022] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/"] [unique_id "aYHC24blShffGl-01odGewAAAFI"]
[Tue Feb 03 17:41:48.015511 2026] [:error] [pid 5229:tid 5239] [client 185.193.157.161:56038] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aYHC3EKmEgmJub93yUqy9QAAAYg"]
[Tue Feb 03 17:41:48.568608 2026] [:error] [pid 42920:tid 42949] [client 185.193.157.161:56040] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aYHC3Cix3YKltG4EU0lSjAAAABQ"]
[Tue Feb 03 17:41:49.168248 2026] [:error] [pid 42921:tid 42974] [client 185.193.157.161:56042] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aYHC3YblShffGl-01odGfAAAAFA"]
[Tue Feb 03 17:41:49.721758 2026] [:error] [pid 42920:tid 42937] [client 185.193.157.161:56058] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aYHC3Six3YKltG4EU0lSjgAAAAg"]
[Tue Feb 03 17:41:50.569124 2026] [:error] [pid 28720:tid 28732] [client 185.193.157.161:33206] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/"] [unique_id "aYHC3mmRXm2bmr_sYiacgQAAAQo"]
[Tue Feb 03 17:41:51.122021 2026] [:error] [pid 5229:tid 5244] [client 185.193.157.161:33220] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/"] [unique_id "aYHC30KmEgmJub93yUqy-gAAAY0"]
[Tue Feb 03 17:41:51.673420 2026] [:error] [pid 5148:tid 5153] [client 185.193.157.161:33224] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/"] [unique_id "aYHC3783HCHLtUIbS7KqdwAAAUI"]
[Tue Feb 03 17:41:52.228336 2026] [:error] [pid 42922:tid 43009] [client 185.193.157.161:33232] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/"] [unique_id "aYHC4GazX4WPS_dQRkhoNwAAAJg"]
[Tue Feb 03 17:41:52.793042 2026] [:error] [pid 28720:tid 28743] [client 185.193.157.161:33242] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/"] [unique_id "aYHC4GmRXm2bmr_sYiacgwAAARU"]
[Tue Feb 03 17:41:53.346526 2026] [:error] [pid 5148:tid 5151] [client 185.193.157.161:33246] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/"] [unique_id "aYHC4b83HCHLtUIbS7KqewAAAUA"]
[Tue Feb 03 17:41:53.899075 2026] [:error] [pid 42921:tid 42969] [client 185.193.157.161:33260] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/"] [unique_id "aYHC4YblShffGl-01odGgAAAAEs"]
[Tue Feb 03 17:41:54.508180 2026] [:error] [pid 43028:tid 43051] [client 185.193.157.161:33268] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/"] [unique_id "aYHC4lnHWnJD4cJC5Dth7QAAANU"]
[Tue Feb 03 17:41:55.072704 2026] [:error] [pid 42921:tid 42960] [client 185.193.157.161:33270] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/"] [unique_id "aYHC44blShffGl-01odGhQAAAEI"]
[Tue Feb 03 17:41:55.626274 2026] [:error] [pid 5148:tid 5160] [client 185.193.157.161:33282] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/"] [unique_id "aYHC4783HCHLtUIbS7KqgQAAAUk"]
[Tue Feb 03 17:41:56.270555 2026] [:error] [pid 42921:tid 42980] [client 185.193.157.161:33298] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/"] [unique_id "aYHC5IblShffGl-01odGhwAAAFY"]
[Tue Feb 03 17:41:56.823102 2026] [:error] [pid 5148:tid 5174] [client 185.193.157.161:33304] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/"] [unique_id "aYHC5L83HCHLtUIbS7KqhgAAAVc"]
[Tue Feb 03 17:41:57.447205 2026] [:error] [pid 42921:tid 42971] [client 185.193.157.161:33320] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "aYHC5YblShffGl-01odGiQAAAE0"]
[Tue Feb 03 17:41:58.056972 2026] [:error] [pid 28720:tid 28733] [client 185.193.157.161:33330] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "aYHC5mmRXm2bmr_sYiachQAAAQs"]
[Tue Feb 03 17:41:58.610540 2026] [:error] [pid 43028:tid 43040] [client 185.193.157.161:33344] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "aYHC5lnHWnJD4cJC5Dth9AAAAMo"]
[Tue Feb 03 17:41:59.463760 2026] [:error] [pid 5229:tid 5231] [client 185.193.157.161:33348] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "aYHC50KmEgmJub93yUqy_wAAAYA"]
[Tue Feb 03 17:42:00.031188 2026] [:error] [pid 5229:tid 5251] [client 185.193.157.161:33356] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/"] [unique_id "aYHC6EKmEgmJub93yUqzAQAAAZQ"]
[Tue Feb 03 17:42:00.591159 2026] [:error] [pid 5229:tid 5246] [client 185.193.157.161:60086] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/"] [unique_id "aYHC6EKmEgmJub93yUqzBAAAAY8"]
[Tue Feb 03 17:42:01.187306 2026] [:error] [pid 43028:tid 43034] [client 185.193.157.161:60092] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/"] [unique_id "aYHC6VnHWnJD4cJC5Dth9QAAAMQ"]
[Tue Feb 03 17:42:01.740143 2026] [:error] [pid 42922:tid 42989] [client 185.193.157.161:60108] [client 185.193.157.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/"] [unique_id "aYHC6WazX4WPS_dQRkhoPwAAAIQ"]
[Tue Feb 03 18:12:14.275301 2026] [:error] [pid 43028:tid 43034] [client 134.122.71.153:47760] [client 134.122.71.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.122.71.153, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYHJ_lnHWnJD4cJC5DtpwwAAAMQ"]
[Tue Feb 03 19:29:25.442777 2026] [:error] [pid 42921:tid 42964] [client 103.65.236.149:53471] [client 103.65.236.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aYHcFYblShffGl-01odhiAAAAEY"]
[Tue Feb 03 19:29:25.794521 2026] [:error] [pid 5148:tid 5162] [client 103.65.236.149:53508] [client 103.65.236.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aYHcFb83HCHLtUIbS7LMgAAAAUs"]
[Tue Feb 03 20:31:02.693521 2026] [autoindex:error] [pid 42922:tid 42986] [client 52.253.119.74:21073] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 20:31:10.754697 2026] [:error] [pid 42922:tid 42989] [client 52.253.119.74:21073] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x56.php"] [unique_id "aYHqjmazX4WPS_dQRkiTMAAAAIQ"]
[Tue Feb 03 20:31:22.814878 2026] [:error] [pid 42920:tid 42929] [client 52.253.119.74:29260] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x56.php"] [unique_id "aYHqmiix3YKltG4EU0l8ngAAAAA"]
[Tue Feb 03 20:31:47.125774 2026] [:error] [pid 43028:tid 43040] [client 52.253.119.74:22563] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "aYHqs1nHWnJD4cJC5DubCQAAAMo"]
[Tue Feb 03 20:31:49.558776 2026] [:error] [pid 42922:tid 42997] [client 52.253.119.74:25631] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "aYHqtWazX4WPS_dQRkiTbQAAAIw"]
[Tue Feb 03 20:31:51.506807 2026] [:error] [pid 5229:tid 5237] [client 52.253.119.74:22581] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "aYHqt0KmEgmJub93yUryjwAAAYY"]
[Tue Feb 03 20:33:09.227037 2026] [:error] [pid 43028:tid 43030] [client 52.253.119.74:30982] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aYHrBVnHWnJD4cJC5Dub4AAAAMA"]
[Tue Feb 03 20:33:09.921086 2026] [:error] [pid 42921:tid 42958] [client 52.253.119.74:17658] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aYHrBYblShffGl-01odyNgAAAEA"]
[Tue Feb 03 20:33:51.306337 2026] [:error] [pid 43028:tid 43032] [client 52.253.119.74:19065] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aYHrL1nHWnJD4cJC5DucUQAAAMI"]
[Tue Feb 03 20:33:53.075506 2026] [:error] [pid 42920:tid 42937] [client 52.253.119.74:12089] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aYHrMSix3YKltG4EU0l9fAAAAAg"]
[Tue Feb 03 20:34:00.936335 2026] [:error] [pid 42920:tid 42952] [client 52.253.119.74:23447] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aYHrOCix3YKltG4EU0l9iwAAABc"]
[Tue Feb 03 20:34:15.305674 2026] [:error] [pid 42921:tid 42977] [client 52.253.119.74:25214] [client 52.253.119.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aYHrR4blShffGl-01odylwAAAFM"]
[Tue Feb 03 20:34:22.281682 2026] [:error] [pid 5229:tid 5250] [client 52.253.119.74:23449] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aYHrTkKmEgmJub93yUrzngAAAZM"]
[Tue Feb 03 20:34:23.420844 2026] [:error] [pid 28720:tid 28741] [client 52.253.119.74:19051] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aYHrT2mRXm2bmr_sYibJ8wAAARM"]
[Tue Feb 03 20:34:29.023205 2026] [:error] [pid 5148:tid 5156] [client 52.253.119.74:13591] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aYHrVb83HCHLtUIbS7LfkAAAAUU"]
[Tue Feb 03 20:34:34.720360 2026] [:error] [pid 43028:tid 43032] [client 52.253.119.74:13571] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aYHrWlnHWnJD4cJC5Duc0wAAAMI"]
[Tue Feb 03 20:34:37.509929 2026] [:error] [pid 28720:tid 28723] [client 52.253.119.74:14250] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aYHrXWmRXm2bmr_sYibKBAAAAQE"]
[Tue Feb 03 20:34:48.423156 2026] [:error] [pid 5229:tid 5248] [client 52.253.119.74:23435] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aYHraEKmEgmJub93yUrzyQAAAZE"]
[Tue Feb 03 20:34:50.177978 2026] [:error] [pid 42922:tid 42991] [client 52.253.119.74:19009] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aYHramazX4WPS_dQRkiUqgAAAIY"]
[Tue Feb 03 20:34:52.525121 2026] [:error] [pid 42922:tid 42994] [client 52.253.119.74:14235] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aYHrbGazX4WPS_dQRkiUsQAAAIk"]
[Tue Feb 03 20:34:55.450808 2026] [:error] [pid 5148:tid 5163] [client 52.253.119.74:27222] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aYHrb783HCHLtUIbS7LfwgAAAUw"]
[Tue Feb 03 20:35:11.456232 2026] [:error] [pid 5148:tid 5161] [client 52.253.119.74:15141] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aYHrf783HCHLtUIbS7Lf3QAAAUo"]
[Tue Feb 03 20:35:13.948009 2026] [:error] [pid 28720:tid 28723] [client 52.253.119.74:20594] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aYHrgWmRXm2bmr_sYibKLAAAAQE"]
[Tue Feb 03 20:35:18.383230 2026] [:error] [pid 42922:tid 42989] [client 52.253.119.74:18589] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aYHrhmazX4WPS_dQRkiU5gAAAIQ"]
[Tue Feb 03 20:35:34.558619 2026] [:error] [pid 5229:tid 5235] [client 52.253.119.74:20603] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aYHrlkKmEgmJub93yUr0XgAAAYQ"]
[Tue Feb 03 20:36:04.005260 2026] [:error] [pid 43028:tid 43033] [client 52.253.119.74:26198] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aYHrtFnHWnJD4cJC5Dud6QAAAMM"]
[Tue Feb 03 20:36:08.322983 2026] [:error] [pid 5148:tid 5161] [client 52.253.119.74:24410] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aYHruL83HCHLtUIbS7LgTAAAAUo"]
[Tue Feb 03 20:36:11.157893 2026] [:error] [pid 43028:tid 43043] [client 52.253.119.74:27525] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aYHru1nHWnJD4cJC5Dud9AAAAM0"]
[Tue Feb 03 20:36:13.090165 2026] [:error] [pid 5148:tid 5172] [client 52.253.119.74:25692] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aYHrvb83HCHLtUIbS7LgUAAAAVU"]
[Tue Feb 03 20:37:40.329696 2026] [:error] [pid 5148:tid 5172] [client 52.253.119.74:4818] [client 52.253.119.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.253.119.74, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYHsFL83HCHLtUIbS7LgzAAAAVU"]
[Tue Feb 03 20:37:50.309124 2026] [:error] [pid 42922:tid 43008] [client 52.253.119.74:4800] [client 52.253.119.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.253.119.74, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYHsHmazX4WPS_dQRkiWGQAAAJc"]
[Tue Feb 03 20:37:51.899879 2026] [:error] [pid 43028:tid 43042] [client 52.253.119.74:30978] [client 52.253.119.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aYHsH1nHWnJD4cJC5DuejwAAAMw"]
[Tue Feb 03 20:38:00.502853 2026] [:error] [pid 43028:tid 43032] [client 52.253.119.74:4827] [client 52.253.119.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aYHsKFnHWnJD4cJC5DuenQAAAMI"]
[Tue Feb 03 20:38:10.786665 2026] [:error] [pid 42921:tid 42964] [client 52.253.119.74:22548] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filemanager/dialog.php"] [unique_id "aYHsMoblShffGl-01odz0QAAAEY"]
[Tue Feb 03 20:38:17.025769 2026] [:error] [pid 28720:tid 28744] [client 52.253.119.74:25660] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filemanager/dialog.php"] [unique_id "aYHsOWmRXm2bmr_sYibLNQAAARY"]
[Tue Feb 03 20:38:22.630043 2026] [:error] [pid 43028:tid 43036] [client 52.253.119.74:18134] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filemanager/dialog.php"] [unique_id "aYHsPlnHWnJD4cJC5DuexwAAAMY"]
[Tue Feb 03 20:38:29.271750 2026] [:error] [pid 5229:tid 5255] [client 52.253.119.74:18157] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aYHsRUKmEgmJub93yUr1XgAAAZg"]
[Tue Feb 03 20:38:33.692332 2026] [:error] [pid 42921:tid 42968] [client 52.253.119.74:18147] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aYHsSYblShffGl-01odz8wAAAEo"]
[Tue Feb 03 20:38:35.102938 2026] [:error] [pid 43028:tid 43039] [client 52.253.119.74:15169] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aYHsS1nHWnJD4cJC5Due2gAAAMk"]
[Tue Feb 03 20:38:36.399309 2026] [:error] [pid 5229:tid 5242] [client 52.253.119.74:14239] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aYHsTEKmEgmJub93yUr1ZwAAAYs"]
[Tue Feb 03 20:38:45.721445 2026] [:error] [pid 42921:tid 42972] [client 52.253.119.74:31033] [client 52.253.119.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aYHsVYblShffGl-01od0AgAAAE4"]
[Tue Feb 03 20:38:48.183899 2026] [:error] [pid 5229:tid 5253] [client 52.253.119.74:14252] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "aYHsWEKmEgmJub93yUr1dwAAAZY"]
[Tue Feb 03 20:38:49.101918 2026] [:error] [pid 42920:tid 42953] [client 52.253.119.74:30382] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "aYHsWSix3YKltG4EU0l_AAAAABg"]
[Tue Feb 03 20:38:54.324354 2026] [:error] [pid 42920:tid 42948] [client 52.253.119.74:22650] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "aYHsXiix3YKltG4EU0l_AwAAABM"]
[Tue Feb 03 20:38:55.338086 2026] [:error] [pid 42922:tid 42999] [client 52.253.119.74:31006] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/autoload_classmap.php"] [unique_id "aYHsX2azX4WPS_dQRkiWZAAAAI4"]
[Tue Feb 03 20:38:56.550137 2026] [:error] [pid 5229:tid 5242] [client 52.253.119.74:29352] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/autoload_classmap.php"] [unique_id "aYHsYEKmEgmJub93yUr1igAAAYs"]
[Tue Feb 03 20:38:59.519233 2026] [:error] [pid 28720:tid 28727] [client 52.253.119.74:12091] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/autoload_classmap.php"] [unique_id "aYHsY2mRXm2bmr_sYibLcgAAAQU"]
[Tue Feb 03 20:39:01.711633 2026] [:error] [pid 43028:tid 43053] [client 52.253.119.74:30997] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/autoload_classmap.php"] [unique_id "aYHsZVnHWnJD4cJC5DufAgAAANc"]
[Tue Feb 03 20:39:04.131974 2026] [:error] [pid 43028:tid 43043] [client 52.253.119.74:13571] [client 52.253.119.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aYHsaFnHWnJD4cJC5DufCAAAAM0"]
[Tue Feb 03 20:39:08.014523 2026] [:error] [pid 43028:tid 43033] [client 52.253.119.74:23433] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww1.php"] [unique_id "aYHsbFnHWnJD4cJC5DufDgAAAMM"]
[Tue Feb 03 20:39:11.880201 2026] [proxy_fcgi:error] [pid 42920:tid 42939] [client 52.253.119.74:12037] AH01071: Got error 'Primary script unknown'
[Tue Feb 03 20:39:17.325864 2026] [:error] [pid 42920:tid 42937] [client 52.253.119.74:22050] [client 52.253.119.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.253.119.74, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYHsdSix3YKltG4EU0l_LQAAAAg"]
[Tue Feb 03 20:39:18.565844 2026] [autoindex:error] [pid 42920:tid 42941] [client 52.253.119.74:12037] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 20:39:19.502263 2026] [:error] [pid 42920:tid 42931] [client 52.253.119.74:12037] [client 52.253.119.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aYHsdyix3YKltG4EU0l_MgAAAAI"]
[Tue Feb 03 20:39:28.061160 2026] [autoindex:error] [pid 42921:tid 42962] [client 52.253.119.74:17654] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 20:39:30.658371 2026] [:error] [pid 42921:tid 42968] [client 52.253.119.74:17654] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aYHsgoblShffGl-01od0LAAAAEo"]
[Tue Feb 03 20:39:33.316911 2026] [:error] [pid 5148:tid 5154] [client 52.253.119.74:23430] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aYHshb83HCHLtUIbS7LhTwAAAUM"]
[Tue Feb 03 20:39:50.523107 2026] [:error] [pid 43028:tid 43039] [client 52.253.119.74:22632] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/log.php"] [unique_id "aYHsllnHWnJD4cJC5DufYgAAAMk"]
[Tue Feb 03 20:40:15.160960 2026] [:error] [pid 43028:tid 43041] [client 52.253.119.74:23446] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aYHsr1nHWnJD4cJC5DufvAAAAMs"]
[Tue Feb 03 20:40:17.093510 2026] [:error] [pid 42922:tid 42998] [client 52.253.119.74:19054] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aYHssWazX4WPS_dQRkiWtQAAAI0"]
[Tue Feb 03 20:40:18.241329 2026] [:error] [pid 43028:tid 43040] [client 52.253.119.74:19053] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aYHsslnHWnJD4cJC5DufwwAAAMo"]
[Tue Feb 03 20:40:23.614912 2026] [:error] [pid 43028:tid 43042] [client 52.253.119.74:12047] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aYHst1nHWnJD4cJC5Duf0AAAAMw"]
[Tue Feb 03 20:40:26.958215 2026] [:error] [pid 28720:tid 28734] [client 52.253.119.74:23480] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless5.php"] [unique_id "aYHsummRXm2bmr_sYibLygAAAQw"]
[Tue Feb 03 20:40:31.337470 2026] [:error] [pid 42920:tid 42934] [client 52.253.119.74:24427] [client 52.253.119.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aYHsvyix3YKltG4EU0l_gAAAAAU"]
[Tue Feb 03 20:40:32.184690 2026] [:error] [pid 42922:tid 43002] [client 52.253.119.74:24439] [client 52.253.119.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aYHswGazX4WPS_dQRkiWzwAAAJE"]
[Tue Feb 03 20:40:43.251598 2026] [:error] [pid 43028:tid 43045] [client 52.253.119.74:12050] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aYHsy1nHWnJD4cJC5DugAQAAAM8"]
[Tue Feb 03 20:40:44.688083 2026] [:error] [pid 43028:tid 43048] [client 52.253.119.74:22069] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aYHszFnHWnJD4cJC5DugBwAAANI"]
[Tue Feb 03 20:40:47.675746 2026] [:error] [pid 43028:tid 43030] [client 52.253.119.74:12086] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aYHsz1nHWnJD4cJC5DugCgAAAMA"]
[Tue Feb 03 20:40:53.037923 2026] [:error] [pid 42920:tid 42933] [client 52.253.119.74:13585] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aYHs1Six3YKltG4EU0l_kgAAAAQ"]
[Tue Feb 03 20:40:54.209516 2026] [:error] [pid 28720:tid 28724] [client 52.253.119.74:35201] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aYHs1mmRXm2bmr_sYibL6QAAAQI"]
[Tue Feb 03 20:40:56.027687 2026] [:error] [pid 28720:tid 28731] [client 52.253.119.74:12103] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aYHs2GmRXm2bmr_sYibL7QAAAQk"]
[Tue Feb 03 20:40:57.337599 2026] [:error] [pid 43028:tid 43030] [client 52.253.119.74:19530] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aYHs2VnHWnJD4cJC5DugHgAAAMA"]
[Tue Feb 03 20:40:58.891766 2026] [:error] [pid 28720:tid 28746] [client 52.253.119.74:23441] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aYHs2mmRXm2bmr_sYibL9AAAARg"]
[Tue Feb 03 20:41:01.056946 2026] [:error] [pid 28720:tid 28726] [client 52.253.119.74:22617] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aYHs3WmRXm2bmr_sYibL9wAAAQQ"]
[Tue Feb 03 20:41:05.202687 2026] [:error] [pid 5229:tid 5251] [client 52.253.119.74:12129] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aYHs4UKmEgmJub93yUr2IQAAAZQ"]
[Tue Feb 03 20:41:27.783609 2026] [:error] [pid 28720:tid 28726] [client 52.253.119.74:13160] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2clas.php"] [unique_id "aYHs92mRXm2bmr_sYibMFAAAAQQ"]
[Tue Feb 03 20:41:55.040947 2026] [:error] [pid 42920:tid 42952] [client 52.253.119.74:12134] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aYHtEyix3YKltG4EU0l_0AAAABc"]
[Tue Feb 03 20:41:57.197099 2026] [:error] [pid 5148:tid 5169] [client 52.253.119.74:13140] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aYHtFb83HCHLtUIbS7LiDgAAAVI"]
[Tue Feb 03 20:41:58.345881 2026] [:error] [pid 42920:tid 42936] [client 52.253.119.74:17632] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aYHtFiix3YKltG4EU0l_0QAAAAc"]
[Tue Feb 03 20:42:00.235343 2026] [:error] [pid 5229:tid 5253] [client 52.253.119.74:13572] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aYHtGEKmEgmJub93yUr2cAAAAZY"]
[Tue Feb 03 20:42:02.022715 2026] [:error] [pid 28720:tid 28742] [client 52.253.119.74:25149] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aYHtGmmRXm2bmr_sYibMOAAAARQ"]
[Tue Feb 03 20:42:05.705946 2026] [:error] [pid 28720:tid 28740] [client 52.253.119.74:12123] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aYHtHWmRXm2bmr_sYibMPgAAARI"]
[Tue Feb 03 20:42:06.656025 2026] [:error] [pid 5229:tid 5252] [client 52.253.119.74:25191] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aYHtHkKmEgmJub93yUr2dgAAAZU"]
[Tue Feb 03 20:42:12.908653 2026] [:error] [pid 43028:tid 43044] [client 52.253.119.74:35232] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aYHtJFnHWnJD4cJC5DugmgAAAM4"]
[Tue Feb 03 20:42:16.162764 2026] [:error] [pid 42920:tid 42934] [client 52.253.119.74:13600] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aYHtKCix3YKltG4EU0l_3wAAAAU"]
[Tue Feb 03 20:42:17.387422 2026] [:error] [pid 42920:tid 42933] [client 52.253.119.74:25162] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aYHtKSix3YKltG4EU0l_4gAAAAQ"]
[Tue Feb 03 20:42:38.900289 2026] [:error] [pid 42920:tid 42930] [client 52.253.119.74:18067] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "aYHtPiix3YKltG4EU0l_9AAAAAE"]
[Tue Feb 03 20:42:40.914433 2026] [:error] [pid 42921:tid 42977] [client 52.253.119.74:18606] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "aYHtQIblShffGl-01od0zQAAAFM"]
[Tue Feb 03 20:42:41.771769 2026] [:error] [pid 42920:tid 42943] [client 52.253.119.74:17607] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "aYHtQSix3YKltG4EU0l_-QAAAA4"]
[Tue Feb 03 20:42:44.448170 2026] [:error] [pid 5229:tid 5253] [client 52.253.119.74:4693] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "aYHtREKmEgmJub93yUr2oAAAAZY"]
[Tue Feb 03 20:42:45.202627 2026] [:error] [pid 5148:tid 5159] [client 52.253.119.74:17613] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "aYHtRb83HCHLtUIbS7LiTgAAAUg"]
[Tue Feb 03 20:42:48.377188 2026] [:error] [pid 5148:tid 5152] [client 52.253.119.74:12666] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "aYHtSL83HCHLtUIbS7LiUQAAAUE"]
[Tue Feb 03 20:42:49.729618 2026] [:error] [pid 43028:tid 43041] [client 52.253.119.74:4238] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "aYHtSVnHWnJD4cJC5Dug2AAAAMs"]
[Tue Feb 03 20:42:51.671102 2026] [:error] [pid 28720:tid 28725] [client 52.253.119.74:19531] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aYHtS2mRXm2bmr_sYibMYgAAAQM"]
[Tue Feb 03 20:43:17.545935 2026] [:error] [pid 28720:tid 28739] [client 52.253.119.74:18085] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aYHtZWmRXm2bmr_sYibMhQAAARE"]
[Tue Feb 03 20:43:18.834006 2026] [:error] [pid 28720:tid 28740] [client 52.253.119.74:13127] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aYHtZmmRXm2bmr_sYibMhwAAARI"]
[Tue Feb 03 20:43:19.964605 2026] [:error] [pid 28720:tid 28730] [client 52.253.119.74:25090] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aYHtZ2mRXm2bmr_sYibMjQAAAQg"]
[Tue Feb 03 20:43:21.492930 2026] [:error] [pid 43028:tid 43046] [client 52.253.119.74:21546] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aYHtaVnHWnJD4cJC5DuhDwAAANA"]
[Tue Feb 03 20:43:28.920613 2026] [:error] [pid 42921:tid 42982] [client 52.253.119.74:12148] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ova.php"] [unique_id "aYHtcIblShffGl-01od1HwAAAFg"]
[Tue Feb 03 20:43:30.921580 2026] [:error] [pid 42920:tid 42938] [client 52.253.119.74:13650] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ova.php"] [unique_id "aYHtciix3YKltG4EU0mAHwAAAAk"]
[Tue Feb 03 20:43:42.060750 2026] [:error] [pid 42920:tid 42946] [client 52.253.119.74:23037] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aYHtfiix3YKltG4EU0mAKwAAABE"]
[Tue Feb 03 20:43:44.289485 2026] [:error] [pid 42922:tid 43004] [client 182.42.111.156:34682] [client 182.42.111.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYHtgGazX4WPS_dQRkiXlAAAAJM"]
[Tue Feb 03 20:43:58.193988 2026] [:error] [pid 28720:tid 28746] [client 52.253.119.74:13578] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aYHtjmmRXm2bmr_sYibMpQAAARg"]
[Tue Feb 03 20:44:07.430975 2026] [:error] [pid 42922:tid 42988] [client 52.253.119.74:20997] [client 52.253.119.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aYHtl2azX4WPS_dQRkiXrQAAAIM"]
[Tue Feb 03 21:20:39.173007 2026] [autoindex:error] [pid 5229:tid 5244] [client 104.208.91.171:12130] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/thickbox/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 21:20:41.500792 2026] [autoindex:error] [pid 5229:tid 5247] [client 104.208.91.171:12130] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 21:20:43.055025 2026] [:error] [pid 5229:tid 5234] [client 104.208.91.171:12130] [client 104.208.91.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/"] [unique_id "aYH2K0KmEgmJub93yUoDEAAAAYM"]
[Tue Feb 03 21:20:43.529924 2026] [:error] [pid 28720:tid 28743] [client 104.208.91.171:7177] [client 104.208.91.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/"] [unique_id "aYH2K2mRXm2bmr_sYibViwAAARU"]
[Tue Feb 03 21:20:44.007225 2026] [:error] [pid 43028:tid 43054] [client 104.208.91.171:7224] [client 104.208.91.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/"] [unique_id "aYH2LFnHWnJD4cJC5Duv1gAAANg"]
[Tue Feb 03 21:20:44.480039 2026] [:error] [pid 5229:tid 5248] [client 104.208.91.171:14290] [client 104.208.91.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/"] [unique_id "aYH2LEKmEgmJub93yUoDFQAAAZE"]
[Tue Feb 03 22:17:02.341689 2026] [:error] [pid 5229:tid 5234] [client 98.96.235.67:10101] [client 98.96.235.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYIDXkKmEgmJub93yUoXmQAAAYM"]
[Tue Feb 03 22:50:39.229577 2026] [autoindex:error] [pid 42922:tid 43003] [client 20.205.110.134:35679] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 22:50:46.891519 2026] [:error] [pid 42922:tid 43007] [client 20.205.110.134:35679] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x56.php"] [unique_id "aYILRmazX4WPS_dQRki6RgAAAJY"]
[Tue Feb 03 22:50:48.605565 2026] [:error] [pid 28720:tid 28736] [client 20.205.110.134:7325] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x56.php"] [unique_id "aYILSGmRXm2bmr_sYibu8QAAAQ4"]
[Tue Feb 03 22:51:04.128432 2026] [:error] [pid 43028:tid 43046] [client 20.205.110.134:42273] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "aYILWFnHWnJD4cJC5DvXjQAAANA"]
[Tue Feb 03 22:51:05.960489 2026] [:error] [pid 5148:tid 5170] [client 20.205.110.134:43094] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "aYILWb83HCHLtUIbS7IIpAAAAVM"]
[Tue Feb 03 22:51:12.007383 2026] [:error] [pid 43028:tid 43044] [client 20.205.110.134:20822] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "aYILYFnHWnJD4cJC5DvXrgAAAM4"]
[Tue Feb 03 22:51:12.881607 2026] [:error] [pid 43028:tid 43047] [client 20.205.110.134:16315] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "aYILYFnHWnJD4cJC5DvXtAAAANE"]
[Tue Feb 03 22:51:17.884854 2026] [:error] [pid 5229:tid 5255] [client 20.205.110.134:43126] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aYILZUKmEgmJub93yUokLwAAAZg"]
[Tue Feb 03 22:51:18.873751 2026] [:error] [pid 5229:tid 5241] [client 20.205.110.134:3303] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aYILZkKmEgmJub93yUokMQAAAYo"]
[Tue Feb 03 22:51:19.578205 2026] [:error] [pid 43028:tid 43041] [client 20.205.110.134:3304] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aYILZ1nHWnJD4cJC5DvXyQAAAMs"]
[Tue Feb 03 22:51:20.817310 2026] [:error] [pid 43028:tid 43054] [client 20.205.110.134:42462] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aYILaFnHWnJD4cJC5DvXzQAAANg"]
[Tue Feb 03 22:51:28.258239 2026] [:error] [pid 42921:tid 42970] [client 20.205.110.134:42488] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x50.php"] [unique_id "aYILcIblShffGl-01oeXTwAAAEw"]
[Tue Feb 03 22:51:32.083908 2026] [:error] [pid 5229:tid 5237] [client 20.205.110.134:20808] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x50.php"] [unique_id "aYILdEKmEgmJub93yUokRQAAAYY"]
[Tue Feb 03 22:51:34.585978 2026] [:error] [pid 42922:tid 42985] [client 20.205.110.134:42249] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x50.php"] [unique_id "aYILdmazX4WPS_dQRki6eAAAAIA"]
[Tue Feb 03 22:51:44.264072 2026] [:error] [pid 43028:tid 43050] [client 20.205.110.134:20862] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aYILgFnHWnJD4cJC5DvX-AAAANQ"]
[Tue Feb 03 22:51:44.741447 2026] [:error] [pid 42922:tid 43006] [client 20.205.110.134:20826] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aYILgGazX4WPS_dQRki6iwAAAJU"]
[Tue Feb 03 22:51:45.530749 2026] [:error] [pid 42922:tid 43002] [client 20.205.110.134:3300] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aYILgWazX4WPS_dQRki6jgAAAJE"]
[Tue Feb 03 22:51:56.837486 2026] [:error] [pid 5229:tid 5231] [client 20.205.110.134:42246] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aYILjEKmEgmJub93yUokaQAAAYA"]
[Tue Feb 03 22:52:01.838860 2026] [:error] [pid 43028:tid 43035] [client 20.205.110.134:42255] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aYILkVnHWnJD4cJC5DvYGgAAAMU"]
[Tue Feb 03 22:52:04.488705 2026] [:error] [pid 42921:tid 42969] [client 20.205.110.134:43110] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aYILlIblShffGl-01oeXhAAAAEs"]
[Tue Feb 03 22:52:26.719086 2026] [:error] [pid 42921:tid 42961] [client 20.205.110.134:43091] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aYILqoblShffGl-01oeXsgAAAEM"]
[Tue Feb 03 22:52:43.813298 2026] [:error] [pid 43028:tid 43049] [client 20.205.110.134:44494] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aYILu1nHWnJD4cJC5DvYhgAAANM"]
[Tue Feb 03 22:52:46.816779 2026] [:error] [pid 28720:tid 28744] [client 20.205.110.134:42320] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aYILvmmRXm2bmr_sYibviQAAARY"]
[Tue Feb 03 22:52:50.145584 2026] [:error] [pid 42921:tid 42981] [client 20.205.110.134:18089] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aYILwoblShffGl-01oeXyQAAAFc"]
[Tue Feb 03 22:52:53.787607 2026] [:error] [pid 43028:tid 43045] [client 20.205.110.134:3990] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aYILxVnHWnJD4cJC5DvYmgAAAM8"]
[Tue Feb 03 22:52:54.644678 2026] [:error] [pid 5229:tid 5249] [client 20.205.110.134:31954] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aYILxkKmEgmJub93yUok3QAAAZI"]
[Tue Feb 03 22:53:06.013566 2026] [:error] [pid 42921:tid 42980] [client 20.205.110.134:15904] [client 20.205.110.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aYIL0oblShffGl-01oeX1wAAAFY"]
[Tue Feb 03 22:53:14.600727 2026] [:error] [pid 42920:tid 42948] [client 20.205.110.134:3888] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aYIL2iix3YKltG4EU0mjcwAAABM"]
[Tue Feb 03 22:53:19.400138 2026] [:error] [pid 42920:tid 42949] [client 20.205.110.134:23524] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aYIL3yix3YKltG4EU0mjjAAAABQ"]
[Tue Feb 03 22:53:21.635138 2026] [:error] [pid 42922:tid 42993] [client 20.205.110.134:42885] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aYIL4WazX4WPS_dQRki7BgAAAIg"]
[Tue Feb 03 22:53:24.533384 2026] [:error] [pid 42922:tid 42992] [client 20.205.110.134:28256] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aYIL5GazX4WPS_dQRki7CgAAAIc"]
[Tue Feb 03 22:53:25.517236 2026] [:error] [pid 42920:tid 42930] [client 20.205.110.134:23828] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aYIL5Six3YKltG4EU0mjsAAAAAE"]
[Tue Feb 03 22:53:30.549964 2026] [:error] [pid 42922:tid 42991] [client 20.205.110.134:24529] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aYIL6mazX4WPS_dQRki7EQAAAIY"]
[Tue Feb 03 22:53:38.282293 2026] [:error] [pid 42920:tid 42930] [client 20.205.110.134:24513] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aYIL8iix3YKltG4EU0mj5wAAAAE"]
[Tue Feb 03 22:53:42.058642 2026] [:error] [pid 42921:tid 42964] [client 20.205.110.134:43659] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aYIL9oblShffGl-01oeYDAAAAEY"]
[Tue Feb 03 22:53:43.678001 2026] [:error] [pid 43028:tid 43036] [client 20.205.110.134:24085] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aYIL91nHWnJD4cJC5DvY_gAAAMY"]
[Tue Feb 03 22:53:44.068884 2026] [:error] [pid 5148:tid 5158] [client 20.205.110.134:32235] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aYIL-L83HCHLtUIbS7IJfwAAAUc"]
[Tue Feb 03 22:53:46.019007 2026] [:error] [pid 43028:tid 43045] [client 20.205.110.134:24094] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aYIL-lnHWnJD4cJC5DvZBAAAAM8"]
[Tue Feb 03 22:53:53.389661 2026] [:error] [pid 43028:tid 43032] [client 20.205.110.134:43697] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aYIMAVnHWnJD4cJC5DvZHgAAAMI"]
[Tue Feb 03 22:54:41.857078 2026] [:error] [pid 5229:tid 5234] [client 20.205.110.134:43664] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aYIMMUKmEgmJub93yUolsgAAAYM"]
[Tue Feb 03 22:54:43.473462 2026] [:error] [pid 5148:tid 5167] [client 20.205.110.134:22785] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aYIMM783HCHLtUIbS7IJ2gAAAVA"]
[Tue Feb 03 22:54:45.212145 2026] [:error] [pid 43028:tid 43042] [client 20.205.110.134:45642] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aYIMNVnHWnJD4cJC5DvZhAAAAMw"]
[Tue Feb 03 22:54:48.813497 2026] [:error] [pid 28720:tid 28737] [client 20.205.110.134:37765] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aYIMOGmRXm2bmr_sYibwlwAAAQ8"]
[Tue Feb 03 22:54:51.080784 2026] [:error] [pid 28720:tid 28726] [client 20.205.110.134:31135] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aYIMO2mRXm2bmr_sYibwmAAAAQQ"]
[Tue Feb 03 22:54:54.454262 2026] [:error] [pid 42922:tid 42993] [client 20.205.110.134:22806] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aYIMPmazX4WPS_dQRki7kQAAAIg"]
[Tue Feb 03 22:54:59.753470 2026] [:error] [pid 5229:tid 5233] [client 20.205.110.134:43707] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aYIMQ0KmEgmJub93yUolzgAAAYI"]
[Tue Feb 03 22:55:02.600448 2026] [:error] [pid 5229:tid 5243] [client 20.205.110.134:22818] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aYIMRkKmEgmJub93yUol0QAAAYw"]
[Tue Feb 03 22:55:08.468111 2026] [:error] [pid 43028:tid 43043] [client 20.205.110.134:17540] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aYIMTFnHWnJD4cJC5DvZqQAAAM0"]
[Tue Feb 03 22:55:10.553117 2026] [:error] [pid 43028:tid 43035] [client 20.205.110.134:27397] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aYIMTlnHWnJD4cJC5DvZrAAAAMU"]
[Tue Feb 03 22:55:11.247930 2026] [:error] [pid 5229:tid 5253] [client 20.205.110.134:7312] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aYIMT0KmEgmJub93yUol1wAAAZY"]
[Tue Feb 03 22:55:12.977346 2026] [:error] [pid 5229:tid 5236] [client 20.205.110.134:43873] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aYIMUEKmEgmJub93yUol2wAAAYU"]
[Tue Feb 03 22:55:27.697575 2026] [:error] [pid 42921:tid 42982] [client 20.205.110.134:17541] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aYIMX4blShffGl-01oeYgAAAAFg"]
[Tue Feb 03 22:55:29.427703 2026] [:error] [pid 42922:tid 43008] [client 20.205.110.134:17549] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "aYIMYWazX4WPS_dQRki7vgAAAJc"]
[Tue Feb 03 22:55:33.029629 2026] [:error] [pid 42921:tid 42974] [client 20.205.110.134:17542] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "aYIMZYblShffGl-01oeYiAAAAFA"]
[Tue Feb 03 22:55:35.326289 2026] [:error] [pid 42922:tid 43000] [client 20.205.110.134:27400] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "aYIMZ2azX4WPS_dQRki7wwAAAI8"]
[Tue Feb 03 22:55:38.038192 2026] [:error] [pid 43028:tid 43048] [client 20.205.110.134:7337] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "aYIMalnHWnJD4cJC5DvZ1gAAANI"]
[Tue Feb 03 22:55:54.826771 2026] [:error] [pid 43028:tid 43050] [client 20.205.110.134:22818] [client 20.205.110.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.205.110.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYIMelnHWnJD4cJC5DvZ9gAAANQ"]
[Tue Feb 03 22:55:57.301985 2026] [:error] [pid 43028:tid 43030] [client 20.205.110.134:22818] [client 20.205.110.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.205.110.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYIMfVnHWnJD4cJC5DvZ-QAAAMA"]
[Tue Feb 03 22:55:59.785861 2026] [:error] [pid 5148:tid 5152] [client 20.205.110.134:43891] [client 20.205.110.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aYIMf783HCHLtUIbS7IKVQAAAUE"]
[Tue Feb 03 22:56:02.135807 2026] [:error] [pid 5229:tid 5235] [client 20.205.110.134:7342] [client 20.205.110.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aYIMgkKmEgmJub93yUomDwAAAYQ"]
[Tue Feb 03 22:56:07.717287 2026] [autoindex:error] [pid 5148:tid 5173] [client 20.205.110.134:7344] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 22:56:07.858959 2026] [:error] [pid 5148:tid 5164] [client 20.205.110.134:7344] [client 20.205.110.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aYIMh783HCHLtUIbS7IKZAAAAU0"]
[Tue Feb 03 22:56:11.670445 2026] [:error] [pid 43028:tid 43043] [client 20.205.110.134:27474] [client 20.205.110.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aYIMi1nHWnJD4cJC5DvaEgAAAM0"]
[Tue Feb 03 22:56:14.497326 2026] [:error] [pid 42920:tid 42944] [client 20.205.110.134:7355] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww1.php"] [unique_id "aYIMjiix3YKltG4EU0mksQAAAA8"]
[Tue Feb 03 22:56:19.801668 2026] [:error] [pid 42922:tid 43003] [client 20.205.110.134:17594] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww1.php"] [unique_id "aYIMk2azX4WPS_dQRki79gAAAJI"]
[Tue Feb 03 22:56:36.141853 2026] [:error] [pid 43028:tid 43033] [client 20.205.110.134:7346] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aYIMpFnHWnJD4cJC5DvaQQAAAMM"]
[Tue Feb 03 22:56:38.969377 2026] [:error] [pid 42920:tid 42948] [client 20.205.110.134:42489] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aYIMpiix3YKltG4EU0mkwAAAABM"]
[Tue Feb 03 22:56:44.938786 2026] [:error] [pid 5148:tid 5170] [client 20.205.110.134:42004] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aYIMrL83HCHLtUIbS7IKigAAAVM"]
[Tue Feb 03 22:56:47.466117 2026] [:error] [pid 42920:tid 42934] [client 20.205.110.134:41993] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aYIMryix3YKltG4EU0mkzQAAAAU"]
[Tue Feb 03 22:56:49.062700 2026] [:error] [pid 43028:tid 43031] [client 20.205.110.134:16290] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aYIMsVnHWnJD4cJC5DvaXAAAAME"]
[Tue Feb 03 22:56:51.298293 2026] [:error] [pid 42920:tid 42933] [client 20.205.110.134:14057] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aYIMsyix3YKltG4EU0mkzwAAAAQ"]
[Tue Feb 03 22:56:52.147978 2026] [:error] [pid 28720:tid 28725] [client 20.205.110.134:42246] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aYIMtGmRXm2bmr_sYibxHwAAAQM"]
[Tue Feb 03 22:56:52.870067 2026] [:error] [pid 43028:tid 43046] [client 20.205.110.134:45517] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aYIMtFnHWnJD4cJC5DvaXwAAANA"]
[Tue Feb 03 22:56:57.703782 2026] [:error] [pid 28720:tid 28738] [client 20.205.110.134:16300] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aYIMuWmRXm2bmr_sYibxKwAAARA"]
[Tue Feb 03 22:57:07.428385 2026] [:error] [pid 5229:tid 5241] [client 20.205.110.134:44543] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aYIMw0KmEgmJub93yUomYAAAAYo"]
[Tue Feb 03 22:57:07.858912 2026] [:error] [pid 43028:tid 43034] [client 20.205.110.134:44530] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aYIMw1nHWnJD4cJC5DvacwAAAMQ"]
[Tue Feb 03 22:57:09.290966 2026] [:error] [pid 42922:tid 43003] [client 20.205.110.134:22786] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/colors/blue/index.php"] [unique_id "aYIMxWazX4WPS_dQRki8KAAAAJI"]
[Tue Feb 03 22:57:09.921200 2026] [:error] [pid 42920:tid 42937] [client 20.205.110.134:22811] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/colors/blue/index.php"] [unique_id "aYIMxSix3YKltG4EU0mk6wAAAAg"]
[Tue Feb 03 22:57:21.915026 2026] [:error] [pid 42921:tid 42967] [client 20.205.110.134:46593] [client 20.205.110.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.205.110.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYIM0YblShffGl-01oeY6gAAAEk"]
[Tue Feb 03 22:57:23.302019 2026] [autoindex:error] [pid 43028:tid 43036] [client 20.205.110.134:15569] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 22:57:24.327605 2026] [:error] [pid 43028:tid 43041] [client 20.205.110.134:15569] [client 20.205.110.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aYIM1FnHWnJD4cJC5DvanwAAAMs"]
[Tue Feb 03 22:57:34.150927 2026] [autoindex:error] [pid 43028:tid 43038] [client 20.205.110.134:12028] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 03 22:57:39.321719 2026] [:error] [pid 43028:tid 43039] [client 20.205.110.134:12028] [client 20.205.110.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aYIM41nHWnJD4cJC5Dva0wAAAMk"]
[Tue Feb 03 22:57:53.342152 2026] [:error] [pid 42921:tid 42968] [client 20.205.110.134:46596] [client 20.205.110.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aYIM8YblShffGl-01oeZBgAAAEo"]
[Tue Feb 03 22:58:02.123273 2026] [:error] [pid 5148:tid 5157] [client 20.205.110.134:20806] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aYIM-r83HCHLtUIbS7ILAwAAAUY"]
[Tue Feb 03 22:58:03.337280 2026] [:error] [pid 42920:tid 42934] [client 20.205.110.134:44454] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aYIM-yix3YKltG4EU0mlLAAAAAU"]
[Tue Feb 03 22:58:04.529769 2026] [:error] [pid 5229:tid 5236] [client 20.205.110.134:39708] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aYIM_EKmEgmJub93yUomugAAAYU"]
[Tue Feb 03 22:58:07.480720 2026] [:error] [pid 28720:tid 28730] [client 20.205.110.134:44207] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aYIM_2mRXm2bmr_sYibxbgAAAQg"]
[Tue Feb 03 22:58:09.412667 2026] [:error] [pid 43028:tid 43030] [client 20.205.110.134:44465] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/juuuu.php"] [unique_id "aYINAVnHWnJD4cJC5Dva-gAAAMA"]
[Tue Feb 03 22:58:11.334927 2026] [:error] [pid 5148:tid 5151] [client 20.205.110.134:20846] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/juuuu.php"] [unique_id "aYINA783HCHLtUIbS7ILDAAAAUA"]
[Tue Feb 03 22:58:12.574814 2026] [:error] [pid 42920:tid 42938] [client 20.205.110.134:44221] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/juuuu.php"] [unique_id "aYINBCix3YKltG4EU0mlNgAAAAk"]
[Tue Feb 03 22:58:20.037706 2026] [:error] [pid 42921:tid 42963] [client 20.205.110.134:44424] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/juuuu.php"] [unique_id "aYINDIblShffGl-01oeZFgAAAEU"]
[Tue Feb 03 22:58:23.559558 2026] [:error] [pid 28720:tid 28726] [client 20.205.110.134:43329] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aYIND2mRXm2bmr_sYibxeAAAAQQ"]
[Tue Feb 03 22:58:26.324431 2026] [:error] [pid 43028:tid 43032] [client 20.205.110.134:44434] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aYINElnHWnJD4cJC5DvbJAAAAMI"]
[Tue Feb 03 22:58:31.313834 2026] [:error] [pid 42921:tid 42980] [client 20.205.110.134:44197] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aYINF4blShffGl-01oeZJgAAAFY"]
[Tue Feb 03 22:58:45.618400 2026] [:error] [pid 42921:tid 42969] [client 20.205.110.134:4020] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aYINJYblShffGl-01oeZMQAAAEs"]
[Tue Feb 03 22:58:48.346226 2026] [:error] [pid 43028:tid 43033] [client 20.205.110.134:3843] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aYINKFnHWnJD4cJC5DvbQwAAAMM"]
[Tue Feb 03 22:59:10.575870 2026] [:error] [pid 43028:tid 43054] [client 20.205.110.134:31842] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bibil.php"] [unique_id "aYINPlnHWnJD4cJC5DvbfQAAANg"]
[Tue Feb 03 22:59:14.137465 2026] [:error] [pid 42922:tid 42987] [client 20.205.110.134:23846] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bibil.php"] [unique_id "aYINQmazX4WPS_dQRki8oQAAAII"]
[Tue Feb 03 22:59:18.765736 2026] [:error] [pid 42922:tid 43003] [client 20.205.110.134:44664] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bibil.php"] [unique_id "aYINRmazX4WPS_dQRki8qgAAAJI"]
[Tue Feb 03 22:59:28.719724 2026] [:error] [pid 42920:tid 42952] [client 20.205.110.134:20181] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aYINUCix3YKltG4EU0mllwAAABc"]
[Tue Feb 03 22:59:30.230312 2026] [:error] [pid 5229:tid 5255] [client 20.205.110.134:24114] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aYINUkKmEgmJub93yUonUQAAAZg"]
[Tue Feb 03 22:59:31.049994 2026] [:error] [pid 28720:tid 28730] [client 20.205.110.134:45272] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aYINU2mRXm2bmr_sYibxvgAAAQg"]
[Tue Feb 03 22:59:32.464644 2026] [:error] [pid 5229:tid 5254] [client 20.205.110.134:45284] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aYINVEKmEgmJub93yUonVAAAAZc"]
[Tue Feb 03 22:59:34.243402 2026] [:error] [pid 5148:tid 5164] [client 20.205.110.134:28229] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aYINVr83HCHLtUIbS7ILYgAAAU0"]
[Tue Feb 03 22:59:36.209353 2026] [:error] [pid 43028:tid 43033] [client 20.205.110.134:44630] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aYINWFnHWnJD4cJC5DvbrQAAAMM"]
[Tue Feb 03 22:59:37.210702 2026] [:error] [pid 42921:tid 42977] [client 20.205.110.134:44720] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aYINWYblShffGl-01oeZigAAAFM"]
[Tue Feb 03 22:59:40.007699 2026] [:error] [pid 5148:tid 5156] [client 20.205.110.134:28248] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aYINXL83HCHLtUIbS7ILbwAAAUU"]
[Tue Feb 03 22:59:46.422595 2026] [:error] [pid 42920:tid 42951] [client 20.205.110.134:24544] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aYINYiix3YKltG4EU0mlrQAAABY"]
[Tue Feb 03 22:59:49.730697 2026] [:error] [pid 42921:tid 42968] [client 20.205.110.134:23511] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aYINZYblShffGl-01oeZlQAAAEo"]
[Tue Feb 03 22:59:56.791774 2026] [:error] [pid 5229:tid 5255] [client 20.205.110.134:25344] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aYINbEKmEgmJub93yUonrgAAAZg"]
[Tue Feb 03 22:59:59.634395 2026] [:error] [pid 43028:tid 43045] [client 20.205.110.134:23544] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aYINb1nHWnJD4cJC5DvbvwAAAM8"]
[Tue Feb 03 23:00:02.678939 2026] [:error] [pid 28720:tid 28740] [client 20.205.110.134:25386] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aYINcmmRXm2bmr_sYibx0wAAARI"]
[Tue Feb 03 23:00:05.346367 2026] [:error] [pid 42920:tid 42939] [client 20.205.110.134:23494] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aYINdSix3YKltG4EU0mlvQAAAAo"]
[Tue Feb 03 23:00:08.497183 2026] [:error] [pid 43028:tid 43051] [client 20.205.110.134:23504] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aYINeFnHWnJD4cJC5Dvb0wAAANU"]
[Tue Feb 03 23:00:17.823005 2026] [:error] [pid 5229:tid 5237] [client 20.205.110.134:23501] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aYINgUKmEgmJub93yUon1QAAAYY"]
[Tue Feb 03 23:00:19.727788 2026] [:error] [pid 28720:tid 28745] [client 20.205.110.134:31167] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aYINg2mRXm2bmr_sYibx5gAAARc"]
[Tue Feb 03 23:00:20.652919 2026] [:error] [pid 5229:tid 5248] [client 20.205.110.134:31126] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aYINhEKmEgmJub93yUon1wAAAZE"]
[Tue Feb 03 23:00:30.781231 2026] [:error] [pid 43028:tid 43040] [client 20.205.110.134:29040] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aYINjlnHWnJD4cJC5Dvb-gAAAMo"]
[Tue Feb 03 23:00:32.722072 2026] [:error] [pid 5229:tid 5241] [client 20.205.110.134:29332] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "aYINkEKmEgmJub93yUon5AAAAYo"]
[Tue Feb 03 23:00:35.231813 2026] [:error] [pid 43028:tid 43041] [client 20.205.110.134:29312] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "aYINk1nHWnJD4cJC5DvcAwAAAMs"]
[Tue Feb 03 23:00:41.654998 2026] [:error] [pid 28720:tid 28733] [client 20.205.110.134:28999] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "aYINmWmRXm2bmr_sYibx-AAAAQs"]
[Tue Feb 03 23:00:59.072600 2026] [:error] [pid 5229:tid 5255] [client 20.205.110.134:45264] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pop.php"] [unique_id "aYINq0KmEgmJub93yUooBAAAAZg"]
[Tue Feb 03 23:01:00.906753 2026] [:error] [pid 43028:tid 43049] [client 20.205.110.134:24115] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pop.php"] [unique_id "aYINrFnHWnJD4cJC5DvcOgAAANM"]
[Tue Feb 03 23:01:02.697590 2026] [:error] [pid 42920:tid 42929] [client 20.205.110.134:44926] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pop.php"] [unique_id "aYINriix3YKltG4EU0ml9gAAAAA"]
[Tue Feb 03 23:01:04.827423 2026] [:error] [pid 42920:tid 42937] [client 20.205.110.134:46872] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pop.php"] [unique_id "aYINsCix3YKltG4EU0ml-QAAAAg"]
[Tue Feb 03 23:01:05.688755 2026] [:error] [pid 42922:tid 42993] [client 20.205.110.134:42438] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aYINsWazX4WPS_dQRki89QAAAIg"]
[Tue Feb 03 23:01:12.247490 2026] [:error] [pid 42920:tid 42953] [client 20.205.110.134:41997] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aYINuCix3YKltG4EU0mmAgAAABg"]
[Tue Feb 03 23:01:13.647479 2026] [:error] [pid 42922:tid 42993] [client 20.205.110.134:44911] [client 20.205.110.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aYINuWazX4WPS_dQRki9AQAAAIg"]
[Wed Feb 04 01:18:42.018448 2026] [:error] [pid 5229:tid 5241] [client 143.110.190.80:37550] [client 143.110.190.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.110.190.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYIt8kKmEgmJub93yUpb-gAAAYo"]
[Wed Feb 04 01:32:12.953286 2026] [:error] [pid 5229:tid 5240] [client 195.88.82.88:62351] [client 195.88.82.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.88.82.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYIxHEKmEgmJub93yUplfwAAAYk"]
[Wed Feb 04 01:32:21.061698 2026] [:error] [pid 28720:tid 28731] [client 89.43.17.214:51172] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYIxJWmRXm2bmr_sYiYkqwAAAQk"]
[Wed Feb 04 01:32:29.519139 2026] [:error] [pid 42921:tid 42978] [client 93.187.203.101:42054] [client 93.187.203.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.187.203.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYIxLYblShffGl-01ofK2gAAAFQ"]
[Wed Feb 04 01:32:30.948136 2026] [:error] [pid 42922:tid 42988] [client 123.57.79.137:60044] [client 123.57.79.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 123.57.79.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYIxLmazX4WPS_dQRkjstwAAAIM"]
[Wed Feb 04 01:32:36.544530 2026] [:error] [pid 42920:tid 42952] [client 99.198.97.74:65233] [client 99.198.97.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 99.198.97.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYIxNCix3YKltG4EU0nUbgAAABc"]
[Wed Feb 04 01:32:38.165458 2026] [:error] [pid 42920:tid 42949] [client 103.28.36.205:47404] [client 103.28.36.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.28.36.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYIxNiix3YKltG4EU0nUcQAAABQ"]
[Wed Feb 04 01:32:40.728017 2026] [:error] [pid 5229:tid 5244] [client 118.27.100.24:41074] [client 118.27.100.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.27.100.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYIxOEKmEgmJub93yUplkQAAAY0"]
[Wed Feb 04 01:32:55.624382 2026] [:error] [pid 43028:tid 43033] [client 47.82.118.63:50376] [client 47.82.118.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.82.118.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYIxR1nHWnJD4cJC5DskSwAAAMM"]
[Wed Feb 04 01:32:57.795778 2026] [:error] [pid 5229:tid 5234] [client 99.198.97.74:53178] [client 99.198.97.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 99.198.97.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYIxSUKmEgmJub93yUploAAAAYM"]
[Wed Feb 04 01:33:31.155146 2026] [:error] [pid 42921:tid 42961] [client 193.202.110.30:47636] [client 193.202.110.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.202.110.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYIxa4blShffGl-01ofLFgAAAEM"]
[Wed Feb 04 04:36:07.012745 2026] [:error] [pid 47577:tid 47586] [client 74.208.194.58:34198] [client 74.208.194.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.208.194.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYJcN6vA4Yp0Sov-3kTgkQAAAAU"]
[Wed Feb 04 05:33:38.976677 2026] [:error] [pid 47676:tid 47694] [client 43.166.129.247:50606] [client 43.166.129.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYJpsgrYSkTgZEfUDqFnhAAAANA"]
[Wed Feb 04 05:52:45.155727 2026] [:error] [pid 47577:tid 47602] [client 104.244.79.40:38762] [client 104.244.79.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.244.79.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYJuLavA4Yp0Sov-3kT6vAAAABU"]
[Wed Feb 04 05:52:47.823620 2026] [:error] [pid 47676:tid 47684] [client 99.198.97.74:56769] [client 99.198.97.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 99.198.97.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYJuLwrYSkTgZEfUDqFt_wAAAMY"]
[Wed Feb 04 05:52:48.376982 2026] [:error] [pid 18816:tid 18840] [client 104.244.79.40:38774] [client 104.244.79.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.244.79.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYJuMMszZcOol_Iv-0U8LAAAARU"]
[Wed Feb 04 05:52:51.625176 2026] [:error] [pid 18816:tid 18829] [client 184.168.120.235:41952] [client 184.168.120.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.120.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYJuM8szZcOol_Iv-0U8LwAAAQo"]
[Wed Feb 04 05:52:56.923611 2026] [:error] [pid 18816:tid 18837] [client 159.89.182.203:44396] [client 159.89.182.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.182.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYJuOMszZcOol_Iv-0U8NwAAARI"]
[Wed Feb 04 05:53:13.547563 2026] [:error] [pid 47579:tid 47654] [client 195.88.82.88:63634] [client 195.88.82.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.88.82.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYJuSfuxWks846_Vi2zIhgAAAIo"]
[Wed Feb 04 05:53:14.887707 2026] [:error] [pid 47676:tid 47696] [client 116.103.108.158:45016] [client 116.103.108.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.103.108.158, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYJuSgrYSkTgZEfUDqFuHAAAANI"]
[Wed Feb 04 07:36:13.943475 2026] [:error] [pid 18816:tid 18835] [client 52.2.159.67:49628] [client 52.2.159.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.2.159.67, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYKGbcszZcOol_Iv-0VgxwAAARA"]
[Wed Feb 04 07:36:35.016991 2026] [:error] [pid 18816:tid 18821] [client 20.28.220.202:64583] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bayss.php"] [unique_id "aYKGg8szZcOol_Iv-0Vg7QAAAQI"]
[Wed Feb 04 07:36:40.566398 2026] [:error] [pid 55445:tid 55461] [client 20.28.220.202:16704] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bayss.php"] [unique_id "aYKGiFnd043q8WHuhu3k5AAAAU4"]
[Wed Feb 04 07:36:47.377861 2026] [:error] [pid 47578:tid 47640] [client 20.28.220.202:16726] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bayss.php"] [unique_id "aYKGj55oatM9u8-yDv8R8gAAAFc"]
[Wed Feb 04 07:36:54.132443 2026] [:error] [pid 47578:tid 47622] [client 20.28.220.202:24741] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/easy.php"] [unique_id "aYKGlp5oatM9u8-yDv8R-gAAAEc"]
[Wed Feb 04 07:37:13.108110 2026] [:error] [pid 47577:tid 47605] [client 20.28.220.202:64993] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edorxrr.php"] [unique_id "aYKGqavA4Yp0Sov-3kQaugAAABg"]
[Wed Feb 04 07:37:21.927892 2026] [:error] [pid 47579:tid 47644] [client 20.28.220.202:64954] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edorxrr.php"] [unique_id "aYKGsfuxWks846_Vi2zkmwAAAIA"]
[Wed Feb 04 07:37:31.938104 2026] [:error] [pid 47577:tid 47581] [client 20.28.220.202:24758] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aYKGu6vA4Yp0Sov-3kQazAAAAAA"]
[Wed Feb 04 07:37:32.270071 2026] [:error] [pid 18816:tid 18836] [client 20.28.220.202:43062] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aYKGvMszZcOol_Iv-0VhSQAAARE"]
[Wed Feb 04 07:37:33.213276 2026] [:error] [pid 55445:tid 55465] [client 20.28.220.202:43055] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aYKGvVnd043q8WHuhu3lGwAAAVI"]
[Wed Feb 04 07:37:33.901697 2026] [:error] [pid 55445:tid 55451] [client 20.28.220.202:16763] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aYKGvVnd043q8WHuhu3lHQAAAUQ"]
[Wed Feb 04 07:37:47.138249 2026] [:error] [pid 18816:tid 18843] [client 20.28.220.202:24726] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rzzaq.php"] [unique_id "aYKGy8szZcOol_Iv-0VhZwAAARg"]
[Wed Feb 04 07:37:47.940852 2026] [:error] [pid 47676:tid 47684] [client 20.28.220.202:65000] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rzzaq.php"] [unique_id "aYKGywrYSkTgZEfUDqGTFwAAAMY"]
[Wed Feb 04 07:37:50.809890 2026] [:error] [pid 47676:tid 47700] [client 20.28.220.202:16741] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rzzaq.php"] [unique_id "aYKGzgrYSkTgZEfUDqGTHwAAANY"]
[Wed Feb 04 07:37:59.856765 2026] [:error] [pid 47578:tid 47638] [client 20.28.220.202:43027] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rzzaq.php"] [unique_id "aYKG155oatM9u8-yDv8SLAAAAFY"]
[Wed Feb 04 07:38:01.531675 2026] [:error] [pid 55445:tid 55459] [client 20.28.220.202:64602] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aYKG2Vnd043q8WHuhu3lWgAAAUw"]
[Wed Feb 04 07:38:02.765916 2026] [:error] [pid 47676:tid 47692] [client 20.28.220.202:16749] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aYKG2grYSkTgZEfUDqGTNAAAAM4"]
[Wed Feb 04 07:38:04.025344 2026] [:error] [pid 55445:tid 55466] [client 20.28.220.202:64960] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aYKG3Fnd043q8WHuhu3lZAAAAVM"]
[Wed Feb 04 07:38:16.076318 2026] [:error] [pid 18816:tid 18825] [client 20.28.220.202:24757] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aYKG6MszZcOol_Iv-0VhiQAAAQY"]
[Wed Feb 04 07:38:24.982217 2026] [:error] [pid 47579:tid 47648] [client 20.28.220.202:24722] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aYKG8PuxWks846_Vi2zk8gAAAIQ"]
[Wed Feb 04 07:38:28.580564 2026] [:error] [pid 47578:tid 47618] [client 20.28.220.202:64959] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aYKG9J5oatM9u8-yDv8SVgAAAEM"]
[Wed Feb 04 07:38:29.269688 2026] [:error] [pid 47578:tid 47623] [client 20.28.220.202:64916] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aYKG9Z5oatM9u8-yDv8SWAAAAEg"]
[Wed Feb 04 07:38:30.166512 2026] [:error] [pid 18816:tid 18830] [client 20.28.220.202:64951] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aYKG9sszZcOol_Iv-0VhrQAAAQs"]
[Wed Feb 04 07:38:30.829206 2026] [:error] [pid 18816:tid 18838] [client 20.28.220.202:65009] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aYKG9sszZcOol_Iv-0VhrgAAARM"]
[Wed Feb 04 07:38:40.442392 2026] [:error] [pid 47676:tid 47691] [client 20.28.220.202:64946] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aYKHAArYSkTgZEfUDqGTZgAAAM0"]
[Wed Feb 04 07:38:42.528607 2026] [:error] [pid 47579:tid 47658] [client 20.28.220.202:24750] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aYKHAvuxWks846_Vi2zlEgAAAI4"]
[Wed Feb 04 07:39:17.059304 2026] [:error] [pid 47579:tid 47646] [client 20.28.220.202:12038] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aYKHJfuxWks846_Vi2zlSgAAAII"]
[Wed Feb 04 07:39:20.726730 2026] [:error] [pid 55445:tid 55471] [client 20.28.220.202:24714] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aYKHKFnd043q8WHuhu3mIwAAAVg"]
[Wed Feb 04 07:39:25.062053 2026] [:error] [pid 18816:tid 18828] [client 20.28.220.202:11707] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aYKHLcszZcOol_Iv-0ViIAAAAQk"]
[Wed Feb 04 07:39:26.812323 2026] [:error] [pid 18816:tid 18837] [client 20.28.220.202:64984] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aYKHLsszZcOol_Iv-0ViIwAAARI"]
[Wed Feb 04 07:39:27.845384 2026] [:error] [pid 47579:tid 47652] [client 20.28.220.202:24763] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "aYKHL_uxWks846_Vi2zlXAAAAIg"]
[Wed Feb 04 07:39:33.200772 2026] [:error] [pid 47676:tid 47688] [client 20.28.220.202:12085] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "aYKHNQrYSkTgZEfUDqGTwQAAAMo"]
[Wed Feb 04 07:39:35.341059 2026] [:error] [pid 55445:tid 55458] [client 20.28.220.202:11700] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "aYKHN1nd043q8WHuhu3mRgAAAUs"]
[Wed Feb 04 07:39:36.022443 2026] [:error] [pid 55445:tid 55452] [client 20.28.220.202:65010] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "aYKHOFnd043q8WHuhu3mSwAAAUU"]
[Wed Feb 04 07:39:36.680990 2026] [:error] [pid 47578:tid 47635] [client 20.28.220.202:32927] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aYKHOJ5oatM9u8-yDv8SrwAAAFQ"]
[Wed Feb 04 07:39:38.910985 2026] [:error] [pid 47579:tid 47658] [client 20.28.220.202:12055] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aYKHOvuxWks846_Vi2zlbwAAAI4"]
[Wed Feb 04 07:39:44.547465 2026] [:error] [pid 18816:tid 18839] [client 20.28.220.202:64969] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aYKHQMszZcOol_Iv-0ViSAAAARQ"]
[Wed Feb 04 07:39:45.867440 2026] [:error] [pid 47676:tid 47695] [client 20.28.220.202:24736] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aYKHQQrYSkTgZEfUDqGT0gAAANE"]
[Wed Feb 04 07:39:57.947967 2026] [:error] [pid 47577:tid 47594] [client 20.28.220.202:12075] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aYKHTavA4Yp0Sov-3kQbzQAAAA0"]
[Wed Feb 04 07:39:59.239568 2026] [:error] [pid 47578:tid 47627] [client 20.28.220.202:43068] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aYKHT55oatM9u8-yDv8SyQAAAEw"]
[Wed Feb 04 07:39:59.622817 2026] [:error] [pid 18816:tid 18823] [client 20.28.220.202:12084] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aYKHT8szZcOol_Iv-0ViXQAAAQQ"]
[Wed Feb 04 07:40:09.610656 2026] [:error] [pid 47577:tid 47589] [client 20.28.220.202:12077] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gtc.php"] [unique_id "aYKHWavA4Yp0Sov-3kQb5gAAAAg"]
[Wed Feb 04 07:40:12.169046 2026] [:error] [pid 47676:tid 47696] [client 20.28.220.202:65017] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gtc.php"] [unique_id "aYKHXArYSkTgZEfUDqGUAgAAANI"]
[Wed Feb 04 07:40:26.154194 2026] [:error] [pid 47578:tid 47626] [client 20.28.220.202:24728] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aYKHap5oatM9u8-yDv8TEwAAAEs"]
[Wed Feb 04 07:40:28.266497 2026] [:error] [pid 47676:tid 47691] [client 20.28.220.202:32919] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aYKHbArYSkTgZEfUDqGUFAAAAM0"]
[Wed Feb 04 07:40:31.234528 2026] [:error] [pid 47579:tid 47657] [client 20.28.220.202:24747] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aYKHb_uxWks846_Vi2zl6gAAAI0"]
[Wed Feb 04 07:40:31.995156 2026] [:error] [pid 47579:tid 47653] [client 20.28.220.202:32930] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aYKHb_uxWks846_Vi2zl7gAAAIk"]
[Wed Feb 04 07:40:32.922476 2026] [:error] [pid 55445:tid 55455] [client 20.28.220.202:11658] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aYKHcFnd043q8WHuhu3mzwAAAUg"]
[Wed Feb 04 07:40:38.323503 2026] [:error] [pid 18816:tid 18842] [client 20.28.220.202:45742] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aYKHdsszZcOol_Iv-0Vi9wAAARc"]
[Wed Feb 04 07:40:41.590639 2026] [:error] [pid 47676:tid 47679] [client 20.28.220.202:12043] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aYKHeQrYSkTgZEfUDqGUOgAAAME"]
[Wed Feb 04 07:40:43.373095 2026] [:error] [pid 47578:tid 47635] [client 20.28.220.202:32901] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aYKHe55oatM9u8-yDv8TIQAAAFQ"]
[Wed Feb 04 07:40:45.179915 2026] [:error] [pid 18816:tid 18836] [client 20.28.220.202:12059] [client 20.28.220.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aYKHfcszZcOol_Iv-0VjFgAAARE"]
[Wed Feb 04 07:40:58.432516 2026] [:error] [pid 47676:tid 47680] [client 20.28.220.202:12078] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aYKHigrYSkTgZEfUDqGUZgAAAMI"]
[Wed Feb 04 07:40:59.641056 2026] [:error] [pid 47578:tid 47635] [client 20.28.220.202:11683] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aYKHi55oatM9u8-yDv8TRQAAAFQ"]
[Wed Feb 04 07:41:04.049350 2026] [:error] [pid 18816:tid 18821] [client 20.28.220.202:65014] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aYKHkMszZcOol_Iv-0VjIQAAAQI"]
[Wed Feb 04 07:41:11.575582 2026] [:error] [pid 47577:tid 47583] [client 20.28.220.202:43018] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aYKHl6vA4Yp0Sov-3kQcOQAAAAI"]
[Wed Feb 04 07:41:14.159315 2026] [:error] [pid 47579:tid 47666] [client 20.28.220.202:24719] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aYKHmvuxWks846_Vi2zmNwAAAJY"]
[Wed Feb 04 07:41:15.051052 2026] [:error] [pid 47676:tid 47683] [client 20.28.220.202:43058] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aYKHmwrYSkTgZEfUDqGUewAAAMU"]
[Wed Feb 04 07:41:37.970392 2026] [:error] [pid 47578:tid 47625] [client 20.28.220.202:43010] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aYKHsZ5oatM9u8-yDv8TvQAAAEo"]
[Wed Feb 04 07:41:48.242526 2026] [:error] [pid 47676:tid 47691] [client 20.28.220.202:11673] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aYKHvArYSkTgZEfUDqGU4gAAAM0"]
[Wed Feb 04 07:41:49.110747 2026] [:error] [pid 47577:tid 47585] [client 20.28.220.202:24751] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aYKHvavA4Yp0Sov-3kQclwAAAAQ"]
[Wed Feb 04 07:41:50.790533 2026] [:error] [pid 47676:tid 47683] [client 20.28.220.202:11690] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aYKHvgrYSkTgZEfUDqGU5gAAAMU"]
[Wed Feb 04 07:41:57.615732 2026] [:error] [pid 55445:tid 55470] [client 20.28.220.202:65023] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aYKHxVnd043q8WHuhu3nmQAAAVc"]
[Wed Feb 04 07:41:58.827068 2026] [:error] [pid 55445:tid 55458] [client 20.28.220.202:12040] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aYKHxlnd043q8WHuhu3nowAAAUs"]
[Wed Feb 04 07:42:01.350237 2026] [:error] [pid 18816:tid 18828] [client 20.28.220.202:11657] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aYKHycszZcOol_Iv-0VjoQAAAQk"]
[Wed Feb 04 07:42:04.934149 2026] [:error] [pid 47676:tid 47694] [client 20.28.220.202:64983] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aYKHzArYSkTgZEfUDqGVGAAAANA"]
[Wed Feb 04 07:42:20.027796 2026] [:error] [pid 55445:tid 55471] [client 20.28.220.202:45698] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aYKH3Fnd043q8WHuhu3oAQAAAVg"]
[Wed Feb 04 07:42:21.570611 2026] [:error] [pid 47578:tid 47627] [client 20.28.220.202:32935] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/Cache/footer.php"] [unique_id "aYKH3Z5oatM9u8-yDv8UHwAAAEw"]
[Wed Feb 04 07:42:22.649905 2026] [:error] [pid 18816:tid 18828] [client 20.28.220.202:64988] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/Cache/footer.php"] [unique_id "aYKH3sszZcOol_Iv-0VjzAAAAQk"]
[Wed Feb 04 07:42:33.776302 2026] [:error] [pid 47676:tid 47687] [client 20.28.220.202:28296] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/Cache/footer.php"] [unique_id "aYKH6QrYSkTgZEfUDqGVUQAAAMk"]
[Wed Feb 04 07:43:01.824052 2026] [:error] [pid 47676:tid 47682] [client 20.28.220.202:43014] [client 20.28.220.202] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.28.220.202, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYKIBQrYSkTgZEfUDqGVjAAAAMQ"]
[Wed Feb 04 07:43:03.931755 2026] [:error] [pid 47676:tid 47691] [client 20.28.220.202:43014] [client 20.28.220.202] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.28.220.202, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYKIBwrYSkTgZEfUDqGVkAAAAM0"]
[Wed Feb 04 07:43:05.408438 2026] [:error] [pid 47577:tid 47596] [client 20.28.220.202:11662] [client 20.28.220.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aYKICavA4Yp0Sov-3kQdLQAAAA8"]
[Wed Feb 04 07:43:08.806808 2026] [:error] [pid 47676:tid 47690] [client 20.28.220.202:64989] [client 20.28.220.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aYKIDArYSkTgZEfUDqGVmAAAAMw"]
[Wed Feb 04 07:43:16.250185 2026] [autoindex:error] [pid 55445:tid 55461] [client 20.28.220.202:43060] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 04 07:43:16.275608 2026] [:error] [pid 55445:tid 55452] [client 20.28.220.202:43060] [client 20.28.220.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aYKIFFnd043q8WHuhu3odgAAAUU"]
[Wed Feb 04 07:43:19.086228 2026] [:error] [pid 47577:tid 47584] [client 20.28.220.202:12083] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/autoload_classmap.php"] [unique_id "aYKIF6vA4Yp0Sov-3kQdNAAAAAM"]
[Wed Feb 04 07:43:24.294006 2026] [:error] [pid 47577:tid 47601] [client 20.28.220.202:33303] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/autoload_classmap.php"] [unique_id "aYKIHKvA4Yp0Sov-3kQdPgAAABQ"]
[Wed Feb 04 07:43:26.060888 2026] [:error] [pid 47577:tid 47605] [client 20.28.220.202:12051] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/autoload_classmap.php"] [unique_id "aYKIHqvA4Yp0Sov-3kQdSAAAABg"]
[Wed Feb 04 07:43:28.425434 2026] [:error] [pid 47676:tid 47679] [client 20.28.220.202:33314] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/autoload_classmap.php"] [unique_id "aYKIIArYSkTgZEfUDqGVswAAAME"]
[Wed Feb 04 07:43:35.548732 2026] [:error] [pid 47578:tid 47631] [client 20.28.220.202:28343] [client 20.28.220.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aYKIJ55oatM9u8-yDv8UeAAAAFA"]
[Wed Feb 04 07:43:37.633490 2026] [:error] [pid 18816:tid 18833] [client 20.28.220.202:41581] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww1.php"] [unique_id "aYKIKcszZcOol_Iv-0VkGQAAAQ4"]
[Wed Feb 04 07:43:39.321806 2026] [:error] [pid 55445:tid 55459] [client 20.28.220.202:42832] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww1.php"] [unique_id "aYKIK1nd043q8WHuhu3okgAAAUw"]
[Wed Feb 04 07:43:40.418270 2026] [:error] [pid 55445:tid 55453] [client 20.28.220.202:42860] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww1.php"] [unique_id "aYKILFnd043q8WHuhu3opQAAAUY"]
[Wed Feb 04 07:43:40.903769 2026] [:error] [pid 18816:tid 18827] [client 20.28.220.202:25924] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww1.php"] [unique_id "aYKILMszZcOol_Iv-0VkHgAAAQg"]
[Wed Feb 04 07:43:55.036882 2026] [:error] [pid 18816:tid 18826] [client 20.28.220.202:31971] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aYKIO8szZcOol_Iv-0VkdwAAAQc"]
[Wed Feb 04 07:43:57.403862 2026] [:error] [pid 55445:tid 55452] [client 20.28.220.202:35134] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aYKIPVnd043q8WHuhu3pcAAAAUU"]
[Wed Feb 04 07:43:58.378798 2026] [:error] [pid 55445:tid 55449] [client 20.28.220.202:11779] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aYKIPlnd043q8WHuhu3pdwAAAUI"]
[Wed Feb 04 07:44:00.724458 2026] [:error] [pid 47578:tid 47640] [client 20.28.220.202:41289] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aYKIQJ5oatM9u8-yDv8U4gAAAFc"]
[Wed Feb 04 07:44:01.338598 2026] [:error] [pid 47578:tid 47628] [client 20.28.220.202:16696] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aYKIQZ5oatM9u8-yDv8U5QAAAE0"]
[Wed Feb 04 07:44:06.712494 2026] [:error] [pid 47578:tid 47619] [client 20.28.220.202:34644] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aYKIRp5oatM9u8-yDv8U7gAAAEQ"]
[Wed Feb 04 07:44:07.495994 2026] [:error] [pid 47579:tid 47665] [client 20.28.220.202:16684] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aYKIR_uxWks846_Vi2zncwAAAJU"]
[Wed Feb 04 07:44:16.250405 2026] [:error] [pid 47578:tid 47623] [client 20.28.220.202:34670] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aYKIUJ5oatM9u8-yDv8VBQAAAEg"]
[Wed Feb 04 07:44:44.728632 2026] [:error] [pid 47676:tid 47696] [client 20.28.220.202:64464] [client 20.28.220.202] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.28.220.202, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYKIbArYSkTgZEfUDqGWcgAAANI"]
[Wed Feb 04 07:44:45.920457 2026] [autoindex:error] [pid 55445:tid 55452] [client 20.28.220.202:39889] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 04 07:44:46.574625 2026] [:error] [pid 55445:tid 55449] [client 20.28.220.202:39889] [client 20.28.220.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aYKIblnd043q8WHuhu3p-gAAAUI"]
[Wed Feb 04 07:44:50.728188 2026] [autoindex:error] [pid 47676:tid 47694] [client 20.28.220.202:43789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 04 07:44:55.358043 2026] [:error] [pid 47676:tid 47694] [client 20.28.220.202:43789] [client 20.28.220.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aYKIdwrYSkTgZEfUDqGWmQAAANA"]
[Wed Feb 04 07:45:02.793911 2026] [:error] [pid 47578:tid 47633] [client 20.28.220.202:12350] [client 20.28.220.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aYKIfp5oatM9u8-yDv8VPgAAAFI"]
[Wed Feb 04 07:45:05.887794 2026] [:error] [pid 47579:tid 47661] [client 20.28.220.202:24274] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/juuuu.php"] [unique_id "aYKIgfuxWks846_Vi2zntQAAAJE"]
[Wed Feb 04 07:45:07.372962 2026] [:error] [pid 55445:tid 55464] [client 20.28.220.202:64198] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/juuuu.php"] [unique_id "aYKIg1nd043q8WHuhu3qJwAAAVE"]
[Wed Feb 04 07:45:10.568822 2026] [:error] [pid 47577:tid 47586] [client 20.28.220.202:19247] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/juuuu.php"] [unique_id "aYKIhqvA4Yp0Sov-3kQeiQAAAAU"]
[Wed Feb 04 07:45:13.183454 2026] [:error] [pid 47676:tid 47684] [client 20.28.220.202:26479] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/juuuu.php"] [unique_id "aYKIiQrYSkTgZEfUDqGWuAAAAMY"]
[Wed Feb 04 07:45:14.890287 2026] [:error] [pid 47578:tid 47623] [client 20.28.220.202:39706] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aYKIip5oatM9u8-yDv8VUgAAAEg"]
[Wed Feb 04 07:45:21.100917 2026] [:error] [pid 55445:tid 55447] [client 20.28.220.202:64206] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aYKIkVnd043q8WHuhu3qOAAAAUA"]
[Wed Feb 04 07:45:23.519658 2026] [:error] [pid 47676:tid 47686] [client 20.28.220.202:65369] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aYKIkwrYSkTgZEfUDqGWwwAAAMg"]
[Wed Feb 04 07:45:32.956330 2026] [:error] [pid 47577:tid 47605] [client 20.28.220.202:61207] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aYKInKvA4Yp0Sov-3kQesAAAABg"]
[Wed Feb 04 07:45:34.429668 2026] [:error] [pid 47676:tid 47687] [client 20.28.220.202:32375] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aYKIngrYSkTgZEfUDqGW0AAAAMk"]
[Wed Feb 04 07:45:34.668160 2026] [:error] [pid 47578:tid 47636] [client 20.28.220.202:52503] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aYKInp5oatM9u8-yDv8VfQAAAFU"]
[Wed Feb 04 07:45:36.585765 2026] [:error] [pid 47579:tid 47661] [client 20.28.220.202:64232] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aYKIoPuxWks846_Vi2zn2gAAAJE"]
[Wed Feb 04 07:45:42.079647 2026] [:error] [pid 55445:tid 55463] [client 20.28.220.202:11451] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aYKIplnd043q8WHuhu3qXwAAAVA"]
[Wed Feb 04 07:45:43.076928 2026] [:error] [pid 18816:tid 18839] [client 20.28.220.202:24293] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aYKIp8szZcOol_Iv-0VlfwAAARQ"]
[Wed Feb 04 07:45:44.191632 2026] [:error] [pid 55445:tid 55458] [client 20.28.220.202:64246] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aYKIqFnd043q8WHuhu3qagAAAUs"]
[Wed Feb 04 07:45:48.760998 2026] [:error] [pid 18816:tid 18840] [client 20.28.220.202:25358] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aYKIrMszZcOol_Iv-0VlhAAAARU"]
[Wed Feb 04 07:45:49.659976 2026] [:error] [pid 47579:tid 47656] [client 20.28.220.202:30612] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/04.php"] [unique_id "aYKIrfuxWks846_Vi2zn5wAAAIw"]
[Wed Feb 04 07:45:51.222777 2026] [:error] [pid 47676:tid 47686] [client 20.28.220.202:25347] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/04.php"] [unique_id "aYKIrwrYSkTgZEfUDqGW4QAAAMg"]
[Wed Feb 04 07:45:57.733407 2026] [:error] [pid 47676:tid 47691] [client 20.28.220.202:24304] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/04.php"] [unique_id "aYKItQrYSkTgZEfUDqGW6gAAAM0"]
[Wed Feb 04 07:46:00.243328 2026] [:error] [pid 47577:tid 47587] [client 20.28.220.202:25381] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/04.php"] [unique_id "aYKIuKvA4Yp0Sov-3kQexwAAAAY"]
[Wed Feb 04 07:46:02.523967 2026] [:error] [pid 55445:tid 55463] [client 20.28.220.202:24277] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "aYKIulnd043q8WHuhu3qigAAAVA"]
[Wed Feb 04 07:46:35.190737 2026] [:error] [pid 55445:tid 55454] [client 20.28.220.202:32321] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aYKI21nd043q8WHuhu3q6AAAAUc"]
[Wed Feb 04 07:46:48.139708 2026] [:error] [pid 47676:tid 47678] [client 20.28.220.202:43909] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aYKI6ArYSkTgZEfUDqGXNwAAAMA"]
[Wed Feb 04 07:46:56.228044 2026] [:error] [pid 47578:tid 47626] [client 20.28.220.202:12119] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aYKI8J5oatM9u8-yDv8VywAAAEs"]
[Wed Feb 04 07:46:57.179152 2026] [:error] [pid 47676:tid 47680] [client 20.28.220.202:12125] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aYKI8QrYSkTgZEfUDqGXPQAAAMI"]
[Wed Feb 04 07:46:58.954113 2026] [:error] [pid 55445:tid 55461] [client 20.28.220.202:61005] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aYKI8lnd043q8WHuhu3rOwAAAU4"]
[Wed Feb 04 07:46:59.718910 2026] [:error] [pid 47676:tid 47678] [client 20.28.220.202:27429] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aYKI8wrYSkTgZEfUDqGXQAAAAMA"]
[Wed Feb 04 07:47:01.413493 2026] [:error] [pid 47579:tid 47657] [client 20.28.220.202:12157] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aYKI9fuxWks846_Vi2zoQAAAAI0"]
[Wed Feb 04 07:47:04.551015 2026] [:error] [pid 47577:tid 47581] [client 20.28.220.202:11730] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aYKI-KvA4Yp0Sov-3kQfKAAAAAA"]
[Wed Feb 04 07:47:05.703932 2026] [:error] [pid 47577:tid 47604] [client 20.28.220.202:27436] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aYKI-avA4Yp0Sov-3kQfLAAAABc"]
[Wed Feb 04 07:47:06.516583 2026] [:error] [pid 47578:tid 47634] [client 20.28.220.202:11750] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aYKI-p5oatM9u8-yDv8V2gAAAFM"]
[Wed Feb 04 07:47:09.444874 2026] [:error] [pid 55445:tid 55447] [client 20.28.220.202:27453] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aYKI_Vnd043q8WHuhu3rVwAAAUA"]
[Wed Feb 04 07:47:12.740376 2026] [:error] [pid 47676:tid 47686] [client 20.28.220.202:27397] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aYKJAArYSkTgZEfUDqGXTgAAAMg"]
[Wed Feb 04 07:47:13.557603 2026] [:error] [pid 47676:tid 47693] [client 20.28.220.202:11754] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aYKJAQrYSkTgZEfUDqGXUQAAAM8"]
[Wed Feb 04 07:47:14.130806 2026] [:error] [pid 47577:tid 47593] [client 20.28.220.202:12147] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aYKJAqvA4Yp0Sov-3kQfQgAAAAw"]
[Wed Feb 04 07:47:46.813337 2026] [:error] [pid 47578:tid 47640] [client 20.28.220.202:43308] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xaz.php"] [unique_id "aYKJIp5oatM9u8-yDv8WJQAAAFc"]
[Wed Feb 04 07:47:49.813483 2026] [:error] [pid 47577:tid 47583] [client 20.28.220.202:62413] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xaz.php"] [unique_id "aYKJJavA4Yp0Sov-3kQflwAAAAI"]
[Wed Feb 04 07:47:51.735590 2026] [:error] [pid 47578:tid 47625] [client 20.28.220.202:62424] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xaz.php"] [unique_id "aYKJJ55oatM9u8-yDv8WLQAAAEo"]
[Wed Feb 04 07:47:52.854925 2026] [:error] [pid 47676:tid 47698] [client 20.28.220.202:11477] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xaz.php"] [unique_id "aYKJKArYSkTgZEfUDqGXpwAAANQ"]
[Wed Feb 04 07:47:57.707361 2026] [:error] [pid 18816:tid 18823] [client 20.28.220.202:45705] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up4.php"] [unique_id "aYKJLcszZcOol_Iv-0VmTAAAAQQ"]
[Wed Feb 04 07:47:58.286134 2026] [:error] [pid 55445:tid 55467] [client 20.28.220.202:11482] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up4.php"] [unique_id "aYKJLlnd043q8WHuhu3r8gAAAVQ"]
[Wed Feb 04 07:48:04.966306 2026] [:error] [pid 47577:tid 47592] [client 20.28.220.202:11494] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up4.php"] [unique_id "aYKJNKvA4Yp0Sov-3kQfsQAAAAs"]
[Wed Feb 04 07:48:08.454126 2026] [:error] [pid 47579:tid 47653] [client 20.28.220.202:63098] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up4.php"] [unique_id "aYKJOPuxWks846_Vi2zokQAAAIk"]
[Wed Feb 04 07:48:09.719637 2026] [:error] [pid 18816:tid 18830] [client 20.28.220.202:32929] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1aa.php"] [unique_id "aYKJOcszZcOol_Iv-0VmaAAAAQs"]
[Wed Feb 04 07:48:36.987112 2026] [:error] [pid 47676:tid 47684] [client 20.28.220.202:41542] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aYKJVArYSkTgZEfUDqGX9wAAAMY"]
[Wed Feb 04 07:48:40.109635 2026] [:error] [pid 47676:tid 47682] [client 20.28.220.202:52052] [client 20.28.220.202] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aYKJWArYSkTgZEfUDqGX-wAAAMQ"]
[Wed Feb 04 08:32:20.806424 2026] [:error] [pid 18816:tid 18823] [client 45.92.1.79:54110] [client 45.92.1.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYKTlMszZcOol_Iv-0V8bAAAAQQ"]
[Wed Feb 04 08:32:21.392349 2026] [:error] [pid 47579:tid 47658] [client 45.92.1.79:54343] [client 45.92.1.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYKTlfuxWks846_Vi2z1ZgAAAI4"]
[Wed Feb 04 08:32:22.054890 2026] [:error] [pid 47577:tid 47597] [client 45.92.1.79:54640] [client 45.92.1.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYKTlqvA4Yp0Sov-3kQtFAAAABA"]
[Wed Feb 04 08:32:22.643981 2026] [:error] [pid 47676:tid 47698] [client 45.92.1.79:54970] [client 45.92.1.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYKTlgrYSkTgZEfUDqGkbAAAANQ"]
[Wed Feb 04 08:32:23.227270 2026] [:error] [pid 47578:tid 47622] [client 45.92.1.79:55227] [client 45.92.1.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYKTl55oatM9u8-yDv8mQgAAAEc"]
[Wed Feb 04 09:04:55.047561 2026] [:error] [pid 55445:tid 55468] [client 192.42.116.219:41705] [client 192.42.116.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.42.116.219, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYKbN1nd043q8WHuhu0DEAAAAVU"], referer: https://expressinteriors.com/xmlrpc.php?rsd
[Wed Feb 04 09:39:06.550493 2026] [:error] [pid 47676:tid 47696] [client 99.198.97.74:49293] [client 99.198.97.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 99.198.97.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYKjOgrYSkTgZEfUDqG3gAAAANI"]
[Wed Feb 04 09:39:12.248210 2026] [:error] [pid 47578:tid 47628] [client 99.198.97.74:49839] [client 99.198.97.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 99.198.97.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYKjQJ5oatM9u8-yDv9AVAAAAE0"]
[Wed Feb 04 09:39:24.946027 2026] [:error] [pid 47676:tid 47678] [client 89.43.17.214:38698] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYKjTArYSkTgZEfUDqG3lwAAAMA"]
[Wed Feb 04 09:39:32.941364 2026] [:error] [pid 47579:tid 47653] [client 152.32.235.239:49054] [client 152.32.235.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.32.235.239, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYKjVPuxWks846_Vi2wMXAAAAIk"]
[Wed Feb 04 09:39:38.765806 2026] [:error] [pid 47676:tid 47700] [client 89.43.17.214:41220] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYKjWgrYSkTgZEfUDqG3rQAAANY"]
[Wed Feb 04 09:39:47.499795 2026] [:error] [pid 18816:tid 18842] [client 193.202.110.21:51958] [client 193.202.110.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.202.110.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYKjY8szZcOol_Iv-0We4AAAARc"]
[Wed Feb 04 09:39:50.038018 2026] [:error] [pid 18816:tid 18826] [client 47.239.109.32:40250] [client 47.239.109.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.239.109.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYKjZsszZcOol_Iv-0We4wAAAQc"]
[Wed Feb 04 09:39:53.909764 2026] [:error] [pid 18816:tid 18837] [client 184.168.120.235:57622] [client 184.168.120.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.120.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYKjacszZcOol_Iv-0We5wAAARI"]
[Wed Feb 04 10:18:10.827873 2026] [:error] [pid 47406:tid 47486] [client 59.125.102.142:44798] [client 59.125.102.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYKsYgeu9R9b-_wtQ0KfPAAAARM"]
[Wed Feb 04 12:52:12.743011 2026] [:error] [pid 47405:tid 47445] [client 78.47.65.98:55116] [client 78.47.65.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.47.65.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYLQfKTmhSrwHQTn6I72UwAAAMU"]
[Wed Feb 04 14:00:51.567164 2026] [:error] [pid 47406:tid 47490] [client 62.234.219.29:39528] [client 62.234.219.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.234.219.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYLgkweu9R9b-_wtQ0Lm2gAAARc"]
[Wed Feb 04 14:01:20.839280 2026] [:error] [pid 8285:tid 8296] [client 46.242.243.207:48341] [client 46.242.243.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.242.243.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYLgsBpweS7ndDaunz-MvAAAAEk"]
[Wed Feb 04 14:01:21.542020 2026] [:error] [pid 47500:tid 47525] [client 43.129.189.147:40488] [client 43.129.189.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.129.189.147, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYLgsbrUat0rhPdY3A21hAAAAVU"]
[Wed Feb 04 14:01:27.388856 2026] [:error] [pid 47500:tid 47510] [client 62.192.188.82:42976] [client 62.192.188.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.192.188.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYLgt7rUat0rhPdY3A21igAAAUY"]
[Wed Feb 04 15:16:46.371558 2026] [:error] [pid 47404:tid 47429] [client 162.62.213.187:37324] [client 162.62.213.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYLyXltGjJnGFKjTTubP8QAAAJM"]
[Wed Feb 04 15:49:08.187070 2026] [:error] [pid 47405:tid 47450] [client 149.202.183.73:35344] [client 149.202.183.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.183.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYL59KTmhSrwHQTn6I4jKwAAAMo"]
[Wed Feb 04 16:41:28.641127 2026] [ssl:error] [pid 47500:tid 47512] [client 107.172.58.36:50802] AH02032: Hostname www.cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup, referer: http://www.cdbdinteriors.com.au/
[Wed Feb 04 16:49:07.740225 2026] [:error] [pid 55160:tid 55180] [client 14.215.163.132:53989] [client 14.215.163.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYMIA-TAiAYDLSDaxdfv7AAAAZI"]
[Wed Feb 04 17:34:51.582041 2026] [:error] [pid 8285:tid 8296] [client 34.61.249.235:35280] [client 34.61.249.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.61.249.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYMSuxpweS7ndDaunz--YQAAAEk"]
[Wed Feb 04 17:34:55.132352 2026] [:error] [pid 55160:tid 55174] [client 118.27.125.50:42856] [client 118.27.125.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.27.125.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYMSv-TAiAYDLSDaxdcBxAAAAYw"]
[Wed Feb 04 17:34:55.987312 2026] [:error] [pid 55160:tid 55178] [client 122.155.171.214:52574] [client 122.155.171.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.155.171.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYMSv-TAiAYDLSDaxdcByAAAAZA"]
[Wed Feb 04 17:39:27.540195 2026] [:error] [pid 55160:tid 55179] [client 43.153.123.4:44624] [client 43.153.123.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYMTz-TAiAYDLSDaxdcDCgAAAZE"]
[Wed Feb 04 18:55:43.287387 2026] [:error] [pid 8285:tid 8311] [client 57.128.117.142:44296] [client 57.128.117.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 57.128.117.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYMlrxpweS7ndDaunz_S1gAAAFg"]
[Wed Feb 04 19:21:56.916637 2026] [:error] [pid 47406:tid 47479] [client 34.38.63.253:64919] [client 34.38.63.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.63.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYMr1Aeu9R9b-_wtQ0In7gAAAQw"]
[Wed Feb 04 19:21:59.695715 2026] [:error] [pid 47406:tid 47478] [client 34.38.63.253:64919] [client 34.38.63.253] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYMr1weu9R9b-_wtQ0In8QAAAQs"]
[Wed Feb 04 19:21:59.966241 2026] [:error] [pid 47406:tid 47475] [client 34.38.63.253:64919] [client 34.38.63.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.63.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYMr1weu9R9b-_wtQ0In8wAAAQg"]
[Wed Feb 04 19:22:01.711348 2026] [:error] [pid 8285:tid 8300] [client 34.38.63.253:55971] [client 34.38.63.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.63.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYMr2RpweS7ndDaunz_ZBgAAAE0"]
[Wed Feb 04 19:22:03.431967 2026] [:error] [pid 55160:tid 55173] [client 34.38.63.253:59412] [client 34.38.63.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.63.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYMr2-TAiAYDLSDaxdcqDwAAAYs"]
[Wed Feb 04 19:22:03.432233 2026] [:error] [pid 55160:tid 55173] [client 34.38.63.253:59412] [client 34.38.63.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.38.63.253, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYMr2-TAiAYDLSDaxdcqDwAAAYs"]
[Wed Feb 04 20:34:49.361437 2026] [:error] [pid 8285:tid 8308] [client 35.184.55.244:56559] [client 35.184.55.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.184.55.244, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYM86RpweS7ndDaunz_rkQAAAFU"]
[Wed Feb 04 20:34:51.728026 2026] [:error] [pid 8285:tid 8305] [client 35.184.55.244:56559] [client 35.184.55.244] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYM86xpweS7ndDaunz_rlgAAAFI"]
[Wed Feb 04 20:34:51.926026 2026] [:error] [pid 8285:tid 8306] [client 35.184.55.244:56559] [client 35.184.55.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.184.55.244, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYM86xpweS7ndDaunz_rlwAAAFM"]
[Wed Feb 04 20:34:53.672694 2026] [:error] [pid 47405:tid 47454] [client 35.184.55.244:49538] [client 35.184.55.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.184.55.244, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYM87aTmhSrwHQTn6I5V0gAAAM4"]
[Wed Feb 04 20:34:55.316237 2026] [:error] [pid 8285:tid 8290] [client 35.184.55.244:51148] [client 35.184.55.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.184.55.244, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYM87xpweS7ndDaunz_rpQAAAEM"]
[Wed Feb 04 20:34:56.957387 2026] [:error] [pid 47405:tid 47446] [client 35.184.55.244:64786] [client 35.184.55.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.184.55.244, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYM88KTmhSrwHQTn6I5V1AAAAMY"]
[Wed Feb 04 20:34:58.558212 2026] [:error] [pid 47406:tid 47472] [client 35.184.55.244:58548] [client 35.184.55.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.184.55.244, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYM88geu9R9b-_wtQ0I3QQAAAQU"]
[Wed Feb 04 20:34:58.558360 2026] [:error] [pid 47406:tid 47472] [client 35.184.55.244:58548] [client 35.184.55.244] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.184.55.244, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYM88geu9R9b-_wtQ0I3QQAAAQU"]
[Wed Feb 04 20:50:09.326880 2026] [:error] [pid 47500:tid 47504] [client 43.134.186.61:38486] [client 43.134.186.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYNAgbrUat0rhPdY3A0HdgAAAUA"]
[Wed Feb 04 20:58:05.277507 2026] [:error] [pid 55160:tid 55185] [client 37.27.119.185:49352] [client 37.27.119.185] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYNCXeTAiAYDLSDaxddM2QAAAZc"], referer: https://www.baidu.com
[Wed Feb 04 20:58:05.961000 2026] [:error] [pid 47500:tid 47521] [client 37.27.119.185:49981] [client 37.27.119.185] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYNCXbrUat0rhPdY3A0I2gAAAVE"], referer: https://www.mayoclinic.org
[Wed Feb 04 20:58:07.642710 2026] [:error] [pid 47406:tid 47467] [client 37.27.119.185:50563] [client 37.27.119.185] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYNCXweu9R9b-_wtQ0I8VQAAAQA"], referer: https://www.reddit.com/r/movies
[Wed Feb 04 20:58:08.329442 2026] [:error] [pid 8285:tid 8295] [client 37.27.119.185:51279] [client 37.27.119.185] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYNCYBpweS7ndDaunz_x5wAAAEg"], referer: https://www.weibo.com
[Wed Feb 04 21:51:36.159872 2026] [:error] [pid 8285:tid 8310] [client 160.250.227.36:43564] [client 160.250.227.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.227.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYNO6BpweS7ndDaunz8ASgAAAFc"]
[Wed Feb 04 21:51:38.259863 2026] [:error] [pid 8285:tid 8293] [client 220.158.233.50:36894] [client 220.158.233.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.158.233.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYNO6hpweS7ndDaunz8ATgAAAEY"]
[Wed Feb 04 21:51:41.882978 2026] [:error] [pid 55160:tid 55174] [client 81.0.107.76:51487] [client 81.0.107.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.0.107.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYNO7eTAiAYDLSDaxddhFAAAAYw"]
[Wed Feb 04 21:52:11.081605 2026] [:error] [pid 47405:tid 47460] [client 103.28.36.205:46856] [client 103.28.36.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.28.36.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYNPC6TmhSrwHQTn6I5muAAAANQ"]
[Wed Feb 04 21:52:15.670335 2026] [:error] [pid 47406:tid 47480] [client 103.113.152.163:59534] [client 103.113.152.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.113.152.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYNPDweu9R9b-_wtQ0JIWQAAAQ0"]
[Wed Feb 04 22:25:44.487762 2026] [:error] [pid 47404:tid 47414] [client 39.49.105.85:57388] [client 39.49.105.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.49.105.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYNW6FtGjJnGFKjTTuZKugAAAIQ"]
[Wed Feb 04 22:35:43.245291 2026] [:error] [pid 63777:tid 63788] [client 167.99.182.49:37856] [client 167.99.182.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.182.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYNZP_Q-YVerd_zSVS9JcAAAAAk"]
[Wed Feb 04 23:32:22.796921 2026] [:error] [pid 63777:tid 63791] [client 20.58.166.68:1895] [client 20.58.166.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aYNmhvQ-YVerd_zSVS9ikwAAAAw"]
[Wed Feb 04 23:32:22.870045 2026] [:error] [pid 63777:tid 63801] [client 20.58.166.68:9150] [client 20.58.166.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aYNmhvQ-YVerd_zSVS9ilAAAABY"]
[Wed Feb 04 23:32:22.959378 2026] [:error] [pid 63686:tid 63748] [client 20.58.166.68:6640] [client 20.58.166.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aYNmhhyaRl9O5jmngTz4gwAAAQU"]
[Wed Feb 04 23:32:23.057543 2026] [:error] [pid 6490:tid 6514] [client 20.58.166.68:7368] [client 20.58.166.68] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aYNmh_jiJaSp2OpoDUlN_gAAAFU"]
[Thu Feb 05 01:26:16.987486 2026] [:error] [pid 63686:tid 63762] [client 34.42.227.17:58395] [client 34.42.227.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.42.227.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYOBOByaRl9O5jmngTwYNAAAARM"]
[Thu Feb 05 01:26:19.323614 2026] [:error] [pid 63686:tid 63766] [client 34.42.227.17:58395] [client 34.42.227.17] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYOBOxyaRl9O5jmngTwYNwAAARc"]
[Thu Feb 05 01:26:19.587712 2026] [:error] [pid 63686:tid 63744] [client 34.42.227.17:58395] [client 34.42.227.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.42.227.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYOBOxyaRl9O5jmngTwYOAAAAQE"]
[Thu Feb 05 01:26:21.068734 2026] [:error] [pid 63685:tid 63734] [client 34.42.227.17:56585] [client 34.42.227.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.42.227.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYOBPY6Dyg716yRb8FCi0wAAANI"]
[Thu Feb 05 01:26:22.509707 2026] [:error] [pid 63684:tid 63695] [client 34.42.227.17:55739] [client 34.42.227.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.42.227.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYOBPtsfhS3nNwjjsUPKtAAAAIY"]
[Thu Feb 05 01:26:24.056986 2026] [:error] [pid 63684:tid 63699] [client 34.42.227.17:54583] [client 34.42.227.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.42.227.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYOBQNsfhS3nNwjjsUPKtgAAAIo"]
[Thu Feb 05 01:26:25.589772 2026] [:error] [pid 26443:tid 26458] [client 34.42.227.17:60383] [client 34.42.227.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.42.227.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYOBQdRUJ4b_jBAfhPJqawAAAU0"]
[Thu Feb 05 01:26:25.589984 2026] [:error] [pid 26443:tid 26458] [client 34.42.227.17:60383] [client 34.42.227.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.42.227.17, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYOBQdRUJ4b_jBAfhPJqawAAAU0"]
[Thu Feb 05 01:27:58.770665 2026] [:error] [pid 26443:tid 26452] [client 103.77.107.204:54824] [client 103.77.107.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.77.107.204, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYOBntRUJ4b_jBAfhPJrCQAAAUc"]
[Thu Feb 05 01:27:59.887507 2026] [:error] [pid 26443:tid 26464] [client 103.77.107.204:54824] [client 103.77.107.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.77.107.204, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYOBn9RUJ4b_jBAfhPJrCwAAAVM"]
[Thu Feb 05 01:27:59.887618 2026] [:error] [pid 26443:tid 26464] [client 103.77.107.204:54824] [client 103.77.107.204] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 103.77.107.204 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYOBn9RUJ4b_jBAfhPJrCwAAAVM"]
[Thu Feb 05 01:36:56.369988 2026] [:error] [pid 6490:tid 6508] [client 136.111.125.93:52120] [client 136.111.125.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.125.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYODuPjiJaSp2OpoDUl9RAAAAE8"]
[Thu Feb 05 01:36:58.534401 2026] [:error] [pid 6490:tid 6503] [client 136.111.125.93:52120] [client 136.111.125.93] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYODuvjiJaSp2OpoDUl9SgAAAEo"]
[Thu Feb 05 01:36:58.732736 2026] [:error] [pid 6490:tid 6511] [client 136.111.125.93:52120] [client 136.111.125.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.125.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYODuvjiJaSp2OpoDUl9SwAAAFI"]
[Thu Feb 05 01:37:00.117020 2026] [:error] [pid 6490:tid 6509] [client 136.111.125.93:60498] [client 136.111.125.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.125.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYODvPjiJaSp2OpoDUl9TwAAAFA"]
[Thu Feb 05 01:37:01.630427 2026] [:error] [pid 26443:tid 26460] [client 136.111.125.93:57324] [client 136.111.125.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.125.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYODvdRUJ4b_jBAfhPJvhQAAAU8"]
[Thu Feb 05 01:37:03.074909 2026] [:error] [pid 6490:tid 6506] [client 136.111.125.93:56710] [client 136.111.125.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.125.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYODv_jiJaSp2OpoDUl9VQAAAE0"]
[Thu Feb 05 01:37:04.445752 2026] [:error] [pid 63777:tid 63797] [client 136.111.125.93:52662] [client 136.111.125.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.125.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYODwPQ-YVerd_zSVS-K3wAAABI"]
[Thu Feb 05 01:37:04.445929 2026] [:error] [pid 63777:tid 63797] [client 136.111.125.93:52662] [client 136.111.125.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 136.111.125.93, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYODwPQ-YVerd_zSVS-K3wAAABI"]
[Thu Feb 05 01:48:44.997751 2026] [:error] [pid 63685:tid 63733] [client 103.87.69.8:34280] [client 103.87.69.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.87.69.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYOGfI6Dyg716yRb8FCrRgAAANE"]
[Thu Feb 05 01:49:06.747650 2026] [:error] [pid 63777:tid 63791] [client 81.0.107.76:18462] [client 81.0.107.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.0.107.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYOGkvQ-YVerd_zSVS-P1QAAAAw"]
[Thu Feb 05 01:49:08.816285 2026] [:error] [pid 6490:tid 6502] [client 34.38.124.37:56446] [client 34.38.124.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.124.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYOGlPjiJaSp2OpoDUmCSQAAAEk"]
[Thu Feb 05 01:49:14.540466 2026] [:error] [pid 26443:tid 26457] [client 139.59.110.28:56754] [client 139.59.110.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.59.110.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYOGmtRUJ4b_jBAfhPJ2MQAAAUw"]
[Thu Feb 05 01:49:28.024595 2026] [:error] [pid 63685:tid 63729] [client 200.80.43.116:37456] [client 200.80.43.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.80.43.116, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYOGqI6Dyg716yRb8FCrjAAAAM0"]
[Thu Feb 05 01:49:28.601769 2026] [:error] [pid 63684:tid 63693] [client 139.59.110.28:45008] [client 139.59.110.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.59.110.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYOGqNsfhS3nNwjjsUPSlwAAAIQ"]
[Thu Feb 05 01:49:30.768595 2026] [:error] [pid 6490:tid 6516] [client 62.192.188.82:44086] [client 62.192.188.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.192.188.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYOGqvjiJaSp2OpoDUmCaAAAAFc"]
[Thu Feb 05 01:49:56.697492 2026] [:error] [pid 6490:tid 6501] [client 89.43.17.214:49092] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYOGxPjiJaSp2OpoDUmCiwAAAEg"]
[Thu Feb 05 01:51:12.010285 2026] [:error] [pid 63777:tid 63779] [client 85.214.10.56:36186] [client 85.214.10.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.10.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYOHEPQ-YVerd_zSVS-QrwAAAAA"]
[Thu Feb 05 02:56:10.212252 2026] [:error] [pid 63686:tid 63745] [client 217.77.10.74:57102] [client 217.77.10.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-json/wc/store/cart"] [unique_id "aYOWShyaRl9O5jmngTw1AAAAAQI"]
[Thu Feb 05 05:30:30.740352 2026] [:error] [pid 12287:tid 12295] [client 74.208.27.102:42674] [client 74.208.27.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.208.27.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYO6djOXzeBKhB81n7rb2AAAAMU"]
[Thu Feb 05 05:36:23.398027 2026] [:error] [pid 12287:tid 12304] [client 156.239.220.235:28134] [client 156.239.220.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.220.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYO71zOXzeBKhB81n7rekwAAAM4"]
[Thu Feb 05 05:36:25.726634 2026] [:error] [pid 12187:tid 12209] [client 156.239.197.136:18502] [client 156.239.197.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.197.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYO72YnHiwpamEOSyaPsKQAAAA0"], referer: http://expressinteriors.com/wp-login.php
[Thu Feb 05 05:36:28.684226 2026] [:error] [pid 12187:tid 12219] [client 154.82.170.94:51558] [client 154.82.170.94] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYO73InHiwpamEOSyaPsNQAAABc"]
[Thu Feb 05 05:36:30.090227 2026] [:error] [pid 12187:tid 12211] [client 156.239.199.116:23348] [client 156.239.199.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.199.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYO73onHiwpamEOSyaPsPAAAAA8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 05:36:30.094007 2026] [:error] [pid 12187:tid 12211] [client 156.239.199.116:23348] [client 156.239.199.116] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYO73onHiwpamEOSyaPsPAAAAA8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 05:36:32.121055 2026] [:error] [pid 12287:tid 12293] [client 156.239.157.231:49232] [client 156.239.157.231] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.157.231, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYO74DOXzeBKhB81n7remgAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 05:36:32.126280 2026] [:error] [pid 12287:tid 12293] [client 156.239.157.231:49232] [client 156.239.157.231] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYO74DOXzeBKhB81n7remgAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 05:36:33.539816 2026] [:error] [pid 12187:tid 12199] [client 154.82.168.45:34884] [client 154.82.168.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.82.168.45, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYO74YnHiwpamEOSyaPsRAAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 05:36:33.543057 2026] [:error] [pid 12187:tid 12199] [client 154.82.168.45:34884] [client 154.82.168.45] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYO74YnHiwpamEOSyaPsRAAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 05:36:34.975063 2026] [:error] [pid 12189:tid 12260] [client 154.82.150.114:27376] [client 154.82.150.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.82.150.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYO74r10V_VY_a0vRT58AAAAAIk"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 05:36:34.979312 2026] [:error] [pid 12189:tid 12260] [client 154.82.150.114:27376] [client 154.82.150.114] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYO74r10V_VY_a0vRT58AAAAAIk"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 05:36:36.494844 2026] [:error] [pid 12188:tid 12224] [client 156.239.220.94:20760] [client 156.239.220.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.220.94, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYO75DKWpl9mNO_-qzPntgAAAEA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 05:36:36.499189 2026] [:error] [pid 12188:tid 12224] [client 156.239.220.94:20760] [client 156.239.220.94] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYO75DKWpl9mNO_-qzPntgAAAEA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 05:55:04.014162 2026] [:error] [pid 12287:tid 12294] [client 89.43.17.214:48218] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYPAODOXzeBKhB81n7rkCQAAAMQ"]
[Thu Feb 05 05:55:18.293311 2026] [:error] [pid 12287:tid 12311] [client 123.60.56.215:48848] [client 123.60.56.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 123.60.56.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYPARjOXzeBKhB81n7rkGgAAANQ"]
[Thu Feb 05 05:55:46.150538 2026] [:error] [pid 10949:tid 10961] [client 34.140.254.174:40756] [client 34.140.254.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.140.254.174, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYPAYtyI0wNtlpWZ1djTkwAAAUc"]
[Thu Feb 05 05:55:54.624307 2026] [:error] [pid 12188:tid 12248] [client 154.19.37.2:56462] [client 154.19.37.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.19.37.2, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYPAajKWpl9mNO_-qzPufwAAAFg"]
[Thu Feb 05 05:56:04.100785 2026] [:error] [pid 10950:tid 10982] [client 89.43.17.214:57668] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYPAdPyO5N8A8xQHgCrHowAAAYE"]
[Thu Feb 05 05:56:29.136213 2026] [:error] [pid 10950:tid 10983] [client 154.19.37.2:33576] [client 154.19.37.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.19.37.2, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYPAjfyO5N8A8xQHgCrH0gAAAYI"]
[Thu Feb 05 05:56:36.804618 2026] [:error] [pid 12189:tid 12272] [client 160.250.227.36:46836] [client 160.250.227.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.227.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYPAlL10V_VY_a0vRT6B1QAAAJU"]
[Thu Feb 05 07:19:16.764713 2026] [:error] [pid 12187:tid 12219] [client 37.187.149.168:51580] [client 37.187.149.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.187.149.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPT9InHiwpamEOSyaMG4AAAABc"]
[Thu Feb 05 07:19:22.914790 2026] [:error] [pid 12188:tid 12246] [client 208.109.62.151:23642] [client 208.109.62.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.62.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPT-jKWpl9mNO_-qzMOWQAAAFY"]
[Thu Feb 05 07:19:23.808388 2026] [:error] [pid 12188:tid 12244] [client 208.109.62.151:23642] [client 208.109.62.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.62.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPT-zKWpl9mNO_-qzMOWwAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 07:20:12.593663 2026] [:error] [pid 12287:tid 12296] [client 148.72.119.138:34518] [client 148.72.119.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.72.119.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPULDOXzeBKhB81n7r4ywAAAMY"]
[Thu Feb 05 07:20:15.959740 2026] [:error] [pid 12287:tid 12297] [client 148.72.119.138:34518] [client 148.72.119.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.72.119.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPULzOXzeBKhB81n7r4zAAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 07:21:30.897565 2026] [:error] [pid 12188:tid 12238] [client 194.233.87.151:37138] [client 194.233.87.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.233.87.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPUejKWpl9mNO_-qzMPWgAAAE4"]
[Thu Feb 05 07:21:33.199960 2026] [:error] [pid 12188:tid 12227] [client 194.233.87.151:37138] [client 194.233.87.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.233.87.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPUfTKWpl9mNO_-qzMPWwAAAEM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 07:24:54.401651 2026] [:error] [pid 10901:tid 10908] [client 149.154.67.118:60380] [client 149.154.67.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.154.67.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPVRmuRF4wGmEFQVY0qCAAAAQI"]
[Thu Feb 05 07:24:55.885045 2026] [:error] [pid 10901:tid 10906] [client 149.154.67.118:60380] [client 149.154.67.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.154.67.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPVR2uRF4wGmEFQVY0qCwAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 07:25:06.837381 2026] [:error] [pid 12188:tid 12227] [client 185.249.40.156:34570] [client 185.249.40.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.249.40.156, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPVUjKWpl9mNO_-qzMQswAAAEM"]
[Thu Feb 05 07:25:08.277029 2026] [:error] [pid 12188:tid 12234] [client 185.249.40.156:34570] [client 185.249.40.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.249.40.156, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPVVDKWpl9mNO_-qzMQtgAAAEo"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 07:25:14.516163 2026] [:error] [pid 12188:tid 12231] [client 68.178.134.210:31140] [client 68.178.134.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.134.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPVWjKWpl9mNO_-qzMQvAAAAEc"]
[Thu Feb 05 07:25:19.173909 2026] [:error] [pid 12188:tid 12248] [client 68.178.134.210:31140] [client 68.178.134.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.134.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPVXzKWpl9mNO_-qzMQxwAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 07:30:40.714275 2026] [:error] [pid 12287:tid 12315] [client 208.109.62.151:58390] [client 208.109.62.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.62.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPWoDOXzeBKhB81n7r69gAAANg"]
[Thu Feb 05 07:30:41.706887 2026] [:error] [pid 12287:tid 12290] [client 208.109.62.151:58390] [client 208.109.62.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.62.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPWoTOXzeBKhB81n7r69wAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 07:30:44.824693 2026] [:error] [pid 12189:tid 12254] [client 92.205.101.169:52924] [client 92.205.101.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.101.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPWpL10V_VY_a0vRT6YPQAAAIM"]
[Thu Feb 05 07:30:45.747651 2026] [:error] [pid 12189:tid 12265] [client 92.205.101.169:52924] [client 92.205.101.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.101.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPWpb10V_VY_a0vRT6YQQAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 07:35:25.199282 2026] [:error] [pid 10949:tid 10970] [client 68.178.145.210:21810] [client 68.178.145.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.145.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPXvdyI0wNtlpWZ1djuxwAAAVA"]
[Thu Feb 05 07:35:26.213700 2026] [:error] [pid 10949:tid 10957] [client 68.178.145.210:21810] [client 68.178.145.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.145.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPXvtyI0wNtlpWZ1djuyAAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 07:47:44.352050 2026] [:error] [pid 10950:tid 10990] [client 68.178.134.15:32018] [client 68.178.134.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.134.15, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPaoPyO5N8A8xQHgCrrigAAAYk"]
[Thu Feb 05 07:48:56.767452 2026] [:error] [pid 12188:tid 12229] [client 185.249.40.156:59424] [client 185.249.40.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.249.40.156, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPa6DKWpl9mNO_-qzMaRwAAAEU"]
[Thu Feb 05 07:48:57.856865 2026] [:error] [pid 12188:tid 12233] [client 185.249.40.156:59424] [client 185.249.40.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.249.40.156, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPa6TKWpl9mNO_-qzMaSQAAAEk"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 07:50:08.763631 2026] [:error] [pid 12187:tid 12200] [client 162.241.226.85:39834] [client 162.241.226.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.226.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPbMInHiwpamEOSyaMNFgAAAAQ"]
[Thu Feb 05 07:50:10.663446 2026] [:error] [pid 12187:tid 12205] [client 162.241.226.85:39834] [client 162.241.226.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.226.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPbMonHiwpamEOSyaMNGgAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 07:50:44.516766 2026] [:error] [pid 10901:tid 10907] [client 92.205.101.169:53454] [client 92.205.101.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.101.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPbVGuRF4wGmEFQVY0woAAAAQE"]
[Thu Feb 05 07:50:45.704335 2026] [:error] [pid 10901:tid 10915] [client 92.205.101.169:53454] [client 92.205.101.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.101.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPbVWuRF4wGmEFQVY0wogAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 07:53:09.053134 2026] [:error] [pid 10950:tid 10991] [client 46.101.228.235:42020] [client 46.101.228.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.101.228.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPb5fyO5N8A8xQHgCrssAAAAYo"]
[Thu Feb 05 07:58:54.125252 2026] [:error] [pid 10950:tid 10987] [client 97.74.209.166:60262] [client 97.74.209.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 97.74.209.166, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPdPvyO5N8A8xQHgCruRAAAAYY"]
[Thu Feb 05 08:03:54.717794 2026] [:error] [pid 12287:tid 12307] [client 68.178.230.71:21708] [client 68.178.230.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.230.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPeajOXzeBKhB81n7oCAgAAANA"]
[Thu Feb 05 08:03:56.411207 2026] [:error] [pid 12287:tid 12305] [client 68.178.230.71:21708] [client 68.178.230.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.230.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPebDOXzeBKhB81n7oCBAAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 08:04:37.426404 2026] [:error] [pid 50183:tid 50235] [client 68.178.134.210:38822] [client 68.178.134.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.134.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPelUpo3f-TEEfujDRvAgAAAFQ"]
[Thu Feb 05 08:04:39.779496 2026] [:error] [pid 50183:tid 50239] [client 68.178.134.210:38822] [client 68.178.134.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.134.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPel0po3f-TEEfujDRvDAAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 08:12:24.551560 2026] [:error] [pid 50184:tid 50242] [client 103.56.161.165:57778] [client 103.56.161.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.56.161.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPgaFoximo2jVxzvs9OQAAAAIA"]
[Thu Feb 05 08:12:27.901608 2026] [:error] [pid 50184:tid 50263] [client 103.56.161.165:57778] [client 103.56.161.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.56.161.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPga1oximo2jVxzvs9ORQAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 08:15:27.915688 2026] [:error] [pid 50183:tid 50221] [client 185.249.40.156:44934] [client 185.249.40.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.249.40.156, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPhH0po3f-TEEfujDRyhgAAAEY"]
[Thu Feb 05 08:15:29.014479 2026] [:error] [pid 50183:tid 50230] [client 185.249.40.156:44934] [client 185.249.40.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.249.40.156, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPhIUpo3f-TEEfujDRyiQAAAE8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 08:16:20.296427 2026] [:error] [pid 50184:tid 50258] [client 148.72.126.93:34226] [client 148.72.126.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.72.126.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPhVFoximo2jVxzvs9PRgAAAJA"]
[Thu Feb 05 08:16:24.627277 2026] [:error] [pid 50184:tid 50266] [client 148.72.126.93:34226] [client 148.72.126.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.72.126.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPhWFoximo2jVxzvs9PSQAAAJg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 08:23:32.502789 2026] [:error] [pid 50182:tid 50187] [client 65.254.95.236:41756] [client 65.254.95.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.95.236, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPjBJb6zPs3SP7NHoMeXwAAAAE"]
[Thu Feb 05 08:23:33.962859 2026] [:error] [pid 50182:tid 50192] [client 65.254.95.236:41756] [client 65.254.95.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.95.236, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPjBZb6zPs3SP7NHoMeYwAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 08:24:35.746458 2026] [:error] [pid 50288:tid 50301] [client 18.168.142.104:55144] [client 18.168.142.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.168.142.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPjQ9J_SR3UqxCWcb2FMgAAAMU"]
[Thu Feb 05 08:24:37.264771 2026] [:error] [pid 50288:tid 50311] [client 18.168.142.104:55144] [client 18.168.142.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.168.142.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPjRdJ_SR3UqxCWcb2FNwAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 08:26:22.070028 2026] [:error] [pid 50624:tid 50640] [client 50.6.35.191:55378] [client 50.6.35.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.35.191, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPjrtICUaNaYRCGlHI2ywAAAQ0"]
[Thu Feb 05 08:26:23.101326 2026] [:error] [pid 50624:tid 50628] [client 50.6.35.191:55378] [client 50.6.35.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.35.191, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPjr9ICUaNaYRCGlHI2zAAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 08:29:52.916464 2026] [:error] [pid 50288:tid 50319] [client 50.62.187.124:13120] [client 50.62.187.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.187.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPkgNJ_SR3UqxCWcb2HVwAAANc"]
[Thu Feb 05 08:29:53.933460 2026] [:error] [pid 50288:tid 50316] [client 50.62.187.124:13120] [client 50.62.187.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.187.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPkgdJ_SR3UqxCWcb2HWAAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 08:33:52.600798 2026] [:error] [pid 50183:tid 50231] [client 51.38.230.115:42946] [client 51.38.230.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.38.230.115, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYPlcEpo3f-TEEfujDR5cAAAAFA"]
[Thu Feb 05 08:41:06.430008 2026] [:error] [pid 50183:tid 50217] [client 97.74.92.211:52754] [client 97.74.92.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 97.74.92.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPnIkpo3f-TEEfujDR9lwAAAEI"]
[Thu Feb 05 08:41:08.791820 2026] [:error] [pid 50183:tid 50218] [client 97.74.92.211:52754] [client 97.74.92.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 97.74.92.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPnJEpo3f-TEEfujDR9mgAAAEM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 08:45:57.351213 2026] [:error] [pid 50624:tid 50633] [client 50.62.187.124:63974] [client 50.62.187.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.187.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPoRdICUaNaYRCGlHI9tAAAAQY"]
[Thu Feb 05 08:45:59.025632 2026] [:error] [pid 50624:tid 50649] [client 50.62.187.124:63974] [client 50.62.187.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.187.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPoR9ICUaNaYRCGlHI9tgAAARY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 08:52:28.920083 2026] [:error] [pid 50184:tid 50254] [client 97.74.209.166:21888] [client 97.74.209.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 97.74.209.166, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPpzFoximo2jVxzvs9avQAAAIw"]
[Thu Feb 05 08:52:34.124773 2026] [:error] [pid 50184:tid 50252] [client 97.74.209.166:21888] [client 97.74.209.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 97.74.209.166, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPp0loximo2jVxzvs9azgAAAIo"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 09:01:13.559700 2026] [:error] [pid 50624:tid 50640] [client 34.77.90.132:2790] [client 34.77.90.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.77.90.132, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPr2dICUaNaYRCGlHJBkQAAAQ0"]
[Thu Feb 05 09:02:44.738762 2026] [:error] [pid 50182:tid 50186] [client 97.74.92.211:51776] [client 97.74.92.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 97.74.92.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPsNJb6zPs3SP7NHoMtdQAAAAA"]
[Thu Feb 05 09:02:48.926327 2026] [:error] [pid 50182:tid 50206] [client 97.74.92.211:51776] [client 97.74.92.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 97.74.92.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPsOJb6zPs3SP7NHoMtegAAABQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 09:07:02.919540 2026] [:error] [pid 50183:tid 50234] [client 184.168.101.160:41700] [client 184.168.101.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 184.168.101.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPtNkpo3f-TEEfujDSKBQAAAFM"]
[Thu Feb 05 09:07:03.949235 2026] [:error] [pid 50183:tid 50233] [client 184.168.101.160:41700] [client 184.168.101.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 184.168.101.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPtN0po3f-TEEfujDSKCQAAAFI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 09:09:15.142933 2026] [:error] [pid 50624:tid 50633] [client 68.178.134.210:15364] [client 68.178.134.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.134.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPtu9ICUaNaYRCGlHJDCgAAAQY"]
[Thu Feb 05 09:09:16.965716 2026] [:error] [pid 50624:tid 50642] [client 68.178.134.210:15364] [client 68.178.134.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.134.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPtvNICUaNaYRCGlHJDDAAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 09:11:11.240038 2026] [:error] [pid 50184:tid 50257] [client 68.178.245.62:34638] [client 68.178.245.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.245.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPuL1oximo2jVxzvs9fjQAAAI8"]
[Thu Feb 05 09:11:12.645938 2026] [:error] [pid 50184:tid 50250] [client 68.178.245.62:34638] [client 68.178.245.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.245.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPuMFoximo2jVxzvs9fjgAAAIg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 09:18:36.406954 2026] [:error] [pid 50184:tid 50257] [client 68.178.245.62:25042] [client 68.178.245.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.245.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPv7Foximo2jVxzvs9g8AAAAI8"]
[Thu Feb 05 09:18:38.302761 2026] [:error] [pid 50184:tid 50244] [client 68.178.245.62:25042] [client 68.178.245.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.245.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPv7loximo2jVxzvs9g8gAAAII"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 09:23:21.788596 2026] [:error] [pid 50183:tid 50231] [client 178.253.43.167:41644] [client 178.253.43.167] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.253.43.167, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPxCUpo3f-TEEfujDSRvgAAAFA"]
[Thu Feb 05 09:23:24.138792 2026] [:error] [pid 50183:tid 50226] [client 178.253.43.167:41644] [client 178.253.43.167] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.253.43.167, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPxDEpo3f-TEEfujDSRwAAAAEs"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 09:26:40.541520 2026] [:error] [pid 50183:tid 50237] [client 148.72.126.93:49538] [client 148.72.126.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.72.126.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPx0Epo3f-TEEfujDSTGAAAAFY"]
[Thu Feb 05 09:26:42.174170 2026] [:error] [pid 50183:tid 50227] [client 148.72.126.93:49538] [client 148.72.126.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.72.126.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPx0kpo3f-TEEfujDSTGQAAAEw"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 09:30:22.939111 2026] [:error] [pid 50288:tid 50307] [client 68.178.134.15:19670] [client 68.178.134.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.134.15, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPyrtJ_SR3UqxCWcb2ZbgAAAMs"]
[Thu Feb 05 09:30:25.658060 2026] [:error] [pid 50288:tid 50300] [client 68.178.134.15:19670] [client 68.178.134.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.134.15, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPysdJ_SR3UqxCWcb2ZdAAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 09:35:53.837764 2026] [:error] [pid 50288:tid 50307] [client 162.241.217.201:45872] [client 162.241.217.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.217.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPz-dJ_SR3UqxCWcb2bRQAAAMs"]
[Thu Feb 05 09:35:55.221029 2026] [:error] [pid 50288:tid 50311] [client 162.241.217.201:45872] [client 162.241.217.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.217.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYPz-9J_SR3UqxCWcb2bRgAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 09:36:26.328390 2026] [:error] [pid 50624:tid 50650] [client 103.56.161.165:54072] [client 103.56.161.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.56.161.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYP0GtICUaNaYRCGlHJK2AAAARc"]
[Thu Feb 05 09:39:19.714012 2026] [:error] [pid 50183:tid 50216] [client 66.175.44.59:60302] [client 66.175.44.59] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.59, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYP0x0po3f-TEEfujDSYKwAAAEE"]
[Thu Feb 05 09:39:20.953194 2026] [:error] [pid 50183:tid 50220] [client 66.175.44.59:60302] [client 66.175.44.59] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.59, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYP0yEpo3f-TEEfujDSYLQAAAEU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 09:39:43.247838 2026] [:error] [pid 50183:tid 50239] [client 66.175.44.54:56138] [client 66.175.44.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYP030po3f-TEEfujDSYPAAAAFg"]
[Thu Feb 05 09:39:44.683345 2026] [:error] [pid 50183:tid 50239] [client 66.175.44.54:56138] [client 66.175.44.54] ModSecurity: Audit log: Failed to lock global mutex: Invalid argument [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYP030po3f-TEEfujDSYPAAAAFg"]
[Thu Feb 05 09:39:44.683743 2026] [:error] [pid 50183:tid 50239] [client 66.175.44.54:56138] [client 66.175.44.54] ModSecurity: Audit log: Failed to unlock global mutex: Invalid argument [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYP030po3f-TEEfujDSYPAAAAFg"]
[Thu Feb 05 09:39:57.562121 2026] [:error] [pid 12392:tid 12402] [client 66.175.44.54:50992] [client 66.175.44.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYP07aXSMOxDzGl0jEhmLAAAAUc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 09:40:33.711747 2026] [:error] [pid 12271:tid 12365] [client 103.56.161.165:33150] [client 103.56.161.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.56.161.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYP1ES845cbUdCsdlWbbxgAAARQ"]
[Thu Feb 05 09:41:34.006843 2026] [:error] [pid 12392:tid 12410] [client 66.175.44.58:58418] [client 66.175.44.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYP1TqXSMOxDzGl0jEhm3wAAAU8"]
[Thu Feb 05 09:41:35.122841 2026] [:error] [pid 12392:tid 12398] [client 66.175.44.58:58418] [client 66.175.44.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYP1T6XSMOxDzGl0jEhm4AAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 09:44:50.102695 2026] [:error] [pid 12392:tid 12410] [client 134.209.95.224:57582] [client 134.209.95.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.209.95.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYP2EqXSMOxDzGl0jEholQAAAU8"]
[Thu Feb 05 09:44:52.955341 2026] [:error] [pid 12651:tid 12659] [client 52.238.252.162:2368] [client 52.238.252.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.238.252.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYP2FERTBQD6hew8ACs4CgAAAEQ"]
[Thu Feb 05 09:44:53.246014 2026] [:error] [pid 12270:tid 12322] [client 89.43.17.214:50206] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYP2FcDeA15OKg8IIIVQHAAAAIQ"]
[Thu Feb 05 09:45:04.436939 2026] [:error] [pid 12651:tid 12662] [client 139.59.110.28:51498] [client 139.59.110.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.59.110.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYP2IERTBQD6hew8ACs4GwAAAEc"]
[Thu Feb 05 09:45:04.808815 2026] [:error] [pid 12651:tid 12667] [client 38.58.224.32:46014] [client 38.58.224.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.58.224.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYP2IERTBQD6hew8ACs4HAAAAEw"]
[Thu Feb 05 09:45:06.753645 2026] [:error] [pid 12270:tid 12329] [client 139.59.110.28:51526] [client 139.59.110.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.59.110.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYP2IsDeA15OKg8IIIVQKAAAAIs"]
[Thu Feb 05 09:45:16.927546 2026] [:error] [pid 12269:tid 12286] [client 195.88.82.88:65436] [client 195.88.82.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.88.82.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYP2LPXlH20E8ZAPZel8NAAAAAA"]
[Thu Feb 05 09:45:19.901175 2026] [:error] [pid 12271:tid 12353] [client 81.0.107.76:19968] [client 81.0.107.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.0.107.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYP2Ly845cbUdCsdlWbdmgAAAQg"]
[Thu Feb 05 09:45:31.269918 2026] [:error] [pid 12651:tid 12660] [client 45.207.210.202:54704] [client 45.207.210.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.207.210.202, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYP2O0RTBQD6hew8ACs4TgAAAEU"]
[Thu Feb 05 09:45:32.491422 2026] [:error] [pid 12392:tid 12401] [client 99.198.97.74:51668] [client 99.198.97.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 99.198.97.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYP2PKXSMOxDzGl0jEho4QAAAUY"]
[Thu Feb 05 09:47:31.685022 2026] [:error] [pid 12392:tid 12413] [client 37.187.149.168:57614] [client 37.187.149.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.187.149.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYP2s6XSMOxDzGl0jEhpmgAAAVI"]
[Thu Feb 05 09:47:35.710833 2026] [:error] [pid 12392:tid 12417] [client 37.187.149.168:57614] [client 37.187.149.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.187.149.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYP2t6XSMOxDzGl0jEhpnwAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 10:00:58.711890 2026] [:error] [pid 12651:tid 12659] [client 18.168.142.104:56672] [client 18.168.142.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.168.142.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYP52kRTBQD6hew8ACs_uQAAAEQ"]
[Thu Feb 05 10:00:59.436331 2026] [:error] [pid 12651:tid 12677] [client 18.168.142.104:56672] [client 18.168.142.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.168.142.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYP520RTBQD6hew8ACs_uwAAAFY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 10:07:09.960754 2026] [:error] [pid 12270:tid 12335] [client 162.240.105.3:57696] [client 162.240.105.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.105.3, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYP7TcDeA15OKg8IIIVY_gAAAJE"]
[Thu Feb 05 10:30:52.586498 2026] [:error] [pid 33122:tid 33134] [client 45.92.1.79:62592] [client 45.92.1.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYQA3PW0IebAnFB9KDCTkgAAAEo"]
[Thu Feb 05 10:30:53.183311 2026] [:error] [pid 31833:tid 31837] [client 45.92.1.79:62883] [client 45.92.1.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYQA3RzypZt5yekRAkGi_QAAAYI"]
[Thu Feb 05 10:30:53.779690 2026] [:error] [pid 33122:tid 33147] [client 45.92.1.79:63277] [client 45.92.1.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYQA3fW0IebAnFB9KDCTqQAAAFc"]
[Thu Feb 05 10:30:54.374504 2026] [:error] [pid 31739:tid 31760] [client 45.92.1.79:63729] [client 45.92.1.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYQA3gGrHl_5BvMstJIw9gAAABM"]
[Thu Feb 05 10:30:55.120391 2026] [:error] [pid 31739:tid 31747] [client 45.92.1.79:64165] [client 45.92.1.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYQA3wGrHl_5BvMstJIxHgAAAAY"]
[Thu Feb 05 10:37:50.613366 2026] [:error] [pid 31833:tid 31857] [client 66.175.44.23:33914] [client 66.175.44.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQCfhzypZt5yekRAkGlhAAAAZY"]
[Thu Feb 05 10:37:52.151427 2026] [:error] [pid 31833:tid 31852] [client 66.175.44.23:33914] [client 66.175.44.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQCgBzypZt5yekRAkGlhwAAAZE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 10:43:33.575891 2026] [:error] [pid 31774:tid 31787] [client 104.225.1.248:54760] [client 104.225.1.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.225.1.248, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQD1ajDlLg1NOhSOXWHzAAAAIk"]
[Thu Feb 05 10:43:35.790623 2026] [:error] [pid 31774:tid 31796] [client 104.225.1.248:54760] [client 104.225.1.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.225.1.248, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQD16jDlLg1NOhSOXWH2AAAAJI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 10:51:35.044496 2026] [:error] [pid 31774:tid 31786] [client 66.116.196.26:37244] [client 66.116.196.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.116.196.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQFt6jDlLg1NOhSOXWKwgAAAIg"]
[Thu Feb 05 10:51:36.429030 2026] [:error] [pid 31774:tid 31782] [client 66.116.196.26:37244] [client 66.116.196.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.116.196.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQFuKjDlLg1NOhSOXWKxAAAAIQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 10:56:27.415346 2026] [:error] [pid 31774:tid 31784] [client 104.37.174.183:35754] [client 104.37.174.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.37.174.183, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYQG26jDlLg1NOhSOXWMsAAAAIY"]
[Thu Feb 05 11:10:10.568893 2026] [:error] [pid 33396:tid 33406] [client 66.175.44.39:51938] [client 66.175.44.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.39, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQKEvTgp_Ev6LiSSgA4JgAAAMM"]
[Thu Feb 05 11:10:15.254671 2026] [:error] [pid 33396:tid 33405] [client 66.175.44.39:51938] [client 66.175.44.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.39, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQKF_Tgp_Ev6LiSSgA4MQAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 11:14:44.636223 2026] [:error] [pid 33396:tid 33413] [client 149.154.67.118:55474] [client 149.154.67.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.154.67.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQLJPTgp_Ev6LiSSgA6OAAAAMo"]
[Thu Feb 05 11:14:46.787737 2026] [:error] [pid 33396:tid 33417] [client 149.154.67.118:55474] [client 149.154.67.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.154.67.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQLJvTgp_Ev6LiSSgA6OgAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 11:15:33.584295 2026] [:error] [pid 31774:tid 31788] [client 66.175.44.54:37676] [client 66.175.44.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQLVajDlLg1NOhSOXWZpwAAAIo"]
[Thu Feb 05 11:15:35.955153 2026] [:error] [pid 31774:tid 31792] [client 66.175.44.54:37676] [client 66.175.44.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQLV6jDlLg1NOhSOXWZqwAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 11:21:47.667035 2026] [:error] [pid 31833:tid 31844] [client 66.175.44.54:55024] [client 66.175.44.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQMyxzypZt5yekRAkG2lgAAAYk"]
[Thu Feb 05 11:21:49.429968 2026] [:error] [pid 31833:tid 31853] [client 66.175.44.54:55024] [client 66.175.44.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQMzRzypZt5yekRAkG2mgAAAZI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 11:22:45.597301 2026] [:error] [pid 31739:tid 31746] [client 66.175.44.40:38598] [client 66.175.44.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.40, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQNBQGrHl_5BvMstJJBAwAAAAU"]
[Thu Feb 05 11:22:46.861919 2026] [:error] [pid 31739:tid 31760] [client 66.175.44.40:38598] [client 66.175.44.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.40, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQNBgGrHl_5BvMstJJBBAAAABM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 11:43:31.504589 2026] [:error] [pid 31775:tid 31818] [client 66.175.44.37:60574] [client 66.175.44.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.37, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQR4xNlTj92HTKsJN2E0QAAAQ0"]
[Thu Feb 05 11:43:33.981059 2026] [:error] [pid 31775:tid 31816] [client 66.175.44.37:60574] [client 66.175.44.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.37, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQR5RNlTj92HTKsJN2E0gAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 11:46:27.230712 2026] [:error] [pid 33396:tid 33415] [client 66.116.196.26:43198] [client 66.116.196.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.116.196.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQSk_Tgp_Ev6LiSSgBEWQAAAMw"]
[Thu Feb 05 11:46:29.089565 2026] [:error] [pid 33396:tid 33423] [client 66.116.196.26:43198] [client 66.116.196.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.116.196.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQSlfTgp_Ev6LiSSgBEXAAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 11:56:07.877052 2026] [:error] [pid 33122:tid 33138] [client 107.180.115.163:25718] [client 107.180.115.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.115.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQU1_W0IebAnFB9KDCwawAAAE4"]
[Thu Feb 05 11:56:08.946570 2026] [:error] [pid 33122:tid 33143] [client 107.180.115.163:25718] [client 107.180.115.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.115.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQU2PW0IebAnFB9KDCwbAAAAFM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 12:08:10.020845 2026] [:error] [pid 33396:tid 33419] [client 66.116.196.26:42460] [client 66.116.196.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.116.196.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQXqvTgp_Ev6LiSSgBMAQAAANA"]
[Thu Feb 05 12:17:13.072929 2026] [:error] [pid 33396:tid 33418] [client 49.51.33.159:34472] [client 49.51.33.159] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYQZyfTgp_Ev6LiSSgBPVgAAAM8"]
[Thu Feb 05 12:19:36.935868 2026] [:error] [pid 33396:tid 33421] [client 123.187.240.242:36114] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYQaWPTgp_Ev6LiSSgBQCwAAANI"]
[Thu Feb 05 12:22:56.223439 2026] [:error] [pid 31833:tid 31851] [client 66.175.44.24:46244] [client 66.175.44.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQbIBzypZt5yekRAkHL4AAAAZA"]
[Thu Feb 05 12:22:58.042476 2026] [:error] [pid 31833:tid 31842] [client 66.175.44.24:46244] [client 66.175.44.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQbIhzypZt5yekRAkHL6gAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 12:35:20.587353 2026] [:error] [pid 33396:tid 33418] [client 66.175.44.60:50160] [client 66.175.44.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQeCPTgp_Ev6LiSSgBVCQAAAM8"]
[Thu Feb 05 12:35:22.195336 2026] [:error] [pid 33396:tid 33415] [client 66.175.44.60:50160] [client 66.175.44.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQeCvTgp_Ev6LiSSgBVDQAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 12:37:03.680209 2026] [:error] [pid 33396:tid 33410] [client 162.144.253.27:39274] [client 162.144.253.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.144.253.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQeb_Tgp_Ev6LiSSgBVlgAAAMc"]
[Thu Feb 05 12:37:05.348887 2026] [:error] [pid 33396:tid 33422] [client 162.144.253.27:39274] [client 162.144.253.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.144.253.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQecfTgp_Ev6LiSSgBVmwAAANM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 12:39:24.770111 2026] [:error] [pid 33396:tid 33407] [client 66.175.44.58:39894] [client 66.175.44.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQe_PTgp_Ev6LiSSgBW1wAAAMQ"]
[Thu Feb 05 12:39:28.476917 2026] [:error] [pid 33396:tid 33418] [client 66.175.44.58:39894] [client 66.175.44.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQfAPTgp_Ev6LiSSgBW2gAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 12:46:35.532769 2026] [:error] [pid 33122:tid 33129] [client 66.175.44.39:47580] [client 66.175.44.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.39, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQgq_W0IebAnFB9KDC_kgAAAEU"]
[Thu Feb 05 12:46:36.566559 2026] [:error] [pid 33122:tid 33142] [client 66.175.44.39:47580] [client 66.175.44.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.39, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQgrPW0IebAnFB9KDC_kwAAAFI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 13:09:17.300467 2026] [:error] [pid 31775:tid 31813] [client 47.161.210.72:35480] [client 47.161.210.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.161.210.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQl_RNlTj92HTKsJN2cUwAAAQg"]
[Thu Feb 05 13:09:21.354041 2026] [:error] [pid 31775:tid 31811] [client 47.161.210.72:35480] [client 47.161.210.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.161.210.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQmARNlTj92HTKsJN2cVgAAAQY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 13:14:34.877656 2026] [:error] [pid 33396:tid 33414] [client 66.175.44.37:42172] [client 66.175.44.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.37, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQnOvTgp_Ev6LiSSgBg1wAAAMs"]
[Thu Feb 05 13:14:36.670500 2026] [:error] [pid 33396:tid 33405] [client 66.175.44.37:42172] [client 66.175.44.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.37, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQnPPTgp_Ev6LiSSgBg2wAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 13:48:17.925321 2026] [:error] [pid 33122:tid 33128] [client 113.166.92.134:37930] [client 113.166.92.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 113.166.92.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQvIfW0IebAnFB9KDDP6gAAAEQ"]
[Thu Feb 05 13:48:19.392903 2026] [:error] [pid 33122:tid 33133] [client 113.166.92.134:37930] [client 113.166.92.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 113.166.92.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQvI_W0IebAnFB9KDDP7AAAAEk"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 13:51:39.027845 2026] [:error] [pid 31739:tid 31741] [client 66.175.44.69:54058] [client 66.175.44.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.69, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQv6wGrHl_5BvMstJJoyAAAAAA"]
[Thu Feb 05 13:51:40.173370 2026] [:error] [pid 31739:tid 31749] [client 66.175.44.69:54058] [client 66.175.44.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.69, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQv7AGrHl_5BvMstJJoywAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 14:01:54.587905 2026] [:error] [pid 31833:tid 31855] [client 54.73.157.139:48726] [client 54.73.157.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.73.157.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQyUhzypZt5yekRAkH5BAAAAZQ"]
[Thu Feb 05 14:04:39.797975 2026] [:error] [pid 33122:tid 33133] [client 162.213.255.225:41620] [client 162.213.255.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.213.255.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQy9_W0IebAnFB9KDDUvgAAAEk"]
[Thu Feb 05 14:04:41.061786 2026] [:error] [pid 33122:tid 33126] [client 162.213.255.225:41620] [client 162.213.255.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.213.255.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQy-fW0IebAnFB9KDDUwAAAAEI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 14:08:19.198908 2026] [:error] [pid 31775:tid 31814] [client 54.73.157.139:60212] [client 54.73.157.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.73.157.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQz0xNlTj92HTKsJN2s5wAAAQk"]
[Thu Feb 05 14:10:46.137594 2026] [:error] [pid 31833:tid 31851] [client 81.8.91.201:51368] [client 81.8.91.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.8.91.201, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYQ0ZhzypZt5yekRAkH8VwAAAZA"]
[Thu Feb 05 14:24:04.997270 2026] [:error] [pid 33122:tid 33143] [client 66.116.196.26:47694] [client 66.116.196.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.116.196.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQ3hPW0IebAnFB9KDDZ9gAAAFM"]
[Thu Feb 05 14:24:06.579919 2026] [:error] [pid 33122:tid 33126] [client 66.116.196.26:47694] [client 66.116.196.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.116.196.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQ3hvW0IebAnFB9KDDZ-gAAAEI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 14:28:23.390894 2026] [:error] [pid 33396:tid 33414] [client 184.168.117.149:47570] [client 184.168.117.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 184.168.117.149, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQ4h_Tgp_Ev6LiSSgB5eQAAAMs"]
[Thu Feb 05 14:28:24.610909 2026] [:error] [pid 33396:tid 33418] [client 184.168.117.149:47570] [client 184.168.117.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 184.168.117.149, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQ4iPTgp_Ev6LiSSgB5fgAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 14:30:21.290425 2026] [:error] [pid 33122:tid 33128] [client 66.175.44.35:47768] [client 66.175.44.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQ4_fW0IebAnFB9KDDcQgAAAEQ"]
[Thu Feb 05 14:30:22.908666 2026] [:error] [pid 33122:tid 33127] [client 66.175.44.35:47768] [client 66.175.44.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.44.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYQ4_vW0IebAnFB9KDDcRwAAAEM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 05 15:38:29.751656 2026] [:error] [pid 31833:tid 31852] [client 161.35.195.79:40222] [client 161.35.195.79] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/wp-json/wc/store/cart"] [unique_id "aYRI9RzypZt5yekRAkEbZgAAAZE"]
[Thu Feb 05 15:52:03.514503 2026] [:error] [pid 31774:tid 31794] [client 43.156.232.190:44336] [client 43.156.232.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYRMI6jDlLg1NOhSOXX1KwAAAJA"]
[Thu Feb 05 17:39:04.547347 2026] [:error] [pid 14577:tid 14583] [client 24.199.87.153:38132] [client 24.199.87.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.199.87.153, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYRlOJZbKwRdMc_HlgJdNAAAAUQ"]
[Thu Feb 05 17:51:32.368272 2026] [:error] [pid 19246:tid 19269] [client 81.0.107.76:10409] [client 81.0.107.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.0.107.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYRoJHE1Gc0V44f4mCcmQwAAAhI"]
[Thu Feb 05 17:51:37.915510 2026] [:error] [pid 19213:tid 19223] [client 203.162.234.20:58798] [client 203.162.234.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.162.234.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYRoKV7WBXhXgHKWAIA_xgAAAcU"]
[Thu Feb 05 17:51:54.198887 2026] [:error] [pid 33122:tid 33138] [client 120.79.172.65:46040] [client 120.79.172.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.79.172.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYRoOvW0IebAnFB9KDAI5gAAAE4"]
[Thu Feb 05 17:52:02.215291 2026] [:error] [pid 31775:tid 31820] [client 193.202.110.33:49972] [client 193.202.110.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.202.110.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYRoQhNlTj92HTKsJN30VQAAAQ8"]
[Thu Feb 05 17:52:18.132452 2026] [:error] [pid 19213:tid 19238] [client 93.187.203.101:52574] [client 93.187.203.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.187.203.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYRoUl7WBXhXgHKWAIA_2gAAAdQ"]
[Thu Feb 05 17:52:19.605472 2026] [:error] [pid 31775:tid 31829] [client 34.132.81.192:40468] [client 34.132.81.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.132.81.192, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYRoUxNlTj92HTKsJN30XQAAARg"]
[Thu Feb 05 19:40:34.111529 2026] [:error] [pid 33396:tid 33417] [client 20.110.235.211:4192] [client 20.110.235.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/st.php"] [unique_id "aYSBsvTgp_Ev6LiSSgDJRwAAAM4"]
[Thu Feb 05 19:40:36.909390 2026] [:error] [pid 14577:tid 14600] [client 20.110.235.211:4250] [client 20.110.235.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/st.php"] [unique_id "aYSBtJZbKwRdMc_HlgKGaQAAAVU"]
[Thu Feb 05 19:43:28.404619 2026] [:error] [pid 31775:tid 31807] [client 20.110.235.211:4730] [client 20.110.235.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aYSCYBNlTj92HTKsJN0lqQAAAQI"]
[Thu Feb 05 19:43:39.024051 2026] [autoindex:error] [pid 31774:tid 31792] [client 20.110.235.211:4890] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 05 19:43:39.224947 2026] [:error] [pid 31774:tid 31793] [client 20.110.235.211:4890] [client 20.110.235.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/library/shlo.php"] [unique_id "aYSCa6jDlLg1NOhSOXUvhQAAAI8"]
[Thu Feb 05 19:43:43.836716 2026] [:error] [pid 14577:tid 14601] [client 20.110.235.211:4860] [client 20.110.235.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs5.php"] [unique_id "aYSCb5ZbKwRdMc_HlgKHEQAAAVY"]
[Thu Feb 05 19:43:47.402353 2026] [:error] [pid 19246:tid 19275] [client 20.110.235.211:4695] [client 20.110.235.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs5.php"] [unique_id "aYSCc3E1Gc0V44f4mCdNTQAAAhg"]
[Thu Feb 05 19:43:52.101760 2026] [:error] [pid 31775:tid 31818] [client 20.110.235.211:4899] [client 20.110.235.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs5.php"] [unique_id "aYSCeBNlTj92HTKsJN0lxAAAAQ0"]
[Thu Feb 05 19:43:53.156532 2026] [:error] [pid 31774:tid 31787] [client 20.110.235.211:4680] [client 20.110.235.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs5.php"] [unique_id "aYSCeajDlLg1NOhSOXUviAAAAIk"]
[Thu Feb 05 19:43:58.496984 2026] [:error] [pid 31775:tid 31824] [client 20.110.235.211:4935] [client 20.110.235.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ednse.php"] [unique_id "aYSCfhNlTj92HTKsJN0lyQAAARM"]
[Thu Feb 05 19:44:00.273840 2026] [:error] [pid 31774:tid 31793] [client 20.110.235.211:4857] [client 20.110.235.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ednse.php"] [unique_id "aYSCgKjDlLg1NOhSOXUvjgAAAI8"]
[Thu Feb 05 19:44:00.962470 2026] [:error] [pid 31774:tid 31799] [client 20.110.235.211:4755] [client 20.110.235.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ednse.php"] [unique_id "aYSCgKjDlLg1NOhSOXUvkAAAAJU"]
[Thu Feb 05 19:44:02.247005 2026] [:error] [pid 33396:tid 33412] [client 20.110.235.211:4900] [client 20.110.235.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ednse.php"] [unique_id "aYSCgvTgp_Ev6LiSSgDJyQAAAMk"]
[Thu Feb 05 19:44:12.001711 2026] [:error] [pid 14577:tid 14582] [client 20.110.235.211:4996] [client 20.110.235.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aYSCjJZbKwRdMc_HlgKHHgAAAUM"]
[Thu Feb 05 19:44:13.236566 2026] [:error] [pid 31774:tid 31782] [client 20.110.235.211:4853] [client 20.110.235.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aYSCjajDlLg1NOhSOXUvmwAAAIQ"]
[Thu Feb 05 19:44:15.255162 2026] [:error] [pid 33396:tid 33423] [client 20.110.235.211:4939] [client 20.110.235.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aYSCj_Tgp_Ev6LiSSgDJ0QAAANQ"]
[Thu Feb 05 19:44:20.748889 2026] [:error] [pid 14577:tid 14598] [client 20.110.235.211:4829] [client 20.110.235.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/niett.php"] [unique_id "aYSClJZbKwRdMc_HlgKHIQAAAVM"]
[Thu Feb 05 19:44:25.431296 2026] [:error] [pid 14577:tid 14582] [client 20.110.235.211:5037] [client 20.110.235.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/niett.php"] [unique_id "aYSCmZZbKwRdMc_HlgKHKwAAAUM"]
[Thu Feb 05 19:44:27.890341 2026] [:error] [pid 31739:tid 31758] [client 20.110.235.211:4881] [client 20.110.235.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/niett.php"] [unique_id "aYSCmwGrHl_5BvMstJLW0AAAABE"]
[Thu Feb 05 19:44:39.268671 2026] [:error] [pid 19213:tid 19220] [client 20.110.235.211:4782] [client 20.110.235.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/puibr.php"] [unique_id "aYSCp17WBXhXgHKWAIBe9AAAAcI"]
[Thu Feb 05 20:50:05.252718 2026] [:error] [pid 19246:tid 19273] [client 157.230.24.5:33248] [client 157.230.24.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.24.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYSR_XE1Gc0V44f4mCdhogAAAhY"]
[Thu Feb 05 21:41:48.414374 2026] [:error] [pid 19213:tid 19221] [client 43.166.242.189:37436] [client 43.166.242.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYSeHF7WBXhXgHKWAIBz1wAAAcM"]
[Thu Feb 05 22:10:12.511968 2026] [:error] [pid 31774:tid 31789] [client 42.112.21.205:48968] [client 42.112.21.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 42.112.21.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYSkxKjDlLg1NOhSOXVKagAAAIs"]
[Thu Feb 05 22:10:21.019341 2026] [:error] [pid 33396:tid 33417] [client 187.45.240.74:53004] [client 187.45.240.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.45.240.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYSkzfTgp_Ev6LiSSgDiHAAAAM4"]
[Thu Feb 05 22:10:35.596931 2026] [:error] [pid 31833:tid 31851] [client 59.110.143.128:33464] [client 59.110.143.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.110.143.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYSk2xzypZt5yekRAkFv0AAAAZA"]
[Fri Feb 06 00:34:59.020083 2026] [:error] [pid 11121:tid 11128] [client 152.77.98.132:52182] [client 152.77.98.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.77.98.132, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYTGsxEsbmrTJ-7kOtbY2AAAAAI"], referer: https://expressinteriors.com/login
[Fri Feb 06 01:05:57.540803 2026] [:error] [pid 11459:tid 11520] [client 46.225.2.215:41552] [client 46.225.2.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.225.2.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYTN9Zn3t_QGiBnEMgMHdgAAAEk"]
[Fri Feb 06 01:58:38.510407 2026] [:error] [pid 11459:tid 11522] [client 47.253.193.141:40476] [client 47.253.193.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.253.193.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYTaTpn3t_QGiBnEMgMaIwAAAEs"]
[Fri Feb 06 01:58:53.837606 2026] [:error] [pid 11122:tid 11167] [client 194.163.151.80:34148] [client 194.163.151.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.163.151.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYTaXT0RBzI4cnzjYXK6cQAAAIo"]
[Fri Feb 06 01:59:01.466967 2026] [:error] [pid 11123:tid 11196] [client 41.193.5.58:57742] [client 41.193.5.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.193.5.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYTaZaJk7pHfPArl4eW15QAAAQw"]
[Fri Feb 06 03:43:28.213932 2026] [:error] [pid 1663:tid 1681] [client 20.119.172.139:12089] [client 20.119.172.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/st.php"] [unique_id "aYTy4F9EQrJaKkABjK98iAAAAAg"]
[Fri Feb 06 03:43:32.078849 2026] [:error] [pid 1665:tid 1727] [client 20.119.172.139:9847] [client 20.119.172.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/st.php"] [unique_id "aYTy5DYZLE6gThXvZMp6HAAAAIA"]
[Fri Feb 06 03:43:35.894858 2026] [:error] [pid 1663:tid 1684] [client 20.119.172.139:4102] [client 20.119.172.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/st.php"] [unique_id "aYTy519EQrJaKkABjK98kgAAAAs"]
[Fri Feb 06 03:43:39.597268 2026] [:error] [pid 1773:tid 1805] [client 20.119.172.139:11234] [client 20.119.172.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/st.php"] [unique_id "aYTy6zYbySBHYmKOdJ-AzgAAANY"]
[Fri Feb 06 03:43:50.874952 2026] [:error] [pid 1665:tid 1739] [client 20.119.172.139:4466] [client 20.119.172.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/"] [unique_id "aYTy9jYZLE6gThXvZMp6NQAAAIw"]
[Fri Feb 06 03:43:55.002701 2026] [:error] [pid 1664:tid 1714] [client 20.119.172.139:1788] [client 20.119.172.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/"] [unique_id "aYTy--_0lM6yA3VnvQVQ0AAAAE4"]
[Fri Feb 06 03:44:00.055666 2026] [:error] [pid 1663:tid 1675] [client 20.119.172.139:1765] [client 20.119.172.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oxse.php"] [unique_id "aYTzAF9EQrJaKkABjK98pQAAAAI"]
[Fri Feb 06 03:44:05.460975 2026] [:error] [pid 1665:tid 1748] [client 20.119.172.139:8114] [client 20.119.172.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oxse.php"] [unique_id "aYTzBTYZLE6gThXvZMp6RAAAAJU"]
[Fri Feb 06 03:44:20.927516 2026] [:error] [pid 1664:tid 1723] [client 20.119.172.139:6280] [client 20.119.172.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "aYTzFO_0lM6yA3VnvQVQ6gAAAFc"]
[Fri Feb 06 03:44:23.555373 2026] [:error] [pid 1773:tid 1778] [client 20.119.172.139:7717] [client 20.119.172.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "aYTzFzYbySBHYmKOdJ-BDwAAAMA"]
[Fri Feb 06 03:44:25.028979 2026] [:error] [pid 1664:tid 1717] [client 20.119.172.139:7321] [client 20.119.172.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "aYTzGe_0lM6yA3VnvQVQ7QAAAFE"]
[Fri Feb 06 03:44:25.846994 2026] [:error] [pid 1773:tid 1801] [client 20.119.172.139:4421] [client 20.119.172.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "aYTzGTYbySBHYmKOdJ-BEgAAANI"]
[Fri Feb 06 03:45:30.743195 2026] [:error] [pid 1664:tid 1709] [client 20.119.172.139:4908] [client 20.119.172.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/codehu.php"] [unique_id "aYTzWu_0lM6yA3VnvQVRNgAAAEk"]
[Fri Feb 06 03:46:02.294927 2026] [:error] [pid 1773:tid 1796] [client 20.119.172.139:6240] [client 20.119.172.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/resp.php"] [unique_id "aYTzejYbySBHYmKOdJ-BuQAAAM0"]
[Fri Feb 06 03:46:05.368125 2026] [:error] [pid 1665:tid 1749] [client 20.119.172.139:2914] [client 20.119.172.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aYTzfTYZLE6gThXvZMp6xgAAAJY"]
[Fri Feb 06 03:46:07.151784 2026] [:error] [pid 1665:tid 1746] [client 20.119.172.139:7154] [client 20.119.172.139] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/library/"] [unique_id "aYTzfzYZLE6gThXvZMp6yAAAAJM"]
[Fri Feb 06 04:01:34.958501 2026] [:error] [pid 1663:tid 1691] [client 43.153.135.208:41890] [client 43.153.135.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYT3Hl9EQrJaKkABjK-CCgAAABI"]
[Fri Feb 06 04:07:50.829778 2026] [:error] [pid 34582:tid 34598] [client 165.227.108.154:41528] [client 165.227.108.154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aYT4luDeJq1JGssYG6xOHgAAAQ0"]
[Fri Feb 06 05:11:31.401395 2026] [:error] [pid 1663:tid 1674] [client 41.203.18.9:44402] [client 41.203.18.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.203.18.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYUHg19EQrJaKkABjK-T8wAAAAE"]
[Fri Feb 06 05:12:36.332534 2026] [:error] [pid 1665:tid 1738] [client 157.66.27.54:57388] [client 157.66.27.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYUHxDYZLE6gThXvZMqS0AAAAIs"]
[Fri Feb 06 06:54:11.418645 2026] [:error] [pid 1663:tid 1696] [client 43.130.67.6:36528] [client 43.130.67.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYUfk19EQrJaKkABjK_mdgAAABc"]
[Fri Feb 06 08:30:05.409238 2026] [:error] [pid 13650:tid 13671] [client 85.17.76.141:47462] [client 85.17.76.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.17.76.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYU2DRoU-_lpgnGeX7WlTwAAAVM"]
[Fri Feb 06 08:40:18.205505 2026] [:error] [pid 13650:tid 13676] [client 34.38.1.181:55884] [client 34.38.1.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.1.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYU4choU-_lpgnGeX7WpMQAAAVg"]
[Fri Feb 06 08:40:20.851089 2026] [:error] [pid 13650:tid 13658] [client 34.38.1.181:55884] [client 34.38.1.181] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYU4dBoU-_lpgnGeX7WpNgAAAUY"]
[Fri Feb 06 08:40:21.121377 2026] [:error] [pid 13650:tid 13665] [client 34.38.1.181:55884] [client 34.38.1.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.1.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYU4dRoU-_lpgnGeX7WpOAAAAU0"]
[Fri Feb 06 08:40:22.973567 2026] [:error] [pid 1773:tid 1792] [client 34.38.1.181:58545] [client 34.38.1.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.1.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYU4djYbySBHYmKOdJ8uWQAAAMk"]
[Fri Feb 06 08:40:24.747828 2026] [:error] [pid 52212:tid 52224] [client 34.38.1.181:62839] [client 34.38.1.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.1.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYU4eGy3e5ZfWRP0XAc3CgAAAYo"]
[Fri Feb 06 08:40:26.594700 2026] [:error] [pid 1664:tid 1713] [client 34.38.1.181:58341] [client 34.38.1.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.1.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYU4eu_0lM6yA3VnvQXn8gAAAE0"]
[Fri Feb 06 08:40:28.495916 2026] [:error] [pid 1773:tid 1803] [client 34.38.1.181:62680] [client 34.38.1.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.1.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYU4fDYbySBHYmKOdJ8uZgAAANQ"]
[Fri Feb 06 08:40:28.496126 2026] [:error] [pid 1773:tid 1803] [client 34.38.1.181:62680] [client 34.38.1.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.38.1.181, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYU4fDYbySBHYmKOdJ8uZgAAANQ"]
[Fri Feb 06 09:44:29.859607 2026] [:error] [pid 3513:tid 3525] [client 165.227.108.154:60212] [client 165.227.108.154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aYVHfTSw3-HAlzpqSxy_BQAAAUo"]
[Fri Feb 06 09:58:50.325277 2026] [:error] [pid 3513:tid 3527] [client 34.45.47.34:57360] [client 34.45.47.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.45.47.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYVK2jSw3-HAlzpqSxzHpQAAAUw"]
[Fri Feb 06 09:58:52.351797 2026] [:error] [pid 3477:tid 3481] [client 34.132.181.99:48448] [client 34.132.181.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.132.181.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYVK3LL0Hdh40C7HYgVwlwAAAMI"]
[Fri Feb 06 09:58:59.537700 2026] [:error] [pid 3380:tid 3387] [client 62.192.188.82:53604] [client 62.192.188.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.192.188.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYVK4xFAlUvBGSBK2jdBWQAAAAM"]
[Fri Feb 06 09:59:13.943213 2026] [:error] [pid 3477:tid 3486] [client 62.192.188.82:46734] [client 62.192.188.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.192.188.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYVK8bL0Hdh40C7HYgVwtwAAAMc"]
[Fri Feb 06 09:59:47.673277 2026] [:error] [pid 3381:tid 3414] [client 118.27.125.50:56664] [client 118.27.125.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.27.125.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYVLEy81zqRg96ZREgh70wAAAEE"]
[Fri Feb 06 11:11:00.135827 2026] [:error] [pid 3380:tid 3385] [client 170.106.165.76:44424] [client 170.106.165.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYVbxBFAlUvBGSBK2jdflAAAAAE"]
[Fri Feb 06 11:37:43.718323 2026] [:error] [pid 3477:tid 3500] [client 5.161.99.57:55680] [client 5.161.99.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.161.99.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYViB7L0Hdh40C7HYgWdLwAAANU"]
[Fri Feb 06 13:47:06.596716 2026] [:error] [pid 3382:tid 3447] [client 154.86.113.251:49608] [client 154.86.113.251] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.86.113.251, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYWAWsIgU1HR0rhYrE-y6wAAAIc"]
[Fri Feb 06 13:47:13.405597 2026] [:error] [pid 3477:tid 3481] [client 154.193.154.178:55436] [client 154.193.154.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.193.154.178, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYWAYbL0Hdh40C7HYgXYeQAAAMI"], referer: http://expressinteriors.com/wp-login.php
[Fri Feb 06 13:47:16.053586 2026] [:error] [pid 3477:tid 3499] [client 156.249.124.136:48138] [client 156.249.124.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYWAZLL0Hdh40C7HYgXYggAAANQ"]
[Fri Feb 06 13:47:17.691195 2026] [:error] [pid 3381:tid 3419] [client 156.249.125.185:27554] [client 156.249.125.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.249.125.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYWAZS81zqRg96ZREgjXxQAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 13:47:17.694917 2026] [:error] [pid 3381:tid 3419] [client 156.249.125.185:27554] [client 156.249.125.185] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYWAZS81zqRg96ZREgjXxQAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 13:47:19.304992 2026] [:error] [pid 3382:tid 3440] [client 156.249.126.44:27096] [client 156.249.126.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.249.126.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYWAZ8IgU1HR0rhYrE-zAAAAAIA"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 13:47:19.308494 2026] [:error] [pid 3382:tid 3440] [client 156.249.126.44:27096] [client 156.249.126.44] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYWAZ8IgU1HR0rhYrE-zAAAAAIA"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 13:47:20.733867 2026] [:error] [pid 3380:tid 3385] [client 154.193.152.225:51892] [client 154.193.152.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.193.152.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYWAaBFAlUvBGSBK2je-OQAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 13:47:20.737562 2026] [:error] [pid 3380:tid 3385] [client 154.193.152.225:51892] [client 154.193.152.225] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYWAaBFAlUvBGSBK2je-OQAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 13:47:22.199907 2026] [:error] [pid 3382:tid 3445] [client 154.86.113.206:16268] [client 154.86.113.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.86.113.206, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYWAasIgU1HR0rhYrE-zBwAAAIU"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 13:47:22.204412 2026] [:error] [pid 3382:tid 3445] [client 154.86.113.206:16268] [client 154.86.113.206] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYWAasIgU1HR0rhYrE-zBwAAAIU"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 13:47:23.754634 2026] [:error] [pid 3477:tid 3484] [client 156.239.157.57:14274] [client 156.239.157.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.157.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYWAa7L0Hdh40C7HYgXYlAAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 13:47:23.757642 2026] [:error] [pid 3477:tid 3484] [client 156.239.157.57:14274] [client 156.239.157.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYWAa7L0Hdh40C7HYgXYlAAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 15:14:43.602700 2026] [:error] [pid 3513:tid 3526] [client 54.180.142.193:33264] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aYWU4zSw3-HAlzpqSxxv3QAAAUs"]
[Fri Feb 06 15:14:44.195858 2026] [:error] [pid 3513:tid 3516] [client 54.180.142.193:33268] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/HEAD"] [unique_id "aYWU5DSw3-HAlzpqSxxv4AAAAUE"]
[Fri Feb 06 15:14:44.800165 2026] [:error] [pid 3380:tid 3385] [client 54.180.142.193:43430] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/credentials"] [unique_id "aYWU5BFAlUvBGSBK2jf5cwAAAAE"]
[Fri Feb 06 15:14:45.399840 2026] [:error] [pid 3382:tid 3440] [client 54.180.142.193:43442] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config.bak"] [unique_id "aYWU5cIgU1HR0rhYrE_bGQAAAIA"]
[Fri Feb 06 15:14:46.002012 2026] [:error] [pid 3382:tid 3446] [client 54.180.142.193:43450] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config.old"] [unique_id "aYWU5sIgU1HR0rhYrE_bHQAAAIY"]
[Fri Feb 06 15:15:02.586304 2026] [:error] [pid 3381:tid 3434] [client 54.180.142.193:46330] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.production"] [unique_id "aYWU9i81zqRg96ZREgj_DQAAAFU"]
[Fri Feb 06 15:15:03.181546 2026] [:error] [pid 3477:tid 3487] [client 54.180.142.193:46332] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.development"] [unique_id "aYWU97L0Hdh40C7HYgUC5AAAAMg"]
[Fri Feb 06 15:15:03.785727 2026] [:error] [pid 3382:tid 3462] [client 54.180.142.193:46348] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.staging"] [unique_id "aYWU98IgU1HR0rhYrE_bNAAAAJY"]
[Fri Feb 06 15:15:04.378905 2026] [:error] [pid 3380:tid 3396] [client 54.180.142.193:46352] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.local"] [unique_id "aYWU-BFAlUvBGSBK2jf5ngAAAAw"]
[Fri Feb 06 15:15:04.975100 2026] [:error] [pid 3382:tid 3456] [client 54.180.142.193:33778] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.test"] [unique_id "aYWU-MIgU1HR0rhYrE_bNwAAAJA"]
[Fri Feb 06 15:15:05.575104 2026] [:error] [pid 3381:tid 3419] [client 54.180.142.193:33782] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.backup"] [unique_id "aYWU-S81zqRg96ZREgj_EQAAAEY"]
[Fri Feb 06 15:15:06.180880 2026] [:error] [pid 3380:tid 3392] [client 54.180.142.193:33794] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.old"] [unique_id "aYWU-hFAlUvBGSBK2jf5pAAAAAg"]
[Fri Feb 06 15:15:06.787706 2026] [:error] [pid 3477:tid 3482] [client 54.180.142.193:33798] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.bak"] [unique_id "aYWU-rL0Hdh40C7HYgUC5QAAAMM"]
[Fri Feb 06 15:15:07.388251 2026] [:error] [pid 3477:tid 3503] [client 54.180.142.193:33806] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.dist"] [unique_id "aYWU-7L0Hdh40C7HYgUC5wAAANg"]
[Fri Feb 06 15:15:07.989896 2026] [:error] [pid 3381:tid 3424] [client 54.180.142.193:33816] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aYWU-y81zqRg96ZREgj_GAAAAEs"]
[Fri Feb 06 15:15:08.587025 2026] [:error] [pid 3380:tid 3404] [client 54.180.142.193:33832] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.php"] [unique_id "aYWU_BFAlUvBGSBK2jf5qwAAABQ"]
[Fri Feb 06 15:15:09.185686 2026] [:error] [pid 3380:tid 3392] [client 54.180.142.193:33842] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.example"] [unique_id "aYWU_RFAlUvBGSBK2jf5rwAAAAg"]
[Fri Feb 06 15:15:09.779305 2026] [:error] [pid 3381:tid 3436] [client 54.180.142.193:33858] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.sample"] [unique_id "aYWU_S81zqRg96ZREgj_GgAAAFc"]
[Fri Feb 06 15:15:10.382613 2026] [:error] [pid 3380:tid 3404] [client 54.180.142.193:33860] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.dev"] [unique_id "aYWU_hFAlUvBGSBK2jf5tQAAABQ"]
[Fri Feb 06 15:15:10.985888 2026] [:error] [pid 3381:tid 3426] [client 54.180.142.193:33876] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.prod"] [unique_id "aYWU_i81zqRg96ZREgj_HQAAAE0"]
[Fri Feb 06 15:15:11.588567 2026] [:error] [pid 3380:tid 3401] [client 54.180.142.193:33892] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.stage"] [unique_id "aYWU_xFAlUvBGSBK2jf5twAAABE"]
[Fri Feb 06 15:15:12.179558 2026] [:error] [pid 3477:tid 3494] [client 54.180.142.193:33898] [client 54.180.142.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.live"] [unique_id "aYWVALL0Hdh40C7HYgUC8AAAAM8"]
[Fri Feb 06 15:15:14.286101 2026] [:error] [pid 3381:tid 3432] [client 54.180.142.193:33908] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bitbucket_keys.json"] [unique_id "aYWVAi81zqRg96ZREgj_IgAAAFM"]
[Fri Feb 06 15:15:14.887457 2026] [:error] [pid 3477:tid 3482] [client 54.180.142.193:51628] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.bitbucket_keys"] [unique_id "aYWVArL0Hdh40C7HYgUC9AAAAMM"]
[Fri Feb 06 15:15:15.485746 2026] [:error] [pid 3513:tid 3515] [client 54.180.142.193:51632] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/phpinfo.php"] [unique_id "aYWVAzSw3-HAlzpqSxxwGwAAAUA"]
[Fri Feb 06 15:15:16.087217 2026] [:error] [pid 3382:tid 3463] [client 54.180.142.193:51640] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aYWVBMIgU1HR0rhYrE_bTAAAAJc"]
[Fri Feb 06 15:15:16.688437 2026] [:error] [pid 3477:tid 3503] [client 54.180.142.193:51650] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test.php"] [unique_id "aYWVBLL0Hdh40C7HYgUC9QAAANg"]
[Fri Feb 06 15:15:17.280946 2026] [:error] [pid 3381:tid 3422] [client 54.180.142.193:51662] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/php.php"] [unique_id "aYWVBS81zqRg96ZREgj_JQAAAEk"]
[Fri Feb 06 15:15:17.882503 2026] [:error] [pid 3381:tid 3430] [client 54.180.142.193:51670] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/phpinfo.php.bak"] [unique_id "aYWVBS81zqRg96ZREgj_JwAAAFE"]
[Fri Feb 06 15:15:18.487508 2026] [:error] [pid 3513:tid 3536] [client 54.180.142.193:51686] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/phpinfo.php"] [unique_id "aYWVBjSw3-HAlzpqSxxwIQAAAVU"]
[Fri Feb 06 15:15:19.084425 2026] [:error] [pid 3380:tid 3391] [client 54.180.142.193:51696] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/info.php"] [unique_id "aYWVBxFAlUvBGSBK2jf5wAAAAAc"]
[Fri Feb 06 15:15:19.687434 2026] [:error] [pid 3380:tid 3405] [client 54.180.142.193:51698] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/phpinfo.php"] [unique_id "aYWVBxFAlUvBGSBK2jf5wgAAABU"]
[Fri Feb 06 15:15:20.286716 2026] [:error] [pid 3513:tid 3523] [client 54.180.142.193:51714] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server.php"] [unique_id "aYWVCDSw3-HAlzpqSxxwJgAAAUg"]
[Fri Feb 06 15:15:20.889632 2026] [:error] [pid 3382:tid 3440] [client 54.180.142.193:51724] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/debug.php"] [unique_id "aYWVCMIgU1HR0rhYrE_bUAAAAIA"]
[Fri Feb 06 15:15:21.487144 2026] [:error] [pid 3477:tid 3497] [client 54.180.142.193:51736] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/php_info.php"] [unique_id "aYWVCbL0Hdh40C7HYgUC-gAAANI"]
[Fri Feb 06 15:15:22.083664 2026] [:error] [pid 3381:tid 3436] [client 54.180.142.193:51742] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/testphp.php"] [unique_id "aYWVCi81zqRg96ZREgj_LAAAAFc"]
[Fri Feb 06 15:15:22.690737 2026] [:error] [pid 3477:tid 3481] [client 54.180.142.193:51758] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/probe.php"] [unique_id "aYWVCrL0Hdh40C7HYgUC_AAAAMI"]
[Fri Feb 06 15:15:23.287216 2026] [:error] [pid 3477:tid 3482] [client 54.180.142.193:51770] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/check.php"] [unique_id "aYWVC7L0Hdh40C7HYgUC_wAAAMM"]
[Fri Feb 06 15:15:23.879230 2026] [:error] [pid 3380:tid 3401] [client 54.180.142.193:51776] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api/phpinfo.php"] [unique_id "aYWVCxFAlUvBGSBK2jf5yQAAABE"]
[Fri Feb 06 15:15:24.482206 2026] [:error] [pid 3513:tid 3517] [client 54.180.142.193:45046] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api/info.php"] [unique_id "aYWVDDSw3-HAlzpqSxxwKgAAAUI"]
[Fri Feb 06 15:15:25.082625 2026] [:error] [pid 3382:tid 3455] [client 54.180.142.193:45050] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/phpinfo"] [unique_id "aYWVDcIgU1HR0rhYrE_bWgAAAI8"]
[Fri Feb 06 15:15:25.678422 2026] [:error] [pid 3477:tid 3495] [client 54.180.142.193:45064] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info"] [unique_id "aYWVDbL0Hdh40C7HYgUDBQAAANA"]
[Fri Feb 06 15:15:26.275270 2026] [:error] [pid 3380:tid 3396] [client 54.180.142.193:45074] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test"] [unique_id "aYWVDhFAlUvBGSBK2jf5zAAAAAw"]
[Fri Feb 06 15:15:26.873922 2026] [:error] [pid 3382:tid 3454] [client 54.180.142.193:45078] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/php"] [unique_id "aYWVDsIgU1HR0rhYrE_bYAAAAI4"]
[Fri Feb 06 15:15:27.478858 2026] [:error] [pid 3381:tid 3429] [client 54.180.142.193:45086] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/phpinfo.bak"] [unique_id "aYWVDy81zqRg96ZREgj_MwAAAFA"]
[Fri Feb 06 15:15:28.077658 2026] [:error] [pid 3381:tid 3425] [client 54.180.142.193:45088] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/phpinfo"] [unique_id "aYWVEC81zqRg96ZREgj_NAAAAEw"]
[Fri Feb 06 15:15:28.675610 2026] [:error] [pid 3382:tid 3456] [client 54.180.142.193:45100] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/info"] [unique_id "aYWVEMIgU1HR0rhYrE_bZQAAAJA"]
[Fri Feb 06 15:15:29.271027 2026] [:error] [pid 3477:tid 3491] [client 54.180.142.193:45114] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/phpinfo"] [unique_id "aYWVEbL0Hdh40C7HYgUDCgAAAMw"]
[Fri Feb 06 15:15:29.873374 2026] [:error] [pid 3477:tid 3483] [client 54.180.142.193:45116] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server"] [unique_id "aYWVEbL0Hdh40C7HYgUDCwAAAMQ"]
[Fri Feb 06 15:15:30.468644 2026] [:error] [pid 3477:tid 3485] [client 54.180.142.193:45124] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/debug"] [unique_id "aYWVErL0Hdh40C7HYgUDDAAAAMY"]
[Fri Feb 06 15:15:31.064100 2026] [:error] [pid 3477:tid 3496] [client 54.180.142.193:45126] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/php_info"] [unique_id "aYWVE7L0Hdh40C7HYgUDDgAAANE"]
[Fri Feb 06 15:15:31.661866 2026] [:error] [pid 3477:tid 3503] [client 54.180.142.193:45136] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/testphp"] [unique_id "aYWVE7L0Hdh40C7HYgUDEAAAANg"]
[Fri Feb 06 15:15:32.257334 2026] [:error] [pid 3477:tid 3492] [client 54.180.142.193:45140] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/probe"] [unique_id "aYWVFLL0Hdh40C7HYgUDEQAAAM0"]
[Fri Feb 06 15:15:32.850415 2026] [:error] [pid 3380:tid 3389] [client 54.180.142.193:45148] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/check"] [unique_id "aYWVFBFAlUvBGSBK2jf54QAAAAU"]
[Fri Feb 06 15:15:33.447837 2026] [:error] [pid 3380:tid 3394] [client 54.180.142.193:45150] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api/phpinfo"] [unique_id "aYWVFRFAlUvBGSBK2jf55QAAAAo"]
[Fri Feb 06 15:15:34.043322 2026] [:error] [pid 3380:tid 3400] [client 54.180.142.193:45166] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/api/info"] [unique_id "aYWVFhFAlUvBGSBK2jf57AAAABA"]
[Fri Feb 06 15:15:34.641113 2026] [:error] [pid 3380:tid 3406] [client 54.180.142.193:33826] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/phpinfo.php.old"] [unique_id "aYWVFhFAlUvBGSBK2jf57wAAABY"]
[Fri Feb 06 15:15:35.233815 2026] [:error] [pid 3380:tid 3401] [client 54.180.142.193:33828] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/_profiler/phpinfo"] [unique_id "aYWVFxFAlUvBGSBK2jf58QAAABE"]
[Fri Feb 06 15:15:35.835271 2026] [:error] [pid 3382:tid 3443] [client 54.180.142.193:33840] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cpanel/phpinfo.php"] [unique_id "aYWVF8IgU1HR0rhYrE_bbgAAAIM"]
[Fri Feb 06 15:15:36.434618 2026] [:error] [pid 3382:tid 3454] [client 54.180.142.193:33844] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/www/phpinfo.php"] [unique_id "aYWVGMIgU1HR0rhYrE_bcAAAAI4"]
[Fri Feb 06 15:15:37.030874 2026] [:error] [pid 3381:tid 3430] [client 54.180.142.193:33848] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/web/phpinfo.php"] [unique_id "aYWVGS81zqRg96ZREgj_PQAAAFE"]
[Fri Feb 06 15:15:37.627008 2026] [:error] [pid 3477:tid 3489] [client 54.180.142.193:33864] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server/phpinfo.php"] [unique_id "aYWVGbL0Hdh40C7HYgUDGAAAAMo"]
[Fri Feb 06 15:15:38.223754 2026] [:error] [pid 3477:tid 3479] [client 54.180.142.193:33872] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info2.php"] [unique_id "aYWVGrL0Hdh40C7HYgUDGgAAAMA"]
[Fri Feb 06 15:15:38.816315 2026] [:error] [pid 3380:tid 3387] [client 54.180.142.193:33874] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info1.php"] [unique_id "aYWVGhFAlUvBGSBK2jf59gAAAAM"]
[Fri Feb 06 15:15:39.419789 2026] [:error] [pid 3380:tid 3396] [client 54.180.142.193:33886] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info3.php"] [unique_id "aYWVGxFAlUvBGSBK2jf5-AAAAAw"]
[Fri Feb 06 15:15:40.013232 2026] [:error] [pid 3381:tid 3437] [client 54.180.142.193:33894] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/php-info.php"] [unique_id "aYWVHC81zqRg96ZREgj_RQAAAFg"]
[Fri Feb 06 15:15:40.607297 2026] [:error] [pid 3380:tid 3408] [client 54.180.142.193:33906] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/phptest.php"] [unique_id "aYWVHBFAlUvBGSBK2jf5_AAAABg"]
[Fri Feb 06 15:15:41.202968 2026] [:error] [pid 3513:tid 3516] [client 54.180.142.193:33908] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/phpversion.php"] [unique_id "aYWVHTSw3-HAlzpqSxxwNwAAAUE"]
[Fri Feb 06 15:15:41.805616 2026] [:error] [pid 3477:tid 3480] [client 54.180.142.193:33924] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/php_version.php"] [unique_id "aYWVHbL0Hdh40C7HYgUDIAAAAME"]
[Fri Feb 06 15:15:42.401719 2026] [:error] [pid 3477:tid 3491] [client 54.180.142.193:33928] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/serverinfo.php"] [unique_id "aYWVHrL0Hdh40C7HYgUDIgAAAMw"]
[Fri Feb 06 15:15:42.999770 2026] [:error] [pid 3477:tid 3483] [client 54.180.142.193:33934] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/_debug"] [unique_id "aYWVHrL0Hdh40C7HYgUDJgAAAMQ"]
[Fri Feb 06 15:15:43.592610 2026] [:error] [pid 3380:tid 3391] [client 54.180.142.193:33940] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pi.php"] [unique_id "aYWVHxFAlUvBGSBK2jf6AQAAAAc"]
[Fri Feb 06 15:15:44.193834 2026] [:error] [pid 3380:tid 3386] [client 54.180.142.193:33956] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i.php"] [unique_id "aYWVIBFAlUvBGSBK2jf6BgAAAAI"]
[Fri Feb 06 15:15:44.792460 2026] [:error] [pid 3380:tid 3402] [client 54.180.142.193:37576] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "aYWVIBFAlUvBGSBK2jf6CgAAABI"]
[Fri Feb 06 15:15:45.395681 2026] [:error] [pid 3477:tid 3492] [client 54.180.142.193:37582] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t.php"] [unique_id "aYWVIbL0Hdh40C7HYgUDLAAAAM0"]
[Fri Feb 06 15:15:46.002814 2026] [:error] [pid 3513:tid 3536] [client 54.180.142.193:37584] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aYWVIjSw3-HAlzpqSxxwOQAAAVU"]
[Fri Feb 06 15:15:46.606743 2026] [:error] [pid 3513:tid 3533] [client 54.180.142.193:37592] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aYWVIjSw3-HAlzpqSxxwPAAAAVI"]
[Fri Feb 06 15:15:47.206075 2026] [:error] [pid 3382:tid 3443] [client 54.180.142.193:37594] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aYWVI8IgU1HR0rhYrE_bjgAAAIM"]
[Fri Feb 06 15:15:47.805199 2026] [:error] [pid 3382:tid 3455] [client 54.180.142.193:37600] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/diagnostic.php"] [unique_id "aYWVI8IgU1HR0rhYrE_bkAAAAI8"]
[Fri Feb 06 15:15:48.404954 2026] [:error] [pid 3380:tid 3396] [client 54.180.142.193:37616] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/phpinfo.txt"] [unique_id "aYWVJBFAlUvBGSBK2jf6EAAAAAw"]
[Fri Feb 06 15:15:48.998868 2026] [:error] [pid 3381:tid 3420] [client 54.180.142.193:37622] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.txt"] [unique_id "aYWVJC81zqRg96ZREgj_VAAAAEc"]
[Fri Feb 06 15:15:49.593926 2026] [:error] [pid 3513:tid 3516] [client 54.180.142.193:37634] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/phpinfo.html"] [unique_id "aYWVJTSw3-HAlzpqSxxwRgAAAUE"]
[Fri Feb 06 15:15:50.192094 2026] [:error] [pid 3380:tid 3400] [client 54.180.142.193:37638] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.html"] [unique_id "aYWVJhFAlUvBGSBK2jf6FgAAABA"]
[Fri Feb 06 15:15:50.785302 2026] [:error] [pid 3382:tid 3445] [client 54.180.142.193:37644] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/phpinfo.php~"] [unique_id "aYWVJsIgU1HR0rhYrE_bmgAAAIU"]
[Fri Feb 06 15:15:51.388073 2026] [:error] [pid 3380:tid 3385] [client 54.180.142.193:37650] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/phpinfo.php.save"] [unique_id "aYWVJxFAlUvBGSBK2jf6GAAAAAE"]
[Fri Feb 06 15:15:51.983453 2026] [:error] [pid 3382:tid 3454] [client 54.180.142.193:37654] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/info.php"] [unique_id "aYWVJ8IgU1HR0rhYrE_bngAAAI4"]
[Fri Feb 06 15:15:52.580210 2026] [:error] [pid 3513:tid 3539] [client 54.180.142.193:37668] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/phpinfo.php"] [unique_id "aYWVKDSw3-HAlzpqSxxwTwAAAVg"]
[Fri Feb 06 15:15:53.184288 2026] [:error] [pid 3477:tid 3480] [client 54.180.142.193:37670] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/phpinfo.php"] [unique_id "aYWVKbL0Hdh40C7HYgUDPQAAAME"]
[Fri Feb 06 15:15:53.784344 2026] [:error] [pid 3477:tid 3488] [client 54.180.142.193:37676] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v1/phpinfo.php"] [unique_id "aYWVKbL0Hdh40C7HYgUDQAAAAMk"]
[Fri Feb 06 15:15:54.381012 2026] [:error] [pid 3380:tid 3403] [client 54.180.142.193:37678] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2/phpinfo.php"] [unique_id "aYWVKhFAlUvBGSBK2jf6HwAAABM"]
[Fri Feb 06 15:15:54.983642 2026] [:error] [pid 3513:tid 3536] [client 54.180.142.193:41254] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.gitlab-ci.yml"] [unique_id "aYWVKjSw3-HAlzpqSxxwUwAAAVU"]
[Fri Feb 06 15:15:55.580374 2026] [:error] [pid 3477:tid 3499] [client 54.180.142.193:41262] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.gitlab/config"] [unique_id "aYWVK7L0Hdh40C7HYgUDQwAAANQ"]
[Fri Feb 06 15:15:56.175844 2026] [:error] [pid 3381:tid 3429] [client 54.180.142.193:41278] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gitlab/config"] [unique_id "aYWVLC81zqRg96ZREgj_YAAAAFA"]
[Fri Feb 06 15:15:56.767016 2026] [:error] [pid 3513:tid 3525] [client 54.180.142.193:41292] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config/gitlab.json"] [unique_id "aYWVLDSw3-HAlzpqSxxwVQAAAUo"]
[Fri Feb 06 15:15:57.364452 2026] [:error] [pid 3382:tid 3440] [client 54.180.142.193:41298] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.config/git/config"] [unique_id "aYWVLcIgU1HR0rhYrE_bqAAAAIA"]
[Fri Feb 06 15:15:57.960599 2026] [:error] [pid 3380:tid 3402] [client 54.180.142.193:41300] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.config/git/credentials"] [unique_id "aYWVLRFAlUvBGSBK2jf6KAAAABI"]
[Fri Feb 06 15:16:00.108444 2026] [:error] [pid 3382:tid 3454] [client 54.180.142.193:41320] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/pages/9"] [unique_id "aYWVMMIgU1HR0rhYrE_btgAAAI4"]
[Fri Feb 06 15:16:00.709128 2026] [:error] [pid 3513:tid 3530] [client 54.180.142.193:41326] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/feed/"] [unique_id "aYWVMDSw3-HAlzpqSxxwXAAAAU8"]
[Fri Feb 06 15:16:01.429682 2026] [:error] [pid 3380:tid 3404] [client 54.180.142.193:41328] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-json/oembed/1.0/embed"] [unique_id "aYWVMRFAlUvBGSBK2jf6MAAAABQ"]
[Fri Feb 06 15:16:02.032094 2026] [:error] [pid 3381:tid 3423] [client 54.180.142.193:41332] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/comments/feed/"] [unique_id "aYWVMi81zqRg96ZREgj_bgAAAEo"]
[Fri Feb 06 15:16:02.634784 2026] [:error] [pid 3477:tid 3501] [client 54.180.142.193:41342] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-json/oembed/1.0/embed"] [unique_id "aYWVMrL0Hdh40C7HYgUDWQAAANY"]
[Fri Feb 06 15:16:03.229225 2026] [:error] [pid 3381:tid 3435] [client 54.180.142.193:41350] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYWVMy81zqRg96ZREgj_cAAAAFY"]
[Fri Feb 06 15:16:03.985035 2026] [:error] [pid 3382:tid 3449] [client 54.180.142.193:41354] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-json/"] [unique_id "aYWVM8IgU1HR0rhYrE_buAAAAIk"]
[Fri Feb 06 15:16:05.013257 2026] [:error] [pid 3477:tid 3486] [client 54.180.142.193:60708] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/block-library/style.min.css"] [unique_id "aYWVNbL0Hdh40C7HYgUDYQAAAMc"]
[Fri Feb 06 15:16:05.728624 2026] [:error] [pid 3382:tid 3463] [client 54.180.142.193:60714] [client 54.180.142.193] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYWVNcIgU1HR0rhYrE_bvwAAAJc"]
[Fri Feb 06 15:41:39.946545 2026] [:error] [pid 3380:tid 3389] [client 54.169.91.52:34946] [client 54.169.91.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.169.91.52, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYWbMxFAlUvBGSBK2jcMsQAAAAU"]
[Fri Feb 06 16:21:46.618205 2026] [:error] [pid 3381:tid 3425] [client 122.162.146.190:27798] [client 122.162.146.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.162.146.190, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYWkmi81zqRg96ZREggcHQAAAEw"], referer: https://expressinteriors.com/
[Fri Feb 06 17:46:46.417939 2026] [:error] [pid 3380:tid 3392] [client 47.82.118.63:47450] [client 47.82.118.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.82.118.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYW4hhFAlUvBGSBK2jdHGgAAAAg"]
[Fri Feb 06 17:46:49.368323 2026] [:error] [pid 3513:tid 3538] [client 103.196.146.240:50792] [client 103.196.146.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.196.146.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYW4iTSw3-HAlzpqSxywdAAAAVc"]
[Fri Feb 06 17:47:03.630616 2026] [:error] [pid 3381:tid 3416] [client 34.69.68.107:48270] [client 34.69.68.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.68.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYW4ly81zqRg96ZREgg_ZwAAAEM"]
[Fri Feb 06 17:47:12.256656 2026] [:error] [pid 15821:tid 15841] [client 185.73.130.137:48734] [client 185.73.130.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.73.130.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYW4oHARQa67J4c772neVAAAARA"]
[Fri Feb 06 17:47:16.292763 2026] [:error] [pid 3513:tid 3517] [client 47.82.118.63:39654] [client 47.82.118.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.82.118.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYW4pDSw3-HAlzpqSxywnQAAAUI"]
[Fri Feb 06 17:47:22.266090 2026] [:error] [pid 3477:tid 3495] [client 103.242.13.14:52044] [client 103.242.13.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.242.13.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYW4qrL0Hdh40C7HYgVDjAAAANA"]
[Fri Feb 06 17:47:26.919756 2026] [:error] [pid 3513:tid 3539] [client 103.196.146.240:49662] [client 103.196.146.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.196.146.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYW4rjSw3-HAlzpqSxywowAAAVg"]
[Fri Feb 06 17:48:08.834694 2026] [:error] [pid 3382:tid 3444] [client 104.244.79.40:36122] [client 104.244.79.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.244.79.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYW42MIgU1HR0rhYrE8Z9wAAAIQ"]
[Fri Feb 06 19:09:16.108286 2026] [:error] [pid 3382:tid 3459] [client 98.159.108.144:43796] [client 98.159.108.144] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/feed/"] [unique_id "aYXL3MIgU1HR0rhYrE8xXwAAAJM"]
[Fri Feb 06 19:33:46.895742 2026] [:error] [pid 3382:tid 3446] [client 107.180.117.184:58186] [client 107.180.117.184] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.117.184, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXRmsIgU1HR0rhYrE83bgAAAIY"]
[Fri Feb 06 19:33:48.127508 2026] [:error] [pid 3382:tid 3457] [client 107.180.117.184:58186] [client 107.180.117.184] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.117.184, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXRnMIgU1HR0rhYrE83cAAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 19:34:23.798499 2026] [:error] [pid 37019:tid 37042] [client 103.28.36.200:50758] [client 103.28.36.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXRvwkAjqd3bcgYBrtW9gAAAhU"]
[Fri Feb 06 19:34:24.762753 2026] [:error] [pid 37019:tid 37035] [client 103.28.36.200:50758] [client 103.28.36.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXRwAkAjqd3bcgYBrtW-AAAAg4"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 19:36:09.119782 2026] [:error] [pid 3513:tid 3526] [client 64.225.25.250:60292] [client 64.225.25.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.225.25.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXSKTSw3-HAlzpqSxzGcAAAAUs"]
[Fri Feb 06 19:36:10.048815 2026] [:error] [pid 3513:tid 3528] [client 64.225.25.250:60292] [client 64.225.25.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.225.25.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXSKjSw3-HAlzpqSxzGcQAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 19:36:52.345928 2026] [:error] [pid 3381:tid 3414] [client 65.254.225.214:34576] [client 65.254.225.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.214, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXSVC81zqRg96ZREghZKAAAAEE"]
[Fri Feb 06 19:36:53.244411 2026] [:error] [pid 3381:tid 3436] [client 65.254.225.214:34576] [client 65.254.225.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.214, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXSVS81zqRg96ZREghZKgAAAFc"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 19:37:53.031203 2026] [:error] [pid 3381:tid 3414] [client 163.245.209.119:34270] [client 163.245.209.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 163.245.209.119, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXSkS81zqRg96ZREghZYAAAAEE"]
[Fri Feb 06 19:37:53.962475 2026] [:error] [pid 3381:tid 3429] [client 163.245.209.119:34270] [client 163.245.209.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 163.245.209.119, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXSkS81zqRg96ZREghZYgAAAFA"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 19:38:42.831432 2026] [:error] [pid 3381:tid 3421] [client 157.230.226.169:49276] [client 157.230.226.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.226.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXSwi81zqRg96ZREghZcgAAAEg"]
[Fri Feb 06 19:38:43.776830 2026] [:error] [pid 3381:tid 3414] [client 157.230.226.169:49276] [client 157.230.226.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.226.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXSwy81zqRg96ZREghZcwAAAEE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 19:39:30.927429 2026] [:error] [pid 15821:tid 15825] [client 3.7.184.189:57212] [client 3.7.184.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.7.184.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXS8nARQa67J4c772n9UAAAAQA"]
[Fri Feb 06 19:39:31.909982 2026] [:error] [pid 15821:tid 15842] [client 3.7.184.189:57212] [client 3.7.184.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.7.184.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXS83ARQa67J4c772n9UgAAARE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 19:41:27.588248 2026] [:error] [pid 3477:tid 3501] [client 184.168.104.3:44722] [client 184.168.104.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 184.168.104.3, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXTZ7L0Hdh40C7HYgVeVQAAANY"]
[Fri Feb 06 19:41:28.556316 2026] [:error] [pid 3477:tid 3484] [client 184.168.104.3:44722] [client 184.168.104.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 184.168.104.3, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXTaLL0Hdh40C7HYgVeWgAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 19:45:40.405654 2026] [:error] [pid 3380:tid 3389] [client 132.148.182.144:21454] [client 132.148.182.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 132.148.182.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXUZBFAlUvBGSBK2jdbUgAAAAU"]
[Fri Feb 06 19:45:41.362650 2026] [:error] [pid 3380:tid 3387] [client 132.148.182.144:21454] [client 132.148.182.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 132.148.182.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXUZRFAlUvBGSBK2jdbUwAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 19:47:00.027052 2026] [:error] [pid 3477:tid 3498] [client 152.53.90.232:54480] [client 152.53.90.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.53.90.232, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXUtLL0Hdh40C7HYgVfZgAAANM"]
[Fri Feb 06 19:47:01.083152 2026] [:error] [pid 3477:tid 3487] [client 152.53.90.232:54480] [client 152.53.90.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.53.90.232, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXUtbL0Hdh40C7HYgVfawAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 19:47:08.615464 2026] [:error] [pid 3382:tid 3441] [client 162.254.34.241:42152] [client 162.254.34.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.254.34.241, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXUvMIgU1HR0rhYrE87GAAAAIE"]
[Fri Feb 06 19:47:09.530389 2026] [:error] [pid 3382:tid 3460] [client 162.254.34.241:42152] [client 162.254.34.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.254.34.241, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXUvcIgU1HR0rhYrE87GgAAAJQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 19:47:09.605617 2026] [:error] [pid 36928:tid 36932] [client 107.180.113.88:52658] [client 107.180.113.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.113.88, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXUvZs7fyU8D36r-OplAgAAAcA"]
[Fri Feb 06 19:47:10.496223 2026] [:error] [pid 36928:tid 36956] [client 107.180.113.88:52658] [client 107.180.113.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.113.88, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXUvps7fyU8D36r-OplAwAAAdg"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 19:47:44.782272 2026] [:error] [pid 3381:tid 3429] [client 154.0.170.193:53890] [client 154.0.170.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.0.170.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXU4C81zqRg96ZREghbUAAAAFA"]
[Fri Feb 06 19:47:46.076694 2026] [:error] [pid 3381:tid 3424] [client 154.0.170.193:53890] [client 154.0.170.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.0.170.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXU4i81zqRg96ZREghbUQAAAEs"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 19:48:39.954192 2026] [:error] [pid 3382:tid 3447] [client 213.160.71.14:39954] [client 213.160.71.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.160.71.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXVF8IgU1HR0rhYrE87fwAAAIc"]
[Fri Feb 06 19:48:41.117610 2026] [:error] [pid 3382:tid 3464] [client 213.160.71.14:39954] [client 213.160.71.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.160.71.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXVGcIgU1HR0rhYrE87gAAAAJg"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 19:50:02.330092 2026] [:error] [pid 3381:tid 3418] [client 154.0.170.193:53928] [client 154.0.170.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.0.170.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXVai81zqRg96ZREghbpAAAAEU"]
[Fri Feb 06 19:50:03.577118 2026] [:error] [pid 3381:tid 3423] [client 154.0.170.193:53928] [client 154.0.170.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.0.170.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXVay81zqRg96ZREghbpQAAAEo"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 19:51:00.650846 2026] [:error] [pid 3513:tid 3533] [client 154.53.39.25:46276] [client 154.53.39.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.53.39.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXVpDSw3-HAlzpqSxzIPAAAAVI"]
[Fri Feb 06 19:51:04.469322 2026] [:error] [pid 3513:tid 3534] [client 154.53.39.25:46276] [client 154.53.39.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.53.39.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXVqDSw3-HAlzpqSxzIPwAAAVM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 19:51:20.107107 2026] [:error] [pid 37019:tid 37034] [client 162.241.203.12:31114] [client 162.241.203.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.203.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXVuAkAjqd3bcgYBrtZRQAAAg0"]
[Fri Feb 06 19:51:21.957491 2026] [:error] [pid 37019:tid 37025] [client 162.241.203.12:31114] [client 162.241.203.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.203.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXVuQkAjqd3bcgYBrtZRwAAAgQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 19:52:14.623919 2026] [:error] [pid 37019:tid 37024] [client 154.0.170.193:40998] [client 154.0.170.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.0.170.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXV7gkAjqd3bcgYBrtZdwAAAgM"]
[Fri Feb 06 19:52:16.681450 2026] [:error] [pid 37019:tid 37038] [client 154.0.170.193:40998] [client 154.0.170.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.0.170.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXV8AkAjqd3bcgYBrtZewAAAhE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 19:53:27.644361 2026] [:error] [pid 3513:tid 3533] [client 69.49.241.126:44370] [client 69.49.241.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.241.126, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXWNzSw3-HAlzpqSxzItgAAAVI"]
[Fri Feb 06 19:53:29.070196 2026] [:error] [pid 3513:tid 3537] [client 69.49.241.126:44370] [client 69.49.241.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.241.126, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXWOTSw3-HAlzpqSxzItwAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 19:58:18.696095 2026] [:error] [pid 36857:tid 36870] [client 103.13.103.146:57360] [client 103.13.103.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.13.103.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXXWpVQwfj7Kp4Dd0Hm2gAAAYs"]
[Fri Feb 06 19:58:21.122933 2026] [:error] [pid 36857:tid 36863] [client 103.13.103.146:57360] [client 103.13.103.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.13.103.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXXXZVQwfj7Kp4Dd0Hm3AAAAYQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:03:46.073853 2026] [:error] [pid 15821:tid 15826] [client 68.183.235.102:58856] [client 68.183.235.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.183.235.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXYonARQa67J4c772kBVAAAAQE"]
[Fri Feb 06 20:04:07.018087 2026] [:error] [pid 3477:tid 3481] [client 68.183.235.102:45910] [client 68.183.235.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.183.235.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXYt7L0Hdh40C7HYgVjDQAAAMI"]
[Fri Feb 06 20:04:16.786768 2026] [:error] [pid 3513:tid 3517] [client 134.209.145.63:50340] [client 134.209.145.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.209.145.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYXYwDSw3-HAlzpqSxzJ5AAAAUI"]
[Fri Feb 06 20:04:48.777957 2026] [:error] [pid 3382:tid 3444] [client 202.254.239.44:53462] [client 202.254.239.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.254.239.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXY4MIgU1HR0rhYrE9ATgAAAIQ"]
[Fri Feb 06 20:04:49.716651 2026] [:error] [pid 3382:tid 3445] [client 202.254.239.44:53462] [client 202.254.239.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.254.239.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXY4cIgU1HR0rhYrE9ATwAAAIU"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:05:32.695497 2026] [:error] [pid 3381:tid 3421] [client 1.53.205.48:54994] [client 1.53.205.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 1.53.205.48, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXZDC81zqRg96ZREgheogAAAEg"]
[Fri Feb 06 20:07:47.407305 2026] [:error] [pid 3477:tid 3483] [client 162.0.216.102:51352] [client 162.0.216.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.216.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXZk7L0Hdh40C7HYgVkaAAAAMQ"]
[Fri Feb 06 20:07:48.945759 2026] [:error] [pid 3477:tid 3486] [client 162.0.216.102:51352] [client 162.0.216.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.216.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXZlLL0Hdh40C7HYgVkbAAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:13:30.335460 2026] [:error] [pid 3380:tid 3392] [client 3.23.166.38:39270] [client 3.23.166.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.23.166.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXa6hFAlUvBGSBK2jde6AAAAAg"]
[Fri Feb 06 20:13:33.290613 2026] [:error] [pid 3380:tid 3403] [client 3.23.166.38:39270] [client 3.23.166.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.23.166.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXa7RFAlUvBGSBK2jde6gAAABM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:15:47.060502 2026] [:error] [pid 36928:tid 36940] [client 152.53.90.232:56212] [client 152.53.90.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.90.232, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYXbc5s7fyU8D36r-Opo0AAAAcg"]
[Fri Feb 06 20:17:42.651576 2026] [:error] [pid 37019:tid 37021] [client 213.145.94.73:51226] [client 213.145.94.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.145.94.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXb5gkAjqd3bcgYBrtdWgAAAgA"]
[Fri Feb 06 20:17:43.694368 2026] [:error] [pid 37019:tid 37033] [client 213.145.94.73:51226] [client 213.145.94.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.145.94.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXb5wkAjqd3bcgYBrtdWwAAAgw"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:20:15.514376 2026] [:error] [pid 3381:tid 3426] [client 198.71.60.118:52042] [client 198.71.60.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.71.60.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXcfy81zqRg96ZREghhogAAAE0"]
[Fri Feb 06 20:20:16.780587 2026] [:error] [pid 3381:tid 3420] [client 198.71.60.118:52042] [client 198.71.60.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.71.60.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXcgC81zqRg96ZREghhpQAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:20:58.287494 2026] [:error] [pid 3477:tid 3481] [client 38.49.208.84:56624] [client 38.49.208.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.49.208.84, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXcqrL0Hdh40C7HYgVnJwAAAMI"]
[Fri Feb 06 20:20:59.256868 2026] [:error] [pid 3477:tid 3491] [client 38.49.208.84:56624] [client 38.49.208.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.49.208.84, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXcq7L0Hdh40C7HYgVnKgAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:21:03.718893 2026] [:error] [pid 3513:tid 3516] [client 57.128.176.122:52308] [client 57.128.176.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 57.128.176.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXcrzSw3-HAlzpqSxzMIwAAAUE"]
[Fri Feb 06 20:21:19.836976 2026] [:error] [pid 37019:tid 37034] [client 122.175.189.80:52276] [client 122.175.189.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 122.175.189.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXcvwkAjqd3bcgYBrtd2wAAAg0"]
[Fri Feb 06 20:21:20.871398 2026] [:error] [pid 37019:tid 37043] [client 122.175.189.80:52276] [client 122.175.189.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 122.175.189.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXcwAkAjqd3bcgYBrtd3QAAAhY"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:21:38.047704 2026] [:error] [pid 36928:tid 36937] [client 57.128.176.122:58716] [client 57.128.176.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 57.128.176.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXc0ps7fyU8D36r-OppeAAAAcU"]
[Fri Feb 06 20:21:42.605058 2026] [:error] [pid 36928:tid 36934] [client 57.128.176.122:58716] [client 57.128.176.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 57.128.176.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXc1ps7fyU8D36r-OppfQAAAcI"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:22:15.923782 2026] [:error] [pid 15821:tid 15847] [client 195.248.230.30:43560] [client 195.248.230.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.248.230.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXc93ARQa67J4c772kEkQAAARY"]
[Fri Feb 06 20:22:17.849490 2026] [:error] [pid 15821:tid 15839] [client 195.248.230.30:43560] [client 195.248.230.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.248.230.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXc-XARQa67J4c772kEkwAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:22:31.510180 2026] [:error] [pid 46432:tid 46441] [client 188.191.147.38:41554] [client 188.191.147.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.191.147.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXdBwbwJwu_od0kZjMgnwAAAkc"]
[Fri Feb 06 20:22:33.004580 2026] [:error] [pid 46432:tid 46439] [client 188.191.147.38:41554] [client 188.191.147.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.191.147.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXdCQbwJwu_od0kZjMgoAAAAkU"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:24:53.519872 2026] [:error] [pid 3382:tid 3441] [client 136.112.41.9:49607] [client 136.112.41.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.41.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYXdlcIgU1HR0rhYrE9GHwAAAIE"]
[Fri Feb 06 20:24:55.663698 2026] [:error] [pid 3382:tid 3452] [client 136.112.41.9:49607] [client 136.112.41.9] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYXdl8IgU1HR0rhYrE9GIgAAAIw"]
[Fri Feb 06 20:24:55.862627 2026] [:error] [pid 3382:tid 3445] [client 136.112.41.9:49607] [client 136.112.41.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.41.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYXdl8IgU1HR0rhYrE9GIwAAAIU"]
[Fri Feb 06 20:24:57.243268 2026] [:error] [pid 3380:tid 3387] [client 136.112.41.9:61282] [client 136.112.41.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.41.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYXdmRFAlUvBGSBK2jdgiwAAAAM"]
[Fri Feb 06 20:24:58.778462 2026] [:error] [pid 3382:tid 3457] [client 136.112.41.9:50333] [client 136.112.41.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.41.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYXdmsIgU1HR0rhYrE9GJgAAAJE"]
[Fri Feb 06 20:25:00.225595 2026] [:error] [pid 3382:tid 3453] [client 136.112.41.9:65003] [client 136.112.41.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.41.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYXdnMIgU1HR0rhYrE9GLAAAAI0"]
[Fri Feb 06 20:25:01.784310 2026] [:error] [pid 36928:tid 36954] [client 136.112.41.9:49273] [client 136.112.41.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.41.9, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYXdnZs7fyU8D36r-OpqLQAAAdY"]
[Fri Feb 06 20:25:01.784438 2026] [:error] [pid 36928:tid 36954] [client 136.112.41.9:49273] [client 136.112.41.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 136.112.41.9, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYXdnZs7fyU8D36r-OpqLQAAAdY"]
[Fri Feb 06 20:32:21.476061 2026] [:error] [pid 36928:tid 36952] [client 185.180.207.133:35702] [client 185.180.207.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.180.207.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXfVZs7fyU8D36r-OprugAAAdQ"]
[Fri Feb 06 20:32:22.531374 2026] [:error] [pid 36928:tid 36941] [client 185.180.207.133:35702] [client 185.180.207.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.180.207.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXfVps7fyU8D36r-OprvAAAAck"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:32:48.454328 2026] [:error] [pid 3382:tid 3440] [client 157.230.226.169:36580] [client 157.230.226.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.226.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXfcMIgU1HR0rhYrE9JJgAAAIA"]
[Fri Feb 06 20:32:49.425015 2026] [:error] [pid 3382:tid 3457] [client 157.230.226.169:36580] [client 157.230.226.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.226.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXfccIgU1HR0rhYrE9JKAAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:33:58.373405 2026] [:error] [pid 15821:tid 15839] [client 82.165.88.170:54628] [client 82.165.88.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.165.88.170, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXftnARQa67J4c772kHbgAAAQ4"]
[Fri Feb 06 20:33:59.322050 2026] [:error] [pid 15821:tid 15841] [client 82.165.88.170:54628] [client 82.165.88.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.165.88.170, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXft3ARQa67J4c772kHbwAAARA"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:34:40.848653 2026] [:error] [pid 15821:tid 15839] [client 65.7.17.58:58900] [client 65.7.17.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.7.17.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXf4HARQa67J4c772kHlgAAAQ4"]
[Fri Feb 06 20:34:43.266264 2026] [:error] [pid 15821:tid 15845] [client 65.7.17.58:58900] [client 65.7.17.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.7.17.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXf43ARQa67J4c772kHlwAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:35:14.702223 2026] [:error] [pid 3380:tid 3408] [client 198.71.60.118:57404] [client 198.71.60.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.71.60.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXgAhFAlUvBGSBK2jdiIQAAABg"]
[Fri Feb 06 20:35:28.971451 2026] [:error] [pid 3380:tid 3396] [client 78.128.60.70:56242] [client 78.128.60.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.128.60.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXgEBFAlUvBGSBK2jdiPAAAAAw"]
[Fri Feb 06 20:35:30.516231 2026] [:error] [pid 3380:tid 3405] [client 78.128.60.70:56242] [client 78.128.60.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.128.60.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXgEhFAlUvBGSBK2jdiPQAAABU"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:35:55.125566 2026] [:error] [pid 37019:tid 37031] [client 57.128.176.122:56928] [client 57.128.176.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 57.128.176.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXgKwkAjqd3bcgYBrthJwAAAgo"]
[Fri Feb 06 20:35:56.773240 2026] [:error] [pid 37019:tid 37028] [client 57.128.176.122:56928] [client 57.128.176.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 57.128.176.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXgLAkAjqd3bcgYBrthKAAAAgc"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:36:20.766340 2026] [:error] [pid 3381:tid 3423] [client 64.227.151.198:34900] [client 64.227.151.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.151.198, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXgRC81zqRg96ZREghlvwAAAEo"]
[Fri Feb 06 20:36:22.514939 2026] [:error] [pid 3381:tid 3417] [client 64.227.151.198:34900] [client 64.227.151.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.151.198, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXgRi81zqRg96ZREghlwQAAAEQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:38:17.573119 2026] [:error] [pid 37019:tid 37045] [client 72.167.134.85:36450] [client 72.167.134.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 72.167.134.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXguQkAjqd3bcgYBrthbwAAAhg"]
[Fri Feb 06 20:38:18.534890 2026] [:error] [pid 37019:tid 37035] [client 72.167.134.85:36450] [client 72.167.134.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 72.167.134.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXgugkAjqd3bcgYBrthcQAAAg4"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:44:16.526382 2026] [:error] [pid 36857:tid 36859] [client 185.118.190.165:33114] [client 185.118.190.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.118.190.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXiIJVQwfj7Kp4Dd0HuVAAAAYA"]
[Fri Feb 06 20:44:18.262151 2026] [:error] [pid 36857:tid 36875] [client 185.118.190.165:33114] [client 185.118.190.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.118.190.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXiIpVQwfj7Kp4Dd0HuVgAAAZA"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:47:04.171833 2026] [:error] [pid 3477:tid 3485] [client 147.124.215.30:47046] [client 147.124.215.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 147.124.215.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXiyLL0Hdh40C7HYgVt6wAAAMY"]
[Fri Feb 06 20:47:05.106749 2026] [:error] [pid 3477:tid 3480] [client 147.124.215.30:47046] [client 147.124.215.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 147.124.215.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXiybL0Hdh40C7HYgVt7gAAAME"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:48:21.647463 2026] [:error] [pid 3477:tid 3484] [client 103.145.51.249:58282] [client 103.145.51.249] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.145.51.249, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXjFbL0Hdh40C7HYgVuRAAAAMU"]
[Fri Feb 06 20:48:22.912246 2026] [:error] [pid 3477:tid 3490] [client 103.145.51.249:58282] [client 103.145.51.249] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.145.51.249, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXjFrL0Hdh40C7HYgVuSAAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:48:42.270195 2026] [:error] [pid 36857:tid 36862] [client 192.163.196.216:43488] [client 192.163.196.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.163.196.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXjKpVQwfj7Kp4Dd0Hu5AAAAYM"]
[Fri Feb 06 20:48:43.621584 2026] [:error] [pid 36857:tid 36865] [client 192.163.196.216:43488] [client 192.163.196.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.163.196.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXjK5VQwfj7Kp4Dd0Hu6AAAAYY"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:49:58.439365 2026] [:error] [pid 15821:tid 15828] [client 82.223.245.250:49044] [client 82.223.245.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.245.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXjdnARQa67J4c772kKEQAAAQM"]
[Fri Feb 06 20:50:03.179077 2026] [:error] [pid 15821:tid 15827] [client 82.223.245.250:49044] [client 82.223.245.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.245.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXje3ARQa67J4c772kKFgAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:50:21.646062 2026] [:error] [pid 36928:tid 36938] [client 81.22.243.161:40106] [client 81.22.243.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.22.243.161, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXjjZs7fyU8D36r-OpuXwAAAcY"]
[Fri Feb 06 20:50:23.188438 2026] [:error] [pid 36928:tid 36951] [client 81.22.243.161:40106] [client 81.22.243.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.22.243.161, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXjj5s7fyU8D36r-OpuZAAAAdM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:50:53.046441 2026] [:error] [pid 46432:tid 46442] [client 185.217.127.100:38726] [client 185.217.127.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.217.127.100, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXjrQbwJwu_od0kZjMmMgAAAkg"]
[Fri Feb 06 20:50:53.953067 2026] [:error] [pid 46432:tid 46455] [client 185.217.127.100:38726] [client 185.217.127.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.217.127.100, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXjrQbwJwu_od0kZjMmMwAAAlU"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:52:59.807479 2026] [:error] [pid 36928:tid 36944] [client 213.160.71.14:52270] [client 213.160.71.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.160.71.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXkK5s7fyU8D36r-OpusAAAAcw"]
[Fri Feb 06 20:53:00.799754 2026] [:error] [pid 36928:tid 36936] [client 213.160.71.14:52270] [client 213.160.71.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.160.71.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXkLJs7fyU8D36r-OpusgAAAcQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:53:10.407438 2026] [:error] [pid 3382:tid 3445] [client 81.22.243.161:52404] [client 81.22.243.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.22.243.161, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXkNsIgU1HR0rhYrE9QfQAAAIU"]
[Fri Feb 06 20:53:13.192270 2026] [:error] [pid 3382:tid 3440] [client 81.22.243.161:52404] [client 81.22.243.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.22.243.161, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXkOcIgU1HR0rhYrE9QggAAAIA"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 20:57:18.476606 2026] [:error] [pid 3380:tid 3391] [client 49.247.31.241:39133] [client 49.247.31.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.247.31.241, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYXlLhFAlUvBGSBK2jdlPgAAAAc"]
[Fri Feb 06 20:59:35.917942 2026] [:error] [pid 3382:tid 3442] [client 185.118.190.165:38572] [client 185.118.190.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.118.190.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXlt8IgU1HR0rhYrE9SfgAAAII"]
[Fri Feb 06 20:59:52.006927 2026] [:error] [pid 3381:tid 3423] [client 185.118.190.165:50104] [client 185.118.190.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.118.190.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXlyC81zqRg96ZREghqjAAAAEo"]
[Fri Feb 06 20:59:55.367839 2026] [:error] [pid 3381:tid 3414] [client 185.118.190.165:50104] [client 185.118.190.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.118.190.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXlyy81zqRg96ZREghqjgAAAEE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:00:36.888610 2026] [:error] [pid 3513:tid 3538] [client 213.160.71.14:57424] [client 213.160.71.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.160.71.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXl9DSw3-HAlzpqSxzRvgAAAVc"]
[Fri Feb 06 21:05:41.789876 2026] [:error] [pid 46432:tid 46456] [client 76.13.70.145:50276] [client 76.13.70.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 76.13.70.145, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXnJQbwJwu_od0kZjMo6gAAAlY"]
[Fri Feb 06 21:06:00.357592 2026] [:error] [pid 3382:tid 3462] [client 154.82.170.248:59400] [client 154.82.170.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.82.170.248, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXnOMIgU1HR0rhYrE9UIQAAAJY"]
[Fri Feb 06 21:06:03.605270 2026] [:error] [pid 46432:tid 46441] [client 154.199.69.212:16648] [client 154.199.69.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.199.69.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXnOwbwJwu_od0kZjMo_QAAAkc"], referer: http://expressinteriors.com/wp-login.php
[Fri Feb 06 21:06:06.865634 2026] [:error] [pid 3477:tid 3488] [client 156.239.193.113:25696] [client 156.239.193.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYXnPrL0Hdh40C7HYgVy8AAAAMk"]
[Fri Feb 06 21:06:08.428974 2026] [:error] [pid 36857:tid 36862] [client 45.206.73.28:45582] [client 45.206.73.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.206.73.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXnQJVQwfj7Kp4Dd0HxOwAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:06:08.432352 2026] [:error] [pid 36857:tid 36862] [client 45.206.73.28:45582] [client 45.206.73.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXnQJVQwfj7Kp4Dd0HxOwAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:06:09.884723 2026] [:error] [pid 3513:tid 3532] [client 154.82.169.69:16880] [client 154.82.169.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.82.169.69, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXnQTSw3-HAlzpqSxzSSwAAAVE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:06:09.888754 2026] [:error] [pid 3513:tid 3532] [client 154.82.169.69:16880] [client 154.82.169.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXnQTSw3-HAlzpqSxzSSwAAAVE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:06:12.582815 2026] [:error] [pid 3381:tid 3420] [client 156.239.218.43:49366] [client 156.239.218.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.218.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXnRC81zqRg96ZREghriAAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:06:12.586170 2026] [:error] [pid 3381:tid 3420] [client 156.239.218.43:49366] [client 156.239.218.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXnRC81zqRg96ZREghriAAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:06:13.984813 2026] [:error] [pid 37019:tid 37022] [client 154.86.113.121:26170] [client 154.86.113.121] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.86.113.121, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXnRQkAjqd3bcgYBrtleAAAAgE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:06:13.990472 2026] [:error] [pid 37019:tid 37022] [client 154.86.113.121:26170] [client 154.86.113.121] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXnRQkAjqd3bcgYBrtleAAAAgE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:06:15.525778 2026] [:error] [pid 36857:tid 36874] [client 156.239.204.235:54770] [client 156.239.204.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.204.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXnR5VQwfj7Kp4Dd0HxQgAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:06:15.530006 2026] [:error] [pid 36857:tid 36874] [client 156.239.204.235:54770] [client 156.239.204.235] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXnR5VQwfj7Kp4Dd0HxQgAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:12:59.859838 2026] [:error] [pid 3380:tid 3388] [client 51.195.116.187:38024] [client 51.195.116.187] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.195.116.187, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXo2xFAlUvBGSBK2jdnawAAAAQ"]
[Fri Feb 06 21:13:10.512207 2026] [:error] [pid 3381:tid 3433] [client 51.195.116.187:41108] [client 51.195.116.187] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.195.116.187, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXo5i81zqRg96ZREghtOQAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:16:13.509135 2026] [:error] [pid 36928:tid 36944] [client 157.20.159.163:37516] [client 157.20.159.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.20.159.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXpnZs7fyU8D36r-OpyKgAAAcw"]
[Fri Feb 06 21:16:16.187256 2026] [:error] [pid 3380:tid 3389] [client 157.20.159.163:37526] [client 157.20.159.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.20.159.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXpoBFAlUvBGSBK2jdoBgAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:16:20.642664 2026] [:error] [pid 36857:tid 36875] [client 185.217.127.100:50736] [client 185.217.127.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.217.127.100, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXppJVQwfj7Kp4Dd0HyogAAAZA"]
[Fri Feb 06 21:16:22.876303 2026] [:error] [pid 46432:tid 46441] [client 185.217.127.100:50740] [client 185.217.127.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.217.127.100, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXppgbwJwu_od0kZjMrHwAAAkc"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:16:57.502304 2026] [:error] [pid 3381:tid 3433] [client 72.167.134.85:35612] [client 72.167.134.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 72.167.134.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXpyS81zqRg96ZREghuDAAAAFQ"]
[Fri Feb 06 21:16:58.722732 2026] [:error] [pid 3381:tid 3421] [client 72.167.134.85:35612] [client 72.167.134.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 72.167.134.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXpyi81zqRg96ZREghuDQAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:17:58.436755 2026] [:error] [pid 15821:tid 15839] [client 35.91.35.38:36898] [client 35.91.35.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.91.35.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXqBnARQa67J4c772kO7wAAAQ4"]
[Fri Feb 06 21:18:03.315462 2026] [:error] [pid 3513:tid 3521] [client 35.91.35.38:59566] [client 35.91.35.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.91.35.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXqCzSw3-HAlzpqSxzUJAAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:18:37.799698 2026] [:error] [pid 3380:tid 3392] [client 3.7.184.189:40892] [client 3.7.184.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.7.184.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXqLRFAlUvBGSBK2jdoTAAAAAg"]
[Fri Feb 06 21:18:39.963200 2026] [:error] [pid 3477:tid 3502] [client 3.7.184.189:44352] [client 3.7.184.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.7.184.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXqL7L0Hdh40C7HYgV19wAAANc"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:19:02.451218 2026] [:error] [pid 3380:tid 3398] [client 63.176.224.195:56278] [client 63.176.224.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.176.224.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXqRhFAlUvBGSBK2jdoXAAAAA4"]
[Fri Feb 06 21:19:03.414945 2026] [:error] [pid 3380:tid 3403] [client 63.176.224.195:56278] [client 63.176.224.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.176.224.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXqRxFAlUvBGSBK2jdoXQAAABM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:19:08.760505 2026] [:error] [pid 37019:tid 37030] [client 185.217.127.100:56398] [client 185.217.127.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.217.127.100, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXqTAkAjqd3bcgYBrtnYgAAAgk"]
[Fri Feb 06 21:19:11.484333 2026] [:error] [pid 37019:tid 37022] [client 185.217.127.100:56398] [client 185.217.127.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.217.127.100, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXqTwkAjqd3bcgYBrtnZQAAAgE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:23:42.384630 2026] [:error] [pid 3513:tid 3516] [client 3.82.50.143:43724] [client 3.82.50.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aYXrXjSw3-HAlzpqSxzVLAAAAUE"]
[Fri Feb 06 21:24:52.278482 2026] [:error] [pid 3477:tid 3479] [client 63.250.44.53:59512] [client 63.250.44.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.44.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXrpLL0Hdh40C7HYgV3gAAAAMA"]
[Fri Feb 06 21:24:54.740882 2026] [:error] [pid 3382:tid 3453] [client 63.250.44.53:46802] [client 63.250.44.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.44.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXrpsIgU1HR0rhYrE9bCAAAAI0"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:34:03.890273 2026] [:error] [pid 37019:tid 37039] [client 162.55.14.58:56872] [client 162.55.14.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.55.14.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXtywkAjqd3bcgYBrtqkAAAAhI"]
[Fri Feb 06 21:34:05.920433 2026] [:error] [pid 3380:tid 3401] [client 162.55.14.58:36768] [client 162.55.14.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.55.14.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXtzRFAlUvBGSBK2jdqrgAAABE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:39:48.243159 2026] [:error] [pid 3381:tid 3423] [client 136.243.21.235:45840] [client 136.243.21.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.243.21.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXvJC81zqRg96ZREghy6wAAAEo"]
[Fri Feb 06 21:39:50.082875 2026] [:error] [pid 3380:tid 3397] [client 136.243.21.235:58932] [client 136.243.21.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.243.21.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXvJhFAlUvBGSBK2jdrcgAAAA0"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:40:33.170225 2026] [:error] [pid 3382:tid 3441] [client 217.195.196.83:41796] [client 217.195.196.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.195.196.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXvUcIgU1HR0rhYrE9fsQAAAIE"]
[Fri Feb 06 21:40:41.998935 2026] [:error] [pid 37019:tid 37029] [client 217.195.196.83:58858] [client 217.195.196.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.195.196.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXvWQkAjqd3bcgYBrtr6wAAAgg"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:40:49.936613 2026] [:error] [pid 15821:tid 15840] [client 34.73.126.11:33964] [client 34.73.126.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.73.126.11, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXvYXARQa67J4c772kTGQAAAQ8"]
[Fri Feb 06 21:40:55.911792 2026] [:error] [pid 46432:tid 46434] [client 34.73.126.11:36232] [client 34.73.126.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.73.126.11, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXvZwbwJwu_od0kZjMv2QAAAkA"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:43:32.382336 2026] [:error] [pid 46432:tid 46444] [client 52.140.96.215:54642] [client 52.140.96.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.140.96.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXwBAbwJwu_od0kZjMwGgAAAko"]
[Fri Feb 06 21:43:34.345039 2026] [:error] [pid 3477:tid 3497] [client 52.140.96.215:54654] [client 52.140.96.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.140.96.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXwBrL0Hdh40C7HYgV7OgAAANI"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:44:00.414103 2026] [:error] [pid 46432:tid 46458] [client 31.220.151.86:16696] [client 31.220.151.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.220.151.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXwIAbwJwu_od0kZjMwIwAAAlg"]
[Fri Feb 06 21:44:02.125339 2026] [:error] [pid 3513:tid 3528] [client 31.220.151.86:16704] [client 31.220.151.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.220.151.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXwIjSw3-HAlzpqSxzX6gAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:46:22.189250 2026] [:error] [pid 3477:tid 3487] [client 49.247.31.241:30554] [client 49.247.31.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 49.247.31.241, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXwrrL0Hdh40C7HYgV7sAAAAMg"]
[Fri Feb 06 21:46:32.003687 2026] [:error] [pid 3513:tid 3523] [client 49.247.31.241:2056] [client 49.247.31.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 49.247.31.241, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXwuDSw3-HAlzpqSxzYPAAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:48:36.661851 2026] [:error] [pid 3382:tid 3450] [client 136.243.21.235:49658] [client 136.243.21.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.243.21.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXxNMIgU1HR0rhYrE9hzAAAAIo"]
[Fri Feb 06 21:49:25.006745 2026] [:error] [pid 15821:tid 15837] [client 188.191.147.38:51240] [client 188.191.147.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.191.147.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXxZXARQa67J4c772kUaQAAAQw"]
[Fri Feb 06 21:49:26.368432 2026] [:error] [pid 15821:tid 15844] [client 188.191.147.38:51240] [client 188.191.147.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.191.147.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXxZnARQa67J4c772kUagAAARM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:53:12.063916 2026] [:error] [pid 46432:tid 46443] [client 54.37.85.6:52970] [client 54.37.85.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.37.85.6, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXySAbwJwu_od0kZjMxsgAAAkk"]
[Fri Feb 06 21:53:16.726677 2026] [:error] [pid 3382:tid 3453] [client 54.37.85.6:37738] [client 54.37.85.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.37.85.6, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXyTMIgU1HR0rhYrE9i9QAAAI0"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:53:16.882041 2026] [:error] [pid 15821:tid 15848] [client 152.53.90.232:42002] [client 152.53.90.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.53.90.232, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXyTHARQa67J4c772kVKAAAARc"]
[Fri Feb 06 21:53:19.069515 2026] [:error] [pid 15821:tid 15845] [client 152.53.90.232:42002] [client 152.53.90.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.53.90.232, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXyT3ARQa67J4c772kVKQAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:53:58.870274 2026] [:error] [pid 3477:tid 3490] [client 3.7.184.189:45098] [client 3.7.184.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.7.184.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXydrL0Hdh40C7HYgV9fwAAAMs"]
[Fri Feb 06 21:54:00.667695 2026] [:error] [pid 3477:tid 3486] [client 3.7.184.189:45098] [client 3.7.184.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.7.184.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXyeLL0Hdh40C7HYgV9gwAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:54:47.412770 2026] [:error] [pid 3477:tid 3481] [client 118.139.177.197:49158] [client 118.139.177.197] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.139.177.197, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYXyp7L0Hdh40C7HYgV9xQAAAMI"]
[Fri Feb 06 21:58:25.191289 2026] [:error] [pid 46432:tid 46442] [client 67.225.255.185:57162] [client 67.225.255.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.225.255.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXzgQbwJwu_od0kZjMy1gAAAkg"]
[Fri Feb 06 21:58:27.736105 2026] [:error] [pid 46432:tid 46450] [client 67.225.255.185:57162] [client 67.225.255.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.225.255.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXzgwbwJwu_od0kZjMy2AAAAlA"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 21:59:44.331451 2026] [:error] [pid 36928:tid 36954] [client 152.53.204.199:46696] [client 152.53.204.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.53.204.199, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXz0Js7fyU8D36r-Op4mAAAAdY"]
[Fri Feb 06 21:59:45.809721 2026] [:error] [pid 36928:tid 36937] [client 152.53.204.199:46696] [client 152.53.204.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.53.204.199, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYXz0Zs7fyU8D36r-Op4mQAAAcU"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 22:00:52.934129 2026] [:error] [pid 3477:tid 3493] [client 171.111.192.222:36324] [client 171.111.192.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 171.111.192.222, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX0FLL0Hdh40C7HYgV-qwAAAM4"]
[Fri Feb 06 22:01:03.077014 2026] [:error] [pid 3382:tid 3443] [client 162.0.216.102:40246] [client 162.0.216.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.216.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX0H8IgU1HR0rhYrE9kmgAAAIM"]
[Fri Feb 06 22:01:05.550046 2026] [:error] [pid 3382:tid 3456] [client 162.0.216.102:40246] [client 162.0.216.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.216.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX0IcIgU1HR0rhYrE9kmwAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 22:01:14.385560 2026] [:error] [pid 3382:tid 3450] [client 209.235.136.148:42292] [client 209.235.136.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.148, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX0KsIgU1HR0rhYrE9kowAAAIo"]
[Fri Feb 06 22:01:17.040710 2026] [:error] [pid 3382:tid 3462] [client 209.235.136.148:42292] [client 209.235.136.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.148, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX0LcIgU1HR0rhYrE9kpQAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 22:04:42.387049 2026] [:error] [pid 3513:tid 3516] [client 54.255.216.38:40162] [client 54.255.216.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.255.216.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX0-jSw3-HAlzpqSxza3QAAAUE"]
[Fri Feb 06 22:04:43.333175 2026] [:error] [pid 3513:tid 3527] [client 54.255.216.38:40162] [client 54.255.216.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.255.216.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX0-zSw3-HAlzpqSxza4AAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 22:06:13.125357 2026] [:error] [pid 3513:tid 3529] [client 104.248.143.200:49529] [client 104.248.143.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.248.143.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX1VTSw3-HAlzpqSxza-wAAAU4"]
[Fri Feb 06 22:06:14.826684 2026] [:error] [pid 36928:tid 36944] [client 104.248.143.200:49878] [client 104.248.143.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.248.143.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX1Vps7fyU8D36r-Op5_gAAAcw"]
[Fri Feb 06 22:08:20.108787 2026] [:error] [pid 46432:tid 46439] [client 184.168.120.235:48044] [client 184.168.120.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.120.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYX11AbwJwu_od0kZjMz6AAAAkU"]
[Fri Feb 06 22:08:28.723597 2026] [:error] [pid 3382:tid 3447] [client 173.236.158.190:43500] [client 173.236.158.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.236.158.190, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYX13MIgU1HR0rhYrE9lqAAAAIc"]
[Fri Feb 06 22:09:07.185314 2026] [:error] [pid 15821:tid 15830] [client 43.129.189.147:38926] [client 43.129.189.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.129.189.147, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYX2A3ARQa67J4c772kXtAAAAQU"]
[Fri Feb 06 22:09:13.921287 2026] [:error] [pid 36928:tid 36937] [client 203.59.224.59:58373] [client 203.59.224.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.59.224.59, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYX2CZs7fyU8D36r-Op64AAAAcU"]
[Fri Feb 06 22:09:28.554577 2026] [:error] [pid 36928:tid 36949] [client 185.225.22.28:34418] [client 185.225.22.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.225.22.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYX2GJs7fyU8D36r-Op68gAAAdE"]
[Fri Feb 06 22:09:37.719748 2026] [:error] [pid 37019:tid 37023] [client 47.239.109.32:34124] [client 47.239.109.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.239.109.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYX2IQkAjqd3bcgYBrtv0QAAAgI"]
[Fri Feb 06 22:09:38.509206 2026] [:error] [pid 3477:tid 3490] [client 163.44.193.130:48128] [client 163.44.193.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.44.193.130, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYX2IrL0Hdh40C7HYgWAaAAAAMs"]
[Fri Feb 06 22:09:45.152373 2026] [:error] [pid 15821:tid 15829] [client 162.241.70.178:55700] [client 162.241.70.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.70.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYX2KXARQa67J4c772kXxQAAAQQ"]
[Fri Feb 06 22:10:32.093327 2026] [:error] [pid 36857:tid 36868] [client 81.22.243.161:36124] [client 81.22.243.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.22.243.161, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX2WJVQwfj7Kp4Dd0H6AgAAAYk"]
[Fri Feb 06 22:10:33.649187 2026] [:error] [pid 36857:tid 36873] [client 81.22.243.161:36124] [client 81.22.243.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.22.243.161, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX2WZVQwfj7Kp4Dd0H6BAAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 22:14:23.801310 2026] [:error] [pid 15821:tid 15834] [client 35.91.35.38:57078] [client 35.91.35.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.91.35.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX3P3ARQa67J4c772kYSgAAAQk"]
[Fri Feb 06 22:14:24.761772 2026] [:error] [pid 15821:tid 15848] [client 35.91.35.38:57078] [client 35.91.35.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.91.35.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX3QHARQa67J4c772kYSwAAARc"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 22:15:53.403234 2026] [:error] [pid 3381:tid 3422] [client 104.248.143.200:55894] [client 104.248.143.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.248.143.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX3mS81zqRg96ZREgh5pAAAAEk"]
[Fri Feb 06 22:16:56.729242 2026] [:error] [pid 36928:tid 36951] [client 132.148.183.111:17824] [client 132.148.183.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 132.148.183.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX32Js7fyU8D36r-Op8YgAAAdM"]
[Fri Feb 06 22:16:58.607060 2026] [:error] [pid 36928:tid 36952] [client 132.148.183.111:17824] [client 132.148.183.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 132.148.183.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX32ps7fyU8D36r-Op8YwAAAdQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 22:18:11.795842 2026] [:error] [pid 3382:tid 3464] [client 181.214.100.145:49906] [client 181.214.100.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 181.214.100.145, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX4I8IgU1HR0rhYrE9mxAAAAJg"]
[Fri Feb 06 22:18:12.760016 2026] [:error] [pid 3382:tid 3445] [client 181.214.100.145:49906] [client 181.214.100.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 181.214.100.145, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX4JMIgU1HR0rhYrE9mxgAAAIU"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 22:18:48.940263 2026] [:error] [pid 3381:tid 3429] [client 217.160.149.31:56248] [client 217.160.149.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.160.149.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX4SC81zqRg96ZREgh6HAAAAFA"]
[Fri Feb 06 22:18:49.917116 2026] [:error] [pid 3381:tid 3414] [client 217.160.149.31:56248] [client 217.160.149.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.160.149.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX4SS81zqRg96ZREgh6IQAAAEE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 22:19:44.165909 2026] [:error] [pid 3381:tid 3413] [client 82.223.203.218:59236] [client 82.223.203.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.203.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX4gC81zqRg96ZREgh6UgAAAEA"]
[Fri Feb 06 22:19:45.268771 2026] [:error] [pid 3381:tid 3429] [client 82.223.203.218:59236] [client 82.223.203.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.203.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX4gS81zqRg96ZREgh6UwAAAFA"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 22:22:36.234367 2026] [:error] [pid 3382:tid 3457] [client 104.248.143.200:52021] [client 104.248.143.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.248.143.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX5LMIgU1HR0rhYrE9nigAAAJE"]
[Fri Feb 06 22:22:53.446318 2026] [:error] [pid 3380:tid 3396] [client 167.71.234.30:59957] [client 167.71.234.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.234.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX5PRFAlUvBGSBK2jdwEwAAAAw"]
[Fri Feb 06 22:22:54.864407 2026] [:error] [pid 3380:tid 3386] [client 167.71.234.30:60028] [client 167.71.234.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.234.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX5PhFAlUvBGSBK2jdwFgAAAAI"]
[Fri Feb 06 22:24:54.973375 2026] [:error] [pid 46432:tid 46445] [client 65.7.17.58:51042] [client 65.7.17.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.7.17.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX5tgbwJwu_od0kZjM13AAAAks"]
[Fri Feb 06 22:24:56.159792 2026] [:error] [pid 46432:tid 46443] [client 65.7.17.58:51042] [client 65.7.17.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.7.17.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX5uAbwJwu_od0kZjM13wAAAkk"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 22:26:06.904525 2026] [:error] [pid 3382:tid 3451] [client 31.220.151.86:50776] [client 31.220.151.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.220.151.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX5_sIgU1HR0rhYrE9oUAAAAIs"]
[Fri Feb 06 22:26:10.428444 2026] [:error] [pid 3382:tid 3452] [client 31.220.151.86:50776] [client 31.220.151.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.220.151.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX6AsIgU1HR0rhYrE9oUwAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 22:27:12.481537 2026] [:error] [pid 36928:tid 36939] [client 171.111.192.222:60820] [client 171.111.192.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 171.111.192.222, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX6QJs7fyU8D36r-Op-vwAAAcc"]
[Fri Feb 06 22:27:28.354773 2026] [:error] [pid 36928:tid 36933] [client 171.111.192.222:37730] [client 171.111.192.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 171.111.192.222, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX6UJs7fyU8D36r-Op-zgAAAcE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 22:35:08.814283 2026] [:error] [pid 46432:tid 46439] [client 157.230.226.169:37712] [client 157.230.226.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.226.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX8HAbwJwu_od0kZjM3YwAAAkU"]
[Fri Feb 06 22:35:09.836527 2026] [:error] [pid 46432:tid 46457] [client 157.230.226.169:37712] [client 157.230.226.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.226.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX8HQbwJwu_od0kZjM3ZQAAAlc"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 22:39:47.805544 2026] [:error] [pid 3381:tid 3433] [client 173.236.255.37:54904] [client 173.236.255.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.255.37, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX9My81zqRg96ZREgh_AwAAAFQ"]
[Fri Feb 06 22:39:50.870762 2026] [:error] [pid 3381:tid 3421] [client 173.236.255.37:54904] [client 173.236.255.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.255.37, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX9Ni81zqRg96ZREgh_BQAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 22:40:08.293260 2026] [:error] [pid 36928:tid 36946] [client 143.95.255.155:38642] [client 143.95.255.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.95.255.155, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX9SJs7fyU8D36r-OqCFwAAAc4"]
[Fri Feb 06 22:40:34.297851 2026] [:error] [pid 36857:tid 36865] [client 143.95.255.155:24900] [client 143.95.255.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.95.255.155, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX9YpVQwfj7Kp4Dd0H9DwAAAYY"]
[Fri Feb 06 22:40:48.542018 2026] [:error] [pid 36928:tid 36952] [client 170.106.72.178:56834] [client 170.106.72.178] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYX9cJs7fyU8D36r-OqCQwAAAdQ"]
[Fri Feb 06 22:40:58.371532 2026] [:error] [pid 46432:tid 46449] [client 143.95.255.155:28840] [client 143.95.255.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.95.255.155, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX9egbwJwu_od0kZjM4KwAAAk8"]
[Fri Feb 06 22:46:05.730467 2026] [:error] [pid 37019:tid 37021] [client 20.203.201.174:26801] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/444.php"] [unique_id "aYX-rQkAjqd3bcgYBrt0dAAAAgA"]
[Fri Feb 06 22:46:12.417983 2026] [:error] [pid 15821:tid 15829] [client 20.203.201.174:46622] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/444.php"] [unique_id "aYX-tHARQa67J4c772kcVQAAAQQ"]
[Fri Feb 06 22:46:14.127702 2026] [:error] [pid 3513:tid 3537] [client 20.203.201.174:29010] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/444.php"] [unique_id "aYX-tjSw3-HAlzpqSxzfvAAAAVY"]
[Fri Feb 06 22:46:15.435840 2026] [:error] [pid 36857:tid 36880] [client 20.203.201.174:40412] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/444.php"] [unique_id "aYX-t5VQwfj7Kp4Dd0H9vAAAAZU"]
[Fri Feb 06 22:46:16.984434 2026] [:error] [pid 3382:tid 3452] [client 20.203.201.174:4673] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aYX-uMIgU1HR0rhYrE9r3wAAAIw"]
[Fri Feb 06 22:46:19.535011 2026] [:error] [pid 3381:tid 3429] [client 20.203.201.174:25216] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aYX-uy81zqRg96ZREgiAiwAAAFA"]
[Fri Feb 06 22:46:22.012161 2026] [:error] [pid 15821:tid 15832] [client 20.203.201.174:46622] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aYX-vnARQa67J4c772kcWQAAAQc"]
[Fri Feb 06 22:46:28.582742 2026] [:error] [pid 36857:tid 36879] [client 20.203.201.174:45675] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aYX-xJVQwfj7Kp4Dd0H9wgAAAZQ"]
[Fri Feb 06 22:46:29.308674 2026] [:error] [pid 36857:tid 36872] [client 20.203.201.174:41158] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filesss.php"] [unique_id "aYX-xZVQwfj7Kp4Dd0H9wwAAAY0"]
[Fri Feb 06 22:46:30.686461 2026] [:error] [pid 3382:tid 3443] [client 20.203.201.174:41161] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filesss.php"] [unique_id "aYX-xsIgU1HR0rhYrE9r5gAAAIM"]
[Fri Feb 06 22:46:31.420193 2026] [:error] [pid 3477:tid 3503] [client 20.203.201.174:4362] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filesss.php"] [unique_id "aYX-x7L0Hdh40C7HYgWFtwAAANg"]
[Fri Feb 06 22:46:32.524178 2026] [:error] [pid 3477:tid 3489] [client 20.203.201.174:45616] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filesss.php"] [unique_id "aYX-yLL0Hdh40C7HYgWFuQAAAMo"]
[Fri Feb 06 22:46:33.084104 2026] [:error] [pid 46432:tid 46458] [client 20.203.201.174:29298] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file88.php"] [unique_id "aYX-yQbwJwu_od0kZjM48gAAAlg"]
[Fri Feb 06 22:46:33.837095 2026] [:error] [pid 36857:tid 36875] [client 20.203.201.174:41208] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file88.php"] [unique_id "aYX-yZVQwfj7Kp4Dd0H9xQAAAZA"]
[Fri Feb 06 22:46:35.063884 2026] [:error] [pid 3382:tid 3448] [client 20.203.201.174:4375] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file88.php"] [unique_id "aYX-y8IgU1HR0rhYrE9r6QAAAIg"]
[Fri Feb 06 22:46:35.796029 2026] [:error] [pid 36928:tid 36945] [client 20.203.201.174:45624] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file88.php"] [unique_id "aYX-y5s7fyU8D36r-OqDqQAAAc0"]
[Fri Feb 06 22:46:36.538785 2026] [:error] [pid 3382:tid 3454] [client 20.203.201.174:26853] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aYX-zMIgU1HR0rhYrE9r6gAAAI4"]
[Fri Feb 06 22:46:37.242729 2026] [:error] [pid 36928:tid 36939] [client 20.203.201.174:38136] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aYX-zZs7fyU8D36r-OqDqwAAAcc"]
[Fri Feb 06 22:46:37.867951 2026] [:error] [pid 15821:tid 15837] [client 20.203.201.174:41202] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aYX-zXARQa67J4c772kcXgAAAQw"]
[Fri Feb 06 22:46:38.517432 2026] [:error] [pid 36928:tid 36944] [client 20.203.201.174:30076] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aYX-zps7fyU8D36r-OqDrAAAAcw"]
[Fri Feb 06 22:46:39.786881 2026] [:error] [pid 36928:tid 36936] [client 20.203.201.174:45595] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-wp.php"] [unique_id "aYX-z5s7fyU8D36r-OqDsQAAAcQ"]
[Fri Feb 06 22:46:40.505610 2026] [:error] [pid 37019:tid 37029] [client 20.203.201.174:45638] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-wp.php"] [unique_id "aYX-0AkAjqd3bcgYBrt0fwAAAgg"]
[Fri Feb 06 22:46:41.316927 2026] [:error] [pid 37019:tid 37045] [client 20.203.201.174:25319] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-wp.php"] [unique_id "aYX-0QkAjqd3bcgYBrt0gAAAAhg"]
[Fri Feb 06 22:46:42.351126 2026] [:error] [pid 3513:tid 3530] [client 20.203.201.174:32006] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-wp.php"] [unique_id "aYX-0jSw3-HAlzpqSxzfyQAAAU8"]
[Fri Feb 06 22:46:43.381098 2026] [:error] [pid 37019:tid 37021] [client 20.203.201.174:41545] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/555.php"] [unique_id "aYX-0wkAjqd3bcgYBrt0gQAAAgA"]
[Fri Feb 06 22:46:45.275526 2026] [:error] [pid 37019:tid 37025] [client 20.203.201.174:38107] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/555.php"] [unique_id "aYX-1QkAjqd3bcgYBrt0gwAAAgQ"]
[Fri Feb 06 22:46:46.350006 2026] [:error] [pid 3513:tid 3521] [client 20.203.201.174:25337] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/555.php"] [unique_id "aYX-1jSw3-HAlzpqSxzfzgAAAUY"]
[Fri Feb 06 22:46:47.173106 2026] [:error] [pid 37019:tid 37023] [client 20.203.201.174:33254] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/555.php"] [unique_id "aYX-1wkAjqd3bcgYBrt0hgAAAgI"]
[Fri Feb 06 22:46:48.631062 2026] [:error] [pid 36928:tid 36947] [client 20.203.201.174:42511] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "aYX-2Js7fyU8D36r-OqDugAAAc8"]
[Fri Feb 06 22:46:49.611143 2026] [:error] [pid 46432:tid 46448] [client 20.203.201.174:38127] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "aYX-2QbwJwu_od0kZjM49AAAAk4"]
[Fri Feb 06 22:46:51.431446 2026] [:error] [pid 46432:tid 46434] [client 20.203.201.174:4594] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "aYX-2wbwJwu_od0kZjM49wAAAkA"]
[Fri Feb 06 22:46:53.441329 2026] [:error] [pid 36928:tid 36948] [client 20.203.201.174:25474] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "aYX-3Zs7fyU8D36r-OqDwgAAAdA"]
[Fri Feb 06 22:46:54.447352 2026] [:error] [pid 37019:tid 37037] [client 20.203.201.174:25788] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aYX-3gkAjqd3bcgYBrt0iAAAAhA"]
[Fri Feb 06 22:46:55.391203 2026] [:error] [pid 37019:tid 37033] [client 20.203.201.174:42543] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aYX-3wkAjqd3bcgYBrt0jAAAAgw"]
[Fri Feb 06 22:46:56.145372 2026] [:error] [pid 3513:tid 3535] [client 20.203.201.174:27645] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aYX-4DSw3-HAlzpqSxzf0wAAAVQ"]
[Fri Feb 06 22:46:56.739660 2026] [:error] [pid 36928:tid 36947] [client 20.203.201.174:32818] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aYX-4Js7fyU8D36r-OqDxgAAAc8"]
[Fri Feb 06 22:46:57.296911 2026] [:error] [pid 36928:tid 36937] [client 20.203.201.174:42546] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2clas.php"] [unique_id "aYX-4Zs7fyU8D36r-OqDxwAAAcU"]
[Fri Feb 06 22:46:58.176196 2026] [:error] [pid 36928:tid 36938] [client 20.203.201.174:32466] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2clas.php"] [unique_id "aYX-4ps7fyU8D36r-OqDyQAAAcY"]
[Fri Feb 06 22:46:59.949628 2026] [:error] [pid 36928:tid 36956] [client 20.203.201.174:32462] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2clas.php"] [unique_id "aYX-45s7fyU8D36r-OqDzAAAAdg"]
[Fri Feb 06 22:47:01.347908 2026] [:error] [pid 37019:tid 37044] [client 20.203.201.174:30757] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2clas.php"] [unique_id "aYX-5QkAjqd3bcgYBrt0lQAAAhc"]
[Fri Feb 06 22:47:02.940006 2026] [:error] [pid 3381:tid 3414] [client 20.203.201.174:38059] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless5.php"] [unique_id "aYX-5i81zqRg96ZREgiAmAAAAEE"]
[Fri Feb 06 22:47:03.812770 2026] [:error] [pid 36928:tid 36932] [client 20.203.201.174:63261] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless5.php"] [unique_id "aYX-55s7fyU8D36r-OqD2QAAAcA"]
[Fri Feb 06 22:47:15.027963 2026] [:error] [pid 36857:tid 36878] [client 20.203.201.174:25525] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fffff.php"] [unique_id "aYX-85VQwfj7Kp4Dd0H91wAAAZM"]
[Fri Feb 06 22:47:15.824038 2026] [:error] [pid 15821:tid 15832] [client 20.203.201.174:36882] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fffff.php"] [unique_id "aYX-83ARQa67J4c772kcZQAAAQc"]
[Fri Feb 06 22:47:16.480477 2026] [:error] [pid 37019:tid 37039] [client 20.203.201.174:28011] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fffff.php"] [unique_id "aYX-9AkAjqd3bcgYBrt0nAAAAhI"]
[Fri Feb 06 22:47:17.221313 2026] [:error] [pid 46432:tid 46456] [client 20.203.201.174:28509] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fffff.php"] [unique_id "aYX-9QbwJwu_od0kZjM4_QAAAlY"]
[Fri Feb 06 22:47:18.037436 2026] [:error] [pid 15821:tid 15839] [client 20.203.201.174:33637] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/indo.php"] [unique_id "aYX-9nARQa67J4c772kcaAAAAQ4"]
[Fri Feb 06 22:47:18.856023 2026] [:error] [pid 15821:tid 15826] [client 20.203.201.174:63259] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/indo.php"] [unique_id "aYX-9nARQa67J4c772kcagAAAQE"]
[Fri Feb 06 22:47:19.956533 2026] [:error] [pid 15821:tid 15837] [client 20.203.201.174:4980] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/indo.php"] [unique_id "aYX-93ARQa67J4c772kcawAAAQw"]
[Fri Feb 06 22:47:20.957283 2026] [:error] [pid 46432:tid 46442] [client 20.203.201.174:4972] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/indo.php"] [unique_id "aYX--AbwJwu_od0kZjM5AAAAAkg"]
[Fri Feb 06 22:47:21.953958 2026] [:error] [pid 36857:tid 36875] [client 20.203.201.174:48581] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fileas.php"] [unique_id "aYX--ZVQwfj7Kp4Dd0H92QAAAZA"]
[Fri Feb 06 22:47:24.571375 2026] [:error] [pid 3381:tid 3432] [client 20.203.201.174:4955] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fileas.php"] [unique_id "aYX-_C81zqRg96ZREgiAnQAAAFM"]
[Fri Feb 06 22:47:30.570951 2026] [:error] [pid 46432:tid 46439] [client 20.203.201.174:38038] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fileas.php"] [unique_id "aYX_AgbwJwu_od0kZjM5BgAAAkU"]
[Fri Feb 06 22:47:33.346809 2026] [:error] [pid 36857:tid 36859] [client 20.203.201.174:4874] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fileas.php"] [unique_id "aYX_BZVQwfj7Kp4Dd0H93wAAAYA"]
[Fri Feb 06 22:47:34.902519 2026] [:error] [pid 36857:tid 36867] [client 20.203.201.174:29478] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "aYX_BpVQwfj7Kp4Dd0H94gAAAYg"]
[Fri Feb 06 22:47:35.920930 2026] [:error] [pid 36928:tid 36950] [client 20.203.201.174:38066] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "aYX_B5s7fyU8D36r-OqD8wAAAdI"]
[Fri Feb 06 22:47:36.712772 2026] [:error] [pid 3477:tid 3479] [client 20.203.201.174:27978] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "aYX_CLL0Hdh40C7HYgWFwgAAAMA"]
[Fri Feb 06 22:47:37.743642 2026] [:error] [pid 3382:tid 3446] [client 20.203.201.174:25497] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "aYX_CcIgU1HR0rhYrE9r-wAAAIY"]
[Fri Feb 06 22:47:38.893563 2026] [:error] [pid 36928:tid 36936] [client 20.203.201.174:30770] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/33.php"] [unique_id "aYX_Cps7fyU8D36r-OqD9wAAAcQ"]
[Fri Feb 06 22:47:39.938862 2026] [:error] [pid 36928:tid 36933] [client 20.203.201.174:4923] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/33.php"] [unique_id "aYX_C5s7fyU8D36r-OqD-QAAAcE"]
[Fri Feb 06 22:47:41.252794 2026] [:error] [pid 37019:tid 37022] [client 20.203.201.174:48623] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/33.php"] [unique_id "aYX_DQkAjqd3bcgYBrt0pQAAAgE"]
[Fri Feb 06 22:47:41.866705 2026] [:error] [pid 15821:tid 15831] [client 20.203.201.174:38027] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/33.php"] [unique_id "aYX_DXARQa67J4c772kcdQAAAQY"]
[Fri Feb 06 22:47:42.807021 2026] [:error] [pid 36857:tid 36878] [client 20.203.201.174:36307] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plss3.php"] [unique_id "aYX_DpVQwfj7Kp4Dd0H95gAAAZM"]
[Fri Feb 06 22:47:43.900494 2026] [:error] [pid 3477:tid 3502] [client 20.203.201.174:29474] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plss3.php"] [unique_id "aYX_D7L0Hdh40C7HYgWFxAAAANc"]
[Fri Feb 06 22:47:44.984314 2026] [:error] [pid 3381:tid 3418] [client 20.203.201.174:28521] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plss3.php"] [unique_id "aYX_EC81zqRg96ZREgiApQAAAEU"]
[Fri Feb 06 22:47:46.243009 2026] [:error] [pid 15821:tid 15845] [client 20.203.201.174:33662] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plss3.php"] [unique_id "aYX_EnARQa67J4c772kceAAAARQ"]
[Fri Feb 06 22:47:47.090883 2026] [:error] [pid 15821:tid 15830] [client 20.203.201.174:28016] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/he.php"] [unique_id "aYX_E3ARQa67J4c772kcewAAAQU"]
[Fri Feb 06 22:47:48.037671 2026] [:error] [pid 36857:tid 36882] [client 20.203.201.174:38050] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/he.php"] [unique_id "aYX_FJVQwfj7Kp4Dd0H95wAAAZc"]
[Fri Feb 06 22:47:48.969721 2026] [:error] [pid 3513:tid 3537] [client 20.203.201.174:36878] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/he.php"] [unique_id "aYX_FDSw3-HAlzpqSxzf5AAAAVY"]
[Fri Feb 06 22:47:50.147432 2026] [:error] [pid 3382:tid 3464] [client 20.203.201.174:25785] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/he.php"] [unique_id "aYX_FsIgU1HR0rhYrE9r_QAAAJg"]
[Fri Feb 06 22:47:50.803132 2026] [:error] [pid 36857:tid 36880] [client 20.203.201.174:4950] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thxt.php"] [unique_id "aYX_FpVQwfj7Kp4Dd0H97AAAAZU"]
[Fri Feb 06 22:47:52.057073 2026] [:error] [pid 3382:tid 3451] [client 20.203.201.174:28031] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thxt.php"] [unique_id "aYX_GMIgU1HR0rhYrE9r_gAAAIs"]
[Fri Feb 06 22:47:52.644972 2026] [:error] [pid 36857:tid 36873] [client 20.203.201.174:36887] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thxt.php"] [unique_id "aYX_GJVQwfj7Kp4Dd0H97gAAAY4"]
[Fri Feb 06 22:47:53.158722 2026] [:error] [pid 3513:tid 3539] [client 20.203.201.174:28493] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thxt.php"] [unique_id "aYX_GTSw3-HAlzpqSxzf5QAAAVg"]
[Fri Feb 06 22:47:53.765258 2026] [:error] [pid 36928:tid 36939] [client 20.203.201.174:25494] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wfile.php"] [unique_id "aYX_GZs7fyU8D36r-OqD_gAAAcc"]
[Fri Feb 06 22:47:54.566813 2026] [:error] [pid 3513:tid 3526] [client 20.203.201.174:4971] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wfile.php"] [unique_id "aYX_GjSw3-HAlzpqSxzf5gAAAUs"]
[Fri Feb 06 22:47:55.513202 2026] [:error] [pid 15821:tid 15829] [client 20.203.201.174:28503] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wfile.php"] [unique_id "aYX_G3ARQa67J4c772kcfgAAAQQ"]
[Fri Feb 06 22:47:56.326242 2026] [:error] [pid 3513:tid 3533] [client 20.203.201.174:28520] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wfile.php"] [unique_id "aYX_HDSw3-HAlzpqSxzf5wAAAVI"]
[Fri Feb 06 22:47:57.208641 2026] [:error] [pid 36928:tid 36943] [client 20.203.201.174:62840] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aYX_HZs7fyU8D36r-OqEBgAAAcs"]
[Fri Feb 06 22:47:57.875972 2026] [:error] [pid 46432:tid 46434] [client 20.203.201.174:4893] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aYX_HQbwJwu_od0kZjM5EQAAAkA"]
[Fri Feb 06 22:47:58.896031 2026] [:error] [pid 36928:tid 36956] [client 20.203.201.174:36332] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aYX_Hps7fyU8D36r-OqECgAAAdg"]
[Fri Feb 06 22:47:59.873304 2026] [:error] [pid 36928:tid 36945] [client 20.203.201.174:33620] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aYX_H5s7fyU8D36r-OqEDAAAAc0"]
[Fri Feb 06 22:48:00.944588 2026] [:error] [pid 36928:tid 36955] [client 20.203.201.174:33600] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/build.php"] [unique_id "aYX_IJs7fyU8D36r-OqEDgAAAdc"]
[Fri Feb 06 22:48:02.664883 2026] [:error] [pid 15821:tid 15834] [client 20.203.201.174:29447] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/build.php"] [unique_id "aYX_InARQa67J4c772kcfwAAAQk"]
[Fri Feb 06 22:48:03.525054 2026] [:error] [pid 3381:tid 3423] [client 20.203.201.174:29458] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/build.php"] [unique_id "aYX_Iy81zqRg96ZREgiAsgAAAEo"]
[Fri Feb 06 22:48:04.237640 2026] [:error] [pid 36928:tid 36943] [client 20.203.201.174:28486] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/build.php"] [unique_id "aYX_JJs7fyU8D36r-OqEEwAAAcs"]
[Fri Feb 06 22:48:05.132811 2026] [:error] [pid 36928:tid 36938] [client 20.203.201.174:38031] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aYX_JZs7fyU8D36r-OqEFQAAAcY"]
[Fri Feb 06 22:48:05.962360 2026] [:error] [pid 36928:tid 36939] [client 20.203.201.174:38046] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aYX_JZs7fyU8D36r-OqEGAAAAcc"]
[Fri Feb 06 22:48:07.683665 2026] [:error] [pid 36928:tid 36947] [client 20.203.201.174:25762] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aYX_J5s7fyU8D36r-OqEHAAAAc8"]
[Fri Feb 06 22:48:08.381519 2026] [:error] [pid 3513:tid 3536] [client 20.203.201.174:30767] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aYX_KDSw3-HAlzpqSxzf6wAAAVU"]
[Fri Feb 06 22:48:09.782841 2026] [:error] [pid 36928:tid 36932] [client 20.203.201.174:4948] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/usep.php"] [unique_id "aYX_KZs7fyU8D36r-OqEIQAAAcA"]
[Fri Feb 06 22:48:10.985078 2026] [:error] [pid 36857:tid 36880] [client 20.203.201.174:28492] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/usep.php"] [unique_id "aYX_KpVQwfj7Kp4Dd0H99wAAAZU"]
[Fri Feb 06 22:48:12.409339 2026] [:error] [pid 3381:tid 3424] [client 20.203.201.174:25735] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/usep.php"] [unique_id "aYX_LC81zqRg96ZREgiAtQAAAEs"]
[Fri Feb 06 22:48:25.385195 2026] [:error] [pid 46432:tid 46434] [client 20.203.201.174:4195] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aYX_OQbwJwu_od0kZjM5JAAAAkA"]
[Fri Feb 06 22:48:26.421424 2026] [:error] [pid 36928:tid 36939] [client 20.203.201.174:4911] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aYX_Ops7fyU8D36r-OqEMAAAAcc"]
[Fri Feb 06 22:48:27.375018 2026] [:error] [pid 15821:tid 15827] [client 20.203.201.174:30725] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aYX_O3ARQa67J4c772kcigAAAQI"]
[Fri Feb 06 22:48:28.190656 2026] [:error] [pid 36928:tid 36954] [client 20.203.201.174:36315] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aYX_PJs7fyU8D36r-OqEMwAAAdY"]
[Fri Feb 06 22:48:30.244828 2026] [:error] [pid 15821:tid 15846] [client 20.203.201.174:36321] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aYX_PnARQa67J4c772kciwAAARU"]
[Fri Feb 06 22:48:34.126011 2026] [:error] [pid 46432:tid 46445] [client 20.203.201.174:4173] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aYX_QgbwJwu_od0kZjM5LwAAAks"]
[Fri Feb 06 22:48:41.482593 2026] [:error] [pid 36928:tid 36954] [client 20.203.201.174:40820] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aYX_SZs7fyU8D36r-OqEPAAAAdY"]
[Fri Feb 06 22:48:42.905150 2026] [:error] [pid 46432:tid 46453] [client 20.203.201.174:43055] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aYX_SgbwJwu_od0kZjM5MQAAAlM"]
[Fri Feb 06 22:48:43.585427 2026] [:error] [pid 3513:tid 3518] [client 20.203.201.174:35554] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aYX_SzSw3-HAlzpqSxzf-AAAAUM"]
[Fri Feb 06 22:48:44.324347 2026] [:error] [pid 37019:tid 37044] [client 20.203.201.174:49276] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aYX_TAkAjqd3bcgYBrt0uAAAAhc"]
[Fri Feb 06 22:48:44.881305 2026] [:error] [pid 3513:tid 3520] [client 20.203.201.174:33627] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aYX_TDSw3-HAlzpqSxzf-gAAAUU"]
[Fri Feb 06 22:48:45.657872 2026] [:error] [pid 3382:tid 3440] [client 20.203.201.174:4222] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aYX_TcIgU1HR0rhYrE9sEgAAAIA"]
[Fri Feb 06 22:48:46.740736 2026] [:error] [pid 36928:tid 36952] [client 20.203.201.174:63286] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aYX_Tps7fyU8D36r-OqEPwAAAdQ"]
[Fri Feb 06 22:48:47.387390 2026] [:error] [pid 3477:tid 3480] [client 20.203.201.174:34007] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aYX_T7L0Hdh40C7HYgWF1QAAAME"]
[Fri Feb 06 22:48:48.147051 2026] [:error] [pid 3382:tid 3442] [client 20.203.201.174:43012] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aYX_UMIgU1HR0rhYrE9sEwAAAII"]
[Fri Feb 06 22:48:49.543499 2026] [:error] [pid 36928:tid 36941] [client 20.203.201.174:39193] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aYX_UZs7fyU8D36r-OqEQwAAAck"]
[Fri Feb 06 22:48:50.212346 2026] [:error] [pid 3382:tid 3446] [client 20.203.201.174:43129] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NewFile.php"] [unique_id "aYX_UsIgU1HR0rhYrE9sFQAAAIY"]
[Fri Feb 06 22:48:51.141854 2026] [:error] [pid 3381:tid 3418] [client 20.203.201.174:33992] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NewFile.php"] [unique_id "aYX_Uy81zqRg96ZREgiAwAAAAEU"]
[Fri Feb 06 22:48:52.065180 2026] [:error] [pid 3513:tid 3534] [client 20.203.201.174:35540] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NewFile.php"] [unique_id "aYX_VDSw3-HAlzpqSxzf_AAAAVM"]
[Fri Feb 06 22:48:52.671334 2026] [:error] [pid 36928:tid 36950] [client 20.203.201.174:25106] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NewFile.php"] [unique_id "aYX_VJs7fyU8D36r-OqESgAAAdI"]
[Fri Feb 06 22:48:53.612215 2026] [:error] [pid 37019:tid 37033] [client 20.203.201.174:39201] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aYX_VQkAjqd3bcgYBrt0vgAAAgw"]
[Fri Feb 06 22:48:54.416952 2026] [:error] [pid 3381:tid 3424] [client 20.203.201.174:39168] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aYX_Vi81zqRg96ZREgiAwwAAAEs"]
[Fri Feb 06 22:48:55.475327 2026] [:error] [pid 3380:tid 3408] [client 20.203.201.174:33214] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aYX_VxFAlUvBGSBK2jdywgAAABg"]
[Fri Feb 06 22:48:56.132290 2026] [:error] [pid 46432:tid 46442] [client 20.203.201.174:39208] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aYX_WAbwJwu_od0kZjM5OAAAAkg"]
[Fri Feb 06 22:48:56.843233 2026] [:error] [pid 46432:tid 46448] [client 20.203.201.174:25120] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aYX_WAbwJwu_od0kZjM5OwAAAk4"]
[Fri Feb 06 22:48:57.588086 2026] [:error] [pid 3382:tid 3456] [client 20.203.201.174:28503] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aYX_WcIgU1HR0rhYrE9sHAAAAJA"]
[Fri Feb 06 22:48:58.826186 2026] [:error] [pid 37019:tid 37038] [client 20.203.201.174:4840] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aYX_WgkAjqd3bcgYBrt0wQAAAhE"]
[Fri Feb 06 22:49:00.147068 2026] [:error] [pid 37019:tid 37036] [client 20.203.201.174:43132] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aYX_XAkAjqd3bcgYBrt0wgAAAg8"]
[Fri Feb 06 22:49:01.758126 2026] [:error] [pid 46432:tid 46441] [client 20.203.201.174:38425] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "aYX_XQbwJwu_od0kZjM5PAAAAkc"]
[Fri Feb 06 22:49:04.214730 2026] [:error] [pid 46432:tid 46453] [client 20.203.201.174:32390] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "aYX_YAbwJwu_od0kZjM5PgAAAlM"]
[Fri Feb 06 22:49:05.090635 2026] [:error] [pid 15821:tid 15830] [client 20.203.201.174:46134] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "aYX_YXARQa67J4c772kclQAAAQU"]
[Fri Feb 06 22:49:06.246330 2026] [:error] [pid 36928:tid 36934] [client 20.203.201.174:4806] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "aYX_Yps7fyU8D36r-OqEWAAAAcI"]
[Fri Feb 06 22:49:07.300690 2026] [:error] [pid 36928:tid 36945] [client 20.203.201.174:31358] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "aYX_Y5s7fyU8D36r-OqEWgAAAc0"]
[Fri Feb 06 22:49:07.990676 2026] [:error] [pid 3380:tid 3395] [client 20.203.201.174:38409] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "aYX_YxFAlUvBGSBK2jdyxgAAAAs"]
[Fri Feb 06 22:49:08.580669 2026] [:error] [pid 15821:tid 15827] [client 20.203.201.174:28770] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "aYX_ZHARQa67J4c772kclwAAAQI"]
[Fri Feb 06 22:49:09.288379 2026] [:error] [pid 3381:tid 3432] [client 20.203.201.174:42573] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "aYX_ZS81zqRg96ZREgiAxwAAAFM"]
[Fri Feb 06 22:49:10.194674 2026] [:error] [pid 15821:tid 15829] [client 20.203.201.174:33183] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geck.php"] [unique_id "aYX_ZnARQa67J4c772kcmAAAAQQ"]
[Fri Feb 06 22:49:11.168728 2026] [:error] [pid 3382:tid 3458] [client 20.203.201.174:33190] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geck.php"] [unique_id "aYX_Z8IgU1HR0rhYrE9sIQAAAJI"]
[Fri Feb 06 22:49:12.646173 2026] [:error] [pid 36857:tid 36867] [client 20.203.201.174:33205] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geck.php"] [unique_id "aYX_aJVQwfj7Kp4Dd0H-BwAAAYg"]
[Fri Feb 06 22:49:13.647114 2026] [:error] [pid 36928:tid 36949] [client 20.203.201.174:44121] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geck.php"] [unique_id "aYX_aZs7fyU8D36r-OqEYgAAAdE"]
[Fri Feb 06 22:49:14.155822 2026] [:error] [pid 46432:tid 46442] [client 20.203.201.174:46087] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "aYX_agbwJwu_od0kZjM5QwAAAkg"]
[Fri Feb 06 22:49:14.838025 2026] [:error] [pid 46432:tid 46435] [client 20.203.201.174:42608] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "aYX_agbwJwu_od0kZjM5RAAAAkE"]
[Fri Feb 06 22:49:15.724582 2026] [:error] [pid 36857:tid 36863] [client 20.203.201.174:28793] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "aYX_a5VQwfj7Kp4Dd0H-DQAAAYQ"]
[Fri Feb 06 22:49:16.546953 2026] [:error] [pid 3477:tid 3489] [client 20.203.201.174:44099] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "aYX_bLL0Hdh40C7HYgWF4QAAAMo"]
[Fri Feb 06 22:49:17.313752 2026] [:error] [pid 3382:tid 3460] [client 20.203.201.174:42587] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aYX_bcIgU1HR0rhYrE9sKwAAAJQ"]
[Fri Feb 06 22:49:18.319132 2026] [:error] [pid 37019:tid 37030] [client 20.203.201.174:28746] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aYX_bgkAjqd3bcgYBrt0yAAAAgk"]
[Fri Feb 06 22:49:19.341601 2026] [:error] [pid 36928:tid 36932] [client 20.203.201.174:42616] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aYX_b5s7fyU8D36r-OqEagAAAcA"]
[Fri Feb 06 22:49:19.531580 2026] [:error] [pid 36857:tid 36862] [client 132.148.176.115:50286] [client 132.148.176.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 132.148.176.115, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX_b5VQwfj7Kp4Dd0H-EAAAAYM"]
[Fri Feb 06 22:49:20.097406 2026] [:error] [pid 3382:tid 3449] [client 20.203.201.174:44035] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aYX_cMIgU1HR0rhYrE9sMwAAAIk"]
[Fri Feb 06 22:49:20.454722 2026] [:error] [pid 36857:tid 36874] [client 132.148.176.115:50286] [client 132.148.176.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 132.148.176.115, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYX_cJVQwfj7Kp4Dd0H-EQAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 22:49:21.472586 2026] [:error] [pid 36928:tid 36955] [client 20.203.201.174:42577] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cccc.php"] [unique_id "aYX_cZs7fyU8D36r-OqEcQAAAdc"]
[Fri Feb 06 22:49:22.749811 2026] [:error] [pid 37019:tid 37027] [client 20.203.201.174:46109] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cccc.php"] [unique_id "aYX_cgkAjqd3bcgYBrt0zwAAAgY"]
[Fri Feb 06 22:49:23.515839 2026] [:error] [pid 3380:tid 3388] [client 20.203.201.174:32429] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cccc.php"] [unique_id "aYX_cxFAlUvBGSBK2jdy1AAAAAQ"]
[Fri Feb 06 22:49:35.946094 2026] [:error] [pid 36857:tid 36875] [client 20.203.201.174:32439] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/des.php"] [unique_id "aYX_f5VQwfj7Kp4Dd0H-HwAAAZA"]
[Fri Feb 06 22:49:36.450197 2026] [:error] [pid 3381:tid 3418] [client 20.203.201.174:44135] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/des.php"] [unique_id "aYX_gC81zqRg96ZREgiA2wAAAEU"]
[Fri Feb 06 22:49:36.952418 2026] [:error] [pid 36928:tid 36955] [client 20.203.201.174:27736] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/des.php"] [unique_id "aYX_gJs7fyU8D36r-OqEegAAAdc"]
[Fri Feb 06 22:49:38.009321 2026] [:error] [pid 3382:tid 3446] [client 20.203.201.174:26270] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/des.php"] [unique_id "aYX_gsIgU1HR0rhYrE9sNQAAAIY"]
[Fri Feb 06 22:49:38.631147 2026] [:error] [pid 37019:tid 37034] [client 20.203.201.174:44136] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "aYX_ggkAjqd3bcgYBrt04gAAAg0"]
[Fri Feb 06 22:49:39.151412 2026] [:error] [pid 3381:tid 3417] [client 20.203.201.174:46136] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "aYX_gy81zqRg96ZREgiA3AAAAEQ"]
[Fri Feb 06 22:49:39.817508 2026] [:error] [pid 3380:tid 3406] [client 20.203.201.174:27764] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "aYX_gxFAlUvBGSBK2jdy1wAAABY"]
[Fri Feb 06 22:49:40.494170 2026] [:error] [pid 3380:tid 3395] [client 20.203.201.174:27773] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "aYX_hBFAlUvBGSBK2jdy2AAAAAs"]
[Fri Feb 06 22:49:41.184347 2026] [:error] [pid 46432:tid 46444] [client 20.203.201.174:35513] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aYX_hQbwJwu_od0kZjM5XgAAAko"]
[Fri Feb 06 22:49:42.314110 2026] [:error] [pid 3380:tid 3400] [client 20.203.201.174:44142] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aYX_hhFAlUvBGSBK2jdy2QAAABA"]
[Fri Feb 06 22:49:43.044743 2026] [:error] [pid 37019:tid 37045] [client 20.203.201.174:4142] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aYX_hwkAjqd3bcgYBrt05wAAAhg"]
[Fri Feb 06 22:49:43.592309 2026] [:error] [pid 3382:tid 3457] [client 20.203.201.174:25188] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aYX_h8IgU1HR0rhYrE9sNgAAAJE"]
[Fri Feb 06 22:49:44.321942 2026] [:error] [pid 46432:tid 46437] [client 20.203.201.174:46138] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "aYX_iAbwJwu_od0kZjM5YQAAAkM"]
[Fri Feb 06 22:49:45.668247 2026] [:error] [pid 3477:tid 3487] [client 20.203.201.174:25152] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "aYX_ibL0Hdh40C7HYgWF_wAAAMg"]
[Fri Feb 06 22:49:47.043312 2026] [:error] [pid 3477:tid 3489] [client 20.203.201.174:45060] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "aYX_i7L0Hdh40C7HYgWGAQAAAMo"]
[Fri Feb 06 22:49:48.974513 2026] [:error] [pid 15821:tid 15826] [client 20.203.201.174:35958] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "aYX_jHARQa67J4c772kcugAAAQE"]
[Fri Feb 06 22:49:50.253989 2026] [:error] [pid 3477:tid 3490] [client 20.203.201.174:35460] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/efile.php"] [unique_id "aYX_jrL0Hdh40C7HYgWGBAAAAMs"]
[Fri Feb 06 22:49:51.018265 2026] [:error] [pid 3477:tid 3482] [client 20.203.201.174:27568] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/efile.php"] [unique_id "aYX_j7L0Hdh40C7HYgWGBwAAAMM"]
[Fri Feb 06 22:49:52.335702 2026] [:error] [pid 46432:tid 46445] [client 20.203.201.174:39573] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/efile.php"] [unique_id "aYX_kAbwJwu_od0kZjM5ZQAAAks"]
[Fri Feb 06 22:49:53.909941 2026] [:error] [pid 36928:tid 36938] [client 20.203.201.174:27540] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/efile.php"] [unique_id "aYX_kZs7fyU8D36r-OqEhwAAAcY"]
[Fri Feb 06 22:49:54.833773 2026] [:error] [pid 3380:tid 3385] [client 20.203.201.174:4102] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/afile.php"] [unique_id "aYX_khFAlUvBGSBK2jdy3QAAAAE"]
[Fri Feb 06 22:49:56.075370 2026] [:error] [pid 46432:tid 46434] [client 20.203.201.174:45058] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/afile.php"] [unique_id "aYX_lAbwJwu_od0kZjM5ZwAAAkA"]
[Fri Feb 06 22:49:57.362251 2026] [:error] [pid 46432:tid 46451] [client 20.203.201.174:25170] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/afile.php"] [unique_id "aYX_lQbwJwu_od0kZjM5bAAAAlE"]
[Fri Feb 06 22:49:58.403988 2026] [:error] [pid 46432:tid 46455] [client 20.203.201.174:4140] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/afile.php"] [unique_id "aYX_lgbwJwu_od0kZjM5bQAAAlU"]
[Fri Feb 06 22:49:59.767511 2026] [:error] [pid 3477:tid 3479] [client 20.203.201.174:37694] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/errorfile.php"] [unique_id "aYX_l7L0Hdh40C7HYgWGDAAAAMA"]
[Fri Feb 06 22:50:00.734804 2026] [:error] [pid 3381:tid 3426] [client 20.203.201.174:45092] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/errorfile.php"] [unique_id "aYX_mC81zqRg96ZREgiA6wAAAE0"]
[Fri Feb 06 22:50:01.428833 2026] [:error] [pid 36928:tid 36944] [client 20.203.201.174:39589] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/errorfile.php"] [unique_id "aYX_mZs7fyU8D36r-OqEjAAAAcw"]
[Fri Feb 06 22:50:02.089479 2026] [:error] [pid 3382:tid 3453] [client 20.203.201.174:28755] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/errorfile.php"] [unique_id "aYX_msIgU1HR0rhYrE9sOQAAAI0"]
[Fri Feb 06 22:50:03.067911 2026] [:error] [pid 3513:tid 3533] [client 20.203.201.174:29230] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aYX_mzSw3-HAlzpqSxzgMwAAAVI"]
[Fri Feb 06 22:50:03.933353 2026] [:error] [pid 37019:tid 37031] [client 20.203.201.174:27364] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aYX_mwkAjqd3bcgYBrt06wAAAgo"]
[Fri Feb 06 22:50:04.589468 2026] [:error] [pid 3513:tid 3516] [client 20.203.201.174:39615] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aYX_nDSw3-HAlzpqSxzgNAAAAUE"]
[Fri Feb 06 22:50:05.291469 2026] [:error] [pid 36928:tid 36937] [client 20.203.201.174:39587] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aYX_nZs7fyU8D36r-OqEjQAAAcU"]
[Fri Feb 06 22:50:06.127245 2026] [:error] [pid 36928:tid 36941] [client 20.203.201.174:27526] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gool.php"] [unique_id "aYX_nps7fyU8D36r-OqEjgAAAck"]
[Fri Feb 06 22:50:07.481669 2026] [:error] [pid 3381:tid 3433] [client 20.203.201.174:29220] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gool.php"] [unique_id "aYX_ny81zqRg96ZREgiA7QAAAFQ"]
[Fri Feb 06 22:50:08.713945 2026] [:error] [pid 36928:tid 36956] [client 20.203.201.174:45098] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gool.php"] [unique_id "aYX_oJs7fyU8D36r-OqEkAAAAdg"]
[Fri Feb 06 22:50:10.146061 2026] [:error] [pid 3380:tid 3404] [client 20.203.201.174:39944] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gool.php"] [unique_id "aYX_ohFAlUvBGSBK2jdy4gAAABQ"]
[Fri Feb 06 22:50:11.010223 2026] [:error] [pid 46432:tid 46434] [client 20.203.201.174:37653] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/haikh.php"] [unique_id "aYX_owbwJwu_od0kZjM5dgAAAkA"]
[Fri Feb 06 22:50:12.211426 2026] [:error] [pid 3380:tid 3387] [client 20.203.201.174:39562] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/haikh.php"] [unique_id "aYX_pBFAlUvBGSBK2jdy5gAAAAM"]
[Fri Feb 06 22:50:13.048878 2026] [:error] [pid 46432:tid 46456] [client 20.203.201.174:27353] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/haikh.php"] [unique_id "aYX_pQbwJwu_od0kZjM5gQAAAlY"]
[Fri Feb 06 22:50:14.044820 2026] [:error] [pid 3513:tid 3518] [client 20.203.201.174:64669] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/haikh.php"] [unique_id "aYX_pjSw3-HAlzpqSxzgOAAAAUM"]
[Fri Feb 06 22:50:16.865486 2026] [:error] [pid 3381:tid 3428] [client 20.203.201.174:39552] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/135.php"] [unique_id "aYX_qC81zqRg96ZREgiA8AAAAE8"]
[Fri Feb 06 22:50:17.709082 2026] [:error] [pid 3380:tid 3402] [client 20.203.201.174:39672] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/135.php"] [unique_id "aYX_qRFAlUvBGSBK2jdy6gAAABI"]
[Fri Feb 06 22:50:18.768354 2026] [:error] [pid 46432:tid 46458] [client 20.203.201.174:45064] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/135.php"] [unique_id "aYX_qgbwJwu_od0kZjM5mwAAAlg"]
[Fri Feb 06 22:50:20.347118 2026] [:error] [pid 36928:tid 36949] [client 20.203.201.174:39590] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/135.php"] [unique_id "aYX_rJs7fyU8D36r-OqEmwAAAdE"]
[Fri Feb 06 22:50:21.580463 2026] [:error] [pid 36928:tid 36937] [client 20.203.201.174:25191] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/enclas.php"] [unique_id "aYX_rZs7fyU8D36r-OqEnAAAAcU"]
[Fri Feb 06 22:50:22.575488 2026] [:error] [pid 3381:tid 3417] [client 20.203.201.174:27358] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/enclas.php"] [unique_id "aYX_ri81zqRg96ZREgiA9QAAAEQ"]
[Fri Feb 06 22:50:24.025765 2026] [:error] [pid 36928:tid 36948] [client 20.203.201.174:63542] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/enclas.php"] [unique_id "aYX_sJs7fyU8D36r-OqEngAAAdA"]
[Fri Feb 06 22:50:25.218667 2026] [:error] [pid 37019:tid 37044] [client 20.203.201.174:25172] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/enclas.php"] [unique_id "aYX_sQkAjqd3bcgYBrt09AAAAhc"]
[Fri Feb 06 22:50:25.944541 2026] [:error] [pid 3513:tid 3528] [client 20.203.201.174:35165] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aYX_sTSw3-HAlzpqSxzgQAAAAU0"]
[Fri Feb 06 22:50:26.933035 2026] [:error] [pid 15821:tid 15828] [client 20.203.201.174:37661] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aYX_snARQa67J4c772kcyQAAAQM"]
[Fri Feb 06 22:50:28.636531 2026] [:error] [pid 3513:tid 3537] [client 20.203.201.174:27387] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aYX_tDSw3-HAlzpqSxzgQQAAAVY"]
[Fri Feb 06 22:50:30.636863 2026] [:error] [pid 3477:tid 3484] [client 20.203.201.174:35169] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aYX_trL0Hdh40C7HYgWGEgAAAMU"]
[Fri Feb 06 22:50:32.888500 2026] [:error] [pid 46432:tid 46453] [client 20.203.201.174:29219] [client 20.203.201.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aYX_uAbwJwu_od0kZjM50wAAAlM"]
[Fri Feb 06 22:53:25.274152 2026] [:error] [pid 3380:tid 3386] [client 49.247.31.241:34460] [client 49.247.31.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 49.247.31.241, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYAZRFAlUvBGSBK2jdzLgAAAAI"]
[Fri Feb 06 22:53:26.313663 2026] [:error] [pid 3380:tid 3406] [client 49.247.31.241:34460] [client 49.247.31.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 49.247.31.241, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYAZhFAlUvBGSBK2jdzLwAAABY"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:01:54.521840 2026] [:error] [pid 3477:tid 3500] [client 157.230.226.169:53818] [client 157.230.226.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.226.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYCYrL0Hdh40C7HYgWHfAAAANU"]
[Fri Feb 06 23:01:55.432748 2026] [:error] [pid 3477:tid 3482] [client 157.230.226.169:53818] [client 157.230.226.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.226.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYCY7L0Hdh40C7HYgWHfgAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:03:16.900866 2026] [:error] [pid 36928:tid 36949] [client 142.93.68.12:43026] [client 142.93.68.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.93.68.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYCtJs7fyU8D36r-OqHEQAAAdE"]
[Fri Feb 06 23:03:17.969595 2026] [:error] [pid 36928:tid 36937] [client 142.93.68.12:43026] [client 142.93.68.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.93.68.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYCtZs7fyU8D36r-OqHEwAAAcU"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:03:35.894137 2026] [:error] [pid 36857:tid 36870] [client 103.179.56.102:50082] [client 103.179.56.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.179.56.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYCx5VQwfj7Kp4Dd0H_dAAAAYs"]
[Fri Feb 06 23:03:36.981852 2026] [:error] [pid 36857:tid 36862] [client 103.179.56.102:50082] [client 103.179.56.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.179.56.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYCyJVQwfj7Kp4Dd0H_dQAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:04:23.668102 2026] [:error] [pid 36928:tid 36949] [client 162.241.3.6:22162] [client 162.241.3.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.3.6, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYC95s7fyU8D36r-OqHSwAAAdE"]
[Fri Feb 06 23:04:24.599775 2026] [:error] [pid 36928:tid 36934] [client 162.241.3.6:22162] [client 162.241.3.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.3.6, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYC-Js7fyU8D36r-OqHTAAAAcI"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:08:23.805601 2026] [:error] [pid 37019:tid 37025] [client 65.7.17.58:51794] [client 65.7.17.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.7.17.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYD5wkAjqd3bcgYBrt2nwAAAgQ"]
[Fri Feb 06 23:08:25.042143 2026] [:error] [pid 37019:tid 37037] [client 65.7.17.58:51794] [client 65.7.17.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.7.17.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYD6QkAjqd3bcgYBrt2oQAAAhA"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:10:57.146469 2026] [:error] [pid 46432:tid 46439] [client 65.7.17.58:33676] [client 65.7.17.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.7.17.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYEgQbwJwu_od0kZjM8xwAAAkU"]
[Fri Feb 06 23:10:58.334151 2026] [:error] [pid 46432:tid 46440] [client 65.7.17.58:33676] [client 65.7.17.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.7.17.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYEggbwJwu_od0kZjM8yAAAAkY"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:11:28.634571 2026] [:error] [pid 36928:tid 36941] [client 94.136.187.150:49710] [client 94.136.187.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.136.187.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYEoJs7fyU8D36r-OqJRQAAAck"]
[Fri Feb 06 23:11:30.921849 2026] [:error] [pid 36928:tid 36939] [client 94.136.187.150:49710] [client 94.136.187.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.136.187.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYEops7fyU8D36r-OqJRwAAAcc"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:15:25.231809 2026] [:error] [pid 3381:tid 3431] [client 50.62.187.124:12220] [client 50.62.187.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.62.187.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYFjS81zqRg96ZREgiFawAAAFI"]
[Fri Feb 06 23:16:04.516515 2026] [:error] [pid 36857:tid 36865] [client 51.222.158.107:45186] [client 51.222.158.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.222.158.107, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYFtJVQwfj7Kp4Dd0EA0wAAAYY"]
[Fri Feb 06 23:16:05.452704 2026] [:error] [pid 36857:tid 36875] [client 51.222.158.107:45186] [client 51.222.158.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.222.158.107, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYFtZVQwfj7Kp4Dd0EA1AAAAZA"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:17:59.433289 2026] [:error] [pid 37019:tid 37030] [client 217.154.105.13:49384] [client 217.154.105.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.154.105.13, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYGJwkAjqd3bcgYBrt31QAAAgk"]
[Fri Feb 06 23:18:00.679635 2026] [:error] [pid 37019:tid 37023] [client 217.154.105.13:49384] [client 217.154.105.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.154.105.13, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYGKAkAjqd3bcgYBrt31gAAAgI"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:18:22.484857 2026] [:error] [pid 3477:tid 3500] [client 217.154.105.13:33428] [client 217.154.105.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.154.105.13, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYGPrL0Hdh40C7HYgWJ7gAAANU"]
[Fri Feb 06 23:18:23.856158 2026] [:error] [pid 3477:tid 3482] [client 217.154.105.13:33428] [client 217.154.105.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.154.105.13, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYGP7L0Hdh40C7HYgWJ8AAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:19:06.657335 2026] [:error] [pid 36928:tid 36934] [client 94.136.187.150:39354] [client 94.136.187.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.136.187.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYGaps7fyU8D36r-OqLCQAAAcI"]
[Fri Feb 06 23:19:08.001372 2026] [:error] [pid 36928:tid 36946] [client 94.136.187.150:39354] [client 94.136.187.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.136.187.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYGbJs7fyU8D36r-OqLCwAAAc4"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:19:09.743482 2026] [:error] [pid 3381:tid 3422] [client 103.56.161.126:51500] [client 103.56.161.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.56.161.126, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYGbS81zqRg96ZREgiF_QAAAEk"]
[Fri Feb 06 23:19:10.645586 2026] [:error] [pid 3381:tid 3421] [client 103.56.161.126:51500] [client 103.56.161.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.56.161.126, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYGbi81zqRg96ZREgiF_gAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:20:08.430925 2026] [:error] [pid 36928:tid 36949] [client 213.145.94.73:55980] [client 213.145.94.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.145.94.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYGqJs7fyU8D36r-OqLGAAAAdE"]
[Fri Feb 06 23:20:11.190756 2026] [:error] [pid 36928:tid 36951] [client 213.145.94.73:55980] [client 213.145.94.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.145.94.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYGq5s7fyU8D36r-OqLGgAAAdM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:22:13.258475 2026] [:error] [pid 15821:tid 15829] [client 46.101.137.29:40070] [client 46.101.137.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.101.137.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYHJXARQa67J4c772kgsAAAAQQ"]
[Fri Feb 06 23:22:14.729466 2026] [:error] [pid 15821:tid 15838] [client 46.101.137.29:40070] [client 46.101.137.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.101.137.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYHJnARQa67J4c772kgsQAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:25:10.192526 2026] [:error] [pid 15821:tid 15836] [client 64.225.25.250:49456] [client 64.225.25.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.225.25.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYH1nARQa67J4c772khLwAAAQs"]
[Fri Feb 06 23:25:11.117409 2026] [:error] [pid 15821:tid 15842] [client 64.225.25.250:49456] [client 64.225.25.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.225.25.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYH13ARQa67J4c772khMQAAARE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:26:13.400249 2026] [:error] [pid 36857:tid 36882] [client 50.62.147.150:16684] [client 50.62.147.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.62.147.150, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYIFZVQwfj7Kp4Dd0EB_QAAAZc"]
[Fri Feb 06 23:29:37.493505 2026] [:error] [pid 3477:tid 3488] [client 162.55.14.58:59696] [client 162.55.14.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.55.14.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYI4bL0Hdh40C7HYgWLSwAAAMk"]
[Fri Feb 06 23:29:39.663665 2026] [:error] [pid 3477:tid 3491] [client 162.55.14.58:59696] [client 162.55.14.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.55.14.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYI47L0Hdh40C7HYgWLTgAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:30:54.673528 2026] [:error] [pid 3380:tid 3390] [client 101.99.90.29:51368] [client 101.99.90.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.99.90.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYJLhFAlUvBGSBK2jd3kgAAAAY"]
[Fri Feb 06 23:30:55.713699 2026] [:error] [pid 3380:tid 3401] [client 101.99.90.29:51368] [client 101.99.90.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.99.90.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYJLxFAlUvBGSBK2jd3kwAAABE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:34:12.708374 2026] [:error] [pid 3513:tid 3529] [client 65.108.238.179:48858] [client 65.108.238.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.108.238.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYJ9DSw3-HAlzpqSxzkxwAAAU4"]
[Fri Feb 06 23:34:13.897952 2026] [:error] [pid 3513:tid 3530] [client 65.108.238.179:48858] [client 65.108.238.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.108.238.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYJ9TSw3-HAlzpqSxzkyAAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:34:25.037944 2026] [:error] [pid 15821:tid 15831] [client 50.62.187.124:61658] [client 50.62.187.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.187.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYKAXARQa67J4c772kiYgAAAQY"]
[Fri Feb 06 23:34:26.683883 2026] [:error] [pid 15821:tid 15835] [client 50.62.187.124:61658] [client 50.62.187.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.187.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYKAnARQa67J4c772kiYwAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:35:46.055319 2026] [:error] [pid 3477:tid 3488] [client 43.229.86.17:58936] [client 43.229.86.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.229.86.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYKUrL0Hdh40C7HYgWMUAAAAMk"]
[Fri Feb 06 23:35:47.162372 2026] [:error] [pid 3477:tid 3491] [client 43.229.86.17:58936] [client 43.229.86.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.229.86.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYKU7L0Hdh40C7HYgWMUgAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:36:44.829471 2026] [:error] [pid 3380:tid 3398] [client 103.56.161.126:43472] [client 103.56.161.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.56.161.126, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYKjBFAlUvBGSBK2jd4PQAAAA4"]
[Fri Feb 06 23:36:45.914767 2026] [:error] [pid 3380:tid 3384] [client 103.56.161.126:43472] [client 103.56.161.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.56.161.126, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYKjRFAlUvBGSBK2jd4QgAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:38:34.787055 2026] [:error] [pid 15821:tid 15846] [client 103.82.21.44:23820] [client 103.82.21.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.82.21.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYK-nARQa67J4c772ki7QAAARU"]
[Fri Feb 06 23:38:35.806152 2026] [:error] [pid 15821:tid 15833] [client 103.82.21.44:23820] [client 103.82.21.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.82.21.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYK-3ARQa67J4c772ki7gAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:38:45.404615 2026] [:error] [pid 3477:tid 3494] [client 192.163.196.216:37162] [client 192.163.196.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.163.196.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYLBbL0Hdh40C7HYgWM-AAAAM8"]
[Fri Feb 06 23:38:46.256694 2026] [:error] [pid 3477:tid 3497] [client 192.163.196.216:37162] [client 192.163.196.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.163.196.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYLBrL0Hdh40C7HYgWM-QAAANI"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:40:21.636020 2026] [:error] [pid 37019:tid 37024] [client 103.216.118.192:46376] [client 103.216.118.192] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.216.118.192, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYLZQkAjqd3bcgYBrt6cQAAAgM"]
[Fri Feb 06 23:40:22.877199 2026] [:error] [pid 37019:tid 37041] [client 103.216.118.192:46376] [client 103.216.118.192] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.216.118.192, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYLZgkAjqd3bcgYBrt6cwAAAhQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:43:09.960427 2026] [:error] [pid 15821:tid 15847] [client 192.163.196.216:42500] [client 192.163.196.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.163.196.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYMDXARQa67J4c772kjkAAAARY"]
[Fri Feb 06 23:43:11.017477 2026] [:error] [pid 15821:tid 15834] [client 192.163.196.216:42500] [client 192.163.196.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.163.196.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYMD3ARQa67J4c772kjlAAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:47:55.178591 2026] [:error] [pid 37019:tid 37040] [client 49.247.31.241:34136] [client 49.247.31.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 49.247.31.241, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYNKwkAjqd3bcgYBrt7dwAAAhM"]
[Fri Feb 06 23:47:56.178284 2026] [:error] [pid 37019:tid 37038] [client 49.247.31.241:34136] [client 49.247.31.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 49.247.31.241, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYNLAkAjqd3bcgYBrt7eAAAAhE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:48:35.671866 2026] [:error] [pid 46432:tid 46454] [client 159.203.0.194:61372] [client 159.203.0.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.203.0.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYNUwbwJwu_od0kZjNBpwAAAlQ"]
[Fri Feb 06 23:48:37.186558 2026] [:error] [pid 3380:tid 3404] [client 159.203.0.194:61445] [client 159.203.0.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.203.0.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYNVRFAlUvBGSBK2jd5tAAAABQ"]
[Fri Feb 06 23:51:13.156905 2026] [:error] [pid 3381:tid 3416] [client 103.145.51.249:56994] [client 103.145.51.249] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.145.51.249, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYN8S81zqRg96ZREgiL_gAAAEM"]
[Fri Feb 06 23:51:14.303017 2026] [:error] [pid 3381:tid 3436] [client 103.145.51.249:56994] [client 103.145.51.249] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.145.51.249, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYN8i81zqRg96ZREgiL_wAAAFc"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:52:20.209751 2026] [:error] [pid 46432:tid 46450] [client 181.214.100.145:58432] [client 181.214.100.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 181.214.100.145, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYONAbwJwu_od0kZjNCMgAAAlA"]
[Fri Feb 06 23:52:21.128361 2026] [:error] [pid 46432:tid 46443] [client 181.214.100.145:58432] [client 181.214.100.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 181.214.100.145, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYONQbwJwu_od0kZjNCNAAAAkk"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:52:31.584404 2026] [:error] [pid 15821:tid 15837] [client 94.136.187.150:55872] [client 94.136.187.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.136.187.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYOP3ARQa67J4c772kkmwAAAQw"]
[Fri Feb 06 23:52:32.579155 2026] [:error] [pid 15821:tid 15828] [client 94.136.187.150:55872] [client 94.136.187.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.136.187.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYOQHARQa67J4c772kknQAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:53:39.079254 2026] [:error] [pid 37019:tid 37043] [client 54.255.216.38:48886] [client 54.255.216.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.255.216.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYOgwkAjqd3bcgYBrt74gAAAhY"]
[Fri Feb 06 23:53:40.050453 2026] [:error] [pid 37019:tid 37030] [client 54.255.216.38:48886] [client 54.255.216.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.255.216.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYOhAkAjqd3bcgYBrt75QAAAgk"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:54:32.851997 2026] [:error] [pid 15821:tid 15834] [client 192.185.81.201:41790] [client 192.185.81.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.81.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYOuHARQa67J4c772kkwgAAAQk"]
[Fri Feb 06 23:54:36.877784 2026] [:error] [pid 15821:tid 15842] [client 192.185.81.201:41790] [client 192.185.81.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.81.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYOvHARQa67J4c772kkxQAAARE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:54:43.972586 2026] [:error] [pid 36928:tid 36949] [client 50.87.253.125:22988] [client 50.87.253.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.253.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYOw5s7fyU8D36r-OqSPwAAAdE"]
[Fri Feb 06 23:55:01.048151 2026] [:error] [pid 36928:tid 36953] [client 112.213.89.124:46218] [client 112.213.89.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 112.213.89.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYO1Zs7fyU8D36r-OqSSQAAAdU"]
[Fri Feb 06 23:55:02.078034 2026] [:error] [pid 36928:tid 36954] [client 112.213.89.124:46218] [client 112.213.89.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 112.213.89.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYO1ps7fyU8D36r-OqSTAAAAdY"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:55:18.552010 2026] [:error] [pid 36857:tid 36869] [client 50.87.253.125:50058] [client 50.87.253.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.253.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYO5pVQwfj7Kp4Dd0EFHQAAAYo"]
[Fri Feb 06 23:55:26.922679 2026] [:error] [pid 37019:tid 37037] [client 50.87.253.125:35870] [client 50.87.253.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.253.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYO7gkAjqd3bcgYBrt8BgAAAhA"]
[Fri Feb 06 23:55:30.560650 2026] [:error] [pid 37019:tid 37025] [client 50.87.253.125:35870] [client 50.87.253.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.253.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYO8gkAjqd3bcgYBrt8DQAAAgQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:56:16.929530 2026] [:error] [pid 46432:tid 46441] [client 78.128.60.70:41702] [client 78.128.60.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.128.60.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYPIAbwJwu_od0kZjNCiAAAAkc"]
[Fri Feb 06 23:56:20.003276 2026] [:error] [pid 46432:tid 46454] [client 78.128.60.70:41702] [client 78.128.60.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.128.60.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYPJAbwJwu_od0kZjNCigAAAlQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:57:28.357903 2026] [:error] [pid 36857:tid 36864] [client 49.247.31.241:29360] [client 49.247.31.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 49.247.31.241, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYPaJVQwfj7Kp4Dd0EFWAAAAYU"]
[Fri Feb 06 23:57:29.708686 2026] [:error] [pid 36857:tid 36878] [client 49.247.31.241:29360] [client 49.247.31.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 49.247.31.241, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYPaZVQwfj7Kp4Dd0EFWQAAAZM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 06 23:58:20.617463 2026] [:error] [pid 36928:tid 36937] [client 209.235.136.133:43834] [client 209.235.136.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYPnJs7fyU8D36r-OqTmgAAAcU"]
[Fri Feb 06 23:58:48.241494 2026] [:error] [pid 3382:tid 3447] [client 209.235.136.133:41216] [client 209.235.136.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYPuMIgU1HR0rhYrE92yAAAAIc"]
[Fri Feb 06 23:59:08.084294 2026] [:error] [pid 46432:tid 46451] [client 209.235.136.133:35842] [client 209.235.136.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYPzAbwJwu_od0kZjNC-QAAAlE"]
[Sat Feb 07 00:02:04.709863 2026] [:error] [pid 3381:tid 3432] [client 50.116.87.240:19034] [client 50.116.87.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.116.87.240, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYQfC81zqRg96ZREgiOEwAAAFM"]
[Sat Feb 07 00:02:07.812892 2026] [:error] [pid 3381:tid 3423] [client 50.116.87.240:19034] [client 50.116.87.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.116.87.240, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYQfy81zqRg96ZREgiOFgAAAEo"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:02:54.995254 2026] [:error] [pid 3381:tid 3422] [client 209.235.136.148:33514] [client 209.235.136.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.148, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYQri81zqRg96ZREgiOLgAAAEk"]
[Sat Feb 07 00:02:56.296883 2026] [:error] [pid 3381:tid 3437] [client 209.235.136.148:33514] [client 209.235.136.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.148, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYQsC81zqRg96ZREgiOLwAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:03:01.156672 2026] [:error] [pid 15821:tid 15832] [client 159.198.37.158:52170] [client 159.198.37.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.198.37.158, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYQtXARQa67J4c772klyAAAAQc"]
[Sat Feb 07 00:03:02.094021 2026] [:error] [pid 15821:tid 15838] [client 159.198.37.158:52170] [client 159.198.37.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.198.37.158, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYQtnARQa67J4c772klygAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:03:14.902598 2026] [:error] [pid 36857:tid 36867] [client 52.71.49.243:42536] [client 52.71.49.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.71.49.243, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYQwpVQwfj7Kp4Dd0EGGQAAAYg"]
[Sat Feb 07 00:03:16.152852 2026] [:error] [pid 36857:tid 36880] [client 52.71.49.243:42536] [client 52.71.49.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.71.49.243, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYQxJVQwfj7Kp4Dd0EGGgAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:05:31.722712 2026] [:error] [pid 36928:tid 36938] [client 101.99.90.29:36202] [client 101.99.90.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.99.90.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYRS5s7fyU8D36r-OqVXAAAAcY"]
[Sat Feb 07 00:05:34.796085 2026] [:error] [pid 36928:tid 36948] [client 101.99.90.29:36202] [client 101.99.90.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.99.90.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYRTps7fyU8D36r-OqVXwAAAdA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:10:22.424353 2026] [:error] [pid 36857:tid 36880] [client 152.53.204.199:52530] [client 152.53.204.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.53.204.199, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYSbpVQwfj7Kp4Dd0EG3QAAAZU"]
[Sat Feb 07 00:10:25.055857 2026] [:error] [pid 36857:tid 36872] [client 152.53.204.199:52530] [client 152.53.204.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.53.204.199, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYScZVQwfj7Kp4Dd0EG4AAAAY0"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:11:02.245681 2026] [:error] [pid 37019:tid 37040] [client 43.229.86.17:44248] [client 43.229.86.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.229.86.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYSlgkAjqd3bcgYBrt-IgAAAhM"]
[Sat Feb 07 00:11:03.332414 2026] [:error] [pid 37019:tid 37035] [client 43.229.86.17:44248] [client 43.229.86.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.229.86.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYSlwkAjqd3bcgYBrt-IwAAAg4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:11:48.242439 2026] [:error] [pid 15821:tid 15828] [client 3.7.184.189:45704] [client 3.7.184.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.7.184.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYSxHARQa67J4c772knDgAAAQM"]
[Sat Feb 07 00:11:49.219364 2026] [:error] [pid 15821:tid 15839] [client 3.7.184.189:45704] [client 3.7.184.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.7.184.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYSxXARQa67J4c772knDwAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:11:52.811429 2026] [:error] [pid 15821:tid 15837] [client 64.91.224.70:42204] [client 64.91.224.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.91.224.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYSyHARQa67J4c772knEwAAAQw"]
[Sat Feb 07 00:11:54.201908 2026] [:error] [pid 15821:tid 15830] [client 64.91.224.70:42204] [client 64.91.224.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.91.224.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYSynARQa67J4c772knFgAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:16:22.131118 2026] [:error] [pid 36857:tid 36870] [client 81.22.243.161:34458] [client 81.22.243.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.22.243.161, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYT1pVQwfj7Kp4Dd0EHugAAAYs"]
[Sat Feb 07 00:16:23.376722 2026] [:error] [pid 36857:tid 36876] [client 81.22.243.161:34458] [client 81.22.243.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.22.243.161, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYT15VQwfj7Kp4Dd0EHvQAAAZE"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:18:56.969958 2026] [:error] [pid 36857:tid 36877] [client 82.223.203.218:53034] [client 82.223.203.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.203.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYUcJVQwfj7Kp4Dd0EIVgAAAZI"]
[Sat Feb 07 00:18:59.141970 2026] [:error] [pid 36857:tid 36860] [client 82.223.203.218:53034] [client 82.223.203.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.203.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYUc5VQwfj7Kp4Dd0EIWQAAAYE"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:25:11.705511 2026] [:error] [pid 3477:tid 3502] [client 35.91.35.38:47330] [client 35.91.35.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.91.35.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYV57L0Hdh40C7HYgWT7wAAANc"]
[Sat Feb 07 00:25:13.083821 2026] [:error] [pid 3477:tid 3496] [client 35.91.35.38:47330] [client 35.91.35.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.91.35.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYV6bL0Hdh40C7HYgWT8AAAANE"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:25:25.156859 2026] [:error] [pid 37019:tid 37029] [client 162.0.219.118:33874] [client 162.0.219.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.219.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYV9QkAjqd3bcgYBruBBgAAAgg"]
[Sat Feb 07 00:25:27.021348 2026] [:error] [pid 37019:tid 37034] [client 162.0.219.118:33874] [client 162.0.219.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.219.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYV9wkAjqd3bcgYBruBDQAAAg0"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:26:42.538749 2026] [:error] [pid 3382:tid 3459] [client 69.175.61.106:44266] [client 69.175.61.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.175.61.106, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYWQsIgU1HR0rhYrE99rAAAAJM"]
[Sat Feb 07 00:27:01.585498 2026] [:error] [pid 3513:tid 3536] [client 69.175.61.106:37908] [client 69.175.61.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.175.61.106, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYWVTSw3-HAlzpqSxzqbQAAAVU"]
[Sat Feb 07 00:27:04.195275 2026] [:error] [pid 3513:tid 3517] [client 69.175.61.106:37908] [client 69.175.61.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.175.61.106, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYWWDSw3-HAlzpqSxzqbgAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:29:37.567504 2026] [:error] [pid 3381:tid 3413] [client 205.196.209.171:32848] [client 205.196.209.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 205.196.209.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYW8S81zqRg96ZREgiUOQAAAEA"]
[Sat Feb 07 00:29:38.526638 2026] [:error] [pid 3381:tid 3434] [client 205.196.209.171:32848] [client 205.196.209.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 205.196.209.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYW8i81zqRg96ZREgiUOgAAAFU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:29:55.059199 2026] [:error] [pid 36857:tid 36879] [client 198.57.247.130:31658] [client 198.57.247.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.57.247.130, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYXA5VQwfj7Kp4Dd0EJtwAAAZQ"]
[Sat Feb 07 00:29:57.882068 2026] [:error] [pid 36857:tid 36861] [client 198.57.247.130:31658] [client 198.57.247.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.57.247.130, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYXBZVQwfj7Kp4Dd0EJuwAAAYI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:34:46.663528 2026] [:error] [pid 35307:tid 35383] [client 216.251.35.203:44836] [client 216.251.35.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.251.35.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYYJusb9VwRNUckGgu-pQAAABE"]
[Sat Feb 07 00:35:51.490754 2026] [:error] [pid 35307:tid 35376] [client 52.140.96.215:37808] [client 52.140.96.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.140.96.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYYZ-sb9VwRNUckGgu_OAAAAAo"]
[Sat Feb 07 00:35:52.727339 2026] [:error] [pid 35307:tid 35378] [client 52.140.96.215:37808] [client 52.140.96.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.140.96.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYYaOsb9VwRNUckGgu_OwAAAAw"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:36:35.512919 2026] [:error] [pid 55701:tid 55774] [client 198.57.247.130:11894] [client 198.57.247.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.57.247.130, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYYk8DNf5Dni-14pBC9lAAAAVI"]
[Sat Feb 07 00:36:36.483836 2026] [:error] [pid 55701:tid 55780] [client 198.57.247.130:11894] [client 198.57.247.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.57.247.130, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYYlMDNf5Dni-14pBC9mAAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:39:36.242423 2026] [:error] [pid 35537:tid 35560] [client 68.178.195.38:47236] [client 68.178.195.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.195.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYZSM1jKVeByUo420DTzQAAARU"]
[Sat Feb 07 00:39:37.225631 2026] [:error] [pid 35537:tid 35545] [client 68.178.195.38:47236] [client 68.178.195.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.195.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYZSc1jKVeByUo420DTzgAAAQY"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:42:03.616602 2026] [:error] [pid 35309:tid 35470] [client 181.214.100.145:60160] [client 181.214.100.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 181.214.100.145, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYZ24jeM9w-4dKewm-9ywAAAM8"]
[Sat Feb 07 00:42:04.690596 2026] [:error] [pid 35309:tid 35480] [client 181.214.100.145:60160] [client 181.214.100.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 181.214.100.145, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYZ3IjeM9w-4dKewm-9zAAAANg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:46:23.552079 2026] [:error] [pid 55701:tid 55758] [client 47.99.186.219:35700] [client 47.99.186.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.99.186.219, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYa38DNf5Dni-14pBDA7wAAAUM"]
[Sat Feb 07 00:46:26.415388 2026] [:error] [pid 55701:tid 55760] [client 47.99.186.219:35700] [client 47.99.186.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.99.186.219, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYa4sDNf5Dni-14pBDA9wAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:50:39.415402 2026] [:error] [pid 55616:tid 55620] [client 92.205.182.143:48752] [client 92.205.182.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.182.143, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYb3-zxeKHfFD-B2b3UmgAAAEE"]
[Sat Feb 07 00:50:45.389133 2026] [:error] [pid 55616:tid 55642] [client 81.22.243.161:60428] [client 81.22.243.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.22.243.161, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYb5ezxeKHfFD-B2b3UogAAAFc"]
[Sat Feb 07 00:50:46.318326 2026] [:error] [pid 55616:tid 55623] [client 81.22.243.161:60428] [client 81.22.243.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 81.22.243.161, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYb5uzxeKHfFD-B2b3UpAAAAEQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:51:20.024687 2026] [:error] [pid 35308:tid 35451] [client 92.205.182.143:42744] [client 92.205.182.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.182.143, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYcCAUnbRgf4hlvwiyUmgAAAJg"]
[Sat Feb 07 00:51:24.812778 2026] [:error] [pid 35308:tid 35437] [client 92.205.182.143:42744] [client 92.205.182.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.182.143, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYcDAUnbRgf4hlvwiyUngAAAIo"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:51:50.166596 2026] [:error] [pid 35307:tid 35372] [client 46.101.137.29:33348] [client 46.101.137.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.101.137.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYcJusb9VwRNUckGgvDIwAAAAc"]
[Sat Feb 07 00:51:51.121609 2026] [:error] [pid 35307:tid 35366] [client 46.101.137.29:33348] [client 46.101.137.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.101.137.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYcJ-sb9VwRNUckGgvDJAAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:54:08.961605 2026] [:error] [pid 35309:tid 35455] [client 64.91.224.70:34248] [client 64.91.224.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.91.224.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYcsIjeM9w-4dKewm_BBwAAAMA"]
[Sat Feb 07 00:54:09.993750 2026] [:error] [pid 35309:tid 35469] [client 64.91.224.70:34248] [client 64.91.224.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.91.224.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYcsYjeM9w-4dKewm_BDAAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 00:55:26.725764 2026] [:error] [pid 55701:tid 55780] [client 34.60.225.181:51239] [client 34.60.225.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.60.225.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYc_sDNf5Dni-14pBDE2QAAAVg"]
[Sat Feb 07 00:55:26.824738 2026] [:error] [pid 55616:tid 55629] [client 34.60.225.181:58918] [client 34.60.225.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.60.225.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYc_uzxeKHfFD-B2b3WngAAAEo"]
[Sat Feb 07 00:55:29.275408 2026] [:error] [pid 55616:tid 55624] [client 34.60.225.181:58918] [client 34.60.225.181] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYYdAezxeKHfFD-B2b3WpQAAAEU"]
[Sat Feb 07 00:55:29.486816 2026] [:error] [pid 55616:tid 55626] [client 34.60.225.181:58918] [client 34.60.225.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.60.225.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYdAezxeKHfFD-B2b3WpwAAAEc"]
[Sat Feb 07 00:55:30.595431 2026] [:error] [pid 55701:tid 55771] [client 34.60.225.181:51239] [client 34.60.225.181] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYYdAsDNf5Dni-14pBDE6AAAAU8"]
[Sat Feb 07 00:55:30.820367 2026] [:error] [pid 55701:tid 55779] [client 34.60.225.181:51239] [client 34.60.225.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.60.225.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYdAsDNf5Dni-14pBDE6wAAAVc"]
[Sat Feb 07 00:55:31.020596 2026] [:error] [pid 55701:tid 55764] [client 34.60.225.181:55688] [client 34.60.225.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.60.225.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYdA8DNf5Dni-14pBDE7AAAAUg"]
[Sat Feb 07 00:55:32.598656 2026] [:error] [pid 55616:tid 55621] [client 34.60.225.181:59561] [client 34.60.225.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.60.225.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYdBOzxeKHfFD-B2b3WrAAAAEI"]
[Sat Feb 07 00:55:32.598799 2026] [:error] [pid 55616:tid 55621] [client 34.60.225.181:59561] [client 34.60.225.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.60.225.181, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYdBOzxeKHfFD-B2b3WrAAAAEI"]
[Sat Feb 07 00:55:32.646072 2026] [:error] [pid 35537:tid 35547] [client 34.60.225.181:59567] [client 34.60.225.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.60.225.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYdBM1jKVeByUo420DY0wAAAQg"]
[Sat Feb 07 00:55:32.646198 2026] [:error] [pid 35537:tid 35547] [client 34.60.225.181:59567] [client 34.60.225.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.60.225.181, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYdBM1jKVeByUo420DY0wAAAQg"]
[Sat Feb 07 00:58:01.927302 2026] [:error] [pid 55701:tid 55760] [client 107.172.134.18:47108] [client 107.172.134.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.172.134.18, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYdmcDNf5Dni-14pBDGKAAAAUU"]
[Sat Feb 07 00:58:23.460468 2026] [:error] [pid 35537:tid 35544] [client 34.133.6.141:53279] [client 34.133.6.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.133.6.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYdr81jKVeByUo420DaQAAAAQU"]
[Sat Feb 07 00:58:26.351705 2026] [:error] [pid 35537:tid 35560] [client 34.133.6.141:53279] [client 34.133.6.141] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYYdss1jKVeByUo420DaSQAAARU"]
[Sat Feb 07 00:58:26.561134 2026] [:error] [pid 35537:tid 35554] [client 34.133.6.141:53279] [client 34.133.6.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.133.6.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYdss1jKVeByUo420DaSgAAAQ8"]
[Sat Feb 07 00:58:28.194730 2026] [:error] [pid 55701:tid 55776] [client 34.133.6.141:57788] [client 34.133.6.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.133.6.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYdtMDNf5Dni-14pBDGewAAAVQ"]
[Sat Feb 07 00:58:29.661303 2026] [:error] [pid 55616:tid 55628] [client 34.133.6.141:55041] [client 34.133.6.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.133.6.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYdtezxeKHfFD-B2b3YXgAAAEk"]
[Sat Feb 07 00:58:31.304567 2026] [:error] [pid 55701:tid 55756] [client 34.133.6.141:62491] [client 34.133.6.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.133.6.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYdt8DNf5Dni-14pBDGgwAAAUE"]
[Sat Feb 07 00:58:32.777288 2026] [:error] [pid 35309:tid 35456] [client 34.133.6.141:53233] [client 34.133.6.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.133.6.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYduIjeM9w-4dKewm_DJAAAAME"]
[Sat Feb 07 00:58:32.777485 2026] [:error] [pid 35309:tid 35456] [client 34.133.6.141:53233] [client 34.133.6.141] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.133.6.141, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYduIjeM9w-4dKewm_DJAAAAME"]
[Sat Feb 07 01:02:28.381316 2026] [:error] [pid 35308:tid 35439] [client 163.245.209.119:57056] [client 163.245.209.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 163.245.209.119, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYepAUnbRgf4hlvwiyYGQAAAIw"]
[Sat Feb 07 01:02:30.135031 2026] [:error] [pid 35308:tid 35443] [client 163.245.209.119:57056] [client 163.245.209.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 163.245.209.119, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYepgUnbRgf4hlvwiyYGwAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:03:19.894868 2026] [:error] [pid 35309:tid 35468] [client 46.101.137.29:53206] [client 46.101.137.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.101.137.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYe14jeM9w-4dKewm_FbQAAAM0"]
[Sat Feb 07 01:03:20.829033 2026] [:error] [pid 35309:tid 35469] [client 46.101.137.29:53206] [client 46.101.137.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.101.137.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYe2IjeM9w-4dKewm_FbwAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:03:24.015683 2026] [:error] [pid 55701:tid 55762] [client 3.82.50.143:53530] [client 3.82.50.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aYYe3MDNf5Dni-14pBDI2gAAAUc"]
[Sat Feb 07 01:04:32.535039 2026] [:error] [pid 35309:tid 35467] [client 84.247.191.248:40312] [client 84.247.191.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 84.247.191.248, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYfIIjeM9w-4dKewm_FvgAAAMw"]
[Sat Feb 07 01:04:35.385275 2026] [:error] [pid 35309:tid 35461] [client 84.247.191.248:40312] [client 84.247.191.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 84.247.191.248, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYfI4jeM9w-4dKewm_F0AAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:05:48.998401 2026] [:error] [pid 35307:tid 35380] [client 152.53.204.199:50068] [client 152.53.204.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.53.204.199, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYfbOsb9VwRNUckGgvHTAAAAA4"]
[Sat Feb 07 01:06:07.152806 2026] [:error] [pid 35307:tid 35377] [client 152.53.204.199:52342] [client 152.53.204.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.53.204.199, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYff-sb9VwRNUckGgvHXgAAAAs"]
[Sat Feb 07 01:06:11.476694 2026] [:error] [pid 35307:tid 35366] [client 152.53.204.199:52342] [client 152.53.204.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.53.204.199, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYfg-sb9VwRNUckGgvHYwAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:10:05.805758 2026] [:error] [pid 55616:tid 55622] [client 103.97.124.92:46602] [client 103.97.124.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.97.124.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYgbezxeKHfFD-B2b3cHwAAAEM"]
[Sat Feb 07 01:10:06.979733 2026] [:error] [pid 55616:tid 55634] [client 103.97.124.92:46602] [client 103.97.124.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.97.124.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYgbuzxeKHfFD-B2b3cIgAAAE8"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:12:42.030397 2026] [:error] [pid 35537:tid 35543] [client 171.111.192.222:43486] [client 171.111.192.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 171.111.192.222, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYhCs1jKVeByUo420DeQwAAAQQ"]
[Sat Feb 07 01:12:48.273978 2026] [:error] [pid 55616:tid 55630] [client 171.111.192.222:45846] [client 171.111.192.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 171.111.192.222, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYhEOzxeKHfFD-B2b3diwAAAEs"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:13:16.474518 2026] [:error] [pid 35307:tid 35365] [client 92.205.20.61:34272] [client 92.205.20.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.20.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYhLOsb9VwRNUckGgvI8wAAAAA"]
[Sat Feb 07 01:13:17.408888 2026] [:error] [pid 35307:tid 35380] [client 92.205.20.61:34272] [client 92.205.20.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.20.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYhLesb9VwRNUckGgvI9gAAAA4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:16:30.209479 2026] [:error] [pid 35307:tid 35382] [client 43.153.87.54:40804] [client 43.153.87.54] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYYh7usb9VwRNUckGgvKIQAAABA"]
[Sat Feb 07 01:17:15.441939 2026] [:error] [pid 55616:tid 55635] [client 92.204.221.160:41522] [client 92.204.221.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.204.221.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYiG-zxeKHfFD-B2b3ezwAAAFA"]
[Sat Feb 07 01:17:16.396427 2026] [:error] [pid 55616:tid 55628] [client 92.204.221.160:41522] [client 92.204.221.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.204.221.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYiHOzxeKHfFD-B2b3e0QAAAEk"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:22:01.892368 2026] [:error] [pid 55701:tid 55772] [client 35.91.35.38:60508] [client 35.91.35.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.91.35.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYjOcDNf5Dni-14pBDSgAAAAVA"]
[Sat Feb 07 01:22:03.101025 2026] [:error] [pid 55701:tid 55766] [client 35.91.35.38:60508] [client 35.91.35.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.91.35.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYjO8DNf5Dni-14pBDSgwAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:23:35.042863 2026] [:error] [pid 35309:tid 35455] [client 216.194.175.55:39384] [client 216.194.175.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.194.175.55, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYjl4jeM9w-4dKewm_LswAAAMA"]
[Sat Feb 07 01:23:37.230513 2026] [:error] [pid 55616:tid 55627] [client 216.194.175.55:41076] [client 216.194.175.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.194.175.55, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYjmezxeKHfFD-B2b3gsgAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:25:48.949238 2026] [:error] [pid 55616:tid 55630] [client 20.219.105.83:10880] [client 20.219.105.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.219.105.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYkHOzxeKHfFD-B2b3huAAAAEs"]
[Sat Feb 07 01:25:49.972704 2026] [:error] [pid 55616:tid 55633] [client 20.219.105.83:10880] [client 20.219.105.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.219.105.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYkHezxeKHfFD-B2b3huwAAAE4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:28:40.797361 2026] [:error] [pid 35308:tid 35432] [client 177.131.140.128:53390] [client 177.131.140.128] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 177.131.140.128, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYkyAUnbRgf4hlvwiyfRgAAAIU"]
[Sat Feb 07 01:28:58.523132 2026] [:error] [pid 35309:tid 35477] [client 177.131.140.128:59804] [client 177.131.140.128] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 177.131.140.128, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYk2ojeM9w-4dKewm_M_gAAANY"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:32:45.420023 2026] [:error] [pid 35537:tid 35556] [client 34.73.126.11:41052] [client 34.73.126.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.73.126.11, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYlvc1jKVeByUo420DjOgAAARE"]
[Sat Feb 07 01:32:46.874804 2026] [:error] [pid 35537:tid 35558] [client 34.73.126.11:41052] [client 34.73.126.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.73.126.11, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYlvs1jKVeByUo420DjPgAAARM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:33:37.217276 2026] [:error] [pid 55701:tid 55761] [client 103.216.118.192:51714] [client 103.216.118.192] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.216.118.192, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYl8cDNf5Dni-14pBDZAAAAAUY"]
[Sat Feb 07 01:33:39.391167 2026] [:error] [pid 35537:tid 35559] [client 103.216.118.192:51726] [client 103.216.118.192] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.216.118.192, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYl881jKVeByUo420DjqQAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:34:48.885503 2026] [:error] [pid 35309:tid 35464] [client 180.252.95.33:55830] [client 180.252.95.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 180.252.95.33, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYmOIjeM9w-4dKewm_O8QAAAMk"]
[Sat Feb 07 01:34:58.985229 2026] [:error] [pid 35309:tid 35458] [client 180.252.95.33:53958] [client 180.252.95.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 180.252.95.33, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYmQojeM9w-4dKewm_O-gAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:35:00.337357 2026] [:error] [pid 35537:tid 35546] [client 43.229.86.17:58706] [client 43.229.86.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.229.86.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYmRM1jKVeByUo420DkBgAAAQc"]
[Sat Feb 07 01:35:21.687737 2026] [:error] [pid 35308:tid 35449] [client 43.229.86.17:33974] [client 43.229.86.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.229.86.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYmWQUnbRgf4hlvwiyhDwAAAJY"]
[Sat Feb 07 01:35:37.026637 2026] [:error] [pid 55701:tid 55760] [client 43.229.86.17:40138] [client 43.229.86.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.229.86.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYmacDNf5Dni-14pBDZZQAAAUU"]
[Sat Feb 07 01:35:41.577435 2026] [:error] [pid 55701:tid 55768] [client 43.229.86.17:40138] [client 43.229.86.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.229.86.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYmbcDNf5Dni-14pBDZZgAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:37:20.048325 2026] [:error] [pid 50881:tid 50939] [client 69.175.61.106:60348] [client 69.175.61.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.175.61.106, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYm0F8TBLsqJpkSDKXV-QAAAYA"]
[Sat Feb 07 01:37:24.223588 2026] [:error] [pid 50881:tid 50955] [client 69.175.61.106:36514] [client 69.175.61.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.175.61.106, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYm1F8TBLsqJpkSDKXWAgAAAZA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:42:19.838394 2026] [:error] [pid 35309:tid 35461] [client 101.99.90.29:57212] [client 101.99.90.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.99.90.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYn-4jeM9w-4dKewm_R5wAAAMY"]
[Sat Feb 07 01:42:20.894915 2026] [:error] [pid 35309:tid 35479] [client 101.99.90.29:57212] [client 101.99.90.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.99.90.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYn_IjeM9w-4dKewm_R6AAAANc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:48:06.842342 2026] [:error] [pid 35307:tid 35378] [client 198.252.105.16:38602] [client 198.252.105.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.252.105.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYpVusb9VwRNUckGgvRewAAAAw"]
[Sat Feb 07 01:48:07.886833 2026] [:error] [pid 35307:tid 35365] [client 198.252.105.16:38602] [client 198.252.105.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.252.105.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYpV-sb9VwRNUckGgvRfQAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:48:47.407755 2026] [:error] [pid 55701:tid 55779] [client 101.99.90.29:54992] [client 101.99.90.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.99.90.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYpf8DNf5Dni-14pBDcPwAAAVc"]
[Sat Feb 07 01:48:48.481194 2026] [:error] [pid 55701:tid 55778] [client 101.99.90.29:54992] [client 101.99.90.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.99.90.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYpgMDNf5Dni-14pBDcQQAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:48:53.658024 2026] [:error] [pid 35309:tid 35476] [client 192.250.224.24:47650] [client 192.250.224.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.250.224.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYphYjeM9w-4dKewm_TUAAAANU"]
[Sat Feb 07 01:48:54.540790 2026] [:error] [pid 35309:tid 35474] [client 192.250.224.24:47650] [client 192.250.224.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.250.224.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYphojeM9w-4dKewm_TUwAAANM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:49:34.024387 2026] [:error] [pid 55616:tid 55623] [client 192.250.224.24:52188] [client 192.250.224.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.250.224.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYpruzxeKHfFD-B2b3ozwAAAEQ"]
[Sat Feb 07 01:49:36.174980 2026] [:error] [pid 35309:tid 35471] [client 192.250.224.24:52198] [client 192.250.224.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.250.224.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYpsIjeM9w-4dKewm_TjgAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:50:12.361726 2026] [:error] [pid 35537:tid 35562] [client 184.154.22.90:65131] [client 184.154.22.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.154.22.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYp1M1jKVeByUo420DnlwAAARc"]
[Sat Feb 07 01:50:13.651261 2026] [:error] [pid 35307:tid 35369] [client 65.108.238.179:31000] [client 65.108.238.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.108.238.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYp1esb9VwRNUckGgvR_wAAAAQ"]
[Sat Feb 07 01:50:13.686703 2026] [:error] [pid 55616:tid 55629] [client 103.20.213.90:65369] [client 103.20.213.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.20.213.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYp1ezxeKHfFD-B2b3o-gAAAEo"]
[Sat Feb 07 01:50:14.897213 2026] [:error] [pid 35307:tid 35377] [client 65.108.238.179:31000] [client 65.108.238.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.108.238.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYp1usb9VwRNUckGgvSAgAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:50:29.327116 2026] [:error] [pid 55616:tid 55634] [client 118.27.125.50:38760] [client 118.27.125.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.27.125.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYp5ezxeKHfFD-B2b3pAQAAAE8"]
[Sat Feb 07 01:50:29.709141 2026] [:error] [pid 35308:tid 35443] [client 195.88.82.88:57645] [client 195.88.82.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.88.82.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYp5QUnbRgf4hlvwiyj_gAAAJA"]
[Sat Feb 07 01:50:37.378320 2026] [:error] [pid 35308:tid 35432] [client 35.233.218.233:59634] [client 35.233.218.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.233.218.233, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYp7QUnbRgf4hlvwiykCAAAAIU"]
[Sat Feb 07 01:50:49.369469 2026] [:error] [pid 50881:tid 50949] [client 64.91.224.70:59770] [client 64.91.224.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.91.224.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYp-V8TBLsqJpkSDKXbPgAAAYo"]
[Sat Feb 07 01:50:50.220399 2026] [:error] [pid 50881:tid 50960] [client 64.91.224.70:59770] [client 64.91.224.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.91.224.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYp-l8TBLsqJpkSDKXbQAAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:50:51.669857 2026] [:error] [pid 50881:tid 50943] [client 43.129.189.147:44280] [client 43.129.189.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.129.189.147, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYp-18TBLsqJpkSDKXbQwAAAYQ"]
[Sat Feb 07 01:50:58.028532 2026] [:error] [pid 50881:tid 50960] [client 128.140.71.121:47730] [client 128.140.71.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.140.71.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYqAl8TBLsqJpkSDKXbTAAAAZU"]
[Sat Feb 07 01:51:08.643559 2026] [:error] [pid 50881:tid 50961] [client 185.225.22.28:54838] [client 185.225.22.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.225.22.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYYqDF8TBLsqJpkSDKXbVwAAAZY"]
[Sat Feb 07 01:56:50.666324 2026] [:error] [pid 35537:tid 35541] [client 162.240.52.25:43692] [client 162.240.52.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.52.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYrYs1jKVeByUo420DpXgAAAQI"]
[Sat Feb 07 01:56:54.341814 2026] [:error] [pid 35537:tid 35544] [client 162.240.52.25:43692] [client 162.240.52.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.52.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYrZs1jKVeByUo420DpZgAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:58:15.859404 2026] [:error] [pid 50881:tid 50960] [client 118.139.178.142:23942] [client 118.139.178.142] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 118.139.178.142, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYrt18TBLsqJpkSDKXeMwAAAZU"]
[Sat Feb 07 01:58:16.739882 2026] [:error] [pid 50881:tid 50954] [client 118.139.178.142:23942] [client 118.139.178.142] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 118.139.178.142, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYruF8TBLsqJpkSDKXeNQAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 01:59:56.469468 2026] [:error] [pid 35307:tid 35366] [client 84.247.191.248:43308] [client 84.247.191.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 84.247.191.248, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYsHOsb9VwRNUckGgvUPgAAAAE"]
[Sat Feb 07 01:59:58.929881 2026] [:error] [pid 55616:tid 55635] [client 84.247.191.248:43324] [client 84.247.191.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 84.247.191.248, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYsHuzxeKHfFD-B2b3rCQAAAFA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:00:41.201919 2026] [:error] [pid 55616:tid 55633] [client 118.139.182.105:26216] [client 118.139.182.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 118.139.182.105, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYsSezxeKHfFD-B2b3rJQAAAE4"]
[Sat Feb 07 02:00:43.272008 2026] [:error] [pid 35309:tid 35455] [client 118.139.182.105:26224] [client 118.139.182.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 118.139.182.105, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYsS4jeM9w-4dKewm_W-wAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:00:54.256299 2026] [:error] [pid 35309:tid 35471] [client 65.21.208.253:43890] [client 65.21.208.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.21.208.253, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYsVojeM9w-4dKewm_XCwAAANA"]
[Sat Feb 07 02:00:55.193076 2026] [:error] [pid 35309:tid 35456] [client 65.21.208.253:43890] [client 65.21.208.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.21.208.253, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYsV4jeM9w-4dKewm_XDgAAAME"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:02:25.677676 2026] [:error] [pid 35307:tid 35377] [client 84.247.191.248:49490] [client 84.247.191.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 84.247.191.248, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYssesb9VwRNUckGgvUlgAAAAs"]
[Sat Feb 07 02:02:27.679044 2026] [:error] [pid 35307:tid 35365] [client 84.247.191.248:49490] [client 84.247.191.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 84.247.191.248, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYss-sb9VwRNUckGgvUmAAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:05:36.066982 2026] [:error] [pid 35309:tid 35461] [client 91.134.77.234:40233] [client 91.134.77.234] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.134.77.234, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYtcIjeM9w-4dKewm_YLQAAAMY"]
[Sat Feb 07 02:05:36.950037 2026] [:error] [pid 35309:tid 35474] [client 91.134.77.234:40233] [client 91.134.77.234] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.134.77.234, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYtcIjeM9w-4dKewm_YLgAAANM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:10:11.101921 2026] [:error] [pid 35309:tid 35464] [client 216.251.35.203:53988] [client 216.251.35.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.251.35.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYug4jeM9w-4dKewm_ZQwAAAMk"]
[Sat Feb 07 02:10:12.148064 2026] [:error] [pid 35309:tid 35476] [client 216.251.35.203:53988] [client 216.251.35.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.251.35.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYuhIjeM9w-4dKewm_ZRgAAANU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:13:21.928632 2026] [:error] [pid 35307:tid 35373] [client 45.77.246.163:54294] [client 45.77.246.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.77.246.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYvQesb9VwRNUckGgvW9AAAAAg"]
[Sat Feb 07 02:13:22.895356 2026] [:error] [pid 35307:tid 35379] [client 45.77.246.163:54294] [client 45.77.246.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.77.246.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYvQusb9VwRNUckGgvW9QAAAA0"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:13:32.228611 2026] [:error] [pid 35309:tid 35463] [client 209.235.136.133:41082] [client 209.235.136.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYvTIjeM9w-4dKewm_aWAAAAMg"]
[Sat Feb 07 02:13:33.119917 2026] [:error] [pid 35309:tid 35472] [client 209.235.136.133:41082] [client 209.235.136.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYvTYjeM9w-4dKewm_aWwAAANE"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:13:38.129976 2026] [:error] [pid 35308:tid 35445] [client 103.216.118.192:36642] [client 103.216.118.192] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.216.118.192, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYvUgUnbRgf4hlvwiyoUwAAAJI"]
[Sat Feb 07 02:13:45.529660 2026] [:error] [pid 35308:tid 35428] [client 103.216.118.192:33606] [client 103.216.118.192] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.216.118.192, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYvWQUnbRgf4hlvwiyoXwAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:14:31.447228 2026] [:error] [pid 35307:tid 35377] [client 103.216.118.192:42072] [client 103.216.118.192] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.216.118.192, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYvh-sb9VwRNUckGgvXSAAAAAs"]
[Sat Feb 07 02:14:32.385831 2026] [:error] [pid 35307:tid 35380] [client 103.216.118.192:42072] [client 103.216.118.192] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.216.118.192, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYviOsb9VwRNUckGgvXSQAAAA4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:16:16.322687 2026] [:error] [pid 35537:tid 35560] [client 69.175.61.106:59410] [client 69.175.61.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.175.61.106, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYv8M1jKVeByUo420DtMwAAARU"]
[Sat Feb 07 02:16:18.274425 2026] [:error] [pid 35309:tid 35459] [client 69.175.61.106:36604] [client 69.175.61.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.175.61.106, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYv8ojeM9w-4dKewm_bgAAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:17:39.181135 2026] [:error] [pid 35308:tid 35434] [client 45.77.246.163:57832] [client 45.77.246.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.77.246.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYwQwUnbRgf4hlvwiypYwAAAIc"]
[Sat Feb 07 02:17:40.109965 2026] [:error] [pid 35308:tid 35444] [client 45.77.246.163:57832] [client 45.77.246.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.77.246.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYwRAUnbRgf4hlvwiypZwAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:28:08.718688 2026] [:error] [pid 50881:tid 50960] [client 149.28.143.127:22966] [client 149.28.143.127] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.28.143.127, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYyuF8TBLsqJpkSDKXqHAAAAZU"]
[Sat Feb 07 02:28:10.947767 2026] [:error] [pid 50881:tid 50953] [client 149.28.143.127:22966] [client 149.28.143.127] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 149.28.143.127, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYyul8TBLsqJpkSDKXqIAAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:31:04.169525 2026] [:error] [pid 50881:tid 50943] [client 217.195.196.83:36360] [client 217.195.196.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.195.196.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYzaF8TBLsqJpkSDKXrtQAAAYQ"]
[Sat Feb 07 02:31:05.189965 2026] [:error] [pid 50881:tid 50940] [client 217.195.196.83:36360] [client 217.195.196.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.195.196.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYYzaV8TBLsqJpkSDKXrtwAAAYE"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:35:32.974486 2026] [:error] [pid 35307:tid 35367] [client 185.118.190.223:43424] [client 185.118.190.223] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.118.190.223, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY0dOsb9VwRNUckGgvdcAAAAAI"]
[Sat Feb 07 02:35:34.021765 2026] [:error] [pid 35307:tid 35389] [client 185.118.190.223:43424] [client 185.118.190.223] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.118.190.223, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY0dusb9VwRNUckGgvddAAAABc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:35:58.299993 2026] [:error] [pid 35307:tid 35384] [client 50.62.149.159:26650] [client 50.62.149.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.149.159, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY0jusb9VwRNUckGgvdiAAAABI"]
[Sat Feb 07 02:35:59.224765 2026] [:error] [pid 35307:tid 35379] [client 50.62.149.159:26650] [client 50.62.149.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.149.159, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY0j-sb9VwRNUckGgvdigAAAA0"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:38:08.338564 2026] [:error] [pid 35308:tid 35432] [client 68.178.227.246:51612] [client 68.178.227.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.227.246, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY1EAUnbRgf4hlvwiyu5wAAAIU"]
[Sat Feb 07 02:38:10.185682 2026] [:error] [pid 35308:tid 35446] [client 68.178.227.246:51612] [client 68.178.227.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.227.246, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY1EgUnbRgf4hlvwiyu6gAAAJM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:38:35.429470 2026] [:error] [pid 55701:tid 55772] [client 162.240.10.235:39542] [client 162.240.10.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.10.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY1K8DNf5Dni-14pBDnTwAAAVA"]
[Sat Feb 07 02:38:36.320774 2026] [:error] [pid 55701:tid 55773] [client 162.240.10.235:39542] [client 162.240.10.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.10.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY1LMDNf5Dni-14pBDnUAAAAVE"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:40:45.417524 2026] [:error] [pid 35309:tid 35467] [client 159.198.37.158:59108] [client 159.198.37.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.198.37.158, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY1rYjeM9w-4dKewm_ijgAAAMw"]
[Sat Feb 07 02:40:46.312868 2026] [:error] [pid 35309:tid 35476] [client 159.198.37.158:59108] [client 159.198.37.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.198.37.158, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY1rojeM9w-4dKewm_ikAAAANU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:41:33.067706 2026] [:error] [pid 35537:tid 35559] [client 45.77.246.163:45498] [client 45.77.246.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.77.246.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYY13c1jKVeByUo420D0kgAAARQ"]
[Sat Feb 07 02:42:02.279791 2026] [:error] [pid 55616:tid 55629] [client 82.223.245.250:53724] [client 82.223.245.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.245.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY1-uzxeKHfFD-B2b32KAAAAEo"]
[Sat Feb 07 02:42:03.371915 2026] [:error] [pid 55616:tid 55635] [client 82.223.245.250:53724] [client 82.223.245.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.245.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY1--zxeKHfFD-B2b32LAAAAFA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:42:12.314495 2026] [:error] [pid 35307:tid 35374] [client 92.205.182.143:45432] [client 92.205.182.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.182.143, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY2BOsb9VwRNUckGgvfIQAAAAk"]
[Sat Feb 07 02:42:14.119649 2026] [:error] [pid 35307:tid 35377] [client 92.205.182.143:45438] [client 92.205.182.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.182.143, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY2Busb9VwRNUckGgvfJgAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:46:15.982754 2026] [:error] [pid 35537:tid 35556] [client 64.91.224.70:56092] [client 64.91.224.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.91.224.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY2981jKVeByUo420D2AwAAARE"]
[Sat Feb 07 02:46:16.960841 2026] [:error] [pid 35537:tid 35555] [client 64.91.224.70:56092] [client 64.91.224.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.91.224.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY2-M1jKVeByUo420D2BwAAARA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:48:06.632582 2026] [:error] [pid 50881:tid 50946] [client 31.220.151.86:17336] [client 31.220.151.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.220.151.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY3Zl8TBLsqJpkSDKXx7gAAAYc"]
[Sat Feb 07 02:48:07.558380 2026] [:error] [pid 50881:tid 50953] [client 31.220.151.86:17336] [client 31.220.151.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.220.151.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY3Z18TBLsqJpkSDKXx8QAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:50:35.166978 2026] [:error] [pid 35307:tid 35387] [client 162.0.220.160:45736] [client 162.0.220.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.220.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY3--sb9VwRNUckGgvhkAAAABU"]
[Sat Feb 07 02:50:37.136337 2026] [:error] [pid 35308:tid 35451] [client 162.0.220.160:47304] [client 162.0.220.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.220.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY3_QUnbRgf4hlvwiyxlQAAAJg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:50:49.713789 2026] [:error] [pid 35308:tid 35436] [client 162.0.220.160:36052] [client 162.0.220.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.220.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY4CQUnbRgf4hlvwiyxmQAAAIk"]
[Sat Feb 07 02:50:50.561059 2026] [:error] [pid 35308:tid 35447] [client 162.0.220.160:36052] [client 162.0.220.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.220.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY4CgUnbRgf4hlvwiyxmgAAAJQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:52:07.503485 2026] [:error] [pid 50881:tid 50954] [client 64.91.224.70:51384] [client 64.91.224.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.91.224.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY4V18TBLsqJpkSDKXzdQAAAY8"]
[Sat Feb 07 02:52:08.476049 2026] [:error] [pid 50881:tid 50957] [client 64.91.224.70:51384] [client 64.91.224.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.91.224.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY4WF8TBLsqJpkSDKXzeAAAAZI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:52:58.899477 2026] [:error] [pid 35537:tid 35553] [client 65.254.225.219:46358] [client 65.254.225.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.219, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY4is1jKVeByUo420D3iAAAAQ4"]
[Sat Feb 07 02:52:59.816135 2026] [:error] [pid 35537:tid 35550] [client 65.254.225.219:46358] [client 65.254.225.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.219, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY4i81jKVeByUo420D3igAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:54:00.380333 2026] [:error] [pid 50881:tid 50958] [client 69.175.61.106:38032] [client 69.175.61.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.175.61.106, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYY4yF8TBLsqJpkSDKX0mwAAAZM"]
[Sat Feb 07 02:54:55.097029 2026] [:error] [pid 50881:tid 50959] [client 109.234.160.91:45788] [client 109.234.160.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.234.160.91, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY4_18TBLsqJpkSDKX08wAAAZQ"]
[Sat Feb 07 02:54:56.063399 2026] [:error] [pid 50881:tid 50954] [client 109.234.160.91:45788] [client 109.234.160.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.234.160.91, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY5AF8TBLsqJpkSDKX09QAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:55:25.247113 2026] [:error] [pid 50881:tid 50953] [client 135.181.134.243:47926] [client 135.181.134.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 135.181.134.243, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY5HV8TBLsqJpkSDKX1NgAAAY4"]
[Sat Feb 07 02:55:27.296012 2026] [:error] [pid 50881:tid 50946] [client 135.181.134.243:47932] [client 135.181.134.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 135.181.134.243, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY5H18TBLsqJpkSDKX1OgAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:57:15.205117 2026] [:error] [pid 55616:tid 55637] [client 192.163.196.216:48466] [client 192.163.196.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.163.196.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY5i-zxeKHfFD-B2b35egAAAFI"]
[Sat Feb 07 02:59:03.933740 2026] [:error] [pid 55616:tid 55633] [client 107.180.114.192:40090] [client 107.180.114.192] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.114.192, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY59-zxeKHfFD-B2b36DwAAAE4"]
[Sat Feb 07 02:59:04.858952 2026] [:error] [pid 55616:tid 55637] [client 107.180.114.192:40090] [client 107.180.114.192] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.114.192, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY5-OzxeKHfFD-B2b36EgAAAFI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:59:18.270791 2026] [:error] [pid 35537:tid 35548] [client 31.220.151.86:53382] [client 31.220.151.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.220.151.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY6Bs1jKVeByUo420D50AAAAQk"]
[Sat Feb 07 02:59:19.951529 2026] [:error] [pid 35308:tid 35435] [client 31.220.151.86:53388] [client 31.220.151.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.220.151.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY6BwUnbRgf4hlvwiyzmgAAAIg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:59:40.252519 2026] [:error] [pid 50881:tid 50956] [client 208.109.39.153:50610] [client 208.109.39.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.39.153, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY6HF8TBLsqJpkSDKX3awAAAZE"]
[Sat Feb 07 02:59:42.087606 2026] [:error] [pid 50881:tid 50941] [client 208.109.39.153:50610] [client 208.109.39.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.39.153, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY6Hl8TBLsqJpkSDKX3eAAAAYI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 02:59:52.880614 2026] [:error] [pid 50881:tid 50945] [client 31.220.151.86:27958] [client 31.220.151.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.220.151.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY6KF8TBLsqJpkSDKX3oAAAAYY"]
[Sat Feb 07 02:59:55.685565 2026] [:error] [pid 55701:tid 55771] [client 31.220.151.86:27966] [client 31.220.151.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.220.151.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY6K8DNf5Dni-14pBDsqgAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:02:47.127586 2026] [:error] [pid 55616:tid 55642] [client 217.195.196.83:37374] [client 217.195.196.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.195.196.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY61-zxeKHfFD-B2b368gAAAFc"]
[Sat Feb 07 03:02:48.162447 2026] [:error] [pid 55616:tid 55619] [client 217.195.196.83:37374] [client 217.195.196.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.195.196.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY62OzxeKHfFD-B2b369AAAAEA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:03:25.564028 2026] [:error] [pid 35308:tid 35427] [client 107.180.115.190:19260] [client 107.180.115.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.115.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY6_QUnbRgf4hlvwiy0ogAAAIA"]
[Sat Feb 07 03:03:28.039602 2026] [:error] [pid 55616:tid 55630] [client 107.180.115.190:19264] [client 107.180.115.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.115.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY7AOzxeKHfFD-B2b37FQAAAEs"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:04:38.645561 2026] [:error] [pid 35308:tid 35428] [client 5.180.107.178:50224] [client 5.180.107.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.180.107.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYY7RgUnbRgf4hlvwiy08gAAAIE"]
[Sat Feb 07 03:04:48.498489 2026] [:error] [pid 50881:tid 50949] [client 135.181.134.243:33190] [client 135.181.134.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 135.181.134.243, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY7UF8TBLsqJpkSDKX5oAAAAYo"]
[Sat Feb 07 03:04:51.081109 2026] [:error] [pid 35307:tid 35367] [client 135.181.134.243:33194] [client 135.181.134.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 135.181.134.243, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY7U-sb9VwRNUckGgvl1wAAAAI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:06:39.615768 2026] [:error] [pid 55701:tid 55777] [client 82.223.203.218:51260] [client 82.223.203.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.203.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY7v8DNf5Dni-14pBDucgAAAVU"]
[Sat Feb 07 03:06:42.965656 2026] [:error] [pid 35309:tid 35480] [client 82.223.203.218:51264] [client 82.223.203.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.203.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY7wojeM9w-4dKewm_qlQAAANg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:06:44.708475 2026] [:error] [pid 50881:tid 50949] [client 154.199.69.241:37328] [client 154.199.69.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.199.69.241, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY7xF8TBLsqJpkSDKX6ygAAAYo"]
[Sat Feb 07 03:06:46.887144 2026] [:error] [pid 35537:tid 35560] [client 156.239.210.166:53142] [client 156.239.210.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.210.166, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY7xs1jKVeByUo420D8nQAAARU"], referer: http://expressinteriors.com/wp-login.php
[Sat Feb 07 03:06:48.746646 2026] [:error] [pid 50881:tid 50952] [client 154.199.15.112:37326] [client 154.199.15.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYY7yF8TBLsqJpkSDKX60wAAAY0"]
[Sat Feb 07 03:06:50.157428 2026] [:error] [pid 35309:tid 35458] [client 156.239.223.199:54882] [client 156.239.223.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.223.199, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY7yojeM9w-4dKewm_qpQAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:06:50.162568 2026] [:error] [pid 35309:tid 35458] [client 156.239.223.199:54882] [client 156.239.223.199] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY7yojeM9w-4dKewm_qpQAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:06:52.931902 2026] [:error] [pid 35309:tid 35460] [client 156.239.207.201:38256] [client 156.239.207.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.207.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY7zIjeM9w-4dKewm_qqAAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:06:52.935808 2026] [:error] [pid 35309:tid 35460] [client 156.239.207.201:38256] [client 156.239.207.201] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY7zIjeM9w-4dKewm_qqAAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:06:55.694731 2026] [:error] [pid 35308:tid 35436] [client 45.206.73.125:53402] [client 45.206.73.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.206.73.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY7zwUnbRgf4hlvwiy1qAAAAIk"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:06:55.698126 2026] [:error] [pid 35308:tid 35436] [client 45.206.73.125:53402] [client 45.206.73.125] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY7zwUnbRgf4hlvwiy1qAAAAIk"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:06:58.026076 2026] [:error] [pid 55616:tid 55626] [client 154.193.153.44:58800] [client 154.193.153.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.193.153.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY70uzxeKHfFD-B2b377wAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:06:58.031616 2026] [:error] [pid 55616:tid 55626] [client 154.193.153.44:58800] [client 154.193.153.44] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY70uzxeKHfFD-B2b377wAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:07:00.763648 2026] [:error] [pid 55701:tid 55765] [client 156.242.51.179:45562] [client 156.242.51.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.242.51.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY71MDNf5Dni-14pBDuiQAAAUk"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:07:00.767156 2026] [:error] [pid 55701:tid 55765] [client 156.242.51.179:45562] [client 156.242.51.179] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY71MDNf5Dni-14pBDuiQAAAUk"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:08:56.003820 2026] [:error] [pid 55616:tid 55631] [client 162.240.52.25:48528] [client 162.240.52.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.52.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY8SOzxeKHfFD-B2b38dAAAAEw"]
[Sat Feb 07 03:08:56.924565 2026] [:error] [pid 55616:tid 55642] [client 162.240.52.25:48528] [client 162.240.52.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.52.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY8SOzxeKHfFD-B2b38dgAAAFc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:10:00.272509 2026] [:error] [pid 35537:tid 35557] [client 5.180.107.178:40016] [client 5.180.107.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.180.107.178, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY8iM1jKVeByUo420D9fwAAARI"]
[Sat Feb 07 03:10:01.329325 2026] [:error] [pid 35537:tid 35542] [client 5.180.107.178:40016] [client 5.180.107.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.180.107.178, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY8ic1jKVeByUo420D9gAAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:10:56.248819 2026] [:error] [pid 35537:tid 35552] [client 174.136.29.222:54636] [client 174.136.29.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 174.136.29.222, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY8wM1jKVeByUo420D9vAAAAQ0"]
[Sat Feb 07 03:10:58.778980 2026] [:error] [pid 50881:tid 50960] [client 174.136.29.222:54640] [client 174.136.29.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 174.136.29.222, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY8wl8TBLsqJpkSDKX7_wAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:11:54.537510 2026] [:error] [pid 50881:tid 50953] [client 213.154.231.200:48524] [client 213.154.231.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.154.231.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY8-l8TBLsqJpkSDKX8WQAAAY4"]
[Sat Feb 07 03:11:55.808356 2026] [:error] [pid 50881:tid 50952] [client 213.154.231.200:48524] [client 213.154.231.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.154.231.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY8-18TBLsqJpkSDKX8WwAAAY0"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:12:26.948243 2026] [:error] [pid 55616:tid 55638] [client 82.223.245.250:34462] [client 82.223.245.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.245.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY9GuzxeKHfFD-B2b39jgAAAFM"]
[Sat Feb 07 03:12:27.980568 2026] [:error] [pid 55616:tid 55622] [client 82.223.245.250:34462] [client 82.223.245.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.245.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYY9G-zxeKHfFD-B2b39kQAAAEM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:24:52.429601 2026] [:error] [pid 19970:tid 19999] [client 157.20.159.163:50206] [client 157.20.159.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.20.159.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZABP0_mZWEnOw3Tv3W2wAAANc"]
[Sat Feb 07 03:24:53.961049 2026] [:error] [pid 19970:tid 19978] [client 157.20.159.163:50206] [client 157.20.159.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.20.159.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZABf0_mZWEnOw3Tv3W3AAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:25:58.131622 2026] [:error] [pid 19879:tid 19946] [client 162.0.220.160:50366] [client 162.0.220.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.220.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZARshpdd5jUm69iDdwNAAAAIQ"]
[Sat Feb 07 03:26:02.910970 2026] [:error] [pid 19879:tid 19942] [client 162.0.220.160:50366] [client 162.0.220.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.220.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZASshpdd5jUm69iDdwOAAAAIA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:28:36.414311 2026] [autoindex:error] [pid 19878:tid 19939] [client 20.151.206.105:12931] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 03:28:44.588064 2026] [:error] [pid 19878:tid 19931] [client 20.151.206.105:12931] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aYZA7O8VxXcZObrExUs9JQAAAFA"]
[Sat Feb 07 03:28:45.027753 2026] [:error] [pid 19970:tid 19988] [client 20.151.206.105:13187] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aYZA7f0_mZWEnOw3Tv3ZPwAAAMw"]
[Sat Feb 07 03:28:45.460340 2026] [:error] [pid 19877:tid 19907] [client 20.151.206.105:13216] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aYZA7f92PxH5MPiXPJRiKQAAABM"]
[Sat Feb 07 03:28:45.887169 2026] [:error] [pid 19877:tid 19894] [client 20.151.206.105:13188] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aYZA7f92PxH5MPiXPJRiKwAAAAY"]
[Sat Feb 07 03:28:46.329762 2026] [:error] [pid 19877:tid 19888] [client 20.151.206.105:12950] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x56.php"] [unique_id "aYZA7v92PxH5MPiXPJRiLAAAAAA"]
[Sat Feb 07 03:28:46.820650 2026] [:error] [pid 19879:tid 19964] [client 20.151.206.105:12948] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x56.php"] [unique_id "aYZA7shpdd5jUm69iDdxRQAAAJY"]
[Sat Feb 07 03:28:47.233499 2026] [:error] [pid 19877:tid 19891] [client 20.151.206.105:13234] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x56.php"] [unique_id "aYZA7_92PxH5MPiXPJRiLgAAAAM"]
[Sat Feb 07 03:28:47.655396 2026] [:error] [pid 19879:tid 19961] [client 20.151.206.105:13189] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x56.php"] [unique_id "aYZA78hpdd5jUm69iDdxSAAAAJM"]
[Sat Feb 07 03:28:48.067796 2026] [:error] [pid 19970:tid 19980] [client 20.151.206.105:12930] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "aYZA8P0_mZWEnOw3Tv3ZRAAAAMQ"]
[Sat Feb 07 03:28:48.502508 2026] [:error] [pid 19879:tid 19944] [client 20.151.206.105:13201] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "aYZA8Mhpdd5jUm69iDdxSwAAAII"]
[Sat Feb 07 03:28:49.005042 2026] [:error] [pid 19877:tid 19898] [client 20.151.206.105:13206] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "aYZA8f92PxH5MPiXPJRiMgAAAAo"]
[Sat Feb 07 03:28:49.437424 2026] [:error] [pid 19970:tid 19998] [client 20.151.206.105:13184] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "aYZA8f0_mZWEnOw3Tv3ZSgAAANY"]
[Sat Feb 07 03:28:50.067833 2026] [:error] [pid 19879:tid 19965] [client 20.151.206.105:13231] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aYZA8shpdd5jUm69iDdxTgAAAJc"]
[Sat Feb 07 03:28:50.911329 2026] [:error] [pid 19879:tid 19945] [client 20.151.206.105:12942] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aYZA8shpdd5jUm69iDdxTwAAAIM"]
[Sat Feb 07 03:28:56.624783 2026] [:error] [pid 19879:tid 19962] [client 20.151.206.105:13197] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aYZA-Mhpdd5jUm69iDdxWwAAAJQ"]
[Sat Feb 07 03:28:57.041618 2026] [:error] [pid 19970:tid 19983] [client 20.151.206.105:12947] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aYZA-f0_mZWEnOw3Tv3ZYgAAAMc"]
[Sat Feb 07 03:28:57.473281 2026] [:error] [pid 19970:tid 19992] [client 20.151.206.105:13218] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x50.php"] [unique_id "aYZA-f0_mZWEnOw3Tv3ZZAAAANA"]
[Sat Feb 07 03:28:57.886046 2026] [:error] [pid 19970:tid 19999] [client 20.151.206.105:13240] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x50.php"] [unique_id "aYZA-f0_mZWEnOw3Tv3ZZwAAANc"]
[Sat Feb 07 03:28:58.307465 2026] [:error] [pid 19970:tid 19998] [client 20.151.206.105:13191] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x50.php"] [unique_id "aYZA-v0_mZWEnOw3Tv3ZaQAAANY"]
[Sat Feb 07 03:28:58.720447 2026] [:error] [pid 19878:tid 19930] [client 20.151.206.105:13238] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x50.php"] [unique_id "aYZA-u8VxXcZObrExUs9OwAAAE8"]
[Sat Feb 07 03:28:59.132501 2026] [:error] [pid 19878:tid 19933] [client 20.151.206.105:13217] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aYZA--8VxXcZObrExUs9PAAAAFI"]
[Sat Feb 07 03:28:59.652324 2026] [:error] [pid 19878:tid 19932] [client 20.151.206.105:12943] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aYZA--8VxXcZObrExUs9PgAAAFE"]
[Sat Feb 07 03:29:00.062893 2026] [:error] [pid 19879:tid 19948] [client 20.151.206.105:13223] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aYZA_Mhpdd5jUm69iDdxXwAAAIY"]
[Sat Feb 07 03:29:00.491420 2026] [:error] [pid 19878:tid 19915] [client 20.151.206.105:12928] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aYZA_O8VxXcZObrExUs9QQAAAEA"]
[Sat Feb 07 03:29:00.903904 2026] [:error] [pid 19970:tid 20000] [client 20.151.206.105:13245] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aYZA_P0_mZWEnOw3Tv3ZbgAAANg"]
[Sat Feb 07 03:29:01.329164 2026] [:error] [pid 19970:tid 19977] [client 20.151.206.105:12945] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aYZA_f0_mZWEnOw3Tv3ZcAAAAME"]
[Sat Feb 07 03:29:01.745879 2026] [:error] [pid 19970:tid 19987] [client 20.151.206.105:13196] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aYZA_f0_mZWEnOw3Tv3ZdQAAAMs"]
[Sat Feb 07 03:29:02.166062 2026] [:error] [pid 19970:tid 19982] [client 20.151.206.105:13219] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aYZA_v0_mZWEnOw3Tv3ZdwAAAMY"]
[Sat Feb 07 03:29:02.593052 2026] [:error] [pid 19879:tid 19959] [client 20.151.206.105:12937] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "aYZA_shpdd5jUm69iDdxYgAAAJE"]
[Sat Feb 07 03:29:03.004663 2026] [:error] [pid 19970:tid 19995] [client 20.151.206.105:12935] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "aYZA__0_mZWEnOw3Tv3ZfwAAANM"]
[Sat Feb 07 03:29:03.414815 2026] [:error] [pid 19970:tid 19986] [client 20.151.206.105:12949] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "aYZA__0_mZWEnOw3Tv3ZgwAAAMo"]
[Sat Feb 07 03:29:03.860647 2026] [:error] [pid 19878:tid 19927] [client 20.151.206.105:12944] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "aYZA_-8VxXcZObrExUs9QgAAAEw"]
[Sat Feb 07 03:29:04.272798 2026] [:error] [pid 19877:tid 19900] [client 20.151.206.105:13198] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aYZBAP92PxH5MPiXPJRiRAAAAAw"]
[Sat Feb 07 03:29:04.686760 2026] [:error] [pid 19970:tid 19980] [client 20.151.206.105:12932] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aYZBAP0_mZWEnOw3Tv3ZjgAAAMQ"]
[Sat Feb 07 03:29:05.102714 2026] [:error] [pid 19878:tid 19920] [client 20.151.206.105:13080] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aYZBAe8VxXcZObrExUs9RgAAAEU"]
[Sat Feb 07 03:29:05.519808 2026] [:error] [pid 19970:tid 19994] [client 20.151.206.105:12963] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aYZBAf0_mZWEnOw3Tv3ZkwAAANI"]
[Sat Feb 07 03:29:05.933869 2026] [:error] [pid 19970:tid 19984] [client 20.151.206.105:13066] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aYZBAf0_mZWEnOw3Tv3ZmQAAAMg"]
[Sat Feb 07 03:29:06.370984 2026] [:error] [pid 19970:tid 19998] [client 20.151.206.105:12940] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aYZBAv0_mZWEnOw3Tv3ZnAAAANY"]
[Sat Feb 07 03:29:06.787664 2026] [:error] [pid 19877:tid 19912] [client 20.151.206.105:13199] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aYZBAv92PxH5MPiXPJRiSQAAABg"]
[Sat Feb 07 03:29:07.218782 2026] [:error] [pid 19877:tid 19888] [client 20.151.206.105:13060] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aYZBA_92PxH5MPiXPJRiSgAAAAA"]
[Sat Feb 07 03:29:07.632704 2026] [:error] [pid 19878:tid 19917] [client 20.151.206.105:13058] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gtc.php"] [unique_id "aYZBA-8VxXcZObrExUs9WAAAAEI"]
[Sat Feb 07 03:29:08.043473 2026] [:error] [pid 19970:tid 19985] [client 20.151.206.105:12934] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gtc.php"] [unique_id "aYZBBP0_mZWEnOw3Tv3ZsAAAAMk"]
[Sat Feb 07 03:29:08.463272 2026] [:error] [pid 19878:tid 19916] [client 20.151.206.105:13209] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gtc.php"] [unique_id "aYZBBO8VxXcZObrExUs9XgAAAEE"]
[Sat Feb 07 03:29:08.875397 2026] [:error] [pid 19877:tid 19911] [client 20.151.206.105:13076] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gtc.php"] [unique_id "aYZBBP92PxH5MPiXPJRiUwAAABc"]
[Sat Feb 07 03:29:09.302061 2026] [:error] [pid 19879:tid 19946] [client 20.151.206.105:13246] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atx.php"] [unique_id "aYZBBchpdd5jUm69iDdxbAAAAIQ"]
[Sat Feb 07 03:29:09.722864 2026] [:error] [pid 19878:tid 19922] [client 20.151.206.105:13239] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atx.php"] [unique_id "aYZBBe8VxXcZObrExUs9bwAAAEc"]
[Sat Feb 07 03:29:10.134799 2026] [:error] [pid 19879:tid 19955] [client 20.151.206.105:13225] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atx.php"] [unique_id "aYZBBshpdd5jUm69iDdxcAAAAI0"]
[Sat Feb 07 03:29:10.550501 2026] [:error] [pid 19878:tid 19936] [client 20.151.206.105:13203] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atx.php"] [unique_id "aYZBBu8VxXcZObrExUs9dwAAAFU"]
[Sat Feb 07 03:29:10.975191 2026] [:error] [pid 19970:tid 19980] [client 20.151.206.105:12980] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aYZBBv0_mZWEnOw3Tv3aBgAAAMQ"]
[Sat Feb 07 03:29:11.387309 2026] [:error] [pid 19878:tid 19917] [client 20.151.206.105:12939] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aYZBB-8VxXcZObrExUs9ewAAAEI"]
[Sat Feb 07 03:29:11.800115 2026] [:error] [pid 19877:tid 19911] [client 20.151.206.105:12959] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aYZBB_92PxH5MPiXPJRifAAAABc"]
[Sat Feb 07 03:29:12.216218 2026] [:error] [pid 19970:tid 19982] [client 20.151.206.105:13210] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z60.php"] [unique_id "aYZBCP0_mZWEnOw3Tv3aKAAAAMY"]
[Sat Feb 07 03:29:12.651064 2026] [:error] [pid 19878:tid 19921] [client 20.151.206.105:13242] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aYZBCO8VxXcZObrExUs9ggAAAEY"]
[Sat Feb 07 03:29:13.061620 2026] [:error] [pid 19878:tid 19938] [client 20.151.206.105:12933] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aYZBCe8VxXcZObrExUs9gwAAAFc"]
[Sat Feb 07 03:29:13.471084 2026] [:error] [pid 19879:tid 19946] [client 20.151.206.105:13074] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aYZBCchpdd5jUm69iDdxfAAAAIQ"]
[Sat Feb 07 03:29:13.882638 2026] [:error] [pid 19879:tid 19959] [client 20.151.206.105:12991] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aYZBCchpdd5jUm69iDdxfQAAAJE"]
[Sat Feb 07 03:29:14.309430 2026] [:error] [pid 19970:tid 19985] [client 20.151.206.105:13244] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aYZBCv0_mZWEnOw3Tv3aQQAAAMk"]
[Sat Feb 07 03:29:14.723626 2026] [:error] [pid 19970:tid 19999] [client 20.151.206.105:12974] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aYZBCv0_mZWEnOw3Tv3aRAAAANc"]
[Sat Feb 07 03:29:15.133086 2026] [:error] [pid 19878:tid 19930] [client 20.151.206.105:13061] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aYZBC-8VxXcZObrExUs9iwAAAE8"]
[Sat Feb 07 03:29:15.544233 2026] [:error] [pid 19970:tid 19978] [client 20.151.206.105:12955] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aYZBC_0_mZWEnOw3Tv3aSQAAAMI"]
[Sat Feb 07 03:29:15.972671 2026] [:error] [pid 19879:tid 19965] [client 20.151.206.105:13085] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aYZBC8hpdd5jUm69iDdxggAAAJc"]
[Sat Feb 07 03:29:16.383335 2026] [:error] [pid 19877:tid 19897] [client 20.151.206.105:13094] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aYZBDP92PxH5MPiXPJRijAAAAAk"]
[Sat Feb 07 03:29:16.808147 2026] [:error] [pid 19877:tid 19905] [client 20.151.206.105:12969] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aYZBDP92PxH5MPiXPJRijQAAABE"]
[Sat Feb 07 03:29:17.219997 2026] [:error] [pid 19877:tid 19888] [client 20.151.206.105:13227] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aYZBDf92PxH5MPiXPJRikQAAAAA"]
[Sat Feb 07 03:29:17.630803 2026] [:error] [pid 19970:tid 19984] [client 20.151.206.105:13204] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aYZBDf0_mZWEnOw3Tv3aUAAAAMg"]
[Sat Feb 07 03:29:18.054369 2026] [:error] [pid 19970:tid 19980] [client 20.151.206.105:12936] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aYZBDv0_mZWEnOw3Tv3aUgAAAMQ"]
[Sat Feb 07 03:29:18.469313 2026] [:error] [pid 19877:tid 19903] [client 20.151.206.105:13059] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aYZBDv92PxH5MPiXPJRilQAAAA8"]
[Sat Feb 07 03:29:18.896106 2026] [:error] [pid 19877:tid 19897] [client 20.151.206.105:13089] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aYZBDv92PxH5MPiXPJRilgAAAAk"]
[Sat Feb 07 03:29:19.307734 2026] [:error] [pid 19878:tid 19936] [client 20.151.206.105:13092] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aYZBD-8VxXcZObrExUs9kQAAAFU"]
[Sat Feb 07 03:29:19.716630 2026] [:error] [pid 19877:tid 19901] [client 20.151.206.105:13213] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aYZBD_92PxH5MPiXPJRimgAAAA0"]
[Sat Feb 07 03:29:20.156210 2026] [:error] [pid 19877:tid 19894] [client 20.151.206.105:13208] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aYZBEP92PxH5MPiXPJRinQAAAAY"]
[Sat Feb 07 03:29:20.575648 2026] [:error] [pid 19878:tid 19930] [client 20.151.206.105:12552] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aYZBEO8VxXcZObrExUs9kgAAAE8"]
[Sat Feb 07 03:29:20.988496 2026] [:error] [pid 19878:tid 19915] [client 20.151.206.105:12931] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aYZBEO8VxXcZObrExUs9kwAAAEA"]
[Sat Feb 07 03:29:21.399098 2026] [:error] [pid 19970:tid 19982] [client 20.151.206.105:13243] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aYZBEf0_mZWEnOw3Tv3aWwAAAMY"]
[Sat Feb 07 03:29:21.819507 2026] [:error] [pid 19878:tid 19929] [client 20.151.206.105:12951] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aYZBEe8VxXcZObrExUs9lgAAAE4"]
[Sat Feb 07 03:29:22.233266 2026] [:error] [pid 19878:tid 19916] [client 20.151.206.105:13237] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aYZBEu8VxXcZObrExUs9lwAAAEE"]
[Sat Feb 07 03:29:22.645447 2026] [:error] [pid 19877:tid 19911] [client 20.151.206.105:13207] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aYZBEv92PxH5MPiXPJRioQAAABc"]
[Sat Feb 07 03:29:23.056373 2026] [:error] [pid 19970:tid 19981] [client 20.151.206.105:13077] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aYZBE_0_mZWEnOw3Tv3aXQAAAMU"]
[Sat Feb 07 03:29:23.480514 2026] [:error] [pid 19877:tid 19908] [client 20.151.206.105:12957] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aYZBE_92PxH5MPiXPJRiowAAABQ"]
[Sat Feb 07 03:29:23.890695 2026] [:error] [pid 19878:tid 19939] [client 20.151.206.105:12976] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aYZBE-8VxXcZObrExUs9nQAAAFg"]
[Sat Feb 07 03:29:24.303839 2026] [:error] [pid 19878:tid 19928] [client 20.151.206.105:13195] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aYZBFO8VxXcZObrExUs9ngAAAE0"]
[Sat Feb 07 03:29:24.755376 2026] [:error] [pid 19879:tid 19943] [client 20.151.206.105:13221] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aYZBFMhpdd5jUm69iDdxlAAAAIE"]
[Sat Feb 07 03:29:25.169789 2026] [:error] [pid 19878:tid 19936] [client 20.151.206.105:13235] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aYZBFe8VxXcZObrExUs9oQAAAFU"]
[Sat Feb 07 03:29:25.608109 2026] [:error] [pid 19970:tid 19998] [client 20.151.206.105:13075] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aYZBFf0_mZWEnOw3Tv3aZgAAANY"]
[Sat Feb 07 03:29:26.069761 2026] [:error] [pid 19879:tid 19955] [client 20.151.206.105:13098] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aYZBFshpdd5jUm69iDdxmgAAAI0"]
[Sat Feb 07 03:29:26.498909 2026] [:error] [pid 19970:tid 19996] [client 20.151.206.105:13226] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aYZBFv0_mZWEnOw3Tv3aagAAANQ"]
[Sat Feb 07 03:29:27.060915 2026] [:error] [pid 19970:tid 19991] [client 20.151.206.105:12960] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aYZBF_0_mZWEnOw3Tv3acAAAAM8"]
[Sat Feb 07 03:29:27.648006 2026] [:error] [pid 19970:tid 19976] [client 20.151.206.105:12970] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aYZBF_0_mZWEnOw3Tv3aeAAAAMA"]
[Sat Feb 07 03:29:28.092169 2026] [:error] [pid 19970:tid 19982] [client 20.151.206.105:13202] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aYZBGP0_mZWEnOw3Tv3aewAAAMY"]
[Sat Feb 07 03:29:28.561550 2026] [:error] [pid 19970:tid 19990] [client 20.151.206.105:12583] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aYZBGP0_mZWEnOw3Tv3aggAAAM4"]
[Sat Feb 07 03:29:29.092763 2026] [:error] [pid 19970:tid 19996] [client 20.151.206.105:12958] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aYZBGf0_mZWEnOw3Tv3ahQAAANQ"]
[Sat Feb 07 03:29:29.506170 2026] [:error] [pid 19877:tid 19893] [client 20.151.206.105:13205] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aYZBGf92PxH5MPiXPJRirwAAAAU"]
[Sat Feb 07 03:29:29.942772 2026] [:error] [pid 19878:tid 19933] [client 20.151.206.105:12987] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aYZBGe8VxXcZObrExUs9pQAAAFI"]
[Sat Feb 07 03:29:30.363762 2026] [:error] [pid 19970:tid 19994] [client 20.151.206.105:13211] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aYZBGv0_mZWEnOw3Tv3aigAAANI"]
[Sat Feb 07 03:29:30.814761 2026] [:error] [pid 19878:tid 19920] [client 20.151.206.105:13236] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aYZBGu8VxXcZObrExUs9pgAAAEU"]
[Sat Feb 07 03:29:31.230679 2026] [:error] [pid 19878:tid 19926] [client 20.151.206.105:12967] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aYZBG-8VxXcZObrExUs9qAAAAEs"]
[Sat Feb 07 03:29:31.644845 2026] [:error] [pid 19878:tid 19915] [client 20.151.206.105:12938] [client 20.151.206.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aYZBG-8VxXcZObrExUs9qwAAAEA"]
[Sat Feb 07 03:29:32.081061 2026] [:error] [pid 19970:tid 19980] [client 20.151.206.105:13062] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aYZBHP0_mZWEnOw3Tv3akAAAAMQ"]
[Sat Feb 07 03:29:32.491630 2026] [:error] [pid 19970:tid 19987] [client 20.151.206.105:13084] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aYZBHP0_mZWEnOw3Tv3akwAAAMs"]
[Sat Feb 07 03:29:32.915874 2026] [:error] [pid 19970:tid 19991] [client 20.151.206.105:12966] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aYZBHP0_mZWEnOw3Tv3algAAAM8"]
[Sat Feb 07 03:29:33.338717 2026] [:error] [pid 19879:tid 19953] [client 20.151.206.105:12555] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aYZBHchpdd5jUm69iDdxoAAAAIs"]
[Sat Feb 07 03:29:33.751350 2026] [:error] [pid 19877:tid 19907] [client 20.151.206.105:12972] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aYZBHf92PxH5MPiXPJRiswAAABM"]
[Sat Feb 07 03:29:34.162583 2026] [:error] [pid 19879:tid 19944] [client 20.151.206.105:13088] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aYZBHshpdd5jUm69iDdxoQAAAII"]
[Sat Feb 07 03:29:34.574125 2026] [:error] [pid 19879:tid 19966] [client 20.151.206.105:13113] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aYZBHshpdd5jUm69iDdxogAAAJg"]
[Sat Feb 07 03:29:34.984984 2026] [:error] [pid 19879:tid 19954] [client 20.151.206.105:13070] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aYZBHshpdd5jUm69iDdxowAAAIw"]
[Sat Feb 07 03:29:35.395401 2026] [:error] [pid 19970:tid 19985] [client 20.151.206.105:13190] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aYZBH_0_mZWEnOw3Tv3angAAAMk"]
[Sat Feb 07 03:29:35.808143 2026] [:error] [pid 19879:tid 19962] [client 20.151.206.105:13102] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aYZBH8hpdd5jUm69iDdxqAAAAJQ"]
[Sat Feb 07 03:29:36.219122 2026] [:error] [pid 19879:tid 19951] [client 20.151.206.105:13186] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aYZBIMhpdd5jUm69iDdxrAAAAIk"]
[Sat Feb 07 03:29:36.636655 2026] [:error] [pid 19879:tid 19955] [client 20.151.206.105:12571] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aYZBIMhpdd5jUm69iDdxsAAAAI0"]
[Sat Feb 07 03:29:37.055504 2026] [:error] [pid 19879:tid 19956] [client 20.151.206.105:13192] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aYZBIchpdd5jUm69iDdxsgAAAI4"]
[Sat Feb 07 03:29:37.481612 2026] [:error] [pid 19879:tid 19944] [client 20.151.206.105:12953] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aYZBIchpdd5jUm69iDdxtQAAAII"]
[Sat Feb 07 03:29:37.899346 2026] [:error] [pid 19970:tid 19995] [client 20.151.206.105:12977] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aYZBIf0_mZWEnOw3Tv3apgAAANM"]
[Sat Feb 07 03:29:38.311370 2026] [:error] [pid 19970:tid 19999] [client 20.151.206.105:12971] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aYZBIv0_mZWEnOw3Tv3apwAAANc"]
[Sat Feb 07 03:29:38.733642 2026] [:error] [pid 19970:tid 19989] [client 20.151.206.105:13082] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aYZBIv0_mZWEnOw3Tv3aqwAAAM0"]
[Sat Feb 07 03:29:39.151038 2026] [:error] [pid 19970:tid 19996] [client 20.151.206.105:12961] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aYZBI_0_mZWEnOw3Tv3argAAANQ"]
[Sat Feb 07 03:29:39.562156 2026] [:error] [pid 19970:tid 19995] [client 20.151.206.105:12929] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aYZBI_0_mZWEnOw3Tv3asQAAANM"]
[Sat Feb 07 03:29:40.002833 2026] [:error] [pid 19970:tid 19976] [client 20.151.206.105:13091] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aYZBJP0_mZWEnOw3Tv3aswAAAMA"]
[Sat Feb 07 03:29:40.433486 2026] [:error] [pid 19970:tid 19999] [client 20.151.206.105:13212] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aYZBJP0_mZWEnOw3Tv3atAAAANc"]
[Sat Feb 07 03:29:40.850318 2026] [:error] [pid 19970:tid 19992] [client 20.151.206.105:12989] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aYZBJP0_mZWEnOw3Tv3atQAAANA"]
[Sat Feb 07 03:29:41.264401 2026] [:error] [pid 19970:tid 19982] [client 20.151.206.105:12563] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aYZBJf0_mZWEnOw3Tv3atgAAAMY"]
[Sat Feb 07 03:29:41.684791 2026] [:error] [pid 19970:tid 19979] [client 20.151.206.105:13101] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aYZBJf0_mZWEnOw3Tv3atwAAAMM"]
[Sat Feb 07 03:29:42.148411 2026] [:error] [pid 19877:tid 19896] [client 20.151.206.105:13056] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aYZBJv92PxH5MPiXPJRivwAAAAg"]
[Sat Feb 07 03:29:42.603970 2026] [:error] [pid 19879:tid 19943] [client 20.151.206.105:12981] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aYZBJshpdd5jUm69iDdxwQAAAIE"]
[Sat Feb 07 03:29:56.901629 2026] [:error] [pid 19879:tid 19965] [client 20.151.206.105:13208] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aYZBNMhpdd5jUm69iDdx8AAAAJc"]
[Sat Feb 07 03:29:57.311009 2026] [:error] [pid 19970:tid 19999] [client 20.151.206.105:13185] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aYZBNf0_mZWEnOw3Tv3a0gAAANc"]
[Sat Feb 07 03:29:57.724892 2026] [:error] [pid 19970:tid 19986] [client 20.151.206.105:12965] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aYZBNf0_mZWEnOw3Tv3a0wAAAMo"]
[Sat Feb 07 03:29:58.155847 2026] [:error] [pid 19878:tid 19915] [client 20.151.206.105:13220] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "aYZBNu8VxXcZObrExUs90AAAAEA"]
[Sat Feb 07 03:29:58.630597 2026] [:error] [pid 19878:tid 19930] [client 20.151.206.105:13057] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aYZBNu8VxXcZObrExUs90gAAAE8"]
[Sat Feb 07 03:29:59.042637 2026] [:error] [pid 19877:tid 19908] [client 20.151.206.105:13193] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aYZBN_92PxH5MPiXPJRi3AAAABQ"]
[Sat Feb 07 03:29:59.462558 2026] [:error] [pid 19878:tid 19935] [client 20.151.206.105:12956] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aYZBN-8VxXcZObrExUs91QAAAFQ"]
[Sat Feb 07 03:29:59.886347 2026] [:error] [pid 19970:tid 19978] [client 20.151.206.105:13107] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aYZBN_0_mZWEnOw3Tv3a1QAAAMI"]
[Sat Feb 07 03:30:00.336450 2026] [:error] [pid 19878:tid 19933] [client 20.151.206.105:13229] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aYZBOO8VxXcZObrExUs92QAAAFI"]
[Sat Feb 07 03:30:00.775453 2026] [:error] [pid 19878:tid 19916] [client 20.151.206.105:12979] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aYZBOO8VxXcZObrExUs93QAAAEE"]
[Sat Feb 07 03:30:01.199625 2026] [:error] [pid 19970:tid 19994] [client 20.151.206.105:13067] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aYZBOf0_mZWEnOw3Tv3a1wAAANI"]
[Sat Feb 07 03:30:01.665418 2026] [:error] [pid 19878:tid 19931] [client 20.151.206.105:12984] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "aYZBOe8VxXcZObrExUs95QAAAFA"]
[Sat Feb 07 03:30:02.133624 2026] [:error] [pid 19878:tid 19933] [client 20.151.206.105:12550] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/Cache/footer.php"] [unique_id "aYZBOu8VxXcZObrExUs96gAAAFI"]
[Sat Feb 07 03:30:02.549178 2026] [:error] [pid 19879:tid 19961] [client 20.151.206.105:12952] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/Cache/footer.php"] [unique_id "aYZBOshpdd5jUm69iDdyFQAAAJM"]
[Sat Feb 07 03:30:02.991111 2026] [:error] [pid 19970:tid 19999] [client 20.151.206.105:12985] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/Cache/footer.php"] [unique_id "aYZBOv0_mZWEnOw3Tv3a2wAAANc"]
[Sat Feb 07 03:30:03.417141 2026] [:error] [pid 19970:tid 20000] [client 20.151.206.105:13108] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/Cache/footer.php"] [unique_id "aYZBO_0_mZWEnOw3Tv3a3QAAANg"]
[Sat Feb 07 03:30:03.827779 2026] [:error] [pid 19970:tid 19996] [client 20.151.206.105:13071] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aYZBO_0_mZWEnOw3Tv3a4QAAANQ"]
[Sat Feb 07 03:30:04.243456 2026] [:error] [pid 19970:tid 19995] [client 20.151.206.105:13083] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aYZBPP0_mZWEnOw3Tv3a5AAAANM"]
[Sat Feb 07 03:30:04.677000 2026] [:error] [pid 19970:tid 19991] [client 20.151.206.105:12547] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aYZBPP0_mZWEnOw3Tv3a5wAAAM8"]
[Sat Feb 07 03:30:05.093480 2026] [:error] [pid 19970:tid 19984] [client 20.151.206.105:13100] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aYZBPf0_mZWEnOw3Tv3a6wAAAMg"]
[Sat Feb 07 03:30:05.506365 2026] [:error] [pid 19877:tid 19895] [client 20.151.206.105:13090] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aYZBPf92PxH5MPiXPJRjAwAAAAc"]
[Sat Feb 07 03:30:05.919154 2026] [:error] [pid 19879:tid 19966] [client 20.151.206.105:13214] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aYZBPchpdd5jUm69iDdyNwAAAJg"]
[Sat Feb 07 03:30:06.335786 2026] [:error] [pid 19879:tid 19947] [client 20.151.206.105:12579] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aYZBPshpdd5jUm69iDdyOAAAAIU"]
[Sat Feb 07 03:30:06.753039 2026] [:error] [pid 19879:tid 19951] [client 20.151.206.105:12549] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aYZBPshpdd5jUm69iDdyOQAAAIk"]
[Sat Feb 07 03:30:07.168718 2026] [:error] [pid 19879:tid 19952] [client 20.151.206.105:13079] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aYZBP8hpdd5jUm69iDdyOwAAAIo"]
[Sat Feb 07 03:30:07.588968 2026] [:error] [pid 19970:tid 19980] [client 20.151.206.105:12737] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aYZBP_0_mZWEnOw3Tv3a7wAAAMQ"]
[Sat Feb 07 03:30:07.998694 2026] [:error] [pid 19877:tid 19908] [client 20.151.206.105:12973] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aYZBP_92PxH5MPiXPJRjCwAAABQ"]
[Sat Feb 07 03:30:08.414618 2026] [:error] [pid 19878:tid 19931] [client 20.151.206.105:12978] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aYZBQO8VxXcZObrExUs-DQAAAFA"]
[Sat Feb 07 03:30:08.827289 2026] [:error] [pid 19877:tid 19910] [client 20.151.206.105:12962] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aYZBQP92PxH5MPiXPJRjDQAAABY"]
[Sat Feb 07 03:30:09.258245 2026] [:error] [pid 19877:tid 19896] [client 20.151.206.105:12569] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aYZBQf92PxH5MPiXPJRjDwAAAAg"]
[Sat Feb 07 03:30:09.696490 2026] [:error] [pid 19970:tid 19989] [client 20.151.206.105:12576] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aYZBQf0_mZWEnOw3Tv3a9gAAAM0"]
[Sat Feb 07 03:30:10.107983 2026] [:error] [pid 19970:tid 19981] [client 20.151.206.105:13103] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aYZBQv0_mZWEnOw3Tv3a-AAAAMU"]
[Sat Feb 07 03:30:10.532875 2026] [:error] [pid 19970:tid 19996] [client 20.151.206.105:12545] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "aYZBQv0_mZWEnOw3Tv3a-QAAANQ"]
[Sat Feb 07 03:30:10.947820 2026] [:error] [pid 19877:tid 19903] [client 20.151.206.105:13224] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "aYZBQv92PxH5MPiXPJRjEwAAAA8"]
[Sat Feb 07 03:30:11.357915 2026] [:error] [pid 19970:tid 19984] [client 20.151.206.105:12590] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "aYZBQ_0_mZWEnOw3Tv3bBQAAAMg"]
[Sat Feb 07 03:30:11.802204 2026] [:error] [pid 19877:tid 19900] [client 20.151.206.105:12988] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "aYZBQ_92PxH5MPiXPJRjGAAAAAw"]
[Sat Feb 07 03:30:12.214095 2026] [:error] [pid 19877:tid 19899] [client 20.151.206.105:13233] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aYZBRP92PxH5MPiXPJRjHAAAAAs"]
[Sat Feb 07 03:30:12.631963 2026] [:error] [pid 19878:tid 19919] [client 20.151.206.105:13112] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aYZBRO8VxXcZObrExUs-GgAAAEQ"]
[Sat Feb 07 03:30:13.064009 2026] [:error] [pid 19877:tid 19889] [client 20.151.206.105:12602] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aYZBRf92PxH5MPiXPJRjIAAAAAE"]
[Sat Feb 07 03:30:13.491797 2026] [:error] [pid 19970:tid 19979] [client 20.151.206.105:13105] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aYZBRf0_mZWEnOw3Tv3bFgAAAMM"]
[Sat Feb 07 03:30:14.026829 2026] [:error] [pid 19970:tid 19998] [client 20.151.206.105:13215] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aYZBRv0_mZWEnOw3Tv3bGgAAANY"]
[Sat Feb 07 03:30:14.438444 2026] [:error] [pid 19879:tid 19964] [client 20.151.206.105:13073] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aYZBRshpdd5jUm69iDdyVwAAAJY"]
[Sat Feb 07 03:30:14.881690 2026] [:error] [pid 19877:tid 19898] [client 20.151.206.105:13118] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aYZBRv92PxH5MPiXPJRjKwAAAAo"]
[Sat Feb 07 03:30:15.349518 2026] [:error] [pid 19877:tid 19906] [client 20.151.206.105:13099] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aYZBR_92PxH5MPiXPJRjLAAAABI"]
[Sat Feb 07 03:30:16.012140 2026] [:error] [pid 19970:tid 19991] [client 20.151.206.105:12561] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aYZBSP0_mZWEnOw3Tv3bJwAAAM8"]
[Sat Feb 07 03:30:16.561099 2026] [:error] [pid 19878:tid 19932] [client 20.151.206.105:12941] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aYZBSO8VxXcZObrExUs-IwAAAFE"]
[Sat Feb 07 03:30:17.144945 2026] [:error] [pid 19879:tid 19955] [client 20.151.206.105:13072] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aYZBSchpdd5jUm69iDdyXwAAAI0"]
[Sat Feb 07 03:30:17.743213 2026] [:error] [pid 19970:tid 19980] [client 20.151.206.105:13087] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aYZBSf0_mZWEnOw3Tv3bLwAAAMQ"]
[Sat Feb 07 03:30:18.402062 2026] [:error] [pid 19878:tid 19918] [client 20.151.206.105:12593] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aYZBSu8VxXcZObrExUs-KAAAAEM"]
[Sat Feb 07 03:30:18.934490 2026] [:error] [pid 19970:tid 19977] [client 20.151.206.105:12990] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aYZBSv0_mZWEnOw3Tv3bMQAAAME"]
[Sat Feb 07 03:30:19.468828 2026] [:error] [pid 19877:tid 19889] [client 20.151.206.105:12565] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aYZBS_92PxH5MPiXPJRjNwAAAAE"]
[Sat Feb 07 03:30:19.893028 2026] [:error] [pid 19877:tid 19897] [client 20.151.206.105:13081] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aYZBS_92PxH5MPiXPJRjOAAAAAk"]
[Sat Feb 07 03:30:20.382983 2026] [:error] [pid 19879:tid 19959] [client 20.151.206.105:12572] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/index.php"] [unique_id "aYZBTMhpdd5jUm69iDdyZAAAAJE"]
[Sat Feb 07 03:30:20.847744 2026] [:error] [pid 19970:tid 19988] [client 20.151.206.105:13064] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/index.php"] [unique_id "aYZBTP0_mZWEnOw3Tv3bOgAAAMw"]
[Sat Feb 07 03:30:21.311900 2026] [:error] [pid 19879:tid 19951] [client 20.151.206.105:12605] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/index.php"] [unique_id "aYZBTchpdd5jUm69iDdyawAAAIk"]
[Sat Feb 07 03:30:21.726874 2026] [:error] [pid 19878:tid 19935] [client 20.151.206.105:12743] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/index.php"] [unique_id "aYZBTe8VxXcZObrExUs-MgAAAFQ"]
[Sat Feb 07 03:30:22.163313 2026] [:error] [pid 19970:tid 19994] [client 20.151.206.105:12581] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aYZBTv0_mZWEnOw3Tv3bQwAAANI"]
[Sat Feb 07 03:30:22.593673 2026] [:error] [pid 19970:tid 19999] [client 20.151.206.105:12574] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aYZBTv0_mZWEnOw3Tv3bRgAAANc"]
[Sat Feb 07 03:30:23.037087 2026] [:error] [pid 19879:tid 19966] [client 20.151.206.105:12544] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aYZBT8hpdd5jUm69iDdyeAAAAJg"]
[Sat Feb 07 03:30:23.614629 2026] [:error] [pid 19879:tid 19946] [client 20.151.206.105:13106] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aYZBT8hpdd5jUm69iDdyfQAAAIQ"]
[Sat Feb 07 03:30:24.104233 2026] [:error] [pid 19878:tid 19925] [client 20.151.206.105:13069] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aYZBUO8VxXcZObrExUs-PQAAAEo"]
[Sat Feb 07 03:30:24.694722 2026] [:error] [pid 19879:tid 19957] [client 20.151.206.105:13114] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aYZBUMhpdd5jUm69iDdygwAAAI8"]
[Sat Feb 07 03:30:25.111350 2026] [:error] [pid 19970:tid 19993] [client 20.151.206.105:12566] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aYZBUf0_mZWEnOw3Tv3bVwAAANE"]
[Sat Feb 07 03:30:25.552789 2026] [:error] [pid 19878:tid 19936] [client 20.151.206.105:13119] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aYZBUe8VxXcZObrExUs-QwAAAFU"]
[Sat Feb 07 03:30:25.981066 2026] [:error] [pid 19970:tid 19982] [client 20.151.206.105:12584] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aYZBUf0_mZWEnOw3Tv3bWgAAAMY"]
[Sat Feb 07 03:30:26.393762 2026] [:error] [pid 19878:tid 19915] [client 20.151.206.105:12766] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aYZBUu8VxXcZObrExUs-RAAAAEA"]
[Sat Feb 07 03:30:27.010330 2026] [:error] [pid 19970:tid 19997] [client 20.151.206.105:12946] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aYZBU_0_mZWEnOw3Tv3bXgAAANU"]
[Sat Feb 07 03:30:27.720381 2026] [:error] [pid 19970:tid 19992] [client 20.151.206.105:12745] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aYZBU_0_mZWEnOw3Tv3bXwAAANA"]
[Sat Feb 07 03:30:28.350822 2026] [:error] [pid 19970:tid 19998] [client 20.151.206.105:13200] [client 20.151.206.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aYZBVP0_mZWEnOw3Tv3bYgAAANY"]
[Sat Feb 07 03:30:28.869106 2026] [:error] [pid 19879:tid 19959] [client 20.151.206.105:13230] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aYZBVMhpdd5jUm69iDdyigAAAJE"]
[Sat Feb 07 03:30:29.492568 2026] [:error] [pid 19879:tid 19947] [client 20.151.206.105:13222] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aYZBVchpdd5jUm69iDdyjAAAAIU"]
[Sat Feb 07 03:30:30.332106 2026] [:error] [pid 19877:tid 19911] [client 20.151.206.105:13116] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aYZBVv92PxH5MPiXPJRjRwAAABc"]
[Sat Feb 07 03:30:30.851262 2026] [:error] [pid 19879:tid 19962] [client 20.151.206.105:12553] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aYZBVshpdd5jUm69iDdykQAAAJQ"]
[Sat Feb 07 03:30:31.355179 2026] [:error] [pid 19879:tid 19949] [client 20.151.206.105:12964] [client 20.151.206.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aYZBV8hpdd5jUm69iDdykgAAAIc"]
[Sat Feb 07 03:30:31.896912 2026] [:error] [pid 19877:tid 19889] [client 20.151.206.105:12548] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aYZBV_92PxH5MPiXPJRjSgAAAAE"]
[Sat Feb 07 03:30:32.407036 2026] [:error] [pid 19878:tid 19927] [client 20.151.206.105:12591] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aYZBWO8VxXcZObrExUs-TwAAAEw"]
[Sat Feb 07 03:30:33.004481 2026] [:error] [pid 19879:tid 19956] [client 20.151.206.105:12784] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aYZBWchpdd5jUm69iDdymgAAAI4"]
[Sat Feb 07 03:30:33.856804 2026] [:error] [pid 19878:tid 19933] [client 20.151.206.105:12559] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filemanager/dialog.php"] [unique_id "aYZBWe8VxXcZObrExUs-UAAAAFI"]
[Sat Feb 07 03:30:34.433940 2026] [:error] [pid 19878:tid 19929] [client 20.151.206.105:13247] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filemanager/dialog.php"] [unique_id "aYZBWu8VxXcZObrExUs-UgAAAE4"]
[Sat Feb 07 03:30:34.885114 2026] [:error] [pid 19970:tid 19985] [client 20.151.206.105:12986] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filemanager/dialog.php"] [unique_id "aYZBWv0_mZWEnOw3Tv3bbwAAAMk"]
[Sat Feb 07 03:30:35.356955 2026] [:error] [pid 19879:tid 19965] [client 20.151.206.105:13065] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filemanager/dialog.php"] [unique_id "aYZBW8hpdd5jUm69iDdyoAAAAJc"]
[Sat Feb 07 03:30:35.884168 2026] [:error] [pid 19877:tid 19900] [client 20.151.206.105:12596] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aYZBW_92PxH5MPiXPJRjTwAAAAw"]
[Sat Feb 07 03:30:36.359444 2026] [:error] [pid 19878:tid 19931] [client 20.151.206.105:12586] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aYZBXO8VxXcZObrExUs-VgAAAFA"]
[Sat Feb 07 03:30:36.791723 2026] [:error] [pid 19878:tid 19916] [client 20.151.206.105:12768] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aYZBXO8VxXcZObrExUs-VwAAAEE"]
[Sat Feb 07 03:30:37.428907 2026] [:error] [pid 19970:tid 19993] [client 20.151.206.105:12560] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aYZBXf0_mZWEnOw3Tv3bdQAAANE"]
[Sat Feb 07 03:30:37.865577 2026] [:error] [pid 19879:tid 19966] [client 20.151.206.105:12792] [client 20.151.206.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aYZBXchpdd5jUm69iDdyogAAAJg"]
[Sat Feb 07 03:30:38.299336 2026] [:error] [pid 19879:tid 19964] [client 20.151.206.105:12755] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "aYZBXshpdd5jUm69iDdyowAAAJY"]
[Sat Feb 07 03:30:38.728621 2026] [:error] [pid 19878:tid 19933] [client 20.151.206.105:12573] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "aYZBXu8VxXcZObrExUs-XgAAAFI"]
[Sat Feb 07 03:30:39.211154 2026] [:error] [pid 19878:tid 19931] [client 20.151.206.105:12675] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "aYZBX-8VxXcZObrExUs-YAAAAFA"]
[Sat Feb 07 03:30:39.655667 2026] [:error] [pid 19970:tid 19988] [client 20.151.206.105:13063] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "aYZBX_0_mZWEnOw3Tv3begAAAMw"]
[Sat Feb 07 03:30:40.101901 2026] [:error] [pid 19877:tid 19906] [client 20.151.206.105:12546] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/autoload_classmap.php"] [unique_id "aYZBYP92PxH5MPiXPJRjWQAAABI"]
[Sat Feb 07 03:30:40.534630 2026] [:error] [pid 19878:tid 19936] [client 20.151.206.105:12759] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/autoload_classmap.php"] [unique_id "aYZBYO8VxXcZObrExUs-ZgAAAFU"]
[Sat Feb 07 03:30:40.964845 2026] [:error] [pid 19877:tid 19902] [client 20.151.206.105:13093] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/autoload_classmap.php"] [unique_id "aYZBYP92PxH5MPiXPJRjXAAAAA4"]
[Sat Feb 07 03:30:41.406093 2026] [:error] [pid 19970:tid 19976] [client 20.151.206.105:12595] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uploads/autoload_classmap.php"] [unique_id "aYZBYf0_mZWEnOw3Tv3bfgAAAMA"]
[Sat Feb 07 03:30:41.832885 2026] [:error] [pid 19878:tid 19918] [client 20.151.206.105:12975] [client 20.151.206.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aYZBYe8VxXcZObrExUs-agAAAEM"]
[Sat Feb 07 03:30:42.254473 2026] [:error] [pid 19970:tid 19995] [client 20.151.206.105:12788] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww1.php"] [unique_id "aYZBYv0_mZWEnOw3Tv3bgQAAANM"]
[Sat Feb 07 03:30:42.674040 2026] [:error] [pid 19970:tid 19992] [client 20.151.206.105:12597] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww1.php"] [unique_id "aYZBYv0_mZWEnOw3Tv3bggAAANA"]
[Sat Feb 07 03:30:43.096234 2026] [:error] [pid 19879:tid 19949] [client 20.151.206.105:12770] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww1.php"] [unique_id "aYZBY8hpdd5jUm69iDdyrAAAAIc"]
[Sat Feb 07 03:30:43.549982 2026] [:error] [pid 19877:tid 19888] [client 20.151.206.105:12592] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aYZBY_92PxH5MPiXPJRjZAAAAAA"]
[Sat Feb 07 03:30:44.021596 2026] [:error] [pid 19970:tid 19996] [client 20.151.206.105:12740] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aYZBZP0_mZWEnOw3Tv3bhgAAANQ"]
[Sat Feb 07 03:30:44.452507 2026] [:error] [pid 19879:tid 19964] [client 20.151.206.105:12761] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aYZBZMhpdd5jUm69iDdyrwAAAJY"]
[Sat Feb 07 03:30:44.866889 2026] [:error] [pid 19970:tid 19986] [client 20.151.206.105:12780] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about/function.php"] [unique_id "aYZBZP0_mZWEnOw3Tv3biAAAAMo"]
[Sat Feb 07 03:30:45.298527 2026] [:error] [pid 19970:tid 19976] [client 20.151.206.105:12772] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aYZBZf0_mZWEnOw3Tv3biQAAAMA"]
[Sat Feb 07 03:30:45.729332 2026] [:error] [pid 19970:tid 19977] [client 20.151.206.105:12551] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aYZBZf0_mZWEnOw3Tv3bigAAAME"]
[Sat Feb 07 03:30:46.144281 2026] [:error] [pid 19877:tid 19910] [client 20.151.206.105:12982] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aYZBZv92PxH5MPiXPJRjawAAABY"]
[Sat Feb 07 03:30:46.623827 2026] [:error] [pid 19970:tid 19995] [client 20.151.206.105:12773] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "aYZBZv0_mZWEnOw3Tv3bjAAAANM"]
[Sat Feb 07 03:30:47.044447 2026] [:error] [pid 19970:tid 19987] [client 20.151.206.105:12786] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aYZBZ_0_mZWEnOw3Tv3bjQAAAMs"]
[Sat Feb 07 03:30:47.498965 2026] [:error] [pid 19970:tid 19989] [client 20.151.206.105:12568] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "aYZBZ_0_mZWEnOw3Tv3bjwAAAM0"]
[Sat Feb 07 03:31:03.756759 2026] [autoindex:error] [pid 50671:tid 50698] [client 20.151.206.105:13115] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 03:31:05.285476 2026] [:error] [pid 50671:tid 50695] [client 20.151.206.105:13115] [client 20.151.206.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aYZBebvqLohWBI_mqBO2MgAAAA8"]
[Sat Feb 07 03:31:07.752601 2026] [autoindex:error] [pid 50673:tid 50743] [client 20.151.206.105:12564] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 03:31:13.379810 2026] [:error] [pid 50673:tid 50735] [client 20.151.206.105:12564] [client 20.151.206.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aYZBgWVwLsaZ7aKO2cnOPgAAAIA"]
[Sat Feb 07 03:31:13.795737 2026] [:error] [pid 50780:tid 50805] [client 20.151.206.105:12589] [client 20.151.206.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aYZBgetUmIu2JHM2CrttZAAAANc"]
[Sat Feb 07 03:31:17.062328 2026] [:error] [pid 50780:tid 50794] [client 20.151.206.105:13097] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aYZBhetUmIu2JHM2CrttawAAAMw"]
[Sat Feb 07 03:31:17.485288 2026] [:error] [pid 50673:tid 50757] [client 20.151.206.105:12756] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aYZBhWVwLsaZ7aKO2cnORQAAAJY"]
[Sat Feb 07 03:31:17.905290 2026] [:error] [pid 50672:tid 50708] [client 20.151.206.105:12578] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aYZBhQ9o0jq1XS8Nv7NTfQAAAEA"]
[Sat Feb 07 03:31:18.324897 2026] [:error] [pid 50673:tid 50759] [client 20.151.206.105:12599] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aYZBhmVwLsaZ7aKO2cnOSAAAAJg"]
[Sat Feb 07 03:31:18.748222 2026] [:error] [pid 50780:tid 50804] [client 20.151.206.105:12577] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aYZBhutUmIu2JHM2CrttcQAAANY"]
[Sat Feb 07 03:31:19.188170 2026] [:error] [pid 50673:tid 50740] [client 20.151.206.105:13117] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aYZBh2VwLsaZ7aKO2cnOSwAAAIU"]
[Sat Feb 07 03:31:19.635628 2026] [:error] [pid 50672:tid 50715] [client 20.151.206.105:12607] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aYZBhw9o0jq1XS8Nv7NTfwAAAEc"]
[Sat Feb 07 03:31:20.092960 2026] [:error] [pid 50672:tid 50714] [client 20.151.206.105:12765] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aYZBiA9o0jq1XS8Nv7NTgAAAAEY"]
[Sat Feb 07 03:31:20.568471 2026] [:error] [pid 50780:tid 50782] [client 20.151.206.105:12694] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aYZBiOtUmIu2JHM2CrttcgAAAMA"]
[Sat Feb 07 03:31:20.980383 2026] [:error] [pid 50780:tid 50791] [client 20.151.206.105:13110] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aYZBiOtUmIu2JHM2CrttdAAAAMk"]
[Sat Feb 07 03:31:21.466174 2026] [:error] [pid 50780:tid 50792] [client 20.151.206.105:12709] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aYZBietUmIu2JHM2CrttdQAAAMo"]
[Sat Feb 07 03:31:21.880348 2026] [:error] [pid 50780:tid 50796] [client 20.151.206.105:12751] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aYZBietUmIu2JHM2CrttdgAAAM4"]
[Sat Feb 07 03:31:22.312075 2026] [:error] [pid 50780:tid 50798] [client 20.151.206.105:12682] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/04.php"] [unique_id "aYZBiutUmIu2JHM2CrttdwAAANA"]
[Sat Feb 07 03:31:22.753786 2026] [:error] [pid 50780:tid 50803] [client 20.151.206.105:12764] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/04.php"] [unique_id "aYZBiutUmIu2JHM2CrtteQAAANU"]
[Sat Feb 07 03:31:23.213232 2026] [:error] [pid 50780:tid 50806] [client 20.151.206.105:13078] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/04.php"] [unique_id "aYZBi-tUmIu2JHM2CrttewAAANg"]
[Sat Feb 07 03:31:23.685628 2026] [:error] [pid 50780:tid 50786] [client 20.151.206.105:12767] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/04.php"] [unique_id "aYZBi-tUmIu2JHM2CrttfwAAAMQ"]
[Sat Feb 07 03:31:24.122667 2026] [:error] [pid 50780:tid 50785] [client 20.151.206.105:12585] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "aYZBjOtUmIu2JHM2CrttgAAAAMM"]
[Sat Feb 07 03:31:24.582519 2026] [:error] [pid 50780:tid 50792] [client 20.151.206.105:12748] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "aYZBjOtUmIu2JHM2CrttggAAAMo"]
[Sat Feb 07 03:31:25.030624 2026] [:error] [pid 50780:tid 50796] [client 20.151.206.105:12736] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "aYZBjetUmIu2JHM2CrtthAAAAM4"]
[Sat Feb 07 03:31:25.501088 2026] [:error] [pid 50780:tid 50797] [client 20.151.206.105:12760] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "aYZBjetUmIu2JHM2CrtthgAAAM8"]
[Sat Feb 07 03:31:26.078888 2026] [:error] [pid 50780:tid 50794] [client 20.151.206.105:12582] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/520.php"] [unique_id "aYZBjutUmIu2JHM2CrttiQAAAMw"]
[Sat Feb 07 03:31:26.501776 2026] [:error] [pid 50672:tid 50727] [client 20.151.206.105:12742] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/520.php"] [unique_id "aYZBjg9o0jq1XS8Nv7NThwAAAFM"]
[Sat Feb 07 03:31:26.994442 2026] [:error] [pid 50780:tid 50805] [client 20.151.206.105:12747] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/520.php"] [unique_id "aYZBjutUmIu2JHM2CrttkQAAANc"]
[Sat Feb 07 03:31:27.417338 2026] [:error] [pid 50780:tid 50783] [client 20.151.206.105:12433] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/520.php"] [unique_id "aYZBj-tUmIu2JHM2CrttkwAAAME"]
[Sat Feb 07 03:31:27.875122 2026] [:error] [pid 50673:tid 50753] [client 20.151.206.105:12575] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aYZBj2VwLsaZ7aKO2cnOUAAAAJI"]
[Sat Feb 07 03:31:28.376780 2026] [:error] [pid 50780:tid 50795] [client 20.151.206.105:12450] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aYZBkOtUmIu2JHM2CrttmAAAAM0"]
[Sat Feb 07 03:31:28.852269 2026] [:error] [pid 50780:tid 50793] [client 20.151.206.105:12420] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aYZBkOtUmIu2JHM2CrttmgAAAMs"]
[Sat Feb 07 03:31:29.346443 2026] [:error] [pid 50673:tid 50752] [client 20.151.206.105:12799] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aYZBkWVwLsaZ7aKO2cnOUQAAAJE"]
[Sat Feb 07 03:31:29.825773 2026] [:error] [pid 50673:tid 50756] [client 20.151.206.105:13111] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aYZBkWVwLsaZ7aKO2cnOUwAAAJU"]
[Sat Feb 07 03:31:30.262404 2026] [:error] [pid 50780:tid 50790] [client 20.151.206.105:12782] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aYZBkutUmIu2JHM2CrttogAAAMg"]
[Sat Feb 07 03:31:30.680693 2026] [:error] [pid 50780:tid 50797] [client 20.151.206.105:12954] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aYZBkutUmIu2JHM2CrttowAAAM8"]
[Sat Feb 07 03:31:31.120105 2026] [:error] [pid 50780:tid 50798] [client 20.151.206.105:12564] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aYZBk-tUmIu2JHM2CrttpQAAANA"]
[Sat Feb 07 03:31:31.566474 2026] [:error] [pid 50780:tid 50796] [client 20.151.206.105:12562] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aYZBk-tUmIu2JHM2CrttpgAAAM4"]
[Sat Feb 07 03:31:31.994953 2026] [:error] [pid 50780:tid 50790] [client 20.151.206.105:13104] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aYZBk-tUmIu2JHM2CrttqQAAAMg"]
[Sat Feb 07 03:31:32.415905 2026] [:error] [pid 50780:tid 50797] [client 20.151.206.105:12968] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aYZBlOtUmIu2JHM2CrttrAAAAM8"]
[Sat Feb 07 03:31:32.850621 2026] [:error] [pid 50780:tid 50782] [client 20.151.206.105:12691] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aYZBlOtUmIu2JHM2CrttrwAAAMA"]
[Sat Feb 07 03:31:33.282965 2026] [:error] [pid 50780:tid 50805] [client 20.151.206.105:12774] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aYZBletUmIu2JHM2CrttsgAAANc"]
[Sat Feb 07 03:31:33.699879 2026] [:error] [pid 50780:tid 50801] [client 20.151.206.105:12603] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aYZBletUmIu2JHM2CrtttQAAANM"]
[Sat Feb 07 03:31:34.120963 2026] [:error] [pid 50671:tid 50698] [client 20.151.206.105:12598] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aYZBlrvqLohWBI_mqBO2UAAAABI"]
[Sat Feb 07 03:31:34.550179 2026] [:error] [pid 50780:tid 50792] [client 20.151.206.105:12703] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass4.php"] [unique_id "aYZBlutUmIu2JHM2CrttuAAAAMo"]
[Sat Feb 07 03:31:34.974604 2026] [:error] [pid 50780:tid 50794] [client 20.151.206.105:13221] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2clas.php"] [unique_id "aYZBlutUmIu2JHM2CrttuwAAAMw"]
[Sat Feb 07 03:31:35.416651 2026] [:error] [pid 50780:tid 50790] [client 20.151.206.105:12435] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2clas.php"] [unique_id "aYZBl-tUmIu2JHM2CrttvwAAAMg"]
[Sat Feb 07 03:31:35.838775 2026] [:error] [pid 50672:tid 50718] [client 20.151.206.105:13096] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2clas.php"] [unique_id "aYZBlw9o0jq1XS8Nv7NTkgAAAEo"]
[Sat Feb 07 03:31:36.259353 2026] [:error] [pid 50780:tid 50784] [client 20.151.206.105:12763] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2clas.php"] [unique_id "aYZBmOtUmIu2JHM2CrttwgAAAMI"]
[Sat Feb 07 03:31:36.686249 2026] [:error] [pid 50672:tid 50726] [client 20.151.206.105:13241] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ave.php"] [unique_id "aYZBmA9o0jq1XS8Nv7NTlQAAAFI"]
[Sat Feb 07 03:31:37.104349 2026] [:error] [pid 50780:tid 50802] [client 20.151.206.105:12570] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ave.php"] [unique_id "aYZBmetUmIu2JHM2CrttxwAAANQ"]
[Sat Feb 07 03:31:37.528423 2026] [:error] [pid 50673:tid 50741] [client 20.151.206.105:12697] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ave.php"] [unique_id "aYZBmWVwLsaZ7aKO2cnOWQAAAIY"]
[Sat Feb 07 03:31:37.956729 2026] [:error] [pid 50780:tid 50791] [client 20.151.206.105:12587] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ave.php"] [unique_id "aYZBmetUmIu2JHM2CrttywAAAMk"]
[Sat Feb 07 03:31:38.407011 2026] [:error] [pid 50671:tid 50694] [client 20.151.206.105:13194] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wrt.php"] [unique_id "aYZBmrvqLohWBI_mqBO2UwAAAA4"]
[Sat Feb 07 03:31:38.834141 2026] [:error] [pid 50673:tid 50746] [client 20.151.206.105:12749] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wrt.php"] [unique_id "aYZBmmVwLsaZ7aKO2cnOWgAAAIs"]
[Sat Feb 07 03:31:39.266776 2026] [:error] [pid 50672:tid 50718] [client 20.151.206.105:12681] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wrt.php"] [unique_id "aYZBmw9o0jq1XS8Nv7NTngAAAEo"]
[Sat Feb 07 03:31:39.760951 2026] [:error] [pid 50673:tid 50752] [client 20.151.206.105:12556] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wrt.php"] [unique_id "aYZBm2VwLsaZ7aKO2cnOXQAAAJE"]
[Sat Feb 07 03:31:40.234995 2026] [:error] [pid 50673:tid 50749] [client 20.151.206.105:12680] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bibil.php"] [unique_id "aYZBnGVwLsaZ7aKO2cnOXwAAAI4"]
[Sat Feb 07 03:31:40.734023 2026] [:error] [pid 50673:tid 50759] [client 20.151.206.105:13109] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bibil.php"] [unique_id "aYZBnGVwLsaZ7aKO2cnOZAAAAJg"]
[Sat Feb 07 03:31:41.160283 2026] [:error] [pid 50671:tid 50689] [client 20.151.206.105:12758] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bibil.php"] [unique_id "aYZBnbvqLohWBI_mqBO2VwAAAAk"]
[Sat Feb 07 03:31:41.596499 2026] [:error] [pid 50671:tid 50683] [client 20.151.206.105:12588] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bibil.php"] [unique_id "aYZBnbvqLohWBI_mqBO2WAAAAAM"]
[Sat Feb 07 03:31:42.017816 2026] [:error] [pid 50672:tid 50731] [client 20.151.206.105:12580] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aYZBng9o0jq1XS8Nv7NTogAAAFc"]
[Sat Feb 07 03:31:42.439071 2026] [:error] [pid 50780:tid 50783] [client 20.151.206.105:12468] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aYZBnutUmIu2JHM2Crtt0QAAAME"]
[Sat Feb 07 03:31:42.870049 2026] [:error] [pid 50672:tid 50709] [client 20.151.206.105:12771] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aYZBng9o0jq1XS8Nv7NTpAAAAEE"]
[Sat Feb 07 03:31:43.282602 2026] [:error] [pid 50671:tid 50695] [client 20.151.206.105:13095] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aYZBn7vqLohWBI_mqBO2XAAAAA8"]
[Sat Feb 07 03:31:43.721606 2026] [:error] [pid 50671:tid 50687] [client 20.151.206.105:12557] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aYZBn7vqLohWBI_mqBO2XgAAAAc"]
[Sat Feb 07 03:31:44.137793 2026] [:error] [pid 50673:tid 50756] [client 20.151.206.105:13068] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aYZBoGVwLsaZ7aKO2cnObQAAAJU"]
[Sat Feb 07 03:31:44.557730 2026] [:error] [pid 50671:tid 50685] [client 20.151.206.105:12754] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aYZBoLvqLohWBI_mqBO2XwAAAAU"]
[Sat Feb 07 03:31:44.991798 2026] [:error] [pid 50780:tid 50782] [client 20.151.206.105:12690] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aYZBoOtUmIu2JHM2Crtt1QAAAMA"]
[Sat Feb 07 03:31:45.450123 2026] [:error] [pid 50780:tid 50788] [client 20.151.206.105:12695] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aYZBoetUmIu2JHM2Crtt1wAAAMY"]
[Sat Feb 07 03:31:45.863440 2026] [:error] [pid 50672:tid 50712] [client 20.151.206.105:12778] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aYZBoQ9o0jq1XS8Nv7NTqwAAAEQ"]
[Sat Feb 07 03:31:46.281276 2026] [:error] [pid 50672:tid 50721] [client 20.151.206.105:12450] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aYZBog9o0jq1XS8Nv7NTrgAAAE0"]
[Sat Feb 07 03:31:46.731608 2026] [:error] [pid 50672:tid 50720] [client 20.151.206.105:12796] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aYZBog9o0jq1XS8Nv7NTsAAAAEw"]
[Sat Feb 07 03:31:47.207166 2026] [:error] [pid 50672:tid 50726] [client 20.151.206.105:12684] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aYZBow9o0jq1XS8Nv7NTswAAAFI"]
[Sat Feb 07 03:31:47.621773 2026] [:error] [pid 50672:tid 50724] [client 20.151.206.105:12750] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aYZBow9o0jq1XS8Nv7NTtgAAAFA"]
[Sat Feb 07 03:31:48.034274 2026] [:error] [pid 50672:tid 50714] [client 20.151.206.105:12776] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aYZBpA9o0jq1XS8Nv7NTuwAAAEY"]
[Sat Feb 07 03:31:48.463738 2026] [:error] [pid 50672:tid 50711] [client 20.151.206.105:12558] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aYZBpA9o0jq1XS8Nv7NTvQAAAEM"]
[Sat Feb 07 03:31:48.914335 2026] [:error] [pid 50780:tid 50798] [client 20.151.206.105:12744] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aYZBpOtUmIu2JHM2Crtt3AAAANA"]
[Sat Feb 07 03:31:49.378753 2026] [:error] [pid 50672:tid 50708] [client 20.151.206.105:12428] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aYZBpQ9o0jq1XS8Nv7NTwQAAAEA"]
[Sat Feb 07 03:31:49.794173 2026] [:error] [pid 50673:tid 50741] [client 20.151.206.105:12685] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aYZBpWVwLsaZ7aKO2cnOdAAAAIY"]
[Sat Feb 07 03:31:50.279805 2026] [:error] [pid 50672:tid 50718] [client 20.151.206.105:13232] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aYZBpg9o0jq1XS8Nv7NTwgAAAEo"]
[Sat Feb 07 03:31:50.703747 2026] [:error] [pid 50780:tid 50797] [client 20.151.206.105:12706] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aYZBputUmIu2JHM2Crtt4wAAAM8"]
[Sat Feb 07 03:31:51.129436 2026] [:error] [pid 50673:tid 50738] [client 20.151.206.105:12794] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aYZBp2VwLsaZ7aKO2cnOdgAAAIM"]
[Sat Feb 07 03:31:51.546438 2026] [:error] [pid 50672:tid 50732] [client 20.151.206.105:12594] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aYZBpw9o0jq1XS8Nv7NTxQAAAFg"]
[Sat Feb 07 03:31:51.960316 2026] [:error] [pid 50671:tid 50704] [client 20.151.206.105:12715] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aYZBp7vqLohWBI_mqBO2ZgAAABg"]
[Sat Feb 07 03:31:52.374068 2026] [:error] [pid 50672:tid 50711] [client 20.151.206.105:12790] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aYZBqA9o0jq1XS8Nv7NTyQAAAEM"]
[Sat Feb 07 03:31:52.805270 2026] [:error] [pid 50671:tid 50687] [client 20.151.206.105:12673] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aYZBqLvqLohWBI_mqBO2aAAAAAc"]
[Sat Feb 07 03:31:53.221413 2026] [:error] [pid 50673:tid 50736] [client 20.151.206.105:12707] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aYZBqWVwLsaZ7aKO2cnOegAAAIE"]
[Sat Feb 07 03:31:53.633537 2026] [:error] [pid 50671:tid 50696] [client 20.151.206.105:12689] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aYZBqbvqLohWBI_mqBO2awAAABA"]
[Sat Feb 07 03:31:54.044304 2026] [:error] [pid 50671:tid 50690] [client 20.151.206.105:12762] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aYZBqrvqLohWBI_mqBO2bQAAAAo"]
[Sat Feb 07 03:31:54.480170 2026] [:error] [pid 50671:tid 50692] [client 20.151.206.105:12793] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aYZBqrvqLohWBI_mqBO2bgAAAAw"]
[Sat Feb 07 03:31:54.660762 2026] [:error] [pid 50671:tid 50695] [client 34.73.126.11:51636] [client 34.73.126.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.73.126.11, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZBqrvqLohWBI_mqBO2bwAAAA8"]
[Sat Feb 07 03:31:54.904021 2026] [:error] [pid 50780:tid 50803] [client 20.151.206.105:12787] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aYZBqutUmIu2JHM2Crtt7AAAANU"]
[Sat Feb 07 03:31:55.317494 2026] [:error] [pid 50671:tid 50699] [client 20.151.206.105:12753] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aYZBq7vqLohWBI_mqBO2cQAAABM"]
[Sat Feb 07 03:31:55.735465 2026] [:error] [pid 50673:tid 50753] [client 20.151.206.105:13125] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aYZBq2VwLsaZ7aKO2cnOgAAAAJI"]
[Sat Feb 07 03:31:56.147734 2026] [:error] [pid 50671:tid 50682] [client 20.151.206.105:12781] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aYZBrLvqLohWBI_mqBO2cwAAAAI"]
[Sat Feb 07 03:31:56.564264 2026] [:error] [pid 50673:tid 50748] [client 20.151.206.105:12741] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aYZBrGVwLsaZ7aKO2cnOgQAAAI0"]
[Sat Feb 07 03:31:56.980421 2026] [:error] [pid 50672:tid 50724] [client 20.151.206.105:12554] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aYZBrA9o0jq1XS8Nv7NTygAAAFA"]
[Sat Feb 07 03:31:57.395833 2026] [:error] [pid 50673:tid 50741] [client 20.151.206.105:13125] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aYZBrWVwLsaZ7aKO2cnOggAAAIY"]
[Sat Feb 07 03:31:57.808123 2026] [:error] [pid 50672:tid 50717] [client 20.151.206.105:12696] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aYZBrQ9o0jq1XS8Nv7NTywAAAEk"]
[Sat Feb 07 03:31:58.220490 2026] [:error] [pid 50673:tid 50746] [client 20.151.206.105:12434] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aYZBrmVwLsaZ7aKO2cnOhAAAAIs"]
[Sat Feb 07 03:31:58.633599 2026] [:error] [pid 50780:tid 50787] [client 20.151.206.105:12734] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aYZBrutUmIu2JHM2Crtt9QAAAMU"]
[Sat Feb 07 03:31:59.044709 2026] [:error] [pid 50780:tid 50782] [client 20.151.206.105:12704] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aYZBr-tUmIu2JHM2Crtt-AAAAMA"]
[Sat Feb 07 03:31:59.456380 2026] [:error] [pid 50780:tid 50803] [client 20.151.206.105:12797] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aYZBr-tUmIu2JHM2Crtt-wAAANU"]
[Sat Feb 07 03:31:59.914605 2026] [:error] [pid 50780:tid 50791] [client 20.151.206.105:12779] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aYZBr-tUmIu2JHM2Crtt_QAAAMk"]
[Sat Feb 07 03:32:00.326687 2026] [:error] [pid 50673:tid 50754] [client 20.151.206.105:12783] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aYZBsGVwLsaZ7aKO2cnOiAAAAJM"]
[Sat Feb 07 03:32:00.739274 2026] [:error] [pid 50673:tid 50735] [client 20.151.206.105:12422] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "aYZBsGVwLsaZ7aKO2cnOiQAAAIA"]
[Sat Feb 07 03:32:01.152843 2026] [:error] [pid 50673:tid 50743] [client 20.151.206.105:12679] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "aYZBsWVwLsaZ7aKO2cnOiwAAAIg"]
[Sat Feb 07 03:32:01.565253 2026] [:error] [pid 50671:tid 50683] [client 20.151.206.105:13193] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "aYZBsbvqLohWBI_mqBO2hAAAAAM"]
[Sat Feb 07 03:32:02.011224 2026] [:error] [pid 50673:tid 50748] [client 20.151.206.105:12606] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "aYZBsmVwLsaZ7aKO2cnOjgAAAI0"]
[Sat Feb 07 03:32:02.423107 2026] [:error] [pid 50780:tid 50786] [client 20.151.206.105:12713] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "aYZBsutUmIu2JHM2CrtuBwAAAMQ"]
[Sat Feb 07 03:32:02.834513 2026] [:error] [pid 50780:tid 50785] [client 20.151.206.105:12785] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "aYZBsutUmIu2JHM2CrtuCQAAAMM"]
[Sat Feb 07 03:32:03.254091 2026] [:error] [pid 50671:tid 50698] [client 20.151.206.105:12710] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "aYZBs7vqLohWBI_mqBO2hgAAABI"]
[Sat Feb 07 03:32:03.666182 2026] [:error] [pid 50672:tid 50720] [client 20.151.206.105:12798] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "aYZBsw9o0jq1XS8Nv7NTzgAAAEw"]
[Sat Feb 07 03:32:04.078478 2026] [:error] [pid 50671:tid 50692] [client 20.151.206.105:12417] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aYZBtLvqLohWBI_mqBO2iQAAAAw"]
[Sat Feb 07 03:32:04.488234 2026] [:error] [pid 50673:tid 50736] [client 20.151.206.105:12726] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aYZBtGVwLsaZ7aKO2cnOlgAAAIE"]
[Sat Feb 07 03:32:04.904706 2026] [:error] [pid 50671:tid 50688] [client 20.151.206.105:12683] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aYZBtLvqLohWBI_mqBO2jAAAAAg"]
[Sat Feb 07 03:32:05.353718 2026] [:error] [pid 50780:tid 50791] [client 20.151.206.105:12791] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aYZBtetUmIu2JHM2CrtuEQAAAMk"]
[Sat Feb 07 03:32:05.788751 2026] [:error] [pid 50671:tid 50680] [client 20.151.206.105:13192] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aYZBtbvqLohWBI_mqBO2jgAAAAA"]
[Sat Feb 07 03:32:06.226416 2026] [:error] [pid 50672:tid 50727] [client 20.151.206.105:12717] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aYZBtg9o0jq1XS8Nv7NT0QAAAFM"]
[Sat Feb 07 03:32:06.644764 2026] [:error] [pid 50780:tid 50801] [client 20.151.206.105:12795] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aYZBtutUmIu2JHM2CrtuFAAAANM"]
[Sat Feb 07 03:32:07.059889 2026] [:error] [pid 50672:tid 50721] [client 20.151.206.105:12674] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aYZBtw9o0jq1XS8Nv7NT1QAAAE0"]
[Sat Feb 07 03:32:07.527753 2026] [:error] [pid 50672:tid 50724] [client 20.151.206.105:12711] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aYZBtw9o0jq1XS8Nv7NT1wAAAFA"]
[Sat Feb 07 03:32:07.946678 2026] [:error] [pid 50672:tid 50730] [client 20.151.206.105:13086] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aYZBtw9o0jq1XS8Nv7NT2QAAAFY"]
[Sat Feb 07 03:32:08.367332 2026] [:error] [pid 50780:tid 50789] [client 20.151.206.105:12712] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aYZBuOtUmIu2JHM2CrtuFwAAAMc"]
[Sat Feb 07 03:32:08.781304 2026] [:error] [pid 50672:tid 50717] [client 20.151.206.105:12678] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aYZBuA9o0jq1XS8Nv7NT2wAAAEk"]
[Sat Feb 07 03:32:09.210652 2026] [:error] [pid 50673:tid 50747] [client 20.151.206.105:12452] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "aYZBuWVwLsaZ7aKO2cnOoAAAAIw"]
[Sat Feb 07 03:32:09.624649 2026] [:error] [pid 50780:tid 50791] [client 20.151.206.105:12701] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "aYZBuetUmIu2JHM2CrtuGgAAAMk"]
[Sat Feb 07 03:32:10.036565 2026] [:error] [pid 50673:tid 50746] [client 20.151.206.105:12739] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "aYZBumVwLsaZ7aKO2cnOowAAAIs"]
[Sat Feb 07 03:32:10.446758 2026] [:error] [pid 50671:tid 50697] [client 20.151.206.105:12732] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "aYZBurvqLohWBI_mqBO2lAAAABE"]
[Sat Feb 07 03:32:10.861271 2026] [:error] [pid 50671:tid 50681] [client 20.151.206.105:13228] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pop.php"] [unique_id "aYZBurvqLohWBI_mqBO2lgAAAAE"]
[Sat Feb 07 03:32:11.281697 2026] [:error] [pid 50671:tid 50693] [client 20.151.206.105:12676] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pop.php"] [unique_id "aYZBu7vqLohWBI_mqBO2mQAAAA0"]
[Sat Feb 07 03:32:11.694030 2026] [:error] [pid 50672:tid 50712] [client 20.151.206.105:12426] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pop.php"] [unique_id "aYZBuw9o0jq1XS8Nv7NT4AAAAEQ"]
[Sat Feb 07 03:32:12.104456 2026] [:error] [pid 50672:tid 50710] [client 20.151.206.105:12777] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pop.php"] [unique_id "aYZBvA9o0jq1XS8Nv7NT4wAAAEI"]
[Sat Feb 07 03:32:12.535722 2026] [:error] [pid 50780:tid 50792] [client 20.151.206.105:12775] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aYZBvOtUmIu2JHM2CrtuHAAAAMo"]
[Sat Feb 07 03:32:12.952666 2026] [:error] [pid 50672:tid 50730] [client 20.151.206.105:12718] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aYZBvA9o0jq1XS8Nv7NT5gAAAFY"]
[Sat Feb 07 03:32:13.365270 2026] [:error] [pid 50672:tid 50712] [client 20.151.206.105:12688] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aYZBvQ9o0jq1XS8Nv7NT6wAAAEQ"]
[Sat Feb 07 03:32:13.778770 2026] [:error] [pid 50672:tid 50718] [client 20.151.206.105:12474] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aYZBvQ9o0jq1XS8Nv7NT7AAAAEo"]
[Sat Feb 07 03:32:14.192936 2026] [:error] [pid 50780:tid 50797] [client 20.151.206.105:12449] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xaz.php"] [unique_id "aYZBvutUmIu2JHM2CrtuHQAAAM8"]
[Sat Feb 07 03:32:14.603041 2026] [:error] [pid 50673:tid 50754] [client 20.151.206.105:12418] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xaz.php"] [unique_id "aYZBvmVwLsaZ7aKO2cnOqgAAAJM"]
[Sat Feb 07 03:32:15.017058 2026] [:error] [pid 50671:tid 50700] [client 20.151.206.105:12705] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xaz.php"] [unique_id "aYZBv7vqLohWBI_mqBO2nQAAABQ"]
[Sat Feb 07 03:32:15.444727 2026] [:error] [pid 50780:tid 50782] [client 20.151.206.105:12692] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xaz.php"] [unique_id "aYZBv-tUmIu2JHM2CrtuIQAAAMA"]
[Sat Feb 07 03:32:15.872410 2026] [:error] [pid 50780:tid 50799] [client 20.151.206.105:12672] [client 20.151.206.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up4.php"] [unique_id "aYZBv-tUmIu2JHM2CrtuIwAAANE"]
[Sat Feb 07 03:33:46.746751 2026] [:error] [pid 50780:tid 50804] [client 51.195.116.187:48924] [client 51.195.116.187] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.195.116.187, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZCGutUmIu2JHM2CrtuqgAAANY"]
[Sat Feb 07 03:33:47.692805 2026] [:error] [pid 50780:tid 50791] [client 51.195.116.187:48924] [client 51.195.116.187] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.195.116.187, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZCG-tUmIu2JHM2CrtusAAAAMk"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:35:25.356863 2026] [:error] [pid 50673:tid 50756] [client 65.254.225.219:34396] [client 65.254.225.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.219, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZCfWVwLsaZ7aKO2cnQNgAAAJU"]
[Sat Feb 07 03:35:26.324385 2026] [:error] [pid 50673:tid 50744] [client 65.254.225.219:34396] [client 65.254.225.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.219, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZCfmVwLsaZ7aKO2cnQOQAAAIk"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:37:46.233278 2026] [:error] [pid 50780:tid 50787] [client 179.108.84.136:52908] [client 179.108.84.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 179.108.84.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZDCutUmIu2JHM2CrtxVAAAAMU"]
[Sat Feb 07 03:37:47.667643 2026] [:error] [pid 50780:tid 50797] [client 179.108.84.136:52908] [client 179.108.84.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 179.108.84.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZDC-tUmIu2JHM2CrtxVwAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:38:16.902533 2026] [:error] [pid 50671:tid 50695] [client 209.59.172.182:33402] [client 209.59.172.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.59.172.182, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZDKLvqLohWBI_mqBO5WAAAAA8"]
[Sat Feb 07 03:38:17.927454 2026] [:error] [pid 50671:tid 50690] [client 209.59.172.182:33402] [client 209.59.172.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.59.172.182, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZDKbvqLohWBI_mqBO5WQAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:39:20.308445 2026] [:error] [pid 50673:tid 50746] [client 92.205.20.61:49694] [client 92.205.20.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.205.20.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZDaGVwLsaZ7aKO2cnSFAAAAIs"]
[Sat Feb 07 03:42:48.750719 2026] [:error] [pid 50671:tid 50689] [client 157.20.159.163:56336] [client 157.20.159.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.20.159.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZEOLvqLohWBI_mqBO6vAAAAAk"]
[Sat Feb 07 03:42:50.026114 2026] [:error] [pid 50671:tid 50694] [client 157.20.159.163:56336] [client 157.20.159.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.20.159.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZEOrvqLohWBI_mqBO6vQAAAA4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:46:02.853546 2026] [:error] [pid 55157:tid 55170] [client 209.235.136.133:48090] [client 209.235.136.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZE-n36JdtTn2bTEoyYpwAAAQg"]
[Sat Feb 07 03:46:04.535877 2026] [:error] [pid 55157:tid 55173] [client 209.235.136.133:48090] [client 209.235.136.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZE_H36JdtTn2bTEoyYrQAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:47:22.038930 2026] [:error] [pid 55157:tid 55180] [client 216.194.175.55:54602] [client 216.194.175.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.194.175.55, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZFSn36JdtTn2bTEoyZbwAAARI"]
[Sat Feb 07 03:47:23.057906 2026] [:error] [pid 55157:tid 55182] [client 216.194.175.55:54602] [client 216.194.175.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.194.175.55, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZFS336JdtTn2bTEoyZcQAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:47:55.139685 2026] [:error] [pid 50672:tid 50711] [client 184.168.108.157:16478] [client 184.168.108.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 184.168.108.157, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZFaw9o0jq1XS8Nv7NZYwAAAEM"]
[Sat Feb 07 03:47:56.144690 2026] [:error] [pid 50672:tid 50714] [client 184.168.108.157:16478] [client 184.168.108.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 184.168.108.157, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZFbA9o0jq1XS8Nv7NZZgAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:49:11.303910 2026] [:error] [pid 55157:tid 55185] [client 136.110.3.61:55134] [client 136.110.3.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.110.3.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZFt336JdtTn2bTEoyaWwAAARc"]
[Sat Feb 07 03:49:14.220221 2026] [:error] [pid 55157:tid 55165] [client 136.110.3.61:55142] [client 136.110.3.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.110.3.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZFun36JdtTn2bTEoyaYQAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:51:32.713239 2026] [:error] [pid 50780:tid 50793] [client 131.72.236.108:42776] [client 131.72.236.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 131.72.236.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZGROtUmIu2JHM2Crt2pAAAAMs"]
[Sat Feb 07 03:55:09.333432 2026] [:error] [pid 55157:tid 55183] [client 162.0.211.226:57730] [client 162.0.211.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.211.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZHHX36JdtTn2bTEoyeJAAAARU"]
[Sat Feb 07 03:55:10.278797 2026] [:error] [pid 55157:tid 55172] [client 162.0.211.226:57730] [client 162.0.211.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.211.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZHHn36JdtTn2bTEoyeJwAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 03:56:17.819351 2026] [:error] [pid 50672:tid 50722] [client 34.182.116.62:39262] [client 34.182.116.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.182.116.62, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZHYQ9o0jq1XS8Nv7NceQAAAE4"]
[Sat Feb 07 04:01:04.261386 2026] [:error] [pid 50672:tid 50711] [client 69.175.61.106:38312] [client 69.175.61.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.175.61.106, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZIgA9o0jq1XS8Nv7NeDwAAAEM"]
[Sat Feb 07 04:01:06.446771 2026] [:error] [pid 50672:tid 50730] [client 69.175.61.106:38312] [client 69.175.61.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.175.61.106, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZIgg9o0jq1XS8Nv7NeFQAAAFY"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 04:06:16.756651 2026] [:error] [pid 50673:tid 50735] [client 64.225.25.250:50942] [client 64.225.25.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.225.25.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZJuGVwLsaZ7aKO2cncMAAAAIA"]
[Sat Feb 07 04:06:17.750642 2026] [:error] [pid 50673:tid 50754] [client 64.225.25.250:50942] [client 64.225.25.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.225.25.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZJuWVwLsaZ7aKO2cncMQAAAJM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 04:06:46.291567 2026] [:error] [pid 50780:tid 50805] [client 63.250.44.53:35882] [client 63.250.44.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.44.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZJ1utUmIu2JHM2Crt9XAAAANc"]
[Sat Feb 07 04:06:47.378445 2026] [:error] [pid 50780:tid 50804] [client 63.250.44.53:35882] [client 63.250.44.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.44.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZJ1-tUmIu2JHM2Crt9XgAAANY"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 04:07:38.857597 2026] [:error] [pid 55157:tid 55184] [client 91.134.77.234:25797] [client 91.134.77.234] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.134.77.234, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZKCn36JdtTn2bTEoymXgAAARY"]
[Sat Feb 07 04:07:39.872612 2026] [:error] [pid 55157:tid 55180] [client 91.134.77.234:25797] [client 91.134.77.234] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.134.77.234, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZKC336JdtTn2bTEoymYAAAARI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 04:19:08.473984 2026] [:error] [pid 55157:tid 55185] [client 209.235.136.148:59636] [client 209.235.136.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.148, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZMvH36JdtTn2bTEoyuTgAAARc"]
[Sat Feb 07 04:19:09.619751 2026] [:error] [pid 55157:tid 55170] [client 209.235.136.148:59636] [client 209.235.136.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.148, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZMvX36JdtTn2bTEoyuUgAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 04:20:18.059494 2026] [:error] [pid 50672:tid 50726] [client 162.0.216.102:37712] [client 162.0.216.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.216.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZNAg9o0jq1XS8Nv7NoFwAAAFI"]
[Sat Feb 07 04:29:21.367532 2026] [:error] [pid 55157:tid 55186] [client 3.223.104.32:52918] [client 3.223.104.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.223.104.32, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZPIX36JdtTn2bTEoy1mwAAARg"]
[Sat Feb 07 04:29:31.517610 2026] [:error] [pid 55157:tid 55179] [client 3.223.104.32:53784] [client 3.223.104.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.223.104.32, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZPK336JdtTn2bTEoy1rgAAARE"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 04:36:22.464638 2026] [:error] [pid 55157:tid 55179] [client 131.72.236.108:57858] [client 131.72.236.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 131.72.236.108, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZQxn36JdtTn2bTEoy3-AAAARE"]
[Sat Feb 07 04:36:25.384404 2026] [:error] [pid 55157:tid 55172] [client 131.72.236.108:59908] [client 131.72.236.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 131.72.236.108, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZQyX36JdtTn2bTEoy3_gAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 04:38:31.626584 2026] [:error] [pid 55157:tid 55168] [client 50.62.137.49:60996] [client 50.62.137.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.137.49, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZRR336JdtTn2bTEoy4-gAAAQY"]
[Sat Feb 07 04:38:53.690311 2026] [:error] [pid 50671:tid 50702] [client 50.62.137.49:62924] [client 50.62.137.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.137.49, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZRXbvqLohWBI_mqBPQPAAAABY"]
[Sat Feb 07 04:38:55.697654 2026] [:error] [pid 55157:tid 55178] [client 50.62.137.49:62926] [client 50.62.137.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.137.49, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZRX336JdtTn2bTEoy5aQAAARA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 04:42:36.862759 2026] [:error] [pid 50671:tid 50702] [client 162.241.169.5:17202] [client 162.241.169.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.169.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZSPLvqLohWBI_mqBPRHQAAABY"]
[Sat Feb 07 04:42:37.805228 2026] [:error] [pid 50671:tid 50688] [client 162.241.169.5:17202] [client 162.241.169.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.169.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZSPbvqLohWBI_mqBPRHgAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 04:42:43.983442 2026] [:error] [pid 50673:tid 50750] [client 162.240.10.235:58724] [client 162.240.10.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.10.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZSQ2VwLsaZ7aKO2cnqTwAAAI8"]
[Sat Feb 07 04:42:44.962609 2026] [:error] [pid 50673:tid 50743] [client 162.240.10.235:58724] [client 162.240.10.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.10.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZSRGVwLsaZ7aKO2cnqUQAAAIg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 04:50:16.735872 2026] [:error] [pid 50671:tid 50694] [client 103.97.124.92:43732] [client 103.97.124.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.97.124.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZUCLvqLohWBI_mqBPTTgAAAA4"]
[Sat Feb 07 04:50:17.703024 2026] [:error] [pid 50671:tid 50683] [client 103.97.124.92:43732] [client 103.97.124.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.97.124.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZUCbvqLohWBI_mqBPTUAAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 04:51:41.363476 2026] [:error] [pid 50780:tid 50805] [client 95.170.13.164:59136] [client 95.170.13.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.170.13.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZUXetUmIu2JHM2CruRyAAAANc"]
[Sat Feb 07 04:51:42.184621 2026] [:error] [pid 50780:tid 50801] [client 95.170.13.164:59136] [client 95.170.13.164] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.170.13.164, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZUXutUmIu2JHM2CruRzQAAANM"]
[Sat Feb 07 04:51:47.492067 2026] [:error] [pid 50780:tid 50794] [client 95.170.13.164:59136] [client 95.170.13.164] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYZUY-tUmIu2JHM2CruR2wAAAMw"]
[Sat Feb 07 04:51:47.795478 2026] [:error] [pid 50780:tid 50801] [client 95.170.13.164:59136] [client 95.170.13.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.170.13.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZUY-tUmIu2JHM2CruR3gAAANM"]
[Sat Feb 07 04:51:47.796649 2026] [:error] [pid 50780:tid 50801] [client 95.170.13.164:59136] [client 95.170.13.164] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZUY-tUmIu2JHM2CruR3gAAANM"]
[Sat Feb 07 04:51:47.798039 2026] [:error] [pid 50780:tid 50801] [client 95.170.13.164:59136] [client 95.170.13.164] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZUY-tUmIu2JHM2CruR3gAAANM"]
[Sat Feb 07 04:51:54.193181 2026] [:error] [pid 55157:tid 55184] [client 192.185.131.65:31640] [client 192.185.131.65] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.131.65, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZUan36JdtTn2bTEoy-qAAAARY"]
[Sat Feb 07 04:51:55.031032 2026] [:error] [pid 55157:tid 55175] [client 192.185.131.65:31640] [client 192.185.131.65] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.131.65, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZUa336JdtTn2bTEoy-qgAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 04:51:59.990721 2026] [:error] [pid 50671:tid 50698] [client 95.170.13.164:49725] [client 95.170.13.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.170.13.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZUb7vqLohWBI_mqBPTuQAAABI"]
[Sat Feb 07 04:51:59.992500 2026] [:error] [pid 50671:tid 50698] [client 95.170.13.164:49725] [client 95.170.13.164] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZUb7vqLohWBI_mqBPTuQAAABI"]
[Sat Feb 07 04:51:59.993862 2026] [:error] [pid 50671:tid 50698] [client 95.170.13.164:49725] [client 95.170.13.164] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZUb7vqLohWBI_mqBPTuQAAABI"]
[Sat Feb 07 04:52:07.474202 2026] [:error] [pid 55157:tid 55177] [client 95.170.13.164:52475] [client 95.170.13.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.170.13.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZUd336JdtTn2bTEoy-vwAAAQ8"]
[Sat Feb 07 04:52:13.842880 2026] [:error] [pid 50780:tid 50796] [client 95.170.13.164:55797] [client 95.170.13.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.170.13.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZUfetUmIu2JHM2CruSEwAAAM4"]
[Sat Feb 07 04:53:07.042474 2026] [:error] [pid 50780:tid 50800] [client 68.178.227.3:51324] [client 68.178.227.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.227.3, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZUs-tUmIu2JHM2CruSowAAANI"]
[Sat Feb 07 04:53:08.026436 2026] [:error] [pid 50780:tid 50796] [client 68.178.227.3:51324] [client 68.178.227.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.227.3, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZUtOtUmIu2JHM2CruSpAAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 04:57:35.161634 2026] [:error] [pid 50780:tid 50782] [client 118.139.176.76:34658] [client 118.139.176.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 118.139.176.76, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZVv-tUmIu2JHM2CruUOAAAAMA"]
[Sat Feb 07 04:57:36.152989 2026] [:error] [pid 50780:tid 50783] [client 118.139.176.76:34658] [client 118.139.176.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 118.139.176.76, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZVwOtUmIu2JHM2CruUOgAAAME"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 05:01:01.532170 2026] [:error] [pid 55157:tid 55180] [client 69.49.241.51:14862] [client 69.49.241.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.241.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZWjX36JdtTn2bTEozCywAAARI"]
[Sat Feb 07 05:01:02.533962 2026] [:error] [pid 55157:tid 55181] [client 69.49.241.51:14862] [client 69.49.241.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.241.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZWjn36JdtTn2bTEozCzQAAARM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 05:01:48.132034 2026] [:error] [pid 55157:tid 55181] [client 54.255.216.38:35820] [client 54.255.216.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.255.216.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZWvH36JdtTn2bTEozC_AAAARM"]
[Sat Feb 07 05:01:51.225363 2026] [:error] [pid 50672:tid 50724] [client 54.255.216.38:35822] [client 54.255.216.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.255.216.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZWvw9o0jq1XS8Nv7N0uAAAAFA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 05:02:06.856533 2026] [:error] [pid 50672:tid 50732] [client 69.49.241.51:44230] [client 69.49.241.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.241.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZWzg9o0jq1XS8Nv7N0xgAAAFg"]
[Sat Feb 07 05:02:07.749875 2026] [:error] [pid 50672:tid 50720] [client 69.49.241.51:44230] [client 69.49.241.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.241.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZWzw9o0jq1XS8Nv7N0yAAAAEw"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 05:02:27.433393 2026] [:error] [pid 50673:tid 50759] [client 184.168.116.165:22294] [client 184.168.116.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 184.168.116.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZW42VwLsaZ7aKO2cnv2QAAAJg"]
[Sat Feb 07 05:02:30.462558 2026] [:error] [pid 55157:tid 55175] [client 184.168.116.165:22298] [client 184.168.116.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 184.168.116.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZW5n36JdtTn2bTEozDLQAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 05:12:09.598693 2026] [:error] [pid 55157:tid 55180] [client 209.59.172.182:48926] [client 209.59.172.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.59.172.182, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZZKX36JdtTn2bTEozG5wAAARI"]
[Sat Feb 07 05:12:10.734486 2026] [:error] [pid 55157:tid 55172] [client 209.59.172.182:48926] [client 209.59.172.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.59.172.182, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZZKn36JdtTn2bTEozG6gAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 05:21:22.067984 2026] [:error] [pid 50671:tid 50693] [client 172.105.244.221:59312] [client 172.105.244.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.105.244.221, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZbUrvqLohWBI_mqBPbgAAAAA0"]
[Sat Feb 07 05:21:24.395231 2026] [:error] [pid 55157:tid 55176] [client 172.105.244.221:59316] [client 172.105.244.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.105.244.221, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZbVH36JdtTn2bTEozMJgAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 05:29:17.421615 2026] [:error] [pid 50671:tid 50682] [client 162.240.10.235:48640] [client 162.240.10.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.10.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZdLbvqLohWBI_mqBPd2wAAAAI"]
[Sat Feb 07 05:29:20.648322 2026] [:error] [pid 50671:tid 50685] [client 162.240.10.235:48640] [client 162.240.10.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.10.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZdMLvqLohWBI_mqBPd3wAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 05:29:48.165489 2026] [:error] [pid 55157:tid 55185] [client 172.105.244.221:41254] [client 172.105.244.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.105.244.221, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZdTH36JdtTn2bTEozQWQAAARc"]
[Sat Feb 07 05:30:13.954203 2026] [:error] [pid 43182:tid 43186] [client 185.180.207.133:39572] [client 185.180.207.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.180.207.133, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZdZfEC82JnxmrnFYm1hQAAAUI"]
[Sat Feb 07 05:30:31.887915 2026] [:error] [pid 55157:tid 55172] [client 185.221.174.225:57246] [client 185.221.174.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.221.174.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZdd336JdtTn2bTEozQyAAAAQo"]
[Sat Feb 07 05:30:35.099267 2026] [:error] [pid 55157:tid 55166] [client 185.221.174.225:57246] [client 185.221.174.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.221.174.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZde336JdtTn2bTEozQzwAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 05:30:36.054690 2026] [:error] [pid 50673:tid 50738] [client 34.77.90.132:48371] [client 34.77.90.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.77.90.132, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZdfGVwLsaZ7aKO2cn3wAAAAIM"]
[Sat Feb 07 05:30:36.844019 2026] [:error] [pid 50673:tid 50736] [client 34.77.90.132:48371] [client 34.77.90.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.77.90.132, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZdfGVwLsaZ7aKO2cn3wgAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 05:30:44.923506 2026] [:error] [pid 55157:tid 55182] [client 136.243.21.235:42556] [client 136.243.21.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.243.21.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZdhH36JdtTn2bTEozQ5AAAARQ"]
[Sat Feb 07 05:30:48.896451 2026] [:error] [pid 55157:tid 55169] [client 136.243.21.235:42556] [client 136.243.21.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.243.21.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZdiH36JdtTn2bTEozQ8QAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 05:31:19.793064 2026] [:error] [pid 50673:tid 50740] [client 92.205.20.61:33398] [client 92.205.20.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.20.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZdp2VwLsaZ7aKO2cn38wAAAIU"]
[Sat Feb 07 05:31:21.805836 2026] [:error] [pid 55157:tid 55176] [client 92.205.20.61:36872] [client 92.205.20.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.20.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZdqX36JdtTn2bTEozRLQAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 05:42:25.407045 2026] [:error] [pid 50672:tid 50708] [client 34.73.126.11:43978] [client 34.73.126.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.73.126.11, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZgQQ9o0jq1XS8Nv7N_YQAAAEA"]
[Sat Feb 07 05:42:26.661047 2026] [:error] [pid 50672:tid 50716] [client 34.73.126.11:43978] [client 34.73.126.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.73.126.11, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZgQg9o0jq1XS8Nv7N_ZQAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 05:47:35.260560 2026] [:error] [pid 50673:tid 50753] [client 5.180.107.178:37922] [client 5.180.107.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.180.107.178, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZhd2VwLsaZ7aKO2cn9BwAAAJI"]
[Sat Feb 07 05:47:36.272797 2026] [:error] [pid 50673:tid 50740] [client 5.180.107.178:37922] [client 5.180.107.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.180.107.178, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZheGVwLsaZ7aKO2cn9CQAAAIU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 05:49:26.305408 2026] [:error] [pid 50671:tid 50683] [client 198.38.94.18:53008] [client 198.38.94.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.38.94.18, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZh5rvqLohWBI_mqBPi1AAAAAM"]
[Sat Feb 07 05:49:27.404259 2026] [:error] [pid 50671:tid 50699] [client 198.38.94.18:53008] [client 198.38.94.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.38.94.18, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZh57vqLohWBI_mqBPi1wAAABM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 05:50:37.720526 2026] [:error] [pid 55157:tid 55163] [client 136.110.3.61:58156] [client 136.110.3.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.110.3.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZiLX36JdtTn2bTEozaNwAAAQE"]
[Sat Feb 07 05:50:40.234067 2026] [:error] [pid 43182:tid 43192] [client 136.110.3.61:58170] [client 136.110.3.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.110.3.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZiMPEC82JnxmrnFYm9dgAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 05:52:08.879770 2026] [:error] [pid 50673:tid 50747] [client 135.181.134.243:36072] [client 135.181.134.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 135.181.134.243, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZiiGVwLsaZ7aKO2cn-bAAAAIw"]
[Sat Feb 07 05:52:10.956745 2026] [:error] [pid 43182:tid 43188] [client 135.181.134.243:36078] [client 135.181.134.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 135.181.134.243, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZiivEC82JnxmrnFYm-JAAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 05:53:34.979102 2026] [:error] [pid 55157:tid 55182] [client 162.0.211.226:35234] [client 162.0.211.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.211.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZi3n36JdtTn2bTEozblAAAARQ"]
[Sat Feb 07 05:53:36.978480 2026] [:error] [pid 43182:tid 43206] [client 162.0.211.226:49656] [client 162.0.211.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.211.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZi4PEC82JnxmrnFYm-sgAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 05:54:00.314842 2026] [:error] [pid 43182:tid 43205] [client 107.180.114.83:61954] [client 107.180.114.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.114.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZi-PEC82JnxmrnFYm-0wAAAVU"]
[Sat Feb 07 05:54:01.299061 2026] [:error] [pid 43182:tid 43194] [client 107.180.114.83:61954] [client 107.180.114.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.114.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZi-fEC82JnxmrnFYm-1gAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 06:03:19.105420 2026] [:error] [pid 55157:tid 55173] [client 51.255.148.60:33988] [client 51.255.148.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.255.148.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZlJ336JdtTn2bTEozgAgAAAQs"]
[Sat Feb 07 06:03:20.162526 2026] [:error] [pid 55157:tid 55169] [client 51.255.148.60:33988] [client 51.255.148.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.255.148.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZlKH36JdtTn2bTEozgAwAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 06:03:31.921719 2026] [:error] [pid 50673:tid 50746] [client 68.178.134.15:27194] [client 68.178.134.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.134.15, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZlM2VwLsaZ7aKO2ckBogAAAIs"]
[Sat Feb 07 06:03:32.806058 2026] [:error] [pid 50673:tid 50756] [client 68.178.134.15:27194] [client 68.178.134.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.134.15, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZlNGVwLsaZ7aKO2ckBpQAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 06:06:27.111218 2026] [:error] [pid 50780:tid 50789] [client 43.229.86.17:36736] [client 43.229.86.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.229.86.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZl4-tUmIu2JHM2CrupfAAAAMc"]
[Sat Feb 07 06:06:30.390042 2026] [:error] [pid 43182:tid 43185] [client 43.229.86.17:36748] [client 43.229.86.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.229.86.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZl5vEC82JnxmrnFYnDKwAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 06:09:28.651429 2026] [:error] [pid 55157:tid 55165] [client 97.74.83.242:32946] [client 97.74.83.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 97.74.83.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZmmH36JdtTn2bTEozimwAAAQM"]
[Sat Feb 07 06:09:35.981809 2026] [:error] [pid 50672:tid 50729] [client 89.43.17.214:50358] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZmnw9o0jq1XS8Nv7OH_gAAAFU"]
[Sat Feb 07 06:09:39.118176 2026] [:error] [pid 55157:tid 55175] [client 104.244.79.40:60530] [client 104.244.79.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.244.79.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZmo336JdtTn2bTEoziogAAAQ0"]
[Sat Feb 07 06:09:44.623791 2026] [:error] [pid 50671:tid 50682] [client 89.43.17.214:51568] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZmqLvqLohWBI_mqBPo0gAAAAI"]
[Sat Feb 07 06:09:51.870621 2026] [:error] [pid 50673:tid 50747] [client 47.94.14.136:34112] [client 47.94.14.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.94.14.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZmr2VwLsaZ7aKO2ckDngAAAIw"]
[Sat Feb 07 06:09:58.187727 2026] [:error] [pid 55157:tid 55180] [client 97.74.83.242:59856] [client 97.74.83.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 97.74.83.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZmtn36JdtTn2bTEozizQAAARI"]
[Sat Feb 07 06:09:58.492504 2026] [:error] [pid 55157:tid 55163] [client 185.73.130.137:50338] [client 185.73.130.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.73.130.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZmtn36JdtTn2bTEozizwAAAQE"]
[Sat Feb 07 06:10:02.142742 2026] [:error] [pid 43182:tid 43207] [client 130.185.76.102:43474] [client 130.185.76.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.185.76.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZmuvEC82JnxmrnFYnEpAAAAVc"]
[Sat Feb 07 06:10:04.047932 2026] [:error] [pid 55157:tid 55168] [client 160.250.227.36:42110] [client 160.250.227.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.227.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZmvH36JdtTn2bTEozi3AAAAQY"]
[Sat Feb 07 06:10:06.821771 2026] [:error] [pid 50780:tid 50785] [client 89.43.17.214:54634] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZmvutUmIu2JHM2Cruq2QAAAMM"]
[Sat Feb 07 06:10:52.919565 2026] [:error] [pid 50780:tid 50783] [client 82.223.245.250:34620] [client 82.223.245.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.245.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZm7OtUmIu2JHM2CrurIQAAAME"]
[Sat Feb 07 06:10:54.000734 2026] [:error] [pid 50780:tid 50805] [client 82.223.245.250:34620] [client 82.223.245.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.245.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZm7etUmIu2JHM2CrurIwAAANc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 06:11:04.074539 2026] [:error] [pid 43182:tid 43189] [client 156.146.60.76:27438] [client 156.146.60.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 156.146.60.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZm-PEC82JnxmrnFYnE1QAAAUU"], referer: https://expressinteriors.com/
[Sat Feb 07 06:12:37.185411 2026] [:error] [pid 50671:tid 50704] [client 103.13.103.146:51920] [client 103.13.103.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.13.103.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZnVbvqLohWBI_mqBPpSAAAABg"]
[Sat Feb 07 06:12:38.218343 2026] [:error] [pid 50671:tid 50680] [client 103.13.103.146:51920] [client 103.13.103.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.13.103.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZnVrvqLohWBI_mqBPpSgAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 06:19:44.230330 2026] [:error] [pid 55157:tid 55162] [client 43.229.86.17:52058] [client 43.229.86.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.229.86.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZpAH36JdtTn2bTEozmgAAAAQA"]
[Sat Feb 07 06:19:46.401667 2026] [:error] [pid 50673:tid 50739] [client 162.240.10.235:51696] [client 162.240.10.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.10.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZpAmVwLsaZ7aKO2ckFagAAAIQ"]
[Sat Feb 07 06:19:47.312678 2026] [:error] [pid 50673:tid 50740] [client 162.240.10.235:51696] [client 162.240.10.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.10.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZpA2VwLsaZ7aKO2ckFbAAAAIU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 06:23:37.537646 2026] [:error] [pid 55157:tid 55173] [client 82.223.20.103:48770] [client 82.223.20.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.20.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZp6X36JdtTn2bTEozn7wAAAQs"]
[Sat Feb 07 06:29:00.674781 2026] [:error] [pid 55157:tid 55178] [client 162.240.10.235:53168] [client 162.240.10.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.10.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZrLH36JdtTn2bTEozqEwAAARA"]
[Sat Feb 07 06:29:02.598468 2026] [:error] [pid 55157:tid 55166] [client 162.240.10.235:53168] [client 162.240.10.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.10.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZrLn36JdtTn2bTEozqGAAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 06:29:27.588188 2026] [:error] [pid 43182:tid 43200] [client 66.223.49.177:41802] [client 66.223.49.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.223.49.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZrR_EC82JnxmrnFYnKRQAAAVA"]
[Sat Feb 07 06:29:28.537781 2026] [:error] [pid 43182:tid 43196] [client 66.223.49.177:41802] [client 66.223.49.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.223.49.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZrSPEC82JnxmrnFYnKSQAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 06:32:06.545157 2026] [:error] [pid 50671:tid 50687] [client 113.166.92.134:33672] [client 113.166.92.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 113.166.92.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZr5rvqLohWBI_mqBPuOgAAAAc"]
[Sat Feb 07 06:32:07.601415 2026] [:error] [pid 50671:tid 50691] [client 113.166.92.134:33672] [client 113.166.92.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 113.166.92.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZr57vqLohWBI_mqBPuQQAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 06:35:29.946331 2026] [:error] [pid 50672:tid 50714] [client 95.111.228.44:52216] [client 95.111.228.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.111.228.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZssQ9o0jq1XS8Nv7OQcwAAAEY"]
[Sat Feb 07 06:35:31.729337 2026] [:error] [pid 50672:tid 50717] [client 95.111.228.44:52216] [client 95.111.228.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.111.228.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZssw9o0jq1XS8Nv7OQdwAAAEk"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 06:37:21.899268 2026] [:error] [pid 50671:tid 50694] [client 159.198.37.158:36678] [client 159.198.37.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.198.37.158, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZtIbvqLohWBI_mqBPw3QAAAA4"]
[Sat Feb 07 06:37:22.841212 2026] [:error] [pid 50671:tid 50695] [client 159.198.37.158:36678] [client 159.198.37.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.198.37.158, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZtIrvqLohWBI_mqBPw3wAAAA8"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 06:37:44.880622 2026] [:error] [pid 50672:tid 50720] [client 131.72.236.108:45874] [client 131.72.236.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 131.72.236.108, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZtOA9o0jq1XS8Nv7ORVwAAAEw"]
[Sat Feb 07 06:37:46.057799 2026] [:error] [pid 50672:tid 50722] [client 131.72.236.108:45874] [client 131.72.236.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 131.72.236.108, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZtOg9o0jq1XS8Nv7ORWAAAAE4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 06:45:01.680396 2026] [:error] [pid 50780:tid 50791] [client 103.154.176.224:45616] [client 103.154.176.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.154.176.224, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZu7etUmIu2JHM2Cru34AAAAMk"]
[Sat Feb 07 06:45:05.171722 2026] [:error] [pid 50780:tid 50783] [client 103.154.176.224:45616] [client 103.154.176.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.154.176.224, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZu8etUmIu2JHM2Cru34wAAAME"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 06:47:28.789785 2026] [:error] [pid 50673:tid 50743] [client 202.51.3.72:59316] [client 202.51.3.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.51.3.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZvgGVwLsaZ7aKO2ckO6gAAAIg"]
[Sat Feb 07 06:47:34.173827 2026] [:error] [pid 50672:tid 50714] [client 202.51.3.72:48616] [client 202.51.3.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.51.3.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZvhg9o0jq1XS8Nv7OTYwAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 06:52:34.414484 2026] [:error] [pid 50780:tid 50788] [client 103.13.103.146:44498] [client 103.13.103.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.13.103.146, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYZwsutUmIu2JHM2Cru6TwAAAMY"]
[Sat Feb 07 06:54:37.461505 2026] [:error] [pid 55157:tid 55165] [client 103.13.103.146:51582] [client 103.13.103.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.13.103.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZxLX36JdtTn2bTEoz6lAAAAQM"]
[Sat Feb 07 06:54:43.107907 2026] [:error] [pid 55157:tid 55180] [client 103.13.103.146:51582] [client 103.13.103.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.13.103.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZxM336JdtTn2bTEoz6nwAAARI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 06:58:44.459610 2026] [:error] [pid 43182:tid 43198] [client 65.254.225.221:50242] [client 65.254.225.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.221, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZyJPEC82JnxmrnFYnZEQAAAU4"]
[Sat Feb 07 06:58:46.559625 2026] [:error] [pid 50673:tid 50748] [client 65.254.225.222:50254] [client 65.254.225.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.222, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZyJmVwLsaZ7aKO2ckSQgAAAI0"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 07:01:05.749546 2026] [:error] [pid 50672:tid 50709] [client 209.59.172.182:45544] [client 209.59.172.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.59.172.182, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZysQ9o0jq1XS8Nv7OY6AAAAEE"]
[Sat Feb 07 07:01:06.737864 2026] [:error] [pid 50672:tid 50723] [client 209.59.172.182:45544] [client 209.59.172.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.59.172.182, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZysg9o0jq1XS8Nv7OY6QAAAE8"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 07:02:16.447810 2026] [:error] [pid 50780:tid 50801] [client 148.66.157.16:36694] [client 148.66.157.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.66.157.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZy-OtUmIu2JHM2Cru-7wAAANM"]
[Sat Feb 07 07:02:17.524852 2026] [:error] [pid 50780:tid 50793] [client 148.66.157.16:36694] [client 148.66.157.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.66.157.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZy-etUmIu2JHM2Cru-8AAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 07:10:37.503241 2026] [:error] [pid 55157:tid 55186] [client 103.178.234.11:40878] [client 103.178.234.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.178.234.11, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ07X36JdtTn2bTEowDYwAAARg"]
[Sat Feb 07 07:10:39.772491 2026] [:error] [pid 50673:tid 50738] [client 103.178.234.11:40888] [client 103.178.234.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.178.234.11, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ072VwLsaZ7aKO2ckWLAAAAIM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 07:22:52.947145 2026] [:error] [pid 50672:tid 50730] [client 173.231.197.185:37200] [client 173.231.197.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.231.197.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ3zA9o0jq1XS8Nv7OebAAAAFY"]
[Sat Feb 07 07:22:55.267633 2026] [:error] [pid 43182:tid 43186] [client 173.231.197.185:41712] [client 173.231.197.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.231.197.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ3z_EC82JnxmrnFYnlHgAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 07:28:03.952454 2026] [:error] [pid 50673:tid 50758] [client 107.180.114.83:11944] [client 107.180.114.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.114.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ5A2VwLsaZ7aKO2ckb-wAAAJc"]
[Sat Feb 07 07:28:05.937604 2026] [:error] [pid 55157:tid 55164] [client 107.180.114.83:11948] [client 107.180.114.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.114.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ5BX36JdtTn2bTEowJ5QAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 07:31:07.774059 2026] [:error] [pid 50780:tid 50798] [client 65.181.116.151:38514] [client 65.181.116.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.181.116.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ5u-tUmIu2JHM2CrvH5AAAANA"]
[Sat Feb 07 07:31:08.785259 2026] [:error] [pid 50780:tid 50792] [client 65.181.116.151:38514] [client 65.181.116.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.181.116.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ5vOtUmIu2JHM2CrvH5QAAAMo"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 07:33:22.971294 2026] [:error] [pid 43182:tid 43187] [client 152.53.90.232:39838] [client 152.53.90.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.53.90.232, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ6QvEC82JnxmrnFYnqqQAAAUM"]
[Sat Feb 07 07:33:23.930354 2026] [:error] [pid 43182:tid 43190] [client 152.53.90.232:39838] [client 152.53.90.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.53.90.232, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ6Q_EC82JnxmrnFYnqqgAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 07:38:22.570479 2026] [:error] [pid 50672:tid 50720] [client 177.131.140.128:55198] [client 177.131.140.128] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 177.131.140.128, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ7bg9o0jq1XS8Nv7OjygAAAEw"]
[Sat Feb 07 07:38:24.175509 2026] [:error] [pid 50672:tid 50715] [client 177.131.140.128:55198] [client 177.131.140.128] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 177.131.140.128, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ7cA9o0jq1XS8Nv7OjywAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 07:42:12.530003 2026] [:error] [pid 50672:tid 50717] [client 103.13.103.146:47586] [client 103.13.103.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.13.103.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ8VA9o0jq1XS8Nv7Ok3QAAAEk"]
[Sat Feb 07 07:42:13.447789 2026] [:error] [pid 50672:tid 50732] [client 103.13.103.146:47586] [client 103.13.103.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.13.103.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ8VQ9o0jq1XS8Nv7Ok4AAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 07:47:03.996531 2026] [:error] [pid 50780:tid 50804] [client 103.69.196.26:54462] [client 103.69.196.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.69.196.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ9d-tUmIu2JHM2CrvMjgAAANY"]
[Sat Feb 07 07:47:05.118144 2026] [:error] [pid 50780:tid 50806] [client 103.69.196.26:54462] [client 103.69.196.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.69.196.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ9eetUmIu2JHM2CrvMkAAAANg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 07:52:45.506341 2026] [:error] [pid 50780:tid 50791] [client 78.46.39.162:33564] [client 78.46.39.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.46.39.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ-zetUmIu2JHM2CrvOrwAAAMk"]
[Sat Feb 07 07:52:47.458611 2026] [:error] [pid 43182:tid 43206] [client 78.46.39.162:33570] [client 78.46.39.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.46.39.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ-z_EC82JnxmrnFYn0DAAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 07:53:18.027216 2026] [:error] [pid 43182:tid 43192] [client 148.66.157.16:35182] [client 148.66.157.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.66.157.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ-7vEC82JnxmrnFYn0UAAAAUg"]
[Sat Feb 07 07:53:19.127282 2026] [:error] [pid 43182:tid 43205] [client 148.66.157.16:35182] [client 148.66.157.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.66.157.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ-7_EC82JnxmrnFYn0VQAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 07:54:13.959974 2026] [:error] [pid 50673:tid 50742] [client 185.221.174.225:45624] [client 185.221.174.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.221.174.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ_JWVwLsaZ7aKO2ckkdwAAAIc"]
[Sat Feb 07 07:54:15.866752 2026] [:error] [pid 50673:tid 50743] [client 185.221.174.225:45624] [client 185.221.174.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.221.174.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ_J2VwLsaZ7aKO2ckkfAAAAIg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 07:56:38.212322 2026] [:error] [pid 55157:tid 55180] [client 190.107.177.244:46522] [client 190.107.177.244] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.107.177.244, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ_tn36JdtTn2bTEowV0wAAARI"]
[Sat Feb 07 07:56:39.498580 2026] [:error] [pid 55157:tid 55182] [client 190.107.177.244:46522] [client 190.107.177.244] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.107.177.244, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ_t336JdtTn2bTEowV1wAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 07:57:10.924707 2026] [:error] [pid 50672:tid 50708] [client 132.148.217.253:44850] [client 132.148.217.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 132.148.217.253, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ_1g9o0jq1XS8Nv7Oo7gAAAEA"]
[Sat Feb 07 07:57:12.894597 2026] [:error] [pid 43182:tid 43190] [client 132.148.217.253:44856] [client 132.148.217.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 132.148.217.253, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYZ_2PEC82JnxmrnFYn2WAAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 08:02:39.054198 2026] [:error] [pid 50671:tid 50684] [client 65.21.208.253:49662] [client 65.21.208.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.21.208.253, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaBH7vqLohWBI_mqBMK_wAAAAQ"]
[Sat Feb 07 08:02:40.302176 2026] [:error] [pid 50671:tid 50680] [client 65.21.208.253:49662] [client 65.21.208.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.21.208.253, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaBILvqLohWBI_mqBMLAAAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 08:10:38.369835 2026] [:error] [pid 50671:tid 50687] [client 103.13.103.146:55952] [client 103.13.103.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.13.103.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaC_rvqLohWBI_mqBMNCQAAAAc"]
[Sat Feb 07 08:10:39.355237 2026] [:error] [pid 50671:tid 50696] [client 103.13.103.146:55952] [client 103.13.103.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.13.103.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaC_7vqLohWBI_mqBMNCwAAABA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 08:10:49.934419 2026] [:error] [pid 55157:tid 55185] [client 208.109.71.211:32860] [client 208.109.71.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.71.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaDCX36JdtTn2bTEowaewAAARc"]
[Sat Feb 07 08:10:51.839006 2026] [:error] [pid 50673:tid 50740] [client 208.109.71.211:32866] [client 208.109.71.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.71.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaDC2VwLsaZ7aKO2ckpMwAAAIU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 08:11:24.064616 2026] [:error] [pid 43182:tid 43208] [client 103.13.103.146:38504] [client 103.13.103.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.13.103.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaDLPEC82JnxmrnFYn7uAAAAVg"]
[Sat Feb 07 08:11:25.418505 2026] [:error] [pid 43182:tid 43186] [client 103.13.103.146:38504] [client 103.13.103.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.13.103.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaDLfEC82JnxmrnFYn7uQAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 08:13:03.201565 2026] [:error] [pid 50671:tid 50682] [client 102.213.180.5:38380] [client 102.213.180.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 102.213.180.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaDj7vqLohWBI_mqBMN-gAAAAI"]
[Sat Feb 07 08:13:06.122251 2026] [:error] [pid 50780:tid 50787] [client 102.213.180.5:52280] [client 102.213.180.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 102.213.180.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaDkutUmIu2JHM2CrvU0gAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 08:18:19.460238 2026] [:error] [pid 50673:tid 50740] [client 103.74.116.253:38704] [client 103.74.116.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.74.116.253, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaEy2VwLsaZ7aKO2ckqpAAAAIU"]
[Sat Feb 07 08:18:20.835273 2026] [:error] [pid 50673:tid 50758] [client 103.74.116.253:38704] [client 103.74.116.253] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.74.116.253, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaEzGVwLsaZ7aKO2ckqpQAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 08:19:14.011174 2026] [:error] [pid 50671:tid 50688] [client 92.205.20.61:44922] [client 92.205.20.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.20.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaFArvqLohWBI_mqBMPagAAAAg"]
[Sat Feb 07 08:19:16.097814 2026] [:error] [pid 50671:tid 50703] [client 92.205.20.61:44922] [client 92.205.20.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.20.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaFBLvqLohWBI_mqBMPcgAAABc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 08:24:11.042208 2026] [:error] [pid 55157:tid 55173] [client 154.62.226.86:56120] [client 154.62.226.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.62.226.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaGK336JdtTn2bTEowemQAAAQs"]
[Sat Feb 07 08:24:13.451594 2026] [:error] [pid 50780:tid 50800] [client 154.62.226.86:56124] [client 154.62.226.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.62.226.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaGLetUmIu2JHM2CrvYXAAAANI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 08:29:18.179959 2026] [:error] [pid 50671:tid 50698] [client 209.235.136.138:34140] [client 209.235.136.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaHXrvqLohWBI_mqBMSGAAAABI"]
[Sat Feb 07 08:29:21.334640 2026] [:error] [pid 55157:tid 55180] [client 209.235.136.138:34154] [client 209.235.136.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaHYX36JdtTn2bTEowhIwAAARI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 08:29:23.153316 2026] [:error] [pid 50672:tid 50726] [client 209.59.172.182:42020] [client 209.59.172.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.59.172.182, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaHYw9o0jq1XS8Nv7OwnAAAAFI"]
[Sat Feb 07 08:30:14.029729 2026] [:error] [pid 50673:tid 50742] [client 45.77.246.163:47960] [client 45.77.246.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.77.246.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaHlmVwLsaZ7aKO2cktuwAAAIc"]
[Sat Feb 07 08:30:15.614918 2026] [:error] [pid 50673:tid 50740] [client 45.77.246.163:47960] [client 45.77.246.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.77.246.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaHl2VwLsaZ7aKO2cktvAAAAIU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 08:31:13.725620 2026] [:error] [pid 50673:tid 50753] [client 152.53.90.232:48460] [client 152.53.90.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.53.90.232, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaH0WVwLsaZ7aKO2ckuJAAAAJI"]
[Sat Feb 07 08:31:15.579125 2026] [:error] [pid 50673:tid 50735] [client 152.53.90.232:48460] [client 152.53.90.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.53.90.232, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaH02VwLsaZ7aKO2ckuJgAAAIA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 08:32:50.486628 2026] [:error] [pid 50671:tid 50690] [client 51.222.158.107:43888] [client 51.222.158.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.222.158.107, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaIMrvqLohWBI_mqBMTIAAAAAo"]
[Sat Feb 07 08:32:51.577110 2026] [:error] [pid 50671:tid 50692] [client 51.222.158.107:43888] [client 51.222.158.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.222.158.107, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaIM7vqLohWBI_mqBMTKgAAAAw"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 08:36:06.942489 2026] [:error] [pid 50673:tid 50738] [client 43.159.144.16:60124] [client 43.159.144.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYaI9mVwLsaZ7aKO2ckvoQAAAIM"]
[Sat Feb 07 08:37:12.469396 2026] [:error] [pid 43182:tid 43186] [client 162.0.211.226:53374] [client 162.0.211.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.211.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaJOPEC82JnxmrnFYkHDAAAAUI"]
[Sat Feb 07 08:37:25.636711 2026] [:error] [pid 43182:tid 43191] [client 162.0.211.226:51668] [client 162.0.211.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.211.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaJRfEC82JnxmrnFYkHPQAAAUc"]
[Sat Feb 07 08:37:27.487684 2026] [:error] [pid 43182:tid 43197] [client 162.0.211.226:51684] [client 162.0.211.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.211.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaJR_EC82JnxmrnFYkHSQAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 08:43:44.089456 2026] [:error] [pid 50671:tid 50691] [client 129.146.223.190:57932] [client 129.146.223.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.146.223.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaKwLvqLohWBI_mqBMWagAAAAs"]
[Sat Feb 07 08:43:45.042967 2026] [:error] [pid 50671:tid 50684] [client 129.146.223.190:57932] [client 129.146.223.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.146.223.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaKwbvqLohWBI_mqBMWawAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 08:46:06.965143 2026] [:error] [pid 43182:tid 43206] [client 192.185.131.120:25738] [client 192.185.131.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.131.120, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaLTvEC82JnxmrnFYkLKwAAAVY"]
[Sat Feb 07 08:46:09.472143 2026] [:error] [pid 43182:tid 43195] [client 192.185.131.120:25754] [client 192.185.131.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.131.120, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaLUfEC82JnxmrnFYkLMAAAAUs"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 08:47:02.551247 2026] [:error] [pid 50672:tid 50731] [client 87.229.45.179:50424] [client 87.229.45.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.229.45.179, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYaLhg9o0jq1XS8Nv7O17QAAAFc"]
[Sat Feb 07 08:47:58.171208 2026] [:error] [pid 50671:tid 50703] [client 79.184.153.195:51216] [client 79.184.153.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 79.184.153.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaLvrvqLohWBI_mqBMXKgAAABc"]
[Sat Feb 07 08:47:59.952433 2026] [:error] [pid 50671:tid 50684] [client 79.184.153.195:51216] [client 79.184.153.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 79.184.153.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaLv7vqLohWBI_mqBMXLAAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 08:48:06.575296 2026] [:error] [pid 50672:tid 50711] [client 192.185.4.70:29706] [client 192.185.4.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.4.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaLxg9o0jq1XS8Nv7O2NAAAAEM"]
[Sat Feb 07 08:48:07.461928 2026] [:error] [pid 50672:tid 50728] [client 192.185.4.70:29706] [client 192.185.4.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.4.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaLxw9o0jq1XS8Nv7O2NgAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 08:51:01.778288 2026] [:error] [pid 43182:tid 43197] [client 192.185.4.70:42022] [client 192.185.4.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.4.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaMdfEC82JnxmrnFYkMqAAAAU0"]
[Sat Feb 07 08:51:02.758879 2026] [:error] [pid 43182:tid 43189] [client 192.185.4.70:42022] [client 192.185.4.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.4.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaMdvEC82JnxmrnFYkMqQAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 08:53:28.912159 2026] [:error] [pid 50671:tid 50700] [client 173.231.197.185:51188] [client 173.231.197.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.231.197.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaNCLvqLohWBI_mqBMYLQAAABQ"]
[Sat Feb 07 08:53:29.882046 2026] [:error] [pid 50671:tid 50703] [client 173.231.197.185:51188] [client 173.231.197.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.231.197.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaNCbvqLohWBI_mqBMYLwAAABc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 08:56:38.386236 2026] [:error] [pid 55157:tid 55183] [client 45.77.246.163:35264] [client 45.77.246.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.77.246.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaNxn36JdtTn2bTEowqJwAAARU"]
[Sat Feb 07 08:56:39.770816 2026] [:error] [pid 55157:tid 55185] [client 45.77.246.163:35264] [client 45.77.246.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.77.246.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaNx336JdtTn2bTEowqKAAAARc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 08:58:24.625140 2026] [:error] [pid 43182:tid 43187] [client 50.6.43.14:20220] [client 50.6.43.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.43.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaOMPEC82JnxmrnFYkPZQAAAUM"]
[Sat Feb 07 08:58:29.359258 2026] [:error] [pid 43182:tid 43191] [client 50.6.43.14:20220] [client 50.6.43.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.43.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaONfEC82JnxmrnFYkPcAAAAUc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 09:00:03.367247 2026] [:error] [pid 55157:tid 55163] [client 63.250.44.53:38306] [client 63.250.44.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.44.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaOk336JdtTn2bTEowrZQAAAQE"]
[Sat Feb 07 09:00:04.329748 2026] [:error] [pid 55157:tid 55185] [client 63.250.44.53:38306] [client 63.250.44.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.44.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaOlH36JdtTn2bTEowraAAAARc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 09:01:27.887661 2026] [:error] [pid 50671:tid 50699] [client 5.180.107.178:41776] [client 5.180.107.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.180.107.178, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaO57vqLohWBI_mqBMahwAAABM"]
[Sat Feb 07 09:01:28.907396 2026] [:error] [pid 50671:tid 50704] [client 5.180.107.178:41776] [client 5.180.107.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.180.107.178, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaO6LvqLohWBI_mqBMaiAAAABg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 09:01:40.501060 2026] [:error] [pid 55157:tid 55168] [client 54.255.216.38:41442] [client 54.255.216.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.255.216.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaO9H36JdtTn2bTEowrwAAAAQY"]
[Sat Feb 07 09:01:42.318290 2026] [:error] [pid 55157:tid 55170] [client 54.255.216.38:41442] [client 54.255.216.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.255.216.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaO9n36JdtTn2bTEowrwgAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 09:02:30.640588 2026] [:error] [pid 55157:tid 55172] [client 192.185.131.120:42328] [client 192.185.131.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.131.120, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaPJn36JdtTn2bTEowsMQAAAQo"]
[Sat Feb 07 09:02:32.585132 2026] [:error] [pid 55157:tid 55180] [client 192.185.131.120:42328] [client 192.185.131.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.131.120, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaPKH36JdtTn2bTEowsMgAAARI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 09:06:57.123467 2026] [:error] [pid 50673:tid 50756] [client 220.158.234.70:55034] [client 220.158.234.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 220.158.234.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaQMWVwLsaZ7aKO2ck4PQAAAJU"]
[Sat Feb 07 09:06:58.134721 2026] [:error] [pid 50673:tid 50745] [client 220.158.234.70:55034] [client 220.158.234.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 220.158.234.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaQMmVwLsaZ7aKO2ck4PgAAAIo"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 09:15:53.804410 2026] [:error] [pid 55157:tid 55164] [client 67.231.26.222:49664] [client 67.231.26.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.231.26.222, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaSSX36JdtTn2bTEowxNAAAAQI"]
[Sat Feb 07 09:15:55.881579 2026] [:error] [pid 55157:tid 55182] [client 67.231.26.222:49664] [client 67.231.26.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.231.26.222, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaSS336JdtTn2bTEowxNwAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 09:18:06.399489 2026] [:error] [pid 50671:tid 50699] [client 103.154.176.224:55656] [client 103.154.176.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.154.176.224, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaSzrvqLohWBI_mqBMdjwAAABM"]
[Sat Feb 07 09:18:07.978777 2026] [:error] [pid 50671:tid 50697] [client 103.154.176.224:55656] [client 103.154.176.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.154.176.224, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaSz7vqLohWBI_mqBMdkgAAABE"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 09:21:23.639265 2026] [:error] [pid 43182:tid 43186] [client 49.247.31.241:25790] [client 49.247.31.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 49.247.31.241, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaTk_EC82JnxmrnFYkYtgAAAUI"]
[Sat Feb 07 09:21:24.995633 2026] [:error] [pid 43182:tid 43195] [client 49.247.31.241:25790] [client 49.247.31.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 49.247.31.241, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaTlPEC82JnxmrnFYkYuwAAAUs"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 09:24:30.463536 2026] [:error] [pid 50671:tid 50692] [client 51.222.158.107:42180] [client 51.222.158.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.222.158.107, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaUTrvqLohWBI_mqBMfdwAAAAw"]
[Sat Feb 07 09:24:32.559779 2026] [:error] [pid 50671:tid 50682] [client 51.222.158.107:42180] [client 51.222.158.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.222.158.107, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaUULvqLohWBI_mqBMfegAAAAI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 09:25:10.438619 2026] [:error] [pid 50780:tid 50805] [client 20.219.105.83:20776] [client 20.219.105.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.219.105.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaUdutUmIu2JHM2CrvnAwAAANc"]
[Sat Feb 07 09:25:11.353591 2026] [:error] [pid 50780:tid 50784] [client 20.219.105.83:20776] [client 20.219.105.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.219.105.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaUd-tUmIu2JHM2CrvnBAAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 09:27:43.703675 2026] [:error] [pid 50671:tid 50695] [client 50.6.7.129:55452] [client 50.6.7.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.7.129, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaVD7vqLohWBI_mqBMgHgAAAA8"]
[Sat Feb 07 09:27:44.762492 2026] [:error] [pid 50671:tid 50689] [client 50.6.7.129:55452] [client 50.6.7.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.7.129, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaVELvqLohWBI_mqBMgHwAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 09:31:20.495133 2026] [:error] [pid 43182:tid 43192] [client 5.180.107.178:59190] [client 5.180.107.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.180.107.178, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaV6PEC82JnxmrnFYkcaQAAAUg"]
[Sat Feb 07 09:31:21.494114 2026] [:error] [pid 43182:tid 43204] [client 5.180.107.178:59190] [client 5.180.107.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.180.107.178, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaV6fEC82JnxmrnFYkcbQAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 09:32:58.564246 2026] [:error] [pid 50672:tid 50726] [client 69.49.241.51:34376] [client 69.49.241.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.241.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaWSg9o0jq1XS8Nv7PA7wAAAFI"]
[Sat Feb 07 09:33:02.394732 2026] [:error] [pid 50672:tid 50721] [client 69.49.241.51:34376] [client 69.49.241.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.241.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaWTg9o0jq1XS8Nv7PA8gAAAE0"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 09:37:06.518113 2026] [:error] [pid 55157:tid 55180] [client 65.254.225.218:43620] [client 65.254.225.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaXQn36JdtTn2bTEow4RwAAARI"]
[Sat Feb 07 09:37:07.597637 2026] [:error] [pid 55157:tid 55162] [client 65.254.225.218:43620] [client 65.254.225.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaXQ336JdtTn2bTEow4VAAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 09:42:48.974152 2026] [:error] [pid 58058:tid 58067] [client 132.148.179.195:16070] [client 132.148.179.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 132.148.179.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaYmLz-Qlvs65S4DP-BowAAAYY"]
[Sat Feb 07 09:42:49.934140 2026] [:error] [pid 58058:tid 58069] [client 132.148.179.195:16070] [client 132.148.179.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 132.148.179.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYaYmbz-Qlvs65S4DP-BpAAAAYg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 09:47:50.501670 2026] [:error] [pid 50780:tid 50789] [client 132.148.121.208:57871] [client 132.148.121.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.121.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYaZxutUmIu2JHM2CrvsugAAAMc"]
[Sat Feb 07 09:47:56.788169 2026] [:error] [pid 50672:tid 50726] [client 47.236.10.255:34950] [client 47.236.10.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.236.10.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYaZzA9o0jq1XS8Nv7PE-gAAAFI"]
[Sat Feb 07 09:47:59.985602 2026] [:error] [pid 43182:tid 43203] [client 193.202.110.33:53156] [client 193.202.110.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.202.110.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYaZz_EC82JnxmrnFYki0wAAAVM"]
[Sat Feb 07 09:48:18.902620 2026] [:error] [pid 50673:tid 50745] [client 45.204.193.61:50450] [client 45.204.193.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.204.193.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYaZ4mVwLsaZ7aKO2clEiQAAAIo"]
[Sat Feb 07 09:48:42.440563 2026] [:error] [pid 43182:tid 43196] [client 162.0.213.109:48398] [client 162.0.213.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.0.213.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYaZ-vEC82JnxmrnFYkjCgAAAUw"]
[Sat Feb 07 09:48:48.360401 2026] [:error] [pid 50780:tid 50805] [client 31.177.95.217:54046] [client 31.177.95.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.177.95.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYaaAOtUmIu2JHM2CrvtIgAAANc"]
[Sat Feb 07 09:48:50.982290 2026] [:error] [pid 50780:tid 50787] [client 118.27.125.50:43414] [client 118.27.125.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.27.125.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYaaAutUmIu2JHM2CrvtJgAAAMU"]
[Sat Feb 07 09:48:52.214886 2026] [:error] [pid 50673:tid 50756] [client 195.88.82.88:54223] [client 195.88.82.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.88.82.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYaaBGVwLsaZ7aKO2clE8AAAAJU"]
[Sat Feb 07 09:53:26.807452 2026] [:error] [pid 50671:tid 50687] [client 51.255.148.60:40532] [client 51.255.148.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.255.148.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYabFrvqLohWBI_mqBMm0AAAAAc"]
[Sat Feb 07 09:53:27.715420 2026] [:error] [pid 50671:tid 50691] [client 51.255.148.60:40532] [client 51.255.148.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.255.148.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYabF7vqLohWBI_mqBMm0wAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 09:57:20.345309 2026] [:error] [pid 55157:tid 55180] [client 38.49.208.84:51182] [client 38.49.208.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.49.208.84, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYacAH36JdtTn2bTEow-RwAAARI"]
[Sat Feb 07 09:57:21.287275 2026] [:error] [pid 55157:tid 55177] [client 38.49.208.84:51182] [client 38.49.208.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.49.208.84, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYacAX36JdtTn2bTEow-SgAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 10:24:12.455326 2026] [:error] [pid 50672:tid 50731] [client 109.74.14.122:53904] [client 109.74.14.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.74.14.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYaiTA9o0jq1XS8Nv7PMnwAAAFc"]
[Sat Feb 07 11:07:15.046471 2026] [:error] [pid 55157:tid 55184] [client 91.134.77.234:54888] [client 91.134.77.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.134.77.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYasY336JdtTn2bTEoxMSQAAARY"]
[Sat Feb 07 11:23:00.397889 2026] [:error] [pid 50673:tid 50739] [client 209.235.136.139:53486] [client 209.235.136.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYawFGVwLsaZ7aKO2cljvQAAAIQ"]
[Sat Feb 07 11:23:01.539367 2026] [:error] [pid 50673:tid 50749] [client 209.235.136.139:53486] [client 209.235.136.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYawFWVwLsaZ7aKO2cljwQAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 11:55:57.404215 2026] [:error] [pid 50672:tid 50722] [client 68.178.245.211:56264] [client 68.178.245.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.245.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYa3zQ9o0jq1XS8Nv7PbKQAAAE4"]
[Sat Feb 07 11:55:59.308005 2026] [:error] [pid 55157:tid 55164] [client 68.178.245.211:56266] [client 68.178.245.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.245.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYa3z336JdtTn2bTEoxUsgAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 11:59:03.739613 2026] [:error] [pid 43182:tid 43206] [client 118.139.181.124:53776] [client 118.139.181.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 118.139.181.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYa4h_EC82JnxmrnFYk8dwAAAVY"]
[Sat Feb 07 11:59:04.687609 2026] [:error] [pid 43182:tid 43196] [client 118.139.181.124:53776] [client 118.139.181.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 118.139.181.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYa4iPEC82JnxmrnFYk8eAAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 12:13:47.798175 2026] [:error] [pid 43182:tid 43195] [client 1.55.92.108:52677] [client 1.55.92.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 1.55.92.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYa7-_EC82JnxmrnFYk_rwAAAUs"]
[Sat Feb 07 12:18:08.593279 2026] [:error] [pid 58058:tid 58074] [client 43.135.211.148:55892] [client 43.135.211.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYa9ALz-Qlvs65S4DP-izwAAAY0"]
[Sat Feb 07 12:24:43.486560 2026] [:error] [pid 50673:tid 50742] [client 209.235.136.139:43618] [client 209.235.136.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYa-i2VwLsaZ7aKO2cl3SwAAAIc"]
[Sat Feb 07 12:24:47.873928 2026] [:error] [pid 50673:tid 50751] [client 209.235.136.139:43618] [client 209.235.136.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYa-j2VwLsaZ7aKO2cl3TwAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 12:32:38.044517 2026] [:error] [pid 50671:tid 50695] [client 203.86.122.1:37316] [client 203.86.122.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.86.122.1, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYbAZrvqLohWBI_mqBNBRQAAAA8"]
[Sat Feb 07 12:32:39.397978 2026] [:error] [pid 50671:tid 50688] [client 203.86.122.1:37316] [client 203.86.122.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.86.122.1, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYbAZ7vqLohWBI_mqBNBRgAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 13:25:46.118463 2026] [:error] [pid 55157:tid 55184] [client 109.234.164.171:45584] [client 109.234.164.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.234.164.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYbM2n36JdtTn2bTEoxn-wAAARY"]
[Sat Feb 07 13:48:49.380755 2026] [:error] [pid 50780:tid 50792] [client 198.12.233.112:46832] [client 198.12.233.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.12.233.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYbSQetUmIu2JHM2CrsqDwAAAMo"]
[Sat Feb 07 14:13:23.321882 2026] [:error] [pid 50780:tid 50782] [client 89.43.17.214:34556] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYbYA-tUmIu2JHM2Crs17gAAAMA"]
[Sat Feb 07 14:13:27.008042 2026] [:error] [pid 50671:tid 50687] [client 192.64.117.254:56580] [client 192.64.117.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.64.117.254, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYbYB7vqLohWBI_mqBNVbQAAAAc"]
[Sat Feb 07 14:13:33.456833 2026] [:error] [pid 50780:tid 50799] [client 34.63.109.236:56452] [client 34.63.109.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.63.109.236, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYbYDetUmIu2JHM2Crs2GwAAANE"]
[Sat Feb 07 14:13:46.642702 2026] [:error] [pid 58058:tid 58075] [client 154.219.104.78:53918] [client 154.219.104.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.219.104.78, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYbYGrz-Qlvs65S4DP-_9AAAAY4"]
[Sat Feb 07 14:13:49.161912 2026] [:error] [pid 58058:tid 58078] [client 8.156.67.207:57112] [client 8.156.67.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.156.67.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYbYHbz-Qlvs65S4DP-_9wAAAZE"]
[Sat Feb 07 14:14:08.920225 2026] [:error] [pid 58058:tid 58061] [client 34.45.47.34:59788] [client 34.45.47.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.45.47.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYbYMLz-Qlvs65S4DP_AAAAAAYA"]
[Sat Feb 07 14:23:28.946863 2026] [autoindex:error] [pid 50671:tid 50680] [client 5.45.77.43:57270] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 14:23:31.226697 2026] [authz_core:error] [pid 50671:tid 50692] [client 5.45.77.43:57725] AH01630: client denied by server configuration: /home/expressi/public_html/wp-content/plugins/akismet/_inc/
[Sat Feb 07 14:23:32.309256 2026] [authz_core:error] [pid 50673:tid 50742] [client 5.45.77.43:57951] AH01630: client denied by server configuration: /home/expressi/public_html/wp-content/plugins/akismet/_inc/fonts
[Sat Feb 07 14:23:33.510100 2026] [authz_core:error] [pid 50671:tid 50696] [client 5.45.77.43:58217] AH01630: client denied by server configuration: /home/expressi/public_html/wp-content/plugins/akismet/_inc/img/
[Sat Feb 07 14:23:34.955401 2026] [authz_core:error] [pid 50673:tid 50740] [client 5.45.77.43:58471] AH01630: client denied by server configuration: /home/expressi/public_html/wp-content/plugins/akismet/_inc/rtl
[Sat Feb 07 14:23:35.912418 2026] [autoindex:error] [pid 50673:tid 50756] [client 5.45.77.43:58660] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 14:23:37.232377 2026] [autoindex:error] [pid 50673:tid 50755] [client 5.45.77.43:58920] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 14:23:38.373793 2026] [autoindex:error] [pid 50780:tid 50788] [client 5.45.77.43:59148] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 14:23:39.137300 2026] [autoindex:error] [pid 50671:tid 50704] [client 5.45.77.43:59303] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 14:25:44.317983 2026] [:error] [pid 50671:tid 50690] [client 50.6.184.26:27670] [client 50.6.184.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.6.184.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYba6LvqLohWBI_mqBNXJgAAAAo"]
[Sat Feb 07 14:37:54.939805 2026] [:error] [pid 43182:tid 43187] [client 157.230.24.207:47700] [client 157.230.24.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.24.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYbdwvEC82JnxmrnFYlgywAAAUM"]
[Sat Feb 07 14:37:57.445137 2026] [:error] [pid 50780:tid 50787] [client 157.230.24.207:47704] [client 157.230.24.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.24.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYbdxetUmIu2JHM2Crs-eAAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 14:46:19.991790 2026] [:error] [pid 50671:tid 50685] [client 1.55.92.108:60426] [client 1.55.92.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 1.55.92.108, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYbfu7vqLohWBI_mqBNbNQAAAAU"]
[Sat Feb 07 14:46:23.055761 2026] [:error] [pid 50671:tid 50689] [client 1.55.92.108:60426] [client 1.55.92.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 1.55.92.108, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYbfv7vqLohWBI_mqBNbOgAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 14:47:58.646457 2026] [:error] [pid 58058:tid 58075] [client 103.179.190.187:44330] [client 103.179.190.187] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.179.190.187, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYbgHrz-Qlvs65S4DP_H1gAAAY4"]
[Sat Feb 07 14:47:59.681239 2026] [:error] [pid 58058:tid 58080] [client 103.179.190.187:44330] [client 103.179.190.187] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.179.190.187, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYbgH7z-Qlvs65S4DP_H2wAAAZM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 14:51:13.298957 2026] [:error] [pid 50671:tid 50693] [client 192.185.176.242:42646] [client 192.185.176.242] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.176.242, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYbg4bvqLohWBI_mqBNcYgAAAA0"]
[Sat Feb 07 14:51:14.275910 2026] [:error] [pid 50671:tid 50701] [client 192.185.176.242:42646] [client 192.185.176.242] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.176.242, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYbg4rvqLohWBI_mqBNcZwAAABU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 14:57:26.268545 2026] [:error] [pid 55157:tid 55181] [client 72.61.91.48:35666] [client 72.61.91.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.61.91.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYbiVn36JdtTn2bTEox8-wAAARM"]
[Sat Feb 07 15:36:20.846778 2026] [:error] [pid 50780:tid 50782] [client 162.254.34.241:42566] [client 162.254.34.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.254.34.241, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYbrdOtUmIu2JHM2CrtS-wAAAMA"]
[Sat Feb 07 15:36:22.115424 2026] [:error] [pid 50780:tid 50791] [client 162.254.34.241:42566] [client 162.254.34.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.254.34.241, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYbrdutUmIu2JHM2CrtTAAAAAMk"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 15:45:41.792735 2026] [:error] [pid 50672:tid 50711] [client 182.44.10.67:49540] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYbtpQ9o0jq1XS8Nv7MIqgAAAEM"]
[Sat Feb 07 15:48:24.001625 2026] [:error] [pid 50780:tid 50790] [client 170.249.236.27:37742] [client 170.249.236.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 170.249.236.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYbuSOtUmIu2JHM2CrtVmAAAAMg"]
[Sat Feb 07 15:48:25.014022 2026] [:error] [pid 50780:tid 50800] [client 170.249.236.27:37742] [client 170.249.236.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 170.249.236.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYbuSetUmIu2JHM2CrtVmwAAANI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 15:53:51.791391 2026] [:error] [pid 55157:tid 55180] [client 69.57.172.96:49678] [client 69.57.172.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.57.172.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYbvj336JdtTn2bTEoyG5AAAARI"]
[Sat Feb 07 15:53:52.875132 2026] [:error] [pid 55157:tid 55165] [client 69.57.172.96:49678] [client 69.57.172.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.57.172.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYbvkH36JdtTn2bTEoyG5gAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 16:01:28.517737 2026] [:error] [pid 43182:tid 43195] [client 68.183.235.102:52970] [client 68.183.235.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.183.235.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYbxWPEC82JnxmrnFYlwkAAAAUs"]
[Sat Feb 07 16:01:30.585924 2026] [:error] [pid 50673:tid 50742] [client 68.183.235.102:52978] [client 68.183.235.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.183.235.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYbxWmVwLsaZ7aKO2cm6bAAAAIc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 16:32:21.266179 2026] [:error] [pid 50671:tid 50701] [client 43.131.243.61:35030] [client 43.131.243.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYb4lbvqLohWBI_mqBNsfAAAABU"]
[Sat Feb 07 16:34:40.708441 2026] [:error] [pid 50671:tid 50681] [client 154.82.171.218:22312] [client 154.82.171.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.82.171.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb5ILvqLohWBI_mqBNsxwAAAAE"]
[Sat Feb 07 16:34:42.857134 2026] [:error] [pid 50780:tid 50805] [client 154.82.168.95:35540] [client 154.82.168.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.82.168.95, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb5IutUmIu2JHM2CrtjFAAAANc"], referer: http://expressinteriors.com/wp-login.php
[Sat Feb 07 16:34:44.657018 2026] [:error] [pid 55157:tid 55171] [client 45.206.72.14:12316] [client 45.206.72.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYb5JH36JdtTn2bTEoyPGQAAAQk"]
[Sat Feb 07 16:34:46.650637 2026] [:error] [pid 55157:tid 55183] [client 154.222.132.145:12074] [client 154.222.132.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.222.132.145, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb5Jn36JdtTn2bTEoyPHgAAARU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 16:34:46.654276 2026] [:error] [pid 55157:tid 55183] [client 154.222.132.145:12074] [client 154.222.132.145] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb5Jn36JdtTn2bTEoyPHgAAARU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 16:34:48.046091 2026] [:error] [pid 55157:tid 55185] [client 154.222.132.103:54694] [client 154.222.132.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.222.132.103, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb5KH36JdtTn2bTEoyPHwAAARc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 16:34:48.049245 2026] [:error] [pid 55157:tid 55185] [client 154.222.132.103:54694] [client 154.222.132.103] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb5KH36JdtTn2bTEoyPHwAAARc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 16:34:49.453894 2026] [:error] [pid 50673:tid 50747] [client 154.86.113.99:60338] [client 154.86.113.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.86.113.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb5KWVwLsaZ7aKO2cnCfAAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 16:34:49.457526 2026] [:error] [pid 50673:tid 50747] [client 154.86.113.99:60338] [client 154.86.113.99] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb5KWVwLsaZ7aKO2cnCfAAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 16:34:58.938950 2026] [:error] [pid 50673:tid 50753] [client 156.249.125.187:31870] [client 156.249.125.187] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.249.125.187, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb5MmVwLsaZ7aKO2cnCggAAAJI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 16:34:58.942266 2026] [:error] [pid 50673:tid 50753] [client 156.249.125.187:31870] [client 156.249.125.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb5MmVwLsaZ7aKO2cnCggAAAJI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 16:35:00.908466 2026] [:error] [pid 58058:tid 58084] [client 156.239.201.149:21420] [client 156.239.201.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.201.149, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb5NLz-Qlvs65S4DP_gVgAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 16:35:00.913206 2026] [:error] [pid 58058:tid 58084] [client 156.239.201.149:21420] [client 156.239.201.149] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb5NLz-Qlvs65S4DP_gVgAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 16:36:15.210851 2026] [:error] [pid 50780:tid 50797] [client 68.178.245.211:51598] [client 68.178.245.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.245.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb5f-tUmIu2JHM2CrtjxQAAAM8"]
[Sat Feb 07 16:36:16.132904 2026] [:error] [pid 50780:tid 50786] [client 68.178.245.211:51598] [client 68.178.245.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.245.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb5gOtUmIu2JHM2CrtjywAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 16:37:06.769254 2026] [:error] [pid 43182:tid 43184] [client 65.254.225.221:36740] [client 65.254.225.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.221, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb5svEC82JnxmrnFYl3mgAAAUA"]
[Sat Feb 07 16:37:07.739057 2026] [:error] [pid 43182:tid 43203] [client 65.254.225.221:36740] [client 65.254.225.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.221, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb5s_EC82JnxmrnFYl3nAAAAVM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 16:37:31.556241 2026] [:error] [pid 55157:tid 55172] [client 107.180.115.201:50876] [client 107.180.115.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.115.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb5y336JdtTn2bTEoyPfwAAAQo"]
[Sat Feb 07 16:37:32.460518 2026] [:error] [pid 55157:tid 55176] [client 107.180.115.201:50876] [client 107.180.115.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.115.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb5zH36JdtTn2bTEoyPgAAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 16:38:04.017229 2026] [:error] [pid 55157:tid 55170] [client 209.235.136.139:50252] [client 209.235.136.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb57H36JdtTn2bTEoyPoAAAAQg"]
[Sat Feb 07 16:38:05.321918 2026] [:error] [pid 55157:tid 55167] [client 209.235.136.139:50252] [client 209.235.136.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb57X36JdtTn2bTEoyPpAAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 16:46:29.190822 2026] [:error] [pid 50671:tid 50683] [client 109.234.162.233:40416] [client 109.234.162.233] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.234.162.233, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb75bvqLohWBI_mqBNu7gAAAAM"]
[Sat Feb 07 16:46:30.120203 2026] [:error] [pid 50671:tid 50684] [client 109.234.162.233:40416] [client 109.234.162.233] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.234.162.233, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb75rvqLohWBI_mqBNu7wAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 16:48:17.127108 2026] [:error] [pid 50780:tid 50796] [client 216.69.162.185:59696] [client 216.69.162.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.69.162.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb8UetUmIu2JHM2CrtnowAAAM4"]
[Sat Feb 07 16:48:18.042193 2026] [:error] [pid 50780:tid 50791] [client 216.69.162.185:59696] [client 216.69.162.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.69.162.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb8UutUmIu2JHM2CrtnpQAAAMk"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 17:01:31.311238 2026] [:error] [pid 50673:tid 50745] [client 185.135.241.112:47674] [client 185.135.241.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.135.241.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb_a2VwLsaZ7aKO2cnKNgAAAIo"]
[Sat Feb 07 17:01:34.163452 2026] [:error] [pid 50673:tid 50746] [client 185.135.241.112:47674] [client 185.135.241.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.135.241.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYb_bmVwLsaZ7aKO2cnKOQAAAIs"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 17:04:02.753110 2026] [:error] [pid 50672:tid 50711] [client 103.191.241.242:47828] [client 103.191.241.242] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.191.241.242, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcAAg9o0jq1XS8Nv7MVOAAAAEM"]
[Sat Feb 07 17:04:03.896120 2026] [:error] [pid 50672:tid 50728] [client 103.191.241.242:47828] [client 103.191.241.242] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.191.241.242, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcAAw9o0jq1XS8Nv7MVOgAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 17:16:11.034034 2026] [:error] [pid 55157:tid 55171] [client 82.223.116.42:52334] [client 82.223.116.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.116.42, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcC2336JdtTn2bTEoyYXgAAAQk"]
[Sat Feb 07 17:16:12.122700 2026] [:error] [pid 55157:tid 55165] [client 82.223.116.42:52334] [client 82.223.116.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.116.42, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcC3H36JdtTn2bTEoyYYAAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 17:17:17.346605 2026] [:error] [pid 50672:tid 50714] [client 109.234.162.233:34114] [client 109.234.162.233] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.234.162.233, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcDHQ9o0jq1XS8Nv7MXlAAAAEY"]
[Sat Feb 07 17:17:18.248871 2026] [:error] [pid 50672:tid 50712] [client 109.234.162.233:34114] [client 109.234.162.233] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.234.162.233, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcDHg9o0jq1XS8Nv7MXmAAAAEQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 17:23:54.216626 2026] [:error] [pid 50671:tid 50695] [client 50.62.201.28:26730] [client 50.62.201.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.201.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcEqrvqLohWBI_mqBN4egAAAA8"]
[Sat Feb 07 17:23:55.449851 2026] [:error] [pid 50671:tid 50680] [client 50.62.201.28:26730] [client 50.62.201.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.201.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcEq7vqLohWBI_mqBN4fQAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 17:24:38.177620 2026] [:error] [pid 50672:tid 50715] [client 91.134.77.234:12463] [client 91.134.77.234] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.134.77.234, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcE1g9o0jq1XS8Nv7MZNwAAAEc"]
[Sat Feb 07 17:28:46.937436 2026] [:error] [pid 58058:tid 58067] [client 107.180.117.104:63932] [client 107.180.117.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.117.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcFzrz-Qlvs65S4DP_vdAAAAYY"]
[Sat Feb 07 17:28:47.852418 2026] [:error] [pid 58058:tid 58068] [client 107.180.117.104:63932] [client 107.180.117.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.117.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcFz7z-Qlvs65S4DP_vdgAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 17:55:39.970603 2026] [:error] [pid 58058:tid 58063] [client 103.160.153.11:52460] [client 103.160.153.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.160.153.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYcMG7z-Qlvs65S4DP_1iwAAAYI"]
[Sat Feb 07 17:55:46.640382 2026] [:error] [pid 50673:tid 50747] [client 34.45.47.34:36948] [client 34.45.47.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.45.47.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYcMImVwLsaZ7aKO2cnZMQAAAIw"]
[Sat Feb 07 17:55:55.579664 2026] [:error] [pid 50672:tid 50715] [client 103.108.220.125:49751] [client 103.108.220.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.108.220.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYcMKw9o0jq1XS8Nv7MfZwAAAEc"]
[Sat Feb 07 17:56:04.279101 2026] [:error] [pid 58058:tid 58071] [client 193.202.110.29:51090] [client 193.202.110.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.202.110.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYcMNLz-Qlvs65S4DP_1pQAAAYo"]
[Sat Feb 07 17:56:08.012428 2026] [:error] [pid 43182:tid 43208] [client 132.148.121.208:64678] [client 132.148.121.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 132.148.121.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYcMOPEC82JnxmrnFYmKnQAAAVg"]
[Sat Feb 07 17:56:54.410378 2026] [:error] [pid 58058:tid 58077] [client 34.55.134.91:39658] [client 34.55.134.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.55.134.91, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYcMZrz-Qlvs65S4DP_2BQAAAZA"]
[Sat Feb 07 17:57:04.875165 2026] [:error] [pid 58058:tid 58076] [client 103.69.96.39:36110] [client 103.69.96.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.69.96.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYcMcLz-Qlvs65S4DP_2FAAAAY8"]
[Sat Feb 07 18:06:21.532958 2026] [:error] [pid 55157:tid 55181] [client 162.254.34.241:54090] [client 162.254.34.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.254.34.241, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcOnX36JdtTn2bTEoykngAAARM"]
[Sat Feb 07 18:06:22.532683 2026] [:error] [pid 55157:tid 55168] [client 162.254.34.241:54090] [client 162.254.34.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.254.34.241, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcOnn36JdtTn2bTEoyknwAAAQY"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 18:08:50.608444 2026] [:error] [pid 55157:tid 55167] [client 82.223.116.42:36382] [client 82.223.116.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.116.42, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcPMn36JdtTn2bTEoyk9AAAAQU"]
[Sat Feb 07 18:08:51.808844 2026] [:error] [pid 55157:tid 55166] [client 82.223.116.42:36382] [client 82.223.116.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.116.42, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcPM336JdtTn2bTEoyk-AAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 18:12:46.188758 2026] [:error] [pid 50780:tid 50787] [client 107.136.207.122:43424] [client 107.136.207.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.136.207.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcQHutUmIu2JHM2CruGpwAAAMU"]
[Sat Feb 07 18:12:50.777668 2026] [:error] [pid 50780:tid 50805] [client 107.136.207.122:43424] [client 107.136.207.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.136.207.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcQIutUmIu2JHM2CruGtgAAANc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 18:14:48.655232 2026] [:error] [pid 58058:tid 58074] [client 129.146.223.190:48296] [client 129.146.223.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.146.223.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcQmLz-Qlvs65S4DP_5OQAAAY0"]
[Sat Feb 07 18:14:49.644520 2026] [:error] [pid 58058:tid 58063] [client 129.146.223.190:48296] [client 129.146.223.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.146.223.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcQmbz-Qlvs65S4DP_5OwAAAYI"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 18:18:09.640876 2026] [:error] [pid 58058:tid 58077] [client 107.180.118.255:63522] [client 107.180.118.255] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.118.255, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcRYbz-Qlvs65S4DP_56wAAAZA"]
[Sat Feb 07 18:18:10.612645 2026] [:error] [pid 58058:tid 58080] [client 107.180.118.255:63522] [client 107.180.118.255] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.118.255, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcRYrz-Qlvs65S4DP_57AAAAZM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 18:25:13.878708 2026] [:error] [pid 50780:tid 50804] [client 162.0.224.185:47084] [client 162.0.224.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.224.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcTCetUmIu2JHM2CruKYQAAANY"]
[Sat Feb 07 18:25:15.101534 2026] [:error] [pid 50780:tid 50801] [client 162.0.224.185:47084] [client 162.0.224.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.224.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcTC-tUmIu2JHM2CruKYgAAANM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 18:34:34.860456 2026] [:error] [pid 58058:tid 58070] [client 184.168.115.88:14910] [client 184.168.115.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 184.168.115.88, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcVOrz-Qlvs65S4DP_-EQAAAYk"]
[Sat Feb 07 18:34:36.228912 2026] [:error] [pid 58058:tid 58067] [client 184.168.115.88:14910] [client 184.168.115.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 184.168.115.88, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcVPLz-Qlvs65S4DP_-FAAAAYY"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 18:38:02.309405 2026] [:error] [pid 58058:tid 58071] [client 109.234.164.171:43618] [client 109.234.164.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.234.164.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcWCrz-Qlvs65S4DP__WgAAAYo"]
[Sat Feb 07 18:38:04.416244 2026] [:error] [pid 58058:tid 58061] [client 109.234.164.171:43618] [client 109.234.164.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.234.164.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcWDLz-Qlvs65S4DP__XAAAAYA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 18:47:23.728246 2026] [:error] [pid 55157:tid 55174] [client 107.136.207.122:38506] [client 107.136.207.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.136.207.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcYO336JdtTn2bTEoytGwAAAQw"]
[Sat Feb 07 18:47:24.727410 2026] [:error] [pid 55157:tid 55172] [client 107.136.207.122:38506] [client 107.136.207.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.136.207.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcYPH36JdtTn2bTEoytHAAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 18:49:25.158272 2026] [:error] [pid 50673:tid 50745] [client 92.205.170.157:58884] [client 92.205.170.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.170.157, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcYtWVwLsaZ7aKO2cnn9wAAAIo"]
[Sat Feb 07 18:49:26.145775 2026] [:error] [pid 50673:tid 50740] [client 92.205.170.157:58884] [client 92.205.170.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.170.157, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcYtmVwLsaZ7aKO2cnn-AAAAIU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 18:56:13.402053 2026] [:error] [pid 50673:tid 50752] [client 162.241.61.250:46708] [client 162.241.61.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.61.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcaTWVwLsaZ7aKO2cnqQQAAAJE"]
[Sat Feb 07 18:56:18.368747 2026] [:error] [pid 50673:tid 50741] [client 162.241.61.250:46708] [client 162.241.61.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.61.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcaUmVwLsaZ7aKO2cnqRAAAAIY"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 18:58:38.455762 2026] [:error] [pid 50780:tid 50786] [client 43.159.149.56:34872] [client 43.159.149.56] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYca3utUmIu2JHM2CruWXgAAAMQ"]
[Sat Feb 07 19:13:07.079428 2026] [:error] [pid 58058:tid 58074] [client 69.57.172.96:49130] [client 69.57.172.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.57.172.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYceQ7z-Qlvs65S4DP8I-gAAAY0"]
[Sat Feb 07 19:13:09.043008 2026] [:error] [pid 58058:tid 58078] [client 69.57.172.96:49130] [client 69.57.172.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.57.172.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYceRbz-Qlvs65S4DP8JAQAAAZE"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 19:18:31.561635 2026] [:error] [pid 50673:tid 50743] [client 129.121.74.194:32892] [client 129.121.74.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.121.74.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcfh2VwLsaZ7aKO2cnyYQAAAIg"]
[Sat Feb 07 19:18:35.890671 2026] [:error] [pid 50673:tid 50745] [client 129.121.74.194:32892] [client 129.121.74.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.121.74.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcfi2VwLsaZ7aKO2cnyYwAAAIo"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 19:35:46.620058 2026] [:error] [pid 58058:tid 58072] [client 129.121.74.194:49914] [client 129.121.74.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.121.74.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcjkrz-Qlvs65S4DP8OlwAAAYs"]
[Sat Feb 07 19:35:47.738921 2026] [:error] [pid 58058:tid 58073] [client 129.121.74.194:49914] [client 129.121.74.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.121.74.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcjk7z-Qlvs65S4DP8OmQAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 19:50:32.124732 2026] [:error] [pid 50671:tid 50703] [client 192.185.82.235:59840] [client 192.185.82.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.82.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcnCLvqLohWBI_mqBOXVQAAABc"]
[Sat Feb 07 19:50:34.864731 2026] [:error] [pid 50671:tid 50690] [client 192.185.82.235:59840] [client 192.185.82.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.82.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcnCrvqLohWBI_mqBOXWwAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 19:54:06.860385 2026] [:error] [pid 58058:tid 58063] [client 162.241.62.137:43000] [client 162.241.62.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.62.137, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcn3rz-Qlvs65S4DP8SyQAAAYI"]
[Sat Feb 07 19:54:08.729677 2026] [:error] [pid 58058:tid 58075] [client 162.241.62.137:43000] [client 162.241.62.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.62.137, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcn4Lz-Qlvs65S4DP8SzwAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 20:04:21.699500 2026] [:error] [pid 55157:tid 55182] [client 108.179.192.140:10648] [client 108.179.192.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.179.192.140, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcqRX36JdtTn2bTEozAHgAAARQ"]
[Sat Feb 07 20:04:23.173660 2026] [:error] [pid 55157:tid 55176] [client 108.179.192.140:10648] [client 108.179.192.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.179.192.140, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcqR336JdtTn2bTEozAIgAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 20:05:01.046791 2026] [:error] [pid 55157:tid 55170] [client 198.57.247.228:16744] [client 198.57.247.228] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.57.247.228, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcqbX36JdtTn2bTEozAUAAAAQg"]
[Sat Feb 07 20:05:02.154607 2026] [:error] [pid 55157:tid 55169] [client 198.57.247.228:16744] [client 198.57.247.228] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.57.247.228, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcqbn36JdtTn2bTEozAUgAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 20:06:13.400607 2026] [:error] [pid 50671:tid 50699] [client 50.62.149.159:51522] [client 50.62.149.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.149.159, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcqtbvqLohWBI_mqBOb1QAAABM"]
[Sat Feb 07 20:06:14.320837 2026] [:error] [pid 50671:tid 50695] [client 50.62.149.159:51522] [client 50.62.149.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.149.159, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcqtrvqLohWBI_mqBOb1wAAAA8"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 20:06:26.115032 2026] [:error] [pid 55157:tid 55177] [client 198.57.247.130:42076] [client 198.57.247.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.57.247.130, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcqwn36JdtTn2bTEozAfAAAAQ8"]
[Sat Feb 07 20:06:26.989325 2026] [:error] [pid 55157:tid 55182] [client 198.57.247.130:42076] [client 198.57.247.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.57.247.130, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcqwn36JdtTn2bTEozAfQAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 20:16:52.856497 2026] [:error] [pid 50672:tid 50709] [client 143.95.158.36:34056] [client 143.95.158.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.95.158.36, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYctNA9o0jq1XS8Nv7M-lAAAAEE"]
[Sat Feb 07 20:16:56.866707 2026] [:error] [pid 50672:tid 50724] [client 143.95.158.36:34056] [client 143.95.158.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.95.158.36, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYctOA9o0jq1XS8Nv7M-lwAAAFA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 20:29:03.697159 2026] [:error] [pid 50780:tid 50793] [client 185.208.174.156:46828] [client 185.208.174.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.208.174.156, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcwD-tUmIu2JHM2Cruy0QAAAMs"]
[Sat Feb 07 20:29:05.010808 2026] [:error] [pid 50780:tid 50806] [client 185.208.174.156:46828] [client 185.208.174.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.208.174.156, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcwEetUmIu2JHM2Cruy0gAAANg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 20:37:19.677932 2026] [:error] [pid 43182:tid 43207] [client 78.135.111.25:50900] [client 78.135.111.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.135.111.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcx__EC82JnxmrnFYm54wAAAVc"]
[Sat Feb 07 20:37:20.705630 2026] [:error] [pid 43182:tid 43205] [client 78.135.111.25:50900] [client 78.135.111.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.135.111.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYcyAPEC82JnxmrnFYm56QAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 20:47:29.593533 2026] [:error] [pid 55157:tid 55178] [client 162.0.224.185:59530] [client 162.0.224.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.224.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYc0YX36JdtTn2bTEozIowAAARA"]
[Sat Feb 07 20:47:31.585682 2026] [:error] [pid 50673:tid 50738] [client 162.0.224.185:60394] [client 162.0.224.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.224.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYc0Y2VwLsaZ7aKO2ckHWQAAAIM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 20:57:24.291462 2026] [:error] [pid 55157:tid 55173] [client 195.85.19.30:15758] [client 195.85.19.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.85.19.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYc2tH36JdtTn2bTEozKvwAAAQs"]
[Sat Feb 07 20:57:28.517110 2026] [:error] [pid 55157:tid 55182] [client 195.85.19.30:15758] [client 195.85.19.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.85.19.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYc2uH36JdtTn2bTEozKwgAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 21:01:08.940612 2026] [:error] [pid 43182:tid 43192] [client 135.181.179.114:37134] [client 135.181.179.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 135.181.179.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYc3lPEC82JnxmrnFYnCrgAAAUg"]
[Sat Feb 07 21:01:09.935335 2026] [:error] [pid 43182:tid 43191] [client 135.181.179.114:37134] [client 135.181.179.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 135.181.179.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYc3lfEC82JnxmrnFYnCrwAAAUc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 21:17:20.033381 2026] [:error] [pid 58058:tid 58065] [client 69.16.200.33:53670] [client 69.16.200.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.16.200.33, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYc7YLz-Qlvs65S4DP8lngAAAYQ"]
[Sat Feb 07 21:17:23.386258 2026] [:error] [pid 58058:tid 58076] [client 69.16.200.33:53670] [client 69.16.200.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.16.200.33, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYc7Y7z-Qlvs65S4DP8lowAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 21:22:07.915559 2026] [:error] [pid 50780:tid 50796] [client 202.51.3.72:46648] [client 202.51.3.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.51.3.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYc8f-tUmIu2JHM2Cru_CgAAAM4"]
[Sat Feb 07 21:22:15.032716 2026] [:error] [pid 43182:tid 43201] [client 202.51.3.72:51846] [client 202.51.3.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.51.3.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYc8h_EC82JnxmrnFYnJhwAAAVE"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 21:41:08.083014 2026] [:error] [pid 50780:tid 50795] [client 211.21.61.244:57058] [client 211.21.61.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.244, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYdA9OtUmIu2JHM2CrvEhQAAAM0"]
[Sat Feb 07 21:41:46.237649 2026] [:error] [pid 30684:tid 30695] [client 202.51.3.72:56696] [client 202.51.3.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.51.3.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdBGrqwdxwowLt-_LwVzQAAAcg"]
[Sat Feb 07 21:41:49.871519 2026] [:error] [pid 30684:tid 30706] [client 202.51.3.72:56696] [client 202.51.3.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.51.3.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdBHbqwdxwowLt-_LwV0gAAAdM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 21:48:06.980025 2026] [:error] [pid 58058:tid 58068] [client 50.62.149.159:62130] [client 50.62.149.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.149.159, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdClrz-Qlvs65S4DP8sAgAAAYc"]
[Sat Feb 07 21:48:07.997329 2026] [:error] [pid 58058:tid 58064] [client 50.62.149.159:62130] [client 50.62.149.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.149.159, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdCl7z-Qlvs65S4DP8sBAAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 21:54:03.914047 2026] [:error] [pid 50780:tid 50789] [client 195.85.19.30:28414] [client 195.85.19.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.85.19.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdD--tUmIu2JHM2CrvHxQAAAMc"]
[Sat Feb 07 21:54:17.743414 2026] [:error] [pid 43182:tid 43195] [client 195.85.19.30:7448] [client 195.85.19.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.85.19.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdECfEC82JnxmrnFYnVlAAAAUs"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 21:54:23.376704 2026] [:error] [pid 30684:tid 30698] [client 194.60.196.102:53716] [client 194.60.196.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.60.196.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdED7qwdxwowLt-_LwZnwAAAcs"]
[Sat Feb 07 21:54:25.285633 2026] [:error] [pid 43182:tid 43189] [client 194.60.196.102:53718] [client 194.60.196.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.60.196.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdEEfEC82JnxmrnFYnVmwAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 21:55:56.257613 2026] [:error] [pid 50672:tid 50708] [client 209.235.136.139:36042] [client 209.235.136.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdEbA9o0jq1XS8Nv7NSdwAAAEA"]
[Sat Feb 07 21:56:09.787564 2026] [:error] [pid 58058:tid 58061] [client 209.235.136.139:47900] [client 209.235.136.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdEebz-Qlvs65S4DP8uRAAAAYA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 22:00:56.784372 2026] [autoindex:error] [pid 50671:tid 50697] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:00:57.294283 2026] [autoindex:error] [pid 50671:tid 50683] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:00:59.335871 2026] [autoindex:error] [pid 50671:tid 50697] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:00:59.838160 2026] [autoindex:error] [pid 50671:tid 50680] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:05.835195 2026] [autoindex:error] [pid 50671:tid 50684] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:06.387839 2026] [autoindex:error] [pid 50671:tid 50692] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:06.919753 2026] [autoindex:error] [pid 50671:tid 50696] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:07.451843 2026] [autoindex:error] [pid 50671:tid 50694] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:07.954789 2026] [autoindex:error] [pid 50671:tid 50688] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:08.442441 2026] [autoindex:error] [pid 50671:tid 50701] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:09.460399 2026] [autoindex:error] [pid 50671:tid 50695] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:14.418838 2026] [autoindex:error] [pid 50671:tid 50691] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:14.904260 2026] [autoindex:error] [pid 50671:tid 50699] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:20.873322 2026] [autoindex:error] [pid 50671:tid 50695] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:21.381859 2026] [autoindex:error] [pid 50671:tid 50693] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:21.879620 2026] [autoindex:error] [pid 50671:tid 50687] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:22.393987 2026] [autoindex:error] [pid 50671:tid 50690] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:25.355917 2026] [autoindex:error] [pid 50671:tid 50699] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:25.903716 2026] [autoindex:error] [pid 50671:tid 50695] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:28.580147 2026] [autoindex:error] [pid 50671:tid 50695] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:34.378134 2026] [autoindex:error] [pid 50671:tid 50696] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:34.867490 2026] [autoindex:error] [pid 50671:tid 50687] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:35.355146 2026] [autoindex:error] [pid 50671:tid 50698] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:43.801796 2026] [autoindex:error] [pid 50671:tid 50694] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:52.222231 2026] [autoindex:error] [pid 50671:tid 50701] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:55.116692 2026] [autoindex:error] [pid 50671:tid 50684] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:55.613262 2026] [autoindex:error] [pid 50671:tid 50680] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:57.132484 2026] [autoindex:error] [pid 50671:tid 50686] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:57.632843 2026] [autoindex:error] [pid 50671:tid 50680] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:01:58.141303 2026] [autoindex:error] [pid 50671:tid 50703] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:02:09.941978 2026] [autoindex:error] [pid 50671:tid 50680] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:03:08.593539 2026] [autoindex:error] [pid 50671:tid 50684] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:03:09.080872 2026] [autoindex:error] [pid 50671:tid 50689] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:03:09.567432 2026] [autoindex:error] [pid 50671:tid 50694] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:03:10.064847 2026] [autoindex:error] [pid 50671:tid 50704] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:03:15.239526 2026] [autoindex:error] [pid 50671:tid 50690] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:03:15.797244 2026] [autoindex:error] [pid 50671:tid 50688] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:03:18.448119 2026] [autoindex:error] [pid 50671:tid 50690] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:03:21.331357 2026] [autoindex:error] [pid 50671:tid 50702] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:03:21.828563 2026] [autoindex:error] [pid 50671:tid 50687] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:03:22.326395 2026] [autoindex:error] [pid 50671:tid 50694] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:03:25.154462 2026] [autoindex:error] [pid 50671:tid 50687] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:03:25.640303 2026] [autoindex:error] [pid 50671:tid 50691] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:03:26.123050 2026] [autoindex:error] [pid 50671:tid 50697] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:03:26.610911 2026] [autoindex:error] [pid 50671:tid 50693] [client 31.171.130.135:33621] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:04:15.639644 2026] [autoindex:error] [pid 30684:tid 30700] [client 31.171.130.155:48877] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:04:39.574796 2026] [autoindex:error] [pid 30684:tid 30691] [client 31.171.130.155:48877] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:04:41.441266 2026] [:error] [pid 50673:tid 50758] [client 5.45.73.111:45658] [client 5.45.73.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.45.73.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdGeWVwLsaZ7aKO2ckj2AAAAJc"]
[Sat Feb 07 22:04:43.635622 2026] [:error] [pid 50673:tid 50738] [client 5.45.73.111:45658] [client 5.45.73.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.45.73.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdGe2VwLsaZ7aKO2ckkEwAAAIM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 22:04:50.755338 2026] [autoindex:error] [pid 30684:tid 30709] [client 31.171.130.155:48877] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:04:51.231945 2026] [autoindex:error] [pid 30684:tid 30708] [client 31.171.130.155:48877] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:05:00.656242 2026] [autoindex:error] [pid 30684:tid 30710] [client 31.171.130.155:48877] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:05:00.884451 2026] [:error] [pid 50780:tid 50788] [client 103.169.160.74:58928] [client 103.169.160.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.169.160.74, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdGjOtUmIu2JHM2CrvUVgAAAMY"]
[Sat Feb 07 22:05:01.140495 2026] [autoindex:error] [pid 30684:tid 30703] [client 31.171.130.155:48877] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:05:01.617729 2026] [autoindex:error] [pid 30684:tid 30692] [client 31.171.130.155:48877] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:05:02.106797 2026] [autoindex:error] [pid 30684:tid 30699] [client 31.171.130.155:48877] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:05:02.610035 2026] [autoindex:error] [pid 30684:tid 30705] [client 31.171.130.155:48877] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:05:03.152680 2026] [autoindex:error] [pid 30684:tid 30688] [client 31.171.130.155:48877] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:05:03.637746 2026] [autoindex:error] [pid 30684:tid 30700] [client 31.171.130.155:48877] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:05:04.116360 2026] [autoindex:error] [pid 30684:tid 30696] [client 31.171.130.155:48877] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:05:04.593833 2026] [autoindex:error] [pid 30684:tid 30689] [client 31.171.130.155:48877] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:05:07.092147 2026] [:error] [pid 50673:tid 50739] [client 103.169.160.74:56840] [client 103.169.160.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.169.160.74, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdGk2VwLsaZ7aKO2ckkogAAAIQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 22:05:17.487282 2026] [:error] [pid 30684:tid 30693] [client 107.136.207.122:54144] [client 107.136.207.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.136.207.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdGnbqwdxwowLt-_LwlIwAAAcY"]
[Sat Feb 07 22:05:22.485107 2026] [:error] [pid 30684:tid 30695] [client 107.136.207.122:54144] [client 107.136.207.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.136.207.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdGorqwdxwowLt-_LwlRAAAAcg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 22:06:09.954245 2026] [autoindex:error] [pid 30684:tid 30705] [client 31.171.130.155:48877] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 07 22:10:37.867413 2026] [:error] [pid 55157:tid 55167] [client 162.0.224.185:34326] [client 162.0.224.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.224.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdH3X36JdtTn2bTEozmvQAAAQU"]
[Sat Feb 07 22:10:41.600585 2026] [:error] [pid 55157:tid 55162] [client 162.0.224.185:34326] [client 162.0.224.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.224.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdH4X36JdtTn2bTEozmzwAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 22:13:35.716486 2026] [:error] [pid 50673:tid 50754] [client 69.16.200.33:41496] [client 69.16.200.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.16.200.33, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdIj2VwLsaZ7aKO2ckzLAAAAJM"]
[Sat Feb 07 22:13:57.529666 2026] [:error] [pid 43182:tid 43197] [client 69.16.200.33:39550] [client 69.16.200.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.16.200.33, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdIpfEC82JnxmrnFYn0UwAAAU0"]
[Sat Feb 07 22:14:03.377126 2026] [:error] [pid 43182:tid 43207] [client 69.16.200.33:39550] [client 69.16.200.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.16.200.33, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdIq_EC82JnxmrnFYn0uQAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 22:15:00.361515 2026] [:error] [pid 50671:tid 50690] [client 209.235.136.139:35428] [client 209.235.136.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdI5LvqLohWBI_mqBPIrwAAAAo"]
[Sat Feb 07 22:15:04.728705 2026] [:error] [pid 50672:tid 50716] [client 209.235.136.139:44516] [client 209.235.136.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdI6A9o0jq1XS8Nv7NrUgAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 22:16:16.466941 2026] [:error] [pid 43182:tid 43193] [client 185.125.27.114:35658] [client 185.125.27.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.125.27.114, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYdJMPEC82JnxmrnFYn6IgAAAUk"]
[Sat Feb 07 22:16:29.829211 2026] [:error] [pid 50780:tid 50793] [client 46.101.217.74:57188] [client 46.101.217.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.101.217.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYdJPetUmIu2JHM2CrvonwAAAMs"]
[Sat Feb 07 22:16:52.051476 2026] [:error] [pid 50780:tid 50782] [client 199.188.199.61:51994] [client 199.188.199.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 199.188.199.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYdJVOtUmIu2JHM2Crvo9QAAAMA"]
[Sat Feb 07 22:16:57.457001 2026] [:error] [pid 43182:tid 43184] [client 116.118.44.53:37032] [client 116.118.44.53] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.118.44.53, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYdJWfEC82JnxmrnFYn7tgAAAUA"]
[Sat Feb 07 22:22:07.276070 2026] [:error] [pid 30684:tid 30690] [client 124.156.179.141:60678] [client 124.156.179.141] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYdKj7qwdxwowLt-_LxAGwAAAcM"]
[Sat Feb 07 22:25:05.359689 2026] [:error] [pid 58058:tid 58067] [client 194.60.196.102:56330] [client 194.60.196.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.60.196.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdLQbz-Qlvs65S4DP9UowAAAYY"]
[Sat Feb 07 22:25:20.569566 2026] [:error] [pid 43182:tid 43198] [client 194.60.196.102:52656] [client 194.60.196.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.60.196.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdLUPEC82JnxmrnFYkDXgAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 22:34:07.817222 2026] [:error] [pid 55157:tid 55174] [client 185.137.164.3:27423] [client 185.137.164.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/HEAD"] [unique_id "aYdNX336JdtTn2bTEoz5pAAAAQw"]
[Sat Feb 07 23:02:13.875477 2026] [:error] [pid 43182:tid 43200] [client 103.221.221.13:55672] [client 103.221.221.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.221.221.13, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdT9fEC82JnxmrnFYkULwAAAVA"]
[Sat Feb 07 23:02:16.340992 2026] [:error] [pid 55157:tid 55182] [client 103.221.221.13:55682] [client 103.221.221.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.221.221.13, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdT-H36JdtTn2bTEowA0AAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 23:09:11.232819 2026] [:error] [pid 50672:tid 50723] [client 157.230.24.207:33116] [client 157.230.24.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.24.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdVlw9o0jq1XS8Nv7N6kAAAAE8"]
[Sat Feb 07 23:09:13.933460 2026] [:error] [pid 50673:tid 50737] [client 157.230.24.207:33126] [client 157.230.24.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.24.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdVmWVwLsaZ7aKO2clItAAAAII"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 23:14:38.465417 2026] [:error] [pid 50673:tid 50753] [client 195.85.19.30:59792] [client 195.85.19.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.85.19.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdW3mVwLsaZ7aKO2clJ5gAAAJI"]
[Sat Feb 07 23:14:39.729295 2026] [:error] [pid 50673:tid 50755] [client 195.85.19.30:59792] [client 195.85.19.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.85.19.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdW32VwLsaZ7aKO2clJ6AAAAJQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 23:16:57.107105 2026] [:error] [pid 55157:tid 55185] [client 63.250.33.123:47636] [client 63.250.33.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.33.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdXaX36JdtTn2bTEowDVgAAARc"]
[Sat Feb 07 23:16:58.029387 2026] [:error] [pid 55157:tid 55181] [client 63.250.33.123:47636] [client 63.250.33.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.33.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdXan36JdtTn2bTEowDWAAAARM"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 23:29:46.204861 2026] [:error] [pid 50673:tid 50736] [client 5.45.73.111:37844] [client 5.45.73.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.45.73.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdaamVwLsaZ7aKO2clNXwAAAIE"]
[Sat Feb 07 23:29:57.534121 2026] [:error] [pid 30684:tid 30703] [client 5.45.73.111:14760] [client 5.45.73.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.45.73.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdadbqwdxwowLt-_LxV4QAAAdA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 23:35:53.256631 2026] [:error] [pid 30684:tid 30691] [client 5.45.73.111:42750] [client 5.45.73.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.45.73.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdb2bqwdxwowLt-_LxXkwAAAcQ"]
[Sat Feb 07 23:35:55.403009 2026] [:error] [pid 50671:tid 50693] [client 5.45.73.111:42766] [client 5.45.73.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.45.73.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdb27vqLohWBI_mqBPeTAAAAA0"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 07 23:55:21.767697 2026] [:error] [pid 50672:tid 50714] [client 65.254.225.221:59588] [client 65.254.225.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.221, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdgaQ9o0jq1XS8Nv7ODRwAAAEY"]
[Sat Feb 07 23:55:22.771963 2026] [:error] [pid 50672:tid 50726] [client 65.254.225.221:59588] [client 65.254.225.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.221, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdgag9o0jq1XS8Nv7ODSAAAAFI"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 00:04:29.116737 2026] [:error] [pid 55157:tid 55167] [client 67.225.216.61:44973] [client 67.225.216.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.225.216.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdijX36JdtTn2bTEowNWwAAAQU"]
[Sun Feb 08 00:04:30.093298 2026] [:error] [pid 55157:tid 55175] [client 67.225.216.61:44973] [client 67.225.216.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.225.216.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdijn36JdtTn2bTEowNXgAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 00:10:48.358824 2026] [:error] [pid 50672:tid 50729] [client 157.230.24.207:44936] [client 157.230.24.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.24.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdkCA9o0jq1XS8Nv7OF0AAAAFU"]
[Sun Feb 08 00:10:50.779794 2026] [:error] [pid 55157:tid 55166] [client 157.230.24.207:44938] [client 157.230.24.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.24.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdkCn36JdtTn2bTEowOkQAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 00:13:41.277190 2026] [:error] [pid 58058:tid 58063] [client 103.77.107.178:53250] [client 103.77.107.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aYdktbz-Qlvs65S4DP9sAQAAAYI"]
[Sun Feb 08 00:26:28.865839 2026] [:error] [pid 62341:tid 62424] [client 50.62.149.159:60154] [client 50.62.149.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.149.159, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdntJ-t2yekx5OosV4UTQAAAFY"]
[Sun Feb 08 00:26:30.664063 2026] [:error] [pid 62341:tid 62410] [client 50.62.149.159:60154] [client 50.62.149.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.149.159, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYdntp-t2yekx5OosV4UTgAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 00:44:22.663292 2026] [:error] [pid 46302:tid 46367] [client 43.133.139.6:41342] [client 43.133.139.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYdr5uLz0c8aDYK5YhbEnwAAARA"]
[Sun Feb 08 01:50:08.523415 2026] [:error] [pid 62342:tid 62434] [client 103.205.208.252:58732] [client 103.205.208.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.205.208.252, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYd7UOwzANoqjscwU_7LiQAAAIU"]
[Sun Feb 08 01:50:50.936033 2026] [:error] [pid 16829:tid 16862] [client 103.205.208.252:51504] [client 103.205.208.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.205.208.252, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYd7egQFls00VxRngXuvbQAAAVU"]
[Sun Feb 08 02:05:50.900523 2026] [:error] [pid 17001:tid 17022] [client 89.43.17.214:53882] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYd-_t0X31QDRSlPKmR8WAAAAYY"]
[Sun Feb 08 02:06:09.628960 2026] [:error] [pid 17001:tid 17029] [client 136.111.10.47:50592] [client 136.111.10.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.10.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYd_Ed0X31QDRSlPKmR8dQAAAY0"]
[Sun Feb 08 02:06:22.638175 2026] [:error] [pid 62340:tid 62399] [client 193.202.110.21:49260] [client 193.202.110.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.202.110.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYd_Hgp6H49g9bqshiuO9wAAABg"]
[Sun Feb 08 02:13:23.297695 2026] [:error] [pid 62340:tid 62398] [client 5.45.73.111:46380] [client 5.45.73.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.45.73.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeAwwp6H49g9bqshiuQKAAAABc"]
[Sun Feb 08 02:13:24.562054 2026] [:error] [pid 62340:tid 62388] [client 5.45.73.111:46380] [client 5.45.73.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.45.73.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeAxAp6H49g9bqshiuQLAAAAA0"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 02:18:04.928965 2026] [:error] [pid 62641:tid 62655] [client 5.180.47.55:51614] [client 5.180.47.55] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=application/xhtml+xml"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYeB3C_seVuUK_C4AppwsQAAAMw"]
[Sun Feb 08 02:28:37.589480 2026] [:error] [pid 46302:tid 46362] [client 209.235.136.147:43360] [client 209.235.136.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeEVeLz0c8aDYK5YhbdXAAAAQs"]
[Sun Feb 08 02:28:38.887473 2026] [:error] [pid 46302:tid 46353] [client 209.235.136.147:43360] [client 209.235.136.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeEVuLz0c8aDYK5YhbdXgAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 02:30:24.114151 2026] [:error] [pid 62340:tid 62385] [client 50.62.201.28:26824] [client 50.62.201.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.201.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeEwAp6H49g9bqshiuT8gAAAAo"]
[Sun Feb 08 02:30:25.058656 2026] [:error] [pid 62340:tid 62383] [client 50.62.201.28:26824] [client 50.62.201.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.201.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeEwQp6H49g9bqshiuT9QAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 02:32:19.534926 2026] [:error] [pid 62342:tid 62448] [client 202.51.3.72:39394] [client 202.51.3.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.51.3.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeFM-wzANoqjscwU_7UiAAAAJM"]
[Sun Feb 08 02:32:49.589215 2026] [:error] [pid 46302:tid 46355] [client 132.148.178.220:24912] [client 132.148.178.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 132.148.178.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeFUeLz0c8aDYK5YhbeKgAAAQU"]
[Sun Feb 08 02:32:50.506490 2026] [:error] [pid 46302:tid 46352] [client 132.148.178.220:24912] [client 132.148.178.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 132.148.178.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeFUuLz0c8aDYK5YhbeKwAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 02:36:13.590816 2026] [:error] [pid 17001:tid 17035] [client 68.178.161.74:52552] [client 68.178.161.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.161.74, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeGHd0X31QDRSlPKmSG3QAAAZM"]
[Sun Feb 08 02:36:14.656802 2026] [:error] [pid 17001:tid 17032] [client 68.178.161.74:52552] [client 68.178.161.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.161.74, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeGHt0X31QDRSlPKmSG3wAAAZA"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 02:45:26.501610 2026] [:error] [pid 46302:tid 46354] [client 107.136.207.122:37226] [client 107.136.207.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.136.207.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeIRuLz0c8aDYK5YhbgbQAAAQQ"]
[Sun Feb 08 02:45:27.486643 2026] [:error] [pid 46302:tid 46371] [client 107.136.207.122:37226] [client 107.136.207.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.136.207.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeIR-Lz0c8aDYK5YhbgbwAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 02:56:04.167833 2026] [:error] [pid 62340:tid 62396] [client 69.57.172.96:44120] [client 69.57.172.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.57.172.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeKxAp6H49g9bqshiuZDQAAABU"]
[Sun Feb 08 02:56:06.855342 2026] [:error] [pid 62340:tid 62375] [client 69.57.172.96:44120] [client 69.57.172.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.57.172.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeKxgp6H49g9bqshiuZDgAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 03:04:11.364360 2026] [:error] [pid 16829:tid 16865] [client 129.146.223.190:37136] [client 129.146.223.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.146.223.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeMqwQFls00VxRngXvCuwAAAVg"]
[Sun Feb 08 03:04:13.264107 2026] [:error] [pid 17001:tid 17035] [client 129.146.223.190:49292] [client 129.146.223.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.146.223.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeMrd0X31QDRSlPKmSQQQAAAZM"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 03:24:48.026604 2026] [:error] [pid 17001:tid 17028] [client 5.45.73.111:57846] [client 5.45.73.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.45.73.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeRgN0X31QDRSlPKmSYbgAAAYw"]
[Sun Feb 08 03:24:50.553656 2026] [:error] [pid 17001:tid 17017] [client 5.45.73.111:57846] [client 5.45.73.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.45.73.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeRgt0X31QDRSlPKmSYcAAAAYE"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 03:31:33.190803 2026] [:error] [pid 46302:tid 46355] [client 5.45.73.111:51814] [client 5.45.73.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.45.73.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeTFeLz0c8aDYK5YhbrsAAAAQU"]
[Sun Feb 08 03:31:35.075224 2026] [:error] [pid 62340:tid 62380] [client 5.45.73.111:51826] [client 5.45.73.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.45.73.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeTFwp6H49g9bqshiugbQAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 03:36:08.781214 2026] [:error] [pid 16509:tid 16598] [client 184.168.112.138:21916] [client 184.168.112.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 184.168.112.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeUKO_saLSx60Yt3JuNqgAAAAw"]
[Sun Feb 08 03:36:09.763506 2026] [:error] [pid 16509:tid 16602] [client 184.168.112.138:21916] [client 184.168.112.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 184.168.112.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeUKe_saLSx60Yt3JuNrAAAABA"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 03:57:58.418076 2026] [:error] [pid 59037:tid 59052] [client 82.223.68.186:49922] [client 82.223.68.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.68.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYeZRqfozbk92ZUh9fVzugAAAMk"]
[Sun Feb 08 04:09:04.118969 2026] [:error] [pid 24421:tid 24438] [client 209.235.136.147:41494] [client 209.235.136.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeb4Kp7cTzhX5M1IP_9RQAAAAc"]
[Sun Feb 08 04:09:05.136677 2026] [:error] [pid 24421:tid 24446] [client 209.235.136.147:41494] [client 209.235.136.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeb4ap7cTzhX5M1IP_9SQAAAA8"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 04:17:45.375706 2026] [:error] [pid 24530:tid 24538] [client 20.215.184.141:18103] [client 20.215.184.141] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mln.php"] [unique_id "aYed6UazNRCs1GRWrh7g7wAAAMY"]
[Sun Feb 08 04:17:48.914931 2026] [:error] [pid 24530:tid 24537] [client 20.215.184.141:20599] [client 20.215.184.141] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aYed7EazNRCs1GRWrh7g9wAAAMU"]
[Sun Feb 08 04:17:49.957250 2026] [:error] [pid 24422:tid 24461] [client 20.215.184.141:31297] [client 20.215.184.141] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aYed7SNNjcLoSCLKhTduJQAAAEM"]
[Sun Feb 08 04:18:02.726781 2026] [:error] [pid 24422:tid 24476] [client 20.215.184.141:3394] [client 20.215.184.141] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aYed-iNNjcLoSCLKhTduMgAAAFI"]
[Sun Feb 08 04:23:58.222078 2026] [:error] [pid 56906:tid 56919] [client 107.136.207.122:34948] [client 107.136.207.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.136.207.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYefXvxl3WX27-WXfDh2CQAAAQs"]
[Sun Feb 08 04:24:02.933357 2026] [:error] [pid 56906:tid 56927] [client 107.136.207.122:34948] [client 107.136.207.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.136.207.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYefYvxl3WX27-WXfDh2FwAAARM"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 04:30:43.276585 2026] [:error] [pid 24423:tid 24496] [client 68.178.223.62:52502] [client 68.178.223.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.223.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeg803f9n1Y0TpV5YZvrAAAAIs"]
[Sun Feb 08 04:30:44.224910 2026] [:error] [pid 24423:tid 24486] [client 68.178.223.62:52502] [client 68.178.223.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.223.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeg9E3f9n1Y0TpV5YZvrQAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 04:43:00.977473 2026] [:error] [pid 24421:tid 24437] [client 157.230.24.207:60698] [client 157.230.24.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.24.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYej1Kp7cTzhX5M1IP8LrgAAAAY"]
[Sun Feb 08 04:43:02.906842 2026] [:error] [pid 24421:tid 24436] [client 157.230.24.207:60698] [client 157.230.24.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.24.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYej1qp7cTzhX5M1IP8LsQAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 05:04:51.187008 2026] [:error] [pid 24530:tid 24545] [client 101.0.79.10:57918] [client 101.0.79.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.0.79.10, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeo80azNRCs1GRWrh7wrgAAAM0"]
[Sun Feb 08 05:04:55.087922 2026] [:error] [pid 24530:tid 24533] [client 101.0.79.10:57918] [client 101.0.79.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.0.79.10, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeo90azNRCs1GRWrh7wtgAAAME"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 05:06:20.061830 2026] [:error] [pid 24421:tid 24449] [client 107.136.207.122:33148] [client 107.136.207.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.136.207.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYepTKp7cTzhX5M1IP8WTgAAABI"]
[Sun Feb 08 05:06:39.997554 2026] [:error] [pid 24530:tid 24534] [client 107.136.207.122:55724] [client 107.136.207.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.136.207.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYepX0azNRCs1GRWrh7xSQAAAMI"]
[Sun Feb 08 05:06:43.042490 2026] [:error] [pid 24530:tid 24535] [client 107.136.207.122:55724] [client 107.136.207.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.136.207.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYepY0azNRCs1GRWrh7xUQAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 05:12:02.765607 2026] [:error] [pid 24422:tid 24462] [client 177.92.76.186:53421] [client 177.92.76.186] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 177.92.76.186, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeqoiNNjcLoSCLKhTeCegAAAEQ"]
[Sun Feb 08 05:12:03.931988 2026] [:error] [pid 24422:tid 24477] [client 177.92.76.186:53421] [client 177.92.76.186] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 177.92.76.186, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeqoyNNjcLoSCLKhTeCfgAAAFM"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 05:29:51.892927 2026] [:error] [pid 24421:tid 24442] [client 51.120.74.232:26026] [client 51.120.74.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yvtuizub.php"] [unique_id "aYeuz6p7cTzhX5M1IP8gUgAAAAs"]
[Sun Feb 08 05:29:54.299482 2026] [:error] [pid 24423:tid 24509] [client 51.120.74.232:35528] [client 51.120.74.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mln.php"] [unique_id "aYeu0k3f9n1Y0TpV5YaCxgAAAJg"]
[Sun Feb 08 05:29:55.500908 2026] [:error] [pid 24530:tid 24546] [client 51.120.74.232:23081] [client 51.120.74.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aYeu00azNRCs1GRWrh75DQAAAM4"]
[Sun Feb 08 05:29:58.890250 2026] [:error] [pid 24422:tid 24462] [client 51.120.74.232:33119] [client 51.120.74.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aYeu1iNNjcLoSCLKhTeKOAAAAEQ"]
[Sun Feb 08 05:30:02.161322 2026] [:error] [pid 56906:tid 56921] [client 51.120.74.232:30297] [client 51.120.74.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aYeu2vxl3WX27-WXfDiZIAAAAQ0"]
[Sun Feb 08 05:30:05.441013 2026] [:error] [pid 56906:tid 56920] [client 51.120.74.232:30387] [client 51.120.74.232] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aYeu3fxl3WX27-WXfDiZLQAAAQw"]
[Sun Feb 08 05:38:11.254116 2026] [:error] [pid 56906:tid 56922] [client 63.250.33.123:52138] [client 63.250.33.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.33.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYeww_xl3WX27-WXfDicowAAAQ4"]
[Sun Feb 08 05:38:12.224647 2026] [:error] [pid 56906:tid 56932] [client 63.250.33.123:52138] [client 63.250.33.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.250.33.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYewxPxl3WX27-WXfDicqAAAARg"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 05:38:22.854924 2026] [:error] [pid 56906:tid 56914] [client 50.62.149.159:39524] [client 50.62.149.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.149.159, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYewzvxl3WX27-WXfDictQAAAQY"]
[Sun Feb 08 05:38:23.730249 2026] [:error] [pid 56906:tid 56913] [client 50.62.149.159:39524] [client 50.62.149.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.62.149.159, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYewz_xl3WX27-WXfDicuAAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 05:57:32.296615 2026] [:error] [pid 24530:tid 24550] [client 101.0.79.10:41116] [client 101.0.79.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.0.79.10, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYe1TEazNRCs1GRWrh4BTAAAANI"]
[Sun Feb 08 05:57:36.513245 2026] [:error] [pid 24530:tid 24551] [client 101.0.79.10:41116] [client 101.0.79.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.0.79.10, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYe1UEazNRCs1GRWrh4BUwAAANM"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 06:07:53.619970 2026] [:error] [pid 24422:tid 24467] [client 65.254.225.231:49374] [client 65.254.225.231] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.231, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYe3uSNNjcLoSCLKhTeWAgAAAEk"]
[Sun Feb 08 06:07:54.545437 2026] [:error] [pid 24422:tid 24471] [client 65.254.225.231:49374] [client 65.254.225.231] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.231, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYe3uiNNjcLoSCLKhTeWAwAAAE0"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 06:29:56.319795 2026] [:error] [pid 56906:tid 56914] [client 178.128.239.177:34710] [client 178.128.239.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.128.239.177, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYe85Pxl3WX27-WXfDi0_gAAAQY"]
[Sun Feb 08 06:29:56.819302 2026] [:error] [pid 24530:tid 24548] [client 103.160.153.11:34360] [client 103.160.153.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.160.153.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYe85EazNRCs1GRWrh4JigAAANA"]
[Sun Feb 08 06:30:02.290219 2026] [:error] [pid 24422:tid 24459] [client 198.54.114.124:60866] [client 198.54.114.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYe86iNNjcLoSCLKhTec3QAAAEE"]
[Sun Feb 08 06:30:07.535297 2026] [:error] [pid 24530:tid 24549] [client 47.253.193.141:53568] [client 47.253.193.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.253.193.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYe870azNRCs1GRWrh4JnAAAANE"]
[Sun Feb 08 06:30:12.732656 2026] [:error] [pid 24423:tid 24505] [client 47.100.130.223:48550] [client 47.100.130.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.100.130.223, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYe89E3f9n1Y0TpV5YaUygAAAJQ"]
[Sun Feb 08 06:33:10.774564 2026] [:error] [pid 56906:tid 56909] [client 141.30.32.5:55318] [client 141.30.32.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.30.32.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYe9pvxl3WX27-WXfDi2jAAAAQE"]
[Sun Feb 08 06:33:15.511681 2026] [:error] [pid 56906:tid 56918] [client 141.30.32.5:55318] [client 141.30.32.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.30.32.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYe9q_xl3WX27-WXfDi2lQAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 07:23:00.276249 2026] [:error] [pid 24422:tid 24465] [client 18.136.78.124:43124] [client 18.136.78.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.136.78.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfJVCNNjcLoSCLKhTexUwAAAEc"]
[Sun Feb 08 07:23:01.964237 2026] [:error] [pid 24422:tid 24481] [client 18.136.78.124:43124] [client 18.136.78.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.136.78.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfJVSNNjcLoSCLKhTexVwAAAFc"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 07:29:25.621721 2026] [:error] [pid 24423:tid 24489] [client 198.38.94.18:36316] [client 198.38.94.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.38.94.18, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfK1U3f9n1Y0TpV5YarKgAAAIQ"]
[Sun Feb 08 07:29:26.651707 2026] [:error] [pid 24423:tid 24507] [client 198.38.94.18:36316] [client 198.38.94.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.38.94.18, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfK1k3f9n1Y0TpV5YarLQAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 07:34:25.169472 2026] [:error] [pid 56906:tid 56924] [client 65.21.72.120:46476] [client 65.21.72.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.21.72.120, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfMAfxl3WX27-WXfDjWugAAARA"]
[Sun Feb 08 07:34:26.131201 2026] [:error] [pid 56906:tid 56931] [client 65.21.72.120:46476] [client 65.21.72.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.21.72.120, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfMAvxl3WX27-WXfDjWvAAAARc"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 08:14:42.137044 2026] [:error] [pid 24423:tid 24493] [client 107.180.115.163:22522] [client 107.180.115.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.115.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfVck3f9n1Y0TpV5Ya75gAAAIg"]
[Sun Feb 08 08:14:43.586310 2026] [:error] [pid 24423:tid 24501] [client 107.180.115.163:22522] [client 107.180.115.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.180.115.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfVc03f9n1Y0TpV5Ya76QAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 08:23:02.681086 2026] [:error] [pid 56906:tid 56926] [client 138.201.124.171:35556] [client 138.201.124.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.201.124.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfXZvxl3WX27-WXfDj1ugAAARI"]
[Sun Feb 08 08:23:03.664160 2026] [:error] [pid 56906:tid 56932] [client 138.201.124.171:35556] [client 138.201.124.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.201.124.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfXZ_xl3WX27-WXfDj1uwAAARg"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 08:26:48.505955 2026] [:error] [pid 56906:tid 56911] [client 158.158.72.156:60102] [client 158.158.72.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 158.158.72.156, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfYSPxl3WX27-WXfDj4PAAAAQM"]
[Sun Feb 08 08:26:50.928436 2026] [:error] [pid 56906:tid 56924] [client 158.158.72.156:60102] [client 158.158.72.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 158.158.72.156, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfYSvxl3WX27-WXfDj4RgAAARA"]
[Sun Feb 08 08:28:20.681506 2026] [:error] [pid 24422:tid 24460] [client 132.148.177.42:11714] [client 132.148.177.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 132.148.177.42, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfYpCNNjcLoSCLKhTfLYgAAAEI"]
[Sun Feb 08 08:28:21.531564 2026] [:error] [pid 24422:tid 24466] [client 132.148.177.42:11714] [client 132.148.177.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 132.148.177.42, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfYpSNNjcLoSCLKhTfLZAAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 08:51:32.688599 2026] [:error] [pid 24421:tid 24438] [client 101.0.79.10:41072] [client 101.0.79.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.0.79.10, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfeFKp7cTzhX5M1IP90dAAAAAc"]
[Sun Feb 08 08:51:35.657122 2026] [:error] [pid 24421:tid 24442] [client 101.0.79.10:41072] [client 101.0.79.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.0.79.10, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfeF6p7cTzhX5M1IP90egAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 08:56:36.615731 2026] [:error] [pid 24423:tid 24491] [client 92.205.89.255:18812] [client 92.205.89.255] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 92.205.89.255, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYffRE3f9n1Y0TpV5YbJvwAAAIY"]
[Sun Feb 08 09:01:20.554444 2026] [:error] [pid 24422:tid 24465] [client 13.126.164.139:52132] [client 13.126.164.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 13.126.164.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfgYCNNjcLoSCLKhTfYewAAAEc"]
[Sun Feb 08 09:01:21.650512 2026] [:error] [pid 24422:tid 24482] [client 13.126.164.139:52132] [client 13.126.164.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 13.126.164.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfgYSNNjcLoSCLKhTfYfgAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 09:04:30.167168 2026] [:error] [pid 56906:tid 56910] [client 157.230.24.207:43484] [client 157.230.24.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.24.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfhHvxl3WX27-WXfDgNRwAAAQI"]
[Sun Feb 08 09:04:31.837763 2026] [:error] [pid 56906:tid 56929] [client 157.230.24.207:43484] [client 157.230.24.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.24.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfhH_xl3WX27-WXfDgNSwAAARU"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 09:17:33.024497 2026] [:error] [pid 56906:tid 56918] [client 141.30.32.5:50890] [client 141.30.32.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.30.32.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfkLfxl3WX27-WXfDgVGQAAAQo"]
[Sun Feb 08 09:17:35.184189 2026] [:error] [pid 24422:tid 24482] [client 141.30.32.5:45318] [client 141.30.32.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.30.32.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfkLyNNjcLoSCLKhTffBAAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 09:20:15.115917 2026] [:error] [pid 56906:tid 56932] [client 43.130.72.40:48222] [client 43.130.72.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYfkz_xl3WX27-WXfDgWpAAAARg"]
[Sun Feb 08 09:29:36.766224 2026] [:error] [pid 24423:tid 24503] [client 130.255.126.226:36706] [client 130.255.126.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.255.126.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYfnAE3f9n1Y0TpV5YbVMQAAAJI"]
[Sun Feb 08 09:32:34.294676 2026] [:error] [pid 56906:tid 56927] [client 89.117.172.183:51392] [client 89.117.172.183] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.117.172.183, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfnsvxl3WX27-WXfDgd7QAAARM"]
[Sun Feb 08 09:32:36.978361 2026] [:error] [pid 56906:tid 56916] [client 89.117.172.183:51392] [client 89.117.172.183] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.117.172.183, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfntPxl3WX27-WXfDgd-QAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 09:36:54.791603 2026] [:error] [pid 24421:tid 24433] [client 157.230.24.207:49946] [client 157.230.24.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.24.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfotqp7cTzhX5M1IP-HvAAAAAI"]
[Sun Feb 08 09:36:55.713810 2026] [:error] [pid 24421:tid 24435] [client 157.230.24.207:49946] [client 157.230.24.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.24.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfot6p7cTzhX5M1IP-HwAAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 09:59:59.833791 2026] [:error] [pid 24422:tid 24461] [client 141.30.32.5:35154] [client 141.30.32.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.30.32.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfuHyNNjcLoSCLKhTfu-gAAAEM"]
[Sun Feb 08 10:10:36.807064 2026] [:error] [pid 24422:tid 24467] [client 170.249.236.27:48236] [client 170.249.236.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 170.249.236.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfwnCNNjcLoSCLKhTfynwAAAEk"]
[Sun Feb 08 10:10:37.775147 2026] [:error] [pid 24422:tid 24473] [client 170.249.236.27:48236] [client 170.249.236.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 170.249.236.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYfwnSNNjcLoSCLKhTfyoAAAAE8"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 10:25:45.086764 2026] [:error] [pid 24421:tid 24445] [client 65.254.225.219:59994] [client 65.254.225.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.219, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYf0Kap7cTzhX5M1IP-aYgAAAA4"]
[Sun Feb 08 10:25:46.239120 2026] [:error] [pid 24421:tid 24436] [client 65.254.225.219:59994] [client 65.254.225.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.219, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYf0Kqp7cTzhX5M1IP-aZQAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 10:28:01.014377 2026] [:error] [pid 56906:tid 56914] [client 120.76.99.214:56172] [client 120.76.99.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.76.99.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYf0sfxl3WX27-WXfDg5_QAAAQY"]
[Sun Feb 08 10:28:11.636904 2026] [:error] [pid 56906:tid 56915] [client 47.82.118.63:51164] [client 47.82.118.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.82.118.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYf0u_xl3WX27-WXfDg6EQAAAQc"]
[Sun Feb 08 10:28:24.565767 2026] [:error] [pid 56906:tid 56926] [client 89.42.211.170:59724] [client 89.42.211.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.42.211.170, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYf0yPxl3WX27-WXfDg6JwAAARI"]
[Sun Feb 08 10:28:33.452543 2026] [:error] [pid 24422:tid 24465] [client 103.113.152.163:37030] [client 103.113.152.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.113.152.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYf00SNNjcLoSCLKhTf3nQAAAEc"]
[Sun Feb 08 10:28:55.911174 2026] [:error] [pid 24422:tid 24478] [client 167.172.67.131:60784] [client 167.172.67.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.67.131, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYf05yNNjcLoSCLKhTf3wAAAAFQ"]
[Sun Feb 08 10:43:54.699839 2026] [:error] [pid 24421:tid 24439] [client 72.167.253.131:35148] [client 72.167.253.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 72.167.253.131, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYf4aqp7cTzhX5M1IP-hyQAAAAg"]
[Sun Feb 08 10:43:55.682989 2026] [:error] [pid 24421:tid 24435] [client 72.167.253.131:35148] [client 72.167.253.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 72.167.253.131, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYf4a6p7cTzhX5M1IP-hzAAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 11:00:48.205999 2026] [:error] [pid 56906:tid 56925] [client 3.109.96.140:42162] [client 3.109.96.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.109.96.140, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYf8YPxl3WX27-WXfDhKvQAAARE"]
[Sun Feb 08 11:00:49.242736 2026] [:error] [pid 56906:tid 56910] [client 3.109.96.140:42162] [client 3.109.96.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.109.96.140, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYf8Yfxl3WX27-WXfDhKwwAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 11:16:10.863454 2026] [:error] [pid 24422:tid 24464] [client 113.166.92.134:58734] [client 113.166.92.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 113.166.92.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYf_-iNNjcLoSCLKhTcJkgAAAEY"]
[Sun Feb 08 11:16:11.900094 2026] [:error] [pid 24422:tid 24482] [client 113.166.92.134:58734] [client 113.166.92.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 113.166.92.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYf_-yNNjcLoSCLKhTcJlQAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 11:18:46.936592 2026] [:error] [pid 24421:tid 24433] [client 5.182.33.212:55158] [client 5.182.33.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.182.33.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYgAlqp7cTzhX5M1IP-wTQAAAAI"]
[Sun Feb 08 11:18:50.785285 2026] [:error] [pid 24421:tid 24453] [client 5.182.33.212:55158] [client 5.182.33.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.182.33.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYgAmqp7cTzhX5M1IP-wVQAAABY"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 11:46:16.106157 2026] [:error] [pid 24423:tid 24493] [client 3.78.78.214:58210] [client 3.78.78.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.78.78.214, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYgHCE3f9n1Y0TpV5Yb_KwAAAIg"]
[Sun Feb 08 11:46:17.281444 2026] [:error] [pid 24423:tid 24507] [client 3.78.78.214:58210] [client 3.78.78.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.78.78.214, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYgHCU3f9n1Y0TpV5Yb_LQAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 11:53:00.283307 2026] [:error] [pid 24421:tid 24448] [client 15.164.172.90:36268] [client 15.164.172.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.164.172.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYgInKp7cTzhX5M1IP-7jAAAABE"]
[Sun Feb 08 11:53:02.856888 2026] [:error] [pid 24421:tid 24435] [client 15.164.172.90:36268] [client 15.164.172.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.164.172.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYgInqp7cTzhX5M1IP-7kAAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 11:56:21.807508 2026] [:error] [pid 24422:tid 24458] [client 88.198.69.173:45458] [client 88.198.69.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.198.69.173, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYgJZSNNjcLoSCLKhTcUSAAAAEA"]
[Sun Feb 08 11:56:22.766957 2026] [:error] [pid 24422:tid 24464] [client 88.198.69.173:45458] [client 88.198.69.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.198.69.173, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYgJZiNNjcLoSCLKhTcUSQAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 12:29:00.377695 2026] [:error] [pid 24423:tid 24493] [client 5.182.33.212:53256] [client 5.182.33.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.182.33.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYgRDE3f9n1Y0TpV5YYKlwAAAIg"]
[Sun Feb 08 12:29:02.855119 2026] [:error] [pid 24423:tid 24506] [client 5.182.33.212:53256] [client 5.182.33.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.182.33.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYgRDk3f9n1Y0TpV5YYKnAAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 13:25:03.608035 2026] [:error] [pid 24423:tid 24495] [client 15.164.172.90:53650] [client 15.164.172.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.164.172.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYgeL03f9n1Y0TpV5YYWBQAAAIo"]
[Sun Feb 08 13:25:06.904923 2026] [:error] [pid 24423:tid 24492] [client 15.164.172.90:53650] [client 15.164.172.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.164.172.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYgeMk3f9n1Y0TpV5YYWEQAAAIc"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 13:25:10.954506 2026] [:error] [pid 43900:tid 43910] [client 103.159.239.25:43192] [client 103.159.239.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.159.239.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYgeNuWrhnpm_Csk3klCoAAAAUc"]
[Sun Feb 08 13:53:16.333151 2026] [:error] [pid 24422:tid 24480] [client 192.250.239.84:57494] [client 192.250.239.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.250.239.84, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYgkzCNNjcLoSCLKhTcttgAAAFY"]
[Sun Feb 08 14:24:00.771473 2026] [:error] [pid 24421:tid 24439] [client 47.82.118.63:48846] [client 47.82.118.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.82.118.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYgsAKp7cTzhX5M1IP_kUwAAAAg"]
[Sun Feb 08 14:47:29.069619 2026] [:error] [pid 24422:tid 24472] [client 65.254.225.227:57916] [client 65.254.225.227] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.227, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYgxgSNNjcLoSCLKhTc4vgAAAE4"]
[Sun Feb 08 14:47:29.984284 2026] [:error] [pid 24422:tid 24462] [client 65.254.225.227:57916] [client 65.254.225.227] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.227, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYgxgSNNjcLoSCLKhTc4wAAAAEQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 14:50:18.338199 2026] [:error] [pid 43900:tid 43915] [client 3.147.168.15:54976] [client 3.147.168.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.147.168.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYgyKuWrhnpm_Csk3kldPQAAAUw"]
[Sun Feb 08 14:55:03.326304 2026] [:error] [pid 56906:tid 56931] [client 47.82.118.63:58416] [client 47.82.118.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.82.118.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYgzR_xl3WX27-WXfDiK7gAAARc"]
[Sun Feb 08 14:55:23.099857 2026] [:error] [pid 24530:tid 24543] [client 103.217.92.186:33202] [client 103.217.92.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.217.92.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYgzW0azNRCs1GRWrh7FTAAAAMs"]
[Sun Feb 08 14:55:38.034640 2026] [:error] [pid 24423:tid 24499] [client 220.158.233.216:12318] [client 220.158.233.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.158.233.216, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYgzak3f9n1Y0TpV5YYsjAAAAI4"]
[Sun Feb 08 14:55:40.972855 2026] [:error] [pid 56906:tid 56929] [client 139.224.36.66:39884] [client 139.224.36.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.224.36.66, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYgzbPxl3WX27-WXfDiLOAAAARU"]
[Sun Feb 08 15:09:41.772888 2026] [:error] [pid 43900:tid 43916] [client 65.254.225.215:54878] [client 65.254.225.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYg2teWrhnpm_Csk3klimQAAAU0"]
[Sun Feb 08 15:09:43.706914 2026] [:error] [pid 43900:tid 43906] [client 65.254.225.217:54886] [client 65.254.225.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYg2t-Wrhnpm_Csk3klioQAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 15:18:29.321590 2026] [:error] [pid 43900:tid 43904] [client 103.82.21.44:26486] [client 103.82.21.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.82.21.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYg4xeWrhnpm_Csk3kllzQAAAUE"]
[Sun Feb 08 15:18:30.363609 2026] [:error] [pid 43900:tid 43919] [client 103.82.21.44:26486] [client 103.82.21.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.82.21.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYg4xuWrhnpm_Csk3kll0AAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 15:34:01.790760 2026] [:error] [pid 24530:tid 24549] [client 65.254.225.214:32854] [client 65.254.225.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.214, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYg8aUazNRCs1GRWrh7UwgAAANE"]
[Sun Feb 08 15:34:03.044768 2026] [:error] [pid 24530:tid 24553] [client 65.254.225.214:32854] [client 65.254.225.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.214, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYg8a0azNRCs1GRWrh7UxAAAANU"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 15:59:53.068880 2026] [:error] [pid 43900:tid 43919] [client 43.135.172.89:39320] [client 43.135.172.89] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYhCeeWrhnpm_Csk3klvZQAAAVA"]
[Sun Feb 08 17:14:09.393998 2026] [:error] [pid 58631:tid 58653] [client 157.173.110.68:60874] [client 157.173.110.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.173.110.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYhT4X-r9Xz6zi7KqKxDWAAAAdQ"]
[Sun Feb 08 17:14:10.267220 2026] [:error] [pid 58631:tid 58633] [client 157.173.110.68:60874] [client 157.173.110.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.173.110.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYhT4n-r9Xz6zi7KqKxDWQAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 17:25:24.177414 2026] [:error] [pid 24423:tid 24508] [client 103.152.165.165:27560] [client 103.152.165.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.152.165.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYhWhE3f9n1Y0TpV5YZLVAAAAJc"]
[Sun Feb 08 17:25:26.838452 2026] [:error] [pid 58631:tid 58638] [client 103.152.165.165:27568] [client 103.152.165.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.152.165.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYhWhn-r9Xz6zi7KqKxHsQAAAcU"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 17:47:28.522262 2026] [:error] [pid 24530:tid 24538] [client 157.90.6.50:50404] [client 157.90.6.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.90.6.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYhbsEazNRCs1GRWrh75bQAAAMY"]
[Sun Feb 08 17:47:30.418824 2026] [:error] [pid 24421:tid 24434] [client 157.90.6.50:50416] [client 157.90.6.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.90.6.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYhbsqp7cTzhX5M1IP8TEgAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 18:01:22.334877 2026] [:error] [pid 43900:tid 43920] [client 79.184.153.195:47940] [client 79.184.153.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 79.184.153.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYhe8uWrhnpm_Csk3kmJ9gAAAVE"]
[Sun Feb 08 18:01:29.205342 2026] [:error] [pid 24530:tid 24537] [client 79.184.153.195:40120] [client 79.184.153.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 79.184.153.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYhe-UazNRCs1GRWrh78YQAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 18:01:51.189567 2026] [:error] [pid 58631:tid 58639] [client 65.254.225.219:47688] [client 65.254.225.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.219, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYhfD3-r9Xz6zi7KqKxTWwAAAcY"]
[Sun Feb 08 18:01:53.133589 2026] [:error] [pid 56906:tid 56929] [client 65.254.225.220:47690] [client 65.254.225.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYhfEfxl3WX27-WXfDiwxwAAARU"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 18:32:38.532943 2026] [:error] [pid 24422:tid 24475] [client 65.254.225.220:39992] [client 65.254.225.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYhmRiNNjcLoSCLKhTdqmwAAAFE"]
[Sun Feb 08 18:32:39.770015 2026] [:error] [pid 24422:tid 24474] [client 65.254.225.220:39992] [client 65.254.225.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYhmRyNNjcLoSCLKhTdqngAAAFA"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 18:45:42.940557 2026] [:error] [pid 54609:tid 54622] [client 157.51.79.143:52496] [client 157.51.79.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.51.79.143, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYhpVqRRnRH9N52BW9KX2QAAAYs"]
[Sun Feb 08 19:03:05.925975 2026] [:error] [pid 43900:tid 43912] [client 129.146.65.146:38872] [client 129.146.65.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.146.65.146, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYhtaeWrhnpm_Csk3kmV2wAAAUk"]
[Sun Feb 08 19:03:51.609236 2026] [:error] [pid 24421:tid 24442] [client 195.88.82.88:58824] [client 195.88.82.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.88.82.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYhtl6p7cTzhX5M1IP8jMwAAAAs"]
[Sun Feb 08 19:33:06.366627 2026] [:error] [pid 58631:tid 58654] [client 154.19.37.2:47140] [client 154.19.37.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.19.37.2, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYh0cn-r9Xz6zi7KqKxx9QAAAdU"]
[Sun Feb 08 19:33:07.356487 2026] [:error] [pid 58631:tid 58633] [client 154.19.37.2:47140] [client 154.19.37.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.19.37.2, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYh0c3-r9Xz6zi7KqKxx-QAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 19:56:36.519451 2026] [:error] [pid 54609:tid 54626] [client 103.90.234.204:37176] [client 103.90.234.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.90.234.204, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYh59KRRnRH9N52BW9KmhgAAAY8"]
[Sun Feb 08 19:56:38.915511 2026] [:error] [pid 54609:tid 54619] [client 103.90.234.204:37176] [client 103.90.234.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.90.234.204, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYh59qRRnRH9N52BW9KmhwAAAYg"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 20:09:27.300876 2026] [:error] [pid 56906:tid 56927] [client 185.196.220.16:51958] [client 185.196.220.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.196.220.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYh89_xl3WX27-WXfDjHEgAAARM"]
[Sun Feb 08 20:09:28.712338 2026] [:error] [pid 56906:tid 56908] [client 185.196.220.16:51958] [client 185.196.220.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.196.220.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYh8-Pxl3WX27-WXfDjHEwAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 20:44:00.904561 2026] [:error] [pid 24423:tid 24502] [client 147.79.68.118:43096] [client 147.79.68.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 147.79.68.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYiFEE3f9n1Y0TpV5YZsvAAAAJE"]
[Sun Feb 08 20:44:02.240536 2026] [:error] [pid 24423:tid 24485] [client 147.79.68.118:43096] [client 147.79.68.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 147.79.68.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYiFEk3f9n1Y0TpV5YZsvQAAAIA"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 20:57:29.031499 2026] [:error] [pid 24422:tid 24458] [client 15.164.172.90:44638] [client 15.164.172.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.164.172.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYiIOSNNjcLoSCLKhTeONgAAAEA"]
[Sun Feb 08 21:13:43.981393 2026] [:error] [pid 24423:tid 24486] [client 190.92.174.183:48666] [client 190.92.174.183] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.92.174.183, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYiMB03f9n1Y0TpV5YZv9AAAAIE"]
[Sun Feb 08 21:13:44.998682 2026] [:error] [pid 24423:tid 24492] [client 190.92.174.183:48666] [client 190.92.174.183] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.92.174.183, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYiMCE3f9n1Y0TpV5YZv9wAAAIc"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 21:30:44.890811 2026] [:error] [pid 24423:tid 24493] [client 65.254.225.224:53118] [client 65.254.225.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.224, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYiQBE3f9n1Y0TpV5YZzNgAAAIg"]
[Sun Feb 08 21:30:47.273473 2026] [:error] [pid 24421:tid 24431] [client 65.254.225.225:33724] [client 65.254.225.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYiQB6p7cTzhX5M1IP88IgAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 21:34:16.765582 2026] [:error] [pid 24422:tid 24467] [client 15.164.172.90:47606] [client 15.164.172.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.164.172.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYiQ2CNNjcLoSCLKhTeXKAAAAEk"]
[Sun Feb 08 21:34:17.772679 2026] [:error] [pid 24422:tid 24469] [client 15.164.172.90:47606] [client 15.164.172.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.164.172.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYiQ2SNNjcLoSCLKhTeXKgAAAEs"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 21:41:17.494575 2026] [:error] [pid 56906:tid 56923] [client 4.204.8.222:44146] [client 4.204.8.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.204.8.222, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYiSffxl3WX27-WXfDjVVQAAAQ8"]
[Sun Feb 08 21:41:19.459825 2026] [:error] [pid 24530:tid 24554] [client 4.204.8.222:44154] [client 4.204.8.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.204.8.222, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYiSf0azNRCs1GRWrh4mVQAAANY"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 21:54:14.135901 2026] [:error] [pid 24421:tid 24445] [client 157.230.249.241:41218] [client 157.230.249.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.249.241, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYiVhqp7cTzhX5M1IP8_-AAAAA4"]
[Sun Feb 08 21:54:29.805722 2026] [:error] [pid 24530:tid 24542] [client 103.140.205.215:45542] [client 103.140.205.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.140.205.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYiVlUazNRCs1GRWrh4odwAAAMo"]
[Sun Feb 08 21:54:31.265778 2026] [:error] [pid 24530:tid 24533] [client 103.140.205.215:45542] [client 103.140.205.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.140.205.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYiVl0azNRCs1GRWrh4oeAAAAME"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 21:59:52.894514 2026] [:error] [pid 24421:tid 24449] [client 43.159.139.164:37096] [client 43.159.139.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYiW2Kp7cTzhX5M1IP9A2AAAABI"]
[Sun Feb 08 22:05:53.080521 2026] [:error] [pid 56906:tid 56911] [client 216.106.180.52:56374] [client 216.106.180.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.106.180.52, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYiYQfxl3WX27-WXfDjZHQAAAQM"]
[Sun Feb 08 22:05:54.013161 2026] [:error] [pid 56906:tid 56927] [client 216.106.180.52:56374] [client 216.106.180.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.106.180.52, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYiYQvxl3WX27-WXfDjZHgAAARM"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 22:29:24.189687 2026] [:error] [pid 6723:tid 6809] [client 70.68.224.110:57355] [client 70.68.224.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.68.224.110, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYidxDkiu6gHwS33P0p5pQAAA1g"]
[Sun Feb 08 22:29:25.820360 2026] [:error] [pid 43900:tid 43905] [client 70.68.224.110:57400] [client 70.68.224.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.68.224.110, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYidxeWrhnpm_Csk3km3TQAAAUI"], referer: http://expressinteriors.com/wp-login.php
[Sun Feb 08 22:29:57.805527 2026] [:error] [pid 6630:tid 6638] [client 4.204.8.222:55488] [client 4.204.8.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.204.8.222, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYid5Z2jf0FBTEb_cWT7XAAAAgU"]
[Sun Feb 08 22:29:59.806261 2026] [:error] [pid 6723:tid 6795] [client 4.204.8.222:55506] [client 4.204.8.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.204.8.222, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYid5zkiu6gHwS33P0p5xAAAA0o"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 23:09:29.124513 2026] [:error] [pid 6723:tid 6807] [client 195.88.82.88:50187] [client 195.88.82.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.88.82.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYinKTkiu6gHwS33P0p_zwAAA1Y"]
[Sun Feb 08 23:09:34.313786 2026] [:error] [pid 6630:tid 6652] [client 154.222.16.33:36846] [client 154.222.16.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.222.16.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYinLp2jf0FBTEb_cWQBEgAAAhM"]
[Sun Feb 08 23:09:35.869937 2026] [:error] [pid 6663:tid 6701] [client 199.188.199.61:47068] [client 199.188.199.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 199.188.199.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYinL2GI3uHqWdeZM76S_gAAAog"]
[Sun Feb 08 23:10:03.116531 2026] [:error] [pid 24421:tid 24448] [client 143.95.111.157:62344] [client 143.95.111.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.95.111.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYinS6p7cTzhX5M1IP9LKAAAABE"]
[Sun Feb 08 23:10:12.274359 2026] [:error] [pid 9422:tid 9426] [client 34.67.201.23:39910] [client 34.67.201.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.67.201.23, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYinVK9DqDJC68qBbyws9wAAAYE"]
[Sun Feb 08 23:24:52.034138 2026] [:error] [pid 9422:tid 9428] [client 37.187.149.168:51758] [client 37.187.149.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.187.149.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYiqxK9DqDJC68qBbywwUgAAAYM"]
[Sun Feb 08 23:24:54.267671 2026] [:error] [pid 6723:tid 6785] [client 37.187.149.168:51774] [client 37.187.149.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.187.149.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYiqxjkiu6gHwS33P0qCRwAAA0A"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 08 23:30:10.155387 2026] [:error] [pid 6630:tid 6650] [client 37.187.149.168:37120] [client 37.187.149.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.187.149.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYisAp2jf0FBTEb_cWQDzwAAAhE"]
[Mon Feb 09 00:18:25.405325 2026] [:error] [pid 6630:tid 6640] [client 122.51.236.174:46288] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYi3UZ2jf0FBTEb_cWQK2wAAAgc"]
[Mon Feb 09 00:29:23.851827 2026] [:error] [pid 24423:tid 24495] [client 172.96.161.16:53892] [client 172.96.161.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.96.161.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYi5403f9n1Y0TpV5YaG6QAAAIo"]
[Mon Feb 09 00:29:25.636864 2026] [:error] [pid 24423:tid 24488] [client 172.96.161.16:53892] [client 172.96.161.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.96.161.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYi55U3f9n1Y0TpV5YaG6gAAAIM"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 00:47:01.592107 2026] [:error] [pid 9422:tid 9444] [client 37.187.149.168:32822] [client 37.187.149.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.187.149.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYi-Ba9DqDJC68qBbyxD-AAAAZM"]
[Mon Feb 09 00:47:02.573925 2026] [:error] [pid 9422:tid 9431] [client 37.187.149.168:32822] [client 37.187.149.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.187.149.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYi-Bq9DqDJC68qBbyxD-QAAAYY"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 01:20:09.938175 2026] [:error] [pid 6630:tid 6636] [client 49.51.233.95:38926] [client 49.51.233.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYjFyZ2jf0FBTEb_cWQXbQAAAgM"]
[Mon Feb 09 02:07:40.116532 2026] [:error] [pid 24423:tid 24487] [client 211.47.74.19:64583] [client 211.47.74.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 211.47.74.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYjQ7E3f9n1Y0TpV5YaVVgAAAII"]
[Mon Feb 09 02:07:43.465682 2026] [:error] [pid 24423:tid 24486] [client 211.47.74.19:64583] [client 211.47.74.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 211.47.74.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYjQ703f9n1Y0TpV5YaVVwAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 02:16:32.046299 2026] [:error] [pid 6663:tid 6693] [client 195.78.67.29:54354] [client 195.78.67.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.78.67.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYjTAGGI3uHqWdeZM76wHgAAAoA"]
[Mon Feb 09 02:16:33.632687 2026] [:error] [pid 6663:tid 6697] [client 195.78.67.29:54354] [client 195.78.67.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.78.67.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYjTAWGI3uHqWdeZM76wIwAAAoQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 02:34:44.668508 2026] [:error] [pid 43900:tid 43903] [client 37.187.149.168:34150] [client 37.187.149.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.187.149.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYjXROWrhnpm_Csk3kneXwAAAUA"]
[Mon Feb 09 02:34:45.993209 2026] [:error] [pid 43900:tid 43925] [client 37.187.149.168:34150] [client 37.187.149.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.187.149.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYjXReWrhnpm_Csk3kneYgAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 03:01:22.436711 2026] [:error] [pid 24530:tid 24553] [client 98.159.233.69:56921] [client 98.159.233.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.159.233.69, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYjdgkazNRCs1GRWrh5PjgAAANU"], referer: https://expressinteriors.com/
[Mon Feb 09 03:17:29.336416 2026] [:error] [pid 6662:tid 6684] [client 65.254.225.212:34390] [client 65.254.225.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYjhSd-oEK1ut16KiNI03QAAAlI"]
[Mon Feb 09 03:17:30.254303 2026] [:error] [pid 6662:tid 6668] [client 65.254.225.212:34390] [client 65.254.225.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYjhSt-oEK1ut16KiNI03gAAAkI"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 03:21:31.159513 2026] [:error] [pid 43900:tid 43923] [client 193.202.110.28:55880] [client 193.202.110.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.202.110.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYjiO-Wrhnpm_Csk3knurQAAAVQ"]
[Mon Feb 09 03:21:34.303802 2026] [:error] [pid 6723:tid 6803] [client 47.106.140.4:34562] [client 47.106.140.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.106.140.4, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYjiPjkiu6gHwS33P0qyegAAA1I"]
[Mon Feb 09 03:21:47.794471 2026] [:error] [pid 6630:tid 6640] [client 129.146.65.146:33840] [client 129.146.65.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.146.65.146, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYjiS52jf0FBTEb_cWQs7wAAAgc"]
[Mon Feb 09 03:21:54.349354 2026] [:error] [pid 24530:tid 24543] [client 193.202.110.29:35908] [client 193.202.110.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.202.110.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYjiUkazNRCs1GRWrh5SrgAAAMs"]
[Mon Feb 09 03:22:10.286129 2026] [:error] [pid 43900:tid 43917] [client 77.92.144.132:34588] [client 77.92.144.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.92.144.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYjiYuWrhnpm_Csk3knvBAAAAU4"]
[Mon Feb 09 03:29:52.362997 2026] [:error] [pid 6663:tid 6695] [client 104.243.34.108:60472] [client 104.243.34.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.243.34.108, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYjkMGGI3uHqWdeZM77ErgAAAoI"]
[Mon Feb 09 03:29:53.251632 2026] [:error] [pid 6663:tid 6717] [client 104.243.34.108:60472] [client 104.243.34.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.243.34.108, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYjkMWGI3uHqWdeZM77ErwAAApg"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 03:48:45.072088 2026] [:error] [pid 48044:tid 48052] [client 190.107.177.235:52010] [client 190.107.177.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.107.177.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYjonZvmvsMP5E03sZKXdgAAAMY"]
[Mon Feb 09 03:48:47.164069 2026] [:error] [pid 48044:tid 48050] [client 190.107.177.235:52010] [client 190.107.177.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.107.177.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYjon5vmvsMP5E03sZKXfgAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 03:53:05.294152 2026] [:error] [pid 47938:tid 47994] [client 47.82.118.63:60162] [client 47.82.118.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.82.118.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYjpobVCzWE6fQJEkNLxxgAAAE8"]
[Mon Feb 09 03:53:08.129074 2026] [:error] [pid 47938:tid 47982] [client 159.89.182.203:41340] [client 159.89.182.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.182.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYjppLVCzWE6fQJEkNLx1wAAAEM"]
[Mon Feb 09 03:53:18.027775 2026] [:error] [pid 47937:tid 47951] [client 50.116.24.118:58446] [client 50.116.24.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.116.24.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYjprs4Fd42MP2DhNrX3QAAAAAU"]
[Mon Feb 09 03:59:15.509058 2026] [autoindex:error] [pid 47938:tid 47996] [client 20.48.253.154:36387] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 09 03:59:15.744812 2026] [:error] [pid 47938:tid 47986] [client 20.48.253.154:36387] [client 20.48.253.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/moon.php"] [unique_id "aYjrE7VCzWE6fQJEkNL0KQAAAEc"]
[Mon Feb 09 03:59:19.039338 2026] [:error] [pid 47938:tid 47992] [client 20.48.253.154:26066] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zaa.php"] [unique_id "aYjrF7VCzWE6fQJEkNL0OAAAAE0"]
[Mon Feb 09 03:59:20.940914 2026] [:error] [pid 47939:tid 48018] [client 20.48.253.154:26076] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zaa.php"] [unique_id "aYjrGNkpZei8M7cJ2z0UfwAAAIw"]
[Mon Feb 09 03:59:21.889952 2026] [:error] [pid 47937:tid 47952] [client 20.48.253.154:16376] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zaa.php"] [unique_id "aYjrGc4Fd42MP2DhNrX5RQAAAAY"]
[Mon Feb 09 03:59:23.975444 2026] [:error] [pid 48044:tid 48057] [client 20.48.253.154:36368] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zaa.php"] [unique_id "aYjrG5vmvsMP5E03sZKc4QAAAMs"]
[Mon Feb 09 03:59:26.211017 2026] [:error] [pid 47938:tid 48002] [client 20.48.253.154:36390] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-miiss.php.php"] [unique_id "aYjrHrVCzWE6fQJEkNL0RQAAAFc"]
[Mon Feb 09 03:59:27.371712 2026] [:error] [pid 47938:tid 47989] [client 20.48.253.154:36359] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-miiss.php.php"] [unique_id "aYjrH7VCzWE6fQJEkNL0SQAAAEo"]
[Mon Feb 09 03:59:27.961719 2026] [:error] [pid 47939:tid 48009] [client 20.48.253.154:36395] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-miiss.php.php"] [unique_id "aYjrH9kpZei8M7cJ2z0UlAAAAIM"]
[Mon Feb 09 03:59:28.561699 2026] [:error] [pid 48044:tid 48063] [client 20.48.253.154:36412] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-miiss.php.php"] [unique_id "aYjrIJvmvsMP5E03sZKc7wAAANE"]
[Mon Feb 09 03:59:29.046330 2026] [:error] [pid 48044:tid 48062] [client 20.48.253.154:36383] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aYjrIZvmvsMP5E03sZKc8gAAANA"]
[Mon Feb 09 03:59:29.698959 2026] [:error] [pid 48044:tid 48064] [client 20.48.253.154:26090] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aYjrIZvmvsMP5E03sZKc9gAAANI"]
[Mon Feb 09 03:59:30.393151 2026] [:error] [pid 48044:tid 48069] [client 20.48.253.154:26064] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aYjrIpvmvsMP5E03sZKc-AAAANc"]
[Mon Feb 09 03:59:32.042474 2026] [:error] [pid 47938:tid 47985] [client 20.48.253.154:26069] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aYjrJLVCzWE6fQJEkNL0VwAAAEY"]
[Mon Feb 09 03:59:33.286939 2026] [:error] [pid 48044:tid 48062] [client 20.48.253.154:36415] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "aYjrJZvmvsMP5E03sZKdAAAAANA"]
[Mon Feb 09 03:59:34.416563 2026] [:error] [pid 47939:tid 48011] [client 20.48.253.154:36385] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "aYjrJtkpZei8M7cJ2z0UoAAAAIU"]
[Mon Feb 09 03:59:35.765722 2026] [:error] [pid 48044:tid 48057] [client 20.48.253.154:36358] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "aYjrJ5vmvsMP5E03sZKdAwAAAMs"]
[Mon Feb 09 03:59:36.458588 2026] [:error] [pid 47937:tid 47954] [client 20.48.253.154:36364] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "aYjrKM4Fd42MP2DhNrX5aQAAAAg"]
[Mon Feb 09 03:59:37.580461 2026] [:error] [pid 47939:tid 48012] [client 20.48.253.154:36362] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/install.php"] [unique_id "aYjrKdkpZei8M7cJ2z0UqAAAAIY"]
[Mon Feb 09 03:59:39.539754 2026] [:error] [pid 47939:tid 48017] [client 20.48.253.154:26062] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/install.php"] [unique_id "aYjrK9kpZei8M7cJ2z0UqgAAAIs"]
[Mon Feb 09 03:59:41.569968 2026] [:error] [pid 47938:tid 47983] [client 20.48.253.154:26093] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/install.php"] [unique_id "aYjrLbVCzWE6fQJEkNL0bwAAAEQ"]
[Mon Feb 09 03:59:43.371394 2026] [:error] [pid 47939:tid 48023] [client 20.48.253.154:36366] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/install.php"] [unique_id "aYjrL9kpZei8M7cJ2z0UswAAAJE"]
[Mon Feb 09 03:59:44.723785 2026] [:error] [pid 47938:tid 48000] [client 20.48.253.154:36411] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aYjrMLVCzWE6fQJEkNL0dgAAAFU"]
[Mon Feb 09 03:59:45.665367 2026] [:error] [pid 48044:tid 48066] [client 20.48.253.154:36411] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aYjrMZvmvsMP5E03sZKdFwAAANQ"]
[Mon Feb 09 03:59:46.526088 2026] [:error] [pid 48044:tid 48065] [client 20.48.253.154:26067] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aYjrMpvmvsMP5E03sZKdGgAAANM"]
[Mon Feb 09 03:59:47.171172 2026] [:error] [pid 47939:tid 48015] [client 20.48.253.154:36403] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aYjrM9kpZei8M7cJ2z0UvwAAAIk"]
[Mon Feb 09 03:59:48.070794 2026] [:error] [pid 47939:tid 48009] [client 20.48.253.154:36375] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aYjrNNkpZei8M7cJ2z0UwgAAAIM"]
[Mon Feb 09 03:59:48.851116 2026] [:error] [pid 47939:tid 48019] [client 20.48.253.154:36379] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aYjrNNkpZei8M7cJ2z0UyQAAAI0"]
[Mon Feb 09 03:59:49.509986 2026] [:error] [pid 47937:tid 47953] [client 20.48.253.154:36398] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aYjrNc4Fd42MP2DhNrX5ggAAAAc"]
[Mon Feb 09 03:59:50.121087 2026] [:error] [pid 48044:tid 48048] [client 20.48.253.154:26098] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aYjrNpvmvsMP5E03sZKdIwAAAMI"]
[Mon Feb 09 03:59:50.793704 2026] [:error] [pid 47937:tid 47959] [client 20.48.253.154:26055] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ma.php"] [unique_id "aYjrNs4Fd42MP2DhNrX5hgAAAA0"]
[Mon Feb 09 03:59:51.831161 2026] [:error] [pid 48044:tid 48046] [client 20.48.253.154:36353] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ma.php"] [unique_id "aYjrN5vmvsMP5E03sZKdLQAAAMA"]
[Mon Feb 09 03:59:52.375395 2026] [:error] [pid 47937:tid 47947] [client 20.48.253.154:16336] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ma.php"] [unique_id "aYjrOM4Fd42MP2DhNrX5iQAAAAE"]
[Mon Feb 09 03:59:52.886374 2026] [:error] [pid 48044:tid 48061] [client 20.48.253.154:26092] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ma.php"] [unique_id "aYjrOJvmvsMP5E03sZKdMgAAAM8"]
[Mon Feb 09 03:59:53.378603 2026] [:error] [pid 47937:tid 47964] [client 20.48.253.154:26048] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fetch.php"] [unique_id "aYjrOc4Fd42MP2DhNrX5jAAAABI"]
[Mon Feb 09 03:59:53.929132 2026] [:error] [pid 47937:tid 47949] [client 20.48.253.154:26106] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fetch.php"] [unique_id "aYjrOc4Fd42MP2DhNrX5jgAAAAM"]
[Mon Feb 09 03:59:54.425378 2026] [:error] [pid 47937:tid 47965] [client 20.48.253.154:16342] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fetch.php"] [unique_id "aYjrOs4Fd42MP2DhNrX5kQAAABM"]
[Mon Feb 09 03:59:54.981523 2026] [:error] [pid 47938:tid 47998] [client 20.48.253.154:36397] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fetch.php"] [unique_id "aYjrOrVCzWE6fQJEkNL0hgAAAFM"]
[Mon Feb 09 03:59:55.415058 2026] [:error] [pid 47938:tid 47982] [client 20.48.253.154:36407] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2.php"] [unique_id "aYjrO7VCzWE6fQJEkNL0hwAAAEM"]
[Mon Feb 09 03:59:56.178705 2026] [:error] [pid 48044:tid 48069] [client 20.48.253.154:26110] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2.php"] [unique_id "aYjrPJvmvsMP5E03sZKdPgAAANc"]
[Mon Feb 09 03:59:56.633031 2026] [:error] [pid 47939:tid 48027] [client 20.48.253.154:26087] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2.php"] [unique_id "aYjrPNkpZei8M7cJ2z0U3AAAAJU"]
[Mon Feb 09 03:59:57.340699 2026] [:error] [pid 48044:tid 48051] [client 20.48.253.154:26050] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2.php"] [unique_id "aYjrPZvmvsMP5E03sZKdQgAAAMU"]
[Mon Feb 09 03:59:57.866437 2026] [:error] [pid 48044:tid 48050] [client 20.48.253.154:16332] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "aYjrPZvmvsMP5E03sZKdRQAAAMQ"]
[Mon Feb 09 03:59:58.472895 2026] [:error] [pid 48044:tid 48058] [client 20.48.253.154:36389] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "aYjrPpvmvsMP5E03sZKdSQAAAMw"]
[Mon Feb 09 03:59:58.960436 2026] [:error] [pid 48044:tid 48053] [client 20.48.253.154:26074] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "aYjrPpvmvsMP5E03sZKdTQAAAMc"]
[Mon Feb 09 03:59:59.390824 2026] [:error] [pid 47937:tid 47958] [client 20.48.253.154:36355] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "aYjrP84Fd42MP2DhNrX5mgAAAAw"]
[Mon Feb 09 03:59:59.905280 2026] [:error] [pid 47938:tid 47980] [client 20.48.253.154:36377] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aYjrP7VCzWE6fQJEkNL0jwAAAEE"]
[Mon Feb 09 04:00:00.330910 2026] [:error] [pid 48044:tid 48056] [client 20.48.253.154:36399] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aYjrQJvmvsMP5E03sZKdUQAAAMo"]
[Mon Feb 09 04:00:00.769646 2026] [:error] [pid 47939:tid 48019] [client 20.48.253.154:36388] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aYjrQNkpZei8M7cJ2z0U4wAAAI0"]
[Mon Feb 09 04:00:01.303708 2026] [:error] [pid 48044:tid 48059] [client 20.48.253.154:26070] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aYjrQZvmvsMP5E03sZKdVQAAAM0"]
[Mon Feb 09 04:00:01.740624 2026] [:error] [pid 47938:tid 48003] [client 20.48.253.154:36405] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.trash7309/f/"] [unique_id "aYjrQbVCzWE6fQJEkNL0lAAAAFg"]
[Mon Feb 09 04:00:02.214842 2026] [:error] [pid 47937:tid 47962] [client 20.48.253.154:36357] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.trash7309/f/"] [unique_id "aYjrQs4Fd42MP2DhNrX5oAAAABA"]
[Mon Feb 09 04:00:02.732591 2026] [:error] [pid 47938:tid 47996] [client 20.48.253.154:36414] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.trash7309/f/"] [unique_id "aYjrQrVCzWE6fQJEkNL0mQAAAFE"]
[Mon Feb 09 04:00:03.157411 2026] [:error] [pid 47938:tid 48000] [client 20.48.253.154:16343] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.trash7309/f/"] [unique_id "aYjrQ7VCzWE6fQJEkNL0mwAAAFU"]
[Mon Feb 09 04:00:03.582686 2026] [:error] [pid 47939:tid 48006] [client 20.48.253.154:26059] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/des.php"] [unique_id "aYjrQ9kpZei8M7cJ2z0U6AAAAIA"]
[Mon Feb 09 04:00:04.102602 2026] [:error] [pid 48044:tid 48070] [client 20.48.253.154:26060] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/des.php"] [unique_id "aYjrRJvmvsMP5E03sZKdWgAAANg"]
[Mon Feb 09 04:00:04.562407 2026] [:error] [pid 48044:tid 48056] [client 20.48.253.154:16322] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/des.php"] [unique_id "aYjrRJvmvsMP5E03sZKdXAAAAMo"]
[Mon Feb 09 04:00:05.084133 2026] [:error] [pid 47938:tid 48003] [client 20.48.253.154:16371] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/des.php"] [unique_id "aYjrRbVCzWE6fQJEkNL0ngAAAFg"]
[Mon Feb 09 04:00:05.954299 2026] [:error] [pid 47937:tid 47960] [client 20.48.253.154:36361] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mans.php"] [unique_id "aYjrRc4Fd42MP2DhNrX5qgAAAA4"]
[Mon Feb 09 04:00:07.100076 2026] [:error] [pid 47937:tid 47966] [client 20.48.253.154:36363] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mans.php"] [unique_id "aYjrR84Fd42MP2DhNrX5rQAAABQ"]
[Mon Feb 09 04:00:09.068164 2026] [:error] [pid 47938:tid 47999] [client 20.48.253.154:26094] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mans.php"] [unique_id "aYjrSbVCzWE6fQJEkNL0pQAAAFQ"]
[Mon Feb 09 04:00:12.103485 2026] [:error] [pid 48044:tid 48060] [client 20.48.253.154:26052] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mans.php"] [unique_id "aYjrTJvmvsMP5E03sZKdbgAAAM4"]
[Mon Feb 09 04:00:14.193011 2026] [:error] [pid 47939:tid 48010] [client 20.48.253.154:26049] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aYjrTtkpZei8M7cJ2z0VAgAAAIQ"]
[Mon Feb 09 04:00:15.532642 2026] [:error] [pid 48044:tid 48046] [client 20.48.253.154:36352] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aYjrT5vmvsMP5E03sZKdegAAAMA"]
[Mon Feb 09 04:00:16.640785 2026] [:error] [pid 48044:tid 48067] [client 20.48.253.154:36372] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aYjrUJvmvsMP5E03sZKdfgAAANU"]
[Mon Feb 09 04:00:35.009088 2026] [:error] [pid 47937:tid 47946] [client 20.48.253.154:26108] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/configuration.php"] [unique_id "aYjrY84Fd42MP2DhNrX6AAAAAAA"]
[Mon Feb 09 04:00:36.513984 2026] [:error] [pid 47938:tid 47999] [client 20.48.253.154:36401] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/configuration.php"] [unique_id "aYjrZLVCzWE6fQJEkNL02gAAAFQ"]
[Mon Feb 09 04:00:37.238327 2026] [:error] [pid 47937:tid 47966] [client 20.48.253.154:36381] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/configuration.php"] [unique_id "aYjrZc4Fd42MP2DhNrX6CQAAABQ"]
[Mon Feb 09 04:00:38.492045 2026] [:error] [pid 47937:tid 47958] [client 20.48.253.154:26063] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/configuration.php"] [unique_id "aYjrZs4Fd42MP2DhNrX6CwAAAAw"]
[Mon Feb 09 04:00:39.503909 2026] [:error] [pid 47937:tid 47970] [client 20.48.253.154:26058] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.kb.php"] [unique_id "aYjrZ84Fd42MP2DhNrX6DgAAABg"]
[Mon Feb 09 04:00:40.166489 2026] [:error] [pid 47939:tid 48015] [client 20.48.253.154:36370] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.kb.php"] [unique_id "aYjraNkpZei8M7cJ2z0VPQAAAIk"]
[Mon Feb 09 04:00:40.668645 2026] [:error] [pid 47937:tid 47949] [client 20.48.253.154:16324] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.kb.php"] [unique_id "aYjraM4Fd42MP2DhNrX6EwAAAAM"]
[Mon Feb 09 04:00:41.354178 2026] [:error] [pid 47939:tid 48021] [client 20.48.253.154:16329] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.kb.php"] [unique_id "aYjradkpZei8M7cJ2z0VPwAAAI8"]
[Mon Feb 09 04:00:41.900794 2026] [:error] [pid 48044:tid 48070] [client 20.48.253.154:26065] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rip.php"] [unique_id "aYjraZvmvsMP5E03sZKd1gAAANg"]
[Mon Feb 09 04:00:42.512722 2026] [:error] [pid 47938:tid 47990] [client 20.48.253.154:26068] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rip.php"] [unique_id "aYjrarVCzWE6fQJEkNL05wAAAEs"]
[Mon Feb 09 04:00:43.083017 2026] [:error] [pid 48044:tid 48052] [client 20.48.253.154:26065] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rip.php"] [unique_id "aYjra5vmvsMP5E03sZKd2wAAAMY"]
[Mon Feb 09 04:00:43.544938 2026] [:error] [pid 47938:tid 47993] [client 20.48.253.154:16344] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rip.php"] [unique_id "aYjra7VCzWE6fQJEkNL06wAAAE4"]
[Mon Feb 09 04:00:44.103655 2026] [:error] [pid 47939:tid 48027] [client 20.48.253.154:26077] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/achdxhv/languages/admin.php"] [unique_id "aYjrbNkpZei8M7cJ2z0VRwAAAJU"]
[Mon Feb 09 04:00:44.536740 2026] [:error] [pid 47939:tid 48024] [client 20.48.253.154:16357] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/achdxhv/languages/admin.php"] [unique_id "aYjrbNkpZei8M7cJ2z0VSQAAAJI"]
[Mon Feb 09 04:00:44.987151 2026] [:error] [pid 48044:tid 48050] [client 20.48.253.154:16280] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/achdxhv/languages/admin.php"] [unique_id "aYjrbJvmvsMP5E03sZKd3AAAAMQ"]
[Mon Feb 09 04:00:45.408762 2026] [:error] [pid 48044:tid 48059] [client 20.48.253.154:26099] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/achdxhv/languages/admin.php"] [unique_id "aYjrbZvmvsMP5E03sZKd3wAAAM0"]
[Mon Feb 09 04:00:45.997217 2026] [:error] [pid 48044:tid 48069] [client 20.48.253.154:36400] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "aYjrbZvmvsMP5E03sZKd4QAAANc"]
[Mon Feb 09 04:00:46.436872 2026] [:error] [pid 48044:tid 48058] [client 20.48.253.154:16350] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "aYjrbpvmvsMP5E03sZKd4gAAAMw"]
[Mon Feb 09 04:00:46.872509 2026] [:error] [pid 47938:tid 47996] [client 20.48.253.154:16352] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "aYjrbrVCzWE6fQJEkNL08QAAAFE"]
[Mon Feb 09 04:00:47.366638 2026] [:error] [pid 47937:tid 47959] [client 20.48.253.154:36410] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "aYjrb84Fd42MP2DhNrX6IQAAAA0"]
[Mon Feb 09 04:00:47.816412 2026] [:error] [pid 47937:tid 47949] [client 20.48.253.154:26071] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "aYjrb84Fd42MP2DhNrX6JQAAAAM"]
[Mon Feb 09 04:00:48.265245 2026] [:error] [pid 48044:tid 48048] [client 20.48.253.154:16277] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "aYjrcJvmvsMP5E03sZKd5wAAAMI"]
[Mon Feb 09 04:00:48.685152 2026] [:error] [pid 47939:tid 48011] [client 20.48.253.154:26081] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "aYjrcNkpZei8M7cJ2z0VVQAAAIU"]
[Mon Feb 09 04:00:49.137000 2026] [:error] [pid 47937:tid 47951] [client 20.48.253.154:36392] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "aYjrcc4Fd42MP2DhNrX6KAAAAAU"]
[Mon Feb 09 04:00:49.576398 2026] [:error] [pid 47938:tid 47988] [client 20.48.253.154:16199] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lp6.php"] [unique_id "aYjrcbVCzWE6fQJEkNL0-QAAAEk"]
[Mon Feb 09 04:00:50.011146 2026] [:error] [pid 47938:tid 47985] [client 20.48.253.154:26080] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lp6.php"] [unique_id "aYjrcrVCzWE6fQJEkNL0-gAAAEY"]
[Mon Feb 09 04:00:50.459197 2026] [:error] [pid 47938:tid 47994] [client 20.48.253.154:36393] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lp6.php"] [unique_id "aYjrcrVCzWE6fQJEkNL0-wAAAE8"]
[Mon Feb 09 04:00:50.892758 2026] [:error] [pid 48044:tid 48069] [client 20.48.253.154:36391] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lp6.php"] [unique_id "aYjrcpvmvsMP5E03sZKd7QAAANc"]
[Mon Feb 09 04:00:51.342294 2026] [:error] [pid 47937:tid 47950] [client 20.48.253.154:26088] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/"] [unique_id "aYjrc84Fd42MP2DhNrX6LAAAAAQ"]
[Mon Feb 09 04:00:51.858160 2026] [:error] [pid 47937:tid 47965] [client 20.48.253.154:36360] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/"] [unique_id "aYjrc84Fd42MP2DhNrX6LQAAABM"]
[Mon Feb 09 04:00:52.411220 2026] [:error] [pid 47938:tid 47981] [client 20.48.253.154:26079] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/"] [unique_id "aYjrdLVCzWE6fQJEkNL1AQAAAEI"]
[Mon Feb 09 04:00:52.920968 2026] [:error] [pid 47937:tid 47948] [client 20.48.253.154:26086] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/"] [unique_id "aYjrdM4Fd42MP2DhNrX6LwAAAAI"]
[Mon Feb 09 04:00:53.357212 2026] [:error] [pid 47939:tid 48014] [client 20.48.253.154:36413] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bk.php"] [unique_id "aYjrddkpZei8M7cJ2z0VXwAAAIg"]
[Mon Feb 09 04:00:54.025585 2026] [:error] [pid 47938:tid 47995] [client 20.48.253.154:26073] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bk.php"] [unique_id "aYjrdrVCzWE6fQJEkNL1CAAAAFA"]
[Mon Feb 09 04:00:54.829106 2026] [:error] [pid 47938:tid 47991] [client 20.48.253.154:36374] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bk.php"] [unique_id "aYjrdrVCzWE6fQJEkNL1CQAAAEw"]
[Mon Feb 09 04:00:55.260969 2026] [:error] [pid 47938:tid 47987] [client 20.48.253.154:36408] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bk.php"] [unique_id "aYjrd7VCzWE6fQJEkNL1CwAAAEg"]
[Mon Feb 09 04:00:55.852355 2026] [:error] [pid 47937:tid 47946] [client 20.48.253.154:16325] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aYjrd84Fd42MP2DhNrX6NAAAAAA"]
[Mon Feb 09 04:00:56.291214 2026] [:error] [pid 47937:tid 47955] [client 20.48.253.154:26095] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aYjreM4Fd42MP2DhNrX6NgAAAAk"]
[Mon Feb 09 04:00:56.805868 2026] [:error] [pid 47938:tid 47985] [client 20.48.253.154:16271] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aYjreLVCzWE6fQJEkNL1EAAAAEY"]
[Mon Feb 09 04:00:57.458027 2026] [:error] [pid 47937:tid 47961] [client 20.48.253.154:16330] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aYjrec4Fd42MP2DhNrX6OQAAAA8"]
[Mon Feb 09 04:00:58.233824 2026] [:error] [pid 47939:tid 48029] [client 20.48.253.154:36386] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aYjretkpZei8M7cJ2z0VZgAAAJc"]
[Mon Feb 09 04:00:59.445031 2026] [:error] [pid 48044:tid 48051] [client 20.48.253.154:16230] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aYjre5vmvsMP5E03sZKd_QAAAMU"]
[Mon Feb 09 04:01:00.404712 2026] [:error] [pid 47938:tid 47997] [client 20.48.253.154:16334] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aYjrfLVCzWE6fQJEkNL1GQAAAFI"]
[Mon Feb 09 04:01:01.184978 2026] [:error] [pid 48044:tid 48065] [client 20.48.253.154:16349] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aYjrfZvmvsMP5E03sZKeAQAAANM"]
[Mon Feb 09 04:01:02.733118 2026] [:error] [pid 48044:tid 48047] [client 20.48.253.154:26089] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/skin/install/default/security.php"] [unique_id "aYjrfpvmvsMP5E03sZKeBAAAAME"]
[Mon Feb 09 04:01:03.871221 2026] [:error] [pid 48044:tid 48046] [client 20.48.253.154:16212] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/skin/install/default/security.php"] [unique_id "aYjrf5vmvsMP5E03sZKeCAAAAMA"]
[Mon Feb 09 04:01:05.220282 2026] [:error] [pid 48044:tid 48056] [client 20.48.253.154:26075] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/skin/install/default/security.php"] [unique_id "aYjrgZvmvsMP5E03sZKeCwAAAMo"]
[Mon Feb 09 04:01:06.977376 2026] [:error] [pid 48044:tid 48063] [client 20.48.253.154:16364] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/skin/install/default/security.php"] [unique_id "aYjrgpvmvsMP5E03sZKeEgAAANE"]
[Mon Feb 09 04:01:08.724652 2026] [:error] [pid 47938:tid 47985] [client 20.48.253.154:36394] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/WordPress/x/"] [unique_id "aYjrhLVCzWE6fQJEkNL1KQAAAEY"]
[Mon Feb 09 04:01:09.493677 2026] [:error] [pid 47939:tid 48011] [client 20.48.253.154:16353] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/WordPress/x/"] [unique_id "aYjrhdkpZei8M7cJ2z0VgQAAAIU"]
[Mon Feb 09 04:01:10.912827 2026] [:error] [pid 48044:tid 48047] [client 20.48.253.154:36404] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/WordPress/x/"] [unique_id "aYjrhpvmvsMP5E03sZKeGwAAAME"]
[Mon Feb 09 04:01:11.902900 2026] [:error] [pid 47939:tid 48010] [client 20.48.253.154:16365] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/WordPress/x/"] [unique_id "aYjrh9kpZei8M7cJ2z0VhQAAAIQ"]
[Mon Feb 09 04:01:12.571526 2026] [:error] [pid 48044:tid 48067] [client 20.48.253.154:16289] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aYjriJvmvsMP5E03sZKeIAAAANU"]
[Mon Feb 09 04:01:13.513779 2026] [:error] [pid 47938:tid 47999] [client 20.48.253.154:16340] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aYjribVCzWE6fQJEkNL1NAAAAFQ"]
[Mon Feb 09 04:01:14.421320 2026] [:error] [pid 47938:tid 47995] [client 20.48.253.154:16258] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aYjrirVCzWE6fQJEkNL1NwAAAFA"]
[Mon Feb 09 04:01:15.020878 2026] [:error] [pid 47938:tid 48003] [client 20.48.253.154:16355] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aYjri7VCzWE6fQJEkNL1OAAAAFg"]
[Mon Feb 09 04:01:15.766523 2026] [:error] [pid 47938:tid 47982] [client 20.48.253.154:16360] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ap.php"] [unique_id "aYjri7VCzWE6fQJEkNL1OwAAAEM"]
[Mon Feb 09 04:01:16.243004 2026] [:error] [pid 47937:tid 47947] [client 20.48.253.154:36396] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ap.php"] [unique_id "aYjrjM4Fd42MP2DhNrX6XgAAAAE"]
[Mon Feb 09 04:01:16.805998 2026] [:error] [pid 47938:tid 47989] [client 20.48.253.154:16304] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ap.php"] [unique_id "aYjrjLVCzWE6fQJEkNL1PQAAAEo"]
[Mon Feb 09 04:01:17.365825 2026] [:error] [pid 47937:tid 47967] [client 20.48.253.154:16369] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ap.php"] [unique_id "aYjrjc4Fd42MP2DhNrX6XwAAABU"]
[Mon Feb 09 04:01:17.792451 2026] [:error] [pid 48044:tid 48069] [client 20.48.253.154:26085] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aYjrjZvmvsMP5E03sZKeKwAAANc"]
[Mon Feb 09 04:01:18.269953 2026] [:error] [pid 47939:tid 48022] [client 20.48.253.154:16308] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aYjrjtkpZei8M7cJ2z0VkgAAAJA"]
[Mon Feb 09 04:01:18.746152 2026] [:error] [pid 47937:tid 47961] [client 20.48.253.154:16367] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aYjrjs4Fd42MP2DhNrX6YwAAAA8"]
[Mon Feb 09 04:01:19.231880 2026] [:error] [pid 47939:tid 48020] [client 20.48.253.154:16338] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aYjrj9kpZei8M7cJ2z0VlQAAAI4"]
[Mon Feb 09 04:01:19.831826 2026] [:error] [pid 47937:tid 47954] [client 20.48.253.154:26051] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clasa99.php"] [unique_id "aYjrj84Fd42MP2DhNrX6aQAAAAg"]
[Mon Feb 09 04:01:20.300269 2026] [:error] [pid 47939:tid 48016] [client 20.48.253.154:36406] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clasa99.php"] [unique_id "aYjrkNkpZei8M7cJ2z0VlwAAAIo"]
[Mon Feb 09 04:01:20.882828 2026] [:error] [pid 47939:tid 48013] [client 20.48.253.154:16285] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clasa99.php"] [unique_id "aYjrkNkpZei8M7cJ2z0VnAAAAIc"]
[Mon Feb 09 04:01:21.400717 2026] [:error] [pid 48044:tid 48066] [client 20.48.253.154:16321] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clasa99.php"] [unique_id "aYjrkZvmvsMP5E03sZKeLQAAANQ"]
[Mon Feb 09 04:01:21.866636 2026] [:error] [pid 47937:tid 47965] [client 20.48.253.154:36384] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "aYjrkc4Fd42MP2DhNrX6bgAAABM"]
[Mon Feb 09 04:01:22.343971 2026] [:error] [pid 47937:tid 47970] [client 20.48.253.154:16193] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "aYjrks4Fd42MP2DhNrX6cAAAABg"]
[Mon Feb 09 04:01:22.843372 2026] [:error] [pid 47939:tid 48020] [client 20.48.253.154:16288] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "aYjrktkpZei8M7cJ2z0VoAAAAI4"]
[Mon Feb 09 04:01:23.319414 2026] [:error] [pid 47939:tid 48016] [client 20.48.253.154:16337] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "aYjrk9kpZei8M7cJ2z0VoQAAAIo"]
[Mon Feb 09 04:01:23.757491 2026] [:error] [pid 47939:tid 48013] [client 20.48.253.154:16356] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assacc.php"] [unique_id "aYjrk9kpZei8M7cJ2z0VpgAAAIc"]
[Mon Feb 09 04:01:24.199756 2026] [:error] [pid 47939:tid 48010] [client 20.48.253.154:36354] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assacc.php"] [unique_id "aYjrlNkpZei8M7cJ2z0VqAAAAIQ"]
[Mon Feb 09 04:01:24.700688 2026] [:error] [pid 47938:tid 47993] [client 20.48.253.154:16375] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assacc.php"] [unique_id "aYjrlLVCzWE6fQJEkNL1TAAAAE4"]
[Mon Feb 09 04:01:25.138480 2026] [:error] [pid 48044:tid 48063] [client 20.48.253.154:26078] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assacc.php"] [unique_id "aYjrlZvmvsMP5E03sZKeNAAAANE"]
[Mon Feb 09 04:01:25.581564 2026] [:error] [pid 47937:tid 47949] [client 20.48.253.154:36356] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hzz.php"] [unique_id "aYjrlc4Fd42MP2DhNrX6dQAAAAM"]
[Mon Feb 09 04:01:26.131291 2026] [:error] [pid 48044:tid 48059] [client 20.48.253.154:16346] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hzz.php"] [unique_id "aYjrlpvmvsMP5E03sZKeOgAAAM0"]
[Mon Feb 09 04:01:26.682894 2026] [:error] [pid 48044:tid 48049] [client 20.48.253.154:36378] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hzz.php"] [unique_id "aYjrlpvmvsMP5E03sZKePQAAAMM"]
[Mon Feb 09 04:01:27.379222 2026] [:error] [pid 47937:tid 47946] [client 20.48.253.154:16347] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hzz.php"] [unique_id "aYjrl84Fd42MP2DhNrX6fAAAAAA"]
[Mon Feb 09 04:01:28.054714 2026] [:error] [pid 47939:tid 48019] [client 20.48.253.154:36402] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/~norapump/hah.php"] [unique_id "aYjrmNkpZei8M7cJ2z0VrgAAAI0"]
[Mon Feb 09 04:01:28.704235 2026] [:error] [pid 47939:tid 48030] [client 20.48.253.154:16306] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/~norapump/hah.php"] [unique_id "aYjrmNkpZei8M7cJ2z0VsAAAAJg"]
[Mon Feb 09 04:01:29.360783 2026] [:error] [pid 47939:tid 48023] [client 20.48.253.154:26096] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/~norapump/hah.php"] [unique_id "aYjrmdkpZei8M7cJ2z0VsgAAAJE"]
[Mon Feb 09 04:01:30.313119 2026] [:error] [pid 47939:tid 48024] [client 20.48.253.154:16341] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/~norapump/hah.php"] [unique_id "aYjrmtkpZei8M7cJ2z0VtAAAAJI"]
[Mon Feb 09 04:01:31.053479 2026] [:error] [pid 47938:tid 48002] [client 20.48.253.154:26057] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system.php"] [unique_id "aYjrm7VCzWE6fQJEkNL1WAAAAFc"]
[Mon Feb 09 04:01:32.557828 2026] [:error] [pid 47938:tid 47984] [client 20.48.253.154:36373] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system.php"] [unique_id "aYjrnLVCzWE6fQJEkNL1XAAAAEU"]
[Mon Feb 09 04:01:33.264640 2026] [:error] [pid 47939:tid 48008] [client 20.48.253.154:26061] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system.php"] [unique_id "aYjrndkpZei8M7cJ2z0VugAAAII"]
[Mon Feb 09 04:01:33.772627 2026] [:error] [pid 47937:tid 47967] [client 20.48.253.154:16318] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system.php"] [unique_id "aYjrnc4Fd42MP2DhNrX6jwAAABU"]
[Mon Feb 09 04:01:48.184219 2026] [:error] [pid 48044:tid 48060] [client 20.48.253.154:26091] [client 20.48.253.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aYjrrJvmvsMP5E03sZKecQAAAM4"]
[Mon Feb 09 04:01:50.006951 2026] [:error] [pid 48044:tid 48068] [client 20.48.253.154:26102] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aYjrrpvmvsMP5E03sZKedwAAANY"]
[Mon Feb 09 04:01:50.564451 2026] [:error] [pid 48044:tid 48057] [client 20.48.253.154:16373] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aYjrrpvmvsMP5E03sZKeegAAAMs"]
[Mon Feb 09 04:01:51.179215 2026] [:error] [pid 48044:tid 48070] [client 20.48.253.154:16331] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aYjrr5vmvsMP5E03sZKeewAAANg"]
[Mon Feb 09 04:01:51.627825 2026] [:error] [pid 47938:tid 48001] [client 20.48.253.154:16290] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aYjrr7VCzWE6fQJEkNL1hwAAAFY"]
[Mon Feb 09 04:01:52.196282 2026] [:error] [pid 47938:tid 47985] [client 20.48.253.154:26083] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "aYjrsLVCzWE6fQJEkNL1igAAAEY"]
[Mon Feb 09 04:01:52.834939 2026] [:error] [pid 47937:tid 47952] [client 20.48.253.154:26072] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "aYjrsM4Fd42MP2DhNrX6wAAAAAY"]
[Mon Feb 09 04:01:53.367073 2026] [:error] [pid 47939:tid 48013] [client 20.48.253.154:26104] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "aYjrsdkpZei8M7cJ2z0V1wAAAIc"]
[Mon Feb 09 04:01:53.795740 2026] [:error] [pid 47939:tid 48029] [client 20.48.253.154:16339] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "aYjrsdkpZei8M7cJ2z0V2gAAAJc"]
[Mon Feb 09 04:01:54.373949 2026] [:error] [pid 47939:tid 48019] [client 20.48.253.154:16299] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "aYjrstkpZei8M7cJ2z0V2wAAAI0"]
[Mon Feb 09 04:01:54.907729 2026] [:error] [pid 47938:tid 47980] [client 20.48.253.154:26100] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "aYjrsrVCzWE6fQJEkNL1kwAAAEE"]
[Mon Feb 09 04:01:55.334180 2026] [:error] [pid 47937:tid 47958] [client 20.48.253.154:16213] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "aYjrs84Fd42MP2DhNrX6xQAAAAw"]
[Mon Feb 09 04:01:55.928885 2026] [:error] [pid 47938:tid 47988] [client 20.48.253.154:16270] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "aYjrs7VCzWE6fQJEkNL1lgAAAEk"]
[Mon Feb 09 04:01:56.369028 2026] [:error] [pid 47937:tid 47970] [client 20.48.253.154:16256] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/c99.php"] [unique_id "aYjrtM4Fd42MP2DhNrX6ywAAABg"]
[Mon Feb 09 04:01:56.794699 2026] [:error] [pid 47938:tid 47997] [client 20.48.253.154:16311] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/c99.php"] [unique_id "aYjrtLVCzWE6fQJEkNL1mQAAAFI"]
[Mon Feb 09 04:01:57.475623 2026] [:error] [pid 47939:tid 48024] [client 20.48.253.154:16274] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/c99.php"] [unique_id "aYjrtdkpZei8M7cJ2z0V4AAAAJI"]
[Mon Feb 09 04:01:57.923991 2026] [:error] [pid 47939:tid 48021] [client 20.48.253.154:16327] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/c99.php"] [unique_id "aYjrtdkpZei8M7cJ2z0V4gAAAI8"]
[Mon Feb 09 04:01:58.345944 2026] [:error] [pid 47939:tid 48017] [client 20.48.253.154:36409] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/n3.php"] [unique_id "aYjrttkpZei8M7cJ2z0V5AAAAIs"]
[Mon Feb 09 04:01:58.808848 2026] [:error] [pid 47937:tid 47955] [client 20.48.253.154:16269] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/n3.php"] [unique_id "aYjrts4Fd42MP2DhNrX6zwAAAAk"]
[Mon Feb 09 04:01:59.228786 2026] [:error] [pid 47937:tid 47959] [client 20.48.253.154:36369] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/n3.php"] [unique_id "aYjrt84Fd42MP2DhNrX60gAAAA0"]
[Mon Feb 09 04:01:59.690795 2026] [:error] [pid 47938:tid 47994] [client 20.48.253.154:26053] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/n3.php"] [unique_id "aYjrt7VCzWE6fQJEkNL1nAAAAE8"]
[Mon Feb 09 04:02:00.120136 2026] [:error] [pid 47939:tid 48030] [client 20.48.253.154:16293] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/"] [unique_id "aYjruNkpZei8M7cJ2z0V5gAAAJg"]
[Mon Feb 09 04:02:00.563641 2026] [:error] [pid 47939:tid 48027] [client 20.48.253.154:16354] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/"] [unique_id "aYjruNkpZei8M7cJ2z0V5wAAAJU"]
[Mon Feb 09 04:02:01.054033 2026] [:error] [pid 48044:tid 48061] [client 20.48.253.154:26103] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/"] [unique_id "aYjruZvmvsMP5E03sZKekwAAAM8"]
[Mon Feb 09 04:02:01.623855 2026] [:error] [pid 47938:tid 47999] [client 20.48.253.154:16377] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/"] [unique_id "aYjrubVCzWE6fQJEkNL1pwAAAFQ"]
[Mon Feb 09 04:02:02.163756 2026] [:error] [pid 47937:tid 47967] [client 20.48.253.154:16286] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/environment.php"] [unique_id "aYjrus4Fd42MP2DhNrX62wAAABU"]
[Mon Feb 09 04:02:02.638457 2026] [:error] [pid 48044:tid 48066] [client 20.48.253.154:16305] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/environment.php"] [unique_id "aYjrupvmvsMP5E03sZKelQAAANQ"]
[Mon Feb 09 04:02:03.428271 2026] [:error] [pid 48044:tid 48048] [client 20.48.253.154:16361] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/environment.php"] [unique_id "aYjru5vmvsMP5E03sZKelwAAAMI"]
[Mon Feb 09 04:02:03.925526 2026] [:error] [pid 47938:tid 47997] [client 20.48.253.154:16362] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/environment.php"] [unique_id "aYjru7VCzWE6fQJEkNL1qQAAAFI"]
[Mon Feb 09 04:02:04.443790 2026] [:error] [pid 47938:tid 47985] [client 20.48.253.154:26097] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ho/wpup.php"] [unique_id "aYjrvLVCzWE6fQJEkNL1qwAAAEY"]
[Mon Feb 09 04:02:04.957905 2026] [:error] [pid 47939:tid 48028] [client 20.48.253.154:26082] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ho/wpup.php"] [unique_id "aYjrvNkpZei8M7cJ2z0V8AAAAJY"]
[Mon Feb 09 04:02:05.490564 2026] [:error] [pid 48044:tid 48054] [client 20.48.253.154:16345] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ho/wpup.php"] [unique_id "aYjrvZvmvsMP5E03sZKemgAAAMg"]
[Mon Feb 09 04:02:06.041385 2026] [:error] [pid 47939:tid 48018] [client 20.48.253.154:26105] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ho/wpup.php"] [unique_id "aYjrvtkpZei8M7cJ2z0V8QAAAIw"]
[Mon Feb 09 04:02:06.507808 2026] [:error] [pid 47939:tid 48026] [client 20.48.253.154:16303] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bnn_.php"] [unique_id "aYjrvtkpZei8M7cJ2z0V8wAAAJQ"]
[Mon Feb 09 04:02:06.998997 2026] [:error] [pid 47937:tid 47967] [client 20.48.253.154:16249] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bnn_.php"] [unique_id "aYjrvs4Fd42MP2DhNrX65gAAABU"]
[Mon Feb 09 04:02:07.442867 2026] [:error] [pid 47938:tid 47993] [client 20.48.253.154:26111] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bnn_.php"] [unique_id "aYjrv7VCzWE6fQJEkNL1swAAAE4"]
[Mon Feb 09 04:02:07.874076 2026] [:error] [pid 48044:tid 48060] [client 20.48.253.154:16292] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bnn_.php"] [unique_id "aYjrv5vmvsMP5E03sZKenwAAAM4"]
[Mon Feb 09 04:02:08.294583 2026] [:error] [pid 47939:tid 48019] [client 20.48.253.154:16348] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1337.php"] [unique_id "aYjrwNkpZei8M7cJ2z0V-AAAAI0"]
[Mon Feb 09 04:02:08.824442 2026] [:error] [pid 47937:tid 47951] [client 20.48.253.154:16229] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1337.php"] [unique_id "aYjrwM4Fd42MP2DhNrX67AAAAAU"]
[Mon Feb 09 04:02:09.375095 2026] [:error] [pid 48044:tid 48048] [client 20.48.253.154:16328] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1337.php"] [unique_id "aYjrwZvmvsMP5E03sZKepgAAAMI"]
[Mon Feb 09 04:02:10.306526 2026] [:error] [pid 47937:tid 47961] [client 20.48.253.154:16366] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1337.php"] [unique_id "aYjrws4Fd42MP2DhNrX68gAAAA8"]
[Mon Feb 09 04:02:11.070420 2026] [:error] [pid 47939:tid 48012] [client 20.48.253.154:26084] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test.php"] [unique_id "aYjrw9kpZei8M7cJ2z0V_AAAAIY"]
[Mon Feb 09 04:02:11.541289 2026] [:error] [pid 47938:tid 48000] [client 20.48.253.154:16215] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test.php"] [unique_id "aYjrw7VCzWE6fQJEkNL1vwAAAFU"]
[Mon Feb 09 04:02:12.024324 2026] [:error] [pid 47937:tid 47953] [client 20.48.253.154:36367] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test.php"] [unique_id "aYjrxM4Fd42MP2DhNrX69gAAAAc"]
[Mon Feb 09 04:02:12.459124 2026] [:error] [pid 47938:tid 47995] [client 20.48.253.154:16297] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test.php"] [unique_id "aYjrxLVCzWE6fQJEkNL1xAAAAFA"]
[Mon Feb 09 04:02:12.876985 2026] [:error] [pid 47939:tid 48030] [client 20.48.253.154:36380] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aYjrxNkpZei8M7cJ2z0WAwAAAJg"]
[Mon Feb 09 04:02:13.316202 2026] [:error] [pid 48044:tid 48064] [client 20.48.253.154:16316] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aYjrxZvmvsMP5E03sZKerAAAANI"]
[Mon Feb 09 04:02:13.942736 2026] [:error] [pid 48044:tid 48053] [client 20.48.253.154:16320] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aYjrxZvmvsMP5E03sZKergAAAMc"]
[Mon Feb 09 04:02:14.369586 2026] [:error] [pid 47937:tid 47961] [client 20.48.253.154:16284] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aYjrxs4Fd42MP2DhNrX6-wAAAA8"]
[Mon Feb 09 04:02:14.864813 2026] [:error] [pid 47938:tid 48001] [client 20.48.253.154:36371] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aYjrxrVCzWE6fQJEkNL1yQAAAFY"]
[Mon Feb 09 04:02:15.277826 2026] [:error] [pid 47939:tid 48007] [client 20.48.253.154:16260] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aYjrx9kpZei8M7cJ2z0WCQAAAIE"]
[Mon Feb 09 04:02:15.705214 2026] [:error] [pid 47937:tid 47950] [client 20.48.253.154:16309] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aYjrx84Fd42MP2DhNrX6_QAAAAQ"]
[Mon Feb 09 04:02:16.213724 2026] [:error] [pid 47938:tid 47997] [client 20.48.253.154:16257] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/content.php"] [unique_id "aYjryLVCzWE6fQJEkNL10AAAAFI"]
[Mon Feb 09 04:02:16.678295 2026] [:error] [pid 47939:tid 48017] [client 20.48.253.154:16220] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wqqs.php"] [unique_id "aYjryNkpZei8M7cJ2z0WDAAAAIs"]
[Mon Feb 09 04:02:17.124462 2026] [:error] [pid 47937:tid 47959] [client 20.48.253.154:16326] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wqqs.php"] [unique_id "aYjryc4Fd42MP2DhNrX7AQAAAA0"]
[Mon Feb 09 04:02:17.597004 2026] [:error] [pid 48044:tid 48053] [client 20.48.253.154:16192] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wqqs.php"] [unique_id "aYjryZvmvsMP5E03sZKeugAAAMc"]
[Mon Feb 09 04:02:18.046607 2026] [:error] [pid 47937:tid 47947] [client 20.48.253.154:16300] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wqqs.php"] [unique_id "aYjrys4Fd42MP2DhNrX7BQAAAAE"]
[Mon Feb 09 04:02:18.689221 2026] [:error] [pid 47937:tid 47970] [client 20.48.253.154:26101] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ole.php"] [unique_id "aYjrys4Fd42MP2DhNrX7BgAAABg"]
[Mon Feb 09 04:02:19.120997 2026] [:error] [pid 48044:tid 48061] [client 20.48.253.154:36365] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ole.php"] [unique_id "aYjry5vmvsMP5E03sZKevwAAAM8"]
[Mon Feb 09 04:02:19.535921 2026] [:error] [pid 47938:tid 47987] [client 20.48.253.154:16237] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ole.php"] [unique_id "aYjry7VCzWE6fQJEkNL11gAAAEg"]
[Mon Feb 09 04:02:19.997977 2026] [:error] [pid 47939:tid 48021] [client 20.48.253.154:36376] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ole.php"] [unique_id "aYjry9kpZei8M7cJ2z0WFAAAAI8"]
[Mon Feb 09 04:02:20.564840 2026] [:error] [pid 47938:tid 47990] [client 20.48.253.154:16242] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/json.php"] [unique_id "aYjrzLVCzWE6fQJEkNL12QAAAEs"]
[Mon Feb 09 04:02:21.366314 2026] [:error] [pid 47937:tid 47948] [client 20.48.253.154:16276] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/json.php"] [unique_id "aYjrzc4Fd42MP2DhNrX7CgAAAAI"]
[Mon Feb 09 04:02:22.391254 2026] [:error] [pid 47938:tid 47994] [client 20.48.253.154:16209] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/json.php"] [unique_id "aYjrzrVCzWE6fQJEkNL13QAAAE8"]
[Mon Feb 09 04:02:23.204057 2026] [:error] [pid 48044:tid 48064] [client 20.48.253.154:16287] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/json.php"] [unique_id "aYjrz5vmvsMP5E03sZKexQAAANI"]
[Mon Feb 09 04:02:24.728740 2026] [:error] [pid 47937:tid 47960] [client 20.48.253.154:16351] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "aYjr0M4Fd42MP2DhNrX7EQAAAA4"]
[Mon Feb 09 04:02:25.458697 2026] [:error] [pid 48044:tid 48057] [client 20.48.253.154:16363] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "aYjr0ZvmvsMP5E03sZKeygAAAMs"]
[Mon Feb 09 04:02:26.597619 2026] [:error] [pid 47939:tid 48014] [client 20.48.253.154:16273] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "aYjr0tkpZei8M7cJ2z0WJAAAAIg"]
[Mon Feb 09 04:02:27.546690 2026] [:error] [pid 47937:tid 47968] [client 20.48.253.154:36357] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "aYjr084Fd42MP2DhNrX7HQAAABY"]
[Mon Feb 09 04:02:29.088309 2026] [:error] [pid 47938:tid 47980] [client 20.48.253.154:16251] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ak.php"] [unique_id "aYjr1bVCzWE6fQJEkNL17QAAAEE"]
[Mon Feb 09 04:02:30.056568 2026] [:error] [pid 47938:tid 47986] [client 20.48.253.154:26107] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ak.php"] [unique_id "aYjr1rVCzWE6fQJEkNL18AAAAEc"]
[Mon Feb 09 04:02:31.462105 2026] [:error] [pid 48044:tid 48068] [client 20.48.253.154:16298] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ak.php"] [unique_id "aYjr15vmvsMP5E03sZKe1QAAANY"]
[Mon Feb 09 04:02:32.812484 2026] [:error] [pid 47937:tid 47965] [client 20.48.253.154:16264] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ak.php"] [unique_id "aYjr2M4Fd42MP2DhNrX7JQAAABM"]
[Mon Feb 09 04:02:33.378922 2026] [:error] [pid 48044:tid 48066] [client 20.48.253.154:16268] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.trash7309/dd/"] [unique_id "aYjr2ZvmvsMP5E03sZKe2gAAANQ"]
[Mon Feb 09 04:02:33.863031 2026] [:error] [pid 47938:tid 47993] [client 20.48.253.154:36382] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.trash7309/dd/"] [unique_id "aYjr2bVCzWE6fQJEkNL1-AAAAE4"]
[Mon Feb 09 04:02:34.353181 2026] [:error] [pid 47938:tid 47997] [client 20.48.253.154:16266] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.trash7309/dd/"] [unique_id "aYjr2rVCzWE6fQJEkNL1-QAAAFI"]
[Mon Feb 09 04:02:34.860843 2026] [:error] [pid 47938:tid 47998] [client 20.48.253.154:16281] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.trash7309/dd/"] [unique_id "aYjr2rVCzWE6fQJEkNL1_gAAAFM"]
[Mon Feb 09 04:02:35.292738 2026] [:error] [pid 47939:tid 48015] [client 20.48.253.154:16382] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mds.php"] [unique_id "aYjr29kpZei8M7cJ2z0WOQAAAIk"]
[Mon Feb 09 04:02:35.726670 2026] [:error] [pid 47938:tid 47988] [client 20.48.253.154:16234] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mds.php"] [unique_id "aYjr27VCzWE6fQJEkNL1_wAAAEk"]
[Mon Feb 09 04:02:36.174438 2026] [:error] [pid 47939:tid 48027] [client 20.48.253.154:16261] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mds.php"] [unique_id "aYjr3NkpZei8M7cJ2z0WPAAAAJU"]
[Mon Feb 09 04:02:37.408507 2026] [:error] [pid 47939:tid 48016] [client 20.48.253.154:16194] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mds.php"] [unique_id "aYjr3dkpZei8M7cJ2z0WQAAAAIo"]
[Mon Feb 09 04:02:39.953346 2026] [:error] [pid 47938:tid 47981] [client 20.48.253.154:16301] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ellv3.php"] [unique_id "aYjr37VCzWE6fQJEkNL2CAAAAEI"]
[Mon Feb 09 04:02:40.732996 2026] [:error] [pid 47937:tid 47955] [client 20.48.253.154:16240] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ellv3.php"] [unique_id "aYjr4M4Fd42MP2DhNrX7MAAAAAk"]
[Mon Feb 09 04:02:41.791654 2026] [:error] [pid 47939:tid 48021] [client 20.48.253.154:16130] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ellv3.php"] [unique_id "aYjr4dkpZei8M7cJ2z0WSwAAAI8"]
[Mon Feb 09 04:02:42.411638 2026] [:error] [pid 47938:tid 47999] [client 20.48.253.154:16206] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ellv3.php"] [unique_id "aYjr4rVCzWE6fQJEkNL2EAAAAFQ"]
[Mon Feb 09 04:02:42.852327 2026] [:error] [pid 47939:tid 48026] [client 20.48.253.154:16232] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aYjr4tkpZei8M7cJ2z0WTQAAAJQ"]
[Mon Feb 09 04:02:43.460116 2026] [:error] [pid 48044:tid 48048] [client 20.48.253.154:16312] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aYjr45vmvsMP5E03sZKe9AAAAMI"]
[Mon Feb 09 04:02:43.918631 2026] [:error] [pid 47939:tid 48018] [client 20.48.253.154:16381] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aYjr49kpZei8M7cJ2z0WUQAAAIw"]
[Mon Feb 09 04:02:44.382890 2026] [:error] [pid 47939:tid 48010] [client 20.48.253.154:16377] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aYjr5NkpZei8M7cJ2z0WUgAAAIQ"]
[Mon Feb 09 04:02:44.900157 2026] [:error] [pid 48044:tid 48054] [client 20.48.253.154:16203] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ffd.php"] [unique_id "aYjr5JvmvsMP5E03sZKe-QAAAMg"]
[Mon Feb 09 04:02:45.330629 2026] [:error] [pid 48044:tid 48067] [client 20.48.253.154:16358] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ffd.php"] [unique_id "aYjr5ZvmvsMP5E03sZKe-wAAANU"]
[Mon Feb 09 04:02:45.778228 2026] [:error] [pid 47937:tid 47952] [client 20.48.253.154:16368] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ffd.php"] [unique_id "aYjr5c4Fd42MP2DhNrX7MQAAAAY"]
[Mon Feb 09 04:02:46.227560 2026] [:error] [pid 47939:tid 48012] [client 20.48.253.154:16066] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ffd.php"] [unique_id "aYjr5tkpZei8M7cJ2z0WWQAAAIY"]
[Mon Feb 09 04:02:46.694608 2026] [:error] [pid 48044:tid 48052] [client 20.48.253.154:16137] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/"] [unique_id "aYjr5pvmvsMP5E03sZKfAwAAAMY"]
[Mon Feb 09 04:02:47.294199 2026] [:error] [pid 47939:tid 48028] [client 20.48.253.154:16314] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/"] [unique_id "aYjr59kpZei8M7cJ2z0WWgAAAJY"]
[Mon Feb 09 04:02:47.813744 2026] [:error] [pid 47939:tid 48013] [client 20.48.253.154:16210] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/"] [unique_id "aYjr59kpZei8M7cJ2z0WXQAAAIc"]
[Mon Feb 09 04:02:48.237666 2026] [autoindex:error] [pid 47938:tid 47989] [client 20.48.253.154:16207] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 09 04:02:52.596847 2026] [:error] [pid 47938:tid 47994] [client 20.48.253.154:16207] [client 20.48.253.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aYjr7LVCzWE6fQJEkNL2JQAAAE8"]
[Mon Feb 09 04:02:55.443099 2026] [:error] [pid 47938:tid 47996] [client 20.48.253.154:26059] [client 20.48.253.154] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.48.253.154, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYjr77VCzWE6fQJEkNL2LQAAAFE"]
[Mon Feb 09 04:03:04.036477 2026] [:error] [pid 47938:tid 47987] [client 20.48.253.154:16323] [client 20.48.253.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aYjr-LVCzWE6fQJEkNL2QQAAAEg"]
[Mon Feb 09 04:03:07.871234 2026] [:error] [pid 47939:tid 48015] [client 20.48.253.154:16267] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aYjr-9kpZei8M7cJ2z0WmwAAAIk"]
[Mon Feb 09 04:03:08.809220 2026] [:error] [pid 47938:tid 47990] [client 20.48.253.154:16253] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aYjr_LVCzWE6fQJEkNL2TgAAAEs"]
[Mon Feb 09 04:03:09.463185 2026] [:error] [pid 48044:tid 48059] [client 20.48.253.154:16372] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aYjr_ZvmvsMP5E03sZKfJQAAAM0"]
[Mon Feb 09 04:03:10.042299 2026] [:error] [pid 47938:tid 47996] [client 20.48.253.154:16169] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aYjr_rVCzWE6fQJEkNL2VAAAAFE"]
[Mon Feb 09 04:03:10.905398 2026] [:error] [pid 48044:tid 48068] [client 20.48.253.154:16283] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/apsarasarts/okk.php"] [unique_id "aYjr_pvmvsMP5E03sZKfKAAAANY"]
[Mon Feb 09 04:03:12.165437 2026] [:error] [pid 47939:tid 48030] [client 20.48.253.154:26109] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/apsarasarts/okk.php"] [unique_id "aYjsANkpZei8M7cJ2z0WtAAAAJg"]
[Mon Feb 09 04:03:12.983344 2026] [:error] [pid 47938:tid 47992] [client 20.48.253.154:16153] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/apsarasarts/okk.php"] [unique_id "aYjsALVCzWE6fQJEkNL2WQAAAE0"]
[Mon Feb 09 04:03:13.587656 2026] [:error] [pid 48044:tid 48063] [client 20.48.253.154:16313] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/apsarasarts/okk.php"] [unique_id "aYjsAZvmvsMP5E03sZKfMAAAANE"]
[Mon Feb 09 04:03:14.207750 2026] [:error] [pid 47939:tid 48026] [client 20.48.253.154:16359] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mal.php"] [unique_id "aYjsAtkpZei8M7cJ2z0WwAAAAJQ"]
[Mon Feb 09 04:03:15.197175 2026] [:error] [pid 47939:tid 48030] [client 20.48.253.154:16246] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mal.php"] [unique_id "aYjsA9kpZei8M7cJ2z0WywAAAJg"]
[Mon Feb 09 04:03:15.783313 2026] [:error] [pid 47939:tid 48017] [client 20.48.253.154:16221] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mal.php"] [unique_id "aYjsA9kpZei8M7cJ2z0WzgAAAIs"]
[Mon Feb 09 04:03:16.563402 2026] [:error] [pid 47939:tid 48030] [client 20.48.253.154:26056] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mal.php"] [unique_id "aYjsBNkpZei8M7cJ2z0W1AAAAJg"]
[Mon Feb 09 04:03:17.390667 2026] [:error] [pid 47938:tid 47996] [client 20.48.253.154:16379] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/wpupex.php/"] [unique_id "aYjsBbVCzWE6fQJEkNL2WgAAAFE"]
[Mon Feb 09 04:03:18.183313 2026] [:error] [pid 47939:tid 48016] [client 20.48.253.154:16250] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/wpupex.php/"] [unique_id "aYjsBtkpZei8M7cJ2z0W4gAAAIo"]
[Mon Feb 09 04:03:19.792074 2026] [:error] [pid 47939:tid 48016] [client 20.48.253.154:16208] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/wpupex.php/"] [unique_id "aYjsB9kpZei8M7cJ2z0W6wAAAIo"]
[Mon Feb 09 04:03:21.116695 2026] [:error] [pid 48044:tid 48066] [client 20.48.253.154:16224] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/wpupex.php/"] [unique_id "aYjsCZvmvsMP5E03sZKfPAAAANQ"]
[Mon Feb 09 04:03:21.842538 2026] [:error] [pid 47938:tid 48000] [client 20.48.253.154:16262] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "aYjsCbVCzWE6fQJEkNL2YQAAAFU"]
[Mon Feb 09 04:03:22.332976 2026] [:error] [pid 47938:tid 47991] [client 20.48.253.154:26054] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "aYjsCrVCzWE6fQJEkNL2ZQAAAEw"]
[Mon Feb 09 04:03:22.877690 2026] [:error] [pid 48044:tid 48061] [client 20.48.253.154:16228] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "aYjsCpvmvsMP5E03sZKfQAAAAM8"]
[Mon Feb 09 04:03:23.894307 2026] [:error] [pid 47937:tid 47951] [client 20.48.253.154:16217] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "aYjsC84Fd42MP2DhNrX7agAAAAU"]
[Mon Feb 09 04:03:25.189665 2026] [:error] [pid 47939:tid 48009] [client 20.48.253.154:16296] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/deeto/login.php"] [unique_id "aYjsDdkpZei8M7cJ2z0XCAAAAIM"]
[Mon Feb 09 04:03:25.922857 2026] [:error] [pid 47938:tid 47990] [client 20.48.253.154:16227] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/deeto/login.php"] [unique_id "aYjsDbVCzWE6fQJEkNL2bwAAAEs"]
[Mon Feb 09 04:03:26.480402 2026] [:error] [pid 48044:tid 48054] [client 20.48.253.154:16374] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/deeto/login.php"] [unique_id "aYjsDpvmvsMP5E03sZKfRgAAAMg"]
[Mon Feb 09 04:03:27.340138 2026] [:error] [pid 47939:tid 48025] [client 20.48.253.154:16146] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/deeto/login.php"] [unique_id "aYjsD9kpZei8M7cJ2z0XEwAAAJM"]
[Mon Feb 09 04:03:28.713541 2026] [:error] [pid 47939:tid 48012] [client 20.48.253.154:16291] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/index.php"] [unique_id "aYjsENkpZei8M7cJ2z0XGQAAAIY"]
[Mon Feb 09 04:03:29.161296 2026] [:error] [pid 48044:tid 48049] [client 20.48.253.154:16317] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/index.php"] [unique_id "aYjsEZvmvsMP5E03sZKfTgAAAMM"]
[Mon Feb 09 04:03:29.929091 2026] [:error] [pid 48044:tid 48046] [client 20.48.253.154:16226] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/index.php"] [unique_id "aYjsEZvmvsMP5E03sZKfUQAAAMA"]
[Mon Feb 09 04:03:30.670653 2026] [:error] [pid 47939:tid 48024] [client 20.48.253.154:16315] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/index.php"] [unique_id "aYjsEtkpZei8M7cJ2z0XJAAAAJI"]
[Mon Feb 09 04:03:31.284627 2026] [:error] [pid 47938:tid 47983] [client 20.48.253.154:16235] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ph33w.php"] [unique_id "aYjsE7VCzWE6fQJEkNL2cgAAAEQ"]
[Mon Feb 09 04:03:31.893089 2026] [:error] [pid 47939:tid 48017] [client 20.48.253.154:16272] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ph33w.php"] [unique_id "aYjsE9kpZei8M7cJ2z0XKQAAAIs"]
[Mon Feb 09 04:03:32.638544 2026] [:error] [pid 47939:tid 48027] [client 20.48.253.154:16096] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ph33w.php"] [unique_id "aYjsFNkpZei8M7cJ2z0XLQAAAJU"]
[Mon Feb 09 04:03:33.821910 2026] [:error] [pid 48044:tid 48059] [client 20.48.253.154:16190] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ph33w.php"] [unique_id "aYjsFZvmvsMP5E03sZKfXAAAAM0"]
[Mon Feb 09 04:03:34.479129 2026] [:error] [pid 48044:tid 48069] [client 20.48.253.154:16204] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cv.php"] [unique_id "aYjsFpvmvsMP5E03sZKfYAAAANc"]
[Mon Feb 09 04:03:35.550300 2026] [:error] [pid 47939:tid 48007] [client 20.48.253.154:36395] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cv.php"] [unique_id "aYjsF9kpZei8M7cJ2z0XOgAAAIE"]
[Mon Feb 09 04:03:37.556935 2026] [:error] [pid 48044:tid 48063] [client 20.48.253.154:16157] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cv.php"] [unique_id "aYjsGZvmvsMP5E03sZKfZAAAANE"]
[Mon Feb 09 04:03:38.835890 2026] [:error] [pid 47939:tid 48027] [client 20.48.253.154:16233] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cv.php"] [unique_id "aYjsGtkpZei8M7cJ2z0XSwAAAJU"]
[Mon Feb 09 04:03:39.347971 2026] [:error] [pid 47937:tid 47962] [client 20.48.253.154:16132] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sad/about.php"] [unique_id "aYjsG84Fd42MP2DhNrX7iAAAABA"]
[Mon Feb 09 04:03:40.184008 2026] [:error] [pid 48044:tid 48056] [client 20.48.253.154:16225] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sad/about.php"] [unique_id "aYjsHJvmvsMP5E03sZKfbAAAAMo"]
[Mon Feb 09 04:03:40.910374 2026] [:error] [pid 47937:tid 47952] [client 20.48.253.154:16380] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sad/about.php"] [unique_id "aYjsHM4Fd42MP2DhNrX7jAAAAAY"]
[Mon Feb 09 04:03:41.495047 2026] [:error] [pid 48044:tid 48047] [client 20.48.253.154:16140] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sad/about.php"] [unique_id "aYjsHZvmvsMP5E03sZKfcQAAAME"]
[Mon Feb 09 04:03:42.061014 2026] [:error] [pid 47937:tid 47960] [client 20.48.253.154:26069] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp4.php"] [unique_id "aYjsHs4Fd42MP2DhNrX7jwAAAA4"]
[Mon Feb 09 04:03:42.578029 2026] [:error] [pid 48044:tid 48050] [client 20.48.253.154:16307] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp4.php"] [unique_id "aYjsHpvmvsMP5E03sZKfdQAAAMQ"]
[Mon Feb 09 04:03:43.691445 2026] [:error] [pid 47938:tid 48000] [client 20.48.253.154:16319] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp4.php"] [unique_id "aYjsH7VCzWE6fQJEkNL2gwAAAFU"]
[Mon Feb 09 04:03:44.338594 2026] [:error] [pid 47937:tid 47950] [client 20.48.253.154:36415] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp4.php"] [unique_id "aYjsIM4Fd42MP2DhNrX7lQAAAAQ"]
[Mon Feb 09 04:03:44.883487 2026] [:error] [pid 48044:tid 48054] [client 20.48.253.154:36412] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/fk2e3/"] [unique_id "aYjsIJvmvsMP5E03sZKffQAAAMg"]
[Mon Feb 09 04:03:45.936157 2026] [:error] [pid 47939:tid 48016] [client 20.48.253.154:16170] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/fk2e3/"] [unique_id "aYjsIdkpZei8M7cJ2z0XXgAAAIo"]
[Mon Feb 09 04:03:46.655839 2026] [:error] [pid 47939:tid 48021] [client 20.48.253.154:16187] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/fk2e3/"] [unique_id "aYjsItkpZei8M7cJ2z0XYwAAAI8"]
[Mon Feb 09 04:03:47.358322 2026] [:error] [pid 47938:tid 48002] [client 20.48.253.154:16181] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/fk2e3/"] [unique_id "aYjsI7VCzWE6fQJEkNL2jAAAAFc"]
[Mon Feb 09 04:03:48.634025 2026] [:error] [pid 48044:tid 48048] [client 20.48.253.154:36364] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "aYjsJJvmvsMP5E03sZKfigAAAMI"]
[Mon Feb 09 04:03:49.461743 2026] [:error] [pid 47938:tid 47989] [client 20.48.253.154:16200] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "aYjsJbVCzWE6fQJEkNL2kgAAAEo"]
[Mon Feb 09 04:03:50.308895 2026] [:error] [pid 47939:tid 48009] [client 20.48.253.154:36387] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "aYjsJtkpZei8M7cJ2z0XawAAAIM"]
[Mon Feb 09 04:03:51.361390 2026] [:error] [pid 47939:tid 48012] [client 20.48.253.154:26062] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "aYjsJ9kpZei8M7cJ2z0XcQAAAIY"]
[Mon Feb 09 04:03:52.436756 2026] [:error] [pid 47938:tid 47993] [client 20.48.253.154:16142] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sxo.php"] [unique_id "aYjsKLVCzWE6fQJEkNL2mAAAAE4"]
[Mon Feb 09 04:03:53.817810 2026] [:error] [pid 47939:tid 48030] [client 20.48.253.154:16131] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sxo.php"] [unique_id "aYjsKdkpZei8M7cJ2z0XdgAAAJg"]
[Mon Feb 09 04:03:54.647247 2026] [:error] [pid 47938:tid 47980] [client 20.48.253.154:16176] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sxo.php"] [unique_id "aYjsKrVCzWE6fQJEkNL2mgAAAEE"]
[Mon Feb 09 04:03:55.743415 2026] [:error] [pid 47939:tid 48025] [client 20.48.253.154:26066] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sxo.php"] [unique_id "aYjsK9kpZei8M7cJ2z0XfgAAAJM"]
[Mon Feb 09 04:03:56.444722 2026] [:error] [pid 47937:tid 47956] [client 20.48.253.154:16383] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026.php"] [unique_id "aYjsLM4Fd42MP2DhNrX7pwAAAAo"]
[Mon Feb 09 04:03:57.321263 2026] [:error] [pid 47937:tid 47960] [client 20.48.253.154:16231] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026.php"] [unique_id "aYjsLc4Fd42MP2DhNrX7qQAAAA4"]
[Mon Feb 09 04:03:58.508739 2026] [:error] [pid 47937:tid 47950] [client 20.48.253.154:36383] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026.php"] [unique_id "aYjsLs4Fd42MP2DhNrX7rwAAAAQ"]
[Mon Feb 09 04:03:59.211970 2026] [:error] [pid 47939:tid 48023] [client 20.48.253.154:16172] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026.php"] [unique_id "aYjsL9kpZei8M7cJ2z0XhQAAAJE"]
[Mon Feb 09 04:04:00.406077 2026] [:error] [pid 47937:tid 47965] [client 20.48.253.154:26092] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aYjsMM4Fd42MP2DhNrX7tQAAABM"]
[Mon Feb 09 04:04:02.527814 2026] [:error] [pid 47937:tid 47957] [client 20.48.253.154:26055] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aYjsMs4Fd42MP2DhNrX7vAAAAAs"]
[Mon Feb 09 04:04:04.468982 2026] [:error] [pid 47939:tid 48026] [client 20.48.253.154:16021] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aYjsNNkpZei8M7cJ2z0XlAAAAJQ"]
[Mon Feb 09 04:04:13.076517 2026] [:error] [pid 47939:tid 48019] [client 20.48.253.154:16069] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/user.php"] [unique_id "aYjsPdkpZei8M7cJ2z0XugAAAI0"]
[Mon Feb 09 04:04:13.745005 2026] [:error] [pid 47937:tid 47955] [client 20.48.253.154:16335] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/user.php"] [unique_id "aYjsPc4Fd42MP2DhNrX72gAAAAk"]
[Mon Feb 09 04:04:14.278358 2026] [:error] [pid 47938:tid 47988] [client 20.48.253.154:36363] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/user.php"] [unique_id "aYjsPrVCzWE6fQJEkNL2vwAAAEk"]
[Mon Feb 09 04:04:14.781573 2026] [:error] [pid 47939:tid 48008] [client 20.48.253.154:26087] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/user.php"] [unique_id "aYjsPtkpZei8M7cJ2z0XvgAAAII"]
[Mon Feb 09 04:04:15.269085 2026] [:error] [pid 47939:tid 48014] [client 20.48.253.154:36375] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aYjsP9kpZei8M7cJ2z0XwQAAAIg"]
[Mon Feb 09 04:04:15.762878 2026] [:error] [pid 47937:tid 47947] [client 20.48.253.154:26090] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aYjsP84Fd42MP2DhNrX73gAAAAE"]
[Mon Feb 09 04:04:16.358844 2026] [:error] [pid 47939:tid 48030] [client 20.48.253.154:36407] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aYjsQNkpZei8M7cJ2z0XxwAAAJg"]
[Mon Feb 09 04:04:16.951276 2026] [:error] [pid 47937:tid 47950] [client 20.48.253.154:36358] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aYjsQM4Fd42MP2DhNrX74QAAAAQ"]
[Mon Feb 09 04:04:17.698496 2026] [:error] [pid 47938:tid 47990] [client 20.48.253.154:36385] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8xyz.php"] [unique_id "aYjsQbVCzWE6fQJEkNL2ywAAAEs"]
[Mon Feb 09 04:04:18.244077 2026] [:error] [pid 48044:tid 48069] [client 20.48.253.154:16310] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8xyz.php"] [unique_id "aYjsQpvmvsMP5E03sZKfzgAAANc"]
[Mon Feb 09 04:04:18.823595 2026] [:error] [pid 47938:tid 47985] [client 20.48.253.154:26052] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8xyz.php"] [unique_id "aYjsQrVCzWE6fQJEkNL2zQAAAEY"]
[Mon Feb 09 04:04:19.288923 2026] [:error] [pid 47938:tid 47992] [client 20.48.253.154:36379] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8xyz.php"] [unique_id "aYjsQ7VCzWE6fQJEkNL2zgAAAE0"]
[Mon Feb 09 04:04:19.820272 2026] [:error] [pid 48044:tid 48047] [client 20.48.253.154:16259] [client 20.48.253.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/about.php"] [unique_id "aYjsQ5vmvsMP5E03sZKf2QAAAME"]
[Mon Feb 09 04:04:20.516851 2026] [:error] [pid 47938:tid 47996] [client 20.48.253.154:26093] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rezor.php"] [unique_id "aYjsRLVCzWE6fQJEkNL20wAAAFE"]
[Mon Feb 09 04:04:21.039902 2026] [:error] [pid 47937:tid 47970] [client 20.48.253.154:26064] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rezor.php"] [unique_id "aYjsRc4Fd42MP2DhNrX76QAAABg"]
[Mon Feb 09 04:04:21.681441 2026] [:error] [pid 48044:tid 48064] [client 20.48.253.154:16162] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rezor.php"] [unique_id "aYjsRZvmvsMP5E03sZKf4wAAANI"]
[Mon Feb 09 04:04:22.630090 2026] [:error] [pid 48044:tid 48056] [client 20.48.253.154:16185] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rezor.php"] [unique_id "aYjsRpvmvsMP5E03sZKf5QAAAMo"]
[Mon Feb 09 04:04:23.706803 2026] [:error] [pid 48044:tid 48051] [client 20.48.253.154:16073] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Wp-good.php"] [unique_id "aYjsR5vmvsMP5E03sZKf6QAAAMU"]
[Mon Feb 09 04:04:24.352949 2026] [:error] [pid 48044:tid 48070] [client 20.48.253.154:16161] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Wp-good.php"] [unique_id "aYjsSJvmvsMP5E03sZKf7gAAANg"]
[Mon Feb 09 04:04:25.633022 2026] [:error] [pid 47937:tid 47954] [client 20.48.253.154:16201] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Wp-good.php"] [unique_id "aYjsSc4Fd42MP2DhNrX77wAAAAg"]
[Mon Feb 09 04:04:26.233883 2026] [:error] [pid 47937:tid 47956] [client 20.48.253.154:16070] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Wp-good.php"] [unique_id "aYjsSs4Fd42MP2DhNrX78QAAAAo"]
[Mon Feb 09 04:04:26.881771 2026] [:error] [pid 47937:tid 47969] [client 20.48.253.154:16294] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ze.php"] [unique_id "aYjsSs4Fd42MP2DhNrX78gAAABc"]
[Mon Feb 09 04:04:27.582437 2026] [:error] [pid 47938:tid 47979] [client 20.48.253.154:36399] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ze.php"] [unique_id "aYjsS7VCzWE6fQJEkNL25AAAAEA"]
[Mon Feb 09 04:04:28.157345 2026] [:error] [pid 48044:tid 48051] [client 20.48.253.154:16135] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ze.php"] [unique_id "aYjsTJvmvsMP5E03sZKf_gAAAMU"]
[Mon Feb 09 04:04:28.694730 2026] [:error] [pid 48044:tid 48050] [client 20.48.253.154:16278] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ze.php"] [unique_id "aYjsTJvmvsMP5E03sZKgAgAAAMQ"]
[Mon Feb 09 04:04:29.327024 2026] [:error] [pid 47938:tid 48001] [client 20.48.253.154:16254] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aYjsTbVCzWE6fQJEkNL26QAAAFY"]
[Mon Feb 09 04:04:29.761321 2026] [:error] [pid 47938:tid 47992] [client 20.48.253.154:36403] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aYjsTbVCzWE6fQJEkNL26wAAAE0"]
[Mon Feb 09 04:04:30.259511 2026] [:error] [pid 47939:tid 48014] [client 20.48.253.154:26049] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aYjsTtkpZei8M7cJ2z0X7QAAAIg"]
[Mon Feb 09 04:04:30.757654 2026] [:error] [pid 47938:tid 47998] [client 20.48.253.154:36353] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aYjsTrVCzWE6fQJEkNL27AAAAFM"]
[Mon Feb 09 04:04:31.338759 2026] [:error] [pid 47939:tid 48011] [client 20.48.253.154:16241] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jmfi2.php"] [unique_id "aYjsT9kpZei8M7cJ2z0X8QAAAIU"]
[Mon Feb 09 04:04:31.850845 2026] [:error] [pid 48044:tid 48047] [client 20.48.253.154:36372] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jmfi2.php"] [unique_id "aYjsT5vmvsMP5E03sZKgCgAAAME"]
[Mon Feb 09 04:04:32.457631 2026] [:error] [pid 47939:tid 48027] [client 20.48.253.154:36366] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jmfi2.php"] [unique_id "aYjsUNkpZei8M7cJ2z0X9QAAAJU"]
[Mon Feb 09 04:04:32.913612 2026] [:error] [pid 47937:tid 47948] [client 20.48.253.154:26067] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jmfi2.php"] [unique_id "aYjsUM4Fd42MP2DhNrX8AQAAAAI"]
[Mon Feb 09 04:04:33.544118 2026] [:error] [pid 48044:tid 48053] [client 20.48.253.154:16336] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x7.php"] [unique_id "aYjsUZvmvsMP5E03sZKgEQAAAMc"]
[Mon Feb 09 04:04:34.068859 2026] [:error] [pid 48044:tid 48065] [client 20.48.253.154:16145] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x7.php"] [unique_id "aYjsUpvmvsMP5E03sZKgFQAAANM"]
[Mon Feb 09 04:04:34.506542 2026] [:error] [pid 48044:tid 48069] [client 20.48.253.154:16252] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x7.php"] [unique_id "aYjsUpvmvsMP5E03sZKgFwAAANc"]
[Mon Feb 09 04:04:35.023653 2026] [:error] [pid 47937:tid 47956] [client 20.48.253.154:26076] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x7.php"] [unique_id "aYjsU84Fd42MP2DhNrX8BgAAAAo"]
[Mon Feb 09 04:04:35.623462 2026] [:error] [pid 48044:tid 48053] [client 20.48.253.154:16128] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hey.php"] [unique_id "aYjsU5vmvsMP5E03sZKgHAAAAMc"]
[Mon Feb 09 04:04:36.317521 2026] [:error] [pid 48044:tid 48056] [client 20.48.253.154:16150] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hey.php"] [unique_id "aYjsVJvmvsMP5E03sZKgIAAAAMo"]
[Mon Feb 09 04:04:37.259138 2026] [:error] [pid 47939:tid 48018] [client 20.48.253.154:16129] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hey.php"] [unique_id "aYjsVdkpZei8M7cJ2z0YBgAAAIw"]
[Mon Feb 09 04:04:37.913268 2026] [:error] [pid 47938:tid 47982] [client 20.48.253.154:16158] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hey.php"] [unique_id "aYjsVbVCzWE6fQJEkNL2-QAAAEM"]
[Mon Feb 09 04:04:38.522639 2026] [:error] [pid 48044:tid 48061] [client 20.48.253.154:16214] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/class-db.php"] [unique_id "aYjsVpvmvsMP5E03sZKgKAAAAM8"]
[Mon Feb 09 04:04:39.303601 2026] [:error] [pid 47938:tid 48001] [client 20.48.253.154:16222] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/class-db.php"] [unique_id "aYjsV7VCzWE6fQJEkNL2_QAAAFY"]
[Mon Feb 09 04:04:39.938609 2026] [:error] [pid 47939:tid 48027] [client 20.48.253.154:16171] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/class-db.php"] [unique_id "aYjsV9kpZei8M7cJ2z0YEgAAAJU"]
[Mon Feb 09 04:04:40.444941 2026] [:error] [pid 47939:tid 48021] [client 20.48.253.154:16343] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/class-db.php"] [unique_id "aYjsWNkpZei8M7cJ2z0YEwAAAI8"]
[Mon Feb 09 04:04:41.144146 2026] [:error] [pid 48044:tid 48060] [client 20.48.253.154:36398] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aYjsWZvmvsMP5E03sZKgLQAAAM4"]
[Mon Feb 09 04:04:42.265676 2026] [:error] [pid 48044:tid 48069] [client 20.48.253.154:16083] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aYjsWpvmvsMP5E03sZKgMwAAANc"]
[Mon Feb 09 04:04:43.235048 2026] [:error] [pid 47937:tid 47962] [client 20.48.253.154:26070] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aYjsW84Fd42MP2DhNrX8DwAAABA"]
[Mon Feb 09 04:04:43.926913 2026] [:error] [pid 48044:tid 48062] [client 20.48.253.154:16219] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aYjsW5vmvsMP5E03sZKgNgAAANA"]
[Mon Feb 09 04:04:44.567927 2026] [:error] [pid 47938:tid 48001] [client 20.48.253.154:26108] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/Core-EconX/up.php"] [unique_id "aYjsXLVCzWE6fQJEkNL3BQAAAFY"]
[Mon Feb 09 04:04:45.105642 2026] [:error] [pid 48044:tid 48058] [client 20.48.253.154:36401] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/Core-EconX/up.php"] [unique_id "aYjsXZvmvsMP5E03sZKgOgAAAMw"]
[Mon Feb 09 04:04:45.546644 2026] [:error] [pid 47938:tid 47992] [client 20.48.253.154:16238] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/Core-EconX/up.php"] [unique_id "aYjsXbVCzWE6fQJEkNL3BgAAAE0"]
[Mon Feb 09 04:04:46.205415 2026] [:error] [pid 47937:tid 47958] [client 20.48.253.154:26058] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/Core-EconX/up.php"] [unique_id "aYjsXs4Fd42MP2DhNrX8FQAAAAw"]
[Mon Feb 09 04:04:46.686027 2026] [:error] [pid 47939:tid 48020] [client 20.48.253.154:16218] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gib.php"] [unique_id "aYjsXtkpZei8M7cJ2z0YKAAAAI4"]
[Mon Feb 09 04:04:47.365535 2026] [:error] [pid 48044:tid 48052] [client 20.48.253.154:36377] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gib.php"] [unique_id "aYjsX5vmvsMP5E03sZKgQwAAAMY"]
[Mon Feb 09 04:04:47.950023 2026] [:error] [pid 47939:tid 48015] [client 20.48.253.154:36405] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gib.php"] [unique_id "aYjsX9kpZei8M7cJ2z0YLAAAAIk"]
[Mon Feb 09 04:04:48.462509 2026] [:error] [pid 47939:tid 48025] [client 20.48.253.154:36355] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gib.php"] [unique_id "aYjsYNkpZei8M7cJ2z0YLwAAAJM"]
[Mon Feb 09 04:04:49.396568 2026] [:error] [pid 48044:tid 48070] [client 20.48.253.154:16322] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aYjsYZvmvsMP5E03sZKgRwAAANg"]
[Mon Feb 09 04:04:49.940438 2026] [:error] [pid 47937:tid 47967] [client 20.48.253.154:16198] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aYjsYc4Fd42MP2DhNrX8GAAAABU"]
[Mon Feb 09 04:04:50.389523 2026] [:error] [pid 48044:tid 48067] [client 20.48.253.154:16344] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aYjsYpvmvsMP5E03sZKgSgAAANU"]
[Mon Feb 09 04:04:50.835167 2026] [:error] [pid 48044:tid 48063] [client 20.48.253.154:26084] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "aYjsYpvmvsMP5E03sZKgTQAAANE"]
[Mon Feb 09 04:04:51.271102 2026] [:error] [pid 47939:tid 48018] [client 20.48.253.154:26074] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aYjsY9kpZei8M7cJ2z0YPQAAAIw"]
[Mon Feb 09 04:04:51.916265 2026] [:error] [pid 47937:tid 47958] [client 20.48.253.154:16144] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aYjsY84Fd42MP2DhNrX8HwAAAAw"]
[Mon Feb 09 04:04:52.444446 2026] [:error] [pid 47938:tid 47984] [client 20.48.253.154:26098] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aYjsZLVCzWE6fQJEkNL3EQAAAEU"]
[Mon Feb 09 04:04:52.929114 2026] [:error] [pid 47938:tid 47998] [client 20.48.253.154:26059] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aYjsZLVCzWE6fQJEkNL3EgAAAFM"]
[Mon Feb 09 04:04:53.369107 2026] [:error] [pid 47937:tid 47969] [client 20.48.253.154:26068] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/index.php"] [unique_id "aYjsZc4Fd42MP2DhNrX8IQAAABc"]
[Mon Feb 09 04:04:54.041872 2026] [:error] [pid 48044:tid 48065] [client 20.48.253.154:16332] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/index.php"] [unique_id "aYjsZpvmvsMP5E03sZKgVQAAANM"]
[Mon Feb 09 04:04:54.564580 2026] [:error] [pid 47937:tid 47967] [client 20.48.253.154:16118] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/index.php"] [unique_id "aYjsZs4Fd42MP2DhNrX8JQAAABU"]
[Mon Feb 09 04:04:55.216675 2026] [:error] [pid 47937:tid 47947] [client 20.48.253.154:36410] [client 20.48.253.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/index.php"] [unique_id "aYjsZ84Fd42MP2DhNrX8KQAAAAE"]
[Mon Feb 09 04:28:03.853166 2026] [:error] [pid 18303:tid 18319] [client 47.161.210.7:41556] [client 47.161.210.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.161.210.7, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYjx00Y7TEaZkFrGG4mwqwAAAQ4"]
[Mon Feb 09 04:28:08.641495 2026] [:error] [pid 18303:tid 18324] [client 47.161.210.7:41556] [client 47.161.210.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.161.210.7, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYjx2EY7TEaZkFrGG4mwsAAAARM"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 05:11:51.807412 2026] [:error] [pid 48044:tid 48055] [client 91.134.81.133:36275] [client 91.134.81.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.134.81.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYj8F5vmvsMP5E03sZLASgAAAMk"]
[Mon Feb 09 05:11:52.847369 2026] [:error] [pid 48044:tid 48062] [client 91.134.81.133:36275] [client 91.134.81.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.134.81.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYj8GJvmvsMP5E03sZLASwAAANA"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 05:47:05.086388 2026] [:error] [pid 18303:tid 18317] [client 147.79.68.118:35304] [client 147.79.68.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 147.79.68.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYkEWUY7TEaZkFrGG4nbqgAAAQw"]
[Mon Feb 09 05:47:06.556854 2026] [:error] [pid 18303:tid 18310] [client 147.79.68.118:35304] [client 147.79.68.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 147.79.68.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYkEWkY7TEaZkFrGG4nbrAAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 06:04:28.265795 2026] [:error] [pid 47938:tid 48000] [client 151.115.90.241:38074] [client 151.115.90.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 151.115.90.241, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYkIbLVCzWE6fQJEkNInyQAAAFU"]
[Mon Feb 09 06:34:01.256919 2026] [:error] [pid 18303:tid 18321] [client 161.248.223.31:43522] [client 161.248.223.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.248.223.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYkPWUY7TEaZkFrGG4n05AAAARA"]
[Mon Feb 09 06:34:02.919698 2026] [:error] [pid 18303:tid 18317] [client 161.248.223.31:43522] [client 161.248.223.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.248.223.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYkPWkY7TEaZkFrGG4n05wAAAQw"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 06:54:29.873289 2026] [:error] [pid 48044:tid 48066] [client 103.138.189.49:41540] [client 103.138.189.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.138.189.49, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYkUJZvmvsMP5E03sZLvPgAAANQ"]
[Mon Feb 09 06:54:30.961171 2026] [:error] [pid 48044:tid 48062] [client 103.138.189.49:41540] [client 103.138.189.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.138.189.49, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYkUJpvmvsMP5E03sZLvQQAAANA"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 06:55:19.360986 2026] [:error] [pid 18303:tid 18311] [client 65.254.225.220:39250] [client 65.254.225.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYkUV0Y7TEaZkFrGG4kCfwAAAQY"]
[Mon Feb 09 06:55:20.400877 2026] [:error] [pid 18303:tid 18321] [client 65.254.225.220:39250] [client 65.254.225.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYkUWEY7TEaZkFrGG4kCgwAAARA"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 07:23:30.930612 2026] [:error] [pid 60589:tid 60607] [client 185.208.174.156:52732] [client 185.208.174.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.208.174.156, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYka8jIJyhPWC0JyMLzKyAAAAdA"]
[Mon Feb 09 07:23:33.218796 2026] [:error] [pid 60589:tid 60609] [client 185.208.174.156:52732] [client 185.208.174.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.208.174.156, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYka9TIJyhPWC0JyMLzK0AAAAdI"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 07:24:37.290638 2026] [:error] [pid 47937:tid 47969] [client 65.21.29.43:58682] [client 65.21.29.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.21.29.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYkbNc4Fd42MP2DhNrVHZwAAABc"]
[Mon Feb 09 07:24:39.481564 2026] [:error] [pid 47937:tid 47950] [client 65.21.29.43:58682] [client 65.21.29.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.21.29.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYkbN84Fd42MP2DhNrVHaQAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 07:51:54.839212 2026] [:error] [pid 18303:tid 18321] [client 77.92.144.132:46168] [client 77.92.144.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.92.144.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYkhmkY7TEaZkFrGG4kRpgAAARA"]
[Mon Feb 09 07:51:59.772034 2026] [:error] [pid 60619:tid 60661] [client 184.168.120.235:57024] [client 184.168.120.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.120.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYkhn3Epg0UoeR8kJ-1xNwAAAkw"]
[Mon Feb 09 07:52:23.868728 2026] [:error] [pid 60677:tid 60720] [client 193.202.110.21:58160] [client 193.202.110.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.202.110.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYkht1yBgzfmDf6Gaeu9IAAAAsk"]
[Mon Feb 09 07:52:28.356490 2026] [:error] [pid 60619:tid 60673] [client 116.103.108.158:51456] [client 116.103.108.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.103.108.158, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYkhvHEpg0UoeR8kJ-1xhQAAAlc"]
[Mon Feb 09 07:52:31.643809 2026] [:error] [pid 60508:tid 60511] [client 167.99.116.143:46466] [client 167.99.116.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.116.143, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYkhv-XDvLC4ADfnEzMiBgAAAYE"]
[Mon Feb 09 08:00:45.148736 2026] [:error] [pid 60619:tid 60671] [client 43.157.20.63:59896] [client 43.157.20.63] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYkjrXEpg0UoeR8kJ-11CQAAAlU"]
[Mon Feb 09 08:03:41.855800 2026] [:error] [pid 60619:tid 60665] [client 65.254.225.212:45448] [client 65.254.225.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.254.225.212, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYkkXXEpg0UoeR8kJ-12lQAAAk8"]
[Mon Feb 09 08:14:14.002366 2026] [:error] [pid 60619:tid 60664] [client 65.21.72.120:55926] [client 65.21.72.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.21.72.120, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYkm1nEpg0UoeR8kJ-17dAAAAk4"]
[Mon Feb 09 08:14:14.978037 2026] [:error] [pid 60619:tid 60641] [client 65.21.72.120:55926] [client 65.21.72.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.21.72.120, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYkm1nEpg0UoeR8kJ-17dgAAAkE"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 08:27:01.301703 2026] [:error] [pid 60679:tid 60748] [client 45.19.204.17:40168] [client 45.19.204.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.19.204.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYkp1cixhoT1e6Iv6g9c6QAAA0o"]
[Mon Feb 09 08:27:03.935954 2026] [:error] [pid 60589:tid 60612] [client 45.19.204.17:40180] [client 45.19.204.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.19.204.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYkp1zIJyhPWC0JyMLzgOQAAAdU"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 08:51:48.794819 2026] [:error] [pid 60679:tid 60784] [client 209.172.2.40:51866] [client 209.172.2.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.172.2.40, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYkvpMixhoT1e6Iv6g9jJQAAA1g"]
[Mon Feb 09 08:51:49.831033 2026] [:error] [pid 60679:tid 60781] [client 209.172.2.40:51866] [client 209.172.2.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.172.2.40, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYkvpcixhoT1e6Iv6g9jJgAAA1c"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 10:57:16.277634 2026] [:error] [pid 60508:tid 60521] [client 209.235.136.144:44930] [client 209.235.136.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYlNDOXDvLC4ADfnEzNWPQAAAYs"]
[Mon Feb 09 10:57:21.123659 2026] [:error] [pid 60508:tid 60510] [client 209.235.136.144:44930] [client 209.235.136.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYlNEeXDvLC4ADfnEzNWQgAAAYA"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 11:25:25.388768 2026] [:error] [pid 60619:tid 60663] [client 94.237.69.112:41468] [client 94.237.69.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.237.69.112, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYlTpXEpg0UoeR8kJ-28KQAAAk0"]
[Mon Feb 09 11:25:28.473432 2026] [:error] [pid 60677:tid 60773] [client 103.37.61.52:51410] [client 103.37.61.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.37.61.52, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYlTqFyBgzfmDf6GaesIqwAAAtY"]
[Mon Feb 09 11:25:32.266617 2026] [:error] [pid 60676:tid 60687] [client 34.19.240.49:49098] [client 34.19.240.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.19.240.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYlTrHhKcn7mJYMx5_BE9AAAAoM"]
[Mon Feb 09 11:26:04.112742 2026] [:error] [pid 60619:tid 60672] [client 130.211.204.218:39894] [client 130.211.204.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.211.204.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYlTzHEpg0UoeR8kJ-28XgAAAlY"]
[Mon Feb 09 11:26:11.205708 2026] [:error] [pid 60676:tid 60694] [client 154.222.16.33:52748] [client 154.222.16.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.222.16.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYlT03hKcn7mJYMx5_BFBgAAAoo"]
[Mon Feb 09 11:26:20.415715 2026] [:error] [pid 60677:tid 60722] [client 34.69.68.107:38674] [client 34.69.68.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.68.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYlT3FyBgzfmDf6GaesI7AAAAso"]
[Mon Feb 09 11:28:29.512434 2026] [:error] [pid 18303:tid 18311] [client 203.161.54.74:49372] [client 203.161.54.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.161.54.74, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYlUXUY7TEaZkFrGG4k_HgAAAQY"]
[Mon Feb 09 11:28:30.509088 2026] [:error] [pid 18303:tid 18328] [client 203.161.54.74:49372] [client 203.161.54.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.161.54.74, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYlUXkY7TEaZkFrGG4k_IAAAARc"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 11:31:54.587724 2026] [:error] [pid 18303:tid 18328] [client 185.125.27.109:41026] [client 185.125.27.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.125.27.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYlVKkY7TEaZkFrGG4k_uAAAARc"]
[Mon Feb 09 11:53:22.322927 2026] [:error] [pid 60677:tid 60717] [client 185.162.89.7:37452] [client 185.162.89.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.162.89.7, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYlaMlyBgzfmDf6GaesSzgAAAsY"]
[Mon Feb 09 11:53:24.164358 2026] [:error] [pid 60677:tid 60725] [client 185.162.89.7:37452] [client 185.162.89.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.162.89.7, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYlaNFyBgzfmDf6GaesS1AAAAss"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 12:07:18.099517 2026] [:error] [pid 18303:tid 18311] [client 209.235.136.144:55752] [client 209.235.136.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYlddkY7TEaZkFrGG4lGTgAAAQY"]
[Mon Feb 09 12:07:20.914634 2026] [:error] [pid 18303:tid 18323] [client 209.235.136.144:55752] [client 209.235.136.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.235.136.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYldeEY7TEaZkFrGG4lGUQAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 12:59:36.397276 2026] [:error] [pid 60589:tid 60603] [client 66.94.119.146:47384] [client 66.94.119.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.94.119.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYlpuDIJyhPWC0JyMLwoQwAAAcw"]
[Mon Feb 09 12:59:37.406397 2026] [:error] [pid 60589:tid 60597] [client 66.94.119.146:47384] [client 66.94.119.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.94.119.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYlpuTIJyhPWC0JyMLwoRAAAAcY"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 13:20:14.876396 2026] [:error] [pid 60619:tid 60668] [client 74.7.241.45:52456] [client 74.7.241.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.7.241.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYlujnEpg0UoeR8kJ-3Y-gAAAlI"], referer: https://expressinteriors.com/
[Mon Feb 09 13:20:32.055099 2026] [:error] [pid 60619:tid 60670] [client 74.7.241.45:52456] [client 74.7.241.45] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "aYluoHEpg0UoeR8kJ-3ZIwAAAlQ"], referer: https://expressinteriors.com/author/acs/
[Mon Feb 09 13:20:36.506817 2026] [:error] [pid 60619:tid 60664] [client 74.7.241.45:52456] [client 74.7.241.45] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.7.241.45, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYlupHEpg0UoeR8kJ-3ZKwAAAk4"], referer: https://expressinteriors.com/2023/02/27/hello-world/
[Mon Feb 09 13:58:05.459938 2026] [:error] [pid 18303:tid 18321] [client 161.248.223.31:47500] [client 161.248.223.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.248.223.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYl3bUY7TEaZkFrGG4lZ5QAAARA"]
[Mon Feb 09 13:58:07.341237 2026] [:error] [pid 18303:tid 18318] [client 161.248.223.31:47500] [client 161.248.223.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.248.223.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYl3b0Y7TEaZkFrGG4lZ5gAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 14:12:57.818476 2026] [:error] [pid 60677:tid 60714] [client 190.92.174.29:35118] [client 190.92.174.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.92.174.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYl66VyBgzfmDf6GaetPPwAAAsM"]
[Mon Feb 09 14:12:58.873169 2026] [:error] [pid 60677:tid 60722] [client 190.92.174.29:35118] [client 190.92.174.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.92.174.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYl66lyBgzfmDf6GaetPRgAAAso"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 14:39:46.316708 2026] [:error] [pid 47938:tid 48000] [client 202.124.204.254:47578] [client 202.124.204.254] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.124.204.254, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYmBMrVCzWE6fQJEkNLP8QAAAFU"]
[Mon Feb 09 14:40:06.798667 2026] [:error] [pid 60508:tid 60514] [client 202.124.204.254:58868] [client 202.124.204.254] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.124.204.254, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYmBRuXDvLC4ADfnEzOJRgAAAYQ"]
[Mon Feb 09 14:40:11.552707 2026] [:error] [pid 60508:tid 60512] [client 202.124.204.254:58868] [client 202.124.204.254] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.124.204.254, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYmBS-XDvLC4ADfnEzOJSQAAAYI"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 14:40:47.585817 2026] [:error] [pid 60508:tid 60533] [client 202.124.204.254:53222] [client 202.124.204.254] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.124.204.254, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYmBb-XDvLC4ADfnEzOJZAAAAZc"]
[Mon Feb 09 15:01:32.135620 2026] [:error] [pid 60589:tid 60605] [client 103.82.22.235:42236] [client 103.82.22.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.82.22.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYmGTDIJyhPWC0JyMLxGFQAAAc4"]
[Mon Feb 09 15:01:34.738988 2026] [:error] [pid 60589:tid 60607] [client 103.82.22.235:42236] [client 103.82.22.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.82.22.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYmGTjIJyhPWC0JyMLxGFwAAAdA"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 15:39:08.326374 2026] [:error] [pid 18303:tid 18314] [client 122.175.189.80:35398] [client 122.175.189.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 122.175.189.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYmPHEY7TEaZkFrGG4ltoAAAAQk"]
[Mon Feb 09 15:39:09.449720 2026] [:error] [pid 18303:tid 18305] [client 122.175.189.80:35398] [client 122.175.189.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 122.175.189.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYmPHUY7TEaZkFrGG4ltogAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 15:59:57.953646 2026] [:error] [pid 60678:tid 60747] [client 162.0.220.160:47460] [client 162.0.220.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.220.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYmT_e8Gd_fDFrcNu4OGUAAAAwg"]
[Mon Feb 09 16:00:01.288932 2026] [:error] [pid 60678:tid 60785] [client 162.0.220.160:47460] [client 162.0.220.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.220.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYmUAe8Gd_fDFrcNu4OGVgAAAxU"], referer: https://expressinteriors.com/wp-login.php
[Mon Feb 09 17:01:34.685407 2026] [:error] [pid 60589:tid 60595] [client 43.157.50.58:50190] [client 43.157.50.58] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYmibjIJyhPWC0JyMLxjhAAAAcQ"]
[Mon Feb 09 17:07:12.782209 2026] [:error] [pid 47937:tid 47963] [client 118.27.125.50:59930] [client 118.27.125.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.27.125.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYmjwM4Fd42MP2DhNrXJjwAAABE"]
[Mon Feb 09 17:07:14.082325 2026] [:error] [pid 60679:tid 60759] [client 192.64.117.254:50036] [client 192.64.117.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.64.117.254, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYmjwsixhoT1e6Iv6g_GswAAA04"]
[Mon Feb 09 17:07:24.634926 2026] [:error] [pid 60677:tid 60770] [client 159.75.126.74:46676] [client 159.75.126.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.75.126.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYmjzFyBgzfmDf6GaeuWOgAAAtU"]
[Mon Feb 09 17:07:30.091564 2026] [:error] [pid 60676:tid 60702] [client 167.172.67.131:54814] [client 167.172.67.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.67.131, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYmj0nhKcn7mJYMx5_CF1QAAApI"]
[Mon Feb 09 17:07:47.145867 2026] [:error] [pid 60508:tid 60532] [client 155.94.145.228:43514] [client 155.94.145.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.94.145.228, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYmj4-XDvLC4ADfnEzOozwAAAZY"]
[Mon Feb 09 17:08:01.509997 2026] [:error] [pid 60619:tid 60670] [client 103.196.146.240:58128] [client 103.196.146.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.196.146.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYmj8XEpg0UoeR8kJ-0XBQAAAlQ"]
[Mon Feb 09 17:08:13.481233 2026] [:error] [pid 47938:tid 47986] [client 103.124.95.33:58952] [client 103.124.95.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.124.95.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYmj_bVCzWE6fQJEkNL79gAAAEc"]
[Mon Feb 09 17:08:40.045787 2026] [:error] [pid 60676:tid 60691] [client 110.164.163.21:51424] [client 110.164.163.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.164.163.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYmkGHhKcn7mJYMx5_CGCgAAAoc"]
[Mon Feb 09 17:27:47.686000 2026] [:error] [pid 60508:tid 60523] [client 54.38.245.207:45266] [client 54.38.245.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.245.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYmok-XDvLC4ADfnEzOtGAAAAY0"]
[Mon Feb 09 18:43:16.949360 2026] [:error] [pid 60677:tid 60770] [client 94.247.172.129:22798] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYm6RFyBgzfmDf6Gaeu4JQAAAtU"]
[Mon Feb 09 21:37:59.735669 2026] [:error] [pid 60589:tid 60611] [client 157.245.238.103:53978] [client 157.245.238.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.238.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYnjNzIJyhPWC0JyMLyfSwAAAdQ"]
[Mon Feb 09 21:38:01.865307 2026] [:error] [pid 60677:tid 60758] [client 64.225.20.171:39136] [client 64.225.20.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.225.20.171, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYnjOVyBgzfmDf6Gaev0yAAAAtM"]
[Mon Feb 09 21:38:01.902891 2026] [:error] [pid 47938:tid 47992] [client 165.22.61.123:47348] [client 165.22.61.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.61.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYnjObVCzWE6fQJEkNJFQgAAAE0"]
[Mon Feb 09 21:38:06.372112 2026] [:error] [pid 60678:tid 60724] [client 101.46.58.127:57636] [client 101.46.58.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 101.46.58.127, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYnjPu8Gd_fDFrcNu4O-7wAAAwE"]
[Mon Feb 09 21:38:06.427142 2026] [:error] [pid 60619:tid 60646] [client 195.88.82.88:50307] [client 195.88.82.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.88.82.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYnjPnEpg0UoeR8kJ-1WXQAAAkU"]
[Mon Feb 09 21:38:11.800318 2026] [:error] [pid 60676:tid 60704] [client 160.250.227.36:54356] [client 160.250.227.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.227.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYnjQ3hKcn7mJYMx5_Cv3wAAApQ"]
[Mon Feb 09 21:38:13.382899 2026] [:error] [pid 60619:tid 60646] [client 43.129.189.147:44574] [client 43.129.189.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.129.189.147, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYnjRXEpg0UoeR8kJ-1WZgAAAkU"]
[Mon Feb 09 22:39:46.113781 2026] [:error] [pid 60508:tid 60521] [client 45.92.1.94:57080] [client 45.92.1.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "aYnxsuXDvLC4ADfnEzPoqwAAAYs"]
[Mon Feb 09 22:39:46.625593 2026] [:error] [pid 18303:tid 18306] [client 45.92.1.94:57123] [client 45.92.1.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "aYnxskY7TEaZkFrGG4myJQAAAQE"]
[Mon Feb 09 22:39:47.132495 2026] [:error] [pid 60679:tid 60733] [client 45.92.1.94:57163] [client 45.92.1.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "aYnxs8ixhoT1e6Iv6g_8uAAAA0M"]
[Mon Feb 09 22:39:49.235092 2026] [:error] [pid 60589:tid 60607] [client 45.92.1.94:57359] [client 45.92.1.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "aYnxtTIJyhPWC0JyMLyqOQAAAdA"]
[Mon Feb 09 22:39:51.839565 2026] [:error] [pid 60679:tid 60738] [client 43.133.14.237:40424] [client 43.133.14.237] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYnxt8ixhoT1e6Iv6g_8vAAAA0Y"]
[Tue Feb 10 00:02:46.732421 2026] [:error] [pid 47938:tid 47995] [client 20.163.27.0:45526] [client 20.163.27.0] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.163.27.0, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYoFJrVCzWE6fQJEkNJnFwAAAFA"]
[Tue Feb 10 00:11:24.598663 2026] [:error] [pid 60677:tid 60756] [client 34.69.39.12:57002] [client 34.69.39.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.39.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYoHLFyBgzfmDf6GaesiEwAAAtI"]
[Tue Feb 10 00:11:24.657669 2026] [:error] [pid 60619:tid 60650] [client 34.69.39.12:53339] [client 34.69.39.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.39.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYoHLHEpg0UoeR8kJ-18PwAAAkg"]
[Tue Feb 10 00:11:26.979974 2026] [:error] [pid 60677:tid 60718] [client 34.69.39.12:57002] [client 34.69.39.12] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYoHLlyBgzfmDf6GaesiGQAAAsc"]
[Tue Feb 10 00:11:27.187088 2026] [:error] [pid 60619:tid 60647] [client 34.69.39.12:53339] [client 34.69.39.12] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYoHL3Epg0UoeR8kJ-18RQAAAkY"]
[Tue Feb 10 00:11:27.192059 2026] [:error] [pid 60677:tid 60719] [client 34.69.39.12:57002] [client 34.69.39.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.39.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYoHL1yBgzfmDf6GaesiGgAAAsg"]
[Tue Feb 10 00:11:27.399489 2026] [:error] [pid 60619:tid 60643] [client 34.69.39.12:53339] [client 34.69.39.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.39.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYoHL3Epg0UoeR8kJ-18RwAAAkM"]
[Tue Feb 10 00:11:28.662685 2026] [:error] [pid 60678:tid 60747] [client 34.69.39.12:50430] [client 34.69.39.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.39.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYoHMO8Gd_fDFrcNu4PVTgAAAwg"]
[Tue Feb 10 00:11:28.870040 2026] [:error] [pid 60589:tid 60592] [client 34.69.39.12:59134] [client 34.69.39.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.39.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYoHMDIJyhPWC0JyMLy64QAAAcE"]
[Tue Feb 10 00:11:30.203807 2026] [:error] [pid 60508:tid 60521] [client 34.69.39.12:58313] [client 34.69.39.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.39.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYoHMuXDvLC4ADfnEzP5pQAAAYs"]
[Tue Feb 10 00:11:30.204023 2026] [:error] [pid 60508:tid 60521] [client 34.69.39.12:58313] [client 34.69.39.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.69.39.12, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYoHMuXDvLC4ADfnEzP5pQAAAYs"]
[Tue Feb 10 00:11:30.447644 2026] [:error] [pid 60508:tid 60520] [client 34.69.39.12:51974] [client 34.69.39.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.39.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYoHMuXDvLC4ADfnEzP5pgAAAYo"]
[Tue Feb 10 00:11:30.447806 2026] [:error] [pid 60508:tid 60520] [client 34.69.39.12:51974] [client 34.69.39.12] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.69.39.12, counter = 8"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYoHMuXDvLC4ADfnEzP5pgAAAYo"]
[Tue Feb 10 01:39:45.900248 2026] [:error] [pid 34046:tid 34112] [client 167.86.83.231:50716] [client 167.86.83.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "aYob4XP7l4DEEA1DQG_RIwAAAQk"], referer: binance.com
[Tue Feb 10 02:05:20.763437 2026] [:error] [pid 34046:tid 34117] [client 148.113.5.85:55090] [client 148.113.5.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.5.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYoh4HP7l4DEEA1DQG_YIAAAAQ4"]
[Tue Feb 10 02:05:23.618964 2026] [:error] [pid 14194:tid 14207] [client 193.254.188.223:33020] [client 193.254.188.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.254.188.223, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYoh409dsx8pYaYQoND4oAAAAUs"]
[Tue Feb 10 02:23:24.684065 2026] [:error] [pid 14194:tid 14207] [client 122.51.236.174:43854] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYomHE9dsx8pYaYQoNAAwQAAAUs"]
[Tue Feb 10 02:38:09.856672 2026] [:error] [pid 34139:tid 34150] [client 118.27.125.50:32914] [client 118.27.125.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.27.125.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYopkegedr85OdF4Mt0LCwAAAIc"]
[Tue Feb 10 02:38:27.141497 2026] [:error] [pid 34139:tid 34151] [client 31.177.95.217:47290] [client 31.177.95.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.177.95.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYopo-gedr85OdF4Mt0LEwAAAIg"]
[Tue Feb 10 02:38:36.538660 2026] [:error] [pid 14194:tid 14201] [client 120.76.99.214:34062] [client 120.76.99.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.76.99.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYoprE9dsx8pYaYQoNAH-QAAAUU"]
[Tue Feb 10 02:38:37.510210 2026] [:error] [pid 34044:tid 34070] [client 203.162.234.20:60726] [client 203.162.234.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.162.234.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYoprXKt48XODNt-cM-RrgAAABY"]
[Tue Feb 10 02:38:45.060268 2026] [:error] [pid 14069:tid 14078] [client 45.207.210.202:52448] [client 45.207.210.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.207.210.202, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYoptYzIGuLoki0yhfHuTwAAAMc"]
[Tue Feb 10 02:38:45.802913 2026] [:error] [pid 14069:tid 14085] [client 93.187.203.101:40366] [client 93.187.203.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.187.203.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYoptYzIGuLoki0yhfHuUQAAAM4"]
[Tue Feb 10 02:38:54.906483 2026] [:error] [pid 34046:tid 34106] [client 195.88.82.88:53609] [client 195.88.82.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.88.82.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYopvnP7l4DEEA1DQG_f-wAAAQM"]
[Tue Feb 10 02:39:04.287610 2026] [:error] [pid 34046:tid 34122] [client 118.27.125.50:38368] [client 118.27.125.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.27.125.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYopyHP7l4DEEA1DQG_gCQAAARM"]
[Tue Feb 10 02:39:17.382226 2026] [:error] [pid 14194:tid 14199] [client 122.155.171.214:47918] [client 122.155.171.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.155.171.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYop1U9dsx8pYaYQoNAIKgAAAUM"]
[Tue Feb 10 03:02:15.555201 2026] [:error] [pid 34046:tid 34122] [client 196.171.90.26:58161] [client 196.171.90.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.171.90.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYovN3P7l4DEEA1DQG_n8gAAARM"]
[Tue Feb 10 03:19:06.164115 2026] [:error] [pid 34046:tid 34110] [client 99.79.116.107:37688] [client 99.79.116.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 99.79.116.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYozKnP7l4DEEA1DQG_sRQAAAQc"]
[Tue Feb 10 04:11:22.135784 2026] [:error] [pid 47837:tid 47903] [client 200.152.177.24:35432] [client 200.152.177.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.152.177.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYo_anFY8KYFPX79Z4m7xgAAAIM"]
[Tue Feb 10 04:41:01.830469 2026] [:error] [pid 47837:tid 47914] [client 43.157.82.252:38830] [client 43.157.82.252] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYpGXXFY8KYFPX79Z4nLyAAAAI4"]
[Tue Feb 10 05:04:34.546967 2026] [:error] [pid 47837:tid 47908] [client 37.27.108.93:41824] [client 37.27.108.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.27.108.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYpL4nFY8KYFPX79Z4nWKQAAAIg"]
[Tue Feb 10 05:55:37.365278 2026] [:error] [pid 47937:tid 47956] [client 69.62.81.48:36382] [client 69.62.81.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.62.81.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYpX2cpqXpC2CvJ3fOOXCgAAANE"]
[Tue Feb 10 06:50:19.156091 2026] [:error] [pid 47837:tid 47902] [client 157.90.158.130:47068] [client 157.90.158.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.90.158.130, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYpkq3FY8KYFPX79Z4n-lwAAAII"]
[Tue Feb 10 07:16:51.110253 2026] [:error] [pid 47830:tid 47857] [client 195.88.82.88:64744] [client 195.88.82.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.88.82.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYpq40co45BZs8e301BcSAAAAAs"]
[Tue Feb 10 07:16:55.640640 2026] [:error] [pid 30054:tid 30057] [client 101.46.58.127:39048] [client 101.46.58.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 101.46.58.127, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYpq52ecgOOXCu-GgYVXaQAAAQE"]
[Tue Feb 10 07:17:24.177649 2026] [:error] [pid 30054:tid 30074] [client 190.92.174.109:49410] [client 190.92.174.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.92.174.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYprBGecgOOXCu-GgYVXnwAAARI"]
[Tue Feb 10 07:17:52.999740 2026] [:error] [pid 47937:tid 47953] [client 34.38.124.37:43486] [client 34.38.124.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.38.124.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYprIMpqXpC2CvJ3fOO5tgAAAM4"]
[Tue Feb 10 07:17:55.391166 2026] [:error] [pid 47830:tid 47868] [client 103.196.146.240:54860] [client 103.196.146.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.196.146.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYprI0co45BZs8e301BcvQAAABY"]
[Tue Feb 10 07:44:56.127680 2026] [:error] [pid 47937:tid 47961] [client 178.128.255.38:35434] [client 178.128.255.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.128.255.38, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYpxeMpqXpC2CvJ3fOPGdAAAANY"]
[Tue Feb 10 08:16:30.505754 2026] [:error] [pid 47937:tid 47942] [client 43.152.72.244:45066] [client 43.152.72.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYp43spqXpC2CvJ3fOPTygAAAMM"]
[Tue Feb 10 08:36:53.095881 2026] [:error] [pid 47837:tid 47924] [client 192.162.12.86:37370] [client 192.162.12.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.162.12.86, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYp9pXFY8KYFPX79Z4kpUAAAAJg"]
[Tue Feb 10 08:37:42.246953 2026] [:error] [pid 30054:tid 30065] [client 104.28.240.86:51556] [client 104.28.240.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.240.86, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYp91mecgOOXCu-GgYWJsgAAAQk"]
[Tue Feb 10 08:37:45.345693 2026] [:error] [pid 59407:tid 59423] [client 104.28.240.86:51609] [client 104.28.240.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.240.86, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYp92WLlhBXE3qmX-JlxtwAAAU4"]
[Tue Feb 10 08:37:48.485307 2026] [:error] [pid 59407:tid 59411] [client 104.28.240.86:51646] [client 104.28.240.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.240.86, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYp93GLlhBXE3qmX-JlxvwAAAUI"]
[Tue Feb 10 08:43:50.912940 2026] [:error] [pid 47837:tid 47920] [client 121.229.185.160:59053] [client 121.229.185.160] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYp_RnFY8KYFPX79Z4krNgAAAJQ"]
[Tue Feb 10 09:07:22.829310 2026] [:error] [pid 47837:tid 47904] [client 104.248.240.27:62618] [client 104.248.240.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.248.240.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYqEynFY8KYFPX79Z4kyGgAAAIQ"]
[Tue Feb 10 09:07:24.518347 2026] [:error] [pid 30054:tid 30069] [client 104.248.240.27:63341] [client 104.248.240.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.248.240.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYqEzGecgOOXCu-GgYWYaAAAAQ0"]
[Tue Feb 10 09:33:09.291891 2026] [:error] [pid 30054:tid 30065] [client 37.27.108.93:34870] [client 37.27.108.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.27.108.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYqK1WecgOOXCu-GgYWigQAAAQk"]
[Tue Feb 10 09:52:37.456781 2026] [:error] [pid 7704:tid 7718] [client 104.248.240.27:50853] [client 104.248.240.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.248.240.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYqPZf0EcqgVBUs6CW2JhQAAAcs"]
[Tue Feb 10 09:56:34.121376 2026] [:error] [pid 59544:tid 59556] [client 104.248.240.27:64953] [client 104.248.240.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.248.240.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYqQUqZySR9mFY4BailWNAAAAYg"]
[Tue Feb 10 10:00:51.232887 2026] [:error] [pid 47837:tid 47915] [client 104.248.240.27:61895] [client 104.248.240.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.248.240.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYqRU3FY8KYFPX79Z4lA5AAAAI8"]
[Tue Feb 10 10:23:23.644745 2026] [:error] [pid 47837:tid 47909] [client 167.99.240.84:41162] [client 167.99.240.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.240.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYqWm3FY8KYFPX79Z4lGtAAAAIk"]
[Tue Feb 10 10:51:05.538873 2026] [:error] [pid 47831:tid 47880] [client 206.81.19.8:63009] [client 206.81.19.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.81.19.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYqdGSdxbZYarWVkiAC4HQAAAEc"]
[Tue Feb 10 10:51:07.294200 2026] [:error] [pid 30054:tid 30077] [client 206.81.19.8:63336] [client 206.81.19.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.81.19.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYqdG2ecgOOXCu-GgYW0KwAAARU"]
[Tue Feb 10 11:18:57.352494 2026] [:error] [pid 59407:tid 59425] [client 156.239.217.9:35854] [client 156.239.217.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.217.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYqjoWLlhBXE3qmX-JmcXAAAAVA"]
[Tue Feb 10 11:18:59.568933 2026] [:error] [pid 47830:tid 47857] [client 154.82.170.41:40148] [client 154.82.170.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.82.170.41, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYqjo0co45BZs8e301C-PwAAAAs"], referer: http://expressinteriors.com/wp-login.php
[Tue Feb 10 11:19:05.029123 2026] [:error] [pid 47937:tid 47941] [client 156.239.198.58:22730] [client 156.239.198.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYqjqcpqXpC2CvJ3fOMPcAAAAMI"]
[Tue Feb 10 11:19:08.001751 2026] [:error] [pid 47831:tid 47880] [client 154.199.14.197:50804] [client 154.199.14.197] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.199.14.197, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYqjrCdxbZYarWVkiAC-9QAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Tue Feb 10 11:19:08.005273 2026] [:error] [pid 47831:tid 47880] [client 154.199.14.197:50804] [client 154.199.14.197] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYqjrCdxbZYarWVkiAC-9QAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Tue Feb 10 11:19:10.006585 2026] [:error] [pid 7704:tid 7726] [client 156.249.126.92:54868] [client 156.249.126.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.249.126.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYqjrv0EcqgVBUs6CW2dFQAAAdM"], referer: https://expressinteriors.com/wp-login.php
[Tue Feb 10 11:19:10.010338 2026] [:error] [pid 7704:tid 7726] [client 156.249.126.92:54868] [client 156.249.126.92] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYqjrv0EcqgVBUs6CW2dFQAAAdM"], referer: https://expressinteriors.com/wp-login.php
[Tue Feb 10 11:19:12.673003 2026] [:error] [pid 59407:tid 59409] [client 154.82.168.195:41188] [client 154.82.168.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.82.168.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYqjsGLlhBXE3qmX-JmccAAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Tue Feb 10 11:19:12.677986 2026] [:error] [pid 59407:tid 59409] [client 154.82.168.195:41188] [client 154.82.168.195] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYqjsGLlhBXE3qmX-JmccAAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Tue Feb 10 11:19:14.283810 2026] [:error] [pid 47830:tid 47851] [client 156.242.51.23:13704] [client 156.242.51.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.242.51.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYqjskco45BZs8e301C-UgAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Tue Feb 10 11:19:14.288073 2026] [:error] [pid 47830:tid 47851] [client 156.242.51.23:13704] [client 156.242.51.23] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYqjskco45BZs8e301C-UgAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Tue Feb 10 11:19:15.606997 2026] [:error] [pid 47830:tid 47864] [client 154.86.114.170:40644] [client 154.86.114.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.86.114.170, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYqjs0co45BZs8e301C-VQAAABI"], referer: https://expressinteriors.com/wp-login.php
[Tue Feb 10 11:19:15.611328 2026] [:error] [pid 47830:tid 47864] [client 154.86.114.170:40644] [client 154.86.114.170] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYqjs0co45BZs8e301C-VQAAABI"], referer: https://expressinteriors.com/wp-login.php
[Tue Feb 10 11:19:27.316630 2026] [:error] [pid 47831:tid 47892] [client 61.59.6.105:47182] [client 61.59.6.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 61.59.6.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYqjvydxbZYarWVkiAC_CgAAAFM"]
[Tue Feb 10 12:01:04.103710 2026] [:error] [pid 47831:tid 47894] [client 220.158.233.50:4162] [client 220.158.233.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.158.233.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYqtgCdxbZYarWVkiADJ7wAAAFU"]
[Tue Feb 10 12:01:30.342437 2026] [:error] [pid 47937:tid 47956] [client 120.79.172.65:50180] [client 120.79.172.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.79.172.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYqtmspqXpC2CvJ3fOMdjwAAANE"]
[Tue Feb 10 12:01:41.547155 2026] [:error] [pid 47837:tid 47921] [client 47.115.48.198:50842] [client 47.115.48.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.115.48.198, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYqtpXFY8KYFPX79Z4lj-wAAAJU"]
[Tue Feb 10 12:01:43.432255 2026] [:error] [pid 30054:tid 30064] [client 89.43.17.214:48422] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYqtp2ecgOOXCu-GgYXF1gAAAQg"]
[Tue Feb 10 12:01:47.666019 2026] [:error] [pid 47937:tid 47955] [client 220.158.233.50:44528] [client 220.158.233.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.158.233.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYqtq8pqXpC2CvJ3fOMdowAAANA"]
[Tue Feb 10 12:02:06.424347 2026] [:error] [pid 47937:tid 47948] [client 82.156.14.49:60590] [client 82.156.14.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.156.14.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYqtvspqXpC2CvJ3fOMdtgAAAMk"]
[Tue Feb 10 12:13:36.704800 2026] [:error] [pid 59544:tid 59558] [client 164.132.49.123:54324] [client 164.132.49.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.49.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYqwcKZySR9mFY4Bail8dgAAAYo"]
[Tue Feb 10 13:10:49.031918 2026] [:error] [pid 30054:tid 30063] [client 85.214.228.221:42766] [client 85.214.228.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.228.221, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYq92WecgOOXCu-GgYXW9QAAAQc"]
[Tue Feb 10 14:08:11.180630 2026] [:error] [pid 47830:tid 47848] [client 94.130.66.41:40230] [client 94.130.66.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.130.66.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYrLS0co45BZs8e301AKaQAAAAI"]
[Tue Feb 10 14:16:06.393986 2026] [:error] [pid 47831:tid 47877] [client 43.166.244.66:45298] [client 43.166.244.66] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYrNJidxbZYarWVkiADsvAAAAEQ"]
[Tue Feb 10 15:03:19.240221 2026] [:error] [pid 47937:tid 47939] [client 164.132.49.123:54976] [client 164.132.49.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.49.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYrYN8pqXpC2CvJ3fONbVQAAAMA"]
[Tue Feb 10 15:03:21.451956 2026] [:error] [pid 47937:tid 47947] [client 3.66.224.93:48246] [client 3.66.224.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.66.224.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYrYOcpqXpC2CvJ3fONbWgAAAMg"]
[Tue Feb 10 15:43:27.908601 2026] [:error] [pid 59407:tid 59419] [client 206.81.19.8:63233] [client 206.81.19.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.81.19.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYrhn2LlhBXE3qmX-JnixQAAAUo"]
[Tue Feb 10 15:48:16.600758 2026] [:error] [pid 47837:tid 47915] [client 206.81.19.8:55445] [client 206.81.19.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.81.19.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYriwHFY8KYFPX79Z4mkiwAAAI8"]
[Tue Feb 10 15:52:14.172702 2026] [:error] [pid 7704:tid 7721] [client 206.81.19.8:50580] [client 206.81.19.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.81.19.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYrjrv0EcqgVBUs6CW3eiQAAAc4"]
[Tue Feb 10 15:57:10.616830 2026] [:error] [pid 47830:tid 47851] [client 206.81.19.8:61775] [client 206.81.19.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.81.19.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYrk1kco45BZs8e301AtCwAAAAU"]
[Tue Feb 10 16:01:55.059520 2026] [:error] [pid 59544:tid 59551] [client 51.159.214.31:43032] [client 51.159.214.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.214.31, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYrl86ZySR9mFY4Baim4XgAAAYM"]
[Tue Feb 10 16:02:36.753945 2026] [:error] [pid 59407:tid 59414] [client 206.81.19.8:56687] [client 206.81.19.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.81.19.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYrmHGLlhBXE3qmX-JnmRgAAAUU"]
[Tue Feb 10 16:29:25.447083 2026] [:error] [pid 47937:tid 47941] [client 196.171.90.26:57147] [client 196.171.90.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.171.90.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYrsZcpqXpC2CvJ3fONzhgAAAMI"]
[Tue Feb 10 16:30:43.747209 2026] [:error] [pid 59407:tid 59424] [client 196.171.90.26:12737] [client 196.171.90.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.171.90.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYrss2LlhBXE3qmX-Jnr8AAAAU8"]
[Tue Feb 10 16:31:44.358032 2026] [:error] [pid 30054:tid 30064] [client 196.171.90.26:11065] [client 196.171.90.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.171.90.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYrs8GecgOOXCu-GgYUG3wAAAQg"]
[Tue Feb 10 16:32:32.309618 2026] [:error] [pid 59544:tid 59566] [client 196.171.90.26:7255] [client 196.171.90.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.171.90.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYrtIKZySR9mFY4Baim--AAAAZA"]
[Tue Feb 10 16:33:40.466805 2026] [:error] [pid 30054:tid 30073] [client 196.171.90.26:46580] [client 196.171.90.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.171.90.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYrtZGecgOOXCu-GgYUHQQAAARE"]
[Tue Feb 10 16:58:20.181850 2026] [:error] [pid 47831:tid 47889] [client 192.250.239.237:58438] [client 192.250.239.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.239.237, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYrzLCdxbZYarWVkiAAvFgAAAFA"]
[Tue Feb 10 17:55:41.908813 2026] [:error] [pid 47937:tid 47947] [client 31.220.97.172:43632] [client 31.220.97.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.220.97.172, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYsAncpqXpC2CvJ3fOOMEwAAAMg"]
[Tue Feb 10 18:58:02.433966 2026] [:error] [pid 59544:tid 59571] [client 138.197.145.244:58006] [client 138.197.145.244] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.197.145.244, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYsPOqZySR9mFY4Bainh4gAAAZQ"]
[Tue Feb 10 19:06:38.140758 2026] [:error] [pid 7704:tid 7730] [client 136.109.186.85:51302] [client 136.109.186.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.109.186.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYsRPv0EcqgVBUs6CW0JSAAAAdc"]
[Tue Feb 10 19:06:40.332116 2026] [:error] [pid 7704:tid 7728] [client 136.109.186.85:51302] [client 136.109.186.85] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYsRQP0EcqgVBUs6CW0JTQAAAdU"]
[Tue Feb 10 19:06:40.507792 2026] [:error] [pid 7704:tid 7708] [client 136.109.186.85:51302] [client 136.109.186.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.109.186.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYsRQP0EcqgVBUs6CW0JTgAAAcE"]
[Tue Feb 10 19:06:41.866848 2026] [:error] [pid 59544:tid 59553] [client 136.109.186.85:58593] [client 136.109.186.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.109.186.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYsRQaZySR9mFY4Bainj6AAAAYU"]
[Tue Feb 10 19:06:43.150740 2026] [:error] [pid 47830:tid 47854] [client 136.109.186.85:57959] [client 136.109.186.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.109.186.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYsRQ0co45BZs8e301BmLwAAAAg"]
[Tue Feb 10 19:06:44.472480 2026] [:error] [pid 59544:tid 59561] [client 136.109.186.85:49473] [client 136.109.186.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.109.186.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYsRRKZySR9mFY4Bainj6wAAAY0"]
[Tue Feb 10 19:06:45.733538 2026] [:error] [pid 59407:tid 59429] [client 136.109.186.85:58768] [client 136.109.186.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.109.186.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYsRRWLlhBXE3qmX-JkQqAAAAVQ"]
[Tue Feb 10 19:06:45.733734 2026] [:error] [pid 59407:tid 59429] [client 136.109.186.85:58768] [client 136.109.186.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 136.109.186.85, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYsRRWLlhBXE3qmX-JkQqAAAAVQ"]
[Tue Feb 10 19:26:27.900483 2026] [:error] [pid 47831:tid 47889] [client 45.117.169.203:36988] [client 45.117.169.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.117.169.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYsV4ydxbZYarWVkiABn9wAAAFA"]
[Tue Feb 10 19:55:54.086737 2026] [:error] [pid 59544:tid 59559] [client 77.68.74.119:52140] [client 77.68.74.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.68.74.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYscyqZySR9mFY4Bainw0wAAAYs"]
[Tue Feb 10 21:04:17.348690 2026] [:error] [pid 47837:tid 47917] [client 212.93.137.200:53014] [client 212.93.137.200] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.93.137.200, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYss0XFY8KYFPX79Z4nw5AAAAJE"]
[Tue Feb 10 22:09:31.277460 2026] [:error] [pid 30054:tid 30058] [client 212.227.231.243:33524] [client 212.227.231.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.227.231.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYs8G2ecgOOXCu-GgYVNZQAAAQI"]
[Tue Feb 10 23:07:09.520252 2026] [:error] [pid 47831:tid 47875] [client 210.245.90.251:33040] [client 210.245.90.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 210.245.90.251, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtJnSdxbZYarWVkiAC6DgAAAEI"]
[Tue Feb 10 23:07:15.710765 2026] [:error] [pid 47937:tid 47959] [client 89.43.17.214:45506] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtJo8pqXpC2CvJ3fOPYOQAAANQ"]
[Tue Feb 10 23:07:16.203434 2026] [:error] [pid 47831:tid 47877] [client 47.82.118.63:36598] [client 47.82.118.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.82.118.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtJpCdxbZYarWVkiAC6EwAAAEQ"]
[Tue Feb 10 23:07:28.427459 2026] [:error] [pid 30054:tid 30080] [client 159.89.182.203:55176] [client 159.89.182.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.182.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtJsGecgOOXCu-GgYVZYQAAARg"]
[Tue Feb 10 23:07:32.278760 2026] [:error] [pid 30054:tid 30068] [client 120.79.172.65:59792] [client 120.79.172.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.79.172.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtJtGecgOOXCu-GgYVZaAAAAQw"]
[Tue Feb 10 23:07:37.628971 2026] [:error] [pid 30054:tid 30075] [client 47.79.22.6:42138] [client 47.79.22.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.79.22.6, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtJuWecgOOXCu-GgYVZbQAAARM"]
[Tue Feb 10 23:17:39.644650 2026] [:error] [pid 47830:tid 47853] [client 45.10.160.28:38666] [client 45.10.160.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.10.160.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtME0co45BZs8e301CtAQAAAAc"]
[Tue Feb 10 23:29:34.353506 2026] [:error] [pid 59407:tid 59430] [client 34.170.131.79:53566] [client 34.170.131.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.170.131.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtO3mLlhBXE3qmX-JlHAgAAAVU"]
[Tue Feb 10 23:29:36.580985 2026] [:error] [pid 59407:tid 59425] [client 34.170.131.79:53566] [client 34.170.131.79] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYtO4GLlhBXE3qmX-JlHBQAAAVA"]
[Tue Feb 10 23:29:36.780015 2026] [:error] [pid 59407:tid 59423] [client 34.170.131.79:53566] [client 34.170.131.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.170.131.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtO4GLlhBXE3qmX-JlHBgAAAU4"]
[Tue Feb 10 23:29:38.221524 2026] [:error] [pid 47830:tid 47870] [client 34.170.131.79:54485] [client 34.170.131.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.170.131.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtO4kco45BZs8e301Cv8AAAABg"]
[Tue Feb 10 23:29:39.606271 2026] [:error] [pid 47937:tid 47946] [client 34.170.131.79:53968] [client 34.170.131.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.170.131.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtO48pqXpC2CvJ3fOPdpgAAAMc"]
[Tue Feb 10 23:29:41.043926 2026] [:error] [pid 47831:tid 47887] [client 34.170.131.79:60403] [client 34.170.131.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.170.131.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtO5SdxbZYarWVkiADCKQAAAE4"]
[Tue Feb 10 23:29:42.567609 2026] [:error] [pid 47831:tid 47880] [client 34.170.131.79:64393] [client 34.170.131.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.170.131.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtO5idxbZYarWVkiADCMAAAAEc"]
[Tue Feb 10 23:29:42.567764 2026] [:error] [pid 47831:tid 47880] [client 34.170.131.79:64393] [client 34.170.131.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.170.131.79, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtO5idxbZYarWVkiADCMAAAAEc"]
[Tue Feb 10 23:53:38.899356 2026] [:error] [pid 30054:tid 30064] [client 136.111.79.0:51834] [client 136.111.79.0] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.79.0, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtUgmecgOOXCu-GgYVjFgAAAQg"]
[Tue Feb 10 23:53:41.079734 2026] [:error] [pid 30054:tid 30065] [client 136.111.79.0:51834] [client 136.111.79.0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYtUhWecgOOXCu-GgYVjGwAAAQk"]
[Tue Feb 10 23:53:41.292994 2026] [:error] [pid 30054:tid 30072] [client 136.111.79.0:51834] [client 136.111.79.0] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.79.0, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtUhWecgOOXCu-GgYVjHAAAARA"]
[Tue Feb 10 23:53:42.647931 2026] [:error] [pid 59407:tid 59413] [client 136.111.79.0:51484] [client 136.111.79.0] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.79.0, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtUhmLlhBXE3qmX-JlMnAAAAUQ"]
[Tue Feb 10 23:53:44.104204 2026] [:error] [pid 47937:tid 47956] [client 136.111.79.0:50614] [client 136.111.79.0] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.79.0, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtUiMpqXpC2CvJ3fOPj1wAAANE"]
[Tue Feb 10 23:53:45.483837 2026] [:error] [pid 7704:tid 7721] [client 136.111.79.0:59276] [client 136.111.79.0] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.79.0, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtUif0EcqgVBUs6CW1E4AAAAc4"]
[Tue Feb 10 23:53:46.881195 2026] [:error] [pid 59544:tid 59562] [client 136.111.79.0:56975] [client 136.111.79.0] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.79.0, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtUiqZySR9mFY4Baikh8AAAAY4"]
[Tue Feb 10 23:53:46.881360 2026] [:error] [pid 59544:tid 59562] [client 136.111.79.0:56975] [client 136.111.79.0] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 136.111.79.0, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtUiqZySR9mFY4Baikh8AAAAY4"]
[Wed Feb 11 00:27:38.242829 2026] [:error] [pid 15011:tid 15036] [client 45.133.117.105:37264] [client 45.133.117.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.133.117.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtcel-gTNLV94AtLrjk5gAAAdc"]
[Wed Feb 11 00:56:59.639083 2026] [:error] [pid 46779:tid 46834] [client 35.201.212.96:44348] [client 35.201.212.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.201.212.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYtjW9ZrCpVdS6yMMkdCSQAAAIc"]
[Wed Feb 11 01:25:24.685855 2026] [:error] [pid 15011:tid 15037] [client 43.130.72.40:60516] [client 43.130.72.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYtqBF-gTNLV94AtLrj2ygAAAdg"]
[Wed Feb 11 01:34:55.953291 2026] [:error] [pid 46779:tid 46845] [client 45.233.148.167:52982] [client 45.233.148.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.233.148.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYtsP9ZrCpVdS6yMMkdPbAAAAJE"]
[Wed Feb 11 01:57:53.332622 2026] [:error] [pid 46525:tid 46583] [client 158.158.55.114:10951] [client 158.158.55.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "aYtxoQlEqQj0Mpse0PlHrwAAAAo"]
[Wed Feb 11 01:57:54.330955 2026] [autoindex:error] [pid 15011:tid 15018] [client 158.158.55.114:3677] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 11 01:58:03.726814 2026] [autoindex:error] [pid 15011:tid 15025] [client 158.158.55.114:3677] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 11 01:58:16.867672 2026] [:error] [pid 15011:tid 15016] [client 158.158.55.114:3677] [client 158.158.55.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aYtxuF-gTNLV94AtLrj98AAAAcM"]
[Wed Feb 11 01:58:17.895013 2026] [:error] [pid 14803:tid 14926] [client 158.158.55.114:48585] [client 158.158.55.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aYtxubwzY9_NIasL_OXWsgAAAQk"]
[Wed Feb 11 01:58:18.889249 2026] [:error] [pid 15011:tid 15031] [client 158.158.55.114:48633] [client 158.158.55.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aYtxul-gTNLV94AtLrj9-wAAAdI"]
[Wed Feb 11 01:58:19.886671 2026] [:error] [pid 14803:tid 14937] [client 158.158.55.114:3405] [client 158.158.55.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aYtxu7wzY9_NIasL_OXWswAAARQ"]
[Wed Feb 11 02:46:53.229581 2026] [:error] [pid 15011:tid 15036] [client 77.68.115.185:44236] [client 77.68.115.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.68.115.185, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYt9HV-gTNLV94AtLrgJsgAAAdc"]
[Wed Feb 11 03:55:06.253119 2026] [:error] [pid 27964:tid 27984] [client 204.48.18.182:34868] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYuNGsp0XgWYHLcQtEiqgQAAAAk"]
[Wed Feb 11 03:59:02.105226 2026] [:error] [pid 27966:tid 28047] [client 49.51.72.236:33428] [client 49.51.72.236] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYuOBl8HJ9ydyf0SPu6J0QAAAJE"]
[Wed Feb 11 04:48:25.871605 2026] [:error] [pid 28073:tid 28075] [client 139.59.110.28:46450] [client 139.59.110.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.59.110.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYuZmYeHYIlOlF-DsMxyowAAAMA"]
[Wed Feb 11 04:48:42.172567 2026] [:error] [pid 27965:tid 28026] [client 66.42.61.4:43236] [client 66.42.61.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.42.61.4, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYuZqtHLAUAIo8qpZyE1QAAAAFc"]
[Wed Feb 11 04:48:45.651193 2026] [:error] [pid 27965:tid 28016] [client 139.59.110.28:51286] [client 139.59.110.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.59.110.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYuZrdHLAUAIo8qpZyE1TQAAAE0"]
[Wed Feb 11 04:48:51.526832 2026] [:error] [pid 28073:tid 28089] [client 34.171.105.96:41856] [client 34.171.105.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.171.105.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYuZs4eHYIlOlF-DsMxy0wAAAM4"]
[Wed Feb 11 04:48:56.901627 2026] [:error] [pid 27966:tid 28041] [client 203.162.234.20:59788] [client 203.162.234.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.162.234.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYuZuF8HJ9ydyf0SPu6gvQAAAIs"]
[Wed Feb 11 04:49:07.598309 2026] [:error] [pid 28073:tid 28087] [client 139.59.110.28:40814] [client 139.59.110.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.59.110.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYuZw4eHYIlOlF-DsMxy_QAAAMw"]
[Wed Feb 11 05:05:50.250309 2026] [:error] [pid 28073:tid 28088] [client 5.75.144.251:53636] [client 5.75.144.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.75.144.251, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYudroeHYIlOlF-DsMx8VAAAAM0"]
[Wed Feb 11 09:52:49.848082 2026] [:error] [pid 27966:tid 28039] [client 68.178.245.174:20734] [client 68.178.245.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.245.174, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYvg8V8HJ9ydyf0SPu4GUAAAAIk"]
[Wed Feb 11 09:52:53.930792 2026] [:error] [pid 27966:tid 28054] [client 68.178.245.174:20734] [client 68.178.245.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.245.174, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYvg9V8HJ9ydyf0SPu4GWQAAAJg"], referer: https://expressinteriors.com/wp-login.php
[Wed Feb 11 10:06:00.433567 2026] [:error] [pid 27965:tid 28012] [client 162.0.233.91:41288] [client 162.0.233.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.233.91, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYvkCNHLAUAIo8qpZyGskwAAAEk"]
[Wed Feb 11 10:06:01.479074 2026] [:error] [pid 27965:tid 28020] [client 162.0.233.91:41288] [client 162.0.233.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.233.91, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYvkCdHLAUAIo8qpZyGslAAAAFE"], referer: https://expressinteriors.com/wp-login.php
[Wed Feb 11 10:07:22.405594 2026] [:error] [pid 27965:tid 28009] [client 94.198.46.60:39702] [client 94.198.46.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.198.46.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYvkWtHLAUAIo8qpZyGs1QAAAEY"]
[Wed Feb 11 10:07:27.445149 2026] [:error] [pid 27965:tid 28004] [client 94.198.46.60:39702] [client 94.198.46.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.198.46.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYvkX9HLAUAIo8qpZyGs1wAAAEE"], referer: https://expressinteriors.com/wp-login.php
[Wed Feb 11 10:08:46.787188 2026] [:error] [pid 27965:tid 28011] [client 50.116.24.118:37232] [client 50.116.24.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.116.24.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYvkrtHLAUAIo8qpZyGtMQAAAEg"]
[Wed Feb 11 10:08:46.804348 2026] [:error] [pid 27964:tid 27994] [client 193.202.110.29:36884] [client 193.202.110.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.202.110.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYvkrsp0XgWYHLcQtEgQegAAABM"]
[Wed Feb 11 10:08:47.287269 2026] [:error] [pid 22569:tid 22583] [client 103.172.239.79:60448] [client 103.172.239.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.172.239.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYvkr8AhSI7iX9G3eniXqQAAAYo"]
[Wed Feb 11 10:09:14.321857 2026] [:error] [pid 22569:tid 22578] [client 199.188.199.61:47038] [client 199.188.199.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 199.188.199.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYvkysAhSI7iX9G3eniXuwAAAYU"]
[Wed Feb 11 10:09:29.853116 2026] [:error] [pid 28073:tid 28095] [client 89.43.17.214:49822] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYvk2YeHYIlOlF-DsMzQxAAAANQ"]
[Wed Feb 11 10:13:41.975891 2026] [:error] [pid 17401:tid 17419] [client 220.158.233.50:41416] [client 220.158.233.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 220.158.233.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYvl1Q0lHeayTY40t37axwAAARA"]
[Wed Feb 11 10:13:46.619753 2026] [:error] [pid 17401:tid 17413] [client 220.158.233.50:41416] [client 220.158.233.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 220.158.233.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYvl2g0lHeayTY40t37a1QAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Wed Feb 11 10:28:25.505883 2026] [:error] [pid 27965:tid 28027] [client 43.135.144.81:39672] [client 43.135.144.81] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aYvpSdHLAUAIo8qpZyGz0QAAAFg"]
[Wed Feb 11 10:38:05.908806 2026] [:error] [pid 22570:tid 22613] [client 64.225.25.250:55984] [client 64.225.25.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.225.25.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYvrjSE5uSe043FXwQrcMAAAAc0"]
[Wed Feb 11 10:38:08.887413 2026] [:error] [pid 22570:tid 22619] [client 64.225.25.250:55984] [client 64.225.25.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.225.25.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYvrkCE5uSe043FXwQrcNAAAAdM"], referer: https://expressinteriors.com/wp-login.php
[Wed Feb 11 10:39:01.374663 2026] [:error] [pid 22570:tid 22601] [client 220.158.233.50:31662] [client 220.158.233.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 220.158.233.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYvrxSE5uSe043FXwQrcZgAAAcE"]
[Wed Feb 11 10:39:05.559847 2026] [:error] [pid 22570:tid 22608] [client 220.158.233.50:31662] [client 220.158.233.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 220.158.233.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYvrySE5uSe043FXwQrcagAAAcg"], referer: https://expressinteriors.com/wp-login.php
[Wed Feb 11 10:57:06.176477 2026] [:error] [pid 28073:tid 28092] [client 142.93.114.194:56466] [client 142.93.114.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.93.114.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYvwAoeHYIlOlF-DsMzjmgAAANE"]
[Wed Feb 11 11:35:32.931728 2026] [ssl:error] [pid 27964:tid 27986] [client 35.80.12.170:49764] AH02032: Hostname cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup
[Wed Feb 11 12:42:02.449156 2026] [ssl:error] [pid 22570:tid 22608] [client 44.250.145.26:52704] AH02032: Hostname www.cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup
[Wed Feb 11 14:07:04.522048 2026] [:error] [pid 27965:tid 28006] [client 43.157.179.227:43692] [client 43.157.179.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYwciNHLAUAIo8qpZyHy4AAAAEM"]
[Wed Feb 11 16:26:03.218422 2026] [:error] [pid 27965:tid 28008] [client 15.235.224.64:40750] [client 15.235.224.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.224.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYw9G9HLAUAIo8qpZyEdbgAAAEU"]
[Wed Feb 11 17:55:14.520927 2026] [:error] [pid 17401:tid 17426] [client 158.158.40.168:18123] [client 158.158.40.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 158.158.40.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYxSAg0lHeayTY40t35HxwAAARc"]
[Wed Feb 11 18:20:43.584938 2026] [:error] [pid 27966:tid 28040] [client 66.70.178.228:38210] [client 66.70.178.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.70.178.228, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYxX-18HJ9ydyf0SPu6XQgAAAIo"]
[Wed Feb 11 19:02:30.161010 2026] [:error] [pid 22570:tid 22618] [client 185.74.81.105:38686] [client 185.74.81.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.74.81.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYxhxiE5uSe043FXwQpgngAAAdI"]
[Wed Feb 11 19:41:48.098767 2026] [:error] [pid 22570:tid 22609] [client 211.21.61.225:53662] [client 211.21.61.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.225, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYxq_CE5uSe043FXwQprgAAAAck"]
[Wed Feb 11 20:12:26.189718 2026] [:error] [pid 22570:tid 22604] [client 103.196.146.240:60376] [client 103.196.146.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.196.146.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYxyKiE5uSe043FXwQp0HgAAAcQ"]
[Wed Feb 11 20:12:28.807367 2026] [:error] [pid 27965:tid 28022] [client 117.4.254.166:34366] [client 117.4.254.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.4.254.166, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYxyLNHLAUAIo8qpZyFh0gAAAFM"]
[Wed Feb 11 20:12:50.900455 2026] [:error] [pid 27964:tid 27986] [client 45.117.169.203:58320] [client 45.117.169.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.117.169.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYxyQsp0XgWYHLcQtEjeZAAAAAs"]
[Wed Feb 11 20:12:51.050659 2026] [:error] [pid 22569:tid 22595] [client 129.146.65.146:56312] [client 129.146.65.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.146.65.146, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYxyQ8AhSI7iX9G3eng0OwAAAZY"]
[Wed Feb 11 20:13:21.514680 2026] [:error] [pid 28073:tid 28091] [client 159.89.182.203:34794] [client 159.89.182.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.182.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYxyYYeHYIlOlF-DsMzawAAAANA"]
[Wed Feb 11 20:13:35.048904 2026] [:error] [pid 22570:tid 22618] [client 198.54.114.54:45500] [client 198.54.114.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYxybyE5uSe043FXwQp0TwAAAdI"]
[Wed Feb 11 20:13:37.896081 2026] [:error] [pid 27964:tid 27994] [client 31.177.95.217:56646] [client 31.177.95.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.177.95.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYxyccp0XgWYHLcQtEjehgAAABM"]
[Wed Feb 11 20:20:57.730079 2026] [:error] [pid 22537:tid 22559] [client 34.23.157.207:58277] [client 34.23.157.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.23.157.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYx0KSfg2TagwM3bvQP91wAAAVQ"]
[Wed Feb 11 20:21:00.233894 2026] [:error] [pid 22537:tid 22554] [client 34.23.157.207:58277] [client 34.23.157.207] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYx0LCfg2TagwM3bvQP93gAAAU8"]
[Wed Feb 11 20:21:00.488866 2026] [:error] [pid 22537:tid 22551] [client 34.23.157.207:58277] [client 34.23.157.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.23.157.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYx0LCfg2TagwM3bvQP93wAAAUw"]
[Wed Feb 11 20:21:02.080057 2026] [:error] [pid 17401:tid 17427] [client 34.23.157.207:64056] [client 34.23.157.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.23.157.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYx0Lg0lHeayTY40t35rMgAAARg"]
[Wed Feb 11 20:21:03.705932 2026] [:error] [pid 27965:tid 28017] [client 34.23.157.207:50391] [client 34.23.157.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.23.157.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYx0L9HLAUAIo8qpZyFkDAAAAE4"]
[Wed Feb 11 20:21:05.281840 2026] [:error] [pid 22537:tid 22552] [client 34.23.157.207:52902] [client 34.23.157.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.23.157.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYx0MSfg2TagwM3bvQP95AAAAU0"]
[Wed Feb 11 20:21:06.885698 2026] [:error] [pid 27965:tid 28008] [client 34.23.157.207:56047] [client 34.23.157.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.23.157.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYx0MtHLAUAIo8qpZyFkEwAAAEU"]
[Wed Feb 11 20:21:06.885882 2026] [:error] [pid 27965:tid 28008] [client 34.23.157.207:56047] [client 34.23.157.207] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.23.157.207, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYx0MtHLAUAIo8qpZyFkEwAAAEU"]
[Wed Feb 11 20:23:23.201609 2026] [:error] [pid 22569:tid 22582] [client 3.147.168.15:50766] [client 3.147.168.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.147.168.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYx0u8AhSI7iX9G3eng2mgAAAYk"]
[Wed Feb 11 20:37:45.694115 2026] [:error] [pid 27964:tid 27997] [client 20.208.32.128:6526] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aYx4Gcp0XgWYHLcQtEjlkwAAABY"]
[Wed Feb 11 20:37:46.194431 2026] [:error] [pid 27966:tid 28046] [client 20.208.32.128:6640] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aYx4Gl8HJ9ydyf0SPu6-4wAAAJA"]
[Wed Feb 11 20:37:46.682304 2026] [:error] [pid 22569:tid 22581] [client 20.208.32.128:58257] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aYx4GsAhSI7iX9G3eng6RgAAAYg"]
[Wed Feb 11 20:37:47.196647 2026] [:error] [pid 22570:tid 22623] [client 20.208.32.128:6647] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aYx4GyE5uSe043FXwQp6SgAAAdc"]
[Wed Feb 11 20:37:47.781619 2026] [:error] [pid 28073:tid 28094] [client 20.208.32.128:56471] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aYx4G4eHYIlOlF-DsMzk5QAAANM"]
[Wed Feb 11 20:37:48.322570 2026] [:error] [pid 28073:tid 28075] [client 20.208.32.128:57035] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aYx4HIeHYIlOlF-DsMzk6AAAAMA"]
[Wed Feb 11 20:37:48.811698 2026] [:error] [pid 27964:tid 27987] [client 20.208.32.128:58273] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aYx4HMp0XgWYHLcQtEjlmQAAAAw"]
[Wed Feb 11 20:37:49.288856 2026] [:error] [pid 28073:tid 28076] [client 20.208.32.128:6475] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aYx4HYeHYIlOlF-DsMzk6wAAAME"]
[Wed Feb 11 20:37:49.764020 2026] [:error] [pid 27964:tid 27984] [client 20.208.32.128:56473] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/un.php"] [unique_id "aYx4Hcp0XgWYHLcQtEjlngAAAAk"]
[Wed Feb 11 20:37:50.253864 2026] [:error] [pid 27965:tid 28005] [client 20.208.32.128:6470] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/un.php"] [unique_id "aYx4HtHLAUAIo8qpZyFoygAAAEI"]
[Wed Feb 11 20:37:50.742853 2026] [:error] [pid 27964:tid 27993] [client 20.208.32.128:56457] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/un.php"] [unique_id "aYx4Hsp0XgWYHLcQtEjlowAAABI"]
[Wed Feb 11 20:37:51.225931 2026] [:error] [pid 27966:tid 28034] [client 20.208.32.128:6510] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/un.php"] [unique_id "aYx4H18HJ9ydyf0SPu6-6AAAAIQ"]
[Wed Feb 11 20:37:51.750358 2026] [:error] [pid 28073:tid 28099] [client 20.208.32.128:6466] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aYx4H4eHYIlOlF-DsMzk8wAAANg"]
[Wed Feb 11 20:37:52.225330 2026] [:error] [pid 27964:tid 27979] [client 20.208.32.128:6602] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aYx4IMp0XgWYHLcQtEjlpgAAAAQ"]
[Wed Feb 11 20:37:52.724349 2026] [:error] [pid 28073:tid 28081] [client 20.208.32.128:6609] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aYx4IIeHYIlOlF-DsMzk9QAAAMY"]
[Wed Feb 11 20:37:53.195615 2026] [:error] [pid 28073:tid 28095] [client 20.208.32.128:57034] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aYx4IYeHYIlOlF-DsMzk9gAAANQ"]
[Wed Feb 11 20:37:53.713406 2026] [:error] [pid 22570:tid 22608] [client 20.208.32.128:57046] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lts.php"] [unique_id "aYx4ISE5uSe043FXwQp6TgAAAcg"]
[Wed Feb 11 20:37:54.190704 2026] [:error] [pid 27965:tid 28010] [client 20.208.32.128:51563] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lts.php"] [unique_id "aYx4ItHLAUAIo8qpZyFozQAAAEc"]
[Wed Feb 11 20:37:54.689816 2026] [:error] [pid 27965:tid 28003] [client 20.208.32.128:57074] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lts.php"] [unique_id "aYx4ItHLAUAIo8qpZyFozgAAAEA"]
[Wed Feb 11 20:37:55.163667 2026] [:error] [pid 27965:tid 28024] [client 20.208.32.128:6606] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lts.php"] [unique_id "aYx4I9HLAUAIo8qpZyFo0AAAAFU"]
[Wed Feb 11 20:37:55.666896 2026] [:error] [pid 22570:tid 22604] [client 20.208.32.128:55759] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms.php"] [unique_id "aYx4IyE5uSe043FXwQp6UQAAAcQ"]
[Wed Feb 11 20:37:56.142858 2026] [:error] [pid 27965:tid 28008] [client 20.208.32.128:51541] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms.php"] [unique_id "aYx4JNHLAUAIo8qpZyFo1AAAAEU"]
[Wed Feb 11 20:37:56.667059 2026] [:error] [pid 27964:tid 27998] [client 20.208.32.128:51574] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms.php"] [unique_id "aYx4JMp0XgWYHLcQtEjlqwAAABc"]
[Wed Feb 11 20:37:57.139434 2026] [:error] [pid 28073:tid 28088] [client 20.208.32.128:57056] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms.php"] [unique_id "aYx4JYeHYIlOlF-DsMzk_AAAAM0"]
[Wed Feb 11 20:37:57.630899 2026] [:error] [pid 27964:tid 27993] [client 20.208.32.128:6493] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login8.php"] [unique_id "aYx4Jcp0XgWYHLcQtEjlrQAAABI"]
[Wed Feb 11 20:37:58.107137 2026] [:error] [pid 28073:tid 28077] [client 20.208.32.128:51566] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login8.php"] [unique_id "aYx4JoeHYIlOlF-DsMzk_QAAAMI"]
[Wed Feb 11 20:37:58.594536 2026] [:error] [pid 22537:tid 22549] [client 20.208.32.128:6469] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login8.php"] [unique_id "aYx4Jifg2TagwM3bvQMBrgAAAUo"]
[Wed Feb 11 20:37:59.079815 2026] [:error] [pid 27966:tid 28032] [client 20.208.32.128:57083] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login8.php"] [unique_id "aYx4J18HJ9ydyf0SPu6-6gAAAII"]
[Wed Feb 11 20:37:59.560809 2026] [:error] [pid 27964:tid 27992] [client 20.208.32.128:56496] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nnyvn.php"] [unique_id "aYx4J8p0XgWYHLcQtEjlrwAAABE"]
[Wed Feb 11 20:38:00.059785 2026] [:error] [pid 27965:tid 28026] [client 20.208.32.128:51535] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nnyvn.php"] [unique_id "aYx4KNHLAUAIo8qpZyFo2gAAAFc"]
[Wed Feb 11 20:38:00.550443 2026] [:error] [pid 27964:tid 27996] [client 20.208.32.128:56486] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nnyvn.php"] [unique_id "aYx4KMp0XgWYHLcQtEjlsAAAABU"]
[Wed Feb 11 20:38:01.086315 2026] [:error] [pid 22570:tid 22606] [client 20.208.32.128:57050] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nnyvn.php"] [unique_id "aYx4KSE5uSe043FXwQp6VAAAAcY"]
[Wed Feb 11 20:38:01.567339 2026] [:error] [pid 27964:tid 27988] [client 20.208.32.128:51570] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "aYx4Kcp0XgWYHLcQtEjlsQAAAA0"]
[Wed Feb 11 20:38:02.059993 2026] [:error] [pid 28073:tid 28082] [client 20.208.32.128:6504] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "aYx4KoeHYIlOlF-DsMzlAwAAAMc"]
[Wed Feb 11 20:38:02.573523 2026] [:error] [pid 28073:tid 28094] [client 20.208.32.128:6599] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "aYx4KoeHYIlOlF-DsMzlBAAAANM"]
[Wed Feb 11 20:38:03.046216 2026] [:error] [pid 22569:tid 22588] [client 20.208.32.128:45641] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "aYx4K8AhSI7iX9G3eng6TwAAAY8"]
[Wed Feb 11 20:38:03.548893 2026] [:error] [pid 22537:tid 22541] [client 20.208.32.128:56475] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lul.php"] [unique_id "aYx4Kyfg2TagwM3bvQMBsgAAAUI"]
[Wed Feb 11 20:38:04.028049 2026] [:error] [pid 27966:tid 28039] [client 20.208.32.128:6480] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lul.php"] [unique_id "aYx4LF8HJ9ydyf0SPu6-7AAAAIk"]
[Wed Feb 11 20:38:04.521228 2026] [:error] [pid 22569:tid 22593] [client 20.208.32.128:51543] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lul.php"] [unique_id "aYx4LMAhSI7iX9G3eng6UgAAAZQ"]
[Wed Feb 11 20:38:05.019584 2026] [:error] [pid 22537:tid 22546] [client 20.208.32.128:55779] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lul.php"] [unique_id "aYx4LSfg2TagwM3bvQMBtQAAAUc"]
[Wed Feb 11 20:38:05.545327 2026] [:error] [pid 27965:tid 28025] [client 20.208.32.128:56484] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aYx4LdHLAUAIo8qpZyFo3wAAAFY"]
[Wed Feb 11 20:38:06.034274 2026] [:error] [pid 27965:tid 28024] [client 20.208.32.128:6465] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aYx4LtHLAUAIo8qpZyFo4AAAAFU"]
[Wed Feb 11 20:38:06.543284 2026] [:error] [pid 27965:tid 28007] [client 20.208.32.128:51557] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aYx4LtHLAUAIo8qpZyFo4QAAAEQ"]
[Wed Feb 11 20:38:07.020855 2026] [:error] [pid 28073:tid 28090] [client 20.208.32.128:6650] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aYx4L4eHYIlOlF-DsMzlCgAAAM8"]
[Wed Feb 11 20:38:07.550780 2026] [:error] [pid 27965:tid 28012] [client 20.208.32.128:51524] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ee8.php"] [unique_id "aYx4L9HLAUAIo8qpZyFo4wAAAEk"]
[Wed Feb 11 20:38:08.042331 2026] [:error] [pid 22537:tid 22547] [client 20.208.32.128:6476] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ee8.php"] [unique_id "aYx4MCfg2TagwM3bvQMBuAAAAUg"]
[Wed Feb 11 20:38:08.523567 2026] [:error] [pid 27964:tid 27976] [client 20.208.32.128:6505] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ee8.php"] [unique_id "aYx4MMp0XgWYHLcQtEjltAAAAAE"]
[Wed Feb 11 20:38:09.015599 2026] [:error] [pid 22570:tid 22624] [client 20.208.32.128:56508] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ee8.php"] [unique_id "aYx4MSE5uSe043FXwQp6WQAAAdg"]
[Wed Feb 11 20:38:09.492782 2026] [:error] [pid 27964:tid 27995] [client 20.208.32.128:51533] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aYx4Mcp0XgWYHLcQtEjluQAAABQ"]
[Wed Feb 11 20:38:09.975007 2026] [:error] [pid 17401:tid 17421] [client 20.208.32.128:57049] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aYx4MQ0lHeayTY40t35vEAAAARI"]
[Wed Feb 11 20:38:10.463383 2026] [:error] [pid 17401:tid 17404] [client 20.208.32.128:6499] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aYx4Mg0lHeayTY40t35vEgAAAQE"]
[Wed Feb 11 20:38:10.936095 2026] [:error] [pid 22537:tid 22560] [client 20.208.32.128:58244] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aYx4Mifg2TagwM3bvQMBvAAAAVU"]
[Wed Feb 11 20:38:11.408870 2026] [:error] [pid 27966:tid 28043] [client 20.208.32.128:51539] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ya.php"] [unique_id "aYx4M18HJ9ydyf0SPu6-9AAAAI0"]
[Wed Feb 11 20:38:11.898911 2026] [:error] [pid 27964:tid 27975] [client 20.208.32.128:51559] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ya.php"] [unique_id "aYx4M8p0XgWYHLcQtEjlugAAAAA"]
[Wed Feb 11 20:38:12.373358 2026] [:error] [pid 27966:tid 28050] [client 20.208.32.128:57038] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ya.php"] [unique_id "aYx4NF8HJ9ydyf0SPu6-9wAAAJQ"]
[Wed Feb 11 20:38:12.879523 2026] [:error] [pid 22569:tid 22595] [client 20.208.32.128:55788] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ya.php"] [unique_id "aYx4NMAhSI7iX9G3eng6WAAAAZY"]
[Wed Feb 11 20:38:13.352730 2026] [:error] [pid 22537:tid 22548] [client 20.208.32.128:6602] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "aYx4NSfg2TagwM3bvQMBwQAAAUk"]
[Wed Feb 11 20:38:13.846475 2026] [:error] [pid 22537:tid 22539] [client 20.208.32.128:55814] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "aYx4NSfg2TagwM3bvQMBwwAAAUA"]
[Wed Feb 11 20:38:14.339606 2026] [:error] [pid 27964:tid 27985] [client 20.208.32.128:56505] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "aYx4Nsp0XgWYHLcQtEjlwwAAAAo"]
[Wed Feb 11 20:38:14.828141 2026] [:error] [pid 22570:tid 22621] [client 20.208.32.128:57041] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "aYx4NiE5uSe043FXwQp6YAAAAdU"]
[Wed Feb 11 20:38:15.353286 2026] [:error] [pid 27964:tid 27990] [client 20.208.32.128:6503] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aYx4N8p0XgWYHLcQtEjl0gAAAA8"]
[Wed Feb 11 20:38:15.847877 2026] [:error] [pid 22537:tid 22551] [client 20.208.32.128:53897] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aYx4Nyfg2TagwM3bvQMBxQAAAUw"]
[Wed Feb 11 20:38:16.332118 2026] [:error] [pid 27964:tid 27995] [client 20.208.32.128:51542] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aYx4OMp0XgWYHLcQtEjl4wAAABQ"]
[Wed Feb 11 20:38:16.860771 2026] [:error] [pid 27964:tid 27983] [client 20.208.32.128:53914] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aYx4OMp0XgWYHLcQtEjl5gAAAAg"]
[Wed Feb 11 20:38:17.352623 2026] [:error] [pid 27965:tid 28005] [client 20.208.32.128:57055] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftem.php"] [unique_id "aYx4OdHLAUAIo8qpZyFo6AAAAEI"]
[Wed Feb 11 20:38:17.880730 2026] [:error] [pid 27966:tid 28052] [client 20.208.32.128:53893] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftem.php"] [unique_id "aYx4OV8HJ9ydyf0SPu6-_AAAAJY"]
[Wed Feb 11 20:38:18.428605 2026] [:error] [pid 27964:tid 27993] [client 20.208.32.128:53889] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftem.php"] [unique_id "aYx4Osp0XgWYHLcQtEjl6gAAABI"]
[Wed Feb 11 20:38:18.915532 2026] [:error] [pid 28073:tid 28084] [client 20.208.32.128:56453] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftem.php"] [unique_id "aYx4OoeHYIlOlF-DsMzlDQAAAMk"]
[Wed Feb 11 20:38:19.469128 2026] [:error] [pid 27966:tid 28033] [client 20.208.32.128:56474] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Ova-Simple.php"] [unique_id "aYx4O18HJ9ydyf0SPu6-_gAAAIM"]
[Wed Feb 11 20:38:20.119024 2026] [:error] [pid 27966:tid 28040] [client 20.208.32.128:6515] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Ova-Simple.php"] [unique_id "aYx4PF8HJ9ydyf0SPu6-_wAAAIo"]
[Wed Feb 11 20:38:20.950253 2026] [:error] [pid 28073:tid 28096] [client 20.208.32.128:51538] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Ova-Simple.php"] [unique_id "aYx4PIeHYIlOlF-DsMzlEgAAANU"]
[Wed Feb 11 20:38:21.642571 2026] [:error] [pid 27966:tid 28050] [client 20.208.32.128:57027] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Ova-Simple.php"] [unique_id "aYx4PV8HJ9ydyf0SPu6_BAAAAJQ"]
[Wed Feb 11 20:38:22.244131 2026] [:error] [pid 28073:tid 28080] [client 20.208.32.128:6594] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "aYx4PoeHYIlOlF-DsMzlFAAAAMU"]
[Wed Feb 11 20:38:23.232502 2026] [:error] [pid 28073:tid 28087] [client 20.208.32.128:56499] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "aYx4P4eHYIlOlF-DsMzlFgAAAMw"]
[Wed Feb 11 20:38:23.981817 2026] [:error] [pid 28073:tid 28091] [client 20.208.32.128:57053] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "aYx4P4eHYIlOlF-DsMzlGAAAANA"]
[Wed Feb 11 20:38:25.268056 2026] [:error] [pid 22570:tid 22604] [client 20.208.32.128:6646] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "aYx4QSE5uSe043FXwQp6aQAAAcQ"]
[Wed Feb 11 20:38:26.441346 2026] [:error] [pid 27964:tid 27990] [client 20.208.32.128:51527] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1vx.php"] [unique_id "aYx4Qsp0XgWYHLcQtEjl8AAAAA8"]
[Wed Feb 11 20:38:27.556810 2026] [:error] [pid 27965:tid 28019] [client 20.208.32.128:53939] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1vx.php"] [unique_id "aYx4Q9HLAUAIo8qpZyFo6wAAAFA"]
[Wed Feb 11 20:38:28.266217 2026] [:error] [pid 28073:tid 28077] [client 20.208.32.128:57063] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1vx.php"] [unique_id "aYx4RIeHYIlOlF-DsMzlJAAAAMI"]
[Wed Feb 11 20:38:28.896604 2026] [:error] [pid 28073:tid 28089] [client 20.208.32.128:6763] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1vx.php"] [unique_id "aYx4RIeHYIlOlF-DsMzlJwAAAM4"]
[Wed Feb 11 20:38:29.677774 2026] [:error] [pid 28073:tid 28090] [client 20.208.32.128:6641] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aYx4RYeHYIlOlF-DsMzlKgAAAM8"]
[Wed Feb 11 20:38:30.374452 2026] [:error] [pid 27965:tid 28024] [client 20.208.32.128:57030] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aYx4RtHLAUAIo8qpZyFo7gAAAFU"]
[Wed Feb 11 20:38:31.299789 2026] [:error] [pid 28073:tid 28077] [client 20.208.32.128:53898] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aYx4R4eHYIlOlF-DsMzlLgAAAMI"]
[Wed Feb 11 20:38:32.346766 2026] [:error] [pid 17401:tid 17421] [client 20.208.32.128:6773] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aYx4SA0lHeayTY40t35vGwAAARI"]
[Wed Feb 11 20:38:33.578923 2026] [:error] [pid 17401:tid 17425] [client 20.208.32.128:51577] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aYx4SQ0lHeayTY40t35vHAAAARY"]
[Wed Feb 11 20:38:34.637980 2026] [:error] [pid 17401:tid 17418] [client 20.208.32.128:64531] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aYx4Sg0lHeayTY40t35vHwAAAQ8"]
[Wed Feb 11 20:38:35.708134 2026] [:error] [pid 27966:tid 28054] [client 20.208.32.128:64570] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aYx4S18HJ9ydyf0SPu6_DgAAAJg"]
[Wed Feb 11 20:38:36.650159 2026] [:error] [pid 22537:tid 22561] [client 20.208.32.128:64519] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aYx4TCfg2TagwM3bvQMByAAAAVY"]
[Wed Feb 11 20:38:37.673112 2026] [:error] [pid 27966:tid 28032] [client 20.208.32.128:56451] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/06.php"] [unique_id "aYx4TV8HJ9ydyf0SPu6_DwAAAII"]
[Wed Feb 11 20:38:38.619871 2026] [:error] [pid 22537:tid 22562] [client 20.208.32.128:57048] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/06.php"] [unique_id "aYx4Tifg2TagwM3bvQMBywAAAVc"]
[Wed Feb 11 20:38:39.460391 2026] [:error] [pid 22537:tid 22546] [client 20.208.32.128:53896] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/06.php"] [unique_id "aYx4Tyfg2TagwM3bvQMBzAAAAUc"]
[Wed Feb 11 20:38:40.120826 2026] [:error] [pid 27966:tid 28047] [client 20.208.32.128:6502] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/06.php"] [unique_id "aYx4UF8HJ9ydyf0SPu6_EwAAAJE"]
[Wed Feb 11 20:38:40.771156 2026] [:error] [pid 27965:tid 28012] [client 20.208.32.128:64523] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "aYx4UNHLAUAIo8qpZyFo_AAAAEk"]
[Wed Feb 11 20:38:41.479706 2026] [:error] [pid 22537:tid 22554] [client 20.208.32.128:53907] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "aYx4USfg2TagwM3bvQMBzQAAAU8"]
[Wed Feb 11 20:38:43.308851 2026] [:error] [pid 28073:tid 28078] [client 20.208.32.128:55769] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "aYx4U4eHYIlOlF-DsMzlNAAAAMM"]
[Wed Feb 11 20:38:55.815681 2026] [:error] [pid 27965:tid 28017] [client 20.208.32.128:6723] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vxrl.php"] [unique_id "aYx4X9HLAUAIo8qpZyFpLAAAAE4"]
[Wed Feb 11 20:38:56.756468 2026] [:error] [pid 27966:tid 28053] [client 20.208.32.128:53416] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vxrl.php"] [unique_id "aYx4YF8HJ9ydyf0SPu6_IAAAAJc"]
[Wed Feb 11 20:38:57.537722 2026] [:error] [pid 27966:tid 28051] [client 20.208.32.128:53428] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vxrl.php"] [unique_id "aYx4YV8HJ9ydyf0SPu6_IQAAAJU"]
[Wed Feb 11 20:38:58.415038 2026] [:error] [pid 27965:tid 28008] [client 20.208.32.128:64548] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vxrl.php"] [unique_id "aYx4YtHLAUAIo8qpZyFpLgAAAEU"]
[Wed Feb 11 20:38:59.263411 2026] [:error] [pid 22537:tid 22545] [client 20.208.32.128:50825] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/re.php"] [unique_id "aYx4Yyfg2TagwM3bvQMB3QAAAUY"]
[Wed Feb 11 20:38:59.965492 2026] [:error] [pid 27965:tid 28019] [client 20.208.32.128:50874] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/re.php"] [unique_id "aYx4Y9HLAUAIo8qpZyFpMgAAAFA"]
[Wed Feb 11 20:39:00.526122 2026] [:error] [pid 27964:tid 27999] [client 20.208.32.128:53426] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/re.php"] [unique_id "aYx4ZMp0XgWYHLcQtEjmAAAAABg"]
[Wed Feb 11 20:39:01.208412 2026] [:error] [pid 22537:tid 22544] [client 20.208.32.128:64550] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/re.php"] [unique_id "aYx4ZSfg2TagwM3bvQMB3wAAAUU"]
[Wed Feb 11 20:39:01.781529 2026] [:error] [pid 22570:tid 22618] [client 20.208.32.128:49201] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "aYx4ZSE5uSe043FXwQp6dwAAAdI"]
[Wed Feb 11 20:39:02.282808 2026] [:error] [pid 17401:tid 17405] [client 20.208.32.128:46171] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "aYx4Zg0lHeayTY40t35vLQAAAQI"]
[Wed Feb 11 20:39:02.916852 2026] [:error] [pid 17401:tid 17424] [client 20.208.32.128:50834] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "aYx4Zg0lHeayTY40t35vMAAAARU"]
[Wed Feb 11 20:39:03.489863 2026] [:error] [pid 27965:tid 28012] [client 20.208.32.128:49202] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "aYx4Z9HLAUAIo8qpZyFpNQAAAEk"]
[Wed Feb 11 20:39:04.073921 2026] [:error] [pid 27966:tid 28039] [client 20.208.32.128:50879] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "aYx4aF8HJ9ydyf0SPu6_JgAAAIk"]
[Wed Feb 11 20:39:04.586804 2026] [:error] [pid 22570:tid 22604] [client 20.208.32.128:49168] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "aYx4aCE5uSe043FXwQp6egAAAcQ"]
[Wed Feb 11 20:39:05.106456 2026] [:error] [pid 27965:tid 28017] [client 20.208.32.128:56444] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "aYx4adHLAUAIo8qpZyFpNgAAAE4"]
[Wed Feb 11 20:39:05.640784 2026] [:error] [pid 22537:tid 22560] [client 20.208.32.128:64518] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "aYx4aSfg2TagwM3bvQMB4wAAAVU"]
[Wed Feb 11 20:39:06.132906 2026] [:error] [pid 22570:tid 22607] [client 20.208.32.128:56392] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vxrl.php"] [unique_id "aYx4aiE5uSe043FXwQp6fAAAAcc"]
[Wed Feb 11 20:39:06.698027 2026] [:error] [pid 22570:tid 22619] [client 20.208.32.128:53417] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vxrl.php"] [unique_id "aYx4aiE5uSe043FXwQp6fQAAAdM"]
[Wed Feb 11 20:39:07.229422 2026] [:error] [pid 22570:tid 22606] [client 20.208.32.128:64554] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vxrl.php"] [unique_id "aYx4ayE5uSe043FXwQp6gAAAAcY"]
[Wed Feb 11 20:39:07.738378 2026] [:error] [pid 22570:tid 22601] [client 20.208.32.128:6599] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vxrl.php"] [unique_id "aYx4ayE5uSe043FXwQp6gQAAAcE"]
[Wed Feb 11 20:39:08.332818 2026] [:error] [pid 27964:tid 27982] [client 20.208.32.128:53386] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "aYx4bMp0XgWYHLcQtEjmFAAAAAc"]
[Wed Feb 11 20:39:08.865403 2026] [:error] [pid 28073:tid 28083] [client 20.208.32.128:49187] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "aYx4bIeHYIlOlF-DsMzlPwAAAMg"]
[Wed Feb 11 20:39:09.405250 2026] [:error] [pid 27964:tid 27983] [client 20.208.32.128:49197] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "aYx4bcp0XgWYHLcQtEjmGgAAAAg"]
[Wed Feb 11 20:39:09.964848 2026] [:error] [pid 28073:tid 28075] [client 20.208.32.128:50873] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "aYx4bYeHYIlOlF-DsMzlQQAAAMA"]
[Wed Feb 11 20:39:10.499929 2026] [:error] [pid 22569:tid 22578] [client 20.208.32.128:46186] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aYx4bsAhSI7iX9G3eng6cQAAAYU"]
[Wed Feb 11 20:39:11.040333 2026] [:error] [pid 28073:tid 28076] [client 20.208.32.128:56393] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aYx4b4eHYIlOlF-DsMzlRQAAAME"]
[Wed Feb 11 20:39:11.572476 2026] [:error] [pid 28073:tid 28087] [client 20.208.32.128:56408] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aYx4b4eHYIlOlF-DsMzlRgAAAMw"]
[Wed Feb 11 20:39:12.054114 2026] [:error] [pid 27964:tid 27997] [client 20.208.32.128:46154] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aYx4cMp0XgWYHLcQtEjmHAAAABY"]
[Wed Feb 11 20:39:12.586980 2026] [:error] [pid 27966:tid 28033] [client 20.208.32.128:56390] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aYx4cF8HJ9ydyf0SPu6_KgAAAIM"]
[Wed Feb 11 20:39:13.090144 2026] [:error] [pid 28073:tid 28096] [client 20.208.32.128:6757] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aYx4cYeHYIlOlF-DsMzlRwAAANU"]
[Wed Feb 11 20:39:13.577422 2026] [:error] [pid 28073:tid 28092] [client 20.208.32.128:49212] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aYx4cYeHYIlOlF-DsMzlSQAAANE"]
[Wed Feb 11 20:39:14.114317 2026] [:error] [pid 27964:tid 27996] [client 20.208.32.128:6603] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aYx4csp0XgWYHLcQtEjmIAAAABU"]
[Wed Feb 11 20:39:14.590628 2026] [:error] [pid 17401:tid 17416] [client 20.208.32.128:46166] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aYx4cg0lHeayTY40t35vPwAAAQ0"]
[Wed Feb 11 20:39:15.095290 2026] [:error] [pid 27964:tid 27980] [client 20.208.32.128:50876] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aYx4c8p0XgWYHLcQtEjmIgAAAAU"]
[Wed Feb 11 20:39:15.578997 2026] [:error] [pid 27964:tid 27999] [client 20.208.32.128:56445] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aYx4c8p0XgWYHLcQtEjmJQAAABg"]
[Wed Feb 11 20:39:16.054052 2026] [:error] [pid 28073:tid 28085] [client 20.208.32.128:50856] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aYx4dIeHYIlOlF-DsMzlSwAAAMo"]
[Wed Feb 11 20:39:16.535355 2026] [:error] [pid 27964:tid 27976] [client 20.208.32.128:56388] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aYx4dMp0XgWYHLcQtEjmJgAAAAE"]
[Wed Feb 11 20:39:17.061994 2026] [:error] [pid 22570:tid 22614] [client 20.208.32.128:49185] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aYx4dSE5uSe043FXwQp6iAAAAc4"]
[Wed Feb 11 20:39:17.585594 2026] [:error] [pid 22569:tid 22581] [client 20.208.32.128:46181] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aYx4dcAhSI7iX9G3eng6dgAAAYg"]
[Wed Feb 11 20:39:18.066922 2026] [:error] [pid 28073:tid 28083] [client 20.208.32.128:53405] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aYx4doeHYIlOlF-DsMzlTgAAAMg"]
[Wed Feb 11 20:39:18.551932 2026] [:error] [pid 27964:tid 27975] [client 20.208.32.128:50855] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/trd.php"] [unique_id "aYx4dsp0XgWYHLcQtEjmKAAAAAA"]
[Wed Feb 11 20:39:19.043012 2026] [:error] [pid 17401:tid 17404] [client 20.208.32.128:56404] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/trd.php"] [unique_id "aYx4dw0lHeayTY40t35vRgAAAQE"]
[Wed Feb 11 20:39:19.580137 2026] [:error] [pid 27964:tid 27984] [client 20.208.32.128:53395] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/trd.php"] [unique_id "aYx4d8p0XgWYHLcQtEjmKwAAAAk"]
[Wed Feb 11 20:39:20.053685 2026] [:error] [pid 27965:tid 28021] [client 20.208.32.128:64534] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/trd.php"] [unique_id "aYx4eNHLAUAIo8qpZyFpPgAAAFI"]
[Wed Feb 11 20:39:20.530340 2026] [:error] [pid 22569:tid 22579] [client 20.208.32.128:64566] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/past.php"] [unique_id "aYx4eMAhSI7iX9G3eng6eAAAAYY"]
[Wed Feb 11 20:39:21.008629 2026] [:error] [pid 28073:tid 28079] [client 20.208.32.128:64571] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/past.php"] [unique_id "aYx4eYeHYIlOlF-DsMzlTwAAAMQ"]
[Wed Feb 11 20:39:21.503263 2026] [:error] [pid 17401:tid 17419] [client 20.208.32.128:46191] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/past.php"] [unique_id "aYx4eQ0lHeayTY40t35vSgAAARA"]
[Wed Feb 11 20:39:21.977513 2026] [:error] [pid 27964:tid 27989] [client 20.208.32.128:56439] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/past.php"] [unique_id "aYx4ecp0XgWYHLcQtEjmMQAAAA4"]
[Wed Feb 11 20:39:22.454607 2026] [:error] [pid 28073:tid 28089] [client 20.208.32.128:50823] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/prv8.php"] [unique_id "aYx4eoeHYIlOlF-DsMzlUQAAAM4"]
[Wed Feb 11 20:39:22.938227 2026] [:error] [pid 28073:tid 28087] [client 20.208.32.128:53409] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/prv8.php"] [unique_id "aYx4eoeHYIlOlF-DsMzlUgAAAMw"]
[Wed Feb 11 20:39:23.438122 2026] [:error] [pid 22569:tid 22592] [client 20.208.32.128:46195] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/prv8.php"] [unique_id "aYx4e8AhSI7iX9G3eng6eQAAAZM"]
[Wed Feb 11 20:39:23.922755 2026] [:error] [pid 27964:tid 27975] [client 20.208.32.128:49157] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/prv8.php"] [unique_id "aYx4e8p0XgWYHLcQtEjmNAAAAAA"]
[Wed Feb 11 20:39:24.448139 2026] [:error] [pid 17401:tid 17410] [client 20.208.32.128:49208] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i.php"] [unique_id "aYx4fA0lHeayTY40t35vUQAAAQc"]
[Wed Feb 11 20:39:24.921577 2026] [:error] [pid 22570:tid 22619] [client 20.208.32.128:53403] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i.php"] [unique_id "aYx4fCE5uSe043FXwQp6kQAAAdM"]
[Wed Feb 11 20:39:25.401234 2026] [:error] [pid 22537:tid 22545] [client 20.208.32.128:46162] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i.php"] [unique_id "aYx4fSfg2TagwM3bvQMCAQAAAUY"]
[Wed Feb 11 20:39:25.874961 2026] [:error] [pid 22537:tid 22553] [client 20.208.32.128:46173] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i.php"] [unique_id "aYx4fSfg2TagwM3bvQMCAgAAAU4"]
[Wed Feb 11 20:39:26.348272 2026] [:error] [pid 22537:tid 22560] [client 20.208.32.128:56429] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/admin.php"] [unique_id "aYx4fifg2TagwM3bvQMCBAAAAVU"]
[Wed Feb 11 20:39:26.825918 2026] [:error] [pid 22570:tid 22608] [client 20.208.32.128:56426] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/admin.php"] [unique_id "aYx4fiE5uSe043FXwQp6lwAAAcg"]
[Wed Feb 11 20:39:27.299399 2026] [:error] [pid 27965:tid 28023] [client 20.208.32.128:53411] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/admin.php"] [unique_id "aYx4f9HLAUAIo8qpZyFpQQAAAFQ"]
[Wed Feb 11 20:39:27.785271 2026] [:error] [pid 22537:tid 22546] [client 20.208.32.128:53392] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/admin.php"] [unique_id "aYx4fyfg2TagwM3bvQMCCAAAAUc"]
[Wed Feb 11 20:39:28.261625 2026] [:error] [pid 27964:tid 27991] [client 20.208.32.128:49175] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYx4gMp0XgWYHLcQtEjmNQAAABA"]
[Wed Feb 11 20:39:28.737587 2026] [:error] [pid 22570:tid 22611] [client 20.208.32.128:53387] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYx4gCE5uSe043FXwQp6mQAAAcs"]
[Wed Feb 11 20:39:29.216128 2026] [:error] [pid 22537:tid 22541] [client 20.208.32.128:49192] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYx4gSfg2TagwM3bvQMCCQAAAUI"]
[Wed Feb 11 20:39:29.688446 2026] [:error] [pid 28073:tid 28091] [client 20.208.32.128:56419] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYx4gYeHYIlOlF-DsMzlVwAAANA"]
[Wed Feb 11 20:39:30.161473 2026] [:error] [pid 27964:tid 27989] [client 20.208.32.128:49194] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aw.php"] [unique_id "aYx4gsp0XgWYHLcQtEjmPAAAAA4"]
[Wed Feb 11 20:39:30.638377 2026] [:error] [pid 22569:tid 22591] [client 20.208.32.128:56415] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aw.php"] [unique_id "aYx4gsAhSI7iX9G3eng6egAAAZI"]
[Wed Feb 11 20:39:31.116454 2026] [:error] [pid 27965:tid 28014] [client 20.208.32.128:51534] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aw.php"] [unique_id "aYx4g9HLAUAIo8qpZyFpRgAAAEs"]
[Wed Feb 11 20:39:31.594407 2026] [:error] [pid 27965:tid 28026] [client 20.208.32.128:49213] [client 20.208.32.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aw.php"] [unique_id "aYx4g9HLAUAIo8qpZyFpRwAAAFc"]
[Wed Feb 11 20:43:32.062605 2026] [:error] [pid 17401:tid 17421] [client 178.20.55.16:37334] [client 178.20.55.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.20.55.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYx5dA0lHeayTY40t35wKwAAARI"], referer: https://expressinteriors.com/xmlrpc.php?rsd
[Wed Feb 11 21:01:53.462652 2026] [:error] [pid 27965:tid 28008] [client 159.223.142.249:33906] [client 159.223.142.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.142.249, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYx9wdHLAUAIo8qpZyFuIwAAAEU"]
[Wed Feb 11 21:27:43.707799 2026] [:error] [pid 27965:tid 28006] [client 34.127.9.236:57365] [client 34.127.9.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.127.9.236, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYyDz9HLAUAIo8qpZyF0fQAAAEM"]
[Wed Feb 11 21:27:46.551269 2026] [:error] [pid 27965:tid 28023] [client 34.127.9.236:57365] [client 34.127.9.236] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYyD0tHLAUAIo8qpZyF0hQAAAFQ"]
[Wed Feb 11 21:27:46.750326 2026] [:error] [pid 27965:tid 28011] [client 34.127.9.236:57365] [client 34.127.9.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.127.9.236, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYyD0tHLAUAIo8qpZyF0hgAAAEg"]
[Wed Feb 11 21:27:47.998660 2026] [:error] [pid 27964:tid 27991] [client 34.127.9.236:65376] [client 34.127.9.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.127.9.236, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYyD08p0XgWYHLcQtEj1ewAAABA"]
[Wed Feb 11 21:27:49.331539 2026] [:error] [pid 22569:tid 22587] [client 34.127.9.236:58470] [client 34.127.9.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.127.9.236, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYyD1cAhSI7iX9G3enhEfQAAAY4"]
[Wed Feb 11 21:27:50.648172 2026] [:error] [pid 22569:tid 22588] [client 34.127.9.236:59606] [client 34.127.9.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.127.9.236, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYyD1sAhSI7iX9G3enhEgwAAAY8"]
[Wed Feb 11 21:27:51.918970 2026] [:error] [pid 27964:tid 27994] [client 34.127.9.236:59264] [client 34.127.9.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.127.9.236, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYyD18p0XgWYHLcQtEj1iAAAABM"]
[Wed Feb 11 21:27:51.919116 2026] [:error] [pid 27964:tid 27994] [client 34.127.9.236:59264] [client 34.127.9.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.127.9.236, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYyD18p0XgWYHLcQtEj1iAAAABM"]
[Wed Feb 11 21:47:01.653314 2026] [:error] [pid 27964:tid 27975] [client 46.4.235.36:58894] [client 46.4.235.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.4.235.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYyIVcp0XgWYHLcQtEj7ggAAAAA"]
[Wed Feb 11 22:28:55.890528 2026] [:error] [pid 22570:tid 22608] [client 198.58.118.10:55204] [client 198.58.118.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.58.118.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYySJyE5uSe043FXwQqSeAAAAcg"]
[Wed Feb 11 23:07:05.410620 2026] [:error] [pid 27964:tid 27984] [client 179.43.191.19:52732] [client 179.43.191.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 179.43.191.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYybGcp0XgWYHLcQtEgORwAAAAk"], referer: expressinteriors.com
[Wed Feb 11 23:12:50.355233 2026] [:error] [pid 17401:tid 17425] [client 147.182.250.143:53056] [client 147.182.250.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.250.143, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYyccg0lHeayTY40t36LTwAAARY"]
[Wed Feb 11 23:23:06.623414 2026] [:error] [pid 22537:tid 22545] [client 34.139.117.99:52665] [client 34.139.117.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.139.117.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYye2ifg2TagwM3bvQMgvgAAAUY"]
[Wed Feb 11 23:23:09.766239 2026] [:error] [pid 22537:tid 22547] [client 34.139.117.99:52665] [client 34.139.117.99] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYye3Sfg2TagwM3bvQMgxwAAAUg"]
[Wed Feb 11 23:23:10.023634 2026] [:error] [pid 22537:tid 22551] [client 34.139.117.99:52665] [client 34.139.117.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.139.117.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYye3ifg2TagwM3bvQMgyAAAAUw"]
[Wed Feb 11 23:23:11.583479 2026] [:error] [pid 27966:tid 28040] [client 34.139.117.99:58450] [client 34.139.117.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.139.117.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYye318HJ9ydyf0SPu7kKwAAAIo"]
[Wed Feb 11 23:23:13.109118 2026] [:error] [pid 27965:tid 28027] [client 34.139.117.99:58238] [client 34.139.117.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.139.117.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYye4dHLAUAIo8qpZyGOigAAAFg"]
[Wed Feb 11 23:23:14.728041 2026] [:error] [pid 27964:tid 27986] [client 34.139.117.99:54164] [client 34.139.117.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.139.117.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYye4sp0XgWYHLcQtEgTiAAAAAs"]
[Wed Feb 11 23:23:16.299011 2026] [:error] [pid 28073:tid 28084] [client 34.139.117.99:49571] [client 34.139.117.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.139.117.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYye5IeHYIlOlF-DsMwiWQAAAMk"]
[Wed Feb 11 23:23:16.299177 2026] [:error] [pid 28073:tid 28084] [client 34.139.117.99:49571] [client 34.139.117.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.139.117.99, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYye5IeHYIlOlF-DsMwiWQAAAMk"]
[Wed Feb 11 23:24:31.777468 2026] [:error] [pid 28073:tid 28078] [client 151.241.17.161:51942] [client 151.241.17.161] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.expressinteriors.com|F|2"] [data "TX:0=image/tiff"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYyfL4eHYIlOlF-DsMwi8gAAAMM"]
[Wed Feb 11 23:55:01.728001 2026] [:error] [pid 22569:tid 22581] [client 178.124.129.153:38318] [client 178.124.129.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.124.129.153, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYymVcAhSI7iX9G3enhhZgAAAYg"]
[Thu Feb 12 00:17:35.283004 2026] [:error] [pid 1228:tid 1248] [client 35.223.131.73:55017] [client 35.223.131.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.223.131.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYyrn0_hjxiA8NB0VHEJAgAAAQ4"]
[Thu Feb 12 00:17:37.658566 2026] [:error] [pid 1228:tid 1237] [client 35.223.131.73:55017] [client 35.223.131.73] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYyroU_hjxiA8NB0VHEJCwAAAQU"]
[Thu Feb 12 00:17:37.871870 2026] [:error] [pid 1228:tid 1242] [client 35.223.131.73:55017] [client 35.223.131.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.223.131.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYyroU_hjxiA8NB0VHEJDAAAAQo"]
[Thu Feb 12 00:17:39.328498 2026] [:error] [pid 1139:tid 1218] [client 35.223.131.73:50007] [client 35.223.131.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.223.131.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYyro7I02pKuv8PUn6KzaQAAANc"]
[Thu Feb 12 00:17:40.823255 2026] [:error] [pid 1137:tid 1142] [client 35.223.131.73:55458] [client 35.223.131.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.223.131.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYyrpFn3jVbMBipltpt-SwAAAEE"]
[Thu Feb 12 00:17:42.258132 2026] [:error] [pid 1137:tid 1159] [client 35.223.131.73:64914] [client 35.223.131.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.223.131.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYyrpln3jVbMBipltpt-TQAAAFI"]
[Thu Feb 12 00:17:43.703692 2026] [:error] [pid 1228:tid 1252] [client 35.223.131.73:61704] [client 35.223.131.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.223.131.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYyrp0_hjxiA8NB0VHEJHQAAARE"]
[Thu Feb 12 00:17:43.703888 2026] [:error] [pid 1228:tid 1252] [client 35.223.131.73:61704] [client 35.223.131.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.223.131.73, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYyrp0_hjxiA8NB0VHEJHQAAARE"]
[Thu Feb 12 00:21:15.311130 2026] [:error] [pid 49093:tid 49100] [client 156.249.126.168:34024] [client 156.249.126.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.249.126.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYysewYzxX9Zu4qZ-D1qPgAAAEI"]
[Thu Feb 12 00:21:18.571901 2026] [:error] [pid 49095:tid 49169] [client 154.199.68.179:47232] [client 154.199.68.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.199.68.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYysfoDzbTIrmslQGKTLvAAAARA"], referer: http://expressinteriors.com/wp-login.php
[Thu Feb 12 00:21:22.658668 2026] [:error] [pid 49093:tid 49111] [client 154.222.132.142:32862] [client 154.222.132.142] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYysggYzxX9Zu4qZ-D1qUgAAAE0"]
[Thu Feb 12 00:21:24.066134 2026] [:error] [pid 49095:tid 49156] [client 156.249.127.116:53216] [client 156.249.127.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.249.127.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYyshIDzbTIrmslQGKTLxQAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 12 00:21:24.069734 2026] [:error] [pid 49095:tid 49156] [client 156.249.127.116:53216] [client 156.249.127.116] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYyshIDzbTIrmslQGKTLxQAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 12 00:21:30.465949 2026] [:error] [pid 49093:tid 49104] [client 156.239.220.255:18008] [client 156.239.220.255] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.220.255, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYysigYzxX9Zu4qZ-D1qXgAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 12 00:21:30.470719 2026] [:error] [pid 49093:tid 49104] [client 156.239.220.255:18008] [client 156.239.220.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYysigYzxX9Zu4qZ-D1qXgAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 12 00:21:32.304669 2026] [:error] [pid 49095:tid 49171] [client 156.239.216.222:23648] [client 156.239.216.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.216.222, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYysjIDzbTIrmslQGKTLzwAAARI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 12 00:21:32.308772 2026] [:error] [pid 49095:tid 49171] [client 156.239.216.222:23648] [client 156.239.216.222] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYysjIDzbTIrmslQGKTLzwAAARI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 12 00:21:33.992802 2026] [:error] [pid 49095:tid 49175] [client 154.199.69.167:23120] [client 154.199.69.167] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.199.69.167, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYysjYDzbTIrmslQGKTL0QAAARY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 12 00:21:33.996383 2026] [:error] [pid 49095:tid 49175] [client 154.199.69.167:23120] [client 154.199.69.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYysjYDzbTIrmslQGKTL0QAAARY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 12 00:21:35.578931 2026] [:error] [pid 49093:tid 49106] [client 156.242.51.175:26770] [client 156.242.51.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.242.51.175, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYysjwYzxX9Zu4qZ-D1qZAAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 12 00:21:35.583246 2026] [:error] [pid 49093:tid 49106] [client 156.242.51.175:26770] [client 156.242.51.175] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aYysjwYzxX9Zu4qZ-D1qZAAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 12 00:32:45.166909 2026] [:error] [pid 49180:tid 49184] [client 35.192.100.98:53778] [client 35.192.100.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.192.100.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYyvLXD8wAezUtqGiU5OhQAAAUI"]
[Thu Feb 12 00:32:53.516054 2026] [:error] [pid 49093:tid 49109] [client 82.156.14.49:55078] [client 82.156.14.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.156.14.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYyvNQYzxX9Zu4qZ-D1vDQAAAEs"]
[Thu Feb 12 00:44:27.373054 2026] [:error] [pid 59768:tid 59787] [client 134.209.169.174:34224] [client 134.209.169.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.209.169.174, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYyx6y1wUqEWhF_w6UGKRQAAABE"]
[Thu Feb 12 01:28:49.064098 2026] [:error] [pid 49180:tid 49188] [client 150.109.180.208:34260] [client 150.109.180.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.109.180.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYy8UXD8wAezUtqGiU5kcQAAAUY"]
[Thu Feb 12 01:56:29.985114 2026] [:error] [pid 49094:tid 49126] [client 43.133.220.37:46700] [client 43.133.220.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aYzCzeUgUVJo2a1h94XJrAAAAMA"]
[Thu Feb 12 02:14:10.913629 2026] [:error] [pid 49094:tid 49141] [client 80.85.224.86:39202] [client 80.85.224.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.85.224.86, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYzG8uUgUVJo2a1h94XO1wAAAM8"]
[Thu Feb 12 02:55:53.471137 2026] [:error] [pid 49095:tid 49166] [client 51.161.82.187:18566] [client 51.161.82.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.161.82.187, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYzQuYDzbTIrmslQGKT6gAAAAQ0"]
[Thu Feb 12 03:44:24.734558 2026] [:error] [pid 57641:tid 57663] [client 51.159.214.31:43248] [client 51.159.214.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.214.31, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYzcGHEGAHJopH5xQFwXBwAAANM"]
[Thu Feb 12 03:54:15.791206 2026] [:error] [pid 57641:tid 57649] [client 35.238.97.38:50222] [client 35.238.97.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.238.97.38, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYzeZ3EGAHJopH5xQFwcJQAAAMY"]
[Thu Feb 12 03:54:18.152589 2026] [:error] [pid 57641:tid 57651] [client 35.238.97.38:50222] [client 35.238.97.38] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aYzeanEGAHJopH5xQFwcMAAAAMg"]
[Thu Feb 12 03:54:18.365390 2026] [:error] [pid 57641:tid 57666] [client 35.238.97.38:50222] [client 35.238.97.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.238.97.38, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYzeanEGAHJopH5xQFwcMgAAANY"]
[Thu Feb 12 03:54:19.894696 2026] [:error] [pid 57533:tid 57578] [client 35.238.97.38:57040] [client 35.238.97.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.238.97.38, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYzea8BMbk5EwuXt4Ze3eAAAAEM"]
[Thu Feb 12 03:54:21.391460 2026] [:error] [pid 57533:tid 57600] [client 35.238.97.38:51388] [client 35.238.97.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.238.97.38, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYzebcBMbk5EwuXt4Ze3egAAAFg"]
[Thu Feb 12 03:54:22.985411 2026] [:error] [pid 57534:tid 57607] [client 35.238.97.38:57256] [client 35.238.97.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.238.97.38, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYzebt-p0vPYwBdK43TtagAAAIQ"]
[Thu Feb 12 03:54:24.472108 2026] [:error] [pid 57533:tid 57580] [client 35.238.97.38:64029] [client 35.238.97.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.238.97.38, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYzecMBMbk5EwuXt4Ze3gwAAAEU"]
[Thu Feb 12 03:54:24.472319 2026] [:error] [pid 57533:tid 57580] [client 35.238.97.38:64029] [client 35.238.97.38] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.238.97.38, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYzecMBMbk5EwuXt4Ze3gwAAAEU"]
[Thu Feb 12 04:21:16.612641 2026] [:error] [pid 29368:tid 29382] [client 103.196.146.240:54268] [client 103.196.146.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.196.146.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYzkvNNsoKUOH6cSt82TpgAAAQw"]
[Thu Feb 12 04:22:03.477666 2026] [:error] [pid 57533:tid 57579] [client 31.177.95.217:46422] [client 31.177.95.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.177.95.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYzk68BMbk5EwuXt4ZfCFgAAAEQ"]
[Thu Feb 12 04:22:30.317507 2026] [:error] [pid 57533:tid 57583] [client 103.108.220.125:50916] [client 103.108.220.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.108.220.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYzlBsBMbk5EwuXt4ZfCLQAAAEg"]
[Thu Feb 12 04:22:37.269232 2026] [:error] [pid 57534:tid 57615] [client 103.212.121.158:56500] [client 103.212.121.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.212.121.158, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYzlDd-p0vPYwBdK43T4GAAAAIw"]
[Thu Feb 12 04:22:49.618183 2026] [:error] [pid 29368:tid 29376] [client 120.76.99.214:57678] [client 120.76.99.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.76.99.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYzlGdNsoKUOH6cSt82UQAAAAQY"]
[Thu Feb 12 04:23:23.871114 2026] [:error] [pid 29368:tid 29370] [client 104.243.19.148:59296] [client 104.243.19.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.243.19.148, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYzlO9NsoKUOH6cSt82UfwAAAQA"]
[Thu Feb 12 04:28:05.246826 2026] [:error] [pid 57534:tid 57622] [client 204.48.18.182:41642] [client 204.48.18.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.48.18.182, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYzmVd-p0vPYwBdK43T5rAAAAJM"]
[Thu Feb 12 05:17:22.418332 2026] [:error] [pid 57534:tid 57619] [client 68.178.164.217:52594] [client 68.178.164.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.164.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYzx4t-p0vPYwBdK43QMAgAAAJA"]
[Thu Feb 12 06:01:26.304744 2026] [:error] [pid 29368:tid 29387] [client 63.131.146.5:53722] [client 63.131.146.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 63.131.146.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aYz8NtNsoKUOH6cSt83JmgAAARE"]
[Thu Feb 12 06:52:31.681725 2026] [:error] [pid 1851:tid 1873] [client 212.56.41.124:41704] [client 212.56.41.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.56.41.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY0IL_gC37byWfqZjZHcpQAAAVI"]
[Thu Feb 12 07:41:24.402216 2026] [:error] [pid 57534:tid 57623] [client 146.190.84.203:32804] [client 146.190.84.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.84.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY0TpN-p0vPYwBdK43Q7dgAAAJQ"]
[Thu Feb 12 08:27:41.451782 2026] [:error] [pid 1851:tid 1856] [client 84.201.130.79:58890] [client 84.201.130.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.201.130.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY0effgC37byWfqZjZEGqgAAAUE"]
[Thu Feb 12 09:56:42.264084 2026] [:error] [pid 50254:tid 50263] [client 176.99.9.19:44040] [client 176.99.9.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.99.9.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY0zWlXkZ-o2G0C1rDGKxwAAAgQ"]
[Thu Feb 12 10:17:31.426729 2026] [:error] [pid 50167:tid 50180] [client 121.40.46.168:58000] [client 121.40.46.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.40.46.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY04OzOWAjqME-_ayFObiwAAAMk"]
[Thu Feb 12 10:17:31.775858 2026] [:error] [pid 3188:tid 3211] [client 193.202.110.28:36482] [client 193.202.110.28] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.202.110.28, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY04O8YMNJKHx_XKcXzX1wAAAJU"]
[Thu Feb 12 10:17:43.084534 2026] [:error] [pid 60619:tid 60632] [client 160.250.227.36:47376] [client 160.250.227.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.227.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY04R0WmS0KSFtjY-wYxKQAAAAs"]
[Thu Feb 12 10:17:45.003566 2026] [:error] [pid 3136:tid 3153] [client 193.202.110.30:36328] [client 193.202.110.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.202.110.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY04SRiPjM-TIZEnQeE8KAAAAE8"]
[Thu Feb 12 10:18:03.500464 2026] [:error] [pid 50169:tid 50235] [client 47.94.14.136:51146] [client 47.94.14.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.94.14.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY04W7QmA2Sph23KFXBPGAAAAck"]
[Thu Feb 12 10:39:20.478474 2026] [:error] [pid 50168:tid 50214] [client 217.154.56.229:44240] [client 217.154.56.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.56.229, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY09WAih-d2Mb0suxEfshQAAAY8"]
[Thu Feb 12 11:30:35.720870 2026] [:error] [pid 50254:tid 50282] [client 178.33.162.49:58458] [client 178.33.162.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.33.162.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY1JW1XkZ-o2G0C1rDGjEAAAAhc"]
[Thu Feb 12 13:05:39.704813 2026] [:error] [pid 50167:tid 50195] [client 45.56.121.237:60046] [client 45.56.121.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.56.121.237, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY1fozOWAjqME-_ayFPD1AAAANg"]
[Thu Feb 12 13:45:39.159124 2026] [:error] [pid 60619:tid 60636] [client 31.128.47.66:32846] [client 31.128.47.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.128.47.66, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY1pA0WmS0KSFtjY-wZtPAAAAA8"]
[Thu Feb 12 14:38:49.602662 2026] [:error] [pid 50168:tid 50204] [client 193.205.142.236:14115] [client 193.205.142.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.205.142.236, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY11eQih-d2Mb0suxEcmigAAAYU"]
[Thu Feb 12 15:10:10.343907 2026] [:error] [pid 21527:tid 21544] [client 142.93.83.180:40972] [client 142.93.83.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.93.83.180, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY180iaer9JPUXlMLuFoLAAAAA8"]
[Thu Feb 12 15:24:45.620387 2026] [:error] [pid 21433:tid 21483] [client 178.33.40.189:56430] [client 178.33.40.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.33.40.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY2APdc_9AdG3uAKpzu5BwAAAY0"]
[Thu Feb 12 16:13:25.701446 2026] [:error] [pid 39777:tid 39797] [client 185.199.223.93:42280] [client 185.199.223.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY2LpVzexR6hGUkt5pO5fAAAAFI"]
[Thu Feb 12 16:57:08.968685 2026] [:error] [pid 21433:tid 21488] [client 46.225.2.215:38266] [client 46.225.2.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 46.225.2.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY2V5Nc_9AdG3uAKpzvl0gAAAZI"]
[Thu Feb 12 17:05:48.265313 2026] [:error] [pid 21527:tid 21535] [client 35.198.41.118:57238] [client 35.198.41.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.198.41.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY2X7Caer9JPUXlMLuG5FAAAAAY"]
[Thu Feb 12 17:36:16.790228 2026] [:error] [pid 63416:tid 63423] [client 43.166.255.102:36100] [client 43.166.255.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aY2fEL2wmecPaCHcM297qAAAAYI"]
[Thu Feb 12 17:43:24.474204 2026] [:error] [pid 63511:tid 63515] [client 20.215.248.189:36679] [client 20.215.248.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aY2gvKQCQbD5BgeyIk3CnQAAAAI"]
[Thu Feb 12 17:43:28.986310 2026] [autoindex:error] [pid 63418:tid 63479] [client 20.215.248.189:36733] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 12 17:43:36.868780 2026] [:error] [pid 63418:tid 63488] [client 20.215.248.189:36733] [client 20.215.248.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aY2gyNzjh-bbJnStPZKVigAAAIw"]
[Thu Feb 12 17:43:39.931766 2026] [:error] [pid 63417:tid 63466] [client 20.215.248.189:41438] [client 20.215.248.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aY2gy_8gSb97qRMtXCKePQAAAFE"]
[Thu Feb 12 17:43:42.704069 2026] [:error] [pid 63417:tid 63461] [client 20.215.248.189:59472] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aY2gzv8gSb97qRMtXCKeQQAAAEw"]
[Thu Feb 12 17:43:44.118806 2026] [:error] [pid 63418:tid 63491] [client 20.215.248.189:36729] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aY2g0Nzjh-bbJnStPZKVlAAAAI8"]
[Thu Feb 12 17:43:45.229232 2026] [:error] [pid 65064:tid 65082] [client 20.215.248.189:45816] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aY2g0ROvRgscTcqsMBmBhAAAAM8"]
[Thu Feb 12 17:43:46.159931 2026] [:error] [pid 63511:tid 63516] [client 20.215.248.189:53298] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/juuuu.php"] [unique_id "aY2g0qQCQbD5BgeyIk3C1wAAAAM"]
[Thu Feb 12 17:43:47.013850 2026] [:error] [pid 65064:tid 65081] [client 20.215.248.189:53280] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/juuuu.php"] [unique_id "aY2g0xOvRgscTcqsMBmBiQAAAM4"]
[Thu Feb 12 17:43:47.900850 2026] [:error] [pid 63416:tid 63421] [client 20.215.248.189:46998] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/juuuu.php"] [unique_id "aY2g072wmecPaCHcM29-TAAAAYA"]
[Thu Feb 12 17:43:48.810356 2026] [:error] [pid 63511:tid 63517] [client 20.215.248.189:56903] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/juuuu.php"] [unique_id "aY2g1KQCQbD5BgeyIk3C2gAAAAQ"]
[Thu Feb 12 17:43:49.889604 2026] [:error] [pid 63416:tid 63428] [client 20.215.248.189:47002] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aY2g1b2wmecPaCHcM29-UAAAAYc"]
[Thu Feb 12 17:43:50.779059 2026] [:error] [pid 63416:tid 63437] [client 20.215.248.189:40236] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aY2g1r2wmecPaCHcM29-UgAAAZA"]
[Thu Feb 12 17:43:52.411596 2026] [:error] [pid 63416:tid 63424] [client 20.215.248.189:46984] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aY2g2L2wmecPaCHcM29-VwAAAYM"]
[Thu Feb 12 17:43:53.720345 2026] [:error] [pid 65064:tid 65082] [client 20.215.248.189:45782] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aY2g2ROvRgscTcqsMBmBkgAAAM8"]
[Thu Feb 12 17:43:54.894354 2026] [:error] [pid 65064:tid 65089] [client 20.215.248.189:41423] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aY2g2hOvRgscTcqsMBmBlQAAANY"]
[Thu Feb 12 17:43:56.838856 2026] [:error] [pid 63511:tid 63522] [client 20.215.248.189:40214] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "aY2g3KQCQbD5BgeyIk3C7wAAAAk"]
[Thu Feb 12 17:44:13.708459 2026] [:error] [pid 63511:tid 63534] [client 20.215.248.189:38931] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/04.php"] [unique_id "aY2g7aQCQbD5BgeyIk3DBQAAABU"]
[Thu Feb 12 17:44:17.135957 2026] [:error] [pid 65064:tid 65090] [client 20.215.248.189:3081] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/04.php"] [unique_id "aY2g8ROvRgscTcqsMBmBvgAAANc"]
[Thu Feb 12 17:44:18.794259 2026] [:error] [pid 63416:tid 63433] [client 20.215.248.189:3881] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/04.php"] [unique_id "aY2g8r2wmecPaCHcM29-cwAAAYw"]
[Thu Feb 12 17:44:19.929011 2026] [:error] [pid 63511:tid 63521] [client 20.215.248.189:49408] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/04.php"] [unique_id "aY2g86QCQbD5BgeyIk3DDgAAAAg"]
[Thu Feb 12 17:44:22.284101 2026] [:error] [pid 63418:tid 63497] [client 20.215.248.189:38968] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "aY2g9tzjh-bbJnStPZKV0gAAAJU"]
[Thu Feb 12 17:44:23.188085 2026] [:error] [pid 63418:tid 63487] [client 20.215.248.189:3751] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "aY2g99zjh-bbJnStPZKV1AAAAIs"]
[Thu Feb 12 17:44:24.212448 2026] [:error] [pid 63418:tid 63488] [client 20.215.248.189:3854] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "aY2g-Nzjh-bbJnStPZKV2gAAAIw"]
[Thu Feb 12 17:44:25.287364 2026] [:error] [pid 65064:tid 65074] [client 20.215.248.189:41388] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "aY2g-ROvRgscTcqsMBmBxQAAAMc"]
[Thu Feb 12 17:44:26.015598 2026] [:error] [pid 63417:tid 63465] [client 20.215.248.189:49415] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/520.php"] [unique_id "aY2g-v8gSb97qRMtXCKeewAAAFA"]
[Thu Feb 12 17:44:27.371108 2026] [:error] [pid 63511:tid 63527] [client 20.215.248.189:3895] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/520.php"] [unique_id "aY2g-6QCQbD5BgeyIk3DGQAAAA4"]
[Thu Feb 12 17:44:28.533187 2026] [:error] [pid 63418:tid 63489] [client 20.215.248.189:46145] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/520.php"] [unique_id "aY2g_Nzjh-bbJnStPZKV3gAAAI0"]
[Thu Feb 12 17:44:29.993400 2026] [:error] [pid 63416:tid 63440] [client 20.215.248.189:3744] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/520.php"] [unique_id "aY2g_b2wmecPaCHcM29-igAAAZM"]
[Thu Feb 12 17:44:31.347702 2026] [:error] [pid 63418:tid 63479] [client 20.215.248.189:54378] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aY2g_9zjh-bbJnStPZKV4QAAAIM"]
[Thu Feb 12 17:44:32.287747 2026] [:error] [pid 63511:tid 63522] [client 20.215.248.189:3714] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aY2hAKQCQbD5BgeyIk3DLgAAAAk"]
[Thu Feb 12 17:44:33.401955 2026] [:error] [pid 65064:tid 65068] [client 20.215.248.189:52328] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aY2hAROvRgscTcqsMBmB2QAAAME"]
[Thu Feb 12 17:44:34.738966 2026] [:error] [pid 63417:tid 63457] [client 20.215.248.189:50653] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "aY2hAv8gSb97qRMtXCKegwAAAEg"]
[Thu Feb 12 17:44:47.865110 2026] [:error] [pid 63418:tid 63498] [client 20.215.248.189:39245] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aY2hD9zjh-bbJnStPZKWNwAAAJY"]
[Thu Feb 12 17:44:49.012536 2026] [:error] [pid 65064:tid 65086] [client 20.215.248.189:47379] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aY2hEROvRgscTcqsMBmB9AAAANM"]
[Thu Feb 12 17:44:50.438027 2026] [:error] [pid 63418:tid 63486] [client 20.215.248.189:59930] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aY2hEtzjh-bbJnStPZKWOgAAAIo"]
[Thu Feb 12 17:44:51.542223 2026] [:error] [pid 63417:tid 63463] [client 20.215.248.189:52310] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aY2hE_8gSb97qRMtXCKemQAAAE4"]
[Thu Feb 12 17:44:53.316688 2026] [:error] [pid 65064:tid 65068] [client 20.215.248.189:37481] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aY2hFROvRgscTcqsMBmB9wAAAME"]
[Thu Feb 12 17:44:54.206163 2026] [:error] [pid 63511:tid 63523] [client 20.215.248.189:47364] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aY2hFqQCQbD5BgeyIk3DWwAAAAo"]
[Thu Feb 12 17:44:55.766813 2026] [:error] [pid 65064:tid 65079] [client 20.215.248.189:59958] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aY2hFxOvRgscTcqsMBmB-gAAAMw"]
[Thu Feb 12 17:44:57.728911 2026] [:error] [pid 63418:tid 63484] [client 20.215.248.189:47412] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aY2hGdzjh-bbJnStPZKWPgAAAIg"]
[Thu Feb 12 17:44:58.630450 2026] [:error] [pid 63418:tid 63498] [client 20.215.248.189:3647] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aY2hGtzjh-bbJnStPZKWQQAAAJY"]
[Thu Feb 12 17:45:00.644343 2026] [:error] [pid 63417:tid 63452] [client 20.215.248.189:50635] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aY2hHP8gSb97qRMtXCKepAAAAEM"]
[Thu Feb 12 17:45:01.913667 2026] [:error] [pid 63511:tid 63520] [client 20.215.248.189:55936] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aY2hHaQCQbD5BgeyIk3DZQAAAAc"]
[Thu Feb 12 17:45:03.093865 2026] [:error] [pid 63511:tid 63519] [client 20.215.248.189:47380] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aY2hH6QCQbD5BgeyIk3DZwAAAAY"]
[Thu Feb 12 17:45:04.447097 2026] [:error] [pid 63417:tid 63456] [client 20.215.248.189:55952] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aY2hIP8gSb97qRMtXCKepQAAAEc"]
[Thu Feb 12 17:45:05.506963 2026] [:error] [pid 63416:tid 63445] [client 20.215.248.189:54908] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aY2hIb2wmecPaCHcM29-vAAAAZg"]
[Thu Feb 12 17:45:07.265595 2026] [:error] [pid 63417:tid 63464] [client 20.215.248.189:58137] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aY2hI_8gSb97qRMtXCKepwAAAE8"]
[Thu Feb 12 17:45:10.307612 2026] [:error] [pid 63417:tid 63450] [client 20.215.248.189:58123] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aY2hJv8gSb97qRMtXCKeqQAAAEE"]
[Thu Feb 12 17:45:14.286188 2026] [:error] [pid 63511:tid 63525] [client 20.215.248.189:54882] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aY2hKqQCQbD5BgeyIk3DcgAAAAw"]
[Thu Feb 12 17:45:16.896413 2026] [:error] [pid 63416:tid 63424] [client 20.215.248.189:3794] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aY2hLL2wmecPaCHcM29-yQAAAYM"]
[Thu Feb 12 17:45:24.192122 2026] [:error] [pid 63416:tid 63445] [client 20.215.248.189:46693] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aY2hNL2wmecPaCHcM29-0QAAAZg"]
[Thu Feb 12 17:45:24.898606 2026] [:error] [pid 65064:tid 65088] [client 20.215.248.189:42665] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aY2hNBOvRgscTcqsMBmCIAAAANU"]
[Thu Feb 12 17:45:27.310108 2026] [:error] [pid 63417:tid 63459] [client 20.215.248.189:50145] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aY2hN_8gSb97qRMtXCKeugAAAEo"]
[Thu Feb 12 17:45:30.559195 2026] [:error] [pid 63418:tid 63490] [client 20.215.248.189:50151] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aY2hOtzjh-bbJnStPZKWXQAAAI4"]
[Thu Feb 12 17:45:32.684648 2026] [:error] [pid 65064:tid 65071] [client 20.215.248.189:40961] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aY2hPBOvRgscTcqsMBmCNAAAAMQ"]
[Thu Feb 12 17:45:34.528585 2026] [:error] [pid 63417:tid 63449] [client 20.215.248.189:60429] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aY2hPv8gSb97qRMtXCKexAAAAEA"]
[Thu Feb 12 17:45:35.593681 2026] [:error] [pid 63417:tid 63459] [client 20.215.248.189:37506] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aY2hP_8gSb97qRMtXCKexgAAAEo"]
[Thu Feb 12 17:45:36.958649 2026] [:error] [pid 63418:tid 63498] [client 20.215.248.189:35963] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aY2hQNzjh-bbJnStPZKWegAAAJY"]
[Thu Feb 12 17:45:39.074332 2026] [:error] [pid 63416:tid 63433] [client 20.215.248.189:37203] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aY2hQ72wmecPaCHcM29_EwAAAYw"]
[Thu Feb 12 17:45:41.130541 2026] [:error] [pid 63417:tid 63450] [client 20.215.248.189:37195] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aY2hRf8gSb97qRMtXCKezgAAAEE"]
[Thu Feb 12 17:45:42.462368 2026] [:error] [pid 65064:tid 65091] [client 20.215.248.189:35928] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "aY2hRhOvRgscTcqsMBmCZAAAANg"]
[Thu Feb 12 17:45:43.471105 2026] [:error] [pid 63417:tid 63467] [client 20.215.248.189:35904] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "aY2hR_8gSb97qRMtXCKe0QAAAFI"]
[Thu Feb 12 17:45:44.347794 2026] [:error] [pid 65064:tid 65083] [client 20.215.248.189:37248] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "aY2hSBOvRgscTcqsMBmCagAAANA"]
[Thu Feb 12 17:45:45.561483 2026] [:error] [pid 63418:tid 63499] [client 20.215.248.189:37308] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "aY2hSdzjh-bbJnStPZKWtAAAAJc"]
[Thu Feb 12 17:45:59.316098 2026] [:error] [pid 63418:tid 63483] [client 20.215.248.189:35917] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtz.php"] [unique_id "aY2hV9zjh-bbJnStPZKW1gAAAIc"]
[Thu Feb 12 17:46:04.072180 2026] [:error] [pid 63417:tid 63461] [client 20.215.248.189:40546] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtz.php"] [unique_id "aY2hXP8gSb97qRMtXCKe-AAAAEw"]
[Thu Feb 12 17:46:05.325032 2026] [:error] [pid 63416:tid 63425] [client 20.215.248.189:60356] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtz.php"] [unique_id "aY2hXb2wmecPaCHcM29_RwAAAYQ"]
[Thu Feb 12 17:46:06.842607 2026] [:error] [pid 65064:tid 65078] [client 20.215.248.189:57822] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtz.php"] [unique_id "aY2hXhOvRgscTcqsMBmCjwAAAMs"]
[Thu Feb 12 17:46:09.224224 2026] [:error] [pid 63417:tid 63470] [client 20.215.248.189:3934] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/galex.php"] [unique_id "aY2hYf8gSb97qRMtXCKfAgAAAFU"]
[Thu Feb 12 17:46:13.162671 2026] [:error] [pid 63417:tid 63456] [client 20.215.248.189:57800] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/galex.php"] [unique_id "aY2hZf8gSb97qRMtXCKfCQAAAEc"]
[Thu Feb 12 17:46:14.775300 2026] [:error] [pid 63416:tid 63431] [client 20.215.248.189:51747] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/galex.php"] [unique_id "aY2hZr2wmecPaCHcM29_TQAAAYo"]
[Thu Feb 12 17:46:16.431761 2026] [:error] [pid 63511:tid 63535] [client 20.215.248.189:39709] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/galex.php"] [unique_id "aY2haKQCQbD5BgeyIk3DxQAAABY"]
[Thu Feb 12 17:46:18.028861 2026] [:error] [pid 63417:tid 63463] [client 20.215.248.189:51723] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aY2hav8gSb97qRMtXCKfDwAAAE4"]
[Thu Feb 12 17:46:19.638327 2026] [:error] [pid 65064:tid 65080] [client 20.215.248.189:53327] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aY2haxOvRgscTcqsMBmCqgAAAM0"]
[Thu Feb 12 17:46:23.816973 2026] [:error] [pid 65064:tid 65071] [client 20.215.248.189:59054] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aY2hbxOvRgscTcqsMBmCsgAAAMQ"]
[Thu Feb 12 17:46:26.793122 2026] [:error] [pid 63511:tid 63530] [client 20.215.248.189:53364] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aY2hcqQCQbD5BgeyIk3D1gAAABE"]
[Thu Feb 12 17:46:29.567951 2026] [:error] [pid 65064:tid 65089] [client 20.215.248.189:38344] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ova.php"] [unique_id "aY2hdROvRgscTcqsMBmCvQAAANY"]
[Thu Feb 12 17:46:31.823760 2026] [:error] [pid 65064:tid 65070] [client 20.215.248.189:43342] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ova.php"] [unique_id "aY2hdxOvRgscTcqsMBmC0AAAAMM"]
[Thu Feb 12 17:46:35.434833 2026] [:error] [pid 63417:tid 63461] [client 20.215.248.189:38366] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ova.php"] [unique_id "aY2he_8gSb97qRMtXCKfOAAAAEw"]
[Thu Feb 12 17:46:39.123654 2026] [:error] [pid 63418:tid 63496] [client 20.215.248.189:40140] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ova.php"] [unique_id "aY2hf9zjh-bbJnStPZKXBAAAAJQ"]
[Thu Feb 12 17:46:42.665384 2026] [:error] [pid 63511:tid 63514] [client 20.215.248.189:40165] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aY2hgqQCQbD5BgeyIk3D8gAAAAE"]
[Thu Feb 12 17:46:44.111199 2026] [:error] [pid 63416:tid 63430] [client 20.215.248.189:36766] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aY2hhL2wmecPaCHcM29_ewAAAYk"]
[Thu Feb 12 17:46:45.556277 2026] [:error] [pid 63511:tid 63515] [client 20.215.248.189:3141] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aY2hhaQCQbD5BgeyIk3D-QAAAAI"]
[Thu Feb 12 17:46:47.763825 2026] [:error] [pid 63417:tid 63471] [client 20.215.248.189:37761] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aY2hh_8gSb97qRMtXCKfRwAAAFY"]
[Thu Feb 12 17:46:50.675501 2026] [:error] [pid 63417:tid 63469] [client 20.215.248.189:36356] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aY2hiv8gSb97qRMtXCKfTwAAAFQ"]
[Thu Feb 12 17:46:53.035508 2026] [:error] [pid 63418:tid 63494] [client 20.215.248.189:3142] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aY2hjdzjh-bbJnStPZKXEAAAAJI"]
[Thu Feb 12 17:46:56.460016 2026] [:error] [pid 63417:tid 63466] [client 20.215.248.189:36325] [client 20.215.248.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aY2hkP8gSb97qRMtXCKfXwAAAFE"]
[Thu Feb 12 17:52:46.810451 2026] [:error] [pid 63511:tid 63531] [client 51.91.58.113:60338] [client 51.91.58.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.91.58.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY2i7qQCQbD5BgeyIk3GXQAAABI"]
[Thu Feb 12 18:45:34.120002 2026] [:error] [pid 65064:tid 65075] [client 88.198.106.177:56352] [client 88.198.106.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.198.106.177, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY2vThOvRgscTcqsMBmseAAAAMg"]
[Thu Feb 12 19:31:13.200969 2026] [:error] [pid 63417:tid 63466] [client 42.112.21.205:41546] [client 42.112.21.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 42.112.21.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY26Af8gSb97qRMtXCLNuAAAAFE"]
[Thu Feb 12 19:31:20.000965 2026] [:error] [pid 63511:tid 63530] [client 47.236.10.255:57230] [client 47.236.10.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.236.10.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY26CKQCQbD5BgeyIk35nQAAABE"]
[Thu Feb 12 19:31:25.726908 2026] [:error] [pid 63418:tid 63483] [client 34.134.121.168:43368] [client 34.134.121.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.134.121.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY26Ddzjh-bbJnStPZLHewAAAIc"]
[Thu Feb 12 19:31:36.607518 2026] [:error] [pid 63511:tid 63534] [client 122.155.171.214:50702] [client 122.155.171.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.155.171.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY26GKQCQbD5BgeyIk35swAAABU"]
[Thu Feb 12 19:31:42.717650 2026] [:error] [pid 63418:tid 63497] [client 178.62.197.103:57996] [client 178.62.197.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.197.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY26Htzjh-bbJnStPZLHiAAAAJU"]
[Thu Feb 12 19:31:54.385518 2026] [:error] [pid 63511:tid 63522] [client 192.64.117.254:56744] [client 192.64.117.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.64.117.254, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY26KqQCQbD5BgeyIk357wAAAAk"]
[Thu Feb 12 19:32:08.254803 2026] [:error] [pid 63511:tid 63525] [client 34.69.68.107:39518] [client 34.69.68.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.68.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY26OKQCQbD5BgeyIk35_wAAAAw"]
[Thu Feb 12 20:28:07.806891 2026] [:error] [pid 63418:tid 63499] [client 51.161.82.187:9242] [client 51.161.82.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.161.82.187, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY3HV9zjh-bbJnStPZLgLgAAAJc"]
[Thu Feb 12 20:45:46.424358 2026] [:error] [pid 46603:tid 46609] [client 20.100.192.104:28548] [client 20.100.192.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.100.192.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aY3LevEi6O39v05JNJdzNwAAAQQ"]
[Thu Feb 12 20:50:08.101408 2026] [:error] [pid 46603:tid 46605] [client 34.10.141.88:61593] [client 34.10.141.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.10.141.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY3MgPEi6O39v05JNJd0kQAAAQA"]
[Thu Feb 12 20:50:10.324405 2026] [:error] [pid 46603:tid 46615] [client 34.10.141.88:61593] [client 34.10.141.88] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aY3MgvEi6O39v05JNJd0lgAAAQo"]
[Thu Feb 12 20:50:10.536755 2026] [:error] [pid 46603:tid 46610] [client 34.10.141.88:61593] [client 34.10.141.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.10.141.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY3MgvEi6O39v05JNJd0lwAAAQU"]
[Thu Feb 12 20:50:12.025866 2026] [:error] [pid 46603:tid 46614] [client 34.10.141.88:60495] [client 34.10.141.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.10.141.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY3MhPEi6O39v05JNJd0nQAAAQk"]
[Thu Feb 12 20:50:13.534359 2026] [:error] [pid 63416:tid 63439] [client 34.10.141.88:50898] [client 34.10.141.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.10.141.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY3Mhb2wmecPaCHcM2_J-AAAAZI"]
[Thu Feb 12 20:50:14.952442 2026] [:error] [pid 46603:tid 46625] [client 34.10.141.88:64999] [client 34.10.141.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.10.141.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY3MhvEi6O39v05JNJd0ogAAARQ"]
[Thu Feb 12 20:50:16.321832 2026] [:error] [pid 63511:tid 63527] [client 34.10.141.88:60437] [client 34.10.141.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.10.141.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY3MiKQCQbD5BgeyIk0grgAAAA4"]
[Thu Feb 12 20:50:16.322023 2026] [:error] [pid 63511:tid 63527] [client 34.10.141.88:60437] [client 34.10.141.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.10.141.88, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY3MiKQCQbD5BgeyIk0grgAAAA4"]
[Thu Feb 12 20:58:05.877581 2026] [:error] [pid 46675:tid 46687] [client 20.251.203.56:8196] [client 20.251.203.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "aY3OXTuaQILPonWFiQloJwAAAUk"]
[Thu Feb 12 20:58:13.765328 2026] [autoindex:error] [pid 63417:tid 63468] [client 20.251.203.56:11530] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 12 20:58:22.041278 2026] [:error] [pid 63417:tid 63452] [client 20.251.203.56:11530] [client 20.251.203.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aY3Obv8gSb97qRMtXCLvTAAAAEM"]
[Thu Feb 12 20:58:23.741026 2026] [:error] [pid 63416:tid 63424] [client 20.251.203.56:11884] [client 20.251.203.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aY3Ob72wmecPaCHcM2_L5QAAAYM"]
[Thu Feb 12 20:58:25.103525 2026] [:error] [pid 63511:tid 63521] [client 20.251.203.56:35227] [client 20.251.203.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aY3OcaQCQbD5BgeyIk0igwAAAAg"]
[Thu Feb 12 20:58:26.954648 2026] [:error] [pid 46718:tid 46725] [client 20.251.203.56:8227] [client 20.251.203.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aY3OckdfX45LelQwruQWaAAAAcQ"]
[Thu Feb 12 21:10:50.101706 2026] [:error] [pid 63417:tid 63468] [client 189.18.247.17:57098] [client 189.18.247.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.18.247.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY3RWv8gSb97qRMtXCLzBQAAAFM"]
[Thu Feb 12 21:13:25.516008 2026] [:error] [pid 63416:tid 63428] [client 108.61.81.109:41942] [client 108.61.81.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 108.61.81.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY3R9b2wmecPaCHcM2_PEQAAAYc"]
[Thu Feb 12 21:18:15.030029 2026] [:error] [pid 63418:tid 63493] [client 189.18.247.17:53591] [client 189.18.247.17] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aY3TF9zjh-bbJnStPZLvjQAAAJE"]
[Thu Feb 12 21:20:02.644984 2026] [:error] [pid 65064:tid 65076] [client 189.18.247.17:54741] [client 189.18.247.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.18.247.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY3TghOvRgscTcqsMBkEOwAAAMk"]
[Thu Feb 12 21:21:35.976381 2026] [:error] [pid 46718:tid 46722] [client 189.18.247.17:60466] [client 189.18.247.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.18.247.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY3T30dfX45LelQwruQf9QAAAcE"]
[Thu Feb 12 21:23:06.210737 2026] [:error] [pid 46675:tid 46688] [client 189.18.247.17:53461] [client 189.18.247.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.18.247.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY3UOjuaQILPonWFiQlv0gAAAUo"]
[Thu Feb 12 21:24:34.510220 2026] [:error] [pid 63511:tid 63513] [client 189.18.247.17:54331] [client 189.18.247.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.18.247.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY3UkqQCQbD5BgeyIk0pewAAAAA"]
[Thu Feb 12 22:02:07.540728 2026] [:error] [pid 46718:tid 46732] [client 158.69.220.86:42082] [client 158.69.220.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.69.220.86, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY3dX0dfX45LelQwruQwlQAAAcs"]
[Thu Feb 12 22:35:34.515189 2026] [:error] [pid 46603:tid 46608] [client 107.189.25.71:65265] [client 107.189.25.71] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php~"] [unique_id "aY3lNvEi6O39v05JNJeUoQAAAQM"]
[Thu Feb 12 22:47:12.776866 2026] [:error] [pid 46603:tid 46621] [client 103.77.107.222:57401] [client 103.77.107.222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aY3n8PEi6O39v05JNJeYWwAAARA"]
[Thu Feb 12 22:47:13.052397 2026] [:error] [pid 46603:tid 46620] [client 103.77.107.222:57435] [client 103.77.107.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aY3n8fEi6O39v05JNJeYXgAAAQ8"]
[Thu Feb 12 22:48:49.659738 2026] [:error] [pid 46603:tid 46621] [client 103.27.206.168:34770] [client 103.27.206.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.27.206.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY3oUfEi6O39v05JNJeY7wAAARA"]
[Thu Feb 12 23:21:41.474270 2026] [autoindex:error] [pid 63417:tid 63451] [client 144.91.97.38:50392] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Thu Feb 12 23:25:18.068592 2026] [:error] [pid 65064:tid 65091] [client 68.219.89.70:3411] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-k3w6g9s4h2.php"] [unique_id "aY3w3hOvRgscTcqsMBkmAwAAANg"]
[Thu Feb 12 23:25:18.735671 2026] [:error] [pid 46675:tid 46697] [client 68.219.89.70:18315] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-k3w6g9s4h2.php"] [unique_id "aY3w3juaQILPonWFiQmW0wAAAVM"]
[Thu Feb 12 23:25:20.975338 2026] [:error] [pid 63511:tid 63515] [client 68.219.89.70:26310] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-k3w6g9s4h2.php"] [unique_id "aY3w4KQCQbD5BgeyIk1GLAAAAAI"]
[Thu Feb 12 23:25:22.147361 2026] [:error] [pid 46603:tid 46627] [client 68.219.89.70:3611] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-k3w6g9s4h2.php"] [unique_id "aY3w4vEi6O39v05JNJejZAAAARY"]
[Thu Feb 12 23:25:22.902240 2026] [:error] [pid 46603:tid 46607] [client 68.219.89.70:31682] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/007xx.php"] [unique_id "aY3w4vEi6O39v05JNJejZwAAAQI"]
[Thu Feb 12 23:25:27.267594 2026] [:error] [pid 63417:tid 63459] [client 68.219.89.70:37903] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/007xx.php"] [unique_id "aY3w5_8gSb97qRMtXCITrgAAAEo"]
[Thu Feb 12 23:25:29.415103 2026] [:error] [pid 63417:tid 63458] [client 68.219.89.70:18358] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/007xx.php"] [unique_id "aY3w6f8gSb97qRMtXCITswAAAEk"]
[Thu Feb 12 23:25:31.802172 2026] [:error] [pid 63418:tid 63479] [client 68.219.89.70:3864] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/007xx.php"] [unique_id "aY3w69zjh-bbJnStPZIPOAAAAIM"]
[Thu Feb 12 23:25:33.199906 2026] [:error] [pid 63417:tid 63457] [client 68.219.89.70:21163] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/l3gi0n.php"] [unique_id "aY3w7f8gSb97qRMtXCITvAAAAEg"]
[Thu Feb 12 23:25:36.013256 2026] [:error] [pid 46603:tid 46606] [client 68.219.89.70:3595] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/l3gi0n.php"] [unique_id "aY3w8PEi6O39v05JNJejdwAAAQE"]
[Thu Feb 12 23:25:42.565589 2026] [:error] [pid 63416:tid 63443] [client 68.219.89.70:3566] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/l3gi0n.php"] [unique_id "aY3w9r2wmecPaCHcM2_shgAAAZY"]
[Thu Feb 12 23:25:46.766485 2026] [:error] [pid 46603:tid 46605] [client 68.219.89.70:52800] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/l3gi0n.php"] [unique_id "aY3w-vEi6O39v05JNJejiQAAAQA"]
[Thu Feb 12 23:25:47.607749 2026] [:error] [pid 46718:tid 46735] [client 68.219.89.70:20531] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sldnjqlm.php"] [unique_id "aY3w-0dfX45LelQwruRSYAAAAc4"]
[Thu Feb 12 23:26:01.041041 2026] [:error] [pid 46718:tid 46732] [client 68.219.89.70:52829] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sldnjqlm.php"] [unique_id "aY3xCUdfX45LelQwruRSeQAAAcs"]
[Thu Feb 12 23:26:03.607977 2026] [:error] [pid 46675:tid 46685] [client 68.219.89.70:22872] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s3.php"] [unique_id "aY3xCzuaQILPonWFiQmXJwAAAUc"]
[Thu Feb 12 23:26:05.002522 2026] [:error] [pid 63418:tid 63477] [client 68.219.89.70:19463] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s3.php"] [unique_id "aY3xDdzjh-bbJnStPZIPSAAAAIE"]
[Thu Feb 12 23:26:06.093789 2026] [:error] [pid 65064:tid 65069] [client 68.219.89.70:3213] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s3.php"] [unique_id "aY3xDhOvRgscTcqsMBkmLgAAAMI"]
[Thu Feb 12 23:26:12.369027 2026] [:error] [pid 46603:tid 46625] [client 68.219.89.70:54246] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s3.php"] [unique_id "aY3xFPEi6O39v05JNJejtgAAARQ"]
[Thu Feb 12 23:26:31.038963 2026] [:error] [pid 46718:tid 46745] [client 68.219.89.70:20539] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pass4.php"] [unique_id "aY3xJ0dfX45LelQwruRStAAAAdg"]
[Thu Feb 12 23:26:34.235384 2026] [:error] [pid 46718:tid 46739] [client 68.219.89.70:3254] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pass4.php"] [unique_id "aY3xKkdfX45LelQwruRStwAAAdI"]
[Thu Feb 12 23:26:47.783326 2026] [:error] [pid 63417:tid 63449] [client 68.219.89.70:3249] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nux.php"] [unique_id "aY3xN_8gSb97qRMtXCIUIAAAAEA"]
[Thu Feb 12 23:26:51.266377 2026] [:error] [pid 46675:tid 46697] [client 68.219.89.70:26315] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nux.php"] [unique_id "aY3xOzuaQILPonWFiQmXhQAAAVM"]
[Thu Feb 12 23:26:56.057176 2026] [:error] [pid 46603:tid 46621] [client 68.219.89.70:52834] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nux.php"] [unique_id "aY3xQPEi6O39v05JNJekCQAAARA"]
[Thu Feb 12 23:27:01.721150 2026] [:error] [pid 46603:tid 46616] [client 68.219.89.70:19484] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "aY3xRfEi6O39v05JNJekQAAAAQs"]
[Thu Feb 12 23:27:03.035889 2026] [:error] [pid 63418:tid 63485] [client 68.219.89.70:20491] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "aY3xR9zjh-bbJnStPZIPqQAAAIk"]
[Thu Feb 12 23:27:06.400202 2026] [:error] [pid 63418:tid 63481] [client 68.219.89.70:19492] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/init.php"] [unique_id "aY3xStzjh-bbJnStPZIPrwAAAIU"]
[Thu Feb 12 23:27:08.050409 2026] [:error] [pid 63418:tid 63497] [client 68.219.89.70:3567] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/init.php"] [unique_id "aY3xTNzjh-bbJnStPZIPsgAAAJU"]
[Thu Feb 12 23:27:12.908104 2026] [:error] [pid 63418:tid 63485] [client 68.219.89.70:26578] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/init.php"] [unique_id "aY3xUNzjh-bbJnStPZIPtgAAAIk"]
[Thu Feb 12 23:27:18.163970 2026] [:error] [pid 65064:tid 65072] [client 68.219.89.70:22890] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/init.php"] [unique_id "aY3xVhOvRgscTcqsMBkm4QAAAMU"]
[Thu Feb 12 23:27:20.414777 2026] [:error] [pid 46718:tid 46736] [client 68.219.89.70:39993] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sfcl.php"] [unique_id "aY3xWEdfX45LelQwruRTOAAAAc8"]
[Thu Feb 12 23:27:21.675929 2026] [:error] [pid 63418:tid 63476] [client 68.219.89.70:20134] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sfcl.php"] [unique_id "aY3xWdzjh-bbJnStPZIPwQAAAIA"]
[Thu Feb 12 23:27:23.444522 2026] [:error] [pid 46603:tid 46614] [client 68.219.89.70:16425] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sfcl.php"] [unique_id "aY3xW_Ei6O39v05JNJekhgAAAQk"]
[Thu Feb 12 23:27:24.787209 2026] [:error] [pid 63511:tid 63532] [client 68.219.89.70:16440] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sfcl.php"] [unique_id "aY3xXKQCQbD5BgeyIk1GxwAAABM"]
[Thu Feb 12 23:27:25.461559 2026] [:error] [pid 63511:tid 63523] [client 68.219.89.70:26560] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mjq.php"] [unique_id "aY3xXaQCQbD5BgeyIk1GyAAAAAo"]
[Thu Feb 12 23:27:27.815016 2026] [:error] [pid 63417:tid 63473] [client 68.219.89.70:37583] [client 68.219.89.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mjq.php"] [unique_id "aY3xX_8gSb97qRMtXCIUcgAAAFg"]
[Fri Feb 13 00:23:59.303467 2026] [:error] [pid 37512:tid 37624] [client 217.216.74.224:56492] [client 217.216.74.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aY3-n9De69znS-f6vSYwRgAAAA4"]
[Fri Feb 13 00:23:59.946560 2026] [:error] [pid 37511:tid 37602] [client 217.216.74.224:56638] [client 217.216.74.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "aY3-n-8EBJ86uZdxpA1k5wAAAFU"]
[Fri Feb 13 00:24:04.529729 2026] [:error] [pid 37856:tid 37874] [client 217.216.74.224:62302] [client 217.216.74.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/media/system/js/core.js"] [unique_id "aY3-pJUcWP4qWM7hWsnpUwAAAM8"]
[Fri Feb 13 00:33:58.153706 2026] [:error] [pid 23410:tid 23418] [client 64.89.163.24:58013] [client 64.89.163.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aY4A9hXZP6NFBacuW_0FgQAAAIY"]
[Fri Feb 13 00:33:59.609335 2026] [:error] [pid 37512:tid 37612] [client 64.89.163.24:57816] [client 64.89.163.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aY4A99De69znS-f6vSY1fgAAAAQ"]
[Fri Feb 13 00:34:01.157901 2026] [:error] [pid 37856:tid 37881] [client 64.89.163.24:50520] [client 64.89.163.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aY4A-ZUcWP4qWM7hWsnvoQAAANY"]
[Fri Feb 13 00:34:03.222530 2026] [:error] [pid 23410:tid 23430] [client 64.89.163.24:57702] [client 64.89.163.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aY4A-xXZP6NFBacuW_0FwgAAAJI"]
[Fri Feb 13 00:34:04.996267 2026] [:error] [pid 37856:tid 37880] [client 64.89.163.24:49604] [client 64.89.163.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aY4A_JUcWP4qWM7hWsnv0wAAANU"]
[Fri Feb 13 00:39:19.515782 2026] [:error] [pid 23410:tid 23435] [client 170.249.163.210:40516] [client 170.249.163.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.249.163.210, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY4CNxXZP6NFBacuW_0ITwAAAJc"]
[Fri Feb 13 01:23:14.282779 2026] [:error] [pid 23410:tid 23421] [client 74.208.118.55:39154] [client 74.208.118.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.208.118.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY4MghXZP6NFBacuW_0fTAAAAIk"]
[Fri Feb 13 02:14:43.843640 2026] [:error] [pid 23410:tid 23430] [client 103.28.36.205:37814] [client 103.28.36.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.28.36.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY4YkxXZP6NFBacuW_08HQAAAJI"]
[Fri Feb 13 02:15:07.906708 2026] [:error] [pid 37510:tid 37527] [client 89.43.17.214:39332] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY4Yq8UrqDPNSf1wYBWnSAAAAYs"]
[Fri Feb 13 02:18:13.706476 2026] [:error] [pid 37856:tid 37876] [client 217.154.56.229:52424] [client 217.154.56.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.56.229, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY4ZZZUcWP4qWM7hWskdhgAAANE"]
[Fri Feb 13 02:45:49.228662 2026] [:error] [pid 37511:tid 37581] [client 35.238.99.250:50506] [client 35.238.99.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.238.99.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY4f3e8EBJ86uZdxpA2aFAAAAEE"]
[Fri Feb 13 02:45:51.654337 2026] [:error] [pid 37511:tid 37585] [client 35.238.99.250:50506] [client 35.238.99.250] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aY4f3-8EBJ86uZdxpA2aHAAAAEQ"]
[Fri Feb 13 02:45:51.894195 2026] [:error] [pid 37511:tid 37589] [client 35.238.99.250:50506] [client 35.238.99.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.238.99.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY4f3-8EBJ86uZdxpA2aHgAAAEg"]
[Fri Feb 13 02:45:53.442569 2026] [:error] [pid 37510:tid 37527] [client 35.238.99.250:52881] [client 35.238.99.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.238.99.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY4f4cUrqDPNSf1wYBWyzgAAAYs"]
[Fri Feb 13 02:45:55.055213 2026] [:error] [pid 37512:tid 37609] [client 35.238.99.250:56484] [client 35.238.99.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.238.99.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY4f49De69znS-f6vSZl-wAAAAE"]
[Fri Feb 13 02:45:56.546686 2026] [:error] [pid 37512:tid 37635] [client 35.238.99.250:52373] [client 35.238.99.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.238.99.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY4f5NDe69znS-f6vSZmAQAAABg"]
[Fri Feb 13 02:45:58.060073 2026] [:error] [pid 37512:tid 37619] [client 35.238.99.250:49954] [client 35.238.99.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.238.99.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY4f5tDe69znS-f6vSZmBgAAAAo"]
[Fri Feb 13 02:45:58.060230 2026] [:error] [pid 37512:tid 37619] [client 35.238.99.250:49954] [client 35.238.99.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.238.99.250, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY4f5tDe69znS-f6vSZmBgAAAAo"]
[Fri Feb 13 02:56:12.825394 2026] [:error] [pid 37856:tid 37874] [client 216.26.241.54:9117] [client 216.26.241.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aY4iTJUcWP4qWM7hWskujgAAAM8"]
[Fri Feb 13 02:56:13.831623 2026] [:error] [pid 23410:tid 23435] [client 104.207.49.251:59371] [client 104.207.49.251] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aY4iTRXZP6NFBacuW_1UVwAAAJc"]
[Fri Feb 13 04:05:06.493986 2026] [:error] [pid 51243:tid 51257] [client 212.36.76.11:49406] [client 212.36.76.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.36.76.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY4ycsim7ZTAHzi7xZufDQAAAQw"]
[Fri Feb 13 04:53:11.603797 2026] [:error] [pid 49335:tid 49348] [client 207.154.197.201:54004] [client 207.154.197.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.154.197.201, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY49t6p--SFY2nwOiqkUzQAAAMs"]
[Fri Feb 13 05:51:08.891888 2026] [:error] [pid 49335:tid 49356] [client 27.0.175.83:35374] [client 27.0.175.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 27.0.175.83, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY5LTKp--SFY2nwOiqk5BAAAANM"]
[Fri Feb 13 06:47:33.222688 2026] [:error] [pid 49224:tid 49287] [client 216.177.141.187:55382] [client 216.177.141.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.177.141.187, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY5YhdiAvPoWmw5YhwmyIAAAAFQ"]
[Fri Feb 13 07:22:03.628360 2026] [:error] [pid 51243:tid 51258] [client 199.188.199.61:50956] [client 199.188.199.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 199.188.199.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY5gm8im7ZTAHzi7xZvyogAAAQ0"]
[Fri Feb 13 07:22:08.215879 2026] [:error] [pid 49224:tid 49291] [client 103.212.121.158:51249] [client 103.212.121.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.212.121.158, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY5goNiAvPoWmw5YhwnDIgAAAFg"]
[Fri Feb 13 07:22:53.532291 2026] [:error] [pid 49224:tid 49291] [client 199.188.199.61:33092] [client 199.188.199.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 199.188.199.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY5gzdiAvPoWmw5YhwnDrgAAAFg"]
[Fri Feb 13 07:33:03.077267 2026] [:error] [pid 49335:tid 49355] [client 149.202.83.206:33718] [client 149.202.83.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.83.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY5jL6p--SFY2nwOiql9XAAAANI"]
[Fri Feb 13 08:29:39.152439 2026] [:error] [pid 49335:tid 49356] [client 172.232.57.249:53608] [client 172.232.57.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.232.57.249, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY5wc6p--SFY2nwOiqmnnwAAANM"]
[Fri Feb 13 09:18:51.184619 2026] [:error] [pid 49224:tid 49272] [client 128.199.207.13:22460] [client 128.199.207.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.207.13, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY57-9iAvPoWmw5YhwkGcAAAAEU"]
[Fri Feb 13 09:51:14.214206 2026] [:error] [pid 49224:tid 49291] [client 170.106.72.178:40572] [client 170.106.72.178] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aY6DktiAvPoWmw5YhwkYNwAAAFg"]
[Fri Feb 13 10:11:32.937739 2026] [:error] [pid 46821:tid 46823] [client 168.119.162.72:36466] [client 168.119.162.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.119.162.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY6IVI6G1N5YSq0J0gd0hAAAAUA"]
[Fri Feb 13 11:55:17.364344 2026] [:error] [pid 49335:tid 49355] [client 217.216.48.92:56900] [client 217.216.48.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.216.48.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY6gpap--SFY2nwOiqn8xQAAANI"]
[Fri Feb 13 12:24:28.035932 2026] [:error] [pid 46821:tid 46834] [client 104.28.164.218:22572] [client 104.28.164.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aY6nfI6G1N5YSq0J0gespQAAAUs"]
[Fri Feb 13 12:26:33.075331 2026] [:error] [pid 51243:tid 51267] [client 54.36.181.89:48356] [client 54.36.181.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.181.89, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY6n-cim7ZTAHzi7xZtviwAAARY"]
[Fri Feb 13 12:41:01.403168 2026] [:error] [pid 46821:tid 46841] [client 199.188.200.121:41666] [client 199.188.200.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 199.188.200.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY6rXY6G1N5YSq0J0gex9gAAAVI"]
[Fri Feb 13 12:41:19.998276 2026] [:error] [pid 49224:tid 49277] [client 128.140.71.121:51660] [client 128.140.71.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.140.71.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY6rb9iAvPoWmw5YhwlzMwAAAEo"]
[Fri Feb 13 12:52:42.533173 2026] [:error] [pid 49335:tid 49361] [client 20.212.251.69:35772] [client 20.212.251.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.212.251.69, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY6uGqp--SFY2nwOiqkPZgAAANg"]
[Fri Feb 13 13:40:54.793717 2026] [:error] [pid 51243:tid 51267] [client 192.250.239.237:49200] [client 192.250.239.237] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.250.239.237, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY65Zsim7ZTAHzi7xZuFdAAAARY"]
[Fri Feb 13 13:58:48.258796 2026] [:error] [pid 49335:tid 49348] [client 37.140.223.53:46925] [client 37.140.223.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aY69mKp--SFY2nwOiqkiowAAAMs"]
[Fri Feb 13 14:41:55.893959 2026] [:error] [pid 47080:tid 47103] [client 164.132.49.123:36700] [client 164.132.49.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.49.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY7Hs0bWJwYCVF39z6vVcgAAAc8"]
[Fri Feb 13 15:07:46.351496 2026] [:error] [pid 49335:tid 49345] [client 60.188.57.0:50319] [client 60.188.57.0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aY7Nwqp--SFY2nwOiqkwvAAAAMg"]
[Fri Feb 13 15:38:23.899592 2026] [:error] [pid 49335:tid 49357] [client 143.198.119.177:37508] [client 143.198.119.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.198.119.177, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY7U76p--SFY2nwOiqk3XgAAANQ"]
[Fri Feb 13 16:32:18.579686 2026] [:error] [pid 47358:tid 47386] [client 188.165.95.76:35720] [client 188.165.95.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.165.95.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY7hksQFBuVVUQTESUzqyAAAApQ"]
[Fri Feb 13 17:33:40.481439 2026] [:error] [pid 49225:tid 49307] [client 52.226.240.29:42816] [client 52.226.240.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.226.240.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY7v9DwH8-zGxtAd3jvq7AAAAI0"]
[Fri Feb 13 17:58:38.784285 2026] [:error] [pid 47080:tid 47093] [client 154.222.16.33:53470] [client 154.222.16.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.222.16.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY71zkbWJwYCVF39z6sb9wAAAcU"]
[Fri Feb 13 17:58:42.984447 2026] [:error] [pid 49223:tid 49251] [client 163.223.227.6:59742] [client 163.223.227.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.223.227.6, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY710h8A_fZBamNLnfU61wAAABM"]
[Fri Feb 13 17:59:09.356648 2026] [:error] [pid 46821:tid 46823] [client 103.217.92.186:36960] [client 103.217.92.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.217.92.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY717Y6G1N5YSq0J0gf7BQAAAUA"]
[Fri Feb 13 18:08:09.064290 2026] [autoindex:error] [pid 49225:tid 49307] [client 207.180.241.56:53756] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Feb 13 18:24:30.358220 2026] [:error] [pid 49223:tid 49236] [client 209.50.227.124:53602] [client 209.50.227.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.50.227.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY773h8A_fZBamNLnfVCugAAAAQ"]
[Fri Feb 13 19:26:28.218558 2026] [:error] [pid 46821:tid 46832] [client 87.247.142.97:57344] [client 87.247.142.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.247.142.97, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY8KZI6G1N5YSq0J0gcNGQAAAUk"]
[Fri Feb 13 19:54:34.402467 2026] [:error] [pid 49335:tid 49350] [client 14.46.163.229:62320] [client 14.46.163.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 14.46.163.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aY8Q-qp--SFY2nwOiqloagAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 13 19:54:35.585503 2026] [:error] [pid 49335:tid 49347] [client 14.46.163.229:62320] [client 14.46.163.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 14.46.163.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aY8Q-6p--SFY2nwOiqloawAAAMo"], referer: https://lifewithlaila.com/wp-login.php?jetpack-sso-show-default-form=1
[Fri Feb 13 21:15:14.547897 2026] [:error] [pid 47575:tid 47603] [client 35.187.115.6:47622] [client 35.187.115.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.187.115.6, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY8j4gIPBuXb07mA_mTWzAAAAtY"]
[Fri Feb 13 22:15:14.969644 2026] [:error] [pid 18097:tid 18117] [client 54.38.195.241:51556] [client 54.38.195.241] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.38.195.241, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY8x8nFzYiQ_BfaDDlZMWQAAAZI"]
[Fri Feb 13 23:10:00.917839 2026] [:error] [pid 46821:tid 46835] [client 85.214.10.56:42682] [client 85.214.10.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.214.10.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY8-yI6G1N5YSq0J0gcwLwAAAUw"]
[Fri Feb 13 23:11:48.340643 2026] [:error] [pid 51243:tid 51264] [client 154.222.16.33:59150] [client 154.222.16.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.222.16.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY8_NMim7ZTAHzi7xZvpTAAAARM"]
[Fri Feb 13 23:11:57.076587 2026] [:error] [pid 49223:tid 49253] [client 89.43.17.214:56560] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY8_PR8A_fZBamNLnfWLAwAAABU"]
[Fri Feb 13 23:12:22.274503 2026] [:error] [pid 47080:tid 47089] [client 89.43.17.214:59642] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY8_VkbWJwYCVF39z6t82gAAAcE"]
[Fri Feb 13 23:12:46.417864 2026] [:error] [pid 47080:tid 47088] [client 31.177.95.217:57980] [client 31.177.95.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.177.95.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY8_bkbWJwYCVF39z6t89QAAAcA"]
[Sat Feb 14 00:04:21.336506 2026] [:error] [pid 47143:tid 47221] [client 35.234.37.132:36608] [client 35.234.37.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.234.37.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY9LhchV30NbMarHJLtohQAAAkc"]
[Sat Feb 14 00:14:47.483643 2026] [:error] [pid 18097:tid 18111] [client 136.111.114.245:56174] [client 136.111.114.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.114.245, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY9N93FzYiQ_BfaDDlZjoAAAAYw"]
[Sat Feb 14 00:14:49.628636 2026] [:error] [pid 18097:tid 18103] [client 136.111.114.245:56174] [client 136.111.114.245] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aY9N-XFzYiQ_BfaDDlZjpgAAAYQ"]
[Sat Feb 14 00:14:49.827653 2026] [:error] [pid 18097:tid 18104] [client 136.111.114.245:56174] [client 136.111.114.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.114.245, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY9N-XFzYiQ_BfaDDlZjqAAAAYU"]
[Sat Feb 14 00:14:51.227630 2026] [:error] [pid 18097:tid 18122] [client 136.111.114.245:61155] [client 136.111.114.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.114.245, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY9N-3FzYiQ_BfaDDlZjqgAAAZc"]
[Sat Feb 14 00:14:52.603833 2026] [:error] [pid 47143:tid 47229] [client 136.111.114.245:56299] [client 136.111.114.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.114.245, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY9N_MhV30NbMarHJLtp8AAAAk8"]
[Sat Feb 14 00:14:53.955308 2026] [:error] [pid 51243:tid 51256] [client 136.111.114.245:53482] [client 136.111.114.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.114.245, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY9N_cim7ZTAHzi7xZvyaAAAAQs"]
[Sat Feb 14 00:14:55.336742 2026] [:error] [pid 47358:tid 47377] [client 136.111.114.245:62029] [client 136.111.114.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.114.245, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY9N_8QFBuVVUQTESUw-pQAAAos"]
[Sat Feb 14 00:14:55.336876 2026] [:error] [pid 47358:tid 47377] [client 136.111.114.245:62029] [client 136.111.114.245] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 136.111.114.245, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY9N_8QFBuVVUQTESUw-pQAAAos"]
[Sat Feb 14 01:10:27.954917 2026] [:error] [pid 49225:tid 49308] [client 149.202.83.206:53120] [client 149.202.83.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.83.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY9bAzwH8-zGxtAd3jtAAAAAAI4"]
[Sat Feb 14 02:02:04.122996 2026] [:error] [pid 49225:tid 49306] [client 207.154.197.201:49276] [client 207.154.197.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.154.197.201, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY9nHDwH8-zGxtAd3jtISQAAAIw"]
[Sat Feb 14 02:46:43.610800 2026] [:error] [pid 49225:tid 49299] [client 34.61.163.159:64285] [client 34.61.163.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.61.163.159, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY9xkzwH8-zGxtAd3jtQggAAAIU"]
[Sat Feb 14 02:46:45.848878 2026] [:error] [pid 49225:tid 49304] [client 34.61.163.159:64285] [client 34.61.163.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aY9xlTwH8-zGxtAd3jtQhwAAAIo"]
[Sat Feb 14 02:46:46.048287 2026] [:error] [pid 49225:tid 49307] [client 34.61.163.159:64285] [client 34.61.163.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.61.163.159, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY9xljwH8-zGxtAd3jtQiAAAAI0"]
[Sat Feb 14 02:46:47.594518 2026] [:error] [pid 49335:tid 49339] [client 34.61.163.159:60927] [client 34.61.163.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.61.163.159, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY9xl6p--SFY2nwOiqmsiQAAAMI"]
[Sat Feb 14 02:46:48.971096 2026] [:error] [pid 49335:tid 49356] [client 34.61.163.159:49731] [client 34.61.163.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.61.163.159, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY9xmKp--SFY2nwOiqmsjAAAANM"]
[Sat Feb 14 02:46:50.335521 2026] [:error] [pid 49223:tid 49238] [client 34.61.163.159:56304] [client 34.61.163.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.61.163.159, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY9xmh8A_fZBamNLnfW7BwAAAAY"]
[Sat Feb 14 02:46:51.736981 2026] [:error] [pid 49335:tid 49357] [client 34.61.163.159:58653] [client 34.61.163.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.61.163.159, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY9xm6p--SFY2nwOiqmskQAAANQ"]
[Sat Feb 14 02:46:51.737093 2026] [:error] [pid 49335:tid 49357] [client 34.61.163.159:58653] [client 34.61.163.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.61.163.159, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY9xm6p--SFY2nwOiqmskQAAANQ"]
[Sat Feb 14 02:53:52.045460 2026] [:error] [pid 49335:tid 49353] [client 45.195.75.44:54824] [client 45.195.75.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.195.75.44, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY9zQKp--SFY2nwOiqmtYAAAANA"]
[Sat Feb 14 04:42:40.136976 2026] [:error] [pid 21785:tid 21829] [client 212.36.76.11:48428] [client 212.36.76.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.36.76.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY-MwAOBjP5pmZ2xNN4ifgAAAY8"]
[Sat Feb 14 05:04:35.829115 2026] [:error] [pid 21196:tid 21278] [client 184.168.120.235:60092] [client 184.168.120.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.120.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY-R4_tQbaugyUK6TM9yygAAAJQ"]
[Sat Feb 14 05:04:36.158900 2026] [:error] [pid 21195:tid 21255] [client 47.100.130.223:49446] [client 47.100.130.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.100.130.223, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY-R5N_2sARdLQ6dpsU2vgAAAFg"]
[Sat Feb 14 05:04:39.431418 2026] [:error] [pid 21196:tid 21282] [client 165.22.61.123:54642] [client 165.22.61.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.61.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY-R5_tQbaugyUK6TM9y0AAAAJg"]
[Sat Feb 14 05:04:40.905245 2026] [:error] [pid 58882:tid 58888] [client 167.172.67.131:60764] [client 167.172.67.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.67.131, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY-R6J5gZqnf2ItlwaozoQAAAcQ"]
[Sat Feb 14 05:04:41.043177 2026] [:error] [pid 58882:tid 58885] [client 103.108.220.125:63027] [client 103.108.220.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.108.220.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY-R6Z5gZqnf2ItlwaozpAAAAcE"]
[Sat Feb 14 05:04:46.662080 2026] [:error] [pid 21784:tid 21799] [client 159.203.123.124:19648] [client 159.203.123.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.123.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY-R7q1lOIszF3YGN_9sfAAAAUw"]
[Sat Feb 14 05:04:52.679984 2026] [:error] [pid 58882:tid 58903] [client 82.156.14.49:57380] [client 82.156.14.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.156.14.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY-R9J5gZqnf2ItlwaozswAAAdM"]
[Sat Feb 14 05:04:57.918406 2026] [:error] [pid 21194:tid 21208] [client 50.116.24.118:33448] [client 50.116.24.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.116.24.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY-R-YW0MV8dvwNvAHoQHQAAAAU"]
[Sat Feb 14 05:05:01.082880 2026] [:error] [pid 21195:tid 21233] [client 184.168.120.235:37824] [client 184.168.120.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.120.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY-R_d_2sARdLQ6dpsU2ywAAAEI"]
[Sat Feb 14 05:10:44.415610 2026] [:error] [pid 21194:tid 21217] [client 154.86.112.133:19024] [client 154.86.112.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.86.112.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aY-TVIW0MV8dvwNvAHoRGwAAAA4"]
[Sat Feb 14 05:10:46.438560 2026] [:error] [pid 21194:tid 21219] [client 156.239.192.129:55452] [client 156.239.192.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.192.129, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aY-TVoW0MV8dvwNvAHoRHgAAABA"], referer: http://expressinteriors.com/wp-login.php
[Sat Feb 14 05:10:48.877259 2026] [:error] [pid 21752:tid 21760] [client 156.249.127.167:32546] [client 156.249.127.167] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aY-TWBOc0bldMgpeu11hugAAAQY"]
[Sat Feb 14 05:10:51.108669 2026] [:error] [pid 21299:tid 21323] [client 154.199.15.252:27946] [client 154.199.15.252] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.199.15.252, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aY-TWyOQKXTT1MWe_sDVtQAAANU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 14 05:10:51.112391 2026] [:error] [pid 21299:tid 21323] [client 154.199.15.252:27946] [client 154.199.15.252] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aY-TWyOQKXTT1MWe_sDVtQAAANU"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 14 05:10:52.718493 2026] [:error] [pid 21785:tid 21830] [client 154.193.154.198:43480] [client 154.193.154.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.193.154.198, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aY-TXAOBjP5pmZ2xNN4rOAAAAZA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 14 05:10:52.725663 2026] [:error] [pid 21785:tid 21830] [client 154.193.154.198:43480] [client 154.193.154.198] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aY-TXAOBjP5pmZ2xNN4rOAAAAZA"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 14 05:10:54.246102 2026] [:error] [pid 21195:tid 21244] [client 156.249.125.23:16812] [client 156.249.125.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.249.125.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aY-TXt_2sARdLQ6dpsU3yQAAAE0"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 14 05:10:54.250997 2026] [:error] [pid 21195:tid 21244] [client 156.249.125.23:16812] [client 156.249.125.23] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aY-TXt_2sARdLQ6dpsU3yQAAAE0"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 14 05:10:55.812140 2026] [:error] [pid 21784:tid 21801] [client 156.249.127.204:53698] [client 156.249.127.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.249.127.204, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aY-TX61lOIszF3YGN_9t0wAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 14 05:10:55.814770 2026] [:error] [pid 21784:tid 21801] [client 156.249.127.204:53698] [client 156.249.127.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aY-TX61lOIszF3YGN_9t0wAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 14 05:10:57.073272 2026] [:error] [pid 21752:tid 21768] [client 154.193.159.32:15738] [client 154.193.159.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.193.159.32, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aY-TYROc0bldMgpeu11hxgAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 14 05:10:57.076410 2026] [:error] [pid 21752:tid 21768] [client 154.193.159.32:15738] [client 154.193.159.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aY-TYROc0bldMgpeu11hxgAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 14 05:40:14.496131 2026] [:error] [pid 21784:tid 21795] [client 196.27.114.137:56834] [client 196.27.114.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.27.114.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY-aPq1lOIszF3YGN_90eAAAAUg"]
[Sat Feb 14 06:07:48.934339 2026] [:error] [pid 21196:tid 21260] [client 102.64.223.133:56275] [client 102.64.223.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.64.223.133, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY-gtPtQbaugyUK6TM-APgAAAII"]
[Sat Feb 14 06:37:07.051076 2026] [:error] [pid 21785:tid 21823] [client 109.228.37.48:45986] [client 109.228.37.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.228.37.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY-nkwOBjP5pmZ2xNN5E9gAAAYk"]
[Sat Feb 14 07:30:08.428489 2026] [:error] [pid 58882:tid 58904] [client 207.154.197.201:53242] [client 207.154.197.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 207.154.197.201, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY-0AJ5gZqnf2ItlwapXmwAAAdQ"]
[Sat Feb 14 07:44:55.192424 2026] [:error] [pid 21194:tid 21222] [client 43.157.46.118:49362] [client 43.157.46.118] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aY-3d4W0MV8dvwNvAHorVgAAABM"]
[Sat Feb 14 08:28:41.184387 2026] [:error] [pid 21196:tid 21261] [client 49.13.10.24:55384] [client 49.13.10.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.13.10.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY_BuftQbaugyUK6TM-cPgAAAIM"]
[Sat Feb 14 09:17:24.189898 2026] [:error] [pid 58882:tid 58890] [client 52.226.240.29:16768] [client 52.226.240.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.226.240.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY_NJJ5gZqnf2ItlwapvZgAAAcY"]
[Sat Feb 14 10:17:04.480176 2026] [:error] [pid 21785:tid 21829] [client 116.202.3.129:42692] [client 116.202.3.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.202.3.129, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY_bIAOBjP5pmZ2xNN6A6AAAAY8"]
[Sat Feb 14 11:02:56.099901 2026] [:error] [pid 28883:tid 28927] [client 31.177.95.217:44258] [client 31.177.95.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.177.95.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY_l4GBZFo3PsPpATCyIvAAAAo8"]
[Sat Feb 14 11:03:28.756454 2026] [:error] [pid 7849:tid 7854] [client 68.183.24.180:41472] [client 68.183.24.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.24.180, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY_mAKo2GBj-ngzmcoV_xgAAAgM"]
[Sat Feb 14 11:03:42.877507 2026] [:error] [pid 28853:tid 28861] [client 47.251.116.156:42730] [client 47.251.116.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.251.116.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY_mDrwdrXcA78tPzCiT-wAAAMY"]
[Sat Feb 14 11:03:47.439179 2026] [:error] [pid 58882:tid 58905] [client 199.188.199.61:43820] [client 199.188.199.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 199.188.199.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY_mE55gZqnf2ItlwaqDkQAAAdU"]
[Sat Feb 14 11:04:11.291348 2026] [:error] [pid 28882:tid 28905] [client 34.72.233.94:53556] [client 34.72.233.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.72.233.94, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY_mK3FQSrm4EPBDLaw9OAAAAlQ"]
[Sat Feb 14 11:14:37.624464 2026] [:error] [pid 28882:tid 28898] [client 167.235.6.174:46336] [client 167.235.6.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.235.6.174, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY_onXFQSrm4EPBDLaw_BwAAAk0"]
[Sat Feb 14 11:45:49.986540 2026] [:error] [pid 8039:tid 8057] [client 139.59.24.163:65132] [client 139.59.24.163] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "aY_v7XLa1ioCIZV3fA4R1AAAAw0"], referer: binance.com
[Sat Feb 14 11:55:15.347040 2026] [:error] [pid 8039:tid 8068] [client 45.94.31.72:63823] [client 45.94.31.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "aY_yI3La1ioCIZV3fA4TVAAAAxg"]
[Sat Feb 14 11:55:15.834099 2026] [:error] [pid 58882:tid 58884] [client 45.94.31.72:64083] [client 45.94.31.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "aY_yI55gZqnf2ItlwaqN9gAAAcA"]
[Sat Feb 14 11:55:16.318953 2026] [:error] [pid 21752:tid 21770] [client 45.94.31.72:64303] [client 45.94.31.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "aY_yJBOc0bldMgpeu12xzwAAARA"]
[Sat Feb 14 11:55:18.358049 2026] [:error] [pid 7849:tid 7857] [client 45.94.31.72:49297] [client 45.94.31.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "aY_yJqo2GBj-ngzmcoWNXgAAAgY"]
[Sat Feb 14 12:01:33.886190 2026] [:error] [pid 7849:tid 7862] [client 43.153.102.138:46256] [client 43.153.102.138] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aY_znao2GBj-ngzmcoWOmwAAAgs"]
[Sat Feb 14 12:07:11.860227 2026] [:error] [pid 7982:tid 8034] [client 87.98.165.243:49430] [client 87.98.165.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.98.165.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aY_072LTp1DWAgIKqwScbwAAAtc"]
[Sat Feb 14 12:36:32.630217 2026] [:error] [pid 7982:tid 8012] [client 16.144.51.162:57525] [client 16.144.51.162] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "57.141.14.71_bb694759cd2c22a01c1316c1c32e166b75850636"): Internal error (specific information not available) [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/jquery.min.js"] [unique_id "aY_7z2LTp1DWAgIKqwSgPAAAAsE"]
[Sat Feb 14 13:05:31.492713 2026] [:error] [pid 63325:tid 63330] [client 80.82.219.138:47240] [client 80.82.219.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.82.219.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZACmwGMleU5keYIEc5SfAAAAIE"]
[Sat Feb 14 14:02:34.969960 2026] [:error] [pid 7982:tid 8016] [client 89.185.138.75:41742] [client 89.185.138.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.185.138.75, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZAP-mLTp1DWAgIKqwSymgAAAsU"]
[Sat Feb 14 15:57:38.401629 2026] [:error] [pid 28883:tid 28927] [client 167.172.153.2:43330] [client 167.172.153.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.153.2, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZAq8mBZFo3PsPpATCy98AAAAo8"]
[Sat Feb 14 16:52:25.068050 2026] [:error] [pid 36056:tid 36072] [client 129.204.9.155:33440] [client 129.204.9.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.204.9.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZA3ybv3wQbSPS1vpOjypAAAAA4"]
[Sat Feb 14 16:52:29.638561 2026] [:error] [pid 35135:tid 35138] [client 163.44.193.130:49924] [client 163.44.193.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.44.193.130, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZA3zYkSccJZYMDP04wVVQAAAQA"]
[Sat Feb 14 16:52:34.251667 2026] [:error] [pid 63327:tid 63358] [client 8.156.67.207:50168] [client 8.156.67.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.156.67.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZA30i9btvSz88ToHa-7nAAAAYI"]
[Sat Feb 14 16:52:46.071885 2026] [:error] [pid 56719:tid 56774] [client 220.158.233.50:5174] [client 220.158.233.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.158.233.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZA33kBVs8LiCmFJP0CxTgAAAtg"]
[Sat Feb 14 16:52:55.626975 2026] [:error] [pid 56719:tid 56770] [client 20.106.212.198:32886] [client 20.106.212.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.106.212.198, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZA350BVs8LiCmFJP0CxYgAAAtQ"]
[Sat Feb 14 16:53:00.323214 2026] [:error] [pid 50401:tid 50483] [client 134.209.95.224:53758] [client 134.209.95.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.209.95.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZA37LOW7kXCx3N6fEiODAAAA1g"]
[Sat Feb 14 16:53:01.893381 2026] [:error] [pid 50401:tid 50477] [client 97.74.92.57:39154] [client 97.74.92.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 97.74.92.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZA37bOW7kXCx3N6fEiODQAAA1I"]
[Sat Feb 14 16:53:10.829514 2026] [:error] [pid 56720:tid 56784] [client 184.168.120.235:44884] [client 184.168.120.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.120.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZA39njg3vzUoXJ19eD5pwAAA8c"]
[Sat Feb 14 16:53:33.452564 2026] [:error] [pid 50401:tid 50476] [client 193.202.110.34:39410] [client 193.202.110.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.202.110.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZA4DbOW7kXCx3N6fEiOKgAAA1E"]
[Sat Feb 14 17:48:24.151041 2026] [:error] [pid 36056:tid 36070] [client 157.245.107.90:51182] [client 157.245.107.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.245.107.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZBE6Lv3wQbSPS1vpOj8eQAAAAw"]
[Sat Feb 14 18:58:14.623059 2026] [:error] [pid 63327:tid 63356] [client 102.64.223.133:55574] [client 102.64.223.133] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aZBVRi9btvSz88ToHa_W-QAAAYA"]
[Sat Feb 14 18:59:44.433477 2026] [:error] [pid 56718:tid 56730] [client 102.64.223.133:54714] [client 102.64.223.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.64.223.133, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZBVoAt_sRAfjbGa_J7L1QAAAkc"]
[Sat Feb 14 19:00:57.278753 2026] [:error] [pid 56720:tid 56793] [client 102.64.223.133:57431] [client 102.64.223.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.64.223.133, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZBV6Xjg3vzUoXJ19eASLAAAA9A"]
[Sat Feb 14 19:01:50.210697 2026] [:error] [pid 35135:tid 35159] [client 49.51.183.75:49878] [client 49.51.183.75] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZBWHokSccJZYMDP04wyrwAAARU"]
[Sat Feb 14 19:02:08.328731 2026] [:error] [pid 63327:tid 63364] [client 102.64.223.133:56181] [client 102.64.223.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.64.223.133, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZBWMC9btvSz88ToHa_XpwAAAYg"]
[Sat Feb 14 19:03:14.305873 2026] [:error] [pid 8275:tid 8311] [client 102.64.223.133:56339] [client 102.64.223.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.64.223.133, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZBWcnGd3NoJAR-fTNVFNwAAAcM"]
[Sat Feb 14 19:04:22.285054 2026] [:error] [pid 24532:tid 24577] [client 102.64.223.133:55398] [client 102.64.223.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.64.223.133, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZBWth_n3lsEkQwyflIOQgAAAw0"]
[Sat Feb 14 19:38:13.744021 2026] [:error] [pid 50339:tid 50383] [client 103.14.123.169:40952] [client 103.14.123.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.14.123.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZBepcI6TclQ9GOl2Y1nOwAAAg0"]
[Sat Feb 14 21:25:19.187661 2026] [:error] [pid 53920:tid 53960] [client 51.159.214.31:60942] [client 51.159.214.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.214.31, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZB3vyrmNDNQ_-GD91KFeQAAAUs"]
[Sat Feb 14 22:25:47.438202 2026] [:error] [pid 53980:tid 54028] [client 159.223.103.141:43594] [client 159.223.103.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.103.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZCF69posYBT7xU8oxTUWwAAAtI"]
[Sat Feb 14 22:38:19.989577 2026] [:error] [pid 11705:tid 11731] [client 43.155.26.193:60468] [client 43.155.26.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZCI22aUAy1IvysReyxRAwAAAFg"]
[Sat Feb 14 22:52:04.260893 2026] [:error] [pid 50339:tid 50386] [client 182.42.104.32:32947] [client 182.42.104.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZCMFMI6TclQ9GOl2Y2PeAAAAhA"]
[Sat Feb 14 23:00:17.595586 2026] [:error] [pid 7462:tid 7473] [client 118.27.125.50:60400] [client 118.27.125.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.27.125.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZCOAW2K0eQbQ6nA1wPASwAAAMg"]
[Sat Feb 14 23:00:22.056195 2026] [:error] [pid 11705:tid 11717] [client 103.113.152.163:48042] [client 103.113.152.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.113.152.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZCOBmaUAy1IvysReyxUYgAAAEo"]
[Sat Feb 14 23:00:26.543512 2026] [:error] [pid 11801:tid 11874] [client 120.46.91.85:34504] [client 120.46.91.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.46.91.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZCOCjP96sFUu5UWagzSowAAA48"]
[Sat Feb 14 23:00:44.665187 2026] [:error] [pid 11705:tid 11728] [client 34.132.81.192:50364] [client 34.132.81.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.132.81.192, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZCOHGaUAy1IvysReyxUbwAAAFU"]
[Sat Feb 14 23:00:46.782949 2026] [:error] [pid 50339:tid 50377] [client 47.82.118.63:57964] [client 47.82.118.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.82.118.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZCOHsI6TclQ9GOl2Y2QrwAAAgc"]
[Sat Feb 14 23:00:52.908899 2026] [:error] [pid 11801:tid 11872] [client 103.172.239.79:50946] [client 103.172.239.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.172.239.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZCOJDP96sFUu5UWagzSvwAAA40"]
[Sat Feb 14 23:01:07.597494 2026] [:error] [pid 11800:tid 11860] [client 49.235.37.218:43090] [client 49.235.37.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.235.37.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZCOM3FcWMbg_UEt9SEa1wAAA1c"]
[Sat Feb 14 23:01:11.902250 2026] [:error] [pid 11705:tid 11711] [client 118.27.125.50:43266] [client 118.27.125.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.27.125.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZCON2aUAy1IvysReyxUfQAAAEQ"]
[Sat Feb 14 23:01:15.404969 2026] [:error] [pid 53980:tid 54029] [client 97.74.92.57:41502] [client 97.74.92.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 97.74.92.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZCOO9posYBT7xU8oxTakQAAAtM"]
[Sat Feb 14 23:01:22.614662 2026] [:error] [pid 11801:tid 11812] [client 167.99.116.143:51382] [client 167.99.116.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.116.143, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZCOQjP96sFUu5UWagzS1AAAA4M"]
[Sun Feb 15 00:23:00.072278 2026] [:error] [pid 15954:tid 16003] [client 51.89.19.88:46502] [client 51.89.19.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.89.19.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZChZO2YplA3pz7MAbV9VgAAAdM"]
[Sun Feb 15 01:09:20.485719 2026] [:error] [pid 53980:tid 54029] [client 43.166.7.113:37966] [client 43.166.7.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZCsQNposYBT7xU8oxTvBgAAAtM"]
[Sun Feb 15 01:24:26.355387 2026] [:error] [pid 28511:tid 28524] [client 93.190.49.83:57196] [client 93.190.49.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.190.49.83, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZCvyhZ3wyYJRs97ghpnmQAAAQo"]
[Sun Feb 15 02:25:30.045979 2026] [:error] [pid 53980:tid 54024] [client 37.128.148.215:41294] [client 37.128.148.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.128.148.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZC-GtposYBT7xU8oxT5zwAAAs4"]
[Sun Feb 15 03:19:50.830563 2026] [:error] [pid 18113:tid 18126] [client 170.249.163.210:41824] [client 170.249.163.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.249.163.210, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZDK1rtXQ3sVVSAsCgi9KgAAAko"]
[Sun Feb 15 05:07:20.194417 2026] [:error] [pid 24412:tid 24443] [client 122.51.236.174:56696] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZDkCCFWEC7XTrgvZHkqjgAAAgE"]
[Sun Feb 15 05:18:18.761412 2026] [:error] [pid 54015:tid 54027] [client 5.135.142.201:34132] [client 5.135.142.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.135.142.201, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZDmmqpo2V_xmMbamFHvggAAAAM"]
[Sun Feb 15 05:56:18.540382 2026] [:error] [pid 35272:tid 35282] [client 199.188.199.61:42770] [client 199.188.199.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 199.188.199.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZDvgp2NOcixEnMLwzcfkwAAAIY"]
[Sun Feb 15 05:56:56.554770 2026] [:error] [pid 25058:tid 25105] [client 103.2.225.70:58070] [client 103.2.225.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.2.225.70, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZDvqIg4NxVrOKZPnPElYgAAAxI"]
[Sun Feb 15 06:27:40.325818 2026] [:error] [pid 33236:tid 33292] [client 43.135.134.127:51480] [client 43.135.134.127] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZD23DCGj89oAJrfH6DsYgAAA1g"]
[Sun Feb 15 07:09:08.210712 2026] [:error] [pid 53689:tid 53747] [client 137.184.25.215:48420] [client 137.184.25.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.25.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZEAlAdVuSk1xLp2CvBGzQAAA8E"]
[Sun Feb 15 08:08:30.220235 2026] [:error] [pid 9116:tid 9181] [client 5.135.139.120:52082] [client 5.135.139.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.135.139.120, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZEOfrhcWbzDt4E9y-vsbwAAA4k"]
[Sun Feb 15 08:11:32.447484 2026] [:error] [pid 53689:tid 53757] [client 154.199.68.161:31004] [client 154.199.68.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.199.68.161, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZEPNAdVuSk1xLp2CvBTLQAAA8s"]
[Sun Feb 15 08:11:39.140486 2026] [:error] [pid 9116:tid 9180] [client 154.82.169.76:15000] [client 154.82.169.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.82.169.76, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZEPO7hcWbzDt4E9y-vtGwAAA4g"], referer: http://expressinteriors.com/wp-login.php
[Sun Feb 15 08:11:41.150500 2026] [:error] [pid 53689:tid 53759] [client 154.199.15.110:33166] [client 154.199.15.110] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aZEPPQdVuSk1xLp2CvBTMAAAA80"]
[Sun Feb 15 08:11:42.675238 2026] [:error] [pid 14671:tid 14715] [client 154.222.132.227:16846] [client 154.222.132.227] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.222.132.227, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZEPPowuLRDzNvw55EPrJQAAAow"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 15 08:11:42.678226 2026] [:error] [pid 14671:tid 14715] [client 154.222.132.227:16846] [client 154.222.132.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZEPPowuLRDzNvw55EPrJQAAAow"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 15 08:11:45.129600 2026] [:error] [pid 9056:tid 9061] [client 156.239.220.6:15714] [client 156.239.220.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.220.6, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZEPQe5xjYNtxWEQS9mekgAAAII"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 15 08:11:45.132980 2026] [:error] [pid 9056:tid 9061] [client 156.239.220.6:15714] [client 156.239.220.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZEPQe5xjYNtxWEQS9mekgAAAII"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 15 08:11:46.408757 2026] [:error] [pid 14671:tid 14718] [client 154.82.170.201:11144] [client 154.82.170.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.82.170.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZEPQowuLRDzNvw55EPrJwAAAo8"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 15 08:11:46.411937 2026] [:error] [pid 14671:tid 14718] [client 154.82.170.201:11144] [client 154.82.170.201] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZEPQowuLRDzNvw55EPrJwAAAo8"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 15 08:11:50.687040 2026] [:error] [pid 9056:tid 9076] [client 154.86.113.26:26484] [client 154.86.113.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.86.113.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZEPRu5xjYNtxWEQS9melQAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 15 08:11:50.691193 2026] [:error] [pid 9056:tid 9076] [client 154.86.113.26:26484] [client 154.86.113.26] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZEPRu5xjYNtxWEQS9melQAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 15 08:11:54.780463 2026] [:error] [pid 14671:tid 14703] [client 156.239.218.155:59988] [client 156.239.218.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.218.155, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZEPSowuLRDzNvw55EPrLQAAAoA"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 15 08:11:54.783822 2026] [:error] [pid 14671:tid 14703] [client 156.239.218.155:59988] [client 156.239.218.155] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZEPSowuLRDzNvw55EPrLQAAAoA"], referer: https://expressinteriors.com/wp-login.php
[Sun Feb 15 09:05:54.954330 2026] [:error] [pid 19652:tid 19664] [client 134.122.6.46:33764] [client 134.122.6.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.122.6.46, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZEb8jHg2T9K5fiyOL976QAAAAo"]
[Sun Feb 15 09:54:31.847087 2026] [:error] [pid 42752:tid 42780] [client 43.130.150.80:40692] [client 43.130.150.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZEnV8ClY05C-Gq9l0gKUwAAAtU"]
[Sun Feb 15 11:17:29.865898 2026] [:error] [pid 19652:tid 19654] [client 43.129.189.147:53376] [client 43.129.189.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.129.189.147, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZE6yTHg2T9K5fiyOL-SOQAAAAA"]
[Sun Feb 15 11:17:45.508707 2026] [:error] [pid 19652:tid 19678] [client 39.108.188.68:45124] [client 39.108.188.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.108.188.68, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZE62THg2T9K5fiyOL-SSQAAABg"]
[Sun Feb 15 11:18:15.301761 2026] [:error] [pid 35497:tid 35545] [client 47.239.109.32:34654] [client 47.239.109.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.239.109.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZE698yqpfYzoxiskhsheQAAANI"]
[Sun Feb 15 11:18:16.737488 2026] [:error] [pid 42659:tid 42672] [client 121.40.46.168:41972] [client 121.40.46.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.40.46.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZE6-Oy3JGHOB-Rj_FYm8wAAAEs"]
[Sun Feb 15 11:18:53.426747 2026] [:error] [pid 42754:tid 42834] [client 192.64.117.254:36276] [client 192.64.117.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.64.117.254, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZE7HeiCZrZWT4BVy12KBAAAA9Q"]
[Sun Feb 15 11:19:07.234983 2026] [:error] [pid 19652:tid 19661] [client 103.172.239.79:49304] [client 103.172.239.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.172.239.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZE7KzHg2T9K5fiyOL-SkAAAAAc"]
[Sun Feb 15 11:19:10.510240 2026] [:error] [pid 31679:tid 31726] [client 47.239.109.32:38758] [client 47.239.109.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.239.109.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZE7Lhz9Q_0Eh7M-Xr1ZzwAAAhE"]
[Sun Feb 15 11:55:57.303613 2026] [:error] [pid 35497:tid 35538] [client 217.154.99.219:39228] [client 217.154.99.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.99.219, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZFDzcyqpfYzoxiskhsqewAAAMs"]
[Sun Feb 15 12:26:51.755378 2026] [autoindex:error] [pid 19652:tid 19669] [client 207.180.241.56:55176] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Feb 15 12:27:35.391241 2026] [:error] [pid 35560:tid 35628] [client 51.75.151.149:60608] [client 51.75.151.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/cidaas-pro-master/composer.json"] [unique_id "aZFLNwZSChHPc3occZ4BDQAAAws"]
[Sun Feb 15 12:48:54.652305 2026] [autoindex:error] [pid 42659:tid 42685] [client 167.86.118.77:59247] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Feb 15 12:57:12.295154 2026] [:error] [pid 42754:tid 42838] [client 35.198.41.118:54908] [client 35.198.41.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.198.41.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZFSKOiCZrZWT4BVy12b7wAAA9g"]
[Sun Feb 15 14:02:56.659317 2026] [:error] [pid 42754:tid 42833] [client 43.135.182.43:57752] [client 43.135.182.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZFhkOiCZrZWT4BVy12m3QAAA9M"]
[Sun Feb 15 16:29:17.114732 2026] [:error] [pid 42659:tid 42668] [client 50.116.24.118:44184] [client 50.116.24.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.116.24.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZGD3ey3JGHOB-Rj_FZpHgAAAEc"]
[Sun Feb 15 16:29:44.905307 2026] [:error] [pid 35497:tid 35539] [client 89.42.211.170:44502] [client 89.42.211.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.42.211.170, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZGD-MyqpfYzoxiskhtl1wAAAMw"]
[Sun Feb 15 16:29:55.323504 2026] [:error] [pid 35557:tid 35586] [client 38.58.224.32:16428] [client 38.58.224.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.58.224.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZGEA8I4REuGME4xEbMqLQAAAlc"]
[Sun Feb 15 16:30:15.417805 2026] [:error] [pid 42752:tid 42762] [client 34.72.233.94:56714] [client 34.72.233.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.72.233.94, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZGEF8ClY05C-Gq9l0hHFAAAAsM"]
[Sun Feb 15 16:49:30.445089 2026] [:error] [pid 19652:tid 19662] [client 43.131.26.226:60570] [client 43.131.26.226] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZGImjHg2T9K5fiyOL_eMwAAAAg"]
[Sun Feb 15 20:17:10.631240 2026] [:error] [pid 42752:tid 42782] [client 43.155.188.157:53082] [client 43.155.188.157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZG5RsClY05C-Gq9l0hqMQAAAtc"]
[Sun Feb 15 21:32:55.984779 2026] [:error] [pid 35557:tid 35565] [client 45.61.149.49:57399] [client 45.61.149.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.61.149.49, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZHLB8I4REuGME4xEbNa8QAAAkI"]
[Sun Feb 15 21:33:02.374166 2026] [autoindex:error] [pid 35497:tid 35531] [client 45.61.149.49:59240] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Feb 15 21:33:07.382753 2026] [autoindex:error] [pid 42754:tid 42835] [client 45.61.149.49:60448] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Feb 15 21:33:12.197056 2026] [autoindex:error] [pid 42754:tid 42833] [client 45.61.149.49:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Feb 15 21:33:16.685040 2026] [:error] [pid 35560:tid 35627] [client 45.61.149.49:63632] [client 45.61.149.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Content/Type/index.php"] [unique_id "aZHLHAZSChHPc3occZ5XggAAAwo"]
[Sun Feb 15 21:33:20.255419 2026] [:error] [pid 35560:tid 35619] [client 45.61.149.49:64656] [client 45.61.149.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aZHLIAZSChHPc3occZ5XhQAAAwI"]
[Sun Feb 15 21:33:21.644877 2026] [:error] [pid 42753:tid 42797] [client 45.61.149.49:64958] [client 45.61.149.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/userfuns.php"] [unique_id "aZHLIQhQMLzszrBLG6cLhAAAA4o"]
[Sun Feb 15 21:33:28.704258 2026] [:error] [pid 42659:tid 42685] [client 45.61.149.49:51158] [client 45.61.149.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/index.php"] [unique_id "aZHLKOy3JGHOB-Rj_FaZdgAAAFg"]
[Sun Feb 15 21:33:29.266204 2026] [:error] [pid 31679:tid 31711] [client 45.61.149.49:51353] [client 45.61.149.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/userfuns.php"] [unique_id "aZHLKRz9Q_0Eh7M-Xr3TvAAAAgI"]
[Sun Feb 15 21:33:32.308794 2026] [:error] [pid 35557:tid 35587] [client 45.61.149.49:53014] [client 45.61.149.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/index.php"] [unique_id "aZHLLMI4REuGME4xEbNbIAAAAlg"]
[Sun Feb 15 21:33:32.963160 2026] [:error] [pid 35557:tid 35571] [client 45.61.149.49:53246] [client 45.61.149.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/userfuns.php"] [unique_id "aZHLLMI4REuGME4xEbNbIwAAAkg"]
[Sun Feb 15 21:33:36.277057 2026] [:error] [pid 35557:tid 35564] [client 45.61.149.49:54800] [client 45.61.149.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/index.php"] [unique_id "aZHLMMI4REuGME4xEbNbKgAAAkE"]
[Sun Feb 15 21:33:36.783967 2026] [:error] [pid 35557:tid 35577] [client 45.61.149.49:54989] [client 45.61.149.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/about.php"] [unique_id "aZHLMMI4REuGME4xEbNbLQAAAk4"]
[Sun Feb 15 21:33:40.838597 2026] [:error] [pid 35560:tid 35623] [client 45.61.149.49:56582] [client 45.61.149.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/IXR/index.php"] [unique_id "aZHLNAZSChHPc3occZ5XigAAAwY"]
[Sun Feb 15 21:33:41.013089 2026] [:error] [pid 14577:tid 14588] [client 45.61.149.49:56722] [client 45.61.149.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aZHLNXTqrkuce6u39HtWRwAAAQg"]
[Sun Feb 15 21:33:47.754097 2026] [:error] [pid 42659:tid 42661] [client 45.61.149.49:58856] [client 45.61.149.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZHLO-y3JGHOB-Rj_FaZhAAAAEA"]
[Sun Feb 15 22:18:55.771985 2026] [:error] [pid 14577:tid 14585] [client 103.235.95.188:5212] [client 103.235.95.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.235.95.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZHVz3Tqrkuce6u39HtcjAAAAQU"]
[Sun Feb 15 22:24:40.875919 2026] [:error] [pid 19652:tid 19670] [client 103.235.95.188:44362] [client 103.235.95.188] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aZHXKDHg2T9K5fiyOL8vxQAAABA"]
[Sun Feb 15 22:26:51.555153 2026] [:error] [pid 35497:tid 35538] [client 103.235.95.188:15018] [client 103.235.95.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.235.95.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZHXq8yqpfYzoxiskhuiMAAAAMs"]
[Sun Feb 15 22:27:48.168443 2026] [:error] [pid 19652:tid 19672] [client 47.253.193.141:53746] [client 47.253.193.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.253.193.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZHX5DHg2T9K5fiyOL8wVQAAABI"]
[Sun Feb 15 22:28:01.361294 2026] [:error] [pid 35560:tid 35635] [client 129.204.9.155:41338] [client 129.204.9.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.204.9.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZHX8QZSChHPc3occZ5cigAAAxI"]
[Sun Feb 15 22:28:06.803428 2026] [:error] [pid 42754:tid 42822] [client 45.118.151.91:63440] [client 45.118.151.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.118.151.91, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZHX9uiCZrZWT4BVy13yIgAAA8g"]
[Sun Feb 15 22:28:11.339289 2026] [:error] [pid 42754:tid 42836] [client 160.250.227.36:36674] [client 160.250.227.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.227.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZHX--iCZrZWT4BVy13yJAAAA9Y"]
[Sun Feb 15 22:28:15.874799 2026] [:error] [pid 42752:tid 42769] [client 103.235.95.188:48464] [client 103.235.95.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.235.95.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZHX_8ClY05C-Gq9l0h2uQAAAso"]
[Sun Feb 15 22:29:44.670648 2026] [:error] [pid 35557:tid 35579] [client 103.235.95.188:56660] [client 103.235.95.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.235.95.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZHYWMI4REuGME4xEbNmOwAAAlA"]
[Sun Feb 15 22:31:12.370435 2026] [:error] [pid 31679:tid 31728] [client 103.235.95.188:38420] [client 103.235.95.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.235.95.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZHYsBz9Q_0Eh7M-Xr3a6QAAAhM"]
[Mon Feb 16 04:48:51.353024 2026] [:error] [pid 4455:tid 4469] [client 62.192.188.82:56114] [client 62.192.188.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.192.188.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZIxMwNa-4dvQCL0rupXrQAAAMw"]
[Mon Feb 16 04:48:51.838621 2026] [:error] [pid 37004:tid 37025] [client 118.190.217.51:52220] [client 118.190.217.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.190.217.51, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZIxM1XWqA9gxE5oGmb0sgAAARM"]
[Mon Feb 16 04:48:54.718000 2026] [:error] [pid 4348:tid 4396] [client 103.69.96.39:45898] [client 103.69.96.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.69.96.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZIxNnxbK-cCGKg9aytmOAAAAEE"]
[Mon Feb 16 04:49:01.419873 2026] [:error] [pid 4349:tid 4444] [client 121.43.140.64:51606] [client 121.43.140.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.43.140.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZIxPcrbZYafUL_3QfzffQAAAJY"]
[Mon Feb 16 04:49:47.619777 2026] [:error] [pid 4347:tid 4382] [client 121.40.46.168:43904] [client 121.40.46.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.40.46.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZIxazFcjv6pEAnSEieF_QAAAA4"]
[Mon Feb 16 04:50:02.830490 2026] [:error] [pid 37004:tid 37029] [client 139.196.149.77:50138] [client 139.196.149.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.196.149.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZIxelXWqA9gxE5oGmb1BgAAARc"]
[Mon Feb 16 04:50:31.693105 2026] [:error] [pid 4455:tid 4480] [client 217.154.179.111:34818] [client 217.154.179.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.154.179.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZIxlwNa-4dvQCL0rupYKwAAANc"]
[Mon Feb 16 06:17:01.439390 2026] [:error] [pid 37004:tid 37023] [client 117.62.235.53:41658] [client 117.62.235.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZJF3VXWqA9gxE5oGmYftwAAARE"]
[Mon Feb 16 09:43:47.453000 2026] [:error] [pid 38888:tid 38909] [client 47.117.113.64:57840] [client 47.117.113.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.117.113.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZJ2U6mDoBJWPvV4pcNx8AAAAVI"]
[Mon Feb 16 09:44:06.645682 2026] [:error] [pid 4348:tid 4395] [client 167.172.67.131:42256] [client 167.172.67.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.67.131, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZJ2ZnxbK-cCGKg9ayvV0wAAAEA"]
[Mon Feb 16 09:44:23.542881 2026] [:error] [pid 4455:tid 4458] [client 47.117.113.64:59144] [client 47.117.113.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.117.113.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZJ2dwNa-4dvQCL0rurTwAAAAME"]
[Mon Feb 16 09:44:42.847976 2026] [:error] [pid 4348:tid 4399] [client 8.8.246.21:27597] [client 8.8.246.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.8.246.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZJ2inxbK-cCGKg9ayvWFAAAAEQ"]
[Mon Feb 16 09:44:52.683821 2026] [:error] [pid 4348:tid 4417] [client 121.40.46.168:40114] [client 121.40.46.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.40.46.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZJ2lHxbK-cCGKg9ayvWJwAAAFY"]
[Mon Feb 16 09:45:47.165805 2026] [:error] [pid 37004:tid 37024] [client 202.95.15.60:47454] [client 202.95.15.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.95.15.60, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZJ2y1XWqA9gxE5oGmZ9RQAAARI"]
[Mon Feb 16 11:41:39.683713 2026] [:error] [pid 4455:tid 4468] [client 43.130.100.35:41030] [client 43.130.100.35] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZKR8wNa-4dvQCL0rur5bgAAAMs"]
[Mon Feb 16 14:19:44.409069 2026] [:error] [pid 26648:tid 26656] [client 121.40.46.168:32922] [client 121.40.46.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.40.46.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZK3ADT55fUixS3gmyitkgAAAYM"]
[Mon Feb 16 14:20:08.007855 2026] [:error] [pid 4349:tid 4434] [client 47.236.10.255:36462] [client 47.236.10.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.236.10.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZK3GMrbZYafUL_3QfyZAwAAAIw"]
[Mon Feb 16 14:21:32.286773 2026] [:error] [pid 4347:tid 4377] [client 62.234.219.29:55300] [client 62.234.219.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.234.219.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZK3bDFcjv6pEAnSEidJVQAAAAk"]
[Mon Feb 16 16:14:22.646886 2026] [:error] [pid 38888:tid 38908] [client 185.193.89.22:36826] [client 185.193.89.22] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aZLR3qmDoBJWPvV4pcMNSQAAAVE"]
[Mon Feb 16 19:37:04.961065 2026] [:error] [pid 4349:tid 4426] [client 160.250.227.36:57204] [client 160.250.227.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.227.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZMBYMrbZYafUL_3QfzttwAAAIQ"]
[Mon Feb 16 19:37:11.970175 2026] [:error] [pid 26648:tid 26671] [client 89.43.17.214:45750] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZMBZzT55fUixS3gmygqBQAAAZI"]
[Mon Feb 16 19:37:29.277566 2026] [:error] [pid 38888:tid 38897] [client 47.82.118.63:51972] [client 47.82.118.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.82.118.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZMBeamDoBJWPvV4pcNLMgAAAUY"]
[Mon Feb 16 19:38:17.509805 2026] [:error] [pid 38888:tid 38895] [client 45.118.151.91:49562] [client 45.118.151.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.118.151.91, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZMBqamDoBJWPvV4pcNLZQAAAUQ"]
[Mon Feb 16 19:38:33.791326 2026] [:error] [pid 4347:tid 4377] [client 47.106.140.4:33474] [client 47.106.140.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.106.140.4, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZMBuTFcjv6pEAnSEie4KQAAAAk"]
[Mon Feb 16 19:38:39.969386 2026] [:error] [pid 38888:tid 38896] [client 121.40.46.168:54874] [client 121.40.46.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.40.46.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZMBv6mDoBJWPvV4pcNLhAAAAUU"]
[Mon Feb 16 23:07:15.009316 2026] [:error] [pid 4455:tid 4467] [client 43.157.179.227:44274] [client 43.157.179.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZMyowNa-4dvQCL0ruq1QgAAAMo"]
[Tue Feb 17 00:37:17.779673 2026] [:error] [pid 34932:tid 34958] [client 142.93.83.180:58126] [client 142.93.83.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.93.83.180, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZNHvUKCWyYIg5P1IPfDsAAAAhM"]
[Tue Feb 17 00:37:17.934110 2026] [:error] [pid 4347:tid 4388] [client 121.43.140.64:53992] [client 121.43.140.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.43.140.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZNHvTFcjv6pEAnSEich5QAAABQ"]
[Tue Feb 17 00:37:18.946739 2026] [:error] [pid 26648:tid 26662] [client 160.250.227.36:51426] [client 160.250.227.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.227.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZNHvjT55fUixS3gmyh4yAAAAYk"]
[Tue Feb 17 00:37:24.960363 2026] [:error] [pid 4347:tid 4369] [client 129.204.9.155:56606] [client 129.204.9.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.204.9.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZNHxDFcjv6pEAnSEich_AAAAAE"]
[Tue Feb 17 03:15:36.929111 2026] [:error] [pid 26648:tid 26655] [client 156.239.210.234:36028] [client 156.239.210.234] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.210.234, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZNs2DT55fUixS3gmyiTRwAAAYI"]
[Tue Feb 17 03:15:38.967434 2026] [:error] [pid 4455:tid 4469] [client 156.239.215.135:49572] [client 156.239.215.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.215.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZNs2gNa-4dvQCL0rurlAAAAAMw"], referer: http://expressinteriors.com/wp-login.php
[Tue Feb 17 03:15:41.202153 2026] [:error] [pid 4347:tid 4389] [client 156.242.51.123:54314] [client 156.242.51.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aZNs3TFcjv6pEAnSEidM2wAAABU"]
[Tue Feb 17 03:15:42.688674 2026] [:error] [pid 34932:tid 34962] [client 45.206.73.71:57638] [client 45.206.73.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.206.73.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZNs3kKCWyYIg5P1IPfcOgAAAhc"], referer: https://expressinteriors.com/wp-login.php
[Tue Feb 17 03:15:42.691919 2026] [:error] [pid 34932:tid 34962] [client 45.206.73.71:57638] [client 45.206.73.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZNs3kKCWyYIg5P1IPfcOgAAAhc"], referer: https://expressinteriors.com/wp-login.php
[Tue Feb 17 03:15:44.193648 2026] [:error] [pid 38888:tid 38912] [client 156.239.214.38:52264] [client 156.239.214.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.214.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZNs4KmDoBJWPvV4pcOzhgAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Tue Feb 17 03:15:44.196880 2026] [:error] [pid 38888:tid 38912] [client 156.239.214.38:52264] [client 156.239.214.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZNs4KmDoBJWPvV4pcOzhgAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Tue Feb 17 03:15:46.173230 2026] [:error] [pid 4347:tid 4374] [client 156.239.201.205:38960] [client 156.239.201.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.201.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZNs4jFcjv6pEAnSEidM5gAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Tue Feb 17 03:15:46.176192 2026] [:error] [pid 4347:tid 4374] [client 156.239.201.205:38960] [client 156.239.201.205] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZNs4jFcjv6pEAnSEidM5gAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Tue Feb 17 03:15:47.782132 2026] [:error] [pid 34933:tid 34983] [client 156.239.208.251:32816] [client 156.239.208.251] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.208.251, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZNs48ubrqI4iEJPNFmbEAAAAlE"], referer: https://expressinteriors.com/wp-login.php
[Tue Feb 17 03:15:47.785609 2026] [:error] [pid 34933:tid 34983] [client 156.239.208.251:32816] [client 156.239.208.251] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZNs48ubrqI4iEJPNFmbEAAAAlE"], referer: https://expressinteriors.com/wp-login.php
[Tue Feb 17 03:15:49.086941 2026] [:error] [pid 34932:tid 34941] [client 154.82.150.59:25162] [client 154.82.150.59] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.82.150.59, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZNs5UKCWyYIg5P1IPfcPwAAAgI"], referer: https://expressinteriors.com/wp-login.php
[Tue Feb 17 03:15:49.090354 2026] [:error] [pid 34932:tid 34941] [client 154.82.150.59:25162] [client 154.82.150.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZNs5UKCWyYIg5P1IPfcPwAAAgI"], referer: https://expressinteriors.com/wp-login.php
[Tue Feb 17 03:29:20.751330 2026] [:error] [pid 4347:tid 4378] [client 20.205.120.43:3273] [client 20.205.120.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.205.120.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZNwEDFcjv6pEAnSEidRRwAAAAo"]
[Tue Feb 17 03:29:34.768978 2026] [:error] [pid 4347:tid 4381] [client 20.205.120.43:3273] [client 20.205.120.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aZNwHjFcjv6pEAnSEidRWgAAAA0"]
[Tue Feb 17 03:29:35.268683 2026] [:error] [pid 4349:tid 4441] [client 20.205.120.43:6621] [client 20.205.120.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aZNwH8rbZYafUL_3QfxcLwAAAJM"]
[Tue Feb 17 03:29:35.749378 2026] [:error] [pid 35004:tid 35010] [client 20.205.120.43:8261] [client 20.205.120.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aZNwH2X1hIIv5l_K_OukEgAAAoQ"]
[Tue Feb 17 03:29:36.229564 2026] [:error] [pid 34932:tid 34961] [client 20.205.120.43:6651] [client 20.205.120.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aZNwIEKCWyYIg5P1IPfetgAAAhY"]
[Tue Feb 17 04:43:51.927930 2026] [:error] [pid 58558:tid 58622] [client 20.111.44.121:34236] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zz.php"] [unique_id "aZOBhymIxlfUL2nViZyUwgAAAIA"]
[Tue Feb 17 04:43:52.707219 2026] [:error] [pid 58552:tid 58604] [client 20.111.44.121:30512] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zz.php"] [unique_id "aZOBiDBHVJP2Oz3yR5fGjgAAAEk"]
[Tue Feb 17 04:43:55.215879 2026] [:error] [pid 58659:tid 58665] [client 20.111.44.121:44953] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zz.php"] [unique_id "aZOBi8DX32iTEO4jt2_JJAAAAMQ"]
[Tue Feb 17 04:44:19.127396 2026] [:error] [pid 58558:tid 58643] [client 20.111.44.121:20405] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aZOBoymIxlfUL2nViZyU3AAAAJU"]
[Tue Feb 17 04:44:24.729276 2026] [:error] [pid 32790:tid 32799] [client 20.111.44.121:16174] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aZOBqHs3HJP9ozPHsN6tQQAAAQU"]
[Tue Feb 17 04:44:27.036563 2026] [:error] [pid 58552:tid 58618] [client 20.111.44.121:10775] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aZOBqzBHVJP2Oz3yR5fGtAAAAFc"]
[Tue Feb 17 04:44:28.325401 2026] [:error] [pid 58558:tid 58639] [client 20.111.44.121:5889] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aZOBrCmIxlfUL2nViZyU7AAAAJE"]
[Tue Feb 17 04:44:30.690570 2026] [:error] [pid 32790:tid 32796] [client 20.111.44.121:5911] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tanjiro.php"] [unique_id "aZOBrns3HJP9ozPHsN6tTwAAAQI"]
[Tue Feb 17 04:44:33.011177 2026] [:error] [pid 58659:tid 58667] [client 20.111.44.121:28676] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tanjiro.php"] [unique_id "aZOBscDX32iTEO4jt2_JegAAAMY"]
[Tue Feb 17 04:44:37.824614 2026] [:error] [pid 58551:tid 58564] [client 20.111.44.121:24442] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tanjiro.php"] [unique_id "aZOBta1t8eWr-MgFsppLfQAAAAQ"]
[Tue Feb 17 04:44:40.841224 2026] [:error] [pid 32790:tid 32809] [client 20.111.44.121:10856] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tanjiro.php"] [unique_id "aZOBuHs3HJP9ozPHsN6tZQAAAQ8"]
[Tue Feb 17 04:44:43.292861 2026] [:error] [pid 58558:tid 58642] [client 20.111.44.121:50209] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up.php"] [unique_id "aZOBuymIxlfUL2nViZyU_QAAAJQ"]
[Tue Feb 17 04:44:46.120809 2026] [:error] [pid 58551:tid 58567] [client 20.111.44.121:22390] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up.php"] [unique_id "aZOBvq1t8eWr-MgFsppLgwAAAAc"]
[Tue Feb 17 04:45:05.732241 2026] [:error] [pid 58659:tid 58676] [client 20.111.44.121:24343] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ztv.php"] [unique_id "aZOB0cDX32iTEO4jt2_JoQAAAM8"]
[Tue Feb 17 04:45:15.072297 2026] [:error] [pid 58551:tid 58570] [client 20.111.44.121:46617] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ztv.php"] [unique_id "aZOB261t8eWr-MgFsppLrAAAAAo"]
[Tue Feb 17 04:45:20.817847 2026] [:error] [pid 58659:tid 58685] [client 20.111.44.121:9315] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ztv.php"] [unique_id "aZOB4MDX32iTEO4jt2_JsAAAANg"]
[Tue Feb 17 04:45:22.960379 2026] [:error] [pid 58659:tid 58673] [client 20.111.44.121:22283] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aZOB4sDX32iTEO4jt2_JtQAAAMw"]
[Tue Feb 17 04:45:24.694587 2026] [:error] [pid 58551:tid 58577] [client 20.111.44.121:30555] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aZOB5K1t8eWr-MgFsppLvAAAABE"]
[Tue Feb 17 04:45:30.025116 2026] [:error] [pid 58558:tid 58640] [client 20.111.44.121:31030] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aZOB6imIxlfUL2nViZyVWgAAAJI"]
[Tue Feb 17 04:45:30.897736 2026] [:error] [pid 32790:tid 32809] [client 20.111.44.121:45918] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bras.php"] [unique_id "aZOB6ns3HJP9ozPHsN6tuAAAAQ8"]
[Tue Feb 17 04:45:32.127598 2026] [:error] [pid 58558:tid 58628] [client 20.111.44.121:24766] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wziar.php"] [unique_id "aZOB7CmIxlfUL2nViZyVXwAAAIY"]
[Tue Feb 17 04:45:41.117055 2026] [:error] [pid 58659:tid 58661] [client 20.111.44.121:25587] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wziar.php"] [unique_id "aZOB9cDX32iTEO4jt2_J0QAAAMA"]
[Tue Feb 17 04:45:42.482441 2026] [:error] [pid 32790:tid 32817] [client 20.111.44.121:21124] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wziar.php"] [unique_id "aZOB9ns3HJP9ozPHsN6tzgAAARc"]
[Tue Feb 17 04:45:48.259874 2026] [:error] [pid 58551:tid 58581] [client 20.111.44.121:7967] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpup.php"] [unique_id "aZOB_K1t8eWr-MgFsppL2wAAABU"]
[Tue Feb 17 04:45:54.446419 2026] [:error] [pid 32790:tid 32817] [client 20.111.44.121:21138] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpup.php"] [unique_id "aZOCAns3HJP9ozPHsN6t5QAAARc"]
[Tue Feb 17 04:46:22.956470 2026] [:error] [pid 58659:tid 58684] [client 20.111.44.121:6141] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xse25.php"] [unique_id "aZOCHsDX32iTEO4jt2_KEAAAANc"]
[Tue Feb 17 04:46:28.109795 2026] [:error] [pid 58551:tid 58562] [client 20.111.44.121:33213] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xse25.php"] [unique_id "aZOCJK1t8eWr-MgFsppMCAAAAAI"]
[Tue Feb 17 04:46:56.525973 2026] [:error] [pid 58551:tid 58574] [client 20.111.44.121:32622] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf9.php"] [unique_id "aZOCQK1t8eWr-MgFsppMLQAAAA4"]
[Tue Feb 17 04:47:02.621423 2026] [:error] [pid 58659:tid 58664] [client 20.111.44.121:16591] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf9.php"] [unique_id "aZOCRsDX32iTEO4jt2_KbAAAAMM"]
[Tue Feb 17 04:47:05.910138 2026] [:error] [pid 32790:tid 32807] [client 20.111.44.121:47416] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "aZOCSXs3HJP9ozPHsN6uYgAAAQ0"]
[Tue Feb 17 04:47:09.088600 2026] [:error] [pid 58551:tid 58575] [client 20.111.44.121:18449] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "aZOCTa1t8eWr-MgFsppMNQAAAA8"]
[Tue Feb 17 04:47:14.067798 2026] [:error] [pid 58558:tid 58643] [client 20.111.44.121:10494] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "aZOCUimIxlfUL2nViZyVzgAAAJU"]
[Tue Feb 17 04:47:19.233076 2026] [:error] [pid 58552:tid 58601] [client 20.111.44.121:48683] [client 20.111.44.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "aZOCVzBHVJP2Oz3yR5fHnQAAAEY"]
[Tue Feb 17 04:47:22.989907 2026] [autoindex:error] [pid 58558:tid 58622] [client 20.111.44.121:12692] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 17 04:51:19.490021 2026] [:error] [pid 32790:tid 32814] [client 20.238.121.35:27183] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/init.php"] [unique_id "aZODR3s3HJP9ozPHsN6w4gAAARQ"]
[Tue Feb 17 04:51:57.511064 2026] [:error] [pid 32790:tid 32817] [client 20.238.121.35:25466] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aZODbXs3HJP9ozPHsN6xIgAAARc"]
[Tue Feb 17 04:51:59.612697 2026] [:error] [pid 32790:tid 32811] [client 20.238.121.35:23271] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aZODb3s3HJP9ozPHsN6xJgAAARE"]
[Tue Feb 17 04:52:08.448882 2026] [:error] [pid 58659:tid 58668] [client 20.238.121.35:20182] [client 20.238.121.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aZODeMDX32iTEO4jt2_M1gAAAMc"]
[Tue Feb 17 04:52:26.485641 2026] [:error] [pid 32790:tid 32806] [client 20.238.121.35:25461] [client 20.238.121.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/about.php"] [unique_id "aZODins3HJP9ozPHsN6xYwAAAQw"]
[Tue Feb 17 05:20:13.688888 2026] [:error] [pid 58558:tid 58634] [client 162.62.231.139:40228] [client 162.62.231.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZOKDSmIxlfUL2nViZyh4gAAAIw"]
[Tue Feb 17 05:52:07.011633 2026] [:error] [pid 32790:tid 32817] [client 160.250.227.36:57860] [client 160.250.227.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.227.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZORh3s3HJP9ozPHsN7QrwAAARc"]
[Tue Feb 17 05:52:08.942158 2026] [:error] [pid 58659:tid 58681] [client 202.95.15.60:33700] [client 202.95.15.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.95.15.60, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZORiMDX32iTEO4jt2_n-AAAANQ"]
[Tue Feb 17 05:52:20.477800 2026] [:error] [pid 32790:tid 32807] [client 37.187.132.24:52600] [client 37.187.132.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.187.132.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZORlHs3HJP9ozPHsN7Q0AAAAQ0"]
[Tue Feb 17 05:52:42.936478 2026] [:error] [pid 58551:tid 58574] [client 120.46.91.85:39044] [client 120.46.91.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.46.91.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZORqq1t8eWr-MgFsppjwQAAAA4"]
[Tue Feb 17 05:52:46.769583 2026] [:error] [pid 32790:tid 32808] [client 134.209.95.224:41296] [client 134.209.95.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.209.95.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZORrns3HJP9ozPHsN7REQAAAQ4"]
[Tue Feb 17 05:52:54.392781 2026] [:error] [pid 58659:tid 58672] [client 134.209.95.224:33284] [client 134.209.95.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.209.95.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZORtsDX32iTEO4jt2_oWgAAAMs"]
[Tue Feb 17 05:53:17.356601 2026] [:error] [pid 58552:tid 58615] [client 118.190.217.51:48736] [client 118.190.217.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.190.217.51, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZORzTBHVJP2Oz3yR5fhJQAAAFQ"]
[Tue Feb 17 09:00:53.023512 2026] [:error] [pid 32790:tid 32807] [client 170.106.160.90:40530] [client 170.106.160.90] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZO9xXs3HJP9ozPHsN5ILwAAAQ0"]
[Tue Feb 17 10:20:09.409164 2026] [:error] [pid 58659:tid 58685] [client 158.158.33.103:37281] [client 158.158.33.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-k3w6g9s4h2.php"] [unique_id "aZPQWcDX32iTEO4jt29yYQAAANg"]
[Tue Feb 17 10:20:20.539928 2026] [:error] [pid 58659:tid 58680] [client 158.158.33.103:41181] [client 158.158.33.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-k3w6g9s4h2.php"] [unique_id "aZPQZMDX32iTEO4jt29ycAAAANM"]
[Tue Feb 17 10:20:21.994593 2026] [:error] [pid 58551:tid 58563] [client 158.158.33.103:14266] [client 158.158.33.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-k3w6g9s4h2.php"] [unique_id "aZPQZa1t8eWr-MgFsprX7gAAAAM"]
[Tue Feb 17 10:20:27.293371 2026] [:error] [pid 32790:tid 32800] [client 158.158.33.103:24724] [client 158.158.33.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ahax.php"] [unique_id "aZPQa3s3HJP9ozPHsN57MQAAAQY"]
[Tue Feb 17 10:20:32.469674 2026] [:error] [pid 58558:tid 58629] [client 158.158.33.103:41955] [client 158.158.33.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ahax.php"] [unique_id "aZPQcCmIxlfUL2nViZwo-wAAAIc"]
[Tue Feb 17 10:20:35.149338 2026] [:error] [pid 58551:tid 58570] [client 158.158.33.103:44783] [client 158.158.33.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ahax.php"] [unique_id "aZPQc61t8eWr-MgFsprX9wAAAAo"]
[Tue Feb 17 10:21:29.133370 2026] [:error] [pid 32790:tid 32807] [client 158.158.33.103:42349] [client 158.158.33.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/about.php"] [unique_id "aZPQqXs3HJP9ozPHsN57wwAAAQ0"]
[Tue Feb 17 10:23:59.819923 2026] [:error] [pid 58552:tid 58599] [client 129.204.9.155:33222] [client 129.204.9.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.204.9.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZPRPzBHVJP2Oz3yR5dXewAAAEQ"]
[Tue Feb 17 10:25:01.300838 2026] [:error] [pid 58659:tid 58682] [client 47.82.118.63:48212] [client 47.82.118.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.82.118.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZPRfcDX32iTEO4jt290sgAAANU"]
[Tue Feb 17 10:25:17.421665 2026] [:error] [pid 32790:tid 32794] [client 199.188.200.121:33710] [client 199.188.200.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 199.188.200.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZPRjXs3HJP9ozPHsN5-NgAAAQA"]
[Tue Feb 17 10:25:21.871611 2026] [:error] [pid 32790:tid 32816] [client 47.98.255.122:42304] [client 47.98.255.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.98.255.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZPRkXs3HJP9ozPHsN5-QgAAARY"]
[Tue Feb 17 10:25:47.568626 2026] [:error] [pid 58552:tid 58618] [client 198.54.114.54:43140] [client 198.54.114.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZPRqzBHVJP2Oz3yR5dYQwAAAFc"]
[Tue Feb 17 10:26:09.011251 2026] [:error] [pid 58551:tid 58562] [client 103.212.121.158:64926] [client 103.212.121.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.212.121.158, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZPRwa1t8eWr-MgFspraNAAAAAI"]
[Tue Feb 17 11:28:32.961134 2026] [:error] [pid 58659:tid 58665] [client 43.155.129.131:44614] [client 43.155.129.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZPgYMDX32iTEO4jt2-UIwAAAMQ"]
[Tue Feb 17 12:20:08.215998 2026] [:error] [pid 58552:tid 58601] [client 167.71.244.81:62732] [client 167.71.244.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/profile-builder/readme.txt"] [unique_id "aZPseDBHVJP2Oz3yR5eG4QAAAEY"]
[Tue Feb 17 13:19:50.009464 2026] [:error] [pid 32790:tid 32794] [client 106.54.62.156:39960] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZP6dns3HJP9ozPHsN7lvgAAAQA"]
[Tue Feb 17 14:55:27.759006 2026] [:error] [pid 58558:tid 58629] [client 43.166.226.57:60542] [client 43.166.226.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZQQ3ymIxlfUL2nViZyd2AAAAIc"]
[Tue Feb 17 15:20:53.973240 2026] [:error] [pid 58558:tid 58641] [client 45.118.151.91:64291] [client 45.118.151.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.118.151.91, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZQW1SmIxlfUL2nViZymvQAAAJM"]
[Tue Feb 17 15:20:58.814289 2026] [:error] [pid 58659:tid 58665] [client 160.250.227.36:37606] [client 160.250.227.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.250.227.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZQW2sDX32iTEO4jt28BKAAAAMQ"]
[Tue Feb 17 15:21:29.173990 2026] [:error] [pid 58659:tid 58671] [client 31.177.95.217:38086] [client 31.177.95.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.177.95.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZQW-cDX32iTEO4jt28BpQAAAMo"]
[Tue Feb 17 15:21:32.840055 2026] [:error] [pid 32790:tid 32797] [client 203.59.224.59:57961] [client 203.59.224.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.59.224.59, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZQW_Hs3HJP9ozPHsN4m8wAAAQM"]
[Tue Feb 17 15:21:41.425128 2026] [:error] [pid 32790:tid 32816] [client 8.140.214.189:41296] [client 8.140.214.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.140.214.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZQXBXs3HJP9ozPHsN4nCAAAARY"]
[Tue Feb 17 15:21:50.808893 2026] [:error] [pid 58552:tid 58613] [client 89.43.17.214:51338] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZQXDjBHVJP2Oz3yR5fMMwAAAFI"]
[Tue Feb 17 17:10:43.692370 2026] [:error] [pid 58659:tid 58663] [client 104.28.163.90:49598] [client 104.28.163.90] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.expressinteriors.com|F|2"] [data "TX:0=image/png"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZQwk8DX32iTEO4jt28kgwAAAMI"]
[Tue Feb 17 17:14:15.186917 2026] [:error] [pid 58552:tid 58612] [client 43.156.109.53:56678] [client 43.156.109.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZQxZzBHVJP2Oz3yR5f3-QAAAFE"]
[Tue Feb 17 17:29:59.080310 2026] [:error] [pid 58552:tid 58596] [client 134.122.188.6:60767] [client 134.122.188.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.122.188.6, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZQ1FzBHVJP2Oz3yR5f8MgAAAEE"], referer: http://www.expressinteriors.com
[Tue Feb 17 17:30:01.166499 2026] [:error] [pid 58558:tid 58622] [client 134.122.188.6:53432] [client 134.122.188.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.122.188.6, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZQ1GSmIxlfUL2nViZzOQgAAAIA"], referer: http://www.expressinteriors.com
[Tue Feb 17 17:30:01.944432 2026] [:error] [pid 58552:tid 58604] [client 134.122.188.6:63040] [client 134.122.188.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.122.188.6, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZQ1GTBHVJP2Oz3yR5f8NQAAAEk"], referer: http://www.expressinteriors.com
[Tue Feb 17 17:30:03.677758 2026] [:error] [pid 58659:tid 58663] [client 134.122.188.6:64699] [client 134.122.188.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.122.188.6, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZQ1G8DX32iTEO4jt28qEwAAAMI"], referer: http://www.expressinteriors.com
[Tue Feb 17 17:30:15.565180 2026] [:error] [pid 58558:tid 58630] [client 134.122.188.6:62555] [client 134.122.188.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.122.188.6, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZQ1JymIxlfUL2nViZzOVAAAAIg"], referer: http://www.expressinteriors.com
[Tue Feb 17 17:30:17.283691 2026] [:error] [pid 32790:tid 32794] [client 134.122.188.6:50480] [client 134.122.188.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.122.188.6, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZQ1KXs3HJP9ozPHsN5PygAAAQA"], referer: http://www.expressinteriors.com
[Tue Feb 17 17:30:18.070741 2026] [:error] [pid 32790:tid 32807] [client 134.122.188.6:54666] [client 134.122.188.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.122.188.6, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZQ1Kns3HJP9ozPHsN5PzAAAAQ0"], referer: http://www.expressinteriors.com
[Tue Feb 17 17:30:19.812591 2026] [:error] [pid 13106:tid 13119] [client 134.122.188.6:65295] [client 134.122.188.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.122.188.6, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZQ1K7BEWrYCV-0FRdrojAAAAUk"], referer: http://www.expressinteriors.com
[Tue Feb 17 17:43:08.836487 2026] [:error] [pid 58551:tid 58580] [client 220.86.211.1:55230] [client 220.86.211.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 220.86.211.1, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZQ4LK1t8eWr-MgFsppztgAAABQ"], referer: https://expressinteriors.com/wp-login.php
[Tue Feb 17 17:43:09.956536 2026] [:error] [pid 58551:tid 58577] [client 220.86.211.1:55230] [client 220.86.211.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 220.86.211.1, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZQ4La1t8eWr-MgFsppzvAAAABE"], referer: http://milsarl-drc.com/wp-login.php
[Tue Feb 17 19:14:49.773464 2026] [:error] [pid 58558:tid 58634] [client 199.188.199.61:59824] [client 199.188.199.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 199.188.199.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZRNqSmIxlfUL2nViZzn7QAAAIw"]
[Tue Feb 17 19:15:18.327266 2026] [:error] [pid 58551:tid 58561] [client 52.238.252.162:2368] [client 52.238.252.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.238.252.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZRNxq1t8eWr-MgFspqOsQAAAAE"]
[Tue Feb 17 19:15:32.268484 2026] [:error] [pid 58551:tid 58575] [client 62.234.219.29:55264] [client 62.234.219.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.234.219.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZRN1K1t8eWr-MgFspqPGAAAAA8"]
[Tue Feb 17 19:29:23.784048 2026] [:error] [pid 58558:tid 58646] [client 36.41.75.167:44806] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZRREymIxlfUL2nViZzq9wAAAJg"]
[Tue Feb 17 23:07:48.769900 2026] [:error] [pid 2575:tid 2597] [client 198.54.114.54:47182] [client 198.54.114.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZSERM0nHzM9JGTFE56QPQAAAdQ"]
[Tue Feb 17 23:07:55.962745 2026] [:error] [pid 2727:tid 2743] [client 89.43.17.214:60836] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZSESyIYJerZs7d7DPuiXQAAAo4"]
[Tue Feb 17 23:08:23.161720 2026] [:error] [pid 58551:tid 58574] [client 129.146.65.146:43062] [client 129.146.65.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.146.65.146, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZSEZ61t8eWr-MgFsprVLgAAAA4"]
[Tue Feb 17 23:09:21.730045 2026] [:error] [pid 58659:tid 58661] [client 136.111.10.47:59578] [client 136.111.10.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.111.10.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZSEocDX32iTEO4jt29s2AAAAMA"]
[Tue Feb 17 23:09:26.689959 2026] [:error] [pid 2605:tid 2617] [client 159.89.182.203:60552] [client 159.89.182.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.182.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZSEphliizaiVjfuA2CdOQAAAgk"]
[Wed Feb 18 02:52:21.972217 2026] [:error] [pid 58552:tid 58605] [client 163.44.193.130:52200] [client 163.44.193.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.44.193.130, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZS45TBHVJP2Oz3yR5eNhQAAAEo"]
[Wed Feb 18 02:52:26.898345 2026] [:error] [pid 58552:tid 58608] [client 34.69.68.107:52484] [client 34.69.68.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.68.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZS46jBHVJP2Oz3yR5eNjgAAAE0"]
[Wed Feb 18 02:52:27.711612 2026] [:error] [pid 2606:tid 2640] [client 47.98.255.122:50696] [client 47.98.255.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.98.255.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZS461FV84PnUA8QSAjtcgAAAkU"]
[Wed Feb 18 02:52:35.302390 2026] [:error] [pid 58552:tid 58598] [client 163.44.193.130:53206] [client 163.44.193.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.44.193.130, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZS48zBHVJP2Oz3yR5eNkwAAAEM"]
[Wed Feb 18 02:52:38.222839 2026] [:error] [pid 13106:tid 13121] [client 31.177.95.217:39800] [client 31.177.95.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.177.95.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZS49rBEWrYCV-0FRdp0GgAAAUs"]
[Wed Feb 18 02:53:16.980864 2026] [:error] [pid 2727:tid 2729] [client 191.6.210.119:51798] [client 191.6.210.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.6.210.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZS5HCIYJerZs7d7DPvHZgAAAoA"]
[Wed Feb 18 02:53:25.717836 2026] [:error] [pid 2606:tid 2646] [client 198.54.114.36:50604] [client 198.54.114.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.54.114.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZS5JVFV84PnUA8QSAjtjwAAAks"]
[Wed Feb 18 02:53:31.441097 2026] [:error] [pid 13106:tid 13124] [client 203.59.224.59:49536] [client 203.59.224.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.59.224.59, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZS5K7BEWrYCV-0FRdp0RQAAAU4"]
[Wed Feb 18 02:54:35.230348 2026] [:error] [pid 2606:tid 2655] [client 8.8.246.21:29590] [client 8.8.246.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.8.246.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZS5a1FV84PnUA8QSAjtvQAAAlQ"]
[Wed Feb 18 04:47:47.988857 2026] [:error] [pid 21847:tid 21869] [client 49.51.183.220:39708] [client 49.51.183.220] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZTT8_y9A5wy4LuXmJ2j0wAAAAs"]
[Wed Feb 18 05:38:51.258520 2026] [:error] [pid 57014:tid 57029] [client 47.82.118.63:34946] [client 47.82.118.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.82.118.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZTf6xNZnhS5qKtVIMLzVAAAAQw"]
[Wed Feb 18 05:38:55.311403 2026] [:error] [pid 21961:tid 21971] [client 34.72.233.94:52432] [client 34.72.233.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.72.233.94, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZTf78UBDt_-H0ms3gVWGAAAAMg"]
[Wed Feb 18 05:39:01.029807 2026] [:error] [pid 21848:tid 21907] [client 121.40.46.168:33744] [client 121.40.46.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.40.46.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZTf9fbG91VRkVidT5cZ6wAAAFI"]
[Wed Feb 18 05:39:08.756814 2026] [:error] [pid 21847:tid 21859] [client 47.117.113.64:59016] [client 47.117.113.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.117.113.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZTf_Py9A5wy4LuXmJ20zwAAAAE"]
[Wed Feb 18 05:39:42.613750 2026] [:error] [pid 57014:tid 57024] [client 62.192.188.82:33070] [client 62.192.188.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.192.188.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZTgHhNZnhS5qKtVIMLzngAAAQc"]
[Wed Feb 18 05:40:31.204409 2026] [:error] [pid 57014:tid 57032] [client 193.202.110.34:44010] [client 193.202.110.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.202.110.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZTgTxNZnhS5qKtVIMLz0AAAAQ8"]
[Wed Feb 18 06:19:32.741163 2026] [:error] [pid 5561:tid 5570] [client 20.43.58.61:20890] [client 20.43.58.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aZTpdEoQssCZYQ4NexboOAAAAUY"]
[Wed Feb 18 06:19:41.490700 2026] [:error] [pid 21961:tid 21987] [client 20.43.58.61:27949] [client 20.43.58.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file5.php"] [unique_id "aZTpfcUBDt_-H0ms3gVi9gAAANg"]
[Wed Feb 18 06:19:45.397649 2026] [:error] [pid 21849:tid 21936] [client 20.43.58.61:11772] [client 20.43.58.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file5.php"] [unique_id "aZTpgbx9a1XrfTYnuzJ9uQAAAJQ"]
[Wed Feb 18 06:19:53.416751 2026] [:error] [pid 21847:tid 21863] [client 20.43.58.61:27926] [client 20.43.58.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file5.php"] [unique_id "aZTpify9A5wy4LuXmJ3AawAAAAU"]
[Wed Feb 18 06:20:14.329176 2026] [:error] [pid 57014:tid 57025] [client 20.43.58.61:11766] [client 20.43.58.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file8.php"] [unique_id "aZTpnhNZnhS5qKtVIMICxwAAAQg"]
[Wed Feb 18 06:20:17.099682 2026] [:error] [pid 21961:tid 21980] [client 20.43.58.61:18058] [client 20.43.58.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file8.php"] [unique_id "aZTpocUBDt_-H0ms3gVjGgAAANE"]
[Wed Feb 18 06:20:24.046399 2026] [:error] [pid 21847:tid 21866] [client 20.43.58.61:11819] [client 20.43.58.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file8.php"] [unique_id "aZTpqPy9A5wy4LuXmJ3A1gAAAAg"]
[Wed Feb 18 06:20:26.695308 2026] [:error] [pid 5561:tid 5570] [client 20.43.58.61:18106] [client 20.43.58.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file8.php"] [unique_id "aZTpqkoQssCZYQ4NexbofwAAAUY"]
[Wed Feb 18 06:20:28.450424 2026] [:error] [pid 21848:tid 21899] [client 20.43.58.61:18057] [client 20.43.58.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file3.php"] [unique_id "aZTprPbG91VRkVidT5cn9wAAAEo"]
[Wed Feb 18 08:32:27.798969 2026] [:error] [pid 57014:tid 57019] [client 43.135.133.194:45926] [client 43.135.133.194] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZUImxNZnhS5qKtVIMI1vwAAAQI"]
[Wed Feb 18 08:50:04.084957 2026] [:error] [pid 21961:tid 21967] [client 45.67.97.52:41161] [client 45.67.97.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.wp/wso.php"] [unique_id "aZUMvMUBDt_-H0ms3gWYdwAAAMQ"]
[Wed Feb 18 10:42:46.767240 2026] [:error] [pid 21848:tid 21904] [client 165.245.187.140:54152] [client 165.245.187.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/profile-builder/readme.txt"] [unique_id "aZUnJvbG91VRkVidT5eJ0wAAAE8"]
[Wed Feb 18 10:58:54.504612 2026] [:error] [pid 21848:tid 21894] [client 43.155.73.192:54042] [client 43.155.73.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.155.73.192, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZUq7vbG91VRkVidT5ePSwAAAEU"]
[Wed Feb 18 10:59:14.395168 2026] [:error] [pid 5561:tid 5564] [client 134.209.95.224:50044] [client 134.209.95.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.209.95.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZUrAkoQssCZYQ4NexZA5AAAAUA"]
[Wed Feb 18 10:59:44.453878 2026] [:error] [pid 57014:tid 57018] [client 211.149.225.141:36048] [client 211.149.225.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.149.225.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZUrIBNZnhS5qKtVIMJwrwAAAQE"]
[Wed Feb 18 10:59:56.120607 2026] [:error] [pid 21849:tid 21924] [client 34.63.234.26:38928] [client 34.63.234.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.63.234.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZUrLLx9a1XrfTYnuzLY9QAAAIg"]
[Wed Feb 18 11:00:24.105030 2026] [:error] [pid 57014:tid 57022] [client 89.43.17.214:37002] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZUrSBNZnhS5qKtVIMJw3AAAAQU"]
[Wed Feb 18 11:00:31.722823 2026] [:error] [pid 5561:tid 5566] [client 184.168.120.235:45606] [client 184.168.120.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.120.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZUrT0oQssCZYQ4NexZBXgAAAUI"]
[Wed Feb 18 12:12:08.127993 2026] [:error] [pid 21847:tid 21875] [client 129.146.65.146:52550] [client 129.146.65.146] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.146.65.146, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZU8GPy9A5wy4LuXmJ11fAAAABE"]
[Wed Feb 18 12:12:08.431585 2026] [:error] [pid 21849:tid 21932] [client 199.188.199.61:47248] [client 199.188.199.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 199.188.199.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZU8GLx9a1XrfTYnuzLwQwAAAJA"]
[Wed Feb 18 12:12:17.164982 2026] [:error] [pid 21848:tid 21913] [client 35.192.100.98:43164] [client 35.192.100.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.192.100.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZU8IfbG91VRkVidT5eqAQAAAFg"]
[Wed Feb 18 12:12:22.334599 2026] [:error] [pid 5561:tid 5588] [client 47.82.118.63:43542] [client 47.82.118.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.82.118.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZU8JkoQssCZYQ4NexZXcwAAAVg"]
[Wed Feb 18 12:12:27.137445 2026] [:error] [pid 5561:tid 5579] [client 203.59.224.59:56508] [client 203.59.224.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.59.224.59, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZU8K0oQssCZYQ4NexZXjAAAAU8"]
[Wed Feb 18 12:12:35.290674 2026] [:error] [pid 5561:tid 5584] [client 203.59.224.59:56805] [client 203.59.224.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.59.224.59, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZU8M0oQssCZYQ4NexZXmwAAAVQ"]
[Wed Feb 18 12:12:36.308557 2026] [:error] [pid 57014:tid 57038] [client 184.168.120.235:56844] [client 184.168.120.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.120.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZU8NBNZnhS5qKtVIMKM6QAAARU"]
[Wed Feb 18 14:19:50.589346 2026] [:error] [pid 21847:tid 21869] [client 182.42.111.213:48816] [client 182.42.111.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZVaBvy9A5wy4LuXmJ2q_AAAAAs"]
[Wed Feb 18 14:26:37.795819 2026] [:error] [pid 21961:tid 21981] [client 47.82.118.63:47982] [client 47.82.118.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.82.118.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZVbncUBDt_-H0ms3gUoagAAANI"]
[Wed Feb 18 14:26:59.838327 2026] [:error] [pid 21849:tid 21930] [client 8.156.67.207:51762] [client 8.156.67.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.156.67.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZVbs7x9a1XrfTYnuzIbpgAAAI4"]
[Wed Feb 18 14:27:05.330777 2026] [:error] [pid 21848:tid 21895] [client 195.210.46.49:13936] [client 195.210.46.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.210.46.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZVbufbG91VRkVidT5fXiAAAAEY"]
[Wed Feb 18 14:27:05.517619 2026] [:error] [pid 21961:tid 21974] [client 193.202.110.33:36248] [client 193.202.110.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.202.110.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZVbucUBDt_-H0ms3gUo0AAAAMs"]
[Wed Feb 18 14:27:06.119711 2026] [:error] [pid 57014:tid 57023] [client 8.156.67.207:56338] [client 8.156.67.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.156.67.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZVbuhNZnhS5qKtVIMK8ngAAAQY"]
[Wed Feb 18 14:27:19.523063 2026] [:error] [pid 21961:tid 21970] [client 35.234.240.84:41612] [client 35.234.240.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.234.240.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZVbx8UBDt_-H0ms3gUo6QAAAMc"]
[Wed Feb 18 16:00:54.297615 2026] [:error] [pid 21849:tid 21927] [client 163.44.193.130:50378] [client 163.44.193.130] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.44.193.130, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZVxtrx9a1XrfTYnuzI4ywAAAIs"]
[Wed Feb 18 16:00:58.440645 2026] [:error] [pid 21847:tid 21870] [client 45.118.151.91:57599] [client 45.118.151.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.118.151.91, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZVxuvy9A5wy4LuXmJ3StQAAAAw"]
[Wed Feb 18 16:01:01.358516 2026] [:error] [pid 21847:tid 21859] [client 211.149.225.141:57052] [client 211.149.225.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.149.225.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZVxvfy9A5wy4LuXmJ3SwgAAAAE"]
[Wed Feb 18 16:01:06.669511 2026] [:error] [pid 21848:tid 21897] [client 31.177.95.217:45562] [client 31.177.95.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.177.95.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZVxwvbG91VRkVidT5f3KAAAAEg"]
[Wed Feb 18 16:01:12.367494 2026] [:error] [pid 5561:tid 5575] [client 34.29.14.47:36842] [client 34.29.14.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.29.14.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZVxyEoQssCZYQ4NexaetwAAAUs"]
[Wed Feb 18 16:01:23.405578 2026] [:error] [pid 21848:tid 21905] [client 59.110.143.128:43002] [client 59.110.143.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.110.143.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZVx0_bG91VRkVidT5f3PAAAAFA"]
[Wed Feb 18 18:06:37.690156 2026] [:error] [pid 21847:tid 21872] [client 45.118.151.91:61925] [client 45.118.151.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.118.151.91, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZWPLfy9A5wy4LuXmJ39mAAAAA4"]
[Wed Feb 18 18:06:41.549683 2026] [:error] [pid 57014:tid 57034] [client 122.155.171.214:34834] [client 122.155.171.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.155.171.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZWPMRNZnhS5qKtVIMIFRwAAARE"]
[Wed Feb 18 18:06:44.658438 2026] [:error] [pid 21848:tid 21894] [client 86.109.170.96:58108] [client 86.109.170.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.109.170.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZWPNPbG91VRkVidT5ccpgAAAEU"]
[Wed Feb 18 18:06:46.882508 2026] [:error] [pid 11512:tid 11517] [client 8.140.237.151:46162] [client 8.140.237.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.140.237.151, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZWPNhGamu0xQuQ-jbFBYAAAAYA"]
[Wed Feb 18 18:06:48.350932 2026] [:error] [pid 11609:tid 11662] [client 39.108.188.68:50272] [client 39.108.188.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.108.188.68, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZWPOMhm3UjgaKO2Na8YdAAAApI"]
[Wed Feb 18 18:07:30.401445 2026] [:error] [pid 5561:tid 5586] [client 35.233.218.233:33276] [client 35.233.218.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.233.218.233, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZWPYkoQssCZYQ4Nexa_SwAAAVY"]
[Wed Feb 18 18:07:33.594499 2026] [:error] [pid 11512:tid 11521] [client 89.43.17.214:43652] [client 89.43.17.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.43.17.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZWPZRGamu0xQuQ-jbFBdgAAAYQ"]
[Wed Feb 18 18:07:36.038047 2026] [:error] [pid 11611:tid 11721] [client 103.212.121.158:49786] [client 103.212.121.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.212.121.158, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZWPaO2m6IPN_aBZuKZSKgAAAxc"]
[Wed Feb 18 18:07:44.789451 2026] [:error] [pid 21847:tid 21882] [client 193.202.110.34:59368] [client 193.202.110.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.202.110.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZWPcPy9A5wy4LuXmJ3-CQAAABg"]
[Wed Feb 18 20:14:28.637046 2026] [:error] [pid 11607:tid 11619] [client 43.135.148.92:34300] [client 43.135.148.92] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZWtJBw91ggRx3FA7BfmxQAAAkQ"]
[Wed Feb 18 20:47:09.281853 2026] [:error] [pid 21848:tid 21907] [client 20.46.124.66:25160] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dom.php"] [unique_id "aZW0zfbG91VRkVidT5dD1wAAAFI"]
[Wed Feb 18 20:47:09.781507 2026] [:error] [pid 21848:tid 21896] [client 20.46.124.66:12553] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dom.php"] [unique_id "aZW0zfbG91VRkVidT5dD2QAAAEc"]
[Wed Feb 18 20:47:10.985607 2026] [:error] [pid 11611:tid 11707] [client 20.46.124.66:14163] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dom.php"] [unique_id "aZW0zu2m6IPN_aBZuKZwDAAAAwk"]
[Wed Feb 18 20:47:11.311213 2026] [:error] [pid 11609:tid 11659] [client 20.46.124.66:13581] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dom.php"] [unique_id "aZW0z8hm3UjgaKO2Na8z_wAAApA"]
[Wed Feb 18 20:47:11.665757 2026] [:error] [pid 11609:tid 11665] [client 20.46.124.66:24759] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aZW0z8hm3UjgaKO2Na80AAAAApU"]
[Wed Feb 18 20:47:12.091620 2026] [:error] [pid 5561:tid 5582] [client 20.46.124.66:25214] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aZW00EoQssCZYQ4NexbX3gAAAVI"]
[Wed Feb 18 20:47:12.465865 2026] [:error] [pid 11610:tid 11680] [client 20.46.124.66:12607] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aZW00LWMUt4MNfN7mx3R6gAAAsk"]
[Wed Feb 18 20:47:12.793718 2026] [:error] [pid 11611:tid 11706] [client 20.46.124.66:25200] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aZW00O2m6IPN_aBZuKZwDgAAAwg"]
[Wed Feb 18 20:47:13.208221 2026] [:error] [pid 57014:tid 57031] [client 20.46.124.66:24745] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/samiri.php"] [unique_id "aZW00RNZnhS5qKtVIMIzqQAAAQ4"]
[Wed Feb 18 20:47:13.820175 2026] [:error] [pid 5561:tid 5566] [client 20.46.124.66:14190] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/samiri.php"] [unique_id "aZW00UoQssCZYQ4NexbX4QAAAUI"]
[Wed Feb 18 20:47:14.556440 2026] [:error] [pid 57014:tid 57037] [client 20.46.124.66:23650] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/samiri.php"] [unique_id "aZW00hNZnhS5qKtVIMIzrAAAARQ"]
[Wed Feb 18 20:47:14.952275 2026] [:error] [pid 57014:tid 57029] [client 20.46.124.66:22468] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/samiri.php"] [unique_id "aZW00hNZnhS5qKtVIMIzrQAAAQw"]
[Wed Feb 18 20:47:15.595867 2026] [:error] [pid 21848:tid 21902] [client 20.46.124.66:22405] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins.php"] [unique_id "aZW00_bG91VRkVidT5dD3AAAAE0"]
[Wed Feb 18 20:47:15.898178 2026] [:error] [pid 11548:tid 11578] [client 20.46.124.66:22464] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins.php"] [unique_id "aZW00zSFZiBIZZvmIlMMcAAAAgA"]
[Wed Feb 18 20:47:16.465496 2026] [:error] [pid 57014:tid 57022] [client 20.46.124.66:13903] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins.php"] [unique_id "aZW01BNZnhS5qKtVIMIztQAAAQU"]
[Wed Feb 18 20:47:16.774463 2026] [:error] [pid 21848:tid 21897] [client 20.46.124.66:13586] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins.php"] [unique_id "aZW01PbG91VRkVidT5dD3QAAAEg"]
[Wed Feb 18 20:47:17.039119 2026] [:error] [pid 5561:tid 5567] [client 20.46.124.66:22469] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xoot.php"] [unique_id "aZW01UoQssCZYQ4NexbX5wAAAUM"]
[Wed Feb 18 20:47:17.314309 2026] [:error] [pid 21847:tid 21881] [client 20.46.124.66:12560] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xoot.php"] [unique_id "aZW01fy9A5wy4LuXmJ0fKgAAABc"]
[Wed Feb 18 20:47:17.665308 2026] [:error] [pid 21848:tid 21906] [client 20.46.124.66:23208] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xoot.php"] [unique_id "aZW01fbG91VRkVidT5dD3gAAAFE"]
[Wed Feb 18 20:47:17.950779 2026] [:error] [pid 11548:tid 11589] [client 20.46.124.66:24749] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xoot.php"] [unique_id "aZW01TSFZiBIZZvmIlMMcQAAAgs"]
[Wed Feb 18 20:47:18.321096 2026] [:error] [pid 5561:tid 5565] [client 20.46.124.66:22435] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X57.php"] [unique_id "aZW01koQssCZYQ4NexbX6wAAAUE"]
[Wed Feb 18 20:47:18.591671 2026] [:error] [pid 5561:tid 5574] [client 20.46.124.66:22438] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X57.php"] [unique_id "aZW01koQssCZYQ4NexbX7AAAAUo"]
[Wed Feb 18 20:47:19.001488 2026] [:error] [pid 21848:tid 21898] [client 20.46.124.66:14178] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X57.php"] [unique_id "aZW01_bG91VRkVidT5dD4QAAAEk"]
[Wed Feb 18 20:47:19.290634 2026] [:error] [pid 21848:tid 21894] [client 20.46.124.66:24732] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X57.php"] [unique_id "aZW01_bG91VRkVidT5dD5AAAAEU"]
[Wed Feb 18 20:47:19.608895 2026] [:error] [pid 21847:tid 21865] [client 20.46.124.66:13604] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aZW01_y9A5wy4LuXmJ0fLQAAAAc"]
[Wed Feb 18 20:47:20.176134 2026] [:error] [pid 21847:tid 21866] [client 20.46.124.66:23979] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aZW02Py9A5wy4LuXmJ0fLwAAAAg"]
[Wed Feb 18 20:47:20.590321 2026] [:error] [pid 21848:tid 21895] [client 20.46.124.66:14201] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aZW02PbG91VRkVidT5dD5wAAAEY"]
[Wed Feb 18 20:47:21.037200 2026] [:error] [pid 21848:tid 21899] [client 20.46.124.66:22461] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aZW02fbG91VRkVidT5dD6QAAAEo"]
[Wed Feb 18 20:47:21.782329 2026] [:error] [pid 21848:tid 21906] [client 20.46.124.66:24753] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file59.php"] [unique_id "aZW02fbG91VRkVidT5dD7AAAAFE"]
[Wed Feb 18 20:47:22.278984 2026] [:error] [pid 11609:tid 11658] [client 20.46.124.66:13933] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file59.php"] [unique_id "aZW02shm3UjgaKO2Na80BQAAAo8"]
[Wed Feb 18 20:47:22.659365 2026] [:error] [pid 21847:tid 21871] [client 20.46.124.66:12574] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file59.php"] [unique_id "aZW02vy9A5wy4LuXmJ0fMAAAAA0"]
[Wed Feb 18 20:47:22.950417 2026] [:error] [pid 21847:tid 21877] [client 20.46.124.66:14205] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file59.php"] [unique_id "aZW02vy9A5wy4LuXmJ0fMQAAABM"]
[Wed Feb 18 20:47:23.322340 2026] [:error] [pid 21848:tid 21900] [client 20.46.124.66:22235] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aZW02_bG91VRkVidT5dD8gAAAEs"]
[Wed Feb 18 20:47:24.160539 2026] [:error] [pid 21847:tid 21861] [client 20.46.124.66:24707] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aZW03Py9A5wy4LuXmJ0fNAAAAAM"]
[Wed Feb 18 20:47:24.498702 2026] [:error] [pid 11607:tid 11627] [client 20.46.124.66:24725] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aZW03Bw91ggRx3FA7BfsEAAAAkw"]
[Wed Feb 18 20:47:24.853197 2026] [:error] [pid 21848:tid 21899] [client 20.46.124.66:13591] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aZW03PbG91VRkVidT5dD9QAAAEo"]
[Wed Feb 18 20:47:25.205117 2026] [:error] [pid 21848:tid 21905] [client 20.46.124.66:23563] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shas.php"] [unique_id "aZW03fbG91VRkVidT5dD9gAAAFA"]
[Wed Feb 18 20:47:26.372869 2026] [:error] [pid 21847:tid 21864] [client 20.46.124.66:13897] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shas.php"] [unique_id "aZW03vy9A5wy4LuXmJ0fOgAAAAY"]
[Wed Feb 18 20:47:27.055678 2026] [:error] [pid 57014:tid 57028] [client 20.46.124.66:23942] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shas.php"] [unique_id "aZW03xNZnhS5qKtVIMIztwAAAQs"]
[Wed Feb 18 20:47:27.608703 2026] [:error] [pid 11607:tid 11615] [client 20.46.124.66:22474] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shas.php"] [unique_id "aZW03xw91ggRx3FA7BfsEgAAAkA"]
[Wed Feb 18 20:47:28.144073 2026] [:error] [pid 11611:tid 11705] [client 20.46.124.66:23262] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aZW04O2m6IPN_aBZuKZwGQAAAwc"]
[Wed Feb 18 20:47:28.450974 2026] [:error] [pid 11512:tid 11538] [client 20.46.124.66:23589] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aZW04BGamu0xQuQ-jbFZqQAAAZU"]
[Wed Feb 18 20:47:28.747020 2026] [:error] [pid 11610:tid 11674] [client 20.46.124.66:23241] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aZW04LWMUt4MNfN7mx3R9QAAAsM"]
[Wed Feb 18 20:47:28.985386 2026] [:error] [pid 21847:tid 21865] [client 20.46.124.66:23259] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aZW04Py9A5wy4LuXmJ0fPwAAAAc"]
[Wed Feb 18 20:47:29.256569 2026] [:error] [pid 21847:tid 21859] [client 20.46.124.66:14195] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "aZW04fy9A5wy4LuXmJ0fQAAAAAE"]
[Wed Feb 18 20:47:29.631261 2026] [:error] [pid 5561:tid 5582] [client 20.46.124.66:23999] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "aZW04UoQssCZYQ4NexbX9AAAAVI"]
[Wed Feb 18 20:47:30.089428 2026] [:error] [pid 11607:tid 11628] [client 20.46.124.66:24341] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "aZW04hw91ggRx3FA7BfsFgAAAk0"]
[Wed Feb 18 20:47:30.442255 2026] [:error] [pid 11607:tid 11618] [client 20.46.124.66:23574] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "aZW04hw91ggRx3FA7BfsFwAAAkM"]
[Wed Feb 18 20:47:30.913611 2026] [:error] [pid 57014:tid 57035] [client 20.46.124.66:23237] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/er.php"] [unique_id "aZW04hNZnhS5qKtVIMIzvQAAARI"]
[Wed Feb 18 20:47:31.337989 2026] [:error] [pid 11607:tid 11638] [client 20.46.124.66:23607] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/er.php"] [unique_id "aZW04xw91ggRx3FA7BfsGAAAAlc"]
[Wed Feb 18 20:47:31.854754 2026] [:error] [pid 57014:tid 57038] [client 20.46.124.66:3965] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/er.php"] [unique_id "aZW04xNZnhS5qKtVIMIzwAAAARU"]
[Wed Feb 18 20:47:32.103688 2026] [:error] [pid 21847:tid 21873] [client 20.46.124.66:3966] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/er.php"] [unique_id "aZW05Py9A5wy4LuXmJ0fQQAAAA8"]
[Wed Feb 18 20:47:32.403185 2026] [:error] [pid 11607:tid 11623] [client 20.46.124.66:22486] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fault.php"] [unique_id "aZW05Bw91ggRx3FA7BfsGgAAAkg"]
[Wed Feb 18 20:47:32.769811 2026] [:error] [pid 57014:tid 57017] [client 20.46.124.66:13937] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fault.php"] [unique_id "aZW05BNZnhS5qKtVIMIzwgAAAQA"]
[Wed Feb 18 20:47:33.098208 2026] [:error] [pid 57014:tid 57025] [client 20.46.124.66:22843] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fault.php"] [unique_id "aZW05RNZnhS5qKtVIMIzxAAAAQg"]
[Wed Feb 18 20:47:33.342193 2026] [:error] [pid 11607:tid 11619] [client 20.46.124.66:3952] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fault.php"] [unique_id "aZW05Rw91ggRx3FA7BfsHAAAAkQ"]
[Wed Feb 18 20:47:33.796457 2026] [:error] [pid 11607:tid 11635] [client 20.46.124.66:3561] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aZW05Rw91ggRx3FA7BfsHQAAAlQ"]
[Wed Feb 18 20:47:34.042463 2026] [:error] [pid 57014:tid 57037] [client 20.46.124.66:13890] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aZW05hNZnhS5qKtVIMIzyAAAARQ"]
[Wed Feb 18 20:47:34.330199 2026] [:error] [pid 11611:tid 11708] [client 20.46.124.66:3603] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aZW05u2m6IPN_aBZuKZwHQAAAwo"]
[Wed Feb 18 20:47:34.631179 2026] [:error] [pid 11607:tid 11636] [client 20.46.124.66:20544] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aZW05hw91ggRx3FA7BfsIAAAAlU"]
[Wed Feb 18 20:47:34.924334 2026] [:error] [pid 11548:tid 11581] [client 20.46.124.66:22257] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aZW05jSFZiBIZZvmIlMMdgAAAgM"]
[Wed Feb 18 20:47:35.231394 2026] [:error] [pid 11611:tid 11716] [client 20.46.124.66:22788] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aZW05-2m6IPN_aBZuKZwIAAAAxI"]
[Wed Feb 18 20:47:35.669541 2026] [:error] [pid 57014:tid 57036] [client 20.46.124.66:25107] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aZW05xNZnhS5qKtVIMIzzAAAARM"]
[Wed Feb 18 20:47:35.986981 2026] [:error] [pid 21847:tid 21881] [client 20.46.124.66:3580] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aZW05_y9A5wy4LuXmJ0fRAAAABc"]
[Wed Feb 18 20:47:36.389127 2026] [:error] [pid 21847:tid 21872] [client 20.46.124.66:13903] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/leuk.php"] [unique_id "aZW06Py9A5wy4LuXmJ0fRQAAAA4"]
[Wed Feb 18 20:47:36.656473 2026] [:error] [pid 21847:tid 21858] [client 20.46.124.66:22198] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/leuk.php"] [unique_id "aZW06Py9A5wy4LuXmJ0fRgAAAAA"]
[Wed Feb 18 20:47:36.946206 2026] [:error] [pid 11607:tid 11628] [client 20.46.124.66:21979] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/leuk.php"] [unique_id "aZW06Bw91ggRx3FA7BfsIwAAAk0"]
[Wed Feb 18 20:47:37.269365 2026] [:error] [pid 21847:tid 21878] [client 20.46.124.66:3462] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/leuk.php"] [unique_id "aZW06fy9A5wy4LuXmJ0fRwAAABQ"]
[Wed Feb 18 20:47:37.573445 2026] [:error] [pid 21847:tid 21882] [client 20.46.124.66:21960] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xqq.php"] [unique_id "aZW06fy9A5wy4LuXmJ0fSQAAABg"]
[Wed Feb 18 20:47:37.935098 2026] [:error] [pid 11607:tid 11624] [client 20.46.124.66:21980] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xqq.php"] [unique_id "aZW06Rw91ggRx3FA7BfsJQAAAkk"]
[Wed Feb 18 20:47:38.197174 2026] [:error] [pid 11609:tid 11662] [client 20.46.124.66:16336] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xqq.php"] [unique_id "aZW06shm3UjgaKO2Na80FAAAApI"]
[Wed Feb 18 20:47:38.455595 2026] [:error] [pid 21848:tid 21911] [client 20.46.124.66:16782] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xqq.php"] [unique_id "aZW06vbG91VRkVidT5dD-QAAAFY"]
[Wed Feb 18 20:47:38.698450 2026] [:error] [pid 11611:tid 11722] [client 20.46.124.66:15861] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kolda.php"] [unique_id "aZW06u2m6IPN_aBZuKZwJAAAAxg"]
[Wed Feb 18 20:47:38.996787 2026] [:error] [pid 21848:tid 21908] [client 20.46.124.66:3500] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kolda.php"] [unique_id "aZW06vbG91VRkVidT5dD-gAAAFM"]
[Wed Feb 18 20:47:39.429489 2026] [:error] [pid 21848:tid 21896] [client 20.46.124.66:21995] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kolda.php"] [unique_id "aZW06_bG91VRkVidT5dD_AAAAEc"]
[Wed Feb 18 20:47:39.761449 2026] [:error] [pid 21848:tid 21905] [client 20.46.124.66:3277] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kolda.php"] [unique_id "aZW06_bG91VRkVidT5dD_gAAAFA"]
[Wed Feb 18 20:47:40.014383 2026] [:error] [pid 21848:tid 21889] [client 20.46.124.66:16856] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "aZW07PbG91VRkVidT5dEAAAAAEA"]
[Wed Feb 18 20:47:40.302203 2026] [:error] [pid 21848:tid 21892] [client 20.46.124.66:16358] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "aZW07PbG91VRkVidT5dEAgAAAEM"]
[Wed Feb 18 20:47:40.641791 2026] [:error] [pid 11611:tid 11721] [client 20.46.124.66:20935] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "aZW07O2m6IPN_aBZuKZwKgAAAxc"]
[Wed Feb 18 20:47:40.879836 2026] [:error] [pid 11611:tid 11720] [client 20.46.124.66:16351] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "aZW07O2m6IPN_aBZuKZwKwAAAxY"]
[Wed Feb 18 20:47:41.171179 2026] [:error] [pid 21847:tid 21877] [client 20.46.124.66:16786] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/god.php"] [unique_id "aZW07fy9A5wy4LuXmJ0fTgAAABM"]
[Wed Feb 18 20:47:41.821126 2026] [:error] [pid 21848:tid 21902] [client 20.46.124.66:3484] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/god.php"] [unique_id "aZW07fbG91VRkVidT5dEBQAAAE0"]
[Wed Feb 18 20:47:42.356179 2026] [:error] [pid 57014:tid 57039] [client 20.46.124.66:16354] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/god.php"] [unique_id "aZW07hNZnhS5qKtVIMIzzQAAARY"]
[Wed Feb 18 20:47:42.589652 2026] [:error] [pid 11610:tid 11689] [client 20.46.124.66:21967] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/god.php"] [unique_id "aZW07rWMUt4MNfN7mx3R-gAAAtI"]
[Wed Feb 18 20:47:42.900732 2026] [:error] [pid 57014:tid 57018] [client 20.46.124.66:20987] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aZW07hNZnhS5qKtVIMIz0AAAAQE"]
[Wed Feb 18 20:47:43.208297 2026] [:error] [pid 11611:tid 11715] [client 20.46.124.66:16377] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aZW07-2m6IPN_aBZuKZwLwAAAxE"]
[Wed Feb 18 20:47:43.771024 2026] [:error] [pid 11548:tid 11591] [client 20.46.124.66:16884] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aZW07zSFZiBIZZvmIlMMfgAAAg0"]
[Wed Feb 18 20:47:44.176162 2026] [:error] [pid 11512:tid 11539] [client 20.46.124.66:16356] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aZW08BGamu0xQuQ-jbFZrQAAAZY"]
[Wed Feb 18 20:47:44.457162 2026] [:error] [pid 21848:tid 21901] [client 20.46.124.66:15006] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aZW08PbG91VRkVidT5dECAAAAEw"]
[Wed Feb 18 20:47:44.783068 2026] [:error] [pid 11512:tid 11534] [client 20.46.124.66:16870] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aZW08BGamu0xQuQ-jbFZrgAAAZE"]
[Wed Feb 18 20:47:45.036574 2026] [:error] [pid 5561:tid 5581] [client 20.46.124.66:29482] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aZW08UoQssCZYQ4NexbX_wAAAVE"]
[Wed Feb 18 20:47:45.334616 2026] [:error] [pid 11548:tid 11580] [client 20.46.124.66:29462] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aZW08TSFZiBIZZvmIlMMfwAAAgI"]
[Wed Feb 18 20:47:45.560765 2026] [:error] [pid 5561:tid 5584] [client 20.46.124.66:29520] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/un.php"] [unique_id "aZW08UoQssCZYQ4NexbYAAAAAVQ"]
[Wed Feb 18 20:47:45.800954 2026] [:error] [pid 57014:tid 57040] [client 20.46.124.66:29458] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/un.php"] [unique_id "aZW08RNZnhS5qKtVIMIz1AAAARc"]
[Wed Feb 18 20:47:46.155333 2026] [:error] [pid 11609:tid 11643] [client 20.46.124.66:3300] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/un.php"] [unique_id "aZW08shm3UjgaKO2Na80FgAAAoA"]
[Wed Feb 18 20:47:46.509667 2026] [:error] [pid 11610:tid 11676] [client 20.46.124.66:3304] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/un.php"] [unique_id "aZW08rWMUt4MNfN7mx3R_AAAAsU"]
[Wed Feb 18 20:47:46.771195 2026] [:error] [pid 11607:tid 11627] [client 20.46.124.66:16284] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aZW08hw91ggRx3FA7BfsKAAAAkw"]
[Wed Feb 18 20:47:47.005989 2026] [:error] [pid 11609:tid 11663] [client 20.46.124.66:20957] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aZW088hm3UjgaKO2Na80GAAAApM"]
[Wed Feb 18 20:47:47.261704 2026] [:error] [pid 11610:tid 11694] [client 20.46.124.66:12574] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aZW087WMUt4MNfN7mx3R_QAAAtc"]
[Wed Feb 18 20:47:47.495415 2026] [:error] [pid 11512:tid 11522] [client 20.46.124.66:15821] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aZW08xGamu0xQuQ-jbFZsgAAAYU"]
[Wed Feb 18 20:47:47.767567 2026] [:error] [pid 57014:tid 57029] [client 20.46.124.66:29515] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms.php"] [unique_id "aZW08xNZnhS5qKtVIMIz1gAAAQw"]
[Wed Feb 18 20:47:48.213959 2026] [:error] [pid 11512:tid 11536] [client 20.46.124.66:29508] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms.php"] [unique_id "aZW09BGamu0xQuQ-jbFZswAAAZM"]
[Wed Feb 18 20:47:48.519807 2026] [:error] [pid 57014:tid 57022] [client 20.46.124.66:16872] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms.php"] [unique_id "aZW09BNZnhS5qKtVIMIz2AAAAQU"]
[Wed Feb 18 20:47:48.768784 2026] [:error] [pid 11609:tid 11647] [client 20.46.124.66:29499] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms.php"] [unique_id "aZW09Mhm3UjgaKO2Na80GQAAAoQ"]
[Wed Feb 18 20:47:49.062323 2026] [:error] [pid 11609:tid 11648] [client 20.46.124.66:16879] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login8.php"] [unique_id "aZW09chm3UjgaKO2Na80GwAAAoU"]
[Wed Feb 18 20:47:49.320616 2026] [:error] [pid 57014:tid 57031] [client 20.46.124.66:3289] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login8.php"] [unique_id "aZW09RNZnhS5qKtVIMIz2QAAAQ4"]
[Wed Feb 18 20:47:49.584126 2026] [:error] [pid 11611:tid 11699] [client 20.46.124.66:16313] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login8.php"] [unique_id "aZW09e2m6IPN_aBZuKZwMgAAAwE"]
[Wed Feb 18 20:47:50.124635 2026] [:error] [pid 57014:tid 57037] [client 20.46.124.66:16799] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login8.php"] [unique_id "aZW09hNZnhS5qKtVIMIz2gAAARQ"]
[Wed Feb 18 20:47:50.401319 2026] [:error] [pid 21848:tid 21895] [client 20.46.124.66:16817] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nnyvn.php"] [unique_id "aZW09vbG91VRkVidT5dECQAAAEY"]
[Wed Feb 18 20:47:50.638228 2026] [:error] [pid 57014:tid 57024] [client 20.46.124.66:15814] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nnyvn.php"] [unique_id "aZW09hNZnhS5qKtVIMIz3wAAAQc"]
[Wed Feb 18 20:47:50.873709 2026] [:error] [pid 11611:tid 11717] [client 20.46.124.66:16268] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nnyvn.php"] [unique_id "aZW09u2m6IPN_aBZuKZwNAAAAxM"]
[Wed Feb 18 20:47:51.124933 2026] [:error] [pid 11609:tid 11659] [client 20.46.124.66:3273] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nnyvn.php"] [unique_id "aZW098hm3UjgaKO2Na80IQAAApA"]
[Wed Feb 18 20:47:51.359852 2026] [:error] [pid 11609:tid 11667] [client 20.46.124.66:20988] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "aZW098hm3UjgaKO2Na80IgAAApc"]
[Wed Feb 18 20:47:51.621054 2026] [:error] [pid 21848:tid 21892] [client 20.46.124.66:3265] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "aZW09_bG91VRkVidT5dECgAAAEM"]
[Wed Feb 18 20:47:52.006135 2026] [:error] [pid 21847:tid 21869] [client 20.46.124.66:16321] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "aZW0-Py9A5wy4LuXmJ0fUgAAAAs"]
[Wed Feb 18 20:47:52.244621 2026] [:error] [pid 5561:tid 5569] [client 20.46.124.66:20945] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "aZW0-EoQssCZYQ4NexbYBAAAAUU"]
[Wed Feb 18 20:47:52.551484 2026] [:error] [pid 5561:tid 5573] [client 20.46.124.66:16802] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lul.php"] [unique_id "aZW0-EoQssCZYQ4NexbYBgAAAUk"]
[Wed Feb 18 20:47:52.787325 2026] [:error] [pid 11609:tid 11651] [client 20.46.124.66:23241] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lul.php"] [unique_id "aZW0-Mhm3UjgaKO2Na80JgAAAog"]
[Wed Feb 18 20:47:53.019807 2026] [:error] [pid 57014:tid 57033] [client 20.46.124.66:16375] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lul.php"] [unique_id "aZW0-RNZnhS5qKtVIMIz5AAAARA"]
[Wed Feb 18 20:47:53.286772 2026] [:error] [pid 57014:tid 57025] [client 20.46.124.66:16853] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lul.php"] [unique_id "aZW0-RNZnhS5qKtVIMIz5QAAAQg"]
[Wed Feb 18 20:47:53.543485 2026] [:error] [pid 5561:tid 5577] [client 20.46.124.66:16874] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aZW0-UoQssCZYQ4NexbYBwAAAU0"]
[Wed Feb 18 20:47:53.913007 2026] [:error] [pid 57014:tid 57026] [client 20.46.124.66:29555] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aZW0-RNZnhS5qKtVIMIz6QAAAQk"]
[Wed Feb 18 20:47:54.286537 2026] [:error] [pid 5561:tid 5578] [client 20.46.124.66:21967] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aZW0-koQssCZYQ4NexbYCAAAAU4"]
[Wed Feb 18 20:47:54.531473 2026] [:error] [pid 57014:tid 57023] [client 20.46.124.66:16891] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aZW0-hNZnhS5qKtVIMIz6wAAAQY"]
[Wed Feb 18 20:47:54.869102 2026] [:error] [pid 11609:tid 11668] [client 20.46.124.66:15853] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aZW0-shm3UjgaKO2Na80KAAAApg"]
[Wed Feb 18 20:47:55.152919 2026] [:error] [pid 11609:tid 11652] [client 20.46.124.66:22265] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aZW0-8hm3UjgaKO2Na80KgAAAok"]
[Wed Feb 18 20:47:55.407506 2026] [:error] [pid 5561:tid 5583] [client 20.46.124.66:15835] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aZW0-0oQssCZYQ4NexbYCgAAAVM"]
[Wed Feb 18 20:47:55.665228 2026] [:error] [pid 5561:tid 5570] [client 20.46.124.66:22005] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aZW0-0oQssCZYQ4NexbYDAAAAUY"]
[Wed Feb 18 20:47:56.029255 2026] [:error] [pid 21847:tid 21870] [client 20.46.124.66:29544] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ya.php"] [unique_id "aZW0_Py9A5wy4LuXmJ0fUwAAAAw"]
[Wed Feb 18 20:47:56.259160 2026] [:error] [pid 11610:tid 11684] [client 20.46.124.66:16883] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ya.php"] [unique_id "aZW0_LWMUt4MNfN7mx3SAAAAAs0"]
[Wed Feb 18 20:47:56.557715 2026] [:error] [pid 11548:tid 11585] [client 20.46.124.66:16849] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ya.php"] [unique_id "aZW0_DSFZiBIZZvmIlMMggAAAgc"]
[Wed Feb 18 20:47:56.820722 2026] [:error] [pid 11610:tid 11693] [client 20.46.124.66:14976] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ya.php"] [unique_id "aZW0_LWMUt4MNfN7mx3SAQAAAtY"]
[Wed Feb 18 20:47:57.088058 2026] [:error] [pid 57014:tid 57034] [client 20.46.124.66:16312] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "aZW0_RNZnhS5qKtVIMIz7wAAARE"]
[Wed Feb 18 20:47:57.352204 2026] [:error] [pid 21847:tid 21866] [client 20.46.124.66:15849] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "aZW0_fy9A5wy4LuXmJ0fVAAAAAg"]
[Wed Feb 18 20:47:57.683356 2026] [:error] [pid 11611:tid 11704] [client 20.46.124.66:16851] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "aZW0_e2m6IPN_aBZuKZwOAAAAwY"]
[Wed Feb 18 20:47:57.934488 2026] [:error] [pid 11512:tid 11526] [client 20.46.124.66:16790] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "aZW0_RGamu0xQuQ-jbFZtwAAAYk"]
[Wed Feb 18 20:47:58.241709 2026] [:error] [pid 11548:tid 11588] [client 20.46.124.66:16285] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aZW0_jSFZiBIZZvmIlMMhAAAAgo"]
[Wed Feb 18 20:47:58.490485 2026] [:error] [pid 57014:tid 57017] [client 20.46.124.66:16848] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aZW0_hNZnhS5qKtVIMIz8wAAAQA"]
[Wed Feb 18 20:47:58.758430 2026] [:error] [pid 11610:tid 11681] [client 20.46.124.66:16345] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aZW0_rWMUt4MNfN7mx3SAgAAAso"]
[Wed Feb 18 20:47:59.010752 2026] [:error] [pid 5561:tid 5585] [client 20.46.124.66:29523] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aZW0_0oQssCZYQ4NexbYDwAAAVU"]
[Wed Feb 18 20:47:59.323188 2026] [:error] [pid 11611:tid 11698] [client 20.46.124.66:22014] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "aZW0_-2m6IPN_aBZuKZwOwAAAwA"]
[Wed Feb 18 20:47:59.667094 2026] [:error] [pid 11607:tid 11628] [client 20.46.124.66:29498] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "aZW0_xw91ggRx3FA7BfsLAAAAk0"]
[Wed Feb 18 20:47:59.906088 2026] [:error] [pid 11548:tid 11601] [client 20.46.124.66:3282] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "aZW0_zSFZiBIZZvmIlMMhQAAAhc"]
[Wed Feb 18 20:48:00.175634 2026] [:error] [pid 11611:tid 11715] [client 20.46.124.66:22003] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "aZW1AO2m6IPN_aBZuKZwPAAAAxE"]
[Wed Feb 18 20:48:00.506811 2026] [:error] [pid 11512:tid 11528] [client 20.46.124.66:16875] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1vx.php"] [unique_id "aZW1ABGamu0xQuQ-jbFZuQAAAYs"]
[Wed Feb 18 20:48:00.778867 2026] [:error] [pid 21848:tid 21911] [client 20.46.124.66:15018] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1vx.php"] [unique_id "aZW1APbG91VRkVidT5dEEQAAAFY"]
[Wed Feb 18 20:48:01.156967 2026] [:error] [pid 11607:tid 11624] [client 20.46.124.66:29493] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1vx.php"] [unique_id "aZW1ARw91ggRx3FA7BfsLwAAAkk"]
[Wed Feb 18 20:48:01.567745 2026] [:error] [pid 5561:tid 5564] [client 20.46.124.66:15842] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1vx.php"] [unique_id "aZW1AUoQssCZYQ4NexbYEgAAAUA"]
[Wed Feb 18 20:48:01.832104 2026] [:error] [pid 5561:tid 5575] [client 20.46.124.66:20937] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aZW1AUoQssCZYQ4NexbYEwAAAUs"]
[Wed Feb 18 20:48:02.086352 2026] [:error] [pid 11609:tid 11644] [client 20.46.124.66:16300] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aZW1Ashm3UjgaKO2Na80LgAAAoE"]
[Wed Feb 18 20:48:02.347502 2026] [:error] [pid 21848:tid 21889] [client 20.46.124.66:15008] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aZW1AvbG91VRkVidT5dEFQAAAEA"]
[Wed Feb 18 20:48:02.591478 2026] [:error] [pid 11610:tid 11690] [client 20.46.124.66:29456] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aZW1ArWMUt4MNfN7mx3SBgAAAtM"]
[Wed Feb 18 20:48:02.863836 2026] [:error] [pid 57014:tid 57020] [client 20.46.124.66:22795] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aZW1AhNZnhS5qKtVIMIz9wAAAQM"]
[Wed Feb 18 20:48:03.111977 2026] [:error] [pid 11609:tid 11657] [client 20.46.124.66:21954] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aZW1A8hm3UjgaKO2Na80MAAAAo4"]
[Wed Feb 18 20:48:03.354820 2026] [:error] [pid 11607:tid 11623] [client 20.46.124.66:16778] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aZW1Axw91ggRx3FA7BfsMAAAAkg"]
[Wed Feb 18 20:48:03.704653 2026] [:error] [pid 21848:tid 21895] [client 20.46.124.66:3603] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aZW1A_bG91VRkVidT5dEGAAAAEY"]
[Wed Feb 18 20:48:04.017951 2026] [:error] [pid 11610:tid 11695] [client 20.46.124.66:29488] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/06.php"] [unique_id "aZW1BLWMUt4MNfN7mx3SCQAAAtg"]
[Wed Feb 18 20:48:04.256622 2026] [:error] [pid 5561:tid 5580] [client 20.46.124.66:22011] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/06.php"] [unique_id "aZW1BEoQssCZYQ4NexbYFgAAAVA"]
[Wed Feb 18 20:48:04.644944 2026] [:error] [pid 11610:tid 11680] [client 20.46.124.66:29516] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/06.php"] [unique_id "aZW1BLWMUt4MNfN7mx3SDAAAAsk"]
[Wed Feb 18 20:48:04.987005 2026] [:error] [pid 21848:tid 21912] [client 20.46.124.66:16819] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/06.php"] [unique_id "aZW1BPbG91VRkVidT5dEGgAAAFc"]
[Wed Feb 18 20:48:05.311387 2026] [:error] [pid 11610:tid 11671] [client 20.46.124.66:16274] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "aZW1BbWMUt4MNfN7mx3SDwAAAsA"]
[Wed Feb 18 20:48:05.730061 2026] [:error] [pid 57014:tid 57017] [client 20.46.124.66:29545] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "aZW1BRNZnhS5qKtVIMIz-QAAAQA"]
[Wed Feb 18 20:48:06.012401 2026] [:error] [pid 11610:tid 11684] [client 20.46.124.66:29505] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "aZW1BrWMUt4MNfN7mx3SEgAAAs0"]
[Wed Feb 18 20:48:06.279832 2026] [:error] [pid 57014:tid 57019] [client 20.46.124.66:14995] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "aZW1BhNZnhS5qKtVIMIz-gAAAQI"]
[Wed Feb 18 20:48:06.521523 2026] [:error] [pid 57014:tid 57032] [client 20.46.124.66:21961] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fot.php"] [unique_id "aZW1BhNZnhS5qKtVIMIz_gAAAQ8"]
[Wed Feb 18 20:48:06.782898 2026] [:error] [pid 57014:tid 57035] [client 20.46.124.66:16827] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fot.php"] [unique_id "aZW1BhNZnhS5qKtVIMI0AAAAARI"]
[Wed Feb 18 20:48:07.132336 2026] [:error] [pid 57014:tid 57030] [client 20.46.124.66:20942] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fot.php"] [unique_id "aZW1BxNZnhS5qKtVIMI0AgAAAQ0"]
[Wed Feb 18 20:48:07.394096 2026] [:error] [pid 57014:tid 57034] [client 20.46.124.66:16788] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fot.php"] [unique_id "aZW1BxNZnhS5qKtVIMI0AwAAARE"]
[Wed Feb 18 20:48:07.646695 2026] [:error] [pid 11610:tid 11691] [client 20.46.124.66:15813] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff1.php"] [unique_id "aZW1B7WMUt4MNfN7mx3SFAAAAtQ"]
[Wed Feb 18 20:48:18.941739 2026] [:error] [pid 57014:tid 57023] [client 20.46.124.66:16784] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "aZW1EhNZnhS5qKtVIMI0QAAAAQY"]
[Wed Feb 18 20:48:19.187837 2026] [:error] [pid 11607:tid 11624] [client 20.46.124.66:29834] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "aZW1Exw91ggRx3FA7BfsOgAAAkk"]
[Wed Feb 18 20:48:19.497186 2026] [:error] [pid 5561:tid 5586] [client 20.46.124.66:16839] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "aZW1E0oQssCZYQ4NexbYGgAAAVY"]
[Wed Feb 18 20:48:19.724954 2026] [:error] [pid 11609:tid 11661] [client 20.46.124.66:15011] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "aZW1E8hm3UjgaKO2Na80QgAAApE"]
[Wed Feb 18 20:48:20.007664 2026] [:error] [pid 57014:tid 57037] [client 20.46.124.66:29865] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vxrl.php"] [unique_id "aZW1FBNZnhS5qKtVIMI0QwAAARQ"]
[Wed Feb 18 20:48:20.261462 2026] [:error] [pid 11607:tid 11638] [client 20.46.124.66:16256] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vxrl.php"] [unique_id "aZW1FBw91ggRx3FA7BfsPgAAAlc"]
[Wed Feb 18 20:48:20.506908 2026] [:error] [pid 11610:tid 11690] [client 20.46.124.66:29550] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vxrl.php"] [unique_id "aZW1FLWMUt4MNfN7mx3SHQAAAtM"]
[Wed Feb 18 20:48:20.772595 2026] [:error] [pid 11610:tid 11689] [client 20.46.124.66:29517] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vxrl.php"] [unique_id "aZW1FLWMUt4MNfN7mx3SHgAAAtI"]
[Wed Feb 18 20:48:21.023857 2026] [:error] [pid 57014:tid 57038] [client 20.46.124.66:22233] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "aZW1FRNZnhS5qKtVIMI0RAAAARU"]
[Wed Feb 18 20:48:21.250649 2026] [:error] [pid 57014:tid 57028] [client 20.46.124.66:21970] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "aZW1FRNZnhS5qKtVIMI0RQAAAQs"]
[Wed Feb 18 20:48:21.502782 2026] [:error] [pid 5561:tid 5572] [client 20.46.124.66:3299] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "aZW1FUoQssCZYQ4NexbYHAAAAUg"]
[Wed Feb 18 20:48:21.732564 2026] [:error] [pid 21847:tid 21863] [client 20.46.124.66:13591] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "aZW1Ffy9A5wy4LuXmJ0faQAAAAU"]
[Wed Feb 18 20:48:22.036720 2026] [:error] [pid 11611:tid 11718] [client 20.46.124.66:16364] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aZW1Fu2m6IPN_aBZuKZwewAAAxQ"]
[Wed Feb 18 20:48:22.274487 2026] [:error] [pid 11607:tid 11620] [client 20.46.124.66:29942] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aZW1Fhw91ggRx3FA7BfsQgAAAkU"]
[Wed Feb 18 20:48:22.807097 2026] [:error] [pid 11512:tid 11526] [client 20.46.124.66:29470] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aZW1FhGamu0xQuQ-jbFZwgAAAYk"]
[Wed Feb 18 20:48:23.242254 2026] [:error] [pid 11611:tid 11720] [client 20.46.124.66:29534] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aZW1F-2m6IPN_aBZuKZwfQAAAxY"]
[Wed Feb 18 20:48:23.474639 2026] [:error] [pid 5561:tid 5584] [client 20.46.124.66:16355] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aZW1F0oQssCZYQ4NexbYHwAAAVQ"]
[Wed Feb 18 20:48:23.702250 2026] [:error] [pid 5561:tid 5575] [client 20.46.124.66:15036] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aZW1F0oQssCZYQ4NexbYIQAAAUs"]
[Wed Feb 18 20:48:23.976670 2026] [:error] [pid 57014:tid 57035] [client 20.46.124.66:16304] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aZW1FxNZnhS5qKtVIMI0SAAAARI"]
[Wed Feb 18 20:48:24.308045 2026] [:error] [pid 21847:tid 21876] [client 20.46.124.66:29506] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aZW1GPy9A5wy4LuXmJ0fbAAAABI"]
[Wed Feb 18 20:48:24.570799 2026] [:error] [pid 57014:tid 57022] [client 20.46.124.66:21991] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aZW1GBNZnhS5qKtVIMI0TAAAAQU"]
[Wed Feb 18 20:48:24.845849 2026] [:error] [pid 11610:tid 11694] [client 20.46.124.66:16340] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aZW1GLWMUt4MNfN7mx3SIwAAAtc"]
[Wed Feb 18 20:48:25.146885 2026] [:error] [pid 11610:tid 11678] [client 20.46.124.66:16768] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aZW1GbWMUt4MNfN7mx3SJAAAAsc"]
[Wed Feb 18 20:48:25.385611 2026] [:error] [pid 21847:tid 21871] [client 20.46.124.66:16857] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aZW1Gfy9A5wy4LuXmJ0fbwAAAA0"]
[Wed Feb 18 20:48:25.616794 2026] [:error] [pid 11512:tid 11532] [client 20.46.124.66:16315] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aZW1GRGamu0xQuQ-jbFZxwAAAY8"]
[Wed Feb 18 20:48:25.850217 2026] [:error] [pid 5561:tid 5576] [client 20.46.124.66:16889] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aZW1GUoQssCZYQ4NexbYIwAAAUw"]
[Wed Feb 18 20:48:26.084245 2026] [:error] [pid 21847:tid 21862] [client 20.46.124.66:16271] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aZW1Gvy9A5wy4LuXmJ0fcAAAAAQ"]
[Wed Feb 18 20:48:26.319349 2026] [:error] [pid 11548:tid 11583] [client 20.46.124.66:29887] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/karak.php"] [unique_id "aZW1GjSFZiBIZZvmIlMMkwAAAgU"]
[Wed Feb 18 20:48:26.649843 2026] [:error] [pid 11610:tid 11679] [client 20.46.124.66:3520] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/prv8.php"] [unique_id "aZW1GrWMUt4MNfN7mx3SJgAAAsg"]
[Wed Feb 18 20:48:26.884726 2026] [:error] [pid 21847:tid 21860] [client 20.46.124.66:16338] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/prv8.php"] [unique_id "aZW1Gvy9A5wy4LuXmJ0fcwAAAAI"]
[Wed Feb 18 20:48:27.147011 2026] [:error] [pid 5561:tid 5577] [client 20.46.124.66:16860] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/prv8.php"] [unique_id "aZW1G0oQssCZYQ4NexbYJwAAAU0"]
[Wed Feb 18 20:48:27.424301 2026] [:error] [pid 11611:tid 11700] [client 20.46.124.66:29843] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/prv8.php"] [unique_id "aZW1G-2m6IPN_aBZuKZwggAAAwI"]
[Wed Feb 18 20:48:27.688998 2026] [:error] [pid 11611:tid 11706] [client 20.46.124.66:29908] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i.php"] [unique_id "aZW1G-2m6IPN_aBZuKZwgwAAAwg"]
[Wed Feb 18 20:48:27.920205 2026] [:error] [pid 11607:tid 11626] [client 20.46.124.66:16298] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i.php"] [unique_id "aZW1Gxw91ggRx3FA7BfsSAAAAks"]
[Wed Feb 18 20:48:28.191886 2026] [:error] [pid 11548:tid 11595] [client 20.46.124.66:3276] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i.php"] [unique_id "aZW1HDSFZiBIZZvmIlMMlgAAAhE"]
[Wed Feb 18 20:48:28.572816 2026] [:error] [pid 11611:tid 11722] [client 20.46.124.66:16275] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i.php"] [unique_id "aZW1HO2m6IPN_aBZuKZwhwAAAxg"]
[Wed Feb 18 20:48:28.799443 2026] [:error] [pid 11611:tid 11701] [client 20.46.124.66:16270] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aZW1HO2m6IPN_aBZuKZwiAAAAwM"]
[Wed Feb 18 20:48:29.029441 2026] [:error] [pid 21847:tid 21858] [client 20.46.124.66:21989] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aZW1Hfy9A5wy4LuXmJ0feAAAAAA"]
[Wed Feb 18 20:48:29.267858 2026] [:error] [pid 11607:tid 11624] [client 20.46.124.66:29922] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aZW1HRw91ggRx3FA7BfsSQAAAkk"]
[Wed Feb 18 20:48:29.496999 2026] [:error] [pid 11607:tid 11631] [client 20.46.124.66:29537] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aZW1HRw91ggRx3FA7BfsSgAAAlA"]
[Wed Feb 18 20:48:29.770167 2026] [:error] [pid 11512:tid 11538] [client 20.46.124.66:16295] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZW1HRGamu0xQuQ-jbFZywAAAZU"]
[Wed Feb 18 20:48:30.113420 2026] [:error] [pid 11548:tid 11600] [client 20.46.124.66:16260] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZW1HjSFZiBIZZvmIlMMmgAAAhY"]
[Wed Feb 18 20:48:30.386397 2026] [:error] [pid 11548:tid 11602] [client 20.46.124.66:29495] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZW1HjSFZiBIZZvmIlMMmwAAAhg"]
[Wed Feb 18 20:48:30.634336 2026] [:error] [pid 11607:tid 11633] [client 20.46.124.66:16374] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZW1Hhw91ggRx3FA7BfsTQAAAlI"]
[Wed Feb 18 20:48:30.887415 2026] [:error] [pid 11611:tid 11720] [client 20.46.124.66:29510] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aw.php"] [unique_id "aZW1Hu2m6IPN_aBZuKZwjgAAAxY"]
[Wed Feb 18 20:48:31.268660 2026] [:error] [pid 11611:tid 11708] [client 20.46.124.66:29561] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aw.php"] [unique_id "aZW1H-2m6IPN_aBZuKZwkAAAAwo"]
[Wed Feb 18 20:48:31.497446 2026] [:error] [pid 11548:tid 11590] [client 20.46.124.66:29485] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aw.php"] [unique_id "aZW1HzSFZiBIZZvmIlMMnwAAAgw"]
[Wed Feb 18 20:48:31.758838 2026] [:error] [pid 11512:tid 11526] [client 20.46.124.66:21975] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aw.php"] [unique_id "aZW1HxGamu0xQuQ-jbFZ0QAAAYk"]
[Wed Feb 18 20:48:32.130294 2026] [:error] [pid 11548:tid 11594] [client 20.46.124.66:16865] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev.php"] [unique_id "aZW1IDSFZiBIZZvmIlMMoQAAAhA"]
[Wed Feb 18 20:48:32.440438 2026] [:error] [pid 21847:tid 21882] [client 20.46.124.66:15034] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev.php"] [unique_id "aZW1IPy9A5wy4LuXmJ0fggAAABg"]
[Wed Feb 18 20:48:32.800188 2026] [:error] [pid 57014:tid 57021] [client 20.46.124.66:15024] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev.php"] [unique_id "aZW1IBNZnhS5qKtVIMI0VgAAAQQ"]
[Wed Feb 18 20:48:33.051879 2026] [:error] [pid 21848:tid 21899] [client 20.46.124.66:29454] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev.php"] [unique_id "aZW1IfbG91VRkVidT5dElwAAAEo"]
[Wed Feb 18 20:48:33.339973 2026] [:error] [pid 21848:tid 21903] [client 20.46.124.66:29895] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aZW1IfbG91VRkVidT5dEmgAAAE4"]
[Wed Feb 18 20:48:33.647266 2026] [:error] [pid 11611:tid 11716] [client 20.46.124.66:20207] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aZW1Ie2m6IPN_aBZuKZwkQAAAxI"]
[Wed Feb 18 20:48:33.889266 2026] [:error] [pid 21848:tid 21905] [client 20.46.124.66:29519] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aZW1IfbG91VRkVidT5dEmwAAAFA"]
[Wed Feb 18 20:48:34.179298 2026] [:error] [pid 5561:tid 5587] [client 20.46.124.66:3303] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aZW1IkoQssCZYQ4NexbYKgAAAVc"]
[Wed Feb 18 20:48:34.428824 2026] [:error] [pid 21847:tid 21870] [client 20.46.124.66:3566] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/155.php"] [unique_id "aZW1Ivy9A5wy4LuXmJ0fhwAAAAw"]
[Wed Feb 18 20:48:34.669870 2026] [:error] [pid 11512:tid 11527] [client 20.46.124.66:29461] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/155.php"] [unique_id "aZW1IhGamu0xQuQ-jbFZ1gAAAYo"]
[Wed Feb 18 20:48:34.912147 2026] [:error] [pid 21847:tid 21859] [client 20.46.124.66:15027] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/155.php"] [unique_id "aZW1Ivy9A5wy4LuXmJ0fiAAAAAE"]
[Wed Feb 18 20:48:35.184015 2026] [:error] [pid 11548:tid 11596] [client 20.46.124.66:16774] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/155.php"] [unique_id "aZW1IzSFZiBIZZvmIlMMowAAAhI"]
[Wed Feb 18 20:48:35.437427 2026] [:error] [pid 57014:tid 57039] [client 20.46.124.66:16829] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat.php"] [unique_id "aZW1IxNZnhS5qKtVIMI0WAAAARY"]
[Wed Feb 18 20:48:35.664387 2026] [:error] [pid 11609:tid 11645] [client 20.46.124.66:16816] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat.php"] [unique_id "aZW1I8hm3UjgaKO2Na80TgAAAoI"]
[Wed Feb 18 20:48:36.240948 2026] [:error] [pid 11548:tid 11586] [client 20.46.124.66:16325] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat.php"] [unique_id "aZW1JDSFZiBIZZvmIlMMpAAAAgg"]
[Wed Feb 18 20:48:36.503360 2026] [:error] [pid 21847:tid 21880] [client 20.46.124.66:29853] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat.php"] [unique_id "aZW1JPy9A5wy4LuXmJ0fiwAAABY"]
[Wed Feb 18 20:48:36.731580 2026] [:error] [pid 21847:tid 21867] [client 20.46.124.66:16283] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tcp.php"] [unique_id "aZW1JPy9A5wy4LuXmJ0fjAAAAAk"]
[Wed Feb 18 20:48:36.985968 2026] [:error] [pid 21847:tid 21869] [client 20.46.124.66:16859] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tcp.php"] [unique_id "aZW1JPy9A5wy4LuXmJ0fjQAAAAs"]
[Wed Feb 18 20:48:37.263534 2026] [:error] [pid 11512:tid 11526] [client 20.46.124.66:29824] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tcp.php"] [unique_id "aZW1JRGamu0xQuQ-jbFZ3wAAAYk"]
[Wed Feb 18 20:48:37.526241 2026] [:error] [pid 11607:tid 11626] [client 20.46.124.66:16287] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tcp.php"] [unique_id "aZW1JRw91ggRx3FA7BfsVgAAAks"]
[Wed Feb 18 20:48:37.779623 2026] [:error] [pid 11611:tid 11705] [client 20.46.124.66:29916] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ext.php"] [unique_id "aZW1Je2m6IPN_aBZuKZwlQAAAwc"]
[Wed Feb 18 20:48:38.033772 2026] [:error] [pid 11611:tid 11717] [client 20.46.124.66:20587] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ext.php"] [unique_id "aZW1Ju2m6IPN_aBZuKZwlgAAAxM"]
[Wed Feb 18 20:48:38.272732 2026] [:error] [pid 11610:tid 11690] [client 20.46.124.66:29880] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ext.php"] [unique_id "aZW1JrWMUt4MNfN7mx3SKgAAAtM"]
[Wed Feb 18 20:48:38.541293 2026] [:error] [pid 57014:tid 57036] [client 20.46.124.66:3266] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ext.php"] [unique_id "aZW1JhNZnhS5qKtVIMI0WgAAARM"]
[Wed Feb 18 20:48:38.854255 2026] [:error] [pid 57014:tid 57017] [client 20.46.124.66:16840] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aZW1JhNZnhS5qKtVIMI0XAAAAQA"]
[Wed Feb 18 20:48:39.225355 2026] [:error] [pid 57014:tid 57025] [client 20.46.124.66:16886] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aZW1JxNZnhS5qKtVIMI0XgAAAQg"]
[Wed Feb 18 20:48:39.735167 2026] [:error] [pid 21848:tid 21901] [client 20.46.124.66:16261] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aZW1J_bG91VRkVidT5dEoQAAAEw"]
[Wed Feb 18 20:48:40.028391 2026] [:error] [pid 11611:tid 11721] [client 20.46.124.66:16319] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aZW1KO2m6IPN_aBZuKZwmgAAAxc"]
[Wed Feb 18 20:48:40.271242 2026] [:error] [pid 21847:tid 21859] [client 20.46.124.66:25088] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi.php"] [unique_id "aZW1KPy9A5wy4LuXmJ0flAAAAAE"]
[Wed Feb 18 20:48:40.510865 2026] [:error] [pid 57014:tid 57019] [client 20.46.124.66:24827] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi.php"] [unique_id "aZW1KBNZnhS5qKtVIMI0YAAAAQI"]
[Wed Feb 18 20:48:40.790329 2026] [:error] [pid 11607:tid 11631] [client 20.46.124.66:16888] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi.php"] [unique_id "aZW1KBw91ggRx3FA7BfsWgAAAlA"]
[Wed Feb 18 20:48:41.050951 2026] [:error] [pid 11548:tid 11580] [client 20.46.124.66:29917] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi.php"] [unique_id "aZW1KTSFZiBIZZvmIlMMpgAAAgI"]
[Wed Feb 18 20:48:41.577928 2026] [:error] [pid 11512:tid 11541] [client 20.46.124.66:16277] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "aZW1KRGamu0xQuQ-jbFZ5QAAAZg"]
[Wed Feb 18 20:48:41.864918 2026] [:error] [pid 11611:tid 11720] [client 20.46.124.66:29858] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "aZW1Ke2m6IPN_aBZuKZwnAAAAxY"]
[Wed Feb 18 20:48:42.213315 2026] [:error] [pid 21847:tid 21882] [client 20.46.124.66:15820] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "aZW1Kvy9A5wy4LuXmJ0fmwAAABg"]
[Wed Feb 18 20:48:42.499200 2026] [:error] [pid 21847:tid 21861] [client 20.46.124.66:29903] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "aZW1Kvy9A5wy4LuXmJ0fnAAAAAM"]
[Wed Feb 18 20:48:42.986629 2026] [:error] [pid 11512:tid 11520] [client 20.46.124.66:30142] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ov.php"] [unique_id "aZW1KhGamu0xQuQ-jbFZ7QAAAYM"]
[Wed Feb 18 20:48:43.237893 2026] [:error] [pid 5561:tid 5569] [client 20.46.124.66:29938] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ov.php"] [unique_id "aZW1K0oQssCZYQ4NexbYNAAAAUU"]
[Wed Feb 18 20:48:43.535077 2026] [:error] [pid 21847:tid 21870] [client 20.46.124.66:29486] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ov.php"] [unique_id "aZW1K_y9A5wy4LuXmJ0foAAAAAw"]
[Wed Feb 18 20:48:43.873042 2026] [:error] [pid 11607:tid 11617] [client 20.46.124.66:3473] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ov.php"] [unique_id "aZW1Kxw91ggRx3FA7BfsXAAAAkI"]
[Wed Feb 18 20:48:44.198362 2026] [:error] [pid 11607:tid 11635] [client 20.46.124.66:30194] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aZW1LBw91ggRx3FA7BfsXQAAAlQ"]
[Wed Feb 18 20:48:44.457084 2026] [:error] [pid 21847:tid 21871] [client 20.46.124.66:29526] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aZW1LPy9A5wy4LuXmJ0fogAAAA0"]
[Wed Feb 18 20:48:44.701639 2026] [:error] [pid 57014:tid 57030] [client 20.46.124.66:15861] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aZW1LBNZnhS5qKtVIMI0ZwAAAQ0"]
[Wed Feb 18 20:48:45.064419 2026] [:error] [pid 11512:tid 11525] [client 20.46.124.66:29943] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aZW1LRGamu0xQuQ-jbFZ9AAAAYg"]
[Wed Feb 18 20:48:45.452863 2026] [:error] [pid 21847:tid 21867] [client 20.46.124.66:30153] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "aZW1Lfy9A5wy4LuXmJ0fpQAAAAk"]
[Wed Feb 18 20:48:45.709335 2026] [:error] [pid 57014:tid 57020] [client 20.46.124.66:16360] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "aZW1LRNZnhS5qKtVIMI0aQAAAQM"]
[Wed Feb 18 20:48:45.952650 2026] [:error] [pid 57014:tid 57039] [client 20.46.124.66:29872] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "aZW1LRNZnhS5qKtVIMI0agAAARY"]
[Wed Feb 18 20:48:46.245879 2026] [:error] [pid 21847:tid 21861] [client 20.46.124.66:29539] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "aZW1Lvy9A5wy4LuXmJ0fqAAAAAM"]
[Wed Feb 18 20:48:46.499125 2026] [:error] [pid 11512:tid 11524] [client 20.46.124.66:29494] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aZW1LhGamu0xQuQ-jbFZ9wAAAYc"]
[Wed Feb 18 20:48:46.855670 2026] [:error] [pid 11611:tid 11713] [client 20.46.124.66:30135] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aZW1Lu2m6IPN_aBZuKZwoAAAAw8"]
[Wed Feb 18 20:48:47.128436 2026] [:error] [pid 57014:tid 57024] [client 20.46.124.66:16365] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aZW1LxNZnhS5qKtVIMI0bgAAAQc"]
[Wed Feb 18 20:48:47.360656 2026] [:error] [pid 11548:tid 11587] [client 20.46.124.66:20933] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aZW1LzSFZiBIZZvmIlMMqAAAAgk"]
[Wed Feb 18 20:48:47.648182 2026] [:error] [pid 57014:tid 57023] [client 20.46.124.66:3283] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aZW1LxNZnhS5qKtVIMI0bwAAAQY"]
[Wed Feb 18 20:48:47.892596 2026] [:error] [pid 21848:tid 21909] [client 20.46.124.66:29543] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aZW1L_bG91VRkVidT5dEqgAAAFQ"]
[Wed Feb 18 20:48:48.221287 2026] [:error] [pid 21848:tid 21893] [client 20.46.124.66:30196] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aZW1MPbG91VRkVidT5dErAAAAEQ"]
[Wed Feb 18 20:48:48.464953 2026] [:error] [pid 11607:tid 11629] [client 20.46.124.66:29477] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aZW1MBw91ggRx3FA7BfsYwAAAk4"]
[Wed Feb 18 20:48:48.855159 2026] [:error] [pid 57014:tid 57019] [client 20.46.124.66:3325] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.1.php"] [unique_id "aZW1MBNZnhS5qKtVIMI0cgAAAQI"]
[Wed Feb 18 20:48:49.136365 2026] [:error] [pid 5561:tid 5577] [client 20.46.124.66:29861] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.1.php"] [unique_id "aZW1MUoQssCZYQ4NexbYNQAAAU0"]
[Wed Feb 18 20:48:49.465747 2026] [:error] [pid 5561:tid 5579] [client 20.46.124.66:15860] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.1.php"] [unique_id "aZW1MUoQssCZYQ4NexbYNgAAAU8"]
[Wed Feb 18 20:48:49.712203 2026] [:error] [pid 11611:tid 11702] [client 20.46.124.66:21984] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.1.php"] [unique_id "aZW1Me2m6IPN_aBZuKZwqQAAAwQ"]
[Wed Feb 18 20:48:50.115080 2026] [:error] [pid 11611:tid 11701] [client 20.46.124.66:29876] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/async.php"] [unique_id "aZW1Mu2m6IPN_aBZuKZwqgAAAwM"]
[Wed Feb 18 20:48:50.420580 2026] [:error] [pid 57014:tid 57040] [client 20.46.124.66:15033] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/async.php"] [unique_id "aZW1MhNZnhS5qKtVIMI0dgAAARc"]
[Wed Feb 18 20:48:50.671889 2026] [:error] [pid 11609:tid 11668] [client 20.46.124.66:16806] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/async.php"] [unique_id "aZW1Mshm3UjgaKO2Na80VwAAApg"]
[Wed Feb 18 20:48:50.971637 2026] [:error] [pid 21847:tid 21880] [client 20.46.124.66:29831] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/async.php"] [unique_id "aZW1Mvy9A5wy4LuXmJ0frQAAABY"]
[Wed Feb 18 20:48:51.239749 2026] [:error] [pid 5561:tid 5587] [client 20.46.124.66:30105] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff.php"] [unique_id "aZW1M0oQssCZYQ4NexbYOgAAAVc"]
[Wed Feb 18 20:48:51.510935 2026] [:error] [pid 11610:tid 11671] [client 20.46.124.66:15002] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff.php"] [unique_id "aZW1M7WMUt4MNfN7mx3SMAAAAsA"]
[Wed Feb 18 20:48:51.788823 2026] [:error] [pid 5561:tid 5581] [client 20.46.124.66:16379] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff.php"] [unique_id "aZW1M0oQssCZYQ4NexbYPQAAAVE"]
[Wed Feb 18 20:48:52.093048 2026] [:error] [pid 5561:tid 5564] [client 20.46.124.66:29940] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff.php"] [unique_id "aZW1NEoQssCZYQ4NexbYPgAAAUA"]
[Wed Feb 18 20:48:52.323605 2026] [:error] [pid 11610:tid 11688] [client 20.46.124.66:30091] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aZW1NLWMUt4MNfN7mx3SMwAAAtE"]
[Wed Feb 18 20:48:52.640390 2026] [:error] [pid 11610:tid 11690] [client 20.46.124.66:3575] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aZW1NLWMUt4MNfN7mx3SNQAAAtM"]
[Wed Feb 18 20:48:52.973877 2026] [:error] [pid 57014:tid 57022] [client 20.46.124.66:29854] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aZW1NBNZnhS5qKtVIMI0eAAAAQU"]
[Wed Feb 18 20:48:53.293914 2026] [:error] [pid 57014:tid 57036] [client 20.46.124.66:30090] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aZW1NRNZnhS5qKtVIMI0egAAARM"]
[Wed Feb 18 20:48:53.555042 2026] [:error] [pid 11610:tid 11677] [client 20.46.124.66:3305] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aZW1NbWMUt4MNfN7mx3SOgAAAsY"]
[Wed Feb 18 20:48:53.793223 2026] [:error] [pid 57014:tid 57023] [client 20.46.124.66:16303] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aZW1NRNZnhS5qKtVIMI0ewAAAQY"]
[Wed Feb 18 20:48:54.047468 2026] [:error] [pid 11512:tid 11526] [client 20.46.124.66:16299] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aZW1NhGamu0xQuQ-jbFZ_QAAAYk"]
[Wed Feb 18 20:48:54.276794 2026] [:error] [pid 11610:tid 11683] [client 20.46.124.66:29827] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aZW1NrWMUt4MNfN7mx3SPQAAAsw"]
[Wed Feb 18 20:48:54.505595 2026] [:error] [pid 5561:tid 5573] [client 20.46.124.66:16258] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aZW1NkoQssCZYQ4NexbYRwAAAUk"]
[Wed Feb 18 20:48:54.774053 2026] [:error] [pid 11610:tid 11679] [client 20.46.124.66:24707] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aZW1NrWMUt4MNfN7mx3SPwAAAsg"]
[Wed Feb 18 20:48:55.011495 2026] [:error] [pid 11610:tid 11672] [client 20.46.124.66:30117] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aZW1N7WMUt4MNfN7mx3SQQAAAsE"]
[Wed Feb 18 20:48:55.253296 2026] [:error] [pid 11610:tid 11693] [client 20.46.124.66:30106] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aZW1N7WMUt4MNfN7mx3SQwAAAtY"]
[Wed Feb 18 20:48:55.506995 2026] [:error] [pid 11610:tid 11684] [client 20.46.124.66:16329] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aZW1N7WMUt4MNfN7mx3SRAAAAs0"]
[Wed Feb 18 20:48:55.758267 2026] [:error] [pid 5561:tid 5585] [client 20.46.124.66:29444] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aZW1N0oQssCZYQ4NexbYUAAAAVU"]
[Wed Feb 18 20:48:56.057711 2026] [:error] [pid 11610:tid 11673] [client 20.46.124.66:16838] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aZW1OLWMUt4MNfN7mx3SRwAAAsI"]
[Wed Feb 18 20:48:56.319640 2026] [:error] [pid 21847:tid 21878] [client 20.46.124.66:29875] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aZW1OPy9A5wy4LuXmJ0fsQAAABQ"]
[Wed Feb 18 20:48:56.581293 2026] [:error] [pid 11512:tid 11535] [client 20.46.124.66:29463] [client 20.46.124.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aZW1OBGamu0xQuQ-jbFZ_gAAAZI"]
[Wed Feb 18 20:48:56.811126 2026] [:error] [pid 21847:tid 21874] [client 20.46.124.66:15031] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lc.php"] [unique_id "aZW1OPy9A5wy4LuXmJ0fsgAAABA"]
[Wed Feb 18 20:48:57.039469 2026] [:error] [pid 11611:tid 11700] [client 20.46.124.66:16867] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lc.php"] [unique_id "aZW1Oe2m6IPN_aBZuKZwrwAAAwI"]
[Wed Feb 18 20:48:57.286729 2026] [:error] [pid 11548:tid 11590] [client 20.46.124.66:29453] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lc.php"] [unique_id "aZW1OTSFZiBIZZvmIlMMqQAAAgw"]
[Wed Feb 18 20:48:57.597732 2026] [:error] [pid 11610:tid 11694] [client 20.46.124.66:22005] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lc.php"] [unique_id "aZW1ObWMUt4MNfN7mx3STwAAAtc"]
[Wed Feb 18 20:48:57.845897 2026] [:error] [pid 11607:tid 11628] [client 20.46.124.66:20168] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cbrfo.php"] [unique_id "aZW1ORw91ggRx3FA7BfsaQAAAk0"]
[Wed Feb 18 20:48:58.111696 2026] [:error] [pid 5561:tid 5567] [client 20.46.124.66:14978] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cbrfo.php"] [unique_id "aZW1OkoQssCZYQ4NexbYVQAAAUM"]
[Wed Feb 18 20:48:58.388657 2026] [:error] [pid 11609:tid 11653] [client 20.46.124.66:29487] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cbrfo.php"] [unique_id "aZW1Oshm3UjgaKO2Na80WwAAAoo"]
[Wed Feb 18 20:48:58.649123 2026] [:error] [pid 11548:tid 11584] [client 20.46.124.66:30120] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cbrfo.php"] [unique_id "aZW1OjSFZiBIZZvmIlMMqwAAAgY"]
[Wed Feb 18 20:48:59.017014 2026] [:error] [pid 5561:tid 5574] [client 20.46.124.66:15556] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inc.php"] [unique_id "aZW1O0oQssCZYQ4NexbYWQAAAUo"]
[Wed Feb 18 20:48:59.381077 2026] [:error] [pid 11610:tid 11688] [client 20.46.124.66:14986] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inc.php"] [unique_id "aZW1O7WMUt4MNfN7mx3SUwAAAtE"]
[Wed Feb 18 20:48:59.616610 2026] [:error] [pid 11610:tid 11675] [client 20.46.124.66:21988] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inc.php"] [unique_id "aZW1O7WMUt4MNfN7mx3SVgAAAsQ"]
[Wed Feb 18 20:48:59.929129 2026] [:error] [pid 5561:tid 5571] [client 20.46.124.66:16339] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inc.php"] [unique_id "aZW1O0oQssCZYQ4NexbYWwAAAUc"]
[Wed Feb 18 20:49:00.271013 2026] [:error] [pid 5561:tid 5586] [client 20.46.124.66:21953] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aZW1PEoQssCZYQ4NexbYXQAAAVY"]
[Wed Feb 18 20:49:00.567015 2026] [:error] [pid 5561:tid 5575] [client 20.46.124.66:30137] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aZW1PEoQssCZYQ4NexbYXgAAAUs"]
[Wed Feb 18 20:49:00.834797 2026] [:error] [pid 21848:tid 21893] [client 20.46.124.66:3487] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aZW1PPbG91VRkVidT5dEtwAAAEQ"]
[Wed Feb 18 20:49:01.187447 2026] [:error] [pid 21848:tid 21889] [client 20.46.124.66:30176] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aZW1PfbG91VRkVidT5dEuAAAAEA"]
[Wed Feb 18 20:49:01.426513 2026] [:error] [pid 5561:tid 5570] [client 20.46.124.66:29536] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/miansha.php"] [unique_id "aZW1PUoQssCZYQ4NexbYYAAAAUY"]
[Wed Feb 18 20:49:01.658098 2026] [:error] [pid 21848:tid 21899] [client 20.46.124.66:21999] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/miansha.php"] [unique_id "aZW1PfbG91VRkVidT5dEuQAAAEo"]
[Wed Feb 18 20:49:01.919458 2026] [:error] [pid 11607:tid 11632] [client 20.46.124.66:29951] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/miansha.php"] [unique_id "aZW1PRw91ggRx3FA7BfsbgAAAlE"]
[Wed Feb 18 20:49:02.170005 2026] [:error] [pid 11548:tid 11582] [client 20.46.124.66:15015] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/miansha.php"] [unique_id "aZW1PjSFZiBIZZvmIlMMsAAAAgQ"]
[Wed Feb 18 20:49:02.407298 2026] [:error] [pid 21848:tid 21898] [client 20.46.124.66:3469] [client 20.46.124.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aZW1PvbG91VRkVidT5dEuwAAAEk"]
[Wed Feb 18 20:49:02.654009 2026] [:error] [pid 11512:tid 11538] [client 20.46.124.66:14983] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aZW1PhGamu0xQuQ-jbFaBAAAAZU"]
[Wed Feb 18 20:49:03.007943 2026] [:error] [pid 11548:tid 11583] [client 20.46.124.66:15587] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aZW1PzSFZiBIZZvmIlMMsQAAAgU"]
[Wed Feb 18 20:49:03.244262 2026] [:error] [pid 11548:tid 11601] [client 20.46.124.66:16350] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aZW1PzSFZiBIZZvmIlMMsgAAAhc"]
[Wed Feb 18 20:49:03.613459 2026] [:error] [pid 5561:tid 5574] [client 20.46.124.66:16318] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ok.php"] [unique_id "aZW1P0oQssCZYQ4NexbYYQAAAUo"]
[Wed Feb 18 20:49:03.916308 2026] [:error] [pid 11548:tid 11578] [client 20.46.124.66:16895] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ok.php"] [unique_id "aZW1PzSFZiBIZZvmIlMMtwAAAgA"]
[Wed Feb 18 20:49:04.189714 2026] [:error] [pid 11610:tid 11671] [client 20.46.124.66:30202] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ok.php"] [unique_id "aZW1QLWMUt4MNfN7mx3SXwAAAsA"]
[Wed Feb 18 20:49:04.460033 2026] [:error] [pid 5561:tid 5584] [client 20.46.124.66:16264] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ok.php"] [unique_id "aZW1QEoQssCZYQ4NexbYYwAAAVQ"]
[Wed Feb 18 20:49:04.690955 2026] [:error] [pid 11548:tid 11598] [client 20.46.124.66:30126] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "aZW1QDSFZiBIZZvmIlMMuwAAAhQ"]
[Wed Feb 18 20:49:04.964979 2026] [:error] [pid 11548:tid 11592] [client 20.46.124.66:30167] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "aZW1QDSFZiBIZZvmIlMMvgAAAg4"]
[Wed Feb 18 20:49:05.206229 2026] [:error] [pid 21848:tid 21911] [client 20.46.124.66:20986] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "aZW1QfbG91VRkVidT5dExgAAAFY"]
[Wed Feb 18 20:49:05.602582 2026] [:error] [pid 21848:tid 21907] [client 20.46.124.66:14993] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "aZW1QfbG91VRkVidT5dExwAAAFI"]
[Wed Feb 18 20:49:05.874636 2026] [:error] [pid 11607:tid 11627] [client 20.46.124.66:29559] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/muzu.php"] [unique_id "aZW1QRw91ggRx3FA7BfscwAAAkw"]
[Wed Feb 18 20:49:06.143405 2026] [:error] [pid 11607:tid 11626] [client 20.46.124.66:16794] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/muzu.php"] [unique_id "aZW1Qhw91ggRx3FA7BfsdAAAAks"]
[Wed Feb 18 20:49:06.426756 2026] [:error] [pid 21848:tid 21889] [client 20.46.124.66:16349] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/muzu.php"] [unique_id "aZW1QvbG91VRkVidT5dEyQAAAEA"]
[Wed Feb 18 20:49:06.808173 2026] [:error] [pid 5561:tid 5583] [client 20.46.124.66:16273] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/muzu.php"] [unique_id "aZW1QkoQssCZYQ4NexbYaQAAAVM"]
[Wed Feb 18 20:49:07.048675 2026] [:error] [pid 21848:tid 21898] [client 20.46.124.66:16834] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/reze.php"] [unique_id "aZW1Q_bG91VRkVidT5dEzAAAAEk"]
[Wed Feb 18 20:49:07.281794 2026] [:error] [pid 21847:tid 21871] [client 20.46.124.66:16272] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/reze.php"] [unique_id "aZW1Q_y9A5wy4LuXmJ0ftwAAAA0"]
[Wed Feb 18 20:49:07.542500 2026] [:error] [pid 11607:tid 11618] [client 20.46.124.66:14999] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/reze.php"] [unique_id "aZW1Qxw91ggRx3FA7BfseAAAAkM"]
[Wed Feb 18 20:49:07.824995 2026] [:error] [pid 5561:tid 5573] [client 20.46.124.66:16833] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/reze.php"] [unique_id "aZW1Q0oQssCZYQ4NexbYbQAAAUk"]
[Wed Feb 18 20:49:08.094506 2026] [:error] [pid 11512:tid 11537] [client 20.46.124.66:30140] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/styll.php"] [unique_id "aZW1RBGamu0xQuQ-jbFaDwAAAZQ"]
[Wed Feb 18 20:49:08.334141 2026] [:error] [pid 11512:tid 11528] [client 20.46.124.66:29535] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/styll.php"] [unique_id "aZW1RBGamu0xQuQ-jbFaEAAAAYs"]
[Wed Feb 18 20:49:08.600006 2026] [:error] [pid 11607:tid 11628] [client 20.46.124.66:16880] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/styll.php"] [unique_id "aZW1RBw91ggRx3FA7BfsfAAAAk0"]
[Wed Feb 18 20:49:08.921252 2026] [:error] [pid 11611:tid 11712] [client 20.46.124.66:15561] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/styll.php"] [unique_id "aZW1RO2m6IPN_aBZuKZwtgAAAw4"]
[Wed Feb 18 20:49:09.228939 2026] [:error] [pid 57014:tid 57038] [client 20.46.124.66:16814] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x7.php"] [unique_id "aZW1RRNZnhS5qKtVIMI0jAAAARU"]
[Wed Feb 18 20:49:09.469256 2026] [:error] [pid 57014:tid 57021] [client 20.46.124.66:14987] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x7.php"] [unique_id "aZW1RRNZnhS5qKtVIMI0jgAAAQQ"]
[Wed Feb 18 20:49:09.799169 2026] [:error] [pid 21847:tid 21865] [client 20.46.124.66:20179] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x7.php"] [unique_id "aZW1Rfy9A5wy4LuXmJ0fuwAAAAc"]
[Wed Feb 18 20:49:10.129565 2026] [:error] [pid 21847:tid 21861] [client 20.46.124.66:29466] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x7.php"] [unique_id "aZW1Rvy9A5wy4LuXmJ0fvQAAAAM"]
[Wed Feb 18 20:49:10.396157 2026] [:error] [pid 21847:tid 21860] [client 20.46.124.66:16868] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thebe.php"] [unique_id "aZW1Rvy9A5wy4LuXmJ0fvwAAAAI"]
[Wed Feb 18 20:49:10.679284 2026] [:error] [pid 21847:tid 21868] [client 20.46.124.66:16850] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thebe.php"] [unique_id "aZW1Rvy9A5wy4LuXmJ0fwQAAAAo"]
[Wed Feb 18 20:49:10.974571 2026] [:error] [pid 57014:tid 57039] [client 20.46.124.66:14979] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thebe.php"] [unique_id "aZW1RhNZnhS5qKtVIMI0jwAAARY"]
[Wed Feb 18 20:49:11.309866 2026] [:error] [pid 5561:tid 5576] [client 20.46.124.66:30154] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thebe.php"] [unique_id "aZW1R0oQssCZYQ4NexbYfQAAAUw"]
[Wed Feb 18 20:49:11.601506 2026] [:error] [pid 11607:tid 11631] [client 20.46.124.66:16343] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ddd.php"] [unique_id "aZW1Rxw91ggRx3FA7BfshAAAAlA"]
[Wed Feb 18 20:49:11.976636 2026] [:error] [pid 57014:tid 57025] [client 20.46.124.66:29489] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ddd.php"] [unique_id "aZW1RxNZnhS5qKtVIMI0kwAAAQg"]
[Wed Feb 18 20:49:12.210256 2026] [:error] [pid 11610:tid 11685] [client 20.46.124.66:3293] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ddd.php"] [unique_id "aZW1SLWMUt4MNfN7mx3SZgAAAs4"]
[Wed Feb 18 20:49:12.826485 2026] [:error] [pid 11607:tid 11618] [client 20.46.124.66:16269] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ddd.php"] [unique_id "aZW1SBw91ggRx3FA7BfshQAAAkM"]
[Wed Feb 18 20:49:13.138680 2026] [:error] [pid 21847:tid 21865] [client 20.46.124.66:30085] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aZW1Sfy9A5wy4LuXmJ0fzwAAAAc"]
[Wed Feb 18 20:49:13.391974 2026] [:error] [pid 11611:tid 11709] [client 20.46.124.66:30152] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aZW1Se2m6IPN_aBZuKZwwQAAAws"]
[Wed Feb 18 20:49:13.626915 2026] [:error] [pid 11610:tid 11673] [client 20.46.124.66:16892] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aZW1SbWMUt4MNfN7mx3SbAAAAsI"]
[Wed Feb 18 20:49:13.941599 2026] [:error] [pid 21847:tid 21861] [client 20.46.124.66:29907] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aZW1Sfy9A5wy4LuXmJ0f0QAAAAM"]
[Wed Feb 18 20:49:14.200658 2026] [:error] [pid 11610:tid 11689] [client 20.46.124.66:30420] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8xyz.php"] [unique_id "aZW1SrWMUt4MNfN7mx3ScAAAAtI"]
[Wed Feb 18 20:49:14.486134 2026] [:error] [pid 11610:tid 11677] [client 20.46.124.66:25160] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8xyz.php"] [unique_id "aZW1SrWMUt4MNfN7mx3ScgAAAsY"]
[Wed Feb 18 20:49:14.725138 2026] [:error] [pid 11548:tid 11580] [client 20.46.124.66:16317] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8xyz.php"] [unique_id "aZW1SjSFZiBIZZvmIlMMxAAAAgI"]
[Wed Feb 18 20:49:14.963604 2026] [:error] [pid 11611:tid 11718] [client 20.46.124.66:30430] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8xyz.php"] [unique_id "aZW1Su2m6IPN_aBZuKZwygAAAxQ"]
[Wed Feb 18 20:49:15.222723 2026] [:error] [pid 11548:tid 11592] [client 20.46.124.66:16810] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi.php"] [unique_id "aZW1SzSFZiBIZZvmIlMMxgAAAg4"]
[Wed Feb 18 20:49:15.558186 2026] [:error] [pid 21848:tid 21906] [client 20.46.124.66:16316] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi.php"] [unique_id "aZW1S_bG91VRkVidT5dE3AAAAFE"]
[Wed Feb 18 20:49:15.834089 2026] [:error] [pid 57014:tid 57035] [client 20.46.124.66:14989] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi.php"] [unique_id "aZW1SxNZnhS5qKtVIMI0nQAAARI"]
[Wed Feb 18 20:49:16.208733 2026] [:error] [pid 11607:tid 11633] [client 20.46.124.66:30452] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi.php"] [unique_id "aZW1TBw91ggRx3FA7BfshgAAAlI"]
[Wed Feb 18 20:49:16.512516 2026] [:error] [pid 57014:tid 57018] [client 20.46.124.66:29856] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xpwer1.php"] [unique_id "aZW1TBNZnhS5qKtVIMI0pAAAAQE"]
[Wed Feb 18 20:49:16.769978 2026] [:error] [pid 11610:tid 11680] [client 20.46.124.66:30100] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xpwer1.php"] [unique_id "aZW1TLWMUt4MNfN7mx3SdwAAAsk"]
[Wed Feb 18 20:49:17.028090 2026] [:error] [pid 57014:tid 57019] [client 20.46.124.66:29870] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xpwer1.php"] [unique_id "aZW1TRNZnhS5qKtVIMI0qQAAAQI"]
[Wed Feb 18 20:49:17.284120 2026] [:error] [pid 57014:tid 57028] [client 20.46.124.66:29847] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xpwer1.php"] [unique_id "aZW1TRNZnhS5qKtVIMI0rAAAAQs"]
[Wed Feb 18 20:49:17.516675 2026] [:error] [pid 5561:tid 5581] [client 20.46.124.66:3569] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "aZW1TUoQssCZYQ4NexbYhAAAAVE"]
[Wed Feb 18 20:49:17.757512 2026] [:error] [pid 21848:tid 21894] [client 20.46.124.66:30381] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "aZW1TfbG91VRkVidT5dE4wAAAEU"]
[Wed Feb 18 20:49:29.026776 2026] [:error] [pid 57014:tid 57017] [client 20.46.124.66:30372] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/"] [unique_id "aZW1WRNZnhS5qKtVIMI01wAAAQA"]
[Wed Feb 18 20:49:29.267845 2026] [:error] [pid 11610:tid 11681] [client 20.46.124.66:29476] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/"] [unique_id "aZW1WbWMUt4MNfN7mx3SfwAAAso"]
[Wed Feb 18 20:49:29.503431 2026] [:error] [pid 11548:tid 11595] [client 20.46.124.66:30337] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/"] [unique_id "aZW1WTSFZiBIZZvmIlMM1QAAAhE"]
[Wed Feb 18 20:49:29.746579 2026] [:error] [pid 11611:tid 11711] [client 20.46.124.66:30119] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/"] [unique_id "aZW1We2m6IPN_aBZuKZw4AAAAw0"]
[Wed Feb 18 20:49:30.044642 2026] [:error] [pid 11548:tid 11590] [client 20.46.124.66:16842] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aZW1WjSFZiBIZZvmIlMM1gAAAgw"]
[Wed Feb 18 20:49:30.296863 2026] [:error] [pid 21847:tid 21863] [client 20.46.124.66:29948] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aZW1Wvy9A5wy4LuXmJ0f3wAAAAU"]
[Wed Feb 18 20:49:30.547138 2026] [:error] [pid 57014:tid 57026] [client 20.46.124.66:20169] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aZW1WhNZnhS5qKtVIMI02gAAAQk"]
[Wed Feb 18 20:49:30.887045 2026] [:error] [pid 11548:tid 11589] [client 20.46.124.66:29907] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aZW1WjSFZiBIZZvmIlMM2QAAAgs"]
[Wed Feb 18 20:49:31.125928 2026] [:error] [pid 11611:tid 11716] [client 20.46.124.66:29937] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZW1W-2m6IPN_aBZuKZw4QAAAxI"]
[Wed Feb 18 20:49:31.451479 2026] [:error] [pid 11609:tid 11652] [client 20.46.124.66:30089] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZW1W8hm3UjgaKO2Na80cwAAAok"]
[Wed Feb 18 20:49:31.776456 2026] [:error] [pid 57014:tid 57017] [client 20.46.124.66:16890] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZW1WxNZnhS5qKtVIMI05wAAAQA"]
[Wed Feb 18 20:49:32.011283 2026] [:error] [pid 11607:tid 11617] [client 20.46.124.66:15029] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aZW1XBw91ggRx3FA7BfsmAAAAkI"]
[Wed Feb 18 20:49:32.320962 2026] [:error] [pid 5561:tid 5584] [client 20.46.124.66:30336] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f5.php"] [unique_id "aZW1XEoQssCZYQ4NexbYlgAAAVQ"]
[Wed Feb 18 20:49:32.547195 2026] [:error] [pid 5561:tid 5571] [client 20.46.124.66:30341] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f5.php"] [unique_id "aZW1XEoQssCZYQ4NexbYmAAAAUc"]
[Wed Feb 18 20:49:32.969459 2026] [:error] [pid 5561:tid 5566] [client 20.46.124.66:30383] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f5.php"] [unique_id "aZW1XEoQssCZYQ4NexbYmwAAAUI"]
[Wed Feb 18 20:49:33.234161 2026] [:error] [pid 57014:tid 57028] [client 20.46.124.66:30412] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f5.php"] [unique_id "aZW1XRNZnhS5qKtVIMI0_QAAAQs"]
[Wed Feb 18 20:49:33.725214 2026] [:error] [pid 21847:tid 21877] [client 20.46.124.66:16785] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "aZW1Xfy9A5wy4LuXmJ0f9QAAABM"]
[Wed Feb 18 20:49:33.974360 2026] [:error] [pid 11609:tid 11667] [client 20.46.124.66:29565] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "aZW1Xchm3UjgaKO2Na80dQAAApc"]
[Wed Feb 18 20:49:34.276591 2026] [:error] [pid 57014:tid 57026] [client 20.46.124.66:16864] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "aZW1XhNZnhS5qKtVIMI0_wAAAQk"]
[Wed Feb 18 20:49:34.576655 2026] [:error] [pid 11609:tid 11645] [client 20.46.124.66:16807] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "aZW1Xshm3UjgaKO2Na80dgAAAoI"]
[Wed Feb 18 20:49:34.967787 2026] [:error] [pid 11609:tid 11666] [client 20.46.124.66:30340] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aZW1Xshm3UjgaKO2Na80eAAAApY"]
[Wed Feb 18 20:49:35.309102 2026] [:error] [pid 11609:tid 11658] [client 20.46.124.66:16797] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aZW1X8hm3UjgaKO2Na80eQAAAo8"]
[Wed Feb 18 20:49:35.580502 2026] [:error] [pid 5561:tid 5575] [client 20.46.124.66:15026] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aZW1X0oQssCZYQ4NexbYnwAAAUs"]
[Wed Feb 18 20:49:35.879488 2026] [:error] [pid 11548:tid 11600] [client 20.46.124.66:29933] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aZW1XzSFZiBIZZvmIlMM6AAAAhY"]
[Wed Feb 18 20:49:36.142823 2026] [:error] [pid 11609:tid 11662] [client 20.46.124.66:29491] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aZW1YMhm3UjgaKO2Na80ewAAApI"]
[Wed Feb 18 20:49:36.370605 2026] [:error] [pid 21848:tid 21891] [client 20.46.124.66:16815] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aZW1YPbG91VRkVidT5dE9QAAAEI"]
[Wed Feb 18 20:49:36.650418 2026] [:error] [pid 5561:tid 5578] [client 20.46.124.66:30203] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aZW1YEoQssCZYQ4NexbYoQAAAU4"]
[Wed Feb 18 20:49:36.989397 2026] [:error] [pid 11607:tid 11624] [client 20.46.124.66:29529] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aZW1YBw91ggRx3FA7BfsoAAAAkk"]
[Wed Feb 18 20:49:37.233529 2026] [:error] [pid 21848:tid 21895] [client 20.46.124.66:15851] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/"] [unique_id "aZW1YfbG91VRkVidT5dE9gAAAEY"]
[Wed Feb 18 20:49:37.514783 2026] [:error] [pid 5561:tid 5574] [client 20.46.124.66:29825] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/"] [unique_id "aZW1YUoQssCZYQ4NexbYogAAAUo"]
[Wed Feb 18 20:49:37.746638 2026] [:error] [pid 11548:tid 11595] [client 20.46.124.66:30453] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/"] [unique_id "aZW1YTSFZiBIZZvmIlMM7QAAAhE"]
[Wed Feb 18 20:49:38.044684 2026] [:error] [pid 21848:tid 21912] [client 20.46.124.66:15000] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/"] [unique_id "aZW1YvbG91VRkVidT5dE-AAAAFc"]
[Wed Feb 18 20:49:38.278219 2026] [:error] [pid 11609:tid 11657] [client 20.46.124.66:16878] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "aZW1Yshm3UjgaKO2Na80fwAAAo4"]
[Wed Feb 18 20:49:38.546767 2026] [:error] [pid 5561:tid 5565] [client 20.46.124.66:29481] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "aZW1YkoQssCZYQ4NexbYpwAAAUE"]
[Wed Feb 18 20:49:38.849608 2026] [:error] [pid 21847:tid 21877] [client 20.46.124.66:16306] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "aZW1Yvy9A5wy4LuXmJ0gAAAAABM"]
[Wed Feb 18 20:49:39.104161 2026] [:error] [pid 57014:tid 57023] [client 20.46.124.66:30433] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "aZW1YxNZnhS5qKtVIMI1CAAAAQY"]
[Wed Feb 18 20:49:39.568142 2026] [:error] [pid 11610:tid 11690] [client 20.46.124.66:29542] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aZW1Y7WMUt4MNfN7mx3ShwAAAtM"]
[Wed Feb 18 20:49:40.048841 2026] [:error] [pid 57014:tid 57029] [client 20.46.124.66:30463] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aZW1ZBNZnhS5qKtVIMI1CQAAAQw"]
[Wed Feb 18 20:49:40.293881 2026] [:error] [pid 11609:tid 11652] [client 20.46.124.66:20181] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aZW1ZMhm3UjgaKO2Na80hQAAAok"]
[Wed Feb 18 20:49:40.548606 2026] [:error] [pid 11609:tid 11661] [client 20.46.124.66:15020] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aZW1ZMhm3UjgaKO2Na80hgAAApE"]
[Wed Feb 18 20:49:40.857540 2026] [:error] [pid 5561:tid 5566] [client 20.46.124.66:30384] [client 20.46.124.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aZW1ZEoQssCZYQ4NexbYqgAAAUI"]
[Wed Feb 18 20:49:41.144405 2026] [:error] [pid 21847:tid 21860] [client 20.46.124.66:15016] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aZW1Zfy9A5wy4LuXmJ0gCAAAAAI"]
[Wed Feb 18 20:49:41.382328 2026] [:error] [pid 21847:tid 21864] [client 20.46.124.66:16844] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aZW1Zfy9A5wy4LuXmJ0gCQAAAAY"]
[Wed Feb 18 20:49:41.621022 2026] [:error] [pid 21848:tid 21898] [client 20.46.124.66:3696] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aZW1ZfbG91VRkVidT5dFAgAAAEk"]
[Wed Feb 18 20:49:41.907001 2026] [:error] [pid 11609:tid 11667] [client 20.46.124.66:3301] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aZW1Zchm3UjgaKO2Na80iQAAApc"]
[Wed Feb 18 20:49:42.357199 2026] [:error] [pid 21847:tid 21875] [client 20.46.124.66:3655] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jane.php"] [unique_id "aZW1Zvy9A5wy4LuXmJ0gDAAAABE"]
[Wed Feb 18 20:49:42.605087 2026] [:error] [pid 21847:tid 21870] [client 20.46.124.66:29530] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jane.php"] [unique_id "aZW1Zvy9A5wy4LuXmJ0gDwAAAAw"]
[Wed Feb 18 20:49:42.851454 2026] [:error] [pid 11512:tid 11538] [client 20.46.124.66:20985] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jane.php"] [unique_id "aZW1ZhGamu0xQuQ-jbFaJwAAAZU"]
[Wed Feb 18 20:49:43.079568 2026] [:error] [pid 11607:tid 11636] [client 20.46.124.66:30399] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jane.php"] [unique_id "aZW1Zxw91ggRx3FA7BfsqgAAAlU"]
[Wed Feb 18 20:49:43.337338 2026] [:error] [pid 11548:tid 11579] [client 20.46.124.66:15007] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aZW1ZzSFZiBIZZvmIlMM9AAAAgE"]
[Wed Feb 18 20:49:43.755960 2026] [:error] [pid 21847:tid 21879] [client 20.46.124.66:3654] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aZW1Z_y9A5wy4LuXmJ0gEQAAABU"]
[Wed Feb 18 20:49:47.106907 2026] [:error] [pid 11611:tid 11706] [client 20.46.124.66:30396] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aZW1a-2m6IPN_aBZuKZw8AAAAwg"]
[Wed Feb 18 20:49:48.377120 2026] [:error] [pid 21847:tid 21865] [client 20.46.124.66:29449] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aZW1bPy9A5wy4LuXmJ0gGQAAAAc"]
[Wed Feb 18 20:49:51.892381 2026] [:error] [pid 21848:tid 21906] [client 20.46.124.66:17861] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aZW1b_bG91VRkVidT5dFGQAAAFE"]
[Wed Feb 18 20:49:55.880777 2026] [:error] [pid 21848:tid 21909] [client 20.46.124.66:18868] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aZW1c_bG91VRkVidT5dFHgAAAFQ"]
[Wed Feb 18 20:50:01.030500 2026] [:error] [pid 21847:tid 21878] [client 20.46.124.66:18572] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aZW1efy9A5wy4LuXmJ0gJAAAABQ"]
[Wed Feb 18 20:50:03.010123 2026] [:error] [pid 21848:tid 21894] [client 20.46.124.66:28452] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aZW1e_bG91VRkVidT5dFLgAAAEU"]
[Wed Feb 18 20:50:05.440108 2026] [:error] [pid 11609:tid 11658] [client 20.46.124.66:18089] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "aZW1fchm3UjgaKO2Na80rwAAAo8"]
[Wed Feb 18 20:50:05.989105 2026] [:error] [pid 5561:tid 5569] [client 20.46.124.66:19407] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "aZW1fUoQssCZYQ4NexbYxwAAAUU"]
[Wed Feb 18 20:50:06.284772 2026] [:error] [pid 21847:tid 21866] [client 20.46.124.66:21640] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "aZW1fvy9A5wy4LuXmJ0gKQAAAAg"]
[Wed Feb 18 20:50:06.566310 2026] [:error] [pid 21848:tid 21901] [client 20.46.124.66:3249] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "aZW1fvbG91VRkVidT5dFNwAAAEw"]
[Wed Feb 18 20:50:06.916443 2026] [:error] [pid 11607:tid 11620] [client 20.46.124.66:19371] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aZW1fhw91ggRx3FA7BfswgAAAkU"]
[Wed Feb 18 20:50:07.375655 2026] [:error] [pid 21847:tid 21862] [client 20.46.124.66:18077] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aZW1f_y9A5wy4LuXmJ0gLQAAAAQ"]
[Wed Feb 18 20:50:07.740021 2026] [:error] [pid 57014:tid 57021] [client 20.46.124.66:22862] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aZW1fxNZnhS5qKtVIMI1JgAAAQQ"]
[Wed Feb 18 20:50:07.984030 2026] [:error] [pid 57014:tid 57027] [client 20.46.124.66:19424] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aZW1fxNZnhS5qKtVIMI1JwAAAQo"]
[Wed Feb 18 20:50:08.292564 2026] [:error] [pid 21848:tid 21910] [client 20.46.124.66:24408] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxxx.php"] [unique_id "aZW1gPbG91VRkVidT5dFOgAAAFU"]
[Wed Feb 18 20:50:08.560586 2026] [:error] [pid 21848:tid 21894] [client 20.46.124.66:24391] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxxx.php"] [unique_id "aZW1gPbG91VRkVidT5dFPAAAAEU"]
[Wed Feb 18 20:50:08.829200 2026] [:error] [pid 11548:tid 11593] [client 20.46.124.66:19396] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxxx.php"] [unique_id "aZW1gDSFZiBIZZvmIlMNCAAAAg8"]
[Wed Feb 18 20:50:09.240501 2026] [:error] [pid 21847:tid 21869] [client 20.46.124.66:29880] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxxx.php"] [unique_id "aZW1gfy9A5wy4LuXmJ0gMgAAAAs"]
[Wed Feb 18 20:50:09.529350 2026] [:error] [pid 57014:tid 57040] [client 20.46.124.66:3218] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aZW1gRNZnhS5qKtVIMI1LQAAARc"]
[Wed Feb 18 20:50:09.786664 2026] [:error] [pid 57014:tid 57038] [client 20.46.124.66:3391] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aZW1gRNZnhS5qKtVIMI1LgAAARU"]
[Wed Feb 18 20:50:10.167113 2026] [:error] [pid 5561:tid 5582] [client 20.46.124.66:27634] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aZW1gkoQssCZYQ4NexbY0AAAAVI"]
[Wed Feb 18 20:50:10.473046 2026] [:error] [pid 57014:tid 57028] [client 20.46.124.66:3359] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aZW1ghNZnhS5qKtVIMI1MgAAAQs"]
[Wed Feb 18 20:50:10.720112 2026] [:error] [pid 11609:tid 11643] [client 20.46.124.66:15282] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aZW1gshm3UjgaKO2Na80tQAAAoA"]
[Wed Feb 18 20:50:10.978181 2026] [:error] [pid 11609:tid 11667] [client 20.46.124.66:3212] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aZW1gshm3UjgaKO2Na80tgAAApc"]
[Wed Feb 18 20:50:11.213169 2026] [:error] [pid 21847:tid 21877] [client 20.46.124.66:15264] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aZW1g_y9A5wy4LuXmJ0gQQAAABM"]
[Wed Feb 18 20:50:11.521128 2026] [:error] [pid 21848:tid 21889] [client 20.46.124.66:28416] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aZW1g_bG91VRkVidT5dFPgAAAEA"]
[Wed Feb 18 20:50:11.793788 2026] [:error] [pid 57014:tid 57029] [client 20.46.124.66:22904] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aZW1gxNZnhS5qKtVIMI1NgAAAQw"]
[Wed Feb 18 20:50:12.095217 2026] [:error] [pid 57014:tid 57037] [client 20.46.124.66:22909] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aZW1hBNZnhS5qKtVIMI1NwAAARQ"]
[Wed Feb 18 20:50:12.327537 2026] [:error] [pid 57014:tid 57021] [client 20.46.124.66:20877] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aZW1hBNZnhS5qKtVIMI1OAAAAQQ"]
[Wed Feb 18 20:50:12.612257 2026] [:error] [pid 57014:tid 57039] [client 20.46.124.66:15271] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aZW1hBNZnhS5qKtVIMI1OgAAARY"]
[Wed Feb 18 20:50:13.024516 2026] [:error] [pid 21848:tid 21905] [client 20.46.124.66:24418] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "aZW1hfbG91VRkVidT5dFPwAAAFA"]
[Wed Feb 18 20:50:13.253390 2026] [:error] [pid 57014:tid 57038] [client 20.46.124.66:22896] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "aZW1hRNZnhS5qKtVIMI1PQAAARU"]
[Wed Feb 18 20:50:13.508772 2026] [:error] [pid 57014:tid 57025] [client 20.46.124.66:3368] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "aZW1hRNZnhS5qKtVIMI1PwAAAQg"]
[Wed Feb 18 20:50:13.907875 2026] [:error] [pid 21847:tid 21858] [client 20.46.124.66:15291] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "aZW1hfy9A5wy4LuXmJ0gSgAAAAA"]
[Wed Feb 18 20:50:14.265887 2026] [:error] [pid 21847:tid 21867] [client 20.46.124.66:24422] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aZW1hvy9A5wy4LuXmJ0gTAAAAAk"]
[Wed Feb 18 20:50:14.622578 2026] [:error] [pid 21847:tid 21869] [client 20.46.124.66:12885] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aZW1hvy9A5wy4LuXmJ0gUAAAAAs"]
[Wed Feb 18 20:50:15.091523 2026] [:error] [pid 21847:tid 21878] [client 20.46.124.66:28258] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aZW1h_y9A5wy4LuXmJ0gVAAAABQ"]
[Wed Feb 18 20:50:15.342131 2026] [:error] [pid 11607:tid 11632] [client 20.46.124.66:22876] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aZW1hxw91ggRx3FA7BfsyAAAAlE"]
[Wed Feb 18 20:50:15.612390 2026] [:error] [pid 11609:tid 11645] [client 20.46.124.66:27586] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "aZW1h8hm3UjgaKO2Na80twAAAoI"]
[Wed Feb 18 20:50:15.925022 2026] [:error] [pid 11609:tid 11653] [client 20.46.124.66:22871] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "aZW1h8hm3UjgaKO2Na80uQAAAoo"]
[Wed Feb 18 20:50:16.197152 2026] [:error] [pid 57014:tid 57029] [client 20.46.124.66:3377] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "aZW1iBNZnhS5qKtVIMI1RgAAAQw"]
[Wed Feb 18 20:50:16.517909 2026] [:error] [pid 11609:tid 11656] [client 20.46.124.66:22883] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "aZW1iMhm3UjgaKO2Na80ugAAAo0"]
[Wed Feb 18 20:50:16.988047 2026] [:error] [pid 21847:tid 21871] [client 20.46.124.66:3354] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blurbs18.php"] [unique_id "aZW1iPy9A5wy4LuXmJ0gVwAAAA0"]
[Wed Feb 18 20:50:17.341820 2026] [:error] [pid 57014:tid 57040] [client 20.46.124.66:20868] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blurbs18.php"] [unique_id "aZW1iRNZnhS5qKtVIMI1TQAAARc"]
[Wed Feb 18 20:50:17.696687 2026] [:error] [pid 11607:tid 11621] [client 20.46.124.66:22867] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blurbs18.php"] [unique_id "aZW1iRw91ggRx3FA7BfsywAAAkY"]
[Wed Feb 18 20:50:18.058964 2026] [:error] [pid 11609:tid 11666] [client 20.46.124.66:24419] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blurbs18.php"] [unique_id "aZW1ishm3UjgaKO2Na80vAAAApY"]
[Wed Feb 18 20:50:18.604296 2026] [:error] [pid 21847:tid 21860] [client 20.46.124.66:28236] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aZW1ivy9A5wy4LuXmJ0gXwAAAAI"]
[Wed Feb 18 20:50:19.061065 2026] [:error] [pid 11609:tid 11659] [client 20.46.124.66:24389] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aZW1i8hm3UjgaKO2Na80vgAAApA"]
[Wed Feb 18 20:50:19.300271 2026] [:error] [pid 11607:tid 11638] [client 20.46.124.66:27582] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aZW1ixw91ggRx3FA7BfszwAAAlc"]
[Wed Feb 18 20:50:19.608248 2026] [:error] [pid 11609:tid 11651] [client 20.46.124.66:28236] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aZW1i8hm3UjgaKO2Na80wAAAAog"]
[Wed Feb 18 20:50:19.862605 2026] [:error] [pid 57014:tid 57039] [client 20.46.124.66:26879] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aZW1ixNZnhS5qKtVIMI1VwAAARY"]
[Wed Feb 18 20:50:20.145461 2026] [:error] [pid 21847:tid 21858] [client 20.46.124.66:27645] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aZW1jPy9A5wy4LuXmJ0gZAAAAAA"]
[Wed Feb 18 20:50:20.397985 2026] [:error] [pid 21848:tid 21911] [client 20.46.124.66:3350] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aZW1jPbG91VRkVidT5dFSwAAAFY"]
[Wed Feb 18 20:50:20.838520 2026] [:error] [pid 57014:tid 57019] [client 20.46.124.66:3363] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/about.php"] [unique_id "aZW1jBNZnhS5qKtVIMI1XAAAAQI"]
[Wed Feb 18 20:50:21.138458 2026] [:error] [pid 57014:tid 57017] [client 20.46.124.66:28029] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aZW1jRNZnhS5qKtVIMI1YAAAAQA"]
[Wed Feb 18 20:50:21.533169 2026] [:error] [pid 11611:tid 11718] [client 20.46.124.66:14742] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aZW1je2m6IPN_aBZuKZxAAAAAxQ"]
[Wed Feb 18 20:50:21.829964 2026] [:error] [pid 11611:tid 11698] [client 20.46.124.66:27933] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aZW1je2m6IPN_aBZuKZxAwAAAwA"]
[Wed Feb 18 20:50:22.504226 2026] [:error] [pid 21847:tid 21869] [client 20.46.124.66:15254] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aZW1jvy9A5wy4LuXmJ0gZwAAAAs"]
[Wed Feb 18 20:50:23.208573 2026] [:error] [pid 21847:tid 21860] [client 20.46.124.66:30866] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aZW1j_y9A5wy4LuXmJ0gaQAAAAI"]
[Wed Feb 18 20:50:23.573454 2026] [:error] [pid 21847:tid 21878] [client 20.46.124.66:28237] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aZW1j_y9A5wy4LuXmJ0gawAAABQ"]
[Wed Feb 18 20:50:24.045652 2026] [:error] [pid 11611:tid 11707] [client 20.46.124.66:26848] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aZW1kO2m6IPN_aBZuKZxCwAAAwk"]
[Wed Feb 18 20:50:24.675184 2026] [:error] [pid 21848:tid 21897] [client 20.46.124.66:27940] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aZW1kPbG91VRkVidT5dFTwAAAEg"]
[Wed Feb 18 20:50:24.974920 2026] [:error] [pid 11609:tid 11663] [client 20.46.124.66:30947] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aZW1kMhm3UjgaKO2Na80wgAAApM"]
[Wed Feb 18 20:50:25.803951 2026] [:error] [pid 57014:tid 57024] [client 20.46.124.66:26817] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aZW1kRNZnhS5qKtVIMI1awAAAQc"]
[Wed Feb 18 20:50:26.386189 2026] [:error] [pid 11609:tid 11650] [client 20.46.124.66:27937] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aZW1kshm3UjgaKO2Na80yAAAAoc"]
[Wed Feb 18 20:50:26.680064 2026] [:error] [pid 21848:tid 21909] [client 20.46.124.66:28186] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aZW1kvbG91VRkVidT5dFVQAAAFQ"]
[Wed Feb 18 20:50:27.176057 2026] [:error] [pid 21848:tid 21899] [client 20.46.124.66:30904] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/admin.php"] [unique_id "aZW1k_bG91VRkVidT5dFVwAAAEo"]
[Wed Feb 18 20:50:27.793439 2026] [:error] [pid 11611:tid 11699] [client 20.46.124.66:30923] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/admin.php"] [unique_id "aZW1k-2m6IPN_aBZuKZxDwAAAwE"]
[Wed Feb 18 20:50:38.350526 2026] [:error] [pid 11607:tid 11625] [client 20.46.124.66:15805] [client 20.46.124.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.46.124.66, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZW1nhw91ggRx3FA7Bfs4QAAAko"]
[Wed Feb 18 20:50:40.412774 2026] [:error] [pid 11610:tid 11682] [client 20.46.124.66:14779] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.php"] [unique_id "aZW1oLWMUt4MNfN7mx3SxAAAAss"]
[Wed Feb 18 20:50:41.937423 2026] [:error] [pid 11607:tid 11631] [client 20.46.124.66:3078] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.php"] [unique_id "aZW1oRw91ggRx3FA7Bfs5QAAAlA"]
[Wed Feb 18 20:50:42.529826 2026] [:error] [pid 11512:tid 11534] [client 20.46.124.66:3158] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.php"] [unique_id "aZW1ohGamu0xQuQ-jbFaNwAAAZE"]
[Wed Feb 18 20:50:42.960077 2026] [:error] [pid 11607:tid 11621] [client 20.46.124.66:15753] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.php"] [unique_id "aZW1ohw91ggRx3FA7Bfs5wAAAkY"]
[Wed Feb 18 20:50:45.338770 2026] [:error] [pid 11610:tid 11673] [client 20.46.124.66:25472] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aZW1pbWMUt4MNfN7mx3SxgAAAsI"]
[Wed Feb 18 20:50:46.073603 2026] [:error] [pid 21848:tid 21897] [client 20.46.124.66:27157] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aZW1pvbG91VRkVidT5dFawAAAEg"]
[Wed Feb 18 20:50:46.978963 2026] [:error] [pid 21848:tid 21909] [client 20.46.124.66:11782] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aZW1pvbG91VRkVidT5dFdQAAAFQ"]
[Wed Feb 18 20:50:47.442043 2026] [:error] [pid 21848:tid 21913] [client 20.46.124.66:3154] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aZW1p_bG91VRkVidT5dFeAAAAFg"]
[Wed Feb 18 20:50:48.083946 2026] [:error] [pid 11611:tid 11717] [client 20.46.124.66:15102] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "aZW1qO2m6IPN_aBZuKZxGAAAAxM"]
[Wed Feb 18 20:50:48.364665 2026] [:error] [pid 57014:tid 57028] [client 20.46.124.66:14837] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "aZW1qBNZnhS5qKtVIMI1cwAAAQs"]
[Wed Feb 18 20:50:49.750245 2026] [:error] [pid 21848:tid 21900] [client 20.46.124.66:15497] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "aZW1qfbG91VRkVidT5dFgAAAAEs"]
[Wed Feb 18 20:50:50.438077 2026] [:error] [pid 21848:tid 21906] [client 20.46.124.66:3147] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "aZW1qvbG91VRkVidT5dFgQAAAFE"]
[Wed Feb 18 20:50:50.841335 2026] [:error] [pid 21847:tid 21872] [client 20.46.124.66:25533] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "aZW1qvy9A5wy4LuXmJ0ghAAAAA4"]
[Wed Feb 18 20:50:51.079128 2026] [:error] [pid 11548:tid 11594] [client 20.46.124.66:16042] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "aZW1qzSFZiBIZZvmIlMNEwAAAhA"]
[Wed Feb 18 20:50:51.462801 2026] [:error] [pid 11548:tid 11579] [client 20.46.124.66:25088] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "aZW1qzSFZiBIZZvmIlMNFAAAAgE"]
[Wed Feb 18 20:50:51.791126 2026] [:error] [pid 21848:tid 21897] [client 20.46.124.66:11798] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "aZW1q_bG91VRkVidT5dFggAAAEg"]
[Wed Feb 18 20:50:52.375614 2026] [:error] [pid 21848:tid 21899] [client 20.46.124.66:4061] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aZW1rPbG91VRkVidT5dFgwAAAEo"]
[Wed Feb 18 20:50:52.835407 2026] [:error] [pid 57014:tid 57029] [client 20.46.124.66:25523] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aZW1rBNZnhS5qKtVIMI1eQAAAQw"]
[Wed Feb 18 20:50:53.155628 2026] [:error] [pid 57014:tid 57026] [client 20.46.124.66:3891] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aZW1rRNZnhS5qKtVIMI1fAAAAQk"]
[Wed Feb 18 20:50:53.463937 2026] [:error] [pid 21848:tid 21889] [client 20.46.124.66:15076] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aZW1rfbG91VRkVidT5dFhAAAAEA"]
[Wed Feb 18 20:50:53.774635 2026] [:error] [pid 11610:tid 11678] [client 20.46.124.66:14835] [client 20.46.124.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aZW1rbWMUt4MNfN7mx3SygAAAsc"]
[Wed Feb 18 20:50:54.461437 2026] [:error] [pid 11611:tid 11710] [client 20.46.124.66:3841] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jsond.php"] [unique_id "aZW1ru2m6IPN_aBZuKZxHwAAAww"]
[Wed Feb 18 20:50:55.152809 2026] [:error] [pid 11609:tid 11666] [client 20.46.124.66:11813] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jsond.php"] [unique_id "aZW1r8hm3UjgaKO2Na808gAAApY"]
[Wed Feb 18 20:50:55.473134 2026] [:error] [pid 5561:tid 5565] [client 20.46.124.66:13322] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jsond.php"] [unique_id "aZW1r0oQssCZYQ4NexbY4wAAAUE"]
[Wed Feb 18 20:50:56.023421 2026] [:error] [pid 11611:tid 11722] [client 20.46.124.66:3851] [client 20.46.124.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jsond.php"] [unique_id "aZW1sO2m6IPN_aBZuKZxIQAAAxg"]
[Wed Feb 18 21:08:13.484657 2026] [:error] [pid 11607:tid 11615] [client 34.170.46.5:56348] [client 34.170.46.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.170.46.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZW5vRw91ggRx3FA7BfxCQAAAkA"]
[Wed Feb 18 21:08:18.964306 2026] [:error] [pid 21848:tid 21908] [client 34.67.190.83:43562] [client 34.67.190.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.67.190.83, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZW5wvbG91VRkVidT5dJdAAAAFM"]
[Wed Feb 18 21:08:22.306521 2026] [:error] [pid 5561:tid 5581] [client 134.209.95.224:43930] [client 134.209.95.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.209.95.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZW5xkoQssCZYQ4Nexbb5QAAAVE"]
[Wed Feb 18 21:08:26.897678 2026] [:error] [pid 11548:tid 11584] [client 61.171.113.15:40884] [client 61.171.113.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 61.171.113.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZW5yjSFZiBIZZvmIlMRqgAAAgY"]
[Wed Feb 18 21:08:39.175218 2026] [:error] [pid 21847:tid 21865] [client 101.46.58.127:39048] [client 101.46.58.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 101.46.58.127, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZW51_y9A5wy4LuXmJ0j3AAAAAc"]
[Wed Feb 18 21:08:48.571928 2026] [:error] [pid 11609:tid 11649] [client 35.234.240.84:57550] [client 35.234.240.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.234.240.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZW54Mhm3UjgaKO2Na838AAAAoY"]
[Wed Feb 18 21:08:49.409421 2026] [:error] [pid 11607:tid 11617] [client 45.118.151.91:53408] [client 45.118.151.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.118.151.91, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZW54Rw91ggRx3FA7BfxKgAAAkI"]
[Wed Feb 18 21:08:56.457946 2026] [:error] [pid 21848:tid 21906] [client 43.155.73.192:33416] [client 43.155.73.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.155.73.192, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZW56PbG91VRkVidT5dJhwAAAFE"]
[Wed Feb 18 22:27:46.233498 2026] [:error] [pid 21847:tid 21870] [client 170.106.147.63:52588] [client 170.106.147.63] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZXMYvy9A5wy4LuXmJ0wZwAAAAw"]
[Wed Feb 18 22:58:11.884485 2026] [:error] [pid 11512:tid 11529] [client 47.98.255.122:57764] [client 47.98.255.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.98.255.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZXTgxGamu0xQuQ-jbFsewAAAYw"]
[Wed Feb 18 22:58:12.105483 2026] [:error] [pid 11610:tid 11691] [client 47.82.118.63:45986] [client 47.82.118.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.82.118.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZXThLWMUt4MNfN7mx3qoAAAAtQ"]
[Wed Feb 18 22:58:43.979532 2026] [:error] [pid 57014:tid 57033] [client 193.202.110.33:42166] [client 193.202.110.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.202.110.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZXToxNZnhS5qKtVIMJJLgAAARA"]
[Wed Feb 18 22:58:47.206046 2026] [:error] [pid 11512:tid 11536] [client 193.202.110.33:42180] [client 193.202.110.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.202.110.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZXTpxGamu0xQuQ-jbFslQAAAZM"]
[Wed Feb 18 22:59:00.395097 2026] [:error] [pid 11609:tid 11647] [client 203.59.224.59:58576] [client 203.59.224.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.59.224.59, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZXTtMhm3UjgaKO2Na9IogAAAoQ"]
[Wed Feb 18 22:59:44.410822 2026] [:error] [pid 21848:tid 21906] [client 167.99.116.143:47066] [client 167.99.116.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.116.143, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZXT4PbG91VRkVidT5dihQAAAFE"]
[Thu Feb 19 01:10:03.437712 2026] [:error] [pid 11611:tid 11701] [client 31.177.95.217:41074] [client 31.177.95.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.177.95.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZXya-2m6IPN_aBZuKaaSAAAAwM"]
[Thu Feb 19 01:10:05.268079 2026] [:error] [pid 11610:tid 11683] [client 128.140.71.121:52152] [client 128.140.71.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.140.71.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZXybbWMUt4MNfN7mx0DYwAAAsw"]
[Thu Feb 19 01:10:10.497870 2026] [:error] [pid 11610:tid 11689] [client 82.156.14.49:52968] [client 82.156.14.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.156.14.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZXycrWMUt4MNfN7mx0DZgAAAtI"]
[Thu Feb 19 01:10:19.901077 2026] [:error] [pid 11548:tid 11584] [client 47.98.255.122:51310] [client 47.98.255.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.98.255.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZXyezSFZiBIZZvmIlNXAgAAAgY"]
[Thu Feb 19 01:10:45.392075 2026] [:error] [pid 21848:tid 21898] [client 34.132.81.192:56078] [client 34.132.81.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.132.81.192, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZXylfbG91VRkVidT5eB2AAAAEk"]
[Thu Feb 19 01:10:49.088044 2026] [:error] [pid 11607:tid 11628] [client 184.168.120.235:36754] [client 184.168.120.235] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.168.120.235, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZXymRw91ggRx3FA7BcjaAAAAk0"]
[Thu Feb 19 01:11:09.602245 2026] [:error] [pid 21848:tid 21907] [client 193.202.110.34:60556] [client 193.202.110.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 193.202.110.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZXyrfbG91VRkVidT5eB7wAAAFI"]
[Thu Feb 19 01:11:21.563211 2026] [:error] [pid 11607:tid 11640] [client 191.6.210.119:37592] [client 191.6.210.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.6.210.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZXyuRw91ggRx3FA7BcjgQAAAlg"]
[Thu Feb 19 02:06:04.649249 2026] [:error] [pid 57014:tid 57031] [client 43.153.7.191:58576] [client 43.153.7.191] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZX_jBNZnhS5qKtVIMJjvQAAAQ4"]
[Thu Feb 19 02:14:54.000902 2026] [:error] [pid 21848:tid 21897] [client 103.65.236.149:53567] [client 103.65.236.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aZYBnvbG91VRkVidT5eP_gAAAEg"]
[Thu Feb 19 02:14:54.257640 2026] [:error] [pid 11607:tid 11633] [client 103.65.236.149:53582] [client 103.65.236.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aZYBnhw91ggRx3FA7BcwdwAAAlI"]
[Thu Feb 19 02:37:00.435606 2026] [:error] [pid 57014:tid 57027] [client 34.105.217.55:40784] [client 34.105.217.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.105.217.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZYGzBNZnhS5qKtVIMJo8QAAAQo"]
[Thu Feb 19 08:57:17.200701 2026] [:error] [pid 48901:tid 48931] [client 43.130.139.136:47340] [client 43.130.139.136] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZZf7cixYz-lHbN0WBL-HQAAABU"]
[Thu Feb 19 14:54:31.675221 2026] [:error] [pid 15513:tid 15521] [client 170.106.11.6:45916] [client 170.106.11.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZazp8GTRTE022JWg19wMwAAAQY"]
[Thu Feb 19 16:00:20.358515 2026] [ssl:error] [pid 24048:tid 24073] [client 104.168.28.15:57348] AH02032: Hostname www.cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup, referer: http://www.cdbdinteriors.com.au/
[Thu Feb 19 17:16:06.020709 2026] [:error] [pid 48902:tid 48944] [client 43.157.158.178:55404] [client 43.157.158.178] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZbU1mcJ-6aYRpRRFsUJdQAAAEY"]
[Thu Feb 19 17:38:38.120705 2026] [:error] [pid 15513:tid 15537] [client 34.23.22.61:55403] [client 34.23.22.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.23.22.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZbaHsGTRTE022JWg1-stwAAARY"]
[Thu Feb 19 17:38:40.498611 2026] [:error] [pid 15513:tid 15532] [client 34.23.22.61:55403] [client 34.23.22.61] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aZbaIMGTRTE022JWg1-suwAAARE"]
[Thu Feb 19 17:38:40.743178 2026] [:error] [pid 15513:tid 15522] [client 34.23.22.61:55403] [client 34.23.22.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.23.22.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZbaIMGTRTE022JWg1-svAAAAQc"]
[Thu Feb 19 17:38:42.487915 2026] [:error] [pid 24048:tid 24051] [client 34.23.22.61:58615] [client 34.23.22.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.23.22.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZbaImug6wHHqU0QyDbLDAAAAUE"]
[Thu Feb 19 17:38:44.088259 2026] [:error] [pid 5581:tid 5618] [client 34.23.22.61:62833] [client 34.23.22.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.23.22.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZbaJHIfW0xlXmrVd3qrrgAAAgc"]
[Thu Feb 19 17:38:45.670833 2026] [:error] [pid 48903:tid 48972] [client 34.23.22.61:64467] [client 34.23.22.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.23.22.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZbaJY6aTgKrpAR115vJZwAAAIc"]
[Thu Feb 19 17:38:47.177781 2026] [:error] [pid 48903:tid 48984] [client 34.23.22.61:60567] [client 34.23.22.61] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.23.22.61, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZbaJ46aTgKrpAR115vJawAAAJM"]
[Thu Feb 19 17:38:47.177918 2026] [:error] [pid 48903:tid 48984] [client 34.23.22.61:60567] [client 34.23.22.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.23.22.61, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZbaJ46aTgKrpAR115vJawAAAJM"]
[Thu Feb 19 18:16:49.112225 2026] [:error] [pid 24048:tid 24071] [client 51.83.161.209:52069] [client 51.83.161.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.161.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZbjEWug6wHHqU0QyDbW0wAAAVU"]
[Thu Feb 19 18:16:49.897423 2026] [:error] [pid 24048:tid 24052] [client 51.83.161.209:52069] [client 51.83.161.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.83.161.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZbjEWug6wHHqU0QyDbW1QAAAUI"]
[Thu Feb 19 18:16:52.322966 2026] [:error] [pid 24048:tid 24070] [client 51.83.161.209:52069] [client 51.83.161.209] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aZbjFGug6wHHqU0QyDbW3AAAAVQ"]
[Thu Feb 19 18:16:52.587802 2026] [:error] [pid 24048:tid 24061] [client 51.83.161.209:52069] [client 51.83.161.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.161.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZbjFGug6wHHqU0QyDbW3gAAAUs"]
[Thu Feb 19 18:16:52.589388 2026] [:error] [pid 24048:tid 24061] [client 51.83.161.209:52069] [client 51.83.161.209] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZbjFGug6wHHqU0QyDbW3gAAAUs"]
[Thu Feb 19 18:16:52.590839 2026] [:error] [pid 24048:tid 24061] [client 51.83.161.209:52069] [client 51.83.161.209] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZbjFGug6wHHqU0QyDbW3gAAAUs"]
[Thu Feb 19 18:16:54.206894 2026] [:error] [pid 5580:tid 5583] [client 51.83.161.209:54573] [client 51.83.161.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.161.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZbjFoV24kZpmf6nh3DqYQAAAcA"]
[Thu Feb 19 18:16:54.208557 2026] [:error] [pid 5580:tid 5583] [client 51.83.161.209:54573] [client 51.83.161.209] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZbjFoV24kZpmf6nh3DqYQAAAcA"]
[Thu Feb 19 18:16:54.209964 2026] [:error] [pid 5580:tid 5583] [client 51.83.161.209:54573] [client 51.83.161.209] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZbjFoV24kZpmf6nh3DqYQAAAcA"]
[Thu Feb 19 18:16:55.802241 2026] [:error] [pid 48902:tid 48939] [client 51.83.161.209:55102] [client 51.83.161.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.161.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZbjF2cJ-6aYRpRRFsUVwQAAAEE"]
[Thu Feb 19 18:16:57.413006 2026] [:error] [pid 5548:tid 5561] [client 51.83.161.209:55609] [client 51.83.161.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.161.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZbjGZMpsAkdKxbTbsOkjAAAAYo"]
[Thu Feb 19 18:16:59.038484 2026] [:error] [pid 15513:tid 15530] [client 51.83.161.209:56196] [client 51.83.161.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.161.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZbjG8GTRTE022JWg1-8tgAAAQ8"]
[Thu Feb 19 18:16:59.038713 2026] [:error] [pid 15513:tid 15530] [client 51.83.161.209:56196] [client 51.83.161.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 51.83.161.209, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZbjG8GTRTE022JWg1-8tgAAAQ8"]
[Thu Feb 19 18:17:00.085055 2026] [:error] [pid 5580:tid 5592] [client 51.83.161.209:56600] [client 51.83.161.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 51.83.161.209, counter = 6"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZbjHIV24kZpmf6nh3DqaQAAAcg"], referer: https://expressinteriors.com//wp-login.php
[Thu Feb 19 18:17:01.143657 2026] [:error] [pid 49002:tid 49029] [client 51.83.161.209:57003] [client 51.83.161.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 51.83.161.209, counter = 6"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZbjHVfcBtQ6hSJuEQlPGgAAAM8"], referer: https://expressinteriors.com//wp-login.php
[Thu Feb 19 18:17:02.193939 2026] [:error] [pid 24048:tid 24067] [client 51.83.161.209:57383] [client 51.83.161.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 51.83.161.209, counter = 6"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZbjHmug6wHHqU0QyDbW6QAAAVE"], referer: https://expressinteriors.com//wp-login.php
[Thu Feb 19 18:17:03.240605 2026] [:error] [pid 48902:tid 48952] [client 51.83.161.209:57691] [client 51.83.161.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 51.83.161.209, counter = 6"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZbjH2cJ-6aYRpRRFsUVxwAAAE4"], referer: https://expressinteriors.com//wp-login.php
[Thu Feb 19 18:21:19.928358 2026] [:error] [pid 49002:tid 49019] [client 179.43.191.19:56918] [client 179.43.191.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 179.43.191.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZbkH1fcBtQ6hSJuEQlQIgAAAMU"], referer: expressinteriors.com
[Thu Feb 19 18:27:58.796716 2026] [:error] [pid 49002:tid 49024] [client 34.31.161.149:65231] [client 34.31.161.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.31.161.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZblrlfcBtQ6hSJuEQlRUwAAAMo"]
[Thu Feb 19 18:28:01.056141 2026] [:error] [pid 49002:tid 49026] [client 34.31.161.149:65231] [client 34.31.161.149] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aZblsVfcBtQ6hSJuEQlRWgAAAMw"]
[Thu Feb 19 18:28:01.270043 2026] [:error] [pid 49002:tid 49035] [client 34.31.161.149:65231] [client 34.31.161.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.31.161.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZblsVfcBtQ6hSJuEQlRWwAAANU"]
[Thu Feb 19 18:28:02.679621 2026] [:error] [pid 49002:tid 49017] [client 34.31.161.149:52344] [client 34.31.161.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.31.161.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZblslfcBtQ6hSJuEQlRYQAAAMM"]
[Thu Feb 19 18:28:04.114421 2026] [:error] [pid 48903:tid 48987] [client 34.31.161.149:54829] [client 34.31.161.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.31.161.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZbltI6aTgKrpAR115vVhwAAAJY"]
[Thu Feb 19 18:28:04.118354 2026] [:error] [pid 48903:tid 48987] [client 34.31.161.149:54829] [client 34.31.161.149] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/usr/local/apache/modsecurity-cwaf/rules/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 34.31.161.149 (+1 hits since last alert)|expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZbltI6aTgKrpAR115vVhwAAAJY"]
[Thu Feb 19 19:19:37.618230 2026] [:error] [pid 15513:tid 15530] [client 154.199.69.18:49450] [client 154.199.69.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.199.69.18, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZbxycGTRTE022JWg1_QFAAAAQ8"]
[Thu Feb 19 19:19:40.732422 2026] [:error] [pid 5580:tid 5603] [client 156.249.127.180:22322] [client 156.249.127.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.249.127.180, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZbxzIV24kZpmf6nh3D2YgAAAdM"], referer: http://expressinteriors.com/wp-login.php
[Thu Feb 19 19:19:42.788001 2026] [:error] [pid 5580:tid 5607] [client 45.206.73.188:46176] [client 45.206.73.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aZbxzoV24kZpmf6nh3D2aQAAAdc"]
[Thu Feb 19 19:19:43.923222 2026] [:error] [pid 48901:tid 48915] [client 154.193.153.97:44590] [client 154.193.153.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.193.153.97, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZbxz8ixYz-lHbN0WBKwEgAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 19 19:19:43.925619 2026] [:error] [pid 48901:tid 48915] [client 154.193.153.97:44590] [client 154.193.153.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZbxz8ixYz-lHbN0WBKwEgAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 19 19:19:45.169177 2026] [:error] [pid 5580:tid 5599] [client 154.193.155.229:32362] [client 154.193.155.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.193.155.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZbx0YV24kZpmf6nh3D2agAAAc8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 19 19:19:45.174347 2026] [:error] [pid 5580:tid 5599] [client 154.193.155.229:32362] [client 154.193.155.229] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZbx0YV24kZpmf6nh3D2agAAAc8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 19 19:19:46.444756 2026] [:error] [pid 48901:tid 48924] [client 154.86.112.43:17324] [client 154.86.112.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.86.112.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZbx0sixYz-lHbN0WBKwFQAAAA4"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 19 19:19:46.448980 2026] [:error] [pid 48901:tid 48924] [client 154.86.112.43:17324] [client 154.86.112.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZbx0sixYz-lHbN0WBKwFQAAAA4"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 19 19:19:48.229679 2026] [:error] [pid 15513:tid 15528] [client 156.239.215.51:50538] [client 156.239.215.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.215.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZbx1MGTRTE022JWg1_QGwAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 19 19:19:48.232706 2026] [:error] [pid 15513:tid 15528] [client 156.239.215.51:50538] [client 156.239.215.51] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZbx1MGTRTE022JWg1_QGwAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 19 19:19:49.512654 2026] [:error] [pid 24048:tid 24051] [client 154.199.15.10:12874] [client 154.199.15.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.199.15.10, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZbx1Wug6wHHqU0QyDbm-gAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 19 19:19:49.515842 2026] [:error] [pid 24048:tid 24051] [client 154.199.15.10:12874] [client 154.199.15.10] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZbx1Wug6wHHqU0QyDbm-gAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 19 20:30:41.114180 2026] [:error] [pid 48902:tid 48958] [client 124.156.226.179:38216] [client 124.156.226.179] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZcCcWcJ-6aYRpRRFsUt9AAAAFQ"]
[Thu Feb 19 21:32:59.581227 2026] [:error] [pid 48901:tid 48911] [client 111.172.249.49:52965] [client 111.172.249.49] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZcRC8ixYz-lHbN0WBLUOQAAAAE"]
[Thu Feb 19 22:17:19.456950 2026] [:error] [pid 15513:tid 15520] [client 34.105.8.204:65437] [client 34.105.8.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.105.8.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZcbb8GTRTE022JWg18IDgAAAQU"]
[Thu Feb 19 22:17:21.612084 2026] [:error] [pid 15513:tid 15526] [client 34.105.8.204:65437] [client 34.105.8.204] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aZcbccGTRTE022JWg18IFwAAAQs"]
[Thu Feb 19 22:17:21.873610 2026] [:error] [pid 15513:tid 15535] [client 34.105.8.204:65437] [client 34.105.8.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.105.8.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZcbccGTRTE022JWg18IGQAAARQ"]
[Thu Feb 19 22:17:23.226097 2026] [:error] [pid 48903:tid 48979] [client 34.105.8.204:57097] [client 34.105.8.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.105.8.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZcbc46aTgKrpAR115sEKQAAAI4"]
[Thu Feb 19 22:17:24.666373 2026] [:error] [pid 48901:tid 48915] [client 34.105.8.204:64389] [client 34.105.8.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.105.8.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZcbdMixYz-lHbN0WBLd_QAAAAU"]
[Thu Feb 19 22:17:25.979721 2026] [:error] [pid 15513:tid 15526] [client 34.105.8.204:61732] [client 34.105.8.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.105.8.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZcbdcGTRTE022JWg18IHAAAAQs"]
[Thu Feb 19 22:17:27.328526 2026] [:error] [pid 5581:tid 5622] [client 34.105.8.204:62219] [client 34.105.8.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.105.8.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZcbd3IfW0xlXmrVd3rgpQAAAgs"]
[Thu Feb 19 22:17:27.328817 2026] [:error] [pid 5581:tid 5622] [client 34.105.8.204:62219] [client 34.105.8.204] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.105.8.204, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZcbd3IfW0xlXmrVd3rgpQAAAgs"]
[Fri Feb 20 01:46:13.604630 2026] [:error] [pid 5581:tid 5622] [client 85.203.21.120:30015] [client 85.203.21.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZdMZXIfW0xlXmrVd3oQ7AAAAgs"]
[Fri Feb 20 01:46:13.973126 2026] [:error] [pid 48901:tid 48928] [client 85.203.21.120:53571] [client 85.203.21.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZdMZcixYz-lHbN0WBIWHQAAABI"]
[Fri Feb 20 03:51:17.114753 2026] [:error] [pid 417:tid 439] [client 43.138.68.113:47928] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZdptWZ8vv9H56paZ2ClKgAAARQ"]
[Fri Feb 20 04:42:47.302437 2026] [:error] [pid 64405:tid 64470] [client 170.106.193.108:42028] [client 170.106.193.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZd1x9SgDnQB5OAbOuSiOwAAAIM"]
[Fri Feb 20 06:24:19.606516 2026] [:error] [pid 417:tid 428] [client 193.36.225.52:39781] [client 193.36.225.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.52, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZeNk2Z8vv9H56paZ2D7vwAAAQk"]
[Fri Feb 20 08:20:03.302098 2026] [:error] [pid 22278:tid 22301] [client 43.156.156.96:56482] [client 43.156.156.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZeos10FtS8l4lgFYkAOvgAAAdQ"]
[Fri Feb 20 08:38:45.160066 2026] [:error] [pid 22495:tid 22497] [client 172.245.102.1:32217] [client 172.245.102.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.1, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZetFazhuDxEcqzNb1KN9QAAAkA"]
[Fri Feb 20 08:57:06.963411 2026] [:error] [pid 39706:tid 39802] [client 136.144.33.208:28479] [client 136.144.33.208] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.208, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZexYlHCi9Thcb5pcMTGAQAAAU8"]
[Fri Feb 20 09:14:52.403341 2026] [:error] [pid 52517:tid 52542] [client 193.36.225.31:49291] [client 193.36.225.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZe1jNRyU5YA5v2_49iXDQAAAFc"]
[Fri Feb 20 09:32:50.595768 2026] [:error] [pid 54520:tid 54541] [client 193.36.225.34:42075] [client 193.36.225.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.34, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZe5wmQaQX7QUBqXcyEc3wAAAJM"]
[Fri Feb 20 10:09:39.391078 2026] [:error] [pid 54520:tid 54532] [client 193.36.225.246:36513] [client 193.36.225.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.246, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZfCY2QaQX7QUBqXcyEpoQAAAIo"]
[Fri Feb 20 10:28:17.847835 2026] [:error] [pid 59127:tid 59153] [client 193.36.225.23:43483] [client 193.36.225.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZfGwXSltzl55Qz-09htDwAAARg"]
[Fri Feb 20 10:46:27.240248 2026] [:error] [pid 59127:tid 59146] [client 172.245.102.1:54067] [client 172.245.102.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.1, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZfLA3Sltzl55Qz-09h2QwAAARE"]
[Fri Feb 20 11:05:43.478815 2026] [:error] [pid 54461:tid 54494] [client 193.36.225.235:22313] [client 193.36.225.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZfPhy372fkN0w39NDMJggAAAEI"]
[Fri Feb 20 11:25:52.751536 2026] [:error] [pid 54552:tid 54566] [client 136.144.33.234:20101] [client 136.144.33.234] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.234, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZfUQMe4t0F-_sbWepaE0wAAAMs"]
[Fri Feb 20 11:29:56.343203 2026] [:error] [pid 54461:tid 54506] [client 74.7.227.5:59038] [client 74.7.227.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.7.227.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZfVNC372fkN0w39NDMVagAAAE4"], referer: https://expressinteriors.com/
[Fri Feb 20 11:45:20.413295 2026] [:error] [pid 54552:tid 54575] [client 193.36.225.32:55977] [client 193.36.225.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.32, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZfY0Me4t0F-_sbWepaMyAAAANQ"]
[Fri Feb 20 12:22:31.997873 2026] [:error] [pid 54461:tid 54504] [client 193.36.225.241:21815] [client 193.36.225.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.241, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZfhhy372fkN0w39NDMmNQAAAEw"]
[Fri Feb 20 12:41:33.538213 2026] [:error] [pid 54460:tid 54473] [client 193.36.225.31:53077] [client 193.36.225.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZfl_coUiaZ-Z7V-F9_YBQAAAAg"]
[Fri Feb 20 13:00:04.161913 2026] [:error] [pid 54460:tid 54487] [client 193.36.225.251:64881] [client 193.36.225.251] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.251, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZfqVMoUiaZ-Z7V-F9_fLAAAABY"]
[Fri Feb 20 13:18:52.009732 2026] [:error] [pid 54520:tid 54526] [client 193.36.225.25:40767] [client 193.36.225.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZfuvGQaQX7QUBqXcyFurgAAAIQ"]
[Fri Feb 20 13:37:30.126725 2026] [:error] [pid 59127:tid 59133] [client 193.36.225.247:32769] [client 193.36.225.247] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.247, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZfzGnSltzl55Qz-09jKyQAAAQQ"]
[Fri Feb 20 13:56:04.187868 2026] [:error] [pid 54460:tid 54465] [client 193.36.225.76:22563] [client 193.36.225.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.76, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZf3dMoUiaZ-Z7V-F9_zLwAAAAA"]
[Fri Feb 20 14:14:15.258325 2026] [:error] [pid 46012:tid 46027] [client 43.153.58.28:53848] [client 43.153.58.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZf7tzXz-GTvuxLwgUGonwAAAU0"]
[Fri Feb 20 14:14:28.165536 2026] [:error] [pid 59127:tid 59148] [client 193.36.225.23:25641] [client 193.36.225.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZf7xHSltzl55Qz-09jWRAAAARM"]
[Fri Feb 20 14:33:37.726692 2026] [:error] [pid 54520:tid 54538] [client 37.140.223.189:36969] [client 37.140.223.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZgAQWQaQX7QUBqXcyGHhQAAAJA"]
[Fri Feb 20 14:53:07.421497 2026] [:error] [pid 46012:tid 46026] [client 37.140.223.188:62547] [client 37.140.223.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZgE0zXz-GTvuxLwgUG74gAAAUw"]
[Fri Feb 20 15:12:21.470788 2026] [:error] [pid 46012:tid 46037] [client 37.140.223.168:31349] [client 37.140.223.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZgJVTXz-GTvuxLwgUHGngAAAVc"]
[Fri Feb 20 15:32:03.369641 2026] [:error] [pid 54460:tid 54479] [client 37.140.223.209:55453] [client 37.140.223.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZgN88oUiaZ-Z7V-F98WeQAAAA4"]
[Fri Feb 20 15:51:46.649137 2026] [:error] [pid 46012:tid 46028] [client 37.140.223.188:37457] [client 37.140.223.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZgSkjXz-GTvuxLwgUHWuQAAAU4"]
[Fri Feb 20 15:51:59.081138 2026] [:error] [pid 54460:tid 54467] [client 106.54.62.156:59368] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZgSn8oUiaZ-Z7V-F98cOwAAAAI"]
[Fri Feb 20 16:11:30.417328 2026] [:error] [pid 59127:tid 59150] [client 37.140.223.174:25111] [client 37.140.223.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.174, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZgXMnSltzl55Qz-09j6XAAAARU"]
[Fri Feb 20 16:31:04.368940 2026] [:error] [pid 59127:tid 59147] [client 37.140.223.171:31467] [client 37.140.223.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZgbyHSltzl55Qz-09gAuAAAARI"]
[Fri Feb 20 16:50:47.003089 2026] [:error] [pid 54460:tid 54487] [client 37.140.223.175:64411] [client 37.140.223.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.175, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZggZ8oUiaZ-Z7V-F98vpgAAABY"]
[Fri Feb 20 17:10:14.334688 2026] [:error] [pid 54461:tid 54498] [client 37.140.223.211:28855] [client 37.140.223.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZgk9i372fkN0w39NDOD9QAAAEY"]
[Fri Feb 20 17:29:55.238173 2026] [:error] [pid 54461:tid 54516] [client 37.140.223.210:52227] [client 37.140.223.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZgpky372fkN0w39NDOKRwAAAFg"]
[Fri Feb 20 17:34:44.884776 2026] [:error] [pid 54461:tid 54511] [client 34.187.147.194:54842] [client 34.187.147.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.187.147.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZgqtC372fkN0w39NDOLnwAAAFM"]
[Fri Feb 20 17:49:43.779502 2026] [:error] [pid 54552:tid 54555] [client 37.140.223.196:24059] [client 37.140.223.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.196, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZguN8e4t0F-_sbWepYHIQAAAMA"]
[Fri Feb 20 18:09:42.114695 2026] [:error] [pid 54552:tid 54555] [client 37.140.223.198:29291] [client 37.140.223.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.198, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZgy5se4t0F-_sbWepYNGwAAAMA"]
[Fri Feb 20 18:29:40.948135 2026] [:error] [pid 59127:tid 59136] [client 172.245.102.77:24833] [client 172.245.102.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZg3lHSltzl55Qz-09ghhAAAAQc"]
[Fri Feb 20 18:49:40.078555 2026] [:error] [pid 54460:tid 54488] [client 37.140.223.172:22083] [client 37.140.223.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.172, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZg8RMoUiaZ-Z7V-F99XKgAAABc"]
[Fri Feb 20 19:09:41.205329 2026] [:error] [pid 54461:tid 54493] [client 136.144.33.247:61859] [client 136.144.33.247] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.33.247, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZhA9S372fkN0w39NDOovQAAAEE"]
[Fri Feb 20 19:29:38.672912 2026] [:error] [pid 46012:tid 46014] [client 37.140.223.165:32649] [client 37.140.223.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZhFojXz-GTvuxLwgUE6sgAAAUA"]
[Fri Feb 20 19:48:06.221633 2026] [:error] [pid 59127:tid 59130] [client 43.165.65.180:34388] [client 43.165.65.180] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZhJ9nSltzl55Qz-09g4YQAAAQE"]
[Fri Feb 20 19:49:56.311528 2026] [:error] [pid 54461:tid 54495] [client 37.140.223.195:20455] [client 37.140.223.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZhKZC372fkN0w39NDO2QQAAAEM"]
[Fri Feb 20 20:09:50.750432 2026] [:error] [pid 46012:tid 46024] [client 37.140.223.193:23493] [client 37.140.223.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZhPDjXz-GTvuxLwgUFMbgAAAUo"]
[Fri Feb 20 20:30:30.178985 2026] [:error] [pid 54461:tid 54496] [client 37.140.223.188:34603] [client 37.140.223.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZhT5i372fkN0w39NDPBugAAAEQ"]
[Fri Feb 20 20:50:42.307516 2026] [:error] [pid 54552:tid 54557] [client 37.140.223.213:26905] [client 37.140.223.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.213, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZhYose4t0F-_sbWepY7CQAAAMI"]
[Fri Feb 20 20:55:03.202484 2026] [:error] [pid 46012:tid 46033] [client 182.8.129.89:31617] [client 182.8.129.89] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZhZpzXz-GTvuxLwgUFaqQAAAVM"]
[Fri Feb 20 21:10:54.202668 2026] [:error] [pid 54460:tid 54484] [client 37.140.223.176:60601] [client 37.140.223.176] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.176, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZhdXsoUiaZ-Z7V-F9-MzwAAABM"]
[Fri Feb 20 21:31:19.280280 2026] [:error] [pid 54552:tid 54555] [client 172.245.102.78:56039] [client 172.245.102.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.245.102.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZhiJ8e4t0F-_sbWepZGsgAAAMA"]
[Fri Feb 20 21:51:25.988587 2026] [:error] [pid 54520:tid 54536] [client 37.140.223.188:41529] [client 37.140.223.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZhm3WQaQX7QUBqXcyEF2AAAAI4"]
[Fri Feb 20 22:11:23.633133 2026] [:error] [pid 54552:tid 54562] [client 37.140.223.188:64469] [client 37.140.223.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.223.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZhri8e4t0F-_sbWepZRtwAAAMc"]
[Fri Feb 20 23:57:14.290420 2026] [:error] [pid 54552:tid 54571] [client 18.219.131.181:56766] [client 18.219.131.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZiEWse4t0F-_sbWepZtmwAAANA"]
[Fri Feb 20 23:57:14.684601 2026] [:error] [pid 54552:tid 54578] [client 18.219.131.181:54840] [client 18.219.131.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "aZiEWse4t0F-_sbWepZtnwAAANc"]
[Fri Feb 20 23:57:15.089763 2026] [:error] [pid 59127:tid 59150] [client 18.219.131.181:60476] [client 18.219.131.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/media/system/js/core.js"] [unique_id "aZiEW3Sltzl55Qz-09h4AQAAARU"]
[Sat Feb 21 02:27:04.074219 2026] [:error] [pid 59127:tid 59130] [client 103.65.237.124:58732] [client 103.65.237.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aZineHSltzl55Qz-09if1wAAAQE"]
[Sat Feb 21 03:10:37.634697 2026] [:error] [pid 54460:tid 54473] [client 156.239.204.183:33016] [client 156.239.204.183] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.204.183, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZixrcoUiaZ-Z7V-F98DRwAAAAg"]
[Sat Feb 21 03:10:39.402309 2026] [:error] [pid 54552:tid 54565] [client 154.82.171.195:15570] [client 154.82.171.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.82.171.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZixr8e4t0F-_sbWepaj3QAAAMo"], referer: http://expressinteriors.com/wp-login.php
[Sat Feb 21 03:10:45.615107 2026] [:error] [pid 54461:tid 54498] [client 45.206.72.243:49720] [client 45.206.72.243] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aZixtS372fkN0w39NDMrxAAAAEY"]
[Sat Feb 21 03:10:47.061664 2026] [:error] [pid 59127:tid 59146] [client 154.86.113.193:59564] [client 154.86.113.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 154.86.113.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZixt3Sltzl55Qz-09iq9AAAARE"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 21 03:10:47.064815 2026] [:error] [pid 59127:tid 59146] [client 154.86.113.193:59564] [client 154.86.113.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZixt3Sltzl55Qz-09iq9AAAARE"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 21 03:10:49.460085 2026] [:error] [pid 59127:tid 59143] [client 156.239.221.217:52294] [client 156.239.221.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.221.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZixuXSltzl55Qz-09iq9wAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 21 03:10:49.463233 2026] [:error] [pid 59127:tid 59143] [client 156.239.221.217:52294] [client 156.239.221.217] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZixuXSltzl55Qz-09iq9wAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 21 03:10:50.718765 2026] [:error] [pid 54552:tid 54579] [client 45.206.73.240:51426] [client 45.206.73.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.206.73.240, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZixuse4t0F-_sbWepaj5QAAANg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 21 03:10:50.722060 2026] [:error] [pid 54552:tid 54579] [client 45.206.73.240:51426] [client 45.206.73.240] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZixuse4t0F-_sbWepaj5QAAANg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 21 03:10:52.293957 2026] [:error] [pid 54552:tid 54562] [client 156.239.195.201:30454] [client 156.239.195.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.195.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZixvMe4t0F-_sbWepaj-QAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 21 03:10:52.297505 2026] [:error] [pid 54552:tid 54562] [client 156.239.195.201:30454] [client 156.239.195.201] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZixvMe4t0F-_sbWepaj-QAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 21 03:10:53.833585 2026] [:error] [pid 54552:tid 54575] [client 156.239.202.32:25936] [client 156.239.202.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 156.239.202.32, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZixvce4t0F-_sbWepakBwAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 21 03:10:53.836786 2026] [:error] [pid 54552:tid 54575] [client 156.239.202.32:25936] [client 156.239.202.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZixvce4t0F-_sbWepakBwAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 21 06:24:43.297824 2026] [:error] [pid 40756:tid 40785] [client 43.133.139.6:52516] [client 43.133.139.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZjfKwNlDP60sLYgqXLg9gAAABM"]
[Sat Feb 21 07:27:23.420337 2026] [:error] [pid 40757:tid 40802] [client 65.52.160.249:57775] [client 65.52.160.249] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.52.160.249, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZjt26g_MKVL7zhH7dxUCAAAAEc"]
[Sat Feb 21 08:11:23.426611 2026] [:error] [pid 40757:tid 40814] [client 181.41.103.48:58591] [client 181.41.103.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.41.103.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZj4K6g_MKVL7zhH7dxjSAAAAFM"]
[Sat Feb 21 08:24:01.690623 2026] [:error] [pid 11941:tid 11967] [client 20.212.104.201:1542] [client 20.212.104.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.212.104.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZj7IXTUkHs3EVWllKn_HwAAAZg"]
[Sat Feb 21 09:39:49.142411 2026] [:error] [pid 40758:tid 40836] [client 20.89.58.48:11554] [client 20.89.58.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t.php"] [unique_id "aZkM5UBAHxvBM3i9iKHvSgAAAI4"]
[Sat Feb 21 09:40:35.290842 2026] [:error] [pid 11941:tid 11946] [client 20.89.58.48:11913] [client 20.89.58.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e.php"] [unique_id "aZkNE3TUkHs3EVWllKkSIgAAAYM"]
[Sat Feb 21 09:40:39.104154 2026] [:error] [pid 40871:tid 40894] [client 20.89.58.48:18078] [client 20.89.58.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e.php"] [unique_id "aZkNFzqDikjdiOZeJyUUBgAAANU"]
[Sat Feb 21 09:40:44.091563 2026] [:error] [pid 40758:tid 40844] [client 20.89.58.48:11115] [client 20.89.58.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e.php"] [unique_id "aZkNHEBAHxvBM3i9iKHvhgAAAJY"]
[Sat Feb 21 09:40:45.581168 2026] [:error] [pid 40758:tid 40838] [client 20.89.58.48:8365] [client 20.89.58.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "aZkNHUBAHxvBM3i9iKHviAAAAJA"]
[Sat Feb 21 16:23:13.463946 2026] [:error] [pid 11743:tid 11767] [client 182.42.104.32:41242] [client 182.42.104.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZlrcQALoZZjiTbGvqX5fwAAAVY"]
[Sat Feb 21 18:09:14.420479 2026] [:error] [pid 40756:tid 40783] [client 43.157.172.39:42672] [client 43.157.172.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZmESgNlDP60sLYgqXLBWgAAABE"]
[Sat Feb 21 22:32:10.581854 2026] [:error] [pid 40871:tid 40897] [client 125.75.66.97:57331] [client 125.75.66.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZnB6jqDikjdiOZeJyW0JwAAANg"]
[Sat Feb 21 23:35:42.854879 2026] [:error] [pid 22558:tid 22576] [client 170.106.110.146:51290] [client 170.106.110.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZnQzirVaIb2gXsVbDpGswAAARA"]
[Sun Feb 22 00:09:56.369283 2026] [:error] [pid 11743:tid 11745] [client 135.149.8.148:59439] [client 135.149.8.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 135.149.8.148, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZnY1AALoZZjiTbGvqVd6gAAAUA"]
[Sun Feb 22 04:16:01.865413 2026] [:error] [pid 9695:tid 9717] [client 181.41.103.48:56089] [client 181.41.103.48] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aZoSgVpPqolBNLmJ4eoPZQAAANQ"]
[Sun Feb 22 04:17:31.658620 2026] [:error] [pid 9587:tid 9602] [client 181.41.103.48:59131] [client 181.41.103.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.41.103.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZoS2-hqt7NXCp-NupHQQwAAAAY"]
[Sun Feb 22 04:18:37.827561 2026] [:error] [pid 9589:tid 9661] [client 181.41.103.48:61084] [client 181.41.103.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.41.103.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZoTHdr-1mylR_FoXQUD8QAAAIo"]
[Sun Feb 22 04:19:46.623995 2026] [:error] [pid 9695:tid 9716] [client 181.41.103.48:61366] [client 181.41.103.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.41.103.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZoTYlpPqolBNLmJ4eoQ_wAAANM"]
[Sun Feb 22 04:20:44.925833 2026] [:error] [pid 9588:tid 9627] [client 181.41.103.48:61379] [client 181.41.103.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.41.103.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZoTnGjNBsxseiTcEllIpAAAAEM"]
[Sun Feb 22 04:21:41.430343 2026] [:error] [pid 9588:tid 9624] [client 181.41.103.48:52993] [client 181.41.103.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.41.103.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZoT1WjNBsxseiTcEllI6wAAAEA"]
[Sun Feb 22 04:29:24.764437 2026] [:error] [pid 10537:tid 10549] [client 216.81.248.168:39430] [client 216.81.248.168] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aZoVpLgCiSojLQQBckjO3AAAAQo"]
[Sun Feb 22 04:46:40.632946 2026] [:error] [pid 9695:tid 9719] [client 36.111.67.189:43640] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZoZsFpPqolBNLmJ4eobxQAAANY"]
[Sun Feb 22 10:44:34.376679 2026] [:error] [pid 9589:tid 9669] [client 1.15.52.154:43588] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZptktr-1mylR_FoXQWiPwAAAJI"]
[Sun Feb 22 16:38:05.876786 2026] [:error] [pid 12501:tid 12507] [client 34.224.132.215:28209] [client 34.224.132.215] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "aZrAbZicztrbvinWGXOwFAAAAUQ"]
[Sun Feb 22 16:46:35.616472 2026] [:error] [pid 9695:tid 9721] [client 43.130.174.37:58106] [client 43.130.174.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZrCa1pPqolBNLmJ4eohGwAAANg"]
[Sun Feb 22 16:58:28.989970 2026] [:error] [pid 9588:tid 9641] [client 223.15.245.170:41370] [client 223.15.245.170] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZrFNGjNBsxseiTcElkzVgAAAFE"]
[Sun Feb 22 19:57:59.539084 2026] [:error] [pid 2762:tid 2816] [client 43.135.145.77:36382] [client 43.135.145.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZrvR30XaxeZ1xx2EW9apgAAAIM"]
[Sun Feb 22 22:04:50.543355 2026] [:error] [pid 2629:tid 2682] [client 43.155.188.157:33922] [client 43.155.188.157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZsNAglsXSV5M4mfwZ8znAAAAVg"]
[Sun Feb 22 23:14:58.284992 2026] [:error] [pid 2475:tid 2563] [client 1.15.52.154:58210] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZsdcidme8TSKYpXujdmkQAAAJc"]
[Sun Feb 22 23:33:44.495613 2026] [:error] [pid 2475:tid 2563] [client 185.137.164.21:47125] [client 185.137.164.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "aZsh2Cdme8TSKYpXujdw8gAAAJc"]
[Sun Feb 22 23:33:50.583620 2026] [:error] [pid 2475:tid 2558] [client 185.137.164.20:30983] [client 185.137.164.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/O-Simple.php"] [unique_id "aZsh3idme8TSKYpXujdxLgAAAJI"]
[Sun Feb 22 23:33:51.176895 2026] [:error] [pid 2629:tid 2666] [client 185.137.164.14:61887] [client 185.137.164.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/O-Simple.php"] [unique_id "aZsh3wlsXSV5M4mfwZ9alwAAAUg"]
[Sun Feb 22 23:33:51.732750 2026] [:error] [pid 2628:tid 2635] [client 185.137.164.13:64697] [client 185.137.164.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/O-Simple.php"] [unique_id "aZsh37K4woMTeUPH2ns8OQAAAQQ"]
[Sun Feb 22 23:34:00.552124 2026] [:error] [pid 2474:tid 2515] [client 185.137.164.19:26949] [client 185.137.164.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aZsh6PhvE7P5hX_xKnS41wAAAEY"]
[Sun Feb 22 23:34:04.542869 2026] [:error] [pid 2629:tid 2675] [client 185.137.164.20:41487] [client 185.137.164.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aZsh7AlsXSV5M4mfwZ9bSAAAAVE"]
[Sun Feb 22 23:34:05.073179 2026] [:error] [pid 2473:tid 2495] [client 185.137.164.18:25721] [client 185.137.164.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aZsh7XptAeV7-XzzNzg-TQAAABI"]
[Sun Feb 22 23:34:05.583685 2026] [:error] [pid 2473:tid 2500] [client 185.137.164.16:61337] [client 185.137.164.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aZsh7XptAeV7-XzzNzg-VAAAABc"]
[Sun Feb 22 23:34:13.059773 2026] [:error] [pid 2474:tid 2539] [client 185.137.164.13:57461] [client 185.137.164.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/login.php"] [unique_id "aZsh9fhvE7P5hX_xKnS5YgAAAFI"]
[Sun Feb 22 23:34:15.817185 2026] [:error] [pid 2629:tid 2668] [client 185.137.164.20:63353] [client 185.137.164.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mah.php"] [unique_id "aZsh9wlsXSV5M4mfwZ9b0AAAAUo"]
[Sun Feb 22 23:34:22.385807 2026] [:error] [pid 3103:tid 3106] [client 185.137.164.21:61293] [client 185.137.164.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/robots.php"] [unique_id "aZsh_pfzX5hBIaQY93OAzgAAAYA"]
[Sun Feb 22 23:34:22.915132 2026] [:error] [pid 2629:tid 2662] [client 185.137.164.17:62537] [client 185.137.164.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/robots.php"] [unique_id "aZsh_glsXSV5M4mfwZ9cDgAAAUQ"]
[Sun Feb 22 23:34:25.543932 2026] [:error] [pid 2574:tid 2594] [client 185.137.164.14:56235] [client 185.137.164.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aZsiAckPV7h4nTf-jiTnywAAAM0"]
[Sun Feb 22 23:34:26.067935 2026] [:error] [pid 2629:tid 2664] [client 185.137.164.13:52195] [client 185.137.164.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aZsiAglsXSV5M4mfwZ9cIAAAAUY"]
[Sun Feb 22 23:34:26.645963 2026] [:error] [pid 2628:tid 2632] [client 185.137.164.13:59205] [client 185.137.164.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aZsiArK4woMTeUPH2ns9egAAAQE"]
[Sun Feb 22 23:34:27.247864 2026] [:error] [pid 2629:tid 2666] [client 185.137.164.14:38153] [client 185.137.164.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aZsiAwlsXSV5M4mfwZ9cJAAAAUg"]
[Sun Feb 22 23:34:27.755725 2026] [:error] [pid 2574:tid 2591] [client 185.137.164.14:38987] [client 185.137.164.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aZsiA8kPV7h4nTf-jiTn5QAAAMo"]
[Sun Feb 22 23:34:28.408645 2026] [autoindex:error] [pid 2475:tid 2562] [client 185.137.164.21:62913] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Feb 22 23:34:28.734669 2026] [:error] [pid 2475:tid 2563] [client 185.137.164.21:62913] [client 185.137.164.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/"] [unique_id "aZsiBCdme8TSKYpXujdyYwAAAJc"]
[Sun Feb 22 23:34:29.276745 2026] [autoindex:error] [pid 2574:tid 2589] [client 185.137.164.19:53183] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Feb 22 23:34:29.546874 2026] [:error] [pid 2574:tid 2600] [client 185.137.164.19:53183] [client 185.137.164.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/"] [unique_id "aZsiBckPV7h4nTf-jiTn7wAAANM"]
[Sun Feb 22 23:34:30.087879 2026] [autoindex:error] [pid 2628:tid 2631] [client 185.137.164.16:42141] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Feb 22 23:34:30.357863 2026] [:error] [pid 2628:tid 2633] [client 185.137.164.16:42141] [client 185.137.164.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/"] [unique_id "aZsiBrK4woMTeUPH2ns9kAAAAQI"]
[Sun Feb 22 23:34:30.917759 2026] [:error] [pid 26033:tid 26052] [client 185.137.164.16:49285] [client 185.137.164.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/"] [unique_id "aZsiBkTRRZdhkkS8ouSKgQAAAdE"]
[Sun Feb 22 23:34:31.475095 2026] [autoindex:error] [pid 3103:tid 3110] [client 185.137.164.16:36935] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Feb 22 23:34:31.754012 2026] [:error] [pid 3103:tid 3125] [client 185.137.164.16:36935] [client 185.137.164.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/erinyani/"] [unique_id "aZsiB5fzX5hBIaQY93OA-AAAAZM"]
[Sun Feb 22 23:34:32.276039 2026] [:error] [pid 2473:tid 2496] [client 185.137.164.19:30829] [client 185.137.164.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/erinyani/"] [unique_id "aZsiCHptAeV7-XzzNzg_bAAAABM"]
[Sun Feb 22 23:34:32.781149 2026] [:error] [pid 2474:tid 2514] [client 185.137.164.14:50099] [client 185.137.164.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/erinyani/"] [unique_id "aZsiCPhvE7P5hX_xKnS5_gAAAEU"]
[Sun Feb 22 23:34:33.334931 2026] [:error] [pid 26033:tid 26053] [client 185.137.164.16:62863] [client 185.137.164.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/erinyani/"] [unique_id "aZsiCUTRRZdhkkS8ouSKlgAAAdI"]
[Sun Feb 22 23:34:33.866774 2026] [:error] [pid 2473:tid 2486] [client 185.137.164.15:28227] [client 185.137.164.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/erinyani/"] [unique_id "aZsiCXptAeV7-XzzNzg_gAAAAAk"]
[Mon Feb 23 00:31:11.093843 2026] [:error] [pid 28425:tid 28518] [client 216.24.210.101:30791] [client 216.24.210.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.101, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZsvTzO7QIkwG1UqFGzZWwAAAFg"]
[Mon Feb 23 01:14:45.603414 2026] [:error] [pid 28425:tid 28500] [client 43.166.247.82:47922] [client 43.166.247.82] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZs5hTO7QIkwG1UqFGzpCgAAAEc"]
[Mon Feb 23 01:42:26.844814 2026] [:error] [pid 28426:tid 28531] [client 216.24.210.27:51843] [client 216.24.210.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtAAmgbPVf4pO12NZnaPgAAAIk"]
[Mon Feb 23 01:49:31.200079 2026] [:error] [pid 28425:tid 28502] [client 216.24.210.95:27365] [client 216.24.210.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.95, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtBqzO7QIkwG1UqFGz1mQAAAEk"]
[Mon Feb 23 01:55:38.793292 2026] [:error] [pid 28558:tid 28570] [client 216.24.210.99:28613] [client 216.24.210.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtDGidFHR5e1Gd10vePPAAAAMo"]
[Mon Feb 23 02:01:39.441758 2026] [:error] [pid 28424:tid 28448] [client 216.24.210.104:39905] [client 216.24.210.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtEgwBAZT_BJOxE-Z44fgAAABQ"]
[Mon Feb 23 02:07:46.996785 2026] [:error] [pid 28426:tid 28538] [client 98.159.37.43:46377] [client 98.159.37.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtF8mgbPVf4pO12NZni9gAAAJA"]
[Mon Feb 23 02:13:43.586368 2026] [:error] [pid 28426:tid 28530] [client 216.24.210.48:21649] [client 216.24.210.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.48, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtHV2gbPVf4pO12NZnlsAAAAIg"]
[Mon Feb 23 02:19:54.996579 2026] [:error] [pid 4806:tid 4809] [client 216.24.210.102:37133] [client 216.24.210.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtIyvFTHI_ud-cTYbQVAwAAAQE"]
[Mon Feb 23 02:26:03.087842 2026] [:error] [pid 28558:tid 28576] [client 98.159.37.44:33761] [client 98.159.37.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtKOydFHR5e1Gd10vecgQAAANA"]
[Mon Feb 23 02:32:13.526876 2026] [:error] [pid 28558:tid 28582] [client 216.24.210.99:59171] [client 216.24.210.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtLrSdFHR5e1Gd10vefiAAAANY"]
[Mon Feb 23 02:38:20.848380 2026] [:error] [pid 4806:tid 4831] [client 216.24.210.107:50729] [client 216.24.210.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.107, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtNHPFTHI_ud-cTYbQfjAAAARc"]
[Mon Feb 23 02:44:23.713758 2026] [:error] [pid 4806:tid 4808] [client 216.24.210.121:60091] [client 216.24.210.121] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.121, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtOh_FTHI_ud-cTYbQi7gAAAQA"]
[Mon Feb 23 02:50:40.107069 2026] [:error] [pid 28425:tid 28511] [client 98.159.37.38:35941] [client 98.159.37.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtQADO7QIkwG1UqFGwNJAAAAFI"]
[Mon Feb 23 02:56:38.775315 2026] [:error] [pid 28558:tid 28560] [client 98.159.37.42:22445] [client 98.159.37.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.42, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtRZidFHR5e1Gd10verEQAAAMA"]
[Mon Feb 23 03:02:38.785834 2026] [:error] [pid 4806:tid 4811] [client 216.24.210.113:45511] [client 216.24.210.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.113, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtSzvFTHI_ud-cTYbQr_wAAAQM"]
[Mon Feb 23 03:08:45.629609 2026] [:error] [pid 28558:tid 28578] [client 98.159.37.31:23751] [client 98.159.37.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtUPSdFHR5e1Gd10vev7QAAANI"]
[Mon Feb 23 03:14:56.473267 2026] [:error] [pid 28424:tid 28445] [client 216.24.210.49:53983] [client 216.24.210.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.49, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtVsABAZT_BJOxE-Z5UZgAAABE"]
[Mon Feb 23 03:21:11.452308 2026] [:error] [pid 28426:tid 28542] [client 98.159.37.34:57953] [client 98.159.37.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.34, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtXJ2gbPVf4pO12NZn--wAAAJQ"]
[Mon Feb 23 03:25:14.718221 2026] [:error] [pid 28426:tid 28537] [client 187.120.52.168:33411] [client 187.120.52.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.120.52.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZtYGmgbPVf4pO12NZkAzgAAAI8"]
[Mon Feb 23 03:27:16.899213 2026] [:error] [pid 28558:tid 28564] [client 98.159.37.37:25847] [client 98.159.37.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.37, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtYlCdFHR5e1Gd10ve31AAAAMQ"]
[Mon Feb 23 03:33:31.116953 2026] [:error] [pid 28425:tid 28509] [client 216.24.210.116:31273] [client 216.24.210.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtaCzO7QIkwG1UqFGweFQAAAFA"]
[Mon Feb 23 03:39:48.670215 2026] [:error] [pid 28425:tid 28494] [client 216.24.210.119:40071] [client 216.24.210.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.119, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtbhDO7QIkwG1UqFGwf-AAAAEE"]
[Mon Feb 23 03:46:14.974240 2026] [:error] [pid 52203:tid 52260] [client 216.24.210.101:34327] [client 216.24.210.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.101, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtdBo2G7HHSEgnIv4CTZgAAAEc"]
[Mon Feb 23 03:52:34.792829 2026] [:error] [pid 52366:tid 52395] [client 216.24.210.117:50959] [client 216.24.210.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.117, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtegg94gUnLSLvfklPzcgAAANI"]
[Mon Feb 23 03:58:40.138032 2026] [:error] [pid 24211:tid 24228] [client 216.24.210.104:56011] [client 216.24.210.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtf8Fm1sz-v1hIlKZQPJgAAAA0"]
[Mon Feb 23 04:04:46.125629 2026] [:error] [pid 54381:tid 54451] [client 98.159.37.44:20941] [client 98.159.37.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZthXrZA3T28ex6RStpKagAAAIk"]
[Mon Feb 23 04:11:17.075069 2026] [:error] [pid 54482:tid 54487] [client 98.159.37.34:24071] [client 98.159.37.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.34, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZti5T8bYINguLe1hWc1VwAAAMM"]
[Mon Feb 23 04:17:30.373419 2026] [:error] [pid 54379:tid 54399] [client 98.159.37.43:48443] [client 98.159.37.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtkWtEE6mAMJmUyCcRjfgAAAAs"]
[Mon Feb 23 04:23:52.931952 2026] [:error] [pid 54379:tid 54390] [client 216.24.210.102:63899] [client 216.24.210.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtl2NEE6mAMJmUyCcRldAAAAAI"]
[Mon Feb 23 04:30:05.119301 2026] [:error] [pid 54379:tid 54408] [client 98.159.37.35:25159] [client 98.159.37.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtnTdEE6mAMJmUyCcRnrgAAABQ"]
[Mon Feb 23 04:36:22.766971 2026] [:error] [pid 54482:tid 54486] [client 216.24.210.49:45375] [client 216.24.210.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.49, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtoxj8bYINguLe1hWc_1AAAAMI"]
[Mon Feb 23 04:42:35.908206 2026] [:error] [pid 54482:tid 54489] [client 216.24.210.117:24681] [client 216.24.210.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.117, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtqOz8bYINguLe1hWdCUwAAAMU"]
[Mon Feb 23 04:49:12.334630 2026] [:error] [pid 56133:tid 56159] [client 216.24.210.27:63417] [client 216.24.210.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtryNhBvtDnaqF5Ql7xsQAAARg"]
[Mon Feb 23 04:55:37.257529 2026] [:error] [pid 56133:tid 56158] [client 98.159.37.44:38815] [client 98.159.37.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZttSdhBvtDnaqF5Ql702wAAARc"]
[Mon Feb 23 05:02:22.516905 2026] [:error] [pid 54482:tid 54497] [client 216.24.210.105:38763] [client 216.24.210.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.105, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtu3j8bYINguLe1hWdLTgAAAM0"]
[Mon Feb 23 05:08:33.856487 2026] [:error] [pid 54380:tid 54415] [client 216.24.210.98:25429] [client 216.24.210.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.98, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtwUaX3e5TFfa1i4D0mAQAAAEA"]
[Mon Feb 23 05:14:42.838147 2026] [:error] [pid 35629:tid 35639] [client 98.159.37.29:57669] [client 98.159.37.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtxwtMXZIv4bciDBETMbwAAAUc"]
[Mon Feb 23 05:20:50.841270 2026] [:error] [pid 54379:tid 54392] [client 216.24.210.116:60027] [client 216.24.210.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZtzMtEE6mAMJmUyCcR6iAAAAAQ"]
[Mon Feb 23 05:27:22.597433 2026] [:error] [pid 35629:tid 35632] [client 98.159.37.23:39921] [client 98.159.37.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZt0utMXZIv4bciDBETSRAAAAUA"]
[Mon Feb 23 05:34:11.759201 2026] [:error] [pid 56133:tid 56148] [client 98.159.37.44:42609] [client 98.159.37.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZt2U9hBvtDnaqF5Ql4I0AAAAQ0"]
[Mon Feb 23 06:07:31.234872 2026] [:error] [pid 2446:tid 2511] [client 98.159.37.23:46827] [client 98.159.37.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZt-I9MqX9gYEfsYvrilGAAAAIk"]
[Mon Feb 23 06:15:40.040116 2026] [:error] [pid 2826:tid 2851] [client 216.24.210.49:37927] [client 216.24.210.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.49, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuADD3FWVe0BC2oMiDR8wAAARY"]
[Mon Feb 23 06:23:31.346145 2026] [:error] [pid 2570:tid 2579] [client 98.159.37.23:29303] [client 98.159.37.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuB46h2MyYIw6djQ6W5xQAAAME"]
[Mon Feb 23 06:31:16.971309 2026] [:error] [pid 2570:tid 2597] [client 98.159.37.34:47283] [client 98.159.37.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.34, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuDtKh2MyYIw6djQ6W-pAAAANM"]
[Mon Feb 23 06:38:56.179463 2026] [:error] [pid 2826:tid 2851] [client 98.159.37.43:43871] [client 98.159.37.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuFgD3FWVe0BC2oMiDl2QAAARY"]
[Mon Feb 23 06:46:34.361038 2026] [:error] [pid 2446:tid 2514] [client 98.159.37.38:60083] [client 98.159.37.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuHStMqX9gYEfsYvri2lgAAAIw"]
[Mon Feb 23 06:54:40.268692 2026] [:error] [pid 2445:tid 2486] [client 98.159.37.24:53205] [client 98.159.37.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuJMD1z6EhBn71lCAGB4gAAAEs"]
[Mon Feb 23 07:02:55.422339 2026] [:error] [pid 2446:tid 2523] [client 98.159.37.28:63997] [client 98.159.37.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuLH9MqX9gYEfsYvri7LAAAAJU"]
[Mon Feb 23 07:10:58.296152 2026] [:error] [pid 2444:tid 2463] [client 216.24.210.96:36297] [client 216.24.210.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuNArMHc-5h3vMZorA0EAAAAA8"]
[Mon Feb 23 07:18:25.219983 2026] [:error] [pid 2444:tid 2452] [client 216.24.210.96:54425] [client 216.24.210.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuOwbMHc-5h3vMZorA1lgAAAAQ"]
[Mon Feb 23 07:25:04.194620 2026] [:error] [pid 2570:tid 2602] [client 98.159.37.45:61843] [client 98.159.37.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.45, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuQUKh2MyYIw6djQ6XXqgAAANg"]
[Mon Feb 23 07:31:42.407935 2026] [:error] [pid 2570:tid 2595] [client 98.159.37.25:55697] [client 98.159.37.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuR3qh2MyYIw6djQ6XblwAAANE"]
[Mon Feb 23 07:38:45.451982 2026] [:error] [pid 25295:tid 25338] [client 98.159.37.28:55109] [client 98.159.37.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuThY2Av4J1Jnqi7yJ-QwAAAIc"]
[Mon Feb 23 07:46:06.872132 2026] [:error] [pid 25295:tid 25335] [client 98.159.37.28:46859] [client 98.159.37.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuVPo2Av4J1Jnqi7yKBUQAAAIQ"]
[Mon Feb 23 07:53:52.402691 2026] [:error] [pid 25295:tid 25369] [client 98.159.37.44:20983] [client 98.159.37.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuXEI2Av4J1Jnqi7yKFTwAAAJg"]
[Mon Feb 23 08:01:41.600866 2026] [:error] [pid 25380:tid 25394] [client 98.159.37.27:49615] [client 98.159.37.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuY5aKrc8yFQ8fy78r-vwAAAMw"]
[Mon Feb 23 08:09:14.730913 2026] [:error] [pid 25294:tid 25364] [client 98.159.37.31:22089] [client 98.159.37.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuaqiRCFB3CqIo_jfZPugAAAE8"]
[Mon Feb 23 08:16:17.082925 2026] [:error] [pid 25294:tid 25351] [client 216.24.210.104:63737] [client 216.24.210.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZucUSRCFB3CqIo_jfZWDwAAAEk"]
[Mon Feb 23 08:22:55.545821 2026] [:error] [pid 25380:tid 25406] [client 216.24.210.103:50279] [client 216.24.210.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.103, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZud36Krc8yFQ8fy78oNTwAAANg"]
[Mon Feb 23 08:29:52.571993 2026] [:error] [pid 29909:tid 29931] [client 216.24.210.95:40501] [client 216.24.210.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.95, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZufgD9oc2QzltksUk6jlAAAARQ"]
[Mon Feb 23 08:36:52.796710 2026] [:error] [pid 25380:tid 25391] [client 216.24.210.117:54797] [client 216.24.210.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.117, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuhJKKrc8yFQ8fy78oVpgAAAMk"]
[Mon Feb 23 08:44:21.148486 2026] [:error] [pid 39540:tid 39581] [client 98.159.37.27:39717] [client 98.159.37.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZui5bsgm9aTWhlRScJhvgAAAcw"]
[Mon Feb 23 08:52:12.414620 2026] [:error] [pid 25380:tid 25393] [client 216.24.210.115:44693] [client 216.24.210.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.115, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZukvKKrc8yFQ8fy78ogIwAAAMs"]
[Mon Feb 23 08:59:54.410348 2026] [:error] [pid 39540:tid 39569] [client 216.24.210.115:31147] [client 216.24.210.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.115, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZumirsgm9aTWhlRScJuYwAAAcA"]
[Mon Feb 23 09:07:50.963218 2026] [:error] [pid 39540:tid 39576] [client 216.24.210.104:46021] [client 216.24.210.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuoZrsgm9aTWhlRScJ09gAAAcc"]
[Mon Feb 23 09:15:51.790604 2026] [:error] [pid 39640:tid 39694] [client 216.24.210.116:51905] [client 216.24.210.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuqR9sK--eVCgzvvucv1wAAApg"]
[Mon Feb 23 09:23:56.383140 2026] [:error] [pid 25294:tid 25328] [client 98.159.37.45:58973] [client 98.159.37.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.45, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZusLCRCFB3CqIo_jfZ0UwAAAEA"]
[Mon Feb 23 09:31:28.956671 2026] [:error] [pid 39540:tid 39575] [client 98.159.37.24:51137] [client 98.159.37.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZut8Lsgm9aTWhlRScKJmQAAAcY"]
[Mon Feb 23 09:34:24.087155 2026] [:error] [pid 39540:tid 39580] [client 49.51.141.76:47896] [client 49.51.141.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZuuoLsgm9aTWhlRScKLWgAAAcs"]
[Mon Feb 23 09:38:33.065142 2026] [:error] [pid 39640:tid 39673] [client 216.24.210.104:39059] [client 216.24.210.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuvmdsK--eVCgzvvuc5qAAAAoM"]
[Mon Feb 23 09:45:32.691330 2026] [:error] [pid 25293:tid 25305] [client 216.24.210.49:29411] [client 216.24.210.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.49, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuxPOL9XfBf66iHi_eNwgAAAAY"]
[Mon Feb 23 09:52:49.706086 2026] [:error] [pid 39640:tid 39681] [client 98.159.37.29:60499] [client 98.159.37.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZuy8dsK--eVCgzvvuc-oAAAAos"]
[Mon Feb 23 10:00:34.173990 2026] [:error] [pid 39540:tid 39585] [client 216.24.210.101:36897] [client 216.24.210.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.101, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZu0wrsgm9aTWhlRScKd-QAAAdA"]
[Mon Feb 23 10:08:58.103490 2026] [:error] [pid 39540:tid 39575] [client 216.24.210.101:62417] [client 216.24.210.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.101, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZu2ursgm9aTWhlRScKlYwAAAcY"]
[Mon Feb 23 10:17:37.794570 2026] [:error] [pid 39640:tid 39694] [client 98.159.37.35:26237] [client 98.159.37.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZu4wdsK--eVCgzvvudIFgAAApg"]
[Mon Feb 23 10:26:24.249677 2026] [:error] [pid 39540:tid 39569] [client 216.24.210.111:57597] [client 216.24.210.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZu60Lsgm9aTWhlRScKxSAAAAcA"]
[Mon Feb 23 10:35:11.492523 2026] [:error] [pid 25380:tid 25386] [client 216.24.210.113:57159] [client 216.24.210.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.113, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZu836Krc8yFQ8fy78pYjwAAAMQ"]
[Mon Feb 23 10:43:47.949890 2026] [:error] [pid 39640:tid 39672] [client 98.159.37.27:49063] [client 98.159.37.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZu-49sK--eVCgzvvudR2gAAAoI"]
[Mon Feb 23 10:52:18.835153 2026] [:error] [pid 39540:tid 39584] [client 216.24.210.118:36909] [client 216.24.210.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZvA4rsgm9aTWhlRScLAlgAAAc8"]
[Mon Feb 23 11:00:27.110506 2026] [:error] [pid 25293:tid 25314] [client 216.24.210.119:32307] [client 216.24.210.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.119, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZvCy-L9XfBf66iHi_eRFQAAAA8"]
[Mon Feb 23 11:08:38.004277 2026] [:error] [pid 39504:tid 39510] [client 216.24.210.108:49399] [client 216.24.210.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.108, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZvEtnLcHpOlI9gwwJroOwAAAUQ"]
[Mon Feb 23 11:17:14.169360 2026] [:error] [pid 25380:tid 25388] [client 216.24.210.113:21689] [client 216.24.210.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.113, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZvGuqKrc8yFQ8fy78poIgAAAMY"]
[Mon Feb 23 11:26:07.944222 2026] [:error] [pid 39540:tid 39593] [client 98.159.37.37:63169] [client 98.159.37.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.37, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZvIz7sgm9aTWhlRScLQFgAAAdg"]
[Mon Feb 23 11:35:20.304712 2026] [:error] [pid 29909:tid 29917] [client 98.159.37.40:29447] [client 98.159.37.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.40, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZvK-D9oc2QzltksUk62JgAAAQY"]
[Mon Feb 23 11:44:15.016451 2026] [:error] [pid 25380:tid 25390] [client 98.159.37.26:55285] [client 98.159.37.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZvND6Krc8yFQ8fy78pzXgAAAMg"]
[Mon Feb 23 12:02:10.908648 2026] [:error] [pid 25294:tid 25377] [client 98.159.37.30:43711] [client 98.159.37.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZvRQiRCFB3CqIo_jfaPQAAAAFg"]
[Mon Feb 23 12:11:04.784292 2026] [:error] [pid 39540:tid 39569] [client 98.159.37.43:64167] [client 98.159.37.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZvTWLsgm9aTWhlRScLrDgAAAcA"]
[Mon Feb 23 12:19:56.704506 2026] [:error] [pid 39640:tid 39686] [client 216.24.210.242:61093] [client 216.24.210.242] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.242, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZvVbNsK--eVCgzvvudvRwAAApA"]
[Mon Feb 23 12:28:32.647247 2026] [:error] [pid 39639:tid 39653] [client 98.159.37.35:53109] [client 98.159.37.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZvXcBpFkMoMi8uTUUM28QAAAko"]
[Mon Feb 23 12:45:45.039531 2026] [:error] [pid 25380:tid 25386] [client 98.159.37.27:41311] [client 98.159.37.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZvbeaKrc8yFQ8fy78qMAgAAAMQ"]
[Mon Feb 23 12:53:56.602442 2026] [:error] [pid 39540:tid 39585] [client 216.24.210.27:34691] [client 216.24.210.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZvdZLsgm9aTWhlRScIA5wAAAdA"]
[Mon Feb 23 13:02:05.167627 2026] [:error] [pid 25380:tid 25404] [client 98.159.37.30:56047] [client 98.159.37.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZvfTaKrc8yFQ8fy78qRBwAAANY"]
[Mon Feb 23 13:10:42.648365 2026] [:error] [pid 39640:tid 39683] [client 98.159.37.26:51359] [client 98.159.37.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZvhUtsK--eVCgzvvud7OwAAAo0"]
[Mon Feb 23 13:19:38.914953 2026] [:error] [pid 25295:tid 25347] [client 98.159.37.42:31745] [client 98.159.37.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.42, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZvjao2Av4J1Jnqi7yKpXgAAAI0"]
[Mon Feb 23 13:28:43.912014 2026] [:error] [pid 39640:tid 39681] [client 216.24.210.116:55381] [client 216.24.210.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZvli9sK--eVCgzvvueBNwAAAos"]
[Mon Feb 23 13:37:36.908284 2026] [:error] [pid 25294:tid 25377] [client 216.24.210.48:59485] [client 216.24.210.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.48, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZvnoCRCFB3CqIo_jfadzQAAAFg"]
[Mon Feb 23 13:46:20.922897 2026] [:error] [pid 25295:tid 25365] [client 98.159.37.27:48927] [client 98.159.37.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZvprI2Av4J1Jnqi7yKrBQAAAJY"]
[Mon Feb 23 14:11:51.792243 2026] [:error] [pid 39540:tid 39577] [client 216.24.210.104:29289] [client 216.24.210.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZvvp7sgm9aTWhlRScIoLQAAAcg"]
[Mon Feb 23 14:20:21.752727 2026] [:error] [pid 25380:tid 25391] [client 98.159.37.36:49361] [client 98.159.37.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.36, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZvxpaKrc8yFQ8fy78qxDQAAAMk"]
[Mon Feb 23 14:37:24.738906 2026] [:error] [pid 39540:tid 39592] [client 98.159.37.25:53027] [client 98.159.37.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZv1pLsgm9aTWhlRScI1bwAAAdc"]
[Mon Feb 23 14:45:52.584572 2026] [:error] [pid 39639:tid 39663] [client 216.24.210.108:24157] [client 216.24.210.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.108, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZv3oBpFkMoMi8uTUUNSlwAAAlQ"]
[Mon Feb 23 14:54:03.987762 2026] [:error] [pid 39504:tid 39521] [client 216.24.210.100:35059] [client 216.24.210.100] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.100, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZv5i3LcHpOlI9gwwJr8aQAAAU8"]
[Mon Feb 23 18:07:39.949132 2026] [:error] [pid 25380:tid 25405] [client 170.106.35.187:48460] [client 170.106.35.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZwm66Krc8yFQ8fy78oMVQAAANc"]
[Mon Feb 23 18:16:10.425440 2026] [:error] [pid 39639:tid 39648] [client 5.195.219.154:58133] [client 5.195.219.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.195.219.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZwo6hpFkMoMi8uTUUOPUQAAAkU"]
[Mon Feb 23 19:24:12.854406 2026] [:error] [pid 25380:tid 25404] [client 182.42.105.144:50747] [client 182.42.105.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZw43KKrc8yFQ8fy78omDAAAANY"]
[Mon Feb 23 20:10:01.386920 2026] [:error] [pid 39639:tid 39657] [client 37.140.254.82:65129] [client 37.140.254.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aZxDmRpFkMoMi8uTUUPFIwAAAk4"]
[Mon Feb 23 20:10:05.590855 2026] [:error] [pid 25294:tid 25343] [client 37.140.254.81:23089] [client 37.140.254.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aZxDnSRCFB3CqIo_jfbhXwAAAEU"]
[Mon Feb 23 20:10:12.415532 2026] [:error] [pid 39538:tid 39543] [client 37.140.254.98:60059] [client 37.140.254.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aZxDpC4Zk8-cQOG3ZnpuAgAAAYE"]
[Mon Feb 23 20:10:17.727982 2026] [:error] [pid 25380:tid 25404] [client 37.140.254.82:58513] [client 37.140.254.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aZxDqaKrc8yFQ8fy78o2OAAAANY"]
[Mon Feb 23 20:10:24.577991 2026] [:error] [pid 25380:tid 25385] [client 37.140.254.59:23499] [client 37.140.254.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aZxDsKKrc8yFQ8fy78o2VAAAAMM"]
[Mon Feb 23 20:10:26.582758 2026] [:error] [pid 39540:tid 39584] [client 37.140.254.82:40679] [client 37.140.254.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aZxDsrsgm9aTWhlRScKu9AAAAc8"]
[Mon Feb 23 20:10:28.249599 2026] [:error] [pid 39540:tid 39581] [client 37.140.254.64:60283] [client 37.140.254.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aZxDtLsgm9aTWhlRScKu9wAAAcw"]
[Mon Feb 23 20:10:28.856398 2026] [:error] [pid 39639:tid 39653] [client 37.140.254.101:41269] [client 37.140.254.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aZxDtBpFkMoMi8uTUUPFNgAAAko"]
[Mon Feb 23 20:10:29.469936 2026] [:error] [pid 39639:tid 39664] [client 37.140.254.83:63507] [client 37.140.254.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aZxDtRpFkMoMi8uTUUPFOgAAAlU"]
[Mon Feb 23 20:10:30.124857 2026] [:error] [pid 25293:tid 25300] [client 37.140.254.64:57757] [client 37.140.254.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aZxDtuL9XfBf66iHi_erBAAAAAE"]
[Mon Feb 23 20:10:31.707934 2026] [:error] [pid 25295:tid 25344] [client 37.140.254.88:36293] [client 37.140.254.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aZxDt42Av4J1Jnqi7yLCgQAAAIs"]
[Mon Feb 23 20:10:34.132527 2026] [:error] [pid 39540:tid 39583] [client 37.140.254.61:40417] [client 37.140.254.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aZxDursgm9aTWhlRScKu_QAAAc4"]
[Mon Feb 23 20:10:36.920791 2026] [:error] [pid 25294:tid 25360] [client 37.140.254.79:57449] [client 37.140.254.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aZxDvCRCFB3CqIo_jfbhbgAAAE0"]
[Mon Feb 23 20:10:38.391505 2026] [:error] [pid 25380:tid 25398] [client 37.140.254.60:54719] [client 37.140.254.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aZxDvqKrc8yFQ8fy78o2ZAAAANA"]
[Mon Feb 23 20:10:40.613251 2026] [:error] [pid 25294:tid 25345] [client 37.140.254.105:22263] [client 37.140.254.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aZxDwCRCFB3CqIo_jfbhcgAAAEY"]
[Mon Feb 23 20:10:47.276330 2026] [:error] [pid 39540:tid 39575] [client 37.140.254.98:24365] [client 37.140.254.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aZxDx7sgm9aTWhlRScKvBwAAAcY"]
[Mon Feb 23 20:10:49.308967 2026] [:error] [pid 39639:tid 39661] [client 37.140.254.88:49701] [client 37.140.254.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aZxDyRpFkMoMi8uTUUPFRQAAAlI"]
[Mon Feb 23 20:10:52.575639 2026] [:error] [pid 25380:tid 25402] [client 37.140.254.69:63249] [client 37.140.254.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/defaults.php"] [unique_id "aZxDzKKrc8yFQ8fy78o2gwAAANQ"]
[Mon Feb 23 20:10:54.693784 2026] [:error] [pid 39540:tid 39588] [client 37.140.254.145:31319] [client 37.140.254.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aZxDzrsgm9aTWhlRScKvEQAAAdM"]
[Mon Feb 23 20:10:59.412247 2026] [:error] [pid 25380:tid 25392] [client 37.140.254.103:47239] [client 37.140.254.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aZxD06Krc8yFQ8fy78o2jgAAAMo"]
[Mon Feb 23 20:11:01.833800 2026] [:error] [pid 39540:tid 39589] [client 37.140.254.99:36263] [client 37.140.254.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aZxD1bsgm9aTWhlRScKvGAAAAdQ"]
[Mon Feb 23 20:11:04.125126 2026] [:error] [pid 29909:tid 29929] [client 37.140.254.69:27907] [client 37.140.254.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aZxD2D9oc2QzltksUk7bNgAAARI"]
[Mon Feb 23 20:11:05.796718 2026] [:error] [pid 25380:tid 25396] [client 37.140.254.66:51379] [client 37.140.254.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aZxD2aKrc8yFQ8fy78o2kAAAAM4"]
[Mon Feb 23 20:11:06.418339 2026] [:error] [pid 25380:tid 25400] [client 37.140.254.58:34417] [client 37.140.254.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aZxD2qKrc8yFQ8fy78o2kQAAANI"]
[Mon Feb 23 20:11:10.116827 2026] [:error] [pid 25380:tid 25398] [client 37.140.254.72:34689] [client 37.140.254.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/info.php"] [unique_id "aZxD3qKrc8yFQ8fy78o2mQAAANA"]
[Mon Feb 23 20:11:10.695483 2026] [:error] [pid 25380:tid 25399] [client 37.140.254.81:60251] [client 37.140.254.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class.api.php"] [unique_id "aZxD3qKrc8yFQ8fy78o2nAAAANE"]
[Mon Feb 23 20:11:11.597938 2026] [:error] [pid 25380:tid 25404] [client 37.140.254.81:42453] [client 37.140.254.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aZxD36Krc8yFQ8fy78o2ngAAANY"]
[Mon Feb 23 20:11:20.054525 2026] [:error] [pid 39639:tid 39648] [client 37.140.254.84:38927] [client 37.140.254.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/admin.php"] [unique_id "aZxD6BpFkMoMi8uTUUPFbwAAAkU"]
[Mon Feb 23 20:11:23.755674 2026] [:error] [pid 25294:tid 25330] [client 37.140.254.79:28775] [client 37.140.254.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.254.79, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aZxD6yRCFB3CqIo_jfbhhQAAAEE"]
[Mon Feb 23 20:11:36.296843 2026] [:error] [pid 25294:tid 25334] [client 37.140.254.79:28775] [client 37.140.254.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aZxD-CRCFB3CqIo_jfbhlgAAAEM"]
[Mon Feb 23 20:11:39.331070 2026] [:error] [pid 39540:tid 39591] [client 37.140.254.61:52815] [client 37.140.254.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.254.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aZxD-7sgm9aTWhlRScKvQAAAAdY"]
[Mon Feb 23 20:11:41.424384 2026] [:error] [pid 39540:tid 39582] [client 37.140.254.61:52815] [client 37.140.254.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/item.php"] [unique_id "aZxD_bsgm9aTWhlRScKvQgAAAc0"]
[Mon Feb 23 20:11:50.144831 2026] [:error] [pid 25380:tid 25391] [client 37.140.254.61:48393] [client 37.140.254.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aZxEBqKrc8yFQ8fy78o20AAAAMk"]
[Mon Feb 23 20:11:58.419753 2026] [:error] [pid 39639:tid 39646] [client 37.140.254.81:54349] [client 37.140.254.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aZxEDhpFkMoMi8uTUUPFuQAAAkM"]
[Mon Feb 23 20:12:01.436062 2026] [:error] [pid 39639:tid 39655] [client 37.140.254.102:22409] [client 37.140.254.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aZxEERpFkMoMi8uTUUPFwAAAAkw"]
[Mon Feb 23 20:12:05.478810 2026] [:error] [pid 25380:tid 25392] [client 37.140.254.165:64681] [client 37.140.254.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.254.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aZxEFaKrc8yFQ8fy78o22QAAAMo"]
[Mon Feb 23 20:12:06.592055 2026] [:error] [pid 25380:tid 25401] [client 37.140.254.165:64681] [client 37.140.254.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aZxEFqKrc8yFQ8fy78o22gAAANM"]
[Mon Feb 23 20:12:25.498409 2026] [:error] [pid 25380:tid 25397] [client 37.140.254.75:56875] [client 37.140.254.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aZxEKaKrc8yFQ8fy78o29wAAAM8"]
[Mon Feb 23 20:12:30.067316 2026] [:error] [pid 39639:tid 39666] [client 37.140.254.84:28637] [client 37.140.254.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.254.84, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aZxELhpFkMoMi8uTUUPGAQAAAlc"]
[Mon Feb 23 20:12:34.963455 2026] [:error] [pid 39639:tid 39653] [client 37.140.254.84:28637] [client 37.140.254.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aZxEMhpFkMoMi8uTUUPGCQAAAko"]
[Mon Feb 23 20:12:36.976205 2026] [:error] [pid 25294:tid 25341] [client 37.140.254.87:57137] [client 37.140.254.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/infi.php"] [unique_id "aZxENCRCFB3CqIo_jfbhxAAAAEQ"]
[Mon Feb 23 20:12:39.427771 2026] [:error] [pid 39540:tid 39585] [client 49.51.47.100:51034] [client 49.51.47.100] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZxEN7sgm9aTWhlRScKvUwAAAdA"]
[Mon Feb 23 20:12:39.797186 2026] [:error] [pid 25294:tid 25345] [client 37.140.254.66:37681] [client 37.140.254.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aZxENyRCFB3CqIo_jfbhzQAAAEY"]
[Mon Feb 23 20:12:43.720622 2026] [:error] [pid 39538:tid 39543] [client 37.140.254.165:38675] [client 37.140.254.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aZxEOy4Zk8-cQOG3ZnpuJAAAAYE"]
[Mon Feb 23 20:12:44.604375 2026] [:error] [pid 39639:tid 39663] [client 37.140.254.92:57227] [client 37.140.254.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aZxEPBpFkMoMi8uTUUPGEgAAAlQ"]
[Mon Feb 23 20:12:51.840294 2026] [:error] [pid 39540:tid 39578] [client 37.140.254.72:20143] [client 37.140.254.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aZxEQ7sgm9aTWhlRScKvYwAAAck"]
[Mon Feb 23 20:12:53.866012 2026] [:error] [pid 39639:tid 39646] [client 37.140.254.84:54443] [client 37.140.254.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "aZxERRpFkMoMi8uTUUPGKwAAAkM"]
[Mon Feb 23 20:12:58.214013 2026] [:error] [pid 39639:tid 39645] [client 37.140.254.99:39039] [client 37.140.254.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/edit.php"] [unique_id "aZxEShpFkMoMi8uTUUPGNQAAAkI"]
[Mon Feb 23 20:13:02.047062 2026] [:error] [pid 25380:tid 25396] [client 37.140.254.91:59807] [client 37.140.254.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aZxETqKrc8yFQ8fy78o3DQAAAM4"]
[Mon Feb 23 20:13:05.014282 2026] [:error] [pid 39540:tid 39573] [client 37.140.254.77:30901] [client 37.140.254.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/click.php"] [unique_id "aZxEUbsgm9aTWhlRScKvbQAAAcQ"]
[Mon Feb 23 20:13:14.675909 2026] [:error] [pid 29909:tid 29914] [client 37.140.254.63:62593] [client 37.140.254.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aZxEWj9oc2QzltksUk7bUQAAAQM"]
[Mon Feb 23 20:13:23.160255 2026] [:error] [pid 39504:tid 39530] [client 37.140.254.68:39337] [client 37.140.254.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aZxEY3LcHpOlI9gwwJoZyAAAAVg"]
[Mon Feb 23 20:13:23.876854 2026] [:error] [pid 25294:tid 25351] [client 37.140.254.59:51659] [client 37.140.254.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/xl2023.php"] [unique_id "aZxEYyRCFB3CqIo_jfbh3wAAAEk"]
[Mon Feb 23 20:13:24.548707 2026] [:error] [pid 39540:tid 39570] [client 37.140.254.136:21989] [client 37.140.254.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aZxEZLsgm9aTWhlRScKvdwAAAcE"]
[Mon Feb 23 20:13:25.260519 2026] [:error] [pid 39639:tid 39651] [client 37.140.254.136:22187] [client 37.140.254.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aZxEZRpFkMoMi8uTUUPGTAAAAkg"]
[Mon Feb 23 20:13:27.333100 2026] [:error] [pid 39639:tid 39657] [client 37.140.254.87:47805] [client 37.140.254.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aZxEZxpFkMoMi8uTUUPGUgAAAk4"]
[Mon Feb 23 20:13:28.021508 2026] [:error] [pid 25380:tid 25401] [client 37.140.254.62:21547] [client 37.140.254.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aZxEaKKrc8yFQ8fy78o3HwAAANM"]
[Mon Feb 23 20:13:31.302239 2026] [:error] [pid 25294:tid 25364] [client 37.140.254.67:42575] [client 37.140.254.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aZxEayRCFB3CqIo_jfbh6wAAAE8"]
[Mon Feb 23 20:13:32.049359 2026] [:error] [pid 39540:tid 39593] [client 37.140.254.76:30811] [client 37.140.254.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aZxEbLsgm9aTWhlRScKvfAAAAdg"]
[Mon Feb 23 20:13:32.703209 2026] [:error] [pid 25380:tid 25397] [client 37.140.254.69:56963] [client 37.140.254.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aZxEbKKrc8yFQ8fy78o3KgAAAM8"]
[Mon Feb 23 20:13:33.388281 2026] [:error] [pid 25380:tid 25385] [client 37.140.254.136:36195] [client 37.140.254.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "aZxEbaKrc8yFQ8fy78o3LQAAAMM"]
[Mon Feb 23 20:13:35.983906 2026] [:error] [pid 39538:tid 39544] [client 37.140.254.89:22021] [client 37.140.254.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aZxEby4Zk8-cQOG3ZnpuMwAAAYI"]
[Mon Feb 23 20:13:36.641093 2026] [proxy_fcgi:error] [pid 29909:tid 29919] [client 37.140.254.107:22237] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function add_action() in /home/expressi/public_html/wp-content/plugins/hello.php:69\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/plugins/hello.php on line 69'
[Mon Feb 23 20:13:38.688130 2026] [:error] [pid 39640:tid 39678] [client 37.140.254.78:28557] [client 37.140.254.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "aZxEctsK--eVCgzvvufb0AAAAog"]
[Mon Feb 23 20:13:43.485086 2026] [:error] [pid 39639:tid 39655] [client 37.140.254.106:44775] [client 37.140.254.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aZxEdxpFkMoMi8uTUUPGYQAAAkw"]
[Mon Feb 23 20:13:51.524931 2026] [:error] [pid 25294:tid 25364] [client 37.140.254.95:34669] [client 37.140.254.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/file.php"] [unique_id "aZxEfyRCFB3CqIo_jfbh-wAAAE8"]
[Mon Feb 23 20:13:55.264414 2026] [:error] [pid 25294:tid 25368] [client 37.140.254.91:61321] [client 37.140.254.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aZxEgyRCFB3CqIo_jfbiAQAAAFE"]
[Mon Feb 23 20:13:55.859706 2026] [:error] [pid 39540:tid 39578] [client 37.140.254.60:65119] [client 37.140.254.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aZxEg7sgm9aTWhlRScKvhwAAAck"]
[Mon Feb 23 20:14:00.525782 2026] [:error] [pid 39540:tid 39574] [client 37.140.254.71:30455] [client 37.140.254.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aZxEiLsgm9aTWhlRScKvjAAAAcU"]
[Mon Feb 23 20:14:04.788915 2026] [proxy_fcgi:error] [pid 25294:tid 25331] [client 37.140.254.60:30439] AH01071: Got error 'Primary script unknown'
[Mon Feb 23 20:14:05.084439 2026] [proxy_fcgi:error] [pid 25294:tid 25334] [client 37.140.254.60:30439] AH01071: Got error 'Primary script unknown'
[Mon Feb 23 20:14:05.384998 2026] [proxy_fcgi:error] [pid 25294:tid 25377] [client 37.140.254.60:30439] AH01071: Got error 'Primary script unknown'
[Mon Feb 23 20:14:08.895620 2026] [:error] [pid 25294:tid 25354] [client 37.140.254.60:30439] [client 37.140.254.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aZxEkCRCFB3CqIo_jfbiGgAAAEo"]
[Mon Feb 23 20:14:09.572691 2026] [:error] [pid 39504:tid 39521] [client 37.140.254.68:20613] [client 37.140.254.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aZxEkXLcHpOlI9gwwJoZ2gAAAU8"]
[Mon Feb 23 20:14:10.214960 2026] [:error] [pid 39504:tid 39525] [client 37.140.254.108:62193] [client 37.140.254.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aZxEknLcHpOlI9gwwJoZ3AAAAVM"]
[Mon Feb 23 20:14:10.849206 2026] [:error] [pid 39639:tid 39665] [client 37.140.254.104:47973] [client 37.140.254.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aZxEkhpFkMoMi8uTUUPGfwAAAlY"]
[Mon Feb 23 20:14:11.498774 2026] [:error] [pid 25380:tid 25397] [client 37.140.254.83:51891] [client 37.140.254.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aZxEk6Krc8yFQ8fy78o3MwAAAM8"]
[Mon Feb 23 20:14:12.198734 2026] [:error] [pid 39639:tid 39650] [client 37.140.254.76:58329] [client 37.140.254.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aZxElBpFkMoMi8uTUUPGgwAAAkc"]
[Mon Feb 23 20:14:13.582531 2026] [:error] [pid 39639:tid 39667] [client 37.140.254.86:37683] [client 37.140.254.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "aZxElRpFkMoMi8uTUUPGiQAAAlg"]
[Mon Feb 23 20:14:14.262839 2026] [:error] [pid 39639:tid 39653] [client 37.140.254.65:33355] [client 37.140.254.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aZxElhpFkMoMi8uTUUPGiwAAAko"]
[Mon Feb 23 20:14:14.862363 2026] [:error] [pid 39639:tid 39663] [client 37.140.254.59:61941] [client 37.140.254.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aZxElhpFkMoMi8uTUUPGjQAAAlQ"]
[Mon Feb 23 20:14:15.463575 2026] [:error] [pid 39540:tid 39588] [client 37.140.254.92:22453] [client 37.140.254.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aZxEl7sgm9aTWhlRScKvlQAAAdM"]
[Mon Feb 23 20:14:18.360303 2026] [:error] [pid 39504:tid 39515] [client 37.140.254.136:44609] [client 37.140.254.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aZxEmnLcHpOlI9gwwJoZ4wAAAUk"]
[Mon Feb 23 20:14:19.992435 2026] [:error] [pid 39639:tid 39656] [client 37.140.254.98:30209] [client 37.140.254.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "aZxEmxpFkMoMi8uTUUPGlAAAAk0"]
[Mon Feb 23 20:14:24.068516 2026] [:error] [pid 39640:tid 39671] [client 37.140.254.60:40163] [client 37.140.254.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aZxEoNsK--eVCgzvvufb6QAAAoE"]
[Mon Feb 23 20:14:26.994534 2026] [:error] [pid 39540:tid 39593] [client 37.140.254.97:29365] [client 37.140.254.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/about.php"] [unique_id "aZxEorsgm9aTWhlRScKvoQAAAdg"]
[Mon Feb 23 20:14:31.021784 2026] [:error] [pid 39639:tid 39659] [client 37.140.254.68:47783] [client 37.140.254.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aZxEpxpFkMoMi8uTUUPGogAAAlA"]
[Mon Feb 23 20:14:35.988328 2026] [:error] [pid 39540:tid 39571] [client 37.140.254.79:20721] [client 37.140.254.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aZxEq7sgm9aTWhlRScKvqQAAAcI"]
[Mon Feb 23 20:14:38.286925 2026] [:error] [pid 39640:tid 39680] [client 37.140.254.87:49381] [client 37.140.254.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aZxErtsK--eVCgzvvufb7wAAAoo"]
[Mon Feb 23 20:14:54.919801 2026] [:error] [pid 25295:tid 25335] [client 37.140.254.62:25869] [client 37.140.254.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aZxEvo2Av4J1Jnqi7yLCqgAAAIQ"]
[Mon Feb 23 20:14:55.529713 2026] [:error] [pid 39540:tid 39589] [client 37.140.254.59:57753] [client 37.140.254.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aZxEv7sgm9aTWhlRScKv4AAAAdQ"]
[Mon Feb 23 20:14:56.204471 2026] [:error] [pid 25380:tid 25402] [client 37.140.254.109:33187] [client 37.140.254.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.254.109, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZxEwKKrc8yFQ8fy78o3SwAAANQ"]
[Mon Feb 23 20:14:59.068330 2026] [:error] [pid 25380:tid 25389] [client 37.140.254.109:33187] [client 37.140.254.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aZxEw6Krc8yFQ8fy78o3TwAAAMc"]
[Mon Feb 23 20:15:03.158765 2026] [:error] [pid 25380:tid 25387] [client 37.140.254.86:31931] [client 37.140.254.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aZxEx6Krc8yFQ8fy78o3XQAAAMU"]
[Mon Feb 23 20:15:03.733291 2026] [:error] [pid 25380:tid 25396] [client 37.140.254.61:57977] [client 37.140.254.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aZxEx6Krc8yFQ8fy78o3XgAAAM4"]
[Mon Feb 23 20:15:08.507246 2026] [:error] [pid 25294:tid 25370] [client 37.140.254.92:36297] [client 37.140.254.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aZxEzCRCFB3CqIo_jfbiOAAAAFI"]
[Mon Feb 23 20:15:09.135226 2026] [:error] [pid 29909:tid 29931] [client 37.140.254.84:27509] [client 37.140.254.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aZxEzT9oc2QzltksUk7bZQAAARQ"]
[Mon Feb 23 20:15:14.952526 2026] [:error] [pid 29909:tid 29924] [client 37.140.254.60:61687] [client 37.140.254.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aZxE0j9oc2QzltksUk7bbAAAAQ0"]
[Mon Feb 23 20:15:17.846220 2026] [proxy_fcgi:error] [pid 25295:tid 25349] [client 37.140.254.92:40697] AH01071: Got error 'Primary script unknown'
[Mon Feb 23 20:15:19.121908 2026] [:error] [pid 25295:tid 25357] [client 37.140.254.92:40697] [client 37.140.254.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/function.php"] [unique_id "aZxE142Av4J1Jnqi7yLCtgAAAJI"]
[Mon Feb 23 20:15:19.721099 2026] [:error] [pid 29909:tid 29918] [client 37.140.254.101:23793] [client 37.140.254.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/plugins.php"] [unique_id "aZxE1z9oc2QzltksUk7bbgAAAQc"]
[Mon Feb 23 20:15:22.833528 2026] [:error] [pid 39639:tid 39657] [client 37.140.254.66:23987] [client 37.140.254.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "aZxE2hpFkMoMi8uTUUPG9wAAAk4"]
[Mon Feb 23 20:15:23.460699 2026] [:error] [pid 39639:tid 39654] [client 37.140.254.67:33695] [client 37.140.254.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aZxE2xpFkMoMi8uTUUPG-gAAAks"]
[Mon Feb 23 20:15:31.549820 2026] [:error] [pid 25380:tid 25400] [client 37.140.254.109:61835] [client 37.140.254.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/atomlib.php"] [unique_id "aZxE46Krc8yFQ8fy78o3cwAAANI"]
[Mon Feb 23 20:15:32.174608 2026] [:error] [pid 39639:tid 39649] [client 37.140.254.105:50709] [client 37.140.254.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aZxE5BpFkMoMi8uTUUPG_AAAAkY"]
[Mon Feb 23 20:15:36.872690 2026] [:error] [pid 25380:tid 25395] [client 37.140.254.65:23669] [client 37.140.254.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aZxE6KKrc8yFQ8fy78o3fQAAAM0"]
[Mon Feb 23 20:15:37.592954 2026] [:error] [pid 25380:tid 25383] [client 37.140.254.97:55713] [client 37.140.254.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aZxE6aKrc8yFQ8fy78o3fgAAAME"]
[Mon Feb 23 20:15:38.177125 2026] [:error] [pid 25380:tid 25402] [client 37.140.254.79:65453] [client 37.140.254.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aZxE6qKrc8yFQ8fy78o3fwAAANQ"]
[Mon Feb 23 20:15:43.914904 2026] [:error] [pid 29909:tid 29931] [client 37.140.254.63:23363] [client 37.140.254.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aZxE7z9oc2QzltksUk7bdQAAARQ"]
[Mon Feb 23 20:15:45.862361 2026] [:error] [pid 39504:tid 39519] [client 37.140.254.59:59307] [client 37.140.254.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aZxE8XLcHpOlI9gwwJoZ9gAAAU0"]
[Mon Feb 23 20:15:52.905252 2026] [:error] [pid 39639:tid 39650] [client 37.140.254.136:63707] [client 37.140.254.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.254.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/js/wp-login.php"] [unique_id "aZxE-BpFkMoMi8uTUUPHEQAAAkc"]
[Mon Feb 23 20:15:58.171542 2026] [:error] [pid 39639:tid 39645] [client 37.140.254.136:63707] [client 37.140.254.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bk/index.php"] [unique_id "aZxE_hpFkMoMi8uTUUPHGQAAAkI"]
[Mon Feb 23 20:15:58.728323 2026] [:error] [pid 39639:tid 39647] [client 37.140.254.70:48175] [client 37.140.254.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.254.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aZxE_hpFkMoMi8uTUUPHGgAAAkQ"]
[Mon Feb 23 20:16:10.329499 2026] [proxy_fcgi:error] [pid 39639:tid 39651] [client 37.140.254.70:48175] AH01071: Got error 'Primary script unknown'
[Mon Feb 23 20:16:24.054293 2026] [:error] [pid 39639:tid 39659] [client 37.140.254.70:48175] [client 37.140.254.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/about.php"] [unique_id "aZxFGBpFkMoMi8uTUUPHSwAAAlA"]
[Mon Feb 23 20:16:27.997789 2026] [:error] [pid 39540:tid 39577] [client 37.140.254.98:49949] [client 37.140.254.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aZxFG7sgm9aTWhlRScKwBQAAAcg"]
[Mon Feb 23 20:16:31.029995 2026] [:error] [pid 25380:tid 25386] [client 37.140.254.81:57631] [client 37.140.254.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aZxFH6Krc8yFQ8fy78o3pAAAAMQ"]
[Mon Feb 23 20:16:41.180915 2026] [:error] [pid 25294:tid 25348] [client 37.140.254.82:44375] [client 37.140.254.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aZxFKSRCFB3CqIo_jfbiZgAAAEc"]
[Mon Feb 23 20:16:44.367282 2026] [:error] [pid 39540:tid 39585] [client 37.140.254.136:37885] [client 37.140.254.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aZxFLLsgm9aTWhlRScKwFQAAAdA"]
[Mon Feb 23 20:16:46.386641 2026] [:error] [pid 29909:tid 29913] [client 37.140.254.111:26225] [client 37.140.254.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aZxFLj9oc2QzltksUk7bfwAAAQI"]
[Mon Feb 23 20:16:51.550537 2026] [proxy_fcgi:error] [pid 25293:tid 25320] [client 37.140.254.136:62117] AH01071: Got error 'Primary script unknown'
[Mon Feb 23 20:16:51.866920 2026] [proxy_fcgi:error] [pid 25293:tid 25317] [client 37.140.254.136:62117] AH01071: Got error 'Primary script unknown'
[Mon Feb 23 20:16:52.189693 2026] [:error] [pid 25293:tid 25299] [client 37.140.254.136:62117] [client 37.140.254.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aZxFNOL9XfBf66iHi_erQAAAAAA"]
[Mon Feb 23 20:16:52.784466 2026] [:error] [pid 25295:tid 25338] [client 37.140.254.69:51853] [client 37.140.254.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aZxFNI2Av4J1Jnqi7yLCxQAAAIc"]
[Mon Feb 23 20:17:00.368987 2026] [:error] [pid 39640:tid 39674] [client 37.140.254.87:45881] [client 37.140.254.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aZxFPNsK--eVCgzvvufcHwAAAoQ"]
[Mon Feb 23 20:17:02.580344 2026] [:error] [pid 39640:tid 39678] [client 37.140.254.136:58283] [client 37.140.254.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "aZxFPtsK--eVCgzvvufcIgAAAog"]
[Mon Feb 23 20:17:06.491614 2026] [:error] [pid 39639:tid 39664] [client 37.140.254.89:58761] [client 37.140.254.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aZxFQhpFkMoMi8uTUUPHegAAAlU"]
[Mon Feb 23 20:17:14.444520 2026] [:error] [pid 25295:tid 25336] [client 37.140.254.62:27509] [client 37.140.254.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aZxFSo2Av4J1Jnqi7yLC1AAAAIU"]
[Mon Feb 23 20:17:15.044123 2026] [proxy_fcgi:error] [pid 39639:tid 39667] [client 37.140.254.83:41333] AH01071: Got error 'Primary script unknown'
[Mon Feb 23 20:17:17.653485 2026] [:error] [pid 39639:tid 39661] [client 37.140.254.83:41333] [client 37.140.254.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aZxFTRpFkMoMi8uTUUPHgwAAAlI"]
[Mon Feb 23 20:17:23.368454 2026] [proxy_fcgi:error] [pid 39639:tid 39651] [client 37.140.254.81:47095] AH01071: Got error 'Primary script unknown'
[Mon Feb 23 20:17:24.549964 2026] [:error] [pid 39639:tid 39644] [client 37.140.254.81:47095] [client 37.140.254.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.140.254.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aZxFVBpFkMoMi8uTUUPHjgAAAkE"]
[Mon Feb 23 20:17:28.877321 2026] [:error] [pid 39639:tid 39665] [client 37.140.254.81:47095] [client 37.140.254.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aZxFWBpFkMoMi8uTUUPHngAAAlY"]
[Mon Feb 23 20:17:30.885527 2026] [:error] [pid 25294:tid 25343] [client 37.140.254.86:41233] [client 37.140.254.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aZxFWiRCFB3CqIo_jfbieAAAAEU"]
[Mon Feb 23 20:17:35.498474 2026] [:error] [pid 39639:tid 39659] [client 37.140.254.136:51357] [client 37.140.254.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aZxFXxpFkMoMi8uTUUPHsQAAAlA"]
[Mon Feb 23 20:17:40.197323 2026] [:error] [pid 39639:tid 39644] [client 37.140.254.89:20765] [client 37.140.254.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aZxFZBpFkMoMi8uTUUPHzAAAAkE"]
[Mon Feb 23 20:17:42.162851 2026] [:error] [pid 39639:tid 39661] [client 37.140.254.101:45389] [client 37.140.254.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aZxFZhpFkMoMi8uTUUPH2QAAAlI"]
[Mon Feb 23 20:17:46.260449 2026] [:error] [pid 39639:tid 39644] [client 37.140.254.71:65495] [client 37.140.254.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aZxFahpFkMoMi8uTUUPH4gAAAkE"]
[Mon Feb 23 20:17:49.982358 2026] [proxy_fcgi:error] [pid 25380:tid 25386] [client 37.140.254.58:31965] AH01071: Got error 'Primary script unknown'
[Mon Feb 23 20:17:50.303072 2026] [:error] [pid 25380:tid 25401] [client 37.140.254.58:31965] [client 37.140.254.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aZxFbqKrc8yFQ8fy78o30gAAANM"]
[Mon Feb 23 20:17:50.894873 2026] [proxy_fcgi:error] [pid 25380:tid 25383] [client 37.140.254.71:65345] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function add_action() in /home/expressi/public_html/wp-content/themes/twentytwentyfour/functions.php:147\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/themes/twentytwentyfour/functions.php on line 147'
[Mon Feb 23 20:18:01.549320 2026] [autoindex:error] [pid 39538:tid 39566] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:01.900924 2026] [autoindex:error] [pid 39538:tid 39548] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:02.590465 2026] [autoindex:error] [pid 39538:tid 39542] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:02.876706 2026] [autoindex:error] [pid 39538:tid 39546] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:04.571948 2026] [autoindex:error] [pid 39538:tid 39551] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:04.911562 2026] [autoindex:error] [pid 39538:tid 39562] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:05.270280 2026] [autoindex:error] [pid 39538:tid 39563] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:05.634308 2026] [autoindex:error] [pid 39538:tid 39565] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:05.974419 2026] [autoindex:error] [pid 39538:tid 39543] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:06.297463 2026] [autoindex:error] [pid 39538:tid 39560] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:07.285616 2026] [autoindex:error] [pid 39538:tid 39559] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:08.915813 2026] [autoindex:error] [pid 39538:tid 39553] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:09.413538 2026] [autoindex:error] [pid 39538:tid 39556] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:13.817353 2026] [autoindex:error] [pid 39538:tid 39564] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:14.354646 2026] [autoindex:error] [pid 39538:tid 39558] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:14.906534 2026] [autoindex:error] [pid 39538:tid 39545] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:15.402773 2026] [autoindex:error] [pid 39538:tid 39566] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:17.579518 2026] [autoindex:error] [pid 39538:tid 39550] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:17.922738 2026] [autoindex:error] [pid 39538:tid 39557] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:19.490847 2026] [autoindex:error] [pid 39538:tid 39546] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:22.274117 2026] [autoindex:error] [pid 39538:tid 39565] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:22.564195 2026] [autoindex:error] [pid 39538:tid 39560] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:23.863934 2026] [autoindex:error] [pid 39538:tid 39549] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:27.579357 2026] [autoindex:error] [pid 39538:tid 39558] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:30.574931 2026] [autoindex:error] [pid 39538:tid 39550] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:31.825361 2026] [autoindex:error] [pid 39538:tid 39542] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:32.229600 2026] [autoindex:error] [pid 39538:tid 39546] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:33.189691 2026] [autoindex:error] [pid 39538:tid 39563] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:33.589622 2026] [autoindex:error] [pid 39538:tid 39551] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:33.889805 2026] [autoindex:error] [pid 39538:tid 39565] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:18:37.828261 2026] [autoindex:error] [pid 39538:tid 39556] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:04.433224 2026] [autoindex:error] [pid 39538:tid 39556] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:04.734452 2026] [autoindex:error] [pid 39538:tid 39554] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:05.087032 2026] [autoindex:error] [pid 39538:tid 39559] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:05.400457 2026] [autoindex:error] [pid 39538:tid 39544] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:07.650549 2026] [autoindex:error] [pid 39538:tid 39561] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:08.113095 2026] [autoindex:error] [pid 39538:tid 39545] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:09.493267 2026] [autoindex:error] [pid 39538:tid 39566] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:10.732382 2026] [autoindex:error] [pid 39538:tid 39553] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:11.057710 2026] [autoindex:error] [pid 39538:tid 39552] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:11.389276 2026] [autoindex:error] [pid 39538:tid 39550] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:12.703128 2026] [autoindex:error] [pid 39538:tid 39542] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:13.067595 2026] [autoindex:error] [pid 39538:tid 39547] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:13.385182 2026] [autoindex:error] [pid 39538:tid 39557] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:13.679210 2026] [autoindex:error] [pid 39538:tid 39562] [client 37.140.254.108:28191] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:36.125808 2026] [autoindex:error] [pid 25380:tid 25391] [client 37.140.254.92:57539] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:47.982294 2026] [autoindex:error] [pid 25380:tid 25386] [client 37.140.254.92:57539] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:52.344741 2026] [autoindex:error] [pid 25380:tid 25392] [client 37.140.254.92:57539] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:52.646499 2026] [autoindex:error] [pid 25380:tid 25396] [client 37.140.254.92:57539] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:56.829547 2026] [autoindex:error] [pid 25380:tid 25403] [client 37.140.254.92:57539] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:57.224708 2026] [autoindex:error] [pid 25380:tid 25405] [client 37.140.254.92:57539] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:57.540556 2026] [autoindex:error] [pid 25380:tid 25399] [client 37.140.254.92:57539] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:57.832444 2026] [autoindex:error] [pid 25380:tid 25390] [client 37.140.254.92:57539] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:58.135346 2026] [autoindex:error] [pid 25380:tid 25395] [client 37.140.254.92:57539] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:58.477755 2026] [autoindex:error] [pid 25380:tid 25386] [client 37.140.254.92:57539] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:58.792240 2026] [autoindex:error] [pid 25380:tid 25400] [client 37.140.254.92:57539] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:59.107679 2026] [autoindex:error] [pid 25380:tid 25404] [client 37.140.254.92:57539] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:19:59.374114 2026] [autoindex:error] [pid 25380:tid 25396] [client 37.140.254.92:57539] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Feb 23 20:20:18.210984 2026] [autoindex:error] [pid 25380:tid 25401] [client 37.140.254.92:57539] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Feb 24 01:28:16.157970 2026] [:error] [pid 60063:tid 60075] [client 43.133.187.11:59356] [client 43.133.187.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZyOME_6t1uQomVVdUNWawAAAQo"]
[Tue Feb 24 02:24:58.079645 2026] [:error] [pid 29291:tid 29399] [client 188.166.176.213:51152] [client 188.166.176.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.166.176.213, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZybej2gdpbMAXIIRb15ngAAAIw"]
[Tue Feb 24 02:32:44.584518 2026] [:error] [pid 29424:tid 29434] [client 182.44.67.97:52996] [client 182.44.67.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZydTPgElGDq6B8YX7Bz8QAAAMg"]
[Tue Feb 24 05:14:28.639584 2026] [:error] [pid 37539:tid 37599] [client 20.234.99.178:33491] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "aZzDNHEnr46jUQep9z_CQQAAAFg"]
[Tue Feb 24 05:14:30.872151 2026] [:error] [pid 37539:tid 37579] [client 20.234.99.178:35718] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "aZzDNnEnr46jUQep9z_CTgAAAEQ"]
[Tue Feb 24 05:14:32.838587 2026] [:error] [pid 37540:tid 37605] [client 20.234.99.178:18166] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "aZzDOCahRAUBJS8hpJVWAgAAAIM"]
[Tue Feb 24 05:14:35.142814 2026] [:error] [pid 37644:tid 37666] [client 20.234.99.178:20005] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "aZzDO0LaEhVDwBRydH0wQAAAANQ"]
[Tue Feb 24 05:14:36.040736 2026] [:error] [pid 37644:tid 37669] [client 20.234.99.178:21317] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rak.php"] [unique_id "aZzDPELaEhVDwBRydH0wQwAAANc"]
[Tue Feb 24 05:14:39.146212 2026] [:error] [pid 37539:tid 37590] [client 20.234.99.178:14812] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rak.php"] [unique_id "aZzDP3Enr46jUQep9z_CUQAAAE8"]
[Tue Feb 24 05:14:40.685541 2026] [:error] [pid 37644:tid 37656] [client 20.234.99.178:25817] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rak.php"] [unique_id "aZzDQELaEhVDwBRydH0wUAAAAMo"]
[Tue Feb 24 05:14:49.526960 2026] [:error] [pid 11672:tid 11687] [client 20.234.99.178:25822] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rak.php"] [unique_id "aZzDSfa0fhnmfPYq92uR-gAAAQ0"]
[Tue Feb 24 05:14:57.681073 2026] [:error] [pid 11672:tid 11687] [client 20.234.99.178:2232] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rdfe.php"] [unique_id "aZzDUfa0fhnmfPYq92uSBgAAAQ0"]
[Tue Feb 24 05:14:59.795083 2026] [:error] [pid 37644:tid 37669] [client 20.234.99.178:19971] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rdfe.php"] [unique_id "aZzDU0LaEhVDwBRydH0whgAAANc"]
[Tue Feb 24 05:15:03.540971 2026] [:error] [pid 37644:tid 37658] [client 20.234.99.178:33496] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rdfe.php"] [unique_id "aZzDV0LaEhVDwBRydH0wjwAAAMw"]
[Tue Feb 24 05:15:26.177718 2026] [:error] [pid 11672:tid 11684] [client 20.234.99.178:33485] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sad.php"] [unique_id "aZzDbva0fhnmfPYq92uSIwAAAQo"]
[Tue Feb 24 05:15:38.011927 2026] [:error] [pid 37540:tid 37605] [client 20.234.99.178:35489] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless3.php"] [unique_id "aZzDeiahRAUBJS8hpJVWaAAAAIM"]
[Tue Feb 24 05:15:40.900706 2026] [:error] [pid 37538:tid 37548] [client 20.234.99.178:30342] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless3.php"] [unique_id "aZzDfCynTiHZ9J0Y2nZdPQAAAAA"]
[Tue Feb 24 05:15:52.540399 2026] [:error] [pid 37644:tid 37670] [client 20.234.99.178:26348] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless3.php"] [unique_id "aZzDiELaEhVDwBRydH0xIAAAANg"]
[Tue Feb 24 05:15:54.556214 2026] [:error] [pid 37539:tid 37591] [client 20.234.99.178:28849] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless2.php"] [unique_id "aZzDinEnr46jUQep9z_CeQAAAFA"]
[Tue Feb 24 05:15:57.267993 2026] [:error] [pid 37538:tid 37559] [client 20.234.99.178:35464] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless2.php"] [unique_id "aZzDjSynTiHZ9J0Y2nZdTwAAAAs"]
[Tue Feb 24 05:16:10.614640 2026] [:error] [pid 37539:tid 37597] [client 20.234.99.178:36178] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wander.php"] [unique_id "aZzDmnEnr46jUQep9z_CiAAAAFY"]
[Tue Feb 24 05:16:11.717792 2026] [:error] [pid 11672:tid 11684] [client 20.234.99.178:30356] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wander.php"] [unique_id "aZzDm_a0fhnmfPYq92uSbgAAAQo"]
[Tue Feb 24 05:16:14.434549 2026] [:error] [pid 11672:tid 11694] [client 20.234.99.178:35476] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wander.php"] [unique_id "aZzDnva0fhnmfPYq92uSdAAAARQ"]
[Tue Feb 24 05:16:15.094503 2026] [:error] [pid 37540:tid 37603] [client 20.234.99.178:21348] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wander.php"] [unique_id "aZzDnyahRAUBJS8hpJVWowAAAIE"]
[Tue Feb 24 05:16:18.838695 2026] [:error] [pid 37539:tid 37599] [client 20.234.99.178:25830] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2.php"] [unique_id "aZzDonEnr46jUQep9z_ClQAAAFg"]
[Tue Feb 24 05:16:20.072431 2026] [:error] [pid 37538:tid 37559] [client 20.234.99.178:15055] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v2.php"] [unique_id "aZzDpCynTiHZ9J0Y2nZdWwAAAAs"]
[Tue Feb 24 05:16:58.131234 2026] [:error] [pid 37644:tid 37654] [client 20.234.99.178:18921] [client 20.234.99.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aZzDykLaEhVDwBRydH0x4AAAAMg"]
[Tue Feb 24 05:17:04.184595 2026] [:error] [pid 37644:tid 37646] [client 20.234.99.178:17947] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc.php"] [unique_id "aZzD0ELaEhVDwBRydH0x6AAAAMA"]
[Tue Feb 24 05:17:05.834383 2026] [:error] [pid 37644:tid 37654] [client 20.234.99.178:35223] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc.php"] [unique_id "aZzD0ULaEhVDwBRydH0x6gAAAMg"]
[Tue Feb 24 05:17:10.071257 2026] [:error] [pid 37644:tid 37666] [client 20.234.99.178:34900] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc.php"] [unique_id "aZzD1kLaEhVDwBRydH0x-QAAANQ"]
[Tue Feb 24 05:17:14.290407 2026] [:error] [pid 11672:tid 11682] [client 20.234.99.178:32432] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc.php"] [unique_id "aZzD2va0fhnmfPYq92uSzwAAAQg"]
[Tue Feb 24 05:17:14.996796 2026] [:error] [pid 37644:tid 37656] [client 20.234.99.178:18924] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "aZzD2kLaEhVDwBRydH0yCgAAAMo"]
[Tue Feb 24 05:17:16.725064 2026] [:error] [pid 37644:tid 37662] [client 20.234.99.178:18914] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "aZzD3ELaEhVDwBRydH0yDAAAANA"]
[Tue Feb 24 05:17:17.585452 2026] [:error] [pid 11672:tid 11676] [client 20.234.99.178:19730] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "aZzD3fa0fhnmfPYq92uS1QAAAQI"]
[Tue Feb 24 05:17:19.037586 2026] [:error] [pid 37539:tid 37575] [client 20.234.99.178:32614] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "aZzD33Enr46jUQep9z_CwgAAAEA"]
[Tue Feb 24 05:17:20.240606 2026] [:error] [pid 37644:tid 37662] [client 20.234.99.178:30069] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rsnu.php"] [unique_id "aZzD4ELaEhVDwBRydH0yGgAAANA"]
[Tue Feb 24 05:17:22.185638 2026] [:error] [pid 37540:tid 37611] [client 20.234.99.178:18939] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rsnu.php"] [unique_id "aZzD4iahRAUBJS8hpJVW5AAAAIk"]
[Tue Feb 24 05:17:25.794815 2026] [:error] [pid 37539:tid 37585] [client 20.234.99.178:18555] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rsnu.php"] [unique_id "aZzD5XEnr46jUQep9z_CxwAAAEo"]
[Tue Feb 24 05:17:27.562194 2026] [:error] [pid 37539:tid 37578] [client 20.234.99.178:19804] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rsnu.php"] [unique_id "aZzD53Enr46jUQep9z_CygAAAEM"]
[Tue Feb 24 05:17:28.866736 2026] [:error] [pid 37538:tid 37556] [client 20.234.99.178:35037] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/trd.php"] [unique_id "aZzD6CynTiHZ9J0Y2nZdnQAAAAg"]
[Tue Feb 24 05:17:33.259762 2026] [:error] [pid 37538:tid 37568] [client 20.234.99.178:38213] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/trd.php"] [unique_id "aZzD7SynTiHZ9J0Y2nZdoAAAABQ"]
[Tue Feb 24 05:17:34.105476 2026] [:error] [pid 37644:tid 37667] [client 20.234.99.178:30959] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/trd.php"] [unique_id "aZzD7kLaEhVDwBRydH0yLQAAANU"]
[Tue Feb 24 05:17:42.652959 2026] [:error] [pid 11672:tid 11683] [client 20.234.99.178:26818] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/trd.php"] [unique_id "aZzD9va0fhnmfPYq92uS8QAAAQk"]
[Tue Feb 24 05:17:44.764203 2026] [:error] [pid 37538:tid 37556] [client 20.234.99.178:30961] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd67.php"] [unique_id "aZzD-CynTiHZ9J0Y2nZdqQAAAAg"]
[Tue Feb 24 05:17:47.442139 2026] [:error] [pid 37540:tid 37611] [client 20.234.99.178:22328] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd67.php"] [unique_id "aZzD-yahRAUBJS8hpJVW-AAAAIk"]
[Tue Feb 24 05:17:48.841442 2026] [:error] [pid 37538:tid 37567] [client 20.234.99.178:30962] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd67.php"] [unique_id "aZzD_CynTiHZ9J0Y2nZdsQAAABM"]
[Tue Feb 24 05:17:53.443457 2026] [:error] [pid 11672:tid 11689] [client 20.234.99.178:30037] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd67.php"] [unique_id "aZzEAfa0fhnmfPYq92uTEgAAAQ8"]
[Tue Feb 24 05:17:56.752802 2026] [:error] [pid 37539:tid 37594] [client 20.234.99.178:18189] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mo.php"] [unique_id "aZzEBHEnr46jUQep9z_C5QAAAFM"]
[Tue Feb 24 05:17:59.917699 2026] [:error] [pid 11672:tid 11686] [client 20.234.99.178:22326] [client 20.234.99.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mo.php"] [unique_id "aZzEB_a0fhnmfPYq92uTIgAAAQw"]
[Tue Feb 24 06:56:47.641721 2026] [:error] [pid 37539:tid 37591] [client 174.101.152.17:63348] [client 174.101.152.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 174.101.152.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZzbL3Enr46jUQep9z_akgAAAFA"]
[Tue Feb 24 07:11:52.257170 2026] [:error] [pid 11672:tid 11688] [client 43.152.72.244:47840] [client 43.152.72.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZzeuPa0fhnmfPYq92vCMQAAAQ4"]
[Tue Feb 24 07:45:17.825027 2026] [:error] [pid 37539:tid 37578] [client 178.16.52.3:58939] [client 178.16.52.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aZzmjXEnr46jUQep9z_kYQAAAEM"]
[Tue Feb 24 08:23:14.643175 2026] [:error] [pid 11672:tid 11698] [client 174.101.152.17:58018] [client 174.101.152.17] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aZzvcva0fhnmfPYq92vR4gAAARg"]
[Tue Feb 24 08:25:03.378458 2026] [:error] [pid 41188:tid 41196] [client 174.101.152.17:58368] [client 174.101.152.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 174.101.152.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZzv3wWRg7szIRhA0WigGwAAAUU"]
[Tue Feb 24 08:26:13.517865 2026] [:error] [pid 37540:tid 37626] [client 174.101.152.17:58608] [client 174.101.152.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 174.101.152.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZzwJSahRAUBJS8hpJWnowAAAJg"]
[Tue Feb 24 08:27:20.055704 2026] [:error] [pid 37540:tid 37623] [client 174.101.152.17:59369] [client 174.101.152.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 174.101.152.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZzwaCahRAUBJS8hpJWpOQAAAJU"]
[Tue Feb 24 08:28:19.198138 2026] [:error] [pid 41188:tid 41214] [client 174.101.152.17:60579] [client 174.101.152.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 174.101.152.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZzwowWRg7szIRhA0Wih1AAAAVc"]
[Tue Feb 24 08:29:25.079225 2026] [:error] [pid 11672:tid 11691] [client 174.101.152.17:61906] [client 174.101.152.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 174.101.152.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZzw5fa0fhnmfPYq92vTSgAAARE"]
[Tue Feb 24 10:36:16.256041 2026] [autoindex:error] [pid 11672:tid 11698] [client 213.199.32.162:49472] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Feb 24 11:43:07.275364 2026] [:error] [pid 37540:tid 37613] [client 194.26.192.238:59186] [client 194.26.192.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "aZ0eSyahRAUBJS8hpJXf4gAAAIs"]
[Tue Feb 24 11:43:08.338453 2026] [:error] [pid 37540:tid 37622] [client 194.26.192.238:51902] [client 194.26.192.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "aZ0eTCahRAUBJS8hpJXf6gAAAJQ"]
[Tue Feb 24 11:43:09.504405 2026] [:error] [pid 37540:tid 37615] [client 194.26.192.238:51946] [client 194.26.192.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "aZ0eTSahRAUBJS8hpJXf7gAAAI0"]
[Tue Feb 24 11:43:12.581490 2026] [:error] [pid 34175:tid 34188] [client 194.26.192.238:58836] [client 194.26.192.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "aZ0eUHNLnkJcHQ-bNtVSOwAAAYs"]
[Tue Feb 24 15:25:48.496681 2026] [:error] [pid 23678:tid 23747] [client 36.111.67.189:35124] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZ1SfEjfX6zv05Y7fF6B-QAAAU0"]
[Tue Feb 24 18:06:43.861073 2026] [:error] [pid 37095:tid 37108] [client 43.165.69.68:45638] [client 43.165.69.68] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZ14MyX8qkGqxKHLt3uIkQAAAIs"]
[Tue Feb 24 19:45:21.552497 2026] [:error] [pid 16805:tid 16819] [client 103.77.107.57:60576] [client 103.77.107.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aZ2PUaYuGciBkyQZTxUK3AAAAww"]
[Tue Feb 24 19:45:21.757832 2026] [:error] [pid 16868:tid 16913] [client 103.77.107.57:60588] [client 103.77.107.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aZ2PUSdEecEcYKsh8PTkWAAAA9A"]
[Tue Feb 24 21:21:47.141753 2026] [:error] [pid 37749:tid 37767] [client 203.145.49.44:62915] [client 203.145.49.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.145.49.44, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ2l6xe9Q4R7GROWEVeqzwAAAlA"]
[Tue Feb 24 22:21:29.847683 2026] [:error] [pid 37884:tid 37912] [client 203.145.49.44:1418] [client 203.145.49.44] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aZ2z6f08KJo-7FmKlnBXpAAAA1g"]
[Tue Feb 24 22:23:23.975645 2026] [:error] [pid 40456:tid 40508] [client 203.145.49.44:21642] [client 203.145.49.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.145.49.44, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ20W-P0ojUS1IXv0AXI1QAAAZU"]
[Tue Feb 24 22:25:11.645833 2026] [:error] [pid 37715:tid 37721] [client 203.145.49.44:39395] [client 203.145.49.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.145.49.44, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ20x0IBAxg--xL5ughaOwAAAgQ"]
[Tue Feb 24 22:26:53.631733 2026] [:error] [pid 40455:tid 40473] [client 203.145.49.44:45949] [client 203.145.49.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.145.49.44, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ21LVw13ca9RV2qrBmGbAAAAU0"]
[Tue Feb 24 22:28:33.636807 2026] [:error] [pid 40455:tid 40465] [client 203.145.49.44:50076] [client 203.145.49.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.145.49.44, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ21kVw13ca9RV2qrBmHCAAAAUU"]
[Tue Feb 24 22:30:11.947361 2026] [:error] [pid 40393:tid 40408] [client 203.145.49.44:1300] [client 203.145.49.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.145.49.44, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ2187DZWhNc1DniCm3W4AAAAEk"]
[Tue Feb 24 22:42:11.119824 2026] [:error] [pid 40455:tid 40476] [client 104.28.161.70:48163] [client 104.28.161.70] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aZ24w1w13ca9RV2qrBmJygAAAVA"]
[Wed Feb 25 00:23:02.930133 2026] [:error] [pid 18447:tid 18778] [client 43.165.1.10:55376] [client 43.165.1.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.165.1.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ3QZs-TpHVc8yBj5eadDAAAAg8"]
[Wed Feb 25 00:23:05.327068 2026] [:error] [pid 18458:tid 18812] [client 43.165.1.10:55389] [client 43.165.1.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.165.1.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ3QaQuir-tBe4tUislrYQAAApE"]
[Wed Feb 25 00:23:06.880349 2026] [:error] [pid 18458:tid 18795] [client 43.165.1.10:55395] [client 43.165.1.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.165.1.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ3Qaguir-tBe4tUislrZAAAAoI"]
[Wed Feb 25 00:23:08.471033 2026] [:error] [pid 18441:tid 18715] [client 43.165.1.10:55399] [client 43.165.1.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.165.1.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ3QbBYF1wpOnXIaHlOHKgAAAMc"]
[Wed Feb 25 00:23:10.071755 2026] [:error] [pid 18850:tid 18872] [client 43.165.1.10:55403] [client 43.165.1.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.165.1.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ3QbuDBmHucoAJRnqnUggAAABQ"]
[Wed Feb 25 00:23:11.674501 2026] [:error] [pid 18850:tid 18853] [client 43.165.1.10:55407] [client 43.165.1.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.165.1.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ3Qb-DBmHucoAJRnqnUhgAAAAE"]
[Wed Feb 25 00:23:11.674643 2026] [:error] [pid 18850:tid 18853] [client 43.165.1.10:55407] [client 43.165.1.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 43.165.1.10, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ3Qb-DBmHucoAJRnqnUhgAAAAE"]
[Wed Feb 25 00:23:12.687553 2026] [:error] [pid 18850:tid 18863] [client 43.165.1.10:55412] [client 43.165.1.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.165.1.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ3QcODBmHucoAJRnqnUiwAAAAs"]
[Wed Feb 25 00:23:12.687705 2026] [:error] [pid 18850:tid 18863] [client 43.165.1.10:55412] [client 43.165.1.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 43.165.1.10, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ3QcODBmHucoAJRnqnUiwAAAAs"]
[Wed Feb 25 00:23:13.704429 2026] [:error] [pid 18447:tid 18783] [client 43.165.1.10:55417] [client 43.165.1.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.165.1.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ3Qcc-TpHVc8yBj5eadHQAAAhQ"]
[Wed Feb 25 00:23:13.704605 2026] [:error] [pid 18447:tid 18783] [client 43.165.1.10:55417] [client 43.165.1.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 43.165.1.10, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ3Qcc-TpHVc8yBj5eadHQAAAhQ"]
[Wed Feb 25 02:26:14.889128 2026] [:error] [pid 18441:tid 18727] [client 43.165.65.75:54956] [client 43.165.65.75] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZ3tRhYF1wpOnXIaHlOgfwAAANI"]
[Wed Feb 25 03:02:41.828827 2026] [autoindex:error] [pid 18441:tid 18712] [client 4.233.88.210:10714] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 03:02:53.063981 2026] [:error] [pid 18441:tid 18713] [client 4.233.88.210:10714] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aZ313RYF1wpOnXIaHlOoHwAAAMU"]
[Wed Feb 25 03:02:55.363189 2026] [:error] [pid 26872:tid 26874] [client 4.233.88.210:1475] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aZ3133xLbzvRGuzwKjkh8QAAAEA"]
[Wed Feb 25 03:02:58.537226 2026] [:error] [pid 18850:tid 18863] [client 4.233.88.210:29566] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aZ314uDBmHucoAJRnqknxwAAAAs"]
[Wed Feb 25 03:03:19.244455 2026] [:error] [pid 26872:tid 26881] [client 4.233.88.210:29866] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aZ3193xLbzvRGuzwKjkiKAAAAEc"]
[Wed Feb 25 03:03:19.997940 2026] [:error] [pid 18441:tid 18717] [client 4.233.88.210:18691] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x56.php"] [unique_id "aZ319xYF1wpOnXIaHlOoYgAAAMk"]
[Wed Feb 25 03:03:24.160091 2026] [:error] [pid 18447:tid 18768] [client 4.233.88.210:1482] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x56.php"] [unique_id "aZ31_M-TpHVc8yBj5ebHMQAAAgU"]
[Wed Feb 25 03:03:26.689734 2026] [:error] [pid 26872:tid 26892] [client 4.233.88.210:16809] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "aZ31_nxLbzvRGuzwKjkiPQAAAFI"]
[Wed Feb 25 03:03:28.228718 2026] [:error] [pid 13321:tid 13331] [client 4.233.88.210:29547] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "aZ32AJvJpNGl_oIrsV-3NgAAAQg"]
[Wed Feb 25 03:03:29.072555 2026] [:error] [pid 18447:tid 18768] [client 4.233.88.210:7384] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "aZ32Ac-TpHVc8yBj5ebHMgAAAgU"]
[Wed Feb 25 03:03:29.884640 2026] [:error] [pid 13321:tid 13331] [client 4.233.88.210:11521] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "aZ32AZvJpNGl_oIrsV-3OAAAAQg"]
[Wed Feb 25 03:03:31.272609 2026] [:error] [pid 13286:tid 13291] [client 4.233.88.210:11726] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aZ32AyU3io7izGW_QSeJugAAAII"]
[Wed Feb 25 03:03:33.099507 2026] [:error] [pid 13286:tid 13292] [client 4.233.88.210:16796] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aZ32BSU3io7izGW_QSeJvgAAAIM"]
[Wed Feb 25 03:03:35.113231 2026] [:error] [pid 18458:tid 18811] [client 4.233.88.210:16792] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aZ32Bwuir-tBe4tUismmrgAAApA"]
[Wed Feb 25 03:03:36.076733 2026] [:error] [pid 18458:tid 18816] [client 4.233.88.210:12830] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aZ32CAuir-tBe4tUismmsQAAApU"]
[Wed Feb 25 03:03:37.441630 2026] [:error] [pid 13286:tid 13306] [client 4.233.88.210:11580] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x50.php"] [unique_id "aZ32CSU3io7izGW_QSeJxwAAAJE"]
[Wed Feb 25 03:03:38.599972 2026] [:error] [pid 13321:tid 13325] [client 4.233.88.210:13446] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x50.php"] [unique_id "aZ32CpvJpNGl_oIrsV-3QgAAAQI"]
[Wed Feb 25 03:03:40.151986 2026] [:error] [pid 13391:tid 13403] [client 4.233.88.210:13494] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x50.php"] [unique_id "aZ32DEIwokrsisMuCDfQMwAAAYo"]
[Wed Feb 25 03:03:40.768036 2026] [:error] [pid 13321:tid 13341] [client 4.233.88.210:12340] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x50.php"] [unique_id "aZ32DJvJpNGl_oIrsV-3SQAAARI"]
[Wed Feb 25 03:03:41.587109 2026] [:error] [pid 13359:tid 13368] [client 4.233.88.210:12339] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aZ32DaOZX03SYTgjvJXPpQAAAUc"]
[Wed Feb 25 03:03:42.559785 2026] [:error] [pid 18447:tid 18768] [client 4.233.88.210:10910] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aZ32Ds-TpHVc8yBj5ebHNQAAAgU"]
[Wed Feb 25 03:03:43.264103 2026] [:error] [pid 18850:tid 18858] [client 4.233.88.210:10903] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aZ32D-DBmHucoAJRnqkoHAAAAAY"]
[Wed Feb 25 03:03:44.010943 2026] [:error] [pid 18850:tid 18876] [client 4.233.88.210:11733] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aZ32EODBmHucoAJRnqkoHgAAABg"]
[Wed Feb 25 03:03:45.408776 2026] [:error] [pid 13321:tid 13337] [client 4.233.88.210:10518] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aZ32EZvJpNGl_oIrsV-3SwAAAQ4"]
[Wed Feb 25 03:03:45.928784 2026] [:error] [pid 13422:tid 13446] [client 4.233.88.210:12849] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aZ32EZk4EBEd_aiOeSs6aQAAAdU"]
[Wed Feb 25 03:03:46.598593 2026] [:error] [pid 13422:tid 13432] [client 4.233.88.210:13736] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aZ32Epk4EBEd_aiOeSs6bQAAAcc"]
[Wed Feb 25 03:03:47.544260 2026] [:error] [pid 13422:tid 13428] [client 4.233.88.210:12815] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aZ32E5k4EBEd_aiOeSs6cgAAAcM"]
[Wed Feb 25 03:03:48.645592 2026] [:error] [pid 13422:tid 13436] [client 4.233.88.210:13671] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "aZ32FJk4EBEd_aiOeSs6eAAAAcs"]
[Wed Feb 25 03:03:49.952639 2026] [:error] [pid 18850:tid 18867] [client 4.233.88.210:13642] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "aZ32FeDBmHucoAJRnqkoIwAAAA8"]
[Wed Feb 25 03:03:50.716551 2026] [:error] [pid 18850:tid 18867] [client 4.233.88.210:7741] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "aZ32FuDBmHucoAJRnqkoJQAAAA8"]
[Wed Feb 25 03:04:08.800062 2026] [:error] [pid 13391:tid 13413] [client 4.233.88.210:1477] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aZ32KEIwokrsisMuCDfQbwAAAZQ"]
[Wed Feb 25 03:04:09.337963 2026] [:error] [pid 13544:tid 13554] [client 4.233.88.210:9898] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aZ32KUieBEkpCYpYuFgdEAAAA0c"]
[Wed Feb 25 03:04:09.888276 2026] [:error] [pid 13544:tid 13564] [client 4.233.88.210:9887] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aZ32KUieBEkpCYpYuFgdFAAAA1E"]
[Wed Feb 25 03:04:10.648552 2026] [:error] [pid 13574:tid 13585] [client 4.233.88.210:31705] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aZ32Kp1y3bdS8MFXvJ2-ywAAA4c"]
[Wed Feb 25 03:04:11.717779 2026] [:error] [pid 13574:tid 13593] [client 4.233.88.210:10868] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aZ32K51y3bdS8MFXvJ2-0AAAA48"]
[Wed Feb 25 03:04:12.453821 2026] [:error] [pid 13575:tid 13611] [client 4.233.88.210:11469] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aZ32LKwGxLnu91BIPRmH0QAAA8Y"]
[Wed Feb 25 03:04:13.145256 2026] [:error] [pid 13516:tid 13538] [client 4.233.88.210:9865] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aZ32LYDG2jLWmZEFGzVnpQAAAxQ"]
[Wed Feb 25 03:04:13.760691 2026] [:error] [pid 13575:tid 13620] [client 4.233.88.210:10857] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aZ32LawGxLnu91BIPRmH0wAAA88"]
[Wed Feb 25 03:04:14.333249 2026] [:error] [pid 13575:tid 13614] [client 4.233.88.210:12016] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aZ32LqwGxLnu91BIPRmH1wAAA8k"]
[Wed Feb 25 03:04:15.073443 2026] [:error] [pid 13575:tid 13613] [client 4.233.88.210:9890] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aZ32L6wGxLnu91BIPRmH3AAAA8g"]
[Wed Feb 25 03:04:15.621066 2026] [:error] [pid 13575:tid 13610] [client 4.233.88.210:11236] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aZ32L6wGxLnu91BIPRmH3gAAA8U"]
[Wed Feb 25 03:04:16.398754 2026] [:error] [pid 18850:tid 18859] [client 4.233.88.210:9392] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "aZ32MODBmHucoAJRnqkoLgAAAAc"]
[Wed Feb 25 03:04:17.050263 2026] [:error] [pid 18850:tid 18857] [client 4.233.88.210:12695] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aZ32MeDBmHucoAJRnqkoLwAAAAU"]
[Wed Feb 25 03:04:17.638913 2026] [:error] [pid 13516:tid 13526] [client 4.233.88.210:65007] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aZ32MYDG2jLWmZEFGzVnqAAAAwg"]
[Wed Feb 25 03:04:18.414087 2026] [:error] [pid 13286:tid 13312] [client 4.233.88.210:7680] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aZ32MiU3io7izGW_QSeJ1gAAAJc"]
[Wed Feb 25 03:04:19.167128 2026] [:error] [pid 13286:tid 13293] [client 4.233.88.210:12719] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aZ32MyU3io7izGW_QSeJ1wAAAIQ"]
[Wed Feb 25 03:04:19.887041 2026] [:error] [pid 13454:tid 13475] [client 4.233.88.210:31843] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aZ32M-douHfevEW-I1rcOwAAAlM"]
[Wed Feb 25 03:04:21.034744 2026] [:error] [pid 13575:tid 13608] [client 4.233.88.210:10417] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aZ32NawGxLnu91BIPRmH5wAAA8M"]
[Wed Feb 25 03:04:21.687359 2026] [:error] [pid 13454:tid 13467] [client 4.233.88.210:9910] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aZ32NedouHfevEW-I1rcPAAAAks"]
[Wed Feb 25 03:04:22.305258 2026] [:error] [pid 13575:tid 13628] [client 4.233.88.210:65127] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aZ32NqwGxLnu91BIPRmH6wAAA9c"]
[Wed Feb 25 03:04:22.987151 2026] [:error] [pid 13575:tid 13612] [client 4.233.88.210:11452] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aZ32NqwGxLnu91BIPRmH7AAAA8c"]
[Wed Feb 25 03:04:23.815576 2026] [:error] [pid 13575:tid 13622] [client 4.233.88.210:12705] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aZ32N6wGxLnu91BIPRmH8gAAA9E"]
[Wed Feb 25 03:04:24.340634 2026] [:error] [pid 18458:tid 18803] [client 4.233.88.210:11442] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aZ32OAuir-tBe4tUismmywAAAok"]
[Wed Feb 25 03:04:24.991049 2026] [:error] [pid 13516:tid 13519] [client 4.233.88.210:64468] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aZ32OIDG2jLWmZEFGzVnrAAAAwE"]
[Wed Feb 25 03:04:25.562673 2026] [:error] [pid 13575:tid 13609] [client 4.233.88.210:11207] [client 4.233.88.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aZ32OawGxLnu91BIPRmH9QAAA8Q"]
[Wed Feb 25 03:04:26.274266 2026] [:error] [pid 26872:tid 26891] [client 4.233.88.210:13310] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aZ32OnxLbzvRGuzwKjkiRgAAAFE"]
[Wed Feb 25 03:04:27.049723 2026] [:error] [pid 13516:tid 13528] [client 4.233.88.210:10819] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aZ32O4DG2jLWmZEFGzVnrwAAAwo"]
[Wed Feb 25 03:04:27.672712 2026] [:error] [pid 13516:tid 13527] [client 4.233.88.210:11431] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aZ32O4DG2jLWmZEFGzVnsQAAAwk"]
[Wed Feb 25 03:04:28.668431 2026] [:error] [pid 18850:tid 18855] [client 4.233.88.210:1497] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cong.php"] [unique_id "aZ32PODBmHucoAJRnqkoNAAAAAM"]
[Wed Feb 25 03:04:29.289003 2026] [:error] [pid 18850:tid 18853] [client 4.233.88.210:11244] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aZ32PeDBmHucoAJRnqkoNQAAAAE"]
[Wed Feb 25 03:04:30.024752 2026] [:error] [pid 13575:tid 13620] [client 4.233.88.210:12682] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aZ32PqwGxLnu91BIPRmH9wAAA88"]
[Wed Feb 25 03:04:30.703040 2026] [:error] [pid 13575:tid 13616] [client 4.233.88.210:13299] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aZ32PqwGxLnu91BIPRmH-QAAA8s"]
[Wed Feb 25 03:04:31.339301 2026] [:error] [pid 18850:tid 18875] [client 4.233.88.210:1555] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w.php"] [unique_id "aZ32P-DBmHucoAJRnqkoOQAAABc"]
[Wed Feb 25 03:04:31.884822 2026] [:error] [pid 18458:tid 18793] [client 4.233.88.210:16872] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aZ32Pwuir-tBe4tUismmzAAAAoA"]
[Wed Feb 25 03:04:32.496742 2026] [:error] [pid 18850:tid 18852] [client 4.233.88.210:12251] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aZ32QODBmHucoAJRnqkoPAAAAAA"]
[Wed Feb 25 03:04:33.581459 2026] [:error] [pid 18850:tid 18876] [client 4.233.88.210:11234] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aZ32QeDBmHucoAJRnqkoPwAAABg"]
[Wed Feb 25 03:04:34.266098 2026] [:error] [pid 13575:tid 13608] [client 4.233.88.210:1488] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aZ32QqwGxLnu91BIPRmH-wAAA8M"]
[Wed Feb 25 03:04:34.878913 2026] [:error] [pid 13359:tid 13385] [client 4.233.88.210:33469] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aZ32QqOZX03SYTgjvJXPwgAAAVg"]
[Wed Feb 25 03:04:35.533168 2026] [:error] [pid 18441:tid 18730] [client 4.233.88.210:65415] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aZ32QxYF1wpOnXIaHlOogQAAANU"]
[Wed Feb 25 03:04:36.052892 2026] [:error] [pid 13575:tid 13613] [client 4.233.88.210:1262] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aZ32RKwGxLnu91BIPRmH_wAAA8g"]
[Wed Feb 25 03:04:36.744440 2026] [:error] [pid 13391:tid 13416] [client 4.233.88.210:13256] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aZ32REIwokrsisMuCDfQegAAAZc"]
[Wed Feb 25 03:04:37.423291 2026] [:error] [pid 26872:tid 26875] [client 4.233.88.210:14786] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aZ32RXxLbzvRGuzwKjkiTAAAAEE"]
[Wed Feb 25 03:04:38.636883 2026] [:error] [pid 13516:tid 13530] [client 4.233.88.210:65032] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aZ32RoDG2jLWmZEFGzVnyAAAAww"]
[Wed Feb 25 03:04:39.264807 2026] [:error] [pid 18458:tid 18812] [client 4.233.88.210:11401] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aZ32Rwuir-tBe4tUismmzwAAApE"]
[Wed Feb 25 03:04:39.786938 2026] [:error] [pid 13516:tid 13528] [client 4.233.88.210:12874] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "aZ32R4DG2jLWmZEFGzVnygAAAwo"]
[Wed Feb 25 03:04:40.599026 2026] [:error] [pid 13359:tid 13374] [client 4.233.88.210:33455] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aZ32SKOZX03SYTgjvJXPwwAAAU0"]
[Wed Feb 25 03:04:41.488289 2026] [:error] [pid 13575:tid 13615] [client 4.233.88.210:17131] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aZ32SawGxLnu91BIPRmIAgAAA8o"]
[Wed Feb 25 03:04:41.988909 2026] [:error] [pid 13575:tid 13612] [client 4.233.88.210:7322] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aZ32SawGxLnu91BIPRmIAwAAA8c"]
[Wed Feb 25 03:04:42.530715 2026] [:error] [pid 18458:tid 18817] [client 4.233.88.210:31190] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aZ32Sguir-tBe4tUismm0gAAApY"]
[Wed Feb 25 03:04:43.048341 2026] [:error] [pid 18850:tid 18867] [client 4.233.88.210:12260] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aZ32S-DBmHucoAJRnqkoQQAAAA8"]
[Wed Feb 25 03:04:43.790970 2026] [:error] [pid 13359:tid 13379] [client 4.233.88.210:9730] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aZ32S6OZX03SYTgjvJXPxAAAAVI"]
[Wed Feb 25 03:04:44.508350 2026] [:error] [pid 13391:tid 13398] [client 4.233.88.210:12920] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aZ32TEIwokrsisMuCDfQjQAAAYU"]
[Wed Feb 25 03:04:45.468623 2026] [:error] [pid 18441:tid 18724] [client 4.233.88.210:17103] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aZ32TRYF1wpOnXIaHlOogwAAAM8"]
[Wed Feb 25 03:04:46.504040 2026] [:error] [pid 13575:tid 13629] [client 4.233.88.210:12918] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aZ32TqwGxLnu91BIPRmICgAAA9g"]
[Wed Feb 25 03:04:48.284019 2026] [:error] [pid 13575:tid 13613] [client 4.233.88.210:14570] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aZ32UKwGxLnu91BIPRmIDAAAA8g"]
[Wed Feb 25 03:04:49.809810 2026] [:error] [pid 13286:tid 13308] [client 4.233.88.210:12698] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aZ32USU3io7izGW_QSeJ2gAAAJM"]
[Wed Feb 25 03:04:52.185992 2026] [:error] [pid 13575:tid 13616] [client 4.233.88.210:1361] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aZ32VKwGxLnu91BIPRmIFAAAA8s"]
[Wed Feb 25 03:04:56.656835 2026] [:error] [pid 18850:tid 18863] [client 4.233.88.210:17405] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aZ32WODBmHucoAJRnqkoSQAAAAs"]
[Wed Feb 25 03:04:57.902479 2026] [:error] [pid 18458:tid 18815] [client 4.233.88.210:12531] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aZ32WQuir-tBe4tUismm2AAAApQ"]
[Wed Feb 25 03:04:58.696664 2026] [:error] [pid 13575:tid 13605] [client 4.233.88.210:17362] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aZ32WqwGxLnu91BIPRmIJgAAA8A"]
[Wed Feb 25 03:04:59.405767 2026] [:error] [pid 13286:tid 13309] [client 4.233.88.210:12936] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aZ32WyU3io7izGW_QSeJ3QAAAJQ"]
[Wed Feb 25 03:05:00.209732 2026] [:error] [pid 13575:tid 13619] [client 4.233.88.210:8689] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aZ32XKwGxLnu91BIPRmILgAAA84"]
[Wed Feb 25 03:05:00.850715 2026] [:error] [pid 18458:tid 18807] [client 4.233.88.210:31169] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aZ32XAuir-tBe4tUismm2QAAAo0"]
[Wed Feb 25 03:05:01.698887 2026] [:error] [pid 13391:tid 13417] [client 4.233.88.210:12933] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aZ32XUIwokrsisMuCDfQuAAAAZg"]
[Wed Feb 25 03:05:02.416175 2026] [:error] [pid 13391:tid 13393] [client 4.233.88.210:8058] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aZ32XkIwokrsisMuCDfQvAAAAYA"]
[Wed Feb 25 03:05:03.178572 2026] [:error] [pid 13516:tid 13537] [client 4.233.88.210:11716] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aZ32X4DG2jLWmZEFGzVn3wAAAxM"]
[Wed Feb 25 03:05:03.904072 2026] [:error] [pid 13516:tid 13524] [client 4.233.88.210:31192] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aZ32X4DG2jLWmZEFGzVn5AAAAwY"]
[Wed Feb 25 03:05:04.467464 2026] [:error] [pid 13516:tid 13528] [client 4.233.88.210:17147] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aZ32YIDG2jLWmZEFGzVn6AAAAwo"]
[Wed Feb 25 03:05:05.206565 2026] [:error] [pid 13516:tid 13539] [client 4.233.88.210:12413] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aZ32YYDG2jLWmZEFGzVn7gAAAxU"]
[Wed Feb 25 03:05:06.092117 2026] [:error] [pid 13454:tid 13467] [client 4.233.88.210:12960] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aZ32YudouHfevEW-I1rcSwAAAks"]
[Wed Feb 25 03:05:06.702360 2026] [:error] [pid 18441:tid 18730] [client 4.233.88.210:7693] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "aZ32YhYF1wpOnXIaHlOojQAAANU"]
[Wed Feb 25 03:05:26.865535 2026] [:error] [pid 13516:tid 13524] [client 4.233.88.210:12529] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aZ32doDG2jLWmZEFGzVoJQAAAwY"]
[Wed Feb 25 03:05:27.922154 2026] [:error] [pid 13575:tid 13605] [client 4.233.88.210:9925] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aZ32d6wGxLnu91BIPRmIWwAAA8A"]
[Wed Feb 25 03:05:29.928177 2026] [:error] [pid 13575:tid 13628] [client 4.233.88.210:30746] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aZ32eawGxLnu91BIPRmIZwAAA9c"]
[Wed Feb 25 03:05:30.713992 2026] [:error] [pid 13391:tid 13393] [client 4.233.88.210:29502] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aZ32ekIwokrsisMuCDfQ3AAAAYA"]
[Wed Feb 25 03:05:31.665752 2026] [:error] [pid 13516:tid 13540] [client 4.233.88.210:29497] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aZ32e4DG2jLWmZEFGzVoMQAAAxY"]
[Wed Feb 25 03:05:32.221778 2026] [:error] [pid 13359:tid 13379] [client 4.233.88.210:7452] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aZ32fKOZX03SYTgjvJXP0wAAAVI"]
[Wed Feb 25 03:05:32.993580 2026] [:error] [pid 18850:tid 18876] [client 4.233.88.210:9942] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aZ32fODBmHucoAJRnqkoWwAAABg"]
[Wed Feb 25 03:05:33.520827 2026] [:error] [pid 18850:tid 18853] [client 4.233.88.210:7478] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail.php"] [unique_id "aZ32feDBmHucoAJRnqkoXwAAAAE"]
[Wed Feb 25 03:05:34.243757 2026] [:error] [pid 13359:tid 13375] [client 4.233.88.210:11768] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aZ32fqOZX03SYTgjvJXP2AAAAU4"]
[Wed Feb 25 03:05:34.790364 2026] [:error] [pid 13454:tid 13476] [client 4.233.88.210:29493] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aZ32fudouHfevEW-I1rcWwAAAlQ"]
[Wed Feb 25 03:05:35.336497 2026] [:error] [pid 13454:tid 13456] [client 4.233.88.210:13416] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aZ32f-douHfevEW-I1rcXAAAAkA"]
[Wed Feb 25 03:05:35.829349 2026] [:error] [pid 13575:tid 13620] [client 4.233.88.210:12459] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "aZ32f6wGxLnu91BIPRmIcwAAA88"]
[Wed Feb 25 03:05:36.481508 2026] [:error] [pid 13575:tid 13611] [client 4.233.88.210:8370] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aZ32gKwGxLnu91BIPRmIdgAAA8Y"]
[Wed Feb 25 03:05:36.987095 2026] [:error] [pid 13454:tid 13470] [client 4.233.88.210:7322] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aZ32gOdouHfevEW-I1rcYAAAAk4"]
[Wed Feb 25 03:05:37.496946 2026] [:error] [pid 13391:tid 13408] [client 4.233.88.210:12933] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aZ32gUIwokrsisMuCDfQ5AAAAY8"]
[Wed Feb 25 03:05:38.160031 2026] [:error] [pid 13575:tid 13617] [client 4.233.88.210:1957] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aZ32gqwGxLnu91BIPRmIeQAAA8w"]
[Wed Feb 25 03:05:38.957531 2026] [:error] [pid 18850:tid 18862] [client 4.233.88.210:11661] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "aZ32guDBmHucoAJRnqkoYwAAAAo"]
[Wed Feb 25 03:05:39.495312 2026] [:error] [pid 13391:tid 13395] [client 4.233.88.210:11697] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "aZ32g0IwokrsisMuCDfQ5gAAAYI"]
[Wed Feb 25 03:05:40.010351 2026] [:error] [pid 13575:tid 13620] [client 4.233.88.210:17043] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "aZ32hKwGxLnu91BIPRmIfwAAA88"]
[Wed Feb 25 03:05:40.593806 2026] [:error] [pid 18458:tid 18813] [client 4.233.88.210:11773] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "aZ32hAuir-tBe4tUismm5gAAApI"]
[Wed Feb 25 03:05:41.101370 2026] [:error] [pid 13575:tid 13609] [client 4.233.88.210:16874] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aZ32hawGxLnu91BIPRmIgwAAA8Q"]
[Wed Feb 25 03:05:41.734729 2026] [:error] [pid 13516:tid 13519] [client 4.233.88.210:31125] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aZ32hYDG2jLWmZEFGzVoPwAAAwE"]
[Wed Feb 25 03:05:42.214052 2026] [:error] [pid 18458:tid 18810] [client 4.233.88.210:17049] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aZ32hguir-tBe4tUismm5wAAAo8"]
[Wed Feb 25 03:05:42.692522 2026] [:error] [pid 13391:tid 13393] [client 4.233.88.210:1948] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "aZ32hkIwokrsisMuCDfQ6wAAAYA"]
[Wed Feb 25 03:05:43.170566 2026] [:error] [pid 13516:tid 13536] [client 4.233.88.210:8260] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aZ32h4DG2jLWmZEFGzVoQgAAAxI"]
[Wed Feb 25 03:05:43.655939 2026] [:error] [pid 13516:tid 13529] [client 4.233.88.210:9054] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aZ32h4DG2jLWmZEFGzVoRQAAAws"]
[Wed Feb 25 03:05:44.186210 2026] [:error] [pid 13516:tid 13531] [client 4.233.88.210:8442] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aZ32iIDG2jLWmZEFGzVoSQAAAw0"]
[Wed Feb 25 03:05:44.832600 2026] [:error] [pid 13516:tid 13538] [client 4.233.88.210:31167] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aZ32iIDG2jLWmZEFGzVoTgAAAxQ"]
[Wed Feb 25 03:05:45.365016 2026] [:error] [pid 13286:tid 13298] [client 4.233.88.210:8940] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aZ32iSU3io7izGW_QSeJ7gAAAIk"]
[Wed Feb 25 03:05:45.840837 2026] [:error] [pid 13454:tid 13476] [client 4.233.88.210:14389] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aZ32iedouHfevEW-I1rcagAAAlQ"]
[Wed Feb 25 03:05:46.334689 2026] [:error] [pid 13454:tid 13478] [client 4.233.88.210:8304] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aZ32iudouHfevEW-I1rcbAAAAlY"]
[Wed Feb 25 03:05:46.861282 2026] [:error] [pid 13575:tid 13606] [client 4.233.88.210:16875] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aZ32iqwGxLnu91BIPRmIhgAAA8E"]
[Wed Feb 25 03:05:47.349140 2026] [:error] [pid 13575:tid 13622] [client 4.233.88.210:17075] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aZ32i6wGxLnu91BIPRmIiAAAA9E"]
[Wed Feb 25 03:05:47.876042 2026] [:error] [pid 13575:tid 13625] [client 4.233.88.210:15324] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aZ32i6wGxLnu91BIPRmIjAAAA9Q"]
[Wed Feb 25 03:05:48.420241 2026] [:error] [pid 13575:tid 13619] [client 4.233.88.210:7685] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aZ32jKwGxLnu91BIPRmIjwAAA84"]
[Wed Feb 25 03:05:49.145251 2026] [:error] [pid 13391:tid 13402] [client 4.233.88.210:8749] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aZ32jUIwokrsisMuCDfQ7QAAAYk"]
[Wed Feb 25 03:05:49.778137 2026] [:error] [pid 18458:tid 18802] [client 4.233.88.210:11153] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/index.php"] [unique_id "aZ32jQuir-tBe4tUismm6wAAAog"]
[Wed Feb 25 03:05:50.438852 2026] [:error] [pid 13391:tid 13414] [client 4.233.88.210:11187] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/index.php"] [unique_id "aZ32jkIwokrsisMuCDfQ7wAAAZU"]
[Wed Feb 25 03:05:51.206629 2026] [:error] [pid 13391:tid 13410] [client 4.233.88.210:7737] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/index.php"] [unique_id "aZ32j0IwokrsisMuCDfQ8AAAAZE"]
[Wed Feb 25 03:05:51.852675 2026] [:error] [pid 13575:tid 13619] [client 4.233.88.210:13981] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/index.php"] [unique_id "aZ32j6wGxLnu91BIPRmInQAAA84"]
[Wed Feb 25 03:05:52.837556 2026] [:error] [pid 13516:tid 13536] [client 4.233.88.210:1428] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aZ32kIDG2jLWmZEFGzVoWQAAAxI"]
[Wed Feb 25 03:05:54.848899 2026] [:error] [pid 18458:tid 18812] [client 4.233.88.210:7719] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aZ32kguir-tBe4tUismm7wAAApE"]
[Wed Feb 25 03:05:57.731997 2026] [:error] [pid 13454:tid 13471] [client 4.233.88.210:10657] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aZ32ledouHfevEW-I1rcgQAAAk8"]
[Wed Feb 25 03:06:01.054878 2026] [:error] [pid 13391:tid 13411] [client 4.233.88.210:14614] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/plugins.php"] [unique_id "aZ32mUIwokrsisMuCDfQ_wAAAZI"]
[Wed Feb 25 03:06:04.256193 2026] [:error] [pid 13575:tid 13624] [client 4.233.88.210:17331] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aZ32nKwGxLnu91BIPRmIwgAAA9M"]
[Wed Feb 25 03:06:05.730629 2026] [:error] [pid 13516:tid 13530] [client 4.233.88.210:1625] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aZ32nYDG2jLWmZEFGzVoYAAAAww"]
[Wed Feb 25 03:06:06.814071 2026] [:error] [pid 13575:tid 13612] [client 4.233.88.210:17343] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aZ32nqwGxLnu91BIPRmIyAAAA8c"]
[Wed Feb 25 03:06:07.710401 2026] [:error] [pid 13575:tid 13625] [client 4.233.88.210:18770] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aZ32n6wGxLnu91BIPRmIzQAAA9Q"]
[Wed Feb 25 03:06:08.747593 2026] [:error] [pid 13575:tid 13605] [client 4.233.88.210:14024] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aZ32oKwGxLnu91BIPRmI0wAAA8A"]
[Wed Feb 25 03:06:09.692112 2026] [:error] [pid 13286:tid 13309] [client 4.233.88.210:2028] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aZ32oSU3io7izGW_QSeJ9wAAAJQ"]
[Wed Feb 25 03:06:10.531626 2026] [:error] [pid 13516:tid 13524] [client 4.233.88.210:2013] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aZ32ooDG2jLWmZEFGzVoaAAAAwY"]
[Wed Feb 25 03:06:11.720959 2026] [:error] [pid 13359:tid 13375] [client 4.233.88.210:1066] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gmo.php"] [unique_id "aZ32o6OZX03SYTgjvJXP5wAAAU4"]
[Wed Feb 25 03:06:12.494190 2026] [:error] [pid 26872:tid 26881] [client 4.233.88.210:13117] [client 4.233.88.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aZ32pHxLbzvRGuzwKjkiZwAAAEc"]
[Wed Feb 25 03:06:13.281224 2026] [:error] [pid 13454:tid 13478] [client 4.233.88.210:13831] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aZ32pedouHfevEW-I1rciAAAAlY"]
[Wed Feb 25 03:06:13.887727 2026] [:error] [pid 13575:tid 13606] [client 4.233.88.210:1645] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aZ32pawGxLnu91BIPRmI1QAAA8E"]
[Wed Feb 25 03:06:14.504684 2026] [:error] [pid 13359:tid 13369] [client 4.233.88.210:30509] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aZ32pqOZX03SYTgjvJXP6QAAAUg"]
[Wed Feb 25 03:06:15.027471 2026] [:error] [pid 13391:tid 13395] [client 4.233.88.210:2032] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aZ32p0IwokrsisMuCDfRBwAAAYI"]
[Wed Feb 25 03:06:15.918771 2026] [:error] [pid 26872:tid 26893] [client 4.233.88.210:30527] [client 4.233.88.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aZ32p3xLbzvRGuzwKjkibQAAAFM"]
[Wed Feb 25 03:06:16.505279 2026] [:error] [pid 13391:tid 13401] [client 4.233.88.210:7859] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aZ32qEIwokrsisMuCDfRCAAAAYg"]
[Wed Feb 25 03:06:17.354535 2026] [:error] [pid 13391:tid 13394] [client 4.233.88.210:30111] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aZ32qUIwokrsisMuCDfRCQAAAYE"]
[Wed Feb 25 03:06:18.509746 2026] [:error] [pid 13286:tid 13304] [client 4.233.88.210:1040] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "aZ32qiU3io7izGW_QSeJ_gAAAI8"]
[Wed Feb 25 03:06:19.707016 2026] [:error] [pid 13516:tid 13530] [client 4.233.88.210:1028] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filemanager/dialog.php"] [unique_id "aZ32q4DG2jLWmZEFGzVobwAAAww"]
[Wed Feb 25 03:06:20.668823 2026] [:error] [pid 18441:tid 18714] [client 4.233.88.210:13215] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filemanager/dialog.php"] [unique_id "aZ32rBYF1wpOnXIaHlOolgAAAMY"]
[Wed Feb 25 03:06:21.604909 2026] [:error] [pid 13391:tid 13398] [client 4.233.88.210:7864] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filemanager/dialog.php"] [unique_id "aZ32rUIwokrsisMuCDfRCwAAAYU"]
[Wed Feb 25 03:06:22.316522 2026] [:error] [pid 26872:tid 26884] [client 4.233.88.210:30524] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filemanager/dialog.php"] [unique_id "aZ32rnxLbzvRGuzwKjkidwAAAEo"]
[Wed Feb 25 03:06:23.039519 2026] [:error] [pid 13286:tid 13312] [client 4.233.88.210:14217] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aZ32ryU3io7izGW_QSeKAQAAAJc"]
[Wed Feb 25 03:06:23.683304 2026] [:error] [pid 13286:tid 13293] [client 4.233.88.210:30584] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aZ32ryU3io7izGW_QSeKAgAAAIQ"]
[Wed Feb 25 03:06:24.661400 2026] [:error] [pid 13575:tid 13615] [client 4.233.88.210:11302] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aZ32sKwGxLnu91BIPRmI3wAAA8o"]
[Wed Feb 25 03:06:26.321327 2026] [autoindex:error] [pid 13391:tid 13410] [client 4.233.88.210:9232] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 03:06:26.556319 2026] [:error] [pid 13391:tid 13416] [client 4.233.88.210:9232] [client 4.233.88.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aZ32skIwokrsisMuCDfRFAAAAZc"]
[Wed Feb 25 03:06:29.231439 2026] [:error] [pid 13575:tid 13628] [client 4.233.88.210:14256] [client 4.233.88.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aZ32tawGxLnu91BIPRmI6AAAA9c"]
[Wed Feb 25 03:06:32.850661 2026] [proxy_fcgi:error] [pid 13516:tid 13526] [client 4.233.88.210:13773] AH01071: Got error 'Primary script unknown'
[Wed Feb 25 03:06:38.569028 2026] [:error] [pid 13286:tid 13292] [client 4.233.88.210:30817] [client 4.233.88.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.233.88.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ32viU3io7izGW_QSeKCAAAAIM"]
[Wed Feb 25 03:06:40.825822 2026] [autoindex:error] [pid 13516:tid 13536] [client 4.233.88.210:13773] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 03:06:41.895532 2026] [:error] [pid 13516:tid 13539] [client 4.233.88.210:13773] [client 4.233.88.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aZ32wYDG2jLWmZEFGzVonQAAAxU"]
[Wed Feb 25 03:06:44.952490 2026] [autoindex:error] [pid 13516:tid 13540] [client 4.233.88.210:14916] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 03:06:45.994236 2026] [:error] [pid 13516:tid 13542] [client 4.233.88.210:14916] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aZ32xYDG2jLWmZEFGzVotAAAAxg"]
[Wed Feb 25 03:06:47.352270 2026] [:error] [pid 13391:tid 13398] [client 4.233.88.210:9454] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aZ32x0IwokrsisMuCDfRHAAAAYU"]
[Wed Feb 25 03:06:48.424829 2026] [:error] [pid 18441:tid 18728] [client 4.233.88.210:16834] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aZ32yBYF1wpOnXIaHlOopAAAANM"]
[Wed Feb 25 03:06:49.309520 2026] [:error] [pid 13286:tid 13310] [client 4.233.88.210:1846] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aZ32ySU3io7izGW_QSeKDAAAAJU"]
[Wed Feb 25 03:06:50.661889 2026] [:error] [pid 13516:tid 13519] [client 4.233.88.210:10073] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "aZ32yoDG2jLWmZEFGzVouAAAAwE"]
[Wed Feb 25 03:06:51.430139 2026] [:error] [pid 13454:tid 13467] [client 4.233.88.210:13138] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "aZ32y-douHfevEW-I1rclAAAAks"]
[Wed Feb 25 03:06:52.150073 2026] [:error] [pid 13391:tid 13412] [client 4.233.88.210:16522] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "aZ32zEIwokrsisMuCDfRHgAAAZM"]
[Wed Feb 25 03:06:53.482894 2026] [:error] [pid 13391:tid 13405] [client 4.233.88.210:1094] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "aZ32zUIwokrsisMuCDfRIQAAAYw"]
[Wed Feb 25 03:06:55.339034 2026] [:error] [pid 13454:tid 13462] [client 4.233.88.210:9468] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aZ32z-douHfevEW-I1rcnwAAAkY"]
[Wed Feb 25 03:06:56.223686 2026] [:error] [pid 13575:tid 13613] [client 4.233.88.210:10597] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aZ320KwGxLnu91BIPRmI8wAAA8g"]
[Wed Feb 25 03:06:56.786047 2026] [:error] [pid 13575:tid 13628] [client 4.233.88.210:7884] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aZ320KwGxLnu91BIPRmI9QAAA9c"]
[Wed Feb 25 03:06:57.295181 2026] [:error] [pid 13575:tid 13618] [client 4.233.88.210:1804] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "aZ320awGxLnu91BIPRmI-wAAA80"]
[Wed Feb 25 03:06:57.970945 2026] [:error] [pid 13454:tid 13458] [client 4.233.88.210:14997] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/log.php"] [unique_id "aZ320edouHfevEW-I1rcowAAAkI"]
[Wed Feb 25 03:06:59.181684 2026] [:error] [pid 18850:tid 18865] [client 4.233.88.210:1136] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/log.php"] [unique_id "aZ320-DBmHucoAJRnqkodQAAAA0"]
[Wed Feb 25 03:07:00.474369 2026] [:error] [pid 13575:tid 13622] [client 4.233.88.210:9703] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/log.php"] [unique_id "aZ321KwGxLnu91BIPRmJCQAAA9E"]
[Wed Feb 25 03:07:02.188909 2026] [:error] [pid 13575:tid 13606] [client 4.233.88.210:10726] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/log.php"] [unique_id "aZ321qwGxLnu91BIPRmJFgAAA8E"]
[Wed Feb 25 03:07:03.525425 2026] [:error] [pid 13516:tid 13531] [client 4.233.88.210:14935] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aZ3214DG2jLWmZEFGzVowAAAAw0"]
[Wed Feb 25 03:07:05.978464 2026] [:error] [pid 13391:tid 13400] [client 4.233.88.210:9424] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aZ322UIwokrsisMuCDfRKwAAAYc"]
[Wed Feb 25 03:07:09.165133 2026] [:error] [pid 18441:tid 18709] [client 4.233.88.210:10099] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aZ323RYF1wpOnXIaHlOopgAAAME"]
[Wed Feb 25 03:07:12.164616 2026] [:error] [pid 18441:tid 18712] [client 4.233.88.210:9324] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aZ324BYF1wpOnXIaHlOoqAAAAMQ"]
[Wed Feb 25 03:07:13.287297 2026] [:error] [pid 18850:tid 18855] [client 4.233.88.210:65375] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless5.php"] [unique_id "aZ324eDBmHucoAJRnqkoegAAAAM"]
[Wed Feb 25 03:07:16.387091 2026] [:error] [pid 13575:tid 13614] [client 4.233.88.210:15018] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless5.php"] [unique_id "aZ325KwGxLnu91BIPRmJPQAAA8k"]
[Wed Feb 25 03:07:19.021652 2026] [:error] [pid 13516:tid 13523] [client 4.233.88.210:1161] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless5.php"] [unique_id "aZ3254DG2jLWmZEFGzVo0QAAAwU"]
[Wed Feb 25 03:07:21.550498 2026] [:error] [pid 13454:tid 13463] [client 4.233.88.210:15013] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless5.php"] [unique_id "aZ326edouHfevEW-I1rctQAAAkc"]
[Wed Feb 25 03:07:23.972730 2026] [:error] [pid 13575:tid 13608] [client 4.233.88.210:14177] [client 4.233.88.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aZ3266wGxLnu91BIPRmJYgAAA8M"]
[Wed Feb 25 03:07:28.730505 2026] [:error] [pid 18850:tid 18852] [client 4.233.88.210:16519] [client 4.233.88.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "aZ328ODBmHucoAJRnqkogwAAAAA"]
[Wed Feb 25 03:07:34.742380 2026] [:error] [pid 13575:tid 13605] [client 4.233.88.210:8624] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aZ329qwGxLnu91BIPRmJngAAA8A"]
[Wed Feb 25 03:07:36.527737 2026] [:error] [pid 13391:tid 13401] [client 4.233.88.210:65310] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aZ32-EIwokrsisMuCDfRNQAAAYg"]
[Wed Feb 25 03:07:37.317346 2026] [:error] [pid 18850:tid 18868] [client 4.233.88.210:22423] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aZ32-eDBmHucoAJRnqkoigAAABA"]
[Wed Feb 25 03:07:37.864871 2026] [:error] [pid 13359:tid 13378] [client 4.233.88.210:8598] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aZ32-aOZX03SYTgjvJXQBwAAAVE"]
[Wed Feb 25 03:07:38.402216 2026] [:error] [pid 13286:tid 13290] [client 4.233.88.210:29867] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aZ32-iU3io7izGW_QSeKGAAAAIE"]
[Wed Feb 25 03:07:39.094216 2026] [:error] [pid 13516:tid 13520] [client 4.233.88.210:11058] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aZ32-4DG2jLWmZEFGzVo2AAAAwI"]
[Wed Feb 25 03:07:39.617200 2026] [:error] [pid 13516:tid 13540] [client 4.233.88.210:1169] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aZ32-4DG2jLWmZEFGzVo2QAAAxY"]
[Wed Feb 25 03:07:40.372371 2026] [:error] [pid 13516:tid 13528] [client 4.233.88.210:65278] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/juuuu.php"] [unique_id "aZ32_IDG2jLWmZEFGzVo3gAAAwo"]
[Wed Feb 25 03:07:41.110905 2026] [:error] [pid 13359:tid 13377] [client 4.233.88.210:1192] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/juuuu.php"] [unique_id "aZ32_aOZX03SYTgjvJXQCQAAAVA"]
[Wed Feb 25 03:07:41.598014 2026] [:error] [pid 13516:tid 13537] [client 4.233.88.210:8639] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/juuuu.php"] [unique_id "aZ32_YDG2jLWmZEFGzVo5AAAAxM"]
[Wed Feb 25 03:07:42.090684 2026] [:error] [pid 13286:tid 13299] [client 4.233.88.210:22456] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/juuuu.php"] [unique_id "aZ32_iU3io7izGW_QSeKGgAAAIo"]
[Wed Feb 25 03:07:42.675216 2026] [:error] [pid 13359:tid 13383] [client 4.233.88.210:10557] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aZ32_qOZX03SYTgjvJXQCwAAAVY"]
[Wed Feb 25 03:07:43.272917 2026] [:error] [pid 13516:tid 13520] [client 4.233.88.210:10785] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aZ32_4DG2jLWmZEFGzVo6QAAAwI"]
[Wed Feb 25 03:07:43.783774 2026] [:error] [pid 13516:tid 13522] [client 4.233.88.210:10519] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aZ32_4DG2jLWmZEFGzVo6wAAAwQ"]
[Wed Feb 25 03:07:44.522300 2026] [:error] [pid 13575:tid 13605] [client 4.233.88.210:10778] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aZ33AKwGxLnu91BIPRmJzgAAA8A"]
[Wed Feb 25 03:07:55.002795 2026] [:error] [pid 13454:tid 13470] [client 4.233.88.210:22400] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wrt.php"] [unique_id "aZ33C-douHfevEW-I1rc0wAAAk4"]
[Wed Feb 25 03:07:56.319147 2026] [:error] [pid 18850:tid 18860] [client 4.233.88.210:10662] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wrt.php"] [unique_id "aZ33DODBmHucoAJRnqkomQAAAAg"]
[Wed Feb 25 03:07:57.315098 2026] [:error] [pid 13516:tid 13530] [client 4.233.88.210:7619] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wrt.php"] [unique_id "aZ33DYDG2jLWmZEFGzVo9gAAAww"]
[Wed Feb 25 03:07:57.989716 2026] [:error] [pid 13575:tid 13620] [client 4.233.88.210:7633] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wrt.php"] [unique_id "aZ33DawGxLnu91BIPRmJ8QAAA88"]
[Wed Feb 25 03:07:58.696139 2026] [:error] [pid 13575:tid 13618] [client 4.233.88.210:10678] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bibil.php"] [unique_id "aZ33DqwGxLnu91BIPRmJ9QAAA80"]
[Wed Feb 25 03:07:59.289282 2026] [:error] [pid 13575:tid 13605] [client 4.233.88.210:16826] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bibil.php"] [unique_id "aZ33D6wGxLnu91BIPRmJ9wAAA8A"]
[Wed Feb 25 03:07:59.862855 2026] [:error] [pid 13359:tid 13377] [client 4.233.88.210:10980] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bibil.php"] [unique_id "aZ33D6OZX03SYTgjvJXQFgAAAVA"]
[Wed Feb 25 03:08:00.576115 2026] [:error] [pid 13516:tid 13528] [client 4.233.88.210:16595] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bibil.php"] [unique_id "aZ33EIDG2jLWmZEFGzVo-QAAAwo"]
[Wed Feb 25 03:08:01.115952 2026] [:error] [pid 13454:tid 13476] [client 4.233.88.210:16799] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aZ33EedouHfevEW-I1rc1gAAAlQ"]
[Wed Feb 25 03:08:01.739275 2026] [:error] [pid 13516:tid 13527] [client 4.233.88.210:18731] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aZ33EYDG2jLWmZEFGzVo_AAAAwk"]
[Wed Feb 25 03:08:02.325545 2026] [:error] [pid 13516:tid 13535] [client 4.233.88.210:13675] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aZ33EoDG2jLWmZEFGzVo_QAAAxE"]
[Wed Feb 25 03:08:02.858305 2026] [:error] [pid 13516:tid 13534] [client 4.233.88.210:7418] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "aZ33EoDG2jLWmZEFGzVo_wAAAxA"]
[Wed Feb 25 03:08:03.592951 2026] [:error] [pid 13454:tid 13473] [client 4.233.88.210:18746] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aZ33E-douHfevEW-I1rc2QAAAlE"]
[Wed Feb 25 03:08:04.218047 2026] [:error] [pid 13359:tid 13383] [client 4.233.88.210:65159] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aZ33FKOZX03SYTgjvJXQGAAAAVY"]
[Wed Feb 25 03:08:04.876000 2026] [:error] [pid 13575:tid 13608] [client 4.233.88.210:15061] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aZ33FKwGxLnu91BIPRmKAAAAA8M"]
[Wed Feb 25 03:08:05.460903 2026] [:error] [pid 13575:tid 13624] [client 4.233.88.210:65179] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "aZ33FawGxLnu91BIPRmKAgAAA9M"]
[Wed Feb 25 03:08:06.069126 2026] [:error] [pid 18850:tid 18873] [client 4.233.88.210:10993] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aZ33FuDBmHucoAJRnqkooQAAABU"]
[Wed Feb 25 03:08:06.595725 2026] [:error] [pid 18850:tid 18864] [client 4.233.88.210:11539] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aZ33FuDBmHucoAJRnqkoogAAAAw"]
[Wed Feb 25 03:08:07.108341 2026] [:error] [pid 13575:tid 13625] [client 4.233.88.210:18743] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aZ33F6wGxLnu91BIPRmKAwAAA9Q"]
[Wed Feb 25 03:08:07.693060 2026] [:error] [pid 13454:tid 13462] [client 4.233.88.210:12838] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aZ33F-douHfevEW-I1rc4AAAAkY"]
[Wed Feb 25 03:08:08.238114 2026] [:error] [pid 13575:tid 13607] [client 4.233.88.210:16594] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aZ33GKwGxLnu91BIPRmKJwAAA8I"]
[Wed Feb 25 03:08:08.835836 2026] [:error] [pid 13454:tid 13477] [client 4.233.88.210:29541] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aZ33GOdouHfevEW-I1rc4wAAAlU"]
[Wed Feb 25 03:08:09.335088 2026] [:error] [pid 13454:tid 13470] [client 4.233.88.210:13479] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aZ33GedouHfevEW-I1rc5AAAAk4"]
[Wed Feb 25 03:08:09.919561 2026] [:error] [pid 18441:tid 18715] [client 4.233.88.210:65185] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aZ33GRYF1wpOnXIaHlOoswAAAMc"]
[Wed Feb 25 03:08:10.629258 2026] [:error] [pid 13454:tid 13475] [client 4.233.88.210:65187] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aZ33GudouHfevEW-I1rc5wAAAlM"]
[Wed Feb 25 03:08:11.420588 2026] [:error] [pid 13516:tid 13527] [client 4.233.88.210:11553] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aZ33G4DG2jLWmZEFGzVpDwAAAwk"]
[Wed Feb 25 03:08:12.381131 2026] [:error] [pid 13575:tid 13610] [client 4.233.88.210:15067] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aZ33HKwGxLnu91BIPRmKPQAAA8U"]
[Wed Feb 25 03:08:13.118862 2026] [:error] [pid 18850:tid 18870] [client 4.233.88.210:13750] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "aZ33HeDBmHucoAJRnqkoqAAAABI"]
[Wed Feb 25 03:08:13.966080 2026] [:error] [pid 13575:tid 13615] [client 4.233.88.210:11627] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aZ33HawGxLnu91BIPRmKQwAAA8o"]
[Wed Feb 25 03:08:14.607606 2026] [:error] [pid 13516:tid 13533] [client 4.233.88.210:12836] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aZ33HoDG2jLWmZEFGzVpFwAAAw8"]
[Wed Feb 25 03:08:15.313982 2026] [:error] [pid 13516:tid 13518] [client 4.233.88.210:16583] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aZ33H4DG2jLWmZEFGzVpGwAAAwA"]
[Wed Feb 25 03:08:15.885335 2026] [:error] [pid 13359:tid 13371] [client 4.233.88.210:11834] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "aZ33H6OZX03SYTgjvJXQIwAAAUo"]
[Wed Feb 25 03:08:17.242900 2026] [:error] [pid 18850:tid 18862] [client 4.233.88.210:11626] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aZ33IeDBmHucoAJRnqkotgAAAAo"]
[Wed Feb 25 03:08:18.655495 2026] [:error] [pid 13454:tid 13468] [client 4.233.88.210:11798] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aZ33IudouHfevEW-I1rc8wAAAkw"]
[Wed Feb 25 03:08:20.390592 2026] [:error] [pid 13516:tid 13537] [client 4.233.88.210:13736] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aZ33JIDG2jLWmZEFGzVpIwAAAxM"]
[Wed Feb 25 03:08:22.251461 2026] [:error] [pid 26872:tid 26898] [client 4.233.88.210:14314] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aZ33JnxLbzvRGuzwKjkijQAAAFg"]
[Wed Feb 25 03:08:23.471783 2026] [:error] [pid 13286:tid 13302] [client 4.233.88.210:13481] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aZ33JyU3io7izGW_QSeKIwAAAI0"]
[Wed Feb 25 03:08:24.064264 2026] [:error] [pid 13516:tid 13521] [client 4.233.88.210:31718] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aZ33KIDG2jLWmZEFGzVpKgAAAwM"]
[Wed Feb 25 03:08:25.076295 2026] [:error] [pid 13391:tid 13406] [client 4.233.88.210:13725] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aZ33KUIwokrsisMuCDfRSwAAAY0"]
[Wed Feb 25 03:08:25.903592 2026] [:error] [pid 18441:tid 18711] [client 4.233.88.210:15525] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aZ33KRYF1wpOnXIaHlOotwAAAMM"]
[Wed Feb 25 03:08:26.465780 2026] [:error] [pid 13575:tid 13620] [client 4.233.88.210:13728] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aZ33KqwGxLnu91BIPRmKVAAAA88"]
[Wed Feb 25 03:08:26.989854 2026] [:error] [pid 13286:tid 13309] [client 4.233.88.210:11476] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aZ33KiU3io7izGW_QSeKJgAAAJQ"]
[Wed Feb 25 03:08:27.536349 2026] [:error] [pid 13391:tid 13412] [client 4.233.88.210:15068] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aZ33K0IwokrsisMuCDfRTQAAAZM"]
[Wed Feb 25 03:08:28.062888 2026] [:error] [pid 18441:tid 18732] [client 4.233.88.210:14745] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "aZ33LBYF1wpOnXIaHlOouAAAANc"]
[Wed Feb 25 03:08:28.591659 2026] [:error] [pid 13516:tid 13523] [client 4.233.88.210:13463] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aZ33LIDG2jLWmZEFGzVpLwAAAwU"]
[Wed Feb 25 03:08:29.090108 2026] [:error] [pid 13575:tid 13622] [client 4.233.88.210:13501] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aZ33LawGxLnu91BIPRmKXwAAA9E"]
[Wed Feb 25 03:08:29.622243 2026] [:error] [pid 13575:tid 13610] [client 4.233.88.210:13447] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aZ33LawGxLnu91BIPRmKYAAAA8U"]
[Wed Feb 25 03:08:30.166124 2026] [:error] [pid 13359:tid 13361] [client 4.233.88.210:13744] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aZ33LqOZX03SYTgjvJXQKAAAAUA"]
[Wed Feb 25 03:08:31.018793 2026] [:error] [pid 13359:tid 13366] [client 4.233.88.210:11807] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aZ33L6OZX03SYTgjvJXQKQAAAUU"]
[Wed Feb 25 03:08:31.688809 2026] [:error] [pid 13575:tid 13623] [client 4.233.88.210:10414] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aZ33L6wGxLnu91BIPRmKYwAAA9I"]
[Wed Feb 25 03:08:32.264882 2026] [:error] [pid 13575:tid 13606] [client 4.233.88.210:15499] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aZ33MKwGxLnu91BIPRmKZgAAA8E"]
[Wed Feb 25 03:08:33.326579 2026] [:error] [pid 13391:tid 13414] [client 4.233.88.210:7619] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "aZ33MUIwokrsisMuCDfRTwAAAZU"]
[Wed Feb 25 03:08:34.322326 2026] [:error] [pid 18441:tid 18721] [client 4.233.88.210:9909] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "aZ33MhYF1wpOnXIaHlOovAAAAM0"]
[Wed Feb 25 03:08:35.062325 2026] [:error] [pid 13575:tid 13625] [client 4.233.88.210:9856] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "aZ33M6wGxLnu91BIPRmKaAAAA9Q"]
[Wed Feb 25 03:08:35.601602 2026] [:error] [pid 18850:tid 18863] [client 4.233.88.210:10393] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "aZ33M-DBmHucoAJRnqkouQAAAAs"]
[Wed Feb 25 03:08:36.137512 2026] [:error] [pid 13359:tid 13367] [client 4.233.88.210:14316] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "aZ33NKOZX03SYTgjvJXQMAAAAUY"]
[Wed Feb 25 03:08:36.672319 2026] [:error] [pid 13391:tid 13408] [client 4.233.88.210:9403] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "aZ33NEIwokrsisMuCDfRUAAAAY8"]
[Wed Feb 25 03:08:37.276454 2026] [:error] [pid 18458:tid 18811] [client 4.233.88.210:11473] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "aZ33NQuir-tBe4tUismnDAAAApA"]
[Wed Feb 25 03:08:37.913929 2026] [:error] [pid 18458:tid 18806] [client 4.233.88.210:9879] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "aZ33NQuir-tBe4tUismnDwAAAow"]
[Wed Feb 25 03:08:39.235683 2026] [:error] [pid 13575:tid 13605] [client 4.233.88.210:10822] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "aZ33N6wGxLnu91BIPRmKawAAA8A"]
[Wed Feb 25 03:08:39.940872 2026] [:error] [pid 13575:tid 13621] [client 4.233.88.210:31706] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aZ33N6wGxLnu91BIPRmKbgAAA9A"]
[Wed Feb 25 03:08:40.622929 2026] [:error] [pid 13391:tid 13409] [client 4.233.88.210:64998] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aZ33OEIwokrsisMuCDfRUgAAAZA"]
[Wed Feb 25 03:08:41.520892 2026] [:error] [pid 18850:tid 18872] [client 4.233.88.210:65090] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aZ33OeDBmHucoAJRnqkowAAAABQ"]
[Wed Feb 25 03:08:42.491679 2026] [:error] [pid 18850:tid 18873] [client 4.233.88.210:10024] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aZ33OuDBmHucoAJRnqkowwAAABU"]
[Wed Feb 25 03:08:43.498183 2026] [:error] [pid 13359:tid 13378] [client 4.233.88.210:12702] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aZ33O6OZX03SYTgjvJXQNAAAAVE"]
[Wed Feb 25 03:08:44.121105 2026] [:error] [pid 18458:tid 18800] [client 4.233.88.210:1498] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aZ33PAuir-tBe4tUismnHAAAAoY"]
[Wed Feb 25 03:08:44.768856 2026] [:error] [pid 18458:tid 18817] [client 4.233.88.210:11975] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aZ33PAuir-tBe4tUismnHwAAApY"]
[Wed Feb 25 03:08:45.574094 2026] [:error] [pid 13286:tid 13310] [client 4.233.88.210:14275] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file9.php"] [unique_id "aZ33PSU3io7izGW_QSeKRwAAAJU"]
[Wed Feb 25 03:08:46.455861 2026] [:error] [pid 18850:tid 18863] [client 4.233.88.210:10425] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aZ33PuDBmHucoAJRnqkoxQAAAAs"]
[Wed Feb 25 03:08:47.218156 2026] [:error] [pid 26872:tid 26881] [client 4.233.88.210:31869] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aZ33P3xLbzvRGuzwKjkiwgAAAEc"]
[Wed Feb 25 03:08:48.360375 2026] [:error] [pid 13575:tid 13617] [client 4.233.88.210:1517] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aZ33QKwGxLnu91BIPRmKmwAAA8w"]
[Wed Feb 25 03:08:49.614211 2026] [:error] [pid 13575:tid 13607] [client 4.233.88.210:10837] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aZ33QawGxLnu91BIPRmKngAAA8I"]
[Wed Feb 25 03:08:50.618183 2026] [:error] [pid 13454:tid 13469] [client 4.233.88.210:10047] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "aZ33QudouHfevEW-I1rdKQAAAk0"]
[Wed Feb 25 03:08:51.452349 2026] [:error] [pid 18850:tid 18871] [client 4.233.88.210:65012] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "aZ33Q-DBmHucoAJRnqkoygAAABM"]
[Wed Feb 25 03:08:52.367951 2026] [:error] [pid 13575:tid 13616] [client 4.233.88.210:14835] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "aZ33RKwGxLnu91BIPRmKogAAA8s"]
[Wed Feb 25 03:08:53.654676 2026] [:error] [pid 13575:tid 13612] [client 4.233.88.210:14815] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "aZ33RawGxLnu91BIPRmKqwAAA8c"]
[Wed Feb 25 03:09:07.610709 2026] [:error] [pid 18850:tid 18867] [client 4.233.88.210:13269] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aZ33U-DBmHucoAJRnqko2QAAAA8"]
[Wed Feb 25 03:09:08.650744 2026] [:error] [pid 13575:tid 13619] [client 4.233.88.210:1235] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aZ33VKwGxLnu91BIPRmLCgAAA84"]
[Wed Feb 25 03:09:09.750302 2026] [:error] [pid 13575:tid 13626] [client 4.233.88.210:1219] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aZ33VawGxLnu91BIPRmLDQAAA9U"]
[Wed Feb 25 03:09:10.744766 2026] [:error] [pid 13454:tid 13463] [client 4.233.88.210:14563] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aZ33VudouHfevEW-I1rdPQAAAkc"]
[Wed Feb 25 03:09:11.921755 2026] [:error] [pid 13575:tid 13610] [client 4.233.88.210:1277] [client 4.233.88.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "aZ33V6wGxLnu91BIPRmLDgAAA8U"]
[Wed Feb 25 03:09:12.557425 2026] [:error] [pid 13575:tid 13613] [client 4.233.88.210:7559] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/gravity_forms/g/e/e/a/Casper.php"] [unique_id "aZ33WKwGxLnu91BIPRmLEwAAA8g"]
[Wed Feb 25 03:09:13.561806 2026] [:error] [pid 13286:tid 13312] [client 4.233.88.210:7345] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/gravity_forms/g/e/e/a/Casper.php"] [unique_id "aZ33WSU3io7izGW_QSeKSwAAAJc"]
[Wed Feb 25 03:09:14.171916 2026] [:error] [pid 13575:tid 13612] [client 4.233.88.210:14553] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/gravity_forms/g/e/e/a/Casper.php"] [unique_id "aZ33WqwGxLnu91BIPRmLFgAAA8c"]
[Wed Feb 25 03:09:14.971043 2026] [:error] [pid 18850:tid 18853] [client 4.233.88.210:7575] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/gravity_forms/g/e/e/a/Casper.php"] [unique_id "aZ33WuDBmHucoAJRnqko3AAAAAE"]
[Wed Feb 25 03:09:15.876839 2026] [:error] [pid 13575:tid 13615] [client 4.233.88.210:12882] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/spip.php"] [unique_id "aZ33W6wGxLnu91BIPRmLGwAAA8o"]
[Wed Feb 25 03:09:16.851568 2026] [:error] [pid 26872:tid 26894] [client 4.233.88.210:1257] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/spip.php"] [unique_id "aZ33XHxLbzvRGuzwKjkixQAAAFQ"]
[Wed Feb 25 03:09:18.266045 2026] [:error] [pid 13516:tid 13524] [client 4.233.88.210:12887] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/spip.php"] [unique_id "aZ33XoDG2jLWmZEFGzVpdgAAAwY"]
[Wed Feb 25 03:09:19.155988 2026] [:error] [pid 18850:tid 18866] [client 4.233.88.210:7338] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/spip.php"] [unique_id "aZ33X-DBmHucoAJRnqko3wAAAA4"]
[Wed Feb 25 03:09:20.022386 2026] [:error] [pid 13575:tid 13621] [client 4.233.88.210:33438] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/scripts/wpup.php"] [unique_id "aZ33YKwGxLnu91BIPRmLOQAAA9A"]
[Wed Feb 25 03:09:20.883149 2026] [:error] [pid 13575:tid 13614] [client 4.233.88.210:9740] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/scripts/wpup.php"] [unique_id "aZ33YKwGxLnu91BIPRmLRgAAA8k"]
[Wed Feb 25 03:09:22.401221 2026] [:error] [pid 13454:tid 13475] [client 4.233.88.210:12864] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/scripts/wpup.php"] [unique_id "aZ33YudouHfevEW-I1rdSgAAAlM"]
[Wed Feb 25 03:09:23.975751 2026] [:error] [pid 13454:tid 13463] [client 4.233.88.210:33423] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/scripts/wpup.php"] [unique_id "aZ33Y-douHfevEW-I1rdUAAAAkc"]
[Wed Feb 25 03:09:28.176941 2026] [:error] [pid 18850:tid 18873] [client 4.233.88.210:8665] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/update/wpupex.php"] [unique_id "aZ33aODBmHucoAJRnqko4QAAABU"]
[Wed Feb 25 03:09:30.107341 2026] [:error] [pid 13575:tid 13616] [client 4.233.88.210:7357] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/update/wpupex.php"] [unique_id "aZ33aqwGxLnu91BIPRmLeQAAA8s"]
[Wed Feb 25 03:09:34.418909 2026] [:error] [pid 13575:tid 13613] [client 4.233.88.210:17398] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/update/wpupex.php"] [unique_id "aZ33bqwGxLnu91BIPRmLmAAAA8g"]
[Wed Feb 25 03:09:36.196220 2026] [:error] [pid 13575:tid 13607] [client 4.233.88.210:33450] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/update/wpupex.php"] [unique_id "aZ33cKwGxLnu91BIPRmLnAAAA8I"]
[Wed Feb 25 03:09:39.110633 2026] [:error] [pid 13575:tid 13615] [client 4.233.88.210:30763] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ho/wpup.php"] [unique_id "aZ33c6wGxLnu91BIPRmLowAAA8o"]
[Wed Feb 25 03:09:39.730782 2026] [:error] [pid 13575:tid 13617] [client 4.233.88.210:12946] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ho/wpup.php"] [unique_id "aZ33c6wGxLnu91BIPRmLpwAAA8w"]
[Wed Feb 25 03:09:40.346939 2026] [:error] [pid 13391:tid 13400] [client 4.233.88.210:15525] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ho/wpup.php"] [unique_id "aZ33dEIwokrsisMuCDfRdwAAAYc"]
[Wed Feb 25 03:09:41.210838 2026] [:error] [pid 13391:tid 13398] [client 4.233.88.210:1369] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ho/wpup.php"] [unique_id "aZ33dUIwokrsisMuCDfReAAAAYU"]
[Wed Feb 25 03:09:41.923973 2026] [:error] [pid 13516:tid 13537] [client 4.233.88.210:29459] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/"] [unique_id "aZ33dYDG2jLWmZEFGzVpgwAAAxM"]
[Wed Feb 25 03:09:42.721776 2026] [:error] [pid 13286:tid 13313] [client 4.233.88.210:14483] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/"] [unique_id "aZ33diU3io7izGW_QSeKUwAAAJg"]
[Wed Feb 25 03:09:43.396855 2026] [:error] [pid 18458:tid 18819] [client 4.233.88.210:17371] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/"] [unique_id "aZ33dwuir-tBe4tUismnLAAAApg"]
[Wed Feb 25 03:09:44.145764 2026] [:error] [pid 18441:tid 18711] [client 4.233.88.210:12271] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/"] [unique_id "aZ33eBYF1wpOnXIaHlOoxQAAAMM"]
[Wed Feb 25 03:09:45.126663 2026] [:error] [pid 13516:tid 13531] [client 4.233.88.210:14526] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp/wp-content/plugins/classic-editor/js/geido.php"] [unique_id "aZ33eYDG2jLWmZEFGzVphQAAAw0"]
[Wed Feb 25 03:09:45.870808 2026] [:error] [pid 13516:tid 13525] [client 4.233.88.210:13389] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp/wp-content/plugins/classic-editor/js/geido.php"] [unique_id "aZ33eYDG2jLWmZEFGzVphwAAAwc"]
[Wed Feb 25 03:09:46.349105 2026] [:error] [pid 13575:tid 13611] [client 4.233.88.210:11757] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp/wp-content/plugins/classic-editor/js/geido.php"] [unique_id "aZ33eqwGxLnu91BIPRmLtgAAA8Y"]
[Wed Feb 25 03:09:47.199485 2026] [:error] [pid 13575:tid 13626] [client 4.233.88.210:14476] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp/wp-content/plugins/classic-editor/js/geido.php"] [unique_id "aZ33e6wGxLnu91BIPRmLvgAAA9U"]
[Wed Feb 25 03:09:48.656477 2026] [:error] [pid 13575:tid 13617] [client 4.233.88.210:9930] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myy.php"] [unique_id "aZ33fKwGxLnu91BIPRmLxQAAA8w"]
[Wed Feb 25 03:09:50.033572 2026] [:error] [pid 13359:tid 13362] [client 4.233.88.210:8423] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myy.php"] [unique_id "aZ33fqOZX03SYTgjvJXQSQAAAUE"]
[Wed Feb 25 03:09:51.570426 2026] [:error] [pid 13575:tid 13620] [client 4.233.88.210:31114] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myy.php"] [unique_id "aZ33f6wGxLnu91BIPRmLzAAAA88"]
[Wed Feb 25 03:09:52.495063 2026] [:error] [pid 13516:tid 13530] [client 4.233.88.210:7182] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myy.php"] [unique_id "aZ33gIDG2jLWmZEFGzVptgAAAww"]
[Wed Feb 25 03:09:53.194938 2026] [:error] [pid 13516:tid 13527] [client 4.233.88.210:7436] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/halo.php"] [unique_id "aZ33gYDG2jLWmZEFGzVpvQAAAwk"]
[Wed Feb 25 03:09:53.763719 2026] [:error] [pid 18458:tid 18796] [client 4.233.88.210:9025] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/halo.php"] [unique_id "aZ33gQuir-tBe4tUismnLQAAAoM"]
[Wed Feb 25 03:09:54.415222 2026] [:error] [pid 13286:tid 13294] [client 4.233.88.210:7439] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/halo.php"] [unique_id "aZ33giU3io7izGW_QSeKVwAAAIU"]
[Wed Feb 25 03:09:55.925459 2026] [:error] [pid 13286:tid 13293] [client 4.233.88.210:1983] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/halo.php"] [unique_id "aZ33gyU3io7izGW_QSeKWgAAAIQ"]
[Wed Feb 25 03:09:56.748462 2026] [:error] [pid 13516:tid 13536] [client 4.233.88.210:8307] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfour/assets/css/geido.php"] [unique_id "aZ33hIDG2jLWmZEFGzVp6AAAAxI"]
[Wed Feb 25 03:09:57.657912 2026] [:error] [pid 13516:tid 13534] [client 4.233.88.210:7457] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfour/assets/css/geido.php"] [unique_id "aZ33hYDG2jLWmZEFGzVp9QAAAxA"]
[Wed Feb 25 03:09:58.657708 2026] [:error] [pid 13575:tid 13605] [client 4.233.88.210:13048] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfour/assets/css/geido.php"] [unique_id "aZ33hqwGxLnu91BIPRmLzwAAA8A"]
[Wed Feb 25 03:09:59.367240 2026] [:error] [pid 13454:tid 13464] [client 4.233.88.210:7424] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfour/assets/css/geido.php"] [unique_id "aZ33h-douHfevEW-I1rdyAAAAkg"]
[Wed Feb 25 03:10:00.436553 2026] [:error] [pid 13391:tid 13401] [client 4.233.88.210:8998] [client 4.233.88.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/library/upload.php"] [unique_id "aZ33iEIwokrsisMuCDfRewAAAYg"]
[Wed Feb 25 03:10:01.282888 2026] [:error] [pid 18458:tid 18813] [client 4.233.88.210:8951] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/coffee/index.php"] [unique_id "aZ33iQuir-tBe4tUismnMAAAApI"]
[Wed Feb 25 03:10:01.912389 2026] [:error] [pid 13391:tid 13410] [client 4.233.88.210:31106] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/coffee/index.php"] [unique_id "aZ33iUIwokrsisMuCDfRfAAAAZE"]
[Wed Feb 25 03:10:02.470463 2026] [:error] [pid 13454:tid 13465] [client 4.233.88.210:8956] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/coffee/index.php"] [unique_id "aZ33iudouHfevEW-I1rdzQAAAkk"]
[Wed Feb 25 03:10:03.025719 2026] [:error] [pid 26872:tid 26881] [client 4.233.88.210:17054] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/coffee/index.php"] [unique_id "aZ33i3xLbzvRGuzwKjki0QAAAEc"]
[Wed Feb 25 03:10:03.568571 2026] [:error] [pid 26872:tid 26890] [client 4.233.88.210:8316] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aZ33i3xLbzvRGuzwKjki0gAAAFA"]
[Wed Feb 25 03:10:04.146380 2026] [:error] [pid 18441:tid 18721] [client 4.233.88.210:17071] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aZ33jBYF1wpOnXIaHlOoxwAAAM0"]
[Wed Feb 25 03:10:04.944713 2026] [:error] [pid 13359:tid 13371] [client 4.233.88.210:8754] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aZ33jKOZX03SYTgjvJXQZQAAAUo"]
[Wed Feb 25 03:10:05.536123 2026] [:error] [pid 13286:tid 13297] [client 4.233.88.210:10186] [client 4.233.88.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aZ33jSU3io7izGW_QSeKXwAAAIg"]
[Wed Feb 25 04:29:43.637737 2026] [:error] [pid 20763:tid 20768] [client 120.71.59.24:35278] [client 120.71.59.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZ4KN00w_zc13OX-xibkxAAAAMM"]
[Wed Feb 25 04:49:43.446960 2026] [:error] [pid 20659:tid 20695] [client 43.164.196.57:46756] [client 43.164.196.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZ4O5z_THK_HtK-Q44LlNwAAAEA"]
[Wed Feb 25 05:22:08.071283 2026] [:error] [pid 60498:tid 60506] [client 98.159.43.162:34769] [client 98.159.43.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aZ4WgCFCVhQ3ffus0uJqIwAAAsE"]
[Wed Feb 25 05:22:09.212668 2026] [:error] [pid 5556:tid 5589] [client 98.159.43.162:34761] [client 98.159.43.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bk/index.php"] [unique_id "aZ4WgaOrYeaTyh7lGRUV_QAAAcI"]
[Wed Feb 25 05:22:14.418069 2026] [:error] [pid 5619:tid 5659] [client 98.159.43.119:65343] [client 98.159.43.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aZ4WhpFUzdv-0L_F4fuseAAAAhg"]
[Wed Feb 25 05:22:16.234971 2026] [:error] [pid 5620:tid 5662] [client 98.159.43.110:27565] [client 98.159.43.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aZ4WiIY2LQjtieeRkoagkgAAAwA"]
[Wed Feb 25 05:22:16.456900 2026] [:error] [pid 5620:tid 5670] [client 98.159.43.121:51029] [client 98.159.43.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/chosen.php"] [unique_id "aZ4WiIY2LQjtieeRkoagkwAAAwg"]
[Wed Feb 25 05:22:16.772531 2026] [:error] [pid 5619:tid 5648] [client 98.159.43.145:48899] [client 98.159.43.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aZ4WiJFUzdv-0L_F4fuseQAAAg0"]
[Wed Feb 25 05:22:17.992892 2026] [:error] [pid 5620:tid 5664] [client 98.159.43.129:37615] [client 98.159.43.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aZ4WiYY2LQjtieeRkoagngAAAwI"]
[Wed Feb 25 05:22:19.240168 2026] [:error] [pid 5619:tid 5644] [client 98.159.43.130:45453] [client 98.159.43.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aZ4Wi5FUzdv-0L_F4fushAAAAgk"]
[Wed Feb 25 05:22:24.296763 2026] [:error] [pid 60498:tid 60511] [client 98.159.43.134:23443] [client 98.159.43.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aZ4WkCFCVhQ3ffus0uJqNAAAAsY"]
[Wed Feb 25 05:22:24.575080 2026] [:error] [pid 5620:tid 5678] [client 98.159.43.137:42193] [client 98.159.43.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aZ4WkIY2LQjtieeRkoagrAAAAxA"]
[Wed Feb 25 05:22:53.325574 2026] [:error] [pid 5619:tid 5652] [client 98.159.43.123:28851] [client 98.159.43.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ4WrZFUzdv-0L_F4futAwAAAhE"]
[Wed Feb 25 05:22:56.748834 2026] [:error] [pid 5619:tid 5656] [client 98.159.43.123:28851] [client 98.159.43.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/modules.php"] [unique_id "aZ4WsJFUzdv-0L_F4futBwAAAhU"]
[Wed Feb 25 05:23:05.982145 2026] [:error] [pid 5620:tid 5663] [client 98.159.43.140:21753] [client 98.159.43.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/codeboy1877_up.php"] [unique_id "aZ4WuYY2LQjtieeRkoahCAAAAwE"]
[Wed Feb 25 05:23:32.704038 2026] [:error] [pid 5620:tid 5664] [client 98.159.43.153:54403] [client 98.159.43.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/lx.php"] [unique_id "aZ4W1IY2LQjtieeRkoahaAAAAwI"]
[Wed Feb 25 05:24:12.941636 2026] [:error] [pid 5556:tid 5590] [client 98.159.43.132:29145] [client 98.159.43.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/F0x.php"] [unique_id "aZ4W_KOrYeaTyh7lGRUXgAAAAcM"]
[Wed Feb 25 05:24:34.175404 2026] [:error] [pid 20658:tid 20677] [client 98.159.43.112:52691] [client 98.159.43.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aZ4XEuu8cohhPfsAIFmmIAAAAAo"]
[Wed Feb 25 05:24:34.414788 2026] [:error] [pid 20763:tid 20774] [client 98.159.43.156:23305] [client 98.159.43.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.159.43.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ4XEk0w_zc13OX-xibpJgAAAMk"]
[Wed Feb 25 05:24:37.118175 2026] [:error] [pid 20763:tid 20766] [client 98.159.43.156:23305] [client 98.159.43.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aZ4XFU0w_zc13OX-xibpLAAAAME"]
[Wed Feb 25 05:24:44.466643 2026] [:error] [pid 5619:tid 5641] [client 98.159.43.121:62019] [client 98.159.43.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aZ4XHJFUzdv-0L_F4fuuBwAAAgY"]
[Wed Feb 25 05:24:56.212560 2026] [:error] [pid 60498:tid 60505] [client 98.159.43.155:52185] [client 98.159.43.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aZ4XKCFCVhQ3ffus0uJqowAAAsA"]
[Wed Feb 25 05:24:56.394858 2026] [:error] [pid 60290:tid 60295] [client 98.159.43.144:64249] [client 98.159.43.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aZ4XKDPwSUztcPyiofps9AAAAQM"]
[Wed Feb 25 05:24:56.609444 2026] [:error] [pid 60500:tid 60601] [client 98.159.43.156:33659] [client 98.159.43.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/about.php"] [unique_id "aZ4XKPY9avxuno9KAT_7uAAAA04"]
[Wed Feb 25 05:24:56.845101 2026] [:error] [pid 60290:tid 60307] [client 98.159.43.160:56675] [client 98.159.43.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/about.php"] [unique_id "aZ4XKDPwSUztcPyiofps9QAAAQ8"]
[Wed Feb 25 05:24:59.564822 2026] [:error] [pid 5620:tid 5700] [client 98.159.43.132:26449] [client 98.159.43.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.132, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/wp-login.php"] [unique_id "aZ4XK4Y2LQjtieeRkoaiKQAAAxg"]
[Wed Feb 25 05:25:12.062436 2026] [:error] [pid 5620:tid 5672] [client 98.159.43.132:26449] [client 98.159.43.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aZ4XOIY2LQjtieeRkoaiTAAAAwo"]
[Wed Feb 25 05:25:15.411232 2026] [:error] [pid 5620:tid 5678] [client 98.159.43.112:45493] [client 98.159.43.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aZ4XO4Y2LQjtieeRkoaiVwAAAxA"]
[Wed Feb 25 05:25:22.338308 2026] [:error] [pid 5620:tid 5662] [client 98.159.43.112:45493] [client 98.159.43.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/makeasmtp.php"] [unique_id "aZ4XQoY2LQjtieeRkoaiYwAAAwA"]
[Wed Feb 25 05:25:22.542045 2026] [:error] [pid 5619:tid 5642] [client 98.159.43.157:56249] [client 98.159.43.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/about.php"] [unique_id "aZ4XQpFUzdv-0L_F4fuuHgAAAgc"]
[Wed Feb 25 05:25:24.537925 2026] [proxy_fcgi:error] [pid 5556:tid 5601] [client 98.159.43.148:38399] AH01071: Got error 'Primary script unknown'
[Wed Feb 25 05:25:29.557117 2026] [proxy_fcgi:error] [pid 5556:tid 5604] [client 98.159.43.148:38399] AH01071: Got error 'Primary script unknown'
[Wed Feb 25 05:25:38.765936 2026] [:error] [pid 5556:tid 5608] [client 98.159.43.148:38399] [client 98.159.43.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aZ4XUqOrYeaTyh7lGRUX3AAAAdU"]
[Wed Feb 25 05:25:42.005940 2026] [:error] [pid 5620:tid 5671] [client 98.159.43.111:25007] [client 98.159.43.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bak.php"] [unique_id "aZ4XVoY2LQjtieeRkoainQAAAwk"]
[Wed Feb 25 05:25:43.177218 2026] [:error] [pid 5620:tid 5664] [client 98.159.43.109:55311] [client 98.159.43.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aZ4XV4Y2LQjtieeRkoaioQAAAwI"]
[Wed Feb 25 05:25:47.176834 2026] [:error] [pid 5619:tid 5643] [client 98.159.43.157:26407] [client 98.159.43.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aZ4XW5FUzdv-0L_F4fuuRQAAAgg"]
[Wed Feb 25 05:25:47.425683 2026] [:error] [pid 60498:tid 60516] [client 98.159.43.109:32251] [client 98.159.43.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aZ4XWyFCVhQ3ffus0uJqyQAAAss"]
[Wed Feb 25 05:25:47.794006 2026] [:error] [pid 5556:tid 5599] [client 98.159.43.130:51857] [client 98.159.43.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.130, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aZ4XW6OrYeaTyh7lGRUX7QAAAcw"]
[Wed Feb 25 05:25:50.255067 2026] [:error] [pid 5556:tid 5601] [client 98.159.43.130:51857] [client 98.159.43.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/themes.php"] [unique_id "aZ4XXqOrYeaTyh7lGRUX9wAAAc4"]
[Wed Feb 25 05:25:54.118922 2026] [autoindex:error] [pid 5556:tid 5599] [client 98.159.43.150:56455] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:25:54.845791 2026] [:error] [pid 5556:tid 5598] [client 98.159.43.150:56455] [client 98.159.43.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-includes_function.php"] [unique_id "aZ4XYqOrYeaTyh7lGRUYCAAAAcs"]
[Wed Feb 25 05:25:56.712582 2026] [:error] [pid 5556:tid 5609] [client 98.159.43.108:23277] [client 98.159.43.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/about.php"] [unique_id "aZ4XZKOrYeaTyh7lGRUYEAAAAdY"]
[Wed Feb 25 05:25:58.623727 2026] [:error] [pid 20658:tid 20687] [client 98.159.43.131:40945] [client 98.159.43.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aZ4XZuu8cohhPfsAIFmmUwAAABQ"]
[Wed Feb 25 05:26:01.635238 2026] [:error] [pid 60387:tid 60472] [client 98.159.43.150:21627] [client 98.159.43.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/themes/wp-login.php"] [unique_id "aZ4XaYHL0QH7Sr13X0Kj2AAAAoA"]
[Wed Feb 25 05:26:03.853658 2026] [:error] [pid 60387:tid 60480] [client 98.159.43.150:21627] [client 98.159.43.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/index.php"] [unique_id "aZ4Xa4HL0QH7Sr13X0Kj2wAAAog"]
[Wed Feb 25 05:26:04.071107 2026] [:error] [pid 5620:tid 5678] [client 98.159.43.162:38707] [client 98.159.43.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aZ4XbIY2LQjtieeRkoai3QAAAxA"]
[Wed Feb 25 05:26:12.342788 2026] [:error] [pid 5620:tid 5677] [client 98.159.43.113:44799] [client 98.159.43.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aZ4XdIY2LQjtieeRkoajCQAAAw8"]
[Wed Feb 25 05:26:14.364714 2026] [autoindex:error] [pid 60498:tid 60511] [client 98.159.43.154:58409] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:26:14.478251 2026] [:error] [pid 60498:tid 60521] [client 98.159.43.154:58409] [client 98.159.43.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aZ4XdiFCVhQ3ffus0uJq0QAAAtA"]
[Wed Feb 25 05:26:14.702525 2026] [:error] [pid 5619:tid 5652] [client 98.159.43.122:52903] [client 98.159.43.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/about.php"] [unique_id "aZ4XdpFUzdv-0L_F4fuuawAAAhE"]
[Wed Feb 25 05:26:14.962888 2026] [:error] [pid 5619:tid 5636] [client 98.159.43.157:37801] [client 98.159.43.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Content/index.php"] [unique_id "aZ4XdpFUzdv-0L_F4fuubAAAAgE"]
[Wed Feb 25 05:26:15.170054 2026] [:error] [pid 5619:tid 5647] [client 98.159.43.140:49965] [client 98.159.43.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aZ4Xd5FUzdv-0L_F4fuubwAAAgw"]
[Wed Feb 25 05:26:18.729225 2026] [:error] [pid 5619:tid 5654] [client 98.159.43.133:34823] [client 98.159.43.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/autoload_classmap.php"] [unique_id "aZ4XepFUzdv-0L_F4fuugQAAAhM"]
[Wed Feb 25 05:26:22.020679 2026] [:error] [pid 20658:tid 20688] [client 98.159.43.123:40821] [client 98.159.43.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aZ4Xfuu8cohhPfsAIFmmfgAAABU"]
[Wed Feb 25 05:26:23.831086 2026] [:error] [pid 20659:tid 20717] [client 98.159.43.106:46543] [client 98.159.43.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aZ4Xfz_THK_HtK-Q44LzwAAAAFY"]
[Wed Feb 25 05:26:24.928451 2026] [:error] [pid 5556:tid 5597] [client 98.159.43.140:35571] [client 98.159.43.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/autoload_classmap.php"] [unique_id "aZ4XgKOrYeaTyh7lGRUYHQAAAco"]
[Wed Feb 25 05:26:27.535169 2026] [:error] [pid 60290:tid 60303] [client 98.159.43.147:54859] [client 98.159.43.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aZ4XgzPwSUztcPyiofptLAAAAQs"]
[Wed Feb 25 05:26:27.829435 2026] [:error] [pid 5620:tid 5675] [client 98.159.43.133:30839] [client 98.159.43.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/zmFM.php"] [unique_id "aZ4Xg4Y2LQjtieeRkoajwQAAAw0"]
[Wed Feb 25 05:26:28.828277 2026] [:error] [pid 60498:tid 60506] [client 98.159.43.114:63427] [client 98.159.43.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aZ4XhCFCVhQ3ffus0uJq5AAAAsE"]
[Wed Feb 25 05:26:31.330090 2026] [:error] [pid 20763:tid 20775] [client 98.159.43.117:58299] [client 98.159.43.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.117, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/cgi-bin/wp-login.php"] [unique_id "aZ4Xh00w_zc13OX-xibpRwAAAMo"]
[Wed Feb 25 05:26:32.848487 2026] [:error] [pid 20763:tid 20779] [client 98.159.43.117:58299] [client 98.159.43.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/wp-login.php"] [unique_id "aZ4XiE0w_zc13OX-xibpSQAAAM4"]
[Wed Feb 25 05:26:33.175938 2026] [:error] [pid 5620:tid 5672] [client 98.159.43.120:49279] [client 98.159.43.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aZ4XiYY2LQjtieeRkoajzAAAAwo"]
[Wed Feb 25 05:26:39.413197 2026] [:error] [pid 5620:tid 5666] [client 98.159.43.132:62517] [client 98.159.43.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.132, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aZ4Xj4Y2LQjtieeRkoaj3gAAAwQ"]
[Wed Feb 25 05:26:40.117811 2026] [:error] [pid 5620:tid 5685] [client 98.159.43.132:62517] [client 98.159.43.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aZ4XkIY2LQjtieeRkoaj4gAAAxQ"]
[Wed Feb 25 05:26:40.360476 2026] [:error] [pid 5556:tid 5589] [client 98.159.43.163:43589] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/network.php"] [unique_id "aZ4XkKOrYeaTyh7lGRUYMQAAAcI"]
[Wed Feb 25 05:26:40.696201 2026] [:error] [pid 60498:tid 60509] [client 98.159.43.112:60841] [client 98.159.43.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aZ4XkCFCVhQ3ffus0uJq5wAAAsQ"]
[Wed Feb 25 05:26:44.059064 2026] [:error] [pid 60498:tid 60520] [client 98.159.43.158:30883] [client 98.159.43.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/php-compat/autoload_classmap.php"] [unique_id "aZ4XlCFCVhQ3ffus0uJq8AAAAs8"]
[Wed Feb 25 05:26:51.336858 2026] [:error] [pid 60498:tid 60511] [client 98.159.43.154:26491] [client 98.159.43.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aZ4XmyFCVhQ3ffus0uJq_AAAAsY"]
[Wed Feb 25 05:26:53.884042 2026] [:error] [pid 5619:tid 5636] [client 98.159.43.123:50747] [client 98.159.43.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aZ4XnZFUzdv-0L_F4fuusQAAAgE"]
[Wed Feb 25 05:26:57.311827 2026] [:error] [pid 5619:tid 5649] [client 98.159.43.154:23209] [client 98.159.43.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "aZ4XoZFUzdv-0L_F4fuuvwAAAg4"]
[Wed Feb 25 05:26:58.482355 2026] [:error] [pid 5619:tid 5657] [client 98.159.43.151:46885] [client 98.159.43.151] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aZ4XopFUzdv-0L_F4fuuwgAAAhY"]
[Wed Feb 25 05:26:59.495484 2026] [:error] [pid 20658:tid 20688] [client 98.159.43.130:30269] [client 98.159.43.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aZ4Xo-u8cohhPfsAIFmmrgAAABU"]
[Wed Feb 25 05:27:00.930640 2026] [:error] [pid 20659:tid 20706] [client 98.159.43.109:38899] [client 98.159.43.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aZ4XpD_THK_HtK-Q44LzxwAAAEs"]
[Wed Feb 25 05:27:02.099204 2026] [:error] [pid 20763:tid 20782] [client 98.159.43.136:37987] [client 98.159.43.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aZ4Xpk0w_zc13OX-xibpTgAAANE"]
[Wed Feb 25 05:27:04.249344 2026] [:error] [pid 60290:tid 60313] [client 98.159.43.109:38993] [client 98.159.43.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aZ4XqDPwSUztcPyiofptQAAAARU"]
[Wed Feb 25 05:27:08.872498 2026] [:error] [pid 60290:tid 60314] [client 98.159.43.142:56043] [client 98.159.43.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aZ4XrDPwSUztcPyiofptSAAAARY"]
[Wed Feb 25 05:27:11.591788 2026] [:error] [pid 5620:tid 5677] [client 98.159.43.147:23837] [client 98.159.43.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aZ4Xr4Y2LQjtieeRkoakAAAAAw8"]
[Wed Feb 25 05:27:12.451465 2026] [proxy_fcgi:error] [pid 5620:tid 5668] [client 98.159.43.133:23377] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function add_action() in /home/expressi/public_html/wp-content/plugins/hello.php:69\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/plugins/hello.php on line 69'
[Wed Feb 25 05:27:12.707692 2026] [:error] [pid 5619:tid 5649] [client 98.159.43.133:60925] [client 98.159.43.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aZ4XsJFUzdv-0L_F4fuu0gAAAg4"]
[Wed Feb 25 05:27:14.550441 2026] [proxy_fcgi:error] [pid 60290:tid 60307] [client 98.159.43.152:31839] AH01071: Got error 'Primary script unknown'
[Wed Feb 25 05:27:16.293768 2026] [:error] [pid 60290:tid 60309] [client 98.159.43.152:31839] [client 98.159.43.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aZ4XtDPwSUztcPyiofptWAAAARE"]
[Wed Feb 25 05:27:27.293697 2026] [:error] [pid 5556:tid 5588] [client 98.159.43.131:24203] [client 98.159.43.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "aZ4Xv6OrYeaTyh7lGRUYeQAAAcE"]
[Wed Feb 25 05:27:27.487876 2026] [:error] [pid 60290:tid 60303] [client 98.159.43.137:34875] [client 98.159.43.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aZ4XvzPwSUztcPyiofptaAAAAQs"]
[Wed Feb 25 05:27:30.133764 2026] [:error] [pid 60387:tid 60483] [client 98.159.43.138:60773] [client 98.159.43.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/index.php"] [unique_id "aZ4XwoHL0QH7Sr13X0Kj8wAAAos"]
[Wed Feb 25 05:27:30.465398 2026] [:error] [pid 20763:tid 20777] [client 98.159.43.132:64669] [client 98.159.43.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aZ4Xwk0w_zc13OX-xibpUwAAAMw"]
[Wed Feb 25 05:27:31.416511 2026] [:error] [pid 5620:tid 5685] [client 98.159.43.121:57025] [client 98.159.43.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/wp-login.php"] [unique_id "aZ4Xw4Y2LQjtieeRkoakMwAAAxQ"]
[Wed Feb 25 05:27:37.636435 2026] [:error] [pid 5619:tid 5646] [client 98.159.43.122:47119] [client 98.159.43.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aZ4XyZFUzdv-0L_F4fuu9wAAAgs"]
[Wed Feb 25 05:27:38.773603 2026] [:error] [pid 60500:tid 60611] [client 98.159.43.150:43243] [client 98.159.43.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aZ4XyvY9avxuno9KAT_76wAAA1g"]
[Wed Feb 25 05:27:40.417546 2026] [:error] [pid 60500:tid 60608] [client 98.159.43.150:43243] [client 98.159.43.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aZ4XzPY9avxuno9KAT_77QAAA1U"]
[Wed Feb 25 05:27:40.681197 2026] [:error] [pid 5556:tid 5606] [client 98.159.43.135:32425] [client 98.159.43.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aZ4XzKOrYeaTyh7lGRUYgQAAAdM"]
[Wed Feb 25 05:27:43.445549 2026] [:error] [pid 20658:tid 20691] [client 98.159.43.117:25059] [client 98.159.43.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/autoload_classmap.php"] [unique_id "aZ4Xz-u8cohhPfsAIFmmzQAAABg"]
[Wed Feb 25 05:27:44.708077 2026] [:error] [pid 5620:tid 5666] [client 98.159.43.153:32667] [client 98.159.43.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rk2.php"] [unique_id "aZ4X0IY2LQjtieeRkoakUwAAAwQ"]
[Wed Feb 25 05:27:47.315737 2026] [proxy_fcgi:error] [pid 5620:tid 5667] [client 98.159.43.161:37315] AH01071: Got error 'Primary script unknown'
[Wed Feb 25 05:27:51.541464 2026] [proxy_fcgi:error] [pid 5620:tid 5685] [client 98.159.43.161:37315] AH01071: Got error 'Primary script unknown'
[Wed Feb 25 05:27:53.512511 2026] [:error] [pid 5620:tid 5682] [client 98.159.43.161:37315] [client 98.159.43.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/plugin.php"] [unique_id "aZ4X2YY2LQjtieeRkoakhgAAAxM"]
[Wed Feb 25 05:27:56.379007 2026] [:error] [pid 5620:tid 5662] [client 98.159.43.153:21953] [client 98.159.43.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/wp-tinymce.php"] [unique_id "aZ4X3IY2LQjtieeRkoakogAAAwA"]
[Wed Feb 25 05:27:59.302330 2026] [:error] [pid 20658:tid 20680] [client 98.159.43.131:34549] [client 98.159.43.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.131, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aZ4X3-u8cohhPfsAIFmm1gAAAA0"]
[Wed Feb 25 05:27:59.308109 2026] [proxy_fcgi:error] [pid 20658:tid 20680] [client 98.159.43.131:34549] AH01071: Got error 'Primary script unknown'
[Wed Feb 25 05:28:03.315929 2026] [:error] [pid 20658:tid 20686] [client 98.159.43.131:34549] [client 98.159.43.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/mah.php"] [unique_id "aZ4X4-u8cohhPfsAIFmm3AAAABM"]
[Wed Feb 25 05:28:03.508585 2026] [:error] [pid 60387:tid 60488] [client 98.159.43.146:44683] [client 98.159.43.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/sunrise/wp-login.php"] [unique_id "aZ4X44HL0QH7Sr13X0KkCQAAApA"]
[Wed Feb 25 05:28:04.544834 2026] [:error] [pid 60387:tid 60489] [client 98.159.43.146:44683] [client 98.159.43.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/lmfi.php"] [unique_id "aZ4X5IHL0QH7Sr13X0KkCwAAApE"]
[Wed Feb 25 05:28:09.784974 2026] [proxy_fcgi:error] [pid 5619:tid 5635] [client 98.159.43.163:33679] AH01071: Got error 'Primary script unknown'
[Wed Feb 25 05:28:11.439112 2026] [:error] [pid 5619:tid 5637] [client 98.159.43.163:33679] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aZ4X65FUzdv-0L_F4fuvNgAAAgI"]
[Wed Feb 25 05:28:13.405171 2026] [:error] [pid 20658:tid 20677] [client 98.159.43.146:20809] [client 98.159.43.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aZ4X7eu8cohhPfsAIFmm6AAAAAo"]
[Wed Feb 25 05:28:14.696199 2026] [:error] [pid 5620:tid 5680] [client 98.159.43.137:31477] [client 98.159.43.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.137, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/light/wp-login.php"] [unique_id "aZ4X7oY2LQjtieeRkoak3AAAAxE"]
[Wed Feb 25 05:28:21.701051 2026] [:error] [pid 5620:tid 5675] [client 98.159.43.137:31477] [client 98.159.43.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/button/index.php"] [unique_id "aZ4X9YY2LQjtieeRkoak-AAAAw0"]
[Wed Feb 25 05:28:22.849644 2026] [:error] [pid 20763:tid 20777] [client 98.159.43.121:33251] [client 98.159.43.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/packed.php"] [unique_id "aZ4X9k0w_zc13OX-xibpYQAAAMw"]
[Wed Feb 25 05:28:29.261500 2026] [:error] [pid 5619:tid 5636] [client 98.159.43.142:57151] [client 98.159.43.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/file.php"] [unique_id "aZ4X_ZFUzdv-0L_F4fuvbQAAAgE"]
[Wed Feb 25 05:28:30.430501 2026] [:error] [pid 5620:tid 5672] [client 98.159.43.163:47751] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "aZ4X_oY2LQjtieeRkoalFAAAAwo"]
[Wed Feb 25 05:28:31.272100 2026] [:error] [pid 60498:tid 60529] [client 98.159.43.163:24435] [client 98.159.43.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "aZ4X_yFCVhQ3ffus0uJrKwAAAtg"]
[Wed Feb 25 05:28:36.017256 2026] [:error] [pid 5619:tid 5643] [client 98.159.43.157:36363] [client 98.159.43.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.157, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/wp-login.php"] [unique_id "aZ4YBJFUzdv-0L_F4fuvdQAAAgg"]
[Wed Feb 25 05:28:36.709324 2026] [:error] [pid 5619:tid 5647] [client 98.159.43.157:36363] [client 98.159.43.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aZ4YBJFUzdv-0L_F4fuvdgAAAgw"]
[Wed Feb 25 05:28:41.767240 2026] [:error] [pid 5620:tid 5682] [client 98.159.43.110:55997] [client 98.159.43.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aZ4YCYY2LQjtieeRkoalSAAAAxM"]
[Wed Feb 25 05:28:42.075449 2026] [:error] [pid 20658:tid 20677] [client 98.159.43.145:47199] [client 98.159.43.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/wp-login.php"] [unique_id "aZ4YCuu8cohhPfsAIFmm8wAAAAo"]
[Wed Feb 25 05:28:46.309045 2026] [proxy_fcgi:error] [pid 5619:tid 5643] [client 98.159.43.142:48847] AH01071: Got error 'Primary script unknown'
[Wed Feb 25 05:28:47.946942 2026] [proxy_fcgi:error] [pid 5619:tid 5652] [client 98.159.43.142:48847] AH01071: Got error 'Primary script unknown'
[Wed Feb 25 05:28:48.078632 2026] [:error] [pid 5619:tid 5638] [client 98.159.43.142:48847] [client 98.159.43.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/function.php"] [unique_id "aZ4YEJFUzdv-0L_F4fuviwAAAgM"]
[Wed Feb 25 05:28:50.833549 2026] [:error] [pid 60498:tid 60517] [client 98.159.43.134:49913] [client 98.159.43.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/votes.php"] [unique_id "aZ4YEiFCVhQ3ffus0uJrOwAAAsw"]
[Wed Feb 25 05:28:56.076568 2026] [proxy_fcgi:error] [pid 5556:tid 5599] [client 98.159.43.153:55865] AH01071: Got error 'Primary script unknown'
[Wed Feb 25 05:28:56.936355 2026] [:error] [pid 5556:tid 5600] [client 98.159.43.153:55865] [client 98.159.43.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/file.php"] [unique_id "aZ4YGKOrYeaTyh7lGRUYvQAAAc0"]
[Wed Feb 25 05:29:00.090948 2026] [:error] [pid 20658:tid 20681] [client 98.159.43.160:23429] [client 98.159.43.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/parx.php"] [unique_id "aZ4YHOu8cohhPfsAIFmnDwAAAA4"]
[Wed Feb 25 05:29:07.214791 2026] [proxy_fcgi:error] [pid 60498:tid 60510] [client 98.159.43.146:34273] AH01071: Got error 'Primary script unknown'
[Wed Feb 25 05:29:07.315996 2026] [:error] [pid 60498:tid 60514] [client 98.159.43.146:34273] [client 98.159.43.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/components/about.php"] [unique_id "aZ4YIyFCVhQ3ffus0uJrVAAAAsk"]
[Wed Feb 25 05:29:07.535968 2026] [proxy_fcgi:error] [pid 20659:tid 20698] [client 98.159.43.150:32425] AH01071: Got error 'Primary script unknown'
[Wed Feb 25 05:29:10.316105 2026] [proxy_fcgi:error] [pid 20659:tid 20710] [client 98.159.43.150:32425] AH01071: Got error 'PHP message: PHP Warning:  Use of undefined constant ABSPATH - assumed 'ABSPATH' (this will throw an Error in a future version of PHP) in /home/expressi/public_html/wp-settings.php on line 34PHP message: PHP Warning:  require(ABSPATHwp-includes/version.php): failed to open stream: No such file or directory in /home/expressi/public_html/wp-settings.php on line 34PHP message: PHP Warning:  require(ABSPATHwp-includes/version.php): failed to open stream: No such file or directory in /home/expressi/public_html/wp-settings.php on line 34PHP message: PHP Fatal error:  require(): Failed opening required 'ABSPATHwp-includes/version.php' (include_path='.:') in /home/expressi/public_html/wp-settings.php on line 34'
[Wed Feb 25 05:29:10.500247 2026] [:error] [pid 20658:tid 20675] [client 98.159.43.150:51775] [client 98.159.43.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aZ4YJuu8cohhPfsAIFmnIQAAAAg"]
[Wed Feb 25 05:29:17.420917 2026] [:error] [pid 5620:tid 5670] [client 98.159.43.161:51203] [client 98.159.43.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/item.php"] [unique_id "aZ4YLYY2LQjtieeRkoal0AAAAwg"]
[Wed Feb 25 05:29:22.191363 2026] [:error] [pid 5619:tid 5651] [client 98.159.43.131:43965] [client 98.159.43.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.131, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/.well-known/pki-validation/wp-login.php"] [unique_id "aZ4YMpFUzdv-0L_F4fuvwQAAAhA"]
[Wed Feb 25 05:29:22.976363 2026] [:error] [pid 5619:tid 5652] [client 98.159.43.131:43965] [client 98.159.43.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.131, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aZ4YMpFUzdv-0L_F4fuvwgAAAhE"]
[Wed Feb 25 05:29:23.749053 2026] [:error] [pid 5619:tid 5659] [client 98.159.43.131:43965] [client 98.159.43.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/mani.php"] [unique_id "aZ4YM5FUzdv-0L_F4fuvwwAAAhg"]
[Wed Feb 25 05:29:31.680282 2026] [:error] [pid 5619:tid 5635] [client 98.159.43.140:53099] [client 98.159.43.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/network.php"] [unique_id "aZ4YO5FUzdv-0L_F4fuvzgAAAgA"]
[Wed Feb 25 05:29:33.760924 2026] [:error] [pid 5619:tid 5637] [client 98.159.43.129:51827] [client 98.159.43.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/defaults.php"] [unique_id "aZ4YPZFUzdv-0L_F4fuv0QAAAgI"]
[Wed Feb 25 05:29:37.275579 2026] [proxy_fcgi:error] [pid 5556:tid 5602] [client 98.159.43.107:32037] AH01071: Got error 'Primary script unknown'
[Wed Feb 25 05:29:39.235248 2026] [proxy_fcgi:error] [pid 5556:tid 5601] [client 98.159.43.107:32037] AH01071: Got error 'Primary script unknown'
[Wed Feb 25 05:29:39.995358 2026] [:error] [pid 5556:tid 5596] [client 98.159.43.107:32037] [client 98.159.43.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aZ4YQ6OrYeaTyh7lGRUY8gAAAck"]
[Wed Feb 25 05:29:40.324514 2026] [:error] [pid 60290:tid 60304] [client 98.159.43.150:39761] [client 98.159.43.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/about.php"] [unique_id "aZ4YRDPwSUztcPyiofptwwAAAQw"]
[Wed Feb 25 05:29:43.984010 2026] [:error] [pid 60290:tid 60307] [client 98.159.43.160:20481] [client 98.159.43.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/wp-login.php"] [unique_id "aZ4YRzPwSUztcPyiofptzAAAAQ8"]
[Wed Feb 25 05:29:47.051546 2026] [:error] [pid 60290:tid 60302] [client 98.159.43.160:20481] [client 98.159.43.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/file.php"] [unique_id "aZ4YSzPwSUztcPyiofpt0gAAAQo"]
[Wed Feb 25 05:29:47.940857 2026] [:error] [pid 20658:tid 20669] [client 98.159.43.109:47417] [client 98.159.43.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/xBrain.php"] [unique_id "aZ4YS-u8cohhPfsAIFmnRwAAAAI"]
[Wed Feb 25 05:29:48.205683 2026] [:error] [pid 5620:tid 5664] [client 98.159.43.138:26057] [client 98.159.43.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aZ4YTIY2LQjtieeRkoamUgAAAwI"]
[Wed Feb 25 05:29:49.358249 2026] [:error] [pid 5620:tid 5675] [client 98.159.43.107:63355] [client 98.159.43.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aZ4YTYY2LQjtieeRkoamYQAAAw0"]
[Wed Feb 25 05:29:55.270729 2026] [proxy_fcgi:error] [pid 60290:tid 60301] [client 98.159.43.158:60055] AH01071: Got error 'Primary script unknown'
[Wed Feb 25 05:29:56.272184 2026] [:error] [pid 60290:tid 60295] [client 98.159.43.158:60055] [client 98.159.43.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/widgets/about.php"] [unique_id "aZ4YVDPwSUztcPyiofpt3wAAAQM"]
[Wed Feb 25 05:29:57.429494 2026] [proxy_fcgi:error] [pid 60290:tid 60305] [client 98.159.43.152:30851] AH01071: Got error 'Primary script unknown'
[Wed Feb 25 05:30:07.143562 2026] [:error] [pid 60290:tid 60292] [client 98.159.43.152:30851] [client 98.159.43.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/radio.php"] [unique_id "aZ4YXzPwSUztcPyiofpt-gAAAQA"]
[Wed Feb 25 05:30:14.729948 2026] [:error] [pid 60498:tid 60510] [client 98.159.43.158:51101] [client 98.159.43.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/src/Core/Curve25519/Ge/wp_blog.php"] [unique_id "aZ4YZiFCVhQ3ffus0uJrhwAAAsU"]
[Wed Feb 25 05:30:19.496578 2026] [:error] [pid 60290:tid 60292] [client 98.159.43.120:36791] [client 98.159.43.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aZ4YazPwSUztcPyiofpuGAAAAQA"]
[Wed Feb 25 05:30:20.742534 2026] [:error] [pid 5619:tid 5638] [client 98.159.43.160:26533] [client 98.159.43.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/fonts/index.php"] [unique_id "aZ4YbJFUzdv-0L_F4fuwIAAAAgM"]
[Wed Feb 25 05:30:27.156015 2026] [:error] [pid 20658:tid 20686] [client 98.159.43.112:45765] [client 98.159.43.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/compat3x/css/index.php"] [unique_id "aZ4Yc-u8cohhPfsAIFmnYgAAABM"]
[Wed Feb 25 05:30:27.426512 2026] [:error] [pid 5620:tid 5665] [client 98.159.43.147:20163] [client 98.159.43.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aZ4Yc4Y2LQjtieeRkoam6gAAAwM"]
[Wed Feb 25 05:30:29.382996 2026] [:error] [pid 5620:tid 5662] [client 98.159.43.142:41271] [client 98.159.43.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/random_compat/about.php"] [unique_id "aZ4YdYY2LQjtieeRkoam-QAAAwA"]
[Wed Feb 25 05:30:53.381354 2026] [proxy_fcgi:error] [pid 5620:tid 5688] [client 98.159.43.122:24831] AH01071: Got error 'Primary script unknown'
[Wed Feb 25 05:30:54.281487 2026] [:error] [pid 5620:tid 5674] [client 98.159.43.122:24831] [client 98.159.43.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/include.php"] [unique_id "aZ4YjoY2LQjtieeRkoanoQAAAww"]
[Wed Feb 25 05:31:03.401962 2026] [:error] [pid 5620:tid 5698] [client 98.159.43.136:21763] [client 98.159.43.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/css.php"] [unique_id "aZ4Yl4Y2LQjtieeRkoan9gAAAxc"]
[Wed Feb 25 05:31:14.199321 2026] [:error] [pid 5556:tid 5595] [client 98.159.43.130:38483] [client 98.159.43.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wso112233.php"] [unique_id "aZ4YoqOrYeaTyh7lGRUZeAAAAcg"]
[Wed Feb 25 05:31:14.427348 2026] [:error] [pid 5620:tid 5667] [client 98.159.43.147:31745] [client 98.159.43.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/shell20211028.php"] [unique_id "aZ4YooY2LQjtieeRkoaoFQAAAwU"]
[Wed Feb 25 05:31:16.518700 2026] [:error] [pid 5619:tid 5636] [client 98.159.43.107:21533] [client 98.159.43.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/dropdown.php"] [unique_id "aZ4YpJFUzdv-0L_F4fuwsQAAAgE"]
[Wed Feb 25 05:31:17.727671 2026] [:error] [pid 60500:tid 60608] [client 98.159.43.129:56339] [client 98.159.43.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/repeater.php"] [unique_id "aZ4YpfY9avxuno9KAT_8KAAAA1U"]
[Wed Feb 25 05:31:30.252734 2026] [:error] [pid 5556:tid 5608] [client 98.159.43.122:64573] [client 98.159.43.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/test.php"] [unique_id "aZ4YsqOrYeaTyh7lGRUZmgAAAdU"]
[Wed Feb 25 05:31:30.459439 2026] [:error] [pid 20658:tid 20690] [client 98.159.43.142:34009] [client 98.159.43.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "aZ4Ysuu8cohhPfsAIFmnkwAAABc"]
[Wed Feb 25 05:31:31.673140 2026] [:error] [pid 60498:tid 60507] [client 98.159.43.145:51171] [client 98.159.43.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/options.php"] [unique_id "aZ4YsyFCVhQ3ffus0uJr4gAAAsI"]
[Wed Feb 25 05:31:34.026318 2026] [:error] [pid 5620:tid 5673] [client 98.159.43.134:37741] [client 98.159.43.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/gzdecode.php"] [unique_id "aZ4YtoY2LQjtieeRkoaovgAAAws"]
[Wed Feb 25 05:31:34.287637 2026] [:error] [pid 5619:tid 5641] [client 98.159.43.149:55891] [client 98.159.43.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-includes/atomlib.php"] [unique_id "aZ4YtpFUzdv-0L_F4fuw2QAAAgY"]
[Wed Feb 25 05:31:36.175681 2026] [:error] [pid 5619:tid 5635] [client 98.159.43.152:37089] [client 98.159.43.152] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.152, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/images/wp-login.php"] [unique_id "aZ4YuJFUzdv-0L_F4fuw5AAAAgA"]
[Wed Feb 25 05:31:39.233179 2026] [:error] [pid 5619:tid 5655] [client 98.159.43.152:37089] [client 98.159.43.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/plupload/wp-login.php"] [unique_id "aZ4Yu5FUzdv-0L_F4fuw7QAAAhQ"]
[Wed Feb 25 05:31:42.748511 2026] [:error] [pid 5619:tid 5640] [client 98.159.43.161:32621] [client 98.159.43.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/themes.php"] [unique_id "aZ4YvpFUzdv-0L_F4fuw-wAAAgU"]
[Wed Feb 25 05:31:42.989974 2026] [:error] [pid 5619:tid 5659] [client 98.159.43.139:65359] [client 98.159.43.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/site-title/index.php"] [unique_id "aZ4YvpFUzdv-0L_F4fuw_gAAAhg"]
[Wed Feb 25 05:31:43.226933 2026] [proxy_fcgi:error] [pid 5619:tid 5645] [client 98.159.43.145:36069] AH01071: Got error 'Primary script unknown'
[Wed Feb 25 05:31:43.326949 2026] [:error] [pid 5619:tid 5636] [client 98.159.43.145:36069] [client 98.159.43.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.145, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/wp-login.php"] [unique_id "aZ4Yv5FUzdv-0L_F4fuxBAAAAgE"]
[Wed Feb 25 05:31:44.958911 2026] [:error] [pid 5619:tid 5638] [client 98.159.43.145:36069] [client 98.159.43.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-includes/admin-bar.php"] [unique_id "aZ4YwJFUzdv-0L_F4fuxCAAAAgM"]
[Wed Feb 25 05:31:50.703406 2026] [:error] [pid 60387:tid 60482] [client 98.159.43.161:21021] [client 98.159.43.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/plugins.php"] [unique_id "aZ4YxoHL0QH7Sr13X0KkPQAAAoo"]
[Wed Feb 25 05:32:24.940697 2026] [:error] [pid 60498:tid 60524] [client 98.159.43.117:55135] [client 98.159.43.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.117, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aZ4Y6CFCVhQ3ffus0uJsJgAAAtM"]
[Wed Feb 25 05:32:28.335942 2026] [:error] [pid 60498:tid 60515] [client 98.159.43.117:55135] [client 98.159.43.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.117, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/.tmb/wp-login.php"] [unique_id "aZ4Y7CFCVhQ3ffus0uJsKwAAAso"]
[Wed Feb 25 05:32:30.921211 2026] [:error] [pid 60498:tid 60522] [client 98.159.43.117:55135] [client 98.159.43.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aZ4Y7iFCVhQ3ffus0uJsLgAAAtE"]
[Wed Feb 25 05:32:31.296749 2026] [:error] [pid 5619:tid 5651] [client 98.159.43.139:33413] [client 98.159.43.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/wp-login.php"] [unique_id "aZ4Y75FUzdv-0L_F4fuxhwAAAhA"]
[Wed Feb 25 05:32:31.523538 2026] [:error] [pid 5619:tid 5638] [client 98.159.43.157:41825] [client 98.159.43.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/install.php"] [unique_id "aZ4Y75FUzdv-0L_F4fuxiAAAAgM"]
[Wed Feb 25 05:32:41.052296 2026] [:error] [pid 5619:tid 5649] [client 98.159.43.117:58347] [client 98.159.43.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.117, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/modules/karakaroa/wp-login.php"] [unique_id "aZ4Y-ZFUzdv-0L_F4fuxrwAAAg4"]
[Wed Feb 25 05:32:41.862365 2026] [:error] [pid 5619:tid 5642] [client 98.159.43.117:58347] [client 98.159.43.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aZ4Y-ZFUzdv-0L_F4fuxswAAAgc"]
[Wed Feb 25 05:32:43.906923 2026] [:error] [pid 60290:tid 60297] [client 98.159.43.116:35223] [client 98.159.43.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aZ4Y-zPwSUztcPyiofpuogAAAQU"]
[Wed Feb 25 05:32:56.269304 2026] [:error] [pid 60290:tid 60312] [client 98.159.43.116:35223] [client 98.159.43.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/editor/fxp.php"] [unique_id "aZ4ZCDPwSUztcPyiofpuwwAAARQ"]
[Wed Feb 25 05:33:06.060667 2026] [:error] [pid 60500:tid 60603] [client 98.159.43.109:46653] [client 98.159.43.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aZ4ZEvY9avxuno9KAT_8WwAAA1A"]
[Wed Feb 25 05:33:17.416010 2026] [:error] [pid 5619:tid 5640] [client 98.159.43.136:61887] [client 98.159.43.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.43.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aZ4ZHZFUzdv-0L_F4fuyLwAAAgU"]
[Wed Feb 25 05:33:27.898968 2026] [autoindex:error] [pid 5619:tid 5641] [client 98.159.43.136:61887] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:33:28.814752 2026] [autoindex:error] [pid 5619:tid 5642] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:33:31.171556 2026] [autoindex:error] [pid 5619:tid 5636] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:33:32.057427 2026] [autoindex:error] [pid 5619:tid 5658] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:33:32.159446 2026] [autoindex:error] [pid 5619:tid 5644] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:33:32.308872 2026] [autoindex:error] [pid 5619:tid 5652] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:33:32.424365 2026] [autoindex:error] [pid 5619:tid 5653] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:33:32.551864 2026] [autoindex:error] [pid 5619:tid 5659] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:33:32.750369 2026] [autoindex:error] [pid 5619:tid 5639] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:33:32.865712 2026] [autoindex:error] [pid 5619:tid 5646] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:33:32.974729 2026] [autoindex:error] [pid 5619:tid 5656] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:33:33.106348 2026] [autoindex:error] [pid 5619:tid 5635] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:33:36.800712 2026] [autoindex:error] [pid 5619:tid 5654] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:33:57.282056 2026] [autoindex:error] [pid 5619:tid 5653] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:33:57.447148 2026] [autoindex:error] [pid 5619:tid 5648] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:33:57.593683 2026] [autoindex:error] [pid 5619:tid 5635] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:33:57.720173 2026] [autoindex:error] [pid 5619:tid 5647] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:33:57.882859 2026] [autoindex:error] [pid 5619:tid 5636] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:33:58.021151 2026] [autoindex:error] [pid 5619:tid 5641] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:33:58.124974 2026] [autoindex:error] [pid 5619:tid 5639] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:33:59.640740 2026] [autoindex:error] [pid 5619:tid 5653] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:33:59.778735 2026] [autoindex:error] [pid 5619:tid 5656] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:00.714589 2026] [autoindex:error] [pid 5619:tid 5658] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:01.630618 2026] [autoindex:error] [pid 5619:tid 5652] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:01.772103 2026] [autoindex:error] [pid 5619:tid 5655] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:01.907500 2026] [autoindex:error] [pid 5619:tid 5649] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:02.716674 2026] [autoindex:error] [pid 5619:tid 5639] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:02.815881 2026] [autoindex:error] [pid 5619:tid 5641] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:02.996284 2026] [autoindex:error] [pid 5619:tid 5643] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:03.120502 2026] [autoindex:error] [pid 5619:tid 5657] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:03.222511 2026] [autoindex:error] [pid 5619:tid 5658] [client 98.159.43.136:61887] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:24.451762 2026] [autoindex:error] [pid 5620:tid 5678] [client 98.159.43.119:59429] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:32.626554 2026] [autoindex:error] [pid 5620:tid 5673] [client 98.159.43.119:59429] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:36.962651 2026] [autoindex:error] [pid 5620:tid 5665] [client 98.159.43.119:59429] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:37.100913 2026] [autoindex:error] [pid 5620:tid 5688] [client 98.159.43.119:59429] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:39.355367 2026] [autoindex:error] [pid 5620:tid 5681] [client 98.159.43.119:59429] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:39.512719 2026] [autoindex:error] [pid 5620:tid 5664] [client 98.159.43.119:59429] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:39.618904 2026] [autoindex:error] [pid 5620:tid 5669] [client 98.159.43.119:59429] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:39.767759 2026] [autoindex:error] [pid 5620:tid 5662] [client 98.159.43.119:59429] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:39.892761 2026] [autoindex:error] [pid 5620:tid 5675] [client 98.159.43.119:59429] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:40.016384 2026] [autoindex:error] [pid 5620:tid 5694] [client 98.159.43.119:59429] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:40.184846 2026] [autoindex:error] [pid 5620:tid 5678] [client 98.159.43.119:59429] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:40.296063 2026] [autoindex:error] [pid 5620:tid 5681] [client 98.159.43.119:59429] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:40.425746 2026] [autoindex:error] [pid 5620:tid 5664] [client 98.159.43.119:59429] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:40.560590 2026] [autoindex:error] [pid 5620:tid 5668] [client 98.159.43.119:59429] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:46.805127 2026] [autoindex:error] [pid 5620:tid 5670] [client 98.159.43.119:59429] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:54.996189 2026] [autoindex:error] [pid 5620:tid 5678] [client 98.159.43.119:59429] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:34:55.139107 2026] [autoindex:error] [pid 5620:tid 5682] [client 98.159.43.119:59429] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:35:06.284544 2026] [autoindex:error] [pid 5620:tid 5675] [client 98.159.43.119:59429] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/paste/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:35:07.894022 2026] [autoindex:error] [pid 5620:tid 5678] [client 98.159.43.119:59429] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:35:11.510553 2026] [autoindex:error] [pid 5619:tid 5646] [client 98.159.43.137:50937] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:35:12.414472 2026] [autoindex:error] [pid 5619:tid 5641] [client 98.159.43.137:50937] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:35:14.065765 2026] [autoindex:error] [pid 5619:tid 5658] [client 98.159.43.137:50937] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/directionality/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:35:14.901203 2026] [autoindex:error] [pid 5619:tid 5656] [client 98.159.43.137:50937] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/search/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:35:15.003619 2026] [autoindex:error] [pid 5619:tid 5655] [client 98.159.43.137:50937] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/compat3x/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:35:15.974653 2026] [autoindex:error] [pid 5619:tid 5640] [client 98.159.43.137:50937] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:35:16.825668 2026] [autoindex:error] [pid 5619:tid 5639] [client 98.159.43.137:50937] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:35:17.626166 2026] [autoindex:error] [pid 5619:tid 5653] [client 98.159.43.137:50937] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:35:17.744914 2026] [autoindex:error] [pid 5619:tid 5641] [client 98.159.43.137:50937] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/classic-editor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:35:17.910454 2026] [proxy_fcgi:error] [pid 5619:tid 5643] [client 98.159.43.137:50937] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_header() in /home/expressi/public_html/wp-content/themes/twentytwentyone/index.php:17\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/themes/twentytwentyone/index.php on line 17'
[Wed Feb 25 05:35:20.014909 2026] [autoindex:error] [pid 5556:tid 5591] [client 98.159.43.116:20055] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:35:25.201131 2026] [autoindex:error] [pid 5556:tid 5602] [client 98.159.43.116:20055] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/paragraph/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:35:29.509549 2026] [autoindex:error] [pid 5556:tid 5590] [client 98.159.43.116:20055] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/nux/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:35:30.469789 2026] [autoindex:error] [pid 5556:tid 5611] [client 98.159.43.116:20055] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/lists/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:35:30.582193 2026] [autoindex:error] [pid 5556:tid 5600] [client 98.159.43.116:20055] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:35:57.104109 2026] [autoindex:error] [pid 5556:tid 5592] [client 98.159.43.116:20055] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:35:58.780335 2026] [autoindex:error] [pid 5556:tid 5595] [client 98.159.43.116:20055] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/social-links/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 05:36:13.210804 2026] [autoindex:error] [pid 5556:tid 5610] [client 98.159.43.116:20055] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/src/Core/Curve25519/Ge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Feb 25 10:33:42.692750 2026] [:error] [pid 20763:tid 20781] [client 43.130.141.193:60046] [client 43.130.141.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZ5fhk0w_zc13OX-xib7uAAAANA"]
[Wed Feb 25 10:47:17.868651 2026] [:error] [pid 60498:tid 60506] [client 103.251.244.118:56209] [client 103.251.244.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.251.244.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ5itSFCVhQ3ffus0uKyEQAAAsE"]
[Wed Feb 25 13:45:40.542712 2026] [:error] [pid 60498:tid 60506] [client 43.130.78.203:36444] [client 43.130.78.203] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZ6MhCFCVhQ3ffus0uLZpwAAAsE"]
[Wed Feb 25 15:49:46.720677 2026] [:error] [pid 5619:tid 5651] [client 43.130.3.120:53060] [client 43.130.3.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZ6pmpFUzdv-0L_F4fsmewAAAhA"]
[Wed Feb 25 15:55:56.448043 2026] [:error] [pid 5556:tid 5593] [client 45.154.138.237:55379] [client 45.154.138.237] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/HEAD"] [unique_id "aZ6rDKOrYeaTyh7lGRXv8gAAAcY"]
[Wed Feb 25 17:13:08.924250 2026] [:error] [pid 5556:tid 5598] [client 106.54.62.156:36128] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZ69JKOrYeaTyh7lGRUMdAAAAcs"]
[Wed Feb 25 19:35:32.359567 2026] [:error] [pid 60387:tid 60495] [client 98.96.235.137:26265] [client 98.96.235.137] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.expressinteriors.com|F|2"] [data "TX:0=application/zip"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZ7ehIHL0QH7Sr13X0JjYgAAApc"]
[Wed Feb 25 19:35:34.134195 2026] [:error] [pid 60387:tid 60483] [client 98.96.235.137:26265] [client 98.96.235.137] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.expressinteriors.com|F|2"] [data "TX:0=application/zip"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZ7ehoHL0QH7Sr13X0JjZQAAAos"]
[Wed Feb 25 20:46:04.507468 2026] [:error] [pid 60290:tid 60314] [client 185.149.22.52:48085] [client 185.149.22.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.149.22.52, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ7vDDPwSUztcPyiofqxhAAAARY"], referer: https://expressinteriors.com/
[Wed Feb 25 20:46:06.405060 2026] [:error] [pid 20763:tid 20777] [client 185.149.22.52:34579] [client 185.149.22.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.149.22.52, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ7vDk0w_zc13OX-xiYj1QAAAMw"], referer: https://expressinteriors.com/wp-login.php?action=register
[Wed Feb 25 21:07:31.607847 2026] [:error] [pid 20658:tid 20687] [client 43.153.104.196:55690] [client 43.153.104.196] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZ70E-u8cohhPfsAIFn9ogAAABQ"]
[Wed Feb 25 21:17:20.072128 2026] [autoindex:error] [pid 60387:tid 60485] [client 139.59.24.163:53043] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Feb 25 22:56:27.291776 2026] [:error] [pid 20659:tid 20695] [client 195.178.110.28:33840] [client 195.178.110.28] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aZ8Nmz_THK_HtK-Q44JQ2QAAAEA"]
[Wed Feb 25 23:45:35.271179 2026] [:error] [pid 20659:tid 20696] [client 86.33.75.90:29094] [client 86.33.75.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.33.75.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ8ZHz_THK_HtK-Q44JbsgAAAEE"]
[Wed Feb 25 23:45:39.059621 2026] [:error] [pid 20658:tid 20678] [client 203.147.140.128:15054] [client 203.147.140.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.147.140.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ8ZI-u8cohhPfsAIFkMUQAAAAs"]
[Wed Feb 25 23:45:48.709043 2026] [:error] [pid 5619:tid 5651] [client 20.104.206.236:16359] [client 20.104.206.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZ8ZLJFUzdv-0L_F4ftm9AAAAhA"]
[Wed Feb 25 23:45:49.755106 2026] [:error] [pid 20659:tid 20708] [client 20.104.206.236:16338] [client 20.104.206.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZ8ZLT_THK_HtK-Q44JbtwAAAE0"]
[Wed Feb 25 23:45:51.371260 2026] [:error] [pid 20659:tid 20701] [client 20.104.206.236:16355] [client 20.104.206.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZ8ZLz_THK_HtK-Q44JbuQAAAEY"]
[Wed Feb 25 23:45:52.907228 2026] [:error] [pid 5556:tid 5598] [client 20.104.206.236:16342] [client 20.104.206.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZ8ZMKOrYeaTyh7lGRW7HwAAAcs"]
[Wed Feb 25 23:48:44.248158 2026] [:error] [pid 60498:tid 60520] [client 86.33.75.90:13667] [client 86.33.75.90] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aZ8Z3CFCVhQ3ffus0uJSNgAAAs8"]
[Wed Feb 25 23:50:29.230619 2026] [:error] [pid 5619:tid 5654] [client 86.33.75.90:58132] [client 86.33.75.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.33.75.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ8aRZFUzdv-0L_F4ftnagAAAhM"]
[Wed Feb 25 23:51:56.486607 2026] [:error] [pid 5556:tid 5600] [client 86.33.75.90:53612] [client 86.33.75.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.33.75.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ8anKOrYeaTyh7lGRW9fgAAAc0"]
[Wed Feb 25 23:53:13.529802 2026] [:error] [pid 60500:tid 60606] [client 86.33.75.90:65127] [client 86.33.75.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.33.75.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ8a6fY9avxuno9KAT9okQAAA1M"]
[Wed Feb 25 23:54:34.695019 2026] [:error] [pid 5619:tid 5642] [client 86.33.75.90:41116] [client 86.33.75.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.33.75.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ8bOpFUzdv-0L_F4ftoJQAAAgc"]
[Thu Feb 26 00:09:03.451758 2026] [:error] [pid 5556:tid 5592] [client 43.156.202.34:58526] [client 43.156.202.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZ8en6OrYeaTyh7lGRXD4QAAAcU"]
[Thu Feb 26 00:37:58.060108 2026] [:error] [pid 49554:tid 49628] [client 45.94.31.242:58634] [client 45.94.31.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "aZ8lZttlDT3cCGsQMTcjlAAAABM"]
[Thu Feb 26 00:37:58.856097 2026] [:error] [pid 49555:tid 49675] [client 45.94.31.242:55830] [client 45.94.31.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "aZ8lZtw3_NsD2xC15YbBBwAAAEw"]
[Thu Feb 26 00:37:59.492284 2026] [:error] [pid 49555:tid 49687] [client 45.94.31.242:63303] [client 45.94.31.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "aZ8lZ9w3_NsD2xC15YbBCwAAAFg"]
[Thu Feb 26 00:38:02.820779 2026] [:error] [pid 49770:tid 49830] [client 45.94.31.242:59225] [client 45.94.31.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "aZ8lai7xhdZV4TFeNysiKgAAAIQ"]
[Thu Feb 26 02:36:55.104542 2026] [:error] [pid 49554:tid 49622] [client 43.133.139.6:44014] [client 43.133.139.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZ9BR9tlDT3cCGsQMTdG6QAAAA0"]
[Thu Feb 26 02:39:15.255792 2026] [:error] [pid 49554:tid 49611] [client 136.112.114.101:54963] [client 136.112.114.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.114.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ9B09tlDT3cCGsQMTdHXwAAAAI"]
[Thu Feb 26 02:39:17.374203 2026] [:error] [pid 49554:tid 49618] [client 136.112.114.101:54963] [client 136.112.114.101] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aZ9B1dtlDT3cCGsQMTdHYgAAAAk"]
[Thu Feb 26 02:39:17.594785 2026] [:error] [pid 49554:tid 49614] [client 136.112.114.101:54963] [client 136.112.114.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.114.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ9B1dtlDT3cCGsQMTdHYwAAAAU"]
[Thu Feb 26 02:39:19.046462 2026] [:error] [pid 49554:tid 49619] [client 136.112.114.101:64113] [client 136.112.114.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.114.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ9B19tlDT3cCGsQMTdHZgAAAAo"]
[Thu Feb 26 02:39:20.455475 2026] [:error] [pid 49770:tid 49837] [client 136.112.114.101:50504] [client 136.112.114.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.114.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ9B2C7xhdZV4TFeNyuCygAAAIs"]
[Thu Feb 26 02:39:21.842687 2026] [:error] [pid 49556:tid 49654] [client 136.112.114.101:65013] [client 136.112.114.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.114.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ9B2Zjk27yQt3CGcmihTwAAAM8"]
[Thu Feb 26 02:39:23.260504 2026] [:error] [pid 49770:tid 49843] [client 136.112.114.101:61987] [client 136.112.114.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.114.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ9B2y7xhdZV4TFeNyuC0gAAAJE"]
[Thu Feb 26 02:39:23.260683 2026] [:error] [pid 49770:tid 49843] [client 136.112.114.101:61987] [client 136.112.114.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 136.112.114.101, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ9B2y7xhdZV4TFeNyuC0gAAAJE"]
[Thu Feb 26 04:21:19.459478 2026] [:error] [pid 9589:tid 9668] [client 20.104.251.200:2613] [client 20.104.251.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZ9Zv6BuBxYiI1p-njSniwAAAI8"]
[Thu Feb 26 04:21:19.870340 2026] [:error] [pid 9702:tid 9712] [client 20.104.251.200:2573] [client 20.104.251.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZ9Zv5vL1wp7EOGdeswqVQAAAMY"]
[Thu Feb 26 04:21:20.298386 2026] [:error] [pid 9589:tid 9674] [client 20.104.251.200:2597] [client 20.104.251.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZ9ZwKBuBxYiI1p-njSnkQAAAJU"]
[Thu Feb 26 04:21:20.718157 2026] [:error] [pid 9702:tid 9714] [client 20.104.251.200:2571] [client 20.104.251.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aZ9ZwJvL1wp7EOGdeswqVwAAAMg"]
[Thu Feb 26 05:02:20.083642 2026] [:error] [pid 6071:tid 6085] [client 23.251.48.87:52504] [client 23.251.48.87] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZ9jXIQfAzdrpgft075FsQAAAQs"]
[Thu Feb 26 06:10:09.420891 2026] [:error] [pid 17651:tid 17672] [client 203.147.140.128:4775] [client 203.147.140.128] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aZ9zQZ5mQDz5cec8gk49PwAAAVM"]
[Thu Feb 26 06:11:46.593296 2026] [:error] [pid 9587:tid 9601] [client 203.147.140.128:1355] [client 203.147.140.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.147.140.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ9zoviLfyuakov_VlBXwwAAAAQ"]
[Thu Feb 26 06:13:17.988133 2026] [:error] [pid 6071:tid 6090] [client 203.147.140.128:4743] [client 203.147.140.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.147.140.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ9z_YQfAzdrpgft075jXwAAARA"]
[Thu Feb 26 06:13:17.989975 2026] [:error] [pid 6071:tid 6090] [client 203.147.140.128:4743] [client 203.147.140.128] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ9z_YQfAzdrpgft075jXwAAARA"]
[Thu Feb 26 06:13:17.991400 2026] [:error] [pid 6071:tid 6090] [client 203.147.140.128:4743] [client 203.147.140.128] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ9z_YQfAzdrpgft075jXwAAARA"]
[Thu Feb 26 06:14:20.622211 2026] [:error] [pid 6071:tid 6088] [client 4.205.17.183:30658] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x123.php"] [unique_id "aZ90PIQfAzdrpgft075j5QAAAQ4"]
[Thu Feb 26 06:14:21.051562 2026] [:error] [pid 6071:tid 6090] [client 4.205.17.183:30603] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x123.php"] [unique_id "aZ90PYQfAzdrpgft075j5wAAARA"]
[Thu Feb 26 06:14:21.468403 2026] [:error] [pid 9589:tid 9662] [client 4.205.17.183:30703] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x123.php"] [unique_id "aZ90PaBuBxYiI1p-njTa_QAAAIk"]
[Thu Feb 26 06:14:21.886505 2026] [:error] [pid 6071:tid 6079] [client 4.205.17.183:30672] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x123.php"] [unique_id "aZ90PYQfAzdrpgft075j6wAAAQU"]
[Thu Feb 26 06:14:22.314211 2026] [:error] [pid 9589:tid 9674] [client 4.205.17.183:30609] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aZ90PqBuBxYiI1p-njTbAQAAAJU"]
[Thu Feb 26 06:14:22.736198 2026] [:error] [pid 9702:tid 9723] [client 4.205.17.183:30641] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aZ90PpvL1wp7EOGdesxW3wAAANE"]
[Thu Feb 26 06:14:23.172150 2026] [:error] [pid 6071:tid 6095] [client 4.205.17.183:30607] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aZ90P4QfAzdrpgft075j7QAAARU"]
[Thu Feb 26 06:14:23.601280 2026] [:error] [pid 9587:tid 9609] [client 4.205.17.183:30686] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aZ90P_iLfyuakov_VlBaHwAAAAw"]
[Thu Feb 26 06:14:24.025546 2026] [:error] [pid 9702:tid 9721] [client 4.205.17.183:30592] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moshou.php"] [unique_id "aZ90QJvL1wp7EOGdesxW4gAAAM8"]
[Thu Feb 26 06:14:24.479147 2026] [:error] [pid 9587:tid 9613] [client 4.205.17.183:30708] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moshou.php"] [unique_id "aZ90QPiLfyuakov_VlBaJAAAABA"]
[Thu Feb 26 06:14:24.893386 2026] [:error] [pid 9588:tid 9633] [client 4.205.17.183:30658] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moshou.php"] [unique_id "aZ90QOSfsVC0YxizsTvOmQAAAEc"]
[Thu Feb 26 06:14:25.315943 2026] [:error] [pid 6071:tid 6081] [client 4.205.17.183:30674] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moshou.php"] [unique_id "aZ90QYQfAzdrpgft075j8gAAAQc"]
[Thu Feb 26 06:14:25.738608 2026] [:error] [pid 17651:tid 17665] [client 4.205.17.183:30711] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/seetox.php"] [unique_id "aZ90QZ5mQDz5cec8gk4-7AAAAUw"]
[Thu Feb 26 06:14:26.183459 2026] [:error] [pid 6071:tid 6083] [client 4.205.17.183:30716] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/seetox.php"] [unique_id "aZ90QoQfAzdrpgft075j9AAAAQk"]
[Thu Feb 26 06:14:26.614230 2026] [:error] [pid 9589:tid 9658] [client 4.205.17.183:30659] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/seetox.php"] [unique_id "aZ90QqBuBxYiI1p-njTbCwAAAIU"]
[Thu Feb 26 06:14:27.049449 2026] [:error] [pid 9587:tid 9611] [client 4.205.17.183:30719] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/seetox.php"] [unique_id "aZ90Q_iLfyuakov_VlBaLgAAAA4"]
[Thu Feb 26 06:14:27.476101 2026] [:error] [pid 9587:tid 9609] [client 4.205.17.183:30668] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dom.php"] [unique_id "aZ90Q_iLfyuakov_VlBaMAAAAAw"]
[Thu Feb 26 06:14:27.894022 2026] [:error] [pid 9587:tid 9612] [client 4.205.17.183:30691] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dom.php"] [unique_id "aZ90Q_iLfyuakov_VlBaMQAAAA8"]
[Thu Feb 26 06:14:28.324527 2026] [:error] [pid 9587:tid 9613] [client 4.205.17.183:30657] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dom.php"] [unique_id "aZ90RPiLfyuakov_VlBaMwAAABA"]
[Thu Feb 26 06:14:28.749327 2026] [:error] [pid 9587:tid 9601] [client 4.205.17.183:30615] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dom.php"] [unique_id "aZ90RPiLfyuakov_VlBaNgAAAAQ"]
[Thu Feb 26 06:14:29.171697 2026] [:error] [pid 9587:tid 9610] [client 4.205.17.183:30680] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws60.php"] [unique_id "aZ90RfiLfyuakov_VlBaOQAAAA0"]
[Thu Feb 26 06:14:29.598354 2026] [:error] [pid 9588:tid 9638] [client 4.205.17.183:30600] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws60.php"] [unique_id "aZ90ReSfsVC0YxizsTvOnAAAAEw"]
[Thu Feb 26 06:14:30.037330 2026] [:error] [pid 9587:tid 9607] [client 4.205.17.183:30706] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws60.php"] [unique_id "aZ90RviLfyuakov_VlBaPwAAAAo"]
[Thu Feb 26 06:14:30.487013 2026] [:error] [pid 9702:tid 9728] [client 4.205.17.183:30676] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws60.php"] [unique_id "aZ90RpvL1wp7EOGdesxW6gAAANY"]
[Thu Feb 26 06:14:30.922862 2026] [:error] [pid 9587:tid 9613] [client 4.205.17.183:30610] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/samiri.php"] [unique_id "aZ90RviLfyuakov_VlBaQwAAABA"]
[Thu Feb 26 06:14:31.345668 2026] [:error] [pid 9588:tid 9634] [client 4.205.17.183:30692] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/samiri.php"] [unique_id "aZ90R-SfsVC0YxizsTvOnQAAAEg"]
[Thu Feb 26 06:14:31.770529 2026] [:error] [pid 9587:tid 9611] [client 4.205.17.183:30694] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/samiri.php"] [unique_id "aZ90R_iLfyuakov_VlBaTAAAAA4"]
[Thu Feb 26 06:14:32.222260 2026] [:error] [pid 17651:tid 17673] [client 4.205.17.183:30596] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/samiri.php"] [unique_id "aZ90SJ5mQDz5cec8gk4-7wAAAVQ"]
[Thu Feb 26 06:14:32.702257 2026] [:error] [pid 9587:tid 9615] [client 4.205.17.183:30675] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins.php"] [unique_id "aZ90SPiLfyuakov_VlBaUwAAABI"]
[Thu Feb 26 06:14:33.143908 2026] [:error] [pid 9587:tid 9620] [client 4.205.17.183:30695] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins.php"] [unique_id "aZ90SfiLfyuakov_VlBaVQAAABc"]
[Thu Feb 26 06:14:33.557669 2026] [:error] [pid 9587:tid 9611] [client 4.205.17.183:30681] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins.php"] [unique_id "aZ90SfiLfyuakov_VlBaVgAAAA4"]
[Thu Feb 26 06:14:33.970295 2026] [:error] [pid 9589:tid 9663] [client 4.205.17.183:30670] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins.php"] [unique_id "aZ90SaBuBxYiI1p-njTbHgAAAIo"]
[Thu Feb 26 06:14:34.391259 2026] [:error] [pid 9587:tid 9602] [client 4.205.17.183:30713] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xoot.php"] [unique_id "aZ90SviLfyuakov_VlBaWgAAAAU"]
[Thu Feb 26 06:14:34.817956 2026] [:error] [pid 9587:tid 9599] [client 4.205.17.183:30542] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xoot.php"] [unique_id "aZ90SviLfyuakov_VlBaXAAAAAI"]
[Thu Feb 26 06:14:35.248693 2026] [:error] [pid 9587:tid 9613] [client 4.205.17.183:30709] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xoot.php"] [unique_id "aZ90S_iLfyuakov_VlBaYAAAABA"]
[Thu Feb 26 06:14:35.666216 2026] [:error] [pid 9589:tid 9662] [client 4.205.17.183:30671] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xoot.php"] [unique_id "aZ90S6BuBxYiI1p-njTbIwAAAIk"]
[Thu Feb 26 06:14:36.076658 2026] [:error] [pid 9589:tid 9668] [client 4.205.17.183:30700] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X57.php"] [unique_id "aZ90TKBuBxYiI1p-njTbJwAAAI8"]
[Thu Feb 26 06:14:36.487504 2026] [:error] [pid 9589:tid 9676] [client 4.205.17.183:30663] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X57.php"] [unique_id "aZ90TKBuBxYiI1p-njTbKQAAAJc"]
[Thu Feb 26 06:14:36.908331 2026] [:error] [pid 9589:tid 9658] [client 4.205.17.183:30699] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X57.php"] [unique_id "aZ90TKBuBxYiI1p-njTbLgAAAIU"]
[Thu Feb 26 06:14:37.320607 2026] [:error] [pid 6071:tid 6082] [client 4.205.17.183:30639] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X57.php"] [unique_id "aZ90TYQfAzdrpgft075j_QAAAQg"]
[Thu Feb 26 06:14:37.737905 2026] [:error] [pid 9588:tid 9650] [client 4.205.17.183:30594] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aZ90TeSfsVC0YxizsTvOogAAAFg"]
[Thu Feb 26 06:14:38.157599 2026] [:error] [pid 9589:tid 9666] [client 4.205.17.183:30604] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aZ90TqBuBxYiI1p-njTbMwAAAI0"]
[Thu Feb 26 06:14:38.575655 2026] [:error] [pid 9589:tid 9674] [client 4.205.17.183:30702] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aZ90TqBuBxYiI1p-njTbNwAAAJU"]
[Thu Feb 26 06:14:39.020791 2026] [:error] [pid 9587:tid 9597] [client 4.205.17.183:30623] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aZ90T_iLfyuakov_VlBaawAAAAA"]
[Thu Feb 26 06:14:39.471248 2026] [:error] [pid 9589:tid 9665] [client 4.205.17.183:30710] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file59.php"] [unique_id "aZ90T6BuBxYiI1p-njTbPQAAAIw"]
[Thu Feb 26 06:14:39.914639 2026] [:error] [pid 9587:tid 9607] [client 4.205.17.183:30717] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file59.php"] [unique_id "aZ90T_iLfyuakov_VlBacgAAAAo"]
[Thu Feb 26 06:14:40.340806 2026] [:error] [pid 9587:tid 9612] [client 4.205.17.183:30605] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file59.php"] [unique_id "aZ90UPiLfyuakov_VlBadQAAAA8"]
[Thu Feb 26 06:14:40.766713 2026] [:error] [pid 9587:tid 9613] [client 4.205.17.183:30625] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file59.php"] [unique_id "aZ90UPiLfyuakov_VlBaewAAABA"]
[Thu Feb 26 06:14:41.198618 2026] [:error] [pid 9587:tid 9601] [client 4.205.17.183:30715] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aZ90UfiLfyuakov_VlBagAAAAAQ"]
[Thu Feb 26 06:14:41.628654 2026] [:error] [pid 9587:tid 9609] [client 4.205.17.183:30688] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aZ90UfiLfyuakov_VlBahAAAAAw"]
[Thu Feb 26 06:14:42.086916 2026] [:error] [pid 9587:tid 9612] [client 4.205.17.183:30712] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aZ90UviLfyuakov_VlBahwAAAA8"]
[Thu Feb 26 06:14:42.518849 2026] [:error] [pid 9587:tid 9619] [client 4.205.17.183:30620] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aZ90UviLfyuakov_VlBaiwAAABY"]
[Thu Feb 26 06:14:42.936565 2026] [:error] [pid 6071:tid 6092] [client 4.205.17.183:30678] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shas.php"] [unique_id "aZ90UoQfAzdrpgft075kBQAAARI"]
[Thu Feb 26 06:14:43.355999 2026] [:error] [pid 9587:tid 9604] [client 4.205.17.183:30701] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shas.php"] [unique_id "aZ90U_iLfyuakov_VlBakwAAAAc"]
[Thu Feb 26 06:14:43.779882 2026] [:error] [pid 9587:tid 9620] [client 4.205.17.183:30602] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shas.php"] [unique_id "aZ90U_iLfyuakov_VlBamQAAABc"]
[Thu Feb 26 06:14:44.218753 2026] [:error] [pid 9587:tid 9609] [client 4.205.17.183:30612] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shas.php"] [unique_id "aZ90VPiLfyuakov_VlBanwAAAAw"]
[Thu Feb 26 06:14:44.654314 2026] [:error] [pid 9587:tid 9598] [client 4.205.17.183:30593] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aZ90VPiLfyuakov_VlBapgAAAAE"]
[Thu Feb 26 06:14:45.079185 2026] [:error] [pid 9589:tid 9653] [client 4.205.17.183:30601] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aZ90VaBuBxYiI1p-njTbSwAAAIA"]
[Thu Feb 26 06:14:45.496375 2026] [:error] [pid 17651:tid 17655] [client 203.147.140.128:1379] [client 203.147.140.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.147.140.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ90VZ5mQDz5cec8gk4--QAAAUI"]
[Thu Feb 26 06:14:45.518120 2026] [:error] [pid 9589:tid 9673] [client 4.205.17.183:30532] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aZ90VaBuBxYiI1p-njTbTQAAAJQ"]
[Thu Feb 26 06:14:45.949478 2026] [:error] [pid 9589:tid 9658] [client 4.205.17.183:30608] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aZ90VaBuBxYiI1p-njTbTwAAAIU"]
[Thu Feb 26 06:14:46.379917 2026] [:error] [pid 9589:tid 9677] [client 4.205.17.183:30673] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "aZ90VqBuBxYiI1p-njTbUwAAAJg"]
[Thu Feb 26 06:14:46.804753 2026] [:error] [pid 9588:tid 9637] [client 4.205.17.183:30598] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "aZ90VuSfsVC0YxizsTvOpAAAAEs"]
[Thu Feb 26 06:14:47.234902 2026] [:error] [pid 9587:tid 9602] [client 4.205.17.183:30683] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "aZ90V_iLfyuakov_VlBatgAAAAU"]
[Thu Feb 26 06:14:47.660132 2026] [:error] [pid 9587:tid 9619] [client 4.205.17.183:30660] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "aZ90V_iLfyuakov_VlBavQAAABY"]
[Thu Feb 26 06:14:48.091326 2026] [:error] [pid 9702:tid 9714] [client 4.205.17.183:30667] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/er.php"] [unique_id "aZ90WJvL1wp7EOGdesxW-AAAAMg"]
[Thu Feb 26 06:14:48.522367 2026] [:error] [pid 6071:tid 6078] [client 4.205.17.183:30622] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/er.php"] [unique_id "aZ90WIQfAzdrpgft075kFgAAAQQ"]
[Thu Feb 26 06:14:48.947979 2026] [:error] [pid 9587:tid 9607] [client 4.205.17.183:30627] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/er.php"] [unique_id "aZ90WPiLfyuakov_VlBaygAAAAo"]
[Thu Feb 26 06:14:49.381117 2026] [:error] [pid 9587:tid 9612] [client 4.205.17.183:30606] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/er.php"] [unique_id "aZ90WfiLfyuakov_VlBazgAAAA8"]
[Thu Feb 26 06:14:49.825083 2026] [:error] [pid 9587:tid 9613] [client 4.205.17.183:30707] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fault.php"] [unique_id "aZ90WfiLfyuakov_VlBa0gAAABA"]
[Thu Feb 26 06:14:50.247184 2026] [:error] [pid 9589:tid 9662] [client 4.205.17.183:30474] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fault.php"] [unique_id "aZ90WqBuBxYiI1p-njTbWwAAAIk"]
[Thu Feb 26 06:14:50.664072 2026] [:error] [pid 9587:tid 9620] [client 4.205.17.183:30644] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fault.php"] [unique_id "aZ90WviLfyuakov_VlBa1wAAABc"]
[Thu Feb 26 06:14:51.087624 2026] [:error] [pid 9702:tid 9710] [client 4.205.17.183:30677] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fault.php"] [unique_id "aZ90W5vL1wp7EOGdesxW_gAAAMQ"]
[Thu Feb 26 06:14:51.512030 2026] [:error] [pid 9589:tid 9658] [client 4.205.17.183:30651] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aZ90W6BuBxYiI1p-njTbYwAAAIU"]
[Thu Feb 26 06:14:51.955475 2026] [:error] [pid 9589:tid 9663] [client 4.205.17.183:30642] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aZ90W6BuBxYiI1p-njTbZAAAAIo"]
[Thu Feb 26 06:14:52.433334 2026] [:error] [pid 9589:tid 9677] [client 4.205.17.183:30614] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aZ90XKBuBxYiI1p-njTbZQAAAJg"]
[Thu Feb 26 06:14:52.854114 2026] [:error] [pid 9589:tid 9661] [client 4.205.17.183:30611] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aZ90XKBuBxYiI1p-njTbZwAAAIg"]
[Thu Feb 26 06:14:53.274054 2026] [:error] [pid 9587:tid 9610] [client 4.205.17.183:30533] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aZ90XfiLfyuakov_VlBa7wAAAA0"]
[Thu Feb 26 06:14:53.697675 2026] [:error] [pid 9588:tid 9641] [client 4.205.17.183:30538] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aZ90XeSfsVC0YxizsTvOqAAAAE8"]
[Thu Feb 26 06:14:54.116068 2026] [:error] [pid 9587:tid 9615] [client 4.205.17.183:30714] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aZ90XviLfyuakov_VlBa9gAAABI"]
[Thu Feb 26 06:14:54.542785 2026] [:error] [pid 9589:tid 9673] [client 4.205.17.183:30718] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aZ90XqBuBxYiI1p-njTbcQAAAJQ"]
[Thu Feb 26 06:14:54.967438 2026] [:error] [pid 9587:tid 9601] [client 4.205.17.183:30661] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/leuk.php"] [unique_id "aZ90XviLfyuakov_VlBa-QAAAAQ"]
[Thu Feb 26 06:14:55.403448 2026] [:error] [pid 9587:tid 9618] [client 4.205.17.183:30619] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/leuk.php"] [unique_id "aZ90X_iLfyuakov_VlBa_QAAABU"]
[Thu Feb 26 06:14:55.818253 2026] [:error] [pid 9587:tid 9608] [client 4.205.17.183:30534] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/leuk.php"] [unique_id "aZ90X_iLfyuakov_VlBbAAAAAAs"]
[Thu Feb 26 06:14:56.233314 2026] [:error] [pid 9587:tid 9597] [client 4.205.17.183:30646] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/leuk.php"] [unique_id "aZ90YPiLfyuakov_VlBbBAAAAAA"]
[Thu Feb 26 06:14:56.650572 2026] [:error] [pid 9587:tid 9605] [client 4.205.17.183:30547] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xqq.php"] [unique_id "aZ90YPiLfyuakov_VlBbCwAAAAg"]
[Thu Feb 26 06:14:57.089169 2026] [:error] [pid 9587:tid 9616] [client 4.205.17.183:30632] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xqq.php"] [unique_id "aZ90YfiLfyuakov_VlBbGAAAABM"]
[Thu Feb 26 06:14:57.501853 2026] [:error] [pid 9702:tid 9707] [client 4.205.17.183:30531] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xqq.php"] [unique_id "aZ90YZvL1wp7EOGdesxW_wAAAME"]
[Thu Feb 26 06:14:57.921319 2026] [:error] [pid 9589:tid 9673] [client 4.205.17.183:30640] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xqq.php"] [unique_id "aZ90YaBuBxYiI1p-njTbgQAAAJQ"]
[Thu Feb 26 06:14:58.360140 2026] [:error] [pid 9589:tid 9663] [client 4.205.17.183:30552] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kolda.php"] [unique_id "aZ90YqBuBxYiI1p-njTbiQAAAIo"]
[Thu Feb 26 06:14:58.780133 2026] [:error] [pid 6071:tid 6082] [client 4.205.17.183:30530] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kolda.php"] [unique_id "aZ90YoQfAzdrpgft075kLQAAAQg"]
[Thu Feb 26 06:14:59.211334 2026] [:error] [pid 9587:tid 9614] [client 4.205.17.183:30684] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kolda.php"] [unique_id "aZ90Y_iLfyuakov_VlBbMwAAABE"]
[Thu Feb 26 06:14:59.631546 2026] [:error] [pid 6071:tid 6075] [client 4.205.17.183:30528] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kolda.php"] [unique_id "aZ90Y4QfAzdrpgft075kMAAAAQE"]
[Thu Feb 26 06:15:00.050188 2026] [:error] [pid 17651:tid 17660] [client 4.205.17.183:30704] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "aZ90ZJ5mQDz5cec8gk4_AgAAAUc"]
[Thu Feb 26 06:15:00.473448 2026] [:error] [pid 6071:tid 6087] [client 4.205.17.183:30705] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "aZ90ZIQfAzdrpgft075kMgAAAQ0"]
[Thu Feb 26 06:15:00.896799 2026] [:error] [pid 6071:tid 6078] [client 4.205.17.183:30655] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "aZ90ZIQfAzdrpgft075kNQAAAQQ"]
[Thu Feb 26 06:15:01.313165 2026] [:error] [pid 9589:tid 9663] [client 4.205.17.183:30473] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "aZ90ZaBuBxYiI1p-njTblQAAAIo"]
[Thu Feb 26 06:15:01.766474 2026] [:error] [pid 9587:tid 9607] [client 4.205.17.183:30629] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/god.php"] [unique_id "aZ90ZfiLfyuakov_VlBbQQAAAAo"]
[Thu Feb 26 06:15:02.190032 2026] [:error] [pid 9587:tid 9618] [client 4.205.17.183:30633] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/god.php"] [unique_id "aZ90ZviLfyuakov_VlBbRQAAABU"]
[Thu Feb 26 06:15:02.606285 2026] [:error] [pid 9587:tid 9608] [client 4.205.17.183:30637] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/god.php"] [unique_id "aZ90ZviLfyuakov_VlBbSAAAAAs"]
[Thu Feb 26 06:15:03.037364 2026] [:error] [pid 9587:tid 9621] [client 4.205.17.183:30645] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/god.php"] [unique_id "aZ90Z_iLfyuakov_VlBbSwAAABg"]
[Thu Feb 26 06:15:03.466060 2026] [:error] [pid 9587:tid 9616] [client 4.205.17.183:30571] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aZ90Z_iLfyuakov_VlBbTQAAABM"]
[Thu Feb 26 06:15:03.898843 2026] [:error] [pid 9702:tid 9718] [client 4.205.17.183:30613] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aZ90Z5vL1wp7EOGdesxXAwAAAMw"]
[Thu Feb 26 06:15:04.316745 2026] [:error] [pid 9702:tid 9712] [client 4.205.17.183:30650] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aZ90aJvL1wp7EOGdesxXBQAAAMY"]
[Thu Feb 26 06:15:04.747354 2026] [:error] [pid 6071:tid 6088] [client 4.205.17.183:30553] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aZ90aIQfAzdrpgft075kOgAAAQ4"]
[Thu Feb 26 06:15:05.169504 2026] [:error] [pid 9587:tid 9605] [client 4.205.17.183:30541] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aZ90afiLfyuakov_VlBbVgAAAAg"]
[Thu Feb 26 06:15:05.614650 2026] [:error] [pid 9702:tid 9716] [client 4.205.17.183:30624] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aZ90aZvL1wp7EOGdesxXCQAAAMo"]
[Thu Feb 26 06:15:06.034156 2026] [:error] [pid 9587:tid 9610] [client 4.205.17.183:30467] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aZ90aviLfyuakov_VlBbWgAAAA0"]
[Thu Feb 26 06:15:06.456829 2026] [:error] [pid 9587:tid 9615] [client 4.205.17.183:30621] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aZ90aviLfyuakov_VlBbXQAAABI"]
[Thu Feb 26 06:15:06.899329 2026] [:error] [pid 9702:tid 9714] [client 4.205.17.183:30562] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/un.php"] [unique_id "aZ90apvL1wp7EOGdesxXDAAAAMg"]
[Thu Feb 26 06:15:07.322717 2026] [:error] [pid 9702:tid 9719] [client 4.205.17.183:30558] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/un.php"] [unique_id "aZ90a5vL1wp7EOGdesxXDQAAAM0"]
[Thu Feb 26 06:15:07.746866 2026] [:error] [pid 9702:tid 9708] [client 4.205.17.183:30539] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/un.php"] [unique_id "aZ90a5vL1wp7EOGdesxXDwAAAMI"]
[Thu Feb 26 06:15:08.168143 2026] [:error] [pid 9589:tid 9676] [client 4.205.17.183:30551] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/un.php"] [unique_id "aZ90bKBuBxYiI1p-njTbmgAAAJc"]
[Thu Feb 26 06:15:08.591924 2026] [:error] [pid 9702:tid 9706] [client 4.205.17.183:30634] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aZ90bJvL1wp7EOGdesxXFAAAAMA"]
[Thu Feb 26 06:15:09.033060 2026] [:error] [pid 9589:tid 9658] [client 4.205.17.183:30536] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aZ90baBuBxYiI1p-njTbnAAAAIU"]
[Thu Feb 26 06:15:09.470257 2026] [:error] [pid 9702:tid 9728] [client 4.205.17.183:30697] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aZ90bZvL1wp7EOGdesxXFgAAANY"]
[Thu Feb 26 06:15:09.888863 2026] [:error] [pid 17651:tid 17659] [client 4.205.17.183:30648] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aZ90bZ5mQDz5cec8gk4_EgAAAUY"]
[Thu Feb 26 06:15:10.320740 2026] [:error] [pid 9587:tid 9601] [client 4.205.17.183:30630] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms.php"] [unique_id "aZ90bviLfyuakov_VlBbZgAAAAQ"]
[Thu Feb 26 06:15:10.743983 2026] [:error] [pid 17651:tid 17666] [client 4.205.17.183:30420] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms.php"] [unique_id "aZ90bp5mQDz5cec8gk4_FAAAAU0"]
[Thu Feb 26 06:15:11.171953 2026] [:error] [pid 17651:tid 17667] [client 4.205.17.183:30679] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms.php"] [unique_id "aZ90b55mQDz5cec8gk4_GAAAAU4"]
[Thu Feb 26 06:15:11.592580 2026] [:error] [pid 9702:tid 9725] [client 4.205.17.183:30554] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms.php"] [unique_id "aZ90b5vL1wp7EOGdesxXGAAAANM"]
[Thu Feb 26 06:15:12.005303 2026] [:error] [pid 9702:tid 9721] [client 4.205.17.183:30482] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login8.php"] [unique_id "aZ90cJvL1wp7EOGdesxXGgAAAM8"]
[Thu Feb 26 06:15:12.418207 2026] [:error] [pid 9588:tid 9626] [client 4.205.17.183:30540] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login8.php"] [unique_id "aZ90cOSfsVC0YxizsTvOrgAAAEA"]
[Thu Feb 26 06:15:12.846105 2026] [:error] [pid 17651:tid 17655] [client 4.205.17.183:30476] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login8.php"] [unique_id "aZ90cJ5mQDz5cec8gk4_HgAAAUI"]
[Thu Feb 26 06:15:13.303049 2026] [:error] [pid 17651:tid 17671] [client 4.205.17.183:30488] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/login8.php"] [unique_id "aZ90cZ5mQDz5cec8gk4_IAAAAVI"]
[Thu Feb 26 06:15:13.733614 2026] [:error] [pid 9589:tid 9677] [client 4.205.17.183:30638] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nnyvn.php"] [unique_id "aZ90caBuBxYiI1p-njTbowAAAJg"]
[Thu Feb 26 06:15:14.164993 2026] [:error] [pid 9587:tid 9619] [client 4.205.17.183:30583] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nnyvn.php"] [unique_id "aZ90cviLfyuakov_VlBbbQAAABY"]
[Thu Feb 26 06:15:14.601843 2026] [:error] [pid 9589:tid 9669] [client 4.205.17.183:30682] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nnyvn.php"] [unique_id "aZ90cqBuBxYiI1p-njTbpgAAAJA"]
[Thu Feb 26 06:15:15.032306 2026] [:error] [pid 9587:tid 9604] [client 4.205.17.183:30587] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nnyvn.php"] [unique_id "aZ90c_iLfyuakov_VlBbcQAAAAc"]
[Thu Feb 26 06:15:15.448822 2026] [:error] [pid 9589:tid 9660] [client 4.205.17.183:30566] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "aZ90c6BuBxYiI1p-njTbqwAAAIc"]
[Thu Feb 26 06:15:15.875946 2026] [:error] [pid 9588:tid 9650] [client 4.205.17.183:30573] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "aZ90c-SfsVC0YxizsTvOsAAAAFg"]
[Thu Feb 26 06:15:16.319122 2026] [:error] [pid 17651:tid 17666] [client 4.205.17.183:30537] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "aZ90dJ5mQDz5cec8gk4_KQAAAU0"]
[Thu Feb 26 06:15:16.741796 2026] [:error] [pid 9587:tid 9603] [client 4.205.17.183:30693] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "aZ90dPiLfyuakov_VlBbdwAAAAY"]
[Thu Feb 26 06:15:17.161217 2026] [:error] [pid 9587:tid 9615] [client 4.205.17.183:30569] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lul.php"] [unique_id "aZ90dfiLfyuakov_VlBbewAAABI"]
[Thu Feb 26 06:15:17.588970 2026] [:error] [pid 9587:tid 9599] [client 4.205.17.183:30527] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lul.php"] [unique_id "aZ90dfiLfyuakov_VlBbfgAAAAI"]
[Thu Feb 26 06:15:18.006640 2026] [:error] [pid 9587:tid 9613] [client 4.205.17.183:30591] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lul.php"] [unique_id "aZ90dviLfyuakov_VlBbgAAAABA"]
[Thu Feb 26 06:15:18.429388 2026] [:error] [pid 9587:tid 9604] [client 4.205.17.183:30545] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lul.php"] [unique_id "aZ90dviLfyuakov_VlBbhQAAAAc"]
[Thu Feb 26 06:15:18.843637 2026] [:error] [pid 9589:tid 9670] [client 4.205.17.183:30483] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0.php"] [unique_id "aZ90dqBuBxYiI1p-njTbrQAAAJE"]
[Thu Feb 26 06:15:29.906636 2026] [:error] [pid 9587:tid 9602] [client 4.205.17.183:30544] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fot.php"] [unique_id "aZ90gfiLfyuakov_VlBcHAAAAAU"]
[Thu Feb 26 06:15:30.325185 2026] [:error] [pid 9702:tid 9721] [client 4.205.17.183:30471] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fot.php"] [unique_id "aZ90gpvL1wp7EOGdesxXdAAAAM8"]
[Thu Feb 26 06:15:30.753493 2026] [:error] [pid 9702:tid 9709] [client 4.205.17.183:30662] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fot.php"] [unique_id "aZ90gpvL1wp7EOGdesxXdQAAAMM"]
[Thu Feb 26 06:15:31.185618 2026] [:error] [pid 9587:tid 9614] [client 4.205.17.183:30653] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fot.php"] [unique_id "aZ90g_iLfyuakov_VlBcIQAAABE"]
[Thu Feb 26 06:15:31.608998 2026] [:error] [pid 9702:tid 9730] [client 4.205.17.183:30535] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff1.php"] [unique_id "aZ90g5vL1wp7EOGdesxXdgAAANg"]
[Thu Feb 26 06:15:32.034537 2026] [:error] [pid 9702:tid 9718] [client 4.205.17.183:30498] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff1.php"] [unique_id "aZ90hJvL1wp7EOGdesxXdwAAAMw"]
[Thu Feb 26 06:15:32.468349 2026] [:error] [pid 9702:tid 9719] [client 4.205.17.183:30689] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff1.php"] [unique_id "aZ90hJvL1wp7EOGdesxXegAAAM0"]
[Thu Feb 26 06:15:32.896786 2026] [:error] [pid 6071:tid 6091] [client 4.205.17.183:30643] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff1.php"] [unique_id "aZ90hIQfAzdrpgft075kbAAAARE"]
[Thu Feb 26 06:15:33.321160 2026] [:error] [pid 6071:tid 6082] [client 4.205.17.183:30413] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/forbidals.php"] [unique_id "aZ90hYQfAzdrpgft075kbwAAAQg"]
[Thu Feb 26 06:15:33.742791 2026] [:error] [pid 9588:tid 9627] [client 4.205.17.183:30572] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/forbidals.php"] [unique_id "aZ90heSfsVC0YxizsTvOtQAAAEE"]
[Thu Feb 26 06:15:34.156472 2026] [:error] [pid 6071:tid 6088] [client 4.205.17.183:30489] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/forbidals.php"] [unique_id "aZ90hoQfAzdrpgft075kcwAAAQ4"]
[Thu Feb 26 06:15:34.570932 2026] [:error] [pid 9589:tid 9673] [client 4.205.17.183:30480] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/forbidals.php"] [unique_id "aZ90hqBuBxYiI1p-njTbvQAAAJQ"]
[Thu Feb 26 06:15:35.008839 2026] [:error] [pid 9589:tid 9675] [client 4.205.17.183:30485] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/erty.php"] [unique_id "aZ90h6BuBxYiI1p-njTbvgAAAJY"]
[Thu Feb 26 06:15:35.433434 2026] [:error] [pid 9589:tid 9657] [client 4.205.17.183:30487] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/erty.php"] [unique_id "aZ90h6BuBxYiI1p-njTbwAAAAIQ"]
[Thu Feb 26 06:15:35.869692 2026] [:error] [pid 6071:tid 6097] [client 4.205.17.183:30599] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/erty.php"] [unique_id "aZ90h4QfAzdrpgft075kegAAARc"]
[Thu Feb 26 06:15:36.304700 2026] [:error] [pid 9587:tid 9610] [client 4.205.17.183:30647] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/erty.php"] [unique_id "aZ90iPiLfyuakov_VlBcMAAAAA0"]
[Thu Feb 26 06:15:36.739561 2026] [:error] [pid 9587:tid 9605] [client 4.205.17.183:30574] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev1s.php"] [unique_id "aZ90iPiLfyuakov_VlBcMwAAAAg"]
[Thu Feb 26 06:15:37.166554 2026] [:error] [pid 9587:tid 9618] [client 4.205.17.183:30690] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev1s.php"] [unique_id "aZ90ifiLfyuakov_VlBcNwAAABU"]
[Thu Feb 26 06:15:37.584162 2026] [:error] [pid 9588:tid 9638] [client 4.205.17.183:30557] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev1s.php"] [unique_id "aZ90ieSfsVC0YxizsTvOuQAAAEw"]
[Thu Feb 26 06:15:38.006264 2026] [:error] [pid 17651:tid 17663] [client 4.205.17.183:30652] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev1s.php"] [unique_id "aZ90ip5mQDz5cec8gk4_QwAAAUo"]
[Thu Feb 26 06:15:38.432324 2026] [:error] [pid 17651:tid 17655] [client 4.205.17.183:30581] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ffd.php"] [unique_id "aZ90ip5mQDz5cec8gk4_RAAAAUI"]
[Thu Feb 26 06:15:38.845864 2026] [:error] [pid 9588:tid 9634] [client 4.205.17.183:30504] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ffd.php"] [unique_id "aZ90iuSfsVC0YxizsTvOuwAAAEg"]
[Thu Feb 26 06:15:39.266271 2026] [:error] [pid 9702:tid 9722] [client 4.205.17.183:30595] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ffd.php"] [unique_id "aZ90i5vL1wp7EOGdesxXfgAAANA"]
[Thu Feb 26 06:15:39.682947 2026] [:error] [pid 9702:tid 9707] [client 4.205.17.183:30584] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ffd.php"] [unique_id "aZ90i5vL1wp7EOGdesxXgQAAAME"]
[Thu Feb 26 06:15:40.095147 2026] [:error] [pid 9587:tid 9619] [client 4.205.17.183:30578] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admiin.php"] [unique_id "aZ90jPiLfyuakov_VlBcPQAAABY"]
[Thu Feb 26 06:15:40.510118 2026] [:error] [pid 9589:tid 9661] [client 4.205.17.183:30529] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admiin.php"] [unique_id "aZ90jKBuBxYiI1p-njTbzAAAAIg"]
[Thu Feb 26 06:15:40.943703 2026] [:error] [pid 9587:tid 9614] [client 4.205.17.183:30687] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admiin.php"] [unique_id "aZ90jPiLfyuakov_VlBcPwAAABE"]
[Thu Feb 26 06:15:41.369488 2026] [:error] [pid 9589:tid 9676] [client 4.205.17.183:30351] [client 4.205.17.183] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admiin.php"] [unique_id "aZ90jaBuBxYiI1p-njTbzwAAAJc"]
[Thu Feb 26 06:15:52.770304 2026] [:error] [pid 9587:tid 9620] [client 203.147.140.128:8614] [client 203.147.140.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.147.140.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ90mPiLfyuakov_VlBcowAAABc"]
[Thu Feb 26 06:17:06.304888 2026] [:error] [pid 17651:tid 17672] [client 203.147.140.128:3722] [client 203.147.140.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.147.140.128, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ904p5mQDz5cec8gk4_kwAAAVM"]
[Thu Feb 26 06:17:06.308032 2026] [:error] [pid 17651:tid 17672] [client 203.147.140.128:3722] [client 203.147.140.128] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1admin%expressinteriorstitle0xf737511fdescription0xf737511fmt_keywords0xf737511fmt_excerpt0xf737511f1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ904p5mQDz5cec8gk4_kwAAAVM"]
[Thu Feb 26 06:22:59.535587 2026] [:error] [pid 9589:tid 9667] [client 43.166.128.86:46902] [client 43.166.128.86] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZ92Q6BuBxYiI1p-njTiGQAAAI4"]
[Thu Feb 26 08:47:18.473711 2026] [:error] [pid 25311:tid 25335] [client 43.153.10.83:33686] [client 43.153.10.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZ-YFtfdM__yZAgJFSv79AAAAZU"]
[Thu Feb 26 12:02:55.906952 2026] [:error] [pid 3883:tid 3889] [client 43.167.157.80:34154] [client 43.167.157.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aZ_F7-A33x90V6yYHagzygAAAUM"]
[Thu Feb 26 12:08:54.589003 2026] [proxy_fcgi:error] [pid 55618:tid 55626] [client 4.193.97.168:4981] AH01071: Got error 'Primary script unknown'
[Thu Feb 26 12:08:54.680613 2026] [proxy_fcgi:error] [pid 55618:tid 55628] [client 4.193.97.168:4981] AH01071: Got error 'Primary script unknown'
[Thu Feb 26 12:08:54.772151 2026] [proxy_fcgi:error] [pid 55618:tid 55642] [client 4.193.97.168:4981] AH01071: Got error 'Primary script unknown'
[Thu Feb 26 12:08:59.187701 2026] [:error] [pid 55618:tid 55624] [client 4.193.97.168:4981] [client 4.193.97.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/01.php"] [unique_id "aZ_HWx61Vrh12f_8oWRa5QAAAQM"]
[Thu Feb 26 12:08:59.555125 2026] [:error] [pid 25311:tid 25335] [client 4.193.97.168:4900] [client 4.193.97.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/01.php"] [unique_id "aZ_HW9fdM__yZAgJFSuWPgAAAZU"]
[Thu Feb 26 12:08:59.911298 2026] [:error] [pid 55618:tid 55630] [client 4.193.97.168:8518] [client 4.193.97.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/01.php"] [unique_id "aZ_HWx61Vrh12f_8oWRa6QAAAQk"]
[Thu Feb 26 12:09:00.262115 2026] [:error] [pid 55618:tid 55629] [client 4.193.97.168:4877] [client 4.193.97.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/01.php"] [unique_id "aZ_HXB61Vrh12f_8oWRa6gAAAQg"]
[Thu Feb 26 12:31:33.885053 2026] [:error] [pid 55051:tid 55072] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MpQmK1w2kZvh5eLHYogAAAJI"]
[Thu Feb 26 12:31:41.358172 2026] [:error] [pid 55051:tid 55058] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aZ_MrQmK1w2kZvh5eLHYrAAAAIQ"], referer: https://www.facebook.com/
[Thu Feb 26 12:31:41.686447 2026] [:error] [pid 55051:tid 55066] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MrQmK1w2kZvh5eLHYrQAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:31:43.814631 2026] [:error] [pid 55051:tid 55068] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MrwmK1w2kZvh5eLHYsgAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:31:44.813036 2026] [:error] [pid 55051:tid 55070] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MsAmK1w2kZvh5eLHYswAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:31:46.844493 2026] [:error] [pid 55051:tid 55077] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MsgmK1w2kZvh5eLHYtwAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:31:47.881259 2026] [:error] [pid 55051:tid 55069] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MswmK1w2kZvh5eLHYuwAAAI8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:31:49.847551 2026] [:error] [pid 55051:tid 55058] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MtQmK1w2kZvh5eLHYwQAAAIQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:31:50.747553 2026] [:error] [pid 55051:tid 55070] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MtgmK1w2kZvh5eLHYxwAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:31:52.614959 2026] [:error] [pid 55051:tid 55060] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MuAmK1w2kZvh5eLHYygAAAIY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:31:53.464744 2026] [:error] [pid 55051:tid 55077] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MuQmK1w2kZvh5eLHYywAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:31:55.165162 2026] [:error] [pid 55051:tid 55065] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MuwmK1w2kZvh5eLHYzwAAAIs"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:31:56.036730 2026] [:error] [pid 55051:tid 55059] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MvAmK1w2kZvh5eLHY0QAAAIU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:31:57.968117 2026] [:error] [pid 55051:tid 55067] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MvQmK1w2kZvh5eLHY1AAAAI0"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:31:58.812001 2026] [:error] [pid 55051:tid 55074] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MvgmK1w2kZvh5eLHY1QAAAJQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:01.088519 2026] [:error] [pid 55051:tid 55055] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MwQmK1w2kZvh5eLHY2AAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:02.308074 2026] [:error] [pid 55051:tid 55071] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MwgmK1w2kZvh5eLHY2QAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:04.385516 2026] [:error] [pid 55051:tid 55056] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MxAmK1w2kZvh5eLHY3AAAAII"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:05.265070 2026] [:error] [pid 55051:tid 55075] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MxQmK1w2kZvh5eLHY3wAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:07.224511 2026] [:error] [pid 55051:tid 55068] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MxwmK1w2kZvh5eLHY4QAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:08.214666 2026] [:error] [pid 55051:tid 55065] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MyAmK1w2kZvh5eLHY4wAAAIs"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:10.380557 2026] [:error] [pid 55051:tid 55078] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MygmK1w2kZvh5eLHY5gAAAJg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:11.213263 2026] [:error] [pid 55051:tid 55054] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MywmK1w2kZvh5eLHY5wAAAIA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:13.002877 2026] [:error] [pid 55051:tid 55057] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MzQmK1w2kZvh5eLHY6QAAAIM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:14.097346 2026] [:error] [pid 55051:tid 55066] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_MzgmK1w2kZvh5eLHY6gAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:16.472763 2026] [:error] [pid 55051:tid 55064] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M0AmK1w2kZvh5eLHY7AAAAIo"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:17.520987 2026] [:error] [pid 55051:tid 55055] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M0QmK1w2kZvh5eLHY7QAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:19.494635 2026] [:error] [pid 55051:tid 55058] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M0wmK1w2kZvh5eLHY7wAAAIQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:20.406036 2026] [:error] [pid 55051:tid 55061] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M1AmK1w2kZvh5eLHY8AAAAIc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:23.806583 2026] [:error] [pid 55051:tid 55056] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M1wmK1w2kZvh5eLHY8wAAAII"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:25.250680 2026] [:error] [pid 55051:tid 55069] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M2QmK1w2kZvh5eLHY9AAAAI8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:27.379511 2026] [:error] [pid 55051:tid 55068] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M2wmK1w2kZvh5eLHY9gAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:28.474799 2026] [:error] [pid 55051:tid 55062] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M3AmK1w2kZvh5eLHY9wAAAIg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:30.485493 2026] [:error] [pid 55051:tid 55078] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M3gmK1w2kZvh5eLHY-gAAAJg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:31.606622 2026] [:error] [pid 55051:tid 55054] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M3wmK1w2kZvh5eLHY-wAAAIA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:33.554540 2026] [:error] [pid 55051:tid 55063] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M4QmK1w2kZvh5eLHZAAAAAIk"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:34.404384 2026] [:error] [pid 55051:tid 55070] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M4gmK1w2kZvh5eLHZBAAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:36.906352 2026] [:error] [pid 55051:tid 55060] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M5AmK1w2kZvh5eLHZBgAAAIY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:37.966531 2026] [:error] [pid 55051:tid 55075] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M5QmK1w2kZvh5eLHZBwAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:40.210676 2026] [:error] [pid 55051:tid 55076] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M6AmK1w2kZvh5eLHZCQAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:41.140328 2026] [:error] [pid 55051:tid 55068] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M6QmK1w2kZvh5eLHZCgAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:42.929728 2026] [:error] [pid 55051:tid 55072] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M6gmK1w2kZvh5eLHZDAAAAJI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:43.782585 2026] [:error] [pid 55051:tid 55065] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M6wmK1w2kZvh5eLHZDQAAAIs"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:45.650556 2026] [:error] [pid 55051:tid 55078] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M7QmK1w2kZvh5eLHZDwAAAJg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:46.533929 2026] [:error] [pid 55051:tid 55067] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M7gmK1w2kZvh5eLHZEAAAAI0"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:48.763298 2026] [:error] [pid 55051:tid 55073] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M8AmK1w2kZvh5eLHZEgAAAJM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:49.805682 2026] [:error] [pid 55051:tid 55077] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M8QmK1w2kZvh5eLHZEwAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:51.694283 2026] [:error] [pid 55051:tid 55054] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M8wmK1w2kZvh5eLHZFQAAAIA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:52.613680 2026] [:error] [pid 55051:tid 55066] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M9AmK1w2kZvh5eLHZFgAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:54.536075 2026] [:error] [pid 55051:tid 55055] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M9gmK1w2kZvh5eLHZGAAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:55.577340 2026] [:error] [pid 55051:tid 55071] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M9wmK1w2kZvh5eLHZGQAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:57.793284 2026] [:error] [pid 55051:tid 55061] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M-QmK1w2kZvh5eLHZHAAAAIc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:32:58.842363 2026] [:error] [pid 55051:tid 55056] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M-gmK1w2kZvh5eLHZHQAAAII"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:01.105496 2026] [:error] [pid 55051:tid 55069] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M_QmK1w2kZvh5eLHZIAAAAI8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:02.045154 2026] [:error] [pid 55051:tid 55076] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_M_gmK1w2kZvh5eLHZIQAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:04.371890 2026] [:error] [pid 55051:tid 55065] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NAAmK1w2kZvh5eLHZIwAAAIs"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:05.312975 2026] [:error] [pid 55051:tid 55078] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NAQmK1w2kZvh5eLHZJAAAAJg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:07.473354 2026] [:error] [pid 55051:tid 55073] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NAwmK1w2kZvh5eLHZKAAAAJM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:08.471938 2026] [:error] [pid 55051:tid 55077] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NBAmK1w2kZvh5eLHZKQAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:10.340649 2026] [:error] [pid 55051:tid 55054] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NBgmK1w2kZvh5eLHZKwAAAIA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:11.224248 2026] [:error] [pid 55051:tid 55064] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NBwmK1w2kZvh5eLHZLAAAAIo"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:13.033853 2026] [:error] [pid 55051:tid 55058] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NCQmK1w2kZvh5eLHZLgAAAIQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:13.957931 2026] [:error] [pid 55051:tid 55056] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NCQmK1w2kZvh5eLHZMAAAAII"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:16.163289 2026] [:error] [pid 55051:tid 55069] [client 176.65.132.19:55659] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NDAmK1w2kZvh5eLHZMgAAAI8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:18.120735 2026] [:error] [pid 3883:tid 3899] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NDuA33x90V6yYHahEFAAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:20.104958 2026] [:error] [pid 3883:tid 3902] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NEOA33x90V6yYHahEHgAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:20.981670 2026] [:error] [pid 3883:tid 3910] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NEOA33x90V6yYHahEIQAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:23.509210 2026] [:error] [pid 3883:tid 3886] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NE-A33x90V6yYHahEKAAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:24.469048 2026] [:error] [pid 3883:tid 3896] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NFOA33x90V6yYHahELQAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:26.382404 2026] [:error] [pid 3883:tid 3899] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NFuA33x90V6yYHahEMAAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:27.265543 2026] [:error] [pid 3883:tid 3898] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NF-A33x90V6yYHahENQAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:29.340154 2026] [:error] [pid 3883:tid 3897] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NGeA33x90V6yYHahEOgAAAUs"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:30.462817 2026] [:error] [pid 3883:tid 3893] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NGuA33x90V6yYHahEOwAAAUc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:32.229290 2026] [:error] [pid 3883:tid 3908] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NHOA33x90V6yYHahEUAAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:33.335744 2026] [:error] [pid 3883:tid 3908] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NHeA33x90V6yYHahEWAAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:35.511957 2026] [:error] [pid 3883:tid 3907] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NH-A33x90V6yYHahEYgAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:36.553526 2026] [:error] [pid 3883:tid 3893] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NIOA33x90V6yYHahEZAAAAUc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:38.695272 2026] [:error] [pid 3883:tid 3896] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NIuA33x90V6yYHahEbgAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:39.756261 2026] [:error] [pid 3883:tid 3889] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NI-A33x90V6yYHahEdgAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:41.592645 2026] [:error] [pid 3883:tid 3888] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NJeA33x90V6yYHahEgAAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:42.629858 2026] [:error] [pid 3883:tid 3891] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NJuA33x90V6yYHahEgQAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:44.991793 2026] [:error] [pid 3883:tid 3902] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NKOA33x90V6yYHahEgwAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:46.098990 2026] [:error] [pid 3883:tid 3907] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NKuA33x90V6yYHahEhQAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:48.400303 2026] [:error] [pid 3883:tid 3909] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NLOA33x90V6yYHahEiAAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:49.286042 2026] [:error] [pid 3883:tid 3886] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NLeA33x90V6yYHahEiwAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:52.704680 2026] [:error] [pid 3883:tid 3892] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NMOA33x90V6yYHahEmAAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:53.714911 2026] [:error] [pid 3883:tid 3894] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NMeA33x90V6yYHahEmgAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:55.785928 2026] [:error] [pid 3883:tid 3892] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NM-A33x90V6yYHahEpwAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:56.803930 2026] [:error] [pid 3883:tid 3908] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NNOA33x90V6yYHahEqgAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:33:59.195644 2026] [:error] [pid 3883:tid 3886] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NN-A33x90V6yYHahErgAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:00.288925 2026] [:error] [pid 3883:tid 3887] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NOOA33x90V6yYHahErwAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:02.689825 2026] [:error] [pid 3883:tid 3908] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NOuA33x90V6yYHahEtgAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:03.772135 2026] [:error] [pid 3883:tid 3888] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NO-A33x90V6yYHahEugAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:05.906006 2026] [:error] [pid 3883:tid 3899] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NPeA33x90V6yYHahEwgAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:07.129759 2026] [:error] [pid 3883:tid 3890] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NP-A33x90V6yYHahExAAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:09.331694 2026] [:error] [pid 3883:tid 3891] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NQeA33x90V6yYHahEyQAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:10.367570 2026] [:error] [pid 3883:tid 3897] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NQuA33x90V6yYHahEywAAAUs"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:12.684589 2026] [:error] [pid 3883:tid 3909] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NROA33x90V6yYHahEzwAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:13.844466 2026] [:error] [pid 3883:tid 3899] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NReA33x90V6yYHahE0QAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:15.681066 2026] [:error] [pid 3883:tid 3892] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NR-A33x90V6yYHahE0wAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:16.593963 2026] [:error] [pid 3883:tid 3901] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NSOA33x90V6yYHahE1QAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:18.775294 2026] [:error] [pid 3883:tid 3893] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NSuA33x90V6yYHahE2gAAAUc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:19.671401 2026] [:error] [pid 3883:tid 3897] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NS-A33x90V6yYHahE3wAAAUs"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:21.909232 2026] [:error] [pid 3883:tid 3903] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NTeA33x90V6yYHahE5QAAAVE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:22.836088 2026] [:error] [pid 3883:tid 3894] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NTuA33x90V6yYHahE7AAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:24.951152 2026] [:error] [pid 3883:tid 3898] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NUOA33x90V6yYHahE8gAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:27.218961 2026] [:error] [pid 3883:tid 3898] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NU-A33x90V6yYHahE9gAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:29.349629 2026] [:error] [pid 3883:tid 3887] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NVeA33x90V6yYHahE-wAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:30.698607 2026] [:error] [pid 3883:tid 3894] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NVuA33x90V6yYHahE_QAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:32.837680 2026] [:error] [pid 3883:tid 3896] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NWOA33x90V6yYHahFAwAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:33.727403 2026] [:error] [pid 3883:tid 3901] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NWeA33x90V6yYHahFBwAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:35.941354 2026] [:error] [pid 3883:tid 3900] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NW-A33x90V6yYHahFEAAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:37.036608 2026] [:error] [pid 3883:tid 3895] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NXeA33x90V6yYHahFFAAAAUk"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:39.251679 2026] [:error] [pid 3883:tid 3898] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NX-A33x90V6yYHahFGAAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:40.252050 2026] [:error] [pid 3883:tid 3901] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NYOA33x90V6yYHahFGgAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:42.441521 2026] [:error] [pid 3883:tid 3900] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NYuA33x90V6yYHahFIQAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:43.338652 2026] [:error] [pid 3883:tid 3907] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NY-A33x90V6yYHahFJQAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:45.412608 2026] [:error] [pid 3883:tid 3902] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NZeA33x90V6yYHahFKgAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:46.446566 2026] [:error] [pid 3883:tid 3901] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NZuA33x90V6yYHahFLAAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:48.371321 2026] [:error] [pid 3883:tid 3904] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NaOA33x90V6yYHahFNgAAAVI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:49.556795 2026] [:error] [pid 3883:tid 3906] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NaeA33x90V6yYHahFOgAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:51.593472 2026] [:error] [pid 3883:tid 3910] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_Na-A33x90V6yYHahFQwAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:52.605721 2026] [:error] [pid 3883:tid 3888] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NbOA33x90V6yYHahFRAAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:54.785509 2026] [:error] [pid 3883:tid 3904] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NbuA33x90V6yYHahFSAAAAVI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:55.737137 2026] [:error] [pid 3883:tid 3898] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_Nb-A33x90V6yYHahFSQAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:57.872350 2026] [:error] [pid 3883:tid 3899] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NceA33x90V6yYHahFUwAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:34:58.840311 2026] [:error] [pid 3883:tid 3890] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NcuA33x90V6yYHahFVwAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:01.070401 2026] [:error] [pid 3883:tid 3909] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NdeA33x90V6yYHahFWgAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:02.043991 2026] [:error] [pid 3883:tid 3896] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NduA33x90V6yYHahFXAAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:04.076478 2026] [:error] [pid 3883:tid 3901] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NeOA33x90V6yYHahFYAAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:04.983705 2026] [:error] [pid 3883:tid 3910] [client 176.65.132.19:62166] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NeOA33x90V6yYHahFYwAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:08.953454 2026] [:error] [pid 3883:tid 3898] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NfOA33x90V6yYHahFbQAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:09.987462 2026] [:error] [pid 3883:tid 3907] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NfeA33x90V6yYHahFdgAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:13.078741 2026] [:error] [pid 3883:tid 3890] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NgeA33x90V6yYHahFjQAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:14.162635 2026] [:error] [pid 3883:tid 3907] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NguA33x90V6yYHahFlgAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:16.422515 2026] [:error] [pid 3883:tid 3909] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NhOA33x90V6yYHahFowAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:17.390336 2026] [:error] [pid 3883:tid 3891] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NheA33x90V6yYHahFqwAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:19.387276 2026] [:error] [pid 3883:tid 3900] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_Nh-A33x90V6yYHahFsgAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:20.327502 2026] [:error] [pid 3883:tid 3908] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NiOA33x90V6yYHahFtQAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:22.241361 2026] [:error] [pid 3883:tid 3889] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NiuA33x90V6yYHahFuQAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:23.169352 2026] [:error] [pid 3883:tid 3899] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_Ni-A33x90V6yYHahF0AAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:24.972535 2026] [:error] [pid 3883:tid 3900] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NjOA33x90V6yYHahF2wAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:26.016350 2026] [:error] [pid 3883:tid 3899] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NjuA33x90V6yYHahF3wAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:27.953524 2026] [:error] [pid 3883:tid 3892] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_Nj-A33x90V6yYHahF5QAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:28.887833 2026] [:error] [pid 3883:tid 3910] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NkOA33x90V6yYHahF6AAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:30.792260 2026] [:error] [pid 3883:tid 3886] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NkuA33x90V6yYHahF7gAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:31.754817 2026] [:error] [pid 3883:tid 3895] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_Nk-A33x90V6yYHahF-AAAAUk"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:34.025407 2026] [:error] [pid 3883:tid 3908] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NluA33x90V6yYHahGEQAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:34.917792 2026] [:error] [pid 3883:tid 3894] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NluA33x90V6yYHahGEgAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:36.838560 2026] [:error] [pid 3883:tid 3910] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NmOA33x90V6yYHahGFAAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:37.700585 2026] [:error] [pid 3883:tid 3887] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NmeA33x90V6yYHahGGQAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:40.197863 2026] [:error] [pid 3883:tid 3891] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NnOA33x90V6yYHahGHwAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:41.142519 2026] [:error] [pid 3883:tid 3890] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NneA33x90V6yYHahGJAAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:43.405101 2026] [:error] [pid 3883:tid 3908] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_Nn-A33x90V6yYHahGKwAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:44.342142 2026] [:error] [pid 3883:tid 3904] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NoOA33x90V6yYHahGLQAAAVI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:46.296312 2026] [:error] [pid 3883:tid 3901] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NouA33x90V6yYHahGMQAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:47.255738 2026] [:error] [pid 3883:tid 3888] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_No-A33x90V6yYHahGNAAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:49.349969 2026] [:error] [pid 3883:tid 3887] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NpeA33x90V6yYHahGNwAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:50.465581 2026] [:error] [pid 3883:tid 3886] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NpuA33x90V6yYHahGOQAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:52.648769 2026] [:error] [pid 3883:tid 3898] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NqOA33x90V6yYHahGPgAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:53.698021 2026] [:error] [pid 3883:tid 3902] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NqeA33x90V6yYHahGQAAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:55.898693 2026] [:error] [pid 3883:tid 3894] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_Nq-A33x90V6yYHahGSwAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:56.904695 2026] [:error] [pid 3883:tid 3898] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NrOA33x90V6yYHahGUQAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:35:59.083735 2026] [:error] [pid 3883:tid 3897] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_Nr-A33x90V6yYHahGUwAAAUs"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:00.255151 2026] [:error] [pid 3883:tid 3891] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NsOA33x90V6yYHahGVwAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:02.535763 2026] [:error] [pid 3883:tid 3894] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NsuA33x90V6yYHahGXAAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:03.471749 2026] [:error] [pid 3883:tid 3896] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_Ns-A33x90V6yYHahGYAAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:05.447171 2026] [:error] [pid 3883:tid 3901] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NteA33x90V6yYHahGYwAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:06.449820 2026] [:error] [pid 3883:tid 3907] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NtuA33x90V6yYHahGawAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:08.629227 2026] [:error] [pid 3883:tid 3896] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NuOA33x90V6yYHahGcwAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:09.557058 2026] [:error] [pid 3883:tid 3908] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NueA33x90V6yYHahGdwAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:11.696564 2026] [:error] [pid 3883:tid 3897] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_Nu-A33x90V6yYHahGiQAAAUs"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:12.715204 2026] [:error] [pid 3883:tid 3892] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NvOA33x90V6yYHahGkwAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:14.649739 2026] [:error] [pid 3883:tid 3889] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NvuA33x90V6yYHahGmgAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:15.724751 2026] [:error] [pid 3883:tid 3902] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_Nv-A33x90V6yYHahGnQAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:17.584107 2026] [:error] [pid 3883:tid 3906] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NweA33x90V6yYHahGoAAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:19.579078 2026] [:error] [pid 3883:tid 3906] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_Nw-A33x90V6yYHahGqAAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:21.527753 2026] [:error] [pid 3883:tid 3909] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NxeA33x90V6yYHahGsgAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:22.545933 2026] [:error] [pid 3883:tid 3895] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NxuA33x90V6yYHahGtwAAAUk"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:24.775823 2026] [:error] [pid 3883:tid 3894] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NyOA33x90V6yYHahGwQAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:25.725529 2026] [:error] [pid 3883:tid 3904] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NyeA33x90V6yYHahGxgAAAVI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:27.884919 2026] [:error] [pid 3883:tid 3892] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_Ny-A33x90V6yYHahGzAAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:28.820719 2026] [:error] [pid 3883:tid 3900] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NzOA33x90V6yYHahGzQAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:30.702075 2026] [:error] [pid 3883:tid 3886] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_NzuA33x90V6yYHahG0wAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:31.671712 2026] [:error] [pid 3883:tid 3901] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_Nz-A33x90V6yYHahG1AAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:33.408025 2026] [:error] [pid 3883:tid 3892] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N0eA33x90V6yYHahG3AAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:34.353660 2026] [:error] [pid 3883:tid 3889] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N0uA33x90V6yYHahG4gAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:36.427155 2026] [:error] [pid 3883:tid 3909] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N1OA33x90V6yYHahG7gAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:37.415574 2026] [:error] [pid 3883:tid 3886] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N1eA33x90V6yYHahG8wAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:39.948886 2026] [:error] [pid 3883:tid 3895] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N1-A33x90V6yYHahG_QAAAUk"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:40.790865 2026] [:error] [pid 3883:tid 3901] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N2OA33x90V6yYHahHBQAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:42.859557 2026] [:error] [pid 3883:tid 3890] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N2uA33x90V6yYHahHDgAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:43.860775 2026] [:error] [pid 3883:tid 3900] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N2-A33x90V6yYHahHEgAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:45.819196 2026] [:error] [pid 3883:tid 3898] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N3eA33x90V6yYHahHGwAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:46.633646 2026] [:error] [pid 3883:tid 3889] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N3uA33x90V6yYHahHHQAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:48.494647 2026] [:error] [pid 3883:tid 3899] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N4OA33x90V6yYHahHIwAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:49.388752 2026] [:error] [pid 3883:tid 3891] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N4eA33x90V6yYHahHKAAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:52.643920 2026] [:error] [pid 3883:tid 3892] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N5OA33x90V6yYHahHMAAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:53.573514 2026] [:error] [pid 3883:tid 3907] [client 176.65.132.19:60430] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N5eA33x90V6yYHahHNQAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:56.898192 2026] [:error] [pid 54991:tid 55020] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N6N4Zx-mJ8gbRB2iFkQAAAEA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:36:58.268957 2026] [:error] [pid 54991:tid 55039] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N6t4Zx-mJ8gbRB2iFkgAAAFM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:00.296222 2026] [:error] [pid 54991:tid 55041] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N7N4Zx-mJ8gbRB2iFlAAAAFU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:01.242253 2026] [:error] [pid 54991:tid 55021] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N7d4Zx-mJ8gbRB2iFlQAAAEE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:03.523227 2026] [:error] [pid 54991:tid 55035] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N794Zx-mJ8gbRB2iFlwAAAE8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:04.518933 2026] [:error] [pid 54991:tid 55036] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N8N4Zx-mJ8gbRB2iFmAAAAFA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:06.875974 2026] [:error] [pid 54991:tid 55034] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N8t4Zx-mJ8gbRB2iFmwAAAE4"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:07.889671 2026] [:error] [pid 54991:tid 55026] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N894Zx-mJ8gbRB2iFnAAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:09.971403 2026] [:error] [pid 54991:tid 55032] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N9d4Zx-mJ8gbRB2iFngAAAEw"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:11.064214 2026] [:error] [pid 54991:tid 55027] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N994Zx-mJ8gbRB2iFnwAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:13.616408 2026] [:error] [pid 54991:tid 55033] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N-d4Zx-mJ8gbRB2iFoQAAAE0"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:14.520649 2026] [:error] [pid 54991:tid 55025] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N-t4Zx-mJ8gbRB2iFogAAAEU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:16.430122 2026] [:error] [pid 54991:tid 55043] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N_N4Zx-mJ8gbRB2iFpAAAAFc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:17.363232 2026] [:error] [pid 54991:tid 55042] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N_d4Zx-mJ8gbRB2iFpQAAAFY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:19.446635 2026] [:error] [pid 54991:tid 55038] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_N_94Zx-mJ8gbRB2iFqAAAAFI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:20.481055 2026] [:error] [pid 54991:tid 55041] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_OAN4Zx-mJ8gbRB2iFqQAAAFU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:22.404118 2026] [:error] [pid 54991:tid 55040] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_OAt4Zx-mJ8gbRB2iFqwAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:23.388183 2026] [:error] [pid 54991:tid 55035] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_OA94Zx-mJ8gbRB2iFrAAAAE8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:25.264074 2026] [:error] [pid 54991:tid 55023] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_OBd4Zx-mJ8gbRB2iFrgAAAEM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:26.195819 2026] [:error] [pid 54991:tid 55030] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_OBt4Zx-mJ8gbRB2iFrwAAAEo"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:28.457285 2026] [:error] [pid 54991:tid 55026] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_OCN4Zx-mJ8gbRB2iFsQAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:29.610233 2026] [:error] [pid 54991:tid 55028] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_OCd4Zx-mJ8gbRB2iFsgAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:31.646010 2026] [:error] [pid 54991:tid 55037] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_OC94Zx-mJ8gbRB2iFtAAAAFE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:32.721811 2026] [:error] [pid 54991:tid 55031] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_ODN4Zx-mJ8gbRB2iFtQAAAEs"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:35.166930 2026] [:error] [pid 54991:tid 55022] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_OD94Zx-mJ8gbRB2iFtwAAAEI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:36.254483 2026] [:error] [pid 54991:tid 55033] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_OEN4Zx-mJ8gbRB2iFuAAAAE0"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:38.946999 2026] [:error] [pid 54991:tid 55044] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_OEt4Zx-mJ8gbRB2iFugAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:40.176724 2026] [:error] [pid 54991:tid 55043] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_OFN4Zx-mJ8gbRB2iFuwAAAFc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:42.258337 2026] [:error] [pid 54991:tid 55020] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_OFt4Zx-mJ8gbRB2iFvQAAAEA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:43.185620 2026] [:error] [pid 54991:tid 55024] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_OF94Zx-mJ8gbRB2iFvgAAAEQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:45.371197 2026] [:error] [pid 54991:tid 55040] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_OGd4Zx-mJ8gbRB2iFwgAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:46.264477 2026] [:error] [pid 54991:tid 55035] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_OGt4Zx-mJ8gbRB2iFwwAAAE8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 12:37:48.405014 2026] [:error] [pid 54991:tid 55023] [client 176.65.132.19:61453] [client 176.65.132.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.65.132.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aZ_OHN4Zx-mJ8gbRB2iFxgAAAEM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 13:31:29.069653 2026] [:error] [pid 3883:tid 3906] [client 195.178.110.109:31248] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aZ_aseA33x90V6yYHahkmwAAAVQ"]
[Thu Feb 26 13:31:53.534498 2026] [:error] [pid 25311:tid 25337] [client 195.178.110.109:35390] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aZ_aydfdM__yZAgJFSvZSwAAAZc"]
[Thu Feb 26 13:31:57.166758 2026] [:error] [pid 25311:tid 25323] [client 195.178.110.109:35394] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/portal/.env"] [unique_id "aZ_azdfdM__yZAgJFSvZYAAAAYk"]
[Thu Feb 26 13:31:58.598289 2026] [:error] [pid 25311:tid 25325] [client 195.178.110.109:35398] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/env/.env"] [unique_id "aZ_aztfdM__yZAgJFSvZagAAAYs"]
[Thu Feb 26 13:32:00.049911 2026] [:error] [pid 54990:tid 54996] [client 195.178.110.109:65480] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/api/.env"] [unique_id "aZ_a0Htr2qmt_mBhH2zdgwAAAAM"]
[Thu Feb 26 13:32:01.636918 2026] [:error] [pid 55618:tid 55637] [client 195.178.110.109:65484] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/app/.env"] [unique_id "aZ_a0R61Vrh12f_8oWR5FAAAARA"]
[Thu Feb 26 13:32:04.893401 2026] [:error] [pid 3883:tid 3902] [client 195.178.110.109:65510] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/dev/.env"] [unique_id "aZ_a1OA33x90V6yYHahkvgAAAVA"]
[Thu Feb 26 13:32:06.327638 2026] [:error] [pid 55618:tid 55629] [client 195.178.110.109:65516] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/new/.env"] [unique_id "aZ_a1h61Vrh12f_8oWR5GwAAAQg"]
[Thu Feb 26 13:32:07.529200 2026] [:error] [pid 55618:tid 55634] [client 195.178.110.109:65522] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/new/.env.local"] [unique_id "aZ_a1x61Vrh12f_8oWR5HQAAAQ0"]
[Thu Feb 26 13:32:08.711995 2026] [:error] [pid 3883:tid 3901] [client 195.178.110.109:1026] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/new/.env.production"] [unique_id "aZ_a2OA33x90V6yYHahkxQAAAU8"]
[Thu Feb 26 13:32:09.911907 2026] [:error] [pid 54990:tid 54997] [client 195.178.110.109:1506] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/new/.env.staging"] [unique_id "aZ_a2Xtr2qmt_mBhH2zdigAAAAQ"]
[Thu Feb 26 13:32:26.176858 2026] [:error] [pid 55618:tid 55642] [client 195.178.110.109:46192] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/awstats/.env"] [unique_id "aZ_a6h61Vrh12f_8oWR5PAAAARU"]
[Thu Feb 26 13:32:27.603822 2026] [:error] [pid 54990:tid 54999] [client 195.178.110.109:46198] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/conf/.env"] [unique_id "aZ_a63tr2qmt_mBhH2zdqgAAAAY"]
[Thu Feb 26 13:32:28.985446 2026] [:error] [pid 25311:tid 25314] [client 195.178.110.109:46202] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/cron/.env"] [unique_id "aZ_a7NfdM__yZAgJFSvZ0QAAAYA"]
[Thu Feb 26 13:32:30.290903 2026] [:error] [pid 25311:tid 25329] [client 195.178.110.109:26922] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/www/.env"] [unique_id "aZ_a7tfdM__yZAgJFSvZ1gAAAY8"]
[Thu Feb 26 13:32:32.316791 2026] [:error] [pid 25311:tid 25314] [client 195.178.110.109:26938] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/docker/.env"] [unique_id "aZ_a8NfdM__yZAgJFSvZ5wAAAYA"]
[Thu Feb 26 13:32:33.572362 2026] [:error] [pid 55618:tid 55630] [client 195.178.110.109:26944] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/docker/app/.env"] [unique_id "aZ_a8R61Vrh12f_8oWR5SAAAAQk"]
[Thu Feb 26 13:32:34.973261 2026] [:error] [pid 55122:tid 55124] [client 195.178.110.109:26950] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/env.backup"] [unique_id "aZ_a8oLiR0OfjFxvcN--LgAAAMA"]
[Thu Feb 26 13:32:36.792669 2026] [:error] [pid 55122:tid 55128] [client 195.178.110.109:26950] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/info.php"] [unique_id "aZ_a9ILiR0OfjFxvcN--MwAAAMQ"]
[Thu Feb 26 13:32:38.372476 2026] [:error] [pid 54990:tid 55000] [client 195.178.110.109:26954] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/info.php"] [unique_id "aZ_a9ntr2qmt_mBhH2zdrwAAAAc"]
[Thu Feb 26 13:32:39.722485 2026] [:error] [pid 3883:tid 3900] [client 195.178.110.109:35196] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/info.php"] [unique_id "aZ_a9-A33x90V6yYHahk7QAAAU4"]
[Thu Feb 26 13:32:41.040440 2026] [:error] [pid 3883:tid 3892] [client 195.178.110.109:35202] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/info.php"] [unique_id "aZ_a-eA33x90V6yYHahk8AAAAUY"]
[Thu Feb 26 13:32:43.555793 2026] [:error] [pid 3883:tid 3898] [client 195.178.110.109:35254] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/info.php"] [unique_id "aZ_a--A33x90V6yYHahlJAAAAUw"]
[Thu Feb 26 13:32:44.970440 2026] [:error] [pid 55618:tid 55624] [client 195.178.110.109:35274] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/info.php"] [unique_id "aZ_a_B61Vrh12f_8oWR5XAAAAQM"]
[Thu Feb 26 13:32:46.337872 2026] [:error] [pid 54991:tid 55037] [client 195.178.110.109:35298] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/info.php"] [unique_id "aZ_a_t4Zx-mJ8gbRB2iNLAAAAFE"]
[Thu Feb 26 13:32:48.652977 2026] [:error] [pid 55618:tid 55642] [client 195.178.110.109:35320] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/info.php"] [unique_id "aZ_bAB61Vrh12f_8oWR5YgAAARU"]
[Thu Feb 26 13:32:50.005806 2026] [:error] [pid 54991:tid 55032] [client 195.178.110.109:64662] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/info.php"] [unique_id "aZ_bAt4Zx-mJ8gbRB2iNLwAAAEw"]
[Thu Feb 26 13:32:51.281268 2026] [:error] [pid 3883:tid 3896] [client 195.178.110.109:64676] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/info.php"] [unique_id "aZ_bA-A33x90V6yYHahlMAAAAUo"]
[Thu Feb 26 13:32:52.675782 2026] [:error] [pid 3883:tid 3889] [client 195.178.110.109:64696] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/info.php"] [unique_id "aZ_bBOA33x90V6yYHahlMwAAAUM"]
[Thu Feb 26 13:32:53.854265 2026] [:error] [pid 54990:tid 54995] [client 195.178.110.109:64698] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/phpinfo.php"] [unique_id "aZ_bBXtr2qmt_mBhH2zdtgAAAAI"]
[Thu Feb 26 13:32:55.282962 2026] [:error] [pid 55122:tid 55137] [client 195.178.110.109:64708] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/phpinfo.php"] [unique_id "aZ_bB4LiR0OfjFxvcN--QQAAAM0"]
[Thu Feb 26 13:32:56.634698 2026] [:error] [pid 3883:tid 3898] [client 195.178.110.109:64718] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/phpinfo.php"] [unique_id "aZ_bCOA33x90V6yYHahlPQAAAUw"]
[Thu Feb 26 13:32:58.828915 2026] [:error] [pid 3883:tid 3907] [client 195.178.110.109:64734] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/phpinfo.php"] [unique_id "aZ_bCuA33x90V6yYHahlSQAAAVU"]
[Thu Feb 26 13:32:59.965008 2026] [:error] [pid 25311:tid 25323] [client 195.178.110.109:39354] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/phpinfo.php"] [unique_id "aZ_bC9fdM__yZAgJFSvacQAAAYk"]
[Thu Feb 26 13:33:01.150770 2026] [:error] [pid 3883:tid 3892] [client 195.178.110.109:39368] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/phpinfo.php"] [unique_id "aZ_bDeA33x90V6yYHahlUAAAAUY"]
[Thu Feb 26 13:33:02.294880 2026] [:error] [pid 25311:tid 25329] [client 195.178.110.109:39378] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/phpinfo.php"] [unique_id "aZ_bDtfdM__yZAgJFSvaewAAAY8"]
[Thu Feb 26 13:33:04.369852 2026] [:error] [pid 55122:tid 55145] [client 195.178.110.109:39400] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/phpinfo.php"] [unique_id "aZ_bEILiR0OfjFxvcN--SgAAANU"]
[Thu Feb 26 13:33:05.524712 2026] [:error] [pid 3883:tid 3908] [client 195.178.110.109:39402] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/phpinfo.php"] [unique_id "aZ_bEeA33x90V6yYHahlUwAAAVY"]
[Thu Feb 26 13:33:06.626269 2026] [:error] [pid 25311:tid 25331] [client 195.178.110.109:39408] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/phpinfo.php"] [unique_id "aZ_bEtfdM__yZAgJFSvajAAAAZE"]
[Thu Feb 26 13:33:07.740509 2026] [:error] [pid 54991:tid 55042] [client 195.178.110.109:39424] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lara/phpinfo.php"] [unique_id "aZ_bE94Zx-mJ8gbRB2iNNQAAAFY"]
[Thu Feb 26 13:33:09.756629 2026] [:error] [pid 55618:tid 55629] [client 195.178.110.109:35156] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/laravel/info.php"] [unique_id "aZ_bFR61Vrh12f_8oWR5nwAAAQg"]
[Thu Feb 26 13:33:10.834615 2026] [:error] [pid 55618:tid 55632] [client 195.178.110.109:35162] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/laravel/info.php"] [unique_id "aZ_bFh61Vrh12f_8oWR5pAAAAQs"]
[Thu Feb 26 13:33:11.928644 2026] [:error] [pid 55051:tid 55074] [client 195.178.110.109:35164] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/laravel/info.php"] [unique_id "aZ_bFwmK1w2kZvh5eLHkJQAAAJQ"]
[Thu Feb 26 13:33:13.044435 2026] [:error] [pid 55051:tid 55070] [client 195.178.110.109:35172] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/laravel/info.php"] [unique_id "aZ_bGQmK1w2kZvh5eLHkKAAAAJA"]
[Thu Feb 26 13:33:15.020894 2026] [:error] [pid 25311:tid 25332] [client 195.178.110.109:35182] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/laravel/info.php"] [unique_id "aZ_bG9fdM__yZAgJFSvaowAAAZI"]
[Thu Feb 26 13:33:16.387005 2026] [:error] [pid 55051:tid 55055] [client 195.178.110.109:35184] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/laravel/info.php"] [unique_id "aZ_bHAmK1w2kZvh5eLHkKgAAAIE"]
[Thu Feb 26 13:33:17.699371 2026] [:error] [pid 55618:tid 55641] [client 195.178.110.109:35192] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/laravel/info.php"] [unique_id "aZ_bHR61Vrh12f_8oWR5vQAAARQ"]
[Thu Feb 26 13:33:20.428227 2026] [:error] [pid 55618:tid 55623] [client 195.178.110.109:16022] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/laravel/info.php"] [unique_id "aZ_bIB61Vrh12f_8oWR5ygAAAQI"]
[Thu Feb 26 13:33:21.795992 2026] [:error] [pid 3883:tid 3903] [client 195.178.110.109:16030] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/laravel/info.php"] [unique_id "aZ_bIeA33x90V6yYHahlXAAAAVE"]
[Thu Feb 26 13:33:23.223784 2026] [:error] [pid 54991:tid 55034] [client 195.178.110.109:16038] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/laravel/info.php"] [unique_id "aZ_bI94Zx-mJ8gbRB2iNOAAAAE4"]
[Thu Feb 26 13:33:25.555930 2026] [:error] [pid 54991:tid 55040] [client 195.178.110.109:16046] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.vscode/.env"] [unique_id "aZ_bJd4Zx-mJ8gbRB2iNOgAAAFQ"]
[Thu Feb 26 13:33:26.815124 2026] [:error] [pid 55051:tid 55060] [client 195.178.110.109:16060] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/js/.env"] [unique_id "aZ_bJgmK1w2kZvh5eLHkMQAAAIY"]
[Thu Feb 26 13:33:28.280159 2026] [:error] [pid 55051:tid 55066] [client 195.178.110.109:16068] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/laravel/.env"] [unique_id "aZ_bKAmK1w2kZvh5eLHkNQAAAIw"]
[Thu Feb 26 13:33:29.540327 2026] [:error] [pid 54991:tid 55035] [client 195.178.110.109:26430] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/laravel/core/.env"] [unique_id "aZ_bKd4Zx-mJ8gbRB2iNPAAAAE8"]
[Thu Feb 26 13:33:30.677201 2026] [:error] [pid 55122:tid 55137] [client 195.178.110.109:26442] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/mail/.env"] [unique_id "aZ_bKoLiR0OfjFxvcN--XAAAAM0"]
[Thu Feb 26 13:33:31.883998 2026] [:error] [pid 3883:tid 3890] [client 195.178.110.109:26444] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/mailer/.env"] [unique_id "aZ_bK-A33x90V6yYHahlfAAAAUQ"]
[Thu Feb 26 13:33:33.337109 2026] [:error] [pid 3883:tid 3900] [client 195.178.110.109:26454] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/nginx/.env"] [unique_id "aZ_bLeA33x90V6yYHahlhwAAAU4"]
[Thu Feb 26 13:33:34.463882 2026] [:error] [pid 25311:tid 25327] [client 195.178.110.109:26466] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/public/.env"] [unique_id "aZ_bLtfdM__yZAgJFSvaxwAAAY0"]
[Thu Feb 26 13:33:35.613123 2026] [:error] [pid 54991:tid 55039] [client 195.178.110.109:26478] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/site/.env"] [unique_id "aZ_bL94Zx-mJ8gbRB2iNQgAAAFM"]
[Thu Feb 26 13:33:36.757871 2026] [:error] [pid 55618:tid 55636] [client 195.178.110.109:26486] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/xampp/.env"] [unique_id "aZ_bMB61Vrh12f_8oWR53gAAAQ8"]
[Thu Feb 26 13:33:37.998125 2026] [:error] [pid 3883:tid 3894] [client 195.178.110.109:26496] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/main/.env"] [unique_id "aZ_bMeA33x90V6yYHahlnwAAAUg"]
[Thu Feb 26 13:33:39.131044 2026] [:error] [pid 3883:tid 3907] [client 195.178.110.109:26502] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/node_modules/.env"] [unique_id "aZ_bM-A33x90V6yYHahlpwAAAVU"]
[Thu Feb 26 13:33:40.274157 2026] [:error] [pid 3883:tid 3887] [client 195.178.110.109:19824] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/kyc/.env"] [unique_id "aZ_bNOA33x90V6yYHahlsQAAAUE"]
[Thu Feb 26 13:33:41.387781 2026] [:error] [pid 55618:tid 55628] [client 195.178.110.109:19838] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/admin/.env"] [unique_id "aZ_bNR61Vrh12f_8oWR54gAAAQc"]
[Thu Feb 26 13:33:42.653737 2026] [:error] [pid 55122:tid 55138] [client 195.178.110.109:19844] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/prod/.env"] [unique_id "aZ_bNoLiR0OfjFxvcN--aQAAAM4"]
[Thu Feb 26 13:33:43.854963 2026] [:error] [pid 55122:tid 55128] [client 195.178.110.109:19854] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.bak"] [unique_id "aZ_bN4LiR0OfjFxvcN--cAAAAMQ"]
[Thu Feb 26 13:33:49.946989 2026] [:error] [pid 3883:tid 3905] [client 195.178.110.109:19880] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/website/.env"] [unique_id "aZ_bPeA33x90V6yYHahl4AAAAVM"]
[Thu Feb 26 13:33:51.103711 2026] [:error] [pid 55618:tid 55630] [client 195.178.110.109:9528] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/development/.env"] [unique_id "aZ_bPx61Vrh12f_8oWR57AAAAQk"]
[Thu Feb 26 13:33:52.297603 2026] [:error] [pid 3883:tid 3906] [client 195.178.110.109:9530] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/backend/.env"] [unique_id "aZ_bQOA33x90V6yYHahl6wAAAVQ"]
[Thu Feb 26 13:33:53.638833 2026] [:error] [pid 3883:tid 3908] [client 195.178.110.109:9532] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/api/shared/config/.env"] [unique_id "aZ_bQeA33x90V6yYHahl9AAAAVY"]
[Thu Feb 26 13:33:55.023320 2026] [:error] [pid 25311:tid 25327] [client 195.178.110.109:9546] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/api/shared/.env"] [unique_id "aZ_bQ9fdM__yZAgJFSva2wAAAY0"]
[Thu Feb 26 13:33:58.494683 2026] [:error] [pid 55618:tid 55641] [client 195.178.110.109:9560] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/node/.env_example"] [unique_id "aZ_bRh61Vrh12f_8oWR59gAAARQ"]
[Thu Feb 26 13:33:59.626551 2026] [:error] [pid 55051:tid 55069] [client 195.178.110.109:29702] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.production.local"] [unique_id "aZ_bRwmK1w2kZvh5eLHkUgAAAI8"]
[Thu Feb 26 13:34:00.827477 2026] [:error] [pid 55051:tid 55061] [client 195.178.110.109:29716] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.local"] [unique_id "aZ_bSAmK1w2kZvh5eLHkVwAAAIc"]
[Thu Feb 26 13:34:01.984017 2026] [:error] [pid 3883:tid 3893] [client 195.178.110.109:29728] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.example"] [unique_id "aZ_bSeA33x90V6yYHahmGQAAAUc"]
[Thu Feb 26 13:34:03.465664 2026] [:error] [pid 54991:tid 55040] [client 195.178.110.109:29730] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.stage"] [unique_id "aZ_bS94Zx-mJ8gbRB2iNWAAAAFQ"]
[Thu Feb 26 13:34:06.023214 2026] [:error] [pid 3883:tid 3900] [client 195.178.110.109:29734] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.old"] [unique_id "aZ_bTuA33x90V6yYHahmMgAAAU4"]
[Thu Feb 26 13:34:07.148329 2026] [:error] [pid 3883:tid 3896] [client 195.178.110.109:29746] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env_sample"] [unique_id "aZ_bT-A33x90V6yYHahmOgAAAUo"]
[Thu Feb 26 13:34:09.722617 2026] [:error] [pid 25311:tid 25314] [client 195.178.110.109:29758] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.prod"] [unique_id "aZ_bUdfdM__yZAgJFSvbJgAAAYA"]
[Thu Feb 26 13:34:10.877892 2026] [:error] [pid 55122:tid 55127] [client 195.178.110.109:30080] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/crm/.env"] [unique_id "aZ_bUoLiR0OfjFxvcN--mQAAAMM"]
[Thu Feb 26 13:34:12.046574 2026] [:error] [pid 3883:tid 3890] [client 195.178.110.109:30088] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/local/.env"] [unique_id "aZ_bVOA33x90V6yYHahmSAAAAUQ"]
[Thu Feb 26 13:34:13.292894 2026] [:error] [pid 55618:tid 55636] [client 195.178.110.109:30100] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/core/.env"] [unique_id "aZ_bVR61Vrh12f_8oWR6EwAAAQ8"]
[Thu Feb 26 13:34:14.507387 2026] [:error] [pid 55051:tid 55060] [client 195.178.110.109:30116] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/apps/.env"] [unique_id "aZ_bVgmK1w2kZvh5eLHkaQAAAIY"]
[Thu Feb 26 13:34:16.021160 2026] [:error] [pid 3883:tid 3910] [client 195.178.110.109:30124] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/application/.env"] [unique_id "aZ_bWOA33x90V6yYHahmWQAAAVg"]
[Thu Feb 26 13:34:17.241568 2026] [:error] [pid 25311:tid 25319] [client 195.178.110.109:30130] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/web/.env"] [unique_id "aZ_bWdfdM__yZAgJFSvbKQAAAYU"]
[Thu Feb 26 13:34:19.749172 2026] [:error] [pid 55122:tid 55129] [client 195.178.110.109:30144] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.bak"] [unique_id "aZ_bW4LiR0OfjFxvcN--ogAAAMU"]
[Thu Feb 26 13:34:24.210530 2026] [:error] [pid 55122:tid 55127] [client 195.178.110.109:62316] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/2.ca066a4b.chunk.js"] [unique_id "aZ_bYILiR0OfjFxvcN--qQAAAMM"]
[Thu Feb 26 13:34:25.669490 2026] [:error] [pid 54991:tid 55032] [client 195.178.110.109:62320] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/2.ca066a4b.chunk.js"] [unique_id "aZ_bYd4Zx-mJ8gbRB2iNYAAAAEw"]
[Thu Feb 26 13:34:26.924328 2026] [:error] [pid 3883:tid 3901] [client 195.178.110.109:62326] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/2.ca066a4b.chunk.js"] [unique_id "aZ_bYuA33x90V6yYHahmiAAAAU8"]
[Thu Feb 26 13:34:28.615475 2026] [:error] [pid 54990:tid 54999] [client 195.178.110.109:62328] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/2.ca066a4b.chunk.js"] [unique_id "aZ_bZHtr2qmt_mBhH2zeIQAAAAY"]
[Thu Feb 26 13:34:30.236626 2026] [:error] [pid 25311:tid 25315] [client 195.178.110.109:48082] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/2.ca066a4b.chunk.js"] [unique_id "aZ_bZtfdM__yZAgJFSvbSAAAAYE"]
[Thu Feb 26 13:34:31.500924 2026] [:error] [pid 25311:tid 25334] [client 195.178.110.109:48086] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/2.ca066a4b.chunk.js"] [unique_id "aZ_bZ9fdM__yZAgJFSvbSgAAAZQ"]
[Thu Feb 26 13:34:32.742745 2026] [:error] [pid 55618:tid 55641] [client 195.178.110.109:48102] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/2.ca066a4b.chunk.js"] [unique_id "aZ_baB61Vrh12f_8oWR6KQAAARQ"]
[Thu Feb 26 13:34:34.253796 2026] [:error] [pid 25311:tid 25331] [client 195.178.110.109:48108] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/2.ca066a4b.chunk.js"] [unique_id "aZ_batfdM__yZAgJFSvbUwAAAZE"]
[Thu Feb 26 13:34:35.241545 2026] [:error] [pid 55051:tid 55077] [client 195.178.110.109:48122] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/2.ca066a4b.chunk.js"] [unique_id "aZ_bawmK1w2kZvh5eLHkdAAAAJc"]
[Thu Feb 26 13:34:36.455762 2026] [:error] [pid 25311:tid 25328] [client 195.178.110.109:48130] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/2.ca066a4b.chunk.js"] [unique_id "aZ_bbNfdM__yZAgJFSvbXwAAAY4"]
[Thu Feb 26 13:34:37.535845 2026] [:error] [pid 55051:tid 55065] [client 195.178.110.109:48142] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/2.ca066a4b.chunk.js"] [unique_id "aZ_bbQmK1w2kZvh5eLHkfgAAAIs"]
[Thu Feb 26 13:34:38.644438 2026] [:error] [pid 55618:tid 55635] [client 195.178.110.109:48144] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/2.ca066a4b.chunk.js"] [unique_id "aZ_bbh61Vrh12f_8oWR6PQAAAQ4"]
[Thu Feb 26 13:34:40.660126 2026] [:error] [pid 25311:tid 25316] [client 195.178.110.109:23566] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/main.e85f7a37.js"] [unique_id "aZ_bcNfdM__yZAgJFSvbfAAAAYI"]
[Thu Feb 26 13:34:41.716620 2026] [:error] [pid 55618:tid 55625] [client 195.178.110.109:23574] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/main.e85f7a37.js"] [unique_id "aZ_bcR61Vrh12f_8oWR6RAAAAQQ"]
[Thu Feb 26 13:34:42.862819 2026] [:error] [pid 25311:tid 25338] [client 195.178.110.109:23578] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/main.e85f7a37.js"] [unique_id "aZ_bctfdM__yZAgJFSvbkwAAAZg"]
[Thu Feb 26 13:34:43.979977 2026] [:error] [pid 25311:tid 25318] [client 195.178.110.109:23584] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/main.e85f7a37.js"] [unique_id "aZ_bc9fdM__yZAgJFSvbnAAAAYQ"]
[Thu Feb 26 13:34:45.953046 2026] [:error] [pid 55122:tid 55128] [client 195.178.110.109:23594] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/main.e85f7a37.js"] [unique_id "aZ_bdYLiR0OfjFxvcN--ygAAAMQ"]
[Thu Feb 26 13:34:47.429099 2026] [:error] [pid 25311:tid 25330] [client 195.178.110.109:23610] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/main.e85f7a37.js"] [unique_id "aZ_bd9fdM__yZAgJFSvbtwAAAZA"]
[Thu Feb 26 13:34:48.526755 2026] [:error] [pid 3883:tid 3893] [client 195.178.110.109:23612] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/main.e85f7a37.js"] [unique_id "aZ_beOA33x90V6yYHahmkAAAAUc"]
[Thu Feb 26 13:34:49.582583 2026] [:error] [pid 25311:tid 25327] [client 195.178.110.109:2690] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/main.e85f7a37.js"] [unique_id "aZ_bedfdM__yZAgJFSvb2gAAAY0"]
[Thu Feb 26 13:34:51.674428 2026] [:error] [pid 55618:tid 55645] [client 195.178.110.109:2712] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/main.e85f7a37.js"] [unique_id "aZ_bex61Vrh12f_8oWR6UQAAARg"]
[Thu Feb 26 13:34:52.745513 2026] [:error] [pid 25311:tid 25336] [client 195.178.110.109:2722] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/main.e85f7a37.js"] [unique_id "aZ_bfNfdM__yZAgJFSvb9AAAAZY"]
[Thu Feb 26 13:34:53.832915 2026] [:error] [pid 25311:tid 25330] [client 195.178.110.109:2736] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/main.e85f7a37.js"] [unique_id "aZ_bfdfdM__yZAgJFSvcAAAAAZA"]
[Thu Feb 26 13:34:54.975118 2026] [:error] [pid 55618:tid 55640] [client 195.178.110.109:2748] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/static/js/main.e85f7a37.js"] [unique_id "aZ_bfh61Vrh12f_8oWR6VQAAARM"]
[Thu Feb 26 13:34:56.970234 2026] [:error] [pid 54991:tid 55041] [client 195.178.110.109:2762] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/server_info.php"] [unique_id "aZ_bgN4Zx-mJ8gbRB2iNcwAAAFU"]
[Thu Feb 26 13:34:58.040717 2026] [:error] [pid 25311:tid 25317] [client 195.178.110.109:2776] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/server_info.php"] [unique_id "aZ_bgtfdM__yZAgJFSvcFwAAAYM"]
[Thu Feb 26 13:34:59.093512 2026] [:error] [pid 55051:tid 55055] [client 195.178.110.109:2782] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/server_info.php"] [unique_id "aZ_bgwmK1w2kZvh5eLHkjAAAAIE"]
[Thu Feb 26 13:35:00.115576 2026] [:error] [pid 54990:tid 55001] [client 195.178.110.109:36146] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/server_info.php"] [unique_id "aZ_bhHtr2qmt_mBhH2zePgAAAAg"]
[Thu Feb 26 13:35:02.137405 2026] [:error] [pid 25311:tid 25332] [client 195.178.110.109:36172] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/server_info.php"] [unique_id "aZ_bhtfdM__yZAgJFSvcJAAAAZI"]
[Thu Feb 26 13:35:03.199639 2026] [:error] [pid 55122:tid 55140] [client 195.178.110.109:36186] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/server_info.php"] [unique_id "aZ_bh4LiR0OfjFxvcN--1gAAANA"]
[Thu Feb 26 13:35:04.494381 2026] [:error] [pid 55122:tid 55127] [client 195.178.110.109:36190] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/server_info.php"] [unique_id "aZ_biILiR0OfjFxvcN--2AAAAMM"]
[Thu Feb 26 13:35:05.549172 2026] [:error] [pid 54991:tid 55027] [client 195.178.110.109:36200] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/server_info.php"] [unique_id "aZ_bid4Zx-mJ8gbRB2iNfAAAAEc"]
[Thu Feb 26 13:35:07.808901 2026] [:error] [pid 54991:tid 55024] [client 195.178.110.109:36216] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/server_info.php"] [unique_id "aZ_bi94Zx-mJ8gbRB2iNfgAAAEQ"]
[Thu Feb 26 13:35:08.874178 2026] [:error] [pid 25311:tid 25323] [client 195.178.110.109:36226] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/server_info.php"] [unique_id "aZ_bjNfdM__yZAgJFSvcQAAAAYk"]
[Thu Feb 26 13:35:09.983341 2026] [:error] [pid 54991:tid 55021] [client 195.178.110.109:6224] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/server_info.php"] [unique_id "aZ_bjd4Zx-mJ8gbRB2iNhAAAAEE"]
[Thu Feb 26 13:35:11.040567 2026] [:error] [pid 55051:tid 55067] [client 195.178.110.109:6236] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/server_info.php"] [unique_id "aZ_bjwmK1w2kZvh5eLHkoQAAAI0"]
[Thu Feb 26 13:35:12.982755 2026] [:error] [pid 55122:tid 55142] [client 195.178.110.109:6256] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server_info.php"] [unique_id "aZ_bkILiR0OfjFxvcN--5QAAANI"]
[Thu Feb 26 13:35:14.050287 2026] [:error] [pid 25311:tid 25328] [client 195.178.110.109:6270] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server_info.php"] [unique_id "aZ_bktfdM__yZAgJFSvcWAAAAY4"]
[Thu Feb 26 13:35:15.087744 2026] [:error] [pid 25311:tid 25324] [client 195.178.110.109:6282] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server_info.php"] [unique_id "aZ_bk9fdM__yZAgJFSvcYQAAAYo"]
[Thu Feb 26 13:35:16.135142 2026] [:error] [pid 55618:tid 55625] [client 195.178.110.109:6294] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server_info.php"] [unique_id "aZ_blB61Vrh12f_8oWR6bAAAAQQ"]
[Thu Feb 26 13:35:18.023500 2026] [:error] [pid 55051:tid 55058] [client 195.178.110.109:6316] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server_info.php"] [unique_id "aZ_blgmK1w2kZvh5eLHkqgAAAIQ"]
[Thu Feb 26 13:35:19.084535 2026] [:error] [pid 3883:tid 3905] [client 195.178.110.109:6324] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server_info.php"] [unique_id "aZ_bl-A33x90V6yYHahmqgAAAVM"]
[Thu Feb 26 13:35:20.135144 2026] [:error] [pid 3883:tid 3909] [client 195.178.110.109:45030] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server_info.php"] [unique_id "aZ_bmOA33x90V6yYHahmsAAAAVc"]
[Thu Feb 26 13:35:21.211982 2026] [:error] [pid 3883:tid 3891] [client 195.178.110.109:45042] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server_info.php"] [unique_id "aZ_bmeA33x90V6yYHahmtwAAAUU"]
[Thu Feb 26 13:35:26.818275 2026] [authz_host:error] [pid 55618:tid 55623] [client 195.178.110.109:45054] AH01753: access check of '.example.com' to /server-info failed, reason: unable to get the remote host name
[Thu Feb 26 13:35:26.818346 2026] [authz_core:error] [pid 55618:tid 55623] [client 195.178.110.109:45054] AH01630: client denied by server configuration: /home/expressi/public_html/server-info
[Thu Feb 26 13:35:35.994998 2026] [:error] [pid 25311:tid 25327] [client 195.178.110.109:45060] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aZ_bp9fdM__yZAgJFSvcpAAAAY0"]
[Thu Feb 26 13:35:37.438631 2026] [:error] [pid 25311:tid 25315] [client 195.178.110.109:50214] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aZ_bqdfdM__yZAgJFSvcqgAAAYE"]
[Thu Feb 26 13:35:38.478773 2026] [:error] [pid 25311:tid 25314] [client 195.178.110.109:50224] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aZ_bqtfdM__yZAgJFSvcrwAAAYA"]
[Thu Feb 26 13:35:39.545588 2026] [:error] [pid 3883:tid 3890] [client 195.178.110.109:40936] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aZ_bq-A33x90V6yYHahmxQAAAUQ"]
[Thu Feb 26 13:35:40.690542 2026] [:error] [pid 55618:tid 55635] [client 195.178.110.109:40938] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aZ_brB61Vrh12f_8oWR6mgAAAQ4"]
[Thu Feb 26 13:35:41.797051 2026] [:error] [pid 55051:tid 55067] [client 195.178.110.109:40948] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aZ_brQmK1w2kZvh5eLHktAAAAI0"]
[Thu Feb 26 13:35:42.846625 2026] [:error] [pid 3883:tid 3894] [client 195.178.110.109:40958] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aZ_bruA33x90V6yYHahmywAAAUg"]
[Thu Feb 26 13:35:43.879600 2026] [:error] [pid 3883:tid 3888] [client 195.178.110.109:40974] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aZ_br-A33x90V6yYHahmzwAAAUI"]
[Thu Feb 26 13:35:44.959269 2026] [:error] [pid 3883:tid 3910] [client 195.178.110.109:40978] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aZ_bsOA33x90V6yYHahm6wAAAVg"]
[Thu Feb 26 13:35:45.999512 2026] [:error] [pid 55051:tid 55068] [client 195.178.110.109:40986] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aZ_bsQmK1w2kZvh5eLHktwAAAI4"]
[Thu Feb 26 13:35:46.905156 2026] [:error] [pid 3883:tid 3888] [client 195.178.110.109:40990] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aZ_bsuA33x90V6yYHahnBQAAAUI"]
[Thu Feb 26 13:35:47.945480 2026] [:error] [pid 55122:tid 55132] [client 195.178.110.109:41006] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aZ_bs4LiR0OfjFxvcN--9AAAAMg"]
[Thu Feb 26 13:35:48.962514 2026] [:error] [pid 25311:tid 25324] [client 195.178.110.109:41020] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aZ_btNfdM__yZAgJFSvc2wAAAYo"]
[Thu Feb 26 13:35:49.992501 2026] [:error] [pid 25311:tid 25328] [client 195.178.110.109:25910] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aZ_btdfdM__yZAgJFSvc3gAAAY4"]
[Thu Feb 26 13:35:51.070255 2026] [:error] [pid 25311:tid 25331] [client 195.178.110.109:25918] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.json"] [unique_id "aZ_bt9fdM__yZAgJFSvc4QAAAZE"]
[Thu Feb 26 13:35:51.943331 2026] [:error] [pid 55618:tid 55625] [client 195.178.110.109:25928] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.js"] [unique_id "aZ_btx61Vrh12f_8oWR6ngAAAQQ"]
[Thu Feb 26 13:35:53.159221 2026] [:error] [pid 25311:tid 25327] [client 195.178.110.109:25930] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.js"] [unique_id "aZ_budfdM__yZAgJFSvc6AAAAY0"]
[Thu Feb 26 13:35:54.221901 2026] [:error] [pid 25311:tid 25322] [client 195.178.110.109:25946] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.js"] [unique_id "aZ_butfdM__yZAgJFSvc8gAAAYg"]
[Thu Feb 26 13:35:55.277746 2026] [:error] [pid 25311:tid 25315] [client 195.178.110.109:25948] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.js"] [unique_id "aZ_bu9fdM__yZAgJFSvc_wAAAYE"]
[Thu Feb 26 13:35:57.242459 2026] [:error] [pid 54991:tid 55027] [client 195.178.110.109:25968] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.js"] [unique_id "aZ_bvd4Zx-mJ8gbRB2iNtQAAAEc"]
[Thu Feb 26 13:35:58.394278 2026] [:error] [pid 54991:tid 55039] [client 195.178.110.109:25970] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.js"] [unique_id "aZ_bvt4Zx-mJ8gbRB2iNuQAAAFM"]
[Thu Feb 26 13:35:59.487974 2026] [:error] [pid 55051:tid 55074] [client 195.178.110.109:35548] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.js"] [unique_id "aZ_bvwmK1w2kZvh5eLHkvwAAAJQ"]
[Thu Feb 26 13:36:00.505271 2026] [:error] [pid 25311:tid 25314] [client 195.178.110.109:35554] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.js"] [unique_id "aZ_bwNfdM__yZAgJFSvdEQAAAYA"]
[Thu Feb 26 13:36:02.409941 2026] [:error] [pid 55618:tid 55630] [client 195.178.110.109:35566] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.js"] [unique_id "aZ_bwh61Vrh12f_8oWR6rAAAAQk"]
[Thu Feb 26 13:36:03.436276 2026] [:error] [pid 54990:tid 55004] [client 195.178.110.109:35582] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.js"] [unique_id "aZ_bw3tr2qmt_mBhH2zeVQAAAAs"]
[Thu Feb 26 13:36:04.496666 2026] [:error] [pid 25311:tid 25329] [client 195.178.110.109:35584] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.js"] [unique_id "aZ_bxNfdM__yZAgJFSvdFQAAAY8"]
[Thu Feb 26 13:36:05.532807 2026] [:error] [pid 55618:tid 55634] [client 195.178.110.109:35594] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.js"] [unique_id "aZ_bxR61Vrh12f_8oWR6twAAAQ0"]
[Thu Feb 26 13:36:06.582819 2026] [:error] [pid 55618:tid 55626] [client 195.178.110.109:35602] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.js"] [unique_id "aZ_bxh61Vrh12f_8oWR6uQAAAQU"]
[Thu Feb 26 13:36:07.499732 2026] [:error] [pid 3883:tid 3904] [client 195.178.110.109:35612] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config/constants.js"] [unique_id "aZ_bx-A33x90V6yYHahnHQAAAVI"]
[Thu Feb 26 13:36:08.522782 2026] [:error] [pid 3883:tid 3907] [client 195.178.110.109:35620] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config/constants.js"] [unique_id "aZ_byOA33x90V6yYHahnHwAAAVU"]
[Thu Feb 26 13:36:09.588307 2026] [:error] [pid 25311:tid 25324] [client 195.178.110.109:64762] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config/constants.js"] [unique_id "aZ_bydfdM__yZAgJFSvdHwAAAYo"]
[Thu Feb 26 13:36:10.579467 2026] [:error] [pid 54990:tid 54995] [client 195.178.110.109:64774] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config/constants.js"] [unique_id "aZ_byntr2qmt_mBhH2zeWAAAAAI"]
[Thu Feb 26 13:36:11.561704 2026] [:error] [pid 25311:tid 25337] [client 195.178.110.109:64778] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config/constants.js"] [unique_id "aZ_by9fdM__yZAgJFSvdJQAAAZc"]
[Thu Feb 26 13:36:12.514795 2026] [:error] [pid 25311:tid 25315] [client 195.178.110.109:64788] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config/constants.js"] [unique_id "aZ_bzNfdM__yZAgJFSvdLQAAAYE"]
[Thu Feb 26 13:36:13.517885 2026] [:error] [pid 3883:tid 3887] [client 195.178.110.109:64804] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config/constants.js"] [unique_id "aZ_bzeA33x90V6yYHahnIwAAAUE"]
[Thu Feb 26 13:36:14.506640 2026] [:error] [pid 55122:tid 55143] [client 195.178.110.109:64812] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config/constants.js"] [unique_id "aZ_bzoLiR0OfjFxvcN-_BwAAANM"]
[Thu Feb 26 13:36:15.491689 2026] [:error] [pid 55122:tid 55148] [client 195.178.110.109:64820] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config/constants.js"] [unique_id "aZ_bz4LiR0OfjFxvcN-_CAAAANg"]
[Thu Feb 26 13:36:16.504350 2026] [:error] [pid 3883:tid 3895] [client 195.178.110.109:64822] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config/constants.js"] [unique_id "aZ_b0OA33x90V6yYHahnJwAAAUk"]
[Thu Feb 26 13:36:17.540445 2026] [:error] [pid 55051:tid 55059] [client 195.178.110.109:64826] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config/constants.js"] [unique_id "aZ_b0QmK1w2kZvh5eLHkwgAAAIU"]
[Thu Feb 26 13:36:18.529760 2026] [:error] [pid 25311:tid 25317] [client 195.178.110.109:64830] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config/constants.js"] [unique_id "aZ_b0tfdM__yZAgJFSvdNQAAAYM"]
[Thu Feb 26 13:36:19.525542 2026] [:error] [pid 25311:tid 25333] [client 195.178.110.109:49054] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config/constants.js"] [unique_id "aZ_b09fdM__yZAgJFSvdNwAAAZM"]
[Thu Feb 26 13:36:20.587834 2026] [:error] [pid 3883:tid 3904] [client 195.178.110.109:49060] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config/constants.js"] [unique_id "aZ_b1OA33x90V6yYHahnLwAAAVI"]
[Thu Feb 26 13:36:21.645427 2026] [:error] [pid 55051:tid 55063] [client 195.178.110.109:49070] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config/constants.js"] [unique_id "aZ_b1QmK1w2kZvh5eLHkxgAAAIk"]
[Thu Feb 26 13:36:22.643063 2026] [:error] [pid 25311:tid 25319] [client 195.178.110.109:49082] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/application.properties"] [unique_id "aZ_b1tfdM__yZAgJFSvdOQAAAYU"]
[Thu Feb 26 13:36:23.679665 2026] [:error] [pid 54990:tid 55004] [client 195.178.110.109:49098] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/application.properties"] [unique_id "aZ_b13tr2qmt_mBhH2zeZwAAAAs"]
[Thu Feb 26 13:36:24.719619 2026] [:error] [pid 3883:tid 3908] [client 195.178.110.109:49102] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/application.properties"] [unique_id "aZ_b2OA33x90V6yYHahnNwAAAVY"]
[Thu Feb 26 13:36:25.751913 2026] [:error] [pid 3883:tid 3894] [client 195.178.110.109:49106] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/application.properties"] [unique_id "aZ_b2eA33x90V6yYHahnOgAAAUg"]
[Thu Feb 26 13:36:26.852961 2026] [:error] [pid 55618:tid 55636] [client 195.178.110.109:49120] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/application.properties"] [unique_id "aZ_b2h61Vrh12f_8oWR6wQAAAQ8"]
[Thu Feb 26 13:36:27.760785 2026] [:error] [pid 55051:tid 55058] [client 195.178.110.109:49134] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/application.properties"] [unique_id "aZ_b2wmK1w2kZvh5eLHkxwAAAIQ"]
[Thu Feb 26 13:36:28.804889 2026] [:error] [pid 55618:tid 55632] [client 195.178.110.109:49150] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/application.properties"] [unique_id "aZ_b3B61Vrh12f_8oWR6wwAAAQs"]
[Thu Feb 26 13:36:29.803028 2026] [:error] [pid 3883:tid 3899] [client 195.178.110.109:58208] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/application.properties"] [unique_id "aZ_b3eA33x90V6yYHahnQwAAAU0"]
[Thu Feb 26 13:36:30.781259 2026] [:error] [pid 3883:tid 3892] [client 195.178.110.109:58222] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/application.properties"] [unique_id "aZ_b3uA33x90V6yYHahnSAAAAUY"]
[Thu Feb 26 13:36:31.778144 2026] [:error] [pid 3883:tid 3887] [client 195.178.110.109:58230] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/application.properties"] [unique_id "aZ_b3-A33x90V6yYHahnSwAAAUE"]
[Thu Feb 26 13:36:32.765463 2026] [:error] [pid 55051:tid 55064] [client 195.178.110.109:58234] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/application.properties"] [unique_id "aZ_b4AmK1w2kZvh5eLHkywAAAIo"]
[Thu Feb 26 13:36:33.754284 2026] [:error] [pid 55051:tid 55077] [client 195.178.110.109:58242] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/application.properties"] [unique_id "aZ_b4QmK1w2kZvh5eLHkzAAAAJc"]
[Thu Feb 26 13:36:34.752094 2026] [:error] [pid 55122:tid 55127] [client 195.178.110.109:58244] [client 195.178.110.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/application.properties"] [unique_id "aZ_b4oLiR0OfjFxvcN-_FgAAAMM"]
[Thu Feb 26 13:36:56.113213 2026] [:error] [pid 25311:tid 25338] [client 195.178.110.109:25574] [client 195.178.110.109] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/storage/logs/laravel.log"] [unique_id "aZ_b-NfdM__yZAgJFSvdbwAAAZg"]
[Thu Feb 26 14:15:12.917453 2026] [:error] [pid 55051:tid 55078] [client 162.62.231.139:33716] [client 162.62.231.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aZ_k8AmK1w2kZvh5eLHsNQAAAJg"]
[Thu Feb 26 14:23:02.843032 2026] [:error] [pid 55618:tid 55644] [client 103.8.27.27:52498] [client 103.8.27.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/backend/.env"] [unique_id "aZ_mxh61Vrh12f_8oWSPGQAAARc"]
[Thu Feb 26 14:23:02.843060 2026] [:error] [pid 55122:tid 55140] [client 103.8.27.27:54901] [client 103.8.27.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/dashboard/.env"] [unique_id "aZ_mxoLiR0OfjFxvcN_MeAAAANA"]
[Thu Feb 26 14:23:02.844685 2026] [:error] [pid 55122:tid 55126] [client 103.8.27.27:49325] [client 103.8.27.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/dash/.env"] [unique_id "aZ_mxoLiR0OfjFxvcN_MeQAAAMI"]
[Thu Feb 26 14:23:02.845763 2026] [:error] [pid 55122:tid 55143] [client 103.8.27.27:52056] [client 103.8.27.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/admin/.env"] [unique_id "aZ_mxoLiR0OfjFxvcN_MegAAANM"]
[Thu Feb 26 14:23:02.845953 2026] [:error] [pid 54991:tid 55027] [client 103.8.27.27:54880] [client 103.8.27.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/app/.env"] [unique_id "aZ_mxt4Zx-mJ8gbRB2iVRQAAAEc"]
[Thu Feb 26 14:23:02.846039 2026] [:error] [pid 55051:tid 55061] [client 103.8.27.27:55937] [client 103.8.27.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aZ_mxgmK1w2kZvh5eLHt4QAAAIc"]
[Thu Feb 26 14:23:02.848709 2026] [:error] [pid 55122:tid 55131] [client 103.8.27.27:56359] [client 103.8.27.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/api/.env"] [unique_id "aZ_mxoLiR0OfjFxvcN_MfAAAAMc"]
[Thu Feb 26 14:23:02.850321 2026] [:error] [pid 3883:tid 3898] [client 103.8.27.27:55429] [client 103.8.27.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/member/.env"] [unique_id "aZ_mxuA33x90V6yYHaiAPAAAAUw"]
[Thu Feb 26 14:23:02.852022 2026] [:error] [pid 54991:tid 55037] [client 103.8.27.27:55542] [client 103.8.27.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/laravel/.env"] [unique_id "aZ_mxt4Zx-mJ8gbRB2iVRgAAAFE"]
[Thu Feb 26 14:23:02.852057 2026] [:error] [pid 55122:tid 55138] [client 103.8.27.27:55043] [client 103.8.27.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/test/.env"] [unique_id "aZ_mxoLiR0OfjFxvcN_MfQAAAM4"]
[Thu Feb 26 14:23:02.856041 2026] [:error] [pid 55618:tid 55623] [client 103.8.27.27:59936] [client 103.8.27.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/apps/.env"] [unique_id "aZ_mxh61Vrh12f_8oWSPGgAAAQI"]
[Thu Feb 26 14:23:02.857481 2026] [:error] [pid 3883:tid 3900] [client 103.8.27.27:60557] [client 103.8.27.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/core/.env"] [unique_id "aZ_mxuA33x90V6yYHaiAPQAAAU4"]
[Thu Feb 26 14:49:59.487931 2026] [:error] [pid 25311:tid 25320] [client 195.178.110.28:58782] [client 195.178.110.28] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aZ_tF9fdM__yZAgJFSsR8QAAAYY"]
[Thu Feb 26 15:08:27.584689 2026] [:error] [pid 3883:tid 3906] [client 212.104.214.238:5522] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aZ_xa-A33x90V6yYHaiW4AAAAVQ"]
[Thu Feb 26 17:26:58.151456 2026] [:error] [pid 55051:tid 55072] [client 43.167.157.80:36758] [client 43.167.157.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaAR4gmK1w2kZvh5eLEl4AAAAJI"]
[Thu Feb 26 18:15:22.261447 2026] [:error] [pid 55618:tid 55632] [client 94.26.106.114:64879] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdOh61Vrh12f_8oWTJTwAAAQs"]
[Thu Feb 26 18:16:04.471182 2026] [:error] [pid 20419:tid 20429] [client 94.26.106.114:61865] [client 94.26.106.114] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaAdZO3DVDvMfTYYUBUChQAAAcc"], referer: https://www.google.com/search?q=wordpress
[Thu Feb 26 18:16:49.258997 2026] [:error] [pid 54990:tid 54996] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdkXtr2qmt_mBhH2wDUgAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:16:51.354478 2026] [:error] [pid 54990:tid 55006] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdk3tr2qmt_mBhH2wDVAAAAA0"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:16:52.181105 2026] [:error] [pid 54990:tid 55002] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdlHtr2qmt_mBhH2wDVQAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:16:54.369936 2026] [:error] [pid 54990:tid 55012] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdlntr2qmt_mBhH2wDVwAAABM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:16:55.772864 2026] [:error] [pid 54990:tid 54998] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdl3tr2qmt_mBhH2wDWQAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:16:58.663666 2026] [:error] [pid 54990:tid 55011] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdmntr2qmt_mBhH2wDXAAAABI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:00.366154 2026] [:error] [pid 54990:tid 55014] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdnHtr2qmt_mBhH2wDXQAAABU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:03.065128 2026] [:error] [pid 54990:tid 55007] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdn3tr2qmt_mBhH2wDXwAAAA4"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:04.172020 2026] [:error] [pid 54990:tid 55003] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdoHtr2qmt_mBhH2wDYAAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:06.576206 2026] [:error] [pid 54990:tid 54997] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdontr2qmt_mBhH2wDYgAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:07.575980 2026] [:error] [pid 54990:tid 54993] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdo3tr2qmt_mBhH2wDZAAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:10.479841 2026] [:error] [pid 54990:tid 55015] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdpntr2qmt_mBhH2wDZgAAABY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:11.866003 2026] [:error] [pid 54990:tid 55016] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdp3tr2qmt_mBhH2wDZwAAABc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:13.852528 2026] [:error] [pid 54990:tid 55005] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdqXtr2qmt_mBhH2wDaQAAAAw"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:15.167084 2026] [:error] [pid 54990:tid 54996] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdq3tr2qmt_mBhH2wDagAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:18.578953 2026] [:error] [pid 54990:tid 55002] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdrntr2qmt_mBhH2wDbQAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:20.262644 2026] [:error] [pid 54990:tid 55004] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdsHtr2qmt_mBhH2wDbgAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:22.963607 2026] [:error] [pid 54990:tid 55012] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdsntr2qmt_mBhH2wDcAAAABM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:23.863812 2026] [:error] [pid 54990:tid 54998] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAds3tr2qmt_mBhH2wDcQAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:26.967989 2026] [:error] [pid 54990:tid 55017] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdtntr2qmt_mBhH2wDcwAAABg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:28.678904 2026] [:error] [pid 54990:tid 55017] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAduHtr2qmt_mBhH2wDdAAAABg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:30.960454 2026] [:error] [pid 54990:tid 55011] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAduntr2qmt_mBhH2wDdgAAABI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:32.589549 2026] [:error] [pid 54990:tid 55014] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdvHtr2qmt_mBhH2wDdwAAABU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:35.662915 2026] [:error] [pid 54990:tid 55007] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdv3tr2qmt_mBhH2wDeQAAAA4"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:36.760950 2026] [:error] [pid 54990:tid 55003] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdwHtr2qmt_mBhH2wDegAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:38.575861 2026] [:error] [pid 54990:tid 54997] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdwntr2qmt_mBhH2wDfAAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:39.659137 2026] [:error] [pid 54990:tid 55010] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdw3tr2qmt_mBhH2wDfQAAABE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:42.371803 2026] [:error] [pid 54990:tid 55013] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdxntr2qmt_mBhH2wDgQAAABQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:43.756584 2026] [:error] [pid 54990:tid 54996] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdx3tr2qmt_mBhH2wDhAAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:47.065283 2026] [:error] [pid 54990:tid 55002] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdy3tr2qmt_mBhH2wDhgAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:48.269200 2026] [:error] [pid 54990:tid 55004] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdzHtr2qmt_mBhH2wDhwAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:51.472726 2026] [:error] [pid 54990:tid 55012] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAdz3tr2qmt_mBhH2wDiQAAABM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:53.063863 2026] [:error] [pid 54990:tid 54998] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd0Xtr2qmt_mBhH2wDigAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:56.056647 2026] [:error] [pid 54990:tid 55017] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd1Htr2qmt_mBhH2wDjAAAABg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:17:57.375914 2026] [:error] [pid 54990:tid 55009] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd1Xtr2qmt_mBhH2wDjQAAABA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:00.276554 2026] [:error] [pid 54990:tid 55014] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd2Htr2qmt_mBhH2wDjwAAABU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:01.366691 2026] [:error] [pid 54990:tid 54994] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd2Xtr2qmt_mBhH2wDkAAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:03.166858 2026] [:error] [pid 54990:tid 55003] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd23tr2qmt_mBhH2wDkgAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:04.259522 2026] [:error] [pid 54990:tid 55001] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd3Htr2qmt_mBhH2wDkwAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:06.370287 2026] [:error] [pid 54990:tid 55015] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd3ntr2qmt_mBhH2wDlgAAABY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:07.877241 2026] [:error] [pid 54990:tid 55016] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd33tr2qmt_mBhH2wDlwAAABc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:09.874868 2026] [:error] [pid 54990:tid 54996] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd4Xtr2qmt_mBhH2wDmQAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:11.257772 2026] [:error] [pid 54990:tid 55006] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd43tr2qmt_mBhH2wDmgAAAA0"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:13.873376 2026] [:error] [pid 54990:tid 55004] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd5Xtr2qmt_mBhH2wDnAAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:14.682337 2026] [:error] [pid 54990:tid 54995] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd5ntr2qmt_mBhH2wDnQAAAAI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:16.361799 2026] [:error] [pid 54990:tid 55000] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd6Htr2qmt_mBhH2wDoAAAAAc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:17.363891 2026] [:error] [pid 54990:tid 55017] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd6Xtr2qmt_mBhH2wDoQAAABg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:19.464016 2026] [:error] [pid 54990:tid 55011] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd63tr2qmt_mBhH2wDowAAABI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:20.676992 2026] [:error] [pid 54990:tid 55014] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd7Htr2qmt_mBhH2wDpAAAABU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:23.268411 2026] [:error] [pid 54990:tid 55001] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd73tr2qmt_mBhH2wDpwAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:24.876878 2026] [:error] [pid 54990:tid 54997] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd8Htr2qmt_mBhH2wDqQAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:27.873711 2026] [:error] [pid 54990:tid 54999] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd83tr2qmt_mBhH2wDqwAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:28.758031 2026] [:error] [pid 54990:tid 55016] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd9Htr2qmt_mBhH2wDrAAAABc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:31.866138 2026] [:error] [pid 54990:tid 55005] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd93tr2qmt_mBhH2wDrgAAAAw"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:32.958554 2026] [:error] [pid 54990:tid 54996] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd-Htr2qmt_mBhH2wDrwAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:35.263698 2026] [:error] [pid 54990:tid 55008] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd-3tr2qmt_mBhH2wDsQAAAA8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:36.378544 2026] [:error] [pid 54990:tid 55002] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd_Htr2qmt_mBhH2wDsgAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:38.975251 2026] [:error] [pid 54990:tid 54995] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd_ntr2qmt_mBhH2wDtAAAAAI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:39.955115 2026] [:error] [pid 54990:tid 54998] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAd_3tr2qmt_mBhH2wDtQAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:42.163878 2026] [:error] [pid 54990:tid 55011] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeAntr2qmt_mBhH2wDugAAABI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:43.172226 2026] [:error] [pid 54990:tid 55010] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeA3tr2qmt_mBhH2wDvAAAABE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:45.658449 2026] [:error] [pid 54990:tid 54999] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeBXtr2qmt_mBhH2wDwQAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:46.881199 2026] [:error] [pid 54990:tid 54996] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeBntr2qmt_mBhH2wDwwAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:49.970848 2026] [:error] [pid 54990:tid 55004] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeCXtr2qmt_mBhH2wDxQAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:50.955547 2026] [:error] [pid 54990:tid 54995] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeCntr2qmt_mBhH2wDxgAAAAI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:53.956524 2026] [:error] [pid 54990:tid 55000] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeDXtr2qmt_mBhH2wDyAAAAAc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:54.772583 2026] [:error] [pid 54990:tid 55009] [client 94.26.106.114:51542] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeDntr2qmt_mBhH2wDyQAAABA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:58.758298 2026] [:error] [pid 20419:tid 20436] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeEu3DVDvMfTYYUBUDQgAAAc4"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:18:59.961021 2026] [:error] [pid 20419:tid 20439] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeE-3DVDvMfTYYUBUDQwAAAdE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:02.458467 2026] [:error] [pid 20419:tid 20434] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeFu3DVDvMfTYYUBUDSAAAAcw"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:04.271369 2026] [:error] [pid 20419:tid 20446] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeGO3DVDvMfTYYUBUDTgAAAdg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:06.459795 2026] [:error] [pid 20419:tid 20444] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeGu3DVDvMfTYYUBUDUQAAAdY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:07.755162 2026] [:error] [pid 20419:tid 20423] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeG-3DVDvMfTYYUBUDUgAAAcE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:10.179816 2026] [:error] [pid 20419:tid 20445] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeHu3DVDvMfTYYUBUDVAAAAdc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:11.368259 2026] [:error] [pid 20419:tid 20432] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeH-3DVDvMfTYYUBUDVgAAAco"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:13.866261 2026] [:error] [pid 20419:tid 20422] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeIe3DVDvMfTYYUBUDWQAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:15.768435 2026] [:error] [pid 20419:tid 20426] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeI-3DVDvMfTYYUBUDWwAAAcQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:18.266909 2026] [:error] [pid 20419:tid 20440] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeJu3DVDvMfTYYUBUDXQAAAdI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:20.259567 2026] [:error] [pid 20419:tid 20423] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeKO3DVDvMfTYYUBUDYwAAAcE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:22.456964 2026] [:error] [pid 20419:tid 20427] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeKu3DVDvMfTYYUBUDaQAAAcU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:23.863176 2026] [:error] [pid 20419:tid 20422] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeK-3DVDvMfTYYUBUDagAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:26.155225 2026] [:error] [pid 20419:tid 20440] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeLu3DVDvMfTYYUBUDbgAAAdI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:27.354015 2026] [:error] [pid 20419:tid 20442] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeL-3DVDvMfTYYUBUDcAAAAdQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:29.277742 2026] [:error] [pid 20419:tid 20441] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeMe3DVDvMfTYYUBUDdAAAAdM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:30.662312 2026] [:error] [pid 20419:tid 20423] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeMu3DVDvMfTYYUBUDdgAAAcE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:33.261369 2026] [:error] [pid 20419:tid 20431] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeNe3DVDvMfTYYUBUDewAAAck"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:34.657226 2026] [:error] [pid 20419:tid 20437] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeNu3DVDvMfTYYUBUDfAAAAc8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:37.665880 2026] [:error] [pid 20419:tid 20443] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeOe3DVDvMfTYYUBUDgAAAAdU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:38.867192 2026] [:error] [pid 20419:tid 20430] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeOu3DVDvMfTYYUBUDgQAAAcg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:41.467639 2026] [:error] [pid 20419:tid 20444] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAePe3DVDvMfTYYUBUDhAAAAdY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:42.961654 2026] [:error] [pid 20419:tid 20445] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAePu3DVDvMfTYYUBUDhgAAAdc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:45.756614 2026] [:error] [pid 20419:tid 20434] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeQe3DVDvMfTYYUBUDjAAAAcw"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:46.971030 2026] [:error] [pid 20419:tid 20425] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeQu3DVDvMfTYYUBUDjQAAAcM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:49.369169 2026] [:error] [pid 20419:tid 20424] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeRe3DVDvMfTYYUBUDkgAAAcI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:50.474495 2026] [:error] [pid 20419:tid 20436] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeRu3DVDvMfTYYUBUDlQAAAc4"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:52.363431 2026] [:error] [pid 20419:tid 20438] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeSO3DVDvMfTYYUBUDlwAAAdA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:53.178386 2026] [:error] [pid 20419:tid 20422] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeSe3DVDvMfTYYUBUDmAAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:55.153955 2026] [:error] [pid 20419:tid 20427] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeS-3DVDvMfTYYUBUDmgAAAcU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:56.468855 2026] [:error] [pid 20419:tid 20434] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeTO3DVDvMfTYYUBUDnQAAAcw"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:58.677280 2026] [:error] [pid 20419:tid 20435] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeTu3DVDvMfTYYUBUDoAAAAc0"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:19:59.671875 2026] [:error] [pid 20419:tid 20430] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeT-3DVDvMfTYYUBUDoQAAAcg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:01.774474 2026] [:error] [pid 20419:tid 20424] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeUe3DVDvMfTYYUBUDpAAAAcI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:02.951827 2026] [:error] [pid 20419:tid 20429] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeUu3DVDvMfTYYUBUDpQAAAcc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:05.476023 2026] [:error] [pid 20419:tid 20445] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeVe3DVDvMfTYYUBUDqAAAAdc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:06.763297 2026] [:error] [pid 20419:tid 20432] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeVu3DVDvMfTYYUBUDqQAAAco"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:08.777845 2026] [:error] [pid 20419:tid 20422] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeWO3DVDvMfTYYUBUDqwAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:09.858091 2026] [:error] [pid 20419:tid 20426] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeWe3DVDvMfTYYUBUDrAAAAcQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:11.570635 2026] [:error] [pid 20419:tid 20439] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeW-3DVDvMfTYYUBUDrgAAAdE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:13.265046 2026] [:error] [pid 20419:tid 20434] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeXe3DVDvMfTYYUBUDrwAAAcw"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:15.260892 2026] [:error] [pid 20419:tid 20446] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeX-3DVDvMfTYYUBUDsQAAAdg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:16.260756 2026] [:error] [pid 20419:tid 20425] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeYO3DVDvMfTYYUBUDsgAAAcM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:18.074857 2026] [:error] [pid 20419:tid 20435] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeYu3DVDvMfTYYUBUDtAAAAc0"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:19.163256 2026] [:error] [pid 20419:tid 20442] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeY-3DVDvMfTYYUBUDtgAAAdQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:20.980796 2026] [:error] [pid 20419:tid 20424] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeZO3DVDvMfTYYUBUDuAAAAcI"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:22.472631 2026] [:error] [pid 20419:tid 20444] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeZu3DVDvMfTYYUBUDugAAAdY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:24.277555 2026] [:error] [pid 20419:tid 20437] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeaO3DVDvMfTYYUBUDvAAAAc8"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:25.076810 2026] [:error] [pid 20419:tid 20423] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeae3DVDvMfTYYUBUDvQAAAcE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:27.359180 2026] [:error] [pid 20419:tid 20438] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAea-3DVDvMfTYYUBUDwQAAAdA"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:28.256024 2026] [:error] [pid 20419:tid 20439] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAebO3DVDvMfTYYUBUDwwAAAdE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:30.763221 2026] [:error] [pid 20419:tid 20446] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAebu3DVDvMfTYYUBUDxgAAAdg"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:32.176594 2026] [:error] [pid 20419:tid 20425] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAecO3DVDvMfTYYUBUDxwAAAcM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:34.165539 2026] [:error] [pid 20419:tid 20442] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAecu3DVDvMfTYYUBUDygAAAdQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:35.071764 2026] [:error] [pid 20419:tid 20429] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAec-3DVDvMfTYYUBUDzAAAAcc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:37.280145 2026] [:error] [pid 20419:tid 20444] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAede3DVDvMfTYYUBUDzgAAAdY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:38.156160 2026] [:error] [pid 20419:tid 20433] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAedu3DVDvMfTYYUBUDzwAAAcs"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:40.678477 2026] [:error] [pid 20419:tid 20423] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeeO3DVDvMfTYYUBUD0gAAAcE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:41.478870 2026] [:error] [pid 20419:tid 20439] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAeee3DVDvMfTYYUBUD1QAAAdE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:43.976725 2026] [:error] [pid 20419:tid 20443] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAee-3DVDvMfTYYUBUD2gAAAdU"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:44.860555 2026] [:error] [pid 20419:tid 20425] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAefO3DVDvMfTYYUBUD2wAAAcM"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:46.867854 2026] [:error] [pid 20419:tid 20429] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAefu3DVDvMfTYYUBUD3gAAAcc"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:47.759084 2026] [:error] [pid 20419:tid 20444] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAef-3DVDvMfTYYUBUD3wAAAdY"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:49.958597 2026] [:error] [pid 20419:tid 20423] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAege3DVDvMfTYYUBUD4QAAAcE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:50.860286 2026] [:error] [pid 20419:tid 20436] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAegu3DVDvMfTYYUBUD4gAAAc4"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:20:52.762340 2026] [:error] [pid 20419:tid 20439] [client 94.26.106.114:53479] [client 94.26.106.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.26.106.114, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaAehO3DVDvMfTYYUBUD5QAAAdE"], referer: https://expressinteriors.com/wp-login.php
[Thu Feb 26 18:52:26.692847 2026] [:error] [pid 55618:tid 55626] [client 193.37.32.31:29461] [client 193.37.32.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aaAl6h61Vrh12f_8oWTcggAAAQU"]
[Thu Feb 26 18:52:39.377041 2026] [:error] [pid 3883:tid 3900] [client 193.37.32.48:44109] [client 193.37.32.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aaAl9-A33x90V6yYHahTAgAAAU4"]
[Thu Feb 26 18:53:04.196855 2026] [:error] [pid 20419:tid 20439] [client 193.37.32.19:27867] [client 193.37.32.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aaAmEO3DVDvMfTYYUBUedgAAAdE"]
[Thu Feb 26 18:53:14.444199 2026] [:error] [pid 3883:tid 3887] [client 193.37.32.8:20921] [client 193.37.32.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aaAmGuA33x90V6yYHahUjQAAAUE"]
[Thu Feb 26 18:53:45.386591 2026] [:error] [pid 55051:tid 55057] [client 193.37.32.36:55507] [client 193.37.32.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aaAmOQmK1w2kZvh5eLFqggAAAIM"]
[Thu Feb 26 18:53:52.535612 2026] [:error] [pid 20419:tid 20434] [client 193.37.32.47:21651] [client 193.37.32.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aaAmQO3DVDvMfTYYUBUgHwAAAcw"]
[Thu Feb 26 18:53:52.829590 2026] [:error] [pid 25311:tid 25327] [client 193.37.32.15:58905] [client 193.37.32.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aaAmQNfdM__yZAgJFSuPBwAAAY0"]
[Thu Feb 26 18:53:53.234099 2026] [:error] [pid 25311:tid 25331] [client 193.37.32.15:62765] [client 193.37.32.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aaAmQdfdM__yZAgJFSuPDgAAAZE"]
[Thu Feb 26 18:53:53.580798 2026] [:error] [pid 55122:tid 55139] [client 193.37.32.130:51311] [client 193.37.32.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aaAmQYLiR0OfjFxvcN8L6gAAAM8"]
[Thu Feb 26 18:53:53.839055 2026] [:error] [pid 3883:tid 3894] [client 193.37.32.53:48365] [client 193.37.32.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aaAmQeA33x90V6yYHahWVgAAAUg"]
[Thu Feb 26 18:53:56.662260 2026] [:error] [pid 3883:tid 3887] [client 193.37.32.13:26509] [client 193.37.32.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aaAmROA33x90V6yYHahWcgAAAUE"]
[Thu Feb 26 18:54:00.957069 2026] [:error] [pid 3883:tid 3907] [client 193.37.32.9:22545] [client 193.37.32.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aaAmSOA33x90V6yYHahWzgAAAVU"]
[Thu Feb 26 18:54:10.074163 2026] [:error] [pid 20419:tid 20436] [client 193.37.32.25:21161] [client 193.37.32.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aaAmUu3DVDvMfTYYUBUgiwAAAc4"]
[Thu Feb 26 18:54:13.233569 2026] [:error] [pid 3883:tid 3902] [client 193.37.32.21:60375] [client 193.37.32.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aaAmVeA33x90V6yYHahXnwAAAVA"]
[Thu Feb 26 18:54:18.309703 2026] [:error] [pid 25311:tid 25316] [client 193.37.32.16:49035] [client 193.37.32.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aaAmWtfdM__yZAgJFSuQUQAAAYI"]
[Thu Feb 26 18:54:44.807699 2026] [:error] [pid 20419:tid 20437] [client 193.37.32.129:51563] [client 193.37.32.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aaAmdO3DVDvMfTYYUBUhywAAAc8"]
[Thu Feb 26 18:54:50.547030 2026] [:error] [pid 55051:tid 55067] [client 193.37.32.5:28047] [client 193.37.32.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aaAmegmK1w2kZvh5eLFsmgAAAI0"]
[Thu Feb 26 18:54:58.541400 2026] [:error] [pid 25311:tid 25316] [client 193.37.32.25:23531] [client 193.37.32.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/defaults.php"] [unique_id "aaAmgtfdM__yZAgJFSuSfgAAAYI"]
[Thu Feb 26 18:55:01.623653 2026] [:error] [pid 25311:tid 25318] [client 193.37.32.24:56799] [client 193.37.32.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aaAmhdfdM__yZAgJFSuSngAAAYQ"]
[Thu Feb 26 18:55:20.601952 2026] [:error] [pid 55618:tid 55628] [client 193.37.32.31:55151] [client 193.37.32.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aaAmmB61Vrh12f_8oWTiHAAAAQc"]
[Thu Feb 26 18:55:23.016316 2026] [:error] [pid 55051:tid 55066] [client 182.42.105.85:60991] [client 182.42.105.85] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaAmmwmK1w2kZvh5eLFtuwAAAIw"]
[Thu Feb 26 18:55:24.394006 2026] [:error] [pid 55122:tid 55134] [client 193.37.32.19:59237] [client 193.37.32.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aaAmnILiR0OfjFxvcN8NtAAAAMo"]
[Thu Feb 26 18:55:30.215145 2026] [:error] [pid 20419:tid 20442] [client 193.37.32.43:57133] [client 193.37.32.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aaAmou3DVDvMfTYYUBUjawAAAdQ"]
[Thu Feb 26 18:55:31.288792 2026] [:error] [pid 55051:tid 55054] [client 193.37.32.9:35695] [client 193.37.32.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aaAmowmK1w2kZvh5eLFt_gAAAIA"]
[Thu Feb 26 18:55:31.593428 2026] [:error] [pid 20419:tid 20438] [client 193.37.32.53:27135] [client 193.37.32.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaAmo-3DVDvMfTYYUBUjcQAAAdA"]
[Thu Feb 26 18:55:46.084629 2026] [:error] [pid 25311:tid 25317] [client 193.37.32.53:39307] [client 193.37.32.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/info.php"] [unique_id "aaAmstfdM__yZAgJFSuUkwAAAYM"]
[Thu Feb 26 18:55:46.425984 2026] [:error] [pid 55122:tid 55132] [client 193.37.32.29:25065] [client 193.37.32.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class.api.php"] [unique_id "aaAmsoLiR0OfjFxvcN8OZAAAAMg"]
[Thu Feb 26 18:55:46.637535 2026] [:error] [pid 3883:tid 3904] [client 193.37.32.50:62433] [client 193.37.32.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaAmsuA33x90V6yYHahbqwAAAVI"]
[Thu Feb 26 18:56:17.822805 2026] [:error] [pid 55051:tid 55075] [client 193.37.32.17:56713] [client 193.37.32.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/admin.php"] [unique_id "aaAm0QmK1w2kZvh5eLFvgwAAAJU"]
[Thu Feb 26 18:56:28.084373 2026] [autoindex:error] [pid 20419:tid 20432] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:56:28.243547 2026] [autoindex:error] [pid 20419:tid 20446] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:56:28.427406 2026] [autoindex:error] [pid 20419:tid 20426] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:56:28.599672 2026] [autoindex:error] [pid 20419:tid 20444] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:56:36.179863 2026] [autoindex:error] [pid 20419:tid 20424] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:56:36.290360 2026] [autoindex:error] [pid 20419:tid 20445] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:56:36.460633 2026] [autoindex:error] [pid 20419:tid 20446] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:56:36.689586 2026] [autoindex:error] [pid 20419:tid 20439] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:56:36.867885 2026] [autoindex:error] [pid 20419:tid 20443] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:56:37.017599 2026] [autoindex:error] [pid 20419:tid 20444] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:56:37.590681 2026] [autoindex:error] [pid 20419:tid 20434] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:56:43.113445 2026] [autoindex:error] [pid 20419:tid 20429] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:56:43.262764 2026] [autoindex:error] [pid 20419:tid 20442] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:56:54.142437 2026] [autoindex:error] [pid 20419:tid 20441] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:56:54.438310 2026] [autoindex:error] [pid 20419:tid 20430] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:56:54.577250 2026] [autoindex:error] [pid 20419:tid 20422] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:56:54.730843 2026] [autoindex:error] [pid 20419:tid 20441] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:56:57.827080 2026] [autoindex:error] [pid 20419:tid 20429] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:56:57.976029 2026] [autoindex:error] [pid 20419:tid 20434] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:57:00.956734 2026] [autoindex:error] [pid 20419:tid 20429] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:57:08.984198 2026] [autoindex:error] [pid 20419:tid 20441] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:57:09.132890 2026] [autoindex:error] [pid 20419:tid 20431] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:57:09.261673 2026] [autoindex:error] [pid 20419:tid 20437] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:57:23.837673 2026] [autoindex:error] [pid 20419:tid 20429] [client 193.37.32.8:29625] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:57:31.041307 2026] [:error] [pid 20419:tid 20429] [client 193.37.32.8:29625] [client 193.37.32.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "aaAnG-3DVDvMfTYYUBUn9QAAAcc"]
[Thu Feb 26 18:57:31.357782 2026] [:error] [pid 3883:tid 3891] [client 193.37.32.8:56471] [client 193.37.32.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "aaAnG-A33x90V6yYHahieAAAAUU"]
[Thu Feb 26 18:57:40.749322 2026] [autoindex:error] [pid 55122:tid 55127] [client 193.37.32.40:51141] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:57:46.092638 2026] [autoindex:error] [pid 55122:tid 55136] [client 193.37.32.40:51141] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:57:46.248283 2026] [autoindex:error] [pid 55122:tid 55139] [client 193.37.32.40:51141] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:57:46.759677 2026] [autoindex:error] [pid 55122:tid 55134] [client 193.37.32.40:51141] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:57:46.906182 2026] [autoindex:error] [pid 55122:tid 55141] [client 193.37.32.40:51141] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:57:47.051287 2026] [autoindex:error] [pid 55122:tid 55127] [client 193.37.32.40:51141] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 18:58:08.402668 2026] [autoindex:error] [pid 55122:tid 55129] [client 193.37.32.40:51141] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:00:12.273168 2026] [autoindex:error] [pid 55122:tid 55146] [client 193.37.32.40:51141] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:00:12.482757 2026] [autoindex:error] [pid 55122:tid 55127] [client 193.37.32.40:51141] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:00:13.256849 2026] [autoindex:error] [pid 55122:tid 55144] [client 193.37.32.40:51141] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:00:13.420845 2026] [autoindex:error] [pid 55122:tid 55135] [client 193.37.32.40:51141] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:00:26.181113 2026] [autoindex:error] [pid 55122:tid 55146] [client 193.37.32.40:51141] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:00:26.330236 2026] [autoindex:error] [pid 55122:tid 55130] [client 193.37.32.40:51141] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:00:32.313937 2026] [autoindex:error] [pid 55122:tid 55145] [client 193.37.32.40:51141] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:00:38.921156 2026] [:error] [pid 55122:tid 55138] [client 193.37.32.40:51141] [client 193.37.32.40] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/crystal/"] [unique_id "aaAn1oLiR0OfjFxvcN8ZHgAAAM4"]
[Thu Feb 26 19:00:39.223263 2026] [autoindex:error] [pid 25311:tid 25321] [client 193.37.32.21:39131] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:00:39.396610 2026] [autoindex:error] [pid 25311:tid 25333] [client 193.37.32.21:39131] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:00:39.551923 2026] [autoindex:error] [pid 25311:tid 25320] [client 193.37.32.21:39131] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:00:46.821466 2026] [autoindex:error] [pid 25311:tid 25337] [client 193.37.32.21:39131] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:00:47.362893 2026] [autoindex:error] [pid 25311:tid 25317] [client 193.37.32.21:39131] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:00:47.532609 2026] [autoindex:error] [pid 25311:tid 25316] [client 193.37.32.21:39131] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:00:47.722231 2026] [autoindex:error] [pid 25311:tid 25318] [client 193.37.32.21:39131] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:02:33.833144 2026] [autoindex:error] [pid 25311:tid 25314] [client 193.37.32.21:39131] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:03:17.599371 2026] [autoindex:error] [pid 25311:tid 25316] [client 193.37.32.21:39131] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:03:30.258121 2026] [autoindex:error] [pid 25311:tid 25315] [client 193.37.32.21:39131] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:03:30.435602 2026] [autoindex:error] [pid 25311:tid 25320] [client 193.37.32.21:39131] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:03:43.521285 2026] [autoindex:error] [pid 25311:tid 25336] [client 193.37.32.21:39131] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:03:43.715725 2026] [autoindex:error] [pid 25311:tid 25328] [client 193.37.32.21:39131] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:03:44.267310 2026] [autoindex:error] [pid 25311:tid 25329] [client 193.37.32.21:39131] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:03:44.440443 2026] [autoindex:error] [pid 25311:tid 25320] [client 193.37.32.21:39131] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:03:44.568369 2026] [autoindex:error] [pid 25311:tid 25331] [client 193.37.32.21:39131] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:03:44.712019 2026] [autoindex:error] [pid 25311:tid 25332] [client 193.37.32.21:39131] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:03:44.892667 2026] [autoindex:error] [pid 25311:tid 25322] [client 193.37.32.21:39131] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:03:45.033890 2026] [autoindex:error] [pid 25311:tid 25327] [client 193.37.32.21:39131] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:03:45.654149 2026] [autoindex:error] [pid 25311:tid 25321] [client 193.37.32.21:39131] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:04:47.840197 2026] [autoindex:error] [pid 25311:tid 25322] [client 193.37.32.21:39131] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Feb 26 19:31:57.234404 2026] [:error] [pid 3883:tid 3896] [client 43.130.100.35:38534] [client 43.130.100.35] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaAvLeA33x90V6yYHailJwAAAUo"]
[Thu Feb 26 22:02:28.583153 2026] [:error] [pid 55051:tid 55054] [client 157.245.196.99:50799] [client 157.245.196.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/profile-builder/readme.txt"] [unique_id "aaBSdAmK1w2kZvh5eLHCqQAAAIA"]
[Thu Feb 26 22:29:43.642421 2026] [:error] [pid 20419:tid 20428] [client 43.130.116.87:60696] [client 43.130.116.87] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaBY1-3DVDvMfTYYUBVqTQAAAcY"]
[Fri Feb 27 00:00:30.510721 2026] [:error] [pid 55122:tid 55131] [client 45.157.54.16:50267] [client 45.157.54.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.157.54.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaBuHoLiR0OfjFxvcN9B7wAAAMc"]
[Fri Feb 27 00:00:30.514101 2026] [:error] [pid 3883:tid 3897] [client 45.157.54.16:50276] [client 45.157.54.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.157.54.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaBuHuA33x90V6yYHagKmgAAAUs"]
[Fri Feb 27 00:38:12.928161 2026] [:error] [pid 20059:tid 20126] [client 43.157.22.57:43992] [client 43.157.22.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaB29JZBS5wIa_NsqsjW8QAAAdg"]
[Fri Feb 27 01:54:19.086141 2026] [:error] [pid 20059:tid 20125] [client 125.75.66.97:59627] [client 125.75.66.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaCIy5ZBS5wIa_NsqsgXpAAAAdc"]
[Fri Feb 27 02:44:51.299632 2026] [:error] [pid 18843:tid 18963] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUoyuD2bhSYSowPs0ZkQAAARc"]
[Fri Feb 27 02:44:57.636210 2026] [:error] [pid 18843:tid 18947] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaCUqSuD2bhSYSowPs0ZpQAAAQc"]
[Fri Feb 27 02:44:57.808040 2026] [:error] [pid 18843:tid 18957] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUqSuD2bhSYSowPs0ZpgAAARE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:44:59.223858 2026] [:error] [pid 18843:tid 18942] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUqyuD2bhSYSowPs0ZqQAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:44:59.922185 2026] [:error] [pid 18843:tid 18950] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUqyuD2bhSYSowPs0ZqgAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:01.383101 2026] [:error] [pid 18843:tid 18945] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUrSuD2bhSYSowPs0ZrQAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:02.094893 2026] [:error] [pid 18843:tid 18943] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUriuD2bhSYSowPs0ZrwAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:03.496272 2026] [:error] [pid 18843:tid 18958] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUryuD2bhSYSowPs0ZswAAARI"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:04.180933 2026] [:error] [pid 18843:tid 18956] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUsCuD2bhSYSowPs0ZtAAAARA"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:05.656154 2026] [:error] [pid 18843:tid 18954] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUsSuD2bhSYSowPs0ZtgAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:07.868078 2026] [:error] [pid 18843:tid 18954] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUsyuD2bhSYSowPs0ZtwAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:09.232211 2026] [:error] [pid 18843:tid 18960] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUtSuD2bhSYSowPs0ZuwAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:09.912497 2026] [:error] [pid 18843:tid 18942] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUtSuD2bhSYSowPs0ZvAAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:11.365724 2026] [:error] [pid 18843:tid 18953] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUtyuD2bhSYSowPs0ZwAAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:12.064473 2026] [:error] [pid 18843:tid 18963] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUuCuD2bhSYSowPs0ZxgAAARc"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:13.529965 2026] [:error] [pid 18843:tid 18947] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUuSuD2bhSYSowPs0ZywAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:14.211993 2026] [:error] [pid 18843:tid 18959] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUuiuD2bhSYSowPs0ZzAAAARM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:15.624815 2026] [:error] [pid 18843:tid 18953] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUuyuD2bhSYSowPs0Z1gAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:16.274976 2026] [:error] [pid 18843:tid 18958] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUvCuD2bhSYSowPs0Z2gAAARI"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:17.646679 2026] [:error] [pid 18843:tid 18960] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUvSuD2bhSYSowPs0Z3QAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:18.321203 2026] [:error] [pid 18843:tid 18944] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUviuD2bhSYSowPs0Z5QAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:19.833459 2026] [:error] [pid 18843:tid 18954] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUvyuD2bhSYSowPs0Z7QAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:20.643513 2026] [:error] [pid 18843:tid 18944] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUwCuD2bhSYSowPs0Z9wAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:22.058331 2026] [:error] [pid 18843:tid 18955] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUwiuD2bhSYSowPs0Z_wAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:22.801972 2026] [:error] [pid 18843:tid 18950] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUwiuD2bhSYSowPs0aBQAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:24.307293 2026] [:error] [pid 18843:tid 18943] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUxCuD2bhSYSowPs0aDQAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:25.510945 2026] [:error] [pid 18843:tid 18943] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUxSuD2bhSYSowPs0aFAAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:27.082972 2026] [:error] [pid 18843:tid 18957] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUxyuD2bhSYSowPs0aGgAAARE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:27.793200 2026] [:error] [pid 18843:tid 18952] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUxyuD2bhSYSowPs0aHAAAAQw"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:29.263847 2026] [:error] [pid 18843:tid 18940] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUySuD2bhSYSowPs0aIAAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:30.042918 2026] [:error] [pid 18843:tid 18942] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUyiuD2bhSYSowPs0aIgAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:31.512337 2026] [:error] [pid 18843:tid 18950] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUyyuD2bhSYSowPs0aJAAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:32.178041 2026] [:error] [pid 18843:tid 18963] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUzCuD2bhSYSowPs0aJwAAARc"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:33.537859 2026] [:error] [pid 18843:tid 18941] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUzSuD2bhSYSowPs0aLAAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:34.251121 2026] [:error] [pid 18843:tid 18957] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCUziuD2bhSYSowPs0aLgAAARE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:36.355577 2026] [:error] [pid 18843:tid 18946] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU0CuD2bhSYSowPs0aOAAAAQY"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:37.015643 2026] [:error] [pid 18843:tid 18959] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU0SuD2bhSYSowPs0aOQAAARM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:38.424470 2026] [:error] [pid 18843:tid 18944] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU0iuD2bhSYSowPs0aPgAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:39.080785 2026] [:error] [pid 18843:tid 18953] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU0yuD2bhSYSowPs0aQQAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:40.465736 2026] [:error] [pid 18843:tid 18957] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU1CuD2bhSYSowPs0aRwAAARE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:41.179982 2026] [:error] [pid 18843:tid 18948] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU1SuD2bhSYSowPs0aSQAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:42.607549 2026] [:error] [pid 18843:tid 18942] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU1iuD2bhSYSowPs0aTAAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:43.298828 2026] [:error] [pid 18843:tid 18955] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU1yuD2bhSYSowPs0aTQAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:44.669489 2026] [:error] [pid 18843:tid 18947] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU2CuD2bhSYSowPs0aUgAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:45.355681 2026] [:error] [pid 18843:tid 18960] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU2SuD2bhSYSowPs0aWgAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:46.745448 2026] [:error] [pid 18843:tid 18963] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU2iuD2bhSYSowPs0aZAAAARc"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:47.468131 2026] [:error] [pid 18843:tid 18947] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU2yuD2bhSYSowPs0aaAAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:48.891169 2026] [:error] [pid 18843:tid 18944] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU3CuD2bhSYSowPs0adwAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:49.582916 2026] [:error] [pid 18843:tid 18958] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU3SuD2bhSYSowPs0aeQAAARI"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:51.036591 2026] [:error] [pid 18843:tid 18964] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU3yuD2bhSYSowPs0afgAAARg"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:51.792828 2026] [:error] [pid 18843:tid 18954] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU3yuD2bhSYSowPs0agQAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:53.340988 2026] [:error] [pid 18843:tid 18959] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU4SuD2bhSYSowPs0ahwAAARM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:54.112589 2026] [:error] [pid 18843:tid 18960] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU4iuD2bhSYSowPs0aigAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:55.698300 2026] [:error] [pid 18843:tid 18950] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU4yuD2bhSYSowPs0ajgAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:56.373591 2026] [:error] [pid 18843:tid 18943] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU5CuD2bhSYSowPs0akAAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:57.774561 2026] [:error] [pid 18843:tid 18961] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU5SuD2bhSYSowPs0akwAAARU"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:58.454843 2026] [:error] [pid 18843:tid 18963] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU5iuD2bhSYSowPs0alAAAARc"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:45:59.908448 2026] [:error] [pid 18843:tid 18956] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU5yuD2bhSYSowPs0algAAARA"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:46:00.666164 2026] [:error] [pid 18843:tid 18962] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU6CuD2bhSYSowPs0amAAAARY"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:46:02.098674 2026] [:error] [pid 18843:tid 18941] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU6iuD2bhSYSowPs0anAAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:46:02.773530 2026] [:error] [pid 18843:tid 18958] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU6iuD2bhSYSowPs0anQAAARI"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:46:04.215812 2026] [:error] [pid 18843:tid 18957] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU7CuD2bhSYSowPs0anwAAARE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:46:04.915431 2026] [:error] [pid 18843:tid 18949] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU7CuD2bhSYSowPs0aogAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:46:06.384795 2026] [:error] [pid 18843:tid 18951] [client 54.215.238.21:50936] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU7iuD2bhSYSowPs0apAAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:46:07.564446 2026] [:error] [pid 19020:tid 19046] [client 54.215.238.21:53700] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU77N3kp7wL6QzPnVMxgAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:46:09.037386 2026] [:error] [pid 19020:tid 19029] [client 54.215.238.21:53700] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU8bN3kp7wL6QzPnVMzAAAAUc"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:46:09.776045 2026] [:error] [pid 19020:tid 19035] [client 54.215.238.21:53700] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU8bN3kp7wL6QzPnVM0AAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:46:11.205126 2026] [:error] [pid 19020:tid 19022] [client 54.215.238.21:53700] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU87N3kp7wL6QzPnVM1AAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:46:12.996939 2026] [:error] [pid 19020:tid 19022] [client 54.215.238.21:53700] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU9LN3kp7wL6QzPnVM2AAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:46:14.366599 2026] [:error] [pid 19020:tid 19035] [client 54.215.238.21:53700] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU9rN3kp7wL6QzPnVM3gAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:46:15.036245 2026] [:error] [pid 19020:tid 19041] [client 54.215.238.21:53700] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU97N3kp7wL6QzPnVM4AAAAVM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:46:16.389939 2026] [:error] [pid 19020:tid 19046] [client 54.215.238.21:53700] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU-LN3kp7wL6QzPnVM5AAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:46:17.061903 2026] [:error] [pid 19020:tid 19032] [client 54.215.238.21:53700] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU-bN3kp7wL6QzPnVM6AAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 02:46:18.490573 2026] [:error] [pid 19020:tid 19023] [client 54.215.238.21:53700] [client 54.215.238.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.215.238.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaCU-rN3kp7wL6QzPnVM7QAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 03:36:07.536753 2026] [:error] [pid 18818:tid 18884] [client 187.86.247.108:23450] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCgpxhPgqk2SeS_W83hewAAAAA"]
[Fri Feb 27 03:48:36.328971 2026] [:error] [pid 64229:tid 64238] [client 147.93.39.188:46486] [client 147.93.39.188] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aaCjlA4WeEvq64DXt8jCAQAAAMc"]
[Fri Feb 27 03:48:36.329932 2026] [:error] [pid 64069:tid 64167] [client 147.93.39.188:46470] [client 147.93.39.188] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/core/.env"] [unique_id "aaCjlDj7uWj7Qx3w-DAkvwAAABY"]
[Fri Feb 27 03:57:36.129019 2026] [:error] [pid 64229:tid 64244] [client 45.165.121.118:28340] [client 45.165.121.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.165.121.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaClsA4WeEvq64DXt8jFAAAAAM0"]
[Fri Feb 27 04:01:03.959371 2026] [:error] [pid 37895:tid 37967] [client 45.165.121.118:28259] [client 45.165.121.118] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaCmf7x7AKEYlDsU2_11kwAAAJA"]
[Fri Feb 27 04:02:02.287136 2026] [:error] [pid 37893:tid 37907] [client 39.32.134.74:49989] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCmurCiThGvciFYy77iCwAAAAo"]
[Fri Feb 27 04:02:17.559660 2026] [:error] [pid 37893:tid 37917] [client 45.165.121.118:28567] [client 45.165.121.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.165.121.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCmybCiThGvciFYy77iNQAAABQ"]
[Fri Feb 27 04:03:21.530137 2026] [:error] [pid 37895:tid 37975] [client 45.165.121.118:28694] [client 45.165.121.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.165.121.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCnCbx7AKEYlDsU2_12swAAAJg"]
[Fri Feb 27 04:04:33.461988 2026] [:error] [pid 37893:tid 37907] [client 45.165.121.118:28343] [client 45.165.121.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.165.121.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCnUbCiThGvciFYy77jLAAAAAo"]
[Fri Feb 27 04:05:50.186841 2026] [:error] [pid 37894:tid 37926] [client 45.165.121.118:28578] [client 45.165.121.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.165.121.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCnngrG3d4cnTcm0zweygAAAEI"]
[Fri Feb 27 04:07:12.979065 2026] [:error] [pid 3974:tid 4045] [client 45.165.121.118:28453] [client 45.165.121.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.165.121.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCn8Hp-fQtdOYjkuFvAbQAAAEg"]
[Fri Feb 27 04:07:12.983516 2026] [:error] [pid 3974:tid 4045] [client 45.165.121.118:28453] [client 45.165.121.118] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/usr/local/apache/modsecurity-cwaf/rules/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 45.165.121.118 (+1 hits since last alert)|expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCn8Hp-fQtdOYjkuFvAbQAAAEg"]
[Fri Feb 27 04:08:56.978506 2026] [:error] [pid 3974:tid 4046] [client 45.165.121.118:28308] [client 45.165.121.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.165.121.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCoWHp-fQtdOYjkuFvBhQAAAEk"]
[Fri Feb 27 04:08:56.978613 2026] [:error] [pid 3974:tid 4046] [client 45.165.121.118:28308] [client 45.165.121.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 45.165.121.118, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCoWHp-fQtdOYjkuFvBhQAAAEk"]
[Fri Feb 27 04:09:19.868040 2026] [:error] [pid 5365:tid 5375] [client 39.32.134.74:55239] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCob5YAa8J3tYxdG3zO4QAAAQg"]
[Fri Feb 27 04:10:25.033538 2026] [:error] [pid 5365:tid 5388] [client 45.165.121.118:28508] [client 45.165.121.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.165.121.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCosZYAa8J3tYxdG3zRzwAAARU"]
[Fri Feb 27 04:10:25.033681 2026] [:error] [pid 5365:tid 5388] [client 45.165.121.118:28508] [client 45.165.121.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 45.165.121.118, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCosZYAa8J3tYxdG3zRzwAAARU"]
[Fri Feb 27 04:12:12.992725 2026] [:error] [pid 5365:tid 5375] [client 45.165.121.118:28587] [client 45.165.121.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.165.121.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCpHJYAa8J3tYxdG3zTzQAAAQg"]
[Fri Feb 27 04:12:12.992846 2026] [:error] [pid 5365:tid 5375] [client 45.165.121.118:28587] [client 45.165.121.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 45.165.121.118, counter = 8"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCpHJYAa8J3tYxdG3zTzQAAAQg"]
[Fri Feb 27 04:13:09.724478 2026] [:error] [pid 5365:tid 5382] [client 39.32.134.74:57878] [client 39.32.134.74] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaCpVZYAa8J3tYxdG3zUvwAAAQ8"]
[Fri Feb 27 04:13:45.003013 2026] [:error] [pid 5365:tid 5388] [client 45.165.121.118:28658] [client 45.165.121.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.165.121.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCpeZYAa8J3tYxdG3zVbAAAARU"]
[Fri Feb 27 04:13:45.003158 2026] [:error] [pid 5365:tid 5388] [client 45.165.121.118:28658] [client 45.165.121.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 45.165.121.118, counter = 9"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCpeZYAa8J3tYxdG3zVbAAAARU"]
[Fri Feb 27 04:14:40.557934 2026] [:error] [pid 5365:tid 5376] [client 39.32.134.74:58359] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCpsJYAa8J3tYxdG3zWAwAAAQk"]
[Fri Feb 27 04:15:21.117703 2026] [:error] [pid 3974:tid 4061] [client 45.165.121.118:28680] [client 45.165.121.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.165.121.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCp2Xp-fQtdOYjkuFvEWgAAAFg"]
[Fri Feb 27 04:15:21.117857 2026] [:error] [pid 3974:tid 4061] [client 45.165.121.118:28680] [client 45.165.121.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 45.165.121.118, counter = 10"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCp2Xp-fQtdOYjkuFvEWgAAAFg"]
[Fri Feb 27 04:16:06.609585 2026] [:error] [pid 5365:tid 5383] [client 43.166.250.187:58126] [client 43.166.250.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaCqBpYAa8J3tYxdG3zW_gAAARA"]
[Fri Feb 27 04:16:16.313187 2026] [:error] [pid 21329:tid 21401] [client 39.32.134.74:58678] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCqEJvQWnde-MjcQ1E26gAAAVI"]
[Fri Feb 27 04:17:00.976155 2026] [:error] [pid 5365:tid 5368] [client 45.165.121.118:28439] [client 45.165.121.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.165.121.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCqPJYAa8J3tYxdG3zYBAAAAQE"]
[Fri Feb 27 04:17:00.976322 2026] [:error] [pid 5365:tid 5368] [client 45.165.121.118:28439] [client 45.165.121.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 45.165.121.118, counter = 11"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCqPJYAa8J3tYxdG3zYBAAAAQE"]
[Fri Feb 27 04:17:52.505497 2026] [:error] [pid 5365:tid 5390] [client 39.32.134.74:58988] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCqcJYAa8J3tYxdG3zYbAAAARc"]
[Fri Feb 27 04:18:37.001665 2026] [:error] [pid 5365:tid 5382] [client 45.165.121.118:28349] [client 45.165.121.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.165.121.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCqnZYAa8J3tYxdG3zYqQAAAQ8"]
[Fri Feb 27 04:18:37.001862 2026] [:error] [pid 5365:tid 5382] [client 45.165.121.118:28349] [client 45.165.121.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 45.165.121.118, counter = 12"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCqnZYAa8J3tYxdG3zYqQAAAQ8"]
[Fri Feb 27 04:19:21.192809 2026] [:error] [pid 5365:tid 5374] [client 39.32.134.74:59280] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCqyZYAa8J3tYxdG3zZPwAAAQc"]
[Fri Feb 27 04:20:13.682839 2026] [:error] [pid 5365:tid 5379] [client 45.165.121.118:28463] [client 45.165.121.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.165.121.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCq_ZYAa8J3tYxdG3zadQAAAQw"]
[Fri Feb 27 04:20:13.682974 2026] [:error] [pid 5365:tid 5379] [client 45.165.121.118:28463] [client 45.165.121.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 45.165.121.118, counter = 13"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCq_ZYAa8J3tYxdG3zadQAAAQw"]
[Fri Feb 27 04:20:52.030884 2026] [:error] [pid 5365:tid 5368] [client 39.32.134.74:59578] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCrJJYAa8J3tYxdG3za6QAAAQE"]
[Fri Feb 27 04:21:41.004489 2026] [:error] [pid 3974:tid 4054] [client 45.165.121.118:28672] [client 45.165.121.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.165.121.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCrVXp-fQtdOYjkuFvGfgAAAFE"]
[Fri Feb 27 04:21:41.004631 2026] [:error] [pid 3974:tid 4054] [client 45.165.121.118:28672] [client 45.165.121.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 45.165.121.118, counter = 14"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCrVXp-fQtdOYjkuFvGfgAAAFE"]
[Fri Feb 27 04:22:20.541228 2026] [:error] [pid 5365:tid 5385] [client 39.32.134.74:59823] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCrfJYAa8J3tYxdG3zb5AAAARI"]
[Fri Feb 27 04:23:05.013775 2026] [:error] [pid 5365:tid 5376] [client 45.165.121.118:28551] [client 45.165.121.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.165.121.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCrqZYAa8J3tYxdG3zcaAAAAQk"]
[Fri Feb 27 04:23:05.013930 2026] [:error] [pid 5365:tid 5376] [client 45.165.121.118:28551] [client 45.165.121.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 45.165.121.118, counter = 15"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCrqZYAa8J3tYxdG3zcaAAAAQk"]
[Fri Feb 27 04:23:48.833802 2026] [:error] [pid 5365:tid 5390] [client 39.32.134.74:60062] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCr1JYAa8J3tYxdG3zdAAAAARc"]
[Fri Feb 27 04:25:37.460200 2026] [:error] [pid 21329:tid 21402] [client 39.32.134.74:60408] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCsQZvQWnde-MjcQ1E7zgAAAVM"]
[Fri Feb 27 04:27:14.350513 2026] [:error] [pid 5365:tid 5379] [client 39.32.134.74:61684] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCsopYAa8J3tYxdG3zg5wAAAQw"]
[Fri Feb 27 04:28:43.464950 2026] [:error] [pid 3973:tid 3988] [client 39.32.134.74:62987] [client 39.32.134.74] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaCs-4JZsftwqmUaaLPuRQAAAAU"]
[Fri Feb 27 04:28:45.648794 2026] [:error] [pid 5365:tid 5378] [client 39.32.134.74:63016] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCs_ZYAa8J3tYxdG3zsIAAAAQs"]
[Fri Feb 27 04:30:00.551488 2026] [:error] [pid 21329:tid 21402] [client 39.32.134.74:64052] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCtSJvQWnde-MjcQ1FKcQAAAVM"]
[Fri Feb 27 04:30:19.384998 2026] [:error] [pid 4081:tid 4092] [client 39.32.134.74:64279] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCtWw55mnr35z8h7t3WZQAAAMk"]
[Fri Feb 27 04:30:33.796283 2026] [:error] [pid 5365:tid 5368] [client 185.198.240.149:30601] [client 185.198.240.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/upload.php"] [unique_id "aaCtaZYAa8J3tYxdG3z9GwAAAQE"]
[Fri Feb 27 04:30:58.971619 2026] [autoindex:error] [pid 5365:tid 5387] [client 173.239.214.5:44173] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:30:59.327839 2026] [autoindex:error] [pid 5365:tid 5389] [client 173.239.214.5:44173] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:30:59.595154 2026] [autoindex:error] [pid 5365:tid 5369] [client 173.239.214.5:44173] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:30:59.908263 2026] [autoindex:error] [pid 5365:tid 5369] [client 173.239.214.5:44173] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:31:06.567295 2026] [autoindex:error] [pid 5365:tid 5380] [client 173.239.214.5:44173] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:31:06.829203 2026] [autoindex:error] [pid 5365:tid 5375] [client 173.239.214.5:44173] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:31:07.107287 2026] [autoindex:error] [pid 5365:tid 5380] [client 173.239.214.5:44173] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:31:07.384347 2026] [autoindex:error] [pid 5365:tid 5379] [client 173.239.214.5:44173] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:31:07.637286 2026] [autoindex:error] [pid 5365:tid 5367] [client 173.239.214.5:44173] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:31:07.882604 2026] [autoindex:error] [pid 5365:tid 5383] [client 173.239.214.5:44173] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:31:08.635189 2026] [autoindex:error] [pid 5365:tid 5386] [client 173.239.214.5:44173] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:31:15.066883 2026] [:error] [pid 5365:tid 5376] [client 39.32.134.74:65129] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCtk5YAa8J3tYxdG3wA0QAAAQk"]
[Fri Feb 27 04:31:17.892342 2026] [autoindex:error] [pid 21329:tid 21384] [client 185.198.240.157:38249] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:31:18.214774 2026] [autoindex:error] [pid 21329:tid 21399] [client 185.198.240.157:38249] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:31:29.959533 2026] [autoindex:error] [pid 21329:tid 21405] [client 185.198.240.157:38249] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:31:30.266289 2026] [autoindex:error] [pid 21329:tid 21398] [client 185.198.240.157:38249] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:31:30.543208 2026] [autoindex:error] [pid 21329:tid 21393] [client 185.198.240.157:38249] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:31:30.926305 2026] [autoindex:error] [pid 21329:tid 21384] [client 185.198.240.157:38249] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:31:37.001971 2026] [autoindex:error] [pid 21329:tid 21394] [client 185.198.240.157:38249] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:31:37.303986 2026] [autoindex:error] [pid 21329:tid 21406] [client 185.198.240.157:38249] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:31:41.258340 2026] [autoindex:error] [pid 21329:tid 21384] [client 185.198.240.157:38249] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:31:46.434735 2026] [:error] [pid 21329:tid 21390] [client 39.32.134.74:65523] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCtspvQWnde-MjcQ1FQrAAAAUc"]
[Fri Feb 27 04:31:47.993265 2026] [autoindex:error] [pid 21329:tid 21384] [client 185.198.240.157:38249] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:31:48.309156 2026] [autoindex:error] [pid 21329:tid 21399] [client 185.198.240.157:38249] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:31:48.628743 2026] [autoindex:error] [pid 21329:tid 21403] [client 185.198.240.157:38249] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:32:00.237231 2026] [autoindex:error] [pid 21329:tid 21403] [client 185.198.240.157:38249] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:32:08.182805 2026] [autoindex:error] [pid 21329:tid 21383] [client 185.198.240.157:38249] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:32:10.326504 2026] [autoindex:error] [pid 21329:tid 21386] [client 185.198.240.157:38249] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:32:10.763072 2026] [autoindex:error] [pid 21329:tid 21407] [client 185.198.240.157:38249] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:32:11.727809 2026] [autoindex:error] [pid 21329:tid 21402] [client 185.198.240.157:38249] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:32:12.030892 2026] [autoindex:error] [pid 21329:tid 21404] [client 185.198.240.157:38249] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:32:12.312690 2026] [autoindex:error] [pid 21329:tid 21383] [client 185.198.240.157:38249] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:32:23.617407 2026] [autoindex:error] [pid 21329:tid 21390] [client 185.198.240.157:38249] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:32:33.757598 2026] [:error] [pid 42435:tid 42450] [client 39.32.134.74:49756] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCt4R5hHLnaukp_y9955AAAAYo"]
[Fri Feb 27 04:32:38.227197 2026] [:error] [pid 21329:tid 21392] [client 185.198.240.157:38249] [client 185.198.240.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/controller/extension/extension/"] [unique_id "aaCt5pvQWnde-MjcQ1FSogAAAUk"]
[Fri Feb 27 04:33:09.264115 2026] [:error] [pid 5365:tid 5388] [client 39.32.134.74:50164] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCuBZYAa8J3tYxdG3wG6wAAARU"]
[Fri Feb 27 04:33:09.944242 2026] [autoindex:error] [pid 3974:tid 4060] [client 173.239.214.15:25333] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:33:10.241584 2026] [autoindex:error] [pid 3974:tid 4058] [client 173.239.214.15:25333] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:33:10.493467 2026] [autoindex:error] [pid 3974:tid 4049] [client 173.239.214.15:25333] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:33:10.740135 2026] [autoindex:error] [pid 3974:tid 4042] [client 173.239.214.15:25333] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:33:14.945466 2026] [autoindex:error] [pid 3974:tid 4054] [client 173.239.214.15:25333] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:33:15.199345 2026] [autoindex:error] [pid 3974:tid 4057] [client 173.239.214.15:25333] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:33:16.784882 2026] [autoindex:error] [pid 3974:tid 4059] [client 173.239.214.15:25333] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:33:18.340927 2026] [autoindex:error] [pid 3974:tid 4035] [client 173.239.214.15:25333] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:33:18.590827 2026] [autoindex:error] [pid 3974:tid 4043] [client 173.239.214.15:25333] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:33:18.905805 2026] [autoindex:error] [pid 3974:tid 4033] [client 173.239.214.15:25333] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:33:20.517551 2026] [autoindex:error] [pid 3974:tid 4042] [client 173.239.214.15:25333] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:33:20.890764 2026] [autoindex:error] [pid 3974:tid 4038] [client 173.239.214.15:25333] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:33:21.195816 2026] [autoindex:error] [pid 3974:tid 4048] [client 173.239.214.15:25333] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:33:21.491041 2026] [autoindex:error] [pid 3974:tid 4051] [client 173.239.214.15:25333] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:33:51.035715 2026] [autoindex:error] [pid 3974:tid 4040] [client 173.239.214.15:25333] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 04:33:54.354188 2026] [:error] [pid 3974:tid 4060] [client 173.239.214.15:25333] [client 173.239.214.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/rishi/"] [unique_id "aaCuMnp-fQtdOYjkuFvZTwAAAFc"]
[Fri Feb 27 04:33:54.831691 2026] [:error] [pid 42658:tid 42678] [client 39.32.134.74:50538] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCuMozcoYl3nRbu1jZG5wAAAhI"]
[Fri Feb 27 04:35:22.304253 2026] [:error] [pid 5365:tid 5391] [client 39.32.134.74:51167] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCuipYAa8J3tYxdG3wLpAAAARg"]
[Fri Feb 27 04:35:47.019011 2026] [:error] [pid 5365:tid 5376] [client 39.32.134.74:51494] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCuo5YAa8J3tYxdG3wMjAAAAQk"]
[Fri Feb 27 04:36:52.496012 2026] [:error] [pid 42435:tid 42453] [client 39.32.134.74:52380] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCu5B5hHLnaukp_y9994gAAAY0"]
[Fri Feb 27 04:36:59.143222 2026] [:error] [pid 42658:tid 42673] [client 39.32.134.74:52476] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaCu64zcoYl3nRbu1jZL9wAAAg0"]
[Fri Feb 27 04:44:53.734246 2026] [:error] [pid 5365:tid 5372] [client 20.41.98.49:5837] [client 20.41.98.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aaCwxZYAa8J3tYxdG3wc-wAAAQU"]
[Fri Feb 27 04:44:54.279996 2026] [:error] [pid 42435:tid 42451] [client 20.41.98.49:5831] [client 20.41.98.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aaCwxh5hHLnaukp_y9-BeQAAAYs"]
[Fri Feb 27 04:44:54.846743 2026] [:error] [pid 4081:tid 4088] [client 20.41.98.49:5367] [client 20.41.98.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aaCwxg55mnr35z8h7t3fhwAAAMU"]
[Fri Feb 27 04:44:55.385711 2026] [:error] [pid 42658:tid 42677] [client 20.41.98.49:5590] [client 20.41.98.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aaCwx4zcoYl3nRbu1jZXowAAAhE"]
[Fri Feb 27 05:24:24.910835 2026] [:error] [pid 5365:tid 5381] [client 39.32.134.74:53736] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC6CJYAa8J3tYxdG3w4TgAAAQ4"]
[Fri Feb 27 05:24:25.007627 2026] [:error] [pid 5365:tid 5388] [client 39.32.134.74:53738] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC6CZYAa8J3tYxdG3w4TwAAARU"]
[Fri Feb 27 05:25:40.232448 2026] [:error] [pid 21329:tid 21397] [client 39.32.134.74:54945] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC6VJvQWnde-MjcQ1FfQQAAAU4"]
[Fri Feb 27 05:25:52.594795 2026] [:error] [pid 42435:tid 42449] [client 39.32.134.74:55100] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC6YB5hHLnaukp_y9-L8QAAAYk"]
[Fri Feb 27 05:26:47.021131 2026] [:error] [pid 42658:tid 42676] [client 39.32.134.74:56348] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC6l4zcoYl3nRbu1jZrwgAAAhA"]
[Fri Feb 27 05:27:15.682235 2026] [:error] [pid 4081:tid 4093] [client 39.32.134.74:56949] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC6sw55mnr35z8h7t3kwQAAAMo"]
[Fri Feb 27 05:28:03.021795 2026] [:error] [pid 5365:tid 5371] [client 39.32.134.74:57952] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC645YAa8J3tYxdG3w7AgAAAQQ"]
[Fri Feb 27 05:28:38.435101 2026] [:error] [pid 5365:tid 5385] [client 39.32.134.74:58521] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC7BpYAa8J3tYxdG3w7SwAAARI"]
[Fri Feb 27 05:29:24.235514 2026] [:error] [pid 5365:tid 5369] [client 39.32.134.74:59229] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC7NJYAa8J3tYxdG3w74QAAAQI"]
[Fri Feb 27 05:29:55.733938 2026] [:error] [pid 5365:tid 5375] [client 39.32.134.74:59899] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC7U5YAa8J3tYxdG3w8YAAAAQg"]
[Fri Feb 27 05:31:08.890138 2026] [:error] [pid 42658:tid 42660] [client 39.32.134.74:62064] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC7nIzcoYl3nRbu1jZtRwAAAgA"]
[Fri Feb 27 05:31:29.739730 2026] [:error] [pid 21329:tid 21386] [client 39.32.134.74:62688] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC7sZvQWnde-MjcQ1FgtwAAAUM"]
[Fri Feb 27 05:32:27.944318 2026] [:error] [pid 5365:tid 5368] [client 39.32.134.74:63939] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC765YAa8J3tYxdG3w96gAAAQE"]
[Fri Feb 27 05:32:48.450258 2026] [:error] [pid 21329:tid 21402] [client 39.32.134.74:64215] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC8AJvQWnde-MjcQ1Fg6gAAAVM"]
[Fri Feb 27 05:33:32.055501 2026] [:error] [pid 42563:tid 42580] [client 39.32.134.74:64987] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC8LHKL5BclZy73IRHIkgAAAco"]
[Fri Feb 27 05:34:18.237087 2026] [:error] [pid 42435:tid 42443] [client 39.32.134.74:49220] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC8Wh5hHLnaukp_y9-OxgAAAYM"]
[Fri Feb 27 05:34:38.523014 2026] [:error] [pid 3974:tid 4061] [client 39.32.134.74:49534] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC8bnp-fQtdOYjkuFvf7QAAAFg"]
[Fri Feb 27 05:35:42.242622 2026] [:error] [pid 42658:tid 42663] [client 39.32.134.74:50517] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC8rozcoYl3nRbu1jZueAAAAgM"]
[Fri Feb 27 05:35:43.283473 2026] [:error] [pid 21329:tid 21383] [client 39.32.134.74:50532] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC8r5vQWnde-MjcQ1FhgAAAAUA"]
[Fri Feb 27 05:36:51.718487 2026] [:error] [pid 5365:tid 5387] [client 39.32.134.74:52002] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC885YAa8J3tYxdG3w_9AAAARQ"]
[Fri Feb 27 05:37:06.387460 2026] [:error] [pid 3973:tid 3991] [client 39.32.134.74:52259] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC9AoJZsftwqmUaaLP8tgAAAAg"]
[Fri Feb 27 05:37:58.695633 2026] [:error] [pid 3973:tid 3992] [client 39.32.134.74:53136] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC9NoJZsftwqmUaaLP8ygAAAAk"]
[Fri Feb 27 05:38:29.398784 2026] [:error] [pid 5365:tid 5369] [client 39.32.134.74:53642] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC9VZYAa8J3tYxdG3xAigAAAQI"]
[Fri Feb 27 05:43:32.867002 2026] [:error] [pid 5365:tid 5386] [client 39.32.134.74:54336] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC-hJYAa8J3tYxdG3xC-gAAARM"]
[Fri Feb 27 05:44:23.470904 2026] [:error] [pid 5365:tid 5375] [client 39.32.134.74:55083] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC-t5YAa8J3tYxdG3xDxwAAAQg"]
[Fri Feb 27 05:44:49.320470 2026] [:error] [pid 5365:tid 5387] [client 39.32.134.74:55473] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC-0ZYAa8J3tYxdG3xD6AAAARQ"]
[Fri Feb 27 05:45:45.275165 2026] [:error] [pid 42435:tid 42453] [client 39.32.134.74:56193] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC_CR5hHLnaukp_y9-RDwAAAY0"]
[Fri Feb 27 05:46:05.150604 2026] [:error] [pid 5365:tid 5388] [client 39.32.134.74:56464] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC_HZYAa8J3tYxdG3xEWwAAARU"]
[Fri Feb 27 05:47:08.687944 2026] [:error] [pid 5365:tid 5381] [client 39.32.134.74:57313] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC_XJYAa8J3tYxdG3xE5wAAAQ4"]
[Fri Feb 27 05:47:15.061669 2026] [:error] [pid 42563:tid 42591] [client 39.32.134.74:57398] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC_Y3KL5BclZy73IRHMiQAAAdU"]
[Fri Feb 27 05:48:14.178997 2026] [:error] [pid 3974:tid 4052] [client 39.32.134.74:58230] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC_nnp-fQtdOYjkuFvhXgAAAE8"]
[Fri Feb 27 05:48:35.052148 2026] [:error] [pid 5365:tid 5385] [client 39.32.134.74:58500] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC_s5YAa8J3tYxdG3xFkAAAARI"]
[Fri Feb 27 05:49:26.473623 2026] [:error] [pid 5365:tid 5370] [client 39.32.134.74:59263] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaC_5pYAa8J3tYxdG3xGZAAAAQM"]
[Fri Feb 27 05:49:58.554281 2026] [:error] [pid 5365:tid 5378] [client 39.32.134.74:59751] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDABpYAa8J3tYxdG3xHEwAAAQs"]
[Fri Feb 27 05:50:49.413342 2026] [:error] [pid 42658:tid 42679] [client 39.32.134.74:60459] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDAOYzcoYl3nRbu1jZ1rwAAAhM"]
[Fri Feb 27 05:51:24.631263 2026] [:error] [pid 4081:tid 4094] [client 39.32.134.74:60992] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDAXA55mnr35z8h7t3n2wAAAMs"]
[Fri Feb 27 05:52:15.261188 2026] [:error] [pid 5365:tid 5369] [client 39.32.134.74:61585] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDAj5YAa8J3tYxdG3xJnAAAAQI"]
[Fri Feb 27 05:52:49.306777 2026] [:error] [pid 42435:tid 42452] [client 39.32.134.74:62040] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDAsR5hHLnaukp_y9-TEAAAAYw"]
[Fri Feb 27 05:53:31.255229 2026] [:error] [pid 42563:tid 42574] [client 39.32.134.74:62861] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDA23KL5BclZy73IRHPfQAAAcY"]
[Fri Feb 27 05:54:08.370143 2026] [:error] [pid 42435:tid 42448] [client 39.32.134.74:63406] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDBAB5hHLnaukp_y9-TVgAAAYg"]
[Fri Feb 27 05:54:43.607445 2026] [:error] [pid 21329:tid 21407] [client 39.32.134.74:63747] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDBI5vQWnde-MjcQ1Fk3wAAAVg"]
[Fri Feb 27 05:55:29.535371 2026] [:error] [pid 4081:tid 4097] [client 39.32.134.74:64321] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDBUQ55mnr35z8h7t3oHgAAAM4"]
[Fri Feb 27 05:55:51.364461 2026] [:error] [pid 42658:tid 42672] [client 39.32.134.74:64690] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDBZ4zcoYl3nRbu1jZ25QAAAgw"]
[Fri Feb 27 05:56:50.596096 2026] [:error] [pid 3974:tid 4046] [client 39.32.134.74:49303] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDBonp-fQtdOYjkuFviZgAAAEk"]
[Fri Feb 27 05:56:50.788564 2026] [:error] [pid 5365:tid 5367] [client 39.32.134.74:49308] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDBopYAa8J3tYxdG3xLygAAAQA"]
[Fri Feb 27 05:57:51.632048 2026] [:error] [pid 3974:tid 4049] [client 39.32.134.74:50263] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDB33p-fQtdOYjkuFvibAAAAEw"]
[Fri Feb 27 05:58:18.704686 2026] [:error] [pid 5365:tid 5367] [client 39.32.134.74:50704] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDB-pYAa8J3tYxdG3xMvAAAAQA"]
[Fri Feb 27 05:58:50.564661 2026] [:error] [pid 4081:tid 4090] [client 39.32.134.74:51180] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDCGg55mnr35z8h7t3okQAAAMc"]
[Fri Feb 27 05:59:40.195511 2026] [:error] [pid 3975:tid 4012] [client 39.32.134.74:51948] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDCTBMVp0-T2hD76b3CYQAAAII"]
[Fri Feb 27 05:59:50.768691 2026] [:error] [pid 5365:tid 5371] [client 39.32.134.74:52127] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDCVpYAa8J3tYxdG3xNcQAAAQQ"]
[Fri Feb 27 06:00:54.252925 2026] [:error] [pid 5365:tid 5381] [client 39.32.134.74:53146] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDClpYAa8J3tYxdG3xN5QAAAQ4"]
[Fri Feb 27 06:01:05.227692 2026] [:error] [pid 42563:tid 42573] [client 39.32.134.74:53329] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDCoXKL5BclZy73IRHRPwAAAcU"]
[Fri Feb 27 06:01:54.557243 2026] [:error] [pid 42435:tid 42461] [client 39.32.134.74:54079] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDC0h5hHLnaukp_y9-UYQAAAZU"]
[Fri Feb 27 06:02:26.657837 2026] [:error] [pid 42563:tid 42580] [client 39.32.134.74:54593] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDC8nKL5BclZy73IRHRwgAAAco"]
[Fri Feb 27 06:02:54.370556 2026] [:error] [pid 42658:tid 42683] [client 39.32.134.74:54982] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDDDozcoYl3nRbu1jZ47gAAAhc"]
[Fri Feb 27 06:03:39.331297 2026] [:error] [pid 42563:tid 42584] [client 39.32.134.74:55557] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDDO3KL5BclZy73IRHR-gAAAc4"]
[Fri Feb 27 06:03:53.531509 2026] [:error] [pid 42658:tid 42677] [client 39.32.134.74:55776] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDDSYzcoYl3nRbu1jZ5OwAAAhE"]
[Fri Feb 27 06:04:46.752671 2026] [:error] [pid 4081:tid 4087] [client 39.32.134.74:56619] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDDfg55mnr35z8h7t3pTQAAAMQ"]
[Fri Feb 27 06:04:54.341894 2026] [:error] [pid 42435:tid 42440] [client 39.32.134.74:56763] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDDhh5hHLnaukp_y9-UywAAAYA"]
[Fri Feb 27 06:05:54.134418 2026] [:error] [pid 42658:tid 42660] [client 39.32.134.74:57693] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDDwozcoYl3nRbu1jZ6CgAAAgA"]
[Fri Feb 27 06:05:55.342224 2026] [:error] [pid 42658:tid 42667] [client 39.32.134.74:57711] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDDw4zcoYl3nRbu1jZ6EAAAAgc"]
[Fri Feb 27 06:06:54.311501 2026] [:error] [pid 42435:tid 42440] [client 39.32.134.74:58648] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDD_h5hHLnaukp_y9-VPQAAAYA"]
[Fri Feb 27 06:07:02.661497 2026] [:error] [pid 4081:tid 4083] [client 39.32.134.74:58788] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDEBg55mnr35z8h7t3pgAAAAMA"]
[Fri Feb 27 06:07:54.245906 2026] [:error] [pid 5365:tid 5384] [client 39.32.134.74:59643] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDEOpYAa8J3tYxdG3xRvAAAARE"]
[Fri Feb 27 06:08:01.388163 2026] [:error] [pid 5365:tid 5383] [client 39.32.134.74:59761] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDEQZYAa8J3tYxdG3xRxAAAARA"]
[Fri Feb 27 06:08:54.492517 2026] [:error] [pid 42563:tid 42585] [client 39.32.134.74:60592] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDEdnKL5BclZy73IRHTkAAAAc8"]
[Fri Feb 27 06:09:00.374065 2026] [:error] [pid 5365:tid 5379] [client 39.32.134.74:60690] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDEfJYAa8J3tYxdG3xSRwAAAQw"]
[Fri Feb 27 06:09:54.189902 2026] [:error] [pid 42658:tid 42662] [client 39.32.134.74:61371] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDEsozcoYl3nRbu1jZ8UgAAAgI"]
[Fri Feb 27 06:10:03.575957 2026] [:error] [pid 21329:tid 21384] [client 39.32.134.74:61493] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDEu5vQWnde-MjcQ1FnRAAAAUE"]
[Fri Feb 27 06:10:54.331048 2026] [:error] [pid 3973:tid 4001] [client 39.32.134.74:62082] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDE7oJZsftwqmUaaLP-kAAAABI"]
[Fri Feb 27 06:11:04.183653 2026] [:error] [pid 21329:tid 21383] [client 39.32.134.74:62161] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDE-JvQWnde-MjcQ1FnnAAAAUA"]
[Fri Feb 27 06:11:53.482957 2026] [:error] [pid 5365:tid 5381] [client 39.32.134.74:62555] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDFKZYAa8J3tYxdG3xTzQAAAQ4"]
[Fri Feb 27 06:12:53.687584 2026] [:error] [pid 4081:tid 4092] [client 39.32.134.74:62941] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDFZQ55mnr35z8h7t3qCwAAAMk"]
[Fri Feb 27 06:13:53.591969 2026] [:error] [pid 42658:tid 42669] [client 39.32.134.74:63314] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDFoYzcoYl3nRbu1jZ-IQAAAgk"]
[Fri Feb 27 06:14:53.884723 2026] [:error] [pid 5365:tid 5386] [client 39.32.134.74:63650] [client 39.32.134.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.32.134.74, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDF3ZYAa8J3tYxdG3xVlQAAARM"]
[Fri Feb 27 06:39:26.671742 2026] [:error] [pid 5365:tid 5381] [client 187.86.247.108:22757] [client 187.86.247.108] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaDLnpYAa8J3tYxdG3xjEAAAAQ4"]
[Fri Feb 27 06:40:07.997038 2026] [:error] [pid 42435:tid 42447] [client 43.164.197.224:35322] [client 43.164.197.224] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaDLxx5hHLnaukp_y9-cMwAAAYc"]
[Fri Feb 27 06:41:02.709235 2026] [:error] [pid 42658:tid 42665] [client 187.86.247.108:60143] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDL_ozcoYl3nRbu1jaKGwAAAgU"]
[Fri Feb 27 06:42:16.184544 2026] [:error] [pid 42563:tid 42583] [client 187.86.247.108:60375] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDMSHKL5BclZy73IRHd1gAAAc0"]
[Fri Feb 27 06:43:31.371893 2026] [:error] [pid 42563:tid 42593] [client 187.86.247.108:20357] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDMk3KL5BclZy73IRHeQAAAAdc"]
[Fri Feb 27 06:43:31.375401 2026] [:error] [pid 42563:tid 42593] [client 187.86.247.108:20357] [client 187.86.247.108] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1adminadmin2023%wppass_u%title0x4b05b1f4description0x4b05b1f4mt_keywords0x4b05b1f4mt_excerpt0x4b05b1f41"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDMk3KL5BclZy73IRHeQAAAAdc"]
[Fri Feb 27 06:44:34.797794 2026] [:error] [pid 5365:tid 5381] [client 187.86.247.108:60243] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDM0pYAa8J3tYxdG3xl7wAAAQ4"]
[Fri Feb 27 06:44:34.799138 2026] [:error] [pid 5365:tid 5381] [client 187.86.247.108:60243] [client 187.86.247.108] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDM0pYAa8J3tYxdG3xl7wAAAQ4"]
[Fri Feb 27 06:44:34.800443 2026] [:error] [pid 5365:tid 5381] [client 187.86.247.108:60243] [client 187.86.247.108] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDM0pYAa8J3tYxdG3xl7wAAAQ4"]
[Fri Feb 27 06:45:56.275641 2026] [:error] [pid 42435:tid 42449] [client 187.86.247.108:23180] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDNJB5hHLnaukp_y9-dlwAAAYk"]
[Fri Feb 27 06:45:56.280102 2026] [:error] [pid 42435:tid 42449] [client 187.86.247.108:23180] [client 187.86.247.108] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1adminadmin%expressinteriorstitle0x8db44782description0x8db44782mt_keywords0x8db44782mt_excerpt0x8db447821"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDNJB5hHLnaukp_y9-dlwAAAYk"]
[Fri Feb 27 06:47:06.635575 2026] [:error] [pid 4081:tid 4088] [client 187.86.247.108:22565] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDNag55mnr35z8h7t3uPQAAAMU"]
[Fri Feb 27 06:48:26.973922 2026] [:error] [pid 5365:tid 5368] [client 187.86.247.108:22716] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDNupYAa8J3tYxdG3xoPwAAAQE"]
[Fri Feb 27 06:49:28.151738 2026] [:error] [pid 42658:tid 42663] [client 187.86.247.108:22645] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDN-IzcoYl3nRbu1jaN4wAAAgM"]
[Fri Feb 27 06:50:40.517286 2026] [:error] [pid 5365:tid 5391] [client 187.86.247.108:23501] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDOQJYAa8J3tYxdG3xp1wAAARg"]
[Fri Feb 27 06:51:53.322708 2026] [:error] [pid 5365:tid 5369] [client 187.86.247.108:59443] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDOiZYAa8J3tYxdG3xqmgAAAQI"]
[Fri Feb 27 06:51:53.327926 2026] [:error] [pid 5365:tid 5369] [client 187.86.247.108:59443] [client 187.86.247.108] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1adminadmin%wppass_u%title0xfd1f4494description0xfd1f4494mt_keywords0xfd1f4494mt_excerpt0xfd1f44941"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDOiZYAa8J3tYxdG3xqmgAAAQI"]
[Fri Feb 27 06:52:59.204596 2026] [:error] [pid 42563:tid 42577] [client 187.86.247.108:22571] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDOy3KL5BclZy73IRHhIAAAAcg"]
[Fri Feb 27 06:54:15.041044 2026] [:error] [pid 5365:tid 5387] [client 187.86.247.108:22885] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDPF5YAa8J3tYxdG3xsPQAAARQ"]
[Fri Feb 27 06:55:14.052523 2026] [:error] [pid 5365:tid 5376] [client 187.86.247.108:59419] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDPUpYAa8J3tYxdG3xs3wAAAQk"]
[Fri Feb 27 06:56:10.133525 2026] [:error] [pid 3974:tid 4056] [client 187.86.247.108:23519] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDPinp-fQtdOYjkuFvoGAAAAFM"]
[Fri Feb 27 06:57:08.924133 2026] [:error] [pid 5365:tid 5386] [client 187.86.247.108:23191] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDPxJYAa8J3tYxdG3xuHAAAARM"]
[Fri Feb 27 06:58:13.525248 2026] [:error] [pid 3974:tid 4051] [client 187.86.247.108:23217] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDQBXp-fQtdOYjkuFvoMAAAAE4"]
[Fri Feb 27 06:58:13.528476 2026] [:error] [pid 3974:tid 4051] [client 187.86.247.108:23217] [client 187.86.247.108] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1admin%expressinteriorstitle0xf9a400a3description0xf9a400a3mt_keywords0xf9a400a3mt_excerpt0xf9a400a31"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDQBXp-fQtdOYjkuFvoMAAAAE4"]
[Fri Feb 27 06:59:25.274116 2026] [:error] [pid 5365:tid 5379] [client 187.86.247.108:23477] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDQTZYAa8J3tYxdG3xvTgAAAQw"]
[Fri Feb 27 07:00:20.536926 2026] [:error] [pid 42563:tid 42568] [client 187.86.247.108:23403] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDQhHKL5BclZy73IRHj8gAAAcA"]
[Fri Feb 27 07:01:22.304952 2026] [:error] [pid 21329:tid 21403] [client 187.86.247.108:23229] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDQwpvQWnde-MjcQ1FvuQAAAVQ"]
[Fri Feb 27 07:02:42.726097 2026] [:error] [pid 5365:tid 5374] [client 187.86.247.108:23353] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDREpYAa8J3tYxdG3xxJQAAAQc"]
[Fri Feb 27 07:03:51.615027 2026] [:error] [pid 42563:tid 42582] [client 187.86.247.108:23540] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDRV3KL5BclZy73IRHlTgAAAcw"]
[Fri Feb 27 07:05:11.426410 2026] [:error] [pid 42658:tid 42673] [client 187.86.247.108:22659] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDRp4zcoYl3nRbu1jaWEgAAAg0"]
[Fri Feb 27 07:06:38.765397 2026] [:error] [pid 3975:tid 4021] [client 187.86.247.108:23125] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDR_hMVp0-T2hD76b3HuwAAAIs"]
[Fri Feb 27 07:06:38.768512 2026] [:error] [pid 3975:tid 4021] [client 187.86.247.108:23125] [client 187.86.247.108] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1expressinteriors.comexpressinteriors.com2023%wppass_u%title0x91b96b4cdescription0x91b96b4cmt_keywords0x91b96b4cmt_excerpt0x91b96b4c1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDR_hMVp0-T2hD76b3HuwAAAIs"]
[Fri Feb 27 07:07:51.016734 2026] [:error] [pid 42658:tid 42670] [client 187.86.247.108:23061] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDSR4zcoYl3nRbu1jaXxQAAAgo"]
[Fri Feb 27 07:07:51.018739 2026] [:error] [pid 42658:tid 42670] [client 187.86.247.108:23061] [client 187.86.247.108] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDSR4zcoYl3nRbu1jaXxQAAAgo"]
[Fri Feb 27 07:07:51.020144 2026] [:error] [pid 42658:tid 42670] [client 187.86.247.108:23061] [client 187.86.247.108] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDSR4zcoYl3nRbu1jaXxQAAAgo"]
[Fri Feb 27 07:08:45.111527 2026] [:error] [pid 3973:tid 3992] [client 187.86.247.108:23354] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDSfYJZsftwqmUaaLMB_AAAAAk"]
[Fri Feb 27 07:08:45.116339 2026] [:error] [pid 3973:tid 3992] [client 187.86.247.108:23354] [client 187.86.247.108] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1expressinteriors.comexpressinteriors.com%expressinteriorstitle0xd6f6b870description0xd6f6b870mt_keywords0xd6f6b870mt_excerpt0xd6f6b8701"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDSfYJZsftwqmUaaLMB_AAAAAk"]
[Fri Feb 27 07:09:45.691018 2026] [:error] [pid 5365:tid 5368] [client 187.86.247.108:60077] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDSuZYAa8J3tYxdG3x5KQAAAQE"]
[Fri Feb 27 07:10:51.022023 2026] [:error] [pid 21329:tid 21401] [client 187.86.247.108:23306] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDS-5vQWnde-MjcQ1FxnAAAAVI"]
[Fri Feb 27 07:11:53.906772 2026] [:error] [pid 21329:tid 21398] [client 187.86.247.108:22796] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDTOZvQWnde-MjcQ1Fx2wAAAU8"]
[Fri Feb 27 07:12:50.614180 2026] [:error] [pid 42658:tid 42680] [client 187.86.247.108:23414] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDTcozcoYl3nRbu1jaavQAAAhQ"]
[Fri Feb 27 07:13:53.272568 2026] [:error] [pid 42435:tid 42455] [client 187.86.247.108:60293] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDTsR5hHLnaukp_y9-kCgAAAY8"]
[Fri Feb 27 07:13:53.277344 2026] [:error] [pid 42435:tid 42455] [client 187.86.247.108:60293] [client 187.86.247.108] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1expressinteriors.comexpressinteriors.com%wppass_u%title0xdd0574e4description0xdd0574e4mt_keywords0xdd0574e4mt_excerpt0xdd0574e41"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDTsR5hHLnaukp_y9-kCgAAAY8"]
[Fri Feb 27 07:14:53.455894 2026] [:error] [pid 5365:tid 5370] [client 187.86.247.108:23169] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDT7ZYAa8J3tYxdG3x9AQAAAQM"]
[Fri Feb 27 07:15:52.382019 2026] [:error] [pid 5365:tid 5378] [client 187.86.247.108:60227] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDUKJYAa8J3tYxdG3x9twAAAQs"]
[Fri Feb 27 07:16:53.092439 2026] [:error] [pid 42563:tid 42583] [client 187.86.247.108:60085] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDUZXKL5BclZy73IRHqhAAAAc0"]
[Fri Feb 27 07:17:51.556089 2026] [:error] [pid 5365:tid 5384] [client 187.86.247.108:23278] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDUn5YAa8J3tYxdG3x_6AAAARE"]
[Fri Feb 27 07:17:51.560849 2026] [:error] [pid 5365:tid 5384] [client 187.86.247.108:23278] [client 187.86.247.108] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1expressinteriors.comexpressinteriors%expressinteriors.comtitle0x0f6dcc4bdescription0x0f6dcc4bmt_keywords0x0f6dcc4bmt_excerpt0x0f6dcc4b1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDUn5YAa8J3tYxdG3x_6AAAARE"]
[Fri Feb 27 07:18:50.326198 2026] [:error] [pid 42563:tid 42573] [client 187.86.247.108:22798] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDU2nKL5BclZy73IRHrcAAAAcU"]
[Fri Feb 27 07:19:53.563369 2026] [:error] [pid 42563:tid 42574] [client 187.86.247.108:22567] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDVGXKL5BclZy73IRHsGgAAAcY"]
[Fri Feb 27 07:19:53.566512 2026] [:error] [pid 42563:tid 42574] [client 187.86.247.108:22567] [client 187.86.247.108] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1expressinteriors.com%expressinteriorstitle0x0ddc9884description0x0ddc9884mt_keywords0x0ddc9884mt_excerpt0x0ddc98841"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDVGXKL5BclZy73IRHsGgAAAcY"]
[Fri Feb 27 07:20:58.473947 2026] [:error] [pid 42435:tid 42462] [client 187.86.247.108:23156] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDVWh5hHLnaukp_y9-lqwAAAZY"]
[Fri Feb 27 07:22:11.091419 2026] [:error] [pid 42435:tid 42442] [client 187.86.247.108:23136] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDVox5hHLnaukp_y9-l3QAAAYI"]
[Fri Feb 27 07:23:01.295796 2026] [:error] [pid 42435:tid 42446] [client 187.86.247.108:23164] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDV1R5hHLnaukp_y9-mDAAAAYY"]
[Fri Feb 27 07:23:59.302076 2026] [:error] [pid 42563:tid 42582] [client 187.86.247.108:59933] [client 187.86.247.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.86.247.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaDWD3KL5BclZy73IRHthwAAAcw"]
[Fri Feb 27 08:21:08.227217 2026] [:error] [pid 54102:tid 54168] [client 114.80.36.40:47124] [client 114.80.36.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaDjdHi74D4fiYUm_GfLpQAAAJc"]
[Fri Feb 27 10:14:17.994949 2026] [:error] [pid 62998:tid 63015] [client 43.133.66.51:34488] [client 43.133.66.51] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaD9-VQeueXZDUmoLokE2gAAAQ0"]
[Fri Feb 27 11:07:36.349740 2026] [:error] [pid 62998:tid 63025] [client 64.64.108.62:46459] [client 64.64.108.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aaEKeFQeueXZDUmoLolFBwAAARc"]
[Fri Feb 27 11:07:37.288111 2026] [:error] [pid 62998:tid 63012] [client 64.64.108.36:39405] [client 64.64.108.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/chosen.php"] [unique_id "aaEKeVQeueXZDUmoLolFLQAAAQo"]
[Fri Feb 27 11:07:38.383632 2026] [:error] [pid 62998:tid 63025] [client 64.64.108.32:23105] [client 64.64.108.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/wp-conflg.php"] [unique_id "aaEKelQeueXZDUmoLolFWgAAARc"]
[Fri Feb 27 11:07:46.140772 2026] [:error] [pid 62998:tid 63021] [client 64.64.108.35:42163] [client 64.64.108.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aaEKglQeueXZDUmoLolGJwAAARM"]
[Fri Feb 27 11:07:47.188905 2026] [:error] [pid 56075:tid 56082] [client 64.64.108.41:29689] [client 64.64.108.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aaEKg8KBhrfI6KNv9Rh5xAAAAAU"]
[Fri Feb 27 11:08:14.253633 2026] [:error] [pid 62998:tid 63025] [client 64.64.108.43:60485] [client 64.64.108.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aaEKnlQeueXZDUmoLolIXAAAARc"]
[Fri Feb 27 11:08:15.605437 2026] [:error] [pid 62998:tid 63015] [client 64.64.108.34:26477] [client 64.64.108.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aaEKn1QeueXZDUmoLolIegAAAQ0"]
[Fri Feb 27 11:11:33.900904 2026] [:error] [pid 62998:tid 63018] [client 64.64.108.56:26599] [client 64.64.108.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.56, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaELZVQeueXZDUmoLolYBgAAARA"]
[Fri Feb 27 11:11:58.074208 2026] [:error] [pid 62998:tid 63010] [client 64.64.108.56:26599] [client 64.64.108.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/modules.php"] [unique_id "aaELflQeueXZDUmoLolajQAAAQg"]
[Fri Feb 27 11:15:23.462462 2026] [:error] [pid 49306:tid 49318] [client 64.64.108.32:38455] [client 64.64.108.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/lx.php"] [unique_id "aaEMS_nSUDZue59Px9tziwAAAUo"]
[Fri Feb 27 11:21:33.940616 2026] [:error] [pid 54231:tid 54242] [client 64.64.108.43:21439] [client 64.64.108.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-pano.php"] [unique_id "aaENveTvb5AeyJCdY7CG4QAAAEg"]
[Fri Feb 27 11:21:45.053772 2026] [:error] [pid 52073:tid 52099] [client 64.64.108.45:31297] [client 64.64.108.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aaENyYa650YPyxXVeRZ9fAAAAZc"]
[Fri Feb 27 11:21:45.987098 2026] [:error] [pid 52073:tid 52099] [client 64.64.108.46:34137] [client 64.64.108.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.64.108.46, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaENyYa650YPyxXVeRZ9hwAAAZc"]
[Fri Feb 27 11:22:19.949445 2026] [:error] [pid 52073:tid 52078] [client 64.64.108.46:34137] [client 64.64.108.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aaEN64a650YPyxXVeRZ_QgAAAYI"]
[Fri Feb 27 11:23:28.944581 2026] [:error] [pid 56075:tid 56097] [client 64.64.108.38:36781] [client 64.64.108.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aaEOMMKBhrfI6KNv9Rid4QAAABM"]
[Fri Feb 27 11:25:18.637520 2026] [:error] [pid 62998:tid 63025] [client 64.64.108.28:48169] [client 64.64.108.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aaEOnlQeueXZDUmoLomJfwAAARc"]
[Fri Feb 27 11:25:19.982233 2026] [:error] [pid 62998:tid 63006] [client 64.64.108.56:59497] [client 64.64.108.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaEOn1QeueXZDUmoLomJnQAAAQQ"]
[Fri Feb 27 11:25:21.094825 2026] [:error] [pid 56075:tid 56090] [client 64.64.108.55:60591] [client 64.64.108.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/about.php"] [unique_id "aaEOocKBhrfI6KNv9RigZAAAAAw"]
[Fri Feb 27 11:25:22.074324 2026] [:error] [pid 62998:tid 63001] [client 64.64.108.47:50993] [client 64.64.108.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/about.php"] [unique_id "aaEOolQeueXZDUmoLomJzAAAAQA"]
[Fri Feb 27 11:25:39.445730 2026] [:error] [pid 56075:tid 56085] [client 64.64.108.21:51667] [client 64.64.108.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/wp-login.php"] [unique_id "aaEOs8KBhrfI6KNv9Rig4QAAAAg"]
[Fri Feb 27 11:27:03.835332 2026] [:error] [pid 56075:tid 56081] [client 64.64.108.21:51667] [client 64.64.108.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aaEPB8KBhrfI6KNv9Rii4wAAAAQ"]
[Fri Feb 27 11:27:19.866199 2026] [:error] [pid 49306:tid 49330] [client 64.64.108.27:52561] [client 64.64.108.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aaEPF_nSUDZue59Px9uRgAAAAVY"]
[Fri Feb 27 11:27:57.734159 2026] [:error] [pid 49306:tid 49321] [client 64.64.108.27:52561] [client 64.64.108.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/makeasmtp.php"] [unique_id "aaEPPfnSUDZue59Px9uSlgAAAU0"]
[Fri Feb 27 11:27:59.392292 2026] [:error] [pid 62998:tid 63004] [client 64.64.108.32:45397] [client 64.64.108.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/about.php"] [unique_id "aaEPP1QeueXZDUmoLomP8AAAAQI"]
[Fri Feb 27 11:29:42.839925 2026] [:error] [pid 56075:tid 56098] [client 64.64.108.37:50413] [client 64.64.108.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "aaEPpsKBhrfI6KNv9RimNwAAABQ"]
[Fri Feb 27 11:30:02.452496 2026] [:error] [pid 52073:tid 52077] [client 64.64.108.30:38857] [client 64.64.108.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aaEPuoa650YPyxXVeRaSdQAAAYE"]
[Fri Feb 27 11:30:31.435162 2026] [:error] [pid 52073:tid 52097] [client 64.64.108.61:34591] [client 64.64.108.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bak.php"] [unique_id "aaEP14a650YPyxXVeRaTOAAAAZU"]
[Fri Feb 27 11:30:40.730409 2026] [:error] [pid 52073:tid 52092] [client 64.64.108.48:62745] [client 64.64.108.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aaEP4Ia650YPyxXVeRaTfgAAAZA"]
[Fri Feb 27 11:31:13.652408 2026] [:error] [pid 54103:tid 54170] [client 64.64.108.28:34405] [client 64.64.108.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aaEQAevG4MPCmE0B2sBNbwAAAMA"]
[Fri Feb 27 11:31:14.489779 2026] [:error] [pid 49306:tid 49314] [client 64.64.108.17:28037] [client 64.64.108.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aaEQAvnSUDZue59Px9uZuQAAAUY"]
[Fri Feb 27 11:31:15.572065 2026] [:error] [pid 56075:tid 56097] [client 64.64.108.19:51999] [client 64.64.108.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "aaEQA8KBhrfI6KNv9RioIQAAABM"]
[Fri Feb 27 11:31:33.732824 2026] [:error] [pid 56075:tid 56079] [client 64.64.108.19:51999] [client 64.64.108.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/themes.php"] [unique_id "aaEQFcKBhrfI6KNv9RionwAAAAI"]
[Fri Feb 27 11:32:03.535813 2026] [:error] [pid 54231:tid 54248] [client 64.64.108.29:30483] [client 64.64.108.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-includes_function.php"] [unique_id "aaEQM-Tvb5AeyJCdY7CWtQAAAE4"]
[Fri Feb 27 11:32:15.543625 2026] [:error] [pid 49306:tid 49313] [client 64.64.108.48:31373] [client 64.64.108.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/about.php"] [unique_id "aaEQP_nSUDZue59Px9ubOQAAAUU"]
[Fri Feb 27 11:32:28.629896 2026] [:error] [pid 54103:tid 54183] [client 64.64.108.46:58675] [client 64.64.108.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aaEQTOvG4MPCmE0B2sBN_wAAAMw"]
[Fri Feb 27 11:32:50.325819 2026] [:error] [pid 62998:tid 63011] [client 64.64.108.16:35867] [client 64.64.108.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/themes/wp-login.php"] [unique_id "aaEQYlQeueXZDUmoLomYHgAAAQk"]
[Fri Feb 27 11:33:04.737826 2026] [:error] [pid 62998:tid 63008] [client 64.64.108.16:35867] [client 64.64.108.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/index.php"] [unique_id "aaEQcFQeueXZDUmoLomYTAAAAQY"]
[Fri Feb 27 11:33:05.711055 2026] [:error] [pid 52073:tid 52087] [client 64.64.108.35:52237] [client 64.64.108.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaEQcYa650YPyxXVeRaVfwAAAYs"]
[Fri Feb 27 11:33:56.052455 2026] [:error] [pid 49306:tid 49322] [client 64.64.108.62:58001] [client 64.64.108.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aaEQpPnSUDZue59Px9udgQAAAU4"]
[Fri Feb 27 11:34:03.051104 2026] [autoindex:error] [pid 62998:tid 63021] [client 64.64.108.59:60335] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:34:03.460564 2026] [:error] [pid 62998:tid 63006] [client 64.64.108.59:60335] [client 64.64.108.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aaEQq1QeueXZDUmoLomZcAAAAQQ"]
[Fri Feb 27 11:34:04.602513 2026] [:error] [pid 62998:tid 63016] [client 64.64.108.19:34265] [client 64.64.108.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/about.php"] [unique_id "aaEQrFQeueXZDUmoLomZewAAAQ4"]
[Fri Feb 27 11:34:05.489408 2026] [:error] [pid 49306:tid 49322] [client 64.64.108.32:61549] [client 64.64.108.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Content/index.php"] [unique_id "aaEQrfnSUDZue59Px9udogAAAU4"]
[Fri Feb 27 11:34:06.492627 2026] [:error] [pid 62998:tid 63004] [client 64.64.108.48:58201] [client 64.64.108.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aaEQrlQeueXZDUmoLomZiQAAAQI"]
[Fri Feb 27 11:34:26.039470 2026] [:error] [pid 52073:tid 52077] [client 64.64.108.38:56447] [client 64.64.108.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/autoload_classmap.php"] [unique_id "aaEQwoa650YPyxXVeRaWcgAAAYE"]
[Fri Feb 27 11:34:38.558019 2026] [:error] [pid 49306:tid 49324] [client 64.64.108.23:55893] [client 64.64.108.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aaEQzvnSUDZue59Px9uepgAAAVA"]
[Fri Feb 27 11:34:48.241579 2026] [:error] [pid 52073:tid 52098] [client 64.64.108.37:22685] [client 64.64.108.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aaEQ2Ia650YPyxXVeRaW4AAAAZY"]
[Fri Feb 27 11:34:53.253612 2026] [:error] [pid 56075:tid 56088] [client 64.64.108.44:22893] [client 64.64.108.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/autoload_classmap.php"] [unique_id "aaEQ3cKBhrfI6KNv9Riq-gAAAAs"]
[Fri Feb 27 11:35:06.942176 2026] [:error] [pid 49306:tid 49326] [client 64.64.108.39:51261] [client 64.64.108.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aaEQ6vnSUDZue59Px9ufMAAAAVI"]
[Fri Feb 27 11:35:10.473035 2026] [:error] [pid 56075:tid 56077] [client 64.64.108.47:62379] [client 64.64.108.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/zmFM.php"] [unique_id "aaEQ7sKBhrfI6KNv9RirQgAAAAA"]
[Fri Feb 27 11:35:14.343581 2026] [:error] [pid 54231:tid 54241] [client 64.64.108.64:44057] [client 64.64.108.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aaEQ8uTvb5AeyJCdY7CYsgAAAEc"]
[Fri Feb 27 11:35:26.537633 2026] [:error] [pid 54102:tid 54164] [client 64.64.108.54:26215] [client 64.64.108.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/cgi-bin/wp-login.php"] [unique_id "aaEQ_ni74D4fiYUm_GcpUgAAAJQ"]
[Fri Feb 27 11:35:33.437437 2026] [:error] [pid 54102:tid 54150] [client 64.64.108.54:26215] [client 64.64.108.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/wp-login.php"] [unique_id "aaERBXi74D4fiYUm_GcpVAAAAIY"]
[Fri Feb 27 11:35:35.385210 2026] [:error] [pid 62998:tid 63008] [client 64.64.108.47:27617] [client 64.64.108.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "aaERB1QeueXZDUmoLomblAAAAQY"]
[Fri Feb 27 11:36:01.229690 2026] [:error] [pid 62998:tid 63017] [client 64.64.108.42:42329] [client 64.64.108.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.42, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/wp-login.php"] [unique_id "aaERIVQeueXZDUmoLomcRQAAAQ8"]
[Fri Feb 27 11:36:03.742589 2026] [:error] [pid 62998:tid 63016] [client 64.64.108.42:42329] [client 64.64.108.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aaERI1QeueXZDUmoLomcTAAAAQ4"]
[Fri Feb 27 11:36:04.880257 2026] [:error] [pid 52073:tid 52084] [client 64.64.108.31:52449] [client 64.64.108.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/network.php"] [unique_id "aaERJIa650YPyxXVeRaYDgAAAYg"]
[Fri Feb 27 11:36:05.896464 2026] [:error] [pid 52073:tid 52083] [client 64.64.108.39:56885] [client 64.64.108.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aaERJYa650YPyxXVeRaYGgAAAYc"]
[Fri Feb 27 11:36:18.157263 2026] [:error] [pid 56075:tid 56096] [client 64.64.108.31:60871] [client 64.64.108.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/php-compat/autoload_classmap.php"] [unique_id "aaERMsKBhrfI6KNv9RisSwAAABI"]
[Fri Feb 27 11:36:28.640758 2026] [:error] [pid 52073:tid 52076] [client 64.64.108.26:35813] [client 64.64.108.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aaERPIa650YPyxXVeRaYbAAAAYA"]
[Fri Feb 27 11:36:42.947779 2026] [:error] [pid 52073:tid 52080] [client 64.64.108.54:64411] [client 64.64.108.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aaERSoa650YPyxXVeRaYzgAAAYQ"]
[Fri Feb 27 11:36:58.141442 2026] [:error] [pid 49306:tid 49317] [client 64.64.108.34:28147] [client 64.64.108.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aaERWvnSUDZue59Px9uhgQAAAUk"]
[Fri Feb 27 11:37:18.246056 2026] [:error] [pid 62998:tid 63012] [client 64.64.108.23:49847] [client 64.64.108.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "aaERblQeueXZDUmoLomdTQAAAQo"]
[Fri Feb 27 11:37:23.329517 2026] [:error] [pid 56075:tid 56102] [client 64.64.108.26:59609] [client 64.64.108.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aaERc8KBhrfI6KNv9RitLQAAABg"]
[Fri Feb 27 11:37:24.373622 2026] [:error] [pid 52073:tid 52089] [client 64.64.108.51:23579] [client 64.64.108.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/makeasmtp.php"] [unique_id "aaERdIa650YPyxXVeRaZtAAAAY0"]
[Fri Feb 27 11:37:25.295513 2026] [:error] [pid 62998:tid 63001] [client 64.64.108.62:58501] [client 64.64.108.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aaERdVQeueXZDUmoLomdXAAAAQA"]
[Fri Feb 27 11:37:30.247689 2026] [:error] [pid 56075:tid 56080] [client 64.64.108.45:44245] [client 64.64.108.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aaEResKBhrfI6KNv9RitTAAAAAM"]
[Fri Feb 27 11:37:35.049465 2026] [:error] [pid 49306:tid 49311] [client 64.64.108.50:39583] [client 64.64.108.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aaERf_nSUDZue59Px9uiOQAAAUM"]
[Fri Feb 27 11:37:42.146591 2026] [:error] [pid 56075:tid 56081] [client 64.64.108.47:42427] [client 64.64.108.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aaERhsKBhrfI6KNv9RitngAAAAQ"]
[Fri Feb 27 11:37:51.144119 2026] [:error] [pid 56075:tid 56096] [client 64.64.108.33:23113] [client 64.64.108.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aaERj8KBhrfI6KNv9Rit1QAAABI"]
[Fri Feb 27 11:37:59.156454 2026] [:error] [pid 54102:tid 54168] [client 64.64.108.65:48305] [client 64.64.108.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aaERl3i74D4fiYUm_GcplQAAAJc"]
[Fri Feb 27 11:38:03.664524 2026] [proxy_fcgi:error] [pid 49306:tid 49318] [client 64.64.108.59:44805] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function add_action() in /home/expressi/public_html/wp-content/plugins/hello.php:69\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/plugins/hello.php on line 69'
[Fri Feb 27 11:38:04.674317 2026] [:error] [pid 49306:tid 49332] [client 64.64.108.43:53977] [client 64.64.108.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aaERnPnSUDZue59Px9uiuAAAAVg"]
[Fri Feb 27 11:38:19.443668 2026] [:error] [pid 56075:tid 56082] [client 64.64.108.21:33075] [client 64.64.108.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aaERq8KBhrfI6KNv9RiuTwAAAAU"]
[Fri Feb 27 11:38:40.832694 2026] [:error] [pid 49306:tid 49308] [client 64.64.108.60:32623] [client 64.64.108.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aaERwPnSUDZue59Px9ujTAAAAUA"]
[Fri Feb 27 11:38:54.640347 2026] [:error] [pid 56075:tid 56079] [client 64.64.108.25:63833] [client 64.64.108.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "aaERzsKBhrfI6KNv9Riv5AAAAAI"]
[Fri Feb 27 11:38:56.785452 2026] [:error] [pid 49306:tid 49318] [client 64.64.108.56:27871] [client 64.64.108.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aaER0PnSUDZue59Px9ujfgAAAUo"]
[Fri Feb 27 11:39:08.044726 2026] [:error] [pid 62998:tid 63015] [client 64.64.108.18:35789] [client 64.64.108.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/index.php"] [unique_id "aaER3FQeueXZDUmoLomePQAAAQ0"]
[Fri Feb 27 11:39:09.072729 2026] [:error] [pid 56075:tid 56080] [client 64.64.108.51:61829] [client 64.64.108.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aaER3cKBhrfI6KNv9RiwUwAAAAM"]
[Fri Feb 27 11:39:21.730505 2026] [:error] [pid 54103:tid 54189] [client 64.64.108.49:44693] [client 64.64.108.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aaER6evG4MPCmE0B2sBPSgAAANI"]
[Fri Feb 27 11:39:31.946279 2026] [:error] [pid 52073:tid 52098] [client 64.64.108.65:62589] [client 64.64.108.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aaER84a650YPyxXVeRab1AAAAZY"]
[Fri Feb 27 11:39:36.231152 2026] [:error] [pid 49306:tid 49316] [client 64.64.108.25:58305] [client 64.64.108.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aaER-PnSUDZue59Px9ukiQAAAUg"]
[Fri Feb 27 11:39:40.753070 2026] [:error] [pid 49306:tid 49319] [client 64.64.108.25:58305] [client 64.64.108.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aaER_PnSUDZue59Px9uklgAAAUs"]
[Fri Feb 27 11:39:41.673243 2026] [:error] [pid 56075:tid 56081] [client 64.64.108.41:59313] [client 64.64.108.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aaER_cKBhrfI6KNv9RixCAAAAAQ"]
[Fri Feb 27 11:39:51.896802 2026] [:error] [pid 62998:tid 63020] [client 64.64.108.31:27411] [client 64.64.108.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/autoload_classmap.php"] [unique_id "aaESB1QeueXZDUmoLomecAAAARI"]
[Fri Feb 27 11:39:55.743130 2026] [:error] [pid 52073:tid 52089] [client 64.64.108.50:29397] [client 64.64.108.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rk2.php"] [unique_id "aaESC4a650YPyxXVeRab_AAAAY0"]
[Fri Feb 27 11:40:24.854686 2026] [:error] [pid 49306:tid 49313] [client 64.64.108.51:33711] [client 64.64.108.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/plugin.php"] [unique_id "aaESKPnSUDZue59Px9ulsAAAAUU"]
[Fri Feb 27 11:40:55.546763 2026] [:error] [pid 62998:tid 63022] [client 64.64.108.27:64925] [client 64.64.108.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/mah.php"] [unique_id "aaESR1QeueXZDUmoLome4wAAARQ"]
[Fri Feb 27 11:40:56.597342 2026] [:error] [pid 62998:tid 63023] [client 64.64.108.15:62951] [client 64.64.108.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.15, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/sunrise/wp-login.php"] [unique_id "aaESSFQeueXZDUmoLome5QAAARU"]
[Fri Feb 27 11:41:00.552238 2026] [:error] [pid 62998:tid 63025] [client 64.64.108.15:62951] [client 64.64.108.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/lmfi.php"] [unique_id "aaESTFQeueXZDUmoLome9gAAARc"]
[Fri Feb 27 11:41:29.149190 2026] [:error] [pid 56075:tid 56087] [client 64.64.108.34:61727] [client 64.64.108.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aaESacKBhrfI6KNv9RizFwAAAAo"]
[Fri Feb 27 11:41:34.945549 2026] [:error] [pid 49306:tid 49308] [client 64.64.108.66:38847] [client 64.64.108.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.66, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/light/wp-login.php"] [unique_id "aaESbvnSUDZue59Px9unmwAAAUA"]
[Fri Feb 27 11:41:55.438553 2026] [:error] [pid 49306:tid 49309] [client 64.64.108.66:38847] [client 64.64.108.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/button/index.php"] [unique_id "aaESg_nSUDZue59Px9uoAwAAAUE"]
[Fri Feb 27 11:41:59.560879 2026] [:error] [pid 56075:tid 56082] [client 64.64.108.53:31417] [client 64.64.108.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/packed.php"] [unique_id "aaESh8KBhrfI6KNv9RizfQAAAAU"]
[Fri Feb 27 11:42:26.741999 2026] [:error] [pid 52073:tid 52083] [client 64.64.108.44:29103] [client 64.64.108.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/file.php"] [unique_id "aaESooa650YPyxXVeRaeOgAAAYc"]
[Fri Feb 27 11:42:31.456257 2026] [:error] [pid 56075:tid 56096] [client 64.64.108.65:29399] [client 64.64.108.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "aaESp8KBhrfI6KNv9Ri0AAAAABI"]
[Fri Feb 27 11:42:37.171763 2026] [:error] [pid 56075:tid 56097] [client 64.64.108.17:54905] [client 64.64.108.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "aaESrcKBhrfI6KNv9Ri0GgAAABM"]
[Fri Feb 27 11:42:50.646118 2026] [:error] [pid 49306:tid 49316] [client 64.64.108.46:49891] [client 64.64.108.46] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.46, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/wp-login.php"] [unique_id "aaESuvnSUDZue59Px9uo-gAAAUg"]
[Fri Feb 27 11:42:53.456577 2026] [:error] [pid 49306:tid 49323] [client 64.64.108.46:49891] [client 64.64.108.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aaESvfnSUDZue59Px9upAQAAAU8"]
[Fri Feb 27 11:43:11.347864 2026] [:error] [pid 52073:tid 52076] [client 64.64.108.54:22945] [client 64.64.108.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aaESz4a650YPyxXVeRafjQAAAYA"]
[Fri Feb 27 11:43:12.383930 2026] [:error] [pid 49306:tid 49332] [client 64.64.108.64:62537] [client 64.64.108.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/wp-login.php"] [unique_id "aaES0PnSUDZue59Px9upOAAAAVg"]
[Fri Feb 27 11:43:32.353150 2026] [:error] [pid 52073:tid 52083] [client 64.64.108.32:37105] [client 64.64.108.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/function.php"] [unique_id "aaES5Ia650YPyxXVeRagZwAAAYc"]
[Fri Feb 27 11:43:41.346824 2026] [:error] [pid 52073:tid 52087] [client 64.64.108.24:61547] [client 64.64.108.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/votes.php"] [unique_id "aaES7Ya650YPyxXVeRagtgAAAYs"]
[Fri Feb 27 11:44:07.764272 2026] [:error] [pid 52073:tid 52078] [client 64.64.108.26:30515] [client 64.64.108.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/file.php"] [unique_id "aaETB4a650YPyxXVeRahdwAAAYI"]
[Fri Feb 27 11:44:21.339239 2026] [:error] [pid 52073:tid 52084] [client 64.64.108.55:42329] [client 64.64.108.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/parx.php"] [unique_id "aaETFYa650YPyxXVeRahwgAAAYg"]
[Fri Feb 27 11:44:48.937892 2026] [:error] [pid 49306:tid 49325] [client 64.64.108.32:20059] [client 64.64.108.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/components/about.php"] [unique_id "aaETMPnSUDZue59Px9uq9QAAAVE"]
[Fri Feb 27 11:44:56.236578 2026] [proxy_fcgi:error] [pid 49306:tid 49313] [client 64.64.108.43:40187] AH01071: Got error 'PHP message: PHP Warning:  Use of undefined constant ABSPATH - assumed 'ABSPATH' (this will throw an Error in a future version of PHP) in /home/expressi/public_html/wp-settings.php on line 34PHP message: PHP Warning:  require(ABSPATHwp-includes/version.php): failed to open stream: No such file or directory in /home/expressi/public_html/wp-settings.php on line 34PHP message: PHP Warning:  require(ABSPATHwp-includes/version.php): failed to open stream: No such file or directory in /home/expressi/public_html/wp-settings.php on line 34PHP message: PHP Fatal error:  require(): Failed opening required 'ABSPATHwp-includes/version.php' (include_path='.:') in /home/expressi/public_html/wp-settings.php on line 34'
[Fri Feb 27 11:44:57.178124 2026] [:error] [pid 49306:tid 49308] [client 64.64.108.40:51211] [client 64.64.108.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aaETOfnSUDZue59Px9urLwAAAUA"]
[Fri Feb 27 11:45:16.662250 2026] [:error] [pid 56075:tid 56088] [client 64.64.108.17:44603] [client 64.64.108.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/item.php"] [unique_id "aaETTMKBhrfI6KNv9Ri1zgAAAAs"]
[Fri Feb 27 11:45:30.938776 2026] [:error] [pid 52073:tid 52098] [client 64.64.108.55:35489] [client 64.64.108.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.55, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/.well-known/pki-validation/wp-login.php"] [unique_id "aaETWoa650YPyxXVeRakQAAAAZY"]
[Fri Feb 27 11:45:32.845116 2026] [:error] [pid 52073:tid 52084] [client 64.64.108.55:35489] [client 64.64.108.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.55, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aaETXIa650YPyxXVeRakVwAAAYg"]
[Fri Feb 27 11:45:34.828179 2026] [:error] [pid 52073:tid 52094] [client 64.64.108.55:35489] [client 64.64.108.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/mani.php"] [unique_id "aaETXoa650YPyxXVeRakaQAAAZI"]
[Fri Feb 27 11:45:58.434890 2026] [:error] [pid 56075:tid 56097] [client 64.64.108.62:50881] [client 64.64.108.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/network.php"] [unique_id "aaETdsKBhrfI6KNv9Ri2cAAAABM"]
[Fri Feb 27 11:46:07.342761 2026] [:error] [pid 56075:tid 56085] [client 64.64.108.16:24381] [client 64.64.108.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/defaults.php"] [unique_id "aaETf8KBhrfI6KNv9Ri2ggAAAAg"]
[Fri Feb 27 11:46:25.140539 2026] [:error] [pid 52073:tid 52076] [client 64.64.108.23:46927] [client 64.64.108.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/about.php"] [unique_id "aaETkYa650YPyxXVeRalvQAAAYA"]
[Fri Feb 27 11:46:41.839728 2026] [:error] [pid 49306:tid 49313] [client 64.64.108.22:61289] [client 64.64.108.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/wp-login.php"] [unique_id "aaETofnSUDZue59Px9utsgAAAUU"]
[Fri Feb 27 11:46:55.043946 2026] [:error] [pid 49306:tid 49315] [client 64.64.108.22:61289] [client 64.64.108.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/file.php"] [unique_id "aaETr_nSUDZue59Px9ut3wAAAUc"]
[Fri Feb 27 11:46:59.852856 2026] [:error] [pid 54231:tid 54238] [client 64.64.108.29:62607] [client 64.64.108.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/xBrain.php"] [unique_id "aaETs-Tvb5AeyJCdY7CcFQAAAEQ"]
[Fri Feb 27 11:47:00.886405 2026] [:error] [pid 49306:tid 49312] [client 64.64.108.22:44973] [client 64.64.108.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aaETtPnSUDZue59Px9ut_wAAAUQ"]
[Fri Feb 27 11:47:06.449334 2026] [:error] [pid 49306:tid 49324] [client 64.64.108.25:22957] [client 64.64.108.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aaETuvnSUDZue59Px9uuGQAAAVA"]
[Fri Feb 27 11:47:24.248966 2026] [:error] [pid 52073:tid 52098] [client 64.64.108.47:46373] [client 64.64.108.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/widgets/about.php"] [unique_id "aaETzIa650YPyxXVeRanJQAAAZY"]
[Fri Feb 27 11:47:54.752488 2026] [:error] [pid 52073:tid 52077] [client 64.64.108.16:42463] [client 64.64.108.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/radio.php"] [unique_id "aaET6oa650YPyxXVeRaoDAAAAYE"]
[Fri Feb 27 11:48:17.439497 2026] [:error] [pid 49306:tid 49313] [client 64.64.108.19:51193] [client 64.64.108.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/src/Core/Curve25519/Ge/wp_blog.php"] [unique_id "aaEUAfnSUDZue59Px9uvVwAAAUU"]
[Fri Feb 27 11:48:28.744727 2026] [:error] [pid 52073:tid 52085] [client 64.64.108.37:64395] [client 64.64.108.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aaEUDIa650YPyxXVeRao9wAAAYk"]
[Fri Feb 27 11:48:45.245087 2026] [:error] [pid 54231:tid 54235] [client 64.64.108.37:55613] [client 64.64.108.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aaEUHeTvb5AeyJCdY7CcfAAAAEE"]
[Fri Feb 27 11:48:49.945253 2026] [:error] [pid 49306:tid 49314] [client 64.64.108.33:59767] [client 64.64.108.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/random_compat/about.php"] [unique_id "aaEUIfnSUDZue59Px9uwOwAAAUY"]
[Fri Feb 27 11:49:47.457122 2026] [:error] [pid 52073:tid 52095] [client 64.64.108.48:40023] [client 64.64.108.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/include.php"] [unique_id "aaEUW4a650YPyxXVeRarDwAAAZM"]
[Fri Feb 27 11:50:07.540364 2026] [:error] [pid 56075:tid 56093] [client 64.64.108.57:62635] [client 64.64.108.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/css.php"] [unique_id "aaEUb8KBhrfI6KNv9Ri5cgAAAA8"]
[Fri Feb 27 11:50:26.753817 2026] [:error] [pid 49306:tid 49318] [client 64.64.108.27:45601] [client 64.64.108.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wso112233.php"] [unique_id "aaEUgvnSUDZue59Px9uxwAAAAUo"]
[Fri Feb 27 11:50:27.877036 2026] [:error] [pid 62998:tid 63012] [client 64.64.108.56:39387] [client 64.64.108.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/shell20211028.php"] [unique_id "aaEUg1QeueXZDUmoLomkgQAAAQo"]
[Fri Feb 27 11:50:33.328956 2026] [:error] [pid 52073:tid 52097] [client 64.64.108.32:21325] [client 64.64.108.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/dropdown.php"] [unique_id "aaEUiYa650YPyxXVeRarxgAAAZU"]
[Fri Feb 27 11:50:36.433790 2026] [:error] [pid 56075:tid 56094] [client 64.64.108.60:34497] [client 64.64.108.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/repeater.php"] [unique_id "aaEUjMKBhrfI6KNv9Ri5yQAAABA"]
[Fri Feb 27 11:51:02.451170 2026] [:error] [pid 52073:tid 52081] [client 64.64.108.17:53517] [client 64.64.108.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/test.php"] [unique_id "aaEUpoa650YPyxXVeRasnwAAAYU"]
[Fri Feb 27 11:51:04.786045 2026] [:error] [pid 62998:tid 63025] [client 64.64.108.47:55543] [client 64.64.108.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "aaEUqFQeueXZDUmoLomk9QAAARc"]
[Fri Feb 27 11:51:08.338308 2026] [:error] [pid 62998:tid 63010] [client 64.64.108.45:49501] [client 64.64.108.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/options.php"] [unique_id "aaEUrFQeueXZDUmoLomk_wAAAQg"]
[Fri Feb 27 11:51:19.098555 2026] [:error] [pid 56075:tid 56079] [client 64.64.108.22:44297] [client 64.64.108.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/gzdecode.php"] [unique_id "aaEUt8KBhrfI6KNv9Ri6CgAAAAI"]
[Fri Feb 27 11:51:20.187682 2026] [:error] [pid 52073:tid 52100] [client 64.64.108.33:40847] [client 64.64.108.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-includes/atomlib.php"] [unique_id "aaEUuIa650YPyxXVeRas3gAAAZg"]
[Fri Feb 27 11:51:24.042598 2026] [:error] [pid 49306:tid 49320] [client 64.64.108.24:24915] [client 64.64.108.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/images/wp-login.php"] [unique_id "aaEUvPnSUDZue59Px9uzBwAAAUw"]
[Fri Feb 27 11:51:30.745937 2026] [:error] [pid 49306:tid 49316] [client 64.64.108.24:24915] [client 64.64.108.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/plupload/wp-login.php"] [unique_id "aaEUwvnSUDZue59Px9uzIwAAAUg"]
[Fri Feb 27 11:51:38.937604 2026] [:error] [pid 56075:tid 56092] [client 64.64.108.43:27143] [client 64.64.108.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/themes.php"] [unique_id "aaEUysKBhrfI6KNv9Ri6KwAAAA4"]
[Fri Feb 27 11:51:39.779620 2026] [:error] [pid 52073:tid 52077] [client 64.64.108.20:62317] [client 64.64.108.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/site-title/index.php"] [unique_id "aaEUy4a650YPyxXVeRatdAAAAYE"]
[Fri Feb 27 11:51:40.692287 2026] [:error] [pid 52073:tid 52100] [client 64.64.108.17:20015] [client 64.64.108.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/wp-login.php"] [unique_id "aaEUzIa650YPyxXVeRatfQAAAZg"]
[Fri Feb 27 11:51:42.850767 2026] [:error] [pid 52073:tid 52080] [client 64.64.108.17:20015] [client 64.64.108.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-includes/admin-bar.php"] [unique_id "aaEUzoa650YPyxXVeRatkQAAAYQ"]
[Fri Feb 27 11:51:51.039217 2026] [:error] [pid 49306:tid 49328] [client 64.64.108.21:49849] [client 64.64.108.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/plugins.php"] [unique_id "aaEU1_nSUDZue59Px9uzggAAAVQ"]
[Fri Feb 27 11:53:12.450877 2026] [:error] [pid 52073:tid 52081] [client 64.64.108.43:53471] [client 64.64.108.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aaEVKIa650YPyxXVeRav7AAAAYU"]
[Fri Feb 27 11:53:25.465859 2026] [:error] [pid 52073:tid 52079] [client 64.64.108.43:53471] [client 64.64.108.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/.tmb/wp-login.php"] [unique_id "aaEVNYa650YPyxXVeRawQQAAAYM"]
[Fri Feb 27 11:53:36.551789 2026] [:error] [pid 52073:tid 52093] [client 64.64.108.43:53471] [client 64.64.108.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "aaEVQIa650YPyxXVeRawhwAAAZE"]
[Fri Feb 27 11:53:37.622963 2026] [:error] [pid 56075:tid 56079] [client 64.64.108.26:43371] [client 64.64.108.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/wp-login.php"] [unique_id "aaEVQcKBhrfI6KNv9Ri7mAAAAAI"]
[Fri Feb 27 11:53:38.744673 2026] [:error] [pid 49306:tid 49329] [client 64.64.108.26:39729] [client 64.64.108.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/install.php"] [unique_id "aaEVQvnSUDZue59Px9u1bQAAAVU"]
[Fri Feb 27 11:53:59.772579 2026] [:error] [pid 49306:tid 49323] [client 64.64.108.64:53137] [client 64.64.108.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.64, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/modules/karakaroa/wp-login.php"] [unique_id "aaEVV_nSUDZue59Px9u18wAAAU8"]
[Fri Feb 27 11:54:01.164281 2026] [:error] [pid 49306:tid 49328] [client 64.64.108.64:53137] [client 64.64.108.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aaEVWfnSUDZue59Px9u1_AAAAVQ"]
[Fri Feb 27 11:54:05.853754 2026] [:error] [pid 52073:tid 52096] [client 64.64.108.38:43995] [client 64.64.108.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aaEVXYa650YPyxXVeRaxNAAAAZQ"]
[Fri Feb 27 11:54:30.344404 2026] [:error] [pid 52073:tid 52079] [client 64.64.108.38:43995] [client 64.64.108.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/editor/fxp.php"] [unique_id "aaEVdoa650YPyxXVeRaxtwAAAYM"]
[Fri Feb 27 11:54:49.246554 2026] [:error] [pid 52073:tid 52096] [client 64.64.108.35:23765] [client 64.64.108.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aaEViYa650YPyxXVeRax8AAAAZQ"]
[Fri Feb 27 11:55:09.129592 2026] [:error] [pid 49306:tid 49311] [client 64.64.108.41:56039] [client 64.64.108.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.64.108.41, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aaEVnfnSUDZue59Px9u3IAAAAUM"]
[Fri Feb 27 11:55:44.048318 2026] [autoindex:error] [pid 49306:tid 49328] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:55:50.955231 2026] [autoindex:error] [pid 49306:tid 49312] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:55:54.039564 2026] [autoindex:error] [pid 49306:tid 49330] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:55:54.554504 2026] [autoindex:error] [pid 49306:tid 49329] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:55:55.138139 2026] [autoindex:error] [pid 49306:tid 49332] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:55:55.743851 2026] [autoindex:error] [pid 49306:tid 49312] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:55:56.243870 2026] [autoindex:error] [pid 49306:tid 49311] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:55:57.152808 2026] [autoindex:error] [pid 49306:tid 49322] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:55:57.660607 2026] [autoindex:error] [pid 49306:tid 49328] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:55:58.155942 2026] [autoindex:error] [pid 49306:tid 49322] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:55:58.851656 2026] [autoindex:error] [pid 49306:tid 49315] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:56:07.060829 2026] [autoindex:error] [pid 49306:tid 49321] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:57:01.657208 2026] [autoindex:error] [pid 49306:tid 49322] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:57:02.455357 2026] [autoindex:error] [pid 49306:tid 49330] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:57:03.746819 2026] [autoindex:error] [pid 49306:tid 49316] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:57:04.255250 2026] [autoindex:error] [pid 49306:tid 49309] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:57:04.864970 2026] [autoindex:error] [pid 49306:tid 49311] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:57:05.379900 2026] [autoindex:error] [pid 49306:tid 49322] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:57:05.877204 2026] [autoindex:error] [pid 49306:tid 49328] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:57:11.087724 2026] [autoindex:error] [pid 49306:tid 49319] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:57:11.683314 2026] [autoindex:error] [pid 49306:tid 49312] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:57:14.771723 2026] [autoindex:error] [pid 49306:tid 49319] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:57:16.974281 2026] [autoindex:error] [pid 49306:tid 49324] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:57:17.589537 2026] [autoindex:error] [pid 49306:tid 49320] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:57:18.043760 2026] [autoindex:error] [pid 49306:tid 49311] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:57:20.434732 2026] [autoindex:error] [pid 49306:tid 49323] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:57:20.941491 2026] [autoindex:error] [pid 49306:tid 49332] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:57:22.138507 2026] [autoindex:error] [pid 49306:tid 49316] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:57:22.654517 2026] [autoindex:error] [pid 49306:tid 49324] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:57:23.147937 2026] [autoindex:error] [pid 49306:tid 49308] [client 64.64.108.41:56039] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:58:43.146159 2026] [autoindex:error] [pid 54103:tid 54193] [client 64.64.108.33:51123] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:58:43.551571 2026] [autoindex:error] [pid 54103:tid 54180] [client 64.64.108.33:51123] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:58:51.148609 2026] [autoindex:error] [pid 54103:tid 54185] [client 64.64.108.33:51123] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:58:51.638613 2026] [autoindex:error] [pid 54103:tid 54179] [client 64.64.108.33:51123] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:58:52.151332 2026] [autoindex:error] [pid 54103:tid 54183] [client 64.64.108.33:51123] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:58:52.741512 2026] [autoindex:error] [pid 54103:tid 54187] [client 64.64.108.33:51123] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:58:53.255586 2026] [autoindex:error] [pid 54103:tid 54191] [client 64.64.108.33:51123] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:58:53.741474 2026] [autoindex:error] [pid 54103:tid 54194] [client 64.64.108.33:51123] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:58:54.245312 2026] [autoindex:error] [pid 54103:tid 54177] [client 64.64.108.33:51123] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:58:54.736688 2026] [autoindex:error] [pid 54103:tid 54190] [client 64.64.108.33:51123] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:58:55.244756 2026] [autoindex:error] [pid 54103:tid 54178] [client 64.64.108.33:51123] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:58:55.748246 2026] [autoindex:error] [pid 54103:tid 54193] [client 64.64.108.33:51123] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:59:11.644131 2026] [autoindex:error] [pid 54103:tid 54177] [client 64.64.108.33:51123] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:59:31.444645 2026] [autoindex:error] [pid 54103:tid 54186] [client 64.64.108.33:51123] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:59:31.945603 2026] [autoindex:error] [pid 54103:tid 54188] [client 64.64.108.33:51123] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 11:59:59.457178 2026] [autoindex:error] [pid 54103:tid 54191] [client 64.64.108.33:51123] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 12:00:08.538945 2026] [autoindex:error] [pid 54103:tid 54186] [client 64.64.108.33:51123] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 12:00:12.990560 2026] [autoindex:error] [pid 52073:tid 52080] [client 64.64.108.45:42047] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/search/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 12:00:15.346339 2026] [autoindex:error] [pid 52073:tid 52098] [client 64.64.108.45:42047] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 12:00:17.850946 2026] [autoindex:error] [pid 52073:tid 52083] [client 64.64.108.45:42047] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 12:00:20.033862 2026] [autoindex:error] [pid 52073:tid 52098] [client 64.64.108.45:42047] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/classic-editor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 12:00:20.543602 2026] [proxy_fcgi:error] [pid 52073:tid 52100] [client 64.64.108.45:42047] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_header() in /home/expressi/public_html/wp-content/themes/twentytwentyone/index.php:17\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/themes/twentytwentyone/index.php on line 17'
[Fri Feb 27 12:00:25.159694 2026] [autoindex:error] [pid 56075:tid 56085] [client 64.64.108.43:20795] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 12:00:33.644896 2026] [autoindex:error] [pid 56075:tid 56090] [client 64.64.108.43:20795] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/paragraph/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 12:00:40.352877 2026] [autoindex:error] [pid 56075:tid 56097] [client 64.64.108.43:20795] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/nux/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 12:01:35.339014 2026] [autoindex:error] [pid 56075:tid 56087] [client 64.64.108.43:20795] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 12:01:40.960189 2026] [autoindex:error] [pid 56075:tid 56096] [client 64.64.108.43:20795] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/social-links/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 12:02:16.653813 2026] [autoindex:error] [pid 56075:tid 56078] [client 64.64.108.43:20795] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/src/Core/Curve25519/Ge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 12:40:58.882060 2026] [:error] [pid 52073:tid 52076] [client 43.167.245.18:43804] [client 43.167.245.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaEgWoa650YPyxXVeRbYNwAAAYA"]
[Fri Feb 27 13:41:06.259002 2026] [:error] [pid 54102:tid 54148] [client 185.220.101.103:54813] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEucni74D4fiYUm_Gc1lwAAAIQ"], referer: https://www.google.com/
[Fri Feb 27 13:41:09.456229 2026] [:error] [pid 49306:tid 49316] [client 185.220.101.103:9609] [client 185.220.101.103] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaEudfnSUDZue59Px9sS-AAAAUg"]
[Fri Feb 27 13:41:22.699771 2026] [:error] [pid 49306:tid 49316] [client 185.220.101.103:9609] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEugvnSUDZue59Px9sTNQAAAUg"]
[Fri Feb 27 13:41:22.700081 2026] [:error] [pid 49306:tid 49316] [client 185.220.101.103:9609] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEugvnSUDZue59Px9sTNQAAAUg"]
[Fri Feb 27 13:41:24.882986 2026] [:error] [pid 52073:tid 52086] [client 185.220.101.103:34347] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuhIa650YPyxXVeRb4SwAAAYo"]
[Fri Feb 27 13:41:24.883427 2026] [:error] [pid 52073:tid 52086] [client 185.220.101.103:34347] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuhIa650YPyxXVeRb4SwAAAYo"]
[Fri Feb 27 13:41:26.977532 2026] [:error] [pid 52073:tid 52081] [client 185.220.101.103:62913] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuhoa650YPyxXVeRb4TgAAAYU"]
[Fri Feb 27 13:41:26.977795 2026] [:error] [pid 52073:tid 52081] [client 185.220.101.103:62913] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuhoa650YPyxXVeRb4TgAAAYU"]
[Fri Feb 27 13:41:26.994931 2026] [:error] [pid 52073:tid 52092] [client 185.220.101.103:62881] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuhoa650YPyxXVeRb4UAAAAZA"]
[Fri Feb 27 13:41:26.994966 2026] [:error] [pid 52073:tid 52097] [client 185.220.101.103:62895] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuhoa650YPyxXVeRb4TwAAAZU"]
[Fri Feb 27 13:41:26.995284 2026] [:error] [pid 52073:tid 52092] [client 185.220.101.103:62881] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuhoa650YPyxXVeRb4UAAAAZA"]
[Fri Feb 27 13:41:26.995347 2026] [:error] [pid 52073:tid 52097] [client 185.220.101.103:62895] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuhoa650YPyxXVeRb4TwAAAZU"]
[Fri Feb 27 13:41:27.009190 2026] [:error] [pid 54102:tid 54169] [client 185.220.101.103:62885] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuh3i74D4fiYUm_Gc1nAAAAJg"]
[Fri Feb 27 13:41:27.009598 2026] [:error] [pid 54102:tid 54169] [client 185.220.101.103:62885] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuh3i74D4fiYUm_Gc1nAAAAJg"]
[Fri Feb 27 13:41:27.010145 2026] [:error] [pid 52073:tid 52080] [client 185.220.101.103:62903] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuh4a650YPyxXVeRb4UQAAAYQ"]
[Fri Feb 27 13:41:27.010298 2026] [:error] [pid 52073:tid 52080] [client 185.220.101.103:62903] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuh4a650YPyxXVeRb4UQAAAYQ"]
[Fri Feb 27 13:41:28.945119 2026] [:error] [pid 49306:tid 49311] [client 185.220.101.103:62917] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuiPnSUDZue59Px9sTPQAAAUM"]
[Fri Feb 27 13:41:28.945451 2026] [:error] [pid 49306:tid 49311] [client 185.220.101.103:62917] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuiPnSUDZue59Px9sTPQAAAUM"]
[Fri Feb 27 13:41:28.945567 2026] [:error] [pid 49306:tid 49311] [client 185.220.101.103:62917] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 8"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuiPnSUDZue59Px9sTPQAAAUM"]
[Fri Feb 27 13:41:28.994537 2026] [:error] [pid 52073:tid 52091] [client 185.220.101.103:62939] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuiIa650YPyxXVeRb4VAAAAY8"]
[Fri Feb 27 13:41:28.994797 2026] [:error] [pid 52073:tid 52091] [client 185.220.101.103:62939] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuiIa650YPyxXVeRb4VAAAAY8"]
[Fri Feb 27 13:41:28.994893 2026] [:error] [pid 52073:tid 52091] [client 185.220.101.103:62939] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 9"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuiIa650YPyxXVeRb4VAAAAY8"]
[Fri Feb 27 13:41:29.039961 2026] [:error] [pid 49306:tid 49326] [client 185.220.101.103:62923] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuifnSUDZue59Px9sTPgAAAVI"]
[Fri Feb 27 13:41:29.040273 2026] [:error] [pid 49306:tid 49326] [client 185.220.101.103:62923] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuifnSUDZue59Px9sTPgAAAVI"]
[Fri Feb 27 13:41:29.040457 2026] [:error] [pid 49306:tid 49326] [client 185.220.101.103:62923] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 10"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuifnSUDZue59Px9sTPgAAAVI"]
[Fri Feb 27 13:41:29.101167 2026] [:error] [pid 49306:tid 49320] [client 185.220.101.103:62929] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuifnSUDZue59Px9sTPwAAAUw"]
[Fri Feb 27 13:41:29.101570 2026] [:error] [pid 49306:tid 49320] [client 185.220.101.103:62929] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuifnSUDZue59Px9sTPwAAAUw"]
[Fri Feb 27 13:41:29.101708 2026] [:error] [pid 49306:tid 49320] [client 185.220.101.103:62929] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 11"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuifnSUDZue59Px9sTPwAAAUw"]
[Fri Feb 27 13:41:29.480555 2026] [:error] [pid 49306:tid 49323] [client 185.220.101.103:62955] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuifnSUDZue59Px9sTQQAAAU8"]
[Fri Feb 27 13:41:29.480854 2026] [:error] [pid 49306:tid 49323] [client 185.220.101.103:62955] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuifnSUDZue59Px9sTQQAAAU8"]
[Fri Feb 27 13:41:29.481026 2026] [:error] [pid 49306:tid 49323] [client 185.220.101.103:62955] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 12"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuifnSUDZue59Px9sTQQAAAU8"]
[Fri Feb 27 13:41:30.984445 2026] [:error] [pid 56075:tid 56079] [client 185.220.101.103:62971] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuisKBhrfI6KNv9RjsAgAAAAI"]
[Fri Feb 27 13:41:30.984723 2026] [:error] [pid 56075:tid 56079] [client 185.220.101.103:62971] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuisKBhrfI6KNv9RjsAgAAAAI"]
[Fri Feb 27 13:41:30.984863 2026] [:error] [pid 56075:tid 56079] [client 185.220.101.103:62971] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 13"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuisKBhrfI6KNv9RjsAgAAAAI"]
[Fri Feb 27 13:41:31.010309 2026] [:error] [pid 49306:tid 49328] [client 185.220.101.103:62997] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEui_nSUDZue59Px9sTRAAAAVQ"]
[Fri Feb 27 13:41:31.010875 2026] [:error] [pid 49306:tid 49328] [client 185.220.101.103:62997] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEui_nSUDZue59Px9sTRAAAAVQ"]
[Fri Feb 27 13:41:31.011061 2026] [:error] [pid 49306:tid 49328] [client 185.220.101.103:62997] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 14"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEui_nSUDZue59Px9sTRAAAAVQ"]
[Fri Feb 27 13:41:31.020348 2026] [:error] [pid 54101:tid 54118] [client 185.220.101.103:63005] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEui1Y5qgRktcYTGFsQbgAAAco"]
[Fri Feb 27 13:41:31.020660 2026] [:error] [pid 54101:tid 54118] [client 185.220.101.103:63005] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEui1Y5qgRktcYTGFsQbgAAAco"]
[Fri Feb 27 13:41:31.020769 2026] [:error] [pid 54101:tid 54118] [client 185.220.101.103:63005] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 15"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEui1Y5qgRktcYTGFsQbgAAAco"]
[Fri Feb 27 13:41:31.021672 2026] [:error] [pid 56075:tid 56083] [client 185.220.101.103:62977] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEui8KBhrfI6KNv9RjsAwAAAAY"]
[Fri Feb 27 13:41:31.021845 2026] [:error] [pid 56075:tid 56083] [client 185.220.101.103:62977] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEui8KBhrfI6KNv9RjsAwAAAAY"]
[Fri Feb 27 13:41:31.021930 2026] [:error] [pid 56075:tid 56083] [client 185.220.101.103:62977] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 16"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEui8KBhrfI6KNv9RjsAwAAAAY"]
[Fri Feb 27 13:41:31.167704 2026] [:error] [pid 49306:tid 49310] [client 185.220.101.103:62991] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEui_nSUDZue59Px9sTRQAAAUI"]
[Fri Feb 27 13:41:31.168002 2026] [:error] [pid 49306:tid 49310] [client 185.220.101.103:62991] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEui_nSUDZue59Px9sTRQAAAUI"]
[Fri Feb 27 13:41:31.168133 2026] [:error] [pid 49306:tid 49310] [client 185.220.101.103:62991] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 17"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEui_nSUDZue59Px9sTRQAAAUI"]
[Fri Feb 27 13:41:32.355778 2026] [:error] [pid 52073:tid 52098] [client 185.220.101.103:63011] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujIa650YPyxXVeRb4WwAAAZY"]
[Fri Feb 27 13:41:32.356093 2026] [:error] [pid 52073:tid 52098] [client 185.220.101.103:63011] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujIa650YPyxXVeRb4WwAAAZY"]
[Fri Feb 27 13:41:32.356186 2026] [:error] [pid 52073:tid 52098] [client 185.220.101.103:63011] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 18"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujIa650YPyxXVeRb4WwAAAZY"]
[Fri Feb 27 13:41:32.426010 2026] [:error] [pid 52073:tid 52099] [client 185.220.101.103:63047] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujIa650YPyxXVeRb4XQAAAZc"]
[Fri Feb 27 13:41:32.426010 2026] [:error] [pid 52073:tid 52089] [client 185.220.101.103:63019] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujIa650YPyxXVeRb4XgAAAY0"]
[Fri Feb 27 13:41:32.426371 2026] [:error] [pid 52073:tid 52099] [client 185.220.101.103:63047] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujIa650YPyxXVeRb4XQAAAZc"]
[Fri Feb 27 13:41:32.426385 2026] [:error] [pid 52073:tid 52089] [client 185.220.101.103:63019] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujIa650YPyxXVeRb4XgAAAY0"]
[Fri Feb 27 13:41:32.426546 2026] [:error] [pid 52073:tid 52099] [client 185.220.101.103:63047] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 19"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujIa650YPyxXVeRb4XQAAAZc"]
[Fri Feb 27 13:41:32.426546 2026] [:error] [pid 52073:tid 52089] [client 185.220.101.103:63019] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 19"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujIa650YPyxXVeRb4XgAAAY0"]
[Fri Feb 27 13:41:32.497287 2026] [:error] [pid 54103:tid 54187] [client 185.220.101.103:63033] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujOvG4MPCmE0B2sBefwAAANA"]
[Fri Feb 27 13:41:32.497602 2026] [:error] [pid 54103:tid 54187] [client 185.220.101.103:63033] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujOvG4MPCmE0B2sBefwAAANA"]
[Fri Feb 27 13:41:32.497717 2026] [:error] [pid 54103:tid 54187] [client 185.220.101.103:63033] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 20"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujOvG4MPCmE0B2sBefwAAANA"]
[Fri Feb 27 13:41:32.773957 2026] [:error] [pid 52073:tid 52081] [client 185.220.101.103:63051] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujIa650YPyxXVeRb4YAAAAYU"]
[Fri Feb 27 13:41:32.774321 2026] [:error] [pid 52073:tid 52081] [client 185.220.101.103:63051] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujIa650YPyxXVeRb4YAAAAYU"]
[Fri Feb 27 13:41:32.774489 2026] [:error] [pid 52073:tid 52081] [client 185.220.101.103:63051] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 21"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujIa650YPyxXVeRb4YAAAAYU"]
[Fri Feb 27 13:41:34.227515 2026] [:error] [pid 52073:tid 52082] [client 185.220.101.103:63055] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujoa650YPyxXVeRb4ZwAAAYY"]
[Fri Feb 27 13:41:34.227812 2026] [:error] [pid 52073:tid 52082] [client 185.220.101.103:63055] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujoa650YPyxXVeRb4ZwAAAYY"]
[Fri Feb 27 13:41:34.227919 2026] [:error] [pid 52073:tid 52082] [client 185.220.101.103:63055] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 22"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujoa650YPyxXVeRb4ZwAAAYY"]
[Fri Feb 27 13:41:34.268621 2026] [:error] [pid 52073:tid 52076] [client 185.220.101.103:63053] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujoa650YPyxXVeRb4aAAAAYA"]
[Fri Feb 27 13:41:34.268905 2026] [:error] [pid 52073:tid 52076] [client 185.220.101.103:63053] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujoa650YPyxXVeRb4aAAAAYA"]
[Fri Feb 27 13:41:34.269013 2026] [:error] [pid 52073:tid 52076] [client 185.220.101.103:63053] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 23"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujoa650YPyxXVeRb4aAAAAYA"]
[Fri Feb 27 13:41:34.310022 2026] [:error] [pid 52073:tid 52079] [client 185.220.101.103:63069] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujoa650YPyxXVeRb4aQAAAYM"]
[Fri Feb 27 13:41:34.310301 2026] [:error] [pid 52073:tid 52079] [client 185.220.101.103:63069] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujoa650YPyxXVeRb4aQAAAYM"]
[Fri Feb 27 13:41:34.310435 2026] [:error] [pid 52073:tid 52079] [client 185.220.101.103:63069] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 24"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujoa650YPyxXVeRb4aQAAAYM"]
[Fri Feb 27 13:41:34.311305 2026] [:error] [pid 49306:tid 49318] [client 185.220.101.103:63075] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujvnSUDZue59Px9sTRgAAAUo"]
[Fri Feb 27 13:41:34.311497 2026] [:error] [pid 49306:tid 49318] [client 185.220.101.103:63075] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujvnSUDZue59Px9sTRgAAAUo"]
[Fri Feb 27 13:41:34.311590 2026] [:error] [pid 49306:tid 49318] [client 185.220.101.103:63075] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 25"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujvnSUDZue59Px9sTRgAAAUo"]
[Fri Feb 27 13:41:34.481275 2026] [:error] [pid 54101:tid 54117] [client 185.220.101.103:63091] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujlY5qgRktcYTGFsQcAAAAck"]
[Fri Feb 27 13:41:34.481588 2026] [:error] [pid 54101:tid 54117] [client 185.220.101.103:63091] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujlY5qgRktcYTGFsQcAAAAck"]
[Fri Feb 27 13:41:34.481713 2026] [:error] [pid 54101:tid 54117] [client 185.220.101.103:63091] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 26"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEujlY5qgRktcYTGFsQcAAAAck"]
[Fri Feb 27 13:41:35.512003 2026] [:error] [pid 62998:tid 63006] [client 185.220.101.103:63105] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuj1QeueXZDUmoLonGswAAAQQ"]
[Fri Feb 27 13:41:35.512279 2026] [:error] [pid 62998:tid 63006] [client 185.220.101.103:63105] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuj1QeueXZDUmoLonGswAAAQQ"]
[Fri Feb 27 13:41:35.512380 2026] [:error] [pid 62998:tid 63006] [client 185.220.101.103:63105] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 27"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuj1QeueXZDUmoLonGswAAAQQ"]
[Fri Feb 27 13:41:35.700727 2026] [:error] [pid 49306:tid 49317] [client 185.220.101.103:63113] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuj_nSUDZue59Px9sTRwAAAUk"]
[Fri Feb 27 13:41:35.701051 2026] [:error] [pid 49306:tid 49317] [client 185.220.101.103:63113] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuj_nSUDZue59Px9sTRwAAAUk"]
[Fri Feb 27 13:41:35.701221 2026] [:error] [pid 49306:tid 49317] [client 185.220.101.103:63113] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 28"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuj_nSUDZue59Px9sTRwAAAUk"]
[Fri Feb 27 13:41:35.807992 2026] [:error] [pid 49306:tid 49330] [client 185.220.101.103:63123] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuj_nSUDZue59Px9sTSQAAAVY"]
[Fri Feb 27 13:41:35.808263 2026] [:error] [pid 49306:tid 49330] [client 185.220.101.103:63123] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuj_nSUDZue59Px9sTSQAAAVY"]
[Fri Feb 27 13:41:35.808403 2026] [:error] [pid 49306:tid 49330] [client 185.220.101.103:63123] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 29"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuj_nSUDZue59Px9sTSQAAAVY"]
[Fri Feb 27 13:41:35.862175 2026] [:error] [pid 49306:tid 49313] [client 185.220.101.103:63125] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuj_nSUDZue59Px9sTSgAAAUU"]
[Fri Feb 27 13:41:35.862505 2026] [:error] [pid 49306:tid 49313] [client 185.220.101.103:63125] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuj_nSUDZue59Px9sTSgAAAUU"]
[Fri Feb 27 13:41:35.862607 2026] [:error] [pid 49306:tid 49313] [client 185.220.101.103:63125] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 30"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuj_nSUDZue59Px9sTSgAAAUU"]
[Fri Feb 27 13:41:35.877647 2026] [:error] [pid 49306:tid 49331] [client 185.220.101.103:63131] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuj_nSUDZue59Px9sTSwAAAVc"]
[Fri Feb 27 13:41:35.878022 2026] [:error] [pid 49306:tid 49331] [client 185.220.101.103:63131] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuj_nSUDZue59Px9sTSwAAAVc"]
[Fri Feb 27 13:41:35.878150 2026] [:error] [pid 49306:tid 49331] [client 185.220.101.103:63131] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 31"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuj_nSUDZue59Px9sTSwAAAVc"]
[Fri Feb 27 13:41:37.327253 2026] [:error] [pid 49306:tid 49325] [client 185.220.101.103:30975] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukfnSUDZue59Px9sTVQAAAVE"]
[Fri Feb 27 13:41:37.327584 2026] [:error] [pid 49306:tid 49325] [client 185.220.101.103:30975] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukfnSUDZue59Px9sTVQAAAVE"]
[Fri Feb 27 13:41:37.327737 2026] [:error] [pid 49306:tid 49325] [client 185.220.101.103:30975] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 32"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukfnSUDZue59Px9sTVQAAAVE"]
[Fri Feb 27 13:41:37.359656 2026] [:error] [pid 49306:tid 49316] [client 185.220.101.103:30949] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukfnSUDZue59Px9sTVgAAAUg"]
[Fri Feb 27 13:41:37.359924 2026] [:error] [pid 49306:tid 49316] [client 185.220.101.103:30949] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukfnSUDZue59Px9sTVgAAAUg"]
[Fri Feb 27 13:41:37.360025 2026] [:error] [pid 49306:tid 49316] [client 185.220.101.103:30949] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 33"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukfnSUDZue59Px9sTVgAAAUg"]
[Fri Feb 27 13:41:37.382219 2026] [:error] [pid 49306:tid 49309] [client 185.220.101.103:30935] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukfnSUDZue59Px9sTVwAAAUE"]
[Fri Feb 27 13:41:37.382631 2026] [:error] [pid 49306:tid 49309] [client 185.220.101.103:30935] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukfnSUDZue59Px9sTVwAAAUE"]
[Fri Feb 27 13:41:37.382756 2026] [:error] [pid 49306:tid 49309] [client 185.220.101.103:30935] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 34"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukfnSUDZue59Px9sTVwAAAUE"]
[Fri Feb 27 13:41:37.397460 2026] [:error] [pid 54102:tid 54160] [client 185.220.101.103:30967] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukXi74D4fiYUm_Gc1nwAAAJA"]
[Fri Feb 27 13:41:37.397783 2026] [:error] [pid 54102:tid 54160] [client 185.220.101.103:30967] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukXi74D4fiYUm_Gc1nwAAAJA"]
[Fri Feb 27 13:41:37.397873 2026] [:error] [pid 54102:tid 54160] [client 185.220.101.103:30967] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 35"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukXi74D4fiYUm_Gc1nwAAAJA"]
[Fri Feb 27 13:41:37.450000 2026] [:error] [pid 49306:tid 49321] [client 185.220.101.103:30965] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukfnSUDZue59Px9sTWAAAAU0"]
[Fri Feb 27 13:41:37.450345 2026] [:error] [pid 49306:tid 49321] [client 185.220.101.103:30965] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukfnSUDZue59Px9sTWAAAAU0"]
[Fri Feb 27 13:41:37.450508 2026] [:error] [pid 49306:tid 49321] [client 185.220.101.103:30965] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 36"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukfnSUDZue59Px9sTWAAAAU0"]
[Fri Feb 27 13:41:38.737108 2026] [:error] [pid 49306:tid 49313] [client 185.220.101.103:30985] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukvnSUDZue59Px9sTXwAAAUU"]
[Fri Feb 27 13:41:38.737462 2026] [:error] [pid 49306:tid 49313] [client 185.220.101.103:30985] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukvnSUDZue59Px9sTXwAAAUU"]
[Fri Feb 27 13:41:38.737599 2026] [:error] [pid 49306:tid 49313] [client 185.220.101.103:30985] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 37"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukvnSUDZue59Px9sTXwAAAUU"]
[Fri Feb 27 13:41:38.762150 2026] [:error] [pid 49306:tid 49331] [client 185.220.101.103:30995] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukvnSUDZue59Px9sTYAAAAVc"]
[Fri Feb 27 13:41:38.762554 2026] [:error] [pid 49306:tid 49331] [client 185.220.101.103:30995] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukvnSUDZue59Px9sTYAAAAVc"]
[Fri Feb 27 13:41:38.762706 2026] [:error] [pid 49306:tid 49331] [client 185.220.101.103:30995] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 38"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukvnSUDZue59Px9sTYAAAAVc"]
[Fri Feb 27 13:41:38.792695 2026] [:error] [pid 49306:tid 49319] [client 185.220.101.103:30999] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukvnSUDZue59Px9sTYQAAAUs"]
[Fri Feb 27 13:41:38.793046 2026] [:error] [pid 49306:tid 49319] [client 185.220.101.103:30999] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukvnSUDZue59Px9sTYQAAAUs"]
[Fri Feb 27 13:41:38.793201 2026] [:error] [pid 49306:tid 49319] [client 185.220.101.103:30999] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 39"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukvnSUDZue59Px9sTYQAAAUs"]
[Fri Feb 27 13:41:38.809046 2026] [:error] [pid 49306:tid 49322] [client 185.220.101.103:31001] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukvnSUDZue59Px9sTYgAAAU4"]
[Fri Feb 27 13:41:38.809435 2026] [:error] [pid 49306:tid 49322] [client 185.220.101.103:31001] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukvnSUDZue59Px9sTYgAAAU4"]
[Fri Feb 27 13:41:38.809574 2026] [:error] [pid 49306:tid 49322] [client 185.220.101.103:31001] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 40"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukvnSUDZue59Px9sTYgAAAU4"]
[Fri Feb 27 13:41:38.866979 2026] [:error] [pid 52073:tid 52099] [client 185.220.101.103:31013] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukoa650YPyxXVeRb4bwAAAZc"]
[Fri Feb 27 13:41:38.867265 2026] [:error] [pid 52073:tid 52099] [client 185.220.101.103:31013] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukoa650YPyxXVeRb4bwAAAZc"]
[Fri Feb 27 13:41:38.867386 2026] [:error] [pid 52073:tid 52099] [client 185.220.101.103:31013] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 41"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEukoa650YPyxXVeRb4bwAAAZc"]
[Fri Feb 27 13:41:40.405675 2026] [:error] [pid 62998:tid 63024] [client 185.220.101.103:31023] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulFQeueXZDUmoLonGtQAAARY"]
[Fri Feb 27 13:41:40.406144 2026] [:error] [pid 62998:tid 63024] [client 185.220.101.103:31023] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulFQeueXZDUmoLonGtQAAARY"]
[Fri Feb 27 13:41:40.406211 2026] [:error] [pid 62998:tid 63024] [client 185.220.101.103:31023] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 42"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulFQeueXZDUmoLonGtQAAARY"]
[Fri Feb 27 13:41:40.470529 2026] [:error] [pid 49306:tid 49314] [client 185.220.101.103:31047] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulPnSUDZue59Px9sTbAAAAUY"]
[Fri Feb 27 13:41:40.470813 2026] [:error] [pid 49306:tid 49314] [client 185.220.101.103:31047] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulPnSUDZue59Px9sTbAAAAUY"]
[Fri Feb 27 13:41:40.470907 2026] [:error] [pid 49306:tid 49314] [client 185.220.101.103:31047] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 43"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulPnSUDZue59Px9sTbAAAAUY"]
[Fri Feb 27 13:41:40.484745 2026] [:error] [pid 49306:tid 49310] [client 185.220.101.103:31057] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulPnSUDZue59Px9sTbgAAAUI"]
[Fri Feb 27 13:41:40.484753 2026] [:error] [pid 49306:tid 49308] [client 185.220.101.103:31035] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulPnSUDZue59Px9sTbQAAAUA"]
[Fri Feb 27 13:41:40.485016 2026] [:error] [pid 49306:tid 49310] [client 185.220.101.103:31057] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulPnSUDZue59Px9sTbgAAAUI"]
[Fri Feb 27 13:41:40.485016 2026] [:error] [pid 49306:tid 49308] [client 185.220.101.103:31035] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulPnSUDZue59Px9sTbQAAAUA"]
[Fri Feb 27 13:41:40.485103 2026] [:error] [pid 49306:tid 49310] [client 185.220.101.103:31057] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 44"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulPnSUDZue59Px9sTbgAAAUI"]
[Fri Feb 27 13:41:40.485132 2026] [:error] [pid 49306:tid 49308] [client 185.220.101.103:31035] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 44"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulPnSUDZue59Px9sTbQAAAUA"]
[Fri Feb 27 13:41:40.486140 2026] [:error] [pid 49306:tid 49326] [client 185.220.101.103:31073] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulPnSUDZue59Px9sTbwAAAVI"]
[Fri Feb 27 13:41:40.486287 2026] [:error] [pid 49306:tid 49326] [client 185.220.101.103:31073] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulPnSUDZue59Px9sTbwAAAVI"]
[Fri Feb 27 13:41:40.486450 2026] [:error] [pid 49306:tid 49326] [client 185.220.101.103:31073] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 46"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulPnSUDZue59Px9sTbwAAAVI"]
[Fri Feb 27 13:41:41.911802 2026] [:error] [pid 49306:tid 49320] [client 185.220.101.103:31097] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulfnSUDZue59Px9sTdQAAAUw"]
[Fri Feb 27 13:41:41.912189 2026] [:error] [pid 49306:tid 49320] [client 185.220.101.103:31097] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulfnSUDZue59Px9sTdQAAAUw"]
[Fri Feb 27 13:41:41.912328 2026] [:error] [pid 49306:tid 49320] [client 185.220.101.103:31097] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 47"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulfnSUDZue59Px9sTdQAAAUw"]
[Fri Feb 27 13:41:41.913745 2026] [:error] [pid 49306:tid 49328] [client 185.220.101.103:31081] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulfnSUDZue59Px9sTdgAAAVQ"]
[Fri Feb 27 13:41:41.913975 2026] [:error] [pid 49306:tid 49328] [client 185.220.101.103:31081] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulfnSUDZue59Px9sTdgAAAVQ"]
[Fri Feb 27 13:41:41.914082 2026] [:error] [pid 49306:tid 49328] [client 185.220.101.103:31081] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 48"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulfnSUDZue59Px9sTdgAAAVQ"]
[Fri Feb 27 13:41:42.044991 2026] [:error] [pid 49306:tid 49323] [client 185.220.101.103:31101] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulvnSUDZue59Px9sTdwAAAU8"]
[Fri Feb 27 13:41:42.045306 2026] [:error] [pid 49306:tid 49323] [client 185.220.101.103:31101] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulvnSUDZue59Px9sTdwAAAU8"]
[Fri Feb 27 13:41:42.045459 2026] [:error] [pid 49306:tid 49323] [client 185.220.101.103:31101] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 49"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulvnSUDZue59Px9sTdwAAAU8"]
[Fri Feb 27 13:41:42.381251 2026] [:error] [pid 52073:tid 52100] [client 185.220.101.103:31117] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuloa650YPyxXVeRb4dQAAAZg"]
[Fri Feb 27 13:41:42.381251 2026] [:error] [pid 56075:tid 56081] [client 185.220.101.103:31105] [client 185.220.101.103] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulsKBhrfI6KNv9RjsDwAAAAQ"]
[Fri Feb 27 13:41:42.381596 2026] [:error] [pid 56075:tid 56081] [client 185.220.101.103:31105] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulsKBhrfI6KNv9RjsDwAAAAQ"]
[Fri Feb 27 13:41:42.381596 2026] [:error] [pid 52073:tid 52100] [client 185.220.101.103:31117] [client 185.220.101.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.220.101.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuloa650YPyxXVeRb4dQAAAZg"]
[Fri Feb 27 13:41:42.381719 2026] [:error] [pid 52073:tid 52100] [client 185.220.101.103:31117] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 50"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEuloa650YPyxXVeRb4dQAAAZg"]
[Fri Feb 27 13:41:42.381728 2026] [:error] [pid 56075:tid 56081] [client 185.220.101.103:31105] [client 185.220.101.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.220.101.103, counter = 50"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaEulsKBhrfI6KNv9RjsDwAAAAQ"]
[Fri Feb 27 14:12:15.005671 2026] [:error] [pid 52073:tid 52092] [client 38.213.27.194:33108] [client 38.213.27.194] ModSecurity: Multipart parsing error (init): Multipart: Boundary not found in C-T. [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaE1v4a650YPyxXVeRYLDQAAAZA"]
[Fri Feb 27 14:12:15.006569 2026] [:error] [pid 52073:tid 52092] [client 38.213.27.194:33108] [client 38.213.27.194] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||www.expressinteriors.com|F|2"] [data "Multipart: Boundary not found in C-T."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaE1v4a650YPyxXVeRYLDQAAAZA"]
[Fri Feb 27 14:12:15.006636 2026] [:error] [pid 52073:tid 52092] [client 38.213.27.194:33108] [client 38.213.27.194] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 0, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||www.expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaE1v4a650YPyxXVeRYLDQAAAZA"]
[Fri Feb 27 14:58:16.572191 2026] [:error] [pid 52073:tid 52084] [client 182.44.2.148:58513] [client 182.44.2.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaFAiIa650YPyxXVeRYmngAAAYg"]
[Fri Feb 27 15:17:59.807762 2026] [:error] [pid 56075:tid 56085] [client 20.92.234.66:4790] [client 20.92.234.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-editor.php"] [unique_id "aaFFJ8KBhrfI6KNv9RgSYQAAAAg"]
[Fri Feb 27 15:17:59.869557 2026] [:error] [pid 52073:tid 52099] [client 20.92.234.66:1565] [client 20.92.234.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-editor.php"] [unique_id "aaFFJ4a650YPyxXVeRY2OQAAAZc"]
[Fri Feb 27 15:17:59.929457 2026] [:error] [pid 56075:tid 56079] [client 20.92.234.66:1117] [client 20.92.234.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-editor.php"] [unique_id "aaFFJ8KBhrfI6KNv9RgSYgAAAAI"]
[Fri Feb 27 15:17:59.989225 2026] [:error] [pid 49306:tid 49312] [client 20.92.234.66:1098] [client 20.92.234.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-editor.php"] [unique_id "aaFFJ_nSUDZue59Px9tU3gAAAUQ"]
[Fri Feb 27 15:28:18.579927 2026] [:error] [pid 52073:tid 52076] [client 34.182.116.62:60474] [client 34.182.116.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.182.116.62, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaFHkoa650YPyxXVeRZGVQAAAYA"]
[Fri Feb 27 16:17:34.157804 2026] [:error] [pid 56075:tid 56080] [client 37.77.150.123:59633] [client 37.77.150.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.77.150.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaFTHcKBhrfI6KNv9RgoqgAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 16:17:39.869870 2026] [:error] [pid 54103:tid 54172] [client 37.77.150.123:49463] [client 37.77.150.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.77.150.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaFTI-vG4MPCmE0B2sB0nQAAAME"], referer: https://expressinteriors.com/wp-login.php
[Fri Feb 27 16:20:22.950984 2026] [:error] [pid 52073:tid 52078] [client 172.70.242.215:12026] [client 172.70.242.215] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aaFTxoa650YPyxXVeRZsMgAAAYI"]
[Fri Feb 27 16:29:49.536043 2026] [:error] [pid 52073:tid 52078] [client 43.157.168.43:52490] [client 43.157.168.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaFV_Ya650YPyxXVeRZyPAAAAYI"]
[Fri Feb 27 18:02:31.067872 2026] [:error] [pid 62998:tid 63024] [client 20.41.98.49:5712] [client 20.41.98.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aaFrt1QeueXZDUmoLokGJgAAARY"]
[Fri Feb 27 18:02:31.614343 2026] [:error] [pid 56075:tid 56095] [client 20.41.98.49:14950] [client 20.41.98.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aaFrt8KBhrfI6KNv9RhJ1QAAABE"]
[Fri Feb 27 18:02:32.178187 2026] [:error] [pid 54103:tid 54194] [client 20.41.98.49:7294] [client 20.41.98.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aaFruOvG4MPCmE0B2sCC0wAAANc"]
[Fri Feb 27 18:02:32.718096 2026] [:error] [pid 56075:tid 56088] [client 20.41.98.49:14954] [client 20.41.98.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aaFruMKBhrfI6KNv9RhJ1gAAAAs"]
[Fri Feb 27 18:10:01.081625 2026] [:error] [pid 52073:tid 52092] [client 65.109.145.54:55442] [client 65.109.145.54] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.expressinteriors.com|F|2"] [data "TX:0=audio/mpeg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaFteYa650YPyxXVeRa11wAAAZA"]
[Fri Feb 27 18:20:02.030466 2026] [:error] [pid 54101:tid 54121] [client 35.195.188.37:64189] [client 35.195.188.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.195.188.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaFv0lY5qgRktcYTGFss8QAAAc0"]
[Fri Feb 27 18:20:04.481106 2026] [:error] [pid 54101:tid 54120] [client 35.195.188.37:64189] [client 35.195.188.37] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aaFv1FY5qgRktcYTGFss9QAAAcw"]
[Fri Feb 27 18:20:04.749425 2026] [:error] [pid 54101:tid 54111] [client 35.195.188.37:64189] [client 35.195.188.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.195.188.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaFv1FY5qgRktcYTGFss9gAAAcM"]
[Fri Feb 27 18:20:06.477349 2026] [:error] [pid 49306:tid 49331] [client 35.195.188.37:57231] [client 35.195.188.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.195.188.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaFv1vnSUDZue59Px9u1hwAAAVc"]
[Fri Feb 27 18:20:08.439985 2026] [:error] [pid 49306:tid 49316] [client 35.195.188.37:50489] [client 35.195.188.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.195.188.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaFv2PnSUDZue59Px9u1kgAAAUg"]
[Fri Feb 27 18:20:10.108587 2026] [:error] [pid 49306:tid 49329] [client 35.195.188.37:60884] [client 35.195.188.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.195.188.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaFv2vnSUDZue59Px9u1mgAAAVU"]
[Fri Feb 27 18:20:11.786351 2026] [:error] [pid 56075:tid 56102] [client 35.195.188.37:59249] [client 35.195.188.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.195.188.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaFv28KBhrfI6KNv9RhO5QAAABg"]
[Fri Feb 27 18:20:11.786595 2026] [:error] [pid 56075:tid 56102] [client 35.195.188.37:59249] [client 35.195.188.37] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.195.188.37, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaFv28KBhrfI6KNv9RhO5QAAABg"]
[Fri Feb 27 18:56:30.987718 2026] [:error] [pid 52073:tid 52080] [client 43.157.147.3:58670] [client 43.157.147.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaF4Xoa650YPyxXVeRbdTQAAAYQ"]
[Fri Feb 27 19:06:53.774355 2026] [:error] [pid 54103:tid 54183] [client 74.244.87.111:29080] [client 74.244.87.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaF6zevG4MPCmE0B2sCKyQAAAMw"]
[Fri Feb 27 19:07:18.054293 2026] [:error] [pid 52073:tid 52082] [client 102.209.130.218:63200] [client 102.209.130.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.209.130.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaF65oa650YPyxXVeRbmOAAAAYY"]
[Fri Feb 27 19:10:47.499288 2026] [:error] [pid 52073:tid 52099] [client 102.209.130.218:49900] [client 102.209.130.218] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaF7t4a650YPyxXVeRbpcAAAAZc"]
[Fri Feb 27 19:12:21.397328 2026] [:error] [pid 56075:tid 56102] [client 102.209.130.218:50414] [client 102.209.130.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.209.130.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaF8FcKBhrfI6KNv9RhkWQAAABg"]
[Fri Feb 27 19:13:45.759139 2026] [:error] [pid 52073:tid 52096] [client 102.209.130.218:51611] [client 102.209.130.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.209.130.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaF8aYa650YPyxXVeRbsGgAAAZQ"]
[Fri Feb 27 19:15:10.298875 2026] [:error] [pid 52073:tid 52093] [client 102.209.130.218:53094] [client 102.209.130.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.209.130.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaF8voa650YPyxXVeRbtTwAAAZE"]
[Fri Feb 27 19:16:39.349316 2026] [:error] [pid 52073:tid 52088] [client 102.209.130.218:54604] [client 102.209.130.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.209.130.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaF9F4a650YPyxXVeRbuowAAAYw"]
[Fri Feb 27 19:16:44.032341 2026] [:error] [pid 49306:tid 49315] [client 20.104.124.39:2148] [client 20.104.124.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.104.124.39, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaF9HPnSUDZue59Px9vVggAAAUc"]
[Fri Feb 27 19:25:46.194342 2026] [:error] [pid 52073:tid 52085] [client 20.205.120.43:11280] [client 20.205.120.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Cookie/cloud.php"] [unique_id "aaF_Ooa650YPyxXVeRb23wAAAYk"]
[Fri Feb 27 19:25:48.651330 2026] [:error] [pid 62998:tid 63016] [client 20.205.120.43:6115] [client 20.205.120.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/functions.php"] [unique_id "aaF_PFQeueXZDUmoLokerAAAAQ4"]
[Fri Feb 27 19:25:51.813744 2026] [:error] [pid 49306:tid 49332] [client 20.205.120.43:4319] [client 20.205.120.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/flower.php"] [unique_id "aaF_P_nSUDZue59Px9vcpQAAAVg"]
[Fri Feb 27 19:25:54.349815 2026] [:error] [pid 49306:tid 49330] [client 20.205.120.43:16770] [client 20.205.120.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/block-bindings.php"] [unique_id "aaF_QvnSUDZue59Px9vcuAAAAVY"]
[Fri Feb 27 19:25:54.844635 2026] [:error] [pid 52073:tid 52087] [client 20.205.120.43:4298] [client 20.205.120.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Content/root.php"] [unique_id "aaF_Qoa650YPyxXVeRb3CAAAAYs"]
[Fri Feb 27 19:25:55.423940 2026] [proxy_fcgi:error] [pid 52073:tid 52082] [client 20.205.120.43:3484] AH01071: Got error 'Primary script unknown'
[Fri Feb 27 19:25:55.547030 2026] [:error] [pid 52073:tid 52084] [client 20.205.120.43:3484] [client 20.205.120.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/index.php"] [unique_id "aaF_Q4a650YPyxXVeRb3EQAAAYg"]
[Fri Feb 27 19:25:56.093892 2026] [:error] [pid 52073:tid 52100] [client 20.205.120.43:4317] [client 20.205.120.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aaF_RIa650YPyxXVeRb3FQAAAZg"]
[Fri Feb 27 19:25:56.674820 2026] [:error] [pid 52073:tid 52087] [client 20.205.120.43:13317] [client 20.205.120.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aaF_RIa650YPyxXVeRb3GAAAAYs"]
[Fri Feb 27 19:25:57.302283 2026] [:error] [pid 52073:tid 52078] [client 20.205.120.43:16816] [client 20.205.120.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aaF_RYa650YPyxXVeRb3IAAAAYI"]
[Fri Feb 27 19:25:57.843624 2026] [:error] [pid 56075:tid 56090] [client 20.205.120.43:5546] [client 20.205.120.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aaF_RcKBhrfI6KNv9RhpaAAAAAw"]
[Fri Feb 27 19:31:24.124111 2026] [:error] [pid 49306:tid 49330] [client 20.220.8.221:6605] [client 20.220.8.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aaGAjPnSUDZue59Px9vfTwAAAVY"]
[Fri Feb 27 19:31:27.875831 2026] [autoindex:error] [pid 52073:tid 52096] [client 20.220.8.221:6602] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 19:31:28.087544 2026] [proxy_fcgi:error] [pid 52073:tid 52089] [client 20.220.8.221:6602] AH01071: Got error 'Primary script unknown'
[Fri Feb 27 19:31:28.306876 2026] [autoindex:error] [pid 52073:tid 52078] [client 20.220.8.221:6602] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 19:31:28.522022 2026] [autoindex:error] [pid 52073:tid 52086] [client 20.220.8.221:6602] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 19:31:28.729932 2026] [:error] [pid 52073:tid 52099] [client 20.220.8.221:6602] [client 20.220.8.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.220.8.221, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaGAkIa650YPyxXVeRb8UwAAAZc"]
[Fri Feb 27 19:31:31.161312 2026] [autoindex:error] [pid 52073:tid 52082] [client 20.220.8.221:6602] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 19:31:32.195027 2026] [:error] [pid 52073:tid 52084] [client 20.220.8.221:6602] [client 20.220.8.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aaGAlIa650YPyxXVeRb8XgAAAYg"]
[Fri Feb 27 19:31:33.049979 2026] [:error] [pid 54231:tid 54235] [client 20.220.8.221:6654] [client 20.220.8.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "aaGAleTvb5AeyJCdY7Dz2gAAAEE"]
[Fri Feb 27 19:31:36.885853 2026] [:error] [pid 49306:tid 49310] [client 20.220.8.221:6638] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aaGAmPnSUDZue59Px9vfdQAAAUI"]
[Fri Feb 27 19:31:37.741629 2026] [:error] [pid 52073:tid 52088] [client 20.220.8.221:6616] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aaGAmYa650YPyxXVeRb8bgAAAYw"]
[Fri Feb 27 19:31:38.590633 2026] [:error] [pid 52073:tid 52077] [client 20.220.8.221:6637] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aaGAmoa650YPyxXVeRb8cQAAAYE"]
[Fri Feb 27 19:31:39.452303 2026] [:error] [pid 56075:tid 56102] [client 20.220.8.221:6593] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aaGAm8KBhrfI6KNv9RhsLwAAABg"]
[Fri Feb 27 21:32:45.448595 2026] [:error] [pid 52073:tid 52094] [client 45.131.195.111:30467] [client 45.131.195.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aaGc_Ya650YPyxXVeRZrRAAAAZI"]
[Fri Feb 27 21:33:07.159499 2026] [:error] [pid 49306:tid 49319] [client 45.131.195.57:21425] [client 45.131.195.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aaGdE_nSUDZue59Px9snAgAAAUs"]
[Fri Feb 27 21:33:56.113516 2026] [:error] [pid 54102:tid 54158] [client 45.131.195.86:50211] [client 45.131.195.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aaGdRHi74D4fiYUm_Gd6dAAAAI4"]
[Fri Feb 27 21:34:12.981627 2026] [:error] [pid 62998:tid 63005] [client 45.131.195.77:28115] [client 45.131.195.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aaGdVFQeueXZDUmoLolX2gAAAQM"]
[Fri Feb 27 21:34:39.129841 2026] [:error] [pid 52073:tid 52077] [client 45.131.195.114:27583] [client 45.131.195.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aaGdb4a650YPyxXVeRZxhQAAAYE"]
[Fri Feb 27 21:34:42.902640 2026] [:error] [pid 56075:tid 56092] [client 45.131.195.79:48699] [client 45.131.195.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aaGdcsKBhrfI6KNv9RjnCgAAAA4"]
[Fri Feb 27 21:34:43.419286 2026] [:error] [pid 54231:tid 54253] [client 45.131.195.109:50761] [client 45.131.195.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aaGdc-Tvb5AeyJCdY7AelwAAAFM"]
[Fri Feb 27 21:34:44.056463 2026] [:error] [pid 54231:tid 54246] [client 45.131.195.96:59177] [client 45.131.195.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aaGddOTvb5AeyJCdY7AepgAAAEw"]
[Fri Feb 27 21:34:44.477920 2026] [:error] [pid 56075:tid 56094] [client 45.131.195.90:51617] [client 45.131.195.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aaGddMKBhrfI6KNv9RjnNgAAABA"]
[Fri Feb 27 21:34:44.942673 2026] [:error] [pid 49306:tid 49330] [client 45.131.195.100:22743] [client 45.131.195.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aaGddPnSUDZue59Px9srnAAAAVY"]
[Fri Feb 27 21:34:48.133030 2026] [:error] [pid 52073:tid 52100] [client 45.131.195.52:44453] [client 45.131.195.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aaGdeIa650YPyxXVeRZyHgAAAZg"]
[Fri Feb 27 21:34:51.817273 2026] [:error] [pid 54102:tid 54146] [client 45.131.195.79:47983] [client 45.131.195.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aaGde3i74D4fiYUm_Gd75wAAAII"]
[Fri Feb 27 21:35:01.983163 2026] [:error] [pid 54101:tid 54128] [client 45.131.195.53:34915] [client 45.131.195.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aaGdhVY5qgRktcYTGFtMlgAAAdQ"]
[Fri Feb 27 21:35:06.343210 2026] [:error] [pid 49306:tid 49323] [client 45.131.195.57:53661] [client 45.131.195.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aaGdivnSUDZue59Px9ss2QAAAU8"]
[Fri Feb 27 21:35:12.503338 2026] [:error] [pid 56075:tid 56087] [client 45.131.195.61:20863] [client 45.131.195.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aaGdkMKBhrfI6KNv9RjoYAAAAAo"]
[Fri Feb 27 21:35:30.277404 2026] [:error] [pid 54231:tid 54241] [client 45.131.195.85:24015] [client 45.131.195.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aaGdouTvb5AeyJCdY7AgMgAAAEc"]
[Fri Feb 27 21:35:33.416101 2026] [:error] [pid 54103:tid 54180] [client 45.131.195.59:38955] [client 45.131.195.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aaGdpevG4MPCmE0B2sCzRAAAAMk"]
[Fri Feb 27 21:35:33.850325 2026] [:error] [pid 54103:tid 54178] [client 45.131.195.66:40047] [client 45.131.195.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aaGdpevG4MPCmE0B2sCzRgAAAMc"]
[Fri Feb 27 21:35:40.964312 2026] [:error] [pid 56075:tid 56077] [client 45.131.195.100:20721] [client 45.131.195.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/defaults.php"] [unique_id "aaGdrMKBhrfI6KNv9RjpsgAAAAA"]
[Fri Feb 27 21:35:43.893864 2026] [:error] [pid 54231:tid 54257] [client 45.131.195.53:42799] [client 45.131.195.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aaGdr-Tvb5AeyJCdY7AhMQAAAFc"]
[Fri Feb 27 21:35:55.616873 2026] [:error] [pid 62998:tid 63026] [client 45.131.195.94:42847] [client 45.131.195.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aaGdu1QeueXZDUmoLolb3gAAARg"]
[Fri Feb 27 21:35:58.450600 2026] [:error] [pid 54101:tid 54114] [client 45.131.195.96:42459] [client 45.131.195.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aaGdvlY5qgRktcYTGFtN_wAAAcY"]
[Fri Feb 27 21:36:03.172795 2026] [:error] [pid 56075:tid 56078] [client 45.131.195.89:37549] [client 45.131.195.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aaGdw8KBhrfI6KNv9RjrLQAAAAE"]
[Fri Feb 27 21:36:03.612429 2026] [:error] [pid 49306:tid 49313] [client 45.131.195.109:60897] [client 45.131.195.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aaGdw_nSUDZue59Px9svxAAAAUU"]
[Fri Feb 27 21:36:04.139050 2026] [:error] [pid 54101:tid 54122] [client 45.131.195.62:25045] [client 45.131.195.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaGdxFY5qgRktcYTGFtOEQAAAc4"]
[Fri Feb 27 21:36:12.968482 2026] [:error] [pid 49306:tid 49330] [client 45.131.195.94:20259] [client 45.131.195.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/info.php"] [unique_id "aaGdzPnSUDZue59Px9swFQAAAVY"]
[Fri Feb 27 21:36:13.468347 2026] [:error] [pid 54103:tid 54193] [client 45.131.195.77:28023] [client 45.131.195.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class.api.php"] [unique_id "aaGdzevG4MPCmE0B2sC0MgAAANY"]
[Fri Feb 27 21:36:13.930089 2026] [:error] [pid 52073:tid 52089] [client 45.131.195.89:26415] [client 45.131.195.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaGdzYa650YPyxXVeRZ1wQAAAY0"]
[Fri Feb 27 21:36:29.781589 2026] [:error] [pid 54231:tid 54252] [client 45.131.195.81:49673] [client 45.131.195.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/admin.php"] [unique_id "aaGd3eTvb5AeyJCdY7AjJQAAAFI"]
[Fri Feb 27 21:36:36.957157 2026] [:error] [pid 54101:tid 54114] [client 45.131.195.105:54947] [client 45.131.195.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.105, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aaGd5FY5qgRktcYTGFtOigAAAcY"]
[Fri Feb 27 21:36:57.664243 2026] [:error] [pid 54101:tid 54115] [client 45.131.195.105:54947] [client 45.131.195.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aaGd-VY5qgRktcYTGFtOrQAAAcc"]
[Fri Feb 27 21:37:04.819235 2026] [:error] [pid 54101:tid 54124] [client 45.131.195.99:65443] [client 45.131.195.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aaGeAFY5qgRktcYTGFtOvwAAAdA"]
[Fri Feb 27 21:37:09.818346 2026] [:error] [pid 54101:tid 54113] [client 45.131.195.99:65443] [client 45.131.195.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/item.php"] [unique_id "aaGeBVY5qgRktcYTGFtOxAAAAcU"]
[Fri Feb 27 21:37:28.418814 2026] [:error] [pid 49306:tid 49331] [client 45.131.195.56:61215] [client 45.131.195.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aaGeGPnSUDZue59Px9sz-AAAAVc"]
[Fri Feb 27 21:37:47.238677 2026] [:error] [pid 52073:tid 52085] [client 45.131.195.94:62947] [client 45.131.195.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-class.php"] [unique_id "aaGeK4a650YPyxXVeRZ7bwAAAYk"]
[Fri Feb 27 21:37:49.336383 2026] [:error] [pid 49306:tid 49325] [client 45.131.195.105:31707] [client 45.131.195.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aaGeLfnSUDZue59Px9s0zQAAAVE"]
[Fri Feb 27 21:37:53.654867 2026] [:error] [pid 56075:tid 56088] [client 45.131.195.104:30153] [client 45.131.195.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aaGeMcKBhrfI6KNv9Rjx5AAAAAs"]
[Fri Feb 27 21:38:01.194537 2026] [:error] [pid 49306:tid 49319] [client 45.131.195.89:32899] [client 45.131.195.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.89, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aaGeOfnSUDZue59Px9s1JAAAAUs"]
[Fri Feb 27 21:38:03.219146 2026] [:error] [pid 49306:tid 49325] [client 45.131.195.89:32899] [client 45.131.195.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aaGeO_nSUDZue59Px9s1KgAAAVE"]
[Fri Feb 27 21:38:13.715846 2026] [autoindex:error] [pid 52073:tid 52093] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:13.937275 2026] [autoindex:error] [pid 52073:tid 52098] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:14.215630 2026] [autoindex:error] [pid 52073:tid 52097] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:14.438458 2026] [autoindex:error] [pid 52073:tid 52078] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:16.432398 2026] [autoindex:error] [pid 52073:tid 52076] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:16.669971 2026] [autoindex:error] [pid 52073:tid 52093] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:16.916944 2026] [autoindex:error] [pid 52073:tid 52095] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:17.132707 2026] [autoindex:error] [pid 52073:tid 52085] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:17.395132 2026] [autoindex:error] [pid 52073:tid 52094] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:17.613008 2026] [autoindex:error] [pid 52073:tid 52093] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:18.047260 2026] [autoindex:error] [pid 52073:tid 52084] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:20.117668 2026] [autoindex:error] [pid 52073:tid 52090] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:20.347889 2026] [autoindex:error] [pid 52073:tid 52084] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:23.834658 2026] [autoindex:error] [pid 52073:tid 52080] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:24.062161 2026] [autoindex:error] [pid 52073:tid 52096] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:24.290043 2026] [autoindex:error] [pid 52073:tid 52090] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:24.502930 2026] [autoindex:error] [pid 52073:tid 52076] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:26.825575 2026] [autoindex:error] [pid 52073:tid 52078] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:27.049527 2026] [autoindex:error] [pid 52073:tid 52095] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:28.514728 2026] [autoindex:error] [pid 52073:tid 52085] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:32.714720 2026] [autoindex:error] [pid 52073:tid 52082] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:33.089424 2026] [autoindex:error] [pid 52073:tid 52086] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:33.313081 2026] [autoindex:error] [pid 52073:tid 52093] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:37.679058 2026] [autoindex:error] [pid 52073:tid 52097] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:42.796610 2026] [autoindex:error] [pid 52073:tid 52089] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:44.647783 2026] [autoindex:error] [pid 52073:tid 52078] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:44.875767 2026] [autoindex:error] [pid 52073:tid 52094] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:45.574531 2026] [autoindex:error] [pid 52073:tid 52091] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:45.833189 2026] [autoindex:error] [pid 52073:tid 52093] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:46.076125 2026] [autoindex:error] [pid 52073:tid 52084] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:38:51.646221 2026] [autoindex:error] [pid 52073:tid 52082] [client 45.131.195.62:54727] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:39:14.354945 2026] [autoindex:error] [pid 54231:tid 54243] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:39:14.586702 2026] [autoindex:error] [pid 54231:tid 54251] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:39:14.837819 2026] [autoindex:error] [pid 54231:tid 54248] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:39:15.080839 2026] [autoindex:error] [pid 54231:tid 54239] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:39:17.660539 2026] [autoindex:error] [pid 54231:tid 54243] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:39:17.917827 2026] [autoindex:error] [pid 54231:tid 54251] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:39:19.141782 2026] [autoindex:error] [pid 54231:tid 54245] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:39:20.712292 2026] [autoindex:error] [pid 54231:tid 54236] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:39:20.948854 2026] [autoindex:error] [pid 54231:tid 54244] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:39:21.203992 2026] [autoindex:error] [pid 54231:tid 54239] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:39:22.475405 2026] [autoindex:error] [pid 54231:tid 54251] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:39:22.747409 2026] [autoindex:error] [pid 54231:tid 54234] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:39:22.976834 2026] [autoindex:error] [pid 54231:tid 54250] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:39:23.203225 2026] [autoindex:error] [pid 54231:tid 54247] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:39:50.211499 2026] [autoindex:error] [pid 54231:tid 54236] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:40:02.183767 2026] [autoindex:error] [pid 54231:tid 54251] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:40:06.871216 2026] [autoindex:error] [pid 54231:tid 54237] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:40:07.126097 2026] [autoindex:error] [pid 54231:tid 54250] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:40:11.233454 2026] [autoindex:error] [pid 54231:tid 54248] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:40:11.539752 2026] [autoindex:error] [pid 54231:tid 54257] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:40:11.769849 2026] [autoindex:error] [pid 54231:tid 54252] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:40:11.992852 2026] [autoindex:error] [pid 54231:tid 54251] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:40:12.213800 2026] [autoindex:error] [pid 54231:tid 54241] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:40:12.447573 2026] [autoindex:error] [pid 54231:tid 54245] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:40:12.673624 2026] [autoindex:error] [pid 54231:tid 54255] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:40:12.951304 2026] [autoindex:error] [pid 54231:tid 54242] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:40:13.179497 2026] [autoindex:error] [pid 54231:tid 54249] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:40:35.813535 2026] [autoindex:error] [pid 54231:tid 54238] [client 45.131.195.114:39089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Feb 27 21:54:26.413168 2026] [:error] [pid 56075:tid 56092] [client 43.133.253.253:56952] [client 43.133.253.253] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaGiEsKBhrfI6KNv9RgUeQAAAA4"]
[Fri Feb 27 22:16:09.549964 2026] [:error] [pid 62998:tid 63024] [client 182.42.111.156:32909] [client 182.42.111.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaGnKVQeueXZDUmoLolzEwAAARY"]
[Fri Feb 27 23:22:27.968324 2026] [:error] [pid 49306:tid 49308] [client 146.190.160.27:53947] [client 146.190.160.27] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 146.190.160.27, counter = 6"] [hostname "expressinteriors.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aaG2s_nSUDZue59Px9tyXwAAAUA"]
[Fri Feb 27 23:49:12.326297 2026] [:error] [pid 49306:tid 49312] [client 20.220.221.45:7725] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaG8-PnSUDZue59Px9uBNgAAAUQ"]
[Fri Feb 27 23:49:12.739744 2026] [:error] [pid 56075:tid 56084] [client 20.220.221.45:7685] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaG8-MKBhrfI6KNv9Rh_eQAAAAc"]
[Fri Feb 27 23:49:13.150929 2026] [:error] [pid 54231:tid 54242] [client 20.220.221.45:7761] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaG8-eTvb5AeyJCdY7BQmwAAAEg"]
[Fri Feb 27 23:49:13.567529 2026] [:error] [pid 62998:tid 63026] [client 20.220.221.45:7681] [client 20.220.221.45] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaG8-VQeueXZDUmoLomVlQAAARg"]
[Fri Feb 27 23:54:55.158099 2026] [:error] [pid 49306:tid 49317] [client 43.158.91.71:33906] [client 43.158.91.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaG-T_nSUDZue59Px9uD-QAAAUk"]
[Sat Feb 28 00:19:41.860736 2026] [:error] [pid 56075:tid 56096] [client 212.104.214.238:1788] [client 212.104.214.238] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaHEHcKBhrfI6KNv9RiaHQAAABI"]
[Sat Feb 28 00:21:38.883408 2026] [:error] [pid 15240:tid 15243] [client 212.104.214.238:1097] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHEki1iKL_41Rk9A9NFYwAAAAE"]
[Sat Feb 28 00:23:17.868441 2026] [:error] [pid 15240:tid 15255] [client 212.104.214.238:65071] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHE9S1iKL_41Rk9A9NHiAAAAA0"]
[Sat Feb 28 00:25:02.039494 2026] [:error] [pid 15240:tid 15245] [client 212.104.214.238:25404] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHFXi1iKL_41Rk9A9NJhgAAAAM"]
[Sat Feb 28 00:26:42.328291 2026] [:error] [pid 15098:tid 15113] [client 212.104.214.238:36872] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHFwskFqny8dQQbmTkSrgAAAIc"]
[Sat Feb 28 00:28:15.886297 2026] [:error] [pid 15240:tid 15258] [client 212.104.214.238:4450] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHGHy1iKL_41Rk9A9NM_wAAABA"]
[Sat Feb 28 00:29:49.398666 2026] [:error] [pid 15100:tid 15182] [client 212.104.214.238:37196] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHGfUOEbzcINan_ctKofgAAAFY"]
[Sat Feb 28 00:31:25.827338 2026] [:error] [pid 15098:tid 15106] [client 212.104.214.238:18699] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHG3ckFqny8dQQbmTkVMAAAAIE"]
[Sat Feb 28 00:33:14.571221 2026] [:error] [pid 15100:tid 15176] [client 212.104.214.238:13105] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHHSkOEbzcINan_ctKrkgAAAFA"]
[Sat Feb 28 00:34:54.252656 2026] [:error] [pid 15100:tid 15184] [client 212.104.214.238:43924] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHHrkOEbzcINan_ctKtDAAAAFg"]
[Sat Feb 28 00:36:26.479140 2026] [:error] [pid 15100:tid 15166] [client 212.104.214.238:30108] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHICkOEbzcINan_ctKuYgAAAEY"]
[Sat Feb 28 00:38:02.463556 2026] [:error] [pid 38586:tid 38597] [client 212.104.214.238:5683] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHIar_i6nvKNhjFW7UbsAAAAQg"]
[Sat Feb 28 00:39:40.198882 2026] [:error] [pid 15100:tid 15161] [client 212.104.214.238:57595] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHIzEOEbzcINan_ctKwCAAAAEE"]
[Sat Feb 28 00:41:05.799190 2026] [:error] [pid 38586:tid 38609] [client 212.104.214.238:37103] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHJIb_i6nvKNhjFW7UeVQAAARQ"]
[Sat Feb 28 00:42:30.718750 2026] [:error] [pid 15098:tid 15113] [client 212.104.214.238:38962] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHJdskFqny8dQQbmTkZpAAAAIc"]
[Sat Feb 28 00:44:02.156545 2026] [:error] [pid 15240:tid 15244] [client 212.104.214.238:33332] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHJ0i1iKL_41Rk9A9NcoAAAAAI"]
[Sat Feb 28 00:45:33.376190 2026] [:error] [pid 38620:tid 38643] [client 212.104.214.238:11663] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHKLQP6I7SRqrhh7RrUtAAAAVU"]
[Sat Feb 28 00:47:01.278791 2026] [:error] [pid 15100:tid 15175] [client 212.104.214.238:17504] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHKhUOEbzcINan_ctKzcAAAAE8"]
[Sat Feb 28 00:48:29.580232 2026] [:error] [pid 38620:tid 38642] [client 212.104.214.238:32451] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHK3QP6I7SRqrhh7RrX2AAAAVQ"]
[Sat Feb 28 00:49:52.488153 2026] [:error] [pid 15099:tid 15148] [client 212.104.214.238:27535] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHLMOnvP2vtPjYDq_grXAAAAM8"]
[Sat Feb 28 00:51:17.562222 2026] [:error] [pid 38586:tid 38607] [client 212.104.214.238:45881] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHLhb_i6nvKNhjFW7UmewAAARI"]
[Sat Feb 28 00:52:40.334577 2026] [:error] [pid 38620:tid 38642] [client 212.104.214.238:38632] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHL2AP6I7SRqrhh7Rrb8gAAAVQ"]
[Sat Feb 28 00:53:25.271833 2026] [:error] [pid 38620:tid 38639] [client 20.220.8.221:6303] [client 20.220.8.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "aaHMBQP6I7SRqrhh7RrcjgAAAVE"]
[Sat Feb 28 00:53:26.863978 2026] [autoindex:error] [pid 15100:tid 15163] [client 20.220.8.221:6326] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 00:53:31.993628 2026] [:error] [pid 15100:tid 15163] [client 20.220.8.221:6326] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "aaHMC0OEbzcINan_ctK2CgAAAEM"]
[Sat Feb 28 00:53:32.840816 2026] [:error] [pid 15099:tid 15150] [client 20.220.8.221:6310] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "aaHMDOnvP2vtPjYDq_gshAAAANE"]
[Sat Feb 28 00:53:33.675921 2026] [:error] [pid 38620:tid 38646] [client 20.220.8.221:6274] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "aaHMDQP6I7SRqrhh7RrclwAAAVg"]
[Sat Feb 28 00:53:34.521619 2026] [:error] [pid 38620:tid 38623] [client 20.220.8.221:6407] [client 20.220.8.221] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "aaHMDgP6I7SRqrhh7RrcmQAAAUE"]
[Sat Feb 28 00:54:08.243200 2026] [:error] [pid 38586:tid 38590] [client 212.104.214.238:29283] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHMML_i6nvKNhjFW7UorAAAAQE"]
[Sat Feb 28 00:55:35.638813 2026] [:error] [pid 15099:tid 15144] [client 212.104.214.238:52410] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHMh-nvP2vtPjYDq_gs6QAAAMs"]
[Sat Feb 28 00:56:58.958830 2026] [:error] [pid 38586:tid 38594] [client 212.104.214.238:62885] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHM2r_i6nvKNhjFW7UqWQAAAQU"]
[Sat Feb 28 00:58:25.078444 2026] [:error] [pid 15100:tid 15164] [client 212.104.214.238:47611] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHNMUOEbzcINan_ctK3GAAAAEQ"]
[Sat Feb 28 00:59:53.186326 2026] [:error] [pid 38586:tid 38610] [client 212.104.214.238:19807] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHNib_i6nvKNhjFW7UshgAAARU"]
[Sat Feb 28 01:01:22.116515 2026] [:error] [pid 38586:tid 38589] [client 212.104.214.238:40280] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHN4r_i6nvKNhjFW7UtlQAAAQA"]
[Sat Feb 28 01:01:32.213589 2026] [:error] [pid 38620:tid 38642] [client 34.134.248.15:63590] [client 34.134.248.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.134.248.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHN7AP6I7SRqrhh7RrkgAAAAVQ"]
[Sat Feb 28 01:01:34.589869 2026] [:error] [pid 38620:tid 38625] [client 34.134.248.15:63590] [client 34.134.248.15] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aaHN7gP6I7SRqrhh7Rrk0gAAAUM"]
[Sat Feb 28 01:01:34.817495 2026] [:error] [pid 38620:tid 38629] [client 34.134.248.15:63590] [client 34.134.248.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.134.248.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHN7gP6I7SRqrhh7Rrk0wAAAUc"]
[Sat Feb 28 01:01:36.288084 2026] [:error] [pid 15240:tid 15250] [client 34.134.248.15:62349] [client 34.134.248.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.134.248.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHN8C1iKL_41Rk9A9NldAAAAAg"]
[Sat Feb 28 01:01:37.716308 2026] [:error] [pid 38586:tid 38594] [client 34.134.248.15:51286] [client 34.134.248.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.134.248.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHN8b_i6nvKNhjFW7UtsQAAAQU"]
[Sat Feb 28 01:01:39.189135 2026] [:error] [pid 38620:tid 38630] [client 34.134.248.15:62181] [client 34.134.248.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.134.248.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHN8wP6I7SRqrhh7Rrk8AAAAUg"]
[Sat Feb 28 01:01:40.674095 2026] [:error] [pid 15099:tid 15133] [client 34.134.248.15:51238] [client 34.134.248.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.134.248.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHN9OnvP2vtPjYDq_guggAAAMA"]
[Sat Feb 28 01:01:40.674200 2026] [:error] [pid 15099:tid 15133] [client 34.134.248.15:51238] [client 34.134.248.15] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.134.248.15, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHN9OnvP2vtPjYDq_guggAAAMA"]
[Sat Feb 28 01:02:58.124264 2026] [:error] [pid 38586:tid 38603] [client 212.104.214.238:59663] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHOQr_i6nvKNhjFW7UvKQAAAQ4"]
[Sat Feb 28 01:04:31.098633 2026] [:error] [pid 15100:tid 15160] [client 212.104.214.238:48151] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHOn0OEbzcINan_ctK5kgAAAEA"]
[Sat Feb 28 01:05:22.289540 2026] [:error] [pid 15240:tid 15264] [client 34.70.223.26:55677] [client 34.70.223.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.70.223.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHO0i1iKL_41Rk9A9Nn7AAAABY"]
[Sat Feb 28 01:05:24.659782 2026] [:error] [pid 15240:tid 15259] [client 34.70.223.26:55677] [client 34.70.223.26] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aaHO1C1iKL_41Rk9A9Nn-AAAABE"]
[Sat Feb 28 01:05:24.871234 2026] [:error] [pid 15240:tid 15256] [client 34.70.223.26:55677] [client 34.70.223.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.70.223.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHO1C1iKL_41Rk9A9Nn-QAAAA4"]
[Sat Feb 28 01:05:26.455486 2026] [:error] [pid 15100:tid 15165] [client 34.70.223.26:58569] [client 34.70.223.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.70.223.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHO1kOEbzcINan_ctK53wAAAEU"]
[Sat Feb 28 01:05:27.864272 2026] [:error] [pid 15240:tid 15242] [client 34.70.223.26:60987] [client 34.70.223.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.70.223.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHO1y1iKL_41Rk9A9Nn-wAAAAA"]
[Sat Feb 28 01:05:29.369837 2026] [:error] [pid 15098:tid 15118] [client 34.70.223.26:54512] [client 34.70.223.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.70.223.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHO2ckFqny8dQQbmTkfSAAAAIw"]
[Sat Feb 28 01:05:30.962719 2026] [:error] [pid 38620:tid 38635] [client 34.70.223.26:55769] [client 34.70.223.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.70.223.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHO2gP6I7SRqrhh7RrqdQAAAU0"]
[Sat Feb 28 01:05:30.962858 2026] [:error] [pid 38620:tid 38635] [client 34.70.223.26:55769] [client 34.70.223.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.70.223.26, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHO2gP6I7SRqrhh7RrqdQAAAU0"]
[Sat Feb 28 01:05:57.130821 2026] [:error] [pid 38586:tid 38599] [client 212.104.214.238:29867] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHO9b_i6nvKNhjFW7UxtQAAAQo"]
[Sat Feb 28 01:07:25.259358 2026] [:error] [pid 15099:tid 15153] [client 212.104.214.238:27173] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHPTenvP2vtPjYDq_gwOwAAANQ"]
[Sat Feb 28 01:07:48.537688 2026] [:error] [pid 15098:tid 15121] [client 34.134.248.15:63362] [client 34.134.248.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.134.248.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHPZMkFqny8dQQbmTkfyAAAAI8"]
[Sat Feb 28 01:07:51.014063 2026] [:error] [pid 15098:tid 15111] [client 34.134.248.15:63362] [client 34.134.248.15] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aaHPZ8kFqny8dQQbmTkfzgAAAIU"]
[Sat Feb 28 01:07:51.226163 2026] [:error] [pid 15098:tid 15113] [client 34.134.248.15:63362] [client 34.134.248.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.134.248.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHPZ8kFqny8dQQbmTkfzwAAAIc"]
[Sat Feb 28 01:07:52.790300 2026] [:error] [pid 15240:tid 15255] [client 34.134.248.15:55554] [client 34.134.248.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.134.248.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHPaC1iKL_41Rk9A9NpcAAAAA0"]
[Sat Feb 28 01:07:52.794751 2026] [:error] [pid 15240:tid 15255] [client 34.134.248.15:55554] [client 34.134.248.15] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/usr/local/apache/modsecurity-cwaf/rules/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 34.134.248.15 (+1 hits since last alert)|expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHPaC1iKL_41Rk9A9NpcAAAAA0"]
[Sat Feb 28 01:08:52.867833 2026] [:error] [pid 38620:tid 38644] [client 212.104.214.238:6417] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHPpAP6I7SRqrhh7Rrv0QAAAVY"]
[Sat Feb 28 01:10:13.429721 2026] [:error] [pid 38586:tid 38590] [client 20.151.128.128:8064] [client 20.151.128.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "aaHP9b_i6nvKNhjFW7U1XwAAAQE"]
[Sat Feb 28 01:10:14.588769 2026] [:error] [pid 38586:tid 38611] [client 212.104.214.238:24400] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHP9r_i6nvKNhjFW7U1bgAAARY"]
[Sat Feb 28 01:10:25.955147 2026] [:error] [pid 15099:tid 15156] [client 20.151.128.128:8151] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaHQAenvP2vtPjYDq_gxSQAAANc"]
[Sat Feb 28 01:10:28.365223 2026] [:error] [pid 15240:tid 15257] [client 20.151.128.128:8162] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaHQBC1iKL_41Rk9A9NrOgAAAA8"]
[Sat Feb 28 01:10:31.088096 2026] [:error] [pid 15240:tid 15258] [client 20.151.128.128:8080] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaHQBy1iKL_41Rk9A9NrRgAAABA"]
[Sat Feb 28 01:10:34.307484 2026] [:error] [pid 15100:tid 15173] [client 20.151.128.128:8188] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaHQCkOEbzcINan_ctK8NgAAAE0"]
[Sat Feb 28 01:10:37.285044 2026] [:error] [pid 38586:tid 38598] [client 20.151.128.128:8156] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aaHQDb_i6nvKNhjFW7U1sAAAAQk"]
[Sat Feb 28 01:10:38.209730 2026] [:error] [pid 38620:tid 38642] [client 20.151.128.128:8171] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aaHQDgP6I7SRqrhh7RryVwAAAVQ"]
[Sat Feb 28 01:10:41.133077 2026] [:error] [pid 38586:tid 38592] [client 20.151.128.128:8155] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aaHQEb_i6nvKNhjFW7U1xQAAAQM"]
[Sat Feb 28 01:10:44.440334 2026] [:error] [pid 38620:tid 38640] [client 20.151.128.128:8146] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aaHQFAP6I7SRqrhh7RryhAAAAVI"]
[Sat Feb 28 01:10:46.926167 2026] [:error] [pid 38586:tid 38606] [client 20.151.128.128:8189] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaHQFr_i6nvKNhjFW7U18QAAARE"]
[Sat Feb 28 01:10:48.812557 2026] [:error] [pid 38620:tid 38630] [client 20.151.128.128:8168] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaHQGAP6I7SRqrhh7RryvgAAAUg"]
[Sat Feb 28 01:10:49.382170 2026] [:error] [pid 38620:tid 38628] [client 20.151.128.128:8066] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaHQGQP6I7SRqrhh7RryxwAAAUY"]
[Sat Feb 28 01:10:50.451457 2026] [:error] [pid 38620:tid 38632] [client 20.151.128.128:8084] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaHQGgP6I7SRqrhh7RryzwAAAUo"]
[Sat Feb 28 01:10:52.027782 2026] [:error] [pid 15098:tid 15108] [client 20.151.128.128:8153] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaHQHMkFqny8dQQbmTkgmwAAAIM"]
[Sat Feb 28 01:10:56.907599 2026] [:error] [pid 15100:tid 15178] [client 20.151.128.128:8133] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaHQIEOEbzcINan_ctK8UQAAAFI"]
[Sat Feb 28 01:10:59.070004 2026] [:error] [pid 15100:tid 15164] [client 20.151.128.128:8180] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaHQI0OEbzcINan_ctK8VAAAAEQ"]
[Sat Feb 28 01:11:00.553775 2026] [:error] [pid 38620:tid 38646] [client 20.151.128.128:8185] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaHQJAP6I7SRqrhh7RrzFQAAAVg"]
[Sat Feb 28 01:11:02.653289 2026] [:error] [pid 38620:tid 38633] [client 20.151.128.128:8139] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaHQJgP6I7SRqrhh7RrzLQAAAUs"]
[Sat Feb 28 01:11:06.746607 2026] [:error] [pid 15100:tid 15175] [client 20.151.128.128:8191] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaHQKkOEbzcINan_ctK8ZwAAAE8"]
[Sat Feb 28 01:11:07.817884 2026] [:error] [pid 38620:tid 38636] [client 20.151.128.128:8135] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaHQKwP6I7SRqrhh7RrzUAAAAU4"]
[Sat Feb 28 01:11:09.069893 2026] [:error] [pid 38620:tid 38646] [client 20.151.128.128:8108] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaHQLQP6I7SRqrhh7RrzXgAAAVg"]
[Sat Feb 28 01:11:10.491373 2026] [:error] [pid 15240:tid 15262] [client 20.151.128.128:8163] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaHQLi1iKL_41Rk9A9NrnAAAABQ"]
[Sat Feb 28 01:11:11.323405 2026] [:error] [pid 38586:tid 38602] [client 20.151.128.128:8166] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaHQL7_i6nvKNhjFW7U2PgAAAQ0"]
[Sat Feb 28 01:11:15.615824 2026] [:error] [pid 15240:tid 15249] [client 20.151.128.128:8148] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaHQMy1iKL_41Rk9A9NrpQAAAAc"]
[Sat Feb 28 01:11:17.304856 2026] [:error] [pid 38620:tid 38641] [client 20.151.128.128:8149] [client 20.151.128.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaHQNQP6I7SRqrhh7RrzigAAAVM"]
[Sat Feb 28 01:11:40.557262 2026] [:error] [pid 38620:tid 38624] [client 212.104.214.238:12166] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHQTAP6I7SRqrhh7Rr0IgAAAUI"]
[Sat Feb 28 01:13:05.838713 2026] [:error] [pid 38620:tid 38642] [client 212.104.214.238:6143] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHQoQP6I7SRqrhh7Rr2NQAAAVQ"]
[Sat Feb 28 01:14:34.447241 2026] [:error] [pid 15100:tid 15177] [client 212.104.214.238:3702] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHQ-kOEbzcINan_ctK-CAAAAFE"]
[Sat Feb 28 01:15:54.437257 2026] [:error] [pid 15098:tid 15123] [client 212.104.214.238:15711] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHRSskFqny8dQQbmTkiOgAAAJE"]
[Sat Feb 28 01:17:09.487454 2026] [:error] [pid 38586:tid 38601] [client 212.104.214.238:49030] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHRlb_i6nvKNhjFW7U9HwAAAQw"]
[Sat Feb 28 01:18:18.918808 2026] [:error] [pid 15240:tid 15249] [client 212.104.214.238:3619] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHR2i1iKL_41Rk9A9NyIwAAAAc"]
[Sat Feb 28 01:19:25.478958 2026] [:error] [pid 15100:tid 15164] [client 212.104.214.238:19477] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHSHUOEbzcINan_ctLAXAAAAEQ"]
[Sat Feb 28 01:20:37.339018 2026] [:error] [pid 15240:tid 15259] [client 212.104.214.238:16394] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHSZS1iKL_41Rk9A9N0hwAAABE"]
[Sat Feb 28 01:21:46.839564 2026] [:error] [pid 38586:tid 38590] [client 212.104.214.238:41777] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHSqr_i6nvKNhjFW7VBrwAAAQE"]
[Sat Feb 28 01:22:51.307098 2026] [:error] [pid 38620:tid 38627] [client 212.104.214.238:61534] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHS6wP6I7SRqrhh7RoGDwAAAUU"]
[Sat Feb 28 01:24:00.978188 2026] [:error] [pid 38620:tid 38624] [client 212.104.214.238:21781] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHTMAP6I7SRqrhh7RoH3QAAAUI"]
[Sat Feb 28 01:25:07.963626 2026] [:error] [pid 15240:tid 15259] [client 212.104.214.238:19547] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHTcy1iKL_41Rk9A9N5KQAAABE"]
[Sat Feb 28 01:26:09.706365 2026] [:error] [pid 38620:tid 38642] [client 212.104.214.238:56111] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHTsQP6I7SRqrhh7RoL9AAAAVQ"]
[Sat Feb 28 01:27:12.246662 2026] [:error] [pid 15240:tid 15245] [client 212.104.214.238:22226] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHT8C1iKL_41Rk9A9N6lQAAAAM"]
[Sat Feb 28 01:28:15.739121 2026] [:error] [pid 15098:tid 15122] [client 212.104.214.238:40142] [client 212.104.214.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.104.214.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHUL8kFqny8dQQbmTkmZwAAAJA"]
[Sat Feb 28 02:32:14.284738 2026] [:error] [pid 15100:tid 15175] [client 74.244.87.95:27077] [client 74.244.87.95] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaHjLkOEbzcINan_ctLfRAAAAE8"]
[Sat Feb 28 02:34:08.680983 2026] [:error] [pid 38586:tid 38612] [client 74.244.87.95:44891] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHjoL_i6nvKNhjFW7V5DAAAARc"]
[Sat Feb 28 02:36:51.529243 2026] [:error] [pid 38620:tid 38626] [client 74.244.87.95:31097] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHkQwP6I7SRqrhh7RpXsAAAAUQ"]
[Sat Feb 28 02:39:15.643948 2026] [:error] [pid 15099:tid 15145] [client 74.244.87.95:59349] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHk0-nvP2vtPjYDq_hNAgAAAMw"]
[Sat Feb 28 02:41:07.926938 2026] [:error] [pid 15098:tid 15127] [client 74.244.87.95:57815] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHlQ8kFqny8dQQbmTk5UwAAAJU"]
[Sat Feb 28 02:43:00.748265 2026] [:error] [pid 38586:tid 38598] [client 74.244.87.95:28612] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHltL_i6nvKNhjFW7V-9wAAAQk"]
[Sat Feb 28 02:45:40.456971 2026] [:error] [pid 38620:tid 38631] [client 74.244.87.95:4149] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHmVAP6I7SRqrhh7RpfxwAAAUk"]
[Sat Feb 28 02:47:54.529822 2026] [:error] [pid 38620:tid 38630] [client 74.244.87.95:11941] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHm2gP6I7SRqrhh7RphxQAAAUg"]
[Sat Feb 28 02:49:55.480275 2026] [:error] [pid 38620:tid 38622] [client 74.244.87.95:26909] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHnUwP6I7SRqrhh7RpkaAAAAUA"]
[Sat Feb 28 02:52:14.163232 2026] [:error] [pid 38620:tid 38634] [client 74.244.87.95:38084] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHn3gP6I7SRqrhh7RpnCgAAAUw"]
[Sat Feb 28 02:53:58.513049 2026] [:error] [pid 15098:tid 15116] [client 74.244.87.95:2208] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHoRskFqny8dQQbmTk8ugAAAIo"]
[Sat Feb 28 02:55:21.522287 2026] [:error] [pid 19669:tid 19680] [client 37.77.150.123:49316] [client 37.77.150.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.77.150.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaHomUy98E5mX0pQrMo4tQAAAYg"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 28 02:55:27.584505 2026] [:error] [pid 15098:tid 15112] [client 37.77.150.123:63379] [client 37.77.150.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.77.150.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaHon8kFqny8dQQbmTk88gAAAIY"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 28 02:55:28.219261 2026] [:error] [pid 15098:tid 15120] [client 74.244.87.95:54140] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHooMkFqny8dQQbmTk89gAAAI4"]
[Sat Feb 28 02:57:02.117044 2026] [:error] [pid 15240:tid 15263] [client 74.244.87.95:26966] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHo_i1iKL_41Rk9A9OoswAAABU"]
[Sat Feb 28 02:58:09.354412 2026] [:error] [pid 38586:tid 38593] [client 74.244.87.95:35046] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHpQb_i6nvKNhjFW7WIrAAAAQQ"]
[Sat Feb 28 02:59:29.517528 2026] [:error] [pid 20709:tid 20711] [client 74.244.87.95:12947] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHpkU5CnHafo7s0kbTXiQAAAcA"]
[Sat Feb 28 03:00:43.852089 2026] [:error] [pid 38586:tid 38597] [client 74.244.87.95:45807] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHp27_i6nvKNhjFW7WLrgAAAQg"]
[Sat Feb 28 03:02:02.421349 2026] [:error] [pid 15098:tid 15105] [client 74.244.87.95:49439] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHqKskFqny8dQQbmTk9ywAAAIA"]
[Sat Feb 28 03:03:09.852117 2026] [:error] [pid 19669:tid 19675] [client 74.244.87.95:48497] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHqbUy98E5mX0pQrMo-bgAAAYM"]
[Sat Feb 28 03:04:20.626328 2026] [:error] [pid 38586:tid 38595] [client 74.244.87.95:28466] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHqtL_i6nvKNhjFW7WP_gAAAQY"]
[Sat Feb 28 03:05:26.175684 2026] [:error] [pid 20709:tid 20721] [client 74.244.87.95:47944] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHq9k5CnHafo7s0kbTb9gAAAco"]
[Sat Feb 28 03:06:27.955508 2026] [:error] [pid 15240:tid 15265] [client 74.244.87.95:50686] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHrMy1iKL_41Rk9A9OscwAAABc"]
[Sat Feb 28 03:07:33.432850 2026] [:error] [pid 19669:tid 19680] [client 74.244.87.95:3745] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHrdUy98E5mX0pQrMpDZAAAAYg"]
[Sat Feb 28 03:08:46.287165 2026] [:error] [pid 38620:tid 38623] [client 74.244.87.95:6962] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHrvgP6I7SRqrhh7RpwGQAAAUE"]
[Sat Feb 28 03:09:54.329968 2026] [:error] [pid 15240:tid 15254] [client 74.244.87.95:46263] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHsAi1iKL_41Rk9A9OtWQAAAAw"]
[Sat Feb 28 03:11:01.867954 2026] [:error] [pid 20709:tid 20714] [client 74.244.87.95:40100] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHsRU5CnHafo7s0kbTf-gAAAcM"]
[Sat Feb 28 03:12:05.572359 2026] [:error] [pid 38586:tid 38603] [client 74.244.87.95:32561] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHshb_i6nvKNhjFW7WZggAAAQ4"]
[Sat Feb 28 03:13:13.831513 2026] [:error] [pid 20709:tid 20727] [client 74.244.87.95:9567] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHsyU5CnHafo7s0kbThQAAAAdA"]
[Sat Feb 28 03:14:25.831082 2026] [:error] [pid 38586:tid 38604] [client 74.244.87.95:34655] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHtEb_i6nvKNhjFW7Wb9wAAAQ8"]
[Sat Feb 28 03:15:29.599281 2026] [:error] [pid 20709:tid 20729] [client 74.244.87.95:52936] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHtUU5CnHafo7s0kbTiKgAAAdI"]
[Sat Feb 28 03:16:29.744245 2026] [:error] [pid 38586:tid 38608] [client 74.244.87.95:12476] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHtjb_i6nvKNhjFW7WdwgAAARM"]
[Sat Feb 28 03:17:34.194558 2026] [:error] [pid 15099:tid 15135] [client 74.244.87.95:8248] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHtzunvP2vtPjYDq_hVMQAAAMI"]
[Sat Feb 28 03:18:29.556409 2026] [:error] [pid 38586:tid 38599] [client 74.244.87.95:54674] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHuBb_i6nvKNhjFW7WfZQAAAQo"]
[Sat Feb 28 03:19:33.567167 2026] [:error] [pid 20709:tid 20730] [client 74.244.87.95:57383] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHuRU5CnHafo7s0kbTjxwAAAdM"]
[Sat Feb 28 03:20:34.504918 2026] [:error] [pid 38620:tid 38628] [client 74.244.87.95:62828] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHuggP6I7SRqrhh7Rp0jQAAAUY"]
[Sat Feb 28 03:21:38.138278 2026] [:error] [pid 38586:tid 38604] [client 74.244.87.95:49562] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHuwr_i6nvKNhjFW7WhnQAAAQ8"]
[Sat Feb 28 03:22:30.232509 2026] [:error] [pid 19669:tid 19686] [client 74.244.87.95:41592] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHu9ky98E5mX0pQrMpNGQAAAY4"]
[Sat Feb 28 03:23:32.575042 2026] [:error] [pid 15099:tid 15139] [client 74.244.87.95:54751] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHvNOnvP2vtPjYDq_hWjwAAAMY"]
[Sat Feb 28 03:24:30.286471 2026] [:error] [pid 20709:tid 20722] [client 74.244.87.95:42520] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHvbk5CnHafo7s0kbTmIwAAAcs"]
[Sat Feb 28 03:25:40.808129 2026] [:error] [pid 19669:tid 19672] [client 74.244.87.95:38573] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHvtEy98E5mX0pQrMpPbwAAAYA"]
[Sat Feb 28 03:26:44.836839 2026] [:error] [pid 38620:tid 38644] [client 74.244.87.95:13887] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHv9AP6I7SRqrhh7Rp2bAAAAVY"]
[Sat Feb 28 03:27:48.284054 2026] [:error] [pid 38586:tid 38591] [client 74.244.87.95:59241] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHwNL_i6nvKNhjFW7Wm9QAAAQI"]
[Sat Feb 28 03:28:47.760404 2026] [:error] [pid 38586:tid 38609] [client 74.244.87.95:32777] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHwb7_i6nvKNhjFW7WoLgAAARQ"]
[Sat Feb 28 03:29:44.690703 2026] [:error] [pid 15240:tid 15265] [client 74.244.87.95:40333] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHwqC1iKL_41Rk9A9OzKgAAABc"]
[Sat Feb 28 03:30:43.120798 2026] [:error] [pid 20709:tid 20718] [client 74.244.87.95:30432] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHw405CnHafo7s0kbTpEQAAAcc"]
[Sat Feb 28 03:31:43.185905 2026] [:error] [pid 19669:tid 19691] [client 74.244.87.95:30770] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHxH0y98E5mX0pQrMpUewAAAZM"]
[Sat Feb 28 03:32:46.174809 2026] [:error] [pid 19669:tid 19687] [client 74.244.87.95:5633] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHxXky98E5mX0pQrMpU8wAAAY8"]
[Sat Feb 28 03:33:43.704516 2026] [:error] [pid 19669:tid 19689] [client 74.244.87.95:37622] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHxl0y98E5mX0pQrMpVnQAAAZE"]
[Sat Feb 28 03:34:43.443929 2026] [:error] [pid 19669:tid 19695] [client 74.244.87.95:39229] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHx00y98E5mX0pQrMpWUAAAAZc"]
[Sat Feb 28 03:35:52.995691 2026] [:error] [pid 33723:tid 33733] [client 74.244.87.95:49178] [client 74.244.87.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.244.87.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaHyGFhQrWqxbeNSs4aJYwAAAAQ"]
[Sat Feb 28 03:59:16.099647 2026] [:error] [pid 39185:tid 39268] [client 186.243.24.92:47941] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH3lBVE-FfM89u7BQb8rAAAAJY"]
[Sat Feb 28 04:02:36.138906 2026] [:error] [pid 39292:tid 39304] [client 186.243.24.92:47504] [client 186.243.24.92] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaH4XKIAO5fN7BxyqcHVqQAAAMo"]
[Sat Feb 28 04:04:01.563061 2026] [:error] [pid 39185:tid 39269] [client 186.243.24.92:48917] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH4sRVE-FfM89u7BQYBGgAAAJc"]
[Sat Feb 28 04:04:11.766109 2026] [:error] [pid 39184:tid 39220] [client 20.151.224.126:4965] [client 20.151.224.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.151.224.126, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaH4u1tZF9Zd_U7easD-ywAAAEE"]
[Sat Feb 28 04:05:23.783572 2026] [:error] [pid 39292:tid 39300] [client 186.243.24.92:45639] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH5A6IAO5fN7BxyqcHZLAAAAMY"]
[Sat Feb 28 04:06:25.717956 2026] [:error] [pid 39183:tid 39196] [client 20.151.224.126:4293] [client 20.151.224.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.151.224.126, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaH5QRCf4HvhVePw3LY70AAAAAQ"]
[Sat Feb 28 04:06:41.150549 2026] [:error] [pid 39185:tid 39247] [client 186.243.24.92:48899] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH5URVE-FfM89u7BQYDiQAAAIE"]
[Sat Feb 28 04:06:41.156141 2026] [:error] [pid 39185:tid 39247] [client 186.243.24.92:48899] [client 186.243.24.92] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1adminadmin2025%wppass_u%title0x053afc5bdescription0x053afc5bmt_keywords0x053afc5bmt_excerpt0x053afc5b1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH5URVE-FfM89u7BQYDiQAAAIE"]
[Sat Feb 28 04:08:01.731017 2026] [:error] [pid 39185:tid 39257] [client 186.243.24.92:46275] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH5oRVE-FfM89u7BQYE-gAAAIs"]
[Sat Feb 28 04:09:18.178787 2026] [:error] [pid 39185:tid 39253] [client 186.243.24.92:48516] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH57hVE-FfM89u7BQYGJQAAAIc"]
[Sat Feb 28 04:10:39.410736 2026] [:error] [pid 39185:tid 39265] [client 186.243.24.92:49301] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH6PxVE-FfM89u7BQYHHwAAAJM"]
[Sat Feb 28 04:10:39.413896 2026] [:error] [pid 39185:tid 39265] [client 186.243.24.92:49301] [client 186.243.24.92] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1adminadmin$%wppass_u%title0xb8aeab68description0xb8aeab68mt_keywords0xb8aeab68mt_excerpt0xb8aeab681"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH6PxVE-FfM89u7BQYHHwAAAJM"]
[Sat Feb 28 04:11:50.069506 2026] [:error] [pid 39183:tid 39195] [client 186.243.24.92:45483] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH6hhCf4HvhVePw3LY_KQAAAAM"]
[Sat Feb 28 04:13:09.737331 2026] [:error] [pid 39183:tid 39213] [client 186.243.24.92:46439] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH61RCf4HvhVePw3LY_9gAAABU"]
[Sat Feb 28 04:14:31.084235 2026] [:error] [pid 39292:tid 39297] [client 186.243.24.92:47326] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH7J6IAO5fN7BxyqcHkgAAAAMM"]
[Sat Feb 28 04:15:54.748280 2026] [:error] [pid 39292:tid 39301] [client 186.243.24.92:48651] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH7eqIAO5fN7BxyqcHmXwAAAMc"]
[Sat Feb 28 04:17:10.354863 2026] [:error] [pid 39185:tid 39260] [client 186.243.24.92:49254] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH7xhVE-FfM89u7BQYNAwAAAI4"]
[Sat Feb 28 04:17:10.358266 2026] [:error] [pid 39185:tid 39260] [client 186.243.24.92:49254] [client 186.243.24.92] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1adminadmin%wppass_u%title0xe6a4f9eadescription0xe6a4f9eamt_keywords0xe6a4f9eamt_excerpt0xe6a4f9ea1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH7xhVE-FfM89u7BQYNAwAAAI4"]
[Sat Feb 28 04:18:26.526706 2026] [:error] [pid 39184:tid 39220] [client 186.243.24.92:49243] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH8EltZF9Zd_U7easAJ0wAAAEE"]
[Sat Feb 28 04:19:39.651659 2026] [:error] [pid 39184:tid 39232] [client 186.243.24.92:47165] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH8W1tZF9Zd_U7easAKWgAAAE0"]
[Sat Feb 28 04:19:39.656467 2026] [:error] [pid 39184:tid 39232] [client 186.243.24.92:47165] [client 186.243.24.92] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1adminadmin*0%wppass_u%title0xecca559bdescription0xecca559bmt_keywords0xecca559bmt_excerpt0xecca559b1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH8W1tZF9Zd_U7easAKWgAAAE0"]
[Sat Feb 28 04:21:01.604619 2026] [:error] [pid 39183:tid 39192] [client 186.243.24.92:48019] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH8rRCf4HvhVePw3LZFIQAAAAA"]
[Sat Feb 28 04:22:09.547712 2026] [:error] [pid 39292:tid 39304] [client 186.243.24.92:48197] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH88aIAO5fN7BxyqcHtewAAAMo"]
[Sat Feb 28 04:22:09.550311 2026] [:error] [pid 39292:tid 39304] [client 186.243.24.92:48197] [client 186.243.24.92] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH88aIAO5fN7BxyqcHtewAAAMo"]
[Sat Feb 28 04:22:09.551870 2026] [:error] [pid 39292:tid 39304] [client 186.243.24.92:48197] [client 186.243.24.92] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH88aIAO5fN7BxyqcHtewAAAMo"]
[Sat Feb 28 04:23:24.705143 2026] [:error] [pid 39183:tid 39206] [client 186.243.24.92:49042] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH9PBCf4HvhVePw3LZGpAAAAA4"]
[Sat Feb 28 04:24:44.015509 2026] [:error] [pid 39185:tid 39248] [client 186.243.24.92:45840] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH9jBVE-FfM89u7BQYTWgAAAII"]
[Sat Feb 28 04:26:00.997086 2026] [:error] [pid 39184:tid 39230] [client 186.243.24.92:46602] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH92FtZF9Zd_U7easAOOwAAAEs"]
[Sat Feb 28 04:26:01.004157 2026] [:error] [pid 39184:tid 39230] [client 186.243.24.92:46602] [client 186.243.24.92] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1adminexpressinteriors@%wppass_d%title0x7e31f690description0x7e31f690mt_keywords0x7e31f690mt_excerpt0x7e31f6901"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH92FtZF9Zd_U7easAOOwAAAEs"]
[Sat Feb 28 04:26:26.801458 2026] [:error] [pid 11791:tid 11805] [client 64.89.163.69:58534] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaH98muX5e1Q32gqxH1RpAAAAQw"]
[Sat Feb 28 04:26:26.802667 2026] [:error] [pid 11791:tid 11816] [client 64.89.163.69:58519] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aaH98muX5e1Q32gqxH1RpQAAARc"], referer: www.google.com
[Sat Feb 28 04:26:26.805494 2026] [:error] [pid 11791:tid 11802] [client 64.89.163.69:58522] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-plain.php"] [unique_id "aaH98muX5e1Q32gqxH1RpgAAAQk"], referer: www.google.com
[Sat Feb 28 04:26:26.812596 2026] [:error] [pid 11791:tid 11809] [client 64.89.163.69:58531] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aaH98muX5e1Q32gqxH1RpwAAARA"], referer: www.google.com
[Sat Feb 28 04:26:27.279245 2026] [:error] [pid 11791:tid 11806] [client 64.89.163.69:59880] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaH982uX5e1Q32gqxH1RxwAAAQ0"]
[Sat Feb 28 04:26:27.280361 2026] [:error] [pid 11791:tid 11816] [client 64.89.163.69:59894] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aaH982uX5e1Q32gqxH1RyAAAARc"], referer: www.google.com
[Sat Feb 28 04:26:27.284011 2026] [:error] [pid 11791:tid 11807] [client 64.89.163.69:59895] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-plain.php"] [unique_id "aaH982uX5e1Q32gqxH1RygAAAQ4"], referer: www.google.com
[Sat Feb 28 04:26:27.288292 2026] [:error] [pid 39183:tid 39216] [client 64.89.163.69:59904] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aaH98xCf4HvhVePw3LZIpAAAABg"], referer: www.google.com
[Sat Feb 28 04:26:27.757029 2026] [:error] [pid 39185:tid 39268] [client 64.89.163.69:60630] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aaH98xVE-FfM89u7BQYU8gAAAJY"], referer: www.google.com
[Sat Feb 28 04:26:27.760239 2026] [:error] [pid 39183:tid 39204] [client 64.89.163.69:60636] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaH98xCf4HvhVePw3LZIqgAAAAw"]
[Sat Feb 28 04:26:27.767683 2026] [:error] [pid 39292:tid 39308] [client 64.89.163.69:60640] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-plain.php"] [unique_id "aaH986IAO5fN7BxyqcHynQAAAM4"], referer: www.google.com
[Sat Feb 28 04:26:27.767683 2026] [:error] [pid 39185:tid 39247] [client 64.89.163.69:60642] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aaH98xVE-FfM89u7BQYU8wAAAIE"], referer: www.google.com
[Sat Feb 28 04:26:28.265014 2026] [:error] [pid 39185:tid 39250] [client 64.89.163.69:61609] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aaH99BVE-FfM89u7BQYU_QAAAIQ"], referer: www.google.com
[Sat Feb 28 04:26:28.266520 2026] [:error] [pid 39185:tid 39254] [client 64.89.163.69:61651] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aaH99BVE-FfM89u7BQYU_gAAAIg"], referer: www.google.com
[Sat Feb 28 04:26:28.268860 2026] [:error] [pid 39185:tid 39260] [client 64.89.163.69:61635] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-plain.php"] [unique_id "aaH99BVE-FfM89u7BQYU_wAAAI4"], referer: www.google.com
[Sat Feb 28 04:26:28.270655 2026] [:error] [pid 39185:tid 39269] [client 64.89.163.69:61649] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaH99BVE-FfM89u7BQYVAAAAAJc"]
[Sat Feb 28 04:26:28.743188 2026] [:error] [pid 39185:tid 39263] [client 64.89.163.69:62429] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aaH99BVE-FfM89u7BQYVHAAAAJE"], referer: www.google.com
[Sat Feb 28 04:26:28.744276 2026] [:error] [pid 39185:tid 39258] [client 64.89.163.69:62431] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aaH99BVE-FfM89u7BQYVHQAAAIw"], referer: www.google.com
[Sat Feb 28 04:26:28.745640 2026] [:error] [pid 39185:tid 39250] [client 64.89.163.69:62432] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-plain.php"] [unique_id "aaH99BVE-FfM89u7BQYVIAAAAIQ"], referer: www.google.com
[Sat Feb 28 04:26:28.753991 2026] [:error] [pid 39185:tid 39254] [client 64.89.163.69:62436] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaH99BVE-FfM89u7BQYVIQAAAIg"]
[Sat Feb 28 04:26:29.733314 2026] [:error] [pid 11791:tid 11805] [client 64.89.163.69:63381] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aaH99WuX5e1Q32gqxH1SGgAAAQw"], referer: www.google.com
[Sat Feb 28 04:26:29.754103 2026] [:error] [pid 11791:tid 11810] [client 64.89.163.69:63384] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aaH99WuX5e1Q32gqxH1SGwAAARE"], referer: www.google.com
[Sat Feb 28 04:26:30.698338 2026] [:error] [pid 39185:tid 39269] [client 64.89.163.69:65370] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aaH99hVE-FfM89u7BQYVXAAAAJc"], referer: www.google.com
[Sat Feb 28 04:26:30.714730 2026] [:error] [pid 39185:tid 39262] [client 64.89.163.69:65408] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aaH99hVE-FfM89u7BQYVXQAAAJA"], referer: www.google.com
[Sat Feb 28 04:26:31.656628 2026] [:error] [pid 39185:tid 39254] [client 64.89.163.69:50742] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aaH99xVE-FfM89u7BQYVfwAAAIg"], referer: www.google.com
[Sat Feb 28 04:26:31.670032 2026] [:error] [pid 11791:tid 11796] [client 64.89.163.69:50778] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aaH992uX5e1Q32gqxH1STwAAAQM"], referer: www.google.com
[Sat Feb 28 04:26:32.615964 2026] [:error] [pid 39183:tid 39198] [client 64.89.163.69:52546] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aaH9-BCf4HvhVePw3LZIywAAAAY"], referer: www.google.com
[Sat Feb 28 04:26:32.624075 2026] [:error] [pid 39184:tid 39240] [client 64.89.163.69:52603] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aaH9-FtZF9Zd_U7easAOggAAAFU"], referer: www.google.com
[Sat Feb 28 04:26:33.586696 2026] [:error] [pid 39292:tid 39304] [client 64.89.163.69:55278] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "aaH9-aIAO5fN7BxyqcHy3gAAAMo"], referer: www.google.com
[Sat Feb 28 04:26:33.586956 2026] [:error] [pid 39292:tid 39299] [client 64.89.163.69:55282] [client 64.89.163.69] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "aaH9-aIAO5fN7BxyqcHy3wAAAMU"], referer: www.google.com
[Sat Feb 28 04:27:12.077529 2026] [:error] [pid 39184:tid 39237] [client 186.243.24.92:47186] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH-IFtZF9Zd_U7easAOzwAAAFI"]
[Sat Feb 28 04:28:24.384251 2026] [:error] [pid 11791:tid 11800] [client 186.243.24.92:46047] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH-aGuX5e1Q32gqxH1U8QAAAQc"]
[Sat Feb 28 04:29:48.589124 2026] [:error] [pid 39184:tid 39237] [client 186.243.24.92:48254] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH-vFtZF9Zd_U7easAQNQAAAFI"]
[Sat Feb 28 04:31:00.180016 2026] [:error] [pid 11791:tid 11816] [client 186.243.24.92:45577] [client 186.243.24.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.243.24.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaH_BGuX5e1Q32gqxH1YywAAARc"]
[Sat Feb 28 05:01:37.667532 2026] [:error] [pid 39185:tid 39255] [client 20.220.144.87:15706] [client 20.220.144.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.220.144.87, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaIGMRVE-FfM89u7BQYoWwAAAIk"]
[Sat Feb 28 05:01:40.051404 2026] [:error] [pid 39185:tid 39246] [client 20.220.144.87:15706] [client 20.220.144.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.220.144.87, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaIGNBVE-FfM89u7BQYoYQAAAIA"]
[Sat Feb 28 05:02:16.310523 2026] [:error] [pid 11791:tid 11794] [client 122.51.236.174:35666] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaIGWGuX5e1Q32gqxH15bQAAAQE"]
[Sat Feb 28 05:15:41.960742 2026] [:error] [pid 11791:tid 11810] [client 20.220.144.87:33789] [client 20.220.144.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaIJfWuX5e1Q32gqxH2BVAAAARE"]
[Sat Feb 28 05:15:42.370281 2026] [:error] [pid 22194:tid 22200] [client 20.220.144.87:33765] [client 20.220.144.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaIJfn6mbajs3bzQGyvKVgAAAUQ"]
[Sat Feb 28 05:15:42.779830 2026] [:error] [pid 22194:tid 22197] [client 20.220.144.87:33747] [client 20.220.144.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaIJfn6mbajs3bzQGyvKWQAAAUE"]
[Sat Feb 28 05:15:43.187613 2026] [:error] [pid 22194:tid 22198] [client 20.220.144.87:33681] [client 20.220.144.87] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaIJf36mbajs3bzQGyvKXAAAAUI"]
[Sat Feb 28 05:41:25.759152 2026] [:error] [pid 11791:tid 11798] [client 170.106.15.3:52554] [client 170.106.15.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaIPhWuX5e1Q32gqxH2PdAAAAQU"]
[Sat Feb 28 06:29:55.209254 2026] [:error] [pid 39183:tid 39200] [client 20.205.120.43:22775] [client 20.205.120.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Cookie/cloud.php"] [unique_id "aaIa4xCf4HvhVePw3LZu7AAAAAg"]
[Sat Feb 28 06:29:57.674351 2026] [:error] [pid 39183:tid 39197] [client 20.205.120.43:19582] [client 20.205.120.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/functions.php"] [unique_id "aaIa5RCf4HvhVePw3LZu8gAAAAU"]
[Sat Feb 28 06:30:00.840363 2026] [:error] [pid 39292:tid 39301] [client 20.205.120.43:22662] [client 20.205.120.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/flower.php"] [unique_id "aaIa6KIAO5fN7BxyqcFncgAAAMc"]
[Sat Feb 28 06:30:03.230665 2026] [:error] [pid 39292:tid 39307] [client 20.205.120.43:23210] [client 20.205.120.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/block-bindings.php"] [unique_id "aaIa66IAO5fN7BxyqcFnfwAAAM0"]
[Sat Feb 28 06:30:03.789476 2026] [:error] [pid 11791:tid 11803] [client 20.205.120.43:20287] [client 20.205.120.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Content/root.php"] [unique_id "aaIa62uX5e1Q32gqxH2p8AAAAQo"]
[Sat Feb 28 06:30:04.272563 2026] [proxy_fcgi:error] [pid 39292:tid 39300] [client 20.205.120.43:22758] AH01071: Got error 'Primary script unknown'
[Sat Feb 28 06:30:04.424698 2026] [:error] [pid 39292:tid 39311] [client 20.205.120.43:22758] [client 20.205.120.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/index.php"] [unique_id "aaIa7KIAO5fN7BxyqcFnhgAAANE"]
[Sat Feb 28 06:30:04.959841 2026] [:error] [pid 39292:tid 39294] [client 20.205.120.43:23212] [client 20.205.120.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aaIa7KIAO5fN7BxyqcFniQAAAMA"]
[Sat Feb 28 06:30:05.498491 2026] [:error] [pid 22194:tid 22208] [client 20.205.120.43:34802] [client 20.205.120.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aaIa7X6mbajs3bzQGysA6wAAAUw"]
[Sat Feb 28 06:30:06.053758 2026] [:error] [pid 39292:tid 39296] [client 20.205.120.43:9462] [client 20.205.120.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "aaIa7qIAO5fN7BxyqcFnjQAAAMI"]
[Sat Feb 28 06:57:07.644167 2026] [:error] [pid 39183:tid 39202] [client 14.232.109.153:38688] [client 14.232.109.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 14.232.109.153, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaIhQxCf4HvhVePw3LZ0rwAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Sat Feb 28 06:57:09.351562 2026] [:error] [pid 39183:tid 39200] [client 14.232.109.153:38688] [client 14.232.109.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 14.232.109.153, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaIhRRCf4HvhVePw3LZ0swAAAAg"], referer: https://clinic.funke-medical.de/wp-login.php
[Sat Feb 28 07:46:18.946313 2026] [:error] [pid 22194:tid 22220] [client 65.52.66.14:47813] [client 65.52.66.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaIsyn6mbajs3bzQGys2hAAAAVg"]
[Sat Feb 28 07:46:20.051304 2026] [:error] [pid 39292:tid 39304] [client 65.52.66.14:48967] [client 65.52.66.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaIszKIAO5fN7BxyqcG2GgAAAMo"]
[Sat Feb 28 07:46:20.936315 2026] [:error] [pid 39292:tid 39307] [client 65.52.66.14:53297] [client 65.52.66.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaIszKIAO5fN7BxyqcG2JQAAAM0"]
[Sat Feb 28 07:46:22.111134 2026] [:error] [pid 39292:tid 39318] [client 65.52.66.14:38422] [client 65.52.66.14] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaIszqIAO5fN7BxyqcG2NAAAANg"]
[Sat Feb 28 08:33:32.960234 2026] [:error] [pid 11791:tid 11798] [client 109.245.227.81:32271] [client 109.245.227.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.245.227.81, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaI33GuX5e1Q32gqxH356QAAAQU"]
[Sat Feb 28 08:41:44.788255 2026] [:error] [pid 39292:tid 39307] [client 20.220.61.156:15318] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaI5yKIAO5fN7BxyqcEjBQAAAM0"]
[Sat Feb 28 08:41:45.363466 2026] [:error] [pid 39185:tid 39252] [client 20.220.61.156:15329] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaI5yRVE-FfM89u7BQaXLAAAAIY"]
[Sat Feb 28 08:41:46.349334 2026] [:error] [pid 39183:tid 39202] [client 20.220.61.156:15315] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaI5yhCf4HvhVePw3LaauQAAAAo"]
[Sat Feb 28 08:41:47.032785 2026] [:error] [pid 39183:tid 39212] [client 20.220.61.156:15326] [client 20.220.61.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaI5yxCf4HvhVePw3LaawwAAABQ"]
[Sat Feb 28 08:59:03.619411 2026] [:error] [pid 22194:tid 22211] [client 173.244.55.23:45889] [client 173.244.55.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aaI9136mbajs3bzQGyvJzgAAAU8"]
[Sat Feb 28 08:59:11.121947 2026] [:error] [pid 39183:tid 39202] [client 173.244.55.29:62291] [client 173.244.55.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "aaI93xCf4HvhVePw3LawjQAAAAo"]
[Sat Feb 28 08:59:19.828923 2026] [:error] [pid 39292:tid 39300] [client 173.244.55.22:22817] [client 173.244.55.22] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aaI956IAO5fN7BxyqcFTkwAAAMY"]
[Sat Feb 28 08:59:36.631317 2026] [:error] [pid 22194:tid 22197] [client 173.244.55.31:27267] [client 173.244.55.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/robots.php"] [unique_id "aaI9-H6mbajs3bzQGyvLbgAAAUE"]
[Sat Feb 28 08:59:50.937041 2026] [:error] [pid 39184:tid 39225] [client 173.244.55.28:32883] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file5.php"] [unique_id "aaI-BltZF9Zd_U7easCVpgAAAEY"]
[Sat Feb 28 09:00:17.130728 2026] [:error] [pid 39183:tid 39199] [client 173.244.55.22:30505] [client 173.244.55.22] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/bootstrap.php"] [unique_id "aaI-IRCf4HvhVePw3LazGgAAAAc"]
[Sat Feb 28 09:00:26.013748 2026] [:error] [pid 39292:tid 39295] [client 173.244.55.21:39927] [client 173.244.55.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/pridmag/db.php"] [unique_id "aaI-KqIAO5fN7BxyqcFWkQAAAME"]
[Sat Feb 28 09:00:33.961773 2026] [:error] [pid 22194:tid 22212] [client 173.244.55.28:46699] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/bn_1_1754420677.phtml"] [unique_id "aaI-MX6mbajs3bzQGyvOHQAAAVA"]
[Sat Feb 28 09:00:34.846723 2026] [:error] [pid 39292:tid 39294] [client 173.244.55.28:54723] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/uploads/bn_1_1754420677.phtml"] [unique_id "aaI-MqIAO5fN7BxyqcFW4gAAAMA"]
[Sat Feb 28 09:00:40.445741 2026] [:error] [pid 22194:tid 22218] [client 173.244.55.29:42729] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aaI-OH6mbajs3bzQGyvORwAAAVY"]
[Sat Feb 28 09:00:48.087716 2026] [:error] [pid 11791:tid 11813] [client 173.244.55.29:34453] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aaI-QGuX5e1Q32gqxH1iYwAAARQ"]
[Sat Feb 28 09:00:53.797617 2026] [:error] [pid 22194:tid 22200] [client 173.244.55.21:36913] [client 173.244.55.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aaI-RX6mbajs3bzQGyvO7AAAAUQ"]
[Sat Feb 28 09:00:59.303084 2026] [:error] [pid 39183:tid 39194] [client 173.244.55.25:38935] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aaI-SxCf4HvhVePw3La0NAAAAAI"]
[Sat Feb 28 09:01:05.189328 2026] [:error] [pid 39292:tid 39302] [client 173.244.55.25:41439] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aaI-UaIAO5fN7BxyqcFYdwAAAMg"]
[Sat Feb 28 09:01:11.301581 2026] [:error] [pid 22194:tid 22198] [client 173.244.55.21:37025] [client 173.244.55.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/classwithtostring.php"] [unique_id "aaI-V36mbajs3bzQGyvQZAAAAUI"]
[Sat Feb 28 09:01:12.191425 2026] [:error] [pid 39292:tid 39316] [client 173.244.55.31:36615] [client 173.244.55.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/classwithtostring.php"] [unique_id "aaI-WKIAO5fN7BxyqcFY0QAAANY"]
[Sat Feb 28 09:01:17.369301 2026] [:error] [pid 39292:tid 39298] [client 173.244.55.25:38309] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aaI-XaIAO5fN7BxyqcFZJQAAAMQ"]
[Sat Feb 28 09:01:20.053266 2026] [:error] [pid 22194:tid 22209] [client 173.244.55.29:25423] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aaI-YH6mbajs3bzQGyvQ3QAAAU0"]
[Sat Feb 28 09:01:20.959610 2026] [:error] [pid 39184:tid 39237] [client 173.244.55.21:57581] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aaI-YFtZF9Zd_U7easCYUAAAAFI"]
[Sat Feb 28 09:01:21.838326 2026] [:error] [pid 11791:tid 11802] [client 173.244.55.25:29387] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aaI-YWuX5e1Q32gqxH1kkgAAAQk"]
[Sat Feb 28 09:01:22.714084 2026] [:error] [pid 11791:tid 11799] [client 173.244.55.29:43701] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aaI-YmuX5e1Q32gqxH1krgAAAQY"]
[Sat Feb 28 09:01:23.597788 2026] [:error] [pid 11791:tid 11809] [client 173.244.55.30:23493] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aaI-Y2uX5e1Q32gqxH1kvwAAARA"]
[Sat Feb 28 09:01:25.509504 2026] [:error] [pid 39185:tid 39249] [client 173.244.55.20:33609] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aaI-ZRVE-FfM89u7BQbBkwAAAIM"]
[Sat Feb 28 09:01:28.660880 2026] [:error] [pid 22194:tid 22199] [client 173.244.55.31:43049] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aaI-aH6mbajs3bzQGyvRdgAAAUM"]
[Sat Feb 28 09:01:32.911788 2026] [:error] [pid 39292:tid 39298] [client 173.244.55.26:24857] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aaI-bKIAO5fN7BxyqcFZowAAAMQ"]
[Sat Feb 28 09:01:35.039654 2026] [:error] [pid 22194:tid 22218] [client 173.244.55.29:64021] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aaI-b36mbajs3bzQGyvR0wAAAVY"]
[Sat Feb 28 09:01:37.743259 2026] [:error] [pid 11791:tid 11793] [client 173.244.55.25:32061] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aaI-cWuX5e1Q32gqxH1mBwAAAQA"]
[Sat Feb 28 09:01:39.672667 2026] [:error] [pid 39184:tid 39229] [client 173.244.55.30:53929] [client 173.244.55.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/network.php"] [unique_id "aaI-c1tZF9Zd_U7easCYgwAAAEo"]
[Sat Feb 28 09:01:43.818661 2026] [:error] [pid 11791:tid 11800] [client 173.244.55.29:26445] [client 173.244.55.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aaI-d2uX5e1Q32gqxH1mXQAAAQc"]
[Sat Feb 28 09:01:44.701354 2026] [:error] [pid 39185:tid 39263] [client 173.244.55.29:28509] [client 173.244.55.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aaI-eBVE-FfM89u7BQbCCgAAAJE"]
[Sat Feb 28 09:01:50.203214 2026] [:error] [pid 11791:tid 11795] [client 173.244.55.23:47823] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aaI-fmuX5e1Q32gqxH1m3wAAAQI"]
[Sat Feb 28 09:01:52.872687 2026] [:error] [pid 39183:tid 39213] [client 173.244.55.22:43205] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aaI-gBCf4HvhVePw3La1EwAAABU"]
[Sat Feb 28 09:01:57.078018 2026] [:error] [pid 39292:tid 39309] [client 173.244.55.28:48473] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/defaults.php"] [unique_id "aaI-haIAO5fN7BxyqcFazgAAAM8"]
[Sat Feb 28 09:01:57.982102 2026] [:error] [pid 39292:tid 39300] [client 173.244.55.30:56939] [client 173.244.55.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/DJP9.php"] [unique_id "aaI-haIAO5fN7BxyqcFa1wAAAMY"]
[Sat Feb 28 09:02:00.723580 2026] [:error] [pid 39183:tid 39203] [client 173.244.55.25:30985] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aaI-iBCf4HvhVePw3La1LwAAAAs"]
[Sat Feb 28 09:02:06.635700 2026] [:error] [pid 22194:tid 22199] [client 173.244.55.30:43919] [client 173.244.55.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/function/function.php"] [unique_id "aaI-jn6mbajs3bzQGyvS5wAAAUM"]
[Sat Feb 28 09:02:10.318332 2026] [:error] [pid 22194:tid 22205] [client 173.244.55.23:59735] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aaI-kn6mbajs3bzQGyvTKwAAAUk"]
[Sat Feb 28 09:02:13.166673 2026] [:error] [pid 11791:tid 11810] [client 173.244.55.22:59443] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aaI-lWuX5e1Q32gqxH1oSAAAARE"]
[Sat Feb 28 09:02:16.883265 2026] [:error] [pid 22194:tid 22220] [client 173.244.55.26:27641] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aaI-mH6mbajs3bzQGyvTmAAAAVg"]
[Sat Feb 28 09:02:17.756306 2026] [:error] [pid 39183:tid 39198] [client 173.244.55.28:47771] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aaI-mRCf4HvhVePw3La1VwAAAAY"]
[Sat Feb 28 09:02:18.639197 2026] [:error] [pid 39292:tid 39314] [client 173.244.55.20:38399] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaI-mqIAO5fN7BxyqcFbcAAAANQ"]
[Sat Feb 28 09:02:26.546692 2026] [:error] [pid 22194:tid 22206] [client 173.244.55.31:51531] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/info.php"] [unique_id "aaI-on6mbajs3bzQGyvT4AAAAUo"]
[Sat Feb 28 09:02:27.424344 2026] [:error] [pid 39185:tid 39252] [client 173.244.55.29:31147] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class.api.php"] [unique_id "aaI-oxVE-FfM89u7BQbC3AAAAIY"]
[Sat Feb 28 09:02:28.309457 2026] [:error] [pid 39185:tid 39251] [client 173.244.55.26:57767] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaI-pBVE-FfM89u7BQbC4QAAAIU"]
[Sat Feb 28 09:02:36.396561 2026] [:error] [pid 22194:tid 22204] [client 173.244.55.31:54913] [client 173.244.55.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/pki-validation/mariju.php"] [unique_id "aaI-rH6mbajs3bzQGyvUSAAAAUg"]
[Sat Feb 28 09:02:37.285883 2026] [:error] [pid 39292:tid 39306] [client 173.244.55.31:22709] [client 173.244.55.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/pki-validation/mariju.php"] [unique_id "aaI-raIAO5fN7BxyqcFcFgAAAMw"]
[Sat Feb 28 09:02:42.709958 2026] [:error] [pid 11791:tid 11794] [client 173.244.55.25:49791] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/admin.php"] [unique_id "aaI-smuX5e1Q32gqxH1qcgAAAQE"]
[Sat Feb 28 09:02:48.472506 2026] [:error] [pid 22194:tid 22217] [client 173.244.55.26:64597] [client 173.244.55.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aaI-uH6mbajs3bzQGyvU5wAAAVU"]
[Sat Feb 28 09:02:49.352206 2026] [:error] [pid 39184:tid 39230] [client 173.244.55.28:60873] [client 173.244.55.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aaI-uVtZF9Zd_U7easCZmwAAAEs"]
[Sat Feb 28 09:03:07.405741 2026] [:error] [pid 39184:tid 39222] [client 173.244.55.28:60873] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/product.php"] [unique_id "aaI-y1tZF9Zd_U7easCZ6AAAAEM"]
[Sat Feb 28 09:03:10.867407 2026] [:error] [pid 39185:tid 39248] [client 173.244.55.31:21331] [client 173.244.55.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/autoload_classmap.php"] [unique_id "aaI-zhVE-FfM89u7BQbDsgAAAII"]
[Sat Feb 28 09:03:15.218376 2026] [:error] [pid 39185:tid 39260] [client 173.244.55.28:63355] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aaI-0xVE-FfM89u7BQbD5AAAAI4"]
[Sat Feb 28 09:03:21.871565 2026] [:error] [pid 39184:tid 39231] [client 173.244.55.31:41433] [client 173.244.55.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aaI-2VtZF9Zd_U7easCaMwAAAEw"]
[Sat Feb 28 09:03:22.748127 2026] [:error] [pid 22194:tid 22212] [client 173.244.55.22:59161] [client 173.244.55.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aaI-2n6mbajs3bzQGyvWfAAAAVA"]
[Sat Feb 28 09:03:27.126476 2026] [:error] [pid 22194:tid 22199] [client 173.244.55.22:59161] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/item.php"] [unique_id "aaI-336mbajs3bzQGyvWsAAAAUM"]
[Sat Feb 28 09:03:33.632329 2026] [:error] [pid 22194:tid 22207] [client 173.244.55.25:38361] [client 173.244.55.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aaI-5X6mbajs3bzQGyvW9wAAAUs"]
[Sat Feb 28 09:03:38.989846 2026] [:error] [pid 39183:tid 39199] [client 173.244.55.29:28317] [client 173.244.55.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "aaI-6hCf4HvhVePw3La2QgAAAAc"]
[Sat Feb 28 09:03:41.898590 2026] [:error] [pid 11791:tid 11813] [client 173.244.55.26:23593] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aaI-7WuX5e1Q32gqxH1s5AAAARQ"]
[Sat Feb 28 09:04:04.266693 2026] [:error] [pid 11791:tid 11798] [client 173.244.55.20:65223] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aaI_BGuX5e1Q32gqxH1uAAAAAQU"]
[Sat Feb 28 09:04:09.901277 2026] [:error] [pid 39183:tid 39208] [client 173.244.55.28:57391] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aaI_CRCf4HvhVePw3La25QAAABA"]
[Sat Feb 28 09:04:19.364789 2026] [:error] [pid 39185:tid 39259] [client 173.244.55.23:64481] [client 173.244.55.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aaI_ExVE-FfM89u7BQbFcgAAAI0"]
[Sat Feb 28 09:04:21.497100 2026] [:error] [pid 39185:tid 39247] [client 173.244.55.23:64481] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aaI_FRVE-FfM89u7BQbFdQAAAIE"]
[Sat Feb 28 09:04:38.819342 2026] [:error] [pid 22194:tid 22202] [client 173.244.55.28:60859] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aaI_Jn6mbajs3bzQGyvZegAAAUY"]
[Sat Feb 28 09:04:39.715270 2026] [:error] [pid 22194:tid 22205] [client 173.244.55.28:52191] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aaI_J36mbajs3bzQGyvZfQAAAUk"]
[Sat Feb 28 09:04:40.591901 2026] [:error] [pid 11791:tid 11814] [client 173.244.55.28:27403] [client 173.244.55.28] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "aaI_KGuX5e1Q32gqxH1vwAAAARU"]
[Sat Feb 28 09:05:04.607224 2026] [:error] [pid 22194:tid 22202] [client 173.244.55.31:23907] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aaI_QH6mbajs3bzQGyvaOwAAAUY"]
[Sat Feb 28 09:05:10.988664 2026] [:error] [pid 11791:tid 11806] [client 173.244.55.30:50921] [client 173.244.55.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aaI_RmuX5e1Q32gqxH1xOQAAAQ0"]
[Sat Feb 28 09:05:20.669105 2026] [:error] [pid 11791:tid 11808] [client 173.244.55.30:50921] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aaI_UGuX5e1Q32gqxH1xgwAAAQ8"]
[Sat Feb 28 09:05:23.524399 2026] [:error] [pid 11791:tid 11810] [client 173.244.55.31:33535] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/infi.php"] [unique_id "aaI_U2uX5e1Q32gqxH1xrgAAARE"]
[Sat Feb 28 09:05:29.212012 2026] [:error] [pid 22194:tid 22212] [client 173.244.55.29:64059] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aaI_WX6mbajs3bzQGyvbEgAAAVA"]
[Sat Feb 28 09:05:37.654084 2026] [:error] [pid 11791:tid 11802] [client 173.244.55.20:34943] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aaI_YWuX5e1Q32gqxH1yQwAAAQk"]
[Sat Feb 28 09:05:38.529380 2026] [:error] [pid 39183:tid 39202] [client 173.244.55.23:57873] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aaI_YhCf4HvhVePw3La36wAAAAo"]
[Sat Feb 28 09:05:47.979595 2026] [:error] [pid 39183:tid 39197] [client 173.244.55.31:60123] [client 173.244.55.31] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/sunrise/colors_95.php"] [unique_id "aaI_axCf4HvhVePw3La4CwAAAAU"]
[Sat Feb 28 09:05:52.128355 2026] [:error] [pid 39184:tid 39229] [client 173.244.55.23:37451] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aaI_cFtZF9Zd_U7easCc1AAAAEo"]
[Sat Feb 28 09:05:56.139245 2026] [:error] [pid 11791:tid 11807] [client 173.244.55.31:30651] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "aaI_dGuX5e1Q32gqxH1zOgAAAQ4"]
[Sat Feb 28 09:06:05.288252 2026] [:error] [pid 22194:tid 22196] [client 173.244.55.23:24487] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/edit.php"] [unique_id "aaI_fX6mbajs3bzQGyvcDgAAAUA"]
[Sat Feb 28 09:06:12.843399 2026] [:error] [pid 39184:tid 39240] [client 173.244.55.31:45403] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aaI_hFtZF9Zd_U7easCdRAAAAFU"]
[Sat Feb 28 09:06:18.368258 2026] [:error] [pid 22194:tid 22196] [client 173.244.55.23:53637] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/click.php"] [unique_id "aaI_in6mbajs3bzQGyvcbgAAAUA"]
[Sat Feb 28 09:06:26.341994 2026] [:error] [pid 39183:tid 39215] [client 173.244.55.29:60711] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aaI_khCf4HvhVePw3La4hgAAABc"]
[Sat Feb 28 09:06:41.306142 2026] [:error] [pid 39185:tid 39268] [client 173.244.55.29:56575] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aaI_oRVE-FfM89u7BQbJEgAAAJY"]
[Sat Feb 28 09:06:42.178884 2026] [:error] [pid 39292:tid 39304] [client 173.244.55.29:57233] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/xl2023.php"] [unique_id "aaI_oqIAO5fN7BxyqcFjigAAAMo"]
[Sat Feb 28 09:06:43.062884 2026] [:error] [pid 11791:tid 11798] [client 173.244.55.30:27999] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aaI_o2uX5e1Q32gqxH11MQAAAQU"]
[Sat Feb 28 09:06:43.950575 2026] [:error] [pid 22194:tid 22220] [client 173.244.55.30:62945] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aaI_o36mbajs3bzQGyvdfgAAAVg"]
[Sat Feb 28 09:06:47.282404 2026] [:error] [pid 39185:tid 39249] [client 173.244.55.22:32861] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aaI_pxVE-FfM89u7BQbJPAAAAIM"]
[Sat Feb 28 09:06:48.171720 2026] [:error] [pid 22194:tid 22203] [client 173.244.55.21:21997] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aaI_qH6mbajs3bzQGyvdoAAAAUc"]
[Sat Feb 28 09:06:54.651680 2026] [:error] [pid 39292:tid 39299] [client 173.244.55.30:50041] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aaI_rqIAO5fN7BxyqcFj1wAAAMU"]
[Sat Feb 28 09:06:55.533019 2026] [:error] [pid 39292:tid 39295] [client 173.244.55.26:47005] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aaI_r6IAO5fN7BxyqcFj4gAAAME"]
[Sat Feb 28 09:06:56.412554 2026] [:error] [pid 39185:tid 39267] [client 173.244.55.26:24609] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aaI_sBVE-FfM89u7BQbJggAAAJU"]
[Sat Feb 28 09:06:57.295576 2026] [:error] [pid 11791:tid 11801] [client 173.244.55.29:34493] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "aaI_sWuX5e1Q32gqxH11tgAAAQg"]
[Sat Feb 28 09:07:00.883191 2026] [:error] [pid 11791:tid 11816] [client 173.244.55.25:38227] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aaI_tGuX5e1Q32gqxH116wAAARc"]
[Sat Feb 28 09:07:01.774096 2026] [proxy_fcgi:error] [pid 22194:tid 22213] [client 173.244.55.29:40597] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function add_action() in /home/expressi/public_html/wp-content/plugins/hello.php:69\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/plugins/hello.php on line 69'
[Sat Feb 28 09:07:05.268136 2026] [:error] [pid 22194:tid 22201] [client 173.244.55.29:39707] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "aaI_uX6mbajs3bzQGyveewAAAUU"]
[Sat Feb 28 09:07:18.232897 2026] [:error] [pid 22194:tid 22199] [client 173.244.55.28:62887] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aaI_xn6mbajs3bzQGyvfBAAAAUM"]
[Sat Feb 28 09:07:31.643786 2026] [:error] [pid 39184:tid 39234] [client 173.244.55.28:56157] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/file.php"] [unique_id "aaI_01tZF9Zd_U7easCesQAAAE8"]
[Sat Feb 28 09:07:38.444875 2026] [:error] [pid 22194:tid 22207] [client 173.244.55.25:26247] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aaI_2n6mbajs3bzQGyvfiQAAAUs"]
[Sat Feb 28 09:07:39.386941 2026] [:error] [pid 11791:tid 11799] [client 173.244.55.20:32305] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aaI_22uX5e1Q32gqxH13kQAAAQY"]
[Sat Feb 28 09:07:49.402584 2026] [:error] [pid 39292:tid 39311] [client 173.244.55.26:31509] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aaI_5aIAO5fN7BxyqcFlbQAAANE"]
[Sat Feb 28 09:07:57.492423 2026] [proxy_fcgi:error] [pid 22194:tid 22204] [client 173.244.55.30:59829] AH01071: Got error 'Primary script unknown'
[Sat Feb 28 09:07:57.948485 2026] [proxy_fcgi:error] [pid 22194:tid 22217] [client 173.244.55.30:59829] AH01071: Got error 'Primary script unknown'
[Sat Feb 28 09:07:58.391322 2026] [proxy_fcgi:error] [pid 22194:tid 22203] [client 173.244.55.30:59829] AH01071: Got error 'Primary script unknown'
[Sat Feb 28 09:08:04.800216 2026] [:error] [pid 22194:tid 22220] [client 173.244.55.30:59829] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aaI_9H6mbajs3bzQGyvgmgAAAVg"]
[Sat Feb 28 09:08:05.708850 2026] [:error] [pid 39292:tid 39307] [client 173.244.55.22:25419] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aaI_9aIAO5fN7BxyqcFl8wAAAM0"]
[Sat Feb 28 09:08:06.588789 2026] [:error] [pid 11791:tid 11809] [client 173.244.55.29:20365] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aaI_9muX5e1Q32gqxH14iwAAARA"]
[Sat Feb 28 09:08:07.478578 2026] [:error] [pid 11791:tid 11806] [client 173.244.55.23:53377] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aaI_92uX5e1Q32gqxH14kQAAAQ0"]
[Sat Feb 28 09:08:08.377783 2026] [:error] [pid 11791:tid 11814] [client 173.244.55.25:54645] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aaI_-GuX5e1Q32gqxH14mwAAARU"]
[Sat Feb 28 09:08:09.277515 2026] [:error] [pid 39292:tid 39313] [client 173.244.55.25:48597] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aaI_-aIAO5fN7BxyqcFmEQAAANM"]
[Sat Feb 28 09:08:13.284349 2026] [:error] [pid 39183:tid 39208] [client 173.244.55.21:20245] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "aaI__RCf4HvhVePw3La56wAAABA"]
[Sat Feb 28 09:08:16.247228 2026] [:error] [pid 11791:tid 11805] [client 173.244.55.22:53667] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aaJAAGuX5e1Q32gqxH148gAAAQw"]
[Sat Feb 28 09:08:17.120140 2026] [:error] [pid 39183:tid 39196] [client 173.244.55.26:52499] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aaJAARCf4HvhVePw3La6AAAAAAQ"]
[Sat Feb 28 09:08:18.003463 2026] [:error] [pid 11791:tid 11808] [client 173.244.55.23:23725] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aaJAAmuX5e1Q32gqxH15DgAAAQ8"]
[Sat Feb 28 09:08:24.509410 2026] [:error] [pid 39183:tid 39197] [client 173.244.55.28:58725] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aaJACBCf4HvhVePw3La6NAAAAAU"]
[Sat Feb 28 09:08:27.220539 2026] [:error] [pid 39184:tid 39233] [client 173.244.55.31:38065] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "aaJAC1tZF9Zd_U7easCfcAAAAE4"]
[Sat Feb 28 09:08:32.948802 2026] [:error] [pid 39183:tid 39193] [client 173.244.55.21:40839] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aaJAEBCf4HvhVePw3La6UgAAAAE"]
[Sat Feb 28 09:08:39.255375 2026] [:error] [pid 39183:tid 39204] [client 173.244.55.25:20433] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/about.php"] [unique_id "aaJAFxCf4HvhVePw3La6ZwAAAAw"]
[Sat Feb 28 09:08:44.876359 2026] [:error] [pid 39184:tid 39223] [client 173.244.55.23:56513] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aaJAHFtZF9Zd_U7easCfiAAAAEQ"]
[Sat Feb 28 09:08:54.401243 2026] [:error] [pid 22194:tid 22211] [client 173.244.55.29:48263] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aaJAJn6mbajs3bzQGyviSQAAAU8"]
[Sat Feb 28 09:08:56.705727 2026] [autoindex:error] [pid 11791:tid 11797] [client 194.146.12.7:64291] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Feb 28 09:08:57.354604 2026] [:error] [pid 11791:tid 11816] [client 173.244.55.22:46923] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aaJAKWuX5e1Q32gqxH16rgAAARc"]
[Sat Feb 28 09:09:26.041985 2026] [:error] [pid 22194:tid 22207] [client 173.244.55.21:26835] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aaJARn6mbajs3bzQGyvjWgAAAUs"]
[Sat Feb 28 09:09:26.918093 2026] [:error] [pid 11791:tid 11804] [client 173.244.55.30:34293] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aaJARmuX5e1Q32gqxH18PQAAAQs"]
[Sat Feb 28 09:09:27.809801 2026] [:error] [pid 39292:tid 39295] [client 173.244.55.31:46147] [client 173.244.55.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaJAR6IAO5fN7BxyqcFn8AAAAME"]
[Sat Feb 28 09:09:35.501217 2026] [:error] [pid 39292:tid 39297] [client 173.244.55.31:46147] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aaJAT6IAO5fN7BxyqcFoGQAAAMM"]
[Sat Feb 28 09:09:41.709415 2026] [:error] [pid 39183:tid 39215] [client 173.244.55.20:34397] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aaJAVRCf4HvhVePw3La6xwAAABc"]
[Sat Feb 28 09:09:42.580526 2026] [:error] [pid 39292:tid 39313] [client 173.244.55.21:24011] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aaJAVqIAO5fN7BxyqcFoXQAAANM"]
[Sat Feb 28 09:09:56.136729 2026] [:error] [pid 22194:tid 22204] [client 173.244.55.31:52319] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aaJAZH6mbajs3bzQGyvkyQAAAUg"]
[Sat Feb 28 09:09:57.022603 2026] [:error] [pid 11791:tid 11815] [client 173.244.55.21:36287] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aaJAZWuX5e1Q32gqxH18-QAAARY"]
[Sat Feb 28 09:10:07.491678 2026] [:error] [pid 39185:tid 39247] [client 173.244.55.28:37299] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aaJAbxVE-FfM89u7BQbNYwAAAIE"]
[Sat Feb 28 09:10:12.379848 2026] [proxy_fcgi:error] [pid 22194:tid 22206] [client 173.244.55.22:55577] AH01071: Got error 'Primary script unknown'
[Sat Feb 28 09:10:14.936662 2026] [:error] [pid 22194:tid 22209] [client 173.244.55.22:55577] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/function.php"] [unique_id "aaJAdn6mbajs3bzQGyvlhwAAAU0"]
[Sat Feb 28 09:10:15.825405 2026] [:error] [pid 39183:tid 39205] [client 173.244.55.21:49197] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/plugins.php"] [unique_id "aaJAdxCf4HvhVePw3La7IgAAAA0"]
[Sat Feb 28 09:10:20.563739 2026] [:error] [pid 22194:tid 22201] [client 173.244.55.28:35209] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "aaJAfH6mbajs3bzQGyvl0QAAAUU"]
[Sat Feb 28 09:10:21.434310 2026] [:error] [pid 11791:tid 11805] [client 173.244.55.28:46811] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aaJAfWuX5e1Q32gqxH19zgAAAQw"]
[Sat Feb 28 09:10:39.831536 2026] [:error] [pid 39184:tid 39232] [client 173.244.55.21:27883] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/atomlib.php"] [unique_id "aaJAj1tZF9Zd_U7easCg2gAAAE0"]
[Sat Feb 28 09:10:40.715275 2026] [:error] [pid 39184:tid 39231] [client 173.244.55.29:26217] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aaJAkFtZF9Zd_U7easCg3QAAAEw"]
[Sat Feb 28 09:10:52.027100 2026] [:error] [pid 22194:tid 22201] [client 173.244.55.25:30735] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aaJAnH6mbajs3bzQGyvmjwAAAUU"]
[Sat Feb 28 09:10:52.940076 2026] [:error] [pid 22194:tid 22201] [client 173.244.55.21:49227] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aaJAnH6mbajs3bzQGyvmmgAAAUU"]
[Sat Feb 28 09:10:53.835833 2026] [:error] [pid 11791:tid 11804] [client 173.244.55.21:30331] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aaJAnWuX5e1Q32gqxH1_ogAAAQs"]
[Sat Feb 28 09:11:07.354601 2026] [:error] [pid 22194:tid 22211] [client 173.244.55.29:65037] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aaJAq36mbajs3bzQGyvnLgAAAU8"]
[Sat Feb 28 09:11:12.268650 2026] [:error] [pid 39184:tid 39241] [client 173.244.55.25:50519] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aaJAsFtZF9Zd_U7easChNwAAAFY"]
[Sat Feb 28 09:11:24.574685 2026] [:error] [pid 11791:tid 11796] [client 173.244.55.30:57593] [client 173.244.55.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/js/wp-login.php"] [unique_id "aaJAvGuX5e1Q32gqxH2ArQAAAQM"]
[Sat Feb 28 09:11:33.617216 2026] [:error] [pid 11791:tid 11808] [client 173.244.55.30:57593] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bk/index.php"] [unique_id "aaJAxWuX5e1Q32gqxH2A9QAAAQ8"]
[Sat Feb 28 09:11:34.499070 2026] [:error] [pid 39185:tid 39266] [client 173.244.55.30:35143] [client 173.244.55.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aaJAxhVE-FfM89u7BQbPuwAAAJQ"]
[Sat Feb 28 09:12:02.337441 2026] [proxy_fcgi:error] [pid 39185:tid 39269] [client 173.244.55.30:35143] AH01071: Got error 'Primary script unknown'
[Sat Feb 28 09:12:38.966476 2026] [:error] [pid 39185:tid 39266] [client 173.244.55.30:35143] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/about.php"] [unique_id "aaJBBhVE-FfM89u7BQbRiAAAAJQ"]
[Sat Feb 28 09:12:47.572868 2026] [:error] [pid 11791:tid 11817] [client 173.244.55.23:21685] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aaJBD2uX5e1Q32gqxH2DbQAAARg"]
[Sat Feb 28 09:12:55.019723 2026] [:error] [pid 11791:tid 11803] [client 173.244.55.29:60377] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aaJBF2uX5e1Q32gqxH2DqQAAAQo"]
[Sat Feb 28 09:13:10.916418 2026] [:error] [pid 22194:tid 22202] [client 173.244.55.29:25903] [client 173.244.55.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/repeater.php"] [unique_id "aaJBJn6mbajs3bzQGyvqiwAAAUY"]
[Sat Feb 28 09:13:17.248647 2026] [:error] [pid 39184:tid 39240] [client 173.244.55.23:32417] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aaJBLVtZF9Zd_U7easCjPgAAAFU"]
[Sat Feb 28 09:13:25.773171 2026] [:error] [pid 39185:tid 39250] [client 173.244.55.28:42897] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aaJBNRVE-FfM89u7BQbSQQAAAIQ"]
[Sat Feb 28 09:13:29.529305 2026] [:error] [pid 39292:tid 39314] [client 173.244.55.23:58555] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aaJBOaIAO5fN7BxyqcFuDQAAANQ"]
[Sat Feb 28 09:13:44.372461 2026] [proxy_fcgi:error] [pid 22194:tid 22205] [client 173.244.55.29:26919] AH01071: Got error 'Primary script unknown'
[Sat Feb 28 09:13:44.815436 2026] [proxy_fcgi:error] [pid 22194:tid 22208] [client 173.244.55.29:26919] AH01071: Got error 'Primary script unknown'
[Sat Feb 28 09:13:45.252333 2026] [:error] [pid 22194:tid 22214] [client 173.244.55.29:26919] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aaJBSX6mbajs3bzQGyvrhAAAAVI"]
[Sat Feb 28 09:13:46.165597 2026] [:error] [pid 22194:tid 22201] [client 173.244.55.26:51781] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aaJBSn6mbajs3bzQGyvrkAAAAUU"]
[Sat Feb 28 09:14:07.563360 2026] [:error] [pid 39185:tid 39256] [client 173.244.55.31:44107] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aaJBXxVE-FfM89u7BQbSyQAAAIo"]
[Sat Feb 28 09:14:11.365464 2026] [:error] [pid 11791:tid 11794] [client 173.244.55.20:38319] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "aaJBY2uX5e1Q32gqxH2HBQAAAQE"]
[Sat Feb 28 09:14:19.691190 2026] [:error] [pid 22194:tid 22214] [client 173.244.55.22:30151] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aaJBa36mbajs3bzQGyvseAAAAVI"]
[Sat Feb 28 09:14:35.797355 2026] [:error] [pid 39185:tid 39263] [client 173.244.55.25:22747] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aaJBexVE-FfM89u7BQbTVgAAAJE"]
[Sat Feb 28 09:14:36.703472 2026] [proxy_fcgi:error] [pid 39184:tid 39222] [client 173.244.55.28:51815] AH01071: Got error 'Primary script unknown'
[Sat Feb 28 09:14:43.092914 2026] [:error] [pid 39184:tid 39229] [client 173.244.55.28:51815] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aaJBg1tZF9Zd_U7easCjvwAAAEo"]
[Sat Feb 28 09:14:59.647387 2026] [proxy_fcgi:error] [pid 11791:tid 11803] [client 173.244.55.21:53645] AH01071: Got error 'Primary script unknown'
[Sat Feb 28 09:15:02.942827 2026] [:error] [pid 11791:tid 11796] [client 173.244.55.21:53645] [client 173.244.55.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aaJBlmuX5e1Q32gqxH2JCwAAAQM"]
[Sat Feb 28 09:15:15.828624 2026] [:error] [pid 11791:tid 11798] [client 173.244.55.21:53645] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aaJBo2uX5e1Q32gqxH2JiAAAAQU"]
[Sat Feb 28 09:15:18.886541 2026] [:error] [pid 39184:tid 39223] [client 173.244.55.29:60721] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aaJBpltZF9Zd_U7easCkBQAAAEQ"]
[Sat Feb 28 09:15:28.365755 2026] [:error] [pid 22194:tid 22218] [client 173.244.55.25:57573] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aaJBsH6mbajs3bzQGyvuwgAAAVY"]
[Sat Feb 28 09:15:39.257180 2026] [:error] [pid 22194:tid 22213] [client 173.244.55.23:37973] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aaJBu36mbajs3bzQGyvvAQAAAVE"]
[Sat Feb 28 09:15:43.495511 2026] [:error] [pid 39183:tid 39205] [client 173.244.55.22:25177] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aaJBvxCf4HvhVePw3La9zAAAAA0"]
[Sat Feb 28 09:15:53.073179 2026] [:error] [pid 22194:tid 22196] [client 173.244.55.22:32647] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aaJByX6mbajs3bzQGyvvWwAAAUA"]
[Sat Feb 28 09:15:58.781461 2026] [proxy_fcgi:error] [pid 11791:tid 11794] [client 173.244.55.28:32621] AH01071: Got error 'Primary script unknown'
[Sat Feb 28 09:15:59.228070 2026] [:error] [pid 11791:tid 11817] [client 173.244.55.28:32621] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aaJBz2uX5e1Q32gqxH2LZgAAARg"]
[Sat Feb 28 09:16:00.122471 2026] [proxy_fcgi:error] [pid 39184:tid 39233] [client 173.244.55.22:24873] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function add_action() in /home/expressi/public_html/wp-content/themes/twentytwentyfour/functions.php:147\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/themes/twentytwentyfour/functions.php on line 147'
[Sat Feb 28 09:16:01.075633 2026] [:error] [pid 22194:tid 22199] [client 173.244.55.20:59907] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/db.php"] [unique_id "aaJB0X6mbajs3bzQGyvvfwAAAUM"]
[Sat Feb 28 09:16:02.038123 2026] [:error] [pid 22194:tid 22220] [client 173.244.55.25:46073] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aaJB0n6mbajs3bzQGyvvjgAAAVg"]
[Sat Feb 28 09:16:02.941658 2026] [:error] [pid 39185:tid 39263] [client 173.244.55.25:62789] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aaJB0hVE-FfM89u7BQbUjwAAAJE"]
[Sat Feb 28 09:16:03.835352 2026] [:error] [pid 39185:tid 39268] [client 173.244.55.23:49851] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aaJB0xVE-FfM89u7BQbUlgAAAJY"]
[Sat Feb 28 09:16:04.756844 2026] [:error] [pid 39292:tid 39294] [client 173.244.55.23:57079] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aaJB1KIAO5fN7BxyqcFxSQAAAMA"]
[Sat Feb 28 09:16:05.692669 2026] [:error] [pid 11791:tid 11801] [client 173.244.55.31:64269] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aaJB1WuX5e1Q32gqxH2LlwAAAQg"]
[Sat Feb 28 09:16:11.070374 2026] [:error] [pid 11791:tid 11797] [client 173.244.55.29:55761] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aaJB22uX5e1Q32gqxH2LxgAAAQQ"]
[Sat Feb 28 09:16:11.948890 2026] [:error] [pid 39184:tid 39224] [client 173.244.55.23:34303] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aaJB21tZF9Zd_U7easCkWQAAAEU"]
[Sat Feb 28 09:16:12.826184 2026] [:error] [pid 39292:tid 39309] [client 173.244.55.28:60839] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aaJB3KIAO5fN7BxyqcFxcwAAAM8"]
[Sat Feb 28 09:16:15.793342 2026] [:error] [pid 22194:tid 22206] [client 173.244.55.30:44561] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aaJB336mbajs3bzQGyvwJgAAAUo"]
[Sat Feb 28 09:16:21.709891 2026] [:error] [pid 11791:tid 11813] [client 173.244.55.26:40363] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/options.php"] [unique_id "aaJB5WuX5e1Q32gqxH2MNAAAARQ"]
[Sat Feb 28 09:16:22.594531 2026] [proxy_fcgi:error] [pid 11791:tid 11795] [client 173.244.55.26:50803] AH01071: Got error 'Primary script unknown'
[Sat Feb 28 09:16:31.089377 2026] [:error] [pid 11791:tid 11801] [client 173.244.55.26:50803] [client 173.244.55.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aaJB72uX5e1Q32gqxH2MlQAAAQg"]
[Sat Feb 28 09:16:43.788768 2026] [:error] [pid 11791:tid 11802] [client 173.244.55.26:50803] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aaJB-2uX5e1Q32gqxH2NDgAAAQk"]
[Sat Feb 28 09:16:44.713828 2026] [:error] [pid 11791:tid 11810] [client 173.244.55.29:50813] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aaJB_GuX5e1Q32gqxH2NFAAAARE"]
[Sat Feb 28 09:17:20.147491 2026] [:error] [pid 39183:tid 39204] [client 173.244.55.28:35387] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aaJCIBCf4HvhVePw3La-qwAAAAw"]
[Sat Feb 28 09:17:21.041768 2026] [:error] [pid 39292:tid 39312] [client 173.244.55.23:57475] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aaJCIaIAO5fN7BxyqcFzEwAAANI"]
[Sat Feb 28 09:17:21.928183 2026] [:error] [pid 39292:tid 39318] [client 173.244.55.22:65045] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aaJCIaIAO5fN7BxyqcFzGgAAANg"]
[Sat Feb 28 09:17:35.644338 2026] [:error] [pid 39184:tid 39235] [client 173.244.55.20:29017] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aaJCL1tZF9Zd_U7easCk_AAAAFA"]
[Sat Feb 28 09:17:36.517009 2026] [:error] [pid 22194:tid 22219] [client 173.244.55.26:20687] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aaJCMH6mbajs3bzQGyvyYwAAAVc"]
[Sat Feb 28 09:17:37.407410 2026] [:error] [pid 22194:tid 22216] [client 173.244.55.26:62377] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aaJCMX6mbajs3bzQGyvycgAAAVQ"]
[Sat Feb 28 09:17:47.620119 2026] [:error] [pid 22194:tid 22200] [client 173.244.55.29:28393] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aaJCO36mbajs3bzQGyvy6AAAAUQ"]
[Sat Feb 28 09:17:51.790090 2026] [:error] [pid 22194:tid 22214] [client 173.244.55.31:24301] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aaJCP36mbajs3bzQGyvy_QAAAVI"]
[Sat Feb 28 09:17:58.679296 2026] [:error] [pid 11791:tid 11813] [client 173.244.55.23:53825] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aaJCRmuX5e1Q32gqxH2P0QAAARQ"]
[Sat Feb 28 09:18:25.848182 2026] [:error] [pid 11791:tid 11795] [client 173.244.55.31:56693] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aaJCYWuX5e1Q32gqxH2REQAAAQI"]
[Sat Feb 28 09:18:30.800255 2026] [:error] [pid 22194:tid 22203] [client 173.244.55.23:64851] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/about.php"] [unique_id "aaJCZn6mbajs3bzQGyvz7QAAAUc"]
[Sat Feb 28 09:18:44.982714 2026] [:error] [pid 11791:tid 11817] [client 173.244.55.21:31993] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-sup.php"] [unique_id "aaJCdGuX5e1Q32gqxH2RvAAAARg"]
[Sat Feb 28 09:18:51.134437 2026] [:error] [pid 11791:tid 11796] [client 173.244.55.31:47559] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aaJCe2uX5e1Q32gqxH2R8gAAAQM"]
[Sat Feb 28 09:19:02.540764 2026] [:error] [pid 39292:tid 39311] [client 173.244.55.20:32791] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aaJChqIAO5fN7BxyqcF0fwAAANE"]
[Sat Feb 28 09:19:14.690439 2026] [:error] [pid 11791:tid 11804] [client 173.244.55.21:24449] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aaJCkmuX5e1Q32gqxH2S2wAAAQs"]
[Sat Feb 28 09:19:20.498794 2026] [:error] [pid 39185:tid 39258] [client 173.244.55.21:46361] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aaJCmBVE-FfM89u7BQbXVAAAAIw"]
[Sat Feb 28 09:19:21.404210 2026] [:error] [pid 11791:tid 11814] [client 173.244.55.22:52271] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aaJCmWuX5e1Q32gqxH2TAQAAARU"]
[Sat Feb 28 09:19:36.018265 2026] [:error] [pid 39292:tid 39299] [client 173.244.55.31:36355] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aaJCqKIAO5fN7BxyqcF0uwAAAMU"]
[Sat Feb 28 09:19:50.178037 2026] [:error] [pid 22194:tid 22209] [client 173.244.55.22:54783] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aaJCtn6mbajs3bzQGyv3CQAAAU0"]
[Sat Feb 28 09:20:02.855739 2026] [:error] [pid 39292:tid 39304] [client 173.244.55.28:34737] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aaJCwqIAO5fN7BxyqcF1mgAAAMo"]
[Sat Feb 28 09:20:03.783956 2026] [:error] [pid 11791:tid 11817] [client 173.244.55.30:57965] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aaJCw2uX5e1Q32gqxH2UGQAAARg"]
[Sat Feb 28 09:20:10.721148 2026] [:error] [pid 39292:tid 39294] [client 173.244.55.20:31213] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aaJCyqIAO5fN7BxyqcF2AwAAAMA"]
[Sat Feb 28 09:20:17.764344 2026] [:error] [pid 39183:tid 39212] [client 173.244.55.28:34617] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/install.php"] [unique_id "aaJC0RCf4HvhVePw3La_hgAAABQ"]
[Sat Feb 28 09:20:18.692347 2026] [:error] [pid 11791:tid 11814] [client 173.244.55.25:25379] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aaJC0muX5e1Q32gqxH2UagAAARU"]
[Sat Feb 28 09:20:32.930686 2026] [:error] [pid 11791:tid 11812] [client 173.244.55.25:20567] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/category-double.php"] [unique_id "aaJC4GuX5e1Q32gqxH2UvQAAARM"]
[Sat Feb 28 09:20:37.926813 2026] [:error] [pid 39292:tid 39316] [client 173.244.55.31:29399] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/db.php"] [unique_id "aaJC5aIAO5fN7BxyqcF26QAAANY"]
[Sat Feb 28 09:20:38.819566 2026] [:error] [pid 39185:tid 39265] [client 173.244.55.30:20749] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/security.php"] [unique_id "aaJC5hVE-FfM89u7BQbYOgAAAJM"]
[Sat Feb 28 09:20:44.325355 2026] [:error] [pid 22194:tid 22208] [client 173.244.55.31:51439] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aaJC7H6mbajs3bzQGyv4ZQAAAUw"]
[Sat Feb 28 09:20:47.151972 2026] [:error] [pid 11791:tid 11796] [client 173.244.55.26:63263] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aaJC72uX5e1Q32gqxH2U4AAAAQM"]
[Sat Feb 28 09:20:55.805918 2026] [:error] [pid 22194:tid 22219] [client 173.244.55.28:43387] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aaJC936mbajs3bzQGyv4zQAAAVc"]
[Sat Feb 28 09:21:02.419507 2026] [:error] [pid 22194:tid 22211] [client 173.244.55.31:31765] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aaJC_n6mbajs3bzQGyv48QAAAU8"]
[Sat Feb 28 09:21:09.858922 2026] [:error] [pid 11791:tid 11813] [client 173.244.55.28:64031] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aaJDBWuX5e1Q32gqxH2VNQAAARQ"]
[Sat Feb 28 09:21:12.823584 2026] [:error] [pid 11791:tid 11797] [client 173.244.55.23:53087] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/as.php"] [unique_id "aaJDCGuX5e1Q32gqxH2VSQAAAQQ"]
[Sat Feb 28 09:21:16.867480 2026] [:error] [pid 22194:tid 22206] [client 173.244.55.20:28201] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aaJDDH6mbajs3bzQGyv5OwAAAUo"]
[Sat Feb 28 09:21:17.803923 2026] [:error] [pid 39292:tid 39305] [client 173.244.55.21:53413] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/install.php"] [unique_id "aaJDDaIAO5fN7BxyqcF4AwAAAMs"]
[Sat Feb 28 09:21:18.761080 2026] [:error] [pid 11791:tid 11816] [client 173.244.55.30:54571] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/db.php"] [unique_id "aaJDDmuX5e1Q32gqxH2VXQAAARc"]
[Sat Feb 28 09:21:32.329339 2026] [:error] [pid 39292:tid 39314] [client 173.244.55.30:34121] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aaJDHKIAO5fN7BxyqcF4dgAAANQ"]
[Sat Feb 28 09:21:41.320442 2026] [:error] [pid 39292:tid 39316] [client 173.244.55.30:64729] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rk2.php"] [unique_id "aaJDJaIAO5fN7BxyqcF4ogAAANY"]
[Sat Feb 28 09:21:49.330112 2026] [:error] [pid 11791:tid 11809] [client 173.244.55.29:40501] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/past.php"] [unique_id "aaJDLWuX5e1Q32gqxH2WFAAAARA"]
[Sat Feb 28 09:21:55.548913 2026] [:error] [pid 52460:tid 52471] [client 173.244.55.21:24109] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/edit-tags.php"] [unique_id "aaJDM7LWOogAgHGh62RSQgAAAYg"]
[Sat Feb 28 09:22:06.811874 2026] [:error] [pid 39292:tid 39297] [client 173.244.55.30:32179] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aaJDPqIAO5fN7BxyqcF5DwAAAMM"]
[Sat Feb 28 09:22:09.612772 2026] [:error] [pid 11791:tid 11796] [client 173.244.55.29:50019] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aaJDQWuX5e1Q32gqxH2WegAAAQM"]
[Sat Feb 28 09:22:12.317573 2026] [:error] [pid 11791:tid 11815] [client 173.244.55.20:20809] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aaJDRGuX5e1Q32gqxH2WoAAAARY"]
[Sat Feb 28 09:22:17.345641 2026] [:error] [pid 39292:tid 39303] [client 173.244.55.31:25695] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aaJDSaIAO5fN7BxyqcF5OwAAAMk"]
[Sat Feb 28 09:22:33.670362 2026] [:error] [pid 52460:tid 52479] [client 173.244.55.31:47979] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aaJDWbLWOogAgHGh62RS6wAAAZA"]
[Sat Feb 28 09:22:34.565856 2026] [:error] [pid 39185:tid 39255] [client 173.244.55.26:36811] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aaJDWhVE-FfM89u7BQbZaAAAAIk"]
[Sat Feb 28 09:22:41.775558 2026] [:error] [pid 39184:tid 39236] [client 173.244.55.22:49385] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aaJDYVtZF9Zd_U7easCnbwAAAFE"]
[Sat Feb 28 09:22:42.693713 2026] [:error] [pid 22194:tid 22204] [client 173.244.55.31:20001] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aaJDYn6mbajs3bzQGyv6ZQAAAUg"]
[Sat Feb 28 09:22:49.690640 2026] [:error] [pid 39185:tid 39270] [client 173.244.55.22:24835] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aaJDaRVE-FfM89u7BQbZ5AAAAJg"]
[Sat Feb 28 09:22:50.629905 2026] [:error] [pid 39185:tid 39247] [client 173.244.55.30:37011] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ms-file.php"] [unique_id "aaJDahVE-FfM89u7BQbZ7QAAAIE"]
[Sat Feb 28 09:22:51.534131 2026] [:error] [pid 39185:tid 39270] [client 173.244.55.22:35825] [client 173.244.55.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aaJDaxVE-FfM89u7BQbZ8wAAAJg"]
[Sat Feb 28 09:22:51.542525 2026] [proxy_fcgi:error] [pid 39185:tid 39270] [client 173.244.55.22:35825] AH01071: Got error 'Primary script unknown'
[Sat Feb 28 09:22:52.009783 2026] [:error] [pid 39185:tid 39266] [client 173.244.55.22:35825] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/av.php"] [unique_id "aaJDbBVE-FfM89u7BQbZ9gAAAJQ"]
[Sat Feb 28 09:23:01.992190 2026] [:error] [pid 39184:tid 39236] [client 173.244.55.23:56785] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aaJDdVtZF9Zd_U7easCnjAAAAFE"]
[Sat Feb 28 09:23:02.933186 2026] [:error] [pid 52460:tid 52473] [client 173.244.55.28:28883] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/network.php"] [unique_id "aaJDdrLWOogAgHGh62RTUAAAAYo"]
[Sat Feb 28 09:23:22.376872 2026] [:error] [pid 11791:tid 11797] [client 173.244.55.29:62927] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aaJDimuX5e1Q32gqxH2X5wAAAQQ"]
[Sat Feb 28 09:23:23.272276 2026] [:error] [pid 22194:tid 22211] [client 173.244.55.30:24023] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/item.php"] [unique_id "aaJDi36mbajs3bzQGyv6mwAAAU8"]
[Sat Feb 28 09:23:28.137056 2026] [:error] [pid 11791:tid 11807] [client 173.244.55.22:55281] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aaJDkGuX5e1Q32gqxH2X9QAAAQ4"]
[Sat Feb 28 09:23:29.051761 2026] [:error] [pid 39185:tid 39249] [client 173.244.55.26:37131] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/install.php"] [unique_id "aaJDkRVE-FfM89u7BQbaoAAAAIM"]
[Sat Feb 28 09:23:29.981610 2026] [proxy_fcgi:error] [pid 39185:tid 39264] [client 173.244.55.25:36213] AH01071: Got error 'Primary script unknown'
[Sat Feb 28 09:23:30.480985 2026] [:error] [pid 39185:tid 39247] [client 173.244.55.25:36213] [client 173.244.55.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.244.55.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aaJDkhVE-FfM89u7BQbarwAAAIE"]
[Sat Feb 28 09:23:34.603370 2026] [:error] [pid 39185:tid 39250] [client 173.244.55.25:36213] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aaJDlhVE-FfM89u7BQbazQAAAIQ"]
[Sat Feb 28 09:23:43.416006 2026] [:error] [pid 39185:tid 39267] [client 173.244.55.20:35559] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aaJDnxVE-FfM89u7BQbbDgAAAJU"]
[Sat Feb 28 09:23:46.430538 2026] [:error] [pid 39292:tid 39312] [client 173.244.55.29:43379] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aaJDoqIAO5fN7BxyqcF6sAAAANI"]
[Sat Feb 28 09:23:47.350123 2026] [:error] [pid 39185:tid 39252] [client 173.244.55.28:41927] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aaJDoxVE-FfM89u7BQbbIwAAAIY"]
[Sat Feb 28 09:23:56.173941 2026] [:error] [pid 39185:tid 39261] [client 173.244.55.28:36789] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aaJDrBVE-FfM89u7BQbbcAAAAI8"]
[Sat Feb 28 09:24:01.455966 2026] [:error] [pid 39185:tid 39251] [client 173.244.55.28:63567] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "aaJDsRVE-FfM89u7BQbblwAAAIU"]
[Sat Feb 28 09:24:10.479819 2026] [:error] [pid 52460:tid 52487] [client 173.244.55.28:22261] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aaJDurLWOogAgHGh62RU4gAAAZg"]
[Sat Feb 28 09:24:11.359380 2026] [:error] [pid 39185:tid 39267] [client 173.244.55.26:47087] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bypass.php"] [unique_id "aaJDuxVE-FfM89u7BQbb3wAAAJU"]
[Sat Feb 28 09:24:15.092859 2026] [:error] [pid 11791:tid 11809] [client 173.244.55.28:30969] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/count.php"] [unique_id "aaJDv2uX5e1Q32gqxH2YWQAAARA"]
[Sat Feb 28 09:24:27.670366 2026] [:error] [pid 39185:tid 39264] [client 173.244.55.20:23601] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aaJDyxVE-FfM89u7BQbcbAAAAJI"]
[Sat Feb 28 09:24:32.502053 2026] [:error] [pid 39185:tid 39257] [client 173.244.55.20:49087] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "expressinteriors.com"] [uri "/images/stories/themes.php"] [unique_id "aaJD0BVE-FfM89u7BQbcpwAAAIs"]
[Sat Feb 28 09:24:32.999469 2026] [:error] [pid 39185:tid 39257] [client 173.244.55.20:49087] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aaJD0BVE-FfM89u7BQbcqwAAAIs"]
[Sat Feb 28 09:24:37.202916 2026] [:error] [pid 52460:tid 52482] [client 173.244.55.23:59167] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aaJD1bLWOogAgHGh62RVpAAAAZM"]
[Sat Feb 28 09:24:38.097899 2026] [:error] [pid 39185:tid 39249] [client 173.244.55.20:56335] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/vars-soap.php"] [unique_id "aaJD1hVE-FfM89u7BQbcxQAAAIM"]
[Sat Feb 28 09:24:49.025518 2026] [:error] [pid 39185:tid 39248] [client 173.244.55.22:29251] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aaJD4RVE-FfM89u7BQbdNwAAAII"]
[Sat Feb 28 09:24:53.777307 2026] [:error] [pid 39185:tid 39252] [client 173.244.55.25:62675] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aaJD5RVE-FfM89u7BQbdeQAAAIY"]
[Sat Feb 28 09:24:57.259463 2026] [:error] [pid 11791:tid 11810] [client 173.244.55.20:44689] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aaJD6WuX5e1Q32gqxH2YzQAAARE"]
[Sat Feb 28 09:25:06.520306 2026] [:error] [pid 39185:tid 39253] [client 173.244.55.29:31575] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aaJD8hVE-FfM89u7BQbd0gAAAIc"]
[Sat Feb 28 09:25:09.435745 2026] [:error] [pid 39183:tid 39193] [client 173.244.55.28:31663] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/colour.php"] [unique_id "aaJD9RCf4HvhVePw3LbA_QAAAAE"]
[Sat Feb 28 09:25:12.541249 2026] [:error] [pid 39185:tid 39260] [client 173.244.55.30:63995] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aaJD-BVE-FfM89u7BQbeAAAAAI4"]
[Sat Feb 28 09:25:13.447504 2026] [:error] [pid 52460:tid 52467] [client 173.244.55.25:40867] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/include.php"] [unique_id "aaJD-bLWOogAgHGh62RXCwAAAYQ"]
[Sat Feb 28 09:25:18.247926 2026] [:error] [pid 39185:tid 39251] [client 173.244.55.25:33687] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aaJD_hVE-FfM89u7BQbePgAAAIU"]
[Sat Feb 28 09:25:26.547841 2026] [:error] [pid 11791:tid 11805] [client 173.244.55.21:52509] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aaJEBmuX5e1Q32gqxH2ZjAAAAQw"]
[Sat Feb 28 09:25:27.436860 2026] [:error] [pid 52460:tid 52484] [client 173.244.55.31:25351] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about5.php"] [unique_id "aaJEB7LWOogAgHGh62RXTQAAAZU"]
[Sat Feb 28 09:25:36.794219 2026] [:error] [pid 39292:tid 39306] [client 173.244.55.30:26981] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/db.php"] [unique_id "aaJEEKIAO5fN7BxyqcF8MAAAAMw"]
[Sat Feb 28 09:25:42.106728 2026] [:error] [pid 22194:tid 22213] [client 173.244.55.21:59651] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aaJEFn6mbajs3bzQGyv8CQAAAVE"]
[Sat Feb 28 09:25:49.786012 2026] [:error] [pid 39292:tid 39302] [client 173.244.55.29:32093] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aaJEHaIAO5fN7BxyqcF8TAAAAMg"]
[Sat Feb 28 09:25:50.681028 2026] [:error] [pid 52460:tid 52481] [client 173.244.55.20:32539] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aaJEHrLWOogAgHGh62RXsgAAAZI"]
[Sat Feb 28 09:25:53.378498 2026] [:error] [pid 39183:tid 39201] [client 173.244.55.22:39895] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aaJEIRCf4HvhVePw3LbBNAAAAAk"]
[Sat Feb 28 09:25:57.959467 2026] [:error] [pid 39185:tid 39247] [client 173.244.55.29:58115] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aaJEJRVE-FfM89u7BQbf5wAAAIE"]
[Sat Feb 28 09:26:03.255883 2026] [:error] [pid 52460:tid 52474] [client 173.244.55.23:62787] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aaJEK7LWOogAgHGh62RYAAAAAYs"]
[Sat Feb 28 09:26:04.161961 2026] [:error] [pid 39185:tid 39267] [client 173.244.55.20:50763] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aaJELBVE-FfM89u7BQbgNQAAAJU"]
[Sat Feb 28 09:26:07.066866 2026] [:error] [pid 11791:tid 11795] [client 173.244.55.20:55051] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aaJEL2uX5e1Q32gqxH2aQgAAAQI"]
[Sat Feb 28 09:26:07.951218 2026] [:error] [pid 39185:tid 39269] [client 173.244.55.29:53747] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/simi.php"] [unique_id "aaJELxVE-FfM89u7BQbgYwAAAJc"]
[Sat Feb 28 09:26:12.221287 2026] [:error] [pid 52460:tid 52486] [client 173.244.55.28:37991] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aaJENLLWOogAgHGh62RYUgAAAZc"]
[Sat Feb 28 09:26:14.558783 2026] [:error] [pid 52460:tid 52477] [client 173.244.55.29:34573] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aaJENrLWOogAgHGh62RYWgAAAY4"]
[Sat Feb 28 09:26:15.485578 2026] [:error] [pid 39184:tid 39231] [client 173.244.55.26:49665] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aaJEN1tZF9Zd_U7easCopgAAAEw"]
[Sat Feb 28 09:26:16.372555 2026] [:error] [pid 39185:tid 39269] [client 173.244.55.29:42861] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aaJEOBVE-FfM89u7BQbgowAAAJc"]
[Sat Feb 28 09:26:25.036774 2026] [:error] [pid 11791:tid 11808] [client 173.244.55.21:31395] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aaJEQWuX5e1Q32gqxH2a0AAAAQ8"]
[Sat Feb 28 09:26:30.889881 2026] [:error] [pid 39292:tid 39296] [client 173.244.55.20:49439] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aaJERqIAO5fN7BxyqcF8ugAAAMI"]
[Sat Feb 28 09:26:34.683828 2026] [:error] [pid 11791:tid 11798] [client 173.244.55.31:64085] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aaJESmuX5e1Q32gqxH2a-wAAAQU"]
[Sat Feb 28 09:26:35.572779 2026] [proxy_fcgi:error] [pid 39185:tid 39246] [client 173.244.55.29:41157] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_locale() in /home/expressi/public_html/wp-admin/includes/admin.php:16\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-admin/includes/admin.php on line 16'
[Sat Feb 28 09:26:36.541127 2026] [:error] [pid 11791:tid 11817] [client 173.244.55.26:59463] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aaJETGuX5e1Q32gqxH2bBAAAARg"]
[Sat Feb 28 09:26:47.319492 2026] [:error] [pid 39185:tid 39257] [client 173.244.55.30:46225] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/plugin.php"] [unique_id "aaJEVxVE-FfM89u7BQbhzwAAAIs"]
[Sat Feb 28 09:26:48.229840 2026] [:error] [pid 52460:tid 52468] [client 173.244.55.28:39293] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aaJEWLLWOogAgHGh62RY8gAAAYU"]
[Sat Feb 28 09:26:52.405493 2026] [:error] [pid 39185:tid 39270] [client 173.244.55.21:42325] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aaJEXBVE-FfM89u7BQbiCAAAAJg"]
[Sat Feb 28 09:26:59.386710 2026] [:error] [pid 52460:tid 52480] [client 173.244.55.31:33373] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aaJEY7LWOogAgHGh62RZZgAAAZE"]
[Sat Feb 28 09:27:04.530119 2026] [:error] [pid 11791:tid 11797] [client 173.244.55.25:42143] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aaJEaGuX5e1Q32gqxH2bcwAAAQQ"]
[Sat Feb 28 09:27:08.416273 2026] [:error] [pid 11791:tid 11804] [client 173.244.55.31:25099] [client 173.244.55.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aaJEbGuX5e1Q32gqxH2boAAAAQs"]
[Sat Feb 28 09:27:11.413921 2026] [:error] [pid 39185:tid 39268] [client 173.244.55.20:39135] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aaJEbxVE-FfM89u7BQbinwAAAJY"]
[Sat Feb 28 09:27:14.145146 2026] [:error] [pid 39292:tid 39304] [client 173.244.55.30:49753] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aaJEcqIAO5fN7BxyqcF9PgAAAMo"]
[Sat Feb 28 09:27:21.205509 2026] [:error] [pid 39184:tid 39219] [client 173.244.55.29:28523] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aaJEeVtZF9Zd_U7easCo5gAAAEA"]
[Sat Feb 28 09:27:26.858587 2026] [:error] [pid 11791:tid 11805] [client 173.244.55.25:39111] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aaJEfmuX5e1Q32gqxH2b5AAAAQw"]
[Sat Feb 28 09:27:27.757050 2026] [proxy_fcgi:error] [pid 39185:tid 39256] [client 173.244.55.25:24813] AH01071: Got error 'Primary script unknown'
[Sat Feb 28 09:27:28.208240 2026] [:error] [pid 39185:tid 39246] [client 173.244.55.25:24813] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aaJEgBVE-FfM89u7BQbjUgAAAIA"]
[Sat Feb 28 09:27:29.103485 2026] [:error] [pid 22194:tid 22210] [client 173.244.55.26:45319] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aaJEgX6mbajs3bzQGyv8rwAAAU4"]
[Sat Feb 28 09:27:34.008259 2026] [:error] [pid 22194:tid 22208] [client 173.244.55.28:29407] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aaJEhn6mbajs3bzQGyv8wAAAAUw"]
[Sat Feb 28 09:27:34.893170 2026] [:error] [pid 52460:tid 52467] [client 173.244.55.26:56191] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aaJEhrLWOogAgHGh62RaoQAAAYQ"]
[Sat Feb 28 09:27:44.921638 2026] [:error] [pid 39185:tid 39246] [client 173.244.55.21:48151] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-2019.php"] [unique_id "aaJEkBVE-FfM89u7BQbj6wAAAIA"]
[Sat Feb 28 09:27:45.811510 2026] [:error] [pid 22194:tid 22213] [client 173.244.55.20:22337] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aaJEkX6mbajs3bzQGyv82AAAAVE"]
[Sat Feb 28 09:27:48.679763 2026] [:error] [pid 22194:tid 22207] [client 173.244.55.21:42953] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/log.php"] [unique_id "aaJElH6mbajs3bzQGyv84AAAAUs"]
[Sat Feb 28 09:27:49.623506 2026] [:error] [pid 39184:tid 39219] [client 173.244.55.29:32423] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aaJElVtZF9Zd_U7easCo9gAAAEA"]
[Sat Feb 28 09:27:50.540340 2026] [:error] [pid 22194:tid 22197] [client 173.244.55.26:62609] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aaJEln6mbajs3bzQGyv86AAAAUE"]
[Sat Feb 28 09:27:51.439947 2026] [:error] [pid 39184:tid 39231] [client 173.244.55.21:23391] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/aw.php"] [unique_id "aaJEl1tZF9Zd_U7easCo-wAAAEw"]
[Sat Feb 28 09:27:58.431206 2026] [:error] [pid 52460:tid 52471] [client 173.244.55.29:48235] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/db.php"] [unique_id "aaJEnrLWOogAgHGh62RbowAAAYg"]
[Sat Feb 28 09:27:59.315584 2026] [:error] [pid 22194:tid 22212] [client 173.244.55.20:30975] [client 173.244.55.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/install.php"] [unique_id "aaJEn36mbajs3bzQGyv9CgAAAVA"]
[Sat Feb 28 09:28:04.647010 2026] [:error] [pid 11791:tid 11801] [client 173.244.55.21:53577] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aaJEpGuX5e1Q32gqxH2cjgAAAQg"]
[Sat Feb 28 09:28:05.563277 2026] [:error] [pid 39184:tid 39229] [client 173.244.55.23:36147] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aaJEpVtZF9Zd_U7easCpBgAAAEo"]
[Sat Feb 28 09:28:10.280474 2026] [:error] [pid 39185:tid 39266] [client 173.244.55.29:55117] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/template-less.php"] [unique_id "aaJEqhVE-FfM89u7BQbkwgAAAJQ"]
[Sat Feb 28 09:28:11.201512 2026] [:error] [pid 11791:tid 11814] [client 173.244.55.28:57485] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aaJEq2uX5e1Q32gqxH2czgAAARU"]
[Sat Feb 28 09:28:23.450288 2026] [:error] [pid 52460:tid 52466] [client 173.244.55.26:44757] [client 173.244.55.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/min.php"] [unique_id "aaJEt7LWOogAgHGh62RcAQAAAYM"]
[Sat Feb 28 09:28:24.359678 2026] [:error] [pid 52460:tid 52477] [client 173.244.55.28:60381] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aaJEuLLWOogAgHGh62RcBgAAAY4"]
[Sat Feb 28 09:28:28.783878 2026] [:error] [pid 11791:tid 11793] [client 173.244.55.29:41965] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/file.php"] [unique_id "aaJEvGuX5e1Q32gqxH2dQwAAAQA"]
[Sat Feb 28 09:28:31.466709 2026] [:error] [pid 39185:tid 39257] [client 173.244.55.25:51953] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aaJEvxVE-FfM89u7BQblngAAAIs"]
[Sat Feb 28 09:28:34.626103 2026] [:error] [pid 52460:tid 52469] [client 173.244.55.22:32773] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/load.php"] [unique_id "aaJEwrLWOogAgHGh62RcTQAAAYY"]
[Sat Feb 28 09:28:35.520868 2026] [:error] [pid 39292:tid 39301] [client 173.244.55.29:31383] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aaJEw6IAO5fN7BxyqcF-AAAAAMc"]
[Sat Feb 28 09:28:36.414440 2026] [:error] [pid 39292:tid 39307] [client 173.244.55.25:58199] [client 173.244.55.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aaJExKIAO5fN7BxyqcF-BQAAAM0"]
[Sat Feb 28 09:28:42.670794 2026] [:error] [pid 39292:tid 39302] [client 173.244.55.21:50615] [client 173.244.55.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aaJEyqIAO5fN7BxyqcF-FgAAAMg"]
[Sat Feb 28 09:28:45.599562 2026] [:error] [pid 52460:tid 52482] [client 173.244.55.30:50739] [client 173.244.55.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aaJEzbLWOogAgHGh62RchwAAAZM"]
[Sat Feb 28 09:28:51.460731 2026] [:error] [pid 11791:tid 11813] [client 173.244.55.29:38883] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aaJE02uX5e1Q32gqxH2drwAAARQ"]
[Sat Feb 28 09:28:52.338940 2026] [:error] [pid 39185:tid 39249] [client 173.244.55.29:46605] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aaJE1BVE-FfM89u7BQbmVgAAAIM"]
[Sat Feb 28 09:28:55.023567 2026] [:error] [pid 11791:tid 11808] [client 173.244.55.28:36047] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aaJE12uX5e1Q32gqxH2dxQAAAQ8"]
[Sat Feb 28 09:29:09.350183 2026] [:error] [pid 11791:tid 11803] [client 173.244.55.22:47317] [client 173.244.55.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/system.php"] [unique_id "aaJE5WuX5e1Q32gqxH2eEQAAAQo"]
[Sat Feb 28 09:29:11.294765 2026] [:error] [pid 11791:tid 11812] [client 173.244.55.23:56871] [client 173.244.55.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aaJE52uX5e1Q32gqxH2eJQAAARM"]
[Sat Feb 28 09:29:15.597477 2026] [:error] [pid 39185:tid 39254] [client 173.244.55.28:40287] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aaJE6xVE-FfM89u7BQbnIwAAAIg"]
[Sat Feb 28 09:29:16.565698 2026] [:error] [pid 22194:tid 22208] [client 173.244.55.28:60907] [client 173.244.55.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aaJE7H6mbajs3bzQGyv9gQAAAUw"]
[Sat Feb 28 09:29:17.477973 2026] [:error] [pid 11791:tid 11811] [client 173.244.55.29:41933] [client 173.244.55.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aaJE7WuX5e1Q32gqxH2eTwAAARI"]
[Sat Feb 28 09:29:20.340685 2026] [autoindex:error] [pid 22194:tid 22207] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:20.798819 2026] [autoindex:error] [pid 22194:tid 22199] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:21.245020 2026] [autoindex:error] [pid 22194:tid 22210] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:21.700485 2026] [autoindex:error] [pid 22194:tid 22196] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:23.491001 2026] [autoindex:error] [pid 22194:tid 22209] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:23.950178 2026] [autoindex:error] [pid 22194:tid 22217] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:24.394159 2026] [autoindex:error] [pid 22194:tid 22207] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:24.913431 2026] [autoindex:error] [pid 22194:tid 22199] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:25.360128 2026] [autoindex:error] [pid 22194:tid 22210] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:25.804320 2026] [autoindex:error] [pid 22194:tid 22206] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:26.707851 2026] [autoindex:error] [pid 22194:tid 22217] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:28.172995 2026] [autoindex:error] [pid 22194:tid 22215] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:28.642214 2026] [autoindex:error] [pid 22194:tid 22211] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:32.553153 2026] [autoindex:error] [pid 22194:tid 22199] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:33.071727 2026] [autoindex:error] [pid 22194:tid 22210] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:33.539329 2026] [autoindex:error] [pid 22194:tid 22205] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:34.004250 2026] [autoindex:error] [pid 22194:tid 22211] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:35.638457 2026] [autoindex:error] [pid 22194:tid 22203] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:36.090318 2026] [autoindex:error] [pid 22194:tid 22216] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:37.695754 2026] [autoindex:error] [pid 22194:tid 22213] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:40.655353 2026] [autoindex:error] [pid 22194:tid 22219] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:41.105275 2026] [autoindex:error] [pid 22194:tid 22205] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:41.549944 2026] [autoindex:error] [pid 22194:tid 22211] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:45.768486 2026] [autoindex:error] [pid 22194:tid 22214] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:49.495821 2026] [autoindex:error] [pid 22194:tid 22204] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:51.065268 2026] [autoindex:error] [pid 22194:tid 22197] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:51.518196 2026] [autoindex:error] [pid 22194:tid 22218] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:52.855598 2026] [autoindex:error] [pid 22194:tid 22199] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:53.315088 2026] [autoindex:error] [pid 22194:tid 22213] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:53.762048 2026] [autoindex:error] [pid 22194:tid 22205] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:29:58.927406 2026] [autoindex:error] [pid 22194:tid 22201] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:30:33.806473 2026] [autoindex:error] [pid 22194:tid 22211] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:30:34.254322 2026] [autoindex:error] [pid 22194:tid 22213] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:30:34.702881 2026] [autoindex:error] [pid 22194:tid 22210] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:30:35.202881 2026] [autoindex:error] [pid 22194:tid 22205] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:30:38.123695 2026] [autoindex:error] [pid 22194:tid 22216] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:30:38.580208 2026] [autoindex:error] [pid 22194:tid 22212] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:30:40.307971 2026] [autoindex:error] [pid 22194:tid 22215] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:30:41.993411 2026] [autoindex:error] [pid 22194:tid 22205] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:30:42.440835 2026] [autoindex:error] [pid 22194:tid 22219] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:30:42.915610 2026] [autoindex:error] [pid 22194:tid 22220] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:30:44.814249 2026] [autoindex:error] [pid 22194:tid 22198] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:30:45.263531 2026] [autoindex:error] [pid 22194:tid 22203] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:30:45.722568 2026] [autoindex:error] [pid 22194:tid 22209] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:30:46.167803 2026] [autoindex:error] [pid 22194:tid 22197] [client 173.244.55.30:45737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:31:14.354493 2026] [autoindex:error] [pid 22194:tid 22217] [client 173.244.55.23:30471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:31:28.143353 2026] [autoindex:error] [pid 22194:tid 22216] [client 173.244.55.23:30471] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:31:35.225873 2026] [autoindex:error] [pid 22194:tid 22197] [client 173.244.55.23:30471] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:31:35.672086 2026] [autoindex:error] [pid 22194:tid 22204] [client 173.244.55.23:30471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:31:42.461956 2026] [autoindex:error] [pid 22194:tid 22212] [client 173.244.55.23:30471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:31:42.907116 2026] [autoindex:error] [pid 22194:tid 22200] [client 173.244.55.23:30471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:31:43.353511 2026] [autoindex:error] [pid 22194:tid 22201] [client 173.244.55.23:30471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:31:43.816344 2026] [autoindex:error] [pid 22194:tid 22214] [client 173.244.55.23:30471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:31:44.265688 2026] [autoindex:error] [pid 22194:tid 22219] [client 173.244.55.23:30471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:31:44.710332 2026] [autoindex:error] [pid 22194:tid 22196] [client 173.244.55.23:30471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:31:45.158533 2026] [autoindex:error] [pid 22194:tid 22197] [client 173.244.55.23:30471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:31:45.605877 2026] [autoindex:error] [pid 22194:tid 22204] [client 173.244.55.23:30471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:31:46.052186 2026] [autoindex:error] [pid 22194:tid 22210] [client 173.244.55.23:30471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:32:10.233598 2026] [autoindex:error] [pid 22194:tid 22210] [client 173.244.55.23:30471] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 09:40:58.024213 2026] [:error] [pid 11791:tid 11795] [client 43.153.86.78:37634] [client 43.153.86.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaJHqmuX5e1Q32gqxH2nhAAAAQI"]
[Sat Feb 28 11:07:09.303003 2026] [:error] [pid 39184:tid 39225] [client 1.15.52.154:51980] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaJb3VtZF9Zd_U7easDAVQAAAEY"]
[Sat Feb 28 12:08:28.842562 2026] [:error] [pid 52460:tid 52466] [client 80.71.233.30:57337] [client 80.71.233.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-content/plugins/wpgateway/readme.txt"] [unique_id "aaJqPLLWOogAgHGh62T9gwAAAYM"], referer: https://expressinteriors.com/
[Sat Feb 28 12:18:57.830315 2026] [:error] [pid 52460:tid 52467] [client 167.86.118.77:56261] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.86.118.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaJssbLWOogAgHGh62QHigAAAYQ"], referer: binance.com
[Sat Feb 28 12:19:07.321404 2026] [:error] [pid 22194:tid 22197] [client 167.86.118.77:56434] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJsu36mbajs3bzQGyszLwAAAUE"], referer: binance.com
[Sat Feb 28 12:19:17.511670 2026] [:error] [pid 52460:tid 52478] [client 167.86.118.77:56736] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJsxbLWOogAgHGh62QH2QAAAY8"]
[Sat Feb 28 12:19:17.511792 2026] [:error] [pid 52460:tid 52478] [client 167.86.118.77:56736] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 6"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJsxbLWOogAgHGh62QH2QAAAY8"]
[Sat Feb 28 12:19:22.976214 2026] [:error] [pid 22194:tid 22216] [client 167.86.118.77:56781] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJsyn6mbajs3bzQGyszOQAAAVQ"]
[Sat Feb 28 12:19:22.976356 2026] [:error] [pid 22194:tid 22216] [client 167.86.118.77:56781] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 6"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJsyn6mbajs3bzQGyszOQAAAVQ"]
[Sat Feb 28 12:19:24.520843 2026] [:error] [pid 22194:tid 22197] [client 167.86.118.77:56918] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJszH6mbajs3bzQGyszOwAAAUE"]
[Sat Feb 28 12:19:24.520977 2026] [:error] [pid 22194:tid 22197] [client 167.86.118.77:56918] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 9"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJszH6mbajs3bzQGyszOwAAAUE"]
[Sat Feb 28 12:19:25.723211 2026] [:error] [pid 39292:tid 39303] [client 167.86.118.77:56953] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJszaIAO5fN7BxyqcHCtwAAAMk"]
[Sat Feb 28 12:19:25.723376 2026] [:error] [pid 39292:tid 39303] [client 167.86.118.77:56953] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 7"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJszaIAO5fN7BxyqcHCtwAAAMk"]
[Sat Feb 28 12:19:31.993643 2026] [:error] [pid 39185:tid 39250] [client 167.86.118.77:56984] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs0xVE-FfM89u7BQaZgwAAAIQ"]
[Sat Feb 28 12:19:31.993775 2026] [:error] [pid 39185:tid 39250] [client 167.86.118.77:56984] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 10"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs0xVE-FfM89u7BQaZgwAAAIQ"]
[Sat Feb 28 12:19:33.805887 2026] [:error] [pid 52460:tid 52465] [client 167.86.118.77:57163] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs1bLWOogAgHGh62QIEQAAAYI"]
[Sat Feb 28 12:19:33.806088 2026] [:error] [pid 52460:tid 52465] [client 167.86.118.77:57163] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 9"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs1bLWOogAgHGh62QIEQAAAYI"]
[Sat Feb 28 12:19:36.664631 2026] [:error] [pid 39184:tid 39221] [client 167.86.118.77:57238] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs2FtZF9Zd_U7easDQxwAAAEI"]
[Sat Feb 28 12:19:36.664786 2026] [:error] [pid 39184:tid 39221] [client 167.86.118.77:57238] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs2FtZF9Zd_U7easDQxwAAAEI"]
[Sat Feb 28 12:19:39.015775 2026] [:error] [pid 11791:tid 11796] [client 167.86.118.77:57342] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs22uX5e1Q32gqxH0CUgAAAQM"]
[Sat Feb 28 12:19:39.015912 2026] [:error] [pid 11791:tid 11796] [client 167.86.118.77:57342] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs22uX5e1Q32gqxH0CUgAAAQM"]
[Sat Feb 28 12:19:40.523285 2026] [:error] [pid 39292:tid 39308] [client 167.86.118.77:57426] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs3KIAO5fN7BxyqcHCwwAAAM4"]
[Sat Feb 28 12:19:42.741996 2026] [:error] [pid 39185:tid 39259] [client 167.86.118.77:57510] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs3hVE-FfM89u7BQaZkAAAAI0"]
[Sat Feb 28 12:19:42.742119 2026] [:error] [pid 39185:tid 39259] [client 167.86.118.77:57510] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 8"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs3hVE-FfM89u7BQaZkAAAAI0"]
[Sat Feb 28 12:19:54.250001 2026] [:error] [pid 39185:tid 39253] [client 167.86.118.77:57547] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs6hVE-FfM89u7BQaZoQAAAIc"]
[Sat Feb 28 12:19:54.250111 2026] [:error] [pid 39185:tid 39253] [client 167.86.118.77:57547] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 8"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs6hVE-FfM89u7BQaZoQAAAIc"]
[Sat Feb 28 12:19:55.548987 2026] [:error] [pid 52460:tid 52478] [client 167.86.118.77:57862] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs67LWOogAgHGh62QIRgAAAY8"]
[Sat Feb 28 12:19:55.549153 2026] [:error] [pid 52460:tid 52478] [client 167.86.118.77:57862] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 8"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs67LWOogAgHGh62QIRgAAAY8"]
[Sat Feb 28 12:19:57.224334 2026] [:error] [pid 52460:tid 52471] [client 167.86.118.77:57926] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs7bLWOogAgHGh62QISQAAAYg"]
[Sat Feb 28 12:19:57.224515 2026] [:error] [pid 52460:tid 52471] [client 167.86.118.77:57926] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 10"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs7bLWOogAgHGh62QISQAAAYg"]
[Sat Feb 28 12:19:58.478045 2026] [:error] [pid 52460:tid 52475] [client 167.86.118.77:57962] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs7rLWOogAgHGh62QIUwAAAYw"]
[Sat Feb 28 12:19:58.478222 2026] [:error] [pid 52460:tid 52475] [client 167.86.118.77:57962] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 7"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs7rLWOogAgHGh62QIUwAAAYw"]
[Sat Feb 28 12:19:59.805940 2026] [:error] [pid 39185:tid 39267] [client 167.86.118.77:57992] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs7xVE-FfM89u7BQaZrgAAAJU"]
[Sat Feb 28 12:19:59.806090 2026] [:error] [pid 39185:tid 39267] [client 167.86.118.77:57992] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 6"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs7xVE-FfM89u7BQaZrgAAAJU"]
[Sat Feb 28 12:20:15.475981 2026] [:error] [pid 52460:tid 52479] [client 167.86.118.77:58187] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs_7LWOogAgHGh62QIiQAAAZA"]
[Sat Feb 28 12:20:15.476157 2026] [:error] [pid 52460:tid 52479] [client 167.86.118.77:58187] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 9"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJs_7LWOogAgHGh62QIiQAAAZA"]
[Sat Feb 28 12:20:27.096997 2026] [:error] [pid 52460:tid 52470] [client 167.86.118.77:58520] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtC7LWOogAgHGh62QIqgAAAYc"]
[Sat Feb 28 12:20:27.097111 2026] [:error] [pid 52460:tid 52470] [client 167.86.118.77:58520] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 7"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtC7LWOogAgHGh62QIqgAAAYc"]
[Sat Feb 28 12:20:39.075510 2026] [:error] [pid 39292:tid 39307] [client 167.86.118.77:58652] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtF6IAO5fN7BxyqcHC6wAAAM0"]
[Sat Feb 28 12:20:39.075647 2026] [:error] [pid 39292:tid 39307] [client 167.86.118.77:58652] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 10"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtF6IAO5fN7BxyqcHC6wAAAM0"]
[Sat Feb 28 12:20:40.898628 2026] [:error] [pid 52460:tid 52485] [client 167.86.118.77:58932] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtGLLWOogAgHGh62QIuwAAAZY"]
[Sat Feb 28 12:20:40.898727 2026] [:error] [pid 52460:tid 52485] [client 167.86.118.77:58932] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtGLLWOogAgHGh62QIuwAAAZY"]
[Sat Feb 28 12:20:42.695297 2026] [:error] [pid 39185:tid 39251] [client 167.86.118.77:59000] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtGhVE-FfM89u7BQaaJwAAAIU"]
[Sat Feb 28 12:20:42.695533 2026] [:error] [pid 39185:tid 39251] [client 167.86.118.77:59000] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 6"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtGhVE-FfM89u7BQaaJwAAAIU"]
[Sat Feb 28 12:20:44.957588 2026] [:error] [pid 39184:tid 39243] [client 167.86.118.77:59058] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtHFtZF9Zd_U7easDQ1gAAAFg"]
[Sat Feb 28 12:21:18.906868 2026] [:error] [pid 52460:tid 52478] [client 167.86.118.77:59994] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtPrLWOogAgHGh62QKIgAAAY8"]
[Sat Feb 28 12:21:18.907022 2026] [:error] [pid 52460:tid 52478] [client 167.86.118.77:59994] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 9"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtPrLWOogAgHGh62QKIgAAAY8"]
[Sat Feb 28 12:21:24.912730 2026] [:error] [pid 39184:tid 39229] [client 167.86.118.77:60162] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtRFtZF9Zd_U7easDQ8AAAAEo"]
[Sat Feb 28 12:21:24.912875 2026] [:error] [pid 39184:tid 39229] [client 167.86.118.77:60162] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 9"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtRFtZF9Zd_U7easDQ8AAAAEo"]
[Sat Feb 28 12:21:28.889895 2026] [:error] [pid 39185:tid 39269] [client 167.86.118.77:60253] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtSBVE-FfM89u7BQaarQAAAJc"]
[Sat Feb 28 12:21:28.890041 2026] [:error] [pid 39185:tid 39269] [client 167.86.118.77:60253] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtSBVE-FfM89u7BQaarQAAAJc"]
[Sat Feb 28 12:21:30.308673 2026] [:error] [pid 52460:tid 52474] [client 167.86.118.77:60319] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtSrLWOogAgHGh62QKnwAAAYs"]
[Sat Feb 28 12:21:30.308855 2026] [:error] [pid 52460:tid 52474] [client 167.86.118.77:60319] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 10"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtSrLWOogAgHGh62QKnwAAAYs"]
[Sat Feb 28 12:21:31.697109 2026] [:error] [pid 22194:tid 22214] [client 167.86.118.77:60358] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtS36mbajs3bzQGyszuQAAAVI"]
[Sat Feb 28 12:21:31.697292 2026] [:error] [pid 22194:tid 22214] [client 167.86.118.77:60358] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 7"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtS36mbajs3bzQGyszuQAAAVI"]
[Sat Feb 28 12:21:33.077152 2026] [:error] [pid 39292:tid 39301] [client 167.86.118.77:60399] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtTaIAO5fN7BxyqcHDHAAAAMc"]
[Sat Feb 28 12:21:36.835078 2026] [:error] [pid 52460:tid 52483] [client 167.86.118.77:60459] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtULLWOogAgHGh62QKuQAAAZQ"]
[Sat Feb 28 12:21:36.835208 2026] [:error] [pid 52460:tid 52483] [client 167.86.118.77:60459] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtULLWOogAgHGh62QKuQAAAZQ"]
[Sat Feb 28 12:21:38.602611 2026] [:error] [pid 39183:tid 39211] [client 167.86.118.77:60516] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtUhCf4HvhVePw3LbiIQAAABM"]
[Sat Feb 28 12:21:38.602731 2026] [:error] [pid 39183:tid 39211] [client 167.86.118.77:60516] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtUhCf4HvhVePw3LbiIQAAABM"]
[Sat Feb 28 12:21:40.072881 2026] [:error] [pid 39185:tid 39267] [client 167.86.118.77:60558] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtVBVE-FfM89u7BQaauwAAAJU"]
[Sat Feb 28 12:21:40.073051 2026] [:error] [pid 39185:tid 39267] [client 167.86.118.77:60558] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtVBVE-FfM89u7BQaauwAAAJU"]
[Sat Feb 28 12:21:41.629153 2026] [:error] [pid 22194:tid 22196] [client 167.86.118.77:60606] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtVX6mbajs3bzQGyszvQAAAUA"]
[Sat Feb 28 12:21:41.629315 2026] [:error] [pid 22194:tid 22196] [client 167.86.118.77:60606] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtVX6mbajs3bzQGyszvQAAAUA"]
[Sat Feb 28 12:21:44.011980 2026] [:error] [pid 39185:tid 39252] [client 167.86.118.77:60659] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtWBVE-FfM89u7BQaaxAAAAIY"]
[Sat Feb 28 12:21:44.012167 2026] [:error] [pid 39185:tid 39252] [client 167.86.118.77:60659] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtWBVE-FfM89u7BQaaxAAAAIY"]
[Sat Feb 28 12:21:46.279780 2026] [:error] [pid 11791:tid 11807] [client 167.86.118.77:60751] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtWmuX5e1Q32gqxH0DLwAAAQ4"]
[Sat Feb 28 12:21:46.279985 2026] [:error] [pid 11791:tid 11807] [client 167.86.118.77:60751] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 9"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtWmuX5e1Q32gqxH0DLwAAAQ4"]
[Sat Feb 28 12:21:47.535838 2026] [:error] [pid 52460:tid 52486] [client 167.86.118.77:60794] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtW7LWOogAgHGh62QKvgAAAZc"]
[Sat Feb 28 12:21:47.536024 2026] [:error] [pid 52460:tid 52486] [client 167.86.118.77:60794] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtW7LWOogAgHGh62QKvgAAAZc"]
[Sat Feb 28 12:21:49.921163 2026] [:error] [pid 39185:tid 39262] [client 167.86.118.77:60835] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtXRVE-FfM89u7BQaaygAAAJA"]
[Sat Feb 28 12:21:49.921270 2026] [:error] [pid 39185:tid 39262] [client 167.86.118.77:60835] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtXRVE-FfM89u7BQaaygAAAJA"]
[Sat Feb 28 12:21:52.752481 2026] [:error] [pid 39185:tid 39263] [client 167.86.118.77:60866] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtYBVE-FfM89u7BQaa2AAAAJE"]
[Sat Feb 28 12:21:52.752582 2026] [:error] [pid 39185:tid 39263] [client 167.86.118.77:60866] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 8"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtYBVE-FfM89u7BQaa2AAAAJE"]
[Sat Feb 28 12:21:53.923873 2026] [:error] [pid 11791:tid 11793] [client 167.86.118.77:60897] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtYWuX5e1Q32gqxH0DQAAAAQA"]
[Sat Feb 28 12:21:53.924014 2026] [:error] [pid 11791:tid 11793] [client 167.86.118.77:60897] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 10"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtYWuX5e1Q32gqxH0DQAAAAQA"]
[Sat Feb 28 12:21:55.635307 2026] [:error] [pid 52460:tid 52475] [client 167.86.118.77:60916] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtY7LWOogAgHGh62QKzwAAAYw"]
[Sat Feb 28 12:21:55.635537 2026] [:error] [pid 52460:tid 52475] [client 167.86.118.77:60916] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 10"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtY7LWOogAgHGh62QKzwAAAYw"]
[Sat Feb 28 12:21:57.058077 2026] [:error] [pid 52460:tid 52479] [client 167.86.118.77:60947] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtZbLWOogAgHGh62QK0wAAAZA"]
[Sat Feb 28 12:21:57.058249 2026] [:error] [pid 52460:tid 52479] [client 167.86.118.77:60947] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtZbLWOogAgHGh62QK0wAAAZA"]
[Sat Feb 28 12:21:58.477486 2026] [:error] [pid 39185:tid 39259] [client 167.86.118.77:61001] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtZhVE-FfM89u7BQaa4AAAAI0"]
[Sat Feb 28 12:21:58.477617 2026] [:error] [pid 39185:tid 39259] [client 167.86.118.77:61001] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtZhVE-FfM89u7BQaa4AAAAI0"]
[Sat Feb 28 12:21:59.922256 2026] [:error] [pid 22194:tid 22200] [client 167.86.118.77:61060] [client 167.86.118.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.86.118.77, incrementing ddos counter"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtZ36mbajs3bzQGyszxgAAAUQ"]
[Sat Feb 28 12:21:59.922418 2026] [:error] [pid 22194:tid 22200] [client 167.86.118.77:61060] [client 167.86.118.77] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.86.118.77, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaJtZ36mbajs3bzQGyszxgAAAUQ"]
[Sat Feb 28 14:00:51.392042 2026] [:error] [pid 11791:tid 11813] [client 43.167.236.228:45814] [client 43.167.236.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaKEk2uX5e1Q32gqxH032wAAARQ"]
[Sat Feb 28 14:11:55.553303 2026] [:error] [pid 52460:tid 52478] [client 20.63.83.113:31965] [client 20.63.83.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.63.83.113, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaKHK7LWOogAgHGh62RghQAAAY8"]
[Sat Feb 28 14:11:57.112281 2026] [:error] [pid 39185:tid 39252] [client 20.63.83.113:49813] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ynz.PhP7"] [unique_id "aaKHLRVE-FfM89u7BQYIxQAAAIY"]
[Sat Feb 28 14:11:57.529421 2026] [:error] [pid 39185:tid 39265] [client 20.63.83.113:58896] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ynz.PhP7"] [unique_id "aaKHLRVE-FfM89u7BQYIxwAAAJM"]
[Sat Feb 28 14:11:57.944404 2026] [:error] [pid 52460:tid 52463] [client 20.63.83.113:31936] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ynz.PhP7"] [unique_id "aaKHLbLWOogAgHGh62RgjAAAAYA"]
[Sat Feb 28 14:11:58.358208 2026] [:error] [pid 52460:tid 52472] [client 20.63.83.113:29619] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ynz.PhP7"] [unique_id "aaKHLrLWOogAgHGh62RgkQAAAYk"]
[Sat Feb 28 14:11:58.773845 2026] [:error] [pid 39185:tid 39258] [client 20.63.83.113:31970] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aaKHLhVE-FfM89u7BQYIzQAAAIw"]
[Sat Feb 28 14:11:59.189245 2026] [:error] [pid 39292:tid 39312] [client 20.63.83.113:31957] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aaKHL6IAO5fN7BxyqcHo-wAAANI"]
[Sat Feb 28 14:11:59.616938 2026] [:error] [pid 52460:tid 52479] [client 20.63.83.113:58912] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aaKHL7LWOogAgHGh62RgmgAAAZA"]
[Sat Feb 28 14:12:00.026942 2026] [:error] [pid 52460:tid 52468] [client 20.63.83.113:31988] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "aaKHMLLWOogAgHGh62RgoAAAAYU"]
[Sat Feb 28 14:12:00.438822 2026] [:error] [pid 39183:tid 39215] [client 20.63.83.113:42036] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/packed.php"] [unique_id "aaKHMBCf4HvhVePw3Lbz6wAAABc"]
[Sat Feb 28 14:12:00.849636 2026] [:error] [pid 39185:tid 39250] [client 20.63.83.113:42014] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/packed.php"] [unique_id "aaKHMBVE-FfM89u7BQYI0wAAAIQ"]
[Sat Feb 28 14:12:01.259252 2026] [:error] [pid 22194:tid 22209] [client 20.63.83.113:42038] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/packed.php"] [unique_id "aaKHMX6mbajs3bzQGytR5AAAAU0"]
[Sat Feb 28 14:12:01.674915 2026] [:error] [pid 39185:tid 39263] [client 20.63.83.113:60963] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/packed.php"] [unique_id "aaKHMRVE-FfM89u7BQYI3AAAAJE"]
[Sat Feb 28 14:12:02.086247 2026] [:error] [pid 39185:tid 39253] [client 20.63.83.113:24958] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aaKHMhVE-FfM89u7BQYI4AAAAIc"]
[Sat Feb 28 14:12:02.496665 2026] [:error] [pid 22194:tid 22215] [client 20.63.83.113:24920] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aaKHMn6mbajs3bzQGytR5QAAAVM"]
[Sat Feb 28 14:12:02.910970 2026] [:error] [pid 11791:tid 11814] [client 20.63.83.113:24896] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aaKHMmuX5e1Q32gqxH0-yQAAARU"]
[Sat Feb 28 14:12:03.324592 2026] [:error] [pid 39184:tid 39241] [client 20.63.83.113:42035] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "aaKHM1tZF9Zd_U7easDpgAAAAFY"]
[Sat Feb 28 14:12:03.735761 2026] [:error] [pid 39185:tid 39257] [client 20.63.83.113:42038] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ok.php"] [unique_id "aaKHMxVE-FfM89u7BQYI8AAAAIs"]
[Sat Feb 28 14:12:04.151293 2026] [:error] [pid 52460:tid 52467] [client 20.63.83.113:60964] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ok.php"] [unique_id "aaKHNLLWOogAgHGh62RgpwAAAYQ"]
[Sat Feb 28 14:12:04.592041 2026] [:error] [pid 39292:tid 39303] [client 20.63.83.113:60959] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ok.php"] [unique_id "aaKHNKIAO5fN7BxyqcHpCAAAAMk"]
[Sat Feb 28 14:12:05.005941 2026] [:error] [pid 39185:tid 39254] [client 20.63.83.113:63720] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ok.php"] [unique_id "aaKHNRVE-FfM89u7BQYI-QAAAIg"]
[Sat Feb 28 14:12:05.417318 2026] [:error] [pid 39185:tid 39258] [client 20.63.83.113:37773] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "aaKHNRVE-FfM89u7BQYI_gAAAIw"]
[Sat Feb 28 14:12:05.827452 2026] [:error] [pid 11791:tid 11801] [client 20.63.83.113:63696] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "aaKHNWuX5e1Q32gqxH0-zQAAAQg"]
[Sat Feb 28 14:12:06.239556 2026] [:error] [pid 39184:tid 39232] [client 20.63.83.113:60991] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "aaKHNltZF9Zd_U7easDpggAAAE0"]
[Sat Feb 28 14:12:06.663737 2026] [:error] [pid 11791:tid 11809] [client 20.63.83.113:60982] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "aaKHNmuX5e1Q32gqxH0-0QAAARA"]
[Sat Feb 28 14:12:07.087505 2026] [:error] [pid 52460:tid 52463] [client 20.63.83.113:37819] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pass.php"] [unique_id "aaKHN7LWOogAgHGh62RgrwAAAYA"]
[Sat Feb 28 14:12:07.511403 2026] [:error] [pid 22194:tid 22200] [client 20.63.83.113:64545] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pass.php"] [unique_id "aaKHN36mbajs3bzQGytR7AAAAUQ"]
[Sat Feb 28 14:12:07.924579 2026] [:error] [pid 11791:tid 11799] [client 20.63.83.113:60954] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pass.php"] [unique_id "aaKHN2uX5e1Q32gqxH0-0gAAAQY"]
[Sat Feb 28 14:12:08.336907 2026] [:error] [pid 39185:tid 39263] [client 20.63.83.113:60930] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pass.php"] [unique_id "aaKHOBVE-FfM89u7BQYJDgAAAJE"]
[Sat Feb 28 14:12:08.756314 2026] [:error] [pid 52460:tid 52472] [client 20.63.83.113:62739] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aaKHOLLWOogAgHGh62RgtQAAAYk"]
[Sat Feb 28 14:12:09.177878 2026] [:error] [pid 11791:tid 11795] [client 20.63.83.113:60599] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aaKHOWuX5e1Q32gqxH0-3AAAAQI"]
[Sat Feb 28 14:12:09.619625 2026] [:error] [pid 11791:tid 11808] [client 20.63.83.113:64529] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aaKHOWuX5e1Q32gqxH0-4AAAAQ8"]
[Sat Feb 28 14:12:10.073960 2026] [:error] [pid 52460:tid 52486] [client 20.63.83.113:60589] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aaKHOrLWOogAgHGh62RguAAAAZc"]
[Sat Feb 28 14:38:40.013207 2026] [:error] [pid 39292:tid 39294] [client 204.76.203.25:42872] [client 204.76.203.25] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aaKNcKIAO5fN7BxyqcHwdgAAAMA"]
[Sat Feb 28 14:39:19.833524 2026] [:error] [pid 39185:tid 39258] [client 13.71.191.191:64791] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaKNlxVE-FfM89u7BQYiewAAAIw"]
[Sat Feb 28 14:39:20.319059 2026] [:error] [pid 39185:tid 39250] [client 13.71.191.191:64193] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaKNmBVE-FfM89u7BQYiggAAAIQ"]
[Sat Feb 28 14:39:21.337548 2026] [:error] [pid 39185:tid 39256] [client 13.71.191.191:65363] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaKNmRVE-FfM89u7BQYiigAAAIo"]
[Sat Feb 28 14:39:22.130979 2026] [:error] [pid 22194:tid 22214] [client 13.71.191.191:65359] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaKNmn6mbajs3bzQGytZUQAAAVI"]
[Sat Feb 28 15:29:56.140775 2026] [:error] [pid 39185:tid 39268] [client 104.194.155.80:59286] [client 104.194.155.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aaKZdBVE-FfM89u7BQZY3AAAAJY"]
[Sat Feb 28 16:36:26.134551 2026] [:error] [pid 39184:tid 39235] [client 43.131.243.61:52066] [client 43.131.243.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaKpCltZF9Zd_U7easAkTAAAAFA"]
[Sat Feb 28 17:33:47.003289 2026] [:error] [pid 49763:tid 49781] [client 192.144.148.122:48460] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaK2e7THSOG_yf2PpqEdWQAAAc8"]
[Sat Feb 28 19:12:32.908626 2026] [:error] [pid 39183:tid 39196] [client 20.63.83.113:26013] [client 20.63.83.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.63.83.113, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaLNoBCf4HvhVePw3La08QAAAAQ"]
[Sat Feb 28 19:41:51.625117 2026] [:error] [pid 39183:tid 39203] [client 35.239.72.149:57419] [client 35.239.72.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.239.72.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaLUfxCf4HvhVePw3LbbtAAAAAs"]
[Sat Feb 28 19:41:53.935001 2026] [:error] [pid 39183:tid 39202] [client 35.239.72.149:57419] [client 35.239.72.149] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aaLUgRCf4HvhVePw3LbbyAAAAAo"]
[Sat Feb 28 19:41:54.176541 2026] [:error] [pid 39183:tid 39196] [client 35.239.72.149:57419] [client 35.239.72.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.239.72.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaLUghCf4HvhVePw3LbbyQAAAAQ"]
[Sat Feb 28 19:41:55.711889 2026] [:error] [pid 39185:tid 39249] [client 35.239.72.149:61061] [client 35.239.72.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.239.72.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaLUgxVE-FfM89u7BQaMVwAAAIM"]
[Sat Feb 28 19:41:57.301407 2026] [:error] [pid 49763:tid 49774] [client 35.239.72.149:60880] [client 35.239.72.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.239.72.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaLUhbTHSOG_yf2PpqHZpQAAAcg"]
[Sat Feb 28 19:41:58.856547 2026] [:error] [pid 49763:tid 49782] [client 35.239.72.149:50556] [client 35.239.72.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.239.72.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaLUhrTHSOG_yf2PpqHZrAAAAdA"]
[Sat Feb 28 19:42:00.366966 2026] [:error] [pid 22194:tid 22214] [client 35.239.72.149:49685] [client 35.239.72.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.239.72.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaLUiH6mbajs3bzQGyuRYwAAAVI"]
[Sat Feb 28 19:42:00.367113 2026] [:error] [pid 22194:tid 22214] [client 35.239.72.149:49685] [client 35.239.72.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.239.72.149, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaLUiH6mbajs3bzQGyuRYwAAAVI"]
[Sat Feb 28 19:43:40.315685 2026] [:error] [pid 39292:tid 39298] [client 170.106.180.153:58544] [client 170.106.180.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaLU7KIAO5fN7BxyqcFcUwAAAMQ"]
[Sat Feb 28 19:47:03.260740 2026] [:error] [pid 49763:tid 49775] [client 13.71.191.191:35824] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aaLVt7THSOG_yf2PpqHgxwAAAck"]
[Sat Feb 28 19:47:03.691507 2026] [:error] [pid 49763:tid 49781] [client 13.71.191.191:35784] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aaLVt7THSOG_yf2PpqHgyQAAAc8"]
[Sat Feb 28 19:47:04.105094 2026] [:error] [pid 39183:tid 39195] [client 13.71.191.191:35791] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aaLVuBCf4HvhVePw3LbiTgAAAAM"]
[Sat Feb 28 19:47:04.527462 2026] [:error] [pid 49763:tid 49785] [client 13.71.191.191:35793] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aaLVuLTHSOG_yf2PpqHgzQAAAdM"]
[Sat Feb 28 19:47:04.955226 2026] [:error] [pid 52460:tid 52486] [client 13.71.191.191:35813] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aaLVuLLWOogAgHGh62Q_rwAAAZc"]
[Sat Feb 28 19:47:05.389844 2026] [:error] [pid 22194:tid 22212] [client 13.71.191.191:35830] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aaLVuX6mbajs3bzQGyuS5gAAAVA"]
[Sat Feb 28 19:47:05.823584 2026] [:error] [pid 49763:tid 49767] [client 13.71.191.191:35721] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aaLVubTHSOG_yf2PpqHg0AAAAcE"]
[Sat Feb 28 19:47:06.243500 2026] [:error] [pid 39185:tid 39251] [client 13.71.191.191:35790] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aaLVuhVE-FfM89u7BQaNSwAAAIU"]
[Sat Feb 28 19:47:06.682998 2026] [:error] [pid 11791:tid 11807] [client 13.71.191.191:35801] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cxxuv.php"] [unique_id "aaLVumuX5e1Q32gqxH2tZAAAAQ4"]
[Sat Feb 28 19:47:07.104149 2026] [:error] [pid 39185:tid 39262] [client 13.71.191.191:35797] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cxxuv.php"] [unique_id "aaLVuxVE-FfM89u7BQaNTgAAAJA"]
[Sat Feb 28 19:47:07.537087 2026] [:error] [pid 49763:tid 49786] [client 13.71.191.191:35832] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cxxuv.php"] [unique_id "aaLVu7THSOG_yf2PpqHg1QAAAdQ"]
[Sat Feb 28 19:47:07.977040 2026] [:error] [pid 49763:tid 49770] [client 13.71.191.191:35797] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cxxuv.php"] [unique_id "aaLVu7THSOG_yf2PpqHg3QAAAcQ"]
[Sat Feb 28 19:47:08.422022 2026] [:error] [pid 52460:tid 52478] [client 13.71.191.191:35736] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "aaLVvLLWOogAgHGh62Q_wQAAAY8"]
[Sat Feb 28 19:47:08.939324 2026] [:error] [pid 49763:tid 49776] [client 13.71.191.191:35836] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "aaLVvLTHSOG_yf2PpqHg9gAAAco"]
[Sat Feb 28 19:47:09.395780 2026] [:error] [pid 49763:tid 49771] [client 13.71.191.191:35717] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "aaLVvbTHSOG_yf2PpqHg_gAAAcU"]
[Sat Feb 28 19:47:09.825867 2026] [:error] [pid 39183:tid 39216] [client 13.71.191.191:35835] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "aaLVvRCf4HvhVePw3LbigwAAABg"]
[Sat Feb 28 19:47:10.239198 2026] [:error] [pid 49763:tid 49778] [client 13.71.191.191:35723] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gi.php"] [unique_id "aaLVvrTHSOG_yf2PpqHhEQAAAcw"]
[Sat Feb 28 19:47:10.652033 2026] [:error] [pid 49763:tid 49787] [client 13.71.191.191:35720] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gi.php"] [unique_id "aaLVvrTHSOG_yf2PpqHhGAAAAdU"]
[Sat Feb 28 19:47:11.062043 2026] [:error] [pid 49763:tid 49775] [client 13.71.191.191:35805] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gi.php"] [unique_id "aaLVv7THSOG_yf2PpqHhGgAAAck"]
[Sat Feb 28 19:47:11.472872 2026] [:error] [pid 39183:tid 39216] [client 13.71.191.191:35651] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gi.php"] [unique_id "aaLVvxCf4HvhVePw3LbimAAAABg"]
[Sat Feb 28 19:47:11.886947 2026] [:error] [pid 39183:tid 39202] [client 13.71.191.191:35788] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e0v9e95c.php"] [unique_id "aaLVvxCf4HvhVePw3LbioQAAAAo"]
[Sat Feb 28 19:47:12.302726 2026] [:error] [pid 39292:tid 39296] [client 13.71.191.191:35810] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e0v9e95c.php"] [unique_id "aaLVwKIAO5fN7BxyqcFdcAAAAMI"]
[Sat Feb 28 19:47:12.716640 2026] [:error] [pid 49763:tid 49781] [client 13.71.191.191:35782] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e0v9e95c.php"] [unique_id "aaLVwLTHSOG_yf2PpqHhJwAAAc8"]
[Sat Feb 28 19:47:13.129506 2026] [:error] [pid 52460:tid 52473] [client 13.71.191.191:35731] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e0v9e95c.php"] [unique_id "aaLVwbLWOogAgHGh62Q_1AAAAYo"]
[Sat Feb 28 19:47:13.542352 2026] [:error] [pid 49763:tid 49767] [client 13.71.191.191:35814] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2gz1dxix.php"] [unique_id "aaLVwbTHSOG_yf2PpqHhLAAAAcE"]
[Sat Feb 28 19:47:13.967031 2026] [:error] [pid 52460:tid 52479] [client 13.71.191.191:35719] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2gz1dxix.php"] [unique_id "aaLVwbLWOogAgHGh62Q_2wAAAZA"]
[Sat Feb 28 19:47:14.400555 2026] [:error] [pid 52460:tid 52467] [client 13.71.191.191:35786] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2gz1dxix.php"] [unique_id "aaLVwrLWOogAgHGh62Q_3AAAAYQ"]
[Sat Feb 28 19:47:14.851288 2026] [:error] [pid 49763:tid 49790] [client 13.71.191.191:35807] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2gz1dxix.php"] [unique_id "aaLVwrTHSOG_yf2PpqHhLwAAAdg"]
[Sat Feb 28 19:47:15.288257 2026] [:error] [pid 39292:tid 39317] [client 13.71.191.191:35785] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws75.php"] [unique_id "aaLVw6IAO5fN7BxyqcFdcwAAANc"]
[Sat Feb 28 19:47:15.760655 2026] [:error] [pid 49763:tid 49773] [client 13.71.191.191:35819] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws75.php"] [unique_id "aaLVw7THSOG_yf2PpqHhMAAAAcc"]
[Sat Feb 28 19:47:16.183833 2026] [:error] [pid 49763:tid 49783] [client 13.71.191.191:35718] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws75.php"] [unique_id "aaLVxLTHSOG_yf2PpqHhMwAAAdE"]
[Sat Feb 28 19:47:16.614903 2026] [:error] [pid 49763:tid 49785] [client 13.71.191.191:35726] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws75.php"] [unique_id "aaLVxLTHSOG_yf2PpqHhOQAAAdM"]
[Sat Feb 28 19:47:17.030120 2026] [:error] [pid 49763:tid 49774] [client 13.71.191.191:35811] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws49.php"] [unique_id "aaLVxbTHSOG_yf2PpqHhPQAAAcg"]
[Sat Feb 28 19:47:17.453972 2026] [:error] [pid 39184:tid 39233] [client 13.71.191.191:35789] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws49.php"] [unique_id "aaLVxVtZF9Zd_U7easCRcgAAAE4"]
[Sat Feb 28 19:47:17.896186 2026] [:error] [pid 49763:tid 49774] [client 13.71.191.191:35722] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws49.php"] [unique_id "aaLVxbTHSOG_yf2PpqHhUAAAAcg"]
[Sat Feb 28 19:47:18.305312 2026] [:error] [pid 52460:tid 52466] [client 13.71.191.191:35771] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws49.php"] [unique_id "aaLVxrLWOogAgHGh62Q_9AAAAYM"]
[Sat Feb 28 19:47:18.764981 2026] [:error] [pid 49763:tid 49774] [client 13.71.191.191:35750] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aaLVxrTHSOG_yf2PpqHhYQAAAcg"]
[Sat Feb 28 19:47:19.189134 2026] [:error] [pid 49763:tid 49786] [client 13.71.191.191:35657] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aaLVx7THSOG_yf2PpqHhZwAAAdQ"]
[Sat Feb 28 19:47:19.634227 2026] [:error] [pid 39183:tid 39197] [client 13.71.191.191:35820] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aaLVxxCf4HvhVePw3Lbi1wAAAAU"]
[Sat Feb 28 19:47:20.055641 2026] [:error] [pid 52460:tid 52471] [client 13.71.191.191:35776] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aaLVyLLWOogAgHGh62Q_-gAAAYg"]
[Sat Feb 28 19:47:20.503926 2026] [:error] [pid 49763:tid 49772] [client 13.71.191.191:35822] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaLVyLTHSOG_yf2PpqHhegAAAcY"]
[Sat Feb 28 19:47:20.934001 2026] [:error] [pid 39184:tid 39232] [client 13.71.191.191:35823] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaLVyFtZF9Zd_U7easCRgQAAAE0"]
[Sat Feb 28 19:47:21.347903 2026] [:error] [pid 52460:tid 52468] [client 13.71.191.191:35716] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaLVybLWOogAgHGh62RAAAAAAYU"]
[Sat Feb 28 19:47:21.762882 2026] [:error] [pid 39183:tid 39212] [client 13.71.191.191:35730] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaLVyRCf4HvhVePw3Lbi6gAAABQ"]
[Sat Feb 28 19:47:22.187144 2026] [:error] [pid 11791:tid 11797] [client 13.71.191.191:35752] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-f.php"] [unique_id "aaLVymuX5e1Q32gqxH2tZgAAAQQ"]
[Sat Feb 28 19:47:22.629312 2026] [:error] [pid 39183:tid 39216] [client 13.71.191.191:35812] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-f.php"] [unique_id "aaLVyhCf4HvhVePw3Lbi8wAAABg"]
[Sat Feb 28 19:47:23.057636 2026] [:error] [pid 11791:tid 11793] [client 13.71.191.191:35713] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-f.php"] [unique_id "aaLVy2uX5e1Q32gqxH2tZwAAAQA"]
[Sat Feb 28 19:47:23.509565 2026] [:error] [pid 11791:tid 11802] [client 13.71.191.191:35795] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-f.php"] [unique_id "aaLVy2uX5e1Q32gqxH2taAAAAQk"]
[Sat Feb 28 19:47:23.946845 2026] [:error] [pid 52460:tid 52474] [client 13.71.191.191:35779] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aaLVy7LWOogAgHGh62RADwAAAYs"]
[Sat Feb 28 19:47:24.380652 2026] [:error] [pid 52460:tid 52468] [client 13.71.191.191:35678] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aaLVzLLWOogAgHGh62RAFAAAAYU"]
[Sat Feb 28 19:47:24.811821 2026] [:error] [pid 39183:tid 39201] [client 13.71.191.191:35773] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aaLVzBCf4HvhVePw3LbjBAAAAAk"]
[Sat Feb 28 19:47:25.242813 2026] [:error] [pid 49763:tid 49766] [client 13.71.191.191:35808] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aaLVzbTHSOG_yf2PpqHhogAAAcA"]
[Sat Feb 28 19:47:25.662253 2026] [:error] [pid 49763:tid 49776] [client 13.71.191.191:35818] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx78.php"] [unique_id "aaLVzbTHSOG_yf2PpqHhpwAAAco"]
[Sat Feb 28 19:47:26.090869 2026] [:error] [pid 49763:tid 49775] [client 13.71.191.191:35829] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx78.php"] [unique_id "aaLVzrTHSOG_yf2PpqHhsAAAAck"]
[Sat Feb 28 19:47:26.502295 2026] [:error] [pid 49763:tid 49790] [client 13.71.191.191:35756] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx78.php"] [unique_id "aaLVzrTHSOG_yf2PpqHhtwAAAdg"]
[Sat Feb 28 19:47:26.955730 2026] [:error] [pid 39183:tid 39204] [client 13.71.191.191:35806] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx78.php"] [unique_id "aaLVzhCf4HvhVePw3LbjDQAAAAw"]
[Sat Feb 28 19:47:27.374857 2026] [:error] [pid 39183:tid 39199] [client 13.71.191.191:35739] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaLVzxCf4HvhVePw3LbjEAAAAAc"]
[Sat Feb 28 19:47:27.792337 2026] [:error] [pid 39183:tid 39198] [client 13.71.191.191:35715] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaLVzxCf4HvhVePw3LbjEwAAAAY"]
[Sat Feb 28 19:47:28.203999 2026] [:error] [pid 49763:tid 49788] [client 13.71.191.191:35729] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaLV0LTHSOG_yf2PpqHhzgAAAdY"]
[Sat Feb 28 19:47:28.614201 2026] [:error] [pid 52460:tid 52463] [client 13.71.191.191:35754] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaLV0LLWOogAgHGh62RAJAAAAYA"]
[Sat Feb 28 19:47:29.024479 2026] [:error] [pid 39183:tid 39216] [client 13.71.191.191:35817] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0bb45ctt.php"] [unique_id "aaLV0RCf4HvhVePw3LbjGgAAABg"]
[Sat Feb 28 19:47:29.438313 2026] [:error] [pid 52460:tid 52473] [client 13.71.191.191:35714] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0bb45ctt.php"] [unique_id "aaLV0bLWOogAgHGh62RAJgAAAYo"]
[Sat Feb 28 19:47:29.875661 2026] [:error] [pid 49763:tid 49790] [client 13.71.191.191:35762] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0bb45ctt.php"] [unique_id "aaLV0bTHSOG_yf2PpqHh4QAAAdg"]
[Sat Feb 28 19:47:30.306408 2026] [:error] [pid 39292:tid 39296] [client 13.71.191.191:35838] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0bb45ctt.php"] [unique_id "aaLV0qIAO5fN7BxyqcFdfQAAAMI"]
[Sat Feb 28 19:47:30.719121 2026] [:error] [pid 49763:tid 49781] [client 13.71.191.191:35798] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "aaLV0rTHSOG_yf2PpqHh6wAAAc8"]
[Sat Feb 28 19:47:31.129083 2026] [:error] [pid 52460:tid 52474] [client 13.71.191.191:35800] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "aaLV07LWOogAgHGh62RAKwAAAYs"]
[Sat Feb 28 19:47:31.564288 2026] [:error] [pid 52460:tid 52478] [client 13.71.191.191:35728] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "aaLV07LWOogAgHGh62RALAAAAY8"]
[Sat Feb 28 19:47:31.981629 2026] [:error] [pid 39183:tid 39195] [client 13.71.191.191:35733] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "aaLV0xCf4HvhVePw3LbjMQAAAAM"]
[Sat Feb 28 19:47:32.401849 2026] [:error] [pid 39292:tid 39312] [client 13.71.191.191:35792] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "aaLV1KIAO5fN7BxyqcFdfgAAANI"]
[Sat Feb 28 19:47:32.815896 2026] [:error] [pid 39183:tid 39215] [client 13.71.191.191:35778] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "aaLV1BCf4HvhVePw3LbjNQAAABc"]
[Sat Feb 28 19:47:33.237449 2026] [:error] [pid 49763:tid 49781] [client 13.71.191.191:35650] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "aaLV1bTHSOG_yf2PpqHiBgAAAc8"]
[Sat Feb 28 19:47:33.655300 2026] [:error] [pid 49763:tid 49773] [client 13.71.191.191:35668] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "aaLV1bTHSOG_yf2PpqHiEAAAAcc"]
[Sat Feb 28 19:47:34.098331 2026] [:error] [pid 22194:tid 22214] [client 13.71.191.191:35837] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aaLV1n6mbajs3bzQGyuS_QAAAVI"]
[Sat Feb 28 19:47:34.521711 2026] [:error] [pid 49763:tid 49787] [client 13.71.191.191:35745] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aaLV1rTHSOG_yf2PpqHiIQAAAdU"]
[Sat Feb 28 19:47:34.943469 2026] [:error] [pid 39183:tid 39201] [client 13.71.191.191:35590] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aaLV1hCf4HvhVePw3LbjPwAAAAk"]
[Sat Feb 28 19:47:35.363617 2026] [:error] [pid 39183:tid 39207] [client 13.71.191.191:35761] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aaLV1xCf4HvhVePw3LbjRAAAAA8"]
[Sat Feb 28 19:47:35.782840 2026] [:error] [pid 49763:tid 49778] [client 13.71.191.191:35652] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aaLV17THSOG_yf2PpqHiLAAAAcw"]
[Sat Feb 28 19:47:36.210061 2026] [:error] [pid 49763:tid 49777] [client 13.71.191.191:35724] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aaLV2LTHSOG_yf2PpqHiNAAAAcs"]
[Sat Feb 28 19:47:36.639734 2026] [:error] [pid 52460:tid 52473] [client 13.71.191.191:35665] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aaLV2LLWOogAgHGh62RANAAAAYo"]
[Sat Feb 28 19:47:37.056136 2026] [:error] [pid 11791:tid 11798] [client 13.71.191.191:35734] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aaLV2WuX5e1Q32gqxH2tfQAAAQU"]
[Sat Feb 28 19:47:37.487296 2026] [:error] [pid 39292:tid 39308] [client 13.71.191.191:35727] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tt.php"] [unique_id "aaLV2aIAO5fN7BxyqcFdgAAAAM4"]
[Sat Feb 28 19:47:37.911065 2026] [:error] [pid 39184:tid 39241] [client 13.71.191.191:35774] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tt.php"] [unique_id "aaLV2VtZF9Zd_U7easCRxwAAAFY"]
[Sat Feb 28 19:47:38.343650 2026] [:error] [pid 39185:tid 39254] [client 13.71.191.191:35781] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tt.php"] [unique_id "aaLV2hVE-FfM89u7BQaNYgAAAIg"]
[Sat Feb 28 19:47:38.780887 2026] [:error] [pid 39184:tid 39237] [client 13.71.191.191:35666] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tt.php"] [unique_id "aaLV2ltZF9Zd_U7easCRzAAAAFI"]
[Sat Feb 28 19:47:39.204057 2026] [:error] [pid 39183:tid 39197] [client 13.71.191.191:35834] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/62ix02bk.php"] [unique_id "aaLV2xCf4HvhVePw3LbjWAAAAAU"]
[Sat Feb 28 19:47:39.653273 2026] [:error] [pid 49763:tid 49768] [client 13.71.191.191:35664] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/62ix02bk.php"] [unique_id "aaLV27THSOG_yf2PpqHiRgAAAcI"]
[Sat Feb 28 19:47:40.076098 2026] [:error] [pid 22194:tid 22204] [client 13.71.191.191:35740] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/62ix02bk.php"] [unique_id "aaLV3H6mbajs3bzQGyuS_gAAAUg"]
[Sat Feb 28 19:47:40.505902 2026] [:error] [pid 39292:tid 39310] [client 13.71.191.191:35760] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/62ix02bk.php"] [unique_id "aaLV3KIAO5fN7BxyqcFdiAAAANA"]
[Sat Feb 28 19:47:40.922745 2026] [:error] [pid 49763:tid 49784] [client 13.71.191.191:35599] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wdf.php"] [unique_id "aaLV3LTHSOG_yf2PpqHiTwAAAdI"]
[Sat Feb 28 19:47:41.334906 2026] [:error] [pid 39185:tid 39261] [client 13.71.191.191:35679] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wdf.php"] [unique_id "aaLV3RVE-FfM89u7BQaNawAAAI8"]
[Sat Feb 28 19:47:41.753380 2026] [:error] [pid 49763:tid 49781] [client 13.71.191.191:35749] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wdf.php"] [unique_id "aaLV3bTHSOG_yf2PpqHiVQAAAc8"]
[Sat Feb 28 19:47:42.173231 2026] [:error] [pid 49763:tid 49771] [client 13.71.191.191:35803] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wdf.php"] [unique_id "aaLV3rTHSOG_yf2PpqHiWAAAAcU"]
[Sat Feb 28 19:47:42.594782 2026] [:error] [pid 49763:tid 49785] [client 13.71.191.191:35660] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6ijmjpa.php"] [unique_id "aaLV3rTHSOG_yf2PpqHiXQAAAdM"]
[Sat Feb 28 19:47:43.012643 2026] [:error] [pid 52460:tid 52482] [client 13.71.191.191:35804] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6ijmjpa.php"] [unique_id "aaLV37LWOogAgHGh62RAOAAAAZM"]
[Sat Feb 28 19:47:43.439942 2026] [:error] [pid 52460:tid 52476] [client 13.71.191.191:35767] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6ijmjpa.php"] [unique_id "aaLV37LWOogAgHGh62RAPAAAAY0"]
[Sat Feb 28 19:47:43.852104 2026] [:error] [pid 49763:tid 49789] [client 13.71.191.191:35743] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6ijmjpa.php"] [unique_id "aaLV37THSOG_yf2PpqHiaAAAAdc"]
[Sat Feb 28 19:47:44.279848 2026] [:error] [pid 39292:tid 39313] [client 13.71.191.191:35775] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp_jVML8V37.php"] [unique_id "aaLV4KIAO5fN7BxyqcFdnAAAANM"]
[Sat Feb 28 19:47:44.731401 2026] [:error] [pid 49763:tid 49784] [client 13.71.191.191:35770] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp_jVML8V37.php"] [unique_id "aaLV4LTHSOG_yf2PpqHibwAAAdI"]
[Sat Feb 28 19:47:45.147655 2026] [:error] [pid 49763:tid 49782] [client 13.71.191.191:35702] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp_jVML8V37.php"] [unique_id "aaLV4bTHSOG_yf2PpqHicwAAAdA"]
[Sat Feb 28 19:47:45.585447 2026] [:error] [pid 52460:tid 52479] [client 13.71.191.191:35670] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp_jVML8V37.php"] [unique_id "aaLV4bLWOogAgHGh62RAQgAAAZA"]
[Sat Feb 28 19:47:46.006177 2026] [:error] [pid 52460:tid 52477] [client 13.71.191.191:35809] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4wj632p1.php"] [unique_id "aaLV4rLWOogAgHGh62RAQwAAAY4"]
[Sat Feb 28 19:47:46.455842 2026] [:error] [pid 49763:tid 49790] [client 13.71.191.191:35747] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4wj632p1.php"] [unique_id "aaLV4rTHSOG_yf2PpqHihgAAAdg"]
[Sat Feb 28 19:47:46.875424 2026] [:error] [pid 49763:tid 49773] [client 13.71.191.191:35677] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4wj632p1.php"] [unique_id "aaLV4rTHSOG_yf2PpqHiiQAAAcc"]
[Sat Feb 28 19:47:47.291305 2026] [:error] [pid 49763:tid 49768] [client 13.71.191.191:35799] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4wj632p1.php"] [unique_id "aaLV47THSOG_yf2PpqHijQAAAcI"]
[Sat Feb 28 19:47:47.735547 2026] [:error] [pid 39183:tid 39213] [client 13.71.191.191:35758] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws81.php"] [unique_id "aaLV4xCf4HvhVePw3LbjfAAAABU"]
[Sat Feb 28 19:47:48.197690 2026] [:error] [pid 39183:tid 39204] [client 13.71.191.191:35746] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws81.php"] [unique_id "aaLV5BCf4HvhVePw3LbjgQAAAAw"]
[Sat Feb 28 19:47:48.666586 2026] [:error] [pid 39292:tid 39295] [client 13.71.191.191:35586] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws81.php"] [unique_id "aaLV5KIAO5fN7BxyqcFdngAAAME"]
[Sat Feb 28 19:47:49.083060 2026] [:error] [pid 49763:tid 49778] [client 13.71.191.191:35661] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws81.php"] [unique_id "aaLV5bTHSOG_yf2PpqHimwAAAcw"]
[Sat Feb 28 19:47:49.550253 2026] [:error] [pid 49763:tid 49785] [client 13.71.191.191:35732] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e31hmf9b.php"] [unique_id "aaLV5bTHSOG_yf2PpqHipAAAAdM"]
[Sat Feb 28 19:47:49.990157 2026] [:error] [pid 49763:tid 49779] [client 13.71.191.191:35704] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e31hmf9b.php"] [unique_id "aaLV5bTHSOG_yf2PpqHiqQAAAc0"]
[Sat Feb 28 19:47:50.507593 2026] [:error] [pid 49763:tid 49773] [client 13.71.191.191:35751] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e31hmf9b.php"] [unique_id "aaLV5rTHSOG_yf2PpqHisAAAAcc"]
[Sat Feb 28 19:47:50.933351 2026] [:error] [pid 39185:tid 39249] [client 13.71.191.191:35783] [client 13.71.191.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e31hmf9b.php"] [unique_id "aaLV5hVE-FfM89u7BQaNdgAAAIM"]
[Sat Feb 28 21:32:23.662643 2026] [:error] [pid 49763:tid 49771] [client 20.63.96.246:49898] [client 20.63.96.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aaLuZ7THSOG_yf2PpqF98AAAAcU"]
[Sat Feb 28 21:32:27.900989 2026] [autoindex:error] [pid 52460:tid 52475] [client 20.63.96.246:33539] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 21:32:28.145542 2026] [proxy_fcgi:error] [pid 52460:tid 52463] [client 20.63.96.246:33539] AH01071: Got error 'Primary script unknown'
[Sat Feb 28 21:32:28.388022 2026] [autoindex:error] [pid 52460:tid 52468] [client 20.63.96.246:33539] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 21:32:28.651267 2026] [autoindex:error] [pid 52460:tid 52480] [client 20.63.96.246:33539] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 21:32:28.856301 2026] [:error] [pid 52460:tid 52487] [client 20.63.96.246:33539] [client 20.63.96.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.63.96.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaLubLLWOogAgHGh62STFAAAAZg"]
[Sat Feb 28 21:32:31.287081 2026] [autoindex:error] [pid 52460:tid 52476] [client 20.63.96.246:33539] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Feb 28 21:32:32.316267 2026] [:error] [pid 52460:tid 52468] [client 20.63.96.246:33539] [client 20.63.96.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aaLucLLWOogAgHGh62STJgAAAYU"]
[Sat Feb 28 21:32:33.412760 2026] [:error] [pid 49763:tid 49787] [client 20.63.96.246:63550] [client 20.63.96.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "aaLucbTHSOG_yf2PpqF-BwAAAdU"]
[Sat Feb 28 21:32:38.516201 2026] [:error] [pid 52460:tid 52476] [client 20.63.96.246:52910] [client 20.63.96.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aaLudrLWOogAgHGh62STUQAAAY0"]
[Sat Feb 28 21:32:39.764405 2026] [:error] [pid 49763:tid 49770] [client 20.63.96.246:32904] [client 20.63.96.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aaLud7THSOG_yf2PpqF-GwAAAcQ"]
[Sat Feb 28 21:32:41.020488 2026] [:error] [pid 49763:tid 49780] [client 20.63.96.246:63602] [client 20.63.96.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aaLuebTHSOG_yf2PpqF-IQAAAc4"]
[Sat Feb 28 21:32:42.088969 2026] [:error] [pid 49763:tid 49779] [client 20.63.96.246:63579] [client 20.63.96.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aaLuerTHSOG_yf2PpqF-LQAAAc0"]
[Sat Feb 28 21:46:48.032156 2026] [:error] [pid 39183:tid 39197] [client 43.165.67.57:52206] [client 43.165.67.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaLxyBCf4HvhVePw3LZhywAAAAU"]
[Sat Feb 28 22:51:16.250291 2026] [:error] [pid 39183:tid 39200] [client 20.220.13.5:50408] [client 20.220.13.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aaMA5BCf4HvhVePw3LasPAAAAAg"]
[Sat Feb 28 22:51:17.091532 2026] [:error] [pid 52460:tid 52479] [client 20.220.13.5:50444] [client 20.220.13.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aaMA5bLWOogAgHGh62TM0QAAAZA"]
[Sat Feb 28 22:51:17.923486 2026] [:error] [pid 49763:tid 49777] [client 20.220.13.5:50488] [client 20.220.13.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aaMA5bTHSOG_yf2PpqHoygAAAcs"]
[Sat Feb 28 22:51:18.768847 2026] [:error] [pid 39183:tid 39200] [client 20.220.13.5:50369] [client 20.220.13.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aaMA5hCf4HvhVePw3LasTQAAAAg"]
[Sat Feb 28 23:54:33.905775 2026] [:error] [pid 39185:tid 39266] [client 169.150.203.251:42190] [client 169.150.203.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.150.203.251, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaMPuRVE-FfM89u7BQbDFQAAAJQ"]
[Sat Feb 28 23:54:36.233134 2026] [:error] [pid 39185:tid 39248] [client 169.150.203.251:42190] [client 169.150.203.251] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aaMPvBVE-FfM89u7BQbDGAAAAII"]
[Sat Feb 28 23:54:36.390554 2026] [:error] [pid 39185:tid 39267] [client 169.150.203.251:42190] [client 169.150.203.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.150.203.251, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaMPvBVE-FfM89u7BQbDGQAAAJU"]
[Sat Feb 28 23:54:37.614446 2026] [:error] [pid 39183:tid 39205] [client 169.150.203.251:42202] [client 169.150.203.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.150.203.251, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaMPvRCf4HvhVePw3LYHvAAAAA0"]
[Sat Feb 28 23:54:38.794177 2026] [:error] [pid 39184:tid 39230] [client 169.150.203.251:42208] [client 169.150.203.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.150.203.251, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaMPvltZF9Zd_U7easAPCAAAAEs"]
[Sat Feb 28 23:54:39.996445 2026] [:error] [pid 39183:tid 39211] [client 169.150.203.251:42218] [client 169.150.203.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.150.203.251, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaMPvxCf4HvhVePw3LYH1QAAABM"]
[Sat Feb 28 23:54:41.177161 2026] [:error] [pid 49763:tid 49768] [client 169.150.203.251:42226] [client 169.150.203.251] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.150.203.251, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaMPwbTHSOG_yf2PpqEpcQAAAcI"]
[Sat Feb 28 23:54:41.177283 2026] [:error] [pid 49763:tid 49768] [client 169.150.203.251:42226] [client 169.150.203.251] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 169.150.203.251, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaMPwbTHSOG_yf2PpqEpcQAAAcI"]
[Sun Mar 01 00:07:45.000980 2026] [autoindex:error] [pid 49763:tid 49778] [client 84.247.187.54:57876] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Mar 01 00:23:45.952807 2026] [:error] [pid 31190:tid 31220] [client 40.85.222.96:48225] [client 40.85.222.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "aaMWkRfvwGOholYpM1E7hAAAAM4"]
[Sun Mar 01 00:24:04.292211 2026] [:error] [pid 31190:tid 31216] [client 40.85.222.96:48243] [client 40.85.222.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaMWpBfvwGOholYpM1E77wAAAMo"]
[Sun Mar 01 00:24:08.721353 2026] [:error] [pid 30795:tid 30824] [client 40.85.222.96:48206] [client 40.85.222.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaMWqGuI44IL94Zgti-kCgAAABA"]
[Sun Mar 01 00:24:44.873635 2026] [:error] [pid 31190:tid 31207] [client 40.85.222.96:48229] [client 40.85.222.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaMWzBfvwGOholYpM1E84gAAAME"]
[Sun Mar 01 00:24:54.058019 2026] [:error] [pid 31190:tid 31227] [client 40.85.222.96:48231] [client 40.85.222.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaMW1hfvwGOholYpM1E9KgAAANU"]
[Sun Mar 01 00:29:17.163571 2026] [:error] [pid 53600:tid 53604] [client 175.6.217.4:55654] [client 175.6.217.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaMX3Q2UMRAYWtDB23SlPQAAAQE"]
[Sun Mar 01 00:52:33.041403 2026] [:error] [pid 11920:tid 11928] [client 49.51.245.241:47130] [client 49.51.245.241] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaMdUSzLNJUKxvBorrBs1AAAAYQ"]
[Sun Mar 01 00:56:27.575847 2026] [:error] [pid 30797:tid 30873] [client 20.63.96.246:46290] [client 20.63.96.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "aaMeO_QmcmSQL-3rvLABQAAAAEI"]
[Sun Mar 01 00:56:29.526796 2026] [autoindex:error] [pid 7644:tid 7648] [client 20.63.96.246:34894] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 00:56:34.856109 2026] [autoindex:error] [pid 7644:tid 7664] [client 20.63.96.246:34894] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 00:56:35.066568 2026] [autoindex:error] [pid 7644:tid 7650] [client 20.63.96.246:34894] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/block/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 00:56:36.224580 2026] [:error] [pid 7644:tid 7659] [client 20.63.96.246:34894] [client 20.63.96.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaMeRPqeDUGmVAHX7VCP3wAAAU0"]
[Sun Mar 01 00:56:37.521786 2026] [:error] [pid 30798:tid 30911] [client 20.63.96.246:36304] [client 20.63.96.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/special.php"] [unique_id "aaMeRcBkD73gO8wTonZMCQAAAIw"]
[Sun Mar 01 00:56:39.432373 2026] [:error] [pid 31190:tid 31221] [client 20.63.96.246:36316] [client 20.63.96.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/special.php"] [unique_id "aaMeRxfvwGOholYpM1FemwAAAM8"]
[Sun Mar 01 00:56:41.270785 2026] [:error] [pid 11920:tid 11925] [client 20.63.96.246:21247] [client 20.63.96.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/special.php"] [unique_id "aaMeSSzLNJUKxvBorrB0bQAAAYE"]
[Sun Mar 01 00:56:42.929290 2026] [:error] [pid 30798:tid 30924] [client 20.63.96.246:57235] [client 20.63.96.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/special.php"] [unique_id "aaMeSsBkD73gO8wTonZMIAAAAJg"]
[Sun Mar 01 02:03:47.856524 2026] [:error] [pid 7644:tid 7662] [client 20.220.213.17:34523] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "aaMuA_qeDUGmVAHX7VCnGQAAAVA"]
[Sun Mar 01 02:03:48.287478 2026] [:error] [pid 11920:tid 11938] [client 20.220.213.17:35515] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "aaMuBCzLNJUKxvBorrDfPgAAAY4"]
[Sun Mar 01 02:03:48.697600 2026] [:error] [pid 11920:tid 11934] [client 20.220.213.17:38703] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "aaMuBCzLNJUKxvBorrDfQAAAAYo"]
[Sun Mar 01 02:03:49.119614 2026] [:error] [pid 11920:tid 11944] [client 20.220.213.17:42880] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "aaMuBSzLNJUKxvBorrDfRQAAAZQ"]
[Sun Mar 01 02:03:49.534725 2026] [:error] [pid 30798:tid 30900] [client 20.220.213.17:35512] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aaMuBcBkD73gO8wTonaS-AAAAIE"]
[Sun Mar 01 02:03:49.948035 2026] [:error] [pid 11920:tid 11926] [client 20.220.213.17:43091] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aaMuBSzLNJUKxvBorrDfSgAAAYI"]
[Sun Mar 01 02:03:50.367303 2026] [:error] [pid 11920:tid 11924] [client 20.220.213.17:38882] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aaMuBizLNJUKxvBorrDfTQAAAYA"]
[Sun Mar 01 02:03:50.783995 2026] [:error] [pid 30798:tid 30911] [client 20.220.213.17:37003] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aaMuBsBkD73gO8wTonaTAQAAAIw"]
[Sun Mar 01 02:03:51.203103 2026] [:error] [pid 30798:tid 30918] [client 20.220.213.17:35253] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lp6.php"] [unique_id "aaMuB8BkD73gO8wTonaTCAAAAJM"]
[Sun Mar 01 02:03:51.627822 2026] [:error] [pid 11920:tid 11936] [client 20.220.213.17:39372] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lp6.php"] [unique_id "aaMuByzLNJUKxvBorrDfUwAAAYw"]
[Sun Mar 01 02:03:52.045232 2026] [:error] [pid 30798:tid 30911] [client 20.220.213.17:38461] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lp6.php"] [unique_id "aaMuCMBkD73gO8wTonaTEAAAAIw"]
[Sun Mar 01 02:03:52.455141 2026] [:error] [pid 11920:tid 11926] [client 20.220.213.17:39288] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lp6.php"] [unique_id "aaMuCCzLNJUKxvBorrDfWwAAAYI"]
[Sun Mar 01 02:03:52.875187 2026] [:error] [pid 11920:tid 11928] [client 20.220.213.17:42924] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aaMuCCzLNJUKxvBorrDfXgAAAYQ"]
[Sun Mar 01 02:03:53.293486 2026] [:error] [pid 7644:tid 7647] [client 20.220.213.17:27483] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aaMuCfqeDUGmVAHX7VCnLQAAAUE"]
[Sun Mar 01 02:03:53.708509 2026] [:error] [pid 31190:tid 31217] [client 20.220.213.17:37048] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aaMuCRfvwGOholYpM1GUNwAAAMs"]
[Sun Mar 01 02:03:54.128045 2026] [:error] [pid 31190:tid 31207] [client 20.220.213.17:35931] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aaMuChfvwGOholYpM1GUOgAAAME"]
[Sun Mar 01 02:03:54.543046 2026] [:error] [pid 11920:tid 11944] [client 20.220.213.17:35233] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aaMuCizLNJUKxvBorrDfaAAAAZQ"]
[Sun Mar 01 02:03:54.961864 2026] [:error] [pid 30798:tid 30909] [client 20.220.213.17:37331] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aaMuCsBkD73gO8wTonaTIAAAAIo"]
[Sun Mar 01 02:03:55.384190 2026] [:error] [pid 11920:tid 11935] [client 20.220.213.17:39272] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aaMuCyzLNJUKxvBorrDfcwAAAYs"]
[Sun Mar 01 02:03:55.804915 2026] [:error] [pid 11920:tid 11930] [client 20.220.213.17:34542] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aaMuCyzLNJUKxvBorrDfdwAAAYY"]
[Sun Mar 01 02:03:56.218102 2026] [:error] [pid 30798:tid 30917] [client 20.220.213.17:38422] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aaMuDMBkD73gO8wTonaTLAAAAJI"]
[Sun Mar 01 02:03:56.632527 2026] [:error] [pid 31190:tid 31219] [client 20.220.213.17:38712] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aaMuDBfvwGOholYpM1GUPQAAAM0"]
[Sun Mar 01 02:03:57.050268 2026] [:error] [pid 7644:tid 7655] [client 20.220.213.17:41937] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aaMuDfqeDUGmVAHX7VCnPAAAAUk"]
[Sun Mar 01 02:03:57.464547 2026] [:error] [pid 7644:tid 7670] [client 20.220.213.17:38680] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aaMuDfqeDUGmVAHX7VCnQAAAAVg"]
[Sun Mar 01 02:03:57.877782 2026] [:error] [pid 30798:tid 30911] [client 20.220.213.17:35259] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aaMuDcBkD73gO8wTonaTNwAAAIw"]
[Sun Mar 01 02:03:58.292185 2026] [:error] [pid 31190:tid 31222] [client 20.220.213.17:35930] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aaMuDhfvwGOholYpM1GUQwAAANA"]
[Sun Mar 01 02:03:58.705947 2026] [:error] [pid 31190:tid 31209] [client 20.220.213.17:35963] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aaMuDhfvwGOholYpM1GURwAAAMM"]
[Sun Mar 01 02:03:59.126304 2026] [:error] [pid 11920:tid 11929] [client 20.220.213.17:42756] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aaMuDyzLNJUKxvBorrDflwAAAYU"]
[Sun Mar 01 02:03:59.540831 2026] [:error] [pid 53600:tid 53622] [client 20.220.213.17:39250] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aaMuDw2UMRAYWtDB23TtfQAAARM"]
[Sun Mar 01 02:03:59.950509 2026] [:error] [pid 53600:tid 53618] [client 20.220.213.17:39263] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aaMuDw2UMRAYWtDB23TtgAAAAQ8"]
[Sun Mar 01 02:04:00.366619 2026] [:error] [pid 11920:tid 11941] [client 20.220.213.17:39282] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aaMuECzLNJUKxvBorrDfpgAAAZE"]
[Sun Mar 01 02:04:00.783143 2026] [:error] [pid 30798:tid 30899] [client 20.220.213.17:35964] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aaMuEMBkD73gO8wTonaTRwAAAIA"]
[Sun Mar 01 02:04:01.201444 2026] [:error] [pid 30795:tid 30828] [client 20.220.213.17:42933] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aaMuEWuI44IL94Zgti_IUgAAABQ"]
[Sun Mar 01 02:04:01.617625 2026] [:error] [pid 53600:tid 53606] [client 20.220.213.17:42793] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aaMuEQ2UMRAYWtDB23TthAAAAQM"]
[Sun Mar 01 02:04:02.032816 2026] [:error] [pid 30798:tid 30904] [client 20.220.213.17:35702] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aaMuEsBkD73gO8wTonaTUAAAAIU"]
[Sun Mar 01 02:04:02.443753 2026] [:error] [pid 31190:tid 31228] [client 20.220.213.17:35918] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aaMuEhfvwGOholYpM1GUXQAAANY"]
[Sun Mar 01 02:04:02.863350 2026] [:error] [pid 53600:tid 53617] [client 20.220.213.17:34502] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cxxuv.php"] [unique_id "aaMuEg2UMRAYWtDB23TtiAAAAQ4"]
[Sun Mar 01 02:04:03.288349 2026] [:error] [pid 53600:tid 53610] [client 20.220.213.17:38430] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cxxuv.php"] [unique_id "aaMuEw2UMRAYWtDB23TtjAAAAQc"]
[Sun Mar 01 02:04:03.704307 2026] [:error] [pid 11920:tid 11924] [client 20.220.213.17:35813] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cxxuv.php"] [unique_id "aaMuEyzLNJUKxvBorrDfzgAAAYA"]
[Sun Mar 01 02:04:04.120055 2026] [:error] [pid 11920:tid 11933] [client 20.220.213.17:38432] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cxxuv.php"] [unique_id "aaMuFCzLNJUKxvBorrDf1gAAAYk"]
[Sun Mar 01 02:04:04.535554 2026] [:error] [pid 11920:tid 11924] [client 20.220.213.17:27497] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "aaMuFCzLNJUKxvBorrDf4AAAAYA"]
[Sun Mar 01 02:04:04.954284 2026] [:error] [pid 11920:tid 11932] [client 20.220.213.17:34518] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "aaMuFCzLNJUKxvBorrDf6gAAAYg"]
[Sun Mar 01 02:04:05.368519 2026] [:error] [pid 11920:tid 11924] [client 20.220.213.17:41940] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "aaMuFSzLNJUKxvBorrDf8wAAAYA"]
[Sun Mar 01 02:04:05.778709 2026] [:error] [pid 30798:tid 30901] [client 20.220.213.17:35904] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "aaMuFcBkD73gO8wTonaTXwAAAII"]
[Sun Mar 01 02:04:06.191840 2026] [:error] [pid 30798:tid 30900] [client 20.220.213.17:35909] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gi.php"] [unique_id "aaMuFsBkD73gO8wTonaTYQAAAIE"]
[Sun Mar 01 02:04:06.603064 2026] [:error] [pid 7644:tid 7661] [client 20.220.213.17:35933] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gi.php"] [unique_id "aaMuFvqeDUGmVAHX7VCnTQAAAU8"]
[Sun Mar 01 02:04:07.017333 2026] [:error] [pid 30798:tid 30908] [client 20.220.213.17:38874] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gi.php"] [unique_id "aaMuF8BkD73gO8wTonaTYwAAAIk"]
[Sun Mar 01 02:04:07.428259 2026] [:error] [pid 31190:tid 31224] [client 20.220.213.17:27506] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gi.php"] [unique_id "aaMuFxfvwGOholYpM1GUcgAAANI"]
[Sun Mar 01 02:04:07.842949 2026] [:error] [pid 31190:tid 31210] [client 20.220.213.17:37318] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e0v9e95c.php"] [unique_id "aaMuFxfvwGOholYpM1GUdQAAAMQ"]
[Sun Mar 01 02:04:08.259995 2026] [:error] [pid 30798:tid 30909] [client 20.220.213.17:41929] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e0v9e95c.php"] [unique_id "aaMuGMBkD73gO8wTonaTaAAAAIo"]
[Sun Mar 01 02:04:08.674602 2026] [:error] [pid 30798:tid 30923] [client 20.220.213.17:34528] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e0v9e95c.php"] [unique_id "aaMuGMBkD73gO8wTonaTbQAAAJc"]
[Sun Mar 01 02:04:09.093656 2026] [:error] [pid 30798:tid 30905] [client 20.220.213.17:38679] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e0v9e95c.php"] [unique_id "aaMuGcBkD73gO8wTonaTcwAAAIY"]
[Sun Mar 01 02:04:09.505474 2026] [:error] [pid 53600:tid 53626] [client 20.220.213.17:42764] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2gz1dxix.php"] [unique_id "aaMuGQ2UMRAYWtDB23TtlgAAARc"]
[Sun Mar 01 02:04:09.918406 2026] [:error] [pid 30797:tid 30893] [client 20.220.213.17:43425] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2gz1dxix.php"] [unique_id "aaMuGfQmcmSQL-3rvLAOawAAAFY"]
[Sun Mar 01 02:04:10.334136 2026] [:error] [pid 31190:tid 31224] [client 20.220.213.17:35228] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2gz1dxix.php"] [unique_id "aaMuGhfvwGOholYpM1GUhQAAANI"]
[Sun Mar 01 02:04:10.751402 2026] [:error] [pid 31190:tid 31210] [client 20.220.213.17:41934] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2gz1dxix.php"] [unique_id "aaMuGhfvwGOholYpM1GUiQAAAMQ"]
[Sun Mar 01 02:04:11.182764 2026] [:error] [pid 31190:tid 31222] [client 20.220.213.17:38858] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws75.php"] [unique_id "aaMuGxfvwGOholYpM1GUjwAAANA"]
[Sun Mar 01 02:04:11.600495 2026] [:error] [pid 30798:tid 30914] [client 20.220.213.17:38870] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws75.php"] [unique_id "aaMuG8BkD73gO8wTonaTfQAAAI8"]
[Sun Mar 01 02:04:12.014985 2026] [:error] [pid 11920:tid 11942] [client 20.220.213.17:35905] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws75.php"] [unique_id "aaMuHCzLNJUKxvBorrDgIAAAAZI"]
[Sun Mar 01 02:04:12.426759 2026] [:error] [pid 11920:tid 11927] [client 20.220.213.17:35252] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws75.php"] [unique_id "aaMuHCzLNJUKxvBorrDgIwAAAYM"]
[Sun Mar 01 02:04:12.839769 2026] [:error] [pid 11920:tid 11940] [client 20.220.213.17:35255] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws49.php"] [unique_id "aaMuHCzLNJUKxvBorrDgJwAAAZA"]
[Sun Mar 01 02:04:13.250405 2026] [:error] [pid 11920:tid 11926] [client 20.220.213.17:35456] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws49.php"] [unique_id "aaMuHSzLNJUKxvBorrDgKQAAAYI"]
[Sun Mar 01 02:04:13.667987 2026] [:error] [pid 31190:tid 31225] [client 20.220.213.17:39925] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws49.php"] [unique_id "aaMuHRfvwGOholYpM1GUoAAAANM"]
[Sun Mar 01 02:04:14.084612 2026] [:error] [pid 31190:tid 31206] [client 20.220.213.17:45279] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws49.php"] [unique_id "aaMuHhfvwGOholYpM1GUpgAAAMA"]
[Sun Mar 01 02:04:14.499818 2026] [:error] [pid 30798:tid 30902] [client 20.220.213.17:39401] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aaMuHsBkD73gO8wTonaTiwAAAIM"]
[Sun Mar 01 02:04:14.915413 2026] [:error] [pid 31190:tid 31226] [client 20.220.213.17:39415] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aaMuHhfvwGOholYpM1GUqQAAANQ"]
[Sun Mar 01 02:04:15.326238 2026] [:error] [pid 31190:tid 31221] [client 20.220.213.17:36064] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aaMuHxfvwGOholYpM1GUsAAAAM8"]
[Sun Mar 01 02:04:15.740454 2026] [:error] [pid 31190:tid 31208] [client 20.220.213.17:34510] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bak.php"] [unique_id "aaMuHxfvwGOholYpM1GUtAAAAMI"]
[Sun Mar 01 02:04:16.160667 2026] [:error] [pid 31190:tid 31220] [client 20.220.213.17:38902] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaMuIBfvwGOholYpM1GUuQAAAM4"]
[Sun Mar 01 02:04:16.577676 2026] [:error] [pid 31190:tid 31224] [client 20.220.213.17:27050] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaMuIBfvwGOholYpM1GUvQAAANI"]
[Sun Mar 01 02:04:16.991960 2026] [:error] [pid 11920:tid 11928] [client 20.220.213.17:40821] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaMuICzLNJUKxvBorrDgLwAAAYQ"]
[Sun Mar 01 02:04:17.401749 2026] [:error] [pid 31190:tid 31218] [client 20.220.213.17:35263] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Y5MxLiVO9nK.php"] [unique_id "aaMuIRfvwGOholYpM1GUxwAAAMw"]
[Sun Mar 01 02:04:17.815765 2026] [:error] [pid 11920:tid 11948] [client 20.220.213.17:27024] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-f.php"] [unique_id "aaMuISzLNJUKxvBorrDgMAAAAZg"]
[Sun Mar 01 02:04:18.232677 2026] [:error] [pid 11920:tid 11944] [client 20.220.213.17:39553] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-f.php"] [unique_id "aaMuIizLNJUKxvBorrDgNQAAAZQ"]
[Sun Mar 01 02:04:18.646097 2026] [:error] [pid 30795:tid 30816] [client 20.220.213.17:38849] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-f.php"] [unique_id "aaMuImuI44IL94Zgti_IZAAAAAg"]
[Sun Mar 01 02:04:19.062666 2026] [:error] [pid 53600:tid 53623] [client 20.220.213.17:36827] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-f.php"] [unique_id "aaMuIw2UMRAYWtDB23TtngAAARQ"]
[Sun Mar 01 02:04:19.493234 2026] [:error] [pid 30798:tid 30913] [client 20.220.213.17:42780] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aaMuI8BkD73gO8wTonaTnwAAAI4"]
[Sun Mar 01 02:04:19.902654 2026] [:error] [pid 30798:tid 30918] [client 20.220.213.17:27505] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aaMuI8BkD73gO8wTonaTowAAAJM"]
[Sun Mar 01 02:04:20.317982 2026] [:error] [pid 30798:tid 30901] [client 20.220.213.17:41978] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aaMuJMBkD73gO8wTonaTpwAAAII"]
[Sun Mar 01 02:04:20.730723 2026] [:error] [pid 30798:tid 30913] [client 20.220.213.17:42795] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aaMuJMBkD73gO8wTonaTsQAAAI4"]
[Sun Mar 01 02:04:21.151133 2026] [:error] [pid 30798:tid 30902] [client 20.220.213.17:36060] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx78.php"] [unique_id "aaMuJcBkD73gO8wTonaTugAAAIM"]
[Sun Mar 01 02:04:21.569621 2026] [:error] [pid 53600:tid 53620] [client 20.220.213.17:45254] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx78.php"] [unique_id "aaMuJQ2UMRAYWtDB23TtpgAAARE"]
[Sun Mar 01 02:04:21.986636 2026] [:error] [pid 30797:tid 30874] [client 20.220.213.17:39609] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx78.php"] [unique_id "aaMuJfQmcmSQL-3rvLAOcAAAAEM"]
[Sun Mar 01 02:04:22.401616 2026] [:error] [pid 11920:tid 11932] [client 20.220.213.17:26774] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx78.php"] [unique_id "aaMuJizLNJUKxvBorrDgPQAAAYg"]
[Sun Mar 01 02:04:22.960807 2026] [:error] [pid 11920:tid 11931] [client 20.220.213.17:41930] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaMuJizLNJUKxvBorrDgQAAAAYc"]
[Sun Mar 01 02:04:23.380009 2026] [:error] [pid 11920:tid 11945] [client 20.220.213.17:45302] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaMuJyzLNJUKxvBorrDgRwAAAZU"]
[Sun Mar 01 02:04:23.797282 2026] [:error] [pid 30798:tid 30913] [client 20.220.213.17:27012] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaMuJ8BkD73gO8wTonaT0QAAAI4"]
[Sun Mar 01 02:04:24.218071 2026] [:error] [pid 30798:tid 30912] [client 20.220.213.17:39513] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp_bqLC0MQe.php"] [unique_id "aaMuKMBkD73gO8wTonaT1gAAAI0"]
[Sun Mar 01 02:04:24.630750 2026] [:error] [pid 30798:tid 30921] [client 20.220.213.17:42330] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0bb45ctt.php"] [unique_id "aaMuKMBkD73gO8wTonaT2wAAAJU"]
[Sun Mar 01 02:04:25.045118 2026] [:error] [pid 30798:tid 30913] [client 20.220.213.17:26765] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0bb45ctt.php"] [unique_id "aaMuKcBkD73gO8wTonaT3wAAAI4"]
[Sun Mar 01 02:04:25.457341 2026] [:error] [pid 11920:tid 11944] [client 20.220.213.17:27421] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0bb45ctt.php"] [unique_id "aaMuKSzLNJUKxvBorrDgUQAAAZQ"]
[Sun Mar 01 02:04:25.866187 2026] [:error] [pid 11920:tid 11947] [client 20.220.213.17:40820] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0bb45ctt.php"] [unique_id "aaMuKSzLNJUKxvBorrDgVAAAAZc"]
[Sun Mar 01 02:04:26.277822 2026] [:error] [pid 11920:tid 11948] [client 20.220.213.17:42322] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "aaMuKizLNJUKxvBorrDgVgAAAZg"]
[Sun Mar 01 02:04:26.692308 2026] [:error] [pid 30795:tid 30809] [client 20.220.213.17:45251] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "aaMuKmuI44IL94Zgti_IbQAAAAE"]
[Sun Mar 01 02:04:27.111278 2026] [:error] [pid 30798:tid 30921] [client 20.220.213.17:27037] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "aaMuK8BkD73gO8wTonaT6wAAAJU"]
[Sun Mar 01 02:04:27.527514 2026] [:error] [pid 30795:tid 30831] [client 20.220.213.17:45950] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "aaMuK2uI44IL94Zgti_IbgAAABc"]
[Sun Mar 01 02:04:27.937507 2026] [:error] [pid 7644:tid 7646] [client 20.220.213.17:39366] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "aaMuK_qeDUGmVAHX7VCnZwAAAUA"]
[Sun Mar 01 02:04:28.355007 2026] [:error] [pid 11920:tid 11932] [client 20.220.213.17:45207] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "aaMuLCzLNJUKxvBorrDgYgAAAYg"]
[Sun Mar 01 02:04:28.770054 2026] [:error] [pid 7644:tid 7656] [client 20.220.213.17:39380] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "aaMuLPqeDUGmVAHX7VCnbQAAAUo"]
[Sun Mar 01 02:04:29.187469 2026] [:error] [pid 11920:tid 11945] [client 20.220.213.17:36104] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "aaMuLSzLNJUKxvBorrDgZwAAAZU"]
[Sun Mar 01 02:04:29.598443 2026] [:error] [pid 11920:tid 11929] [client 20.220.213.17:27413] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aaMuLSzLNJUKxvBorrDgbAAAAYU"]
[Sun Mar 01 02:04:30.015088 2026] [:error] [pid 53600:tid 53609] [client 20.220.213.17:26771] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aaMuLg2UMRAYWtDB23TttQAAAQY"]
[Sun Mar 01 02:04:30.432499 2026] [:error] [pid 11920:tid 11932] [client 20.220.213.17:40805] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aaMuLizLNJUKxvBorrDgcwAAAYg"]
[Sun Mar 01 02:04:30.846953 2026] [:error] [pid 30798:tid 30915] [client 20.220.213.17:36855] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aaMuLsBkD73gO8wTonaT-gAAAJA"]
[Sun Mar 01 02:04:31.270337 2026] [:error] [pid 11920:tid 11924] [client 20.220.213.17:27408] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aaMuLyzLNJUKxvBorrDgewAAAYA"]
[Sun Mar 01 02:04:31.684702 2026] [:error] [pid 11920:tid 11946] [client 20.220.213.17:27428] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aaMuLyzLNJUKxvBorrDgfwAAAZY"]
[Sun Mar 01 02:04:32.101606 2026] [:error] [pid 11920:tid 11942] [client 20.220.213.17:36033] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aaMuMCzLNJUKxvBorrDghwAAAZI"]
[Sun Mar 01 02:04:32.514812 2026] [:error] [pid 11920:tid 11925] [client 20.220.213.17:36510] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aaMuMCzLNJUKxvBorrDgjgAAAYE"]
[Sun Mar 01 02:04:32.927965 2026] [:error] [pid 11920:tid 11946] [client 20.220.213.17:26781] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tt.php"] [unique_id "aaMuMCzLNJUKxvBorrDgkwAAAZY"]
[Sun Mar 01 02:04:33.346984 2026] [:error] [pid 53600:tid 53627] [client 20.220.213.17:26810] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tt.php"] [unique_id "aaMuMQ2UMRAYWtDB23TtuwAAARg"]
[Sun Mar 01 02:04:33.761237 2026] [:error] [pid 11920:tid 11925] [client 20.220.213.17:36144] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tt.php"] [unique_id "aaMuMSzLNJUKxvBorrDgmwAAAYE"]
[Sun Mar 01 02:04:34.174992 2026] [:error] [pid 30798:tid 30921] [client 20.220.213.17:45896] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tt.php"] [unique_id "aaMuMsBkD73gO8wTonaUCgAAAJU"]
[Sun Mar 01 02:04:34.588933 2026] [:error] [pid 11920:tid 11942] [client 20.220.213.17:27031] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/62ix02bk.php"] [unique_id "aaMuMizLNJUKxvBorrDgowAAAZI"]
[Sun Mar 01 02:04:35.005682 2026] [:error] [pid 30798:tid 30923] [client 20.220.213.17:26803] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/62ix02bk.php"] [unique_id "aaMuM8BkD73gO8wTonaUEAAAAJc"]
[Sun Mar 01 02:04:35.425569 2026] [:error] [pid 7644:tid 7661] [client 20.220.213.17:39549] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/62ix02bk.php"] [unique_id "aaMuM_qeDUGmVAHX7VCndAAAAU8"]
[Sun Mar 01 02:04:35.842714 2026] [:error] [pid 30795:tid 30816] [client 20.220.213.17:39618] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/62ix02bk.php"] [unique_id "aaMuM2uI44IL94Zgti_IeAAAAAg"]
[Sun Mar 01 02:04:36.264070 2026] [:error] [pid 31190:tid 31221] [client 20.220.213.17:43649] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wdf.php"] [unique_id "aaMuNBfvwGOholYpM1GVDAAAAM8"]
[Sun Mar 01 02:04:36.681918 2026] [:error] [pid 7644:tid 7666] [client 20.220.213.17:45951] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wdf.php"] [unique_id "aaMuNPqeDUGmVAHX7VCndwAAAVQ"]
[Sun Mar 01 02:04:37.106317 2026] [:error] [pid 30797:tid 30886] [client 20.220.213.17:36150] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wdf.php"] [unique_id "aaMuNfQmcmSQL-3rvLAOdQAAAE8"]
[Sun Mar 01 02:04:37.518477 2026] [:error] [pid 30798:tid 30901] [client 20.220.213.17:43673] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wdf.php"] [unique_id "aaMuNcBkD73gO8wTonaUJQAAAII"]
[Sun Mar 01 02:04:37.929439 2026] [:error] [pid 11920:tid 11948] [client 20.220.213.17:32791] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6ijmjpa.php"] [unique_id "aaMuNSzLNJUKxvBorrDguQAAAZg"]
[Sun Mar 01 02:04:38.347364 2026] [:error] [pid 11920:tid 11947] [client 20.220.213.17:33319] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6ijmjpa.php"] [unique_id "aaMuNizLNJUKxvBorrDgwQAAAZc"]
[Sun Mar 01 02:04:38.768208 2026] [:error] [pid 11920:tid 11931] [client 20.220.213.17:44054] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6ijmjpa.php"] [unique_id "aaMuNizLNJUKxvBorrDgxgAAAYc"]
[Sun Mar 01 02:04:39.185408 2026] [:error] [pid 30798:tid 30908] [client 20.220.213.17:39639] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6ijmjpa.php"] [unique_id "aaMuN8BkD73gO8wTonaULAAAAIk"]
[Sun Mar 01 02:04:39.595059 2026] [:error] [pid 53600:tid 53624] [client 20.220.213.17:36099] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp_jVML8V37.php"] [unique_id "aaMuNw2UMRAYWtDB23TtvgAAARU"]
[Sun Mar 01 02:04:40.005721 2026] [:error] [pid 30798:tid 30917] [client 20.220.213.17:33304] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp_jVML8V37.php"] [unique_id "aaMuOMBkD73gO8wTonaUMQAAAJI"]
[Sun Mar 01 02:04:40.418896 2026] [:error] [pid 11920:tid 11936] [client 20.220.213.17:43213] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp_jVML8V37.php"] [unique_id "aaMuOCzLNJUKxvBorrDg2QAAAYw"]
[Sun Mar 01 02:04:40.829088 2026] [:error] [pid 11920:tid 11928] [client 20.220.213.17:43250] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp_jVML8V37.php"] [unique_id "aaMuOCzLNJUKxvBorrDg4QAAAYQ"]
[Sun Mar 01 02:04:41.257574 2026] [:error] [pid 30798:tid 30916] [client 20.220.213.17:43230] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4wj632p1.php"] [unique_id "aaMuOcBkD73gO8wTonaUPQAAAJE"]
[Sun Mar 01 02:04:41.673741 2026] [:error] [pid 30798:tid 30910] [client 20.220.213.17:36335] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4wj632p1.php"] [unique_id "aaMuOcBkD73gO8wTonaUPgAAAIs"]
[Sun Mar 01 02:04:42.084496 2026] [:error] [pid 30795:tid 30819] [client 20.220.213.17:40349] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4wj632p1.php"] [unique_id "aaMuOmuI44IL94Zgti_IfwAAAAs"]
[Sun Mar 01 02:04:42.500146 2026] [:error] [pid 11920:tid 11940] [client 20.220.213.17:36704] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4wj632p1.php"] [unique_id "aaMuOizLNJUKxvBorrDg9wAAAZA"]
[Sun Mar 01 02:04:42.913293 2026] [:error] [pid 30798:tid 30900] [client 20.220.213.17:39645] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws81.php"] [unique_id "aaMuOsBkD73gO8wTonaURwAAAIE"]
[Sun Mar 01 02:04:43.324206 2026] [:error] [pid 11920:tid 11942] [client 20.220.213.17:37751] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws81.php"] [unique_id "aaMuOyzLNJUKxvBorrDhAgAAAZI"]
[Sun Mar 01 02:04:43.735723 2026] [:error] [pid 11920:tid 11925] [client 20.220.213.17:37149] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws81.php"] [unique_id "aaMuOyzLNJUKxvBorrDhCQAAAYE"]
[Sun Mar 01 02:04:44.152705 2026] [:error] [pid 30798:tid 30907] [client 20.220.213.17:41122] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws81.php"] [unique_id "aaMuPMBkD73gO8wTonaUTwAAAIg"]
[Sun Mar 01 02:04:44.571194 2026] [:error] [pid 31190:tid 31211] [client 20.220.213.17:35074] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e31hmf9b.php"] [unique_id "aaMuPBfvwGOholYpM1GVFgAAAMU"]
[Sun Mar 01 02:04:44.989238 2026] [:error] [pid 11920:tid 11924] [client 20.220.213.17:36393] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e31hmf9b.php"] [unique_id "aaMuPCzLNJUKxvBorrDhFwAAAYA"]
[Sun Mar 01 02:04:45.405940 2026] [:error] [pid 11920:tid 11925] [client 20.220.213.17:36683] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e31hmf9b.php"] [unique_id "aaMuPSzLNJUKxvBorrDhHQAAAYE"]
[Sun Mar 01 02:04:45.816511 2026] [:error] [pid 30798:tid 30923] [client 20.220.213.17:40316] [client 20.220.213.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e31hmf9b.php"] [unique_id "aaMuPcBkD73gO8wTonaUWAAAAJc"]
[Sun Mar 01 02:30:37.553693 2026] [:error] [pid 53600:tid 53622] [client 20.220.13.5:50524] [client 20.220.13.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aaM0TQ2UMRAYWtDB23T34wAAARM"]
[Sun Mar 01 02:30:38.387036 2026] [:error] [pid 30798:tid 30908] [client 20.220.13.5:50530] [client 20.220.13.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aaM0TsBkD73gO8wTonavMgAAAIk"]
[Sun Mar 01 02:30:39.217098 2026] [:error] [pid 30798:tid 30911] [client 20.220.13.5:50559] [client 20.220.13.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aaM0T8BkD73gO8wTonavNwAAAIw"]
[Sun Mar 01 02:30:40.047721 2026] [:error] [pid 30798:tid 30909] [client 20.220.13.5:50517] [client 20.220.13.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aaM0UMBkD73gO8wTonavOgAAAIo"]
[Sun Mar 01 02:39:04.421965 2026] [:error] [pid 11920:tid 11929] [client 20.104.124.39:43137] [client 20.104.124.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaM2SCzLNJUKxvBorrAP5QAAAYU"]
[Sun Mar 01 02:39:05.543647 2026] [:error] [pid 53600:tid 53615] [client 20.104.124.39:43190] [client 20.104.124.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaM2SQ2UMRAYWtDB23T6CwAAAQw"]
[Sun Mar 01 02:39:06.960207 2026] [:error] [pid 53600:tid 53606] [client 20.104.124.39:43202] [client 20.104.124.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaM2Sg2UMRAYWtDB23T6DwAAAQM"]
[Sun Mar 01 02:39:08.216767 2026] [:error] [pid 11920:tid 11927] [client 20.104.124.39:43156] [client 20.104.124.39] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaM2TCzLNJUKxvBorrAP8QAAAYM"]
[Sun Mar 01 03:36:51.329107 2026] [:error] [pid 30798:tid 30920] [client 51.75.151.149:53965] [client 51.75.151.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.75.151.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaND08BkD73gO8wTonb2wgAAAJQ"]
[Sun Mar 01 03:45:19.530022 2026] [:error] [pid 10508:tid 10518] [client 51.75.151.149:50546] [client 51.75.151.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/cidaas-pro-master/composer.json"] [unique_id "aaNFz_nZ4Ocsz9vZs1Nf2QAAAMY"]
[Sun Mar 01 03:52:14.875222 2026] [:error] [pid 10292:tid 10399] [client 43.131.36.84:43892] [client 43.131.36.84] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaNHbgUd4thFAarmPH1-NwAAAEU"]
[Sun Mar 01 03:56:54.542671 2026] [:error] [pid 14637:tid 14652] [client 194.26.192.138:51976] [client 194.26.192.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "aaNIhqQVOOrpA69ImxnNTwAAAQo"]
[Sun Mar 01 03:56:55.099125 2026] [:error] [pid 14637:tid 14646] [client 194.26.192.138:63391] [client 194.26.192.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "aaNIh6QVOOrpA69ImxnNUQAAAQQ"]
[Sun Mar 01 03:56:55.756016 2026] [:error] [pid 10508:tid 10524] [client 194.26.192.138:60884] [client 194.26.192.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "aaNIh_nZ4Ocsz9vZs1NnvwAAAMw"]
[Sun Mar 01 03:56:59.879994 2026] [:error] [pid 14637:tid 14653] [client 194.26.192.138:65262] [client 194.26.192.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "aaNIi6QVOOrpA69ImxnNfgAAAQs"]
[Sun Mar 01 04:21:36.131294 2026] [:error] [pid 21159:tid 21224] [client 20.63.96.246:46322] [client 20.63.96.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.63.96.246, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "aaNOUOLi3ouy1NZIkgr_agAAAIM"]
[Sun Mar 01 04:21:39.636838 2026] [:error] [pid 21159:tid 21231] [client 20.63.96.246:46322] [client 20.63.96.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.63.96.246, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaNOU-Li3ouy1NZIkgr_eQAAAIo"]
[Sun Mar 01 04:21:41.061809 2026] [:error] [pid 21159:tid 21224] [client 20.63.96.246:46322] [client 20.63.96.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.63.96.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaNOVeLi3ouy1NZIkgr_fAAAAIM"]
[Sun Mar 01 04:21:42.104932 2026] [autoindex:error] [pid 21159:tid 21225] [client 20.63.96.246:46322] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 04:21:43.159794 2026] [:error] [pid 21159:tid 21236] [client 20.63.96.246:46322] [client 20.63.96.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aaNOV-Li3ouy1NZIkgr_hQAAAI8"]
[Sun Mar 01 04:21:44.681020 2026] [:error] [pid 21263:tid 21277] [client 20.63.96.246:61915] [client 20.63.96.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aaNOWNAxjzLvN1upBhmtWwAAAMo"]
[Sun Mar 01 04:21:45.740908 2026] [:error] [pid 21159:tid 21237] [client 20.63.96.246:33575] [client 20.63.96.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aaNOWeLi3ouy1NZIkgr_igAAAJA"]
[Sun Mar 01 04:21:54.314184 2026] [:error] [pid 21159:tid 21242] [client 20.63.96.246:25986] [client 20.63.96.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aaNOYuLi3ouy1NZIkgr_pAAAAJU"]
[Sun Mar 01 04:39:52.443780 2026] [:error] [pid 24576:tid 24597] [client 103.65.236.153:58579] [client 103.65.236.153] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aaNSmIvfb5CnctJh073HhQAAARE"]
[Sun Mar 01 04:39:52.681720 2026] [:error] [pid 24576:tid 24589] [client 103.65.236.153:58611] [client 103.65.236.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aaNSmIvfb5CnctJh073HhgAAAQo"]
[Sun Mar 01 05:58:50.737287 2026] [:error] [pid 24576:tid 24592] [client 185.193.157.189:38114] [client 185.193.157.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.193.157.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaNlGovfb5CnctJh070cKgAAAQw"]
[Sun Mar 01 05:58:53.409600 2026] [:error] [pid 24576:tid 24592] [client 185.193.157.189:38114] [client 185.193.157.189] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aaNlHYvfb5CnctJh070cMgAAAQw"]
[Sun Mar 01 05:58:53.558036 2026] [:error] [pid 24576:tid 24604] [client 185.193.157.189:38114] [client 185.193.157.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.193.157.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaNlHYvfb5CnctJh070cNQAAARg"]
[Sun Mar 01 05:58:54.813969 2026] [:error] [pid 8688:tid 8698] [client 185.193.157.189:37780] [client 185.193.157.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.193.157.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaNlHjHJ4Nn-RvulD0q01wAAAUg"]
[Sun Mar 01 05:58:56.303355 2026] [:error] [pid 8688:tid 8708] [client 185.193.157.189:37794] [client 185.193.157.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.193.157.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaNlIDHJ4Nn-RvulD0q03gAAAVI"]
[Sun Mar 01 05:58:57.518289 2026] [:error] [pid 8688:tid 8707] [client 185.193.157.189:37796] [client 185.193.157.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.193.157.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaNlITHJ4Nn-RvulD0q06AAAAVE"]
[Sun Mar 01 05:58:58.746683 2026] [:error] [pid 8688:tid 8704] [client 185.193.157.189:37802] [client 185.193.157.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.193.157.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaNlIjHJ4Nn-RvulD0q08AAAAU4"]
[Sun Mar 01 05:58:58.746877 2026] [:error] [pid 8688:tid 8704] [client 185.193.157.189:37802] [client 185.193.157.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 185.193.157.189, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaNlIjHJ4Nn-RvulD0q08AAAAU4"]
[Sun Mar 01 06:28:11.136524 2026] [:error] [pid 21159:tid 21226] [client 182.44.12.37:38711] [client 182.44.12.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaNr--Li3ouy1NZIkgo6NAAAAIU"]
[Sun Mar 01 09:40:38.608637 2026] [:error] [pid 21158:tid 21213] [client 20.104.206.150:38877] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaOZFjriSIe3-pWnbPb4dgAAAFQ"]
[Sun Mar 01 09:40:39.265001 2026] [:error] [pid 33767:tid 33788] [client 20.104.206.150:38907] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaOZF0GyeKe3MWsxvBj93AAAAhI"]
[Sun Mar 01 09:40:39.873859 2026] [:error] [pid 21159:tid 21228] [client 20.104.206.150:38793] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaOZF-Li3ouy1NZIkgo8nAAAAIc"]
[Sun Mar 01 09:40:40.563642 2026] [:error] [pid 35654:tid 35661] [client 20.104.206.150:38890] [client 20.104.206.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaOZGEIPeuEwCTirofJ2rAAAA8M"]
[Sun Mar 01 10:52:44.661818 2026] [:error] [pid 21263:tid 21290] [client 43.166.244.251:34276] [client 43.166.244.251] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaOp_NAxjzLvN1upBhkVqQAAANc"]
[Sun Mar 01 11:55:55.229258 2026] [:error] [pid 33229:tid 33251] [client 165.245.142.82:50213] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO4y3zT4c9ddlGE6FxiZQAAAZQ"]
[Sun Mar 01 11:56:02.716174 2026] [:error] [pid 33767:tid 33792] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaO40kGyeKe3MWsxvBgbEQAAAhY"], referer: https://wordpress.org/
[Sun Mar 01 11:56:03.939691 2026] [:error] [pid 33767:tid 33787] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO400GyeKe3MWsxvBgbEwAAAhE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:05.452057 2026] [:error] [pid 33767:tid 33789] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO41UGyeKe3MWsxvBgbFgAAAhM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:06.164354 2026] [:error] [pid 33767:tid 33770] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO41kGyeKe3MWsxvBgbGAAAAgA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:07.642467 2026] [:error] [pid 33767:tid 33787] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO410GyeKe3MWsxvBgbHAAAAhE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:08.340194 2026] [:error] [pid 33767:tid 33789] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO42EGyeKe3MWsxvBgbIAAAAhM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:09.770656 2026] [:error] [pid 33767:tid 33789] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO42UGyeKe3MWsxvBgbJgAAAhM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:10.448129 2026] [:error] [pid 33767:tid 33780] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO42kGyeKe3MWsxvBgbJwAAAgo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:11.874222 2026] [:error] [pid 33767:tid 33777] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO420GyeKe3MWsxvBgbMAAAAgc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:12.682169 2026] [:error] [pid 33767:tid 33792] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO43EGyeKe3MWsxvBgbNAAAAhY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:14.162900 2026] [:error] [pid 33767:tid 33790] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO43kGyeKe3MWsxvBgbPAAAAhQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:14.868082 2026] [:error] [pid 33767:tid 33792] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO43kGyeKe3MWsxvBgbPwAAAhY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:16.365085 2026] [:error] [pid 33767:tid 33794] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO44EGyeKe3MWsxvBgbSgAAAhg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:17.047802 2026] [:error] [pid 33767:tid 33777] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO44UGyeKe3MWsxvBgbTgAAAgc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:18.476761 2026] [:error] [pid 33767:tid 33779] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO44kGyeKe3MWsxvBgbWwAAAgk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:20.861845 2026] [:error] [pid 33767:tid 33779] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO45EGyeKe3MWsxvBgbZgAAAgk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:22.346224 2026] [:error] [pid 33767:tid 33781] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO45kGyeKe3MWsxvBgbaQAAAgs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:23.130588 2026] [:error] [pid 33767:tid 33792] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO450GyeKe3MWsxvBgbagAAAhY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:24.595880 2026] [:error] [pid 33767:tid 33777] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO46EGyeKe3MWsxvBgbbwAAAgc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:25.478510 2026] [:error] [pid 33767:tid 33779] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO46UGyeKe3MWsxvBgbdAAAAgk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:27.897826 2026] [:error] [pid 33767:tid 33781] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO460GyeKe3MWsxvBgbhAAAAgs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:28.672780 2026] [:error] [pid 33767:tid 33789] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO47EGyeKe3MWsxvBgbiAAAAhM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:30.111261 2026] [:error] [pid 33767:tid 33777] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO47kGyeKe3MWsxvBgbjQAAAgc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:30.895026 2026] [:error] [pid 33767:tid 33781] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO47kGyeKe3MWsxvBgbjwAAAgs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:32.467185 2026] [:error] [pid 33767:tid 33777] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO48EGyeKe3MWsxvBgbkwAAAgc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:33.692283 2026] [:error] [pid 33767:tid 33777] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO48UGyeKe3MWsxvBgblgAAAgc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:35.180893 2026] [:error] [pid 33767:tid 33787] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO480GyeKe3MWsxvBgbmgAAAhE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:35.955029 2026] [:error] [pid 33767:tid 33780] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO480GyeKe3MWsxvBgbngAAAgo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:38.488902 2026] [:error] [pid 33767:tid 33779] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO49kGyeKe3MWsxvBgbogAAAgk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:39.171493 2026] [:error] [pid 33767:tid 33781] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO490GyeKe3MWsxvBgbowAAAgs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:42.462615 2026] [:error] [pid 33767:tid 33780] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO4-kGyeKe3MWsxvBgbqAAAAgo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:43.199608 2026] [:error] [pid 33767:tid 33790] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO4-0GyeKe3MWsxvBgbqQAAAhQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:44.666640 2026] [:error] [pid 33767:tid 33779] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO4_EGyeKe3MWsxvBgbqwAAAgk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:45.375542 2026] [:error] [pid 33767:tid 33787] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO4_UGyeKe3MWsxvBgbrAAAAhE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:46.811803 2026] [:error] [pid 33767:tid 33777] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO4_kGyeKe3MWsxvBgbrwAAAgc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:47.517259 2026] [:error] [pid 33767:tid 33789] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO4_0GyeKe3MWsxvBgbsAAAAhM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:48.998846 2026] [:error] [pid 33767:tid 33792] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5AEGyeKe3MWsxvBgbsgAAAhY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:49.722617 2026] [:error] [pid 33767:tid 33794] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5AUGyeKe3MWsxvBgbtgAAAhg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:51.173521 2026] [:error] [pid 33767:tid 33792] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5A0GyeKe3MWsxvBgbvgAAAhY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:51.874489 2026] [:error] [pid 33767:tid 33787] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5A0GyeKe3MWsxvBgbwwAAAhE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:53.352715 2026] [:error] [pid 33767:tid 33789] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5BUGyeKe3MWsxvBgbywAAAhM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:54.928094 2026] [:error] [pid 33767:tid 33789] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5BkGyeKe3MWsxvBgb1AAAAhM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:56.655372 2026] [:error] [pid 33767:tid 33792] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5CEGyeKe3MWsxvBgb3AAAAhY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:57.491499 2026] [:error] [pid 33767:tid 33789] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5CUGyeKe3MWsxvBgb4gAAAhM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:56:59.263223 2026] [:error] [pid 33767:tid 33777] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5C0GyeKe3MWsxvBgb6gAAAgc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:00.046796 2026] [:error] [pid 33767:tid 33770] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5DEGyeKe3MWsxvBgb7AAAAgA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:01.754347 2026] [:error] [pid 33767:tid 33780] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5DUGyeKe3MWsxvBgb7wAAAgo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:02.608703 2026] [:error] [pid 33767:tid 33792] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5DkGyeKe3MWsxvBgb8QAAAhY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:04.175513 2026] [:error] [pid 33767:tid 33794] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5EEGyeKe3MWsxvBgb9wAAAhg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:04.934096 2026] [:error] [pid 33767:tid 33780] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5EEGyeKe3MWsxvBgb-AAAAgo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:06.731286 2026] [:error] [pid 33767:tid 33779] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5EkGyeKe3MWsxvBgcAAAAAgk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:07.523264 2026] [:error] [pid 33767:tid 33787] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5E0GyeKe3MWsxvBgcAQAAAhE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:09.143722 2026] [:error] [pid 33767:tid 33777] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5FUGyeKe3MWsxvBgcBQAAAgc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:10.053336 2026] [:error] [pid 33767:tid 33794] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5FkGyeKe3MWsxvBgcBgAAAhg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:11.920981 2026] [:error] [pid 33767:tid 33779] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5F0GyeKe3MWsxvBgcCAAAAgk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:12.673427 2026] [:error] [pid 33767:tid 33787] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5GEGyeKe3MWsxvBgcCgAAAhE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:14.760485 2026] [:error] [pid 33767:tid 33779] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5GkGyeKe3MWsxvBgcEQAAAgk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:15.532509 2026] [:error] [pid 33767:tid 33792] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5G0GyeKe3MWsxvBgcEgAAAhY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:17.085068 2026] [:error] [pid 33767:tid 33779] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5HUGyeKe3MWsxvBgcJwAAAgk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:17.920710 2026] [:error] [pid 33767:tid 33790] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5HUGyeKe3MWsxvBgcNAAAAhQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:19.744307 2026] [:error] [pid 33767:tid 33789] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5H0GyeKe3MWsxvBgcRwAAAhM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:20.676440 2026] [:error] [pid 33767:tid 33790] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5IEGyeKe3MWsxvBgcTQAAAhQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:22.249942 2026] [:error] [pid 33767:tid 33777] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5IkGyeKe3MWsxvBgcVwAAAgc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:22.950829 2026] [:error] [pid 33767:tid 33789] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5IkGyeKe3MWsxvBgcWQAAAhM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:24.430279 2026] [:error] [pid 33767:tid 33780] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5JEGyeKe3MWsxvBgcXQAAAgo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:25.136151 2026] [:error] [pid 33767:tid 33794] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5JUGyeKe3MWsxvBgcXgAAAhg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:26.701637 2026] [:error] [pid 33767:tid 33777] [client 165.245.142.82:51766] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5JkGyeKe3MWsxvBgcYgAAAgc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:27.991058 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:57374] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5J-Li3ouy1NZIkgpYEAAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:30.037089 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5KuLi3ouy1NZIkgpYGAAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:30.730846 2026] [:error] [pid 21159:tid 21242] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5KuLi3ouy1NZIkgpYIAAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:32.161382 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5LOLi3ouy1NZIkgpYJwAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:32.855916 2026] [:error] [pid 21159:tid 21242] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5LOLi3ouy1NZIkgpYKAAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:34.333976 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5LuLi3ouy1NZIkgpYLgAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:35.056781 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5L-Li3ouy1NZIkgpYMQAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:36.471555 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5MOLi3ouy1NZIkgpYOAAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:37.323329 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5MeLi3ouy1NZIkgpYPAAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:38.793845 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5MuLi3ouy1NZIkgpYSQAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:39.528106 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5M-Li3ouy1NZIkgpYSgAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:41.007248 2026] [:error] [pid 21159:tid 21242] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5NeLi3ouy1NZIkgpYTAAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:41.718975 2026] [:error] [pid 21159:tid 21242] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5NeLi3ouy1NZIkgpYTgAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:43.163368 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5N-Li3ouy1NZIkgpYWwAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:43.859801 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5N-Li3ouy1NZIkgpYXAAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:45.346698 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5OeLi3ouy1NZIkgpYYAAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:46.071898 2026] [:error] [pid 21159:tid 21242] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5OuLi3ouy1NZIkgpYYQAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:47.608592 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5O-Li3ouy1NZIkgpYZwAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:48.333083 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5POLi3ouy1NZIkgpYaAAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:49.778822 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5PeLi3ouy1NZIkgpYbQAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:50.542751 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5PuLi3ouy1NZIkgpYcwAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:52.146810 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5QOLi3ouy1NZIkgpYegAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:52.875016 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5QOLi3ouy1NZIkgpYfgAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:54.332533 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5QuLi3ouy1NZIkgpYgwAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:55.040112 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5Q-Li3ouy1NZIkgpYhwAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:56.622090 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5ROLi3ouy1NZIkgpYigAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:57.315402 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5ReLi3ouy1NZIkgpYiwAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:57:58.847274 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5RuLi3ouy1NZIkgpYkAAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:00.961548 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5SOLi3ouy1NZIkgpYkQAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:02.616574 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5SuLi3ouy1NZIkgpYlAAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:03.355719 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5S-Li3ouy1NZIkgpYlgAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:04.865327 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5TOLi3ouy1NZIkgpYmAAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:05.639222 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:57599] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5TeLi3ouy1NZIkgpYmQAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:07.869150 2026] [:error] [pid 34286:tid 34310] [client 165.245.142.82:49278] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5T3PFxpCIhHW6XmmwfQAAApY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:08.645078 2026] [:error] [pid 34286:tid 34310] [client 165.245.142.82:49278] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5UHPFxpCIhHW6XmmwfgAAApY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:10.879237 2026] [:error] [pid 21263:tid 21275] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5UtAxjzLvN1upBhko-QAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:11.601405 2026] [:error] [pid 21263:tid 21283] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5U9AxjzLvN1upBhko-gAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:13.038656 2026] [:error] [pid 21263:tid 21279] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5VdAxjzLvN1upBhko_AAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:13.753152 2026] [:error] [pid 21263:tid 21282] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5VdAxjzLvN1upBhko_gAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:15.220739 2026] [:error] [pid 21263:tid 21273] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5V9AxjzLvN1upBhkpAAAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:15.925446 2026] [:error] [pid 21263:tid 21267] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5V9AxjzLvN1upBhkpAQAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:17.421931 2026] [:error] [pid 21263:tid 21290] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5WdAxjzLvN1upBhkpAwAAANc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:18.210856 2026] [:error] [pid 21263:tid 21283] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5WtAxjzLvN1upBhkpBAAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:19.779180 2026] [:error] [pid 21263:tid 21279] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5W9AxjzLvN1upBhkpBwAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:22.284090 2026] [:error] [pid 21263:tid 21279] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5XtAxjzLvN1upBhkpCAAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:23.801260 2026] [:error] [pid 21263:tid 21278] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5X9AxjzLvN1upBhkpCgAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:24.555024 2026] [:error] [pid 21263:tid 21273] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5YNAxjzLvN1upBhkpCwAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:26.056032 2026] [:error] [pid 21263:tid 21287] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5YtAxjzLvN1upBhkpDQAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:26.772004 2026] [:error] [pid 21263:tid 21290] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5YtAxjzLvN1upBhkpDgAAANc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:28.217258 2026] [:error] [pid 21263:tid 21271] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5ZNAxjzLvN1upBhkpEAAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:28.931234 2026] [:error] [pid 21263:tid 21283] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5ZNAxjzLvN1upBhkpEQAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:30.362611 2026] [:error] [pid 21263:tid 21278] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5ZtAxjzLvN1upBhkpFQAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:31.057887 2026] [:error] [pid 21263:tid 21273] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5Z9AxjzLvN1upBhkpFgAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:32.487583 2026] [:error] [pid 21263:tid 21290] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5aNAxjzLvN1upBhkpGQAAANc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:33.164998 2026] [:error] [pid 21263:tid 21271] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5adAxjzLvN1upBhkpGgAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:34.582878 2026] [:error] [pid 21263:tid 21291] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5atAxjzLvN1upBhkpHQAAANg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:35.275548 2026] [:error] [pid 21263:tid 21278] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5a9AxjzLvN1upBhkpHgAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:36.687142 2026] [:error] [pid 21263:tid 21273] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5bNAxjzLvN1upBhkpIAAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:37.417666 2026] [:error] [pid 21263:tid 21267] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5bdAxjzLvN1upBhkpIQAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:38.877211 2026] [:error] [pid 21263:tid 21283] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5btAxjzLvN1upBhkpIwAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:39.608318 2026] [:error] [pid 21263:tid 21271] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5b9AxjzLvN1upBhkpJAAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:41.027261 2026] [:error] [pid 21263:tid 21291] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5cdAxjzLvN1upBhkpJgAAANg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:41.747413 2026] [:error] [pid 21263:tid 21278] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5cdAxjzLvN1upBhkpJwAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:43.250234 2026] [:error] [pid 21263:tid 21273] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5c9AxjzLvN1upBhkpKQAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:43.961052 2026] [:error] [pid 21263:tid 21267] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5c9AxjzLvN1upBhkpKgAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:45.471092 2026] [:error] [pid 21263:tid 21275] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5ddAxjzLvN1upBhkpLQAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:46.164774 2026] [:error] [pid 21263:tid 21271] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5dtAxjzLvN1upBhkpLgAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:47.609348 2026] [:error] [pid 21263:tid 21273] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5d9AxjzLvN1upBhkpMgAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:48.298756 2026] [:error] [pid 21263:tid 21267] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5eNAxjzLvN1upBhkpMwAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:49.766511 2026] [:error] [pid 21263:tid 21287] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5edAxjzLvN1upBhkpNQAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:50.466637 2026] [:error] [pid 21263:tid 21275] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5etAxjzLvN1upBhkpNgAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:51.984156 2026] [:error] [pid 21263:tid 21279] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5e9AxjzLvN1upBhkpOAAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:52.669139 2026] [:error] [pid 21263:tid 21291] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5fNAxjzLvN1upBhkpOgAAANg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:54.167213 2026] [:error] [pid 21263:tid 21283] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5ftAxjzLvN1upBhkpQAAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:54.908935 2026] [:error] [pid 21263:tid 21271] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5ftAxjzLvN1upBhkpQQAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:56.393097 2026] [:error] [pid 21263:tid 21291] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5gNAxjzLvN1upBhkpRAAAANg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:57.097405 2026] [:error] [pid 21263:tid 21278] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5gdAxjzLvN1upBhkpRQAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:58.536658 2026] [:error] [pid 21263:tid 21287] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5gtAxjzLvN1upBhkpSAAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:58:59.233252 2026] [:error] [pid 21263:tid 21283] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5g9AxjzLvN1upBhkpSgAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:00.686594 2026] [:error] [pid 21263:tid 21279] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5hNAxjzLvN1upBhkpTAAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:01.413114 2026] [:error] [pid 21263:tid 21291] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5hdAxjzLvN1upBhkpTgAAANg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:02.845790 2026] [:error] [pid 21263:tid 21273] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5htAxjzLvN1upBhkpUAAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:03.562842 2026] [:error] [pid 21263:tid 21287] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5h9AxjzLvN1upBhkpUQAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:05.039977 2026] [:error] [pid 21263:tid 21283] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5idAxjzLvN1upBhkpUwAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:06.030688 2026] [:error] [pid 21263:tid 21283] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5itAxjzLvN1upBhkpVgAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:07.438098 2026] [:error] [pid 21263:tid 21278] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5i9AxjzLvN1upBhkpWAAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:08.133029 2026] [:error] [pid 21263:tid 21287] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5jNAxjzLvN1upBhkpWwAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:09.575986 2026] [:error] [pid 21263:tid 21291] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5jdAxjzLvN1upBhkpYAAAANg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:10.269862 2026] [:error] [pid 21263:tid 21290] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5jtAxjzLvN1upBhkpYQAAANc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:11.743828 2026] [:error] [pid 21263:tid 21278] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5j9AxjzLvN1upBhkpYwAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:12.465237 2026] [:error] [pid 21263:tid 21267] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5kNAxjzLvN1upBhkpZAAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:13.865170 2026] [:error] [pid 21263:tid 21271] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5kdAxjzLvN1upBhkpZgAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:14.564120 2026] [:error] [pid 21263:tid 21282] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5ktAxjzLvN1upBhkpZwAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:15.999325 2026] [:error] [pid 21263:tid 21283] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5k9AxjzLvN1upBhkpaQAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:16.728161 2026] [:error] [pid 21263:tid 21279] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5lNAxjzLvN1upBhkpagAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:18.124066 2026] [:error] [pid 21263:tid 21290] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5ltAxjzLvN1upBhkpbAAAANc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:18.829954 2026] [:error] [pid 21263:tid 21275] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5ltAxjzLvN1upBhkpbQAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:20.331973 2026] [:error] [pid 21263:tid 21267] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5mNAxjzLvN1upBhkpbwAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:21.058655 2026] [:error] [pid 21263:tid 21273] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5mdAxjzLvN1upBhkpcAAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:22.579118 2026] [:error] [pid 21263:tid 21282] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5mtAxjzLvN1upBhkpcgAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:23.279186 2026] [:error] [pid 21263:tid 21283] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5m9AxjzLvN1upBhkpdAAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:24.743058 2026] [:error] [pid 21263:tid 21291] [client 165.245.142.82:49940] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5nNAxjzLvN1upBhkpdgAAANg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:26.041873 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:49340] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5noC4dBNEGEcJx-OKUAAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:28.100856 2026] [:error] [pid 34785:tid 34792] [client 165.245.142.82:49340] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5oIC4dBNEGEcJx-OKXAAAAwU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:28.858744 2026] [:error] [pid 34785:tid 34792] [client 165.245.142.82:49340] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5oIC4dBNEGEcJx-OKXQAAAwU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:30.313116 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:49340] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5ooC4dBNEGEcJx-OKXwAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:31.635590 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:49340] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5o4C4dBNEGEcJx-OKYAAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:33.046214 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:49340] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5pYC4dBNEGEcJx-OKZgAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:34.467307 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:49340] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5poC4dBNEGEcJx-OKZwAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:35.898100 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:49340] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5p4C4dBNEGEcJx-OKagAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:36.599604 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:49340] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5qIC4dBNEGEcJx-OKbAAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:38.007796 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:49340] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5qoC4dBNEGEcJx-OKcQAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:38.722024 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:49340] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5qoC4dBNEGEcJx-OKdAAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:40.147824 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:49340] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5rIC4dBNEGEcJx-OKfQAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:40.899444 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:49340] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5rIC4dBNEGEcJx-OKgwAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:42.335002 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:49340] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5roC4dBNEGEcJx-OKjgAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:43.044754 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:49340] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5r4C4dBNEGEcJx-OKkQAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:44.521805 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:49340] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5sIC4dBNEGEcJx-OKmAAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:45.261000 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:49340] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5sYC4dBNEGEcJx-OKmQAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:46.778210 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:49340] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5soC4dBNEGEcJx-OKnQAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:48.648145 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:49340] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5tIC4dBNEGEcJx-OKogAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:51.887202 2026] [:error] [pid 34286:tid 34294] [client 165.245.142.82:55205] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5t3PFxpCIhHW6XmmxVQAAAoY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:51.887277 2026] [:error] [pid 34286:tid 34294] [client 165.245.142.82:55205] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5t3PFxpCIhHW6XmmxVQAAAoY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:52.655770 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:55561] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO5uIC4dBNEGEcJx-OKqgAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:53.419066 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:55769] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO5uXzT4c9ddlGE6FxkjQAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:54.194756 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:55963] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5uuLi3ouy1NZIkgpZwwAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:55.662178 2026] [:error] [pid 21159:tid 21242] [client 165.245.142.82:55963] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5u-Li3ouy1NZIkgpZxwAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:56.363286 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:55963] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5vOLi3ouy1NZIkgpZyAAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:57.767313 2026] [:error] [pid 21159:tid 21242] [client 165.245.142.82:55963] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5veLi3ouy1NZIkgpZygAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:58.455923 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:55963] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5vuLi3ouy1NZIkgpZzAAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 11:59:59.878120 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:55963] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5v-Li3ouy1NZIkgpZ0QAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:00.717746 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:55963] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5wOLi3ouy1NZIkgpZ0gAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:02.822830 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:55963] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5wuLi3ouy1NZIkgpZ1AAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:03.560611 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:55963] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5w-Li3ouy1NZIkgpZ1gAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:06.522378 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:58581] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5xuLi3ouy1NZIkgpZ5AAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:07.215500 2026] [:error] [pid 21159:tid 21242] [client 165.245.142.82:58581] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5x-Li3ouy1NZIkgpZ6QAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:08.737487 2026] [:error] [pid 21159:tid 21242] [client 165.245.142.82:58581] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5yOLi3ouy1NZIkgpZ8gAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:09.514876 2026] [:error] [pid 21159:tid 21242] [client 165.245.142.82:58581] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5yeLi3ouy1NZIkgpZ9gAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:09.514949 2026] [:error] [pid 21159:tid 21242] [client 165.245.142.82:58581] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5yeLi3ouy1NZIkgpZ9gAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:11.102575 2026] [:error] [pid 34286:tid 34297] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5y3PFxpCIhHW6XmmxbQAAAok"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:11.852003 2026] [:error] [pid 34286:tid 34296] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5y3PFxpCIhHW6XmmxbwAAAog"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:13.790049 2026] [:error] [pid 34286:tid 34310] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5zXPFxpCIhHW6XmmxcgAAApY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:14.484114 2026] [:error] [pid 34286:tid 34297] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5znPFxpCIhHW6XmmxcwAAAok"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:15.927098 2026] [:error] [pid 34286:tid 34306] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5z3PFxpCIhHW6XmmxdQAAApI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:16.664756 2026] [:error] [pid 34286:tid 34294] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO50HPFxpCIhHW6XmmxdwAAAoY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:18.076013 2026] [:error] [pid 34286:tid 34296] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO50nPFxpCIhHW6XmmxegAAAog"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:18.791816 2026] [:error] [pid 34286:tid 34293] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO50nPFxpCIhHW6XmmxfAAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:20.244426 2026] [:error] [pid 34286:tid 34296] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO51HPFxpCIhHW6XmmxgAAAAog"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:20.945945 2026] [:error] [pid 34286:tid 34297] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO51HPFxpCIhHW6XmmxgwAAAok"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:22.377526 2026] [:error] [pid 34286:tid 34293] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO51nPFxpCIhHW6XmmxiAAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:23.075613 2026] [:error] [pid 34286:tid 34311] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO513PFxpCIhHW6XmmxiQAAApc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:24.508808 2026] [:error] [pid 34286:tid 34293] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO52HPFxpCIhHW6XmmxkAAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:25.231922 2026] [:error] [pid 34286:tid 34297] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO52XPFxpCIhHW6XmmxlgAAAok"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:26.666365 2026] [:error] [pid 34286:tid 34306] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO52nPFxpCIhHW6XmmxnAAAApI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:27.400205 2026] [:error] [pid 34286:tid 34310] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO523PFxpCIhHW6XmmxoAAAApY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:28.880870 2026] [:error] [pid 34286:tid 34306] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO53HPFxpCIhHW6XmmxqgAAApI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:29.716853 2026] [:error] [pid 34286:tid 34294] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO53XPFxpCIhHW6XmmxsQAAAoY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:31.198604 2026] [:error] [pid 34286:tid 34304] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO533PFxpCIhHW6XmmxuAAAApA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:31.922602 2026] [:error] [pid 34286:tid 34297] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO533PFxpCIhHW6XmmxuwAAAok"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:33.425865 2026] [:error] [pid 34286:tid 34296] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO54XPFxpCIhHW6XmmxwQAAAog"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:34.444169 2026] [:error] [pid 34286:tid 34296] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO54nPFxpCIhHW6XmmxwgAAAog"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:35.850476 2026] [:error] [pid 34286:tid 34311] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO543PFxpCIhHW6XmmxyAAAApc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:36.562766 2026] [:error] [pid 34286:tid 34296] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO55HPFxpCIhHW6XmmxywAAAog"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:37.981029 2026] [:error] [pid 34286:tid 34297] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO55XPFxpCIhHW6Xmmx0QAAAok"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:38.670997 2026] [:error] [pid 34286:tid 34296] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO55nPFxpCIhHW6Xmmx1AAAAog"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:40.069466 2026] [:error] [pid 34286:tid 34293] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO56HPFxpCIhHW6Xmmx3QAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:40.783377 2026] [:error] [pid 34286:tid 34294] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO56HPFxpCIhHW6Xmmx4AAAAoY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:42.246937 2026] [:error] [pid 34286:tid 34296] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO56nPFxpCIhHW6Xmmx5QAAAog"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:42.969831 2026] [:error] [pid 34286:tid 34297] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO56nPFxpCIhHW6Xmmx6AAAAok"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:44.399654 2026] [:error] [pid 34286:tid 34304] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO57HPFxpCIhHW6Xmmx7gAAApA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:45.094343 2026] [:error] [pid 34286:tid 34297] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO57XPFxpCIhHW6Xmmx8QAAAok"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:46.535726 2026] [:error] [pid 34286:tid 34310] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO57nPFxpCIhHW6Xmmx-QAAApY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:47.250349 2026] [:error] [pid 34286:tid 34293] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO573PFxpCIhHW6Xmmx_AAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:48.676165 2026] [:error] [pid 34286:tid 34310] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO58HPFxpCIhHW6XmmyGAAAApY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:49.401141 2026] [:error] [pid 34286:tid 34297] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO58XPFxpCIhHW6XmmyHgAAAok"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:50.822221 2026] [:error] [pid 34286:tid 34296] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO58nPFxpCIhHW6XmmyIgAAAog"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:51.511698 2026] [:error] [pid 34286:tid 34311] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO583PFxpCIhHW6XmmyJQAAApc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:52.925510 2026] [:error] [pid 34286:tid 34294] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO59HPFxpCIhHW6XmmyKQAAAoY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:53.614579 2026] [:error] [pid 34286:tid 34293] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO59XPFxpCIhHW6XmmyLAAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:55.003919 2026] [:error] [pid 34286:tid 34296] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO593PFxpCIhHW6XmmyMQAAAog"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:55.710978 2026] [:error] [pid 34286:tid 34311] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO593PFxpCIhHW6XmmyNAAAApc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:57.122337 2026] [:error] [pid 34286:tid 34297] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5-XPFxpCIhHW6XmmyOQAAAok"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:57.805352 2026] [:error] [pid 34286:tid 34293] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5-XPFxpCIhHW6XmmyPAAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:59.210307 2026] [:error] [pid 34286:tid 34297] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5-3PFxpCIhHW6XmmyQgAAAok"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:00:59.916025 2026] [:error] [pid 34286:tid 34306] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5-3PFxpCIhHW6XmmyRgAAApI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:01.581165 2026] [:error] [pid 34286:tid 34297] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5_XPFxpCIhHW6XmmyTAAAAok"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:02.289803 2026] [:error] [pid 34286:tid 34296] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5_nPFxpCIhHW6XmmyUAAAAog"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:03.720841 2026] [:error] [pid 34286:tid 34294] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO5_3PFxpCIhHW6XmmyVAAAAoY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:04.451827 2026] [:error] [pid 34286:tid 34306] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6AHPFxpCIhHW6XmmyVgAAApI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:05.922011 2026] [:error] [pid 34286:tid 34306] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6AXPFxpCIhHW6XmmyXgAAApI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:06.719279 2026] [:error] [pid 34286:tid 34304] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6AnPFxpCIhHW6XmmyYQAAApA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:08.158186 2026] [:error] [pid 34286:tid 34311] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6BHPFxpCIhHW6XmmyaQAAApc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:08.876787 2026] [:error] [pid 34286:tid 34293] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6BHPFxpCIhHW6XmmybgAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:11.068209 2026] [:error] [pid 34286:tid 34297] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6B3PFxpCIhHW6XmmydgAAAok"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:11.797491 2026] [:error] [pid 34286:tid 34310] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6B3PFxpCIhHW6XmmyeQAAApY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:13.365567 2026] [:error] [pid 34286:tid 34311] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6CXPFxpCIhHW6XmmyfAAAApc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:14.236168 2026] [:error] [pid 34286:tid 34311] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6CnPFxpCIhHW6XmmygAAAApc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:15.748113 2026] [:error] [pid 34286:tid 34311] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6C3PFxpCIhHW6XmmyiAAAApc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:15.748190 2026] [:error] [pid 34286:tid 34311] [client 165.245.142.82:59658] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6C3PFxpCIhHW6XmmyiAAAApc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:16.520962 2026] [:error] [pid 34286:tid 34311] [client 165.245.142.82:58721] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO6DHPFxpCIhHW6XmmyjgAAApc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:17.277825 2026] [:error] [pid 35060:tid 35080] [client 165.245.142.82:58906] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO6DZL8JPoS_tq-tiUOVAAAA1I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:18.049835 2026] [:error] [pid 34552:tid 34578] [client 165.245.142.82:59097] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO6DnBlU_DRqGi4yvsdwAAAAtc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:18.814215 2026] [:error] [pid 24576:tid 24594] [client 165.245.142.82:59287] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6Dovfb5CnctJh071RjwAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:20.289023 2026] [:error] [pid 24576:tid 24599] [client 165.245.142.82:59287] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6EIvfb5CnctJh071RlAAAARM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:21.006169 2026] [:error] [pid 24576:tid 24595] [client 165.245.142.82:59287] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6EYvfb5CnctJh071RlwAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:22.485286 2026] [:error] [pid 24576:tid 24592] [client 165.245.142.82:59287] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6Eovfb5CnctJh071RnwAAAQw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:23.208647 2026] [:error] [pid 24576:tid 24603] [client 165.245.142.82:59287] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6E4vfb5CnctJh071RogAAARc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:24.676319 2026] [:error] [pid 24576:tid 24587] [client 165.245.142.82:59287] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6FIvfb5CnctJh071RqAAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:25.392703 2026] [:error] [pid 24576:tid 24602] [client 165.245.142.82:59287] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6FYvfb5CnctJh071RqwAAARY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:25.392795 2026] [:error] [pid 24576:tid 24602] [client 165.245.142.82:59287] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6FYvfb5CnctJh071RqwAAARY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:26.905866 2026] [:error] [pid 35350:tid 35366] [client 165.245.142.82:61002] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6FoqZbPJ_JGYY1RQEWQAAA44"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:26.905941 2026] [:error] [pid 35350:tid 35366] [client 165.245.142.82:61002] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6FoqZbPJ_JGYY1RQEWQAAA44"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:27.669100 2026] [:error] [pid 33229:tid 33254] [client 165.245.142.82:61358] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO6F3zT4c9ddlGE6FxlpQAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:28.432952 2026] [:error] [pid 8688:tid 8705] [client 165.245.142.82:61549] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO6GDHJ4Nn-RvulD0rqKwAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:29.199192 2026] [:error] [pid 33976:tid 33989] [client 165.245.142.82:61718] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO6GQUyU3c4Xm_xpMTPcwAAAks"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:29.954264 2026] [:error] [pid 33539:tid 33549] [client 165.245.142.82:61901] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6GdCsLwBYg4s018vHpgAAAcQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:30.693495 2026] [:error] [pid 33539:tid 33558] [client 165.245.142.82:61901] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO6GtCsLwBYg4s018vHqAAAAc0"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:31.449502 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:62239] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO6G-Li3ouy1NZIkgpargAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:32.217449 2026] [:error] [pid 33229:tid 33236] [client 165.245.142.82:62406] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO6HHzT4c9ddlGE6FxlsgAAAYU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:32.993494 2026] [:error] [pid 35350:tid 35366] [client 165.245.142.82:62585] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO6HIqZbPJ_JGYY1RQEXwAAA44"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:33.752705 2026] [:error] [pid 35350:tid 35366] [client 165.245.142.82:62761] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6HYqZbPJ_JGYY1RQEYQAAA44"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:35.308861 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:62761] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6H4qZbPJ_JGYY1RQEYwAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:36.103251 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:62761] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6IIqZbPJ_JGYY1RQEZAAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:37.663707 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:62761] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6IYqZbPJ_JGYY1RQEZgAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:38.366471 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:62761] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6IoqZbPJ_JGYY1RQEZwAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:40.850453 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:62761] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6JIqZbPJ_JGYY1RQEaQAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:42.311499 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:62761] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6JoqZbPJ_JGYY1RQEagAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:42.311599 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:62761] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6JoqZbPJ_JGYY1RQEagAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:43.890657 2026] [:error] [pid 34286:tid 34293] [client 165.245.142.82:64861] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6J3PFxpCIhHW6Xmmy4gAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:44.644818 2026] [:error] [pid 34286:tid 34311] [client 165.245.142.82:64861] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6KHPFxpCIhHW6Xmmy5wAAApc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:46.102448 2026] [:error] [pid 34286:tid 34297] [client 165.245.142.82:64861] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6KnPFxpCIhHW6Xmmy8wAAAok"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:48.232235 2026] [:error] [pid 34286:tid 34297] [client 165.245.142.82:64861] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6LHPFxpCIhHW6Xmmy9wAAAok"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:50.623301 2026] [:error] [pid 34286:tid 34310] [client 165.245.142.82:64861] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6LnPFxpCIhHW6Xmmy_AAAApY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:51.345778 2026] [:error] [pid 34286:tid 34293] [client 165.245.142.82:64861] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6L3PFxpCIhHW6Xmmy_QAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:53.866125 2026] [:error] [pid 34286:tid 34293] [client 165.245.142.82:64861] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6MXPFxpCIhHW6XmmzAQAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:54.693415 2026] [:error] [pid 34286:tid 34293] [client 165.245.142.82:64861] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6MnPFxpCIhHW6XmmzAwAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:56.117877 2026] [:error] [pid 34286:tid 34294] [client 165.245.142.82:64861] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6NHPFxpCIhHW6XmmzBQAAAoY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:56.824993 2026] [:error] [pid 34286:tid 34310] [client 165.245.142.82:64861] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6NHPFxpCIhHW6XmmzBgAAApY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:58.316296 2026] [:error] [pid 34286:tid 34297] [client 165.245.142.82:64861] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6NnPFxpCIhHW6XmmzCQAAAok"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:01:59.030619 2026] [:error] [pid 34286:tid 34296] [client 165.245.142.82:64861] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6N3PFxpCIhHW6XmmzCgAAAog"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:00.626821 2026] [:error] [pid 34286:tid 34311] [client 165.245.142.82:64861] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO6OHPFxpCIhHW6XmmzDAAAApc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:01.381507 2026] [:error] [pid 21156:tid 21186] [client 165.245.142.82:52284] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO6OasaG_9IkG8N2p0ZywAAABQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:02.151247 2026] [:error] [pid 34286:tid 34310] [client 165.245.142.82:52427] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO6OnPFxpCIhHW6XmmzDwAAApY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:02.907755 2026] [:error] [pid 33976:tid 34002] [client 165.245.142.82:52563] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO6OgUyU3c4Xm_xpMTPiQAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:03.683532 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6O-Li3ouy1NZIkgpa6wAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:05.191636 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6PeLi3ouy1NZIkgpa8AAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:05.896873 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6PeLi3ouy1NZIkgpa8QAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:07.405770 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6P-Li3ouy1NZIkgpa9gAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:08.089952 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6QOLi3ouy1NZIkgpa-AAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:09.536332 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6QeLi3ouy1NZIkgpa_gAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:10.266774 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6QuLi3ouy1NZIkgpbAAAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:11.758329 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6Q-Li3ouy1NZIkgpbAwAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:12.551641 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6ROLi3ouy1NZIkgpbBgAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:15.436800 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6R-Li3ouy1NZIkgpbDgAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:16.128113 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6SOLi3ouy1NZIkgpbEgAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:17.584478 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6SeLi3ouy1NZIkgpbGgAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:18.314882 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6SuLi3ouy1NZIkgpbHAAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:19.812900 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6S-Li3ouy1NZIkgpbHwAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:20.522375 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6TOLi3ouy1NZIkgpbIAAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:22.072701 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6TuLi3ouy1NZIkgpbIgAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:22.792124 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6TuLi3ouy1NZIkgpbJAAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:24.231103 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6UOLi3ouy1NZIkgpbLgAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:24.954232 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6UOLi3ouy1NZIkgpbMgAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:26.422005 2026] [:error] [pid 21159:tid 21237] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6UuLi3ouy1NZIkgpbNQAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:27.133417 2026] [:error] [pid 21159:tid 21237] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6U-Li3ouy1NZIkgpbNgAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:27.133492 2026] [:error] [pid 21159:tid 21237] [client 165.245.142.82:52708] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6U-Li3ouy1NZIkgpbNgAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:28.614340 2026] [:error] [pid 35350:tid 35366] [client 165.245.142.82:57924] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6VIqZbPJ_JGYY1RQEmwAAA44"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:29.313587 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:57924] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6VYqZbPJ_JGYY1RQEnAAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:30.853940 2026] [:error] [pid 35350:tid 35366] [client 165.245.142.82:57924] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6VoqZbPJ_JGYY1RQEngAAA44"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:32.211047 2026] [:error] [pid 35350:tid 35366] [client 165.245.142.82:57924] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6WIqZbPJ_JGYY1RQEoAAAA44"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:33.861365 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:57924] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6WYqZbPJ_JGYY1RQEogAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:34.583562 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:57924] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6WoqZbPJ_JGYY1RQEpAAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:34.583620 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:57924] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6WoqZbPJ_JGYY1RQEpAAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:36.291828 2026] [:error] [pid 33976:tid 34002] [client 165.245.142.82:59626] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6XAUyU3c4Xm_xpMTPuQAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:36.980851 2026] [:error] [pid 33976:tid 33995] [client 165.245.142.82:59626] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6XAUyU3c4Xm_xpMTPuwAAAlE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:38.403057 2026] [:error] [pid 33976:tid 33995] [client 165.245.142.82:59626] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6XgUyU3c4Xm_xpMTPwAAAAlE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:39.086629 2026] [:error] [pid 33976:tid 33995] [client 165.245.142.82:59626] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6XwUyU3c4Xm_xpMTPwQAAAlE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:40.609142 2026] [:error] [pid 33976:tid 33995] [client 165.245.142.82:59626] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6YAUyU3c4Xm_xpMTPwwAAAlE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:41.379588 2026] [:error] [pid 33976:tid 33995] [client 165.245.142.82:59626] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6YQUyU3c4Xm_xpMTPxAAAAlE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:43.198246 2026] [:error] [pid 33976:tid 34002] [client 165.245.142.82:59626] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6YwUyU3c4Xm_xpMTP0wAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:43.906546 2026] [:error] [pid 33976:tid 34002] [client 165.245.142.82:59626] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6YwUyU3c4Xm_xpMTP4gAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:48.112755 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:62086] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6aOLi3ouy1NZIkgpbWwAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:49.888480 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:62086] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6aeLi3ouy1NZIkgpbXAAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:49.888526 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:62086] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6aeLi3ouy1NZIkgpbXAAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:51.374315 2026] [:error] [pid 33229:tid 33234] [client 165.245.142.82:62825] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6a3zT4c9ddlGE6FxmHgAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:52.090863 2026] [:error] [pid 33229:tid 33245] [client 165.245.142.82:62825] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6bHzT4c9ddlGE6FxmHwAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:53.547527 2026] [:error] [pid 33229:tid 33254] [client 165.245.142.82:62825] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6bXzT4c9ddlGE6FxmIgAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:54.266794 2026] [:error] [pid 33229:tid 33245] [client 165.245.142.82:62825] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6bnzT4c9ddlGE6FxmJAAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:55.712312 2026] [:error] [pid 33229:tid 33254] [client 165.245.142.82:62825] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6b3zT4c9ddlGE6FxmJwAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:57.155175 2026] [:error] [pid 33229:tid 33254] [client 165.245.142.82:62825] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6cXzT4c9ddlGE6FxmLQAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:58.677258 2026] [:error] [pid 33229:tid 33254] [client 165.245.142.82:62825] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6cnzT4c9ddlGE6FxmLwAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:02:59.703587 2026] [:error] [pid 33229:tid 33254] [client 165.245.142.82:62825] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6c3zT4c9ddlGE6FxmMAAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:01.205081 2026] [:error] [pid 33229:tid 33252] [client 165.245.142.82:62825] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6dXzT4c9ddlGE6FxmMwAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:01.914972 2026] [:error] [pid 33229:tid 33254] [client 165.245.142.82:62825] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6dXzT4c9ddlGE6FxmNAAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:03.495511 2026] [:error] [pid 33229:tid 33236] [client 165.245.142.82:62825] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6d3zT4c9ddlGE6FxmNgAAAYU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:04.213683 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:62825] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6eHzT4c9ddlGE6FxmOQAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:05.740456 2026] [:error] [pid 33229:tid 33252] [client 165.245.142.82:62825] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6eXzT4c9ddlGE6FxmQAAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:06.467492 2026] [:error] [pid 33229:tid 33236] [client 165.245.142.82:62825] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6enzT4c9ddlGE6FxmRAAAAYU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:07.887795 2026] [:error] [pid 33229:tid 33234] [client 165.245.142.82:62825] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6e3zT4c9ddlGE6FxmRgAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:08.624995 2026] [:error] [pid 33229:tid 33254] [client 165.245.142.82:62825] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6fHzT4c9ddlGE6FxmSAAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:08.625046 2026] [:error] [pid 33229:tid 33254] [client 165.245.142.82:62825] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6fHzT4c9ddlGE6FxmSAAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:10.179948 2026] [:error] [pid 35654:tid 35680] [client 165.245.142.82:50419] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6fkIPeuEwCTirofKZUgAAA9Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:10.906195 2026] [:error] [pid 35654:tid 35680] [client 165.245.142.82:50419] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6fkIPeuEwCTirofKZUwAAA9Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:12.395599 2026] [:error] [pid 35654:tid 35680] [client 165.245.142.82:50419] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6gEIPeuEwCTirofKZVgAAA9Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:13.103204 2026] [:error] [pid 35654:tid 35680] [client 165.245.142.82:50419] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6gUIPeuEwCTirofKZVwAAA9Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:14.550217 2026] [:error] [pid 35654:tid 35680] [client 165.245.142.82:50419] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6gkIPeuEwCTirofKZWQAAA9Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:15.234012 2026] [:error] [pid 35654:tid 35680] [client 165.245.142.82:50419] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6g0IPeuEwCTirofKZWgAAA9Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:16.673906 2026] [:error] [pid 35654:tid 35680] [client 165.245.142.82:50419] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6hEIPeuEwCTirofKZXAAAA9Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:17.410811 2026] [:error] [pid 35654:tid 35680] [client 165.245.142.82:50419] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6hUIPeuEwCTirofKZXQAAA9Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:18.891167 2026] [:error] [pid 35654:tid 35680] [client 165.245.142.82:50419] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6hkIPeuEwCTirofKZXwAAA9Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:18.891241 2026] [:error] [pid 35654:tid 35680] [client 165.245.142.82:50419] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6hkIPeuEwCTirofKZXwAAA9Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:19.645988 2026] [:error] [pid 33767:tid 33780] [client 165.245.142.82:52547] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO6h0GyeKe3MWsxvBgdZQAAAgo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:20.417522 2026] [:error] [pid 33976:tid 33989] [client 165.245.142.82:52684] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO6iAUyU3c4Xm_xpMTQHAAAAks"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:21.182024 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:52832] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO6iYqZbPJ_JGYY1RQE5AAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:21.939849 2026] [:error] [pid 34286:tid 34297] [client 165.245.142.82:52994] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6iXPFxpCIhHW6XmmzTQAAAok"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:23.401242 2026] [:error] [pid 34286:tid 34293] [client 165.245.142.82:52994] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6i3PFxpCIhHW6XmmzUwAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:24.086094 2026] [:error] [pid 34286:tid 34294] [client 165.245.142.82:52994] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6jHPFxpCIhHW6XmmzVQAAAoY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:25.577547 2026] [:error] [pid 34286:tid 34310] [client 165.245.142.82:52994] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6jXPFxpCIhHW6XmmzWgAAApY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:26.358942 2026] [:error] [pid 34286:tid 34296] [client 165.245.142.82:52994] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6jnPFxpCIhHW6XmmzXgAAAog"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:27.878712 2026] [:error] [pid 34286:tid 34296] [client 165.245.142.82:52994] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6j3PFxpCIhHW6XmmzZAAAAog"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:28.701179 2026] [:error] [pid 34286:tid 34297] [client 165.245.142.82:52994] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6kHPFxpCIhHW6XmmzZgAAAok"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:28.701257 2026] [:error] [pid 34286:tid 34297] [client 165.245.142.82:52994] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6kHPFxpCIhHW6XmmzZgAAAok"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:30.215504 2026] [:error] [pid 35060:tid 35073] [client 165.245.142.82:54591] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6kpL8JPoS_tq-tiUPXgAAA0s"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:30.912097 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:54591] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6kpL8JPoS_tq-tiUPXwAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:32.361812 2026] [:error] [pid 35060:tid 35073] [client 165.245.142.82:54591] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6lJL8JPoS_tq-tiUPYQAAA0s"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:33.111713 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:54591] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6lZL8JPoS_tq-tiUPYgAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:34.558445 2026] [:error] [pid 35060:tid 35072] [client 165.245.142.82:54591] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6lpL8JPoS_tq-tiUPZAAAA0o"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:35.257226 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:54591] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6l5L8JPoS_tq-tiUPZwAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:36.812269 2026] [:error] [pid 35060:tid 35073] [client 165.245.142.82:54591] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6mJL8JPoS_tq-tiUPbwAAA0s"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:37.561046 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:54591] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6mZL8JPoS_tq-tiUPcgAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:38.297776 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:54591] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO6mpL8JPoS_tq-tiUPdAAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:39.057722 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:56827] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO6m4C4dBNEGEcJx-OLnAAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:39.823449 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:56987] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO6m-Li3ouy1NZIkgpbjQAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:40.589873 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:57180] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO6nOLi3ouy1NZIkgpbpQAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:41.353306 2026] [:error] [pid 34785:tid 34792] [client 165.245.142.82:57354] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6nYC4dBNEGEcJx-OLwwAAAwU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:42.834329 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:57354] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6noC4dBNEGEcJx-OLywAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:43.687987 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:57354] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6n4C4dBNEGEcJx-OLzwAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:44.419546 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:57354] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO6oIC4dBNEGEcJx-OL0QAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:45.184330 2026] [:error] [pid 21159:tid 21237] [client 165.245.142.82:58307] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO6oeLi3ouy1NZIkgpbuAAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:45.948443 2026] [:error] [pid 8688:tid 8691] [client 165.245.142.82:58491] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO6oTHJ4Nn-RvulD0rqrAAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:46.733295 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:58662] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO6onzT4c9ddlGE6FxmfAAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:47.493799 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:58851] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6o4C4dBNEGEcJx-OL1gAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:49.888751 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:58851] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6pYC4dBNEGEcJx-OL2QAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:50.598678 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:58851] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6poC4dBNEGEcJx-OL2wAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:50.598758 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:58851] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6poC4dBNEGEcJx-OL2wAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:52.094078 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:59793] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6qOLi3ouy1NZIkgpbwgAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:52.796311 2026] [:error] [pid 21159:tid 21237] [client 165.245.142.82:59793] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6qOLi3ouy1NZIkgpbwwAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:54.338325 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:59793] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6quLi3ouy1NZIkgpbxgAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:55.045163 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:59793] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6q-Li3ouy1NZIkgpbxwAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:55.794353 2026] [:error] [pid 21159:tid 21237] [client 165.245.142.82:59793] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO6q-Li3ouy1NZIkgpbyAAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:56.557441 2026] [:error] [pid 33976:tid 33989] [client 165.245.142.82:61023] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO6rAUyU3c4Xm_xpMTQMwAAAks"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:57.324568 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:61186] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO6rZL8JPoS_tq-tiUPjAAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:58.079984 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:61354] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO6rpL8JPoS_tq-tiUPjwAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:03:58.845272 2026] [:error] [pid 33976:tid 33989] [client 165.245.142.82:61537] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6rgUyU3c4Xm_xpMTQNgAAAks"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:00.337456 2026] [:error] [pid 33976:tid 33980] [client 165.245.142.82:61537] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6sAUyU3c4Xm_xpMTQOgAAAkI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:00.337528 2026] [:error] [pid 33976:tid 33980] [client 165.245.142.82:61537] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6sAUyU3c4Xm_xpMTQOgAAAkI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:01.096125 2026] [:error] [pid 33976:tid 33980] [client 165.245.142.82:62042] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO6sQUyU3c4Xm_xpMTQPAAAAkI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:01.854745 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:62232] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO6sYqZbPJ_JGYY1RQFEAAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:02.621721 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:62417] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO6suLi3ouy1NZIkgpbzQAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:03.377399 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:62603] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6s4qZbPJ_JGYY1RQFFAAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:04.808047 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:62603] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6tIqZbPJ_JGYY1RQFFgAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:05.567680 2026] [:error] [pid 35350:tid 35366] [client 165.245.142.82:62603] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6tYqZbPJ_JGYY1RQFFwAAA44"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:07.002520 2026] [:error] [pid 35350:tid 35366] [client 165.245.142.82:62603] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6t4qZbPJ_JGYY1RQFGQAAA44"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:07.002593 2026] [:error] [pid 35350:tid 35366] [client 165.245.142.82:62603] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6t4qZbPJ_JGYY1RQFGQAAA44"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:07.766880 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:63641] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO6t4C4dBNEGEcJx-OL_wAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:08.534510 2026] [:error] [pid 34785:tid 34806] [client 165.245.142.82:63844] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO6uIC4dBNEGEcJx-OMAgAAAxM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:09.298614 2026] [:error] [pid 35060:tid 35080] [client 165.245.142.82:64029] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO6uZL8JPoS_tq-tiUPpAAAA1I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:10.057446 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:64217] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6upL8JPoS_tq-tiUPqAAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:11.510360 2026] [:error] [pid 35060:tid 35080] [client 165.245.142.82:64217] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6u5L8JPoS_tq-tiUPqgAAA1I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:12.206473 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:64217] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6vJL8JPoS_tq-tiUPqwAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:12.206543 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:64217] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6vJL8JPoS_tq-tiUPqwAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:13.716010 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:64877] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6vZL8JPoS_tq-tiUPrgAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:14.427365 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:64877] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6vpL8JPoS_tq-tiUPsAAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:14.427472 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:64877] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6vpL8JPoS_tq-tiUPsAAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:15.958427 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:65409] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6v-Li3ouy1NZIkgpb7AAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:16.717978 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:65409] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6wOLi3ouy1NZIkgpb7QAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:18.723448 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:65409] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO6wuLi3ouy1NZIkgpb7wAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:19.482484 2026] [:error] [pid 34785:tid 34792] [client 165.245.142.82:50035] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO6w4C4dBNEGEcJx-OMJAAAAwU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:20.246830 2026] [:error] [pid 35060:tid 35080] [client 165.245.142.82:50207] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO6xJL8JPoS_tq-tiUPzQAAA1I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:21.013889 2026] [:error] [pid 33976:tid 34002] [client 165.245.142.82:50378] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO6xQUyU3c4Xm_xpMTQVwAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:21.799064 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:50561] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6xYC4dBNEGEcJx-OMLAAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:23.194837 2026] [:error] [pid 34785:tid 34806] [client 165.245.142.82:50561] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6x4C4dBNEGEcJx-OMMgAAAxM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:23.890098 2026] [:error] [pid 34785:tid 34806] [client 165.245.142.82:50561] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6x4C4dBNEGEcJx-OMNAAAAxM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:25.308094 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:50561] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6yYC4dBNEGEcJx-OMNgAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:26.043799 2026] [:error] [pid 34785:tid 34806] [client 165.245.142.82:50561] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6yoC4dBNEGEcJx-OMNwAAAxM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:26.043879 2026] [:error] [pid 34785:tid 34806] [client 165.245.142.82:50561] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6yoC4dBNEGEcJx-OMNwAAAxM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:30.472441 2026] [:error] [pid 35060:tid 35072] [client 165.245.142.82:52421] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6zpL8JPoS_tq-tiUP4wAAA0o"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:31.178251 2026] [:error] [pid 35060:tid 35072] [client 165.245.142.82:52421] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6z5L8JPoS_tq-tiUP5AAAA0o"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:32.652644 2026] [:error] [pid 35060:tid 35072] [client 165.245.142.82:52421] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO60JL8JPoS_tq-tiUP6AAAA0o"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:33.405915 2026] [:error] [pid 35060:tid 35072] [client 165.245.142.82:52421] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO60ZL8JPoS_tq-tiUP6QAAA0o"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:33.405997 2026] [:error] [pid 35060:tid 35072] [client 165.245.142.82:52421] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO60ZL8JPoS_tq-tiUP6QAAA0o"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:34.942534 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:53547] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO60oqZbPJ_JGYY1RQFOgAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:35.709292 2026] [:error] [pid 35350:tid 35366] [client 165.245.142.82:53547] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO604qZbPJ_JGYY1RQFPQAAA44"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:37.154799 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:53547] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO61YqZbPJ_JGYY1RQFQQAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:37.883012 2026] [:error] [pid 35350:tid 35366] [client 165.245.142.82:53547] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO61YqZbPJ_JGYY1RQFRwAAA44"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:39.341508 2026] [:error] [pid 35350:tid 35366] [client 165.245.142.82:53547] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO614qZbPJ_JGYY1RQFTgAAA44"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:39.341597 2026] [:error] [pid 35350:tid 35366] [client 165.245.142.82:53547] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO614qZbPJ_JGYY1RQFTgAAA44"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:40.104713 2026] [:error] [pid 33976:tid 34002] [client 165.245.142.82:55021] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO62AUyU3c4Xm_xpMTQgwAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:40.872187 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:55201] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO62OLi3ouy1NZIkgpcAQAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:41.648885 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:55368] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO62eLi3ouy1NZIkgpcBQAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:42.408670 2026] [:error] [pid 33976:tid 34002] [client 165.245.142.82:55538] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO62gUyU3c4Xm_xpMTQhwAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:42.408734 2026] [:error] [pid 33976:tid 34002] [client 165.245.142.82:55538] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO62gUyU3c4Xm_xpMTQhwAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:43.168779 2026] [:error] [pid 21156:tid 21167] [client 165.245.142.82:55737] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO626saG_9IkG8N2p0axAAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:43.927465 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:55942] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO624qZbPJ_JGYY1RQFaQAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:44.703636 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:56128] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO63IC4dBNEGEcJx-OMdAAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:45.464637 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:56329] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO63YC4dBNEGEcJx-OMiwAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:46.220273 2026] [:error] [pid 34286:tid 34288] [client 165.245.142.82:56492] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO63nPFxpCIhHW6XmmzqQAAAoA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:47.677490 2026] [:error] [pid 34286:tid 34296] [client 165.245.142.82:56492] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO633PFxpCIhHW6XmmzrAAAAog"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:48.369941 2026] [:error] [pid 34286:tid 34293] [client 165.245.142.82:56492] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO64HPFxpCIhHW6XmmzrQAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:49.921689 2026] [:error] [pid 34286:tid 34294] [client 165.245.142.82:56492] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO64XPFxpCIhHW6XmmzsAAAAoY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:50.718442 2026] [:error] [pid 34286:tid 34311] [client 165.245.142.82:56492] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO64nPFxpCIhHW6XmmzsQAAApc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:52.341941 2026] [:error] [pid 34286:tid 34293] [client 165.245.142.82:56492] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO65HPFxpCIhHW6XmmzswAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:52.342056 2026] [:error] [pid 34286:tid 34293] [client 165.245.142.82:56492] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO65HPFxpCIhHW6XmmzswAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:54.660406 2026] [:error] [pid 21156:tid 21176] [client 165.245.142.82:58507] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO65qsaG_9IkG8N2p0a4wAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:55.425236 2026] [:error] [pid 35060:tid 35080] [client 165.245.142.82:58667] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO655L8JPoS_tq-tiUQKwAAA1I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:56.193528 2026] [:error] [pid 34785:tid 34792] [client 165.245.142.82:58824] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO66IC4dBNEGEcJx-OMqQAAAwU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:56.193607 2026] [:error] [pid 34785:tid 34792] [client 165.245.142.82:58824] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO66IC4dBNEGEcJx-OMqQAAAwU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:57.732107 2026] [:error] [pid 21156:tid 21167] [client 165.245.142.82:59009] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO66asaG_9IkG8N2p0a7wAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:58.434152 2026] [:error] [pid 21156:tid 21186] [client 165.245.142.82:59009] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO66qsaG_9IkG8N2p0a8wAAABQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:59.948564 2026] [:error] [pid 21156:tid 21167] [client 165.245.142.82:59009] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO666saG_9IkG8N2p0a-gAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:04:59.948675 2026] [:error] [pid 21156:tid 21167] [client 165.245.142.82:59009] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO666saG_9IkG8N2p0a-gAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:00.720799 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:59927] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO67IqZbPJ_JGYY1RQFtAAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:01.488989 2026] [:error] [pid 21156:tid 21167] [client 165.245.142.82:60112] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO67asaG_9IkG8N2p0bAAAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:02.253885 2026] [:error] [pid 33767:tid 33776] [client 165.245.142.82:60259] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO67kGyeKe3MWsxvBgdjQAAAgY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:03.033289 2026] [:error] [pid 35060:tid 35080] [client 165.245.142.82:60428] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO675L8JPoS_tq-tiUQNwAAA1I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:04.572699 2026] [:error] [pid 35060:tid 35068] [client 165.245.142.82:60428] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO68JL8JPoS_tq-tiUQOgAAA0Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:05.268823 2026] [:error] [pid 35060:tid 35068] [client 165.245.142.82:60428] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO68ZL8JPoS_tq-tiUQPgAAA0Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:06.796464 2026] [:error] [pid 35060:tid 35068] [client 165.245.142.82:60428] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO68pL8JPoS_tq-tiUQQQAAA0Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:07.567117 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:60428] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO685L8JPoS_tq-tiUQQgAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:07.567190 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:60428] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO685L8JPoS_tq-tiUQQgAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:08.324888 2026] [:error] [pid 35350:tid 35366] [client 165.245.142.82:61662] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO69IqZbPJ_JGYY1RQFvQAAA44"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:09.089811 2026] [:error] [pid 34286:tid 34311] [client 165.245.142.82:61840] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO69XPFxpCIhHW6XmmzuQAAApc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:09.862562 2026] [:error] [pid 35350:tid 35366] [client 165.245.142.82:62037] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO69YqZbPJ_JGYY1RQFxAAAA44"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:10.619447 2026] [:error] [pid 21156:tid 21167] [client 165.245.142.82:62229] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO69qsaG_9IkG8N2p0bJQAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:11.407886 2026] [:error] [pid 34286:tid 34288] [client 165.245.142.82:62401] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO693PFxpCIhHW6XmmzvAAAAoA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:11.407983 2026] [:error] [pid 34286:tid 34288] [client 165.245.142.82:62401] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO693PFxpCIhHW6XmmzvAAAAoA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:12.903679 2026] [:error] [pid 21156:tid 21186] [client 165.245.142.82:62572] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6-KsaG_9IkG8N2p0bLQAAABQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:13.700852 2026] [:error] [pid 21156:tid 21167] [client 165.245.142.82:62572] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6-asaG_9IkG8N2p0bLgAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:13.700940 2026] [:error] [pid 21156:tid 21167] [client 165.245.142.82:62572] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6-asaG_9IkG8N2p0bLgAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:14.473018 2026] [:error] [pid 33976:tid 33983] [client 165.245.142.82:63084] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO6-gUyU3c4Xm_xpMTQqwAAAkU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:15.232903 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:63270] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO6-4qZbPJ_JGYY1RQF1gAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:16.003552 2026] [:error] [pid 21159:tid 21237] [client 165.245.142.82:63438] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO6_OLi3ouy1NZIkgpcmAAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:16.769248 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:63633] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO6_IqZbPJ_JGYY1RQF2wAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:17.543571 2026] [:error] [pid 34552:tid 34569] [client 165.245.142.82:63822] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO6_XBlU_DRqGi4yvseHwAAAs4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:18.251529 2026] [:error] [pid 34552:tid 34569] [client 165.245.142.82:63822] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO6_nBlU_DRqGi4yvseIQAAAs4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:19.008893 2026] [:error] [pid 24576:tid 24595] [client 165.245.142.82:64179] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO6_4vfb5CnctJh071R7AAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:19.791187 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:64354] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO6_4C4dBNEGEcJx-OM3gAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:20.560291 2026] [:error] [pid 34552:tid 34558] [client 165.245.142.82:64526] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7AHBlU_DRqGi4yvseIwAAAsM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:21.323868 2026] [:error] [pid 33229:tid 33234] [client 165.245.142.82:64700] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7AXzT4c9ddlGE6Fxm9QAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:22.763601 2026] [:error] [pid 33229:tid 33252] [client 165.245.142.82:64700] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7AnzT4c9ddlGE6Fxm9wAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:22.763704 2026] [:error] [pid 33229:tid 33252] [client 165.245.142.82:64700] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7AnzT4c9ddlGE6Fxm9wAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:23.531319 2026] [:error] [pid 34552:tid 34558] [client 165.245.142.82:65236] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7A3BlU_DRqGi4yvseJgAAAsM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:24.291102 2026] [:error] [pid 21159:tid 21237] [client 165.245.142.82:65419] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7BOLi3ouy1NZIkgpcnQAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:25.056926 2026] [:error] [pid 34286:tid 34296] [client 165.245.142.82:49207] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7BXPFxpCIhHW6Xmmz2QAAAog"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:25.824912 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:49385] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7BeLi3ouy1NZIkgpcoQAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:26.552147 2026] [:error] [pid 21159:tid 21238] [client 165.245.142.82:49385] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7BuLi3ouy1NZIkgpcowAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:27.313824 2026] [:error] [pid 35060:tid 35076] [client 165.245.142.82:49718] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7B5L8JPoS_tq-tiUQVgAAA04"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:28.077098 2026] [:error] [pid 33229:tid 33253] [client 165.245.142.82:49897] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7CHzT4c9ddlGE6Fxm_AAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:28.838328 2026] [:error] [pid 21156:tid 21172] [client 165.245.142.82:50075] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7CKsaG_9IkG8N2p0bUAAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:29.604060 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:50274] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7CYqZbPJ_JGYY1RQF6wAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:29.604104 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:50274] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7CYqZbPJ_JGYY1RQF6wAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:31.472555 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:50518] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7C5L8JPoS_tq-tiUQZwAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:32.193573 2026] [:error] [pid 35060:tid 35076] [client 165.245.142.82:50518] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7DJL8JPoS_tq-tiUQawAAA04"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:32.193635 2026] [:error] [pid 35060:tid 35076] [client 165.245.142.82:50518] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7DJL8JPoS_tq-tiUQawAAA04"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:33.718588 2026] [:error] [pid 33229:tid 33253] [client 165.245.142.82:51018] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7DXzT4c9ddlGE6FxnCwAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:34.486062 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:51018] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7DnzT4c9ddlGE6FxnEAAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:34.486135 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:51018] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7DnzT4c9ddlGE6FxnEAAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:35.245065 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:51547] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7D3zT4c9ddlGE6FxnEwAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:36.010518 2026] [:error] [pid 34785:tid 34806] [client 165.245.142.82:51717] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7EIC4dBNEGEcJx-ONHQAAAxM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:36.776108 2026] [:error] [pid 35350:tid 35366] [client 165.245.142.82:51880] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7EIqZbPJ_JGYY1RQF8gAAA44"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:37.542170 2026] [:error] [pid 35350:tid 35366] [client 165.245.142.82:52050] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7EYqZbPJ_JGYY1RQF9QAAA44"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:38.308800 2026] [:error] [pid 34785:tid 34806] [client 165.245.142.82:52226] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7EoC4dBNEGEcJx-ONJwAAAxM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:38.308858 2026] [:error] [pid 34785:tid 34806] [client 165.245.142.82:52226] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7EoC4dBNEGEcJx-ONJwAAAxM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:39.076897 2026] [:error] [pid 34785:tid 34797] [client 165.245.142.82:52416] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7E4C4dBNEGEcJx-ONKQAAAwo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:39.837875 2026] [:error] [pid 33229:tid 33252] [client 165.245.142.82:52577] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7E3zT4c9ddlGE6FxnGgAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:40.604632 2026] [:error] [pid 21156:tid 21172] [client 165.245.142.82:52767] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7FKsaG_9IkG8N2p0bZQAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:41.376036 2026] [:error] [pid 33976:tid 34002] [client 165.245.142.82:52961] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7FQUyU3c4Xm_xpMTQwgAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:42.135719 2026] [:error] [pid 33976:tid 33989] [client 165.245.142.82:53153] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7FgUyU3c4Xm_xpMTQxQAAAks"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:42.135802 2026] [:error] [pid 33976:tid 33989] [client 165.245.142.82:53153] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7FgUyU3c4Xm_xpMTQxQAAAks"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:43.668260 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:53336] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7F-Li3ouy1NZIkgpcrgAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:44.368074 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:53336] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7GOLi3ouy1NZIkgpcsQAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:44.368129 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:53336] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7GOLi3ouy1NZIkgpcsQAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:45.890225 2026] [:error] [pid 35060:tid 35080] [client 165.245.142.82:53852] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7GZL8JPoS_tq-tiUQggAAA1I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:45.890281 2026] [:error] [pid 35060:tid 35080] [client 165.245.142.82:53852] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7GZL8JPoS_tq-tiUQggAAA1I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:46.644709 2026] [:error] [pid 35060:tid 35072] [client 165.245.142.82:54244] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7GpL8JPoS_tq-tiUQhAAAA0o"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:47.409958 2026] [:error] [pid 21159:tid 21237] [client 165.245.142.82:54427] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7G-Li3ouy1NZIkgpcuQAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:48.185408 2026] [:error] [pid 33229:tid 33236] [client 165.245.142.82:54623] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7HHzT4c9ddlGE6FxnIAAAAYU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:48.947842 2026] [:error] [pid 33976:tid 34002] [client 165.245.142.82:54807] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7HAUyU3c4Xm_xpMTQzQAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:48.947943 2026] [:error] [pid 33976:tid 34002] [client 165.245.142.82:54807] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7HAUyU3c4Xm_xpMTQzQAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:50.431589 2026] [:error] [pid 33767:tid 33780] [client 165.245.142.82:54980] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7HkGyeKe3MWsxvBgdmQAAAgo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:51.162272 2026] [:error] [pid 33767:tid 33776] [client 165.245.142.82:54980] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7H0GyeKe3MWsxvBgdmgAAAgY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:52.765570 2026] [:error] [pid 33767:tid 33777] [client 165.245.142.82:54980] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7IEGyeKe3MWsxvBgdnAAAAgc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:53.473257 2026] [:error] [pid 33767:tid 33779] [client 165.245.142.82:54980] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7IUGyeKe3MWsxvBgdnQAAAgk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:53.473375 2026] [:error] [pid 33767:tid 33779] [client 165.245.142.82:54980] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7IUGyeKe3MWsxvBgdnQAAAgk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:54.245758 2026] [:error] [pid 35060:tid 35080] [client 165.245.142.82:56081] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7IpL8JPoS_tq-tiUQkQAAA1I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:55.011104 2026] [:error] [pid 34785:tid 34792] [client 165.245.142.82:56269] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7I4C4dBNEGEcJx-ONSQAAAwU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:55.774990 2026] [:error] [pid 34785:tid 34806] [client 165.245.142.82:56441] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7I4C4dBNEGEcJx-ONTAAAAxM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:56.542582 2026] [:error] [pid 33767:tid 33792] [client 165.245.142.82:56622] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7JEGyeKe3MWsxvBgdnwAAAhY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:57.308169 2026] [:error] [pid 34785:tid 34792] [client 165.245.142.82:56808] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7JYC4dBNEGEcJx-ONaAAAAwU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:58.739585 2026] [:error] [pid 34785:tid 34806] [client 165.245.142.82:56808] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7JoC4dBNEGEcJx-ONcQAAAxM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:05:59.455633 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:56808] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7J4C4dBNEGEcJx-ONcwAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:00.943322 2026] [:error] [pid 34785:tid 34806] [client 165.245.142.82:56808] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7KIC4dBNEGEcJx-ONewAAAxM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:01.648026 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:56808] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7KYC4dBNEGEcJx-ONfAAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:02.387223 2026] [:error] [pid 34785:tid 34806] [client 165.245.142.82:56808] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7KoC4dBNEGEcJx-ONfQAAAxM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:03.152204 2026] [:error] [pid 34785:tid 34797] [client 165.245.142.82:58048] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7K4C4dBNEGEcJx-ONggAAAwo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:03.909345 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:58194] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7K-Li3ouy1NZIkgpc3wAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:04.674342 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:58348] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7LIC4dBNEGEcJx-ONhgAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:05.431605 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:58538] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7LeLi3ouy1NZIkgpc4AAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:05.431694 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:58538] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7LeLi3ouy1NZIkgpc4AAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:06.193016 2026] [:error] [pid 8688:tid 8706] [client 165.245.142.82:58709] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7LjHJ4Nn-RvulD0rrSAAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:06.948523 2026] [:error] [pid 34286:tid 34312] [client 165.245.142.82:58891] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7LnPFxpCIhHW6Xmm0IAAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:07.713215 2026] [:error] [pid 33229:tid 33253] [client 165.245.142.82:59065] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7L3zT4c9ddlGE6FxnkAAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:08.479763 2026] [:error] [pid 34785:tid 34792] [client 165.245.142.82:59261] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7MIC4dBNEGEcJx-ONlQAAAwU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:09.244447 2026] [:error] [pid 33229:tid 33253] [client 165.245.142.82:59454] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7MXzT4c9ddlGE6FxnkwAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:09.244530 2026] [:error] [pid 33229:tid 33253] [client 165.245.142.82:59454] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7MXzT4c9ddlGE6FxnkwAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:10.011231 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:59636] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7MoqZbPJ_JGYY1RQF-gAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:10.777063 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:59811] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7MoC4dBNEGEcJx-ONnAAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:11.534682 2026] [:error] [pid 35060:tid 35076] [client 165.245.142.82:59990] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7M5L8JPoS_tq-tiUQoAAAA04"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:12.307755 2026] [:error] [pid 21159:tid 21237] [client 165.245.142.82:60168] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7NOLi3ouy1NZIkgpc7gAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:13.072168 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:60321] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7NYC4dBNEGEcJx-ONpAAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:13.072248 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:60321] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7NYC4dBNEGEcJx-ONpAAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:15.451002 2026] [:error] [pid 8688:tid 8705] [client 165.245.142.82:60710] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7NzHJ4Nn-RvulD0rrTwAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:15.451080 2026] [:error] [pid 8688:tid 8705] [client 165.245.142.82:60710] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7NzHJ4Nn-RvulD0rrTwAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:16.221499 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:61084] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7OIC4dBNEGEcJx-ONrQAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:16.985903 2026] [:error] [pid 34552:tid 34558] [client 165.245.142.82:61296] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7OHBlU_DRqGi4yvseKgAAAsM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:17.745357 2026] [:error] [pid 24576:tid 24596] [client 165.245.142.82:61468] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7OYvfb5CnctJh071SAwAAARA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:17.745478 2026] [:error] [pid 24576:tid 24596] [client 165.245.142.82:61468] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7OYvfb5CnctJh071SAwAAARA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:18.503283 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:61641] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7OuLi3ouy1NZIkgpc9gAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:19.264703 2026] [:error] [pid 35060:tid 35076] [client 165.245.142.82:61801] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7O5L8JPoS_tq-tiUQpQAAA04"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:20.026602 2026] [:error] [pid 34785:tid 34792] [client 165.245.142.82:61974] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7PIC4dBNEGEcJx-ONuQAAAwU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:20.800775 2026] [:error] [pid 34785:tid 34792] [client 165.245.142.82:62128] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7PIC4dBNEGEcJx-ONvAAAAwU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:20.800838 2026] [:error] [pid 34785:tid 34792] [client 165.245.142.82:62128] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7PIC4dBNEGEcJx-ONvAAAAwU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:22.299359 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:62306] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7PnzT4c9ddlGE6FxnqgAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:22.299452 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:62306] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7PnzT4c9ddlGE6FxnqgAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:23.064752 2026] [:error] [pid 33229:tid 33236] [client 165.245.142.82:62601] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7P3zT4c9ddlGE6FxnrAAAAYU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:23.839907 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:62769] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7P-Li3ouy1NZIkgpc_AAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:24.613342 2026] [:error] [pid 21159:tid 21233] [client 165.245.142.82:62955] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7QOLi3ouy1NZIkgpc_wAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:25.368265 2026] [:error] [pid 35060:tid 35076] [client 165.245.142.82:63142] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7QZL8JPoS_tq-tiUQtQAAA04"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:26.832775 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:63142] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7QpL8JPoS_tq-tiUQuAAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:27.552496 2026] [:error] [pid 35060:tid 35076] [client 165.245.142.82:63142] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7Q5L8JPoS_tq-tiUQuwAAA04"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:28.995660 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:63142] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7RJL8JPoS_tq-tiUQvwAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:29.713467 2026] [:error] [pid 35060:tid 35072] [client 165.245.142.82:63142] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7RZL8JPoS_tq-tiUQwwAAA0o"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:29.713561 2026] [:error] [pid 35060:tid 35072] [client 165.245.142.82:63142] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7RZL8JPoS_tq-tiUQwwAAA0o"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:31.236013 2026] [:error] [pid 35060:tid 35084] [client 165.245.142.82:64362] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7R5L8JPoS_tq-tiUQyAAAA1Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:31.951755 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:64362] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7R5L8JPoS_tq-tiUQywAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:31.951823 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:64362] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7R5L8JPoS_tq-tiUQywAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:32.721431 2026] [:error] [pid 35060:tid 35084] [client 165.245.142.82:64902] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7SJL8JPoS_tq-tiUQzwAAA1Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:33.486578 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:65102] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7SZL8JPoS_tq-tiUQ1QAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:34.252522 2026] [:error] [pid 35060:tid 35084] [client 165.245.142.82:65319] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7SpL8JPoS_tq-tiUQ2AAAA1Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:35.011685 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:49158] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7S5L8JPoS_tq-tiUQ2gAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:35.782307 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:49345] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7S4qZbPJ_JGYY1RQGAAAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:37.281212 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:49345] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7TYqZbPJ_JGYY1RQGBAAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:38.059205 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:49345] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7ToqZbPJ_JGYY1RQGCQAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:38.766281 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:49345] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7ToqZbPJ_JGYY1RQGCwAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:39.526851 2026] [:error] [pid 33976:tid 33998] [client 165.245.142.82:50322] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7TwUyU3c4Xm_xpMTQ9QAAAlQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:40.308833 2026] [:error] [pid 21159:tid 21243] [client 165.245.142.82:50517] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7UOLi3ouy1NZIkgpdIwAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:41.075197 2026] [:error] [pid 33767:tid 33780] [client 165.245.142.82:50712] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7UUGyeKe3MWsxvBgdrwAAAgo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:41.830189 2026] [:error] [pid 34286:tid 34288] [client 165.245.142.82:50916] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7UXPFxpCIhHW6Xmm0cAAAAoA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:41.830233 2026] [:error] [pid 34286:tid 34288] [client 165.245.142.82:50916] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7UXPFxpCIhHW6Xmm0cAAAAoA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:42.586371 2026] [:error] [pid 34286:tid 34288] [client 165.245.142.82:51113] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7UnPFxpCIhHW6Xmm0dAAAAoA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:43.358636 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:51338] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7U5L8JPoS_tq-tiUQ5gAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:44.124164 2026] [:error] [pid 34785:tid 34806] [client 165.245.142.82:51542] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7VIC4dBNEGEcJx-ON0gAAAxM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:44.884309 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:51747] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7VOLi3ouy1NZIkgpdKwAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:45.651043 2026] [:error] [pid 33539:tid 33548] [client 165.245.142.82:51967] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7VdCsLwBYg4s018vIGAAAAcM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:45.651135 2026] [:error] [pid 33539:tid 33548] [client 165.245.142.82:51967] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7VdCsLwBYg4s018vIGAAAAcM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:47.152800 2026] [:error] [pid 34286:tid 34288] [client 165.245.142.82:52182] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7V3PFxpCIhHW6Xmm0hQAAAoA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:47.898041 2026] [:error] [pid 34286:tid 34296] [client 165.245.142.82:52182] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7V3PFxpCIhHW6Xmm0iAAAAog"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:47.898111 2026] [:error] [pid 34286:tid 34296] [client 165.245.142.82:52182] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7V3PFxpCIhHW6Xmm0iAAAAog"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:48.666968 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:52820] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7WOLi3ouy1NZIkgpdOQAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:49.427850 2026] [:error] [pid 33229:tid 33234] [client 165.245.142.82:53039] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7WXzT4c9ddlGE6FxnzwAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:50.181741 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:53236] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7WnzT4c9ddlGE6Fxn0QAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:50.949645 2026] [:error] [pid 33229:tid 33236] [client 165.245.142.82:53428] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7WnzT4c9ddlGE6Fxn1gAAAYU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:51.706113 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:53631] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7W-Li3ouy1NZIkgpdQAAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:52.433777 2026] [:error] [pid 21159:tid 21222] [client 165.245.142.82:53631] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7XOLi3ouy1NZIkgpdQgAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:53.197903 2026] [:error] [pid 34286:tid 34288] [client 165.245.142.82:54032] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7XXPFxpCIhHW6Xmm0mgAAAoA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:53.964538 2026] [:error] [pid 34286:tid 34288] [client 165.245.142.82:54254] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7XXPFxpCIhHW6Xmm0ngAAAoA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:54.729477 2026] [:error] [pid 21159:tid 21243] [client 165.245.142.82:54444] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7XuLi3ouy1NZIkgpdRQAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:55.484166 2026] [:error] [pid 33539:tid 33564] [client 165.245.142.82:54663] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7X9CsLwBYg4s018vIHAAAAdI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:56.183754 2026] [:error] [pid 33539:tid 33546] [client 165.245.142.82:54663] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7YNCsLwBYg4s018vIHQAAAcE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:56.947618 2026] [:error] [pid 34552:tid 34558] [client 165.245.142.82:55044] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7YHBlU_DRqGi4yvseUQAAAsM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:57.713863 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:55241] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7YYqZbPJ_JGYY1RQGGwAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:58.480133 2026] [:error] [pid 34552:tid 34558] [client 165.245.142.82:55462] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7YnBlU_DRqGi4yvseVwAAAsM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:06:59.245165 2026] [:error] [pid 33229:tid 33234] [client 165.245.142.82:55682] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7Y3zT4c9ddlGE6Fxn6QAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:00.034599 2026] [:error] [pid 33229:tid 33234] [client 165.245.142.82:55682] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7ZHzT4c9ddlGE6Fxn6wAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:00.792995 2026] [:error] [pid 8688:tid 8714] [client 165.245.142.82:56059] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7ZDHJ4Nn-RvulD0rreQAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:01.571062 2026] [:error] [pid 34286:tid 34288] [client 165.245.142.82:56254] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7ZXPFxpCIhHW6Xmm1EQAAAoA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:02.339220 2026] [:error] [pid 21263:tid 21279] [client 165.245.142.82:56461] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7ZtAxjzLvN1upBhkqYQAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:03.096188 2026] [:error] [pid 34785:tid 34792] [client 165.245.142.82:56651] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7Z4C4dBNEGEcJx-ON_wAAAwU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:03.096268 2026] [:error] [pid 34785:tid 34792] [client 165.245.142.82:56651] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7Z4C4dBNEGEcJx-ON_wAAAwU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:03.857911 2026] [:error] [pid 8688:tid 8713] [client 165.245.142.82:56853] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7ZzHJ4Nn-RvulD0rrfwAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:04.638812 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:57059] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7aJL8JPoS_tq-tiURCAAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:05.393622 2026] [:error] [pid 33229:tid 33234] [client 165.245.142.82:57279] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7aXzT4c9ddlGE6Fxn-QAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:06.150808 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:57478] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7anzT4c9ddlGE6Fxn_AAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:06.905230 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:57689] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7aoqZbPJ_JGYY1RQGKgAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:06.905285 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:57689] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7aoqZbPJ_JGYY1RQGKgAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:07.667638 2026] [:error] [pid 34286:tid 34312] [client 165.245.142.82:57913] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7a3PFxpCIhHW6Xmm1HQAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:08.426211 2026] [:error] [pid 34286:tid 34293] [client 165.245.142.82:58130] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7bHPFxpCIhHW6Xmm1IQAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:09.182998 2026] [:error] [pid 8688:tid 8695] [client 165.245.142.82:58340] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7bTHJ4Nn-RvulD0rrgQAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:09.950093 2026] [:error] [pid 34286:tid 34312] [client 165.245.142.82:58542] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7bXPFxpCIhHW6Xmm1JgAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:10.715628 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:58722] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7bpL8JPoS_tq-tiURFwAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:13.943296 2026] [:error] [pid 35060:tid 35072] [client 165.245.142.82:59386] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7cZL8JPoS_tq-tiURHgAAA0o"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:14.652939 2026] [:error] [pid 35060:tid 35072] [client 165.245.142.82:59386] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7cpL8JPoS_tq-tiURHwAAA0o"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:16.155761 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:59386] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7dJL8JPoS_tq-tiURJQAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:16.856291 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:59386] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7dJL8JPoS_tq-tiURJgAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:16.856350 2026] [:error] [pid 35060:tid 35077] [client 165.245.142.82:59386] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7dJL8JPoS_tq-tiURJgAAA08"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:17.627250 2026] [:error] [pid 33539:tid 33570] [client 165.245.142.82:60546] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7ddCsLwBYg4s018vIMgAAAdg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:18.392836 2026] [:error] [pid 33767:tid 33792] [client 165.245.142.82:60771] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7dkGyeKe3MWsxvBgdxwAAAhY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:19.160269 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:60991] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7d4C4dBNEGEcJx-OOJwAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:19.933223 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:61184] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7d4qZbPJ_JGYY1RQGPgAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:20.714951 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:61405] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7eIC4dBNEGEcJx-OOLAAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:20.715106 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:61405] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7eIC4dBNEGEcJx-OOLAAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:22.202049 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:61618] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7eoC4dBNEGEcJx-OONwAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:22.909323 2026] [:error] [pid 34785:tid 34792] [client 165.245.142.82:61618] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7eoC4dBNEGEcJx-OOOgAAAwU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:22.909436 2026] [:error] [pid 34785:tid 34792] [client 165.245.142.82:61618] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7eoC4dBNEGEcJx-OOOgAAAwU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:24.469575 2026] [:error] [pid 8688:tid 8712] [client 165.245.142.82:62238] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7fDHJ4Nn-RvulD0rrmAAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:25.208853 2026] [:error] [pid 8688:tid 8695] [client 165.245.142.82:62238] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7fTHJ4Nn-RvulD0rrmgAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:25.208913 2026] [:error] [pid 8688:tid 8695] [client 165.245.142.82:62238] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7fTHJ4Nn-RvulD0rrmgAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:26.803613 2026] [:error] [pid 33767:tid 33794] [client 165.245.142.82:62911] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7fkGyeKe3MWsxvBgd4AAAAhg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:27.514775 2026] [:error] [pid 33767:tid 33788] [client 165.245.142.82:62911] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7f0GyeKe3MWsxvBgd5gAAAhI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:27.514854 2026] [:error] [pid 33767:tid 33788] [client 165.245.142.82:62911] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7f0GyeKe3MWsxvBgd5gAAAhI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:28.988526 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:63515] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7gIqZbPJ_JGYY1RQGTQAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:29.732460 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:63515] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7gYqZbPJ_JGYY1RQGTgAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:29.732560 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:63515] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7gYqZbPJ_JGYY1RQGTgAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:30.494324 2026] [:error] [pid 33767:tid 33773] [client 165.245.142.82:64123] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7gkGyeKe3MWsxvBgd6AAAAgM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:31.259043 2026] [:error] [pid 8688:tid 8706] [client 165.245.142.82:64322] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7gzHJ4Nn-RvulD0rrpwAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:32.032859 2026] [:error] [pid 24576:tid 24589] [client 165.245.142.82:64501] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7hIvfb5CnctJh071SJwAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:32.806869 2026] [:error] [pid 8688:tid 8712] [client 165.245.142.82:64687] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7hDHJ4Nn-RvulD0rrqwAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:33.573295 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:64889] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7hYqZbPJ_JGYY1RQGUwAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:33.573358 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:64889] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7hYqZbPJ_JGYY1RQGUwAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:35.042621 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:65088] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7h4qZbPJ_JGYY1RQGVwAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:35.741975 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:65088] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7h4qZbPJ_JGYY1RQGXQAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:37.193843 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:65088] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7iYqZbPJ_JGYY1RQGYAAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:37.193916 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:65088] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7iYqZbPJ_JGYY1RQGYAAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:37.955517 2026] [:error] [pid 33539:tid 33548] [client 165.245.142.82:49605] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7idCsLwBYg4s018vIQQAAAcM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:38.714793 2026] [:error] [pid 33539:tid 33550] [client 165.245.142.82:49823] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7itCsLwBYg4s018vIQgAAAcU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:39.488968 2026] [:error] [pid 33767:tid 33776] [client 165.245.142.82:50046] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7i0GyeKe3MWsxvBgeAQAAAgY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:40.250479 2026] [:error] [pid 24576:tid 24601] [client 165.245.142.82:50235] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7jIvfb5CnctJh071SKwAAARU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:41.294116 2026] [:error] [pid 24576:tid 24603] [client 165.245.142.82:50235] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7jYvfb5CnctJh071SLQAAARc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:42.057926 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:50700] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7joqZbPJ_JGYY1RQGbAAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:42.837078 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:50885] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7joqZbPJ_JGYY1RQGbgAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:43.606305 2026] [:error] [pid 33539:tid 33546] [client 165.245.142.82:51093] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7j9CsLwBYg4s018vIRQAAAcE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:44.360747 2026] [:error] [pid 8688:tid 8714] [client 165.245.142.82:51284] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7kDHJ4Nn-RvulD0rr0AAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:45.854774 2026] [:error] [pid 8688:tid 8690] [client 165.245.142.82:51284] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7kTHJ4Nn-RvulD0rr3gAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:45.854847 2026] [:error] [pid 8688:tid 8690] [client 165.245.142.82:51284] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7kTHJ4Nn-RvulD0rr3gAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:46.608428 2026] [:error] [pid 34286:tid 34312] [client 165.245.142.82:51838] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7knPFxpCIhHW6Xmm1RgAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:47.362946 2026] [:error] [pid 34785:tid 34792] [client 165.245.142.82:52034] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7k4C4dBNEGEcJx-OObwAAAwU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:48.119751 2026] [:error] [pid 24576:tid 24595] [client 165.245.142.82:52223] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7lIvfb5CnctJh071SMAAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:48.887229 2026] [:error] [pid 33767:tid 33773] [client 165.245.142.82:52431] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7lEGyeKe3MWsxvBgeFwAAAgM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:48.887323 2026] [:error] [pid 33767:tid 33773] [client 165.245.142.82:52431] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7lEGyeKe3MWsxvBgeFwAAAgM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:49.650310 2026] [:error] [pid 24576:tid 24599] [client 165.245.142.82:52618] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7lYvfb5CnctJh071SMwAAARM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:50.416750 2026] [:error] [pid 33539:tid 33564] [client 165.245.142.82:52786] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7ltCsLwBYg4s018vISAAAAdI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:51.184269 2026] [:error] [pid 24576:tid 24603] [client 165.245.142.82:52979] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7l4vfb5CnctJh071SNgAAARc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:51.948989 2026] [:error] [pid 34286:tid 34293] [client 165.245.142.82:53167] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7l3PFxpCIhHW6Xmm1WgAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:52.719722 2026] [:error] [pid 33539:tid 33548] [client 165.245.142.82:53336] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7mNCsLwBYg4s018vITQAAAcM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:52.719787 2026] [:error] [pid 33539:tid 33548] [client 165.245.142.82:53336] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7mNCsLwBYg4s018vITQAAAcM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:54.796128 2026] [:error] [pid 33767:tid 33773] [client 165.245.142.82:53658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7mkGyeKe3MWsxvBgeKgAAAgM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:54.796215 2026] [:error] [pid 33767:tid 33773] [client 165.245.142.82:53658] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7mkGyeKe3MWsxvBgeKgAAAgM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:55.556437 2026] [:error] [pid 34286:tid 34293] [client 165.245.142.82:54041] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7m3PFxpCIhHW6Xmm1YQAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:56.321768 2026] [:error] [pid 8688:tid 8714] [client 165.245.142.82:54237] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7nDHJ4Nn-RvulD0rr-QAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:57.089227 2026] [:error] [pid 21263:tid 21270] [client 165.245.142.82:54436] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7ndAxjzLvN1upBhkqigAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:57.089314 2026] [:error] [pid 21263:tid 21270] [client 165.245.142.82:54436] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7ndAxjzLvN1upBhkqigAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:57.856451 2026] [:error] [pid 33539:tid 33565] [client 165.245.142.82:54615] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7ndCsLwBYg4s018vIXQAAAdM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:58.620225 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:54817] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7nnzT4c9ddlGE6FxoJQAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:07:59.387491 2026] [:error] [pid 34552:tid 34577] [client 165.245.142.82:55013] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7n3BlU_DRqGi4yvsebgAAAtY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:00.144031 2026] [:error] [pid 34552:tid 34570] [client 165.245.142.82:55194] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7oHBlU_DRqGi4yvsedAAAAs8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:00.901276 2026] [:error] [pid 33767:tid 33794] [client 165.245.142.82:55408] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7oEGyeKe3MWsxvBgeNgAAAhg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:00.901404 2026] [:error] [pid 33767:tid 33794] [client 165.245.142.82:55408] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7oEGyeKe3MWsxvBgeNgAAAhg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:01.655558 2026] [:error] [pid 34552:tid 34570] [client 165.245.142.82:55586] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7oXBlU_DRqGi4yvseegAAAs8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:02.410132 2026] [:error] [pid 33229:tid 33252] [client 165.245.142.82:55729] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7onzT4c9ddlGE6FxoKQAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:03.166746 2026] [:error] [pid 33767:tid 33773] [client 165.245.142.82:55897] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7o0GyeKe3MWsxvBgePAAAAgM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:03.932100 2026] [:error] [pid 21159:tid 21244] [client 165.245.142.82:56076] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7o-Li3ouy1NZIkgpdZgAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:04.702080 2026] [:error] [pid 34785:tid 34792] [client 165.245.142.82:56248] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7pIC4dBNEGEcJx-OOpQAAAwU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:06.183565 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:56248] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7poC4dBNEGEcJx-OOrQAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:06.893220 2026] [:error] [pid 34785:tid 34802] [client 165.245.142.82:56248] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7poC4dBNEGEcJx-OOtAAAAw8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:06.893306 2026] [:error] [pid 34785:tid 34802] [client 165.245.142.82:56248] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7poC4dBNEGEcJx-OOtAAAAw8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:08.372051 2026] [:error] [pid 8688:tid 8713] [client 165.245.142.82:56961] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7qDHJ4Nn-RvulD0rsHQAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:08.372130 2026] [:error] [pid 8688:tid 8713] [client 165.245.142.82:56961] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7qDHJ4Nn-RvulD0rsHQAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:09.139587 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:57277] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7qYC4dBNEGEcJx-OOvwAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:09.909561 2026] [:error] [pid 33229:tid 33252] [client 165.245.142.82:57441] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7qXzT4c9ddlGE6FxoOgAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:10.670964 2026] [:error] [pid 34552:tid 34577] [client 165.245.142.82:57591] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7qnBlU_DRqGi4yvseiwAAAtY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:11.433693 2026] [:error] [pid 21263:tid 21275] [client 165.245.142.82:57746] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7q9AxjzLvN1upBhkqpAAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:11.433772 2026] [:error] [pid 21263:tid 21275] [client 165.245.142.82:57746] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7q9AxjzLvN1upBhkqpAAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:14.437524 2026] [:error] [pid 8688:tid 8705] [client 165.245.142.82:58230] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7rjHJ4Nn-RvulD0rsZQAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:14.437638 2026] [:error] [pid 8688:tid 8705] [client 165.245.142.82:58230] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7rjHJ4Nn-RvulD0rsZQAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:15.204369 2026] [:error] [pid 34552:tid 34570] [client 165.245.142.82:58575] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7r3BlU_DRqGi4yvselgAAAs8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:15.965757 2026] [:error] [pid 8688:tid 8713] [client 165.245.142.82:58743] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7rzHJ4Nn-RvulD0rsaQAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:16.728450 2026] [:error] [pid 33767:tid 33770] [client 165.245.142.82:58910] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7sEGyeKe3MWsxvBgeUAAAAgA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:16.728522 2026] [:error] [pid 33767:tid 33770] [client 165.245.142.82:58910] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7sEGyeKe3MWsxvBgeUAAAAgA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:18.219828 2026] [:error] [pid 34552:tid 34577] [client 165.245.142.82:59084] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7snBlU_DRqGi4yvseoAAAAtY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:18.219882 2026] [:error] [pid 34552:tid 34577] [client 165.245.142.82:59084] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7snBlU_DRqGi4yvseoAAAAtY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:18.978700 2026] [:error] [pid 8688:tid 8713] [client 165.245.142.82:59445] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7sjHJ4Nn-RvulD0rsbwAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:19.744979 2026] [:error] [pid 33767:tid 33789] [client 165.245.142.82:59630] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7s0GyeKe3MWsxvBgeVgAAAhM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:20.517320 2026] [:error] [pid 33767:tid 33779] [client 165.245.142.82:59826] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7tEGyeKe3MWsxvBgeXAAAAgk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:21.273329 2026] [:error] [pid 8688:tid 8697] [client 165.245.142.82:59994] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7tTHJ4Nn-RvulD0rsdwAAAUc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:21.994675 2026] [:error] [pid 8688:tid 8705] [client 165.245.142.82:59994] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7tTHJ4Nn-RvulD0rsfQAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:22.776259 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:60321] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7toC4dBNEGEcJx-OO7wAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:23.542310 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:60506] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7t3zT4c9ddlGE6FxoWQAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:24.319342 2026] [:error] [pid 34552:tid 34570] [client 165.245.142.82:60703] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7uHBlU_DRqGi4yvseqQAAAs8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:25.091165 2026] [:error] [pid 8688:tid 8697] [client 165.245.142.82:60885] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7uTHJ4Nn-RvulD0rshgAAAUc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:25.091244 2026] [:error] [pid 8688:tid 8697] [client 165.245.142.82:60885] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7uTHJ4Nn-RvulD0rshgAAAUc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:26.582504 2026] [:error] [pid 21263:tid 21282] [client 165.245.142.82:61074] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7utAxjzLvN1upBhkqrQAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:27.264347 2026] [:error] [pid 21263:tid 21290] [client 165.245.142.82:61074] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7u9AxjzLvN1upBhkqrgAAANc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:28.005969 2026] [:error] [pid 21263:tid 21267] [client 165.245.142.82:61074] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7vNAxjzLvN1upBhkqrwAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:28.783323 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:61693] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7vIqZbPJ_JGYY1RQGogAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:29.540844 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:61870] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7vXzT4c9ddlGE6FxoZwAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:30.295131 2026] [:error] [pid 21263:tid 21287] [client 165.245.142.82:62033] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7vtAxjzLvN1upBhkqsAAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:31.050550 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:62199] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7v4qZbPJ_JGYY1RQGpAAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:31.816229 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:62199] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7v4qZbPJ_JGYY1RQGpgAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:32.573273 2026] [:error] [pid 33767:tid 33790] [client 165.245.142.82:62559] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7wEGyeKe3MWsxvBgefAAAAhQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:33.328573 2026] [:error] [pid 33767:tid 33788] [client 165.245.142.82:62723] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7wUGyeKe3MWsxvBgefgAAAhI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:34.088822 2026] [:error] [pid 24576:tid 24586] [client 165.245.142.82:62901] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7wovfb5CnctJh071SWwAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:34.855887 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:63068] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7wnzT4c9ddlGE6FxocAAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:36.308621 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:63068] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7xHzT4c9ddlGE6FxodQAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:36.308700 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:63068] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7xHzT4c9ddlGE6FxodQAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:37.065796 2026] [:error] [pid 21263:tid 21267] [client 165.245.142.82:63571] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7xdAxjzLvN1upBhkqtwAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:37.824153 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:63765] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7xXzT4c9ddlGE6FxoegAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:38.588865 2026] [:error] [pid 33539:tid 33545] [client 165.245.142.82:63951] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7xtCsLwBYg4s018vIhQAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:39.345257 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:64149] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7x4qZbPJ_JGYY1RQGsAAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:39.345328 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:64149] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7x4qZbPJ_JGYY1RQGsAAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:41.697638 2026] [:error] [pid 34785:tid 34802] [client 165.245.142.82:64711] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7yYC4dBNEGEcJx-OPEQAAAw8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:42.455311 2026] [:error] [pid 33229:tid 33252] [client 165.245.142.82:64900] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7ynzT4c9ddlGE6FxofwAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:43.219174 2026] [:error] [pid 34785:tid 34802] [client 165.245.142.82:65065] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7y4C4dBNEGEcJx-OPFQAAAw8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:43.979650 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:65239] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7y3zT4c9ddlGE6FxohwAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:43.979753 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:65239] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7y3zT4c9ddlGE6FxohwAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:44.746246 2026] [:error] [pid 24576:tid 24599] [client 165.245.142.82:65424] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7zIvfb5CnctJh071SXQAAARM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:45.509817 2026] [:error] [pid 8688:tid 8694] [client 165.245.142.82:49229] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7zTHJ4Nn-RvulD0rssQAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:46.284228 2026] [:error] [pid 33539:tid 33565] [client 165.245.142.82:49404] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7ztCsLwBYg4s018vIlgAAAdM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:47.042108 2026] [:error] [pid 35654:tid 35680] [client 165.245.142.82:49577] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7z0IPeuEwCTirofKZfwAAA9Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:47.808685 2026] [:error] [pid 34785:tid 34802] [client 165.245.142.82:49773] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7z4C4dBNEGEcJx-OPHAAAAw8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:48.514087 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:49773] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO70IC4dBNEGEcJx-OPHQAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:49.278203 2026] [:error] [pid 35654:tid 35660] [client 165.245.142.82:50140] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO70UIPeuEwCTirofKZgwAAA8I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:50.041894 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:50325] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO70nzT4c9ddlGE6FxolwAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:50.807789 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:50513] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO70oqZbPJ_JGYY1RQGwwAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:51.589155 2026] [:error] [pid 34552:tid 34577] [client 165.245.142.82:50694] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO703BlU_DRqGi4yvsetQAAAtY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:51.589235 2026] [:error] [pid 34552:tid 34577] [client 165.245.142.82:50694] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO703BlU_DRqGi4yvsetQAAAtY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:52.355946 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:50894] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO71IqZbPJ_JGYY1RQGxgAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:53.123674 2026] [:error] [pid 35654:tid 35660] [client 165.245.142.82:51070] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO71UIPeuEwCTirofKZiwAAA8I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:53.894333 2026] [:error] [pid 34552:tid 34577] [client 165.245.142.82:51247] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO71XBlU_DRqGi4yvseuwAAAtY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:54.666641 2026] [:error] [pid 34552:tid 34577] [client 165.245.142.82:51459] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO71nBlU_DRqGi4yvsevwAAAtY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:55.440047 2026] [:error] [pid 35654:tid 35680] [client 165.245.142.82:51673] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO710IPeuEwCTirofKZjwAAA9Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:56.239066 2026] [:error] [pid 35654:tid 35680] [client 165.245.142.82:51673] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO72EIPeuEwCTirofKZlAAAA9Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:57.005484 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:52073] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO72YC4dBNEGEcJx-OPMwAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:57.761402 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:52250] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO72YC4dBNEGEcJx-OPOAAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:58.515891 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:52464] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO72oC4dBNEGEcJx-OPOQAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:59.277589 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:52648] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO724C4dBNEGEcJx-OPOgAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:08:59.277659 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:52648] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO724C4dBNEGEcJx-OPOgAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:00.040064 2026] [:error] [pid 35654:tid 35675] [client 165.245.142.82:52824] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO73EIPeuEwCTirofKZmAAAA9E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:00.807755 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:53020] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO73IC4dBNEGEcJx-OPQQAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:01.576890 2026] [:error] [pid 21159:tid 21244] [client 165.245.142.82:53216] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO73eLi3ouy1NZIkgpdtwAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:02.339793 2026] [:error] [pid 35654:tid 35660] [client 165.245.142.82:53397] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO73kIPeuEwCTirofKZoQAAA8I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:03.105376 2026] [:error] [pid 35060:tid 35067] [client 165.245.142.82:53563] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO735L8JPoS_tq-tiURZQAAA0U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:03.105479 2026] [:error] [pid 35060:tid 35067] [client 165.245.142.82:53563] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO735L8JPoS_tq-tiURZQAAA0U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:04.601579 2026] [:error] [pid 34552:tid 34577] [client 165.245.142.82:53761] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO74HBlU_DRqGi4yvse0AAAAtY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:04.601643 2026] [:error] [pid 34552:tid 34577] [client 165.245.142.82:53761] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO74HBlU_DRqGi4yvse0AAAAtY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:05.369536 2026] [:error] [pid 33767:tid 33778] [client 165.245.142.82:54142] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO74UGyeKe3MWsxvBgemwAAAgg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:06.136975 2026] [:error] [pid 33767:tid 33776] [client 165.245.142.82:54329] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO74kGyeKe3MWsxvBgenAAAAgY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:06.894070 2026] [:error] [pid 34552:tid 34577] [client 165.245.142.82:54500] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO74nBlU_DRqGi4yvse1QAAAtY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:07.650344 2026] [:error] [pid 34552:tid 34570] [client 165.245.142.82:54658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO743BlU_DRqGi4yvse1gAAAs8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:07.650455 2026] [:error] [pid 34552:tid 34570] [client 165.245.142.82:54658] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO743BlU_DRqGi4yvse1gAAAs8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:09.166562 2026] [:error] [pid 35654:tid 35675] [client 165.245.142.82:54830] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO75UIPeuEwCTirofKZrAAAA9E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:09.868352 2026] [:error] [pid 35654:tid 35660] [client 165.245.142.82:54830] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO75UIPeuEwCTirofKZrgAAA8I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:10.572076 2026] [:error] [pid 35654:tid 35675] [client 165.245.142.82:54830] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO75kIPeuEwCTirofKZsAAAA9E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:11.338576 2026] [:error] [pid 34785:tid 34802] [client 165.245.142.82:55428] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO754C4dBNEGEcJx-OPSQAAAw8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:12.094846 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:55599] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO76IC4dBNEGEcJx-OPTgAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:12.854800 2026] [:error] [pid 21159:tid 21243] [client 165.245.142.82:55734] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO76OLi3ouy1NZIkgpdxQAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:13.623352 2026] [:error] [pid 34785:tid 34802] [client 165.245.142.82:55883] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO76YC4dBNEGEcJx-OPVgAAAw8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:14.307120 2026] [:error] [pid 34785:tid 34802] [client 165.245.142.82:55883] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO76oC4dBNEGEcJx-OPVwAAAw8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:15.078223 2026] [:error] [pid 35654:tid 35675] [client 165.245.142.82:56185] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO760IPeuEwCTirofKZsQAAA9E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:15.841066 2026] [:error] [pid 35654:tid 35660] [client 165.245.142.82:56357] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO760IPeuEwCTirofKZsgAAA8I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:16.624056 2026] [:error] [pid 35654:tid 35660] [client 165.245.142.82:56498] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO77EIPeuEwCTirofKZtQAAA8I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:17.388855 2026] [:error] [pid 21159:tid 21235] [client 165.245.142.82:56679] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO77eLi3ouy1NZIkgpdzwAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:17.388927 2026] [:error] [pid 21159:tid 21235] [client 165.245.142.82:56679] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO77eLi3ouy1NZIkgpdzwAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:18.921283 2026] [:error] [pid 21159:tid 21235] [client 165.245.142.82:56848] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO77uLi3ouy1NZIkgpd1gAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:19.666823 2026] [:error] [pid 21159:tid 21235] [client 165.245.142.82:56848] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO77-Li3ouy1NZIkgpd2AAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:19.666902 2026] [:error] [pid 21159:tid 21235] [client 165.245.142.82:56848] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO77-Li3ouy1NZIkgpd2AAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:20.433003 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:57326] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO78IqZbPJ_JGYY1RQG8AAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:21.187951 2026] [:error] [pid 21159:tid 21244] [client 165.245.142.82:57489] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO78eLi3ouy1NZIkgpd4AAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:21.948010 2026] [:error] [pid 35654:tid 35660] [client 165.245.142.82:57644] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO78UIPeuEwCTirofKZzgAAA8I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:22.715645 2026] [:error] [pid 34552:tid 34577] [client 165.245.142.82:57792] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO78nBlU_DRqGi4yvse3QAAAtY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:23.471890 2026] [:error] [pid 24576:tid 24599] [client 165.245.142.82:57937] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO784vfb5CnctJh071SZgAAARM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:23.471995 2026] [:error] [pid 24576:tid 24599] [client 165.245.142.82:57937] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO784vfb5CnctJh071SZgAAARM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:24.241266 2026] [:error] [pid 8688:tid 8690] [client 165.245.142.82:58087] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO79DHJ4Nn-RvulD0rszgAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:25.010347 2026] [:error] [pid 8688:tid 8706] [client 165.245.142.82:58244] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO79THJ4Nn-RvulD0rs1gAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:25.774790 2026] [:error] [pid 35060:tid 35071] [client 165.245.142.82:58432] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO79ZL8JPoS_tq-tiURcwAAA0k"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:26.541348 2026] [:error] [pid 34552:tid 34577] [client 165.245.142.82:58592] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO79nBlU_DRqGi4yvse4QAAAtY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:27.300201 2026] [:error] [pid 33767:tid 33779] [client 165.245.142.82:58760] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO790GyeKe3MWsxvBgerwAAAgk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:28.842839 2026] [:error] [pid 33767:tid 33778] [client 165.245.142.82:58760] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7-EGyeKe3MWsxvBgeswAAAgg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:29.625641 2026] [:error] [pid 33767:tid 33780] [client 165.245.142.82:58760] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7-UGyeKe3MWsxvBgetwAAAgo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:29.625717 2026] [:error] [pid 33767:tid 33780] [client 165.245.142.82:58760] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7-UGyeKe3MWsxvBgetwAAAgo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:31.364189 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:59505] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7-4C4dBNEGEcJx-OPagAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:31.364273 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:59505] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7-4C4dBNEGEcJx-OPagAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:32.122567 2026] [:error] [pid 21263:tid 21270] [client 165.245.142.82:59824] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7_NAxjzLvN1upBhkqxgAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:32.882014 2026] [:error] [pid 24576:tid 24599] [client 165.245.142.82:60007] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO7_Ivfb5CnctJh071SbQAAARM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:33.646257 2026] [:error] [pid 35654:tid 35679] [client 165.245.142.82:60186] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7_UIPeuEwCTirofKZ5AAAA9U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:33.646306 2026] [:error] [pid 35654:tid 35679] [client 165.245.142.82:60186] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO7_UIPeuEwCTirofKZ5AAAA9U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:34.407943 2026] [:error] [pid 35654:tid 35680] [client 165.245.142.82:60360] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO7_kIPeuEwCTirofKZ5QAAA9Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:35.176086 2026] [:error] [pid 8688:tid 8713] [client 165.245.142.82:60541] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO7_zHJ4Nn-RvulD0rs7AAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:35.934298 2026] [:error] [pid 33539:tid 33545] [client 165.245.142.82:60727] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO7_9CsLwBYg4s018vIrgAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:36.698127 2026] [:error] [pid 35350:tid 35368] [client 165.245.142.82:60893] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8AIqZbPJ_JGYY1RQHFwAAA5A"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:37.471607 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:61086] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8AYC4dBNEGEcJx-OPcgAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:37.471677 2026] [:error] [pid 34785:tid 34811] [client 165.245.142.82:61086] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8AYC4dBNEGEcJx-OPcgAAAxg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:39.041895 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:61282] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8A4qZbPJ_JGYY1RQHHAAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:39.780687 2026] [:error] [pid 35350:tid 35367] [client 165.245.142.82:61282] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8A4qZbPJ_JGYY1RQHHgAAA48"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:40.631756 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:61282] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8BIqZbPJ_JGYY1RQHHwAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:41.394274 2026] [:error] [pid 21159:tid 21244] [client 165.245.142.82:61974] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8BeLi3ouy1NZIkgpd-QAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:42.151916 2026] [:error] [pid 21263:tid 21267] [client 165.245.142.82:62124] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8BtAxjzLvN1upBhkqyAAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:42.922609 2026] [:error] [pid 24576:tid 24587] [client 165.245.142.82:62280] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8Bovfb5CnctJh071ScQAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:43.682634 2026] [:error] [pid 34552:tid 34577] [client 165.245.142.82:62463] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8B3BlU_DRqGi4yvse8AAAAtY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:43.682692 2026] [:error] [pid 34552:tid 34577] [client 165.245.142.82:62463] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8B3BlU_DRqGi4yvse8AAAAtY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:44.449000 2026] [:error] [pid 35350:tid 35367] [client 165.245.142.82:62651] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8CIqZbPJ_JGYY1RQHKAAAA48"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:45.205096 2026] [:error] [pid 34552:tid 34577] [client 165.245.142.82:62821] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8CXBlU_DRqGi4yvse9AAAAtY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:45.959972 2026] [:error] [pid 34552:tid 34570] [client 165.245.142.82:62999] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8CXBlU_DRqGi4yvse9wAAAs8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:46.731641 2026] [:error] [pid 34552:tid 34570] [client 165.245.142.82:63128] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8CnBlU_DRqGi4yvse-AAAAs8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:47.495422 2026] [:error] [pid 33767:tid 33792] [client 165.245.142.82:63296] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8C0GyeKe3MWsxvBge0gAAAhY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:48.226212 2026] [:error] [pid 33767:tid 33772] [client 165.245.142.82:63296] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8DEGyeKe3MWsxvBge0wAAAgI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:48.985970 2026] [:error] [pid 35350:tid 35368] [client 165.245.142.82:63639] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8DIqZbPJ_JGYY1RQHNwAAA5A"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:49.740451 2026] [:error] [pid 35350:tid 35367] [client 165.245.142.82:63800] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8DYqZbPJ_JGYY1RQHOwAAA48"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:50.512781 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:63954] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8DoqZbPJ_JGYY1RQHPgAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:51.279034 2026] [:error] [pid 35350:tid 35368] [client 165.245.142.82:64130] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8D4qZbPJ_JGYY1RQHQwAAA5A"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:51.279118 2026] [:error] [pid 35350:tid 35368] [client 165.245.142.82:64130] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8D4qZbPJ_JGYY1RQHQwAAA5A"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:52.050733 2026] [:error] [pid 21159:tid 21235] [client 165.245.142.82:64292] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8EOLi3ouy1NZIkgpeBgAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:52.807851 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:64460] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8EIqZbPJ_JGYY1RQHRwAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:53.563220 2026] [:error] [pid 21263:tid 21267] [client 165.245.142.82:64613] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8EdAxjzLvN1upBhkqzQAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:54.328638 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:64761] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8EoqZbPJ_JGYY1RQHSgAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:55.090300 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:64911] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8E3zT4c9ddlGE6Fxo2AAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:55.090387 2026] [:error] [pid 33229:tid 33255] [client 165.245.142.82:64911] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8E3zT4c9ddlGE6Fxo2AAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:56.586993 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:65081] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8FIqZbPJ_JGYY1RQHUAAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:57.307106 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:65081] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8FYqZbPJ_JGYY1RQHUgAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:58.787731 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:65081] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8FoqZbPJ_JGYY1RQHVQAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:59.633011 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:65081] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8F4qZbPJ_JGYY1RQHVgAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:09:59.633085 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:65081] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8F4qZbPJ_JGYY1RQHVgAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:01.176718 2026] [:error] [pid 35060:tid 35067] [client 165.245.142.82:49658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8GZL8JPoS_tq-tiURkQAAA0U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:01.920130 2026] [:error] [pid 35060:tid 35071] [client 165.245.142.82:49658] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8GZL8JPoS_tq-tiURkwAAA0k"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:01.920184 2026] [:error] [pid 35060:tid 35071] [client 165.245.142.82:49658] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8GZL8JPoS_tq-tiURkwAAA0k"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:03.431422 2026] [:error] [pid 21159:tid 21235] [client 165.245.142.82:50081] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8G-Li3ouy1NZIkgpeFgAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:04.142177 2026] [:error] [pid 21159:tid 21235] [client 165.245.142.82:50081] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8HOLi3ouy1NZIkgpeFwAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:04.142274 2026] [:error] [pid 21159:tid 21235] [client 165.245.142.82:50081] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8HOLi3ouy1NZIkgpeFwAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:04.904742 2026] [:error] [pid 33539:tid 33560] [client 165.245.142.82:50491] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8HNCsLwBYg4s018vIxQAAAc8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:05.659796 2026] [:error] [pid 33539:tid 33559] [client 165.245.142.82:50636] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8HdCsLwBYg4s018vIyAAAAc4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:06.417906 2026] [:error] [pid 21159:tid 21244] [client 165.245.142.82:50801] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8HuLi3ouy1NZIkgpeGwAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:07.184009 2026] [:error] [pid 33767:tid 33787] [client 165.245.142.82:50970] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8H0GyeKe3MWsxvBge3QAAAhE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:07.937672 2026] [:error] [pid 8688:tid 8690] [client 165.245.142.82:51132] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8HzHJ4Nn-RvulD0rtGwAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:07.937743 2026] [:error] [pid 8688:tid 8690] [client 165.245.142.82:51132] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8HzHJ4Nn-RvulD0rtGwAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:08.696297 2026] [:error] [pid 8688:tid 8690] [client 165.245.142.82:51308] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8IDHJ4Nn-RvulD0rtHwAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:09.465513 2026] [:error] [pid 35654:tid 35665] [client 165.245.142.82:51491] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8IUIPeuEwCTirofKZ-QAAA8c"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:10.228684 2026] [:error] [pid 8688:tid 8712] [client 165.245.142.82:51653] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8IjHJ4Nn-RvulD0rtJgAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:10.995783 2026] [:error] [pid 35654:tid 35675] [client 165.245.142.82:51838] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8IkIPeuEwCTirofKaAQAAA9E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:11.767237 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:52011] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8I4C4dBNEGEcJx-OPeAAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:11.767296 2026] [:error] [pid 34785:tid 34790] [client 165.245.142.82:52011] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8I4C4dBNEGEcJx-OPeAAAAwM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:15.091927 2026] [:error] [pid 21263:tid 21274] [client 165.245.142.82:52556] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8J9AxjzLvN1upBhkq0wAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:15.783863 2026] [:error] [pid 21263:tid 21283] [client 165.245.142.82:52556] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8J9AxjzLvN1upBhkq1AAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:15.783938 2026] [:error] [pid 21263:tid 21283] [client 165.245.142.82:52556] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8J9AxjzLvN1upBhkq1AAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:16.557755 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:53045] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8KIqZbPJ_JGYY1RQHbAAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:17.324192 2026] [:error] [pid 21159:tid 21243] [client 165.245.142.82:53215] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8KeLi3ouy1NZIkgpeIAAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:18.095270 2026] [:error] [pid 8688:tid 8690] [client 165.245.142.82:53379] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8KjHJ4Nn-RvulD0rtLQAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:18.854214 2026] [:error] [pid 35350:tid 35368] [client 165.245.142.82:53526] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8KoqZbPJ_JGYY1RQHcQAAA5A"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:19.621075 2026] [:error] [pid 24576:tid 24596] [client 165.245.142.82:53694] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8K4vfb5CnctJh071SeQAAARA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:19.621141 2026] [:error] [pid 24576:tid 24596] [client 165.245.142.82:53694] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8K4vfb5CnctJh071SeQAAARA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:21.232692 2026] [:error] [pid 8688:tid 8714] [client 165.245.142.82:53858] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8LTHJ4Nn-RvulD0rtMAAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:21.232781 2026] [:error] [pid 8688:tid 8714] [client 165.245.142.82:53858] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8LTHJ4Nn-RvulD0rtMAAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:21.996517 2026] [:error] [pid 33767:tid 33789] [client 165.245.142.82:54163] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8LUGyeKe3MWsxvBge5wAAAhM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:22.766508 2026] [:error] [pid 21159:tid 21243] [client 165.245.142.82:54313] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8LuLi3ouy1NZIkgpeJwAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:23.522489 2026] [:error] [pid 21159:tid 21235] [client 165.245.142.82:54475] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8L-Li3ouy1NZIkgpeLQAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:23.522568 2026] [:error] [pid 21159:tid 21235] [client 165.245.142.82:54475] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8L-Li3ouy1NZIkgpeLQAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:25.018945 2026] [:error] [pid 21159:tid 21243] [client 165.245.142.82:54618] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8MeLi3ouy1NZIkgpeMgAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:25.747373 2026] [:error] [pid 21159:tid 21243] [client 165.245.142.82:54618] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8MeLi3ouy1NZIkgpeMwAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:26.456129 2026] [:error] [pid 21159:tid 21243] [client 165.245.142.82:54618] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8MuLi3ouy1NZIkgpeNQAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:27.214627 2026] [:error] [pid 33767:tid 33790] [client 165.245.142.82:55315] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8M0GyeKe3MWsxvBge6wAAAhQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:27.979724 2026] [:error] [pid 35654:tid 35664] [client 165.245.142.82:55507] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8M0IPeuEwCTirofKaIQAAA8Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:28.746221 2026] [:error] [pid 8688:tid 8713] [client 165.245.142.82:55709] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8NDHJ4Nn-RvulD0rtRQAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:29.503299 2026] [:error] [pid 21159:tid 21243] [client 165.245.142.82:55889] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8NeLi3ouy1NZIkgpeOAAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:29.503404 2026] [:error] [pid 21159:tid 21243] [client 165.245.142.82:55889] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8NeLi3ouy1NZIkgpeOAAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:30.260445 2026] [:error] [pid 21159:tid 21244] [client 165.245.142.82:56059] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8NuLi3ouy1NZIkgpePAAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:31.028085 2026] [:error] [pid 35654:tid 35664] [client 165.245.142.82:56244] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8N0IPeuEwCTirofKaKgAAA8Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:31.792410 2026] [:error] [pid 33767:tid 33792] [client 165.245.142.82:56424] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8N0GyeKe3MWsxvBge8AAAAhY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:32.559848 2026] [:error] [pid 8688:tid 8712] [client 165.245.142.82:56596] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8ODHJ4Nn-RvulD0rtTAAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:33.324463 2026] [:error] [pid 8688:tid 8706] [client 165.245.142.82:56790] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8OTHJ4Nn-RvulD0rtUAAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:33.324540 2026] [:error] [pid 8688:tid 8706] [client 165.245.142.82:56790] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8OTHJ4Nn-RvulD0rtUAAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:34.098269 2026] [:error] [pid 8688:tid 8712] [client 165.245.142.82:56972] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8OjHJ4Nn-RvulD0rtUwAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:34.853066 2026] [:error] [pid 8688:tid 8712] [client 165.245.142.82:57145] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8OjHJ4Nn-RvulD0rtWQAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:35.618962 2026] [:error] [pid 34286:tid 34312] [client 165.245.142.82:57313] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8O3PFxpCIhHW6Xmm1kgAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:36.384491 2026] [:error] [pid 8688:tid 8706] [client 165.245.142.82:57480] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8PDHJ4Nn-RvulD0rtXwAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:37.143698 2026] [:error] [pid 35350:tid 35368] [client 165.245.142.82:57653] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8PYqZbPJ_JGYY1RQHgAAAA5A"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:38.647854 2026] [:error] [pid 35350:tid 35368] [client 165.245.142.82:57653] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8PoqZbPJ_JGYY1RQHhAAAA5A"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:39.330279 2026] [:error] [pid 35350:tid 35368] [client 165.245.142.82:57653] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8P4qZbPJ_JGYY1RQHhwAAA5A"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:40.056863 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:57653] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8QIqZbPJ_JGYY1RQHiQAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:40.822661 2026] [:error] [pid 8688:tid 8706] [client 165.245.142.82:58490] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8QDHJ4Nn-RvulD0rtZQAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:41.595108 2026] [:error] [pid 8688:tid 8706] [client 165.245.142.82:58664] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8QTHJ4Nn-RvulD0rtZwAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:42.353866 2026] [:error] [pid 8688:tid 8714] [client 165.245.142.82:58837] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8QjHJ4Nn-RvulD0rtbAAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:43.120027 2026] [:error] [pid 35654:tid 35675] [client 165.245.142.82:59002] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8Q0IPeuEwCTirofKaVgAAA9E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:43.120091 2026] [:error] [pid 35654:tid 35675] [client 165.245.142.82:59002] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8Q0IPeuEwCTirofKaVgAAA9E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:44.606553 2026] [:error] [pid 35654:tid 35679] [client 165.245.142.82:59183] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8REIPeuEwCTirofKaXgAAA9U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:45.337728 2026] [:error] [pid 35654:tid 35666] [client 165.245.142.82:59183] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8RUIPeuEwCTirofKaYQAAA8g"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:45.337804 2026] [:error] [pid 35654:tid 35666] [client 165.245.142.82:59183] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8RUIPeuEwCTirofKaYQAAA8g"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:46.103956 2026] [:error] [pid 35654:tid 35679] [client 165.245.142.82:59721] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8RkIPeuEwCTirofKaZAAAA9U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:46.862050 2026] [:error] [pid 35654:tid 35660] [client 165.245.142.82:59888] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8RkIPeuEwCTirofKacQAAA8I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:47.619767 2026] [:error] [pid 35654:tid 35679] [client 165.245.142.82:60078] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8R0IPeuEwCTirofKaewAAA9U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:48.383463 2026] [:error] [pid 34552:tid 34570] [client 165.245.142.82:60254] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8SHBlU_DRqGi4yvsfEQAAAs8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:49.151342 2026] [:error] [pid 35654:tid 35660] [client 165.245.142.82:60424] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8SUIPeuEwCTirofKagQAAA8I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:49.151421 2026] [:error] [pid 35654:tid 35660] [client 165.245.142.82:60424] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8SUIPeuEwCTirofKagQAAA8I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:49.924338 2026] [:error] [pid 21159:tid 21235] [client 165.245.142.82:60609] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8SeLi3ouy1NZIkgpeXQAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:50.692329 2026] [:error] [pid 34286:tid 34295] [client 165.245.142.82:60804] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8SnPFxpCIhHW6Xmm1qgAAAoc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:51.448051 2026] [:error] [pid 8688:tid 8712] [client 165.245.142.82:60973] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8SzHJ4Nn-RvulD0rtdgAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:52.215412 2026] [:error] [pid 21263:tid 21275] [client 165.245.142.82:61146] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8TNAxjzLvN1upBhkq3QAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:52.979766 2026] [:error] [pid 21159:tid 21244] [client 165.245.142.82:61301] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8TOLi3ouy1NZIkgpeYgAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:55.334160 2026] [:error] [pid 35654:tid 35679] [client 165.245.142.82:61628] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8T0IPeuEwCTirofKalQAAA9U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:56.100961 2026] [:error] [pid 35654:tid 35675] [client 165.245.142.82:61628] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8UEIPeuEwCTirofKamAAAA9E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:56.101075 2026] [:error] [pid 35654:tid 35675] [client 165.245.142.82:61628] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8UEIPeuEwCTirofKamAAAA9E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:56.861142 2026] [:error] [pid 34785:tid 34802] [client 165.245.142.82:62164] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8UIC4dBNEGEcJx-OPjgAAAw8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:57.619516 2026] [:error] [pid 34785:tid 34802] [client 165.245.142.82:62319] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8UYC4dBNEGEcJx-OPkAAAAw8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:10:59.761564 2026] [:error] [pid 35654:tid 35660] [client 165.245.142.82:62808] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8U0IPeuEwCTirofKanwAAA8I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:00.528834 2026] [:error] [pid 35654:tid 35664] [client 165.245.142.82:62990] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8VEIPeuEwCTirofKaowAAA8Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:02.081722 2026] [:error] [pid 35654:tid 35665] [client 165.245.142.82:62990] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8VkIPeuEwCTirofKaqAAAA8c"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:02.840980 2026] [:error] [pid 35654:tid 35664] [client 165.245.142.82:62990] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8VkIPeuEwCTirofKaqwAAA8Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:02.841042 2026] [:error] [pid 35654:tid 35664] [client 165.245.142.82:62990] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8VkIPeuEwCTirofKaqwAAA8Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:03.604891 2026] [:error] [pid 33767:tid 33770] [client 165.245.142.82:63682] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8V0GyeKe3MWsxvBge-wAAAgA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:04.376947 2026] [:error] [pid 35350:tid 35368] [client 165.245.142.82:63847] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8WIqZbPJ_JGYY1RQHlQAAA5A"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:05.136619 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:64017] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8WYqZbPJ_JGYY1RQHmAAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:05.902713 2026] [:error] [pid 34785:tid 34796] [client 165.245.142.82:64196] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8WYC4dBNEGEcJx-OPlQAAAwk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:06.667066 2026] [:error] [pid 34785:tid 34796] [client 165.245.142.82:64379] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8WoC4dBNEGEcJx-OPlwAAAwk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:07.384063 2026] [:error] [pid 34785:tid 34796] [client 165.245.142.82:64379] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8W4C4dBNEGEcJx-OPmAAAAwk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:08.158195 2026] [:error] [pid 35060:tid 35071] [client 165.245.142.82:64749] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8XJL8JPoS_tq-tiURmAAAA0k"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:08.917323 2026] [:error] [pid 8688:tid 8712] [client 165.245.142.82:64940] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8XDHJ4Nn-RvulD0rtjAAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:09.681845 2026] [:error] [pid 8688:tid 8694] [client 165.245.142.82:65127] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8XTHJ4Nn-RvulD0rtjgAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:10.453873 2026] [:error] [pid 8688:tid 8694] [client 165.245.142.82:65309] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8XjHJ4Nn-RvulD0rtkwAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:10.453941 2026] [:error] [pid 8688:tid 8694] [client 165.245.142.82:65309] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8XjHJ4Nn-RvulD0rtkwAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:12.016917 2026] [:error] [pid 21159:tid 21243] [client 165.245.142.82:65497] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8YOLi3ouy1NZIkgpefAAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:12.743843 2026] [:error] [pid 21159:tid 21235] [client 165.245.142.82:65497] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8YOLi3ouy1NZIkgpefQAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:14.366933 2026] [:error] [pid 21159:tid 21235] [client 165.245.142.82:65497] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8YuLi3ouy1NZIkgpegAAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:14.366996 2026] [:error] [pid 21159:tid 21235] [client 165.245.142.82:65497] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8YuLi3ouy1NZIkgpegAAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:15.141235 2026] [:error] [pid 21159:tid 21235] [client 165.245.142.82:49959] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8Y-Li3ouy1NZIkgpeggAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:15.897485 2026] [:error] [pid 21263:tid 21290] [client 165.245.142.82:50140] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8Y9AxjzLvN1upBhkq6QAAANc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:16.667400 2026] [:error] [pid 33539:tid 33561] [client 165.245.142.82:50305] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8ZNCsLwBYg4s018vI8gAAAdA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:17.432607 2026] [:error] [pid 35654:tid 35679] [client 165.245.142.82:50473] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8ZUIPeuEwCTirofKa1QAAA9U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:17.432673 2026] [:error] [pid 35654:tid 35679] [client 165.245.142.82:50473] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8ZUIPeuEwCTirofKa1QAAA9U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:18.990040 2026] [:error] [pid 8688:tid 8694] [client 165.245.142.82:50644] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8ZjHJ4Nn-RvulD0rtqQAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:19.742678 2026] [:error] [pid 8688:tid 8712] [client 165.245.142.82:50644] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8ZzHJ4Nn-RvulD0rtqgAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:19.742740 2026] [:error] [pid 8688:tid 8712] [client 165.245.142.82:50644] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8ZzHJ4Nn-RvulD0rtqgAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:21.416024 2026] [:error] [pid 21263:tid 21273] [client 165.245.142.82:51141] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8adAxjzLvN1upBhkq8wAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:22.176543 2026] [:error] [pid 21263:tid 21283] [client 165.245.142.82:51141] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8atAxjzLvN1upBhkq9QAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:22.176627 2026] [:error] [pid 21263:tid 21283] [client 165.245.142.82:51141] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8atAxjzLvN1upBhkq9QAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:23.731316 2026] [:error] [pid 33539:tid 33553] [client 165.245.142.82:51708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8a9CsLwBYg4s018vI-gAAAcg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:24.448258 2026] [:error] [pid 33539:tid 33550] [client 165.245.142.82:51708] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8bNCsLwBYg4s018vI_AAAAcU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:24.448364 2026] [:error] [pid 33539:tid 33550] [client 165.245.142.82:51708] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8bNCsLwBYg4s018vI_AAAAcU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:25.215939 2026] [:error] [pid 24576:tid 24594] [client 165.245.142.82:52242] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8bYvfb5CnctJh071SiQAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:26.001188 2026] [:error] [pid 34552:tid 34570] [client 165.245.142.82:52436] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8bnBlU_DRqGi4yvsfIwAAAs8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:26.760970 2026] [:error] [pid 35654:tid 35660] [client 165.245.142.82:52626] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8bkIPeuEwCTirofKa7AAAA8I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:27.526997 2026] [:error] [pid 21159:tid 21235] [client 165.245.142.82:52789] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8b-Li3ouy1NZIkgpelAAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:28.289934 2026] [:error] [pid 34552:tid 34570] [client 165.245.142.82:52995] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8cHBlU_DRqGi4yvsfLQAAAs8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:28.290000 2026] [:error] [pid 34552:tid 34570] [client 165.245.142.82:52995] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8cHBlU_DRqGi4yvsfLQAAAs8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:29.043945 2026] [:error] [pid 33767:tid 33773] [client 165.245.142.82:53158] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8cUGyeKe3MWsxvBgfGwAAAgM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:29.809036 2026] [:error] [pid 34785:tid 34796] [client 165.245.142.82:53324] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8cYC4dBNEGEcJx-OPsAAAAwk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:30.571929 2026] [:error] [pid 35350:tid 35375] [client 165.245.142.82:53485] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8coqZbPJ_JGYY1RQHtwAAA5c"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:31.326001 2026] [:error] [pid 34785:tid 34796] [client 165.245.142.82:53634] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8c4C4dBNEGEcJx-OPsgAAAwk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:32.088333 2026] [:error] [pid 8688:tid 8690] [client 165.245.142.82:53774] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8dDHJ4Nn-RvulD0rt3wAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:32.794211 2026] [:error] [pid 8688:tid 8712] [client 165.245.142.82:53774] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8dDHJ4Nn-RvulD0rt5QAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:33.550334 2026] [:error] [pid 35654:tid 35679] [client 165.245.142.82:54088] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8dUIPeuEwCTirofKa8wAAA9U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:34.306190 2026] [:error] [pid 35654:tid 35665] [client 165.245.142.82:54244] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8dkIPeuEwCTirofKa-QAAA8c"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:35.059072 2026] [:error] [pid 35654:tid 35664] [client 165.245.142.82:54419] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8d0IPeuEwCTirofKbBwAAA8Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:35.815115 2026] [:error] [pid 21263:tid 21282] [client 165.245.142.82:54579] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8d9AxjzLvN1upBhkrIQAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:37.329508 2026] [:error] [pid 21263:tid 21275] [client 165.245.142.82:54579] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8edAxjzLvN1upBhkrKAAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:38.021886 2026] [:error] [pid 21263:tid 21270] [client 165.245.142.82:54579] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8etAxjzLvN1upBhkrKgAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:38.021989 2026] [:error] [pid 21263:tid 21270] [client 165.245.142.82:54579] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8etAxjzLvN1upBhkrKgAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:38.792693 2026] [:error] [pid 34552:tid 34559] [client 165.245.142.82:55168] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8enBlU_DRqGi4yvsfLwAAAsQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:39.556728 2026] [:error] [pid 34785:tid 34802] [client 165.245.142.82:55308] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8e4C4dBNEGEcJx-OPyQAAAw8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:40.324885 2026] [:error] [pid 21159:tid 21244] [client 165.245.142.82:55435] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8fOLi3ouy1NZIkgpexQAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:41.091995 2026] [:error] [pid 8688:tid 8712] [client 165.245.142.82:55604] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8fTHJ4Nn-RvulD0ruIwAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:41.855557 2026] [:error] [pid 34286:tid 34308] [client 165.245.142.82:55786] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8fXPFxpCIhHW6Xmm15wAAApQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:41.855579 2026] [:error] [pid 34286:tid 34308] [client 165.245.142.82:55786] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8fXPFxpCIhHW6Xmm15wAAApQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:42.620915 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:55927] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8foqZbPJ_JGYY1RQHywAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:43.376271 2026] [:error] [pid 34785:tid 34796] [client 165.245.142.82:56093] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8f4C4dBNEGEcJx-OP0gAAAwk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:44.135844 2026] [:error] [pid 34286:tid 34308] [client 165.245.142.82:56249] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8gHPFxpCIhHW6Xmm17QAAApQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:44.889086 2026] [:error] [pid 34286:tid 34312] [client 165.245.142.82:56406] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8gHPFxpCIhHW6Xmm18QAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:45.649160 2026] [:error] [pid 33767:tid 33784] [client 165.245.142.82:56582] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8gUGyeKe3MWsxvBgfIwAAAg4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:45.649213 2026] [:error] [pid 33767:tid 33784] [client 165.245.142.82:56582] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8gUGyeKe3MWsxvBgfIwAAAg4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:46.405049 2026] [:error] [pid 8688:tid 8712] [client 165.245.142.82:56761] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8gjHJ4Nn-RvulD0ruKAAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:47.173832 2026] [:error] [pid 8688:tid 8713] [client 165.245.142.82:56943] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8gzHJ4Nn-RvulD0ruKQAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:47.934302 2026] [:error] [pid 21159:tid 21235] [client 165.245.142.82:57126] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8g-Li3ouy1NZIkgpe0QAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:48.705692 2026] [:error] [pid 8688:tid 8714] [client 165.245.142.82:57275] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8hDHJ4Nn-RvulD0ruLAAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:49.464130 2026] [:error] [pid 8688:tid 8706] [client 165.245.142.82:57436] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8hTHJ4Nn-RvulD0ruLwAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:49.464223 2026] [:error] [pid 8688:tid 8706] [client 165.245.142.82:57436] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8hTHJ4Nn-RvulD0ruLwAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:51.004488 2026] [:error] [pid 8688:tid 8714] [client 165.245.142.82:57586] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8hzHJ4Nn-RvulD0ruOAAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:51.727417 2026] [:error] [pid 8688:tid 8712] [client 165.245.142.82:57586] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8hzHJ4Nn-RvulD0ruPgAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:53.308311 2026] [:error] [pid 35350:tid 35368] [client 165.245.142.82:58156] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8iYqZbPJ_JGYY1RQH1gAAA5A"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:54.074439 2026] [:error] [pid 34785:tid 34796] [client 165.245.142.82:58305] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8ioC4dBNEGEcJx-OP6gAAAwk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:54.842720 2026] [:error] [pid 34286:tid 34295] [client 165.245.142.82:58449] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8inPFxpCIhHW6Xmm1_gAAAoc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:55.604453 2026] [:error] [pid 34286:tid 34295] [client 165.245.142.82:58614] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8i3PFxpCIhHW6Xmm2AQAAAoc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:56.277830 2026] [:error] [pid 34286:tid 34308] [client 165.245.142.82:58614] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8jHPFxpCIhHW6Xmm2BAAAApQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:57.048700 2026] [:error] [pid 34286:tid 34295] [client 165.245.142.82:58920] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8jXPFxpCIhHW6Xmm2BgAAAoc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:57.807263 2026] [:error] [pid 8688:tid 8714] [client 165.245.142.82:59086] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8jTHJ4Nn-RvulD0ruUgAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:58.565108 2026] [:error] [pid 8688:tid 8714] [client 165.245.142.82:59264] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8jjHJ4Nn-RvulD0ruVQAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:11:59.322359 2026] [:error] [pid 21159:tid 21243] [client 165.245.142.82:59447] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8j-Li3ouy1NZIkgpe5QAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:00.010991 2026] [:error] [pid 21159:tid 21235] [client 165.245.142.82:59447] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8kOLi3ouy1NZIkgpe6AAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:00.775912 2026] [:error] [pid 21159:tid 21235] [client 165.245.142.82:59739] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8kOLi3ouy1NZIkgpe6gAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:01.541338 2026] [:error] [pid 34286:tid 34295] [client 165.245.142.82:59907] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8kXPFxpCIhHW6Xmm2DgAAAoc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:02.308497 2026] [:error] [pid 34286:tid 34308] [client 165.245.142.82:60096] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8knPFxpCIhHW6Xmm2EwAAApQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:03.073225 2026] [:error] [pid 21263:tid 21279] [client 165.245.142.82:60258] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8k9AxjzLvN1upBhkrMgAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:03.073302 2026] [:error] [pid 21263:tid 21279] [client 165.245.142.82:60258] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8k9AxjzLvN1upBhkrMgAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:04.562351 2026] [:error] [pid 33539:tid 33563] [client 165.245.142.82:60424] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8lNCsLwBYg4s018vJCgAAAdE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:05.252283 2026] [:error] [pid 33539:tid 33553] [client 165.245.142.82:60424] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8ldCsLwBYg4s018vJCwAAAcg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:05.252346 2026] [:error] [pid 33539:tid 33553] [client 165.245.142.82:60424] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8ldCsLwBYg4s018vJCwAAAcg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:06.802734 2026] [:error] [pid 34286:tid 34308] [client 165.245.142.82:60948] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8lnPFxpCIhHW6Xmm2HAAAApQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:08.737242 2026] [:error] [pid 34286:tid 34308] [client 165.245.142.82:60948] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8mHPFxpCIhHW6Xmm2IAAAApQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:08.737298 2026] [:error] [pid 34286:tid 34308] [client 165.245.142.82:60948] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8mHPFxpCIhHW6Xmm2IAAAApQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:11.700537 2026] [:error] [pid 34785:tid 34791] [client 165.245.142.82:62054] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8m4C4dBNEGEcJx-OQBwAAAwQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:12.421874 2026] [:error] [pid 34785:tid 34791] [client 165.245.142.82:62054] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8nIC4dBNEGEcJx-OQCAAAAwQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:12.421982 2026] [:error] [pid 34785:tid 34791] [client 165.245.142.82:62054] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8nIC4dBNEGEcJx-OQCAAAAwQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:13.934353 2026] [:error] [pid 34286:tid 34295] [client 165.245.142.82:62526] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8nXPFxpCIhHW6Xmm2LgAAAoc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:13.934462 2026] [:error] [pid 34286:tid 34295] [client 165.245.142.82:62526] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8nXPFxpCIhHW6Xmm2LgAAAoc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:16.072682 2026] [:error] [pid 34552:tid 34579] [client 165.245.142.82:63203] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8oHBlU_DRqGi4yvsfSgAAAtg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:16.837784 2026] [:error] [pid 21263:tid 21283] [client 165.245.142.82:63373] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8oNAxjzLvN1upBhkrXwAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:17.604111 2026] [:error] [pid 34552:tid 34579] [client 165.245.142.82:63533] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8oXBlU_DRqGi4yvsfTwAAAtg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:17.604264 2026] [:error] [pid 34552:tid 34579] [client 165.245.142.82:63533] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8oXBlU_DRqGi4yvsfTwAAAtg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:18.376312 2026] [:error] [pid 35060:tid 35062] [client 165.245.142.82:63760] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8opL8JPoS_tq-tiURtQAAA0A"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:19.138511 2026] [:error] [pid 8688:tid 8712] [client 165.245.142.82:64002] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8ozHJ4Nn-RvulD0rubgAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:19.900676 2026] [:error] [pid 35350:tid 35375] [client 165.245.142.82:64217] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8o4qZbPJ_JGYY1RQH5wAAA5c"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:20.656482 2026] [:error] [pid 8688:tid 8714] [client 165.245.142.82:64433] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8pDHJ4Nn-RvulD0rudAAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:21.416951 2026] [:error] [pid 33539:tid 33561] [client 165.245.142.82:64649] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8pdCsLwBYg4s018vJEAAAAdA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:21.417040 2026] [:error] [pid 33539:tid 33561] [client 165.245.142.82:64649] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8pdCsLwBYg4s018vJEAAAAdA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:22.184833 2026] [:error] [pid 35350:tid 35370] [client 165.245.142.82:64842] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8poqZbPJ_JGYY1RQH6gAAA5I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:22.948928 2026] [:error] [pid 33539:tid 33565] [client 165.245.142.82:65039] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8ptCsLwBYg4s018vJEQAAAdM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:23.704928 2026] [:error] [pid 35060:tid 35074] [client 165.245.142.82:65231] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8p5L8JPoS_tq-tiURugAAA0w"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:24.464425 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:65427] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8qIqZbPJ_JGYY1RQH7wAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:25.224925 2026] [:error] [pid 33539:tid 33546] [client 165.245.142.82:49220] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8qdCsLwBYg4s018vJEwAAAcE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:26.703470 2026] [:error] [pid 33539:tid 33550] [client 165.245.142.82:49220] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8qtCsLwBYg4s018vJFQAAAcU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:27.448546 2026] [:error] [pid 33539:tid 33547] [client 165.245.142.82:49220] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8q9CsLwBYg4s018vJFgAAAcI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:28.914106 2026] [:error] [pid 33539:tid 33545] [client 165.245.142.82:49220] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8rNCsLwBYg4s018vJGAAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:28.914171 2026] [:error] [pid 33539:tid 33545] [client 165.245.142.82:49220] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8rNCsLwBYg4s018vJGAAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:29.684239 2026] [:error] [pid 35654:tid 35673] [client 165.245.142.82:50309] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8rUIPeuEwCTirofKbegAAA88"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:30.446683 2026] [:error] [pid 34552:tid 34579] [client 165.245.142.82:50495] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8rnBlU_DRqGi4yvsfZgAAAtg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:31.215348 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:50674] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8r4qZbPJ_JGYY1RQIAAAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:31.979604 2026] [:error] [pid 8688:tid 8714] [client 165.245.142.82:50950] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8rzHJ4Nn-RvulD0ruzAAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:31.979665 2026] [:error] [pid 8688:tid 8714] [client 165.245.142.82:50950] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8rzHJ4Nn-RvulD0ruzAAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:33.470945 2026] [:error] [pid 34552:tid 34579] [client 165.245.142.82:51183] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8sXBlU_DRqGi4yvsfdgAAAtg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:34.155871 2026] [:error] [pid 34552:tid 34566] [client 165.245.142.82:51183] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8snBlU_DRqGi4yvsfdwAAAss"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:34.155914 2026] [:error] [pid 34552:tid 34566] [client 165.245.142.82:51183] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8snBlU_DRqGi4yvsfdwAAAss"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:34.915597 2026] [:error] [pid 34552:tid 34566] [client 165.245.142.82:51756] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8snBlU_DRqGi4yvsfeQAAAss"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:35.683443 2026] [:error] [pid 8688:tid 8694] [client 165.245.142.82:51943] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8szHJ4Nn-RvulD0ru4AAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:36.452355 2026] [:error] [pid 33767:tid 33787] [client 165.245.142.82:52146] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8tEGyeKe3MWsxvBgfbwAAAhE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:37.210103 2026] [:error] [pid 34552:tid 34566] [client 165.245.142.82:52362] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8tXBlU_DRqGi4yvsffQAAAss"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:37.972491 2026] [:error] [pid 8688:tid 8706] [client 165.245.142.82:52593] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8tTHJ4Nn-RvulD0rvAgAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:37.972570 2026] [:error] [pid 8688:tid 8706] [client 165.245.142.82:52593] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8tTHJ4Nn-RvulD0rvAgAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:39.477965 2026] [:error] [pid 35654:tid 35675] [client 165.245.142.82:52787] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8t0IPeuEwCTirofKbtQAAA9E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:40.219993 2026] [:error] [pid 35654:tid 35673] [client 165.245.142.82:52787] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8uEIPeuEwCTirofKbtgAAA88"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:40.220066 2026] [:error] [pid 35654:tid 35673] [client 165.245.142.82:52787] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8uEIPeuEwCTirofKbtgAAA88"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:40.981155 2026] [:error] [pid 35350:tid 35370] [client 165.245.142.82:53322] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8uIqZbPJ_JGYY1RQIFwAAA5I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:41.747125 2026] [:error] [pid 34286:tid 34307] [client 165.245.142.82:53501] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8uXPFxpCIhHW6Xmm2YgAAApM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:42.510909 2026] [:error] [pid 34286:tid 34307] [client 165.245.142.82:53672] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8unPFxpCIhHW6Xmm2YwAAApM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:43.274918 2026] [:error] [pid 35654:tid 35675] [client 165.245.142.82:53859] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8u0IPeuEwCTirofKbugAAA9E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:44.041243 2026] [:error] [pid 34552:tid 34570] [client 165.245.142.82:54058] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8vHBlU_DRqGi4yvsfiAAAAs8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:44.041306 2026] [:error] [pid 34552:tid 34570] [client 165.245.142.82:54058] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8vHBlU_DRqGi4yvsfiAAAAs8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:44.796037 2026] [:error] [pid 21156:tid 21175] [client 165.245.142.82:54264] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8vKsaG_9IkG8N2p0blQAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:45.559229 2026] [:error] [pid 34552:tid 34566] [client 165.245.142.82:54441] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8vXBlU_DRqGi4yvsfiwAAAss"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:46.325739 2026] [:error] [pid 34552:tid 34566] [client 165.245.142.82:54645] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8vnBlU_DRqGi4yvsfjAAAAss"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:47.079554 2026] [:error] [pid 34552:tid 34566] [client 165.245.142.82:54833] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8v3BlU_DRqGi4yvsfjQAAAss"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:47.838961 2026] [:error] [pid 35060:tid 35086] [client 165.245.142.82:55014] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8v5L8JPoS_tq-tiURwAAAA1g"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:47.839070 2026] [:error] [pid 35060:tid 35086] [client 165.245.142.82:55014] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8v5L8JPoS_tq-tiURwAAAA1g"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:48.610670 2026] [:error] [pid 21156:tid 21175] [client 165.245.142.82:55219] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8wKsaG_9IkG8N2p0bnAAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:49.373235 2026] [:error] [pid 21156:tid 21175] [client 165.245.142.82:55411] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8wasaG_9IkG8N2p0bnQAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:50.134893 2026] [:error] [pid 8688:tid 8714] [client 165.245.142.82:55599] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8wjHJ4Nn-RvulD0rvGAAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:50.892088 2026] [:error] [pid 35060:tid 35086] [client 165.245.142.82:55809] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8wpL8JPoS_tq-tiURwwAAA1g"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:51.650577 2026] [:error] [pid 8688:tid 8694] [client 165.245.142.82:56016] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8wzHJ4Nn-RvulD0rvGwAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:52.380742 2026] [:error] [pid 8688:tid 8713] [client 165.245.142.82:56016] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8xDHJ4Nn-RvulD0rvHAAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:53.150776 2026] [:error] [pid 35060:tid 35074] [client 165.245.142.82:56357] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8xZL8JPoS_tq-tiURxwAAA0w"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:53.919505 2026] [:error] [pid 21156:tid 21175] [client 165.245.142.82:56566] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8xasaG_9IkG8N2p0bpwAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:54.682742 2026] [:error] [pid 8688:tid 8694] [client 165.245.142.82:56780] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8xjHJ4Nn-RvulD0rvHQAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:55.447762 2026] [:error] [pid 35060:tid 35074] [client 165.245.142.82:56980] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8x5L8JPoS_tq-tiURzQAAA0w"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:55.447818 2026] [:error] [pid 35060:tid 35074] [client 165.245.142.82:56980] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8x5L8JPoS_tq-tiURzQAAA0w"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:56.214661 2026] [:error] [pid 35060:tid 35074] [client 165.245.142.82:57181] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8yJL8JPoS_tq-tiUR0AAAA0w"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:56.979956 2026] [:error] [pid 21263:tid 21282] [client 165.245.142.82:57360] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8yNAxjzLvN1upBhkrdwAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:57.744611 2026] [:error] [pid 8688:tid 8712] [client 165.245.142.82:57555] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8yTHJ4Nn-RvulD0rvIQAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:58.511084 2026] [:error] [pid 8688:tid 8712] [client 165.245.142.82:57754] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8yjHJ4Nn-RvulD0rvIwAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:59.282556 2026] [:error] [pid 8688:tid 8714] [client 165.245.142.82:57943] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8yzHJ4Nn-RvulD0rvJgAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:12:59.282620 2026] [:error] [pid 8688:tid 8714] [client 165.245.142.82:57943] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8yzHJ4Nn-RvulD0rvJgAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:00.041625 2026] [:error] [pid 34286:tid 34308] [client 165.245.142.82:58128] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8zHPFxpCIhHW6Xmm2eQAAApQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:00.806486 2026] [:error] [pid 35654:tid 35679] [client 165.245.142.82:58331] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8zEIPeuEwCTirofKb1wAAA9U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:01.574644 2026] [:error] [pid 33539:tid 33545] [client 165.245.142.82:58516] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8zdCsLwBYg4s018vJNAAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:02.338448 2026] [:error] [pid 34286:tid 34308] [client 165.245.142.82:58702] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8znPFxpCIhHW6Xmm2fgAAApQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:03.107504 2026] [:error] [pid 35060:tid 35062] [client 165.245.142.82:58889] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8z5L8JPoS_tq-tiUR5AAAA0A"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:03.804032 2026] [:error] [pid 35060:tid 35062] [client 165.245.142.82:58889] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8z5L8JPoS_tq-tiUR5gAAA0A"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:04.561188 2026] [:error] [pid 21156:tid 21175] [client 165.245.142.82:59247] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO80KsaG_9IkG8N2p0btwAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:05.322956 2026] [:error] [pid 35654:tid 35666] [client 165.245.142.82:59422] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO80UIPeuEwCTirofKb6AAAA8g"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:06.088515 2026] [:error] [pid 34552:tid 34570] [client 165.245.142.82:59697] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO80nBlU_DRqGi4yvsfqQAAAs8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:06.856765 2026] [:error] [pid 35350:tid 35375] [client 165.245.142.82:59912] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO80oqZbPJ_JGYY1RQIKQAAA5c"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:06.856839 2026] [:error] [pid 35350:tid 35375] [client 165.245.142.82:59912] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO80oqZbPJ_JGYY1RQIKQAAA5c"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:07.621742 2026] [:error] [pid 34552:tid 34563] [client 165.245.142.82:60143] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO803BlU_DRqGi4yvsfqwAAAsg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:08.386949 2026] [:error] [pid 35654:tid 35675] [client 165.245.142.82:60355] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO81EIPeuEwCTirofKb7QAAA9E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:09.151137 2026] [:error] [pid 8688:tid 8690] [client 165.245.142.82:60572] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO81THJ4Nn-RvulD0rvOAAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:09.910893 2026] [:error] [pid 8688:tid 8714] [client 165.245.142.82:60764] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO81THJ4Nn-RvulD0rvOwAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:10.668561 2026] [:error] [pid 35654:tid 35681] [client 165.245.142.82:60970] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO81kIPeuEwCTirofKb8AAAA9c"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:11.391064 2026] [:error] [pid 35654:tid 35660] [client 165.245.142.82:60970] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO810IPeuEwCTirofKb8QAAA8I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:12.152563 2026] [:error] [pid 8688:tid 8714] [client 165.245.142.82:61370] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO82DHJ4Nn-RvulD0rvQQAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:12.916783 2026] [:error] [pid 34552:tid 34563] [client 165.245.142.82:61574] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO82HBlU_DRqGi4yvsfsQAAAsg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:13.681828 2026] [:error] [pid 34785:tid 34802] [client 165.245.142.82:61779] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO82YC4dBNEGEcJx-OQUgAAAw8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:14.455916 2026] [:error] [pid 34286:tid 34312] [client 165.245.142.82:61987] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO82nPFxpCIhHW6Xmm2kAAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:17.224479 2026] [:error] [pid 34286:tid 34312] [client 165.245.142.82:61987] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO83XPFxpCIhHW6Xmm2mAAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:17.943476 2026] [:error] [pid 34286:tid 34308] [client 165.245.142.82:61987] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO83XPFxpCIhHW6Xmm2mQAAApQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:17.943568 2026] [:error] [pid 34286:tid 34308] [client 165.245.142.82:61987] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO83XPFxpCIhHW6Xmm2mQAAApQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:21.399274 2026] [:error] [pid 34286:tid 34312] [client 165.245.142.82:63703] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO84XPFxpCIhHW6Xmm2nQAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:22.115293 2026] [:error] [pid 34286:tid 34312] [client 165.245.142.82:63703] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO84nPFxpCIhHW6Xmm2nwAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:22.115387 2026] [:error] [pid 34286:tid 34312] [client 165.245.142.82:63703] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO84nPFxpCIhHW6Xmm2nwAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:23.611750 2026] [:error] [pid 34286:tid 34308] [client 165.245.142.82:64313] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO843PFxpCIhHW6Xmm2pAAAApQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:24.430103 2026] [:error] [pid 34286:tid 34308] [client 165.245.142.82:64313] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO85HPFxpCIhHW6Xmm2pgAAApQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:24.430165 2026] [:error] [pid 34286:tid 34308] [client 165.245.142.82:64313] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO85HPFxpCIhHW6Xmm2pgAAApQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:25.933301 2026] [:error] [pid 34785:tid 34802] [client 165.245.142.82:64973] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO85YC4dBNEGEcJx-OQYgAAAw8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:26.632289 2026] [:error] [pid 34785:tid 34796] [client 165.245.142.82:64973] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO85oC4dBNEGEcJx-OQYwAAAwk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:28.068621 2026] [:error] [pid 34785:tid 34802] [client 165.245.142.82:64973] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO86IC4dBNEGEcJx-OQZgAAAw8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:28.756286 2026] [:error] [pid 34785:tid 34802] [client 165.245.142.82:64973] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO86IC4dBNEGEcJx-OQZwAAAw8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:28.756341 2026] [:error] [pid 34785:tid 34802] [client 165.245.142.82:64973] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO86IC4dBNEGEcJx-OQZwAAAw8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:29.526955 2026] [:error] [pid 34785:tid 34802] [client 165.245.142.82:49804] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO86YC4dBNEGEcJx-OQagAAAw8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:30.281341 2026] [:error] [pid 35654:tid 35666] [client 165.245.142.82:49994] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO86kIPeuEwCTirofKb9AAAA8g"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:31.036406 2026] [:error] [pid 21156:tid 21175] [client 165.245.142.82:50186] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO866saG_9IkG8N2p0b4QAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:31.794849 2026] [:error] [pid 21156:tid 21166] [client 165.245.142.82:50373] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO866saG_9IkG8N2p0b5AAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:32.561318 2026] [:error] [pid 35060:tid 35063] [client 165.245.142.82:50550] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO87JL8JPoS_tq-tiUR_AAAA0E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:32.561387 2026] [:error] [pid 35060:tid 35063] [client 165.245.142.82:50550] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO87JL8JPoS_tq-tiUR_AAAA0E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:34.074075 2026] [:error] [pid 34286:tid 34312] [client 165.245.142.82:50745] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO87nPFxpCIhHW6Xmm2rQAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:34.905224 2026] [:error] [pid 34286:tid 34307] [client 165.245.142.82:50745] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO87nPFxpCIhHW6Xmm2rgAAApM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:34.905285 2026] [:error] [pid 34286:tid 34307] [client 165.245.142.82:50745] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO87nPFxpCIhHW6Xmm2rgAAApM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:36.410008 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:51455] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO88IqZbPJ_JGYY1RQILwAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:37.134623 2026] [:error] [pid 35350:tid 35375] [client 165.245.142.82:51455] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO88YqZbPJ_JGYY1RQIMQAAA5c"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:37.134737 2026] [:error] [pid 35350:tid 35375] [client 165.245.142.82:51455] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO88YqZbPJ_JGYY1RQIMQAAA5c"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:37.890184 2026] [:error] [pid 33539:tid 33559] [client 165.245.142.82:52079] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO88dCsLwBYg4s018vJOAAAAc4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:38.644981 2026] [:error] [pid 33539:tid 33570] [client 165.245.142.82:52296] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO88tCsLwBYg4s018vJOgAAAdg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:39.419442 2026] [:error] [pid 34286:tid 34307] [client 165.245.142.82:52483] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO883PFxpCIhHW6Xmm2swAAApM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:40.185287 2026] [:error] [pid 35060:tid 35079] [client 165.245.142.82:52692] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO89JL8JPoS_tq-tiUSBAAAA1E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:40.947900 2026] [:error] [pid 35350:tid 35368] [client 165.245.142.82:52873] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO89IqZbPJ_JGYY1RQINAAAA5A"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:40.947934 2026] [:error] [pid 35350:tid 35368] [client 165.245.142.82:52873] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO89IqZbPJ_JGYY1RQINAAAA5A"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:41.714144 2026] [:error] [pid 8688:tid 8694] [client 165.245.142.82:53050] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO89THJ4Nn-RvulD0rvWgAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:42.471853 2026] [:error] [pid 35654:tid 35665] [client 165.245.142.82:53228] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO89kIPeuEwCTirofKb_QAAA8c"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:43.230204 2026] [:error] [pid 8688:tid 8690] [client 165.245.142.82:53411] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO89zHJ4Nn-RvulD0rvXQAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:43.994882 2026] [:error] [pid 35654:tid 35660] [client 165.245.142.82:53611] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO890IPeuEwCTirofKb_wAAA8I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:44.761875 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:53804] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8-IqZbPJ_JGYY1RQIRQAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:44.761935 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:53804] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8-IqZbPJ_JGYY1RQIRQAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:45.525177 2026] [:error] [pid 34785:tid 34796] [client 165.245.142.82:54061] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO8-YC4dBNEGEcJx-OQegAAAwk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:46.280097 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:54282] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8-oqZbPJ_JGYY1RQITgAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:47.042211 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:54452] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8-4qZbPJ_JGYY1RQIUAAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:47.807427 2026] [:error] [pid 34552:tid 34563] [client 165.245.142.82:54617] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8-3BlU_DRqGi4yvsf0AAAAsg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:48.573344 2026] [:error] [pid 8688:tid 8694] [client 165.245.142.82:54835] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO8_DHJ4Nn-RvulD0rvYgAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:50.357700 2026] [:error] [pid 21156:tid 21166] [client 165.245.142.82:55248] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO8_qsaG_9IkG8N2p0b7QAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:51.119032 2026] [:error] [pid 21156:tid 21166] [client 165.245.142.82:55442] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO8_6saG_9IkG8N2p0b7gAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:51.885291 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:55619] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO8_4qZbPJ_JGYY1RQIVgAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:52.651403 2026] [:error] [pid 34552:tid 34566] [client 165.245.142.82:55797] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9AHBlU_DRqGi4yvsf1QAAAss"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:52.651462 2026] [:error] [pid 34552:tid 34566] [client 165.245.142.82:55797] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9AHBlU_DRqGi4yvsf1QAAAss"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:53.423211 2026] [:error] [pid 21156:tid 21175] [client 165.245.142.82:55979] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO9AasaG_9IkG8N2p0b7wAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:54.182324 2026] [:error] [pid 35350:tid 35375] [client 165.245.142.82:56159] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO9AoqZbPJ_JGYY1RQIXgAAA5c"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:54.937254 2026] [:error] [pid 35350:tid 35375] [client 165.245.142.82:56335] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO9AoqZbPJ_JGYY1RQIYAAAA5c"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:55.698178 2026] [:error] [pid 34785:tid 34802] [client 165.245.142.82:56563] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO9A4C4dBNEGEcJx-OQgQAAAw8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:56.463604 2026] [:error] [pid 34785:tid 34802] [client 165.245.142.82:56753] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9BIC4dBNEGEcJx-OQggAAAw8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:57.973077 2026] [:error] [pid 34785:tid 34796] [client 165.245.142.82:56753] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9BYC4dBNEGEcJx-OQhwAAAwk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:58.724805 2026] [:error] [pid 34785:tid 34796] [client 165.245.142.82:56753] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9BoC4dBNEGEcJx-OQiQAAAwk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:58.724888 2026] [:error] [pid 34785:tid 34796] [client 165.245.142.82:56753] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9BoC4dBNEGEcJx-OQiQAAAwk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:13:59.496528 2026] [:error] [pid 8688:tid 8712] [client 165.245.142.82:57522] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO9BzHJ4Nn-RvulD0rvegAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:00.251873 2026] [:error] [pid 35060:tid 35079] [client 165.245.142.82:57727] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO9CJL8JPoS_tq-tiUSDwAAA1E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:01.016988 2026] [:error] [pid 34286:tid 34307] [client 165.245.142.82:57912] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO9CXPFxpCIhHW6Xmm2wwAAApM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:01.776036 2026] [:error] [pid 34286:tid 34295] [client 165.245.142.82:58125] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO9CXPFxpCIhHW6Xmm2xwAAAoc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:02.535243 2026] [:error] [pid 8688:tid 8712] [client 165.245.142.82:58308] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9CjHJ4Nn-RvulD0rvfgAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:03.266321 2026] [:error] [pid 8688:tid 8714] [client 165.245.142.82:58308] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO9CzHJ4Nn-RvulD0rvgAAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:04.033079 2026] [:error] [pid 35060:tid 35062] [client 165.245.142.82:58656] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO9DJL8JPoS_tq-tiUSFQAAA0A"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:04.791167 2026] [:error] [pid 34286:tid 34307] [client 165.245.142.82:58846] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO9DHPFxpCIhHW6Xmm2ywAAApM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:05.548218 2026] [:error] [pid 34286:tid 34295] [client 165.245.142.82:59072] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO9DXPFxpCIhHW6Xmm2zAAAAoc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:06.308002 2026] [:error] [pid 34286:tid 34312] [client 165.245.142.82:59256] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9DnPFxpCIhHW6Xmm20AAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:07.734546 2026] [:error] [pid 34286:tid 34295] [client 165.245.142.82:59256] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9D3PFxpCIhHW6Xmm21QAAAoc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:08.438280 2026] [:error] [pid 34286:tid 34308] [client 165.245.142.82:59256] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9EHPFxpCIhHW6Xmm21gAAApQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:09.170469 2026] [:error] [pid 34286:tid 34295] [client 165.245.142.82:59256] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO9EXPFxpCIhHW6Xmm22QAAAoc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:09.932799 2026] [:error] [pid 33976:tid 33991] [client 165.245.142.82:60141] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO9EQUyU3c4Xm_xpMTRSwAAAk0"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:10.704530 2026] [:error] [pid 34286:tid 34308] [client 165.245.142.82:60340] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO9EnPFxpCIhHW6Xmm23AAAApQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:11.465117 2026] [:error] [pid 34286:tid 34312] [client 165.245.142.82:60524] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO9E3PFxpCIhHW6Xmm24AAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:12.220480 2026] [:error] [pid 34785:tid 34802] [client 165.245.142.82:60716] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9FIC4dBNEGEcJx-OQlgAAAw8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:12.220565 2026] [:error] [pid 34785:tid 34802] [client 165.245.142.82:60716] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 19"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9FIC4dBNEGEcJx-OQlgAAAw8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:13.714019 2026] [:error] [pid 8688:tid 8690] [client 165.245.142.82:60880] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9FTHJ4Nn-RvulD0rviAAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:14.422800 2026] [:error] [pid 8688:tid 8714] [client 165.245.142.82:60880] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9FjHJ4Nn-RvulD0rvigAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:14.422881 2026] [:error] [pid 8688:tid 8714] [client 165.245.142.82:60880] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9FjHJ4Nn-RvulD0rvigAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:16.012856 2026] [:error] [pid 34286:tid 34307] [client 165.245.142.82:61395] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9GHPFxpCIhHW6Xmm26wAAApM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:16.758020 2026] [:error] [pid 34286:tid 34307] [client 165.245.142.82:61395] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9GHPFxpCIhHW6Xmm27QAAApM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:16.758085 2026] [:error] [pid 34286:tid 34307] [client 165.245.142.82:61395] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9GHPFxpCIhHW6Xmm27QAAApM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:18.239483 2026] [:error] [pid 34286:tid 34312] [client 165.245.142.82:62006] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9GnPFxpCIhHW6Xmm27wAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:19.001162 2026] [:error] [pid 34286:tid 34312] [client 165.245.142.82:62006] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9G3PFxpCIhHW6Xmm28QAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:20.601893 2026] [:error] [pid 34286:tid 34312] [client 165.245.142.82:62006] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9HHPFxpCIhHW6Xmm29AAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:21.335835 2026] [:error] [pid 34286:tid 34312] [client 165.245.142.82:62006] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9HXPFxpCIhHW6Xmm29gAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:22.064115 2026] [:error] [pid 34286:tid 34295] [client 165.245.142.82:62006] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO9HnPFxpCIhHW6Xmm2-AAAAoc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:22.830853 2026] [:error] [pid 34286:tid 34312] [client 165.245.142.82:63378] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO9HnPFxpCIhHW6Xmm2-wAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:23.604235 2026] [:error] [pid 34286:tid 34312] [client 165.245.142.82:63589] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO9H3PFxpCIhHW6Xmm2_AAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:24.359326 2026] [:error] [pid 33976:tid 33998] [client 165.245.142.82:63806] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO9IAUyU3c4Xm_xpMTRVAAAAlQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:25.129114 2026] [:error] [pid 21156:tid 21175] [client 165.245.142.82:64004] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9IasaG_9IkG8N2p0b-gAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:25.129176 2026] [:error] [pid 21156:tid 21175] [client 165.245.142.82:64004] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9IasaG_9IkG8N2p0b-gAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:25.902231 2026] [:error] [pid 35060:tid 35079] [client 165.245.142.82:64242] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO9IZL8JPoS_tq-tiUSNQAAA1E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:26.667054 2026] [:error] [pid 34785:tid 34794] [client 165.245.142.82:64440] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO9IoC4dBNEGEcJx-OQpAAAAwc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:27.437637 2026] [:error] [pid 35350:tid 35375] [client 165.245.142.82:64625] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO9I4qZbPJ_JGYY1RQImQAAA5c"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:28.199308 2026] [:error] [pid 21156:tid 21166] [client 165.245.142.82:64823] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO9JKsaG_9IkG8N2p0b_gAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:28.964720 2026] [:error] [pid 34785:tid 34794] [client 165.245.142.82:65010] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9JIC4dBNEGEcJx-OQpwAAAwc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:28.964790 2026] [:error] [pid 34785:tid 34794] [client 165.245.142.82:65010] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9JIC4dBNEGEcJx-OQpwAAAwc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:29.729080 2026] [:error] [pid 34286:tid 34312] [client 165.245.142.82:65198] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO9JXPFxpCIhHW6Xmm3BgAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:30.496648 2026] [:error] [pid 34286:tid 34295] [client 165.245.142.82:65405] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO9JnPFxpCIhHW6Xmm3CQAAAoc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:31.260288 2026] [:error] [pid 35350:tid 35354] [client 165.245.142.82:49228] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO9J4qZbPJ_JGYY1RQIowAAA4I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:32.025566 2026] [:error] [pid 34552:tid 34555] [client 165.245.142.82:49407] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO9KHBlU_DRqGi4yvsgDQAAAsA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:32.783341 2026] [:error] [pid 34785:tid 34807] [client 165.245.142.82:49609] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9KIC4dBNEGEcJx-OQqwAAAxQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:32.783478 2026] [:error] [pid 34785:tid 34807] [client 165.245.142.82:49609] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9KIC4dBNEGEcJx-OQqwAAAxQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:34.268087 2026] [:error] [pid 21156:tid 21175] [client 165.245.142.82:49798] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9KqsaG_9IkG8N2p0cAwAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:34.985842 2026] [:error] [pid 21156:tid 21175] [client 165.245.142.82:49798] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9KqsaG_9IkG8N2p0cBQAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:36.456176 2026] [:error] [pid 21156:tid 21175] [client 165.245.142.82:49798] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9LKsaG_9IkG8N2p0cCAAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:37.150217 2026] [:error] [pid 21156:tid 21166] [client 165.245.142.82:49798] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9LasaG_9IkG8N2p0cCQAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:37.150278 2026] [:error] [pid 21156:tid 21166] [client 165.245.142.82:49798] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9LasaG_9IkG8N2p0cCQAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:38.686640 2026] [:error] [pid 35654:tid 35679] [client 165.245.142.82:50900] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9LkIPeuEwCTirofKcEwAAA9U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:39.420400 2026] [:error] [pid 35654:tid 35666] [client 165.245.142.82:50900] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9L0IPeuEwCTirofKcFAAAA8g"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:39.420523 2026] [:error] [pid 35654:tid 35666] [client 165.245.142.82:50900] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9L0IPeuEwCTirofKcFAAAA8g"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:40.175574 2026] [:error] [pid 34552:tid 34566] [client 165.245.142.82:51470] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO9MHBlU_DRqGi4yvsgGQAAAss"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:40.949311 2026] [:error] [pid 35350:tid 35370] [client 165.245.142.82:51660] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO9MIqZbPJ_JGYY1RQIqgAAA5I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:41.712993 2026] [:error] [pid 35350:tid 35353] [client 165.245.142.82:51860] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO9MYqZbPJ_JGYY1RQIrAAAA4E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:42.468898 2026] [:error] [pid 33539:tid 33546] [client 165.245.142.82:52060] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO9MtCsLwBYg4s018vJRQAAAcE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:43.227619 2026] [:error] [pid 21156:tid 21175] [client 165.245.142.82:52267] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9M6saG_9IkG8N2p0cDQAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:43.227686 2026] [:error] [pid 21156:tid 21175] [client 165.245.142.82:52267] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9M6saG_9IkG8N2p0cDQAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:44.800605 2026] [:error] [pid 21156:tid 21175] [client 165.245.142.82:52454] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9NKsaG_9IkG8N2p0cEQAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:45.531475 2026] [:error] [pid 21156:tid 21175] [client 165.245.142.82:52454] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9NasaG_9IkG8N2p0cEwAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:47.155071 2026] [:error] [pid 21156:tid 21175] [client 165.245.142.82:52454] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9N6saG_9IkG8N2p0cFgAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:47.922898 2026] [:error] [pid 21156:tid 21178] [client 165.245.142.82:52454] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9N6saG_9IkG8N2p0cFwAAAAw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:47.922987 2026] [:error] [pid 21156:tid 21178] [client 165.245.142.82:52454] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9N6saG_9IkG8N2p0cFwAAAAw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:48.689970 2026] [:error] [pid 34552:tid 34562] [client 165.245.142.82:53743] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO9OHBlU_DRqGi4yvsgKQAAAsc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:49.456096 2026] [:error] [pid 34785:tid 34794] [client 165.245.142.82:53955] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO9OYC4dBNEGEcJx-OQxwAAAwc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:50.216370 2026] [:error] [pid 34552:tid 34562] [client 165.245.142.82:54168] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO9OnBlU_DRqGi4yvsgKgAAAsc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:50.980340 2026] [:error] [pid 8688:tid 8713] [client 165.245.142.82:54393] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO9OjHJ4Nn-RvulD0rvlgAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:51.747006 2026] [:error] [pid 34286:tid 34295] [client 165.245.142.82:54603] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9O3PFxpCIhHW6Xmm3EwAAAoc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:51.747101 2026] [:error] [pid 34286:tid 34295] [client 165.245.142.82:54603] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9O3PFxpCIhHW6Xmm3EwAAAoc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:52.499673 2026] [:error] [pid 34286:tid 34307] [client 165.245.142.82:54804] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO9PHPFxpCIhHW6Xmm3GAAAApM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:53.260475 2026] [:error] [pid 34286:tid 34307] [client 165.245.142.82:54977] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO9PXPFxpCIhHW6Xmm3GQAAApM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:54.026071 2026] [:error] [pid 21156:tid 21178] [client 165.245.142.82:55182] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO9PqsaG_9IkG8N2p0cHwAAAAw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:54.793429 2026] [:error] [pid 34286:tid 34307] [client 165.245.142.82:55375] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO9PnPFxpCIhHW6Xmm3HQAAApM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:55.565080 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:55596] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9P4qZbPJ_JGYY1RQIyQAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:56.319247 2026] [:error] [pid 35350:tid 35357] [client 165.245.142.82:55596] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO9QIqZbPJ_JGYY1RQIzgAAA4U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:57.089456 2026] [:error] [pid 35350:tid 35375] [client 165.245.142.82:56002] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO9QYqZbPJ_JGYY1RQI0gAAA5c"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:57.854299 2026] [:error] [pid 35350:tid 35354] [client 165.245.142.82:56223] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO9QYqZbPJ_JGYY1RQI1wAAA4I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:58.620977 2026] [:error] [pid 35350:tid 35354] [client 165.245.142.82:56428] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO9QoqZbPJ_JGYY1RQI3AAAA4I"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:14:59.401473 2026] [:error] [pid 8688:tid 8690] [client 165.245.142.82:56627] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9QzHJ4Nn-RvulD0rvmQAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:15:00.169709 2026] [:error] [pid 8688:tid 8694] [client 165.245.142.82:56627] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO9RDHJ4Nn-RvulD0rvnAAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:15:00.931845 2026] [:error] [pid 34286:tid 34295] [client 165.245.142.82:57044] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO9RHPFxpCIhHW6Xmm3JAAAAoc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:15:01.697676 2026] [:error] [pid 35060:tid 35083] [client 165.245.142.82:57247] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO9RZL8JPoS_tq-tiUSTwAAA1U"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:15:02.463861 2026] [:error] [pid 35654:tid 35664] [client 165.245.142.82:57457] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO9RkIPeuEwCTirofKcQAAAA8Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:15:03.231634 2026] [:error] [pid 35060:tid 35063] [client 165.245.142.82:57654] [client 165.245.142.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.245.142.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaO9R5L8JPoS_tq-tiUSVAAAA0E"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:15:03.949653 2026] [:error] [pid 35060:tid 35062] [client 165.245.142.82:57654] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaO9R5L8JPoS_tq-tiUSVgAAA0A"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:15:04.713875 2026] [:error] [pid 21156:tid 21166] [client 165.245.142.82:58068] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaO9SKsaG_9IkG8N2p0cLQAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:15:05.479155 2026] [:error] [pid 33767:tid 33792] [client 165.245.142.82:58292] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaO9SUGyeKe3MWsxvBgfqQAAAhY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:15:06.236690 2026] [:error] [pid 24576:tid 24588] [client 165.245.142.82:58545] [client 165.245.142.82] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 165.245.142.82 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaO9Sovfb5CnctJh071S0gAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 12:29:35.900728 2026] [:error] [pid 33976:tid 33987] [client 182.44.2.148:34463] [client 182.44.2.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaPArwUyU3c4Xm_xpMTWmQAAAkk"]
[Sun Mar 01 12:49:25.510143 2026] [:error] [pid 34552:tid 34573] [client 91.92.242.178:47928] [client 91.92.242.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aaPFVXBlU_DRqGi4yvsnswAAAtI"]
[Sun Mar 01 12:49:47.681025 2026] [autoindex:error] [pid 34785:tid 34806] [client 91.92.242.178:39424] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 12:49:51.178028 2026] [autoindex:error] [pid 34286:tid 34304] [client 91.92.242.178:47292] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 12:49:53.161906 2026] [:error] [pid 33229:tid 33246] [client 91.92.242.178:51630] [client 91.92.242.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.178, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaPFcXzT4c9ddlGE6FxxKQAAAY8"]
[Sun Mar 01 13:15:03.163011 2026] [:error] [pid 37032:tid 37045] [client 37.77.150.123:61411] [client 37.77.150.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.77.150.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaPLVuu0U4o7eSImsVTtOAAAAYs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 13:15:20.100272 2026] [:error] [pid 38034:tid 38050] [client 37.77.150.123:64215] [client 37.77.150.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.77.150.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaPLZwxtfZjwlJok9K84BgAAAQw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 13:27:16.972542 2026] [:error] [pid 41780:tid 41797] [client 20.205.227.70:26624] [client 20.205.227.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/000.php"] [unique_id "aaPONMONkVoocLIqzy38WAAAA84"]
[Sun Mar 01 13:27:17.328159 2026] [:error] [pid 41967:tid 41973] [client 20.205.227.70:20362] [client 20.205.227.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/000.php"] [unique_id "aaPONYO1bqY181I02eFqNAAAAIQ"]
[Sun Mar 01 13:27:17.675611 2026] [:error] [pid 41780:tid 41801] [client 20.205.227.70:3938] [client 20.205.227.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/000.php"] [unique_id "aaPONcONkVoocLIqzy38WwAAA9I"]
[Sun Mar 01 13:27:18.028668 2026] [:error] [pid 41780:tid 41791] [client 20.205.227.70:3954] [client 20.205.227.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/000.php"] [unique_id "aaPONsONkVoocLIqzy38XgAAA8g"]
[Sun Mar 01 13:48:43.950050 2026] [:error] [pid 41967:tid 41984] [client 52.169.119.118:18265] [client 52.169.119.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "aaPTO4O1bqY181I02eFz4QAAAI8"]
[Sun Mar 01 13:48:56.837490 2026] [:error] [pid 44644:tid 44653] [client 52.169.119.118:9748] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaPTSJ3RJaXMcw3y9V9KcQAAAAY"]
[Sun Mar 01 13:48:57.346678 2026] [:error] [pid 38241:tid 38248] [client 52.169.119.118:1253] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaPTSfKRPk6YnJBxw_z-zwAAAMQ"]
[Sun Mar 01 13:48:57.843886 2026] [:error] [pid 38034:tid 38039] [client 52.169.119.118:10826] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaPTSQxtfZjwlJok9K9XbAAAAQM"]
[Sun Mar 01 13:48:58.348810 2026] [:error] [pid 44644:tid 44659] [client 52.169.119.118:10820] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aaPTSp3RJaXMcw3y9V9KgQAAAAw"]
[Sun Mar 01 13:48:58.847638 2026] [:error] [pid 44644:tid 44665] [client 52.169.119.118:1261] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aaPTSp3RJaXMcw3y9V9KgwAAABI"]
[Sun Mar 01 13:48:59.349898 2026] [:error] [pid 37032:tid 37050] [client 52.169.119.118:1265] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aaPTS-u0U4o7eSImsVT-jwAAAZA"]
[Sun Mar 01 13:48:59.859283 2026] [:error] [pid 44644:tid 44659] [client 52.169.119.118:2673] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aaPTS53RJaXMcw3y9V9KkAAAAAw"]
[Sun Mar 01 13:49:00.369667 2026] [:error] [pid 38034:tid 38060] [client 52.169.119.118:7757] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaPTTAxtfZjwlJok9K9XgwAAARY"]
[Sun Mar 01 13:49:00.867597 2026] [:error] [pid 44644:tid 44653] [client 52.169.119.118:7785] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaPTTJ3RJaXMcw3y9V9KlQAAAAY"]
[Sun Mar 01 13:49:01.378303 2026] [:error] [pid 38034:tid 38054] [client 52.169.119.118:1242] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaPTTQxtfZjwlJok9K9XjQAAARA"]
[Sun Mar 01 13:49:01.900252 2026] [:error] [pid 38034:tid 38060] [client 52.169.119.118:16078] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaPTTQxtfZjwlJok9K9XlAAAARY"]
[Sun Mar 01 13:49:02.409684 2026] [:error] [pid 37032:tid 37043] [client 52.169.119.118:14798] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaPTTuu0U4o7eSImsVT-mQAAAYk"]
[Sun Mar 01 13:49:02.919633 2026] [:error] [pid 41342:tid 41358] [client 52.169.119.118:2115] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaPTTo4iJ6RAS5CatDk-OQAAAg0"]
[Sun Mar 01 13:49:03.447272 2026] [:error] [pid 37032:tid 37050] [client 52.169.119.118:16090] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaPTT-u0U4o7eSImsVT-mgAAAZA"]
[Sun Mar 01 13:49:03.946073 2026] [:error] [pid 44644:tid 44660] [client 52.169.119.118:7347] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaPTT53RJaXMcw3y9V9KpAAAAA0"]
[Sun Mar 01 13:49:04.455582 2026] [:error] [pid 44644:tid 44663] [client 52.169.119.118:7358] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaPTUJ3RJaXMcw3y9V9KpgAAABA"]
[Sun Mar 01 13:49:04.965019 2026] [:error] [pid 41342:tid 41366] [client 52.169.119.118:1233] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaPTUI4iJ6RAS5CatDk-PgAAAhU"]
[Sun Mar 01 13:49:05.462985 2026] [:error] [pid 42619:tid 42632] [client 52.169.119.118:1190] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaPTUR_zUXcYaZE4AOdo3AAAAUs"]
[Sun Mar 01 13:49:05.972229 2026] [:error] [pid 38034:tid 38059] [client 52.169.119.118:1208] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaPTUQxtfZjwlJok9K9XqgAAARU"]
[Sun Mar 01 13:49:06.482511 2026] [:error] [pid 38241:tid 38253] [client 52.169.119.118:7773] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaPTUvKRPk6YnJBxw_z-8gAAAMk"]
[Sun Mar 01 13:49:06.980785 2026] [:error] [pid 38034:tid 38059] [client 52.169.119.118:16081] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaPTUgxtfZjwlJok9K9XrwAAARU"]
[Sun Mar 01 13:49:07.476842 2026] [:error] [pid 38034:tid 38045] [client 52.169.119.118:2060] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaPTUwxtfZjwlJok9K9XswAAAQc"]
[Sun Mar 01 13:49:07.987126 2026] [:error] [pid 38241:tid 38253] [client 52.169.119.118:10860] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaPTU_KRPk6YnJBxw_z--AAAAMk"]
[Sun Mar 01 13:49:08.503936 2026] [:error] [pid 42619:tid 42639] [client 52.169.119.118:6602] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php"] [unique_id "aaPTVB_zUXcYaZE4AOdo4gAAAVI"]
[Sun Mar 01 13:49:09.004064 2026] [:error] [pid 38034:tid 38059] [client 52.169.119.118:3966] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php"] [unique_id "aaPTVQxtfZjwlJok9K9XxAAAARU"]
[Sun Mar 01 13:49:09.512684 2026] [:error] [pid 38034:tid 38045] [client 52.169.119.118:1214] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php"] [unique_id "aaPTVQxtfZjwlJok9K9XyQAAAQc"]
[Sun Mar 01 13:49:10.035292 2026] [:error] [pid 38034:tid 38045] [client 52.169.119.118:11716] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php"] [unique_id "aaPTVgxtfZjwlJok9K9XzgAAAQc"]
[Sun Mar 01 14:19:30.306785 2026] [:error] [pid 44644:tid 44669] [client 43.159.138.217:36656] [client 43.159.138.217] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaPacp3RJaXMcw3y9V9mSAAAABY"]
[Sun Mar 01 14:29:32.721203 2026] [:error] [pid 37032:tid 37041] [client 62.60.131.218:55340] [client 62.60.131.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaPczOu0U4o7eSImsVQVawAAAYc"]
[Sun Mar 01 16:34:58.907842 2026] [:error] [pid 7133:tid 7141] [client 142.161.92.150:65247] [client 142.161.92.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.161.92.150, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaP6MvCtubh8pR64qB_VkAAAAEY"]
[Sun Mar 01 16:40:36.415293 2026] [:error] [pid 33822:tid 33826] [client 43.130.102.7:60362] [client 43.130.102.7] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaP7hG6W3ygu1YVssubSQwAAAoI"]
[Sun Mar 01 16:50:20.119336 2026] [:error] [pid 41780:tid 41805] [client 78.101.129.138:33489] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaP9zMONkVoocLIqzy0XAgAAA9Y"]
[Sun Mar 01 16:53:13.380761 2026] [:error] [pid 44644:tid 44661] [client 78.101.129.138:43267] [client 78.101.129.138] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaP-eZ3RJaXMcw3y9V_AugAAAA4"]
[Sun Mar 01 16:54:26.616604 2026] [:error] [pid 40750:tid 40757] [client 78.101.129.138:62084] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaP-wgfBuk03yQKDyqv6qQAAAcQ"]
[Sun Mar 01 16:55:35.606096 2026] [:error] [pid 41780:tid 41789] [client 78.101.129.138:52017] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaP_B8ONkVoocLIqzy0XsQAAA8Y"]
[Sun Mar 01 16:56:40.665780 2026] [:error] [pid 40750:tid 40771] [client 78.101.129.138:63894] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaP_SAfBuk03yQKDyqv9LgAAAdI"]
[Sun Mar 01 16:56:40.668578 2026] [:error] [pid 40750:tid 40771] [client 78.101.129.138:63894] [client 78.101.129.138] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1adminexpressinteriors%%wppass_d%title0x5ede1360description0x5ede1360mt_keywords0x5ede1360mt_excerpt0x5ede13601"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaP_SAfBuk03yQKDyqv9LgAAAdI"]
[Sun Mar 01 16:57:48.211299 2026] [:error] [pid 37032:tid 37040] [client 78.101.129.138:64294] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaP_jOu0U4o7eSImsVRbtwAAAYY"]
[Sun Mar 01 16:57:48.214923 2026] [:error] [pid 37032:tid 37040] [client 78.101.129.138:64294] [client 78.101.129.138] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1admin%expressinteriorstitle0x5a76772ddescription0x5a76772dmt_keywords0x5a76772dmt_excerpt0x5a76772d1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaP_jOu0U4o7eSImsVRbtwAAAYY"]
[Sun Mar 01 16:58:54.320943 2026] [:error] [pid 41342:tid 41361] [client 78.101.129.138:64582] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaP_zo4iJ6RAS5CatDlPuAAAAhA"]
[Sun Mar 01 16:58:54.324992 2026] [:error] [pid 41342:tid 41361] [client 78.101.129.138:64582] [client 78.101.129.138] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1adminadmin%wppass_u%title0xc8544ae5description0xc8544ae5mt_keywords0xc8544ae5mt_excerpt0xc8544ae51"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaP_zo4iJ6RAS5CatDlPuAAAAhA"]
[Sun Mar 01 16:59:59.971798 2026] [:error] [pid 40750:tid 40773] [client 78.101.129.138:64878] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQADwfBuk03yQKDyqsCDgAAAdQ"]
[Sun Mar 01 17:01:13.044453 2026] [:error] [pid 40750:tid 40765] [client 78.101.129.138:64567] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQAWQfBuk03yQKDyqsELQAAAcw"]
[Sun Mar 01 17:02:29.524034 2026] [:error] [pid 40750:tid 40768] [client 78.101.129.138:50514] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQApQfBuk03yQKDyqsGcgAAAc8"]
[Sun Mar 01 17:03:39.174732 2026] [:error] [pid 38034:tid 38054] [client 78.101.129.138:6341] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQA6wxtfZjwlJok9K_iegAAARA"]
[Sun Mar 01 17:04:54.666067 2026] [:error] [pid 7165:tid 7174] [client 78.101.129.138:52720] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQBNhRjCrA8qWBjgG9m2wAAAkc"]
[Sun Mar 01 17:06:09.650806 2026] [:error] [pid 7133:tid 7151] [client 78.101.129.138:11985] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQBgfCtubh8pR64qB_hHQAAAFA"]
[Sun Mar 01 17:07:21.074538 2026] [:error] [pid 7165:tid 7187] [client 78.101.129.138:14461] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQByRRjCrA8qWBjgG9o7AAAAlQ"]
[Sun Mar 01 17:08:32.355076 2026] [:error] [pid 33822:tid 33842] [client 78.101.129.138:55326] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQCEG6W3ygu1YVssubaPAAAApI"]
[Sun Mar 01 17:09:46.954698 2026] [:error] [pid 38241:tid 38245] [client 78.101.129.138:55662] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQCWvKRPk6YnJBxw_yJnQAAAME"]
[Sun Mar 01 17:11:14.221174 2026] [:error] [pid 40750:tid 40766] [client 78.101.129.138:56062] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQCsgfBuk03yQKDyqsTLQAAAc0"]
[Sun Mar 01 17:12:24.259653 2026] [:error] [pid 38034:tid 38049] [client 78.101.129.138:57186] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQC-AxtfZjwlJok9K_kVwAAAQs"]
[Sun Mar 01 17:12:24.262864 2026] [:error] [pid 38034:tid 38049] [client 78.101.129.138:57186] [client 78.101.129.138] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1admin%1title0x2baf3c85description0x2baf3c85mt_keywords0x2baf3c85mt_excerpt0x2baf3c851"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQC-AxtfZjwlJok9K_kVwAAAQs"]
[Sun Mar 01 17:13:30.436127 2026] [:error] [pid 40750:tid 40753] [client 78.101.129.138:24831] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQDOgfBuk03yQKDyqsWPAAAAcA"]
[Sun Mar 01 17:14:39.850212 2026] [:error] [pid 41780:tid 41789] [client 78.101.129.138:59428] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQDf8ONkVoocLIqzy0ZPgAAA8Y"]
[Sun Mar 01 17:15:57.674556 2026] [:error] [pid 40750:tid 40777] [client 78.101.129.138:60588] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQDzQfBuk03yQKDyqsZfQAAAdg"]
[Sun Mar 01 17:17:08.499552 2026] [:error] [pid 44644:tid 44660] [client 78.101.129.138:32141] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQEFJ3RJaXMcw3y9V_C5wAAAA0"]
[Sun Mar 01 17:18:15.502506 2026] [:error] [pid 33822:tid 33847] [client 78.101.129.138:34333] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQEV26W3ygu1YVssubdjwAAApc"]
[Sun Mar 01 17:19:20.129273 2026] [:error] [pid 38034:tid 38054] [client 78.101.129.138:36323] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQEmAxtfZjwlJok9K_lrQAAARA"]
[Sun Mar 01 17:20:25.510188 2026] [:error] [pid 33822:tid 33834] [client 78.101.129.138:38133] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQE2W6W3ygu1YVssubeSgAAAoo"]
[Sun Mar 01 17:20:25.515452 2026] [:error] [pid 33822:tid 33834] [client 78.101.129.138:38133] [client 78.101.129.138] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1expressinteriors.comexpressinteriors%%wppass_d%title0x6767438adescription0x6767438amt_keywords0x6767438amt_excerpt0x6767438a1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQE2W6W3ygu1YVssubeSgAAAoo"]
[Sun Mar 01 17:21:23.047705 2026] [:error] [pid 40750:tid 40754] [client 78.101.129.138:62718] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQFEwfBuk03yQKDyqsjegAAAcE"]
[Sun Mar 01 17:21:23.051446 2026] [:error] [pid 40750:tid 40754] [client 78.101.129.138:62718] [client 78.101.129.138] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1expressinteriors.com%expressinteriorstitle0x783d9575description0x783d9575mt_keywords0x783d9575mt_excerpt0x783d95751"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQFEwfBuk03yQKDyqsjegAAAcE"]
[Sun Mar 01 17:22:24.802753 2026] [:error] [pid 7165:tid 7171] [client 78.101.129.138:43073] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQFUBRjCrA8qWBjgG95CQAAAkQ"]
[Sun Mar 01 17:22:24.806373 2026] [:error] [pid 7165:tid 7171] [client 78.101.129.138:43073] [client 78.101.129.138] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1expressinteriors.comexpressinteriors.com%wppass_u%title0xfcdd311ddescription0xfcdd311dmt_keywords0xfcdd311dmt_excerpt0xfcdd311d1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQFUBRjCrA8qWBjgG95CQAAAkQ"]
[Sun Mar 01 17:23:27.732146 2026] [:error] [pid 40750:tid 40773] [client 78.101.129.138:46999] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQFjwfBuk03yQKDyqsnsAAAAdQ"]
[Sun Mar 01 17:24:33.575771 2026] [:error] [pid 33822:tid 33842] [client 78.101.129.138:65154] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQF0W6W3ygu1YVssubfcwAAApI"]
[Sun Mar 01 17:24:33.578800 2026] [:error] [pid 33822:tid 33842] [client 78.101.129.138:65154] [client 78.101.129.138] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1expressinteriors.comexpressinteriors%expressinteriors.comtitle0xc8408881description0xc8408881mt_keywords0xc8408881mt_excerpt0xc84088811"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQF0W6W3ygu1YVssubfcwAAApI"]
[Sun Mar 01 17:25:37.301760 2026] [:error] [pid 7133:tid 7148] [client 78.101.129.138:55367] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQGEfCtubh8pR64qB_qVQAAAE0"]
[Sun Mar 01 17:26:41.518329 2026] [:error] [pid 40750:tid 40762] [client 78.101.129.138:50856] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQGUQfBuk03yQKDyqss1wAAAck"]
[Sun Mar 01 17:26:42.527633 2026] [:error] [pid 38034:tid 38036] [client 45.67.97.195:48153] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aaQGUgxtfZjwlJok9K_m-wAAAQA"]
[Sun Mar 01 17:26:48.201901 2026] [:error] [pid 40750:tid 40777] [client 45.67.97.20:65379] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aaQGWAfBuk03yQKDyqss5QAAAdg"]
[Sun Mar 01 17:27:12.417269 2026] [:error] [pid 38034:tid 38052] [client 45.67.97.20:54323] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aaQGcAxtfZjwlJok9K_nLgAAAQ4"]
[Sun Mar 01 17:27:18.740320 2026] [:error] [pid 41780:tid 41789] [client 45.67.97.2:33449] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aaQGdsONkVoocLIqzy0auwAAA8Y"]
[Sun Mar 01 17:27:42.467327 2026] [:error] [pid 7165:tid 7172] [client 45.67.97.2:51005] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aaQGjhRjCrA8qWBjgG9_JQAAAkU"]
[Sun Mar 01 17:27:44.348204 2026] [:error] [pid 7165:tid 7182] [client 78.101.129.138:63097] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQGkBRjCrA8qWBjgG9_NAAAAk8"]
[Sun Mar 01 17:27:46.798744 2026] [:error] [pid 37032:tid 37045] [client 45.67.97.2:20711] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aaQGkuu0U4o7eSImsVRgHwAAAYs"]
[Sun Mar 01 17:27:47.789624 2026] [:error] [pid 7165:tid 7168] [client 45.67.97.2:54143] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aaQGkxRjCrA8qWBjgG9_QQAAAkE"]
[Sun Mar 01 17:27:49.044924 2026] [:error] [pid 40750:tid 40761] [client 45.67.97.20:50275] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aaQGlQfBuk03yQKDyqsuTgAAAcg"]
[Sun Mar 01 17:27:50.452647 2026] [:error] [pid 40750:tid 40764] [client 45.67.97.19:62295] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aaQGlgfBuk03yQKDyqsuZwAAAcs"]
[Sun Mar 01 17:27:52.420013 2026] [:error] [pid 38034:tid 38053] [client 45.67.97.2:37773] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aaQGmAxtfZjwlJok9K_nQwAAAQ8"]
[Sun Mar 01 17:27:57.074790 2026] [:error] [pid 7165:tid 7190] [client 45.67.97.20:64425] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aaQGnRRjCrA8qWBjgG9_ZwAAAlc"]
[Sun Mar 01 17:28:01.688626 2026] [:error] [pid 40750:tid 40753] [client 45.67.97.195:64883] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aaQGoQfBuk03yQKDyqsuxQAAAcA"]
[Sun Mar 01 17:28:06.869258 2026] [:error] [pid 7165:tid 7174] [client 45.67.97.195:33677] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aaQGphRjCrA8qWBjgG9_kwAAAkc"]
[Sun Mar 01 17:28:09.463285 2026] [:error] [pid 38241:tid 38247] [client 45.67.97.2:22223] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aaQGqfKRPk6YnJBxw_yXRQAAAMM"]
[Sun Mar 01 17:28:12.379041 2026] [:error] [pid 7165:tid 7178] [client 45.67.97.195:38185] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aaQGrBRjCrA8qWBjgG9_tAAAAks"]
[Sun Mar 01 17:28:33.316171 2026] [:error] [pid 7133:tid 7159] [client 45.67.97.195:58367] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aaQGwfCtubh8pR64qB_rxgAAAFg"]
[Sun Mar 01 17:28:36.225246 2026] [:error] [pid 7133:tid 7144] [client 45.67.97.195:42107] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aaQGxPCtubh8pR64qB_rzgAAAEk"]
[Sun Mar 01 17:28:40.430583 2026] [:error] [pid 40750:tid 40777] [client 45.67.97.19:28703] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/defaults.php"] [unique_id "aaQGyAfBuk03yQKDyqsvoAAAAdg"]
[Sun Mar 01 17:28:43.167807 2026] [:error] [pid 38241:tid 38263] [client 45.67.97.19:38481] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aaQGy_KRPk6YnJBxw_yX6wAAANM"]
[Sun Mar 01 17:28:49.090439 2026] [:error] [pid 7165:tid 7177] [client 78.101.129.138:65523] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQG0RRjCrA8qWBjgG-AHQAAAko"]
[Sun Mar 01 17:28:50.298643 2026] [:error] [pid 7165:tid 7188] [client 45.67.97.20:61401] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aaQG0hRjCrA8qWBjgG-AIgAAAlU"]
[Sun Mar 01 17:28:53.044734 2026] [:error] [pid 38241:tid 38268] [client 45.67.97.20:59067] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aaQG1fKRPk6YnJBxw_yYGAAAANg"]
[Sun Mar 01 17:28:55.830765 2026] [:error] [pid 7165:tid 7174] [client 45.67.97.20:44737] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aaQG1xRjCrA8qWBjgG-AQQAAAkc"]
[Sun Mar 01 17:28:56.729164 2026] [:error] [pid 33822:tid 33838] [client 45.67.97.20:47659] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aaQG2G6W3ygu1YVssubg7wAAAo4"]
[Sun Mar 01 17:28:57.704693 2026] [:error] [pid 38241:tid 38264] [client 45.67.97.20:44901] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaQG2fKRPk6YnJBxw_yYIQAAANQ"]
[Sun Mar 01 17:29:03.511870 2026] [:error] [pid 7165:tid 7168] [client 45.67.97.2:43201] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/info.php"] [unique_id "aaQG3xRjCrA8qWBjgG-AVAAAAkE"]
[Sun Mar 01 17:29:04.400557 2026] [:error] [pid 38241:tid 38260] [client 45.67.97.195:44301] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class.api.php"] [unique_id "aaQG4PKRPk6YnJBxw_yYNwAAANA"]
[Sun Mar 01 17:29:05.267545 2026] [:error] [pid 7133:tid 7140] [client 45.67.97.195:46065] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aaQG4fCtubh8pR64qB_sFgAAAEU"]
[Sun Mar 01 17:29:26.680624 2026] [:error] [pid 38241:tid 38245] [client 45.67.97.20:38411] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/admin.php"] [unique_id "aaQG9vKRPk6YnJBxw_yYhwAAAME"]
[Sun Mar 01 17:29:32.395476 2026] [:error] [pid 38241:tid 38251] [client 45.67.97.2:20737] [client 45.67.97.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.67.97.2, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aaQG_PKRPk6YnJBxw_yYnwAAAMc"]
[Sun Mar 01 17:29:48.019820 2026] [:error] [pid 38241:tid 38245] [client 45.67.97.2:20737] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aaQHDPKRPk6YnJBxw_yYzQAAAME"]
[Sun Mar 01 17:29:49.422642 2026] [:error] [pid 40750:tid 40768] [client 78.101.129.138:2135] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQHDQfBuk03yQKDyqsxVQAAAc8"]
[Sun Mar 01 17:29:52.104602 2026] [:error] [pid 7165:tid 7170] [client 45.67.97.20:49015] [client 45.67.97.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.67.97.20, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aaQHEBRjCrA8qWBjgG-BMAAAAkM"]
[Sun Mar 01 17:29:54.629680 2026] [:error] [pid 7165:tid 7171] [client 45.67.97.20:49015] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/item.php"] [unique_id "aaQHEhRjCrA8qWBjgG-BQAAAAkQ"]
[Sun Mar 01 17:30:09.987995 2026] [:error] [pid 40750:tid 40769] [client 45.67.97.19:64807] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aaQHIQfBuk03yQKDyqsxtAAAAdA"]
[Sun Mar 01 17:30:23.335998 2026] [:error] [pid 38241:tid 38250] [client 45.67.97.195:52389] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aaQHL_KRPk6YnJBxw_yZOQAAAMY"]
[Sun Mar 01 17:30:27.484003 2026] [:error] [pid 38241:tid 38256] [client 45.67.97.195:49969] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aaQHM_KRPk6YnJBxw_yZUgAAAMw"]
[Sun Mar 01 17:30:32.694367 2026] [:error] [pid 7165:tid 7172] [client 45.67.97.20:37537] [client 45.67.97.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.67.97.20, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aaQHOBRjCrA8qWBjgG-CFwAAAkU"]
[Sun Mar 01 17:30:33.923344 2026] [:error] [pid 7165:tid 7169] [client 45.67.97.20:37537] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aaQHORRjCrA8qWBjgG-CHAAAAkI"]
[Sun Mar 01 17:30:56.660815 2026] [:error] [pid 38241:tid 38267] [client 45.67.97.20:61511] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aaQHUPKRPk6YnJBxw_yZnQAAANc"]
[Sun Mar 01 17:30:59.615077 2026] [:error] [pid 38241:tid 38245] [client 78.101.129.138:3935] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQHU_KRPk6YnJBxw_yZogAAAME"]
[Sun Mar 01 17:31:02.428656 2026] [:error] [pid 7165:tid 7171] [client 45.67.97.195:31993] [client 45.67.97.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.67.97.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aaQHVhRjCrA8qWBjgG-CdgAAAkQ"]
[Sun Mar 01 17:31:07.912798 2026] [:error] [pid 7165:tid 7189] [client 45.67.97.195:31993] [client 45.67.97.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aaQHWxRjCrA8qWBjgG-ChQAAAlY"]
[Sun Mar 01 17:31:10.612919 2026] [:error] [pid 7165:tid 7167] [client 45.67.97.19:25979] [client 45.67.97.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/infi.php"] [unique_id "aaQHXhRjCrA8qWBjgG-CiAAAAkA"]
[Sun Mar 01 17:31:14.294565 2026] [:error] [pid 38241:tid 38268] [client 45.67.97.2:38139] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aaQHYvKRPk6YnJBxw_yZzQAAANg"]
[Sun Mar 01 17:31:19.315484 2026] [:error] [pid 38241:tid 38253] [client 45.67.97.2:36533] [client 45.67.97.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aaQHZ_KRPk6YnJBxw_yZ3wAAAMk"]
[Sun Mar 01 17:31:20.223164 2026] [:error] [pid 7165:tid 7189] [client 45.67.97.20:46807] [client 45.67.97.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aaQHaBRjCrA8qWBjgG-CogAAAlY"]
[Sun Mar 01 17:31:31.963770 2026] [autoindex:error] [pid 7165:tid 7189] [client 45.67.97.195:36767] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:31:33.129519 2026] [autoindex:error] [pid 7165:tid 7191] [client 45.67.97.195:36767] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:31:34.410932 2026] [autoindex:error] [pid 7165:tid 7184] [client 45.67.97.195:36767] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:31:35.803013 2026] [autoindex:error] [pid 7165:tid 7174] [client 45.67.97.195:36767] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:31:43.153969 2026] [autoindex:error] [pid 7165:tid 7178] [client 45.67.97.195:36767] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:31:44.824234 2026] [autoindex:error] [pid 7165:tid 7187] [client 45.67.97.195:36767] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:31:45.855722 2026] [autoindex:error] [pid 7165:tid 7182] [client 45.67.97.195:36767] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:31:47.242260 2026] [autoindex:error] [pid 7165:tid 7175] [client 45.67.97.195:36767] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:31:48.576988 2026] [autoindex:error] [pid 7165:tid 7186] [client 45.67.97.195:36767] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:31:50.708663 2026] [autoindex:error] [pid 7165:tid 7184] [client 45.67.97.195:36767] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:31:56.084918 2026] [autoindex:error] [pid 7165:tid 7184] [client 45.67.97.195:36767] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:32:00.862773 2026] [autoindex:error] [pid 7165:tid 7167] [client 45.67.97.195:36767] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:32:03.097848 2026] [autoindex:error] [pid 7165:tid 7180] [client 45.67.97.195:36767] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:32:06.372073 2026] [:error] [pid 38034:tid 38040] [client 78.101.129.138:53472] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQHlgxtfZjwlJok9K_oFQAAAQQ"]
[Sun Mar 01 17:32:15.068186 2026] [autoindex:error] [pid 7165:tid 7168] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:32:15.508780 2026] [autoindex:error] [pid 7165:tid 7175] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:32:15.950405 2026] [autoindex:error] [pid 7165:tid 7187] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:32:16.865308 2026] [autoindex:error] [pid 7165:tid 7186] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:32:18.765785 2026] [autoindex:error] [pid 7165:tid 7188] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:32:19.204346 2026] [autoindex:error] [pid 7165:tid 7168] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:32:21.039302 2026] [autoindex:error] [pid 7165:tid 7173] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:32:24.054937 2026] [autoindex:error] [pid 7165:tid 7182] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:32:24.495872 2026] [autoindex:error] [pid 7165:tid 7188] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:32:24.937950 2026] [autoindex:error] [pid 7165:tid 7187] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:32:29.012717 2026] [autoindex:error] [pid 7165:tid 7186] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:32:32.809948 2026] [autoindex:error] [pid 7165:tid 7175] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:32:34.485659 2026] [autoindex:error] [pid 7165:tid 7169] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:32:34.926721 2026] [autoindex:error] [pid 7165:tid 7183] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:32:36.234141 2026] [autoindex:error] [pid 7165:tid 7172] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:32:36.674976 2026] [autoindex:error] [pid 7165:tid 7168] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:32:37.114602 2026] [autoindex:error] [pid 7165:tid 7182] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:32:42.268356 2026] [autoindex:error] [pid 7165:tid 7175] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:33:10.828942 2026] [:error] [pid 44644:tid 44660] [client 78.101.129.138:53880] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQH1p3RJaXMcw3y9V_E4QAAAA0"]
[Sun Mar 01 17:33:12.964505 2026] [autoindex:error] [pid 7165:tid 7177] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:33:13.404507 2026] [autoindex:error] [pid 7165:tid 7191] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:33:13.845076 2026] [autoindex:error] [pid 7165:tid 7175] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:33:14.290281 2026] [autoindex:error] [pid 7165:tid 7185] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:33:17.059997 2026] [autoindex:error] [pid 7165:tid 7169] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:33:17.495998 2026] [autoindex:error] [pid 7165:tid 7174] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:33:19.053141 2026] [autoindex:error] [pid 7165:tid 7181] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:33:20.644316 2026] [autoindex:error] [pid 7165:tid 7176] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:33:21.085077 2026] [autoindex:error] [pid 7165:tid 7184] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:33:21.517563 2026] [autoindex:error] [pid 7165:tid 7186] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:33:23.207635 2026] [autoindex:error] [pid 7165:tid 7183] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:33:23.639656 2026] [autoindex:error] [pid 7165:tid 7176] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:33:24.070274 2026] [autoindex:error] [pid 7165:tid 7184] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:33:24.510994 2026] [autoindex:error] [pid 7165:tid 7173] [client 45.67.97.19:37679] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:33:54.467893 2026] [autoindex:error] [pid 40750:tid 40760] [client 45.67.97.2:63633] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:34:09.925259 2026] [autoindex:error] [pid 40750:tid 40768] [client 45.67.97.2:63633] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:34:15.374594 2026] [autoindex:error] [pid 40750:tid 40773] [client 45.67.97.2:63633] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:34:15.822261 2026] [autoindex:error] [pid 40750:tid 40753] [client 45.67.97.2:63633] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:34:21.284504 2026] [autoindex:error] [pid 40750:tid 40768] [client 45.67.97.2:63633] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:34:21.729997 2026] [autoindex:error] [pid 40750:tid 40769] [client 45.67.97.2:63633] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:34:22.165120 2026] [autoindex:error] [pid 40750:tid 40758] [client 45.67.97.2:63633] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:34:22.475260 2026] [:error] [pid 40750:tid 40759] [client 78.101.129.138:55132] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQIHgfBuk03yQKDyqs2QwAAAcY"]
[Sun Mar 01 17:34:22.478290 2026] [:error] [pid 40750:tid 40759] [client 78.101.129.138:55132] [client 78.101.129.138] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1expressinteriors.com%1title0x1a4874afdescription0x1a4874afmt_keywords0x1a4874afmt_excerpt0x1a4874af1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQIHgfBuk03yQKDyqs2QwAAAcY"]
[Sun Mar 01 17:34:22.606243 2026] [autoindex:error] [pid 40750:tid 40755] [client 45.67.97.2:63633] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:34:23.070659 2026] [autoindex:error] [pid 40750:tid 40757] [client 45.67.97.2:63633] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:34:23.613823 2026] [autoindex:error] [pid 40750:tid 40769] [client 45.67.97.2:63633] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:34:24.048314 2026] [autoindex:error] [pid 40750:tid 40763] [client 45.67.97.2:63633] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:34:24.487387 2026] [autoindex:error] [pid 40750:tid 40755] [client 45.67.97.2:63633] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:34:24.975738 2026] [autoindex:error] [pid 40750:tid 40768] [client 45.67.97.2:63633] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:34:49.306175 2026] [autoindex:error] [pid 40750:tid 40774] [client 45.67.97.2:63633] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 17:35:26.747362 2026] [:error] [pid 7165:tid 7183] [client 78.101.129.138:56206] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQIXhRjCrA8qWBjgG-F1AAAAlA"]
[Sun Mar 01 17:36:34.781844 2026] [:error] [pid 40750:tid 40773] [client 78.101.129.138:14865] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQIogfBuk03yQKDyqs4cwAAAdQ"]
[Sun Mar 01 17:37:37.744086 2026] [:error] [pid 33822:tid 33830] [client 78.101.129.138:17173] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQI4W6W3ygu1YVssubijQAAAoY"]
[Sun Mar 01 17:38:41.860782 2026] [:error] [pid 38241:tid 38263] [client 78.101.129.138:58510] [client 78.101.129.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.101.129.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQJIfKRPk6YnJBxw_ydEwAAANM"]
[Sun Mar 01 18:39:18.232584 2026] [:error] [pid 38241:tid 38263] [client 20.63.80.2:31972] [client 20.63.80.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wk/index.php"] [unique_id "aaQXVvKRPk6YnJBxw_y_ngAAANM"]
[Sun Mar 01 18:39:19.058495 2026] [:error] [pid 38241:tid 38245] [client 20.63.80.2:31937] [client 20.63.80.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wk/index.php"] [unique_id "aaQXV_KRPk6YnJBxw_y_ogAAAME"]
[Sun Mar 01 18:39:19.882673 2026] [:error] [pid 7165:tid 7172] [client 20.63.80.2:31938] [client 20.63.80.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wk/index.php"] [unique_id "aaQXVxRjCrA8qWBjgG-7awAAAkU"]
[Sun Mar 01 18:39:20.721618 2026] [:error] [pid 7165:tid 7173] [client 20.63.80.2:31936] [client 20.63.80.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wk/index.php"] [unique_id "aaQXWBRjCrA8qWBjgG-7bwAAAkY"]
[Sun Mar 01 18:54:41.112316 2026] [:error] [pid 40750:tid 40763] [client 91.224.92.99:52757] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.224.92.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQa8QfBuk03yQKDyquUJQAAAco"]
[Sun Mar 01 18:54:43.715939 2026] [:error] [pid 40750:tid 40757] [client 91.224.92.99:52757] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aaQa8wfBuk03yQKDyquUMAAAAcQ"]
[Sun Mar 01 18:54:44.054509 2026] [:error] [pid 40750:tid 40774] [client 91.224.92.99:52757] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.224.92.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQa9AfBuk03yQKDyquUMgAAAdU"]
[Sun Mar 01 18:54:45.907248 2026] [:error] [pid 7165:tid 7171] [client 91.224.92.99:53695] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.224.92.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQa9RRjCrA8qWBjgG_J3gAAAkQ"]
[Sun Mar 01 18:54:47.866911 2026] [:error] [pid 38034:tid 38037] [client 91.224.92.99:50060] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.224.92.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQa9wxtfZjwlJok9K_6TQAAAQE"]
[Sun Mar 01 18:54:49.734023 2026] [:error] [pid 7165:tid 7176] [client 91.224.92.99:51317] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.224.92.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQa-RRjCrA8qWBjgG_J6AAAAkk"]
[Sun Mar 01 18:54:51.667182 2026] [:error] [pid 40750:tid 40762] [client 91.224.92.99:55957] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.224.92.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQa-wfBuk03yQKDyquUTQAAAck"]
[Sun Mar 01 18:54:51.667314 2026] [:error] [pid 40750:tid 40762] [client 91.224.92.99:55957] [client 91.224.92.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 91.224.92.99, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQa-wfBuk03yQKDyquUTQAAAck"]
[Sun Mar 01 19:32:32.378227 2026] [:error] [pid 33822:tid 33838] [client 216.73.216.156:53056] [client 216.73.216.156] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||expressinteriors.com|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/robots.txt"] [unique_id "aaQj0G6W3ygu1YVssuYEnwAAAo4"]
[Sun Mar 01 19:41:11.967152 2026] [:error] [pid 38241:tid 38258] [client 43.156.204.134:60924] [client 43.156.204.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaQl1_KRPk6YnJBxw_ziWwAAAM4"]
[Sun Mar 01 21:15:16.933799 2026] [:error] [pid 40750:tid 40764] [client 216.73.216.156:57541] [client 216.73.216.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.73.216.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQ75AfBuk03yQKDyqs5uwAAAcs"]
[Sun Mar 01 21:30:58.329966 2026] [:error] [pid 7165:tid 7167] [client 34.150.177.101:60031] [client 34.150.177.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.150.177.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQ_khRjCrA8qWBjgG9JhQAAAkA"]
[Sun Mar 01 21:31:00.929701 2026] [:error] [pid 7165:tid 7176] [client 34.150.177.101:60031] [client 34.150.177.101] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aaQ_lBRjCrA8qWBjgG9JkwAAAkk"]
[Sun Mar 01 21:31:01.154444 2026] [:error] [pid 7165:tid 7180] [client 34.150.177.101:60031] [client 34.150.177.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.150.177.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQ_lRRjCrA8qWBjgG9JlQAAAk0"]
[Sun Mar 01 21:31:03.175167 2026] [:error] [pid 40750:tid 40761] [client 34.150.177.101:55315] [client 34.150.177.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.150.177.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQ_lwfBuk03yQKDyqtIMwAAAcg"]
[Sun Mar 01 21:31:05.165002 2026] [:error] [pid 40750:tid 40762] [client 34.150.177.101:55197] [client 34.150.177.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.150.177.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQ_mQfBuk03yQKDyqtIOwAAAck"]
[Sun Mar 01 21:31:07.534902 2026] [:error] [pid 38034:tid 38056] [client 34.150.177.101:60881] [client 34.150.177.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.150.177.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQ_mwxtfZjwlJok9K8aAgAAARI"]
[Sun Mar 01 21:31:09.348256 2026] [:error] [pid 7165:tid 7177] [client 34.150.177.101:54986] [client 34.150.177.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.150.177.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQ_nRRjCrA8qWBjgG9JpAAAAko"]
[Sun Mar 01 21:31:09.348433 2026] [:error] [pid 7165:tid 7177] [client 34.150.177.101:54986] [client 34.150.177.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.150.177.101, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaQ_nRRjCrA8qWBjgG9JpAAAAko"]
[Sun Mar 01 21:36:20.452212 2026] [:error] [pid 38241:tid 38245] [client 20.63.80.2:31897] [client 20.63.80.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "aaRA1PKRPk6YnJBxw_wc4gAAAME"]
[Sun Mar 01 21:36:22.045332 2026] [autoindex:error] [pid 40750:tid 40777] [client 20.63.80.2:31899] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 21:36:26.800636 2026] [autoindex:error] [pid 40750:tid 40771] [client 20.63.80.2:31899] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 21:36:27.009695 2026] [autoindex:error] [pid 40750:tid 40753] [client 20.63.80.2:31899] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/block/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 01 21:36:27.948856 2026] [:error] [pid 40750:tid 40756] [client 20.63.80.2:31899] [client 20.63.80.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aaRA2wfBuk03yQKDyqtLtAAAAcM"]
[Sun Mar 01 21:36:28.774654 2026] [:error] [pid 7165:tid 7185] [client 20.63.80.2:31896] [client 20.63.80.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/special.php"] [unique_id "aaRA3BRjCrA8qWBjgG9MegAAAlI"]
[Sun Mar 01 21:36:29.616627 2026] [:error] [pid 7165:tid 7170] [client 20.63.80.2:58834] [client 20.63.80.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/special.php"] [unique_id "aaRA3RRjCrA8qWBjgG9MfwAAAkM"]
[Sun Mar 01 21:36:30.444582 2026] [:error] [pid 40750:tid 40762] [client 20.63.80.2:31921] [client 20.63.80.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/special.php"] [unique_id "aaRA3gfBuk03yQKDyqtLuAAAAck"]
[Sun Mar 01 21:39:16.995777 2026] [:error] [pid 40750:tid 40772] [client 49.51.166.228:45084] [client 49.51.166.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaRBhAfBuk03yQKDyqtN7QAAAdM"]
[Sun Mar 01 21:44:47.845808 2026] [:error] [pid 7133:tid 7149] [client 40.85.219.62:11403] [client 40.85.219.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aaRCz_Ctubh8pR64qB9PmAAAAE4"]
[Sun Mar 01 21:44:48.666958 2026] [:error] [pid 40750:tid 40755] [client 40.85.219.62:11402] [client 40.85.219.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aaRC0AfBuk03yQKDyqtSegAAAcI"]
[Sun Mar 01 21:44:49.510723 2026] [:error] [pid 40750:tid 40776] [client 40.85.219.62:11450] [client 40.85.219.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aaRC0QfBuk03yQKDyqtSiQAAAdc"]
[Sun Mar 01 21:44:50.333912 2026] [:error] [pid 41780:tid 41786] [client 40.85.219.62:11452] [client 40.85.219.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aaRC0sONkVoocLIqzy0uVQAAA8M"]
[Sun Mar 01 22:07:32.108021 2026] [autoindex:error] [pid 7133:tid 7142] [client 194.146.12.7:58588] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Mar 01 22:49:32.662309 2026] [:error] [pid 33822:tid 33843] [client 4.193.177.110:5084] [client 4.193.177.110] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aaRR_G6W3ygu1YVssuY4YQAAApM"]
[Sun Mar 01 22:49:33.020717 2026] [:error] [pid 40750:tid 40772] [client 4.193.177.110:3943] [client 4.193.177.110] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aaRR_QfBuk03yQKDyquCtgAAAdM"]
[Sun Mar 01 22:49:33.405159 2026] [:error] [pid 38034:tid 38036] [client 4.193.177.110:3949] [client 4.193.177.110] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aaRR_QxtfZjwlJok9K8oHgAAAQA"]
[Sun Mar 01 22:49:33.769517 2026] [:error] [pid 7165:tid 7191] [client 4.193.177.110:5057] [client 4.193.177.110] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aaRR_RRjCrA8qWBjgG-R6AAAAlg"]
[Sun Mar 01 23:43:38.026540 2026] [:error] [pid 40750:tid 40753] [client 91.224.92.99:63719] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaReqgfBuk03yQKDyquoNwAAAcA"]
[Sun Mar 01 23:43:39.117767 2026] [:error] [pid 40750:tid 40772] [client 91.224.92.99:63719] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaReqwfBuk03yQKDyquoPQAAAdM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:43:40.964855 2026] [:error] [pid 40750:tid 40754] [client 91.224.92.99:63719] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRerAfBuk03yQKDyquoRwAAAcE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:43:42.790309 2026] [:error] [pid 40750:tid 40776] [client 91.224.92.99:63719] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRergfBuk03yQKDyquoSgAAAdc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:43:44.736424 2026] [:error] [pid 40750:tid 40756] [client 91.224.92.99:63719] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaResAfBuk03yQKDyquoUAAAAcM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:43:46.524868 2026] [:error] [pid 40750:tid 40773] [client 91.224.92.99:63719] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaResgfBuk03yQKDyquoUgAAAdQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:43:48.298399 2026] [:error] [pid 40750:tid 40777] [client 91.224.92.99:63719] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRetAfBuk03yQKDyquoVQAAAdg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:43:49.178376 2026] [:error] [pid 40750:tid 40775] [client 91.224.92.99:63719] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRetQfBuk03yQKDyquoVgAAAdY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:43:51.008690 2026] [:error] [pid 40750:tid 40768] [client 91.224.92.99:63719] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRetwfBuk03yQKDyquoXAAAAc8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:43:52.960720 2026] [:error] [pid 40750:tid 40766] [client 91.224.92.99:63719] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaReuAfBuk03yQKDyquoXgAAAc0"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:43:54.813734 2026] [:error] [pid 40750:tid 40765] [client 91.224.92.99:63719] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaReugfBuk03yQKDyquoYgAAAcw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:43:56.622767 2026] [:error] [pid 40750:tid 40760] [client 91.224.92.99:63719] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRevAfBuk03yQKDyquoZgAAAcc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:43:56.622846 2026] [:error] [pid 40750:tid 40760] [client 91.224.92.99:63719] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRevAfBuk03yQKDyquoZgAAAcc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:43:58.393541 2026] [:error] [pid 40750:tid 40773] [client 91.224.92.99:62269] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRevgfBuk03yQKDyquoZwAAAdQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:43:59.828086 2026] [:error] [pid 7165:tid 7171] [client 91.224.92.99:55221] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRevxRjCrA8qWBjgG_IlgAAAkQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:01.615957 2026] [:error] [pid 7165:tid 7179] [client 91.224.92.99:55221] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRewRRjCrA8qWBjgG_IngAAAkw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:03.846177 2026] [:error] [pid 7165:tid 7191] [client 91.224.92.99:55221] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRewxRjCrA8qWBjgG_IoAAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:04.739317 2026] [:error] [pid 7165:tid 7189] [client 91.224.92.99:55221] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRexBRjCrA8qWBjgG_IowAAAlY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:06.516868 2026] [:error] [pid 7165:tid 7190] [client 91.224.92.99:55221] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRexhRjCrA8qWBjgG_IpwAAAlc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:08.372864 2026] [:error] [pid 7165:tid 7177] [client 91.224.92.99:55221] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaReyBRjCrA8qWBjgG_IqwAAAko"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:08.372936 2026] [:error] [pid 7165:tid 7177] [client 91.224.92.99:55221] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaReyBRjCrA8qWBjgG_IqwAAAko"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:10.709210 2026] [:error] [pid 38034:tid 38044] [client 91.224.92.99:56576] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaReygxtfZjwlJok9K80UwAAAQY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:12.484701 2026] [:error] [pid 38034:tid 38053] [client 91.224.92.99:56576] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRezAxtfZjwlJok9K80VQAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:14.249030 2026] [:error] [pid 38034:tid 38039] [client 91.224.92.99:56576] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRezgxtfZjwlJok9K80VwAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:15.081034 2026] [:error] [pid 38034:tid 38040] [client 91.224.92.99:56576] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRezwxtfZjwlJok9K80WAAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:16.818351 2026] [:error] [pid 38034:tid 38061] [client 91.224.92.99:56576] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe0AxtfZjwlJok9K80WgAAARc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:18.657645 2026] [:error] [pid 38034:tid 38051] [client 91.224.92.99:56576] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe0gxtfZjwlJok9K80XAAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:18.657764 2026] [:error] [pid 38034:tid 38051] [client 91.224.92.99:56576] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe0gxtfZjwlJok9K80XAAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:19.983281 2026] [:error] [pid 40750:tid 40758] [client 91.224.92.99:64166] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe0wfBuk03yQKDyquokgAAAcU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:21.709422 2026] [:error] [pid 40750:tid 40772] [client 91.224.92.99:64166] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe1QfBuk03yQKDyquomgAAAdM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:21.709490 2026] [:error] [pid 40750:tid 40772] [client 91.224.92.99:64166] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe1QfBuk03yQKDyquomgAAAdM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:23.034667 2026] [:error] [pid 40750:tid 40755] [client 91.224.92.99:53614] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRe1wfBuk03yQKDyquooAAAAcI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:27.006689 2026] [:error] [pid 7165:tid 7181] [client 91.224.92.99:65255] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe2xRjCrA8qWBjgG_I4AAAAk4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:28.864385 2026] [:error] [pid 7165:tid 7185] [client 91.224.92.99:65255] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe3BRjCrA8qWBjgG_I8QAAAlI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:30.678576 2026] [:error] [pid 7165:tid 7182] [client 91.224.92.99:65255] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe3hRjCrA8qWBjgG_I9wAAAk8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:31.574652 2026] [:error] [pid 7165:tid 7179] [client 91.224.92.99:65255] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe3xRjCrA8qWBjgG_I_QAAAkw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:32.437880 2026] [:error] [pid 7165:tid 7172] [client 91.224.92.99:65255] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRe4BRjCrA8qWBjgG_I_wAAAkU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:35.727815 2026] [:error] [pid 40750:tid 40764] [client 91.224.92.99:64482] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe4wfBuk03yQKDyquoswAAAcs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:37.455116 2026] [:error] [pid 40750:tid 40774] [client 91.224.92.99:64482] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe5QfBuk03yQKDyquotgAAAdU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:39.201207 2026] [:error] [pid 40750:tid 40765] [client 91.224.92.99:64482] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe5wfBuk03yQKDyquouQAAAcw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:41.490113 2026] [:error] [pid 40750:tid 40761] [client 91.224.92.99:64482] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe6QfBuk03yQKDyquovgAAAcg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:43.235429 2026] [:error] [pid 40750:tid 40763] [client 91.224.92.99:64482] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe6wfBuk03yQKDyquoxwAAAco"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:45.008919 2026] [:error] [pid 40750:tid 40759] [client 91.224.92.99:64482] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe7QfBuk03yQKDyquozAAAAcY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:45.895072 2026] [:error] [pid 40750:tid 40762] [client 91.224.92.99:64482] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe7QfBuk03yQKDyquo0QAAAck"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:45.895139 2026] [:error] [pid 40750:tid 40762] [client 91.224.92.99:64482] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe7QfBuk03yQKDyquo0QAAAck"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:48.119596 2026] [:error] [pid 41780:tid 41789] [client 91.224.92.99:64417] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe8MONkVoocLIqzy04owAAA8Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:50.574712 2026] [:error] [pid 41780:tid 41802] [client 91.224.92.99:64417] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe8sONkVoocLIqzy04pQAAA9M"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:51.734153 2026] [:error] [pid 41780:tid 41793] [client 91.224.92.99:64417] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe88ONkVoocLIqzy04pgAAA8o"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:53.416265 2026] [:error] [pid 41780:tid 41796] [client 91.224.92.99:64417] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe9cONkVoocLIqzy04qQAAA80"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:55.093871 2026] [:error] [pid 41780:tid 41794] [client 91.224.92.99:64417] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe98ONkVoocLIqzy04qwAAA8s"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:55.922194 2026] [:error] [pid 41780:tid 41787] [client 91.224.92.99:64417] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe98ONkVoocLIqzy04rAAAA8Q"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:57.619223 2026] [:error] [pid 41780:tid 41803] [client 91.224.92.99:64417] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe-cONkVoocLIqzy04rgAAA9Q"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:44:59.713509 2026] [:error] [pid 41780:tid 41805] [client 91.224.92.99:64417] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe-8ONkVoocLIqzy04sAAAA9Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:01.460345 2026] [:error] [pid 41780:tid 41798] [client 91.224.92.99:64417] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRe_cONkVoocLIqzy04sQAAA88"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:04.275486 2026] [:error] [pid 41780:tid 41792] [client 91.224.92.99:64417] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfAMONkVoocLIqzy04swAAA8k"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:06.348432 2026] [:error] [pid 41780:tid 41791] [client 91.224.92.99:64417] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfAsONkVoocLIqzy04tQAAA8g"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:07.506869 2026] [:error] [pid 41780:tid 41786] [client 91.224.92.99:64417] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfA8ONkVoocLIqzy04twAAA8M"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:09.253096 2026] [:error] [pid 41780:tid 41806] [client 91.224.92.99:64417] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRfBcONkVoocLIqzy04uAAAA9c"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:11.015612 2026] [:error] [pid 38241:tid 38257] [client 91.224.92.99:54610] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRfB_KRPk6YnJBxw_xZvgAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:12.889714 2026] [:error] [pid 40750:tid 40754] [client 91.224.92.99:55568] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfCAfBuk03yQKDyqupSwAAAcE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:15.007878 2026] [:error] [pid 40750:tid 40774] [client 91.224.92.99:55568] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfCwfBuk03yQKDyqupTgAAAdU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:18.451225 2026] [:error] [pid 40750:tid 40763] [client 91.224.92.99:55568] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfDgfBuk03yQKDyqupWwAAAco"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:19.301977 2026] [:error] [pid 40750:tid 40761] [client 91.224.92.99:55568] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfDwfBuk03yQKDyqupXAAAAcg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:21.057256 2026] [:error] [pid 40750:tid 40766] [client 91.224.92.99:55568] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfEQfBuk03yQKDyqupXgAAAc0"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:24.141251 2026] [:error] [pid 40750:tid 40767] [client 91.224.92.99:55568] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfFAfBuk03yQKDyqupawAAAc4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:24.995503 2026] [:error] [pid 40750:tid 40772] [client 91.224.92.99:55568] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfFAfBuk03yQKDyqupbAAAAdM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:24.995576 2026] [:error] [pid 40750:tid 40772] [client 91.224.92.99:55568] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfFAfBuk03yQKDyqupbAAAAdM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:27.196841 2026] [:error] [pid 38241:tid 38246] [client 91.224.92.99:57863] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfF_KRPk6YnJBxw_xZzwAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:28.886508 2026] [:error] [pid 38241:tid 38259] [client 91.224.92.99:57863] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfGPKRPk6YnJBxw_xZ1AAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:29.717658 2026] [:error] [pid 38241:tid 38266] [client 91.224.92.99:57863] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfGfKRPk6YnJBxw_xZ1gAAANY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:31.811182 2026] [:error] [pid 38241:tid 38247] [client 91.224.92.99:57863] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfG_KRPk6YnJBxw_xZ2wAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:33.922162 2026] [:error] [pid 38241:tid 38255] [client 91.224.92.99:57863] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfHfKRPk6YnJBxw_xZ3gAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:33.922252 2026] [:error] [pid 38241:tid 38255] [client 91.224.92.99:57863] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfHfKRPk6YnJBxw_xZ3gAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:36.729424 2026] [:error] [pid 40750:tid 40762] [client 91.224.92.99:61741] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfIAfBuk03yQKDyqupkwAAAck"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:36.729599 2026] [:error] [pid 40750:tid 40762] [client 91.224.92.99:61741] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfIAfBuk03yQKDyqupkwAAAck"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:43.013747 2026] [:error] [pid 33822:tid 33847] [client 91.224.92.99:51084] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfJ26W3ygu1YVssuZGQQAAApc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:43.888071 2026] [:error] [pid 33822:tid 33843] [client 91.224.92.99:51084] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfJ26W3ygu1YVssuZGRQAAApM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:44.753741 2026] [:error] [pid 33822:tid 33846] [client 91.224.92.99:51084] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRfKG6W3ygu1YVssuZGRwAAApY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:47.185864 2026] [:error] [pid 38241:tid 38256] [client 91.224.92.99:53855] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRfK_KRPk6YnJBxw_xZ_QAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:51.092912 2026] [:error] [pid 7165:tid 7186] [client 91.224.92.99:50353] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfLxRjCrA8qWBjgG_JugAAAlM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:51.092975 2026] [:error] [pid 7165:tid 7186] [client 91.224.92.99:50353] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfLxRjCrA8qWBjgG_JugAAAlM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:53.295327 2026] [:error] [pid 7133:tid 7136] [client 91.224.92.99:56124] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfMfCtubh8pR64qB99MgAAAEE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:55.992769 2026] [:error] [pid 7133:tid 7149] [client 91.224.92.99:56124] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfM_Ctubh8pR64qB99NwAAAE4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:56.871591 2026] [:error] [pid 7133:tid 7150] [client 91.224.92.99:56124] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfNPCtubh8pR64qB99OAAAAE8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:57.710766 2026] [:error] [pid 7133:tid 7138] [client 91.224.92.99:56124] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRfNfCtubh8pR64qB99OQAAAEM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:45:59.829618 2026] [:error] [pid 38241:tid 38253] [client 91.224.92.99:60922] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRfN_KRPk6YnJBxw_xaEQAAAMk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:01.682927 2026] [:error] [pid 40750:tid 40755] [client 91.224.92.99:53418] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfOQfBuk03yQKDyqupxgAAAcI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:01.683027 2026] [:error] [pid 40750:tid 40755] [client 91.224.92.99:53418] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfOQfBuk03yQKDyqupxgAAAcI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:05.571947 2026] [:error] [pid 38241:tid 38268] [client 91.224.92.99:53049] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfPfKRPk6YnJBxw_xaIAAAANg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:05.572006 2026] [:error] [pid 38241:tid 38268] [client 91.224.92.99:53049] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfPfKRPk6YnJBxw_xaIAAAANg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:06.896655 2026] [:error] [pid 7165:tid 7188] [client 91.224.92.99:58216] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRfPhRjCrA8qWBjgG_J6wAAAlU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:08.644062 2026] [:error] [pid 7165:tid 7179] [client 91.224.92.99:52865] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfQBRjCrA8qWBjgG_J9gAAAkw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:11.247605 2026] [:error] [pid 7165:tid 7175] [client 91.224.92.99:52865] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfQxRjCrA8qWBjgG_KAwAAAkg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:13.597344 2026] [:error] [pid 7165:tid 7177] [client 91.224.92.99:52865] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfRRRjCrA8qWBjgG_KDAAAAko"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:14.447371 2026] [:error] [pid 7165:tid 7175] [client 91.224.92.99:52865] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfRhRjCrA8qWBjgG_KEwAAAkg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:14.447582 2026] [:error] [pid 7165:tid 7175] [client 91.224.92.99:52865] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfRhRjCrA8qWBjgG_KEwAAAkg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:17.390100 2026] [:error] [pid 7165:tid 7191] [client 91.224.92.99:60904] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfSRRjCrA8qWBjgG_KLAAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:20.735894 2026] [:error] [pid 7165:tid 7189] [client 91.224.92.99:60904] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfTBRjCrA8qWBjgG_KOgAAAlY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:21.576455 2026] [:error] [pid 7165:tid 7171] [client 91.224.92.99:60904] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfTRRjCrA8qWBjgG_KPwAAAkQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:22.830599 2026] [:error] [pid 7165:tid 7179] [client 91.224.92.99:60904] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRfThRjCrA8qWBjgG_KQwAAAkw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:26.164226 2026] [:error] [pid 7165:tid 7182] [client 91.224.92.99:64590] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRfUhRjCrA8qWBjgG_KWQAAAk8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:28.589669 2026] [:error] [pid 7165:tid 7190] [client 91.224.92.99:55759] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfVBRjCrA8qWBjgG_KaQAAAlc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:31.942729 2026] [:error] [pid 7165:tid 7178] [client 91.224.92.99:55759] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfVxRjCrA8qWBjgG_KdAAAAks"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:31.942804 2026] [:error] [pid 7165:tid 7178] [client 91.224.92.99:55759] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfVxRjCrA8qWBjgG_KdAAAAks"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:34.547172 2026] [:error] [pid 38241:tid 38259] [client 91.224.92.99:54952] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRfWvKRPk6YnJBxw_xaSgAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:36.282775 2026] [:error] [pid 38034:tid 38055] [client 91.224.92.99:61424] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfXAxtfZjwlJok9K80rQAAARE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:36.282844 2026] [:error] [pid 38034:tid 38055] [client 91.224.92.99:61424] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfXAxtfZjwlJok9K80rQAAARE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:38.909249 2026] [:error] [pid 40750:tid 40761] [client 91.224.92.99:58278] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfXgfBuk03yQKDyquqCQAAAcg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:40.605149 2026] [:error] [pid 40750:tid 40753] [client 91.224.92.99:58278] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfYAfBuk03yQKDyquqDAAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:41.461812 2026] [:error] [pid 40750:tid 40758] [client 91.224.92.99:58278] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfYQfBuk03yQKDyquqEAAAAcU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:42.370225 2026] [:error] [pid 40750:tid 40755] [client 91.224.92.99:58278] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRfYgfBuk03yQKDyquqEgAAAcI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:43.692911 2026] [:error] [pid 7133:tid 7140] [client 91.224.92.99:51528] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRfY_Ctubh8pR64qB99VwAAAEU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:45.135819 2026] [:error] [pid 37032:tid 37053] [client 91.224.92.99:54267] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfZeu0U4o7eSImsVSWoQAAAZM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:47.925276 2026] [:error] [pid 37032:tid 37044] [client 91.224.92.99:54267] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfZ-u0U4o7eSImsVSWpAAAAYo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:51.943459 2026] [:error] [pid 37032:tid 37049] [client 91.224.92.99:54267] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfa-u0U4o7eSImsVSWpgAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:51.943532 2026] [:error] [pid 37032:tid 37049] [client 91.224.92.99:54267] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfa-u0U4o7eSImsVSWpgAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:56.727134 2026] [:error] [pid 37032:tid 37048] [client 91.224.92.99:59754] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfcOu0U4o7eSImsVSWrQAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:46:56.727202 2026] [:error] [pid 37032:tid 37048] [client 91.224.92.99:59754] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfcOu0U4o7eSImsVSWrQAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:00.043276 2026] [:error] [pid 7133:tid 7142] [client 91.224.92.99:51762] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfdPCtubh8pR64qB99nAAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:01.834650 2026] [:error] [pid 7133:tid 7143] [client 91.224.92.99:51762] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfdfCtubh8pR64qB99ngAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:04.883059 2026] [:error] [pid 7133:tid 7150] [client 91.224.92.99:51762] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfePCtubh8pR64qB99qwAAAE8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:04.883103 2026] [:error] [pid 7133:tid 7150] [client 91.224.92.99:51762] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfePCtubh8pR64qB99qwAAAE8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:07.810679 2026] [:error] [pid 40750:tid 40758] [client 91.224.92.99:52410] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRfewfBuk03yQKDyquqZQAAAcU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:13.030585 2026] [:error] [pid 38241:tid 38251] [client 91.224.92.99:61135] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRfgfKRPk6YnJBxw_xahAAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:14.457649 2026] [:error] [pid 7133:tid 7152] [client 91.224.92.99:63586] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfgvCtubh8pR64qB99sgAAAFE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:14.457748 2026] [:error] [pid 7133:tid 7152] [client 91.224.92.99:63586] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfgvCtubh8pR64qB99sgAAAFE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:18.409202 2026] [:error] [pid 38034:tid 38037] [client 91.224.92.99:49492] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfhgxtfZjwlJok9K80vgAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:20.764814 2026] [:error] [pid 38034:tid 38052] [client 91.224.92.99:49492] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfiAxtfZjwlJok9K80vwAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:20.764898 2026] [:error] [pid 38034:tid 38052] [client 91.224.92.99:49492] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfiAxtfZjwlJok9K80vwAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:25.308681 2026] [:error] [pid 38034:tid 38054] [client 91.224.92.99:59766] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfjQxtfZjwlJok9K80ywAAARA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:27.393717 2026] [:error] [pid 38034:tid 38047] [client 91.224.92.99:59766] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfjwxtfZjwlJok9K801AAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:27.393794 2026] [:error] [pid 38034:tid 38047] [client 91.224.92.99:59766] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfjwxtfZjwlJok9K801AAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:28.787938 2026] [:error] [pid 7133:tid 7135] [client 91.224.92.99:54420] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfkPCtubh8pR64qB99zAAAAEA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:31.228192 2026] [:error] [pid 7133:tid 7150] [client 91.224.92.99:54420] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfk_Ctubh8pR64qB992gAAAE8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:32.968121 2026] [:error] [pid 7133:tid 7153] [client 91.224.92.99:54420] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRflPCtubh8pR64qB995wAAAFI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:35.300436 2026] [:error] [pid 7133:tid 7155] [client 91.224.92.99:54420] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfl_Ctubh8pR64qB997wAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:35.300497 2026] [:error] [pid 7133:tid 7155] [client 91.224.92.99:54420] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfl_Ctubh8pR64qB997wAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:38.677612 2026] [:error] [pid 40750:tid 40775] [client 91.224.92.99:64164] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRfmgfBuk03yQKDyquqowAAAdY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:42.269990 2026] [:error] [pid 7133:tid 7149] [client 91.224.92.99:52220] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRfnvCtubh8pR64qB99-QAAAE4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:43.719065 2026] [:error] [pid 44644:tid 44660] [client 91.224.92.99:51034] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfn53RJaXMcw3y9V_t7wAAAA0"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:46.836466 2026] [:error] [pid 44644:tid 44648] [client 91.224.92.99:51034] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfop3RJaXMcw3y9V_t8gAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:48.942104 2026] [:error] [pid 44644:tid 44671] [client 91.224.92.99:51034] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfpJ3RJaXMcw3y9V_t9QAAABg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:49.833981 2026] [:error] [pid 44644:tid 44653] [client 91.224.92.99:51034] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfpZ3RJaXMcw3y9V_t9gAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:51.581531 2026] [:error] [pid 44644:tid 44668] [client 91.224.92.99:51034] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfp53RJaXMcw3y9V_t-AAAABU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:53.751873 2026] [:error] [pid 44644:tid 44656] [client 91.224.92.99:51034] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfqZ3RJaXMcw3y9V_t-gAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:53.751948 2026] [:error] [pid 44644:tid 44656] [client 91.224.92.99:51034] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfqZ3RJaXMcw3y9V_t-gAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:57.954500 2026] [:error] [pid 7165:tid 7181] [client 91.224.92.99:58808] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfrRRjCrA8qWBjgG_L1wAAAk4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:47:57.954597 2026] [:error] [pid 7165:tid 7181] [client 91.224.92.99:58808] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfrRRjCrA8qWBjgG_L1wAAAk4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:00.869084 2026] [:error] [pid 40750:tid 40776] [client 91.224.92.99:50451] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRfsAfBuk03yQKDyquq3wAAAdc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:02.296891 2026] [:error] [pid 40750:tid 40759] [client 91.224.92.99:52603] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRfsgfBuk03yQKDyquq5QAAAcY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:03.717473 2026] [:error] [pid 40750:tid 40768] [client 91.224.92.99:51467] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfswfBuk03yQKDyquq7wAAAc8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:03.717545 2026] [:error] [pid 40750:tid 40768] [client 91.224.92.99:51467] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfswfBuk03yQKDyquq7wAAAc8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:05.583559 2026] [:error] [pid 38241:tid 38259] [client 91.224.92.99:60456] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRftfKRPk6YnJBxw_xavAAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:07.013370 2026] [:error] [pid 7165:tid 7188] [client 91.224.92.99:53829] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRftxRjCrA8qWBjgG_MDgAAAlU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:08.444808 2026] [:error] [pid 38241:tid 38264] [client 91.224.92.99:63410] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfuPKRPk6YnJBxw_xaxQAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:08.444871 2026] [:error] [pid 38241:tid 38264] [client 91.224.92.99:63410] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfuPKRPk6YnJBxw_xaxQAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:13.077786 2026] [:error] [pid 7165:tid 7167] [client 91.224.92.99:65299] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfvRRjCrA8qWBjgG_MLQAAAkA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:13.969065 2026] [:error] [pid 7165:tid 7186] [client 91.224.92.99:65299] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfvRRjCrA8qWBjgG_MLgAAAlM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:13.969132 2026] [:error] [pid 7165:tid 7186] [client 91.224.92.99:65299] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfvRRjCrA8qWBjgG_MLgAAAlM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:18.958109 2026] [:error] [pid 7165:tid 7182] [client 91.224.92.99:49867] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRfwhRjCrA8qWBjgG_MMgAAAk8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:29.306853 2026] [:error] [pid 44644:tid 44658] [client 91.224.92.99:50674] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfzZ3RJaXMcw3y9V_uEQAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:29.306927 2026] [:error] [pid 44644:tid 44658] [client 91.224.92.99:50674] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRfzZ3RJaXMcw3y9V_uEQAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:32.005188 2026] [:error] [pid 38241:tid 38253] [client 91.224.92.99:61738] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRf0PKRPk6YnJBxw_xa_wAAAMk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:36.532520 2026] [:error] [pid 40750:tid 40755] [client 91.224.92.99:59649] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRf1AfBuk03yQKDyqurxwAAAcI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:36.532613 2026] [:error] [pid 40750:tid 40755] [client 91.224.92.99:59649] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRf1AfBuk03yQKDyqurxwAAAcI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:38.033929 2026] [:error] [pid 37032:tid 37049] [client 91.224.92.99:54089] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRf1uu0U4o7eSImsVSXKwAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:39.572003 2026] [:error] [pid 40750:tid 40765] [client 91.224.92.99:55435] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRf1wfBuk03yQKDyqur1wAAAcw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:41.157058 2026] [:error] [pid 38241:tid 38261] [client 91.224.92.99:65032] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRf2fKRPk6YnJBxw_xbBwAAANE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:43.604052 2026] [:error] [pid 38241:tid 38257] [client 91.224.92.99:65032] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRf2_KRPk6YnJBxw_xbDwAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:45.460913 2026] [:error] [pid 38241:tid 38264] [client 91.224.92.99:65032] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRf3fKRPk6YnJBxw_xbGgAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:46.844559 2026] [:error] [pid 38241:tid 38265] [client 91.224.92.99:65032] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRf3vKRPk6YnJBxw_xbHgAAANU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:48.696116 2026] [:error] [pid 38241:tid 38259] [client 91.224.92.99:65032] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRf4PKRPk6YnJBxw_xbIgAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:50.505327 2026] [:error] [pid 38241:tid 38254] [client 91.224.92.99:65032] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRf4vKRPk6YnJBxw_xbKQAAAMo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:53.502518 2026] [:error] [pid 38241:tid 38252] [client 91.224.92.99:65032] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRf5fKRPk6YnJBxw_xbLwAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:53.502577 2026] [:error] [pid 38241:tid 38252] [client 91.224.92.99:65032] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRf5fKRPk6YnJBxw_xbLwAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:55.006432 2026] [:error] [pid 38241:tid 38258] [client 91.224.92.99:53637] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRf5_KRPk6YnJBxw_xbNgAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:48:58.878223 2026] [:error] [pid 40750:tid 40775] [client 91.224.92.99:49870] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRf6gfBuk03yQKDyqur_wAAAdY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:49:00.228500 2026] [:error] [pid 40750:tid 40765] [client 91.224.92.99:49870] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRf7AfBuk03yQKDyqusBQAAAcw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:49:07.353627 2026] [:error] [pid 7133:tid 7144] [client 91.224.92.99:49882] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRf8_Ctubh8pR64qB9-XgAAAEk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:49:15.293461 2026] [:error] [pid 37032:tid 37050] [client 91.224.92.99:56614] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRf--u0U4o7eSImsVSXPAAAAZA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:49:16.280213 2026] [:error] [pid 37032:tid 37053] [client 91.224.92.99:56614] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRf_Ou0U4o7eSImsVSXPQAAAZM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:49:22.384609 2026] [:error] [pid 38034:tid 38047] [client 91.224.92.99:55099] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRgAgxtfZjwlJok9K81bwAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:49:44.885456 2026] [:error] [pid 7133:tid 7157] [client 91.224.92.99:64630] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgGPCtubh8pR64qB9-jQAAAFY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:49:44.885538 2026] [:error] [pid 7133:tid 7157] [client 91.224.92.99:64630] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgGPCtubh8pR64qB9-jQAAAFY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:49:57.379772 2026] [:error] [pid 41780:tid 41789] [client 91.224.92.99:59721] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRgJcONkVoocLIqzy05MgAAA8Y"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:50:01.447621 2026] [:error] [pid 7165:tid 7172] [client 91.224.92.99:61391] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgKRRjCrA8qWBjgG_NeQAAAkU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:50:01.447687 2026] [:error] [pid 7165:tid 7172] [client 91.224.92.99:61391] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgKRRjCrA8qWBjgG_NeQAAAkU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:50:24.504207 2026] [:error] [pid 7165:tid 7174] [client 91.224.92.99:60130] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgQBRjCrA8qWBjgG_NxwAAAkc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:50:26.920280 2026] [:error] [pid 7165:tid 7189] [client 91.224.92.99:60130] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgQhRjCrA8qWBjgG_NywAAAlY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:50:26.920406 2026] [:error] [pid 7165:tid 7189] [client 91.224.92.99:60130] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgQhRjCrA8qWBjgG_NywAAAlY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:50:35.991889 2026] [:error] [pid 7133:tid 7155] [client 91.224.92.99:54803] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRgS_Ctubh8pR64qB9-1gAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:50:40.061006 2026] [:error] [pid 38034:tid 38044] [client 91.224.92.99:59943] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgUAxtfZjwlJok9K81lQAAAQY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:50:40.942177 2026] [:error] [pid 38034:tid 38040] [client 91.224.92.99:59943] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRgUAxtfZjwlJok9K81lgAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:50:44.028314 2026] [:error] [pid 7165:tid 7177] [client 91.224.92.99:53176] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRgVBRjCrA8qWBjgG_OEAAAAko"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:50:46.420398 2026] [:error] [pid 40750:tid 40757] [client 91.224.92.99:63726] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgVgfBuk03yQKDyqus7AAAAcQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:50:46.420492 2026] [:error] [pid 40750:tid 40757] [client 91.224.92.99:63726] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgVgfBuk03yQKDyqus7AAAAcQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:50:49.390256 2026] [:error] [pid 40750:tid 40770] [client 91.224.92.99:59662] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgWQfBuk03yQKDyqus8gAAAdE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:50:51.203787 2026] [:error] [pid 40750:tid 40764] [client 91.224.92.99:59662] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgWwfBuk03yQKDyqus-QAAAcs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:50:52.114040 2026] [:error] [pid 40750:tid 40759] [client 91.224.92.99:59662] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgXAfBuk03yQKDyqutAAAAAcY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:50:53.029122 2026] [:error] [pid 40750:tid 40769] [client 91.224.92.99:59662] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRgXQfBuk03yQKDyqutBAAAAdA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:50:55.606662 2026] [:error] [pid 7133:tid 7154] [client 91.224.92.99:59350] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRgX_Ctubh8pR64qB9-_QAAAFM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:50:57.502092 2026] [:error] [pid 44644:tid 44670] [client 91.224.92.99:63117] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgYZ3RJaXMcw3y9V_uoQAAABc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:50:59.293104 2026] [:error] [pid 44644:tid 44658] [client 91.224.92.99:63117] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgY53RJaXMcw3y9V_upAAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:01.917926 2026] [:error] [pid 44644:tid 44662] [client 91.224.92.99:63117] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgZZ3RJaXMcw3y9V_uqAAAAA8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:02.806934 2026] [:error] [pid 44644:tid 44663] [client 91.224.92.99:63117] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgZp3RJaXMcw3y9V_uqQAAABA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:02.806997 2026] [:error] [pid 44644:tid 44663] [client 91.224.92.99:63117] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgZp3RJaXMcw3y9V_uqQAAABA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:06.365177 2026] [:error] [pid 44644:tid 44665] [client 91.224.92.99:57661] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRgap3RJaXMcw3y9V_uqwAAABI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:09.391718 2026] [:error] [pid 33822:tid 33838] [client 91.224.92.99:59344] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRgbW6W3ygu1YVssuZH0QAAAo4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:11.914661 2026] [:error] [pid 40750:tid 40757] [client 91.224.92.99:64583] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgbwfBuk03yQKDyqutSAAAAcQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:13.651560 2026] [:error] [pid 40750:tid 40764] [client 91.224.92.99:64583] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgcQfBuk03yQKDyqutVwAAAcs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:15.427739 2026] [:error] [pid 40750:tid 40776] [client 91.224.92.99:64583] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgcwfBuk03yQKDyqutZQAAAdc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:16.297933 2026] [:error] [pid 40750:tid 40767] [client 91.224.92.99:64583] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgdAfBuk03yQKDyqutcQAAAc4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:16.298026 2026] [:error] [pid 40750:tid 40767] [client 91.224.92.99:64583] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgdAfBuk03yQKDyqutcQAAAc4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:21.734146 2026] [:error] [pid 41342:tid 41362] [client 91.224.92.99:59267] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgeY4iJ6RAS5CatDlqBgAAAhE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:22.582939 2026] [:error] [pid 41342:tid 41358] [client 91.224.92.99:59267] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgeo4iJ6RAS5CatDlqBwAAAg0"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:22.583094 2026] [:error] [pid 41342:tid 41358] [client 91.224.92.99:59267] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgeo4iJ6RAS5CatDlqBwAAAg0"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:25.655995 2026] [:error] [pid 7165:tid 7168] [client 91.224.92.99:62303] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgfRRjCrA8qWBjgG_O2AAAAkE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:27.744082 2026] [:error] [pid 7165:tid 7169] [client 91.224.92.99:62303] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgfxRjCrA8qWBjgG_O5gAAAkI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:28.643766 2026] [:error] [pid 7165:tid 7182] [client 91.224.92.99:62303] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRggBRjCrA8qWBjgG_O7AAAAk8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:28.643829 2026] [:error] [pid 7165:tid 7182] [client 91.224.92.99:62303] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRggBRjCrA8qWBjgG_O7AAAAk8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:34.746479 2026] [:error] [pid 41342:tid 41366] [client 91.224.92.99:62306] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgho4iJ6RAS5CatDlqCwAAAhU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:38.988896 2026] [:error] [pid 41342:tid 41361] [client 91.224.92.99:62306] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgio4iJ6RAS5CatDlqDgAAAhA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:46.211555 2026] [:error] [pid 7133:tid 7138] [client 91.224.92.99:50388] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgkvCtubh8pR64qB9_XAAAAEM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:47.559827 2026] [:error] [pid 7133:tid 7143] [client 91.224.92.99:50388] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRgk_Ctubh8pR64qB9_XgAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:53.053745 2026] [:error] [pid 7133:tid 7147] [client 91.224.92.99:62675] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgmfCtubh8pR64qB9_dgAAAEw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:53.053834 2026] [:error] [pid 7133:tid 7147] [client 91.224.92.99:62675] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgmfCtubh8pR64qB9_dgAAAEw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:55.437605 2026] [:error] [pid 38241:tid 38250] [client 91.224.92.99:53667] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgm_KRPk6YnJBxw_xcWQAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:57.204054 2026] [:error] [pid 38241:tid 38257] [client 91.224.92.99:53667] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgnfKRPk6YnJBxw_xcXAAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:51:57.204147 2026] [:error] [pid 38241:tid 38257] [client 91.224.92.99:53667] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgnfKRPk6YnJBxw_xcXAAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:52:09.862226 2026] [:error] [pid 7133:tid 7147] [client 91.224.92.99:60655] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgqfCtubh8pR64qB9_owAAAEw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:52:09.862298 2026] [:error] [pid 7133:tid 7147] [client 91.224.92.99:60655] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgqfCtubh8pR64qB9_owAAAEw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:52:18.627621 2026] [:error] [pid 7165:tid 7172] [client 91.224.92.99:58929] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRgshRjCrA8qWBjgG_PgQAAAkU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:52:23.259523 2026] [:error] [pid 7165:tid 7188] [client 91.224.92.99:49978] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgtxRjCrA8qWBjgG_PnQAAAlU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:52:23.259606 2026] [:error] [pid 7165:tid 7188] [client 91.224.92.99:49978] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgtxRjCrA8qWBjgG_PnQAAAlU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:52:28.040794 2026] [:error] [pid 38034:tid 38057] [client 91.224.92.99:63276] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRgvAxtfZjwlJok9K82HgAAARM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:52:30.034329 2026] [:error] [pid 40750:tid 40763] [client 91.224.92.99:63259] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgvgfBuk03yQKDyquudAAAAco"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:52:30.034472 2026] [:error] [pid 40750:tid 40763] [client 91.224.92.99:63259] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgvgfBuk03yQKDyquudAAAAco"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:52:42.048827 2026] [:error] [pid 38241:tid 38260] [client 91.224.92.99:60597] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgyvKRPk6YnJBxw_xclgAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:52:42.048914 2026] [:error] [pid 38241:tid 38260] [client 91.224.92.99:60597] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRgyvKRPk6YnJBxw_xclgAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:03.340589 2026] [:error] [pid 7165:tid 7189] [client 91.224.92.99:53367] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRg3xRjCrA8qWBjgG_QDgAAAlY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:03.340681 2026] [:error] [pid 7165:tid 7189] [client 91.224.92.99:53367] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRg3xRjCrA8qWBjgG_QDgAAAlY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:08.970436 2026] [:error] [pid 7165:tid 7190] [client 91.224.92.99:56268] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRg5BRjCrA8qWBjgG_QIwAAAlc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:16.770100 2026] [:error] [pid 7165:tid 7170] [client 91.224.92.99:55977] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRg7BRjCrA8qWBjgG_QQgAAAkM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:19.538710 2026] [:error] [pid 38034:tid 38054] [client 91.224.92.99:56003] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRg7wxtfZjwlJok9K82XgAAARA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:19.538810 2026] [:error] [pid 38034:tid 38054] [client 91.224.92.99:56003] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRg7wxtfZjwlJok9K82XgAAARA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:27.594028 2026] [:error] [pid 38241:tid 38266] [client 91.224.92.99:57706] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRg9_KRPk6YnJBxw_xdIQAAANY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:28.508183 2026] [:error] [pid 38241:tid 38260] [client 91.224.92.99:57706] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRg-PKRPk6YnJBxw_xdJAAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:28.508282 2026] [:error] [pid 38241:tid 38260] [client 91.224.92.99:57706] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRg-PKRPk6YnJBxw_xdJAAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:32.007140 2026] [:error] [pid 37032:tid 37040] [client 91.224.92.99:57725] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRg_Ou0U4o7eSImsVSXjAAAAYY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:33.823849 2026] [:error] [pid 37032:tid 37043] [client 91.224.92.99:57725] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRg_eu0U4o7eSImsVSXjgAAAYk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:34.773543 2026] [:error] [pid 37032:tid 37045] [client 91.224.92.99:57725] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRg_uu0U4o7eSImsVSXjwAAAYs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:35.673914 2026] [:error] [pid 37032:tid 37047] [client 91.224.92.99:57725] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRg_-u0U4o7eSImsVSXkAAAAY0"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:37.049701 2026] [:error] [pid 40750:tid 40764] [client 91.224.92.99:62924] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRhAQfBuk03yQKDyquu-gAAAcs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:38.643518 2026] [:error] [pid 38241:tid 38268] [client 91.224.92.99:53160] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhAvKRPk6YnJBxw_xdLgAAANg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:39.533434 2026] [:error] [pid 38241:tid 38260] [client 91.224.92.99:53160] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRhA_KRPk6YnJBxw_xdNwAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:41.065721 2026] [:error] [pid 7165:tid 7187] [client 91.224.92.99:62131] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRhBRRjCrA8qWBjgG_QwgAAAlQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:45.358708 2026] [:error] [pid 38034:tid 38044] [client 91.224.92.99:57473] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhCQxtfZjwlJok9K82agAAAQY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:45.358744 2026] [:error] [pid 38034:tid 38044] [client 91.224.92.99:57473] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhCQxtfZjwlJok9K82agAAAQY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:50.536283 2026] [:error] [pid 37032:tid 37044] [client 91.224.92.99:56298] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhDuu0U4o7eSImsVSXkwAAAYo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:51.771235 2026] [:error] [pid 37032:tid 37036] [client 91.224.92.99:56298] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhD-u0U4o7eSImsVSXlAAAAYI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:53.472754 2026] [:error] [pid 37032:tid 37042] [client 91.224.92.99:56298] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhEeu0U4o7eSImsVSXlgAAAYg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:55.154042 2026] [:error] [pid 37032:tid 37052] [client 91.224.92.99:56298] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhE-u0U4o7eSImsVSXmwAAAZI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:55.154105 2026] [:error] [pid 37032:tid 37052] [client 91.224.92.99:56298] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhE-u0U4o7eSImsVSXmwAAAZI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:56.598623 2026] [:error] [pid 33822:tid 33830] [client 91.224.92.99:49338] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhFG6W3ygu1YVssuZIhwAAAoY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:53:58.345045 2026] [:error] [pid 33822:tid 33833] [client 91.224.92.99:49338] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhFm6W3ygu1YVssuZIiwAAAok"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:00.130727 2026] [:error] [pid 33822:tid 33848] [client 91.224.92.99:49338] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhGG6W3ygu1YVssuZIjQAAApg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:01.010238 2026] [:error] [pid 33822:tid 33846] [client 91.224.92.99:49338] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhGW6W3ygu1YVssuZIjgAAApY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:01.845931 2026] [:error] [pid 33822:tid 33847] [client 91.224.92.99:49338] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRhGW6W3ygu1YVssuZIjwAAApc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:03.361890 2026] [:error] [pid 44644:tid 44659] [client 91.224.92.99:63610] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRhG53RJaXMcw3y9V_u9AAAAAw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:04.872499 2026] [:error] [pid 38241:tid 38244] [client 91.224.92.99:63679] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhHPKRPk6YnJBxw_xdagAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:04.872581 2026] [:error] [pid 38241:tid 38244] [client 91.224.92.99:63679] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhHPKRPk6YnJBxw_xdagAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:09.734608 2026] [:error] [pid 7165:tid 7176] [client 91.224.92.99:63135] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRhIRRjCrA8qWBjgG_RlAAAAkk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:11.671406 2026] [:error] [pid 40750:tid 40768] [client 91.224.92.99:61989] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRhIwfBuk03yQKDyquv1gAAAc8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:13.610843 2026] [:error] [pid 38241:tid 38261] [client 91.224.92.99:59249] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhJfKRPk6YnJBxw_xddgAAANE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:13.610968 2026] [:error] [pid 38241:tid 38261] [client 91.224.92.99:59249] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhJfKRPk6YnJBxw_xddgAAANE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:23.492424 2026] [:error] [pid 37032:tid 37039] [client 91.224.92.99:51094] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRhL-u0U4o7eSImsVSXqAAAAYU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:29.693340 2026] [:error] [pid 33822:tid 33845] [client 91.224.92.99:62992] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhNW6W3ygu1YVssuZIvQAAApU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:30.666231 2026] [:error] [pid 33822:tid 33837] [client 91.224.92.99:62992] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRhNm6W3ygu1YVssuZIvwAAAo0"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:32.131824 2026] [:error] [pid 38241:tid 38266] [client 91.224.92.99:55665] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRhOPKRPk6YnJBxw_xdhwAAANY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:35.042700 2026] [:error] [pid 7133:tid 7146] [client 91.224.92.99:55665] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhO_Ctubh8pR64qB-ASQAAAEs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:36.841355 2026] [:error] [pid 7133:tid 7141] [client 91.224.92.99:55665] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhPPCtubh8pR64qB-AUwAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:41.478279 2026] [:error] [pid 7133:tid 7149] [client 91.224.92.99:55665] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhQfCtubh8pR64qB-AWwAAAE4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:43.846805 2026] [:error] [pid 7133:tid 7138] [client 91.224.92.99:55665] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhQ_Ctubh8pR64qB-AYAAAAEM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:45.209295 2026] [:error] [pid 7133:tid 7157] [client 91.224.92.99:55665] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRhRfCtubh8pR64qB-AYgAAAFY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:52.565657 2026] [:error] [pid 7165:tid 7191] [client 91.224.92.99:55665] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRhTBRjCrA8qWBjgG_R8wAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:57.492386 2026] [:error] [pid 37032:tid 37034] [client 91.224.92.99:51509] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhUeu0U4o7eSImsVSYHgAAAYA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:54:57.492480 2026] [:error] [pid 37032:tid 37034] [client 91.224.92.99:51509] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhUeu0U4o7eSImsVSYHgAAAYA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:00.481651 2026] [:error] [pid 7165:tid 7180] [client 91.224.92.99:51726] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhVBRjCrA8qWBjgG_R-AAAAk0"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:02.825961 2026] [:error] [pid 7165:tid 7168] [client 91.224.92.99:51726] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhVhRjCrA8qWBjgG_R_AAAAkE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:04.932035 2026] [:error] [pid 7165:tid 7183] [client 91.224.92.99:51726] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhWBRjCrA8qWBjgG_R_QAAAlA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:04.932123 2026] [:error] [pid 7165:tid 7183] [client 91.224.92.99:51726] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhWBRjCrA8qWBjgG_R_QAAAlA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:11.113554 2026] [:error] [pid 40750:tid 40753] [client 91.224.92.99:60922] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhXwfBuk03yQKDyquwUgAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:12.470906 2026] [:error] [pid 40750:tid 40760] [client 91.224.92.99:60922] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhYAfBuk03yQKDyquwVQAAAcc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:12.471009 2026] [:error] [pid 40750:tid 40760] [client 91.224.92.99:60922] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhYAfBuk03yQKDyquwVQAAAcc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:14.966788 2026] [:error] [pid 40750:tid 40760] [client 91.224.92.99:55675] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhYgfBuk03yQKDyquwZgAAAcc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:17.196756 2026] [:error] [pid 40750:tid 40754] [client 91.224.92.99:55675] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhZQfBuk03yQKDyquwbgAAAcE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:18.102355 2026] [:error] [pid 40750:tid 40774] [client 91.224.92.99:55675] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhZgfBuk03yQKDyquwcQAAAdU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:18.102441 2026] [:error] [pid 40750:tid 40774] [client 91.224.92.99:55675] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhZgfBuk03yQKDyquwcQAAAdU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:20.657966 2026] [:error] [pid 40750:tid 40756] [client 91.224.92.99:55675] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRhaAfBuk03yQKDyquwegAAAcM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:26.097878 2026] [:error] [pid 7133:tid 7159] [client 91.224.92.99:55675] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRhbvCtubh8pR64qB-AmgAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:35.224086 2026] [:error] [pid 40750:tid 40766] [client 91.224.92.99:51196] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhdwfBuk03yQKDyquwkgAAAc0"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:38.410107 2026] [:error] [pid 40750:tid 40756] [client 91.224.92.99:51196] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhegfBuk03yQKDyquwnwAAAcM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:41.059486 2026] [:error] [pid 40750:tid 40753] [client 91.224.92.99:51196] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhfQfBuk03yQKDyquwrgAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:42.370931 2026] [:error] [pid 40750:tid 40769] [client 91.224.92.99:51196] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhfgfBuk03yQKDyquwswAAAdA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:42.370996 2026] [:error] [pid 40750:tid 40769] [client 91.224.92.99:51196] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhfgfBuk03yQKDyquwswAAAdA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:45.574600 2026] [:error] [pid 7165:tid 7188] [client 91.224.92.99:49514] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhgRRjCrA8qWBjgG_SdgAAAlU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:48.552191 2026] [:error] [pid 7165:tid 7168] [client 91.224.92.99:49514] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhhBRjCrA8qWBjgG_SkgAAAkE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:49.425056 2026] [:error] [pid 7165:tid 7171] [client 91.224.92.99:49514] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhhRRjCrA8qWBjgG_SmAAAAkQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:49.425117 2026] [:error] [pid 7165:tid 7171] [client 91.224.92.99:49514] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhhRRjCrA8qWBjgG_SmAAAAkQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:56.427873 2026] [:error] [pid 38241:tid 38255] [client 91.224.92.99:59898] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhjPKRPk6YnJBxw_xeDQAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:57.784519 2026] [:error] [pid 38241:tid 38265] [client 91.224.92.99:59898] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhjfKRPk6YnJBxw_xeFQAAANU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:55:57.784587 2026] [:error] [pid 38241:tid 38265] [client 91.224.92.99:59898] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhjfKRPk6YnJBxw_xeFQAAANU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:02.113600 2026] [:error] [pid 38241:tid 38255] [client 91.224.92.99:51172] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhkvKRPk6YnJBxw_xeHQAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:03.888998 2026] [:error] [pid 38241:tid 38261] [client 91.224.92.99:51172] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhk_KRPk6YnJBxw_xeJQAAANE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:06.413815 2026] [:error] [pid 38241:tid 38246] [client 91.224.92.99:51172] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhlvKRPk6YnJBxw_xeKQAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:06.413920 2026] [:error] [pid 38241:tid 38246] [client 91.224.92.99:51172] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhlvKRPk6YnJBxw_xeKQAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:09.720918 2026] [:error] [pid 38034:tid 38037] [client 91.224.92.99:50111] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhmQxtfZjwlJok9K83KwAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:13.244326 2026] [:error] [pid 38034:tid 38044] [client 91.224.92.99:50111] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhnQxtfZjwlJok9K83MgAAAQY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:14.099286 2026] [:error] [pid 38034:tid 38053] [client 91.224.92.99:50111] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhngxtfZjwlJok9K83MwAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:14.099364 2026] [:error] [pid 38034:tid 38053] [client 91.224.92.99:50111] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 22"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhngxtfZjwlJok9K83MwAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:18.451743 2026] [:error] [pid 41780:tid 41792] [client 91.224.92.99:54631] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRhosONkVoocLIqzy05xQAAA8k"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:22.254355 2026] [:error] [pid 40750:tid 40770] [client 91.224.92.99:61180] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRhpgfBuk03yQKDyquxHAAAAdE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:23.699312 2026] [:error] [pid 7165:tid 7180] [client 91.224.92.99:56989] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhpxRjCrA8qWBjgG_TAQAAAk0"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:25.452646 2026] [:error] [pid 7165:tid 7178] [client 91.224.92.99:56989] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhqRRjCrA8qWBjgG_TCwAAAks"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:27.213355 2026] [:error] [pid 7165:tid 7179] [client 91.224.92.99:56989] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhqxRjCrA8qWBjgG_TFgAAAkw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:28.079664 2026] [:error] [pid 7165:tid 7183] [client 91.224.92.99:56989] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhrBRjCrA8qWBjgG_THgAAAlA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:29.865076 2026] [:error] [pid 7165:tid 7173] [client 91.224.92.99:56989] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhrRRjCrA8qWBjgG_TKQAAAkY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:31.620042 2026] [:error] [pid 7165:tid 7187] [client 91.224.92.99:56989] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhrxRjCrA8qWBjgG_TMwAAAlQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:32.510754 2026] [:error] [pid 7165:tid 7173] [client 91.224.92.99:56989] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhsBRjCrA8qWBjgG_TOwAAAkY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:32.510833 2026] [:error] [pid 7165:tid 7173] [client 91.224.92.99:56989] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhsBRjCrA8qWBjgG_TOwAAAkY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:34.690539 2026] [:error] [pid 40750:tid 40762] [client 91.224.92.99:51943] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRhsgfBuk03yQKDyquxOAAAAck"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:36.428249 2026] [:error] [pid 40750:tid 40766] [client 91.224.92.99:64213] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRhtAfBuk03yQKDyquxQQAAAc0"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:41.097944 2026] [:error] [pid 38034:tid 38048] [client 91.224.92.99:57838] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhuQxtfZjwlJok9K83SgAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:41.098009 2026] [:error] [pid 38034:tid 38048] [client 91.224.92.99:57838] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 19"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhuQxtfZjwlJok9K83SgAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:46.379538 2026] [:error] [pid 37032:tid 37051] [client 91.224.92.99:60929] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhvuu0U4o7eSImsVSYcwAAAZE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:47.690843 2026] [:error] [pid 37032:tid 37039] [client 91.224.92.99:60929] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhv-u0U4o7eSImsVSYdAAAAYU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:56:47.690924 2026] [:error] [pid 37032:tid 37039] [client 91.224.92.99:60929] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRhv-u0U4o7eSImsVSYdAAAAYU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:57:04.033940 2026] [:error] [pid 7165:tid 7175] [client 91.224.92.99:64052] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRh0BRjCrA8qWBjgG_T8gAAAkg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:57:10.300933 2026] [:error] [pid 44644:tid 44664] [client 91.224.92.99:62531] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRh1p3RJaXMcw3y9V_vhQAAABE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:57:10.301000 2026] [:error] [pid 44644:tid 44664] [client 91.224.92.99:62531] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRh1p3RJaXMcw3y9V_vhQAAABE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:57:15.202334 2026] [:error] [pid 38241:tid 38252] [client 91.224.92.99:62537] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRh2_KRPk6YnJBxw_xejgAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:57:17.675281 2026] [:error] [pid 7165:tid 7189] [client 91.224.92.99:52864] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRh3RRjCrA8qWBjgG_UtAAAAlY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:57:22.448355 2026] [:error] [pid 7133:tid 7135] [client 91.224.92.99:52464] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRh4vCtubh8pR64qB-BfQAAAEA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:57:22.448466 2026] [:error] [pid 7133:tid 7135] [client 91.224.92.99:52464] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRh4vCtubh8pR64qB-BfQAAAEA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:57:24.490165 2026] [:error] [pid 7165:tid 7171] [client 91.224.92.99:50735] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 19"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRh5BRjCrA8qWBjgG_VCwAAAkQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:57:28.326710 2026] [:error] [pid 44644:tid 44658] [client 91.224.92.99:60475] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 19"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRh6J3RJaXMcw3y9V_viwAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:57:29.798694 2026] [:error] [pid 38241:tid 38247] [client 91.224.92.99:55254] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRh6fKRPk6YnJBxw_xetAAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:57:29.798750 2026] [:error] [pid 38241:tid 38247] [client 91.224.92.99:55254] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRh6fKRPk6YnJBxw_xetAAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:57:37.971539 2026] [:error] [pid 7165:tid 7172] [client 91.224.92.99:49700] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRh8RRjCrA8qWBjgG_VYgAAAkU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:57:42.508152 2026] [:error] [pid 40750:tid 40753] [client 91.224.92.99:65003] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRh9gfBuk03yQKDyquyCQAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:57:48.947670 2026] [:error] [pid 7133:tid 7153] [client 91.224.92.99:60131] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRh_PCtubh8pR64qB-BoQAAAFI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:57:48.947760 2026] [:error] [pid 7133:tid 7153] [client 91.224.92.99:60131] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRh_PCtubh8pR64qB-BoQAAAFI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:57:58.774563 2026] [:error] [pid 33822:tid 33843] [client 91.224.92.99:59546] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiBm6W3ygu1YVssuZJywAAApM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:58:03.018519 2026] [:error] [pid 33822:tid 33827] [client 91.224.92.99:59546] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiC26W3ygu1YVssuZJ0AAAAoM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:58:05.929027 2026] [:error] [pid 33822:tid 33826] [client 91.224.92.99:59546] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiDW6W3ygu1YVssuZJ0QAAAoI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:58:05.929096 2026] [:error] [pid 33822:tid 33826] [client 91.224.92.99:59546] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiDW6W3ygu1YVssuZJ0QAAAoI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:58:09.511801 2026] [:error] [pid 7133:tid 7139] [client 91.224.92.99:59546] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRiEfCtubh8pR64qB-BrAAAAEQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:58:16.562313 2026] [:error] [pid 7133:tid 7156] [client 91.224.92.99:49968] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiGPCtubh8pR64qB-BsQAAAFU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:58:16.562370 2026] [:error] [pid 7133:tid 7156] [client 91.224.92.99:49968] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiGPCtubh8pR64qB-BsQAAAFU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:58:18.040192 2026] [:error] [pid 40750:tid 40774] [client 91.224.92.99:53068] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRiGgfBuk03yQKDyquyHgAAAdU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:58:22.790356 2026] [:error] [pid 40750:tid 40771] [client 91.224.92.99:60937] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiHgfBuk03yQKDyquyIgAAAdI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:58:27.879090 2026] [:error] [pid 40750:tid 40769] [client 91.224.92.99:60937] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiIwfBuk03yQKDyquyLwAAAdA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:58:30.878466 2026] [:error] [pid 40750:tid 40754] [client 91.224.92.99:60937] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiJgfBuk03yQKDyquyNwAAAcE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:58:32.151746 2026] [:error] [pid 40750:tid 40768] [client 91.224.92.99:60937] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiKAfBuk03yQKDyquyPQAAAc8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:58:32.151849 2026] [:error] [pid 40750:tid 40768] [client 91.224.92.99:60937] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiKAfBuk03yQKDyquyPQAAAc8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:58:38.220027 2026] [:error] [pid 40750:tid 40768] [client 91.224.92.99:60937] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiLgfBuk03yQKDyquyXAAAAc8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:58:42.822451 2026] [:error] [pid 40750:tid 40770] [client 91.224.92.99:60937] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiMgfBuk03yQKDyquyYgAAAdE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:58:44.092941 2026] [:error] [pid 40750:tid 40753] [client 91.224.92.99:60937] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiNAfBuk03yQKDyquyZAAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:58:44.093028 2026] [:error] [pid 40750:tid 40753] [client 91.224.92.99:60937] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiNAfBuk03yQKDyquyZAAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:58:45.443398 2026] [:error] [pid 38241:tid 38254] [client 91.224.92.99:49469] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRiNfKRPk6YnJBxw_xfKQAAAMo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:58:49.462948 2026] [:error] [pid 33822:tid 33836] [client 91.224.92.99:54091] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiOW6W3ygu1YVssuZKMAAAAow"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:58:50.302765 2026] [:error] [pid 33822:tid 33827] [client 91.224.92.99:54091] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRiOm6W3ygu1YVssuZKMgAAAoM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:58:55.855297 2026] [:error] [pid 7133:tid 7142] [client 91.224.92.99:63121] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRiP_Ctubh8pR64qB-B1QAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:59:02.272222 2026] [:error] [pid 7133:tid 7156] [client 91.224.92.99:55663] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiRvCtubh8pR64qB-B4wAAAFU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:59:05.149523 2026] [:error] [pid 7133:tid 7144] [client 91.224.92.99:55663] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiSfCtubh8pR64qB-B5QAAAEk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:59:07.153932 2026] [:error] [pid 7133:tid 7139] [client 91.224.92.99:55663] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiS_Ctubh8pR64qB-B5wAAAEQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:59:08.730962 2026] [:error] [pid 7133:tid 7135] [client 91.224.92.99:55663] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiTPCtubh8pR64qB-B6AAAAEA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:59:10.446209 2026] [:error] [pid 7133:tid 7158] [client 91.224.92.99:55663] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiTvCtubh8pR64qB-B6gAAAFc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:59:10.446318 2026] [:error] [pid 7133:tid 7158] [client 91.224.92.99:55663] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiTvCtubh8pR64qB-B6gAAAFc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:59:11.901694 2026] [:error] [pid 38034:tid 38061] [client 91.224.92.99:50995] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRiTwxtfZjwlJok9K831QAAARc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:59:16.869828 2026] [:error] [pid 40750:tid 40769] [client 91.224.92.99:62051] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiVAfBuk03yQKDyquyjwAAAdA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:59:16.869892 2026] [:error] [pid 40750:tid 40769] [client 91.224.92.99:62051] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 19"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiVAfBuk03yQKDyquyjwAAAdA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:59:19.784597 2026] [:error] [pid 37032:tid 37036] [client 91.224.92.99:50381] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRiV-u0U4o7eSImsVSYvAAAAYI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:59:26.587588 2026] [:error] [pid 40750:tid 40764] [client 91.224.92.99:61131] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRiXgfBuk03yQKDyquyoQAAAcs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:59:29.320738 2026] [:error] [pid 7133:tid 7150] [client 91.224.92.99:61719] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiYfCtubh8pR64qB-CAAAAAE8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:59:32.602956 2026] [:error] [pid 7133:tid 7146] [client 91.224.92.99:61719] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRiZPCtubh8pR64qB-CAQAAAEs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:59:36.744577 2026] [:error] [pid 40750:tid 40759] [client 91.224.92.99:50002] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRiaAfBuk03yQKDyquyvQAAAcY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:59:57.340407 2026] [:error] [pid 7165:tid 7179] [client 91.224.92.99:53784] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRifRRjCrA8qWBjgG_WqQAAAkw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 01 23:59:57.340499 2026] [:error] [pid 7165:tid 7179] [client 91.224.92.99:53784] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRifRRjCrA8qWBjgG_WqQAAAkw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:00:00.089633 2026] [:error] [pid 40750:tid 40757] [client 91.224.92.99:54373] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRigAfBuk03yQKDyquy-AAAAcQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:00:05.357681 2026] [:error] [pid 7165:tid 7171] [client 91.224.92.99:60784] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRihRRjCrA8qWBjgG_WrwAAAkQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:00:08.761873 2026] [:error] [pid 7165:tid 7170] [client 91.224.92.99:52560] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiiBRjCrA8qWBjgG_WuAAAAkM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:00:10.708164 2026] [:error] [pid 7165:tid 7177] [client 91.224.92.99:52560] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiihRjCrA8qWBjgG_WxgAAAko"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:00:14.147679 2026] [:error] [pid 7165:tid 7168] [client 91.224.92.99:52560] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRijhRjCrA8qWBjgG_W0AAAAkE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:00:29.545043 2026] [:error] [pid 7165:tid 7184] [client 91.224.92.99:53539] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRinRRjCrA8qWBjgG_XAQAAAlE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:00:29.545060 2026] [:error] [pid 7165:tid 7184] [client 91.224.92.99:53539] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRinRRjCrA8qWBjgG_XAQAAAlE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:00:35.184288 2026] [:error] [pid 7133:tid 7150] [client 91.224.92.99:65315] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRio_Ctubh8pR64qB-CTQAAAE8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:00:37.583938 2026] [:error] [pid 7165:tid 7182] [client 91.224.92.99:52768] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRipRRjCrA8qWBjgG_XHAAAAk8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:00:40.824717 2026] [:error] [pid 7133:tid 7143] [client 91.224.92.99:64487] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiqPCtubh8pR64qB-CUAAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:00:40.824809 2026] [:error] [pid 7133:tid 7143] [client 91.224.92.99:64487] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 21"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRiqPCtubh8pR64qB-CUAAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:00:46.870604 2026] [:error] [pid 38241:tid 38254] [client 91.224.92.99:51217] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 19"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRirvKRPk6YnJBxw_xgAgAAAMo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:00:49.509798 2026] [:error] [pid 38034:tid 38061] [client 91.224.92.99:51562] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 19"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRisQxtfZjwlJok9K83_gAAARc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:00:54.399445 2026] [:error] [pid 40750:tid 40767] [client 91.224.92.99:50951] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRitgfBuk03yQKDyquzfAAAAc4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:00:54.399525 2026] [:error] [pid 40750:tid 40767] [client 91.224.92.99:50951] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRitgfBuk03yQKDyquzfAAAAc4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:01:02.088558 2026] [:error] [pid 38241:tid 38268] [client 91.224.92.99:59261] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRivvKRPk6YnJBxw_xgFQAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:01:03.563537 2026] [:error] [pid 7165:tid 7167] [client 91.224.92.99:52685] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRivxRjCrA8qWBjgG_XcgAAAkA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:01:08.375922 2026] [:error] [pid 37032:tid 37040] [client 91.224.92.99:60396] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRixOu0U4o7eSImsVSY3wAAAYY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:01:18.917780 2026] [:error] [pid 44644:tid 44665] [client 91.224.92.99:61398] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRizp3RJaXMcw3y9V_v3QAAABI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:01:23.784618 2026] [:error] [pid 44644:tid 44666] [client 91.224.92.99:61398] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRi053RJaXMcw3y9V_v5gAAABM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:01:24.986930 2026] [:error] [pid 44644:tid 44667] [client 91.224.92.99:61398] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRi1J3RJaXMcw3y9V_v6AAAABQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:01:27.187802 2026] [:error] [pid 44644:tid 44653] [client 91.224.92.99:61398] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRi153RJaXMcw3y9V_v6gAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:01:27.187876 2026] [:error] [pid 44644:tid 44653] [client 91.224.92.99:61398] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRi153RJaXMcw3y9V_v6gAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:01:28.599356 2026] [:error] [pid 7165:tid 7174] [client 91.224.92.99:61398] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRi2BRjCrA8qWBjgG_YGgAAAkc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:01:30.174203 2026] [:error] [pid 7165:tid 7187] [client 91.224.92.99:55087] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRi2hRjCrA8qWBjgG_YPgAAAlQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:01:30.174292 2026] [:error] [pid 7165:tid 7187] [client 91.224.92.99:55087] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 21"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRi2hRjCrA8qWBjgG_YPgAAAlQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:01:36.503503 2026] [:error] [pid 38241:tid 38265] [client 91.224.92.99:50705] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRi4PKRPk6YnJBxw_xgUwAAANU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:01:40.135801 2026] [:error] [pid 38241:tid 38261] [client 91.224.92.99:50705] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRi5PKRPk6YnJBxw_xgXQAAANE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:01:41.484966 2026] [:error] [pid 38241:tid 38263] [client 91.224.92.99:50705] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRi5fKRPk6YnJBxw_xgXwAAANM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:01:43.311835 2026] [:error] [pid 38241:tid 38268] [client 91.224.92.99:50705] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRi5_KRPk6YnJBxw_xgYgAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:01:45.499291 2026] [:error] [pid 38241:tid 38256] [client 91.224.92.99:50705] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRi6fKRPk6YnJBxw_xgZwAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:01:46.739808 2026] [:error] [pid 38241:tid 38248] [client 91.224.92.99:50705] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRi6vKRPk6YnJBxw_xgaQAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:01:46.739912 2026] [:error] [pid 38241:tid 38248] [client 91.224.92.99:50705] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRi6vKRPk6YnJBxw_xgaQAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:01:49.137698 2026] [:error] [pid 7133:tid 7145] [client 91.224.92.99:53812] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRi7fCtubh8pR64qB-CkQAAAEo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:02:02.345046 2026] [:error] [pid 33822:tid 33848] [client 91.224.92.99:54907] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRi-m6W3ygu1YVssuZKyAAAApg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:02:02.345148 2026] [:error] [pid 33822:tid 33848] [client 91.224.92.99:54907] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRi-m6W3ygu1YVssuZKyAAAApg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:02:12.322326 2026] [:error] [pid 7133:tid 7155] [client 91.224.92.99:49556] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjBPCtubh8pR64qB-C3AAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:02:12.322426 2026] [:error] [pid 7133:tid 7155] [client 91.224.92.99:49556] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjBPCtubh8pR64qB-C3AAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:02:23.501850 2026] [:error] [pid 38034:tid 38061] [client 91.224.92.99:55418] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjDwxtfZjwlJok9K84NgAAARc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:02:23.501944 2026] [:error] [pid 38034:tid 38061] [client 91.224.92.99:55418] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 24"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjDwxtfZjwlJok9K84NgAAARc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:02:26.778520 2026] [:error] [pid 7133:tid 7135] [client 91.224.92.99:62076] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRjEvCtubh8pR64qB-DAwAAAEA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:02:30.655444 2026] [:error] [pid 40750:tid 40762] [client 91.224.92.99:53378] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRjFgfBuk03yQKDyqu0aAAAAck"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:02:35.541672 2026] [:error] [pid 38034:tid 38036] [client 91.224.92.99:55047] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjGwxtfZjwlJok9K84OwAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:02:36.514606 2026] [:error] [pid 38034:tid 38037] [client 91.224.92.99:55047] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 19"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRjHAxtfZjwlJok9K84PQAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:02:43.681297 2026] [:error] [pid 33822:tid 33845] [client 91.224.92.99:50008] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjI26W3ygu1YVssuZK4wAAApU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:02:43.681374 2026] [:error] [pid 33822:tid 33845] [client 91.224.92.99:50008] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjI26W3ygu1YVssuZK4wAAApU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:02:51.382654 2026] [:error] [pid 7133:tid 7140] [client 91.224.92.99:54467] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjK_Ctubh8pR64qB-DHwAAAEU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:02:54.176074 2026] [:error] [pid 7133:tid 7145] [client 91.224.92.99:54467] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjLvCtubh8pR64qB-DIgAAAEo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:02:56.883099 2026] [:error] [pid 7133:tid 7159] [client 91.224.92.99:54467] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjMPCtubh8pR64qB-DJAAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:02:56.883178 2026] [:error] [pid 7133:tid 7159] [client 91.224.92.99:54467] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjMPCtubh8pR64qB-DJAAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:02:59.446060 2026] [:error] [pid 40750:tid 40753] [client 91.224.92.99:50967] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjMwfBuk03yQKDyqu0pwAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:03:01.517768 2026] [:error] [pid 40750:tid 40775] [client 91.224.92.99:50967] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjNQfBuk03yQKDyqu0qgAAAdY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:03:02.955996 2026] [:error] [pid 40750:tid 40755] [client 91.224.92.99:50967] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjNgfBuk03yQKDyqu0rwAAAcI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:03:04.869341 2026] [:error] [pid 40750:tid 40763] [client 91.224.92.99:50967] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjOAfBuk03yQKDyqu0vAAAAco"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:03:06.744213 2026] [:error] [pid 40750:tid 40770] [client 91.224.92.99:50967] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjOgfBuk03yQKDyqu0xAAAAdE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:03:08.679913 2026] [:error] [pid 40750:tid 40760] [client 91.224.92.99:50967] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjPAfBuk03yQKDyqu0xgAAAcc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:03:08.680103 2026] [:error] [pid 40750:tid 40760] [client 91.224.92.99:50967] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 23"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjPAfBuk03yQKDyqu0xgAAAcc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:03:11.583722 2026] [:error] [pid 40750:tid 40765] [client 91.224.92.99:61882] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjPwfBuk03yQKDyqu00gAAAcw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:03:16.820380 2026] [:error] [pid 40750:tid 40761] [client 91.224.92.99:61882] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjRAfBuk03yQKDyqu02gAAAcg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:03:18.529452 2026] [:error] [pid 40750:tid 40763] [client 91.224.92.99:61882] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjRgfBuk03yQKDyqu03AAAAco"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:03:28.307603 2026] [:error] [pid 44644:tid 44652] [client 91.224.92.99:62187] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 23"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRjUJ3RJaXMcw3y9V_wGgAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:03:40.577009 2026] [:error] [pid 40750:tid 40774] [client 91.224.92.99:58087] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjXAfBuk03yQKDyqu1BQAAAdU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:03:42.483011 2026] [:error] [pid 40750:tid 40767] [client 91.224.92.99:58087] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjXgfBuk03yQKDyqu1CQAAAc4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:03:53.898939 2026] [:error] [pid 40750:tid 40775] [client 91.224.92.99:55704] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjaQfBuk03yQKDyqu1FwAAAdY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:03:55.784084 2026] [:error] [pid 40750:tid 40753] [client 91.224.92.99:55704] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjawfBuk03yQKDyqu1IQAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:03:57.574065 2026] [:error] [pid 40750:tid 40756] [client 91.224.92.99:55704] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjbQfBuk03yQKDyqu1KQAAAcM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:03:57.574133 2026] [:error] [pid 40750:tid 40756] [client 91.224.92.99:55704] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjbQfBuk03yQKDyqu1KQAAAcM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:00.404481 2026] [:error] [pid 40750:tid 40759] [client 91.224.92.99:62189] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjcAfBuk03yQKDyqu1LgAAAcY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:00.404573 2026] [:error] [pid 40750:tid 40759] [client 91.224.92.99:62189] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjcAfBuk03yQKDyqu1LgAAAcY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:03.335774 2026] [:error] [pid 7165:tid 7181] [client 91.224.92.99:63325] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjcxRjCrA8qWBjgG_aGwAAAk4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:05.374724 2026] [:error] [pid 7165:tid 7190] [client 91.224.92.99:63325] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjdRRjCrA8qWBjgG_aHQAAAlc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:05.374824 2026] [:error] [pid 7165:tid 7190] [client 91.224.92.99:63325] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjdRRjCrA8qWBjgG_aHQAAAlc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:09.436802 2026] [:error] [pid 7133:tid 7149] [client 91.224.92.99:63674] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjefCtubh8pR64qB-DSwAAAE4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:11.638042 2026] [:error] [pid 7133:tid 7142] [client 91.224.92.99:63674] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRje_Ctubh8pR64qB-DUAAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:13.433354 2026] [:error] [pid 7133:tid 7152] [client 91.224.92.99:63674] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjffCtubh8pR64qB-DUQAAAFE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:14.351749 2026] [:error] [pid 7133:tid 7137] [client 91.224.92.99:63674] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRjfvCtubh8pR64qB-DUgAAAEI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:15.709745 2026] [:error] [pid 7165:tid 7186] [client 91.224.92.99:57989] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRjfxRjCrA8qWBjgG_aNgAAAlM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:17.147339 2026] [:error] [pid 40750:tid 40758] [client 91.224.92.99:59315] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjgQfBuk03yQKDyqu1lwAAAcU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:18.063824 2026] [:error] [pid 40750:tid 40760] [client 91.224.92.99:59315] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 19"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRjggfBuk03yQKDyqu1oQAAAcc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:19.510536 2026] [:error] [pid 40750:tid 40765] [client 91.224.92.99:55675] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 19"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRjgwfBuk03yQKDyqu1qQAAAcw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:20.931714 2026] [:error] [pid 7165:tid 7178] [client 91.224.92.99:59798] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjhBRjCrA8qWBjgG_aSgAAAks"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:20.931785 2026] [:error] [pid 7165:tid 7178] [client 91.224.92.99:59798] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 22"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjhBRjCrA8qWBjgG_aSgAAAks"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:23.416119 2026] [:error] [pid 7133:tid 7144] [client 91.224.92.99:60671] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjh_Ctubh8pR64qB-DVgAAAEk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:25.275886 2026] [:error] [pid 7133:tid 7156] [client 91.224.92.99:60671] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjifCtubh8pR64qB-DWgAAAFU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:27.515384 2026] [:error] [pid 7133:tid 7156] [client 91.224.92.99:60671] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRji_Ctubh8pR64qB-DXAAAAFU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:27.515481 2026] [:error] [pid 7133:tid 7156] [client 91.224.92.99:60671] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 25"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRji_Ctubh8pR64qB-DXAAAAFU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:30.084281 2026] [:error] [pid 44644:tid 44655] [client 91.224.92.99:56072] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjjp3RJaXMcw3y9V_wJAAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:32.438490 2026] [:error] [pid 44644:tid 44649] [client 91.224.92.99:56072] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjkJ3RJaXMcw3y9V_wKAAAAAI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:33.751551 2026] [:error] [pid 44644:tid 44662] [client 91.224.92.99:56072] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjkZ3RJaXMcw3y9V_wKQAAAA8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:34.734866 2026] [:error] [pid 44644:tid 44654] [client 91.224.92.99:56072] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRjkp3RJaXMcw3y9V_wKgAAAAc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:36.233030 2026] [:error] [pid 40750:tid 40764] [client 91.224.92.99:58359] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRjlAfBuk03yQKDyqu1xAAAAcs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:42.739116 2026] [:error] [pid 40750:tid 40774] [client 91.224.92.99:58361] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjmgfBuk03yQKDyqu12gAAAdU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:42.739192 2026] [:error] [pid 40750:tid 40774] [client 91.224.92.99:58361] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 26"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjmgfBuk03yQKDyqu12gAAAdU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:46.803606 2026] [:error] [pid 7165:tid 7175] [client 91.224.92.99:59744] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjnhRjCrA8qWBjgG_bAgAAAkg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:46.803721 2026] [:error] [pid 7165:tid 7175] [client 91.224.92.99:59744] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjnhRjCrA8qWBjgG_bAgAAAkg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:53.596665 2026] [:error] [pid 7133:tid 7154] [client 91.224.92.99:59744] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjpfCtubh8pR64qB-DfQAAAFM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:04:53.596741 2026] [:error] [pid 7133:tid 7154] [client 91.224.92.99:59744] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjpfCtubh8pR64qB-DfQAAAFM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:05:07.347712 2026] [:error] [pid 40750:tid 40766] [client 91.224.92.99:57500] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjswfBuk03yQKDyqu1_QAAAc0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:05:07.347816 2026] [:error] [pid 40750:tid 40766] [client 91.224.92.99:57500] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjswfBuk03yQKDyqu1_QAAAc0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:05:11.085721 2026] [:error] [pid 38241:tid 38253] [client 91.224.92.99:51977] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRjt_KRPk6YnJBxw_xiFgAAAMk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:05:13.111593 2026] [:error] [pid 7165:tid 7170] [client 91.224.92.99:63664] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRjuRRjCrA8qWBjgG_bYgAAAkM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:05:14.679518 2026] [:error] [pid 37032:tid 37046] [client 91.224.92.99:54522] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjuuu0U4o7eSImsVSZNQAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:05:14.679592 2026] [:error] [pid 37032:tid 37046] [client 91.224.92.99:54522] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjuuu0U4o7eSImsVSZNQAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:05:27.456798 2026] [:error] [pid 44644:tid 44655] [client 91.224.92.99:54615] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjx53RJaXMcw3y9V_wRgAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:05:27.456916 2026] [:error] [pid 44644:tid 44655] [client 91.224.92.99:54615] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRjx53RJaXMcw3y9V_wRgAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:05:31.295935 2026] [:error] [pid 7165:tid 7188] [client 91.224.92.99:54357] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 22"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRjyxRjCrA8qWBjgG_b1wAAAlU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:05:49.261592 2026] [:error] [pid 7165:tid 7182] [client 91.224.92.99:62298] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRj3RRjCrA8qWBjgG_b-gAAAk8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:05:49.261658 2026] [:error] [pid 7165:tid 7182] [client 91.224.92.99:62298] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRj3RRjCrA8qWBjgG_b-gAAAk8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:02.206641 2026] [:error] [pid 7165:tid 7186] [client 91.224.92.99:61904] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 22"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRj6hRjCrA8qWBjgG_cIwAAAlM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:17.114275 2026] [:error] [pid 7165:tid 7167] [client 91.224.92.99:62177] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRj-RRjCrA8qWBjgG_cSgAAAkA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:18.134881 2026] [:error] [pid 7165:tid 7191] [client 91.224.92.99:62177] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRj-hRjCrA8qWBjgG_cSwAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:20.087635 2026] [:error] [pid 38241:tid 38265] [client 91.224.92.99:65235] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRj_PKRPk6YnJBxw_xiYgAAANU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:24.187275 2026] [:error] [pid 7165:tid 7189] [client 91.224.92.99:49512] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkABRjCrA8qWBjgG_cWwAAAlY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:24.187345 2026] [:error] [pid 7165:tid 7189] [client 91.224.92.99:49512] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkABRjCrA8qWBjgG_cWwAAAlY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:30.890983 2026] [:error] [pid 44644:tid 44670] [client 91.224.92.99:50798] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkBp3RJaXMcw3y9V_wYAAAABc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:32.791864 2026] [:error] [pid 44644:tid 44655] [client 91.224.92.99:50798] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkCJ3RJaXMcw3y9V_wYgAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:33.655124 2026] [:error] [pid 44644:tid 44663] [client 91.224.92.99:50798] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkCZ3RJaXMcw3y9V_wYwAAABA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:34.557530 2026] [:error] [pid 44644:tid 44665] [client 91.224.92.99:50798] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRkCp3RJaXMcw3y9V_wZAAAABI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:35.909528 2026] [:error] [pid 7133:tid 7138] [client 91.224.92.99:58278] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRkC_Ctubh8pR64qB-DvgAAAEM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:41.058797 2026] [:error] [pid 7165:tid 7180] [client 91.224.92.99:58738] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkERRjCrA8qWBjgG_cjgAAAk0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:41.058914 2026] [:error] [pid 7165:tid 7180] [client 91.224.92.99:58738] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkERRjCrA8qWBjgG_cjgAAAk0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:42.447159 2026] [:error] [pid 7165:tid 7181] [client 91.224.92.99:58746] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRkEhRjCrA8qWBjgG_clgAAAk4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:43.797834 2026] [:error] [pid 7165:tid 7167] [client 91.224.92.99:60325] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRkExRjCrA8qWBjgG_cnAAAAkA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:45.126943 2026] [:error] [pid 38241:tid 38253] [client 91.224.92.99:56557] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkFfKRPk6YnJBxw_xidQAAAMk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:46.897992 2026] [:error] [pid 38241:tid 38258] [client 91.224.92.99:56557] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkFvKRPk6YnJBxw_xidwAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:48.675540 2026] [:error] [pid 38241:tid 38255] [client 91.224.92.99:56557] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkGPKRPk6YnJBxw_xiewAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:49.551367 2026] [:error] [pid 38241:tid 38262] [client 91.224.92.99:56557] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkGfKRPk6YnJBxw_xifwAAANI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:52.246924 2026] [:error] [pid 38241:tid 38260] [client 91.224.92.99:56557] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkHPKRPk6YnJBxw_xiggAAANA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:54.403384 2026] [:error] [pid 38241:tid 38258] [client 91.224.92.99:56557] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkHvKRPk6YnJBxw_xiiQAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:55.603379 2026] [:error] [pid 38241:tid 38250] [client 91.224.92.99:56557] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkH_KRPk6YnJBxw_xiiwAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:06:57.347982 2026] [:error] [pid 38241:tid 38246] [client 91.224.92.99:56557] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkIfKRPk6YnJBxw_xilwAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:07:04.972922 2026] [:error] [pid 41342:tid 41359] [client 91.224.92.99:51558] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkKI4iJ6RAS5CatDlrAQAAAg4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:07:07.115063 2026] [:error] [pid 41342:tid 41359] [client 91.224.92.99:51558] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkK44iJ6RAS5CatDlrAgAAAg4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:07:07.115142 2026] [:error] [pid 41342:tid 41359] [client 91.224.92.99:51558] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkK44iJ6RAS5CatDlrAgAAAg4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:07:14.675376 2026] [:error] [pid 7133:tid 7159] [client 91.224.92.99:61419] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRkMvCtubh8pR64qB-D7AAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:07:16.218240 2026] [:error] [pid 41342:tid 41345] [client 91.224.92.99:50168] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRkNI4iJ6RAS5CatDlrCAAAAgA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:07:20.406619 2026] [:error] [pid 7165:tid 7191] [client 91.224.92.99:50169] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkOBRjCrA8qWBjgG_dEAAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:07:20.406705 2026] [:error] [pid 7165:tid 7191] [client 91.224.92.99:50169] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkOBRjCrA8qWBjgG_dEAAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:07:25.353222 2026] [:error] [pid 7133:tid 7147] [client 91.224.92.99:54124] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkPfCtubh8pR64qB-D9QAAAEw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:07:27.664003 2026] [:error] [pid 7133:tid 7137] [client 91.224.92.99:54124] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkP_Ctubh8pR64qB-D-QAAAEI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:07:33.753742 2026] [:error] [pid 38241:tid 38262] [client 91.224.92.99:63857] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkRfKRPk6YnJBxw_xi6QAAANI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:07:33.753850 2026] [:error] [pid 38241:tid 38262] [client 91.224.92.99:63857] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkRfKRPk6YnJBxw_xi6QAAANI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:07:37.100423 2026] [:error] [pid 7165:tid 7170] [client 91.224.92.99:51423] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkSRRjCrA8qWBjgG_dhwAAAkM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:07:39.053841 2026] [:error] [pid 7165:tid 7177] [client 91.224.92.99:51423] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkSxRjCrA8qWBjgG_dlAAAAko"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:07:42.057929 2026] [:error] [pid 7165:tid 7189] [client 91.224.92.99:51423] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkThRjCrA8qWBjgG_dsAAAAlY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:07:43.557720 2026] [:error] [pid 7165:tid 7189] [client 91.224.92.99:51423] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRkTxRjCrA8qWBjgG_dvwAAAlY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:07:45.119876 2026] [:error] [pid 41342:tid 41359] [client 91.224.92.99:56769] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRkUY4iJ6RAS5CatDlrEQAAAg4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:07:49.929781 2026] [:error] [pid 37032:tid 37047] [client 91.224.92.99:56771] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkVeu0U4o7eSImsVSZfQAAAY0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:07:49.929862 2026] [:error] [pid 37032:tid 37047] [client 91.224.92.99:56771] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 25"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkVeu0U4o7eSImsVSZfQAAAY0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:07:53.460119 2026] [:error] [pid 7165:tid 7176] [client 91.224.92.99:54581] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 22"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRkWRRjCrA8qWBjgG_eBwAAAkk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:08:00.017202 2026] [:error] [pid 38034:tid 38043] [client 91.224.92.99:63643] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 22"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRkYAxtfZjwlJok9K85BQAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:08:03.119813 2026] [:error] [pid 38241:tid 38259] [client 91.224.92.99:62295] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkY_KRPk6YnJBxw_xjEwAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:08:04.104442 2026] [:error] [pid 38241:tid 38244] [client 91.224.92.99:62295] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 21"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRkZPKRPk6YnJBxw_xjFAAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:08:08.137289 2026] [:error] [pid 38241:tid 38255] [client 91.224.92.99:55107] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 21"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRkaPKRPk6YnJBxw_xjGAAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:08:21.905143 2026] [:error] [pid 7165:tid 7174] [client 91.224.92.99:57166] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkdRRjCrA8qWBjgG_eogAAAkc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:08:22.946746 2026] [:error] [pid 7165:tid 7191] [client 91.224.92.99:57166] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRkdhRjCrA8qWBjgG_epQAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:08:30.668818 2026] [:error] [pid 40750:tid 40762] [client 91.224.92.99:52414] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRkfgfBuk03yQKDyqu3qAAAAck"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:08:32.223722 2026] [:error] [pid 40750:tid 40759] [client 91.224.92.99:64525] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkgAfBuk03yQKDyqu3rwAAAcY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:08:34.243695 2026] [:error] [pid 40750:tid 40761] [client 91.224.92.99:64525] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkggfBuk03yQKDyqu3uQAAAcg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:08:37.198725 2026] [:error] [pid 40750:tid 40770] [client 91.224.92.99:64525] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkhQfBuk03yQKDyqu3xwAAAdE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:08:39.740214 2026] [:error] [pid 40750:tid 40777] [client 91.224.92.99:64525] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkhwfBuk03yQKDyqu30QAAAdg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:08:39.740270 2026] [:error] [pid 40750:tid 40777] [client 91.224.92.99:64525] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkhwfBuk03yQKDyqu30QAAAdg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:08:45.541461 2026] [:error] [pid 38241:tid 38266] [client 91.224.92.99:55310] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkjfKRPk6YnJBxw_xjUQAAANY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:08:47.754991 2026] [:error] [pid 38241:tid 38255] [client 91.224.92.99:55310] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkj_KRPk6YnJBxw_xjXAAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:08:49.820588 2026] [:error] [pid 38241:tid 38256] [client 91.224.92.99:55310] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkkfKRPk6YnJBxw_xjYwAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:08:49.820667 2026] [:error] [pid 38241:tid 38256] [client 91.224.92.99:55310] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkkfKRPk6YnJBxw_xjYwAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:08:51.385012 2026] [:error] [pid 41342:tid 41347] [client 91.224.92.99:63376] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 21"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRkk44iJ6RAS5CatDlrIAAAAgI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:08:53.320085 2026] [:error] [pid 7133:tid 7159] [client 91.224.92.99:62009] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 21"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRklfCtubh8pR64qB-ENgAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:08:55.798179 2026] [:error] [pid 40750:tid 40761] [client 91.224.92.99:62009] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRklwfBuk03yQKDyqu35gAAAcg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:08:57.891338 2026] [:error] [pid 40750:tid 40773] [client 91.224.92.99:62009] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRkmQfBuk03yQKDyqu39AAAAdQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:08:59.413360 2026] [:error] [pid 38034:tid 38058] [client 91.224.92.99:52449] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRkmwxtfZjwlJok9K85KAAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:00.828633 2026] [:error] [pid 38034:tid 38057] [client 91.224.92.99:53246] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRknAxtfZjwlJok9K85LQAAARM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:00.828694 2026] [:error] [pid 38034:tid 38057] [client 91.224.92.99:53246] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRknAxtfZjwlJok9K85LQAAARM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:02.650093 2026] [:error] [pid 7133:tid 7143] [client 91.224.92.99:53247] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRknvCtubh8pR64qB-ERgAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:11.437407 2026] [:error] [pid 7133:tid 7135] [client 91.224.92.99:58448] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkp_Ctubh8pR64qB-EWwAAAEA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:11.437502 2026] [:error] [pid 7133:tid 7135] [client 91.224.92.99:58448] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkp_Ctubh8pR64qB-EWwAAAEA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:13.791069 2026] [:error] [pid 7165:tid 7169] [client 91.224.92.99:64372] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkqRRjCrA8qWBjgG_fdQAAAkI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:16.460107 2026] [:error] [pid 7165:tid 7191] [client 91.224.92.99:64372] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkrBRjCrA8qWBjgG_feAAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:18.432218 2026] [:error] [pid 7165:tid 7186] [client 91.224.92.99:64372] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkrhRjCrA8qWBjgG_ffAAAAlM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:18.432290 2026] [:error] [pid 7165:tid 7186] [client 91.224.92.99:64372] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkrhRjCrA8qWBjgG_ffAAAAlM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:20.758765 2026] [:error] [pid 7165:tid 7186] [client 91.224.92.99:59332] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRksBRjCrA8qWBjgG_fjAAAAlM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:22.561494 2026] [:error] [pid 7165:tid 7184] [client 91.224.92.99:59332] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkshRjCrA8qWBjgG_fkAAAAlE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:23.517558 2026] [:error] [pid 7165:tid 7182] [client 91.224.92.99:59332] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRksxRjCrA8qWBjgG_fmAAAAk8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:25.292748 2026] [:error] [pid 7165:tid 7178] [client 91.224.92.99:59332] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRktRRjCrA8qWBjgG_fmwAAAks"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:27.678140 2026] [:error] [pid 7165:tid 7167] [client 91.224.92.99:59332] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRktxRjCrA8qWBjgG_foQAAAkA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:28.866386 2026] [:error] [pid 7165:tid 7184] [client 91.224.92.99:59332] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkuBRjCrA8qWBjgG_fowAAAlE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:30.682771 2026] [:error] [pid 7165:tid 7191] [client 91.224.92.99:59332] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkuhRjCrA8qWBjgG_fpgAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:32.442279 2026] [:error] [pid 7165:tid 7182] [client 91.224.92.99:59332] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkvBRjCrA8qWBjgG_fqAAAAk8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:33.323041 2026] [:error] [pid 7165:tid 7178] [client 91.224.92.99:59332] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkvRRjCrA8qWBjgG_fqQAAAks"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:34.199767 2026] [:error] [pid 7165:tid 7176] [client 91.224.92.99:59332] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRkvhRjCrA8qWBjgG_frQAAAkk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:48.905915 2026] [:error] [pid 41780:tid 41787] [client 91.224.92.99:56493] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkzMONkVoocLIqzy07MAAAA8Q"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:48.906015 2026] [:error] [pid 41780:tid 41787] [client 91.224.92.99:56493] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRkzMONkVoocLIqzy07MAAAA8Q"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:54.860610 2026] [:error] [pid 7165:tid 7175] [client 91.224.92.99:60420] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRk0hRjCrA8qWBjgG_f9wAAAkg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:55.772551 2026] [:error] [pid 7165:tid 7173] [client 91.224.92.99:60420] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRk0xRjCrA8qWBjgG_f-wAAAkY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:09:59.642376 2026] [:error] [pid 7165:tid 7185] [client 91.224.92.99:60420] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRk1xRjCrA8qWBjgG_gEQAAAlI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:10:04.425109 2026] [:error] [pid 7165:tid 7185] [client 91.224.92.99:60420] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRk3BRjCrA8qWBjgG_gJwAAAlI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:10:05.697498 2026] [:error] [pid 7165:tid 7175] [client 91.224.92.99:60420] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRk3RRjCrA8qWBjgG_gLQAAAkg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:10:05.697564 2026] [:error] [pid 7165:tid 7175] [client 91.224.92.99:60420] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRk3RRjCrA8qWBjgG_gLQAAAkg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:10:09.526108 2026] [:error] [pid 40750:tid 40755] [client 91.224.92.99:58532] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRk4QfBuk03yQKDyqu49QAAAcI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:10:20.719338 2026] [:error] [pid 7165:tid 7179] [client 91.224.92.99:63148] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRk7BRjCrA8qWBjgG_gUwAAAkw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:10:22.932454 2026] [:error] [pid 7165:tid 7188] [client 91.224.92.99:63148] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRk7hRjCrA8qWBjgG_gWAAAAlU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:10:42.265073 2026] [:error] [pid 38241:tid 38257] [client 91.224.92.99:49408] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlAvKRPk6YnJBxw_xkCwAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:10:44.221073 2026] [:error] [pid 38241:tid 38256] [client 91.224.92.99:49408] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlBPKRPk6YnJBxw_xkDQAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:10:49.980470 2026] [:error] [pid 38241:tid 38248] [client 91.224.92.99:49408] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlCfKRPk6YnJBxw_xkFgAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:10:51.627534 2026] [:error] [pid 38241:tid 38267] [client 91.224.92.99:49408] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlC_KRPk6YnJBxw_xkHAAAANc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:10:51.627593 2026] [:error] [pid 38241:tid 38267] [client 91.224.92.99:49408] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlC_KRPk6YnJBxw_xkHAAAANc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:10:59.028994 2026] [:error] [pid 33822:tid 33825] [client 91.224.92.99:63173] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlE26W3ygu1YVssuZM5AAAAoE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:11:05.557090 2026] [:error] [pid 7165:tid 7186] [client 91.224.92.99:50929] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlGRRjCrA8qWBjgG_g7gAAAlM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:11:05.557191 2026] [:error] [pid 7165:tid 7186] [client 91.224.92.99:50929] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlGRRjCrA8qWBjgG_g7gAAAlM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:11:08.039406 2026] [:error] [pid 7133:tid 7143] [client 91.224.92.99:50935] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRlHPCtubh8pR64qB-E_AAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:11:16.958567 2026] [:error] [pid 7133:tid 7151] [client 91.224.92.99:60637] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRlJPCtubh8pR64qB-FBgAAAFA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:11:26.194758 2026] [:error] [pid 40750:tid 40766] [client 91.224.92.99:52466] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlLgfBuk03yQKDyqu5UAAAAc0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:11:26.194855 2026] [:error] [pid 40750:tid 40766] [client 91.224.92.99:52466] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlLgfBuk03yQKDyqu5UAAAAc0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:11:32.814072 2026] [:error] [pid 33822:tid 33825] [client 91.224.92.99:55662] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlNG6W3ygu1YVssuZNAwAAAoE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:11:38.988565 2026] [:error] [pid 33822:tid 33848] [client 91.224.92.99:55662] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlOm6W3ygu1YVssuZNBQAAApg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:11:38.988644 2026] [:error] [pid 33822:tid 33848] [client 91.224.92.99:55662] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlOm6W3ygu1YVssuZNBQAAApg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:11:41.607987 2026] [:error] [pid 7165:tid 7176] [client 91.224.92.99:55662] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlPRRjCrA8qWBjgG_hNgAAAkk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:11:41.608039 2026] [:error] [pid 7165:tid 7176] [client 91.224.92.99:55662] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlPRRjCrA8qWBjgG_hNgAAAkk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:11:43.839069 2026] [:error] [pid 33822:tid 33846] [client 91.224.92.99:55662] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlP26W3ygu1YVssuZNCAAAApY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:11:45.572217 2026] [:error] [pid 33822:tid 33828] [client 91.224.92.99:55662] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlQW6W3ygu1YVssuZNCwAAAoQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:11:46.440358 2026] [:error] [pid 33822:tid 33847] [client 91.224.92.99:55662] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlQm6W3ygu1YVssuZNDAAAApc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:11:48.188598 2026] [:error] [pid 33822:tid 33840] [client 91.224.92.99:55662] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlRG6W3ygu1YVssuZNEAAAApA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:11:50.836266 2026] [:error] [pid 33822:tid 33829] [client 91.224.92.99:55662] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlRm6W3ygu1YVssuZNFAAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:11:51.723285 2026] [:error] [pid 33822:tid 33836] [client 91.224.92.99:55662] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlR26W3ygu1YVssuZNFQAAAow"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:11:51.723401 2026] [:error] [pid 33822:tid 33836] [client 91.224.92.99:55662] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlR26W3ygu1YVssuZNFQAAAow"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:11:55.835698 2026] [:error] [pid 7165:tid 7190] [client 91.224.92.99:50266] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlSxRjCrA8qWBjgG_hXAAAAlc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:11:58.733751 2026] [:error] [pid 7165:tid 7173] [client 91.224.92.99:50266] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlThRjCrA8qWBjgG_hYAAAAkY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:12:01.069913 2026] [:error] [pid 7165:tid 7182] [client 91.224.92.99:50266] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlURRjCrA8qWBjgG_hYwAAAk8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:12:03.340625 2026] [:error] [pid 7165:tid 7191] [client 91.224.92.99:50266] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlUxRjCrA8qWBjgG_haQAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:12:06.097092 2026] [:error] [pid 7165:tid 7189] [client 91.224.92.99:50266] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlVhRjCrA8qWBjgG_hcgAAAlY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:12:07.742649 2026] [:error] [pid 7165:tid 7167] [client 91.224.92.99:50266] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlVxRjCrA8qWBjgG_hdgAAAkA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:12:10.015970 2026] [:error] [pid 7165:tid 7179] [client 91.224.92.99:50266] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlWhRjCrA8qWBjgG_hfQAAAkw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:12:18.010133 2026] [:error] [pid 7133:tid 7143] [client 91.224.92.99:65520] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlYvCtubh8pR64qB-FQwAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:12:18.923269 2026] [:error] [pid 7133:tid 7150] [client 91.224.92.99:65520] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlYvCtubh8pR64qB-FRAAAAE8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:12:21.570689 2026] [:error] [pid 7133:tid 7140] [client 91.224.92.99:65520] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlZfCtubh8pR64qB-FSQAAAEU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:12:23.748811 2026] [:error] [pid 7133:tid 7156] [client 91.224.92.99:65520] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlZ_Ctubh8pR64qB-FTgAAAFU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:12:24.643691 2026] [:error] [pid 7133:tid 7141] [client 91.224.92.99:65520] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlaPCtubh8pR64qB-FUAAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:12:25.553001 2026] [:error] [pid 7133:tid 7159] [client 91.224.92.99:65520] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRlafCtubh8pR64qB-FUwAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:12:28.727545 2026] [:error] [pid 40750:tid 40768] [client 91.224.92.99:60225] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRlbAfBuk03yQKDyqu6AgAAAc8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:12:35.140410 2026] [:error] [pid 37032:tid 37042] [client 91.224.92.99:51703] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlc-u0U4o7eSImsVSaBQAAAYg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:12:37.436626 2026] [:error] [pid 37032:tid 37053] [client 91.224.92.99:51703] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRldeu0U4o7eSImsVSaBwAAAZM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:12:39.608031 2026] [:error] [pid 37032:tid 37056] [client 91.224.92.99:51703] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRld-u0U4o7eSImsVSaCQAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:12:41.571738 2026] [:error] [pid 37032:tid 37051] [client 91.224.92.99:51703] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRleeu0U4o7eSImsVSaCgAAAZE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:12:52.191834 2026] [:error] [pid 7165:tid 7176] [client 91.224.92.99:52453] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlhBRjCrA8qWBjgG_iIQAAAkk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:12:53.575293 2026] [:error] [pid 7165:tid 7168] [client 91.224.92.99:52453] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlhRRjCrA8qWBjgG_iJgAAAkE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:12:53.575364 2026] [:error] [pid 7165:tid 7168] [client 91.224.92.99:52453] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlhRRjCrA8qWBjgG_iJgAAAkE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:12:58.481538 2026] [:error] [pid 38241:tid 38257] [client 91.224.92.99:57898] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlivKRPk6YnJBxw_xk9AAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:13:07.314205 2026] [:error] [pid 38241:tid 38264] [client 91.224.92.99:50574] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlk_KRPk6YnJBxw_xlEgAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:13:14.529290 2026] [:error] [pid 7133:tid 7140] [client 91.224.92.99:62711] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlmvCtubh8pR64qB-FoAAAAEU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:13:15.423406 2026] [:error] [pid 7133:tid 7153] [client 91.224.92.99:62711] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRlm_Ctubh8pR64qB-FoQAAAFI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:13:20.886565 2026] [:error] [pid 7165:tid 7175] [client 91.224.92.99:58640] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRloBRjCrA8qWBjgG_iiQAAAkg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:13:31.750027 2026] [:error] [pid 33822:tid 33828] [client 91.224.92.99:64820] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlq26W3ygu1YVssuZNbAAAAoQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:13:31.750122 2026] [:error] [pid 33822:tid 33828] [client 91.224.92.99:64820] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlq26W3ygu1YVssuZNbAAAAoQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:13:39.840755 2026] [:error] [pid 38241:tid 38250] [client 91.224.92.99:58060] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRls_KRPk6YnJBxw_xlVgAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:13:43.594669 2026] [:error] [pid 38241:tid 38263] [client 91.224.92.99:58060] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlt_KRPk6YnJBxw_xldgAAANM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:13:46.565073 2026] [:error] [pid 38241:tid 38265] [client 91.224.92.99:58060] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRluvKRPk6YnJBxw_xlfgAAANU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:13:48.633861 2026] [:error] [pid 38241:tid 38253] [client 91.224.92.99:58060] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlvPKRPk6YnJBxw_xlgwAAAMk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:13:50.878905 2026] [:error] [pid 38241:tid 38263] [client 91.224.92.99:58060] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlvvKRPk6YnJBxw_xljwAAANM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:13:52.781911 2026] [:error] [pid 38241:tid 38262] [client 91.224.92.99:58060] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlwPKRPk6YnJBxw_xllQAAANI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:13:52.782002 2026] [:error] [pid 38241:tid 38262] [client 91.224.92.99:58060] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlwPKRPk6YnJBxw_xllQAAANI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:13:57.228303 2026] [:error] [pid 7165:tid 7174] [client 91.224.92.99:55811] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRlxRRjCrA8qWBjgG_jLQAAAkc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:13:58.782873 2026] [:error] [pid 40750:tid 40772] [client 91.224.92.99:55055] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRlxgfBuk03yQKDyqu7KAAAAdM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:14:00.822330 2026] [:error] [pid 38241:tid 38250] [client 91.224.92.99:64275] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlyPKRPk6YnJBxw_xlsQAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:14:00.822439 2026] [:error] [pid 38241:tid 38250] [client 91.224.92.99:64275] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRlyPKRPk6YnJBxw_xlsQAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:14:05.944328 2026] [:error] [pid 33822:tid 33839] [client 91.224.92.99:65003] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 19"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRlzW6W3ygu1YVssuZNmwAAAo8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:14:10.712105 2026] [:error] [pid 38241:tid 38246] [client 91.224.92.99:52146] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRl0vKRPk6YnJBxw_xl0wAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:14:10.712157 2026] [:error] [pid 38241:tid 38246] [client 91.224.92.99:52146] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRl0vKRPk6YnJBxw_xl0wAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:14:14.640351 2026] [:error] [pid 38241:tid 38255] [client 91.224.92.99:52832] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRl1vKRPk6YnJBxw_xl5wAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:14:15.532194 2026] [:error] [pid 38241:tid 38248] [client 91.224.92.99:52832] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRl1_KRPk6YnJBxw_xl6QAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:14:18.490942 2026] [:error] [pid 38241:tid 38256] [client 91.224.92.99:52832] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRl2vKRPk6YnJBxw_xl9QAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:14:21.178227 2026] [:error] [pid 38241:tid 38262] [client 91.224.92.99:52832] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRl3fKRPk6YnJBxw_xl_gAAANI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:14:22.529569 2026] [:error] [pid 38241:tid 38259] [client 91.224.92.99:52832] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRl3vKRPk6YnJBxw_xmAwAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:14:23.405153 2026] [:error] [pid 38241:tid 38251] [client 91.224.92.99:52832] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 19"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRl3_KRPk6YnJBxw_xmBQAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:14:26.785090 2026] [:error] [pid 38241:tid 38247] [client 91.224.92.99:52835] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 19"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRl4vKRPk6YnJBxw_xmCgAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:14:32.723205 2026] [:error] [pid 33822:tid 33839] [client 91.224.92.99:62259] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRl6G6W3ygu1YVssuZN1gAAAo8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:14:33.600628 2026] [:error] [pid 33822:tid 33827] [client 91.224.92.99:62259] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRl6W6W3ygu1YVssuZN1wAAAoM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:14:49.258352 2026] [:error] [pid 7165:tid 7179] [client 91.224.92.99:59209] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRl-RRjCrA8qWBjgG_kGgAAAkw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:14:49.258450 2026] [:error] [pid 7165:tid 7179] [client 91.224.92.99:59209] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRl-RRjCrA8qWBjgG_kGgAAAkw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:14:52.358327 2026] [:error] [pid 38034:tid 38060] [client 91.224.92.99:59209] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRl_AxtfZjwlJok9K86TQAAARY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:14:54.951851 2026] [:error] [pid 38241:tid 38245] [client 91.224.92.99:59211] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRl_vKRPk6YnJBxw_xmbwAAAME"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:15:08.114351 2026] [:error] [pid 33822:tid 33844] [client 91.224.92.99:58408] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmDG6W3ygu1YVssuZN9AAAApQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:15:09.124541 2026] [:error] [pid 33822:tid 33829] [client 91.224.92.99:58408] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRmDW6W3ygu1YVssuZN9QAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:15:16.351860 2026] [:error] [pid 7165:tid 7181] [client 91.224.92.99:59682] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRmFBRjCrA8qWBjgG_kXwAAAk4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:15:19.455016 2026] [:error] [pid 37032:tid 37048] [client 91.224.92.99:59687] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmF-u0U4o7eSImsVSaXAAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:15:22.958352 2026] [:error] [pid 37032:tid 37046] [client 91.224.92.99:59687] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmGuu0U4o7eSImsVSaYAAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:15:33.330690 2026] [:error] [pid 38034:tid 38043] [client 91.224.92.99:64264] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmJQxtfZjwlJok9K86ZQAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:15:34.261166 2026] [:error] [pid 38034:tid 38040] [client 91.224.92.99:64264] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmJgxtfZjwlJok9K86ZgAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:15:37.411190 2026] [:error] [pid 38034:tid 38051] [client 91.224.92.99:64264] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmKQxtfZjwlJok9K86bQAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:15:41.875503 2026] [:error] [pid 38034:tid 38060] [client 91.224.92.99:64264] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmLQxtfZjwlJok9K86bwAAARY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:15:42.788977 2026] [:error] [pid 38034:tid 38036] [client 91.224.92.99:64264] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmLgxtfZjwlJok9K86cAAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:15:44.639184 2026] [:error] [pid 38034:tid 38058] [client 91.224.92.99:64264] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmMAxtfZjwlJok9K86cgAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:15:46.504632 2026] [:error] [pid 38034:tid 38039] [client 91.224.92.99:64264] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmMgxtfZjwlJok9K86dAAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:15:48.862165 2026] [:error] [pid 38034:tid 38038] [client 91.224.92.99:64264] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmNAxtfZjwlJok9K86dQAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:15:51.522601 2026] [:error] [pid 38034:tid 38053] [client 91.224.92.99:64264] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRmNwxtfZjwlJok9K86dwAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:15:56.659006 2026] [:error] [pid 7165:tid 7181] [client 91.224.92.99:62584] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmPBRjCrA8qWBjgG_k9wAAAk4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:15:58.052243 2026] [:error] [pid 7165:tid 7187] [client 91.224.92.99:62584] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRmPhRjCrA8qWBjgG_k_AAAAlQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:00.625284 2026] [:error] [pid 38241:tid 38257] [client 91.224.92.99:49244] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRmQPKRPk6YnJBxw_xm5QAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:02.195635 2026] [:error] [pid 7165:tid 7183] [client 91.224.92.99:61383] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmQhRjCrA8qWBjgG_lEQAAAlA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:04.150512 2026] [:error] [pid 7165:tid 7184] [client 91.224.92.99:61383] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmRBRjCrA8qWBjgG_lIAAAAlE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:07.821108 2026] [:error] [pid 7165:tid 7187] [client 91.224.92.99:61383] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmRxRjCrA8qWBjgG_lQgAAAlQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:11.222905 2026] [:error] [pid 7165:tid 7174] [client 91.224.92.99:61383] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmSxRjCrA8qWBjgG_lUAAAAkc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:11.222977 2026] [:error] [pid 7165:tid 7174] [client 91.224.92.99:61383] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmSxRjCrA8qWBjgG_lUAAAAkc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:20.429617 2026] [:error] [pid 7165:tid 7168] [client 91.224.92.99:64915] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmVBRjCrA8qWBjgG_leAAAAkE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:21.362647 2026] [:error] [pid 7165:tid 7184] [client 91.224.92.99:64915] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmVRRjCrA8qWBjgG_lfAAAAlE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:21.362721 2026] [:error] [pid 7165:tid 7184] [client 91.224.92.99:64915] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmVRRjCrA8qWBjgG_lfAAAAlE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:26.241661 2026] [:error] [pid 7165:tid 7176] [client 91.224.92.99:55441] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmWhRjCrA8qWBjgG_ljAAAAkk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:27.530020 2026] [:error] [pid 7165:tid 7190] [client 91.224.92.99:55441] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmWxRjCrA8qWBjgG_llQAAAlc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:30.324895 2026] [:error] [pid 7165:tid 7184] [client 91.224.92.99:55441] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmXhRjCrA8qWBjgG_lngAAAlE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:32.230799 2026] [:error] [pid 7165:tid 7186] [client 91.224.92.99:55441] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmYBRjCrA8qWBjgG_lpAAAAlM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:35.909500 2026] [:error] [pid 7165:tid 7190] [client 91.224.92.99:55441] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmYxRjCrA8qWBjgG_luQAAAlc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:36.969838 2026] [:error] [pid 7165:tid 7173] [client 91.224.92.99:55441] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRmZBRjCrA8qWBjgG_lugAAAkY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:39.744348 2026] [:error] [pid 7133:tid 7148] [client 91.224.92.99:53593] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRmZ_Ctubh8pR64qB-HIgAAAE0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:41.698198 2026] [:error] [pid 40750:tid 40761] [client 91.224.92.99:57043] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmaQfBuk03yQKDyqu8lgAAAcg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:41.698265 2026] [:error] [pid 40750:tid 40761] [client 91.224.92.99:57043] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmaQfBuk03yQKDyqu8lgAAAcg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:46.299066 2026] [:error] [pid 38034:tid 38059] [client 91.224.92.99:59736] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmbgxtfZjwlJok9K86tAAAARU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:47.185346 2026] [:error] [pid 38034:tid 38054] [client 91.224.92.99:59736] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmbwxtfZjwlJok9K86uAAAARA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:49.023306 2026] [:error] [pid 38034:tid 38062] [client 91.224.92.99:59736] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmcQxtfZjwlJok9K86ugAAARg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:51.186024 2026] [:error] [pid 38034:tid 38056] [client 91.224.92.99:59736] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmcwxtfZjwlJok9K86vwAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:51.186119 2026] [:error] [pid 38034:tid 38056] [client 91.224.92.99:59736] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmcwxtfZjwlJok9K86vwAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:57.371056 2026] [:error] [pid 40750:tid 40762] [client 91.224.92.99:51561] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmeQfBuk03yQKDyqu8sgAAAck"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:57.371112 2026] [:error] [pid 40750:tid 40762] [client 91.224.92.99:51561] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmeQfBuk03yQKDyqu8sgAAAck"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:16:59.144021 2026] [:error] [pid 38241:tid 38260] [client 91.224.92.99:51561] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRme_KRPk6YnJBxw_xnfgAAANA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:02.018741 2026] [:error] [pid 38241:tid 38254] [client 91.224.92.99:64485] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRmfvKRPk6YnJBxw_xnhwAAAMo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:03.347427 2026] [:error] [pid 37032:tid 37049] [client 91.224.92.99:52855] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmf-u0U4o7eSImsVSajgAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:05.050840 2026] [:error] [pid 37032:tid 37046] [client 91.224.92.99:52855] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmgeu0U4o7eSImsVSakgAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:07.923225 2026] [:error] [pid 37032:tid 37050] [client 91.224.92.99:52855] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmg-u0U4o7eSImsVSalAAAAZA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:08.770550 2026] [:error] [pid 37032:tid 37056] [client 91.224.92.99:52855] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmhOu0U4o7eSImsVSalQAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:08.770599 2026] [:error] [pid 37032:tid 37056] [client 91.224.92.99:52855] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmhOu0U4o7eSImsVSalQAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:11.534228 2026] [:error] [pid 7133:tid 7141] [client 91.224.92.99:65186] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRmh_Ctubh8pR64qB-HQwAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:12.864309 2026] [:error] [pid 40750:tid 40759] [client 91.224.92.99:64108] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRmiAfBuk03yQKDyqu88QAAAcY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:14.708300 2026] [:error] [pid 33822:tid 33843] [client 91.224.92.99:55911] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmim6W3ygu1YVssuZOjgAAApM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:17.077201 2026] [:error] [pid 33822:tid 33826] [client 91.224.92.99:55911] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmjW6W3ygu1YVssuZOkgAAAoI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:20.079239 2026] [:error] [pid 33822:tid 33838] [client 91.224.92.99:55911] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmkG6W3ygu1YVssuZOlwAAAo4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:24.455178 2026] [:error] [pid 33822:tid 33847] [client 91.224.92.99:55911] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmlG6W3ygu1YVssuZOmwAAApc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:24.455235 2026] [:error] [pid 33822:tid 33847] [client 91.224.92.99:55911] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 19"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmlG6W3ygu1YVssuZOmwAAApc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:27.287291 2026] [:error] [pid 7165:tid 7191] [client 91.224.92.99:55249] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmlxRjCrA8qWBjgG_mVAAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:29.614171 2026] [:error] [pid 7165:tid 7174] [client 91.224.92.99:55249] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmmRRjCrA8qWBjgG_mZgAAAkc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:30.563129 2026] [:error] [pid 7165:tid 7176] [client 91.224.92.99:55249] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmmhRjCrA8qWBjgG_mawAAAkk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:32.610919 2026] [:error] [pid 7165:tid 7189] [client 91.224.92.99:55249] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRmnBRjCrA8qWBjgG_mewAAAlY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:34.662198 2026] [:error] [pid 41780:tid 41788] [client 91.224.92.99:61401] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRmnsONkVoocLIqzy07vgAAA8U"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:39.034404 2026] [:error] [pid 7165:tid 7178] [client 91.224.92.99:60391] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmoxRjCrA8qWBjgG_mlgAAAks"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:43.329752 2026] [:error] [pid 7165:tid 7180] [client 91.224.92.99:60391] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmpxRjCrA8qWBjgG_mrwAAAk0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:48.220098 2026] [:error] [pid 7165:tid 7177] [client 91.224.92.99:60391] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmrBRjCrA8qWBjgG_myQAAAko"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:52.751506 2026] [:error] [pid 7165:tid 7191] [client 91.224.92.99:60391] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmsBRjCrA8qWBjgG_m5wAAAlg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:56.690039 2026] [:error] [pid 7165:tid 7188] [client 91.224.92.99:60391] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmtBRjCrA8qWBjgG_nFAAAAlU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:56.690120 2026] [:error] [pid 7165:tid 7188] [client 91.224.92.99:60391] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmtBRjCrA8qWBjgG_nFAAAAlU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:59.764966 2026] [:error] [pid 41780:tid 41792] [client 91.224.92.99:64839] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmt8ONkVoocLIqzy07wQAAA8k"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:17:59.765039 2026] [:error] [pid 41780:tid 41792] [client 91.224.92.99:64839] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmt8ONkVoocLIqzy07wQAAA8k"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:18:07.373607 2026] [:error] [pid 40750:tid 40769] [client 91.224.92.99:51259] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmvwfBuk03yQKDyqu9rAAAAdA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:18:09.230355 2026] [:error] [pid 40750:tid 40762] [client 91.224.92.99:51259] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmwQfBuk03yQKDyqu9tQAAAck"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:18:15.349051 2026] [:error] [pid 7165:tid 7177] [client 91.224.92.99:63831] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmxxRjCrA8qWBjgG_ndQAAAko"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:18:21.642951 2026] [:error] [pid 7165:tid 7175] [client 91.224.92.99:63831] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmzRRjCrA8qWBjgG_nhQAAAkg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:18:23.861204 2026] [:error] [pid 7165:tid 7170] [client 91.224.92.99:63831] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRmzxRjCrA8qWBjgG_niAAAAkM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:18:25.894369 2026] [:error] [pid 7165:tid 7190] [client 91.224.92.99:63831] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRm0RRjCrA8qWBjgG_nigAAAlc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:18:27.736906 2026] [:error] [pid 7165:tid 7179] [client 91.224.92.99:63831] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRm0xRjCrA8qWBjgG_nlwAAAkw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:18:33.008374 2026] [:error] [pid 7165:tid 7188] [client 91.224.92.99:63831] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRm2RRjCrA8qWBjgG_nowAAAlU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:18:34.710423 2026] [:error] [pid 7165:tid 7169] [client 91.224.92.99:63831] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRm2hRjCrA8qWBjgG_nqwAAAkI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:18:34.710485 2026] [:error] [pid 7165:tid 7169] [client 91.224.92.99:63831] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRm2hRjCrA8qWBjgG_nqwAAAkI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:18:37.944115 2026] [:error] [pid 7133:tid 7153] [client 91.224.92.99:50578] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRm3fCtubh8pR64qB-HzwAAAFI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:18:43.056294 2026] [:error] [pid 40750:tid 40759] [client 91.224.92.99:50580] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRm4wfBuk03yQKDyqu-MQAAAcY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:19:10.373280 2026] [:error] [pid 38241:tid 38263] [client 91.224.92.99:63696] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRm_vKRPk6YnJBxw_xoKgAAANM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:19:11.405664 2026] [:error] [pid 38241:tid 38246] [client 91.224.92.99:63696] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRm__KRPk6YnJBxw_xoNQAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:19:15.630159 2026] [:error] [pid 7133:tid 7142] [client 91.224.92.99:62638] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnA_Ctubh8pR64qB-IAgAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:19:15.630242 2026] [:error] [pid 7133:tid 7142] [client 91.224.92.99:62638] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnA_Ctubh8pR64qB-IAgAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:19:23.000782 2026] [:error] [pid 40750:tid 40761] [client 91.224.92.99:49949] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 30"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRnCgfBuk03yQKDyqu-dwAAAcg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:19:25.508576 2026] [:error] [pid 44644:tid 44669] [client 91.224.92.99:62216] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnDZ3RJaXMcw3y9V_xXwAAABY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:19:27.537765 2026] [:error] [pid 44644:tid 44651] [client 91.224.92.99:62216] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnD53RJaXMcw3y9V_xYgAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:19:33.485723 2026] [:error] [pid 53180:tid 53452] [client 91.224.92.99:56991] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnFTPPJpDOBvYnaa0xnAAAAYg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:19:34.811036 2026] [:error] [pid 53180:tid 53452] [client 91.224.92.99:56991] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnFjPPJpDOBvYnaa0xpgAAAYg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:19:34.811089 2026] [:error] [pid 53180:tid 53452] [client 91.224.92.99:56991] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnFjPPJpDOBvYnaa0xpgAAAYg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:19:37.847103 2026] [:error] [pid 53585:tid 53608] [client 91.224.92.99:60640] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnGXbCvYsvu6kKhM1DdQAAABQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:19:39.624206 2026] [:error] [pid 53585:tid 53592] [client 91.224.92.99:60640] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnG3bCvYsvu6kKhM1DfAAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:19:39.624286 2026] [:error] [pid 53585:tid 53592] [client 91.224.92.99:60640] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnG3bCvYsvu6kKhM1DfAAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:19:45.539564 2026] [:error] [pid 53182:tid 53551] [client 91.224.92.99:60335] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnIfv073cA6eM1YCSR-AAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:19:47.285553 2026] [:error] [pid 53182:tid 53562] [client 91.224.92.99:60335] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnI_v073cA6eM1YCSR-wAAANI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:19:49.806314 2026] [:error] [pid 53182:tid 53543] [client 91.224.92.99:60335] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnJfv073cA6eM1YCSSAQAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:19:52.860765 2026] [:error] [pid 53182:tid 53550] [client 91.224.92.99:60335] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnKPv073cA6eM1YCSSCAAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:19:52.860844 2026] [:error] [pid 53182:tid 53550] [client 91.224.92.99:60335] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnKPv073cA6eM1YCSSCAAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:20:05.867467 2026] [:error] [pid 53182:tid 53543] [client 91.224.92.99:64816] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnNfv073cA6eM1YCSSMQAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:20:08.590531 2026] [:error] [pid 53182:tid 53555] [client 91.224.92.99:64816] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnOPv073cA6eM1YCSSOQAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:20:12.072037 2026] [:error] [pid 53182:tid 53568] [client 91.224.92.99:64816] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnPPv073cA6eM1YCSSRQAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:20:12.072144 2026] [:error] [pid 53182:tid 53568] [client 91.224.92.99:64816] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnPPv073cA6eM1YCSSRQAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:20:23.810605 2026] [:error] [pid 53180:tid 53459] [client 91.224.92.99:65443] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnRzPPJpDOBvYnaa0yGwAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:20:23.810660 2026] [:error] [pid 53180:tid 53459] [client 91.224.92.99:65443] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnRzPPJpDOBvYnaa0yGwAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:20:27.825076 2026] [:error] [pid 53181:tid 53528] [client 91.224.92.99:64762] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnS4r_0T1SazTrJOAN5gAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:20:29.762167 2026] [:error] [pid 53181:tid 53539] [client 91.224.92.99:64762] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnTYr_0T1SazTrJOAN-gAAARg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:20:30.689599 2026] [:error] [pid 53181:tid 53527] [client 91.224.92.99:64762] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnTor_0T1SazTrJOAOAAAAAQw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:20:31.670933 2026] [:error] [pid 53181:tid 53528] [client 91.224.92.99:64762] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaRnT4r_0T1SazTrJOAOAgAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:20:42.249380 2026] [:error] [pid 53182:tid 53547] [client 91.224.92.99:58106] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnWvv073cA6eM1YCSSjgAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:20:44.195235 2026] [:error] [pid 53182:tid 53560] [client 91.224.92.99:58106] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnXPv073cA6eM1YCSSngAAANA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:20:49.651867 2026] [:error] [pid 53182:tid 53563] [client 91.224.92.99:58106] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnYfv073cA6eM1YCSSugAAANM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:20:50.950184 2026] [:error] [pid 53182:tid 53550] [client 91.224.92.99:58106] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnYvv073cA6eM1YCSSvQAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:20:53.359991 2026] [:error] [pid 53182:tid 53558] [client 91.224.92.99:58106] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnZfv073cA6eM1YCSSygAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:20:56.740649 2026] [:error] [pid 53182:tid 53565] [client 91.224.92.99:58106] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnaPv073cA6eM1YCSS1wAAANU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:20:58.670224 2026] [:error] [pid 53182:tid 53547] [client 91.224.92.99:58106] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnavv073cA6eM1YCSS3QAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:21:00.588486 2026] [:error] [pid 53182:tid 53550] [client 91.224.92.99:58106] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnbPv073cA6eM1YCSS4wAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:21:03.888319 2026] [:error] [pid 53182:tid 53556] [client 91.224.92.99:58106] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnb_v073cA6eM1YCSS6gAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:21:05.923271 2026] [:error] [pid 53182:tid 53556] [client 91.224.92.99:58106] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRncfv073cA6eM1YCSS7gAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:21:05.923327 2026] [:error] [pid 53182:tid 53556] [client 91.224.92.99:58106] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRncfv073cA6eM1YCSS7gAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:21:19.283116 2026] [:error] [pid 53181:tid 53517] [client 91.224.92.99:52933] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnf4r_0T1SazTrJOAObwAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:21:19.283184 2026] [:error] [pid 53181:tid 53517] [client 91.224.92.99:52933] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 21"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnf4r_0T1SazTrJOAObwAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:21:25.220005 2026] [:error] [pid 53182:tid 53557] [client 91.224.92.99:52934] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnhfv073cA6eM1YCSTQAAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:21:33.302795 2026] [:error] [pid 53180:tid 53461] [client 91.224.92.99:64468] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnjTPPJpDOBvYnaa0ygQAAAZE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:21:33.302861 2026] [:error] [pid 53180:tid 53461] [client 91.224.92.99:64468] [client 91.224.92.99] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.224.92.99 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnjTPPJpDOBvYnaa0ygQAAAZE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:21:34.792407 2026] [:error] [pid 53180:tid 53446] [client 91.224.92.99:64470] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnjjPPJpDOBvYnaa0yiwAAAYI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:21:37.971666 2026] [:error] [pid 53180:tid 53467] [client 91.224.92.99:64470] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnkTPPJpDOBvYnaa0ypgAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:21:39.841124 2026] [:error] [pid 53180:tid 53456] [client 91.224.92.99:64470] [client 91.224.92.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRnkzPPJpDOBvYnaa0yswAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 00:35:16.501188 2026] [:error] [pid 53182:tid 53548] [client 20.63.80.2:32710] [client 20.63.80.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.63.80.2, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "aaRqxPv073cA6eM1YCSdcgAAAMU"]
[Mon Mar 02 00:35:19.771071 2026] [:error] [pid 53182:tid 53563] [client 20.63.80.2:32710] [client 20.63.80.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.63.80.2, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaRqx_v073cA6eM1YCSdhgAAANM"]
[Mon Mar 02 00:35:21.316155 2026] [:error] [pid 53182:tid 53543] [client 20.63.80.2:32710] [client 20.63.80.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.63.80.2, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaRqyfv073cA6eM1YCSdjAAAAMA"]
[Mon Mar 02 00:35:22.117907 2026] [autoindex:error] [pid 53182:tid 53553] [client 20.63.80.2:32710] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Mar 02 00:35:23.120450 2026] [:error] [pid 53182:tid 53546] [client 20.63.80.2:32710] [client 20.63.80.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aaRqy_v073cA6eM1YCSdmAAAAMM"]
[Mon Mar 02 00:35:23.972482 2026] [:error] [pid 53585:tid 53595] [client 20.63.80.2:32518] [client 20.63.80.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aaRqy3bCvYsvu6kKhM1XjgAAAAc"]
[Mon Mar 02 00:35:24.799586 2026] [:error] [pid 53181:tid 53534] [client 20.63.80.2:32515] [client 20.63.80.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aaRqzIr_0T1SazTrJOAXCQAAARM"]
[Mon Mar 02 00:35:25.625061 2026] [:error] [pid 53180:tid 53444] [client 20.63.80.2:32717] [client 20.63.80.2] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aaRqzTPPJpDOBvYnaa05_gAAAYA"]
[Mon Mar 02 00:36:31.778705 2026] [:error] [pid 53181:tid 53527] [client 43.155.129.131:57448] [client 43.155.129.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaRrD4r_0T1SazTrJOAXzAAAAQw"]
[Mon Mar 02 00:37:39.038853 2026] [:error] [pid 53585:tid 53601] [client 20.205.227.70:8353] [client 20.205.227.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aaRrU3bCvYsvu6kKhM1afQAAAA0"]
[Mon Mar 02 00:37:39.413064 2026] [:error] [pid 53585:tid 53590] [client 20.205.227.70:7892] [client 20.205.227.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aaRrU3bCvYsvu6kKhM1agQAAAAI"]
[Mon Mar 02 00:37:39.813903 2026] [:error] [pid 53585:tid 53591] [client 20.205.227.70:19314] [client 20.205.227.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aaRrU3bCvYsvu6kKhM1aigAAAAM"]
[Mon Mar 02 00:37:40.164707 2026] [:error] [pid 53182:tid 53561] [client 20.205.227.70:8323] [client 20.205.227.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aaRrVPv073cA6eM1YCSfGQAAANE"]
[Mon Mar 02 01:01:41.961079 2026] [:error] [pid 53181:tid 53538] [client 20.220.162.180:36754] [client 20.220.162.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wk/index.php"] [unique_id "aaRw9Yr_0T1SazTrJOAmuQAAARc"]
[Mon Mar 02 01:01:42.778788 2026] [:error] [pid 53182:tid 53555] [client 20.220.162.180:36788] [client 20.220.162.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wk/index.php"] [unique_id "aaRw9vv073cA6eM1YCS1kgAAAMs"]
[Mon Mar 02 01:01:43.602614 2026] [:error] [pid 53585:tid 53600] [client 20.220.162.180:36793] [client 20.220.162.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wk/index.php"] [unique_id "aaRw93bCvYsvu6kKhM163AAAAAw"]
[Mon Mar 02 01:01:44.423122 2026] [:error] [pid 53180:tid 53456] [client 20.220.162.180:36765] [client 20.220.162.180] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wk/index.php"] [unique_id "aaRw-DPPJpDOBvYnaa1GygAAAYw"]
[Mon Mar 02 01:41:51.870765 2026] [:error] [pid 53585:tid 53598] [client 223.244.35.77:43531] [client 223.244.35.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaR6X3bCvYsvu6kKhM2ciQAAAAo"]
[Mon Mar 02 02:41:37.842628 2026] [:error] [pid 53182:tid 53549] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIYfv073cA6eM1YCT5dAAAAMY"], referer: https://wordpress.org/
[Mon Mar 02 02:41:44.424045 2026] [:error] [pid 53182:tid 53564] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaSIaPv073cA6eM1YCT5iQAAANQ"]
[Mon Mar 02 02:41:44.689582 2026] [:error] [pid 53182:tid 53560] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIaPv073cA6eM1YCT5igAAANA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:41:46.283917 2026] [:error] [pid 53182:tid 53562] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIavv073cA6eM1YCT5kgAAANI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:41:47.067058 2026] [:error] [pid 53182:tid 53557] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIa_v073cA6eM1YCT5lAAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:41:48.691453 2026] [:error] [pid 53182:tid 53544] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIbPv073cA6eM1YCT5mgAAAME"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:41:49.494851 2026] [:error] [pid 53182:tid 53556] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIbfv073cA6eM1YCT5nwAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:41:51.221035 2026] [:error] [pid 53182:tid 53557] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIb_v073cA6eM1YCT5pwAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:41:52.001368 2026] [:error] [pid 53182:tid 53567] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIcPv073cA6eM1YCT5qQAAANc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:41:53.665983 2026] [:error] [pid 53182:tid 53558] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIcfv073cA6eM1YCT5rQAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:41:54.455512 2026] [:error] [pid 53182:tid 53543] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIcvv073cA6eM1YCT5rgAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:41:56.036474 2026] [:error] [pid 53182:tid 53565] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIdPv073cA6eM1YCT5sQAAANU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:41:56.815148 2026] [:error] [pid 53182:tid 53550] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIdPv073cA6eM1YCT5swAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:41:58.380814 2026] [:error] [pid 53182:tid 53558] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIdvv073cA6eM1YCT5vQAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:41:59.149896 2026] [:error] [pid 53182:tid 53566] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSId_v073cA6eM1YCT5wQAAANY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:00.864307 2026] [:error] [pid 53182:tid 53550] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIePv073cA6eM1YCT5xwAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:01.677981 2026] [:error] [pid 53182:tid 53564] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIefv073cA6eM1YCT5ygAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:03.337671 2026] [:error] [pid 53182:tid 53556] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIe_v073cA6eM1YCT5zwAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:04.159458 2026] [:error] [pid 53182:tid 53565] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIfPv073cA6eM1YCT51AAAANU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:05.777020 2026] [:error] [pid 53182:tid 53549] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIffv073cA6eM1YCT53AAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:06.567356 2026] [:error] [pid 53182:tid 53568] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIfvv073cA6eM1YCT53QAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:08.212823 2026] [:error] [pid 53182:tid 53550] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIgPv073cA6eM1YCT55QAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:09.023661 2026] [:error] [pid 53182:tid 53563] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIgfv073cA6eM1YCT56AAAANM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:10.672468 2026] [:error] [pid 53182:tid 53543] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIgvv073cA6eM1YCT57AAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:11.480277 2026] [:error] [pid 53182:tid 53548] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIg_v073cA6eM1YCT57gAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:13.083311 2026] [:error] [pid 53182:tid 53567] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIhfv073cA6eM1YCT58gAAANc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:13.883583 2026] [:error] [pid 53182:tid 53560] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIhfv073cA6eM1YCT59gAAANA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:15.526910 2026] [:error] [pid 53182:tid 53548] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIh_v073cA6eM1YCT5_QAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:16.313454 2026] [:error] [pid 53182:tid 53564] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIiPv073cA6eM1YCT5_gAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:17.897179 2026] [:error] [pid 53182:tid 53544] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIifv073cA6eM1YCT6AQAAAME"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:18.701859 2026] [:error] [pid 53182:tid 53557] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIivv073cA6eM1YCT6AwAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:20.394365 2026] [:error] [pid 53182:tid 53568] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIjPv073cA6eM1YCT6BgAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:21.189801 2026] [:error] [pid 53182:tid 53566] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIjfv073cA6eM1YCT6BwAAANY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:22.857316 2026] [:error] [pid 53182:tid 53553] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIjvv073cA6eM1YCT6DAAAAMo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:23.627716 2026] [:error] [pid 53182:tid 53552] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIj_v073cA6eM1YCT6DwAAAMk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:25.247213 2026] [:error] [pid 53182:tid 53563] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIkfv073cA6eM1YCT6EwAAANM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:26.066674 2026] [:error] [pid 53182:tid 53560] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIkvv073cA6eM1YCT6FQAAANA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:27.684717 2026] [:error] [pid 53182:tid 53555] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIk_v073cA6eM1YCT6GgAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:28.502361 2026] [:error] [pid 53182:tid 53559] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIlPv073cA6eM1YCT6HQAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:30.090282 2026] [:error] [pid 53182:tid 53564] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIlvv073cA6eM1YCT6JQAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:30.941770 2026] [:error] [pid 53182:tid 53559] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIlvv073cA6eM1YCT6LQAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:32.586938 2026] [:error] [pid 53182:tid 53551] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSImPv073cA6eM1YCT6NwAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:33.419425 2026] [:error] [pid 53182:tid 53548] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSImfv073cA6eM1YCT6OgAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:35.060763 2026] [:error] [pid 53182:tid 53549] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIm_v073cA6eM1YCT6PwAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:35.832857 2026] [:error] [pid 53182:tid 53555] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIm_v073cA6eM1YCT6RAAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:37.421232 2026] [:error] [pid 53182:tid 53545] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSInfv073cA6eM1YCT6UQAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:38.257342 2026] [:error] [pid 53182:tid 53546] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSInvv073cA6eM1YCT6VAAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:39.837367 2026] [:error] [pid 53182:tid 53553] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIn_v073cA6eM1YCT6VgAAAMo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:40.620295 2026] [:error] [pid 53182:tid 53555] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIoPv073cA6eM1YCT6VwAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:42.199246 2026] [:error] [pid 53182:tid 53562] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIovv073cA6eM1YCT6XAAAANI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:42.962195 2026] [:error] [pid 53182:tid 53548] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIovv073cA6eM1YCT6XQAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:44.607788 2026] [:error] [pid 53182:tid 53546] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIpPv073cA6eM1YCT6YwAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:45.392465 2026] [:error] [pid 53182:tid 53556] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIpfv073cA6eM1YCT6aQAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:46.950434 2026] [:error] [pid 53182:tid 53555] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIpvv073cA6eM1YCT6dQAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:47.720126 2026] [:error] [pid 53182:tid 53559] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIp_v073cA6eM1YCT6ewAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:49.274553 2026] [:error] [pid 53182:tid 53567] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIqfv073cA6eM1YCT6gAAAANc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:50.042864 2026] [:error] [pid 53182:tid 53543] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIqvv073cA6eM1YCT6gwAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:51.614649 2026] [:error] [pid 53182:tid 53546] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIq_v073cA6eM1YCT6iQAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:53.103796 2026] [:error] [pid 53182:tid 53546] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIrfv073cA6eM1YCT6iwAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:54.683989 2026] [:error] [pid 53182:tid 53558] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIrvv073cA6eM1YCT6jgAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:55.474998 2026] [:error] [pid 53182:tid 53544] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIr_v073cA6eM1YCT6jwAAAME"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:57.060111 2026] [:error] [pid 53182:tid 53551] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIsfv073cA6eM1YCT6kgAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:57.846709 2026] [:error] [pid 53182:tid 53562] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIsfv073cA6eM1YCT6kwAAANI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:42:59.415562 2026] [:error] [pid 53182:tid 53568] [client 91.92.242.216:52920] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIs_v073cA6eM1YCT6lQAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:00.993552 2026] [:error] [pid 53585:tid 53599] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSItHbCvYsvu6kKhM3bxQAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:02.571186 2026] [:error] [pid 53585:tid 53590] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSItnbCvYsvu6kKhM3b0QAAAAI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:03.344490 2026] [:error] [pid 53585:tid 53593] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIt3bCvYsvu6kKhM3b2AAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:04.985467 2026] [:error] [pid 53585:tid 53598] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIuHbCvYsvu6kKhM3b5AAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:05.819559 2026] [:error] [pid 53585:tid 53597] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIuXbCvYsvu6kKhM3b6QAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:08.573112 2026] [:error] [pid 53585:tid 53591] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIvHbCvYsvu6kKhM3b8AAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:09.331691 2026] [:error] [pid 53585:tid 53598] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIvXbCvYsvu6kKhM3b8gAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:10.920453 2026] [:error] [pid 53585:tid 53599] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIvnbCvYsvu6kKhM3b9QAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:11.711490 2026] [:error] [pid 53585:tid 53603] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIv3bCvYsvu6kKhM3b9gAAAA8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:13.277298 2026] [:error] [pid 53585:tid 53612] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIwXbCvYsvu6kKhM3b_QAAABg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:14.065262 2026] [:error] [pid 53585:tid 53609] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIwnbCvYsvu6kKhM3cAAAAABU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:15.701597 2026] [:error] [pid 53585:tid 53606] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIw3bCvYsvu6kKhM3cCAAAABI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:16.501062 2026] [:error] [pid 53585:tid 53601] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIxHbCvYsvu6kKhM3cCQAAAA0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:18.070343 2026] [:error] [pid 53585:tid 53591] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIxnbCvYsvu6kKhM3cDAAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:19.993698 2026] [:error] [pid 53585:tid 53591] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIx3bCvYsvu6kKhM3cFgAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:21.582241 2026] [:error] [pid 53585:tid 53609] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIyXbCvYsvu6kKhM3cHAAAABU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:22.354499 2026] [:error] [pid 53585:tid 53603] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIynbCvYsvu6kKhM3cIwAAAA8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:23.939243 2026] [:error] [pid 53585:tid 53589] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIy3bCvYsvu6kKhM3cKQAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:24.717793 2026] [:error] [pid 53585:tid 53612] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIzHbCvYsvu6kKhM3cLQAAABg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:26.300014 2026] [:error] [pid 53585:tid 53599] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIznbCvYsvu6kKhM3cNgAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:27.061473 2026] [:error] [pid 53585:tid 53596] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSIz3bCvYsvu6kKhM3cOwAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:28.701829 2026] [:error] [pid 53585:tid 53602] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI0HbCvYsvu6kKhM3cRQAAAA4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:29.485055 2026] [:error] [pid 53585:tid 53596] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI0XbCvYsvu6kKhM3cSQAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:31.086316 2026] [:error] [pid 53585:tid 53590] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI03bCvYsvu6kKhM3cUAAAAAI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:31.884138 2026] [:error] [pid 53585:tid 53591] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI03bCvYsvu6kKhM3cUgAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:33.586475 2026] [:error] [pid 53585:tid 53607] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI1XbCvYsvu6kKhM3cXAAAABM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:34.393679 2026] [:error] [pid 53585:tid 53600] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI1nbCvYsvu6kKhM3cYQAAAAw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:36.023285 2026] [:error] [pid 53585:tid 53592] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI2HbCvYsvu6kKhM3cZwAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:36.819788 2026] [:error] [pid 53585:tid 53588] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI2HbCvYsvu6kKhM3caQAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:38.481117 2026] [:error] [pid 53585:tid 53603] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI2nbCvYsvu6kKhM3ccAAAAA8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:39.331432 2026] [:error] [pid 53585:tid 53589] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI23bCvYsvu6kKhM3ceQAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:40.971278 2026] [:error] [pid 53585:tid 53603] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI3HbCvYsvu6kKhM3chgAAAA8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:41.744207 2026] [:error] [pid 53585:tid 53595] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI3XbCvYsvu6kKhM3ciAAAAAc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:43.332641 2026] [:error] [pid 53585:tid 53611] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI33bCvYsvu6kKhM3ciwAAABc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:44.096827 2026] [:error] [pid 53585:tid 53591] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI4HbCvYsvu6kKhM3cjwAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:45.730803 2026] [:error] [pid 53585:tid 53609] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI4XbCvYsvu6kKhM3cngAAABU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:46.535432 2026] [:error] [pid 53585:tid 53592] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI4nbCvYsvu6kKhM3cpQAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:48.152783 2026] [:error] [pid 53585:tid 53604] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI5HbCvYsvu6kKhM3cqgAAABA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:48.923992 2026] [:error] [pid 53585:tid 53601] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI5HbCvYsvu6kKhM3crQAAAA0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:50.558759 2026] [:error] [pid 53585:tid 53602] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI5nbCvYsvu6kKhM3csgAAAA4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:51.373775 2026] [:error] [pid 53585:tid 53600] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI53bCvYsvu6kKhM3ctgAAAAw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:53.006229 2026] [:error] [pid 53585:tid 53604] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI6XbCvYsvu6kKhM3cuwAAABA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:53.824153 2026] [:error] [pid 53585:tid 53601] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI6XbCvYsvu6kKhM3cwQAAAA0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:55.464170 2026] [:error] [pid 53585:tid 53594] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI63bCvYsvu6kKhM3cyAAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:56.267288 2026] [:error] [pid 53585:tid 53593] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI7HbCvYsvu6kKhM3czAAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:57.923720 2026] [:error] [pid 53585:tid 53606] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI7XbCvYsvu6kKhM3c1QAAABI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:43:58.730548 2026] [:error] [pid 53585:tid 53604] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI7nbCvYsvu6kKhM3c1gAAABA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:00.316780 2026] [:error] [pid 53585:tid 53598] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI8HbCvYsvu6kKhM3c2QAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:01.107274 2026] [:error] [pid 53585:tid 53597] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI8XbCvYsvu6kKhM3c2gAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:02.671302 2026] [:error] [pid 53585:tid 53592] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI8nbCvYsvu6kKhM3c3wAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:03.466897 2026] [:error] [pid 53585:tid 53606] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI83bCvYsvu6kKhM3c4AAAABI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:05.050346 2026] [:error] [pid 53585:tid 53594] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI9XbCvYsvu6kKhM3c4gAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:05.857308 2026] [:error] [pid 53585:tid 53599] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI9XbCvYsvu6kKhM3c4wAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:07.428927 2026] [:error] [pid 53585:tid 53596] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI93bCvYsvu6kKhM3c6QAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:08.201524 2026] [:error] [pid 53585:tid 53590] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI-HbCvYsvu6kKhM3c8gAAAAI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:09.803128 2026] [:error] [pid 53585:tid 53602] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI-XbCvYsvu6kKhM3c_QAAAA4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:10.618764 2026] [:error] [pid 53585:tid 53592] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI-nbCvYsvu6kKhM3dAwAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:12.198947 2026] [:error] [pid 53585:tid 53600] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI_HbCvYsvu6kKhM3dCwAAAAw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:12.984228 2026] [:error] [pid 53585:tid 53603] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI_HbCvYsvu6kKhM3dDgAAAA8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:14.584489 2026] [:error] [pid 53585:tid 53593] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI_nbCvYsvu6kKhM3dEgAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:15.346165 2026] [:error] [pid 53585:tid 53608] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSI_3bCvYsvu6kKhM3dEwAAABQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:17.013064 2026] [:error] [pid 53585:tid 53588] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJAXbCvYsvu6kKhM3dFgAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:17.811953 2026] [:error] [pid 53585:tid 53598] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJAXbCvYsvu6kKhM3dFwAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:19.403826 2026] [:error] [pid 53585:tid 53610] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJA3bCvYsvu6kKhM3dGwAAABY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:20.194822 2026] [:error] [pid 53585:tid 53602] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJBHbCvYsvu6kKhM3dHgAAAA4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:21.786947 2026] [:error] [pid 53585:tid 53592] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJBXbCvYsvu6kKhM3dKAAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:22.598341 2026] [:error] [pid 53585:tid 53599] [client 91.92.242.216:63424] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJBnbCvYsvu6kKhM3dLQAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:25.018808 2026] [:error] [pid 26940:tid 26967] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJCRrUg-j5GLDtRFkIGAAAAFc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:25.784802 2026] [:error] [pid 26940:tid 26965] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJCRrUg-j5GLDtRFkIGwAAAFU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:27.352585 2026] [:error] [pid 26940:tid 26957] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJCxrUg-j5GLDtRFkIKgAAAE0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:28.132178 2026] [:error] [pid 26940:tid 26961] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJDBrUg-j5GLDtRFkIMgAAAFE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:29.757814 2026] [:error] [pid 26940:tid 26952] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJDRrUg-j5GLDtRFkIPwAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:30.515560 2026] [:error] [pid 26940:tid 26961] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJDhrUg-j5GLDtRFkIRAAAAFE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:32.102853 2026] [:error] [pid 26940:tid 26944] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJEBrUg-j5GLDtRFkITwAAAEA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:32.876460 2026] [:error] [pid 26940:tid 26946] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJEBrUg-j5GLDtRFkIVAAAAEI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:34.506551 2026] [:error] [pid 26940:tid 26955] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJEhrUg-j5GLDtRFkIXwAAAEs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:35.265707 2026] [:error] [pid 26940:tid 26961] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJExrUg-j5GLDtRFkIZwAAAFE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:36.882326 2026] [:error] [pid 26940:tid 26945] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJFBrUg-j5GLDtRFkIdgAAAEE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:37.694864 2026] [:error] [pid 26940:tid 26958] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJFRrUg-j5GLDtRFkIfAAAAE4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:39.253423 2026] [:error] [pid 26940:tid 26964] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJFxrUg-j5GLDtRFkIgQAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:40.084980 2026] [:error] [pid 26940:tid 26945] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJGBrUg-j5GLDtRFkIggAAAEE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:41.680760 2026] [:error] [pid 26940:tid 26957] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJGRrUg-j5GLDtRFkIjQAAAE0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:42.460038 2026] [:error] [pid 26940:tid 26967] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJGhrUg-j5GLDtRFkIkAAAAFc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:44.068223 2026] [:error] [pid 26940:tid 26949] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJHBrUg-j5GLDtRFkImQAAAEU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:44.864337 2026] [:error] [pid 26940:tid 26957] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJHBrUg-j5GLDtRFkIoAAAAE0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:46.422158 2026] [:error] [pid 26940:tid 26968] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJHhrUg-j5GLDtRFkIpwAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:47.255377 2026] [:error] [pid 26940:tid 26960] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJHxrUg-j5GLDtRFkIqQAAAFA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:48.915248 2026] [:error] [pid 26940:tid 26949] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJIBrUg-j5GLDtRFkItwAAAEU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:49.723300 2026] [:error] [pid 26940:tid 26954] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJIRrUg-j5GLDtRFkIvQAAAEo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:51.352087 2026] [:error] [pid 26940:tid 26960] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJIxrUg-j5GLDtRFkI4gAAAFA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:52.150485 2026] [:error] [pid 26940:tid 26944] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJJBrUg-j5GLDtRFkI6wAAAEA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:53.780565 2026] [:error] [pid 26940:tid 26961] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJJRrUg-j5GLDtRFkJAgAAAFE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:54.582578 2026] [:error] [pid 26940:tid 26960] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJJhrUg-j5GLDtRFkJCAAAAFA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:56.128683 2026] [:error] [pid 26940:tid 26949] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJKBrUg-j5GLDtRFkJEgAAAEU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:56.938649 2026] [:error] [pid 26940:tid 26948] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJKBrUg-j5GLDtRFkJIwAAAEQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:58.571981 2026] [:error] [pid 26940:tid 26950] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJKhrUg-j5GLDtRFkJLQAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:59.352410 2026] [:error] [pid 26940:tid 26953] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJKxrUg-j5GLDtRFkJMwAAAEk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:44:59.352486 2026] [:error] [pid 26940:tid 26953] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 91.92.242.216 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJKxrUg-j5GLDtRFkJMwAAAEk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:01.338186 2026] [:error] [pid 26940:tid 26960] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJLRrUg-j5GLDtRFkJSgAAAFA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:02.151039 2026] [:error] [pid 26940:tid 26962] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJLhrUg-j5GLDtRFkJUgAAAFI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:03.738228 2026] [:error] [pid 26940:tid 26945] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJLxrUg-j5GLDtRFkJbAAAAEE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:04.514676 2026] [:error] [pid 26940:tid 26963] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJMBrUg-j5GLDtRFkJcgAAAFM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:06.117548 2026] [:error] [pid 26940:tid 26957] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJMhrUg-j5GLDtRFkJewAAAE0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:06.898305 2026] [:error] [pid 26940:tid 26950] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJMhrUg-j5GLDtRFkJfAAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:08.539235 2026] [:error] [pid 26940:tid 26963] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJNBrUg-j5GLDtRFkJhgAAAFM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:09.316902 2026] [:error] [pid 26940:tid 26950] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJNRrUg-j5GLDtRFkJiAAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:10.898775 2026] [:error] [pid 26940:tid 26945] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJNhrUg-j5GLDtRFkJkQAAAEE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:11.732167 2026] [:error] [pid 26940:tid 26950] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJNxrUg-j5GLDtRFkJmAAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:13.345015 2026] [:error] [pid 26940:tid 26956] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJORrUg-j5GLDtRFkJnwAAAEw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:14.109718 2026] [:error] [pid 26940:tid 26947] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJOhrUg-j5GLDtRFkJoAAAAEM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:15.702802 2026] [:error] [pid 26940:tid 26945] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJOxrUg-j5GLDtRFkJpAAAAEE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:16.458005 2026] [:error] [pid 26940:tid 26958] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJPBrUg-j5GLDtRFkJqQAAAE4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:18.055670 2026] [:error] [pid 26940:tid 26966] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJPhrUg-j5GLDtRFkJtgAAAFY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:18.881445 2026] [:error] [pid 26940:tid 26964] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJPhrUg-j5GLDtRFkJwAAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:20.464130 2026] [:error] [pid 26940:tid 26949] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJQBrUg-j5GLDtRFkJ0wAAAEU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:21.229452 2026] [:error] [pid 26940:tid 26966] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJQRrUg-j5GLDtRFkJ1gAAAFY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:22.855884 2026] [:error] [pid 26940:tid 26966] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJQhrUg-j5GLDtRFkJ6QAAAFY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:23.619640 2026] [:error] [pid 26940:tid 26956] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJQxrUg-j5GLDtRFkJ6wAAAEw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:25.188576 2026] [:error] [pid 26940:tid 26966] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJRRrUg-j5GLDtRFkKAQAAAFY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:25.942677 2026] [:error] [pid 26940:tid 26961] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJRRrUg-j5GLDtRFkKCgAAAFE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:27.528257 2026] [:error] [pid 26940:tid 26957] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJRxrUg-j5GLDtRFkKDQAAAE0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:28.314823 2026] [:error] [pid 26940:tid 26963] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJSBrUg-j5GLDtRFkKDgAAAFM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:45:29.904875 2026] [:error] [pid 26940:tid 26968] [client 91.92.242.216:52500] [client 91.92.242.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.92.242.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaSJSRrUg-j5GLDtRFkKHAAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 02:47:25.469903 2026] [:error] [pid 26940:tid 26967] [client 43.166.129.247:42042] [client 43.166.129.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaSJvRrUg-j5GLDtRFkMpwAAAFc"]
[Mon Mar 02 03:55:15.999822 2026] [:error] [pid 61943:tid 61968] [client 51.75.151.149:58669] [client 51.75.151.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.75.151.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaSZo9n1J3fKuQpdZdMkbgAAABQ"]
[Mon Mar 02 03:55:25.547774 2026] [:error] [pid 61945:tid 62015] [client 51.75.151.149:55870] [client 51.75.151.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.75.151.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaSZrVLhmMr4eXUWjbidSgAAAIw"]
[Mon Mar 02 05:35:02.712372 2026] [:error] [pid 28908:tid 28928] [client 20.205.226.191:15176] [client 20.205.226.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aaSxBoqJmC8ih_lQQnDwqgAAANI"]
[Mon Mar 02 05:35:03.070151 2026] [:error] [pid 28794:tid 28847] [client 20.205.226.191:12841] [client 20.205.226.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aaSxB6Vy2qpaelbUob0GoQAAAEs"]
[Mon Mar 02 05:35:03.422249 2026] [:error] [pid 28794:tid 28854] [client 20.205.226.191:13918] [client 20.205.226.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aaSxB6Vy2qpaelbUob0GogAAAFI"]
[Mon Mar 02 05:35:03.774728 2026] [:error] [pid 28908:tid 28930] [client 20.205.226.191:13926] [client 20.205.226.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "aaSxB4qJmC8ih_lQQnDwswAAANQ"]
[Mon Mar 02 06:05:11.669700 2026] [:error] [pid 28794:tid 28851] [client 43.157.142.101:47332] [client 43.157.142.101] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaS4F6Vy2qpaelbUob0WOwAAAE8"]
[Mon Mar 02 08:16:27.593884 2026] [:error] [pid 31257:tid 31267] [client 43.167.157.80:55264] [client 43.167.157.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaTW2_-JFLfishX45N-5rwAAAQQ"]
[Mon Mar 02 08:17:42.728836 2026] [:error] [pid 28795:tid 28883] [client 20.205.227.70:9374] [client 20.205.227.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/000.php"] [unique_id "aaTXJrROd53wZBkdI_d7jwAAAJQ"]
[Mon Mar 02 08:17:43.094125 2026] [:error] [pid 28908:tid 28913] [client 20.205.227.70:6064] [client 20.205.227.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/000.php"] [unique_id "aaTXJ4qJmC8ih_lQQnDAegAAAMM"]
[Mon Mar 02 08:17:43.449038 2026] [:error] [pid 28794:tid 28851] [client 20.205.227.70:35934] [client 20.205.227.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/000.php"] [unique_id "aaTXJ6Vy2qpaelbUob1SjQAAAE8"]
[Mon Mar 02 08:17:43.805156 2026] [:error] [pid 28794:tid 28847] [client 20.205.227.70:9629] [client 20.205.227.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/000.php"] [unique_id "aaTXJ6Vy2qpaelbUob1SjwAAAEs"]
[Mon Mar 02 08:21:55.189188 2026] [:error] [pid 28793:tid 28827] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYIw2_fxBANaHo1f49IQAAABQ"], referer: https://t.co/
[Mon Mar 02 08:22:09.843366 2026] [:error] [pid 28793:tid 28814] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaTYMQ2_fxBANaHo1f49LwAAAAc"]
[Mon Mar 02 08:22:11.094365 2026] [:error] [pid 28793:tid 28824] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYMw2_fxBANaHo1f49MQAAABE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:12.719069 2026] [:error] [pid 28793:tid 28831] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYNA2_fxBANaHo1f49MwAAABg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:13.547835 2026] [:error] [pid 28793:tid 28828] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYNQ2_fxBANaHo1f49NAAAABU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:15.145552 2026] [:error] [pid 28793:tid 28819] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYNw2_fxBANaHo1f49OAAAAAw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:15.995143 2026] [:error] [pid 28793:tid 28826] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYNw2_fxBANaHo1f49OQAAABM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:17.657074 2026] [:error] [pid 28793:tid 28820] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYOQ2_fxBANaHo1f49PQAAAA0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:18.450300 2026] [:error] [pid 28793:tid 28809] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYOg2_fxBANaHo1f49PwAAAAI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:20.063941 2026] [:error] [pid 28793:tid 28808] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYPA2_fxBANaHo1f49QQAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:20.925530 2026] [:error] [pid 28793:tid 28814] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYPA2_fxBANaHo1f49QgAAAAc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:22.602144 2026] [:error] [pid 28793:tid 28821] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYPg2_fxBANaHo1f49RgAAAA4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:23.385702 2026] [:error] [pid 28793:tid 28811] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYPw2_fxBANaHo1f49RwAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:25.088887 2026] [:error] [pid 28793:tid 28818] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYQQ2_fxBANaHo1f49TQAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:25.875510 2026] [:error] [pid 28793:tid 28817] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYQQ2_fxBANaHo1f49TwAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:27.675993 2026] [:error] [pid 28793:tid 28814] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYQw2_fxBANaHo1f49UQAAAAc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:28.493650 2026] [:error] [pid 28793:tid 28813] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYRA2_fxBANaHo1f49UgAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:30.193312 2026] [:error] [pid 28793:tid 28827] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYRg2_fxBANaHo1f49VAAAABQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:30.991927 2026] [:error] [pid 28793:tid 28828] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYRg2_fxBANaHo1f49VgAAABU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:32.747348 2026] [:error] [pid 28793:tid 28823] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYSA2_fxBANaHo1f49WAAAABA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:33.604077 2026] [:error] [pid 28793:tid 28819] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYSQ2_fxBANaHo1f49WQAAAAw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:35.313260 2026] [:error] [pid 28793:tid 28826] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYSw2_fxBANaHo1f49WwAAABM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:36.196563 2026] [:error] [pid 28793:tid 28830] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYTA2_fxBANaHo1f49XQAAABc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:37.825182 2026] [:error] [pid 28793:tid 28809] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYTQ2_fxBANaHo1f49YQAAAAI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:38.693475 2026] [:error] [pid 28793:tid 28820] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYTg2_fxBANaHo1f49YgAAAA0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:40.355208 2026] [:error] [pid 28793:tid 28827] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYUA2_fxBANaHo1f49ZwAAABQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:41.162426 2026] [:error] [pid 28793:tid 28828] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYUQ2_fxBANaHo1f49awAAABU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:42.843333 2026] [:error] [pid 28793:tid 28826] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYUg2_fxBANaHo1f49bgAAABM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:43.634855 2026] [:error] [pid 28793:tid 28807] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYUw2_fxBANaHo1f49bwAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:45.360424 2026] [:error] [pid 28793:tid 28829] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYVQ2_fxBANaHo1f49cgAAABY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:46.171064 2026] [:error] [pid 28793:tid 28816] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYVg2_fxBANaHo1f49dQAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:47.817404 2026] [:error] [pid 28793:tid 28822] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYVw2_fxBANaHo1f49ewAAAA8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:48.587664 2026] [:error] [pid 28793:tid 28807] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYWA2_fxBANaHo1f49fQAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:50.184801 2026] [:error] [pid 28793:tid 28816] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYWg2_fxBANaHo1f49gwAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:51.005637 2026] [:error] [pid 28793:tid 28828] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYWw2_fxBANaHo1f49hwAAABU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:52.640262 2026] [:error] [pid 28793:tid 28808] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYXA2_fxBANaHo1f49iwAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:53.404988 2026] [:error] [pid 28793:tid 28831] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYXQ2_fxBANaHo1f49jAAAABg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:54.981677 2026] [:error] [pid 28793:tid 28827] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYXg2_fxBANaHo1f49jgAAABQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:55.832121 2026] [:error] [pid 28793:tid 28819] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYXw2_fxBANaHo1f49jwAAAAw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:57.474083 2026] [:error] [pid 28793:tid 28822] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYYQ2_fxBANaHo1f49kQAAAA8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:58.256402 2026] [:error] [pid 28793:tid 28812] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYYg2_fxBANaHo1f49kgAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:22:59.835993 2026] [:error] [pid 28793:tid 28825] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYYw2_fxBANaHo1f49lAAAABI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:00.673241 2026] [:error] [pid 28793:tid 28818] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYZA2_fxBANaHo1f49lgAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:02.346572 2026] [:error] [pid 28793:tid 28807] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYZg2_fxBANaHo1f49mAAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:03.183422 2026] [:error] [pid 28793:tid 28810] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYZw2_fxBANaHo1f49mQAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:04.817349 2026] [:error] [pid 28793:tid 28829] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYaA2_fxBANaHo1f49mwAAABY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:05.654654 2026] [:error] [pid 28793:tid 28813] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYaQ2_fxBANaHo1f49nAAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:07.369504 2026] [:error] [pid 28793:tid 28811] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYaw2_fxBANaHo1f49nwAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:08.222201 2026] [:error] [pid 28793:tid 28815] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYbA2_fxBANaHo1f49oAAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:09.874253 2026] [:error] [pid 28793:tid 28828] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYbQ2_fxBANaHo1f49ogAAABU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:10.769476 2026] [:error] [pid 28793:tid 28823] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYbg2_fxBANaHo1f49owAAABA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:12.468147 2026] [:error] [pid 28793:tid 28822] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYcA2_fxBANaHo1f49pgAAAA8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:13.426775 2026] [:error] [pid 28793:tid 28817] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYcQ2_fxBANaHo1f49pwAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:15.154096 2026] [:error] [pid 28793:tid 28809] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYcw2_fxBANaHo1f49qgAAAAI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:16.004162 2026] [:error] [pid 28793:tid 28825] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYdA2_fxBANaHo1f49qwAAABI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:17.684364 2026] [:error] [pid 28793:tid 28808] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYdQ2_fxBANaHo1f49rQAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:18.535195 2026] [:error] [pid 28793:tid 28810] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYdg2_fxBANaHo1f49rwAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:20.271614 2026] [:error] [pid 28793:tid 28813] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYeA2_fxBANaHo1f49sQAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:21.146710 2026] [:error] [pid 28793:tid 28814] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYeQ2_fxBANaHo1f49sgAAAAc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:22.853210 2026] [:error] [pid 28793:tid 28816] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYeg2_fxBANaHo1f49tAAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:23.689167 2026] [:error] [pid 28793:tid 28827] [client 161.35.219.9:65242] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYew2_fxBANaHo1f49tQAAABQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:26.097597 2026] [:error] [pid 28908:tid 28926] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYfoqJmC8ih_lQQnDGJwAAANA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:26.958790 2026] [:error] [pid 28908:tid 28922] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYfoqJmC8ih_lQQnDGKwAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:28.596789 2026] [:error] [pid 28908:tid 28929] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYgIqJmC8ih_lQQnDGMgAAANM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:29.392722 2026] [:error] [pid 28908:tid 28928] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYgYqJmC8ih_lQQnDGNQAAANI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:31.110905 2026] [:error] [pid 28908:tid 28923] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYg4qJmC8ih_lQQnDGOgAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:31.884283 2026] [:error] [pid 28908:tid 28920] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYg4qJmC8ih_lQQnDGPQAAAMo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:33.473932 2026] [:error] [pid 28908:tid 28925] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYhYqJmC8ih_lQQnDGQwAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:34.243278 2026] [:error] [pid 28908:tid 28916] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYhoqJmC8ih_lQQnDGSAAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:35.837189 2026] [:error] [pid 28908:tid 28912] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYh4qJmC8ih_lQQnDGUQAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:36.658199 2026] [:error] [pid 28908:tid 28928] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYiIqJmC8ih_lQQnDGVwAAANI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:38.299930 2026] [:error] [pid 28908:tid 28922] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYioqJmC8ih_lQQnDGYgAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:39.061448 2026] [:error] [pid 28908:tid 28929] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYi4qJmC8ih_lQQnDGZAAAANM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:41.094756 2026] [:error] [pid 28908:tid 28921] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYjYqJmC8ih_lQQnDGdAAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:41.995463 2026] [:error] [pid 28908:tid 28924] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYjYqJmC8ih_lQQnDGgAAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:43.611083 2026] [:error] [pid 28908:tid 28919] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYj4qJmC8ih_lQQnDGjgAAAMk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:44.410953 2026] [:error] [pid 28908:tid 28932] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYkIqJmC8ih_lQQnDGkQAAANY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:46.026204 2026] [:error] [pid 28908:tid 28920] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYkoqJmC8ih_lQQnDGkwAAAMo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:46.828205 2026] [:error] [pid 28908:tid 28914] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYkoqJmC8ih_lQQnDGlAAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:48.422346 2026] [:error] [pid 28908:tid 28912] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYlIqJmC8ih_lQQnDGlgAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:49.232323 2026] [:error] [pid 28908:tid 28933] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYlYqJmC8ih_lQQnDGmAAAANc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:50.863506 2026] [:error] [pid 28908:tid 28914] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYloqJmC8ih_lQQnDGoQAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:51.675410 2026] [:error] [pid 28908:tid 28921] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYl4qJmC8ih_lQQnDGpAAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:53.255335 2026] [:error] [pid 28908:tid 28931] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYmYqJmC8ih_lQQnDGqgAAANU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:54.034517 2026] [:error] [pid 28908:tid 28933] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYmoqJmC8ih_lQQnDGrAAAANc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:55.619118 2026] [:error] [pid 28908:tid 28910] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYm4qJmC8ih_lQQnDGswAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:56.398044 2026] [:error] [pid 28908:tid 28932] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYnIqJmC8ih_lQQnDGuAAAANY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:57.992067 2026] [:error] [pid 28908:tid 28926] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYnYqJmC8ih_lQQnDGwQAAANA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:23:58.794185 2026] [:error] [pid 28908:tid 28921] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYnoqJmC8ih_lQQnDGxQAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:00.493157 2026] [:error] [pid 28908:tid 28912] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYoIqJmC8ih_lQQnDG0QAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:01.318237 2026] [:error] [pid 28908:tid 28916] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYoYqJmC8ih_lQQnDG1AAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:03.006117 2026] [:error] [pid 28908:tid 28915] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYo4qJmC8ih_lQQnDG2AAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:03.825780 2026] [:error] [pid 28908:tid 28928] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYo4qJmC8ih_lQQnDG4QAAANI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:05.534837 2026] [:error] [pid 28908:tid 28920] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYpYqJmC8ih_lQQnDG7wAAAMo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:06.444143 2026] [:error] [pid 28908:tid 28919] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYpoqJmC8ih_lQQnDG9AAAAMk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:08.115229 2026] [:error] [pid 28908:tid 28918] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYqIqJmC8ih_lQQnDG-wAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:08.941533 2026] [:error] [pid 28908:tid 28926] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYqIqJmC8ih_lQQnDHAQAAANA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:10.627057 2026] [:error] [pid 28908:tid 28914] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYqoqJmC8ih_lQQnDHCwAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:11.407706 2026] [:error] [pid 28908:tid 28917] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYq4qJmC8ih_lQQnDHDwAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:13.116743 2026] [:error] [pid 28908:tid 28923] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYrYqJmC8ih_lQQnDHGwAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:14.365507 2026] [:error] [pid 28908:tid 28915] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYroqJmC8ih_lQQnDHJgAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:16.274639 2026] [:error] [pid 28908:tid 28930] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYsIqJmC8ih_lQQnDHNgAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:17.471872 2026] [:error] [pid 28908:tid 28929] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYsYqJmC8ih_lQQnDHQwAAANM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:19.366137 2026] [:error] [pid 28908:tid 28926] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYs4qJmC8ih_lQQnDHUgAAANA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:20.215464 2026] [:error] [pid 28908:tid 28923] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYtIqJmC8ih_lQQnDHWQAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:21.933527 2026] [:error] [pid 28908:tid 28913] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYtYqJmC8ih_lQQnDHYwAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:22.745473 2026] [:error] [pid 28908:tid 28934] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYtoqJmC8ih_lQQnDHZAAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:24.445693 2026] [:error] [pid 28908:tid 28913] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYuIqJmC8ih_lQQnDHcwAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:25.264947 2026] [:error] [pid 28908:tid 28926] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYuYqJmC8ih_lQQnDHdgAAANA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:26.944150 2026] [:error] [pid 28908:tid 28918] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYuoqJmC8ih_lQQnDHggAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:27.755304 2026] [:error] [pid 28908:tid 28927] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYu4qJmC8ih_lQQnDHhQAAANE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:29.359936 2026] [:error] [pid 28908:tid 28921] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYvYqJmC8ih_lQQnDHjwAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:30.151273 2026] [:error] [pid 28908:tid 28923] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYvoqJmC8ih_lQQnDHlQAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:31.817617 2026] [:error] [pid 28908:tid 28932] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYv4qJmC8ih_lQQnDHngAAANY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:32.692955 2026] [:error] [pid 28908:tid 28919] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYwIqJmC8ih_lQQnDHpwAAAMk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:34.460685 2026] [:error] [pid 28908:tid 28928] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYwoqJmC8ih_lQQnDIEAAAANI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:35.372883 2026] [:error] [pid 28908:tid 28911] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYw4qJmC8ih_lQQnDINQAAAME"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:37.144241 2026] [:error] [pid 28908:tid 28924] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYxYqJmC8ih_lQQnDIggAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:38.160893 2026] [:error] [pid 28908:tid 28910] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYxoqJmC8ih_lQQnDImAAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:40.255460 2026] [:error] [pid 28908:tid 28923] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYyIqJmC8ih_lQQnDInQAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:41.064154 2026] [:error] [pid 28908:tid 28934] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYyYqJmC8ih_lQQnDIngAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:42.847329 2026] [:error] [pid 28908:tid 28914] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYyoqJmC8ih_lQQnDIqgAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:43.667831 2026] [:error] [pid 28908:tid 28917] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYy4qJmC8ih_lQQnDIsgAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:45.347590 2026] [:error] [pid 28908:tid 28923] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYzYqJmC8ih_lQQnDItgAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:46.169634 2026] [:error] [pid 28908:tid 28915] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTYzoqJmC8ih_lQQnDIxwAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:48.014570 2026] [:error] [pid 28908:tid 28919] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY0IqJmC8ih_lQQnDI1wAAAMk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:48.934689 2026] [:error] [pid 28908:tid 28915] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY0IqJmC8ih_lQQnDI4gAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:51.196957 2026] [:error] [pid 28908:tid 28922] [client 161.35.219.9:51883] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY04qJmC8ih_lQQnDI5AAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:52.982919 2026] [:error] [pid 31257:tid 31264] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY1P-JFLfishX45N_AmgAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:54.862490 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY1v-JFLfishX45N_ApgAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:55.772045 2026] [:error] [pid 31257:tid 31286] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY1_-JFLfishX45N_AqgAAARc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:57.514113 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY2f-JFLfishX45N_AsgAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:24:58.368941 2026] [:error] [pid 31257:tid 31272] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY2v-JFLfishX45N_AtgAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:00.212735 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY3P-JFLfishX45N_AvwAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:01.878335 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY3f-JFLfishX45N_AwgAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:03.978821 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY3_-JFLfishX45N_AzgAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:04.985924 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY4P-JFLfishX45N_A0gAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:06.886667 2026] [:error] [pid 31257:tid 31269] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY4v-JFLfishX45N_A5QAAAQY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:07.916221 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY4_-JFLfishX45N_A5wAAARY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:09.941873 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY5f-JFLfishX45N_A7QAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:10.912199 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY5v-JFLfishX45N_A7gAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:12.790643 2026] [:error] [pid 31257:tid 31280] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY6P-JFLfishX45N_A-wAAARE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:13.764119 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY6f-JFLfishX45N_BAAAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:16.021157 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY7P-JFLfishX45N_BBwAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:16.973524 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY7P-JFLfishX45N_BCAAAARU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:18.829606 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY7v-JFLfishX45N_BHwAAARM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:19.726058 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY7_-JFLfishX45N_BLgAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:21.581814 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY8f-JFLfishX45N_BOwAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:22.511615 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY8v-JFLfishX45N_BPwAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:24.629805 2026] [:error] [pid 31257:tid 31273] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY9P-JFLfishX45N_BSgAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:25.637111 2026] [:error] [pid 31257:tid 31287] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY9f-JFLfishX45N_BTAAAARg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:27.541575 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY9_-JFLfishX45N_BUgAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:28.365040 2026] [:error] [pid 31257:tid 31264] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY-P-JFLfishX45N_BVgAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:30.082432 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY-v-JFLfishX45N_BWQAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:30.939930 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY-v-JFLfishX45N_BWwAAARY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:32.693375 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY_P-JFLfishX45N_BYgAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:33.566687 2026] [:error] [pid 31257:tid 31287] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY_f-JFLfishX45N_BZQAAARg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:35.251725 2026] [:error] [pid 31257:tid 31280] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTY__-JFLfishX45N_BbQAAARE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:36.188750 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZAP-JFLfishX45N_BcQAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:38.003044 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZAv-JFLfishX45N_BewAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:38.843867 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZAv-JFLfishX45N_BgAAAARM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:40.521684 2026] [:error] [pid 31257:tid 31286] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZBP-JFLfishX45N_BiwAAARc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:41.425716 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZBf-JFLfishX45N_BkgAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:43.075726 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZB_-JFLfishX45N_BoQAAARA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:43.892055 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZB_-JFLfishX45N_BqAAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:45.637590 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZCf-JFLfishX45N_BsQAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:46.530191 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZCv-JFLfishX45N_BtgAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:48.280931 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZDP-JFLfishX45N_BwwAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:49.162764 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZDf-JFLfishX45N_BzAAAARU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:50.925362 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZDv-JFLfishX45N_B1wAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:51.726377 2026] [:error] [pid 31257:tid 31286] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZD_-JFLfishX45N_B3gAAARc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:53.450406 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZEf-JFLfishX45N_B6gAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:54.724699 2026] [:error] [pid 31257:tid 31280] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZEv-JFLfishX45N_B8AAAARE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:56.402285 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZFP-JFLfishX45N_B9gAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:57.194743 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZFf-JFLfishX45N_B-QAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:58.928888 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZFv-JFLfishX45N_CAQAAARY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:25:59.771807 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZF_-JFLfishX45N_CCAAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:01.595327 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZGf-JFLfishX45N_CDAAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:02.415354 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZGv-JFLfishX45N_CEAAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:04.049145 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZHP-JFLfishX45N_CEwAAARY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:04.838269 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZHP-JFLfishX45N_CFAAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:06.479712 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZHv-JFLfishX45N_CGAAAARU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:07.633150 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZH_-JFLfishX45N_CHAAAARU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:09.202406 2026] [:error] [pid 31257:tid 31263] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZIf-JFLfishX45N_CIAAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:09.975727 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZIf-JFLfishX45N_CJAAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:11.604618 2026] [:error] [pid 31257:tid 31269] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZI_-JFLfishX45N_CJwAAAQY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:12.426736 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZJP-JFLfishX45N_CKAAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:14.013923 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZJv-JFLfishX45N_CMAAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:14.808107 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZJv-JFLfishX45N_CNQAAARA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:16.399081 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZKP-JFLfishX45N_CRAAAARA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:17.195814 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZKf-JFLfishX45N_CSQAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:18.777365 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZKv-JFLfishX45N_CTQAAARU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:19.591491 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZK_-JFLfishX45N_CTwAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:21.202653 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZLf-JFLfishX45N_CUgAAARM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:22.035785 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:54668] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZLv-JFLfishX45N_CVQAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:24.518663 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:58635] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZMCrocdArcJqFfIljbQAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:25.330747 2026] [:error] [pid 21575:tid 21587] [client 161.35.219.9:58635] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZMSrocdArcJqFfIljdAAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:26.984008 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:58635] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZMirocdArcJqFfIljgAAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:27.805119 2026] [:error] [pid 21575:tid 21582] [client 161.35.219.9:58635] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZMyrocdArcJqFfIljhQAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:29.385924 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:58635] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZNSrocdArcJqFfIljigAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:30.192578 2026] [:error] [pid 21575:tid 21592] [client 161.35.219.9:58635] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZNirocdArcJqFfIljiwAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:31.793958 2026] [:error] [pid 21575:tid 21590] [client 161.35.219.9:58635] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZNyrocdArcJqFfIljjgAAAUs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:32.609088 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:58635] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZOCrocdArcJqFfIljjwAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:34.197921 2026] [:error] [pid 21575:tid 21596] [client 161.35.219.9:58635] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZOirocdArcJqFfIljmAAAAVE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:34.972407 2026] [:error] [pid 21575:tid 21593] [client 161.35.219.9:58635] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZOirocdArcJqFfIljnwAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:34.972487 2026] [:error] [pid 21575:tid 21593] [client 161.35.219.9:58635] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZOirocdArcJqFfIljnwAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:36.820199 2026] [:error] [pid 28795:tid 28876] [client 161.35.219.9:60858] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZPLROd53wZBkdI_eAAAAAAI0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:37.624127 2026] [:error] [pid 28795:tid 28879] [client 161.35.219.9:60858] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZPbROd53wZBkdI_eAAQAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:39.317451 2026] [:error] [pid 28795:tid 28881] [client 161.35.219.9:60858] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZP7ROd53wZBkdI_eABwAAAJI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:40.194861 2026] [:error] [pid 28795:tid 28864] [client 161.35.219.9:60858] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZQLROd53wZBkdI_eACAAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:41.931620 2026] [:error] [pid 28795:tid 28870] [client 161.35.219.9:60858] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZQbROd53wZBkdI_eACwAAAIc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:42.750072 2026] [:error] [pid 28795:tid 28876] [client 161.35.219.9:60858] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZQrROd53wZBkdI_eADAAAAI0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:44.467574 2026] [:error] [pid 28795:tid 28875] [client 161.35.219.9:60858] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZRLROd53wZBkdI_eADgAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:44.467632 2026] [:error] [pid 28795:tid 28875] [client 161.35.219.9:60858] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZRLROd53wZBkdI_eADgAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:45.475200 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:62935] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTZRSrocdArcJqFfIljuAAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:46.532919 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:63139] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTZRv-JFLfishX45N_CfAAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:47.558970 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:63442] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTZR_-JFLfishX45N_CfwAAARY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:48.583279 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZSCrocdArcJqFfIljwAAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:50.268161 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZSirocdArcJqFfIljyQAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:51.143728 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZSyrocdArcJqFfIljzgAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:52.879437 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZTCrocdArcJqFfIlj2wAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:53.710635 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZTSrocdArcJqFfIlj3gAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:55.429544 2026] [:error] [pid 21575:tid 21600] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZTyrocdArcJqFfIlj4gAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:56.262836 2026] [:error] [pid 21575:tid 21582] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZUCrocdArcJqFfIlj4wAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:57.943326 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZUSrocdArcJqFfIlj5wAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:26:58.739758 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZUirocdArcJqFfIlj6QAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:00.408433 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZVCrocdArcJqFfIlj-gAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:01.374021 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZVSrocdArcJqFfIlj_gAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:03.181199 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZVyrocdArcJqFfIlkBwAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:04.121407 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZWCrocdArcJqFfIlkDAAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:05.832662 2026] [:error] [pid 21575:tid 21588] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZWSrocdArcJqFfIlkFQAAAUk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:06.678636 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZWirocdArcJqFfIlkHAAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:08.387062 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZXCrocdArcJqFfIlkKQAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:09.263547 2026] [:error] [pid 21575:tid 21581] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZXSrocdArcJqFfIlkLgAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:10.901996 2026] [:error] [pid 21575:tid 21590] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZXirocdArcJqFfIlkMwAAAUs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:11.707608 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZXyrocdArcJqFfIlkNQAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:13.449946 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZYSrocdArcJqFfIlkPAAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:14.266938 2026] [:error] [pid 21575:tid 21593] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZYirocdArcJqFfIlkPgAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:16.008304 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZZCrocdArcJqFfIlkQgAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:16.862040 2026] [:error] [pid 21575:tid 21593] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZZCrocdArcJqFfIlkRAAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:18.488555 2026] [:error] [pid 21575:tid 21588] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZZirocdArcJqFfIlkUAAAAUk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:19.284863 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZZyrocdArcJqFfIlkUwAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:20.887989 2026] [:error] [pid 21575:tid 21582] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZaCrocdArcJqFfIlkWAAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:21.642540 2026] [:error] [pid 21575:tid 21601] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZaSrocdArcJqFfIlkWQAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:24.226579 2026] [:error] [pid 21575:tid 21588] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZbCrocdArcJqFfIlkZwAAAUk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:25.036851 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZbSrocdArcJqFfIlkbgAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:26.646072 2026] [:error] [pid 21575:tid 21593] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZbirocdArcJqFfIlkdwAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:27.493123 2026] [:error] [pid 21575:tid 21588] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZbyrocdArcJqFfIlkewAAAUk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:30.610812 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZcirocdArcJqFfIlkiQAAAVI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:31.515496 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZcyrocdArcJqFfIlkjAAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:33.193928 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZdSrocdArcJqFfIlkmAAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:34.032014 2026] [:error] [pid 21575:tid 21581] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZdirocdArcJqFfIlknQAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:35.719550 2026] [:error] [pid 21575:tid 21583] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZdyrocdArcJqFfIlkoAAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:36.522282 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZeCrocdArcJqFfIlkogAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:38.255511 2026] [:error] [pid 21575:tid 21593] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZeirocdArcJqFfIlkpAAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:39.126551 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZeyrocdArcJqFfIlkpQAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:41.111468 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZfSrocdArcJqFfIlkqQAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:42.138112 2026] [:error] [pid 21575:tid 21593] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZfirocdArcJqFfIlkrwAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:43.950746 2026] [:error] [pid 21575:tid 21587] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZfyrocdArcJqFfIlkuQAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:44.783613 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZgCrocdArcJqFfIlkvwAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:45.750299 2026] [:error] [pid 21575:tid 21581] [client 161.35.219.9:63648] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTZgSrocdArcJqFfIlkyQAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:46.761038 2026] [:error] [pid 28908:tid 28921] [client 161.35.219.9:60233] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTZgoqJmC8ih_lQQnDNPAAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:47.757162 2026] [:error] [pid 31257:tid 31272] [client 161.35.219.9:60519] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTZg_-JFLfishX45N_C1gAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:48.768727 2026] [:error] [pid 31257:tid 31287] [client 161.35.219.9:60743] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTZhP-JFLfishX45N_C2wAAARg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:49.791266 2026] [:error] [pid 28908:tid 28929] [client 161.35.219.9:60993] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZhYqJmC8ih_lQQnDNZAAAANM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:51.455822 2026] [:error] [pid 28908:tid 28931] [client 161.35.219.9:60993] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZh4qJmC8ih_lQQnDNdAAAANU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:52.272297 2026] [:error] [pid 28908:tid 28932] [client 161.35.219.9:60993] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZiIqJmC8ih_lQQnDNdQAAANY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:52.272433 2026] [:error] [pid 28908:tid 28932] [client 161.35.219.9:60993] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZiIqJmC8ih_lQQnDNdQAAANY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:55.278230 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:61755] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZiyrocdArcJqFfIlk7wAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:56.131211 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:61755] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZjCrocdArcJqFfIlk8wAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:57.744786 2026] [:error] [pid 21575:tid 21596] [client 161.35.219.9:61755] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZjSrocdArcJqFfIlk-AAAAVE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:27:58.555077 2026] [:error] [pid 21575:tid 21583] [client 161.35.219.9:61755] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZjirocdArcJqFfIlk-QAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:00.145072 2026] [:error] [pid 21575:tid 21592] [client 161.35.219.9:61755] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZkCrocdArcJqFfIlk_gAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:01.088090 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:61755] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZkSrocdArcJqFfIllAgAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:02.726479 2026] [:error] [pid 21575:tid 21600] [client 161.35.219.9:61755] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZkirocdArcJqFfIllCgAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:03.566962 2026] [:error] [pid 21575:tid 21601] [client 161.35.219.9:61755] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZkyrocdArcJqFfIllEgAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:04.378957 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:61755] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTZlCrocdArcJqFfIllGgAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:05.420633 2026] [:error] [pid 28908:tid 28917] [client 161.35.219.9:64451] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTZlYqJmC8ih_lQQnDNwgAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:06.438980 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:64698] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTZlirocdArcJqFfIllIAAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:07.462419 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:64991] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTZlyrocdArcJqFfIllJQAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:08.462495 2026] [:error] [pid 21575:tid 21587] [client 161.35.219.9:65213] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZmCrocdArcJqFfIllKAAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:10.105454 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:65213] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZmirocdArcJqFfIllLgAAAVI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:10.908636 2026] [:error] [pid 21575:tid 21598] [client 161.35.219.9:65213] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZmirocdArcJqFfIllLwAAAVM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:12.592088 2026] [:error] [pid 21575:tid 21601] [client 161.35.219.9:65213] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZnCrocdArcJqFfIllNgAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:13.391179 2026] [:error] [pid 21575:tid 21583] [client 161.35.219.9:65213] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZnSrocdArcJqFfIllOAAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:15.093098 2026] [:error] [pid 21575:tid 21592] [client 161.35.219.9:65213] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZnyrocdArcJqFfIllQgAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:15.950642 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:65213] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZnyrocdArcJqFfIllSQAAAVI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:17.659557 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:65213] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZoSrocdArcJqFfIllUwAAAVI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:18.512257 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:65213] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZoirocdArcJqFfIllVwAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:20.201463 2026] [:error] [pid 21575:tid 21592] [client 161.35.219.9:65213] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZpCrocdArcJqFfIllXgAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:21.065761 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:65213] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZpSrocdArcJqFfIllZAAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:21.872086 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:65213] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTZpSrocdArcJqFfIllbAAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:22.896973 2026] [:error] [pid 28795:tid 28863] [client 161.35.219.9:51938] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTZprROd53wZBkdI_eAeQAAAIA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:23.912889 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:52154] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTZp_-JFLfishX45N_C_AAAARY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:24.911730 2026] [:error] [pid 28794:tid 28842] [client 161.35.219.9:52385] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTZqKVy2qpaelbUob1WSAAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:25.933459 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:52600] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZqSrocdArcJqFfIlldwAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:27.683154 2026] [:error] [pid 21575:tid 21590] [client 161.35.219.9:52600] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZqyrocdArcJqFfIllhwAAAUs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:28.491523 2026] [:error] [pid 21575:tid 21581] [client 161.35.219.9:52600] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZrCrocdArcJqFfIlljwAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:28.491602 2026] [:error] [pid 21575:tid 21581] [client 161.35.219.9:52600] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZrCrocdArcJqFfIlljwAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:30.426604 2026] [:error] [pid 21575:tid 21586] [client 161.35.219.9:53392] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZrirocdArcJqFfIllmQAAAUc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:31.234537 2026] [:error] [pid 21575:tid 21582] [client 161.35.219.9:53392] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZryrocdArcJqFfIllmwAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:32.917037 2026] [:error] [pid 21575:tid 21587] [client 161.35.219.9:53392] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZsCrocdArcJqFfIllpgAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:33.792105 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:53392] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZsSrocdArcJqFfIllqQAAAVI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:35.522637 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:53392] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZsyrocdArcJqFfIllswAAAVI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:36.494498 2026] [:error] [pid 21575:tid 21587] [client 161.35.219.9:53392] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZtCrocdArcJqFfIlltgAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:38.225454 2026] [:error] [pid 21575:tid 21580] [client 161.35.219.9:53392] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZtirocdArcJqFfIllwAAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:39.134880 2026] [:error] [pid 21575:tid 21583] [client 161.35.219.9:53392] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZtyrocdArcJqFfIllxwAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:41.025636 2026] [:error] [pid 21575:tid 21580] [client 161.35.219.9:53392] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZuSrocdArcJqFfIll0gAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:42.217045 2026] [:error] [pid 21575:tid 21580] [client 161.35.219.9:53392] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZuirocdArcJqFfIll3QAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:44.050303 2026] [:error] [pid 21575:tid 21581] [client 161.35.219.9:53392] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZvCrocdArcJqFfIll4wAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:44.930099 2026] [:error] [pid 21575:tid 21587] [client 161.35.219.9:53392] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZvCrocdArcJqFfIll6AAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:46.760365 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:53392] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZvirocdArcJqFfIll8QAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:47.629175 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:53392] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZvyrocdArcJqFfIll9wAAAVI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:49.386957 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:53392] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZwSrocdArcJqFfIll_wAAAVI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:50.256218 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:53392] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZwirocdArcJqFfIlmAwAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:52.139781 2026] [:error] [pid 21575:tid 21585] [client 161.35.219.9:53392] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZxCrocdArcJqFfIlmCAAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:53.083487 2026] [:error] [pid 21575:tid 21586] [client 161.35.219.9:53392] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZxSrocdArcJqFfIlmCQAAAUc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:54.777577 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:53392] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZxirocdArcJqFfIlmDwAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:55.709927 2026] [:error] [pid 21575:tid 21582] [client 161.35.219.9:53392] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZxyrocdArcJqFfIlmFAAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:56.540177 2026] [:error] [pid 21575:tid 21596] [client 161.35.219.9:53392] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTZyCrocdArcJqFfIlmFgAAAVE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:57.548961 2026] [:error] [pid 28795:tid 28864] [client 161.35.219.9:59514] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTZybROd53wZBkdI_eAuQAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:58.573517 2026] [:error] [pid 28795:tid 28870] [client 161.35.219.9:59734] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTZyrROd53wZBkdI_eAvQAAAIc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:28:59.624071 2026] [:error] [pid 28795:tid 28886] [client 161.35.219.9:59965] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTZy7ROd53wZBkdI_eAwQAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:00.645847 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:60222] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZzCrocdArcJqFfIlmJAAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:02.346684 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:60222] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZzirocdArcJqFfIlmMAAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:03.167496 2026] [:error] [pid 21575:tid 21582] [client 161.35.219.9:60222] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZzyrocdArcJqFfIlmNwAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:04.818997 2026] [:error] [pid 21575:tid 21582] [client 161.35.219.9:60222] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ0CrocdArcJqFfIlmQQAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:05.599059 2026] [:error] [pid 21575:tid 21596] [client 161.35.219.9:60222] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ0SrocdArcJqFfIlmSgAAAVE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:07.248044 2026] [:error] [pid 21575:tid 21598] [client 161.35.219.9:60222] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ0yrocdArcJqFfIlmTwAAAVM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:08.085108 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:60222] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ1CrocdArcJqFfIlmVQAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:09.757345 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:60222] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ1SrocdArcJqFfIlmYwAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:10.591033 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:60222] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ1irocdArcJqFfIlmaQAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:12.315523 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:60222] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ2CrocdArcJqFfIlmdAAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:13.190212 2026] [:error] [pid 21575:tid 21600] [client 161.35.219.9:60222] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ2SrocdArcJqFfIlmdgAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:14.996086 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:60222] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ2irocdArcJqFfIlmiwAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:14.996146 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:60222] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ2irocdArcJqFfIlmiwAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:16.015217 2026] [:error] [pid 28794:tid 28856] [client 161.35.219.9:63713] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTZ3KVy2qpaelbUob1WbAAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:17.038379 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:63945] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTZ3SrocdArcJqFfIlmngAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:18.107181 2026] [:error] [pid 28908:tid 28913] [client 161.35.219.9:64200] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTZ3oqJmC8ih_lQQnDPWwAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:19.166680 2026] [:error] [pid 21575:tid 21601] [client 161.35.219.9:64447] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ3yrocdArcJqFfIlmtAAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:20.839405 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:64447] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ4CrocdArcJqFfIlmwgAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:21.654189 2026] [:error] [pid 21575:tid 21592] [client 161.35.219.9:64447] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ4SrocdArcJqFfIlmyQAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:23.421927 2026] [:error] [pid 21575:tid 21598] [client 161.35.219.9:64447] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ4yrocdArcJqFfIlm1wAAAVM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:23.422011 2026] [:error] [pid 21575:tid 21598] [client 161.35.219.9:64447] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ4yrocdArcJqFfIlm1wAAAVM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:25.587514 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:49556] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTZ5f-JFLfishX45N_DbgAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:26.642404 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:49785] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTZ5irocdArcJqFfIlm7AAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:27.644707 2026] [:error] [pid 21575:tid 21596] [client 161.35.219.9:50116] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ5yrocdArcJqFfIlm9QAAAVE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:29.312595 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:50116] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ6SrocdArcJqFfIlnCQAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:30.224945 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:50116] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ6irocdArcJqFfIlnEgAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:30.225039 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:50116] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ6irocdArcJqFfIlnEgAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:31.257333 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:51027] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTZ6yrocdArcJqFfIlnHAAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:32.305938 2026] [:error] [pid 21575:tid 21600] [client 161.35.219.9:51248] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTZ7CrocdArcJqFfIlnJQAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:33.314433 2026] [:error] [pid 21575:tid 21583] [client 161.35.219.9:51470] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTZ7SrocdArcJqFfIlnMgAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:34.332564 2026] [:error] [pid 21575:tid 21583] [client 161.35.219.9:51723] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTZ7irocdArcJqFfIlnOgAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:35.375151 2026] [:error] [pid 28908:tid 28934] [client 161.35.219.9:51937] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ74qJmC8ih_lQQnDPlQAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:37.195386 2026] [:error] [pid 28908:tid 28912] [client 161.35.219.9:51937] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ8YqJmC8ih_lQQnDPoQAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:38.056977 2026] [:error] [pid 28908:tid 28932] [client 161.35.219.9:51937] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ8oqJmC8ih_lQQnDPpAAAANY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:39.792304 2026] [:error] [pid 28908:tid 28913] [client 161.35.219.9:51937] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ84qJmC8ih_lQQnDPqAAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:40.737814 2026] [:error] [pid 28908:tid 28923] [client 161.35.219.9:51937] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ9IqJmC8ih_lQQnDPrQAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:42.506042 2026] [:error] [pid 28908:tid 28910] [client 161.35.219.9:51937] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ9oqJmC8ih_lQQnDPwgAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:43.292070 2026] [:error] [pid 28908:tid 28912] [client 161.35.219.9:51937] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ94qJmC8ih_lQQnDPyQAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:43.292132 2026] [:error] [pid 28908:tid 28912] [client 161.35.219.9:51937] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ94qJmC8ih_lQQnDPyQAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:45.172376 2026] [:error] [pid 31257:tid 31263] [client 161.35.219.9:53957] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ-f-JFLfishX45N_DrQAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:46.044932 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:53957] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ-v-JFLfishX45N_DtgAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:48.102417 2026] [:error] [pid 31257:tid 31263] [client 161.35.219.9:53957] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ_P-JFLfishX45N_DvQAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:49.136920 2026] [:error] [pid 31257:tid 31272] [client 161.35.219.9:53957] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ_f-JFLfishX45N_DwAAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:51.294905 2026] [:error] [pid 31257:tid 31287] [client 161.35.219.9:53957] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTZ__-JFLfishX45N_DxgAAARg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:52.661687 2026] [:error] [pid 31257:tid 31287] [client 161.35.219.9:53957] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaAP-JFLfishX45N_DxwAAARg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:54.474308 2026] [:error] [pid 31257:tid 31264] [client 161.35.219.9:53957] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaAv-JFLfishX45N_DzQAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:55.321681 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:53957] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaA_-JFLfishX45N_D0AAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:57.133961 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:53957] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaBf-JFLfishX45N_D1QAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:58.066284 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:53957] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaBv-JFLfishX45N_D1wAAARY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:29:59.809481 2026] [:error] [pid 31257:tid 31264] [client 161.35.219.9:53957] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaB_-JFLfishX45N_D3gAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:00.742810 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:53957] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaCP-JFLfishX45N_D3wAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:02.658760 2026] [:error] [pid 31257:tid 31273] [client 161.35.219.9:53957] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaCv-JFLfishX45N_D4QAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:03.503582 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:53957] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaC_-JFLfishX45N_D5AAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:03.503699 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:53957] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaC_-JFLfishX45N_D5AAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:05.446987 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:58179] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaDSrocdArcJqFfIloFwAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:06.617865 2026] [:error] [pid 21575:tid 21585] [client 161.35.219.9:58179] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaDirocdArcJqFfIloGAAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:08.401430 2026] [:error] [pid 21575:tid 21585] [client 161.35.219.9:58179] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaECrocdArcJqFfIloJgAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:09.314984 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:58179] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaESrocdArcJqFfIloLwAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:11.283336 2026] [:error] [pid 21575:tid 21598] [client 161.35.219.9:58179] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaEyrocdArcJqFfIloPgAAAVM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:12.119181 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:58179] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaFCrocdArcJqFfIloRAAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:14.006191 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:58179] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaFirocdArcJqFfIloVAAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:14.839047 2026] [:error] [pid 21575:tid 21586] [client 161.35.219.9:58179] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaFirocdArcJqFfIloWgAAAUc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:16.660267 2026] [:error] [pid 21575:tid 21588] [client 161.35.219.9:58179] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaGCrocdArcJqFfIloZwAAAUk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:17.552537 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:58179] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaGSrocdArcJqFfIloawAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:19.326959 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:58179] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaGyrocdArcJqFfIlogwAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:20.188841 2026] [:error] [pid 21575:tid 21598] [client 161.35.219.9:58179] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaHCrocdArcJqFfIlojgAAAVM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:21.988574 2026] [:error] [pid 21575:tid 21587] [client 161.35.219.9:58179] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaHSrocdArcJqFfIlooAAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:22.835761 2026] [:error] [pid 21575:tid 21586] [client 161.35.219.9:58179] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaHirocdArcJqFfIlopwAAAUc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:24.571997 2026] [:error] [pid 21575:tid 21582] [client 161.35.219.9:58179] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaICrocdArcJqFfIlotwAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:25.384200 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:58179] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaISrocdArcJqFfIlougAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:25.384282 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:58179] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaISrocdArcJqFfIlougAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:27.330741 2026] [:error] [pid 21575:tid 21600] [client 161.35.219.9:62628] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaIyrocdArcJqFfIlo0QAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:28.202183 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:62628] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaJCrocdArcJqFfIlo2AAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:28.202270 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:62628] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaJCrocdArcJqFfIlo2AAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:30.081068 2026] [:error] [pid 31257:tid 31263] [client 161.35.219.9:63253] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaJv-JFLfishX45N_ECQAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:30.081139 2026] [:error] [pid 31257:tid 31263] [client 161.35.219.9:63253] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaJv-JFLfishX45N_ECQAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:31.107542 2026] [:error] [pid 28793:tid 28820] [client 161.35.219.9:63646] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTaJw2_fxBANaHo1f4_CgAAAA0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:32.125626 2026] [:error] [pid 28908:tid 28911] [client 161.35.219.9:63841] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTaKIqJmC8ih_lQQnDQpgAAAME"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:33.145403 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:64064] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTaKSrocdArcJqFfIlo6wAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:34.158577 2026] [:error] [pid 28795:tid 28880] [client 161.35.219.9:64275] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaKrROd53wZBkdI_eBXwAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:34.158659 2026] [:error] [pid 28795:tid 28880] [client 161.35.219.9:64275] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaKrROd53wZBkdI_eBXwAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:36.044663 2026] [:error] [pid 28795:tid 28863] [client 161.35.219.9:64494] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaLLROd53wZBkdI_eBYQAAAIA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:36.837245 2026] [:error] [pid 28795:tid 28877] [client 161.35.219.9:64494] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaLLROd53wZBkdI_eBZAAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:36.837313 2026] [:error] [pid 28795:tid 28877] [client 161.35.219.9:64494] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaLLROd53wZBkdI_eBZAAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:38.747858 2026] [:error] [pid 28795:tid 28872] [client 161.35.219.9:65045] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaLrROd53wZBkdI_eBaQAAAIk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:39.582145 2026] [:error] [pid 28795:tid 28886] [client 161.35.219.9:65045] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaL7ROd53wZBkdI_eBagAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:41.404362 2026] [:error] [pid 28795:tid 28884] [client 161.35.219.9:65045] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaMbROd53wZBkdI_eBbAAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:42.309779 2026] [:error] [pid 28795:tid 28887] [client 161.35.219.9:65045] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaMrROd53wZBkdI_eBbwAAAJg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:44.314562 2026] [:error] [pid 28795:tid 28880] [client 161.35.219.9:65045] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaNLROd53wZBkdI_eBdAAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:45.207294 2026] [:error] [pid 28795:tid 28863] [client 161.35.219.9:65045] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaNbROd53wZBkdI_eBdgAAAIA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:45.207425 2026] [:error] [pid 28795:tid 28863] [client 161.35.219.9:65045] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaNbROd53wZBkdI_eBdgAAAIA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:46.237914 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:50357] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTaNirocdArcJqFfIlpIwAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:47.280012 2026] [:error] [pid 28795:tid 28884] [client 161.35.219.9:50597] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTaN7ROd53wZBkdI_eBjwAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:48.312925 2026] [:error] [pid 28908:tid 28918] [client 161.35.219.9:50817] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTaOIqJmC8ih_lQQnDQ2wAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:49.338568 2026] [:error] [pid 28794:tid 28837] [client 161.35.219.9:51010] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTaOaVy2qpaelbUob1XAgAAAEE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:50.384472 2026] [:error] [pid 28794:tid 28854] [client 161.35.219.9:51254] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaOqVy2qpaelbUob1XBQAAAFI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:53.533967 2026] [:error] [pid 28794:tid 28844] [client 161.35.219.9:51254] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaPaVy2qpaelbUob1XBwAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:54.808085 2026] [:error] [pid 28794:tid 28838] [client 161.35.219.9:51254] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaPqVy2qpaelbUob1XDAAAAEI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:55.917460 2026] [:error] [pid 28794:tid 28841] [client 161.35.219.9:51254] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTaP6Vy2qpaelbUob1XDwAAAEU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:56.943842 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:52614] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTaQP-JFLfishX45N_ElwAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:57.969466 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:52868] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTaQf-JFLfishX45N_EnAAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:30:58.985298 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:53120] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTaQkzkQFuA2qBk8UMYxAAAAYU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:00.001744 2026] [:error] [pid 28908:tid 28918] [client 161.35.219.9:53351] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaRIqJmC8ih_lQQnDQ9wAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:02.350948 2026] [:error] [pid 28908:tid 28924] [client 161.35.219.9:53351] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaRoqJmC8ih_lQQnDQ-wAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:03.147911 2026] [:error] [pid 28908:tid 28929] [client 161.35.219.9:53351] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaR4qJmC8ih_lQQnDQ_AAAANM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:03.988592 2026] [:error] [pid 28908:tid 28928] [client 161.35.219.9:53351] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTaR4qJmC8ih_lQQnDQ_wAAANI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:05.130196 2026] [:error] [pid 21575:tid 21581] [client 161.35.219.9:54523] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTaSSrocdArcJqFfIlpcwAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:06.318197 2026] [:error] [pid 28794:tid 28846] [client 161.35.219.9:54775] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTaSqVy2qpaelbUob1XFQAAAEo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:07.534346 2026] [:error] [pid 28908:tid 28928] [client 161.35.219.9:55082] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTaS4qJmC8ih_lQQnDRCQAAANI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:08.584901 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:55371] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaTP-JFLfishX45N_EtQAAARY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:10.286140 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:55371] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaTv-JFLfishX45N_EtwAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:11.169517 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:55371] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaT_-JFLfishX45N_EugAAARA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:11.169598 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:55371] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaT_-JFLfishX45N_EugAAARA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:13.073927 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:56254] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaUf-JFLfishX45N_EvwAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:14.275686 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:56254] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaUv-JFLfishX45N_EwgAAARA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:14.275772 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:56254] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaUv-JFLfishX45N_EwgAAARA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:17.896063 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:56966] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaVUzkQFuA2qBk8UMY7AAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:17.896149 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:56966] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaVUzkQFuA2qBk8UMY7AAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:18.916319 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:57853] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTaVkzkQFuA2qBk8UMY8gAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:19.921094 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:58113] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTaV_-JFLfishX45N_E0AAAARY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:20.953493 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:58377] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTaWEzkQFuA2qBk8UMZEgAAAYI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:21.963570 2026] [:error] [pid 28795:tid 28883] [client 161.35.219.9:58599] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaWbROd53wZBkdI_eB2QAAAJQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:21.963642 2026] [:error] [pid 28795:tid 28883] [client 161.35.219.9:58599] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaWbROd53wZBkdI_eB2QAAAJQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:23.845945 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:58850] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaW0zkQFuA2qBk8UMZHQAAAZA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:24.739500 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:58850] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaXEzkQFuA2qBk8UMZMAAAAYk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:24.739574 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:58850] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaXEzkQFuA2qBk8UMZMAAAAYk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:26.630912 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:59472] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaXkzkQFuA2qBk8UMZPwAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:27.448547 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:59472] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaX0zkQFuA2qBk8UMZRwAAAYY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:29.070075 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:59472] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaYUzkQFuA2qBk8UMZUgAAAYY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:29.923924 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:59472] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaYUzkQFuA2qBk8UMZVQAAAYk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:31.612367 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:59472] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaY0zkQFuA2qBk8UMZXwAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:31.612547 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:59472] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaY0zkQFuA2qBk8UMZXwAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:32.631640 2026] [:error] [pid 28908:tid 28932] [client 161.35.219.9:61182] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTaZIqJmC8ih_lQQnDRLAAAANY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:33.646277 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:61413] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTaZUzkQFuA2qBk8UMZZwAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:34.699106 2026] [:error] [pid 23872:tid 23894] [client 161.35.219.9:61664] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTaZkzkQFuA2qBk8UMZbgAAAZM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:35.724151 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:61889] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaZyrocdArcJqFfIlprQAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:35.724257 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:61889] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaZyrocdArcJqFfIlprQAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:37.575839 2026] [:error] [pid 31257:tid 31269] [client 161.35.219.9:62131] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaaf-JFLfishX45N_FRgAAAQY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:38.364149 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:62131] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaav-JFLfishX45N_FTAAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:40.091883 2026] [:error] [pid 31257:tid 31286] [client 161.35.219.9:62131] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTabP-JFLfishX45N_FWAAAARc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:40.958688 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:62131] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTabP-JFLfishX45N_FZAAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:42.971018 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:62131] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTabv-JFLfishX45N_FbAAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:43.950993 2026] [:error] [pid 31257:tid 31273] [client 161.35.219.9:62131] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTab_-JFLfishX45N_FbgAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:43.951059 2026] [:error] [pid 31257:tid 31273] [client 161.35.219.9:62131] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTab_-JFLfishX45N_FbgAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:45.815025 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:64177] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTacUzkQFuA2qBk8UMZwgAAAYA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:46.647910 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:64177] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTackzkQFuA2qBk8UMZwwAAAYY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:48.261401 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:64177] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTadEzkQFuA2qBk8UMZzgAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:49.049232 2026] [:error] [pid 23872:tid 23876] [client 161.35.219.9:64177] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTadUzkQFuA2qBk8UMZ0AAAAYE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:50.828675 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:64177] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTadkzkQFuA2qBk8UMZ0gAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:51.683507 2026] [:error] [pid 23872:tid 23883] [client 161.35.219.9:64177] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTad0zkQFuA2qBk8UMZ0wAAAYg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:53.396251 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:64177] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaeUzkQFuA2qBk8UMZ4wAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:54.255951 2026] [:error] [pid 23872:tid 23885] [client 161.35.219.9:64177] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaekzkQFuA2qBk8UMZ5QAAAYo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:54.256020 2026] [:error] [pid 23872:tid 23885] [client 161.35.219.9:64177] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaekzkQFuA2qBk8UMZ5QAAAYo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:56.273506 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:50267] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTafP-JFLfishX45N_FowAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:57.143877 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:50267] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaff-JFLfishX45N_FpwAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:58.819216 2026] [:error] [pid 31257:tid 31273] [client 161.35.219.9:50267] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTafv-JFLfishX45N_FswAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:59.679521 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:50267] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaf_-JFLfishX45N_FuwAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:31:59.679579 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:50267] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaf_-JFLfishX45N_FuwAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:00.694381 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:51538] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTagEzkQFuA2qBk8UMZ8gAAAZI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:01.711182 2026] [:error] [pid 28908:tid 28914] [client 161.35.219.9:51767] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTagYqJmC8ih_lQQnDRXwAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:02.737033 2026] [:error] [pid 28794:tid 28853] [client 161.35.219.9:51987] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTagqVy2qpaelbUob1XSAAAAFE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:03.769719 2026] [:error] [pid 28794:tid 28837] [client 161.35.219.9:52204] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTag6Vy2qpaelbUob1XSQAAAEE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:04.808585 2026] [:error] [pid 31257:tid 31272] [client 161.35.219.9:52413] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTahP-JFLfishX45N_FyQAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:04.808651 2026] [:error] [pid 31257:tid 31272] [client 161.35.219.9:52413] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTahP-JFLfishX45N_FyQAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:06.732729 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:52656] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTahv-JFLfishX45N_F0QAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:06.732801 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:52656] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTahv-JFLfishX45N_F0QAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:07.728048 2026] [:error] [pid 28793:tid 28824] [client 161.35.219.9:53117] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTahw2_fxBANaHo1f4_eQAAABE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:08.754298 2026] [:error] [pid 21575:tid 21587] [client 161.35.219.9:53315] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTaiCrocdArcJqFfIlqAgAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:09.778106 2026] [:error] [pid 31257:tid 31263] [client 161.35.219.9:53561] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTaif-JFLfishX45N_F2wAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:10.772753 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:53790] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaiv-JFLfishX45N_F4AAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:10.772874 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:53790] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaiv-JFLfishX45N_F4AAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:11.787125 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:54018] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTai_-JFLfishX45N_F5gAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:12.808998 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:54281] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTajP-JFLfishX45N_F7wAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:13.821662 2026] [:error] [pid 21575:tid 21596] [client 161.35.219.9:54515] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTajSrocdArcJqFfIlqCwAAAVE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:14.840475 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:54751] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTajkzkQFuA2qBk8UMaGAAAAYY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:15.849925 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:54998] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaj0zkQFuA2qBk8UMaHgAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:15.849997 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:54998] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaj0zkQFuA2qBk8UMaHgAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:17.958097 2026] [:error] [pid 21575:tid 21601] [client 161.35.219.9:55265] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTakSrocdArcJqFfIlqEgAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:18.862512 2026] [:error] [pid 21575:tid 21583] [client 161.35.219.9:55265] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTakirocdArcJqFfIlqFQAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:20.700662 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:55265] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTalCrocdArcJqFfIlqGQAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:21.615004 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:55265] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTalSrocdArcJqFfIlqGwAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:22.555473 2026] [:error] [pid 21575:tid 21580] [client 161.35.219.9:55265] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTalirocdArcJqFfIlqHAAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:23.583025 2026] [:error] [pid 31257:tid 31275] [client 161.35.219.9:56833] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTal_-JFLfishX45N_GEgAAAQw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:24.615408 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:57055] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTamEzkQFuA2qBk8UMaRQAAAZE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:25.620569 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:57300] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTamf-JFLfishX45N_GIQAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:26.633851 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:57502] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTamkzkQFuA2qBk8UMaVwAAAYI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:28.580880 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:57502] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTanEzkQFuA2qBk8UMaYQAAAYY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:29.489526 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:57502] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTanUzkQFuA2qBk8UMaYgAAAYI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:29.489596 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:57502] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTanUzkQFuA2qBk8UMaYgAAAYI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:30.512330 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:58390] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTanv-JFLfishX45N_GRQAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:31.542554 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:58617] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTan0zkQFuA2qBk8UMaZgAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:32.553159 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:58858] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTaoEzkQFuA2qBk8UMabQAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:33.575810 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:59114] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTaoUzkQFuA2qBk8UMacwAAAZA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:34.600449 2026] [:error] [pid 28908:tid 28917] [client 161.35.219.9:59350] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaooqJmC8ih_lQQnDRewAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:37.169265 2026] [:error] [pid 28908:tid 28927] [client 161.35.219.9:59350] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTapYqJmC8ih_lQQnDRfQAAANE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:38.276409 2026] [:error] [pid 28908:tid 28921] [client 161.35.219.9:59350] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTapoqJmC8ih_lQQnDRfgAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:39.724634 2026] [:error] [pid 28908:tid 28930] [client 161.35.219.9:59350] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTap4qJmC8ih_lQQnDRfwAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:40.807603 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:60936] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTaqEzkQFuA2qBk8UMaogAAAZI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:41.813244 2026] [:error] [pid 28795:tid 28875] [client 161.35.219.9:61146] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTaqbROd53wZBkdI_eCUgAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:42.843674 2026] [:error] [pid 21575:tid 21596] [client 161.35.219.9:61403] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTaqirocdArcJqFfIlqRwAAAVE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:43.912227 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:61614] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaq0zkQFuA2qBk8UMarwAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:46.499633 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:61614] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTarkzkQFuA2qBk8UMauwAAAYY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:47.620756 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:61614] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTar0zkQFuA2qBk8UMaxAAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:49.609515 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:61614] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTasUzkQFuA2qBk8UMa2wAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:50.979779 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:61614] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaskzkQFuA2qBk8UMa3wAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:50.979876 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:61614] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaskzkQFuA2qBk8UMa3wAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:53.480247 2026] [:error] [pid 28908:tid 28919] [client 161.35.219.9:63536] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTatYqJmC8ih_lQQnDRjgAAAMk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:53.480352 2026] [:error] [pid 28908:tid 28919] [client 161.35.219.9:63536] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTatYqJmC8ih_lQQnDRjgAAAMk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:54.491340 2026] [:error] [pid 28908:tid 28930] [client 161.35.219.9:64151] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTatoqJmC8ih_lQQnDRlAAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:55.524777 2026] [:error] [pid 28908:tid 28932] [client 161.35.219.9:64380] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTat4qJmC8ih_lQQnDRmwAAANY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:56.552697 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:64610] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTauEzkQFuA2qBk8UMa8QAAAZQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:57.597883 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:64927] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTauf-JFLfishX45N_G6QAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:57.597992 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:64927] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTauf-JFLfishX45N_G6QAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:58.645697 2026] [:error] [pid 28795:tid 28872] [client 161.35.219.9:65183] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTaurROd53wZBkdI_eCYQAAAIk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:32:59.649897 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:65445] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTau_-JFLfishX45N_G7QAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:00.877752 2026] [:error] [pid 28795:tid 28873] [client 161.35.219.9:49290] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTavLROd53wZBkdI_eCZQAAAIo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:01.914443 2026] [:error] [pid 28795:tid 28878] [client 161.35.219.9:49535] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTavbROd53wZBkdI_eCagAAAI8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:02.921410 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:49771] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTavv-JFLfishX45N_G_QAAARU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:07.182917 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:49771] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaw_-JFLfishX45N_HJwAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:08.211116 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:49771] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaxP-JFLfishX45N_HLQAAARY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:08.211209 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:49771] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaxP-JFLfishX45N_HLQAAARY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:10.178200 2026] [:error] [pid 31257:tid 31269] [client 161.35.219.9:51217] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaxv-JFLfishX45N_HNgAAAQY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:11.243615 2026] [:error] [pid 31257:tid 31264] [client 161.35.219.9:51217] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTax_-JFLfishX45N_HPgAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:11.243695 2026] [:error] [pid 31257:tid 31264] [client 161.35.219.9:51217] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTax_-JFLfishX45N_HPgAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:13.227580 2026] [:error] [pid 21575:tid 21592] [client 161.35.219.9:51901] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTaySrocdArcJqFfIlq1AAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:14.277817 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:51901] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTayirocdArcJqFfIlq1gAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:17.035308 2026] [:error] [pid 21575:tid 21583] [client 161.35.219.9:51901] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTazSrocdArcJqFfIlq2AAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:18.039970 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:53188] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTazkzkQFuA2qBk8UMbnQAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:19.052953 2026] [:error] [pid 23872:tid 23885] [client 161.35.219.9:53424] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTaz0zkQFuA2qBk8UMbqgAAAYo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:20.082845 2026] [:error] [pid 28908:tid 28926] [client 161.35.219.9:53640] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTa0IqJmC8ih_lQQnDRsQAAANA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:21.072409 2026] [:error] [pid 31257:tid 31280] [client 161.35.219.9:53911] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa0f-JFLfishX45N_HoQAAARE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:22.106269 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:53911] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTa0v-JFLfishX45N_HrQAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:23.107090 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:54384] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTa0_-JFLfishX45N_HvQAAARU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:24.123497 2026] [:error] [pid 28795:tid 28884] [client 161.35.219.9:54646] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTa1LROd53wZBkdI_eCdwAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:25.140360 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:54895] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTa1UzkQFuA2qBk8UMbxAAAAYQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:26.209366 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:55149] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa1kzkQFuA2qBk8UMb1gAAAYA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:28.188844 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:55149] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa2EzkQFuA2qBk8UMb6AAAAZQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:28.188911 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:55149] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa2EzkQFuA2qBk8UMb6AAAAZQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:29.212530 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:55958] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTa2f-JFLfishX45N_H7gAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:30.240262 2026] [:error] [pid 28908:tid 28933] [client 161.35.219.9:56243] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTa2oqJmC8ih_lQQnDRvwAAANc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:31.250471 2026] [:error] [pid 28795:tid 28871] [client 161.35.219.9:56452] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTa27ROd53wZBkdI_eCggAAAIg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:32.247411 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:56660] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa3P-JFLfishX45N_H-gAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:32.247495 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:56660] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa3P-JFLfishX45N_H-gAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:34.538020 2026] [:error] [pid 28908:tid 28934] [client 161.35.219.9:56880] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa3oqJmC8ih_lQQnDR0wAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:34.538113 2026] [:error] [pid 28908:tid 28934] [client 161.35.219.9:56880] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa3oqJmC8ih_lQQnDR0wAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:35.567764 2026] [:error] [pid 28908:tid 28914] [client 161.35.219.9:57439] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTa34qJmC8ih_lQQnDR1gAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:36.598511 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:57650] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTa4EzkQFuA2qBk8UMcKgAAAZQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:37.621742 2026] [:error] [pid 28908:tid 28921] [client 161.35.219.9:57914] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTa4YqJmC8ih_lQQnDR2QAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:38.624456 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:58164] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa4irocdArcJqFfIlrHgAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:40.339827 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:58164] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa5CrocdArcJqFfIlrJQAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:41.209620 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:58164] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa5SrocdArcJqFfIlrJwAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:41.209696 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:58164] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa5SrocdArcJqFfIlrJwAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:42.206413 2026] [:error] [pid 21575:tid 21588] [client 161.35.219.9:59002] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTa5irocdArcJqFfIlrKQAAAUk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:43.232734 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:59258] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTa5_-JFLfishX45N_INAAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:44.527611 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:59469] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTa6CrocdArcJqFfIlrLAAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:45.553056 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:59759] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTa6f-JFLfishX45N_IQAAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:46.550357 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:59966] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa6v-JFLfishX45N_ISgAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:46.550488 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:59966] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa6v-JFLfishX45N_ISgAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:47.568198 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:60206] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTa60zkQFuA2qBk8UMcUAAAAYQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:48.608023 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:60496] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTa7EzkQFuA2qBk8UMcXAAAAYY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:49.622209 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:60733] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTa7UzkQFuA2qBk8UMcZAAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:50.650176 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:60983] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTa7kzkQFuA2qBk8UMccAAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:51.650882 2026] [:error] [pid 28908:tid 28934] [client 161.35.219.9:61210] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa74qJmC8ih_lQQnDR6QAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:51.650938 2026] [:error] [pid 28908:tid 28934] [client 161.35.219.9:61210] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa74qJmC8ih_lQQnDR6QAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:53.537870 2026] [:error] [pid 23872:tid 23894] [client 161.35.219.9:61456] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa8UzkQFuA2qBk8UMcewAAAZM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:54.440047 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:61456] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa8kzkQFuA2qBk8UMcggAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:54.440146 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:61456] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa8kzkQFuA2qBk8UMcggAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:55.447275 2026] [:error] [pid 31257:tid 31275] [client 161.35.219.9:62130] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTa8_-JFLfishX45N_IagAAAQw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:56.472849 2026] [:error] [pid 28795:tid 28873] [client 161.35.219.9:62385] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTa9LROd53wZBkdI_eCngAAAIo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:57.497878 2026] [:error] [pid 28795:tid 28876] [client 161.35.219.9:62660] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTa9bROd53wZBkdI_eCrQAAAI0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:58.516595 2026] [:error] [pid 23872:tid 23883] [client 161.35.219.9:62921] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTa9kzkQFuA2qBk8UMckQAAAYg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:33:59.573729 2026] [:error] [pid 23872:tid 23883] [client 161.35.219.9:63165] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa90zkQFuA2qBk8UMcmQAAAYg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:02.337047 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:63165] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa-kzkQFuA2qBk8UMcowAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:03.829585 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:63165] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTa-0zkQFuA2qBk8UMcrgAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:05.364205 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:63165] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTa_UzkQFuA2qBk8UMcuAAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:06.364724 2026] [:error] [pid 23872:tid 23883] [client 161.35.219.9:64685] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTa_kzkQFuA2qBk8UMcvgAAAYg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:07.401330 2026] [:error] [pid 31257:tid 31264] [client 161.35.219.9:64952] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTa__-JFLfishX45N_ItAAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:08.460499 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:65217] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbAEzkQFuA2qBk8UMcywAAAYs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:09.472890 2026] [:error] [pid 28795:tid 28873] [client 161.35.219.9:65460] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbAbROd53wZBkdI_eCygAAAIo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:10.331812 2026] [:error] [pid 28795:tid 28868] [client 161.35.219.9:65460] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTbArROd53wZBkdI_eCywAAAIU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:11.359972 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:49541] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbAyrocdArcJqFfIlrZAAAAVI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:12.363813 2026] [:error] [pid 28908:tid 28920] [client 161.35.219.9:49776] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbBIqJmC8ih_lQQnDSDAAAAMo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:13.396860 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:50018] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbBUzkQFuA2qBk8UMc9AAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:14.423579 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:50299] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbBkzkQFuA2qBk8UMdAAAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:14.423660 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:50299] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbBkzkQFuA2qBk8UMdAAAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:15.438096 2026] [:error] [pid 28795:tid 28867] [client 161.35.219.9:50560] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTbB7ROd53wZBkdI_eCzgAAAIQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:16.434330 2026] [:error] [pid 28794:tid 28860] [client 161.35.219.9:50772] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbCKVy2qpaelbUob1XgwAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:17.455575 2026] [:error] [pid 28795:tid 28875] [client 161.35.219.9:51002] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbCbROd53wZBkdI_eC1AAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:18.461102 2026] [:error] [pid 28908:tid 28933] [client 161.35.219.9:51291] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbCoqJmC8ih_lQQnDSJAAAANc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:19.497328 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:51512] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbC0zkQFuA2qBk8UMdIgAAAY0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:19.497438 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:51512] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbC0zkQFuA2qBk8UMdIgAAAY0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:21.543771 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:51759] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbDf-JFLfishX45N_IzwAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:21.543863 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:51759] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbDf-JFLfishX45N_IzwAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:22.801368 2026] [:error] [pid 28794:tid 28850] [client 161.35.219.9:52247] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbDqVy2qpaelbUob1XigAAAE4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:23.819320 2026] [:error] [pid 28908:tid 28931] [client 161.35.219.9:52478] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbD4qJmC8ih_lQQnDSMAAAANU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:24.847362 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:52716] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbEEzkQFuA2qBk8UMdTgAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:25.970290 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:52969] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbESrocdArcJqFfIlrfAAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:28.968303 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:52969] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbFCrocdArcJqFfIlrgQAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:30.469927 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:52969] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbFirocdArcJqFfIlrhgAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:30.469987 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:52969] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbFirocdArcJqFfIlrhgAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:31.503223 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:54342] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTbF0zkQFuA2qBk8UMdggAAAYk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:32.553248 2026] [:error] [pid 28908:tid 28923] [client 161.35.219.9:54588] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbGIqJmC8ih_lQQnDSYQAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:33.586302 2026] [:error] [pid 28908:tid 28912] [client 161.35.219.9:54870] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbGYqJmC8ih_lQQnDSaQAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:34.605138 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:55146] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbGkzkQFuA2qBk8UMdlAAAAYk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:35.630150 2026] [:error] [pid 31257:tid 31263] [client 161.35.219.9:55394] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbG_-JFLfishX45N_JEAAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:35.630246 2026] [:error] [pid 31257:tid 31263] [client 161.35.219.9:55394] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbG_-JFLfishX45N_JEAAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:37.528077 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:55647] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbHUzkQFuA2qBk8UMdpgAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:38.409039 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:55647] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbHkzkQFuA2qBk8UMdrQAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:39.281793 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:55647] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTbH0zkQFuA2qBk8UMdsAAAAYI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:40.304496 2026] [:error] [pid 28795:tid 28865] [client 161.35.219.9:56573] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbILROd53wZBkdI_eC-QAAAII"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:42.652063 2026] [:error] [pid 28908:tid 28919] [client 161.35.219.9:56790] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbIoqJmC8ih_lQQnDSfgAAAMk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:43.754068 2026] [:error] [pid 23872:tid 23883] [client 161.35.219.9:57091] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbI0zkQFuA2qBk8UMd1AAAAYg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:44.984706 2026] [:error] [pid 28795:tid 28872] [client 161.35.219.9:57288] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbJLROd53wZBkdI_eC-wAAAIk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:46.866312 2026] [:error] [pid 28795:tid 28886] [client 161.35.219.9:57288] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbJrROd53wZBkdI_eC_QAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:47.743898 2026] [:error] [pid 28795:tid 28882] [client 161.35.219.9:57288] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbJ7ROd53wZBkdI_eC_wAAAJM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:47.743972 2026] [:error] [pid 28795:tid 28882] [client 161.35.219.9:57288] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbJ7ROd53wZBkdI_eC_wAAAJM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:48.739312 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:58189] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTbKEzkQFuA2qBk8UMeBgAAAZI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:49.755448 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:58458] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbKUzkQFuA2qBk8UMeDgAAAYA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:50.797601 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:58711] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbKv-JFLfishX45N_JPwAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:51.808356 2026] [:error] [pid 23872:tid 23883] [client 161.35.219.9:58954] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbK0zkQFuA2qBk8UMeJgAAAYg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:52.823591 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:59183] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbLEzkQFuA2qBk8UMeNQAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:53.699944 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:59183] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTbLUzkQFuA2qBk8UMeOwAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:54.705827 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:59628] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbLkzkQFuA2qBk8UMeRgAAAYY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:55.739406 2026] [:error] [pid 31257:tid 31272] [client 161.35.219.9:59857] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbL_-JFLfishX45N_JTwAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:56.762271 2026] [:error] [pid 28793:tid 28819] [client 161.35.219.9:60118] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbMA2_fxBANaHo1f4_nAAAAAw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:57.792689 2026] [:error] [pid 31257:tid 31280] [client 161.35.219.9:60373] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbMf-JFLfishX45N_JYQAAARE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:57.792771 2026] [:error] [pid 31257:tid 31280] [client 161.35.219.9:60373] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbMf-JFLfishX45N_JYQAAARE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:34:59.876896 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:60629] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbM_-JFLfishX45N_JdwAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:00.785293 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:60629] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbNP-JFLfishX45N_JfgAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:02.655294 2026] [:error] [pid 31257:tid 31263] [client 161.35.219.9:60629] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbNv-JFLfishX45N_JjQAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:02.655405 2026] [:error] [pid 31257:tid 31263] [client 161.35.219.9:60629] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbNv-JFLfishX45N_JjQAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:03.700294 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:61774] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbN0zkQFuA2qBk8UMebwAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:04.719266 2026] [:error] [pid 31257:tid 31273] [client 161.35.219.9:62013] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbOP-JFLfishX45N_JpgAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:05.774774 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:62274] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbOf-JFLfishX45N_JrgAAARA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:06.809654 2026] [:error] [pid 31257:tid 31269] [client 161.35.219.9:62523] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbOv-JFLfishX45N_JtgAAAQY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:07.769504 2026] [:error] [pid 31257:tid 31272] [client 161.35.219.9:62523] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTbO_-JFLfishX45N_JvgAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:08.867979 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:63005] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbPEzkQFuA2qBk8UMekAAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:09.864726 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:63292] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbPUzkQFuA2qBk8UMemgAAAYs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:10.883489 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:63514] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbPirocdArcJqFfIlrxQAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:11.937724 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:63750] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbP0zkQFuA2qBk8UMetAAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:11.937797 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:63750] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbP0zkQFuA2qBk8UMetAAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:13.989540 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:63966] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbQUzkQFuA2qBk8UMeyAAAAYU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:15.443155 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:63966] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbQ0zkQFuA2qBk8UMezgAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:15.443223 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:63966] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbQ0zkQFuA2qBk8UMezgAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:17.486500 2026] [:error] [pid 28795:tid 28877] [client 161.35.219.9:64731] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbRbROd53wZBkdI_eDJQAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:18.370741 2026] [:error] [pid 28795:tid 28878] [client 161.35.219.9:64731] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbRrROd53wZBkdI_eDKAAAAI8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:18.370848 2026] [:error] [pid 28795:tid 28878] [client 161.35.219.9:64731] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbRrROd53wZBkdI_eDKAAAAI8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:19.378853 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:65405] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTbR0zkQFuA2qBk8UMe4wAAAZE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:20.400078 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:49247] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbSCrocdArcJqFfIlr5gAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:21.427558 2026] [:error] [pid 28908:tid 28920] [client 161.35.219.9:49459] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbSYqJmC8ih_lQQnDSqAAAAMo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:22.466972 2026] [:error] [pid 21575:tid 21580] [client 161.35.219.9:49686] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbSirocdArcJqFfIlr8gAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:23.494270 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:49930] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbSyrocdArcJqFfIlr-AAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:25.273237 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:49930] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbTSrocdArcJqFfIlr_gAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:26.126104 2026] [:error] [pid 21575:tid 21581] [client 161.35.219.9:49930] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbTirocdArcJqFfIlsAQAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:27.782786 2026] [:error] [pid 21575:tid 21583] [client 161.35.219.9:49930] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbTyrocdArcJqFfIlsCwAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:28.569961 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:49930] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbUCrocdArcJqFfIlsDAAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:30.219744 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:49930] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbUirocdArcJqFfIlsEAAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:31.161289 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:49930] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbUyrocdArcJqFfIlsFQAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:31.161375 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:49930] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbUyrocdArcJqFfIlsFQAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:33.086504 2026] [:error] [pid 28908:tid 28916] [client 161.35.219.9:51807] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbVYqJmC8ih_lQQnDSwQAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:33.946989 2026] [:error] [pid 28908:tid 28934] [client 161.35.219.9:51807] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbVYqJmC8ih_lQQnDSxAAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:34.907775 2026] [:error] [pid 28908:tid 28913] [client 161.35.219.9:51807] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTbVoqJmC8ih_lQQnDSxgAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:37.520592 2026] [:error] [pid 21575:tid 21600] [client 161.35.219.9:53053] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbWSrocdArcJqFfIlsJAAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:38.510027 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:53318] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbWirocdArcJqFfIlsKQAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:39.525876 2026] [:error] [pid 28795:tid 28872] [client 161.35.219.9:53591] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbW7ROd53wZBkdI_eDXwAAAIk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:41.356831 2026] [:error] [pid 28795:tid 28882] [client 161.35.219.9:53591] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbXbROd53wZBkdI_eDYgAAAJM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:42.238435 2026] [:error] [pid 28795:tid 28870] [client 161.35.219.9:53591] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbXrROd53wZBkdI_eDYwAAAIc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:44.384591 2026] [:error] [pid 28795:tid 28881] [client 161.35.219.9:53591] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbYLROd53wZBkdI_eDZQAAAJI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:44.384682 2026] [:error] [pid 28795:tid 28881] [client 161.35.219.9:53591] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbYLROd53wZBkdI_eDZQAAAJI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:45.420875 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:55057] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbYUzkQFuA2qBk8UMfbAAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:46.458117 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:55303] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbYkzkQFuA2qBk8UMfggAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:47.526809 2026] [:error] [pid 28908:tid 28912] [client 161.35.219.9:55557] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbY4qJmC8ih_lQQnDS0wAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:48.538464 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:55864] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbZEzkQFuA2qBk8UMfnwAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:48.538568 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:55864] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbZEzkQFuA2qBk8UMfnwAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:49.560193 2026] [:error] [pid 28795:tid 28867] [client 161.35.219.9:56114] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTbZbROd53wZBkdI_eDbgAAAIQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:50.561179 2026] [:error] [pid 21575:tid 21583] [client 161.35.219.9:56363] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbZirocdArcJqFfIlsWQAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:52.758304 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:56557] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbaCrocdArcJqFfIlsZAAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:53.858927 2026] [:error] [pid 28795:tid 28864] [client 161.35.219.9:56825] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbabROd53wZBkdI_eDdwAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:54.898549 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:57005] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbakzkQFuA2qBk8UMf0wAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:54.898638 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:57005] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbakzkQFuA2qBk8UMf0wAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:56.771807 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:57207] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbbP-JFLfishX45N_KjgAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:57.647542 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:57207] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbbf-JFLfishX45N_KkQAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:57.647641 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:57207] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbbf-JFLfishX45N_KkQAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:35:59.475168 2026] [:error] [pid 31257:tid 31280] [client 161.35.219.9:57880] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbb_-JFLfishX45N_KogAAARE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:00.272666 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:57880] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbcP-JFLfishX45N_KqgAAARU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:00.272755 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:57880] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbcP-JFLfishX45N_KqgAAARU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:02.161931 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:58493] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbckzkQFuA2qBk8UMgAQAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:02.992637 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:58493] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbckzkQFuA2qBk8UMgAgAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:02.992737 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:58493] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbckzkQFuA2qBk8UMgAgAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:04.010646 2026] [:error] [pid 28795:tid 28873] [client 161.35.219.9:59063] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTbdLROd53wZBkdI_eDhgAAAIo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:05.051466 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:59308] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbdUzkQFuA2qBk8UMgEwAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:06.079505 2026] [:error] [pid 28794:tid 28836] [client 161.35.219.9:59510] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbdqVy2qpaelbUob1X3AAAAEA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:07.108908 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:59746] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbd_-JFLfishX45N_KxQAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:08.102604 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:59966] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbeEzkQFuA2qBk8UMgJQAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:08.102735 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:59966] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbeEzkQFuA2qBk8UMgJQAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:10.872799 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:60425] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbev-JFLfishX45N_KzAAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:11.656451 2026] [:error] [pid 31257:tid 31286] [client 161.35.219.9:60425] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbe_-JFLfishX45N_KzwAAARc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:13.391670 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:60425] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbff-JFLfishX45N_K1AAAARA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:13.391743 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:60425] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbff-JFLfishX45N_K1AAAARA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:14.399101 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:61354] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbfkzkQFuA2qBk8UMgYgAAAY0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:15.398400 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:61570] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbf0zkQFuA2qBk8UMgbAAAAYY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:16.415234 2026] [:error] [pid 31257:tid 31273] [client 161.35.219.9:61797] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbgP-JFLfishX45N_K2QAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:17.429187 2026] [:error] [pid 21575:tid 21583] [client 161.35.219.9:62020] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbgSrocdArcJqFfIlskwAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:17.429288 2026] [:error] [pid 21575:tid 21583] [client 161.35.219.9:62020] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbgSrocdArcJqFfIlskwAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:19.290030 2026] [:error] [pid 28908:tid 28913] [client 161.35.219.9:62257] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbg4qJmC8ih_lQQnDTFgAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:20.095069 2026] [:error] [pid 28908:tid 28914] [client 161.35.219.9:62257] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbhIqJmC8ih_lQQnDTFwAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:20.926147 2026] [:error] [pid 28908:tid 28919] [client 161.35.219.9:62257] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTbhIqJmC8ih_lQQnDTGQAAAMk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:21.964737 2026] [:error] [pid 28794:tid 28854] [client 161.35.219.9:63104] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbhaVy2qpaelbUob1X-wAAAFI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:22.995063 2026] [:error] [pid 28795:tid 28868] [client 161.35.219.9:63357] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbhrROd53wZBkdI_eDjQAAAIU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:24.036123 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:63595] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbiEzkQFuA2qBk8UMgkgAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:25.045702 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:63807] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbiUzkQFuA2qBk8UMgmAAAAZA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:26.763950 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:63807] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbikzkQFuA2qBk8UMgoQAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:26.764025 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:63807] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbikzkQFuA2qBk8UMgoQAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:27.796601 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:64417] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbi0zkQFuA2qBk8UMgqgAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:28.791768 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:64685] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbjP-JFLfishX45N_K9AAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:29.790649 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:64942] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbjf-JFLfishX45N_K-QAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:30.800526 2026] [:error] [pid 31257:tid 31286] [client 161.35.219.9:65157] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbjv-JFLfishX45N_K_QAAARc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:32.621586 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:65157] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbkP-JFLfishX45N_LCQAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:33.461810 2026] [:error] [pid 31257:tid 31275] [client 161.35.219.9:65157] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbkf-JFLfishX45N_LCgAAAQw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:33.461921 2026] [:error] [pid 31257:tid 31275] [client 161.35.219.9:65157] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbkf-JFLfishX45N_LCgAAAQw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:34.484480 2026] [:error] [pid 31257:tid 31280] [client 161.35.219.9:49557] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTbkv-JFLfishX45N_LDAAAARE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:35.516511 2026] [:error] [pid 31257:tid 31263] [client 161.35.219.9:49789] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbk_-JFLfishX45N_LEQAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:36.530478 2026] [:error] [pid 21575:tid 21585] [client 161.35.219.9:50000] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTblCrocdArcJqFfIls1gAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:37.578090 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:50236] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTblUzkQFuA2qBk8UMgzgAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:38.606929 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:50485] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTblkzkQFuA2qBk8UMg1wAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:38.606998 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:50485] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTblkzkQFuA2qBk8UMg1wAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:39.663514 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:50730] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTbl_-JFLfishX45N_LFQAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:40.672774 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:50968] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbmCrocdArcJqFfIls5gAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:41.704790 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:51172] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbmf-JFLfishX45N_LIwAAARM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:42.714313 2026] [:error] [pid 28795:tid 28872] [client 161.35.219.9:51412] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbmrROd53wZBkdI_eDmgAAAIk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:43.733886 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:51662] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbm0zkQFuA2qBk8UMg3gAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:43.733952 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:51662] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbm0zkQFuA2qBk8UMg3gAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:44.777320 2026] [:error] [pid 28908:tid 28926] [client 161.35.219.9:51865] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTbnIqJmC8ih_lQQnDTSQAAANA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:45.803789 2026] [:error] [pid 28794:tid 28850] [client 161.35.219.9:52091] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbnaVy2qpaelbUob1YJAAAAE4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:46.823530 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:52290] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbnv-JFLfishX45N_LQgAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:47.855256 2026] [:error] [pid 21575:tid 21580] [client 161.35.219.9:52535] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbnyrocdArcJqFfIls8QAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:48.900353 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:52774] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTboEzkQFuA2qBk8UMg9wAAAYk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:48.900453 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:52774] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTboEzkQFuA2qBk8UMg9wAAAYk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:50.006477 2026] [:error] [pid 28908:tid 28916] [client 161.35.219.9:53063] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbooqJmC8ih_lQQnDTYwAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:51.316647 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:53310] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbo_-JFLfishX45N_LggAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:52.331980 2026] [:error] [pid 23872:tid 23885] [client 161.35.219.9:53572] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbpEzkQFuA2qBk8UMhCAAAAYo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:55.062583 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:54397] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbp0zkQFuA2qBk8UMhFAAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:55.062653 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:54397] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbp0zkQFuA2qBk8UMhFAAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:36:56.261817 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:54674] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTbqCrocdArcJqFfIltBAAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:00.011929 2026] [:error] [pid 21575:tid 21586] [client 161.35.219.9:55462] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbrCrocdArcJqFfIltDwAAAUc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:01.037988 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:55772] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbrUzkQFuA2qBk8UMhUQAAAYs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:02.701371 2026] [:error] [pid 28793:tid 28815] [client 161.35.219.9:56051] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbrg2_fxBANaHo1f5ABAAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:02.701467 2026] [:error] [pid 28793:tid 28815] [client 161.35.219.9:56051] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbrg2_fxBANaHo1f5ABAAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:04.658728 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:56352] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbsEzkQFuA2qBk8UMhaAAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:05.557934 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:56352] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbsUzkQFuA2qBk8UMhbwAAAY0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:05.558018 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:56352] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbsUzkQFuA2qBk8UMhbwAAAY0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:09.974038 2026] [:error] [pid 28795:tid 28867] [client 161.35.219.9:57782] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbtbROd53wZBkdI_eDswAAAIQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:10.769060 2026] [:error] [pid 28795:tid 28872] [client 161.35.219.9:57782] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbtrROd53wZBkdI_eDtQAAAIk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:10.769132 2026] [:error] [pid 28795:tid 28872] [client 161.35.219.9:57782] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbtrROd53wZBkdI_eDtQAAAIk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:12.616525 2026] [:error] [pid 28794:tid 28840] [client 161.35.219.9:58562] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbuKVy2qpaelbUob1YawAAAEQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:13.402615 2026] [:error] [pid 28794:tid 28850] [client 161.35.219.9:58562] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbuaVy2qpaelbUob1YbAAAAE4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:13.402680 2026] [:error] [pid 28794:tid 28850] [client 161.35.219.9:58562] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbuaVy2qpaelbUob1YbAAAAE4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:15.282438 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:59302] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbu0zkQFuA2qBk8UMhoQAAAYY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:16.148483 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:59302] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbvEzkQFuA2qBk8UMhpwAAAZQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:17.039246 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:59302] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTbvUzkQFuA2qBk8UMhqQAAAZE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:18.050110 2026] [:error] [pid 28794:tid 28846] [client 161.35.219.9:60179] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbvqVy2qpaelbUob1YcwAAAEo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:19.076814 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:60471] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbv0zkQFuA2qBk8UMhrwAAAYs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:20.084558 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:60769] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbwCrocdArcJqFfIltNAAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:21.126569 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:61027] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbwf-JFLfishX45N_L2wAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:22.823725 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:61027] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbwv-JFLfishX45N_L6QAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:22.823825 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:61027] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbwv-JFLfishX45N_L6QAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:23.827286 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:61713] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbw_-JFLfishX45N_L7QAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:24.852803 2026] [:error] [pid 21575:tid 21590] [client 161.35.219.9:61982] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbxCrocdArcJqFfIltQwAAAUs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:25.880181 2026] [:error] [pid 21575:tid 21592] [client 161.35.219.9:62268] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbxSrocdArcJqFfIltSAAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:26.902039 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:62491] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTbxirocdArcJqFfIltTQAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:27.767351 2026] [:error] [pid 21575:tid 21598] [client 161.35.219.9:62491] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTbxyrocdArcJqFfIltWQAAAVM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:28.782231 2026] [:error] [pid 28908:tid 28927] [client 161.35.219.9:62976] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbyIqJmC8ih_lQQnDTrAAAANE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:29.797918 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:63265] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbyUzkQFuA2qBk8UMh2QAAAYs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:30.819707 2026] [:error] [pid 28908:tid 28926] [client 161.35.219.9:63507] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbyoqJmC8ih_lQQnDTrgAAANA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:31.847299 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:63793] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTby_-JFLfishX45N_L-wAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:32.653118 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:63793] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTbzP-JFLfishX45N_L_QAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:33.696558 2026] [:error] [pid 28795:tid 28876] [client 161.35.219.9:64233] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTbzbROd53wZBkdI_eD4AAAAI0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:34.703678 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:64530] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTbzv-JFLfishX45N_MCAAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:35.706520 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:64791] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTbz0zkQFuA2qBk8UMh6wAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:38.250042 2026] [:error] [pid 28795:tid 28866] [client 161.35.219.9:65425] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTb0rROd53wZBkdI_eD6QAAAIM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:39.085481 2026] [:error] [pid 28795:tid 28867] [client 161.35.219.9:65425] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTb07ROd53wZBkdI_eD6gAAAIQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:40.107151 2026] [:error] [pid 28793:tid 28830] [client 161.35.219.9:49538] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTb1A2_fxBANaHo1f5AMAAAABc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:41.123497 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:49814] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTb1SrocdArcJqFfIlthwAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:42.147028 2026] [:error] [pid 28795:tid 28865] [client 161.35.219.9:50079] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTb1rROd53wZBkdI_eD9QAAAII"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:43.137285 2026] [:error] [pid 21575:tid 21586] [client 161.35.219.9:50349] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTb1yrocdArcJqFfIltkwAAAUc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:44.854772 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:50349] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTb2CrocdArcJqFfIltmgAAAVI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:45.692196 2026] [:error] [pid 21575:tid 21580] [client 161.35.219.9:50349] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTb2SrocdArcJqFfIltngAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:45.692283 2026] [:error] [pid 21575:tid 21580] [client 161.35.219.9:50349] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTb2SrocdArcJqFfIltngAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:46.723166 2026] [:error] [pid 23872:tid 23894] [client 161.35.219.9:51226] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTb2kzkQFuA2qBk8UMiGQAAAZM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:47.751061 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:51509] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTb20zkQFuA2qBk8UMiLwAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:48.791481 2026] [:error] [pid 31257:tid 31275] [client 161.35.219.9:51785] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTb3P-JFLfishX45N_MOQAAAQw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:49.801093 2026] [:error] [pid 21575:tid 21581] [client 161.35.219.9:52092] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTb3SrocdArcJqFfIltsgAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:50.825220 2026] [:error] [pid 28908:tid 28929] [client 161.35.219.9:52367] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTb3oqJmC8ih_lQQnDT1AAAANM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:52.812965 2026] [:error] [pid 28908:tid 28910] [client 161.35.219.9:52367] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTb4IqJmC8ih_lQQnDT2QAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:53.677164 2026] [:error] [pid 28908:tid 28922] [client 161.35.219.9:52367] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTb4YqJmC8ih_lQQnDT2gAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:53.677234 2026] [:error] [pid 28908:tid 28922] [client 161.35.219.9:52367] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTb4YqJmC8ih_lQQnDT2gAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:54.701638 2026] [:error] [pid 28795:tid 28864] [client 161.35.219.9:53354] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTb4rROd53wZBkdI_eEKQAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:55.714997 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:53611] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTb40zkQFuA2qBk8UMidQAAAZQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:56.724784 2026] [:error] [pid 28908:tid 28913] [client 161.35.219.9:53862] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTb5IqJmC8ih_lQQnDT5QAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:57.739624 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:54138] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTb5f-JFLfishX45N_MVQAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:37:58.759851 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:54465] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTb5v-JFLfishX45N_MWwAAARM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:00.815156 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:54465] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTb6P-JFLfishX45N_MbQAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:02.502878 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:54465] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTb6v-JFLfishX45N_MdAAAARU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:02.502956 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:54465] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTb6v-JFLfishX45N_MdAAAARU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:04.575443 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:55769] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTb7P-JFLfishX45N_MhAAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:05.628193 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:56217] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTb7UzkQFuA2qBk8UMioQAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:06.664136 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:56473] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTb7kzkQFuA2qBk8UMiqgAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:07.684397 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:56774] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTb70zkQFuA2qBk8UMisgAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:08.706968 2026] [:error] [pid 31257:tid 31275] [client 161.35.219.9:57035] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTb8P-JFLfishX45N_MlwAAAQw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:08.707024 2026] [:error] [pid 31257:tid 31275] [client 161.35.219.9:57035] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTb8P-JFLfishX45N_MlwAAAQw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:10.636487 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:57312] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTb8kzkQFuA2qBk8UMiwQAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:11.472922 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:57312] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTb80zkQFuA2qBk8UMixQAAAYA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:12.326773 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:57312] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTb9EzkQFuA2qBk8UMiyAAAAYQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:13.357028 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:58294] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTb9f-JFLfishX45N_MwAAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:14.374510 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:58565] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTb9kzkQFuA2qBk8UMizwAAAYs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:15.412086 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:58849] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTb9_-JFLfishX45N_MzwAAARM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:16.433160 2026] [:error] [pid 21575:tid 21598] [client 161.35.219.9:59079] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTb-CrocdArcJqFfIlt9wAAAVM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:18.136886 2026] [:error] [pid 21575:tid 21601] [client 161.35.219.9:59079] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTb-irocdArcJqFfIlt_wAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:19.017867 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:59079] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTb-yrocdArcJqFfIluAwAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:19.017971 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:59079] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTb-yrocdArcJqFfIluAwAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:20.878310 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:60024] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTb_CrocdArcJqFfIluCwAAAVI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:21.898683 2026] [:error] [pid 28793:tid 28826] [client 161.35.219.9:60261] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTb_Q2_fxBANaHo1f5AXwAAABM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:22.921120 2026] [:error] [pid 28793:tid 28812] [client 161.35.219.9:60494] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTb_g2_fxBANaHo1f5AYQAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:23.948808 2026] [:error] [pid 28795:tid 28886] [client 161.35.219.9:60740] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTb_7ROd53wZBkdI_eEewAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:24.955032 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:60932] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcACrocdArcJqFfIluGQAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:24.955111 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:60932] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcACrocdArcJqFfIluGQAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:26.799733 2026] [:error] [pid 21575:tid 21585] [client 161.35.219.9:61151] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcAirocdArcJqFfIluJAAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:27.666083 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:61151] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcAyrocdArcJqFfIluKwAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:27.666167 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:61151] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcAyrocdArcJqFfIluKwAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:29.576916 2026] [:error] [pid 28794:tid 28840] [client 161.35.219.9:61864] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcBaVy2qpaelbUob1YyQAAAEQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:31.782883 2026] [:error] [pid 28794:tid 28840] [client 161.35.219.9:61864] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcB6Vy2qpaelbUob1YywAAAEQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:31.782972 2026] [:error] [pid 28794:tid 28840] [client 161.35.219.9:61864] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcB6Vy2qpaelbUob1YywAAAEQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:32.798190 2026] [:error] [pid 28908:tid 28911] [client 161.35.219.9:62865] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcCIqJmC8ih_lQQnDUIwAAAME"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:33.818339 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:63114] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcCUzkQFuA2qBk8UMjUwAAAY0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:34.837628 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:63329] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcCkzkQFuA2qBk8UMjWwAAAZA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:35.848194 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:63628] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcC_-JFLfishX45N_NOgAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:36.887557 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:63882] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcDCrocdArcJqFfIlubQAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:36.887643 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:63882] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcDCrocdArcJqFfIlubQAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:37.913089 2026] [:error] [pid 21575:tid 21592] [client 161.35.219.9:64153] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcDSrocdArcJqFfIlucgAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:38.942056 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:64401] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcDkzkQFuA2qBk8UMjegAAAZA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:39.965406 2026] [:error] [pid 31257:tid 31272] [client 161.35.219.9:64716] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcD_-JFLfishX45N_NQwAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:40.989195 2026] [:error] [pid 28908:tid 28922] [client 161.35.219.9:64994] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcEIqJmC8ih_lQQnDUMwAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:41.990024 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:65260] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcEUzkQFuA2qBk8UMjiwAAAYU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:41.990116 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:65260] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcEUzkQFuA2qBk8UMjiwAAAYU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:43.008251 2026] [:error] [pid 28794:tid 28842] [client 161.35.219.9:65500] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcE6Vy2qpaelbUob1Y2QAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:44.064096 2026] [:error] [pid 21575:tid 21600] [client 161.35.219.9:49398] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcFCrocdArcJqFfIluhgAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:45.084094 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:49681] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcFUzkQFuA2qBk8UMjkQAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:46.117236 2026] [:error] [pid 28908:tid 28917] [client 161.35.219.9:49941] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcFoqJmC8ih_lQQnDUOQAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:47.133487 2026] [:error] [pid 21575:tid 21590] [client 161.35.219.9:50222] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcFyrocdArcJqFfIlulAAAAUs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:47.133545 2026] [:error] [pid 21575:tid 21590] [client 161.35.219.9:50222] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcFyrocdArcJqFfIlulAAAAUs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:49.159564 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:50505] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcGUzkQFuA2qBk8UMjrAAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:50.002614 2026] [:error] [pid 23872:tid 23876] [client 161.35.219.9:50505] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcGkzkQFuA2qBk8UMjsQAAAYE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:50.002675 2026] [:error] [pid 23872:tid 23876] [client 161.35.219.9:50505] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcGkzkQFuA2qBk8UMjsQAAAYE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:51.000458 2026] [:error] [pid 31257:tid 31287] [client 161.35.219.9:51225] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcGv-JFLfishX45N_NTwAAARg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:52.476984 2026] [:error] [pid 28794:tid 28845] [client 161.35.219.9:51471] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcHKVy2qpaelbUob1Y4gAAAEk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:53.503036 2026] [:error] [pid 28908:tid 28921] [client 161.35.219.9:51746] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcHYqJmC8ih_lQQnDUSQAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:54.542767 2026] [:error] [pid 28794:tid 28836] [client 161.35.219.9:52033] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcHqVy2qpaelbUob1Y5gAAAEA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:55.568336 2026] [:error] [pid 28794:tid 28859] [client 161.35.219.9:52284] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcH6Vy2qpaelbUob1Y6gAAAFc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:56.349558 2026] [:error] [pid 28794:tid 28853] [client 161.35.219.9:52284] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcIKVy2qpaelbUob1Y7gAAAFE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:57.371179 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:52762] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcIUzkQFuA2qBk8UMjuQAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:58.380738 2026] [:error] [pid 21575:tid 21585] [client 161.35.219.9:53038] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcIirocdArcJqFfIlurAAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:38:59.635772 2026] [:error] [pid 28908:tid 28921] [client 161.35.219.9:53312] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcI4qJmC8ih_lQQnDUVwAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:00.662351 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:53618] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcJP-JFLfishX45N_NXAAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:02.384528 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:53618] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcJv-JFLfishX45N_NXgAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:03.254112 2026] [:error] [pid 31257:tid 31272] [client 161.35.219.9:53618] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcJ_-JFLfishX45N_NYgAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:04.097878 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:53618] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcKP-JFLfishX45N_NZQAAARU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:05.113925 2026] [:error] [pid 28908:tid 28915] [client 161.35.219.9:54724] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcKYqJmC8ih_lQQnDUZQAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:06.138122 2026] [:error] [pid 28795:tid 28870] [client 161.35.219.9:54987] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcKrROd53wZBkdI_eEuwAAAIc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:07.154665 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:55313] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcK0zkQFuA2qBk8UMj5QAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:08.182528 2026] [:error] [pid 28908:tid 28914] [client 161.35.219.9:55567] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcLIqJmC8ih_lQQnDUaAAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:08.182637 2026] [:error] [pid 28908:tid 28914] [client 161.35.219.9:55567] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcLIqJmC8ih_lQQnDUaAAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:10.025795 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:55843] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcLirocdArcJqFfIluwwAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:10.025863 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:55843] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcLirocdArcJqFfIluwwAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:11.040048 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:56305] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcL0zkQFuA2qBk8UMj9gAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:12.053132 2026] [:error] [pid 21575:tid 21582] [client 161.35.219.9:56533] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcMCrocdArcJqFfIlu0QAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:13.069112 2026] [:error] [pid 31257:tid 31287] [client 161.35.219.9:56748] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcMf-JFLfishX45N_NbgAAARg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:14.078486 2026] [:error] [pid 31257:tid 31286] [client 161.35.219.9:56950] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcMv-JFLfishX45N_NcAAAARc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:14.873796 2026] [:error] [pid 31257:tid 31269] [client 161.35.219.9:56950] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcMv-JFLfishX45N_NcQAAAQY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:15.888134 2026] [:error] [pid 28795:tid 28869] [client 161.35.219.9:57332] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcM7ROd53wZBkdI_eExAAAAIY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:16.897655 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:57580] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcNEzkQFuA2qBk8UMkFwAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:17.910734 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:57836] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcNUzkQFuA2qBk8UMkHQAAAZQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:18.931032 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:58102] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcNkzkQFuA2qBk8UMkIQAAAYA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:19.725592 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:58102] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcN0zkQFuA2qBk8UMkJAAAAYQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:20.773684 2026] [:error] [pid 23872:tid 23885] [client 161.35.219.9:58603] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcOEzkQFuA2qBk8UMkLgAAAYo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:21.788543 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:58881] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcOUzkQFuA2qBk8UMkNgAAAZA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:22.822346 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:59118] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcOkzkQFuA2qBk8UMkQwAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:23.867137 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:59372] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcO_-JFLfishX45N_NmQAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:23.867188 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:59372] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcO_-JFLfishX45N_NmQAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:24.965548 2026] [:error] [pid 31257:tid 31272] [client 161.35.219.9:59623] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcPP-JFLfishX45N_NoQAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:25.963028 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:59867] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcPUzkQFuA2qBk8UMkVwAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:26.981212 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:60135] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcPv-JFLfishX45N_NuQAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:28.008054 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:60422] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcQEzkQFuA2qBk8UMkYgAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:29.051742 2026] [:error] [pid 28794:tid 28838] [client 161.35.219.9:60740] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcQaVy2qpaelbUob1Y_wAAAEI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:29.844739 2026] [:error] [pid 28794:tid 28853] [client 161.35.219.9:60740] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcQaVy2qpaelbUob1ZAQAAAFE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:30.865881 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:61179] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcQkzkQFuA2qBk8UMkdgAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:31.874733 2026] [:error] [pid 28794:tid 28843] [client 161.35.219.9:61390] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcQ6Vy2qpaelbUob1ZAwAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:32.906742 2026] [:error] [pid 28908:tid 28916] [client 161.35.219.9:61632] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcRIqJmC8ih_lQQnDUgwAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:33.954799 2026] [:error] [pid 28908:tid 28932] [client 161.35.219.9:61873] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcRYqJmC8ih_lQQnDUiAAAANY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:35.587501 2026] [:error] [pid 28908:tid 28915] [client 161.35.219.9:61873] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcR4qJmC8ih_lQQnDUjQAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:37.485030 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:62512] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcSf-JFLfishX45N_N2QAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:38.527827 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:62808] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcSv-JFLfishX45N_N2wAAARY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:39.562718 2026] [:error] [pid 31257:tid 31272] [client 161.35.219.9:63009] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcS_-JFLfishX45N_N3wAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:40.587952 2026] [:error] [pid 31257:tid 31280] [client 161.35.219.9:63276] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcTP-JFLfishX45N_N5wAAARE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:40.588023 2026] [:error] [pid 31257:tid 31280] [client 161.35.219.9:63276] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcTP-JFLfishX45N_N5wAAARE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:41.617857 2026] [:error] [pid 31257:tid 31272] [client 161.35.219.9:63492] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcTf-JFLfishX45N_N6gAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:42.653549 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:63710] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcTv-JFLfishX45N_N8AAAARU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:43.691165 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:63945] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcT_-JFLfishX45N_N9wAAARY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:45.470232 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:64157] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcUUzkQFuA2qBk8UMktwAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:46.518186 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:64391] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcUkzkQFuA2qBk8UMkvgAAAZQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:47.331880 2026] [:error] [pid 23872:tid 23876] [client 161.35.219.9:64391] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcU0zkQFuA2qBk8UMkxQAAAYE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:48.351918 2026] [:error] [pid 31257:tid 31273] [client 161.35.219.9:64800] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcVP-JFLfishX45N_OAgAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:49.382324 2026] [:error] [pid 21575:tid 21588] [client 161.35.219.9:65056] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcVSrocdArcJqFfIlu-QAAAUk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:50.385961 2026] [:error] [pid 28908:tid 28933] [client 161.35.219.9:65310] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcVoqJmC8ih_lQQnDUngAAANc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:51.402149 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:49171] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcVyrocdArcJqFfIlvAgAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:52.224111 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:49171] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcWCrocdArcJqFfIlvBQAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:53.241198 2026] [:error] [pid 28908:tid 28921] [client 161.35.219.9:49562] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcWYqJmC8ih_lQQnDUpQAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:54.261018 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:49806] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcWv-JFLfishX45N_OHAAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:55.309311 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:50042] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcWyrocdArcJqFfIlvHgAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:56.344990 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:50363] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcXP-JFLfishX45N_OKgAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:57.167902 2026] [:error] [pid 31257:tid 31273] [client 161.35.219.9:50363] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcXf-JFLfishX45N_OMgAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:58.175522 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:50854] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcXkzkQFuA2qBk8UMk6AAAAYU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:39:59.215789 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:51129] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcX0zkQFuA2qBk8UMk7QAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:00.222189 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:51398] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcYEzkQFuA2qBk8UMk9gAAAYQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:01.256404 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:51658] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcYUzkQFuA2qBk8UMk_QAAAZI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:01.256491 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:51658] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcYUzkQFuA2qBk8UMk_QAAAZI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:03.168026 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:51893] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcY0zkQFuA2qBk8UMlCQAAAZE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:04.047633 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:51893] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcZEzkQFuA2qBk8UMlDwAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:04.047700 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:51893] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcZEzkQFuA2qBk8UMlDwAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:05.992365 2026] [:error] [pid 31257:tid 31269] [client 161.35.219.9:52529] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcZf-JFLfishX45N_OUwAAAQY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:06.915690 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:52529] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcZv-JFLfishX45N_OWQAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:06.915781 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:52529] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcZv-JFLfishX45N_OWQAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:07.948738 2026] [:error] [pid 31257:tid 31275] [client 161.35.219.9:53187] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcZ_-JFLfishX45N_OXAAAAQw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:08.959469 2026] [:error] [pid 28795:tid 28884] [client 161.35.219.9:53441] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcaLROd53wZBkdI_eFAAAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:09.966951 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:53684] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcaUzkQFuA2qBk8UMlLQAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:10.963636 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:53886] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcakzkQFuA2qBk8UMlNAAAAYI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:11.975706 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:54131] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTca_-JFLfishX45N_ObAAAARY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:12.787138 2026] [:error] [pid 31257:tid 31264] [client 161.35.219.9:54131] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcbP-JFLfishX45N_OcAAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:13.804964 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:54569] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcbf-JFLfishX45N_OcwAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:14.825064 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:54827] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcbkzkQFuA2qBk8UMlUAAAAZc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:15.831841 2026] [:error] [pid 28794:tid 28856] [client 161.35.219.9:55113] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcb6Vy2qpaelbUob1ZDQAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:16.857497 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:55353] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTccEzkQFuA2qBk8UMlVwAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:16.857582 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:55353] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTccEzkQFuA2qBk8UMlVwAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:17.904871 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:55593] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTccf-JFLfishX45N_OfAAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:18.940474 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:55854] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTccv-JFLfishX45N_OgAAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:20.114790 2026] [:error] [pid 28794:tid 28841] [client 161.35.219.9:56140] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcdKVy2qpaelbUob1ZGgAAAEU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:21.120188 2026] [:error] [pid 21575:tid 21583] [client 161.35.219.9:56408] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcdSrocdArcJqFfIlvQQAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:22.121707 2026] [:error] [pid 28794:tid 28856] [client 161.35.219.9:56628] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcdqVy2qpaelbUob1ZHQAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:22.121792 2026] [:error] [pid 28794:tid 28856] [client 161.35.219.9:56628] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcdqVy2qpaelbUob1ZHQAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:24.788965 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:57278] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTceEzkQFuA2qBk8UMldwAAAYk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:25.844927 2026] [:error] [pid 28793:tid 28808] [client 161.35.219.9:57531] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTceQ2_fxBANaHo1f5AowAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:28.194149 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:57788] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcfP-JFLfishX45N_OiwAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:29.293086 2026] [:error] [pid 21575:tid 21596] [client 161.35.219.9:58273] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcfSrocdArcJqFfIlvVQAAAVE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:30.688977 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:58273] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcfirocdArcJqFfIlvWgAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:31.763616 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:58918] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcf0zkQFuA2qBk8UMlmAAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:32.789172 2026] [:error] [pid 28794:tid 28860] [client 161.35.219.9:59181] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcgKVy2qpaelbUob1ZIgAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:33.797829 2026] [:error] [pid 31257:tid 31287] [client 161.35.219.9:59430] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcgf-JFLfishX45N_OkwAAARg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:34.893678 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:59718] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcgkzkQFuA2qBk8UMlrAAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:34.893760 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:59718] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcgkzkQFuA2qBk8UMlrAAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:36.828789 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:59992] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTchP-JFLfishX45N_OoAAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:37.699886 2026] [:error] [pid 31257:tid 31264] [client 161.35.219.9:59992] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTchf-JFLfishX45N_OowAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:39.519662 2026] [:error] [pid 31257:tid 31263] [client 161.35.219.9:59992] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTch_-JFLfishX45N_OpwAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:40.391579 2026] [:error] [pid 31257:tid 31272] [client 161.35.219.9:59992] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTciP-JFLfishX45N_OqQAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:40.391638 2026] [:error] [pid 31257:tid 31272] [client 161.35.219.9:59992] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTciP-JFLfishX45N_OqQAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:41.403921 2026] [:error] [pid 21575:tid 21600] [client 161.35.219.9:61364] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTciSrocdArcJqFfIlvbgAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:42.404359 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:61594] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTciv-JFLfishX45N_OrgAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:43.396919 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:61820] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTci0zkQFuA2qBk8UMl6gAAAYs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:44.415758 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:62051] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcjEzkQFuA2qBk8UMl8AAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:45.427383 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:62297] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcjUzkQFuA2qBk8UMl9AAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:45.427476 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:62297] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcjUzkQFuA2qBk8UMl9AAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:46.446772 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:62574] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcjkzkQFuA2qBk8UMl_QAAAZI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:47.459193 2026] [:error] [pid 28908:tid 28931] [client 161.35.219.9:62780] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcj4qJmC8ih_lQQnDU4gAAANU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:48.964482 2026] [:error] [pid 28795:tid 28881] [client 161.35.219.9:63025] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTckLROd53wZBkdI_eFIQAAAJI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:50.554224 2026] [:error] [pid 28795:tid 28885] [client 161.35.219.9:63296] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTckrROd53wZBkdI_eFJwAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:51.576750 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:63498] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTck0zkQFuA2qBk8UMmCgAAAZE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:51.576854 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:63498] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTck0zkQFuA2qBk8UMmCgAAAZE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:52.599934 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:63729] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTclEzkQFuA2qBk8UMmFgAAAY0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:53.619541 2026] [:error] [pid 28908:tid 28932] [client 161.35.219.9:63989] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTclYqJmC8ih_lQQnDU6AAAANY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:54.664997 2026] [:error] [pid 31257:tid 31280] [client 161.35.219.9:64238] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTclv-JFLfishX45N_O9wAAARE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:55.720083 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:64502] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcl_-JFLfishX45N_PAAAAARM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:56.754081 2026] [:error] [pid 28793:tid 28813] [client 161.35.219.9:64736] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcmA2_fxBANaHo1f5AsQAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:58.480169 2026] [:error] [pid 28793:tid 28819] [client 161.35.219.9:64736] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcmg2_fxBANaHo1f5AswAAAAw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:58.480266 2026] [:error] [pid 28793:tid 28819] [client 161.35.219.9:64736] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcmg2_fxBANaHo1f5AswAAAAw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:40:59.555782 2026] [:error] [pid 28793:tid 28820] [client 161.35.219.9:65449] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcmw2_fxBANaHo1f5AtgAAAA0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:00.583643 2026] [:error] [pid 28795:tid 28871] [client 161.35.219.9:49346] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcnLROd53wZBkdI_eFPwAAAIg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:01.598621 2026] [:error] [pid 28795:tid 28867] [client 161.35.219.9:49564] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcnbROd53wZBkdI_eFQwAAAIQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:02.650155 2026] [:error] [pid 28795:tid 28878] [client 161.35.219.9:49812] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcnrROd53wZBkdI_eFSgAAAI8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:02.650232 2026] [:error] [pid 28795:tid 28878] [client 161.35.219.9:49812] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcnrROd53wZBkdI_eFSgAAAI8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:03.725212 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:50055] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcnyrocdArcJqFfIlvswAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:04.758353 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:50307] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcoEzkQFuA2qBk8UMmUwAAAYA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:05.766884 2026] [:error] [pid 28793:tid 28822] [client 161.35.219.9:50536] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcoQ2_fxBANaHo1f5AvQAAAA8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:06.791101 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:50733] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcokzkQFuA2qBk8UMmawAAAYA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:07.796325 2026] [:error] [pid 28794:tid 28854] [client 161.35.219.9:50973] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTco6Vy2qpaelbUob1ZLQAAAFI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:07.796467 2026] [:error] [pid 28794:tid 28854] [client 161.35.219.9:50973] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTco6Vy2qpaelbUob1ZLQAAAFI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:08.806898 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:51227] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcpEzkQFuA2qBk8UMmdgAAAYU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:09.807259 2026] [:error] [pid 28908:tid 28933] [client 161.35.219.9:51499] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcpYqJmC8ih_lQQnDVEAAAANc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:10.845161 2026] [:error] [pid 31257:tid 31269] [client 161.35.219.9:51741] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcpv-JFLfishX45N_PLgAAAQY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:11.872182 2026] [:error] [pid 28793:tid 28809] [client 161.35.219.9:51992] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcpw2_fxBANaHo1f5AwwAAAAI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:12.904493 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:52263] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcqP-JFLfishX45N_PNwAAARM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:12.904573 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:52263] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcqP-JFLfishX45N_PNwAAARM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:14.834572 2026] [:error] [pid 28795:tid 28884] [client 161.35.219.9:52468] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcqrROd53wZBkdI_eFbwAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:15.765293 2026] [:error] [pid 28795:tid 28887] [client 161.35.219.9:52468] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcq7ROd53wZBkdI_eFcAAAAJg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:15.765351 2026] [:error] [pid 28795:tid 28887] [client 161.35.219.9:52468] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcq7ROd53wZBkdI_eFcAAAAJg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:16.787922 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:53103] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcrEzkQFuA2qBk8UMmhQAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:17.824118 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:53334] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcrUzkQFuA2qBk8UMmiwAAAYY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:19.858995 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:53602] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcr0zkQFuA2qBk8UMmmAAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:20.861025 2026] [:error] [pid 28795:tid 28865] [client 161.35.219.9:54000] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcsLROd53wZBkdI_eFcQAAAII"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:21.930078 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:54222] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcsUzkQFuA2qBk8UMmoQAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:21.930133 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:54222] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcsUzkQFuA2qBk8UMmoQAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:25.789029 2026] [:error] [pid 28795:tid 28884] [client 161.35.219.9:54972] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTctbROd53wZBkdI_eFfwAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:26.606159 2026] [:error] [pid 28795:tid 28879] [client 161.35.219.9:54972] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTctrROd53wZBkdI_eFgAAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:26.606266 2026] [:error] [pid 28795:tid 28879] [client 161.35.219.9:54972] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTctrROd53wZBkdI_eFgAAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:27.633990 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:55622] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTct0zkQFuA2qBk8UMmvgAAAYk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:28.673279 2026] [:error] [pid 23872:tid 23885] [client 161.35.219.9:55871] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcuEzkQFuA2qBk8UMmxAAAAYo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:29.700526 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:56188] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcuUzkQFuA2qBk8UMmzQAAAZI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:30.727804 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:56479] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcukzkQFuA2qBk8UMm2AAAAYk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:31.738986 2026] [:error] [pid 28908:tid 28933] [client 161.35.219.9:56744] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcu4qJmC8ih_lQQnDVGgAAANc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:31.739047 2026] [:error] [pid 28908:tid 28933] [client 161.35.219.9:56744] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcu4qJmC8ih_lQQnDVGgAAANc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:32.742125 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:57015] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcvEzkQFuA2qBk8UMm6QAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:33.785598 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:57256] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcvUzkQFuA2qBk8UMm7QAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:34.791890 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:57482] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcvv-JFLfishX45N_PhQAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:35.802754 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:57719] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcv0zkQFuA2qBk8UMm-gAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:36.824115 2026] [:error] [pid 28908:tid 28931] [client 161.35.219.9:57959] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcwIqJmC8ih_lQQnDVIgAAANU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:36.824189 2026] [:error] [pid 28908:tid 28931] [client 161.35.219.9:57959] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcwIqJmC8ih_lQQnDVIgAAANU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:37.837023 2026] [:error] [pid 28908:tid 28921] [client 161.35.219.9:58152] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTcwYqJmC8ih_lQQnDVJQAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:38.842103 2026] [:error] [pid 21575:tid 21596] [client 161.35.219.9:58421] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcwirocdArcJqFfIlwJgAAAVE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:39.891809 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:58676] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTcw_-JFLfishX45N_PmAAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:40.910050 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:58938] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTcxP-JFLfishX45N_PnQAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:41.939066 2026] [:error] [pid 28908:tid 28927] [client 161.35.219.9:59125] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcxYqJmC8ih_lQQnDVKAAAANE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:43.676314 2026] [:error] [pid 28908:tid 28934] [client 161.35.219.9:59125] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcx4qJmC8ih_lQQnDVMAAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:44.544888 2026] [:error] [pid 28908:tid 28925] [client 161.35.219.9:59125] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcyIqJmC8ih_lQQnDVMQAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:44.544955 2026] [:error] [pid 28908:tid 28925] [client 161.35.219.9:59125] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 21"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTcyIqJmC8ih_lQQnDVMQAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:47.350350 2026] [:error] [pid 28794:tid 28854] [client 161.35.219.9:60395] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTcy6Vy2qpaelbUob1ZVAAAAFI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:48.383350 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:60630] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTczEzkQFuA2qBk8UMnKQAAAZI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:49.403530 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:60952] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTczUzkQFuA2qBk8UMnLQAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:50.424482 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:61254] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTczirocdArcJqFfIlwRAAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:50.424575 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:61254] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTczirocdArcJqFfIlwRAAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:52.254435 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:61506] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc0CrocdArcJqFfIlwTQAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:53.066424 2026] [:error] [pid 21575:tid 21601] [client 161.35.219.9:61506] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc0SrocdArcJqFfIlwTwAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:53.066513 2026] [:error] [pid 21575:tid 21601] [client 161.35.219.9:61506] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc0SrocdArcJqFfIlwTwAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:54.938842 2026] [:error] [pid 28908:tid 28929] [client 161.35.219.9:62121] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc0oqJmC8ih_lQQnDVSgAAANM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:55.808873 2026] [:error] [pid 28908:tid 28934] [client 161.35.219.9:62121] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc04qJmC8ih_lQQnDVUAAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:55.808971 2026] [:error] [pid 28908:tid 28934] [client 161.35.219.9:62121] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc04qJmC8ih_lQQnDVUAAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:56.821980 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:62765] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTc1P-JFLfishX45N_P9QAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:57.830185 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:62981] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTc1f-JFLfishX45N_QAAAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:58.849327 2026] [:error] [pid 28794:tid 28854] [client 161.35.219.9:63237] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTc1qVy2qpaelbUob1ZYwAAAFI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:41:59.859014 2026] [:error] [pid 31257:tid 31264] [client 161.35.219.9:63500] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTc1_-JFLfishX45N_QBwAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:00.869439 2026] [:error] [pid 28908:tid 28911] [client 161.35.219.9:63748] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc2IqJmC8ih_lQQnDVWQAAAME"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:00.869498 2026] [:error] [pid 28908:tid 28911] [client 161.35.219.9:63748] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc2IqJmC8ih_lQQnDVWQAAAME"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:01.880784 2026] [:error] [pid 28908:tid 28913] [client 161.35.219.9:64005] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTc2YqJmC8ih_lQQnDVXAAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:02.928517 2026] [:error] [pid 28793:tid 28826] [client 161.35.219.9:64245] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTc2g2_fxBANaHo1f5A0QAAABM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:03.934772 2026] [:error] [pid 28908:tid 28919] [client 161.35.219.9:64484] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTc24qJmC8ih_lQQnDVYAAAAMk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:04.943648 2026] [:error] [pid 28793:tid 28812] [client 161.35.219.9:64715] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTc3A2_fxBANaHo1f5A0wAAAAU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:05.948683 2026] [:error] [pid 28795:tid 28881] [client 161.35.219.9:64962] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc3bROd53wZBkdI_eF8wAAAJI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:06.903198 2026] [:error] [pid 28795:tid 28871] [client 161.35.219.9:64962] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTc3rROd53wZBkdI_eF9wAAAIg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:09.599437 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:49476] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTc4UzkQFuA2qBk8UMnbAAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:10.610585 2026] [:error] [pid 28908:tid 28926] [client 161.35.219.9:49746] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTc4oqJmC8ih_lQQnDVawAAANA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:11.609677 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:49954] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc4_-JFLfishX45N_QNQAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:12.416995 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:49954] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTc5P-JFLfishX45N_QOgAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:13.437163 2026] [:error] [pid 28908:tid 28912] [client 161.35.219.9:50408] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTc5YqJmC8ih_lQQnDVcQAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:14.461518 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:50638] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTc5v-JFLfishX45N_QOwAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:15.473988 2026] [:error] [pid 28794:tid 28843] [client 161.35.219.9:50872] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTc56Vy2qpaelbUob1ZbwAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:16.580893 2026] [:error] [pid 31257:tid 31286] [client 161.35.219.9:51152] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc6P-JFLfishX45N_QQwAAARc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:17.462031 2026] [:error] [pid 31257:tid 31269] [client 161.35.219.9:51152] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTc6f-JFLfishX45N_QRwAAAQY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:18.481937 2026] [:error] [pid 23872:tid 23894] [client 161.35.219.9:51626] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTc6kzkQFuA2qBk8UMnjAAAAZM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:19.501834 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:51953] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTc60zkQFuA2qBk8UMnkwAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:20.507565 2026] [:error] [pid 28795:tid 28878] [client 161.35.219.9:52213] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTc7LROd53wZBkdI_eGBQAAAI8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:21.530264 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:52424] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc7f-JFLfishX45N_QVQAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:21.530363 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:52424] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc7f-JFLfishX45N_QVQAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:23.540557 2026] [:error] [pid 21575:tid 21582] [client 161.35.219.9:52667] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc7yrocdArcJqFfIlwjgAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:24.512136 2026] [:error] [pid 21575:tid 21580] [client 161.35.219.9:52667] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc8CrocdArcJqFfIlwlQAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:25.463520 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:52667] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTc8SrocdArcJqFfIlwlgAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:26.474518 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:53543] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTc8kzkQFuA2qBk8UMnrAAAAYs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:27.503670 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:53744] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTc8yrocdArcJqFfIlwmAAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:28.505425 2026] [:error] [pid 28908:tid 28910] [client 161.35.219.9:53997] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTc9IqJmC8ih_lQQnDViQAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:29.520533 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:54273] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc9SrocdArcJqFfIlwnAAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:29.520620 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:54273] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc9SrocdArcJqFfIlwnAAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:30.579146 2026] [:error] [pid 21575:tid 21587] [client 161.35.219.9:54555] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTc9irocdArcJqFfIlwqQAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:31.608820 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:54736] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTc90zkQFuA2qBk8UMnugAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:32.604337 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:54984] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTc-P-JFLfishX45N_QdAAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:33.630055 2026] [:error] [pid 28795:tid 28887] [client 161.35.219.9:55254] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTc-bROd53wZBkdI_eGCQAAAJg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:34.649070 2026] [:error] [pid 28793:tid 28811] [client 161.35.219.9:55498] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc-g2_fxBANaHo1f5A6wAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:34.649162 2026] [:error] [pid 28793:tid 28811] [client 161.35.219.9:55498] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc-g2_fxBANaHo1f5A6wAAAAQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:36.525700 2026] [:error] [pid 28908:tid 28913] [client 161.35.219.9:55760] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc_IqJmC8ih_lQQnDVqgAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:37.394155 2026] [:error] [pid 28908:tid 28918] [client 161.35.219.9:55760] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc_YqJmC8ih_lQQnDVrQAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:37.394232 2026] [:error] [pid 28908:tid 28918] [client 161.35.219.9:55760] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTc_YqJmC8ih_lQQnDVrQAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:38.436029 2026] [:error] [pid 28795:tid 28863] [client 161.35.219.9:56412] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTc_rROd53wZBkdI_eGDQAAAIA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:39.454284 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:56713] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTc_yrocdArcJqFfIlwvwAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:40.461280 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:56954] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdAP-JFLfishX45N_QmgAAARU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:41.462808 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:57188] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdAUzkQFuA2qBk8UMn6AAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:42.483733 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:57367] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdAkzkQFuA2qBk8UMn7wAAAYk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:44.263612 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:57367] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdBEzkQFuA2qBk8UMn9AAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:45.124471 2026] [:error] [pid 23872:tid 23876] [client 161.35.219.9:57367] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdBUzkQFuA2qBk8UMn9wAAAYE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:46.814173 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:57367] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdBkzkQFuA2qBk8UMn-gAAAYI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:47.682529 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:57367] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdB0zkQFuA2qBk8UMn-wAAAYA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:47.682606 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:57367] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdB0zkQFuA2qBk8UMn-wAAAYA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:49.652807 2026] [:error] [pid 21575:tid 21588] [client 161.35.219.9:58729] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdCSrocdArcJqFfIlwzwAAAUk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:50.631477 2026] [:error] [pid 21575:tid 21593] [client 161.35.219.9:58729] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdCirocdArcJqFfIlw0gAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:51.568194 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:58729] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdCyrocdArcJqFfIlw1wAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:52.567150 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:59626] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdDCrocdArcJqFfIlw3QAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:53.568559 2026] [:error] [pid 28908:tid 28917] [client 161.35.219.9:59858] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdDYqJmC8ih_lQQnDWFQAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:54.607227 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:60094] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdDv-JFLfishX45N_QuAAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:55.613839 2026] [:error] [pid 28794:tid 28837] [client 161.35.219.9:60372] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdD6Vy2qpaelbUob1ZlgAAAEE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:56.442732 2026] [:error] [pid 28794:tid 28840] [client 161.35.219.9:60372] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdEKVy2qpaelbUob1ZlwAAAEQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:57.460667 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:60768] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdEUzkQFuA2qBk8UMoEQAAAZI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:58.462206 2026] [:error] [pid 31257:tid 31280] [client 161.35.219.9:61015] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdEv-JFLfishX45N_QxgAAARE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:42:59.479652 2026] [:error] [pid 28794:tid 28844] [client 161.35.219.9:61293] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdE6Vy2qpaelbUob1ZmgAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:00.523072 2026] [:error] [pid 28795:tid 28870] [client 161.35.219.9:61551] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdFLROd53wZBkdI_eGOQAAAIc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:02.417002 2026] [:error] [pid 28795:tid 28877] [client 161.35.219.9:61551] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdFrROd53wZBkdI_eGOwAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:03.282297 2026] [:error] [pid 28795:tid 28886] [client 161.35.219.9:61551] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdF7ROd53wZBkdI_eGPAAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:03.282418 2026] [:error] [pid 28795:tid 28886] [client 161.35.219.9:61551] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdF7ROd53wZBkdI_eGPAAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:04.351576 2026] [:error] [pid 28794:tid 28848] [client 161.35.219.9:62455] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdGKVy2qpaelbUob1ZqgAAAEw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:05.374464 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:62721] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdGUzkQFuA2qBk8UMoNwAAAYA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:06.390709 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:62935] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdGkzkQFuA2qBk8UMoQAAAAYI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:07.396734 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:63174] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdGyrocdArcJqFfIlw-AAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:08.418508 2026] [:error] [pid 21575:tid 21581] [client 161.35.219.9:63397] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdHCrocdArcJqFfIlxAgAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:09.291608 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:63397] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdHSrocdArcJqFfIlxBwAAAVI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:10.338526 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:63942] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdHv-JFLfishX45N_Q4wAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:11.350620 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:64205] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdH0zkQFuA2qBk8UMoWAAAAZI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:12.363494 2026] [:error] [pid 31257:tid 31275] [client 161.35.219.9:64433] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdIP-JFLfishX45N_Q9QAAAQw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:13.385756 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:64695] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdIf-JFLfishX45N_Q_QAAARY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:15.134991 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:64695] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdI_-JFLfishX45N_RBQAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:16.108554 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:64695] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdJP-JFLfishX45N_RCAAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:18.055097 2026] [:error] [pid 31257:tid 31287] [client 161.35.219.9:64695] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdJv-JFLfishX45N_RDgAAARg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:19.030230 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:64695] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdJ_-JFLfishX45N_REQAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:20.876452 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:64695] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdKP-JFLfishX45N_RFQAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:21.832371 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:64695] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdKf-JFLfishX45N_RFwAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:21.832483 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:64695] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdKf-JFLfishX45N_RFwAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:23.797408 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:50810] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdK0zkQFuA2qBk8UMo3gAAAYI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:24.673206 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:50810] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdLEzkQFuA2qBk8UMo7wAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:25.575841 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:50810] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdLUzkQFuA2qBk8UMo9wAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:26.589062 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:51852] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdLkzkQFuA2qBk8UMpAwAAAYk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:27.593401 2026] [:error] [pid 28908:tid 28917] [client 161.35.219.9:52158] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdL4qJmC8ih_lQQnDWOgAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:28.631074 2026] [:error] [pid 28908:tid 28928] [client 161.35.219.9:52444] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdMIqJmC8ih_lQQnDWPQAAANI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:29.649326 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:52824] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdMUzkQFuA2qBk8UMpHAAAAY4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:30.579166 2026] [:error] [pid 23872:tid 23883] [client 161.35.219.9:52824] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdMkzkQFuA2qBk8UMpJgAAAYg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:31.982563 2026] [:error] [pid 21575:tid 21580] [client 161.35.219.9:53370] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdMyrocdArcJqFfIlxPQAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:33.022263 2026] [:error] [pid 23872:tid 23883] [client 161.35.219.9:53655] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdNUzkQFuA2qBk8UMpMwAAAYg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:34.053954 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:53938] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdNkzkQFuA2qBk8UMpPwAAAYQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:35.091732 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:54216] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdN0zkQFuA2qBk8UMpUQAAAYs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:35.091812 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:54216] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdN0zkQFuA2qBk8UMpUQAAAYs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:37.014585 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:54484] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdOSrocdArcJqFfIlxSAAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:37.852225 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:54484] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdOSrocdArcJqFfIlxSwAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:37.852333 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:54484] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdOSrocdArcJqFfIlxSwAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:39.752476 2026] [:error] [pid 28793:tid 28817] [client 161.35.219.9:55218] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdOw2_fxBANaHo1f5BEwAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:40.613167 2026] [:error] [pid 28793:tid 28813] [client 161.35.219.9:55218] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdPA2_fxBANaHo1f5BFAAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:40.613243 2026] [:error] [pid 28793:tid 28813] [client 161.35.219.9:55218] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdPA2_fxBANaHo1f5BFAAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:41.636194 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:56013] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdPUzkQFuA2qBk8UMpggAAAYs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:42.648099 2026] [:error] [pid 21575:tid 21596] [client 161.35.219.9:56327] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdPirocdArcJqFfIlxUQAAAVE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:43.664228 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:56596] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdP_-JFLfishX45N_RQgAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:44.681588 2026] [:error] [pid 31257:tid 31287] [client 161.35.219.9:56863] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdQP-JFLfishX45N_RRwAAARg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:46.522572 2026] [:error] [pid 28908:tid 28914] [client 161.35.219.9:57149] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdQoqJmC8ih_lQQnDWVwAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:46.522678 2026] [:error] [pid 28908:tid 28914] [client 161.35.219.9:57149] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdQoqJmC8ih_lQQnDWVwAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:47.526452 2026] [:error] [pid 28794:tid 28852] [client 161.35.219.9:57482] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdQ6Vy2qpaelbUob1ZwgAAAFA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:48.533846 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:57747] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdREzkQFuA2qBk8UMpqQAAAYY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:49.574736 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:58072] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdRUzkQFuA2qBk8UMpsgAAAYk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:50.580000 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:58354] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdRkzkQFuA2qBk8UMpuAAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:51.602560 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:58625] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdR0zkQFuA2qBk8UMpwAAAAYk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:51.602651 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:58625] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdR0zkQFuA2qBk8UMpwAAAAYk"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:53.453341 2026] [:error] [pid 28908:tid 28912] [client 161.35.219.9:58884] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdSYqJmC8ih_lQQnDWawAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:54.220555 2026] [:error] [pid 28908:tid 28934] [client 161.35.219.9:58884] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdSoqJmC8ih_lQQnDWbQAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:54.220626 2026] [:error] [pid 28908:tid 28934] [client 161.35.219.9:58884] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdSoqJmC8ih_lQQnDWbQAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:56.625762 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:59567] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdTEzkQFuA2qBk8UMp2AAAAYU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:57.424632 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:59567] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdTUzkQFuA2qBk8UMp3AAAAYs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:57.424703 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:59567] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdTUzkQFuA2qBk8UMp3AAAAYs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:58.428704 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:60254] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdTkzkQFuA2qBk8UMp5QAAAY0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:43:59.447573 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:60557] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdT0zkQFuA2qBk8UMp7wAAAYU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:00.473622 2026] [:error] [pid 23872:tid 23876] [client 161.35.219.9:60850] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdUEzkQFuA2qBk8UMqAAAAAYE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:01.484057 2026] [:error] [pid 28795:tid 28870] [client 161.35.219.9:61126] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdUbROd53wZBkdI_eGgwAAAIc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:02.519016 2026] [:error] [pid 23872:tid 23894] [client 161.35.219.9:61365] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdUkzkQFuA2qBk8UMqGwAAAZM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:02.519080 2026] [:error] [pid 23872:tid 23894] [client 161.35.219.9:61365] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdUkzkQFuA2qBk8UMqGwAAAZM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:04.435445 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:61634] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdVP-JFLfishX45N_ReQAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:05.314822 2026] [:error] [pid 31257:tid 31275] [client 161.35.219.9:61634] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdVf-JFLfishX45N_RfQAAAQw"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:07.046196 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:61634] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdV_-JFLfishX45N_RfwAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:07.851102 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:61634] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdV_-JFLfishX45N_RgAAAARA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:08.667123 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:61634] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdWP-JFLfishX45N_RggAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:09.688774 2026] [:error] [pid 28908:tid 28914] [client 161.35.219.9:63346] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdWYqJmC8ih_lQQnDWiAAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:10.688722 2026] [:error] [pid 28794:tid 28849] [client 161.35.219.9:63676] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdWqVy2qpaelbUob1Z1wAAAE0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:11.697824 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:63955] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdW0zkQFuA2qBk8UMqVwAAAYY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:12.723574 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:64219] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdXCrocdArcJqFfIlxigAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:12.723682 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:64219] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdXCrocdArcJqFfIlxigAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:13.728809 2026] [:error] [pid 28793:tid 28821] [client 161.35.219.9:64496] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdXQ2_fxBANaHo1f5BMAAAAA4"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:14.742219 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:64790] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdXkzkQFuA2qBk8UMqZAAAAZQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:15.765814 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:65068] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdX_-JFLfishX45N_RjgAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:16.765731 2026] [:error] [pid 21575:tid 21581] [client 161.35.219.9:65344] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdYCrocdArcJqFfIlxnAAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:17.782174 2026] [:error] [pid 21575:tid 21587] [client 161.35.219.9:49229] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdYSrocdArcJqFfIlxpAAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:18.669235 2026] [:error] [pid 21575:tid 21592] [client 161.35.219.9:49229] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdYirocdArcJqFfIlxpwAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:19.697199 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:49775] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdY_-JFLfishX45N_RlwAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:20.721058 2026] [:error] [pid 28795:tid 28879] [client 161.35.219.9:50053] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdZLROd53wZBkdI_eGkwAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:21.718584 2026] [:error] [pid 21575:tid 21601] [client 161.35.219.9:50343] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdZSrocdArcJqFfIlxqQAAAVY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:22.778239 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:50642] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdZirocdArcJqFfIlxrQAAAVI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:23.599077 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:50642] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdZyrocdArcJqFfIlxrwAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:24.627059 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:51116] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdaCrocdArcJqFfIlxsgAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:25.646421 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:51395] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdaf-JFLfishX45N_RpgAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:26.660683 2026] [:error] [pid 31257:tid 31264] [client 161.35.219.9:51658] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdav-JFLfishX45N_RqwAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:27.689658 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:51943] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTda0zkQFuA2qBk8UMqnQAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:27.689748 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:51943] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTda0zkQFuA2qBk8UMqnQAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:29.526202 2026] [:error] [pid 23872:tid 23883] [client 161.35.219.9:52225] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdbUzkQFuA2qBk8UMq1wAAAYg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:30.328216 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:52225] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdbkzkQFuA2qBk8UMq3AAAAZQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:31.129020 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:52225] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdb0zkQFuA2qBk8UMq3gAAAYY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:32.149769 2026] [:error] [pid 28908:tid 28934] [client 161.35.219.9:53132] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdcIqJmC8ih_lQQnDWrgAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:33.164801 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:53377] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdcf-JFLfishX45N_RuAAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:34.213054 2026] [:error] [pid 28908:tid 28910] [client 161.35.219.9:53608] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdcoqJmC8ih_lQQnDWswAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:35.255888 2026] [:error] [pid 28908:tid 28918] [client 161.35.219.9:53851] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdc4qJmC8ih_lQQnDWugAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:36.936762 2026] [:error] [pid 28908:tid 28913] [client 161.35.219.9:53851] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTddIqJmC8ih_lQQnDWwgAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:37.753962 2026] [:error] [pid 28908:tid 28910] [client 161.35.219.9:53851] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTddYqJmC8ih_lQQnDWxAAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:37.754039 2026] [:error] [pid 28908:tid 28910] [client 161.35.219.9:53851] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTddYqJmC8ih_lQQnDWxAAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:39.640404 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:54720] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTddyrocdArcJqFfIlxxQAAAVI"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:40.451192 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:54720] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdeCrocdArcJqFfIlxywAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:40.451291 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:54720] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdeCrocdArcJqFfIlxywAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:41.493864 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:55376] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdef-JFLfishX45N_R6QAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:42.507950 2026] [:error] [pid 31257:tid 31263] [client 161.35.219.9:55603] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdev-JFLfishX45N_R7wAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:43.522408 2026] [:error] [pid 23872:tid 23885] [client 161.35.219.9:55802] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTde0zkQFuA2qBk8UMq_gAAAYo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:44.977647 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:56064] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdfP-JFLfishX45N_R-AAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:45.996526 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:56336] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdfUzkQFuA2qBk8UMrCAAAAY0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:45.996595 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:56336] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdfUzkQFuA2qBk8UMrCAAAAY0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:47.875187 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:56586] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdf_-JFLfishX45N_R_gAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:48.662917 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:56586] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdgP-JFLfishX45N_SAAAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:48.663024 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:56586] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdgP-JFLfishX45N_SAAAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:49.685219 2026] [:error] [pid 28795:tid 28865] [client 161.35.219.9:57354] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdgbROd53wZBkdI_eGuAAAAII"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:50.696289 2026] [:error] [pid 28794:tid 28858] [client 161.35.219.9:57620] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdgqVy2qpaelbUob1Z-QAAAFY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:53.542586 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:58280] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdhUzkQFuA2qBk8UMrJgAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:54.589203 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:58524] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdhv-JFLfishX45N_SCQAAARM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:55.366180 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:58524] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdh_-JFLfishX45N_SCgAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:56.386442 2026] [:error] [pid 28793:tid 28817] [client 161.35.219.9:59013] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdiA2_fxBANaHo1f5BVgAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:57.395184 2026] [:error] [pid 21575:tid 21592] [client 161.35.219.9:59261] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdiSrocdArcJqFfIlx3wAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:58.428695 2026] [:error] [pid 21575:tid 21583] [client 161.35.219.9:59497] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdiirocdArcJqFfIlx4wAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:59.445473 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:59808] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdi0zkQFuA2qBk8UMrOQAAAZE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:44:59.445575 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:59808] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdi0zkQFuA2qBk8UMrOQAAAZE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:00.453124 2026] [:error] [pid 31257:tid 31280] [client 161.35.219.9:60105] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdjP-JFLfishX45N_SEwAAARE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:01.465324 2026] [:error] [pid 28793:tid 28831] [client 161.35.219.9:60331] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdjQ2_fxBANaHo1f5BXAAAABg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:02.489540 2026] [:error] [pid 28795:tid 28867] [client 161.35.219.9:60552] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdjrROd53wZBkdI_eG0gAAAIQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:03.505750 2026] [:error] [pid 28795:tid 28880] [client 161.35.219.9:60785] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdj7ROd53wZBkdI_eG1QAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:04.521618 2026] [:error] [pid 28908:tid 28930] [client 161.35.219.9:61032] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdkIqJmC8ih_lQQnDW3AAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:04.521723 2026] [:error] [pid 28908:tid 28930] [client 161.35.219.9:61032] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdkIqJmC8ih_lQQnDW3AAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:05.551185 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:61274] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdkUzkQFuA2qBk8UMrZQAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:06.597279 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:61495] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdkkzkQFuA2qBk8UMrcQAAAZQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:07.610059 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:61735] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdkyrocdArcJqFfIlx7AAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:08.616676 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:61973] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdlEzkQFuA2qBk8UMrfQAAAYQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:09.638694 2026] [:error] [pid 28794:tid 28836] [client 161.35.219.9:62256] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdlaVy2qpaelbUob1aBgAAAEA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:09.638775 2026] [:error] [pid 28794:tid 28836] [client 161.35.219.9:62256] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdlaVy2qpaelbUob1aBgAAAEA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:10.652794 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:62520] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdlv-JFLfishX45N_SLgAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:11.717934 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:62767] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdl_-JFLfishX45N_SOAAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:12.730221 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:62969] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdmP-JFLfishX45N_SRwAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:13.733772 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:63233] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdmSrocdArcJqFfIlx9wAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:14.948571 2026] [:error] [pid 21575:tid 21580] [client 161.35.219.9:63475] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdmirocdArcJqFfIlx_AAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:14.948643 2026] [:error] [pid 21575:tid 21580] [client 161.35.219.9:63475] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdmirocdArcJqFfIlx_AAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:17.207072 2026] [:error] [pid 21575:tid 21583] [client 161.35.219.9:63748] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdnSrocdArcJqFfIlyHwAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:18.269687 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:63748] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdnirocdArcJqFfIlyKQAAAVA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:20.024655 2026] [:error] [pid 21575:tid 21582] [client 161.35.219.9:63748] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdoCrocdArcJqFfIlyMQAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:20.937664 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:63748] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdoCrocdArcJqFfIlyMwAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:21.822576 2026] [:error] [pid 21575:tid 21590] [client 161.35.219.9:63748] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdoSrocdArcJqFfIlyNAAAAUs"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:22.840777 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:65455] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdov-JFLfishX45N_SewAAARY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:23.872755 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:49359] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdo0zkQFuA2qBk8UMrwQAAAZA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:24.882865 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:49607] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdpP-JFLfishX45N_ShQAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:31.053014 2026] [:error] [pid 31257:tid 31269] [client 161.35.219.9:51231] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdq_-JFLfishX45N_SpQAAAQY"]
[Mon Mar 02 08:45:40.537504 2026] [:error] [pid 31257:tid 31263] [client 161.35.219.9:51231] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaTdtP-JFLfishX45N_SygAAAQA"], referer: https://t.co/
[Mon Mar 02 08:45:46.429034 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:53681] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaTdukzkQFuA2qBk8UMsDwAAAYU"], referer: https://www.bing.com/
[Mon Mar 02 08:45:52.593146 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:55084] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaTdwP-JFLfishX45N_TCQAAAQ4"], referer: https://duckduckgo.com/
[Mon Mar 02 08:45:55.877023 2026] [:error] [pid 28795:tid 28879] [client 161.35.219.9:56585] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdw7ROd53wZBkdI_eHFgAAAJA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:57.607151 2026] [:error] [pid 28793:tid 28811] [client 161.35.219.9:51841] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdxQ2_fxBANaHo1f5BgAAAAAQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:57.607223 2026] [:error] [pid 28793:tid 28811] [client 161.35.219.9:51841] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdxQ2_fxBANaHo1f5BgAAAAAQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:57.852418 2026] [:error] [pid 28795:tid 28883] [client 161.35.219.9:56585] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdxbROd53wZBkdI_eHHQAAAJQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:58.877604 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:57709] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdxirocdArcJqFfIlyZwAAAVc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:45:59.906773 2026] [:error] [pid 28795:tid 28884] [client 161.35.219.9:58099] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTdx7ROd53wZBkdI_eHIQAAAJU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:00.923851 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:58376] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdyEzkQFuA2qBk8UMsUwAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:03.558363 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:58976] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdy0zkQFuA2qBk8UMsdAAAAYM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:04.379258 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:58376] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdzEzkQFuA2qBk8UMsegAAAZc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:04.379326 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:58376] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTdzEzkQFuA2qBk8UMsegAAAZc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:05.409686 2026] [:error] [pid 31257:tid 31286] [client 161.35.219.9:59446] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTdzf-JFLfishX45N_TTAAAARc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:06.434329 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:59701] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTdzv-JFLfishX45N_TUAAAARQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:07.438216 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:59966] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTdz0zkQFuA2qBk8UMsigAAAZU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:08.456601 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:60203] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTd0EzkQFuA2qBk8UMskAAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:09.495267 2026] [:error] [pid 28795:tid 28879] [client 161.35.219.9:60526] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd0bROd53wZBkdI_eHKQAAAJA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:12.164362 2026] [:error] [pid 23872:tid 23883] [client 161.35.219.9:61178] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd1EzkQFuA2qBk8UMsmQAAAYg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:13.158237 2026] [:error] [pid 28795:tid 28886] [client 161.35.219.9:60526] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd1bROd53wZBkdI_eHKwAAAJc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:14.945246 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:61178] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd1kzkQFuA2qBk8UMspwAAAYw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:15.822121 2026] [:error] [pid 28795:tid 28872] [client 161.35.219.9:60526] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd17ROd53wZBkdI_eHLgAAAIk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:17.623278 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:61178] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd2UzkQFuA2qBk8UMswwAAAZg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:18.428995 2026] [:error] [pid 28795:tid 28885] [client 161.35.219.9:60526] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd2rROd53wZBkdI_eHMQAAAJY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:20.061259 2026] [:error] [pid 23872:tid 23876] [client 161.35.219.9:61178] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd3EzkQFuA2qBk8UMszQAAAYE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:20.870754 2026] [:error] [pid 28795:tid 28867] [client 161.35.219.9:60526] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd3LROd53wZBkdI_eHNQAAAIQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:22.492566 2026] [:error] [pid 23872:tid 23876] [client 161.35.219.9:61178] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd3kzkQFuA2qBk8UMs4QAAAYE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:23.318114 2026] [:error] [pid 28795:tid 28873] [client 161.35.219.9:60526] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd37ROd53wZBkdI_eHPgAAAIo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:23.318203 2026] [:error] [pid 28795:tid 28873] [client 161.35.219.9:60526] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd37ROd53wZBkdI_eHPgAAAIo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:25.135979 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:61178] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd4UzkQFuA2qBk8UMs6AAAAYM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:25.922028 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:64081] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd4SrocdArcJqFfIlyxAAAAUU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:25.922124 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:64081] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd4SrocdArcJqFfIlyxAAAAUU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:26.920146 2026] [:error] [pid 28908:tid 28927] [client 161.35.219.9:64706] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTd4oqJmC8ih_lQQnDXRAAAANE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:27.921832 2026] [:error] [pid 28908:tid 28921] [client 161.35.219.9:64936] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTd44qJmC8ih_lQQnDXTAAAAMs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:28.926107 2026] [:error] [pid 28908:tid 28916] [client 161.35.219.9:65231] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTd5IqJmC8ih_lQQnDXUAAAAMY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:29.970289 2026] [:error] [pid 28794:tid 28857] [client 161.35.219.9:49164] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTd5aVy2qpaelbUob1aXgAAAFU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:30.999250 2026] [:error] [pid 21575:tid 21598] [client 161.35.219.9:49453] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd5irocdArcJqFfIlyxgAAAVM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:30.999344 2026] [:error] [pid 21575:tid 21598] [client 161.35.219.9:49453] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd5irocdArcJqFfIlyxgAAAVM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:32.010685 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:49706] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTd6P-JFLfishX45N_TuAAAAQc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:33.043735 2026] [:error] [pid 28795:tid 28871] [client 161.35.219.9:49956] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTd6bROd53wZBkdI_eHSAAAAIg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:35.536377 2026] [:error] [pid 28908:tid 28930] [client 161.35.219.9:50583] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTd64qJmC8ih_lQQnDXVgAAANQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:36.621792 2026] [:error] [pid 28794:tid 28849] [client 161.35.219.9:50789] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd7KVy2qpaelbUob1aaAAAAE0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:39.238348 2026] [:error] [pid 28794:tid 28856] [client 161.35.219.9:51411] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd76Vy2qpaelbUob1abAAAAFQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:40.143759 2026] [:error] [pid 28794:tid 28850] [client 161.35.219.9:50789] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd8KVy2qpaelbUob1abgAAAE4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:41.865993 2026] [:error] [pid 28794:tid 28842] [client 161.35.219.9:51411] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd8aVy2qpaelbUob1acAAAAEY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:42.988534 2026] [:error] [pid 28794:tid 28849] [client 161.35.219.9:50789] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd8qVy2qpaelbUob1acQAAAE0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:42.988607 2026] [:error] [pid 28794:tid 28849] [client 161.35.219.9:50789] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd8qVy2qpaelbUob1acQAAAE0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:44.870399 2026] [:error] [pid 28794:tid 28840] [client 161.35.219.9:51411] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd9KVy2qpaelbUob1acgAAAEQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:45.681967 2026] [:error] [pid 31257:tid 31280] [client 161.35.219.9:52550] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd9f-JFLfishX45N_T6AAAARE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:47.385059 2026] [:error] [pid 28794:tid 28857] [client 161.35.219.9:51411] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd96Vy2qpaelbUob1acwAAAFU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:48.244680 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:52550] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd-P-JFLfishX45N_T-QAAAQU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:50.049565 2026] [:error] [pid 28794:tid 28848] [client 161.35.219.9:51411] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd-qVy2qpaelbUob1adAAAAEw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:51.002625 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:52550] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd-_-JFLfishX45N_UDAAAAQg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:53.642485 2026] [:error] [pid 28794:tid 28859] [client 161.35.219.9:51411] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd_aVy2qpaelbUob1adQAAAFc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:54.523781 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:52550] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTd_v-JFLfishX45N_ULAAAAQI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:56.245134 2026] [:error] [pid 28794:tid 28836] [client 161.35.219.9:51411] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeAKVy2qpaelbUob1adwAAAEA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:57.158201 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:52550] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeAf-JFLfishX45N_UOwAAAQ8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:57.954503 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:52550] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTeAf-JFLfishX45N_UPQAAAQ4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:58.977209 2026] [:error] [pid 28793:tid 28813] [client 161.35.219.9:56089] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTeAg2_fxBANaHo1f5BogAAAAY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:46:59.991594 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:56401] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTeA0zkQFuA2qBk8UMtKwAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:01.004929 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:56703] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTeBUzkQFuA2qBk8UMtMAAAAZA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:02.033494 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:56995] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeBkzkQFuA2qBk8UMtMwAAAYI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:02.839090 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:56995] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTeBkzkQFuA2qBk8UMtNAAAAY8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:03.893767 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:57432] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTeB0zkQFuA2qBk8UMtOQAAAYw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:04.912309 2026] [:error] [pid 28794:tid 28849] [client 161.35.219.9:57678] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTeCKVy2qpaelbUob1agAAAAE0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:05.932092 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:57936] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTeCf-JFLfishX45N_USAAAAQ0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:06.949090 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:58166] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeCkzkQFuA2qBk8UMtQgAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:07.767235 2026] [:error] [pid 23872:tid 23894] [client 161.35.219.9:58166] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTeC0zkQFuA2qBk8UMtRgAAAZM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:08.781805 2026] [:error] [pid 28793:tid 28807] [client 161.35.219.9:58639] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTeDA2_fxBANaHo1f5BpAAAAAA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:09.811745 2026] [:error] [pid 28793:tid 28812] [client 161.35.219.9:58957] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTeDQ2_fxBANaHo1f5BpwAAAAU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:10.832071 2026] [:error] [pid 28793:tid 28824] [client 161.35.219.9:59260] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTeDg2_fxBANaHo1f5BrAAAABE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:11.845654 2026] [:error] [pid 28795:tid 28865] [client 161.35.219.9:59529] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeD7ROd53wZBkdI_eHcAAAAII"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:12.649345 2026] [:error] [pid 28795:tid 28879] [client 161.35.219.9:59529] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTeELROd53wZBkdI_eHdAAAAJA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:13.678462 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:60082] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTeEUzkQFuA2qBk8UMtTAAAAY0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:14.687310 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:60325] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTeEirocdArcJqFfIly5gAAAVc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:15.699315 2026] [:error] [pid 28794:tid 28858] [client 161.35.219.9:60573] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTeE6Vy2qpaelbUob1aggAAAFY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:16.731377 2026] [:error] [pid 21575:tid 21586] [client 161.35.219.9:60798] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeFCrocdArcJqFfIly6wAAAUc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:19.294697 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:61414] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeFyrocdArcJqFfIly_AAAAUA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:20.058476 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:60798] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeGCrocdArcJqFfIly_QAAAVA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:20.058569 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:60798] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeGCrocdArcJqFfIly_QAAAVA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:22.063079 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:61414] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeGirocdArcJqFfIlzAwAAAVQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:22.897102 2026] [:error] [pid 21575:tid 21592] [client 161.35.219.9:61910] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeGirocdArcJqFfIlzBQAAAU0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:22.897176 2026] [:error] [pid 21575:tid 21592] [client 161.35.219.9:61910] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeGirocdArcJqFfIlzBQAAAU0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:24.729525 2026] [:error] [pid 21575:tid 21581] [client 161.35.219.9:61414] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeHCrocdArcJqFfIlzCQAAAUI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:25.507966 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:62531] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeHUzkQFuA2qBk8UMtUwAAAZY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:25.508028 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:62531] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeHUzkQFuA2qBk8UMtUwAAAZY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:27.334500 2026] [:error] [pid 21575:tid 21600] [client 161.35.219.9:61414] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeHyrocdArcJqFfIlzCgAAAVU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:28.106602 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:63113] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeIEzkQFuA2qBk8UMtZAAAAYs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:28.106816 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:63113] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeIEzkQFuA2qBk8UMtZAAAAYs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:29.146635 2026] [:error] [pid 28908:tid 28925] [client 161.35.219.9:63705] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTeIYqJmC8ih_lQQnDXlwAAAM8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:30.161956 2026] [:error] [pid 28795:tid 28874] [client 161.35.219.9:64006] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTeIrROd53wZBkdI_eHkgAAAIs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:31.188686 2026] [:error] [pid 28794:tid 28858] [client 161.35.219.9:64247] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTeI6Vy2qpaelbUob1ajgAAAFY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:32.214751 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:64521] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeJEzkQFuA2qBk8UMtcAAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:33.007205 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:64521] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTeJUzkQFuA2qBk8UMteAAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:34.050897 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:64968] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTeJkzkQFuA2qBk8UMtfQAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:35.056794 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:65233] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTeJyrocdArcJqFfIlzEAAAAUA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:36.086537 2026] [:error] [pid 28908:tid 28923] [client 161.35.219.9:65474] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTeKIqJmC8ih_lQQnDXnQAAAM0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:37.124266 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:49303] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeKSrocdArcJqFfIlzEQAAAVc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:39.513202 2026] [:error] [pid 28908:tid 28916] [client 161.35.219.9:49866] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeK4qJmC8ih_lQQnDXpAAAAMY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:40.358627 2026] [:error] [pid 21575:tid 21587] [client 161.35.219.9:49303] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeLCrocdArcJqFfIlzFwAAAUg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:42.589549 2026] [:error] [pid 28908:tid 28914] [client 161.35.219.9:49866] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeLoqJmC8ih_lQQnDXpwAAAMQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:43.414324 2026] [:error] [pid 21575:tid 21593] [client 161.35.219.9:49303] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeLyrocdArcJqFfIlzHQAAAU4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:45.127441 2026] [:error] [pid 28908:tid 28934] [client 161.35.219.9:49866] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeMYqJmC8ih_lQQnDXqAAAANg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:45.952652 2026] [:error] [pid 21575:tid 21588] [client 161.35.219.9:49303] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeMSrocdArcJqFfIlzIQAAAUk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:45.952750 2026] [:error] [pid 21575:tid 21588] [client 161.35.219.9:49303] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeMSrocdArcJqFfIlzIQAAAUk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:47.832271 2026] [:error] [pid 28908:tid 28927] [client 161.35.219.9:49866] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeM4qJmC8ih_lQQnDXrgAAANE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:48.661693 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:51514] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeNEzkQFuA2qBk8UMtvgAAAYM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:50.880731 2026] [:error] [pid 28908:tid 28916] [client 161.35.219.9:49866] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeNoqJmC8ih_lQQnDXsQAAAMY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:51.745739 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:51514] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeN0zkQFuA2qBk8UMtxQAAAYY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:51.745803 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:51514] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeN0zkQFuA2qBk8UMtxQAAAYY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:52.771470 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:53005] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTeOEzkQFuA2qBk8UMtyQAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:53.785268 2026] [:error] [pid 31257:tid 31275] [client 161.35.219.9:53211] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTeOf-JFLfishX45N_UmwAAAQw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:55.648920 2026] [:error] [pid 28908:tid 28917] [client 161.35.219.9:53473] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTeO4qJmC8ih_lQQnDXtgAAAMc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:56.661720 2026] [:error] [pid 28794:tid 28859] [client 161.35.219.9:53833] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTePKVy2qpaelbUob1alwAAAFc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:57.702628 2026] [:error] [pid 28794:tid 28860] [client 161.35.219.9:54048] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTePaVy2qpaelbUob1amAAAAFg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:47:57.702679 2026] [:error] [pid 28794:tid 28860] [client 161.35.219.9:54048] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTePaVy2qpaelbUob1amAAAAFg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:00.286407 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:54735] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeQEzkQFuA2qBk8UMt3AAAAYY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:01.147768 2026] [:error] [pid 28795:tid 28877] [client 161.35.219.9:54288] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeQbROd53wZBkdI_eHtAAAAI4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:01.966014 2026] [:error] [pid 28795:tid 28885] [client 161.35.219.9:54288] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTeQbROd53wZBkdI_eHtQAAAJY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:02.988953 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:55410] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTeQirocdArcJqFfIlzSgAAAVQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:04.026883 2026] [:error] [pid 23872:tid 23894] [client 161.35.219.9:55646] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTeREzkQFuA2qBk8UMt7gAAAZM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:05.281258 2026] [:error] [pid 21575:tid 21601] [client 161.35.219.9:56030] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTeRSrocdArcJqFfIlzUgAAAVY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:06.297677 2026] [:error] [pid 28794:tid 28853] [client 161.35.219.9:56264] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeRqVy2qpaelbUob1aqQAAAFE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:08.763207 2026] [:error] [pid 28795:tid 28882] [client 161.35.219.9:56822] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeSLROd53wZBkdI_eHvwAAAJM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:09.520358 2026] [:error] [pid 28794:tid 28851] [client 161.35.219.9:56264] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeSaVy2qpaelbUob1arQAAAE8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:10.315302 2026] [:error] [pid 28794:tid 28860] [client 161.35.219.9:56264] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTeSqVy2qpaelbUob1asAAAAFg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:11.360260 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:57408] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTeS_-JFLfishX45N_UtwAAAQ8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:12.387109 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:57719] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTeTEzkQFuA2qBk8UMuAQAAAZg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:13.390405 2026] [:error] [pid 28795:tid 28863] [client 161.35.219.9:58001] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTeTbROd53wZBkdI_eHyQAAAIA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:14.411314 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:58272] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeTkzkQFuA2qBk8UMuBwAAAY8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:14.411379 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:58272] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeTkzkQFuA2qBk8UMuBwAAAY8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:17.060924 2026] [:error] [pid 28908:tid 28934] [client 161.35.219.9:59052] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeUYqJmC8ih_lQQnDX3AAAANg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:17.922359 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:58606] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeUUzkQFuA2qBk8UMuEwAAAY8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:17.922491 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:58606] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeUUzkQFuA2qBk8UMuEwAAAY8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:19.838000 2026] [:error] [pid 28908:tid 28922] [client 161.35.219.9:59052] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeU4qJmC8ih_lQQnDX3QAAAMw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:20.645434 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:59546] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeVCrocdArcJqFfIlzdwAAAUo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:20.645535 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:59546] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeVCrocdArcJqFfIlzdwAAAUo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:23.356316 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:60721] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTeV0zkQFuA2qBk8UMuNQAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:24.397305 2026] [:error] [pid 23872:tid 23876] [client 161.35.219.9:60975] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTeWEzkQFuA2qBk8UMuQAAAAYE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:25.411151 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:61299] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTeWUzkQFuA2qBk8UMuSAAAAYY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:26.436837 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:61540] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeWkzkQFuA2qBk8UMuTwAAAZc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:26.436913 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:61540] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeWkzkQFuA2qBk8UMuTwAAAZc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:29.088135 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:62114] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeXf-JFLfishX45N_U0QAAAQ8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:29.885088 2026] [:error] [pid 31257:tid 31286] [client 161.35.219.9:61768] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeXf-JFLfishX45N_U1AAAARc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:31.464922 2026] [:error] [pid 31257:tid 31287] [client 161.35.219.9:62114] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeX_-JFLfishX45N_U2wAAARg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:32.232865 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:61768] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeYP-JFLfishX45N_U4AAAAQI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:32.232935 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:61768] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeYP-JFLfishX45N_U4AAAAQI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:33.239230 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:63136] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTeYf-JFLfishX45N_U5QAAAQc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:34.542726 2026] [:error] [pid 23872:tid 23876] [client 161.35.219.9:63347] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTeYkzkQFuA2qBk8UMuYwAAAYE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:35.547895 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:63659] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTeY_-JFLfishX45N_U7QAAAQs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:36.575748 2026] [:error] [pid 21575:tid 21580] [client 161.35.219.9:63857] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTeZCrocdArcJqFfIlzgAAAAUE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:37.583787 2026] [:error] [pid 28795:tid 28871] [client 161.35.219.9:64075] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeZbROd53wZBkdI_eH4QAAAIg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:37.583846 2026] [:error] [pid 28795:tid 28871] [client 161.35.219.9:64075] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeZbROd53wZBkdI_eH4QAAAIg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:39.026919 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:64388] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTeZ_-JFLfishX45N_U-QAAAQg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:40.036128 2026] [:error] [pid 28908:tid 28917] [client 161.35.219.9:64605] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTeaIqJmC8ih_lQQnDX5wAAAMc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:41.026179 2026] [:error] [pid 31257:tid 31264] [client 161.35.219.9:64833] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTeaf-JFLfishX45N_U_gAAAQE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:42.053367 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:65128] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeav-JFLfishX45N_VCgAAAQc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:44.414956 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:49307] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTebP-JFLfishX45N_VFgAAAQ0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:45.187134 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:65128] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTebf-JFLfishX45N_VGgAAAQ8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:46.819254 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:49307] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTebv-JFLfishX45N_VJwAAARM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:47.581341 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:65128] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeb_-JFLfishX45N_VLAAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:47.581443 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:65128] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeb_-JFLfishX45N_VLAAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:49.377559 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:49307] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTecf-JFLfishX45N_VNQAAAQ0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:50.193340 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:50377] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeckzkQFuA2qBk8UMu3wAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:51.858545 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:49307] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTec_-JFLfishX45N_VRQAAAQU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:52.707669 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:50377] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTedEzkQFuA2qBk8UMvCwAAAY8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:54.398206 2026] [:error] [pid 31257:tid 31287] [client 161.35.219.9:49307] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTedv-JFLfishX45N_VSwAAARg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:55.255094 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:50377] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTed0zkQFuA2qBk8UMvEwAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:55.255191 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:50377] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTed0zkQFuA2qBk8UMvEwAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:56.275168 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:52447] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTeeP-JFLfishX45N_VVgAAARY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:57.315020 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:52693] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTeeUzkQFuA2qBk8UMvGAAAAY8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:58.335356 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:52935] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTeev-JFLfishX45N_VXwAAAQg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:48:59.377823 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:53189] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTee0zkQFuA2qBk8UMvHwAAAZY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:00.387971 2026] [:error] [pid 28794:tid 28838] [client 161.35.219.9:53466] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTefKVy2qpaelbUob1azAAAAEI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:00.388048 2026] [:error] [pid 28794:tid 28838] [client 161.35.219.9:53466] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTefKVy2qpaelbUob1azAAAAEI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:03.089692 2026] [:error] [pid 28794:tid 28851] [client 161.35.219.9:54175] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTef6Vy2qpaelbUob1azgAAAE8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:03.921039 2026] [:error] [pid 28793:tid 28816] [client 161.35.219.9:53692] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTefw2_fxBANaHo1f5B7QAAAAk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:05.639634 2026] [:error] [pid 28794:tid 28848] [client 161.35.219.9:54175] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTegaVy2qpaelbUob1a0AAAAEw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:06.447067 2026] [:error] [pid 28793:tid 28825] [client 161.35.219.9:53692] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTegg2_fxBANaHo1f5B7wAAABI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:07.244514 2026] [:error] [pid 28793:tid 28821] [client 161.35.219.9:53692] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTegw2_fxBANaHo1f5B8AAAAA4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:08.270934 2026] [:error] [pid 28795:tid 28877] [client 161.35.219.9:55473] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTehLROd53wZBkdI_eH-wAAAI4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:09.273160 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:55734] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTehUzkQFuA2qBk8UMvOgAAAY8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:10.515668 2026] [:error] [pid 28794:tid 28858] [client 161.35.219.9:55950] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTehqVy2qpaelbUob1a1QAAAFY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:11.552185 2026] [:error] [pid 28794:tid 28849] [client 161.35.219.9:56213] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeh6Vy2qpaelbUob1a1wAAAE0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:12.323606 2026] [:error] [pid 28794:tid 28851] [client 161.35.219.9:56213] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTeiKVy2qpaelbUob1a2AAAAE8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:13.370500 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:56676] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTeif-JFLfishX45N_VdQAAAQ0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:14.423465 2026] [:error] [pid 31257:tid 31287] [client 161.35.219.9:56923] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTeiv-JFLfishX45N_VegAAARg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:15.453830 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:57200] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTei0zkQFuA2qBk8UMvPwAAAYI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:16.477450 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:57446] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTejCrocdArcJqFfIlzswAAAVc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:18.898657 2026] [:error] [pid 28908:tid 28923] [client 161.35.219.9:58105] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTejoqJmC8ih_lQQnDYBQAAAM0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:19.710221 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:57446] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTejyrocdArcJqFfIlzuAAAAU8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:19.710292 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:57446] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTejyrocdArcJqFfIlzuAAAAU8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:21.587425 2026] [:error] [pid 28908:tid 28925] [client 161.35.219.9:58105] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTekYqJmC8ih_lQQnDYDgAAAM8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:22.355409 2026] [:error] [pid 28908:tid 28931] [client 161.35.219.9:58571] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTekoqJmC8ih_lQQnDYDwAAANU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:24.005885 2026] [:error] [pid 28908:tid 28923] [client 161.35.219.9:58105] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTelIqJmC8ih_lQQnDYEgAAAM0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:24.827335 2026] [:error] [pid 28908:tid 28928] [client 161.35.219.9:58571] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTelIqJmC8ih_lQQnDYFAAAANI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:24.827479 2026] [:error] [pid 28908:tid 28928] [client 161.35.219.9:58571] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTelIqJmC8ih_lQQnDYFAAAANI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:26.725965 2026] [:error] [pid 28908:tid 28931] [client 161.35.219.9:58105] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeloqJmC8ih_lQQnDYFwAAANU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:27.486769 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:59995] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTel_-JFLfishX45N_VkwAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:29.112993 2026] [:error] [pid 28908:tid 28912] [client 161.35.219.9:58105] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTemYqJmC8ih_lQQnDYGQAAAMI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:29.955953 2026] [:error] [pid 31257:tid 31272] [client 161.35.219.9:59995] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTemf-JFLfishX45N_VmwAAAQk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:29.956040 2026] [:error] [pid 31257:tid 31272] [client 161.35.219.9:59995] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTemf-JFLfishX45N_VmwAAAQk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:31.890498 2026] [:error] [pid 28908:tid 28919] [client 161.35.219.9:58105] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTem4qJmC8ih_lQQnDYIQAAAMk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:32.738023 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:61311] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTenEzkQFuA2qBk8UMvSwAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:34.409448 2026] [:error] [pid 28908:tid 28925] [client 161.35.219.9:58105] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTenoqJmC8ih_lQQnDYIwAAAM8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:35.227927 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:61311] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTen0zkQFuA2qBk8UMvZwAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:36.861288 2026] [:error] [pid 28908:tid 28930] [client 161.35.219.9:58105] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeoIqJmC8ih_lQQnDYJwAAANQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:37.668156 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:61311] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeoUzkQFuA2qBk8UMvcwAAAYw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:38.477056 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:61311] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTeokzkQFuA2qBk8UMvfgAAAZc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:39.624435 2026] [:error] [pid 21575:tid 21601] [client 161.35.219.9:63444] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTeoyrocdArcJqFfIlzyQAAAVY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:40.648564 2026] [:error] [pid 28908:tid 28919] [client 161.35.219.9:63676] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTepIqJmC8ih_lQQnDYLQAAAMk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:41.689621 2026] [:error] [pid 28794:tid 28859] [client 161.35.219.9:63891] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTepaVy2qpaelbUob1a5QAAAFc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:42.698067 2026] [:error] [pid 28793:tid 28817] [client 161.35.219.9:64127] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTepg2_fxBANaHo1f5CAgAAAAo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:45.282315 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:64667] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeqUzkQFuA2qBk8UMvjQAAAYQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:46.078309 2026] [:error] [pid 28793:tid 28831] [client 161.35.219.9:64127] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeqg2_fxBANaHo1f5CBgAAABg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:47.749033 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:64667] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeq0zkQFuA2qBk8UMvowAAAYw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:48.603905 2026] [:error] [pid 28793:tid 28829] [client 161.35.219.9:64127] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTerA2_fxBANaHo1f5CCQAAABY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:50.353514 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:64667] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTerkzkQFuA2qBk8UMvsAAAAYY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:52.238038 2026] [:error] [pid 28793:tid 28824] [client 161.35.219.9:64127] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTesA2_fxBANaHo1f5CDgAAABE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:53.060968 2026] [:error] [pid 28793:tid 28813] [client 161.35.219.9:64127] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTesQ2_fxBANaHo1f5CDwAAAAY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:54.089918 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:50175] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTeskzkQFuA2qBk8UMvyAAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:55.093994 2026] [:error] [pid 21575:tid 21585] [client 161.35.219.9:50416] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTesyrocdArcJqFfIlz8AAAAUY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:56.093640 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:50658] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTetP-JFLfishX45N_V2QAAAQs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:57.124739 2026] [:error] [pid 23872:tid 23894] [client 161.35.219.9:50847] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTetUzkQFuA2qBk8UMv2AAAAZM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:57.124828 2026] [:error] [pid 23872:tid 23894] [client 161.35.219.9:50847] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTetUzkQFuA2qBk8UMv2AAAAZM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:49:59.719262 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:51420] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTet_-JFLfishX45N_V4AAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:00.537585 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:51076] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeuEzkQFuA2qBk8UMv5gAAAY8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:00.537686 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:51076] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeuEzkQFuA2qBk8UMv5gAAAY8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:02.558117 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:51420] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeuv-JFLfishX45N_V4gAAAQs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:03.358316 2026] [:error] [pid 21575:tid 21585] [client 161.35.219.9:51791] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeuyrocdArcJqFfIlz_AAAAUY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:04.129651 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:51791] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTevCrocdArcJqFfIlz_QAAAVA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:05.125464 2026] [:error] [pid 28793:tid 28817] [client 161.35.219.9:52518] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTevQ2_fxBANaHo1f5CEwAAAAo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:06.287773 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:52735] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTevv-JFLfishX45N_V6wAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:07.339296 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:52953] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTev_-JFLfishX45N_V7QAAAQ8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:08.361297 2026] [:error] [pid 31257:tid 31263] [client 161.35.219.9:53167] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTewP-JFLfishX45N_V9QAAAQA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:10.792075 2026] [:error] [pid 28794:tid 28854] [client 161.35.219.9:53753] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTewqVy2qpaelbUob1a7wAAAFI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:11.599666 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:53167] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTew_-JFLfishX45N_WCAAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:13.187526 2026] [:error] [pid 28794:tid 28859] [client 161.35.219.9:53753] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTexaVy2qpaelbUob1a8QAAAFc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:13.944827 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:53167] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTexf-JFLfishX45N_WDgAAAQc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:15.584152 2026] [:error] [pid 28794:tid 28852] [client 161.35.219.9:53753] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTex6Vy2qpaelbUob1a_AAAAFA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:16.411017 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:53167] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTeyP-JFLfishX45N_WEAAAAQU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:17.176241 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:53167] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTeyf-JFLfishX45N_WEgAAAQg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:18.179103 2026] [:error] [pid 31257:tid 31273] [client 161.35.219.9:55494] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTeyv-JFLfishX45N_WFgAAAQo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:19.196432 2026] [:error] [pid 21575:tid 21585] [client 161.35.219.9:55730] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTeyyrocdArcJqFfIl0DgAAAUY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:20.201724 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:55992] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTezCrocdArcJqFfIl0EgAAAVg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:21.228368 2026] [:error] [pid 23872:tid 23876] [client 161.35.219.9:56213] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTezUzkQFuA2qBk8UMwRQAAAYE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:22.038604 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:56213] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTezkzkQFuA2qBk8UMwTgAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:23.037789 2026] [:error] [pid 31257:tid 31275] [client 161.35.219.9:56653] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTez_-JFLfishX45N_WJAAAAQw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:24.104530 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:56946] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTe0EzkQFuA2qBk8UMwYQAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:25.108915 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:57181] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTe0f-JFLfishX45N_WKAAAAQI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:26.117408 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:57396] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTe0kzkQFuA2qBk8UMwcQAAAYQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:28.930268 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:57933] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTe1P-JFLfishX45N_WQQAAAQQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:28.930354 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:57933] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTe1P-JFLfishX45N_WQQAAAQQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:29.181560 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:57396] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTe1UzkQFuA2qBk8UMwfAAAAYU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:30.195561 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:58294] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTe1kzkQFuA2qBk8UMwggAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:31.229729 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:58573] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTe10zkQFuA2qBk8UMwiQAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:32.509979 2026] [:error] [pid 28908:tid 28929] [client 161.35.219.9:58824] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTe2IqJmC8ih_lQQnDYgwAAANM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:33.283881 2026] [:error] [pid 28908:tid 28924] [client 161.35.219.9:58824] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 21"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTe2YqJmC8ih_lQQnDYhgAAAM4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:34.297299 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:59328] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 21"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTe2kzkQFuA2qBk8UMwnQAAAZU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:35.304846 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:59560] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 21"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTe20zkQFuA2qBk8UMwpgAAAZg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:36.326873 2026] [:error] [pid 28908:tid 28913] [client 161.35.219.9:59813] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 21"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTe3IqJmC8ih_lQQnDYjAAAAMM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:38.808221 2026] [:error] [pid 23872:tid 23885] [client 161.35.219.9:60053] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTe3kzkQFuA2qBk8UMwvAAAAYo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:38.808409 2026] [:error] [pid 23872:tid 23885] [client 161.35.219.9:60053] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTe3kzkQFuA2qBk8UMwvAAAAYo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:41.746896 2026] [:error] [pid 28795:tid 28877] [client 161.35.219.9:60697] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTe4bROd53wZBkdI_eITgAAAI4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:42.628640 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:60393] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTe4kzkQFuA2qBk8UMw3wAAAYM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:42.628715 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:60393] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTe4kzkQFuA2qBk8UMw3wAAAYM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:43.631693 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:61228] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTe4_-JFLfishX45N_WVAAAAQM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:44.835266 2026] [:error] [pid 28908:tid 28912] [client 161.35.219.9:61490] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTe5IqJmC8ih_lQQnDYkwAAAMI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:45.845467 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:61713] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTe5UzkQFuA2qBk8UMw9wAAAZU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:46.861715 2026] [:error] [pid 23872:tid 23894] [client 161.35.219.9:61940] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTe5kzkQFuA2qBk8UMxAQAAAZM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:47.871460 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:62172] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTe50zkQFuA2qBk8UMxCgAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:47.871525 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:62172] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTe50zkQFuA2qBk8UMxCgAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:48.878911 2026] [:error] [pid 28794:tid 28836] [client 161.35.219.9:62417] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTe6KVy2qpaelbUob1baQAAAEA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:49.912133 2026] [:error] [pid 28908:tid 28921] [client 161.35.219.9:62641] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTe6YqJmC8ih_lQQnDYlwAAAMs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:50.918110 2026] [:error] [pid 28795:tid 28877] [client 161.35.219.9:62904] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTe6rROd53wZBkdI_eIVwAAAI4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:51.951723 2026] [:error] [pid 31257:tid 31263] [client 161.35.219.9:63127] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTe6_-JFLfishX45N_WbQAAAQA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:52.975890 2026] [:error] [pid 23872:tid 23876] [client 161.35.219.9:63414] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTe7EzkQFuA2qBk8UMxIAAAAYE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:53.825169 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:63414] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTe7UzkQFuA2qBk8UMxLgAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:54.839907 2026] [:error] [pid 28908:tid 28920] [client 161.35.219.9:63968] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTe7oqJmC8ih_lQQnDYoQAAAMo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:55.849671 2026] [:error] [pid 28908:tid 28927] [client 161.35.219.9:64230] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTe74qJmC8ih_lQQnDYogAAANE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:50:58.383129 2026] [:error] [pid 21575:tid 21582] [client 161.35.219.9:64847] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTe8irocdArcJqFfIl0KwAAAUM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:00.825943 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:65452] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTe9P-JFLfishX45N_WjAAAARM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:01.649783 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:64847] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTe9SrocdArcJqFfIl0NgAAAVI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:02.452535 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:64847] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTe9irocdArcJqFfIl0OAAAAVc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:03.492451 2026] [:error] [pid 21575:tid 21588] [client 161.35.219.9:49742] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTe9yrocdArcJqFfIl0OwAAAUk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:04.504510 2026] [:error] [pid 28795:tid 28870] [client 161.35.219.9:50019] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTe-LROd53wZBkdI_eIYgAAAIc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:05.543441 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:50253] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTe-f-JFLfishX45N_WnQAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:06.558478 2026] [:error] [pid 28908:tid 28932] [client 161.35.219.9:50482] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTe-oqJmC8ih_lQQnDYqwAAANY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:08.949623 2026] [:error] [pid 28908:tid 28922] [client 161.35.219.9:50985] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTe_IqJmC8ih_lQQnDYsQAAAMw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:09.758665 2026] [:error] [pid 28908:tid 28929] [client 161.35.219.9:50482] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTe_YqJmC8ih_lQQnDYswAAANM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:11.400967 2026] [:error] [pid 28908:tid 28934] [client 161.35.219.9:50985] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTe_4qJmC8ih_lQQnDYtwAAANg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:12.164929 2026] [:error] [pid 28908:tid 28913] [client 161.35.219.9:50482] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfAIqJmC8ih_lQQnDYuAAAAMM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:13.772752 2026] [:error] [pid 28908:tid 28927] [client 161.35.219.9:50985] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfAYqJmC8ih_lQQnDYugAAANE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:14.571600 2026] [:error] [pid 28908:tid 28930] [client 161.35.219.9:50482] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfAoqJmC8ih_lQQnDYuwAAANQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:16.209563 2026] [:error] [pid 28908:tid 28915] [client 161.35.219.9:50985] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfBIqJmC8ih_lQQnDYyAAAAMU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:17.047240 2026] [:error] [pid 28908:tid 28923] [client 161.35.219.9:50482] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfBYqJmC8ih_lQQnDYywAAAM0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:17.887510 2026] [:error] [pid 28908:tid 28910] [client 161.35.219.9:50482] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTfBYqJmC8ih_lQQnDYzQAAAMA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:18.900563 2026] [:error] [pid 28795:tid 28876] [client 161.35.219.9:53294] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTfBrROd53wZBkdI_eIcQAAAI0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:19.907887 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:53534] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTfB_-JFLfishX45N_WwAAAAQQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:20.932900 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:53781] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTfCP-JFLfishX45N_WyQAAAQc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:21.943370 2026] [:error] [pid 28795:tid 28885] [client 161.35.219.9:53999] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfCbROd53wZBkdI_eIfQAAAJY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:21.943469 2026] [:error] [pid 28795:tid 28885] [client 161.35.219.9:53999] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfCbROd53wZBkdI_eIfQAAAJY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:22.988267 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:54279] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTfCkzkQFuA2qBk8UMx7QAAAYY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:24.005672 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:54600] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTfDEzkQFuA2qBk8UMx8wAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:24.999947 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:54811] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTfDCrocdArcJqFfIl0bQAAAUw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:26.021627 2026] [:error] [pid 28794:tid 28859] [client 161.35.219.9:54988] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTfDqVy2qpaelbUob1beAAAAFc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:27.757451 2026] [:error] [pid 28908:tid 28921] [client 161.35.219.9:55193] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfD4qJmC8ih_lQQnDY0QAAAMs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:27.757511 2026] [:error] [pid 28908:tid 28921] [client 161.35.219.9:55193] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 22"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfD4qJmC8ih_lQQnDY0QAAAMs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:31.033532 2026] [:error] [pid 28794:tid 28846] [client 161.35.219.9:55881] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfE6Vy2qpaelbUob1bgAAAAEo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:31.820334 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:55529] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfE_-JFLfishX45N_W4gAAAQ0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:32.654798 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:55529] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTfFP-JFLfishX45N_W4wAAAQ8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:33.700964 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:56665] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTfFUzkQFuA2qBk8UMyKAAAAYw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:34.729636 2026] [:error] [pid 28908:tid 28920] [client 161.35.219.9:56934] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTfFoqJmC8ih_lQQnDY8QAAAMo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:35.740379 2026] [:error] [pid 28795:tid 28883] [client 161.35.219.9:57141] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTfF7ROd53wZBkdI_eIpgAAAJQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:36.756527 2026] [:error] [pid 28794:tid 28850] [client 161.35.219.9:57368] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfGKVy2qpaelbUob1bjwAAAE4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:39.097668 2026] [:error] [pid 28793:tid 28814] [client 161.35.219.9:57894] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfGw2_fxBANaHo1f5CLQAAAAc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:39.872488 2026] [:error] [pid 28794:tid 28857] [client 161.35.219.9:57368] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfG6Vy2qpaelbUob1bmgAAAFU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:40.706107 2026] [:error] [pid 28794:tid 28849] [client 161.35.219.9:57368] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTfHKVy2qpaelbUob1bnAAAAE0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:41.694683 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:58493] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTfHUzkQFuA2qBk8UMyWAAAAZc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:42.703568 2026] [:error] [pid 21575:tid 21581] [client 161.35.219.9:58710] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTfHirocdArcJqFfIl0jwAAAUI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:43.736563 2026] [:error] [pid 28795:tid 28868] [client 161.35.219.9:59049] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTfH7ROd53wZBkdI_eIqgAAAIU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:44.760408 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:59270] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfIP-JFLfishX45N_XAQAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:44.760491 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:59270] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfIP-JFLfishX45N_XAQAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:47.384352 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:59753] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfI_-JFLfishX45N_XCgAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:48.216019 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:59457] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfJCrocdArcJqFfIl0ngAAAVQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:49.048107 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:59457] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTfJSrocdArcJqFfIl0nwAAAUo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:50.042647 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:60395] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTfJv-JFLfishX45N_XEAAAAQM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:51.053978 2026] [:error] [pid 28795:tid 28871] [client 161.35.219.9:60613] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTfJ7ROd53wZBkdI_eItAAAAIg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:53.058142 2026] [:error] [pid 28794:tid 28846] [client 161.35.219.9:60834] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTfKaVy2qpaelbUob1bsgAAAEo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:54.094539 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:61338] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfKkzkQFuA2qBk8UMyiwAAAZA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:58.007302 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:62140] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfLirocdArcJqFfIl0wAAAAUo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:58.812081 2026] [:error] [pid 23872:tid 23885] [client 161.35.219.9:61338] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfLkzkQFuA2qBk8UMyrgAAAYo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:51:58.812138 2026] [:error] [pid 23872:tid 23885] [client 161.35.219.9:61338] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfLkzkQFuA2qBk8UMyrgAAAYo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:00.715214 2026] [:error] [pid 21575:tid 21586] [client 161.35.219.9:62140] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfMCrocdArcJqFfIl0xwAAAUc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:01.570897 2026] [:error] [pid 21575:tid 21598] [client 161.35.219.9:62565] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfMSrocdArcJqFfIl0yQAAAVM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:01.570997 2026] [:error] [pid 21575:tid 21598] [client 161.35.219.9:62565] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfMSrocdArcJqFfIl0yQAAAVM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:03.431151 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:62140] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfMyrocdArcJqFfIl0zAAAAU8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:04.256959 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:63176] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfNP-JFLfishX45N_XLQAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:04.257051 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:63176] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfNP-JFLfishX45N_XLQAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:06.141285 2026] [:error] [pid 21575:tid 21593] [client 161.35.219.9:62140] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfNirocdArcJqFfIl0zwAAAU4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:07.118829 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:63914] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfN0zkQFuA2qBk8UMy7gAAAZU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:08.956750 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:62140] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfOCrocdArcJqFfIl02gAAAUU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:09.824019 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:63914] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfOUzkQFuA2qBk8UMzAQAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:11.602123 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:62140] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfOyrocdArcJqFfIl03wAAAVI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:12.441984 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:63914] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfPEzkQFuA2qBk8UMzGgAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:14.143355 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:62140] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfPirocdArcJqFfIl04QAAAUA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:14.143512 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:62140] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfPirocdArcJqFfIl04QAAAUA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:14.390787 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:63914] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTfPkzkQFuA2qBk8UMzLAAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:15.408693 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:49926] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTfP0zkQFuA2qBk8UMzNQAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:16.406752 2026] [:error] [pid 31257:tid 31272] [client 161.35.219.9:50150] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTfQP-JFLfishX45N_XNwAAAQk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:17.405313 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:50345] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfQf-JFLfishX45N_XPAAAAQc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:19.946823 2026] [:error] [pid 28795:tid 28865] [client 161.35.219.9:50904] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfQ7ROd53wZBkdI_eIzAAAAII"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:21.016945 2026] [:error] [pid 31257:tid 31273] [client 161.35.219.9:50345] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfRf-JFLfishX45N_XTQAAAQo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:23.221603 2026] [:error] [pid 28795:tid 28880] [client 161.35.219.9:50904] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfR7ROd53wZBkdI_eIzwAAAJE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:24.462376 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:50345] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfSP-JFLfishX45N_XUQAAARU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:26.432617 2026] [:error] [pid 28795:tid 28879] [client 161.35.219.9:50904] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfSrROd53wZBkdI_eI0QAAAJA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:27.677734 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:50345] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfS_-JFLfishX45N_XUwAAAQ8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:27.677792 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:50345] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfS_-JFLfishX45N_XUwAAAQ8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:28.697740 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:52944] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTfTP-JFLfishX45N_XVgAAAQ0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:29.831295 2026] [:error] [pid 28795:tid 28887] [client 161.35.219.9:53154] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTfTbROd53wZBkdI_eI2QAAAJg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:30.851663 2026] [:error] [pid 21575:tid 21596] [client 161.35.219.9:53396] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTfTirocdArcJqFfIl1DAAAAVE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:31.860111 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:53604] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTfT_-JFLfishX45N_XbAAAARY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:35.065784 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:54387] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfU0zkQFuA2qBk8UMzmwAAAZA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:37.662406 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:54966] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfVUzkQFuA2qBk8UMzsgAAAZg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:38.575788 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:54387] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfVkzkQFuA2qBk8UMzuQAAAZU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:39.452013 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:54387] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTfV0zkQFuA2qBk8UMzwQAAAYY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:40.449378 2026] [:error] [pid 23872:tid 23883] [client 161.35.219.9:55624] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTfWEzkQFuA2qBk8UMzxwAAAYg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:41.452072 2026] [:error] [pid 28793:tid 28814] [client 161.35.219.9:55853] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTfWQ2_fxBANaHo1f5CRQAAAAc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:42.488301 2026] [:error] [pid 31257:tid 31263] [client 161.35.219.9:56052] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTfWv-JFLfishX45N_XdwAAAQA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:43.513495 2026] [:error] [pid 28795:tid 28878] [client 161.35.219.9:56375] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfW7ROd53wZBkdI_eI4gAAAI8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:43.513544 2026] [:error] [pid 28795:tid 28878] [client 161.35.219.9:56375] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfW7ROd53wZBkdI_eI4gAAAI8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:46.174327 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:57151] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfXkzkQFuA2qBk8UMz2gAAAZE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:47.030084 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:56713] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfXyrocdArcJqFfIl1KwAAAUo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:47.855051 2026] [:error] [pid 21575:tid 21587] [client 161.35.219.9:56713] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTfXyrocdArcJqFfIl1NQAAAUg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:48.863368 2026] [:error] [pid 31257:tid 31286] [client 161.35.219.9:57827] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTfYP-JFLfishX45N_XggAAARc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:49.887505 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:58094] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTfYf-JFLfishX45N_XhQAAARQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:52.489287 2026] [:error] [pid 31257:tid 31269] [client 161.35.219.9:58738] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfZP-JFLfishX45N_XmQAAAQY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:52.489425 2026] [:error] [pid 31257:tid 31269] [client 161.35.219.9:58738] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfZP-JFLfishX45N_XmQAAAQY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:53.720770 2026] [:error] [pid 31257:tid 31264] [client 161.35.219.9:59117] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTfZf-JFLfishX45N_XnwAAAQE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:54.748801 2026] [:error] [pid 21575:tid 21586] [client 161.35.219.9:59391] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTfZirocdArcJqFfIl1UgAAAUc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:55.775450 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:59640] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTfZ_-JFLfishX45N_XqAAAAQ8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:56.784220 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:59861] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfaP-JFLfishX45N_XsAAAARM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:52:59.228815 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:60465] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfa_-JFLfishX45N_XvwAAAQs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:00.025813 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:59861] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfbP-JFLfishX45N_XwQAAAQI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:00.913844 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:59861] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTfbP-JFLfishX45N_XwgAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:02.070860 2026] [:error] [pid 31257:tid 31264] [client 161.35.219.9:61134] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTfbv-JFLfishX45N_XxAAAAQE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:03.068574 2026] [:error] [pid 28795:tid 28887] [client 161.35.219.9:61388] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTfb7ROd53wZBkdI_eI9AAAAJg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:04.102354 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:61715] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTfcEzkQFuA2qBk8UM0CQAAAZc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:05.143705 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:61955] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfcf-JFLfishX45N_XzAAAAQg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:07.576032 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:62613] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfc0zkQFuA2qBk8UM0GwAAAYs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:08.340461 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:61955] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfdP-JFLfishX45N_X0wAAARM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:09.989369 2026] [:error] [pid 23872:tid 23885] [client 161.35.219.9:62613] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfdUzkQFuA2qBk8UM0IAAAAYo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:10.766092 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:61955] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfdv-JFLfishX45N_X1gAAAQQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:10.766177 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:61955] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfdv-JFLfishX45N_X1gAAAQQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:12.635608 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:62613] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfeEzkQFuA2qBk8UM0LgAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:13.464736 2026] [:error] [pid 28908:tid 28928] [client 161.35.219.9:63582] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfeYqJmC8ih_lQQnDZ1gAAANI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:13.464835 2026] [:error] [pid 28908:tid 28928] [client 161.35.219.9:63582] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfeYqJmC8ih_lQQnDZ1gAAANI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:15.272527 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:62613] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfe0zkQFuA2qBk8UM0NwAAAZA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:16.159248 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:64359] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTffEzkQFuA2qBk8UM0OAAAAZU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:16.989630 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:64359] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTffEzkQFuA2qBk8UM0PQAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:18.043154 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:65195] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTffkzkQFuA2qBk8UM0TAAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:19.053405 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:65422] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTff0zkQFuA2qBk8UM0ZwAAAZY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:20.074019 2026] [:error] [pid 28908:tid 28927] [client 161.35.219.9:49279] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTfgIqJmC8ih_lQQnDZ6wAAANE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:21.085855 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:49533] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfgSrocdArcJqFfIl1dwAAAUo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:21.085955 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:49533] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfgSrocdArcJqFfIl1dwAAAUo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:23.640202 2026] [:error] [pid 31257:tid 31275] [client 161.35.219.9:50176] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfg_-JFLfishX45N_X5QAAAQw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:23.640299 2026] [:error] [pid 31257:tid 31275] [client 161.35.219.9:50176] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfg_-JFLfishX45N_X5QAAAQw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:23.885656 2026] [:error] [pid 28794:tid 28846] [client 161.35.219.9:49764] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTfg6Vy2qpaelbUob1b7wAAAEo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:24.894297 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:50521] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTfhP-JFLfishX45N_X6gAAAQ4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:25.930551 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:50760] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTfhf-JFLfishX45N_X7QAAARU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:26.964483 2026] [:error] [pid 28793:tid 28822] [client 161.35.219.9:50974] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfhg2_fxBANaHo1f5CcQAAAA8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:27.735381 2026] [:error] [pid 28793:tid 28820] [client 161.35.219.9:50974] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTfhw2_fxBANaHo1f5CcgAAAA0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:28.746415 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:51401] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTfiCrocdArcJqFfIl1jQAAAVc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:29.782771 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:51621] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTfiUzkQFuA2qBk8UM0jwAAAY0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:30.803852 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:51845] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTfiirocdArcJqFfIl1kQAAAU8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:31.803520 2026] [:error] [pid 21575:tid 21583] [client 161.35.219.9:52093] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfiyrocdArcJqFfIl1lAAAAUQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:31.803626 2026] [:error] [pid 21575:tid 21583] [client 161.35.219.9:52093] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfiyrocdArcJqFfIl1lAAAAUQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:34.333812 2026] [:error] [pid 31257:tid 31287] [client 161.35.219.9:52766] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfjv-JFLfishX45N_YBQAAARg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:35.090598 2026] [:error] [pid 28908:tid 28917] [client 161.35.219.9:52301] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfj4qJmC8ih_lQQnDZ-wAAAMc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:36.702147 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:52766] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfkP-JFLfishX45N_YEQAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:37.456193 2026] [:error] [pid 28908:tid 28916] [client 161.35.219.9:52301] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfkYqJmC8ih_lQQnDZ_gAAAMY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:39.023085 2026] [:error] [pid 31257:tid 31264] [client 161.35.219.9:52766] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfk_-JFLfishX45N_YHQAAAQE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:39.776016 2026] [:error] [pid 28908:tid 28913] [client 161.35.219.9:52301] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfk4qJmC8ih_lQQnDaAQAAAMM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:39.776075 2026] [:error] [pid 28908:tid 28913] [client 161.35.219.9:52301] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfk4qJmC8ih_lQQnDaAQAAAMM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:41.585038 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:52766] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTflf-JFLfishX45N_YIQAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:41.585092 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:52766] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTflf-JFLfishX45N_YIQAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:41.835315 2026] [:error] [pid 31257:tid 31269] [client 161.35.219.9:54268] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTflf-JFLfishX45N_YIgAAAQY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:42.859784 2026] [:error] [pid 28795:tid 28866] [client 161.35.219.9:54728] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTflrROd53wZBkdI_eJKwAAAIM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:43.876574 2026] [:error] [pid 31257:tid 31273] [client 161.35.219.9:55035] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTfl_-JFLfishX45N_YLAAAAQo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:44.866267 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:55324] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfmCrocdArcJqFfIl1rAAAAVA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:47.186432 2026] [:error] [pid 28908:tid 28934] [client 161.35.219.9:55801] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfm4qJmC8ih_lQQnDaCgAAANg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:47.965183 2026] [:error] [pid 21575:tid 21582] [client 161.35.219.9:55324] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfmyrocdArcJqFfIl1sQAAAUM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:48.762326 2026] [:error] [pid 21575:tid 21593] [client 161.35.219.9:55324] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTfnCrocdArcJqFfIl1sgAAAU4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:49.771449 2026] [:error] [pid 28794:tid 28842] [client 161.35.219.9:56392] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTfnaVy2qpaelbUob1cEwAAAEY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:50.788121 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:56636] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTfnkzkQFuA2qBk8UM0_QAAAYY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:51.803737 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:56856] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTfn0zkQFuA2qBk8UM1CAAAAZU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:52.811999 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:57091] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfoP-JFLfishX45N_YRQAAARM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:55.310225 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:57833] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfoyrocdArcJqFfIl1wgAAAVI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:56.066999 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:57091] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfpP-JFLfishX45N_YUgAAARY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:56.067051 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:57091] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfpP-JFLfishX45N_YUgAAARY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:58.065282 2026] [:error] [pid 21575:tid 21588] [client 161.35.219.9:57833] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfpirocdArcJqFfIl10QAAAUk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:53:58.852000 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:58276] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfpirocdArcJqFfIl11QAAAVc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:00.466539 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:57833] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfqCrocdArcJqFfIl12gAAAU8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:01.278987 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:58276] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfqSrocdArcJqFfIl15gAAAVQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:02.074237 2026] [:error] [pid 21575:tid 21586] [client 161.35.219.9:58276] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTfqirocdArcJqFfIl18wAAAUc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:03.081197 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:59549] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTfq0zkQFuA2qBk8UM1QgAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:04.084265 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:59882] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTfrEzkQFuA2qBk8UM1TwAAAYQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:05.121098 2026] [:error] [pid 21575:tid 21593] [client 161.35.219.9:60088] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTfrSrocdArcJqFfIl2AAAAAU4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:06.314969 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:60361] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfrkzkQFuA2qBk8UM1XwAAAYs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:06.315060 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:60361] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfrkzkQFuA2qBk8UM1XwAAAYs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:08.895036 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:60980] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfsEzkQFuA2qBk8UM1bAAAAZI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:09.695373 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:60625] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfsUzkQFuA2qBk8UM1cQAAAZE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:10.475352 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:60625] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTfskzkQFuA2qBk8UM1dAAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:11.478676 2026] [:error] [pid 21575:tid 21585] [client 161.35.219.9:61514] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTfsyrocdArcJqFfIl2DAAAAUY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:12.481468 2026] [:error] [pid 21575:tid 21598] [client 161.35.219.9:61734] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTftCrocdArcJqFfIl2DwAAAVM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:13.506153 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:61990] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTftf-JFLfishX45N_YsAAAAQQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:15.300542 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:62350] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTft0zkQFuA2qBk8UM1jAAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:16.133483 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:62350] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTfuEzkQFuA2qBk8UM1kQAAAZI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:17.175253 2026] [:error] [pid 21575:tid 21600] [client 161.35.219.9:62914] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTfuSrocdArcJqFfIl2HAAAAVU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:18.181122 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:63141] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTfukzkQFuA2qBk8UM1oAAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:19.186856 2026] [:error] [pid 21575:tid 21580] [client 161.35.219.9:63376] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTfuyrocdArcJqFfIl2JAAAAUE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:20.173716 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:63608] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfvEzkQFuA2qBk8UM1swAAAZc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:20.173790 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:63608] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfvEzkQFuA2qBk8UM1swAAAZc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:22.855921 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:64254] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfvv-JFLfishX45N_YxwAAARU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:23.652931 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:63848] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfv0zkQFuA2qBk8UM1xAAAAYU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:23.652993 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:63848] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfv0zkQFuA2qBk8UM1xAAAAYU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:24.677473 2026] [:error] [pid 28793:tid 28809] [client 161.35.219.9:64773] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTfwA2_fxBANaHo1f5ClwAAAAI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:25.697979 2026] [:error] [pid 21575:tid 21592] [client 161.35.219.9:65001] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTfwSrocdArcJqFfIl2OAAAAU0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:26.919384 2026] [:error] [pid 28793:tid 28812] [client 161.35.219.9:65254] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTfwg2_fxBANaHo1f5CmAAAAAU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:28.164123 2026] [:error] [pid 28795:tid 28871] [client 161.35.219.9:65462] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTfxLROd53wZBkdI_eJdQAAAIg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:29.193558 2026] [:error] [pid 28794:tid 28851] [client 161.35.219.9:49316] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfxaVy2qpaelbUob1cLAAAAE8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:30.073729 2026] [:error] [pid 28794:tid 28838] [client 161.35.219.9:49316] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTfxqVy2qpaelbUob1cLQAAAEI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:31.090086 2026] [:error] [pid 28908:tid 28924] [client 161.35.219.9:49771] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTfx4qJmC8ih_lQQnDaLAAAAM4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:32.093294 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:49992] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTfyCrocdArcJqFfIl2SQAAAVc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:33.098177 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:50224] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTfyUzkQFuA2qBk8UM12QAAAZI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:34.274562 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:50559] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfyv-JFLfishX45N_Y6AAAARU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:34.274601 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:50559] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfyv-JFLfishX45N_Y6AAAARU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:37.369215 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:51209] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfzUzkQFuA2qBk8UM15gAAAYU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:38.122406 2026] [:error] [pid 31257:tid 31280] [client 161.35.219.9:50851] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfzv-JFLfishX45N_Y-gAAARE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:39.694886 2026] [:error] [pid 23872:tid 23885] [client 161.35.219.9:51209] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTfz0zkQFuA2qBk8UM19QAAAYo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:40.568142 2026] [:error] [pid 31257:tid 31286] [client 161.35.219.9:50851] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf0P-JFLfishX45N_Y_gAAARc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:40.568236 2026] [:error] [pid 31257:tid 31286] [client 161.35.219.9:50851] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf0P-JFLfishX45N_Y_gAAARc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:41.571613 2026] [:error] [pid 23872:tid 23876] [client 161.35.219.9:52186] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTf0UzkQFuA2qBk8UM2BgAAAYE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:42.709810 2026] [:error] [pid 28908:tid 28917] [client 161.35.219.9:52420] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTf0oqJmC8ih_lQQnDaLgAAAMc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:43.747075 2026] [:error] [pid 28794:tid 28858] [client 161.35.219.9:52710] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTf06Vy2qpaelbUob1cOQAAAFY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:44.769588 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:53024] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTf1EzkQFuA2qBk8UM2GwAAAZU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:45.797725 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:53269] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf1UzkQFuA2qBk8UM2IAAAAZI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:48.122309 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:53822] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf2EzkQFuA2qBk8UM2LgAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:48.884151 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:53269] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf2EzkQFuA2qBk8UM2NAAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:48.884211 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:53269] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf2EzkQFuA2qBk8UM2NAAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:49.910690 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:54238] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTf2UzkQFuA2qBk8UM2PwAAAZI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:50.986519 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:54548] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTf2irocdArcJqFfIl2YwAAAVA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:51.989753 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:54749] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTf20zkQFuA2qBk8UM2VAAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:53.023289 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:54989] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTf3UzkQFuA2qBk8UM2YgAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:54.041751 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:55304] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf3v-JFLfishX45N_ZCgAAARQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:56.522186 2026] [:error] [pid 31257:tid 31287] [client 161.35.219.9:55982] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf4P-JFLfishX45N_ZEQAAARg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:57.253237 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:55304] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf4f-JFLfishX45N_ZFAAAAQg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:58.898595 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:55982] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf4v-JFLfishX45N_ZFgAAAQI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:59.661136 2026] [:error] [pid 31257:tid 31275] [client 161.35.219.9:55304] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf4_-JFLfishX45N_ZFwAAAQw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:54:59.661235 2026] [:error] [pid 31257:tid 31275] [client 161.35.219.9:55304] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf4_-JFLfishX45N_ZFwAAAQw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:00.701672 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:56872] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTf5EzkQFuA2qBk8UM2lQAAAY0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:01.728164 2026] [:error] [pid 28908:tid 28919] [client 161.35.219.9:57108] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTf5YqJmC8ih_lQQnDaQQAAAMk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:02.760289 2026] [:error] [pid 31257:tid 31272] [client 161.35.219.9:57357] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTf5v-JFLfishX45N_ZIgAAAQk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:03.970422 2026] [:error] [pid 23872:tid 23883] [client 161.35.219.9:57605] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTf50zkQFuA2qBk8UM2nwAAAYg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:04.998865 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:57948] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf6EzkQFuA2qBk8UM2ogAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:04.998938 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:57948] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf6EzkQFuA2qBk8UM2ogAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:07.772241 2026] [:error] [pid 28794:tid 28846] [client 161.35.219.9:58599] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf66Vy2qpaelbUob1cSQAAAEo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:08.567512 2026] [:error] [pid 28908:tid 28913] [client 161.35.219.9:58262] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf7IqJmC8ih_lQQnDaTgAAAMM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:08.567588 2026] [:error] [pid 28908:tid 28913] [client 161.35.219.9:58262] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf7IqJmC8ih_lQQnDaTgAAAMM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:10.500052 2026] [:error] [pid 28794:tid 28850] [client 161.35.219.9:58599] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf7qVy2qpaelbUob1cUQAAAE4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:10.500143 2026] [:error] [pid 28794:tid 28850] [client 161.35.219.9:58599] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf7qVy2qpaelbUob1cUQAAAE4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:10.752715 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:59048] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTf7kzkQFuA2qBk8UM2sAAAAZY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:11.762500 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:59575] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTf70zkQFuA2qBk8UM2twAAAZI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:12.806880 2026] [:error] [pid 28908:tid 28910] [client 161.35.219.9:59811] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTf8IqJmC8ih_lQQnDaUgAAAMA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:13.830445 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:60091] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf8f-JFLfishX45N_ZSQAAAQ4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:13.830538 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:60091] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf8f-JFLfishX45N_ZSQAAAQ4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:14.876083 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:60399] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTf8kzkQFuA2qBk8UM2wAAAAZU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:15.899947 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:60641] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTf8yrocdArcJqFfIl2kgAAAVg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:16.901977 2026] [:error] [pid 23872:tid 23876] [client 161.35.219.9:60922] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTf9EzkQFuA2qBk8UM2zAAAAYE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:17.916533 2026] [:error] [pid 21575:tid 21585] [client 161.35.219.9:61185] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTf9SrocdArcJqFfIl2lgAAAUY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:18.927554 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:61437] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf9kzkQFuA2qBk8UM21QAAAZc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:21.422688 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:62091] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf-UzkQFuA2qBk8UM28gAAAZI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:22.247144 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:61437] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf-kzkQFuA2qBk8UM2_AAAAZU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:23.854707 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:62091] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf-0zkQFuA2qBk8UM3CAAAAZY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:24.644148 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:61437] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf_EzkQFuA2qBk8UM3DgAAAYw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:24.644228 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:61437] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf_EzkQFuA2qBk8UM3DgAAAYw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:26.939746 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:62091] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf_kzkQFuA2qBk8UM3KwAAAYQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:27.838230 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:63244] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTf_0zkQFuA2qBk8UM3NAAAAZE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:29.534531 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:62091] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgAUzkQFuA2qBk8UM3RgAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:29.534622 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:62091] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgAUzkQFuA2qBk8UM3RgAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:29.788627 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:63244] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTgAUzkQFuA2qBk8UM3SQAAAYU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:30.809694 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:64497] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTgAv-JFLfishX45N_ZfwAAAQM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:31.820020 2026] [:error] [pid 28795:tid 28883] [client 161.35.219.9:64740] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTgA7ROd53wZBkdI_eJpQAAAJQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:32.846527 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:64965] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgBP-JFLfishX45N_ZiAAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:33.714017 2026] [:error] [pid 31257:tid 31269] [client 161.35.219.9:64965] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTgBf-JFLfishX45N_ZjAAAAQY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:34.720625 2026] [:error] [pid 21575:tid 21601] [client 161.35.219.9:65519] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTgBirocdArcJqFfIl2tAAAAVY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:35.719711 2026] [:error] [pid 28908:tid 28915] [client 161.35.219.9:49398] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTgB4qJmC8ih_lQQnDaXAAAAMU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:36.761184 2026] [:error] [pid 28908:tid 28923] [client 161.35.219.9:49636] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTgCIqJmC8ih_lQQnDaXQAAAM0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:37.786529 2026] [:error] [pid 21575:tid 21601] [client 161.35.219.9:49911] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgCSrocdArcJqFfIl2ywAAAVY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:40.194387 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:50515] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgDEzkQFuA2qBk8UM3mAAAAYQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:41.019456 2026] [:error] [pid 21575:tid 21598] [client 161.35.219.9:49911] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgDSrocdArcJqFfIl23wAAAVM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:44.333820 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:50515] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgEEzkQFuA2qBk8UM3uQAAAY0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:45.165527 2026] [:error] [pid 21575:tid 21588] [client 161.35.219.9:49911] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgESrocdArcJqFfIl2-QAAAUk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:46.817268 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:50515] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgEkzkQFuA2qBk8UM3xQAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:47.615812 2026] [:error] [pid 21575:tid 21598] [client 161.35.219.9:49911] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgEyrocdArcJqFfIl3DAAAAVM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:47.615885 2026] [:error] [pid 21575:tid 21598] [client 161.35.219.9:49911] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgEyrocdArcJqFfIl3DAAAAVM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:49.602989 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:50515] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgFUzkQFuA2qBk8UM31QAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:50.464115 2026] [:error] [pid 28908:tid 28934] [client 161.35.219.9:52752] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgFoqJmC8ih_lQQnDaaQAAANg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:51.295326 2026] [:error] [pid 28908:tid 28929] [client 161.35.219.9:52752] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTgF4qJmC8ih_lQQnDaagAAANM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:52.332169 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:53682] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTgGEzkQFuA2qBk8UM35QAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:53.361126 2026] [:error] [pid 28795:tid 28879] [client 161.35.219.9:53965] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTgGbROd53wZBkdI_eJtAAAAJA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:54.375506 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:54327] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTgGv-JFLfishX45N_ZrgAAAQ4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:55.383544 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:54599] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgG_-JFLfishX45N_ZsAAAAQM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:58.790643 2026] [:error] [pid 23872:tid 23885] [client 161.35.219.9:55532] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgHkzkQFuA2qBk8UM4DQAAAYo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:55:59.596714 2026] [:error] [pid 31257:tid 31275] [client 161.35.219.9:54599] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgH_-JFLfishX45N_ZtQAAAQw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:01.241030 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:55532] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgIUzkQFuA2qBk8UM4FQAAAZA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:02.038680 2026] [:error] [pid 31257:tid 31273] [client 161.35.219.9:54599] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgIv-JFLfishX45N_ZuAAAAQo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:02.038738 2026] [:error] [pid 31257:tid 31273] [client 161.35.219.9:54599] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgIv-JFLfishX45N_ZuAAAAQo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:03.052637 2026] [:error] [pid 21575:tid 21590] [client 161.35.219.9:56664] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTgIyrocdArcJqFfIl3MwAAAUs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:04.057352 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:56974] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTgJEzkQFuA2qBk8UM4IAAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:05.070750 2026] [:error] [pid 28794:tid 28855] [client 161.35.219.9:57302] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTgJaVy2qpaelbUob1ccwAAAFM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:06.078535 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:57577] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTgJv-JFLfishX45N_ZwAAAAQM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:07.087235 2026] [:error] [pid 31257:tid 31273] [client 161.35.219.9:57810] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgJ_-JFLfishX45N_ZywAAAQo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:07.087300 2026] [:error] [pid 31257:tid 31273] [client 161.35.219.9:57810] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgJ_-JFLfishX45N_ZywAAAQo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:08.107855 2026] [:error] [pid 21575:tid 21590] [client 161.35.219.9:58066] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTgKCrocdArcJqFfIl3PAAAAUs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:09.146521 2026] [:error] [pid 28908:tid 28932] [client 161.35.219.9:58314] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTgKYqJmC8ih_lQQnDagQAAANY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:10.164482 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:58567] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTgKirocdArcJqFfIl3RQAAAUw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:11.180057 2026] [:error] [pid 21575:tid 21601] [client 161.35.219.9:58827] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTgKyrocdArcJqFfIl3SAAAAVY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:12.209648 2026] [:error] [pid 21575:tid 21600] [client 161.35.219.9:59047] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgLCrocdArcJqFfIl3TAAAAVU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:12.209782 2026] [:error] [pid 21575:tid 21600] [client 161.35.219.9:59047] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgLCrocdArcJqFfIl3TAAAAVU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:14.813713 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:59796] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgLv-JFLfishX45N_Z6AAAARU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:15.625539 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:59331] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgL_-JFLfishX45N_Z7wAAAQ4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:15.625612 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:59331] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgL_-JFLfishX45N_Z7wAAAQ4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:16.685561 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:60212] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTgMEzkQFuA2qBk8UM4RQAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:17.693780 2026] [:error] [pid 31257:tid 31286] [client 161.35.219.9:60433] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTgMf-JFLfishX45N_Z-QAAARc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:18.711704 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:60676] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTgMv-JFLfishX45N_Z_wAAAQU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:19.718125 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:60964] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTgM_-JFLfishX45N_aBQAAAQg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:20.774865 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:61243] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgNEzkQFuA2qBk8UM4VwAAAZY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:21.604782 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:61243] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTgNUzkQFuA2qBk8UM4XAAAAYQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:22.615931 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:61730] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTgNkzkQFuA2qBk8UM4aQAAAZE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:23.638485 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:62003] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTgN0zkQFuA2qBk8UM4bAAAAYI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:24.954859 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:62379] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTgOP-JFLfishX45N_aHgAAARM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:25.976877 2026] [:error] [pid 28795:tid 28875] [client 161.35.219.9:62658] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgObROd53wZBkdI_eJ2wAAAIw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:25.976964 2026] [:error] [pid 28795:tid 28875] [client 161.35.219.9:62658] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgObROd53wZBkdI_eJ2wAAAIw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:28.672235 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:63334] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgPP-JFLfishX45N_aKwAAARM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:29.468492 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:62904] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgPUzkQFuA2qBk8UM4jwAAAYM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:31.018517 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:63334] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgP_-JFLfishX45N_aLgAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:31.793095 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:62904] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgP0zkQFuA2qBk8UM4pAAAAZI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:33.352495 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:63334] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgQf-JFLfishX45N_aNQAAAQ0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:34.114926 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:62904] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgQkzkQFuA2qBk8UM4qAAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:34.115029 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:62904] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgQkzkQFuA2qBk8UM4qAAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:35.936539 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:63334] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgQ_-JFLfishX45N_aOQAAAQs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:36.726752 2026] [:error] [pid 23872:tid 23876] [client 161.35.219.9:65009] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgREzkQFuA2qBk8UM4uwAAAYE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:38.312366 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:63334] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgRv-JFLfishX45N_aQwAAARQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:39.102595 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:65009] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgR0zkQFuA2qBk8UM4xAAAAYU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:39.102645 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:65009] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgR0zkQFuA2qBk8UM4xAAAAYU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:40.918707 2026] [:error] [pid 31257:tid 31264] [client 161.35.219.9:63334] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgSP-JFLfishX45N_aSQAAAQE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:41.727517 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:49865] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgSUzkQFuA2qBk8UM40QAAAYw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:41.727589 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:49865] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgSUzkQFuA2qBk8UM40QAAAYw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:42.743386 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:50532] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTgSv-JFLfishX45N_aUQAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:43.933991 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:50796] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTgSyrocdArcJqFfIl3iQAAAVA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:44.958385 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:51108] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTgTEzkQFuA2qBk8UM43gAAAZE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:45.949112 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:51339] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTgTUzkQFuA2qBk8UM45gAAAZA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:46.959676 2026] [:error] [pid 31257:tid 31286] [client 161.35.219.9:51603] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgTv-JFLfishX45N_aZQAAARc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:46.959743 2026] [:error] [pid 31257:tid 31286] [client 161.35.219.9:51603] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgTv-JFLfishX45N_aZQAAARc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:49.669209 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:52309] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgUUzkQFuA2qBk8UM49gAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:50.541818 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:51851] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgUirocdArcJqFfIl3ogAAAU8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:50.541902 2026] [:error] [pid 21575:tid 21594] [client 161.35.219.9:51851] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgUirocdArcJqFfIl3ogAAAU8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:51.551845 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:52820] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTgU0zkQFuA2qBk8UM4_QAAAYw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:52.628562 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:53103] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTgVCrocdArcJqFfIl3qAAAAUU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:53.632204 2026] [:error] [pid 28795:tid 28874] [client 161.35.219.9:53385] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTgVbROd53wZBkdI_eJ7QAAAIs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:54.658585 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:53722] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTgVirocdArcJqFfIl3rQAAAUA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:55.686222 2026] [:error] [pid 28908:tid 28917] [client 161.35.219.9:53953] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgV4qJmC8ih_lQQnDaxgAAAMc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:56.535769 2026] [:error] [pid 28908:tid 28927] [client 161.35.219.9:53953] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTgWIqJmC8ih_lQQnDaxwAAANE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:57.638135 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:54458] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTgWf-JFLfishX45N_aawAAARM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:58.648543 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:54761] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTgWv-JFLfishX45N_abwAAARY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:56:59.651173 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:55030] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTgW_-JFLfishX45N_acQAAARU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:00.877690 2026] [:error] [pid 21575:tid 21588] [client 161.35.219.9:55352] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgXCrocdArcJqFfIl3vwAAAUk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:00.877756 2026] [:error] [pid 21575:tid 21588] [client 161.35.219.9:55352] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgXCrocdArcJqFfIl3vwAAAUk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:03.480708 2026] [:error] [pid 28794:tid 28860] [client 161.35.219.9:56033] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgX6Vy2qpaelbUob1c0gAAAFg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:04.306113 2026] [:error] [pid 28795:tid 28882] [client 161.35.219.9:55641] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgYLROd53wZBkdI_eKCAAAAJM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:05.916918 2026] [:error] [pid 28794:tid 28847] [client 161.35.219.9:56033] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgYaVy2qpaelbUob1c1QAAAEs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:06.694426 2026] [:error] [pid 28795:tid 28878] [client 161.35.219.9:55641] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgYrROd53wZBkdI_eKDAAAAI8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:06.694460 2026] [:error] [pid 28795:tid 28878] [client 161.35.219.9:55641] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgYrROd53wZBkdI_eKDAAAAI8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:08.545494 2026] [:error] [pid 28794:tid 28845] [client 161.35.219.9:56033] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgZKVy2qpaelbUob1c3AAAAEk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:09.326782 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:57215] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgZUzkQFuA2qBk8UM5YwAAAZc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:09.326879 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:57215] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgZUzkQFuA2qBk8UM5YwAAAZc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:11.135536 2026] [:error] [pid 28794:tid 28839] [client 161.35.219.9:56033] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgZ6Vy2qpaelbUob1c4gAAAEM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:11.953764 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:57909] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgZ0zkQFuA2qBk8UM5dQAAAYQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:12.743754 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:57909] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTgaEzkQFuA2qBk8UM5ewAAAZU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:13.859935 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:58809] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTgaUzkQFuA2qBk8UM5gwAAAZI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:14.857805 2026] [:error] [pid 28794:tid 28838] [client 161.35.219.9:59102] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTgaqVy2qpaelbUob1c5gAAAEI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:15.868907 2026] [:error] [pid 28793:tid 28812] [client 161.35.219.9:59380] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTgaw2_fxBANaHo1f5C7wAAAAU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:16.875540 2026] [:error] [pid 21575:tid 21581] [client 161.35.219.9:59636] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgbCrocdArcJqFfIl37AAAAUI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:19.239530 2026] [:error] [pid 28793:tid 28821] [client 161.35.219.9:60274] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgbw2_fxBANaHo1f5C9AAAAA4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:20.022956 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:59636] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgcCrocdArcJqFfIl3-QAAAUw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:21.648906 2026] [:error] [pid 28793:tid 28820] [client 161.35.219.9:60274] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgcQ2_fxBANaHo1f5C9gAAAA0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:22.415709 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:59636] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgcirocdArcJqFfIl4CAAAAVQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:22.415785 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:59636] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgcirocdArcJqFfIl4CAAAAVQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:23.417014 2026] [:error] [pid 28795:tid 28879] [client 161.35.219.9:61435] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTgc7ROd53wZBkdI_eKHQAAAJA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:24.416014 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:61764] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTgdP-JFLfishX45N_apwAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:25.471053 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:62091] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTgdUzkQFuA2qBk8UM5pAAAAYI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:26.646598 2026] [:error] [pid 28908:tid 28925] [client 161.35.219.9:62433] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTgdoqJmC8ih_lQQnDa8QAAAM8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:27.655273 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:62632] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgd_-JFLfishX45N_argAAARM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:27.655345 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:62632] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgd_-JFLfishX45N_argAAARM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:30.280784 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:63389] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgekzkQFuA2qBk8UM54gAAAY0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:30.280844 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:63389] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgekzkQFuA2qBk8UM54gAAAY0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:30.527706 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:62894] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTgekzkQFuA2qBk8UM55QAAAZg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:31.537534 2026] [:error] [pid 21575:tid 21600] [client 161.35.219.9:63742] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTgeyrocdArcJqFfIl4FAAAAVU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:32.540899 2026] [:error] [pid 28795:tid 28872] [client 161.35.219.9:64019] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTgfLROd53wZBkdI_eKKAAAAIk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:33.548981 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:64300] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgfUzkQFuA2qBk8UM59gAAAYU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:35.922717 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:64935] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgfyrocdArcJqFfIl4JAAAAVg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:35.922814 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:64935] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgfyrocdArcJqFfIl4JAAAAVg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:36.170106 2026] [:error] [pid 23872:tid 23894] [client 161.35.219.9:64300] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTggEzkQFuA2qBk8UM6AAAAAZM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:37.167277 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:65235] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTggSrocdArcJqFfIl4MAAAAUU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:40.350243 2026] [:error] [pid 28908:tid 28916] [client 161.35.219.9:49635] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTghIqJmC8ih_lQQnDbBwAAAMY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:41.364734 2026] [:error] [pid 28908:tid 28921] [client 161.35.219.9:49989] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTghYqJmC8ih_lQQnDbDgAAAMs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:43.748973 2026] [:error] [pid 23872:tid 23883] [client 161.35.219.9:50654] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgh0zkQFuA2qBk8UM6FAAAAYg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:44.540245 2026] [:error] [pid 28908:tid 28918] [client 161.35.219.9:49989] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgiIqJmC8ih_lQQnDbFgAAAMg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:44.540332 2026] [:error] [pid 28908:tid 28918] [client 161.35.219.9:49989] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgiIqJmC8ih_lQQnDbFgAAAMg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:46.383601 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:50654] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgikzkQFuA2qBk8UM6LQAAAYI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:47.166336 2026] [:error] [pid 21575:tid 21581] [client 161.35.219.9:51141] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgiyrocdArcJqFfIl4TQAAAUI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:47.166444 2026] [:error] [pid 21575:tid 21581] [client 161.35.219.9:51141] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgiyrocdArcJqFfIl4TQAAAUI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:48.191003 2026] [:error] [pid 28793:tid 28818] [client 161.35.219.9:51922] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTgjA2_fxBANaHo1f5C_AAAAAs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:49.197166 2026] [:error] [pid 23872:tid 23883] [client 161.35.219.9:52208] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTgjUzkQFuA2qBk8UM6QAAAAYg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:50.210660 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:52521] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTgjkzkQFuA2qBk8UM6SQAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:51.232404 2026] [:error] [pid 28795:tid 28876] [client 161.35.219.9:52816] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTgj7ROd53wZBkdI_eKQwAAAI0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:52.263943 2026] [:error] [pid 28795:tid 28886] [client 161.35.219.9:53121] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgkLROd53wZBkdI_eKRwAAAJc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:52.264069 2026] [:error] [pid 28795:tid 28886] [client 161.35.219.9:53121] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgkLROd53wZBkdI_eKRwAAAJc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:53.273958 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:53387] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTgkf-JFLfishX45N_a3wAAAQs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:54.287186 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:53721] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTgkkzkQFuA2qBk8UM6VAAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:55.285334 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:53997] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTgkyrocdArcJqFfIl4VwAAAUU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:56.311574 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:54235] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTglEzkQFuA2qBk8UM6YAAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:57.337809 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:54497] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTglUzkQFuA2qBk8UM6awAAAZc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:58.096234 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:54497] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTglkzkQFuA2qBk8UM6cgAAAYQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:57:59.113713 2026] [:error] [pid 28793:tid 28808] [client 161.35.219.9:54987] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTglw2_fxBANaHo1f5DCwAAAAE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:00.119961 2026] [:error] [pid 31257:tid 31264] [client 161.35.219.9:55255] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTgmP-JFLfishX45N_a7wAAAQE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:01.113066 2026] [:error] [pid 28908:tid 28926] [client 161.35.219.9:55520] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTgmYqJmC8ih_lQQnDbJwAAANA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:02.136961 2026] [:error] [pid 21575:tid 21590] [client 161.35.219.9:55750] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgmirocdArcJqFfIl4ZAAAAUs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:02.924788 2026] [:error] [pid 21575:tid 21601] [client 161.35.219.9:55750] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTgmirocdArcJqFfIl4aQAAAVY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:03.949097 2026] [:error] [pid 28795:tid 28864] [client 161.35.219.9:56272] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTgm7ROd53wZBkdI_eKXQAAAIE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:05.025550 2026] [:error] [pid 28908:tid 28914] [client 161.35.219.9:56599] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTgnYqJmC8ih_lQQnDbNAAAAMQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:06.024674 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:56860] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTgnkzkQFuA2qBk8UM6kAAAAYw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:07.044615 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:57135] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgnyrocdArcJqFfIl4dQAAAUU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:07.044690 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:57135] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgnyrocdArcJqFfIl4dQAAAUU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:09.820223 2026] [:error] [pid 21575:tid 21593] [client 161.35.219.9:57806] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgoSrocdArcJqFfIl4iQAAAU4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:10.657943 2026] [:error] [pid 28795:tid 28882] [client 161.35.219.9:57439] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgorROd53wZBkdI_eKaQAAAJM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:10.658009 2026] [:error] [pid 28795:tid 28882] [client 161.35.219.9:57439] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgorROd53wZBkdI_eKaQAAAJM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:11.681436 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:58299] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTgo0zkQFuA2qBk8UM6sQAAAZg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:12.689359 2026] [:error] [pid 28794:tid 28837] [client 161.35.219.9:58571] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTgpKVy2qpaelbUob1dFwAAAEE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:13.689063 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:58831] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTgpUzkQFuA2qBk8UM6vQAAAZg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:14.703670 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:59121] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTgpkzkQFuA2qBk8UM6xQAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:15.740656 2026] [:error] [pid 28908:tid 28933] [client 161.35.219.9:59418] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgp4qJmC8ih_lQQnDbOgAAANc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:15.740724 2026] [:error] [pid 28908:tid 28933] [client 161.35.219.9:59418] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgp4qJmC8ih_lQQnDbOgAAANc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:18.310022 2026] [:error] [pid 28795:tid 28881] [client 161.35.219.9:60095] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgqrROd53wZBkdI_eKeQAAAJI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:19.088409 2026] [:error] [pid 28794:tid 28840] [client 161.35.219.9:59725] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgq6Vy2qpaelbUob1dJAAAAEQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:20.731585 2026] [:error] [pid 28795:tid 28879] [client 161.35.219.9:60095] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgrLROd53wZBkdI_eKfAAAAJA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:21.492097 2026] [:error] [pid 28794:tid 28856] [client 161.35.219.9:59725] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgraVy2qpaelbUob1dKQAAAFQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:23.049873 2026] [:error] [pid 28795:tid 28880] [client 161.35.219.9:60095] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgr7ROd53wZBkdI_eKlgAAAJE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:23.843781 2026] [:error] [pid 28794:tid 28840] [client 161.35.219.9:59725] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgr6Vy2qpaelbUob1dNwAAAEQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:24.633742 2026] [:error] [pid 28794:tid 28837] [client 161.35.219.9:59725] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTgsKVy2qpaelbUob1dOQAAAEE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:25.653759 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:62197] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTgsUzkQFuA2qBk8UM67AAAAYY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:26.667669 2026] [:error] [pid 28908:tid 28916] [client 161.35.219.9:62490] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTgsoqJmC8ih_lQQnDbTAAAAMY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:27.671907 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:62733] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTgs0zkQFuA2qBk8UM6-gAAAZI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:28.714021 2026] [:error] [pid 21575:tid 21596] [client 161.35.219.9:62991] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgtCrocdArcJqFfIl4swAAAVE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:31.129082 2026] [:error] [pid 21575:tid 21596] [client 161.35.219.9:62991] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTgtyrocdArcJqFfIl4tgAAAVE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:32.145075 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:63947] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTguP-JFLfishX45N_bLAAAAQ4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:33.161878 2026] [:error] [pid 28908:tid 28917] [client 161.35.219.9:64228] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTguYqJmC8ih_lQQnDbWgAAAMc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:34.179828 2026] [:error] [pid 28908:tid 28913] [client 161.35.219.9:64558] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTguoqJmC8ih_lQQnDbYgAAAMM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:35.223889 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:64901] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgu_-JFLfishX45N_bOgAAAQI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:37.614972 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:65488] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgvf-JFLfishX45N_bXAAAAQI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:37.615057 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:65488] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgvf-JFLfishX45N_bXAAAAQI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:37.862274 2026] [:error] [pid 31257:tid 31280] [client 161.35.219.9:64901] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTgvf-JFLfishX45N_bagAAARE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:38.868034 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:49471] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTgvkzkQFuA2qBk8UM7QgAAAYM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:40.258742 2026] [:error] [pid 28908:tid 28927] [client 161.35.219.9:49832] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTgwIqJmC8ih_lQQnDbZgAAANE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:41.268902 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:50079] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgwUzkQFuA2qBk8UM7XAAAAYw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:43.803411 2026] [:error] [pid 21575:tid 21601] [client 161.35.219.9:50787] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgwyrocdArcJqFfIl46wAAAVY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:44.589444 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:50079] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgxEzkQFuA2qBk8UM7YwAAAYU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:44.589546 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:50079] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgxEzkQFuA2qBk8UM7YwAAAYU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:46.404400 2026] [:error] [pid 21575:tid 21586] [client 161.35.219.9:50787] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgxirocdArcJqFfIl4_wAAAUc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:47.200724 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:51394] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgx_-JFLfishX45N_bvAAAAQ0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:47.200778 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:51394] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgx_-JFLfishX45N_bvAAAAQ0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:48.991673 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:50787] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgyCrocdArcJqFfIl5FQAAAUo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:49.775999 2026] [:error] [pid 28795:tid 28875] [client 161.35.219.9:52197] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgybROd53wZBkdI_eKwgAAAIw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:49.776069 2026] [:error] [pid 28795:tid 28875] [client 161.35.219.9:52197] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgybROd53wZBkdI_eKwgAAAIw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:51.584018 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:50787] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgyyrocdArcJqFfIl5MAAAAVg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:52.367845 2026] [:error] [pid 28795:tid 28872] [client 161.35.219.9:52944] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTgzLROd53wZBkdI_eKxQAAAIk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:53.153495 2026] [:error] [pid 28795:tid 28885] [client 161.35.219.9:52944] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTgzbROd53wZBkdI_eKxgAAAJY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:54.158627 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:53931] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTgzkzkQFuA2qBk8UM73wAAAZA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:55.183828 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:54265] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTgz0zkQFuA2qBk8UM75QAAAZU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:56.224903 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:54544] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTg0CrocdArcJqFfIl5PgAAAUU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:57.227364 2026] [:error] [pid 28908:tid 28915] [client 161.35.219.9:54821] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg0YqJmC8ih_lQQnDbfgAAAMU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:57.227485 2026] [:error] [pid 28908:tid 28915] [client 161.35.219.9:54821] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg0YqJmC8ih_lQQnDbfgAAAMU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:58:59.764683 2026] [:error] [pid 23872:tid 23885] [client 161.35.219.9:55499] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg00zkQFuA2qBk8UM77QAAAYo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:00.529934 2026] [:error] [pid 28908:tid 28933] [client 161.35.219.9:55114] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg1IqJmC8ih_lQQnDblQAAANc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:00.530033 2026] [:error] [pid 28908:tid 28933] [client 161.35.219.9:55114] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg1IqJmC8ih_lQQnDblQAAANc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:01.541893 2026] [:error] [pid 21575:tid 21582] [client 161.35.219.9:56024] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTg1SrocdArcJqFfIl5RgAAAUM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:02.593155 2026] [:error] [pid 23872:tid 23876] [client 161.35.219.9:56360] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTg1kzkQFuA2qBk8UM8BgAAAYE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:03.588917 2026] [:error] [pid 28794:tid 28836] [client 161.35.219.9:56662] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTg16Vy2qpaelbUob1dUwAAAEA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:04.597075 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:56999] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTg2P-JFLfishX45N_b4AAAAQI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:05.611901 2026] [:error] [pid 21575:tid 21585] [client 161.35.219.9:57320] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg2SrocdArcJqFfIl5UAAAAUY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:05.612016 2026] [:error] [pid 21575:tid 21585] [client 161.35.219.9:57320] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg2SrocdArcJqFfIl5UAAAAUY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:08.261962 2026] [:error] [pid 28795:tid 28880] [client 161.35.219.9:58060] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg3LROd53wZBkdI_eK1AAAAJE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:09.042183 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:57649] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg3SrocdArcJqFfIl5XAAAAVc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:09.042281 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:57649] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg3SrocdArcJqFfIl5XAAAAVc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:10.860903 2026] [:error] [pid 28795:tid 28871] [client 161.35.219.9:58060] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg3rROd53wZBkdI_eK1gAAAIg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:11.632104 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:58500] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg3_-JFLfishX45N_b9wAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:12.382873 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:58500] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTg4P-JFLfishX45N_b-QAAAQs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:13.402490 2026] [:error] [pid 28795:tid 28880] [client 161.35.219.9:59404] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTg4bROd53wZBkdI_eK5gAAAJE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:14.406597 2026] [:error] [pid 28795:tid 28865] [client 161.35.219.9:59737] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTg4rROd53wZBkdI_eK6gAAAII"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:15.412909 2026] [:error] [pid 21575:tid 21590] [client 161.35.219.9:60027] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTg4yrocdArcJqFfIl5ZwAAAUs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:16.791591 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:60342] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg5CrocdArcJqFfIl5awAAAUA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:16.791687 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:60342] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg5CrocdArcJqFfIl5awAAAUA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:19.372079 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:61018] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg50zkQFuA2qBk8UM8PQAAAYM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:20.134820 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:60590] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg6EzkQFuA2qBk8UM8SQAAAZg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:20.134871 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:60590] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg6EzkQFuA2qBk8UM8SQAAAZg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:21.940542 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:61018] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg6UzkQFuA2qBk8UM8UAAAAZY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:21.940600 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:61018] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg6UzkQFuA2qBk8UM8UAAAAZY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:22.209645 2026] [:error] [pid 28908:tid 28917] [client 161.35.219.9:61555] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTg6oqJmC8ih_lQQnDbuAAAAMc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:23.238560 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:62105] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTg60zkQFuA2qBk8UM8VAAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:24.411549 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:62460] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTg7P-JFLfishX45N_cEwAAARU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:25.421692 2026] [:error] [pid 28795:tid 28869] [client 161.35.219.9:62773] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg7bROd53wZBkdI_eK9gAAAIY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:27.778007 2026] [:error] [pid 21575:tid 21596] [client 161.35.219.9:63506] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg7yrocdArcJqFfIl5kwAAAVE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:28.618006 2026] [:error] [pid 28795:tid 28870] [client 161.35.219.9:62773] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg8LROd53wZBkdI_eLAAAAAIc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:30.375470 2026] [:error] [pid 21575:tid 21586] [client 161.35.219.9:63506] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg8irocdArcJqFfIl5lwAAAUc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:31.321379 2026] [:error] [pid 28795:tid 28878] [client 161.35.219.9:62773] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg87ROd53wZBkdI_eLBQAAAI8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:31.321508 2026] [:error] [pid 28795:tid 28878] [client 161.35.219.9:62773] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg87ROd53wZBkdI_eLBQAAAI8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:32.343616 2026] [:error] [pid 31257:tid 31287] [client 161.35.219.9:64763] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTg9P-JFLfishX45N_cRwAAARg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:33.362127 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:65050] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTg9UzkQFuA2qBk8UM8ogAAAZI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:34.398125 2026] [:error] [pid 31257:tid 31272] [client 161.35.219.9:65439] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTg9v-JFLfishX45N_cUQAAAQk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:35.411901 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:49375] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTg90zkQFuA2qBk8UM8ugAAAYs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:36.431159 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:49697] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg-EzkQFuA2qBk8UM8wgAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:36.431247 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:49697] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 21"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg-EzkQFuA2qBk8UM8wgAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:37.461108 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:49991] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTg-f-JFLfishX45N_cXgAAARU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:38.473275 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:50259] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTg-kzkQFuA2qBk8UM8zwAAAZY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:39.499366 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:50559] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTg-_-JFLfishX45N_caQAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:40.565317 2026] [:error] [pid 28908:tid 28911] [client 161.35.219.9:50827] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTg_IqJmC8ih_lQQnDb2gAAAME"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:41.594262 2026] [:error] [pid 28908:tid 28918] [client 161.35.219.9:51156] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg_YqJmC8ih_lQQnDb3AAAAMg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:41.594344 2026] [:error] [pid 28908:tid 28918] [client 161.35.219.9:51156] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTg_YqJmC8ih_lQQnDb3AAAAMg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:44.231311 2026] [:error] [pid 28795:tid 28884] [client 161.35.219.9:51959] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThALROd53wZBkdI_eLDQAAAJU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:45.074849 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:51439] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThAf-JFLfishX45N_cgQAAARY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:48.011696 2026] [:error] [pid 28795:tid 28868] [client 161.35.219.9:51959] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThBLROd53wZBkdI_eLEgAAAIU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:48.811535 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:51439] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThBP-JFLfishX45N_ckwAAAQM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:48.811634 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:51439] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 21"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThBP-JFLfishX45N_ckwAAAQM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:50.662660 2026] [:error] [pid 28795:tid 28864] [client 161.35.219.9:51959] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThBrROd53wZBkdI_eLFQAAAIE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:51.413229 2026] [:error] [pid 28795:tid 28876] [client 161.35.219.9:53521] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThB7ROd53wZBkdI_eLFgAAAI0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:51.413296 2026] [:error] [pid 28795:tid 28876] [client 161.35.219.9:53521] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThB7ROd53wZBkdI_eLFgAAAI0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:52.425415 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:54255] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaThCEzkQFuA2qBk8UM9GwAAAYI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:53.442509 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:54534] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThCf-JFLfishX45N_cqgAAAQg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:54.462649 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:54877] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThCkzkQFuA2qBk8UM9MgAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:55.493692 2026] [:error] [pid 21575:tid 21590] [client 161.35.219.9:55156] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaThCyrocdArcJqFfIl5rgAAAUs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:56.499690 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:55493] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThDCrocdArcJqFfIl5sQAAAVg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:56.499783 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:55493] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThDCrocdArcJqFfIl5sQAAAVg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:59.127523 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:56216] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThD0zkQFuA2qBk8UM9UwAAAZg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:59.920836 2026] [:error] [pid 31257:tid 31264] [client 161.35.219.9:55741] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThD_-JFLfishX45N_ctgAAAQE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 08:59:59.920966 2026] [:error] [pid 31257:tid 31264] [client 161.35.219.9:55741] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThD_-JFLfishX45N_ctgAAAQE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:00.998898 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:56795] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaThEP-JFLfishX45N_cuwAAAQ4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:02.016066 2026] [:error] [pid 28795:tid 28886] [client 161.35.219.9:57097] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThErROd53wZBkdI_eLFwAAAJc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:03.036793 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:57358] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThE_-JFLfishX45N_cxQAAAQU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:04.067974 2026] [:error] [pid 21575:tid 21588] [client 161.35.219.9:57618] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaThFCrocdArcJqFfIl5zwAAAUk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:06.129817 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:57967] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThFv-JFLfishX45N_cyAAAAQI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:06.129919 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:57967] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 22"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThFv-JFLfishX45N_cyAAAAQI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:08.757304 2026] [:error] [pid 28793:tid 28813] [client 161.35.219.9:58843] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThGA2_fxBANaHo1f5DagAAAAY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:08.757373 2026] [:error] [pid 28793:tid 28813] [client 161.35.219.9:58843] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThGA2_fxBANaHo1f5DagAAAAY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:09.004400 2026] [:error] [pid 21575:tid 21585] [client 161.35.219.9:58428] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThGSrocdArcJqFfIl54wAAAUY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:10.027248 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:59134] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThGv-JFLfishX45N_c2AAAAQQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:11.033800 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:59397] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaThG0zkQFuA2qBk8UM9egAAAY0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:12.060172 2026] [:error] [pid 28793:tid 28827] [client 161.35.219.9:59694] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThHA2_fxBANaHo1f5DbAAAABQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:12.060248 2026] [:error] [pid 28793:tid 28827] [client 161.35.219.9:59694] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThHA2_fxBANaHo1f5DbAAAABQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:13.091299 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:59999] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaThHUzkQFuA2qBk8UM9gAAAAZU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:14.117770 2026] [:error] [pid 28794:tid 28852] [client 161.35.219.9:60275] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThHqVy2qpaelbUob1dmgAAAFA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:15.127296 2026] [:error] [pid 28795:tid 28886] [client 161.35.219.9:60587] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThH7ROd53wZBkdI_eLKAAAAJc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:16.130847 2026] [:error] [pid 28795:tid 28875] [client 161.35.219.9:60876] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaThILROd53wZBkdI_eLLAAAAIw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:17.222709 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:61149] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThIUzkQFuA2qBk8UM9iwAAAYM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:19.688055 2026] [:error] [pid 28795:tid 28880] [client 161.35.219.9:61841] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThI7ROd53wZBkdI_eLMQAAAJE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:20.485874 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:61149] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThJEzkQFuA2qBk8UM9oQAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:22.068875 2026] [:error] [pid 28795:tid 28885] [client 161.35.219.9:61841] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThJrROd53wZBkdI_eLNAAAAJY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:22.875597 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:61149] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThJkzkQFuA2qBk8UM9qAAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:24.564053 2026] [:error] [pid 28795:tid 28873] [client 161.35.219.9:61841] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThKLROd53wZBkdI_eLOAAAAIo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:25.361719 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:61149] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThKUzkQFuA2qBk8UM9wAAAAY0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:26.972680 2026] [:error] [pid 28795:tid 28878] [client 161.35.219.9:61841] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThKrROd53wZBkdI_eLOQAAAI8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:27.812044 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:61149] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThK0zkQFuA2qBk8UM92gAAAZA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:27.812191 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:61149] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThK0zkQFuA2qBk8UM92gAAAZA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:29.652657 2026] [:error] [pid 28795:tid 28880] [client 161.35.219.9:61841] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThLbROd53wZBkdI_eLPAAAAJE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:30.447868 2026] [:error] [pid 31257:tid 31286] [client 161.35.219.9:64294] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThLv-JFLfishX45N_c-wAAARc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:32.089544 2026] [:error] [pid 28795:tid 28872] [client 161.35.219.9:61841] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThMLROd53wZBkdI_eLPgAAAIk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:32.889877 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:64294] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThMP-JFLfishX45N_dFAAAAQ8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:33.718477 2026] [:error] [pid 31257:tid 31273] [client 161.35.219.9:64294] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaThMf-JFLfishX45N_dGwAAAQo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:34.721897 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:49560] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThMkzkQFuA2qBk8UM97gAAAZI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:35.739019 2026] [:error] [pid 23872:tid 23876] [client 161.35.219.9:49855] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThM0zkQFuA2qBk8UM98QAAAYE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:36.844773 2026] [:error] [pid 28908:tid 28934] [client 161.35.219.9:50189] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaThNIqJmC8ih_lQQnDcKwAAANg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:37.867899 2026] [:error] [pid 31257:tid 31263] [client 161.35.219.9:50445] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThNf-JFLfishX45N_dMwAAAQA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:37.867965 2026] [:error] [pid 31257:tid 31263] [client 161.35.219.9:50445] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThNf-JFLfishX45N_dMwAAAQA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:40.460667 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:51100] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThOEzkQFuA2qBk8UM-BgAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:41.267947 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:50683] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThOf-JFLfishX45N_dQwAAAQQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:42.882281 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:51100] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThOkzkQFuA2qBk8UM-EQAAAY8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:42.882528 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:51100] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThOkzkQFuA2qBk8UM-EQAAAY8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:43.132867 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:50683] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThO_-JFLfishX45N_dSQAAAQ0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:44.157525 2026] [:error] [pid 21575:tid 21585] [client 161.35.219.9:52083] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThPCrocdArcJqFfIl6DQAAAUY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:45.191676 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:52355] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaThPUzkQFuA2qBk8UM-FwAAAZE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:46.209605 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:52628] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThPkzkQFuA2qBk8UM-HQAAAY8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:48.726981 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:53221] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThQEzkQFuA2qBk8UM-JQAAAYY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:49.595931 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:52628] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThQUzkQFuA2qBk8UM-JwAAAZI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:49.596024 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:52628] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThQUzkQFuA2qBk8UM-JwAAAZI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:50.616473 2026] [:error] [pid 28793:tid 28813] [client 161.35.219.9:53717] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaThQg2_fxBANaHo1f5DdgAAAAY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:51.644723 2026] [:error] [pid 21575:tid 21590] [client 161.35.219.9:54054] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThQyrocdArcJqFfIl6GgAAAUs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:52.662739 2026] [:error] [pid 21575:tid 21601] [client 161.35.219.9:54335] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThRCrocdArcJqFfIl6HQAAAVY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:53.678243 2026] [:error] [pid 28908:tid 28924] [client 161.35.219.9:54619] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaThRYqJmC8ih_lQQnDcRwAAAM4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:54.689727 2026] [:error] [pid 28908:tid 28921] [client 161.35.219.9:54942] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThRoqJmC8ih_lQQnDcSAAAAMs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:54.689727 2026] [:error] [pid 28908:tid 28921] [client 161.35.219.9:54942] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThRoqJmC8ih_lQQnDcSAAAAMs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:57.405802 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:55709] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThSUzkQFuA2qBk8UM-OgAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:00:58.439109 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:55219] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThSirocdArcJqFfIl6OAAAAUU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:00.257733 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:55709] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThTEzkQFuA2qBk8UM-WAAAAZY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:01.147664 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:55219] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThTSrocdArcJqFfIl6PgAAAVI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:01.147728 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:55219] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThTSrocdArcJqFfIl6PgAAAVI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:02.151786 2026] [:error] [pid 28795:tid 28863] [client 161.35.219.9:56985] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaThTrROd53wZBkdI_eLXQAAAIA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:03.158065 2026] [:error] [pid 21575:tid 21585] [client 161.35.219.9:57245] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThTyrocdArcJqFfIl6RAAAAUY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:04.230834 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:57544] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThUP-JFLfishX45N_dbwAAAQs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:05.242561 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:57816] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaThUUzkQFuA2qBk8UM-YQAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:06.251514 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:58097] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThUkzkQFuA2qBk8UM-ZwAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:06.251604 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:58097] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThUkzkQFuA2qBk8UM-ZwAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:08.894161 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:58808] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThVEzkQFuA2qBk8UM-dwAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:09.744064 2026] [:error] [pid 28908:tid 28914] [client 161.35.219.9:58383] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThVYqJmC8ih_lQQnDcYwAAAMQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:09.744155 2026] [:error] [pid 28908:tid 28914] [client 161.35.219.9:58383] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThVYqJmC8ih_lQQnDcYwAAAMQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:11.770935 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:58808] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThV0zkQFuA2qBk8UM-jAAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:12.660572 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:59309] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThWEzkQFuA2qBk8UM-kQAAAYY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:13.472527 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:59309] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaThWUzkQFuA2qBk8UM-lwAAAY0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:14.500283 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:60322] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThWkzkQFuA2qBk8UM-ngAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:15.513903 2026] [:error] [pid 28795:tid 28877] [client 161.35.219.9:60636] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThW7ROd53wZBkdI_eLeAAAAI4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:18.190071 2026] [:error] [pid 28908:tid 28911] [client 161.35.219.9:61305] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThXoqJmC8ih_lQQnDccAAAAME"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:20.739737 2026] [:error] [pid 28908:tid 28927] [client 161.35.219.9:61983] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThYIqJmC8ih_lQQnDcdAAAANE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:21.629518 2026] [:error] [pid 28908:tid 28917] [client 161.35.219.9:61305] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThYYqJmC8ih_lQQnDcdQAAAMc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:23.373077 2026] [:error] [pid 28908:tid 28932] [client 161.35.219.9:61983] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThY4qJmC8ih_lQQnDcdwAAANY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:23.373134 2026] [:error] [pid 28908:tid 28932] [client 161.35.219.9:61983] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThY4qJmC8ih_lQQnDcdwAAANY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:23.621471 2026] [:error] [pid 28908:tid 28931] [client 161.35.219.9:61305] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThY4qJmC8ih_lQQnDceAAAANU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:24.625264 2026] [:error] [pid 23872:tid 23876] [client 161.35.219.9:63119] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThZEzkQFuA2qBk8UM_EgAAAYE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:27.700613 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:63888] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThZyrocdArcJqFfIl6bgAAAVQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:27.700698 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:63888] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThZyrocdArcJqFfIl6bgAAAVQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:28.723038 2026] [:error] [pid 28794:tid 28854] [client 161.35.219.9:64117] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaThaKVy2qpaelbUob1d1QAAAFI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:29.712118 2026] [:error] [pid 28795:tid 28885] [client 161.35.219.9:64365] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThabROd53wZBkdI_eLjQAAAJY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:30.709542 2026] [:error] [pid 28795:tid 28887] [client 161.35.219.9:64601] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTharROd53wZBkdI_eLjgAAAJg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:31.716021 2026] [:error] [pid 28793:tid 28815] [client 161.35.219.9:64894] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaThaw2_fxBANaHo1f5DhgAAAAg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:32.748166 2026] [:error] [pid 23872:tid 23876] [client 161.35.219.9:65123] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThbEzkQFuA2qBk8UM_ewAAAYE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:33.577523 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:65123] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaThbUzkQFuA2qBk8UM_ggAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:34.595981 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:49224] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThbkzkQFuA2qBk8UM_iAAAAZg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:35.617696 2026] [:error] [pid 31257:tid 31287] [client 161.35.219.9:49504] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThb_-JFLfishX45N_d5gAAARg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:36.652817 2026] [:error] [pid 28794:tid 28854] [client 161.35.219.9:49821] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaThcKVy2qpaelbUob1d4wAAAFI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:37.674407 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:50047] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThcUzkQFuA2qBk8UM_lgAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:37.674490 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:50047] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThcUzkQFuA2qBk8UM_lgAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:39.494597 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:50299] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaThc0zkQFuA2qBk8UM_ogAAAZY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:40.500795 2026] [:error] [pid 28795:tid 28871] [client 161.35.219.9:50661] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThdLROd53wZBkdI_eLnAAAAIg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:41.509847 2026] [:error] [pid 21575:tid 21599] [client 161.35.219.9:50945] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThdSrocdArcJqFfIl6pAAAAVQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:42.543285 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:51222] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaThdkzkQFuA2qBk8UM_sQAAAYs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:43.561087 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:51468] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThd_-JFLfishX45N_eDwAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:43.561191 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:51468] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThd_-JFLfishX45N_eDwAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:44.564280 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:51779] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTheP-JFLfishX45N_eGAAAARU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:45.572438 2026] [:error] [pid 28795:tid 28876] [client 161.35.219.9:52036] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThebROd53wZBkdI_eLoQAAAI0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:46.586084 2026] [:error] [pid 28793:tid 28812] [client 161.35.219.9:52304] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTheg2_fxBANaHo1f5D0QAAAAU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:47.621791 2026] [:error] [pid 28908:tid 28914] [client 161.35.219.9:52527] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaThe4qJmC8ih_lQQnDczQAAAMQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:48.653538 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:52745] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThfEzkQFuA2qBk8UM_vAAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:48.653613 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:52745] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThfEzkQFuA2qBk8UM_vAAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:49.675310 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:52960] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaThff-JFLfishX45N_eYgAAAQI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:50.683621 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:53200] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThfkzkQFuA2qBk8UM_yAAAAYY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:51.691294 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:53428] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThf0zkQFuA2qBk8UM_zQAAAYM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:52.817649 2026] [:error] [pid 21575:tid 21590] [client 161.35.219.9:53646] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaThgCrocdArcJqFfIl64wAAAUs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:53.831232 2026] [:error] [pid 28794:tid 28849] [client 161.35.219.9:53890] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThgaVy2qpaelbUob1d9AAAAE0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:54.713647 2026] [:error] [pid 28794:tid 28844] [client 161.35.219.9:53890] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaThgqVy2qpaelbUob1d9gAAAEg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:55.742281 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:54373] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThg_-JFLfishX45N_epAAAAQc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:56.777031 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:54636] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThhEzkQFuA2qBk8UM_8wAAAYU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:57.783571 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:54861] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaThhUzkQFuA2qBk8UM__gAAAYw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:58.796629 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:55127] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThhkzkQFuA2qBk8UNABwAAAYM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:01:59.634449 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:55127] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaThh0zkQFuA2qBk8UNACwAAAYs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:00.630681 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:55587] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThiEzkQFuA2qBk8UNAEAAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:01.646506 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:55829] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThif-JFLfishX45N_e3AAAAQg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:04.256244 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:56441] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThjEzkQFuA2qBk8UNAJAAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:04.256315 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:56441] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 23"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThjEzkQFuA2qBk8UNAJAAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:06.988412 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:57086] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThjkzkQFuA2qBk8UNAQQAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:07.855164 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:56657] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThj0zkQFuA2qBk8UNASgAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:08.715042 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:56657] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaThkEzkQFuA2qBk8UNAUgAAAYY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:09.718144 2026] [:error] [pid 31257:tid 31273] [client 161.35.219.9:57705] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThkf-JFLfishX45N_e9QAAAQo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:10.722111 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:57918] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThkv-JFLfishX45N_e-AAAAQc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:11.713771 2026] [:error] [pid 28795:tid 28865] [client 161.35.219.9:58147] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaThk7ROd53wZBkdI_eLsAAAAII"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:12.724642 2026] [:error] [pid 21575:tid 21600] [client 161.35.219.9:58346] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThlCrocdArcJqFfIl7LQAAAVU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:12.724746 2026] [:error] [pid 21575:tid 21600] [client 161.35.219.9:58346] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThlCrocdArcJqFfIl7LQAAAVU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:15.341094 2026] [:error] [pid 21575:tid 21583] [client 161.35.219.9:58996] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThlyrocdArcJqFfIl7MQAAAUQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:16.155977 2026] [:error] [pid 28795:tid 28879] [client 161.35.219.9:58559] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThmLROd53wZBkdI_eLvQAAAJA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:16.982329 2026] [:error] [pid 28795:tid 28887] [client 161.35.219.9:58559] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaThmLROd53wZBkdI_eLvgAAAJg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:17.993714 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:59678] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThmf-JFLfishX45N_fJgAAAQ8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:19.022024 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:59941] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThm0zkQFuA2qBk8UNAiAAAAZY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:20.042803 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:60180] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaThnEzkQFuA2qBk8UNAkAAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:21.050979 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:60397] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThnf-JFLfishX45N_fLQAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:23.544517 2026] [:error] [pid 21575:tid 21588] [client 161.35.219.9:60994] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThnyrocdArcJqFfIl7RgAAAUk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:24.335012 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:60397] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThoP-JFLfishX45N_fOQAAAQg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:24.335090 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:60397] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThoP-JFLfishX45N_fOQAAAQg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:26.196881 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:60994] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThoirocdArcJqFfIl7UAAAAVA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:27.019124 2026] [:error] [pid 28908:tid 28911] [client 161.35.219.9:61477] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTho4qJmC8ih_lQQnDc_wAAAME"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:27.019196 2026] [:error] [pid 28908:tid 28911] [client 161.35.219.9:61477] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 21"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTho4qJmC8ih_lQQnDc_wAAAME"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:28.825197 2026] [:error] [pid 21575:tid 21580] [client 161.35.219.9:60994] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThpCrocdArcJqFfIl7XwAAAUE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:29.639131 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:62168] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThpUzkQFuA2qBk8UNAtAAAAZc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:29.639234 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:62168] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 24"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThpUzkQFuA2qBk8UNAtAAAAZc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:30.641457 2026] [:error] [pid 28794:tid 28854] [client 161.35.219.9:62828] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaThpqVy2qpaelbUob1eDwAAAFI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:31.677017 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:63051] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThp0zkQFuA2qBk8UNAvAAAAZI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:32.685301 2026] [:error] [pid 28795:tid 28878] [client 161.35.219.9:63275] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThqLROd53wZBkdI_eLxAAAAI8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:33.717238 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:63498] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaThqUzkQFuA2qBk8UNAwwAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:34.735473 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:63801] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThqkzkQFuA2qBk8UNAygAAAYs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:34.735534 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:63801] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThqkzkQFuA2qBk8UNAygAAAYs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:35.750012 2026] [:error] [pid 28793:tid 28823] [client 161.35.219.9:64036] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaThqw2_fxBANaHo1f5D4QAAABA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:36.764012 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:64308] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThrEzkQFuA2qBk8UNA1gAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:37.822578 2026] [:error] [pid 21575:tid 21596] [client 161.35.219.9:64564] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThrSrocdArcJqFfIl7cAAAAVE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:38.850619 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:64795] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaThrkzkQFuA2qBk8UNA4wAAAZA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:39.878794 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:65038] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThr0zkQFuA2qBk8UNA6gAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:42.617832 2026] [:error] [pid 21575:tid 21598] [client 161.35.219.9:49319] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThsirocdArcJqFfIl7eAAAAVM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:43.466028 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:65038] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThs0zkQFuA2qBk8UNA-gAAAZc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:44.282727 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:65038] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaThtEzkQFuA2qBk8UNBAgAAAYQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:45.315548 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:50055] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThtf-JFLfishX45N_fTAAAAQg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:46.350600 2026] [:error] [pid 28793:tid 28831] [client 161.35.219.9:50335] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThtg2_fxBANaHo1f5D7gAAABg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:47.380316 2026] [:error] [pid 23872:tid 23894] [client 161.35.219.9:50623] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTht0zkQFuA2qBk8UNBFwAAAZM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:48.394649 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:50876] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThuEzkQFuA2qBk8UNBIQAAAZE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:48.394747 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:50876] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThuEzkQFuA2qBk8UNBIQAAAZE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:51.029695 2026] [:error] [pid 28795:tid 28871] [client 161.35.219.9:51492] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThu7ROd53wZBkdI_eL4wAAAIg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:51.812210 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:51111] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThu_-JFLfishX45N_fXwAAAQU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:52.605199 2026] [:error] [pid 31257:tid 31272] [client 161.35.219.9:51111] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaThvP-JFLfishX45N_fYQAAAQk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:53.645769 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:52141] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThvUzkQFuA2qBk8UNBOQAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:54.680274 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:52427] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThvv-JFLfishX45N_fZQAAAQc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:55.713839 2026] [:error] [pid 28794:tid 28856] [client 161.35.219.9:52667] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaThv6Vy2qpaelbUob1eHgAAAFQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:56.741008 2026] [:error] [pid 28908:tid 28910] [client 161.35.219.9:52921] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThwIqJmC8ih_lQQnDdHgAAAMA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:56.741136 2026] [:error] [pid 28908:tid 28910] [client 161.35.219.9:52921] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThwIqJmC8ih_lQQnDdHgAAAMA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:02:59.376708 2026] [:error] [pid 23872:tid 23894] [client 161.35.219.9:53550] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThw0zkQFuA2qBk8UNBZAAAAZM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:00.311913 2026] [:error] [pid 28795:tid 28868] [client 161.35.219.9:53205] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThxLROd53wZBkdI_eL6gAAAIU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:00.312023 2026] [:error] [pid 28795:tid 28868] [client 161.35.219.9:53205] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 22"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThxLROd53wZBkdI_eL6gAAAIU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:02.213475 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:53550] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThxkzkQFuA2qBk8UNBhQAAAZA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:03.008442 2026] [:error] [pid 28908:tid 28924] [client 161.35.219.9:53968] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThx4qJmC8ih_lQQnDdKAAAAM4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:03.008526 2026] [:error] [pid 28908:tid 28924] [client 161.35.219.9:53968] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThx4qJmC8ih_lQQnDdKAAAAM4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:04.053728 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:54615] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaThyP-JFLfishX45N_fjAAAARQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:05.073782 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:54868] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThyUzkQFuA2qBk8UNBrgAAAZA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:06.104204 2026] [:error] [pid 28794:tid 28851] [client 161.35.219.9:55090] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaThyqVy2qpaelbUob1eJgAAAE8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:07.110782 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:55373] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaThy_-JFLfishX45N_flQAAARM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:08.117325 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:55609] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThzEzkQFuA2qBk8UNBvAAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:11.139011 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:56177] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThz0zkQFuA2qBk8UNB0QAAAY0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:11.139105 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:56177] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaThz0zkQFuA2qBk8UNB0QAAAY0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:11.385557 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:55609] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaThz0zkQFuA2qBk8UNB0wAAAZg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:12.413552 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:56504] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTh0P-JFLfishX45N_fqQAAAQs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:13.430409 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:56721] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTh0UzkQFuA2qBk8UNB4AAAAZA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:14.444031 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:57022] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh0kzkQFuA2qBk8UNB6AAAAYI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:16.917165 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:57626] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh1P-JFLfishX45N_ftAAAAQ4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:17.751358 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:57022] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh1UzkQFuA2qBk8UNB_wAAAZE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:21.138863 2026] [:error] [pid 31257:tid 31269] [client 161.35.219.9:57626] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh2f-JFLfishX45N_fwwAAAQY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:22.102053 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:57022] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh2kzkQFuA2qBk8UNCKgAAAZc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:24.653695 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:57626] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh3P-JFLfishX45N_fzgAAAQI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:25.450111 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:57022] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh3UzkQFuA2qBk8UNCLwAAAY8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:27.144760 2026] [:error] [pid 31257:tid 31263] [client 161.35.219.9:57626] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh3_-JFLfishX45N_f1gAAAQA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:27.999471 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:57022] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh30zkQFuA2qBk8UNCNwAAAYI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:28.886908 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:57022] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTh4EzkQFuA2qBk8UNCOQAAAYM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:29.894134 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:60789] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTh4UzkQFuA2qBk8UNCPwAAAYQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:30.947850 2026] [:error] [pid 23872:tid 23876] [client 161.35.219.9:61003] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTh4kzkQFuA2qBk8UNCQwAAAYE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:31.963787 2026] [:error] [pid 28795:tid 28881] [client 161.35.219.9:61284] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTh47ROd53wZBkdI_eMEgAAAJI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:32.966754 2026] [:error] [pid 21575:tid 21593] [client 161.35.219.9:61518] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh5CrocdArcJqFfIl74AAAAU4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:33.790915 2026] [:error] [pid 21575:tid 21592] [client 161.35.219.9:61518] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTh5SrocdArcJqFfIl74wAAAU0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:34.796339 2026] [:error] [pid 28908:tid 28911] [client 161.35.219.9:61985] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTh5oqJmC8ih_lQQnDdRQAAAME"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:35.818639 2026] [:error] [pid 23872:tid 23876] [client 161.35.219.9:62266] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTh50zkQFuA2qBk8UNCYgAAAYE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:37.650325 2026] [:error] [pid 23872:tid 23885] [client 161.35.219.9:62547] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTh6UzkQFuA2qBk8UNCcgAAAYo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:38.661710 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:62896] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh6irocdArcJqFfIl75wAAAUo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:38.661787 2026] [:error] [pid 21575:tid 21589] [client 161.35.219.9:62896] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh6irocdArcJqFfIl75wAAAUo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:41.387097 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:63465] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh7UzkQFuA2qBk8UNChwAAAYs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:42.195901 2026] [:error] [pid 21575:tid 21593] [client 161.35.219.9:63095] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh7irocdArcJqFfIl78AAAAU4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:42.195997 2026] [:error] [pid 21575:tid 21593] [client 161.35.219.9:63095] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh7irocdArcJqFfIl78AAAAU4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:43.208537 2026] [:error] [pid 28908:tid 28911] [client 161.35.219.9:63865] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTh74qJmC8ih_lQQnDdVAAAAME"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:44.223864 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:64115] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTh8EzkQFuA2qBk8UNCqAAAAYI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:45.226776 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:64344] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTh8UzkQFuA2qBk8UNCsgAAAZc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:46.256813 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:64566] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTh8kzkQFuA2qBk8UNCvwAAAZY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:47.259289 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:64796] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh8yrocdArcJqFfIl78QAAAUU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:48.291415 2026] [:error] [pid 21575:tid 21600] [client 161.35.219.9:64796] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTh9CrocdArcJqFfIl78gAAAVU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:49.298279 2026] [:error] [pid 21575:tid 21582] [client 161.35.219.9:65162] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTh9SrocdArcJqFfIl79AAAAUM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:50.295928 2026] [:error] [pid 28908:tid 28916] [client 161.35.219.9:65395] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTh9oqJmC8ih_lQQnDdWgAAAMY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:51.336168 2026] [:error] [pid 21575:tid 21586] [client 161.35.219.9:49216] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTh9yrocdArcJqFfIl79gAAAUc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:53.401469 2026] [:error] [pid 28793:tid 28808] [client 161.35.219.9:49508] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh-Q2_fxBANaHo1f5EIAAAAAE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:53.401547 2026] [:error] [pid 28793:tid 28808] [client 161.35.219.9:49508] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh-Q2_fxBANaHo1f5EIAAAAAE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:56.050293 2026] [:error] [pid 28908:tid 28923] [client 161.35.219.9:50359] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh_IqJmC8ih_lQQnDdYAAAAM0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:56.920691 2026] [:error] [pid 28795:tid 28880] [client 161.35.219.9:49932] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh_LROd53wZBkdI_eMLAAAAJE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:56.920814 2026] [:error] [pid 28795:tid 28880] [client 161.35.219.9:49932] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh_LROd53wZBkdI_eMLAAAAJE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:58.795828 2026] [:error] [pid 28908:tid 28916] [client 161.35.219.9:50359] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh_oqJmC8ih_lQQnDdZQAAAMY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:59.670992 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:50827] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh__-JFLfishX45N_gKAAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:03:59.671099 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:50827] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 15"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTh__-JFLfishX45N_gKAAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:01.774699 2026] [:error] [pid 28908:tid 28914] [client 161.35.219.9:50359] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiAYqJmC8ih_lQQnDdbAAAAMQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:02.698837 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:51431] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiAkzkQFuA2qBk8UNDbQAAAZU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:02.698970 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:51431] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiAkzkQFuA2qBk8UNDbQAAAZU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:03.716572 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:52094] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTiA0zkQFuA2qBk8UNDcgAAAYQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:04.878134 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:52356] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTiBEzkQFuA2qBk8UNDdwAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:05.870641 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:52573] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTiBSrocdArcJqFfIl8DgAAAUw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:08.677894 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:53192] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiCEzkQFuA2qBk8UNDgwAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:09.506571 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:53192] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTiCUzkQFuA2qBk8UNDhQAAAYU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:10.531863 2026] [:error] [pid 28795:tid 28880] [client 161.35.219.9:53598] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTiCrROd53wZBkdI_eMQQAAAJE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:13.354937 2026] [:error] [pid 28908:tid 28926] [client 161.35.219.9:54161] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTiDYqJmC8ih_lQQnDddwAAANA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:14.368240 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:54426] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiDv-JFLfishX45N_gWgAAARU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:16.823875 2026] [:error] [pid 28908:tid 28913] [client 161.35.219.9:54996] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiEIqJmC8ih_lQQnDdfgAAAMM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:17.649660 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:54426] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiEf-JFLfishX45N_gZgAAARY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:19.369466 2026] [:error] [pid 28908:tid 28926] [client 161.35.219.9:54996] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiE4qJmC8ih_lQQnDdggAAANA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:20.282657 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:54426] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiFP-JFLfishX45N_gbQAAAQ8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:20.282738 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:54426] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiFP-JFLfishX45N_gbQAAAQ8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:22.157633 2026] [:error] [pid 28908:tid 28918] [client 161.35.219.9:54996] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiFoqJmC8ih_lQQnDdhAAAAMg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:22.974936 2026] [:error] [pid 28793:tid 28807] [client 161.35.219.9:56042] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiFg2_fxBANaHo1f5EUAAAAAA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:23.776337 2026] [:error] [pid 28793:tid 28828] [client 161.35.219.9:56042] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTiFw2_fxBANaHo1f5EUwAAABU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:24.787750 2026] [:error] [pid 31257:tid 31273] [client 161.35.219.9:56958] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTiGP-JFLfishX45N_geQAAAQo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:25.807386 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:57216] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTiGUzkQFuA2qBk8UNDwQAAAY8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:26.838809 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:57463] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTiGkzkQFuA2qBk8UNDxwAAAZA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:27.853185 2026] [:error] [pid 31257:tid 31269] [client 161.35.219.9:57703] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiG_-JFLfishX45N_ghwAAAQY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:30.573564 2026] [:error] [pid 28908:tid 28931] [client 161.35.219.9:58400] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiHoqJmC8ih_lQQnDdkgAAANU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:31.386417 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:57703] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiH_-JFLfishX45N_gpgAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:31.386496 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:57703] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiH_-JFLfishX45N_gpgAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:32.418185 2026] [:error] [pid 28793:tid 28823] [client 161.35.219.9:58776] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTiIA2_fxBANaHo1f5EYQAAABA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:33.426864 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:59045] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTiIUzkQFuA2qBk8UND4wAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:34.434325 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:59307] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTiIkzkQFuA2qBk8UND7QAAAZU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:35.457667 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:59550] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiI0zkQFuA2qBk8UND-gAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:37.939492 2026] [:error] [pid 28794:tid 28851] [client 161.35.219.9:60082] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiJaVy2qpaelbUob1efgAAAE8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:38.763990 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:59550] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiJkzkQFuA2qBk8UNEAAAAAZE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:39.531855 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:59550] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTiJ0zkQFuA2qBk8UNEBgAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:40.552281 2026] [:error] [pid 28795:tid 28885] [client 161.35.219.9:60680] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTiKLROd53wZBkdI_eMowAAAJY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:41.539335 2026] [:error] [pid 28795:tid 28863] [client 161.35.219.9:60899] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTiKbROd53wZBkdI_eMsAAAAIA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:43.134571 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:61162] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTiK0zkQFuA2qBk8UNEGAAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:44.142660 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:61416] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiLP-JFLfishX45N_gzQAAAQQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:46.554454 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:62025] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiLkzkQFuA2qBk8UNENQAAAY8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:47.353625 2026] [:error] [pid 31257:tid 31269] [client 161.35.219.9:61416] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiL_-JFLfishX45N_g3QAAAQY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:49.043649 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:62025] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiMUzkQFuA2qBk8UNETAAAAZI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:49.815814 2026] [:error] [pid 31257:tid 31273] [client 161.35.219.9:61416] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiMf-JFLfishX45N_g7gAAAQo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:51.419947 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:62025] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiM0zkQFuA2qBk8UNEYQAAAYQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:52.202443 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:61416] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiNP-JFLfishX45N_g9QAAAQs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:53.022289 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:61416] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTiNf-JFLfishX45N_g9wAAAQ0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:54.042646 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:63800] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTiNkzkQFuA2qBk8UNEfQAAAZA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:55.172888 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:64107] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTiN0zkQFuA2qBk8UNElQAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:56.198835 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:64360] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTiOP-JFLfishX45N_hAQAAAQc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:57.235773 2026] [:error] [pid 31257:tid 31275] [client 161.35.219.9:64631] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiOf-JFLfishX45N_hEQAAAQw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:04:59.885680 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:65253] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiO_-JFLfishX45N_hIAAAAQU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:00.820501 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:64631] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiPP-JFLfishX45N_hJgAAAQg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:01.750597 2026] [:error] [pid 31257:tid 31275] [client 161.35.219.9:64631] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTiPf-JFLfishX45N_hMAAAAQw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:02.772032 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:49583] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTiPkzkQFuA2qBk8UNE1QAAAZU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:03.799324 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:49832] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTiP0zkQFuA2qBk8UNE2gAAAYM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:04.825787 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:50091] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTiQEzkQFuA2qBk8UNE5gAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:05.822052 2026] [:error] [pid 28793:tid 28807] [client 161.35.219.9:50341] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiQQ2_fxBANaHo1f5EpgAAAAA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:05.822162 2026] [:error] [pid 28793:tid 28807] [client 161.35.219.9:50341] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiQQ2_fxBANaHo1f5EpgAAAAA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:06.821989 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:50577] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTiQkzkQFuA2qBk8UNE9QAAAYU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:07.834900 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:50842] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTiQ0zkQFuA2qBk8UNE_QAAAZc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:08.856072 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:51081] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTiREzkQFuA2qBk8UNFCgAAAYU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:09.854958 2026] [:error] [pid 21575:tid 21580] [client 161.35.219.9:51321] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTiRSrocdArcJqFfIl8vwAAAUE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:10.861273 2026] [:error] [pid 28794:tid 28839] [client 161.35.219.9:51530] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiRqVy2qpaelbUob1etAAAAEM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:13.603057 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:52190] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiSSrocdArcJqFfIl8zQAAAVA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:14.419898 2026] [:error] [pid 28794:tid 28856] [client 161.35.219.9:51530] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiSqVy2qpaelbUob1evAAAAFQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:14.419996 2026] [:error] [pid 28794:tid 28856] [client 161.35.219.9:51530] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiSqVy2qpaelbUob1evAAAAFQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:16.238714 2026] [:error] [pid 21575:tid 21586] [client 161.35.219.9:52190] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiTCrocdArcJqFfIl80QAAAUc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:17.118234 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:52592] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiTUzkQFuA2qBk8UNFVQAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:18.797422 2026] [:error] [pid 21575:tid 21587] [client 161.35.219.9:52190] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiTirocdArcJqFfIl82gAAAUg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:19.597019 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:52592] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiT0zkQFuA2qBk8UNFXAAAAYY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:21.323724 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:52190] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiUSrocdArcJqFfIl84AAAAVI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:22.150971 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:52592] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiUkzkQFuA2qBk8UNFZwAAAYs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:22.151045 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:52592] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 25"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiUkzkQFuA2qBk8UNFZwAAAYs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:24.028919 2026] [:error] [pid 21575:tid 21581] [client 161.35.219.9:52190] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiVCrocdArcJqFfIl85gAAAUI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:24.886251 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:54490] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiVEzkQFuA2qBk8UNFeQAAAYI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:26.621709 2026] [:error] [pid 21575:tid 21587] [client 161.35.219.9:52190] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiVirocdArcJqFfIl86gAAAUg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:27.483679 2026] [:error] [pid 23872:tid 23894] [client 161.35.219.9:54490] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiV0zkQFuA2qBk8UNFiwAAAZM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:28.296904 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:54490] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTiWEzkQFuA2qBk8UNFjwAAAYQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:29.307105 2026] [:error] [pid 21575:tid 21596] [client 161.35.219.9:56109] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTiWSrocdArcJqFfIl88gAAAVE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:30.313057 2026] [:error] [pid 28908:tid 28914] [client 161.35.219.9:56377] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTiWoqJmC8ih_lQQnDd7QAAAMQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:31.340010 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:56661] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTiW_-JFLfishX45N_hzwAAARQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:33.387430 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:56909] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiXUzkQFuA2qBk8UNFqQAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:35.157338 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:56909] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTiX0zkQFuA2qBk8UNFrQAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:37.348610 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:57800] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTiYUzkQFuA2qBk8UNFwQAAAZE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:38.370946 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:58292] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTiYkzkQFuA2qBk8UNFxgAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:39.376483 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:58532] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTiYyrocdArcJqFfIl9CgAAAVg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:40.374573 2026] [:error] [pid 21575:tid 21588] [client 161.35.219.9:58789] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiZCrocdArcJqFfIl9DgAAAUk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:42.779529 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:59333] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiZkzkQFuA2qBk8UNF1gAAAZg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:43.606567 2026] [:error] [pid 21575:tid 21587] [client 161.35.219.9:58789] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiZyrocdArcJqFfIl9HgAAAUg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:45.219344 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:59333] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiaUzkQFuA2qBk8UNF5QAAAYY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:46.045310 2026] [:error] [pid 21575:tid 21590] [client 161.35.219.9:58789] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiairocdArcJqFfIl9LAAAAUs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:47.648138 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:59333] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTia0zkQFuA2qBk8UNF8QAAAZc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:48.509726 2026] [:error] [pid 21575:tid 21580] [client 161.35.219.9:58789] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTibCrocdArcJqFfIl9NgAAAUE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:50.126914 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:59333] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTibkzkQFuA2qBk8UNF_AAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:50.956243 2026] [:error] [pid 21575:tid 21590] [client 161.35.219.9:58789] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTibirocdArcJqFfIl9RQAAAUs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:52.589886 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:59333] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTicEzkQFuA2qBk8UNGGgAAAZA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:53.362273 2026] [:error] [pid 21575:tid 21582] [client 161.35.219.9:58789] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTicSrocdArcJqFfIl9eAAAAUM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:55.012460 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:59333] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTic0zkQFuA2qBk8UNGJAAAAYI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:55.012523 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:59333] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTic0zkQFuA2qBk8UNGJAAAAYI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:55.259203 2026] [:error] [pid 21575:tid 21601] [client 161.35.219.9:58789] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTicyrocdArcJqFfIl9fgAAAVY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:56.274278 2026] [:error] [pid 23872:tid 23898] [client 161.35.219.9:62653] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTidEzkQFuA2qBk8UNGKgAAAZc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:57.298193 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:62891] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTidUzkQFuA2qBk8UNGLgAAAYI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:58.335569 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:63144] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTidkzkQFuA2qBk8UNGNQAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:05:59.124940 2026] [:error] [pid 23872:tid 23894] [client 161.35.219.9:63144] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 21"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTid0zkQFuA2qBk8UNGPAAAAZM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:00.151311 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:63586] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 21"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTieCrocdArcJqFfIl9igAAAVc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:01.205823 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:63806] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 21"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTief-JFLfishX45N_iHwAAARM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:02.226551 2026] [:error] [pid 28795:tid 28876] [client 161.35.219.9:64094] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 21"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTierROd53wZBkdI_eNzwAAAI0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:03.261704 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:64343] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTie_-JFLfishX45N_iJAAAAQU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:05.770122 2026] [:error] [pid 28793:tid 28808] [client 161.35.219.9:64947] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTifQ2_fxBANaHo1f5EwwAAAAE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:06.622212 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:64343] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTifv-JFLfishX45N_iNQAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:06.622291 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:64343] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTifv-JFLfishX45N_iNQAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:08.558260 2026] [:error] [pid 28793:tid 28816] [client 161.35.219.9:64947] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTigA2_fxBANaHo1f5ExAAAAAk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:09.409603 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:65402] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTigf-JFLfishX45N_iQQAAAQc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:11.233549 2026] [:error] [pid 28793:tid 28817] [client 161.35.219.9:64947] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTigw2_fxBANaHo1f5ExgAAAAo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:12.056638 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:65402] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTihP-JFLfishX45N_iRwAAARM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:12.886241 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:65402] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 22"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTihP-JFLfishX45N_iSgAAAQM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:13.896823 2026] [:error] [pid 28908:tid 28919] [client 161.35.219.9:50470] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 22"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTihYqJmC8ih_lQQnDeQAAAAMk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:14.953293 2026] [:error] [pid 28795:tid 28882] [client 161.35.219.9:50751] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 22"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTihrROd53wZBkdI_eN6AAAAJM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:15.976344 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:51002] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 22"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTih0zkQFuA2qBk8UNG9AAAAZI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:16.983003 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:51219] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiiEzkQFuA2qBk8UNG-wAAAYM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:19.413026 2026] [:error] [pid 28793:tid 28831] [client 161.35.219.9:51730] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiiw2_fxBANaHo1f5EyQAAABg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:20.320075 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:51219] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTijEzkQFuA2qBk8UNHFwAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:21.135441 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:51219] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTijUzkQFuA2qBk8UNHHAAAAZA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:22.148855 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:52373] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTijkzkQFuA2qBk8UNHKQAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:23.156731 2026] [:error] [pid 28908:tid 28929] [client 161.35.219.9:52614] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTij4qJmC8ih_lQQnDeXAAAANM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:24.190793 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:52885] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 16"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTikEzkQFuA2qBk8UNHQwAAAYw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:25.205531 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:53164] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTikf-JFLfishX45N_iagAAARQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:26.070323 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:53164] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTikv-JFLfishX45N_ibwAAAQ0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:27.089563 2026] [:error] [pid 28793:tid 28828] [client 161.35.219.9:53585] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTikw2_fxBANaHo1f5EzwAAABU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:28.090533 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:53812] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTilP-JFLfishX45N_idwAAAQQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:29.108470 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:54049] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTilUzkQFuA2qBk8UNHcgAAAYQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:30.116726 2026] [:error] [pid 28908:tid 28918] [client 161.35.219.9:54285] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiloqJmC8ih_lQQnDeYQAAAMg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:32.527077 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:54834] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTimP-JFLfishX45N_iiwAAAQU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:33.315178 2026] [:error] [pid 28908:tid 28917] [client 161.35.219.9:54285] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTimYqJmC8ih_lQQnDeZAAAAMc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:34.977505 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:54834] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTimv-JFLfishX45N_ipQAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:35.813766 2026] [:error] [pid 28908:tid 28929] [client 161.35.219.9:54285] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTim4qJmC8ih_lQQnDeagAAANM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:36.705898 2026] [:error] [pid 28908:tid 28910] [client 161.35.219.9:54285] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTinIqJmC8ih_lQQnDeawAAAMA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:37.696648 2026] [:error] [pid 28908:tid 28915] [client 161.35.219.9:56156] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTinYqJmC8ih_lQQnDebQAAAMU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:38.714629 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:56410] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTinkzkQFuA2qBk8UNHrwAAAZI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:39.726353 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:56648] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTin0zkQFuA2qBk8UNHtQAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:40.725660 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:56898] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTioP-JFLfishX45N_i0AAAAQI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:43.153427 2026] [:error] [pid 28794:tid 28853] [client 161.35.219.9:57432] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTio6Vy2qpaelbUob1fRwAAAFE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:43.957442 2026] [:error] [pid 31257:tid 31269] [client 161.35.219.9:56898] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTio_-JFLfishX45N_i6QAAAQY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:45.569923 2026] [:error] [pid 28794:tid 28857] [client 161.35.219.9:57432] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTipaVy2qpaelbUob1fSwAAAFU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:46.367983 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:56898] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTipv-JFLfishX45N_jAAAAAQU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:47.187883 2026] [:error] [pid 31257:tid 31275] [client 161.35.219.9:56898] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTip_-JFLfishX45N_jBAAAAQw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:48.213668 2026] [:error] [pid 21575:tid 21583] [client 161.35.219.9:58689] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTiqCrocdArcJqFfIl98wAAAUQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:49.241107 2026] [:error] [pid 31257:tid 31280] [client 161.35.219.9:58987] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTiqf-JFLfishX45N_jEwAAARE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:50.246916 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:59255] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTiqirocdArcJqFfIl9-AAAAVI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:51.295257 2026] [:error] [pid 28793:tid 28820] [client 161.35.219.9:59511] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiqw2_fxBANaHo1f5E1QAAAA0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:53.818740 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:60217] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTirUzkQFuA2qBk8UNH9AAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:54.657207 2026] [:error] [pid 28793:tid 28812] [client 161.35.219.9:59511] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTirg2_fxBANaHo1f5E1wAAAAU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:55.417736 2026] [:error] [pid 28793:tid 28813] [client 161.35.219.9:59511] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 22"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTirw2_fxBANaHo1f5E2AAAAAY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:56.429661 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:60952] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 22"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTisEzkQFuA2qBk8UNIAQAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:57.461162 2026] [:error] [pid 28908:tid 28919] [client 161.35.219.9:61229] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 22"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTisYqJmC8ih_lQQnDefwAAAMk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:58.475281 2026] [:error] [pid 31257:tid 31264] [client 161.35.219.9:61546] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 22"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTisv-JFLfishX45N_jXAAAAQE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:06:59.481070 2026] [:error] [pid 31257:tid 31286] [client 161.35.219.9:61842] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTis_-JFLfishX45N_jYAAAARc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:02.066759 2026] [:error] [pid 28908:tid 28934] [client 161.35.219.9:62497] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTitoqJmC8ih_lQQnDelAAAANg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:02.949461 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:61842] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTitv-JFLfishX45N_jZwAAARU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:04.829324 2026] [:error] [pid 28908:tid 28911] [client 161.35.219.9:62497] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiuIqJmC8ih_lQQnDepQAAAME"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:06.018838 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:61842] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiuv-JFLfishX45N_jewAAAQU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:07.933733 2026] [:error] [pid 28908:tid 28918] [client 161.35.219.9:62497] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiu4qJmC8ih_lQQnDetwAAAMg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:08.741938 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:61842] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTivP-JFLfishX45N_jmgAAAQQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:10.408447 2026] [:error] [pid 28908:tid 28917] [client 161.35.219.9:62497] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTivoqJmC8ih_lQQnDewAAAAMc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:11.229182 2026] [:error] [pid 31257:tid 31285] [client 161.35.219.9:61842] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiv_-JFLfishX45N_jqAAAARY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:12.060942 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:61842] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTiwP-JFLfishX45N_jrgAAAQU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:13.075956 2026] [:error] [pid 31257:tid 31287] [client 161.35.219.9:65388] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTiwf-JFLfishX45N_jswAAARg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:14.141975 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:49321] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTiwkzkQFuA2qBk8UNIZgAAAZA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:15.142658 2026] [:error] [pid 31257:tid 31274] [client 161.35.219.9:49614] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTiw_-JFLfishX45N_jvAAAAQs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:16.152096 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:49874] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTixP-JFLfishX45N_jwwAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:16.152161 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:49874] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTixP-JFLfishX45N_jwwAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:17.163039 2026] [:error] [pid 31257:tid 31264] [client 161.35.219.9:50126] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTixf-JFLfishX45N_jyQAAAQE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:18.282571 2026] [:error] [pid 31257:tid 31287] [client 161.35.219.9:50419] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTixv-JFLfishX45N_j0AAAARg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:19.277926 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:50687] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTix0zkQFuA2qBk8UNIhQAAAZg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:20.293156 2026] [:error] [pid 21575:tid 21581] [client 161.35.219.9:50960] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTiyCrocdArcJqFfIl-PQAAAUI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:21.328026 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:51239] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiyf-JFLfishX45N_j5gAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:21.328076 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:51239] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTiyf-JFLfishX45N_j5gAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:24.014528 2026] [:error] [pid 21575:tid 21580] [client 161.35.219.9:52008] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTizCrocdArcJqFfIl-SQAAAUE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:24.822477 2026] [:error] [pid 21575:tid 21598] [client 161.35.219.9:51523] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTizCrocdArcJqFfIl-UgAAAVM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:26.550207 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:52008] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTizirocdArcJqFfIl-YAAAAVg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:27.367502 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:51523] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTizyrocdArcJqFfIl-aQAAAVA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:27.367576 2026] [:error] [pid 21575:tid 21595] [client 161.35.219.9:51523] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTizyrocdArcJqFfIl-aQAAAVA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:29.247555 2026] [:error] [pid 21575:tid 21588] [client 161.35.219.9:52008] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTi0SrocdArcJqFfIl-dQAAAUk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:30.044239 2026] [:error] [pid 31257:tid 31287] [client 161.35.219.9:53210] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTi0v-JFLfishX45N_kNgAAARg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:30.044356 2026] [:error] [pid 31257:tid 31287] [client 161.35.219.9:53210] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTi0v-JFLfishX45N_kNgAAARg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:33.715671 2026] [:error] [pid 21575:tid 21600] [client 161.35.219.9:52008] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTi1SrocdArcJqFfIl-mAAAAVU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:34.574032 2026] [:error] [pid 28908:tid 28929] [client 161.35.219.9:54338] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTi1oqJmC8ih_lQQnDfGgAAANM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:36.272690 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:52008] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTi2CrocdArcJqFfIl-qQAAAVc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:37.433729 2026] [:error] [pid 28908:tid 28928] [client 161.35.219.9:54338] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTi2YqJmC8ih_lQQnDfHwAAANI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:38.286830 2026] [:error] [pid 28908:tid 28925] [client 161.35.219.9:54338] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTi2oqJmC8ih_lQQnDfIAAAAM8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:39.332788 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:56023] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTi2_-JFLfishX45N_kVwAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:40.325295 2026] [:error] [pid 28794:tid 28852] [client 161.35.219.9:56298] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTi3KVy2qpaelbUob1fcgAAAFA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:41.328177 2026] [:error] [pid 28795:tid 28874] [client 161.35.219.9:56591] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 17"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTi3bROd53wZBkdI_eOIAAAAIs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:44.164901 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:57302] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTi4EzkQFuA2qBk8UNI-wAAAZg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:46.633506 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:57935] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTi4irocdArcJqFfIl-6gAAAVg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:47.459531 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:57302] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTi40zkQFuA2qBk8UNJGwAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:48.317310 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:57302] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTi5EzkQFuA2qBk8UNJJAAAAYU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:49.352456 2026] [:error] [pid 28794:tid 28850] [client 161.35.219.9:58569] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTi5aVy2qpaelbUob1fdgAAAE4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:50.348695 2026] [:error] [pid 28795:tid 28867] [client 161.35.219.9:58788] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTi5rROd53wZBkdI_eOKAAAAIQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:51.373984 2026] [:error] [pid 21575:tid 21603] [client 161.35.219.9:58999] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTi5yrocdArcJqFfIl_AwAAAVg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:52.386900 2026] [:error] [pid 28795:tid 28865] [client 161.35.219.9:59226] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTi6LROd53wZBkdI_eOKgAAAII"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:53.239318 2026] [:error] [pid 28795:tid 28868] [client 161.35.219.9:59226] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTi6bROd53wZBkdI_eOLQAAAIU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:54.288174 2026] [:error] [pid 28908:tid 28920] [client 161.35.219.9:59694] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTi6oqJmC8ih_lQQnDfJwAAAMo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:55.311821 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:59968] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTi60zkQFuA2qBk8UNJaQAAAYM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:07:59.636063 2026] [:error] [pid 28908:tid 28932] [client 161.35.219.9:60194] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTi74qJmC8ih_lQQnDfMAAAANY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:00.636208 2026] [:error] [pid 28793:tid 28824] [client 161.35.219.9:60895] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTi8A2_fxBANaHo1f5FAgAAABE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:03.402591 2026] [:error] [pid 28794:tid 28852] [client 161.35.219.9:61499] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTi86Vy2qpaelbUob1ffwAAAFA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:04.262546 2026] [:error] [pid 28793:tid 28827] [client 161.35.219.9:60895] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTi9A2_fxBANaHo1f5FCQAAABQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:04.262653 2026] [:error] [pid 28793:tid 28827] [client 161.35.219.9:60895] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTi9A2_fxBANaHo1f5FCQAAABQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:06.155489 2026] [:error] [pid 28794:tid 28840] [client 161.35.219.9:61499] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTi9qVy2qpaelbUob1fgwAAAEQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:07.017112 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:61955] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTi90zkQFuA2qBk8UNJ6AAAAZY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:07.017180 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:61955] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTi90zkQFuA2qBk8UNJ6AAAAZY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:08.054716 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:62596] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTi-P-JFLfishX45N_k4wAAAQg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:09.078052 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:62810] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTi-f-JFLfishX45N_k6wAAAQ4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:10.099990 2026] [:error] [pid 23872:tid 23894] [client 161.35.219.9:63031] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTi-kzkQFuA2qBk8UNKDQAAAZM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:11.100635 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:63281] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTi-yrocdArcJqFfIl_WQAAAVI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:12.115782 2026] [:error] [pid 23872:tid 23882] [client 161.35.219.9:63514] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTi_EzkQFuA2qBk8UNKIgAAAYc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:14.835760 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:64106] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTi_v-JFLfishX45N_lBgAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:15.780630 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:63514] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTi_0zkQFuA2qBk8UNKYwAAAYM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:16.699843 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:63514] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 25"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTjAEzkQFuA2qBk8UNKdQAAAYs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:17.712282 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:64769] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 25"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTjAUzkQFuA2qBk8UNKiAAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:18.724809 2026] [:error] [pid 28793:tid 28812] [client 161.35.219.9:64976] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 25"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTjAg2_fxBANaHo1f5FDwAAAAU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:19.761753 2026] [:error] [pid 21575:tid 21590] [client 161.35.219.9:65239] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 25"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTjAyrocdArcJqFfIl_bwAAAUs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:20.820187 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:65500] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjBEzkQFuA2qBk8UNKpQAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:23.303897 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:49639] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjB0zkQFuA2qBk8UNKygAAAY8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:23.303988 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:49639] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjB0zkQFuA2qBk8UNKygAAAY8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:23.555471 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:65500] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTjB0zkQFuA2qBk8UNK0AAAAYs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:24.582742 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:49958] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTjCEzkQFuA2qBk8UNK4wAAAYU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:25.587782 2026] [:error] [pid 28908:tid 28928] [client 161.35.219.9:50218] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTjCYqJmC8ih_lQQnDfXgAAANI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:26.599910 2026] [:error] [pid 21575:tid 21580] [client 161.35.219.9:50422] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjCirocdArcJqFfIl_eQAAAUE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:27.405974 2026] [:error] [pid 21575:tid 21579] [client 161.35.219.9:50422] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTjCyrocdArcJqFfIl_egAAAUA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:28.432714 2026] [:error] [pid 28793:tid 28807] [client 161.35.219.9:50855] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTjDA2_fxBANaHo1f5FFAAAAAA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:29.436522 2026] [:error] [pid 23872:tid 23891] [client 161.35.219.9:51089] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTjDUzkQFuA2qBk8UNLKwAAAZA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:30.464680 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:51328] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTjDv-JFLfishX45N_legAAAQQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:31.495015 2026] [:error] [pid 28908:tid 28919] [client 161.35.219.9:51566] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjD4qJmC8ih_lQQnDfXwAAAMk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:31.495099 2026] [:error] [pid 28908:tid 28919] [client 161.35.219.9:51566] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 26"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjD4qJmC8ih_lQQnDfXwAAAMk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:32.529178 2026] [:error] [pid 21575:tid 21602] [client 161.35.219.9:51812] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTjECrocdArcJqFfIl_gwAAAVc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:33.525015 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:52055] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTjEUzkQFuA2qBk8UNLYAAAAYM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:34.542801 2026] [:error] [pid 28908:tid 28920] [client 161.35.219.9:52275] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTjEoqJmC8ih_lQQnDfZQAAAMo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:35.552888 2026] [:error] [pid 23872:tid 23887] [client 161.35.219.9:52498] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTjE0zkQFuA2qBk8UNLbAAAAYw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:36.558663 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:52714] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjFEzkQFuA2qBk8UNLdAAAAYU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:39.088098 2026] [:error] [pid 21575:tid 21600] [client 161.35.219.9:53234] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjFyrocdArcJqFfIl_igAAAVU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:39.976552 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:52714] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjF0zkQFuA2qBk8UNLrwAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:39.976612 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:52714] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjF0zkQFuA2qBk8UNLrwAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:41.850209 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:53234] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjGSrocdArcJqFfIl_kAAAAVI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:42.679534 2026] [:error] [pid 31257:tid 31263] [client 161.35.219.9:53645] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjGv-JFLfishX45N_ltwAAAQA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:44.395793 2026] [:error] [pid 21575:tid 21584] [client 161.35.219.9:53234] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjHCrocdArcJqFfIl_lAAAAUU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:45.309076 2026] [:error] [pid 31257:tid 31282] [client 161.35.219.9:53645] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjHf-JFLfishX45N_lwAAAARM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:46.215634 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:53645] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTjHv-JFLfishX45N_lxQAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:47.232986 2026] [:error] [pid 28794:tid 28841] [client 161.35.219.9:54910] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTjH6Vy2qpaelbUob1fmQAAAEU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:48.268546 2026] [:error] [pid 28795:tid 28876] [client 161.35.219.9:55103] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTjILROd53wZBkdI_eOpwAAAI0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:49.326090 2026] [:error] [pid 31257:tid 31284] [client 161.35.219.9:55347] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTjIf-JFLfishX45N_lzQAAARU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:50.383151 2026] [:error] [pid 28908:tid 28923] [client 161.35.219.9:55590] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjIoqJmC8ih_lQQnDfegAAAM0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:53.068505 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:56254] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjJUzkQFuA2qBk8UNMQAAAAZE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:53.068584 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:56254] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjJUzkQFuA2qBk8UNMQAAAAZE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:53.319684 2026] [:error] [pid 28908:tid 28913] [client 161.35.219.9:55590] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTjJYqJmC8ih_lQQnDfggAAAMM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:55.925921 2026] [:error] [pid 31257:tid 31265] [client 161.35.219.9:56934] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTjJ_-JFLfishX45N_mBQAAAQI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:56.959504 2026] [:error] [pid 31257:tid 31283] [client 161.35.219.9:57141] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjKP-JFLfishX45N_mDwAAARQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:08:59.539049 2026] [:error] [pid 28794:tid 28841] [client 161.35.219.9:57653] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjK6Vy2qpaelbUob1fpAAAAEU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:00.381425 2026] [:error] [pid 31257:tid 31268] [client 161.35.219.9:57141] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjLP-JFLfishX45N_mHAAAAQU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:02.152037 2026] [:error] [pid 28794:tid 28858] [client 161.35.219.9:57653] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjLqVy2qpaelbUob1fpgAAAFY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:03.011085 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:57141] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjL_-JFLfishX45N_mHgAAAQ0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:03.011167 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:57141] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 13"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjL_-JFLfishX45N_mHgAAAQ0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:04.938314 2026] [:error] [pid 28794:tid 28840] [client 161.35.219.9:57653] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjMKVy2qpaelbUob1fpwAAAEQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:05.822591 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:58656] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjMUzkQFuA2qBk8UNMkQAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:07.504915 2026] [:error] [pid 28794:tid 28845] [client 161.35.219.9:57653] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjM6Vy2qpaelbUob1fqQAAAEk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:08.320232 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:58656] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjNEzkQFuA2qBk8UNMqQAAAZE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:09.988731 2026] [:error] [pid 28794:tid 28843] [client 161.35.219.9:57653] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjNaVy2qpaelbUob1fqgAAAEc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:10.839228 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:58656] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjNkzkQFuA2qBk8UNMzwAAAY0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:11.667688 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:58656] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTjN0zkQFuA2qBk8UNM2wAAAYY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:12.676714 2026] [:error] [pid 28794:tid 28839] [client 161.35.219.9:60725] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTjOKVy2qpaelbUob1fqwAAAEM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:13.674580 2026] [:error] [pid 23872:tid 23889] [client 161.35.219.9:60968] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTjOUzkQFuA2qBk8UNM7QAAAY4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:14.670034 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:61227] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTjOkzkQFuA2qBk8UNM-AAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:16.235156 2026] [:error] [pid 28793:tid 28809] [client 161.35.219.9:61517] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjPA2_fxBANaHo1f5FKQAAAAI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:18.799162 2026] [:error] [pid 23872:tid 23899] [client 161.35.219.9:62173] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjPkzkQFuA2qBk8UNNIgAAAZg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:19.656160 2026] [:error] [pid 28793:tid 28820] [client 161.35.219.9:61517] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjPw2_fxBANaHo1f5FKwAAAA0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:21.487952 2026] [:error] [pid 23872:tid 23893] [client 161.35.219.9:62173] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjQUzkQFuA2qBk8UNNRQAAAZI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:22.315925 2026] [:error] [pid 28793:tid 28812] [client 161.35.219.9:61517] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjQg2_fxBANaHo1f5FLgAAAAU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:22.316002 2026] [:error] [pid 28793:tid 28812] [client 161.35.219.9:61517] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjQg2_fxBANaHo1f5FLgAAAAU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:23.352444 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:63410] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTjQ0zkQFuA2qBk8UNNXQAAAYU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:25.158663 2026] [:error] [pid 28795:tid 28881] [client 161.35.219.9:63699] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTjRbROd53wZBkdI_ePCAAAAJI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:26.184406 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:64136] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTjRkzkQFuA2qBk8UNNdAAAAYI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:27.191790 2026] [:error] [pid 28794:tid 28856] [client 161.35.219.9:64389] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTjR6Vy2qpaelbUob1fuAAAAFQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:28.182426 2026] [:error] [pid 31257:tid 31280] [client 161.35.219.9:64627] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjSP-JFLfishX45N_mZQAAARE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:30.661350 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:65225] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjSv-JFLfishX45N_maQAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:31.527476 2026] [:error] [pid 31257:tid 31275] [client 161.35.219.9:64627] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjS_-JFLfishX45N_magAAAQw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:32.328696 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:64627] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTjTP-JFLfishX45N_mbAAAAQM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:33.576528 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:49411] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTjTf-JFLfishX45N_mbgAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:34.591716 2026] [:error] [pid 23872:tid 23886] [client 161.35.219.9:49643] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTjTkzkQFuA2qBk8UNNoAAAAYs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:35.626408 2026] [:error] [pid 21575:tid 21591] [client 161.35.219.9:49923] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 18"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTjTyrocdArcJqFfImAEQAAAUw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:36.651277 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:50132] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjUEzkQFuA2qBk8UNNpwAAAYY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:39.053305 2026] [:error] [pid 28795:tid 28886] [client 161.35.219.9:50663] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjU7ROd53wZBkdI_ePIAAAAJc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:39.877334 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:50132] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjU0zkQFuA2qBk8UNNuAAAAYQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:39.877434 2026] [:error] [pid 23872:tid 23879] [client 161.35.219.9:50132] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjU0zkQFuA2qBk8UNNuAAAAYQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:41.806078 2026] [:error] [pid 28795:tid 28885] [client 161.35.219.9:50663] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjVbROd53wZBkdI_ePIgAAAJY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:42.646754 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:51117] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjVv-JFLfishX45N_mjQAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:42.646813 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:51117] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjVv-JFLfishX45N_mjQAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:44.554182 2026] [:error] [pid 28795:tid 28873] [client 161.35.219.9:50663] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjWLROd53wZBkdI_ePJwAAAIo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:45.403260 2026] [:error] [pid 28793:tid 28819] [client 161.35.219.9:51743] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjWQ2_fxBANaHo1f5FOAAAAAw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:45.403328 2026] [:error] [pid 28793:tid 28819] [client 161.35.219.9:51743] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjWQ2_fxBANaHo1f5FOAAAAAw"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:47.593019 2026] [:error] [pid 28908:tid 28910] [client 161.35.219.9:52400] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTjW4qJmC8ih_lQQnDf8gAAAMA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:48.600832 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:52854] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTjXEzkQFuA2qBk8UNN5wAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:49.626553 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:53098] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTjXUzkQFuA2qBk8UNN8QAAAY8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:50.640797 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:53385] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTjXkzkQFuA2qBk8UNOAQAAAZU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:51.659885 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:53624] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjX0zkQFuA2qBk8UNOEAAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:51.659962 2026] [:error] [pid 23872:tid 23895] [client 161.35.219.9:53624] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 27"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjX0zkQFuA2qBk8UNOEAAAAZQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:54.333113 2026] [:error] [pid 28908:tid 28920] [client 161.35.219.9:54202] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjYoqJmC8ih_lQQnDf-QAAAMo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:55.136065 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:53859] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjY0zkQFuA2qBk8UNOVwAAAYU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:55.136134 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:53859] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 28"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjY0zkQFuA2qBk8UNOVwAAAYU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:57.204888 2026] [:error] [pid 28908:tid 28931] [client 161.35.219.9:54202] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjZYqJmC8ih_lQQnDgBgAAANU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:58.138068 2026] [:error] [pid 21575:tid 21581] [client 161.35.219.9:54664] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjZirocdArcJqFfImAfQAAAUI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:09:59.042076 2026] [:error] [pid 21575:tid 21597] [client 161.35.219.9:54664] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTjZyrocdArcJqFfImAhQAAAVI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:00.066806 2026] [:error] [pid 28908:tid 28927] [client 161.35.219.9:55574] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTjaIqJmC8ih_lQQnDgEQAAANE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:01.083263 2026] [:error] [pid 21575:tid 21598] [client 161.35.219.9:55855] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTjaSrocdArcJqFfImAkAAAAVM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:02.098724 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:56078] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTjav-JFLfishX45N_mugAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:03.121713 2026] [:error] [pid 28908:tid 28921] [client 161.35.219.9:56297] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTja4qJmC8ih_lQQnDgFQAAAMs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:05.634529 2026] [:error] [pid 28908:tid 28925] [client 161.35.219.9:56895] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjbYqJmC8ih_lQQnDgJAAAAM8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:06.508588 2026] [:error] [pid 28908:tid 28910] [client 161.35.219.9:56297] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjboqJmC8ih_lQQnDgKAAAAMA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:08.289102 2026] [:error] [pid 28908:tid 28930] [client 161.35.219.9:56895] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjcIqJmC8ih_lQQnDgLwAAANQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:09.144826 2026] [:error] [pid 28908:tid 28912] [client 161.35.219.9:56297] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjcYqJmC8ih_lQQnDgNAAAAMI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:09.981257 2026] [:error] [pid 28908:tid 28924] [client 161.35.219.9:56297] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTjcYqJmC8ih_lQQnDgNgAAAM4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:11.010402 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:58048] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTjc0zkQFuA2qBk8UNPBgAAAZU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:12.048514 2026] [:error] [pid 23872:tid 23881] [client 161.35.219.9:58260] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTjdEzkQFuA2qBk8UNPEQAAAYY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:13.048151 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:58495] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTjdf-JFLfishX45N_m3wAAAQQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:14.068710 2026] [:error] [pid 31257:tid 31280] [client 161.35.219.9:58764] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjdv-JFLfishX45N_m5wAAARE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:15.014672 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:58764] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTjd_-JFLfishX45N_m8QAAAQg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:16.057693 2026] [:error] [pid 21575:tid 21600] [client 161.35.219.9:59310] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTjeCrocdArcJqFfImA1QAAAVU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:17.063730 2026] [:error] [pid 21575:tid 21585] [client 161.35.219.9:59543] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTjeSrocdArcJqFfImA3QAAAUY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:18.069499 2026] [:error] [pid 31257:tid 31280] [client 161.35.219.9:59754] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTjev-JFLfishX45N_nAgAAARE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:19.089787 2026] [:error] [pid 28793:tid 28808] [client 161.35.219.9:59980] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjew2_fxBANaHo1f5FTAAAAAE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:19.089893 2026] [:error] [pid 28793:tid 28808] [client 161.35.219.9:59980] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 29"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjew2_fxBANaHo1f5FTAAAAAE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:23.606032 2026] [:error] [pid 28795:tid 28869] [client 161.35.219.9:60935] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjf7ROd53wZBkdI_ePSgAAAIY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:24.459565 2026] [:error] [pid 31257:tid 31266] [client 161.35.219.9:60577] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjgP-JFLfishX45N_nIgAAAQM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:25.314087 2026] [:error] [pid 31257:tid 31277] [client 161.35.219.9:60577] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTjgf-JFLfishX45N_nIwAAAQ4"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:26.329432 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:61596] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTjgv-JFLfishX45N_nJwAAAQc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:27.327863 2026] [:error] [pid 23872:tid 23897] [client 161.35.219.9:61865] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTjg0zkQFuA2qBk8UNPhQAAAZY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:28.357951 2026] [:error] [pid 23872:tid 23878] [client 161.35.219.9:62077] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTjhEzkQFuA2qBk8UNPkwAAAYM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:29.403430 2026] [:error] [pid 31257:tid 31279] [client 161.35.219.9:62298] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjhf-JFLfishX45N_nLQAAARA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:30.247654 2026] [:error] [pid 31257:tid 31270] [client 161.35.219.9:62298] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTjhv-JFLfishX45N_nMgAAAQc"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:31.319032 2026] [:error] [pid 23872:tid 23896] [client 161.35.219.9:62766] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTjh0zkQFuA2qBk8UNPtAAAAZU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:32.329006 2026] [:error] [pid 31257:tid 31267] [client 161.35.219.9:62993] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTjiP-JFLfishX45N_nOwAAAQQ"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:33.343462 2026] [:error] [pid 31257:tid 31281] [client 161.35.219.9:63209] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTjif-JFLfishX45N_nPQAAARI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:34.356737 2026] [:error] [pid 28908:tid 28926] [client 161.35.219.9:63443] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjioqJmC8ih_lQQnDgUgAAANA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:34.356796 2026] [:error] [pid 28908:tid 28926] [client 161.35.219.9:63443] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 19"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjioqJmC8ih_lQQnDgUgAAANA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:35.361000 2026] [:error] [pid 23872:tid 23883] [client 161.35.219.9:63705] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTji0zkQFuA2qBk8UNP1wAAAYg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:36.524738 2026] [:error] [pid 23872:tid 23883] [client 161.35.219.9:63969] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTjjEzkQFuA2qBk8UNP5gAAAYg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:37.535733 2026] [:error] [pid 21575:tid 21596] [client 161.35.219.9:64249] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTjjSrocdArcJqFfImBGwAAAVE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:38.552645 2026] [:error] [pid 28908:tid 28915] [client 161.35.219.9:64477] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 20"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTjjoqJmC8ih_lQQnDgWQAAAMU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:39.566494 2026] [:error] [pid 23872:tid 23884] [client 161.35.219.9:64718] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjj0zkQFuA2qBk8UNP8wAAAYk"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:40.513836 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:64718] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTjkEzkQFuA2qBk8UNP_QAAAYI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:41.522062 2026] [:error] [pid 31257:tid 31269] [client 161.35.219.9:65247] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTjkf-JFLfishX45N_nUgAAAQY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:42.581503 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:65500] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTjkkzkQFuA2qBk8UNQEQAAAY0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:43.600773 2026] [:error] [pid 28908:tid 28925] [client 161.35.219.9:49358] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 14"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTjk4qJmC8ih_lQQnDgegAAAM8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:44.617096 2026] [:error] [pid 31257:tid 31271] [client 161.35.219.9:49601] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjlP-JFLfishX45N_ncwAAAQg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:47.079254 2026] [:error] [pid 28908:tid 28913] [client 161.35.219.9:50224] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjl4qJmC8ih_lQQnDgjgAAAMM"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:47.924831 2026] [:error] [pid 31257:tid 31276] [client 161.35.219.9:49601] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjl_-JFLfishX45N_negAAAQ0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:48.767628 2026] [:error] [pid 31257:tid 31278] [client 161.35.219.9:49601] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aaTjmP-JFLfishX45N_nfQAAAQ8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:49.795162 2026] [:error] [pid 23872:tid 23883] [client 161.35.219.9:50859] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/profile.php"] [unique_id "aaTjmUzkQFuA2qBk8UNQKwAAAYg"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:50.832602 2026] [:error] [pid 28794:tid 28847] [client 161.35.219.9:51110] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/edit.php"] [unique_id "aaTjmqVy2qpaelbUob1gBQAAAEs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:51.866335 2026] [:error] [pid 21575:tid 21590] [client 161.35.219.9:51365] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 11"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/plugins.php"] [unique_id "aaTjmyrocdArcJqFfImBMQAAAUs"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:52.879109 2026] [:error] [pid 28795:tid 28869] [client 161.35.219.9:51587] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjnLROd53wZBkdI_ePYAAAAIY"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:55.450087 2026] [:error] [pid 23872:tid 23880] [client 161.35.219.9:52249] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjn0zkQFuA2qBk8UNQNwAAAYU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:56.291354 2026] [:error] [pid 28795:tid 28878] [client 161.35.219.9:51587] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjoLROd53wZBkdI_ePYwAAAI8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:10:59.153658 2026] [:error] [pid 23872:tid 23888] [client 161.35.219.9:52249] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjo0zkQFuA2qBk8UNQQgAAAY0"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:11:00.100275 2026] [:error] [pid 28795:tid 28884] [client 161.35.219.9:51587] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjpLROd53wZBkdI_ePeAAAAJU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:11:00.100360 2026] [:error] [pid 28795:tid 28884] [client 161.35.219.9:51587] [client 161.35.219.9] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 161.35.219.9 on wp-login.php, counter = 12"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjpLROd53wZBkdI_ePeAAAAJU"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:11:02.120797 2026] [:error] [pid 23872:tid 23890] [client 161.35.219.9:52249] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjpkzkQFuA2qBk8UNQUQAAAY8"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:11:03.127478 2026] [:error] [pid 23872:tid 23877] [client 161.35.219.9:53584] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjp0zkQFuA2qBk8UNQWAAAAYI"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:11:05.009014 2026] [:error] [pid 23872:tid 23885] [client 161.35.219.9:52249] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjqUzkQFuA2qBk8UNQZgAAAYo"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:11:06.102835 2026] [:error] [pid 23872:tid 23875] [client 161.35.219.9:53584] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "www.expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjqkzkQFuA2qBk8UNQbAAAAYA"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:11:07.974827 2026] [:error] [pid 23872:tid 23892] [client 161.35.219.9:52249] [client 161.35.219.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.219.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaTjq0zkQFuA2qBk8UNQdgAAAZE"], referer: https://www.expressinteriors.com/wp-login.php
[Mon Mar 02 09:12:30.729959 2026] [:error] [pid 21575:tid 21581] [client 20.151.11.236:65028] [client 20.151.11.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaTj_irocdArcJqFfImB-gAAAUI"]
[Mon Mar 02 09:12:31.146909 2026] [:error] [pid 21575:tid 21593] [client 20.151.11.236:65096] [client 20.151.11.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaTj_yrocdArcJqFfImB_AAAAU4"]
[Mon Mar 02 09:12:31.557260 2026] [:error] [pid 21575:tid 21597] [client 20.151.11.236:65106] [client 20.151.11.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaTj_yrocdArcJqFfImB_wAAAVI"]
[Mon Mar 02 09:12:31.974047 2026] [:error] [pid 21575:tid 21587] [client 20.151.11.236:65123] [client 20.151.11.236] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaTj_yrocdArcJqFfImCAAAAAUg"]
[Mon Mar 02 09:27:56.656990 2026] [:error] [pid 31257:tid 31277] [client 20.104.97.185:3289] [client 20.104.97.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aaTnnP-JFLfishX45N_6hwAAAQ4"]
[Mon Mar 02 09:27:57.484138 2026] [:error] [pid 31257:tid 31279] [client 20.104.97.185:3311] [client 20.104.97.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aaTnnf-JFLfishX45N_6iwAAARA"]
[Mon Mar 02 09:27:58.313724 2026] [:error] [pid 28795:tid 28887] [client 20.104.97.185:3310] [client 20.104.97.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aaTnnrROd53wZBkdI_eXJgAAAJg"]
[Mon Mar 02 09:27:59.158932 2026] [:error] [pid 31257:tid 31269] [client 20.104.97.185:3283] [client 20.104.97.185] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aaTnn_-JFLfishX45N_6kwAAAQY"]
[Mon Mar 02 09:49:03.890406 2026] [authz_core:error] [pid 23872:tid 23899] [client 206.189.2.13:60654] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Mon Mar 02 09:49:09.177177 2026] [:error] [pid 23872:tid 23892] [client 206.189.2.13:44138] [client 206.189.2.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aaTslUzkQFuA2qBk8UOE6QAAAZE"]
[Mon Mar 02 09:49:13.225850 2026] [:error] [pid 28794:tid 28852] [client 206.189.2.13:44188] [client 206.189.2.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aaTsmaVy2qpaelbUob1oyAAAAFA"]
[Mon Mar 02 09:49:23.532441 2026] [:error] [pid 21575:tid 21584] [client 206.189.2.13:38960] [client 206.189.2.13] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aaTsoyrocdArcJqFfImXvQAAAUU"]
[Mon Mar 02 10:05:55.582994 2026] [:error] [pid 23872:tid 23884] [client 20.63.41.168:37149] [client 20.63.41.168] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "aaTwg0zkQFuA2qBk8UOTxgAAAYk"]
[Mon Mar 02 10:06:00.970129 2026] [:error] [pid 28795:tid 28876] [client 20.63.41.168:40328] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpo.php"] [unique_id "aaTwiLROd53wZBkdI_ehogAAAI0"]
[Mon Mar 02 10:06:01.711293 2026] [:error] [pid 23872:tid 23899] [client 20.63.41.168:43474] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpo.php"] [unique_id "aaTwiUzkQFuA2qBk8UOT4wAAAZg"]
[Mon Mar 02 10:06:05.754882 2026] [:error] [pid 31257:tid 31283] [client 20.63.41.168:34220] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpo.php"] [unique_id "aaTwjf-JFLfishX45N8YRQAAARQ"]
[Mon Mar 02 10:06:10.293954 2026] [:error] [pid 31257:tid 31287] [client 20.63.41.168:39758] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpo.php"] [unique_id "aaTwkv-JFLfishX45N8YWAAAARg"]
[Mon Mar 02 10:06:18.632800 2026] [:error] [pid 23872:tid 23883] [client 20.63.41.168:39760] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x123x.php"] [unique_id "aaTwmkzkQFuA2qBk8UOUSAAAAYg"]
[Mon Mar 02 10:06:20.198395 2026] [:error] [pid 23872:tid 23896] [client 20.63.41.168:42309] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x123x.php"] [unique_id "aaTwnEzkQFuA2qBk8UOUYgAAAZU"]
[Mon Mar 02 10:06:22.450583 2026] [:error] [pid 23872:tid 23880] [client 20.63.41.168:42316] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x123x.php"] [unique_id "aaTwnkzkQFuA2qBk8UOUeQAAAYU"]
[Mon Mar 02 10:06:23.476307 2026] [:error] [pid 28795:tid 28865] [client 20.63.41.168:41682] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x123x.php"] [unique_id "aaTwn7ROd53wZBkdI_ehsgAAAII"]
[Mon Mar 02 10:06:25.014654 2026] [:error] [pid 31257:tid 31270] [client 20.63.41.168:42343] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aq.php"] [unique_id "aaTwof-JFLfishX45N8YhgAAAQc"]
[Mon Mar 02 10:06:28.464233 2026] [:error] [pid 28794:tid 28859] [client 20.63.41.168:40323] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aq.php"] [unique_id "aaTwpKVy2qpaelbUob1tbQAAAFc"]
[Mon Mar 02 10:06:29.264919 2026] [:error] [pid 23872:tid 23879] [client 20.63.41.168:37124] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aq.php"] [unique_id "aaTwpUzkQFuA2qBk8UOUkwAAAYQ"]
[Mon Mar 02 10:06:30.767153 2026] [:error] [pid 23872:tid 23893] [client 20.63.41.168:34208] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aq.php"] [unique_id "aaTwpkzkQFuA2qBk8UOUnwAAAZI"]
[Mon Mar 02 10:06:34.755357 2026] [:error] [pid 31257:tid 31280] [client 20.63.41.168:41674] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/011i.php"] [unique_id "aaTwqv-JFLfishX45N8YxQAAARE"]
[Mon Mar 02 10:06:49.759977 2026] [:error] [pid 31257:tid 31277] [client 20.63.41.168:43471] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit-tags.php"] [unique_id "aaTwuf-JFLfishX45N8ZHAAAAQ4"]
[Mon Mar 02 10:06:51.327255 2026] [:error] [pid 28908:tid 28933] [client 20.63.41.168:41710] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit-tags.php"] [unique_id "aaTwu4qJmC8ih_lQQnD3owAAANc"]
[Mon Mar 02 10:06:54.024815 2026] [:error] [pid 28908:tid 28912] [client 20.63.41.168:41691] [client 20.63.41.168] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit-tags.php"] [unique_id "aaTwvoqJmC8ih_lQQnD3qQAAAMI"]
[Mon Mar 02 10:14:29.364028 2026] [:error] [pid 21575:tid 21579] [client 180.191.190.224:28098] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaTyhSrocdArcJqFfImmwAAAAUA"]
[Mon Mar 02 10:17:28.202578 2026] [:error] [pid 31257:tid 31269] [client 186.192.183.97:24645] [client 186.192.183.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.192.183.97, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaTzOP-JFLfishX45N8hBwAAAQY"]
[Mon Mar 02 10:18:50.087463 2026] [:error] [pid 23872:tid 23887] [client 180.191.190.224:18644] [client 180.191.190.224] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaTzikzkQFuA2qBk8UOhOQAAAYw"]
[Mon Mar 02 10:21:06.151111 2026] [:error] [pid 31257:tid 31273] [client 180.191.190.224:8941] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT0Ev-JFLfishX45N8jrAAAAQo"]
[Mon Mar 02 10:21:06.154889 2026] [:error] [pid 31257:tid 31273] [client 180.191.190.224:8941] [client 180.191.190.224] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1adminexpressinteriors%wppass_d%title0xdb86daf8description0xdb86daf8mt_keywords0xdb86daf8mt_excerpt0xdb86daf81"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT0Ev-JFLfishX45N8jrAAAAQo"]
[Mon Mar 02 10:22:52.193715 2026] [:error] [pid 23872:tid 23883] [client 180.191.190.224:18581] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT0fEzkQFuA2qBk8UOkfAAAAYg"]
[Mon Mar 02 10:24:49.034665 2026] [:error] [pid 28908:tid 28915] [client 180.191.190.224:51388] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT08YqJmC8ih_lQQnD_AQAAAMU"]
[Mon Mar 02 10:26:49.128239 2026] [:error] [pid 28908:tid 28911] [client 180.191.190.224:1436] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT1aYqJmC8ih_lQQnD_7wAAAME"]
[Mon Mar 02 10:28:55.754609 2026] [:error] [pid 28908:tid 28916] [client 180.191.190.224:8888] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT154qJmC8ih_lQQnABTgAAAMY"]
[Mon Mar 02 10:28:55.758079 2026] [:error] [pid 28908:tid 28916] [client 180.191.190.224:8888] [client 180.191.190.224] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1adminexpressinteriors%title0xd8b0847adescription0xd8b0847amt_keywords0xd8b0847amt_excerpt0xd8b0847a1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT154qJmC8ih_lQQnABTgAAAMY"]
[Mon Mar 02 10:31:08.593376 2026] [:error] [pid 21575:tid 21591] [client 180.191.190.224:18450] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT2bCrocdArcJqFfImxFwAAAUw"]
[Mon Mar 02 10:33:02.813540 2026] [:error] [pid 23872:tid 23885] [client 180.191.190.224:39888] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT23kzkQFuA2qBk8UOwSQAAAYo"]
[Mon Mar 02 10:34:59.991162 2026] [:error] [pid 23872:tid 23884] [client 180.191.190.224:18655] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT3U0zkQFuA2qBk8UOyFAAAAYk"]
[Mon Mar 02 10:36:42.220644 2026] [:error] [pid 28908:tid 28911] [client 180.191.190.224:28099] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT3uoqJmC8ih_lQQnAEEAAAAME"]
[Mon Mar 02 10:38:42.633434 2026] [:error] [pid 23872:tid 23875] [client 180.191.190.224:51328] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT4MkzkQFuA2qBk8UO3ggAAAYA"]
[Mon Mar 02 10:40:19.983522 2026] [:error] [pid 21575:tid 21599] [client 180.191.190.224:48805] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT4kyrocdArcJqFfIm1cQAAAVQ"]
[Mon Mar 02 10:40:19.987560 2026] [:error] [pid 21575:tid 21599] [client 180.191.190.224:48805] [client 180.191.190.224] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1adminadmin%wppass_u%title0xca4c0f04description0xca4c0f04mt_keywords0xca4c0f04mt_excerpt0xca4c0f041"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT4kyrocdArcJqFfIm1cQAAAVQ"]
[Mon Mar 02 10:41:51.272609 2026] [:error] [pid 21575:tid 21592] [client 180.191.190.224:18582] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT47yrocdArcJqFfIm2DQAAAU0"]
[Mon Mar 02 10:41:51.276585 2026] [:error] [pid 21575:tid 21592] [client 180.191.190.224:18582] [client 180.191.190.224] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1adminadmin_1%wppass_u%title0x4572c656description0x4572c656mt_keywords0x4572c656mt_excerpt0x4572c6561"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT47yrocdArcJqFfIm2DQAAAU0"]
[Mon Mar 02 10:43:08.730067 2026] [:error] [pid 23872:tid 23885] [client 180.191.190.224:1433] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT5PEzkQFuA2qBk8UO8oQAAAYo"]
[Mon Mar 02 10:44:27.194407 2026] [:error] [pid 28908:tid 28910] [client 180.191.190.224:1418] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT5i4qJmC8ih_lQQnAHHQAAAMA"]
[Mon Mar 02 10:45:45.584193 2026] [:error] [pid 28908:tid 28928] [client 180.191.190.224:26950] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT52YqJmC8ih_lQQnAH6AAAANI"]
[Mon Mar 02 10:45:45.587582 2026] [:error] [pid 28908:tid 28928] [client 180.191.190.224:26950] [client 180.191.190.224] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1adminadmin123%wppass_u%title0xcbb83d8edescription0xcbb83d8emt_keywords0xcbb83d8emt_excerpt0xcbb83d8e1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT52YqJmC8ih_lQQnAH6AAAANI"]
[Mon Mar 02 10:47:15.507700 2026] [:error] [pid 23872:tid 23892] [client 180.191.190.224:26977] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT6M0zkQFuA2qBk8UPBqAAAAZE"]
[Mon Mar 02 10:48:44.742447 2026] [:error] [pid 28795:tid 28874] [client 180.191.190.224:28010] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT6jLROd53wZBkdI_et-wAAAIs"]
[Mon Mar 02 10:50:30.470173 2026] [:error] [pid 31257:tid 31265] [client 180.191.190.224:8794] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT69v-JFLfishX45N86BwAAAQI"]
[Mon Mar 02 10:51:26.185554 2026] [:error] [pid 28794:tid 28853] [client 20.63.83.113:56097] [client 20.63.83.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aaT7LqVy2qpaelbUob13wwAAAFE"]
[Mon Mar 02 10:51:37.000721 2026] [:error] [pid 28794:tid 28860] [client 20.63.83.113:47164] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Xleet.php"] [unique_id "aaT7OKVy2qpaelbUob13zwAAAFg"]
[Mon Mar 02 10:51:48.460907 2026] [:error] [pid 23872:tid 23876] [client 20.63.83.113:56084] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Xleet.php"] [unique_id "aaT7REzkQFuA2qBk8UPHfAAAAYE"]
[Mon Mar 02 10:51:50.710092 2026] [:error] [pid 21575:tid 21581] [client 20.63.83.113:16253] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Xleet.php"] [unique_id "aaT7RirocdArcJqFfIm95AAAAUI"]
[Mon Mar 02 10:51:58.887312 2026] [:error] [pid 31257:tid 31275] [client 180.191.190.224:8946] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT7Tv-JFLfishX45N87fwAAAQw"]
[Mon Mar 02 10:52:20.187327 2026] [:error] [pid 21575:tid 21585] [client 20.63.83.113:34345] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/issue.php"] [unique_id "aaT7ZCrocdArcJqFfIm-NQAAAUY"]
[Mon Mar 02 10:52:22.326309 2026] [:error] [pid 31257:tid 31271] [client 20.63.83.113:56090] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/issue.php"] [unique_id "aaT7Zv-JFLfishX45N87zQAAAQg"]
[Mon Mar 02 10:52:27.267236 2026] [:error] [pid 31257:tid 31270] [client 20.63.83.113:15628] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/issue.php"] [unique_id "aaT7a_-JFLfishX45N877AAAAQc"]
[Mon Mar 02 10:52:32.478099 2026] [:error] [pid 31257:tid 31280] [client 20.63.83.113:48741] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/issue.php"] [unique_id "aaT7cP-JFLfishX45N87-gAAARE"]
[Mon Mar 02 10:52:33.452661 2026] [:error] [pid 28795:tid 28875] [client 20.63.83.113:34338] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/verify.php"] [unique_id "aaT7cbROd53wZBkdI_evFQAAAIw"]
[Mon Mar 02 10:52:35.054755 2026] [:error] [pid 23872:tid 23883] [client 20.63.83.113:56102] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/verify.php"] [unique_id "aaT7c0zkQFuA2qBk8UPIXwAAAYg"]
[Mon Mar 02 10:52:48.277068 2026] [:error] [pid 21575:tid 21589] [client 20.63.83.113:16211] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abouts.php"] [unique_id "aaT7gCrocdArcJqFfIm-kwAAAUo"]
[Mon Mar 02 10:52:57.208846 2026] [:error] [pid 31257:tid 31269] [client 20.63.83.113:7690] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abouts.php"] [unique_id "aaT7if-JFLfishX45N88wAAAAQY"]
[Mon Mar 02 10:52:58.739311 2026] [:error] [pid 21575:tid 21602] [client 20.63.83.113:30820] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abouts.php"] [unique_id "aaT7iirocdArcJqFfIm-ogAAAVc"]
[Mon Mar 02 10:53:00.194069 2026] [:error] [pid 31257:tid 31280] [client 20.63.83.113:35179] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abouts.php"] [unique_id "aaT7jP-JFLfishX45N880QAAARE"]
[Mon Mar 02 10:53:01.400675 2026] [:error] [pid 21575:tid 21584] [client 20.63.83.113:15677] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cache.php"] [unique_id "aaT7jSrocdArcJqFfIm-sAAAAUU"]
[Mon Mar 02 10:53:05.169684 2026] [:error] [pid 23872:tid 23882] [client 20.63.83.113:7708] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cache.php"] [unique_id "aaT7kUzkQFuA2qBk8UPJVwAAAYc"]
[Mon Mar 02 10:53:07.593277 2026] [:error] [pid 31257:tid 31278] [client 20.63.83.113:7473] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cache.php"] [unique_id "aaT7k_-JFLfishX45N885AAAAQ8"]
[Mon Mar 02 10:53:08.205562 2026] [:error] [pid 23872:tid 23884] [client 20.63.83.113:30810] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cache.php"] [unique_id "aaT7lEzkQFuA2qBk8UPJcQAAAYk"]
[Mon Mar 02 10:53:09.460086 2026] [:error] [pid 31257:tid 31268] [client 20.63.83.113:15619] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "aaT7lf-JFLfishX45N886gAAAQU"]
[Mon Mar 02 10:53:13.127836 2026] [:error] [pid 23872:tid 23890] [client 20.63.83.113:34314] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "aaT7mUzkQFuA2qBk8UPJogAAAY8"]
[Mon Mar 02 10:53:17.241449 2026] [:error] [pid 28794:tid 28851] [client 20.63.83.113:36620] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "aaT7naVy2qpaelbUob13_QAAAE8"]
[Mon Mar 02 10:53:18.512477 2026] [:error] [pid 21575:tid 21591] [client 20.63.83.113:35182] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "aaT7nirocdArcJqFfIm-0gAAAUw"]
[Mon Mar 02 10:53:21.807014 2026] [:error] [pid 23872:tid 23893] [client 20.63.83.113:35175] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "aaT7oUzkQFuA2qBk8UPJwgAAAZI"]
[Mon Mar 02 10:53:23.148639 2026] [:error] [pid 28795:tid 28870] [client 20.63.83.113:34355] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "aaT7o7ROd53wZBkdI_evQgAAAIc"]
[Mon Mar 02 10:53:28.491737 2026] [:error] [pid 28793:tid 28813] [client 20.63.83.113:7480] [client 20.63.83.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "aaT7qA2_fxBANaHo1f5X0gAAAAY"]
[Mon Mar 02 10:53:55.517509 2026] [:error] [pid 31257:tid 31263] [client 180.191.190.224:1334] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT7w_-JFLfishX45N89tQAAAQA"]
[Mon Mar 02 10:55:46.560543 2026] [:error] [pid 23872:tid 23892] [client 180.191.190.224:51202] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT8MkzkQFuA2qBk8UPMMAAAAZE"]
[Mon Mar 02 10:55:46.563527 2026] [:error] [pid 23872:tid 23892] [client 180.191.190.224:51202] [client 180.191.190.224] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1expressinteriors.comexpressinteriors%wppass_d%title0x960e1764description0x960e1764mt_keywords0x960e1764mt_excerpt0x960e17641"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT8MkzkQFuA2qBk8UPMMAAAAZE"]
[Mon Mar 02 10:57:17.740325 2026] [:error] [pid 23872:tid 23889] [client 180.191.190.224:51309] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT8jUzkQFuA2qBk8UPPMwAAAY4"]
[Mon Mar 02 10:59:01.778227 2026] [:error] [pid 21575:tid 21592] [client 180.191.190.224:39909] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT89SrocdArcJqFfInCgwAAAU0"]
[Mon Mar 02 11:00:26.113358 2026] [:error] [pid 31257:tid 31284] [client 180.191.190.224:8830] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT9Sv-JFLfishX45N9ECgAAARU"]
[Mon Mar 02 11:02:01.309636 2026] [:error] [pid 31257:tid 31280] [client 180.191.190.224:18475] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT9qf-JFLfishX45N9FRwAAARE"]
[Mon Mar 02 11:02:01.313508 2026] [:error] [pid 31257:tid 31280] [client 180.191.190.224:18475] [client 180.191.190.224] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1expressinteriors.comexpressinteriors%title0x6e2e808fdescription0x6e2e808fmt_keywords0x6e2e808fmt_excerpt0x6e2e808f1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT9qf-JFLfishX45N9FRwAAARE"]
[Mon Mar 02 11:03:20.975566 2026] [:error] [pid 28793:tid 28808] [client 180.191.190.224:1387] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT9-A2_fxBANaHo1f5ZtAAAAAE"]
[Mon Mar 02 11:04:43.143007 2026] [:error] [pid 23872:tid 23889] [client 180.191.190.224:27913] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT-S0zkQFuA2qBk8UPYRQAAAY4"]
[Mon Mar 02 11:06:01.108885 2026] [:error] [pid 23872:tid 23890] [client 180.191.190.224:26972] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT-mUzkQFuA2qBk8UPZpgAAAY8"]
[Mon Mar 02 11:08:27.523775 2026] [:error] [pid 21575:tid 21591] [client 180.191.190.224:1318] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT_KyrocdArcJqFfInHVAAAAUw"]
[Mon Mar 02 11:10:22.294796 2026] [:error] [pid 23872:tid 23888] [client 180.191.190.224:27920] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT_nkzkQFuA2qBk8UPfZwAAAY0"]
[Mon Mar 02 11:11:46.280026 2026] [:error] [pid 23872:tid 23881] [client 180.191.190.224:48886] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT_8kzkQFuA2qBk8UPgywAAAYY"]
[Mon Mar 02 11:11:46.285292 2026] [:error] [pid 23872:tid 23881] [client 180.191.190.224:48886] [client 180.191.190.224] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1expressinteriors.comexpressinteriors.com%wppass_u%title0xe637286edescription0xe637286emt_keywords0xe637286emt_excerpt0xe637286e1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaT_8kzkQFuA2qBk8UPgywAAAYY"]
[Mon Mar 02 11:12:53.285297 2026] [:error] [pid 21575:tid 21590] [client 180.191.190.224:39785] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaUANSrocdArcJqFfInJtwAAAUs"]
[Mon Mar 02 11:12:53.288262 2026] [:error] [pid 21575:tid 21590] [client 180.191.190.224:39785] [client 180.191.190.224] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1expressinteriors.comexpressinteriors.com_1%wppass_u%title0xc7e4ce4cdescription0xc7e4ce4cmt_keywords0xc7e4ce4cmt_excerpt0xc7e4ce4c1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaUANSrocdArcJqFfInJtwAAAUs"]
[Mon Mar 02 11:13:48.154192 2026] [:error] [pid 21575:tid 21581] [client 180.191.190.224:18523] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaUAbCrocdArcJqFfInKGAAAAUI"]
[Mon Mar 02 11:14:57.789296 2026] [:error] [pid 28908:tid 28926] [client 180.191.190.224:48862] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaUAsYqJmC8ih_lQQnAUwAAAANA"]
[Mon Mar 02 11:15:42.005045 2026] [:error] [pid 21575:tid 21598] [client 180.191.190.224:51276] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaUA3irocdArcJqFfInMrAAAAVM"]
[Mon Mar 02 11:15:42.010686 2026] [:error] [pid 21575:tid 21598] [client 180.191.190.224:51276] [client 180.191.190.224] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1expressinteriors.comexpressinteriors.com123%wppass_u%title0xacfaef47description0xacfaef47mt_keywords0xacfaef47mt_excerpt0xacfaef471"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaUA3irocdArcJqFfInMrAAAAVM"]
[Mon Mar 02 11:16:50.704043 2026] [:error] [pid 28908:tid 28912] [client 180.191.190.224:26995] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaUBIoqJmC8ih_lQQnAYKgAAAMI"]
[Mon Mar 02 11:17:44.100222 2026] [:error] [pid 28793:tid 28810] [client 180.191.190.224:51316] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaUBWA2_fxBANaHo1f5bygAAAAM"]
[Mon Mar 02 11:18:58.469614 2026] [:error] [pid 28908:tid 28930] [client 180.191.190.224:18643] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaUBooqJmC8ih_lQQnAbTgAAANQ"]
[Mon Mar 02 11:19:53.350210 2026] [:error] [pid 21575:tid 21600] [client 180.191.190.224:39701] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaUB2SrocdArcJqFfInQ6QAAAVU"]
[Mon Mar 02 11:20:45.865640 2026] [:error] [pid 23872:tid 23884] [client 180.191.190.224:1451] [client 180.191.190.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.190.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaUCDUzkQFuA2qBk8UPoVgAAAYk"]
[Mon Mar 02 11:25:07.721442 2026] [:error] [pid 28908:tid 28924] [client 43.153.10.83:45364] [client 43.153.10.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaUDE4qJmC8ih_lQQnAhpgAAAM4"]
[Mon Mar 02 11:58:40.270691 2026] [:error] [pid 28908:tid 28914] [client 74.7.227.147:45420] [client 74.7.227.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.7.227.147, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaUK8IqJmC8ih_lQQnBIvQAAAMQ"], referer: https://expressinteriors.com/
[Mon Mar 02 12:25:21.169742 2026] [:error] [pid 28908:tid 28926] [client 74.243.251.125:13065] [client 74.243.251.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "aaURMYqJmC8ih_lQQnB2PQAAANA"]
[Mon Mar 02 12:25:29.695577 2026] [:error] [pid 28794:tid 28841] [client 74.243.251.125:12695] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaUROaVy2qpaelbUob2EkQAAAEU"]
[Mon Mar 02 12:25:30.018545 2026] [:error] [pid 21575:tid 21587] [client 74.243.251.125:12683] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaUROirocdArcJqFfIkp0wAAAUg"]
[Mon Mar 02 12:25:30.350860 2026] [:error] [pid 21575:tid 21580] [client 74.243.251.125:12714] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaUROirocdArcJqFfIkp1wAAAUE"]
[Mon Mar 02 12:25:30.753914 2026] [:error] [pid 21575:tid 21601] [client 74.243.251.125:13063] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaUROirocdArcJqFfIkp3AAAAVY"]
[Mon Mar 02 12:25:31.078063 2026] [:error] [pid 31257:tid 31275] [client 74.243.251.125:13117] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aaURO_-JFLfishX45N9vrQAAAQw"]
[Mon Mar 02 12:25:31.479410 2026] [:error] [pid 28908:tid 28928] [client 74.243.251.125:12717] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aaURO4qJmC8ih_lQQnB2jAAAANI"]
[Mon Mar 02 12:25:31.801894 2026] [:error] [pid 23872:tid 23895] [client 74.243.251.125:12692] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aaURO0zkQFuA2qBk8UMWFwAAAZQ"]
[Mon Mar 02 12:25:32.139183 2026] [:error] [pid 28908:tid 28932] [client 74.243.251.125:12684] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aaURPIqJmC8ih_lQQnB2kAAAANY"]
[Mon Mar 02 12:25:32.462533 2026] [:error] [pid 28908:tid 28922] [client 74.243.251.125:13069] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaURPIqJmC8ih_lQQnB2lgAAAMw"]
[Mon Mar 02 12:25:32.795763 2026] [:error] [pid 21575:tid 21598] [client 74.243.251.125:12691] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaURPCrocdArcJqFfIkp5QAAAVM"]
[Mon Mar 02 12:25:33.136012 2026] [:error] [pid 28908:tid 28919] [client 74.243.251.125:12700] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaURPYqJmC8ih_lQQnB2oAAAAMk"]
[Mon Mar 02 12:25:33.465097 2026] [:error] [pid 28908:tid 28930] [client 74.243.251.125:12733] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaURPYqJmC8ih_lQQnB2pAAAANQ"]
[Mon Mar 02 12:25:33.882946 2026] [:error] [pid 23872:tid 23882] [client 74.243.251.125:12724] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaURPUzkQFuA2qBk8UMWGwAAAYc"]
[Mon Mar 02 12:25:34.205663 2026] [:error] [pid 23872:tid 23880] [client 74.243.251.125:12676] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaURPkzkQFuA2qBk8UMWHAAAAYU"]
[Mon Mar 02 12:25:34.607721 2026] [:error] [pid 28795:tid 28873] [client 74.243.251.125:12696] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaURPrROd53wZBkdI_fCNgAAAIo"]
[Mon Mar 02 12:25:34.930779 2026] [:error] [pid 28795:tid 28887] [client 74.243.251.125:13058] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaURPrROd53wZBkdI_fCNwAAAJg"]
[Mon Mar 02 12:25:35.263748 2026] [:error] [pid 28795:tid 28884] [client 74.243.251.125:12711] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaURP7ROd53wZBkdI_fCOQAAAJU"]
[Mon Mar 02 12:25:35.588089 2026] [:error] [pid 23872:tid 23898] [client 74.243.251.125:12677] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaURP0zkQFuA2qBk8UMWJAAAAZc"]
[Mon Mar 02 12:25:35.912520 2026] [:error] [pid 21575:tid 21601] [client 74.243.251.125:12720] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaURPyrocdArcJqFfIkp6wAAAVY"]
[Mon Mar 02 12:25:36.246102 2026] [:error] [pid 28795:tid 28883] [client 74.243.251.125:12681] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaURQLROd53wZBkdI_fCOgAAAJQ"]
[Mon Mar 02 12:25:36.571960 2026] [:error] [pid 21575:tid 21599] [client 74.243.251.125:13085] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaURQCrocdArcJqFfIkp7wAAAVQ"]
[Mon Mar 02 12:25:36.982287 2026] [:error] [pid 31257:tid 31285] [client 74.243.251.125:12709] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaURQP-JFLfishX45N9vuAAAARY"]
[Mon Mar 02 12:25:37.306982 2026] [:error] [pid 21575:tid 21598] [client 74.243.251.125:12729] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaURQSrocdArcJqFfIkp8gAAAVM"]
[Mon Mar 02 12:25:37.629564 2026] [:error] [pid 21575:tid 21586] [client 74.243.251.125:13068] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaURQSrocdArcJqFfIkp9gAAAUc"]
[Mon Mar 02 12:25:37.963850 2026] [:error] [pid 28794:tid 28839] [client 74.243.251.125:12678] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php"] [unique_id "aaURQaVy2qpaelbUob2EnwAAAEM"]
[Mon Mar 02 12:25:38.287800 2026] [:error] [pid 28793:tid 28808] [client 74.243.251.125:12726] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php"] [unique_id "aaURQg2_fxBANaHo1f5izAAAAAE"]
[Mon Mar 02 12:25:38.611171 2026] [:error] [pid 28793:tid 28817] [client 74.243.251.125:13102] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php"] [unique_id "aaURQg2_fxBANaHo1f5izQAAAAo"]
[Mon Mar 02 12:25:38.937744 2026] [:error] [pid 21575:tid 21600] [client 74.243.251.125:12699] [client 74.243.251.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php"] [unique_id "aaURQirocdArcJqFfIkp_gAAAVU"]
[Mon Mar 02 12:37:33.102018 2026] [:error] [pid 31257:tid 31281] [client 4.193.177.110:2851] [client 4.193.177.110] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aaUUDf-JFLfishX45N90tQAAARI"]
[Mon Mar 02 12:37:33.482142 2026] [:error] [pid 21575:tid 21602] [client 4.193.177.110:3730] [client 4.193.177.110] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aaUUDSrocdArcJqFfIk0wQAAAVc"]
[Mon Mar 02 12:37:33.850034 2026] [:error] [pid 31257:tid 31270] [client 4.193.177.110:2816] [client 4.193.177.110] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aaUUDf-JFLfishX45N90tgAAAQc"]
[Mon Mar 02 12:37:34.255906 2026] [:error] [pid 23872:tid 23889] [client 4.193.177.110:3279] [client 4.193.177.110] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aaUUDkzkQFuA2qBk8UMekwAAAY4"]
[Mon Mar 02 12:46:45.721674 2026] [:error] [pid 23872:tid 23880] [client 51.75.151.149:55219] [client 51.75.151.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.75.151.149, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaUWNUzkQFuA2qBk8UMkswAAAYU"]
[Mon Mar 02 13:27:19.261975 2026] [:error] [pid 59600:tid 59614] [client 104.28.203.58:40992] [client 104.28.203.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aaUft4Q5lE4yocV9IBdHWAAAAAU"]
[Mon Mar 02 13:27:19.605493 2026] [:error] [pid 59600:tid 59615] [client 104.28.203.58:49471] [client 104.28.203.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/style.php"] [unique_id "aaUft4Q5lE4yocV9IBdHWQAAAAY"]
[Mon Mar 02 13:28:44.412084 2026] [:error] [pid 59600:tid 59626] [client 43.130.106.18:44830] [client 43.130.106.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaUgDIQ5lE4yocV9IBdIkQAAABE"]
[Mon Mar 02 14:30:46.485989 2026] [:error] [pid 59734:tid 59737] [client 122.51.236.174:35526] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaUulpeWQx7ZQG9NybG76QAAAUE"]
[Mon Mar 02 15:33:06.349976 2026] [:error] [pid 59734:tid 59743] [client 64.227.147.139:64943] [client 64.227.147.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.147.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaU9MpeWQx7ZQG9NybHLcwAAAUc"]
[Mon Mar 02 15:33:08.115324 2026] [:error] [pid 59602:tid 59682] [client 64.227.147.139:64989] [client 64.227.147.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.147.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaU9NDMtSo_Fr0lHnSbnzwAAAJE"]
[Mon Mar 02 15:42:24.908418 2026] [:error] [pid 28847:tid 28861] [client 64.227.147.139:58594] [client 64.227.147.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.147.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaU_YJ9xbBq8VfeqVDZKwwAAAMw"]
[Mon Mar 02 15:42:40.124820 2026] [:error] [pid 28847:tid 28868] [client 64.227.147.139:59885] [client 64.227.147.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.147.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaU_cJ9xbBq8VfeqVDZK_gAAANM"]
[Mon Mar 02 15:42:51.427852 2026] [:error] [pid 59734:tid 59754] [client 64.227.147.139:60590] [client 64.227.147.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.147.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaU_e5eWQx7ZQG9NybHNjAAAAVI"]
[Mon Mar 02 17:05:45.014002 2026] [authz_core:error] [pid 28847:tid 28850] [client 159.65.144.72:50834] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Mon Mar 02 17:05:51.478747 2026] [:error] [pid 28847:tid 28870] [client 159.65.144.72:50866] [client 159.65.144.72] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aaVS759xbBq8VfeqVDaFwAAAANU"]
[Mon Mar 02 17:05:55.825128 2026] [:error] [pid 59600:tid 59630] [client 159.65.144.72:37542] [client 159.65.144.72] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aaVS84Q5lE4yocV9IBfUJgAAABU"]
[Mon Mar 02 17:06:07.991191 2026] [:error] [pid 59601:tid 59640] [client 159.65.144.72:50116] [client 159.65.144.72] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "aaVS_8Q1lXfvWN0-ZQljOwAAAEI"]
[Mon Mar 02 20:41:42.871760 2026] [autoindex:error] [pid 59600:tid 59624] [client 139.59.24.163:50631] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Mar 02 21:14:47.808615 2026] [:error] [pid 59734:tid 59746] [client 182.40.104.255:36180] [client 182.40.104.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaWNR5eWQx7ZQG9NybEpfAAAAUo"]
[Mon Mar 02 21:27:48.701612 2026] [:error] [pid 59701:tid 59710] [client 43.167.157.80:55674] [client 43.167.157.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaWQVOUmTDVso96U9_LbEQAAAQY"]
[Mon Mar 02 22:50:16.114583 2026] [:error] [pid 59600:tid 59620] [client 52.169.119.118:16582] [client 52.169.119.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "aaWjqIQ5lE4yocV9IBeXMgAAAAs"]
[Mon Mar 02 22:50:24.807984 2026] [:error] [pid 28847:tid 28872] [client 52.169.119.118:14487] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaWjsJ9xbBq8VfeqVDaXLwAAANc"]
[Mon Mar 02 22:50:25.309031 2026] [:error] [pid 59734:tid 59739] [client 52.169.119.118:4456] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaWjsZeWQx7ZQG9NybFHCwAAAUM"]
[Mon Mar 02 22:50:25.809077 2026] [:error] [pid 59601:tid 59649] [client 52.169.119.118:9337] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaWjscQ1lXfvWN0-ZQml9gAAAEs"]
[Mon Mar 02 22:50:26.344794 2026] [:error] [pid 59734:tid 59738] [client 52.169.119.118:5662] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaWjspeWQx7ZQG9NybFHDgAAAUI"]
[Mon Mar 02 22:50:26.845418 2026] [:error] [pid 59602:tid 59685] [client 52.169.119.118:5674] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aaWjsjMtSo_Fr0lHnSaTSgAAAJQ"]
[Mon Mar 02 22:50:27.370829 2026] [:error] [pid 59701:tid 59710] [client 52.169.119.118:6372] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aaWjs-UmTDVso96U9_LvnwAAAQY"]
[Mon Mar 02 22:50:27.898607 2026] [:error] [pid 59701:tid 59705] [client 52.169.119.118:16581] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aaWjs-UmTDVso96U9_LvoAAAAQE"]
[Mon Mar 02 22:50:28.420722 2026] [:error] [pid 28847:tid 28860] [client 52.169.119.118:13056] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aaWjtJ9xbBq8VfeqVDaXMwAAAMs"]
[Mon Mar 02 22:50:28.928662 2026] [:error] [pid 59600:tid 59628] [client 52.169.119.118:13060] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaWjtIQ5lE4yocV9IBeXVwAAABM"]
[Mon Mar 02 22:50:29.434531 2026] [:error] [pid 59734:tid 59748] [client 52.169.119.118:7319] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaWjtZeWQx7ZQG9NybFHFQAAAUw"]
[Mon Mar 02 22:50:29.947926 2026] [:error] [pid 59701:tid 59704] [client 52.169.119.118:9001] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaWjteUmTDVso96U9_LvpQAAAQA"]
[Mon Mar 02 22:50:30.453839 2026] [:error] [pid 59600:tid 59633] [client 52.169.119.118:14449] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaWjtoQ5lE4yocV9IBeXWwAAABg"]
[Mon Mar 02 22:50:30.986974 2026] [:error] [pid 28847:tid 28855] [client 52.169.119.118:4461] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaWjtp9xbBq8VfeqVDaXOQAAAMY"]
[Mon Mar 02 22:50:31.495695 2026] [:error] [pid 59602:tid 59668] [client 52.169.119.118:5668] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaWjtzMtSo_Fr0lHnSaTVwAAAIM"]
[Mon Mar 02 22:50:31.997085 2026] [:error] [pid 59734:tid 59745] [client 52.169.119.118:9280] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaWjt5eWQx7ZQG9NybFHGQAAAUk"]
[Mon Mar 02 22:50:32.496147 2026] [:error] [pid 59701:tid 59711] [client 52.169.119.118:7316] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaWjuOUmTDVso96U9_LvpgAAAQc"]
[Mon Mar 02 22:50:32.995069 2026] [:error] [pid 59600:tid 59632] [client 52.169.119.118:16586] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaWjuIQ5lE4yocV9IBeXXQAAABc"]
[Mon Mar 02 22:50:33.495762 2026] [:error] [pid 59600:tid 59609] [client 52.169.119.118:19026] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaWjuYQ5lE4yocV9IBeXXwAAAAA"]
[Mon Mar 02 22:50:33.995600 2026] [:error] [pid 59600:tid 59621] [client 52.169.119.118:9332] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaWjuYQ5lE4yocV9IBeXYwAAAAw"]
[Mon Mar 02 22:50:34.496019 2026] [:error] [pid 59701:tid 59716] [client 52.169.119.118:2471] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaWjuuUmTDVso96U9_LvpwAAAQw"]
[Mon Mar 02 22:50:34.995966 2026] [:error] [pid 59734:tid 59742] [client 52.169.119.118:19066] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaWjupeWQx7ZQG9NybFHGwAAAUY"]
[Mon Mar 02 22:50:35.528654 2026] [:error] [pid 59600:tid 59609] [client 52.169.119.118:10011] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaWju4Q5lE4yocV9IBeXagAAAAA"]
[Mon Mar 02 22:50:36.029632 2026] [:error] [pid 59601:tid 59648] [client 52.169.119.118:10034] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaWjvMQ1lXfvWN0-ZQmmAgAAAEo"]
[Mon Mar 02 22:50:36.529353 2026] [:error] [pid 59734:tid 59737] [client 52.169.119.118:15500] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaWjvJeWQx7ZQG9NybFHHAAAAUE"]
[Mon Mar 02 22:50:37.028593 2026] [:error] [pid 59602:tid 59689] [client 52.169.119.118:14516] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php"] [unique_id "aaWjvTMtSo_Fr0lHnSaTZAAAAJg"]
[Mon Mar 02 22:50:37.527774 2026] [:error] [pid 59602:tid 59667] [client 52.169.119.118:13281] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php"] [unique_id "aaWjvTMtSo_Fr0lHnSaTZwAAAII"]
[Mon Mar 02 22:50:38.059053 2026] [:error] [pid 59602:tid 59669] [client 52.169.119.118:14447] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php"] [unique_id "aaWjvjMtSo_Fr0lHnSaTbAAAAIQ"]
[Mon Mar 02 22:50:38.558988 2026] [:error] [pid 28847:tid 28864] [client 52.169.119.118:9313] [client 52.169.119.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php"] [unique_id "aaWjvp9xbBq8VfeqVDaXPwAAAM8"]
[Mon Mar 02 23:28:12.891744 2026] [:error] [pid 59602:tid 59682] [client 119.28.140.106:35958] [client 119.28.140.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaWsjDMtSo_Fr0lHnSahcgAAAJE"]
[Tue Mar 03 00:48:18.542734 2026] [:error] [pid 18557:tid 18819] [client 20.151.217.152:21314] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaW_UtngZqR9Tp8JM0FQ0AAAAEA"]
[Tue Mar 03 00:48:18.956436 2026] [:error] [pid 18558:tid 18859] [client 20.151.217.152:21313] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaW_UrO1kQHjTOLioCmzKQAAAIU"]
[Tue Mar 03 00:48:19.367001 2026] [:error] [pid 18960:tid 18976] [client 20.151.217.152:21326] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aaW_U9Cu09icM9oIHwDMLgAAAM0"]
[Tue Mar 03 01:53:07.640268 2026] [:error] [pid 60214:tid 60231] [client 93.183.125.49:57766] [client 93.183.125.49] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.expressinteriors.com|F|2"] [data "TX:0=video/x-msvideo"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaXOg4muQ_v4S3RkLisUbQAAAQ8"]
[Tue Mar 03 02:32:46.428657 2026] [:error] [pid 18960:tid 18979] [client 20.63.100.156:37416] [client 20.63.100.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.63.100.156, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaXXztCu09icM9oIHwAJ8gAAANA"]
[Tue Mar 03 02:36:29.483365 2026] [:error] [pid 60214:tid 60235] [client 13.71.189.74:6127] [client 13.71.189.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "aaXYrYmuQ_v4S3RkLis97gAAARM"]
[Tue Mar 03 02:36:37.792750 2026] [:error] [pid 60214:tid 60219] [client 13.71.189.74:6095] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaXYtYmuQ_v4S3RkLis-GgAAAQM"]
[Tue Mar 03 02:36:38.226145 2026] [:error] [pid 18960:tid 18982] [client 13.71.189.74:6134] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaXYttCu09icM9oIHwAL6gAAANM"]
[Tue Mar 03 02:36:38.642934 2026] [:error] [pid 60214:tid 60225] [client 13.71.189.74:6088] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaXYtomuQ_v4S3RkLis-HQAAAQk"]
[Tue Mar 03 02:36:39.059922 2026] [:error] [pid 18960:tid 18976] [client 13.71.189.74:6111] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaXYt9Cu09icM9oIHwAL7gAAAM0"]
[Tue Mar 03 02:36:39.470450 2026] [:error] [pid 18960:tid 18972] [client 13.71.189.74:6141] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aaXYt9Cu09icM9oIHwAL7wAAAMk"]
[Tue Mar 03 02:36:39.884079 2026] [:error] [pid 18960:tid 18975] [client 13.71.189.74:6084] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aaXYt9Cu09icM9oIHwAL8AAAAMw"]
[Tue Mar 03 02:36:40.294564 2026] [:error] [pid 18558:tid 18871] [client 13.71.189.74:6106] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aaXYuLO1kQHjTOLioCnhTAAAAJE"]
[Tue Mar 03 02:36:40.723314 2026] [:error] [pid 18960:tid 18974] [client 13.71.189.74:6104] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aaXYuNCu09icM9oIHwAL9AAAAMs"]
[Tue Mar 03 02:36:41.154195 2026] [:error] [pid 60214:tid 60235] [client 13.71.189.74:6096] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaXYuYmuQ_v4S3RkLis-LgAAARM"]
[Tue Mar 03 02:36:41.571199 2026] [:error] [pid 60214:tid 60240] [client 13.71.189.74:6099] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaXYuYmuQ_v4S3RkLis-MgAAARg"]
[Tue Mar 03 02:36:41.988206 2026] [:error] [pid 60214:tid 60238] [client 13.71.189.74:6093] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaXYuYmuQ_v4S3RkLis-NgAAARY"]
[Tue Mar 03 02:36:42.426746 2026] [:error] [pid 60214:tid 60237] [client 13.71.189.74:6083] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolf-shell.php"] [unique_id "aaXYuomuQ_v4S3RkLis-OQAAARU"]
[Tue Mar 03 02:36:42.844265 2026] [:error] [pid 60214:tid 60230] [client 13.71.189.74:6018] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaXYuomuQ_v4S3RkLis-PgAAAQ4"]
[Tue Mar 03 02:36:43.265270 2026] [:error] [pid 18960:tid 18974] [client 13.71.189.74:6131] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaXYu9Cu09icM9oIHwAL_AAAAMs"]
[Tue Mar 03 02:36:43.704764 2026] [:error] [pid 18557:tid 18843] [client 13.71.189.74:6036] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaXYu9ngZqR9Tp8JM0Fy1wAAAFQ"]
[Tue Mar 03 02:36:44.133514 2026] [:error] [pid 60214:tid 60225] [client 13.71.189.74:6082] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaXYvImuQ_v4S3RkLis-SQAAAQk"]
[Tue Mar 03 02:36:44.550052 2026] [:error] [pid 60214:tid 60216] [client 13.71.189.74:6133] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaXYvImuQ_v4S3RkLis-TgAAAQA"]
[Tue Mar 03 02:36:44.977926 2026] [:error] [pid 60214:tid 60217] [client 13.71.189.74:6092] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaXYvImuQ_v4S3RkLis-VwAAAQE"]
[Tue Mar 03 02:36:45.396001 2026] [:error] [pid 60214:tid 60231] [client 13.71.189.74:6089] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaXYvYmuQ_v4S3RkLis-XgAAAQ8"]
[Tue Mar 03 02:36:45.813297 2026] [:error] [pid 18960:tid 18980] [client 13.71.189.74:6119] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaXYvdCu09icM9oIHwAMAgAAANE"]
[Tue Mar 03 02:36:46.224015 2026] [:error] [pid 18960:tid 18985] [client 13.71.189.74:6028] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaXYvtCu09icM9oIHwAMBAAAANY"]
[Tue Mar 03 02:36:46.642674 2026] [:error] [pid 18960:tid 18963] [client 13.71.189.74:6126] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaXYvtCu09icM9oIHwAMBwAAAMA"]
[Tue Mar 03 02:36:47.073197 2026] [:error] [pid 18558:tid 18870] [client 13.71.189.74:5777] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaXYv7O1kQHjTOLioCnhUAAAAJA"]
[Tue Mar 03 02:36:47.489102 2026] [:error] [pid 60214:tid 60226] [client 13.71.189.74:6071] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaXYv4muQ_v4S3RkLis-YwAAAQo"]
[Tue Mar 03 02:36:47.905316 2026] [:error] [pid 18556:tid 18770] [client 13.71.189.74:6086] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php"] [unique_id "aaXYv39AYyTTd2eEk9FQWQAAAA8"]
[Tue Mar 03 02:36:48.328363 2026] [:error] [pid 18960:tid 18970] [client 13.71.189.74:6091] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php"] [unique_id "aaXYwNCu09icM9oIHwAMCwAAAMc"]
[Tue Mar 03 02:36:48.746700 2026] [:error] [pid 60214:tid 60238] [client 13.71.189.74:6034] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php"] [unique_id "aaXYwImuQ_v4S3RkLis-aQAAARY"]
[Tue Mar 03 02:36:49.182213 2026] [:error] [pid 18558:tid 18874] [client 13.71.189.74:6117] [client 13.71.189.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php"] [unique_id "aaXYwbO1kQHjTOLioCnhVQAAAJQ"]
[Tue Mar 03 02:49:32.956797 2026] [:error] [pid 18557:tid 18847] [client 20.151.217.152:23297] [client 20.151.217.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/cah.php"] [unique_id "aaXbvNngZqR9Tp8JM0F2RQAAAFg"]
[Tue Mar 03 02:49:42.029628 2026] [:error] [pid 18960:tid 18973] [client 20.151.217.152:23381] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaXbxtCu09icM9oIHwAUjwAAAMo"]
[Tue Mar 03 02:49:42.455997 2026] [:error] [pid 18556:tid 18753] [client 20.151.217.152:23361] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaXbxn9AYyTTd2eEk9FS_QAAAAA"]
[Tue Mar 03 02:49:42.879841 2026] [:error] [pid 18557:tid 18837] [client 20.151.217.152:23401] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as1337.php"] [unique_id "aaXbxtngZqR9Tp8JM0F2YgAAAE4"]
[Tue Mar 03 02:49:43.313924 2026] [:error] [pid 18557:tid 18841] [client 20.151.217.152:23373] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaXbx9ngZqR9Tp8JM0F2ZAAAAFI"]
[Tue Mar 03 02:49:43.729434 2026] [:error] [pid 18557:tid 18826] [client 20.151.217.152:23304] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaXbx9ngZqR9Tp8JM0F2ZQAAAEQ"]
[Tue Mar 03 02:49:44.137952 2026] [:error] [pid 60214:tid 60238] [client 20.151.217.152:23376] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaXbyImuQ_v4S3RkLitIfQAAARY"]
[Tue Mar 03 02:49:44.554756 2026] [:error] [pid 18556:tid 18759] [client 20.151.217.152:23410] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "aaXbyH9AYyTTd2eEk9FTBQAAAAQ"]
[Tue Mar 03 02:49:44.971283 2026] [:error] [pid 18960:tid 18981] [client 20.151.217.152:23385] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaXbyNCu09icM9oIHwAUlwAAANI"]
[Tue Mar 03 02:49:45.383073 2026] [:error] [pid 18960:tid 18976] [client 20.151.217.152:23301] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaXbydCu09icM9oIHwAUmgAAAM0"]
[Tue Mar 03 02:49:45.802295 2026] [:error] [pid 18960:tid 18971] [client 20.151.217.152:23314] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaXbydCu09icM9oIHwAUnwAAAMg"]
[Tue Mar 03 02:49:46.219214 2026] [:error] [pid 18960:tid 18985] [client 20.151.217.152:23316] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zeal.php"] [unique_id "aaXbytCu09icM9oIHwAUoAAAANY"]
[Tue Mar 03 02:49:46.630279 2026] [:error] [pid 18558:tid 18877] [client 20.151.217.152:23246] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaXbyrO1kQHjTOLioCnmsQAAAJc"]
[Tue Mar 03 02:49:47.053088 2026] [:error] [pid 18960:tid 18979] [client 20.151.217.152:23364] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaXby9Cu09icM9oIHwAUpgAAANA"]
[Tue Mar 03 02:49:47.470072 2026] [:error] [pid 18960:tid 18980] [client 20.151.217.152:23409] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaXby9Cu09icM9oIHwAUpwAAANE"]
[Tue Mar 03 02:49:47.888866 2026] [:error] [pid 60214:tid 60232] [client 20.151.217.152:23418] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asf.php"] [unique_id "aaXby4muQ_v4S3RkLitIiQAAARA"]
[Tue Mar 03 02:49:48.318046 2026] [:error] [pid 60214:tid 60218] [client 20.151.217.152:23391] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php"] [unique_id "aaXbzImuQ_v4S3RkLitIjAAAAQI"]
[Tue Mar 03 02:49:48.736838 2026] [:error] [pid 60214:tid 60219] [client 20.151.217.152:23406] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php"] [unique_id "aaXbzImuQ_v4S3RkLitIjwAAAQM"]
[Tue Mar 03 02:49:49.155064 2026] [:error] [pid 18558:tid 18877] [client 20.151.217.152:23420] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php"] [unique_id "aaXbzbO1kQHjTOLioCnmtgAAAJc"]
[Tue Mar 03 02:49:49.570910 2026] [:error] [pid 18558:tid 18860] [client 20.151.217.152:23305] [client 20.151.217.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php"] [unique_id "aaXbzbO1kQHjTOLioCnmtwAAAIY"]
[Tue Mar 03 04:42:37.672998 2026] [:error] [pid 20872:tid 20887] [client 43.130.3.120:58786] [client 43.130.3.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaX2PYlYbNk3E_3CgBhO6QAAAQ0"]
[Tue Mar 03 09:49:58.181543 2026] [:error] [pid 36897:tid 36923] [client 170.106.163.84:53358] [client 170.106.163.84] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaY-RiZC69_8eM0UousfCAAAANU"]
[Tue Mar 03 12:35:32.756745 2026] [:error] [pid 36784:tid 36842] [client 189.201.251.177:49044] [client 189.201.251.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.201.251.177, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaZlFHNeKOSGbW9kDgQaGAAAAFM"]
[Tue Mar 03 13:43:45.884645 2026] [:error] [pid 36897:tid 36919] [client 51.38.104.193:60398] [client 51.38.104.193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/cidaas-pro-master/composer.json"] [unique_id "aaZ1ESZC69_8eM0UouuMUwAAANE"]
[Tue Mar 03 15:31:33.784140 2026] [:error] [pid 36897:tid 36915] [client 103.135.62.185:60413] [client 103.135.62.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.135.62.185, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaaOVSZC69_8eM0UouvAQwAAAM0"]
[Tue Mar 03 15:34:54.949140 2026] [:error] [pid 36785:tid 36857] [client 103.135.62.185:63438] [client 103.135.62.185] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaaPHnhJejauENG9qTg1qwAAAIc"]
[Tue Mar 03 15:36:34.144463 2026] [:error] [pid 36897:tid 36917] [client 103.135.62.185:64974] [client 103.135.62.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.135.62.185, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaaPgiZC69_8eM0UouvClwAAAM8"]
[Tue Mar 03 15:37:48.960801 2026] [:error] [pid 14042:tid 14068] [client 103.135.62.185:49552] [client 103.135.62.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.135.62.185, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaaPzGeHGCmSEiIBcK44YgAAAZg"]
[Tue Mar 03 15:39:02.528328 2026] [:error] [pid 36784:tid 36838] [client 103.135.62.185:50238] [client 103.135.62.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.135.62.185, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaaQFnNeKOSGbW9kDgRqygAAAE8"]
[Tue Mar 03 15:39:02.531921 2026] [:error] [pid 36784:tid 36838] [client 103.135.62.185:50238] [client 103.135.62.185] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1adminadmin%wppass_u%title0x683866dadescription0x683866damt_keywords0x683866damt_excerpt0x683866da1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaaQFnNeKOSGbW9kDgRqygAAAE8"]
[Tue Mar 03 15:40:21.796642 2026] [:error] [pid 14042:tid 14062] [client 103.135.62.185:50718] [client 103.135.62.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.135.62.185, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaaQZWeHGCmSEiIBcK443wAAAZI"]
[Tue Mar 03 16:21:03.403335 2026] [:error] [pid 36785:tid 36858] [client 209.87.169.134:21915] [client 209.87.169.134] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "aaaZ73hJejauENG9qThSSwAAAIg"]
[Tue Mar 03 17:48:21.802287 2026] [:error] [pid 36785:tid 36872] [client 43.135.182.95:48500] [client 43.135.182.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaauZXhJejauENG9qTiLcwAAAJY"]
[Tue Mar 03 22:11:33.671480 2026] [:error] [pid 14042:tid 14047] [client 178.16.53.90:59392] [client 178.16.53.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aabsFWeHGCmSEiIBcK6BKwAAAYM"]
[Wed Mar 04 00:12:58.896095 2026] [:error] [pid 36897:tid 36920] [client 20.151.116.226:21720] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aacIiiZC69_8eM0UouvlSAAAANI"]
[Wed Mar 04 00:12:59.737779 2026] [:error] [pid 26186:tid 26207] [client 20.151.116.226:21753] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aacIi_bZCNtk8wDak9fqUgAAAVM"]
[Wed Mar 04 00:13:00.572075 2026] [:error] [pid 36897:tid 36911] [client 20.151.116.226:21642] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aacIjCZC69_8eM0UouvlTwAAAMk"]
[Wed Mar 04 00:13:01.409086 2026] [:error] [pid 36785:tid 36851] [client 20.151.116.226:21636] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aacIjXhJejauENG9qTg-IQAAAIE"]
[Wed Mar 04 00:44:38.880093 2026] [:error] [pid 48406:tid 48672] [client 108.165.164.21:60864] [client 108.165.164.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.165.164.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aacP9jStn8zJHlZMxFgF9QAAAEo"], referer: https://www.google.com/
[Wed Mar 04 00:44:40.471556 2026] [:error] [pid 48406:tid 48683] [client 108.165.164.21:60864] [client 108.165.164.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacP-DStn8zJHlZMxFgF-wAAAFU"]
[Wed Mar 04 00:44:41.484574 2026] [:error] [pid 48407:tid 48715] [client 108.165.164.21:62725] [client 108.165.164.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacP-T7Td6SiHn8fwfm7IAAAAJg"]
[Wed Mar 04 00:44:42.477038 2026] [:error] [pid 48807:tid 48809] [client 108.165.164.21:63183] [client 108.165.164.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacP-g9v35BN-51vqYZc1wAAAQA"]
[Wed Mar 04 00:44:43.466266 2026] [:error] [pid 48807:tid 48812] [client 108.165.164.21:63641] [client 108.165.164.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacP-w9v35BN-51vqYZc3AAAAQM"]
[Wed Mar 04 00:44:44.459612 2026] [:error] [pid 48407:tid 48704] [client 108.165.164.21:64050] [client 108.165.164.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacP_D7Td6SiHn8fwfm7JwAAAI0"]
[Wed Mar 04 00:44:45.445754 2026] [:error] [pid 48807:tid 48819] [client 108.165.164.21:64479] [client 108.165.164.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacP_Q9v35BN-51vqYZc4gAAAQo"]
[Wed Mar 04 00:44:46.436793 2026] [:error] [pid 48407:tid 48692] [client 108.165.164.21:64837] [client 108.165.164.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacP_j7Td6SiHn8fwfm7LgAAAII"]
[Wed Mar 04 00:44:47.433936 2026] [:error] [pid 48407:tid 48690] [client 108.165.164.21:65260] [client 108.165.164.21] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacP_z7Td6SiHn8fwfm7MgAAAIE"]
[Wed Mar 04 00:46:27.553755 2026] [:error] [pid 48407:tid 48713] [client 34.55.19.246:51972] [client 34.55.19.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.55.19.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacQYz7Td6SiHn8fwfm8MQAAAJY"]
[Wed Mar 04 00:46:29.807987 2026] [:error] [pid 48407:tid 48689] [client 34.55.19.246:51972] [client 34.55.19.246] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aacQZT7Td6SiHn8fwfm8OQAAAIA"]
[Wed Mar 04 00:46:30.022036 2026] [:error] [pid 48407:tid 48711] [client 34.55.19.246:51972] [client 34.55.19.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.55.19.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacQZj7Td6SiHn8fwfm8OgAAAJQ"]
[Wed Mar 04 00:46:31.468239 2026] [:error] [pid 48407:tid 48699] [client 34.55.19.246:58267] [client 34.55.19.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.55.19.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacQZz7Td6SiHn8fwfm8QAAAAIk"]
[Wed Mar 04 00:46:32.984912 2026] [:error] [pid 48407:tid 48700] [client 34.55.19.246:56719] [client 34.55.19.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.55.19.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacQaD7Td6SiHn8fwfm8RQAAAIo"]
[Wed Mar 04 00:46:34.462721 2026] [:error] [pid 48807:tid 48810] [client 34.55.19.246:56507] [client 34.55.19.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.55.19.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacQag9v35BN-51vqYZecgAAAQE"]
[Wed Mar 04 00:46:35.880954 2026] [:error] [pid 48807:tid 48819] [client 34.55.19.246:53174] [client 34.55.19.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.55.19.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacQaw9v35BN-51vqYZedwAAAQo"]
[Wed Mar 04 00:46:35.881154 2026] [:error] [pid 48807:tid 48819] [client 34.55.19.246:53174] [client 34.55.19.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.55.19.246, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacQaw9v35BN-51vqYZedwAAAQo"]
[Wed Mar 04 01:19:28.182593 2026] [:error] [pid 48807:tid 48814] [client 136.119.28.98:54195] [client 136.119.28.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.119.28.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacYIA9v35BN-51vqYZ5gQAAAQU"]
[Wed Mar 04 01:19:30.390226 2026] [:error] [pid 48807:tid 48820] [client 136.119.28.98:54195] [client 136.119.28.98] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aacYIg9v35BN-51vqYZ5jQAAAQs"]
[Wed Mar 04 01:19:30.602698 2026] [:error] [pid 48807:tid 48827] [client 136.119.28.98:54195] [client 136.119.28.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.119.28.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacYIg9v35BN-51vqYZ5jwAAARI"]
[Wed Mar 04 01:31:00.264504 2026] [:error] [pid 48407:tid 48703] [client 157.85.210.215:6001] [client 157.85.210.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.85.210.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaca1D7Td6SiHn8fwfnS4AAAAIw"]
[Wed Mar 04 01:31:15.746609 2026] [:error] [pid 48407:tid 48694] [client 1.32.55.125:59408] [client 1.32.55.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 1.32.55.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaca4z7Td6SiHn8fwfnS9gAAAIQ"]
[Wed Mar 04 02:32:00.749706 2026] [:error] [pid 27359:tid 27369] [client 157.85.210.215:4681] [client 157.85.210.215] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aacpIF607jzBiSmoFjIpIwAAAMg"]
[Wed Mar 04 02:33:20.184142 2026] [:error] [pid 48406:tid 48680] [client 157.85.210.215:4154] [client 157.85.210.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.85.210.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacpcDStn8zJHlZMxFgmYgAAAFI"]
[Wed Mar 04 02:34:29.924247 2026] [:error] [pid 27359:tid 27363] [client 157.85.210.215:4005] [client 157.85.210.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.85.210.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacptV607jzBiSmoFjIqwAAAAMI"]
[Wed Mar 04 02:35:35.633067 2026] [:error] [pid 27359:tid 27364] [client 157.85.210.215:4169] [client 157.85.210.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.85.210.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacp91607jzBiSmoFjIrWgAAAMM"]
[Wed Mar 04 02:36:37.784833 2026] [:error] [pid 48807:tid 48813] [client 157.85.210.215:4194] [client 157.85.210.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.85.210.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacqNQ9v35BN-51vqYaixQAAAQQ"]
[Wed Mar 04 02:37:35.791264 2026] [:error] [pid 27359:tid 27375] [client 157.85.210.215:1509] [client 157.85.210.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.85.210.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aacqb1607jzBiSmoFjIslAAAAM4"]
[Wed Mar 04 03:21:30.482121 2026] [:error] [pid 48407:tid 48689] [client 20.220.211.162:1477] [client 20.220.211.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aac0uj7Td6SiHn8fwfn8FAAAAIA"]
[Wed Mar 04 03:21:31.313113 2026] [:error] [pid 48807:tid 48813] [client 20.220.211.162:2000] [client 20.220.211.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aac0uw9v35BN-51vqYa5WwAAAQQ"]
[Wed Mar 04 03:21:32.156364 2026] [:error] [pid 48405:tid 48570] [client 20.220.211.162:1510] [client 20.220.211.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aac0vBBIGeGp5MBz7gKJ1gAAAAE"]
[Wed Mar 04 03:21:33.142040 2026] [:error] [pid 48807:tid 48819] [client 20.220.211.162:2001] [client 20.220.211.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aac0vQ9v35BN-51vqYa5YAAAAQo"]
[Wed Mar 04 03:44:24.441967 2026] [:error] [pid 14052:tid 14058] [client 170.106.187.106:51572] [client 170.106.187.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aac6GHvGZB0eU0P5_AtNlwAAAMI"]
[Wed Mar 04 03:49:41.722402 2026] [:error] [pid 52572:tid 52624] [client 20.151.116.226:21818] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aac7VeO58U4PQgPkphjHbAAAAFY"]
[Wed Mar 04 03:49:42.560129 2026] [:error] [pid 52662:tid 52667] [client 20.151.116.226:21778] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aac7VhbmiwfmdbW7NopmgwAAAMM"]
[Wed Mar 04 03:49:43.391655 2026] [:error] [pid 52662:tid 52671] [client 20.151.116.226:21765] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aac7VxbmiwfmdbW7NopmiQAAAMc"]
[Wed Mar 04 03:49:44.218360 2026] [:error] [pid 52662:tid 52688] [client 20.151.116.226:21796] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "aac7WBbmiwfmdbW7NopmjAAAANg"]
[Wed Mar 04 04:04:20.962217 2026] [autoindex:error] [pid 18553:tid 18564] [client 62.171.170.202:62976] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Mar 04 04:13:01.100088 2026] [:error] [pid 18555:tid 18625] [client 20.127.131.187:21094] [client 20.127.131.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aadAzTQeUDANiOsQ3GdZJwAAAIY"]
[Wed Mar 04 04:13:01.938325 2026] [:error] [pid 18555:tid 18631] [client 20.127.131.187:21111] [client 20.127.131.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aadAzTQeUDANiOsQ3GdZLAAAAIw"]
[Wed Mar 04 04:13:02.822513 2026] [:error] [pid 18554:tid 18598] [client 20.127.131.187:21080] [client 20.127.131.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aadAzp0fKmKeTIK7QS1qJAAAAEY"]
[Wed Mar 04 04:13:03.708732 2026] [:error] [pid 18555:tid 18629] [client 20.127.131.187:21099] [client 20.127.131.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aadAzzQeUDANiOsQ3GdZMgAAAIo"]
[Wed Mar 04 04:19:04.558269 2026] [:error] [pid 18553:tid 18576] [client 51.254.34.62:47710] [client 51.254.34.62] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aadCOGbax1neh8d0AHZ7igAAAAw"]
[Wed Mar 04 04:19:06.918148 2026] [:error] [pid 54487:tid 54505] [client 103.82.22.214:42486] [client 103.82.22.214] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aadCOvN8030QMpFXddvdggAAARA"]
[Wed Mar 04 04:25:26.175873 2026] [:error] [pid 18555:tid 18620] [client 61.5.147.157:15584] [client 61.5.147.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 61.5.147.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aadDtjQeUDANiOsQ3GdcpAAAAIE"]
[Wed Mar 04 04:31:13.457354 2026] [:error] [pid 18554:tid 18609] [client 61.5.147.157:14508] [client 61.5.147.157] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aadFEZ0fKmKeTIK7QS1zdwAAAFE"]
[Wed Mar 04 04:32:57.201303 2026] [:error] [pid 18554:tid 18598] [client 61.5.147.157:15566] [client 61.5.147.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 61.5.147.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aadFeZ0fKmKeTIK7QS10MgAAAEY"]
[Wed Mar 04 04:56:36.540452 2026] [:error] [pid 18554:tid 18593] [client 182.44.10.67:44223] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aadLBJ0fKmKeTIK7QS2BDAAAAEE"]
[Wed Mar 04 06:47:44.144538 2026] [autoindex:error] [pid 18554:tid 18599] [client 52.252.56.196:63504] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Mar 04 06:47:51.423704 2026] [:error] [pid 18554:tid 18606] [client 52.252.56.196:63504] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx1.php"] [unique_id "aadlF50fKmKeTIK7QS26fgAAAE4"]
[Wed Mar 04 06:47:52.346053 2026] [:error] [pid 54487:tid 54512] [client 52.252.56.196:62087] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "aadlGPN8030QMpFXddtFfgAAARc"]
[Wed Mar 04 06:47:53.715735 2026] [:error] [pid 18681:tid 18697] [client 52.252.56.196:56562] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aadlGaE_TuZYUBveWkWqiwAAAM4"]
[Wed Mar 04 06:47:54.414619 2026] [:error] [pid 18681:tid 18687] [client 52.252.56.196:62157] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aadlGqE_TuZYUBveWkWqjQAAAMQ"]
[Wed Mar 04 06:47:55.292969 2026] [:error] [pid 54487:tid 54508] [client 52.252.56.196:64903] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aadlG_N8030QMpFXddtFiAAAARM"]
[Wed Mar 04 06:47:56.269096 2026] [:error] [pid 18681:tid 18690] [client 52.252.56.196:63525] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "aadlHKE_TuZYUBveWkWqkgAAAMc"]
[Wed Mar 04 06:47:57.077004 2026] [:error] [pid 54487:tid 54495] [client 52.252.56.196:56514] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "aadlHfN8030QMpFXddtFiQAAAQY"]
[Wed Mar 04 06:47:58.120561 2026] [:error] [pid 18554:tid 18611] [client 52.252.56.196:63524] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aadlHp0fKmKeTIK7QS26pAAAAFM"]
[Wed Mar 04 06:48:00.280384 2026] [:error] [pid 54487:tid 54502] [client 52.252.56.196:64980] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aadlIPN8030QMpFXddtFkAAAAQ0"]
[Wed Mar 04 06:48:02.719586 2026] [:error] [pid 18553:tid 18582] [client 52.252.56.196:63578] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gtc.php"] [unique_id "aadlImbax1neh8d0AHaVZQAAABI"]
[Wed Mar 04 06:48:03.161953 2026] [:error] [pid 18681:tid 18703] [client 52.252.56.196:63561] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gtc.php"] [unique_id "aadlI6E_TuZYUBveWkWqmQAAANQ"]
[Wed Mar 04 06:48:04.063978 2026] [:error] [pid 18554:tid 18614] [client 52.252.56.196:56453] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atx.php"] [unique_id "aadlJJ0fKmKeTIK7QS26sAAAAFY"]
[Wed Mar 04 06:48:05.103082 2026] [:error] [pid 54487:tid 54493] [client 52.252.56.196:63584] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atx.php"] [unique_id "aadlJfN8030QMpFXddtFpQAAAQQ"]
[Wed Mar 04 06:48:13.149518 2026] [:error] [pid 18553:tid 18581] [client 52.252.56.196:63571] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atx.php"] [unique_id "aadlLWbax1neh8d0AHaVaQAAABE"]
[Wed Mar 04 06:48:13.690630 2026] [:error] [pid 18554:tid 18597] [client 52.252.56.196:62119] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atx.php"] [unique_id "aadlLZ0fKmKeTIK7QS265QAAAEU"]
[Wed Mar 04 06:48:14.473404 2026] [:error] [pid 18554:tid 18607] [client 52.252.56.196:63537] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aadlLp0fKmKeTIK7QS266gAAAE8"]
[Wed Mar 04 06:48:16.098198 2026] [:error] [pid 18554:tid 18598] [client 52.252.56.196:65013] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aadlMJ0fKmKeTIK7QS269QAAAEY"]
[Wed Mar 04 06:48:16.579594 2026] [:error] [pid 18555:tid 18630] [client 52.252.56.196:65007] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aadlMDQeUDANiOsQ3Gd73QAAAIs"]
[Wed Mar 04 06:48:17.710401 2026] [:error] [pid 18554:tid 18597] [client 52.252.56.196:56462] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "aadlMZ0fKmKeTIK7QS26_wAAAEU"]
[Wed Mar 04 06:48:18.776846 2026] [:error] [pid 18554:tid 18599] [client 52.252.56.196:62149] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aadlMp0fKmKeTIK7QS27BQAAAEc"]
[Wed Mar 04 06:48:20.456081 2026] [:error] [pid 18554:tid 18616] [client 52.252.56.196:63607] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aadlNJ0fKmKeTIK7QS27CgAAAFg"]
[Wed Mar 04 06:48:21.392934 2026] [:error] [pid 18681:tid 18699] [client 52.252.56.196:62086] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aadlNaE_TuZYUBveWkWqrAAAANA"]
[Wed Mar 04 06:48:23.554192 2026] [:error] [pid 18681:tid 18697] [client 52.252.56.196:62152] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/wp-conflg.php"] [unique_id "aadlN6E_TuZYUBveWkWqswAAAM4"]
[Wed Mar 04 06:48:25.664295 2026] [:error] [pid 18681:tid 18684] [client 52.252.56.196:62173] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aadlOaE_TuZYUBveWkWqugAAAME"]
[Wed Mar 04 06:48:26.850558 2026] [:error] [pid 18554:tid 18610] [client 52.252.56.196:63538] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aadlOp0fKmKeTIK7QS27HAAAAFI"]
[Wed Mar 04 06:48:27.466354 2026] [:error] [pid 54487:tid 54510] [client 52.252.56.196:62088] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aadlO_N8030QMpFXddtF1gAAARU"]
[Wed Mar 04 06:48:28.000625 2026] [:error] [pid 18553:tid 18575] [client 52.252.56.196:47810] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aadlO2bax1neh8d0AHaVhAAAAAs"]
[Wed Mar 04 06:48:28.805948 2026] [:error] [pid 18681:tid 18693] [client 52.252.56.196:56538] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aadlPKE_TuZYUBveWkWqwAAAAMo"]
[Wed Mar 04 06:48:29.354353 2026] [:error] [pid 18681:tid 18702] [client 52.252.56.196:63580] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aadlPaE_TuZYUBveWkWqwQAAANM"]
[Wed Mar 04 06:48:30.052405 2026] [:error] [pid 18681:tid 18691] [client 52.252.56.196:63564] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/admin.php"] [unique_id "aadlPqE_TuZYUBveWkWqxAAAAMg"]
[Wed Mar 04 06:48:30.520289 2026] [:error] [pid 18681:tid 18686] [client 52.252.56.196:64916] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/admin.php"] [unique_id "aadlPqE_TuZYUBveWkWqxQAAAMM"]
[Wed Mar 04 06:48:30.977891 2026] [:error] [pid 18553:tid 18585] [client 52.252.56.196:62194] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/admin.php"] [unique_id "aadlPmbax1neh8d0AHaVjgAAABU"]
[Wed Mar 04 06:48:31.406263 2026] [:error] [pid 18681:tid 18696] [client 52.252.56.196:64999] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/admin.php"] [unique_id "aadlP6E_TuZYUBveWkWqyAAAAM0"]
[Wed Mar 04 06:48:32.108110 2026] [:error] [pid 18681:tid 18704] [client 52.252.56.196:62094] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core3.php"] [unique_id "aadlQKE_TuZYUBveWkWqzQAAANU"]
[Wed Mar 04 06:48:32.679691 2026] [:error] [pid 18681:tid 18703] [client 52.252.56.196:54955] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core3.php"] [unique_id "aadlQKE_TuZYUBveWkWq0QAAANQ"]
[Wed Mar 04 06:48:33.164216 2026] [:error] [pid 18553:tid 18583] [client 52.252.56.196:62113] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/RxR.php"] [unique_id "aadlQWbax1neh8d0AHaVkgAAABM"]
[Wed Mar 04 06:48:33.660639 2026] [:error] [pid 18553:tid 18588] [client 52.252.56.196:62182] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/RxR.php"] [unique_id "aadlQWbax1neh8d0AHaVlAAAABg"]
[Wed Mar 04 06:48:34.445653 2026] [:error] [pid 18553:tid 18574] [client 52.252.56.196:62170] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/RxR.php"] [unique_id "aadlQmbax1neh8d0AHaVlQAAAAo"]
[Wed Mar 04 06:48:34.990772 2026] [:error] [pid 18554:tid 18597] [client 52.252.56.196:63497] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/RxR.php"] [unique_id "aadlQp0fKmKeTIK7QS27TwAAAEU"]
[Wed Mar 04 06:48:35.500329 2026] [:error] [pid 18555:tid 18619] [client 52.252.56.196:56468] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-etc/quti.php"] [unique_id "aadlQzQeUDANiOsQ3Gd78AAAAIA"]
[Wed Mar 04 06:48:36.118588 2026] [:error] [pid 18554:tid 18593] [client 52.252.56.196:63574] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-etc/quti.php"] [unique_id "aadlRJ0fKmKeTIK7QS27VQAAAEE"]
[Wed Mar 04 06:48:36.549430 2026] [:error] [pid 54487:tid 54493] [client 52.252.56.196:64950] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-etc/quti.php"] [unique_id "aadlRPN8030QMpFXddtF3QAAAQQ"]
[Wed Mar 04 06:48:37.091680 2026] [:error] [pid 54487:tid 54494] [client 52.252.56.196:63567] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-etc/quti.php"] [unique_id "aadlRfN8030QMpFXddtF3gAAAQU"]
[Wed Mar 04 06:48:37.520265 2026] [:error] [pid 18681:tid 18683] [client 52.252.56.196:62158] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system/logs/skin.php"] [unique_id "aadlRaE_TuZYUBveWkWq2AAAAMA"]
[Wed Mar 04 06:48:38.152387 2026] [:error] [pid 18554:tid 18597] [client 52.252.56.196:56512] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system/logs/skin.php"] [unique_id "aadlRp0fKmKeTIK7QS27XgAAAEU"]
[Wed Mar 04 06:48:38.923300 2026] [:error] [pid 18555:tid 18624] [client 52.252.56.196:62100] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system/logs/skin.php"] [unique_id "aadlRjQeUDANiOsQ3Gd7_AAAAIU"]
[Wed Mar 04 06:48:39.849429 2026] [:error] [pid 18681:tid 18695] [client 52.252.56.196:62192] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Gel.php"] [unique_id "aadlR6E_TuZYUBveWkWq2wAAAMw"]
[Wed Mar 04 06:48:41.330873 2026] [:error] [pid 54487:tid 54512] [client 52.252.56.196:65000] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Gel.php"] [unique_id "aadlSfN8030QMpFXddtF5wAAARc"]
[Wed Mar 04 06:48:42.323815 2026] [:error] [pid 18554:tid 18598] [client 52.252.56.196:64992] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Gel.php"] [unique_id "aadlSp0fKmKeTIK7QS27ZwAAAEY"]
[Wed Mar 04 06:48:43.530285 2026] [:error] [pid 18555:tid 18642] [client 52.252.56.196:62131] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pent.php"] [unique_id "aadlSzQeUDANiOsQ3Gd8BQAAAJc"]
[Wed Mar 04 06:48:44.347567 2026] [:error] [pid 18554:tid 18615] [client 52.252.56.196:62136] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pent.php"] [unique_id "aadlTJ0fKmKeTIK7QS27bQAAAFc"]
[Wed Mar 04 06:48:44.875364 2026] [:error] [pid 18554:tid 18598] [client 52.252.56.196:63568] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pent.php"] [unique_id "aadlTJ0fKmKeTIK7QS27bwAAAEY"]
[Wed Mar 04 06:48:45.489231 2026] [:error] [pid 54487:tid 54507] [client 52.252.56.196:64976] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pent.php"] [unique_id "aadlTfN8030QMpFXddtF9QAAARI"]
[Wed Mar 04 06:48:46.113836 2026] [:error] [pid 18554:tid 18611] [client 52.252.56.196:63499] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/moon.php"] [unique_id "aadlTp0fKmKeTIK7QS27dAAAAFM"]
[Wed Mar 04 06:48:46.610703 2026] [:error] [pid 18554:tid 18609] [client 52.252.56.196:62114] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/moon.php"] [unique_id "aadlTp0fKmKeTIK7QS27dgAAAFE"]
[Wed Mar 04 06:48:48.812993 2026] [:error] [pid 18555:tid 18630] [client 52.252.56.196:56469] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/admin/tinymce/plugins/filemanager/dialog.php"] [unique_id "aadlUDQeUDANiOsQ3Gd8DAAAAIs"]
[Wed Mar 04 06:48:49.700195 2026] [:error] [pid 54487:tid 54496] [client 52.252.56.196:65018] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/admin/tinymce/plugins/filemanager/dialog.php"] [unique_id "aadlUfN8030QMpFXddtGBwAAAQc"]
[Wed Mar 04 06:48:53.769069 2026] [:error] [pid 54487:tid 54509] [client 52.252.56.196:65001] [client 52.252.56.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/php-compat/chosen.php"] [unique_id "aadlVfN8030QMpFXddtGOQAAARQ"]
[Wed Mar 04 06:49:02.782653 2026] [:error] [pid 18554:tid 18593] [client 52.252.56.196:64938] [client 52.252.56.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/aaa.php"] [unique_id "aadlXp0fKmKeTIK7QS28LgAAAEE"]
[Wed Mar 04 06:49:04.711732 2026] [:error] [pid 54487:tid 54510] [client 52.252.56.196:63543] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/enviar-recibo.php"] [unique_id "aadlYPN8030QMpFXddtGggAAARU"]
[Wed Mar 04 06:49:05.326036 2026] [:error] [pid 18555:tid 18641] [client 52.252.56.196:63548] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/enviar-recibo.php"] [unique_id "aadlYTQeUDANiOsQ3Gd8GgAAAJY"]
[Wed Mar 04 06:49:05.816104 2026] [:error] [pid 54487:tid 54501] [client 52.252.56.196:64934] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/enviar-recibo.php"] [unique_id "aadlYfN8030QMpFXddtGhwAAAQw"]
[Wed Mar 04 06:49:06.723712 2026] [:error] [pid 18554:tid 18604] [client 52.252.56.196:63610] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/enviar-recibo.php"] [unique_id "aadlYp0fKmKeTIK7QS28NAAAAEw"]
[Wed Mar 04 06:49:07.179325 2026] [:error] [pid 18554:tid 18606] [client 52.252.56.196:62089] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/gallery/20160513-delelott/photo-gallery/thumb/admin.php"] [unique_id "aadlY50fKmKeTIK7QS28NwAAAE4"]
[Wed Mar 04 06:49:11.051133 2026] [:error] [pid 18554:tid 18608] [client 52.252.56.196:56536] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/gallery/20160513-delelott/photo-gallery/thumb/admin.php"] [unique_id "aadlZ50fKmKeTIK7QS28RAAAAFA"]
[Wed Mar 04 06:49:11.916622 2026] [:error] [pid 54487:tid 54507] [client 52.252.56.196:62202] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/gallery/20160513-delelott/photo-gallery/thumb/admin.php"] [unique_id "aadlZ_N8030QMpFXddtGlQAAARI"]
[Wed Mar 04 06:49:13.412156 2026] [:error] [pid 18554:tid 18609] [client 52.252.56.196:64984] [client 52.252.56.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/gallery/20160513-delelott/photo-gallery/thumb/admin.php"] [unique_id "aadlaZ0fKmKeTIK7QS28SwAAAFE"]
[Wed Mar 04 07:27:58.332733 2026] [:error] [pid 18554:tid 18613] [client 20.151.116.226:22473] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/function.php"] [unique_id "aadufp0fKmKeTIK7QS3bngAAAFU"]
[Wed Mar 04 07:27:59.178976 2026] [:error] [pid 18553:tid 18587] [client 20.151.116.226:22447] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/function.php"] [unique_id "aaduf2bax1neh8d0AHabpgAAABc"]
[Wed Mar 04 07:28:00.015080 2026] [:error] [pid 18554:tid 18609] [client 20.151.116.226:22427] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/function.php"] [unique_id "aadugJ0fKmKeTIK7QS3bpgAAAFE"]
[Wed Mar 04 07:28:00.864926 2026] [:error] [pid 54487:tid 54506] [client 20.151.116.226:22449] [client 20.151.116.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/function.php"] [unique_id "aadugPN8030QMpFXddtajQAAARE"]
[Wed Mar 04 08:07:04.351446 2026] [:error] [pid 54487:tid 54502] [client 103.77.107.204:52509] [client 103.77.107.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.77.107.204, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aad3qPN8030QMpFXddttIwAAAQ0"]
[Wed Mar 04 08:59:38.284802 2026] [:error] [pid 54487:tid 54509] [client 43.130.14.245:34700] [client 43.130.14.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaeD-vN8030QMpFXdduYqQAAARQ"]
[Wed Mar 04 10:01:42.398497 2026] [:error] [pid 18555:tid 18633] [client 137.116.32.109:6028] [client 137.116.32.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aaeShjQeUDANiOsQ3GesnQAAAI4"]
[Wed Mar 04 10:48:24.276969 2026] [:error] [pid 54487:tid 54511] [client 43.140.247.223:58122] [client 43.140.247.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaedePN8030QMpFXddsM3QAAARY"]
[Wed Mar 04 11:13:19.391882 2026] [:error] [pid 54487:tid 54498] [client 113.165.49.234:52013] [client 113.165.49.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 113.165.49.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaejT_N8030QMpFXddsl1wAAAQk"], referer: https://expressinteriors.com/
[Wed Mar 04 12:05:59.189790 2026] [:error] [pid 18554:tid 18603] [client 143.14.6.165:47095] [client 143.14.6.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.14.6.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaevp50fKmKeTIK7QS2TTwAAAEs"]
[Wed Mar 04 13:01:37.139435 2026] [:error] [pid 18553:tid 18580] [client 43.228.157.73:52583] [client 43.228.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aae8sWbax1neh8d0AHbO5wAAABA"]
[Wed Mar 04 13:01:37.705732 2026] [:error] [pid 54487:tid 54507] [client 43.228.157.73:52787] [client 43.228.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aae8sfN8030QMpFXddteHgAAARI"]
[Wed Mar 04 13:01:38.290797 2026] [:error] [pid 18681:tid 18688] [client 43.228.157.73:52997] [client 43.228.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aae8sqE_TuZYUBveWkUpZAAAAMU"]
[Wed Mar 04 13:01:38.867258 2026] [:error] [pid 18554:tid 18609] [client 43.228.157.73:53189] [client 43.228.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aae8sp0fKmKeTIK7QS3LyQAAAFE"]
[Wed Mar 04 13:01:39.441261 2026] [:error] [pid 18681:tid 18688] [client 43.228.157.73:53364] [client 43.228.157.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aae8s6E_TuZYUBveWkUpmgAAAMU"]
[Wed Mar 04 14:03:34.034231 2026] [:error] [pid 59835:tid 59847] [client 43.130.31.17:50634] [client 43.130.31.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aafLNlQB6c0LN1Nf01Cu4gAAAMc"]
[Wed Mar 04 15:07:16.410943 2026] [:error] [pid 51359:tid 51469] [client 23.111.179.58:39437] [client 23.111.179.58] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aafaJPeZtYUOh-itqcqDrwAAAIY"]
[Wed Mar 04 15:52:54.330732 2026] [:error] [pid 51510:tid 51533] [client 1.32.46.65:50629] [client 1.32.46.65] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aafk1n-78MmWmoTGI7tUcQAAARQ"]
[Wed Mar 04 15:55:14.250994 2026] [:error] [pid 59835:tid 59864] [client 1.32.46.65:50563] [client 1.32.46.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 1.32.46.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaflYlQB6c0LN1Nf01AGjwAAANc"]
[Wed Mar 04 15:57:17.522454 2026] [:error] [pid 51357:tid 51416] [client 1.32.46.65:51944] [client 1.32.46.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 1.32.46.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aafl3Wimsh8xS8jkf2hMfgAAAA8"]
[Wed Mar 04 15:58:11.947114 2026] [:error] [pid 51358:tid 51448] [client 43.135.148.92:41992] [client 43.135.148.92] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aafmE1DC2WZyp0MMf73ZlwAAAEw"]
[Wed Mar 04 15:59:20.396738 2026] [:error] [pid 51358:tid 51439] [client 1.32.46.65:52858] [client 1.32.46.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 1.32.46.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aafmWFDC2WZyp0MMf73aWgAAAEM"]
[Wed Mar 04 16:01:01.831811 2026] [:error] [pid 59835:tid 59841] [client 1.32.46.65:60069] [client 1.32.46.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 1.32.46.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aafmvVQB6c0LN1Nf01AKuwAAAME"]
[Wed Mar 04 16:02:58.887614 2026] [:error] [pid 51359:tid 51473] [client 1.32.46.65:53289] [client 1.32.46.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 1.32.46.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aafnMveZtYUOh-itqcqXGgAAAIo"]
[Wed Mar 04 16:14:43.652564 2026] [:error] [pid 59835:tid 59861] [client 188.27.87.143:51597] [client 188.27.87.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.27.87.143, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aafp81QB6c0LN1Nf01ATpAAAANQ"]
[Wed Mar 04 17:15:41.734689 2026] [:error] [pid 63356:tid 63372] [client 125.75.66.97:53389] [client 125.75.66.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaf4Pc5gxyQKbLIoyf-76AAAAE4"]
[Wed Mar 04 17:54:11.098247 2026] [:error] [pid 61225:tid 61261] [client 216.75.132.104:33449] [client 216.75.132.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.75.132.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aagBQ4FRsPGnBbt4lyREBgAAABQ"]
[Wed Mar 04 20:52:03.205763 2026] [:error] [pid 60730:tid 60752] [client 170.106.180.246:36802] [client 170.106.180.246] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aagq80eC7wxPGxvN8ZgbdgAAAVQ"]
[Wed Mar 04 21:12:13.086128 2026] [:error] [pid 64829:tid 64838] [client 117.238.109.49:64500] [client 117.238.109.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.238.109.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aagvrZ9ZED3FG9h7uij61wAAAAc"]
[Wed Mar 04 21:15:54.156160 2026] [:error] [pid 60621:tid 60676] [client 117.238.109.49:50980] [client 117.238.109.49] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aagwilfRSaORpCbdjO2cfgAAAM4"]
[Wed Mar 04 21:17:29.376344 2026] [:error] [pid 64829:tid 64845] [client 117.238.109.49:52110] [client 117.238.109.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.238.109.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aagw6Z9ZED3FG9h7uij-IwAAAA4"]
[Wed Mar 04 21:18:59.237900 2026] [:error] [pid 64829:tid 64854] [client 117.238.109.49:53100] [client 117.238.109.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.238.109.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aagxQ59ZED3FG9h7uij_BgAAABc"]
[Wed Mar 04 21:20:35.361731 2026] [:error] [pid 61723:tid 61748] [client 117.238.109.49:54137] [client 117.238.109.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.238.109.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aagxoz-cYcKSTgnaHK48eQAAAIs"]
[Wed Mar 04 21:22:16.879197 2026] [:error] [pid 61723:tid 61752] [client 117.238.109.49:55526] [client 117.238.109.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.238.109.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aagyCD-cYcKSTgnaHK49gQAAAI8"]
[Wed Mar 04 21:22:16.881016 2026] [:error] [pid 61723:tid 61752] [client 117.238.109.49:55526] [client 117.238.109.49] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aagyCD-cYcKSTgnaHK49gQAAAI8"]
[Wed Mar 04 21:22:16.882432 2026] [:error] [pid 61723:tid 61752] [client 117.238.109.49:55526] [client 117.238.109.49] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aagyCD-cYcKSTgnaHK49gQAAAI8"]
[Wed Mar 04 23:37:46.463630 2026] [:error] [pid 61723:tid 61757] [client 216.75.132.64:40751] [client 216.75.132.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.75.132.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aahRyj-cYcKSTgnaHK6bfgAAAJQ"]
[Thu Mar 05 00:08:30.194445 2026] [:error] [pid 61723:tid 61760] [client 114.80.36.40:38262] [client 114.80.36.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aahY_j-cYcKSTgnaHK6uNAAAAJc"]
[Thu Mar 05 00:43:11.507136 2026] [:error] [pid 27472:tid 27556] [client 35.222.25.176:63385] [client 35.222.25.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.222.25.176, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aahhH7t7N-W1OaN6b8rERwAAAZc"]
[Thu Mar 05 00:43:13.667037 2026] [:error] [pid 27472:tid 27532] [client 35.222.25.176:63385] [client 35.222.25.176] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aahhIbt7N-W1OaN6b8rEUwAAAYE"]
[Thu Mar 05 00:43:13.864354 2026] [:error] [pid 27472:tid 27546] [client 35.222.25.176:63385] [client 35.222.25.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.222.25.176, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aahhIbt7N-W1OaN6b8rEVAAAAY4"]
[Thu Mar 05 00:43:15.381044 2026] [:error] [pid 26969:tid 27051] [client 35.222.25.176:51007] [client 35.222.25.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.222.25.176, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aahhI5lCO2K-E0MVfPPSTgAAAAs"]
[Thu Mar 05 00:43:16.730096 2026] [:error] [pid 27472:tid 27547] [client 35.222.25.176:59069] [client 35.222.25.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.222.25.176, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aahhJLt7N-W1OaN6b8rEWgAAAY8"]
[Thu Mar 05 00:43:18.122220 2026] [:error] [pid 27472:tid 27551] [client 35.222.25.176:57839] [client 35.222.25.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.222.25.176, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aahhJrt7N-W1OaN6b8rEXgAAAZI"]
[Thu Mar 05 00:43:19.492054 2026] [:error] [pid 27814:tid 27887] [client 35.222.25.176:55448] [client 35.222.25.176] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.222.25.176, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aahhJ7Pcbh1BHIHQb9JL2QAAAM0"]
[Thu Mar 05 00:43:19.492210 2026] [:error] [pid 27814:tid 27887] [client 35.222.25.176:55448] [client 35.222.25.176] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.222.25.176, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aahhJ7Pcbh1BHIHQb9JL2QAAAM0"]
[Thu Mar 05 01:48:50.649781 2026] [:error] [pid 26934:tid 26972] [client 43.153.86.78:54016] [client 43.153.86.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aahwgmDWd71V_nuoqWI2NwAAAJE"]
[Thu Mar 05 05:50:36.893815 2026] [:error] [pid 53350:tid 53388] [client 118.148.70.11:62913] [client 118.148.70.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.148.70.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaipLKO0Baxc5WFYeP1lsAAAAQs"]
[Thu Mar 05 05:54:30.011819 2026] [:error] [pid 62177:tid 62327] [client 118.148.70.11:54107] [client 118.148.70.11] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaiqFhWSQc2OzPrsnwUgfAAAAI8"]
[Thu Mar 05 05:55:47.838240 2026] [:error] [pid 53350:tid 53394] [client 118.148.70.11:11278] [client 118.148.70.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.148.70.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaiqY6O0Baxc5WFYeP1oKwAAARE"]
[Thu Mar 05 05:57:02.646418 2026] [:error] [pid 53350:tid 53383] [client 118.148.70.11:32712] [client 118.148.70.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.148.70.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaiqrqO0Baxc5WFYeP1olwAAAQg"]
[Thu Mar 05 05:58:18.126596 2026] [:error] [pid 62435:tid 62465] [client 118.148.70.11:19692] [client 118.148.70.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.148.70.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaiq-iMZJMDfZh_-8sWu8wAAAM8"]
[Thu Mar 05 05:59:38.135002 2026] [:error] [pid 53350:tid 53383] [client 118.148.70.11:31432] [client 118.148.70.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.148.70.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aairSqO0Baxc5WFYeP1pzAAAAQg"]
[Thu Mar 05 07:31:46.101490 2026] [:error] [pid 62435:tid 62474] [client 170.106.11.141:47636] [client 170.106.11.141] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aajA4iMZJMDfZh_-8sXMUgAAANg"]
[Thu Mar 05 12:30:30.716126 2026] [:error] [pid 41459:tid 41492] [client 121.229.185.160:33337] [client 121.229.185.160] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aakG5udFBZEnZ3pzxrU0uQAAAVI"]
[Thu Mar 05 17:41:14.731707 2026] [:error] [pid 62177:tid 62332] [client 43.153.123.4:39942] [client 43.153.123.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aalPuhWSQc2OzPrsnwWvUAAAAJQ"]
[Thu Mar 05 18:37:51.571197 2026] [:error] [pid 53350:tid 53383] [client 95.159.100.242:12320] [client 95.159.100.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.159.100.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aalc_6O0Baxc5WFYeP31DAAAAQg"]
[Thu Mar 05 18:40:46.237506 2026] [:error] [pid 62177:tid 62335] [client 95.159.100.242:18670] [client 95.159.100.242] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aaldrhWSQc2OzPrsnwW-DQAAAJc"]
[Thu Mar 05 18:41:48.376404 2026] [:error] [pid 41459:tid 41482] [client 95.159.100.242:19014] [client 95.159.100.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.159.100.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aald7OdFBZEnZ3pzxrUAawAAAUg"]
[Thu Mar 05 18:42:42.778883 2026] [:error] [pid 62177:tid 62332] [client 95.159.100.242:12393] [client 95.159.100.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.159.100.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaleIhWSQc2OzPrsnwW-VwAAAJQ"]
[Thu Mar 05 18:42:42.787791 2026] [:error] [pid 62177:tid 62332] [client 95.159.100.242:12393] [client 95.159.100.242] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaleIhWSQc2OzPrsnwW-VwAAAJQ"]
[Thu Mar 05 18:42:42.789595 2026] [:error] [pid 62177:tid 62332] [client 95.159.100.242:12393] [client 95.159.100.242] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaleIhWSQc2OzPrsnwW-VwAAAJQ"]
[Thu Mar 05 18:43:40.025725 2026] [:error] [pid 53350:tid 53399] [client 95.159.100.242:4382] [client 95.159.100.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.159.100.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaleXKO0Baxc5WFYeP33DAAAARY"]
[Thu Mar 05 18:44:52.136463 2026] [:error] [pid 62435:tid 62469] [client 95.159.100.242:18651] [client 95.159.100.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.159.100.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aalepCMZJMDfZh_-8sVvOgAAANM"]
[Thu Mar 05 19:02:40.241265 2026] [:error] [pid 41459:tid 41474] [client 182.42.104.32:45717] [client 182.42.104.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aali0OdFBZEnZ3pzxrUQAAAAAUA"]
[Thu Mar 05 19:08:29.430612 2026] [:error] [pid 62176:tid 62296] [client 103.77.106.118:63679] [client 103.77.106.118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aalkLSNfTPJryi30JPnyxwAAAEw"]
[Thu Mar 05 19:08:29.657077 2026] [:error] [pid 62173:tid 62259] [client 103.77.106.118:63701] [client 103.77.106.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aalkLWj_GWbFb-1ncGlyUwAAAAc"]
[Thu Mar 05 20:23:37.385351 2026] [:error] [pid 53350:tid 53389] [client 107.175.75.13:55304] [client 107.175.75.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/feed/"] [unique_id "aal1yaO0Baxc5WFYeP05LwAAAQw"]
[Thu Mar 05 20:27:01.199450 2026] [:error] [pid 53350:tid 53393] [client 43.153.54.14:52852] [client 43.153.54.14] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aal2laO0Baxc5WFYeP08wQAAARA"]
[Thu Mar 05 22:04:53.659041 2026] [:error] [pid 62435:tid 62459] [client 169.150.223.42:60641] [client 169.150.223.42] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=image/gif"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aamNhSMZJMDfZh_-8sWPuQAAAMk"]
[Thu Mar 05 22:18:42.965258 2026] [:error] [pid 41459:tid 41496] [client 43.130.131.18:40484] [client 43.130.131.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aamQwudFBZEnZ3pzxrV6pwAAAVY"]
[Thu Mar 05 22:40:29.535039 2026] [:error] [pid 41459:tid 41490] [client 157.15.40.88:51359] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "aamV3edFBZEnZ3pzxrWEswAAAVA"]
[Thu Mar 05 22:40:29.793626 2026] [:error] [pid 41459:tid 41482] [client 157.15.40.88:51450] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/txets.php"] [unique_id "aamV3edFBZEnZ3pzxrWE0AAAAUg"]
[Thu Mar 05 22:40:30.050753 2026] [:error] [pid 62176:tid 62288] [client 157.15.40.88:51541] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/txets.php"] [unique_id "aamV3iNfTPJryi30JPkJ3gAAAEQ"]
[Thu Mar 05 22:40:30.314347 2026] [:error] [pid 62176:tid 62304] [client 157.15.40.88:51614] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "aamV3iNfTPJryi30JPkJ_AAAAFQ"]
[Thu Mar 05 22:40:30.601503 2026] [:error] [pid 62176:tid 62298] [client 157.15.40.88:51692] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/schallfuns.php"] [unique_id "aamV3iNfTPJryi30JPkKMAAAAE4"]
[Thu Mar 05 22:40:30.867231 2026] [:error] [pid 62177:tid 62327] [client 157.15.40.88:51746] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/postnews.php"] [unique_id "aamV3hWSQc2OzPrsnwX6wwAAAI8"]
[Thu Mar 05 22:40:31.193884 2026] [:error] [pid 62177:tid 62324] [client 157.15.40.88:51825] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/postnews.php"] [unique_id "aamV3xWSQc2OzPrsnwX6ywAAAIw"]
[Thu Mar 05 22:40:31.457906 2026] [:error] [pid 62176:tid 62288] [client 157.15.40.88:51903] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/postnews.php"] [unique_id "aamV3yNfTPJryi30JPkKRAAAAEQ"]
[Thu Mar 05 22:40:31.729426 2026] [:error] [pid 62177:tid 62327] [client 157.15.40.88:51970] [client 157.15.40.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/postnews.php"] [unique_id "aamV3xWSQc2OzPrsnwX65wAAAI8"]
[Fri Mar 06 00:43:27.580516 2026] [:error] [pid 48372:tid 48390] [client 103.77.107.222:53732] [client 103.77.107.222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aamyr0WaQyQyfhXPRrYFZgAAAUM"]
[Fri Mar 06 01:11:33.952880 2026] [:error] [pid 27687:tid 27706] [client 43.167.236.228:45082] [client 43.167.236.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aam5RUI2IG23EwU7sL8VWQAAAIU"]
[Fri Mar 06 01:48:21.959805 2026] [:error] [pid 48372:tid 48402] [client 167.172.186.112:44502] [client 167.172.186.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.172.186.112, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aanB5UWaQyQyfhXPRrYjUAAAAU4"]
[Fri Mar 06 01:50:04.675125 2026] [:error] [pid 27687:tid 27716] [client 106.119.167.146:39255] [client 106.119.167.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aanCTEI2IG23EwU7sL8u5wAAAI8"]
[Fri Mar 06 03:29:06.329964 2026] [:error] [pid 27687:tid 27720] [client 170.106.113.235:60508] [client 170.106.113.235] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aanZgkI2IG23EwU7sL92mgAAAJM"]
[Fri Mar 06 06:50:37.106523 2026] [:error] [pid 16140:tid 16143] [client 43.153.104.196:56198] [client 43.153.104.196] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaoIvZZVpEeGhAeSpv2RFwAAAQE"]
[Fri Mar 06 07:50:59.399228 2026] [:error] [pid 8945:tid 8984] [client 114.96.103.33:40438] [client 114.96.103.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaoW4wttiLGNg13nMzIZ1wAAANE"]
[Fri Mar 06 09:09:46.661701 2026] [:error] [pid 8656:tid 8829] [client 49.51.39.209:43358] [client 49.51.39.209] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaopWpPxTG9Ff1TtP6Nf0AAAAJM"]
[Fri Mar 06 10:41:58.484694 2026] [:error] [pid 8656:tid 8830] [client 180.243.15.111:58737] [client 180.243.15.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.243.15.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aao-9pPxTG9Ff1TtP6O7AAAAAJQ"]
[Fri Mar 06 10:49:27.671793 2026] [:error] [pid 16140:tid 16150] [client 121.121.218.136:52861] [client 121.121.218.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.121.218.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aapAt5ZVpEeGhAeSpv3nSwAAAQg"]
[Fri Mar 06 10:51:26.774717 2026] [:error] [pid 8656:tid 8824] [client 112.202.121.25:56172] [client 112.202.121.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.202.121.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aapBLpPxTG9Ff1TtP6PEEQAAAI4"]
[Fri Mar 06 10:57:11.993980 2026] [:error] [pid 8656:tid 8815] [client 121.121.218.136:54470] [client 121.121.218.136] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aapCh5PxTG9Ff1TtP6PKDQAAAIU"]
[Fri Mar 06 10:58:37.168444 2026] [:error] [pid 8656:tid 8824] [client 121.121.218.136:50503] [client 121.121.218.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.121.218.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aapC3ZPxTG9Ff1TtP6PL6wAAAI4"]
[Fri Mar 06 11:00:02.349461 2026] [:error] [pid 16140:tid 16164] [client 121.121.218.136:52561] [client 121.121.218.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.121.218.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aapDMpZVpEeGhAeSpv3qxAAAARY"]
[Fri Mar 06 11:01:42.549494 2026] [:error] [pid 16140:tid 16164] [client 121.121.218.136:51114] [client 121.121.218.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.121.218.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aapDlpZVpEeGhAeSpv3rmwAAARY"]
[Fri Mar 06 11:03:05.470880 2026] [:error] [pid 16140:tid 16163] [client 121.121.218.136:58812] [client 121.121.218.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.121.218.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aapD6ZZVpEeGhAeSpv3sNQAAARU"]
[Fri Mar 06 11:13:25.288147 2026] [:error] [pid 8656:tid 8815] [client 112.202.121.25:56935] [client 112.202.121.25] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aapGVZPxTG9Ff1TtP6PbngAAAIU"]
[Fri Mar 06 11:14:53.779258 2026] [:error] [pid 8652:tid 8806] [client 112.202.121.25:57920] [client 112.202.121.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.202.121.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aapGrdYc_V4I9STsZ9AySgAAAFc"]
[Fri Mar 06 11:16:36.386103 2026] [:error] [pid 8656:tid 8811] [client 112.202.121.25:55542] [client 112.202.121.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.202.121.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aapHFJPxTG9Ff1TtP6PgTwAAAIE"]
[Fri Mar 06 11:17:53.435340 2026] [:error] [pid 8656:tid 8834] [client 112.202.121.25:57205] [client 112.202.121.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.202.121.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aapHYZPxTG9Ff1TtP6PiFAAAAJg"]
[Fri Mar 06 11:19:08.212329 2026] [:error] [pid 8656:tid 8814] [client 112.202.121.25:55168] [client 112.202.121.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.202.121.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aapHrJPxTG9Ff1TtP6PjbAAAAIQ"]
[Fri Mar 06 12:30:20.129994 2026] [:error] [pid 8656:tid 8812] [client 49.51.166.228:45154] [client 49.51.166.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aapYXJPxTG9Ff1TtP6MnbAAAAII"]
[Fri Mar 06 17:52:59.728494 2026] [:error] [pid 59237:tid 59264] [client 49.51.183.220:39120] [client 49.51.183.220] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaqj--qfMSBs0nxOTxHU-QAAA5Y"]
[Fri Mar 06 19:08:42.816513 2026] [:error] [pid 8656:tid 8816] [client 85.11.167.108:20822] [client 85.11.167.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.11.167.108, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaq1upPxTG9Ff1TtP6OxLgAAAIY"]
[Fri Mar 06 19:16:32.698799 2026] [:error] [pid 59239:tid 59277] [client 5.78.104.3:41014] [client 5.78.104.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/core/.env"] [unique_id "aaq3kLG1EpnE909fvGeP5gAAA8g"]
[Fri Mar 06 19:16:32.701657 2026] [:error] [pid 59239:tid 59269] [client 5.78.104.3:41040] [client 5.78.104.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/api/.env"] [unique_id "aaq3kLG1EpnE909fvGeP5wAAA8A"]
[Fri Mar 06 19:16:32.701927 2026] [:error] [pid 59239:tid 59282] [client 5.78.104.3:41028] [client 5.78.104.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aaq3kLG1EpnE909fvGeP6AAAA80"]
[Fri Mar 06 19:52:16.440397 2026] [:error] [pid 59237:tid 59248] [client 170.106.180.246:42654] [client 170.106.180.246] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaq_8OqfMSBs0nxOTxEf-gAAA4Y"]
[Fri Mar 06 20:06:08.451094 2026] [:error] [pid 16140:tid 16160] [client 79.141.161.27:33698] [client 79.141.161.27] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aarDMJZVpEeGhAeSpv3YjQAAARI"]
[Fri Mar 06 20:39:28.963893 2026] [:error] [pid 59237:tid 59260] [client 117.33.163.216:53280] [client 117.33.163.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aarLAOqfMSBs0nxOTxE_wgAAA5I"]
[Fri Mar 06 23:10:54.943027 2026] [:error] [pid 16140:tid 16143] [client 62.60.131.218:61744] [client 62.60.131.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aarufpZVpEeGhAeSpv0dcwAAAQE"]
[Sat Mar 07 00:32:55.185320 2026] [:error] [pid 6913:tid 7005] [client 109.60.77.43:43293] [client 109.60.77.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.60.77.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aasBt-yYBOeAwrF78TLYwwAAAAo"]
[Sat Mar 07 00:40:00.570210 2026] [:error] [pid 6913:tid 7011] [client 109.60.77.43:47093] [client 109.60.77.43] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aasDYOyYBOeAwrF78TLcQgAAABA"]
[Sat Mar 07 00:41:00.706435 2026] [:error] [pid 7406:tid 7482] [client 109.60.77.43:47377] [client 109.60.77.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.60.77.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aasDnHtbeE4NFKnz6ve-7wAAAM0"]
[Sat Mar 07 00:42:00.523213 2026] [:error] [pid 7406:tid 7495] [client 109.60.77.43:59850] [client 109.60.77.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.60.77.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aasD2HtbeE4NFKnz6ve_kAAAANg"]
[Sat Mar 07 00:43:00.060454 2026] [:error] [pid 7406:tid 7469] [client 109.60.77.43:47831] [client 109.60.77.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.60.77.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aasEFHtbeE4NFKnz6vfALQAAAMA"]
[Sat Mar 07 00:44:04.519281 2026] [:error] [pid 6923:tid 7079] [client 109.60.77.43:48101] [client 109.60.77.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.60.77.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aasEVLAJONsbDnxnyfPJEwAAAIg"]
[Sat Mar 07 03:21:44.364944 2026] [:error] [pid 23672:tid 23768] [client 14.215.163.132:48869] [client 14.215.163.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaspSHPvdBVUU3Simx4aPQAAAA4"]
[Sat Mar 07 08:20:02.642286 2026] [:error] [pid 4315:tid 4453] [client 120.48.93.232:61759] [client 120.48.93.232] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aatvMtDEK9AXzxu9OShZRQAAAIY"]
[Sat Mar 07 08:28:16.974731 2026] [:error] [pid 52484:tid 52509] [client 62.60.131.218:57972] [client 62.60.131.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aatxIPE9AnX6zUICFeRUugAAAQY"]
[Sat Mar 07 12:35:54.310033 2026] [:error] [pid 52484:tid 52520] [client 212.129.7.184:39924] [client 212.129.7.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.129.7.184, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaurKvE9AnX6zUICFeQdMQAAARA"]
[Sat Mar 07 14:37:33.362435 2026] [:error] [pid 52484:tid 52511] [client 34.24.47.138:59820] [client 34.24.47.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/media/system/js/core.js"] [unique_id "aavHrfE9AnX6zUICFeRcvgAAAQg"]
[Sat Mar 07 18:02:03.734055 2026] [:error] [pid 52484:tid 52521] [client 34.10.52.44:59494] [client 34.10.52.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.10.52.44, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aav3m_E9AnX6zUICFeSJwgAAARE"]
[Sat Mar 07 18:02:05.925503 2026] [:error] [pid 52484:tid 52527] [client 34.10.52.44:59494] [client 34.10.52.44] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aav3nfE9AnX6zUICFeSJygAAARc"]
[Sat Mar 07 18:02:06.124164 2026] [:error] [pid 52484:tid 52511] [client 34.10.52.44:59494] [client 34.10.52.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.10.52.44, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aav3nvE9AnX6zUICFeSJywAAAQg"]
[Sat Mar 07 18:02:07.685908 2026] [:error] [pid 52484:tid 52527] [client 34.10.52.44:54446] [client 34.10.52.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.10.52.44, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aav3n_E9AnX6zUICFeSJzgAAARc"]
[Sat Mar 07 18:02:09.111403 2026] [:error] [pid 10276:tid 10311] [client 34.10.52.44:57240] [client 34.10.52.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.10.52.44, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aav3oaNawseyHvpv0LkwVQAAA1U"]
[Sat Mar 07 18:02:10.672506 2026] [:error] [pid 14885:tid 14913] [client 34.10.52.44:57236] [client 34.10.52.44] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.10.52.44, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aav3olj4t7-EBJadtcV9ngAAA44"]
[Sat Mar 07 18:32:06.088078 2026] [:error] [pid 36899:tid 36937] [client 179.9.181.105:50848] [client 179.9.181.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.9.181.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aav-pjIlMfwxLHrLy_9MKwAAAY4"]
[Sat Mar 07 18:36:05.194274 2026] [:error] [pid 14885:tid 14914] [client 179.9.181.105:52449] [client 179.9.181.105] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aav_lVj4t7-EBJadtcWS6wAAA48"]
[Sat Mar 07 18:37:48.245669 2026] [:error] [pid 36899:tid 36923] [client 179.9.181.105:53294] [client 179.9.181.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.9.181.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aav__DIlMfwxLHrLy_9MbgAAAYE"]
[Sat Mar 07 18:39:18.938891 2026] [:error] [pid 14885:tid 14916] [client 179.9.181.105:54023] [client 179.9.181.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.9.181.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aawAVlj4t7-EBJadtcWVVwAAA5E"]
[Sat Mar 07 18:40:39.879283 2026] [:error] [pid 50682:tid 50691] [client 179.9.181.105:54699] [client 179.9.181.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.9.181.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aawAp0_32_2CpDTtIRmbqwAAAoY"]
[Sat Mar 07 18:42:09.100877 2026] [:error] [pid 14885:tid 14906] [client 179.9.181.105:55377] [client 179.9.181.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.9.181.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aawBAVj4t7-EBJadtcWW6QAAA4c"]
[Sat Mar 07 19:26:00.681935 2026] [:error] [pid 50682:tid 50698] [client 43.156.168.214:54480] [client 43.156.168.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aawLSE_32_2CpDTtIRmgCAAAAo0"]
[Sat Mar 07 20:23:18.997145 2026] [:error] [pid 36899:tid 36922] [client 222.154.250.222:38252] [client 222.154.250.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 222.154.250.222, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aawYtjIlMfwxLHrLy_9rHgAAAYA"], referer: https://expressinteriors.com/
[Sat Mar 07 20:46:01.256205 2026] [:error] [pid 10276:tid 10300] [client 95.164.206.212:40185] [client 95.164.206.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.164.206.212, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaweCaNawseyHvpv0LlgjQAAA0o"], referer: https://expressinteriors.com/
[Sat Mar 07 22:19:20.148588 2026] [:error] [pid 36899:tid 36934] [client 45.94.31.190:58388] [client 45.94.31.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.94.31.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aawz6DIlMfwxLHrLy_-DSAAAAYs"]
[Sat Mar 07 22:19:21.842078 2026] [:error] [pid 10276:tid 10312] [client 45.94.31.190:59739] [client 45.94.31.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.94.31.190, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aawz6aNawseyHvpv0LlqJAAAA1Y"]
[Sat Mar 07 22:19:28.131632 2026] [:error] [pid 4315:tid 4466] [client 45.94.31.190:62423] [client 45.94.31.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.94.31.190, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aawz8NDEK9AXzxu9OSgfIgAAAJI"]
[Sat Mar 07 22:43:36.505106 2026] [:error] [pid 28186:tid 28226] [client 180.110.203.108:54808] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aaw5mJzBJnT5JlvQcuacXAAAAg4"]
[Sat Mar 07 23:06:05.129609 2026] [:error] [pid 54127:tid 54151] [client 65.109.24.29:57380] [client 65.109.24.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.109.24.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaw-3UuQzHmVv_Y3VjdxWgAAAsk"]
[Sun Mar 08 00:02:20.628249 2026] [:error] [pid 4315:tid 4453] [client 217.182.137.64:61765] [client 217.182.137.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.182.137.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaxMDNDEK9AXzxu9OSg9awAAAIY"], referer: https://expressinteriors.com/
[Sun Mar 08 00:15:15.535107 2026] [:error] [pid 14885:tid 14914] [client 43.157.179.227:49516] [client 43.157.179.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aaxPE1j4t7-EBJadtcXpNwAAA48"]
[Sun Mar 08 01:10:24.902873 2026] [:error] [pid 19534:tid 19547] [client 195.224.191.196:50734] [client 195.224.191.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.224.191.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aaxcAIiRddMMzZb47n5h8AAAAEs"]
[Sun Mar 08 02:11:31.955571 2026] [:error] [pid 19534:tid 19555] [client 104.28.160.175:13094] [client 104.28.160.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.28.160.175, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aaxqU4iRddMMzZb47n5-ggAAAFM"]
[Sun Mar 08 05:21:21.016357 2026] [:error] [pid 43672:tid 43756] [client 150.228.11.157:29717] [client 150.228.11.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.228.11.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aayW0Xqp35WgfA0DoNAkcQAAAIY"]
[Sun Mar 08 06:10:54.539519 2026] [:error] [pid 22790:tid 22891] [client 150.228.11.157:31040] [client 150.228.11.157] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aayibhXbGDWrzD_dTOcVcgAAA8k"]
[Sun Mar 08 06:12:00.433321 2026] [:error] [pid 22790:tid 22889] [client 150.228.11.157:63355] [client 150.228.11.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.228.11.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aayisBXbGDWrzD_dTOcWRQAAA8c"]
[Sun Mar 08 06:13:06.214498 2026] [:error] [pid 22787:tid 22849] [client 150.228.11.157:13698] [client 150.228.11.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.228.11.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aayi8kF9MGMhk9pT4z7j0wAAA1U"]
[Sun Mar 08 06:14:12.918219 2026] [:error] [pid 22667:tid 22711] [client 150.228.11.157:59691] [client 150.228.11.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.228.11.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aayjNOG7qk1roo-TRWM2uwAAAkY"]
[Sun Mar 08 06:15:10.091330 2026] [:error] [pid 22786:tid 22810] [client 150.228.11.157:22307] [client 150.228.11.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.228.11.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aayjbnPuJewMN2jPbdUc4gAAAwk"]
[Sun Mar 08 07:19:27.936510 2026] [:error] [pid 22669:tid 22764] [client 124.156.179.141:33166] [client 124.156.179.141] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aayyf2vqAhy8LIaua-pDXQAAAsU"]
[Sun Mar 08 08:50:34.687570 2026] [:error] [pid 22790:tid 22882] [client 31.223.146.148:59232] [client 31.223.146.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.223.146.148, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aazH2hXbGDWrzD_dTOd4MQAAA8A"]
[Sun Mar 08 09:21:48.918553 2026] [:error] [pid 22667:tid 22715] [client 31.223.146.148:59189] [client 31.223.146.148] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aazPLOG7qk1roo-TRWNIqAAAAko"]
[Sun Mar 08 09:22:47.755311 2026] [:error] [pid 22790:tid 22883] [client 31.223.146.148:59139] [client 31.223.146.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.223.146.148, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aazPZxXbGDWrzD_dTOeWegAAA8E"]
[Sun Mar 08 09:23:37.215264 2026] [:error] [pid 22790:tid 22899] [client 31.223.146.148:59827] [client 31.223.146.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.223.146.148, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aazPmRXbGDWrzD_dTOeYWQAAA9E"]
[Sun Mar 08 09:24:47.729663 2026] [:error] [pid 22787:tid 22834] [client 31.223.146.148:59592] [client 31.223.146.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.223.146.148, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aazP30F9MGMhk9pT4z4zTQAAA0Y"]
[Sun Mar 08 09:25:43.231063 2026] [:error] [pid 22788:tid 22862] [client 31.223.146.148:59568] [client 31.223.146.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.223.146.148, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aazQF0hwluk21OG9mScXlQAAA4c"]
[Sun Mar 08 10:09:57.929510 2026] [:error] [pid 22787:tid 22831] [client 170.106.37.134:42664] [client 170.106.37.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aazadUF9MGMhk9pT4z5bGwAAA0M"]
[Sun Mar 08 12:50:13.532530 2026] [:error] [pid 22669:tid 22775] [client 46.202.138.211:50022] [client 46.202.138.211] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/core/.env"] [unique_id "aa0ABWvqAhy8LIaua-pcIwAAAtA"]
[Sun Mar 08 12:50:13.533058 2026] [:error] [pid 22788:tid 22870] [client 46.202.138.211:50032] [client 46.202.138.211] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aa0ABUhwluk21OG9mSdaiwAAA48"]
[Sun Mar 08 13:31:07.234005 2026] [:error] [pid 22668:tid 22746] [client 49.51.50.147:34268] [client 49.51.50.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aa0Jm-mzLHpblwnQgPjpDwAAAo4"]
[Sun Mar 08 13:42:06.459965 2026] [:error] [pid 22788:tid 22877] [client 85.11.167.108:25835] [client 85.11.167.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.11.167.108, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aa0MLkhwluk21OG9mSdo1QAAA5Y"]
[Sun Mar 08 15:42:01.160545 2026] [:error] [pid 22786:tid 22817] [client 43.130.47.33:55444] [client 43.130.47.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aa0oSXPuJewMN2jPbdWUFwAAAxA"]
[Sun Mar 08 16:30:47.085826 2026] [:error] [pid 22786:tid 22824] [client 157.245.150.188:55331] [client 157.245.150.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.245.150.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aa0zt3PuJewMN2jPbdWtEgAAAxc"]
[Sun Mar 08 16:55:03.456164 2026] [:error] [pid 22790:tid 22890] [client 94.203.115.145:22285] [client 94.203.115.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.203.115.145, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa05ZxXbGDWrzD_dTOfHigAAA8g"]
[Sun Mar 08 17:06:00.927073 2026] [:error] [pid 22788:tid 22863] [client 94.203.115.145:4100] [client 94.203.115.145] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aa07-Ehwluk21OG9mSfpuwAAA4g"]
[Sun Mar 08 17:07:49.120732 2026] [:error] [pid 22787:tid 22846] [client 94.203.115.145:4096] [client 94.203.115.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.203.115.145, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa08ZUF9MGMhk9pT4z74JgAAA1I"]
[Sun Mar 08 17:09:08.521978 2026] [:error] [pid 22786:tid 22804] [client 94.203.115.145:22310] [client 94.203.115.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.203.115.145, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa08tHPuJewMN2jPbdXFKAAAAwM"]
[Sun Mar 08 18:08:00.985555 2026] [:error] [pid 22786:tid 22818] [client 111.172.249.49:34055] [client 111.172.249.49] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aa1KgHPuJewMN2jPbdXlewAAAxE"]
[Sun Mar 08 18:39:56.525015 2026] [:error] [pid 22788:tid 22871] [client 104.28.159.44:19960] [client 104.28.159.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.28.159.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aa1R_Ehwluk21OG9mScJ4QAAA5A"]
[Sun Mar 08 18:46:20.514321 2026] [:error] [pid 22788:tid 22858] [client 104.28.159.44:21604] [client 104.28.159.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.28.159.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aa1TfEhwluk21OG9mScL_wAAA4M"]
[Sun Mar 08 18:53:03.446901 2026] [:error] [pid 22790:tid 22883] [client 104.28.159.44:21232] [client 104.28.159.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.28.159.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aa1VDxXbGDWrzD_dTOfsTQAAA8E"]
[Sun Mar 08 18:59:13.167451 2026] [:error] [pid 22787:tid 22829] [client 104.28.159.44:21207] [client 104.28.159.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.28.159.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aa1WgUF9MGMhk9pT4z4PhwAAA0E"]
[Sun Mar 08 19:05:43.427261 2026] [:error] [pid 22790:tid 22895] [client 104.28.159.44:19619] [client 104.28.159.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.28.159.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aa1YBxXbGDWrzD_dTOfxYAAAA80"]
[Sun Mar 08 22:59:17.089306 2026] [:error] [pid 22788:tid 22878] [client 176.29.231.238:20750] [client 176.29.231.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.29.231.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa2OxUhwluk21OG9mSdhVwAAA5c"]
[Sun Mar 08 23:01:45.587840 2026] [:error] [pid 22668:tid 22756] [client 176.29.231.238:20760] [client 176.29.231.238] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aa2PWemzLHpblwnQgPhD2wAAApg"]
[Sun Mar 08 23:02:35.597952 2026] [:error] [pid 22668:tid 22749] [client 176.29.231.238:21032] [client 176.29.231.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.29.231.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa2Pi-mzLHpblwnQgPhD9AAAApE"]
[Sun Mar 08 23:02:35.599603 2026] [:error] [pid 22668:tid 22749] [client 176.29.231.238:21032] [client 176.29.231.238] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa2Pi-mzLHpblwnQgPhD9AAAApE"]
[Sun Mar 08 23:02:35.601143 2026] [:error] [pid 22668:tid 22749] [client 176.29.231.238:21032] [client 176.29.231.238] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa2Pi-mzLHpblwnQgPhD9AAAApE"]
[Sun Mar 08 23:03:38.973260 2026] [:error] [pid 22669:tid 22780] [client 176.29.231.238:21250] [client 176.29.231.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.29.231.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa2PymvqAhy8LIaua-rGqAAAAtU"]
[Sun Mar 08 23:04:24.312593 2026] [:error] [pid 22787:tid 22830] [client 176.29.231.238:20745] [client 176.29.231.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.29.231.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa2P-EF9MGMhk9pT4z43UgAAA0I"]
[Sun Mar 08 23:05:24.091567 2026] [:error] [pid 43671:tid 43734] [client 176.29.231.238:21431] [client 176.29.231.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.29.231.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa2QNK6AdwroU1gT3XEQtgAAAEs"]
[Sun Mar 08 23:06:47.178488 2026] [:error] [pid 22668:tid 22749] [client 154.160.19.21:56147] [client 154.160.19.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.160.19.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa2Qh-mzLHpblwnQgPhE5gAAApE"]
[Sun Mar 08 23:09:45.950057 2026] [:error] [pid 22667:tid 22709] [client 154.160.19.21:35713] [client 154.160.19.21] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aa2ROeG7qk1roo-TRWPN8wAAAkQ"]
[Sun Mar 08 23:10:50.872504 2026] [:error] [pid 43671:tid 43737] [client 154.160.19.21:56151] [client 154.160.19.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.160.19.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa2Req6AdwroU1gT3XETkAAAAE4"]
[Sun Mar 08 23:11:52.783775 2026] [:error] [pid 43671:tid 43733] [client 154.160.19.21:36273] [client 154.160.19.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.160.19.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa2RuK6AdwroU1gT3XET_AAAAEo"]
[Sun Mar 08 23:48:07.890883 2026] [:error] [pid 22788:tid 22871] [client 170.106.160.90:51210] [client 170.106.160.90] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aa2aN0hwluk21OG9mSdywgAAA5A"]
[Mon Mar 09 03:41:11.187418 2026] [ssl:error] [pid 6074:tid 6115] [client 107.173.171.201:37268] AH02032: Hostname cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup, referer: http://cdbdinteriors.com.au/
[Mon Mar 09 07:18:10.888673 2026] [:error] [pid 6074:tid 6095] [client 106.119.167.146:39950] [client 106.119.167.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aa4DshgvXHMVGYw_Elz9DgAAAMQ"]
[Mon Mar 09 07:27:20.346840 2026] [:error] [pid 17485:tid 17511] [client 170.106.140.110:52676] [client 170.106.140.110] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aa4F2NQOL_kxQEc1PTDErQAAARc"]
[Mon Mar 09 12:40:13.846985 2026] [:error] [pid 5783:tid 5905] [client 182.188.114.86:53693] [client 182.188.114.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.188.114.86, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa5PLQdiZJ1FQPtsTNRhZAAAAEs"]
[Mon Mar 09 12:40:13.888998 2026] [:error] [pid 17485:tid 17503] [client 182.188.114.86:53692] [client 182.188.114.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.188.114.86, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa5PLdQOL_kxQEc1PTDzPgAAAQ8"]
[Mon Mar 09 12:45:19.358005 2026] [:error] [pid 17485:tid 17511] [client 182.188.114.86:57260] [client 182.188.114.86] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aa5QX9QOL_kxQEc1PTD1ogAAARc"]
[Mon Mar 09 12:45:44.117661 2026] [:error] [pid 17485:tid 17488] [client 182.188.114.86:57660] [client 182.188.114.86] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aa5QeNQOL_kxQEc1PTD2DgAAAQA"]
[Mon Mar 09 12:46:31.507482 2026] [:error] [pid 17485:tid 17510] [client 182.188.114.86:58295] [client 182.188.114.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.188.114.86, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa5Qp9QOL_kxQEc1PTD2-wAAARY"]
[Mon Mar 09 12:46:54.372587 2026] [:error] [pid 17485:tid 17496] [client 182.188.114.86:58520] [client 182.188.114.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.188.114.86, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa5QvtQOL_kxQEc1PTD3TgAAAQg"]
[Mon Mar 09 12:47:53.231593 2026] [:error] [pid 17485:tid 17495] [client 182.188.114.86:59201] [client 182.188.114.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.188.114.86, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa5Q-dQOL_kxQEc1PTD4SwAAAQc"]
[Mon Mar 09 13:32:52.635117 2026] [:error] [pid 17485:tid 17505] [client 14.215.163.132:53376] [client 14.215.163.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aa5bhNQOL_kxQEc1PTAcdAAAARE"]
[Mon Mar 09 13:43:42.567094 2026] [:error] [pid 2145:tid 2196] [client 216.73.216.89:22958] [client 216.73.216.89] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||expressinteriors.com|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/robots.txt"] [unique_id "aa5eDnczzpD9XHtKwuDrZAAAAVc"]
[Mon Mar 09 15:00:02.339432 2026] [:error] [pid 2145:tid 2190] [client 60.50.7.242:61409] [client 60.50.7.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 60.50.7.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa5v8nczzpD9XHtKwuAW5AAAAVI"]
[Mon Mar 09 15:00:44.499718 2026] [:error] [pid 2145:tid 2176] [client 116.197.133.25:56266] [client 116.197.133.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.197.133.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa5wHHczzpD9XHtKwuAXVQAAAUg"]
[Mon Mar 09 15:02:36.879699 2026] [:error] [pid 2145:tid 2176] [client 223.181.26.137:23097] [client 223.181.26.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.181.26.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa5wjHczzpD9XHtKwuAY9AAAAUg"]
[Mon Mar 09 15:12:14.002523 2026] [:error] [pid 5783:tid 5903] [client 223.181.26.137:21974] [client 223.181.26.137] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aa5yzQdiZJ1FQPtsTNR_TwAAAEk"]
[Mon Mar 09 15:13:05.429622 2026] [:error] [pid 5787:tid 5926] [client 116.197.133.25:62858] [client 116.197.133.25] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aa5zAbGpMgQ18gGUaFMVywAAAIQ"]
[Mon Mar 09 15:14:13.754244 2026] [:error] [pid 5787:tid 5943] [client 223.181.26.137:27894] [client 223.181.26.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.181.26.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa5zRbGpMgQ18gGUaFMWFwAAAJU"]
[Mon Mar 09 15:14:29.688205 2026] [:error] [pid 5787:tid 5928] [client 116.197.133.25:63508] [client 116.197.133.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.197.133.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa5zVbGpMgQ18gGUaFMWJwAAAIY"]
[Mon Mar 09 15:15:59.668360 2026] [:error] [pid 17485:tid 17511] [client 116.197.133.25:64278] [client 116.197.133.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.197.133.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa5zr9QOL_kxQEc1PTB21gAAARc"]
[Mon Mar 09 15:16:18.254632 2026] [:error] [pid 17485:tid 17497] [client 223.181.26.137:17906] [client 223.181.26.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.181.26.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa5zwtQOL_kxQEc1PTB3AQAAAQk"]
[Mon Mar 09 15:17:27.418510 2026] [:error] [pid 17485:tid 17492] [client 116.197.133.25:65099] [client 116.197.133.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.197.133.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa50B9QOL_kxQEc1PTB3xwAAAQQ"]
[Mon Mar 09 15:18:17.659529 2026] [:error] [pid 17485:tid 17507] [client 223.181.26.137:4153] [client 223.181.26.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.181.26.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa50OdQOL_kxQEc1PTB4fQAAARM"]
[Mon Mar 09 15:18:46.611370 2026] [:error] [pid 2145:tid 2173] [client 116.197.133.25:49502] [client 116.197.133.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.197.133.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa50VnczzpD9XHtKwuAg0wAAAUc"]
[Mon Mar 09 15:20:29.827363 2026] [:error] [pid 5787:tid 5938] [client 223.181.26.137:27476] [client 223.181.26.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.181.26.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa50vbGpMgQ18gGUaFMYSAAAAJA"]
[Mon Mar 09 15:26:32.703905 2026] [:error] [pid 2145:tid 2183] [client 60.50.7.242:63736] [client 60.50.7.242] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aa52KHczzpD9XHtKwuAkuAAAAU8"]
[Mon Mar 09 15:27:54.832979 2026] [:error] [pid 5779:tid 5860] [client 60.50.7.242:65035] [client 60.50.7.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 60.50.7.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa52egaHbHwtklaurgW3CAAAAAU"]
[Mon Mar 09 15:27:54.835496 2026] [:error] [pid 5779:tid 5860] [client 60.50.7.242:65035] [client 60.50.7.242] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa52egaHbHwtklaurgW3CAAAAAU"]
[Mon Mar 09 15:27:54.837520 2026] [:error] [pid 5779:tid 5860] [client 60.50.7.242:65035] [client 60.50.7.242] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa52egaHbHwtklaurgW3CAAAAAU"]
[Mon Mar 09 15:29:16.048897 2026] [:error] [pid 5787:tid 5934] [client 60.50.7.242:50024] [client 60.50.7.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 60.50.7.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa52zLGpMgQ18gGUaFMaCwAAAIw"]
[Mon Mar 09 15:30:19.984518 2026] [:error] [pid 6074:tid 6112] [client 60.50.7.242:51129] [client 60.50.7.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 60.50.7.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa53CxgvXHMVGYw_ElzRuAAAANU"]
[Mon Mar 09 15:31:31.845257 2026] [:error] [pid 2145:tid 2191] [client 60.50.7.242:52251] [client 60.50.7.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 60.50.7.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa53U3czzpD9XHtKwuAnggAAAVM"]
[Mon Mar 09 15:57:53.433018 2026] [:error] [pid 17485:tid 17494] [client 43.133.187.11:52382] [client 43.133.187.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aa59gdQOL_kxQEc1PTCVywAAAQY"]
[Mon Mar 09 18:39:28.846010 2026] [:error] [pid 44503:tid 44510] [client 43.228.157.68:60656] [client 43.228.157.68] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/public/.git/config"] [unique_id "aa6jYMpGKFA8jlKDDh22hQAAAcM"]
[Mon Mar 09 20:05:02.359517 2026] [:error] [pid 44503:tid 44513] [client 182.44.2.148:41115] [client 182.44.2.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aa63bspGKFA8jlKDDh3uUwAAAcY"]
[Mon Mar 09 21:42:59.964182 2026] [:error] [pid 44503:tid 44522] [client 104.248.94.171:52380] [client 104.248.94.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.248.94.171, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa7OY8pGKFA8jlKDDh0yAAAAAc8"]
[Mon Mar 09 21:43:02.369774 2026] [:error] [pid 44503:tid 44511] [client 104.248.94.171:52380] [client 104.248.94.171] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aa7OZspGKFA8jlKDDh0yBQAAAcQ"]
[Mon Mar 09 21:43:02.628090 2026] [:error] [pid 44503:tid 44528] [client 104.248.94.171:52380] [client 104.248.94.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.248.94.171, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa7OZspGKFA8jlKDDh0yBgAAAdU"]
[Mon Mar 09 21:43:04.269767 2026] [:error] [pid 5787:tid 5944] [client 104.248.94.171:53856] [client 104.248.94.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.248.94.171, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa7OaLGpMgQ18gGUaFPqgAAAAJY"]
[Mon Mar 09 21:43:06.022517 2026] [:error] [pid 44463:tid 44492] [client 104.248.94.171:54322] [client 104.248.94.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.248.94.171, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa7Oai5tVkWjZvDknB0rwAAAAZU"]
[Mon Mar 09 21:43:07.632996 2026] [:error] [pid 44504:tid 44544] [client 104.248.94.171:54844] [client 104.248.94.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.248.94.171, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa7Oa3ri56-8oxPimmhRJwAAAgo"]
[Mon Mar 09 21:43:09.371066 2026] [:error] [pid 6074:tid 6104] [client 104.248.94.171:55318] [client 104.248.94.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.248.94.171, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa7ObRgvXHMVGYw_ElwLQwAAAM0"]
[Mon Mar 09 21:43:09.371232 2026] [:error] [pid 6074:tid 6104] [client 104.248.94.171:55318] [client 104.248.94.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 104.248.94.171, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa7ObRgvXHMVGYw_ElwLQwAAAM0"]
[Mon Mar 09 22:12:26.390207 2026] [:error] [pid 44463:tid 44471] [client 139.59.108.255:44116] [client 139.59.108.255] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 139.59.108.255, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aa7VSi5tVkWjZvDknB0v3QAAAYA"]
[Mon Mar 09 22:12:29.439683 2026] [:error] [pid 44463:tid 44481] [client 139.59.108.255:44116] [client 139.59.108.255] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 139.59.108.255, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aa7VTS5tVkWjZvDknB0v5AAAAYo"], referer: https://expressinteriors.com/wp-login.php
[Tue Mar 10 01:23:03.954208 2026] [:error] [pid 64775:tid 64803] [client 186.189.97.48:63329] [client 186.189.97.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.189.97.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa8B9-D6wJvkR_jrqnWeVAAAARc"]
[Tue Mar 10 02:45:51.085171 2026] [:error] [pid 32798:tid 32807] [client 175.6.217.4:37176] [client 175.6.217.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aa8VX2xfsI4EbE3KrNCZCQAAAEc"]
[Tue Mar 10 04:06:06.076458 2026] [:error] [pid 8193:tid 8229] [client 104.28.159.135:25415] [client 104.28.159.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aa8oLh27LTs3sNpMSvzo_AAAAMk"]
[Tue Mar 10 04:49:26.813625 2026] [:error] [pid 7904:tid 8014] [client 195.224.191.196:56558] [client 195.224.191.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.224.191.196, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aa8yVtqdH-GCmASfJqHcFgAAABY"]
[Tue Mar 10 04:49:28.676019 2026] [:error] [pid 7904:tid 8006] [client 195.224.191.196:59218] [client 195.224.191.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.224.191.196, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aa8yWNqdH-GCmASfJqHcGAAAAA4"]
[Tue Mar 10 05:23:21.658558 2026] [:error] [pid 8193:tid 8241] [client 62.60.131.218:58009] [client 62.60.131.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aa86SR27LTs3sNpMSvwQWgAAANU"]
[Tue Mar 10 05:40:48.448543 2026] [:error] [pid 7904:tid 8014] [client 62.60.131.218:60713] [client 62.60.131.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aa8-YNqdH-GCmASfJqHgQwAAABY"]
[Tue Mar 10 07:08:22.271856 2026] [:error] [pid 32295:tid 32338] [client 43.166.255.122:44242] [client 43.166.255.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aa9S5o_FltxBAKWrlwjXiwAAANQ"]
[Tue Mar 10 07:38:09.915861 2026] [:error] [pid 13407:tid 13445] [client 43.228.157.68:38394] [client 43.228.157.68] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aa9Z4dqN0GV-aESMjNx7AAAAAVM"]
[Tue Mar 10 12:18:11.578687 2026] [:error] [pid 42666:tid 42674] [client 43.159.128.237:39238] [client 43.159.128.237] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aa-bg40d5emjo-Hs705lvQAAAQY"]
[Tue Mar 10 14:21:45.965579 2026] [:error] [pid 42759:tid 42778] [client 43.159.135.203:56946] [client 43.159.135.203] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aa-4efoOpjBGGv-2UuyLfgAAAhA"]
[Tue Mar 10 15:17:17.247349 2026] [:error] [pid 21400:tid 21413] [client 221.229.106.25:48198] [client 221.229.106.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aa_FfTCFYMzi4orNuEGrCgAAAMs"]
[Tue Mar 10 16:50:57.664884 2026] [autoindex:error] [pid 21318:tid 21392] [client 139.59.32.166:60523] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Mar 10 16:51:12.586636 2026] [:error] [pid 21316:tid 21330] [client 116.202.3.129:60370] [client 116.202.3.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.202.3.129, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aa_bgJmAQfAZtna2rDyZEQAAAAo"]
[Tue Mar 10 16:51:14.504414 2026] [:error] [pid 21317:tid 21365] [client 116.202.3.129:52248] [client 116.202.3.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.202.3.129, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aa_bglUUqcn7vK991D2V1QAAAFI"]
[Tue Mar 10 17:12:49.618731 2026] [:error] [pid 21318:tid 21379] [client 109.107.243.93:14149] [client 109.107.243.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.107.243.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa_gkRTTkPqKydpYiIKN-wAAAIU"]
[Tue Mar 10 17:23:11.083691 2026] [:error] [pid 63829:tid 63834] [client 109.107.243.93:5421] [client 109.107.243.93] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aa_i_yf36W4aDbSUXc0G-gAAAQM"]
[Tue Mar 10 17:24:30.020075 2026] [:error] [pid 21317:tid 21359] [client 109.107.243.93:7842] [client 109.107.243.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.107.243.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa_jTlUUqcn7vK991D2h0QAAAEw"]
[Tue Mar 10 17:25:29.705147 2026] [:error] [pid 21317:tid 21354] [client 109.107.243.93:8358] [client 109.107.243.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.107.243.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa_jiVUUqcn7vK991D2iggAAAEc"]
[Tue Mar 10 17:26:33.904650 2026] [:error] [pid 63829:tid 63842] [client 109.107.243.93:17323] [client 109.107.243.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.107.243.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa_jySf36W4aDbSUXc0HxwAAAQs"]
[Tue Mar 10 17:27:33.659682 2026] [:error] [pid 21316:tid 21337] [client 109.107.243.93:12158] [client 109.107.243.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.107.243.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa_kBZmAQfAZtna2rDylKQAAABE"]
[Tue Mar 10 17:59:02.020512 2026] [:error] [pid 51387:tid 51393] [client 88.198.15.122:52516] [client 88.198.15.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.198.15.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aa_rZmiwPCd61yzVMnEncgAAAMQ"]
[Tue Mar 10 17:59:02.905430 2026] [:error] [pid 51387:tid 51404] [client 88.198.15.122:52516] [client 88.198.15.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.198.15.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aa_rZmiwPCd61yzVMnEndwAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Tue Mar 10 18:17:56.442958 2026] [:error] [pid 14507:tid 14567] [client 84.200.16.110:47864] [client 84.200.16.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aa_v1FJsAHIn9Awu5Qu4AwAAAEs"]
[Tue Mar 10 18:18:01.863180 2026] [:error] [pid 14508:tid 14586] [client 84.200.16.110:47948] [client 84.200.16.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aa_v2QnKcSOnGhLjpL4hjwAAAII"], referer: https://expressinteriors.com/wp-login.php
[Tue Mar 10 19:10:45.810643 2026] [:error] [pid 48041:tid 48047] [client 103.106.20.205:39546] [client 103.106.20.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa_8NclHlmjf-3oznxe49QAAAQI"]
[Tue Mar 10 19:20:15.716844 2026] [:error] [pid 14506:tid 14529] [client 103.106.20.205:48866] [client 103.106.20.205] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aa_-b42Aq9vu-sfjs-VYggAAAAk"]
[Tue Mar 10 19:22:22.898120 2026] [:error] [pid 14506:tid 14524] [client 103.106.20.205:51268] [client 103.106.20.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa_-7o2Aq9vu-sfjs-VaXQAAAAQ"]
[Tue Mar 10 19:24:12.297668 2026] [:error] [pid 14506:tid 14537] [client 103.106.20.205:53590] [client 103.106.20.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aa__XI2Aq9vu-sfjs-Vb9wAAABE"]
[Wed Mar 11 03:05:09.915928 2026] [:error] [pid 6892:tid 7082] [client 64.89.163.10:48666] [client 64.89.163.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "abBrZRRWb70O8HM28tG35AAAAAM"]
[Wed Mar 11 03:05:10.432078 2026] [:error] [pid 6892:tid 7099] [client 64.89.163.10:48672] [client 64.89.163.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "abBrZhRWb70O8HM28tG35QAAABI"]
[Wed Mar 11 03:05:10.938825 2026] [:error] [pid 6892:tid 7104] [client 64.89.163.10:48684] [client 64.89.163.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "abBrZhRWb70O8HM28tG36AAAABc"]
[Wed Mar 11 03:05:12.826846 2026] [:error] [pid 7307:tid 7321] [client 64.89.163.10:48714] [client 64.89.163.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "abBraOtE6Vj1tEJkynEKpAAAAMw"]
[Wed Mar 11 03:32:17.571367 2026] [:error] [pid 41245:tid 41318] [client 209.38.20.123:40028] [client 209.38.20.123] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "abBxwQPRacL0aDWe0xY7DwAAAI4"]
2026/03/11 03:32:17 [error] 3469#3469: *412437 access forbidden by rule, client: 209.38.20.123, server: expressinteriors.com, request: "GET /.git/config HTTP/1.1", host: "expressinteriors.com"
2026/03/11 03:32:21 [error] 3469#3469: *412437 upstream prematurely closed connection while reading response header from upstream, client: 209.38.20.123, server: expressinteriors.com, request: "GET /wp-content/plugins/gwolle-gb/frontend/captcha/ajaxresponse.php?abspath=../../../../../ HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-content/plugins/gwolle-gb/frontend/captcha/ajaxresponse.php?abspath=../../../../../", host: "expressinteriors.com"
[Wed Mar 11 03:32:21.103089 2026] [:error] [pid 41334:tid 41336] [client 209.38.20.123:40100] [client 209.38.20.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/gwolle-gb/frontend/captcha/ajaxresponse.php"] [unique_id "abBxxZ5yFJAY74I0vLU3TAAAAMA"]
2026/03/11 03:32:21 [error] 3470#3470: *412442 upstream prematurely closed connection while reading response header from upstream, client: 209.38.20.123, server: expressinteriors.com, request: "GET /wp-content/plugins/canto/includes/lib/sizes.php?abspath=../../../../../ HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-content/plugins/canto/includes/lib/sizes.php?abspath=../../../../../", host: "expressinteriors.com"
[Wed Mar 11 03:32:21.105543 2026] [:error] [pid 41245:tid 41319] [client 209.38.20.123:40102] [client 209.38.20.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/canto/includes/lib/sizes.php"] [unique_id "abBxxQPRacL0aDWe0xY7FQAAAI8"]
2026/03/11 03:32:21 [error] 3469#3469: *412437 upstream prematurely closed connection while reading response header from upstream, client: 209.38.20.123, server: expressinteriors.com, request: "GET /wp-content/plugins/lws-affiliation/view/admin/preview_widget.php?path=../../../../../ HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-content/plugins/lws-affiliation/view/admin/preview_widget.php?path=../../../../../", host: "expressinteriors.com"
[Wed Mar 11 03:32:21.120128 2026] [:error] [pid 41245:tid 41327] [client 209.38.20.123:40104] [client 209.38.20.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/lws-affiliation/view/admin/preview_widget.php"] [unique_id "abBxxQPRacL0aDWe0xY7FgAAAJc"]
[Wed Mar 11 03:32:21.120643 2026] [:error] [pid 41245:tid 41323] [client 209.38.20.123:40106] [client 209.38.20.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abBxxQPRacL0aDWe0xY7FwAAAJM"]
2026/03/11 03:32:21 [error] 3470#3470: *412442 upstream prematurely closed connection while reading response header from upstream, client: 209.38.20.123, server: expressinteriors.com, request: "GET /?umbrella-restore=1&filename=wp-includes/css/editor.css HTTP/1.1", upstream: "http://103.4.122.14:8181/?umbrella-restore=1&filename=wp-includes/css/editor.css", host: "expressinteriors.com"
2026/03/11 03:32:21 [error] 3470#3470: *412442 upstream prematurely closed connection while reading response header from upstream, client: 209.38.20.123, server: expressinteriors.com, request: "GET /wp-content/plugins/where-i-was-where-i-will-be/wiwwiwb.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-content/plugins/where-i-was-where-i-will-be/wiwwiwb.php", host: "expressinteriors.com"
[Wed Mar 11 03:32:21.136429 2026] [:error] [pid 41244:tid 41290] [client 209.38.20.123:40108] [client 209.38.20.123] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/where-i-was-where-i-will-be/wiwwiwb.php"] [unique_id "abBxxebypYGEWSbCH-QjNAAAAE0"]
[Wed Mar 11 03:39:41.442347 2026] [:error] [pid 6117:tid 6149] [client 43.153.113.127:46674] [client 43.153.113.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abBzfcU0P9gyi5rKFp6EIgAAAA0"]
[Wed Mar 11 06:14:08.960603 2026] [:error] [pid 6117:tid 6137] [client 49.49.190.112:55092] [client 49.49.190.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abCXsMU0P9gyi5rKFp6b1gAAAAE"]
[Wed Mar 11 07:48:40.389986 2026] [:error] [pid 11572:tid 11581] [client 209.87.169.77:40764] [client 209.87.169.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abCt2BiTc5L_QZTsfYE5VgAAAQc"]
[Wed Mar 11 09:33:35.280570 2026] [:error] [pid 11751:tid 11769] [client 68.218.165.129:55874] [client 68.218.165.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abDGb3KeU7OoUEz26eXq6QAAAVA"]
[Wed Mar 11 09:33:35.280981 2026] [:error] [pid 11751:tid 11757] [client 68.218.165.129:55876] [client 68.218.165.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abDGb3KeU7OoUEz26eXq6gAAAUQ"]
[Wed Mar 11 09:34:12.700378 2026] [:error] [pid 11796:tid 11806] [client 68.218.165.131:56534] [client 68.218.165.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abDGlAEDXoQrlStpO9AtYgAAAYg"], referer: https://expressinteriors.com/wp-login.php?redirect_to=https%3A%2F%2Fexpressinteriors.com%2Fwp-admin%2Fabout.php&reauth=1
[Wed Mar 11 09:35:12.382166 2026] [:error] [pid 6222:tid 6232] [client 54.253.157.231:57174] [client 54.253.157.231] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abDG0Hs7MIv-0SYBFu3S6wAAAMg"]
[Wed Mar 11 09:35:14.111027 2026] [:error] [pid 6222:tid 6233] [client 54.253.157.231:57190] [client 54.253.157.231] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abDG0ns7MIv-0SYBFu3S7AAAAMk"]
[Wed Mar 11 11:12:41.009939 2026] [:error] [pid 53953:tid 53978] [client 49.49.190.112:37298] [client 49.49.190.112] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abDdqXiDUTQy-Lyy4w2USgAAABU"]
[Wed Mar 11 11:14:10.417803 2026] [:error] [pid 23512:tid 23524] [client 49.49.190.112:38504] [client 49.49.190.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abDeAqeuPtNfm7KRzWWTJAAAAUk"]
[Wed Mar 11 11:15:58.410072 2026] [:error] [pid 53953:tid 53957] [client 49.49.190.112:39814] [client 49.49.190.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abDebniDUTQy-Lyy4w2UhgAAAAA"]
[Wed Mar 11 11:17:36.976247 2026] [:error] [pid 23512:tid 23532] [client 49.49.190.112:41132] [client 49.49.190.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abDe0KeuPtNfm7KRzWWU5QAAAVE"]
[Wed Mar 11 11:19:19.972084 2026] [:error] [pid 54045:tid 54067] [client 49.49.190.112:42392] [client 49.49.190.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abDfNyRcKzQ1f-N8TgQnXwAAANQ"]
[Wed Mar 11 11:21:02.181685 2026] [:error] [pid 53954:tid 54000] [client 49.49.190.112:43738] [client 49.49.190.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abDfnrbD1J_Nhe6jce14ywAAAE4"]
[Wed Mar 11 11:51:55.574585 2026] [:error] [pid 54045:tid 54065] [client 209.87.169.80:38804] [client 209.87.169.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abDm2yRcKzQ1f-N8TgQtQQAAANI"]
[Wed Mar 11 12:58:57.131708 2026] [:error] [pid 23482:tid 23497] [client 209.87.169.114:40222] [client 209.87.169.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abD2kcrYaTAnN_mLXylkwQAAAQw"]
[Wed Mar 11 15:34:15.776145 2026] [:error] [pid 45143:tid 45165] [client 20.63.38.5:44444] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp11.php"] [unique_id "abEa9yEXSpYdWImkpzax_QAAAZQ"]
2026/03/11 15:34:15 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wp11.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp11.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:15.981969 2026] [:error] [pid 54045:tid 54050] [client 20.63.38.5:44452] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file61.php"] [unique_id "abEa9yRcKzQ1f-N8TgRNhwAAAMM"]
2026/03/11 15:34:15 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /file61.php HTTP/1.1", upstream: "http://103.4.122.14:8181/file61.php", host: "expressinteriors.com"
2026/03/11 15:34:16 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /16.php HTTP/1.1", upstream: "http://103.4.122.14:8181/16.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:16.187557 2026] [:error] [pid 23482:tid 23499] [client 20.63.38.5:44456] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/16.php"] [unique_id "abEa-MrYaTAnN_mLXympjgAAAQ4"]
2026/03/11 15:34:16 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /bb.php HTTP/1.1", upstream: "http://103.4.122.14:8181/bb.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:16.393133 2026] [:error] [pid 23512:tid 23529] [client 20.63.38.5:44458] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bb.php"] [unique_id "abEa-KeuPtNfm7KRzWXMWQAAAU4"]
2026/03/11 15:34:16 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /ss.php HTTP/1.1", upstream: "http://103.4.122.14:8181/ss.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:16.598544 2026] [:error] [pid 23482:tid 23500] [client 20.63.38.5:44464] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "abEa-MrYaTAnN_mLXympkAAAAQ8"]
2026/03/11 15:34:16 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /cash.php HTTP/1.1", upstream: "http://103.4.122.14:8181/cash.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:16.817135 2026] [:error] [pid 45143:tid 45147] [client 20.63.38.5:44466] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cash.php"] [unique_id "abEa-CEXSpYdWImkpzax_wAAAYI"]
2026/03/11 15:34:17 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wp-p2r3q9c8k4.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-p2r3q9c8k4.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:17.022825 2026] [:error] [pid 54045:tid 54067] [client 20.63.38.5:44476] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "abEa-SRcKzQ1f-N8TgRNiAAAANQ"]
2026/03/11 15:34:17 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /ty.php HTTP/1.1", upstream: "http://103.4.122.14:8181/ty.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:17.228413 2026] [:error] [pid 53954:tid 53994] [client 20.63.38.5:44482] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ty.php"] [unique_id "abEa-bbD1J_Nhe6jce2JdwAAAEg"]
[Wed Mar 11 15:34:17.433802 2026] [:error] [pid 53953:tid 53960] [client 20.63.38.5:44484] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "abEa-XiDUTQy-Lyy4w2e9AAAAAM"]
2026/03/11 15:34:17 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /albin.php HTTP/1.1", upstream: "http://103.4.122.14:8181/albin.php", host: "expressinteriors.com"
2026/03/11 15:34:17 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wsd.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wsd.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:17.643783 2026] [:error] [pid 53954:tid 53987] [client 20.63.38.5:44488] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "abEa-bbD1J_Nhe6jce2JeQAAAEI"]
2026/03/11 15:34:17 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /utky.php HTTP/1.1", upstream: "http://103.4.122.14:8181/utky.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:17.849426 2026] [:error] [pid 53954:tid 53993] [client 20.63.38.5:44490] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/utky.php"] [unique_id "abEa-bbD1J_Nhe6jce2JegAAAEc"]
2026/03/11 15:34:18 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /settings.php HTTP/1.1", upstream: "http://103.4.122.14:8181/settings.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:18.055329 2026] [:error] [pid 54045:tid 54048] [client 20.63.38.5:44492] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/settings.php"] [unique_id "abEa-iRcKzQ1f-N8TgRNigAAAME"]
2026/03/11 15:34:18 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /fsgdjkl.php HTTP/1.1", upstream: "http://103.4.122.14:8181/fsgdjkl.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:18.260883 2026] [:error] [pid 23482:tid 23492] [client 20.63.38.5:44496] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsgdjkl.php"] [unique_id "abEa-srYaTAnN_mLXympkQAAAQc"]
2026/03/11 15:34:18 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /uuu.php HTTP/1.1", upstream: "http://103.4.122.14:8181/uuu.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:18.466492 2026] [:error] [pid 54045:tid 54066] [client 20.63.38.5:44498] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "abEa-iRcKzQ1f-N8TgRNiwAAANM"]
2026/03/11 15:34:18 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /x12.php HTTP/1.1", upstream: "http://103.4.122.14:8181/x12.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:18.671945 2026] [:error] [pid 53955:tid 54025] [client 20.63.38.5:44502] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x12.php"] [unique_id "abEa-tP1Uf6qBkbxZg_NewAAAIY"]
2026/03/11 15:34:18 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /by.php HTTP/1.1", upstream: "http://103.4.122.14:8181/by.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:18.877661 2026] [:error] [pid 53954:tid 54010] [client 20.63.38.5:44504] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/by.php"] [unique_id "abEa-rbD1J_Nhe6jce2JewAAAFc"]
2026/03/11 15:34:19 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /sf.php HTTP/1.1", upstream: "http://103.4.122.14:8181/sf.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:19.083141 2026] [:error] [pid 53954:tid 53989] [client 20.63.38.5:44512] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "abEa-7bD1J_Nhe6jce2JfQAAAEQ"]
2026/03/11 15:34:19 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /asw.php HTTP/1.1", upstream: "http://103.4.122.14:8181/asw.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:19.288604 2026] [:error] [pid 45143:tid 45151] [client 20.63.38.5:44514] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asw.php"] [unique_id "abEa-yEXSpYdWImkpzayAAAAAYY"]
[Wed Mar 11 15:34:19.494009 2026] [:error] [pid 54045:tid 54047] [client 20.63.38.5:44520] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eee.php"] [unique_id "abEa-yRcKzQ1f-N8TgRNjAAAAMA"]
2026/03/11 15:34:19 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /eee.php HTTP/1.1", upstream: "http://103.4.122.14:8181/eee.php", host: "expressinteriors.com"
2026/03/11 15:34:19 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /lp6.php HTTP/1.1", upstream: "http://103.4.122.14:8181/lp6.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:19.700103 2026] [:error] [pid 53955:tid 54028] [client 20.63.38.5:44526] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lp6.php"] [unique_id "abEa-9P1Uf6qBkbxZg_NfQAAAIk"]
2026/03/11 15:34:19 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /akses.php HTTP/1.1", upstream: "http://103.4.122.14:8181/akses.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:19.905060 2026] [:error] [pid 23512:tid 23526] [client 20.63.38.5:44532] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akses.php"] [unique_id "abEa-6euPtNfm7KRzWXMXAAAAUs"]
2026/03/11 15:34:20 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /no1.php HTTP/1.1", upstream: "http://103.4.122.14:8181/no1.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:20.111451 2026] [:error] [pid 23482:tid 23507] [client 20.63.38.5:44538] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "abEa_MrYaTAnN_mLXympkgAAARY"]
[Wed Mar 11 15:34:20.316850 2026] [:error] [pid 23482:tid 23502] [client 20.63.38.5:44544] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/teee.php"] [unique_id "abEa_MrYaTAnN_mLXymplAAAARE"]
2026/03/11 15:34:20 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /teee.php HTTP/1.1", upstream: "http://103.4.122.14:8181/teee.php", host: "expressinteriors.com"
2026/03/11 15:34:20 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /elabel.php HTTP/1.1", upstream: "http://103.4.122.14:8181/elabel.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:20.522613 2026] [:error] [pid 23482:tid 23495] [client 20.63.38.5:44552] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elabel.php"] [unique_id "abEa_MrYaTAnN_mLXymplgAAAQo"]
2026/03/11 15:34:20 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /bafFz.php HTTP/1.1", upstream: "http://103.4.122.14:8181/bafFz.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:20.730900 2026] [:error] [pid 23482:tid 23491] [client 20.63.38.5:44556] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bafFz.php"] [unique_id "abEa_MrYaTAnN_mLXymplwAAAQY"]
2026/03/11 15:34:20 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /rere.php HTTP/1.1", upstream: "http://103.4.122.14:8181/rere.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:20.936442 2026] [:error] [pid 23482:tid 23506] [client 20.63.38.5:44558] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rere.php"] [unique_id "abEa_MrYaTAnN_mLXympmAAAARU"]
2026/03/11 15:34:21 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /jocundly.php HTTP/1.1", upstream: "http://103.4.122.14:8181/jocundly.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:21.145775 2026] [:error] [pid 53955:tid 54040] [client 20.63.38.5:44564] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jocundly.php"] [unique_id "abEa_dP1Uf6qBkbxZg_NfwAAAJU"]
2026/03/11 15:34:21 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wo.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wo.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:21.351616 2026] [:error] [pid 53955:tid 54037] [client 20.63.38.5:44570] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wo.php"] [unique_id "abEa_dP1Uf6qBkbxZg_NggAAAJI"]
2026/03/11 15:34:21 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /h2h.php HTTP/1.1", upstream: "http://103.4.122.14:8181/h2h.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:21.557630 2026] [:error] [pid 53955:tid 54018] [client 20.63.38.5:44574] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/h2h.php"] [unique_id "abEa_dP1Uf6qBkbxZg_NhAAAAIA"]
[Wed Mar 11 15:34:21.763362 2026] [:error] [pid 53955:tid 54024] [client 20.63.38.5:44578] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "abEa_dP1Uf6qBkbxZg_NhgAAAIU"]
2026/03/11 15:34:21 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /rithin.php HTTP/1.1", upstream: "http://103.4.122.14:8181/rithin.php", host: "expressinteriors.com"
2026/03/11 15:34:21 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /kk.php HTTP/1.1", upstream: "http://103.4.122.14:8181/kk.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:21.970194 2026] [:error] [pid 53955:tid 54026] [client 20.63.38.5:44580] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kk.php"] [unique_id "abEa_dP1Uf6qBkbxZg_NhwAAAIc"]
[Wed Mar 11 15:34:22.175723 2026] [:error] [pid 53953:tid 53977] [client 20.63.38.5:44584] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/path.php"] [unique_id "abEa_niDUTQy-Lyy4w2e9wAAABQ"]
2026/03/11 15:34:22 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /path.php HTTP/1.1", upstream: "http://103.4.122.14:8181/path.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:22.385415 2026] [:error] [pid 53954:tid 53992] [client 20.63.38.5:44588] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cs.php"] [unique_id "abEa_rbD1J_Nhe6jce2JfgAAAEY"]
2026/03/11 15:34:22 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /cs.php HTTP/1.1", upstream: "http://103.4.122.14:8181/cs.php", host: "expressinteriors.com"
2026/03/11 15:34:22 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /w2025.php HTTP/1.1", upstream: "http://103.4.122.14:8181/w2025.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:22.590943 2026] [:error] [pid 53955:tid 54021] [client 20.63.38.5:44590] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "abEa_tP1Uf6qBkbxZg_NiAAAAIM"]
[Wed Mar 11 15:34:22.797497 2026] [:error] [pid 53955:tid 54039] [client 20.63.38.5:44592] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/foxr.php"] [unique_id "abEa_tP1Uf6qBkbxZg_NiQAAAJQ"]
2026/03/11 15:34:22 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /foxr.php HTTP/1.1", upstream: "http://103.4.122.14:8181/foxr.php", host: "expressinteriors.com"
2026/03/11 15:34:23 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /swallowable.php HTTP/1.1", upstream: "http://103.4.122.14:8181/swallowable.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:23.003875 2026] [:error] [pid 54045:tid 54052] [client 20.63.38.5:44596] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/swallowable.php"] [unique_id "abEa_yRcKzQ1f-N8TgRNjwAAAMU"]
2026/03/11 15:34:23 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /claw.php HTTP/1.1", upstream: "http://103.4.122.14:8181/claw.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:23.209600 2026] [:error] [pid 54045:tid 54063] [client 20.63.38.5:44600] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/claw.php"] [unique_id "abEa_yRcKzQ1f-N8TgRNkQAAANA"]
[Wed Mar 11 15:34:23.414552 2026] [:error] [pid 54045:tid 54065] [client 20.63.38.5:44602] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "abEa_yRcKzQ1f-N8TgRNkgAAANI"]
2026/03/11 15:34:23 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /fvvff.php HTTP/1.1", upstream: "http://103.4.122.14:8181/fvvff.php", host: "expressinteriors.com"
2026/03/11 15:34:23 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /a2.php HTTP/1.1", upstream: "http://103.4.122.14:8181/a2.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:23.620339 2026] [:error] [pid 45143:tid 45166] [client 20.63.38.5:44608] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "abEa_yEXSpYdWImkpzayBgAAAZU"]
2026/03/11 15:34:23 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /sty.php HTTP/1.1", upstream: "http://103.4.122.14:8181/sty.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:23.827715 2026] [:error] [pid 45143:tid 45145] [client 20.63.38.5:44612] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sty.php"] [unique_id "abEa_yEXSpYdWImkpzayBwAAAYA"]
2026/03/11 15:34:24 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /xxxx.php HTTP/1.1", upstream: "http://103.4.122.14:8181/xxxx.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:24.033152 2026] [:error] [pid 45143:tid 45160] [client 20.63.38.5:44616] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxxx.php"] [unique_id "abEbACEXSpYdWImkpzayCAAAAY8"]
2026/03/11 15:34:24 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //h.php HTTP/1.1", upstream: "http://103.4.122.14:8181//h.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:24.252613 2026] [:error] [pid 53955:tid 54022] [client 20.63.38.5:44626] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/h.php"] [unique_id "abEbANP1Uf6qBkbxZg_NigAAAIQ"]
2026/03/11 15:34:24 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /g.php HTTP/1.1", upstream: "http://103.4.122.14:8181/g.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:24.457999 2026] [:error] [pid 45143:tid 45155] [client 20.63.38.5:44628] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "abEbACEXSpYdWImkpzayCgAAAYo"]
[Wed Mar 11 15:34:24.663100 2026] [:error] [pid 53955:tid 54031] [client 20.63.38.5:44630] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "abEbANP1Uf6qBkbxZg_NiwAAAIw"]
2026/03/11 15:34:24 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /pp.php HTTP/1.1", upstream: "http://103.4.122.14:8181/pp.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:24.868569 2026] [:error] [pid 53955:tid 54020] [client 20.63.38.5:44634] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sys.php"] [unique_id "abEbANP1Uf6qBkbxZg_NjQAAAII"]
2026/03/11 15:34:24 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //sys.php HTTP/1.1", upstream: "http://103.4.122.14:8181//sys.php", host: "expressinteriors.com"
2026/03/11 15:34:25 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /txets.php HTTP/1.1", upstream: "http://103.4.122.14:8181/txets.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:25.073876 2026] [:error] [pid 53953:tid 53964] [client 20.63.38.5:44640] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "abEbAXiDUTQy-Lyy4w2e-QAAAAc"]
2026/03/11 15:34:25 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wp9.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp9.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:25.279710 2026] [:error] [pid 45143:tid 45165] [client 20.63.38.5:44648] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "abEbASEXSpYdWImkpzayDgAAAZQ"]
2026/03/11 15:34:25 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /path.php HTTP/1.1", upstream: "http://103.4.122.14:8181/path.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:25.485729 2026] [:error] [pid 45143:tid 45146] [client 20.63.38.5:44650] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/path.php"] [unique_id "abEbASEXSpYdWImkpzayDwAAAYE"]
2026/03/11 15:34:25 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wdf.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wdf.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:25.691476 2026] [:error] [pid 45143:tid 45157] [client 20.63.38.5:44658] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wdf.php"] [unique_id "abEbASEXSpYdWImkpzayEQAAAYw"]
2026/03/11 15:34:25 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //2.php HTTP/1.1", upstream: "http://103.4.122.14:8181//2.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:25.914009 2026] [:error] [pid 54045:tid 54062] [client 20.63.38.5:44660] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "abEbASRcKzQ1f-N8TgRNlAAAAM8"]
[Wed Mar 11 15:34:26.119521 2026] [:error] [pid 45143:tid 45153] [client 20.63.38.5:44664] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mga.php"] [unique_id "abEbAiEXSpYdWImkpzayEwAAAYg"]
2026/03/11 15:34:26 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /mga.php HTTP/1.1", upstream: "http://103.4.122.14:8181/mga.php", host: "expressinteriors.com"
2026/03/11 15:34:26 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /maxro.php HTTP/1.1", upstream: "http://103.4.122.14:8181/maxro.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:26.324886 2026] [:error] [pid 53955:tid 54036] [client 20.63.38.5:44672] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maxro.php"] [unique_id "abEbAtP1Uf6qBkbxZg_NkQAAAJE"]
2026/03/11 15:34:26 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /pass2.php HTTP/1.1", upstream: "http://103.4.122.14:8181/pass2.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:26.530459 2026] [:error] [pid 23482:tid 23497] [client 20.63.38.5:44678] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pass2.php"] [unique_id "abEbAsrYaTAnN_mLXympmwAAAQw"]
[Wed Mar 11 15:34:26.735824 2026] [:error] [pid 53955:tid 54035] [client 20.63.38.5:44686] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsvvs.php"] [unique_id "abEbAtP1Uf6qBkbxZg_NkwAAAJA"]
2026/03/11 15:34:26 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wsvvs.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wsvvs.php", host: "expressinteriors.com"
2026/03/11 15:34:26 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //3.php HTTP/1.1", upstream: "http://103.4.122.14:8181//3.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:26.951556 2026] [:error] [pid 45143:tid 45166] [client 20.63.38.5:44696] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "abEbAiEXSpYdWImkpzayFAAAAZU"]
2026/03/11 15:34:27 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //edit.php HTTP/1.1", upstream: "http://103.4.122.14:8181//edit.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:27.156801 2026] [:error] [pid 23482:tid 23500] [client 20.63.38.5:44702] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "abEbA8rYaTAnN_mLXympoQAAAQ8"]
2026/03/11 15:34:27 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /ioxi-o.php HTTP/1.1", upstream: "http://103.4.122.14:8181/ioxi-o.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:27.362630 2026] [:error] [pid 53955:tid 54034] [client 20.63.38.5:44706] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "abEbA9P1Uf6qBkbxZg_NlgAAAI8"]
[Wed Mar 11 15:34:27.569992 2026] [:error] [pid 45143:tid 45167] [client 20.63.38.5:44714] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "abEbAyEXSpYdWImkpzayFgAAAZY"]
2026/03/11 15:34:27 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wp-content/admin.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-content/admin.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:27.775422 2026] [:error] [pid 54045:tid 54059] [client 20.63.38.5:44716] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "abEbAyRcKzQ1f-N8TgRNlQAAAMw"]
2026/03/11 15:34:27 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /66.php HTTP/1.1", upstream: "http://103.4.122.14:8181/66.php", host: "expressinteriors.com"
2026/03/11 15:34:27 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //wp-includes/js/tinymce/themes/inlite/ HTTP/1.1", upstream: "http://103.4.122.14:8181//wp-includes/js/tinymce/themes/inlite/", host: "expressinteriors.com"
[Wed Mar 11 15:34:27.989103 2026] [:error] [pid 54045:tid 54056] [client 20.63.38.5:44728] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "abEbAyRcKzQ1f-N8TgRNlgAAAMk"]
2026/03/11 15:34:28 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /gifclass.php HTTP/1.1", upstream: "http://103.4.122.14:8181/gifclass.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:28.195067 2026] [:error] [pid 53954:tid 53988] [client 20.63.38.5:44732] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "abEbBLbD1J_Nhe6jce2JgAAAAEM"]
[Wed Mar 11 15:34:28.400533 2026] [:error] [pid 45143:tid 45150] [client 20.63.38.5:44734] [client 20.63.38.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "abEbBCEXSpYdWImkpzayGAAAAYU"]
2026/03/11 15:34:28 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //wp-admin/images/wp-conflg.php?p= HTTP/1.1", upstream: "http://103.4.122.14:8181//wp-admin/images/wp-conflg.php?p=", host: "expressinteriors.com"
[Wed Mar 11 15:34:28.606142 2026] [:error] [pid 45143:tid 45160] [client 20.63.38.5:44740] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "abEbBCEXSpYdWImkpzayGQAAAY8"]
2026/03/11 15:34:28 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wp-content/plugins/index.php?p= HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-content/plugins/index.php?p=", host: "expressinteriors.com"
[Wed Mar 11 15:34:28.811328 2026] [:error] [pid 23482:tid 23503] [client 20.63.38.5:44750] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "abEbBMrYaTAnN_mLXymppAAAARI"]
[Wed Mar 11 15:34:29.036995 2026] [:error] [pid 53955:tid 54020] [client 20.63.38.5:44752] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/css/index.php"] [unique_id "abEbBdP1Uf6qBkbxZg_NmwAAAII"]
2026/03/11 15:34:29 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //assets/css/index.php HTTP/1.1", upstream: "http://103.4.122.14:8181//assets/css/index.php", host: "expressinteriors.com"
2026/03/11 15:34:29 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /sc.php HTTP/1.1", upstream: "http://103.4.122.14:8181/sc.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:29.242451 2026] [:error] [pid 23482:tid 23495] [client 20.63.38.5:44758] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sc.php"] [unique_id "abEbBcrYaTAnN_mLXymppgAAAQo"]
2026/03/11 15:34:29 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /xmlrpc.php HTTP/1.1", upstream: "http://103.4.122.14:8181/xmlrpc.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:29.448096 2026] [:error] [pid 54045:tid 54050] [client 20.63.38.5:44764] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abEbBSRcKzQ1f-N8TgRNmgAAAMM"]
2026/03/11 15:34:29 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /ol.php HTTP/1.1", upstream: "http://103.4.122.14:8181/ol.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:29.653822 2026] [:error] [pid 23482:tid 23490] [client 20.63.38.5:44768] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "abEbBcrYaTAnN_mLXymppwAAAQU"]
2026/03/11 15:34:29 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //f6.php HTTP/1.1", upstream: "http://103.4.122.14:8181//f6.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:29.859793 2026] [:error] [pid 53955:tid 54028] [client 20.63.38.5:44778] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "abEbBdP1Uf6qBkbxZg_NnwAAAIk"]
2026/03/11 15:34:30 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //inputs.php HTTP/1.1", upstream: "http://103.4.122.14:8181//inputs.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:30.071668 2026] [:error] [pid 53954:tid 54003] [client 20.63.38.5:44780] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "abEbBrbD1J_Nhe6jce2JggAAAFE"]
2026/03/11 15:34:30 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /style.php HTTP/1.1", upstream: "http://103.4.122.14:8181/style.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:30.277892 2026] [:error] [pid 53955:tid 54033] [client 20.63.38.5:44782] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "abEbBtP1Uf6qBkbxZg_NoAAAAI4"]
2026/03/11 15:34:30 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /bgymj.php HTTP/1.1", upstream: "http://103.4.122.14:8181/bgymj.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:30.483333 2026] [:error] [pid 23512:tid 23537] [client 20.63.38.5:44784] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "abEbBqeuPtNfm7KRzWXMYwAAAVY"]
2026/03/11 15:34:30 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //aa.php HTTP/1.1", upstream: "http://103.4.122.14:8181//aa.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:30.690564 2026] [:error] [pid 23482:tid 23506] [client 20.63.38.5:44792] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "abEbBsrYaTAnN_mLXympqQAAARU"]
2026/03/11 15:34:30 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //1.php HTTP/1.1", upstream: "http://103.4.122.14:8181//1.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:30.895935 2026] [:error] [pid 23482:tid 23497] [client 20.63.38.5:44798] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "abEbBsrYaTAnN_mLXympqwAAAQw"]
2026/03/11 15:34:31 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //sc.php HTTP/1.1", upstream: "http://103.4.122.14:8181//sc.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:31.110077 2026] [:error] [pid 23482:tid 23493] [client 20.63.38.5:44802] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sc.php"] [unique_id "abEbB8rYaTAnN_mLXymprQAAAQg"]
[Wed Mar 11 15:34:31.316091 2026] [:error] [pid 53955:tid 54040] [client 20.63.38.5:44812] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "abEbB9P1Uf6qBkbxZg_NoQAAAJU"]
2026/03/11 15:34:31 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //av.php HTTP/1.1", upstream: "http://103.4.122.14:8181//av.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:31.522879 2026] [:error] [pid 53955:tid 54037] [client 20.63.38.5:44818] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "abEbB9P1Uf6qBkbxZg_NogAAAJI"]
2026/03/11 15:34:31 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /file.php? HTTP/1.1", upstream: "http://103.4.122.14:8181/file.php?", host: "expressinteriors.com"
2026/03/11 15:34:31 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /file59.php HTTP/1.1", upstream: "http://103.4.122.14:8181/file59.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:31.729591 2026] [:error] [pid 23482:tid 23485] [client 20.63.38.5:44824] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file59.php"] [unique_id "abEbB8rYaTAnN_mLXymprwAAAQA"]
[Wed Mar 11 15:34:31.935137 2026] [:error] [pid 53955:tid 54043] [client 20.63.38.5:44826] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "abEbB9P1Uf6qBkbxZg_NpQAAAJg"]
2026/03/11 15:34:31 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /bless.php HTTP/1.1", upstream: "http://103.4.122.14:8181/bless.php", host: "expressinteriors.com"
2026/03/11 15:34:32 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wp9.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp9.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:32.152053 2026] [:error] [pid 53955:tid 54024] [client 20.63.38.5:44832] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "abEbCNP1Uf6qBkbxZg_NpgAAAIU"]
[Wed Mar 11 15:34:32.357790 2026] [:error] [pid 23482:tid 23500] [client 20.63.38.5:44834] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "abEbCMrYaTAnN_mLXympsQAAAQ8"]
2026/03/11 15:34:32 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wp-act.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-act.php", host: "expressinteriors.com"
2026/03/11 15:34:32 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /class-t.api.php HTTP/1.1", upstream: "http://103.4.122.14:8181/class-t.api.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:32.567337 2026] [:error] [pid 23482:tid 23509] [client 20.63.38.5:44848] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "abEbCMrYaTAnN_mLXymptQAAARg"]
2026/03/11 15:34:32 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /xqq.php HTTP/1.1", upstream: "http://103.4.122.14:8181/xqq.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:32.772889 2026] [:error] [pid 53955:tid 54041] [client 20.63.38.5:44856] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xqq.php"] [unique_id "abEbCNP1Uf6qBkbxZg_NrAAAAJY"]
2026/03/11 15:34:32 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wp-admin/css/bolt.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-admin/css/bolt.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:32.977798 2026] [:error] [pid 23482:tid 23503] [client 20.63.38.5:44862] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "abEbCMrYaTAnN_mLXymptwAAARI"]
[Wed Mar 11 15:34:33.192479 2026] [:error] [pid 53955:tid 54031] [client 20.63.38.5:44864] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "abEbCdP1Uf6qBkbxZg_NrgAAAIw"]
2026/03/11 15:34:33 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /a.php?p= HTTP/1.1", upstream: "http://103.4.122.14:8181/a.php?p=", host: "expressinteriors.com"
2026/03/11 15:34:33 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /06.php HTTP/1.1", upstream: "http://103.4.122.14:8181/06.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:33.398192 2026] [:error] [pid 53955:tid 54020] [client 20.63.38.5:44868] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/06.php"] [unique_id "abEbCdP1Uf6qBkbxZg_NrwAAAII"]
[Wed Mar 11 15:34:33.604168 2026] [:error] [pid 53955:tid 54032] [client 20.63.38.5:44874] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plss3.php"] [unique_id "abEbCdP1Uf6qBkbxZg_NsQAAAI0"]
2026/03/11 15:34:33 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /plss3.php HTTP/1.1", upstream: "http://103.4.122.14:8181/plss3.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:33.822216 2026] [:error] [pid 23482:tid 23491] [client 20.63.38.5:44882] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "abEbCcrYaTAnN_mLXympugAAAQY"]
2026/03/11 15:34:33 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /aaa.php?p= HTTP/1.1", upstream: "http://103.4.122.14:8181/aaa.php?p=", host: "expressinteriors.com"
[Wed Mar 11 15:34:34.028053 2026] [:error] [pid 23482:tid 23498] [client 20.63.38.5:44886] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "abEbCsrYaTAnN_mLXympvAAAAQ0"]
2026/03/11 15:34:34 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /classwithtostring.php?p= HTTP/1.1", upstream: "http://103.4.122.14:8181/classwithtostring.php?p=", host: "expressinteriors.com"
2026/03/11 15:34:34 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wp-content/themes/index.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-content/themes/index.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:34.233319 2026] [:error] [pid 23482:tid 23496] [client 20.63.38.5:44890] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "abEbCsrYaTAnN_mLXympvgAAAQs"]
[Wed Mar 11 15:34:34.438892 2026] [:error] [pid 53955:tid 54040] [client 20.63.38.5:44894] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "abEbCtP1Uf6qBkbxZg_NtAAAAJU"]
2026/03/11 15:34:34 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /tinyfilemanager.php?p= HTTP/1.1", upstream: "http://103.4.122.14:8181/tinyfilemanager.php?p=", host: "expressinteriors.com"
[Wed Mar 11 15:34:34.644746 2026] [:error] [pid 23482:tid 23500] [client 20.63.38.5:44898] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "abEbCsrYaTAnN_mLXympwAAAAQ8"]
2026/03/11 15:34:34 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //x.php HTTP/1.1", upstream: "http://103.4.122.14:8181//x.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:34.850333 2026] [:error] [pid 53955:tid 54035] [client 20.63.38.5:44904] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms.php"] [unique_id "abEbCtP1Uf6qBkbxZg_NtQAAAJA"]
2026/03/11 15:34:34 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /ms.php HTTP/1.1", upstream: "http://103.4.122.14:8181/ms.php", host: "expressinteriors.com"
2026/03/11 15:34:35 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //wp-content/plugins/erinyani/ HTTP/1.1", upstream: "http://103.4.122.14:8181//wp-content/plugins/erinyani/", host: "expressinteriors.com"
[Wed Mar 11 15:34:35.056165 2026] [:error] [pid 53955:tid 54041] [client 20.63.38.5:44908] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/erinyani/"] [unique_id "abEbC9P1Uf6qBkbxZg_NtwAAAJY"]
2026/03/11 15:34:35 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wp-update.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-update.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:35.261759 2026] [:error] [pid 53955:tid 54022] [client 20.63.38.5:44914] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "abEbC9P1Uf6qBkbxZg_NuQAAAIQ"]
2026/03/11 15:34:35 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /sbhu.php HTTP/1.1", upstream: "http://103.4.122.14:8181/sbhu.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:35.467794 2026] [:error] [pid 53955:tid 54031] [client 20.63.38.5:44916] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "abEbC9P1Uf6qBkbxZg_NugAAAIw"]
2026/03/11 15:34:35 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /x/ HTTP/1.1", upstream: "http://103.4.122.14:8181/x/", host: "expressinteriors.com"
[Wed Mar 11 15:34:35.673858 2026] [:error] [pid 23512:tid 23530] [client 20.63.38.5:44926] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x/"] [unique_id "abEbC6euPtNfm7KRzWXMZAAAAU8"]
[Wed Mar 11 15:34:35.890977 2026] [:error] [pid 53955:tid 54021] [client 20.63.38.5:44934] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "abEbC9P1Uf6qBkbxZg_NvgAAAIM"]
2026/03/11 15:34:35 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wp-blog.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-blog.php", host: "expressinteriors.com"
2026/03/11 15:34:36 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /test1.php HTTP/1.1", upstream: "http://103.4.122.14:8181/test1.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:36.096333 2026] [:error] [pid 53955:tid 54025] [client 20.63.38.5:44936] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test1.php"] [unique_id "abEbDNP1Uf6qBkbxZg_NvwAAAIY"]
2026/03/11 15:34:36 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //wp-includes/js/jquery/ HTTP/1.1", upstream: "http://103.4.122.14:8181//wp-includes/js/jquery/", host: "expressinteriors.com"
[Wed Mar 11 15:34:36.303472 2026] [:error] [pid 45143:tid 45151] [client 20.63.38.5:44942] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "abEbDCEXSpYdWImkpzayIQAAAYY"]
2026/03/11 15:34:36 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /166.php HTTP/1.1", upstream: "http://103.4.122.14:8181/166.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:36.508864 2026] [:error] [pid 53955:tid 54028] [client 20.63.38.5:44946] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/166.php"] [unique_id "abEbDNP1Uf6qBkbxZg_NwAAAAIk"]
2026/03/11 15:34:36 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //wp-content/admin.php HTTP/1.1", upstream: "http://103.4.122.14:8181//wp-content/admin.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:36.714739 2026] [:error] [pid 45143:tid 45166] [client 20.63.38.5:44954] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "abEbDCEXSpYdWImkpzayJQAAAZU"]
2026/03/11 15:34:36 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /ms-edit.php HTTP/1.1", upstream: "http://103.4.122.14:8181/ms-edit.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:36.920107 2026] [:error] [pid 23482:tid 23494] [client 20.63.38.5:44960] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "abEbDMrYaTAnN_mLXympxAAAAQk"]
[Wed Mar 11 15:34:37.125735 2026] [:error] [pid 23482:tid 23505] [client 20.63.38.5:44968] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "abEbDcrYaTAnN_mLXympxgAAARQ"]
2026/03/11 15:34:37 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //adminfuns.php HTTP/1.1", upstream: "http://103.4.122.14:8181//adminfuns.php", host: "expressinteriors.com"
2026/03/11 15:34:37 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /goods.php HTTP/1.1", upstream: "http://103.4.122.14:8181/goods.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:37.346421 2026] [:error] [pid 53955:tid 54036] [client 20.63.38.5:44974] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "abEbDdP1Uf6qBkbxZg_NwQAAAJE"]
2026/03/11 15:34:37 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /ms-edit.php HTTP/1.1", upstream: "http://103.4.122.14:8181/ms-edit.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:37.552560 2026] [:error] [pid 23482:tid 23502] [client 20.63.38.5:44978] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "abEbDcrYaTAnN_mLXympyQAAARE"]
2026/03/11 15:34:37 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /222.php HTTP/1.1", upstream: "http://103.4.122.14:8181/222.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:37.760126 2026] [:error] [pid 23482:tid 23501] [client 20.63.38.5:44986] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "abEbDcrYaTAnN_mLXympywAAARA"]
2026/03/11 15:34:37 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /plugins.php?p= HTTP/1.1", upstream: "http://103.4.122.14:8181/plugins.php?p=", host: "expressinteriors.com"
[Wed Mar 11 15:34:37.965628 2026] [:error] [pid 23482:tid 23498] [client 20.63.38.5:44988] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins.php"] [unique_id "abEbDcrYaTAnN_mLXympzAAAAQ0"]
2026/03/11 15:34:38 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //cgi-bin/index.php HTTP/1.1", upstream: "http://103.4.122.14:8181//cgi-bin/index.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:38.170759 2026] [:error] [pid 23512:tid 23529] [client 20.63.38.5:44994] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "abEbDqeuPtNfm7KRzWXMaAAAAU4"]
2026/03/11 15:34:38 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //wp-includes/js/dist/ HTTP/1.1", upstream: "http://103.4.122.14:8181//wp-includes/js/dist/", host: "expressinteriors.com"
[Wed Mar 11 15:34:38.377683 2026] [:error] [pid 23512:tid 23523] [client 20.63.38.5:44998] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/"] [unique_id "abEbDqeuPtNfm7KRzWXMaQAAAUg"]
[Wed Mar 11 15:34:38.582934 2026] [:error] [pid 53955:tid 54035] [client 20.63.38.5:45000] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff1.php"] [unique_id "abEbDtP1Uf6qBkbxZg_NxAAAAJA"]
2026/03/11 15:34:38 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /ff1.php HTTP/1.1", upstream: "http://103.4.122.14:8181/ff1.php", host: "expressinteriors.com"
2026/03/11 15:34:38 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /fff.php HTTP/1.1", upstream: "http://103.4.122.14:8181/fff.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:38.788625 2026] [:error] [pid 53955:tid 54039] [client 20.63.38.5:45004] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "abEbDtP1Uf6qBkbxZg_NxQAAAJQ"]
2026/03/11 15:34:38 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wp-content/ HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-content/", host: "expressinteriors.com"
[Wed Mar 11 15:34:38.994211 2026] [:error] [pid 53955:tid 54022] [client 20.63.38.5:45010] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "abEbDtP1Uf6qBkbxZg_NyAAAAIQ"]
2026/03/11 15:34:39 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /goat.php HTTP/1.1", upstream: "http://103.4.122.14:8181/goat.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:39.199421 2026] [:error] [pid 53955:tid 54030] [client 20.63.38.5:45014] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat.php"] [unique_id "abEbD9P1Uf6qBkbxZg_NyQAAAIs"]
2026/03/11 15:34:39 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /155.php HTTP/1.1", upstream: "http://103.4.122.14:8181/155.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:39.423363 2026] [:error] [pid 23482:tid 23493] [client 20.63.38.5:45022] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/155.php"] [unique_id "abEbD8rYaTAnN_mLXympzwAAAQg"]
2026/03/11 15:34:39 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /we.php HTTP/1.1", upstream: "http://103.4.122.14:8181/we.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:39.629797 2026] [:error] [pid 53954:tid 54000] [client 20.63.38.5:45034] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "abEbD7bD1J_Nhe6jce2JgwAAAE4"]
2026/03/11 15:34:39 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /alpha.php HTTP/1.1", upstream: "http://103.4.122.14:8181/alpha.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:39.835824 2026] [:error] [pid 23482:tid 23486] [client 20.63.38.5:45040] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "abEbD8rYaTAnN_mLXymp1AAAAQE"]
2026/03/11 15:34:40 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /makeasmtp.php?p= HTTP/1.1", upstream: "http://103.4.122.14:8181/makeasmtp.php?p=", host: "expressinteriors.com"
[Wed Mar 11 15:34:40.049267 2026] [:error] [pid 23482:tid 23499] [client 20.63.38.5:45044] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "abEbEMrYaTAnN_mLXymp1gAAAQ4"]
2026/03/11 15:34:40 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wp-michan.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-michan.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:40.254655 2026] [:error] [pid 23482:tid 23505] [client 20.63.38.5:45050] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "abEbEMrYaTAnN_mLXymp2AAAARQ"]
2026/03/11 15:34:40 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //wp-content/cong.php HTTP/1.1", upstream: "http://103.4.122.14:8181//wp-content/cong.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:40.466935 2026] [:error] [pid 53955:tid 54020] [client 20.63.38.5:45058] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/cong.php"] [unique_id "abEbENP1Uf6qBkbxZg_NzgAAAII"]
2026/03/11 15:34:40 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wp-the.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-the.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:40.673371 2026] [:error] [pid 53955:tid 54037] [client 20.63.38.5:45074] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "abEbENP1Uf6qBkbxZg_N0wAAAJI"]
2026/03/11 15:34:40 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //wp-includes/css/dist/ HTTP/1.1", upstream: "http://103.4.122.14:8181//wp-includes/css/dist/", host: "expressinteriors.com"
[Wed Mar 11 15:34:40.878786 2026] [:error] [pid 53955:tid 54033] [client 20.63.38.5:45080] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "abEbENP1Uf6qBkbxZg_N1QAAAI4"]
[Wed Mar 11 15:34:41.083451 2026] [:error] [pid 53955:tid 54022] [client 20.63.38.5:45086] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "abEbEdP1Uf6qBkbxZg_N2AAAAIQ"]
2026/03/11 15:34:41 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /BDKR28WP.php HTTP/1.1", upstream: "http://103.4.122.14:8181/BDKR28WP.php", host: "expressinteriors.com"
2026/03/11 15:34:41 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //wp-includes/l10n/ HTTP/1.1", upstream: "http://103.4.122.14:8181//wp-includes/l10n/", host: "expressinteriors.com"
[Wed Mar 11 15:34:41.289618 2026] [:error] [pid 54045:tid 54055] [client 20.63.38.5:45090] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "abEbESRcKzQ1f-N8TgRNngAAAMg"]
2026/03/11 15:34:41 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wp.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:41.498135 2026] [:error] [pid 45143:tid 45157] [client 20.63.38.5:45096] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "abEbESEXSpYdWImkpzayMAAAAYw"]
2026/03/11 15:34:41 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //assets/css/index.php?p= HTTP/1.1", upstream: "http://103.4.122.14:8181//assets/css/index.php?p=", host: "expressinteriors.com"
[Wed Mar 11 15:34:41.703641 2026] [:error] [pid 23482:tid 23503] [client 20.63.38.5:45102] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/css/index.php"] [unique_id "abEbEcrYaTAnN_mLXymp3QAAARI"]
[Wed Mar 11 15:34:41.909724 2026] [:error] [pid 54045:tid 54052] [client 20.63.38.5:45108] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w4.php"] [unique_id "abEbESRcKzQ1f-N8TgRNoAAAAMU"]
2026/03/11 15:34:41 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /w4.php HTTP/1.1", upstream: "http://103.4.122.14:8181/w4.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:42.115708 2026] [:error] [pid 23482:tid 23493] [client 20.63.38.5:45114] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/index.php"] [unique_id "abEbEsrYaTAnN_mLXymp3wAAAQg"]
2026/03/11 15:34:42 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //wp-admin/js/widgets/index.php HTTP/1.1", upstream: "http://103.4.122.14:8181//wp-admin/js/widgets/index.php", host: "expressinteriors.com"
2026/03/11 15:34:42 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /ok.php HTTP/1.1", upstream: "http://103.4.122.14:8181/ok.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:42.330540 2026] [:error] [pid 45143:tid 45153] [client 20.63.38.5:45120] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ok.php"] [unique_id "abEbEiEXSpYdWImkpzayMgAAAYg"]
2026/03/11 15:34:42 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //about.php HTTP/1.1", upstream: "http://103.4.122.14:8181//about.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:42.548997 2026] [:error] [pid 23482:tid 23492] [client 20.63.38.5:45124] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "abEbEsrYaTAnN_mLXymp4AAAAQc"]
[Wed Mar 11 15:34:42.753850 2026] [:error] [pid 45143:tid 45149] [client 20.63.38.5:45128] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "abEbEiEXSpYdWImkpzayNQAAAYQ"]
2026/03/11 15:34:42 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wp-admin/js/fi.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-admin/js/fi.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:42.964387 2026] [:error] [pid 45143:tid 45152] [client 20.63.38.5:45134] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "abEbEiEXSpYdWImkpzayNwAAAYc"]
2026/03/11 15:34:42 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /fe5.php HTTP/1.1", upstream: "http://103.4.122.14:8181/fe5.php", host: "expressinteriors.com"
2026/03/11 15:34:43 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /kj.php HTTP/1.1", upstream: "http://103.4.122.14:8181/kj.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:43.170509 2026] [:error] [pid 53954:tid 53990] [client 20.63.38.5:45140] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "abEbE7bD1J_Nhe6jce2JhAAAAEU"]
2026/03/11 15:34:43 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //wp-content/uploads/2021/02/index.php HTTP/1.1", upstream: "http://103.4.122.14:8181//wp-content/uploads/2021/02/index.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:43.378865 2026] [:error] [pid 45143:tid 45165] [client 20.63.38.5:45146] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "abEbEyEXSpYdWImkpzayOwAAAZQ"]
[Wed Mar 11 15:34:43.586439 2026] [:error] [pid 53955:tid 54034] [client 20.63.38.5:45148] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "abEbE9P1Uf6qBkbxZg_N3AAAAI8"]
2026/03/11 15:34:43 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /av.php HTTP/1.1", upstream: "http://103.4.122.14:8181/av.php", host: "expressinteriors.com"
2026/03/11 15:34:43 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /abcd.php HTTP/1.1", upstream: "http://103.4.122.14:8181/abcd.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:43.791703 2026] [:error] [pid 53955:tid 54025] [client 20.63.38.5:45154] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "abEbE9P1Uf6qBkbxZg_N3QAAAIY"]
[Wed Mar 11 15:34:43.997490 2026] [:error] [pid 45143:tid 45168] [client 20.63.38.5:45156] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/init.php"] [unique_id "abEbEyEXSpYdWImkpzayPgAAAZc"]
2026/03/11 15:34:43 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /init.php HTTP/1.1", upstream: "http://103.4.122.14:8181/init.php", host: "expressinteriors.com"
2026/03/11 15:34:44 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /fi.php HTTP/1.1", upstream: "http://103.4.122.14:8181/fi.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:44.203818 2026] [:error] [pid 53955:tid 54037] [client 20.63.38.5:45162] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "abEbFNP1Uf6qBkbxZg_N4AAAAJI"]
2026/03/11 15:34:44 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //a1.php HTTP/1.1", upstream: "http://103.4.122.14:8181//a1.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:44.410204 2026] [:error] [pid 53955:tid 54019] [client 20.63.38.5:45172] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "abEbFNP1Uf6qBkbxZg_N4gAAAIE"]
2026/03/11 15:34:44 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /update/f35.php HTTP/1.1", upstream: "http://103.4.122.14:8181/update/f35.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:44.660363 2026] [:error] [pid 54045:tid 54049] [client 20.63.38.5:45176] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "abEbFCRcKzQ1f-N8TgRNpQAAAMI"]
[Wed Mar 11 15:34:44.869201 2026] [:error] [pid 54045:tid 54062] [client 20.63.38.5:45184] [client 20.63.38.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "abEbFCRcKzQ1f-N8TgRNpgAAAM8"]
[Wed Mar 11 15:34:45.074243 2026] [:error] [pid 53954:tid 53996] [client 20.63.38.5:45188] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "abEbFbbD1J_Nhe6jce2JhwAAAEo"]
2026/03/11 15:34:45 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /f35.php HTTP/1.1", upstream: "http://103.4.122.14:8181/f35.php", host: "expressinteriors.com"
2026/03/11 15:34:45 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /hi.php HTTP/1.1", upstream: "http://103.4.122.14:8181/hi.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:45.279534 2026] [:error] [pid 54045:tid 54056] [client 20.63.38.5:45192] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hi.php"] [unique_id "abEbFSRcKzQ1f-N8TgRNqAAAAMk"]
[Wed Mar 11 15:34:45.485666 2026] [:error] [pid 45143:tid 45164] [client 20.63.38.5:45202] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lb.php"] [unique_id "abEbFSEXSpYdWImkpzayPwAAAZM"]
2026/03/11 15:34:45 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /lb.php HTTP/1.1", upstream: "http://103.4.122.14:8181/lb.php", host: "expressinteriors.com"
2026/03/11 15:34:45 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //wp-includes/css/index.php?p= HTTP/1.1", upstream: "http://103.4.122.14:8181//wp-includes/css/index.php?p=", host: "expressinteriors.com"
[Wed Mar 11 15:34:45.691494 2026] [:error] [pid 45143:tid 45156] [client 20.63.38.5:45208] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "abEbFSEXSpYdWImkpzayQQAAAYs"]
2026/03/11 15:34:45 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wp-includes/SimplePie/ HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-includes/SimplePie/", host: "expressinteriors.com"
[Wed Mar 11 15:34:45.896915 2026] [:error] [pid 53955:tid 54041] [client 20.63.38.5:45212] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "abEbFdP1Uf6qBkbxZg_N5wAAAJY"]
2026/03/11 15:34:46 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /prv8.php HTTP/1.1", upstream: "http://103.4.122.14:8181/prv8.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:46.102319 2026] [:error] [pid 53954:tid 54008] [client 20.63.38.5:45226] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/prv8.php"] [unique_id "abEbFrbD1J_Nhe6jce2JiAAAAFU"]
2026/03/11 15:34:46 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /k.php HTTP/1.1", upstream: "http://103.4.122.14:8181/k.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:46.307772 2026] [:error] [pid 45143:tid 45161] [client 20.63.38.5:45228] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "abEbFiEXSpYdWImkpzayQgAAAZA"]
2026/03/11 15:34:46 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /dev.php HTTP/1.1", upstream: "http://103.4.122.14:8181/dev.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:46.513991 2026] [:error] [pid 53955:tid 54020] [client 20.63.38.5:45232] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev.php"] [unique_id "abEbFtP1Uf6qBkbxZg_N7wAAAII"]
2026/03/11 15:34:46 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /bal.php HTTP/1.1", upstream: "http://103.4.122.14:8181/bal.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:46.720994 2026] [:error] [pid 53955:tid 54027] [client 20.63.38.5:45248] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "abEbFtP1Uf6qBkbxZg_N8gAAAIg"]
2026/03/11 15:34:46 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /in.php HTTP/1.1", upstream: "http://103.4.122.14:8181/in.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:46.926874 2026] [:error] [pid 23482:tid 23505] [client 20.63.38.5:45254] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "abEbFsrYaTAnN_mLXymp4gAAARQ"]
2026/03/11 15:34:47 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /gssdd.php HTTP/1.1", upstream: "http://103.4.122.14:8181/gssdd.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:47.132414 2026] [:error] [pid 53955:tid 54042] [client 20.63.38.5:45256] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "abEbF9P1Uf6qBkbxZg_N8wAAAJc"]
2026/03/11 15:34:47 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /motu.php HTTP/1.1", upstream: "http://103.4.122.14:8181/motu.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:47.337410 2026] [:error] [pid 45143:tid 45158] [client 20.63.38.5:45260] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "abEbFyEXSpYdWImkpzayRAAAAY0"]
2026/03/11 15:34:47 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /bs1.php HTTP/1.1", upstream: "http://103.4.122.14:8181/bs1.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:47.542932 2026] [:error] [pid 54045:tid 54064] [client 20.63.38.5:45266] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "abEbFyRcKzQ1f-N8TgRNrQAAANE"]
2026/03/11 15:34:47 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /bengi.php HTTP/1.1", upstream: "http://103.4.122.14:8181/bengi.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:47.759009 2026] [:error] [pid 54045:tid 54047] [client 20.63.38.5:45272] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bengi.php"] [unique_id "abEbFyRcKzQ1f-N8TgRNrwAAAMA"]
2026/03/11 15:34:48 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /miansha.php HTTP/1.1", upstream: "http://103.4.122.14:8181/miansha.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:48.081884 2026] [:error] [pid 54045:tid 54054] [client 20.63.38.5:45290] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/miansha.php"] [unique_id "abEbGCRcKzQ1f-N8TgRNswAAAMc"]
2026/03/11 15:34:48 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET //erty.php HTTP/1.1", upstream: "http://103.4.122.14:8181//erty.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:48.287654 2026] [:error] [pid 23482:tid 23494] [client 20.63.38.5:45294] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/erty.php"] [unique_id "abEbGMrYaTAnN_mLXymp5QAAAQk"]
2026/03/11 15:34:48 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /wp-content/plugins/pwnd/as.php HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-content/plugins/pwnd/as.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:48.493904 2026] [:error] [pid 53954:tid 53993] [client 20.63.38.5:45302] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "abEbGLbD1J_Nhe6jce2JjAAAAEc"]
[Wed Mar 11 15:34:48.699208 2026] [:error] [pid 53954:tid 54007] [client 20.63.38.5:45310] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X57.php"] [unique_id "abEbGLbD1J_Nhe6jce2JjQAAAFQ"]
2026/03/11 15:34:48 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /X57.php HTTP/1.1", upstream: "http://103.4.122.14:8181/X57.php", host: "expressinteriors.com"
2026/03/11 15:34:48 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /axx.php HTTP/1.1", upstream: "http://103.4.122.14:8181/axx.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:48.905178 2026] [:error] [pid 54045:tid 54051] [client 20.63.38.5:45314] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "abEbGCRcKzQ1f-N8TgRNtQAAAMQ"]
[Wed Mar 11 15:34:49.110756 2026] [:error] [pid 54045:tid 54065] [client 20.63.38.5:45320] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfashell.php"] [unique_id "abEbGSRcKzQ1f-N8TgRNtwAAANI"]
2026/03/11 15:34:49 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /alfashell.php HTTP/1.1", upstream: "http://103.4.122.14:8181/alfashell.php", host: "expressinteriors.com"
2026/03/11 15:34:49 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /re.php HTTP/1.1", upstream: "http://103.4.122.14:8181/re.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:49.316505 2026] [:error] [pid 53954:tid 54010] [client 20.63.38.5:45332] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/re.php"] [unique_id "abEbGbbD1J_Nhe6jce2JjwAAAFc"]
[Wed Mar 11 15:34:49.521838 2026] [:error] [pid 23512:tid 23537] [client 20.63.38.5:45336] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/styll.php"] [unique_id "abEbGaeuPtNfm7KRzWXMcwAAAVY"]
2026/03/11 15:34:49 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /styll.php HTTP/1.1", upstream: "http://103.4.122.14:8181/styll.php", host: "expressinteriors.com"
2026/03/11 15:34:49 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /flower.php HTTP/1.1", upstream: "http://103.4.122.14:8181/flower.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:49.727178 2026] [:error] [pid 53954:tid 53984] [client 20.63.38.5:45342] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "abEbGbbD1J_Nhe6jce2JkQAAAEA"]
[Wed Mar 11 15:34:49.934862 2026] [:error] [pid 45143:tid 45152] [client 20.63.38.5:45354] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4h.php"] [unique_id "abEbGSEXSpYdWImkpzayRgAAAYc"]
2026/03/11 15:34:49 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /4h.php HTTP/1.1", upstream: "http://103.4.122.14:8181/4h.php", host: "expressinteriors.com"
2026/03/11 15:34:50 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /gettest.php HTTP/1.1", upstream: "http://103.4.122.14:8181/gettest.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:50.140607 2026] [:error] [pid 53954:tid 53985] [client 20.63.38.5:45358] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "abEbGrbD1J_Nhe6jce2JkgAAAEE"]
2026/03/11 15:34:50 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /acp.php HTTP/1.1", upstream: "http://103.4.122.14:8181/acp.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:50.345846 2026] [:error] [pid 23482:tid 23493] [client 20.63.38.5:45364] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "abEbGsrYaTAnN_mLXymp7AAAAQg"]
2026/03/11 15:34:50 [error] 53947#53947: *857261 upstream prematurely closed connection while reading response header from upstream, client: 20.63.38.5, server: expressinteriors.com, request: "GET /database.php HTTP/1.1", upstream: "http://103.4.122.14:8181/database.php", host: "expressinteriors.com"
[Wed Mar 11 15:34:50.552436 2026] [:error] [pid 23482:tid 23485] [client 20.63.38.5:45378] [client 20.63.38.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/database.php"] [unique_id "abEbGsrYaTAnN_mLXymp7wAAAQA"]
[Wed Mar 11 16:29:27.434171 2026] [:error] [pid 54045:tid 54051] [client 74.7.241.52:36188] [client 74.7.241.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abEn5yRcKzQ1f-N8TgRW_QAAAMQ"], referer: https://expressinteriors.com/
[Wed Mar 11 20:16:18.586340 2026] [:error] [pid 23512:tid 23532] [client 149.50.220.150:45984] [client 149.50.220.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abFdEqeuPtNfm7KRzWXX8gAAAVE"], referer: https://expressinteriors.com/
[Wed Mar 11 20:36:01.084548 2026] [:error] [pid 23482:tid 23498] [client 136.109.223.16:35068] [client 136.109.223.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abFhscrYaTAnN_mLXynlswAAAQ0"]
[Wed Mar 11 20:53:37.418680 2026] [:error] [pid 45143:tid 45153] [client 102.218.85.39:51312] [client 102.218.85.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abFl0SEXSpYdWImkpzb0XwAAAYg"]
[Wed Mar 11 20:56:30.875886 2026] [:error] [pid 44995:tid 45018] [client 117.120.56.170:54152] [client 117.120.56.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abFmfjoOSr9ks_axo6PS1AAAAlU"]
[Wed Mar 11 21:26:20.408395 2026] [:error] [pid 45143:tid 45153] [client 102.218.85.39:52424] [client 102.218.85.39] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abFtfCEXSpYdWImkpzb7QgAAAYg"]
[Wed Mar 11 21:28:15.447006 2026] [:error] [pid 44995:tid 45001] [client 102.218.85.39:54420] [client 102.218.85.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abFt7zoOSr9ks_axo6PjIAAAAkQ"]
[Wed Mar 11 21:30:38.687287 2026] [:error] [pid 53955:tid 54040] [client 102.218.85.39:56824] [client 102.218.85.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abFuftP1Uf6qBkbxZg_-OgAAAJU"]
[Wed Mar 11 21:32:19.822668 2026] [:error] [pid 54045:tid 54048] [client 102.218.85.39:58236] [client 102.218.85.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abFu4yRcKzQ1f-N8TgTr0QAAAME"]
[Wed Mar 11 21:34:02.418431 2026] [:error] [pid 44995:tid 45004] [client 102.218.85.39:59644] [client 102.218.85.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abFvSjoOSr9ks_axo6PmIgAAAkc"]
[Wed Mar 11 21:39:45.368781 2026] [:error] [pid 44995:tid 45003] [client 146.103.119.110:35836] [client 146.103.119.110] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.expressinteriors.com|F|2"] [data "TX:0=image/jpeg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abFwoToOSr9ks_axo6PoxgAAAkY"]
[Wed Mar 11 22:43:21.356346 2026] [:error] [pid 44995:tid 44997] [client 103.249.82.131:35578] [client 103.249.82.131] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abF_iToOSr9ks_axo6MHMwAAAkA"]
[Wed Mar 11 22:44:50.578577 2026] [:error] [pid 53955:tid 54025] [client 103.249.82.131:37040] [client 103.249.82.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abF_4tP1Uf6qBkbxZg8FTQAAAIY"]
[Wed Mar 11 22:46:12.427357 2026] [:error] [pid 44995:tid 44999] [client 117.120.56.170:38388] [client 117.120.56.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abGANDoOSr9ks_axo6MIdwAAAkI"]
[Wed Mar 11 22:47:12.670508 2026] [:error] [pid 23482:tid 23507] [client 117.120.56.170:39272] [client 117.120.56.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abGAcMrYaTAnN_mLXyn29gAAARY"]
[Wed Mar 11 22:48:17.244527 2026] [:error] [pid 23482:tid 23494] [client 43.254.111.190:40236] [client 43.254.111.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abGAscrYaTAnN_mLXyn3GgAAAQk"]
[Wed Mar 11 22:49:14.967763 2026] [:error] [pid 45143:tid 45167] [client 43.254.111.190:41008] [client 43.254.111.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abGA6iEXSpYdWImkpzYL2QAAAZY"]
[Wed Mar 11 22:50:30.508589 2026] [:error] [pid 54045:tid 54052] [client 117.120.56.170:41956] [client 117.120.56.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abGBNiRcKzQ1f-N8TgQCUgAAAMU"]
[Wed Mar 11 22:51:44.596944 2026] [:error] [pid 54045:tid 54053] [client 103.249.82.131:43012] [client 103.249.82.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abGBgCRcKzQ1f-N8TgQCrAAAAMY"]
[Wed Mar 11 22:52:54.189893 2026] [:error] [pid 44995:tid 45021] [client 117.120.56.170:44036] [client 117.120.56.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abGBxjoOSr9ks_axo6MLegAAAlg"]
[Wed Mar 11 22:53:59.558017 2026] [:error] [pid 45143:tid 45148] [client 43.254.111.190:44998] [client 43.254.111.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abGCByEXSpYdWImkpzYM1QAAAYM"]
[Wed Mar 11 22:55:04.051319 2026] [:error] [pid 44995:tid 45015] [client 43.254.111.190:45884] [client 43.254.111.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abGCSDoOSr9ks_axo6MMhQAAAlI"]
[Wed Mar 11 22:56:14.173343 2026] [:error] [pid 44995:tid 45018] [client 43.254.111.190:46766] [client 43.254.111.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abGCjjoOSr9ks_axo6MNKAAAAlU"]
[Wed Mar 11 22:58:19.518371 2026] [:error] [pid 54045:tid 54065] [client 103.249.82.131:48512] [client 103.249.82.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abGDCyRcKzQ1f-N8TgQEegAAANI"]
[Wed Mar 11 22:59:34.175074 2026] [:error] [pid 44995:tid 44997] [client 117.120.56.170:49542] [client 117.120.56.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abGDVjoOSr9ks_axo6MO1QAAAkA"]
[Wed Mar 11 23:01:47.842227 2026] [:error] [pid 44995:tid 45015] [client 103.249.82.131:51158] [client 103.249.82.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abGD2zoOSr9ks_axo6MPngAAAlI"]
[Wed Mar 11 23:04:13.953187 2026] [:error] [pid 44800:tid 44814] [client 103.249.82.131:52968] [client 103.249.82.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abGEbTN8ZerbIEHTO2qovwAAAcw"]
[Wed Mar 11 23:08:35.472076 2026] [:error] [pid 53953:tid 53959] [client 185.91.69.242:56644] [client 185.91.69.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abGFc3iDUTQy-Lyy4w2mIwAAAAI"], referer: https://expressinteriors.com/
[Thu Mar 12 01:02:32.246190 2026] [:error] [pid 55266:tid 55334] [client 41.140.33.147:50406] [client 41.140.33.147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "abGgKJsmvC-0sL-4DxHNOQAAAJc"]
[Thu Mar 12 05:13:46.287270 2026] [:error] [pid 63148:tid 63192] [client 187.1.8.87:50612] [client 187.1.8.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abHbCoWsahF1swCrZG7QxgAAAEM"]
[Thu Mar 12 08:42:09.655886 2026] [:error] [pid 11986:tid 12036] [client 43.157.50.58:54120] [client 43.157.50.58] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abIL4TKqY2w-DVCrxTCSpgAAAdI"]
[Thu Mar 12 09:35:34.559743 2026] [:error] [pid 51455:tid 51470] [client 4.199.143.151:24641] [client 4.199.143.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.199.143.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abIYZpE0YyNxdg6PL_AY_gAAAAo"]
[Thu Mar 12 09:35:34.582138 2026] [:error] [pid 11986:tid 12042] [client 4.199.143.151:24648] [client 4.199.143.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.199.143.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abIYZjKqY2w-DVCrxTCZZwAAAdg"]
[Thu Mar 12 09:36:10.197038 2026] [:error] [pid 51455:tid 51470] [client 4.199.143.151:22569] [client 4.199.143.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.199.143.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abIYipE0YyNxdg6PL_AaRAAAAAo"], referer: https://expressinteriors.com/wp-login.php?redirect_to=https%3A%2F%2Fexpressinteriors.com%2Fwp-admin%2Fabout.php&reauth=1
[Thu Mar 12 11:20:49.802805 2026] [:error] [pid 11985:tid 12009] [client 177.249.170.221:50756] [client 177.249.170.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.249.170.221, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abIxEXcAcNujsOssVDfijQAAAZI"]
[Thu Mar 12 12:05:13.189846 2026] [:error] [pid 22063:tid 22072] [client 177.249.170.221:62891] [client 177.249.170.221] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abI7ea0RUhS-MJyHWLSgLgAAAgc"]
[Thu Mar 12 12:06:59.746301 2026] [:error] [pid 51540:tid 51548] [client 177.249.170.221:63951] [client 177.249.170.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.249.170.221, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abI742OFFjotMIN2UD2MlQAAAMY"]
[Thu Mar 12 12:08:19.278187 2026] [:error] [pid 22063:tid 22070] [client 177.249.170.221:64922] [client 177.249.170.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.249.170.221, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abI8M60RUhS-MJyHWLSg8AAAAgU"]
[Thu Mar 12 12:09:37.073218 2026] [:error] [pid 51455:tid 51483] [client 177.249.170.221:49563] [client 177.249.170.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.249.170.221, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abI8gZE0YyNxdg6PL_BvvgAAABc"]
[Thu Mar 12 12:10:50.518987 2026] [:error] [pid 8249:tid 8264] [client 177.249.170.221:51036] [client 177.249.170.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.249.170.221, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abI8yiK5dL3-8Jdf0M0eFAAAAQ0"]
[Thu Mar 12 14:16:52.798465 2026] [:error] [pid 22063:tid 22080] [client 170.106.192.208:52172] [client 170.106.192.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abJaVK0RUhS-MJyHWLTUkAAAAg8"]
[Thu Mar 12 17:32:07.588284 2026] [:error] [pid 8249:tid 8273] [client 43.155.27.244:45830] [client 43.155.27.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abKIFyK5dL3-8Jdf0M3wzAAAARY"]
[Thu Mar 12 17:57:23.669938 2026] [:error] [pid 22063:tid 22078] [client 185.145.245.30:36276] [client 185.145.245.30] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.expressinteriors.com|F|2"] [data "TX:0=video/webm"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abKOA60RUhS-MJyHWLQTBAAAAg0"]
[Thu Mar 12 18:24:20.476035 2026] [:error] [pid 8249:tid 8253] [client 103.65.236.149:65481] [client 103.65.236.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "abKUVCK5dL3-8Jdf0M0JtQAAAQI"]
[Thu Mar 12 18:24:20.695214 2026] [:error] [pid 8249:tid 8252] [client 103.65.236.149:65491] [client 103.65.236.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "abKUVCK5dL3-8Jdf0M0JtgAAAQE"]
[Thu Mar 12 18:35:05.284413 2026] [:error] [pid 22063:tid 22075] [client 117.62.235.53:56501] [client 117.62.235.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abKW2a0RUhS-MJyHWLQevgAAAgo"]
[Thu Mar 12 19:41:51.510493 2026] [:error] [pid 20467:tid 20491] [client 49.51.73.183:50864] [client 49.51.73.183] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abKmf3J3UvosyIqy8ayczwAAApU"]
[Thu Mar 12 22:47:17.400147 2026] [:error] [pid 20531:tid 20620] [client 43.154.127.188:33982] [client 43.154.127.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abLR9fvw-RvNQd9b3a-3hwAAA8Q"]
[Thu Mar 12 23:18:52.852899 2026] [:error] [pid 11953:tid 11967] [client 167.99.71.124:59466] [client 167.99.71.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.99.71.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abLZXJudzqsnq3bvtDaBOQAAAUw"]
[Thu Mar 12 23:22:31.708110 2026] [:error] [pid 51456:tid 51492] [client 167.99.71.124:52362] [client 167.99.71.124] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abLaNxXu8LzVixNGr0uP5AAAAEU"], referer: https://www.google.com/search?q=wordpress
[Thu Mar 12 23:23:33.109319 2026] [:error] [pid 8249:tid 8266] [client 167.99.71.124:43388] [client 167.99.71.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.99.71.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abLadSK5dL3-8Jdf0M2eZgAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Thu Mar 12 23:23:35.904315 2026] [:error] [pid 8249:tid 8266] [client 167.99.71.124:43388] [client 167.99.71.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.99.71.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abLadyK5dL3-8Jdf0M2edQAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Thu Mar 12 23:23:37.078530 2026] [:error] [pid 8249:tid 8251] [client 167.99.71.124:43388] [client 167.99.71.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.99.71.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abLaeSK5dL3-8Jdf0M2eewAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Thu Mar 12 23:23:39.419394 2026] [:error] [pid 8249:tid 8267] [client 167.99.71.124:43388] [client 167.99.71.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.99.71.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abLaeyK5dL3-8Jdf0M2ehgAAARA"], referer: https://expressinteriors.com/wp-login.php
[Thu Mar 12 23:23:41.232573 2026] [:error] [pid 8249:tid 8260] [client 167.99.71.124:43388] [client 167.99.71.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.99.71.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abLafSK5dL3-8Jdf0M2eigAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Thu Mar 12 23:23:43.172620 2026] [:error] [pid 8249:tid 8265] [client 167.99.71.124:43388] [client 167.99.71.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.99.71.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abLafyK5dL3-8Jdf0M2ejwAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Thu Mar 12 23:45:36.388430 2026] [:error] [pid 20467:tid 20494] [client 34.24.114.205:58590] [client 34.24.114.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.24.114.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abLfoHJ3UvosyIqy8ay7OgAAApg"]
[Thu Mar 12 23:45:38.816788 2026] [:error] [pid 20467:tid 20480] [client 34.24.114.205:58590] [client 34.24.114.205] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "abLfonJ3UvosyIqy8ay7PQAAAoo"]
[Thu Mar 12 23:45:39.072946 2026] [:error] [pid 20467:tid 20481] [client 34.24.114.205:58590] [client 34.24.114.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.24.114.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abLfo3J3UvosyIqy8ay7PgAAAos"]
[Thu Mar 12 23:45:40.720925 2026] [:error] [pid 11986:tid 12028] [client 34.24.114.205:52886] [client 34.24.114.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.24.114.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abLfpDKqY2w-DVCrxTBJOgAAAco"]
[Thu Mar 12 23:45:42.282257 2026] [:error] [pid 11986:tid 12040] [client 34.24.114.205:62107] [client 34.24.114.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.24.114.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abLfpjKqY2w-DVCrxTBJPgAAAdY"]
[Thu Mar 12 23:45:43.959691 2026] [:error] [pid 11953:tid 11955] [client 34.24.114.205:57303] [client 34.24.114.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.24.114.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abLfp5udzqsnq3bvtDaMUAAAAUA"]
[Thu Mar 12 23:45:45.461116 2026] [:error] [pid 11986:tid 12039] [client 34.24.114.205:55712] [client 34.24.114.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.24.114.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abLfqTKqY2w-DVCrxTBJQQAAAdU"]
[Thu Mar 12 23:45:45.461342 2026] [:error] [pid 11986:tid 12039] [client 34.24.114.205:55712] [client 34.24.114.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.24.114.205, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abLfqTKqY2w-DVCrxTBJQQAAAdU"]
[Fri Mar 13 00:40:53.803877 2026] [:error] [pid 56003:tid 56022] [client 20.151.108.217:6345] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 27"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "abLslRQtM0oeMdFWe6VM_gAAANE"]
[Fri Mar 13 00:40:54.635758 2026] [:error] [pid 48029:tid 48054] [client 20.151.108.217:6336] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 27"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2024/"] [unique_id "abLslm7cFKMmtdGhPH-wVwAAABc"]
[Fri Mar 13 00:40:55.466926 2026] [:error] [pid 48029:tid 48031] [client 20.151.108.217:6341] [client 20.151.108.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.151.108.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "abLsl27cFKMmtdGhPH-wWAAAAAA"]
[Fri Mar 13 00:40:55.467024 2026] [:error] [pid 48029:tid 48031] [client 20.151.108.217:6341] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "abLsl27cFKMmtdGhPH-wWAAAAAA"]
[Fri Mar 13 00:40:56.293318 2026] [:error] [pid 56003:tid 56029] [client 20.151.108.217:6343] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-corn-sample.php"] [unique_id "abLsmBQtM0oeMdFWe6VNBAAAANg"]
[Fri Mar 13 00:40:57.122244 2026] [:error] [pid 56003:tid 56023] [client 20.151.108.217:6390] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "abLsmRQtM0oeMdFWe6VNCgAAANI"]
[Fri Mar 13 00:40:57.950620 2026] [:error] [pid 47894:tid 48026] [client 20.151.108.217:6368] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "abLsmZiuFpRtVNR6uOJwYQAAARg"]
[Fri Mar 13 00:40:58.774204 2026] [:error] [pid 47894:tid 48003] [client 20.151.108.217:6397] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/index.php"] [unique_id "abLsmpiuFpRtVNR6uOJwYgAAAQE"]
[Fri Mar 13 00:40:59.598882 2026] [:error] [pid 48029:tid 48049] [client 20.151.108.217:6358] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/server.php"] [unique_id "abLsm27cFKMmtdGhPH-wXAAAABI"]
[Fri Mar 13 00:41:00.432193 2026] [:error] [pid 56003:tid 56018] [client 20.151.108.217:6685] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/library/"] [unique_id "abLsnBQtM0oeMdFWe6VNDAAAAM0"]
[Fri Mar 13 00:41:01.255100 2026] [:error] [pid 47894:tid 48013] [client 20.151.108.217:6671] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/"] [unique_id "abLsnZiuFpRtVNR6uOJwZQAAAQs"]
[Fri Mar 13 00:41:02.078891 2026] [:error] [pid 47894:tid 48002] [client 20.151.108.217:6372] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wso.php"] [unique_id "abLsnpiuFpRtVNR6uOJwaAAAAQA"]
[Fri Mar 13 00:41:02.903786 2026] [:error] [pid 48029:tid 48054] [client 20.151.108.217:6337] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/crystal/"] [unique_id "abLsnm7cFKMmtdGhPH-wZwAAABc"]
[Fri Mar 13 00:41:03.731855 2026] [:error] [pid 47892:tid 47966] [client 20.151.108.217:6351] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-file.php"] [unique_id "abLsnzNdN5Yd7YcKfyX6nwAAAFI"]
[Fri Mar 13 00:41:04.560184 2026] [:error] [pid 56003:tid 56021] [client 20.151.108.217:6660] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "abLsoBQtM0oeMdFWe6VNLgAAANA"]
[Fri Mar 13 00:41:05.389562 2026] [:error] [pid 56003:tid 56018] [client 20.151.108.217:6378] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wk/index.php"] [unique_id "abLsoRQtM0oeMdFWe6VNOAAAAM0"]
[Fri Mar 13 00:41:06.216311 2026] [:error] [pid 56003:tid 56017] [client 20.151.108.217:6338] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-admin.php"] [unique_id "abLsohQtM0oeMdFWe6VNOgAAAMw"]
[Fri Mar 13 00:41:07.040194 2026] [:error] [pid 48029:tid 48043] [client 20.151.108.217:6418] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/admin.php"] [unique_id "abLso27cFKMmtdGhPH-wdwAAAAw"]
[Fri Mar 13 00:41:07.874651 2026] [:error] [pid 56003:tid 56024] [client 20.151.108.217:6667] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/"] [unique_id "abLsoxQtM0oeMdFWe6VNPwAAANM"]
[Fri Mar 13 00:41:08.700591 2026] [:error] [pid 48029:tid 48036] [client 20.151.108.217:6657] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/xmrlpc.php"] [unique_id "abLspG7cFKMmtdGhPH-weQAAAAU"]
[Fri Mar 13 00:41:09.525470 2026] [:error] [pid 56003:tid 56017] [client 20.151.108.217:6354] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "abLspRQtM0oeMdFWe6VNQgAAAMw"]
[Fri Mar 13 00:41:10.377117 2026] [:error] [pid 56003:tid 56005] [client 20.151.108.217:6373] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-admin/file.php"] [unique_id "abLsphQtM0oeMdFWe6VNQwAAAMA"]
[Fri Mar 13 00:41:11.203910 2026] [:error] [pid 48029:tid 48033] [client 20.151.108.217:6670] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "abLsp27cFKMmtdGhPH-wewAAAAI"]
[Fri Mar 13 00:41:12.038724 2026] [:error] [pid 47894:tid 48003] [client 20.151.108.217:6348] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "abLsqJiuFpRtVNR6uOJwcgAAAQE"]
[Fri Mar 13 00:41:12.864442 2026] [:error] [pid 47894:tid 48012] [client 20.151.108.217:6662] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "abLsqJiuFpRtVNR6uOJwdwAAAQo"]
[Fri Mar 13 00:41:13.694981 2026] [:error] [pid 47894:tid 48004] [client 20.151.108.217:6392] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-content/et-cache/"] [unique_id "abLsqZiuFpRtVNR6uOJwegAAAQI"]
[Fri Mar 13 00:41:14.544319 2026] [:error] [pid 47892:tid 47953] [client 20.151.108.217:6364] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "abLsqjNdN5Yd7YcKfyX6oQAAAEU"]
[Fri Mar 13 00:41:15.371484 2026] [:error] [pid 56003:tid 56010] [client 20.151.108.217:6399] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/admin.php"] [unique_id "abLsqxQtM0oeMdFWe6VNSAAAAMU"]
[Fri Mar 13 00:41:16.197485 2026] [:error] [pid 56003:tid 56013] [client 20.151.108.217:6672] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "abLsrBQtM0oeMdFWe6VNSgAAAMg"]
[Fri Mar 13 00:41:17.021394 2026] [:error] [pid 47892:tid 47959] [client 20.151.108.217:6687] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "abLsrTNdN5Yd7YcKfyX6pgAAAEs"]
[Fri Mar 13 00:41:17.849743 2026] [:error] [pid 47894:tid 48009] [client 20.151.108.217:6391] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/"] [unique_id "abLsrZiuFpRtVNR6uOJwfwAAAQc"]
[Fri Mar 13 00:41:18.675837 2026] [:error] [pid 47894:tid 48022] [client 20.151.108.217:6347] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "abLsrpiuFpRtVNR6uOJwggAAARQ"]
[Fri Mar 13 00:41:19.499773 2026] [:error] [pid 47892:tid 47969] [client 20.151.108.217:6386] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/block/"] [unique_id "abLsrzNdN5Yd7YcKfyX6qQAAAFU"]
[Fri Mar 13 00:41:20.343434 2026] [:error] [pid 48029:tid 48037] [client 20.151.108.217:6382] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "abLssG7cFKMmtdGhPH-wfgAAAAY"]
[Fri Mar 13 00:41:21.184884 2026] [:error] [pid 48029:tid 48035] [client 20.151.108.217:6388] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "abLssW7cFKMmtdGhPH-wgQAAAAQ"]
[Fri Mar 13 00:41:22.009455 2026] [:error] [pid 48029:tid 48051] [client 20.151.108.217:6383] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "abLssm7cFKMmtdGhPH-whgAAABQ"]
[Fri Mar 13 00:41:22.838126 2026] [:error] [pid 56003:tid 56019] [client 20.151.108.217:6394] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "abLsshQtM0oeMdFWe6VNTwAAAM4"]
[Fri Mar 13 00:41:23.660466 2026] [:error] [pid 56003:tid 56013] [client 20.151.108.217:6694] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/index.php"] [unique_id "abLssxQtM0oeMdFWe6VNUAAAAMg"]
[Fri Mar 13 00:41:24.497468 2026] [:error] [pid 47892:tid 47955] [client 20.151.108.217:6678] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/about.PHP"] [unique_id "abLstDNdN5Yd7YcKfyX6sAAAAEc"]
[Fri Mar 13 00:41:25.329394 2026] [:error] [pid 47894:tid 48014] [client 20.151.108.217:6676] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "abLstZiuFpRtVNR6uOJwjAAAAQw"]
[Fri Mar 13 00:41:26.164755 2026] [:error] [pid 47893:tid 47985] [client 20.151.108.217:6686] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/index.php"] [unique_id "abLstgYSdu6aqxO_YucWlAAAAIo"]
[Fri Mar 13 00:41:27.000294 2026] [:error] [pid 47892:tid 47954] [client 20.151.108.217:6424] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-content/edit.php"] [unique_id "abLstjNdN5Yd7YcKfyX6tgAAAEY"]
[Fri Mar 13 00:41:27.829617 2026] [:error] [pid 48029:tid 48046] [client 20.151.108.217:6350] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "abLst27cFKMmtdGhPH-whwAAAA8"]
[Fri Mar 13 00:41:28.656870 2026] [:error] [pid 48029:tid 48048] [client 20.151.108.217:6684] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "abLsuG7cFKMmtdGhPH-wiAAAABE"]
[Fri Mar 13 00:41:29.479836 2026] [:error] [pid 48029:tid 48038] [client 20.151.108.217:6701] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "abLsuW7cFKMmtdGhPH-wiQAAAAc"]
[Fri Mar 13 00:41:30.310653 2026] [:error] [pid 47894:tid 48015] [client 20.151.108.217:6398] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "abLsupiuFpRtVNR6uOJwkwAAAQ0"]
[Fri Mar 13 00:41:31.136746 2026] [:error] [pid 56003:tid 56019] [client 20.151.108.217:6362] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/cgi-bin/"] [unique_id "abLsuxQtM0oeMdFWe6VNVwAAAM4"]
[Fri Mar 13 00:41:31.973221 2026] [:error] [pid 48029:tid 48049] [client 20.151.108.217:6361] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/test1.php"] [unique_id "abLsu27cFKMmtdGhPH-wjAAAABI"]
[Fri Mar 13 00:41:32.799821 2026] [:error] [pid 56003:tid 56018] [client 20.151.108.217:6346] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-cron.php"] [unique_id "abLsvBQtM0oeMdFWe6VNXAAAAM0"]
[Fri Mar 13 00:41:33.640066 2026] [:error] [pid 48029:tid 48042] [client 20.151.108.217:6374] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/"] [unique_id "abLsvW7cFKMmtdGhPH-wjgAAAAs"]
[Fri Mar 13 00:41:34.466595 2026] [:error] [pid 48029:tid 48047] [client 20.151.108.217:6366] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "abLsvm7cFKMmtdGhPH-wkQAAABA"]
[Fri Mar 13 00:41:35.300994 2026] [:error] [pid 47894:tid 48023] [client 20.151.108.217:6690] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/wp-content/1.php"] [unique_id "abLsv5iuFpRtVNR6uOJwmAAAARU"]
[Fri Mar 13 00:41:36.130183 2026] [:error] [pid 47894:tid 48024] [client 20.151.108.217:6393] [client 20.151.108.217] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 20.151.108.217 on wp-login.php, counter = 28"] [hostname "expressinteriors.com"] [uri "/images/index.php"] [unique_id "abLswJiuFpRtVNR6uOJwmQAAARY"]
[Fri Mar 13 01:19:53.082934 2026] [:error] [pid 47892:tid 47957] [client 120.71.59.24:33810] [client 120.71.59.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abL1uTNdN5Yd7YcKfyUBrQAAAEk"]
[Fri Mar 13 04:48:42.375332 2026] [:error] [pid 61928:tid 61988] [client 43.154.140.188:41360] [client 43.154.140.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abMmqgod66AHekJJZioUhgAAAEs"]
[Fri Mar 13 06:02:58.147361 2026] [:error] [pid 61929:tid 62028] [client 45.131.195.39:29311] [client 45.131.195.39] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "abM4EjGGsow2jgUjLtxd4AAAAJg"]
[Fri Mar 13 06:41:32.930885 2026] [:error] [pid 61927:tid 61967] [client 20.204.115.200:1338] [client 20.204.115.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff1.php"] [unique_id "abNBHLLkK584eBa2J7XM_QAAABU"]
[Fri Mar 13 06:41:33.496679 2026] [:error] [pid 55077:tid 55098] [client 20.204.115.200:10655] [client 20.204.115.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff1.php"] [unique_id "abNBHd9Ul5ym4M-PlQL8FgAAAVM"]
[Fri Mar 13 06:41:34.052353 2026] [:error] [pid 62036:tid 62046] [client 20.204.115.200:10668] [client 20.204.115.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff1.php"] [unique_id "abNBHrce6g9kILuh_R4OmQAAAMM"]
[Fri Mar 13 06:41:34.625522 2026] [:error] [pid 62036:tid 62054] [client 20.204.115.200:8195] [client 20.204.115.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff1.php"] [unique_id "abNBHrce6g9kILuh_R4OmgAAAMs"]
[Fri Mar 13 07:13:53.918886 2026] [:error] [pid 62036:tid 62057] [client 195.178.110.159:58258] [client 195.178.110.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "abNIsbce6g9kILuh_R4X5wAAAM4"]
[Fri Mar 13 08:43:43.819391 2026] [:error] [pid 55077:tid 55092] [client 195.178.110.159:40136] [client 195.178.110.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "abNdv99Ul5ym4M-PlQIyzAAAAU0"]
[Fri Mar 13 09:41:33.526536 2026] [:error] [pid 61928:tid 61980] [client 104.28.166.127:25000] [client 104.28.166.127] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "abNrTQod66AHekJJZipODAAAAEM"]
[Fri Mar 13 09:50:33.576764 2026] [:error] [pid 9111:tid 9150] [client 45.131.195.132:35179] [client 45.131.195.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.132, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abNtaU-M156SLpD2BrsTWAAAAZg"]
[Fri Mar 13 10:46:58.607256 2026] [:error] [pid 9309:tid 9344] [client 43.159.136.201:34196] [client 43.159.136.201] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abN6oqo1KEMMghNWAN9cZwAAAhU"]
[Fri Mar 13 13:21:46.094416 2026] [:error] [pid 9241:tid 9278] [client 117.62.235.53:52419] [client 117.62.235.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abOe6g48xagB6AsXkJ7pggAAAdg"]
[Fri Mar 13 19:59:56.737170 2026] [:error] [pid 62036:tid 62065] [client 114.96.103.33:34848] [client 114.96.103.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abP8PLce6g9kILuh_R551AAAANY"]
[Fri Mar 13 21:17:12.278940 2026] [:error] [pid 9309:tid 9323] [client 85.203.23.49:56403] [client 85.203.23.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.23.49, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abQOWKo1KEMMghNWAN9OFQAAAgA"], referer: https://expressinteriors.com/wp-admin/
[Fri Mar 13 21:18:28.677020 2026] [:error] [pid 60436:tid 60469] [client 85.203.23.31:30365] [client 85.203.23.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.23.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abQOpII3PEddCArY1AaXxAAAAwA"], referer: https://cdbdinteriors.com.au/wp-admin/
[Fri Mar 13 21:18:38.093167 2026] [:error] [pid 60496:tid 60514] [client 85.203.23.53:64725] [client 85.203.23.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.23.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abQOrgb67oGiJ3jaL8z2GwAAA0o"], referer: https://cdbdinteriors.com.au/wp-admin/network/
[Fri Mar 13 21:19:55.378012 2026] [:error] [pid 60497:tid 60551] [client 85.203.23.42:44077] [client 85.203.23.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.23.42, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abQO-xjNYgapWlkb4litrQAAA5M"], referer: https://cdbdinteriors.com.au/wp-admin/about.php
[Fri Mar 13 21:21:18.076212 2026] [:error] [pid 60436:tid 60482] [client 85.203.23.52:22689] [client 85.203.23.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.23.52, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abQPToI3PEddCArY1AaYbQAAAw0"], referer: https://cdbdinteriors.com.au/wp-admin/network/about.php
[Fri Mar 13 21:25:14.075929 2026] [:error] [pid 9311:tid 9354] [client 43.166.226.57:50450] [client 43.166.226.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abQQOlTiCkU4QLmYwPk0RAAAAkM"]
[Fri Mar 13 23:19:37.752890 2026] [:error] [pid 60496:tid 60505] [client 51.89.43.80:64384] [client 51.89.43.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/cidaas-pro-master/composer.json"] [unique_id "abQrCQb67oGiJ3jaL8wf_QAAA0E"]
[Fri Mar 13 23:29:55.193639 2026] [:error] [pid 9309:tid 9323] [client 43.153.123.4:36840] [client 43.153.123.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abQtc6o1KEMMghNWAN9ahQAAAgA"]
[Sat Mar 14 01:24:56.887495 2026] [:error] [pid 47878:tid 47941] [client 20.151.4.179:60779] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chati.php"] [unique_id "abRIaH8jymmmpr1jcBesKwAAAEI"]
[Sat Mar 14 01:24:57.712206 2026] [:error] [pid 47891:tid 47982] [client 20.151.4.179:60767] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chati.php"] [unique_id "abRIafchNnuMqi7I_WH3AAAAAJA"]
[Sat Mar 14 01:24:58.545895 2026] [:error] [pid 48070:tid 48079] [client 20.151.4.179:13264] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chati.php"] [unique_id "abRIakIvrhMS5BVHxNkbawAAAAc"]
[Sat Mar 14 01:24:59.370484 2026] [:error] [pid 47891:tid 47975] [client 20.151.4.179:60755] [client 20.151.4.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chati.php"] [unique_id "abRIa_chNnuMqi7I_WH3AgAAAIk"]
[Sat Mar 14 01:56:50.907563 2026] [:error] [pid 47905:tid 48017] [client 4.204.197.4:17374] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "abRP4haYZayP4o4wpJcvAgAAAVg"]
[Sat Mar 14 01:56:51.337990 2026] [:error] [pid 47905:tid 48011] [client 4.204.197.4:17396] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "abRP4xaYZayP4o4wpJcvAwAAAVI"]
[Sat Mar 14 01:56:51.750961 2026] [:error] [pid 48070:tid 48092] [client 4.204.197.4:17362] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "abRP40IvrhMS5BVHxNksowAAABQ"]
[Sat Mar 14 01:56:52.172012 2026] [:error] [pid 48070:tid 48095] [client 4.204.197.4:17352] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "abRP5EIvrhMS5BVHxNkspAAAABc"]
[Sat Mar 14 01:56:52.582597 2026] [:error] [pid 48070:tid 48088] [client 4.204.197.4:17286] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock.php"] [unique_id "abRP5EIvrhMS5BVHxNksqAAAABA"]
[Sat Mar 14 01:56:52.995732 2026] [:error] [pid 47891:tid 47976] [client 4.204.197.4:17375] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock.php"] [unique_id "abRP5PchNnuMqi7I_WEENAAAAIo"]
[Sat Mar 14 01:56:53.424654 2026] [:error] [pid 47878:tid 47953] [client 4.204.197.4:17373] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock.php"] [unique_id "abRP5X8jymmmpr1jcBezsAAAAE4"]
[Sat Mar 14 01:56:53.834899 2026] [:error] [pid 47905:tid 48016] [client 4.204.197.4:17395] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock.php"] [unique_id "abRP5RaYZayP4o4wpJcvBQAAAVc"]
[Sat Mar 14 01:56:54.245879 2026] [:error] [pid 47878:tid 47944] [client 4.204.197.4:17300] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "abRP5n8jymmmpr1jcBezsgAAAEU"]
[Sat Mar 14 01:56:54.657050 2026] [:error] [pid 48070:tid 48089] [client 4.204.197.4:17402] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "abRP5kIvrhMS5BVHxNksqQAAABE"]
[Sat Mar 14 01:56:55.067936 2026] [:error] [pid 47878:tid 47961] [client 4.204.197.4:17393] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "abRP538jymmmpr1jcBezswAAAFY"]
[Sat Mar 14 01:56:55.478624 2026] [:error] [pid 47891:tid 47985] [client 4.204.197.4:17404] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "abRP5_chNnuMqi7I_WEEPAAAAJM"]
[Sat Mar 14 01:56:55.899302 2026] [:error] [pid 47878:tid 47939] [client 4.204.197.4:17358] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin.php"] [unique_id "abRP538jymmmpr1jcBeztAAAAEA"]
[Sat Mar 14 01:56:56.323841 2026] [:error] [pid 47891:tid 47968] [client 4.204.197.4:17284] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin.php"] [unique_id "abRP6PchNnuMqi7I_WEEPgAAAII"]
[Sat Mar 14 01:56:56.754413 2026] [:error] [pid 47891:tid 47976] [client 4.204.197.4:17388] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin.php"] [unique_id "abRP6PchNnuMqi7I_WEEQAAAAIo"]
[Sat Mar 14 01:56:57.193007 2026] [:error] [pid 47891:tid 47973] [client 4.204.197.4:17350] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin.php"] [unique_id "abRP6fchNnuMqi7I_WEEQgAAAIc"]
[Sat Mar 14 01:56:57.610493 2026] [:error] [pid 47878:tid 47962] [client 4.204.197.4:17287] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "abRP6X8jymmmpr1jcBezuAAAAFc"]
[Sat Mar 14 01:56:58.024571 2026] [:error] [pid 47891:tid 47985] [client 4.204.197.4:17376] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "abRP6vchNnuMqi7I_WEERgAAAJM"]
[Sat Mar 14 01:56:58.446923 2026] [:error] [pid 47878:tid 47941] [client 4.204.197.4:17294] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "abRP6n8jymmmpr1jcBezuQAAAEI"]
[Sat Mar 14 01:56:58.874087 2026] [:error] [pid 47891:tid 47970] [client 4.204.197.4:17289] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "abRP6vchNnuMqi7I_WEESgAAAIQ"]
[Sat Mar 14 01:56:59.314624 2026] [:error] [pid 47878:tid 47958] [client 4.204.197.4:17384] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test.php"] [unique_id "abRP638jymmmpr1jcBezugAAAFM"]
[Sat Mar 14 01:56:59.739765 2026] [:error] [pid 47878:tid 47952] [client 4.204.197.4:17385] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test.php"] [unique_id "abRP638jymmmpr1jcBezuwAAAE0"]
[Sat Mar 14 01:57:00.158884 2026] [:error] [pid 47878:tid 47950] [client 4.204.197.4:17377] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test.php"] [unique_id "abRP7H8jymmmpr1jcBezvAAAAEs"]
[Sat Mar 14 01:57:00.582464 2026] [:error] [pid 47905:tid 48003] [client 4.204.197.4:17296] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test.php"] [unique_id "abRP7BaYZayP4o4wpJcvBwAAAUo"]
[Sat Mar 14 01:57:00.993490 2026] [:error] [pid 47905:tid 48000] [client 4.204.197.4:17235] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "abRP7BaYZayP4o4wpJcvCQAAAUc"]
[Sat Mar 14 01:57:01.410764 2026] [:error] [pid 47905:tid 48015] [client 4.204.197.4:17355] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "abRP7RaYZayP4o4wpJcvCgAAAVY"]
[Sat Mar 14 01:57:01.960254 2026] [:error] [pid 47878:tid 47956] [client 4.204.197.4:17297] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "abRP7X8jymmmpr1jcBezwQAAAFE"]
[Sat Mar 14 01:57:02.411733 2026] [:error] [pid 47891:tid 47979] [client 4.204.197.4:17315] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "abRP7vchNnuMqi7I_WEETwAAAI0"]
[Sat Mar 14 01:57:02.828913 2026] [:error] [pid 47891:tid 47985] [client 4.204.197.4:17311] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "abRP7vchNnuMqi7I_WEEUAAAAJM"]
[Sat Mar 14 01:57:03.309000 2026] [:error] [pid 47891:tid 47977] [client 4.204.197.4:17218] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "abRP7_chNnuMqi7I_WEEUQAAAIs"]
[Sat Mar 14 01:57:03.740746 2026] [:error] [pid 47891:tid 47986] [client 4.204.197.4:17407] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "abRP7_chNnuMqi7I_WEEVAAAAJQ"]
[Sat Mar 14 01:57:04.157536 2026] [:error] [pid 47891:tid 47983] [client 4.204.197.4:17346] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "abRP8PchNnuMqi7I_WEEVgAAAJE"]
[Sat Mar 14 01:57:04.572663 2026] [:error] [pid 48070:tid 48093] [client 4.204.197.4:17216] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up.php"] [unique_id "abRP8EIvrhMS5BVHxNkssAAAABU"]
[Sat Mar 14 01:57:04.983591 2026] [:error] [pid 47905:tid 48011] [client 4.204.197.4:17285] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up.php"] [unique_id "abRP8BaYZayP4o4wpJcvDwAAAVI"]
[Sat Mar 14 01:57:05.396774 2026] [:error] [pid 47891:tid 47968] [client 4.204.197.4:17281] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up.php"] [unique_id "abRP8fchNnuMqi7I_WEEWwAAAII"]
[Sat Mar 14 01:57:05.806299 2026] [:error] [pid 47891:tid 47985] [client 4.204.197.4:17382] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up.php"] [unique_id "abRP8fchNnuMqi7I_WEEXgAAAJM"]
[Sat Mar 14 01:57:06.237372 2026] [:error] [pid 47891:tid 47970] [client 4.204.197.4:17293] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "abRP8vchNnuMqi7I_WEEYwAAAIQ"]
[Sat Mar 14 01:57:06.651304 2026] [:error] [pid 47891:tid 47981] [client 4.204.197.4:17291] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "abRP8vchNnuMqi7I_WEEZgAAAI8"]
[Sat Mar 14 01:57:07.117177 2026] [:error] [pid 47878:tid 47941] [client 4.204.197.4:17307] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "abRP838jymmmpr1jcBezxQAAAEI"]
[Sat Mar 14 01:57:07.531546 2026] [:error] [pid 47891:tid 47973] [client 4.204.197.4:17283] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "abRP8_chNnuMqi7I_WEEaQAAAIc"]
[Sat Mar 14 02:51:12.500869 2026] [:error] [pid 48070:tid 48079] [client 182.43.70.143:53089] [client 182.43.70.143] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abRcoEIvrhMS5BVHxNk8TwAAAAc"]
[Sat Mar 14 02:53:09.122964 2026] [:error] [pid 47878:tid 47945] [client 203.174.26.11:42562] [client 203.174.26.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.174.26.11, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abRdFX8jymmmpr1jcBfC-gAAAEY"]
[Sat Mar 14 02:53:10.267784 2026] [:error] [pid 47878:tid 47947] [client 203.174.26.11:42562] [client 203.174.26.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.174.26.11, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abRdFn8jymmmpr1jcBfC-wAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Sat Mar 14 04:16:29.540294 2026] [:error] [pid 35801:tid 35818] [client 4.205.16.4:2002] [client 4.205.16.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.205.16.4, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abRwnW8tVFelXGsqbU-HSQAAAQ4"]
[Sat Mar 14 04:39:03.979712 2026] [autoindex:error] [pid 35801:tid 35816] [client 20.104.119.247:30722] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Mar 14 04:39:04.187064 2026] [:error] [pid 35801:tid 35827] [client 20.104.119.247:30722] [client 20.104.119.247] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.104.119.247, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "abR16G8tVFelXGsqbU-RNwAAARc"]
[Sat Mar 14 04:39:07.436504 2026] [autoindex:error] [pid 35801:tid 35826] [client 20.104.119.247:30722] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Mar 14 04:39:10.058130 2026] [autoindex:error] [pid 35801:tid 35812] [client 20.104.119.247:30722] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Mar 14 04:39:10.270165 2026] [autoindex:error] [pid 35801:tid 35805] [client 20.104.119.247:30722] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Mar 14 04:39:11.318328 2026] [autoindex:error] [pid 35801:tid 35826] [client 20.104.119.247:30722] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Mar 14 04:39:15.584393 2026] [autoindex:error] [pid 35801:tid 35817] [client 20.104.119.247:30722] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Mar 14 04:39:16.684960 2026] [:error] [pid 35801:tid 35819] [client 20.104.119.247:30722] [client 20.104.119.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "abR19G8tVFelXGsqbU-RfgAAAQ8"]
[Sat Mar 14 04:39:19.134649 2026] [:error] [pid 3914:tid 4004] [client 20.104.119.247:31515] [client 20.104.119.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "abR19_H_HeUqa_sn9-D6jgAAAJQ"]
[Sat Mar 14 04:39:20.066257 2026] [:error] [pid 35801:tid 35820] [client 20.104.119.247:31541] [client 20.104.119.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "abR1-G8tVFelXGsqbU-RhwAAARA"]
[Sat Mar 14 04:39:21.007715 2026] [:error] [pid 3912:tid 3948] [client 20.104.119.247:31521] [client 20.104.119.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "abR1-cXFZBK-jpdCvTG-QwAAABU"]
[Sat Mar 14 04:39:21.888857 2026] [:error] [pid 3914:tid 3984] [client 20.104.119.247:31545] [client 20.104.119.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "abR1-fH_HeUqa_sn9-D6kQAAAIA"]
[Sat Mar 14 07:18:40.981275 2026] [:error] [pid 57226:tid 57233] [client 69.49.112.71:55136] [client 69.49.112.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.112.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abSbUGxFlXQvNewjeI8_aQAAAUM"]
[Sat Mar 14 07:18:41.960162 2026] [:error] [pid 57226:tid 57242] [client 69.49.112.71:55136] [client 69.49.112.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.112.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abSbUWxFlXQvNewjeI8_bAAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Sat Mar 14 08:03:21.046399 2026] [:error] [pid 3913:tid 3968] [client 170.64.164.110:33252] [client 170.64.164.110] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop/wp-admin/install.php"] [unique_id "abSlyR9qvQd4GQHUp68qXAAAAEs"]
[Sat Mar 14 09:03:15.177228 2026] [:error] [pid 3913:tid 3967] [client 43.130.39.254:37218] [client 43.130.39.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abSz0x9qvQd4GQHUp689RgAAAEo"]
[Sat Mar 14 09:32:40.646862 2026] [:error] [pid 57226:tid 57252] [client 162.211.80.57:44474] [client 162.211.80.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.211.80.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abS6uGxFlXQvNewjeI97kwAAAVY"]
[Sat Mar 14 09:32:41.918004 2026] [:error] [pid 57226:tid 57254] [client 162.211.80.57:44474] [client 162.211.80.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.211.80.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abS6uWxFlXQvNewjeI97lQAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Sat Mar 14 11:46:29.775287 2026] [:error] [pid 13261:tid 13268] [client 67.205.48.12:60226] [client 67.205.48.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.205.48.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abTaFfDFVxjWSW61p5kEhQAAAMI"]
[Sat Mar 14 11:46:30.697781 2026] [:error] [pid 13261:tid 13281] [client 67.205.48.12:60226] [client 67.205.48.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.205.48.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abTaFvDFVxjWSW61p5kEhwAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Sat Mar 14 13:33:52.914014 2026] [:error] [pid 13261:tid 13268] [client 49.51.166.228:40452] [client 49.51.166.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abTzQPDFVxjWSW61p5khAwAAAMI"]
[Sat Mar 14 13:58:23.915757 2026] [:error] [pid 54132:tid 54159] [client 45.76.8.220:43768] [client 45.76.8.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.76.8.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abT4_8MoWcZxtn8Rxy9dQwAAA1Y"]
[Sat Mar 14 13:58:26.394186 2026] [:error] [pid 13262:tid 13306] [client 45.76.8.220:43778] [client 45.76.8.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.76.8.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abT5AjAdvM7ft5BXQ2eimgAAAY0"], referer: https://expressinteriors.com/wp-login.php
[Sat Mar 14 15:47:07.583925 2026] [:error] [pid 13151:tid 13171] [client 104.243.43.237:46170] [client 104.243.43.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.243.43.237, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abUSe9bXrXQxFzrsw43-7QAAAJI"]
[Sat Mar 14 15:47:08.568643 2026] [:error] [pid 13151:tid 13160] [client 104.243.43.237:46170] [client 104.243.43.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.243.43.237, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abUSfNbXrXQxFzrsw43-7wAAAIc"], referer: https://expressinteriors.com/wp-login.php
[Sat Mar 14 15:49:39.205824 2026] [:error] [pid 61383:tid 61422] [client 106.119.167.146:50125] [client 106.119.167.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abUTEy4SAn4TCd4o0dXGbgAAAQY"]
[Sat Mar 14 16:37:45.600256 2026] [:error] [pid 13151:tid 13177] [client 192.88.180.174:43260] [client 192.88.180.174] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.expressinteriors.com|F|2"] [data "TX:0=application/javascript"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abUeWdbXrXQxFzrsw40Z3gAAAJg"]
[Sat Mar 14 16:37:47.958669 2026] [:error] [pid 13151:tid 13169] [client 192.88.180.174:43260] [client 192.88.180.174] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.expressinteriors.com|F|2"] [data "TX:0=application/javascript"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abUeW9bXrXQxFzrsw40Z5QAAAJA"]
[Sat Mar 14 17:34:32.651676 2026] [:error] [pid 61477:tid 61489] [client 122.167.187.24:53757] [client 122.167.187.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.167.187.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abUrqKcx6muYfIYRM7CwFwAAAEg"]
[Sat Mar 14 17:43:15.561866 2026] [:error] [pid 61477:tid 61494] [client 122.167.187.24:61775] [client 122.167.187.24] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abUts6cx6muYfIYRM7CyfQAAAE0"]
[Sat Mar 14 17:44:54.273333 2026] [:error] [pid 13151:tid 13172] [client 122.167.187.24:64300] [client 122.167.187.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.167.187.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abUuFtbXrXQxFzrsw401GwAAAJM"]
[Sat Mar 14 17:46:27.480874 2026] [:error] [pid 61384:tid 61462] [client 122.167.187.24:49698] [client 122.167.187.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.167.187.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abUuc_zibL2IYJprDHKnngAAAdM"]
[Sat Mar 14 17:47:43.992063 2026] [:error] [pid 61477:tid 61488] [client 122.167.187.24:50254] [client 122.167.187.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.167.187.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abUuv6cx6muYfIYRM7CzYgAAAEc"]
[Sat Mar 14 17:49:02.963494 2026] [:error] [pid 13151:tid 13156] [client 122.167.187.24:50795] [client 122.167.187.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.167.187.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abUvDtbXrXQxFzrsw403swAAAIM"]
[Sat Mar 14 17:58:24.571637 2026] [:error] [pid 61383:tid 61427] [client 52.205.77.98:19836] [client 52.205.77.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.205.77.98, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abUxQC4SAn4TCd4o0dXbvQAAAQs"]
[Sat Mar 14 17:58:25.457789 2026] [:error] [pid 61383:tid 61430] [client 52.205.77.98:19836] [client 52.205.77.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.205.77.98, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abUxQS4SAn4TCd4o0dXbvwAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Sat Mar 14 20:14:14.764558 2026] [:error] [pid 13151:tid 13175] [client 39.97.110.217:43312] [client 39.97.110.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 39.97.110.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abVRFtbXrXQxFzrsw41f2gAAAJY"]
[Sat Mar 14 20:14:16.780749 2026] [:error] [pid 13151:tid 13168] [client 39.97.110.217:43312] [client 39.97.110.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 39.97.110.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abVRGNbXrXQxFzrsw41f3gAAAI8"], referer: https://expressinteriors.com/wp-login.php
[Sat Mar 14 21:15:03.762858 2026] [:error] [pid 30154:tid 30174] [client 14.248.94.54:57262] [client 14.248.94.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 14.248.94.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abVfV16OP9woRgp3v0GJYQAAAM4"]
[Sat Mar 14 21:24:07.851592 2026] [:error] [pid 58680:tid 58697] [client 14.248.94.54:62558] [client 14.248.94.54] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abVhd5esvz6ml-XzsmVIFwAAAU8"]
[Sat Mar 14 21:25:52.893462 2026] [:error] [pid 30154:tid 30182] [client 14.248.94.54:63892] [client 14.248.94.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 14.248.94.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abVh4F6OP9woRgp3v0GMqQAAANY"]
[Sat Mar 14 21:27:30.526754 2026] [:error] [pid 61384:tid 61455] [client 14.248.94.54:64797] [client 14.248.94.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 14.248.94.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abViQvzibL2IYJprDHLCoQAAAcw"]
[Sat Mar 14 21:29:10.698668 2026] [:error] [pid 30154:tid 30178] [client 14.248.94.54:65113] [client 14.248.94.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 14.248.94.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abVipl6OP9woRgp3v0GNfwAAANI"]
[Sat Mar 14 21:30:49.534842 2026] [:error] [pid 30154:tid 30180] [client 14.248.94.54:49846] [client 14.248.94.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 14.248.94.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abVjCV6OP9woRgp3v0GN2gAAANQ"]
[Sat Mar 14 22:42:50.110186 2026] [:error] [pid 30154:tid 30160] [client 64.202.117.163:37972] [client 64.202.117.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.202.117.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abVz6l6OP9woRgp3v0Gp5AAAAMA"]
[Sat Mar 14 22:42:51.286274 2026] [:error] [pid 30154:tid 30181] [client 64.202.117.163:37972] [client 64.202.117.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.202.117.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abVz616OP9woRgp3v0Gp6AAAANU"], referer: https://expressinteriors.com/wp-login.php
[Sat Mar 14 23:20:53.668597 2026] [:error] [pid 49351:tid 49363] [client 162.240.22.47:51902] [client 162.240.22.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.22.47, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abV81RzAvuOUcwe0iz-HMwAAAwk"]
[Sat Mar 14 23:20:55.006553 2026] [:error] [pid 49351:tid 49366] [client 162.240.22.47:51902] [client 162.240.22.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.22.47, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abV81xzAvuOUcwe0iz-HNgAAAww"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 15 00:24:21.557074 2026] [:error] [pid 19658:tid 19942] [client 43.130.141.193:38930] [client 43.130.141.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abWLtVIS7ZSIcsV9BQp98gAAAAU"]
[Sun Mar 15 01:11:09.983168 2026] [:error] [pid 19680:tid 19999] [client 82.196.25.136:42370] [client 82.196.25.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.196.25.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abWWrUnhGahR8LEhCX-eWgAAAcc"]
[Sun Mar 15 01:11:10.845935 2026] [:error] [pid 19680:tid 20008] [client 82.196.25.136:42370] [client 82.196.25.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.196.25.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abWWrknhGahR8LEhCX-eXQAAAdA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 15 02:27:38.758282 2026] [:error] [pid 19671:tid 19976] [client 104.243.43.237:60228] [client 104.243.43.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.243.43.237, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abWomlu8gYYbnWVq3mUp0AAAAQs"]
[Sun Mar 15 02:27:40.074346 2026] [:error] [pid 19671:tid 19986] [client 104.243.43.237:60228] [client 104.243.43.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.243.43.237, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abWonFu8gYYbnWVq3mUp0QAAARU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 15 03:21:07.877348 2026] [:error] [pid 19680:tid 20011] [client 132.148.77.54:41566] [client 132.148.77.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 132.148.77.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abW1I0nhGahR8LEhCX_GRQAAAdM"]
[Sun Mar 15 03:21:09.253600 2026] [:error] [pid 19680:tid 20014] [client 132.148.77.54:41566] [client 132.148.77.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 132.148.77.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abW1JUnhGahR8LEhCX_GRgAAAdY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 15 04:20:54.941950 2026] [:error] [pid 38540:tid 38595] [client 18.219.163.140:35440] [client 18.219.163.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.219.163.140, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abXDJl8bnHsJ1dE90bLQIwAAAEk"]
[Sun Mar 15 04:20:56.175119 2026] [:error] [pid 38540:tid 38591] [client 18.219.163.140:35440] [client 18.219.163.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.219.163.140, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abXDKF8bnHsJ1dE90bLQJAAAAEU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 15 04:33:21.992800 2026] [:error] [pid 38536:tid 38555] [client 102.18.29.26:61917] [client 102.18.29.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.18.29.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abXGEfpTEqkVJ0rBEWtmyQAAAAI"]
[Sun Mar 15 04:39:53.894364 2026] [:error] [pid 9995:tid 10017] [client 102.18.29.26:65472] [client 102.18.29.26] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abXHmQa8xkcaSmgTbwjCnwAAARM"]
[Sun Mar 15 04:41:21.778853 2026] [:error] [pid 9995:tid 10018] [client 102.18.29.26:50160] [client 102.18.29.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.18.29.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abXH8Qa8xkcaSmgTbwjE0QAAARQ"]
[Sun Mar 15 04:42:48.663351 2026] [:error] [pid 9995:tid 10007] [client 102.18.29.26:51156] [client 102.18.29.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.18.29.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abXISAa8xkcaSmgTbwjGuwAAAQk"]
[Sun Mar 15 04:44:13.052816 2026] [:error] [pid 38536:tid 38559] [client 102.18.29.26:52106] [client 102.18.29.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.18.29.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abXInfpTEqkVJ0rBEWttNwAAAAY"]
[Sun Mar 15 04:45:35.112008 2026] [:error] [pid 38540:tid 38587] [client 102.18.29.26:52789] [client 102.18.29.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.18.29.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abXI718bnHsJ1dE90bLeMQAAAEE"]
[Sun Mar 15 05:05:52.715705 2026] [:error] [pid 38536:tid 38561] [client 182.43.70.143:60176] [client 182.43.70.143] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abXNsPpTEqkVJ0rBEWt3QAAAAAg"]
[Sun Mar 15 05:15:54.774724 2026] [:error] [pid 38540:tid 38599] [client 82.194.91.137:60722] [client 82.194.91.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.194.91.137, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abXQCl8bnHsJ1dE90bLj3QAAAE0"]
[Sun Mar 15 05:15:55.798943 2026] [:error] [pid 38540:tid 38593] [client 82.194.91.137:60722] [client 82.194.91.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.194.91.137, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abXQC18bnHsJ1dE90bLj3wAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 15 08:51:04.574119 2026] [:error] [pid 38541:tid 38635] [client 35.193.28.49:33102] [client 35.193.28.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.193.28.49, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abYCeHuOpex8jIO0jt4QzAAAAJY"]
[Sun Mar 15 08:51:06.810462 2026] [:error] [pid 38645:tid 38659] [client 35.193.28.49:40862] [client 35.193.28.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.193.28.49, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abYCehFPHtsDUuVrWDaPowAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 15 08:56:02.478406 2026] [:error] [pid 38645:tid 38652] [client 157.173.96.120:40100] [client 157.173.96.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.173.96.120, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abYDohFPHtsDUuVrWDaQlQAAAMU"]
[Sun Mar 15 08:56:03.364847 2026] [:error] [pid 38645:tid 38665] [client 157.173.96.120:40100] [client 157.173.96.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.173.96.120, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abYDoxFPHtsDUuVrWDaQlwAAANI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 15 09:43:38.424883 2026] [:error] [pid 38645:tid 38665] [client 20.219.138.187:30696] [client 20.219.138.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff1.php"] [unique_id "abYOyhFPHtsDUuVrWDaaLwAAANI"]
[Sun Mar 15 09:43:39.019047 2026] [:error] [pid 38541:tid 38622] [client 20.219.138.187:7180] [client 20.219.138.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff1.php"] [unique_id "abYOy3uOpex8jIO0jt4d_wAAAIk"]
[Sun Mar 15 09:43:39.610035 2026] [:error] [pid 38541:tid 38627] [client 20.219.138.187:7193] [client 20.219.138.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff1.php"] [unique_id "abYOy3uOpex8jIO0jt4eAQAAAI4"]
[Sun Mar 15 09:43:40.208996 2026] [:error] [pid 9995:tid 10004] [client 20.219.138.187:6423] [client 20.219.138.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff1.php"] [unique_id "abYOzAa8xkcaSmgTbwgo3QAAAQY"]
[Sun Mar 15 10:43:19.647249 2026] [:error] [pid 50986:tid 50989] [client 212.30.33.88:42819] [client 212.30.33.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "abYcxyknK4c779bcQqHkqQAAAUE"]
[Sun Mar 15 10:45:31.886795 2026] [:error] [pid 38645:tid 38653] [client 212.30.33.67:62505] [client 212.30.33.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "abYdSxFPHtsDUuVrWDayBgAAAMY"]
[Sun Mar 15 10:48:31.704329 2026] [:error] [pid 42570:tid 42584] [client 212.30.33.57:64927] [client 212.30.33.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "abYd_8IUXZJLmk_gYCOpYgAAAYs"]
[Sun Mar 15 10:50:03.879125 2026] [:error] [pid 38541:tid 38613] [client 212.30.33.68:61731] [client 212.30.33.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "abYeW3uOpex8jIO0jt5H_AAAAIA"]
[Sun Mar 15 10:50:04.705858 2026] [:error] [pid 38541:tid 38617] [client 212.30.33.98:34495] [client 212.30.33.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "abYeXHuOpex8jIO0jt5IBwAAAIQ"]
[Sun Mar 15 10:50:35.929562 2026] [:error] [pid 42570:tid 42585] [client 212.30.33.98:34171] [client 212.30.33.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "abYee8IUXZJLmk_gYCOyDAAAAYw"]
[Sun Mar 15 10:50:42.704638 2026] [:error] [pid 50986:tid 51006] [client 212.30.33.166:42635] [client 212.30.33.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "abYegiknK4c779bcQqH-XwAAAVE"]
[Sun Mar 15 10:50:53.502292 2026] [:error] [pid 38536:tid 38563] [client 212.30.33.99:34819] [client 212.30.33.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "abYejfpTEqkVJ0rBEWvX4AAAAAo"]
[Sun Mar 15 10:51:24.259490 2026] [:error] [pid 38536:tid 38554] [client 212.30.33.58:48155] [client 212.30.33.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "abYerPpTEqkVJ0rBEWvZWgAAAAE"]
[Sun Mar 15 10:51:39.551313 2026] [proxy_fcgi:error] [pid 50986:tid 50999] [client 212.30.33.228:23535] AH01071: Got error 'Primary script unknown'
[Sun Mar 15 10:51:39.975433 2026] [:error] [pid 50986:tid 51000] [client 212.30.33.228:23535] [client 212.30.33.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "abYeuyknK4c779bcQqEBDgAAAUs"]
[Sun Mar 15 10:51:47.124377 2026] [:error] [pid 42570:tid 42585] [client 212.30.33.95:24099] [client 212.30.33.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "abYew8IUXZJLmk_gYCO3HAAAAYw"]
[Sun Mar 15 10:51:58.423789 2026] [:error] [pid 38540:tid 38605] [client 212.30.33.101:28125] [client 212.30.33.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "abYezl8bnHsJ1dE90bI2xAAAAFM"]
[Sun Mar 15 10:52:13.673986 2026] [:error] [pid 38541:tid 38625] [client 212.30.33.225:41893] [client 212.30.33.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "abYe3XuOpex8jIO0jt5O6gAAAIw"]
[Sun Mar 15 10:52:14.479412 2026] [:error] [pid 45974:tid 45991] [client 212.30.33.62:59159] [client 212.30.33.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "abYe3hWn4R6u72SegehBugAAAg8"]
[Sun Mar 15 10:52:23.968141 2026] [:error] [pid 38541:tid 38628] [client 212.30.33.75:39605] [client 212.30.33.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "abYe53uOpex8jIO0jt5PYgAAAI8"]
[Sun Mar 15 10:52:36.677922 2026] [:error] [pid 38536:tid 38567] [client 212.30.33.80:30185] [client 212.30.33.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "abYe9PpTEqkVJ0rBEWvcvQAAAA4"]
[Sun Mar 15 10:52:37.496721 2026] [:error] [pid 38645:tid 38656] [client 212.30.33.73:50105] [client 212.30.33.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "abYe9RFPHtsDUuVrWDbGKAAAAMk"]
[Sun Mar 15 10:52:38.295120 2026] [:error] [pid 9995:tid 10003] [client 212.30.33.164:45315] [client 212.30.33.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "abYe9ga8xkcaSmgTbwhHNQAAAQU"]
[Sun Mar 15 10:52:47.201097 2026] [:error] [pid 38540:tid 38592] [client 212.30.33.84:42267] [client 212.30.33.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "abYe_18bnHsJ1dE90bI4pwAAAEY"]
[Sun Mar 15 10:52:48.010794 2026] [:error] [pid 50986:tid 50997] [client 212.30.33.68:61589] [client 212.30.33.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "abYfACknK4c779bcQqEDqwAAAUg"]
[Sun Mar 15 10:52:48.821131 2026] [:error] [pid 45974:tid 45991] [client 212.30.33.61:64845] [client 212.30.33.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "abYfABWn4R6u72SegehC0QAAAg8"]
[Sun Mar 15 10:52:49.662491 2026] [:error] [pid 38645:tid 38663] [client 212.30.33.98:30557] [client 212.30.33.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "abYfARFPHtsDUuVrWDbGjgAAANA"]
[Sun Mar 15 10:52:50.469296 2026] [:error] [pid 38540:tid 38594] [client 212.30.33.55:48875] [client 212.30.33.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "abYfAl8bnHsJ1dE90bI4vgAAAEg"]
[Sun Mar 15 10:52:56.045107 2026] [:error] [pid 42570:tid 42594] [client 212.30.33.164:34505] [client 212.30.33.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/about.php"] [unique_id "abYfCMIUXZJLmk_gYCO5qQAAAZU"]
[Sun Mar 15 10:52:56.860153 2026] [:error] [pid 38541:tid 38627] [client 212.30.33.95:43977] [client 212.30.33.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "abYfCHuOpex8jIO0jt5QggAAAI4"]
[Sun Mar 15 10:52:57.675405 2026] [:error] [pid 42570:tid 42576] [client 212.30.33.80:61405] [client 212.30.33.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "abYfCcIUXZJLmk_gYCO5wgAAAYM"]
[Sun Mar 15 10:53:04.882133 2026] [:error] [pid 50986:tid 51010] [client 212.30.33.84:56733] [client 212.30.33.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "abYfECknK4c779bcQqEERgAAAVU"]
[Sun Mar 15 10:53:14.554388 2026] [:error] [pid 45801:tid 45822] [client 212.30.33.80:54441] [client 212.30.33.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "abYfGoaKHL9CTKoVzTDGNgAAAdM"]
[Sun Mar 15 10:53:15.381530 2026] [:error] [pid 38645:tid 38667] [client 212.30.33.58:29665] [client 212.30.33.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "abYfGxFPHtsDUuVrWDbHbwAAANQ"]
[Sun Mar 15 10:53:30.862179 2026] [:error] [pid 42570:tid 42582] [client 212.30.33.90:23411] [client 212.30.33.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/info.php"] [unique_id "abYfKsIUXZJLmk_gYCO60AAAAYk"]
[Sun Mar 15 10:53:55.903323 2026] [:error] [pid 38541:tid 38631] [client 212.30.33.68:44821] [client 212.30.33.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/colour.php"] [unique_id "abYfQ3uOpex8jIO0jt5SDwAAAJI"]
[Sun Mar 15 10:53:56.714254 2026] [:error] [pid 50986:tid 50989] [client 212.30.33.69:60813] [client 212.30.33.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "abYfRCknK4c779bcQqEGEgAAAUE"]
[Sun Mar 15 10:53:57.532737 2026] [:error] [pid 50986:tid 51003] [client 212.30.33.82:25429] [client 212.30.33.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "abYfRSknK4c779bcQqEGKAAAAU4"]
[Sun Mar 15 10:54:10.937285 2026] [proxy_fcgi:error] [pid 38645:tid 38663] [client 212.30.33.69:60889] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function add_action() in /home/expressi/public_html/wp-content/plugins/hello.php:69\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/plugins/hello.php on line 69'
[Sun Mar 15 10:54:16.303691 2026] [:error] [pid 38645:tid 38663] [client 212.30.33.63:28565] [client 212.30.33.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "abYfWBFPHtsDUuVrWDbJqAAAANA"]
[Sun Mar 15 10:54:24.296158 2026] [:error] [pid 45801:tid 45806] [client 212.30.33.72:52529] [client 212.30.33.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "abYfYIaKHL9CTKoVzTDITQAAAcM"]
[Sun Mar 15 10:54:31.941272 2026] [:error] [pid 42570:tid 42588] [client 212.30.33.93:54857] [client 212.30.33.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "abYfZ8IUXZJLmk_gYCO8dAAAAY8"]
[Sun Mar 15 10:54:36.040052 2026] [:error] [pid 42570:tid 42585] [client 212.30.33.100:23807] [client 212.30.33.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "abYfbMIUXZJLmk_gYCO8pgAAAYw"]
[Sun Mar 15 10:54:49.454677 2026] [:error] [pid 38645:tid 38654] [client 212.30.33.164:46485] [client 212.30.33.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "abYfeRFPHtsDUuVrWDbK2QAAAMc"]
[Sun Mar 15 10:54:50.258053 2026] [:error] [pid 50986:tid 51005] [client 212.30.33.72:25289] [client 212.30.33.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "abYfeiknK4c779bcQqEIXQAAAVA"]
[Sun Mar 15 10:54:56.180706 2026] [:error] [pid 38645:tid 38666] [client 212.30.33.84:21391] [client 212.30.33.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "abYfgBFPHtsDUuVrWDbLDQAAANM"]
[Sun Mar 15 10:54:57.010877 2026] [:error] [pid 38645:tid 38671] [client 212.30.33.94:37959] [client 212.30.33.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "abYfgRFPHtsDUuVrWDbLHwAAANg"]
[Sun Mar 15 10:55:21.674498 2026] [:error] [pid 9995:tid 10019] [client 212.30.33.101:63859] [client 212.30.33.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "abYfmQa8xkcaSmgTbwhK0wAAARU"]
[Sun Mar 15 10:55:22.477925 2026] [:error] [pid 42570:tid 42578] [client 212.30.33.51:54897] [client 212.30.33.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "abYfmsIUXZJLmk_gYCO9iAAAAYU"]
[Sun Mar 15 10:55:36.352842 2026] [autoindex:error] [pid 50986:tid 50994] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:55:39.754449 2026] [autoindex:error] [pid 50986:tid 50994] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:55:55.994466 2026] [autoindex:error] [pid 50986:tid 50989] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:00.313158 2026] [autoindex:error] [pid 50986:tid 50989] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:04.779394 2026] [autoindex:error] [pid 50986:tid 51013] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:05.186069 2026] [autoindex:error] [pid 50986:tid 50993] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:12.588402 2026] [autoindex:error] [pid 50986:tid 51007] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:15.626062 2026] [autoindex:error] [pid 50986:tid 50999] [client 212.30.33.85:40365] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:16.040833 2026] [autoindex:error] [pid 50986:tid 51000] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:16.449488 2026] [autoindex:error] [pid 50986:tid 51005] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentytwo/assets/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:16.880200 2026] [autoindex:error] [pid 50986:tid 50991] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:17.298177 2026] [autoindex:error] [pid 50986:tid 51004] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:26.221598 2026] [autoindex:error] [pid 50986:tid 51009] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:26.640053 2026] [autoindex:error] [pid 50986:tid 51002] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:27.045024 2026] [autoindex:error] [pid 50986:tid 51006] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:32.708516 2026] [autoindex:error] [pid 50986:tid 51012] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:33.124051 2026] [autoindex:error] [pid 50986:tid 50989] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:35.930776 2026] [autoindex:error] [pid 50986:tid 51006] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:36.335988 2026] [autoindex:error] [pid 50986:tid 51001] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:36.748009 2026] [autoindex:error] [pid 50986:tid 50994] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:37.151823 2026] [autoindex:error] [pid 50986:tid 50993] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:37.562947 2026] [autoindex:error] [pid 50986:tid 51008] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:39.690428 2026] [autoindex:error] [pid 50986:tid 51010] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:44.995297 2026] [autoindex:error] [pid 50986:tid 50997] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:49.435953 2026] [autoindex:error] [pid 50986:tid 51010] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:56:52.241737 2026] [autoindex:error] [pid 50986:tid 51000] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:57:04.986576 2026] [autoindex:error] [pid 50986:tid 50994] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:57:05.394948 2026] [autoindex:error] [pid 50986:tid 51000] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:57:16.090501 2026] [autoindex:error] [pid 50986:tid 50996] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:57:20.376169 2026] [autoindex:error] [pid 50986:tid 50988] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:57:31.112676 2026] [autoindex:error] [pid 50986:tid 50998] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:57:31.520700 2026] [autoindex:error] [pid 50986:tid 51007] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:57:31.928597 2026] [autoindex:error] [pid 50986:tid 50998] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:57:32.333717 2026] [autoindex:error] [pid 50986:tid 51000] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:57:32.739936 2026] [autoindex:error] [pid 50986:tid 51000] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:57:36.095808 2026] [autoindex:error] [pid 50986:tid 51000] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:57:40.113153 2026] [autoindex:error] [pid 50986:tid 50990] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentythree/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:57:40.521633 2026] [autoindex:error] [pid 50986:tid 50990] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:57:44.722602 2026] [autoindex:error] [pid 50986:tid 51003] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:57:45.148897 2026] [autoindex:error] [pid 50986:tid 51013] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:57:45.555913 2026] [autoindex:error] [pid 50986:tid 51005] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:57:45.961527 2026] [autoindex:error] [pid 50986:tid 51005] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:57:51.234784 2026] [autoindex:error] [pid 50986:tid 51000] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/calendar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:57:55.988248 2026] [autoindex:error] [pid 50986:tid 50999] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:58:05.713405 2026] [autoindex:error] [pid 50986:tid 51011] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:58:06.121543 2026] [autoindex:error] [pid 50986:tid 50990] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:58:06.527644 2026] [autoindex:error] [pid 50986:tid 51002] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:58:16.078174 2026] [autoindex:error] [pid 50986:tid 50996] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:58:16.497939 2026] [autoindex:error] [pid 50986:tid 50997] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:58:19.244798 2026] [autoindex:error] [pid 50986:tid 50996] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:58:19.657910 2026] [autoindex:error] [pid 50986:tid 51000] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:58:22.517152 2026] [autoindex:error] [pid 50986:tid 51009] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:58:22.924330 2026] [autoindex:error] [pid 50986:tid 51013] [client 212.30.33.85:40365] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:58:30.064466 2026] [autoindex:error] [pid 38541:tid 38637] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:58:32.449411 2026] [autoindex:error] [pid 38541:tid 38617] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:58:39.341587 2026] [autoindex:error] [pid 38541:tid 38614] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:58:42.117509 2026] [autoindex:error] [pid 38541:tid 38617] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:58:47.621748 2026] [autoindex:error] [pid 38541:tid 38629] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:58:50.420761 2026] [autoindex:error] [pid 38541:tid 38613] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:58:58.837112 2026] [autoindex:error] [pid 38541:tid 38634] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:59:02.522840 2026] [autoindex:error] [pid 38541:tid 38615] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:59:13.905617 2026] [autoindex:error] [pid 38541:tid 38620] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:59:14.325665 2026] [autoindex:error] [pid 38541:tid 38635] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:59:16.153979 2026] [autoindex:error] [pid 38541:tid 38624] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:59:16.567597 2026] [autoindex:error] [pid 38541:tid 38616] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/thickbox/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:59:16.980710 2026] [autoindex:error] [pid 38541:tid 38637] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:59:23.832872 2026] [autoindex:error] [pid 38541:tid 38624] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:59:31.482395 2026] [autoindex:error] [pid 38541:tid 38637] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:59:33.178441 2026] [autoindex:error] [pid 38541:tid 38632] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:59:36.562710 2026] [autoindex:error] [pid 38541:tid 38626] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:59:39.475399 2026] [autoindex:error] [pid 38541:tid 38624] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:59:39.891856 2026] [autoindex:error] [pid 38541:tid 38616] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:59:42.221184 2026] [autoindex:error] [pid 38541:tid 38613] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:59:57.101602 2026] [autoindex:error] [pid 38541:tid 38615] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/classic-editor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:59:57.513052 2026] [autoindex:error] [pid 38541:tid 38626] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:59:57.925980 2026] [autoindex:error] [pid 38541:tid 38621] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 10:59:58.340476 2026] [autoindex:error] [pid 38541:tid 38625] [client 212.30.33.55:56933] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 15 11:28:16.456676 2026] [:error] [pid 38541:tid 38636] [client 20.89.243.125:3029] [client 20.89.243.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "abYnUHuOpex8jIO0jt5clQAAAJc"]
[Sun Mar 15 11:28:16.948540 2026] [:error] [pid 45974:tid 45979] [client 20.89.243.125:3053] [client 20.89.243.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "abYnUBWn4R6u72SegehfOAAAAgM"]
[Sun Mar 15 11:28:17.459985 2026] [:error] [pid 45974:tid 45987] [client 20.89.243.125:3008] [client 20.89.243.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "abYnURWn4R6u72SegehfOQAAAgs"]
[Sun Mar 15 11:28:17.955666 2026] [:error] [pid 42570:tid 42575] [client 20.89.243.125:3042] [client 20.89.243.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "abYnUcIUXZJLmk_gYCPJzQAAAYI"]
[Sun Mar 15 12:50:43.798748 2026] [:error] [pid 45801:tid 45822] [client 24.25.207.211:65041] [client 24.25.207.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.25.207.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abY6o4aKHL9CTKoVzTDnBQAAAdM"]
[Sun Mar 15 13:23:02.801791 2026] [autoindex:error] [pid 50986:tid 51001] [client 20.17.98.189:63742] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Mar 15 14:16:06.190005 2026] [:error] [pid 42570:tid 42582] [client 43.167.241.46:37932] [client 43.167.241.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abZOpsIUXZJLmk_gYCPengAAAYk"]
[Sun Mar 15 14:37:17.411546 2026] [:error] [pid 38541:tid 38627] [client 24.25.207.211:56552] [client 24.25.207.211] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abZTnXuOpex8jIO0jt5xCQAAAI4"]
[Sun Mar 15 14:38:05.101182 2026] [:error] [pid 45801:tid 45809] [client 162.0.228.124:58564] [client 162.0.228.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.228.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abZTzYaKHL9CTKoVzTD6XQAAAcY"]
[Sun Mar 15 14:38:06.300046 2026] [:error] [pid 45801:tid 45806] [client 162.0.228.124:58564] [client 162.0.228.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.0.228.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abZTzoaKHL9CTKoVzTD6YAAAAcM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 15 14:38:30.711444 2026] [:error] [pid 45974:tid 45987] [client 24.25.207.211:64588] [client 24.25.207.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.25.207.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abZT5hWn4R6u72SegeiLBgAAAgs"]
[Sun Mar 15 14:39:36.646801 2026] [:error] [pid 38645:tid 38659] [client 24.25.207.211:55847] [client 24.25.207.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.25.207.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abZUKBFPHtsDUuVrWDY-hwAAAMw"]
[Sun Mar 15 14:40:45.925862 2026] [:error] [pid 38645:tid 38649] [client 24.25.207.211:49166] [client 24.25.207.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.25.207.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abZUbRFPHtsDUuVrWDY-4gAAAMI"]
[Sun Mar 15 14:41:49.396056 2026] [:error] [pid 38536:tid 38555] [client 24.25.207.211:50988] [client 24.25.207.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.25.207.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abZUrfpTEqkVJ0rBEWvzEgAAAAI"]
[Sun Mar 15 14:42:51.506419 2026] [:error] [pid 38645:tid 38659] [client 24.25.207.211:57592] [client 24.25.207.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.25.207.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abZU6xFPHtsDUuVrWDY_zwAAAMw"]
[Sun Mar 15 14:42:57.087176 2026] [proxy_fcgi:error] [pid 38645:tid 38659] [client 24.25.207.211:57592] AH01071: Got error 'PHP message: PHP Warning:  mysqli_query(): (HY000/2006): MySQL server has gone away in /home/expressi/public_html/wp-includes/class-wpdb.php on line 2357'
[Sun Mar 15 16:13:20.443004 2026] [:error] [pid 50986:tid 51011] [client 104.234.53.89:55807] [client 104.234.53.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.89, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abZqICknK4c779bcQqF2mgAAAVY"]
[Sun Mar 15 16:39:56.191757 2026] [:error] [pid 45801:tid 45814] [client 64.89.163.10:59678] [client 64.89.163.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "abZwXIaKHL9CTKoVzTAR9gAAAcs"]
[Sun Mar 15 16:39:56.700163 2026] [:error] [pid 50986:tid 51011] [client 64.89.163.10:59723] [client 64.89.163.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "abZwXCknK4c779bcQqGAywAAAVY"]
[Sun Mar 15 16:39:57.188928 2026] [:error] [pid 42570:tid 42579] [client 64.89.163.10:59765] [client 64.89.163.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "abZwXcIUXZJLmk_gYCPxZQAAAYY"]
[Sun Mar 15 16:39:59.534598 2026] [:error] [pid 38540:tid 38591] [client 64.89.163.10:60104] [client 64.89.163.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "abZwX18bnHsJ1dE90bJfBQAAAEU"]
[Sun Mar 15 16:41:13.825879 2026] [:error] [pid 45801:tid 45818] [client 43.130.15.147:45978] [client 43.130.15.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abZwqYaKHL9CTKoVzTATAQAAAc8"]
[Sun Mar 15 18:01:59.504278 2026] [:error] [pid 45801:tid 45826] [client 110.166.71.39:34605] [client 110.166.71.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abaDl4aKHL9CTKoVzTAs8wAAAdc"]
[Sun Mar 15 18:32:20.889898 2026] [:error] [pid 45801:tid 45813] [client 212.227.151.177:38594] [client 212.227.151.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.227.151.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abaKtIaKHL9CTKoVzTA16AAAAco"]
[Sun Mar 15 18:32:22.071334 2026] [:error] [pid 45801:tid 45826] [client 212.227.151.177:38594] [client 212.227.151.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.227.151.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abaKtoaKHL9CTKoVzTA16QAAAdc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 15 20:51:55.508048 2026] [:error] [pid 38645:tid 38664] [client 104.234.53.81:39765] [client 104.234.53.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abaraxFPHtsDUuVrWDa_TgAAANE"]
[Sun Mar 15 21:50:17.169538 2026] [:error] [pid 42570:tid 42584] [client 104.234.53.85:47165] [client 104.234.53.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aba5GcIUXZJLmk_gYCMZegAAAYs"]
[Mon Mar 16 00:45:03.174184 2026] [:error] [pid 60694:tid 60829] [client 43.166.246.180:41698] [client 43.166.246.180] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abbiD2EURh3k32p5sFJ1AQAAAJc"]
[Mon Mar 16 01:03:15.782824 2026] [:error] [pid 60679:tid 60801] [client 117.62.235.53:38920] [client 117.62.235.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abbmU5nX8fEKZeqoouEZEAAAAFY"]
[Mon Mar 16 03:02:50.843117 2026] [:error] [pid 23458:tid 23477] [client 43.166.244.251:44214] [client 43.166.244.251] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abcCWg4cKIHVuOkxhho8UwAAARE"]
[Mon Mar 16 04:04:23.017022 2026] [:error] [pid 62427:tid 62457] [client 178.132.108.242:41642] [client 178.132.108.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.132.108.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abcQx8UPP8fzo6XzJCX8igAAABA"]
[Mon Mar 16 04:04:43.478644 2026] [:error] [pid 62428:tid 62471] [client 170.246.250.20:25522] [client 170.246.250.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.246.250.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abcQ26rHSRXFZx1-aIG3BgAAAEI"]
[Mon Mar 16 05:45:42.788817 2026] [authz_core:error] [pid 62428:tid 62491] [client 164.90.208.56:44086] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Mon Mar 16 05:45:48.654341 2026] [:error] [pid 62529:tid 62556] [client 164.90.208.56:44186] [client 164.90.208.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "abcojD84-luOVYZKK0NxxQAAANM"]
[Mon Mar 16 05:45:53.696913 2026] [:error] [pid 62529:tid 62539] [client 164.90.208.56:48474] [client 164.90.208.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "abcokT84-luOVYZKK0Nx6wAAAMI"]
[Mon Mar 16 05:46:03.712796 2026] [:error] [pid 52152:tid 52159] [client 164.90.208.56:48316] [client 164.90.208.56] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "abcom8A6rS_GLRd0NKVl_AAAAQQ"]
[Mon Mar 16 05:46:23.646692 2026] [:error] [pid 62529:tid 62539] [client 164.90.208.56:59714] [client 164.90.208.56] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.expressinteriors.com|F|2"] [data ".axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/trace.axd"] [unique_id "abcorz84-luOVYZKK0NyAQAAAMI"]
[Mon Mar 16 05:48:19.098361 2026] [:error] [pid 52152:tid 52166] [client 138.201.250.96:43276] [client 138.201.250.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.201.250.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abcpI8A6rS_GLRd0NKVnPwAAAQs"]
[Mon Mar 16 05:48:20.085076 2026] [:error] [pid 52152:tid 52171] [client 138.201.250.96:43276] [client 138.201.250.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.201.250.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abcpJMA6rS_GLRd0NKVnQwAAARA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 16 06:44:10.737625 2026] [:error] [pid 1411:tid 1435] [client 43.130.105.21:43698] [client 43.130.105.21] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abc2OtrCV4sh-le3M-1s2wAAAVU"]
[Mon Mar 16 07:02:29.339512 2026] [:error] [pid 62427:tid 62444] [client 203.188.168.27:20885] [client 203.188.168.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.188.168.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abc6hcUPP8fzo6XzJCUiUgAAAAM"]
[Mon Mar 16 07:02:37.626568 2026] [:error] [pid 62529:tid 62551] [client 203.188.168.29:28623] [client 203.188.168.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.188.168.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abc6jT84-luOVYZKK0OMHQAAAM4"]
[Mon Mar 16 07:02:37.626635 2026] [:error] [pid 62529:tid 62551] [client 203.188.168.29:28623] [client 203.188.168.29] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 203.188.168.29 on wp-login.php, counter = 26"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abc6jT84-luOVYZKK0OMHQAAAM4"]
[Mon Mar 16 08:18:36.416572 2026] [:error] [pid 62429:tid 62515] [client 103.65.237.124:58152] [client 103.65.237.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "abdMXFewIPukhLCowEH4MAAAAJM"]
[Mon Mar 16 09:12:07.754120 2026] [:error] [pid 1411:tid 1419] [client 170.106.187.106:43592] [client 170.106.187.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abdY59rCV4sh-le3M-25sQAAAUY"]
[Mon Mar 16 09:21:00.977224 2026] [:error] [pid 1411:tid 1435] [client 212.122.31.4:56132] [client 212.122.31.4] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.expressinteriors.com|F|2"] [data "TX:0=application/javascript"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abda_NrCV4sh-le3M-2_AQAAAVU"]
[Mon Mar 16 09:21:03.508318 2026] [:error] [pid 62529:tid 62538] [client 212.122.31.4:58962] [client 212.122.31.4] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.expressinteriors.com|F|2"] [data "TX:0=application/javascript"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abda_z84-luOVYZKK0O1rAAAAME"]
[Mon Mar 16 09:24:21.029101 2026] [:error] [pid 12768:tid 12794] [client 170.79.29.116:45164] [client 170.79.29.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.79.29.116, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abdbxYvjhfol0SJym0_UrwAAAZU"]
[Mon Mar 16 09:31:54.820196 2026] [:error] [pid 1411:tid 1423] [client 170.79.29.116:45209] [client 170.79.29.116] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abdditrCV4sh-le3M-3FWwAAAUo"]
[Mon Mar 16 09:33:18.005028 2026] [:error] [pid 12822:tid 12841] [client 170.79.29.116:44215] [client 170.79.29.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.79.29.116, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abdd3oG9Ft4WPo7r7sR1kgAAAcY"]
[Mon Mar 16 09:34:40.478601 2026] [:error] [pid 12823:tid 12874] [client 170.79.29.116:44971] [client 170.79.29.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.79.29.116, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abdeMBlVKeelxvdJEr5SjgAAAgw"]
[Mon Mar 16 09:36:04.010576 2026] [:error] [pid 62529:tid 62556] [client 170.79.29.116:44061] [client 170.79.29.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.79.29.116, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abdehD84-luOVYZKK0O6FgAAANM"]
[Mon Mar 16 09:37:29.601273 2026] [:error] [pid 62529:tid 62547] [client 170.79.29.116:43503] [client 170.79.29.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.79.29.116, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abde2T84-luOVYZKK0O6ZAAAAMo"]
[Mon Mar 16 11:05:14.862743 2026] [:error] [pid 62026:tid 62092] [client 173.239.236.224:30261] [client 173.239.236.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abdzau8oW52PUIYI2O4LkwAAAIY"]
[Mon Mar 16 11:05:26.111411 2026] [:error] [pid 62025:tid 62081] [client 173.239.236.116:39835] [client 173.239.236.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/license.txt"] [unique_id "abdzduimBfLmKh7zLXMCqgAAAFY"]
[Mon Mar 16 11:05:26.563069 2026] [:error] [pid 9354:tid 9378] [client 173.239.236.3:26029] [client 173.239.236.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/feed/"] [unique_id "abdzdnBF0M4d8CifbJ43WgAAAc8"]
[Mon Mar 16 11:05:27.425630 2026] [:error] [pid 62026:tid 62091] [client 173.239.236.66:25259] [client 173.239.236.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abdzd-8oW52PUIYI2O4L9QAAAIU"]
[Mon Mar 16 11:05:27.643738 2026] [:error] [pid 62024:tid 62030] [client 173.239.236.94:43439] [client 173.239.236.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abdzd4k-5rtjYvjqC_o6WQAAAAE"]
[Mon Mar 16 11:05:27.863296 2026] [:error] [pid 62024:tid 62046] [client 173.239.236.178:44105] [client 173.239.236.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abdzd4k-5rtjYvjqC_o6XwAAABE"]
[Mon Mar 16 11:05:28.083362 2026] [:error] [pid 9400:tid 9435] [client 173.239.236.66:36457] [client 173.239.236.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "abdzeASHzD8ZM8ddLEnKEQAAAhM"]
[Mon Mar 16 11:05:28.304936 2026] [:error] [pid 62510:tid 62527] [client 173.239.236.1:33071] [client 173.239.236.1] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-json/oembed/1.0/embed"] [unique_id "abdzeCE33_T9aKpoDdjqHQAAAQ4"]
[Mon Mar 16 11:05:28.529281 2026] [:error] [pid 62024:tid 62036] [client 173.239.236.178:49231] [client 173.239.236.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abdzeIk-5rtjYvjqC_o6cwAAAAc"]
[Mon Mar 16 11:27:51.842421 2026] [:error] [pid 9354:tid 9369] [client 116.202.244.177:43050] [client 116.202.244.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.202.244.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abd4t3BF0M4d8CifbJ46YAAAAcY"]
[Mon Mar 16 11:27:53.249798 2026] [:error] [pid 9354:tid 9379] [client 116.202.244.177:43050] [client 116.202.244.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.202.244.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abd4uXBF0M4d8CifbJ46YgAAAdA"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 16 12:20:13.727371 2026] [:error] [pid 62026:tid 62102] [client 150.109.230.210:33226] [client 150.109.230.210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abeE_e8oW52PUIYI2O4hGAAAAJA"]
[Mon Mar 16 13:25:23.736007 2026] [:error] [pid 62510:tid 62517] [client 85.202.160.80:41992] [client 85.202.160.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.202.160.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abeUQyE33_T9aKpoDdgdPAAAAQQ"]
[Mon Mar 16 13:25:25.988788 2026] [:error] [pid 62024:tid 62050] [client 85.202.160.80:42002] [client 85.202.160.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.202.160.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abeURYk-5rtjYvjqC_p4fgAAABU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 16 13:26:01.154039 2026] [:error] [pid 62510:tid 62529] [client 170.246.250.20:29053] [client 170.246.250.20] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abeUaSE33_T9aKpoDdgdXQAAARA"]
[Mon Mar 16 13:27:35.568273 2026] [:error] [pid 62024:tid 62048] [client 170.246.250.20:27280] [client 170.246.250.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.246.250.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abeUx4k-5rtjYvjqC_p5nQAAABM"]
[Mon Mar 16 13:29:00.838408 2026] [:error] [pid 9400:tid 9437] [client 170.246.250.20:28063] [client 170.246.250.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.246.250.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abeVHASHzD8ZM8ddLEnhKgAAAhU"]
[Mon Mar 16 13:30:16.803223 2026] [:error] [pid 62510:tid 62536] [client 170.246.250.20:27583] [client 170.246.250.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.246.250.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abeVaCE33_T9aKpoDdgelAAAARc"]
[Mon Mar 16 13:31:41.562773 2026] [:error] [pid 62024:tid 62050] [client 170.246.250.20:25848] [client 170.246.250.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.246.250.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abeVvYk-5rtjYvjqC_p8QAAAABU"]
[Mon Mar 16 13:32:57.525739 2026] [:error] [pid 62024:tid 62040] [client 170.246.250.20:27997] [client 170.246.250.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 170.246.250.20, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abeWCYk-5rtjYvjqC_p8-AAAAAs"]
[Mon Mar 16 13:40:46.621902 2026] [authz_core:error] [pid 62025:tid 62071] [client 64.226.65.160:60764] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Mon Mar 16 13:40:52.771702 2026] [:error] [pid 9400:tid 9420] [client 64.226.65.160:46188] [client 64.226.65.160] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "abeX5ASHzD8ZM8ddLEnjWgAAAgQ"]
[Mon Mar 16 13:40:57.143314 2026] [:error] [pid 62510:tid 62513] [client 64.226.65.160:46208] [client 64.226.65.160] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "abeX6SE33_T9aKpoDdgixQAAAQA"]
[Mon Mar 16 13:41:09.733634 2026] [:error] [pid 9400:tid 9425] [client 64.226.65.160:59316] [client 64.226.65.160] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "abeX9QSHzD8ZM8ddLEnjaAAAAgk"]
[Mon Mar 16 13:41:28.990844 2026] [:error] [pid 62119:tid 62130] [client 64.226.65.160:48154] [client 64.226.65.160] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.expressinteriors.com|F|2"] [data ".axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/trace.axd"] [unique_id "abeYCD-Co-Fir-PyAwfdCgAAAMg"]
[Mon Mar 16 14:29:42.888630 2026] [:error] [pid 62024:tid 62032] [client 43.157.191.20:47484] [client 43.157.191.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abejVok-5rtjYvjqC_qW1gAAAAM"]
[Mon Mar 16 17:33:08.506929 2026] [:error] [pid 39154:tid 39177] [client 43.159.148.221:43186] [client 43.159.148.221] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abfOVBgq1_qjm7J1LqvdrAAAAVQ"]
[Mon Mar 16 19:24:40.094991 2026] [:error] [pid 39154:tid 39159] [client 103.58.154.86:44309] [client 103.58.154.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.58.154.86, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abfoeBgq1_qjm7J1LqsYDgAAAUI"]
[Mon Mar 16 19:54:35.906367 2026] [:error] [pid 35838:tid 35862] [client 64.89.163.113:52394] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abfvexroTe-x3JLtmo6WaAAAABQ"]
[Mon Mar 16 19:54:36.553739 2026] [:error] [pid 1871:tid 1877] [client 64.89.163.113:49944] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abfvfDinTnZ8uiUPekE69AAAAYQ"]
[Mon Mar 16 19:54:37.077362 2026] [:error] [pid 1871:tid 1875] [client 64.89.163.113:52877] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abfvfTinTnZ8uiUPekE7MgAAAYI"]
[Mon Mar 16 19:54:37.707856 2026] [:error] [pid 36198:tid 36203] [client 64.89.163.113:64117] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abfvfelL1GNckmsdWlM0QQAAAQI"]
[Mon Mar 16 19:54:38.211904 2026] [:error] [pid 35838:tid 35856] [client 64.89.163.113:52432] [client 64.89.163.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abfvfhroTe-x3JLtmo6WkwAAAA4"]
[Mon Mar 16 19:59:44.563963 2026] [:error] [pid 35839:tid 35882] [client 216.73.163.134:21057] [client 216.73.163.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abfwsKxyv6h8-aZrncsJ5AAAAEw"]
[Mon Mar 16 20:08:47.096891 2026] [:error] [pid 36198:tid 36224] [client 182.44.9.147:44581] [client 182.44.9.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abfyz-lL1GNckmsdWlM35gAAARc"]
[Mon Mar 16 20:30:35.191061 2026] [:error] [pid 35929:tid 35953] [client 216.73.163.130:22443] [client 216.73.163.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.130, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abf369W47dGpmA63hwSRHQAAANY"]
[Mon Mar 16 20:34:22.253777 2026] [:error] [pid 39154:tid 39158] [client 45.146.54.131:44879] [client 45.146.54.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.146.54.131, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abf4zhgq1_qjm7J1LqssTQAAAUE"]
[Mon Mar 16 20:37:59.569359 2026] [:error] [pid 1871:tid 1894] [client 45.131.194.122:48565] [client 45.131.194.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.194.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abf5pzinTnZ8uiUPekFMVgAAAZU"]
[Mon Mar 16 20:41:40.889729 2026] [:error] [pid 1871:tid 1879] [client 216.73.163.121:38585] [client 216.73.163.121] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.121, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abf6hDinTnZ8uiUPekFOBwAAAYY"]
[Mon Mar 16 20:45:23.451788 2026] [:error] [pid 36198:tid 36224] [client 216.73.163.160:62183] [client 216.73.163.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abf7Y-lL1GNckmsdWlNAYgAAARc"]
[Mon Mar 16 20:48:55.093066 2026] [:error] [pid 39154:tid 39178] [client 216.73.163.147:53033] [client 216.73.163.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abf8Nxgq1_qjm7J1LqswPgAAAVU"]
[Mon Mar 16 20:52:30.599517 2026] [:error] [pid 35840:tid 35915] [client 216.73.163.121:42447] [client 216.73.163.121] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.121, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abf9DkJFzfEsmtPx-M0RWgAAAJI"]
[Mon Mar 16 20:59:42.242311 2026] [:error] [pid 35840:tid 35902] [client 45.146.54.130:42189] [client 45.146.54.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.146.54.130, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abf-vkJFzfEsmtPx-M0SjgAAAIU"]
[Mon Mar 16 21:05:11.931453 2026] [:error] [pid 36198:tid 36208] [client 216.73.163.121:54391] [client 216.73.163.121] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.121, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgAB-lL1GNckmsdWlNFbwAAAQc"]
[Mon Mar 16 21:10:35.119820 2026] [:error] [pid 35929:tid 35950] [client 45.146.54.137:37555] [client 45.146.54.137] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.146.54.137, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgBS9W47dGpmA63hwSZYQAAANM"]
[Mon Mar 16 21:15:53.152156 2026] [:error] [pid 36198:tid 36208] [client 216.73.163.130:45981] [client 216.73.163.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.130, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgCielL1GNckmsdWlNJaQAAAQc"]
[Mon Mar 16 21:21:16.672160 2026] [:error] [pid 39154:tid 39180] [client 216.73.163.123:29943] [client 216.73.163.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgDzBgq1_qjm7J1Lqs6KQAAAVc"]
[Mon Mar 16 21:26:32.046552 2026] [:error] [pid 39154:tid 39176] [client 45.146.54.133:26755] [client 45.146.54.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.146.54.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgFCBgq1_qjm7J1Lqs7tQAAAVM"]
[Mon Mar 16 21:32:05.752922 2026] [:error] [pid 1871:tid 1889] [client 216.73.163.155:44679] [client 216.73.163.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.155, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgGVTinTnZ8uiUPekFhiAAAAZA"]
[Mon Mar 16 21:37:23.833549 2026] [:error] [pid 35840:tid 35918] [client 216.73.163.150:45475] [client 216.73.163.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgHk0JFzfEsmtPx-M0Y3QAAAJU"]
[Mon Mar 16 21:42:52.515483 2026] [:error] [pid 35838:tid 35845] [client 216.73.163.153:35333] [client 216.73.163.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.153, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgI3BroTe-x3JLtmo7QgwAAAAM"]
[Mon Mar 16 21:45:37.057544 2026] [:error] [pid 36198:tid 36219] [client 41.141.70.57:57694] [client 41.141.70.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.141.70.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgJgelL1GNckmsdWlNRkAAAARI"]
[Mon Mar 16 21:45:38.960504 2026] [:error] [pid 36198:tid 36224] [client 41.141.70.57:57700] [client 41.141.70.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.141.70.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgJgulL1GNckmsdWlNRmgAAARc"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 16 21:48:11.106678 2026] [:error] [pid 35929:tid 35951] [client 216.73.163.153:26787] [client 216.73.163.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.153, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgKG9W47dGpmA63hwSk-AAAANQ"]
[Mon Mar 16 21:53:36.402080 2026] [:error] [pid 1871:tid 1881] [client 45.146.54.130:34337] [client 45.146.54.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.146.54.130, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgLYDinTnZ8uiUPekFs3QAAAYg"]
[Mon Mar 16 21:58:06.858306 2026] [:error] [pid 1871:tid 1876] [client 72.167.46.126:57978] [client 72.167.46.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 72.167.46.126, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgMbjinTnZ8uiUPekFu2gAAAYM"]
[Mon Mar 16 21:58:07.814940 2026] [:error] [pid 1871:tid 1878] [client 72.167.46.126:57978] [client 72.167.46.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 72.167.46.126, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgMbzinTnZ8uiUPekFu3gAAAYU"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 16 21:58:51.286398 2026] [:error] [pid 36198:tid 36218] [client 45.131.194.122:39919] [client 45.131.194.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.194.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgMm-lL1GNckmsdWlNWCQAAARE"]
[Mon Mar 16 22:04:15.909431 2026] [:error] [pid 35840:tid 35899] [client 45.146.54.130:47553] [client 45.146.54.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.146.54.130, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgN30JFzfEsmtPx-M0dJgAAAII"]
[Mon Mar 16 22:05:04.696721 2026] [:error] [pid 39154:tid 39157] [client 43.130.72.177:54518] [client 43.130.72.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abgOEBgq1_qjm7J1LqtDLgAAAUA"]
[Mon Mar 16 22:09:32.492682 2026] [:error] [pid 35839:tid 35893] [client 216.73.163.129:43887] [client 216.73.163.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.129, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgPHKxyv6h8-aZrncsboAAAAFc"]
[Mon Mar 16 22:14:51.897957 2026] [:error] [pid 35838:tid 35852] [client 216.73.163.147:28211] [client 216.73.163.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgQWxroTe-x3JLtmo7YMgAAAAo"]
[Mon Mar 16 22:20:15.356542 2026] [:error] [pid 35838:tid 35844] [client 216.73.163.119:30999] [client 216.73.163.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.119, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgRnxroTe-x3JLtmo7ZZwAAAAI"]
[Mon Mar 16 22:25:36.336489 2026] [:error] [pid 1871:tid 1876] [client 216.73.163.119:39837] [client 216.73.163.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.119, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgS4DinTnZ8uiUPekF-2gAAAYM"]
[Mon Mar 16 22:31:00.348883 2026] [:error] [pid 35929:tid 35951] [client 216.73.163.151:47885] [client 216.73.163.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgUJNW47dGpmA63hwS2EwAAANQ"]
[Mon Mar 16 22:36:29.567907 2026] [:error] [pid 1871:tid 1884] [client 216.73.163.154:24825] [client 216.73.163.154] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.154, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgVbTinTnZ8uiUPekGEXQAAAYs"]
[Mon Mar 16 22:41:49.990445 2026] [:error] [pid 1871:tid 1880] [client 45.146.54.130:45661] [client 45.146.54.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.146.54.130, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgWrTinTnZ8uiUPekGHfAAAAYc"]
[Mon Mar 16 22:47:16.230447 2026] [:error] [pid 36198:tid 36214] [client 216.73.163.132:37421] [client 216.73.163.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.132, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgX9OlL1GNckmsdWlNmMgAAAQ0"]
[Mon Mar 16 22:52:36.778484 2026] [:error] [pid 35840:tid 35902] [client 216.73.163.116:46721] [client 216.73.163.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgZNEJFzfEsmtPx-M0kdgAAAIU"]
[Mon Mar 16 22:58:08.257367 2026] [:error] [pid 35838:tid 35848] [client 216.73.163.141:49663] [client 216.73.163.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.141, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgagBroTe-x3JLtmo7hZAAAAAY"]
[Mon Mar 16 23:03:30.478191 2026] [:error] [pid 35838:tid 35853] [client 216.73.163.122:22871] [client 216.73.163.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgbwhroTe-x3JLtmo7iswAAAAs"]
[Mon Mar 16 23:08:59.693113 2026] [:error] [pid 35929:tid 35931] [client 45.146.54.139:44487] [client 45.146.54.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.146.54.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgdC9W47dGpmA63hwTExgAAAMA"]
[Mon Mar 16 23:14:20.638994 2026] [:error] [pid 1871:tid 1897] [client 216.73.163.146:44167] [client 216.73.163.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.73.163.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgeTDinTnZ8uiUPekGaDQAAAZg"]
[Mon Mar 16 23:44:17.394823 2026] [:error] [pid 1871:tid 1877] [client 216.246.113.8:47010] [client 216.246.113.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.246.113.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abglUTinTnZ8uiUPekGoXwAAAYQ"]
[Mon Mar 16 23:44:18.341644 2026] [:error] [pid 1871:tid 1895] [client 216.246.113.8:47010] [client 216.246.113.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.246.113.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abglUjinTnZ8uiUPekGoZAAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 16 23:56:29.753918 2026] [:error] [pid 35929:tid 35948] [client 192.99.147.218:53162] [client 192.99.147.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.99.147.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgoLdW47dGpmA63hwTWegAAANE"]
[Mon Mar 16 23:56:30.727117 2026] [:error] [pid 35929:tid 35955] [client 192.99.147.218:53162] [client 192.99.147.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.99.147.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abgoLtW47dGpmA63hwTWfwAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Mar 16 23:56:46.623559 2026] [:error] [pid 35839:tid 35871] [client 170.106.11.6:46434] [client 170.106.11.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abgoPqxyv6h8-aZrncspLQAAAEE"]
[Tue Mar 17 02:13:29.274171 2026] [:error] [pid 45652:tid 45662] [client 65.21.75.39:52254] [client 65.21.75.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.21.75.39, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abhISfeWZ4w4tc07R6lZJQAAAMc"]
[Tue Mar 17 02:13:30.240009 2026] [:error] [pid 45652:tid 45675] [client 65.21.75.39:52254] [client 65.21.75.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.21.75.39, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abhISveWZ4w4tc07R6lZKQAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Tue Mar 17 02:38:15.838402 2026] [:error] [pid 9635:tid 9657] [client 118.139.167.171:42484] [client 118.139.167.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 118.139.167.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abhOF3sAHChuwZxGaSgCWAAAAVQ"]
[Tue Mar 17 02:38:16.700672 2026] [:error] [pid 9635:tid 9640] [client 118.139.167.171:42484] [client 118.139.167.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 118.139.167.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abhOGHsAHChuwZxGaSgCXQAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Tue Mar 17 02:50:49.905877 2026] [:error] [pid 3200:tid 3225] [client 43.155.195.141:39452] [client 43.155.195.141] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abhRCVFOeKiNLMuAjedPLQAAARc"]
[Tue Mar 17 02:54:40.106458 2026] [:error] [pid 45450:tid 45580] [client 182.44.8.254:52137] [client 182.44.8.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abhR8L164tBAS29wdMguOgAAAIk"]
[Tue Mar 17 04:36:10.465552 2026] [:error] [pid 22541:tid 22560] [client 120.138.22.197:54688] [client 120.138.22.197] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 120.138.22.197, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abhpuqS6JNY1-CTsTA_A3wAAAQ4"]
[Tue Mar 17 04:36:11.881895 2026] [:error] [pid 22541:tid 22546] [client 120.138.22.197:54688] [client 120.138.22.197] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 120.138.22.197, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abhpu6S6JNY1-CTsTA_A5gAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Tue Mar 17 05:58:03.174358 2026] [:error] [pid 46020:tid 46044] [client 116.90.32.93:41882] [client 116.90.32.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.90.32.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abh863-nCcd9BdzGdLfxGAAAANY"]
[Tue Mar 17 05:58:03.444100 2026] [:error] [pid 46020:tid 46041] [client 54.38.84.133:38764] [client 54.38.84.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.38.84.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abh863-nCcd9BdzGdLfxHAAAANM"]
[Tue Mar 17 05:58:04.187169 2026] [:error] [pid 46020:tid 46036] [client 116.90.32.93:41882] [client 116.90.32.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.90.32.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abh87H-nCcd9BdzGdLfxIAAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Tue Mar 17 05:58:05.183125 2026] [:error] [pid 45917:tid 46006] [client 54.38.84.133:38768] [client 54.38.84.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.38.84.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abh87RMMhmeqL5fT_heIUwAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Tue Mar 17 06:03:41.497547 2026] [:error] [pid 22541:tid 22554] [client 45.77.69.213:47842] [client 45.77.69.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.77.69.213, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abh-PaS6JNY1-CTsTA_rBAAAAQg"]
[Tue Mar 17 06:03:42.518898 2026] [:error] [pid 22541:tid 22556] [client 45.77.69.213:47842] [client 45.77.69.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.77.69.213, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abh-PqS6JNY1-CTsTA_rDgAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Tue Mar 17 07:44:21.814230 2026] [:error] [pid 45917:tid 45990] [client 170.106.165.186:41354] [client 170.106.165.186] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abiV1RMMhmeqL5fT_herfgAAAIE"]
[Tue Mar 17 07:53:38.944735 2026] [:error] [pid 46020:tid 46033] [client 103.145.50.90:36934] [client 103.145.50.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.145.50.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abiYAn-nCcd9BdzGdLc_IgAAAMs"]
[Tue Mar 17 07:53:40.091688 2026] [:error] [pid 46020:tid 46038] [client 103.145.50.90:36934] [client 103.145.50.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.145.50.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abiYBH-nCcd9BdzGdLc_KAAAANA"], referer: https://expressinteriors.com/wp-login.php
[Tue Mar 17 07:56:18.555664 2026] [:error] [pid 15013:tid 15094] [client 185.223.152.134:63215] [client 185.223.152.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abiYolZc-p7DonmJmm2V6wAAAhE"]
[Tue Mar 17 08:04:54.266760 2026] [:error] [pid 14817:tid 14830] [client 208.109.68.48:14440] [client 208.109.68.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.68.48, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abiapuBWVgTpR3dKOganuAAAAUQ"]
[Tue Mar 17 08:04:55.452904 2026] [:error] [pid 14817:tid 14827] [client 208.109.68.48:14440] [client 208.109.68.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.68.48, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abiap-BWVgTpR3dKOganuQAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Tue Mar 17 08:16:08.379524 2026] [:error] [pid 15011:tid 15054] [client 57.151.82.21:45698] [client 57.151.82.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 57.151.82.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abidSMNtgHlAHiPlDyoRhAAAAcU"]
[Tue Mar 17 08:16:09.345678 2026] [:error] [pid 15011:tid 15055] [client 57.151.82.21:45698] [client 57.151.82.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 57.151.82.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abidScNtgHlAHiPlDyoRhQAAAcY"], referer: https://expressinteriors.com/wp-login.php
[Tue Mar 17 08:24:18.640804 2026] [:error] [pid 45916:tid 45984] [client 80.94.92.123:56976] [client 80.94.92.123] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "abifMriS53PnClk_C9AlvgAAAFY"]
[Tue Mar 17 08:33:25.473692 2026] [:error] [pid 45916:tid 45976] [client 216.73.216.164:64141] [client 216.73.216.164] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||expressinteriors.com|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/robots.txt"] [unique_id "abihVbiS53PnClk_C9AsnAAAAE4"]
[Tue Mar 17 08:49:00.929787 2026] [:error] [pid 45916:tid 45970] [client 157.173.110.68:32878] [client 157.173.110.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.173.110.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abik_LiS53PnClk_C9A07wAAAEg"]
[Tue Mar 17 08:49:01.905478 2026] [:error] [pid 45916:tid 45973] [client 157.173.110.68:32878] [client 157.173.110.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.173.110.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abik_biS53PnClk_C9A09AAAAEs"], referer: https://expressinteriors.com/wp-login.php
[Tue Mar 17 08:53:13.471567 2026] [:error] [pid 22541:tid 22552] [client 36.41.75.167:44545] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abil-aS6JNY1-CTsTA84_wAAAQY"]
[Tue Mar 17 09:50:33.848801 2026] [:error] [pid 45915:tid 45946] [client 43.135.145.117:47104] [client 43.135.145.117] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abizaZh7U84ydzcrcndJ3AAAABE"]
[Tue Mar 17 11:19:25.986512 2026] [:error] [pid 15013:tid 15099] [client 75.159.255.245:51764] [client 75.159.255.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 75.159.255.245, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abjIPVZc-p7DonmJmm3E6gAAAhY"]
[Tue Mar 17 12:37:24.168800 2026] [:error] [pid 15162:tid 15180] [client 43.153.96.233:44450] [client 43.153.96.233] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abjahLkCW4399PnBfYS7agAAAk0"]
[Tue Mar 17 12:40:01.238444 2026] [:error] [pid 45915:tid 45931] [client 183.82.6.100:62587] [client 183.82.6.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.82.6.100, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abjbIZh7U84ydzcrcnee_gAAAAI"]
[Tue Mar 17 12:48:51.096988 2026] [:error] [pid 45915:tid 45948] [client 183.82.6.100:51261] [client 183.82.6.100] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abjdM5h7U84ydzcrcnejHwAAABM"]
[Tue Mar 17 12:50:23.029347 2026] [:error] [pid 45916:tid 45974] [client 183.82.6.100:52713] [client 183.82.6.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.82.6.100, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abjdj7iS53PnClk_C9DBVQAAAEw"]
[Tue Mar 17 12:51:51.381922 2026] [:error] [pid 15013:tid 15089] [client 183.82.6.100:53827] [client 183.82.6.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.82.6.100, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abjd51Zc-p7DonmJmm3ctgAAAgw"]
[Tue Mar 17 12:53:19.190040 2026] [:error] [pid 45915:tid 45930] [client 183.82.6.100:28740] [client 183.82.6.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.82.6.100, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abjeP5h7U84ydzcrcnelAAAAAAE"]
[Tue Mar 17 12:54:48.110417 2026] [:error] [pid 45916:tid 45967] [client 183.82.6.100:54809] [client 183.82.6.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.82.6.100, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abjemLiS53PnClk_C9DEsQAAAEU"]
[Tue Mar 17 14:46:00.445111 2026] [:error] [pid 45916:tid 45983] [client 64.225.25.250:57814] [client 64.225.25.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.225.25.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abj4qLiS53PnClk_C9ANIAAAAFU"]
[Tue Mar 17 14:46:01.439609 2026] [:error] [pid 45916:tid 45967] [client 64.225.25.250:57814] [client 64.225.25.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.225.25.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abj4qbiS53PnClk_C9ANKAAAAEU"], referer: https://expressinteriors.com/wp-login.php
[Tue Mar 17 15:02:23.552542 2026] [:error] [pid 15013:tid 15098] [client 68.178.161.48:49250] [client 68.178.161.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.161.48, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abj8f1Zc-p7DonmJmm3-PAAAAhU"]
[Tue Mar 17 15:02:25.685870 2026] [:error] [pid 15162:tid 15188] [client 68.178.161.48:49260] [client 68.178.161.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.161.48, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abj8gbkCW4399PnBfYTPggAAAlU"], referer: https://expressinteriors.com/wp-login.php
[Tue Mar 17 15:38:30.496415 2026] [:error] [pid 45916:tid 45970] [client 60.188.57.0:49078] [client 60.188.57.0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abkE9riS53PnClk_C9As0QAAAEg"]
[Tue Mar 17 17:24:22.548840 2026] [:error] [pid 15013:tid 15088] [client 172.71.164.81:11298] [client 172.71.164.81] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "abkdxlZc-p7DonmJmm0fqQAAAgs"]
[Tue Mar 17 17:24:22.576886 2026] [:error] [pid 15013:tid 15080] [client 172.71.164.81:11300] [client 172.71.164.81] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "abkdxlZc-p7DonmJmm0fqgAAAgM"]
[Tue Mar 17 17:24:22.581698 2026] [:error] [pid 15013:tid 15087] [client 172.71.164.81:11290] [client 172.71.164.81] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/HEAD"] [unique_id "abkdxlZc-p7DonmJmm0fqwAAAgo"]
[Tue Mar 17 19:14:24.186893 2026] [:error] [pid 14817:tid 14831] [client 170.106.107.87:60560] [client 170.106.107.87] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abk3kOBWVgTpR3dKOgYvngAAAUU"]
[Tue Mar 17 21:57:49.664335 2026] [:error] [pid 22541:tid 22564] [client 43.135.134.127:46188] [client 43.135.134.127] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abld3aS6JNY1-CTsTA83rQAAARI"]
[Tue Mar 17 22:14:00.814000 2026] [:error] [pid 14817:tid 14837] [client 49.235.136.28:33672] [client 49.235.136.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ablhqOBWVgTpR3dKOgZ46gAAAUs"]
[Wed Mar 18 00:21:55.498316 2026] [:error] [pid 40717:tid 41054] [client 64.227.35.173:64643] [client 64.227.35.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.35.173, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abl_o8R22EbC70ICesj9CAAAAIM"]
[Wed Mar 18 00:21:57.909456 2026] [:error] [pid 40717:tid 41053] [client 64.227.35.173:59711] [client 64.227.35.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.35.173, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abl_pcR22EbC70ICesj9DwAAAII"]
[Wed Mar 18 00:35:56.429842 2026] [:error] [pid 41165:tid 41181] [client 64.227.35.173:56656] [client 64.227.35.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.35.173, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abmC7HEHb7dujURQaRbOBAAAAQ4"]
[Wed Mar 18 00:43:07.774976 2026] [:error] [pid 40715:tid 40944] [client 64.227.35.173:51991] [client 64.227.35.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.35.173, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abmEm2cms0rUPgdkLiH8vgAAAAY"]
[Wed Mar 18 00:50:04.556184 2026] [:error] [pid 40717:tid 41053] [client 64.227.35.173:57389] [client 64.227.35.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.35.173, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abmGPMR22EbC70ICesgI0QAAAII"]
[Wed Mar 18 00:59:25.971107 2026] [:error] [pid 63449:tid 63454] [client 45.118.105.204:15307] [client 45.118.105.204] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abmIbQplutP4IZ5mr13R-wAAAUM"]
[Wed Mar 18 01:00:46.273147 2026] [:error] [pid 40715:tid 40959] [client 45.118.105.204:15177] [client 45.118.105.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.118.105.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abmIvmcms0rUPgdkLiEABAAAABU"]
[Wed Mar 18 01:01:56.499568 2026] [:error] [pid 63612:tid 63614] [client 45.118.105.204:15484] [client 45.118.105.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.118.105.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abmJBO7vPBSR8vo387MdmgAAAYA"]
[Wed Mar 18 01:03:09.365981 2026] [:error] [pid 63412:tid 63418] [client 45.118.105.204:15051] [client 45.118.105.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.118.105.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abmJTTKUzzFOGoXRLQ-yOQAAAMI"]
[Wed Mar 18 01:08:59.094665 2026] [autoindex:error] [pid 63412:tid 63421] [client 139.59.32.166:63444] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Mar 18 02:44:31.427198 2026] [:error] [pid 63412:tid 63424] [client 43.133.14.237:41324] [client 43.133.14.237] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abmhDzKUzzFOGoXRLQ_OtwAAAMg"]
[Wed Mar 18 03:05:32.685388 2026] [autoindex:error] [pid 41165:tid 41190] [client 142.93.208.146:53276] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed Mar 18 03:23:55.358380 2026] [:error] [pid 63612:tid 63624] [client 45.118.105.204:15487] [client 45.118.105.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.118.105.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abmqS-7vPBSR8vo387NndwAAAYo"]
[Wed Mar 18 03:25:20.391322 2026] [:error] [pid 40716:tid 41035] [client 45.118.105.204:15127] [client 45.118.105.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.118.105.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abmqoBR6i4ByUuhUBASlGwAAAE4"]
[Wed Mar 18 03:26:31.783690 2026] [:error] [pid 41165:tid 41175] [client 45.118.105.204:15275] [client 45.118.105.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.118.105.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abmq53EHb7dujURQaRbqBwAAAQg"]
[Wed Mar 18 03:27:38.166219 2026] [:error] [pid 63412:tid 63437] [client 45.118.105.204:15326] [client 45.118.105.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.118.105.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abmrKjKUzzFOGoXRLQ_dLQAAANU"]
[Wed Mar 18 03:28:48.298589 2026] [:error] [pid 41165:tid 41167] [client 45.118.105.204:15246] [client 45.118.105.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.118.105.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abmrcHEHb7dujURQaRbqUQAAAQA"]
[Wed Mar 18 04:55:00.567688 2026] [:error] [pid 44965:tid 45018] [client 43.167.245.18:53288] [client 43.167.245.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abm_pKNZys-oG-hM22hwAgAAAEg"]
[Wed Mar 18 07:43:37.473386 2026] [:error] [pid 13676:tid 13678] [client 43.157.179.227:60770] [client 43.157.179.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abnnKWxDEHR5lvAEVIgL0QAAAQA"]
[Wed Mar 18 08:13:21.626453 2026] [:error] [pid 13716:tid 13720] [client 20.2.90.103:41700] [client 20.2.90.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "abnuIWWKzQVHkZkUHaRUQAAAAUI"]
[Wed Mar 18 09:36:58.323117 2026] [autoindex:error] [pid 42870:tid 42886] [client 52.140.125.218:34039] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Mar 18 09:37:04.634426 2026] [:error] [pid 42870:tid 42908] [client 52.140.125.218:34039] [client 52.140.125.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "aboBwJ6axlAooiuYyUw_FAAAABc"]
[Wed Mar 18 09:37:05.194467 2026] [:error] [pid 43009:tid 43028] [client 52.140.125.218:33179] [client 52.140.125.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "aboBwX8aUp4Sm6m3nmNulwAAARE"]
[Wed Mar 18 09:37:05.762772 2026] [:error] [pid 43009:tid 43033] [client 52.140.125.218:33992] [client 52.140.125.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "aboBwX8aUp4Sm6m3nmNuoAAAARY"]
[Wed Mar 18 09:37:06.377426 2026] [:error] [pid 42870:tid 42898] [client 52.140.125.218:33182] [client 52.140.125.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "aboBwp6axlAooiuYyUw_LAAAAA0"]
[Wed Mar 18 10:48:34.351210 2026] [:error] [pid 42872:tid 42964] [client 185.8.105.168:54510] [client 185.8.105.168] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=video/quicktime"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aboSgjchM8PQMaMEWJmA2gAAAdY"]
[Wed Mar 18 10:54:53.330892 2026] [:error] [pid 43009:tid 43013] [client 106.227.49.113:58440] [client 106.227.49.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aboT_X8aUp4Sm6m3nmO8hAAAAQI"]
[Wed Mar 18 12:08:55.306869 2026] [:error] [pid 43009:tid 43013] [client 102.189.145.255:50051] [client 102.189.145.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.189.145.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abolV38aUp4Sm6m3nmPntAAAAQI"]
[Wed Mar 18 12:16:29.689390 2026] [:error] [pid 53755:tid 53770] [client 102.189.145.255:53991] [client 102.189.145.255] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abonHaqw5ZSRshmIhWlo2wAAAU0"]
[Wed Mar 18 12:17:59.199153 2026] [:error] [pid 53755:tid 53757] [client 102.189.145.255:55213] [client 102.189.145.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.189.145.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abond6qw5ZSRshmIhWlpUAAAAUA"]
[Wed Mar 18 12:19:23.994614 2026] [:error] [pid 42872:tid 42957] [client 102.189.145.255:56323] [client 102.189.145.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.189.145.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abonyzchM8PQMaMEWJmU1QAAAc8"]
[Wed Mar 18 12:20:47.652483 2026] [:error] [pid 43009:tid 43035] [client 102.189.145.255:57188] [client 102.189.145.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.189.145.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abooH38aUp4Sm6m3nmPqsgAAARg"]
[Wed Mar 18 12:22:03.787144 2026] [:error] [pid 42870:tid 42895] [client 102.189.145.255:57640] [client 102.189.145.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.189.145.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abooa56axlAooiuYyUyNwAAAAAo"]
[Wed Mar 18 12:54:08.921567 2026] [:error] [pid 42870:tid 42908] [client 43.135.211.148:45564] [client 43.135.211.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abov8J6axlAooiuYyUypJgAAABc"]
[Wed Mar 18 17:48:24.292393 2026] [:error] [pid 31232:tid 31235] [client 176.11.1.52:50917] [client 176.11.1.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.11.1.52, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abp06GX6HV7dqh3BQD2ixwAAAEA"]
[Wed Mar 18 17:52:14.662706 2026] [:error] [pid 53755:tid 53772] [client 39.36.103.13:54491] [client 39.36.103.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.36.103.13, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abp1zqqw5ZSRshmIhWnjKwAAAU8"]
[Wed Mar 18 17:54:35.937129 2026] [:error] [pid 31232:tid 31250] [client 43.156.228.27:32848] [client 43.156.228.27] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abp2W2X6HV7dqh3BQD2l2QAAAE8"]
[Wed Mar 18 17:56:45.356185 2026] [:error] [pid 42871:tid 42920] [client 176.11.1.52:10352] [client 176.11.1.52] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abp23WPUS0lM1M9nUaIwigAAAIY"]
[Wed Mar 18 17:57:49.173793 2026] [:error] [pid 53755:tid 53766] [client 176.11.1.52:50721] [client 176.11.1.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.11.1.52, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abp3Haqw5ZSRshmIhWnkzwAAAUk"]
[Wed Mar 18 17:58:45.245163 2026] [:error] [pid 42871:tid 42938] [client 176.11.1.52:50970] [client 176.11.1.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.11.1.52, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abp3VWPUS0lM1M9nUaIxmwAAAJg"]
[Wed Mar 18 17:59:44.042160 2026] [:error] [pid 53755:tid 53769] [client 176.11.1.52:50905] [client 176.11.1.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.11.1.52, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abp3kKqw5ZSRshmIhWnlTAAAAUw"]
[Wed Mar 18 18:00:44.479513 2026] [:error] [pid 43009:tid 43034] [client 176.11.1.52:50815] [client 176.11.1.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.11.1.52, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abp3zH8aUp4Sm6m3nmMhCgAAARc"]
[Thu Mar 19 02:35:58.160446 2026] [:error] [pid 19224:tid 19384] [client 104.28.203.58:14335] [client 104.28.203.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "abrwjjxUIaHQ6Y3ff51yRQAAAc4"]
[Thu Mar 19 05:06:22.839024 2026] [:error] [pid 3278:tid 3284] [client 178.132.108.56:4540] [client 178.132.108.56] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "absTzgC2T_lM6ZgvfcT5kwAAAQM"]
[Thu Mar 19 05:07:21.757685 2026] [:error] [pid 3278:tid 3305] [client 178.132.108.56:31602] [client 178.132.108.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.132.108.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "absUCQC2T_lM6ZgvfcT6eAAAARg"]
[Thu Mar 19 05:08:18.648083 2026] [:error] [pid 23883:tid 23950] [client 178.132.108.56:3280] [client 178.132.108.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.132.108.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "absUQtNi-EnEAH4abz1qEgAAAFU"]
[Thu Mar 19 05:09:20.453858 2026] [:error] [pid 23884:tid 23958] [client 178.132.108.56:10722] [client 178.132.108.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.132.108.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "absUgF6St-VCdOYnZMrTqwAAAII"]
[Thu Mar 19 05:10:19.063132 2026] [:error] [pid 3278:tid 3292] [client 178.132.108.56:51384] [client 178.132.108.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.132.108.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "absUuwC2T_lM6ZgvfcT8cwAAAQs"]
[Thu Mar 19 05:11:21.140779 2026] [:error] [pid 23988:tid 24001] [client 178.132.108.56:37414] [client 178.132.108.56] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.132.108.56, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "absU-WnlkSPXj2matr31_AAAAMo"]
[Thu Mar 19 06:13:04.717431 2026] [:error] [pid 23884:tid 23967] [client 43.166.226.57:48850] [client 43.166.226.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "absjcF6St-VCdOYnZMrqQQAAAIs"]
[Thu Mar 19 06:31:07.385178 2026] [:error] [pid 23988:tid 23993] [client 31.171.130.14:26279] [client 31.171.130.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "absnq2nlkSPXj2matr0cnwAAAMI"]
[Thu Mar 19 09:23:39.353216 2026] [:error] [pid 31205:tid 31218] [client 43.130.72.40:43898] [client 43.130.72.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abtQG1u5gZKGrGz5P1E7LQAAAUI"]
[Thu Mar 19 09:45:15.689620 2026] [:error] [pid 31205:tid 31227] [client 91.99.187.182:55750] [client 91.99.187.182] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abtVK1u5gZKGrGz5P1FCnAAAAUo"]
[Thu Mar 19 09:57:39.134254 2026] [:error] [pid 25044:tid 25057] [client 209.87.169.58:52853] [client 209.87.169.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "abtYE9UUDKsY7wMywpoxOwAAAsk"]
[Thu Mar 19 09:57:45.027703 2026] [:error] [pid 25179:tid 25204] [client 209.87.169.209:57301] [client 209.87.169.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "abtYGWFzmTtmuBLc_LZNYQAAA5c"]
[Thu Mar 19 09:57:58.712426 2026] [:error] [pid 25179:tid 25191] [client 209.87.169.242:32225] [client 209.87.169.242] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "abtYJmFzmTtmuBLc_LZOAQAAA4o"]
[Thu Mar 19 10:01:58.266087 2026] [autoindex:error] [pid 23882:tid 23912] [client 209.87.169.31:22217] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:01.314814 2026] [autoindex:error] [pid 23882:tid 23920] [client 209.87.169.31:22217] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:03.722153 2026] [autoindex:error] [pid 31313:tid 31385] [client 209.87.169.48:24875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:07.589767 2026] [autoindex:error] [pid 31205:tid 31218] [client 209.87.169.251:28681] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:11.565819 2026] [autoindex:error] [pid 32226:tid 32233] [client 209.87.169.224:53271] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:12.332525 2026] [autoindex:error] [pid 31313:tid 31369] [client 209.87.169.69:40175] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/11/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:13.010015 2026] [autoindex:error] [pid 23882:tid 23919] [client 209.87.169.226:39219] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:13.535833 2026] [autoindex:error] [pid 23988:tid 24013] [client 209.87.169.246:26507] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:14.082548 2026] [autoindex:error] [pid 25269:tid 25295] [client 209.87.169.226:60491] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:14.357127 2026] [autoindex:error] [pid 25269:tid 25285] [client 209.87.169.226:60491] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:14.883113 2026] [autoindex:error] [pid 25269:tid 25295] [client 209.87.169.226:60491] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:17.589007 2026] [autoindex:error] [pid 25269:tid 25285] [client 209.87.169.226:60491] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:17.831661 2026] [autoindex:error] [pid 25269:tid 25285] [client 209.87.169.226:60491] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:28.700941 2026] [autoindex:error] [pid 23988:tid 24009] [client 209.87.169.249:44373] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:28.989306 2026] [autoindex:error] [pid 23988:tid 24009] [client 209.87.169.249:44373] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:29.860247 2026] [autoindex:error] [pid 31205:tid 31229] [client 209.87.169.210:26417] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:31.229669 2026] [autoindex:error] [pid 25044:tid 25062] [client 209.87.169.251:22317] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:39.852769 2026] [autoindex:error] [pid 31313:tid 31371] [client 209.87.169.238:26601] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:40.103055 2026] [autoindex:error] [pid 31313:tid 31369] [client 209.87.169.238:26601] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:43.105694 2026] [autoindex:error] [pid 31313:tid 31369] [client 209.87.169.238:26601] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:51.322729 2026] [autoindex:error] [pid 31313:tid 31378] [client 209.87.169.238:26601] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:51.687996 2026] [autoindex:error] [pid 31313:tid 31376] [client 209.87.169.238:26601] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:02:51.960677 2026] [autoindex:error] [pid 31313:tid 31379] [client 209.87.169.238:26601] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:03:01.617032 2026] [autoindex:error] [pid 31313:tid 31376] [client 209.87.169.238:26601] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:03:13.074253 2026] [autoindex:error] [pid 31313:tid 31372] [client 209.87.169.238:26601] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:03:16.351487 2026] [autoindex:error] [pid 31313:tid 31361] [client 209.87.169.238:26601] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:03:16.606919 2026] [autoindex:error] [pid 31313:tid 31361] [client 209.87.169.238:26601] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:03:16.865338 2026] [autoindex:error] [pid 31313:tid 31361] [client 209.87.169.238:26601] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:03:17.374856 2026] [autoindex:error] [pid 31313:tid 31385] [client 209.87.169.238:26601] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:03:17.649645 2026] [autoindex:error] [pid 31313:tid 31376] [client 209.87.169.238:26601] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:03:17.880907 2026] [autoindex:error] [pid 31313:tid 31361] [client 209.87.169.238:26601] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:03:33.935287 2026] [autoindex:error] [pid 31313:tid 31373] [client 209.87.169.238:26601] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:23.678581 2026] [autoindex:error] [pid 23883:tid 23933] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:23.929656 2026] [autoindex:error] [pid 23883:tid 23931] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:24.180965 2026] [autoindex:error] [pid 23883:tid 23932] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:24.456174 2026] [autoindex:error] [pid 23883:tid 23938] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:33.948073 2026] [autoindex:error] [pid 23883:tid 23943] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:34.224858 2026] [autoindex:error] [pid 23883:tid 23930] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:41.896062 2026] [autoindex:error] [pid 23883:tid 23944] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:42.140931 2026] [autoindex:error] [pid 23883:tid 23931] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:42.357794 2026] [autoindex:error] [pid 23883:tid 23929] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:47.153994 2026] [autoindex:error] [pid 23883:tid 23941] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:47.464386 2026] [autoindex:error] [pid 23883:tid 23929] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:47.703559 2026] [autoindex:error] [pid 23883:tid 23945] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:04:47.950732 2026] [autoindex:error] [pid 23883:tid 23944] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:05:45.619987 2026] [autoindex:error] [pid 23883:tid 23952] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:10.795962 2026] [autoindex:error] [pid 23883:tid 23937] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:12.212805 2026] [autoindex:error] [pid 23883:tid 23953] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:12.445781 2026] [autoindex:error] [pid 23883:tid 23946] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:19.016876 2026] [autoindex:error] [pid 23883:tid 23949] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:19.260778 2026] [autoindex:error] [pid 23883:tid 23930] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:19.520818 2026] [autoindex:error] [pid 23883:tid 23946] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:19.751475 2026] [autoindex:error] [pid 23883:tid 23943] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:19.984515 2026] [autoindex:error] [pid 23883:tid 23937] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:20.248495 2026] [autoindex:error] [pid 23883:tid 23931] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:20.529954 2026] [autoindex:error] [pid 23883:tid 23938] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:20.760982 2026] [autoindex:error] [pid 23883:tid 23934] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:21.059331 2026] [autoindex:error] [pid 23883:tid 23930] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:06:48.379816 2026] [autoindex:error] [pid 23883:tid 23948] [client 209.87.169.238:24579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:07:22.308064 2026] [autoindex:error] [pid 25044:tid 25049] [client 209.87.169.46:60005] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/paste/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:07:24.082095 2026] [autoindex:error] [pid 25044:tid 25069] [client 209.87.169.46:60005] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:07:30.041723 2026] [autoindex:error] [pid 25044:tid 25067] [client 209.87.169.46:60005] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:07:32.074974 2026] [autoindex:error] [pid 25044:tid 25069] [client 209.87.169.46:60005] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:07:34.635147 2026] [autoindex:error] [pid 25044:tid 25069] [client 209.87.169.46:60005] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/directionality/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:07:36.367053 2026] [autoindex:error] [pid 25044:tid 25059] [client 209.87.169.46:60005] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/search/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:07:36.595752 2026] [autoindex:error] [pid 25044:tid 25051] [client 209.87.169.46:60005] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/compat3x/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:07:40.535905 2026] [autoindex:error] [pid 25044:tid 25052] [client 209.87.169.46:60005] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:07:40.810381 2026] [autoindex:error] [pid 25044:tid 25059] [client 209.87.169.46:60005] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:07:42.888496 2026] [autoindex:error] [pid 25044:tid 25058] [client 209.87.169.46:60005] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:07:43.111983 2026] [autoindex:error] [pid 25044:tid 25050] [client 209.87.169.46:60005] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/classic-editor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:07:43.366000 2026] [proxy_fcgi:error] [pid 25044:tid 25056] [client 209.87.169.46:60005] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_header() in /home/expressi/public_html/wp-content/themes/twentytwentyone/index.php:17\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/themes/twentytwentyone/index.php on line 17'
[Thu Mar 19 10:07:45.697556 2026] [autoindex:error] [pid 25135:tid 25143] [client 209.87.169.72:48675] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:07:53.953630 2026] [autoindex:error] [pid 25135:tid 25160] [client 209.87.169.72:48675] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/paragraph/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:08:00.906724 2026] [autoindex:error] [pid 25135:tid 25149] [client 209.87.169.72:48675] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/nux/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:08:02.715433 2026] [autoindex:error] [pid 25135:tid 25161] [client 209.87.169.72:48675] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/lists/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:08:02.980605 2026] [autoindex:error] [pid 25135:tid 25144] [client 209.87.169.72:48675] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:08:24.310976 2026] [autoindex:error] [pid 25135:tid 25137] [client 209.87.169.72:48675] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:08:26.535833 2026] [autoindex:error] [pid 25135:tid 25157] [client 209.87.169.72:48675] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/social-links/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:08:48.897570 2026] [autoindex:error] [pid 23884:tid 23962] [client 209.87.169.245:51631] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/src/Core/Curve25519/Ge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:10:44.745474 2026] [autoindex:error] [pid 23884:tid 23963] [client 209.87.169.245:51631] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:10:44.985977 2026] [autoindex:error] [pid 23884:tid 23967] [client 209.87.169.245:51631] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:10:48.147617 2026] [autoindex:error] [pid 23884:tid 23977] [client 209.87.169.245:51631] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:10:52.064505 2026] [autoindex:error] [pid 23884:tid 23968] [client 209.87.169.245:51631] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentythree/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:10:57.436268 2026] [autoindex:error] [pid 23884:tid 23956] [client 209.87.169.245:51631] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:10:59.732853 2026] [autoindex:error] [pid 23884:tid 23973] [client 209.87.169.245:51631] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:11:07.136116 2026] [autoindex:error] [pid 23884:tid 23965] [client 209.87.169.245:51631] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/edit-site/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:11:10.212013 2026] [autoindex:error] [pid 23884:tid 23978] [client 209.87.169.245:51631] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:11:19.708994 2026] [autoindex:error] [pid 23884:tid 23960] [client 209.87.169.245:51631] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/wordpress/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:11:19.936895 2026] [autoindex:error] [pid 23884:tid 23972] [client 209.87.169.245:51631] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/src/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:11:39.650403 2026] [autoindex:error] [pid 31205:tid 31234] [client 209.87.169.214:41225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:11:45.144910 2026] [autoindex:error] [pid 31205:tid 31227] [client 209.87.169.214:41225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:12:01.570526 2026] [autoindex:error] [pid 31205:tid 31238] [client 209.87.169.214:41225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/lightgray/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:12:01.825684 2026] [autoindex:error] [pid 31205:tid 31230] [client 209.87.169.214:41225] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/05/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:12:22.716399 2026] [autoindex:error] [pid 31205:tid 31225] [client 209.87.169.214:41225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/site-title/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:12:47.982375 2026] [autoindex:error] [pid 31205:tid 31241] [client 209.87.169.214:41225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/block-library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:12:48.252961 2026] [autoindex:error] [pid 31205:tid 31237] [client 209.87.169.214:41225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:13:01.344671 2026] [autoindex:error] [pid 31205:tid 31228] [client 209.87.169.214:41225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:13:01.630491 2026] [autoindex:error] [pid 31205:tid 31217] [client 209.87.169.214:41225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/lightgray/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:13:01.947996 2026] [autoindex:error] [pid 31205:tid 31219] [client 209.87.169.214:41225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 19 10:45:28.480508 2026] [:error] [pid 25135:tid 25161] [client 177.188.213.151:61431] [client 177.188.213.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.188.213.151, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abtjSKKtE0dzgMctjFWtogAAA1g"]
[Thu Mar 19 11:20:14.429757 2026] [:error] [pid 24925:tid 24951] [client 170.106.192.3:40266] [client 170.106.192.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abtrbvUZEHbnUgjEbWNYYwAAAZY"]
[Thu Mar 19 12:54:15.428904 2026] [:error] [pid 23883:tid 23929] [client 154.16.49.101:7412] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abuBd9Ni-EnEAH4abz2whAAAAEA"]
[Thu Mar 19 12:54:15.921360 2026] [:error] [pid 23882:tid 23926] [client 154.16.49.101:7649] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/license.txt"] [unique_id "abuBd7WnClbtbN12M7-UcAAAABg"]
[Thu Mar 19 12:54:16.425427 2026] [:error] [pid 25135:tid 25151] [client 154.16.49.101:8010] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/feed/"] [unique_id "abuBeKKtE0dzgMctjFXt3AAAA04"]
[Thu Mar 19 12:56:59.491301 2026] [:error] [pid 25135:tid 25157] [client 110.166.71.39:51219] [client 110.166.71.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abuCG6KtE0dzgMctjFXvQAAAA1Q"]
[Thu Mar 19 14:51:14.289959 2026] [:error] [pid 11110:tid 11133] [client 98.159.37.160:52965] [client 98.159.37.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abuc4gSNPqGfikw7k8JOegAAABI"]
[Thu Mar 19 15:26:26.869685 2026] [:error] [pid 11014:tid 11028] [client 216.24.210.81:59601] [client 216.24.210.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abulIjBVizvrAl0DfCDYzgAAAEk"]
[Thu Mar 19 15:55:47.001577 2026] [:error] [pid 11015:tid 11069] [client 216.24.210.85:27695] [client 216.24.210.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abusA_PcMwFQZAVfzLQoFgAAAJc"]
[Thu Mar 19 16:17:55.073976 2026] [:error] [pid 11014:tid 11041] [client 101.33.80.42:58426] [client 101.33.80.42] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abuxMzBVizvrAl0DfCDs7wAAAFY"]
[Thu Mar 19 16:23:31.776721 2026] [:error] [pid 11015:tid 11055] [client 98.159.37.19:38089] [client 98.159.37.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abuyg_PcMwFQZAVfzLQuQwAAAIk"]
[Thu Mar 19 16:51:11.557499 2026] [:error] [pid 11014:tid 11020] [client 173.239.218.15:48597] [client 173.239.218.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.15, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abu4_zBVizvrAl0DfCD68QAAAEE"]
[Thu Mar 19 17:18:05.458194 2026] [:error] [pid 1247:tid 1272] [client 216.24.210.93:59411] [client 216.24.210.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abu_TQ5tmeOr-yI4XNF-BQAAAdc"]
[Thu Mar 19 17:44:59.241054 2026] [:error] [pid 11015:tid 11053] [client 98.159.37.160:48667] [client 98.159.37.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abvFm_PcMwFQZAVfzLRDvAAAAIc"]
[Thu Mar 19 18:11:31.605930 2026] [:error] [pid 51091:tid 51119] [client 216.24.210.77:52497] [client 216.24.210.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abvL077LZKhdJPD9CBu39AAAAUg"]
[Thu Mar 19 18:39:10.127800 2026] [:error] [pid 11015:tid 11051] [client 216.24.210.81:48507] [client 216.24.210.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abvSTvPcMwFQZAVfzLRS2gAAAIU"]
[Thu Mar 19 19:07:03.944148 2026] [:error] [pid 11015:tid 11053] [client 216.24.210.90:51291] [client 216.24.210.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abvY1_PcMwFQZAVfzLRaFQAAAIc"]
[Thu Mar 19 19:34:51.308416 2026] [:error] [pid 1441:tid 1453] [client 98.159.37.69:26735] [client 98.159.37.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.69, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abvfW4f6BGzjfVNuehUZugAAAwo"]
[Thu Mar 19 19:43:13.216825 2026] [:error] [pid 11016:tid 11077] [client 204.216.105.226:53348] [client 204.216.105.226] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=image/x-icon"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abvhURPK94J9G19C6uVP_AAAAQQ"]
[Thu Mar 19 20:02:29.578969 2026] [:error] [pid 11014:tid 11023] [client 216.24.210.69:65393] [client 216.24.210.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.69, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abvl1TBVizvrAl0DfCASZQAAAEQ"]
[Thu Mar 19 20:07:55.770738 2026] [:error] [pid 1285:tid 1301] [client 182.44.12.37:43368] [client 182.44.12.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abvnG1E95r3zR75X1HolAQAAAg4"]
[Thu Mar 19 20:44:39.127279 2026] [:error] [pid 1397:tid 1403] [client 216.24.210.92:21697] [client 216.24.210.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abvvt3ptc6vBjy-kgOMYvwAAAsQ"]
[Thu Mar 19 21:04:57.136066 2026] [:error] [pid 11015:tid 11067] [client 49.51.52.250:42410] [client 49.51.52.250] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abv0efPcMwFQZAVfzLR9jQAAAJU"]
[Thu Mar 19 21:07:28.970576 2026] [:error] [pid 1247:tid 1267] [client 104.28.196.107:19274] [client 104.28.196.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.196.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abv1EA5tmeOr-yI4XNHf6gAAAdI"]
[Thu Mar 19 21:12:31.119303 2026] [:error] [pid 11110:tid 11116] [client 82.165.89.205:47182] [client 82.165.89.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.165.89.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abv2PwSNPqGfikw7k8K-2wAAAAE"]
[Thu Mar 19 21:12:31.980630 2026] [:error] [pid 11110:tid 11129] [client 82.165.89.205:47182] [client 82.165.89.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.165.89.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abv2PwSNPqGfikw7k8K-3AAAAA4"], referer: https://expressinteriors.com/wp-login.php
[Thu Mar 19 21:31:56.806702 2026] [:error] [pid 11015:tid 11066] [client 108.179.243.221:45878] [client 108.179.243.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.179.243.221, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abv6zPPcMwFQZAVfzLSFGwAAAJQ"]
[Thu Mar 19 21:31:57.706916 2026] [:error] [pid 11015:tid 11069] [client 108.179.243.221:45878] [client 108.179.243.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.179.243.221, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abv6zfPcMwFQZAVfzLSFHAAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Thu Mar 19 21:40:02.020366 2026] [:error] [pid 11015:tid 11058] [client 108.179.192.120:15502] [client 108.179.192.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.179.192.120, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abv8svPcMwFQZAVfzLSG_gAAAIw"]
[Thu Mar 19 21:40:03.174420 2026] [:error] [pid 11015:tid 11048] [client 108.179.192.120:15502] [client 108.179.192.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.179.192.120, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abv8s_PcMwFQZAVfzLSHAQAAAII"], referer: https://expressinteriors.com/wp-login.php
[Thu Mar 19 21:55:16.356112 2026] [:error] [pid 1247:tid 1254] [client 98.159.37.160:20169] [client 98.159.37.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abwARA5tmeOr-yI4XNH5QQAAAcU"]
[Thu Mar 19 21:56:46.888406 2026] [:error] [pid 11014:tid 11038] [client 50.87.144.73:47712] [client 50.87.144.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abwAnjBVizvrAl0DfCAc5gAAAFM"]
[Thu Mar 19 21:56:47.955620 2026] [:error] [pid 11014:tid 11034] [client 50.87.144.73:47712] [client 50.87.144.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abwAnzBVizvrAl0DfCAc6gAAAE8"], referer: https://expressinteriors.com/wp-login.php
[Thu Mar 19 21:58:39.812372 2026] [:error] [pid 1285:tid 1301] [client 104.28.196.107:19447] [client 104.28.196.107] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abwBD1E95r3zR75X1HpQUgAAAg4"]
[Thu Mar 19 21:59:32.200799 2026] [:error] [pid 11110:tid 11137] [client 194.26.192.111:59078] [client 194.26.192.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "abwBRASNPqGfikw7k8LJ0wAAABY"]
[Thu Mar 19 21:59:32.865215 2026] [:error] [pid 11015:tid 11070] [client 194.26.192.111:52608] [client 194.26.192.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "abwBRPPcMwFQZAVfzLSM2QAAAJg"]
[Thu Mar 19 21:59:33.393653 2026] [:error] [pid 48106:tid 48126] [client 194.26.192.111:63727] [client 194.26.192.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "abwBRcVZaUGvkz29lZEePgAAAMw"]
[Thu Mar 19 21:59:35.917407 2026] [:error] [pid 1285:tid 1302] [client 194.26.192.111:52766] [client 194.26.192.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "abwBR1E95r3zR75X1HpQmAAAAg8"]
[Thu Mar 19 22:00:04.668076 2026] [:error] [pid 11015:tid 11063] [client 104.28.196.107:19359] [client 104.28.196.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.196.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abwBZPPcMwFQZAVfzLSNDwAAAJE"]
[Thu Mar 19 22:01:34.418562 2026] [:error] [pid 11014:tid 11028] [client 104.28.196.107:19379] [client 104.28.196.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.196.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abwBvjBVizvrAl0DfCAdZAAAAEk"]
[Thu Mar 19 22:03:45.573337 2026] [:error] [pid 1285:tid 1311] [client 72.167.150.128:46550] [client 72.167.150.128] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 72.167.150.128, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abwCQVE95r3zR75X1HpStwAAAhg"]
[Thu Mar 19 22:03:46.489863 2026] [:error] [pid 1285:tid 1307] [client 72.167.150.128:46550] [client 72.167.150.128] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 72.167.150.128, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abwCQlE95r3zR75X1HpSvwAAAhQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Mar 19 22:04:09.321187 2026] [:error] [pid 48106:tid 48136] [client 104.28.196.107:19339] [client 104.28.196.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.196.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abwCWcVZaUGvkz29lZEevQAAANY"]
[Thu Mar 19 22:05:21.487004 2026] [:error] [pid 1441:tid 1447] [client 104.28.196.107:19397] [client 104.28.196.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.28.196.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abwCoYf6BGzjfVNuehUjJQAAAwQ"]
[Thu Mar 19 22:22:22.164612 2026] [:error] [pid 1247:tid 1250] [client 162.241.203.52:11962] [client 162.241.203.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.203.52, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abwGng5tmeOr-yI4XNEKAgAAAcE"]
[Thu Mar 19 22:22:23.778056 2026] [:error] [pid 1247:tid 1272] [client 162.241.203.52:11962] [client 162.241.203.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.203.52, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abwGnw5tmeOr-yI4XNEKDgAAAdc"], referer: https://expressinteriors.com/wp-login.php
[Thu Mar 19 23:06:38.580422 2026] [:error] [pid 1247:tid 1257] [client 98.159.37.19:21771] [client 98.159.37.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abwQ_g5tmeOr-yI4XNEcuAAAAcg"]
[Thu Mar 19 23:29:40.452572 2026] [:error] [pid 11015:tid 11050] [client 208.109.62.151:43448] [client 208.109.62.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.62.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abwWZPPcMwFQZAVfzLSiJwAAAIQ"]
[Thu Mar 19 23:29:41.348417 2026] [:error] [pid 11015:tid 11052] [client 208.109.62.151:43448] [client 208.109.62.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.109.62.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abwWZfPcMwFQZAVfzLSiKQAAAIY"], referer: https://expressinteriors.com/wp-login.php
[Fri Mar 20 00:18:20.994847 2026] [:error] [pid 51091:tid 51134] [client 98.159.37.20:23445] [client 98.159.37.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.159.37.20, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abwhzL7LZKhdJPD9CBv1hwAAAVc"]
[Fri Mar 20 00:25:37.380182 2026] [:error] [pid 46125:tid 46237] [client 136.117.141.205:54139] [client 136.117.141.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.117.141.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abwjgWgN4lI6NHeckY5OvQAAAI4"]
[Fri Mar 20 00:25:39.435216 2026] [:error] [pid 46125:tid 46215] [client 136.117.141.205:54139] [client 136.117.141.205] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "abwjg2gN4lI6NHeckY5OwQAAAIM"]
[Fri Mar 20 00:25:39.630390 2026] [:error] [pid 46125:tid 46217] [client 136.117.141.205:54139] [client 136.117.141.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.117.141.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abwjg2gN4lI6NHeckY5OwgAAAIQ"]
[Fri Mar 20 00:25:40.965849 2026] [:error] [pid 46125:tid 46230] [client 136.117.141.205:54301] [client 136.117.141.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.117.141.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abwjhGgN4lI6NHeckY5OxAAAAIs"]
[Fri Mar 20 00:25:42.304159 2026] [:error] [pid 46264:tid 46305] [client 136.117.141.205:53788] [client 136.117.141.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.117.141.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abwjhop3TruHFmWOt5G0EQAAABY"]
[Fri Mar 20 00:25:43.638353 2026] [:error] [pid 46124:tid 46180] [client 136.117.141.205:62538] [client 136.117.141.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.117.141.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abwjh0zMrlLOY6zyCjJf9AAAAEA"]
[Fri Mar 20 00:25:44.950752 2026] [:error] [pid 46124:tid 46192] [client 136.117.141.205:51739] [client 136.117.141.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.117.141.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abwjiEzMrlLOY6zyCjJf-AAAAEw"]
[Fri Mar 20 00:25:44.950904 2026] [:error] [pid 46124:tid 46192] [client 136.117.141.205:51739] [client 136.117.141.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 136.117.141.205, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abwjiEzMrlLOY6zyCjJf-AAAAEw"]
[Fri Mar 20 00:41:14.243054 2026] [autoindex:error] [pid 46264:tid 46288] [client 20.104.192.115:12219] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Mar 20 00:41:14.488251 2026] [:error] [pid 46264:tid 46287] [client 20.104.192.115:12219] [client 20.104.192.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.104.192.115, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "abwnKop3TruHFmWOt5G-4gAAAAQ"]
[Fri Mar 20 00:41:16.151551 2026] [autoindex:error] [pid 46264:tid 46304] [client 20.104.192.115:12219] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Mar 20 00:41:18.626800 2026] [autoindex:error] [pid 46264:tid 46301] [client 20.104.192.115:12219] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Mar 20 00:41:18.836831 2026] [autoindex:error] [pid 46264:tid 46298] [client 20.104.192.115:12219] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Mar 20 00:41:19.819311 2026] [autoindex:error] [pid 46264:tid 46287] [client 20.104.192.115:12219] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Mar 20 00:41:24.271269 2026] [autoindex:error] [pid 46264:tid 46300] [client 20.104.192.115:12219] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Mar 20 00:41:25.282532 2026] [:error] [pid 46264:tid 46303] [client 20.104.192.115:12219] [client 20.104.192.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "abwnNYp3TruHFmWOt5G_GQAAABQ"]
[Fri Mar 20 00:41:30.865248 2026] [:error] [pid 46264:tid 46299] [client 20.104.192.115:12200] [client 20.104.192.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "abwnOop3TruHFmWOt5G_LQAAABA"]
[Fri Mar 20 00:41:32.606905 2026] [:error] [pid 46124:tid 46199] [client 20.104.192.115:12181] [client 20.104.192.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "abwnPEzMrlLOY6zyCjJmtQAAAFM"]
[Fri Mar 20 00:41:33.979576 2026] [:error] [pid 46264:tid 46291] [client 20.104.192.115:12198] [client 20.104.192.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "abwnPYp3TruHFmWOt5G_OwAAAAg"]
[Fri Mar 20 00:41:35.481314 2026] [:error] [pid 46124:tid 46183] [client 20.104.192.115:12168] [client 20.104.192.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "abwnP0zMrlLOY6zyCjJmuQAAAEM"]
[Fri Mar 20 01:01:54.349583 2026] [:error] [pid 46126:tid 46216] [client 135.236.141.8:49455] [client 135.236.141.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 135.236.141.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abwsAqQ44YePbsZz3j7HrgAAAQM"]
[Fri Mar 20 01:01:55.291356 2026] [:error] [pid 46126:tid 46256] [client 135.236.141.8:49455] [client 135.236.141.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 135.236.141.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abwsA6Q44YePbsZz3j7HrwAAARc"], referer: https://expressinteriors.com/wp-login.php
[Fri Mar 20 01:14:29.033961 2026] [:error] [pid 46125:tid 46219] [client 209.97.171.56:50084] [client 209.97.171.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abwu9WgN4lI6NHeckY5cCQAAAIU"]
[Fri Mar 20 01:14:29.370047 2026] [:error] [pid 46126:tid 46236] [client 209.97.171.56:51661] [client 209.97.171.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abwu9aQ44YePbsZz3j7MIgAAAQ0"]
[Fri Mar 20 01:14:29.829990 2026] [:error] [pid 46124:tid 46202] [client 209.97.171.56:64699] [client 209.97.171.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "abwu9UzMrlLOY6zyCjJ2RwAAAFY"]
[Fri Mar 20 01:33:09.400905 2026] [:error] [pid 46126:tid 46224] [client 216.24.210.77:40637] [client 216.24.210.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abwzVaQ44YePbsZz3j7RuQAAAQc"]
[Fri Mar 20 01:33:33.675768 2026] [:error] [pid 46124:tid 46194] [client 190.92.175.38:49422] [client 190.92.175.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.92.175.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abwzbUzMrlLOY6zyCjJ-EwAAAE4"]
[Fri Mar 20 01:33:37.640223 2026] [:error] [pid 46124:tid 46186] [client 190.92.175.38:49422] [client 190.92.175.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.92.175.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abwzcUzMrlLOY6zyCjJ-GQAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Fri Mar 20 02:02:13.573764 2026] [autoindex:error] [pid 46125:tid 46217] [client 20.70.169.231:2967] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Mar 20 02:02:17.869906 2026] [:error] [pid 46125:tid 46230] [client 20.70.169.231:2967] [client 20.70.169.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "abw6KWgN4lI6NHeckY5mvwAAAIs"]
[Fri Mar 20 02:02:17.972042 2026] [:error] [pid 46124:tid 46187] [client 20.70.169.231:2952] [client 20.70.169.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "abw6KUzMrlLOY6zyCjKItwAAAEc"]
[Fri Mar 20 02:02:18.067554 2026] [:error] [pid 46264:tid 46298] [client 20.70.169.231:2614] [client 20.70.169.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "abw6Kop3TruHFmWOt5H0EAAAAA8"]
[Fri Mar 20 02:02:18.145348 2026] [:error] [pid 46264:tid 46299] [client 20.70.169.231:2961] [client 20.70.169.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "abw6Kop3TruHFmWOt5H0EgAAABA"]
[Fri Mar 20 02:43:54.702441 2026] [:error] [pid 46125:tid 46237] [client 173.239.218.15:24805] [client 173.239.218.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.15, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abxD6mgN4lI6NHeckY5wBwAAAI4"]
[Fri Mar 20 02:54:44.306261 2026] [:error] [pid 46264:tid 46293] [client 185.59.44.60:57232] [client 185.59.44.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.59.44.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abxGdIp3TruHFmWOt5EajwAAAAo"]
[Fri Mar 20 02:54:45.275421 2026] [:error] [pid 46264:tid 46300] [client 185.59.44.60:57232] [client 185.59.44.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.59.44.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abxGdYp3TruHFmWOt5EakwAAABE"], referer: https://expressinteriors.com/wp-login.php
[Fri Mar 20 03:28:11.161846 2026] [:error] [pid 46264:tid 46302] [client 45.61.184.125:56198] [client 45.61.184.125] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=application/qwik-json"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abxOS4p3TruHFmWOt5ExAQAAABM"]
[Fri Mar 20 03:54:33.430329 2026] [:error] [pid 27353:tid 27441] [client 216.24.210.92:47661] [client 216.24.210.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abxUeWalyWjNUOVnKaupNAAAAJY"]
[Fri Mar 20 05:05:29.724020 2026] [:error] [pid 58230:tid 58235] [client 216.24.210.75:63121] [client 216.24.210.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.75, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abxlGfeBObYxbmHTzfq4BwAAAMI"]
[Fri Mar 20 05:15:21.072323 2026] [:error] [pid 58126:tid 58178] [client 49.51.39.209:54042] [client 49.51.39.209] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abxnaaKAmdXQSS0Y5KBUAQAAAEY"]
[Fri Mar 20 05:25:54.328343 2026] [:error] [pid 43163:tid 43191] [client 50.6.229.148:45762] [client 50.6.229.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.229.148, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abxp4p_n4JP_ko9XUsz0ZAAAARg"]
[Fri Mar 20 05:25:55.583367 2026] [:error] [pid 43163:tid 43169] [client 50.6.229.148:45762] [client 50.6.229.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.229.148, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abxp45_n4JP_ko9XUsz0ZwAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Fri Mar 20 05:44:48.345782 2026] [:error] [pid 58126:tid 58192] [client 185.194.178.101:25091] [client 185.194.178.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.101, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abxuUKKAmdXQSS0Y5KBcuwAAAFQ"]
[Fri Mar 20 05:49:44.030457 2026] [:error] [pid 43163:tid 43174] [client 67.20.114.187:26364] [client 67.20.114.187] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.20.114.187, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abxveJ_n4JP_ko9XUswFTgAAAQc"]
[Fri Mar 20 05:49:44.995500 2026] [:error] [pid 43163:tid 43169] [client 67.20.114.187:26364] [client 67.20.114.187] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.20.114.187, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abxveJ_n4JP_ko9XUswFUQAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Fri Mar 20 06:16:09.409213 2026] [:error] [pid 55206:tid 55218] [client 173.239.218.4:53083] [client 173.239.218.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.4, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abx1qXUc_Wl5viVmsDwcBwAAAUo"]
[Fri Mar 20 06:35:01.117184 2026] [:error] [pid 55239:tid 55275] [client 173.254.29.175:16164] [client 173.254.29.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.254.29.175, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abx6FaycM6mGWSmcyoLpcQAAAcI"]
[Fri Mar 20 06:35:04.057254 2026] [:error] [pid 55239:tid 55292] [client 173.254.29.175:16164] [client 173.254.29.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.254.29.175, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abx6GKycM6mGWSmcyoLpdgAAAdM"], referer: https://expressinteriors.com/wp-login.php
[Fri Mar 20 06:43:06.327295 2026] [:error] [pid 55239:tid 55275] [client 116.118.2.113:40462] [client 116.118.2.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.118.2.113, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abx7-qycM6mGWSmcyoLrgwAAAcI"]
[Fri Mar 20 06:43:07.354185 2026] [:error] [pid 55239:tid 55293] [client 116.118.2.113:40462] [client 116.118.2.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.118.2.113, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abx7-6ycM6mGWSmcyoLrhAAAAdQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Mar 20 06:46:23.262277 2026] [:error] [pid 55301:tid 55365] [client 185.194.178.59:41637] [client 185.194.178.59] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.59, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abx8v8KP1x4sgmjd3xRcAwAAAoM"]
[Fri Mar 20 06:55:10.811814 2026] [:error] [pid 43163:tid 43179] [client 177.188.213.151:50049] [client 177.188.213.151] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abx-zp_n4JP_ko9XUswUAwAAAQw"]
[Fri Mar 20 06:57:50.200703 2026] [:error] [pid 55452:tid 55499] [client 170.106.163.84:60938] [client 170.106.163.84] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abx_bolFvOIliSP0R2BLeAAAA5A"]
[Fri Mar 20 07:09:30.359774 2026] [:error] [pid 55239:tid 55294] [client 177.188.213.151:52194] [client 177.188.213.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.188.213.151, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abyCKqycM6mGWSmcyoLz9QAAAdU"]
[Fri Mar 20 07:10:27.343875 2026] [:error] [pid 55511:tid 55522] [client 185.194.178.93:28211] [client 185.194.178.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abyCY9j429raoauy3fufpQAAA8c"]
[Fri Mar 20 07:11:36.798050 2026] [:error] [pid 55299:tid 55307] [client 177.188.213.151:54258] [client 177.188.213.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.188.213.151, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abyCqPoGhbNgkNIkZwmAEgAAAgI"]
[Fri Mar 20 07:13:28.953594 2026] [:error] [pid 55239:tid 55289] [client 177.188.213.151:56185] [client 177.188.213.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.188.213.151, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abyDGKycM6mGWSmcyoL1CAAAAdA"]
[Fri Mar 20 07:14:59.019509 2026] [:error] [pid 55452:tid 55493] [client 177.188.213.151:57834] [client 177.188.213.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.188.213.151, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abyDc4lFvOIliSP0R2BNlQAAA4o"]
[Fri Mar 20 07:16:13.397149 2026] [:error] [pid 55419:tid 55421] [client 177.188.213.151:59528] [client 177.188.213.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.188.213.151, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abyDvWZBdOmqhJCTdb7aiwAAAwA"]
[Fri Mar 20 07:26:39.963478 2026] [:error] [pid 43163:tid 43170] [client 216.24.210.94:38379] [client 216.24.210.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.94, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abyGL5_n4JP_ko9XUswZWAAAAQM"]
[Fri Mar 20 07:31:20.498106 2026] [:error] [pid 55301:tid 55376] [client 185.194.178.73:46041] [client 185.194.178.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abyHSMKP1x4sgmjd3xR12QAAAos"]
[Fri Mar 20 07:51:55.071102 2026] [:error] [pid 55299:tid 55322] [client 185.194.178.66:23735] [client 185.194.178.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.66, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abyMG_oGhbNgkNIkZwmRNQAAAhE"]
[Fri Mar 20 08:33:28.951867 2026] [:error] [pid 55301:tid 55401] [client 185.194.178.58:56719] [client 185.194.178.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abyV2MKP1x4sgmjd3xST1wAAApY"]
[Fri Mar 20 08:37:57.573804 2026] [:error] [pid 55301:tid 55403] [client 216.24.210.93:59777] [client 216.24.210.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abyW5cKP1x4sgmjd3xSV5QAAApc"]
[Fri Mar 20 08:54:09.717329 2026] [:error] [pid 58126:tid 58181] [client 185.194.178.62:64773] [client 185.194.178.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abyasaKAmdXQSS0Y5KB4gAAAAEk"]
[Fri Mar 20 09:09:34.452777 2026] [:error] [pid 55299:tid 55305] [client 94.232.247.239:45998] [client 94.232.247.239] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=application/xhtml+xml"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abyeTvoGhbNgkNIkZwm5XgAAAgA"]
[Fri Mar 20 09:15:00.262367 2026] [:error] [pid 58126:tid 58172] [client 185.194.178.92:23525] [client 185.194.178.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abyflKKAmdXQSS0Y5KB70QAAAEA"]
[Fri Mar 20 09:30:06.685215 2026] [:error] [pid 55299:tid 55328] [client 60.188.57.0:54851] [client 60.188.57.0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abyjHvoGhbNgkNIkZwnGvAAAAhc"]
[Fri Mar 20 09:32:59.183768 2026] [:error] [pid 49082:tid 49154] [client 43.159.144.16:56774] [client 43.159.144.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "abyjy6pllYJI1LUIdL82EwAAAUw"]
[Fri Mar 20 09:35:59.510895 2026] [:error] [pid 49080:tid 49086] [client 185.194.178.80:39945] [client 185.194.178.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abykf4k5CHi4V0A3ttjbqwAAAEA"]
[Fri Mar 20 09:49:00.997535 2026] [:error] [pid 51714:tid 51718] [client 216.24.210.77:50465] [client 216.24.210.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abynjDWI82pxvQ0gkssH7QAAAII"]
[Fri Mar 20 09:56:36.066719 2026] [:error] [pid 49170:tid 49181] [client 185.194.178.73:21993] [client 185.194.178.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abypVM-c8ctLVDCqUJWnvAAAAAc"]
[Fri Mar 20 10:37:56.564052 2026] [:error] [pid 49170:tid 49193] [client 185.194.178.88:34535] [client 185.194.178.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.88, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abyzBM-c8ctLVDCqUJXACgAAABM"]
[Fri Mar 20 10:44:52.539613 2026] [:error] [pid 49082:tid 49155] [client 108.167.132.40:30122] [client 108.167.132.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.167.132.40, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aby0pKpllYJI1LUIdL9L4gAAAU0"]
[Fri Mar 20 10:44:57.729688 2026] [:error] [pid 49082:tid 49147] [client 108.167.132.40:30138] [client 108.167.132.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.167.132.40, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aby0qapllYJI1LUIdL9L7AAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Fri Mar 20 10:59:51.561489 2026] [:error] [pid 51714:tid 51728] [client 216.24.210.68:33029] [client 216.24.210.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aby4JzWI82pxvQ0gkstGFwAAAIw"]
[Fri Mar 20 11:19:17.804843 2026] [:error] [pid 49082:tid 49147] [client 185.194.178.59:52851] [client 185.194.178.59] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.59, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aby8tapllYJI1LUIdL9WsAAAAUU"]
[Fri Mar 20 11:41:06.617488 2026] [:error] [pid 49170:tid 49183] [client 170.106.37.134:57856] [client 170.106.37.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "abzB0s-c8ctLVDCqUJXnCQAAAAk"]
[Fri Mar 20 11:46:26.646440 2026] [:error] [pid 49080:tid 49103] [client 50.87.144.147:23648] [client 50.87.144.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abzDEok5CHi4V0A3ttgUigAAAFE"]
[Fri Mar 20 11:46:27.852042 2026] [:error] [pid 49080:tid 49102] [client 50.87.144.147:23648] [client 50.87.144.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abzDE4k5CHi4V0A3ttgUjAAAAFA"], referer: https://expressinteriors.com/wp-login.php
[Fri Mar 20 11:49:31.563673 2026] [:error] [pid 49082:tid 49147] [client 162.241.2.204:15696] [client 162.241.2.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.2.204, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abzDy6pllYJI1LUIdL9gbAAAAUU"]
[Fri Mar 20 11:49:34.643204 2026] [:error] [pid 49080:tid 49104] [client 162.241.2.204:15706] [client 162.241.2.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.2.204, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abzDzok5CHi4V0A3ttgVcwAAAFI"], referer: https://expressinteriors.com/wp-login.php
[Fri Mar 20 12:04:15.741602 2026] [:error] [pid 27302:tid 27314] [client 180.194.60.214:50184] [client 180.194.60.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.194.60.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abzHP7DKiUve17xv6yHPjwAAAMo"]
[Fri Mar 20 12:06:19.215746 2026] [:error] [pid 49080:tid 49103] [client 93.89.225.3:49652] [client 93.89.225.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 93.89.225.3, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abzHu4k5CHi4V0A3ttgeewAAAFE"]
[Fri Mar 20 12:06:20.241767 2026] [:error] [pid 49080:tid 49108] [client 93.89.225.3:49652] [client 93.89.225.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 93.89.225.3, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abzHvIk5CHi4V0A3ttgefgAAAFY"], referer: https://expressinteriors.com/wp-login.php
[Fri Mar 20 12:11:24.027800 2026] [:error] [pid 49080:tid 49099] [client 185.194.178.57:55317] [client 185.194.178.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abzI7Ik5CHi4V0A3ttghDAAAAE0"]
[Fri Mar 20 12:13:44.057644 2026] [:error] [pid 27302:tid 27328] [client 180.194.60.214:56250] [client 180.194.60.214] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abzJeLDKiUve17xv6yHTRAAAANg"]
[Fri Mar 20 12:15:15.790556 2026] [:error] [pid 49081:tid 49126] [client 180.194.60.214:57434] [client 180.194.60.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.194.60.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abzJ0xo1LBAUhfhYPR1hgwAAAQs"]
[Fri Mar 20 12:16:55.913312 2026] [:error] [pid 49080:tid 49109] [client 180.194.60.214:58546] [client 180.194.60.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.194.60.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abzKN4k5CHi4V0A3ttgkAQAAAFc"]
[Fri Mar 20 12:18:40.435483 2026] [:error] [pid 27302:tid 27323] [client 180.194.60.214:59238] [client 180.194.60.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.194.60.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abzKoLDKiUve17xv6yHVNgAAANM"]
[Fri Mar 20 12:20:16.141580 2026] [:error] [pid 49170:tid 49180] [client 180.194.60.214:59970] [client 180.194.60.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.194.60.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abzLAM-c8ctLVDCqUJX4TwAAAAY"]
[Fri Mar 20 12:22:14.194568 2026] [:error] [pid 49170:tid 49174] [client 173.239.218.6:40773] [client 173.239.218.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.6, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abzLds-c8ctLVDCqUJX4sgAAAAA"]
[Fri Mar 20 12:25:48.015812 2026] [:error] [pid 49082:tid 49153] [client 43.241.194.162:21686] [client 43.241.194.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.241.194.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "abzMTKpllYJI1LUIdL9n_wAAAUs"]
[Fri Mar 20 12:31:48.628460 2026] [:error] [pid 27302:tid 27325] [client 185.194.178.57:39353] [client 185.194.178.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abzNtLDKiUve17xv6yHZwwAAANU"]
[Fri Mar 20 12:52:36.972432 2026] [:error] [pid 49081:tid 49134] [client 185.194.178.80:65323] [client 185.194.178.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abzSlBo1LBAUhfhYPR1-IwAAARM"]
[Fri Mar 20 13:10:28.775001 2026] [:error] [pid 49170:tid 49179] [client 173.231.249.1:49356] [client 173.231.249.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.231.249.1, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abzWxM-c8ctLVDCqUJUHAwAAAAU"]
[Fri Mar 20 13:10:29.718231 2026] [:error] [pid 49170:tid 49192] [client 173.231.249.1:49356] [client 173.231.249.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.231.249.1, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abzWxc-c8ctLVDCqUJUHBgAAABI"], referer: https://expressinteriors.com/wp-login.php
[Fri Mar 20 13:12:28.173883 2026] [:error] [pid 49080:tid 49096] [client 192.169.148.148:37202] [client 192.169.148.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.169.148.148, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abzXPIk5CHi4V0A3tthA1gAAAEo"]
[Fri Mar 20 13:12:29.152924 2026] [:error] [pid 49080:tid 49099] [client 192.169.148.148:37202] [client 192.169.148.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.169.148.148, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abzXPYk5CHi4V0A3tthA2AAAAE0"], referer: https://expressinteriors.com/wp-login.php
[Fri Mar 20 13:13:15.982749 2026] [:error] [pid 49080:tid 49091] [client 185.194.178.55:36353] [client 185.194.178.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.55, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abzXa4k5CHi4V0A3tthBJgAAAEU"]
[Fri Mar 20 13:33:01.415462 2026] [:error] [pid 51714:tid 51720] [client 173.239.218.7:64973] [client 173.239.218.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.7, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abzcDTWI82pxvQ0gksuSdQAAAIQ"]
[Fri Mar 20 13:57:38.459024 2026] [:error] [pid 49082:tid 49157] [client 185.194.178.71:62187] [client 185.194.178.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abzh0qpllYJI1LUIdL943QAAAU8"]
[Fri Mar 20 14:18:21.926571 2026] [:error] [pid 49081:tid 49128] [client 185.194.178.87:44133] [client 185.194.178.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.87, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abzmrRo1LBAUhfhYPR28pwAAAQ0"]
[Fri Mar 20 14:43:51.443151 2026] [:error] [pid 49170:tid 49189] [client 216.24.210.87:52603] [client 216.24.210.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.87, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abzsp8-c8ctLVDCqUJUjngAAAA8"]
[Fri Mar 20 15:39:22.330725 2026] [:error] [pid 49082:tid 49155] [client 108.179.194.60:56626] [client 108.179.194.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.179.194.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abz5qqpllYJI1LUIdL-KCgAAAU0"]
[Fri Mar 20 15:39:23.566023 2026] [:error] [pid 49082:tid 49146] [client 108.179.194.60:56626] [client 108.179.194.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.179.194.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abz5q6pllYJI1LUIdL-KDAAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Mar 20 15:55:48.224447 2026] [:error] [pid 49080:tid 49087] [client 173.239.218.134:21501] [client 173.239.218.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "abz9hIk5CHi4V0A3ttiWnQAAAEE"]
[Fri Mar 20 16:13:03.742899 2026] [:error] [pid 49080:tid 49105] [client 122.51.236.174:50688] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ab0Bj4k5CHi4V0A3ttid-wAAAFM"]
[Fri Mar 20 16:19:52.040559 2026] [:error] [pid 49080:tid 49094] [client 173.239.240.66:54261] [client 173.239.240.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.66, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab0DKIk5CHi4V0A3ttihaAAAAEg"]
[Fri Mar 20 17:00:45.598794 2026] [:error] [pid 49081:tid 49119] [client 173.239.240.77:42905] [client 173.239.240.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab0MvRo1LBAUhfhYPR0k-wAAAQQ"]
[Fri Mar 20 17:08:02.245907 2026] [:error] [pid 51714:tid 51737] [client 216.24.210.201:58935] [client 216.24.210.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab0OcjWI82pxvQ0gksu9-wAAAJU"]
[Fri Mar 20 17:16:05.841968 2026] [:error] [pid 27302:tid 27320] [client 173.239.240.87:33163] [client 173.239.240.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.87, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab0QVbDKiUve17xv6yFDugAAANA"]
[Fri Mar 20 17:25:57.552183 2026] [:error] [pid 49082:tid 49147] [client 216.172.172.55:10546] [client 216.172.172.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.172.172.55, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab0SpapllYJI1LUIdL-cFgAAAUU"]
[Fri Mar 20 17:25:58.835849 2026] [:error] [pid 49082:tid 49148] [client 216.172.172.55:10546] [client 216.172.172.55] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.172.172.55, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab0SpqpllYJI1LUIdL-cFwAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Fri Mar 20 17:26:50.713723 2026] [:error] [pid 49170:tid 49189] [client 49.37.45.41:64319] [client 49.37.45.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.37.45.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab0S2s-c8ctLVDCqUJVOsgAAAA8"]
[Fri Mar 20 17:31:33.812211 2026] [:error] [pid 49081:tid 49134] [client 173.239.240.75:62489] [client 173.239.240.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.75, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab0T9Ro1LBAUhfhYPR04igAAARM"]
[Fri Mar 20 17:46:58.516868 2026] [:error] [pid 49082:tid 49152] [client 49.37.45.41:57682] [client 49.37.45.41] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ab0XkqpllYJI1LUIdL-fDQAAAUo"]
[Fri Mar 20 17:47:03.039883 2026] [:error] [pid 49081:tid 49118] [client 173.239.240.89:45571] [client 173.239.240.89] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.89, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab0Xlxo1LBAUhfhYPR1CjQAAAQM"]
[Fri Mar 20 17:49:09.266354 2026] [:error] [pid 49082:tid 49163] [client 49.37.45.41:59280] [client 49.37.45.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.37.45.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab0YFapllYJI1LUIdL-fVgAAAVU"]
[Fri Mar 20 17:50:55.689061 2026] [:error] [pid 51714:tid 51716] [client 49.37.45.41:60218] [client 49.37.45.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.37.45.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab0YfzWI82pxvQ0gksvG4AAAAIA"]
[Fri Mar 20 17:52:30.330373 2026] [:error] [pid 49080:tid 49108] [client 49.37.45.41:60850] [client 49.37.45.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.37.45.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab0Y3ok5CHi4V0A3ttjPMgAAAFY"]
[Fri Mar 20 17:54:25.659361 2026] [:error] [pid 27302:tid 27314] [client 49.37.45.41:62076] [client 49.37.45.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.37.45.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab0ZUbDKiUve17xv6yFQTQAAAMo"]
[Fri Mar 20 18:01:59.762797 2026] [:error] [pid 49081:tid 49129] [client 173.239.240.64:51619] [client 173.239.240.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.64, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab0bFxo1LBAUhfhYPR1MbgAAAQ4"]
[Fri Mar 20 18:17:10.955331 2026] [:error] [pid 49170:tid 49188] [client 173.239.240.77:42443] [client 173.239.240.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab0eps-c8ctLVDCqUJVbVgAAAA4"]
[Fri Mar 20 18:20:19.965499 2026] [:error] [pid 49080:tid 49092] [client 216.24.210.216:30185] [client 216.24.210.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab0fY4k5CHi4V0A3ttjb5wAAAEY"]
[Fri Mar 20 18:32:17.342064 2026] [:error] [pid 51714:tid 51724] [client 173.239.240.72:57089] [client 173.239.240.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab0iMTWI82pxvQ0gksvPPAAAAIg"]
[Fri Mar 20 18:47:42.653443 2026] [:error] [pid 49080:tid 49102] [client 173.239.240.87:60189] [client 173.239.240.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.87, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab0lzok5CHi4V0A3ttjnIgAAAFA"]
[Fri Mar 20 19:17:27.306502 2026] [:error] [pid 49081:tid 49117] [client 173.239.240.70:29295] [client 173.239.240.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab0sxxo1LBAUhfhYPR16LAAAAQI"]
[Fri Mar 20 19:32:29.137909 2026] [:error] [pid 49170:tid 49187] [client 216.24.210.206:65445] [client 216.24.210.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.206, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab0wTc-c8ctLVDCqUJVu4AAAAA0"]
[Fri Mar 20 19:32:30.053171 2026] [:error] [pid 51714:tid 51725] [client 173.239.240.84:63981] [client 173.239.240.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.84, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab0wTjWI82pxvQ0gksvbFgAAAIk"]
[Fri Mar 20 19:47:35.386703 2026] [:error] [pid 49080:tid 49094] [client 173.239.240.72:64207] [client 173.239.240.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab0z14k5CHi4V0A3ttj-PQAAAEg"]
[Fri Mar 20 20:09:57.456975 2026] [:error] [pid 49081:tid 49121] [client 173.239.240.73:46127] [client 173.239.240.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab05FRo1LBAUhfhYPR2L5gAAAQY"]
[Fri Mar 20 20:13:35.302721 2026] [:error] [pid 38305:tid 38331] [client 216.24.212.13:61205] [client 216.24.212.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.212.13, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab0573guiB3cZkKG6iI1QAAAAdM"]
[Fri Mar 20 20:14:42.886056 2026] [:error] [pid 51714:tid 51719] [client 43.166.129.247:40370] [client 43.166.129.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ab06MjWI82pxvQ0gksvhnAAAAIM"]
[Fri Mar 20 20:25:30.822059 2026] [:error] [pid 51714:tid 51722] [client 173.239.240.81:20539] [client 173.239.240.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab08ujWI82pxvQ0gksviSgAAAIY"]
[Fri Mar 20 20:44:18.775062 2026] [:error] [pid 49082:tid 49159] [client 216.24.212.22:65413] [client 216.24.212.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.212.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1BIqpllYJI1LUIdL_DqwAAAVE"]
[Fri Mar 20 20:44:47.282732 2026] [:error] [pid 49080:tid 49097] [client 173.239.218.146:21055] [client 173.239.218.146] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.146, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1BP4k5CHi4V0A3ttgNIwAAAEs"]
[Fri Mar 20 20:56:09.618576 2026] [:error] [pid 49170:tid 49180] [client 173.239.240.71:53863] [client 173.239.240.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1D6c-c8ctLVDCqUJWLEQAAAAY"]
[Fri Mar 20 21:11:22.575929 2026] [:error] [pid 49170:tid 49185] [client 173.239.240.70:25929] [client 173.239.240.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1Hes-c8ctLVDCqUJWQLQAAAAs"]
[Fri Mar 20 21:26:45.211655 2026] [:error] [pid 38378:tid 38405] [client 173.239.240.78:53011] [client 173.239.240.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1LFVKb3npPsu9Iib19ZAAAAhc"]
[Fri Mar 20 21:39:58.653862 2026] [:error] [pid 49170:tid 49191] [client 74.7.243.217:35478] [client 74.7.243.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.7.243.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab1OLs-c8ctLVDCqUJWZhgAAABE"], referer: https://expressinteriors.com/
[Fri Mar 20 21:40:07.794428 2026] [:error] [pid 49170:tid 49184] [client 74.7.243.217:35478] [client 74.7.243.217] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "ab1ON8-c8ctLVDCqUJWZqwAAAAo"], referer: https://expressinteriors.com/author/acs/
[Fri Mar 20 21:40:18.658467 2026] [:error] [pid 49170:tid 49179] [client 74.7.243.217:35478] [client 74.7.243.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.7.243.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab1OQs-c8ctLVDCqUJWZvAAAAAU"], referer: https://expressinteriors.com/2023/02/27/hello-world/
[Fri Mar 20 21:40:24.531993 2026] [:error] [pid 49170:tid 49174] [client 216.24.212.24:49429] [client 216.24.212.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.212.24, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1OSM-c8ctLVDCqUJWZyQAAAAA"]
[Fri Mar 20 21:41:54.037026 2026] [:error] [pid 38378:tid 38406] [client 173.239.240.85:45461] [client 173.239.240.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1OolKb3npPsu9Iib1_mQAAAhg"]
[Fri Mar 20 21:56:42.498105 2026] [:error] [pid 49082:tid 49158] [client 216.24.210.196:20395] [client 216.24.210.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.196, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1SGqpllYJI1LUIdL_gjwAAAVA"]
[Fri Mar 20 21:57:05.008297 2026] [:error] [pid 49082:tid 49146] [client 173.239.240.75:55595] [client 173.239.240.75] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.75, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1SMapllYJI1LUIdL_guAAAAUQ"]
[Fri Mar 20 22:04:40.360129 2026] [autoindex:error] [pid 49080:tid 49108] [client 141.98.11.17:61582] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri Mar 20 22:27:34.327265 2026] [:error] [pid 38378:tid 38404] [client 173.239.240.85:61121] [client 173.239.240.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1ZVlKb3npPsu9Iib2IcQAAAhY"]
[Fri Mar 20 22:31:53.246286 2026] [:error] [pid 49082:tid 49151] [client 103.214.60.157:20292] [client 103.214.60.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.214.60.157, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1aWapllYJI1LUIdL_vygAAAUk"]
[Fri Mar 20 22:31:54.196877 2026] [:error] [pid 49082:tid 49160] [client 103.214.60.157:20292] [client 103.214.60.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.214.60.157, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1aWqpllYJI1LUIdL_vzQAAAVI"], referer: https://expressinteriors.com/wp-login.php
[Fri Mar 20 22:38:25.833797 2026] [:error] [pid 27302:tid 27319] [client 69.6.249.227:39458] [client 69.6.249.227] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.6.249.227, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1b4bDKiUve17xv6yGIAQAAAM8"]
[Fri Mar 20 22:38:26.921057 2026] [:error] [pid 27302:tid 27309] [client 69.6.249.227:39458] [client 69.6.249.227] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.6.249.227, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1b4rDKiUve17xv6yGIAgAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Fri Mar 20 22:42:44.299341 2026] [:error] [pid 49080:tid 49102] [client 173.239.240.80:32251] [client 173.239.240.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1c5Ik5CHi4V0A3ttgoAgAAAFA"]
[Fri Mar 20 22:57:41.616413 2026] [:error] [pid 49082:tid 49147] [client 162.241.218.238:21778] [client 162.241.218.238] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.218.238, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1gZapllYJI1LUIdL_7SAAAAUU"]
[Fri Mar 20 22:57:43.656171 2026] [:error] [pid 38305:tid 38330] [client 162.241.218.238:21792] [client 162.241.218.238] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.218.238, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1gZ3guiB3cZkKG6iJNkAAAAdI"], referer: https://expressinteriors.com/wp-login.php
[Fri Mar 20 23:02:24.343811 2026] [:error] [pid 38219:tid 38236] [client 192.185.4.29:19212] [client 192.185.4.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.4.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1hgHLdNs2F_zXG7H8QPAAAAYY"]
[Fri Mar 20 23:02:25.246037 2026] [:error] [pid 38219:tid 38243] [client 192.185.4.29:19212] [client 192.185.4.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.4.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1hgXLdNs2F_zXG7H8QPQAAAY0"], referer: https://expressinteriors.com/wp-login.php
[Fri Mar 20 23:13:20.450038 2026] [:error] [pid 49080:tid 49104] [client 173.239.240.81:44403] [client 173.239.240.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1kEIk5CHi4V0A3ttgujgAAAFI"]
[Fri Mar 20 23:19:02.786026 2026] [:error] [pid 27302:tid 27310] [client 173.239.218.147:45641] [client 173.239.218.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1lZrDKiUve17xv6yGLhgAAAMY"]
[Fri Mar 20 23:43:35.044079 2026] [:error] [pid 49082:tid 49162] [client 173.239.240.62:23089] [client 173.239.240.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1rJ6pllYJI1LUIdL8PZAAAAVQ"]
[Fri Mar 20 23:44:53.609959 2026] [:error] [pid 38219:tid 38235] [client 50.87.144.73:19006] [client 50.87.144.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1rdXLdNs2F_zXG7H8USwAAAYU"]
[Fri Mar 20 23:44:54.620936 2026] [:error] [pid 38219:tid 38237] [client 50.87.144.73:19006] [client 50.87.144.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab1rdnLdNs2F_zXG7H8UTAAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Fri Mar 20 23:45:55.943757 2026] [:error] [pid 38378:tid 38393] [client 121.229.185.160:33340] [client 121.229.185.160] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ab1rs1Kb3npPsu9Iib2WZwAAAgs"]
[Sat Mar 21 00:29:51.996447 2026] [:error] [pid 62480:tid 62558] [client 173.239.240.81:39297] [client 173.239.240.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab11_7q1lu6xCJtkVarUgQAAAVQ"]
[Sat Mar 21 00:45:35.368819 2026] [:error] [pid 62754:tid 62819] [client 173.239.240.68:65293] [client 173.239.240.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab15rxwXN_jHGJ5L7yFIAgAAAAQ"]
[Sat Mar 21 00:53:42.761000 2026] [:error] [pid 62479:tid 62533] [client 50.6.138.86:52716] [client 50.6.138.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.138.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab17lvKZ7MVNG8qirU9SWAAAARY"]
[Sat Mar 21 00:53:43.890525 2026] [:error] [pid 62479:tid 62529] [client 50.6.138.86:52716] [client 50.6.138.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.138.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab17l_KZ7MVNG8qirU9SXAAAARI"], referer: https://expressinteriors.com/wp-login.php
[Sat Mar 21 01:00:42.875421 2026] [:error] [pid 62754:tid 62838] [client 173.239.240.88:47715] [client 173.239.240.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.88, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab19OhwXN_jHGJ5L7yFRngAAABc"]
[Sat Mar 21 01:30:52.509841 2026] [:error] [pid 62754:tid 62824] [client 173.239.240.72:39319] [client 173.239.240.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab2ETBwXN_jHGJ5L7yFk1AAAAAk"]
[Sat Mar 21 01:41:36.187022 2026] [:error] [pid 62476:tid 62488] [client 43.130.60.195:33300] [client 43.130.60.195] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ab2G0GBL9BQ4RM1FKIB71wAAAEU"]
[Sat Mar 21 01:50:43.935616 2026] [:error] [pid 62479:tid 62532] [client 43.157.187.11:60439] [client 43.157.187.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ab2I8_KZ7MVNG8qirU9mJQAAARU"]
[Sat Mar 21 01:50:44.642164 2026] [:error] [pid 62754:tid 62831] [client 43.157.187.11:56371] [client 43.157.187.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "ab2I9BwXN_jHGJ5L7yFxtwAAABA"]
[Sat Mar 21 01:50:45.347947 2026] [:error] [pid 62480:tid 62551] [client 43.157.187.11:50115] [client 43.157.187.11] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/media/system/js/core.js"] [unique_id "ab2I9bq1lu6xCJtkVar4agAAAU0"]
[Sat Mar 21 01:57:09.239153 2026] [:error] [pid 62754:tid 62838] [client 162.241.226.175:60858] [client 162.241.226.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.226.175, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab2KdRwXN_jHGJ5L7yF2DwAAABc"]
[Sat Mar 21 01:57:10.390153 2026] [:error] [pid 62754:tid 62816] [client 162.241.226.175:60858] [client 162.241.226.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.226.175, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab2KdhwXN_jHGJ5L7yF2GAAAAAE"], referer: https://expressinteriors.com/wp-login.php
[Sat Mar 21 04:56:53.824977 2026] [:error] [pid 1601:tid 1607] [client 216.73.216.164:31916] [client 216.73.216.164] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "103.101.196.236_43b5b1ee44e335b8106dce5bd11d0f39ab11406b"): Internal error (specific information not available) [hostname "expressinteriors.com"] [uri "/index.php"] [unique_id "ab20kqdDBYVcyITq-IEn5gAAAMI"], referer: https://expressinteriors.com/sitemap.xml
[Sat Mar 21 06:08:11.685013 2026] [:error] [pid 1601:tid 1629] [client 186.216.176.93:51737] [client 186.216.176.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.216.176.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab3FS6dDBYVcyITq-IFBMwAAANg"]
[Sat Mar 21 06:14:37.619797 2026] [:error] [pid 1491:tid 1569] [client 186.216.176.93:50729] [client 186.216.176.93] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ab3Gza3VfHftzE9w9t7A2QAAAIY"]
[Sat Mar 21 06:16:06.758547 2026] [:error] [pid 1490:tid 1536] [client 186.216.176.93:50313] [client 186.216.176.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.216.176.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab3HJmSWhIPTatyxDeCA-AAAAEM"]
[Sat Mar 21 06:17:50.395781 2026] [:error] [pid 1601:tid 1613] [client 186.216.176.93:50649] [client 186.216.176.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.216.176.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab3HjqdDBYVcyITq-IFFAgAAAMg"]
[Sat Mar 21 06:19:35.601335 2026] [:error] [pid 49170:tid 49178] [client 186.216.176.93:51749] [client 186.216.176.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.216.176.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab3H971KUC-QISS0eWogqwAAAQY"]
[Sat Mar 21 06:21:17.979339 2026] [:error] [pid 1489:tid 1504] [client 186.216.176.93:50340] [client 186.216.176.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.216.176.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab3IXVRvnvBO_DG9kxsCQwAAAAE"]
[Sat Mar 21 11:00:40.686269 2026] [:error] [pid 43052:tid 43059] [client 43.153.27.244:43738] [client 43.153.27.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ab4J2F5fjm-AiInC1hIcTQAAA4U"]
[Sat Mar 21 11:28:44.362668 2026] [:error] [pid 43052:tid 43058] [client 172.252.162.110:50444] [client 172.252.162.110] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=video/webm"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ab4QbF5fjm-AiInC1hIpfAAAA4Q"]
[Sat Mar 21 11:59:39.759734 2026] [:error] [pid 49170:tid 49190] [client 204.12.215.52:42459] [client 204.12.215.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 204.12.215.52, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab4Xq71KUC-QISS0eWps6wAAARI"], referer: http://www.google.com.hk
[Sat Mar 21 12:01:19.915450 2026] [:error] [pid 33584:tid 33604] [client 204.12.215.52:12763] [client 204.12.215.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 204.12.215.52, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab4YD-ATEQBBo5z2HklVOQAAAdI"], referer: http://www.google.com.hk
[Sat Mar 21 15:04:34.029416 2026] [:error] [pid 43052:tid 43055] [client 183.83.234.142:35283] [client 183.83.234.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.83.234.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab5DAl5fjm-AiInC1hKR-wAAA4E"]
[Sat Mar 21 16:02:41.949487 2026] [:error] [pid 49170:tid 49184] [client 183.83.234.142:34142] [client 183.83.234.142] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ab5Qob1KUC-QISS0eWqTZQAAAQw"]
[Sat Mar 21 16:04:18.801788 2026] [:error] [pid 43052:tid 43054] [client 183.83.234.142:33560] [client 183.83.234.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.83.234.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab5RAl5fjm-AiInC1hKujQAAA4A"]
[Sat Mar 21 16:05:44.534846 2026] [:error] [pid 43052:tid 43061] [client 183.83.234.142:35284] [client 183.83.234.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.83.234.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab5RWF5fjm-AiInC1hKvMAAAA4c"]
[Sat Mar 21 16:07:13.263251 2026] [:error] [pid 42886:tid 42890] [client 183.83.234.142:34540] [client 183.83.234.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.83.234.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab5RsV452dC6nbNWav1HmgAAAwI"]
[Sat Mar 21 16:08:35.695152 2026] [:error] [pid 1489:tid 1526] [client 183.83.234.142:35034] [client 183.83.234.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.83.234.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab5SA1RvnvBO_DG9kxu4FwAAABY"]
[Sat Mar 21 16:09:55.471743 2026] [:error] [pid 43052:tid 43058] [client 183.83.234.142:34624] [client 183.83.234.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.83.234.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab5SU15fjm-AiInC1hKxZAAAA4Q"]
[Sat Mar 21 16:51:17.016827 2026] [:error] [pid 43052:tid 43075] [client 43.153.47.201:43082] [client 43.153.47.201] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ab5cBV5fjm-AiInC1hLHvwAAA5U"]
[Sat Mar 21 20:32:51.959669 2026] [:error] [pid 33348:tid 33362] [client 182.42.110.255:51136] [client 182.42.110.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ab6P8zEj9d9zzbs_KjgJcgAAAUs"]
[Sat Mar 21 20:59:49.990562 2026] [:error] [pid 42886:tid 42897] [client 54.169.201.79:64525] [client 54.169.201.79] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ab6WRV452dC6nbNWav18OAAAAwk"]
[Sat Mar 21 20:59:50.163816 2026] [:error] [pid 1489:tid 1525] [client 54.169.201.79:49839] [client 54.169.201.79] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "ab6WRlRvnvBO_DG9kxsOtQAAABU"]
[Sat Mar 21 20:59:50.337049 2026] [:error] [pid 49170:tid 49187] [client 54.169.201.79:63051] [client 54.169.201.79] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/media/system/js/core.js"] [unique_id "ab6WRr1KUC-QISS0eWoB-AAAAQ8"]
[Sat Mar 21 21:04:19.244314 2026] [:error] [pid 49170:tid 49191] [client 45.242.153.109:27883] [client 45.242.153.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.242.153.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab6XU71KUC-QISS0eWoD_gAAARM"]
[Sat Mar 21 21:12:16.226828 2026] [:error] [pid 49170:tid 49191] [client 91.79.194.200:6173] [client 91.79.194.200] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=image/gif"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ab6ZML1KUC-QISS0eWoJUwAAARM"]
[Sat Mar 21 21:41:23.954588 2026] [:error] [pid 33584:tid 33587] [client 170.106.148.137:35412] [client 170.106.148.137] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ab6gA-ATEQBBo5z2HkmjYgAAAcE"]
[Sat Mar 21 22:28:13.090578 2026] [:error] [pid 1491:tid 1578] [client 45.242.153.109:34294] [client 45.242.153.109] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ab6q_a3VfHftzE9w9t5k4QAAAI8"]
[Sat Mar 21 22:29:44.388784 2026] [:error] [pid 49170:tid 49173] [client 45.242.153.109:35785] [client 45.242.153.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.242.153.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab6rWL1KUC-QISS0eWop5QAAAQE"]
[Sat Mar 21 22:31:10.001846 2026] [:error] [pid 33456:tid 33464] [client 45.242.153.109:36977] [client 45.242.153.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.242.153.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab6rrg-0Ziq_OzjHFfU6GgAAAYY"]
[Sat Mar 21 22:32:26.766967 2026] [:error] [pid 49170:tid 49172] [client 45.242.153.109:37397] [client 45.242.153.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.242.153.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab6r-r1KUC-QISS0eWoqoAAAAQA"]
[Sat Mar 21 22:33:49.993224 2026] [:error] [pid 1490:tid 1550] [client 45.242.153.109:37610] [client 45.242.153.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.242.153.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab6sTWSWhIPTatyxDeBwiAAAAE8"]
[Sat Mar 21 22:35:13.400804 2026] [:error] [pid 1491:tid 1573] [client 45.242.153.109:37928] [client 45.242.153.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.242.153.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab6soa3VfHftzE9w9t5ljgAAAIo"]
[Sat Mar 21 22:57:10.607346 2026] [:error] [pid 42886:tid 42892] [client 192.254.250.166:30470] [client 192.254.250.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.254.250.166, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab6xxl452dC6nbNWav2N1wAAAwQ"]
[Sat Mar 21 22:57:11.627769 2026] [:error] [pid 42886:tid 42907] [client 192.254.250.166:30470] [client 192.254.250.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.254.250.166, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab6xx1452dC6nbNWav2N2QAAAxM"], referer: https://expressinteriors.com/wp-login.php
[Sat Mar 21 23:01:59.028443 2026] [:error] [pid 1491:tid 1586] [client 161.97.77.0:48350] [client 161.97.77.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.97.77.0, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab6y563VfHftzE9w9t5oeQAAAJY"]
[Sat Mar 21 23:01:59.968884 2026] [:error] [pid 1491:tid 1563] [client 161.97.77.0:48350] [client 161.97.77.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.97.77.0, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab6y563VfHftzE9w9t5oewAAAIA"], referer: https://expressinteriors.com/wp-login.php
[Sat Mar 21 23:36:44.979072 2026] [:error] [pid 33584:tid 33600] [client 43.157.156.190:49594] [client 43.157.156.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ab67DOATEQBBo5z2HkmxYwAAAc4"]
[Sat Mar 21 23:39:37.513338 2026] [:error] [pid 43052:tid 43057] [client 82.165.85.79:49942] [client 82.165.85.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.165.85.79, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab67uV5fjm-AiInC1hJc2QAAA4M"]
[Sat Mar 21 23:39:38.397053 2026] [:error] [pid 43052:tid 43063] [client 82.165.85.79:49942] [client 82.165.85.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.165.85.79, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab67ul5fjm-AiInC1hJc2wAAA4k"], referer: https://expressinteriors.com/wp-login.php
[Sat Mar 21 23:40:17.838618 2026] [:error] [pid 33348:tid 33369] [client 108.179.192.230:48752] [client 108.179.192.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.179.192.230, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab674TEj9d9zzbs_KjgUagAAAVI"]
[Sat Mar 21 23:40:20.776748 2026] [:error] [pid 43052:tid 43066] [client 108.179.192.230:26602] [client 108.179.192.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.179.192.230, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab675F5fjm-AiInC1hJdIQAAA4w"], referer: https://expressinteriors.com/wp-login.php
[Sat Mar 21 23:41:01.845820 2026] [:error] [pid 49170:tid 49193] [client 50.6.229.148:55416] [client 50.6.229.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.229.148, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab68Db1KUC-QISS0eWpGvwAAARU"]
[Sat Mar 21 23:41:02.744638 2026] [:error] [pid 49170:tid 49175] [client 50.6.229.148:55416] [client 50.6.229.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.229.148, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab68Dr1KUC-QISS0eWpGwQAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Sat Mar 21 23:43:08.063142 2026] [:error] [pid 1491:tid 1576] [client 51.38.30.221:59876] [client 51.38.30.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.38.30.221, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab68jK3VfHftzE9w9t5svwAAAI0"]
[Sat Mar 21 23:43:08.952676 2026] [:error] [pid 1491:tid 1586] [client 51.38.30.221:59876] [client 51.38.30.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.38.30.221, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab68jK3VfHftzE9w9t5sxAAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Sat Mar 21 23:50:30.452582 2026] [:error] [pid 43052:tid 43063] [client 162.241.2.143:40858] [client 162.241.2.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.2.143, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab6-Rl5fjm-AiInC1hJf9AAAA4k"]
[Sat Mar 21 23:50:31.596919 2026] [:error] [pid 43052:tid 43065] [client 162.241.2.143:40858] [client 162.241.2.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.2.143, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab6-R15fjm-AiInC1hJf9gAAA4s"], referer: https://expressinteriors.com/wp-login.php
[Sat Mar 21 23:53:09.371914 2026] [:error] [pid 1490:tid 1549] [client 185.59.44.60:59138] [client 185.59.44.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.59.44.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab6-5WSWhIPTatyxDeCAFAAAAE4"]
[Sat Mar 21 23:53:10.340414 2026] [:error] [pid 1490:tid 1543] [client 185.59.44.60:59138] [client 185.59.44.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.59.44.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab6-5mSWhIPTatyxDeCAFQAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Sat Mar 21 23:53:53.581603 2026] [:error] [pid 49170:tid 49187] [client 192.254.250.159:26344] [client 192.254.250.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.254.250.159, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab6_Eb1KUC-QISS0eWpLXwAAAQ8"]
[Sat Mar 21 23:53:54.567521 2026] [:error] [pid 49170:tid 49194] [client 192.254.250.159:26344] [client 192.254.250.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.254.250.159, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab6_Er1KUC-QISS0eWpLYAAAARY"], referer: https://expressinteriors.com/wp-login.php
[Sat Mar 21 23:57:30.780038 2026] [:error] [pid 1489:tid 1513] [client 124.104.171.226:56785] [client 124.104.171.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.104.171.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab6_6lRvnvBO_DG9kxs5BwAAAAk"]
[Sun Mar 22 00:01:23.258142 2026] [:error] [pid 1489:tid 1505] [client 162.241.63.6:48866] [client 162.241.63.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.63.6, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7A01RvnvBO_DG9kxs56gAAAAI"]
[Sun Mar 22 00:01:24.445196 2026] [:error] [pid 1489:tid 1514] [client 162.241.63.6:48866] [client 162.241.63.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.63.6, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7A1FRvnvBO_DG9kxs57AAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 00:05:55.736806 2026] [:error] [pid 49170:tid 49194] [client 65.254.225.219:52824] [client 65.254.225.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.219, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7B471KUC-QISS0eWpPUQAAARY"]
[Sun Mar 22 00:05:56.662082 2026] [:error] [pid 49170:tid 49191] [client 65.254.225.219:52824] [client 65.254.225.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.219, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7B5L1KUC-QISS0eWpPUwAAARM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 00:19:43.155011 2026] [:error] [pid 1489:tid 1506] [client 95.111.236.64:52742] [client 95.111.236.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.111.236.64, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7FH1RvnvBO_DG9kxs-YQAAAAM"]
[Sun Mar 22 00:19:44.085428 2026] [:error] [pid 1489:tid 1514] [client 95.111.236.64:52742] [client 95.111.236.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.111.236.64, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7FIFRvnvBO_DG9kxs-ZQAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 00:25:30.009862 2026] [:error] [pid 40780:tid 40958] [client 103.28.36.205:44050] [client 103.28.36.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7GeiZDsmYIjKpJe4Mz4AAAAAs"]
[Sun Mar 22 00:25:31.119922 2026] [:error] [pid 40780:tid 40971] [client 103.28.36.205:44050] [client 103.28.36.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7GeyZDsmYIjKpJe4Mz6wAAABc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 00:30:31.829529 2026] [:error] [pid 40782:tid 41050] [client 50.116.87.45:28406] [client 50.116.87.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.116.87.45, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7Hp-aE0aGWZHNA90tpSAAAAJE"]
[Sun Mar 22 00:30:33.834878 2026] [:error] [pid 40782:tid 41035] [client 50.116.87.45:28406] [client 50.116.87.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.116.87.45, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7HqeaE0aGWZHNA90tpTgAAAII"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 00:33:01.705090 2026] [:error] [pid 41061:tid 41070] [client 50.87.144.66:20602] [client 50.87.144.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.66, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7IPaksT6woy-Od6iGeNAAAAMY"]
[Sun Mar 22 00:33:02.747281 2026] [:error] [pid 41061:tid 41083] [client 50.87.144.66:20602] [client 50.87.144.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.66, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7IPqksT6woy-Od6iGeOAAAANM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 00:36:21.043419 2026] [:error] [pid 41061:tid 41072] [client 192.254.250.159:57648] [client 192.254.250.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.254.250.159, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7JBaksT6woy-Od6iGgpQAAAMg"]
[Sun Mar 22 00:36:23.586142 2026] [:error] [pid 40781:tid 41018] [client 192.254.250.159:57664] [client 192.254.250.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.254.250.159, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7JBzJQuCgg1YvEGBLU6AAAAEw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 00:40:11.773309 2026] [:error] [pid 40780:tid 40949] [client 162.241.62.217:39164] [client 162.241.62.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.62.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7J6yZDsmYIjKpJe4M7CQAAAAI"]
[Sun Mar 22 00:40:14.588197 2026] [:error] [pid 40782:tid 41053] [client 162.241.62.217:39176] [client 162.241.62.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.62.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7J7uaE0aGWZHNA90tsjwAAAJQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 00:42:40.912360 2026] [:error] [pid 41061:tid 41088] [client 116.90.32.12:43740] [client 116.90.32.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.90.32.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7KgKksT6woy-Od6iGkiAAAANg"]
[Sun Mar 22 00:42:43.124133 2026] [:error] [pid 40782:tid 41055] [client 116.90.32.12:30904] [client 116.90.32.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.90.32.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7Kg-aE0aGWZHNA90ttUAAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 00:44:02.455261 2026] [:error] [pid 41061:tid 41064] [client 50.87.144.147:12564] [client 50.87.144.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7K0qksT6woy-Od6iGlTwAAAMA"]
[Sun Mar 22 00:44:03.921785 2026] [:error] [pid 41061:tid 41075] [client 50.87.144.147:12564] [client 50.87.144.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7K06ksT6woy-Od6iGlWQAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 00:44:32.549853 2026] [:error] [pid 41061:tid 41087] [client 116.90.36.17:17822] [client 116.90.36.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.90.36.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7K8KksT6woy-Od6iGlrQAAANc"]
[Sun Mar 22 00:44:33.554934 2026] [:error] [pid 41061:tid 41083] [client 116.90.36.17:17822] [client 116.90.36.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.90.36.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7K8aksT6woy-Od6iGlswAAANM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 00:47:59.473627 2026] [:error] [pid 41061:tid 41068] [client 162.241.244.10:38900] [client 162.241.244.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.244.10, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7Lv6ksT6woy-Od6iGohQAAAMQ"]
[Sun Mar 22 00:48:00.446282 2026] [:error] [pid 41061:tid 41082] [client 162.241.244.10:38900] [client 162.241.244.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.244.10, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7LwKksT6woy-Od6iGoiwAAANI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 00:56:12.375879 2026] [:error] [pid 40780:tid 40963] [client 192.185.4.68:56538] [client 192.185.4.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.4.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7NrCZDsmYIjKpJe4NByQAAAA8"]
[Sun Mar 22 00:56:13.271192 2026] [:error] [pid 40780:tid 40949] [client 192.185.4.68:56538] [client 192.185.4.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.4.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7NrSZDsmYIjKpJe4NBygAAAAI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 01:04:29.019375 2026] [:error] [pid 41061:tid 41064] [client 108.179.194.70:12162] [client 108.179.194.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.179.194.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7PnaksT6woy-Od6iGzhQAAAMA"]
[Sun Mar 22 01:04:30.148011 2026] [:error] [pid 41061:tid 41085] [client 108.179.194.70:12162] [client 108.179.194.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.179.194.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7PnqksT6woy-Od6iGzjgAAANU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 01:04:55.289021 2026] [:error] [pid 40780:tid 40970] [client 103.90.232.170:45066] [client 103.90.232.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.90.232.170, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7PtyZDsmYIjKpJe4NGKwAAABY"]
[Sun Mar 22 01:04:56.561897 2026] [:error] [pid 40780:tid 40967] [client 103.90.232.170:45066] [client 103.90.232.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.90.232.170, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7PuCZDsmYIjKpJe4NGLgAAABM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 01:20:13.834020 2026] [:error] [pid 40781:tid 41010] [client 198.57.247.155:29674] [client 198.57.247.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.57.247.155, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7TTTJQuCgg1YvEGBLhFAAAAEQ"]
[Sun Mar 22 01:20:15.163003 2026] [:error] [pid 40781:tid 41019] [client 198.57.247.155:29674] [client 198.57.247.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.57.247.155, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7TTzJQuCgg1YvEGBLhFQAAAE0"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 01:23:26.233428 2026] [:error] [pid 40780:tid 40947] [client 173.254.28.240:28068] [client 173.254.28.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.254.28.240, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7UDiZDsmYIjKpJe4NOVQAAAAA"]
[Sun Mar 22 01:23:27.160939 2026] [:error] [pid 40780:tid 40950] [client 173.254.28.240:28068] [client 173.254.28.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.254.28.240, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7UDyZDsmYIjKpJe4NOWQAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 01:29:33.954948 2026] [:error] [pid 41061:tid 41066] [client 50.87.144.153:49366] [client 50.87.144.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.153, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7VfaksT6woy-Od6iHEsQAAAMI"]
[Sun Mar 22 01:29:35.057093 2026] [:error] [pid 41061:tid 41064] [client 50.87.144.153:49366] [client 50.87.144.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.153, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7Vf6ksT6woy-Od6iHEuQAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 01:34:16.789143 2026] [:error] [pid 40781:tid 41021] [client 116.90.36.50:18120] [client 116.90.36.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.90.36.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7WmDJQuCgg1YvEGBLlBQAAAE8"]
[Sun Mar 22 01:34:37.729017 2026] [:error] [pid 40782:tid 41049] [client 116.90.36.50:47388] [client 116.90.36.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.90.36.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7WreaE0aGWZHNA90t-1gAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 01:38:55.574435 2026] [:error] [pid 41061:tid 41069] [client 162.241.2.62:41568] [client 162.241.2.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.2.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7Xr6ksT6woy-Od6iHMAwAAAMU"]
[Sun Mar 22 01:39:07.385832 2026] [:error] [pid 40780:tid 40969] [client 162.241.2.62:40482] [client 162.241.2.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.2.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7XuyZDsmYIjKpJe4NVrwAAABU"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 01:40:10.217320 2026] [:error] [pid 41061:tid 41083] [client 162.241.60.16:38442] [client 162.241.60.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.60.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7X-qksT6woy-Od6iHM_wAAANM"]
[Sun Mar 22 01:40:11.445032 2026] [:error] [pid 41061:tid 41080] [client 162.241.60.16:38442] [client 162.241.60.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.60.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7X-6ksT6woy-Od6iHNBgAAANA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 01:48:50.241669 2026] [:error] [pid 40781:tid 41011] [client 162.241.62.217:39898] [client 162.241.62.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.62.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7aAjJQuCgg1YvEGBLo-QAAAEU"]
[Sun Mar 22 01:48:52.999453 2026] [:error] [pid 40780:tid 40964] [client 162.241.62.217:20088] [client 162.241.62.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.62.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7aBCZDsmYIjKpJe4NagwAAABA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 01:50:08.229901 2026] [:error] [pid 41061:tid 41083] [client 69.49.241.21:44982] [client 69.49.241.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.241.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7aUKksT6woy-Od6iHWOQAAANM"]
[Sun Mar 22 01:50:09.373497 2026] [:error] [pid 41061:tid 41064] [client 69.49.241.21:44982] [client 69.49.241.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.241.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7aUaksT6woy-Od6iHWPwAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 01:55:37.285561 2026] [:error] [pid 40782:tid 41045] [client 50.87.144.153:44102] [client 50.87.144.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.153, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7bmeaE0aGWZHNA90uGtgAAAIw"]
[Sun Mar 22 01:55:38.299627 2026] [:error] [pid 40782:tid 41033] [client 50.87.144.153:44102] [client 50.87.144.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.153, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7bmuaE0aGWZHNA90uGvQAAAIA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 01:56:23.969051 2026] [:error] [pid 40781:tid 41011] [client 50.87.144.174:13582] [client 50.87.144.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.174, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7bxzJQuCgg1YvEGBLq9gAAAEU"]
[Sun Mar 22 01:56:25.113806 2026] [:error] [pid 40781:tid 41017] [client 50.87.144.174:13582] [client 50.87.144.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.174, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7byTJQuCgg1YvEGBLq-gAAAEs"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 01:57:06.896695 2026] [:error] [pid 41061:tid 41082] [client 162.241.49.35:39288] [client 162.241.49.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.49.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7b8qksT6woy-Od6iHa1QAAANI"]
[Sun Mar 22 01:57:07.816883 2026] [:error] [pid 41061:tid 41068] [client 162.241.49.35:39288] [client 162.241.49.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.49.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7b86ksT6woy-Od6iHa1gAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 02:00:03.695419 2026] [:error] [pid 40782:tid 41034] [client 108.179.192.20:37444] [client 108.179.192.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.179.192.20, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7co-aE0aGWZHNA90uIkQAAAIE"]
[Sun Mar 22 02:00:04.885063 2026] [:error] [pid 40782:tid 41037] [client 108.179.192.20:37444] [client 108.179.192.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.179.192.20, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7cpOaE0aGWZHNA90uImQAAAIQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 02:00:52.484530 2026] [:error] [pid 41061:tid 41079] [client 50.116.87.240:15482] [client 50.116.87.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.116.87.240, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7c1KksT6woy-Od6iHdbAAAAM8"]
[Sun Mar 22 02:00:53.880424 2026] [:error] [pid 41061:tid 41078] [client 50.116.87.240:15482] [client 50.116.87.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.116.87.240, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7c1aksT6woy-Od6iHdcgAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 02:08:22.440884 2026] [:error] [pid 41061:tid 41087] [client 51.222.158.107:46126] [client 51.222.158.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.222.158.107, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7elqksT6woy-Od6iHikQAAANc"]
[Sun Mar 22 02:08:23.464163 2026] [:error] [pid 41061:tid 41072] [client 51.222.158.107:46126] [client 51.222.158.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.222.158.107, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7el6ksT6woy-Od6iHilAAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 02:10:11.857406 2026] [:error] [pid 40782:tid 41039] [client 116.90.32.79:48494] [client 116.90.32.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.90.32.79, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7fA-aE0aGWZHNA90uMEQAAAIY"]
[Sun Mar 22 02:10:14.698504 2026] [:error] [pid 40782:tid 41036] [client 116.90.32.79:48510] [client 116.90.32.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.90.32.79, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7fBuaE0aGWZHNA90uMFwAAAIM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 02:14:05.366553 2026] [:error] [pid 40780:tid 40972] [client 162.241.62.112:22964] [client 162.241.62.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.62.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7f7SZDsmYIjKpJe4NnTwAAABg"]
[Sun Mar 22 02:14:08.167199 2026] [:error] [pid 41061:tid 41076] [client 162.241.62.112:24010] [client 162.241.62.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.62.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7f8KksT6woy-Od6iHmYQAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 02:14:43.073480 2026] [:error] [pid 41061:tid 41077] [client 198.57.247.176:44278] [client 198.57.247.176] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.57.247.176, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7gE6ksT6woy-Od6iHmswAAAM0"]
[Sun Mar 22 02:14:45.148594 2026] [:error] [pid 40780:tid 40965] [client 198.57.247.176:44292] [client 198.57.247.176] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.57.247.176, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7gFSZDsmYIjKpJe4NnkQAAABE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 02:16:33.133182 2026] [autoindex:error] [pid 41061:tid 41081] [client 52.138.39.105:52969] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 22 02:16:33.345774 2026] [autoindex:error] [pid 41061:tid 41078] [client 52.138.39.105:52969] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 22 02:16:33.562517 2026] [autoindex:error] [pid 41061:tid 41084] [client 52.138.39.105:52969] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 22 02:16:34.526793 2026] [autoindex:error] [pid 41061:tid 41064] [client 52.138.39.105:52969] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 22 02:16:37.048000 2026] [:error] [pid 41061:tid 41087] [client 52.138.39.105:52969] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/autoload_classmap.php"] [unique_id "ab7ghaksT6woy-Od6iHoYAAAANc"]
[Sun Mar 22 02:16:37.910856 2026] [:error] [pid 40780:tid 40958] [client 52.138.39.105:20538] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/autoload_classmap.php"] [unique_id "ab7ghSZDsmYIjKpJe4NolwAAAAs"]
[Sun Mar 22 02:16:38.735906 2026] [:error] [pid 40782:tid 41043] [client 52.138.39.105:49781] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/autoload_classmap.php"] [unique_id "ab7ghuaE0aGWZHNA90uN9AAAAIo"]
[Sun Mar 22 02:16:39.576575 2026] [:error] [pid 40781:tid 41006] [client 52.138.39.105:22824] [client 52.138.39.105] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/autoload_classmap.php"] [unique_id "ab7ghzJQuCgg1YvEGBLxHAAAAEA"]
[Sun Mar 22 02:22:05.990964 2026] [:error] [pid 40780:tid 40955] [client 162.241.61.45:54742] [client 162.241.61.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.61.45, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7hzSZDsmYIjKpJe4Nq8QAAAAg"]
[Sun Mar 22 02:22:07.544791 2026] [:error] [pid 40780:tid 40963] [client 162.241.61.45:54742] [client 162.241.61.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.61.45, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7hzyZDsmYIjKpJe4Nq8wAAAA8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 02:32:45.746205 2026] [:error] [pid 23666:tid 23675] [client 198.57.247.143:10590] [client 198.57.247.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.57.247.143, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7kTcMCSeYGBmLsLigaPAAAAQc"]
[Sun Mar 22 02:32:46.764006 2026] [:error] [pid 23666:tid 23688] [client 198.57.247.143:10590] [client 198.57.247.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.57.247.143, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7kTsMCSeYGBmLsLigaQQAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 02:41:48.363891 2026] [:error] [pid 41061:tid 41075] [client 198.57.247.180:41484] [client 198.57.247.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.57.247.180, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7mbKksT6woy-Od6iHzyQAAAMs"]
[Sun Mar 22 02:41:49.314175 2026] [:error] [pid 41061:tid 41064] [client 198.57.247.180:41484] [client 198.57.247.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.57.247.180, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7mbaksT6woy-Od6iHzzQAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 02:56:37.189254 2026] [:error] [pid 40780:tid 40953] [client 162.241.252.38:12538] [client 162.241.252.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.252.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7p5SZDsmYIjKpJe4N1WQAAAAY"]
[Sun Mar 22 02:56:39.188028 2026] [:error] [pid 23666:tid 23676] [client 162.241.252.38:12550] [client 162.241.252.38] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.252.38, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7p58MCSeYGBmLsLigp7gAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 02:57:14.355326 2026] [:error] [pid 40781:tid 41011] [client 50.87.144.31:22280] [client 50.87.144.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7qCjJQuCgg1YvEGBL5YAAAAEU"]
[Sun Mar 22 02:57:15.450912 2026] [:error] [pid 40781:tid 41021] [client 50.87.144.31:22280] [client 50.87.144.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7qCzJQuCgg1YvEGBL5YQAAAE8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 02:59:46.700763 2026] [:error] [pid 40782:tid 41046] [client 50.87.144.31:16384] [client 50.87.144.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7qouaE0aGWZHNA90uY4QAAAI0"]
[Sun Mar 22 02:59:47.725615 2026] [:error] [pid 40782:tid 41041] [client 50.87.144.31:16384] [client 50.87.144.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7qo-aE0aGWZHNA90uY4gAAAIg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 03:01:35.613392 2026] [:error] [pid 40780:tid 40954] [client 192.185.131.30:13998] [client 192.185.131.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.131.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7rDyZDsmYIjKpJe4N3MAAAAAc"]
[Sun Mar 22 03:01:36.583227 2026] [:error] [pid 40780:tid 40949] [client 192.185.131.30:13998] [client 192.185.131.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.131.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7rECZDsmYIjKpJe4N3MgAAAAI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 03:04:01.038275 2026] [:error] [pid 41061:tid 41080] [client 162.241.49.35:39582] [client 162.241.49.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.49.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7roaksT6woy-Od6iH-OwAAANA"]
[Sun Mar 22 03:04:02.002751 2026] [:error] [pid 41061:tid 41082] [client 162.241.49.35:39582] [client 162.241.49.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.49.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7roqksT6woy-Od6iH-QQAAANI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 03:20:32.566919 2026] [:error] [pid 23666:tid 23674] [client 43.157.52.37:33178] [client 43.157.52.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ab7vgMMCSeYGBmLsLig4XAAAAQY"]
[Sun Mar 22 03:21:03.724478 2026] [:error] [pid 40782:tid 41053] [client 117.4.245.202:41758] [client 117.4.245.202] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 117.4.245.202, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7vn-aE0aGWZHNA90ud6QAAAJQ"]
[Sun Mar 22 03:21:05.017057 2026] [:error] [pid 40782:tid 41043] [client 117.4.245.202:41758] [client 117.4.245.202] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 117.4.245.202, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7voeaE0aGWZHNA90ud6gAAAIo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 03:23:08.037594 2026] [:error] [pid 41445:tid 41505] [client 117.4.245.202:50568] [client 117.4.245.202] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 117.4.245.202, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7wHAx9CwOvIkc8h9A0uwAAAIQ"]
[Sun Mar 22 03:23:09.057566 2026] [:error] [pid 41445:tid 41516] [client 117.4.245.202:50568] [client 117.4.245.202] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 117.4.245.202, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7wHQx9CwOvIkc8h9A0vgAAAI8"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 03:24:14.998123 2026] [:error] [pid 42281:tid 42344] [client 65.254.225.211:48764] [client 65.254.225.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7wXiwMFkuizqXnmYl6WAAAAIU"]
[Sun Mar 22 03:24:15.963724 2026] [:error] [pid 42281:tid 42346] [client 65.254.225.211:48764] [client 65.254.225.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7wXywMFkuizqXnmYl6WQAAAIc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 03:27:19.645494 2026] [:error] [pid 42366:tid 42384] [client 5.250.185.149:46948] [client 5.250.185.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.250.185.149, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7xF7mSlwatcbU_6e4zRgAAANA"]
[Sun Mar 22 03:27:20.620502 2026] [:error] [pid 42366:tid 42390] [client 5.250.185.149:46948] [client 5.250.185.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.250.185.149, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7xGLmSlwatcbU_6e4zTAAAANY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 03:28:32.308249 2026] [:error] [pid 42366:tid 42376] [client 162.241.218.238:58638] [client 162.241.218.238] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.218.238, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7xYLmSlwatcbU_6e40RQAAAMg"]
[Sun Mar 22 03:28:35.289801 2026] [:error] [pid 42279:tid 42296] [client 162.241.218.238:36996] [client 162.241.218.238] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.218.238, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7xY9mMqXTQITfYBxx4eAAAAAw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 03:37:35.683164 2026] [:error] [pid 42366:tid 42390] [client 108.179.252.185:31654] [client 108.179.252.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.179.252.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7zf7mSlwatcbU_6e45mQAAANY"]
[Sun Mar 22 03:37:36.729999 2026] [:error] [pid 42366:tid 42378] [client 108.179.252.185:31654] [client 108.179.252.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.179.252.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7zgLmSlwatcbU_6e45ngAAAMo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 03:38:49.953735 2026] [:error] [pid 42366:tid 42378] [client 162.241.60.43:27500] [client 162.241.60.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.60.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7zybmSlwatcbU_6e46VQAAAMo"]
[Sun Mar 22 03:38:51.261370 2026] [:error] [pid 42366:tid 42391] [client 162.241.60.43:27500] [client 162.241.60.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.60.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7zy7mSlwatcbU_6e46XgAAANc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 03:44:27.772576 2026] [:error] [pid 20659:tid 20729] [client 77.55.252.113:39296] [client 77.55.252.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 77.55.252.113, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab71G6GS-ZHZxXPWRh8aswAAAIk"]
[Sun Mar 22 03:46:55.497967 2026] [:error] [pid 20657:tid 20669] [client 162.241.252.32:32088] [client 162.241.252.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.252.32, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab71r8iHgxawnpgy9SZqMAAAAAM"]
[Sun Mar 22 03:46:58.128600 2026] [:error] [pid 20657:tid 20673] [client 162.241.252.32:32102] [client 162.241.252.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.252.32, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab71ssiHgxawnpgy9SZqNwAAAAc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 03:51:30.374769 2026] [:error] [pid 51363:tid 51432] [client 103.28.36.220:34680] [client 103.28.36.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab72wlwa9x6OCTRkhl0Z2gAAAIQ"]
[Sun Mar 22 03:51:31.605339 2026] [:error] [pid 51363:tid 51452] [client 103.28.36.220:34680] [client 103.28.36.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab72w1wa9x6OCTRkhl0Z3AAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 04:02:50.288471 2026] [:error] [pid 51362:tid 51409] [client 148.113.25.132:60586] [client 148.113.25.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.113.25.132, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab75asOwPm3DXzTDjUeLLwAAAEg"]
[Sun Mar 22 04:02:51.486376 2026] [:error] [pid 51362:tid 51411] [client 148.113.25.132:60586] [client 148.113.25.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.113.25.132, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab75a8OwPm3DXzTDjUeLNAAAAEo"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 04:04:36.781190 2026] [:error] [pid 51468:tid 51481] [client 143.95.158.36:13330] [client 143.95.158.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.95.158.36, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab751E2TppSvA8W5CBRMlAAAAMU"]
[Sun Mar 22 04:04:37.749927 2026] [:error] [pid 51468:tid 51499] [client 143.95.158.36:13330] [client 143.95.158.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.95.158.36, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab751U2TppSvA8W5CBRMlgAAANc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 04:26:23.922994 2026] [:error] [pid 51468:tid 51491] [client 164.68.126.67:44962] [client 164.68.126.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 164.68.126.67, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7-702TppSvA8W5CBRbXwAAAM8"]
[Sun Mar 22 04:26:24.919333 2026] [:error] [pid 51468:tid 51485] [client 164.68.126.67:44962] [client 164.68.126.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 164.68.126.67, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab7-8E2TppSvA8W5CBRbZwAAAMk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 04:31:03.743042 2026] [:error] [pid 51468:tid 51486] [client 162.241.2.148:13860] [client 162.241.2.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.2.148, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8AB02TppSvA8W5CBRfYwAAAMo"]
[Sun Mar 22 04:31:04.921649 2026] [:error] [pid 51468:tid 51488] [client 162.241.2.148:13860] [client 162.241.2.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.2.148, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8ACE2TppSvA8W5CBRfZwAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 04:31:41.372026 2026] [:error] [pid 51363:tid 51446] [client 116.90.36.50:30898] [client 116.90.36.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.90.36.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8ALVwa9x6OCTRkhl0tPgAAAJA"]
[Sun Mar 22 04:31:42.611173 2026] [:error] [pid 51363:tid 51431] [client 116.90.36.50:30898] [client 116.90.36.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.90.36.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8ALlwa9x6OCTRkhl0tQAAAAIM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 04:34:39.511128 2026] [:error] [pid 51468:tid 51482] [client 108.179.192.230:23482] [client 108.179.192.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.179.192.230, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8A302TppSvA8W5CBRiygAAAMY"]
[Sun Mar 22 04:34:40.691024 2026] [:error] [pid 51468:tid 51493] [client 108.179.192.230:23482] [client 108.179.192.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.179.192.230, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8A4E2TppSvA8W5CBRi0QAAANE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 04:35:50.444422 2026] [:error] [pid 51468:tid 51491] [client 103.124.95.161:40126] [client 103.124.95.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.124.95.161, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8BJk2TppSvA8W5CBRj8wAAAM8"]
[Sun Mar 22 04:35:51.665854 2026] [:error] [pid 51468:tid 51493] [client 103.124.95.161:40126] [client 103.124.95.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.124.95.161, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8BJ02TppSvA8W5CBRj-gAAANE"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 04:37:00.567899 2026] [:error] [pid 51363:tid 51451] [client 165.22.61.123:42316] [client 165.22.61.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.61.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8BbFwa9x6OCTRkhl0wGAAAAJU"]
[Sun Mar 22 04:37:01.702126 2026] [:error] [pid 51363:tid 51453] [client 165.22.61.123:42316] [client 165.22.61.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.61.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8BbVwa9x6OCTRkhl0wGwAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 04:42:14.491960 2026] [:error] [pid 51468:tid 51497] [client 101.100.228.209:42132] [client 101.100.228.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.100.228.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8Cpk2TppSvA8W5CBRofwAAANU"]
[Sun Mar 22 04:42:15.414407 2026] [:error] [pid 51468:tid 51485] [client 101.100.228.209:42132] [client 101.100.228.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.100.228.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8Cp02TppSvA8W5CBRogwAAAMk"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 04:43:24.055367 2026] [:error] [pid 51468:tid 51484] [client 162.241.203.92:46630] [client 162.241.203.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.203.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8C7E2TppSvA8W5CBRpYQAAAMg"]
[Sun Mar 22 04:43:25.246823 2026] [:error] [pid 51468:tid 51494] [client 162.241.203.92:46630] [client 162.241.203.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.203.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8C7U2TppSvA8W5CBRpaQAAANI"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 04:45:47.166001 2026] [:error] [pid 51361:tid 51389] [client 103.28.36.205:38982] [client 103.28.36.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8DexXYUsdvKC9YWpUfggAAABE"]
[Sun Mar 22 04:45:48.147611 2026] [:error] [pid 51361:tid 51378] [client 103.28.36.205:38982] [client 103.28.36.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8DfBXYUsdvKC9YWpUfhQAAAAc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 04:46:24.011982 2026] [:error] [pid 51362:tid 51411] [client 162.241.63.73:24404] [client 162.241.63.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.63.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8DoMOwPm3DXzTDjUebkgAAAEo"]
[Sun Mar 22 04:46:25.171195 2026] [:error] [pid 51362:tid 51408] [client 162.241.63.73:24404] [client 162.241.63.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.63.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8DocOwPm3DXzTDjUebkwAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 04:48:14.021955 2026] [:error] [pid 51363:tid 51450] [client 162.241.2.148:10130] [client 162.241.2.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.2.148, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8EDlwa9x6OCTRkhl019QAAAJQ"]
[Sun Mar 22 04:48:15.822426 2026] [:error] [pid 51363:tid 51437] [client 162.241.2.148:10130] [client 162.241.2.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.2.148, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8ED1wa9x6OCTRkhl01_QAAAIg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 04:50:06.093303 2026] [:error] [pid 51363:tid 51436] [client 108.179.193.125:34032] [client 108.179.193.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.179.193.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8Eflwa9x6OCTRkhl03DAAAAIc"]
[Sun Mar 22 04:50:07.295536 2026] [:error] [pid 51363:tid 51437] [client 108.179.193.125:34032] [client 108.179.193.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.179.193.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8Ef1wa9x6OCTRkhl03DwAAAIg"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 04:51:52.522902 2026] [:error] [pid 51468:tid 51500] [client 162.241.60.43:37060] [client 162.241.60.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.60.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8E6E2TppSvA8W5CBRv7wAAANg"]
[Sun Mar 22 04:51:54.023676 2026] [:error] [pid 51468:tid 51479] [client 162.241.60.43:37060] [client 162.241.60.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.60.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8E6k2TppSvA8W5CBRv-AAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 04:52:30.278809 2026] [:error] [pid 51363:tid 51431] [client 50.87.144.15:27522] [client 50.87.144.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.15, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8FDlwa9x6OCTRkhl04jgAAAIM"]
[Sun Mar 22 04:52:31.315777 2026] [:error] [pid 51363:tid 51452] [client 50.87.144.15:27522] [client 50.87.144.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.15, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8FD1wa9x6OCTRkhl04kAAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 05:19:23.145469 2026] [:error] [pid 51468:tid 51477] [client 103.90.232.170:52020] [client 103.90.232.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.90.232.170, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8LW02TppSvA8W5CBSCjwAAAME"]
[Sun Mar 22 05:19:25.010340 2026] [:error] [pid 51468:tid 51482] [client 103.90.232.170:52020] [client 103.90.232.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.90.232.170, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab8LXU2TppSvA8W5CBSCkgAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Sun Mar 22 06:10:11.929414 2026] [:error] [pid 51363:tid 51448] [client 43.158.91.71:38102] [client 43.158.91.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ab8XQ1wa9x6OCTRkhl1VpQAAAJI"]
[Sun Mar 22 09:58:18.938414 2026] [:error] [pid 40039:tid 40060] [client 124.104.171.226:56548] [client 124.104.171.226] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ab9Muh3aDgUJfBYishmZmwAAARM"]
[Sun Mar 22 09:59:22.603191 2026] [:error] [pid 40039:tid 40041] [client 124.104.171.226:57300] [client 124.104.171.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.104.171.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab9M-h3aDgUJfBYishmacgAAAQA"]
[Sun Mar 22 10:00:14.772070 2026] [:error] [pid 51363:tid 51450] [client 124.104.171.226:57911] [client 124.104.171.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.104.171.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab9NLlwa9x6OCTRkhl2dZgAAAJQ"]
[Sun Mar 22 10:01:10.529019 2026] [:error] [pid 51468:tid 51494] [client 124.104.171.226:58608] [client 124.104.171.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.104.171.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab9NZk2TppSvA8W5CBQFDQAAANI"]
[Sun Mar 22 10:02:24.629504 2026] [:error] [pid 51468:tid 51495] [client 124.104.171.226:59465] [client 124.104.171.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.104.171.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab9NsE2TppSvA8W5CBQFuQAAANM"]
[Sun Mar 22 10:03:33.382792 2026] [:error] [pid 40039:tid 40047] [client 124.104.171.226:60159] [client 124.104.171.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.104.171.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab9N9R3aDgUJfBYishmdigAAAQY"]
[Sun Mar 22 10:04:25.429484 2026] [:error] [pid 51363:tid 51432] [client 36.41.75.167:56540] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ab9OKVwa9x6OCTRkhl2e4AAAAIQ"]
[Sun Mar 22 10:38:01.826788 2026] [:error] [pid 40039:tid 40043] [client 146.70.226.85:59730] [client 146.70.226.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.70.226.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab9WCR3aDgUJfBYishmyFgAAAQI"]
[Sun Mar 22 10:38:23.220550 2026] [:error] [pid 51468:tid 51479] [client 146.70.226.85:60380] [client 146.70.226.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.70.226.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab9WH02TppSvA8W5CBQUXAAAAMM"]
[Sun Mar 22 11:19:35.467844 2026] [:error] [pid 40039:tid 40047] [client 185.198.240.77:43543] [client 185.198.240.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.198.240.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab9fxx3aDgUJfBYishnRwQAAAQY"]
[Sun Mar 22 12:12:22.080109 2026] [:error] [pid 40039:tid 40062] [client 185.198.240.67:64913] [client 185.198.240.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.198.240.67, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab9sJh3aDgUJfBYishn36wAAARU"]
[Sun Mar 22 12:15:19.986151 2026] [:error] [pid 40039:tid 40052] [client 185.198.240.71:50135] [client 185.198.240.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.198.240.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab9s1x3aDgUJfBYishn5owAAAQs"]
[Sun Mar 22 12:18:43.176520 2026] [:error] [pid 51363:tid 51449] [client 185.198.240.37:23383] [client 185.198.240.37] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.198.240.37, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab9to1wa9x6OCTRkhl3LigAAAJM"]
[Sun Mar 22 13:47:14.474082 2026] [:error] [pid 51363:tid 51447] [client 146.70.226.85:53994] [client 146.70.226.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.70.226.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab-CYlwa9x6OCTRkhl3r9gAAAJE"]
[Sun Mar 22 13:52:50.299198 2026] [:error] [pid 51363:tid 51446] [client 146.70.226.85:51936] [client 146.70.226.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.70.226.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab-Dslwa9x6OCTRkhl3ujAAAAJA"]
[Sun Mar 22 14:07:11.006545 2026] [:error] [pid 51363:tid 51438] [client 146.70.226.85:61871] [client 146.70.226.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.70.226.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab-HD1wa9x6OCTRkhl31XwAAAIk"]
[Sun Mar 22 14:20:42.398457 2026] [:error] [pid 51361:tid 51379] [client 146.70.226.85:54200] [client 146.70.226.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.70.226.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab-KOhXYUsdvKC9YWpWUZwAAAAg"]
[Sun Mar 22 14:36:32.616009 2026] [:error] [pid 51468:tid 51478] [client 146.70.226.85:54233] [client 146.70.226.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 146.70.226.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab-N8E2TppSvA8W5CBSVwAAAAMI"]
[Sun Mar 22 16:05:55.395620 2026] [:error] [pid 51468:tid 51493] [client 43.153.12.58:57904] [client 43.153.12.58] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ab-i402TppSvA8W5CBTRNQAAANE"]
[Sun Mar 22 17:34:28.182825 2026] [:error] [pid 51468:tid 51479] [client 43.241.194.49:26129] [client 43.241.194.49] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ab-3pE2TppSvA8W5CBQeQwAAAMM"]
[Sun Mar 22 17:35:23.665141 2026] [:error] [pid 40039:tid 40051] [client 43.241.194.49:26397] [client 43.241.194.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.241.194.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab-32x3aDgUJfBYishmOZQAAAQo"]
[Sun Mar 22 17:36:23.310527 2026] [:error] [pid 51361:tid 51388] [client 43.241.194.49:25612] [client 43.241.194.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.241.194.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab-4FxXYUsdvKC9YWpXB_AAAABA"]
[Sun Mar 22 17:37:15.575771 2026] [:error] [pid 51363:tid 51431] [client 43.241.194.49:26145] [client 43.241.194.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.241.194.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab-4S1wa9x6OCTRkhl1g2wAAAIM"]
[Sun Mar 22 17:38:33.812616 2026] [:error] [pid 51468:tid 51481] [client 43.241.194.49:25809] [client 43.241.194.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.241.194.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab-4mU2TppSvA8W5CBQg_gAAAMU"]
[Sun Mar 22 17:39:34.811181 2026] [:error] [pid 51361:tid 51377] [client 43.241.194.49:25744] [client 43.241.194.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.241.194.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ab-41hXYUsdvKC9YWpXC4gAAAAY"]
[Sun Mar 22 18:13:47.933406 2026] [:error] [pid 51362:tid 51409] [client 43.165.190.5:34358] [client 43.165.190.5] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ab_A28OwPm3DXzTDjUeFDAAAAEg"]
[Sun Mar 22 19:42:49.649482 2026] [:error] [pid 30166:tid 30197] [client 217.69.7.150:53491] [client 217.69.7.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.69.7.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab_Vubm4_26jKMD0zy3c5gAAAVQ"]
[Sun Mar 22 20:19:49.246826 2026] [:error] [pid 30166:tid 30200] [client 217.69.7.150:61401] [client 217.69.7.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.69.7.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab_eZbm4_26jKMD0zy3paQAAAVc"]
[Sun Mar 22 20:33:57.599363 2026] [:error] [pid 30166:tid 30188] [client 217.69.7.150:50712] [client 217.69.7.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.69.7.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab_htbm4_26jKMD0zy3yggAAAU0"]
[Sun Mar 22 20:48:15.805493 2026] [:error] [pid 51363:tid 51450] [client 217.69.7.150:51643] [client 217.69.7.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.69.7.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab_lD1wa9x6OCTRkhl2-VAAAAJQ"]
[Sun Mar 22 20:55:37.192070 2026] [:error] [pid 40039:tid 40044] [client 52.139.34.203:40292] [client 52.139.34.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "ab_myR3aDgUJfBYishm-lQAAAQM"]
[Sun Mar 22 20:55:42.393871 2026] [:error] [pid 30166:tid 30192] [client 52.139.34.203:40199] [client 52.139.34.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "ab_mzrm4_26jKMD0zy0DSAAAAVE"]
[Sun Mar 22 20:55:43.743355 2026] [:error] [pid 40039:tid 40064] [client 52.139.34.203:40198] [client 52.139.34.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "ab_mzx3aDgUJfBYishm-mQAAARc"]
[Sun Mar 22 21:03:01.766322 2026] [:error] [pid 51362:tid 51410] [client 217.69.7.150:52883] [client 217.69.7.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.69.7.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab_ohcOwPm3DXzTDjUfSvQAAAEk"]
[Sun Mar 22 21:04:40.417863 2026] [:error] [pid 30166:tid 30187] [client 43.130.141.193:36286] [client 43.130.141.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ab_o6Lm4_26jKMD0zy0MoAAAAUw"]
[Sun Mar 22 21:18:31.699539 2026] [:error] [pid 51468:tid 51487] [client 217.69.7.150:61963] [client 217.69.7.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.69.7.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ab_sJ02TppSvA8W5CBRn5wAAAMs"]
[Sun Mar 22 22:06:13.656855 2026] [:error] [pid 51468:tid 51492] [client 175.178.198.9:40288] [client 175.178.198.9] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/plugins/Ueditor/dialogs/attachment/images/alignicon.gif"] [unique_id "ab_3VU2TppSvA8W5CBSLkwAAANA"], referer: https://expressinteriors.com/public/plugins/Ueditor/dialogs/attachment/images/alignicon.gif
[Sun Mar 22 23:02:33.723104 2026] [:error] [pid 30166:tid 30189] [client 37.201.7.79:19564] [client 37.201.7.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.201.7.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acAEibm4_26jKMD0zy042AAAAU4"]
[Mon Mar 23 00:22:30.086624 2026] [:error] [pid 20584:tid 20624] [client 20.220.145.74:65352] [client 20.220.145.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "acAXRiWzr-bD_t6AP_S58AAAAEg"]
[Mon Mar 23 00:22:30.930347 2026] [:error] [pid 20856:tid 20922] [client 20.220.145.74:2895] [client 20.220.145.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "acAXRsxFtXFVNE-X2-Jz4QAAAMM"]
[Mon Mar 23 00:22:31.782901 2026] [:error] [pid 20856:tid 20934] [client 20.220.145.74:65371] [client 20.220.145.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "acAXR8xFtXFVNE-X2-Jz5gAAAM8"]
[Mon Mar 23 00:22:32.643650 2026] [:error] [pid 20856:tid 20932] [client 20.220.145.74:2942] [client 20.220.145.74] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "acAXSMxFtXFVNE-X2-Jz6AAAAM0"]
[Mon Mar 23 00:35:50.055582 2026] [:error] [pid 20587:tid 20658] [client 203.2.64.59:39025] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acAaZoByf8r3QAk4VXPeVAAAAI8"]
[Mon Mar 23 00:43:41.998785 2026] [:error] [pid 20856:tid 20933] [client 88.119.141.208:63254] [client 88.119.141.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.119.141.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acAcPcxFtXFVNE-X2-J9LwAAAM4"]
[Mon Mar 23 02:21:39.321171 2026] [:error] [pid 20856:tid 20936] [client 159.89.183.109:49839] [client 159.89.183.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.89.183.109, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acAzM8xFtXFVNE-X2-KjyAAAANE"]
[Mon Mar 23 02:32:18.256911 2026] [:error] [pid 27776:tid 27872] [client 159.89.183.109:61682] [client 159.89.183.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.89.183.109, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acA1so3Eaq7IZ5L-4XVnJAAAARg"]
[Mon Mar 23 02:48:05.798103 2026] [:error] [pid 20587:tid 20647] [client 159.89.183.109:60645] [client 159.89.183.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.89.183.109, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acA5ZYByf8r3QAk4VXP7_gAAAIQ"]
[Mon Mar 23 03:03:57.915083 2026] [:error] [pid 20574:tid 20596] [client 159.89.183.109:62664] [client 159.89.183.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.89.183.109, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acA9HddMXEnEZrwyzJkeeQAAAAc"]
[Mon Mar 23 03:20:38.673030 2026] [:error] [pid 20856:tid 20934] [client 159.89.183.109:60675] [client 159.89.183.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.89.183.109, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acBBBsxFtXFVNE-X2-K9FwAAAM8"]
[Mon Mar 23 03:41:33.946081 2026] [:error] [pid 20142:tid 20176] [client 88.119.141.208:59533] [client 88.119.141.208] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acBF7QoTWhQEw6h99jrodQAAANc"]
[Mon Mar 23 03:42:55.747543 2026] [:error] [pid 20142:tid 20172] [client 88.119.141.208:59955] [client 88.119.141.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.119.141.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acBGPwoTWhQEw6h99jrpJwAAANM"]
[Mon Mar 23 03:44:14.632566 2026] [:error] [pid 58337:tid 58358] [client 88.119.141.208:60255] [client 88.119.141.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.119.141.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acBGjsQ0SOo3KsJ22FyY4wAAANM"]
[Mon Mar 23 03:45:18.835588 2026] [:error] [pid 58337:tid 58356] [client 88.119.141.208:60573] [client 88.119.141.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.119.141.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acBGzsQ0SOo3KsJ22FyZQAAAANE"]
[Mon Mar 23 03:46:23.494564 2026] [:error] [pid 58224:tid 58273] [client 88.119.141.208:60917] [client 88.119.141.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.119.141.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acBHD5itjpa6ZGWI-MmW8AAAABE"]
[Mon Mar 23 03:47:22.872260 2026] [:error] [pid 58226:tid 58318] [client 88.119.141.208:61201] [client 88.119.141.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.119.141.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acBHSpKXxmzKz4VJqjNjcAAAAIg"]
[Mon Mar 23 04:18:04.154011 2026] [:error] [pid 23439:tid 23461] [client 43.154.250.181:59760] [client 43.154.250.181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acBOfKZv8XIzUKdgaMctUAAAAAw"]
[Mon Mar 23 04:22:54.327349 2026] [authz_core:error] [pid 23441:tid 23507] [client 68.183.9.16:54350] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Mon Mar 23 04:22:59.753927 2026] [:error] [pid 23440:tid 23483] [client 68.183.9.16:43532] [client 68.183.9.16] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "acBPoz49_8n8h_ttcUq5DAAAAEc"]
[Mon Mar 23 04:23:03.835819 2026] [:error] [pid 23440:tid 23478] [client 68.183.9.16:43544] [client 68.183.9.16] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "acBPpz49_8n8h_ttcUq5EwAAAEI"]
[Mon Mar 23 04:23:14.154997 2026] [:error] [pid 57265:tid 57281] [client 68.183.9.16:34476] [client 68.183.9.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "acBPsmNLjPJJkhuqCsiGvQAAAQ4"]
[Mon Mar 23 04:23:29.869656 2026] [:error] [pid 23441:tid 23516] [client 68.183.9.16:58542] [client 68.183.9.16] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.expressinteriors.com|F|2"] [data ".axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/trace.axd"] [unique_id "acBPwRq7S-oOqSXZEr48zQAAAI0"]
[Mon Mar 23 05:10:21.485118 2026] [:error] [pid 57265:tid 57275] [client 152.42.168.106:61226] [client 152.42.168.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.42.168.106, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acBavWNLjPJJkhuqCsihbQAAAQg"]
[Mon Mar 23 07:26:06.579933 2026] [:error] [pid 35165:tid 35188] [client 114.80.36.40:50246] [client 114.80.36.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acB6js6udpN6Esk7JKvHOgAAAZQ"]
[Mon Mar 23 10:33:21.621079 2026] [:error] [pid 23441:tid 23513] [client 185.80.149.229:51478] [client 185.80.149.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.80.149.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acCmcRq7S-oOqSXZEr6JcAAAAIo"], referer: https://expressinteriors.com/
[Mon Mar 23 10:33:23.488406 2026] [:error] [pid 57265:tid 57287] [client 185.80.149.229:40371] [client 185.80.149.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.80.149.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acCmc2NLjPJJkhuqCsglSwAAARQ"], referer: https://expressinteriors.com/wp-login.php?action=register
[Mon Mar 23 10:38:15.902414 2026] [:error] [pid 23440:tid 23487] [client 58.69.68.94:64957] [client 58.69.68.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 58.69.68.94, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acCnlz49_8n8h_ttcUrzgQAAAEs"]
[Mon Mar 23 10:44:36.493294 2026] [:error] [pid 23539:tid 23552] [client 58.69.68.94:51796] [client 58.69.68.94] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acCpFH7Dh3qWGSpIAZW3fgAAAMQ"]
[Mon Mar 23 10:46:47.766891 2026] [:error] [pid 57265:tid 57280] [client 58.69.68.94:53012] [client 58.69.68.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 58.69.68.94, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acCpl2NLjPJJkhuqCsgtagAAAQ0"]
[Mon Mar 23 10:49:01.882456 2026] [:error] [pid 23440:tid 23500] [client 58.69.68.94:54303] [client 58.69.68.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 58.69.68.94, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acCqHT49_8n8h_ttcUr1mgAAAFg"]
[Mon Mar 23 12:19:12.177542 2026] [:error] [pid 14573:tid 14575] [client 43.167.232.38:45942] [client 43.167.232.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acC_QO-oSmHn3q4_J1FAigAAAUA"]
[Mon Mar 23 13:29:18.422283 2026] [:error] [pid 23440:tid 23488] [client 59.96.85.80:59903] [client 59.96.85.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.96.85.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acDPrj49_8n8h_ttcUoK4gAAAEw"]
[Mon Mar 23 14:21:46.756437 2026] [:error] [pid 23440:tid 23483] [client 43.130.60.195:40918] [client 43.130.60.195] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acDb-j49_8n8h_ttcUoR2AAAAEc"]
[Mon Mar 23 15:16:46.225180 2026] [:error] [pid 23539:tid 23553] [client 59.95.19.64:49861] [client 59.95.19.64] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acDo3n7Dh3qWGSpIAZXwCAAAAMU"]
[Mon Mar 23 15:18:03.141525 2026] [:error] [pid 23440:tid 23482] [client 59.95.19.64:51321] [client 59.95.19.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.95.19.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acDpKz49_8n8h_ttcUoYKAAAAEY"]
[Mon Mar 23 15:19:13.882195 2026] [:error] [pid 57265:tid 57284] [client 59.95.19.64:52756] [client 59.95.19.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.95.19.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acDpcWNLjPJJkhuqCsjLRAAAARE"]
[Mon Mar 23 15:20:10.141395 2026] [:error] [pid 57265:tid 57267] [client 59.95.19.64:53390] [client 59.95.19.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.95.19.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acDpqmNLjPJJkhuqCsjLnQAAAQA"]
[Mon Mar 23 15:21:14.788650 2026] [:error] [pid 57265:tid 57273] [client 59.95.19.64:53769] [client 59.95.19.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.95.19.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acDp6mNLjPJJkhuqCsjMBwAAAQY"]
[Mon Mar 23 15:22:13.891335 2026] [:error] [pid 23440:tid 23477] [client 59.95.19.64:54009] [client 59.95.19.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.95.19.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acDqJT49_8n8h_ttcUoYhwAAAEE"]
[Mon Mar 23 15:42:31.947091 2026] [:error] [pid 23441:tid 23513] [client 20.215.241.7:38618] [client 20.215.241.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.215.241.7, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acDu5xq7S-oOqSXZEr685gAAAIo"]
[Mon Mar 23 16:32:39.036187 2026] [:error] [pid 57265:tid 57273] [client 37.39.33.168:52768] [client 37.39.33.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.39.33.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acD6p2NLjPJJkhuqCsj1fwAAAQY"]
[Mon Mar 23 19:23:56.433430 2026] [:error] [pid 35165:tid 35181] [client 98.98.79.9:49407] [client 98.98.79.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.98.79.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acEizM6udpN6Esk7JKvLIQAAAY0"]
[Mon Mar 23 19:37:01.815619 2026] [:error] [pid 57265:tid 57275] [client 98.98.79.9:59595] [client 98.98.79.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.98.79.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acEl3WNLjPJJkhuqCshpEgAAAQg"]
[Mon Mar 23 19:51:23.410194 2026] [:error] [pid 23439:tid 23450] [client 98.98.79.9:64467] [client 98.98.79.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.98.79.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acEpO6Zv8XIzUKdgaMebYgAAAAE"]
[Mon Mar 23 20:07:22.078859 2026] [:error] [pid 23539:tid 23549] [client 98.98.79.9:55808] [client 98.98.79.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.98.79.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acEs-n7Dh3qWGSpIAZU3wwAAAME"]
[Mon Mar 23 20:23:50.036666 2026] [:error] [pid 38177:tid 38225] [client 98.98.79.9:61821] [client 98.98.79.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.98.79.9, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acEw1nsYW-_HCI66MunlhAAAAEo"]
[Mon Mar 23 22:23:20.767880 2026] [:error] [pid 38306:tid 38315] [client 104.28.208.60:39279] [client 104.28.208.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "acFM2DkL8qwu-hHc6Bi2SAAAAQc"]
[Mon Mar 23 22:23:28.329910 2026] [:error] [pid 52341:tid 52348] [client 104.28.208.60:39280] [client 104.28.208.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/style.php"] [unique_id "acFM4KPKTBDR2u47Gb33UQAAAUU"]
[Mon Mar 23 22:23:29.131296 2026] [:error] [pid 52341:tid 52362] [client 104.28.208.60:39284] [client 104.28.208.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/style.php"] [unique_id "acFM4aPKTBDR2u47Gb33UwAAAVM"]
[Mon Mar 23 22:23:30.673178 2026] [:error] [pid 38306:tid 38324] [client 104.28.208.60:39047] [client 104.28.208.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/style.php"] [unique_id "acFM4jkL8qwu-hHc6Bi2VwAAARA"]
[Mon Mar 23 22:23:31.212719 2026] [:error] [pid 52341:tid 52347] [client 104.28.208.60:39050] [client 104.28.208.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style.php"] [unique_id "acFM46PKTBDR2u47Gb33VwAAAUQ"]
[Mon Mar 23 22:23:31.738252 2026] [:error] [pid 38306:tid 38323] [client 104.28.208.60:39056] [client 104.28.208.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "acFM4zkL8qwu-hHc6Bi2WgAAAQ8"]
[Mon Mar 23 22:23:32.269586 2026] [:error] [pid 52341:tid 52352] [client 104.28.208.60:39061] [client 104.28.208.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "acFM5KPKTBDR2u47Gb33WAAAAUk"]
[Mon Mar 23 22:23:32.800436 2026] [:error] [pid 52341:tid 52343] [client 104.28.208.60:39065] [client 104.28.208.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "acFM5KPKTBDR2u47Gb33WgAAAUA"]
[Mon Mar 23 23:46:52.966076 2026] [:error] [pid 38306:tid 38318] [client 40.85.246.124:24467] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "acFgbDkL8qwu-hHc6BjblAAAAQo"]
[Mon Mar 23 23:46:53.405126 2026] [:error] [pid 52341:tid 52347] [client 40.85.246.124:24514] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "acFgbaPKTBDR2u47Gb0rngAAAUQ"]
[Mon Mar 23 23:46:53.845695 2026] [:error] [pid 38276:tid 38279] [client 40.85.246.124:24555] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "acFgbZoKGiI-a7oME3IeHQAAAMA"]
[Mon Mar 23 23:46:54.319162 2026] [:error] [pid 38177:tid 38222] [client 40.85.246.124:24520] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "acFgbnsYW-_HCI66MukMawAAAEc"]
[Mon Mar 23 23:46:54.767424 2026] [:error] [pid 38178:tid 38249] [client 40.85.246.124:24567] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/path.php"] [unique_id "acFgbg0axWfXsVvR9udfjQAAAIc"]
[Mon Mar 23 23:46:55.242610 2026] [:error] [pid 38177:tid 38215] [client 40.85.246.124:24561] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/path.php"] [unique_id "acFgb3sYW-_HCI66MukMbAAAAEA"]
[Mon Mar 23 23:46:55.715730 2026] [:error] [pid 38276:tid 38297] [client 40.85.246.124:24553] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/path.php"] [unique_id "acFgb5oKGiI-a7oME3IeIAAAANI"]
[Mon Mar 23 23:46:56.150762 2026] [:error] [pid 38178:tid 38264] [client 40.85.246.124:24548] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/path.php"] [unique_id "acFgcA0axWfXsVvR9udfkgAAAJY"]
[Mon Mar 23 23:46:56.594571 2026] [:error] [pid 38306:tid 38312] [client 40.85.246.124:24519] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wdf.php"] [unique_id "acFgcDkL8qwu-hHc6BjbmgAAAQQ"]
[Mon Mar 23 23:46:57.042112 2026] [:error] [pid 38176:tid 38197] [client 40.85.246.124:24543] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wdf.php"] [unique_id "acFgcUtG4qlh1gvNjuJqngAAAAo"]
[Mon Mar 23 23:46:57.466787 2026] [:error] [pid 38276:tid 38285] [client 40.85.246.124:24448] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wdf.php"] [unique_id "acFgcZoKGiI-a7oME3IeIwAAAMY"]
[Mon Mar 23 23:46:57.957886 2026] [:error] [pid 38178:tid 38251] [client 40.85.246.124:24558] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wdf.php"] [unique_id "acFgcQ0axWfXsVvR9udfmAAAAIk"]
[Mon Mar 23 23:46:58.370751 2026] [:error] [pid 38276:tid 38292] [client 40.85.246.124:24533] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fleen.php"] [unique_id "acFgcpoKGiI-a7oME3IeJgAAAM0"]
[Mon Mar 23 23:46:58.804868 2026] [:error] [pid 38306:tid 38315] [client 40.85.246.124:24454] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fleen.php"] [unique_id "acFgcjkL8qwu-hHc6BjbnQAAAQc"]
[Mon Mar 23 23:46:59.222449 2026] [:error] [pid 38306:tid 38311] [client 40.85.246.124:24562] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fleen.php"] [unique_id "acFgczkL8qwu-hHc6BjbngAAAQM"]
[Mon Mar 23 23:46:59.635163 2026] [:error] [pid 38306:tid 38310] [client 40.85.246.124:24465] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fleen.php"] [unique_id "acFgczkL8qwu-hHc6BjbowAAAQI"]
[Mon Mar 23 23:47:00.045802 2026] [:error] [pid 38177:tid 38231] [client 40.85.246.124:24453] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tem.php"] [unique_id "acFgdHsYW-_HCI66MukMbwAAAFA"]
[Mon Mar 23 23:47:00.465980 2026] [:error] [pid 38176:tid 38211] [client 40.85.246.124:24485] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tem.php"] [unique_id "acFgdEtG4qlh1gvNjuJqogAAABg"]
[Mon Mar 23 23:47:00.879079 2026] [:error] [pid 38177:tid 38228] [client 40.85.246.124:24542] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tem.php"] [unique_id "acFgdHsYW-_HCI66MukMcQAAAE0"]
[Mon Mar 23 23:47:01.289323 2026] [:error] [pid 52341:tid 52352] [client 40.85.246.124:24481] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tem.php"] [unique_id "acFgdaPKTBDR2u47Gb0rpwAAAUk"]
[Mon Mar 23 23:47:01.713155 2026] [:error] [pid 52341:tid 52365] [client 40.85.246.124:24459] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av6m.php"] [unique_id "acFgdaPKTBDR2u47Gb0rqAAAAVY"]
[Mon Mar 23 23:47:02.137357 2026] [:error] [pid 38176:tid 38201] [client 40.85.246.124:24451] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av6m.php"] [unique_id "acFgdktG4qlh1gvNjuJqpQAAAA4"]
[Mon Mar 23 23:47:02.547221 2026] [:error] [pid 38176:tid 38205] [client 40.85.246.124:24573] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av6m.php"] [unique_id "acFgdktG4qlh1gvNjuJqpgAAABI"]
[Mon Mar 23 23:47:02.989021 2026] [:error] [pid 38176:tid 38207] [client 40.85.246.124:24552] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av6m.php"] [unique_id "acFgdktG4qlh1gvNjuJqqQAAABQ"]
[Mon Mar 23 23:47:03.400529 2026] [:error] [pid 38176:tid 38206] [client 40.85.246.124:24388] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autogooey.php"] [unique_id "acFgd0tG4qlh1gvNjuJqqwAAABM"]
[Mon Mar 23 23:47:03.814755 2026] [:error] [pid 38276:tid 38295] [client 40.85.246.124:24525] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autogooey.php"] [unique_id "acFgd5oKGiI-a7oME3IeLQAAANA"]
[Mon Mar 23 23:47:04.225101 2026] [:error] [pid 38306:tid 38324] [client 40.85.246.124:24569] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autogooey.php"] [unique_id "acFgeDkL8qwu-hHc6BjbqAAAARA"]
[Mon Mar 23 23:47:04.638037 2026] [:error] [pid 38176:tid 38208] [client 40.85.246.124:24512] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autogooey.php"] [unique_id "acFgeEtG4qlh1gvNjuJqrgAAABU"]
[Mon Mar 23 23:47:05.073659 2026] [:error] [pid 52341:tid 52367] [client 40.85.246.124:24515] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/btx25.php"] [unique_id "acFgeaPKTBDR2u47Gb0rrgAAAVg"]
[Mon Mar 23 23:47:05.483912 2026] [:error] [pid 38177:tid 38235] [client 40.85.246.124:24518] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/btx25.php"] [unique_id "acFgeXsYW-_HCI66MukMdQAAAFQ"]
[Mon Mar 23 23:47:05.906837 2026] [:error] [pid 38176:tid 38193] [client 40.85.246.124:24513] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/btx25.php"] [unique_id "acFgeUtG4qlh1gvNjuJqsgAAAAY"]
[Mon Mar 23 23:47:06.318122 2026] [:error] [pid 38306:tid 38311] [client 40.85.246.124:24524] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/btx25.php"] [unique_id "acFgejkL8qwu-hHc6BjbqQAAAQM"]
[Mon Mar 23 23:47:06.728696 2026] [:error] [pid 38177:tid 38220] [client 40.85.246.124:24521] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mga.php"] [unique_id "acFgensYW-_HCI66MukMeAAAAEU"]
[Mon Mar 23 23:47:07.166023 2026] [:error] [pid 38178:tid 38253] [client 40.85.246.124:24526] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mga.php"] [unique_id "acFgew0axWfXsVvR9udfmgAAAIs"]
[Mon Mar 23 23:47:07.575953 2026] [:error] [pid 38306:tid 38330] [client 40.85.246.124:24549] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mga.php"] [unique_id "acFgezkL8qwu-hHc6BjbrQAAARY"]
[Mon Mar 23 23:47:07.989444 2026] [:error] [pid 38306:tid 38323] [client 40.85.246.124:24532] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mga.php"] [unique_id "acFgezkL8qwu-hHc6BjbrgAAAQ8"]
[Mon Mar 23 23:47:08.415913 2026] [:error] [pid 38178:tid 38260] [client 40.85.246.124:24452] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maxro.php"] [unique_id "acFgfA0axWfXsVvR9udfnQAAAJI"]
[Mon Mar 23 23:47:08.863970 2026] [:error] [pid 38306:tid 38331] [client 40.85.246.124:24463] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maxro.php"] [unique_id "acFgfDkL8qwu-hHc6BjbsQAAARc"]
[Mon Mar 23 23:47:09.274826 2026] [:error] [pid 38177:tid 38227] [client 40.85.246.124:24559] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maxro.php"] [unique_id "acFgfXsYW-_HCI66MukMeQAAAEw"]
[Mon Mar 23 23:47:09.684341 2026] [:error] [pid 38176:tid 38194] [client 40.85.246.124:24572] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maxro.php"] [unique_id "acFgfUtG4qlh1gvNjuJqtwAAAAc"]
[Mon Mar 23 23:47:10.126071 2026] [:error] [pid 38176:tid 38187] [client 40.85.246.124:24560] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/agg.php"] [unique_id "acFgfktG4qlh1gvNjuJquQAAAAA"]
[Mon Mar 23 23:47:10.539990 2026] [:error] [pid 38178:tid 38255] [client 40.85.246.124:24547] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/agg.php"] [unique_id "acFgfg0axWfXsVvR9udfnwAAAI0"]
[Mon Mar 23 23:47:10.955766 2026] [:error] [pid 38177:tid 38217] [client 40.85.246.124:24544] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/agg.php"] [unique_id "acFgfnsYW-_HCI66MukMfQAAAEI"]
[Mon Mar 23 23:47:11.371878 2026] [:error] [pid 38177:tid 38231] [client 40.85.246.124:24570] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/agg.php"] [unique_id "acFgf3sYW-_HCI66MukMfgAAAFA"]
[Mon Mar 23 23:47:11.789814 2026] [:error] [pid 38177:tid 38229] [client 40.85.246.124:24530] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pass4.php"] [unique_id "acFgf3sYW-_HCI66MukMfwAAAE4"]
[Mon Mar 23 23:47:12.210594 2026] [:error] [pid 38177:tid 38234] [client 40.85.246.124:24450] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pass4.php"] [unique_id "acFggHsYW-_HCI66MukMgQAAAFM"]
[Mon Mar 23 23:47:12.620778 2026] [:error] [pid 38177:tid 38238] [client 40.85.246.124:24425] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pass4.php"] [unique_id "acFggHsYW-_HCI66MukMgwAAAFc"]
[Mon Mar 23 23:47:13.041023 2026] [:error] [pid 38178:tid 38262] [client 40.85.246.124:24405] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsvvs.php"] [unique_id "acFggQ0axWfXsVvR9udfoQAAAJQ"]
[Mon Mar 23 23:47:13.450573 2026] [:error] [pid 52341:tid 52355] [client 40.85.246.124:24507] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsvvs.php"] [unique_id "acFggaPKTBDR2u47Gb0rtgAAAUw"]
[Mon Mar 23 23:47:13.858932 2026] [:error] [pid 38176:tid 38208] [client 40.85.246.124:24474] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsvvs.php"] [unique_id "acFggUtG4qlh1gvNjuJqugAAABU"]
[Mon Mar 23 23:47:14.291620 2026] [:error] [pid 38178:tid 38245] [client 40.85.246.124:24461] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsvvs.php"] [unique_id "acFggg0axWfXsVvR9udfogAAAIM"]
[Mon Mar 23 23:47:14.704357 2026] [:error] [pid 38306:tid 38309] [client 40.85.246.124:24418] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/G-In.php"] [unique_id "acFggjkL8qwu-hHc6BjbuAAAAQE"]
[Mon Mar 23 23:47:15.136160 2026] [:error] [pid 38176:tid 38211] [client 40.85.246.124:24456] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/G-In.php"] [unique_id "acFgg0tG4qlh1gvNjuJqvQAAABg"]
[Mon Mar 23 23:47:15.558852 2026] [:error] [pid 38276:tid 38301] [client 40.85.246.124:24538] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/G-In.php"] [unique_id "acFgg5oKGiI-a7oME3IeNQAAANY"]
[Mon Mar 23 23:47:15.972848 2026] [:error] [pid 38306:tid 38325] [client 40.85.246.124:24564] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/G-In.php"] [unique_id "acFggzkL8qwu-hHc6BjbugAAARE"]
[Mon Mar 23 23:47:16.398963 2026] [:error] [pid 38177:tid 38219] [client 40.85.246.124:24499] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "acFghHsYW-_HCI66MukMhAAAAEQ"]
[Mon Mar 23 23:47:16.812531 2026] [:error] [pid 38178:tid 38258] [client 40.85.246.124:24470] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "acFghA0axWfXsVvR9udfowAAAJA"]
[Mon Mar 23 23:47:17.225557 2026] [:error] [pid 38177:tid 38239] [client 40.85.246.124:24397] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "acFghXsYW-_HCI66MukMhQAAAFg"]
[Mon Mar 23 23:47:17.636187 2026] [:error] [pid 38276:tid 38300] [client 40.85.246.124:24462] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "acFghZoKGiI-a7oME3IeOQAAANU"]
[Mon Mar 23 23:47:18.047901 2026] [:error] [pid 38178:tid 38261] [client 40.85.246.124:24457] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "acFghg0axWfXsVvR9udfpQAAAJM"]
[Mon Mar 23 23:47:18.476092 2026] [:error] [pid 38176:tid 38210] [client 40.85.246.124:24476] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "acFghktG4qlh1gvNjuJqwwAAABc"]
[Mon Mar 23 23:47:18.899195 2026] [:error] [pid 38176:tid 38194] [client 40.85.246.124:24523] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "acFghktG4qlh1gvNjuJqxQAAAAc"]
[Mon Mar 23 23:47:19.314363 2026] [:error] [pid 52341:tid 52349] [client 40.85.246.124:24460] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "acFgh6PKTBDR2u47Gb0rugAAAUY"]
[Mon Mar 23 23:47:19.724432 2026] [:error] [pid 38276:tid 38299] [client 40.85.246.124:24541] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "acFgh5oKGiI-a7oME3IeOwAAANQ"]
[Mon Mar 23 23:47:20.149477 2026] [:error] [pid 38306:tid 38325] [client 40.85.246.124:24471] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "acFgiDkL8qwu-hHc6BjbwwAAARE"]
[Mon Mar 23 23:47:20.558830 2026] [:error] [pid 38176:tid 38187] [client 40.85.246.124:24493] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "acFgiEtG4qlh1gvNjuJqxwAAAAA"]
[Mon Mar 23 23:47:20.968937 2026] [:error] [pid 38306:tid 38308] [client 40.85.246.124:24453] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "acFgiDkL8qwu-hHc6BjbxQAAAQA"]
[Mon Mar 23 23:47:21.396639 2026] [:error] [pid 38306:tid 38329] [client 40.85.246.124:24477] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "acFgiTkL8qwu-hHc6BjbyAAAARU"]
[Mon Mar 23 23:47:21.808828 2026] [:error] [pid 38306:tid 38323] [client 40.85.246.124:24500] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "acFgiTkL8qwu-hHc6BjbyQAAAQ8"]
[Mon Mar 23 23:47:22.234232 2026] [:error] [pid 38178:tid 38249] [client 40.85.246.124:24546] [client 40.85.246.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "acFgig0axWfXsVvR9udfqQAAAIc"]
[Mon Mar 23 23:47:22.660582 2026] [:error] [pid 38306:tid 38324] [client 40.85.246.124:24468] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "acFgijkL8qwu-hHc6Bjb0AAAARA"]
[Mon Mar 23 23:47:23.070457 2026] [:error] [pid 38176:tid 38197] [client 40.85.246.124:24535] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "acFgi0tG4qlh1gvNjuJqyAAAAAo"]
[Mon Mar 23 23:47:23.484433 2026] [:error] [pid 52341:tid 52345] [client 40.85.246.124:24575] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "acFgi6PKTBDR2u47Gb0rygAAAUI"]
[Mon Mar 23 23:47:23.912394 2026] [:error] [pid 52341:tid 52343] [client 40.85.246.124:24320] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "acFgi6PKTBDR2u47Gb0rzQAAAUA"]
[Mon Mar 23 23:47:24.323220 2026] [:error] [pid 52341:tid 52348] [client 40.85.246.124:24536] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "acFgjKPKTBDR2u47Gb0rzwAAAUU"]
[Mon Mar 23 23:47:24.736159 2026] [:error] [pid 52341:tid 52347] [client 40.85.246.124:24402] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "acFgjKPKTBDR2u47Gb0r0gAAAUQ"]
[Mon Mar 23 23:47:25.164258 2026] [:error] [pid 38178:tid 38245] [client 40.85.246.124:24386] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "acFgjQ0axWfXsVvR9udfswAAAIM"]
[Mon Mar 23 23:47:25.578672 2026] [:error] [pid 38276:tid 38289] [client 40.85.246.124:24484] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/index.php"] [unique_id "acFgjZoKGiI-a7oME3IePQAAAMo"]
[Mon Mar 23 23:47:26.016267 2026] [:error] [pid 38178:tid 38246] [client 40.85.246.124:24415] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/css/index.php"] [unique_id "acFgjg0axWfXsVvR9udftAAAAIQ"]
[Mon Mar 23 23:47:26.429964 2026] [:error] [pid 38306:tid 38322] [client 40.85.246.124:24412] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/css/index.php"] [unique_id "acFgjjkL8qwu-hHc6Bjb1wAAAQ4"]
[Mon Mar 23 23:47:26.843997 2026] [:error] [pid 38306:tid 38332] [client 40.85.246.124:24568] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/css/index.php"] [unique_id "acFgjjkL8qwu-hHc6Bjb2QAAARg"]
[Mon Mar 23 23:47:27.258152 2026] [:error] [pid 38177:tid 38221] [client 40.85.246.124:24480] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assets/css/index.php"] [unique_id "acFgj3sYW-_HCI66MukMiAAAAEY"]
[Tue Mar 24 01:32:09.255860 2026] [:error] [pid 31798:tid 31820] [client 196.65.215.238:52395] [client 196.65.215.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.65.215.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acF5GXdtW_1bksndFbYuXAAAABQ"]
[Tue Mar 24 04:39:46.446771 2026] [:error] [pid 38767:tid 38772] [client 106.119.167.146:41550] [client 106.119.167.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acGlEvwkUqN4GJAI5oVEqgAAAQI"]
[Tue Mar 24 04:58:39.162718 2026] [:error] [pid 3137:tid 3150] [client 196.65.215.238:50013] [client 196.65.215.238] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acGpf5dZesutm6dfYM_NLQAAAMs"]
[Tue Mar 24 04:59:39.937543 2026] [:error] [pid 3031:tid 3098] [client 196.65.215.238:50814] [client 196.65.215.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.65.215.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acGpu6JBKytnG47nuibPfwAAAFY"]
[Tue Mar 24 05:00:36.289711 2026] [:error] [pid 3032:tid 3127] [client 196.65.215.238:51466] [client 196.65.215.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.65.215.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acGp9Ca_-JXXD03-JNy6RgAAAJc"]
[Tue Mar 24 05:01:34.768998 2026] [:error] [pid 38767:tid 38776] [client 196.65.215.238:51839] [client 196.65.215.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.65.215.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acGqLvwkUqN4GJAI5oVcrgAAAQY"]
[Tue Mar 24 05:02:35.237374 2026] [:error] [pid 38767:tid 38788] [client 196.65.215.238:51963] [client 196.65.215.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.65.215.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acGqa_wkUqN4GJAI5oVdtQAAARI"]
[Tue Mar 24 05:03:38.323746 2026] [:error] [pid 3137:tid 3148] [client 196.65.215.238:52087] [client 196.65.215.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.65.215.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acGqqpdZesutm6dfYM_QoQAAAMk"]
[Tue Mar 24 05:11:47.584599 2026] [:error] [pid 38767:tid 38789] [client 43.133.187.11:55238] [client 43.133.187.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acGsk_wkUqN4GJAI5oVkCAAAARM"]
[Tue Mar 24 08:00:55.042281 2026] [:error] [pid 3137:tid 3155] [client 49.51.178.45:59358] [client 49.51.178.45] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acHUN5dZesutm6dfYM8sxQAAANA"]
[Tue Mar 24 08:53:35.630056 2026] [:error] [pid 3137:tid 3159] [client 216.73.216.164:51935] [client 216.73.216.164] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||expressinteriors.com|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/robots.txt"] [unique_id "acHgj5dZesutm6dfYM9QogAAANQ"]
[Tue Mar 24 09:02:47.400891 2026] [:error] [pid 48128:tid 48149] [client 185.223.152.134:37659] [client 185.223.152.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acHit8vR4LIMFLbM5Vn_iwAAAYA"]
[Tue Mar 24 09:25:13.417200 2026] [:error] [pid 3030:tid 3069] [client 98.98.66.82:57617] [client 98.98.66.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.98.66.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acHn-QyOuILyynfcqfkZpwAAABQ"]
[Tue Mar 24 09:39:28.055331 2026] [:error] [pid 48219:tid 48284] [client 98.98.66.82:52519] [client 98.98.66.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.98.66.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acHrUChf3b4R_lAIyv_mBgAAAgM"]
[Tue Mar 24 09:59:55.846836 2026] [:error] [pid 38767:tid 38779] [client 31.57.219.162:63753] [client 31.57.219.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.219.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acHwG_wkUqN4GJAI5oXhNQAAAQk"]
[Tue Mar 24 10:23:33.945207 2026] [:error] [pid 3137:tid 3144] [client 170.106.167.214:39214] [client 170.106.167.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acH1pZdZesutm6dfYM90WgAAAMU"]
[Tue Mar 24 10:38:35.430461 2026] [:error] [pid 48219:tid 48294] [client 31.57.219.162:51255] [client 31.57.219.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.219.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acH5Kyhf3b4R_lAIyv_zfAAAAg0"]
[Tue Mar 24 10:56:54.912611 2026] [:error] [pid 3137:tid 3156] [client 31.57.219.162:49953] [client 31.57.219.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.219.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acH9dpdZesutm6dfYM-BdwAAANE"]
[Tue Mar 24 11:15:19.858506 2026] [:error] [pid 38767:tid 38779] [client 31.57.219.162:61984] [client 31.57.219.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.219.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acIBx_wkUqN4GJAI5oUJhQAAAQk"]
[Tue Mar 24 11:33:46.373827 2026] [:error] [pid 38767:tid 38778] [client 31.57.219.162:56965] [client 31.57.219.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.219.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acIGGvwkUqN4GJAI5oUaLgAAAQg"]
[Tue Mar 24 11:38:57.892653 2026] [:error] [pid 64198:tid 64212] [client 182.44.10.67:39778] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acIHUXVzJqf6OS_oSZ2tZQAAAUw"]
[Tue Mar 24 11:51:59.223900 2026] [:error] [pid 38767:tid 38778] [client 31.57.219.162:54438] [client 31.57.219.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.219.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acIKX_wkUqN4GJAI5oUkrwAAAQg"]
[Tue Mar 24 12:10:21.334337 2026] [:error] [pid 38767:tid 38770] [client 31.57.219.162:52855] [client 31.57.219.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.219.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acIOrfwkUqN4GJAI5oUv4AAAAQA"]
[Tue Mar 24 12:29:17.192369 2026] [:error] [pid 48214:tid 48256] [client 31.57.219.162:56624] [client 31.57.219.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.219.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acITHbeshLWZ3uUDHKkhUAAAAcQ"]
[Tue Mar 24 12:48:27.117327 2026] [:error] [pid 38767:tid 38794] [client 31.57.219.162:56447] [client 31.57.219.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.219.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acIXm_wkUqN4GJAI5oVBeQAAARg"]
[Tue Mar 24 13:07:46.281918 2026] [:error] [pid 38767:tid 38773] [client 31.57.219.162:52322] [client 31.57.219.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.219.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acIcIvwkUqN4GJAI5oVKoQAAAQM"]
[Tue Mar 24 13:17:07.988174 2026] [autoindex:error] [pid 64198:tid 64208] [client 178.18.245.70:62697] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue Mar 24 13:24:44.519504 2026] [:error] [pid 38767:tid 38770] [client 43.133.91.48:51612] [client 43.133.91.48] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acIgHPwkUqN4GJAI5oVRmAAAAQA"]
[Tue Mar 24 13:27:16.018089 2026] [:error] [pid 48219:tid 48305] [client 31.57.219.162:61442] [client 31.57.219.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.219.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acIgtChf3b4R_lAIyv8g4wAAAhg"]
[Tue Mar 24 13:46:57.139129 2026] [:error] [pid 64198:tid 64215] [client 31.57.219.162:54253] [client 31.57.219.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.219.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acIlUXVzJqf6OS_oSZ0AVQAAAU8"]
[Tue Mar 24 14:07:00.760607 2026] [:error] [pid 48214:tid 48273] [client 31.57.219.162:63381] [client 31.57.219.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.219.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acIqBLeshLWZ3uUDHKkwFAAAAdU"]
[Tue Mar 24 14:27:12.950419 2026] [:error] [pid 64198:tid 64216] [client 31.57.219.162:54140] [client 31.57.219.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.219.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acIuwHVzJqf6OS_oSZ0VngAAAVA"]
[Tue Mar 24 14:39:37.791765 2026] [:error] [pid 64198:tid 64212] [client 185.193.158.71:46648] [client 185.193.158.71] ModSecurity: Multipart parsing error (init): Multipart: Boundary not found in C-T. [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acIxqXVzJqf6OS_oSZ0dDQAAAUw"]
[Tue Mar 24 14:39:37.792562 2026] [:error] [pid 64198:tid 64212] [client 185.193.158.71:46648] [client 185.193.158.71] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||www.expressinteriors.com|F|2"] [data "Multipart: Boundary not found in C-T."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acIxqXVzJqf6OS_oSZ0dDQAAAUw"]
[Tue Mar 24 14:39:37.792621 2026] [:error] [pid 64198:tid 64212] [client 185.193.158.71:46648] [client 185.193.158.71] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 0, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||www.expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acIxqXVzJqf6OS_oSZ0dDQAAAUw"]
[Tue Mar 24 14:48:08.251956 2026] [:error] [pid 64198:tid 64210] [client 31.57.219.162:60751] [client 31.57.219.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.219.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acIzqHVzJqf6OS_oSZ0hbgAAAUo"]
[Tue Mar 24 15:04:52.683938 2026] [:error] [pid 64198:tid 64205] [client 135.225.120.62:8263] [client 135.225.120.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 135.225.120.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acI3lHVzJqf6OS_oSZ0oEAAAAUU"]
[Tue Mar 24 15:06:10.050046 2026] [:error] [pid 3137:tid 3146] [client 135.225.120.62:8810] [client 135.225.120.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 135.225.120.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acI34pdZesutm6dfYM_NGgAAAMc"]
[Tue Mar 24 15:08:29.076092 2026] [:error] [pid 3137:tid 3162] [client 31.57.219.162:51025] [client 31.57.219.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.219.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acI4bZdZesutm6dfYM_OSAAAANc"]
[Tue Mar 24 15:29:10.672860 2026] [:error] [pid 64198:tid 64200] [client 31.57.219.162:57486] [client 31.57.219.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.219.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acI9RnVzJqf6OS_oSZ0xVwAAAUA"]
[Tue Mar 24 15:50:11.938873 2026] [:error] [pid 38767:tid 38788] [client 31.57.219.162:62030] [client 31.57.219.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.219.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acJCM_wkUqN4GJAI5oWPoQAAARI"]
[Tue Mar 24 16:10:31.625369 2026] [:error] [pid 3137:tid 3163] [client 197.255.253.18:49609] [client 197.255.253.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.255.253.18, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acJG95dZesutm6dfYM_evwAAANg"]
[Tue Mar 24 16:11:40.126941 2026] [:error] [pid 38767:tid 38788] [client 31.57.219.162:50586] [client 31.57.219.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.219.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acJHPPwkUqN4GJAI5oWbYwAAARI"]
[Tue Mar 24 16:18:13.104082 2026] [:error] [pid 3137:tid 3148] [client 197.255.253.18:53978] [client 197.255.253.18] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acJIxZdZesutm6dfYM_gQAAAAMk"]
[Tue Mar 24 16:19:26.227554 2026] [:error] [pid 64198:tid 64213] [client 197.255.253.18:54902] [client 197.255.253.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.255.253.18, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acJJDnVzJqf6OS_oSZ1DXAAAAU0"]
[Tue Mar 24 16:20:29.551686 2026] [:error] [pid 64198:tid 64203] [client 197.255.253.18:55728] [client 197.255.253.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.255.253.18, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acJJTXVzJqf6OS_oSZ1DuwAAAUM"]
[Tue Mar 24 16:22:21.936753 2026] [:error] [pid 64198:tid 64211] [client 197.255.253.18:56642] [client 197.255.253.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.255.253.18, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acJJvXVzJqf6OS_oSZ1EdgAAAUs"]
[Tue Mar 24 16:23:33.560696 2026] [:error] [pid 48214:tid 48276] [client 197.255.253.18:56881] [client 197.255.253.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.255.253.18, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acJKBbeshLWZ3uUDHKlDqQAAAdg"]
[Tue Mar 24 16:33:05.667720 2026] [:error] [pid 3137:tid 3163] [client 31.57.219.162:54128] [client 31.57.219.162] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.57.219.162, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acJMQZdZesutm6dfYM_juQAAANg"]
[Tue Mar 24 16:49:04.532080 2026] [:error] [pid 48219:tid 48284] [client 49.7.227.204:58164] [client 49.7.227.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acJQAChf3b4R_lAIyv9KnwAAAgM"]
[Tue Mar 24 17:54:36.160136 2026] [:error] [pid 3137:tid 3149] [client 34.24.124.157:54423] [client 34.24.124.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.24.124.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acJfXJdZesutm6dfYM8BUAAAAMo"]
[Tue Mar 24 17:54:38.152502 2026] [:error] [pid 3137:tid 3158] [client 34.24.124.157:54423] [client 34.24.124.157] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "acJfXpdZesutm6dfYM8BUwAAANM"]
[Tue Mar 24 17:54:38.386067 2026] [:error] [pid 3137:tid 3161] [client 34.24.124.157:54423] [client 34.24.124.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.24.124.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acJfXpdZesutm6dfYM8BVAAAANY"]
[Tue Mar 24 17:54:39.716932 2026] [:error] [pid 48214:tid 48262] [client 34.24.124.157:64054] [client 34.24.124.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.24.124.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acJfX7eshLWZ3uUDHKlUyAAAAco"]
[Tue Mar 24 17:54:41.063219 2026] [:error] [pid 3137:tid 3139] [client 34.24.124.157:53468] [client 34.24.124.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.24.124.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acJfYZdZesutm6dfYM8BVwAAAMA"]
[Tue Mar 24 17:54:42.353594 2026] [:error] [pid 48214:tid 48254] [client 34.24.124.157:61007] [client 34.24.124.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.24.124.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acJfYreshLWZ3uUDHKlUywAAAcI"]
[Tue Mar 24 17:54:43.665136 2026] [:error] [pid 38767:tid 38791] [client 34.24.124.157:58783] [client 34.24.124.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.24.124.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acJfY_wkUqN4GJAI5oXc9QAAARU"]
[Tue Mar 24 17:54:43.665267 2026] [:error] [pid 38767:tid 38791] [client 34.24.124.157:58783] [client 34.24.124.157] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.24.124.157, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acJfY_wkUqN4GJAI5oXc9QAAARU"]
[Tue Mar 24 18:38:58.203509 2026] [:error] [pid 38767:tid 38780] [client 49.51.39.209:38346] [client 49.51.39.209] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acJpwvwkUqN4GJAI5oX62AAAAQo"]
[Tue Mar 24 18:39:25.701051 2026] [:error] [pid 48128:tid 48160] [client 2.57.170.193:47155] [client 2.57.170.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "acJp3cvR4LIMFLbM5Vkv7AAAAYg"]
[Tue Mar 24 18:39:27.999189 2026] [:error] [pid 48219:tid 48303] [client 2.57.170.197:48943] [client 2.57.170.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "acJp3yhf3b4R_lAIyv9oPQAAAhY"]
[Tue Mar 24 18:39:41.211805 2026] [:error] [pid 64198:tid 64202] [client 2.57.170.183:54245] [client 2.57.170.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "acJp7XVzJqf6OS_oSZ2IewAAAUI"]
[Tue Mar 24 18:40:00.667289 2026] [proxy_fcgi:error] [pid 38767:tid 38789] [client 2.57.170.201:44661] AH01071: Got error 'PHP message: PHP Warning:  Use of undefined constant ABSPATH - assumed 'ABSPATH' (this will throw an Error in a future version of PHP) in /home/expressi/public_html/wp-settings.php on line 34PHP message: PHP Warning:  require(ABSPATHwp-includes/version.php): failed to open stream: No such file or directory in /home/expressi/public_html/wp-settings.php on line 34PHP message: PHP Warning:  require(ABSPATHwp-includes/version.php): failed to open stream: No such file or directory in /home/expressi/public_html/wp-settings.php on line 34PHP message: PHP Fatal error:  require(): Failed opening required 'ABSPATHwp-includes/version.php' (include_path='.:') in /home/expressi/public_html/wp-settings.php on line 34'
[Tue Mar 24 18:41:09.059708 2026] [:error] [pid 48128:tid 48173] [client 2.57.170.206:43969] [client 2.57.170.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "acJqRcvR4LIMFLbM5VkwUgAAAZQ"]
[Tue Mar 24 18:41:09.728925 2026] [:error] [pid 48128:tid 48158] [client 2.57.170.216:27235] [client 2.57.170.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/chosen.php"] [unique_id "acJqRcvR4LIMFLbM5VkwUwAAAYc"]
[Tue Mar 24 18:41:11.619766 2026] [:error] [pid 48219:tid 48291] [client 2.57.170.193:35811] [client 2.57.170.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "acJqRyhf3b4R_lAIyv9ovAAAAgo"]
[Tue Mar 24 18:41:12.225326 2026] [:error] [pid 3030:tid 3072] [client 2.57.170.183:28163] [client 2.57.170.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "acJqSAyOuILyynfcqflULQAAABc"]
[Tue Mar 24 18:41:13.565604 2026] [:error] [pid 38767:tid 38787] [client 2.57.170.192:33855] [client 2.57.170.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "acJqSfwkUqN4GJAI5oX8mAAAARE"]
[Tue Mar 24 18:41:17.693933 2026] [:error] [pid 3137:tid 3143] [client 2.57.170.187:40051] [client 2.57.170.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "acJqTZdZesutm6dfYM8SggAAAMQ"]
[Tue Mar 24 18:41:18.308835 2026] [:error] [pid 38767:tid 38776] [client 2.57.170.200:44619] [client 2.57.170.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "acJqTvwkUqN4GJAI5oX8mgAAAQY"]
[Tue Mar 24 18:41:21.999332 2026] [:error] [pid 48128:tid 48156] [client 2.57.170.206:25467] [client 2.57.170.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "acJqUcvR4LIMFLbM5VkwXAAAAYY"]
[Tue Mar 24 18:41:26.462180 2026] [:error] [pid 64198:tid 64214] [client 2.57.170.216:50963] [client 2.57.170.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "acJqVnVzJqf6OS_oSZ2JGQAAAU4"]
[Tue Mar 24 18:41:27.056414 2026] [:error] [pid 3137:tid 3143] [client 2.57.170.205:24583] [client 2.57.170.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "acJqV5dZesutm6dfYM8SkAAAAMQ"]
[Tue Mar 24 18:41:27.744671 2026] [:error] [pid 38767:tid 38792] [client 2.57.170.60:43589] [client 2.57.170.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/about.php"] [unique_id "acJqV_wkUqN4GJAI5oX8owAAARY"]
[Tue Mar 24 18:41:28.423733 2026] [:error] [pid 64198:tid 64224] [client 2.57.170.174:34281] [client 2.57.170.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/about.php"] [unique_id "acJqWHVzJqf6OS_oSZ2JIQAAAVg"]
[Tue Mar 24 18:41:35.803911 2026] [:error] [pid 3031:tid 3081] [client 2.57.170.214:58467] [client 2.57.170.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "acJqX6JBKytnG47nuiYvawAAAEU"]
[Tue Mar 24 18:41:37.706202 2026] [:error] [pid 64198:tid 64202] [client 2.57.170.2:31773] [client 2.57.170.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.2, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "acJqYXVzJqf6OS_oSZ2JNgAAAUI"]
[Tue Mar 24 18:41:40.061388 2026] [:error] [pid 64198:tid 64213] [client 2.57.170.2:31773] [client 2.57.170.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/class-config.php"] [unique_id "acJqZHVzJqf6OS_oSZ2JOwAAAU0"]
[Tue Mar 24 18:41:46.891962 2026] [:error] [pid 48128:tid 48152] [client 2.57.170.182:54097] [client 2.57.170.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "acJqasvR4LIMFLbM5VkwbQAAAYM"]
[Tue Mar 24 18:41:51.160605 2026] [:error] [pid 3031:tid 3083] [client 2.57.170.189:53071] [client 2.57.170.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bak.php"] [unique_id "acJqb6JBKytnG47nuiYvcQAAAEc"]
[Tue Mar 24 18:41:51.784395 2026] [:error] [pid 3137:tid 3150] [client 2.57.170.181:46437] [client 2.57.170.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "acJqb5dZesutm6dfYM8SpgAAAMs"]
[Tue Mar 24 18:41:54.643778 2026] [:error] [pid 64198:tid 64207] [client 2.57.170.204:58023] [client 2.57.170.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "acJqcnVzJqf6OS_oSZ2JWQAAAUc"]
[Tue Mar 24 18:41:59.114168 2026] [:error] [pid 48214:tid 48270] [client 2.57.170.194:34441] [client 2.57.170.194] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/about.php"] [unique_id "acJqd7eshLWZ3uUDHKldQwAAAdI"]
[Tue Mar 24 18:41:59.784002 2026] [:error] [pid 38767:tid 38790] [client 2.57.170.175:58135] [client 2.57.170.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "acJqd_wkUqN4GJAI5oX86gAAARQ"]
[Tue Mar 24 18:42:02.704848 2026] [:error] [pid 48214:tid 48266] [client 2.57.170.172:61013] [client 2.57.170.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/index.php"] [unique_id "acJqereshLWZ3uUDHKldRgAAAc4"]
[Tue Mar 24 18:42:03.301873 2026] [:error] [pid 3031:tid 3099] [client 2.57.170.205:31691] [client 2.57.170.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "acJqe6JBKytnG47nuiYvcwAAAFc"]
[Tue Mar 24 18:42:06.374063 2026] [:error] [pid 38767:tid 38788] [client 2.57.170.183:20797] [client 2.57.170.183] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "acJqfvwkUqN4GJAI5oX9BgAAARI"]
[Tue Mar 24 18:42:06.961880 2026] [:error] [pid 3137:tid 3162] [client 2.57.170.212:43857] [client 2.57.170.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Content/index.php"] [unique_id "acJqfpdZesutm6dfYM8SrwAAANc"]
[Tue Mar 24 18:42:07.811930 2026] [:error] [pid 48214:tid 48259] [client 2.57.170.176:31211] [client 2.57.170.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "acJqf7eshLWZ3uUDHKldTQAAAcc"]
[Tue Mar 24 18:42:09.799877 2026] [:error] [pid 3137:tid 3144] [client 2.57.170.174:22169] [client 2.57.170.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/autoload_classmap.php"] [unique_id "acJqgZdZesutm6dfYM8SuAAAAMU"]
[Tue Mar 24 18:42:10.446222 2026] [:error] [pid 48219:tid 48287] [client 2.57.170.206:38545] [client 2.57.170.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "acJqgihf3b4R_lAIyv9pBAAAAgY"]
[Tue Mar 24 18:42:11.074412 2026] [:error] [pid 3137:tid 3155] [client 2.57.170.172:21965] [client 2.57.170.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "acJqg5dZesutm6dfYM8SugAAANA"]
[Tue Mar 24 18:42:11.667623 2026] [:error] [pid 48219:tid 48281] [client 2.57.170.209:55219] [client 2.57.170.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/autoload_classmap.php"] [unique_id "acJqgyhf3b4R_lAIyv9pCwAAAgA"]
[Tue Mar 24 18:42:12.328267 2026] [:error] [pid 48219:tid 48299] [client 2.57.170.206:52443] [client 2.57.170.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "acJqhChf3b4R_lAIyv9pDQAAAhI"]
[Tue Mar 24 18:42:13.675602 2026] [:error] [pid 64198:tid 64223] [client 2.57.170.202:48609] [client 2.57.170.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "acJqhXVzJqf6OS_oSZ2JggAAAVc"]
[Tue Mar 24 18:42:20.764571 2026] [:error] [pid 38767:tid 38778] [client 2.57.170.209:51703] [client 2.57.170.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "acJqjPwkUqN4GJAI5oX9IQAAAQg"]
[Tue Mar 24 18:42:21.384796 2026] [:error] [pid 3030:tid 3059] [client 2.57.170.202:26853] [client 2.57.170.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/network.php"] [unique_id "acJqjQyOuILyynfcqflUPQAAAAo"]
[Tue Mar 24 18:42:21.972163 2026] [:error] [pid 48214:tid 48265] [client 2.57.170.193:27847] [client 2.57.170.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/php-compat/autoload_classmap.php"] [unique_id "acJqjbeshLWZ3uUDHKldVgAAAc0"]
[Tue Mar 24 18:42:24.903197 2026] [:error] [pid 48214:tid 48255] [client 2.57.170.208:61425] [client 2.57.170.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "acJqkLeshLWZ3uUDHKldWgAAAcM"]
[Tue Mar 24 18:42:25.567220 2026] [:error] [pid 48219:tid 48301] [client 2.57.170.173:26201] [client 2.57.170.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "acJqkShf3b4R_lAIyv9pJAAAAhQ"]
[Tue Mar 24 18:42:28.043405 2026] [:error] [pid 3137:tid 3159] [client 2.57.170.184:51943] [client 2.57.170.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "acJqlJdZesutm6dfYM8S2gAAANQ"]
[Tue Mar 24 18:42:30.022634 2026] [:error] [pid 38767:tid 38784] [client 2.57.170.196:60675] [client 2.57.170.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "acJqlvwkUqN4GJAI5oX9UQAAAQ4"]
[Tue Mar 24 18:42:30.995314 2026] [:error] [pid 64198:tid 64203] [client 2.57.170.181:25863] [client 2.57.170.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "acJqlnVzJqf6OS_oSZ2JlwAAAUM"]
[Tue Mar 24 18:42:31.626404 2026] [:error] [pid 64198:tid 64209] [client 2.57.170.200:44869] [client 2.57.170.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "acJql3VzJqf6OS_oSZ2JmQAAAUk"]
[Tue Mar 24 18:42:33.605602 2026] [:error] [pid 64198:tid 64201] [client 2.57.170.200:34209] [client 2.57.170.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "acJqmXVzJqf6OS_oSZ2JnAAAAUE"]
[Tue Mar 24 18:42:35.880043 2026] [:error] [pid 64198:tid 64221] [client 2.57.170.2:61285] [client 2.57.170.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "acJqm3VzJqf6OS_oSZ2JoQAAAVU"]
[Tue Mar 24 18:42:37.933805 2026] [:error] [pid 3031:tid 3095] [client 2.57.170.207:59359] [client 2.57.170.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "acJqnaJBKytnG47nuiYvggAAAFM"]
[Tue Mar 24 18:42:39.755956 2026] [:error] [pid 3137:tid 3162] [client 2.57.170.203:30439] [client 2.57.170.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "acJqn5dZesutm6dfYM8S4QAAANc"]
[Tue Mar 24 18:42:41.305591 2026] [:error] [pid 3137:tid 3146] [client 2.57.170.199:64373] [client 2.57.170.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "acJqoZdZesutm6dfYM8S5gAAAMc"]
[Tue Mar 24 18:42:44.755991 2026] [:error] [pid 48219:tid 48301] [client 2.57.170.174:60253] [client 2.57.170.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "acJqpChf3b4R_lAIyv9pTAAAAhQ"]
[Tue Mar 24 18:42:47.090142 2026] [:error] [pid 3137:tid 3157] [client 2.57.170.203:53485] [client 2.57.170.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/about.php"] [unique_id "acJqp5dZesutm6dfYM8S7gAAANI"]
[Tue Mar 24 18:42:49.753683 2026] [:error] [pid 3032:tid 3124] [client 2.57.170.189:27935] [client 2.57.170.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "acJqqSa_-JXXD03-JNxH5QAAAJU"]
[Tue Mar 24 18:42:50.374984 2026] [:error] [pid 3137:tid 3144] [client 2.57.170.195:33015] [client 2.57.170.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "acJqqpdZesutm6dfYM8S7wAAAMU"]
[Tue Mar 24 18:42:51.036202 2026] [:error] [pid 3137:tid 3150] [client 2.57.170.204:37885] [client 2.57.170.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/index.php"] [unique_id "acJqq5dZesutm6dfYM8S8QAAAMs"]
[Tue Mar 24 18:42:51.708918 2026] [:error] [pid 3137:tid 3143] [client 2.57.170.199:62591] [client 2.57.170.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "acJqq5dZesutm6dfYM8S9AAAAMQ"]
[Tue Mar 24 18:42:52.373313 2026] [:error] [pid 3137:tid 3162] [client 2.57.170.219:36259] [client 2.57.170.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "acJqrJdZesutm6dfYM8S9wAAANc"]
[Tue Mar 24 18:42:54.436132 2026] [:error] [pid 48219:tid 48291] [client 2.57.170.180:60643] [client 2.57.170.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.180, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-login.php"] [unique_id "acJqrihf3b4R_lAIyv9pYQAAAgo"]
[Tue Mar 24 18:42:55.335211 2026] [:error] [pid 48219:tid 48283] [client 2.57.170.180:60643] [client 2.57.170.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "acJqryhf3b4R_lAIyv9pYwAAAgI"]
[Tue Mar 24 18:42:55.977198 2026] [:error] [pid 48214:tid 48272] [client 2.57.170.181:43879] [client 2.57.170.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/index.php"] [unique_id "acJqr7eshLWZ3uUDHKldcgAAAdQ"]
[Tue Mar 24 18:42:57.848455 2026] [:error] [pid 48219:tid 48293] [client 2.57.170.177:20595] [client 2.57.170.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/autoload_classmap.php"] [unique_id "acJqsShf3b4R_lAIyv9pbAAAAgw"]
[Tue Mar 24 18:42:58.458598 2026] [:error] [pid 64198:tid 64212] [client 2.57.170.217:40699] [client 2.57.170.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rk2.php"] [unique_id "acJqsnVzJqf6OS_oSZ2JvwAAAUw"]
[Tue Mar 24 18:43:01.328156 2026] [:error] [pid 3137:tid 3153] [client 2.57.170.186:28479] [client 2.57.170.186] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "acJqtZdZesutm6dfYM8TBAAAAM4"]
[Tue Mar 24 18:43:01.942309 2026] [:error] [pid 3137:tid 3160] [client 2.57.170.216:36043] [client 2.57.170.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/about.php"] [unique_id "acJqtZdZesutm6dfYM8TBQAAANU"]
[Tue Mar 24 18:43:02.566160 2026] [:error] [pid 3137:tid 3147] [client 2.57.170.209:30679] [client 2.57.170.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/button/index.php"] [unique_id "acJqtpdZesutm6dfYM8TBgAAAMg"]
[Tue Mar 24 18:43:05.278029 2026] [:error] [pid 38767:tid 38786] [client 2.57.170.195:26945] [client 2.57.170.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "acJqufwkUqN4GJAI5oX9gwAAARA"]
[Tue Mar 24 18:43:05.919250 2026] [:error] [pid 3137:tid 3148] [client 2.57.170.178:34739] [client 2.57.170.178] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.178, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/wp-login.php"] [unique_id "acJquZdZesutm6dfYM8TCgAAAMk"]
[Tue Mar 24 18:43:09.098785 2026] [:error] [pid 3137:tid 3152] [client 2.57.170.178:34739] [client 2.57.170.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "acJqvZdZesutm6dfYM8TEQAAAM0"]
[Tue Mar 24 18:43:11.011831 2026] [:error] [pid 3030:tid 3067] [client 2.57.170.174:34785] [client 2.57.170.174] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/file.php"] [unique_id "acJqvwyOuILyynfcqflUSwAAABI"]
[Tue Mar 24 18:43:13.625735 2026] [:error] [pid 48214:tid 48262] [client 2.57.170.189:30713] [client 2.57.170.189] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/components/about.php"] [unique_id "acJqwbeshLWZ3uUDHKldiAAAAco"]
[Tue Mar 24 18:43:14.235835 2026] [:error] [pid 48214:tid 48271] [client 2.57.170.60:33353] [client 2.57.170.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "acJqwreshLWZ3uUDHKldiQAAAdM"]
[Tue Mar 24 18:43:20.091874 2026] [:error] [pid 48219:tid 48305] [client 2.57.170.184:22021] [client 2.57.170.184] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.170.184, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "acJqyChf3b4R_lAIyv9piQAAAhg"]
[Tue Mar 24 18:43:21.736600 2026] [:error] [pid 48219:tid 48303] [client 2.57.170.184:22021] [client 2.57.170.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/network.php"] [unique_id "acJqyShf3b4R_lAIyv9pjQAAAhY"]
[Tue Mar 24 18:43:25.289467 2026] [:error] [pid 38767:tid 38794] [client 2.57.170.212:42831] [client 2.57.170.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "acJqzfwkUqN4GJAI5oX9qgAAARg"]
[Tue Mar 24 18:43:25.890417 2026] [:error] [pid 48214:tid 48262] [client 2.57.170.212:39447] [client 2.57.170.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/about.php"] [unique_id "acJqzbeshLWZ3uUDHKldkAAAAco"]
[Tue Mar 24 18:43:28.793832 2026] [:error] [pid 64198:tid 64211] [client 2.57.170.212:34085] [client 2.57.170.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/file.php"] [unique_id "acJq0HVzJqf6OS_oSZ2J8AAAAUs"]
[Tue Mar 24 18:43:29.472250 2026] [:error] [pid 64198:tid 64222] [client 2.57.170.215:39235] [client 2.57.170.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "acJq0XVzJqf6OS_oSZ2J8QAAAVY"]
[Tue Mar 24 18:43:30.181621 2026] [:error] [pid 38767:tid 38794] [client 2.57.170.195:22695] [client 2.57.170.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "acJq0vwkUqN4GJAI5oX9vgAAARg"]
[Tue Mar 24 18:43:34.117298 2026] [:error] [pid 3032:tid 3114] [client 2.57.170.193:35221] [client 2.57.170.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/widgets/about.php"] [unique_id "acJq1ia_-JXXD03-JNxH-gAAAIs"]
[Tue Mar 24 18:43:40.005161 2026] [:error] [pid 38767:tid 38770] [client 2.57.170.190:21901] [client 2.57.170.190] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/s/tinymce/skins/lightgray/fonts/index.php"] [unique_id "acJq3PwkUqN4GJAI5oX95gAAAQA"]
[Tue Mar 24 18:43:40.607454 2026] [:error] [pid 48219:tid 48305] [client 2.57.170.205:52759] [client 2.57.170.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/compat3x/css/index.php"] [unique_id "acJq3Chf3b4R_lAIyv9pnQAAAhg"]
[Tue Mar 24 18:43:41.204671 2026] [:error] [pid 48219:tid 48297] [client 2.57.170.193:60193] [client 2.57.170.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "acJq3Shf3b4R_lAIyv9pnwAAAhA"]
[Tue Mar 24 18:43:43.222466 2026] [:error] [pid 38767:tid 38791] [client 2.57.170.173:65049] [client 2.57.170.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/css.php"] [unique_id "acJq3_wkUqN4GJAI5oX98AAAARU"]
[Tue Mar 24 18:43:45.339889 2026] [:error] [pid 64198:tid 64219] [client 2.57.170.188:24089] [client 2.57.170.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/test.php"] [unique_id "acJq4XVzJqf6OS_oSZ2J_gAAAVM"]
[Tue Mar 24 18:43:45.944898 2026] [:error] [pid 38767:tid 38788] [client 2.57.170.217:39333] [client 2.57.170.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "acJq4fwkUqN4GJAI5oX9-QAAARI"]
[Tue Mar 24 18:43:50.415772 2026] [:error] [pid 48219:tid 48285] [client 2.57.170.191:41361] [client 2.57.170.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/themes.php"] [unique_id "acJq5ihf3b4R_lAIyv9puAAAAgQ"]
[Tue Mar 24 18:43:51.093619 2026] [:error] [pid 3137:tid 3151] [client 2.57.170.187:54237] [client 2.57.170.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/site-title/index.php"] [unique_id "acJq55dZesutm6dfYM8TVQAAAMw"]
[Tue Mar 24 18:43:51.755971 2026] [:error] [pid 3031:tid 3094] [client 2.57.170.205:51001] [client 2.57.170.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-includes/admin-bar.php"] [unique_id "acJq56JBKytnG47nuiYviAAAAFI"]
[Tue Mar 24 18:43:56.178986 2026] [:error] [pid 3031:tid 3095] [client 2.57.170.204:33091] [client 2.57.170.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/plugins.php"] [unique_id "acJq7KJBKytnG47nuiYvkAAAAFM"]
[Tue Mar 24 18:43:56.852593 2026] [:error] [pid 38767:tid 38771] [client 2.57.170.173:63945] [client 2.57.170.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/pomo.php"] [unique_id "acJq7PwkUqN4GJAI5oX-TAAAAQE"]
[Tue Mar 24 18:43:57.468421 2026] [:error] [pid 38767:tid 38774] [client 2.57.170.211:56345] [client 2.57.170.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "acJq7fwkUqN4GJAI5oX-UQAAAQQ"]
[Tue Mar 24 18:44:04.629989 2026] [autoindex:error] [pid 48219:tid 48289] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:06.643607 2026] [autoindex:error] [pid 48219:tid 48300] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:07.814601 2026] [autoindex:error] [pid 48219:tid 48293] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:08.129525 2026] [autoindex:error] [pid 48219:tid 48282] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:08.434491 2026] [autoindex:error] [pid 48219:tid 48294] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:08.846464 2026] [autoindex:error] [pid 48219:tid 48284] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:09.468891 2026] [autoindex:error] [pid 48219:tid 48295] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:09.787963 2026] [autoindex:error] [pid 48219:tid 48288] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:10.108400 2026] [autoindex:error] [pid 48219:tid 48297] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:10.450848 2026] [autoindex:error] [pid 48219:tid 48298] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:15.489578 2026] [autoindex:error] [pid 48219:tid 48291] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:33.072376 2026] [autoindex:error] [pid 48219:tid 48281] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:33.392905 2026] [autoindex:error] [pid 48219:tid 48286] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:33.708332 2026] [autoindex:error] [pid 48219:tid 48302] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:34.222852 2026] [autoindex:error] [pid 48219:tid 48283] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:34.540899 2026] [autoindex:error] [pid 48219:tid 48303] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:34.860954 2026] [autoindex:error] [pid 48219:tid 48287] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:35.168312 2026] [autoindex:error] [pid 48219:tid 48292] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:37.115420 2026] [autoindex:error] [pid 48219:tid 48298] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:37.423405 2026] [autoindex:error] [pid 48219:tid 48304] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:38.810389 2026] [autoindex:error] [pid 48219:tid 48283] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:39.930865 2026] [autoindex:error] [pid 48219:tid 48287] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:40.260409 2026] [autoindex:error] [pid 48219:tid 48292] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:40.559790 2026] [autoindex:error] [pid 48219:tid 48305] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:41.703045 2026] [autoindex:error] [pid 48219:tid 48282] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:41.998566 2026] [autoindex:error] [pid 48219:tid 48294] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:43.632160 2026] [autoindex:error] [pid 48219:tid 48304] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:43.971097 2026] [autoindex:error] [pid 48219:tid 48301] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:44.282070 2026] [autoindex:error] [pid 48219:tid 48297] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:50.330012 2026] [autoindex:error] [pid 48219:tid 48285] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:57.321963 2026] [autoindex:error] [pid 48219:tid 48283] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:44:59.992410 2026] [autoindex:error] [pid 48219:tid 48292] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:00.336967 2026] [autoindex:error] [pid 48219:tid 48305] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:02.513041 2026] [autoindex:error] [pid 48219:tid 48303] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:02.888803 2026] [autoindex:error] [pid 48219:tid 48300] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:03.280918 2026] [autoindex:error] [pid 48219:tid 48288] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:03.617318 2026] [autoindex:error] [pid 48219:tid 48298] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:03.949641 2026] [autoindex:error] [pid 48219:tid 48294] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:04.272758 2026] [autoindex:error] [pid 48219:tid 48293] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:04.601273 2026] [autoindex:error] [pid 48219:tid 48295] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:04.918915 2026] [autoindex:error] [pid 48219:tid 48301] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:05.258085 2026] [autoindex:error] [pid 48219:tid 48283] [client 2.57.170.194:46789] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:12.902579 2026] [autoindex:error] [pid 3137:tid 3154] [client 2.57.170.174:41963] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:19.724902 2026] [autoindex:error] [pid 3137:tid 3160] [client 2.57.170.174:41963] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:20.043978 2026] [autoindex:error] [pid 3137:tid 3152] [client 2.57.170.174:41963] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:36.101633 2026] [autoindex:error] [pid 3137:tid 3156] [client 2.57.170.174:41963] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/paste/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:36.409670 2026] [autoindex:error] [pid 3137:tid 3158] [client 2.57.170.174:41963] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:39.451262 2026] [autoindex:error] [pid 3137:tid 3146] [client 2.57.170.174:41963] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:41.358421 2026] [autoindex:error] [pid 3137:tid 3149] [client 2.57.170.174:41963] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/directionality/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:42.485541 2026] [autoindex:error] [pid 3137:tid 3156] [client 2.57.170.174:41963] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/search/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:42.825003 2026] [autoindex:error] [pid 3137:tid 3158] [client 2.57.170.174:41963] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/compat3x/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:43.905818 2026] [autoindex:error] [pid 3137:tid 3158] [client 2.57.170.174:41963] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:45.044675 2026] [autoindex:error] [pid 3137:tid 3154] [client 2.57.170.174:41963] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:45.674398 2026] [autoindex:error] [pid 3137:tid 3151] [client 2.57.170.174:41963] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:45.974777 2026] [autoindex:error] [pid 3137:tid 3144] [client 2.57.170.174:41963] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/classic-editor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:46.280688 2026] [proxy_fcgi:error] [pid 3137:tid 3158] [client 2.57.170.174:41963] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_header() in /home/expressi/public_html/wp-content/themes/twentytwentyone/index.php:17\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/themes/twentytwentyone/index.php on line 17'
[Tue Mar 24 18:45:49.082742 2026] [autoindex:error] [pid 38767:tid 38781] [client 2.57.170.176:29879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:54.130867 2026] [autoindex:error] [pid 38767:tid 38786] [client 2.57.170.176:29879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/paragraph/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:58.544132 2026] [autoindex:error] [pid 38767:tid 38781] [client 2.57.170.176:29879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/nux/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:59.642483 2026] [autoindex:error] [pid 38767:tid 38779] [client 2.57.170.176:29879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/lists/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:45:59.992151 2026] [autoindex:error] [pid 38767:tid 38781] [client 2.57.170.176:29879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:46:01.928282 2026] [autoindex:error] [pid 38767:tid 38788] [client 2.57.170.176:29879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:46:04.634444 2026] [autoindex:error] [pid 38767:tid 38777] [client 2.57.170.176:29879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:46:11.733507 2026] [autoindex:error] [pid 38767:tid 38777] [client 2.57.170.176:29879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:46:12.969213 2026] [autoindex:error] [pid 38767:tid 38782] [client 2.57.170.176:29879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/social-links/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:46:20.658342 2026] [autoindex:error] [pid 38767:tid 38771] [client 2.57.170.176:29879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/src/Core/Curve25519/Ge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 18:46:26.883107 2026] [autoindex:error] [pid 38767:tid 38777] [client 2.57.170.176:29879] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 20:44:05.329552 2026] [:error] [pid 3032:tid 3106] [client 50.87.144.41:25494] [client 50.87.144.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.41, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acKHFSa_-JXXD03-JNxYVwAAAIM"]
[Tue Mar 24 20:44:06.159262 2026] [:error] [pid 3032:tid 3127] [client 50.87.144.41:25494] [client 50.87.144.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.144.41, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acKHFia_-JXXD03-JNxYWgAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Tue Mar 24 21:15:24.163783 2026] [:error] [pid 38767:tid 38779] [client 43.164.197.224:44142] [client 43.164.197.224] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acKObPwkUqN4GJAI5oVQ5wAAAQk"]
[Tue Mar 24 22:17:10.065776 2026] [:error] [pid 64198:tid 64220] [client 45.94.31.99:58534] [client 45.94.31.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acKc5nVzJqf6OS_oSZ3bbQAAAVQ"]
[Tue Mar 24 22:17:11.076264 2026] [:error] [pid 3031:tid 3076] [client 45.94.31.99:61778] [client 45.94.31.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acKc56JBKytnG47nuiZAgwAAAEA"]
[Tue Mar 24 22:17:12.078165 2026] [:error] [pid 48214:tid 48258] [client 45.94.31.99:49716] [client 45.94.31.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acKc6LeshLWZ3uUDHKl_dgAAAcY"]
[Tue Mar 24 22:17:13.086603 2026] [:error] [pid 3032:tid 3115] [client 45.94.31.99:52557] [client 45.94.31.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acKc6Sa_-JXXD03-JNxkSQAAAIw"]
[Tue Mar 24 22:17:14.125165 2026] [:error] [pid 48219:tid 48301] [client 45.94.31.99:54229] [client 45.94.31.99] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acKc6ihf3b4R_lAIyv-WhwAAAhQ"]
[Tue Mar 24 22:24:08.129961 2026] [:error] [pid 64198:tid 64213] [client 68.178.245.144:59980] [client 68.178.245.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.245.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acKeiHVzJqf6OS_oSZ3dFgAAAU0"]
[Tue Mar 24 22:24:10.480345 2026] [:error] [pid 38767:tid 38784] [client 68.178.245.144:59992] [client 68.178.245.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.178.245.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acKeivwkUqN4GJAI5oVrXAAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Tue Mar 24 22:41:02.523830 2026] [autoindex:error] [pid 48214:tid 48274] [client 85.203.23.145:43705] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/php-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:02.614986 2026] [:error] [pid 48214:tid 48271] [client 85.203.23.145:43705] [client 85.203.23.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/config.php"] [unique_id "acKifreshLWZ3uUDHKmCjQAAAdM"]
[Tue Mar 24 22:41:03.541652 2026] [:error] [pid 3137:tid 3142] [client 85.203.23.132:58459] [client 85.203.23.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/header.php"] [unique_id "acKif5dZesutm6dfYM9YGwAAAMM"]
[Tue Mar 24 22:41:03.729182 2026] [:error] [pid 3030:tid 3056] [client 85.203.23.150:49971] [client 85.203.23.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/system_core.php"] [unique_id "acKifwyOuILyynfcqfls_QAAAAc"]
[Tue Mar 24 22:41:06.061760 2026] [:error] [pid 3030:tid 3066] [client 85.203.23.121:35615] [client 85.203.23.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "acKiggyOuILyynfcqfltAwAAABE"]
[Tue Mar 24 22:41:07.667689 2026] [:error] [pid 48214:tid 48254] [client 85.203.23.132:55913] [client 85.203.23.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "acKig7eshLWZ3uUDHKmCkgAAAcI"]
[Tue Mar 24 22:41:09.221878 2026] [:error] [pid 3137:tid 3160] [client 85.203.23.111:26785] [client 85.203.23.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.23.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acKihZdZesutm6dfYM9YIQAAANU"], referer: https://expressinteriors.com/wp-admin/
[Tue Mar 24 22:41:09.718576 2026] [:error] [pid 48214:tid 48265] [client 85.203.23.118:55313] [client 85.203.23.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/speculative8.php"] [unique_id "acKihbeshLWZ3uUDHKmClQAAAc0"]
[Tue Mar 24 22:41:13.332483 2026] [:error] [pid 3030:tid 3062] [client 85.203.23.119:45855] [client 85.203.23.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "acKiiQyOuILyynfcqfltBwAAAA0"]
[Tue Mar 24 22:41:14.383969 2026] [autoindex:error] [pid 3030:tid 3068] [client 85.203.23.129:59707] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:15.084935 2026] [autoindex:error] [pid 3030:tid 3072] [client 85.203.23.129:59707] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:15.189411 2026] [autoindex:error] [pid 3030:tid 3069] [client 85.203.23.129:59707] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:17.244018 2026] [:error] [pid 3032:tid 3115] [client 85.203.23.130:31187] [client 85.203.23.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.23.130, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acKijSa_-JXXD03-JNxm3gAAAIw"], referer: https://expressinteriors.com/wp-admin/
[Tue Mar 24 22:41:22.919127 2026] [:error] [pid 3030:tid 3062] [client 85.203.23.129:59707] [client 85.203.23.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "acKikgyOuILyynfcqfltHAAAAA0"]
[Tue Mar 24 22:41:23.920860 2026] [autoindex:error] [pid 48214:tid 48274] [client 85.203.23.148:60897] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:24.022251 2026] [autoindex:error] [pid 48214:tid 48271] [client 85.203.23.148:60897] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:24.121955 2026] [autoindex:error] [pid 48214:tid 48270] [client 85.203.23.148:60897] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:24.220401 2026] [autoindex:error] [pid 48214:tid 48272] [client 85.203.23.148:60897] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/block-library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:24.908850 2026] [autoindex:error] [pid 48214:tid 48252] [client 85.203.23.148:60897] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:26.501001 2026] [autoindex:error] [pid 48214:tid 48260] [client 85.203.23.148:60897] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:27.755202 2026] [autoindex:error] [pid 48214:tid 48266] [client 85.203.23.148:60897] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:27.852567 2026] [autoindex:error] [pid 48214:tid 48268] [client 85.203.23.148:60897] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:30.784232 2026] [autoindex:error] [pid 48214:tid 48269] [client 85.203.23.148:60897] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:30.897517 2026] [autoindex:error] [pid 48214:tid 48274] [client 85.203.23.148:60897] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/mediaelement/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:31.012517 2026] [autoindex:error] [pid 48214:tid 48271] [client 85.203.23.148:60897] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:31.109364 2026] [autoindex:error] [pid 48214:tid 48270] [client 85.203.23.148:60897] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:31.208103 2026] [autoindex:error] [pid 48214:tid 48272] [client 85.203.23.148:60897] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:31.314492 2026] [autoindex:error] [pid 48214:tid 48262] [client 85.203.23.148:60897] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:31.433486 2026] [autoindex:error] [pid 48214:tid 48252] [client 85.203.23.148:60897] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:31.541026 2026] [autoindex:error] [pid 48214:tid 48253] [client 85.203.23.148:60897] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:32.224486 2026] [:error] [pid 48214:tid 48257] [client 85.203.23.148:60897] [client 85.203.23.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/private/"] [unique_id "acKinLeshLWZ3uUDHKmCtgAAAcU"]
[Tue Mar 24 22:41:34.393600 2026] [proxy_fcgi:error] [pid 3031:tid 3098] [client 85.203.23.147:32619] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function add_action() in /home/expressi/public_html/wp-content/plugins/hello.php:69\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/plugins/hello.php on line 69'
[Tue Mar 24 22:41:34.584403 2026] [:error] [pid 48214:tid 48264] [client 85.203.23.164:61643] [client 85.203.23.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/about.php"] [unique_id "acKinreshLWZ3uUDHKmCtwAAAcw"]
[Tue Mar 24 22:41:34.794027 2026] [autoindex:error] [pid 64198:tid 64211] [client 85.203.23.140:56855] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:36.239050 2026] [:error] [pid 64198:tid 64219] [client 85.203.23.135:57789] [client 85.203.23.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.23.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acKioHVzJqf6OS_oSZ3iRwAAAVM"], referer: https://expressinteriors.com/wp-admin/network/
[Tue Mar 24 22:41:36.751380 2026] [autoindex:error] [pid 64198:tid 64212] [client 85.203.23.140:56855] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/src/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:37.584345 2026] [autoindex:error] [pid 64198:tid 64203] [client 85.203.23.140:56855] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:37.688123 2026] [autoindex:error] [pid 64198:tid 64204] [client 85.203.23.140:56855] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/comment-content/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:39.512117 2026] [autoindex:error] [pid 64198:tid 64224] [client 85.203.23.140:56855] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/nextpage/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:40.218312 2026] [autoindex:error] [pid 64198:tid 64206] [client 85.203.23.140:56855] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:40.321046 2026] [autoindex:error] [pid 64198:tid 64218] [client 85.203.23.140:56855] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:41.007220 2026] [autoindex:error] [pid 64198:tid 64221] [client 85.203.23.140:56855] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:41.103054 2026] [autoindex:error] [pid 64198:tid 64201] [client 85.203.23.140:56855] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/image/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:41.762525 2026] [autoindex:error] [pid 64198:tid 64206] [client 85.203.23.140:56855] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:41.864220 2026] [autoindex:error] [pid 64198:tid 64204] [client 85.203.23.140:56855] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:42.524886 2026] [autoindex:error] [pid 64198:tid 64213] [client 85.203.23.140:56855] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:43.185014 2026] [autoindex:error] [pid 64198:tid 64208] [client 85.203.23.140:56855] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:43.850945 2026] [autoindex:error] [pid 64198:tid 64221] [client 85.203.23.140:56855] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/post-comments-form/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:44.539985 2026] [:error] [pid 64198:tid 64214] [client 85.203.23.140:56855] [client 85.203.23.140] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/template-singl-portfolio.php"] [unique_id "acKiqHVzJqf6OS_oSZ3icAAAAU4"]
[Tue Mar 24 22:41:47.767971 2026] [autoindex:error] [pid 3137:tid 3152] [client 85.203.23.118:34597] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:47.858573 2026] [:error] [pid 3137:tid 3153] [client 85.203.23.118:34597] [client 85.203.23.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/themes/about.php"] [unique_id "acKiq5dZesutm6dfYM9YYAAAAM4"]
[Tue Mar 24 22:41:49.347367 2026] [autoindex:error] [pid 48219:tid 48282] [client 85.203.23.162:42127] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/column/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:50.004663 2026] [autoindex:error] [pid 48219:tid 48292] [client 85.203.23.162:42127] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/post-terms/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:50.105552 2026] [autoindex:error] [pid 48219:tid 48298] [client 85.203.23.162:42127] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:50.201913 2026] [autoindex:error] [pid 48219:tid 48286] [client 85.203.23.162:42127] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:53.105030 2026] [autoindex:error] [pid 48219:tid 48302] [client 85.203.23.162:42127] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:54.894510 2026] [:error] [pid 48219:tid 48300] [client 85.203.23.162:42127] [client 85.203.23.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/"] [unique_id "acKisihf3b4R_lAIyv-bsAAAAhM"]
[Tue Mar 24 22:41:57.575420 2026] [autoindex:error] [pid 3137:tid 3157] [client 85.203.23.164:64717] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/pullquote/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:57.686908 2026] [autoindex:error] [pid 3137:tid 3142] [client 85.203.23.164:64717] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyone/template-parts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:58.366413 2026] [autoindex:error] [pid 3137:tid 3149] [client 85.203.23.164:64717] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/social-links/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:59.038199 2026] [autoindex:error] [pid 3137:tid 3158] [client 85.203.23.164:64717] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/navigation-submenu/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:59.135991 2026] [autoindex:error] [pid 3137:tid 3144] [client 85.203.23.164:64717] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/paragraph/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:41:59.813368 2026] [autoindex:error] [pid 3137:tid 3145] [client 85.203.23.164:64717] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/video/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:01.082111 2026] [autoindex:error] [pid 3137:tid 3161] [client 85.203.23.164:64717] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:01.180400 2026] [autoindex:error] [pid 3137:tid 3157] [client 85.203.23.164:64717] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:04.580544 2026] [:error] [pid 3032:tid 3112] [client 85.203.23.127:26089] [client 85.203.23.127] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.23.127, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acKivCa_-JXXD03-JNxm7gAAAIk"], referer: https://expressinteriors.com/wp-admin/about.php
[Tue Mar 24 22:42:05.073410 2026] [autoindex:error] [pid 3137:tid 3139] [client 85.203.23.164:64717] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:05.177828 2026] [autoindex:error] [pid 3137:tid 3151] [client 85.203.23.164:64717] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:05.268913 2026] [:error] [pid 3137:tid 3147] [client 85.203.23.164:64717] [client 85.203.23.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/k.php"] [unique_id "acKivZdZesutm6dfYM9YjwAAAMg"]
[Tue Mar 24 22:42:07.415088 2026] [autoindex:error] [pid 64198:tid 64209] [client 85.203.23.125:31523] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:07.509270 2026] [autoindex:error] [pid 64198:tid 64207] [client 85.203.23.125:31523] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:08.150812 2026] [autoindex:error] [pid 64198:tid 64205] [client 85.203.23.125:31523] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:08.345819 2026] [autoindex:error] [pid 64198:tid 64210] [client 85.203.23.125:31523] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://expressinteriors.com/wp-includes/js/dist
[Tue Mar 24 22:42:08.444844 2026] [autoindex:error] [pid 64198:tid 64201] [client 85.203.23.125:31523] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:10.840657 2026] [:error] [pid 64198:tid 64204] [client 85.203.23.125:31523] [client 85.203.23.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "acKiwnVzJqf6OS_oSZ3ikgAAAUQ"]
[Tue Mar 24 22:42:12.416727 2026] [:error] [pid 48219:tid 48305] [client 85.203.23.132:44737] [client 85.203.23.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.203.23.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acKixChf3b4R_lAIyv-bxAAAAhg"]
[Tue Mar 24 22:42:14.077144 2026] [autoindex:error] [pid 48219:tid 48288] [client 85.203.23.132:44737] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:15.381446 2026] [autoindex:error] [pid 48219:tid 48291] [client 85.203.23.132:44737] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:16.614123 2026] [autoindex:error] [pid 48219:tid 48303] [client 85.203.23.132:44737] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentytwo/assets/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:16.713190 2026] [autoindex:error] [pid 48219:tid 48289] [client 85.203.23.132:44737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/customize-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:16.810629 2026] [autoindex:error] [pid 48219:tid 48301] [client 85.203.23.132:44737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:16.911660 2026] [autoindex:error] [pid 48219:tid 48290] [client 85.203.23.132:44737] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/audio/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:18.756993 2026] [:error] [pid 48219:tid 48286] [client 85.203.23.132:44737] [client 85.203.23.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/block-bindings/"] [unique_id "acKiyihf3b4R_lAIyv-b3gAAAgU"]
[Tue Mar 24 22:42:21.406731 2026] [autoindex:error] [pid 3137:tid 3161] [client 85.203.23.119:57063] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:25.506313 2026] [:error] [pid 3137:tid 3155] [client 85.203.23.119:57063] [client 85.203.23.119] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/reception1/includes/tcpdf/examples/config/"] [unique_id "acKi0ZdZesutm6dfYM9YtAAAANA"]
[Tue Mar 24 22:42:27.010616 2026] [autoindex:error] [pid 38767:tid 38776] [client 85.203.23.133:25449] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:27.106440 2026] [autoindex:error] [pid 38767:tid 38790] [client 85.203.23.133:25449] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:27.202580 2026] [autoindex:error] [pid 38767:tid 38786] [client 85.203.23.133:25449] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/Auth/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:27.401602 2026] [autoindex:error] [pid 38767:tid 38789] [client 85.203.23.133:25449] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/page-list/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:31.006445 2026] [autoindex:error] [pid 38767:tid 38779] [client 85.203.23.133:25449] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:32.248142 2026] [:error] [pid 38767:tid 38786] [client 85.203.23.133:25449] [client 85.203.23.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/"] [unique_id "acKi2PwkUqN4GJAI5oVvggAAARA"]
[Tue Mar 24 22:42:37.345446 2026] [autoindex:error] [pid 64198:tid 64217] [client 85.203.23.127:37249] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/commands/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:37.442505 2026] [autoindex:error] [pid 64198:tid 64211] [client 85.203.23.127:37249] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query-title/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:37.540497 2026] [autoindex:error] [pid 64198:tid 64208] [client 85.203.23.127:37249] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query-pagination/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:37.636222 2026] [autoindex:error] [pid 64198:tid 64224] [client 85.203.23.127:37249] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/separator/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:38.497472 2026] [autoindex:error] [pid 64198:tid 64214] [client 85.203.23.127:37249] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:39.818204 2026] [:error] [pid 64198:tid 64212] [client 85.203.23.127:37249] [client 85.203.23.127] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/themes.php"] [unique_id "acKi33VzJqf6OS_oSZ3isQAAAUw"]
[Tue Mar 24 22:42:40.009673 2026] [:error] [pid 48128:tid 48153] [client 85.203.23.162:57383] [client 85.203.23.162] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/freeform/"] [unique_id "acKi4MvR4LIMFLbM5VlFUQAAAYQ"]
[Tue Mar 24 22:42:40.197327 2026] [:error] [pid 48128:tid 48156] [client 85.203.23.146:64771] [client 85.203.23.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "acKi4MvR4LIMFLbM5VlFUgAAAYY"]
[Tue Mar 24 22:42:40.381545 2026] [:error] [pid 48128:tid 48151] [client 85.203.23.119:59823] [client 85.203.23.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/chosen.php"] [unique_id "acKi4MvR4LIMFLbM5VlFUwAAAYI"]
[Tue Mar 24 22:42:41.887556 2026] [:error] [pid 38767:tid 38786] [client 85.203.23.153:21305] [client 85.203.23.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.23.153, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acKi4fwkUqN4GJAI5oVvkAAAARA"], referer: https://expressinteriors.com/wp-admin/network/about.php
[Tue Mar 24 22:42:44.845998 2026] [:error] [pid 3032:tid 3110] [client 85.203.23.120:52275] [client 85.203.23.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "acKi5Ca_-JXXD03-JNxm_wAAAIc"]
[Tue Mar 24 22:42:45.033537 2026] [autoindex:error] [pid 3031:tid 3100] [client 85.203.23.164:64675] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:46.421444 2026] [:error] [pid 3031:tid 3092] [client 85.203.23.164:64675] [client 85.203.23.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/"] [unique_id "acKi5qJBKytnG47nuiZCtgAAAFA"]
[Tue Mar 24 22:42:46.606442 2026] [autoindex:error] [pid 38767:tid 38778] [client 85.203.23.140:45433] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:46.713809 2026] [autoindex:error] [pid 38767:tid 38793] [client 85.203.23.140:45433] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:46.817229 2026] [autoindex:error] [pid 38767:tid 38774] [client 85.203.23.140:45433] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/script-modules/block-library/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:46.932286 2026] [autoindex:error] [pid 38767:tid 38783] [client 85.203.23.140:45433] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/tag-cloud/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:47.774673 2026] [:error] [pid 38767:tid 38791] [client 85.203.23.140:45433] [client 85.203.23.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/about.php"] [unique_id "acKi5_wkUqN4GJAI5oVvnQAAARU"]
[Tue Mar 24 22:42:47.960077 2026] [:error] [pid 48219:tid 48288] [client 85.203.23.116:32343] [client 85.203.23.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "acKi5yhf3b4R_lAIyv-cBQAAAgc"]
[Tue Mar 24 22:42:48.171789 2026] [autoindex:error] [pid 48219:tid 48293] [client 85.203.23.137:65349] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:51.849732 2026] [autoindex:error] [pid 48219:tid 48284] [client 85.203.23.137:65349] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:51.940606 2026] [:error] [pid 48219:tid 48289] [client 85.203.23.137:65349] [client 85.203.23.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/template-singl-portfolio.php"] [unique_id "acKi6yhf3b4R_lAIyv-cEQAAAgg"]
[Tue Mar 24 22:42:52.122275 2026] [:error] [pid 3137:tid 3157] [client 85.203.23.132:39263] [client 85.203.23.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/coffee/"] [unique_id "acKi7JdZesutm6dfYM9Y0gAAANI"]
[Tue Mar 24 22:42:54.211734 2026] [autoindex:error] [pid 3032:tid 3112] [client 85.203.23.113:25213] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/search/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:42:54.854916 2026] [:error] [pid 3032:tid 3103] [client 85.203.23.113:25213] [client 85.203.23.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "acKi7ia_-JXXD03-JNxnCQAAAIA"]
[Tue Mar 24 22:42:55.782164 2026] [:error] [pid 48214:tid 48267] [client 85.203.23.111:27909] [client 85.203.23.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-conflg.php"] [unique_id "acKi77eshLWZ3uUDHKmC3AAAAc8"]
[Tue Mar 24 22:42:55.965329 2026] [:error] [pid 64198:tid 64213] [client 85.203.23.164:43077] [client 85.203.23.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/library/"] [unique_id "acKi73VzJqf6OS_oSZ3itwAAAU0"]
[Tue Mar 24 22:42:57.479305 2026] [:error] [pid 3137:tid 3158] [client 85.203.23.143:36751] [client 85.203.23.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/chosen.php"] [unique_id "acKi8ZdZesutm6dfYM9Y4QAAANM"]
[Tue Mar 24 22:42:58.981166 2026] [autoindex:error] [pid 48128:tid 48166] [client 85.203.23.165:61623] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/namespaced/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:43:00.255270 2026] [autoindex:error] [pid 48128:tid 48154] [client 85.203.23.165:61623] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/post-content/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:43:02.096619 2026] [:error] [pid 48128:tid 48150] [client 85.203.23.165:61623] [client 85.203.23.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/joker.php"] [unique_id "acKi9svR4LIMFLbM5VlFaQAAAYE"]
[Tue Mar 24 22:43:04.184286 2026] [autoindex:error] [pid 3030:tid 3069] [client 85.203.23.154:29589] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/comment-date/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:43:04.274813 2026] [:error] [pid 3030:tid 3063] [client 85.203.23.154:29589] [client 85.203.23.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/joker.php"] [unique_id "acKi-AyOuILyynfcqfltTgAAAA4"]
[Tue Mar 24 22:43:16.647599 2026] [:error] [pid 3032:tid 3124] [client 85.203.23.154:23951] [client 85.203.23.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/text.php"] [unique_id "acKjBCa_-JXXD03-JNxnGgAAAJU"]
[Tue Mar 24 22:43:21.738962 2026] [:error] [pid 38767:tid 38792] [client 85.203.23.134:24121] [client 85.203.23.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "acKjCfwkUqN4GJAI5oVvwAAAARY"]
[Tue Mar 24 22:43:21.919197 2026] [:error] [pid 38767:tid 38788] [client 85.203.23.116:38675] [client 85.203.23.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/mer_gagal.php"] [unique_id "acKjCfwkUqN4GJAI5oVvwQAAARI"]
[Tue Mar 24 22:43:24.005176 2026] [:error] [pid 3137:tid 3151] [client 85.203.23.114:32135] [client 85.203.23.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "acKjDJdZesutm6dfYM9Y9gAAAMw"]
[Tue Mar 24 22:43:24.191884 2026] [autoindex:error] [pid 3137:tid 3145] [client 85.203.23.161:41329] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/accordion/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:43:24.285851 2026] [autoindex:error] [pid 3137:tid 3144] [client 85.203.23.161:41329] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/table/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:43:24.380559 2026] [autoindex:error] [pid 3137:tid 3158] [client 85.203.23.161:41329] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentytwo/parts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:43:26.492103 2026] [autoindex:error] [pid 3137:tid 3148] [client 85.203.23.161:41329] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/edit-post/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:43:29.370850 2026] [:error] [pid 3137:tid 3143] [client 85.203.23.161:41329] [client 85.203.23.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-text-cron.php"] [unique_id "acKjEZdZesutm6dfYM9ZCAAAAMQ"]
[Tue Mar 24 22:43:30.319325 2026] [autoindex:error] [pid 3137:tid 3161] [client 85.203.23.135:51663] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/buttons/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:43:30.416537 2026] [autoindex:error] [pid 3137:tid 3154] [client 85.203.23.135:51663] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/home-link/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:43:31.066549 2026] [autoindex:error] [pid 3137:tid 3156] [client 85.203.23.135:51663] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/astra/inc/builder/type/base/dynamic-css/button/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:43:31.156932 2026] [:error] [pid 3137:tid 3141] [client 85.203.23.135:51663] [client 85.203.23.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/post-template-path.php"] [unique_id "acKjE5dZesutm6dfYM9ZEgAAAMI"]
[Tue Mar 24 22:43:31.354119 2026] [:error] [pid 3137:tid 3146] [client 85.203.23.122:28717] [client 85.203.23.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/plex1.php"] [unique_id "acKjE5dZesutm6dfYM9ZFAAAAMc"]
[Tue Mar 24 22:43:32.280233 2026] [autoindex:error] [pid 64198:tid 64204] [client 85.203.23.108:24611] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/post-template/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:43:34.627096 2026] [:error] [pid 64198:tid 64206] [client 85.203.23.108:24611] [client 85.203.23.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/nextpage/wp-cron.php"] [unique_id "acKjFnVzJqf6OS_oSZ3i0AAAAUY"]
[Tue Mar 24 22:43:36.691996 2026] [:error] [pid 3137:tid 3155] [client 85.203.23.128:38431] [client 85.203.23.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/button/admiin.php"] [unique_id "acKjGJdZesutm6dfYM9ZHgAAANA"]
[Tue Mar 24 22:43:36.893531 2026] [autoindex:error] [pid 48219:tid 48298] [client 85.203.23.119:39197] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/src/Content/Type/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:43:42.740839 2026] [:error] [pid 48219:tid 48296] [client 85.203.23.119:39197] [client 85.203.23.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/users.php"] [unique_id "acKjHihf3b4R_lAIyv-cOQAAAg8"]
[Tue Mar 24 22:43:46.667650 2026] [autoindex:error] [pid 64198:tid 64206] [client 85.203.23.125:42319] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/comments-pagination-next/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:43:46.766161 2026] [autoindex:error] [pid 64198:tid 64205] [client 85.203.23.125:42319] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/Exception/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:43:48.736277 2026] [:error] [pid 64198:tid 64213] [client 85.203.23.127:31209] [client 85.203.23.127] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.23.127, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acKjJHVzJqf6OS_oSZ3i5QAAAU0"], referer: https://expressinteriors.com/wp-admin/options.php
[Tue Mar 24 22:43:52.814441 2026] [:error] [pid 64198:tid 64216] [client 85.203.23.125:42319] [client 85.203.23.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-cron.php"] [unique_id "acKjKHVzJqf6OS_oSZ3i7AAAAVA"]
[Tue Mar 24 22:43:52.998528 2026] [:error] [pid 38767:tid 38772] [client 85.203.23.150:65437] [client 85.203.23.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/api.php"] [unique_id "acKjKPwkUqN4GJAI5oVv8wAAAQI"]
[Tue Mar 24 22:43:53.180445 2026] [:error] [pid 38767:tid 38788] [client 85.203.23.164:59835] [client 85.203.23.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/panel.php"] [unique_id "acKjKfwkUqN4GJAI5oVv9QAAARI"]
[Tue Mar 24 22:43:54.129593 2026] [:error] [pid 38767:tid 38773] [client 85.203.23.147:23989] [client 85.203.23.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/tx1.php"] [unique_id "acKjKvwkUqN4GJAI5oVv-wAAAQM"]
[Tue Mar 24 22:43:55.047501 2026] [:error] [pid 38767:tid 38784] [client 85.203.23.138:56159] [client 85.203.23.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/autoload_classmap.php"] [unique_id "acKjK_wkUqN4GJAI5oVv_wAAAQ4"]
[Tue Mar 24 22:43:55.232482 2026] [:error] [pid 48128:tid 48151] [client 85.203.23.122:23453] [client 85.203.23.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "acKjK8vR4LIMFLbM5VlFiwAAAYI"]
[Tue Mar 24 22:43:57.290627 2026] [:error] [pid 3032:tid 3108] [client 85.203.23.134:26941] [client 85.203.23.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-react-refresh.php"] [unique_id "acKjLSa_-JXXD03-JNxnMwAAAIU"]
[Tue Mar 24 22:44:02.879101 2026] [:error] [pid 48219:tid 48301] [client 85.203.23.148:39471] [client 85.203.23.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/author-template-object.php"] [unique_id "acKjMihf3b4R_lAIyv-cTQAAAhQ"]
[Tue Mar 24 22:44:03.062343 2026] [:error] [pid 3137:tid 3161] [client 85.203.23.154:33213] [client 85.203.23.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/doc.php"] [unique_id "acKjM5dZesutm6dfYM9ZPQAAANY"]
[Tue Mar 24 22:44:03.251194 2026] [:error] [pid 48128:tid 48172] [client 85.203.23.165:51875] [client 85.203.23.165] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/vendor/about.php"] [unique_id "acKjM8vR4LIMFLbM5VlFkQAAAZM"]
[Tue Mar 24 22:44:04.949434 2026] [:error] [pid 64198:tid 64219] [client 85.203.23.140:36441] [client 85.203.23.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Exception/177.php"] [unique_id "acKjNHVzJqf6OS_oSZ3i_QAAAVM"]
[Tue Mar 24 22:44:05.135765 2026] [:error] [pid 3032:tid 3119] [client 85.203.23.108:25355] [client 85.203.23.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/site-title-restful.php"] [unique_id "acKjNSa_-JXXD03-JNxnOQAAAJA"]
[Tue Mar 24 22:44:05.321652 2026] [:error] [pid 48219:tid 48292] [client 85.203.23.136:43721] [client 85.203.23.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.23.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/fonts/poppins/wp-login.php"] [unique_id "acKjNShf3b4R_lAIyv-cUgAAAgs"]
[Tue Mar 24 22:44:06.077802 2026] [:error] [pid 48219:tid 48295] [client 85.203.23.136:43721] [client 85.203.23.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/namespaced/Core/goods.php"] [unique_id "acKjNihf3b4R_lAIyv-cVAAAAg4"]
[Tue Mar 24 22:44:10.514871 2026] [autoindex:error] [pid 48219:tid 48296] [client 85.203.23.137:62735] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/comment-reply-link/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:44:10.610837 2026] [autoindex:error] [pid 48219:tid 48287] [client 85.203.23.137:62735] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/pattern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:44:10.704362 2026] [autoindex:error] [pid 48219:tid 48289] [client 85.203.23.137:62735] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/comments-pagination-numbers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:44:10.800544 2026] [autoindex:error] [pid 48219:tid 48282] [client 85.203.23.137:62735] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/script-modules/block-library/navigation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:44:10.895347 2026] [autoindex:error] [pid 48219:tid 48283] [client 85.203.23.137:62735] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/lightgray/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:44:11.609693 2026] [autoindex:error] [pid 48219:tid 48281] [client 85.203.23.137:62735] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/legacy-widget/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Mar 24 22:44:12.801539 2026] [:error] [pid 48219:tid 48292] [client 85.203.23.137:62735] [client 85.203.23.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "acKjPChf3b4R_lAIyv-ccgAAAgs"], referer: http://expressinteriors.com/wp-includes/customize/wp-conflg.php?p=
[Tue Mar 24 22:44:12.984547 2026] [:error] [pid 64198:tid 64223] [client 85.203.23.154:58971] [client 85.203.23.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/"] [unique_id "acKjPHVzJqf6OS_oSZ3jCQAAAVc"]
[Tue Mar 24 22:44:16.872506 2026] [:error] [pid 3137:tid 3150] [client 85.203.23.145:38139] [client 85.203.23.145] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\/lib\\\\/php\\\\/connector\\\\.minimal\\\\.php$" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/27_Apps_WPPlugin.conf"] [line "6778"] [id "234930"] [rev "2"] [msg "COMODO WAF: File upload vulnerability in the file manager plugin before 6.9 for WordPress (CVE-2020-25213)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WPPlugin"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"] [unique_id "acKjQJdZesutm6dfYM9ZXgAAAMs"]
[Tue Mar 24 22:44:18.143014 2026] [proxy_fcgi:error] [pid 3137:tid 3156] [client 85.203.23.145:38139] AH01071: Got error 'PHP message: PHP Warning:  Use of undefined constant ABSPATH - assumed 'ABSPATH' (this will throw an Error in a future version of PHP) in /home/expressi/public_html/wp-settings.php on line 34PHP message: PHP Warning:  require(ABSPATHwp-includes/version.php): failed to open stream: No such file or directory in /home/expressi/public_html/wp-settings.php on line 34PHP message: PHP Warning:  require(ABSPATHwp-includes/version.php): failed to open stream: No such file or directory in /home/expressi/public_html/wp-settings.php on line 34PHP message: PHP Fatal error:  require(): Failed opening required 'ABSPATHwp-includes/version.php' (include_path='.:') in /home/expressi/public_html/wp-settings.php on line 34'
[Tue Mar 24 22:44:20.768601 2026] [:error] [pid 48128:tid 48151] [client 85.203.23.154:32595] [client 85.203.23.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/latest-posts.php"] [unique_id "acKjRMvR4LIMFLbM5VlFmQAAAYI"]
[Tue Mar 24 22:44:25.948830 2026] [:error] [pid 3137:tid 3161] [client 85.203.23.118:39135] [client 85.203.23.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/search.php"] [unique_id "acKjSZdZesutm6dfYM9ZbwAAANY"]
[Tue Mar 24 22:44:26.134286 2026] [:error] [pid 3137:tid 3149] [client 85.203.23.137:64163] [client 85.203.23.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-comments.php"] [unique_id "acKjSpdZesutm6dfYM9ZcAAAAMo"]
[Tue Mar 24 22:44:35.086789 2026] [:error] [pid 3137:tid 3150] [client 85.203.23.134:61799] [client 85.203.23.134] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/language/overrides/system.php"] [unique_id "acKjU5dZesutm6dfYM9ZfwAAAMs"]
[Tue Mar 24 22:44:41.811631 2026] [:error] [pid 3032:tid 3121] [client 85.203.23.160:43403] [client 85.203.23.160] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/view/template/extension/module/shell.php"] [unique_id "acKjWSa_-JXXD03-JNxnWQAAAJI"]
[Tue Mar 24 22:44:48.603544 2026] [:error] [pid 48214:tid 48269] [client 85.203.23.143:29779] [client 85.203.23.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/storage/framework/views/core.php"] [unique_id "acKjYLeshLWZ3uUDHKmDEgAAAdE"]
[Tue Mar 24 22:44:48.786525 2026] [:error] [pid 64198:tid 64223] [client 85.203.23.125:49937] [client 85.203.23.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/storage/framework/views/core.php"] [unique_id "acKjYHVzJqf6OS_oSZ3jQwAAAVc"]
[Tue Mar 24 22:46:56.757485 2026] [:error] [pid 64198:tid 64213] [client 117.55.203.46:51128] [client 117.55.203.46] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 117.55.203.46, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acKj4HVzJqf6OS_oSZ3kKQAAAU0"]
[Tue Mar 24 22:54:20.216841 2026] [:error] [pid 38767:tid 38785] [client 18.136.78.124:16160] [client 18.136.78.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.136.78.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acKlnPwkUqN4GJAI5oVySgAAAQ8"]
[Tue Mar 24 22:54:21.104317 2026] [:error] [pid 38767:tid 38793] [client 18.136.78.124:16160] [client 18.136.78.124] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.136.78.124, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acKlnfwkUqN4GJAI5oVyTwAAARc"], referer: https://expressinteriors.com/wp-login.php
[Tue Mar 24 23:02:34.760355 2026] [:error] [pid 3030:tid 3063] [client 43.130.57.76:50992] [client 43.130.57.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acKnigyOuILyynfcqflvjgAAAA4"]
[Tue Mar 24 23:36:31.280650 2026] [:error] [pid 64198:tid 64215] [client 93.123.109.79:59349] [client 93.123.109.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "acKvf3VzJqf6OS_oSZ3yLQAAAU8"]
[Wed Mar 25 00:11:08.749614 2026] [:error] [pid 38767:tid 38782] [client 136.117.61.254:32774] [client 136.117.61.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.117.61.254, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acK3nPwkUqN4GJAI5oWQuAAAAQw"]
[Wed Mar 25 00:28:36.602607 2026] [:error] [pid 58154:tid 58168] [client 182.40.104.255:35574] [client 182.40.104.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acK7tA0pGUh6bwD3ouJ13wAAAMs"]
[Wed Mar 25 00:41:55.267030 2026] [:error] [pid 57703:tid 58039] [client 106.51.22.118:58958] [client 106.51.22.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 106.51.22.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acK-0_IVQxDtjkklWGZPdAAAAFQ"]
[Wed Mar 25 00:41:57.895819 2026] [:error] [pid 57711:tid 58066] [client 106.51.22.118:53796] [client 106.51.22.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 106.51.22.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acK-1aLdPFdeRRktTdNPDAAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Wed Mar 25 01:09:42.926485 2026] [:error] [pid 58154:tid 58171] [client 101.132.184.223:38572] [client 101.132.184.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plus/img/df_dedetitle.gif"] [unique_id "acLFVg0pGUh6bwD3ouKNkwAAAM4"], referer: https://expressinteriors.com/plus/img/df_dedetitle.gif
[Wed Mar 25 01:09:44.456497 2026] [:error] [pid 57702:tid 57921] [client 101.132.184.223:38692] [client 101.132.184.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/include/ckeditor/plugins/smiley/images/angel_smile.gif"] [unique_id "acLFWKS8TU_xcQFvlnYBcwAAABI"], referer: https://expressinteriors.com/include/ckeditor/plugins/smiley/images/angel_smile.gif
[Wed Mar 25 01:09:45.437065 2026] [:error] [pid 57702:tid 57918] [client 101.132.184.223:43406] [client 101.132.184.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plus/img/df_dedetitle.gif"] [unique_id "acLFWaS8TU_xcQFvlnYBfgAAAA8"], referer: http://expressinteriors.com/plus/img/df_dedetitle.gif
[Wed Mar 25 01:09:48.005341 2026] [:error] [pid 58154:tid 58161] [client 101.132.184.223:43496] [client 101.132.184.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/include/ckeditor/plugins/smiley/images/angel_smile.gif"] [unique_id "acLFXA0pGUh6bwD3ouKNoAAAAMQ"], referer: http://expressinteriors.com/include/ckeditor/plugins/smiley/images/angel_smile.gif
[Wed Mar 25 01:29:57.319998 2026] [:error] [pid 57702:tid 57916] [client 31.220.85.244:54378] [client 31.220.85.244] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.220.85.244, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acLKFaS8TU_xcQFvlnYJDwAAAA0"]
[Wed Mar 25 01:29:58.153350 2026] [:error] [pid 57702:tid 57906] [client 31.220.85.244:54378] [client 31.220.85.244] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.220.85.244, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acLKFqS8TU_xcQFvlnYJEgAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Wed Mar 25 02:00:27.525827 2026] [:error] [pid 57711:tid 58062] [client 162.241.62.60:36082] [client 162.241.62.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.62.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acLRO6LdPFdeRRktTdNkkgAAAIk"]
[Wed Mar 25 02:00:28.557735 2026] [:error] [pid 57711:tid 58058] [client 162.241.62.60:36082] [client 162.241.62.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.62.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acLRPKLdPFdeRRktTdNkkwAAAIY"], referer: https://expressinteriors.com/wp-login.php
[Wed Mar 25 02:04:53.217575 2026] [:error] [pid 20371:tid 20384] [client 43.153.7.191:38734] [client 43.153.7.191] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acLSReb25OL4yTv2fF-dpQAAAQs"]
[Wed Mar 25 02:37:11.163014 2026] [:error] [pid 20371:tid 20394] [client 20.48.232.178:10445] [client 20.48.232.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acLZ1-b25OL4yTv2fF-yXwAAARU"]
[Wed Mar 25 02:37:11.632838 2026] [:error] [pid 20371:tid 20384] [client 20.48.232.178:10437] [client 20.48.232.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acLZ1-b25OL4yTv2fF-yYgAAAQs"]
[Wed Mar 25 02:37:12.058106 2026] [:error] [pid 58154:tid 58166] [client 20.48.232.178:10461] [client 20.48.232.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acLZ2A0pGUh6bwD3ouK1EQAAAMk"]
[Wed Mar 25 02:37:12.495653 2026] [:error] [pid 20371:tid 20387] [client 20.48.232.178:10483] [client 20.48.232.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acLZ2Ob25OL4yTv2fF-yZQAAAQ4"]
[Wed Mar 25 02:47:50.395604 2026] [:error] [pid 57703:tid 58037] [client 210.245.90.206:41098] [client 210.245.90.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 210.245.90.206, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acLcVvIVQxDtjkklWGZt8AAAAFI"]
[Wed Mar 25 02:47:51.596326 2026] [:error] [pid 57703:tid 58043] [client 210.245.90.206:41098] [client 210.245.90.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 210.245.90.206, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acLcV_IVQxDtjkklWGZt8wAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Wed Mar 25 03:03:43.802410 2026] [:error] [pid 57702:tid 57913] [client 45.175.113.36:23934] [client 45.175.113.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.175.113.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acLgD6S8TU_xcQFvlnYmdAAAAAo"]
[Wed Mar 25 03:11:52.642732 2026] [:error] [pid 57702:tid 57920] [client 45.175.113.36:23859] [client 45.175.113.36] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acLh-KS8TU_xcQFvlnYotQAAABE"]
[Wed Mar 25 06:39:43.821663 2026] [:error] [pid 47989:tid 48003] [client 103.28.36.205:50214] [client 103.28.36.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acMSryWKdJMhIccROjmEUAAAAUw"]
[Wed Mar 25 06:39:44.743474 2026] [:error] [pid 47989:tid 48004] [client 103.28.36.205:50214] [client 103.28.36.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acMSsCWKdJMhIccROjmEVgAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Wed Mar 25 11:14:52.280957 2026] [:error] [pid 756:tid 873] [client 117.4.245.202:54610] [client 117.4.245.202] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 117.4.245.202, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acNTLDOaW6oylMIDBCT59AAAAJU"]
[Wed Mar 25 11:14:53.189091 2026] [:error] [pid 756:tid 874] [client 117.4.245.202:54610] [client 117.4.245.202] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 117.4.245.202, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acNTLTOaW6oylMIDBCT59QAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Wed Mar 25 12:30:52.489014 2026] [:error] [pid 47989:tid 48015] [client 180.191.237.162:56462] [client 180.191.237.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.237.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acNk_CWKdJMhIccROjkNVgAAAVg"]
[Wed Mar 25 12:48:17.085185 2026] [:error] [pid 25969:tid 26041] [client 43.166.245.120:39326] [client 43.166.245.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acNpERd3aEUmOfdKja_evQAAA88"]
[Wed Mar 25 12:59:49.156594 2026] [:error] [pid 26449:tid 26470] [client 180.191.237.162:55018] [client 180.191.237.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.237.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acNrxdpZ2T15NDqzAjE7iAAAAlE"]
[Wed Mar 25 13:06:14.651597 2026] [:error] [pid 26269:tid 26300] [client 180.191.237.162:55083] [client 180.191.237.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.237.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acNtRkn7e-ZQbaIs7qyYhAAAAZg"]
[Wed Mar 25 13:22:10.253657 2026] [:error] [pid 26449:tid 26465] [client 180.191.237.162:54578] [client 180.191.237.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.237.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acNxAtpZ2T15NDqzAjE_gQAAAkw"]
[Wed Mar 25 13:26:05.197547 2026] [:error] [pid 47989:tid 47994] [client 180.191.237.162:55798] [client 180.191.237.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.191.237.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acNx7SWKdJMhIccROjkj0gAAAUM"]
[Wed Mar 25 13:54:19.589214 2026] [:error] [pid 26269:tid 26293] [client 122.51.236.174:48700] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acN4i0n7e-ZQbaIs7qyb8QAAAZE"]
[Wed Mar 25 15:01:07.677985 2026] [:error] [pid 26269:tid 26295] [client 49.51.141.76:43874] [client 49.51.141.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acOIM0n7e-ZQbaIs7qyhSQAAAZM"]
[Wed Mar 25 17:01:48.498546 2026] [:error] [pid 26449:tid 26468] [client 197.231.178.154:63774] [client 197.231.178.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.231.178.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acOkfNpZ2T15NDqzAjFhxAAAAk8"]
[Wed Mar 25 17:09:42.120378 2026] [:error] [pid 47989:tid 48011] [client 34.142.206.177:34484] [client 34.142.206.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.142.206.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acOmViWKdJMhIccROjmEIQAAAVQ"]
[Wed Mar 25 17:09:43.504211 2026] [:error] [pid 47989:tid 47994] [client 34.142.206.177:34484] [client 34.142.206.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.142.206.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acOmVyWKdJMhIccROjmEJgAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Wed Mar 25 17:12:53.384772 2026] [:error] [pid 25875:tid 25884] [client 82.145.60.134:37390] [client 82.145.60.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.145.60.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acOnFRJ38QkS3NyfshzJ1QAAAoM"]
[Wed Mar 25 17:12:55.006154 2026] [:error] [pid 25969:tid 26027] [client 82.145.60.134:38038] [client 82.145.60.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.145.60.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acOnFxd3aEUmOfdKja_59AAAA8E"], referer: https://expressinteriors.com/wp-login.php
[Wed Mar 25 17:34:37.804290 2026] [:error] [pid 25875:tid 25895] [client 102.208.190.163:58633] [client 102.208.190.163] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acOsLRJ38QkS3NyfshzQXgAAAo4"]
[Wed Mar 25 17:36:07.861614 2026] [:error] [pid 25969:tid 26049] [client 102.208.190.163:60017] [client 102.208.190.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.208.190.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acOshxd3aEUmOfdKja_8dQAAA9c"]
[Wed Mar 25 17:37:42.581558 2026] [:error] [pid 25969:tid 26035] [client 102.208.190.163:61508] [client 102.208.190.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.208.190.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acOs5hd3aEUmOfdKja_8oQAAA8k"]
[Wed Mar 25 17:55:15.959689 2026] [:error] [pid 26269:tid 26279] [client 102.208.190.163:60546] [client 102.208.190.163] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acOxA0n7e-ZQbaIs7qyw6AAAAYM"]
[Wed Mar 25 17:56:33.820497 2026] [:error] [pid 25967:tid 25986] [client 197.231.178.154:61921] [client 197.231.178.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.231.178.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acOxUfg8Qtq7ZM4mSFkrqAAAA04"]
[Wed Mar 25 17:58:01.198684 2026] [:error] [pid 25969:tid 26027] [client 102.208.190.163:63567] [client 102.208.190.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.208.190.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acOxqRd3aEUmOfdKja_-vgAAA8E"]
[Wed Mar 25 17:59:21.392934 2026] [:error] [pid 25967:tid 25990] [client 102.208.190.163:65032] [client 102.208.190.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.208.190.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acOx-fg8Qtq7ZM4mSFksowAAA1I"]
[Wed Mar 25 18:00:44.378518 2026] [:error] [pid 47989:tid 48004] [client 102.208.190.163:50194] [client 102.208.190.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.208.190.163, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acOyTCWKdJMhIccROjmfcgAAAU0"]
[Wed Mar 25 18:00:46.166444 2026] [:error] [pid 47946:tid 47953] [client 50.116.87.70:47528] [client 50.116.87.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.116.87.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acOyTjipQTqBMSeKYhd9owAAAQU"]
[Wed Mar 25 18:00:47.250790 2026] [:error] [pid 47946:tid 47956] [client 50.116.87.70:47528] [client 50.116.87.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.116.87.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acOyTzipQTqBMSeKYhd9pAAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Wed Mar 25 18:02:14.683107 2026] [:error] [pid 47989:tid 48015] [client 197.231.178.154:51838] [client 197.231.178.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.231.178.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acOypiWKdJMhIccROjmgrQAAAVg"]
[Wed Mar 25 18:05:04.355610 2026] [:error] [pid 25967:tid 25991] [client 197.231.178.154:55213] [client 197.231.178.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.231.178.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acOzUPg8Qtq7ZM4mSFkvNwAAA1M"]
[Wed Mar 25 18:12:28.406148 2026] [:error] [pid 25967:tid 25984] [client 197.231.178.154:62645] [client 197.231.178.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.231.178.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acO1DPg8Qtq7ZM4mSFky2QAAA0w"]
[Wed Mar 25 18:19:07.998041 2026] [:error] [pid 25967:tid 25981] [client 197.231.178.154:52481] [client 197.231.178.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.231.178.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acO2m_g8Qtq7ZM4mSFk2igAAA0k"]
[Wed Mar 25 18:21:48.472974 2026] [:error] [pid 25967:tid 25987] [client 172.96.172.91:51056] [client 172.96.172.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.96.172.91, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acO3PPg8Qtq7ZM4mSFk3sgAAA08"]
[Wed Mar 25 18:21:51.657101 2026] [:error] [pid 26321:tid 26354] [client 172.96.172.91:51068] [client 172.96.172.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.96.172.91, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acO3P_KO65qqGZCSPZo0cgAAAg0"], referer: https://expressinteriors.com/wp-login.php
[Wed Mar 25 19:05:39.041599 2026] [autoindex:error] [pid 26269:tid 26293] [client 20.151.18.25:29204] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Mar 25 19:05:39.247974 2026] [:error] [pid 26269:tid 26277] [client 20.151.18.25:29204] [client 20.151.18.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.151.18.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "acPBg0n7e-ZQbaIs7qy3jAAAAYE"]
[Wed Mar 25 19:05:40.688788 2026] [autoindex:error] [pid 26269:tid 26288] [client 20.151.18.25:29204] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Mar 25 19:05:42.926289 2026] [autoindex:error] [pid 26269:tid 26283] [client 20.151.18.25:29204] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Mar 25 19:05:43.136888 2026] [autoindex:error] [pid 26269:tid 26294] [client 20.151.18.25:29204] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Mar 25 19:05:44.046128 2026] [autoindex:error] [pid 26269:tid 26285] [client 20.151.18.25:29204] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Mar 25 19:05:47.660191 2026] [autoindex:error] [pid 26269:tid 26284] [client 20.151.18.25:29204] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Mar 25 19:05:48.567554 2026] [:error] [pid 26269:tid 26278] [client 20.151.18.25:29204] [client 20.151.18.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "acPBjEn7e-ZQbaIs7qy3ngAAAYI"]
[Wed Mar 25 19:05:50.512544 2026] [:error] [pid 47989:tid 47992] [client 20.151.18.25:29190] [client 20.151.18.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "acPBjiWKdJMhIccROjnMRQAAAUE"]
[Wed Mar 25 19:05:51.358608 2026] [:error] [pid 26321:tid 26342] [client 20.151.18.25:29188] [client 20.151.18.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "acPBj_KO65qqGZCSPZpBaQAAAgM"]
[Wed Mar 25 19:05:52.179728 2026] [:error] [pid 25875:tid 25902] [client 20.151.18.25:28910] [client 20.151.18.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "acPBkBJ38QkS3NyfshzsvAAAApU"]
[Wed Mar 25 19:05:53.004351 2026] [:error] [pid 26269:tid 26293] [client 20.151.18.25:28927] [client 20.151.18.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "acPBkUn7e-ZQbaIs7qy3oQAAAZE"]
[Wed Mar 25 19:08:10.783707 2026] [:error] [pid 25967:tid 25990] [client 213.32.22.52:58096] [client 213.32.22.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.32.22.52, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acPCGvg8Qtq7ZM4mSFlOBwAAA1I"]
[Wed Mar 25 19:08:12.309218 2026] [:error] [pid 25967:tid 25984] [client 213.32.22.52:58096] [client 213.32.22.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.32.22.52, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acPCHPg8Qtq7ZM4mSFlOCAAAA0w"], referer: https://expressinteriors.com/wp-login.php
[Wed Mar 25 19:17:55.950963 2026] [:error] [pid 25967:tid 25990] [client 172.213.17.84:10195] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zcsu.php"] [unique_id "acPEY_g8Qtq7ZM4mSFlRXgAAA1I"]
[Wed Mar 25 19:17:56.556578 2026] [:error] [pid 892:tid 919] [client 172.213.17.84:13091] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zcsu.php"] [unique_id "acPEZCT_G8WMU3T3yxrQLAAAANQ"]
[Wed Mar 25 19:17:57.292350 2026] [:error] [pid 47989:tid 48005] [client 172.213.17.84:46369] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zcsu.php"] [unique_id "acPEZSWKdJMhIccROjnSCAAAAU4"]
[Wed Mar 25 19:17:58.272601 2026] [:error] [pid 25967:tid 25985] [client 172.213.17.84:20629] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zcsu.php"] [unique_id "acPEZvg8Qtq7ZM4mSFlRYgAAA00"]
[Wed Mar 25 19:17:58.770378 2026] [:error] [pid 25967:tid 25983] [client 172.213.17.84:10359] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "acPEZvg8Qtq7ZM4mSFlRZAAAA0s"]
[Wed Mar 25 19:17:59.285332 2026] [:error] [pid 26449:tid 26458] [client 172.213.17.84:33004] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "acPEZ9pZ2T15NDqzAjF4WQAAAkU"]
[Wed Mar 25 19:17:59.969887 2026] [:error] [pid 25967:tid 25981] [client 172.213.17.84:32980] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "acPEZ_g8Qtq7ZM4mSFlRbAAAA0k"]
[Wed Mar 25 19:18:00.557707 2026] [:error] [pid 47989:tid 47994] [client 172.213.17.84:14998] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "acPEaCWKdJMhIccROjnSEgAAAUM"]
[Wed Mar 25 19:18:01.078785 2026] [:error] [pid 25967:tid 25992] [client 172.213.17.84:28708] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cxs.php"] [unique_id "acPEafg8Qtq7ZM4mSFlRbgAAA1Q"]
[Wed Mar 25 19:18:01.691194 2026] [:error] [pid 892:tid 899] [client 172.213.17.84:2161] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cxs.php"] [unique_id "acPEaST_G8WMU3T3yxrQLgAAAMM"]
[Wed Mar 25 19:18:02.280055 2026] [:error] [pid 26449:tid 26463] [client 172.213.17.84:13057] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cxs.php"] [unique_id "acPEatpZ2T15NDqzAjF4XgAAAko"]
[Wed Mar 25 19:18:02.933106 2026] [:error] [pid 26321:tid 26361] [client 172.213.17.84:46395] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cxs.php"] [unique_id "acPEavKO65qqGZCSPZpEHAAAAhQ"]
[Wed Mar 25 19:18:03.579270 2026] [:error] [pid 892:tid 905] [client 172.213.17.84:9261] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-scanner.php"] [unique_id "acPEayT_G8WMU3T3yxrQMAAAAMc"]
[Wed Mar 25 19:18:04.200729 2026] [:error] [pid 25967:tid 25977] [client 172.213.17.84:12758] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-scanner.php"] [unique_id "acPEbPg8Qtq7ZM4mSFlRjQAAA0U"]
[Wed Mar 25 19:18:04.696935 2026] [:error] [pid 25967:tid 25986] [client 172.213.17.84:16966] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-scanner.php"] [unique_id "acPEbPg8Qtq7ZM4mSFlRjgAAA04"]
[Wed Mar 25 19:18:05.268961 2026] [:error] [pid 47989:tid 48015] [client 172.213.17.84:2143] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-scanner.php"] [unique_id "acPEbSWKdJMhIccROjnSJQAAAVg"]
[Wed Mar 25 19:18:05.847922 2026] [:error] [pid 26321:tid 26353] [client 172.213.17.84:45646] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/saorix1.php"] [unique_id "acPEbfKO65qqGZCSPZpEIQAAAgw"]
[Wed Mar 25 19:18:06.696584 2026] [:error] [pid 25967:tid 25979] [client 172.213.17.84:12742] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/saorix1.php"] [unique_id "acPEbvg8Qtq7ZM4mSFlRkAAAA0c"]
[Wed Mar 25 19:18:08.705811 2026] [:error] [pid 47989:tid 47999] [client 172.213.17.84:29954] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/saorix1.php"] [unique_id "acPEcCWKdJMhIccROjnSLAAAAUg"]
[Wed Mar 25 19:18:12.469864 2026] [:error] [pid 25967:tid 25980] [client 172.213.17.84:11542] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/saorix1.php"] [unique_id "acPEdPg8Qtq7ZM4mSFlRlwAAA0g"]
[Wed Mar 25 19:18:13.232324 2026] [:error] [pid 47989:tid 47997] [client 172.213.17.84:14999] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/torsa1.php"] [unique_id "acPEdSWKdJMhIccROjnSMgAAAUY"]
[Wed Mar 25 19:18:14.502547 2026] [:error] [pid 47989:tid 47996] [client 172.213.17.84:32978] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/torsa1.php"] [unique_id "acPEdiWKdJMhIccROjnSNQAAAUU"]
[Wed Mar 25 19:18:15.475383 2026] [:error] [pid 47989:tid 48015] [client 172.213.17.84:18434] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/torsa1.php"] [unique_id "acPEdyWKdJMhIccROjnSOwAAAVg"]
[Wed Mar 25 19:18:16.086916 2026] [:error] [pid 47989:tid 48010] [client 172.213.17.84:10143] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/torsa1.php"] [unique_id "acPEeCWKdJMhIccROjnSQAAAAVM"]
[Wed Mar 25 19:18:17.086824 2026] [:error] [pid 47989:tid 48012] [client 172.213.17.84:10143] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acPEeSWKdJMhIccROjnSRQAAAVU"]
[Wed Mar 25 19:18:18.035294 2026] [:error] [pid 47989:tid 48004] [client 172.213.17.84:45657] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acPEeiWKdJMhIccROjnSSgAAAU0"]
[Wed Mar 25 19:18:19.283069 2026] [:error] [pid 25967:tid 25972] [client 172.213.17.84:42006] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acPEe_g8Qtq7ZM4mSFlRoAAAA0A"]
[Wed Mar 25 19:18:20.674411 2026] [:error] [pid 25967:tid 25981] [client 172.213.17.84:13387] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acPEfPg8Qtq7ZM4mSFlRpgAAA0k"]
[Wed Mar 25 19:18:21.589191 2026] [:error] [pid 47989:tid 47998] [client 172.213.17.84:12394] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "acPEfSWKdJMhIccROjnSVAAAAUc"]
[Wed Mar 25 19:18:22.351149 2026] [:error] [pid 26321:tid 26364] [client 172.213.17.84:16160] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "acPEfvKO65qqGZCSPZpEKQAAAhc"]
[Wed Mar 25 19:18:23.213345 2026] [:error] [pid 25967:tid 25995] [client 172.213.17.84:44861] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "acPEf_g8Qtq7ZM4mSFlRqQAAA1c"]
[Wed Mar 25 19:18:24.063993 2026] [:error] [pid 47989:tid 48003] [client 172.213.17.84:44853] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "acPEgCWKdJMhIccROjnSWQAAAUw"]
[Wed Mar 25 19:18:26.531168 2026] [:error] [pid 47989:tid 48004] [client 172.213.17.84:26891] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3.php"] [unique_id "acPEgiWKdJMhIccROjnSXgAAAU0"]
[Wed Mar 25 19:18:29.173269 2026] [:error] [pid 25875:tid 25903] [client 172.213.17.84:12272] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3.php"] [unique_id "acPEhRJ38QkS3NyfshzxewAAApY"]
[Wed Mar 25 19:18:31.972219 2026] [:error] [pid 47989:tid 48014] [client 172.213.17.84:16166] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3.php"] [unique_id "acPEhyWKdJMhIccROjnSegAAAVc"]
[Wed Mar 25 19:18:33.073243 2026] [:error] [pid 47989:tid 47998] [client 172.213.17.84:37935] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3.php"] [unique_id "acPEiSWKdJMhIccROjnSggAAAUc"]
[Wed Mar 25 19:18:34.037093 2026] [:error] [pid 47989:tid 48002] [client 172.213.17.84:12273] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "acPEiiWKdJMhIccROjnSigAAAUs"]
[Wed Mar 25 19:18:35.501392 2026] [:error] [pid 25875:tid 25897] [client 172.213.17.84:31131] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "acPEixJ38QkS3NyfshzxgwAAApA"]
[Wed Mar 25 19:18:36.936860 2026] [:error] [pid 26321:tid 26362] [client 172.213.17.84:22951] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "acPEjPKO65qqGZCSPZpENQAAAhU"]
[Wed Mar 25 19:18:37.835671 2026] [:error] [pid 26449:tid 26476] [client 172.213.17.84:10153] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "acPEjdpZ2T15NDqzAjF4cQAAAlc"]
[Wed Mar 25 19:18:38.999897 2026] [:error] [pid 26321:tid 26356] [client 172.213.17.84:44818] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xvs.php"] [unique_id "acPEjvKO65qqGZCSPZpEPgAAAg8"]
[Wed Mar 25 19:18:39.954434 2026] [:error] [pid 25967:tid 25990] [client 172.213.17.84:26883] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xvs.php"] [unique_id "acPEj_g8Qtq7ZM4mSFlRsAAAA1I"]
[Wed Mar 25 19:18:41.174710 2026] [:error] [pid 26449:tid 26462] [client 172.213.17.84:28228] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xvs.php"] [unique_id "acPEkdpZ2T15NDqzAjF4dwAAAkk"]
[Wed Mar 25 19:18:43.131287 2026] [:error] [pid 25967:tid 25986] [client 172.213.17.84:31122] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xvs.php"] [unique_id "acPEk_g8Qtq7ZM4mSFlRswAAA04"]
[Wed Mar 25 19:18:44.707613 2026] [:error] [pid 892:tid 904] [client 172.213.17.84:44830] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid3.php"] [unique_id "acPElCT_G8WMU3T3yxrQPQAAAMY"]
[Wed Mar 25 19:18:47.701119 2026] [:error] [pid 25967:tid 25992] [client 172.213.17.84:22914] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid3.php"] [unique_id "acPEl_g8Qtq7ZM4mSFlRxwAAA1Q"]
[Wed Mar 25 19:18:49.253223 2026] [:error] [pid 26321:tid 26364] [client 172.213.17.84:45671] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid3.php"] [unique_id "acPEmfKO65qqGZCSPZpERgAAAhc"]
[Wed Mar 25 19:18:50.527293 2026] [:error] [pid 47946:tid 47952] [client 172.213.17.84:16170] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid3.php"] [unique_id "acPEmjipQTqBMSeKYheC4wAAAQQ"]
[Wed Mar 25 19:18:51.442733 2026] [:error] [pid 25875:tid 25882] [client 172.213.17.84:22943] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "acPEmxJ38QkS3NyfshzxnwAAAoE"]
[Wed Mar 25 19:18:52.455911 2026] [:error] [pid 25967:tid 25995] [client 172.213.17.84:16404] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "acPEnPg8Qtq7ZM4mSFlRzgAAA1c"]
[Wed Mar 25 19:18:53.229626 2026] [:error] [pid 25967:tid 25987] [client 172.213.17.84:16423] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "acPEnfg8Qtq7ZM4mSFlR1AAAA08"]
[Wed Mar 25 19:18:54.253978 2026] [:error] [pid 47946:tid 47970] [client 172.213.17.84:16175] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "acPEnjipQTqBMSeKYheC6gAAARY"]
[Wed Mar 25 19:19:06.915528 2026] [:error] [pid 47946:tid 47953] [client 172.213.17.84:44819] [client 172.213.17.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.213.17.84, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acPEqjipQTqBMSeKYheC7QAAAQU"]
[Wed Mar 25 19:19:10.668588 2026] [:error] [pid 25875:tid 25902] [client 172.213.17.84:16420] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/erty.php"] [unique_id "acPErhJ38QkS3NyfshzxtQAAApU"]
[Wed Mar 25 19:19:11.824643 2026] [:error] [pid 26269:tid 26284] [client 172.213.17.84:28244] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/erty.php"] [unique_id "acPEr0n7e-ZQbaIs7qy4sgAAAYg"]
[Wed Mar 25 19:19:12.814519 2026] [:error] [pid 47989:tid 48010] [client 172.213.17.84:10146] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/erty.php"] [unique_id "acPEsCWKdJMhIccROjnS1wAAAVM"]
[Wed Mar 25 19:19:13.895585 2026] [:error] [pid 25967:tid 25993] [client 172.213.17.84:25307] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/erty.php"] [unique_id "acPEsfg8Qtq7ZM4mSFlSDwAAA1U"]
[Wed Mar 25 19:19:16.987588 2026] [:error] [pid 25967:tid 25992] [client 172.213.17.84:18457] [client 172.213.17.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/app.php"] [unique_id "acPEtPg8Qtq7ZM4mSFlSKgAAA1Q"]
[Wed Mar 25 19:19:17.974791 2026] [:error] [pid 26321:tid 26360] [client 172.213.17.84:34779] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aee.php"] [unique_id "acPEtfKO65qqGZCSPZpEYwAAAhM"]
[Wed Mar 25 19:19:18.753683 2026] [:error] [pid 25967:tid 25995] [client 172.213.17.84:34790] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aee.php"] [unique_id "acPEtvg8Qtq7ZM4mSFlSMgAAA1c"]
[Wed Mar 25 19:19:20.351946 2026] [:error] [pid 47989:tid 47993] [client 172.213.17.84:26899] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aee.php"] [unique_id "acPEuCWKdJMhIccROjnS3QAAAUI"]
[Wed Mar 25 19:19:21.239950 2026] [:error] [pid 47989:tid 47994] [client 172.213.17.84:22961] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aee.php"] [unique_id "acPEuSWKdJMhIccROjnS4QAAAUM"]
[Wed Mar 25 19:19:22.056135 2026] [:error] [pid 47989:tid 48015] [client 172.213.17.84:11618] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zogy1.php"] [unique_id "acPEuiWKdJMhIccROjnS5wAAAVg"]
[Wed Mar 25 19:19:23.036271 2026] [:error] [pid 26269:tid 26290] [client 172.213.17.84:22942] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zogy1.php"] [unique_id "acPEu0n7e-ZQbaIs7qy4tAAAAY4"]
[Wed Mar 25 19:19:24.557440 2026] [:error] [pid 26449:tid 26474] [client 172.213.17.84:11637] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zogy1.php"] [unique_id "acPEvNpZ2T15NDqzAjF4iwAAAlU"]
[Wed Mar 25 19:19:26.768191 2026] [:error] [pid 26321:tid 26357] [client 172.213.17.84:34809] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zogy1.php"] [unique_id "acPEvvKO65qqGZCSPZpEZwAAAhA"]
[Wed Mar 25 19:19:27.864604 2026] [:error] [pid 47989:tid 48013] [client 172.213.17.84:11598] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "acPEvyWKdJMhIccROjnS8wAAAVY"]
[Wed Mar 25 19:19:29.003091 2026] [:error] [pid 47946:tid 47969] [client 172.213.17.84:16163] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "acPEwTipQTqBMSeKYheC7wAAARU"]
[Wed Mar 25 19:19:33.238990 2026] [:error] [pid 47989:tid 48005] [client 172.213.17.84:10150] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "acPExSWKdJMhIccROjnS9wAAAU4"]
[Wed Mar 25 19:19:36.793129 2026] [:error] [pid 26321:tid 26356] [client 172.213.17.84:9471] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "acPEyPKO65qqGZCSPZpEbgAAAg8"]
[Wed Mar 25 19:19:38.149047 2026] [:error] [pid 26449:tid 26459] [client 172.213.17.84:3009] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "acPEytpZ2T15NDqzAjF4oQAAAkY"]
[Wed Mar 25 19:19:39.220580 2026] [:error] [pid 25967:tid 25995] [client 172.213.17.84:26935] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "acPEy_g8Qtq7ZM4mSFlSaQAAA1c"]
[Wed Mar 25 19:19:41.987603 2026] [:error] [pid 25875:tid 25895] [client 172.213.17.84:18436] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "acPEzRJ38QkS3NyfshzxxwAAAo4"]
[Wed Mar 25 19:19:42.950314 2026] [:error] [pid 25875:tid 25905] [client 172.213.17.84:3051] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "acPEzhJ38QkS3NyfshzxygAAApg"]
[Wed Mar 25 19:19:45.252946 2026] [:error] [pid 47989:tid 48015] [client 172.213.17.84:22927] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aapig.php"] [unique_id "acPE0SWKdJMhIccROjnTHgAAAVg"]
[Wed Mar 25 19:19:48.108942 2026] [:error] [pid 47989:tid 47995] [client 172.213.17.84:16130] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aapig.php"] [unique_id "acPE1CWKdJMhIccROjnTKAAAAUQ"]
[Wed Mar 25 19:19:49.224299 2026] [:error] [pid 25967:tid 25983] [client 172.213.17.84:11644] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aapig.php"] [unique_id "acPE1fg8Qtq7ZM4mSFlSkgAAA0s"]
[Wed Mar 25 19:19:50.092317 2026] [:error] [pid 47946:tid 47959] [client 172.213.17.84:3037] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aapig.php"] [unique_id "acPE1jipQTqBMSeKYheC8gAAAQs"]
[Wed Mar 25 19:19:51.498049 2026] [:error] [pid 47989:tid 48014] [client 172.213.17.84:34772] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/com.php"] [unique_id "acPE1yWKdJMhIccROjnTLwAAAVc"]
[Wed Mar 25 19:19:52.833735 2026] [:error] [pid 26449:tid 26458] [client 172.213.17.84:11617] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/com.php"] [unique_id "acPE2NpZ2T15NDqzAjF4qwAAAkU"]
[Wed Mar 25 19:19:53.634779 2026] [:error] [pid 25967:tid 25979] [client 172.213.17.84:11600] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/com.php"] [unique_id "acPE2fg8Qtq7ZM4mSFlSnAAAA0c"]
[Wed Mar 25 19:19:54.679187 2026] [:error] [pid 25967:tid 25992] [client 172.213.17.84:22938] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/com.php"] [unique_id "acPE2vg8Qtq7ZM4mSFlSpAAAA1Q"]
[Wed Mar 25 19:19:55.614925 2026] [:error] [pid 25967:tid 25994] [client 172.213.17.84:16187] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ta0ol.php"] [unique_id "acPE2_g8Qtq7ZM4mSFlSpwAAA1Y"]
[Wed Mar 25 19:19:56.674442 2026] [:error] [pid 25875:tid 25883] [client 172.213.17.84:16150] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ta0ol.php"] [unique_id "acPE3BJ38QkS3Nyfshzx6wAAAoI"]
[Wed Mar 25 19:19:57.366248 2026] [:error] [pid 26321:tid 26365] [client 172.213.17.84:12270] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ta0ol.php"] [unique_id "acPE3fKO65qqGZCSPZpEdQAAAhg"]
[Wed Mar 25 19:19:58.266649 2026] [:error] [pid 47989:tid 48001] [client 172.213.17.84:16418] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ta0ol.php"] [unique_id "acPE3iWKdJMhIccROjnTOwAAAUo"]
[Wed Mar 25 19:19:59.203558 2026] [:error] [pid 26449:tid 26469] [client 172.213.17.84:12413] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "acPE39pZ2T15NDqzAjF4sAAAAlA"]
[Wed Mar 25 19:20:00.125144 2026] [:error] [pid 25967:tid 25989] [client 172.213.17.84:18480] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "acPE4Pg8Qtq7ZM4mSFlSzwAAA1E"]
[Wed Mar 25 19:20:00.790355 2026] [:error] [pid 26321:tid 26351] [client 172.213.17.84:16141] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "acPE4PKO65qqGZCSPZpEkwAAAgo"]
[Wed Mar 25 19:20:01.525093 2026] [:error] [pid 26321:tid 26348] [client 172.213.17.84:26885] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "acPE4fKO65qqGZCSPZpElgAAAgc"]
[Wed Mar 25 19:20:02.315869 2026] [:error] [pid 25875:tid 25899] [client 172.213.17.84:31161] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "acPE4hJ38QkS3Nyfshzx9AAAApI"]
[Wed Mar 25 19:20:03.188110 2026] [:error] [pid 26449:tid 26477] [client 172.213.17.84:35856] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "acPE49pZ2T15NDqzAjF4tAAAAlg"]
[Wed Mar 25 19:20:04.251655 2026] [:error] [pid 26449:tid 26465] [client 172.213.17.84:3022] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "acPE5NpZ2T15NDqzAjF4tgAAAkw"]
[Wed Mar 25 19:20:05.161012 2026] [:error] [pid 25875:tid 25895] [client 172.213.17.84:11616] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "acPE5RJ38QkS3Nyfshzx-gAAAo4"]
[Wed Mar 25 19:20:06.961320 2026] [:error] [pid 26321:tid 26342] [client 172.213.17.84:37917] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wander.php"] [unique_id "acPE5vKO65qqGZCSPZpEpQAAAgM"]
[Wed Mar 25 19:20:18.698084 2026] [:error] [pid 47989:tid 48015] [client 172.213.17.84:22971] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xper1.php"] [unique_id "acPE8iWKdJMhIccROjnTgwAAAVg"]
[Wed Mar 25 19:20:19.771782 2026] [:error] [pid 25967:tid 25991] [client 172.213.17.84:25287] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xper1.php"] [unique_id "acPE8_g8Qtq7ZM4mSFlTOgAAA1M"]
[Wed Mar 25 19:20:21.875953 2026] [:error] [pid 25875:tid 25905] [client 172.213.17.84:15200] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xper1.php"] [unique_id "acPE9RJ38QkS3NyfshzyCAAAApg"]
[Wed Mar 25 19:20:23.420950 2026] [:error] [pid 25875:tid 25896] [client 172.213.17.84:14096] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xper1.php"] [unique_id "acPE9xJ38QkS3NyfshzyCwAAAo8"]
[Wed Mar 25 19:20:24.608694 2026] [:error] [pid 892:tid 919] [client 172.213.17.84:9856] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "acPE-CT_G8WMU3T3yxrQaAAAANQ"]
[Wed Mar 25 19:20:25.468403 2026] [:error] [pid 25875:tid 25900] [client 172.213.17.84:12268] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "acPE-RJ38QkS3NyfshzyDAAAApM"]
[Wed Mar 25 19:20:26.338965 2026] [:error] [pid 26321:tid 26363] [client 172.213.17.84:8588] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "acPE-vKO65qqGZCSPZpEtgAAAhY"]
[Wed Mar 25 19:20:28.130925 2026] [:error] [pid 756:tid 860] [client 172.213.17.84:38351] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "acPE_DOaW6oylMIDBCQeBQAAAIg"]
[Wed Mar 25 19:20:28.941954 2026] [:error] [pid 25875:tid 25904] [client 172.213.17.84:10819] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "acPE_BJ38QkS3NyfshzyEAAAApc"]
[Wed Mar 25 19:20:29.599488 2026] [:error] [pid 25875:tid 25903] [client 172.213.17.84:30056] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "acPE_RJ38QkS3NyfshzyEwAAApY"]
[Wed Mar 25 19:20:30.433421 2026] [:error] [pid 47989:tid 47993] [client 172.213.17.84:24395] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "acPE_iWKdJMhIccROjnTkAAAAUI"]
[Wed Mar 25 19:20:31.828585 2026] [:error] [pid 47989:tid 47996] [client 172.213.17.84:13997] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "acPE_yWKdJMhIccROjnTlAAAAUU"]
[Wed Mar 25 19:20:33.052127 2026] [:error] [pid 25875:tid 25889] [client 172.213.17.84:17839] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/privacy.php"] [unique_id "acPFARJ38QkS3NyfshzyFgAAAog"]
[Wed Mar 25 19:20:33.752895 2026] [:error] [pid 892:tid 911] [client 172.213.17.84:2186] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/privacy.php"] [unique_id "acPFAST_G8WMU3T3yxrQbwAAAM0"]
[Wed Mar 25 19:20:35.027623 2026] [:error] [pid 25967:tid 25978] [client 172.213.17.84:22616] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/privacy.php"] [unique_id "acPFA_g8Qtq7ZM4mSFlTRAAAA0Y"]
[Wed Mar 25 19:20:35.910498 2026] [:error] [pid 26321:tid 26360] [client 172.213.17.84:27410] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/privacy.php"] [unique_id "acPFA_KO65qqGZCSPZpEvQAAAhM"]
[Wed Mar 25 19:20:36.775765 2026] [:error] [pid 25875:tid 25897] [client 172.213.17.84:10300] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "acPFBBJ38QkS3NyfshzyHQAAApA"]
[Wed Mar 25 19:20:37.644934 2026] [:error] [pid 26321:tid 26365] [client 172.213.17.84:28169] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "acPFBfKO65qqGZCSPZpEwAAAAhg"]
[Wed Mar 25 19:20:38.539840 2026] [:error] [pid 26321:tid 26364] [client 172.213.17.84:11828] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "acPFBvKO65qqGZCSPZpExgAAAhc"]
[Wed Mar 25 19:20:39.301757 2026] [:error] [pid 25967:tid 25989] [client 172.213.17.84:12311] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "acPFB_g8Qtq7ZM4mSFlTSQAAA1E"]
[Wed Mar 25 19:20:40.041195 2026] [:error] [pid 25967:tid 25988] [client 172.213.17.84:27519] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "acPFCPg8Qtq7ZM4mSFlTSwAAA1A"]
[Wed Mar 25 19:20:40.724248 2026] [:error] [pid 25967:tid 25987] [client 172.213.17.84:8410] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "acPFCPg8Qtq7ZM4mSFlTTwAAA08"]
[Wed Mar 25 19:20:41.407656 2026] [:error] [pid 25967:tid 25978] [client 172.213.17.84:22616] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "acPFCfg8Qtq7ZM4mSFlTUQAAA0Y"]
[Wed Mar 25 19:20:42.074319 2026] [:error] [pid 25967:tid 25994] [client 172.213.17.84:11449] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gm.php"] [unique_id "acPFCvg8Qtq7ZM4mSFlTUgAAA1Y"]
[Wed Mar 25 19:20:42.933701 2026] [:error] [pid 892:tid 914] [client 172.213.17.84:22596] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "acPFCiT_G8WMU3T3yxrQdAAAANA"]
[Wed Mar 25 19:20:43.708870 2026] [:error] [pid 47946:tid 47961] [client 172.213.17.84:41068] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "acPFCzipQTqBMSeKYheC_AAAAQ0"]
[Wed Mar 25 19:20:44.449277 2026] [:error] [pid 47946:tid 47969] [client 172.213.17.84:11727] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "acPFDDipQTqBMSeKYheC_QAAARU"]
[Wed Mar 25 19:20:45.162054 2026] [:error] [pid 25967:tid 25981] [client 172.213.17.84:11722] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "acPFDfg8Qtq7ZM4mSFlTXQAAA0k"]
[Wed Mar 25 19:20:45.839852 2026] [:error] [pid 25967:tid 25988] [client 172.213.17.84:27502] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1.php"] [unique_id "acPFDfg8Qtq7ZM4mSFlTYQAAA1A"]
[Wed Mar 25 19:20:46.431626 2026] [:error] [pid 25967:tid 25975] [client 172.213.17.84:8404] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1.php"] [unique_id "acPFDvg8Qtq7ZM4mSFlTZAAAA0M"]
[Wed Mar 25 19:20:47.312442 2026] [:error] [pid 25969:tid 26027] [client 172.213.17.84:39118] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1.php"] [unique_id "acPFDxd3aEUmOfdKja8HzgAAA8E"]
[Wed Mar 25 19:20:48.134317 2026] [:error] [pid 25967:tid 25987] [client 172.213.17.84:11453] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1.php"] [unique_id "acPFEPg8Qtq7ZM4mSFlTawAAA08"]
[Wed Mar 25 19:20:48.931928 2026] [:error] [pid 47989:tid 47991] [client 172.213.17.84:11081] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/torsa1.php"] [unique_id "acPFECWKdJMhIccROjnTygAAAUA"]
[Wed Mar 25 19:20:49.532612 2026] [:error] [pid 47989:tid 48009] [client 172.213.17.84:42779] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/torsa1.php"] [unique_id "acPFESWKdJMhIccROjnT0AAAAVI"]
[Wed Mar 25 19:20:50.426466 2026] [:error] [pid 47989:tid 47992] [client 172.213.17.84:21744] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/torsa1.php"] [unique_id "acPFEiWKdJMhIccROjnT1gAAAUE"]
[Wed Mar 25 19:20:51.152061 2026] [:error] [pid 25967:tid 25985] [client 172.213.17.84:8787] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/torsa1.php"] [unique_id "acPFE_g8Qtq7ZM4mSFlTbgAAA00"]
[Wed Mar 25 19:20:52.008371 2026] [:error] [pid 26449:tid 26476] [client 172.213.17.84:39164] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "acPFFNpZ2T15NDqzAjF4zwAAAlc"]
[Wed Mar 25 19:20:52.863467 2026] [:error] [pid 756:tid 859] [client 172.213.17.84:11103] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "acPFFDOaW6oylMIDBCQeDgAAAIc"]
[Wed Mar 25 19:20:53.610950 2026] [:error] [pid 47989:tid 48002] [client 172.213.17.84:52901] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "acPFFSWKdJMhIccROjnT6AAAAUs"]
[Wed Mar 25 19:20:54.322023 2026] [:error] [pid 25875:tid 25884] [client 172.213.17.84:52899] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "acPFFhJ38QkS3NyfshzyJQAAAoM"]
[Wed Mar 25 19:20:54.877928 2026] [:error] [pid 25875:tid 25885] [client 172.213.17.84:35307] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "acPFFhJ38QkS3NyfshzyJwAAAoQ"]
[Wed Mar 25 19:20:55.458028 2026] [:error] [pid 25875:tid 25886] [client 172.213.17.84:36546] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "acPFFxJ38QkS3NyfshzyKAAAAoU"]
[Wed Mar 25 19:20:55.983754 2026] [:error] [pid 25875:tid 25888] [client 172.213.17.84:23515] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "acPFFxJ38QkS3NyfshzyMAAAAoc"]
[Wed Mar 25 19:20:56.689863 2026] [:error] [pid 25875:tid 25889] [client 172.213.17.84:38315] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "acPFGBJ38QkS3NyfshzyMQAAAog"]
[Wed Mar 25 19:20:57.359349 2026] [:error] [pid 25967:tid 25995] [client 172.213.17.84:11255] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "acPFGfg8Qtq7ZM4mSFlTcQAAA1c"]
[Wed Mar 25 19:20:58.477323 2026] [:error] [pid 47946:tid 47951] [client 172.213.17.84:12447] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "acPFGjipQTqBMSeKYheDAQAAAQM"]
[Wed Mar 25 19:20:59.386055 2026] [:error] [pid 25967:tid 25972] [client 172.213.17.84:21696] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "acPFG_g8Qtq7ZM4mSFlTdQAAA0A"]
[Wed Mar 25 19:21:00.087969 2026] [:error] [pid 25875:tid 25891] [client 172.213.17.84:10624] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "acPFHBJ38QkS3NyfshzyOgAAAoo"]
[Wed Mar 25 19:21:01.145758 2026] [:error] [pid 25875:tid 25899] [client 172.213.17.84:15910] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwq13.php"] [unique_id "acPFHRJ38QkS3NyfshzyPwAAApI"]
[Wed Mar 25 19:21:01.909455 2026] [:error] [pid 25875:tid 25888] [client 172.213.17.84:15902] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwq13.php"] [unique_id "acPFHRJ38QkS3NyfshzyRAAAAoc"]
[Wed Mar 25 19:21:02.797755 2026] [:error] [pid 25969:tid 26040] [client 172.213.17.84:35294] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwq13.php"] [unique_id "acPFHhd3aEUmOfdKja8H1AAAA84"]
[Wed Mar 25 19:21:03.657727 2026] [:error] [pid 26449:tid 26456] [client 172.213.17.84:8335] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwq13.php"] [unique_id "acPFH9pZ2T15NDqzAjF43QAAAkM"]
[Wed Mar 25 19:21:04.972687 2026] [:error] [pid 47989:tid 48003] [client 172.213.17.84:9669] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6kDPjgFTmvS.php"] [unique_id "acPFICWKdJMhIccROjnT8gAAAUw"]
[Wed Mar 25 19:21:05.911614 2026] [:error] [pid 26321:tid 26362] [client 172.213.17.84:35313] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6kDPjgFTmvS.php"] [unique_id "acPFIfKO65qqGZCSPZpEzQAAAhU"]
[Wed Mar 25 19:21:06.722083 2026] [:error] [pid 47946:tid 47965] [client 172.213.17.84:21705] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6kDPjgFTmvS.php"] [unique_id "acPFIjipQTqBMSeKYheDBQAAARE"]
[Wed Mar 25 19:21:07.887882 2026] [:error] [pid 26449:tid 26454] [client 172.213.17.84:11467] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6kDPjgFTmvS.php"] [unique_id "acPFI9pZ2T15NDqzAjF44AAAAkE"]
[Wed Mar 25 19:21:08.877136 2026] [:error] [pid 26269:tid 26295] [client 172.213.17.84:2349] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sc.php"] [unique_id "acPFJEn7e-ZQbaIs7qy4xgAAAZM"]
[Wed Mar 25 19:21:10.121148 2026] [:error] [pid 26449:tid 26470] [client 172.213.17.84:35322] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sc.php"] [unique_id "acPFJtpZ2T15NDqzAjF45gAAAlE"]
[Wed Mar 25 19:21:11.092918 2026] [:error] [pid 26321:tid 26348] [client 172.213.17.84:36586] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sc.php"] [unique_id "acPFJ_KO65qqGZCSPZpE0AAAAgc"]
[Wed Mar 25 19:21:11.870152 2026] [:error] [pid 26321:tid 26349] [client 172.213.17.84:52876] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sc.php"] [unique_id "acPFJ_KO65qqGZCSPZpE0gAAAgg"]
[Wed Mar 25 19:21:12.810340 2026] [:error] [pid 25967:tid 25995] [client 172.213.17.84:11492] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/acxx.php"] [unique_id "acPFKPg8Qtq7ZM4mSFlTfgAAA1c"]
[Wed Mar 25 19:21:15.143764 2026] [:error] [pid 25967:tid 25996] [client 172.213.17.84:23533] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/acxx.php"] [unique_id "acPFK_g8Qtq7ZM4mSFlThAAAA1g"]
[Wed Mar 25 19:21:26.869088 2026] [:error] [pid 25967:tid 25993] [client 172.213.17.84:21756] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aaa.php"] [unique_id "acPFNvg8Qtq7ZM4mSFlTpQAAA1U"]
[Wed Mar 25 19:21:27.666252 2026] [:error] [pid 26321:tid 26349] [client 172.213.17.84:19183] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aaa.php"] [unique_id "acPFN_KO65qqGZCSPZpE3QAAAgg"]
[Wed Mar 25 19:21:28.441848 2026] [:error] [pid 26321:tid 26340] [client 172.213.17.84:8822] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aaa.php"] [unique_id "acPFOPKO65qqGZCSPZpE3wAAAgE"]
[Wed Mar 25 19:21:30.663048 2026] [:error] [pid 892:tid 922] [client 172.213.17.84:14865] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aaa.php"] [unique_id "acPFOiT_G8WMU3T3yxrQhgAAANc"]
[Wed Mar 25 19:21:36.103099 2026] [:error] [pid 25875:tid 25904] [client 172.213.17.84:11044] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-freya.php"] [unique_id "acPFQBJ38QkS3NyfshzySAAAApc"]
[Wed Mar 25 19:21:36.754663 2026] [:error] [pid 892:tid 921] [client 172.213.17.84:11426] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-freya.php"] [unique_id "acPFQCT_G8WMU3T3yxrQhwAAANY"]
[Wed Mar 25 19:21:37.731186 2026] [:error] [pid 756:tid 867] [client 172.213.17.84:11717] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-freya.php"] [unique_id "acPFQTOaW6oylMIDBCQeEgAAAI8"]
[Wed Mar 25 19:21:38.801354 2026] [:error] [pid 892:tid 895] [client 172.213.17.84:11434] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-freya.php"] [unique_id "acPFQiT_G8WMU3T3yxrQjAAAAME"]
[Wed Mar 25 19:21:40.997785 2026] [:error] [pid 892:tid 922] [client 172.213.17.84:30532] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X7x.php"] [unique_id "acPFRCT_G8WMU3T3yxrQkwAAANc"]
[Wed Mar 25 19:21:41.743947 2026] [:error] [pid 25875:tid 25892] [client 172.213.17.84:11850] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X7x.php"] [unique_id "acPFRRJ38QkS3NyfshzyUAAAAos"]
[Wed Mar 25 19:21:43.467452 2026] [:error] [pid 26269:tid 26286] [client 172.213.17.84:27420] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X7x.php"] [unique_id "acPFR0n7e-ZQbaIs7qy42gAAAYo"]
[Wed Mar 25 19:21:45.436249 2026] [:error] [pid 47946:tid 47948] [client 172.213.17.84:28179] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X7x.php"] [unique_id "acPFSTipQTqBMSeKYheDBwAAAQA"]
[Wed Mar 25 19:21:47.431295 2026] [:error] [pid 47989:tid 48010] [client 172.213.17.84:9976] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/opts.php"] [unique_id "acPFSyWKdJMhIccROjnUJAAAAVM"]
[Wed Mar 25 19:21:48.227452 2026] [:error] [pid 892:tid 902] [client 172.213.17.84:11785] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/opts.php"] [unique_id "acPFTCT_G8WMU3T3yxrQlgAAAMU"]
[Wed Mar 25 19:21:49.940789 2026] [:error] [pid 25967:tid 25976] [client 172.213.17.84:12306] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/opts.php"] [unique_id "acPFTfg8Qtq7ZM4mSFlTsgAAA0Q"]
[Wed Mar 25 19:21:51.623309 2026] [:error] [pid 25967:tid 25995] [client 172.213.17.84:22976] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/opts.php"] [unique_id "acPFT_g8Qtq7ZM4mSFlTtwAAA1c"]
[Wed Mar 25 19:21:52.787424 2026] [:error] [pid 26321:tid 26364] [client 172.213.17.84:14033] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filer.php"] [unique_id "acPFUPKO65qqGZCSPZpE8QAAAhc"]
[Wed Mar 25 19:21:53.907538 2026] [:error] [pid 47989:tid 48001] [client 172.213.17.84:39737] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filer.php"] [unique_id "acPFUSWKdJMhIccROjnUKQAAAUo"]
[Wed Mar 25 19:21:54.519950 2026] [:error] [pid 47989:tid 47994] [client 172.213.17.84:2201] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filer.php"] [unique_id "acPFUiWKdJMhIccROjnULAAAAUM"]
[Wed Mar 25 19:21:55.592198 2026] [:error] [pid 25969:tid 26042] [client 172.213.17.84:39725] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filer.php"] [unique_id "acPFUxd3aEUmOfdKja8H5gAAA9A"]
[Wed Mar 25 19:21:56.507620 2026] [:error] [pid 25967:tid 25989] [client 172.213.17.84:30020] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lites.php"] [unique_id "acPFVPg8Qtq7ZM4mSFlTvgAAA1E"]
[Wed Mar 25 19:21:57.483150 2026] [:error] [pid 47989:tid 47991] [client 172.213.17.84:8632] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lites.php"] [unique_id "acPFVSWKdJMhIccROjnUNgAAAUA"]
[Wed Mar 25 19:21:59.456494 2026] [:error] [pid 47989:tid 47993] [client 172.213.17.84:8581] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lites.php"] [unique_id "acPFVyWKdJMhIccROjnUOgAAAUI"]
[Wed Mar 25 19:22:00.636863 2026] [:error] [pid 47989:tid 48004] [client 172.213.17.84:8577] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lites.php"] [unique_id "acPFWCWKdJMhIccROjnUQAAAAU0"]
[Wed Mar 25 19:22:03.061531 2026] [:error] [pid 47989:tid 48014] [client 172.213.17.84:22923] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cord.php"] [unique_id "acPFWyWKdJMhIccROjnUTQAAAVc"]
[Wed Mar 25 19:22:05.943948 2026] [:error] [pid 25967:tid 25973] [client 172.213.17.84:25288] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cord.php"] [unique_id "acPFXfg8Qtq7ZM4mSFlTxAAAA0E"]
[Wed Mar 25 19:22:10.382833 2026] [:error] [pid 25875:tid 25895] [client 172.213.17.84:22950] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cord.php"] [unique_id "acPFYhJ38QkS3NyfshzyagAAAo4"]
[Wed Mar 25 19:22:11.919707 2026] [:error] [pid 47989:tid 48007] [client 172.213.17.84:34807] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cord.php"] [unique_id "acPFYyWKdJMhIccROjnUYwAAAVA"]
[Wed Mar 25 19:22:13.647764 2026] [:error] [pid 26449:tid 26459] [client 172.213.17.84:2154] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shlo.php"] [unique_id "acPFZdpZ2T15NDqzAjF5BwAAAkY"]
[Wed Mar 25 19:22:14.229036 2026] [:error] [pid 26321:tid 26350] [client 172.213.17.84:31119] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shlo.php"] [unique_id "acPFZvKO65qqGZCSPZpFAAAAAgk"]
[Wed Mar 25 19:22:15.276653 2026] [:error] [pid 47989:tid 47996] [client 172.213.17.84:33020] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shlo.php"] [unique_id "acPFZyWKdJMhIccROjnUZAAAAUU"]
[Wed Mar 25 19:22:16.281728 2026] [:error] [pid 47989:tid 48002] [client 172.213.17.84:22259] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shlo.php"] [unique_id "acPFaCWKdJMhIccROjnUaQAAAUs"]
[Wed Mar 25 19:22:17.386659 2026] [:error] [pid 26269:tid 26300] [client 172.213.17.84:16983] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "acPFaUn7e-ZQbaIs7qy45AAAAZg"]
[Wed Mar 25 19:22:18.428929 2026] [:error] [pid 47989:tid 48015] [client 172.213.17.84:14992] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "acPFaiWKdJMhIccROjnUcQAAAVg"]
[Wed Mar 25 19:22:19.097789 2026] [:error] [pid 47989:tid 48011] [client 172.213.17.84:16974] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "acPFayWKdJMhIccROjnUdQAAAVQ"]
[Wed Mar 25 19:22:20.171133 2026] [:error] [pid 892:tid 896] [client 172.213.17.84:13056] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "acPFbCT_G8WMU3T3yxrQpAAAAMI"]
[Wed Mar 25 19:22:21.275519 2026] [:error] [pid 47989:tid 47995] [client 172.213.17.84:47259] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "acPFbSWKdJMhIccROjnUfAAAAUQ"]
[Wed Mar 25 19:22:22.464179 2026] [:error] [pid 26321:tid 26349] [client 172.213.17.84:20627] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "acPFbvKO65qqGZCSPZpFCQAAAgg"]
[Wed Mar 25 19:22:23.246334 2026] [:error] [pid 25967:tid 25984] [client 172.213.17.84:23997] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "acPFb_g8Qtq7ZM4mSFlT0AAAA0w"]
[Wed Mar 25 19:22:24.457524 2026] [:error] [pid 26449:tid 26460] [client 172.213.17.84:21294] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "acPFcNpZ2T15NDqzAjF5DgAAAkc"]
[Wed Mar 25 19:22:25.851825 2026] [:error] [pid 25969:tid 26044] [client 172.213.17.84:22573] [client 172.213.17.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/juuuu.php"] [unique_id "acPFcRd3aEUmOfdKja8H7gAAA9I"]
[Wed Mar 25 19:57:01.840305 2026] [:error] [pid 47946:tid 47960] [client 163.223.13.96:58976] [client 163.223.13.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 163.223.13.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acPNjTipQTqBMSeKYheE_AAAAQw"]
[Wed Mar 25 19:57:06.409923 2026] [:error] [pid 26321:tid 26341] [client 163.223.13.96:58986] [client 163.223.13.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 163.223.13.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acPNkvKO65qqGZCSPZpLXQAAAgI"], referer: https://expressinteriors.com/wp-login.php
[Wed Mar 25 20:16:58.882064 2026] [:error] [pid 25875:tid 25901] [client 43.173.1.69:60648] [client 43.173.1.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acPSOhJ38QkS3NyfshwJpAAAApQ"]
[Wed Mar 25 21:02:24.682681 2026] [:error] [pid 25967:tid 25976] [client 203.2.64.59:47431] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acPc4Pg8Qtq7ZM4mSFls8wAAA0Q"]
[Wed Mar 25 21:18:58.732359 2026] [:error] [pid 26321:tid 26363] [client 37.40.91.255:50591] [client 37.40.91.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.40.91.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acPgwvKO65qqGZCSPZpasgAAAhY"]
[Wed Mar 25 21:20:13.695768 2026] [:error] [pid 25969:tid 26050] [client 112.204.159.15:59642] [client 112.204.159.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.204.159.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acPhDRd3aEUmOfdKja8SgAAAA9g"]
[Wed Mar 25 22:22:12.872608 2026] [:error] [pid 25875:tid 25898] [client 192.185.4.99:25488] [client 192.185.4.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.4.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acPvlBJ38QkS3NyfshxATgAAApE"]
[Wed Mar 25 22:22:14.002505 2026] [:error] [pid 25875:tid 25886] [client 192.185.4.99:25488] [client 192.185.4.99] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.4.99, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acPvlhJ38QkS3NyfshxATwAAAoU"], referer: https://expressinteriors.com/wp-login.php
[Wed Mar 25 23:07:51.439447 2026] [:error] [pid 47946:tid 47970] [client 45.139.177.13:53683] [client 45.139.177.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.139.177.13, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acP6RzipQTqBMSeKYhePZgAAARY"], referer: https://expressinteriors.com/
[Wed Mar 25 23:07:53.902644 2026] [:error] [pid 892:tid 921] [client 45.139.177.13:38235] [client 45.139.177.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.139.177.13, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acP6SST_G8WMU3T3yxrn2QAAANY"], referer: https://expressinteriors.com/wp-login.php?action=register
[Wed Mar 25 23:19:44.278483 2026] [:error] [pid 26449:tid 26454] [client 43.167.245.18:37608] [client 43.167.245.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acP9ENpZ2T15NDqzAjGX-AAAAkE"]
[Thu Mar 26 00:02:52.548420 2026] [:error] [pid 25967:tid 25977] [client 37.40.91.255:50736] [client 37.40.91.255] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acQHLPg8Qtq7ZM4mSFmezAAAA0U"]
[Thu Mar 26 00:04:25.620280 2026] [:error] [pid 47989:tid 47996] [client 37.40.91.255:51227] [client 37.40.91.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.40.91.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acQHiSWKdJMhIccROjkgKgAAAUU"]
[Thu Mar 26 00:05:47.170382 2026] [:error] [pid 47989:tid 48000] [client 37.40.91.255:50946] [client 37.40.91.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.40.91.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acQH2yWKdJMhIccROjkghAAAAUk"]
[Thu Mar 26 00:07:09.085894 2026] [:error] [pid 25967:tid 25996] [client 37.40.91.255:50598] [client 37.40.91.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.40.91.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acQILfg8Qtq7ZM4mSFmgZwAAA1g"]
[Thu Mar 26 00:08:30.940378 2026] [:error] [pid 892:tid 921] [client 37.40.91.255:50944] [client 37.40.91.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.40.91.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acQIfiT_G8WMU3T3yxruNgAAANY"]
[Thu Mar 26 00:09:50.944483 2026] [:error] [pid 25967:tid 25974] [client 37.40.91.255:50834] [client 37.40.91.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.40.91.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acQIzvg8Qtq7ZM4mSFmhYgAAA0I"]
[Thu Mar 26 00:42:07.980058 2026] [:error] [pid 56131:tid 56141] [client 172.59.216.165:4497] [client 172.59.216.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.59.216.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acQQX0g5t1V4ZYPCUhwWWwAAAAI"]
[Thu Mar 26 01:34:35.102118 2026] [:error] [pid 55734:tid 55842] [client 49.51.245.241:54192] [client 49.51.245.241] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acQcq8_x4fL7PCmNzkCBvwAAANA"]
[Thu Mar 26 03:05:53.116832 2026] [:error] [pid 55735:tid 55863] [client 152.237.7.92:19498] [client 152.237.7.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.237.7.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acQyEUhXsYCMQZKUd5PAlQAAAQg"]
[Thu Mar 26 04:21:01.548307 2026] [:error] [pid 19818:tid 19827] [client 122.51.236.174:43440] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acRDrczaSnm3d1BeM5UZswAAAMc"]
[Thu Mar 26 05:15:16.058509 2026] [:error] [pid 19818:tid 19829] [client 43.153.19.83:37062] [client 43.153.19.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acRQZMzaSnm3d1BeM5U4bAAAAMk"]
[Thu Mar 26 05:16:24.575854 2026] [autoindex:error] [pid 19710:tid 19739] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:24.695954 2026] [autoindex:error] [pid 19710:tid 19728] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:24.817436 2026] [autoindex:error] [pid 19710:tid 19733] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:24.934981 2026] [autoindex:error] [pid 19710:tid 19726] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:25.073274 2026] [autoindex:error] [pid 19710:tid 19729] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:25.222073 2026] [autoindex:error] [pid 19710:tid 19745] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:25.343317 2026] [autoindex:error] [pid 19710:tid 19743] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:28.766088 2026] [autoindex:error] [pid 19710:tid 19741] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:29.550955 2026] [autoindex:error] [pid 19710:tid 19738] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:29.674833 2026] [autoindex:error] [pid 19710:tid 19722] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:29.798075 2026] [autoindex:error] [pid 19710:tid 19739] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:29.917211 2026] [autoindex:error] [pid 19710:tid 19728] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:30.035943 2026] [autoindex:error] [pid 19710:tid 19731] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:30.154377 2026] [autoindex:error] [pid 19710:tid 19744] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:30.279724 2026] [autoindex:error] [pid 19710:tid 19743] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:30.399096 2026] [autoindex:error] [pid 19710:tid 19733] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:30.518492 2026] [autoindex:error] [pid 19710:tid 19746] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:34.100697 2026] [autoindex:error] [pid 19710:tid 19740] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:34.363529 2026] [autoindex:error] [pid 19710:tid 19731] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:34.488697 2026] [autoindex:error] [pid 19710:tid 19726] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:34.608986 2026] [autoindex:error] [pid 19710:tid 19735] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:34.737370 2026] [autoindex:error] [pid 19710:tid 19723] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:35.492909 2026] [autoindex:error] [pid 19710:tid 19746] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:35.613598 2026] [autoindex:error] [pid 19710:tid 19725] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:35.755766 2026] [autoindex:error] [pid 19710:tid 19733] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:35.875982 2026] [autoindex:error] [pid 19710:tid 19737] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:35.995006 2026] [autoindex:error] [pid 19710:tid 19741] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:38.056093 2026] [autoindex:error] [pid 19710:tid 19722] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:38.175679 2026] [autoindex:error] [pid 19710:tid 19739] [client 40.115.137.81:35666] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Mar 26 05:16:39.688684 2026] [:error] [pid 19710:tid 19743] [client 40.115.137.81:35666] [client 40.115.137.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Response/"] [unique_id "acRQtwVEWP8Ar68Njk6ClgAAABU"]
[Thu Mar 26 05:16:40.167305 2026] [:error] [pid 19818:tid 19820] [client 40.115.137.81:36440] [client 40.115.137.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Response/"] [unique_id "acRQuMzaSnm3d1BeM5U5HQAAAMA"]
[Thu Mar 26 05:16:40.686626 2026] [:error] [pid 19711:tid 19750] [client 40.115.137.81:36475] [client 40.115.137.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Response/"] [unique_id "acRQuGj3l1y81GYfluQTwwAAAEE"]
[Thu Mar 26 05:16:41.171281 2026] [:error] [pid 19818:tid 19833] [client 40.115.137.81:36435] [client 40.115.137.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Response/"] [unique_id "acRQuczaSnm3d1BeM5U5IAAAAM0"]
[Thu Mar 26 06:33:30.981043 2026] [:error] [pid 19710:tid 19746] [client 152.237.7.92:20752] [client 152.237.7.92] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acRiugVEWP8Ar68Njk6ZWAAAABg"]
[Thu Mar 26 06:35:13.766537 2026] [:error] [pid 19818:tid 19828] [client 152.237.7.92:18857] [client 152.237.7.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.237.7.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acRjIczaSnm3d1BeM5VuSQAAAMg"]
[Thu Mar 26 06:37:13.532597 2026] [:error] [pid 19710:tid 19724] [client 152.237.7.92:21004] [client 152.237.7.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.237.7.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acRjmQVEWP8Ar68Njk6aiwAAAAI"]
[Thu Mar 26 06:39:14.541157 2026] [:error] [pid 60829:tid 60848] [client 152.237.7.92:18955] [client 152.237.7.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.237.7.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acRkEvTdjHKeZokybaQDfQAAARE"]
[Thu Mar 26 06:41:10.613811 2026] [:error] [pid 19818:tid 19829] [client 152.237.7.92:20237] [client 152.237.7.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.237.7.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acRkhszaSnm3d1BeM5Vy8wAAAMk"]
[Thu Mar 26 06:43:12.226303 2026] [:error] [pid 19711:tid 19764] [client 152.237.7.92:17872] [client 152.237.7.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.237.7.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acRlAGj3l1y81GYfluQz5QAAAE8"]
[Thu Mar 26 07:12:53.692927 2026] [:error] [pid 60829:tid 60832] [client 192.3.207.218:57596] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/artisan"] [unique_id "acRr9fTdjHKeZokybaQppAAAAQE"]
[Thu Mar 26 07:12:54.119471 2026] [:error] [pid 19711:tid 19759] [client 192.3.207.218:58220] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/artisan"] [unique_id "acRr9mj3l1y81GYfluRJkQAAAEo"]
[Thu Mar 26 07:12:55.254485 2026] [:error] [pid 19710:tid 19744] [client 192.3.207.218:58777] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/artisan"] [unique_id "acRr9wVEWP8Ar68Njk6pSwAAABY"]
[Thu Mar 26 07:12:55.679535 2026] [:error] [pid 31670:tid 31693] [client 192.3.207.218:59651] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/artisan"] [unique_id "acRr9zXVthXxCnWjOTQxwwAAAVU"]
[Thu Mar 26 07:12:56.539890 2026] [:error] [pid 60829:tid 60849] [client 192.3.207.218:60112] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "acRr-PTdjHKeZokybaQp6AAAARI"]
[Thu Mar 26 10:39:44.380175 2026] [:error] [pid 31778:tid 31806] [client 43.157.22.109:60676] [client 43.157.22.109] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acSccA3kybI2o-xasmB8-wAAAc0"]
[Thu Mar 26 10:55:48.359424 2026] [:error] [pid 60829:tid 60844] [client 120.71.59.24:60848] [client 120.71.59.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acSgNPTdjHKeZokybaRfoQAAAQ0"]
[Thu Mar 26 12:14:54.174747 2026] [:error] [pid 31670:tid 31684] [client 87.6.224.99:14914] [client 87.6.224.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 87.6.224.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acSyvjXVthXxCnWjOTTIeQAAAUw"]
[Thu Mar 26 12:14:54.772061 2026] [:error] [pid 19818:tid 19824] [client 103.68.176.236:54118] [client 103.68.176.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.68.176.236, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acSyvszaSnm3d1BeM5UcsQAAAMQ"]
[Thu Mar 26 12:18:47.139498 2026] [:error] [pid 19712:tid 19791] [client 103.68.176.234:54702] [client 103.68.176.234] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acSzp9WhKhRNqm23vFP48wAAAI8"]
[Thu Mar 26 12:36:05.006308 2026] [:error] [pid 31780:tid 31842] [client 170.106.107.87:55898] [client 170.106.107.87] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acS3tZJDwZsy5O4ZXEghggAAAhU"]
[Thu Mar 26 15:38:47.156486 2026] [:error] [pid 31780:tid 31822] [client 170.106.35.187:35218] [client 170.106.35.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acTih5JDwZsy5O4ZXEheiAAAAgI"]
[Thu Mar 26 17:35:27.548072 2026] [:error] [pid 31670:tid 31682] [client 196.16.2.223:53961] [client 196.16.2.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.16.2.223, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acT93zXVthXxCnWjOTRf1gAAAUo"], referer: https://expressinteriors.com
[Thu Mar 26 18:31:32.008892 2026] [:error] [pid 31778:tid 31794] [client 182.44.67.97:34712] [client 182.44.67.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acULBA3kybI2o-xasmD3AQAAAcE"]
[Thu Mar 26 20:35:45.784059 2026] [:error] [pid 19818:tid 19834] [client 43.153.119.119:46746] [client 43.153.119.119] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acUoIczaSnm3d1BeM5UlmAAAAM4"]
[Thu Mar 26 22:25:10.402587 2026] [:error] [pid 31780:tid 31842] [client 43.153.71.12:59110] [client 43.153.71.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acVBxpJDwZsy5O4ZXEjNWgAAAhU"]
[Thu Mar 26 23:07:22.531665 2026] [:error] [pid 19711:tid 19753] [client 45.175.113.36:23298] [client 45.175.113.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.175.113.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acVLqmj3l1y81GYfluTU2wAAAEQ"]
[Thu Mar 26 23:09:26.534436 2026] [:error] [pid 19712:tid 19779] [client 45.175.113.36:23424] [client 45.175.113.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.175.113.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acVMJtWhKhRNqm23vFNa8wAAAIM"]
[Thu Mar 26 23:11:01.469549 2026] [:error] [pid 31670:tid 31672] [client 45.175.113.36:23494] [client 45.175.113.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.175.113.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acVMhTXVthXxCnWjOTTsMAAAAUA"]
[Thu Mar 26 23:12:22.257773 2026] [:error] [pid 19711:tid 19773] [client 45.175.113.36:23907] [client 45.175.113.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.175.113.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acVM1mj3l1y81GYfluTXIwAAAFg"]
[Thu Mar 26 23:13:56.607876 2026] [:error] [pid 31780:tid 31834] [client 45.175.113.36:23410] [client 45.175.113.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.175.113.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acVNNJJDwZsy5O4ZXEjUNwAAAg0"]
[Thu Mar 26 23:47:56.645768 2026] [:error] [pid 19710:tid 19737] [client 20.63.103.30:59657] [client 20.63.103.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "acVVLAVEWP8Ar68Njk5T0wAAAA8"]
[Thu Mar 26 23:47:57.478834 2026] [:error] [pid 19710:tid 19728] [client 20.63.103.30:59705] [client 20.63.103.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "acVVLQVEWP8Ar68Njk5T2gAAAAY"]
[Thu Mar 26 23:47:58.317696 2026] [:error] [pid 31780:tid 31824] [client 20.63.103.30:59677] [client 20.63.103.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "acVVLpJDwZsy5O4ZXEjY3gAAAgQ"]
[Thu Mar 26 23:47:59.140824 2026] [:error] [pid 19710:tid 19744] [client 20.63.103.30:59664] [client 20.63.103.30] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "acVVLwVEWP8Ar68Njk5T4QAAABY"]
[Fri Mar 27 00:06:40.062063 2026] [:error] [pid 31778:tid 31803] [client 94.187.18.95:4349] [client 94.187.18.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.187.18.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acVZkA3kybI2o-xasmAzCAAAAco"]
[Fri Mar 27 00:13:06.743596 2026] [:error] [pid 31778:tid 31809] [client 94.187.18.95:4337] [client 94.187.18.95] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acVbEg3kybI2o-xasmAzzwAAAdA"]
[Fri Mar 27 00:15:30.964722 2026] [:error] [pid 31670:tid 31686] [client 94.187.18.95:4317] [client 94.187.18.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.187.18.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acVbojXVthXxCnWjOTT-HQAAAU4"]
[Fri Mar 27 00:19:16.412353 2026] [:error] [pid 19710:tid 19737] [client 94.187.18.95:4350] [client 94.187.18.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.187.18.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acVchAVEWP8Ar68Njk5f8QAAAA8"]
[Fri Mar 27 01:18:17.357533 2026] [:error] [pid 44058:tid 44062] [client 43.159.128.155:41984] [client 43.159.128.155] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acVqWeqp9u5CVRGdZPHzQgAAAII"]
[Fri Mar 27 01:35:16.528101 2026] [:error] [pid 44058:tid 44078] [client 185.169.4.152:62041] [client 185.169.4.152] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "acVuVOqp9u5CVRGdZPH-CgAAAJI"]
[Fri Mar 27 01:35:17.253322 2026] [:error] [pid 62147:tid 62484] [client 185.169.4.152:64992] [client 185.169.4.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "acVuVRPjxn06mcLazN5_CgAAABg"]
[Fri Mar 27 01:48:37.313457 2026] [:error] [pid 44058:tid 44078] [client 104.28.153.25:39116] [client 104.28.153.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "acVxdeqp9u5CVRGdZPEGbAAAAJI"]
[Fri Mar 27 03:42:58.492285 2026] [:error] [pid 25266:tid 25281] [client 43.167.239.66:51558] [client 43.167.239.66] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acWMQjc0fUHa4PiGKazuCAAAAM0"]
[Fri Mar 27 06:29:08.376331 2026] [:error] [pid 27851:tid 27869] [client 179.155.139.226:10596] [client 179.155.139.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.155.139.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acWzNHR2ccxe3RMCLboZNAAAAMs"]
[Fri Mar 27 07:04:39.407861 2026] [:error] [pid 27743:tid 27767] [client 43.135.135.57:37564] [client 43.135.135.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acW7hyA46UYYLqzw99AHhQAAAAM"]
[Fri Mar 27 07:29:12.192625 2026] [:error] [pid 4341:tid 4364] [client 190.185.91.12:52043] [client 190.185.91.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.185.91.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acXBSOKJWrNB5dMlEREt_gAAAZU"]
[Fri Mar 27 08:42:11.232678 2026] [:error] [pid 27750:tid 27818] [client 182.44.67.97:43947] [client 182.44.67.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acXSY4aSil5rd17ieLxcQQAAAIA"]
[Fri Mar 27 11:34:36.782500 2026] [:error] [pid 4341:tid 4365] [client 216.81.200.75:41298] [client 216.81.200.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "acX6zOKJWrNB5dMlERGc4QAAAZY"]
[Fri Mar 27 14:57:41.120211 2026] [:error] [pid 27749:tid 27800] [client 103.51.155.32:65240] [client 103.51.155.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.51.155.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acYqZcEqyoMni2Q6_X6_nwAAAEk"]
[Fri Mar 27 15:35:16.072652 2026] [:error] [pid 4341:tid 4366] [client 103.51.155.32:63613] [client 103.51.155.32] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acYzNOKJWrNB5dMlERE4YAAAAZc"]
[Fri Mar 27 15:36:37.554014 2026] [:error] [pid 4293:tid 4297] [client 103.51.155.32:64032] [client 103.51.155.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.51.155.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acYzhZLjeJUC3OKtEx_OYAAAAUI"]
[Fri Mar 27 15:37:53.390302 2026] [:error] [pid 4341:tid 4353] [client 103.51.155.32:65417] [client 103.51.155.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.51.155.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acYz0eKJWrNB5dMlERE5BAAAAYo"]
[Fri Mar 27 15:39:04.712428 2026] [:error] [pid 27743:tid 27784] [client 103.51.155.32:50431] [client 103.51.155.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.51.155.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acY0GCA46UYYLqzw99BZswAAABQ"]
[Fri Mar 27 15:40:20.791459 2026] [:error] [pid 4293:tid 4316] [client 103.51.155.32:51915] [client 103.51.155.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.51.155.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acY0ZJLjeJUC3OKtEx_Q9AAAAVU"]
[Fri Mar 27 18:26:34.031776 2026] [:error] [pid 4341:tid 4359] [client 159.223.58.121:59676] [client 159.223.58.121] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "acZbWuKJWrNB5dMlERF9WQAAAZA"]
[Fri Mar 27 19:36:59.197425 2026] [:error] [pid 4293:tid 4314] [client 108.249.74.54:55530] [client 108.249.74.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 108.249.74.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acZr25LjeJUC3OKtEx9tUgAAAVM"]
[Fri Mar 27 20:40:59.675009 2026] [:error] [pid 4341:tid 4361] [client 43.157.172.39:53162] [client 43.157.172.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acZ62-KJWrNB5dMlERGuzQAAAZI"]
[Fri Mar 27 23:16:37.708086 2026] [:error] [pid 27749:tid 27812] [client 123.187.240.242:36783] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acafVcEqyoMni2Q6_X4jnQAAAFU"]
[Fri Mar 27 23:34:37.321562 2026] [:error] [pid 27750:tid 27829] [client 43.159.149.216:51444] [client 43.159.149.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acajjYaSil5rd17ieLwXcgAAAIs"]
[Sat Mar 28 01:06:47.718161 2026] [:error] [pid 11768:tid 11785] [client 190.185.91.12:62948] [client 190.185.91.12] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aca5J8LK0swIwlw7rFamSwAAAQ0"]
[Sat Mar 28 01:08:20.706913 2026] [:error] [pid 11325:tid 11760] [client 190.185.91.12:63311] [client 190.185.91.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.185.91.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aca5hI9aMci1IHcmG6LqUQAAANM"]
[Sat Mar 28 01:09:30.664253 2026] [:error] [pid 11768:tid 11790] [client 190.185.91.12:63957] [client 190.185.91.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.185.91.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aca5ysLK0swIwlw7rFaofwAAARI"]
[Sat Mar 28 01:10:38.866591 2026] [:error] [pid 11325:tid 11749] [client 190.185.91.12:65127] [client 190.185.91.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.185.91.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aca6Do9aMci1IHcmG6LraQAAAMg"]
[Sat Mar 28 01:11:44.903596 2026] [:error] [pid 11323:tid 11685] [client 190.185.91.12:49792] [client 190.185.91.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.185.91.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aca6UBruG7-TT-rIgF_jAwAAAAU"]
[Sat Mar 28 01:12:51.321287 2026] [:error] [pid 11323:tid 11685] [client 190.185.91.12:50797] [client 190.185.91.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.185.91.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aca6kxruG7-TT-rIgF_jnAAAAAU"]
[Sat Mar 28 03:31:09.002843 2026] [:error] [pid 11768:tid 11780] [client 43.133.253.253:35942] [client 43.133.253.253] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acba_cLK0swIwlw7rFboJgAAAQg"]
[Sat Mar 28 04:49:18.151163 2026] [:error] [pid 64861:tid 64959] [client 108.249.74.54:53272] [client 108.249.74.54] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acbtTuxK22_lUN2kvnUpgAAAAJg"]
[Sat Mar 28 04:49:52.901959 2026] [:error] [pid 34630:tid 34635] [client 108.249.74.54:53810] [client 108.249.74.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 108.249.74.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acbtcCB2k6HS6io_ec2DtAAAAYI"]
[Sat Mar 28 04:50:59.695312 2026] [:error] [pid 64859:tid 64884] [client 108.249.74.54:54843] [client 108.249.74.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 108.249.74.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acbts23qEBHXq3rHdBmQFgAAAAM"]
[Sat Mar 28 04:51:56.123549 2026] [:error] [pid 64859:tid 64899] [client 108.249.74.54:55717] [client 108.249.74.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 108.249.74.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acbt7G3qEBHXq3rHdBmQpwAAABI"]
[Sat Mar 28 04:52:58.075761 2026] [:error] [pid 64859:tid 64882] [client 108.249.74.54:56707] [client 108.249.74.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 108.249.74.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acbuKm3qEBHXq3rHdBmRagAAAAE"]
[Sat Mar 28 04:53:51.778575 2026] [:error] [pid 64860:tid 64908] [client 108.249.74.54:57409] [client 108.249.74.54] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 108.249.74.54, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acbuXxkU3N0pg_4aEL-JsQAAAEA"]
[Sat Mar 28 06:07:18.776359 2026] [:error] [pid 43578:tid 43600] [client 43.138.68.113:48742] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acb_lnNG2YdGm41aN8LTGQAAAlM"]
[Sat Mar 28 07:19:42.823335 2026] [:error] [pid 34631:tid 34681] [client 20.197.29.71:13924] [client 20.197.29.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php"] [unique_id "accQjjtzjMMS6kojpeQrKAAAAdU"]
[Sat Mar 28 07:19:43.429427 2026] [:error] [pid 43578:tid 43582] [client 20.197.29.71:6999] [client 20.197.29.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php"] [unique_id "accQj3NG2YdGm41aN8LemAAAAkE"]
[Sat Mar 28 07:19:44.045578 2026] [:error] [pid 43579:tid 43630] [client 20.197.29.71:11737] [client 20.197.29.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php"] [unique_id "accQkCRqN4JVI8gB7AmOrgAAApY"]
[Sat Mar 28 07:19:44.733502 2026] [:error] [pid 64861:tid 64943] [client 20.197.29.71:13902] [client 20.197.29.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php"] [unique_id "accQkOxK22_lUN2kvnVfQQAAAIg"]
[Sat Mar 28 09:25:45.811345 2026] [:error] [pid 34597:tid 34621] [client 2.58.56.116:52873] [client 2.58.56.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "accuGYluI7-e5s1cafc6egAAAVQ"]
[Sat Mar 28 09:25:46.310147 2026] [:error] [pid 34631:tid 34684] [client 2.58.56.116:53121] [client 2.58.56.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "accuGjtzjMMS6kojpeRTqAAAAdg"]
[Sat Mar 28 09:25:46.810518 2026] [:error] [pid 64861:tid 64942] [client 2.58.56.116:53349] [client 2.58.56.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "accuGuxK22_lUN2kvnWQTgAAAIc"]
[Sat Mar 28 09:25:47.307366 2026] [:error] [pid 43578:tid 43589] [client 2.58.56.116:53662] [client 2.58.56.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "accuG3NG2YdGm41aN8Lw9AAAAkg"]
[Sat Mar 28 09:25:47.803291 2026] [:error] [pid 64966:tid 64990] [client 2.58.56.116:54426] [client 2.58.56.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "accuG9fSvF5AFfSuKxX_lwAAANE"]
[Sat Mar 28 09:31:10.723521 2026] [:error] [pid 34597:tid 34610] [client 43.135.144.126:57322] [client 43.135.144.126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "accvXoluI7-e5s1cafc71QAAAUk"]
[Sat Mar 28 10:02:08.327199 2026] [:error] [pid 34597:tid 34613] [client 191.37.2.118:31236] [client 191.37.2.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.37.2.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acc2oIluI7-e5s1cafdBigAAAUw"]
[Sat Mar 28 10:09:53.796824 2026] [:error] [pid 34631:tid 34669] [client 191.37.2.118:31091] [client 191.37.2.118] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acc4cTtzjMMS6kojpeRlsgAAAck"]
[Sat Mar 28 10:10:58.218543 2026] [:error] [pid 64859:tid 64894] [client 191.37.2.118:31434] [client 191.37.2.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.37.2.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acc4sm3qEBHXq3rHdBm-ZAAAAA0"]
[Sat Mar 28 10:12:04.833061 2026] [:error] [pid 34597:tid 34612] [client 191.37.2.118:31281] [client 191.37.2.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.37.2.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acc49IluI7-e5s1cafdC-wAAAUs"]
[Sat Mar 28 10:13:11.578117 2026] [:error] [pid 64966:tid 64995] [client 191.37.2.118:31257] [client 191.37.2.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.37.2.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acc5N9fSvF5AFfSuKxUEVQAAANY"]
[Sat Mar 28 10:14:20.663401 2026] [:error] [pid 43547:tid 43558] [client 191.37.2.118:31409] [client 191.37.2.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.37.2.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acc5fD4ZEfdetXP-9aDCIgAAAgk"]
[Sat Mar 28 12:27:25.759320 2026] [:error] [pid 2877:tid 2881] [client 43.159.128.247:50562] [client 43.159.128.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acdYrbgM4xL1Xj409YTxywAAAQI"]
[Sat Mar 28 13:14:57.603302 2026] [:error] [pid 64861:tid 64944] [client 49.234.192.248:43872] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acdj0exK22_lUN2kvnXJGAAAAIk"]
[Sat Mar 28 15:11:37.526434 2026] [:error] [pid 64861:tid 64955] [client 197.232.150.204:50565] [client 197.232.150.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.232.150.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acd_KexK22_lUN2kvnXvRQAAAJQ"]
[Sat Mar 28 15:14:58.362753 2026] [:error] [pid 64859:tid 64899] [client 197.232.150.204:52857] [client 197.232.150.204] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acd_8m3qEBHXq3rHdBkGVwAAABI"]
[Sat Mar 28 15:16:11.408939 2026] [:error] [pid 43578:tid 43586] [client 197.232.150.204:53621] [client 197.232.150.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.232.150.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aceAO3NG2YdGm41aN8KPiQAAAkU"]
[Sat Mar 28 15:17:30.381598 2026] [:error] [pid 43578:tid 43601] [client 197.232.150.204:55127] [client 197.232.150.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.232.150.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aceAinNG2YdGm41aN8KQWgAAAlQ"]
[Sat Mar 28 15:18:48.408026 2026] [:error] [pid 64861:tid 64954] [client 197.232.150.204:56615] [client 197.232.150.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.232.150.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aceA2OxK22_lUN2kvnXw9gAAAJM"]
[Sat Mar 28 15:19:53.403212 2026] [:error] [pid 64861:tid 64945] [client 197.232.150.204:57882] [client 197.232.150.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.232.150.204, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aceBGexK22_lUN2kvnXxKQAAAIo"]
[Sat Mar 28 16:10:01.713346 2026] [:error] [pid 64859:tid 64902] [client 43.153.85.46:54492] [client 43.153.85.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aceM2W3qEBHXq3rHdBkXAwAAABU"]
[Sat Mar 28 16:36:00.698323 2026] [:error] [pid 64861:tid 64936] [client 109.185.53.142:20249] [client 109.185.53.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.185.53.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aceS8OxK22_lUN2kvnUA_gAAAIE"]
[Sat Mar 28 16:38:51.779833 2026] [:error] [pid 64966:tid 64990] [client 91.105.176.102:59401] [client 91.105.176.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.105.176.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aceTm9fSvF5AFfSuKxUkNgAAANE"]
[Sat Mar 28 16:44:34.570431 2026] [:error] [pid 34631:tid 34672] [client 109.185.53.142:27865] [client 109.185.53.142] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aceU8jtzjMMS6kojpeTyUAAAAcw"]
[Sat Mar 28 16:45:31.027128 2026] [:error] [pid 64859:tid 64895] [client 109.185.53.142:28985] [client 109.185.53.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.185.53.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aceVK23qEBHXq3rHdBkfTAAAAA4"]
[Sat Mar 28 16:45:51.384634 2026] [:error] [pid 64859:tid 64898] [client 91.105.176.102:64300] [client 91.105.176.102] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aceVP23qEBHXq3rHdBkfiQAAABE"]
[Sat Mar 28 16:46:26.607335 2026] [:error] [pid 64859:tid 64883] [client 109.185.53.142:61106] [client 109.185.53.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.185.53.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aceVYm3qEBHXq3rHdBkfpwAAAAI"]
[Sat Mar 28 16:46:48.184091 2026] [:error] [pid 34631:tid 34667] [client 91.105.176.102:65347] [client 91.105.176.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.105.176.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aceVeDtzjMMS6kojpeTzFwAAAcc"]
[Sat Mar 28 16:47:30.324872 2026] [:error] [pid 64861:tid 64945] [client 109.185.53.142:62498] [client 109.185.53.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.185.53.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aceVouxK22_lUN2kvnUDJQAAAIo"]
[Sat Mar 28 16:47:34.463902 2026] [:error] [pid 64860:tid 64928] [client 91.105.176.102:49869] [client 91.105.176.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.105.176.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aceVphkU3N0pg_4aEL95DAAAAFQ"]
[Sat Mar 28 16:48:27.218779 2026] [:error] [pid 64861:tid 64952] [client 109.185.53.142:63788] [client 109.185.53.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.185.53.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aceV2-xK22_lUN2kvnUDSQAAAJE"]
[Sat Mar 28 16:48:40.271733 2026] [:error] [pid 34631:tid 34670] [client 91.105.176.102:50845] [client 91.105.176.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.105.176.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aceV6DtzjMMS6kojpeTz7wAAAco"]
[Sat Mar 28 16:49:37.348157 2026] [:error] [pid 43579:tid 43624] [client 91.105.176.102:51218] [client 91.105.176.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.105.176.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aceWISRqN4JVI8gB7AndhQAAApA"]
[Sat Mar 28 18:18:38.807499 2026] [:error] [pid 43547:tid 43551] [client 150.109.230.210:49940] [client 150.109.230.210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aceq_j4ZEfdetXP-9aDwEQAAAgI"]
[Sat Mar 28 21:45:09.909299 2026] [:error] [pid 64860:tid 64924] [client 45.123.217.168:59207] [client 45.123.217.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.123.217.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acfbZRkU3N0pg_4aEL-nMAAAAFA"]
[Sat Mar 28 22:43:00.170790 2026] [:error] [pid 64861:tid 64937] [client 159.223.184.140:35334] [client 159.223.184.140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "acfo9OxK22_lUN2kvnWecAAAAII"]
[Sat Mar 28 23:18:54.649346 2026] [:error] [pid 43578:tid 43596] [client 43.135.182.43:38636] [client 43.135.182.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acfxXnNG2YdGm41aN8IukwAAAk8"]
[Sat Mar 28 23:36:41.663010 2026] [:error] [pid 64859:tid 64894] [client 45.94.31.49:57599] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acf1iW3qEBHXq3rHdBl4rwAAAA0"]
[Sat Mar 28 23:36:42.364113 2026] [:error] [pid 43578:tid 43594] [client 45.94.31.49:60054] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acf1inNG2YdGm41aN8I39wAAAk0"]
[Sat Mar 28 23:36:43.269122 2026] [:error] [pid 64860:tid 64911] [client 45.94.31.49:60054] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acf1ixkU3N0pg_4aEL-7xgAAAEM"]
[Sat Mar 28 23:36:44.052786 2026] [:error] [pid 64859:tid 64890] [client 45.94.31.49:60054] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acf1jG3qEBHXq3rHdBl47AAAAAk"]
[Sat Mar 28 23:36:44.924176 2026] [:error] [pid 2877:tid 2892] [client 45.94.31.49:60054] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acf1jLgM4xL1Xj409YQdugAAAQ0"]
[Sun Mar 29 00:08:50.628353 2026] [:error] [pid 34597:tid 34625] [client 45.151.145.157:59391] [client 45.151.145.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.151.145.157, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acf9EoluI7-e5s1cafe6dgAAAVg"], referer: https://expressinteriors.com/
[Sun Mar 29 00:08:52.392506 2026] [:error] [pid 64861:tid 64935] [client 45.151.145.157:46813] [client 45.151.145.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.151.145.157, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acf9FOxK22_lUN2kvnXGegAAAIA"], referer: https://expressinteriors.com/wp-login.php?action=register
[Sun Mar 29 04:44:55.328864 2026] [:error] [pid 32257:tid 32341] [client 220.239.67.107:48990] [client 220.239.67.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.239.67.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acg9xyE3TArOFrUtgWoZogAAAJc"]
[Sun Mar 29 05:34:32.676464 2026] [:error] [pid 32255:tid 32313] [client 41.208.128.58:52555] [client 41.208.128.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.208.128.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "achJaGnfn-AtRoMbquxMSAAAAFY"]
[Sun Mar 29 06:19:43.431724 2026] [:error] [pid 23167:tid 23187] [client 49.51.72.76:45400] [client 49.51.72.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "achT_xIAHJCFaHff3_dGGQAAAdE"]
[Sun Mar 29 07:52:55.169301 2026] [:error] [pid 23167:tid 23183] [client 220.239.67.107:15036] [client 220.239.67.107] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "achp1xIAHJCFaHff3_d3KgAAAc0"]
[Sun Mar 29 07:54:00.217154 2026] [:error] [pid 23167:tid 23185] [client 220.239.67.107:54661] [client 220.239.67.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.239.67.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "achqGBIAHJCFaHff3_d4NQAAAc8"]
[Sun Mar 29 07:54:47.432170 2026] [:error] [pid 32255:tid 32296] [client 220.239.67.107:61555] [client 220.239.67.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.239.67.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "achqR2nfn-AtRoMbqux89AAAAEU"]
[Sun Mar 29 07:55:57.206861 2026] [:error] [pid 1524:tid 1530] [client 220.239.67.107:15085] [client 220.239.67.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.239.67.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "achqjVoaWSl2asqQCh8xKQAAAQI"]
[Sun Mar 29 07:56:56.406460 2026] [:error] [pid 32359:tid 32385] [client 220.239.67.107:58603] [client 220.239.67.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.239.67.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "achqyAMb8G3UzfQP3WjkxwAAANg"]
[Sun Mar 29 07:57:46.992416 2026] [:error] [pid 23250:tid 23274] [client 220.239.67.107:54782] [client 220.239.67.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 220.239.67.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "achq-pxrpj-dQjy1cvpT5QAAAlY"]
[Sun Mar 29 08:51:43.368423 2026] [:error] [pid 23167:tid 23185] [client 45.94.31.49:65436] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ach3nxIAHJCFaHff3_eYBgAAAc8"]
[Sun Mar 29 08:51:43.853038 2026] [:error] [pid 23137:tid 23143] [client 45.94.31.49:52221] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ach3nxaWQa7LdZ_qGFaaCAAAAYQ"]
[Sun Mar 29 08:51:44.341357 2026] [:error] [pid 23284:tid 23302] [client 45.94.31.49:57612] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ach3oIzBujdPHsq7wyR6HQAAApA"]
[Sun Mar 29 08:51:44.828320 2026] [:error] [pid 23250:tid 23262] [client 45.94.31.49:63256] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ach3oJxrpj-dQjy1cvpgRgAAAko"]
[Sun Mar 29 08:51:45.315130 2026] [:error] [pid 23250:tid 23275] [client 45.94.31.49:50814] [client 45.94.31.49] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ach3oZxrpj-dQjy1cvpgcgAAAlc"]
[Sun Mar 29 10:12:02.864634 2026] [:error] [pid 32359:tid 32369] [client 172.59.216.165:58758] [client 172.59.216.165] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aciKcgMb8G3UzfQP3WjtuQAAAMg"]
[Sun Mar 29 10:13:48.170012 2026] [:error] [pid 23167:tid 23183] [client 172.59.216.165:1426] [client 172.59.216.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.59.216.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aciK3BIAHJCFaHff3_e6ZAAAAc0"]
[Sun Mar 29 10:15:15.966281 2026] [:error] [pid 1524:tid 1546] [client 172.59.216.165:52032] [client 172.59.216.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.59.216.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aciLM1oaWSl2asqQCh8-HwAAAQ8"]
[Sun Mar 29 10:16:46.435024 2026] [:error] [pid 23284:tid 23305] [client 172.59.216.165:28263] [client 172.59.216.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.59.216.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aciLjozBujdPHsq7wySRcwAAApM"]
[Sun Mar 29 10:18:08.019798 2026] [:error] [pid 32359:tid 32385] [client 172.59.216.165:28431] [client 172.59.216.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.59.216.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aciL4AMb8G3UzfQP3WjuIAAAANg"]
[Sun Mar 29 10:19:27.885372 2026] [:error] [pid 23167:tid 23191] [client 172.59.216.165:11487] [client 172.59.216.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.59.216.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aciMLxIAHJCFaHff3_e8nwAAAdU"]
[Sun Mar 29 10:27:17.632082 2026] [:error] [pid 23168:tid 23204] [client 43.159.152.184:48524] [client 43.159.152.184] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aciOBWP8p0yRL8ot_28cZAAAAgc"]
[Sun Mar 29 10:52:19.372591 2026] [:error] [pid 23168:tid 23197] [client 49.233.45.47:59916] [client 49.233.45.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aciT42P8p0yRL8ot_28fvgAAAgA"]
[Sun Mar 29 12:02:37.194335 2026] [:error] [pid 23250:tid 23259] [client 41.208.128.58:40063] [client 41.208.128.58] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acikXZxrpj-dQjy1cvqJfAAAAkc"]
[Sun Mar 29 12:04:18.690996 2026] [:error] [pid 32255:tid 32291] [client 41.208.128.58:52571] [client 41.208.128.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.208.128.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acikwmnfn-AtRoMbquzolgAAAEA"]
[Sun Mar 29 12:05:44.472930 2026] [:error] [pid 32255:tid 32297] [client 41.208.128.58:39962] [client 41.208.128.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.208.128.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acilGGnfn-AtRoMbquzpGgAAAEY"]
[Sun Mar 29 12:07:08.179597 2026] [:error] [pid 32255:tid 32299] [client 41.208.128.58:4569] [client 41.208.128.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.208.128.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acilbGnfn-AtRoMbquzpdwAAAEg"]
[Sun Mar 29 12:08:33.274747 2026] [:error] [pid 23250:tid 23260] [client 41.208.128.58:24274] [client 41.208.128.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.208.128.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acilwZxrpj-dQjy1cvqK-QAAAkg"]
[Sun Mar 29 12:09:53.103782 2026] [:error] [pid 23168:tid 23209] [client 41.208.128.58:4486] [client 41.208.128.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.208.128.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acimEWP8p0yRL8ot_28quAAAAgw"]
[Sun Mar 29 14:51:30.137460 2026] [:error] [pid 23250:tid 23256] [client 72.255.13.50:12675] [client 72.255.13.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.255.13.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acjL8pxrpj-dQjy1cvqtxQAAAkQ"]
[Sun Mar 29 15:01:11.520783 2026] [:error] [pid 23167:tid 23190] [client 72.255.13.50:12675] [client 72.255.13.50] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acjONxIAHJCFaHff3_c6GgAAAdQ"]
[Sun Mar 29 15:05:35.268923 2026] [:error] [pid 23168:tid 23220] [client 72.255.13.50:13135] [client 72.255.13.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.255.13.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acjPP2P8p0yRL8ot_29B5AAAAhc"]
[Sun Mar 29 18:20:17.077726 2026] [:error] [pid 23168:tid 23217] [client 43.159.136.201:35978] [client 43.159.136.201] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acj84WP8p0yRL8ot_29fjgAAAhQ"]
[Sun Mar 29 18:25:27.261639 2026] [autoindex:error] [pid 32257:tid 32333] [client 20.242.98.225:38815] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 29 18:25:27.461204 2026] [:error] [pid 32257:tid 32328] [client 20.242.98.225:38815] [client 20.242.98.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.242.98.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "acj-FyE3TArOFrUtgWrGlwAAAIo"]
[Sun Mar 29 18:25:29.203290 2026] [autoindex:error] [pid 32257:tid 32319] [client 20.242.98.225:38815] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 29 18:25:31.628525 2026] [autoindex:error] [pid 32257:tid 32331] [client 20.242.98.225:38815] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 29 18:25:31.833196 2026] [autoindex:error] [pid 32257:tid 32333] [client 20.242.98.225:38815] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 29 18:25:32.835138 2026] [autoindex:error] [pid 32257:tid 32335] [client 20.242.98.225:38815] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 29 18:25:36.926776 2026] [autoindex:error] [pid 32257:tid 32336] [client 20.242.98.225:38815] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Mar 29 18:25:37.890164 2026] [:error] [pid 32257:tid 32322] [client 20.242.98.225:38815] [client 20.242.98.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "acj-ISE3TArOFrUtgWrGtQAAAIQ"]
[Sun Mar 29 18:25:39.944431 2026] [:error] [pid 23168:tid 23217] [client 20.242.98.225:38785] [client 20.242.98.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "acj-I2P8p0yRL8ot_29goQAAAhQ"]
[Sun Mar 29 18:25:40.758038 2026] [:error] [pid 32255:tid 32303] [client 20.242.98.225:38884] [client 20.242.98.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "acj-JGnfn-AtRoMbquybFwAAAEw"]
[Sun Mar 29 18:25:41.618962 2026] [:error] [pid 1524:tid 1545] [client 20.242.98.225:37423] [client 20.242.98.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "acj-JVoaWSl2asqQCh9yWQAAAQ4"]
[Sun Mar 29 18:25:42.423537 2026] [:error] [pid 32255:tid 32305] [client 20.242.98.225:38808] [client 20.242.98.225] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "acj-Jmnfn-AtRoMbquybHgAAAE4"]
[Sun Mar 29 21:18:24.711846 2026] [:error] [pid 23168:tid 23209] [client 93.169.116.90:4839] [client 93.169.116.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.169.116.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ackmoGP8p0yRL8ot_2-RNQAAAgw"]
[Sun Mar 29 21:30:53.243429 2026] [:error] [pid 8818:tid 8826] [client 74.7.242.42:55044] [client 74.7.242.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.7.242.42, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ackpjSCDvotZNSF0FBrahwAAAUQ"], referer: https://expressinteriors.com/
[Sun Mar 29 21:35:41.190378 2026] [:error] [pid 32255:tid 32309] [client 93.169.116.90:2643] [client 93.169.116.90] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ackqrWnfn-AtRoMbquzlwgAAAFI"]
[Sun Mar 29 21:38:42.489716 2026] [:error] [pid 23167:tid 23176] [client 93.169.116.90:5631] [client 93.169.116.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.169.116.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ackrYhIAHJCFaHff3_e80gAAAcY"]
[Sun Mar 29 21:40:57.575247 2026] [:error] [pid 32257:tid 32342] [client 93.169.116.90:1670] [client 93.169.116.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.169.116.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ackr6SE3TArOFrUtgWosiwAAAJg"]
[Sun Mar 29 21:45:33.688162 2026] [:error] [pid 23250:tid 23276] [client 93.169.116.90:3509] [client 93.169.116.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.169.116.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acks_Zxrpj-dQjy1cvoDjQAAAlg"]
[Sun Mar 29 21:52:56.680426 2026] [:error] [pid 23168:tid 23207] [client 93.169.116.90:12133] [client 93.169.116.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.169.116.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ackuuGP8p0yRL8ot_2-cKgAAAgo"]
[Sun Mar 29 23:12:41.662919 2026] [:error] [pid 8818:tid 8826] [client 43.131.23.154:44438] [client 43.131.23.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aclBaSCDvotZNSF0FBrxJwAAAUQ"]
[Sun Mar 29 23:19:20.994359 2026] [:error] [pid 23137:tid 23154] [client 62.16.7.112:53309] [client 62.16.7.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.16.7.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aclC-BaWQa7LdZ_qGFYJMgAAAY8"], referer: https://expressinteriors.com/
[Sun Mar 29 23:19:22.729643 2026] [:error] [pid 23168:tid 23199] [client 62.16.7.112:53599] [client 62.16.7.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.16.7.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aclC-mP8p0yRL8ot_2-56AAAAgI"], referer: https://expressinteriors.com/wp-login.php?action=register
[Mon Mar 30 00:15:52.739710 2026] [:error] [pid 23168:tid 23209] [client 74.248.20.136:53514] [client 74.248.20.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aclQOGP8p0yRL8ot_2_QqAAAAgw"]
[Mon Mar 30 00:16:00.928216 2026] [:error] [pid 23167:tid 23191] [client 74.248.20.136:35515] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/031.php"] [unique_id "aclQQBIAHJCFaHff3_fm5gAAAdU"]
[Mon Mar 30 00:16:03.198113 2026] [:error] [pid 32254:tid 32265] [client 74.248.20.136:59240] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/031.php"] [unique_id "aclQQ6ug2IHuyGgCTn9r-wAAAAE"]
[Mon Mar 30 00:16:03.936324 2026] [:error] [pid 23284:tid 23291] [client 74.248.20.136:25152] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/031.php"] [unique_id "aclQQ4zBujdPHsq7wyQSEQAAAoU"]
[Mon Mar 30 00:16:04.903933 2026] [:error] [pid 23250:tid 23256] [client 74.248.20.136:59254] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/031.php"] [unique_id "aclQRJxrpj-dQjy1cvogrAAAAkQ"]
[Mon Mar 30 00:16:05.689393 2026] [:error] [pid 32257:tid 32339] [client 74.248.20.136:42873] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aclQRSE3TArOFrUtgWqK3gAAAJU"]
[Mon Mar 30 00:16:06.994746 2026] [:error] [pid 32254:tid 32266] [client 74.248.20.136:43850] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aclQRqug2IHuyGgCTn9r_wAAAAI"]
[Mon Mar 30 00:16:08.178427 2026] [:error] [pid 32255:tid 32306] [client 74.248.20.136:30331] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aclQSGnfn-AtRoMbquwx3QAAAE8"]
[Mon Mar 30 00:16:09.287707 2026] [:error] [pid 32255:tid 32310] [client 74.248.20.136:42828] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aclQSWnfn-AtRoMbquwx5QAAAFM"]
[Mon Mar 30 00:16:10.594516 2026] [:error] [pid 32255:tid 32295] [client 74.248.20.136:30786] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aclQSmnfn-AtRoMbquwx6gAAAEQ"]
[Mon Mar 30 00:16:11.910829 2026] [:error] [pid 23284:tid 23303] [client 74.248.20.136:53978] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aclQS4zBujdPHsq7wyQSIAAAApE"]
[Mon Mar 30 00:16:12.959156 2026] [:error] [pid 23284:tid 23297] [client 74.248.20.136:63032] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aclQTIzBujdPHsq7wyQSJAAAAos"]
[Mon Mar 30 00:16:13.733721 2026] [:error] [pid 32254:tid 32287] [client 74.248.20.136:35491] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aclQTaug2IHuyGgCTn9sBAAAABc"]
[Mon Mar 30 00:16:14.692911 2026] [:error] [pid 32255:tid 32297] [client 74.248.20.136:62993] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aclQTmnfn-AtRoMbquwx8QAAAEY"]
[Mon Mar 30 00:16:15.751981 2026] [:error] [pid 23284:tid 23295] [client 74.248.20.136:29576] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aclQT4zBujdPHsq7wyQSMQAAAok"]
[Mon Mar 30 00:16:16.525145 2026] [:error] [pid 23284:tid 23292] [client 74.248.20.136:30292] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aclQUIzBujdPHsq7wyQSMwAAAoY"]
[Mon Mar 30 00:16:17.573900 2026] [:error] [pid 32255:tid 32292] [client 74.248.20.136:25163] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aclQUWnfn-AtRoMbquwx9wAAAEE"]
[Mon Mar 30 00:16:18.856605 2026] [:error] [pid 23250:tid 23266] [client 74.248.20.136:29594] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aclQUpxrpj-dQjy1cvoguwAAAk4"]
[Mon Mar 30 00:16:19.904802 2026] [:error] [pid 32257:tid 32324] [client 74.248.20.136:51520] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aclQUyE3TArOFrUtgWqK-QAAAIY"]
[Mon Mar 30 00:16:20.562136 2026] [:error] [pid 23168:tid 23215] [client 74.248.20.136:39788] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aclQVGP8p0yRL8ot_2_QzwAAAhI"]
[Mon Mar 30 00:16:21.909306 2026] [:error] [pid 32255:tid 32294] [client 74.248.20.136:59224] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aclQVWnfn-AtRoMbquwyAQAAAEM"]
[Mon Mar 30 00:16:23.017515 2026] [:error] [pid 32257:tid 32338] [client 74.248.20.136:30726] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hly.php"] [unique_id "aclQVyE3TArOFrUtgWqLAwAAAJQ"]
[Mon Mar 30 00:16:23.873983 2026] [:error] [pid 32257:tid 32333] [client 74.248.20.136:30755] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hly.php"] [unique_id "aclQVyE3TArOFrUtgWqLBQAAAI8"]
[Mon Mar 30 00:16:24.600634 2026] [:error] [pid 23168:tid 23199] [client 74.248.20.136:63012] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hly.php"] [unique_id "aclQWGP8p0yRL8ot_2_Q0gAAAgI"]
[Mon Mar 30 00:16:25.446081 2026] [:error] [pid 23137:tid 23144] [client 74.248.20.136:30770] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hly.php"] [unique_id "aclQWRaWQa7LdZ_qGFYS9QAAAYU"]
[Mon Mar 30 00:16:26.210376 2026] [:error] [pid 23168:tid 23210] [client 74.248.20.136:51534] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aclQWmP8p0yRL8ot_2_Q2AAAAg0"]
[Mon Mar 30 00:16:27.088095 2026] [:error] [pid 32255:tid 32307] [client 74.248.20.136:63061] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aclQW2nfn-AtRoMbquwyEQAAAFA"]
[Mon Mar 30 00:16:27.898956 2026] [:error] [pid 32257:tid 32325] [client 74.248.20.136:49336] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aclQWyE3TArOFrUtgWqLEQAAAIc"]
[Mon Mar 30 00:16:28.549856 2026] [:error] [pid 23284:tid 23309] [client 74.248.20.136:51158] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "aclQXIzBujdPHsq7wyQSQQAAApc"]
[Mon Mar 30 00:16:29.158309 2026] [:error] [pid 32254:tid 32279] [client 74.248.20.136:20123] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aclQXaug2IHuyGgCTn9sDAAAAA8"]
[Mon Mar 30 00:16:29.857663 2026] [:error] [pid 32257:tid 32324] [client 74.248.20.136:51198] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aclQXSE3TArOFrUtgWqLIAAAAIY"]
[Mon Mar 30 00:16:30.929932 2026] [:error] [pid 23168:tid 23218] [client 74.248.20.136:39691] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aclQXmP8p0yRL8ot_2_Q4gAAAhU"]
[Mon Mar 30 00:16:31.928613 2026] [:error] [pid 23284:tid 23302] [client 74.248.20.136:12246] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "aclQX4zBujdPHsq7wyQSSQAAApA"]
[Mon Mar 30 00:16:32.987092 2026] [:error] [pid 23167:tid 23173] [client 74.248.20.136:39121] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tajj.php"] [unique_id "aclQYBIAHJCFaHff3_fnBgAAAcM"]
[Mon Mar 30 00:16:33.693252 2026] [:error] [pid 23284:tid 23290] [client 74.248.20.136:63078] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tajj.php"] [unique_id "aclQYYzBujdPHsq7wyQSTQAAAoQ"]
[Mon Mar 30 00:16:34.748527 2026] [:error] [pid 23168:tid 23209] [client 74.248.20.136:54002] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tajj.php"] [unique_id "aclQYmP8p0yRL8ot_2_Q4wAAAgw"]
[Mon Mar 30 00:16:36.239276 2026] [:error] [pid 23284:tid 23308] [client 74.248.20.136:63057] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tajj.php"] [unique_id "aclQZIzBujdPHsq7wyQSWQAAApY"]
[Mon Mar 30 00:16:37.198741 2026] [:error] [pid 32257:tid 32321] [client 74.248.20.136:39682] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "aclQZSE3TArOFrUtgWqLJgAAAIM"]
[Mon Mar 30 00:16:37.910627 2026] [:error] [pid 23284:tid 23300] [client 74.248.20.136:39758] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "aclQZYzBujdPHsq7wyQSXQAAAo4"]
[Mon Mar 30 00:16:38.807846 2026] [:error] [pid 32257:tid 32338] [client 74.248.20.136:16524] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "aclQZiE3TArOFrUtgWqLKQAAAJQ"]
[Mon Mar 30 00:16:39.823815 2026] [:error] [pid 32255:tid 32308] [client 74.248.20.136:3146] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "aclQZ2nfn-AtRoMbquwyLAAAAFE"]
[Mon Mar 30 00:16:41.249461 2026] [:error] [pid 23168:tid 23197] [client 74.248.20.136:48394] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aclQaWP8p0yRL8ot_2_Q7QAAAgA"]
[Mon Mar 30 00:16:42.281374 2026] [:error] [pid 32257:tid 32326] [client 74.248.20.136:63067] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aclQaiE3TArOFrUtgWqLNAAAAIg"]
[Mon Mar 30 00:16:43.019826 2026] [:error] [pid 23137:tid 23140] [client 74.248.20.136:36858] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aclQaxaWQa7LdZ_qGFYS-wAAAYE"]
[Mon Mar 30 00:16:43.793478 2026] [:error] [pid 8818:tid 8827] [client 74.248.20.136:34924] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "aclQayCDvotZNSF0FBoBqwAAAUU"]
[Mon Mar 30 00:16:45.428605 2026] [:error] [pid 8818:tid 8840] [client 74.248.20.136:12224] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aclQbSCDvotZNSF0FBoBsAAAAVI"]
[Mon Mar 30 00:16:46.153010 2026] [:error] [pid 23168:tid 23221] [client 74.248.20.136:39772] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aclQbmP8p0yRL8ot_2_Q9QAAAhg"]
[Mon Mar 30 00:16:46.949262 2026] [:error] [pid 23284:tid 23290] [client 74.248.20.136:50539] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aclQbozBujdPHsq7wyQScAAAAoQ"]
[Mon Mar 30 00:16:47.855724 2026] [:error] [pid 8818:tid 8830] [client 74.248.20.136:3197] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aclQbyCDvotZNSF0FBoBtQAAAUg"]
[Mon Mar 30 00:16:48.624789 2026] [:error] [pid 23168:tid 23220] [client 74.248.20.136:63065] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-2.php"] [unique_id "aclQcGP8p0yRL8ot_2_Q_AAAAhc"]
[Mon Mar 30 00:16:49.907112 2026] [:error] [pid 32359:tid 32363] [client 74.248.20.136:21491] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-2.php"] [unique_id "aclQcQMb8G3UzfQP3WhCPAAAAMI"]
[Mon Mar 30 00:16:50.952792 2026] [:error] [pid 32257:tid 32341] [client 74.248.20.136:61051] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-2.php"] [unique_id "aclQciE3TArOFrUtgWqLTgAAAJc"]
[Mon Mar 30 00:16:52.373942 2026] [:error] [pid 32257:tid 32324] [client 74.248.20.136:48434] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-2.php"] [unique_id "aclQdCE3TArOFrUtgWqLUgAAAIY"]
[Mon Mar 30 00:16:53.381955 2026] [:error] [pid 32255:tid 32304] [client 74.248.20.136:48416] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aclQdWnfn-AtRoMbquwySQAAAE0"]
[Mon Mar 30 00:16:55.028505 2026] [:error] [pid 23284:tid 23307] [client 74.248.20.136:37555] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aclQd4zBujdPHsq7wyQSfQAAApU"]
[Mon Mar 30 00:16:55.964197 2026] [:error] [pid 32257:tid 32335] [client 74.248.20.136:48185] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aclQdyE3TArOFrUtgWqLXAAAAJE"]
[Mon Mar 30 00:16:57.550259 2026] [:error] [pid 23137:tid 23139] [client 74.248.20.136:34897] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aclQeRaWQa7LdZ_qGFYTKAAAAYA"]
[Mon Mar 30 00:16:58.355219 2026] [:error] [pid 23167:tid 23192] [client 74.248.20.136:40854] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aclQehIAHJCFaHff3_fnewAAAdY"]
[Mon Mar 30 00:16:59.860745 2026] [:error] [pid 23284:tid 23308] [client 74.248.20.136:12469] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/index.php"] [unique_id "aclQe4zBujdPHsq7wyQSlQAAApY"]
[Mon Mar 30 00:17:12.394779 2026] [:error] [pid 32257:tid 32330] [client 74.248.20.136:36837] [client 74.248.20.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aclQiCE3TArOFrUtgWqLnAAAAIw"]
[Mon Mar 30 00:17:27.572881 2026] [:error] [pid 32257:tid 32330] [client 74.248.20.136:31415] [client 74.248.20.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "aclQlyE3TArOFrUtgWqL_gAAAIw"]
[Mon Mar 30 00:17:31.009166 2026] [:error] [pid 32257:tid 32330] [client 74.248.20.136:35150] [client 74.248.20.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aclQmyE3TArOFrUtgWqMCQAAAIw"]
[Mon Mar 30 00:17:31.753289 2026] [:error] [pid 32254:tid 32277] [client 74.248.20.136:65293] [client 74.248.20.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aclQm6ug2IHuyGgCTn9sMgAAAA0"]
[Mon Mar 30 00:17:34.316935 2026] [:error] [pid 32255:tid 32309] [client 74.248.20.136:30987] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gfile.php"] [unique_id "aclQnmnfn-AtRoMbquwymQAAAFI"]
[Mon Mar 30 00:17:35.494209 2026] [:error] [pid 8818:tid 8828] [client 74.248.20.136:45948] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gfile.php"] [unique_id "aclQnyCDvotZNSF0FBoCBgAAAUY"]
[Mon Mar 30 00:17:36.264637 2026] [:error] [pid 23250:tid 23264] [client 74.248.20.136:48954] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gfile.php"] [unique_id "aclQoJxrpj-dQjy1cvohHAAAAkw"]
[Mon Mar 30 00:17:37.294250 2026] [:error] [pid 23250:tid 23274] [client 74.248.20.136:42914] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gfile.php"] [unique_id "aclQoZxrpj-dQjy1cvohIgAAAlY"]
[Mon Mar 30 00:17:38.382615 2026] [:error] [pid 23137:tid 23147] [client 74.248.20.136:48941] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-freya.php"] [unique_id "aclQohaWQa7LdZ_qGFYTRAAAAYg"]
[Mon Mar 30 00:17:39.566309 2026] [:error] [pid 23284:tid 23294] [client 74.248.20.136:19542] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-freya.php"] [unique_id "aclQo4zBujdPHsq7wyQSzQAAAog"]
[Mon Mar 30 00:17:40.619258 2026] [:error] [pid 23284:tid 23289] [client 74.248.20.136:48907] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-freya.php"] [unique_id "aclQpIzBujdPHsq7wyQS1QAAAoM"]
[Mon Mar 30 00:17:41.338411 2026] [:error] [pid 23284:tid 23293] [client 74.248.20.136:6456] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-freya.php"] [unique_id "aclQpYzBujdPHsq7wyQS2AAAAoc"]
[Mon Mar 30 00:17:42.242081 2026] [:error] [pid 23167:tid 23181] [client 74.248.20.136:42937] [client 74.248.20.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Text/admin.php"] [unique_id "aclQphIAHJCFaHff3_fnwAAAAcs"]
[Mon Mar 30 00:17:43.074679 2026] [:error] [pid 23284:tid 23292] [client 74.248.20.136:44038] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aclQp4zBujdPHsq7wyQS3gAAAoY"]
[Mon Mar 30 00:17:44.355408 2026] [:error] [pid 32257:tid 32338] [client 74.248.20.136:22583] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aclQqCE3TArOFrUtgWqMLgAAAJQ"]
[Mon Mar 30 00:17:46.056763 2026] [:error] [pid 23284:tid 23310] [client 74.248.20.136:65295] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aclQqozBujdPHsq7wyQS6QAAApg"]
[Mon Mar 30 00:17:47.864473 2026] [:error] [pid 32255:tid 32312] [client 74.248.20.136:44034] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "aclQq2nfn-AtRoMbquwyrwAAAFU"]
[Mon Mar 30 00:17:49.269829 2026] [:error] [pid 32257:tid 32333] [client 74.248.20.136:56946] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aclQrSE3TArOFrUtgWqMRgAAAI8"]
[Mon Mar 30 00:17:50.814890 2026] [:error] [pid 23250:tid 23269] [client 74.248.20.136:65303] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aclQrpxrpj-dQjy1cvohVgAAAlE"]
[Mon Mar 30 00:17:52.392501 2026] [:error] [pid 32257:tid 32318] [client 74.248.20.136:35167] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aclQsCE3TArOFrUtgWqMSwAAAIA"]
[Mon Mar 30 00:17:53.400661 2026] [:error] [pid 32257:tid 32322] [client 74.248.20.136:43170] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "aclQsSE3TArOFrUtgWqMTQAAAIQ"]
[Mon Mar 30 00:17:54.763998 2026] [:error] [pid 32257:tid 32323] [client 74.248.20.136:42907] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X7x.php"] [unique_id "aclQsiE3TArOFrUtgWqMVgAAAIU"]
[Mon Mar 30 00:17:55.673601 2026] [:error] [pid 32255:tid 32314] [client 74.248.20.136:43166] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X7x.php"] [unique_id "aclQs2nfn-AtRoMbquwyvgAAAFc"]
[Mon Mar 30 00:17:57.049377 2026] [:error] [pid 32257:tid 32333] [client 74.248.20.136:34961] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X7x.php"] [unique_id "aclQtSE3TArOFrUtgWqMXgAAAI8"]
[Mon Mar 30 00:17:57.878616 2026] [:error] [pid 23167:tid 23170] [client 74.248.20.136:35002] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X7x.php"] [unique_id "aclQtRIAHJCFaHff3_fn5QAAAcA"]
[Mon Mar 30 00:17:58.621964 2026] [:error] [pid 23168:tid 23219] [client 74.248.20.136:3623] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctex1.php"] [unique_id "aclQtmP8p0yRL8ot_2_RYQAAAhY"]
[Mon Mar 30 00:17:59.198783 2026] [:error] [pid 32257:tid 32319] [client 74.248.20.136:29538] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctex1.php"] [unique_id "aclQtyE3TArOFrUtgWqMagAAAIE"]
[Mon Mar 30 00:17:59.975196 2026] [:error] [pid 23167:tid 23176] [client 74.248.20.136:43138] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctex1.php"] [unique_id "aclQtxIAHJCFaHff3_fn5wAAAcY"]
[Mon Mar 30 00:18:00.868306 2026] [:error] [pid 23137:tid 23150] [client 74.248.20.136:55364] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctex1.php"] [unique_id "aclQuBaWQa7LdZ_qGFYTWAAAAYs"]
[Mon Mar 30 00:18:01.751532 2026] [:error] [pid 8818:tid 8827] [client 74.248.20.136:3618] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d12.php"] [unique_id "aclQuSCDvotZNSF0FBoCHQAAAUU"]
[Mon Mar 30 00:18:02.621744 2026] [:error] [pid 23167:tid 23191] [client 74.248.20.136:29518] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d12.php"] [unique_id "aclQuhIAHJCFaHff3_fn6gAAAdU"]
[Mon Mar 30 00:18:04.538059 2026] [:error] [pid 32257:tid 32333] [client 74.248.20.136:33497] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d12.php"] [unique_id "aclQvCE3TArOFrUtgWqMjwAAAI8"]
[Mon Mar 30 00:18:05.388409 2026] [:error] [pid 23250:tid 23266] [client 74.248.20.136:55387] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d12.php"] [unique_id "aclQvZxrpj-dQjy1cvohaQAAAk4"]
[Mon Mar 30 00:18:07.091592 2026] [:error] [pid 32257:tid 32326] [client 74.248.20.136:30648] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aclQvyE3TArOFrUtgWqMnwAAAIg"]
[Mon Mar 30 00:18:07.702010 2026] [:error] [pid 23168:tid 23218] [client 74.248.20.136:31680] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aclQv2P8p0yRL8ot_2_RcAAAAhU"]
[Mon Mar 30 00:18:08.820173 2026] [:error] [pid 32359:tid 32369] [client 74.248.20.136:19533] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aclQwAMb8G3UzfQP3WhCZQAAAMg"]
[Mon Mar 30 00:18:10.220266 2026] [:error] [pid 32257:tid 32338] [client 74.248.20.136:3642] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aclQwiE3TArOFrUtgWqM0gAAAJQ"]
[Mon Mar 30 00:18:11.357896 2026] [:error] [pid 8818:tid 8829] [client 74.248.20.136:3710] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "aclQwyCDvotZNSF0FBoCJgAAAUc"]
[Mon Mar 30 00:18:13.248944 2026] [:error] [pid 32257:tid 32337] [client 74.248.20.136:26460] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "aclQxSE3TArOFrUtgWqM6AAAAJM"]
[Mon Mar 30 00:18:14.184739 2026] [:error] [pid 23168:tid 23206] [client 74.248.20.136:43163] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "aclQxmP8p0yRL8ot_2_RdwAAAgk"]
[Mon Mar 30 00:18:15.311955 2026] [:error] [pid 23284:tid 23288] [client 74.248.20.136:31739] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "aclQx4zBujdPHsq7wyQTNQAAAoI"]
[Mon Mar 30 00:18:16.071268 2026] [:error] [pid 23284:tid 23302] [client 74.248.20.136:26445] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aclQyIzBujdPHsq7wyQTQgAAApA"]
[Mon Mar 30 00:18:18.430082 2026] [:error] [pid 23250:tid 23272] [client 74.248.20.136:49916] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aclQypxrpj-dQjy1cvohbAAAAlQ"]
[Mon Mar 30 00:18:20.295707 2026] [:error] [pid 32255:tid 32300] [client 74.248.20.136:47355] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aclQzGnfn-AtRoMbquwy-wAAAEk"]
[Mon Mar 30 00:18:20.970379 2026] [:error] [pid 23167:tid 23173] [client 74.248.20.136:19834] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "aclQzBIAHJCFaHff3_fn9gAAAcM"]
[Mon Mar 30 00:18:21.983543 2026] [:error] [pid 32257:tid 32340] [client 74.248.20.136:26473] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thoms.php"] [unique_id "aclQzSE3TArOFrUtgWqNDQAAAJY"]
[Mon Mar 30 00:18:22.751938 2026] [:error] [pid 23250:tid 23274] [client 74.248.20.136:30232] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thoms.php"] [unique_id "aclQzpxrpj-dQjy1cvohcQAAAlY"]
[Mon Mar 30 00:18:23.454316 2026] [:error] [pid 23284:tid 23307] [client 74.248.20.136:3109] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thoms.php"] [unique_id "aclQz4zBujdPHsq7wyQTXwAAApU"]
[Mon Mar 30 00:18:24.650438 2026] [:error] [pid 23168:tid 23212] [client 74.248.20.136:33992] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thoms.php"] [unique_id "aclQ0GP8p0yRL8ot_2_RhAAAAg8"]
[Mon Mar 30 00:18:25.784117 2026] [:error] [pid 32255:tid 32304] [client 74.248.20.136:3392] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/O-Simple.php"] [unique_id "aclQ0Wnfn-AtRoMbquwzCgAAAE0"]
[Mon Mar 30 00:18:26.977034 2026] [:error] [pid 23168:tid 23216] [client 74.248.20.136:3441] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/O-Simple.php"] [unique_id "aclQ0mP8p0yRL8ot_2_RhwAAAhM"]
[Mon Mar 30 00:18:28.310173 2026] [:error] [pid 8818:tid 8845] [client 74.248.20.136:18552] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/O-Simple.php"] [unique_id "aclQ1CCDvotZNSF0FBoCOQAAAVc"]
[Mon Mar 30 00:18:29.435359 2026] [:error] [pid 8818:tid 8829] [client 74.248.20.136:36925] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/O-Simple.php"] [unique_id "aclQ1SCDvotZNSF0FBoCPAAAAUc"]
[Mon Mar 30 00:18:30.608496 2026] [:error] [pid 8818:tid 8826] [client 74.248.20.136:41130] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-.php"] [unique_id "aclQ1iCDvotZNSF0FBoCPgAAAUQ"]
[Mon Mar 30 00:18:42.964984 2026] [:error] [pid 8818:tid 8823] [client 74.248.20.136:33512] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "aclQ4iCDvotZNSF0FBoCWgAAAUE"]
[Mon Mar 30 00:18:43.651967 2026] [:error] [pid 32257:tid 32337] [client 74.248.20.136:47346] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "aclQ4yE3TArOFrUtgWqNZwAAAJM"]
[Mon Mar 30 00:18:47.163641 2026] [:error] [pid 32255:tid 32309] [client 74.248.20.136:17350] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "aclQ52nfn-AtRoMbquwzcQAAAFI"]
[Mon Mar 30 00:18:47.944329 2026] [:error] [pid 23137:tid 23159] [client 74.248.20.136:18551] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "aclQ5xaWQa7LdZ_qGFYTjAAAAZQ"]
[Mon Mar 30 00:18:48.692007 2026] [:error] [pid 32255:tid 32306] [client 74.248.20.136:33493] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "aclQ6Gnfn-AtRoMbquwzdwAAAE8"]
[Mon Mar 30 00:18:49.505422 2026] [:error] [pid 23137:tid 23148] [client 74.248.20.136:41832] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "aclQ6RaWQa7LdZ_qGFYTjgAAAYk"]
[Mon Mar 30 00:18:51.539581 2026] [:error] [pid 32257:tid 32341] [client 74.248.20.136:47322] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "aclQ6yE3TArOFrUtgWqNcAAAAJc"]
[Mon Mar 30 00:18:52.266093 2026] [:error] [pid 32255:tid 32296] [client 74.248.20.136:63032] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "aclQ7Gnfn-AtRoMbquwzhQAAAEU"]
[Mon Mar 30 00:18:53.098815 2026] [:error] [pid 23284:tid 23301] [client 74.248.20.136:3792] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aclQ7YzBujdPHsq7wyQTrAAAAo8"]
[Mon Mar 30 00:18:54.004475 2026] [:error] [pid 23137:tid 23162] [client 74.248.20.136:18506] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aclQ7haWQa7LdZ_qGFYTlQAAAZc"]
[Mon Mar 30 00:18:54.814602 2026] [:error] [pid 23167:tid 23170] [client 74.248.20.136:19811] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aclQ7hIAHJCFaHff3_foGQAAAcA"]
[Mon Mar 30 00:18:56.146918 2026] [:error] [pid 32257:tid 32334] [client 74.248.20.136:26380] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aclQ8CE3TArOFrUtgWqNeAAAAJA"]
[Mon Mar 30 00:18:57.902806 2026] [:error] [pid 23168:tid 23221] [client 74.248.20.136:23802] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aclQ8WP8p0yRL8ot_2_RkAAAAhg"]
[Mon Mar 30 00:18:58.512946 2026] [:error] [pid 32254:tid 32284] [client 74.248.20.136:18191] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aclQ8qug2IHuyGgCTn9siQAAABQ"]
[Mon Mar 30 00:19:00.018792 2026] [:error] [pid 8818:tid 8833] [client 74.248.20.136:41849] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aclQ9CCDvotZNSF0FBoCbwAAAUs"]
[Mon Mar 30 00:19:00.591582 2026] [:error] [pid 23284:tid 23302] [client 74.248.20.136:44922] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "aclQ9IzBujdPHsq7wyQTugAAApA"]
[Mon Mar 30 00:19:01.374836 2026] [:error] [pid 32255:tid 32294] [client 74.248.20.136:24806] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "aclQ9Wnfn-AtRoMbquwzkwAAAEM"]
[Mon Mar 30 00:19:02.272441 2026] [:error] [pid 8818:tid 8823] [client 74.248.20.136:33991] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "aclQ9iCDvotZNSF0FBoCcgAAAUE"]
[Mon Mar 30 00:19:03.342381 2026] [:error] [pid 32257:tid 32338] [client 74.248.20.136:49255] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "aclQ9yE3TArOFrUtgWqNlwAAAJQ"]
[Mon Mar 30 00:19:03.974361 2026] [:error] [pid 32255:tid 32291] [client 74.248.20.136:44908] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "aclQ92nfn-AtRoMbquwzmwAAAEA"]
[Mon Mar 30 00:19:04.775298 2026] [:error] [pid 32359:tid 32384] [client 74.248.20.136:26414] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aclQ-AMb8G3UzfQP3WhC2QAAANc"]
[Mon Mar 30 00:19:05.504992 2026] [:error] [pid 23167:tid 23177] [client 74.248.20.136:23757] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aclQ-RIAHJCFaHff3_foIQAAAcc"]
[Mon Mar 30 00:19:06.168830 2026] [:error] [pid 23167:tid 23188] [client 74.248.20.136:44913] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aclQ-hIAHJCFaHff3_foJAAAAdI"]
[Mon Mar 30 00:19:06.868324 2026] [:error] [pid 32359:tid 32365] [client 74.248.20.136:18220] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aclQ-gMb8G3UzfQP3WhC3AAAAMQ"]
[Mon Mar 30 00:19:07.459173 2026] [:error] [pid 32257:tid 32323] [client 74.248.20.136:18210] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aclQ-yE3TArOFrUtgWqNqgAAAIU"]
[Mon Mar 30 00:19:08.521226 2026] [:error] [pid 32257:tid 32340] [client 74.248.20.136:34010] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aclQ_CE3TArOFrUtgWqNswAAAJY"]
[Mon Mar 30 00:19:09.300833 2026] [:error] [pid 32257:tid 32329] [client 74.248.20.136:53922] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aclQ_SE3TArOFrUtgWqNtQAAAIs"]
[Mon Mar 30 00:19:09.938283 2026] [:error] [pid 32255:tid 32291] [client 74.248.20.136:38577] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aclQ_Wnfn-AtRoMbquwztQAAAEA"]
[Mon Mar 30 00:19:11.546934 2026] [:error] [pid 32257:tid 32336] [client 74.248.20.136:33715] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat.php"] [unique_id "aclQ_yE3TArOFrUtgWqNuQAAAJI"]
[Mon Mar 30 00:19:12.555164 2026] [:error] [pid 32257:tid 32324] [client 74.248.20.136:18110] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat.php"] [unique_id "aclRACE3TArOFrUtgWqNwAAAAIY"]
[Mon Mar 30 00:19:13.389162 2026] [:error] [pid 32257:tid 32321] [client 74.248.20.136:18108] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat.php"] [unique_id "aclRASE3TArOFrUtgWqNwwAAAIM"]
[Mon Mar 30 00:19:14.104896 2026] [:error] [pid 23168:tid 23214] [client 74.248.20.136:53896] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat.php"] [unique_id "aclRAmP8p0yRL8ot_2_RpwAAAhE"]
[Mon Mar 30 00:19:15.112430 2026] [:error] [pid 23168:tid 23211] [client 74.248.20.136:41836] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aclRA2P8p0yRL8ot_2_RrQAAAg4"]
[Mon Mar 30 00:19:15.797015 2026] [:error] [pid 23168:tid 23216] [client 74.248.20.136:26409] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aclRA2P8p0yRL8ot_2_RrgAAAhM"]
[Mon Mar 30 00:19:16.439983 2026] [:error] [pid 8818:tid 8835] [client 74.248.20.136:53912] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aclRBCCDvotZNSF0FBoCiQAAAU0"]
[Mon Mar 30 00:19:17.068433 2026] [:error] [pid 23284:tid 23309] [client 74.248.20.136:53931] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "aclRBYzBujdPHsq7wyQTzwAAApc"]
[Mon Mar 30 00:19:17.763680 2026] [:error] [pid 32359:tid 32363] [client 74.248.20.136:38547] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aclRBQMb8G3UzfQP3WhC4wAAAMI"]
[Mon Mar 30 00:19:19.026272 2026] [:error] [pid 32359:tid 32374] [client 74.248.20.136:61107] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aclRBwMb8G3UzfQP3WhC5wAAAM0"]
[Mon Mar 30 00:19:19.806736 2026] [:error] [pid 8818:tid 8835] [client 74.248.20.136:45748] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aclRByCDvotZNSF0FBoCjwAAAU0"]
[Mon Mar 30 00:19:20.628274 2026] [:error] [pid 23137:tid 23144] [client 74.248.20.136:3969] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aclRCBaWQa7LdZ_qGFYTrQAAAYU"]
[Mon Mar 30 00:19:21.358097 2026] [:error] [pid 32257:tid 32333] [client 74.248.20.136:33699] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aclRCSE3TArOFrUtgWqN2gAAAI8"]
[Mon Mar 30 00:19:23.430066 2026] [:error] [pid 8818:tid 8838] [client 74.248.20.136:15597] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aclRCyCDvotZNSF0FBoCngAAAVA"]
[Mon Mar 30 00:19:24.186114 2026] [:error] [pid 23168:tid 23197] [client 74.248.20.136:23761] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aclRDGP8p0yRL8ot_2_RuwAAAgA"]
[Mon Mar 30 00:19:25.898685 2026] [:error] [pid 32257:tid 32339] [client 74.248.20.136:18149] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aclRDSE3TArOFrUtgWqN8AAAAJU"]
[Mon Mar 30 00:19:26.922767 2026] [:error] [pid 23250:tid 23259] [client 74.248.20.136:33706] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "aclRDpxrpj-dQjy1cvohnQAAAkc"]
[Mon Mar 30 00:19:27.813697 2026] [:error] [pid 32257:tid 32333] [client 74.248.20.136:52161] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "aclRDyE3TArOFrUtgWqOBwAAAI8"]
[Mon Mar 30 00:19:28.446995 2026] [:error] [pid 23250:tid 23263] [client 74.248.20.136:33677] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "aclREJxrpj-dQjy1cvohngAAAks"]
[Mon Mar 30 00:19:29.949641 2026] [:error] [pid 32255:tid 32291] [client 74.248.20.136:18201] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "aclREWnfn-AtRoMbquwz2QAAAEA"]
[Mon Mar 30 00:19:30.958643 2026] [:error] [pid 23168:tid 23207] [client 74.248.20.136:18073] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aclREmP8p0yRL8ot_2_RwAAAAgo"]
[Mon Mar 30 00:19:31.968818 2026] [:error] [pid 23167:tid 23172] [client 74.248.20.136:52189] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aclRExIAHJCFaHff3_foTQAAAcI"]
[Mon Mar 30 00:19:33.407076 2026] [:error] [pid 32257:tid 32326] [client 74.248.20.136:61081] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aclRFSE3TArOFrUtgWqOKAAAAIg"]
[Mon Mar 30 00:19:34.492445 2026] [:error] [pid 32257:tid 32342] [client 74.248.20.136:45698] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aclRFiE3TArOFrUtgWqOMQAAAJg"]
[Mon Mar 30 00:19:35.853007 2026] [:error] [pid 32257:tid 32335] [client 74.248.20.136:61077] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "aclRFyE3TArOFrUtgWqOQgAAAJE"]
[Mon Mar 30 00:19:36.524062 2026] [:error] [pid 32257:tid 32336] [client 74.248.20.136:38589] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "aclRGCE3TArOFrUtgWqOTgAAAJI"]
[Mon Mar 30 00:19:37.295724 2026] [:error] [pid 32255:tid 32309] [client 74.248.20.136:51048] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "aclRGWnfn-AtRoMbquwz4QAAAFI"]
[Mon Mar 30 00:19:38.107833 2026] [:error] [pid 23168:tid 23199] [client 74.248.20.136:49249] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "aclRGmP8p0yRL8ot_2_R2QAAAgI"]
[Mon Mar 30 00:19:38.831850 2026] [:error] [pid 32257:tid 32324] [client 74.248.20.136:49271] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "aclRGiE3TArOFrUtgWqOXwAAAIY"]
[Mon Mar 30 00:19:39.750253 2026] [:error] [pid 8818:tid 8831] [client 74.248.20.136:45717] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "aclRGyCDvotZNSF0FBoCqgAAAUk"]
[Mon Mar 30 00:19:40.466301 2026] [:error] [pid 32359:tid 32371] [client 74.248.20.136:31938] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "aclRHAMb8G3UzfQP3WhC-gAAAMo"]
[Mon Mar 30 00:19:41.517857 2026] [:error] [pid 32255:tid 32314] [client 74.248.20.136:49936] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "aclRHWnfn-AtRoMbquwz6gAAAFc"]
[Mon Mar 30 00:19:45.441951 2026] [proxy_fcgi:error] [pid 23137:tid 23162] [client 74.248.20.136:15592] AH01071: Got error 'Primary script unknown'
[Mon Mar 30 00:19:54.311705 2026] [:error] [pid 23137:tid 23148] [client 74.248.20.136:15592] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpo.php"] [unique_id "aclRKhaWQa7LdZ_qGFYT0AAAAYk"]
[Mon Mar 30 00:19:55.347155 2026] [:error] [pid 23168:tid 23209] [client 74.248.20.136:32874] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpo.php"] [unique_id "aclRK2P8p0yRL8ot_2_R5AAAAgw"]
[Mon Mar 30 00:19:56.328413 2026] [:error] [pid 32255:tid 32300] [client 74.248.20.136:48865] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpo.php"] [unique_id "aclRLGnfn-AtRoMbquw0GwAAAEk"]
[Mon Mar 30 00:19:57.336226 2026] [:error] [pid 32257:tid 32325] [client 74.248.20.136:32060] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpo.php"] [unique_id "aclRLSE3TArOFrUtgWqOjwAAAIc"]
[Mon Mar 30 00:19:58.140653 2026] [:error] [pid 23167:tid 23193] [client 74.248.20.136:52085] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aj.php"] [unique_id "aclRLhIAHJCFaHff3_fogQAAAdc"]
[Mon Mar 30 00:19:58.835562 2026] [:error] [pid 23167:tid 23179] [client 74.248.20.136:32015] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aj.php"] [unique_id "aclRLhIAHJCFaHff3_fohQAAAck"]
[Mon Mar 30 00:19:59.526961 2026] [:error] [pid 23284:tid 23289] [client 74.248.20.136:48869] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aj.php"] [unique_id "aclRL4zBujdPHsq7wyQUOQAAAoM"]
[Mon Mar 30 00:20:00.142105 2026] [:error] [pid 23137:tid 23160] [client 74.248.20.136:48864] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aj.php"] [unique_id "aclRMBaWQa7LdZ_qGFYT0gAAAZU"]
[Mon Mar 30 00:20:01.145416 2026] [:error] [pid 32257:tid 32327] [client 74.248.20.136:16313] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/opts.php"] [unique_id "aclRMSE3TArOFrUtgWqOmQAAAIk"]
[Mon Mar 30 00:20:01.910480 2026] [:error] [pid 23167:tid 23181] [client 74.248.20.136:52090] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/opts.php"] [unique_id "aclRMRIAHJCFaHff3_foiwAAAcs"]
[Mon Mar 30 00:20:02.585449 2026] [:error] [pid 23167:tid 23179] [client 74.248.20.136:24499] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/opts.php"] [unique_id "aclRMhIAHJCFaHff3_fojwAAAck"]
[Mon Mar 30 00:20:03.192804 2026] [:error] [pid 32257:tid 32330] [client 74.248.20.136:45560] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/opts.php"] [unique_id "aclRMyE3TArOFrUtgWqOnQAAAIw"]
[Mon Mar 30 00:20:03.838448 2026] [:error] [pid 23284:tid 23304] [client 74.248.20.136:32035] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filer.php"] [unique_id "aclRM4zBujdPHsq7wyQUPwAAApI"]
[Mon Mar 30 00:20:04.482319 2026] [:error] [pid 23284:tid 23303] [client 74.248.20.136:24471] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filer.php"] [unique_id "aclRNIzBujdPHsq7wyQUQwAAApE"]
[Mon Mar 30 00:20:05.081287 2026] [:error] [pid 32257:tid 32338] [client 74.248.20.136:32849] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filer.php"] [unique_id "aclRNSE3TArOFrUtgWqOpAAAAJQ"]
[Mon Mar 30 00:20:05.620579 2026] [:error] [pid 32257:tid 32319] [client 74.248.20.136:55765] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filer.php"] [unique_id "aclRNSE3TArOFrUtgWqOpwAAAIE"]
[Mon Mar 30 00:20:06.269926 2026] [:error] [pid 32359:tid 32362] [client 74.248.20.136:3734] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lites.php"] [unique_id "aclRNgMb8G3UzfQP3WhDCAAAAME"]
[Mon Mar 30 00:20:07.278730 2026] [:error] [pid 23284:tid 23295] [client 74.248.20.136:3240] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lites.php"] [unique_id "aclRN4zBujdPHsq7wyQUSgAAAok"]
[Mon Mar 30 00:20:08.082189 2026] [:error] [pid 32254:tid 32283] [client 74.248.20.136:21434] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lites.php"] [unique_id "aclROKug2IHuyGgCTn9spwAAABM"]
[Mon Mar 30 00:20:08.878282 2026] [:error] [pid 23284:tid 23287] [client 74.248.20.136:51491] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lites.php"] [unique_id "aclROIzBujdPHsq7wyQUTAAAAoE"]
[Mon Mar 30 00:20:09.787032 2026] [:error] [pid 32257:tid 32322] [client 74.248.20.136:52037] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gorila.php"] [unique_id "aclROSE3TArOFrUtgWqOrQAAAIQ"]
[Mon Mar 30 00:20:10.979549 2026] [:error] [pid 23137:tid 23162] [client 74.248.20.136:25313] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gorila.php"] [unique_id "aclROhaWQa7LdZ_qGFYT1gAAAZc"]
[Mon Mar 30 00:20:11.648779 2026] [:error] [pid 32255:tid 32311] [client 74.248.20.136:32837] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gorila.php"] [unique_id "aclRO2nfn-AtRoMbquw0LwAAAFQ"]
[Mon Mar 30 00:20:12.874644 2026] [:error] [pid 32255:tid 32293] [client 74.248.20.136:48324] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gorila.php"] [unique_id "aclRPGnfn-AtRoMbquw0NgAAAEI"]
[Mon Mar 30 00:20:13.859915 2026] [:error] [pid 23284:tid 23290] [client 74.248.20.136:3223] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aclRPYzBujdPHsq7wyQUVgAAAoQ"]
[Mon Mar 30 00:20:14.638817 2026] [:error] [pid 23284:tid 23302] [client 74.248.20.136:3721] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aclRPozBujdPHsq7wyQUWQAAApA"]
[Mon Mar 30 00:20:15.440853 2026] [:error] [pid 32255:tid 32304] [client 74.248.20.136:18140] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aclRP2nfn-AtRoMbquw0PAAAAE0"]
[Mon Mar 30 00:20:16.155413 2026] [:error] [pid 32257:tid 32340] [client 74.248.20.136:24448] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "aclRQCE3TArOFrUtgWqOwAAAAJY"]
[Mon Mar 30 00:20:18.173713 2026] [:error] [pid 23167:tid 23179] [client 74.248.20.136:52034] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.php"] [unique_id "aclRQhIAHJCFaHff3_foygAAAck"]
[Mon Mar 30 00:20:19.218872 2026] [:error] [pid 23284:tid 23306] [client 74.248.20.136:25317] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.php"] [unique_id "aclRQ4zBujdPHsq7wyQUZQAAApQ"]
[Mon Mar 30 00:20:20.142418 2026] [:error] [pid 8818:tid 8823] [client 74.248.20.136:3866] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.php"] [unique_id "aclRRCCDvotZNSF0FBoCuQAAAUE"]
[Mon Mar 30 00:20:20.942107 2026] [:error] [pid 32257:tid 32335] [client 74.248.20.136:52467] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.php"] [unique_id "aclRRCE3TArOFrUtgWqOzwAAAJE"]
[Mon Mar 30 00:20:21.690172 2026] [:error] [pid 32255:tid 32296] [client 74.248.20.136:48335] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins.php"] [unique_id "aclRRWnfn-AtRoMbquw0RQAAAEU"]
[Mon Mar 30 00:20:22.969169 2026] [:error] [pid 32254:tid 32267] [client 74.248.20.136:44310] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins.php"] [unique_id "aclRRqug2IHuyGgCTn9ssQAAAAM"]
[Mon Mar 30 00:20:23.591780 2026] [:error] [pid 32255:tid 32315] [client 74.248.20.136:32869] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins.php"] [unique_id "aclRR2nfn-AtRoMbquw0TwAAAFg"]
[Mon Mar 30 00:20:24.582187 2026] [:error] [pid 23284:tid 23304] [client 74.248.20.136:32895] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins.php"] [unique_id "aclRSIzBujdPHsq7wyQUbQAAApI"]
[Mon Mar 30 00:20:25.158115 2026] [:error] [pid 23168:tid 23207] [client 74.248.20.136:3232] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filename.php"] [unique_id "aclRSWP8p0yRL8ot_2_SBQAAAgo"]
[Mon Mar 30 00:20:25.887684 2026] [:error] [pid 32257:tid 32334] [client 74.248.20.136:21384] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filename.php"] [unique_id "aclRSSE3TArOFrUtgWqO2gAAAJA"]
[Mon Mar 30 00:20:26.862959 2026] [:error] [pid 8818:tid 8836] [client 74.248.20.136:27558] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filename.php"] [unique_id "aclRSiCDvotZNSF0FBoCvwAAAU4"]
[Mon Mar 30 00:20:27.420363 2026] [:error] [pid 23168:tid 23213] [client 74.248.20.136:55449] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filename.php"] [unique_id "aclRS2P8p0yRL8ot_2_SFQAAAhA"]
[Mon Mar 30 00:20:27.976866 2026] [:error] [pid 32255:tid 32299] [client 74.248.20.136:52440] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer.php"] [unique_id "aclRS2nfn-AtRoMbquw0WwAAAEg"]
[Mon Mar 30 00:20:28.630011 2026] [:error] [pid 23167:tid 23173] [client 74.248.20.136:3759] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer.php"] [unique_id "aclRTBIAHJCFaHff3_fo3gAAAcM"]
[Mon Mar 30 00:20:29.343246 2026] [:error] [pid 32255:tid 32306] [client 74.248.20.136:3761] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer.php"] [unique_id "aclRTWnfn-AtRoMbquw0XwAAAE8"]
[Mon Mar 30 00:20:30.042795 2026] [:error] [pid 23284:tid 23297] [client 74.248.20.136:45567] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer.php"] [unique_id "aclRTozBujdPHsq7wyQUfAAAAos"]
[Mon Mar 30 00:20:30.801688 2026] [:error] [pid 32254:tid 32281] [client 74.248.20.136:3750] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aclRTqug2IHuyGgCTn9suAAAABE"]
[Mon Mar 30 00:20:31.443026 2026] [:error] [pid 23168:tid 23221] [client 74.248.20.136:45520] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aclRT2P8p0yRL8ot_2_SNgAAAhg"]
[Mon Mar 30 00:20:32.640466 2026] [:error] [pid 23168:tid 23199] [client 74.248.20.136:40230] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aclRUGP8p0yRL8ot_2_SQAAAAgI"]
[Mon Mar 30 00:20:33.292948 2026] [:error] [pid 23168:tid 23221] [client 74.248.20.136:52435] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "aclRUWP8p0yRL8ot_2_SRwAAAhg"]
[Mon Mar 30 00:20:34.000436 2026] [:error] [pid 8818:tid 8828] [client 74.248.20.136:45957] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aclRUSCDvotZNSF0FBoCwgAAAUY"]
[Mon Mar 30 00:20:34.618588 2026] [:error] [pid 32255:tid 32301] [client 74.248.20.136:33254] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aclRUmnfn-AtRoMbquw0aQAAAEo"]
[Mon Mar 30 00:20:35.294154 2026] [:error] [pid 23250:tid 23269] [client 74.248.20.136:3747] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aclRU5xrpj-dQjy1cvohyQAAAlE"]
[Mon Mar 30 00:20:35.888102 2026] [:error] [pid 23284:tid 23287] [client 74.248.20.136:45975] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aclRU4zBujdPHsq7wyQUiQAAAoE"]
[Mon Mar 30 00:20:36.704813 2026] [:error] [pid 32359:tid 32381] [client 74.248.20.136:44333] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aclRVAMb8G3UzfQP3WhDEwAAANQ"]
[Mon Mar 30 00:20:37.514399 2026] [:error] [pid 8818:tid 8833] [client 74.248.20.136:19843] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aclRVSCDvotZNSF0FBoCyAAAAUs"]
[Mon Mar 30 00:20:38.289641 2026] [:error] [pid 32359:tid 32366] [client 74.248.20.136:42630] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aclRVgMb8G3UzfQP3WhDFQAAAMU"]
[Mon Mar 30 00:20:38.992825 2026] [:error] [pid 23284:tid 23308] [client 74.248.20.136:36858] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aclRVozBujdPHsq7wyQUkwAAApY"]
[Mon Mar 30 00:20:39.816546 2026] [:error] [pid 32257:tid 32323] [client 74.248.20.136:3531] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-gr.php"] [unique_id "aclRVyE3TArOFrUtgWqO7gAAAIU"]
[Mon Mar 30 00:20:40.582503 2026] [:error] [pid 32257:tid 32325] [client 74.248.20.136:54490] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-gr.php"] [unique_id "aclRWCE3TArOFrUtgWqO8AAAAIc"]
[Mon Mar 30 00:20:41.948309 2026] [:error] [pid 32254:tid 32287] [client 74.248.20.136:54489] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-gr.php"] [unique_id "aclRWaug2IHuyGgCTn9svgAAABc"]
[Mon Mar 30 00:20:42.554745 2026] [:error] [pid 32257:tid 32335] [client 74.248.20.136:22261] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-gr.php"] [unique_id "aclRWiE3TArOFrUtgWqO9AAAAJE"]
[Mon Mar 30 00:20:43.217079 2026] [:error] [pid 23167:tid 23177] [client 74.248.20.136:19871] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mn.php"] [unique_id "aclRWxIAHJCFaHff3_fo6AAAAcc"]
[Mon Mar 30 00:20:43.859012 2026] [:error] [pid 23284:tid 23287] [client 74.248.20.136:45137] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mn.php"] [unique_id "aclRW4zBujdPHsq7wyQUmwAAAoE"]
[Mon Mar 30 00:20:44.620891 2026] [:error] [pid 23167:tid 23183] [client 74.248.20.136:47997] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mn.php"] [unique_id "aclRXBIAHJCFaHff3_fo7QAAAc0"]
[Mon Mar 30 00:20:45.527510 2026] [:error] [pid 23168:tid 23198] [client 74.248.20.136:45997] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mn.php"] [unique_id "aclRXWP8p0yRL8ot_2_SUwAAAgE"]
[Mon Mar 30 00:20:46.422820 2026] [:error] [pid 8818:tid 8838] [client 74.248.20.136:37462] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mt.php"] [unique_id "aclRXiCDvotZNSF0FBoC0wAAAVA"]
[Mon Mar 30 00:20:47.276999 2026] [:error] [pid 32254:tid 32269] [client 74.248.20.136:22267] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mt.php"] [unique_id "aclRX6ug2IHuyGgCTn9swQAAAAU"]
[Mon Mar 30 00:20:48.599910 2026] [:error] [pid 32255:tid 32294] [client 74.248.20.136:42642] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mt.php"] [unique_id "aclRYGnfn-AtRoMbquw0egAAAEM"]
[Mon Mar 30 00:20:49.530170 2026] [:error] [pid 32257:tid 32337] [client 74.248.20.136:52541] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mt.php"] [unique_id "aclRYSE3TArOFrUtgWqPAQAAAJM"]
[Mon Mar 30 00:20:50.613023 2026] [:error] [pid 23168:tid 23215] [client 74.248.20.136:54498] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shout.php"] [unique_id "aclRYmP8p0yRL8ot_2_SXwAAAhI"]
[Mon Mar 30 00:20:51.535620 2026] [:error] [pid 32255:tid 32303] [client 74.248.20.136:42664] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shout.php"] [unique_id "aclRY2nfn-AtRoMbquw0kAAAAEw"]
[Mon Mar 30 00:21:03.393858 2026] [:error] [pid 32257:tid 32329] [client 74.248.20.136:47950] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aclRbyE3TArOFrUtgWqPLwAAAIs"]
[Mon Mar 30 00:21:04.030367 2026] [:error] [pid 32255:tid 32305] [client 74.248.20.136:24086] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aclRcGnfn-AtRoMbquw0pAAAAE4"]
[Mon Mar 30 00:21:04.821294 2026] [:error] [pid 23284:tid 23301] [client 74.248.20.136:43269] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aclRcIzBujdPHsq7wyQU3AAAAo8"]
[Mon Mar 30 00:21:05.572474 2026] [:error] [pid 23284:tid 23308] [client 74.248.20.136:16608] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "aclRcYzBujdPHsq7wyQU4QAAApY"]
[Mon Mar 30 00:21:07.978884 2026] [:error] [pid 32257:tid 32325] [client 74.248.20.136:45809] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mn.php"] [unique_id "aclRcyE3TArOFrUtgWqPPAAAAIc"]
[Mon Mar 30 00:21:08.809427 2026] [:error] [pid 32257:tid 32323] [client 74.248.20.136:17141] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mn.php"] [unique_id "aclRdCE3TArOFrUtgWqPRAAAAIU"]
[Mon Mar 30 00:21:09.763831 2026] [:error] [pid 32255:tid 32299] [client 74.248.20.136:28088] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mn.php"] [unique_id "aclRdWnfn-AtRoMbquw0zwAAAEg"]
[Mon Mar 30 00:21:10.585859 2026] [:error] [pid 23284:tid 23289] [client 74.248.20.136:38999] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mn.php"] [unique_id "aclRdozBujdPHsq7wyQU6QAAAoM"]
[Mon Mar 30 00:21:11.220152 2026] [:error] [pid 23284:tid 23310] [client 74.248.20.136:24085] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aclRd4zBujdPHsq7wyQU7AAAApg"]
[Mon Mar 30 00:21:12.262823 2026] [:error] [pid 23167:tid 23173] [client 74.248.20.136:45808] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aclReBIAHJCFaHff3_fo-wAAAcM"]
[Mon Mar 30 00:21:13.114392 2026] [:error] [pid 23284:tid 23301] [client 74.248.20.136:39028] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aclReYzBujdPHsq7wyQU_QAAAo8"]
[Mon Mar 30 00:21:14.432509 2026] [:error] [pid 23168:tid 23208] [client 74.248.20.136:19851] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "aclRemP8p0yRL8ot_2_SdAAAAgs"]
[Mon Mar 30 00:21:15.485460 2026] [:error] [pid 23284:tid 23289] [client 74.248.20.136:17145] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abe.php"] [unique_id "aclRe4zBujdPHsq7wyQVCgAAAoM"]
[Mon Mar 30 00:21:16.624027 2026] [:error] [pid 8818:tid 8823] [client 74.248.20.136:17131] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abe.php"] [unique_id "aclRfCCDvotZNSF0FBoC7AAAAUE"]
[Mon Mar 30 00:21:17.302125 2026] [:error] [pid 23284:tid 23288] [client 74.248.20.136:37502] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abe.php"] [unique_id "aclRfYzBujdPHsq7wyQVEQAAAoI"]
[Mon Mar 30 00:21:17.977812 2026] [:error] [pid 23284:tid 23291] [client 74.248.20.136:56890] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abe.php"] [unique_id "aclRfYzBujdPHsq7wyQVFgAAAoU"]
[Mon Mar 30 00:21:18.664839 2026] [:error] [pid 8818:tid 8827] [client 74.248.20.136:39019] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/index.php"] [unique_id "aclRfiCDvotZNSF0FBoC7QAAAUU"]
[Mon Mar 30 00:21:19.413924 2026] [:error] [pid 32359:tid 32372] [client 74.248.20.136:56850] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/index.php"] [unique_id "aclRfwMb8G3UzfQP3WhDKAAAAMs"]
[Mon Mar 30 00:21:20.045010 2026] [:error] [pid 32257:tid 32337] [client 74.248.20.136:16638] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/index.php"] [unique_id "aclRgCE3TArOFrUtgWqPYwAAAJM"]
[Mon Mar 30 00:21:20.686710 2026] [:error] [pid 32257:tid 32339] [client 74.248.20.136:56848] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/index.php"] [unique_id "aclRgCE3TArOFrUtgWqPZQAAAJU"]
[Mon Mar 30 00:21:21.295888 2026] [:error] [pid 32257:tid 32324] [client 74.248.20.136:53614] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aclRgSE3TArOFrUtgWqPbAAAAIY"]
[Mon Mar 30 00:21:21.920356 2026] [:error] [pid 32257:tid 32325] [client 74.248.20.136:35714] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aclRgSE3TArOFrUtgWqPcgAAAIc"]
[Mon Mar 30 00:21:23.464289 2026] [:error] [pid 23168:tid 23206] [client 74.248.20.136:17104] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aclRg2P8p0yRL8ot_2_SfgAAAgk"]
[Mon Mar 30 00:21:24.315330 2026] [:error] [pid 8818:tid 8829] [client 74.248.20.136:41286] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sx.php"] [unique_id "aclRhCCDvotZNSF0FBoDBwAAAUc"]
[Mon Mar 30 00:21:25.143619 2026] [:error] [pid 32257:tid 32336] [client 74.248.20.136:28724] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gelay.php"] [unique_id "aclRhSE3TArOFrUtgWqPlgAAAJI"]
[Mon Mar 30 00:21:25.868450 2026] [:error] [pid 23137:tid 23151] [client 74.248.20.136:20319] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gelay.php"] [unique_id "aclRhRaWQa7LdZ_qGFYT7wAAAYw"]
[Mon Mar 30 00:21:56.296839 2026] [:error] [pid 32257:tid 32323] [client 74.248.20.136:7309] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-class.php"] [unique_id "aclRpCE3TArOFrUtgWqP8QAAAIU"]
[Mon Mar 30 00:21:58.583936 2026] [:error] [pid 23284:tid 23303] [client 74.248.20.136:7321] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-class.php"] [unique_id "aclRpozBujdPHsq7wyQVUQAAApE"]
[Mon Mar 30 00:21:59.806254 2026] [:error] [pid 23168:tid 23216] [client 74.248.20.136:32721] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-class.php"] [unique_id "aclRp2P8p0yRL8ot_2_SrwAAAhM"]
[Mon Mar 30 00:22:00.528404 2026] [:error] [pid 32257:tid 32325] [client 74.248.20.136:32702] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-class.php"] [unique_id "aclRqCE3TArOFrUtgWqQAwAAAIc"]
[Mon Mar 30 00:22:03.914141 2026] [:error] [pid 32257:tid 32338] [client 74.248.20.136:20650] [client 74.248.20.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.248.20.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aclRqyE3TArOFrUtgWqQGgAAAJQ"]
[Mon Mar 30 00:22:05.964858 2026] [:error] [pid 23284:tid 23291] [client 74.248.20.136:42971] [client 74.248.20.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.248.20.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aclRrYzBujdPHsq7wyQVagAAAoU"]
[Mon Mar 30 00:22:17.326923 2026] [:error] [pid 32257:tid 32328] [client 74.248.20.136:20650] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/claa.php"] [unique_id "aclRuSE3TArOFrUtgWqQOgAAAIo"]
[Mon Mar 30 00:22:19.275152 2026] [:error] [pid 23168:tid 23218] [client 74.248.20.136:29584] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/claa.php"] [unique_id "aclRu2P8p0yRL8ot_2_SzgAAAhU"]
[Mon Mar 30 00:22:20.336034 2026] [:error] [pid 23284:tid 23296] [client 74.248.20.136:16555] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/claa.php"] [unique_id "aclRvIzBujdPHsq7wyQVtAAAAoo"]
[Mon Mar 30 00:22:21.405501 2026] [:error] [pid 23284:tid 23302] [client 74.248.20.136:46629] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/claa.php"] [unique_id "aclRvYzBujdPHsq7wyQVuQAAApA"]
[Mon Mar 30 00:22:22.393814 2026] [:error] [pid 8818:tid 8827] [client 74.248.20.136:35836] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aclRviCDvotZNSF0FBoDMQAAAUU"]
[Mon Mar 30 00:22:23.077040 2026] [:error] [pid 23168:tid 23216] [client 74.248.20.136:61042] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aclRv2P8p0yRL8ot_2_S1gAAAhM"]
[Mon Mar 30 00:22:24.323177 2026] [:error] [pid 23168:tid 23211] [client 74.248.20.136:47374] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aclRwGP8p0yRL8ot_2_S2gAAAg4"]
[Mon Mar 30 00:22:25.183760 2026] [:error] [pid 23168:tid 23218] [client 74.248.20.136:47913] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "aclRwWP8p0yRL8ot_2_S3AAAAhU"]
[Mon Mar 30 00:22:26.345249 2026] [:error] [pid 8818:tid 8826] [client 74.248.20.136:29627] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aclRwiCDvotZNSF0FBoDOQAAAUQ"]
[Mon Mar 30 00:22:27.817282 2026] [:error] [pid 23167:tid 23193] [client 74.248.20.136:34879] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aclRwxIAHJCFaHff3_fpfwAAAdc"]
[Mon Mar 30 00:22:30.154616 2026] [:error] [pid 32255:tid 32309] [client 74.248.20.136:46577] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aclRxmnfn-AtRoMbquw1qQAAAFI"]
[Mon Mar 30 00:22:31.521649 2026] [:error] [pid 32257:tid 32318] [client 74.248.20.136:35809] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aclRxyE3TArOFrUtgWqQRQAAAIA"]
[Mon Mar 30 00:22:33.502645 2026] [:error] [pid 32255:tid 32313] [client 74.248.20.136:42409] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aclRyWnfn-AtRoMbquw1qwAAAFY"]
[Mon Mar 30 00:22:34.504954 2026] [:error] [pid 8818:tid 8835] [client 74.248.20.136:55858] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aclRyiCDvotZNSF0FBoDSwAAAU0"]
[Mon Mar 30 00:22:35.576537 2026] [:error] [pid 32255:tid 32302] [client 74.248.20.136:61052] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aclRy2nfn-AtRoMbquw1swAAAEs"]
[Mon Mar 30 00:22:36.754580 2026] [:error] [pid 23167:tid 23180] [client 74.248.20.136:18666] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "aclRzBIAHJCFaHff3_fpjwAAAco"]
[Mon Mar 30 00:22:37.573848 2026] [:error] [pid 8818:tid 8833] [client 74.248.20.136:46560] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aclRzSCDvotZNSF0FBoDXAAAAUs"]
[Mon Mar 30 00:22:39.120779 2026] [:error] [pid 32257:tid 32321] [client 74.248.20.136:34844] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aclRzyE3TArOFrUtgWqQUwAAAIM"]
[Mon Mar 30 00:22:39.908161 2026] [:error] [pid 23167:tid 23193] [client 74.248.20.136:34830] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aclRzxIAHJCFaHff3_fpnAAAAdc"]
[Mon Mar 30 00:22:40.719502 2026] [:error] [pid 32255:tid 32302] [client 74.248.20.136:23337] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "aclR0Gnfn-AtRoMbquw1vgAAAEs"]
[Mon Mar 30 00:22:41.859305 2026] [:error] [pid 32257:tid 32318] [client 74.248.20.136:15688] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aclR0SE3TArOFrUtgWqQZgAAAIA"]
[Mon Mar 30 00:22:42.940555 2026] [:error] [pid 23250:tid 23267] [client 74.248.20.136:31170] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aclR0pxrpj-dQjy1cvoiMwAAAk8"]
[Mon Mar 30 00:22:43.628369 2026] [:error] [pid 32257:tid 32322] [client 74.248.20.136:31169] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aclR0yE3TArOFrUtgWqQdgAAAIQ"]
[Mon Mar 30 00:22:44.533166 2026] [:error] [pid 23284:tid 23294] [client 74.248.20.136:23327] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "aclR1IzBujdPHsq7wyQV_AAAAog"]
[Mon Mar 30 00:22:46.005278 2026] [:error] [pid 32254:tid 32285] [client 74.248.20.136:30297] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aclR1qug2IHuyGgCTn9s-gAAABU"]
[Mon Mar 30 00:22:46.882095 2026] [:error] [pid 32255:tid 32300] [client 74.248.20.136:28791] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aclR1mnfn-AtRoMbquw12wAAAEk"]
[Mon Mar 30 00:22:47.799507 2026] [:error] [pid 8818:tid 8837] [client 74.248.20.136:18676] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aclR1yCDvotZNSF0FBoDcAAAAU8"]
[Mon Mar 30 00:22:48.917736 2026] [:error] [pid 23284:tid 23288] [client 74.248.20.136:18637] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "aclR2IzBujdPHsq7wyQWDAAAAoI"]
[Mon Mar 30 00:22:49.587978 2026] [:error] [pid 23250:tid 23261] [client 74.248.20.136:29911] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aclR2Zxrpj-dQjy1cvoiNgAAAkk"]
[Mon Mar 30 00:22:50.574290 2026] [:error] [pid 8818:tid 8846] [client 74.248.20.136:21065] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aclR2iCDvotZNSF0FBoDdwAAAVg"]
[Mon Mar 30 00:22:51.347128 2026] [:error] [pid 32359:tid 32367] [client 74.248.20.136:55835] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aclR2wMb8G3UzfQP3WhDXwAAAMY"]
[Mon Mar 30 00:22:53.023032 2026] [:error] [pid 23168:tid 23207] [client 74.248.20.136:14770] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "aclR3WP8p0yRL8ot_2_TBgAAAgo"]
[Mon Mar 30 00:22:54.546228 2026] [:error] [pid 23137:tid 23159] [client 74.248.20.136:55831] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aclR3haWQa7LdZ_qGFYUMwAAAZQ"]
[Mon Mar 30 00:22:56.073816 2026] [:error] [pid 32254:tid 32279] [client 74.248.20.136:49818] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aclR4Kug2IHuyGgCTn9tBQAAAA8"]
[Mon Mar 30 00:22:59.457302 2026] [:error] [pid 23168:tid 23201] [client 74.248.20.136:36686] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aclR42P8p0yRL8ot_2_TGgAAAgQ"]
[Mon Mar 30 00:23:01.532807 2026] [:error] [pid 23284:tid 23292] [client 74.248.20.136:29908] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "aclR5YzBujdPHsq7wyQWKgAAAoY"]
[Mon Mar 30 00:23:02.201427 2026] [:error] [pid 32257:tid 32332] [client 74.248.20.136:22526] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aclR5iE3TArOFrUtgWqQxAAAAI4"]
[Mon Mar 30 00:23:03.072982 2026] [:error] [pid 23168:tid 23204] [client 74.248.20.136:30720] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aclR52P8p0yRL8ot_2_TLQAAAgc"]
[Mon Mar 30 00:23:04.133853 2026] [:error] [pid 32257:tid 32325] [client 74.248.20.136:53037] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aclR6CE3TArOFrUtgWqQ3QAAAIc"]
[Mon Mar 30 00:23:05.062425 2026] [:error] [pid 32257:tid 32336] [client 74.248.20.136:38027] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "aclR6SE3TArOFrUtgWqQ7AAAAJI"]
[Mon Mar 30 00:23:06.025554 2026] [:error] [pid 32359:tid 32370] [client 74.248.20.136:53055] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aclR6gMb8G3UzfQP3WhDZgAAAMk"]
[Mon Mar 30 00:23:08.761302 2026] [:error] [pid 23168:tid 23219] [client 74.248.20.136:30814] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aclR7GP8p0yRL8ot_2_TRQAAAhY"]
[Mon Mar 30 00:23:09.603150 2026] [:error] [pid 32257:tid 32321] [client 74.248.20.136:54463] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aclR7SE3TArOFrUtgWqRHAAAAIM"]
[Mon Mar 30 00:23:10.710758 2026] [:error] [pid 23168:tid 23200] [client 74.248.20.136:49823] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aclR7mP8p0yRL8ot_2_TSAAAAgM"]
[Mon Mar 30 00:23:11.524892 2026] [:error] [pid 32257:tid 32323] [client 74.248.20.136:45945] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lopst.php"] [unique_id "aclR7yE3TArOFrUtgWqRLwAAAIU"]
[Mon Mar 30 00:23:13.092613 2026] [:error] [pid 32359:tid 32372] [client 74.248.20.136:14759] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lopst.php"] [unique_id "aclR8QMb8G3UzfQP3WhDZwAAAMs"]
[Mon Mar 30 00:23:13.752096 2026] [:error] [pid 23284:tid 23296] [client 74.248.20.136:43846] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lopst.php"] [unique_id "aclR8YzBujdPHsq7wyQWPQAAAoo"]
[Mon Mar 30 00:23:14.908283 2026] [:error] [pid 23137:tid 23146] [client 74.248.20.136:54907] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lopst.php"] [unique_id "aclR8haWQa7LdZ_qGFYURwAAAYc"]
[Mon Mar 30 00:23:15.596982 2026] [:error] [pid 23284:tid 23297] [client 74.248.20.136:22802] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wft.php"] [unique_id "aclR84zBujdPHsq7wyQWSwAAAos"]
[Mon Mar 30 00:23:27.228331 2026] [:error] [pid 23250:tid 23271] [client 74.248.20.136:62182] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zample.php"] [unique_id "aclR_5xrpj-dQjy1cvoidgAAAlM"]
[Mon Mar 30 00:23:27.926061 2026] [:error] [pid 8818:tid 8834] [client 74.248.20.136:34885] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zample.php"] [unique_id "aclR_yCDvotZNSF0FBoDkQAAAUw"]
[Mon Mar 30 00:23:29.277570 2026] [:error] [pid 23168:tid 23203] [client 74.248.20.136:42824] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zample.php"] [unique_id "aclSAWP8p0yRL8ot_2_TbwAAAgY"]
[Mon Mar 30 00:23:30.721437 2026] [:error] [pid 8818:tid 8845] [client 74.248.20.136:38053] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zample.php"] [unique_id "aclSAiCDvotZNSF0FBoDkwAAAVc"]
[Mon Mar 30 00:23:31.875927 2026] [:error] [pid 23250:tid 23276] [client 74.248.20.136:62203] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/read.php"] [unique_id "aclSA5xrpj-dQjy1cvoiewAAAlg"]
[Mon Mar 30 00:23:33.936316 2026] [:error] [pid 32359:tid 32369] [client 74.248.20.136:43166] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/read.php"] [unique_id "aclSBQMb8G3UzfQP3WhDbwAAAMg"]
[Mon Mar 30 00:23:34.958852 2026] [:error] [pid 23168:tid 23210] [client 74.248.20.136:51140] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/read.php"] [unique_id "aclSBmP8p0yRL8ot_2_TgAAAAg0"]
[Mon Mar 30 00:23:36.208755 2026] [:error] [pid 23137:tid 23141] [client 74.248.20.136:21444] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/read.php"] [unique_id "aclSCBaWQa7LdZ_qGFYUVgAAAYI"]
[Mon Mar 30 00:23:39.988900 2026] [:error] [pid 23284:tid 23299] [client 74.248.20.136:37541] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "aclSC4zBujdPHsq7wyQWhQAAAo0"]
[Mon Mar 30 00:23:42.284107 2026] [:error] [pid 23167:tid 23189] [client 74.248.20.136:51171] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "aclSDhIAHJCFaHff3_fp2wAAAdM"]
[Mon Mar 30 00:23:47.285911 2026] [:error] [pid 23284:tid 23304] [client 74.248.20.136:26440] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "aclSE4zBujdPHsq7wyQWxgAAApI"]
[Mon Mar 30 00:23:48.152766 2026] [:error] [pid 32257:tid 32330] [client 74.248.20.136:63023] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "aclSFCE3TArOFrUtgWqSRgAAAIw"]
[Mon Mar 30 00:23:49.144124 2026] [:error] [pid 8818:tid 8840] [client 74.248.20.136:31682] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aclSFSCDvotZNSF0FBoDnQAAAVI"]
[Mon Mar 30 00:23:49.944282 2026] [:error] [pid 23137:tid 23145] [client 74.248.20.136:12257] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aclSFRaWQa7LdZ_qGFYUYgAAAYY"]
[Mon Mar 30 00:23:50.767293 2026] [:error] [pid 32257:tid 32329] [client 74.248.20.136:63001] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aclSFiE3TArOFrUtgWqSTwAAAIs"]
[Mon Mar 30 00:23:51.561349 2026] [:error] [pid 32257:tid 32337] [client 74.248.20.136:34922] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aclSFyE3TArOFrUtgWqSUwAAAJM"]
[Mon Mar 30 00:23:52.222772 2026] [:error] [pid 23284:tid 23291] [client 74.248.20.136:44747] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mter.php"] [unique_id "aclSGIzBujdPHsq7wyQW9AAAAoU"]
[Mon Mar 30 00:23:53.073085 2026] [:error] [pid 23284:tid 23309] [client 74.248.20.136:39713] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mter.php"] [unique_id "aclSGYzBujdPHsq7wyQXAwAAApc"]
[Mon Mar 30 00:23:54.270568 2026] [:error] [pid 23250:tid 23262] [client 74.248.20.136:53978] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mter.php"] [unique_id "aclSGpxrpj-dQjy1cvoijAAAAko"]
[Mon Mar 30 00:23:55.119216 2026] [:error] [pid 32254:tid 32265] [client 74.248.20.136:53961] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mter.php"] [unique_id "aclSG6ug2IHuyGgCTn9tFwAAAAE"]
[Mon Mar 30 00:24:06.987364 2026] [:error] [pid 23284:tid 23303] [client 74.248.20.136:34880] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aclSJozBujdPHsq7wyQXtAAAApE"]
[Mon Mar 30 00:24:37.889479 2026] [:error] [pid 23284:tid 23307] [client 74.248.20.136:22553] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aclSRYzBujdPHsq7wyQYeAAAApU"]
[Mon Mar 30 00:24:39.300861 2026] [:error] [pid 23284:tid 23290] [client 74.248.20.136:35144] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aclSR4zBujdPHsq7wyQYfwAAAoQ"]
[Mon Mar 30 00:24:40.684538 2026] [:error] [pid 23284:tid 23300] [client 74.248.20.136:41844] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aclSSIzBujdPHsq7wyQYigAAAo4"]
[Mon Mar 30 00:24:41.564643 2026] [:error] [pid 23284:tid 23294] [client 74.248.20.136:52571] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aclSSYzBujdPHsq7wyQYjwAAAog"]
[Mon Mar 30 00:24:42.597479 2026] [:error] [pid 23250:tid 23256] [client 74.248.20.136:42317] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aclSSpxrpj-dQjy1cvoioAAAAkQ"]
[Mon Mar 30 00:24:43.901842 2026] [:error] [pid 32254:tid 32279] [client 74.248.20.136:3397] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aclSS6ug2IHuyGgCTn9tIwAAAA8"]
[Mon Mar 30 00:24:45.051917 2026] [:error] [pid 23284:tid 23286] [client 74.248.20.136:17361] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aclSTYzBujdPHsq7wyQYmgAAAoA"]
[Mon Mar 30 00:24:46.005164 2026] [:error] [pid 8818:tid 8841] [client 74.248.20.136:38549] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aclSTiCDvotZNSF0FBoD0QAAAVM"]
[Mon Mar 30 00:24:47.169661 2026] [:error] [pid 23137:tid 23148] [client 74.248.20.136:56916] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aclSTxaWQa7LdZ_qGFYUeAAAAYk"]
[Mon Mar 30 00:24:47.926667 2026] [:error] [pid 23167:tid 23193] [client 74.248.20.136:51731] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aclSTxIAHJCFaHff3_fqCgAAAdc"]
[Mon Mar 30 00:24:48.669520 2026] [:error] [pid 32255:tid 32306] [client 74.248.20.136:18152] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aclSUGnfn-AtRoMbquw2tgAAAE8"]
[Mon Mar 30 00:24:51.130557 2026] [:error] [pid 32257:tid 32321] [client 74.248.20.136:6436] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aclSUyE3TArOFrUtgWqTZAAAAIM"]
[Mon Mar 30 00:24:51.940331 2026] [:error] [pid 23250:tid 23261] [client 74.248.20.136:41139] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aclSU5xrpj-dQjy1cvoipAAAAkk"]
[Mon Mar 30 00:24:53.416891 2026] [:error] [pid 23168:tid 23212] [client 74.248.20.136:3454] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aclSVWP8p0yRL8ot_2_UAAAAAg8"]
[Mon Mar 30 00:24:54.130365 2026] [:error] [pid 23168:tid 23207] [client 74.248.20.136:6401] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aclSVmP8p0yRL8ot_2_UBAAAAgo"]
[Mon Mar 30 00:24:55.390233 2026] [:error] [pid 32254:tid 32287] [client 74.248.20.136:36913] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aclSV6ug2IHuyGgCTn9tLAAAABc"]
[Mon Mar 30 00:24:56.962933 2026] [:error] [pid 23284:tid 23303] [client 74.248.20.136:17368] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "aclSWIzBujdPHsq7wyQYnwAAApE"]
[Mon Mar 30 00:24:59.495669 2026] [:error] [pid 32257:tid 32333] [client 74.248.20.136:33333] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "aclSWyE3TArOFrUtgWqTewAAAI8"]
[Mon Mar 30 00:25:00.513244 2026] [:error] [pid 23168:tid 23220] [client 74.248.20.136:23006] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "aclSXGP8p0yRL8ot_2_UEQAAAhc"]
[Mon Mar 30 00:25:01.472457 2026] [:error] [pid 23168:tid 23212] [client 74.248.20.136:34979] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "aclSXWP8p0yRL8ot_2_UFgAAAg8"]
[Mon Mar 30 00:25:02.619548 2026] [:error] [pid 23168:tid 23216] [client 74.248.20.136:31479] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "aclSXmP8p0yRL8ot_2_UHAAAAhM"]
[Mon Mar 30 00:25:03.891350 2026] [:error] [pid 23168:tid 23208] [client 74.248.20.136:6451] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "aclSX2P8p0yRL8ot_2_UIAAAAgs"]
[Mon Mar 30 00:25:04.988409 2026] [:error] [pid 32257:tid 32327] [client 74.248.20.136:34993] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "aclSYCE3TArOFrUtgWqTgwAAAIk"]
[Mon Mar 30 00:25:06.635881 2026] [:error] [pid 32254:tid 32281] [client 74.248.20.136:38549] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "aclSYqug2IHuyGgCTn9tMQAAABE"]
[Mon Mar 30 00:25:07.578634 2026] [:error] [pid 23284:tid 23293] [client 74.248.20.136:62086] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "aclSY4zBujdPHsq7wyQYtwAAAoc"]
[Mon Mar 30 00:25:08.602121 2026] [:error] [pid 23167:tid 23193] [client 74.248.20.136:46348] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "aclSZBIAHJCFaHff3_fqIgAAAdc"]
[Mon Mar 30 00:25:09.800419 2026] [:error] [pid 23284:tid 23305] [client 74.248.20.136:15561] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "aclSZYzBujdPHsq7wyQYyAAAApM"]
[Mon Mar 30 00:25:11.643517 2026] [:error] [pid 23168:tid 23205] [client 74.248.20.136:6453] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "aclSZ2P8p0yRL8ot_2_ULwAAAgg"]
[Mon Mar 30 00:25:13.333578 2026] [:error] [pid 23167:tid 23175] [client 74.248.20.136:47285] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aclSaRIAHJCFaHff3_fqLAAAAcU"]
[Mon Mar 30 00:25:14.288162 2026] [:error] [pid 32257:tid 32326] [client 74.248.20.136:30620] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aclSaiE3TArOFrUtgWqTlgAAAIg"]
[Mon Mar 30 00:25:15.318563 2026] [:error] [pid 8818:tid 8828] [client 74.248.20.136:34972] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aclSayCDvotZNSF0FBoEDwAAAUY"]
[Mon Mar 30 00:25:16.293587 2026] [:error] [pid 23250:tid 23275] [client 74.248.20.136:4029] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aclSbJxrpj-dQjy1cvoiyAAAAlc"]
[Mon Mar 30 00:25:16.978625 2026] [:error] [pid 32257:tid 32330] [client 74.248.20.136:34008] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "aclSbCE3TArOFrUtgWqToQAAAIw"]
[Mon Mar 30 00:25:17.910132 2026] [:error] [pid 8818:tid 8825] [client 74.248.20.136:23784] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "aclSbSCDvotZNSF0FBoEFQAAAUM"]
[Mon Mar 30 00:25:18.602347 2026] [:error] [pid 32257:tid 32336] [client 74.248.20.136:30649] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "aclSbiE3TArOFrUtgWqTpQAAAJI"]
[Mon Mar 30 00:25:19.655518 2026] [:error] [pid 23284:tid 23292] [client 74.248.20.136:18547] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "aclSb4zBujdPHsq7wyQY1gAAAoY"]
[Mon Mar 30 00:25:21.555088 2026] [:error] [pid 32254:tid 32277] [client 74.248.20.136:34040] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aclScaug2IHuyGgCTn9tPgAAAA0"]
[Mon Mar 30 00:25:22.785308 2026] [:error] [pid 23250:tid 23257] [client 74.248.20.136:18616] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aclScpxrpj-dQjy1cvoi2AAAAkU"]
[Mon Mar 30 00:25:24.821883 2026] [:error] [pid 32359:tid 32378] [client 74.248.20.136:30609] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aclSdAMb8G3UzfQP3WhDnQAAANE"]
[Mon Mar 30 00:25:25.905629 2026] [:error] [pid 23167:tid 23171] [client 74.248.20.136:23801] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aclSdRIAHJCFaHff3_fqNwAAAcE"]
[Mon Mar 30 00:25:29.334164 2026] [:error] [pid 32257:tid 32339] [client 74.248.20.136:29528] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bengi.php"] [unique_id "aclSeSE3TArOFrUtgWqTqgAAAJU"]
[Mon Mar 30 00:25:30.084875 2026] [:error] [pid 23167:tid 23193] [client 74.248.20.136:30673] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bengi.php"] [unique_id "aclSehIAHJCFaHff3_fqPgAAAdc"]
[Mon Mar 30 00:25:31.593803 2026] [:error] [pid 32254:tid 32272] [client 74.248.20.136:19800] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bengi.php"] [unique_id "aclSe6ug2IHuyGgCTn9tRAAAAAg"]
[Mon Mar 30 00:25:32.732749 2026] [:error] [pid 32255:tid 32301] [client 74.248.20.136:36583] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bengi.php"] [unique_id "aclSfGnfn-AtRoMbquw28AAAAEo"]
[Mon Mar 30 00:25:33.624840 2026] [:error] [pid 32257:tid 32333] [client 74.248.20.136:33531] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ew.php"] [unique_id "aclSfSE3TArOFrUtgWqTtgAAAI8"]
[Mon Mar 30 00:25:35.175970 2026] [:error] [pid 23137:tid 23156] [client 74.248.20.136:55420] [client 74.248.20.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ew.php"] [unique_id "aclSfxaWQa7LdZ_qGFYUqQAAAZE"]
[Mon Mar 30 00:55:11.864543 2026] [:error] [pid 32257:tid 32338] [client 150.129.9.17:51204] [client 150.129.9.17] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=audio/mpeg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aclZbyE3TArOFrUtgWqu6AAAAJQ"]
[Mon Mar 30 01:02:43.829315 2026] [:error] [pid 32257:tid 32319] [client 20.65.118.88:12282] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsas.php"] [unique_id "aclbMyE3TArOFrUtgWq0mAAAAIE"]
[Mon Mar 30 01:02:44.285895 2026] [:error] [pid 32255:tid 32300] [client 20.65.118.88:12165] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsas.php"] [unique_id "aclbNGnfn-AtRoMbquxJzAAAAEk"]
[Mon Mar 30 01:02:44.807958 2026] [:error] [pid 32257:tid 32322] [client 20.65.118.88:12278] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsas.php"] [unique_id "aclbNCE3TArOFrUtgWq0nAAAAIQ"]
[Mon Mar 30 01:02:45.391996 2026] [:error] [pid 32257:tid 32332] [client 20.65.118.88:12272] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsas.php"] [unique_id "aclbNSE3TArOFrUtgWq0nQAAAI4"]
[Mon Mar 30 01:02:46.007799 2026] [:error] [pid 32257:tid 32327] [client 20.65.118.88:12287] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aclbNiE3TArOFrUtgWq0oQAAAIk"]
[Mon Mar 30 01:02:46.447662 2026] [:error] [pid 23167:tid 23174] [client 20.65.118.88:12118] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aclbNhIAHJCFaHff3_f3TAAAAcQ"]
[Mon Mar 30 01:02:46.943638 2026] [:error] [pid 23167:tid 23172] [client 20.65.118.88:12199] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aclbNhIAHJCFaHff3_f3TQAAAcI"]
[Mon Mar 30 01:02:47.357291 2026] [:error] [pid 23284:tid 23299] [client 20.65.118.88:12241] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aclbN4zBujdPHsq7wyQxVwAAAo0"]
[Mon Mar 30 01:02:48.022443 2026] [:error] [pid 23250:tid 23260] [client 20.65.118.88:12271] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-header.php"] [unique_id "aclbOJxrpj-dQjy1cvoqhQAAAkg"]
[Mon Mar 30 01:02:48.745100 2026] [:error] [pid 32255:tid 32303] [client 20.65.118.88:12258] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-header.php"] [unique_id "aclbOGnfn-AtRoMbquxJ0AAAAEw"]
[Mon Mar 30 01:02:49.188635 2026] [:error] [pid 32255:tid 32301] [client 20.65.118.88:12248] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-header.php"] [unique_id "aclbOWnfn-AtRoMbquxJ0wAAAEo"]
[Mon Mar 30 01:02:49.598084 2026] [:error] [pid 32255:tid 32296] [client 20.65.118.88:12236] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-header.php"] [unique_id "aclbOWnfn-AtRoMbquxJ1QAAAEU"]
[Mon Mar 30 01:02:50.120318 2026] [:error] [pid 32255:tid 32306] [client 20.65.118.88:12275] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aclbOmnfn-AtRoMbquxJ2AAAAE8"]
[Mon Mar 30 01:02:50.705908 2026] [:error] [pid 23250:tid 23272] [client 20.65.118.88:12252] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aclbOpxrpj-dQjy1cvoqiAAAAlQ"]
[Mon Mar 30 01:02:51.212656 2026] [:error] [pid 8818:tid 8838] [client 20.65.118.88:12251] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aclbOyCDvotZNSF0FBoNCgAAAVA"]
[Mon Mar 30 01:02:51.648625 2026] [:error] [pid 8818:tid 8833] [client 20.65.118.88:12285] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aclbOyCDvotZNSF0FBoNCwAAAUs"]
[Mon Mar 30 01:02:52.175651 2026] [:error] [pid 32254:tid 32272] [client 20.65.118.88:12267] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aclbPKug2IHuyGgCTn9xdwAAAAg"]
[Mon Mar 30 01:02:52.609066 2026] [:error] [pid 23284:tid 23307] [client 20.65.118.88:12247] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aclbPIzBujdPHsq7wyQxWwAAApU"]
[Mon Mar 30 01:02:53.070690 2026] [:error] [pid 32257:tid 32331] [client 20.65.118.88:12176] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aclbPSE3TArOFrUtgWq0qgAAAI0"]
[Mon Mar 30 01:02:53.492715 2026] [:error] [pid 23168:tid 23203] [client 20.65.118.88:12262] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aclbPWP8p0yRL8ot_2_i-AAAAgY"]
[Mon Mar 30 01:02:53.948341 2026] [:error] [pid 32257:tid 32328] [client 20.65.118.88:12101] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "aclbPSE3TArOFrUtgWq0rAAAAIo"]
[Mon Mar 30 01:02:54.393763 2026] [:error] [pid 32257:tid 32333] [client 20.65.118.88:12230] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "aclbPiE3TArOFrUtgWq0rgAAAI8"]
[Mon Mar 30 01:02:54.906007 2026] [:error] [pid 23284:tid 23292] [client 20.65.118.88:12173] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "aclbPozBujdPHsq7wyQxYAAAAoY"]
[Mon Mar 30 01:02:55.388249 2026] [:error] [pid 8818:tid 8836] [client 20.65.118.88:12207] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "aclbPyCDvotZNSF0FBoNEQAAAU4"]
[Mon Mar 30 01:02:55.893005 2026] [:error] [pid 8818:tid 8834] [client 20.65.118.88:12225] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "aclbPyCDvotZNSF0FBoNEwAAAUw"]
[Mon Mar 30 01:02:56.374857 2026] [:error] [pid 32255:tid 32301] [client 20.65.118.88:12268] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "aclbQGnfn-AtRoMbquxJ4AAAAEo"]
[Mon Mar 30 01:02:56.790632 2026] [:error] [pid 32255:tid 32306] [client 20.65.118.88:12174] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "aclbQGnfn-AtRoMbquxJ4gAAAE8"]
[Mon Mar 30 01:02:57.236182 2026] [:error] [pid 23168:tid 23212] [client 20.65.118.88:12260] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "aclbQWP8p0yRL8ot_2_i_gAAAg8"]
[Mon Mar 30 01:02:57.740460 2026] [:error] [pid 32257:tid 32331] [client 20.65.118.88:12183] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aclbQSE3TArOFrUtgWq0tQAAAI0"]
[Mon Mar 30 01:02:58.200412 2026] [:error] [pid 32257:tid 32328] [client 20.65.118.88:12250] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aclbQiE3TArOFrUtgWq0twAAAIo"]
[Mon Mar 30 01:02:58.684499 2026] [:error] [pid 8818:tid 8823] [client 20.65.118.88:12281] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aclbQiCDvotZNSF0FBoNFwAAAUE"]
[Mon Mar 30 01:02:59.137306 2026] [:error] [pid 23168:tid 23210] [client 20.65.118.88:12164] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aclbQ2P8p0yRL8ot_2_jAQAAAg0"]
[Mon Mar 30 01:02:59.634928 2026] [:error] [pid 23284:tid 23306] [client 20.65.118.88:12194] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2ksm17n.php"] [unique_id "aclbQ4zBujdPHsq7wyQxagAAApQ"]
[Mon Mar 30 01:03:00.120679 2026] [:error] [pid 23284:tid 23305] [client 20.65.118.88:12273] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2ksm17n.php"] [unique_id "aclbRIzBujdPHsq7wyQxbAAAApM"]
[Mon Mar 30 01:03:00.563277 2026] [:error] [pid 23284:tid 23296] [client 20.65.118.88:12096] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2ksm17n.php"] [unique_id "aclbRIzBujdPHsq7wyQxcwAAAoo"]
[Mon Mar 30 01:03:01.014499 2026] [:error] [pid 32257:tid 32324] [client 20.65.118.88:12279] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2ksm17n.php"] [unique_id "aclbRSE3TArOFrUtgWq0ugAAAIY"]
[Mon Mar 30 01:03:01.424662 2026] [:error] [pid 8818:tid 8839] [client 20.65.118.88:12269] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aclbRSCDvotZNSF0FBoNGAAAAVE"]
[Mon Mar 30 01:03:01.874491 2026] [:error] [pid 32255:tid 32291] [client 20.65.118.88:12244] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aclbRWnfn-AtRoMbquxJ7gAAAEA"]
[Mon Mar 30 01:03:02.390062 2026] [:error] [pid 32255:tid 32292] [client 20.65.118.88:12243] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aclbRmnfn-AtRoMbquxJ8QAAAEE"]
[Mon Mar 30 01:03:02.833508 2026] [:error] [pid 32255:tid 32312] [client 20.65.118.88:12280] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aclbRmnfn-AtRoMbquxJ8wAAAFU"]
[Mon Mar 30 01:03:04.319374 2026] [:error] [pid 23250:tid 23252] [client 20.65.118.88:12202] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hots.php"] [unique_id "aclbSJxrpj-dQjy1cvoqkgAAAkA"]
[Mon Mar 30 01:03:04.788548 2026] [:error] [pid 32257:tid 32337] [client 20.65.118.88:12264] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hots.php"] [unique_id "aclbSCE3TArOFrUtgWq0xAAAAJM"]
[Mon Mar 30 01:03:05.222468 2026] [:error] [pid 32257:tid 32340] [client 20.65.118.88:12242] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hots.php"] [unique_id "aclbSSE3TArOFrUtgWq0xwAAAJY"]
[Mon Mar 30 01:03:05.690602 2026] [:error] [pid 32359:tid 32369] [client 20.65.118.88:12191] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hots.php"] [unique_id "aclbSQMb8G3UzfQP3WhI-wAAAMg"]
[Mon Mar 30 01:03:06.759036 2026] [:error] [pid 23284:tid 23302] [client 20.65.118.88:12136] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "aclbSozBujdPHsq7wyQxdgAAApA"]
[Mon Mar 30 01:03:07.288092 2026] [:error] [pid 8818:tid 8846] [client 20.65.118.88:12234] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "aclbSyCDvotZNSF0FBoNIAAAAVg"]
[Mon Mar 30 01:03:07.809953 2026] [:error] [pid 23168:tid 23212] [client 20.65.118.88:12276] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "aclbS2P8p0yRL8ot_2_jBwAAAg8"]
[Mon Mar 30 01:03:08.236658 2026] [:error] [pid 23137:tid 23140] [client 20.65.118.88:12120] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "aclbTBaWQa7LdZ_qGFYbowAAAYE"]
[Mon Mar 30 01:03:08.671345 2026] [:error] [pid 32257:tid 32321] [client 20.65.118.88:12231] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aclbTCE3TArOFrUtgWq0ywAAAIM"]
[Mon Mar 30 01:03:09.132891 2026] [:error] [pid 23250:tid 23257] [client 20.65.118.88:12169] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aclbTZxrpj-dQjy1cvoqlQAAAkU"]
[Mon Mar 30 01:03:09.680173 2026] [:error] [pid 23168:tid 23207] [client 20.65.118.88:12186] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aclbTWP8p0yRL8ot_2_jCQAAAgo"]
[Mon Mar 30 01:03:10.092101 2026] [:error] [pid 23284:tid 23296] [client 20.65.118.88:12178] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aclbTozBujdPHsq7wyQxeQAAAoo"]
[Mon Mar 30 01:03:10.521039 2026] [:error] [pid 23284:tid 23299] [client 20.65.118.88:12161] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aclbTozBujdPHsq7wyQxegAAAo0"]
[Mon Mar 30 01:03:11.019219 2026] [:error] [pid 23284:tid 23287] [client 20.65.118.88:12119] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aclbT4zBujdPHsq7wyQxewAAAoE"]
[Mon Mar 30 01:03:11.492310 2026] [:error] [pid 32359:tid 32380] [client 20.65.118.88:12253] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aclbTwMb8G3UzfQP3WhJAQAAANM"]
[Mon Mar 30 01:03:11.973607 2026] [:error] [pid 32257:tid 32327] [client 20.65.118.88:12160] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aclbTyE3TArOFrUtgWq02AAAAIk"]
[Mon Mar 30 01:03:12.432738 2026] [:error] [pid 32257:tid 32335] [client 20.65.118.88:12100] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "aclbUCE3TArOFrUtgWq02wAAAJE"]
[Mon Mar 30 01:03:12.905769 2026] [:error] [pid 32257:tid 32324] [client 20.65.118.88:12102] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "aclbUCE3TArOFrUtgWq03gAAAIY"]
[Mon Mar 30 01:03:13.334038 2026] [:error] [pid 32257:tid 32339] [client 20.65.118.88:12238] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "aclbUSE3TArOFrUtgWq04AAAAJU"]
[Mon Mar 30 01:03:13.859978 2026] [:error] [pid 23137:tid 23154] [client 20.65.118.88:12193] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "aclbURaWQa7LdZ_qGFYbpwAAAY8"]
[Mon Mar 30 01:03:14.326486 2026] [:error] [pid 32359:tid 32368] [client 20.65.118.88:12171] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aclbUgMb8G3UzfQP3WhJBAAAAMc"]
[Mon Mar 30 01:03:14.768419 2026] [:error] [pid 32359:tid 32381] [client 20.65.118.88:12106] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aclbUgMb8G3UzfQP3WhJBQAAANQ"]
[Mon Mar 30 01:03:15.203628 2026] [:error] [pid 23137:tid 23162] [client 20.65.118.88:12216] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aclbUxaWQa7LdZ_qGFYbqwAAAZc"]
[Mon Mar 30 01:03:15.646264 2026] [:error] [pid 23137:tid 23157] [client 20.65.118.88:12167] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aclbUxaWQa7LdZ_qGFYbrgAAAZI"]
[Mon Mar 30 01:03:16.055623 2026] [:error] [pid 32255:tid 32291] [client 20.65.118.88:12255] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dass.php"] [unique_id "aclbVGnfn-AtRoMbquxJ_wAAAEA"]
[Mon Mar 30 01:03:16.502289 2026] [:error] [pid 32359:tid 32373] [client 20.65.118.88:12177] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dass.php"] [unique_id "aclbVAMb8G3UzfQP3WhJCQAAAMw"]
[Mon Mar 30 01:03:16.912301 2026] [:error] [pid 32359:tid 32367] [client 20.65.118.88:12126] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dass.php"] [unique_id "aclbVAMb8G3UzfQP3WhJCwAAAMY"]
[Mon Mar 30 01:03:17.353811 2026] [:error] [pid 32359:tid 32374] [client 20.65.118.88:12189] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dass.php"] [unique_id "aclbVQMb8G3UzfQP3WhJDAAAAM0"]
[Mon Mar 30 01:03:17.812774 2026] [:error] [pid 32254:tid 32268] [client 20.65.118.88:12214] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aclbVaug2IHuyGgCTn9xegAAAAQ"]
[Mon Mar 30 01:03:18.233929 2026] [:error] [pid 23168:tid 23220] [client 20.65.118.88:12277] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aclbVmP8p0yRL8ot_2_jDgAAAhc"]
[Mon Mar 30 01:03:18.639232 2026] [:error] [pid 23168:tid 23201] [client 20.65.118.88:12233] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aclbVmP8p0yRL8ot_2_jEQAAAgQ"]
[Mon Mar 30 01:03:19.101001 2026] [:error] [pid 23167:tid 23182] [client 20.65.118.88:12109] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aclbVxIAHJCFaHff3_f3WAAAAcw"]
[Mon Mar 30 01:03:19.621166 2026] [:error] [pid 23137:tid 23140] [client 20.65.118.88:12210] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws83.php"] [unique_id "aclbVxaWQa7LdZ_qGFYbtAAAAYE"]
[Mon Mar 30 01:03:20.075546 2026] [:error] [pid 32257:tid 32331] [client 20.65.118.88:12215] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws83.php"] [unique_id "aclbWCE3TArOFrUtgWq06wAAAI0"]
[Mon Mar 30 01:03:20.628458 2026] [:error] [pid 23250:tid 23262] [client 20.65.118.88:12245] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws83.php"] [unique_id "aclbWJxrpj-dQjy1cvoqnwAAAko"]
[Mon Mar 30 01:03:21.103837 2026] [:error] [pid 32359:tid 32371] [client 20.65.118.88:12257] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws83.php"] [unique_id "aclbWQMb8G3UzfQP3WhJEAAAAMo"]
[Mon Mar 30 01:03:21.539563 2026] [:error] [pid 32359:tid 32372] [client 20.65.118.88:12228] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/56c53.php"] [unique_id "aclbWQMb8G3UzfQP3WhJEwAAAMs"]
[Mon Mar 30 01:03:21.962360 2026] [:error] [pid 32255:tid 32309] [client 20.65.118.88:12254] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/56c53.php"] [unique_id "aclbWWnfn-AtRoMbquxKBAAAAFI"]
[Mon Mar 30 01:03:22.402811 2026] [:error] [pid 32255:tid 32292] [client 20.65.118.88:12190] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/56c53.php"] [unique_id "aclbWmnfn-AtRoMbquxKBQAAAEE"]
[Mon Mar 30 01:03:22.863272 2026] [:error] [pid 32257:tid 32333] [client 20.65.118.88:12226] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/56c53.php"] [unique_id "aclbWiE3TArOFrUtgWq07wAAAI8"]
[Mon Mar 30 01:03:23.296017 2026] [:error] [pid 32257:tid 32319] [client 20.65.118.88:12270] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aclbWyE3TArOFrUtgWq08QAAAIE"]
[Mon Mar 30 01:03:23.727354 2026] [:error] [pid 23167:tid 23180] [client 20.65.118.88:12180] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aclbWxIAHJCFaHff3_f3WwAAAco"]
[Mon Mar 30 01:03:24.179532 2026] [:error] [pid 23168:tid 23204] [client 20.65.118.88:12213] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aclbXGP8p0yRL8ot_2_jGQAAAgc"]
[Mon Mar 30 01:03:24.654951 2026] [:error] [pid 23168:tid 23197] [client 20.65.118.88:12265] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aclbXGP8p0yRL8ot_2_jGgAAAgA"]
[Mon Mar 30 01:03:25.320554 2026] [:error] [pid 32257:tid 32320] [client 20.65.118.88:12224] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "aclbXSE3TArOFrUtgWq09gAAAII"]
[Mon Mar 30 01:03:25.830182 2026] [:error] [pid 32254:tid 32280] [client 20.65.118.88:12237] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "aclbXaug2IHuyGgCTn9xfgAAABA"]
[Mon Mar 30 01:03:26.258779 2026] [:error] [pid 23250:tid 23271] [client 20.65.118.88:12198] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "aclbXpxrpj-dQjy1cvoqpQAAAlM"]
[Mon Mar 30 01:03:26.731808 2026] [:error] [pid 32257:tid 32325] [client 20.65.118.88:12200] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "aclbXiE3TArOFrUtgWq0-wAAAIc"]
[Mon Mar 30 01:03:27.700449 2026] [:error] [pid 23284:tid 23287] [client 20.65.118.88:12143] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "aclbX4zBujdPHsq7wyQxjQAAAoE"]
[Mon Mar 30 01:03:28.471418 2026] [:error] [pid 32257:tid 32328] [client 20.65.118.88:12204] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "aclbYCE3TArOFrUtgWq0_gAAAIo"]
[Mon Mar 30 01:03:28.929582 2026] [:error] [pid 23284:tid 23298] [client 20.65.118.88:12142] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "aclbYIzBujdPHsq7wyQxkAAAAow"]
[Mon Mar 30 01:03:29.413394 2026] [:error] [pid 32254:tid 32275] [client 20.65.118.88:12107] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "aclbYaug2IHuyGgCTn9xggAAAAs"]
[Mon Mar 30 01:03:30.091653 2026] [:error] [pid 23250:tid 23260] [client 20.65.118.88:12140] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "aclbYpxrpj-dQjy1cvoqrQAAAkg"]
[Mon Mar 30 01:03:30.579973 2026] [:error] [pid 32359:tid 32363] [client 20.65.118.88:12166] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "aclbYgMb8G3UzfQP3WhJFgAAAMI"]
[Mon Mar 30 01:03:31.066570 2026] [:error] [pid 23137:tid 23162] [client 20.65.118.88:12137] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "aclbYxaWQa7LdZ_qGFYbwgAAAZc"]
[Mon Mar 30 01:03:31.584283 2026] [:error] [pid 23137:tid 23150] [client 20.65.118.88:12203] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "aclbYxaWQa7LdZ_qGFYbxAAAAYs"]
[Mon Mar 30 01:03:32.173734 2026] [:error] [pid 32254:tid 32278] [client 20.65.118.88:12182] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "aclbZKug2IHuyGgCTn9xhwAAAA4"]
[Mon Mar 30 01:03:32.652583 2026] [:error] [pid 32359:tid 32383] [client 20.65.118.88:12131] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "aclbZAMb8G3UzfQP3WhJGwAAANY"]
[Mon Mar 30 01:03:33.205976 2026] [:error] [pid 32359:tid 32382] [client 20.65.118.88:12108] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "aclbZQMb8G3UzfQP3WhJHAAAANU"]
[Mon Mar 30 01:03:33.757524 2026] [:error] [pid 32255:tid 32298] [client 20.65.118.88:12218] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "aclbZWnfn-AtRoMbquxKEAAAAEc"]
[Mon Mar 30 01:03:34.189468 2026] [:error] [pid 32254:tid 32269] [client 20.65.118.88:11916] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aclbZqug2IHuyGgCTn9xkwAAAAU"]
[Mon Mar 30 01:03:34.627986 2026] [:error] [pid 32257:tid 32325] [client 20.65.118.88:12240] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aclbZiE3TArOFrUtgWq1BQAAAIc"]
[Mon Mar 30 01:03:35.052721 2026] [:error] [pid 23284:tid 23296] [client 20.65.118.88:12197] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aclbZ4zBujdPHsq7wyQxmAAAAoo"]
[Mon Mar 30 01:03:35.514168 2026] [:error] [pid 23284:tid 23294] [client 20.65.118.88:12205] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "aclbZ4zBujdPHsq7wyQxmgAAAog"]
[Mon Mar 30 01:03:35.974213 2026] [:error] [pid 23284:tid 23286] [client 20.65.118.88:12266] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "aclbZ4zBujdPHsq7wyQxnAAAAoA"]
[Mon Mar 30 01:03:36.417408 2026] [:error] [pid 23284:tid 23292] [client 20.65.118.88:11913] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "aclbaIzBujdPHsq7wyQxoAAAAoY"]
[Mon Mar 30 01:03:36.858375 2026] [:error] [pid 23137:tid 23148] [client 20.65.118.88:12159] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "aclbaBaWQa7LdZ_qGFYbzAAAAYk"]
[Mon Mar 30 01:03:37.306883 2026] [:error] [pid 23168:tid 23200] [client 20.65.118.88:12123] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "aclbaWP8p0yRL8ot_2_jIAAAAgM"]
[Mon Mar 30 01:03:37.799202 2026] [:error] [pid 23168:tid 23197] [client 20.65.118.88:12175] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "aclbaWP8p0yRL8ot_2_jJAAAAgA"]
[Mon Mar 30 01:03:38.272061 2026] [:error] [pid 23137:tid 23144] [client 20.65.118.88:12116] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "aclbahaWQa7LdZ_qGFYbzQAAAYU"]
[Mon Mar 30 01:03:38.750847 2026] [:error] [pid 23284:tid 23309] [client 20.65.118.88:12220] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "aclbaozBujdPHsq7wyQxqQAAApc"]
[Mon Mar 30 01:03:39.164015 2026] [:error] [pid 23284:tid 23287] [client 20.65.118.88:11928] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "aclba4zBujdPHsq7wyQxrAAAAoE"]
[Mon Mar 30 01:03:39.588901 2026] [:error] [pid 23168:tid 23199] [client 20.65.118.88:12188] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx78.php"] [unique_id "aclba2P8p0yRL8ot_2_jKAAAAgI"]
[Mon Mar 30 01:03:40.052094 2026] [:error] [pid 23168:tid 23212] [client 20.65.118.88:12261] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx78.php"] [unique_id "aclbbGP8p0yRL8ot_2_jKQAAAg8"]
[Mon Mar 30 01:03:40.474953 2026] [:error] [pid 32255:tid 32305] [client 20.65.118.88:11920] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx78.php"] [unique_id "aclbbGnfn-AtRoMbquxKGAAAAE4"]
[Mon Mar 30 01:03:40.899396 2026] [:error] [pid 32255:tid 32291] [client 20.65.118.88:12163] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx78.php"] [unique_id "aclbbGnfn-AtRoMbquxKGgAAAEA"]
[Mon Mar 30 01:03:41.331118 2026] [:error] [pid 23168:tid 23217] [client 20.65.118.88:12149] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Sanskrit.php"] [unique_id "aclbbWP8p0yRL8ot_2_jLQAAAhQ"]
[Mon Mar 30 01:03:41.767796 2026] [:error] [pid 32257:tid 32322] [client 20.65.118.88:12286] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Sanskrit.php"] [unique_id "aclbbSE3TArOFrUtgWq1DwAAAIQ"]
[Mon Mar 30 01:03:42.219146 2026] [:error] [pid 32255:tid 32307] [client 20.65.118.88:12208] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Sanskrit.php"] [unique_id "aclbbmnfn-AtRoMbquxKHAAAAFA"]
[Mon Mar 30 01:03:42.625134 2026] [:error] [pid 32257:tid 32335] [client 20.65.118.88:12168] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Sanskrit.php"] [unique_id "aclbbiE3TArOFrUtgWq1FAAAAJE"]
[Mon Mar 30 01:03:51.968735 2026] [:error] [pid 32255:tid 32310] [client 20.65.118.88:12274] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws75.php"] [unique_id "aclbd2nfn-AtRoMbquxKNgAAAFM"]
[Mon Mar 30 01:03:52.529624 2026] [:error] [pid 23284:tid 23308] [client 20.65.118.88:11910] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws75.php"] [unique_id "aclbeIzBujdPHsq7wyQxygAAApY"]
[Mon Mar 30 01:03:53.008669 2026] [:error] [pid 32255:tid 32313] [client 20.65.118.88:12129] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws75.php"] [unique_id "aclbeWnfn-AtRoMbquxKOQAAAFY"]
[Mon Mar 30 01:03:53.439123 2026] [:error] [pid 32255:tid 32302] [client 20.65.118.88:12284] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws75.php"] [unique_id "aclbeWnfn-AtRoMbquxKPAAAAEs"]
[Mon Mar 30 01:03:53.867965 2026] [:error] [pid 23168:tid 23209] [client 20.65.118.88:12098] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aclbeWP8p0yRL8ot_2_jQQAAAgw"]
[Mon Mar 30 01:03:54.427754 2026] [:error] [pid 23167:tid 23182] [client 20.65.118.88:11939] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aclbehIAHJCFaHff3_f3YwAAAcw"]
[Mon Mar 30 01:03:54.947080 2026] [:error] [pid 32257:tid 32338] [client 20.65.118.88:12170] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aclbeiE3TArOFrUtgWq1WQAAAJQ"]
[Mon Mar 30 01:03:55.425865 2026] [:error] [pid 23167:tid 23192] [client 20.65.118.88:12192] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "aclbexIAHJCFaHff3_f3ZQAAAdY"]
[Mon Mar 30 01:03:55.860982 2026] [:error] [pid 23284:tid 23287] [client 20.65.118.88:12099] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maul.php"] [unique_id "aclbe4zBujdPHsq7wyQxzwAAAoE"]
[Mon Mar 30 01:03:56.268858 2026] [:error] [pid 8818:tid 8841] [client 20.65.118.88:12117] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maul.php"] [unique_id "aclbfCCDvotZNSF0FBoNOwAAAVM"]
[Mon Mar 30 01:03:56.708468 2026] [:error] [pid 32255:tid 32300] [client 20.65.118.88:12179] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maul.php"] [unique_id "aclbfGnfn-AtRoMbquxKTAAAAEk"]
[Mon Mar 30 01:03:57.129247 2026] [:error] [pid 32359:tid 32374] [client 20.65.118.88:12184] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maul.php"] [unique_id "aclbfQMb8G3UzfQP3WhJJwAAAM0"]
[Mon Mar 30 01:03:57.639655 2026] [:error] [pid 32257:tid 32322] [client 20.65.118.88:12187] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lowpr.php"] [unique_id "aclbfSE3TArOFrUtgWq1aAAAAIQ"]
[Mon Mar 30 01:03:58.083906 2026] [:error] [pid 32257:tid 32336] [client 20.65.118.88:11930] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lowpr.php"] [unique_id "aclbfiE3TArOFrUtgWq1awAAAJI"]
[Mon Mar 30 01:03:58.503809 2026] [:error] [pid 32255:tid 32301] [client 20.65.118.88:12132] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lowpr.php"] [unique_id "aclbfmnfn-AtRoMbquxKUAAAAEo"]
[Mon Mar 30 01:03:58.924945 2026] [:error] [pid 32257:tid 32323] [client 20.65.118.88:12111] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lowpr.php"] [unique_id "aclbfiE3TArOFrUtgWq1dAAAAIU"]
[Mon Mar 30 01:03:59.348865 2026] [:error] [pid 32257:tid 32334] [client 20.65.118.88:12112] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "aclbfyE3TArOFrUtgWq1eAAAAJA"]
[Mon Mar 30 01:03:59.787048 2026] [:error] [pid 8818:tid 8844] [client 20.65.118.88:12146] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "aclbfyCDvotZNSF0FBoNPwAAAVY"]
[Mon Mar 30 01:04:00.492496 2026] [:error] [pid 23284:tid 23297] [client 20.65.118.88:12172] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "aclbgIzBujdPHsq7wyQx3wAAAos"]
[Mon Mar 30 01:04:01.027502 2026] [:error] [pid 23168:tid 23210] [client 20.65.118.88:12219] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "aclbgWP8p0yRL8ot_2_jQwAAAg0"]
[Mon Mar 30 01:04:01.476199 2026] [:error] [pid 32359:tid 32378] [client 20.65.118.88:12151] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/166.php"] [unique_id "aclbgQMb8G3UzfQP3WhJLAAAANE"]
[Mon Mar 30 01:04:01.888143 2026] [:error] [pid 23168:tid 23219] [client 20.65.118.88:12110] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/166.php"] [unique_id "aclbgWP8p0yRL8ot_2_jRQAAAhY"]
[Mon Mar 30 01:04:02.379705 2026] [:error] [pid 23137:tid 23154] [client 20.65.118.88:12195] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/166.php"] [unique_id "aclbghaWQa7LdZ_qGFYb1gAAAY8"]
[Mon Mar 30 01:04:02.808024 2026] [:error] [pid 23168:tid 23202] [client 20.65.118.88:12115] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/166.php"] [unique_id "aclbgmP8p0yRL8ot_2_jRwAAAgU"]
[Mon Mar 30 01:04:03.306949 2026] [:error] [pid 23167:tid 23190] [client 20.65.118.88:12263] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "aclbgxIAHJCFaHff3_f3aQAAAdQ"]
[Mon Mar 30 01:04:03.726357 2026] [:error] [pid 23167:tid 23180] [client 20.65.118.88:12217] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "aclbgxIAHJCFaHff3_f3agAAAco"]
[Mon Mar 30 01:04:04.213832 2026] [:error] [pid 8818:tid 8830] [client 20.65.118.88:12127] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "aclbhCCDvotZNSF0FBoNQwAAAUg"]
[Mon Mar 30 01:04:04.683113 2026] [:error] [pid 8818:tid 8831] [client 20.65.118.88:11904] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "aclbhCCDvotZNSF0FBoNRAAAAUk"]
[Mon Mar 30 01:04:05.129724 2026] [:error] [pid 32255:tid 32303] [client 20.65.118.88:12154] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "aclbhWnfn-AtRoMbquxKXQAAAEw"]
[Mon Mar 30 01:04:05.591509 2026] [:error] [pid 23284:tid 23298] [client 20.65.118.88:12229] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "aclbhYzBujdPHsq7wyQx6gAAAow"]
[Mon Mar 30 01:04:06.153488 2026] [:error] [pid 32257:tid 32336] [client 20.65.118.88:12130] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "aclbhiE3TArOFrUtgWq1mwAAAJI"]
[Mon Mar 30 01:04:06.650394 2026] [:error] [pid 32257:tid 32333] [client 20.65.118.88:12139] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "aclbhiE3TArOFrUtgWq1oQAAAI8"]
[Mon Mar 30 01:04:07.135467 2026] [:error] [pid 32257:tid 32339] [client 20.65.118.88:12147] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aclbhyE3TArOFrUtgWq1qQAAAJU"]
[Mon Mar 30 01:04:07.600172 2026] [:error] [pid 32257:tid 32335] [client 20.65.118.88:12227] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aclbhyE3TArOFrUtgWq1qwAAAJE"]
[Mon Mar 30 01:04:08.043126 2026] [:error] [pid 32359:tid 32365] [client 20.65.118.88:12259] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aclbiAMb8G3UzfQP3WhJMgAAAMQ"]
[Mon Mar 30 01:04:08.549376 2026] [:error] [pid 23284:tid 23288] [client 20.65.118.88:12124] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aclbiIzBujdPHsq7wyQx7QAAAoI"]
[Mon Mar 30 01:04:09.017560 2026] [:error] [pid 23284:tid 23303] [client 20.65.118.88:12138] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hehe.php"] [unique_id "aclbiYzBujdPHsq7wyQx7wAAApE"]
[Mon Mar 30 01:04:09.497225 2026] [:error] [pid 32255:tid 32304] [client 20.65.118.88:12249] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hehe.php"] [unique_id "aclbiWnfn-AtRoMbquxKZgAAAE0"]
[Mon Mar 30 01:04:09.926811 2026] [:error] [pid 32255:tid 32301] [client 20.65.118.88:11912] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hehe.php"] [unique_id "aclbiWnfn-AtRoMbquxKaQAAAEo"]
[Mon Mar 30 01:04:10.371022 2026] [:error] [pid 32257:tid 32341] [client 20.65.118.88:11926] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hehe.php"] [unique_id "aclbiiE3TArOFrUtgWq1tgAAAJc"]
[Mon Mar 30 01:04:10.866842 2026] [:error] [pid 32255:tid 32303] [client 20.65.118.88:12145] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "aclbimnfn-AtRoMbquxKbwAAAEw"]
[Mon Mar 30 01:04:11.364841 2026] [:error] [pid 32255:tid 32308] [client 20.65.118.88:12162] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "aclbi2nfn-AtRoMbquxKcgAAAFE"]
[Mon Mar 30 01:04:11.891821 2026] [:error] [pid 32255:tid 32300] [client 20.65.118.88:12128] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "aclbi2nfn-AtRoMbquxKdAAAAEk"]
[Mon Mar 30 01:04:12.299268 2026] [:error] [pid 23167:tid 23193] [client 20.65.118.88:12158] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "aclbjBIAHJCFaHff3_f3bAAAAdc"]
[Mon Mar 30 01:04:12.819491 2026] [:error] [pid 23137:tid 23149] [client 20.65.118.88:11958] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ne2026.php"] [unique_id "aclbjBaWQa7LdZ_qGFYb3QAAAYo"]
[Mon Mar 30 01:04:13.221490 2026] [:error] [pid 23167:tid 23170] [client 20.65.118.88:12153] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ne2026.php"] [unique_id "aclbjRIAHJCFaHff3_f3bQAAAcA"]
[Mon Mar 30 01:04:13.654767 2026] [:error] [pid 23167:tid 23171] [client 20.65.118.88:12104] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ne2026.php"] [unique_id "aclbjRIAHJCFaHff3_f3bgAAAcE"]
[Mon Mar 30 01:04:14.088040 2026] [:error] [pid 23167:tid 23177] [client 20.65.118.88:11919] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ne2026.php"] [unique_id "aclbjhIAHJCFaHff3_f3bwAAAcc"]
[Mon Mar 30 01:04:14.603001 2026] [:error] [pid 23250:tid 23254] [client 20.65.118.88:12122] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "aclbjpxrpj-dQjy1cvoqwwAAAkI"]
[Mon Mar 30 01:04:15.053039 2026] [:error] [pid 32255:tid 32297] [client 20.65.118.88:11589] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "aclbj2nfn-AtRoMbquxKeQAAAEY"]
[Mon Mar 30 01:04:15.472570 2026] [:error] [pid 32255:tid 32314] [client 20.65.118.88:11588] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "aclbj2nfn-AtRoMbquxKfAAAAFc"]
[Mon Mar 30 01:04:15.931814 2026] [:error] [pid 23284:tid 23303] [client 20.65.118.88:12209] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "aclbj4zBujdPHsq7wyQx-QAAApE"]
[Mon Mar 30 01:04:16.419311 2026] [:error] [pid 23137:tid 23142] [client 20.65.118.88:11623] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "aclbkBaWQa7LdZ_qGFYb4QAAAYM"]
[Mon Mar 30 01:04:17.022569 2026] [:error] [pid 23250:tid 23262] [client 20.65.118.88:11949] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "aclbkZxrpj-dQjy1cvoqxQAAAko"]
[Mon Mar 30 01:04:17.649702 2026] [:error] [pid 8818:tid 8830] [client 20.65.118.88:12223] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "aclbkSCDvotZNSF0FBoNUAAAAUg"]
[Mon Mar 30 01:04:18.206483 2026] [:error] [pid 23284:tid 23299] [client 20.65.118.88:11937] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "aclbkozBujdPHsq7wyQx_wAAAo0"]
[Mon Mar 30 01:04:18.706779 2026] [:error] [pid 23284:tid 23309] [client 20.65.118.88:12181] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "aclbkozBujdPHsq7wyQyBQAAApc"]
[Mon Mar 30 01:04:19.341576 2026] [:error] [pid 23167:tid 23173] [client 20.65.118.88:12256] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "aclbkxIAHJCFaHff3_f3cwAAAcM"]
[Mon Mar 30 01:04:19.839890 2026] [:error] [pid 23167:tid 23184] [client 20.65.118.88:12134] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "aclbkxIAHJCFaHff3_f3dQAAAc4"]
[Mon Mar 30 01:04:20.385585 2026] [:error] [pid 23167:tid 23175] [client 20.65.118.88:11934] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "aclblBIAHJCFaHff3_f3eQAAAcU"]
[Mon Mar 30 01:04:20.839128 2026] [:error] [pid 32257:tid 32342] [client 20.65.118.88:11923] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aclblCE3TArOFrUtgWq1vgAAAJg"]
[Mon Mar 30 01:04:21.325418 2026] [:error] [pid 32257:tid 32318] [client 20.65.118.88:12125] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aclblSE3TArOFrUtgWq1wAAAAIA"]
[Mon Mar 30 01:04:21.866583 2026] [:error] [pid 23167:tid 23171] [client 20.65.118.88:12113] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aclblRIAHJCFaHff3_f3fgAAAcE"]
[Mon Mar 30 01:04:22.287752 2026] [:error] [pid 23167:tid 23186] [client 20.65.118.88:11964] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aclblhIAHJCFaHff3_f3gAAAAdA"]
[Mon Mar 30 01:04:22.731787 2026] [:error] [pid 23284:tid 23302] [client 20.65.118.88:11584] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "aclblozBujdPHsq7wyQyFgAAApA"]
[Mon Mar 30 01:04:23.244596 2026] [:error] [pid 8818:tid 8841] [client 20.65.118.88:11955] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "aclblyCDvotZNSF0FBoNUgAAAVM"]
[Mon Mar 30 01:04:23.655479 2026] [:error] [pid 32257:tid 32339] [client 20.65.118.88:12235] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "aclblyE3TArOFrUtgWq1xgAAAJU"]
[Mon Mar 30 01:04:24.302889 2026] [:error] [pid 32257:tid 32329] [client 20.65.118.88:11945] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "aclbmCE3TArOFrUtgWq1ygAAAIs"]
[Mon Mar 30 01:04:24.715830 2026] [:error] [pid 23167:tid 23179] [client 20.65.118.88:11917] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "aclbmBIAHJCFaHff3_f3iAAAAck"]
[Mon Mar 30 01:04:25.164786 2026] [:error] [pid 32257:tid 32334] [client 20.65.118.88:11946] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "aclbmSE3TArOFrUtgWq1ywAAAJA"]
[Mon Mar 30 01:04:25.583707 2026] [:error] [pid 23284:tid 23294] [client 20.65.118.88:11908] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "aclbmYzBujdPHsq7wyQyIQAAAog"]
[Mon Mar 30 01:04:25.986035 2026] [:error] [pid 23284:tid 23297] [client 20.65.118.88:12221] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "aclbmYzBujdPHsq7wyQyJQAAAos"]
[Mon Mar 30 01:04:26.401704 2026] [:error] [pid 23284:tid 23296] [client 20.65.118.88:11615] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aclbmozBujdPHsq7wyQyKgAAAoo"]
[Mon Mar 30 01:04:26.837835 2026] [:error] [pid 23250:tid 23272] [client 20.65.118.88:11590] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aclbmpxrpj-dQjy1cvoqyAAAAlQ"]
[Mon Mar 30 01:04:27.291825 2026] [:error] [pid 32254:tid 32269] [client 20.65.118.88:11922] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aclbm6ug2IHuyGgCTn9xuQAAAAU"]
[Mon Mar 30 01:04:27.703281 2026] [:error] [pid 23168:tid 23219] [client 20.65.118.88:11680] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aclbm2P8p0yRL8ot_2_jUAAAAhY"]
[Mon Mar 30 01:04:28.119243 2026] [:error] [pid 32254:tid 32267] [client 20.65.118.88:11938] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5e0a.php"] [unique_id "aclbnKug2IHuyGgCTn9xvAAAAAM"]
[Mon Mar 30 01:04:28.556276 2026] [:error] [pid 8818:tid 8835] [client 20.65.118.88:11966] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5e0a.php"] [unique_id "aclbnCCDvotZNSF0FBoNVgAAAU0"]
[Mon Mar 30 01:04:28.956314 2026] [:error] [pid 23284:tid 23309] [client 20.65.118.88:12152] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5e0a.php"] [unique_id "aclbnIzBujdPHsq7wyQyMQAAApc"]
[Mon Mar 30 01:04:29.388889 2026] [:error] [pid 32257:tid 32330] [client 20.65.118.88:12212] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5e0a.php"] [unique_id "aclbnSE3TArOFrUtgWq12AAAAIw"]
[Mon Mar 30 01:04:29.908436 2026] [:error] [pid 32257:tid 32323] [client 20.65.118.88:11954] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/term.php"] [unique_id "aclbnSE3TArOFrUtgWq13AAAAIU"]
[Mon Mar 30 01:04:30.384046 2026] [:error] [pid 32257:tid 32320] [client 20.65.118.88:11944] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/term.php"] [unique_id "aclbniE3TArOFrUtgWq14wAAAII"]
[Mon Mar 30 01:04:30.856092 2026] [:error] [pid 32257:tid 32330] [client 20.65.118.88:12196] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/term.php"] [unique_id "aclbniE3TArOFrUtgWq16QAAAIw"]
[Mon Mar 30 01:04:31.266166 2026] [:error] [pid 8818:tid 8840] [client 20.65.118.88:11957] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/term.php"] [unique_id "aclbnyCDvotZNSF0FBoNWQAAAVI"]
[Mon Mar 30 01:04:31.729028 2026] [:error] [pid 23284:tid 23294] [client 20.65.118.88:11927] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aclbn4zBujdPHsq7wyQyNQAAAog"]
[Mon Mar 30 01:04:32.153824 2026] [:error] [pid 23167:tid 23182] [client 20.65.118.88:12222] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aclboBIAHJCFaHff3_f3jAAAAcw"]
[Mon Mar 30 01:04:32.560832 2026] [:error] [pid 23167:tid 23185] [client 20.65.118.88:12150] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aclboBIAHJCFaHff3_f3jQAAAc8"]
[Mon Mar 30 01:04:32.980133 2026] [:error] [pid 23167:tid 23191] [client 20.65.118.88:12283] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aclboBIAHJCFaHff3_f3kQAAAdU"]
[Mon Mar 30 01:04:33.393577 2026] [:error] [pid 32257:tid 32321] [client 20.65.118.88:11617] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/55b76.php"] [unique_id "aclboSE3TArOFrUtgWq1_gAAAIM"]
[Mon Mar 30 01:04:33.908445 2026] [:error] [pid 23250:tid 23256] [client 20.65.118.88:11956] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/55b76.php"] [unique_id "aclboZxrpj-dQjy1cvoqzAAAAkQ"]
[Mon Mar 30 01:04:34.328158 2026] [:error] [pid 32257:tid 32325] [client 20.65.118.88:11914] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/55b76.php"] [unique_id "aclboiE3TArOFrUtgWq2BQAAAIc"]
[Mon Mar 30 01:04:34.783156 2026] [:error] [pid 23250:tid 23262] [client 20.65.118.88:11932] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/55b76.php"] [unique_id "aclbopxrpj-dQjy1cvoqzQAAAko"]
[Mon Mar 30 01:04:35.185519 2026] [:error] [pid 23168:tid 23208] [client 20.65.118.88:12121] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd.php"] [unique_id "aclbo2P8p0yRL8ot_2_jVwAAAgs"]
[Mon Mar 30 01:04:35.585519 2026] [:error] [pid 32257:tid 32332] [client 20.65.118.88:11967] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd.php"] [unique_id "aclboyE3TArOFrUtgWq2DwAAAI4"]
[Mon Mar 30 01:04:36.018297 2026] [:error] [pid 32257:tid 32325] [client 20.65.118.88:11592] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd.php"] [unique_id "aclbpCE3TArOFrUtgWq2EgAAAIc"]
[Mon Mar 30 01:04:36.425882 2026] [:error] [pid 32257:tid 32330] [client 20.65.118.88:12103] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd.php"] [unique_id "aclbpCE3TArOFrUtgWq2FAAAAIw"]
[Mon Mar 30 01:04:36.838772 2026] [:error] [pid 23168:tid 23198] [client 20.65.118.88:12246] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aclbpGP8p0yRL8ot_2_jWQAAAgE"]
[Mon Mar 30 01:04:37.293630 2026] [:error] [pid 23167:tid 23190] [client 20.65.118.88:11625] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aclbpRIAHJCFaHff3_f3mQAAAdQ"]
[Mon Mar 30 01:04:37.783558 2026] [:error] [pid 23167:tid 23182] [client 20.65.118.88:11921] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aclbpRIAHJCFaHff3_f3mgAAAcw"]
[Mon Mar 30 01:04:38.218125 2026] [:error] [pid 23167:tid 23179] [client 20.65.118.88:11587] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aclbphIAHJCFaHff3_f3mwAAAck"]
[Mon Mar 30 01:04:38.675293 2026] [:error] [pid 8818:tid 8839] [client 20.65.118.88:12155] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aclbpiCDvotZNSF0FBoNYgAAAVE"]
[Mon Mar 30 01:04:39.101946 2026] [:error] [pid 32257:tid 32319] [client 20.65.118.88:12133] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aclbpyE3TArOFrUtgWq2JAAAAIE"]
[Mon Mar 30 01:04:39.517986 2026] [:error] [pid 32257:tid 32337] [client 20.65.118.88:12111] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aclbpyE3TArOFrUtgWq2JwAAAJM"]
[Mon Mar 30 01:04:40.053952 2026] [:error] [pid 23168:tid 23197] [client 20.65.118.88:11931] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aclbqGP8p0yRL8ot_2_jXAAAAgA"]
[Mon Mar 30 01:04:40.507297 2026] [:error] [pid 32257:tid 32320] [client 20.65.118.88:11688] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "aclbqCE3TArOFrUtgWq2LwAAAII"]
[Mon Mar 30 01:04:40.936706 2026] [:error] [pid 32257:tid 32339] [client 20.65.118.88:12185] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "aclbqCE3TArOFrUtgWq2MgAAAJU"]
[Mon Mar 30 01:04:41.390314 2026] [:error] [pid 23250:tid 23265] [client 20.65.118.88:11951] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "aclbqZxrpj-dQjy1cvoq1AAAAk0"]
[Mon Mar 30 01:04:41.812689 2026] [:error] [pid 23168:tid 23217] [client 20.65.118.88:11598] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "aclbqWP8p0yRL8ot_2_jZQAAAhQ"]
[Mon Mar 30 01:04:42.219484 2026] [:error] [pid 23167:tid 23176] [client 20.65.118.88:12105] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drhunthq.php"] [unique_id "aclbqhIAHJCFaHff3_f3nwAAAcY"]
[Mon Mar 30 01:04:42.680207 2026] [:error] [pid 23168:tid 23209] [client 20.65.118.88:11693] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drhunthq.php"] [unique_id "aclbqmP8p0yRL8ot_2_jbQAAAgw"]
[Mon Mar 30 01:04:43.151444 2026] [:error] [pid 32257:tid 32332] [client 20.65.118.88:11585] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drhunthq.php"] [unique_id "aclbqyE3TArOFrUtgWq2OAAAAI4"]
[Mon Mar 30 01:04:43.586385 2026] [:error] [pid 32255:tid 32296] [client 20.65.118.88:12211] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drhunthq.php"] [unique_id "aclbq2nfn-AtRoMbquxKkAAAAEU"]
[Mon Mar 30 01:04:44.063205 2026] [:error] [pid 23167:tid 23189] [client 20.65.118.88:11586] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/file.php"] [unique_id "aclbrBIAHJCFaHff3_f3oAAAAdM"]
[Mon Mar 30 01:04:44.477512 2026] [:error] [pid 23250:tid 23267] [client 20.65.118.88:11940] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/file.php"] [unique_id "aclbrJxrpj-dQjy1cvoq2AAAAk8"]
[Mon Mar 30 01:04:44.890565 2026] [:error] [pid 23168:tid 23220] [client 20.65.118.88:11652] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/file.php"] [unique_id "aclbrGP8p0yRL8ot_2_jbgAAAhc"]
[Mon Mar 30 01:04:45.341322 2026] [:error] [pid 23284:tid 23306] [client 20.65.118.88:11597] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/file.php"] [unique_id "aclbrYzBujdPHsq7wyQyOAAAApQ"]
[Mon Mar 30 01:04:45.805393 2026] [:error] [pid 23168:tid 23210] [client 20.65.118.88:11593] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxw.php"] [unique_id "aclbrWP8p0yRL8ot_2_jcwAAAg0"]
[Mon Mar 30 01:04:46.216562 2026] [:error] [pid 23137:tid 23144] [client 20.65.118.88:11947] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxw.php"] [unique_id "aclbrhaWQa7LdZ_qGFYb9QAAAYU"]
[Mon Mar 30 01:04:46.625834 2026] [:error] [pid 32255:tid 32299] [client 20.65.118.88:11960] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxw.php"] [unique_id "aclbrmnfn-AtRoMbquxKlQAAAEg"]
[Mon Mar 30 01:04:47.043353 2026] [:error] [pid 32257:tid 32342] [client 20.65.118.88:12114] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxw.php"] [unique_id "aclbryE3TArOFrUtgWq2RgAAAJg"]
[Mon Mar 30 01:04:47.469091 2026] [:error] [pid 23284:tid 23299] [client 20.65.118.88:11595] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "aclbr4zBujdPHsq7wyQyOwAAAo0"]
[Mon Mar 30 01:04:47.889349 2026] [:error] [pid 32359:tid 32365] [client 20.65.118.88:11965] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "aclbrwMb8G3UzfQP3WhJTAAAAMQ"]
[Mon Mar 30 01:04:48.310737 2026] [:error] [pid 32257:tid 32322] [client 20.65.118.88:11941] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "aclbsCE3TArOFrUtgWq2RwAAAIQ"]
[Mon Mar 30 01:04:48.734621 2026] [:error] [pid 32255:tid 32295] [client 20.65.118.88:12144] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "aclbsGnfn-AtRoMbquxKnAAAAEQ"]
[Mon Mar 30 01:04:49.204499 2026] [:error] [pid 23167:tid 23190] [client 20.65.118.88:11607] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "aclbsRIAHJCFaHff3_f3qgAAAdQ"]
[Mon Mar 30 01:04:49.652201 2026] [:error] [pid 23167:tid 23179] [client 20.65.118.88:11905] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "aclbsRIAHJCFaHff3_f3qwAAAck"]
[Mon Mar 30 01:04:50.099680 2026] [:error] [pid 23168:tid 23209] [client 20.65.118.88:11631] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "aclbsmP8p0yRL8ot_2_jdAAAAgw"]
[Mon Mar 30 01:04:50.534931 2026] [:error] [pid 32359:tid 32363] [client 20.65.118.88:11602] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "aclbsgMb8G3UzfQP3WhJUAAAAMI"]
[Mon Mar 30 01:04:50.963803 2026] [:error] [pid 32255:tid 32291] [client 20.65.118.88:12206] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lm15.php"] [unique_id "aclbsmnfn-AtRoMbquxKngAAAEA"]
[Mon Mar 30 01:05:00.580871 2026] [:error] [pid 32359:tid 32381] [client 20.65.118.88:11962] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "aclbvAMb8G3UzfQP3WhJYwAAANQ"]
[Mon Mar 30 01:05:01.023221 2026] [:error] [pid 8818:tid 8846] [client 20.65.118.88:11601] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "aclbvSCDvotZNSF0FBoNfgAAAVg"]
[Mon Mar 30 01:05:01.476131 2026] [:error] [pid 32257:tid 32323] [client 20.65.118.88:11906] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "aclbvSE3TArOFrUtgWq2VgAAAIU"]
[Mon Mar 30 01:05:01.917288 2026] [:error] [pid 32257:tid 32337] [client 20.65.118.88:11621] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "aclbvSE3TArOFrUtgWq2WQAAAJM"]
[Mon Mar 30 01:05:02.372768 2026] [:error] [pid 32257:tid 32332] [client 20.65.118.88:12201] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ajax.php"] [unique_id "aclbviE3TArOFrUtgWq2XQAAAI4"]
[Mon Mar 30 01:05:02.777042 2026] [:error] [pid 23137:tid 23161] [client 20.65.118.88:11943] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ajax.php"] [unique_id "aclbvhaWQa7LdZ_qGFYcBQAAAZY"]
[Mon Mar 30 01:05:03.243389 2026] [:error] [pid 23284:tid 23286] [client 20.65.118.88:11935] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ajax.php"] [unique_id "aclbv4zBujdPHsq7wyQyTQAAAoA"]
[Mon Mar 30 01:05:03.723965 2026] [:error] [pid 32254:tid 32276] [client 20.65.118.88:11644] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ajax.php"] [unique_id "aclbv6ug2IHuyGgCTn9xxgAAAAw"]
[Mon Mar 30 01:05:04.211629 2026] [:error] [pid 32255:tid 32311] [client 20.65.118.88:11909] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "aclbwGnfn-AtRoMbquxKrQAAAFQ"]
[Mon Mar 30 01:05:04.624242 2026] [:error] [pid 32257:tid 32327] [client 20.65.118.88:11610] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "aclbwCE3TArOFrUtgWq2ZwAAAIk"]
[Mon Mar 30 01:05:05.031366 2026] [:error] [pid 23284:tid 23290] [client 20.65.118.88:11936] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "aclbwYzBujdPHsq7wyQyVAAAAoQ"]
[Mon Mar 30 01:05:05.486086 2026] [:error] [pid 23284:tid 23293] [client 20.65.118.88:11925] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "aclbwYzBujdPHsq7wyQyVgAAAoc"]
[Mon Mar 30 01:05:05.937066 2026] [:error] [pid 32257:tid 32338] [client 20.65.118.88:11692] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aclbwSE3TArOFrUtgWq2bAAAAJQ"]
[Mon Mar 30 01:05:06.427363 2026] [:error] [pid 32359:tid 32365] [client 20.65.118.88:11630] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aclbwgMb8G3UzfQP3WhJZQAAAMQ"]
[Mon Mar 30 01:05:06.852339 2026] [:error] [pid 23284:tid 23298] [client 20.65.118.88:11632] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aclbwozBujdPHsq7wyQyWgAAAow"]
[Mon Mar 30 01:05:07.279639 2026] [:error] [pid 8818:tid 8826] [client 20.65.118.88:11599] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aclbwyCDvotZNSF0FBoNgQAAAUQ"]
[Mon Mar 30 01:05:07.719287 2026] [:error] [pid 32359:tid 32361] [client 20.65.118.88:11678] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aclbwwMb8G3UzfQP3WhJawAAAMA"]
[Mon Mar 30 01:05:08.152332 2026] [:error] [pid 23284:tid 23303] [client 20.65.118.88:11689] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aclbxIzBujdPHsq7wyQyWwAAApE"]
[Mon Mar 30 01:05:08.592438 2026] [:error] [pid 23167:tid 23171] [client 20.65.118.88:11666] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aclbxBIAHJCFaHff3_f3uwAAAcE"]
[Mon Mar 30 01:05:09.066878 2026] [:error] [pid 23284:tid 23306] [client 20.65.118.88:11918] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aclbxYzBujdPHsq7wyQyYQAAApQ"]
[Mon Mar 30 01:05:09.558493 2026] [:error] [pid 23284:tid 23300] [client 20.65.118.88:11673] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "aclbxYzBujdPHsq7wyQyZAAAAo4"]
[Mon Mar 30 01:05:10.022149 2026] [:error] [pid 23284:tid 23286] [client 20.65.118.88:12239] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "aclbxozBujdPHsq7wyQyaAAAAoA"]
[Mon Mar 30 01:05:10.449455 2026] [:error] [pid 23250:tid 23256] [client 20.65.118.88:11605] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "aclbxpxrpj-dQjy1cvoq5gAAAkQ"]
[Mon Mar 30 01:05:10.911184 2026] [:error] [pid 23284:tid 23300] [client 20.65.118.88:12156] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "aclbxozBujdPHsq7wyQybgAAAo4"]
[Mon Mar 30 01:05:11.385412 2026] [:error] [pid 32255:tid 32296] [client 20.65.118.88:11924] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws60.php"] [unique_id "aclbx2nfn-AtRoMbquxKsQAAAEU"]
[Mon Mar 30 01:05:11.852991 2026] [:error] [pid 23284:tid 23289] [client 20.65.118.88:12039] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws60.php"] [unique_id "aclbx4zBujdPHsq7wyQydwAAAoM"]
[Mon Mar 30 01:05:12.381374 2026] [:error] [pid 32254:tid 32281] [client 20.65.118.88:11596] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws60.php"] [unique_id "aclbyKug2IHuyGgCTn9xyQAAABE"]
[Mon Mar 30 01:05:12.844115 2026] [:error] [pid 32359:tid 32381] [client 20.65.118.88:12097] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws60.php"] [unique_id "aclbyAMb8G3UzfQP3WhJbwAAANQ"]
[Mon Mar 30 01:05:13.349410 2026] [:error] [pid 32257:tid 32337] [client 20.65.118.88:11948] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aclbySE3TArOFrUtgWq2bgAAAJM"]
[Mon Mar 30 01:05:13.799912 2026] [:error] [pid 32257:tid 32334] [client 20.65.118.88:11952] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aclbySE3TArOFrUtgWq2cQAAAJA"]
[Mon Mar 30 01:05:14.258839 2026] [:error] [pid 32257:tid 32336] [client 20.65.118.88:11933] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aclbyiE3TArOFrUtgWq2dQAAAJI"]
[Mon Mar 30 01:05:14.661769 2026] [:error] [pid 32257:tid 32330] [client 20.65.118.88:11594] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aclbyiE3TArOFrUtgWq2eAAAAIw"]
[Mon Mar 30 01:05:15.111724 2026] [:error] [pid 32257:tid 32322] [client 20.65.118.88:12148] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "aclbyyE3TArOFrUtgWq2fAAAAIQ"]
[Mon Mar 30 01:05:15.573944 2026] [:error] [pid 32257:tid 32321] [client 20.65.118.88:11907] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "aclbyyE3TArOFrUtgWq2fwAAAIM"]
[Mon Mar 30 01:05:16.009377 2026] [:error] [pid 32257:tid 32328] [client 20.65.118.88:11603] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "aclbzCE3TArOFrUtgWq2gAAAAIo"]
[Mon Mar 30 01:05:16.677399 2026] [:error] [pid 23168:tid 23215] [client 20.65.118.88:11613] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "aclbzGP8p0yRL8ot_2_jhQAAAhI"]
[Mon Mar 30 01:05:17.176159 2026] [:error] [pid 23168:tid 23211] [client 20.65.118.88:11648] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myfile.php"] [unique_id "aclbzWP8p0yRL8ot_2_jiAAAAg4"]
[Mon Mar 30 01:05:17.608865 2026] [:error] [pid 23284:tid 23310] [client 20.65.118.88:11655] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myfile.php"] [unique_id "aclbzYzBujdPHsq7wyQygQAAApg"]
[Mon Mar 30 01:05:18.150639 2026] [:error] [pid 32257:tid 32342] [client 20.65.118.88:11637] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myfile.php"] [unique_id "aclbziE3TArOFrUtgWq2iAAAAJg"]
[Mon Mar 30 01:05:18.734310 2026] [:error] [pid 32359:tid 32370] [client 20.65.118.88:11687] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myfile.php"] [unique_id "aclbzgMb8G3UzfQP3WhJdwAAAMk"]
[Mon Mar 30 01:05:19.265712 2026] [:error] [pid 32257:tid 32328] [client 20.65.118.88:12157] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aclbzyE3TArOFrUtgWq2jwAAAIo"]
[Mon Mar 30 01:05:19.695888 2026] [:error] [pid 23167:tid 23179] [client 20.65.118.88:11641] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aclbzxIAHJCFaHff3_f3wQAAAck"]
[Mon Mar 30 01:05:20.159456 2026] [:error] [pid 8818:tid 8839] [client 20.65.118.88:12126] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aclb0CCDvotZNSF0FBoNiAAAAVE"]
[Mon Mar 30 01:05:20.645126 2026] [:error] [pid 8818:tid 8833] [client 20.65.118.88:11624] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aclb0CCDvotZNSF0FBoNiQAAAUs"]
[Mon Mar 30 01:05:21.111486 2026] [:error] [pid 23284:tid 23301] [client 20.65.118.88:12043] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/okxh.php"] [unique_id "aclb0YzBujdPHsq7wyQyhQAAAo8"]
[Mon Mar 30 01:05:21.611853 2026] [:error] [pid 23168:tid 23212] [client 20.65.118.88:11959] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/okxh.php"] [unique_id "aclb0WP8p0yRL8ot_2_jkAAAAg8"]
[Mon Mar 30 01:05:22.036178 2026] [:error] [pid 23168:tid 23198] [client 20.65.118.88:11614] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/okxh.php"] [unique_id "aclb0mP8p0yRL8ot_2_jkwAAAgE"]
[Mon Mar 30 01:05:22.472933 2026] [:error] [pid 32257:tid 32336] [client 20.65.118.88:11639] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/okxh.php"] [unique_id "aclb0iE3TArOFrUtgWq2kgAAAJI"]
[Mon Mar 30 01:05:22.875781 2026] [:error] [pid 32255:tid 32300] [client 20.65.118.88:11660] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "aclb0mnfn-AtRoMbquxKtAAAAEk"]
[Mon Mar 30 01:05:23.304056 2026] [:error] [pid 23250:tid 23265] [client 20.65.118.88:11620] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "aclb05xrpj-dQjy1cvoq6wAAAk0"]
[Mon Mar 30 01:05:23.763970 2026] [:error] [pid 8818:tid 8842] [client 20.65.118.88:12141] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "aclb0yCDvotZNSF0FBoNjgAAAVQ"]
[Mon Mar 30 01:05:24.226985 2026] [:error] [pid 23168:tid 23213] [client 20.65.118.88:11657] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "aclb1GP8p0yRL8ot_2_jlwAAAhA"]
[Mon Mar 30 01:05:24.803222 2026] [:error] [pid 32255:tid 32302] [client 20.65.118.88:11633] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-104.php"] [unique_id "aclb1Gnfn-AtRoMbquxKuAAAAEs"]
[Mon Mar 30 01:05:25.307835 2026] [:error] [pid 32257:tid 32334] [client 20.65.118.88:11699] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-104.php"] [unique_id "aclb1SE3TArOFrUtgWq2lwAAAJA"]
[Mon Mar 30 01:05:25.748469 2026] [:error] [pid 32257:tid 32339] [client 20.65.118.88:11608] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-104.php"] [unique_id "aclb1SE3TArOFrUtgWq2nQAAAJU"]
[Mon Mar 30 01:05:26.171339 2026] [:error] [pid 23137:tid 23156] [client 20.65.118.88:11627] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-104.php"] [unique_id "aclb1haWQa7LdZ_qGFYcDgAAAZE"]
[Mon Mar 30 01:05:26.639963 2026] [:error] [pid 23250:tid 23274] [client 20.65.118.88:11628] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "aclb1pxrpj-dQjy1cvoq7gAAAlY"]
[Mon Mar 30 01:05:27.132174 2026] [:error] [pid 23168:tid 23197] [client 20.65.118.88:11622] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "aclb12P8p0yRL8ot_2_jmAAAAgA"]
[Mon Mar 30 01:05:27.610174 2026] [:error] [pid 23168:tid 23202] [client 20.65.118.88:11646] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "aclb12P8p0yRL8ot_2_jnAAAAgU"]
[Mon Mar 30 01:05:28.057087 2026] [:error] [pid 23284:tid 23295] [client 20.65.118.88:11619] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "aclb2IzBujdPHsq7wyQyiQAAAok"]
[Mon Mar 30 01:05:28.529662 2026] [:error] [pid 23168:tid 23213] [client 20.65.118.88:11679] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blogs.php"] [unique_id "aclb2GP8p0yRL8ot_2_joQAAAhA"]
[Mon Mar 30 01:05:29.007795 2026] [:error] [pid 23168:tid 23221] [client 20.65.118.88:11704] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blogs.php"] [unique_id "aclb2WP8p0yRL8ot_2_jpAAAAhg"]
[Mon Mar 30 01:05:29.430555 2026] [:error] [pid 32257:tid 32338] [client 20.65.118.88:11616] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blogs.php"] [unique_id "aclb2SE3TArOFrUtgWq2pgAAAJQ"]
[Mon Mar 30 01:05:29.897249 2026] [:error] [pid 32257:tid 32327] [client 20.65.118.88:12032] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blogs.php"] [unique_id "aclb2SE3TArOFrUtgWq2qAAAAIk"]
[Mon Mar 30 01:05:30.306750 2026] [:error] [pid 32257:tid 32333] [client 20.65.118.88:11710] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aclb2iE3TArOFrUtgWq2qwAAAI8"]
[Mon Mar 30 01:05:30.731253 2026] [:error] [pid 32257:tid 32328] [client 20.65.118.88:11612] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aclb2iE3TArOFrUtgWq2sAAAAIo"]
[Mon Mar 30 01:05:31.185032 2026] [:error] [pid 32257:tid 32337] [client 20.65.118.88:11691] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aclb2yE3TArOFrUtgWq2tAAAAJM"]
[Mon Mar 30 01:05:31.592910 2026] [:error] [pid 23284:tid 23300] [client 20.65.118.88:11929] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aclb24zBujdPHsq7wyQyjwAAAo4"]
[Mon Mar 30 01:05:32.069470 2026] [:error] [pid 32359:tid 32375] [client 20.65.118.88:11682] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "aclb3AMb8G3UzfQP3WhJggAAAM4"]
[Mon Mar 30 01:05:32.505706 2026] [:error] [pid 8818:tid 8845] [client 20.65.118.88:11929] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "aclb3CCDvotZNSF0FBoNlgAAAVc"]
[Mon Mar 30 01:05:32.938936 2026] [:error] [pid 23284:tid 23290] [client 20.65.118.88:11963] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "aclb3IzBujdPHsq7wyQylAAAAoQ"]
[Mon Mar 30 01:05:33.346625 2026] [:error] [pid 32255:tid 32303] [client 20.65.118.88:11674] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "aclb3Wnfn-AtRoMbquxKvgAAAEw"]
[Mon Mar 30 01:05:33.872691 2026] [:error] [pid 23250:tid 23253] [client 20.65.118.88:11707] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xfun.php"] [unique_id "aclb3Zxrpj-dQjy1cvoq9AAAAkE"]
[Mon Mar 30 01:05:34.305302 2026] [:error] [pid 23250:tid 23255] [client 20.65.118.88:11953] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xfun.php"] [unique_id "aclb3pxrpj-dQjy1cvoq9QAAAkM"]
[Mon Mar 30 01:05:34.730102 2026] [:error] [pid 32255:tid 32299] [client 20.65.118.88:11681] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xfun.php"] [unique_id "aclb3mnfn-AtRoMbquxKwAAAAEg"]
[Mon Mar 30 01:05:35.188763 2026] [:error] [pid 32255:tid 32300] [client 20.65.118.88:11650] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xfun.php"] [unique_id "aclb32nfn-AtRoMbquxKwQAAAEk"]
[Mon Mar 30 01:05:35.643813 2026] [:error] [pid 23250:tid 23261] [client 20.65.118.88:11708] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "aclb35xrpj-dQjy1cvoq9gAAAkk"]
[Mon Mar 30 01:05:36.131270 2026] [:error] [pid 23167:tid 23173] [client 20.65.118.88:11600] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "aclb4BIAHJCFaHff3_f3zQAAAcM"]
[Mon Mar 30 01:05:36.575480 2026] [:error] [pid 23250:tid 23269] [client 20.65.118.88:12135] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "aclb4Jxrpj-dQjy1cvoq-AAAAlE"]
[Mon Mar 30 01:05:37.002381 2026] [:error] [pid 23284:tid 23309] [client 20.65.118.88:11694] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "aclb4YzBujdPHsq7wyQyoQAAApc"]
[Mon Mar 30 01:05:37.464575 2026] [:error] [pid 23284:tid 23288] [client 20.65.118.88:12068] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/155.php"] [unique_id "aclb4YzBujdPHsq7wyQypQAAAoI"]
[Mon Mar 30 01:05:37.925257 2026] [:error] [pid 23250:tid 23265] [client 20.65.118.88:11635] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/155.php"] [unique_id "aclb4Zxrpj-dQjy1cvoq-gAAAk0"]
[Mon Mar 30 01:05:38.410830 2026] [:error] [pid 32255:tid 32305] [client 20.65.118.88:11961] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/155.php"] [unique_id "aclb4mnfn-AtRoMbquxKwwAAAE4"]
[Mon Mar 30 01:05:38.869656 2026] [:error] [pid 23284:tid 23302] [client 20.65.118.88:12056] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/155.php"] [unique_id "aclb4ozBujdPHsq7wyQypwAAApA"]
[Mon Mar 30 01:05:39.309031 2026] [:error] [pid 23284:tid 23296] [client 20.65.118.88:11649] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rzki.php"] [unique_id "aclb44zBujdPHsq7wyQyrAAAAoo"]
[Mon Mar 30 01:05:39.727138 2026] [:error] [pid 23284:tid 23305] [client 20.65.118.88:11634] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rzki.php"] [unique_id "aclb44zBujdPHsq7wyQyrwAAApM"]
[Mon Mar 30 01:05:40.372156 2026] [:error] [pid 23137:tid 23150] [client 20.65.118.88:11591] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rzki.php"] [unique_id "aclb5BaWQa7LdZ_qGFYcEQAAAYs"]
[Mon Mar 30 01:05:40.802782 2026] [:error] [pid 23168:tid 23213] [client 20.65.118.88:11642] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rzki.php"] [unique_id "aclb5GP8p0yRL8ot_2_jqQAAAhA"]
[Mon Mar 30 01:05:41.273774 2026] [:error] [pid 23284:tid 23297] [client 20.65.118.88:11618] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aclb5YzBujdPHsq7wyQysQAAAos"]
[Mon Mar 30 01:05:41.744158 2026] [:error] [pid 32255:tid 32301] [client 20.65.118.88:11668] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aclb5Wnfn-AtRoMbquxKyAAAAEo"]
[Mon Mar 30 01:05:42.167380 2026] [:error] [pid 23284:tid 23294] [client 20.65.118.88:11911] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aclb5ozBujdPHsq7wyQytwAAAog"]
[Mon Mar 30 01:05:42.577867 2026] [:error] [pid 23284:tid 23288] [client 20.65.118.88:12066] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aclb5ozBujdPHsq7wyQyuQAAAoI"]
[Mon Mar 30 01:05:42.984505 2026] [:error] [pid 23168:tid 23220] [client 20.65.118.88:11640] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws49.php"] [unique_id "aclb5mP8p0yRL8ot_2_jqwAAAhc"]
[Mon Mar 30 01:05:43.391049 2026] [:error] [pid 23284:tid 23293] [client 20.65.118.88:11695] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws49.php"] [unique_id "aclb54zBujdPHsq7wyQyuwAAAoc"]
[Mon Mar 30 01:05:43.986657 2026] [:error] [pid 32255:tid 32295] [client 20.65.118.88:11698] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws49.php"] [unique_id "aclb52nfn-AtRoMbquxKzAAAAEQ"]
[Mon Mar 30 01:05:44.399099 2026] [:error] [pid 8818:tid 8824] [client 20.65.118.88:11684] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws49.php"] [unique_id "aclb6CCDvotZNSF0FBoNngAAAUI"]
[Mon Mar 30 01:05:44.894812 2026] [:error] [pid 23250:tid 23258] [client 20.65.118.88:12088] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tool.php"] [unique_id "aclb6Jxrpj-dQjy1cvoq_gAAAkY"]
[Mon Mar 30 01:05:45.324726 2026] [:error] [pid 23168:tid 23215] [client 20.65.118.88:11670] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tool.php"] [unique_id "aclb6WP8p0yRL8ot_2_jrgAAAhI"]
[Mon Mar 30 01:05:45.810775 2026] [:error] [pid 32255:tid 32297] [client 20.65.118.88:11942] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tool.php"] [unique_id "aclb6Wnfn-AtRoMbquxKzgAAAEY"]
[Mon Mar 30 01:05:46.356432 2026] [:error] [pid 23250:tid 23253] [client 20.65.118.88:11606] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tool.php"] [unique_id "aclb6pxrpj-dQjy1cvorBAAAAkE"]
[Mon Mar 30 01:05:46.762335 2026] [:error] [pid 8818:tid 8846] [client 20.65.118.88:12046] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "aclb6iCDvotZNSF0FBoNpAAAAVg"]
[Mon Mar 30 01:05:47.176635 2026] [:error] [pid 23137:tid 23160] [client 20.65.118.88:11665] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "aclb6xaWQa7LdZ_qGFYcHQAAAZU"]
[Mon Mar 30 01:05:47.590266 2026] [:error] [pid 32255:tid 32314] [client 20.65.118.88:11653] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "aclb62nfn-AtRoMbquxK0gAAAFc"]
[Mon Mar 30 01:05:48.037276 2026] [:error] [pid 23284:tid 23289] [client 20.65.118.88:12084] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "aclb7IzBujdPHsq7wyQyxAAAAoM"]
[Mon Mar 30 01:05:48.499528 2026] [:error] [pid 32359:tid 32368] [client 20.65.118.88:11647] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vanda.php"] [unique_id "aclb7AMb8G3UzfQP3WhJjAAAAMc"]
[Mon Mar 30 01:05:49.069177 2026] [:error] [pid 32257:tid 32337] [client 20.65.118.88:12078] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vanda.php"] [unique_id "aclb7SE3TArOFrUtgWq2xwAAAJM"]
[Mon Mar 30 01:05:49.528619 2026] [:error] [pid 32257:tid 32341] [client 20.65.118.88:12006] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vanda.php"] [unique_id "aclb7SE3TArOFrUtgWq2ygAAAJc"]
[Mon Mar 30 01:05:52.446558 2026] [:error] [pid 32255:tid 32313] [client 20.65.118.88:11711] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vanda.php"] [unique_id "aclb8Gnfn-AtRoMbquxK6QAAAFY"]
[Mon Mar 30 01:05:53.007341 2026] [:error] [pid 23284:tid 23289] [client 20.65.118.88:12062] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "aclb8YzBujdPHsq7wyQyzwAAAoM"]
[Mon Mar 30 01:05:53.429044 2026] [:error] [pid 32255:tid 32297] [client 20.65.118.88:11659] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "aclb8Wnfn-AtRoMbquxK7gAAAEY"]
[Mon Mar 30 01:05:53.849782 2026] [:error] [pid 32255:tid 32312] [client 20.65.118.88:12065] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "aclb8Wnfn-AtRoMbquxK8AAAAFU"]
[Mon Mar 30 01:05:54.269808 2026] [:error] [pid 23250:tid 23275] [client 20.65.118.88:11638] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "aclb8pxrpj-dQjy1cvorEQAAAlc"]
[Mon Mar 30 01:05:54.747340 2026] [:error] [pid 23168:tid 23219] [client 20.65.118.88:11656] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "aclb8mP8p0yRL8ot_2_juAAAAhY"]
[Mon Mar 30 01:05:55.240088 2026] [:error] [pid 32255:tid 32292] [client 20.65.118.88:12076] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "aclb82nfn-AtRoMbquxK9AAAAEE"]
[Mon Mar 30 01:05:55.716817 2026] [:error] [pid 32359:tid 32383] [client 20.65.118.88:12071] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "aclb8wMb8G3UzfQP3WhJkAAAANY"]
[Mon Mar 30 01:05:56.208202 2026] [:error] [pid 32359:tid 32382] [client 20.65.118.88:11636] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "aclb9AMb8G3UzfQP3WhJlAAAANU"]
[Mon Mar 30 01:05:56.712612 2026] [:error] [pid 23168:tid 23208] [client 20.65.118.88:12033] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t.php"] [unique_id "aclb9GP8p0yRL8ot_2_juwAAAgs"]
[Mon Mar 30 01:05:57.116446 2026] [:error] [pid 32359:tid 32362] [client 20.65.118.88:11661] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t.php"] [unique_id "aclb9QMb8G3UzfQP3WhJmAAAAME"]
[Mon Mar 30 01:05:57.601529 2026] [:error] [pid 32359:tid 32373] [client 20.65.118.88:11604] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t.php"] [unique_id "aclb9QMb8G3UzfQP3WhJmQAAAMw"]
[Mon Mar 30 01:05:58.032893 2026] [:error] [pid 32359:tid 32372] [client 20.65.118.88:11662] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t.php"] [unique_id "aclb9gMb8G3UzfQP3WhJmgAAAMs"]
[Mon Mar 30 01:05:58.476749 2026] [:error] [pid 32255:tid 32309] [client 20.65.118.88:11703] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms.php"] [unique_id "aclb9mnfn-AtRoMbquxLBwAAAFI"]
[Mon Mar 30 01:05:58.880147 2026] [:error] [pid 32359:tid 32377] [client 20.65.118.88:12037] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms.php"] [unique_id "aclb9gMb8G3UzfQP3WhJnAAAANA"]
[Mon Mar 30 01:06:09.791641 2026] [:error] [pid 23250:tid 23272] [client 20.65.118.88:11658] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "aclcAZxrpj-dQjy1cvorKwAAAlQ"]
[Mon Mar 30 01:06:10.306723 2026] [:error] [pid 23284:tid 23300] [client 20.65.118.88:11977] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "aclcAozBujdPHsq7wyQy_QAAAo4"]
[Mon Mar 30 01:06:10.765504 2026] [:error] [pid 32254:tid 32279] [client 20.65.118.88:11975] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "aclcAqug2IHuyGgCTn9x4AAAAA8"]
[Mon Mar 30 01:06:11.201053 2026] [:error] [pid 32257:tid 32339] [client 20.65.118.88:11626] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "aclcAyE3TArOFrUtgWq27wAAAJU"]
[Mon Mar 30 01:06:11.624613 2026] [:error] [pid 32257:tid 32328] [client 20.65.118.88:11656] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-png.php"] [unique_id "aclcAyE3TArOFrUtgWq28gAAAIo"]
[Mon Mar 30 01:06:12.069033 2026] [:error] [pid 8818:tid 8838] [client 20.65.118.88:11685] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-png.php"] [unique_id "aclcBCCDvotZNSF0FBoNuwAAAVA"]
[Mon Mar 30 01:06:12.520412 2026] [:error] [pid 23137:tid 23141] [client 20.65.118.88:12057] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-png.php"] [unique_id "aclcBBaWQa7LdZ_qGFYcKQAAAYI"]
[Mon Mar 30 01:06:13.036593 2026] [:error] [pid 23250:tid 23269] [client 20.65.118.88:11950] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-png.php"] [unique_id "aclcBZxrpj-dQjy1cvorMgAAAlE"]
[Mon Mar 30 01:06:13.489481 2026] [:error] [pid 32255:tid 32310] [client 20.65.118.88:11683] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aclcBWnfn-AtRoMbquxLPwAAAFM"]
[Mon Mar 30 01:06:13.927855 2026] [:error] [pid 32257:tid 32334] [client 20.65.118.88:12085] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aclcBSE3TArOFrUtgWq29gAAAJA"]
[Mon Mar 30 01:06:14.336981 2026] [:error] [pid 32257:tid 32326] [client 20.65.118.88:11979] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aclcBiE3TArOFrUtgWq2_AAAAIg"]
[Mon Mar 30 01:06:14.846707 2026] [:error] [pid 32255:tid 32302] [client 20.65.118.88:12047] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aclcBmnfn-AtRoMbquxLRAAAAEs"]
[Mon Mar 30 01:06:15.315699 2026] [:error] [pid 32257:tid 32321] [client 20.65.118.88:11985] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "aclcByE3TArOFrUtgWq3AwAAAIM"]
[Mon Mar 30 01:06:15.748621 2026] [:error] [pid 32257:tid 32322] [client 20.65.118.88:11969] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "aclcByE3TArOFrUtgWq3DAAAAIQ"]
[Mon Mar 30 01:06:16.210938 2026] [:error] [pid 32257:tid 32328] [client 20.65.118.88:11706] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "aclcCCE3TArOFrUtgWq3EQAAAIo"]
[Mon Mar 30 01:06:17.210505 2026] [:error] [pid 32254:tid 32270] [client 20.65.118.88:12053] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "aclcCaug2IHuyGgCTn9x5AAAAAY"]
[Mon Mar 30 01:06:17.689946 2026] [:error] [pid 32255:tid 32312] [client 20.65.118.88:12050] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin-footer.php"] [unique_id "aclcCWnfn-AtRoMbquxLRwAAAFU"]
[Mon Mar 30 01:06:18.620686 2026] [:error] [pid 23137:tid 23153] [client 20.65.118.88:11982] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin-footer.php"] [unique_id "aclcChaWQa7LdZ_qGFYcLwAAAY4"]
[Mon Mar 30 01:06:19.035144 2026] [:error] [pid 32257:tid 32321] [client 20.65.118.88:12055] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin-footer.php"] [unique_id "aclcCyE3TArOFrUtgWq3HQAAAIM"]
[Mon Mar 30 01:06:19.464884 2026] [:error] [pid 23167:tid 23189] [client 20.65.118.88:11671] [client 20.65.118.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin-footer.php"] [unique_id "aclcCxIAHJCFaHff3_f4BgAAAdM"]
[Mon Mar 30 01:17:29.487847 2026] [:error] [pid 23167:tid 23194] [client 68.155.145.150:12264] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsas.php"] [unique_id "acleqRIAHJCFaHff3_f60wAAAdg"]
[Mon Mar 30 01:17:29.899060 2026] [:error] [pid 23284:tid 23292] [client 68.155.145.150:12254] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsas.php"] [unique_id "acleqYzBujdPHsq7wyQ49AAAAoY"]
[Mon Mar 30 01:17:30.438616 2026] [:error] [pid 23284:tid 23307] [client 68.155.145.150:12163] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsas.php"] [unique_id "acleqozBujdPHsq7wyQ4-AAAApU"]
[Mon Mar 30 01:17:30.928220 2026] [:error] [pid 23168:tid 23220] [client 68.155.145.150:12270] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsas.php"] [unique_id "acleqmP8p0yRL8ot_2_n0wAAAhc"]
[Mon Mar 30 01:17:31.475650 2026] [:error] [pid 23168:tid 23213] [client 68.155.145.150:12278] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "acleq2P8p0yRL8ot_2_n2AAAAhA"]
[Mon Mar 30 01:17:31.879672 2026] [:error] [pid 8818:tid 8833] [client 68.155.145.150:12165] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "acleqyCDvotZNSF0FBoQNQAAAUs"]
[Mon Mar 30 01:17:32.344970 2026] [:error] [pid 32257:tid 32335] [client 68.155.145.150:12283] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aclerCE3TArOFrUtgWq-JQAAAJE"]
[Mon Mar 30 01:17:32.805729 2026] [:error] [pid 23284:tid 23303] [client 68.155.145.150:12263] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aclerIzBujdPHsq7wyQ5EgAAApE"]
[Mon Mar 30 01:17:33.307309 2026] [:error] [pid 23167:tid 23184] [client 68.155.145.150:12269] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-header.php"] [unique_id "aclerRIAHJCFaHff3_f62QAAAc4"]
[Mon Mar 30 01:17:33.785468 2026] [:error] [pid 8818:tid 8822] [client 68.155.145.150:12241] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-header.php"] [unique_id "aclerSCDvotZNSF0FBoQNwAAAUA"]
[Mon Mar 30 01:17:34.305763 2026] [:error] [pid 32255:tid 32300] [client 68.155.145.150:12255] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-header.php"] [unique_id "aclermnfn-AtRoMbquxPtQAAAEk"]
[Mon Mar 30 01:17:34.789684 2026] [:error] [pid 23167:tid 23187] [client 68.155.145.150:12240] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-header.php"] [unique_id "aclerhIAHJCFaHff3_f63AAAAdE"]
[Mon Mar 30 01:17:35.197250 2026] [:error] [pid 32255:tid 32306] [client 68.155.145.150:12172] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "acler2nfn-AtRoMbquxPtwAAAE8"]
[Mon Mar 30 01:17:35.625789 2026] [:error] [pid 23167:tid 23174] [client 68.155.145.150:12207] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aclerxIAHJCFaHff3_f63QAAAcQ"]
[Mon Mar 30 01:17:36.011814 2026] [:error] [pid 32255:tid 32304] [client 68.155.145.150:12192] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aclesGnfn-AtRoMbquxPuQAAAE0"]
[Mon Mar 30 01:17:36.516926 2026] [:error] [pid 32255:tid 32301] [client 68.155.145.150:12202] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aclesGnfn-AtRoMbquxPvQAAAEo"]
[Mon Mar 30 01:17:36.942873 2026] [:error] [pid 23168:tid 23204] [client 68.155.145.150:12266] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aclesGP8p0yRL8ot_2_n3gAAAgc"]
[Mon Mar 30 01:17:37.428217 2026] [:error] [pid 32255:tid 32313] [client 68.155.145.150:12167] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aclesWnfn-AtRoMbquxPwQAAAFY"]
[Mon Mar 30 01:17:37.921318 2026] [:error] [pid 32359:tid 32381] [client 68.155.145.150:12286] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aclesQMb8G3UzfQP3WhLvwAAANQ"]
[Mon Mar 30 01:17:38.446891 2026] [:error] [pid 23284:tid 23298] [client 68.155.145.150:12233] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aclesozBujdPHsq7wyQ5JAAAAow"]
[Mon Mar 30 01:17:38.920841 2026] [:error] [pid 32257:tid 32335] [client 68.155.145.150:12248] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "aclesiE3TArOFrUtgWq-NwAAAJE"]
[Mon Mar 30 01:17:39.397929 2026] [:error] [pid 23284:tid 23292] [client 68.155.145.150:12191] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "acles4zBujdPHsq7wyQ5JgAAAoY"]
[Mon Mar 30 01:17:39.886323 2026] [:error] [pid 23284:tid 23289] [client 68.155.145.150:12239] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "acles4zBujdPHsq7wyQ5KgAAAoM"]
[Mon Mar 30 01:17:40.296374 2026] [:error] [pid 32254:tid 32275] [client 68.155.145.150:12273] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "acletKug2IHuyGgCTn9zjAAAAAs"]
[Mon Mar 30 01:17:40.796796 2026] [:error] [pid 23168:tid 23218] [client 68.155.145.150:12245] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "acletGP8p0yRL8ot_2_n4gAAAhU"]
[Mon Mar 30 01:17:41.293776 2026] [:error] [pid 32254:tid 32279] [client 68.155.145.150:12169] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "acletaug2IHuyGgCTn9zjQAAAA8"]
[Mon Mar 30 01:17:41.720449 2026] [:error] [pid 23168:tid 23201] [client 68.155.145.150:12105] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "acletWP8p0yRL8ot_2_n6AAAAgQ"]
[Mon Mar 30 01:17:42.160022 2026] [:error] [pid 23167:tid 23189] [client 68.155.145.150:12271] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "aclethIAHJCFaHff3_f65AAAAdM"]
[Mon Mar 30 01:17:42.693345 2026] [:error] [pid 23167:tid 23181] [client 68.155.145.150:12220] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aclethIAHJCFaHff3_f65QAAAcs"]
[Mon Mar 30 01:17:43.133709 2026] [:error] [pid 23250:tid 23262] [client 68.155.145.150:12282] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aclet5xrpj-dQjy1cvotIAAAAko"]
[Mon Mar 30 01:17:43.544386 2026] [:error] [pid 32254:tid 32265] [client 68.155.145.150:12161] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "aclet6ug2IHuyGgCTn9zjwAAAAE"]
[Mon Mar 30 01:17:44.063392 2026] [:error] [pid 23168:tid 23203] [client 68.155.145.150:12247] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "acleuGP8p0yRL8ot_2_n8AAAAgY"]
[Mon Mar 30 01:17:44.482066 2026] [:error] [pid 23168:tid 23197] [client 68.155.145.150:12196] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2ksm17n.php"] [unique_id "acleuGP8p0yRL8ot_2_n8gAAAgA"]
[Mon Mar 30 01:17:44.926660 2026] [:error] [pid 23167:tid 23171] [client 68.155.145.150:12285] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2ksm17n.php"] [unique_id "acleuBIAHJCFaHff3_f67AAAAcE"]
[Mon Mar 30 01:17:45.381080 2026] [:error] [pid 23168:tid 23209] [client 68.155.145.150:12177] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2ksm17n.php"] [unique_id "acleuWP8p0yRL8ot_2_n9QAAAgw"]
[Mon Mar 30 01:17:45.832731 2026] [:error] [pid 32257:tid 32329] [client 68.155.145.150:12168] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2ksm17n.php"] [unique_id "acleuSE3TArOFrUtgWq-QgAAAIs"]
[Mon Mar 30 01:17:46.226927 2026] [:error] [pid 23167:tid 23191] [client 68.155.145.150:12232] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "acleuhIAHJCFaHff3_f69AAAAdU"]
[Mon Mar 30 01:17:46.918586 2026] [:error] [pid 23250:tid 23276] [client 68.155.145.150:12171] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "acleupxrpj-dQjy1cvotJAAAAlg"]
[Mon Mar 30 01:17:47.844942 2026] [:error] [pid 32255:tid 32292] [client 68.155.145.150:12262] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "acleu2nfn-AtRoMbquxPzwAAAEE"]
[Mon Mar 30 01:17:48.991825 2026] [:error] [pid 32359:tid 32375] [client 68.155.145.150:12096] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aclevAMb8G3UzfQP3WhLyQAAAM4"]
[Mon Mar 30 01:17:49.546151 2026] [:error] [pid 32255:tid 32303] [client 68.155.145.150:12249] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hots.php"] [unique_id "aclevWnfn-AtRoMbquxP1gAAAEw"]
[Mon Mar 30 01:17:50.172030 2026] [:error] [pid 23137:tid 23149] [client 68.155.145.150:12113] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hots.php"] [unique_id "aclevhaWQa7LdZ_qGFYenAAAAYo"]
[Mon Mar 30 01:17:51.133864 2026] [:error] [pid 32255:tid 32307] [client 68.155.145.150:12236] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hots.php"] [unique_id "aclev2nfn-AtRoMbquxP2QAAAFA"]
[Mon Mar 30 01:17:51.751818 2026] [:error] [pid 23168:tid 23218] [client 68.155.145.150:12231] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hots.php"] [unique_id "aclev2P8p0yRL8ot_2_oCAAAAhU"]
[Mon Mar 30 01:17:52.846016 2026] [:error] [pid 32257:tid 32322] [client 68.155.145.150:12178] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "aclewCE3TArOFrUtgWq-WAAAAIQ"]
[Mon Mar 30 01:17:53.727291 2026] [:error] [pid 32257:tid 32342] [client 68.155.145.150:12119] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "aclewSE3TArOFrUtgWq-XgAAAJg"]
[Mon Mar 30 01:17:54.399325 2026] [:error] [pid 32257:tid 32329] [client 68.155.145.150:12237] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "aclewiE3TArOFrUtgWq-XwAAAIs"]
[Mon Mar 30 01:17:54.968948 2026] [:error] [pid 32257:tid 32320] [client 68.155.145.150:12265] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "aclewiE3TArOFrUtgWq-YAAAAII"]
[Mon Mar 30 01:17:55.719217 2026] [:error] [pid 32359:tid 32366] [client 68.155.145.150:12174] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aclewwMb8G3UzfQP3WhLzwAAAMU"]
[Mon Mar 30 01:17:56.116835 2026] [:error] [pid 32257:tid 32322] [client 68.155.145.150:12251] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aclexCE3TArOFrUtgWq-ZQAAAIQ"]
[Mon Mar 30 01:17:56.608189 2026] [:error] [pid 32257:tid 32338] [client 68.155.145.150:12160] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aclexCE3TArOFrUtgWq-awAAAJQ"]
[Mon Mar 30 01:17:57.089972 2026] [:error] [pid 8818:tid 8834] [client 68.155.145.150:12204] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aclexSCDvotZNSF0FBoQQQAAAUw"]
[Mon Mar 30 01:17:57.854732 2026] [:error] [pid 32255:tid 32291] [client 68.155.145.150:12224] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aclexWnfn-AtRoMbquxP4wAAAEA"]
[Mon Mar 30 01:17:58.532945 2026] [:error] [pid 32255:tid 32302] [client 68.155.145.150:12166] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aclexmnfn-AtRoMbquxP6wAAAEs"]
[Mon Mar 30 01:17:59.845986 2026] [:error] [pid 23168:tid 23211] [client 68.155.145.150:12256] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aclex2P8p0yRL8ot_2_oDwAAAg4"]
[Mon Mar 30 01:18:01.106554 2026] [:error] [pid 23168:tid 23220] [client 68.155.145.150:12226] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "acleyWP8p0yRL8ot_2_oEQAAAhc"]
[Mon Mar 30 01:18:01.562913 2026] [:error] [pid 32255:tid 32299] [client 68.155.145.150:12253] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acleyWnfn-AtRoMbquxP9QAAAEg"]
[Mon Mar 30 01:18:01.979693 2026] [:error] [pid 32255:tid 32292] [client 68.155.145.150:12228] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acleyWnfn-AtRoMbquxP-gAAAEE"]
[Mon Mar 30 01:18:02.555027 2026] [:error] [pid 23250:tid 23276] [client 68.155.145.150:12179] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acleypxrpj-dQjy1cvotMAAAAlg"]
[Mon Mar 30 01:18:03.096297 2026] [:error] [pid 23137:tid 23140] [client 68.155.145.150:12217] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acleyxaWQa7LdZ_qGFYeogAAAYE"]
[Mon Mar 30 01:18:03.529625 2026] [:error] [pid 23167:tid 23192] [client 68.155.145.150:12041] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "acleyxIAHJCFaHff3_f6_wAAAdY"]
[Mon Mar 30 01:18:03.928007 2026] [:error] [pid 23168:tid 23218] [client 68.155.145.150:12276] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "acley2P8p0yRL8ot_2_oFQAAAhU"]
[Mon Mar 30 01:18:04.580532 2026] [:error] [pid 23167:tid 23188] [client 68.155.145.150:12212] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aclezBIAHJCFaHff3_f7AgAAAdI"]
[Mon Mar 30 01:18:05.193211 2026] [:error] [pid 23137:tid 23151] [client 68.155.145.150:12173] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aclezRaWQa7LdZ_qGFYepAAAAYw"]
[Mon Mar 30 01:18:05.650917 2026] [:error] [pid 23284:tid 23291] [client 68.155.145.150:12208] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dass.php"] [unique_id "aclezYzBujdPHsq7wyQ5XwAAAoU"]
[Mon Mar 30 01:18:06.193269 2026] [:error] [pid 23168:tid 23197] [client 68.155.145.150:12274] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dass.php"] [unique_id "aclezmP8p0yRL8ot_2_oGwAAAgA"]
[Mon Mar 30 01:18:06.749043 2026] [:error] [pid 23137:tid 23155] [client 68.155.145.150:12257] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dass.php"] [unique_id "aclezhaWQa7LdZ_qGFYepgAAAZA"]
[Mon Mar 30 01:18:07.332991 2026] [:error] [pid 32255:tid 32311] [client 68.155.145.150:12107] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dass.php"] [unique_id "aclez2nfn-AtRoMbquxQAwAAAFQ"]
[Mon Mar 30 01:18:07.805644 2026] [:error] [pid 23284:tid 23298] [client 68.155.145.150:12128] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aclez4zBujdPHsq7wyQ5YwAAAow"]
[Mon Mar 30 01:18:08.422017 2026] [:error] [pid 23284:tid 23297] [client 68.155.145.150:12210] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "acle0IzBujdPHsq7wyQ5ZAAAAos"]
[Mon Mar 30 01:18:08.829859 2026] [:error] [pid 23250:tid 23264] [client 68.155.145.150:12229] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "acle0Jxrpj-dQjy1cvotOQAAAkw"]
[Mon Mar 30 01:18:09.295983 2026] [:error] [pid 32254:tid 32264] [client 68.155.145.150:12219] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "acle0aug2IHuyGgCTn9zmgAAAAA"]
[Mon Mar 30 01:18:09.940250 2026] [:error] [pid 23284:tid 23304] [client 68.155.145.150:12111] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws83.php"] [unique_id "acle0YzBujdPHsq7wyQ5ZwAAApI"]
[Mon Mar 30 01:18:10.402844 2026] [:error] [pid 23284:tid 23295] [client 68.155.145.150:12201] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws83.php"] [unique_id "acle0ozBujdPHsq7wyQ5aQAAAok"]
[Mon Mar 30 01:18:10.913004 2026] [:error] [pid 23284:tid 23296] [client 68.155.145.150:12038] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws83.php"] [unique_id "acle0ozBujdPHsq7wyQ5bgAAAoo"]
[Mon Mar 30 01:18:11.418126 2026] [:error] [pid 23284:tid 23292] [client 68.155.145.150:12260] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws83.php"] [unique_id "acle04zBujdPHsq7wyQ5dgAAAoY"]
[Mon Mar 30 01:18:11.956749 2026] [:error] [pid 23284:tid 23306] [client 68.155.145.150:12130] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/56c53.php"] [unique_id "acle04zBujdPHsq7wyQ5ewAAApQ"]
[Mon Mar 30 01:18:12.423160 2026] [:error] [pid 23284:tid 23299] [client 68.155.145.150:12246] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/56c53.php"] [unique_id "acle1IzBujdPHsq7wyQ5fgAAAo0"]
[Mon Mar 30 01:18:12.856309 2026] [:error] [pid 23284:tid 23303] [client 68.155.145.150:12244] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/56c53.php"] [unique_id "acle1IzBujdPHsq7wyQ5gAAAApE"]
[Mon Mar 30 01:18:13.272314 2026] [:error] [pid 23284:tid 23295] [client 68.155.145.150:12146] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/56c53.php"] [unique_id "acle1YzBujdPHsq7wyQ5hQAAAok"]
[Mon Mar 30 01:18:13.790016 2026] [:error] [pid 32255:tid 32294] [client 68.155.145.150:12263] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "acle1Wnfn-AtRoMbquxQDAAAAEM"]
[Mon Mar 30 01:18:14.355844 2026] [:error] [pid 8818:tid 8841] [client 68.155.145.150:12218] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "acle1iCDvotZNSF0FBoQSwAAAVM"]
[Mon Mar 30 01:18:14.774647 2026] [:error] [pid 23284:tid 23302] [client 68.155.145.150:12122] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "acle1ozBujdPHsq7wyQ5hwAAApA"]
[Mon Mar 30 01:18:15.215629 2026] [:error] [pid 23284:tid 23296] [client 68.155.145.150:12162] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "acle14zBujdPHsq7wyQ5iQAAAoo"]
[Mon Mar 30 01:18:15.695389 2026] [:error] [pid 23250:tid 23276] [client 68.155.145.150:12121] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "acle15xrpj-dQjy1cvotOgAAAlg"]
[Mon Mar 30 01:18:16.154530 2026] [:error] [pid 32257:tid 32339] [client 68.155.145.150:12197] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "acle2CE3TArOFrUtgWq-kQAAAJU"]
[Mon Mar 30 01:18:16.629995 2026] [:error] [pid 23168:tid 23216] [client 68.155.145.150:12164] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "acle2GP8p0yRL8ot_2_oLAAAAhM"]
[Mon Mar 30 01:18:17.051479 2026] [:error] [pid 32255:tid 32304] [client 68.155.145.150:12189] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "acle2Wnfn-AtRoMbquxQEwAAAE0"]
[Mon Mar 30 01:18:17.450598 2026] [:error] [pid 23168:tid 23198] [client 68.155.145.150:12098] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "acle2WP8p0yRL8ot_2_oLQAAAgE"]
[Mon Mar 30 01:18:17.882368 2026] [:error] [pid 23168:tid 23218] [client 68.155.145.150:12242] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "acle2WP8p0yRL8ot_2_oMAAAAhU"]
[Mon Mar 30 01:18:18.371336 2026] [:error] [pid 23250:tid 23260] [client 68.155.145.150:12250] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "acle2pxrpj-dQjy1cvotOwAAAkg"]
[Mon Mar 30 01:18:18.786344 2026] [:error] [pid 8818:tid 8839] [client 68.155.145.150:12209] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "acle2iCDvotZNSF0FBoQTgAAAVE"]
[Mon Mar 30 01:18:19.232032 2026] [:error] [pid 23167:tid 23182] [client 68.155.145.150:12198] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "acle2xIAHJCFaHff3_f7CAAAAcw"]
[Mon Mar 30 01:18:19.697905 2026] [:error] [pid 32255:tid 32306] [client 68.155.145.150:12108] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "acle22nfn-AtRoMbquxQGAAAAE8"]
[Mon Mar 30 01:18:20.153343 2026] [:error] [pid 23137:tid 23158] [client 68.155.145.150:12287] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "acle3BaWQa7LdZ_qGFYergAAAZM"]
[Mon Mar 30 01:18:20.537916 2026] [:error] [pid 23284:tid 23305] [client 68.155.145.150:12117] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "acle3IzBujdPHsq7wyQ5kgAAApM"]
[Mon Mar 30 01:18:20.966066 2026] [:error] [pid 23284:tid 23301] [client 68.155.145.150:12126] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "acle3IzBujdPHsq7wyQ5lQAAAo8"]
[Mon Mar 30 01:18:21.626698 2026] [:error] [pid 23168:tid 23211] [client 68.155.145.150:12125] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "acle3WP8p0yRL8ot_2_oMwAAAg4"]
[Mon Mar 30 01:18:22.088442 2026] [:error] [pid 8818:tid 8830] [client 68.155.145.150:12206] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "acle3iCDvotZNSF0FBoQVAAAAUg"]
[Mon Mar 30 01:18:22.727811 2026] [:error] [pid 23137:tid 23154] [client 68.155.145.150:12138] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "acle3haWQa7LdZ_qGFYesQAAAY8"]
[Mon Mar 30 01:18:23.218954 2026] [:error] [pid 8818:tid 8837] [client 68.155.145.150:12215] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "acle3yCDvotZNSF0FBoQVwAAAU8"]
[Mon Mar 30 01:18:23.762288 2026] [:error] [pid 8818:tid 8846] [client 68.155.145.150:12193] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "acle3yCDvotZNSF0FBoQWwAAAVg"]
[Mon Mar 30 01:18:24.251682 2026] [:error] [pid 23250:tid 23268] [client 68.155.145.150:12230] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "acle4Jxrpj-dQjy1cvotQQAAAlA"]
[Mon Mar 30 01:18:24.728837 2026] [:error] [pid 23168:tid 23207] [client 68.155.145.150:12180] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "acle4GP8p0yRL8ot_2_oOAAAAgo"]
[Mon Mar 30 01:18:25.290279 2026] [:error] [pid 23137:tid 23159] [client 68.155.145.150:12103] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "acle4RaWQa7LdZ_qGFYetQAAAZQ"]
[Mon Mar 30 01:18:25.771022 2026] [:error] [pid 23167:tid 23177] [client 68.155.145.150:12170] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "acle4RIAHJCFaHff3_f7EQAAAcc"]
[Mon Mar 30 01:18:26.263881 2026] [:error] [pid 23137:tid 23144] [client 68.155.145.150:12216] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "acle4haWQa7LdZ_qGFYetgAAAYU"]
[Mon Mar 30 01:18:26.884192 2026] [:error] [pid 8818:tid 8845] [client 68.155.145.150:12279] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "acle4iCDvotZNSF0FBoQYAAAAVc"]
[Mon Mar 30 01:18:27.475086 2026] [:error] [pid 32257:tid 32328] [client 68.155.145.150:12205] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "acle4yE3TArOFrUtgWq-lwAAAIo"]
[Mon Mar 30 01:18:36.898905 2026] [:error] [pid 23137:tid 23141] [client 68.155.145.150:12068] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gfd.php"] [unique_id "acle7BaWQa7LdZ_qGFYeyAAAAYI"]
[Mon Mar 30 01:18:37.781350 2026] [:error] [pid 23137:tid 23147] [client 68.155.145.150:12154] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gfd.php"] [unique_id "acle7RaWQa7LdZ_qGFYeyQAAAYg"]
[Mon Mar 30 01:18:38.174875 2026] [:error] [pid 32254:tid 32287] [client 68.155.145.150:12112] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gfd.php"] [unique_id "acle7qug2IHuyGgCTn9zswAAABc"]
[Mon Mar 30 01:18:38.585290 2026] [:error] [pid 23137:tid 23163] [client 68.155.145.150:11968] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gfd.php"] [unique_id "acle7haWQa7LdZ_qGFYeygAAAZg"]
[Mon Mar 30 01:18:39.006651 2026] [:error] [pid 23168:tid 23216] [client 68.155.145.150:12200] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abrand.php"] [unique_id "acle72P8p0yRL8ot_2_oQwAAAhM"]
[Mon Mar 30 01:18:39.400064 2026] [:error] [pid 23168:tid 23202] [client 68.155.145.150:12181] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abrand.php"] [unique_id "acle72P8p0yRL8ot_2_oRgAAAgU"]
[Mon Mar 30 01:18:39.790581 2026] [:error] [pid 8818:tid 8829] [client 68.155.145.150:12213] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abrand.php"] [unique_id "acle7yCDvotZNSF0FBoQawAAAUc"]
[Mon Mar 30 01:18:40.193656 2026] [:error] [pid 8818:tid 8833] [client 68.155.145.150:12099] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abrand.php"] [unique_id "acle8CCDvotZNSF0FBoQbAAAAUs"]
[Mon Mar 30 01:18:40.653962 2026] [:error] [pid 32255:tid 32311] [client 68.155.145.150:12134] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amp.php"] [unique_id "acle8Gnfn-AtRoMbquxQIwAAAFQ"]
[Mon Mar 30 01:18:41.075752 2026] [:error] [pid 32255:tid 32308] [client 68.155.145.150:12141] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amp.php"] [unique_id "acle8Wnfn-AtRoMbquxQJAAAAFE"]
[Mon Mar 30 01:18:41.486642 2026] [:error] [pid 32257:tid 32321] [client 68.155.145.150:12150] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amp.php"] [unique_id "acle8SE3TArOFrUtgWq-qQAAAIM"]
[Mon Mar 30 01:18:41.882317 2026] [:error] [pid 8818:tid 8840] [client 68.155.145.150:12101] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amp.php"] [unique_id "acle8SCDvotZNSF0FBoQcAAAAVI"]
[Mon Mar 30 01:18:42.270998 2026] [:error] [pid 32257:tid 32320] [client 68.155.145.150:12129] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws75.php"] [unique_id "acle8iE3TArOFrUtgWq-rgAAAII"]
[Mon Mar 30 01:18:42.749722 2026] [:error] [pid 23168:tid 23208] [client 68.155.145.150:12045] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws75.php"] [unique_id "acle8mP8p0yRL8ot_2_oUAAAAgs"]
[Mon Mar 30 01:18:43.152543 2026] [:error] [pid 23167:tid 23173] [client 68.155.145.150:12039] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws75.php"] [unique_id "acle8xIAHJCFaHff3_f7IwAAAcM"]
[Mon Mar 30 01:18:43.711771 2026] [:error] [pid 23167:tid 23179] [client 68.155.145.150:12194] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws75.php"] [unique_id "acle8xIAHJCFaHff3_f7JQAAAck"]
[Mon Mar 30 01:18:44.185093 2026] [:error] [pid 23167:tid 23181] [client 68.155.145.150:12190] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "acle9BIAHJCFaHff3_f7JgAAAcs"]
[Mon Mar 30 01:18:44.863657 2026] [:error] [pid 32257:tid 32335] [client 68.155.145.150:12259] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "acle9CE3TArOFrUtgWq-xQAAAJE"]
[Mon Mar 30 01:18:45.381810 2026] [:error] [pid 23284:tid 23288] [client 68.155.145.150:12147] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "acle9YzBujdPHsq7wyQ5sgAAAoI"]
[Mon Mar 30 01:18:45.897817 2026] [:error] [pid 23284:tid 23295] [client 68.155.145.150:12284] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "acle9YzBujdPHsq7wyQ5tQAAAok"]
[Mon Mar 30 01:18:46.373030 2026] [:error] [pid 23284:tid 23287] [client 68.155.145.150:12127] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maul.php"] [unique_id "acle9ozBujdPHsq7wyQ5ugAAAoE"]
[Mon Mar 30 01:18:46.872459 2026] [:error] [pid 23137:tid 23146] [client 68.155.145.150:12109] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maul.php"] [unique_id "acle9haWQa7LdZ_qGFYezgAAAYc"]
[Mon Mar 30 01:18:47.325022 2026] [:error] [pid 32257:tid 32335] [client 68.155.145.150:12155] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maul.php"] [unique_id "acle9yE3TArOFrUtgWq-2QAAAJE"]
[Mon Mar 30 01:18:47.992881 2026] [:error] [pid 23168:tid 23214] [client 68.155.145.150:12120] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maul.php"] [unique_id "acle92P8p0yRL8ot_2_oYQAAAhE"]
[Mon Mar 30 01:18:48.641318 2026] [:error] [pid 23168:tid 23212] [client 68.155.145.150:12175] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lowpr.php"] [unique_id "acle-GP8p0yRL8ot_2_oYwAAAg8"]
[Mon Mar 30 01:18:49.405279 2026] [:error] [pid 23284:tid 23298] [client 68.155.145.150:12209] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lowpr.php"] [unique_id "acle-YzBujdPHsq7wyQ5xAAAAow"]
[Mon Mar 30 01:18:50.059116 2026] [:error] [pid 23250:tid 23275] [client 68.155.145.150:12223] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lowpr.php"] [unique_id "acle-pxrpj-dQjy1cvotUAAAAlc"]
[Mon Mar 30 01:18:50.494767 2026] [:error] [pid 23250:tid 23265] [client 68.155.145.150:12185] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lowpr.php"] [unique_id "acle-pxrpj-dQjy1cvotUgAAAk0"]
[Mon Mar 30 01:18:50.994815 2026] [:error] [pid 23168:tid 23220] [client 68.155.145.150:12275] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "acle-mP8p0yRL8ot_2_oZAAAAhc"]
[Mon Mar 30 01:18:51.764210 2026] [:error] [pid 23250:tid 23273] [client 68.155.145.150:12143] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "acle-5xrpj-dQjy1cvotUwAAAlU"]
[Mon Mar 30 01:18:52.220768 2026] [:error] [pid 23284:tid 23292] [client 68.155.145.150:12261] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "acle_IzBujdPHsq7wyQ5ywAAAoY"]
[Mon Mar 30 01:18:52.689532 2026] [:error] [pid 23250:tid 23261] [client 68.155.145.150:12184] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "acle_Jxrpj-dQjy1cvotVAAAAkk"]
[Mon Mar 30 01:18:53.120384 2026] [:error] [pid 23137:tid 23163] [client 68.155.145.150:12157] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/166.php"] [unique_id "acle_RaWQa7LdZ_qGFYe2AAAAZg"]
[Mon Mar 30 01:18:53.547566 2026] [:error] [pid 23167:tid 23174] [client 68.155.145.150:12123] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/166.php"] [unique_id "acle_RIAHJCFaHff3_f7NgAAAcQ"]
[Mon Mar 30 01:18:53.961832 2026] [:error] [pid 32257:tid 32341] [client 68.155.145.150:12267] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/166.php"] [unique_id "acle_SE3TArOFrUtgWq_BwAAAJc"]
[Mon Mar 30 01:18:54.354138 2026] [:error] [pid 23168:tid 23217] [client 68.155.145.150:12158] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/166.php"] [unique_id "acle_mP8p0yRL8ot_2_oZgAAAhQ"]
[Mon Mar 30 01:18:54.784975 2026] [:error] [pid 23167:tid 23177] [client 68.155.145.150:12067] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "acle_hIAHJCFaHff3_f7OgAAAcc"]
[Mon Mar 30 01:18:55.371305 2026] [:error] [pid 32255:tid 32295] [client 68.155.145.150:12142] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "acle_2nfn-AtRoMbquxQJgAAAEQ"]
[Mon Mar 30 01:18:55.874867 2026] [:error] [pid 23168:tid 23218] [client 68.155.145.150:12044] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "acle_2P8p0yRL8ot_2_oaQAAAhU"]
[Mon Mar 30 01:18:56.266372 2026] [:error] [pid 32257:tid 32319] [client 68.155.145.150:12133] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "aclfACE3TArOFrUtgWq_GgAAAIE"]
[Mon Mar 30 01:18:56.750088 2026] [:error] [pid 23284:tid 23307] [client 68.155.145.150:12234] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "aclfAIzBujdPHsq7wyQ52AAAApU"]
[Mon Mar 30 01:18:57.191842 2026] [:error] [pid 23284:tid 23292] [client 68.155.145.150:12070] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "aclfAYzBujdPHsq7wyQ52wAAAoY"]
[Mon Mar 30 01:18:57.677249 2026] [:error] [pid 23167:tid 23182] [client 68.155.145.150:12080] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "aclfARIAHJCFaHff3_f7PAAAAcw"]
[Mon Mar 30 01:18:58.084639 2026] [:error] [pid 23250:tid 23258] [client 68.155.145.150:12238] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "aclfApxrpj-dQjy1cvotVwAAAkY"]
[Mon Mar 30 01:18:58.470611 2026] [:error] [pid 23168:tid 23214] [client 68.155.145.150:12268] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aclfAmP8p0yRL8ot_2_obwAAAhE"]
[Mon Mar 30 01:18:58.867838 2026] [:error] [pid 23167:tid 23180] [client 68.155.145.150:12148] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aclfAhIAHJCFaHff3_f7PgAAAco"]
[Mon Mar 30 01:18:59.281551 2026] [:error] [pid 23137:tid 23150] [client 68.155.145.150:12225] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aclfAxaWQa7LdZ_qGFYe3AAAAYs"]
[Mon Mar 30 01:18:59.714475 2026] [:error] [pid 32255:tid 32301] [client 68.155.145.150:11993] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aclfA2nfn-AtRoMbquxQKwAAAEo"]
[Mon Mar 30 01:19:00.205978 2026] [:error] [pid 23168:tid 23220] [client 68.155.145.150:12227] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hehe.php"] [unique_id "aclfBGP8p0yRL8ot_2_ocAAAAhc"]
[Mon Mar 30 01:19:00.657089 2026] [:error] [pid 23250:tid 23254] [client 68.155.145.150:12054] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hehe.php"] [unique_id "aclfBJxrpj-dQjy1cvotWwAAAkI"]
[Mon Mar 30 01:19:01.086605 2026] [:error] [pid 32255:tid 32310] [client 68.155.145.150:12221] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hehe.php"] [unique_id "aclfBWnfn-AtRoMbquxQLgAAAFM"]
[Mon Mar 30 01:19:01.520747 2026] [:error] [pid 23284:tid 23307] [client 68.155.145.150:12106] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hehe.php"] [unique_id "aclfBYzBujdPHsq7wyQ55AAAApU"]
[Mon Mar 30 01:19:01.980306 2026] [:error] [pid 23284:tid 23305] [client 68.155.145.150:12066] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "aclfBYzBujdPHsq7wyQ56AAAApM"]
[Mon Mar 30 01:19:02.391163 2026] [:error] [pid 32255:tid 32302] [client 68.155.145.150:12124] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "aclfBmnfn-AtRoMbquxQMQAAAEs"]
[Mon Mar 30 01:19:02.919978 2026] [:error] [pid 23250:tid 23255] [client 68.155.145.150:12211] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "aclfBpxrpj-dQjy1cvotXgAAAkM"]
[Mon Mar 30 01:19:03.346897 2026] [:error] [pid 23284:tid 23298] [client 68.155.145.150:12084] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "aclfB4zBujdPHsq7wyQ57QAAAow"]
[Mon Mar 30 01:19:03.741060 2026] [:error] [pid 8818:tid 8831] [client 68.155.145.150:12102] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ne2026.php"] [unique_id "aclfByCDvotZNSF0FBoQjAAAAUk"]
[Mon Mar 30 01:19:04.182937 2026] [:error] [pid 23284:tid 23304] [client 68.155.145.150:12252] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ne2026.php"] [unique_id "aclfCIzBujdPHsq7wyQ58wAAApI"]
[Mon Mar 30 01:19:04.638097 2026] [:error] [pid 23284:tid 23287] [client 68.155.145.150:12188] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ne2026.php"] [unique_id "aclfCIzBujdPHsq7wyQ59wAAAoE"]
[Mon Mar 30 01:19:05.090579 2026] [:error] [pid 8818:tid 8829] [client 68.155.145.150:12049] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ne2026.php"] [unique_id "aclfCSCDvotZNSF0FBoQkwAAAUc"]
[Mon Mar 30 01:19:05.539540 2026] [:error] [pid 32255:tid 32293] [client 68.155.145.150:12059] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "aclfCWnfn-AtRoMbquxQMgAAAEI"]
[Mon Mar 30 01:19:06.320979 2026] [:error] [pid 32257:tid 32334] [client 68.155.145.150:12062] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "aclfCiE3TArOFrUtgWq_KAAAAJA"]
[Mon Mar 30 01:19:06.998986 2026] [:error] [pid 23167:tid 23174] [client 68.155.145.150:12115] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "aclfChIAHJCFaHff3_f7TwAAAcQ"]
[Mon Mar 30 01:19:07.874280 2026] [:error] [pid 32254:tid 32281] [client 68.155.145.150:12258] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "aclfC6ug2IHuyGgCTn9zvQAAABE"]
[Mon Mar 30 01:19:08.720398 2026] [:error] [pid 32254:tid 32284] [client 68.155.145.150:12186] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "aclfDKug2IHuyGgCTn9zvgAAABQ"]
[Mon Mar 30 01:19:09.504711 2026] [:error] [pid 32257:tid 32341] [client 68.155.145.150:12022] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "aclfDSE3TArOFrUtgWq_LgAAAJc"]
[Mon Mar 30 01:19:10.087797 2026] [:error] [pid 23168:tid 23208] [client 68.155.145.150:12071] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "aclfDmP8p0yRL8ot_2_odQAAAgs"]
[Mon Mar 30 01:19:10.892648 2026] [:error] [pid 32359:tid 32365] [client 68.155.145.150:12079] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "aclfDgMb8G3UzfQP3WhL4wAAAMQ"]
[Mon Mar 30 01:19:11.340516 2026] [:error] [pid 23250:tid 23262] [client 68.155.145.150:12116] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "aclfD5xrpj-dQjy1cvotYwAAAko"]
[Mon Mar 30 01:19:12.039805 2026] [:error] [pid 23250:tid 23270] [client 68.155.145.150:12135] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "aclfEJxrpj-dQjy1cvotZQAAAlI"]
[Mon Mar 30 01:19:12.802855 2026] [:error] [pid 8818:tid 8830] [client 68.155.145.150:12235] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "aclfECCDvotZNSF0FBoQmwAAAUg"]
[Mon Mar 30 01:19:13.572349 2026] [:error] [pid 8818:tid 8829] [client 68.155.145.150:12149] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "aclfESCDvotZNSF0FBoQnwAAAUc"]
[Mon Mar 30 01:19:14.644696 2026] [:error] [pid 23284:tid 23300] [client 68.155.145.150:12183] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aclfEozBujdPHsq7wyQ6AgAAAo4"]
[Mon Mar 30 01:19:16.097814 2026] [:error] [pid 23168:tid 23214] [client 68.155.145.150:12166] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aclfFGP8p0yRL8ot_2_odgAAAhE"]
[Mon Mar 30 01:19:16.560913 2026] [:error] [pid 32359:tid 32369] [client 68.155.145.150:12088] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aclfFAMb8G3UzfQP3WhL5QAAAMg"]
[Mon Mar 30 01:19:17.013364 2026] [:error] [pid 32254:tid 32278] [client 68.155.145.150:12153] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aclfFaug2IHuyGgCTn9zwwAAAA4"]
[Mon Mar 30 01:19:17.437892 2026] [:error] [pid 32257:tid 32341] [client 68.155.145.150:12222] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "aclfFSE3TArOFrUtgWq_QQAAAJc"]
[Mon Mar 30 01:19:17.899688 2026] [:error] [pid 23250:tid 23254] [client 68.155.145.150:12110] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "aclfFZxrpj-dQjy1cvotbwAAAkI"]
[Mon Mar 30 01:19:18.334391 2026] [:error] [pid 23284:tid 23303] [client 68.155.145.150:12076] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "aclfFozBujdPHsq7wyQ6BAAAApE"]
[Mon Mar 30 01:19:18.757649 2026] [:error] [pid 8818:tid 8826] [client 68.155.145.150:12159] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "aclfFiCDvotZNSF0FBoQpgAAAUQ"]
[Mon Mar 30 01:19:19.242847 2026] [:error] [pid 32359:tid 32383] [client 68.155.145.150:12272] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "aclfFwMb8G3UzfQP3WhL6QAAANY"]
[Mon Mar 30 01:19:19.719575 2026] [:error] [pid 32359:tid 32368] [client 68.155.145.150:12063] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "aclfFwMb8G3UzfQP3WhL6wAAAMc"]
[Mon Mar 30 01:19:20.165593 2026] [:error] [pid 23167:tid 23171] [client 68.155.145.150:12043] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "aclfGBIAHJCFaHff3_f7VAAAAcE"]
[Mon Mar 30 01:19:20.599933 2026] [:error] [pid 23284:tid 23296] [client 68.155.145.150:12214] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "aclfGIzBujdPHsq7wyQ6BQAAAoo"]
[Mon Mar 30 01:19:21.033209 2026] [:error] [pid 32257:tid 32336] [client 68.155.145.150:11988] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aclfGSE3TArOFrUtgWq_TwAAAJI"]
[Mon Mar 30 01:19:21.506641 2026] [:error] [pid 32255:tid 32293] [client 68.155.145.150:12057] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aclfGWnfn-AtRoMbquxQQQAAAEI"]
[Mon Mar 30 01:19:22.029514 2026] [:error] [pid 32255:tid 32306] [client 68.155.145.150:12035] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aclfGmnfn-AtRoMbquxQQwAAAE8"]
[Mon Mar 30 01:19:22.455052 2026] [:error] [pid 32359:tid 32364] [client 68.155.145.150:12072] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "aclfGgMb8G3UzfQP3WhL7gAAAMM"]
[Mon Mar 30 01:19:22.942119 2026] [:error] [pid 23284:tid 23302] [client 68.155.145.150:12074] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5e0a.php"] [unique_id "aclfGozBujdPHsq7wyQ6BwAAApA"]
[Mon Mar 30 01:19:23.383709 2026] [:error] [pid 32257:tid 32333] [client 68.155.145.150:12132] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5e0a.php"] [unique_id "aclfGyE3TArOFrUtgWq_VQAAAI8"]
[Mon Mar 30 01:19:23.775421 2026] [:error] [pid 32255:tid 32296] [client 68.155.145.150:12280] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5e0a.php"] [unique_id "aclfG2nfn-AtRoMbquxQSAAAAEU"]
[Mon Mar 30 01:19:24.207508 2026] [:error] [pid 32257:tid 32320] [client 68.155.145.150:12281] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5e0a.php"] [unique_id "aclfHCE3TArOFrUtgWq_WwAAAII"]
[Mon Mar 30 01:19:24.600719 2026] [:error] [pid 23250:tid 23272] [client 68.155.145.150:12048] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/term.php"] [unique_id "aclfHJxrpj-dQjy1cvoteAAAAlQ"]
[Mon Mar 30 01:19:25.038674 2026] [:error] [pid 23167:tid 23179] [client 68.155.145.150:12195] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/term.php"] [unique_id "aclfHRIAHJCFaHff3_f7WwAAAck"]
[Mon Mar 30 01:19:25.432251 2026] [:error] [pid 32257:tid 32325] [client 68.155.145.150:12042] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/term.php"] [unique_id "aclfHSE3TArOFrUtgWq_XgAAAIc"]
[Mon Mar 30 01:19:25.839128 2026] [:error] [pid 23250:tid 23254] [client 68.155.145.150:12058] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/term.php"] [unique_id "aclfHZxrpj-dQjy1cvoteQAAAkI"]
[Mon Mar 30 01:19:26.259504 2026] [:error] [pid 32257:tid 32341] [client 68.155.145.150:12056] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aclfHiE3TArOFrUtgWq_ZQAAAJc"]
[Mon Mar 30 01:19:26.670579 2026] [:error] [pid 23137:tid 23148] [client 68.155.145.150:12061] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aclfHhaWQa7LdZ_qGFYe7QAAAYk"]
[Mon Mar 30 01:19:27.117129 2026] [:error] [pid 32257:tid 32323] [client 68.155.145.150:12036] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aclfHyE3TArOFrUtgWq_awAAAIU"]
[Mon Mar 30 01:19:27.549955 2026] [:error] [pid 23167:tid 23175] [client 68.155.145.150:12004] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aclfHxIAHJCFaHff3_f7XQAAAcU"]
[Mon Mar 30 01:19:27.978023 2026] [:error] [pid 8818:tid 8840] [client 68.155.145.150:12077] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/55b76.php"] [unique_id "aclfHyCDvotZNSF0FBoQqwAAAVI"]
[Mon Mar 30 01:19:28.379082 2026] [:error] [pid 23284:tid 23286] [client 68.155.145.150:12104] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/55b76.php"] [unique_id "aclfIIzBujdPHsq7wyQ6CwAAAoA"]
[Mon Mar 30 01:19:28.826659 2026] [:error] [pid 23168:tid 23217] [client 68.155.145.150:12083] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/55b76.php"] [unique_id "aclfIGP8p0yRL8ot_2_ofQAAAhQ"]
[Mon Mar 30 01:19:29.298859 2026] [:error] [pid 23167:tid 23181] [client 68.155.145.150:12037] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/55b76.php"] [unique_id "aclfIRIAHJCFaHff3_f7XgAAAcs"]
[Mon Mar 30 01:19:29.742576 2026] [:error] [pid 32257:tid 32335] [client 68.155.145.150:12051] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd.php"] [unique_id "aclfISE3TArOFrUtgWq_eAAAAJE"]
[Mon Mar 30 01:19:30.206871 2026] [:error] [pid 32257:tid 32320] [client 68.155.145.150:12000] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd.php"] [unique_id "aclfIiE3TArOFrUtgWq_fAAAAII"]
[Mon Mar 30 01:19:30.706368 2026] [:error] [pid 32257:tid 32341] [client 68.155.145.150:12182] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd.php"] [unique_id "aclfIiE3TArOFrUtgWq_ggAAAJc"]
[Mon Mar 30 01:19:31.472207 2026] [:error] [pid 32359:tid 32377] [client 68.155.145.150:11978] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd.php"] [unique_id "aclfIwMb8G3UzfQP3WhL8gAAANA"]
[Mon Mar 30 01:19:32.025111 2026] [:error] [pid 32254:tid 32284] [client 68.155.145.150:12055] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aclfJKug2IHuyGgCTn9zywAAABQ"]
[Mon Mar 30 01:19:32.552089 2026] [:error] [pid 23137:tid 23159] [client 68.155.145.150:12085] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aclfJBaWQa7LdZ_qGFYe8wAAAZQ"]
[Mon Mar 30 01:19:33.513379 2026] [:error] [pid 32255:tid 32311] [client 68.155.145.150:12032] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aclfJWnfn-AtRoMbquxQjAAAAFQ"]
[Mon Mar 30 01:19:34.138250 2026] [:error] [pid 23250:tid 23266] [client 68.155.145.150:12065] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aclfJpxrpj-dQjy1cvotfQAAAk4"]
[Mon Mar 30 01:19:34.706357 2026] [:error] [pid 23250:tid 23273] [client 68.155.145.150:12033] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aclfJpxrpj-dQjy1cvotfgAAAlU"]
[Mon Mar 30 01:19:35.495383 2026] [:error] [pid 32257:tid 32338] [client 68.155.145.150:12093] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aclfJyE3TArOFrUtgWq_iwAAAJQ"]
[Mon Mar 30 01:19:45.677546 2026] [:error] [pid 23137:tid 23152] [client 68.155.145.150:12095] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aclfMRaWQa7LdZ_qGFYfCgAAAY0"]
[Mon Mar 30 01:19:46.302914 2026] [:error] [pid 32255:tid 32299] [client 68.155.145.150:12255] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aclfMmnfn-AtRoMbquxQzAAAAEg"]
[Mon Mar 30 01:19:46.894141 2026] [:error] [pid 23167:tid 23174] [client 68.155.145.150:12002] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aclfMhIAHJCFaHff3_f7ZwAAAcQ"]
[Mon Mar 30 01:19:47.650778 2026] [:error] [pid 23250:tid 23253] [client 68.155.145.150:12024] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aclfM5xrpj-dQjy1cvothQAAAkE"]
[Mon Mar 30 01:19:48.165926 2026] [:error] [pid 23284:tid 23300] [client 68.155.145.150:12131] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aclfNIzBujdPHsq7wyQ6NAAAAo4"]
[Mon Mar 30 01:19:48.748226 2026] [:error] [pid 32255:tid 32305] [client 68.155.145.150:11982] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aclfNGnfn-AtRoMbquxQ0gAAAE4"]
[Mon Mar 30 01:19:49.337986 2026] [:error] [pid 8818:tid 8843] [client 68.155.145.150:12046] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aclfNSCDvotZNSF0FBoQ8QAAAVU"]
[Mon Mar 30 01:19:49.931680 2026] [:error] [pid 32255:tid 32301] [client 68.155.145.150:12064] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aclfNWnfn-AtRoMbquxQ1QAAAEo"]
[Mon Mar 30 01:19:50.605417 2026] [:error] [pid 32257:tid 32328] [client 68.155.145.150:12011] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccs.php"] [unique_id "aclfNiE3TArOFrUtgWq_wwAAAIo"]
[Mon Mar 30 01:19:51.086289 2026] [:error] [pid 23284:tid 23300] [client 68.155.145.150:12082] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccs.php"] [unique_id "aclfN4zBujdPHsq7wyQ6PwAAAo4"]
[Mon Mar 30 01:19:51.628960 2026] [:error] [pid 32257:tid 32336] [client 68.155.145.150:12069] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccs.php"] [unique_id "aclfNyE3TArOFrUtgWq_zwAAAJI"]
[Mon Mar 30 01:19:52.043073 2026] [:error] [pid 32257:tid 32323] [client 68.155.145.150:12151] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccs.php"] [unique_id "aclfOCE3TArOFrUtgWq_0wAAAIU"]
[Mon Mar 30 01:19:52.541997 2026] [:error] [pid 32257:tid 32334] [client 68.155.145.150:12089] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clss.php"] [unique_id "aclfOCE3TArOFrUtgWq_1wAAAJA"]
[Mon Mar 30 01:19:52.956583 2026] [:error] [pid 32255:tid 32298] [client 68.155.145.150:12100] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clss.php"] [unique_id "aclfOGnfn-AtRoMbquxQ3AAAAEc"]
[Mon Mar 30 01:19:53.401272 2026] [:error] [pid 32257:tid 32325] [client 68.155.145.150:12017] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clss.php"] [unique_id "aclfOSE3TArOFrUtgWq_2wAAAIc"]
[Mon Mar 30 01:19:53.857877 2026] [:error] [pid 32255:tid 32313] [client 68.155.145.150:11998] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clss.php"] [unique_id "aclfOWnfn-AtRoMbquxQ3wAAAFY"]
[Mon Mar 30 01:19:54.252726 2026] [:error] [pid 32257:tid 32337] [client 68.155.145.150:11977] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aclfOiE3TArOFrUtgWq_5QAAAJM"]
[Mon Mar 30 01:19:55.318640 2026] [:error] [pid 32254:tid 32284] [client 68.155.145.150:11979] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aclfO6ug2IHuyGgCTn9z1AAAABQ"]
[Mon Mar 30 01:19:55.805306 2026] [:error] [pid 32255:tid 32310] [client 68.155.145.150:12152] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aclfO2nfn-AtRoMbquxQ4wAAAFM"]
[Mon Mar 30 01:19:56.261481 2026] [:error] [pid 23167:tid 23183] [client 68.155.145.150:12009] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "aclfPBIAHJCFaHff3_f7dAAAAc0"]
[Mon Mar 30 01:19:56.646351 2026] [:error] [pid 23168:tid 23207] [client 68.155.145.150:12090] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aclfPGP8p0yRL8ot_2_ooQAAAgo"]
[Mon Mar 30 01:19:57.036201 2026] [:error] [pid 32254:tid 32272] [client 68.155.145.150:12050] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aclfPaug2IHuyGgCTn9z1gAAAAg"]
[Mon Mar 30 01:19:57.455020 2026] [:error] [pid 32359:tid 32377] [client 68.155.145.150:12187] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aclfPQMb8G3UzfQP3WhMDQAAANA"]
[Mon Mar 30 01:19:57.860800 2026] [:error] [pid 32257:tid 32332] [client 68.155.145.150:12014] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aclfPSE3TArOFrUtgWq_-AAAAI4"]
[Mon Mar 30 01:19:58.294626 2026] [:error] [pid 32257:tid 32321] [client 68.155.145.150:11995] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/init.php"] [unique_id "aclfPiE3TArOFrUtgWq__AAAAIM"]
[Mon Mar 30 01:19:58.678894 2026] [:error] [pid 32257:tid 32336] [client 68.155.145.150:12114] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/init.php"] [unique_id "aclfPiE3TArOFrUtgWrAAQAAAJI"]
[Mon Mar 30 01:19:59.113267 2026] [:error] [pid 32257:tid 32333] [client 68.155.145.150:12092] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/init.php"] [unique_id "aclfPyE3TArOFrUtgWrACAAAAI8"]
[Mon Mar 30 01:19:59.520995 2026] [:error] [pid 32257:tid 32322] [client 68.155.145.150:12047] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/init.php"] [unique_id "aclfPyE3TArOFrUtgWrADgAAAIQ"]
[Mon Mar 30 01:19:59.913780 2026] [:error] [pid 23168:tid 23201] [client 68.155.145.150:12176] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "aclfP2P8p0yRL8ot_2_oowAAAgQ"]
[Mon Mar 30 01:20:00.314359 2026] [:error] [pid 23168:tid 23214] [client 68.155.145.150:11973] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "aclfQGP8p0yRL8ot_2_opAAAAhE"]
[Mon Mar 30 01:20:00.716199 2026] [:error] [pid 8818:tid 8823] [client 68.155.145.150:11915] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "aclfQCCDvotZNSF0FBoQ_AAAAUE"]
[Mon Mar 30 01:20:01.230505 2026] [:error] [pid 23168:tid 23199] [client 68.155.145.150:11920] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "aclfQWP8p0yRL8ot_2_opgAAAgI"]
[Mon Mar 30 01:20:01.697478 2026] [:error] [pid 23284:tid 23293] [client 68.155.145.150:11971] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ajax.php"] [unique_id "aclfQYzBujdPHsq7wyQ6TQAAAoc"]
[Mon Mar 30 01:20:02.391476 2026] [:error] [pid 32257:tid 32322] [client 68.155.145.150:12034] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ajax.php"] [unique_id "aclfQiE3TArOFrUtgWrAFgAAAIQ"]
[Mon Mar 30 01:20:03.082018 2026] [:error] [pid 32257:tid 32330] [client 68.155.145.150:12030] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ajax.php"] [unique_id "aclfQyE3TArOFrUtgWrAFwAAAIw"]
[Mon Mar 30 01:20:03.719006 2026] [:error] [pid 23284:tid 23289] [client 68.155.145.150:11908] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ajax.php"] [unique_id "aclfQ4zBujdPHsq7wyQ6TwAAAoM"]
[Mon Mar 30 01:20:04.439774 2026] [:error] [pid 32255:tid 32314] [client 68.155.145.150:12021] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "aclfRGnfn-AtRoMbquxQ8gAAAFc"]
[Mon Mar 30 01:20:05.223340 2026] [:error] [pid 23167:tid 23186] [client 68.155.145.150:12081] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "aclfRRIAHJCFaHff3_f7gQAAAdA"]
[Mon Mar 30 01:20:05.934075 2026] [:error] [pid 23250:tid 23256] [client 68.155.145.150:11989] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "aclfRZxrpj-dQjy1cvotkQAAAkQ"]
[Mon Mar 30 01:20:06.350129 2026] [:error] [pid 32359:tid 32384] [client 68.155.145.150:12156] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "aclfRgMb8G3UzfQP3WhMFwAAANc"]
[Mon Mar 30 01:20:06.764467 2026] [:error] [pid 23284:tid 23307] [client 68.155.145.150:12118] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aclfRozBujdPHsq7wyQ6VgAAApU"]
[Mon Mar 30 01:20:07.181965 2026] [:error] [pid 23167:tid 23183] [client 68.155.145.150:11913] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aclfRxIAHJCFaHff3_f7hQAAAc0"]
[Mon Mar 30 01:20:07.622788 2026] [:error] [pid 23167:tid 23192] [client 68.155.145.150:11994] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aclfRxIAHJCFaHff3_f7iAAAAdY"]
[Mon Mar 30 01:20:08.080169 2026] [:error] [pid 32257:tid 32340] [client 68.155.145.150:12040] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aclfSCE3TArOFrUtgWrAOwAAAJY"]
[Mon Mar 30 01:20:08.568590 2026] [:error] [pid 32257:tid 32318] [client 68.155.145.150:12091] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aclfSCE3TArOFrUtgWrAPgAAAIA"]
[Mon Mar 30 01:20:09.220442 2026] [:error] [pid 23284:tid 23290] [client 68.155.145.150:11937] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aclfSYzBujdPHsq7wyQ6XAAAAoQ"]
[Mon Mar 30 01:20:09.607646 2026] [:error] [pid 23137:tid 23139] [client 68.155.145.150:12075] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aclfSRaWQa7LdZ_qGFYfIgAAAYA"]
[Mon Mar 30 01:20:10.034692 2026] [:error] [pid 23167:tid 23182] [client 68.155.145.150:12008] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aclfShIAHJCFaHff3_f7jQAAAcw"]
[Mon Mar 30 01:20:10.457883 2026] [:error] [pid 32255:tid 32293] [client 68.155.145.150:12073] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "aclfSmnfn-AtRoMbquxQ_wAAAEI"]
[Mon Mar 30 01:20:10.854453 2026] [:error] [pid 32255:tid 32307] [client 68.155.145.150:11990] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "aclfSmnfn-AtRoMbquxRAgAAAFA"]
[Mon Mar 30 01:20:11.283949 2026] [:error] [pid 32255:tid 32292] [client 68.155.145.150:12125] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "aclfS2nfn-AtRoMbquxRAwAAAEE"]
[Mon Mar 30 01:20:11.740568 2026] [:error] [pid 23284:tid 23305] [client 68.155.145.150:11969] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "aclfS4zBujdPHsq7wyQ6YAAAApM"]
[Mon Mar 30 01:20:12.241812 2026] [:error] [pid 23137:tid 23149] [client 68.155.145.150:12018] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws60.php"] [unique_id "aclfTBaWQa7LdZ_qGFYfJgAAAYo"]
[Mon Mar 30 01:20:12.771800 2026] [:error] [pid 8818:tid 8831] [client 68.155.145.150:11904] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws60.php"] [unique_id "aclfTCCDvotZNSF0FBoRCAAAAUk"]
[Mon Mar 30 01:20:13.260325 2026] [:error] [pid 8818:tid 8836] [client 68.155.145.150:12087] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws60.php"] [unique_id "aclfTSCDvotZNSF0FBoRCQAAAU4"]
[Mon Mar 30 01:20:13.655942 2026] [:error] [pid 32255:tid 32313] [client 68.155.145.150:11906] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws60.php"] [unique_id "aclfTWnfn-AtRoMbquxRCgAAAFY"]
[Mon Mar 30 01:20:14.079012 2026] [:error] [pid 23168:tid 23204] [client 68.155.145.150:12203] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aclfTmP8p0yRL8ot_2_osQAAAgc"]
[Mon Mar 30 01:20:14.486972 2026] [:error] [pid 23168:tid 23203] [client 68.155.145.150:11917] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aclfTmP8p0yRL8ot_2_otwAAAgY"]
[Mon Mar 30 01:20:14.958957 2026] [:error] [pid 32257:tid 32337] [client 68.155.145.150:12136] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aclfTiE3TArOFrUtgWrARwAAAJM"]
[Mon Mar 30 01:20:15.423700 2026] [:error] [pid 23168:tid 23197] [client 68.155.145.150:12144] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aclfT2P8p0yRL8ot_2_ovgAAAgA"]
[Mon Mar 30 01:20:15.854411 2026] [:error] [pid 23168:tid 23202] [client 68.155.145.150:12140] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "aclfT2P8p0yRL8ot_2_owQAAAgU"]
[Mon Mar 30 01:20:16.257488 2026] [:error] [pid 23284:tid 23288] [client 68.155.145.150:12007] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "aclfUIzBujdPHsq7wyQ6bgAAAoI"]
[Mon Mar 30 01:20:16.709501 2026] [:error] [pid 32255:tid 32312] [client 68.155.145.150:11976] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "aclfUGnfn-AtRoMbquxRDQAAAFU"]
[Mon Mar 30 01:20:17.104753 2026] [:error] [pid 32255:tid 32308] [client 68.155.145.150:12005] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "aclfUWnfn-AtRoMbquxREAAAAFE"]
[Mon Mar 30 01:20:17.489636 2026] [:error] [pid 32255:tid 32307] [client 68.155.145.150:11943] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myfile.php"] [unique_id "aclfUWnfn-AtRoMbquxREgAAAFA"]
[Mon Mar 30 01:20:17.884108 2026] [:error] [pid 23250:tid 23263] [client 68.155.145.150:11984] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myfile.php"] [unique_id "aclfUZxrpj-dQjy1cvotmgAAAks"]
[Mon Mar 30 01:20:18.277202 2026] [:error] [pid 32254:tid 32266] [client 68.155.145.150:11925] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myfile.php"] [unique_id "aclfUqug2IHuyGgCTn9z3QAAAAI"]
[Mon Mar 30 01:20:18.701115 2026] [:error] [pid 32255:tid 32295] [client 68.155.145.150:12006] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myfile.php"] [unique_id "aclfUmnfn-AtRoMbquxRIQAAAEQ"]
[Mon Mar 30 01:20:19.114096 2026] [:error] [pid 32255:tid 32299] [client 68.155.145.150:11905] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aclfU2nfn-AtRoMbquxRJwAAAEg"]
[Mon Mar 30 01:20:19.507299 2026] [:error] [pid 32254:tid 32281] [client 68.155.145.150:12012] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aclfU6ug2IHuyGgCTn9z3gAAABE"]
[Mon Mar 30 01:20:19.935820 2026] [:error] [pid 23284:tid 23299] [client 68.155.145.150:11910] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aclfU4zBujdPHsq7wyQ6cQAAAo0"]
[Mon Mar 30 01:20:20.367095 2026] [:error] [pid 23167:tid 23191] [client 68.155.145.150:11943] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aclfVBIAHJCFaHff3_f7lQAAAdU"]
[Mon Mar 30 01:20:20.786035 2026] [:error] [pid 32359:tid 32367] [client 68.155.145.150:11942] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/okxh.php"] [unique_id "aclfVAMb8G3UzfQP3WhMGgAAAMY"]
[Mon Mar 30 01:20:21.225578 2026] [:error] [pid 32255:tid 32312] [client 68.155.145.150:12044] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/okxh.php"] [unique_id "aclfVWnfn-AtRoMbquxRLgAAAFU"]
[Mon Mar 30 01:20:21.621890 2026] [:error] [pid 23167:tid 23182] [client 68.155.145.150:12015] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/okxh.php"] [unique_id "aclfVRIAHJCFaHff3_f7lwAAAcw"]
[Mon Mar 30 01:20:22.053518 2026] [:error] [pid 23167:tid 23184] [client 68.155.145.150:12277] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/okxh.php"] [unique_id "aclfVhIAHJCFaHff3_f7mAAAAc4"]
[Mon Mar 30 01:20:22.498504 2026] [:error] [pid 23168:tid 23208] [client 68.155.145.150:11840] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "aclfVmP8p0yRL8ot_2_oywAAAgs"]
[Mon Mar 30 01:20:22.940721 2026] [:error] [pid 8818:tid 8835] [client 68.155.145.150:12060] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "aclfViCDvotZNSF0FBoREAAAAU0"]
[Mon Mar 30 01:20:23.326882 2026] [:error] [pid 23167:tid 23187] [client 68.155.145.150:11986] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "aclfVxIAHJCFaHff3_f7mgAAAdE"]
[Mon Mar 30 01:20:23.757837 2026] [:error] [pid 8818:tid 8843] [client 68.155.145.150:12094] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "aclfVyCDvotZNSF0FBoREgAAAVU"]
[Mon Mar 30 01:20:24.151883 2026] [:error] [pid 23168:tid 23218] [client 68.155.145.150:11981] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-104.php"] [unique_id "aclfWGP8p0yRL8ot_2_ozgAAAhU"]
[Mon Mar 30 01:20:24.635484 2026] [:error] [pid 23284:tid 23288] [client 68.155.145.150:11924] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-104.php"] [unique_id "aclfWIzBujdPHsq7wyQ6fAAAAoI"]
[Mon Mar 30 01:20:25.088126 2026] [:error] [pid 23284:tid 23304] [client 68.155.145.150:11907] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-104.php"] [unique_id "aclfWYzBujdPHsq7wyQ6fwAAApI"]
[Mon Mar 30 01:20:25.497459 2026] [:error] [pid 23284:tid 23296] [client 68.155.145.150:11923] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-104.php"] [unique_id "aclfWYzBujdPHsq7wyQ6gwAAAoo"]
[Mon Mar 30 01:20:25.891626 2026] [:error] [pid 23167:tid 23175] [client 68.155.145.150:11916] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "aclfWRIAHJCFaHff3_f7oAAAAcU"]
[Mon Mar 30 01:20:26.303147 2026] [:error] [pid 23168:tid 23206] [client 68.155.145.150:11953] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "aclfWmP8p0yRL8ot_2_o0QAAAgk"]
[Mon Mar 30 01:20:26.745750 2026] [:error] [pid 32257:tid 32328] [client 68.155.145.150:11972] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "aclfWiE3TArOFrUtgWrATgAAAIo"]
[Mon Mar 30 01:20:27.145112 2026] [:error] [pid 23284:tid 23309] [client 68.155.145.150:12199] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "aclfW4zBujdPHsq7wyQ6hwAAApc"]
[Mon Mar 30 01:20:27.550214 2026] [:error] [pid 23284:tid 23293] [client 68.155.145.150:11970] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blogs.php"] [unique_id "aclfW4zBujdPHsq7wyQ6jgAAAoc"]
[Mon Mar 30 01:20:27.980252 2026] [:error] [pid 23284:tid 23302] [client 68.155.145.150:12031] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blogs.php"] [unique_id "aclfW4zBujdPHsq7wyQ6kwAAApA"]
[Mon Mar 30 01:20:28.367134 2026] [:error] [pid 23284:tid 23310] [client 68.155.145.150:11954] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blogs.php"] [unique_id "aclfXIzBujdPHsq7wyQ6lgAAApg"]
[Mon Mar 30 01:20:28.778216 2026] [:error] [pid 23284:tid 23308] [client 68.155.145.150:11974] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blogs.php"] [unique_id "aclfXIzBujdPHsq7wyQ6mQAAApY"]
[Mon Mar 30 01:20:29.171103 2026] [:error] [pid 23284:tid 23303] [client 68.155.145.150:12139] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aclfXYzBujdPHsq7wyQ6nwAAApE"]
[Mon Mar 30 01:20:29.585562 2026] [:error] [pid 23284:tid 23302] [client 68.155.145.150:11918] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aclfXYzBujdPHsq7wyQ6owAAApA"]
[Mon Mar 30 01:20:29.996678 2026] [:error] [pid 23284:tid 23304] [client 68.155.145.150:11992] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aclfXYzBujdPHsq7wyQ6qAAAApI"]
[Mon Mar 30 01:20:30.423332 2026] [:error] [pid 23168:tid 23202] [client 68.155.145.150:11911] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aclfXmP8p0yRL8ot_2_o0wAAAgU"]
[Mon Mar 30 01:20:30.851156 2026] [:error] [pid 23167:tid 23182] [client 68.155.145.150:12026] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "aclfXhIAHJCFaHff3_f7pQAAAcw"]
[Mon Mar 30 01:20:31.243856 2026] [:error] [pid 23284:tid 23292] [client 68.155.145.150:12053] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "aclfX4zBujdPHsq7wyQ6sgAAAoY"]
[Mon Mar 30 01:20:31.650085 2026] [:error] [pid 23137:tid 23156] [client 68.155.145.150:11985] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "aclfXxaWQa7LdZ_qGFYfMgAAAZE"]
[Mon Mar 30 01:20:32.053426 2026] [:error] [pid 23250:tid 23261] [client 68.155.145.150:11876] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "aclfYJxrpj-dQjy1cvotpQAAAkk"]
[Mon Mar 30 01:20:32.458566 2026] [:error] [pid 23250:tid 23259] [client 68.155.145.150:11951] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xfun.php"] [unique_id "aclfYJxrpj-dQjy1cvotpgAAAkc"]
[Mon Mar 30 01:20:32.872843 2026] [:error] [pid 23137:tid 23143] [client 68.155.145.150:12001] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xfun.php"] [unique_id "aclfYBaWQa7LdZ_qGFYfNQAAAYQ"]
[Mon Mar 30 01:20:33.300258 2026] [:error] [pid 32255:tid 32302] [client 68.155.145.150:11888] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xfun.php"] [unique_id "aclfYWnfn-AtRoMbquxRRAAAAEs"]
[Mon Mar 30 01:20:33.751733 2026] [:error] [pid 23250:tid 23252] [client 68.155.145.150:12063] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xfun.php"] [unique_id "aclfYZxrpj-dQjy1cvotqAAAAkA"]
[Mon Mar 30 01:20:34.174657 2026] [:error] [pid 32257:tid 32341] [client 68.155.145.150:12097] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "aclfYiE3TArOFrUtgWrAYQAAAJc"]
[Mon Mar 30 01:20:34.615408 2026] [:error] [pid 23168:tid 23198] [client 68.155.145.150:11932] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "aclfYmP8p0yRL8ot_2_o2wAAAgE"]
[Mon Mar 30 01:20:35.011312 2026] [:error] [pid 23284:tid 23308] [client 68.155.145.150:11991] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "aclfY4zBujdPHsq7wyQ6wAAAApY"]
[Mon Mar 30 01:20:35.397060 2026] [:error] [pid 32257:tid 32327] [client 68.155.145.150:11930] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "aclfYyE3TArOFrUtgWrAZgAAAIk"]
[Mon Mar 30 01:20:35.790084 2026] [:error] [pid 32257:tid 32333] [client 68.155.145.150:11854] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/155.php"] [unique_id "aclfYyE3TArOFrUtgWrAagAAAI8"]
[Mon Mar 30 01:20:36.242834 2026] [:error] [pid 32359:tid 32368] [client 68.155.145.150:11949] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/155.php"] [unique_id "aclfZAMb8G3UzfQP3WhMHwAAAMc"]
[Mon Mar 30 01:20:36.658173 2026] [:error] [pid 23250:tid 23253] [client 68.155.145.150:11928] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/155.php"] [unique_id "aclfZJxrpj-dQjy1cvotrAAAAkE"]
[Mon Mar 30 01:20:37.041012 2026] [:error] [pid 23250:tid 23262] [client 68.155.145.150:11778] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/155.php"] [unique_id "aclfZZxrpj-dQjy1cvotrQAAAko"]
[Mon Mar 30 01:20:37.424537 2026] [:error] [pid 23250:tid 23272] [client 68.155.145.150:11921] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rzki.php"] [unique_id "aclfZZxrpj-dQjy1cvotrwAAAlQ"]
[Mon Mar 30 01:20:37.941950 2026] [:error] [pid 23284:tid 23307] [client 68.155.145.150:12078] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rzki.php"] [unique_id "aclfZYzBujdPHsq7wyQ6yAAAApU"]
[Mon Mar 30 01:20:38.407053 2026] [:error] [pid 32257:tid 32321] [client 68.155.145.150:12010] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rzki.php"] [unique_id "aclfZiE3TArOFrUtgWrAcgAAAIM"]
[Mon Mar 30 01:20:38.830920 2026] [:error] [pid 23284:tid 23300] [client 68.155.145.150:11850] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rzki.php"] [unique_id "aclfZozBujdPHsq7wyQ60AAAAo4"]
[Mon Mar 30 01:20:39.217545 2026] [:error] [pid 23284:tid 23299] [client 68.155.145.150:12028] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aclfZ4zBujdPHsq7wyQ60wAAAo0"]
[Mon Mar 30 01:20:39.669877 2026] [:error] [pid 23168:tid 23206] [client 68.155.145.150:11999] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aclfZ2P8p0yRL8ot_2_o4AAAAgk"]
[Mon Mar 30 01:20:40.052029 2026] [:error] [pid 32255:tid 32305] [client 68.155.145.150:11868] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aclfaGnfn-AtRoMbquxRUQAAAE4"]
[Mon Mar 30 01:20:40.436136 2026] [:error] [pid 32255:tid 32297] [client 68.155.145.150:11964] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aclfaGnfn-AtRoMbquxRVAAAAEY"]
[Mon Mar 30 01:20:40.819096 2026] [:error] [pid 23168:tid 23217] [client 68.155.145.150:12165] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws49.php"] [unique_id "aclfaGP8p0yRL8ot_2_o5QAAAhQ"]
[Mon Mar 30 01:20:41.205198 2026] [:error] [pid 32254:tid 32275] [client 68.155.145.150:11980] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws49.php"] [unique_id "aclfaaug2IHuyGgCTn9z5QAAAAs"]
[Mon Mar 30 01:20:41.644634 2026] [:error] [pid 8818:tid 8831] [client 68.155.145.150:11967] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws49.php"] [unique_id "aclfaSCDvotZNSF0FBoRIgAAAUk"]
[Mon Mar 30 01:20:42.064935 2026] [:error] [pid 23250:tid 23264] [client 68.155.145.150:11966] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws49.php"] [unique_id "aclfapxrpj-dQjy1cvotsAAAAkw"]
[Mon Mar 30 01:20:42.499586 2026] [:error] [pid 32359:tid 32378] [client 68.155.145.150:11863] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tool.php"] [unique_id "aclfagMb8G3UzfQP3WhMJwAAANE"]
[Mon Mar 30 01:20:42.942787 2026] [:error] [pid 32255:tid 32295] [client 68.155.145.150:11793] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tool.php"] [unique_id "aclfamnfn-AtRoMbquxRXQAAAEQ"]
[Mon Mar 30 01:20:43.353378 2026] [:error] [pid 32257:tid 32326] [client 68.155.145.150:11983] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tool.php"] [unique_id "aclfayE3TArOFrUtgWrAfwAAAIg"]
[Mon Mar 30 01:20:43.775657 2026] [:error] [pid 32359:tid 32363] [client 68.155.145.150:11914] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tool.php"] [unique_id "aclfawMb8G3UzfQP3WhMKgAAAMI"]
[Mon Mar 30 01:20:54.444038 2026] [:error] [pid 32359:tid 32380] [client 68.155.145.150:12016] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/wp-blog.php"] [unique_id "aclfdgMb8G3UzfQP3WhMSgAAANM"]
[Mon Mar 30 01:20:55.006746 2026] [:error] [pid 8818:tid 8837] [client 68.155.145.150:11865] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/wp-blog.php"] [unique_id "aclfdyCDvotZNSF0FBoRNAAAAU8"]
[Mon Mar 30 01:20:55.496321 2026] [:error] [pid 8818:tid 8835] [client 68.155.145.150:12025] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/wp-blog.php"] [unique_id "aclfdyCDvotZNSF0FBoRNgAAAU0"]
[Mon Mar 30 01:20:55.997405 2026] [:error] [pid 32257:tid 32319] [client 68.155.145.150:11862] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/wp-blog.php"] [unique_id "aclfdyE3TArOFrUtgWrAjQAAAIE"]
[Mon Mar 30 01:20:56.461836 2026] [:error] [pid 32255:tid 32302] [client 68.155.145.150:11956] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws88.php"] [unique_id "aclfeGnfn-AtRoMbquxRiAAAAEs"]
[Mon Mar 30 01:20:57.110160 2026] [:error] [pid 32257:tid 32335] [client 68.155.145.150:11936] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws88.php"] [unique_id "aclfeSE3TArOFrUtgWrAlAAAAJE"]
[Mon Mar 30 01:20:57.635711 2026] [:error] [pid 23168:tid 23211] [client 68.155.145.150:11847] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws88.php"] [unique_id "aclfeWP8p0yRL8ot_2_o-gAAAg4"]
[Mon Mar 30 01:20:58.087608 2026] [:error] [pid 32255:tid 32298] [client 68.155.145.150:11890] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws88.php"] [unique_id "aclfemnfn-AtRoMbquxRjQAAAEc"]
[Mon Mar 30 01:20:58.627389 2026] [:error] [pid 8818:tid 8840] [client 68.155.145.150:11866] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/csv.php"] [unique_id "aclfeiCDvotZNSF0FBoRPAAAAVI"]
[Mon Mar 30 01:20:59.122768 2026] [:error] [pid 32257:tid 32331] [client 68.155.145.150:11870] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/csv.php"] [unique_id "aclfeyE3TArOFrUtgWrAowAAAI0"]
[Mon Mar 30 01:20:59.615767 2026] [:error] [pid 23167:tid 23192] [client 68.155.145.150:11965] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/csv.php"] [unique_id "aclfexIAHJCFaHff3_f7xAAAAdY"]
[Mon Mar 30 01:21:00.035719 2026] [:error] [pid 32257:tid 32322] [client 68.155.145.150:11892] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/csv.php"] [unique_id "aclffCE3TArOFrUtgWrArAAAAIQ"]
[Mon Mar 30 01:21:00.449033 2026] [:error] [pid 23167:tid 23184] [client 68.155.145.150:11962] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/varb.php"] [unique_id "aclffBIAHJCFaHff3_f7ygAAAc4"]
[Mon Mar 30 01:21:00.881645 2026] [:error] [pid 8818:tid 8843] [client 68.155.145.150:11955] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/varb.php"] [unique_id "aclffCCDvotZNSF0FBoRPwAAAVU"]
[Mon Mar 30 01:21:01.307760 2026] [:error] [pid 32254:tid 32272] [client 68.155.145.150:11803] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/varb.php"] [unique_id "aclffaug2IHuyGgCTn9z7AAAAAg"]
[Mon Mar 30 01:21:01.697726 2026] [:error] [pid 23284:tid 23290] [client 68.155.145.150:11996] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/varb.php"] [unique_id "aclffYzBujdPHsq7wyQ6-wAAAoQ"]
[Mon Mar 30 01:21:02.094156 2026] [:error] [pid 23250:tid 23252] [client 68.155.145.150:12027] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8573.php"] [unique_id "aclffpxrpj-dQjy1cvotuQAAAkA"]
[Mon Mar 30 01:21:02.543788 2026] [:error] [pid 23168:tid 23218] [client 68.155.145.150:11879] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8573.php"] [unique_id "aclffmP8p0yRL8ot_2_pAwAAAhU"]
[Mon Mar 30 01:21:02.976610 2026] [:error] [pid 23284:tid 23305] [client 68.155.145.150:12029] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8573.php"] [unique_id "aclffozBujdPHsq7wyQ6_wAAApM"]
[Mon Mar 30 01:21:03.359692 2026] [:error] [pid 23284:tid 23307] [client 68.155.145.150:11861] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8573.php"] [unique_id "aclff4zBujdPHsq7wyQ7AAAAApU"]
[Mon Mar 30 01:21:03.767982 2026] [:error] [pid 32257:tid 32318] [client 68.155.145.150:11959] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "aclffyE3TArOFrUtgWrAuwAAAIA"]
[Mon Mar 30 01:21:04.192765 2026] [:error] [pid 32255:tid 32315] [client 68.155.145.150:12020] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "aclfgGnfn-AtRoMbquxRlgAAAFg"]
[Mon Mar 30 01:21:04.604125 2026] [:error] [pid 23284:tid 23297] [client 68.155.145.150:11929] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "aclfgIzBujdPHsq7wyQ7BAAAAos"]
[Mon Mar 30 01:21:05.013976 2026] [:error] [pid 23284:tid 23303] [client 68.155.145.150:12086] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "aclfgYzBujdPHsq7wyQ7BwAAApE"]
[Mon Mar 30 01:21:05.422431 2026] [:error] [pid 32254:tid 32278] [client 68.155.145.150:12207] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-png.php"] [unique_id "aclfgaug2IHuyGgCTn9z8QAAAA4"]
[Mon Mar 30 01:21:05.834668 2026] [:error] [pid 23137:tid 23139] [client 68.155.145.150:12145] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-png.php"] [unique_id "aclfgRaWQa7LdZ_qGFYfTwAAAYA"]
[Mon Mar 30 01:21:06.260467 2026] [:error] [pid 23137:tid 23161] [client 68.155.145.150:11940] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-png.php"] [unique_id "aclfghaWQa7LdZ_qGFYfUgAAAZY"]
[Mon Mar 30 01:21:06.748182 2026] [:error] [pid 23250:tid 23253] [client 68.155.145.150:11958] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-png.php"] [unique_id "aclfgpxrpj-dQjy1cvotvgAAAkE"]
[Mon Mar 30 01:21:07.187133 2026] [:error] [pid 23250:tid 23267] [client 68.155.145.150:11858] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aclfg5xrpj-dQjy1cvotvwAAAk8"]
[Mon Mar 30 01:21:07.608203 2026] [:error] [pid 23168:tid 23213] [client 68.155.145.150:11947] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aclfg2P8p0yRL8ot_2_pCwAAAhA"]
[Mon Mar 30 01:21:08.025867 2026] [:error] [pid 32359:tid 32367] [client 68.155.145.150:12052] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aclfhAMb8G3UzfQP3WhMYQAAAMY"]
[Mon Mar 30 01:21:08.464249 2026] [:error] [pid 32254:tid 32287] [client 68.155.145.150:11842] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aclfhKug2IHuyGgCTn9z-QAAABc"]
[Mon Mar 30 01:21:08.906601 2026] [:error] [pid 32254:tid 32269] [client 68.155.145.150:11899] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "aclfhKug2IHuyGgCTn9z_AAAAAU"]
[Mon Mar 30 01:21:09.327772 2026] [:error] [pid 23167:tid 23193] [client 68.155.145.150:11975] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "aclfhRIAHJCFaHff3_f7zgAAAdc"]
[Mon Mar 30 01:21:09.732197 2026] [:error] [pid 8818:tid 8828] [client 68.155.145.150:11780] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "aclfhSCDvotZNSF0FBoRSAAAAUY"]
[Mon Mar 30 01:21:10.141739 2026] [:error] [pid 23167:tid 23172] [client 68.155.145.150:11891] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "aclfhhIAHJCFaHff3_f70gAAAcI"]
[Mon Mar 30 01:21:10.596203 2026] [:error] [pid 23284:tid 23295] [client 68.155.145.150:11782] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin-footer.php"] [unique_id "aclfhozBujdPHsq7wyQ7FgAAAok"]
[Mon Mar 30 01:21:11.005308 2026] [:error] [pid 23284:tid 23306] [client 68.155.145.150:11934] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin-footer.php"] [unique_id "aclfh4zBujdPHsq7wyQ7HAAAApQ"]
[Mon Mar 30 01:21:11.417180 2026] [:error] [pid 32254:tid 32277] [client 68.155.145.150:12023] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin-footer.php"] [unique_id "aclfh6ug2IHuyGgCTn90AAAAAA0"]
[Mon Mar 30 01:21:11.842904 2026] [:error] [pid 23168:tid 23217] [client 68.155.145.150:11933] [client 68.155.145.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin-footer.php"] [unique_id "aclfh2P8p0yRL8ot_2_pEAAAAhQ"]
[Mon Mar 30 01:35:16.694090 2026] [:error] [pid 23167:tid 23175] [client 40.75.84.21:44691] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/anz.php"] [unique_id "acli1BIAHJCFaHff3_cAnQAAAcU"]
[Mon Mar 30 01:35:17.292701 2026] [:error] [pid 32257:tid 32325] [client 40.75.84.21:53553] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/anz.php"] [unique_id "acli1SE3TArOFrUtgWrLTgAAAIc"]
[Mon Mar 30 01:35:17.757682 2026] [:error] [pid 23168:tid 23200] [client 40.75.84.21:5507] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/anz.php"] [unique_id "acli1WP8p0yRL8ot_2_vHgAAAgM"]
[Mon Mar 30 01:35:18.178897 2026] [:error] [pid 23168:tid 23218] [client 40.75.84.21:52528] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/anz.php"] [unique_id "acli1mP8p0yRL8ot_2_vHwAAAhU"]
[Mon Mar 30 01:35:18.962003 2026] [:error] [pid 8818:tid 8827] [client 40.75.84.21:34017] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "acli1iCDvotZNSF0FBoVlQAAAUU"]
[Mon Mar 30 01:35:19.873592 2026] [:error] [pid 23167:tid 23180] [client 40.75.84.21:51233] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "acli1xIAHJCFaHff3_cAoAAAAco"]
[Mon Mar 30 01:35:22.093401 2026] [:error] [pid 23168:tid 23214] [client 40.75.84.21:5504] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "acli2mP8p0yRL8ot_2_vJQAAAhE"]
[Mon Mar 30 01:35:23.999153 2026] [:error] [pid 23168:tid 23212] [client 40.75.84.21:53565] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "acli22P8p0yRL8ot_2_vJgAAAg8"]
[Mon Mar 30 01:35:25.784115 2026] [:error] [pid 32254:tid 32281] [client 40.75.84.21:5516] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file66.php"] [unique_id "acli3aug2IHuyGgCTn92RwAAABE"]
[Mon Mar 30 01:35:27.370015 2026] [:error] [pid 23137:tid 23154] [client 40.75.84.21:34037] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file66.php"] [unique_id "acli3xaWQa7LdZ_qGFYjKAAAAY8"]
[Mon Mar 30 01:35:28.555359 2026] [:error] [pid 32255:tid 32296] [client 40.75.84.21:5874] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file66.php"] [unique_id "acli4Gnfn-AtRoMbquxZPwAAAEU"]
[Mon Mar 30 01:35:29.507565 2026] [:error] [pid 23167:tid 23176] [client 40.75.84.21:51254] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file66.php"] [unique_id "acli4RIAHJCFaHff3_cArgAAAcY"]
[Mon Mar 30 01:35:30.627940 2026] [:error] [pid 23284:tid 23310] [client 40.75.84.21:53508] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kure.php"] [unique_id "acli4ozBujdPHsq7wyREdQAAApg"]
[Mon Mar 30 01:35:32.190034 2026] [:error] [pid 23250:tid 23275] [client 40.75.84.21:5548] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kure.php"] [unique_id "acli5Jxrpj-dQjy1cvoyMAAAAlc"]
[Mon Mar 30 01:35:32.941030 2026] [:error] [pid 32257:tid 32335] [client 40.75.84.21:53548] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kure.php"] [unique_id "acli5CE3TArOFrUtgWrLcgAAAJE"]
[Mon Mar 30 01:35:33.586293 2026] [:error] [pid 32257:tid 32326] [client 40.75.84.21:5558] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kure.php"] [unique_id "acli5SE3TArOFrUtgWrLdAAAAIg"]
[Mon Mar 30 01:35:34.280772 2026] [:error] [pid 32255:tid 32305] [client 40.75.84.21:63705] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blnux.php"] [unique_id "acli5mnfn-AtRoMbquxZSgAAAE4"]
[Mon Mar 30 01:35:34.818156 2026] [:error] [pid 23284:tid 23287] [client 40.75.84.21:53513] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blnux.php"] [unique_id "acli5ozBujdPHsq7wyREfgAAAoE"]
[Mon Mar 30 01:35:35.309078 2026] [:error] [pid 23284:tid 23289] [client 40.75.84.21:44703] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blnux.php"] [unique_id "acli54zBujdPHsq7wyREfwAAAoM"]
[Mon Mar 30 01:35:35.737295 2026] [:error] [pid 32254:tid 32266] [client 40.75.84.21:54794] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blnux.php"] [unique_id "acli56ug2IHuyGgCTn92VAAAAAI"]
[Mon Mar 30 01:35:36.323802 2026] [:error] [pid 23250:tid 23254] [client 40.75.84.21:52537] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gaje.php"] [unique_id "acli6Jxrpj-dQjy1cvoyMQAAAkI"]
[Mon Mar 30 01:35:36.736661 2026] [:error] [pid 32255:tid 32299] [client 40.75.84.21:34042] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gaje.php"] [unique_id "acli6Gnfn-AtRoMbquxZTQAAAEg"]
[Mon Mar 30 01:35:37.210425 2026] [:error] [pid 32257:tid 32328] [client 40.75.84.21:5885] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gaje.php"] [unique_id "acli6SE3TArOFrUtgWrLeAAAAIo"]
[Mon Mar 30 01:35:37.610859 2026] [:error] [pid 23284:tid 23295] [client 40.75.84.21:5846] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gaje.php"] [unique_id "acli6YzBujdPHsq7wyREgwAAAok"]
[Mon Mar 30 01:35:38.019761 2026] [:error] [pid 23284:tid 23308] [client 40.75.84.21:44678] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/msy.php"] [unique_id "acli6ozBujdPHsq7wyREhgAAApY"]
[Mon Mar 30 01:35:38.561296 2026] [:error] [pid 23284:tid 23296] [client 40.75.84.21:5531] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/msy.php"] [unique_id "acli6ozBujdPHsq7wyREigAAAoo"]
[Mon Mar 30 01:35:39.222999 2026] [:error] [pid 23250:tid 23270] [client 40.75.84.21:54800] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/msy.php"] [unique_id "acli65xrpj-dQjy1cvoyNgAAAlI"]
[Mon Mar 30 01:35:40.280018 2026] [:error] [pid 23284:tid 23305] [client 40.75.84.21:44694] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/msy.php"] [unique_id "acli7IzBujdPHsq7wyREjgAAApM"]
[Mon Mar 30 01:35:40.931972 2026] [:error] [pid 23284:tid 23292] [client 40.75.84.21:52543] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fgd.php"] [unique_id "acli7IzBujdPHsq7wyREkAAAAoY"]
[Mon Mar 30 01:35:41.510734 2026] [:error] [pid 32255:tid 32296] [client 40.75.84.21:51317] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fgd.php"] [unique_id "acli7Wnfn-AtRoMbquxZWQAAAEU"]
[Mon Mar 30 01:35:42.363404 2026] [:error] [pid 32257:tid 32325] [client 40.75.84.21:53526] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fgd.php"] [unique_id "acli7iE3TArOFrUtgWrLiAAAAIc"]
[Mon Mar 30 01:35:42.958181 2026] [:error] [pid 32255:tid 32294] [client 40.75.84.21:34012] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fgd.php"] [unique_id "acli7mnfn-AtRoMbquxZXAAAAEM"]
[Mon Mar 30 01:35:43.837131 2026] [:error] [pid 23168:tid 23208] [client 40.75.84.21:40150] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X7T6.php"] [unique_id "acli72P8p0yRL8ot_2_vLgAAAgs"]
[Mon Mar 30 01:35:44.377863 2026] [:error] [pid 32257:tid 32336] [client 40.75.84.21:34023] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X7T6.php"] [unique_id "acli8CE3TArOFrUtgWrLjgAAAJI"]
[Mon Mar 30 01:35:44.888077 2026] [:error] [pid 23250:tid 23269] [client 40.75.84.21:53556] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X7T6.php"] [unique_id "acli8Jxrpj-dQjy1cvoyPAAAAlE"]
[Mon Mar 30 01:35:45.312362 2026] [:error] [pid 32257:tid 32323] [client 40.75.84.21:52513] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X7T6.php"] [unique_id "acli8SE3TArOFrUtgWrLkQAAAIU"]
[Mon Mar 30 01:35:46.370133 2026] [:error] [pid 32257:tid 32329] [client 40.75.84.21:53519] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alog.php"] [unique_id "acli8iE3TArOFrUtgWrLkwAAAIs"]
[Mon Mar 30 01:35:47.087253 2026] [:error] [pid 32257:tid 32321] [client 40.75.84.21:40144] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alog.php"] [unique_id "acli8yE3TArOFrUtgWrLmAAAAIM"]
[Mon Mar 30 01:35:47.962104 2026] [:error] [pid 32255:tid 32308] [client 40.75.84.21:5490] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alog.php"] [unique_id "acli82nfn-AtRoMbquxZYgAAAFE"]
[Mon Mar 30 01:35:49.300940 2026] [:error] [pid 23168:tid 23199] [client 40.75.84.21:52490] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alog.php"] [unique_id "acli9WP8p0yRL8ot_2_vMwAAAgI"]
[Mon Mar 30 01:35:49.864695 2026] [:error] [pid 23250:tid 23274] [client 40.75.84.21:35893] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "acli9Zxrpj-dQjy1cvoyQAAAAlY"]
[Mon Mar 30 01:35:50.313964 2026] [:error] [pid 32255:tid 32303] [client 40.75.84.21:44679] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "acli9mnfn-AtRoMbquxZcQAAAEw"]
[Mon Mar 30 01:35:50.771756 2026] [:error] [pid 32255:tid 32299] [client 40.75.84.21:38381] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "acli9mnfn-AtRoMbquxZdgAAAEg"]
[Mon Mar 30 01:35:51.402458 2026] [:error] [pid 32359:tid 32373] [client 40.75.84.21:34005] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "acli9wMb8G3UzfQP3WhPWwAAAMw"]
[Mon Mar 30 01:35:52.050288 2026] [:error] [pid 32359:tid 32378] [client 40.75.84.21:49758] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sef.php"] [unique_id "acli-AMb8G3UzfQP3WhPXAAAANE"]
[Mon Mar 30 01:35:52.578019 2026] [:error] [pid 32257:tid 32319] [client 40.75.84.21:42501] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sef.php"] [unique_id "acli-CE3TArOFrUtgWrLoAAAAIE"]
[Mon Mar 30 01:35:53.762280 2026] [:error] [pid 23250:tid 23271] [client 40.75.84.21:54842] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sef.php"] [unique_id "acli-Zxrpj-dQjy1cvoyQwAAAlM"]
[Mon Mar 30 01:35:55.242803 2026] [:error] [pid 23284:tid 23298] [client 40.75.84.21:53614] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sef.php"] [unique_id "acli-4zBujdPHsq7wyRElgAAAow"]
[Mon Mar 30 01:35:55.958641 2026] [:error] [pid 32254:tid 32282] [client 40.75.84.21:5150] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ztv.php"] [unique_id "acli-6ug2IHuyGgCTn92bAAAABI"]
[Mon Mar 30 01:35:56.412177 2026] [:error] [pid 32255:tid 32303] [client 40.75.84.21:64231] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ztv.php"] [unique_id "acli_Gnfn-AtRoMbquxZgwAAAEw"]
[Mon Mar 30 01:35:56.991137 2026] [:error] [pid 23284:tid 23308] [client 40.75.84.21:5174] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ztv.php"] [unique_id "acli_IzBujdPHsq7wyREmgAAApY"]
[Mon Mar 30 01:35:57.479864 2026] [:error] [pid 32254:tid 32287] [client 40.75.84.21:5624] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ztv.php"] [unique_id "acli_aug2IHuyGgCTn92bgAAABc"]
[Mon Mar 30 01:35:59.619688 2026] [:error] [pid 23168:tid 23220] [client 40.75.84.21:47853] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Rk41.php"] [unique_id "acli_2P8p0yRL8ot_2_vPQAAAhc"]
[Mon Mar 30 01:36:00.086171 2026] [:error] [pid 32257:tid 32336] [client 40.75.84.21:36383] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Rk41.php"] [unique_id "acljACE3TArOFrUtgWrLrgAAAJI"]
[Mon Mar 30 01:36:00.634102 2026] [:error] [pid 32255:tid 32301] [client 40.75.84.21:47767] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Rk41.php"] [unique_id "acljAGnfn-AtRoMbquxZjAAAAEo"]
[Mon Mar 30 01:36:01.048154 2026] [:error] [pid 32359:tid 32384] [client 40.75.84.21:46410] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Rk41.php"] [unique_id "acljAQMb8G3UzfQP3WhPXgAAANc"]
[Mon Mar 30 01:36:01.452190 2026] [:error] [pid 32359:tid 32385] [client 40.75.84.21:5621] [client 40.75.84.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/network.php"] [unique_id "acljAQMb8G3UzfQP3WhPXwAAANg"]
[Mon Mar 30 01:36:01.855842 2026] [:error] [pid 32359:tid 32379] [client 40.75.84.21:47807] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "acljAQMb8G3UzfQP3WhPYAAAANI"]
[Mon Mar 30 01:36:02.366287 2026] [:error] [pid 23168:tid 23208] [client 40.75.84.21:36460] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "acljAmP8p0yRL8ot_2_vRwAAAgs"]
[Mon Mar 30 01:36:02.805507 2026] [:error] [pid 32254:tid 32269] [client 40.75.84.21:37742] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "acljAqug2IHuyGgCTn92cgAAAAU"]
[Mon Mar 30 01:36:03.344852 2026] [:error] [pid 23284:tid 23302] [client 40.75.84.21:46420] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade-temp-backup/wp-login.php"] [unique_id "acljA4zBujdPHsq7wyREpgAAApA"]
[Mon Mar 30 01:36:03.750689 2026] [:error] [pid 32255:tid 32295] [client 40.75.84.21:6098] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/fm.php"] [unique_id "acljA2nfn-AtRoMbquxZkgAAAEQ"]
[Mon Mar 30 01:36:04.150678 2026] [:error] [pid 32255:tid 32315] [client 40.75.84.21:59960] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/fm.php"] [unique_id "acljBGnfn-AtRoMbquxZkwAAAFg"]
[Mon Mar 30 01:36:04.799893 2026] [:error] [pid 32254:tid 32264] [client 40.75.84.21:57623] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/fm.php"] [unique_id "acljBKug2IHuyGgCTn92dAAAAAA"]
[Mon Mar 30 01:36:05.276319 2026] [:error] [pid 23137:tid 23150] [client 40.75.84.21:48472] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/fm.php"] [unique_id "acljBRaWQa7LdZ_qGFYjNQAAAYs"]
[Mon Mar 30 01:36:05.797551 2026] [:error] [pid 32255:tid 32292] [client 40.75.84.21:59926] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "acljBWnfn-AtRoMbquxZmQAAAEE"]
[Mon Mar 30 01:36:06.307807 2026] [:error] [pid 23137:tid 23155] [client 40.75.84.21:36424] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "acljBhaWQa7LdZ_qGFYjNgAAAZA"]
[Mon Mar 30 01:36:06.949953 2026] [:error] [pid 32255:tid 32297] [client 40.75.84.21:58643] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "acljBmnfn-AtRoMbquxZnAAAAEY"]
[Mon Mar 30 01:36:07.692539 2026] [:error] [pid 32255:tid 32308] [client 40.75.84.21:5507] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/inc/ki1k.php"] [unique_id "acljB2nfn-AtRoMbquxZnQAAAFE"]
[Mon Mar 30 01:36:09.019290 2026] [:error] [pid 8818:tid 8822] [client 40.75.84.21:58628] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/WordPress/wp-admin/includes/zmFM.php"] [unique_id "acljCSCDvotZNSF0FBoVqgAAAUA"]
[Mon Mar 30 01:36:10.012817 2026] [:error] [pid 32255:tid 32292] [client 40.75.84.21:54166] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/WordPress/wp-admin/includes/zmFM.php"] [unique_id "acljCmnfn-AtRoMbquxZowAAAEE"]
[Mon Mar 30 01:36:10.799830 2026] [:error] [pid 32255:tid 32291] [client 40.75.84.21:58659] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/WordPress/wp-admin/includes/zmFM.php"] [unique_id "acljCmnfn-AtRoMbquxZpQAAAEA"]
[Mon Mar 30 01:36:13.622403 2026] [:error] [pid 23250:tid 23258] [client 40.75.84.21:62410] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/WordPress/wp-admin/includes/zmFM.php"] [unique_id "acljDZxrpj-dQjy1cvoyTgAAAkY"]
[Mon Mar 30 01:36:14.518641 2026] [:error] [pid 23250:tid 23270] [client 40.75.84.21:54184] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "acljDpxrpj-dQjy1cvoyTwAAAlI"]
[Mon Mar 30 01:36:18.333454 2026] [:error] [pid 23137:tid 23148] [client 40.75.84.21:54207] [client 40.75.84.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "acljEhaWQa7LdZ_qGFYjXAAAAYk"]
[Mon Mar 30 01:36:25.751859 2026] [:error] [pid 32254:tid 32280] [client 40.75.84.21:57620] [client 40.75.84.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.75.84.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acljGaug2IHuyGgCTn92dgAAABA"]
[Mon Mar 30 01:36:30.264094 2026] [:error] [pid 23137:tid 23156] [client 40.75.84.21:64531] [client 40.75.84.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "acljHhaWQa7LdZ_qGFYjcQAAAZE"]
[Mon Mar 30 01:36:30.914064 2026] [:error] [pid 32255:tid 32297] [client 40.75.84.21:46934] [client 40.75.84.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "acljHmnfn-AtRoMbquxZxwAAAEY"]
[Mon Mar 30 01:36:31.588931 2026] [:error] [pid 32257:tid 32340] [client 40.75.84.21:50312] [client 40.75.84.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "acljHyE3TArOFrUtgWrL7AAAAJY"]
[Mon Mar 30 01:36:33.515409 2026] [:error] [pid 23167:tid 23190] [client 40.75.84.21:50341] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/install.php"] [unique_id "acljIRIAHJCFaHff3_cA1AAAAdQ"]
[Mon Mar 30 01:36:34.353227 2026] [:error] [pid 32257:tid 32323] [client 40.75.84.21:52966] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/install.php"] [unique_id "acljIiE3TArOFrUtgWrL9AAAAIU"]
[Mon Mar 30 01:36:35.342009 2026] [:error] [pid 32359:tid 32372] [client 40.75.84.21:42605] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/install.php"] [unique_id "acljIwMb8G3UzfQP3WhPcgAAAMs"]
[Mon Mar 30 01:36:36.040960 2026] [:error] [pid 32255:tid 32314] [client 40.75.84.21:46935] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/install.php"] [unique_id "acljJGnfn-AtRoMbquxZ3QAAAFc"]
[Mon Mar 30 01:36:36.793592 2026] [:error] [pid 32255:tid 32312] [client 40.75.84.21:42562] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/link.php"] [unique_id "acljJGnfn-AtRoMbquxZ3wAAAFU"]
[Mon Mar 30 01:36:37.341670 2026] [:error] [pid 32255:tid 32299] [client 40.75.84.21:64538] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/link.php"] [unique_id "acljJWnfn-AtRoMbquxZ4QAAAEg"]
[Mon Mar 30 01:36:38.341526 2026] [:error] [pid 23250:tid 23258] [client 40.75.84.21:52965] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/link.php"] [unique_id "acljJpxrpj-dQjy1cvoyZQAAAkY"]
[Mon Mar 30 01:36:38.961802 2026] [:error] [pid 23167:tid 23179] [client 40.75.84.21:42580] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/link.php"] [unique_id "acljJhIAHJCFaHff3_cA2AAAAck"]
[Mon Mar 30 01:36:39.700039 2026] [:error] [pid 32257:tid 32321] [client 40.75.84.21:37634] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/chosen.php"] [unique_id "acljJyE3TArOFrUtgWrMBQAAAIM"]
[Mon Mar 30 01:36:40.358637 2026] [:error] [pid 23167:tid 23191] [client 40.75.84.21:57630] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/chosen.php"] [unique_id "acljKBIAHJCFaHff3_cA3AAAAdU"]
[Mon Mar 30 01:36:41.213647 2026] [:error] [pid 32255:tid 32303] [client 40.75.84.21:37673] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/chosen.php"] [unique_id "acljKWnfn-AtRoMbquxZ7wAAAEw"]
[Mon Mar 30 01:36:42.235025 2026] [:error] [pid 32257:tid 32337] [client 40.75.84.21:39467] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/chosen.php"] [unique_id "acljKiE3TArOFrUtgWrMDgAAAJM"]
[Mon Mar 30 01:36:43.666017 2026] [:error] [pid 32257:tid 32337] [client 40.75.84.21:38316] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/index.php"] [unique_id "acljKyE3TArOFrUtgWrMGgAAAJM"]
[Mon Mar 30 01:36:46.726969 2026] [:error] [pid 32257:tid 32337] [client 40.75.84.21:42593] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/index.php"] [unique_id "acljLiE3TArOFrUtgWrMIwAAAJM"]
[Mon Mar 30 01:36:48.901450 2026] [:error] [pid 23168:tid 23219] [client 40.75.84.21:54188] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/index.php"] [unique_id "acljMGP8p0yRL8ot_2_vdwAAAhY"]
[Mon Mar 30 01:36:55.414712 2026] [:error] [pid 23284:tid 23307] [client 40.75.84.21:37681] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/index.php"] [unique_id "acljN4zBujdPHsq7wyRExAAAApU"]
[Mon Mar 30 01:36:58.198479 2026] [:error] [pid 32255:tid 32311] [client 40.75.84.21:50349] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/network.php"] [unique_id "acljOmnfn-AtRoMbquxaAQAAAFQ"]
[Mon Mar 30 01:37:02.158978 2026] [:error] [pid 23167:tid 23182] [client 40.75.84.21:54161] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/network.php"] [unique_id "acljPhIAHJCFaHff3_cA_QAAAcw"]
[Mon Mar 30 01:37:07.665326 2026] [:error] [pid 8818:tid 8837] [client 40.75.84.21:46915] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/network.php"] [unique_id "acljQyCDvotZNSF0FBoVzwAAAU8"]
[Mon Mar 30 01:37:09.435041 2026] [:error] [pid 23137:tid 23139] [client 40.75.84.21:54204] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/network.php"] [unique_id "acljRRaWQa7LdZ_qGFYjjAAAAYA"]
[Mon Mar 30 01:37:10.270612 2026] [:error] [pid 23284:tid 23302] [client 40.75.84.21:5743] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/wp-login.php"] [unique_id "acljRozBujdPHsq7wyRE5gAAApA"]
[Mon Mar 30 01:37:10.883153 2026] [:error] [pid 32254:tid 32287] [client 40.75.84.21:38278] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/wp-login.php"] [unique_id "acljRqug2IHuyGgCTn92jwAAABc"]
[Mon Mar 30 01:37:11.518091 2026] [:error] [pid 23137:tid 23153] [client 40.75.84.21:37646] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/wp-login.php"] [unique_id "acljRxaWQa7LdZ_qGFYjkAAAAY4"]
[Mon Mar 30 01:37:11.984816 2026] [:error] [pid 23137:tid 23148] [client 40.75.84.21:39478] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/wp-login.php"] [unique_id "acljRxaWQa7LdZ_qGFYjkQAAAYk"]
[Mon Mar 30 01:37:12.619097 2026] [:error] [pid 32255:tid 32307] [client 40.75.84.21:42595] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/fckeditor/editor/filemanager/updates.php"] [unique_id "acljSGnfn-AtRoMbquxaEAAAAFA"]
[Mon Mar 30 01:37:13.064381 2026] [:error] [pid 23284:tid 23298] [client 40.75.84.21:47807] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/fckeditor/editor/filemanager/updates.php"] [unique_id "acljSYzBujdPHsq7wyRE6gAAAow"]
[Mon Mar 30 01:37:13.584495 2026] [:error] [pid 8818:tid 8826] [client 40.75.84.21:39440] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/fckeditor/editor/filemanager/updates.php"] [unique_id "acljSSCDvotZNSF0FBoV1gAAAUQ"]
[Mon Mar 30 01:37:14.065128 2026] [:error] [pid 32255:tid 32295] [client 40.75.84.21:54150] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/fckeditor/editor/filemanager/updates.php"] [unique_id "acljSmnfn-AtRoMbquxaFQAAAEQ"]
[Mon Mar 30 01:37:14.936273 2026] [:error] [pid 23168:tid 23210] [client 40.75.84.21:42623] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/file.php"] [unique_id "acljSmP8p0yRL8ot_2_vjQAAAg0"]
[Mon Mar 30 01:37:16.056455 2026] [:error] [pid 32255:tid 32306] [client 40.75.84.21:54180] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/file.php"] [unique_id "acljTGnfn-AtRoMbquxaHwAAAE8"]
[Mon Mar 30 01:37:16.659753 2026] [:error] [pid 32255:tid 32302] [client 40.75.84.21:58268] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/file.php"] [unique_id "acljTGnfn-AtRoMbquxaJAAAAEs"]
[Mon Mar 30 01:37:17.381102 2026] [:error] [pid 32359:tid 32372] [client 40.75.84.21:50337] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/file.php"] [unique_id "acljTQMb8G3UzfQP3WhPkQAAAMs"]
[Mon Mar 30 01:37:17.916744 2026] [:error] [pid 23284:tid 23302] [client 40.75.84.21:46951] [client 40.75.84.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Response/wp-login.php"] [unique_id "acljTYzBujdPHsq7wyRE9QAAApA"]
[Mon Mar 30 01:37:18.441721 2026] [:error] [pid 23168:tid 23221] [client 40.75.84.21:37683] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/coffee/alfa-rex.php"] [unique_id "acljTmP8p0yRL8ot_2_vlAAAAhg"]
[Mon Mar 30 01:37:19.472869 2026] [:error] [pid 32257:tid 32321] [client 40.75.84.21:50313] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/coffee/alfa-rex.php"] [unique_id "acljTyE3TArOFrUtgWrMSQAAAIM"]
[Mon Mar 30 01:37:20.519215 2026] [:error] [pid 8818:tid 8832] [client 40.75.84.21:50320] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/coffee/alfa-rex.php"] [unique_id "acljUCCDvotZNSF0FBoV3AAAAUo"]
[Mon Mar 30 01:37:21.189628 2026] [:error] [pid 32257:tid 32330] [client 40.75.84.21:38333] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/coffee/alfa-rex.php"] [unique_id "acljUSE3TArOFrUtgWrMTwAAAIw"]
[Mon Mar 30 01:37:22.838533 2026] [:error] [pid 8818:tid 8843] [client 40.75.84.21:38306] [client 40.75.84.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "acljUiCDvotZNSF0FBoV4AAAAVU"]
[Mon Mar 30 01:37:23.492528 2026] [:error] [pid 32257:tid 32327] [client 40.75.84.21:37690] [client 40.75.84.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/src/alfa-rex.php"] [unique_id "acljUyE3TArOFrUtgWrMUwAAAIk"]
[Mon Mar 30 01:37:24.354824 2026] [:error] [pid 32257:tid 32331] [client 40.75.84.21:64540] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "acljVCE3TArOFrUtgWrMXQAAAI0"]
[Mon Mar 30 01:37:25.061655 2026] [:error] [pid 32257:tid 32328] [client 40.75.84.21:39459] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "acljVSE3TArOFrUtgWrMZAAAAIo"]
[Mon Mar 30 01:37:25.633927 2026] [:error] [pid 23284:tid 23309] [client 40.75.84.21:38282] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "acljVYzBujdPHsq7wyRE_wAAApc"]
[Mon Mar 30 01:37:26.140623 2026] [:error] [pid 23284:tid 23304] [client 40.75.84.21:64563] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "acljVozBujdPHsq7wyRFAwAAApI"]
[Mon Mar 30 01:37:26.883943 2026] [:error] [pid 23167:tid 23189] [client 40.75.84.21:62340] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php/wp-includes/ID3/wp-mail.php"] [unique_id "acljVhIAHJCFaHff3_cBEAAAAdM"]
[Mon Mar 30 01:37:27.454098 2026] [:error] [pid 23250:tid 23276] [client 40.75.84.21:38301] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php/wp-includes/ID3/wp-mail.php"] [unique_id "acljV5xrpj-dQjy1cvoyhgAAAlg"]
[Mon Mar 30 01:37:27.895822 2026] [:error] [pid 23250:tid 23256] [client 40.75.84.21:58289] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php/wp-includes/ID3/wp-mail.php"] [unique_id "acljV5xrpj-dQjy1cvoyigAAAkQ"]
[Mon Mar 30 01:37:28.769854 2026] [:error] [pid 32255:tid 32295] [client 40.75.84.21:42599] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php/wp-includes/ID3/wp-mail.php"] [unique_id "acljWGnfn-AtRoMbquxaOgAAAEQ"]
[Mon Mar 30 01:37:29.761191 2026] [:error] [pid 32255:tid 32292] [client 40.75.84.21:64611] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "acljWWnfn-AtRoMbquxaPgAAAEE"]
[Mon Mar 30 01:37:30.551732 2026] [:error] [pid 23284:tid 23304] [client 40.75.84.21:42602] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "acljWozBujdPHsq7wyRFDgAAApI"]
[Mon Mar 30 01:37:31.907716 2026] [:error] [pid 23284:tid 23300] [client 40.75.84.21:50322] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/xmrlpc.php"] [unique_id "acljW4zBujdPHsq7wyRFGQAAAo4"]
[Mon Mar 30 01:37:34.512325 2026] [:error] [pid 32254:tid 32277] [client 40.75.84.21:38274] [client 40.75.84.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.75.84.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/assets/images/wp-login.php"] [unique_id "acljXqug2IHuyGgCTn92lgAAAA0"]
[Mon Mar 30 01:37:36.103292 2026] [:error] [pid 32254:tid 32286] [client 40.75.84.21:38274] [client 40.75.84.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/themes.php"] [unique_id "acljYKug2IHuyGgCTn92mAAAABY"]
[Mon Mar 30 01:37:40.846929 2026] [:error] [pid 32359:tid 32377] [client 40.75.84.21:39469] [client 40.75.84.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "acljZAMb8G3UzfQP3WhPmgAAANA"]
[Mon Mar 30 01:37:42.269780 2026] [:error] [pid 23250:tid 23257] [client 40.75.84.21:34642] [client 40.75.84.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Content/Type/wp-login.php"] [unique_id "acljZpxrpj-dQjy1cvoyngAAAkU"]
[Mon Mar 30 01:37:45.516610 2026] [:error] [pid 23137:tid 23142] [client 40.75.84.21:46947] [client 40.75.84.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.75.84.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/wp-login.php"] [unique_id "acljaRaWQa7LdZ_qGFYjnAAAAYM"]
[Mon Mar 30 01:37:47.088855 2026] [:error] [pid 23137:tid 23146] [client 40.75.84.21:46947] [client 40.75.84.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/about.php"] [unique_id "acljaxaWQa7LdZ_qGFYjoAAAAYc"]
[Mon Mar 30 01:37:47.982965 2026] [:error] [pid 23137:tid 23153] [client 40.75.84.21:46943] [client 40.75.84.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Content/Type/index.php"] [unique_id "acljaxaWQa7LdZ_qGFYjoQAAAY4"]
[Mon Mar 30 01:37:49.613821 2026] [:error] [pid 23137:tid 23162] [client 40.75.84.21:60584] [client 40.75.84.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "acljbRaWQa7LdZ_qGFYjowAAAZc"]
[Mon Mar 30 01:37:52.341301 2026] [:error] [pid 23284:tid 23293] [client 40.75.84.21:58252] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/travelscape/json.php"] [unique_id "acljcIzBujdPHsq7wyRFSwAAAoc"]
[Mon Mar 30 01:37:53.049025 2026] [:error] [pid 23284:tid 23304] [client 40.75.84.21:60572] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/travelscape/json.php"] [unique_id "acljcYzBujdPHsq7wyRFTAAAApI"]
[Mon Mar 30 01:37:53.715623 2026] [:error] [pid 32257:tid 32328] [client 40.75.84.21:60562] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/travelscape/json.php"] [unique_id "acljcSE3TArOFrUtgWrMkgAAAIo"]
[Mon Mar 30 01:37:54.270375 2026] [:error] [pid 32257:tid 32333] [client 40.75.84.21:42616] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/travelscape/json.php"] [unique_id "acljciE3TArOFrUtgWrMlAAAAI8"]
[Mon Mar 30 01:37:54.793664 2026] [:error] [pid 32257:tid 32319] [client 40.75.84.21:42600] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-admin.php"] [unique_id "acljciE3TArOFrUtgWrMlwAAAIE"]
[Mon Mar 30 01:37:55.202907 2026] [:error] [pid 32257:tid 32323] [client 40.75.84.21:60567] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-admin.php"] [unique_id "acljcyE3TArOFrUtgWrMmwAAAIU"]
[Mon Mar 30 01:37:55.633879 2026] [:error] [pid 32257:tid 32331] [client 40.75.84.21:62336] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-admin.php"] [unique_id "acljcyE3TArOFrUtgWrMnQAAAI0"]
[Mon Mar 30 01:37:56.033322 2026] [:error] [pid 23168:tid 23198] [client 40.75.84.21:60585] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-admin.php"] [unique_id "acljdGP8p0yRL8ot_2_vrQAAAgE"]
[Mon Mar 30 01:37:56.720728 2026] [:error] [pid 32257:tid 32330] [client 40.75.84.21:58261] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/DaoZM.php"] [unique_id "acljdCE3TArOFrUtgWrMngAAAIw"]
[Mon Mar 30 01:37:57.369132 2026] [:error] [pid 32257:tid 32318] [client 40.75.84.21:38331] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/DaoZM.php"] [unique_id "acljdSE3TArOFrUtgWrMoQAAAIA"]
[Mon Mar 30 01:37:58.594274 2026] [:error] [pid 23168:tid 23220] [client 40.75.84.21:49068] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/DaoZM.php"] [unique_id "acljdmP8p0yRL8ot_2_vswAAAhc"]
[Mon Mar 30 01:38:01.310377 2026] [:error] [pid 23168:tid 23209] [client 40.75.84.21:64619] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/DaoZM.php"] [unique_id "acljeWP8p0yRL8ot_2_vuQAAAgw"]
[Mon Mar 30 01:38:02.677487 2026] [:error] [pid 23167:tid 23192] [client 40.75.84.21:62352] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/install.php"] [unique_id "acljehIAHJCFaHff3_cBHgAAAdY"]
[Mon Mar 30 01:38:04.220560 2026] [:error] [pid 32257:tid 32329] [client 40.75.84.21:62385] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/install.php"] [unique_id "acljfCE3TArOFrUtgWrMwQAAAIs"]
[Mon Mar 30 01:38:06.832754 2026] [:error] [pid 32255:tid 32308] [client 40.75.84.21:5216] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/install.php"] [unique_id "acljfmnfn-AtRoMbquxagAAAAFE"]
[Mon Mar 30 01:38:09.715431 2026] [:error] [pid 32255:tid 32307] [client 40.75.84.21:60598] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/install.php"] [unique_id "acljgWnfn-AtRoMbquxaiAAAAFA"]
[Mon Mar 30 01:38:11.130800 2026] [:error] [pid 23284:tid 23305] [client 40.75.84.21:62990] [client 40.75.84.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Content/Type/alfa-rex.php"] [unique_id "acljg4zBujdPHsq7wyRFXAAAApM"]
[Mon Mar 30 01:38:12.638264 2026] [:error] [pid 32255:tid 32302] [client 40.75.84.21:64607] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/link.php"] [unique_id "acljhGnfn-AtRoMbquxajgAAAEs"]
[Mon Mar 30 01:38:13.858296 2026] [:error] [pid 23167:tid 23180] [client 40.75.84.21:60561] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/link.php"] [unique_id "acljhRIAHJCFaHff3_cBJwAAAco"]
[Mon Mar 30 01:38:15.075002 2026] [:error] [pid 32257:tid 32319] [client 40.75.84.21:49047] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/link.php"] [unique_id "acljhyE3TArOFrUtgWrM2gAAAIE"]
[Mon Mar 30 01:38:15.729775 2026] [:error] [pid 23250:tid 23261] [client 40.75.84.21:5245] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/link.php"] [unique_id "acljh5xrpj-dQjy1cvoyrgAAAkk"]
[Mon Mar 30 01:38:16.421735 2026] [:error] [pid 32255:tid 32300] [client 40.75.84.21:52583] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "acljiGnfn-AtRoMbquxalwAAAEk"]
[Mon Mar 30 01:38:17.259906 2026] [:error] [pid 23250:tid 23268] [client 40.75.84.21:49073] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "acljiZxrpj-dQjy1cvoyrwAAAlA"]
[Mon Mar 30 01:38:17.726894 2026] [:error] [pid 23284:tid 23298] [client 40.75.84.21:35947] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "acljiYzBujdPHsq7wyRFgQAAAow"]
[Mon Mar 30 01:38:18.282459 2026] [:error] [pid 23168:tid 23200] [client 40.75.84.21:41348] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "acljimP8p0yRL8ot_2_v3gAAAgM"]
[Mon Mar 30 01:38:18.754398 2026] [:error] [pid 23250:tid 23260] [client 40.75.84.21:55515] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/plugins.php"] [unique_id "acljipxrpj-dQjy1cvoysAAAAkg"]
[Mon Mar 30 01:38:19.154185 2026] [:error] [pid 32255:tid 32306] [client 40.75.84.21:35912] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/plugins.php"] [unique_id "aclji2nfn-AtRoMbquxanQAAAE8"]
[Mon Mar 30 01:38:19.570614 2026] [:error] [pid 23168:tid 23205] [client 40.75.84.21:63009] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/plugins.php"] [unique_id "aclji2P8p0yRL8ot_2_v4wAAAgg"]
[Mon Mar 30 01:38:20.011801 2026] [:error] [pid 23284:tid 23291] [client 40.75.84.21:60570] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/plugins.php"] [unique_id "acljjIzBujdPHsq7wyRFmAAAAoU"]
[Mon Mar 30 01:38:20.445476 2026] [:error] [pid 32255:tid 32297] [client 40.75.84.21:41931] [client 40.75.84.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "acljjGnfn-AtRoMbquxaoAAAAEY"]
[Mon Mar 30 01:38:20.893625 2026] [:error] [pid 23168:tid 23209] [client 40.75.84.21:52574] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "acljjGP8p0yRL8ot_2_v6gAAAgw"]
[Mon Mar 30 01:38:21.304143 2026] [:error] [pid 32255:tid 32293] [client 40.75.84.21:56390] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "acljjWnfn-AtRoMbquxaoQAAAEI"]
[Mon Mar 30 01:38:21.716789 2026] [:error] [pid 23284:tid 23307] [client 40.75.84.21:41965] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "acljjYzBujdPHsq7wyRFowAAApU"]
[Mon Mar 30 01:38:22.415145 2026] [:error] [pid 23284:tid 23291] [client 40.75.84.21:60555] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "acljjozBujdPHsq7wyRFrQAAAoU"]
[Mon Mar 30 01:38:22.990739 2026] [:error] [pid 23250:tid 23262] [client 40.75.84.21:40122] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugin.php"] [unique_id "acljjpxrpj-dQjy1cvoysgAAAko"]
[Mon Mar 30 01:38:23.413502 2026] [:error] [pid 23250:tid 23256] [client 40.75.84.21:41352] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugin.php"] [unique_id "acljj5xrpj-dQjy1cvoytQAAAkQ"]
[Mon Mar 30 01:38:23.876678 2026] [:error] [pid 23284:tid 23306] [client 40.75.84.21:49045] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugin.php"] [unique_id "acljj4zBujdPHsq7wyRFuwAAApQ"]
[Mon Mar 30 01:38:24.312156 2026] [:error] [pid 23284:tid 23289] [client 40.75.84.21:49082] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugin.php"] [unique_id "acljkIzBujdPHsq7wyRFxAAAAoM"]
[Mon Mar 30 01:38:24.745161 2026] [:error] [pid 23284:tid 23306] [client 40.75.84.21:41939] [client 40.75.84.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "acljkIzBujdPHsq7wyRFygAAApQ"]
[Mon Mar 30 01:38:25.393619 2026] [:error] [pid 32359:tid 32379] [client 40.75.84.21:5238] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Assets/edit.php"] [unique_id "acljkQMb8G3UzfQP3WhPpAAAANI"]
[Mon Mar 30 01:38:26.149752 2026] [:error] [pid 8818:tid 8838] [client 40.75.84.21:63017] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Assets/edit.php"] [unique_id "acljkiCDvotZNSF0FBoWDgAAAVA"]
[Mon Mar 30 01:38:26.640593 2026] [:error] [pid 23284:tid 23286] [client 40.75.84.21:56417] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Assets/edit.php"] [unique_id "acljkozBujdPHsq7wyRF2AAAAoA"]
[Mon Mar 30 01:38:27.238198 2026] [:error] [pid 23284:tid 23298] [client 40.75.84.21:56419] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Assets/edit.php"] [unique_id "acljk4zBujdPHsq7wyRF4wAAAow"]
[Mon Mar 30 01:38:27.688263 2026] [:error] [pid 23167:tid 23188] [client 40.75.84.21:49051] [client 40.75.84.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/crystal/about.php"] [unique_id "acljkxIAHJCFaHff3_cBOQAAAdI"]
[Mon Mar 30 01:38:28.095507 2026] [:error] [pid 32257:tid 32341] [client 40.75.84.21:35926] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/file.php"] [unique_id "acljlCE3TArOFrUtgWrM5wAAAJc"]
[Mon Mar 30 01:38:28.507670 2026] [:error] [pid 23168:tid 23219] [client 40.75.84.21:55496] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/file.php"] [unique_id "acljlGP8p0yRL8ot_2_v-QAAAhY"]
[Mon Mar 30 01:38:29.079287 2026] [:error] [pid 23250:tid 23263] [client 40.75.84.21:62986] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/file.php"] [unique_id "acljlZxrpj-dQjy1cvoyuwAAAks"]
[Mon Mar 30 01:38:29.573722 2026] [:error] [pid 32257:tid 32340] [client 40.75.84.21:55523] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/file.php"] [unique_id "acljlSE3TArOFrUtgWrM6QAAAJY"]
[Mon Mar 30 01:38:30.062546 2026] [:error] [pid 23168:tid 23212] [client 40.75.84.21:35946] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/pkivalidation/log.php"] [unique_id "acljlmP8p0yRL8ot_2_v_wAAAg8"]
[Mon Mar 30 01:38:30.542796 2026] [:error] [pid 32257:tid 32321] [client 40.75.84.21:49058] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/pkivalidation/log.php"] [unique_id "acljliE3TArOFrUtgWrM7QAAAIM"]
[Mon Mar 30 01:38:31.123218 2026] [:error] [pid 32257:tid 32319] [client 40.75.84.21:40086] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/pkivalidation/log.php"] [unique_id "acljlyE3TArOFrUtgWrM8QAAAIE"]
[Mon Mar 30 01:38:31.573307 2026] [:error] [pid 8818:tid 8836] [client 40.75.84.21:5199] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/pkivalidation/log.php"] [unique_id "acljlyCDvotZNSF0FBoWEgAAAU4"]
[Mon Mar 30 01:38:32.059251 2026] [:error] [pid 8818:tid 8833] [client 40.75.84.21:49031] [client 40.75.84.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "acljmCCDvotZNSF0FBoWFgAAAUs"]
[Mon Mar 30 01:38:32.533785 2026] [:error] [pid 32257:tid 32336] [client 40.75.84.21:49036] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/packed.php"] [unique_id "acljmCE3TArOFrUtgWrM9gAAAJI"]
[Mon Mar 30 01:38:33.072114 2026] [:error] [pid 32257:tid 32321] [client 40.75.84.21:40125] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/packed.php"] [unique_id "acljmSE3TArOFrUtgWrM-gAAAIM"]
[Mon Mar 30 01:38:33.474131 2026] [:error] [pid 23137:tid 23140] [client 40.75.84.21:62985] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/packed.php"] [unique_id "acljmRaWQa7LdZ_qGFYjrwAAAYE"]
[Mon Mar 30 01:38:33.885625 2026] [:error] [pid 23137:tid 23162] [client 40.75.84.21:35918] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/user.php"] [unique_id "acljmRaWQa7LdZ_qGFYjsQAAAZc"]
[Mon Mar 30 01:38:34.707826 2026] [:error] [pid 32359:tid 32366] [client 40.75.84.21:41346] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/user.php"] [unique_id "acljmgMb8G3UzfQP3WhPqwAAAMU"]
[Mon Mar 30 01:38:35.411393 2026] [:error] [pid 8818:tid 8841] [client 40.75.84.21:35955] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/user.php"] [unique_id "acljmyCDvotZNSF0FBoWGwAAAVM"]
[Mon Mar 30 01:38:35.886044 2026] [:error] [pid 8818:tid 8845] [client 40.75.84.21:41359] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/user.php"] [unique_id "acljmyCDvotZNSF0FBoWHAAAAVc"]
[Mon Mar 30 01:38:36.631792 2026] [:error] [pid 23167:tid 23187] [client 40.75.84.21:43741] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "acljnBIAHJCFaHff3_cBPgAAAdE"]
[Mon Mar 30 01:38:37.337860 2026] [:error] [pid 23250:tid 23263] [client 40.75.84.21:5222] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "acljnZxrpj-dQjy1cvoyxwAAAks"]
[Mon Mar 30 01:38:38.332964 2026] [:error] [pid 32359:tid 32370] [client 40.75.84.21:35963] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "acljngMb8G3UzfQP3WhPrwAAAMk"]
[Mon Mar 30 01:38:38.999586 2026] [:error] [pid 32359:tid 32371] [client 40.75.84.21:5722] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "acljngMb8G3UzfQP3WhPsgAAAMo"]
[Mon Mar 30 01:38:39.628703 2026] [:error] [pid 23284:tid 23295] [client 40.75.84.21:40150] [client 40.75.84.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "acljn4zBujdPHsq7wyRGEwAAAok"]
[Mon Mar 30 01:38:40.771148 2026] [:error] [pid 23167:tid 23191] [client 40.75.84.21:41400] [client 40.75.84.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/wp-login.php"] [unique_id "acljoBIAHJCFaHff3_cBQgAAAdU"]
[Mon Mar 30 01:50:34.325249 2026] [:error] [pid 32257:tid 32325] [client 123.187.240.242:58689] [client 123.187.240.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aclmaiE3TArOFrUtgWrUjQAAAIc"]
[Mon Mar 30 02:20:27.463699 2026] [autoindex:error] [pid 32255:tid 32307] [client 31.220.80.169:56844] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Mar 30 08:16:08.465245 2026] [:error] [pid 41941:tid 41964] [client 43.133.253.253:53970] [client 43.133.253.253] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acnAyCB2g7BNCXGBOJMVVAAAARU"]
[Mon Mar 30 08:59:11.650224 2026] [:error] [pid 41941:tid 41967] [client 37.19.220.57:13233] [client 37.19.220.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.19.220.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acnK3yB2g7BNCXGBOJM1kwAAARg"], referer: https://expressinteriors.com/
[Mon Mar 30 11:25:14.793482 2026] [:error] [pid 41941:tid 41966] [client 194.5.82.144:61181] [client 194.5.82.144] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acntGiB2g7BNCXGBOJN-fgAAARc"]
[Mon Mar 30 11:25:15.005978 2026] [:error] [pid 64743:tid 64752] [client 194.5.82.160:36601] [client 194.5.82.160] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "acntGyzmpVL6Ubzil4hWTAAAAUc"]
[Mon Mar 30 11:25:15.189952 2026] [:error] [pid 35249:tid 35296] [client 194.5.82.150:64713] [client 194.5.82.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/core.php"] [unique_id "acntGyqCKiTq85d6rgAaCAAAAIw"]
[Mon Mar 30 11:25:20.413060 2026] [:error] [pid 35250:tid 35316] [client 194.5.82.117:52705] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wp-activate.php"] [unique_id "acntIIaKM1MR6zcp2YOnsAAAAMU"]
[Mon Mar 30 11:25:20.602100 2026] [:error] [pid 41941:tid 41949] [client 194.5.82.107:39407] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "acntICB2g7BNCXGBOJN-gAAAAQY"]
[Mon Mar 30 11:25:20.809699 2026] [:error] [pid 35250:tid 35321] [client 194.5.82.169:64103] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "acntIIaKM1MR6zcp2YOnsgAAAMo"]
[Mon Mar 30 11:25:21.000486 2026] [:error] [pid 35343:tid 35360] [client 194.5.82.119:60611] [client 194.5.82.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/php-compat/"] [unique_id "acntIKP5HurqmbvwN-JnzgAAAA8"]
[Mon Mar 30 11:25:21.207090 2026] [:error] [pid 35248:tid 35263] [client 194.5.82.122:54533] [client 194.5.82.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/config.php"] [unique_id "acntIb3igMCgAQPFS_8HKwAAAEk"]
[Mon Mar 30 11:25:21.393873 2026] [:error] [pid 35248:tid 35273] [client 194.5.82.113:29895] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/test.php"] [unique_id "acntIb3igMCgAQPFS_8HLQAAAFM"]
[Mon Mar 30 11:25:21.594485 2026] [:error] [pid 64743:tid 64750] [client 194.5.82.124:52575] [client 194.5.82.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/header.php"] [unique_id "acntISzmpVL6Ubzil4hWUwAAAUU"]
[Mon Mar 30 11:25:31.821526 2026] [:error] [pid 35250:tid 35311] [client 194.5.82.143:33149] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/rip.php"] [unique_id "acntK4aKM1MR6zcp2YOnuwAAAMA"]
[Mon Mar 30 11:25:32.004342 2026] [:error] [pid 35250:tid 35334] [client 194.5.82.159:39599] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/admin.php"] [unique_id "acntLIaKM1MR6zcp2YOnvAAAANc"]
[Mon Mar 30 11:25:37.198066 2026] [:error] [pid 35250:tid 35317] [client 194.5.82.144:42191] [client 194.5.82.144] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "acntMYaKM1MR6zcp2YOnyAAAAMY"]
[Mon Mar 30 11:25:37.403445 2026] [:error] [pid 35249:tid 35289] [client 194.5.82.111:59597] [client 194.5.82.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/upload/zczv.php"] [unique_id "acntMSqCKiTq85d6rgAaFgAAAIU"]
[Mon Mar 30 11:25:37.599582 2026] [:error] [pid 35250:tid 35330] [client 194.5.82.108:41355] [client 194.5.82.108] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "acntMYaKM1MR6zcp2YOnzAAAANM"]
[Mon Mar 30 11:25:37.781851 2026] [:error] [pid 35248:tid 35256] [client 194.5.82.119:40269] [client 194.5.82.119] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "acntMb3igMCgAQPFS_8HYQAAAEI"]
[Mon Mar 30 11:25:37.982634 2026] [:error] [pid 35248:tid 35259] [client 194.5.82.164:53735] [client 194.5.82.164] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/admin/"] [unique_id "acntMb3igMCgAQPFS_8HYgAAAEU"]
[Mon Mar 30 11:25:38.163743 2026] [:error] [pid 35250:tid 35326] [client 194.5.82.163:64711] [client 194.5.82.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/speculative8.php"] [unique_id "acntMoaKM1MR6zcp2YOnzgAAAM8"]
[Mon Mar 30 11:25:38.346781 2026] [:error] [pid 35343:tid 35369] [client 194.5.82.134:53095] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/assets/images/selam.php"] [unique_id "acntMqP5HurqmbvwN-Jn6QAAABg"]
[Mon Mar 30 11:25:38.546694 2026] [:error] [pid 35343:tid 35363] [client 194.5.82.153:53441] [client 194.5.82.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "acntMqP5HurqmbvwN-Jn6gAAABI"]
[Mon Mar 30 11:25:38.731150 2026] [:error] [pid 41941:tid 41965] [client 194.5.82.138:44315] [client 194.5.82.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/3PJcpMFsD8B.php"] [unique_id "acntMiB2g7BNCXGBOJN-jQAAARY"]
[Mon Mar 30 11:25:38.916000 2026] [:error] [pid 35248:tid 35261] [client 194.5.82.160:21291] [client 194.5.82.160] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "acntMr3igMCgAQPFS_8HZAAAAEc"]
[Mon Mar 30 11:25:39.099153 2026] [:error] [pid 41941:tid 41963] [client 194.5.82.128:29847] [client 194.5.82.128] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-config-sample.php"] [unique_id "acntMyB2g7BNCXGBOJN-jwAAARQ"]
[Mon Mar 30 11:25:39.284870 2026] [:error] [pid 41941:tid 41955] [client 194.5.82.159:51703] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hello-plus/classes/ehp-sarang.php"] [unique_id "acntMyB2g7BNCXGBOJN-kAAAAQw"]
[Mon Mar 30 11:25:39.489354 2026] [:error] [pid 41941:tid 41953] [client 194.5.82.169:58025] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "acntMyB2g7BNCXGBOJN-kQAAAQo"]
[Mon Mar 30 11:25:39.685272 2026] [:error] [pid 35248:tid 35266] [client 194.5.82.156:41023] [client 194.5.82.156] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/updraft/plugins-old/updraftplus/vendor/team-updraft/"] [unique_id "acntM73igMCgAQPFS_8HZQAAAEw"]
[Mon Mar 30 11:25:39.888807 2026] [:error] [pid 35343:tid 35356] [client 194.5.82.164:22387] [client 194.5.82.164] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/"] [unique_id "acntM6P5HurqmbvwN-Jn7AAAAAs"]
[Mon Mar 30 11:25:40.086078 2026] [:error] [pid 35250:tid 35317] [client 194.5.82.146:23153] [client 194.5.82.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "acntNIaKM1MR6zcp2YOn0wAAAMY"]
[Mon Mar 30 11:25:45.303379 2026] [:error] [pid 35248:tid 35262] [client 194.5.82.135:25679] [client 194.5.82.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/"] [unique_id "acntOb3igMCgAQPFS_8HagAAAEg"]
[Mon Mar 30 11:25:45.610660 2026] [:error] [pid 35343:tid 35356] [client 194.5.82.134:37305] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "acntOaP5HurqmbvwN-Jn-gAAAAs"]
[Mon Mar 30 11:25:45.792578 2026] [:error] [pid 35248:tid 35266] [client 194.5.82.141:50571] [client 194.5.82.141] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/class.api.php"] [unique_id "acntOb3igMCgAQPFS_8HbAAAAEw"]
[Mon Mar 30 11:25:45.978019 2026] [:error] [pid 35248:tid 35265] [client 194.5.82.161:61053] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "acntOb3igMCgAQPFS_8HbQAAAEs"]
[Mon Mar 30 11:25:46.159969 2026] [:error] [pid 35248:tid 35260] [client 194.5.82.105:21327] [client 194.5.82.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "acntOr3igMCgAQPFS_8HbwAAAEY"]
[Mon Mar 30 11:25:46.341088 2026] [:error] [pid 35250:tid 35322] [client 194.5.82.161:20541] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/comments/feed/"] [unique_id "acntOoaKM1MR6zcp2YOn3wAAAMs"]
[Mon Mar 30 11:25:46.521092 2026] [:error] [pid 35249:tid 35305] [client 194.5.82.153:59141] [client 194.5.82.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "acntOiqCKiTq85d6rgAaGQAAAJU"]
[Mon Mar 30 11:25:51.709965 2026] [:error] [pid 35343:tid 35354] [client 194.5.82.113:64789] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/mah.php"] [unique_id "acntP6P5HurqmbvwN-JoAQAAAAk"]
[Mon Mar 30 11:25:51.895382 2026] [:error] [pid 35248:tid 35262] [client 194.5.82.109:48875] [client 194.5.82.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/shell.php"] [unique_id "acntP73igMCgAQPFS_8HhQAAAEg"]
[Mon Mar 30 11:25:52.079300 2026] [:error] [pid 35248:tid 35258] [client 194.5.82.109:51929] [client 194.5.82.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "acntQL3igMCgAQPFS_8HhgAAAEQ"]
[Mon Mar 30 11:25:52.262379 2026] [:error] [pid 35248:tid 35270] [client 194.5.82.121:42073] [client 194.5.82.121] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/revslider/includes/external/page/"] [unique_id "acntQL3igMCgAQPFS_8HiAAAAFA"]
[Mon Mar 30 11:25:52.443014 2026] [:error] [pid 35248:tid 35268] [client 194.5.82.155:59413] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "acntQL3igMCgAQPFS_8HiQAAAE4"]
[Mon Mar 30 11:25:52.630157 2026] [:error] [pid 35248:tid 35274] [client 194.5.82.125:25363] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "acntQL3igMCgAQPFS_8HiwAAAFQ"]
[Mon Mar 30 11:25:52.812571 2026] [:error] [pid 35248:tid 35262] [client 194.5.82.105:52021] [client 194.5.82.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/archives/"] [unique_id "acntQL3igMCgAQPFS_8HjQAAAEg"]
[Mon Mar 30 11:25:52.997233 2026] [:error] [pid 35248:tid 35270] [client 194.5.82.136:34797] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/code/"] [unique_id "acntQL3igMCgAQPFS_8HjwAAAFA"]
[Mon Mar 30 11:25:53.185724 2026] [:error] [pid 35248:tid 35268] [client 194.5.82.147:60361] [client 194.5.82.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "acntQb3igMCgAQPFS_8HkQAAAE4"]
[Mon Mar 30 11:25:58.389597 2026] [:error] [pid 35250:tid 35322] [client 194.5.82.107:48113] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "acntRoaKM1MR6zcp2YOn7AAAAMs"]
[Mon Mar 30 11:25:58.573796 2026] [:error] [pid 35248:tid 35277] [client 194.5.82.163:46619] [client 194.5.82.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/"] [unique_id "acntRr3igMCgAQPFS_8HoQAAAFc"]
[Mon Mar 30 11:25:58.789325 2026] [:error] [pid 35249:tid 35301] [client 194.5.82.159:39347] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "acntRiqCKiTq85d6rgAaJwAAAJE"]
[Mon Mar 30 11:25:58.973869 2026] [:error] [pid 35250:tid 35329] [client 194.5.82.131:56675] [client 194.5.82.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/advanced-product-fields-for-woocommerce/db.php"] [unique_id "acntRoaKM1MR6zcp2YOn-gAAANI"]
[Mon Mar 30 11:25:59.161846 2026] [:error] [pid 35250:tid 35312] [client 194.5.82.144:26311] [client 194.5.82.144] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/"] [unique_id "acntR4aKM1MR6zcp2YOn_gAAAME"]
[Mon Mar 30 11:25:59.350563 2026] [:error] [pid 35250:tid 35319] [client 194.5.82.119:49791] [client 194.5.82.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "acntR4aKM1MR6zcp2YOoAwAAAMg"]
[Mon Mar 30 11:26:04.536477 2026] [:error] [pid 35248:tid 35278] [client 194.5.82.109:39105] [client 194.5.82.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "acntTL3igMCgAQPFS_8HsAAAAFg"]
[Mon Mar 30 11:26:04.919194 2026] [:error] [pid 64743:tid 64766] [client 194.5.82.147:40125] [client 194.5.82.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/"] [unique_id "acntTCzmpVL6Ubzil4hWeAAAAVU"]
[Mon Mar 30 11:26:05.133819 2026] [:error] [pid 35248:tid 35269] [client 194.5.82.147:52395] [client 194.5.82.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/images/"] [unique_id "acntTb3igMCgAQPFS_8HtAAAAE8"]
[Mon Mar 30 11:26:10.319278 2026] [:error] [pid 35250:tid 35333] [client 194.5.82.109:59427] [client 194.5.82.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "acntUoaKM1MR6zcp2YOoGAAAANY"]
[Mon Mar 30 11:26:15.505030 2026] [:error] [pid 35248:tid 35256] [client 194.5.82.147:22645] [client 194.5.82.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/"] [unique_id "acntV73igMCgAQPFS_8H3wAAAEI"]
[Mon Mar 30 11:26:15.686358 2026] [:error] [pid 35248:tid 35261] [client 194.5.82.119:24703] [client 194.5.82.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/mediaelement/"] [unique_id "acntV73igMCgAQPFS_8H4AAAAEc"]
[Mon Mar 30 11:26:15.885420 2026] [:error] [pid 35248:tid 35255] [client 194.5.82.116:32633] [client 194.5.82.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/"] [unique_id "acntV73igMCgAQPFS_8H4QAAAEE"]
[Mon Mar 30 11:26:16.066434 2026] [:error] [pid 35248:tid 35278] [client 194.5.82.137:53529] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/"] [unique_id "acntWL3igMCgAQPFS_8H5AAAAFg"]
[Mon Mar 30 11:26:16.249901 2026] [:error] [pid 35248:tid 35273] [client 194.5.82.108:43445] [client 194.5.82.108] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/"] [unique_id "acntWL3igMCgAQPFS_8H5wAAAFM"]
[Mon Mar 30 11:26:16.449049 2026] [:error] [pid 64743:tid 64766] [client 194.5.82.145:50321] [client 194.5.82.145] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/"] [unique_id "acntWCzmpVL6Ubzil4hWgwAAAVU"]
[Mon Mar 30 11:26:16.633362 2026] [:error] [pid 64743:tid 64765] [client 194.5.82.139:27295] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/"] [unique_id "acntWCzmpVL6Ubzil4hWhAAAAVQ"]
[Mon Mar 30 11:26:16.819833 2026] [:error] [pid 35248:tid 35259] [client 194.5.82.131:48483] [client 194.5.82.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/"] [unique_id "acntWL3igMCgAQPFS_8H6wAAAEU"]
[Mon Mar 30 11:26:17.003134 2026] [:error] [pid 35248:tid 35257] [client 194.5.82.162:20025] [client 194.5.82.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/shell/"] [unique_id "acntWb3igMCgAQPFS_8H7QAAAEM"]
[Mon Mar 30 11:26:17.185626 2026] [:error] [pid 35248:tid 35263] [client 194.5.82.161:52147] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/private/"] [unique_id "acntWb3igMCgAQPFS_8H7gAAAEk"]
[Mon Mar 30 11:26:17.365879 2026] [:error] [pid 35248:tid 35258] [client 194.5.82.159:36633] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/filester/assets/css/404.php"] [unique_id "acntWb3igMCgAQPFS_8H8QAAAEQ"]
[Mon Mar 30 11:26:17.547806 2026] [:error] [pid 35250:tid 35320] [client 194.5.82.160:23369] [client 194.5.82.160] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "acntWYaKM1MR6zcp2YOoIQAAAMk"]
[Mon Mar 30 11:26:17.733115 2026] [:error] [pid 35250:tid 35317] [client 194.5.82.163:25319] [client 194.5.82.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hello.php"] [unique_id "acntWYaKM1MR6zcp2YOoIgAAAMY"]
[Mon Mar 30 11:26:17.914567 2026] [:error] [pid 35249:tid 35304] [client 194.5.82.135:59793] [client 194.5.82.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/about.php"] [unique_id "acntWSqCKiTq85d6rgAaLwAAAJQ"]
[Mon Mar 30 11:26:18.096415 2026] [:error] [pid 64743:tid 64753] [client 194.5.82.132:38103] [client 194.5.82.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/"] [unique_id "acntWizmpVL6Ubzil4hWiAAAAUg"]
[Mon Mar 30 11:26:18.280876 2026] [:error] [pid 35343:tid 35357] [client 194.5.82.138:47669] [client 194.5.82.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/"] [unique_id "acntWqP5HurqmbvwN-JoKQAAAAw"]
[Mon Mar 30 11:26:18.481936 2026] [:error] [pid 35343:tid 35362] [client 194.5.82.128:37999] [client 194.5.82.128] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/src/Core/"] [unique_id "acntWqP5HurqmbvwN-JoKgAAABE"]
[Mon Mar 30 11:26:18.667578 2026] [:error] [pid 64743:tid 64759] [client 194.5.82.125:21799] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "acntWizmpVL6Ubzil4hWjQAAAU4"]
[Mon Mar 30 11:26:18.848555 2026] [:error] [pid 35250:tid 35335] [client 194.5.82.134:40263] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/ocean/"] [unique_id "acntWoaKM1MR6zcp2YOoIwAAANg"]
[Mon Mar 30 11:26:19.037057 2026] [:error] [pid 35248:tid 35275] [client 194.5.82.145:51355] [client 194.5.82.145] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comment-content/"] [unique_id "acntW73igMCgAQPFS_8H9QAAAFU"]
[Mon Mar 30 11:26:19.218222 2026] [:error] [pid 35248:tid 35270] [client 194.5.82.156:65225] [client 194.5.82.156] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "acntW73igMCgAQPFS_8H9gAAAFA"]
[Mon Mar 30 11:26:19.398458 2026] [:error] [pid 35248:tid 35276] [client 194.5.82.105:41639] [client 194.5.82.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-wlx.php"] [unique_id "acntW73igMCgAQPFS_8H-AAAAFY"]
[Mon Mar 30 11:26:19.588641 2026] [:error] [pid 35248:tid 35265] [client 194.5.82.128:21313] [client 194.5.82.128] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/plugins/"] [unique_id "acntW73igMCgAQPFS_8H-wAAAEs"]
[Mon Mar 30 11:26:19.782128 2026] [:error] [pid 35248:tid 35255] [client 194.5.82.155:58605] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/nextpage/"] [unique_id "acntW73igMCgAQPFS_8H_AAAAEE"]
[Mon Mar 30 11:26:19.961433 2026] [:error] [pid 35248:tid 35273] [client 194.5.82.107:25513] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/includes/"] [unique_id "acntW73igMCgAQPFS_8IAAAAAFM"]
[Mon Mar 30 11:26:20.144683 2026] [:error] [pid 35248:tid 35271] [client 194.5.82.118:21293] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/"] [unique_id "acntXL3igMCgAQPFS_8IAgAAAFE"]
[Mon Mar 30 11:26:20.330181 2026] [:error] [pid 35248:tid 35267] [client 194.5.82.125:22971] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/details/"] [unique_id "acntXL3igMCgAQPFS_8IAwAAAE0"]
[Mon Mar 30 11:26:20.620178 2026] [:error] [pid 41941:tid 41943] [client 194.5.82.118:24321] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/buy.php"] [unique_id "acntXCB2g7BNCXGBOJN-sgAAAQA"]
[Mon Mar 30 11:26:20.803112 2026] [:error] [pid 35343:tid 35353] [client 194.5.82.150:60883] [client 194.5.82.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/lib/"] [unique_id "acntXKP5HurqmbvwN-JoLAAAAAg"]
[Mon Mar 30 11:26:21.002047 2026] [:error] [pid 35248:tid 35258] [client 194.5.82.140:50451] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/image/"] [unique_id "acntXb3igMCgAQPFS_8IBQAAAEQ"]
[Mon Mar 30 11:26:21.184965 2026] [:error] [pid 35343:tid 35356] [client 194.5.82.125:55743] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-themes.php"] [unique_id "acntXaP5HurqmbvwN-JoLQAAAAs"]
[Mon Mar 30 11:26:21.365277 2026] [:error] [pid 35250:tid 35319] [client 194.5.82.141:24519] [client 194.5.82.141] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/"] [unique_id "acntXYaKM1MR6zcp2YOoJwAAAMg"]
[Mon Mar 30 11:26:21.554952 2026] [:error] [pid 35250:tid 35320] [client 194.5.82.117:20069] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/light/"] [unique_id "acntXYaKM1MR6zcp2YOoKAAAAMk"]
[Mon Mar 30 11:26:23.407148 2026] [:error] [pid 35343:tid 35361] [client 194.5.82.170:29207] [client 194.5.82.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/theme-check/main.php"] [unique_id "acntX6P5HurqmbvwN-JoMAAAABA"]
[Mon Mar 30 11:26:23.591599 2026] [:error] [pid 35250:tid 35317] [client 194.5.82.119:54089] [client 194.5.82.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/"] [unique_id "acntX4aKM1MR6zcp2YOoKgAAAMY"]
[Mon Mar 30 11:26:23.781891 2026] [:error] [pid 35250:tid 35334] [client 194.5.82.108:31155] [client 194.5.82.108] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin.php"] [unique_id "acntX4aKM1MR6zcp2YOoKwAAANc"]
[Mon Mar 30 11:26:23.963354 2026] [:error] [pid 35250:tid 35324] [client 194.5.82.152:62199] [client 194.5.82.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "acntX4aKM1MR6zcp2YOoLAAAAM0"]
[Mon Mar 30 11:26:24.147655 2026] [:error] [pid 35343:tid 35358] [client 194.5.82.164:60543] [client 194.5.82.164] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wa/"] [unique_id "acntYKP5HurqmbvwN-JoNQAAAA0"]
[Mon Mar 30 11:26:24.330872 2026] [:error] [pid 35248:tid 35275] [client 194.5.82.132:25135] [client 194.5.82.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "acntYL3igMCgAQPFS_8IEgAAAFU"]
[Mon Mar 30 11:26:29.521122 2026] [:error] [pid 35249:tid 35289] [client 194.5.82.163:60419] [client 194.5.82.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/template-singl-portfolio.php"] [unique_id "acntZSqCKiTq85d6rgAaNQAAAIU"]
[Mon Mar 30 11:26:29.702492 2026] [:error] [pid 35250:tid 35335] [client 194.5.82.155:52969] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/404.php"] [unique_id "acntZYaKM1MR6zcp2YOoNwAAANg"]
[Mon Mar 30 11:26:29.888340 2026] [:error] [pid 35343:tid 35361] [client 194.5.82.142:25243] [client 194.5.82.142] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/widgets/"] [unique_id "acntZaP5HurqmbvwN-JoOwAAABA"]
[Mon Mar 30 11:26:30.071014 2026] [:error] [pid 35343:tid 35359] [client 194.5.82.145:29417] [client 194.5.82.145] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/options.php"] [unique_id "acntZqP5HurqmbvwN-JoPAAAAA4"]
[Mon Mar 30 11:26:30.253295 2026] [:error] [pid 41941:tid 41944] [client 194.5.82.147:27525] [client 194.5.82.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "acntZiB2g7BNCXGBOJN-vwAAAQE"]
[Mon Mar 30 11:26:30.436420 2026] [:error] [pid 35248:tid 35270] [client 194.5.82.139:32921] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/"] [unique_id "acntZr3igMCgAQPFS_8IFwAAAFA"]
[Mon Mar 30 11:26:30.628451 2026] [:error] [pid 41941:tid 41964] [client 194.5.82.138:57539] [client 194.5.82.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/themes/about.php"] [unique_id "acntZiB2g7BNCXGBOJN-wQAAARU"]
[Mon Mar 30 11:26:30.819410 2026] [:error] [pid 64743:tid 64754] [client 194.5.82.169:50201] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/mah/function.php"] [unique_id "acntZizmpVL6Ubzil4hWlAAAAUk"]
[Mon Mar 30 11:26:30.999384 2026] [:error] [pid 35249:tid 35290] [client 194.5.82.141:43315] [client 194.5.82.141] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/admin.php"] [unique_id "acntZiqCKiTq85d6rgAaNwAAAIY"]
[Mon Mar 30 11:26:31.183676 2026] [:error] [pid 41941:tid 41955] [client 194.5.82.134:46977] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/column/"] [unique_id "acntZyB2g7BNCXGBOJN-wgAAAQw"]
[Mon Mar 30 11:26:31.382355 2026] [:error] [pid 35248:tid 35266] [client 194.5.82.146:41403] [client 194.5.82.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ahax.php"] [unique_id "acntZ73igMCgAQPFS_8IGQAAAEw"]
[Mon Mar 30 11:26:31.581738 2026] [:error] [pid 35248:tid 35272] [client 194.5.82.162:54465] [client 194.5.82.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-terms/"] [unique_id "acntZ73igMCgAQPFS_8IGgAAAFI"]
[Mon Mar 30 11:26:31.808991 2026] [:error] [pid 35249:tid 35301] [client 194.5.82.150:20901] [client 194.5.82.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/"] [unique_id "acntZyqCKiTq85d6rgAaOAAAAJE"]
[Mon Mar 30 11:26:31.996061 2026] [:error] [pid 35343:tid 35361] [client 194.5.82.120:61911] [client 194.5.82.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/imgareaselect/"] [unique_id "acntZ6P5HurqmbvwN-JoRAAAABA"]
[Mon Mar 30 11:26:37.215493 2026] [:error] [pid 64743:tid 64765] [client 194.5.82.152:39353] [client 194.5.82.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "acntbSzmpVL6Ubzil4hWngAAAVQ"]
[Mon Mar 30 11:26:37.627039 2026] [:error] [pid 35248:tid 35265] [client 194.5.82.143:63111] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "acntbb3igMCgAQPFS_8IIQAAAEs"]
[Mon Mar 30 11:26:37.815721 2026] [:error] [pid 35250:tid 35312] [client 194.5.82.136:31439] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfour/patterns/template-singl-portfolio.php"] [unique_id "acntbYaKM1MR6zcp2YOoPAAAAME"]
[Mon Mar 30 11:26:38.003716 2026] [:error] [pid 35343:tid 35364] [client 194.5.82.152:60619] [client 194.5.82.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "acntbqP5HurqmbvwN-JoTgAAABM"]
[Mon Mar 30 11:26:38.190191 2026] [:error] [pid 35343:tid 35357] [client 194.5.82.139:39235] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/"] [unique_id "acntbqP5HurqmbvwN-JoTwAAAAw"]
[Mon Mar 30 11:26:38.384813 2026] [:error] [pid 64743:tid 64746] [client 194.5.82.107:35627] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "acntbizmpVL6Ubzil4hWoQAAAUE"]
[Mon Mar 30 11:26:38.583601 2026] [:error] [pid 35343:tid 35359] [client 194.5.82.128:51903] [client 194.5.82.128] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/user.php"] [unique_id "acntbqP5HurqmbvwN-JoUAAAAA4"]
[Mon Mar 30 11:26:38.797703 2026] [:error] [pid 35343:tid 35360] [client 194.5.82.164:22549] [client 194.5.82.164] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "acntbqP5HurqmbvwN-JoWwAAAA8"]
[Mon Mar 30 11:26:38.987377 2026] [:error] [pid 35250:tid 35322] [client 194.5.82.140:29015] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/"] [unique_id "acntboaKM1MR6zcp2YOoQAAAAMs"]
[Mon Mar 30 11:26:39.183490 2026] [:error] [pid 41941:tid 41950] [client 194.5.82.111:45597] [client 194.5.82.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "acntbyB2g7BNCXGBOJN-7wAAAQc"]
[Mon Mar 30 11:26:39.384975 2026] [:error] [pid 64743:tid 64753] [client 194.5.82.136:24689] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-links-opml.php"] [unique_id "acntbyzmpVL6Ubzil4hWogAAAUg"]
[Mon Mar 30 11:26:39.580514 2026] [:error] [pid 35249:tid 35298] [client 194.5.82.138:26339] [client 194.5.82.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/PHPMailer/s"] [unique_id "acntbyqCKiTq85d6rgAaQAAAAI4"]
[Mon Mar 30 11:26:39.784776 2026] [:error] [pid 64743:tid 64769] [client 194.5.82.152:20273] [client 194.5.82.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "acntbyzmpVL6Ubzil4hWowAAAVg"]
[Mon Mar 30 11:26:39.984421 2026] [:error] [pid 35343:tid 35353] [client 194.5.82.128:63341] [client 194.5.82.128] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/pullquote/"] [unique_id "acntb6P5HurqmbvwN-JoiwAAAAg"]
[Mon Mar 30 11:26:40.208577 2026] [:error] [pid 35250:tid 35323] [client 194.5.82.159:56839] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyone/template-parts/"] [unique_id "acntcIaKM1MR6zcp2YOoQwAAAMw"]
[Mon Mar 30 11:26:40.406962 2026] [:error] [pid 35250:tid 35333] [client 194.5.82.147:37195] [client 194.5.82.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/widgets/"] [unique_id "acntcIaKM1MR6zcp2YOoRAAAANY"]
[Mon Mar 30 11:26:40.799618 2026] [:error] [pid 35343:tid 35361] [client 194.5.82.116:49915] [client 194.5.82.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/social-links/"] [unique_id "acntcKP5HurqmbvwN-JojQAAABA"]
[Mon Mar 30 11:26:41.030560 2026] [:error] [pid 35343:tid 35351] [client 194.5.82.153:60319] [client 194.5.82.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ab.php"] [unique_id "acntcaP5HurqmbvwN-JojgAAAAY"]
[Mon Mar 30 11:26:41.226997 2026] [:error] [pid 35248:tid 35277] [client 194.5.82.146:65167] [client 194.5.82.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/navigation-submenu/"] [unique_id "acntcb3igMCgAQPFS_8IaQAAAFc"]
[Mon Mar 30 11:26:41.408144 2026] [:error] [pid 35248:tid 35266] [client 194.5.82.117:37751] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/paragraph/"] [unique_id "acntcb3igMCgAQPFS_8IbwAAAEw"]
[Mon Mar 30 11:26:41.619080 2026] [:error] [pid 35248:tid 35275] [client 194.5.82.130:32471] [client 194.5.82.130] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "acntcb3igMCgAQPFS_8IcAAAAFU"]
[Mon Mar 30 11:26:41.800908 2026] [:error] [pid 35250:tid 35314] [client 194.5.82.136:57317] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/video/"] [unique_id "acntcYaKM1MR6zcp2YOoSAAAAMM"]
[Mon Mar 30 11:26:47.003780 2026] [:error] [pid 35250:tid 35326] [client 194.5.82.159:43913] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "acntd4aKM1MR6zcp2YOoWQAAAM8"]
[Mon Mar 30 11:26:47.193410 2026] [:error] [pid 35250:tid 35328] [client 194.5.82.136:53863] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/"] [unique_id "acntd4aKM1MR6zcp2YOoXAAAANE"]
[Mon Mar 30 11:26:47.381069 2026] [:error] [pid 35250:tid 35318] [client 194.5.82.136:25933] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/"] [unique_id "acntd4aKM1MR6zcp2YOoXQAAAMc"]
[Mon Mar 30 11:26:47.582900 2026] [:error] [pid 35249:tid 35294] [client 194.5.82.134:21637] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/"] [unique_id "acntdyqCKiTq85d6rgAaRAAAAIo"]
[Mon Mar 30 11:26:52.784300 2026] [:error] [pid 35248:tid 35266] [client 194.5.82.136:55459] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/"] [unique_id "acntfL3igMCgAQPFS_8IigAAAEw"]
[Mon Mar 30 11:26:58.004686 2026] [:error] [pid 41941:tid 41948] [client 194.5.82.118:55775] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/k.php"] [unique_id "acntgiB2g7BNCXGBOJN_FwAAAQU"]
[Mon Mar 30 11:26:58.184283 2026] [:error] [pid 35248:tid 35276] [client 194.5.82.138:38191] [client 194.5.82.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfour/patterns/file.php"] [unique_id "acntgr3igMCgAQPFS_8IngAAAFY"]
[Mon Mar 30 11:26:58.390672 2026] [:error] [pid 41941:tid 41954] [client 194.5.82.135:22725] [client 194.5.82.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/"] [unique_id "acntgiB2g7BNCXGBOJN_GQAAAQs"]
[Mon Mar 30 11:26:58.594166 2026] [:error] [pid 35343:tid 35361] [client 194.5.82.152:24809] [client 194.5.82.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfour/"] [unique_id "acntgqP5HurqmbvwN-JoswAAABA"]
[Mon Mar 30 11:26:58.783768 2026] [:error] [pid 35248:tid 35274] [client 194.5.82.140:29881] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/development/"] [unique_id "acntgr3igMCgAQPFS_8IogAAAFQ"]
[Mon Mar 30 11:26:58.981931 2026] [:error] [pid 35248:tid 35259] [client 194.5.82.140:62899] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist"] [unique_id "acntgr3igMCgAQPFS_8IpAAAAEU"]
[Mon Mar 30 11:26:59.163193 2026] [:error] [pid 35248:tid 35264] [client 194.5.82.107:44423] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/components/"] [unique_id "acntg73igMCgAQPFS_8IpgAAAEo"]
[Mon Mar 30 11:26:59.343573 2026] [:error] [pid 41941:tid 41949] [client 194.5.82.169:61971] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "acntgyB2g7BNCXGBOJN_GgAAAQY"]
[Mon Mar 30 11:26:59.523782 2026] [:error] [pid 41941:tid 41943] [client 194.5.82.135:36555] [client 194.5.82.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "acntgyB2g7BNCXGBOJN_GwAAAQA"]
[Mon Mar 30 11:26:59.706157 2026] [:error] [pid 41941:tid 41961] [client 194.5.82.120:40685] [client 194.5.82.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "acntgyB2g7BNCXGBOJN_HAAAARI"]
[Mon Mar 30 11:26:59.893969 2026] [:error] [pid 35248:tid 35275] [client 194.5.82.128:51881] [client 194.5.82.128] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "acntg73igMCgAQPFS_8IqwAAAFU"]
[Mon Mar 30 11:27:00.088651 2026] [:error] [pid 35249:tid 35308] [client 194.5.82.139:46285] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "acnthCqCKiTq85d6rgAaTwAAAJg"]
[Mon Mar 30 11:27:00.275774 2026] [:error] [pid 41941:tid 41944] [client 194.5.82.134:47189] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/worksec.php"] [unique_id "acnthCB2g7BNCXGBOJN_IgAAAQE"]
[Mon Mar 30 11:27:00.730270 2026] [:error] [pid 41941:tid 41950] [client 194.5.82.131:29971] [client 194.5.82.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/edit-wolf.php"] [unique_id "acnthCB2g7BNCXGBOJN_JQAAAQc"]
[Mon Mar 30 11:27:01.129058 2026] [:error] [pid 35343:tid 35355] [client 194.5.82.117:53541] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acnthaP5HurqmbvwN-JouAAAAAo"]
[Mon Mar 30 11:27:01.318907 2026] [:error] [pid 35248:tid 35268] [client 194.5.82.140:32169] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-file.php"] [unique_id "acnthb3igMCgAQPFS_8IsgAAAE4"]
[Mon Mar 30 11:27:01.503797 2026] [:error] [pid 35343:tid 35350] [client 194.5.82.109:37247] [client 194.5.82.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "acnthaP5HurqmbvwN-JovAAAAAU"]
[Mon Mar 30 11:27:01.690051 2026] [:error] [pid 35343:tid 35345] [client 194.5.82.118:55071] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "acnthaP5HurqmbvwN-JovwAAAAA"]
[Mon Mar 30 11:27:01.903201 2026] [:error] [pid 41941:tid 41967] [client 194.5.82.170:21127] [client 194.5.82.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-blog.php"] [unique_id "acnthSB2g7BNCXGBOJN_KQAAARg"]
[Mon Mar 30 11:27:02.086507 2026] [:error] [pid 64743:tid 64752] [client 194.5.82.132:27149] [client 194.5.82.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/block-patterns/"] [unique_id "acnthizmpVL6Ubzil4hWtwAAAUc"]
[Mon Mar 30 11:27:02.290551 2026] [:error] [pid 35343:tid 35347] [client 194.5.82.140:44523] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/elementor/"] [unique_id "acnthqP5HurqmbvwN-JoxAAAAAI"]
[Mon Mar 30 11:27:02.490629 2026] [:error] [pid 35248:tid 35262] [client 194.5.82.147:65191] [client 194.5.82.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "acnthr3igMCgAQPFS_8IuAAAAEg"]
[Mon Mar 30 11:27:02.681545 2026] [:error] [pid 35248:tid 35256] [client 194.5.82.157:24947] [client 194.5.82.157] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/bk/"] [unique_id "acnthr3igMCgAQPFS_8IugAAAEI"]
[Mon Mar 30 11:27:02.868074 2026] [:error] [pid 35248:tid 35272] [client 194.5.82.105:55121] [client 194.5.82.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/assets/fonts/"] [unique_id "acnthr3igMCgAQPFS_8IvAAAAFI"]
[Mon Mar 30 11:27:03.050282 2026] [:error] [pid 35248:tid 35274] [client 194.5.82.140:22065] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/customize-widgets/"] [unique_id "acnth73igMCgAQPFS_8IwAAAAFQ"]
[Mon Mar 30 11:27:03.234444 2026] [:error] [pid 41941:tid 41946] [client 194.5.82.117:62065] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/"] [unique_id "acnthyB2g7BNCXGBOJN_KgAAAQM"]
[Mon Mar 30 11:27:03.420744 2026] [:error] [pid 35250:tid 35313] [client 194.5.82.159:58797] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "acnth4aKM1MR6zcp2YOodQAAAMI"]
[Mon Mar 30 11:27:03.619041 2026] [:error] [pid 41941:tid 41965] [client 194.5.82.150:41419] [client 194.5.82.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "acnthyB2g7BNCXGBOJN_KwAAARY"]
[Mon Mar 30 11:27:03.804009 2026] [:error] [pid 35250:tid 35335] [client 194.5.82.125:20147] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "acnth4aKM1MR6zcp2YOodgAAANg"]
[Mon Mar 30 11:27:03.985956 2026] [:error] [pid 35343:tid 35366] [client 194.5.82.111:29109] [client 194.5.82.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/colors/"] [unique_id "acnth6P5HurqmbvwN-JozAAAABU"]
[Mon Mar 30 11:27:04.167373 2026] [:error] [pid 35250:tid 35334] [client 194.5.82.124:53799] [client 194.5.82.124] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/block-bindings/"] [unique_id "acntiIaKM1MR6zcp2YOoeAAAANc"]
[Mon Mar 30 11:27:04.353446 2026] [:error] [pid 35343:tid 35358] [client 194.5.82.146:37939] [client 194.5.82.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content.php"] [unique_id "acntiKP5HurqmbvwN-JozgAAAA0"]
[Mon Mar 30 11:27:04.537250 2026] [:error] [pid 35248:tid 35264] [client 194.5.82.124:22575] [client 194.5.82.124] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-domain.php"] [unique_id "acntiL3igMCgAQPFS_8IxwAAAEo"]
[Mon Mar 30 11:27:04.720600 2026] [:error] [pid 64743:tid 64747] [client 194.5.82.134:48851] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/admin.php"] [unique_id "acntiCzmpVL6Ubzil4hWugAAAUI"]
[Mon Mar 30 11:27:04.909313 2026] [:error] [pid 35250:tid 35322] [client 194.5.82.125:48583] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jcrop/"] [unique_id "acntiIaKM1MR6zcp2YOoeQAAAMs"]
[Mon Mar 30 11:27:05.092535 2026] [:error] [pid 35248:tid 35274] [client 194.5.82.143:37867] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/lock360.php"] [unique_id "acntib3igMCgAQPFS_8IygAAAFQ"]
[Mon Mar 30 11:27:05.275806 2026] [:error] [pid 35248:tid 35278] [client 194.5.82.138:49583] [client 194.5.82.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/fonts/"] [unique_id "acntib3igMCgAQPFS_8IzAAAAFg"]
[Mon Mar 30 11:27:05.465161 2026] [:error] [pid 35250:tid 35323] [client 194.5.82.146:22199] [client 194.5.82.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "acntiYaKM1MR6zcp2YOoegAAAMw"]
[Mon Mar 30 11:27:05.646356 2026] [:error] [pid 35250:tid 35330] [client 194.5.82.140:23001] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "acntiYaKM1MR6zcp2YOofAAAANM"]
[Mon Mar 30 11:27:05.830431 2026] [:error] [pid 35248:tid 35267] [client 194.5.82.161:45683] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/network/"] [unique_id "acntib3igMCgAQPFS_8IzgAAAE0"]
[Mon Mar 30 11:27:06.012882 2026] [:error] [pid 35249:tid 35297] [client 194.5.82.147:63181] [client 194.5.82.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "acntiiqCKiTq85d6rgAaXQAAAI0"]
[Mon Mar 30 11:27:06.225123 2026] [:error] [pid 64743:tid 64757] [client 194.5.82.155:43327] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/chosen.php"] [unique_id "acntiizmpVL6Ubzil4hWvQAAAUw"]
[Mon Mar 30 11:27:06.406123 2026] [:error] [pid 35248:tid 35268] [client 194.5.82.153:52865] [client 194.5.82.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/reception1/includes/tcpdf/examples/config/"] [unique_id "acntir3igMCgAQPFS_8I0QAAAE4"]
[Mon Mar 30 11:27:06.588192 2026] [:error] [pid 41941:tid 41951] [client 194.5.82.162:51945] [client 194.5.82.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-signin.php"] [unique_id "acntiiB2g7BNCXGBOJN_LgAAAQg"]
[Mon Mar 30 11:27:06.784297 2026] [:error] [pid 41941:tid 41954] [client 194.5.82.135:47005] [client 194.5.82.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2024/"] [unique_id "acntiiB2g7BNCXGBOJN_LwAAAQs"]
[Mon Mar 30 11:27:16.987929 2026] [:error] [pid 64743:tid 64745] [client 194.5.82.163:40437] [client 194.5.82.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wpforms/"] [unique_id "acntlCzmpVL6Ubzil4hW0AAAAUA"]
[Mon Mar 30 11:27:17.188690 2026] [:error] [pid 35250:tid 35335] [client 194.5.82.120:46895] [client 194.5.82.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/page-list/"] [unique_id "acntlYaKM1MR6zcp2YOoiQAAANg"]
[Mon Mar 30 11:27:17.371170 2026] [:error] [pid 35250:tid 35322] [client 194.5.82.107:33861] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/images/"] [unique_id "acntlYaKM1MR6zcp2YOoigAAAMs"]
[Mon Mar 30 11:27:17.555961 2026] [:error] [pid 35250:tid 35314] [client 194.5.82.118:38251] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "acntlYaKM1MR6zcp2YOojQAAAMM"]
[Mon Mar 30 11:27:17.739994 2026] [:error] [pid 35343:tid 35353] [client 194.5.82.146:25543] [client 194.5.82.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/plugins/admin.php"] [unique_id "acntlaP5HurqmbvwN-Jo4QAAAAg"]
[Mon Mar 30 11:27:22.946081 2026] [:error] [pid 41941:tid 41949] [client 194.5.82.170:46181] [client 194.5.82.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-signin.php"] [unique_id "acntmiB2g7BNCXGBOJN_UAAAAQY"]
[Mon Mar 30 11:27:23.145938 2026] [:error] [pid 35250:tid 35322] [client 194.5.82.116:55207] [client 194.5.82.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/system.php"] [unique_id "acntm4aKM1MR6zcp2YOolwAAAMs"]
[Mon Mar 30 11:27:23.331197 2026] [:error] [pid 64743:tid 64751] [client 194.5.82.157:39533] [client 194.5.82.157] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/"] [unique_id "acntmyzmpVL6Ubzil4hW3QAAAUY"]
[Mon Mar 30 11:27:28.527581 2026] [:error] [pid 35248:tid 35254] [client 194.5.82.116:42727] [client 194.5.82.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "acntoL3igMCgAQPFS_8I-AAAAEA"]
[Mon Mar 30 11:27:28.717951 2026] [:error] [pid 41941:tid 41962] [client 194.5.82.143:25457] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/providers/"] [unique_id "acntoCB2g7BNCXGBOJN_WwAAARM"]
[Mon Mar 30 11:27:28.902055 2026] [:error] [pid 35248:tid 35266] [client 194.5.82.150:53157] [client 194.5.82.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/"] [unique_id "acntoL3igMCgAQPFS_8I-QAAAEw"]
[Mon Mar 30 11:27:29.084259 2026] [:error] [pid 35248:tid 35257] [client 194.5.82.142:30441] [client 194.5.82.142] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/commands/"] [unique_id "acntob3igMCgAQPFS_8I_QAAAEM"]
[Mon Mar 30 11:27:29.280145 2026] [:error] [pid 35249:tid 35304] [client 194.5.82.125:45939] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/query-title/"] [unique_id "acntoSqCKiTq85d6rgAabQAAAJQ"]
[Mon Mar 30 11:27:29.477279 2026] [:error] [pid 35250:tid 35321] [client 194.5.82.156:46401] [client 194.5.82.156] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/query-pagination/"] [unique_id "acntoYaKM1MR6zcp2YOoqAAAAMo"]
[Mon Mar 30 11:27:29.691859 2026] [:error] [pid 35249:tid 35307] [client 194.5.82.154:44077] [client 194.5.82.154] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/separator/"] [unique_id "acntoSqCKiTq85d6rgAabgAAAJc"]
[Mon Mar 30 11:27:34.884530 2026] [:error] [pid 35343:tid 35345] [client 194.5.82.120:54855] [client 194.5.82.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/"] [unique_id "acntpqP5HurqmbvwN-JpBwAAAAA"]
[Mon Mar 30 11:27:35.074056 2026] [:error] [pid 35343:tid 35363] [client 194.5.82.123:59609] [client 194.5.82.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/t.php"] [unique_id "acntp6P5HurqmbvwN-JpCQAAABI"]
[Mon Mar 30 11:27:35.255014 2026] [:error] [pid 35343:tid 35348] [client 194.5.82.161:22595] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/search/images/"] [unique_id "acntp6P5HurqmbvwN-JpDAAAAAM"]
[Mon Mar 30 11:27:40.440176 2026] [:error] [pid 35248:tid 35257] [client 194.5.82.117:63051] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/freeform/"] [unique_id "acntrL3igMCgAQPFS_8JHQAAAEM"]
[Mon Mar 30 11:27:40.624180 2026] [:error] [pid 35248:tid 35275] [client 194.5.82.142:41809] [client 194.5.82.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "acntrL3igMCgAQPFS_8JHwAAAFU"]
[Mon Mar 30 11:27:40.810515 2026] [:error] [pid 35248:tid 35267] [client 194.5.82.161:24021] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/chosen.php"] [unique_id "acntrL3igMCgAQPFS_8JIAAAAE0"]
[Mon Mar 30 11:27:40.992516 2026] [:error] [pid 35248:tid 35262] [client 194.5.82.132:63623] [client 194.5.82.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/about.php"] [unique_id "acntrL3igMCgAQPFS_8JIgAAAEg"]
[Mon Mar 30 11:27:41.195670 2026] [:error] [pid 35248:tid 35271] [client 194.5.82.142:30487] [client 194.5.82.142] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "acntrb3igMCgAQPFS_8JJAAAAFE"]
[Mon Mar 30 11:27:41.679071 2026] [:error] [pid 35343:tid 35355] [client 194.5.82.150:29003] [client 194.5.82.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/themes/"] [unique_id "acntraP5HurqmbvwN-JpIAAAAAo"]
[Mon Mar 30 11:27:41.898936 2026] [:error] [pid 35248:tid 35278] [client 194.5.82.139:42091] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/ws29.php"] [unique_id "acntrb3igMCgAQPFS_8JKgAAAFg"]
[Mon Mar 30 11:27:47.081833 2026] [:error] [pid 35250:tid 35331] [client 194.5.82.136:63839] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "acnts4aKM1MR6zcp2YOo1gAAANQ"]
[Mon Mar 30 11:27:47.292344 2026] [:error] [pid 35250:tid 35320] [client 194.5.82.155:41677] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/"] [unique_id "acnts4aKM1MR6zcp2YOo1wAAAMk"]
[Mon Mar 30 11:27:47.483644 2026] [:error] [pid 64743:tid 64763] [client 194.5.82.161:52299] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/chosen.php"] [unique_id "acntsyzmpVL6Ubzil4hXBwAAAVI"]
[Mon Mar 30 11:27:47.686403 2026] [:error] [pid 35249:tid 35291] [client 194.5.82.105:30219] [client 194.5.82.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wp-conflg.php"] [unique_id "acntsyqCKiTq85d6rgAaiwAAAIc"]
[Mon Mar 30 11:27:47.886101 2026] [:error] [pid 35248:tid 35267] [client 194.5.82.161:54127] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/"] [unique_id "acnts73igMCgAQPFS_8JOwAAAE0"]
[Mon Mar 30 11:27:53.089641 2026] [:error] [pid 35250:tid 35334] [client 194.5.82.170:54397] [client 194.5.82.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/script-modules/block-library/file/"] [unique_id "acntuYaKM1MR6zcp2YOo6gAAANc"]
[Mon Mar 30 11:27:53.272903 2026] [:error] [pid 41941:tid 41947] [client 194.5.82.139:30203] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/tag-cloud/"] [unique_id "acntuSB2g7BNCXGBOJN_kQAAAQQ"]
[Mon Mar 30 11:27:53.462309 2026] [:error] [pid 41941:tid 41954] [client 194.5.82.139:27007] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/file.php"] [unique_id "acntuSB2g7BNCXGBOJN_lAAAAQs"]
[Mon Mar 30 11:27:53.711764 2026] [:error] [pid 35249:tid 35306] [client 194.5.82.160:45645] [client 194.5.82.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/about.php"] [unique_id "acntuSqCKiTq85d6rgAakgAAAJY"]
[Mon Mar 30 11:27:53.904621 2026] [:error] [pid 41941:tid 41960] [client 194.5.82.137:39647] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "acntuSB2g7BNCXGBOJN_lgAAARE"]
[Mon Mar 30 11:27:54.093293 2026] [:error] [pid 41941:tid 41967] [client 194.5.82.135:36785] [client 194.5.82.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "acntuiB2g7BNCXGBOJN_lwAAARg"]
[Mon Mar 30 11:27:54.275824 2026] [:error] [pid 35343:tid 35350] [client 194.5.82.143:24381] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/updraft/emptydir/"] [unique_id "acntuqP5HurqmbvwN-JpLwAAAAU"]
[Mon Mar 30 11:27:54.458088 2026] [:error] [pid 35249:tid 35307] [client 194.5.82.143:40767] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "acntuiqCKiTq85d6rgAakwAAAJc"]
[Mon Mar 30 11:27:59.641385 2026] [:error] [pid 35249:tid 35293] [client 194.5.82.147:65001] [client 194.5.82.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwenty/assets/fonts/inter/"] [unique_id "acntvyqCKiTq85d6rgAangAAAIk"]
[Mon Mar 30 11:27:59.825752 2026] [:error] [pid 35343:tid 35349] [client 194.5.82.132:42289] [client 194.5.82.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "acntv6P5HurqmbvwN-JpNQAAAAQ"]
[Mon Mar 30 11:28:00.009189 2026] [:error] [pid 35248:tid 35258] [client 194.5.82.119:64525] [client 194.5.82.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2025/"] [unique_id "acntwL3igMCgAQPFS_8JSQAAAEQ"]
[Mon Mar 30 11:28:00.238674 2026] [:error] [pid 35248:tid 35267] [client 194.5.82.134:38883] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/template-singl-portfolio.php"] [unique_id "acntwL3igMCgAQPFS_8JSgAAAE0"]
[Mon Mar 30 11:28:00.429478 2026] [:error] [pid 35248:tid 35262] [client 194.5.82.154:57257] [client 194.5.82.154] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/coffee/"] [unique_id "acntwL3igMCgAQPFS_8JTAAAAEg"]
[Mon Mar 30 11:28:00.820749 2026] [:error] [pid 35248:tid 35259] [client 194.5.82.125:28837] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/"] [unique_id "acntwL3igMCgAQPFS_8JTQAAAEU"]
[Mon Mar 30 11:28:01.026713 2026] [:error] [pid 35249:tid 35300] [client 194.5.82.152:51409] [client 194.5.82.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/admin/metabox/about.php"] [unique_id "acntwSqCKiTq85d6rgAaoQAAAJA"]
[Mon Mar 30 11:28:01.216876 2026] [:error] [pid 35249:tid 35294] [client 194.5.82.164:47511] [client 194.5.82.164] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/database.php"] [unique_id "acntwSqCKiTq85d6rgAaogAAAIo"]
[Mon Mar 30 11:28:01.411343 2026] [:error] [pid 35249:tid 35298] [client 194.5.82.150:33161] [client 194.5.82.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/search/"] [unique_id "acntwSqCKiTq85d6rgAapAAAAI4"]
[Mon Mar 30 11:28:01.594824 2026] [:error] [pid 35249:tid 35302] [client 194.5.82.144:20197] [client 194.5.82.144] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/html-api/"] [unique_id "acntwSqCKiTq85d6rgAapgAAAJI"]
[Mon Mar 30 11:28:11.790172 2026] [:error] [pid 64743:tid 64767] [client 194.5.82.169:33903] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-conflg.php"] [unique_id "acntyyzmpVL6Ubzil4hXLAAAAVY"]
[Mon Mar 30 11:28:12.034686 2026] [:error] [pid 35343:tid 35359] [client 194.5.82.137:55561] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/library/"] [unique_id "acntzKP5HurqmbvwN-JpRgAAAA4"]
[Mon Mar 30 11:28:12.223028 2026] [:error] [pid 35343:tid 35358] [client 194.5.82.161:59541] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/x/wp-classs-editor.php"] [unique_id "acntzKP5HurqmbvwN-JpRwAAAA0"]
[Mon Mar 30 11:28:12.505903 2026] [:error] [pid 35248:tid 35276] [client 194.5.82.142:59625] [client 194.5.82.142] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/src/dashboard/application/search-rankings/about.php"] [unique_id "acntzL3igMCgAQPFS_8JfAAAAFY"]
[Mon Mar 30 11:28:17.691629 2026] [:error] [pid 35343:tid 35352] [client 194.5.82.138:63879] [client 194.5.82.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/wp-conflg.php"] [unique_id "acnt0aP5HurqmbvwN-JpVgAAAAc"]
[Mon Mar 30 11:28:17.884606 2026] [:error] [pid 64743:tid 64750] [client 194.5.82.131:61221] [client 194.5.82.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/zz.php"] [unique_id "acnt0SzmpVL6Ubzil4hXMQAAAUU"]
[Mon Mar 30 11:28:18.081562 2026] [:error] [pid 35343:tid 35360] [client 194.5.82.140:20179] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/namespaced/Core/"] [unique_id "acnt0qP5HurqmbvwN-JpVwAAAA8"]
[Mon Mar 30 11:28:18.282594 2026] [:error] [pid 35249:tid 35285] [client 194.5.82.164:62139] [client 194.5.82.164] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/about.php"] [unique_id "acnt0iqCKiTq85d6rgAasAAAAIE"]
[Mon Mar 30 11:28:18.484784 2026] [:error] [pid 35343:tid 35368] [client 194.5.82.122:48111] [client 194.5.82.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/admin-header.php"] [unique_id "acnt0qP5HurqmbvwN-JpWQAAABc"]
[Mon Mar 30 11:28:18.693117 2026] [:error] [pid 35343:tid 35364] [client 194.5.82.153:51625] [client 194.5.82.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-content/"] [unique_id "acnt0qP5HurqmbvwN-JpWwAAABM"]
[Mon Mar 30 11:28:18.887623 2026] [:error] [pid 35343:tid 35350] [client 194.5.82.160:37289] [client 194.5.82.160] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/function/function.php"] [unique_id "acnt0qP5HurqmbvwN-JpXAAAAAU"]
[Mon Mar 30 11:28:20.537667 2026] [:error] [pid 35250:tid 35319] [client 194.5.82.169:37157] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/log.php"] [unique_id "acnt1IaKM1MR6zcp2YOpBgAAAMg"]
[Mon Mar 30 11:28:20.717700 2026] [:error] [pid 35250:tid 35332] [client 194.5.82.150:59343] [client 194.5.82.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "acnt1IaKM1MR6zcp2YOpBwAAANU"]
[Mon Mar 30 11:28:20.898292 2026] [:error] [pid 35250:tid 35333] [client 194.5.82.152:40041] [client 194.5.82.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/joker.php"] [unique_id "acnt1IaKM1MR6zcp2YOpCAAAANY"]
[Mon Mar 30 11:28:21.085502 2026] [:error] [pid 35250:tid 35335] [client 194.5.82.122:42255] [client 194.5.82.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/Iitespeed-cache/classwithtostring.php"] [unique_id "acnt1YaKM1MR6zcp2YOpCgAAANg"]
[Mon Mar 30 11:28:21.271964 2026] [:error] [pid 35250:tid 35327] [client 194.5.82.111:51025] [client 194.5.82.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/theme-check/theme-check.php"] [unique_id "acnt1YaKM1MR6zcp2YOpCwAAANA"]
[Mon Mar 30 11:28:21.455154 2026] [:error] [pid 41941:tid 41943] [client 194.5.82.122:49879] [client 194.5.82.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/theme-check/joker.php"] [unique_id "acnt1SB2g7BNCXGBOJN_ngAAAQA"]
[Mon Mar 30 11:28:21.639416 2026] [:error] [pid 41941:tid 41953] [client 194.5.82.163:28423] [client 194.5.82.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comment-date/"] [unique_id "acnt1SB2g7BNCXGBOJN_nwAAAQo"]
[Mon Mar 30 11:28:21.819740 2026] [:error] [pid 35343:tid 35364] [client 194.5.82.134:20785] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/joker.php"] [unique_id "acnt1aP5HurqmbvwN-JpZQAAABM"]
[Mon Mar 30 11:28:22.013872 2026] [:error] [pid 35343:tid 35367] [client 194.5.82.139:43293] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/news-portal/content-"] [unique_id "acnt1qP5HurqmbvwN-JpZgAAABY"]
[Mon Mar 30 11:28:22.196740 2026] [:error] [pid 41941:tid 41964] [client 194.5.82.137:30263] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/news-portal/user-install.php"] [unique_id "acnt1iB2g7BNCXGBOJN_oQAAARU"]
[Mon Mar 30 11:28:22.381485 2026] [:error] [pid 35343:tid 35363] [client 194.5.82.138:26405] [client 194.5.82.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/chosen.php"] [unique_id "acnt1qP5HurqmbvwN-JpZwAAABI"]
[Mon Mar 30 11:28:22.561294 2026] [:error] [pid 41941:tid 41945] [client 194.5.82.117:54055] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/joker.php"] [unique_id "acnt1iB2g7BNCXGBOJN_pAAAAQI"]
[Mon Mar 30 11:28:22.742075 2026] [:error] [pid 35249:tid 35301] [client 194.5.82.147:41913] [client 194.5.82.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/elementor/core/files/about.php"] [unique_id "acnt1iqCKiTq85d6rgAatwAAAJE"]
[Mon Mar 30 11:28:27.923388 2026] [:error] [pid 35250:tid 35325] [client 194.5.82.118:29055] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/waspthemes-yellow-pencil/images/list/about.php"] [unique_id "acnt24aKM1MR6zcp2YOpFQAAAM4"]
[Mon Mar 30 11:28:33.289786 2026] [:error] [pid 35248:tid 35263] [client 194.5.82.162:51161] [client 194.5.82.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/miniorange-malware-protection/handler/about.php"] [unique_id "acnt4b3igMCgAQPFS_8JngAAAEk"]
[Mon Mar 30 11:28:33.483143 2026] [:error] [pid 35248:tid 35268] [client 194.5.82.123:36699] [client 194.5.82.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/text.php"] [unique_id "acnt4b3igMCgAQPFS_8JnwAAAE4"]
[Mon Mar 30 11:28:33.679568 2026] [:error] [pid 35343:tid 35347] [client 194.5.82.136:43367] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "acnt4aP5HurqmbvwN-JpcwAAAAI"]
[Mon Mar 30 11:28:33.885666 2026] [:error] [pid 35248:tid 35276] [client 194.5.82.140:31489] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/mer_gagal.php"] [unique_id "acnt4b3igMCgAQPFS_8JoQAAAFY"]
[Mon Mar 30 11:28:34.082588 2026] [:error] [pid 35248:tid 35265] [client 194.5.82.154:41865] [client 194.5.82.154] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/lock.php"] [unique_id "acnt4r3igMCgAQPFS_8JowAAAEs"]
[Mon Mar 30 11:28:34.275135 2026] [:error] [pid 35248:tid 35273] [client 194.5.82.113:52643] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/mtodm/"] [unique_id "acnt4r3igMCgAQPFS_8JpAAAAFM"]
[Mon Mar 30 11:28:34.486010 2026] [:error] [pid 35248:tid 35278] [client 194.5.82.140:46741] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/elementor/modules/atomic-widgets/prop-types/transform/lock.php"] [unique_id "acnt4r3igMCgAQPFS_8JpQAAAFg"]
[Mon Mar 30 11:28:34.676323 2026] [:error] [pid 35249:tid 35295] [client 194.5.82.121:56837] [client 194.5.82.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "acnt4iqCKiTq85d6rgAawgAAAIs"]
[Mon Mar 30 11:28:34.857974 2026] [:error] [pid 35343:tid 35357] [client 194.5.82.145:27593] [client 194.5.82.145] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/accordion/"] [unique_id "acnt4qP5HurqmbvwN-JpdgAAAAw"]
[Mon Mar 30 11:28:35.040322 2026] [:error] [pid 35248:tid 35266] [client 194.5.82.146:52133] [client 194.5.82.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/"] [unique_id "acnt473igMCgAQPFS_8JqQAAAEw"]
[Mon Mar 30 11:28:35.223560 2026] [:error] [pid 64743:tid 64750] [client 194.5.82.139:46397] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/parts/"] [unique_id "acnt4yzmpVL6Ubzil4hXQwAAAUU"]
[Mon Mar 30 11:28:35.404196 2026] [:error] [pid 64743:tid 64761] [client 194.5.82.120:58785] [client 194.5.82.120] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/chillbud/inc/welcome/assets/img/"] [unique_id "acnt4yzmpVL6Ubzil4hXRAAAAVA"]
[Mon Mar 30 11:28:35.586590 2026] [:error] [pid 35343:tid 35369] [client 194.5.82.169:52053] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-cache-sys/"] [unique_id "acnt46P5HurqmbvwN-JpeAAAABg"]
[Mon Mar 30 11:28:35.781912 2026] [:error] [pid 35343:tid 35354] [client 194.5.82.122:44189] [client 194.5.82.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-post/"] [unique_id "acnt46P5HurqmbvwN-JpeQAAAAk"]
[Mon Mar 30 11:28:35.981420 2026] [:error] [pid 35343:tid 35361] [client 194.5.82.136:42833] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/elementor-pro/cong.php"] [unique_id "acnt46P5HurqmbvwN-JpewAAABA"]
[Mon Mar 30 11:28:36.192559 2026] [:error] [pid 35343:tid 35353] [client 194.5.82.109:46127] [client 194.5.82.109] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/hert.php"] [unique_id "acnt5KP5HurqmbvwN-JpfQAAAAg"]
[Mon Mar 30 11:28:36.382517 2026] [:error] [pid 35248:tid 35260] [client 194.5.82.161:21391] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/maintenance.php"] [unique_id "acnt5L3igMCgAQPFS_8JrAAAAEY"]
[Mon Mar 30 11:28:36.583833 2026] [:error] [pid 35248:tid 35265] [client 194.5.82.119:31067] [client 194.5.82.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/coke.php"] [unique_id "acnt5L3igMCgAQPFS_8JrQAAAEs"]
[Mon Mar 30 11:28:36.764073 2026] [:error] [pid 35343:tid 35348] [client 194.5.82.141:64481] [client 194.5.82.141] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugins-long.php"] [unique_id "acnt5KP5HurqmbvwN-JpgAAAAAM"]
[Mon Mar 30 11:28:36.943844 2026] [:error] [pid 35248:tid 35277] [client 194.5.82.160:31497] [client 194.5.82.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-text-cron.php"] [unique_id "acnt5L3igMCgAQPFS_8JrgAAAFc"]
[Mon Mar 30 11:28:37.133574 2026] [:error] [pid 35343:tid 35357] [client 194.5.82.155:22025] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/php7.php"] [unique_id "acnt5aP5HurqmbvwN-JpgQAAAAw"]
[Mon Mar 30 11:28:37.315150 2026] [:error] [pid 35343:tid 35362] [client 194.5.82.146:58307] [client 194.5.82.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "acnt5aP5HurqmbvwN-JpggAAABE"]
[Mon Mar 30 11:28:37.500787 2026] [:error] [pid 35248:tid 35259] [client 194.5.82.111:41215] [client 194.5.82.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/home-link/"] [unique_id "acnt5b3igMCgAQPFS_8JsgAAAEU"]
[Mon Mar 30 11:28:37.687938 2026] [:error] [pid 64743:tid 64763] [client 194.5.82.138:52675] [client 194.5.82.138] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/fuka.php"] [unique_id "acnt5SzmpVL6Ubzil4hXRwAAAVI"]
[Mon Mar 30 11:28:37.885468 2026] [:error] [pid 35343:tid 35354] [client 194.5.82.124:53481] [client 194.5.82.124] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/inc/builder/type/base/dynamic-css/button/"] [unique_id "acnt5aP5HurqmbvwN-JphAAAAAk"]
[Mon Mar 30 11:28:43.085055 2026] [:error] [pid 35343:tid 35357] [client 194.5.82.120:22153] [client 194.5.82.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/plex1.php"] [unique_id "acnt66P5HurqmbvwN-JptQAAAAw"]
[Mon Mar 30 11:28:43.295389 2026] [:error] [pid 35249:tid 35295] [client 194.5.82.159:30581] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/widgets-form-blocks-interface.php"] [unique_id "acnt6yqCKiTq85d6rgAa_wAAAIs"]
[Mon Mar 30 11:28:43.724395 2026] [:error] [pid 64743:tid 64767] [client 194.5.82.113:28801] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/"] [unique_id "acnt6yzmpVL6Ubzil4hXTwAAAVY"]
[Mon Mar 30 11:28:43.911007 2026] [:error] [pid 64743:tid 64754] [client 194.5.82.105:54789] [client 194.5.82.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pretty-link/js/build/wp-cron.php"] [unique_id "acnt6yzmpVL6Ubzil4hXUAAAAUk"]
[Mon Mar 30 11:28:44.093133 2026] [:error] [pid 35249:tid 35288] [client 194.5.82.136:26899] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/webp-express/radio.php"] [unique_id "acnt7CqCKiTq85d6rgAbAAAAAIQ"]
[Mon Mar 30 11:28:44.277458 2026] [:error] [pid 35250:tid 35320] [client 194.5.82.147:53127] [client 194.5.82.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/webp-express/webp-images-bigger-than-source/providers/"] [unique_id "acnt7IaKM1MR6zcp2YOpGgAAAMk"]
[Mon Mar 30 11:28:44.460790 2026] [:error] [pid 35343:tid 35348] [client 194.5.82.123:54281] [client 194.5.82.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/888starz-egypt-theme/inc/page/wp-cron.php"] [unique_id "acnt7KP5HurqmbvwN-JpuwAAAAM"]
[Mon Mar 30 11:28:44.641154 2026] [:error] [pid 35248:tid 35262] [client 194.5.82.108:40137] [client 194.5.82.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/nextpage/wp-cron.php"] [unique_id "acnt7L3igMCgAQPFS_8JvQAAAEg"]
[Mon Mar 30 11:28:44.836976 2026] [:error] [pid 64743:tid 64747] [client 194.5.82.159:23129] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/namespaced/customize/"] [unique_id "acnt7CzmpVL6Ubzil4hXVwAAAUI"]
[Mon Mar 30 11:28:45.019097 2026] [:error] [pid 41941:tid 41957] [client 194.5.82.119:55687] [client 194.5.82.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/theme-compat/"] [unique_id "acnt7SB2g7BNCXGBOJN_ygAAAQ4"]
[Mon Mar 30 11:28:45.200397 2026] [:error] [pid 35248:tid 35273] [client 194.5.82.146:30105] [client 194.5.82.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/wp-rest/about.php"] [unique_id "acnt7b3igMCgAQPFS_8JvwAAAFM"]
[Mon Mar 30 11:28:45.382266 2026] [:error] [pid 35343:tid 35354] [client 194.5.82.169:30941] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/button/admiin.php"] [unique_id "acnt7aP5HurqmbvwN-JpvwAAAAk"]
[Mon Mar 30 11:28:50.561719 2026] [:error] [pid 64743:tid 64769] [client 194.5.82.169:37057] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/sunrise/rum.php"] [unique_id "acnt8izmpVL6Ubzil4hXcQAAAVg"]
[Mon Mar 30 11:28:50.742065 2026] [:error] [pid 35248:tid 35265] [client 194.5.82.125:48807] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/session_init.php"] [unique_id "acnt8r3igMCgAQPFS_8J1QAAAEs"]
[Mon Mar 30 11:28:50.924365 2026] [:error] [pid 35250:tid 35322] [client 194.5.82.146:34555] [client 194.5.82.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/wp-config-extra.php"] [unique_id "acnt8oaKM1MR6zcp2YOpJAAAAMs"]
[Mon Mar 30 11:28:51.111803 2026] [:error] [pid 35248:tid 35269] [client 194.5.82.117:55711] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hello-plus/classes/ehp-social-elf.php"] [unique_id "acnt873igMCgAQPFS_8J1gAAAE8"]
[Mon Mar 30 11:28:51.292073 2026] [:error] [pid 35248:tid 35262] [client 194.5.82.105:50739] [client 194.5.82.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/enhanced-text-widget/analyst/src/403.php"] [unique_id "acnt873igMCgAQPFS_8J2AAAAEg"]
[Mon Mar 30 11:29:01.522296 2026] [:error] [pid 35343:tid 35364] [client 194.5.82.105:52927] [client 194.5.82.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/about.php"] [unique_id "acnt_aP5HurqmbvwN-Jp3AAAABM"]
[Mon Mar 30 11:29:01.700849 2026] [:error] [pid 35248:tid 35254] [client 194.5.82.134:25561] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/themes/load.php"] [unique_id "acnt_b3igMCgAQPFS_8KCgAAAEA"]
[Mon Mar 30 11:29:01.899987 2026] [:error] [pid 35343:tid 35353] [client 194.5.82.146:60925] [client 194.5.82.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/system.php"] [unique_id "acnt_aP5HurqmbvwN-Jp3wAAAAg"]
[Mon Mar 30 11:29:02.090783 2026] [:error] [pid 41941:tid 41959] [client 194.5.82.118:27783] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/users.php"] [unique_id "acnt_iB2g7BNCXGBOJN_8QAAARA"]
[Mon Mar 30 11:29:07.281381 2026] [:error] [pid 35343:tid 35362] [client 194.5.82.135:34345] [client 194.5.82.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/prayer_intentions.php"] [unique_id "acnuA6P5HurqmbvwN-Jp6QAAABE"]
[Mon Mar 30 11:29:07.461347 2026] [:error] [pid 35250:tid 35314] [client 194.5.82.118:60361] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/slideshow-ck/themes/config.php"] [unique_id "acnuA4aKM1MR6zcp2YOpMwAAAMM"]
[Mon Mar 30 11:29:07.643927 2026] [:error] [pid 35248:tid 35264] [client 194.5.82.111:23127] [client 194.5.82.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/db-status.php"] [unique_id "acnuA73igMCgAQPFS_8KLwAAAEo"]
[Mon Mar 30 11:29:07.825322 2026] [:error] [pid 35248:tid 35273] [client 194.5.82.131:36045] [client 194.5.82.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/includes/js/jquery-ui/themes/system.php"] [unique_id "acnuA73igMCgAQPFS_8KMQAAAFM"]
[Mon Mar 30 11:29:08.011585 2026] [:error] [pid 35248:tid 35263] [client 194.5.82.150:55973] [client 194.5.82.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/error.php"] [unique_id "acnuBL3igMCgAQPFS_8KNAAAAEk"]
[Mon Mar 30 11:29:08.192049 2026] [:error] [pid 35248:tid 35254] [client 194.5.82.124:57593] [client 194.5.82.124] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comments-pagination-next/"] [unique_id "acnuBL3igMCgAQPFS_8KNQAAAEA"]
[Mon Mar 30 11:29:08.385136 2026] [:error] [pid 35248:tid 35262] [client 194.5.82.125:29363] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Exception/"] [unique_id "acnuBL3igMCgAQPFS_8KOAAAAEg"]
[Mon Mar 30 11:29:08.565467 2026] [:error] [pid 35248:tid 35276] [client 194.5.82.153:23655] [client 194.5.82.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/cgi-bin/cgi-bin/sql.php"] [unique_id "acnuBL3igMCgAQPFS_8KOgAAAFY"]
[Mon Mar 30 11:29:08.744986 2026] [:error] [pid 35248:tid 35277] [client 194.5.82.105:28597] [client 194.5.82.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/options.php"] [unique_id "acnuBL3igMCgAQPFS_8KOwAAAFc"]
[Mon Mar 30 11:29:08.925546 2026] [:error] [pid 35343:tid 35349] [client 194.5.82.161:27785] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/all-in-one-wp-security-and-firewall/templates/wp-admin/security.php"] [unique_id "acnuBKP5HurqmbvwN-Jp8AAAAAQ"]
[Mon Mar 30 11:29:10.808638 2026] [:error] [pid 35250:tid 35335] [client 194.5.82.125:42409] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/maintenance.php"] [unique_id "acnuBoaKM1MR6zcp2YOpQAAAANg"]
[Mon Mar 30 11:29:10.991804 2026] [:error] [pid 64743:tid 64749] [client 194.5.82.155:54073] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-mail.phpp"] [unique_id "acnuBizmpVL6Ubzil4hXnwAAAUQ"]
[Mon Mar 30 11:29:11.189319 2026] [:error] [pid 35249:tid 35290] [client 194.5.82.161:34909] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/upload.php"] [unique_id "acnuByqCKiTq85d6rgAbEgAAAIY"]
[Mon Mar 30 11:29:11.389391 2026] [:error] [pid 35249:tid 35289] [client 194.5.82.155:36825] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-cron.php"] [unique_id "acnuByqCKiTq85d6rgAbFAAAAIU"]
[Mon Mar 30 11:29:11.589588 2026] [:error] [pid 35343:tid 35366] [client 194.5.82.169:31921] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/api.php"] [unique_id "acnuB6P5HurqmbvwN-Jp8gAAABU"]
[Mon Mar 30 11:29:11.782456 2026] [:error] [pid 64743:tid 64760] [client 194.5.82.116:51563] [client 194.5.82.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/panel.php"] [unique_id "acnuByzmpVL6Ubzil4hXogAAAU8"]
[Mon Mar 30 11:29:11.985909 2026] [:error] [pid 41941:tid 41952] [client 194.5.82.137:33401] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/000.php"] [unique_id "acnuByB2g7BNCXGBOJN__wAAAQk"]
[Mon Mar 30 11:29:12.182370 2026] [:error] [pid 35343:tid 35347] [client 194.5.82.134:55697] [client 194.5.82.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/tx1.php"] [unique_id "acnuCKP5HurqmbvwN-Jp9wAAAAI"]
[Mon Mar 30 11:29:17.412591 2026] [:error] [pid 35248:tid 35276] [client 194.5.82.141:58031] [client 194.5.82.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/autoload_classmap.php"] [unique_id "acnuDb3igMCgAQPFS_8KUgAAAFY"]
[Mon Mar 30 11:29:17.597865 2026] [:error] [pid 35248:tid 35263] [client 194.5.82.122:20833] [client 194.5.82.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "acnuDb3igMCgAQPFS_8KUwAAAEk"]
[Mon Mar 30 11:29:17.787455 2026] [:error] [pid 35250:tid 35325] [client 194.5.82.137:64495] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/chosen.php"] [unique_id "acnuDYaKM1MR6zcp2YOpVwAAAM4"]
[Mon Mar 30 11:29:22.988183 2026] [:error] [pid 35248:tid 35267] [client 194.5.82.153:56545] [client 194.5.82.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/themes/bb.php"] [unique_id "acnuEr3igMCgAQPFS_8KZAAAAE0"]
[Mon Mar 30 11:29:23.181440 2026] [:error] [pid 35248:tid 35271] [client 194.5.82.125:63833] [client 194.5.82.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-react-refresh.php"] [unique_id "acnuE73igMCgAQPFS_8KZQAAAFE"]
[Mon Mar 30 11:29:23.362579 2026] [:error] [pid 35248:tid 35272] [client 194.5.82.113:34919] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint/about2.php"] [unique_id "acnuE73igMCgAQPFS_8KZgAAAFI"]
[Mon Mar 30 11:29:23.557282 2026] [:error] [pid 35248:tid 35269] [client 194.5.82.157:44895] [client 194.5.82.157] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/pngoptimazie.php"] [unique_id "acnuE73igMCgAQPFS_8KagAAAE8"]
[Mon Mar 30 11:29:23.738001 2026] [:error] [pid 35249:tid 35298] [client 194.5.82.121:51379] [client 194.5.82.121] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/rstsgd.php"] [unique_id "acnuEyqCKiTq85d6rgAbGAAAAI4"]
[Mon Mar 30 11:29:23.919718 2026] [:error] [pid 64743:tid 64753] [client 194.5.82.146:31391] [client 194.5.82.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/shortcodes-ultimate/admin.php"] [unique_id "acnuEyzmpVL6Ubzil4hXpgAAAUg"]
[Mon Mar 30 11:29:24.101787 2026] [:error] [pid 64743:tid 64754] [client 194.5.82.153:52103] [client 194.5.82.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/install-helper-new.php"] [unique_id "acnuFCzmpVL6Ubzil4hXpwAAAUk"]
[Mon Mar 30 11:29:29.286744 2026] [:error] [pid 41941:tid 41953] [client 194.5.82.116:56389] [client 194.5.82.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/options-discussion-statement.php"] [unique_id "acnuGSB2g7BNCXGBOJOABgAAAQo"]
[Mon Mar 30 11:29:29.495917 2026] [:error] [pid 64743:tid 64750] [client 194.5.82.137:64997] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/xmrlpc.php"] [unique_id "acnuGSzmpVL6Ubzil4hXrwAAAUU"]
[Mon Mar 30 11:29:29.697854 2026] [:error] [pid 35248:tid 35274] [client 194.5.82.159:37897] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/author-template-object.php"] [unique_id "acnuGb3igMCgAQPFS_8KgwAAAFQ"]
[Mon Mar 30 11:29:29.888103 2026] [:error] [pid 35248:tid 35266] [client 194.5.82.122:39777] [client 194.5.82.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/doc.php"] [unique_id "acnuGb3igMCgAQPFS_8KhQAAAEw"]
[Mon Mar 30 11:29:30.073525 2026] [:error] [pid 35248:tid 35258] [client 194.5.82.135:44641] [client 194.5.82.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/vendor/about.php"] [unique_id "acnuGr3igMCgAQPFS_8KhwAAAEQ"]
[Mon Mar 30 11:29:35.293780 2026] [:error] [pid 35248:tid 35270] [client 194.5.82.144:23013] [client 194.5.82.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/site-title-restful.php"] [unique_id "acnuH73igMCgAQPFS_8KmwAAAFA"]
[Mon Mar 30 11:29:35.700481 2026] [:error] [pid 35248:tid 35278] [client 194.5.82.163:25159] [client 194.5.82.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/fonts/poppins/wp-login.php"] [unique_id "acnuH73igMCgAQPFS_8KnAAAAFg"]
[Mon Mar 30 11:29:35.901284 2026] [:error] [pid 35250:tid 35312] [client 194.5.82.108:63627] [client 194.5.82.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/namespaced/Core/goods.php"] [unique_id "acnuH4aKM1MR6zcp2YOpZQAAAME"]
[Mon Mar 30 11:29:36.082573 2026] [:error] [pid 64743:tid 64752] [client 194.5.82.169:26405] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/moon.php"] [unique_id "acnuICzmpVL6Ubzil4hXtAAAAUc"]
[Mon Mar 30 11:29:36.287209 2026] [:error] [pid 35248:tid 35273] [client 194.5.82.137:35765] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wpcode/moon.php"] [unique_id "acnuIL3igMCgAQPFS_8KoQAAAFM"]
[Mon Mar 30 11:29:36.482131 2026] [:error] [pid 64743:tid 64763] [client 194.5.82.160:33961] [client 194.5.82.160] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/admin.php"] [unique_id "acnuICzmpVL6Ubzil4hXtgAAAVI"]
[Mon Mar 30 11:29:36.691671 2026] [:error] [pid 35250:tid 35323] [client 194.5.82.160:64557] [client 194.5.82.160] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/coffee/backup/js/images/wkag/"] [unique_id "acnuIIaKM1MR6zcp2YOpZwAAAMw"]
[Mon Mar 30 11:29:36.894335 2026] [:error] [pid 35248:tid 35271] [client 194.5.82.141:29823] [client 194.5.82.141] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/ftde.php"] [unique_id "acnuIL3igMCgAQPFS_8KowAAAFE"]
[Mon Mar 30 11:29:37.078916 2026] [:error] [pid 64743:tid 64748] [client 194.5.82.143:29701] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/neve/assets/apps/dashboard/build/"] [unique_id "acnuISzmpVL6Ubzil4hXugAAAUM"]
[Mon Mar 30 11:29:37.259692 2026] [:error] [pid 35250:tid 35311] [client 194.5.82.162:47009] [client 194.5.82.162] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "acnuIYaKM1MR6zcp2YOpaQAAAMA"]
[Mon Mar 30 11:29:37.439298 2026] [:error] [pid 64743:tid 64768] [client 194.5.82.107:34243] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comment-reply-link/"] [unique_id "acnuISzmpVL6Ubzil4hXvAAAAVc"]
[Mon Mar 30 11:29:42.624218 2026] [:error] [pid 35248:tid 35272] [client 194.5.82.122:42349] [client 194.5.82.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comments-pagination-numbers/"] [unique_id "acnuJr3igMCgAQPFS_8KwQAAAFI"]
[Mon Mar 30 11:29:42.812644 2026] [:error] [pid 41941:tid 41961] [client 194.5.82.155:61827] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/script-modules/block-library/navigation/"] [unique_id "acnuJiB2g7BNCXGBOJOAEgAAARI"]
[Mon Mar 30 11:29:42.999655 2026] [:error] [pid 35248:tid 35276] [client 194.5.82.141:24745] [client 194.5.82.141] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/fonts/"] [unique_id "acnuJr3igMCgAQPFS_8KwwAAAFY"]
[Mon Mar 30 11:29:43.181601 2026] [:error] [pid 35248:tid 35261] [client 194.5.82.108:41529] [client 194.5.82.108] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "acnuJ73igMCgAQPFS_8KxAAAAEc"]
[Mon Mar 30 11:29:43.363392 2026] [:error] [pid 35248:tid 35262] [client 194.5.82.163:21391] [client 194.5.82.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/legacy-widget/"] [unique_id "acnuJ73igMCgAQPFS_8KxQAAAEg"]
[Mon Mar 30 11:29:48.545887 2026] [:error] [pid 35249:tid 35288] [client 194.5.82.160:62107] [client 194.5.82.160] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "acnuLCqCKiTq85d6rgAbOAAAAIQ"]
[Mon Mar 30 11:29:48.770313 2026] [:error] [pid 35250:tid 35313] [client 194.5.82.159:20085] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/"] [unique_id "acnuLIaKM1MR6zcp2YOpfwAAAMI"]
[Mon Mar 30 11:29:48.951428 2026] [:error] [pid 35250:tid 35330] [client 194.5.82.118:40339] [client 194.5.82.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ws.php"] [unique_id "acnuLIaKM1MR6zcp2YOpgAAAANM"]
[Mon Mar 30 11:29:54.132466 2026] [:error] [pid 35248:tid 35276] [client 194.5.82.107:41535] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/inc/WPSEO.php"] [unique_id "acnuMr3igMCgAQPFS_8K4wAAAFY"]
[Mon Mar 30 11:29:54.316655 2026] [:error] [pid 35248:tid 35272] [client 194.5.82.159:54017] [client 194.5.82.159] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/elementor/core/files/base.php"] [unique_id "acnuMr3igMCgAQPFS_8K5AAAAFI"]
[Mon Mar 30 11:29:54.509101 2026] [:error] [pid 35250:tid 35326] [client 194.5.82.137:29095] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/includes/admin/reports/class-wc-report-orders-stats.php"] [unique_id "acnuMoaKM1MR6zcp2YOpiAAAAM8"]
[Mon Mar 30 11:29:54.690646 2026] [:error] [pid 35343:tid 35351] [client 194.5.82.146:38803] [client 194.5.82.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/admin/js/contact-form-7-admin.js.php"] [unique_id "acnuMqP5HurqmbvwN-JqMwAAAAY"]
[Mon Mar 30 11:29:54.900179 2026] [:error] [pid 35250:tid 35313] [client 194.5.82.105:26957] [client 194.5.82.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/revslider/temp/update_extract/revslider.php"] [unique_id "acnuMoaKM1MR6zcp2YOpiQAAAMI"]
[Mon Mar 30 11:29:55.082557 2026] [:error] [pid 35343:tid 35368] [client 194.5.82.140:53869] [client 194.5.82.140] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"] [unique_id "acnuM6P5HurqmbvwN-JqNQAAABc"]
[Mon Mar 30 11:29:55.293462 2026] [:error] [pid 64743:tid 64766] [client 194.5.82.122:46341] [client 194.5.82.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/plugins/shell.php"] [unique_id "acnuMyzmpVL6Ubzil4hX0AAAAVU"]
[Mon Mar 30 11:29:55.484223 2026] [:error] [pid 35250:tid 35315] [client 194.5.82.116:37005] [client 194.5.82.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/shell.php"] [unique_id "acnuM4aKM1MR6zcp2YOpigAAAMQ"]
[Mon Mar 30 11:29:55.665652 2026] [:error] [pid 64743:tid 64758] [client 194.5.82.111:47439] [client 194.5.82.111] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-settings.php"] [unique_id "acnuMyzmpVL6Ubzil4hX0gAAAU0"]
[Mon Mar 30 11:29:55.883041 2026] [:error] [pid 35249:tid 35284] [client 194.5.82.145:35897] [client 194.5.82.145] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-blog-header.php"] [unique_id "acnuMyqCKiTq85d6rgAbOgAAAIA"]
[Mon Mar 30 11:29:56.068405 2026] [:error] [pid 64743:tid 64746] [client 194.5.82.169:38151] [client 194.5.82.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/storage/framework/cache/data/shell.php"] [unique_id "acnuNCzmpVL6Ubzil4hX1gAAAUE"]
[Mon Mar 30 11:29:56.248677 2026] [:error] [pid 41941:tid 41953] [client 194.5.82.153:29259] [client 194.5.82.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/cache/supercache/shell.php"] [unique_id "acnuNCB2g7BNCXGBOJOAGAAAAQo"]
[Mon Mar 30 11:30:06.456917 2026] [:error] [pid 35248:tid 35261] [client 194.5.82.155:35293] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/rss.php"] [unique_id "acnuPr3igMCgAQPFS_8K9AAAAEc"]
[Mon Mar 30 11:30:06.641678 2026] [:error] [pid 35248:tid 35259] [client 194.5.82.132:42221] [client 194.5.82.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/search.php"] [unique_id "acnuPr3igMCgAQPFS_8K9QAAAEU"]
[Mon Mar 30 11:30:06.829897 2026] [:error] [pid 35250:tid 35335] [client 194.5.82.170:31973] [client 194.5.82.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-comments.php"] [unique_id "acnuPoaKM1MR6zcp2YOpnAAAANg"]
[Mon Mar 30 11:30:07.011383 2026] [:error] [pid 35250:tid 35325] [client 194.5.82.143:65239] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/templates/system/core.php"] [unique_id "acnuP4aKM1MR6zcp2YOpnQAAAM4"]
[Mon Mar 30 11:30:07.193947 2026] [:error] [pid 35343:tid 35349] [client 194.5.82.135:32791] [client 194.5.82.135] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/administrator/components/com_ajax/ajax.php"] [unique_id "acnuP6P5HurqmbvwN-JqSAAAAAQ"]
[Mon Mar 30 11:30:07.386505 2026] [:error] [pid 35250:tid 35328] [client 194.5.82.155:54759] [client 194.5.82.155] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/components/com_fields/models/fields.php"] [unique_id "acnuP4aKM1MR6zcp2YOpoAAAANE"]
[Mon Mar 30 11:30:07.576613 2026] [:error] [pid 35343:tid 35347] [client 194.5.82.139:62371] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/modules/mod_login/tmpl/default.php"] [unique_id "acnuP6P5HurqmbvwN-JqSgAAAAI"]
[Mon Mar 30 11:30:07.767351 2026] [:error] [pid 35343:tid 35357] [client 194.5.82.147:57007] [client 194.5.82.147] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/plugins/system/shell.php"] [unique_id "acnuP6P5HurqmbvwN-JqSwAAAAw"]
[Mon Mar 30 11:30:12.950576 2026] [:error] [pid 35250:tid 35312] [client 194.5.82.113:65041] [client 194.5.82.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/cache/core.php"] [unique_id "acnuRIaKM1MR6zcp2YOprAAAAME"]
[Mon Mar 30 11:30:13.132860 2026] [:error] [pid 35248:tid 35254] [client 194.5.82.150:36169] [client 194.5.82.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/images/core.php"] [unique_id "acnuRb3igMCgAQPFS_8LAQAAAEA"]
[Mon Mar 30 11:30:13.322977 2026] [:error] [pid 35248:tid 35277] [client 194.5.82.124:29601] [client 194.5.82.124] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/language/overrides/system.php"] [unique_id "acnuRb3igMCgAQPFS_8LAwAAAFc"]
[Mon Mar 30 11:30:13.505313 2026] [:error] [pid 35250:tid 35329] [client 194.5.82.119:60913] [client 194.5.82.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/administrator/cache/core.php"] [unique_id "acnuRYaKM1MR6zcp2YOprgAAANI"]
[Mon Mar 30 11:30:13.686739 2026] [:error] [pid 41941:tid 41962] [client 194.5.82.150:40497] [client 194.5.82.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/components/com_media/controller.php"] [unique_id "acnuRSB2g7BNCXGBOJOAMgAAARM"]
[Mon Mar 30 11:30:13.880092 2026] [:error] [pid 35250:tid 35314] [client 194.5.82.107:28265] [client 194.5.82.107] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/templates/template/error.php"] [unique_id "acnuRYaKM1MR6zcp2YOprwAAAMM"]
[Mon Mar 30 11:30:14.078371 2026] [:error] [pid 64743:tid 64755] [client 194.5.82.119:53869] [client 194.5.82.119] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/administrator/modules/mod_login/core.php"] [unique_id "acnuRizmpVL6Ubzil4hX5gAAAUo"]
[Mon Mar 30 11:30:14.259902 2026] [:error] [pid 35249:tid 35288] [client 194.5.82.132:53195] [client 194.5.82.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/plugins/user/profile/core.php"] [unique_id "acnuRiqCKiTq85d6rgAbQwAAAIQ"]
[Mon Mar 30 11:30:14.443938 2026] [:error] [pid 41941:tid 41950] [client 194.5.82.130:52339] [client 194.5.82.130] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/configuration.php"] [unique_id "acnuRiB2g7BNCXGBOJOANgAAAQc"]
[Mon Mar 30 11:30:14.625632 2026] [:error] [pid 35250:tid 35316] [client 194.5.82.139:45975] [client 194.5.82.139] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/admin/controller/extension/module/shell.php"] [unique_id "acnuRoaKM1MR6zcp2YOpsgAAAMU"]
[Mon Mar 30 11:30:14.806597 2026] [:error] [pid 41941:tid 41960] [client 194.5.82.136:51009] [client 194.5.82.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/image/data/core.php"] [unique_id "acnuRiB2g7BNCXGBOJOAOQAAARE"]
[Mon Mar 30 11:30:15.002894 2026] [:error] [pid 41941:tid 41957] [client 194.5.82.132:36329] [client 194.5.82.132] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/system/storage/cache/core.php"] [unique_id "acnuRyB2g7BNCXGBOJOAPAAAAQ4"]
[Mon Mar 30 11:30:15.224780 2026] [:error] [pid 35250:tid 35315] [client 194.5.82.123:62147] [client 194.5.82.123] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/catalog/view/theme/default/template/common/shell.php"] [unique_id "acnuR4aKM1MR6zcp2YOpswAAAMQ"]
[Mon Mar 30 11:30:15.406165 2026] [:error] [pid 35250:tid 35334] [client 194.5.82.161:62217] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/admin/view/template/extension/module/shell.php"] [unique_id "acnuR4aKM1MR6zcp2YOptAAAANc"]
[Mon Mar 30 11:30:15.586118 2026] [:error] [pid 35250:tid 35328] [client 194.5.82.154:20297] [client 194.5.82.154] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/download/core.php"] [unique_id "acnuR4aKM1MR6zcp2YOptgAAANE"]
[Mon Mar 30 11:30:15.767043 2026] [:error] [pid 41941:tid 41943] [client 194.5.82.117:58769] [client 194.5.82.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/system/engine/loader.php"] [unique_id "acnuRyB2g7BNCXGBOJOAQgAAAQA"]
[Mon Mar 30 11:30:15.946708 2026] [:error] [pid 35250:tid 35320] [client 194.5.82.163:28135] [client 194.5.82.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/admin/controller/common/filemanager/core.php"] [unique_id "acnuR4aKM1MR6zcp2YOpuAAAAMk"]
[Mon Mar 30 11:30:16.128743 2026] [:error] [pid 41941:tid 41951] [client 194.5.82.137:58353] [client 194.5.82.137] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/catalog/controller/journal3/settings.php"] [unique_id "acnuSCB2g7BNCXGBOJOARAAAAQg"]
[Mon Mar 30 11:30:16.381437 2026] [:error] [pid 35249:tid 35298] [client 194.5.82.161:24507] [client 194.5.82.161] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/storage/app/public/core.php"] [unique_id "acnuSCqCKiTq85d6rgAbRgAAAI4"]
[Mon Mar 30 11:30:16.681069 2026] [:error] [pid 41941:tid 41966] [client 194.5.82.163:33087] [client 194.5.82.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/storage/framework/cache/data/core.php"] [unique_id "acnuSCB2g7BNCXGBOJOARgAAARc"]
[Mon Mar 30 11:30:16.890932 2026] [:error] [pid 35250:tid 35329] [client 194.5.82.116:26585] [client 194.5.82.116] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/public/core.php"] [unique_id "acnuSIaKM1MR6zcp2YOpwwAAANI"]
[Mon Mar 30 11:30:17.083687 2026] [:error] [pid 35248:tid 35269] [client 194.5.82.152:64427] [client 194.5.82.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/vendor/composer/installed.php"] [unique_id "acnuSb3igMCgAQPFS_8LBQAAAE8"]
[Mon Mar 30 11:30:17.286795 2026] [:error] [pid 35343:tid 35365] [client 194.5.82.131:63847] [client 194.5.82.131] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/storage/framework/sessions/core.php"] [unique_id "acnuSaP5HurqmbvwN-JqWQAAABQ"]
[Mon Mar 30 11:30:17.478595 2026] [:error] [pid 35343:tid 35345] [client 194.5.82.163:40649] [client 194.5.82.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bootstrap/cache/config.php"] [unique_id "acnuSaP5HurqmbvwN-JqWgAAAAA"]
[Mon Mar 30 11:30:17.659317 2026] [:error] [pid 35250:tid 35315] [client 194.5.82.143:64831] [client 194.5.82.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/storage/framework/views/core.php"] [unique_id "acnuSYaKM1MR6zcp2YOp2wAAAMQ"]
[Mon Mar 30 13:21:06.481394 2026] [:error] [pid 64743:tid 64761] [client 20.222.17.205:2438] [client 20.222.17.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/logs233/index.php"] [unique_id "acoIQizmpVL6Ubzil4hyQAAAAVA"]
[Mon Mar 30 13:21:07.031529 2026] [:error] [pid 50663:tid 50673] [client 20.222.17.205:2682] [client 20.222.17.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/logs233/index.php"] [unique_id "acoIQ228b9DKIAMEdfDPHAAAAYg"]
[Mon Mar 30 13:21:07.603335 2026] [:error] [pid 51065:tid 51077] [client 20.222.17.205:2653] [client 20.222.17.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/logs233/index.php"] [unique_id "acoIQ3Mr8wtZeHSSB7LqxAAAAco"]
[Mon Mar 30 13:21:08.083108 2026] [:error] [pid 35343:tid 35346] [client 20.222.17.205:4363] [client 20.222.17.205] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/logs233/index.php"] [unique_id "acoIRKP5HurqmbvwN-Ko-QAAAAE"]
[Mon Mar 30 13:27:52.614018 2026] [:error] [pid 41941:tid 41956] [client 43.157.22.57:38146] [client 43.157.22.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acoJ2CB2g7BNCXGBOJOm1wAAAQ0"]
[Mon Mar 30 13:43:55.128952 2026] [:error] [pid 35248:tid 35265] [client 104.168.66.97:40066] [client 104.168.66.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "acoNm73igMCgAQPFS_9JQgAAAEs"]
[Mon Mar 30 15:25:13.163835 2026] [:error] [pid 41941:tid 41946] [client 124.123.64.70:49735] [client 124.123.64.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.123.64.70, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acolWSB2g7BNCXGBOJP2ZAAAAQM"]
[Mon Mar 30 15:33:29.522000 2026] [:error] [pid 41941:tid 41959] [client 175.6.217.4:41591] [client 175.6.217.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aconSSB2g7BNCXGBOJP8jQAAARA"]
[Mon Mar 30 16:16:48.522997 2026] [:error] [pid 35249:tid 35290] [client 59.90.29.203:57867] [client 59.90.29.203] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acoxcCqCKiTq85d6rgA__gAAAIY"]
[Mon Mar 30 16:18:20.500141 2026] [:error] [pid 41941:tid 41950] [client 59.90.29.203:57706] [client 59.90.29.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.90.29.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acoxzCB2g7BNCXGBOJMUOQAAAQc"]
[Mon Mar 30 16:19:48.104832 2026] [:error] [pid 41941:tid 41959] [client 59.90.29.203:58397] [client 59.90.29.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.90.29.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acoyJCB2g7BNCXGBOJMV5QAAARA"]
[Mon Mar 30 16:21:13.211313 2026] [:error] [pid 35343:tid 35357] [client 59.90.29.203:64286] [client 59.90.29.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.90.29.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acoyeaP5HurqmbvwN-LxIgAAAAw"]
[Mon Mar 30 16:22:38.906332 2026] [:error] [pid 41941:tid 41946] [client 59.90.29.203:61128] [client 59.90.29.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.90.29.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acoyziB2g7BNCXGBOJMXKQAAAQM"]
[Mon Mar 30 16:24:06.961688 2026] [:error] [pid 51065:tid 51084] [client 59.90.29.203:62735] [client 59.90.29.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.90.29.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acozJnMr8wtZeHSSB7IaFgAAAdE"]
[Mon Mar 30 17:44:03.039249 2026] [:error] [pid 51065:tid 51083] [client 103.65.237.234:62278] [client 103.65.237.234] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "acpF43Mr8wtZeHSSB7IwjAAAAdA"]
[Mon Mar 30 18:19:52.951764 2026] [:error] [pid 35248:tid 35272] [client 51.120.81.94:64045] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsas.php"] [unique_id "acpOSL3igMCgAQPFS_94SgAAAFI"]
[Mon Mar 30 18:19:53.478152 2026] [:error] [pid 35248:tid 35260] [client 51.120.81.94:64532] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsas.php"] [unique_id "acpOSb3igMCgAQPFS_94SwAAAEY"]
[Mon Mar 30 18:19:54.015451 2026] [:error] [pid 11947:tid 11952] [client 51.120.81.94:64012] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsas.php"] [unique_id "acpOSjSVtzzXIgk-FgkpSwAAAgM"]
[Mon Mar 30 18:19:54.543140 2026] [:error] [pid 12046:tid 12073] [client 51.120.81.94:65249] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsas.php"] [unique_id "acpOSpDbtlkoJ6ELn7gRIgAAAlg"]
[Mon Mar 30 18:19:55.073392 2026] [:error] [pid 11947:tid 11967] [client 51.120.81.94:65314] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "acpOSzSVtzzXIgk-FgkpVwAAAhI"]
[Mon Mar 30 18:19:55.600741 2026] [:error] [pid 11947:tid 11965] [client 51.120.81.94:64023] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "acpOSzSVtzzXIgk-FgkpWgAAAhA"]
[Mon Mar 30 18:19:56.140470 2026] [:error] [pid 35248:tid 35276] [client 51.120.81.94:64480] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "acpOTL3igMCgAQPFS_94VQAAAFY"]
[Mon Mar 30 18:19:56.672982 2026] [:error] [pid 11947:tid 11964] [client 51.120.81.94:65342] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "acpOTDSVtzzXIgk-FgkpYwAAAg8"]
[Mon Mar 30 18:19:57.216755 2026] [:error] [pid 11947:tid 11968] [client 51.120.81.94:64036] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-header.php"] [unique_id "acpOTTSVtzzXIgk-FgkpbAAAAhM"]
[Mon Mar 30 18:19:57.757141 2026] [:error] [pid 11947:tid 11954] [client 51.120.81.94:65285] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-header.php"] [unique_id "acpOTTSVtzzXIgk-FgkpdAAAAgU"]
[Mon Mar 30 18:19:58.302011 2026] [:error] [pid 11947:tid 11950] [client 51.120.81.94:65321] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-header.php"] [unique_id "acpOTjSVtzzXIgk-FgkpfQAAAgE"]
[Mon Mar 30 18:19:58.833273 2026] [:error] [pid 64743:tid 64752] [client 51.120.81.94:63963] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-header.php"] [unique_id "acpOTizmpVL6Ubzil4iYeAAAAUc"]
[Mon Mar 30 18:19:59.364679 2026] [:error] [pid 35248:tid 35257] [client 51.120.81.94:65256] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "acpOT73igMCgAQPFS_94WwAAAEM"]
[Mon Mar 30 18:19:59.886903 2026] [:error] [pid 35250:tid 35324] [client 51.120.81.94:65312] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "acpOT4aKM1MR6zcp2YNPVQAAAM0"]
[Mon Mar 30 18:20:00.465010 2026] [:error] [pid 11947:tid 11950] [client 51.120.81.94:64481] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "acpOUDSVtzzXIgk-FgkpggAAAgE"]
[Mon Mar 30 18:20:01.027142 2026] [:error] [pid 11947:tid 11959] [client 51.120.81.94:64492] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "acpOUTSVtzzXIgk-FgkphQAAAgo"]
[Mon Mar 30 18:20:01.556494 2026] [:error] [pid 11947:tid 11951] [client 51.120.81.94:64559] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "acpOUTSVtzzXIgk-FgkpiQAAAgI"]
[Mon Mar 30 18:20:02.081355 2026] [:error] [pid 41941:tid 41955] [client 51.120.81.94:64002] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "acpOUiB2g7BNCXGBOJNfKwAAAQw"]
[Mon Mar 30 18:20:02.614388 2026] [:error] [pid 41941:tid 41961] [client 51.120.81.94:65307] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "acpOUiB2g7BNCXGBOJNfLwAAARI"]
[Mon Mar 30 18:20:03.140395 2026] [:error] [pid 35250:tid 35312] [client 51.120.81.94:64543] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "acpOU4aKM1MR6zcp2YNPWQAAAME"]
[Mon Mar 30 18:20:03.674314 2026] [:error] [pid 35250:tid 35330] [client 51.120.81.94:64561] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "acpOU4aKM1MR6zcp2YNPWwAAANM"]
[Mon Mar 30 18:20:04.196530 2026] [:error] [pid 35250:tid 35327] [client 51.120.81.94:64548] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "acpOVIaKM1MR6zcp2YNPYAAAANA"]
[Mon Mar 30 18:20:04.734471 2026] [:error] [pid 35343:tid 35361] [client 51.120.81.94:65238] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "acpOVKP5HurqmbvwN-IZoQAAABA"]
[Mon Mar 30 18:20:05.277848 2026] [:error] [pid 50663:tid 50686] [client 51.120.81.94:64047] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "acpOVW28b9DKIAMEdfANCQAAAZU"]
[Mon Mar 30 18:20:05.813448 2026] [:error] [pid 50663:tid 50678] [client 51.120.81.94:64537] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "acpOVW28b9DKIAMEdfANDAAAAY0"]
[Mon Mar 30 18:20:06.371292 2026] [:error] [pid 50663:tid 50672] [client 51.120.81.94:64516] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "acpOVm28b9DKIAMEdfANEAAAAYc"]
[Mon Mar 30 18:20:06.961103 2026] [:error] [pid 50663:tid 50666] [client 51.120.81.94:65340] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "acpOVm28b9DKIAMEdfANEgAAAYE"]
[Mon Mar 30 18:20:07.488086 2026] [:error] [pid 41941:tid 41945] [client 51.120.81.94:64031] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "acpOVyB2g7BNCXGBOJNfNwAAAQI"]
[Mon Mar 30 18:20:08.048372 2026] [:error] [pid 41941:tid 41961] [client 51.120.81.94:64056] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "acpOWCB2g7BNCXGBOJNfOgAAARI"]
[Mon Mar 30 18:20:08.579904 2026] [:error] [pid 11947:tid 11964] [client 51.120.81.94:64453] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "acpOWDSVtzzXIgk-FgkpjQAAAg8"]
[Mon Mar 30 18:20:09.112811 2026] [:error] [pid 35250:tid 35333] [client 51.120.81.94:65249] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "acpOWYaKM1MR6zcp2YNPgwAAANY"]
[Mon Mar 30 18:20:09.639026 2026] [:error] [pid 50663:tid 50678] [client 51.120.81.94:64544] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "acpOWW28b9DKIAMEdfANGAAAAY0"]
[Mon Mar 30 18:20:10.171939 2026] [:error] [pid 12046:tid 12050] [client 51.120.81.94:64484] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2ksm17n.php"] [unique_id "acpOWpDbtlkoJ6ELn7gRKAAAAkE"]
[Mon Mar 30 18:20:10.713839 2026] [:error] [pid 35249:tid 35295] [client 51.120.81.94:64455] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2ksm17n.php"] [unique_id "acpOWiqCKiTq85d6rgBNDgAAAIs"]
[Mon Mar 30 18:20:11.242897 2026] [:error] [pid 11947:tid 11953] [client 51.120.81.94:65297] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2ksm17n.php"] [unique_id "acpOWzSVtzzXIgk-FgkpkQAAAgQ"]
[Mon Mar 30 18:20:11.775659 2026] [:error] [pid 11947:tid 11958] [client 51.120.81.94:64504] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2ksm17n.php"] [unique_id "acpOWzSVtzzXIgk-FgkplQAAAgk"]
[Mon Mar 30 18:20:12.309046 2026] [:error] [pid 35343:tid 35366] [client 51.120.81.94:64467] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "acpOXKP5HurqmbvwN-IZpAAAABU"]
[Mon Mar 30 18:20:12.832935 2026] [:error] [pid 50663:tid 50672] [client 51.120.81.94:65328] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "acpOXG28b9DKIAMEdfANGwAAAYc"]
[Mon Mar 30 18:20:13.363933 2026] [:error] [pid 50663:tid 50674] [client 51.120.81.94:64471] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "acpOXW28b9DKIAMEdfANHAAAAYk"]
[Mon Mar 30 18:20:13.886487 2026] [:error] [pid 35249:tid 35304] [client 51.120.81.94:64569] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "acpOXSqCKiTq85d6rgBNDwAAAJQ"]
[Mon Mar 30 18:20:14.416618 2026] [:error] [pid 12106:tid 12114] [client 51.120.81.94:65298] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hots.php"] [unique_id "acpOXrIKxOs8TAdw7hcKMwAAAoY"]
[Mon Mar 30 18:20:14.958448 2026] [:error] [pid 12106:tid 12122] [client 51.120.81.94:64474] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hots.php"] [unique_id "acpOXrIKxOs8TAdw7hcKNgAAAo4"]
[Mon Mar 30 18:20:15.487359 2026] [:error] [pid 35248:tid 35261] [client 51.120.81.94:64032] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hots.php"] [unique_id "acpOX73igMCgAQPFS_94aQAAAEc"]
[Mon Mar 30 18:20:16.014346 2026] [:error] [pid 12106:tid 12125] [client 51.120.81.94:63959] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hots.php"] [unique_id "acpOYLIKxOs8TAdw7hcKNwAAApE"]
[Mon Mar 30 18:20:16.545251 2026] [:error] [pid 64743:tid 64747] [client 51.120.81.94:65334] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "acpOYCzmpVL6Ubzil4iYewAAAUI"]
[Mon Mar 30 18:20:17.074671 2026] [:error] [pid 12106:tid 12110] [client 51.120.81.94:65219] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "acpOYbIKxOs8TAdw7hcKPAAAAoI"]
[Mon Mar 30 18:20:17.611612 2026] [:error] [pid 12106:tid 12132] [client 51.120.81.94:65277] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "acpOYbIKxOs8TAdw7hcKPgAAApg"]
[Mon Mar 30 18:20:18.150393 2026] [:error] [pid 12106:tid 12116] [client 51.120.81.94:64062] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "acpOYrIKxOs8TAdw7hcKQAAAAog"]
[Mon Mar 30 18:20:18.687986 2026] [:error] [pid 50663:tid 50681] [client 51.120.81.94:64028] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "acpOYm28b9DKIAMEdfANHwAAAZA"]
[Mon Mar 30 18:20:19.211179 2026] [:error] [pid 12106:tid 12126] [client 51.120.81.94:63952] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "acpOY7IKxOs8TAdw7hcKQQAAApI"]
[Mon Mar 30 18:20:19.736717 2026] [:error] [pid 12106:tid 12111] [client 51.120.81.94:64546] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "acpOY7IKxOs8TAdw7hcKQgAAAoM"]
[Mon Mar 30 18:20:20.272665 2026] [:error] [pid 12106:tid 12129] [client 51.120.81.94:65293] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "acpOZLIKxOs8TAdw7hcKQwAAApU"]
[Mon Mar 30 18:20:20.817037 2026] [:error] [pid 35343:tid 35356] [client 51.120.81.94:65271] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "acpOZKP5HurqmbvwN-IZsgAAAAs"]
[Mon Mar 30 18:20:21.356354 2026] [:error] [pid 64743:tid 64757] [client 51.120.81.94:63951] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "acpOZSzmpVL6Ubzil4iYggAAAUw"]
[Mon Mar 30 18:20:21.877990 2026] [:error] [pid 35249:tid 35293] [client 51.120.81.94:64459] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "acpOZSqCKiTq85d6rgBNEwAAAIk"]
[Mon Mar 30 18:20:22.422547 2026] [:error] [pid 12046:tid 12066] [client 51.120.81.94:64565] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "acpOZpDbtlkoJ6ELn7gRLwAAAlE"]
[Mon Mar 30 18:20:22.952794 2026] [:error] [pid 41941:tid 41962] [client 51.120.81.94:64563] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acpOZiB2g7BNCXGBOJNfOwAAARM"]
[Mon Mar 30 18:20:23.494316 2026] [:error] [pid 12046:tid 12055] [client 51.120.81.94:64539] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acpOZ5DbtlkoJ6ELn7gRMwAAAkY"]
[Mon Mar 30 18:20:24.020957 2026] [:error] [pid 12106:tid 12118] [client 51.120.81.94:64530] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acpOaLIKxOs8TAdw7hcKRQAAAoo"]
[Mon Mar 30 18:20:24.541347 2026] [:error] [pid 12106:tid 12108] [client 51.120.81.94:65333] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acpOaLIKxOs8TAdw7hcKSAAAAoA"]
[Mon Mar 30 18:20:25.068566 2026] [:error] [pid 50663:tid 50683] [client 51.120.81.94:65277] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "acpOaW28b9DKIAMEdfANJQAAAZI"]
[Mon Mar 30 18:20:25.614095 2026] [:error] [pid 50663:tid 50675] [client 51.120.81.94:64046] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "acpOaW28b9DKIAMEdfANJwAAAYo"]
[Mon Mar 30 18:20:26.147686 2026] [:error] [pid 50663:tid 50687] [client 51.120.81.94:65318] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "acpOam28b9DKIAMEdfANKgAAAZY"]
[Mon Mar 30 18:20:26.681545 2026] [:error] [pid 11947:tid 11966] [client 51.120.81.94:65243] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "acpOajSVtzzXIgk-FgkpmQAAAhE"]
[Mon Mar 30 18:20:27.201393 2026] [:error] [pid 64743:tid 64762] [client 51.120.81.94:64512] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dass.php"] [unique_id "acpOayzmpVL6Ubzil4iYhAAAAVE"]
[Mon Mar 30 18:20:27.732560 2026] [:error] [pid 35248:tid 35275] [client 51.120.81.94:65246] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dass.php"] [unique_id "acpOa73igMCgAQPFS_94cAAAAFU"]
[Mon Mar 30 18:20:28.263030 2026] [:error] [pid 41941:tid 41946] [client 51.120.81.94:65237] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dass.php"] [unique_id "acpObCB2g7BNCXGBOJNfPgAAAQM"]
[Mon Mar 30 18:20:28.789564 2026] [:error] [pid 41941:tid 41954] [client 51.120.81.94:64536] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dass.php"] [unique_id "acpObCB2g7BNCXGBOJNfQQAAAQs"]
[Mon Mar 30 18:20:29.308929 2026] [:error] [pid 11947:tid 11956] [client 51.120.81.94:65291] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "acpObTSVtzzXIgk-FgkpmwAAAgc"]
[Mon Mar 30 18:20:29.835286 2026] [:error] [pid 11947:tid 11957] [client 51.120.81.94:64509] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "acpObTSVtzzXIgk-FgkpngAAAgg"]
[Mon Mar 30 18:20:30.361030 2026] [:error] [pid 50663:tid 50676] [client 51.120.81.94:65338] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "acpObm28b9DKIAMEdfANLAAAAYs"]
[Mon Mar 30 18:20:30.888737 2026] [:error] [pid 35248:tid 35267] [client 51.120.81.94:63950] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "acpObr3igMCgAQPFS_94cgAAAE0"]
[Mon Mar 30 18:20:31.407788 2026] [:error] [pid 11947:tid 11965] [client 51.120.81.94:65250] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws83.php"] [unique_id "acpObzSVtzzXIgk-FgkpowAAAhA"]
[Mon Mar 30 18:20:31.940031 2026] [:error] [pid 11947:tid 11968] [client 51.120.81.94:64523] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws83.php"] [unique_id "acpObzSVtzzXIgk-FgkppQAAAhM"]
[Mon Mar 30 18:20:32.467587 2026] [:error] [pid 35249:tid 35284] [client 51.120.81.94:63031] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws83.php"] [unique_id "acpOcCqCKiTq85d6rgBNGwAAAIA"]
[Mon Mar 30 18:20:32.993598 2026] [:error] [pid 41941:tid 41966] [client 51.120.81.94:64493] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws83.php"] [unique_id "acpOcCB2g7BNCXGBOJNfRQAAARc"]
[Mon Mar 30 18:20:33.512382 2026] [:error] [pid 11947:tid 11967] [client 51.120.81.94:63969] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/56c53.php"] [unique_id "acpOcTSVtzzXIgk-FgkpqQAAAhI"]
[Mon Mar 30 18:20:34.032842 2026] [:error] [pid 41941:tid 41963] [client 51.120.81.94:63388] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/56c53.php"] [unique_id "acpOciB2g7BNCXGBOJNfSQAAARQ"]
[Mon Mar 30 18:20:34.554975 2026] [:error] [pid 11947:tid 11949] [client 51.120.81.94:63966] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/56c53.php"] [unique_id "acpOcjSVtzzXIgk-FgkprQAAAgA"]
[Mon Mar 30 18:20:35.085888 2026] [:error] [pid 50663:tid 50679] [client 51.120.81.94:65229] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/56c53.php"] [unique_id "acpOc228b9DKIAMEdfANNgAAAY4"]
[Mon Mar 30 18:20:35.627774 2026] [:error] [pid 35249:tid 35288] [client 51.120.81.94:65258] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "acpOcyqCKiTq85d6rgBNHgAAAIQ"]
[Mon Mar 30 18:20:36.150497 2026] [:error] [pid 35343:tid 35360] [client 51.120.81.94:64515] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "acpOdKP5HurqmbvwN-IZtAAAAA8"]
[Mon Mar 30 18:20:36.675347 2026] [:error] [pid 41941:tid 41948] [client 51.120.81.94:64535] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "acpOdCB2g7BNCXGBOJNfSwAAAQU"]
[Mon Mar 30 18:20:37.211860 2026] [:error] [pid 35248:tid 35265] [client 51.120.81.94:64009] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "acpOdb3igMCgAQPFS_94dQAAAEs"]
[Mon Mar 30 18:20:37.734773 2026] [:error] [pid 35248:tid 35274] [client 51.120.81.94:64063] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "acpOdb3igMCgAQPFS_94eAAAAFQ"]
[Mon Mar 30 18:20:38.269481 2026] [:error] [pid 35248:tid 35257] [client 51.120.81.94:65280] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "acpOdr3igMCgAQPFS_94egAAAEM"]
[Mon Mar 30 18:20:38.795492 2026] [:error] [pid 35248:tid 35255] [client 51.120.81.94:64503] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "acpOdr3igMCgAQPFS_94fgAAAEE"]
[Mon Mar 30 18:20:39.320079 2026] [:error] [pid 50663:tid 50666] [client 51.120.81.94:63944] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "acpOd228b9DKIAMEdfANOQAAAYE"]
[Mon Mar 30 18:20:39.850112 2026] [:error] [pid 64743:tid 64747] [client 51.120.81.94:65257] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "acpOdyzmpVL6Ubzil4iYiwAAAUI"]
[Mon Mar 30 18:20:40.373766 2026] [:error] [pid 12106:tid 12115] [client 51.120.81.94:64527] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "acpOeLIKxOs8TAdw7hcKUQAAAoc"]
[Mon Mar 30 18:20:40.894160 2026] [:error] [pid 35250:tid 35316] [client 51.120.81.94:64486] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "acpOeIaKM1MR6zcp2YNP3QAAAMU"]
[Mon Mar 30 18:20:41.411883 2026] [:error] [pid 35248:tid 35254] [client 51.120.81.94:63940] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "acpOeb3igMCgAQPFS_94ggAAAEA"]
[Mon Mar 30 18:20:41.936396 2026] [:error] [pid 35248:tid 35262] [client 51.120.81.94:64024] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "acpOeb3igMCgAQPFS_94hQAAAEg"]
[Mon Mar 30 18:20:42.462737 2026] [:error] [pid 35248:tid 35270] [client 51.120.81.94:65272] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "acpOer3igMCgAQPFS_94iQAAAFA"]
[Mon Mar 30 18:20:42.983596 2026] [:error] [pid 35343:tid 35362] [client 51.120.81.94:64568] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "acpOeqP5HurqmbvwN-IZugAAABE"]
[Mon Mar 30 18:20:43.521522 2026] [:error] [pid 12106:tid 12112] [client 51.120.81.94:64517] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "acpOe7IKxOs8TAdw7hcKUwAAAoQ"]
[Mon Mar 30 18:20:44.042578 2026] [:error] [pid 50663:tid 50675] [client 51.120.81.94:65320] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "acpOfG28b9DKIAMEdfANOwAAAYo"]
[Mon Mar 30 18:20:44.564546 2026] [:error] [pid 41941:tid 41962] [client 51.120.81.94:63956] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "acpOfCB2g7BNCXGBOJNfWAAAARM"]
[Mon Mar 30 18:20:45.085148 2026] [:error] [pid 11947:tid 11952] [client 51.120.81.94:65217] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "acpOfTSVtzzXIgk-FgkptQAAAgM"]
[Mon Mar 30 18:20:45.618151 2026] [:error] [pid 41941:tid 41943] [client 51.120.81.94:65218] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "acpOfSB2g7BNCXGBOJNfXQAAAQA"]
[Mon Mar 30 18:20:46.146521 2026] [:error] [pid 11947:tid 11972] [client 51.120.81.94:65231] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "acpOfjSVtzzXIgk-FgkpvAAAAhc"]
[Mon Mar 30 18:20:46.670738 2026] [:error] [pid 35248:tid 35277] [client 51.120.81.94:64560] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "acpOfr3igMCgAQPFS_94kwAAAFc"]
[Mon Mar 30 18:20:47.200973 2026] [:error] [pid 35248:tid 35263] [client 51.120.81.94:65261] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "acpOf73igMCgAQPFS_94lQAAAEk"]
[Mon Mar 30 18:20:47.730975 2026] [:error] [pid 41941:tid 41952] [client 51.120.81.94:65244] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "acpOfyB2g7BNCXGBOJNfYAAAAQk"]
[Mon Mar 30 18:20:48.253754 2026] [:error] [pid 11947:tid 11952] [client 51.120.81.94:64521] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "acpOgDSVtzzXIgk-FgkpwgAAAgM"]
[Mon Mar 30 18:20:48.803303 2026] [:error] [pid 50663:tid 50683] [client 51.120.81.94:65304] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "acpOgG28b9DKIAMEdfANQAAAAZI"]
[Mon Mar 30 18:20:49.333725 2026] [:error] [pid 11947:tid 11949] [client 51.120.81.94:65332] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "acpOgTSVtzzXIgk-FgkpxQAAAgA"]
[Mon Mar 30 18:20:49.876151 2026] [:error] [pid 11947:tid 11966] [client 51.120.81.94:65275] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "acpOgTSVtzzXIgk-FgkpxgAAAhE"]
[Mon Mar 30 18:20:50.397526 2026] [:error] [pid 64743:tid 64751] [client 51.120.81.94:65216] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "acpOgizmpVL6Ubzil4iYkAAAAUY"]
[Mon Mar 30 18:20:50.931468 2026] [:error] [pid 41941:tid 41950] [client 51.120.81.94:64473] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "acpOgiB2g7BNCXGBOJNfZgAAAQc"]
[Mon Mar 30 18:20:51.452195 2026] [:error] [pid 41941:tid 41943] [client 51.120.81.94:65286] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "acpOgyB2g7BNCXGBOJNfaQAAAQA"]
[Mon Mar 30 18:20:51.987580 2026] [:error] [pid 35249:tid 35299] [client 51.120.81.94:65239] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "acpOgyqCKiTq85d6rgBNIgAAAI8"]
[Mon Mar 30 18:21:02.522151 2026] [:error] [pid 11947:tid 11952] [client 51.120.81.94:64478] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abrand.php"] [unique_id "acpOjjSVtzzXIgk-Fgkp6QAAAgM"]
[Mon Mar 30 18:21:03.046307 2026] [:error] [pid 35250:tid 35330] [client 51.120.81.94:64004] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abrand.php"] [unique_id "acpOj4aKM1MR6zcp2YNP_QAAANM"]
[Mon Mar 30 18:21:03.580201 2026] [:error] [pid 41941:tid 41964] [client 51.120.81.94:63004] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abrand.php"] [unique_id "acpOjyB2g7BNCXGBOJNfeQAAARU"]
[Mon Mar 30 18:21:04.106575 2026] [:error] [pid 41941:tid 41953] [client 51.120.81.94:63328] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abrand.php"] [unique_id "acpOkCB2g7BNCXGBOJNfewAAAQo"]
[Mon Mar 30 18:21:04.648015 2026] [:error] [pid 11947:tid 11972] [client 51.120.81.94:64014] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amp.php"] [unique_id "acpOkDSVtzzXIgk-Fgkp7QAAAhc"]
[Mon Mar 30 18:21:05.196484 2026] [:error] [pid 11947:tid 11951] [client 51.120.81.94:64482] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amp.php"] [unique_id "acpOkTSVtzzXIgk-Fgkp7gAAAgI"]
[Mon Mar 30 18:21:05.729714 2026] [:error] [pid 12106:tid 12125] [client 51.120.81.94:65242] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amp.php"] [unique_id "acpOkbIKxOs8TAdw7hcKZAAAApE"]
[Mon Mar 30 18:21:06.254458 2026] [:error] [pid 12106:tid 12131] [client 51.120.81.94:64463] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amp.php"] [unique_id "acpOkrIKxOs8TAdw7hcKZgAAApc"]
[Mon Mar 30 18:21:06.807698 2026] [:error] [pid 64743:tid 64752] [client 51.120.81.94:64541] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws75.php"] [unique_id "acpOkizmpVL6Ubzil4iYlgAAAUc"]
[Mon Mar 30 18:21:07.328475 2026] [:error] [pid 35248:tid 35261] [client 51.120.81.94:64462] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws75.php"] [unique_id "acpOk73igMCgAQPFS_94pwAAAEc"]
[Mon Mar 30 18:21:07.850080 2026] [:error] [pid 41941:tid 41964] [client 51.120.81.94:64017] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws75.php"] [unique_id "acpOkyB2g7BNCXGBOJNfggAAARU"]
[Mon Mar 30 18:21:08.378801 2026] [:error] [pid 35250:tid 35313] [client 51.120.81.94:63342] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws75.php"] [unique_id "acpOlIaKM1MR6zcp2YNQBwAAAMI"]
[Mon Mar 30 18:21:08.906638 2026] [:error] [pid 35250:tid 35318] [client 51.120.81.94:64450] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "acpOlIaKM1MR6zcp2YNQCwAAAMc"]
[Mon Mar 30 18:21:09.446471 2026] [:error] [pid 35248:tid 35270] [client 51.120.81.94:64027] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "acpOlb3igMCgAQPFS_94rQAAAFA"]
[Mon Mar 30 18:21:09.982830 2026] [:error] [pid 41941:tid 41965] [client 51.120.81.94:65267] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "acpOlSB2g7BNCXGBOJNfhgAAARY"]
[Mon Mar 30 18:21:10.512638 2026] [:error] [pid 41941:tid 41943] [client 51.120.81.94:65278] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "acpOliB2g7BNCXGBOJNfiAAAAQA"]
[Mon Mar 30 18:21:11.041068 2026] [:error] [pid 35250:tid 35321] [client 51.120.81.94:64513] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maul.php"] [unique_id "acpOl4aKM1MR6zcp2YNQEQAAAMo"]
[Mon Mar 30 18:21:11.565446 2026] [:error] [pid 35250:tid 35335] [client 51.120.81.94:63945] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maul.php"] [unique_id "acpOl4aKM1MR6zcp2YNQEgAAANg"]
[Mon Mar 30 18:21:12.098103 2026] [:error] [pid 12106:tid 12111] [client 51.120.81.94:64033] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maul.php"] [unique_id "acpOmLIKxOs8TAdw7hcKbAAAAoM"]
[Mon Mar 30 18:21:12.632015 2026] [:error] [pid 12106:tid 12126] [client 51.120.81.94:64479] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maul.php"] [unique_id "acpOmLIKxOs8TAdw7hcKbQAAApI"]
[Mon Mar 30 18:21:13.171667 2026] [:error] [pid 12106:tid 12117] [client 51.120.81.94:62923] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lowpr.php"] [unique_id "acpOmbIKxOs8TAdw7hcKbwAAAok"]
[Mon Mar 30 18:21:13.696138 2026] [:error] [pid 12106:tid 12112] [client 51.120.81.94:64022] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lowpr.php"] [unique_id "acpOmbIKxOs8TAdw7hcKcwAAAoQ"]
[Mon Mar 30 18:21:14.248270 2026] [:error] [pid 64743:tid 64769] [client 51.120.81.94:63335] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lowpr.php"] [unique_id "acpOmizmpVL6Ubzil4iYmwAAAVg"]
[Mon Mar 30 18:21:14.779270 2026] [:error] [pid 12046:tid 12063] [client 51.120.81.94:63957] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lowpr.php"] [unique_id "acpOmpDbtlkoJ6ELn7gRbgAAAk4"]
[Mon Mar 30 18:21:15.306164 2026] [:error] [pid 35249:tid 35299] [client 51.120.81.94:64550] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "acpOmyqCKiTq85d6rgBNKQAAAI8"]
[Mon Mar 30 18:21:15.844616 2026] [:error] [pid 41941:tid 41962] [client 51.120.81.94:63301] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "acpOmyB2g7BNCXGBOJNfkwAAARM"]
[Mon Mar 30 18:21:16.399407 2026] [:error] [pid 11947:tid 11955] [client 51.120.81.94:64029] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "acpOnDSVtzzXIgk-Fgkp-AAAAgY"]
[Mon Mar 30 18:21:16.930565 2026] [:error] [pid 35250:tid 35330] [client 51.120.81.94:63401] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "acpOnIaKM1MR6zcp2YNQGAAAANM"]
[Mon Mar 30 18:21:17.471399 2026] [:error] [pid 41941:tid 41961] [client 51.120.81.94:65279] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/166.php"] [unique_id "acpOnSB2g7BNCXGBOJNfmAAAARI"]
[Mon Mar 30 18:21:18.009926 2026] [:error] [pid 35250:tid 35314] [client 51.120.81.94:64575] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/166.php"] [unique_id "acpOnoaKM1MR6zcp2YNQGwAAAMM"]
[Mon Mar 30 18:21:18.532863 2026] [:error] [pid 35250:tid 35316] [client 51.120.81.94:64529] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/166.php"] [unique_id "acpOnoaKM1MR6zcp2YNQHQAAAMU"]
[Mon Mar 30 18:21:19.058166 2026] [:error] [pid 50663:tid 50687] [client 51.120.81.94:63018] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/166.php"] [unique_id "acpOn228b9DKIAMEdfANXAAAAZY"]
[Mon Mar 30 18:21:19.595309 2026] [:error] [pid 12046:tid 12069] [client 51.120.81.94:64466] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "acpOn5DbtlkoJ6ELn7gRcgAAAlQ"]
[Mon Mar 30 18:21:20.115678 2026] [:error] [pid 12106:tid 12127] [client 51.120.81.94:64494] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "acpOoLIKxOs8TAdw7hcKeQAAApM"]
[Mon Mar 30 18:21:20.652445 2026] [:error] [pid 41941:tid 41949] [client 51.120.81.94:64041] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "acpOoCB2g7BNCXGBOJNfmwAAAQY"]
[Mon Mar 30 18:21:21.179119 2026] [:error] [pid 35250:tid 35334] [client 51.120.81.94:63958] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "acpOoYaKM1MR6zcp2YNQHwAAANc"]
[Mon Mar 30 18:21:21.714216 2026] [:error] [pid 35343:tid 35367] [client 51.120.81.94:64035] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "acpOoaP5HurqmbvwN-IZzQAAABY"]
[Mon Mar 30 18:21:22.237550 2026] [:error] [pid 41941:tid 41960] [client 51.120.81.94:63311] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "acpOoiB2g7BNCXGBOJNfoAAAARE"]
[Mon Mar 30 18:21:22.763620 2026] [:error] [pid 12106:tid 12119] [client 51.120.81.94:64030] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "acpOorIKxOs8TAdw7hcKfwAAAos"]
[Mon Mar 30 18:21:23.302899 2026] [:error] [pid 11947:tid 11950] [client 51.120.81.94:63999] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "acpOozSVtzzXIgk-Fgkp-gAAAgE"]
[Mon Mar 30 18:21:23.827533 2026] [:error] [pid 50663:tid 50680] [client 51.120.81.94:65273] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "acpOo228b9DKIAMEdfANZQAAAY8"]
[Mon Mar 30 18:21:24.350577 2026] [:error] [pid 50663:tid 50687] [client 51.120.81.94:63399] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "acpOpG28b9DKIAMEdfANaQAAAZY"]
[Mon Mar 30 18:21:24.889772 2026] [:error] [pid 12046:tid 12073] [client 51.120.81.94:64021] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "acpOpJDbtlkoJ6ELn7gRegAAAlg"]
[Mon Mar 30 18:21:25.415639 2026] [:error] [pid 50663:tid 50673] [client 51.120.81.94:65254] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "acpOpW28b9DKIAMEdfANcAAAAYg"]
[Mon Mar 30 18:21:26.008741 2026] [:error] [pid 12106:tid 12123] [client 51.120.81.94:64557] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hehe.php"] [unique_id "acpOprIKxOs8TAdw7hcKhAAAAo8"]
[Mon Mar 30 18:21:26.530402 2026] [:error] [pid 35343:tid 35354] [client 51.120.81.94:64040] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hehe.php"] [unique_id "acpOpqP5HurqmbvwN-IZ0AAAAAk"]
[Mon Mar 30 18:21:27.085786 2026] [:error] [pid 50663:tid 50669] [client 51.120.81.94:63960] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hehe.php"] [unique_id "acpOp228b9DKIAMEdfANcwAAAYQ"]
[Mon Mar 30 18:21:27.609112 2026] [:error] [pid 35343:tid 35349] [client 51.120.81.94:64567] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hehe.php"] [unique_id "acpOp6P5HurqmbvwN-IZ0wAAAAQ"]
[Mon Mar 30 18:21:28.133277 2026] [:error] [pid 50663:tid 50682] [client 51.120.81.94:65268] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "acpOqG28b9DKIAMEdfANdQAAAZE"]
[Mon Mar 30 18:21:28.654333 2026] [:error] [pid 50663:tid 50675] [client 51.120.81.94:64048] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "acpOqG28b9DKIAMEdfANdwAAAYo"]
[Mon Mar 30 18:21:29.179449 2026] [:error] [pid 50663:tid 50680] [client 51.120.81.94:64490] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "acpOqW28b9DKIAMEdfANeQAAAY8"]
[Mon Mar 30 18:21:29.707735 2026] [:error] [pid 35249:tid 35304] [client 51.120.81.94:64488] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "acpOqSqCKiTq85d6rgBNLQAAAJQ"]
[Mon Mar 30 18:21:30.239489 2026] [:error] [pid 35343:tid 35367] [client 51.120.81.94:64039] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ne2026.php"] [unique_id "acpOqqP5HurqmbvwN-IZ2QAAABY"]
[Mon Mar 30 18:21:30.760386 2026] [:error] [pid 50663:tid 50676] [client 51.120.81.94:63300] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ne2026.php"] [unique_id "acpOqm28b9DKIAMEdfANggAAAYs"]
[Mon Mar 30 18:21:31.304287 2026] [:error] [pid 50663:tid 50677] [client 51.120.81.94:64054] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ne2026.php"] [unique_id "acpOq228b9DKIAMEdfANhAAAAYw"]
[Mon Mar 30 18:21:31.824864 2026] [:error] [pid 35250:tid 35335] [client 51.120.81.94:65313] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ne2026.php"] [unique_id "acpOq4aKM1MR6zcp2YNQKQAAANg"]
[Mon Mar 30 18:21:32.351704 2026] [:error] [pid 11947:tid 11968] [client 51.120.81.94:65230] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "acpOrDSVtzzXIgk-FgkqAgAAAhM"]
[Mon Mar 30 18:21:32.873675 2026] [:error] [pid 35343:tid 35349] [client 51.120.81.94:63374] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "acpOrKP5HurqmbvwN-IZ3gAAAAQ"]
[Mon Mar 30 18:21:33.407755 2026] [:error] [pid 11947:tid 11957] [client 51.120.81.94:64531] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "acpOrTSVtzzXIgk-FgkqBAAAAgg"]
[Mon Mar 30 18:21:33.943211 2026] [:error] [pid 64743:tid 64754] [client 51.120.81.94:65274] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "acpOrSzmpVL6Ubzil4iYoQAAAUk"]
[Mon Mar 30 18:21:34.487822 2026] [:error] [pid 11947:tid 11961] [client 51.120.81.94:65262] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "acpOrjSVtzzXIgk-FgkqBwAAAgw"]
[Mon Mar 30 18:21:35.026504 2026] [:error] [pid 11947:tid 11960] [client 51.120.81.94:62971] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "acpOrzSVtzzXIgk-FgkqCQAAAgs"]
[Mon Mar 30 18:21:35.577688 2026] [:error] [pid 35250:tid 35325] [client 51.120.81.94:64059] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "acpOr4aKM1MR6zcp2YNQKgAAAM4"]
[Mon Mar 30 18:21:36.114203 2026] [:error] [pid 12046:tid 12060] [client 51.120.81.94:64449] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "acpOsJDbtlkoJ6ELn7gRgQAAAks"]
[Mon Mar 30 18:21:36.635586 2026] [:error] [pid 11947:tid 11965] [client 51.120.81.94:64008] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "acpOsDSVtzzXIgk-FgkqDwAAAhA"]
[Mon Mar 30 18:21:37.171319 2026] [:error] [pid 11947:tid 11949] [client 51.120.81.94:64057] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "acpOsTSVtzzXIgk-FgkqEQAAAgA"]
[Mon Mar 30 18:21:37.694279 2026] [:error] [pid 35250:tid 35323] [client 51.120.81.94:63964] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "acpOsYaKM1MR6zcp2YNQLAAAAMw"]
[Mon Mar 30 18:21:38.223339 2026] [:error] [pid 35343:tid 35347] [client 51.120.81.94:64476] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "acpOsqP5HurqmbvwN-IZ5AAAAAI"]
[Mon Mar 30 18:21:38.763209 2026] [:error] [pid 35248:tid 35275] [client 51.120.81.94:63360] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "acpOsr3igMCgAQPFS_94sgAAAFU"]
[Mon Mar 30 18:21:39.305344 2026] [:error] [pid 50663:tid 50685] [client 51.120.81.94:65264] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "acpOs228b9DKIAMEdfANiAAAAZQ"]
[Mon Mar 30 18:21:39.886109 2026] [:error] [pid 35249:tid 35293] [client 51.120.81.94:65305] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "acpOsyqCKiTq85d6rgBNMgAAAIk"]
[Mon Mar 30 18:21:40.411387 2026] [:error] [pid 35343:tid 35367] [client 51.120.81.94:65322] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "acpOtKP5HurqmbvwN-IZ5gAAABY"]
[Mon Mar 30 18:21:40.983460 2026] [:error] [pid 11947:tid 11972] [client 51.120.81.94:64026] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "acpOtDSVtzzXIgk-FgkqHwAAAhc"]
[Mon Mar 30 18:21:41.516995 2026] [:error] [pid 11947:tid 11949] [client 51.120.81.94:64044] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "acpOtTSVtzzXIgk-FgkqIgAAAgA"]
[Mon Mar 30 18:21:42.114388 2026] [:error] [pid 41941:tid 41967] [client 51.120.81.94:63941] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "acpOtiB2g7BNCXGBOJNfqAAAARg"]
[Mon Mar 30 18:21:42.642429 2026] [:error] [pid 35249:tid 35285] [client 51.120.81.94:63379] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "acpOtiqCKiTq85d6rgBNMwAAAIE"]
[Mon Mar 30 18:21:43.206180 2026] [:error] [pid 35343:tid 35345] [client 51.120.81.94:64526] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "acpOt6P5HurqmbvwN-IZ6gAAAAA"]
[Mon Mar 30 18:21:43.740748 2026] [:error] [pid 11947:tid 11961] [client 51.120.81.94:64574] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "acpOtzSVtzzXIgk-FgkqKAAAAgw"]
[Mon Mar 30 18:21:44.267786 2026] [:error] [pid 35250:tid 35334] [client 51.120.81.94:64571] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "acpOuIaKM1MR6zcp2YNQMAAAANc"]
[Mon Mar 30 18:21:44.814110 2026] [:error] [pid 12106:tid 12120] [client 51.120.81.94:63391] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "acpOuLIKxOs8TAdw7hcKlAAAAow"]
[Mon Mar 30 18:21:45.352021 2026] [:error] [pid 35250:tid 35322] [client 51.120.81.94:63384] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "acpOuYaKM1MR6zcp2YNQMQAAAMs"]
[Mon Mar 30 18:21:45.894920 2026] [:error] [pid 35250:tid 35324] [client 51.120.81.94:65292] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "acpOuYaKM1MR6zcp2YNQNQAAAM0"]
[Mon Mar 30 18:21:46.416019 2026] [:error] [pid 35250:tid 35332] [client 51.120.81.94:64060] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "acpOuoaKM1MR6zcp2YNQOgAAANU"]
[Mon Mar 30 18:21:46.986169 2026] [:error] [pid 11947:tid 11971] [client 51.120.81.94:65329] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "acpOujSVtzzXIgk-FgkqKwAAAhY"]
[Mon Mar 30 18:21:47.517034 2026] [:error] [pid 35250:tid 35316] [client 51.120.81.94:63341] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5e0a.php"] [unique_id "acpOu4aKM1MR6zcp2YNQPAAAAMU"]
[Mon Mar 30 18:21:48.071773 2026] [:error] [pid 35250:tid 35327] [client 51.120.81.94:64475] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5e0a.php"] [unique_id "acpOvIaKM1MR6zcp2YNQPwAAANA"]
[Mon Mar 30 18:21:48.628194 2026] [:error] [pid 12106:tid 12119] [client 51.120.81.94:65248] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5e0a.php"] [unique_id "acpOvLIKxOs8TAdw7hcKlQAAAos"]
[Mon Mar 30 18:21:49.162300 2026] [:error] [pid 41941:tid 41959] [client 51.120.81.94:65251] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5e0a.php"] [unique_id "acpOvSB2g7BNCXGBOJNfswAAARA"]
[Mon Mar 30 18:21:49.682888 2026] [:error] [pid 12046:tid 12068] [client 51.120.81.94:64038] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/term.php"] [unique_id "acpOvZDbtlkoJ6ELn7gRhAAAAlM"]
[Mon Mar 30 18:21:50.210484 2026] [:error] [pid 35249:tid 35308] [client 51.120.81.94:65301] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/term.php"] [unique_id "acpOviqCKiTq85d6rgBNNgAAAJg"]
[Mon Mar 30 18:21:50.733068 2026] [:error] [pid 41941:tid 41950] [client 51.120.81.94:64491] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/term.php"] [unique_id "acpOviB2g7BNCXGBOJNftwAAAQc"]
[Mon Mar 30 18:21:51.268537 2026] [:error] [pid 41941:tid 41952] [client 51.120.81.94:63414] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/term.php"] [unique_id "acpOvyB2g7BNCXGBOJNfuAAAAQk"]
[Mon Mar 30 18:21:51.792214 2026] [:error] [pid 12046:tid 12071] [client 51.120.81.94:63322] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "acpOv5DbtlkoJ6ELn7gRhwAAAlY"]
[Mon Mar 30 18:21:52.323917 2026] [:error] [pid 50663:tid 50671] [client 51.120.81.94:63361] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "acpOwG28b9DKIAMEdfANlAAAAYY"]
[Mon Mar 30 18:21:52.849783 2026] [:error] [pid 35248:tid 35266] [client 51.120.81.94:63406] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "acpOwL3igMCgAQPFS_94vQAAAEw"]
[Mon Mar 30 18:21:53.380313 2026] [:error] [pid 50663:tid 50683] [client 51.120.81.94:63422] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "acpOwW28b9DKIAMEdfANmQAAAZI"]
[Mon Mar 30 18:21:53.911401 2026] [:error] [pid 41941:tid 41956] [client 51.120.81.94:62999] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd.php"] [unique_id "acpOwSB2g7BNCXGBOJNfuwAAAQ0"]
[Mon Mar 30 18:21:54.474700 2026] [:error] [pid 35250:tid 35332] [client 51.120.81.94:64506] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd.php"] [unique_id "acpOwoaKM1MR6zcp2YNQRQAAANU"]
[Mon Mar 30 18:21:55.013364 2026] [:error] [pid 11947:tid 11949] [client 51.120.81.94:63984] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd.php"] [unique_id "acpOwzSVtzzXIgk-FgkqMAAAAgA"]
[Mon Mar 30 18:21:55.546244 2026] [:error] [pid 11947:tid 11955] [client 51.120.81.94:64051] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd.php"] [unique_id "acpOwzSVtzzXIgk-FgkqMgAAAgY"]
[Mon Mar 30 18:21:56.089800 2026] [:error] [pid 50663:tid 50669] [client 51.120.81.94:63396] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "acpOxG28b9DKIAMEdfANngAAAYQ"]
[Mon Mar 30 18:21:56.655219 2026] [:error] [pid 12046:tid 12073] [client 51.120.81.94:63010] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "acpOxJDbtlkoJ6ELn7gRjQAAAlg"]
[Mon Mar 30 18:21:57.174034 2026] [:error] [pid 50663:tid 50685] [client 51.120.81.94:63326] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "acpOxW28b9DKIAMEdfANnwAAAZQ"]
[Mon Mar 30 18:21:57.703619 2026] [:error] [pid 41941:tid 41965] [client 51.120.81.94:62998] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "acpOxSB2g7BNCXGBOJNfyAAAARY"]
[Mon Mar 30 18:21:58.254918 2026] [:error] [pid 11947:tid 11957] [client 51.120.81.94:63337] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "acpOxjSVtzzXIgk-FgkqOAAAAgg"]
[Mon Mar 30 18:21:58.787213 2026] [:error] [pid 35248:tid 35268] [client 51.120.81.94:64490] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "acpOxr3igMCgAQPFS_94yAAAAE4"]
[Mon Mar 30 18:21:59.310104 2026] [:error] [pid 35248:tid 35262] [client 51.120.81.94:64457] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "acpOx73igMCgAQPFS_94ywAAAEg"]
[Mon Mar 30 18:21:59.834274 2026] [:error] [pid 35248:tid 35273] [client 51.120.81.94:64448] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "acpOx73igMCgAQPFS_940AAAAFM"]
[Mon Mar 30 18:22:00.358642 2026] [:error] [pid 35248:tid 35255] [client 51.120.81.94:62501] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "acpOyL3igMCgAQPFS_940gAAAEE"]
[Mon Mar 30 18:22:00.920923 2026] [:error] [pid 35248:tid 35264] [client 51.120.81.94:65281] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "acpOyL3igMCgAQPFS_941QAAAEo"]
[Mon Mar 30 18:22:12.736710 2026] [:error] [pid 35248:tid 35267] [client 51.120.81.94:62990] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "acpO1L3igMCgAQPFS_94-wAAAE0"]
[Mon Mar 30 18:22:13.256637 2026] [:error] [pid 41941:tid 41955] [client 51.120.81.94:65309] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "acpO1SB2g7BNCXGBOJNf0QAAAQw"]
[Mon Mar 30 18:22:13.790315 2026] [:error] [pid 35250:tid 35324] [client 51.120.81.94:63355] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "acpO1YaKM1MR6zcp2YNQbAAAAM0"]
[Mon Mar 30 18:22:14.338810 2026] [:error] [pid 11947:tid 11959] [client 51.120.81.94:63954] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "acpO1jSVtzzXIgk-FgkqYwAAAgo"]
[Mon Mar 30 18:22:14.875588 2026] [:error] [pid 11947:tid 11960] [client 51.120.81.94:65323] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccs.php"] [unique_id "acpO1jSVtzzXIgk-FgkqZAAAAgs"]
[Mon Mar 30 18:22:15.408867 2026] [:error] [pid 35250:tid 35313] [client 51.120.81.94:64489] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccs.php"] [unique_id "acpO14aKM1MR6zcp2YNQbQAAAMI"]
[Mon Mar 30 18:22:15.958917 2026] [:error] [pid 35250:tid 35314] [client 51.120.81.94:63395] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccs.php"] [unique_id "acpO14aKM1MR6zcp2YNQbwAAAMM"]
[Mon Mar 30 18:22:16.503846 2026] [:error] [pid 12106:tid 12129] [client 51.120.81.94:63943] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccs.php"] [unique_id "acpO2LIKxOs8TAdw7hcKmwAAApU"]
[Mon Mar 30 18:22:17.056931 2026] [:error] [pid 12106:tid 12127] [client 51.120.81.94:65288] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clss.php"] [unique_id "acpO2bIKxOs8TAdw7hcKngAAApM"]
[Mon Mar 30 18:22:17.587782 2026] [:error] [pid 35250:tid 35327] [client 51.120.81.94:65247] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clss.php"] [unique_id "acpO2YaKM1MR6zcp2YNQdAAAANA"]
[Mon Mar 30 18:22:18.120183 2026] [:error] [pid 11947:tid 11969] [client 51.120.81.94:63978] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clss.php"] [unique_id "acpO2jSVtzzXIgk-FgkqbgAAAhQ"]
[Mon Mar 30 18:22:18.641105 2026] [:error] [pid 11947:tid 11962] [client 51.120.81.94:63318] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clss.php"] [unique_id "acpO2jSVtzzXIgk-FgkqbwAAAg0"]
[Mon Mar 30 18:22:19.180046 2026] [:error] [pid 11947:tid 11951] [client 51.120.81.94:62481] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "acpO2zSVtzzXIgk-FgkqcAAAAgI"]
[Mon Mar 30 18:22:19.762480 2026] [:error] [pid 35248:tid 35267] [client 51.120.81.94:64511] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "acpO273igMCgAQPFS_95HAAAAE0"]
[Mon Mar 30 18:22:20.288376 2026] [:error] [pid 35343:tid 35350] [client 51.120.81.94:64469] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "acpO3KP5HurqmbvwN-IZ_AAAAAU"]
[Mon Mar 30 18:22:20.819014 2026] [:error] [pid 35343:tid 35352] [client 51.120.81.94:62991] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "acpO3KP5HurqmbvwN-IaAgAAAAc"]
[Mon Mar 30 18:22:21.349004 2026] [:error] [pid 35343:tid 35355] [client 51.120.81.94:64052] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "acpO3aP5HurqmbvwN-IaBAAAAAo"]
[Mon Mar 30 18:22:21.878000 2026] [:error] [pid 11947:tid 11969] [client 51.120.81.94:65311] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "acpO3TSVtzzXIgk-FgkqdQAAAhQ"]
[Mon Mar 30 18:22:22.407058 2026] [:error] [pid 35249:tid 35285] [client 51.120.81.94:65253] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "acpO3iqCKiTq85d6rgBNPwAAAIE"]
[Mon Mar 30 18:22:22.929858 2026] [:error] [pid 35248:tid 35274] [client 51.120.81.94:64553] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "acpO3r3igMCgAQPFS_95JQAAAFQ"]
[Mon Mar 30 18:22:23.470300 2026] [:error] [pid 41941:tid 41950] [client 51.120.81.94:64485] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/init.php"] [unique_id "acpO3yB2g7BNCXGBOJNf0wAAAQc"]
[Mon Mar 30 18:22:23.996106 2026] [:error] [pid 35248:tid 35277] [client 51.120.81.94:64549] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/init.php"] [unique_id "acpO373igMCgAQPFS_95KAAAAFc"]
[Mon Mar 30 18:22:24.522859 2026] [:error] [pid 64743:tid 64766] [client 51.120.81.94:65287] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/init.php"] [unique_id "acpO4CzmpVL6Ubzil4iYqgAAAVU"]
[Mon Mar 30 18:22:25.045200 2026] [:error] [pid 35248:tid 35262] [client 51.120.81.94:65223] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/init.php"] [unique_id "acpO4b3igMCgAQPFS_95KgAAAEg"]
[Mon Mar 30 18:22:25.566865 2026] [:error] [pid 35343:tid 35361] [client 51.120.81.94:64058] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "acpO4aP5HurqmbvwN-IaCAAAABA"]
[Mon Mar 30 18:22:26.096061 2026] [:error] [pid 12046:tid 12058] [client 51.120.81.94:63411] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "acpO4pDbtlkoJ6ELn7gRlgAAAkk"]
[Mon Mar 30 18:22:26.618544 2026] [:error] [pid 12106:tid 12120] [client 51.120.81.94:63400] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "acpO4rIKxOs8TAdw7hcKogAAAow"]
[Mon Mar 30 18:22:27.142016 2026] [:error] [pid 11947:tid 11972] [client 51.120.81.94:63377] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "acpO4zSVtzzXIgk-FgkqfgAAAhc"]
[Mon Mar 30 18:22:27.678470 2026] [:error] [pid 41941:tid 41960] [client 51.120.81.94:65317] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ajax.php"] [unique_id "acpO4yB2g7BNCXGBOJNf1QAAARE"]
[Mon Mar 30 18:22:28.201721 2026] [:error] [pid 35343:tid 35351] [client 51.120.81.94:65245] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ajax.php"] [unique_id "acpO5KP5HurqmbvwN-IaCwAAAAY"]
[Mon Mar 30 18:22:28.726844 2026] [:error] [pid 11947:tid 11967] [client 51.120.81.94:63405] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ajax.php"] [unique_id "acpO5DSVtzzXIgk-FgkqgAAAAhI"]
[Mon Mar 30 18:22:29.258311 2026] [:error] [pid 35343:tid 35365] [client 51.120.81.94:64528] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ajax.php"] [unique_id "acpO5aP5HurqmbvwN-IaDAAAABQ"]
[Mon Mar 30 18:22:29.776239 2026] [:error] [pid 35343:tid 35361] [client 51.120.81.94:64495] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "acpO5aP5HurqmbvwN-IaDgAAABA"]
[Mon Mar 30 18:22:30.298632 2026] [:error] [pid 35343:tid 35367] [client 51.120.81.94:65290] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "acpO5qP5HurqmbvwN-IaFAAAABY"]
[Mon Mar 30 18:22:30.835321 2026] [:error] [pid 35343:tid 35369] [client 51.120.81.94:64522] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "acpO5qP5HurqmbvwN-IaFQAAABg"]
[Mon Mar 30 18:22:31.361851 2026] [:error] [pid 64743:tid 64769] [client 51.120.81.94:62913] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "acpO5yzmpVL6Ubzil4iYrgAAAVg"]
[Mon Mar 30 18:22:31.891380 2026] [:error] [pid 41941:tid 41946] [client 51.120.81.94:64540] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "acpO5yB2g7BNCXGBOJNf2QAAAQM"]
[Mon Mar 30 18:22:32.410635 2026] [:error] [pid 35343:tid 35366] [client 51.120.81.94:64042] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "acpO6KP5HurqmbvwN-IaFwAAABU"]
[Mon Mar 30 18:22:32.933618 2026] [:error] [pid 35343:tid 35349] [client 51.120.81.94:64010] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "acpO6KP5HurqmbvwN-IaGAAAAAQ"]
[Mon Mar 30 18:22:33.461803 2026] [:error] [pid 35248:tid 35277] [client 51.120.81.94:63961] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "acpO6b3igMCgAQPFS_95PgAAAFc"]
[Mon Mar 30 18:22:33.988619 2026] [:error] [pid 35343:tid 35355] [client 51.120.81.94:63939] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "acpO6aP5HurqmbvwN-IaGwAAAAo"]
[Mon Mar 30 18:22:34.512165 2026] [:error] [pid 35343:tid 35356] [client 51.120.81.94:62455] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "acpO6qP5HurqmbvwN-IaHAAAAAs"]
[Mon Mar 30 18:22:35.068561 2026] [:error] [pid 35248:tid 35271] [client 51.120.81.94:63351] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "acpO673igMCgAQPFS_95QAAAAFE"]
[Mon Mar 30 18:22:35.600586 2026] [:error] [pid 64743:tid 64753] [client 51.120.81.94:64554] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "acpO6yzmpVL6Ubzil4iYrwAAAUg"]
[Mon Mar 30 18:22:36.137589 2026] [:error] [pid 35248:tid 35259] [client 51.120.81.94:65336] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "acpO7L3igMCgAQPFS_95QgAAAEU"]
[Mon Mar 30 18:22:36.661542 2026] [:error] [pid 35248:tid 35263] [client 51.120.81.94:64016] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "acpO7L3igMCgAQPFS_95RgAAAEk"]
[Mon Mar 30 18:22:37.190123 2026] [:error] [pid 11947:tid 11973] [client 51.120.81.94:64468] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "acpO7TSVtzzXIgk-FgkqhAAAAhg"]
[Mon Mar 30 18:22:37.743523 2026] [:error] [pid 11947:tid 11964] [client 51.120.81.94:64570] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "acpO7TSVtzzXIgk-FgkqhwAAAg8"]
[Mon Mar 30 18:22:38.272287 2026] [:error] [pid 50663:tid 50682] [client 51.120.81.94:63423] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws60.php"] [unique_id "acpO7m28b9DKIAMEdfANsQAAAZE"]
[Mon Mar 30 18:22:38.799272 2026] [:error] [pid 11947:tid 11956] [client 51.120.81.94:61736] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws60.php"] [unique_id "acpO7jSVtzzXIgk-FgkqiQAAAgc"]
[Mon Mar 30 18:22:39.322169 2026] [:error] [pid 64743:tid 64751] [client 51.120.81.94:62967] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws60.php"] [unique_id "acpO7yzmpVL6Ubzil4iYsAAAAUY"]
[Mon Mar 30 18:22:39.842382 2026] [:error] [pid 11947:tid 11966] [client 51.120.81.94:63965] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws60.php"] [unique_id "acpO7zSVtzzXIgk-FgkqiwAAAhE"]
[Mon Mar 30 18:22:40.396664 2026] [:error] [pid 11947:tid 11962] [client 51.120.81.94:65316] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "acpO8DSVtzzXIgk-FgkqjAAAAg0"]
[Mon Mar 30 18:22:40.919879 2026] [:error] [pid 11947:tid 11971] [client 51.120.81.94:63413] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "acpO8DSVtzzXIgk-FgkqjgAAAhY"]
[Mon Mar 30 18:22:41.441706 2026] [:error] [pid 12046:tid 12053] [client 51.120.81.94:64534] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "acpO8ZDbtlkoJ6ELn7gRnQAAAkQ"]
[Mon Mar 30 18:22:41.971847 2026] [:error] [pid 41941:tid 41945] [client 51.120.81.94:65300] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "acpO8SB2g7BNCXGBOJNf4AAAAQI"]
[Mon Mar 30 18:22:42.502810 2026] [:error] [pid 50663:tid 50673] [client 51.120.81.94:64487] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "acpO8m28b9DKIAMEdfANuAAAAYg"]
[Mon Mar 30 18:22:43.056658 2026] [:error] [pid 12106:tid 12115] [client 51.120.81.94:63970] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "acpO87IKxOs8TAdw7hcKpwAAAoc"]
[Mon Mar 30 18:22:43.600981 2026] [:error] [pid 35248:tid 35264] [client 51.120.81.94:62972] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "acpO873igMCgAQPFS_95TQAAAEo"]
[Mon Mar 30 18:22:44.123825 2026] [:error] [pid 35250:tid 35320] [client 51.120.81.94:63973] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "acpO9IaKM1MR6zcp2YNQfQAAAMk"]
[Mon Mar 30 18:22:44.646863 2026] [:error] [pid 35250:tid 35329] [client 51.120.81.94:63955] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myfile.php"] [unique_id "acpO9IaKM1MR6zcp2YNQfgAAANI"]
[Mon Mar 30 18:22:45.226643 2026] [:error] [pid 35248:tid 35268] [client 51.120.81.94:63305] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myfile.php"] [unique_id "acpO9b3igMCgAQPFS_95TgAAAE4"]
[Mon Mar 30 18:22:45.777434 2026] [:error] [pid 12106:tid 12128] [client 51.120.81.94:65295] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myfile.php"] [unique_id "acpO9bIKxOs8TAdw7hcKqgAAApQ"]
[Mon Mar 30 18:22:46.519092 2026] [:error] [pid 35250:tid 35311] [client 51.120.81.94:64452] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myfile.php"] [unique_id "acpO9oaKM1MR6zcp2YNQgwAAAMA"]
[Mon Mar 30 18:22:47.056640 2026] [:error] [pid 35250:tid 35317] [client 51.120.81.94:65330] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "acpO94aKM1MR6zcp2YNQhAAAAMY"]
[Mon Mar 30 18:22:47.625012 2026] [:error] [pid 35343:tid 35350] [client 51.120.81.94:64053] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "acpO96P5HurqmbvwN-IaJwAAAAU"]
[Mon Mar 30 18:22:48.162305 2026] [:error] [pid 35250:tid 35312] [client 51.120.81.94:62957] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "acpO-IaKM1MR6zcp2YNQigAAAME"]
[Mon Mar 30 18:22:48.688013 2026] [:error] [pid 35250:tid 35326] [client 51.120.81.94:64020] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "acpO-IaKM1MR6zcp2YNQiwAAAM8"]
[Mon Mar 30 18:22:49.212707 2026] [:error] [pid 12046:tid 12055] [client 51.120.81.94:65297] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/okxh.php"] [unique_id "acpO-ZDbtlkoJ6ELn7gRoQAAAkY"]
[Mon Mar 30 18:22:49.765476 2026] [:error] [pid 12106:tid 12108] [client 51.120.81.94:64507] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/okxh.php"] [unique_id "acpO-bIKxOs8TAdw7hcKrgAAAoA"]
[Mon Mar 30 18:22:50.332062 2026] [:error] [pid 35248:tid 35268] [client 51.120.81.94:63345] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/okxh.php"] [unique_id "acpO-r3igMCgAQPFS_95WQAAAE4"]
[Mon Mar 30 18:22:50.861756 2026] [:error] [pid 35248:tid 35276] [client 51.120.81.94:63419] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/okxh.php"] [unique_id "acpO-r3igMCgAQPFS_95XAAAAFY"]
[Mon Mar 30 18:22:51.470608 2026] [:error] [pid 35250:tid 35325] [client 51.120.81.94:63381] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "acpO-4aKM1MR6zcp2YNQjgAAAM4"]
[Mon Mar 30 18:22:51.994633 2026] [:error] [pid 35248:tid 35263] [client 51.120.81.94:63012] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "acpO-73igMCgAQPFS_95ZAAAAEk"]
[Mon Mar 30 18:22:52.545624 2026] [:error] [pid 35250:tid 35323] [client 51.120.81.94:63383] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "acpO_IaKM1MR6zcp2YNQkgAAAMw"]
[Mon Mar 30 18:22:53.102019 2026] [:error] [pid 12046:tid 12068] [client 51.120.81.94:64510] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "acpO_ZDbtlkoJ6ELn7gRpQAAAlM"]
[Mon Mar 30 18:22:53.639714 2026] [:error] [pid 11947:tid 11949] [client 51.120.81.94:63343] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-104.php"] [unique_id "acpO_TSVtzzXIgk-FgkqnwAAAgA"]
[Mon Mar 30 18:22:54.187407 2026] [:error] [pid 35248:tid 35266] [client 51.120.81.94:63946] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-104.php"] [unique_id "acpO_r3igMCgAQPFS_95ZgAAAEw"]
[Mon Mar 30 18:22:54.726845 2026] [:error] [pid 35343:tid 35349] [client 51.120.81.94:64520] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-104.php"] [unique_id "acpO_qP5HurqmbvwN-IaLQAAAAQ"]
[Mon Mar 30 18:22:55.256493 2026] [:error] [pid 11947:tid 11953] [client 51.120.81.94:62936] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-104.php"] [unique_id "acpO_zSVtzzXIgk-FgkqpwAAAgQ"]
[Mon Mar 30 18:22:55.786857 2026] [:error] [pid 35248:tid 35255] [client 51.120.81.94:63350] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "acpO_73igMCgAQPFS_95agAAAEE"]
[Mon Mar 30 18:22:56.347675 2026] [:error] [pid 35248:tid 35262] [client 51.120.81.94:63321] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "acpPAL3igMCgAQPFS_95bgAAAEg"]
[Mon Mar 30 18:22:56.868458 2026] [:error] [pid 12106:tid 12132] [client 51.120.81.94:64566] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "acpPALIKxOs8TAdw7hcKtAAAApg"]
[Mon Mar 30 18:22:57.407057 2026] [:error] [pid 11947:tid 11954] [client 51.120.81.94:63331] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "acpPATSVtzzXIgk-FgkqsAAAAgU"]
[Mon Mar 30 18:22:58.007401 2026] [:error] [pid 35250:tid 35320] [client 51.120.81.94:62996] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blogs.php"] [unique_id "acpPAoaKM1MR6zcp2YNQlgAAAMk"]
[Mon Mar 30 18:22:58.545301 2026] [:error] [pid 35250:tid 35313] [client 51.120.81.94:65284] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blogs.php"] [unique_id "acpPAoaKM1MR6zcp2YNQlwAAAMI"]
[Mon Mar 30 18:22:59.092141 2026] [:error] [pid 35250:tid 35316] [client 51.120.81.94:63298] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blogs.php"] [unique_id "acpPA4aKM1MR6zcp2YNQmAAAAMU"]
[Mon Mar 30 18:22:59.621910 2026] [:error] [pid 35343:tid 35348] [client 51.120.81.94:65302] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blogs.php"] [unique_id "acpPA6P5HurqmbvwN-IaMwAAAAM"]
[Mon Mar 30 18:23:00.151199 2026] [:error] [pid 11947:tid 11954] [client 51.120.81.94:65276] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "acpPBDSVtzzXIgk-FgkquwAAAgU"]
[Mon Mar 30 18:23:00.693280 2026] [:error] [pid 35250:tid 35330] [client 51.120.81.94:62993] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "acpPBIaKM1MR6zcp2YNQnwAAANM"]
[Mon Mar 30 18:23:01.232545 2026] [:error] [pid 35250:tid 35329] [client 51.120.81.94:63359] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "acpPBYaKM1MR6zcp2YNQowAAANI"]
[Mon Mar 30 18:23:01.764679 2026] [:error] [pid 12046:tid 12057] [client 51.120.81.94:64007] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "acpPBZDbtlkoJ6ELn7gRpgAAAkg"]
[Mon Mar 30 18:23:02.283874 2026] [:error] [pid 35250:tid 35324] [client 51.120.81.94:62472] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "acpPBoaKM1MR6zcp2YNQpwAAAM0"]
[Mon Mar 30 18:23:02.820461 2026] [:error] [pid 35250:tid 35317] [client 51.120.81.94:62952] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "acpPBoaKM1MR6zcp2YNQqQAAAMY"]
[Mon Mar 30 18:23:03.345759 2026] [:error] [pid 35248:tid 35276] [client 51.120.81.94:64043] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "acpPB73igMCgAQPFS_95eAAAAFY"]
[Mon Mar 30 18:23:03.876069 2026] [:error] [pid 35250:tid 35318] [client 51.120.81.94:63327] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "acpPB4aKM1MR6zcp2YNQrQAAAMc"]
[Mon Mar 30 18:23:04.401119 2026] [:error] [pid 41941:tid 41960] [client 51.120.81.94:65255] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xfun.php"] [unique_id "acpPCCB2g7BNCXGBOJNf7AAAARE"]
[Mon Mar 30 18:23:04.969883 2026] [:error] [pid 41941:tid 41965] [client 51.120.81.94:63962] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xfun.php"] [unique_id "acpPCCB2g7BNCXGBOJNf7QAAARY"]
[Mon Mar 30 18:23:05.519804 2026] [:error] [pid 12046:tid 12053] [client 51.120.81.94:64470] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xfun.php"] [unique_id "acpPCZDbtlkoJ6ELn7gRpwAAAkQ"]
[Mon Mar 30 18:23:06.052065 2026] [:error] [pid 41941:tid 41956] [client 51.120.81.94:63347] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xfun.php"] [unique_id "acpPCiB2g7BNCXGBOJNf7wAAAQ0"]
[Mon Mar 30 18:23:06.597773 2026] [:error] [pid 12106:tid 12124] [client 51.120.81.94:63410] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "acpPCrIKxOs8TAdw7hcKtgAAApA"]
[Mon Mar 30 18:23:07.130167 2026] [:error] [pid 50663:tid 50676] [client 51.120.81.94:63323] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "acpPC228b9DKIAMEdfANxwAAAYs"]
[Mon Mar 30 18:23:07.658010 2026] [:error] [pid 35248:tid 35258] [client 51.120.81.94:62930] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "acpPC73igMCgAQPFS_95fAAAAEQ"]
[Mon Mar 30 18:23:08.294368 2026] [:error] [pid 12106:tid 12121] [client 51.120.81.94:65240] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "acpPDLIKxOs8TAdw7hcKtwAAAo0"]
[Mon Mar 30 18:23:08.892909 2026] [:error] [pid 41941:tid 41957] [client 51.120.81.94:63030] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/155.php"] [unique_id "acpPDCB2g7BNCXGBOJNf8gAAAQ4"]
[Mon Mar 30 18:23:09.420246 2026] [:error] [pid 35248:tid 35260] [client 51.120.81.94:64464] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/155.php"] [unique_id "acpPDb3igMCgAQPFS_95gAAAAEY"]
[Mon Mar 30 18:23:09.984151 2026] [:error] [pid 35248:tid 35265] [client 51.120.81.94:63304] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/155.php"] [unique_id "acpPDb3igMCgAQPFS_95gwAAAEs"]
[Mon Mar 30 18:23:10.586472 2026] [:error] [pid 35248:tid 35273] [client 51.120.81.94:62983] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/155.php"] [unique_id "acpPDr3igMCgAQPFS_95hQAAAFM"]
[Mon Mar 30 18:23:20.921037 2026] [:error] [pid 35248:tid 35261] [client 51.120.81.94:64552] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa21.php"] [unique_id "acpPGL3igMCgAQPFS_95qQAAAEc"]
[Mon Mar 30 18:23:21.471771 2026] [:error] [pid 11947:tid 11959] [client 51.120.81.94:62485] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa21.php"] [unique_id "acpPGTSVtzzXIgk-Fgkq0gAAAgo"]
[Mon Mar 30 18:23:22.012733 2026] [:error] [pid 11947:tid 11960] [client 51.120.81.94:65266] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa21.php"] [unique_id "acpPGjSVtzzXIgk-Fgkq1AAAAgs"]
[Mon Mar 30 18:23:22.565247 2026] [:error] [pid 41941:tid 41952] [client 51.120.81.94:64458] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa21.php"] [unique_id "acpPGiB2g7BNCXGBOJNf_QAAAQk"]
[Mon Mar 30 18:23:23.106144 2026] [:error] [pid 41941:tid 41947] [client 51.120.81.94:64562] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "acpPGyB2g7BNCXGBOJNf_gAAAQQ"]
[Mon Mar 30 18:23:23.632763 2026] [:error] [pid 12106:tid 12118] [client 51.120.81.94:62992] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "acpPG7IKxOs8TAdw7hcKxgAAAoo"]
[Mon Mar 30 18:23:24.168006 2026] [:error] [pid 41941:tid 41950] [client 51.120.81.94:63977] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "acpPHCB2g7BNCXGBOJNgAAAAAQc"]
[Mon Mar 30 18:23:24.695816 2026] [:error] [pid 41941:tid 41958] [client 51.120.81.94:63421] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "acpPHCB2g7BNCXGBOJNgBAAAAQ8"]
[Mon Mar 30 18:23:25.226357 2026] [:error] [pid 41941:tid 41965] [client 51.120.81.94:64542] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "acpPHSB2g7BNCXGBOJNgBgAAARY"]
[Mon Mar 30 18:23:25.745365 2026] [:error] [pid 11947:tid 11973] [client 51.120.81.94:65259] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "acpPHTSVtzzXIgk-Fgkq2gAAAhg"]
[Mon Mar 30 18:23:26.281401 2026] [:error] [pid 35248:tid 35273] [client 51.120.81.94:63021] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "acpPHr3igMCgAQPFS_95rgAAAFM"]
[Mon Mar 30 18:23:26.809031 2026] [:error] [pid 35343:tid 35345] [client 51.120.81.94:64551] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "acpPHqP5HurqmbvwN-IaOQAAAAA"]
[Mon Mar 30 18:23:27.333548 2026] [:error] [pid 35248:tid 35261] [client 51.120.81.94:63378] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bootstrap.php"] [unique_id "acpPH73igMCgAQPFS_95rwAAAEc"]
[Mon Mar 30 18:23:27.871560 2026] [:error] [pid 35248:tid 35270] [client 51.120.81.94:63408] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bootstrap.php"] [unique_id "acpPH73igMCgAQPFS_95sgAAAFA"]
[Mon Mar 30 18:23:28.405827 2026] [:error] [pid 35248:tid 35272] [client 51.120.81.94:63002] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bootstrap.php"] [unique_id "acpPIL3igMCgAQPFS_95tAAAAFI"]
[Mon Mar 30 18:23:28.926622 2026] [:error] [pid 41941:tid 41965] [client 51.120.81.94:63338] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bootstrap.php"] [unique_id "acpPICB2g7BNCXGBOJNgEAAAARY"]
[Mon Mar 30 18:23:29.469820 2026] [:error] [pid 50663:tid 50670] [client 51.120.81.94:63985] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/wp-blog.php"] [unique_id "acpPIW28b9DKIAMEdfAN1wAAAYU"]
[Mon Mar 30 18:23:29.990561 2026] [:error] [pid 35248:tid 35264] [client 51.120.81.94:65232] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/wp-blog.php"] [unique_id "acpPIb3igMCgAQPFS_95ugAAAEo"]
[Mon Mar 30 18:23:30.537019 2026] [:error] [pid 50663:tid 50675] [client 51.120.81.94:65263] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/wp-blog.php"] [unique_id "acpPIm28b9DKIAMEdfAN2AAAAYo"]
[Mon Mar 30 18:23:31.073424 2026] [:error] [pid 35250:tid 35321] [client 51.120.81.94:63936] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/wp-blog.php"] [unique_id "acpPI4aKM1MR6zcp2YNQxAAAAMo"]
[Mon Mar 30 18:23:31.600301 2026] [:error] [pid 35250:tid 35317] [client 51.120.81.94:64019] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws88.php"] [unique_id "acpPI4aKM1MR6zcp2YNQxgAAAMY"]
[Mon Mar 30 18:23:32.120744 2026] [:error] [pid 35250:tid 35323] [client 51.120.81.94:62510] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws88.php"] [unique_id "acpPJIaKM1MR6zcp2YNQywAAAMw"]
[Mon Mar 30 18:23:32.655243 2026] [:error] [pid 12106:tid 12121] [client 51.120.81.94:62912] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws88.php"] [unique_id "acpPJLIKxOs8TAdw7hcKygAAAo0"]
[Mon Mar 30 18:23:33.183390 2026] [:error] [pid 50663:tid 50673] [client 51.120.81.94:63394] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws88.php"] [unique_id "acpPJW28b9DKIAMEdfAN3AAAAYg"]
[Mon Mar 30 18:23:33.725593 2026] [:error] [pid 35250:tid 35320] [client 51.120.81.94:64454] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/csv.php"] [unique_id "acpPJYaKM1MR6zcp2YNQ0AAAAMk"]
[Mon Mar 30 18:23:34.257070 2026] [:error] [pid 35250:tid 35321] [client 51.120.81.94:62977] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/csv.php"] [unique_id "acpPJoaKM1MR6zcp2YNQ0gAAAMo"]
[Mon Mar 30 18:23:34.784738 2026] [:error] [pid 12046:tid 12069] [client 51.120.81.94:65234] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/csv.php"] [unique_id "acpPJpDbtlkoJ6ELn7gRrwAAAlQ"]
[Mon Mar 30 18:23:35.309290 2026] [:error] [pid 12046:tid 12065] [client 51.120.81.94:63015] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/csv.php"] [unique_id "acpPJ5DbtlkoJ6ELn7gRsAAAAlA"]
[Mon Mar 30 18:23:35.845194 2026] [:error] [pid 50663:tid 50670] [client 51.120.81.94:62497] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/varb.php"] [unique_id "acpPJ228b9DKIAMEdfAN4QAAAYU"]
[Mon Mar 30 18:23:36.379694 2026] [:error] [pid 35248:tid 35266] [client 51.120.81.94:63358] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/varb.php"] [unique_id "acpPKL3igMCgAQPFS_95vwAAAEw"]
[Mon Mar 30 18:23:36.913863 2026] [:error] [pid 35248:tid 35269] [client 51.120.81.94:63022] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/varb.php"] [unique_id "acpPKL3igMCgAQPFS_95wQAAAE8"]
[Mon Mar 30 18:23:37.444557 2026] [:error] [pid 35343:tid 35347] [client 51.120.81.94:62970] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/varb.php"] [unique_id "acpPKaP5HurqmbvwN-IaPgAAAAI"]
[Mon Mar 30 18:23:37.976011 2026] [:error] [pid 35248:tid 35256] [client 51.120.81.94:64514] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8573.php"] [unique_id "acpPKb3igMCgAQPFS_95wwAAAEI"]
[Mon Mar 30 18:23:38.502199 2026] [:error] [pid 35343:tid 35368] [client 51.120.81.94:63019] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8573.php"] [unique_id "acpPKqP5HurqmbvwN-IaQwAAABc"]
[Mon Mar 30 18:23:39.049726 2026] [:error] [pid 12046:tid 12057] [client 51.120.81.94:64477] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8573.php"] [unique_id "acpPK5DbtlkoJ6ELn7gRswAAAkg"]
[Mon Mar 30 18:23:39.573482 2026] [:error] [pid 35248:tid 35262] [client 51.120.81.94:63034] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8573.php"] [unique_id "acpPK73igMCgAQPFS_95xgAAAEg"]
[Mon Mar 30 18:23:40.105420 2026] [:error] [pid 35250:tid 35335] [client 51.120.81.94:64018] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "acpPLIaKM1MR6zcp2YNQ1wAAANg"]
[Mon Mar 30 18:23:40.628243 2026] [:error] [pid 35250:tid 35326] [client 51.120.81.94:64533] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "acpPLIaKM1MR6zcp2YNQ2QAAAM8"]
[Mon Mar 30 18:23:41.162799 2026] [:error] [pid 35250:tid 35324] [client 51.120.81.94:64461] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "acpPLYaKM1MR6zcp2YNQ2wAAAM0"]
[Mon Mar 30 18:23:41.687765 2026] [:error] [pid 41941:tid 41962] [client 51.120.81.94:62976] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "acpPLSB2g7BNCXGBOJNgGwAAARM"]
[Mon Mar 30 18:23:42.222157 2026] [:error] [pid 41941:tid 41959] [client 51.120.81.94:64500] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-png.php"] [unique_id "acpPLiB2g7BNCXGBOJNgHQAAARA"]
[Mon Mar 30 18:23:42.750669 2026] [:error] [pid 50663:tid 50674] [client 51.120.81.94:63363] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-png.php"] [unique_id "acpPLm28b9DKIAMEdfAN6wAAAYk"]
[Mon Mar 30 18:23:43.318703 2026] [:error] [pid 11947:tid 11964] [client 51.120.81.94:62950] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-png.php"] [unique_id "acpPLzSVtzzXIgk-Fgkq5wAAAg8"]
[Mon Mar 30 18:23:43.858732 2026] [:error] [pid 11947:tid 11963] [client 51.120.81.94:64558] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-png.php"] [unique_id "acpPLzSVtzzXIgk-Fgkq6wAAAg4"]
[Mon Mar 30 18:23:44.387167 2026] [:error] [pid 50663:tid 50678] [client 51.120.81.94:64003] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "acpPMG28b9DKIAMEdfAN7gAAAY0"]
[Mon Mar 30 18:23:44.916692 2026] [:error] [pid 12106:tid 12119] [client 51.120.81.94:63372] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "acpPMLIKxOs8TAdw7hcK0gAAAos"]
[Mon Mar 30 18:23:45.443480 2026] [:error] [pid 11947:tid 11952] [client 51.120.81.94:65221] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "acpPMTSVtzzXIgk-Fgkq8QAAAgM"]
[Mon Mar 30 18:23:45.969705 2026] [:error] [pid 11947:tid 11957] [client 51.120.81.94:63997] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "acpPMTSVtzzXIgk-Fgkq8wAAAgg"]
[Mon Mar 30 18:23:46.489653 2026] [:error] [pid 11947:tid 11960] [client 51.120.81.94:63972] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "acpPMjSVtzzXIgk-Fgkq9gAAAgs"]
[Mon Mar 30 18:23:47.021322 2026] [:error] [pid 12106:tid 12124] [client 51.120.81.94:64497] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "acpPM7IKxOs8TAdw7hcK1gAAApA"]
[Mon Mar 30 18:23:47.545755 2026] [:error] [pid 11947:tid 11971] [client 51.120.81.94:65308] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "acpPMzSVtzzXIgk-Fgkq_AAAAhY"]
[Mon Mar 30 18:23:48.067951 2026] [:error] [pid 11947:tid 11957] [client 51.120.81.94:63005] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "acpPNDSVtzzXIgk-Fgkq_wAAAgg"]
[Mon Mar 30 18:23:48.603145 2026] [:error] [pid 12106:tid 12109] [client 51.120.81.94:64049] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin-footer.php"] [unique_id "acpPNLIKxOs8TAdw7hcK2QAAAoE"]
[Mon Mar 30 18:23:49.129276 2026] [:error] [pid 35250:tid 35320] [client 51.120.81.94:64006] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin-footer.php"] [unique_id "acpPNYaKM1MR6zcp2YNQ4QAAAMk"]
[Mon Mar 30 18:23:49.652781 2026] [:error] [pid 11947:tid 11954] [client 51.120.81.94:63387] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin-footer.php"] [unique_id "acpPNTSVtzzXIgk-FgkrAwAAAgU"]
[Mon Mar 30 18:23:50.176159 2026] [:error] [pid 35248:tid 35258] [client 51.120.81.94:63938] [client 51.120.81.94] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin-footer.php"] [unique_id "acpPNr3igMCgAQPFS_95zQAAAEQ"]
[Mon Mar 30 20:42:09.730610 2026] [:error] [pid 64743:tid 64768] [client 137.220.224.4:29016] [client 137.220.224.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acpvoSzmpVL6Ubzil4ipAAAAAVc"]
[Mon Mar 30 20:42:10.387290 2026] [:error] [pid 11947:tid 11968] [client 137.220.224.4:29026] [client 137.220.224.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acpvojSVtzzXIgk-Fgl50gAAAhM"]
[Mon Mar 30 20:42:11.187199 2026] [:error] [pid 35249:tid 35305] [client 137.220.224.4:29040] [client 137.220.224.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acpvoyqCKiTq85d6rgBa1AAAAJU"]
[Mon Mar 30 20:42:11.836694 2026] [:error] [pid 50663:tid 50680] [client 137.220.224.4:29054] [client 137.220.224.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.220.224.4, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acpvo228b9DKIAMEdfBBIwAAAY8"]
[Mon Mar 30 20:42:11.838771 2026] [:error] [pid 50663:tid 50680] [client 137.220.224.4:29054] [client 137.220.224.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acpvo228b9DKIAMEdfBBIwAAAY8"]
[Mon Mar 30 20:42:12.486155 2026] [:error] [pid 12106:tid 12116] [client 137.220.224.4:29064] [client 137.220.224.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.220.224.4, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acpvpLIKxOs8TAdw7hchaAAAAog"]
[Mon Mar 30 20:42:12.487875 2026] [:error] [pid 12106:tid 12116] [client 137.220.224.4:29064] [client 137.220.224.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acpvpLIKxOs8TAdw7hchaAAAAog"]
[Mon Mar 30 22:32:06.857574 2026] [:error] [pid 60746:tid 60785] [client 173.239.214.179:25219] [client 173.239.214.179] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "acqJZp4kQrgjDdAbQCodQQAAAIk"]
[Tue Mar 31 01:20:33.545495 2026] [:error] [pid 39123:tid 39147] [client 185.238.231.221:32627] [client 185.238.231.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.221, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acqw4SobgVY20PMQKVtTYgAAARY"]
[Tue Mar 31 03:02:12.735147 2026] [:error] [pid 36706:tid 36871] [client 170.106.160.90:55078] [client 170.106.160.90] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acrItLa-eBLL1E34-UUk6AAAAMk"]
[Tue Mar 31 03:27:50.129747 2026] [:error] [pid 15453:tid 15525] [client 74.248.131.192:4383] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/by.php"] [unique_id "acrOthsik4F-eVTMtrsXaAAAAFg"]
[Tue Mar 31 03:27:51.464866 2026] [:error] [pid 15454:tid 15532] [client 74.248.131.192:29135] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/by.php"] [unique_id "acrOt3CerH-ZHr3-moQrUgAAAIQ"]
[Tue Mar 31 03:27:54.289828 2026] [:error] [pid 15567:tid 15586] [client 74.248.131.192:28587] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/by.php"] [unique_id "acrOupx4rriuHvPbfx2-IAAAAM8"]
[Tue Mar 31 03:27:55.541157 2026] [:error] [pid 15567:tid 15595] [client 74.248.131.192:4403] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/by.php"] [unique_id "acrOu5x4rriuHvPbfx2-IgAAANg"]
[Tue Mar 31 03:27:56.150369 2026] [:error] [pid 15453:tid 15510] [client 74.248.131.192:65110] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "acrOvBsik4F-eVTMtrsXcwAAAEk"]
[Tue Mar 31 03:27:59.134790 2026] [:error] [pid 15567:tid 15585] [client 74.248.131.192:40703] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-asudo.php"] [unique_id "acrOv5x4rriuHvPbfx2-JQAAAM4"]
[Tue Mar 31 03:28:01.650079 2026] [:error] [pid 15453:tid 15521] [client 74.248.131.192:57419] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-asudo.php"] [unique_id "acrOwRsik4F-eVTMtrsXfQAAAFQ"]
[Tue Mar 31 03:28:04.268025 2026] [:error] [pid 15454:tid 15552] [client 74.248.131.192:4370] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-asudo.php"] [unique_id "acrOxHCerH-ZHr3-moQrcQAAAJg"]
[Tue Mar 31 03:28:05.561981 2026] [:error] [pid 15452:tid 15490] [client 74.248.131.192:39370] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-asudo.php"] [unique_id "acrOxTsQa_tsDXl2tG779gAAABE"]
[Tue Mar 31 03:28:08.876510 2026] [:error] [pid 15454:tid 15531] [client 74.248.131.192:40684] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX2.php"] [unique_id "acrOyHCerH-ZHr3-moQrfgAAAIM"]
[Tue Mar 31 03:28:10.092439 2026] [:error] [pid 15452:tid 15475] [client 74.248.131.192:65115] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX2.php"] [unique_id "acrOyjsQa_tsDXl2tG78AQAAAAI"]
[Tue Mar 31 03:28:11.491060 2026] [:error] [pid 15452:tid 15495] [client 74.248.131.192:28563] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX2.php"] [unique_id "acrOyzsQa_tsDXl2tG78BwAAABY"]
[Tue Mar 31 03:28:14.772998 2026] [:error] [pid 15453:tid 15507] [client 74.248.131.192:28601] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zlnckdxn.php"] [unique_id "acrOzhsik4F-eVTMtrsXkAAAAEY"]
[Tue Mar 31 03:28:17.076010 2026] [:error] [pid 15452:tid 15487] [client 74.248.131.192:4394] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zlnckdxn.php"] [unique_id "acrO0TsQa_tsDXl2tG78HwAAAA4"]
[Tue Mar 31 03:28:21.052904 2026] [:error] [pid 15567:tid 15589] [client 74.248.131.192:38904] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zlnckdxn.php"] [unique_id "acrO1Zx4rriuHvPbfx2-SwAAANI"]
[Tue Mar 31 03:28:24.944679 2026] [:error] [pid 15452:tid 15495] [client 74.248.131.192:28575] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-thi.php"] [unique_id "acrO2DsQa_tsDXl2tG78LwAAABY"]
[Tue Mar 31 03:28:26.561545 2026] [:error] [pid 15567:tid 15589] [client 74.248.131.192:40656] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-thi.php"] [unique_id "acrO2px4rriuHvPbfx2-XwAAANI"]
[Tue Mar 31 03:28:29.615664 2026] [:error] [pid 15452:tid 15483] [client 74.248.131.192:37671] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "acrO3TsQa_tsDXl2tG78PQAAAAo"]
[Tue Mar 31 03:28:30.344267 2026] [:error] [pid 15453:tid 15505] [client 74.248.131.192:36955] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "acrO3hsik4F-eVTMtrsXswAAAEQ"]
[Tue Mar 31 03:28:31.598644 2026] [:error] [pid 15452:tid 15484] [client 74.248.131.192:28573] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "acrO3zsQa_tsDXl2tG78QwAAAAs"]
[Tue Mar 31 03:28:32.328378 2026] [:error] [pid 15453:tid 15516] [client 74.248.131.192:36962] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "acrO4Bsik4F-eVTMtrsXvQAAAE8"]
[Tue Mar 31 03:28:33.568346 2026] [:error] [pid 15567:tid 15579] [client 74.248.131.192:4355] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Geforce.php"] [unique_id "acrO4Zx4rriuHvPbfx2-dAAAAMg"]
[Tue Mar 31 03:28:36.512131 2026] [:error] [pid 15453:tid 15511] [client 74.248.131.192:37648] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Geforce.php"] [unique_id "acrO5Bsik4F-eVTMtrsXwwAAAEo"]
[Tue Mar 31 03:28:38.261355 2026] [:error] [pid 15567:tid 15578] [client 74.248.131.192:4407] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Geforce.php"] [unique_id "acrO5px4rriuHvPbfx2-iwAAAMc"]
[Tue Mar 31 03:28:40.388120 2026] [:error] [pid 15454:tid 15533] [client 74.248.131.192:56254] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "acrO6HCerH-ZHr3-moQrnAAAAIU"]
[Tue Mar 31 03:28:43.340133 2026] [:error] [pid 15454:tid 15541] [client 74.248.131.192:29183] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "acrO63CerH-ZHr3-moQroAAAAI0"]
[Tue Mar 31 03:28:44.456119 2026] [:error] [pid 15567:tid 15585] [client 74.248.131.192:28569] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "acrO7Jx4rriuHvPbfx2-oQAAAM4"]
[Tue Mar 31 03:28:46.171318 2026] [:error] [pid 15567:tid 15571] [client 74.248.131.192:38875] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "acrO7px4rriuHvPbfx2-qwAAAMA"]
[Tue Mar 31 03:28:59.551042 2026] [:error] [pid 15453:tid 15505] [client 74.248.131.192:56222] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/IcC7p.php"] [unique_id "acrO-xsik4F-eVTMtrsX-QAAAEQ"]
[Tue Mar 31 03:29:01.457124 2026] [:error] [pid 15452:tid 15495] [client 74.248.131.192:37657] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/IcC7p.php"] [unique_id "acrO_TsQa_tsDXl2tG78fQAAABY"]
[Tue Mar 31 03:29:03.546761 2026] [:error] [pid 15453:tid 15519] [client 74.248.131.192:38864] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/IcC7p.php"] [unique_id "acrO_xsik4F-eVTMtrsYAQAAAFI"]
[Tue Mar 31 03:29:05.552382 2026] [:error] [pid 15452:tid 15476] [client 74.248.131.192:4369] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/IcC7p.php"] [unique_id "acrPATsQa_tsDXl2tG78iAAAAAM"]
[Tue Mar 31 03:29:07.109574 2026] [:error] [pid 15453:tid 15513] [client 74.248.131.192:28590] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "acrPAxsik4F-eVTMtrsYCQAAAEw"]
[Tue Mar 31 03:29:07.923667 2026] [:error] [pid 15452:tid 15495] [client 74.248.131.192:28561] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "acrPAzsQa_tsDXl2tG78kAAAABY"]
[Tue Mar 31 03:29:08.708660 2026] [:error] [pid 15567:tid 15583] [client 74.248.131.192:56217] [client 74.248.131.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "acrPBJx4rriuHvPbfx2_BAAAAMw"]
[Tue Mar 31 04:18:01.723970 2026] [:error] [pid 18332:tid 18356] [client 114.80.36.40:42098] [client 114.80.36.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acraeb4KXr1F9raS5GSDMAAAAAg"]
[Tue Mar 31 05:06:35.387768 2026] [:error] [pid 1224:tid 1239] [client 43.153.54.138:55906] [client 43.153.54.138] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acrl28XGPQPzIHnCuJgbBQAAAQ0"]
[Tue Mar 31 05:10:57.708487 2026] [:error] [pid 18334:tid 18429] [client 185.238.231.239:38931] [client 185.238.231.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.239, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acrm4XqQrXLbk1cg3mhAoQAAAJc"]
[Tue Mar 31 05:36:27.662335 2026] [:error] [pid 18332:tid 18366] [client 185.238.231.226:31717] [client 185.238.231.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acrs274KXr1F9raS5GSfGAAAABI"]
[Tue Mar 31 06:00:21.992537 2026] [:error] [pid 18333:tid 18392] [client 185.238.231.236:45439] [client 185.238.231.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.236, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acrydUSx2C5hLR0-8dL9ggAAAE0"]
[Tue Mar 31 06:07:51.607383 2026] [:error] [pid 11822:tid 11836] [client 162.201.42.43:57456] [client 162.201.42.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.201.42.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acr0NyLLrL4a3YEM2I0JmAAAAYw"]
[Tue Mar 31 06:31:15.098859 2026] [:error] [pid 1224:tid 1227] [client 15.204.12.43:60592] [client 15.204.12.43] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/cidaas-pro-master/composer.json"] [unique_id "acr5s8XGPQPzIHnCuJhJHAAAAQE"]
[Tue Mar 31 07:12:28.177419 2026] [:error] [pid 11907:tid 11910] [client 185.238.231.243:20299] [client 185.238.231.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.243, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acsDXMcoKGLZkBF4Ym1kFQAAAgA"]
[Tue Mar 31 07:23:21.269177 2026] [:error] [pid 36890:tid 36917] [client 15.168.15.135:57700] [client 15.168.15.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.168.15.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acsF6Z8FASPd_uH8z7ca2gAAABY"]
[Tue Mar 31 07:23:22.426313 2026] [:error] [pid 36890:tid 36899] [client 15.168.15.135:57816] [client 15.168.15.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.168.15.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acsF6p8FASPd_uH8z7ca3AAAAAQ"]
[Tue Mar 31 07:23:23.536586 2026] [:error] [pid 36891:tid 36931] [client 15.168.15.135:57942] [client 15.168.15.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.168.15.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acsF65JhiMaJUqoqfl4WsAAAAEc"]
[Tue Mar 31 09:52:04.223181 2026] [:error] [pid 36982:tid 37001] [client 43.157.148.38:33860] [client 43.157.148.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acsoxPlMmeoQKN0r_GOvVQAAANA"]
[Tue Mar 31 10:47:28.234412 2026] [:error] [pid 36982:tid 37008] [client 216.73.216.147:54309] [client 216.73.216.147] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||expressinteriors.com|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/robots.txt"] [unique_id "acs1wPlMmeoQKN0r_GPgkwAAANc"]
[Tue Mar 31 11:44:56.521039 2026] [:error] [pid 6548:tid 6565] [client 20.107.195.165:4813] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsas.php"] [unique_id "actDOLgIz9HgMl9YwE726QAAAU8"]
[Tue Mar 31 11:44:57.310632 2026] [:error] [pid 36892:tid 36959] [client 20.107.195.165:45543] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsas.php"] [unique_id "actDOUyj9S4G0ek3O4ICGQAAAIg"]
[Tue Mar 31 11:44:59.167398 2026] [:error] [pid 36890:tid 36910] [client 20.107.195.165:57529] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsas.php"] [unique_id "actDO58FASPd_uH8z7eLowAAAA8"]
[Tue Mar 31 11:45:00.326899 2026] [:error] [pid 36982:tid 37001] [client 20.107.195.165:39693] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsas.php"] [unique_id "actDPPlMmeoQKN0r_GMZ6wAAANA"]
[Tue Mar 31 11:45:01.158844 2026] [:error] [pid 36982:tid 37001] [client 20.107.195.165:4193] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "actDPflMmeoQKN0r_GMZ8gAAANA"]
[Tue Mar 31 11:45:02.729470 2026] [:error] [pid 36890:tid 36906] [client 20.107.195.165:24038] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "actDPp8FASPd_uH8z7eLqAAAAAs"]
[Tue Mar 31 11:45:04.098494 2026] [:error] [pid 36982:tid 37002] [client 20.107.195.165:47514] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "actDQPlMmeoQKN0r_GMaAgAAANE"]
[Tue Mar 31 11:45:04.796018 2026] [:error] [pid 6548:tid 6560] [client 20.107.195.165:45540] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "actDQLgIz9HgMl9YwE729gAAAUo"]
[Tue Mar 31 11:45:06.491088 2026] [:error] [pid 36982:tid 36986] [client 20.107.195.165:47490] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-header.php"] [unique_id "actDQvlMmeoQKN0r_GMaEAAAAME"]
[Tue Mar 31 11:45:07.603623 2026] [:error] [pid 36982:tid 36990] [client 20.107.195.165:39688] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-header.php"] [unique_id "actDQ_lMmeoQKN0r_GMaGQAAAMU"]
[Tue Mar 31 11:45:09.120067 2026] [:error] [pid 41421:tid 41436] [client 20.107.195.165:45512] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-header.php"] [unique_id "actDRRSaDjY9kKFtUQDCvwAAAQw"]
[Tue Mar 31 11:45:10.412474 2026] [:error] [pid 36982:tid 36995] [client 20.107.195.165:4801] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog-header.php"] [unique_id "actDRvlMmeoQKN0r_GMaLQAAAMo"]
[Tue Mar 31 11:45:11.193449 2026] [:error] [pid 36982:tid 37004] [client 20.107.195.165:23549] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "actDR_lMmeoQKN0r_GMaNAAAANM"]
[Tue Mar 31 11:45:12.501442 2026] [:error] [pid 36982:tid 36986] [client 20.107.195.165:44371] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "actDSPlMmeoQKN0r_GMaPwAAAME"]
[Tue Mar 31 11:45:13.613031 2026] [:error] [pid 36982:tid 37005] [client 20.107.195.165:44374] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "actDSflMmeoQKN0r_GMaRwAAANQ"]
[Tue Mar 31 11:45:14.819288 2026] [:error] [pid 36982:tid 37008] [client 20.107.195.165:23534] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "actDSvlMmeoQKN0r_GMaUQAAANc"]
[Tue Mar 31 11:45:15.809547 2026] [:error] [pid 36890:tid 36911] [client 20.107.195.165:23543] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "actDS58FASPd_uH8z7eLuAAAABA"]
[Tue Mar 31 11:45:16.460676 2026] [:error] [pid 6548:tid 6572] [client 20.107.195.165:44378] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "actDTLgIz9HgMl9YwE73DQAAAVY"]
[Tue Mar 31 11:45:17.496827 2026] [:error] [pid 6548:tid 6568] [client 20.107.195.165:49670] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "actDTbgIz9HgMl9YwE73EwAAAVI"]
[Tue Mar 31 11:45:29.994984 2026] [:error] [pid 36891:tid 36932] [client 20.107.195.165:45017] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "actDWZJhiMaJUqoqfl5dowAAAEg"]
[Tue Mar 31 11:45:30.938869 2026] [:error] [pid 36982:tid 36992] [client 20.107.195.165:57511] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "actDWvlMmeoQKN0r_GMapwAAAMc"]
[Tue Mar 31 11:45:31.934971 2026] [:error] [pid 36982:tid 36985] [client 20.107.195.165:47567] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "actDW_lMmeoQKN0r_GMatAAAAMA"]
[Tue Mar 31 11:45:33.050059 2026] [:error] [pid 36982:tid 36994] [client 20.107.195.165:30112] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "actDXflMmeoQKN0r_GMavwAAAMk"]
[Tue Mar 31 11:45:34.315208 2026] [:error] [pid 36982:tid 36989] [client 20.107.195.165:23999] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "actDXvlMmeoQKN0r_GMaywAAAMQ"]
[Tue Mar 31 11:45:35.070666 2026] [:error] [pid 41421:tid 41433] [client 20.107.195.165:45538] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "actDXxSaDjY9kKFtUQDC2gAAAQk"]
[Tue Mar 31 11:45:35.658697 2026] [:error] [pid 6548:tid 6574] [client 20.107.195.165:45017] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "actDX7gIz9HgMl9YwE73UwAAAVg"]
[Tue Mar 31 11:45:36.591385 2026] [:error] [pid 41421:tid 41439] [client 20.107.195.165:23983] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "actDYBSaDjY9kKFtUQDC4AAAAQ8"]
[Tue Mar 31 11:45:37.866544 2026] [:error] [pid 6548:tid 6560] [client 20.107.195.165:37926] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "actDYbgIz9HgMl9YwE73YAAAAUo"]
[Tue Mar 31 11:45:38.726470 2026] [:error] [pid 36890:tid 36902] [client 20.107.195.165:52623] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "actDYp8FASPd_uH8z7eL8QAAAAc"]
[Tue Mar 31 11:45:40.120833 2026] [:error] [pid 36982:tid 37004] [client 20.107.195.165:57490] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "actDZPlMmeoQKN0r_GMa5wAAANM"]
[Tue Mar 31 11:45:41.039556 2026] [:error] [pid 36890:tid 36910] [client 20.107.195.165:45048] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "actDZZ8FASPd_uH8z7eL9gAAAA8"]
[Tue Mar 31 11:45:42.186554 2026] [:error] [pid 36982:tid 36992] [client 20.107.195.165:45517] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2ksm17n.php"] [unique_id "actDZvlMmeoQKN0r_GMa8AAAAMc"]
[Tue Mar 31 11:45:43.658883 2026] [:error] [pid 41421:tid 41440] [client 20.107.195.165:4621] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2ksm17n.php"] [unique_id "actDZxSaDjY9kKFtUQDDAgAAARA"]
[Tue Mar 31 11:45:45.101624 2026] [:error] [pid 36890:tid 36909] [client 20.107.195.165:37918] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2ksm17n.php"] [unique_id "actDaZ8FASPd_uH8z7eL_AAAAA4"]
[Tue Mar 31 11:45:46.139651 2026] [:error] [pid 6548:tid 6568] [client 20.107.195.165:57481] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2ksm17n.php"] [unique_id "actDargIz9HgMl9YwE73egAAAVI"]
[Tue Mar 31 11:45:48.929826 2026] [:error] [pid 36982:tid 36986] [client 20.107.195.165:43740] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "actDbPlMmeoQKN0r_GMbFAAAAME"]
[Tue Mar 31 11:45:49.857713 2026] [:error] [pid 36891:tid 36947] [client 20.107.195.165:45556] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "actDbZJhiMaJUqoqfl5dsAAAAFc"]
[Tue Mar 31 11:45:51.497504 2026] [:error] [pid 36982:tid 37007] [client 20.107.195.165:45513] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "actDb_lMmeoQKN0r_GMbIQAAANY"]
[Tue Mar 31 11:45:52.952654 2026] [:error] [pid 36982:tid 36986] [client 20.107.195.165:23974] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "actDcPlMmeoQKN0r_GMbLgAAAME"]
[Tue Mar 31 11:45:54.288852 2026] [:error] [pid 41421:tid 41431] [client 20.107.195.165:43725] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hots.php"] [unique_id "actDchSaDjY9kKFtUQDDEAAAAQc"]
[Tue Mar 31 11:46:07.016363 2026] [:error] [pid 36982:tid 36988] [client 20.107.195.165:4696] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "actDf_lMmeoQKN0r_GMbhQAAAMM"]
[Tue Mar 31 11:46:08.460270 2026] [:error] [pid 41421:tid 41429] [client 20.107.195.165:31697] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "actDgBSaDjY9kKFtUQDDIwAAAQU"]
[Tue Mar 31 11:46:10.350759 2026] [:error] [pid 36982:tid 36988] [client 20.107.195.165:52692] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "actDgvlMmeoQKN0r_GMbkAAAAMM"]
[Tue Mar 31 11:46:11.910783 2026] [:error] [pid 36890:tid 36912] [client 20.107.195.165:55306] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/grsiuk.php"] [unique_id "actDg58FASPd_uH8z7eMHAAAABE"]
[Tue Mar 31 11:46:13.064085 2026] [:error] [pid 36982:tid 36991] [client 20.107.195.165:32180] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "actDhflMmeoQKN0r_GMbowAAAMY"]
[Tue Mar 31 11:46:14.258479 2026] [:error] [pid 36982:tid 37003] [client 20.107.195.165:29125] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "actDhvlMmeoQKN0r_GMbqwAAANI"]
[Tue Mar 31 11:46:15.940989 2026] [:error] [pid 36891:tid 36934] [client 20.107.195.165:63462] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "actDh5JhiMaJUqoqfl5dvAAAAEo"]
[Tue Mar 31 11:46:16.569983 2026] [:error] [pid 36892:tid 36963] [client 20.107.195.165:32141] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "actDiEyj9S4G0ek3O4ICUAAAAIw"]
[Tue Mar 31 11:46:17.936869 2026] [:error] [pid 41421:tid 41430] [client 20.107.195.165:53102] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "actDiRSaDjY9kKFtUQDDMwAAAQY"]
[Tue Mar 31 11:46:19.020574 2026] [:error] [pid 41421:tid 41433] [client 20.107.195.165:33248] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "actDixSaDjY9kKFtUQDDNQAAAQk"]
[Tue Mar 31 11:46:19.939103 2026] [:error] [pid 36982:tid 36999] [client 20.107.195.165:4889] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "actDi_lMmeoQKN0r_GMbxwAAAM4"]
[Tue Mar 31 11:46:21.166173 2026] [:error] [pid 36891:tid 36927] [client 20.107.195.165:52680] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bo.php"] [unique_id "actDjZJhiMaJUqoqfl5dwAAAAEM"]
[Tue Mar 31 11:46:21.931252 2026] [:error] [pid 36982:tid 36999] [client 20.107.195.165:39166] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "actDjflMmeoQKN0r_GMb0gAAAM4"]
[Tue Mar 31 11:46:23.071509 2026] [:error] [pid 36982:tid 36999] [client 20.107.195.165:38651] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "actDj_lMmeoQKN0r_GMb2gAAAM4"]
[Tue Mar 31 11:46:24.198083 2026] [:error] [pid 36982:tid 36997] [client 20.107.195.165:38621] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "actDkPlMmeoQKN0r_GMb5AAAAMw"]
[Tue Mar 31 11:46:25.056407 2026] [:error] [pid 36982:tid 37009] [client 20.107.195.165:4723] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5b9ac.php"] [unique_id "actDkflMmeoQKN0r_GMb6gAAANg"]
[Tue Mar 31 11:46:26.368520 2026] [:error] [pid 36982:tid 36990] [client 20.107.195.165:40234] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "actDkvlMmeoQKN0r_GMb9gAAAMU"]
[Tue Mar 31 11:46:27.254433 2026] [:error] [pid 36890:tid 36914] [client 20.107.195.165:58021] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "actDk58FASPd_uH8z7eMKQAAABM"]
[Tue Mar 31 11:46:28.256552 2026] [:error] [pid 6548:tid 6571] [client 20.107.195.165:40292] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "actDlLgIz9HgMl9YwE738AAAAVU"]
[Tue Mar 31 11:46:29.356003 2026] [:error] [pid 41421:tid 41445] [client 20.107.195.165:4764] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "actDlRSaDjY9kKFtUQDDQQAAARU"]
[Tue Mar 31 11:46:30.490485 2026] [:error] [pid 36891:tid 36935] [client 20.107.195.165:58034] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "actDlpJhiMaJUqoqfl5dxwAAAEs"]
[Tue Mar 31 11:46:31.957036 2026] [:error] [pid 36982:tid 36992] [client 20.107.195.165:45015] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "actDl_lMmeoQKN0r_GMcGgAAAMc"]
[Tue Mar 31 11:46:34.292046 2026] [:error] [pid 36891:tid 36937] [client 20.107.195.165:45025] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "actDmpJhiMaJUqoqfl5dzQAAAE0"]
[Tue Mar 31 11:46:35.317867 2026] [:error] [pid 41421:tid 41426] [client 20.107.195.165:43704] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nw.php"] [unique_id "actDmxSaDjY9kKFtUQDDRgAAAQI"]
[Tue Mar 31 11:46:36.538274 2026] [:error] [pid 36982:tid 36986] [client 20.107.195.165:28034] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "actDnPlMmeoQKN0r_GMcSQAAAME"]
[Tue Mar 31 11:46:37.751112 2026] [:error] [pid 36982:tid 36988] [client 20.107.195.165:25480] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "actDnflMmeoQKN0r_GMcUAAAAMM"]
[Tue Mar 31 11:46:39.545097 2026] [:error] [pid 6548:tid 6562] [client 20.107.195.165:25071] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "actDn7gIz9HgMl9YwE74KwAAAUw"]
[Tue Mar 31 11:46:40.868396 2026] [:error] [pid 36982:tid 36990] [client 20.107.195.165:41170] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "actDoPlMmeoQKN0r_GMcZwAAAMU"]
[Tue Mar 31 11:46:42.092147 2026] [:error] [pid 6548:tid 6551] [client 20.107.195.165:31167] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx78.php"] [unique_id "actDorgIz9HgMl9YwE74MwAAAUE"]
[Tue Mar 31 11:46:43.065765 2026] [:error] [pid 36982:tid 36985] [client 20.107.195.165:31117] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx78.php"] [unique_id "actDo_lMmeoQKN0r_GMccwAAAMA"]
[Tue Mar 31 11:46:43.833825 2026] [:error] [pid 36982:tid 37009] [client 20.107.195.165:24499] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx78.php"] [unique_id "actDo_lMmeoQKN0r_GMcfAAAANg"]
[Tue Mar 31 11:46:44.869268 2026] [:error] [pid 41421:tid 41447] [client 20.107.195.165:27602] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx78.php"] [unique_id "actDpBSaDjY9kKFtUQDDUAAAARc"]
[Tue Mar 31 11:46:45.582042 2026] [:error] [pid 41421:tid 41426] [client 20.107.195.165:31122] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Sanskrit.php"] [unique_id "actDpRSaDjY9kKFtUQDDUwAAAQI"]
[Tue Mar 31 11:46:46.348344 2026] [:error] [pid 41421:tid 41445] [client 20.107.195.165:31121] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Sanskrit.php"] [unique_id "actDphSaDjY9kKFtUQDDVgAAARU"]
[Tue Mar 31 11:46:48.174541 2026] [:error] [pid 36890:tid 36913] [client 20.107.195.165:44977] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Sanskrit.php"] [unique_id "actDqJ8FASPd_uH8z7eMQwAAABI"]
[Tue Mar 31 11:46:49.604336 2026] [:error] [pid 36982:tid 36997] [client 20.107.195.165:62013] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Sanskrit.php"] [unique_id "actDqflMmeoQKN0r_GMcoAAAAMw"]
[Tue Mar 31 11:46:50.206519 2026] [:error] [pid 41421:tid 41441] [client 20.107.195.165:20060] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "actDqhSaDjY9kKFtUQDDXwAAARE"]
[Tue Mar 31 11:46:51.070538 2026] [:error] [pid 36892:tid 36960] [client 20.107.195.165:28041] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "actDq0yj9S4G0ek3O4ICYQAAAIk"]
[Tue Mar 31 11:46:51.833328 2026] [:error] [pid 6548:tid 6551] [client 20.107.195.165:44981] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "actDq7gIz9HgMl9YwE74VQAAAUE"]
[Tue Mar 31 11:46:52.685156 2026] [:error] [pid 36890:tid 36902] [client 20.107.195.165:49783] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "actDrJ8FASPd_uH8z7eMSAAAAAc"]
[Tue Mar 31 11:46:53.499516 2026] [:error] [pid 36892:tid 36955] [client 20.107.195.165:4541] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/torsa1.php"] [unique_id "actDrUyj9S4G0ek3O4ICYwAAAIQ"]
[Tue Mar 31 11:46:54.350849 2026] [:error] [pid 36982:tid 36997] [client 20.107.195.165:49773] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/torsa1.php"] [unique_id "actDrvlMmeoQKN0r_GMcuAAAAMw"]
[Tue Mar 31 11:46:55.019551 2026] [:error] [pid 36982:tid 36993] [client 20.107.195.165:20498] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/torsa1.php"] [unique_id "actDr_lMmeoQKN0r_GMcvwAAAMg"]
[Tue Mar 31 11:46:55.853649 2026] [:error] [pid 6548:tid 6567] [client 20.107.195.165:28083] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/torsa1.php"] [unique_id "actDr7gIz9HgMl9YwE74XQAAAVE"]
[Tue Mar 31 11:46:56.612868 2026] [:error] [pid 41421:tid 41444] [client 20.107.195.165:27599] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "actDsBSaDjY9kKFtUQDDbAAAARQ"]
[Tue Mar 31 11:46:57.521602 2026] [:error] [pid 6548:tid 6574] [client 20.107.195.165:27625] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "actDsbgIz9HgMl9YwE74XwAAAVg"]
[Tue Mar 31 11:46:58.585071 2026] [:error] [pid 36890:tid 36919] [client 20.107.195.165:42464] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "actDsp8FASPd_uH8z7eMUgAAABg"]
[Tue Mar 31 11:46:59.327745 2026] [:error] [pid 36892:tid 36971] [client 20.107.195.165:49791] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "actDs0yj9S4G0ek3O4ICaQAAAJQ"]
[Tue Mar 31 11:47:00.278487 2026] [:error] [pid 36890:tid 36905] [client 20.107.195.165:41833] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "actDtJ8FASPd_uH8z7eMVgAAAAo"]
[Tue Mar 31 11:47:01.174487 2026] [:error] [pid 36890:tid 36909] [client 20.107.195.165:38591] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "actDtZ8FASPd_uH8z7eMWwAAAA4"]
[Tue Mar 31 11:47:01.887810 2026] [:error] [pid 36891:tid 36947] [client 20.107.195.165:41847] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "actDtZJhiMaJUqoqfl5d2QAAAFc"]
[Tue Mar 31 11:47:02.813723 2026] [:error] [pid 6548:tid 6568] [client 20.107.195.165:27607] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "actDtrgIz9HgMl9YwE74ZQAAAVI"]
[Tue Mar 31 11:47:04.498977 2026] [:error] [pid 36982:tid 37004] [client 20.107.195.165:61982] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6kDPjgFTmvS.php"] [unique_id "actDuPlMmeoQKN0r_GMc8gAAANM"]
[Tue Mar 31 11:47:05.375919 2026] [:error] [pid 36890:tid 36895] [client 20.107.195.165:33174] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6kDPjgFTmvS.php"] [unique_id "actDuZ8FASPd_uH8z7eMZQAAAAA"]
[Tue Mar 31 11:47:17.718912 2026] [:error] [pid 41421:tid 41431] [client 20.107.195.165:42470] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "actDxRSaDjY9kKFtUQDDpgAAAQc"]
[Tue Mar 31 11:47:18.664976 2026] [:error] [pid 36982:tid 36986] [client 20.107.195.165:20049] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "actDxvlMmeoQKN0r_GMdJAAAAME"]
[Tue Mar 31 11:47:19.904281 2026] [:error] [pid 36982:tid 37004] [client 20.107.195.165:42481] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "actDx_lMmeoQKN0r_GMdLQAAANM"]
[Tue Mar 31 11:47:20.529146 2026] [:error] [pid 41421:tid 41443] [client 20.107.195.165:22952] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "actDyBSaDjY9kKFtUQDDrwAAARM"]
[Tue Mar 31 11:47:21.665456 2026] [:error] [pid 36982:tid 36992] [client 20.107.195.165:27627] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/166.php"] [unique_id "actDyflMmeoQKN0r_GMdMAAAAMc"]
[Tue Mar 31 11:47:22.740802 2026] [:error] [pid 6548:tid 6569] [client 20.107.195.165:61971] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/166.php"] [unique_id "actDyrgIz9HgMl9YwE74kAAAAVM"]
[Tue Mar 31 11:47:23.832414 2026] [:error] [pid 6548:tid 6551] [client 20.107.195.165:51633] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/166.php"] [unique_id "actDy7gIz9HgMl9YwE74lgAAAUE"]
[Tue Mar 31 11:47:24.812609 2026] [:error] [pid 6548:tid 6569] [client 20.107.195.165:60329] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/166.php"] [unique_id "actDzLgIz9HgMl9YwE74mwAAAVM"]
[Tue Mar 31 11:47:25.909668 2026] [:error] [pid 6548:tid 6558] [client 20.107.195.165:60335] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "actDzbgIz9HgMl9YwE74nQAAAUg"]
[Tue Mar 31 11:47:26.844455 2026] [:error] [pid 6548:tid 6573] [client 20.107.195.165:32214] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "actDzrgIz9HgMl9YwE74ogAAAVc"]
[Tue Mar 31 11:47:27.729330 2026] [:error] [pid 36890:tid 36902] [client 20.107.195.165:20518] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "actDz58FASPd_uH8z7eMiwAAAAc"]
[Tue Mar 31 11:47:28.426889 2026] [:error] [pid 41421:tid 41438] [client 20.107.195.165:44952] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/domains.php"] [unique_id "actD0BSaDjY9kKFtUQDDuwAAAQ4"]
[Tue Mar 31 11:47:29.478348 2026] [:error] [pid 6548:tid 6557] [client 20.107.195.165:33177] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "actD0bgIz9HgMl9YwE74qgAAAUc"]
[Tue Mar 31 11:47:30.730562 2026] [:error] [pid 36982:tid 36998] [client 20.107.195.165:60344] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "actD0vlMmeoQKN0r_GMdTwAAAM0"]
[Tue Mar 31 11:47:31.901343 2026] [:error] [pid 6548:tid 6570] [client 20.107.195.165:22931] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "actD07gIz9HgMl9YwE74twAAAVQ"]
[Tue Mar 31 11:47:32.791289 2026] [:error] [pid 36890:tid 36916] [client 20.107.195.165:32216] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "actD1J8FASPd_uH8z7eMkgAAABU"]
[Tue Mar 31 11:47:34.086412 2026] [:error] [pid 6548:tid 6574] [client 20.107.195.165:51598] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "actD1rgIz9HgMl9YwE74vQAAAVg"]
[Tue Mar 31 11:47:35.123713 2026] [:error] [pid 6548:tid 6566] [client 20.107.195.165:44986] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "actD17gIz9HgMl9YwE74wAAAAVA"]
[Tue Mar 31 11:47:35.879343 2026] [:error] [pid 6548:tid 6559] [client 20.107.195.165:33188] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "actD17gIz9HgMl9YwE74wgAAAUk"]
[Tue Mar 31 11:47:37.177203 2026] [:error] [pid 36982:tid 36986] [client 20.107.195.165:20485] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "actD2flMmeoQKN0r_GMdiQAAAME"]
[Tue Mar 31 11:47:38.807971 2026] [:error] [pid 6548:tid 6556] [client 20.107.195.165:41792] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hehe.php"] [unique_id "actD2rgIz9HgMl9YwE74yQAAAUY"]
[Tue Mar 31 11:47:39.509251 2026] [:error] [pid 6548:tid 6568] [client 20.107.195.165:38535] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hehe.php"] [unique_id "actD27gIz9HgMl9YwE74zQAAAVI"]
[Tue Mar 31 11:47:40.071850 2026] [:error] [pid 36982:tid 36986] [client 20.107.195.165:32254] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hehe.php"] [unique_id "actD3PlMmeoQKN0r_GMdkwAAAME"]
[Tue Mar 31 11:47:41.496860 2026] [:error] [pid 41421:tid 41438] [client 20.107.195.165:27640] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hehe.php"] [unique_id "actD3RSaDjY9kKFtUQDD0AAAAQ4"]
[Tue Mar 31 11:47:43.721837 2026] [:error] [pid 36982:tid 37009] [client 20.107.195.165:38561] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "actD3_lMmeoQKN0r_GMdrAAAANg"]
[Tue Mar 31 11:47:45.236017 2026] [:error] [pid 36982:tid 37006] [client 20.107.195.165:27631] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "actD4flMmeoQKN0r_GMdugAAANU"]
[Tue Mar 31 11:47:46.906420 2026] [:error] [pid 6548:tid 6574] [client 20.107.195.165:33172] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "actD4rgIz9HgMl9YwE742AAAAVg"]
[Tue Mar 31 11:47:50.483418 2026] [:error] [pid 36982:tid 37009] [client 20.107.195.165:31127] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "actD5vlMmeoQKN0r_GMd3QAAANg"]
[Tue Mar 31 11:47:52.483146 2026] [:error] [pid 41421:tid 41427] [client 20.107.195.165:37375] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ne2026.php"] [unique_id "actD6BSaDjY9kKFtUQDD7gAAAQM"]
[Tue Mar 31 11:47:53.593041 2026] [:error] [pid 36982:tid 36988] [client 20.107.195.165:38589] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ne2026.php"] [unique_id "actD6flMmeoQKN0r_GMd7gAAAMM"]
[Tue Mar 31 11:47:55.365601 2026] [:error] [pid 36891:tid 36935] [client 20.107.195.165:22922] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ne2026.php"] [unique_id "actD65JhiMaJUqoqfl5d-gAAAEs"]
[Tue Mar 31 11:47:56.317303 2026] [:error] [pid 36982:tid 36987] [client 20.107.195.165:20519] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ne2026.php"] [unique_id "actD7PlMmeoQKN0r_GMeLwAAAMI"]
[Tue Mar 31 11:47:57.138687 2026] [:error] [pid 36982:tid 36989] [client 20.107.195.165:27636] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "actD7flMmeoQKN0r_GMeOAAAAMQ"]
[Tue Mar 31 11:47:57.959069 2026] [:error] [pid 6548:tid 6560] [client 20.107.195.165:64076] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "actD7bgIz9HgMl9YwE748gAAAUo"]
[Tue Mar 31 11:47:59.490952 2026] [:error] [pid 36982:tid 36985] [client 20.107.195.165:41211] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "actD7_lMmeoQKN0r_GMeYAAAAMA"]
[Tue Mar 31 11:48:00.294576 2026] [:error] [pid 36892:tid 36970] [client 20.107.195.165:40630] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "actD8Eyj9S4G0ek3O4ICtQAAAJM"]
[Tue Mar 31 11:48:01.096381 2026] [:error] [pid 41421:tid 41427] [client 20.107.195.165:64079] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "actD8RSaDjY9kKFtUQDEHgAAAQM"]
[Tue Mar 31 11:48:02.621312 2026] [:error] [pid 6548:tid 6551] [client 20.107.195.165:64097] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "actD8rgIz9HgMl9YwE75AwAAAUE"]
[Tue Mar 31 11:48:04.107947 2026] [:error] [pid 36982:tid 36994] [client 20.107.195.165:40625] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "actD9PlMmeoQKN0r_GMeeQAAAMk"]
[Tue Mar 31 11:48:05.196055 2026] [:error] [pid 6548:tid 6550] [client 20.107.195.165:57009] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "actD9bgIz9HgMl9YwE75DAAAAUA"]
[Tue Mar 31 11:48:06.216415 2026] [:error] [pid 41421:tid 41424] [client 20.107.195.165:33701] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "actD9hSaDjY9kKFtUQDELAAAAQA"]
[Tue Mar 31 11:48:07.311364 2026] [:error] [pid 36890:tid 36906] [client 20.107.195.165:61186] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "actD958FASPd_uH8z7eM2gAAAAs"]
[Tue Mar 31 11:48:09.704380 2026] [:error] [pid 41421:tid 41429] [client 20.107.195.165:64163] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "actD-RSaDjY9kKFtUQDENwAAAQU"]
[Tue Mar 31 11:48:13.274318 2026] [:error] [pid 41421:tid 41438] [client 20.107.195.165:57964] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "actD_RSaDjY9kKFtUQDEQAAAAQ4"]
[Tue Mar 31 11:48:14.984776 2026] [:error] [pid 6548:tid 6573] [client 20.107.195.165:63797] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "actD_rgIz9HgMl9YwE75LQAAAVc"]
[Tue Mar 31 11:48:28.343428 2026] [:error] [pid 36982:tid 36998] [client 20.107.195.165:59784] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "actEDPlMmeoQKN0r_GMe9AAAAM0"]
[Tue Mar 31 11:48:29.373377 2026] [:error] [pid 36982:tid 37002] [client 20.107.195.165:4462] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "actEDflMmeoQKN0r_GMe9wAAANE"]
[Tue Mar 31 11:48:30.426463 2026] [:error] [pid 36982:tid 37003] [client 20.107.195.165:4422] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "actEDvlMmeoQKN0r_GMfAgAAANI"]
[Tue Mar 31 11:48:31.436881 2026] [:error] [pid 36890:tid 36913] [client 20.107.195.165:62985] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "actED58FASPd_uH8z7eM-QAAABI"]
[Tue Mar 31 11:48:32.297317 2026] [:error] [pid 6548:tid 6574] [client 20.107.195.165:22453] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drhunthq.php"] [unique_id "actEELgIz9HgMl9YwE75SgAAAVg"]
[Tue Mar 31 11:48:33.004667 2026] [:error] [pid 36982:tid 36985] [client 20.107.195.165:30198] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drhunthq.php"] [unique_id "actEEflMmeoQKN0r_GMfDQAAAMA"]
[Tue Mar 31 11:48:34.035205 2026] [:error] [pid 36982:tid 36999] [client 20.107.195.165:54291] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drhunthq.php"] [unique_id "actEEvlMmeoQKN0r_GMfFAAAAM4"]
[Tue Mar 31 11:48:34.663168 2026] [:error] [pid 6548:tid 6550] [client 20.107.195.165:21089] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drhunthq.php"] [unique_id "actEErgIz9HgMl9YwE75TwAAAUA"]
[Tue Mar 31 11:48:35.616858 2026] [:error] [pid 36982:tid 36989] [client 20.107.195.165:30179] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/file.php"] [unique_id "actEE_lMmeoQKN0r_GMfHAAAAMQ"]
[Tue Mar 31 11:48:37.144251 2026] [:error] [pid 36982:tid 36987] [client 20.107.195.165:28147] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/file.php"] [unique_id "actEFflMmeoQKN0r_GMfIQAAAMI"]
[Tue Mar 31 11:48:38.851386 2026] [:error] [pid 36982:tid 37007] [client 20.107.195.165:50963] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/file.php"] [unique_id "actEFvlMmeoQKN0r_GMfLwAAANY"]
[Tue Mar 31 11:48:40.143350 2026] [:error] [pid 6548:tid 6568] [client 20.107.195.165:54326] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/file.php"] [unique_id "actEGLgIz9HgMl9YwE75WAAAAVI"]
[Tue Mar 31 11:48:40.881693 2026] [:error] [pid 36982:tid 36994] [client 20.107.195.165:21078] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxw.php"] [unique_id "actEGPlMmeoQKN0r_GMfOQAAAMk"]
[Tue Mar 31 11:48:42.307370 2026] [:error] [pid 6548:tid 6568] [client 20.107.195.165:62650] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxw.php"] [unique_id "actEGrgIz9HgMl9YwE75YwAAAVI"]
[Tue Mar 31 11:48:43.025770 2026] [:error] [pid 36982:tid 37002] [client 20.107.195.165:50997] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxw.php"] [unique_id "actEG_lMmeoQKN0r_GMfPwAAANE"]
[Tue Mar 31 11:48:44.081472 2026] [:error] [pid 41421:tid 41426] [client 20.107.195.165:21096] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxw.php"] [unique_id "actEHBSaDjY9kKFtUQDEawAAAQI"]
[Tue Mar 31 11:48:44.962580 2026] [:error] [pid 36982:tid 36985] [client 20.107.195.165:4350] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "actEHPlMmeoQKN0r_GMfRgAAAMA"]
[Tue Mar 31 11:48:45.857039 2026] [:error] [pid 41421:tid 41431] [client 20.107.195.165:28646] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "actEHRSaDjY9kKFtUQDEbQAAAQc"]
[Tue Mar 31 11:48:46.892954 2026] [:error] [pid 6548:tid 6556] [client 20.107.195.165:5010] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "actEHrgIz9HgMl9YwE75dgAAAUY"]
[Tue Mar 31 11:48:47.699330 2026] [:error] [pid 36890:tid 36897] [client 20.107.195.165:5029] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "actEH58FASPd_uH8z7eNDwAAAAI"]
[Tue Mar 31 11:48:48.662009 2026] [:error] [pid 36982:tid 37003] [client 20.107.195.165:60730] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "actEIPlMmeoQKN0r_GMfTgAAANI"]
[Tue Mar 31 11:48:49.904426 2026] [:error] [pid 41421:tid 41433] [client 20.107.195.165:34152] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "actEIRSaDjY9kKFtUQDEdQAAAQk"]
[Tue Mar 31 11:48:50.906319 2026] [:error] [pid 6548:tid 6568] [client 20.107.195.165:54816] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "actEIrgIz9HgMl9YwE75hQAAAVI"]
[Tue Mar 31 11:48:51.938270 2026] [:error] [pid 41421:tid 41427] [client 20.107.195.165:37267] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "actEIxSaDjY9kKFtUQDEfwAAAQM"]
[Tue Mar 31 11:48:52.915817 2026] [:error] [pid 6548:tid 6570] [client 20.107.195.165:54802] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lm15.php"] [unique_id "actEJLgIz9HgMl9YwE75jwAAAVQ"]
[Tue Mar 31 11:48:54.275449 2026] [:error] [pid 36890:tid 36902] [client 20.107.195.165:45982] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lm15.php"] [unique_id "actEJp8FASPd_uH8z7eNGQAAAAc"]
[Tue Mar 31 11:48:55.323985 2026] [:error] [pid 36892:tid 36972] [client 20.107.195.165:55926] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lm15.php"] [unique_id "actEJ0yj9S4G0ek3O4IC3wAAAJU"]
[Tue Mar 31 11:48:56.122125 2026] [:error] [pid 36982:tid 36994] [client 20.107.195.165:37271] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lm15.php"] [unique_id "actEKPlMmeoQKN0r_GMfXAAAAMk"]
[Tue Mar 31 11:48:58.647719 2026] [:error] [pid 41421:tid 41427] [client 20.107.195.165:21022] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/green.php"] [unique_id "actEKhSaDjY9kKFtUQDElwAAAQM"]
[Tue Mar 31 11:48:59.731046 2026] [:error] [pid 36982:tid 36986] [client 20.107.195.165:34119] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/green.php"] [unique_id "actEK_lMmeoQKN0r_GMfagAAAME"]
[Tue Mar 31 11:49:02.162510 2026] [:error] [pid 36982:tid 36987] [client 20.107.195.165:64966] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/green.php"] [unique_id "actELvlMmeoQKN0r_GMffQAAAMI"]
[Tue Mar 31 11:49:03.041040 2026] [:error] [pid 36982:tid 36995] [client 20.107.195.165:20994] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/green.php"] [unique_id "actEL_lMmeoQKN0r_GMfiQAAAMo"]
[Tue Mar 31 11:49:04.331056 2026] [:error] [pid 36982:tid 36993] [client 20.107.195.165:64966] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "actEMPlMmeoQKN0r_GMfkwAAAMg"]
[Tue Mar 31 11:49:05.789842 2026] [:error] [pid 36982:tid 36987] [client 20.107.195.165:21054] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "actEMflMmeoQKN0r_GMfoQAAAMI"]
[Tue Mar 31 11:49:07.773484 2026] [:error] [pid 6548:tid 6552] [client 20.107.195.165:60245] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "actEM7gIz9HgMl9YwE75qgAAAUI"]
[Tue Mar 31 11:49:08.655574 2026] [:error] [pid 6548:tid 6562] [client 20.107.195.165:63418] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "actENLgIz9HgMl9YwE75sAAAAUw"]
[Tue Mar 31 11:49:09.828287 2026] [:error] [pid 6548:tid 6574] [client 20.107.195.165:55405] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "actENbgIz9HgMl9YwE75uAAAAVg"]
[Tue Mar 31 11:49:10.804793 2026] [:error] [pid 41421:tid 41425] [client 20.107.195.165:21418] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "actENhSaDjY9kKFtUQDEvgAAAQE"]
[Tue Mar 31 11:49:11.674251 2026] [:error] [pid 6548:tid 6551] [client 20.107.195.165:58811] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "actEN7gIz9HgMl9YwE75vQAAAUE"]
[Tue Mar 31 11:49:12.338464 2026] [:error] [pid 36890:tid 36908] [client 20.107.195.165:55382] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "actEOJ8FASPd_uH8z7eNOQAAAA0"]
[Tue Mar 31 11:49:13.222214 2026] [:error] [pid 41421:tid 41425] [client 20.107.195.165:39802] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "actEORSaDjY9kKFtUQDEwgAAAQE"]
[Tue Mar 31 11:49:14.295259 2026] [:error] [pid 6548:tid 6563] [client 20.107.195.165:58769] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "actEOrgIz9HgMl9YwE75wAAAAU0"]
[Tue Mar 31 11:49:15.216018 2026] [:error] [pid 36982:tid 37002] [client 20.107.195.165:55389] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "actEO_lMmeoQKN0r_GMf3gAAANE"]
[Tue Mar 31 11:49:15.905939 2026] [:error] [pid 36890:tid 36898] [client 20.107.195.165:58802] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "actEO58FASPd_uH8z7eNQAAAAAM"]
[Tue Mar 31 11:49:17.076367 2026] [:error] [pid 36892:tid 36974] [client 20.107.195.165:39788] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "actEPUyj9S4G0ek3O4IDAAAAAJc"]
[Tue Mar 31 11:49:18.111261 2026] [:error] [pid 36892:tid 36958] [client 20.107.195.165:58757] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "actEPkyj9S4G0ek3O4IDAgAAAIc"]
[Tue Mar 31 11:49:18.848639 2026] [:error] [pid 41421:tid 41431] [client 20.107.195.165:53872] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "actEPhSaDjY9kKFtUQDE-QAAAQc"]
[Tue Mar 31 11:49:19.842177 2026] [:error] [pid 36892:tid 36961] [client 20.107.195.165:42410] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "actEP0yj9S4G0ek3O4IDBAAAAIo"]
[Tue Mar 31 11:49:20.533397 2026] [:error] [pid 6548:tid 6563] [client 20.107.195.165:42415] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccs.php"] [unique_id "actEQLgIz9HgMl9YwE750QAAAU0"]
[Tue Mar 31 11:49:21.148252 2026] [:error] [pid 41421:tid 41434] [client 20.107.195.165:21384] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccs.php"] [unique_id "actEQRSaDjY9kKFtUQDFDAAAAQo"]
[Tue Mar 31 11:49:22.363343 2026] [:error] [pid 36892:tid 36955] [client 20.107.195.165:34059] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccs.php"] [unique_id "actEQkyj9S4G0ek3O4IDCAAAAIQ"]
[Tue Mar 31 11:49:23.035454 2026] [:error] [pid 36982:tid 36986] [client 20.107.195.165:63412] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccs.php"] [unique_id "actEQ_lMmeoQKN0r_GMgBAAAAME"]
[Tue Mar 31 11:49:23.899627 2026] [:error] [pid 6548:tid 6569] [client 20.107.195.165:59753] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clss.php"] [unique_id "actEQ7gIz9HgMl9YwE756wAAAVM"]
[Tue Mar 31 11:49:24.507543 2026] [:error] [pid 36892:tid 36952] [client 20.107.195.165:61573] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clss.php"] [unique_id "actEREyj9S4G0ek3O4IDDQAAAIE"]
[Tue Mar 31 11:49:25.358596 2026] [:error] [pid 36892:tid 36956] [client 20.107.195.165:59728] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clss.php"] [unique_id "actERUyj9S4G0ek3O4IDEAAAAIU"]
[Tue Mar 31 11:49:26.225185 2026] [:error] [pid 36890:tid 36918] [client 20.107.195.165:39806] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clss.php"] [unique_id "actERp8FASPd_uH8z7eNcQAAABc"]
[Tue Mar 31 11:49:26.999812 2026] [:error] [pid 36982:tid 37007] [client 20.107.195.165:34079] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "actERvlMmeoQKN0r_GMgHwAAANY"]
[Tue Mar 31 11:49:37.643288 2026] [:error] [pid 36890:tid 36895] [client 20.107.195.165:54367] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "actEUZ8FASPd_uH8z7eNogAAAAA"]
[Tue Mar 31 11:49:38.790842 2026] [:error] [pid 36891:tid 36938] [client 20.107.195.165:61622] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "actEUpJhiMaJUqoqfl5eTwAAAE4"]
[Tue Mar 31 11:49:39.404465 2026] [:error] [pid 6548:tid 6555] [client 20.107.195.165:61612] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "actEU7gIz9HgMl9YwE76BwAAAUU"]
[Tue Mar 31 11:49:41.138741 2026] [:error] [pid 36982:tid 37008] [client 20.107.195.165:42427] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "actEVflMmeoQKN0r_GMgVQAAANc"]
[Tue Mar 31 11:49:42.141558 2026] [:error] [pid 6548:tid 6567] [client 20.107.195.165:25578] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myfile.php"] [unique_id "actEVrgIz9HgMl9YwE76DgAAAVE"]
[Tue Mar 31 11:49:42.890053 2026] [:error] [pid 6548:tid 6564] [client 20.107.195.165:30668] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myfile.php"] [unique_id "actEVrgIz9HgMl9YwE76EQAAAU4"]
[Tue Mar 31 11:49:44.332912 2026] [:error] [pid 41421:tid 41442] [client 20.107.195.165:33252] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myfile.php"] [unique_id "actEWBSaDjY9kKFtUQDFQAAAARI"]
[Tue Mar 31 11:49:45.482016 2026] [:error] [pid 41421:tid 41435] [client 20.107.195.165:59767] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myfile.php"] [unique_id "actEWRSaDjY9kKFtUQDFRQAAAQs"]
[Tue Mar 31 11:49:47.874199 2026] [:error] [pid 41421:tid 41430] [client 20.107.195.165:61900] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "actEWxSaDjY9kKFtUQDFSQAAAQY"]
[Tue Mar 31 11:49:49.391743 2026] [:error] [pid 36982:tid 37004] [client 20.107.195.165:42381] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "actEXflMmeoQKN0r_GMgaQAAANM"]
[Tue Mar 31 11:49:50.306296 2026] [:error] [pid 36891:tid 36941] [client 20.107.195.165:33260] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "actEXpJhiMaJUqoqfl5eVwAAAFE"]
[Tue Mar 31 11:49:51.390138 2026] [:error] [pid 36982:tid 36988] [client 20.107.195.165:23428] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "actEX_lMmeoQKN0r_GMgbgAAAMM"]
[Tue Mar 31 11:49:52.316465 2026] [:error] [pid 41421:tid 41440] [client 20.107.195.165:23425] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/okxh.php"] [unique_id "actEYBSaDjY9kKFtUQDFUAAAARA"]
[Tue Mar 31 11:49:54.428589 2026] [:error] [pid 41421:tid 41446] [client 20.107.195.165:42404] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/okxh.php"] [unique_id "actEYhSaDjY9kKFtUQDFWQAAARY"]
[Tue Mar 31 11:49:55.785625 2026] [:error] [pid 41421:tid 41445] [client 20.107.195.165:33258] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/okxh.php"] [unique_id "actEYxSaDjY9kKFtUQDFXQAAARU"]
[Tue Mar 31 11:49:56.810617 2026] [:error] [pid 41421:tid 41446] [client 20.107.195.165:61911] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/okxh.php"] [unique_id "actEZBSaDjY9kKFtUQDFYgAAARY"]
[Tue Mar 31 11:49:58.321556 2026] [:error] [pid 36890:tid 36899] [client 20.107.195.165:36062] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "actEZp8FASPd_uH8z7eNxQAAAAQ"]
[Tue Mar 31 11:49:59.105169 2026] [:error] [pid 36890:tid 36918] [client 20.107.195.165:64964] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "actEZ58FASPd_uH8z7eNyQAAABc"]
[Tue Mar 31 11:50:00.490053 2026] [:error] [pid 36892:tid 36968] [client 20.107.195.165:31227] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "actEaEyj9S4G0ek3O4IDMwAAAJE"]
[Tue Mar 31 11:50:01.516434 2026] [:error] [pid 36891:tid 36936] [client 20.107.195.165:56410] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "actEaZJhiMaJUqoqfl5eZQAAAEw"]
[Tue Mar 31 11:50:03.281683 2026] [:error] [pid 36982:tid 36997] [client 20.107.195.165:22984] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-104.php"] [unique_id "actEa_lMmeoQKN0r_GMgfQAAAMw"]
[Tue Mar 31 11:50:04.922007 2026] [:error] [pid 36982:tid 37007] [client 20.107.195.165:23459] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-104.php"] [unique_id "actEbPlMmeoQKN0r_GMgfwAAANY"]
[Tue Mar 31 11:50:06.325536 2026] [:error] [pid 36982:tid 36993] [client 20.107.195.165:36053] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-104.php"] [unique_id "actEbvlMmeoQKN0r_GMghAAAAMg"]
[Tue Mar 31 11:50:08.598339 2026] [:error] [pid 36982:tid 36988] [client 20.107.195.165:61892] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-104.php"] [unique_id "actEcPlMmeoQKN0r_GMgiwAAAMM"]
[Tue Mar 31 11:50:10.764270 2026] [:error] [pid 6548:tid 6562] [client 20.107.195.165:23448] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "actEcrgIz9HgMl9YwE76SAAAAUw"]
[Tue Mar 31 11:50:12.268282 2026] [:error] [pid 41421:tid 41448] [client 20.107.195.165:31678] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "actEdBSaDjY9kKFtUQDFdgAAARg"]
[Tue Mar 31 11:50:14.309080 2026] [:error] [pid 36982:tid 37005] [client 20.107.195.165:23023] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "actEdvlMmeoQKN0r_GMgnQAAANQ"]
[Tue Mar 31 11:50:16.107441 2026] [:error] [pid 6548:tid 6564] [client 20.107.195.165:4287] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "actEeLgIz9HgMl9YwE76WwAAAU4"]
[Tue Mar 31 11:50:17.198595 2026] [:error] [pid 36982:tid 36986] [client 20.107.195.165:36059] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blogs.php"] [unique_id "actEeflMmeoQKN0r_GMgowAAAME"]
[Tue Mar 31 11:50:20.177219 2026] [:error] [pid 36982:tid 36986] [client 20.107.195.165:22488] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blogs.php"] [unique_id "actEfPlMmeoQKN0r_GMgqwAAAME"]
[Tue Mar 31 11:50:21.085696 2026] [:error] [pid 6548:tid 6556] [client 20.107.195.165:36057] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blogs.php"] [unique_id "actEfbgIz9HgMl9YwE76aAAAAUY"]
[Tue Mar 31 11:50:22.721133 2026] [:error] [pid 36890:tid 36899] [client 20.107.195.165:31640] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blogs.php"] [unique_id "actEfp8FASPd_uH8z7eN_gAAAAQ"]
[Tue Mar 31 11:50:23.753574 2026] [:error] [pid 36892:tid 36965] [client 20.107.195.165:61581] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "actEf0yj9S4G0ek3O4IDTgAAAI4"]
[Tue Mar 31 11:50:25.162498 2026] [:error] [pid 36982:tid 37007] [client 20.107.195.165:56445] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "actEgflMmeoQKN0r_GMgtAAAANY"]
[Tue Mar 31 11:50:26.012924 2026] [:error] [pid 6548:tid 6556] [client 20.107.195.165:30716] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "actEgrgIz9HgMl9YwE76cwAAAUY"]
[Tue Mar 31 11:50:26.780424 2026] [:error] [pid 36982:tid 36991] [client 20.107.195.165:33217] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "actEgvlMmeoQKN0r_GMgvQAAAMY"]
[Tue Mar 31 11:50:28.382423 2026] [:error] [pid 6548:tid 6551] [client 20.107.195.165:22507] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "actEhLgIz9HgMl9YwE76fwAAAUE"]
[Tue Mar 31 11:50:29.085431 2026] [:error] [pid 36890:tid 36902] [client 20.107.195.165:30617] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "actEhZ8FASPd_uH8z7eOCQAAAAc"]
[Tue Mar 31 11:50:29.914169 2026] [:error] [pid 41421:tid 41442] [client 20.107.195.165:4113] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "actEhRSaDjY9kKFtUQDFmAAAARI"]
[Tue Mar 31 11:50:31.008106 2026] [:error] [pid 6548:tid 6552] [client 20.107.195.165:31621] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "actEh7gIz9HgMl9YwE76hgAAAUI"]
[Tue Mar 31 11:50:31.960886 2026] [:error] [pid 36891:tid 36940] [client 20.107.195.165:32133] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xfun.php"] [unique_id "actEh5JhiMaJUqoqfl5eewAAAFA"]
[Tue Mar 31 11:50:32.761662 2026] [:error] [pid 41421:tid 41442] [client 20.107.195.165:21456] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xfun.php"] [unique_id "actEiBSaDjY9kKFtUQDFpAAAARI"]
[Tue Mar 31 11:50:33.522905 2026] [:error] [pid 36891:tid 36938] [client 20.107.195.165:55317] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xfun.php"] [unique_id "actEiZJhiMaJUqoqfl5efQAAAE4"]
[Tue Mar 31 11:50:34.923768 2026] [:error] [pid 6548:tid 6567] [client 20.107.195.165:26065] [client 20.107.195.165] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xfun.php"] [unique_id "actEirgIz9HgMl9YwE76jgAAAVE"]
[Tue Mar 31 12:26:54.983873 2026] [:error] [pid 36982:tid 37001] [client 43.155.129.131:47574] [client 43.155.129.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "actNDvlMmeoQKN0r_GNEUAAAANA"]
[Tue Mar 31 14:18:56.183903 2026] [:error] [pid 36982:tid 36988] [client 49.51.50.147:35318] [client 49.51.50.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "actnUPlMmeoQKN0r_GOsIgAAAMM"]
[Tue Mar 31 16:14:26.739334 2026] [:error] [pid 41421:tid 41433] [client 20.216.187.161:14303] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ycadmin.php"] [unique_id "acuCYhSaDjY9kKFtUQA12AAAAQk"]
[Tue Mar 31 16:14:27.259285 2026] [:error] [pid 6548:tid 6550] [client 20.216.187.161:14320] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ycadmin.php"] [unique_id "acuCY7gIz9HgMl9YwE6cNAAAAUA"]
[Tue Mar 31 16:14:27.839441 2026] [:error] [pid 6548:tid 6555] [client 20.216.187.161:14317] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ycadmin.php"] [unique_id "acuCY7gIz9HgMl9YwE6cNwAAAUU"]
[Tue Mar 31 16:14:28.421994 2026] [:error] [pid 6548:tid 6569] [client 20.216.187.161:14302] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ycadmin.php"] [unique_id "acuCZLgIz9HgMl9YwE6cOgAAAVM"]
[Tue Mar 31 16:14:28.924626 2026] [:error] [pid 36890:tid 36902] [client 20.216.187.161:14211] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "acuCZJ8FASPd_uH8z7fmIwAAAAc"]
[Tue Mar 31 16:14:29.576165 2026] [:error] [pid 6548:tid 6566] [client 20.216.187.161:14307] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "acuCZbgIz9HgMl9YwE6cQAAAAVA"]
[Tue Mar 31 16:14:30.106153 2026] [:error] [pid 36891:tid 36939] [client 20.216.187.161:14290] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "acuCZpJhiMaJUqoqfl6bZwAAAE8"]
[Tue Mar 31 16:14:30.774018 2026] [:error] [pid 36890:tid 36912] [client 20.216.187.161:14323] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "acuCZp8FASPd_uH8z7fmJQAAABE"]
[Tue Mar 31 16:14:31.269035 2026] [:error] [pid 6548:tid 6573] [client 20.216.187.161:14329] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lti.php"] [unique_id "acuCZ7gIz9HgMl9YwE6cSgAAAVc"]
[Tue Mar 31 16:14:31.773714 2026] [:error] [pid 36890:tid 36905] [client 20.216.187.161:14227] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lti.php"] [unique_id "acuCZ58FASPd_uH8z7fmKQAAAAo"]
[Tue Mar 31 16:14:32.485494 2026] [:error] [pid 41421:tid 41445] [client 20.216.187.161:14291] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lti.php"] [unique_id "acuCaBSaDjY9kKFtUQA13QAAARU"]
[Tue Mar 31 16:14:33.005654 2026] [:error] [pid 36892:tid 36967] [client 20.216.187.161:14334] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lti.php"] [unique_id "acuCaUyj9S4G0ek3O4JMiQAAAJA"]
[Tue Mar 31 16:14:33.542556 2026] [:error] [pid 36892:tid 36952] [client 20.216.187.161:14299] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "acuCaUyj9S4G0ek3O4JMiwAAAIE"]
[Tue Mar 31 16:14:34.056981 2026] [:error] [pid 36891:tid 36932] [client 20.216.187.161:14332] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "acuCapJhiMaJUqoqfl6bbgAAAEg"]
[Tue Mar 31 16:14:34.559166 2026] [:error] [pid 36891:tid 36929] [client 20.216.187.161:14335] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "acuCapJhiMaJUqoqfl6bcgAAAEU"]
[Tue Mar 31 16:14:35.229189 2026] [:error] [pid 36982:tid 36991] [client 20.216.187.161:14326] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "acuCa_lMmeoQKN0r_GP_RwAAAMY"]
[Tue Mar 31 16:14:36.215934 2026] [:error] [pid 41421:tid 41437] [client 20.216.187.161:14322] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "acuCbBSaDjY9kKFtUQA14QAAAQ0"]
[Tue Mar 31 16:14:36.743033 2026] [:error] [pid 36892:tid 36958] [client 20.216.187.161:14281] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "acuCbEyj9S4G0ek3O4JMkgAAAIc"]
[Tue Mar 31 16:14:37.269300 2026] [:error] [pid 41421:tid 41431] [client 20.216.187.161:14288] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cnusw.php"] [unique_id "acuCbRSaDjY9kKFtUQA14wAAAQc"]
[Tue Mar 31 16:14:37.874328 2026] [:error] [pid 41421:tid 41427] [client 20.216.187.161:14229] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cnusw.php"] [unique_id "acuCbRSaDjY9kKFtUQA15QAAAQM"]
[Tue Mar 31 16:14:38.419940 2026] [:error] [pid 36891:tid 36930] [client 20.216.187.161:14310] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cnusw.php"] [unique_id "acuCbpJhiMaJUqoqfl6beAAAAEY"]
[Tue Mar 31 16:14:38.932493 2026] [:error] [pid 41421:tid 41439] [client 20.216.187.161:14330] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cnusw.php"] [unique_id "acuCbhSaDjY9kKFtUQA16AAAAQ8"]
[Tue Mar 31 16:14:39.458546 2026] [:error] [pid 36891:tid 36928] [client 20.216.187.161:14301] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "acuCb5JhiMaJUqoqfl6beQAAAEQ"]
[Tue Mar 31 16:14:40.384935 2026] [:error] [pid 41421:tid 41428] [client 20.216.187.161:14209] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "acuCcBSaDjY9kKFtUQA17QAAAQQ"]
[Tue Mar 31 16:14:40.911180 2026] [:error] [pid 36890:tid 36900] [client 20.216.187.161:14319] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "acuCcJ8FASPd_uH8z7fmLAAAAAU"]
[Tue Mar 31 16:14:41.418964 2026] [:error] [pid 41421:tid 41447] [client 20.216.187.161:14275] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "acuCcRSaDjY9kKFtUQA17gAAARc"]
[Tue Mar 31 16:14:42.293014 2026] [:error] [pid 41421:tid 41446] [client 20.216.187.161:14279] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "acuCchSaDjY9kKFtUQA18QAAARY"]
[Tue Mar 31 16:14:42.857563 2026] [:error] [pid 36982:tid 37003] [client 20.216.187.161:14218] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "acuCcvlMmeoQKN0r_GP_UwAAANI"]
[Tue Mar 31 16:14:43.465316 2026] [:error] [pid 36982:tid 37009] [client 20.216.187.161:14210] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "acuCc_lMmeoQKN0r_GP_VgAAANg"]
[Tue Mar 31 16:14:44.140331 2026] [:error] [pid 41421:tid 41444] [client 20.216.187.161:14304] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-conflg.php"] [unique_id "acuCdBSaDjY9kKFtUQA19gAAARQ"]
[Tue Mar 31 16:14:44.747252 2026] [:error] [pid 41421:tid 41438] [client 20.216.187.161:14286] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "acuCdBSaDjY9kKFtUQA1-AAAAQ4"]
[Tue Mar 31 16:14:45.242226 2026] [:error] [pid 36982:tid 36991] [client 20.216.187.161:14316] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "acuCdflMmeoQKN0r_GP_XgAAAMY"]
[Tue Mar 31 16:14:45.827682 2026] [:error] [pid 6548:tid 6571] [client 20.216.187.161:14292] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "acuCdbgIz9HgMl9YwE6cVQAAAVU"]
[Tue Mar 31 16:14:46.313810 2026] [:error] [pid 36982:tid 37008] [client 20.216.187.161:14327] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-conflg.php"] [unique_id "acuCdvlMmeoQKN0r_GP_ZAAAANc"]
[Tue Mar 31 16:14:47.496420 2026] [:error] [pid 6548:tid 6556] [client 20.216.187.161:14314] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "acuCd7gIz9HgMl9YwE6cWAAAAUY"]
[Tue Mar 31 16:14:47.976314 2026] [:error] [pid 6548:tid 6558] [client 20.216.187.161:14208] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "acuCd7gIz9HgMl9YwE6cWgAAAUg"]
[Tue Mar 31 16:14:48.480073 2026] [:error] [pid 36982:tid 37002] [client 20.216.187.161:14296] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "acuCePlMmeoQKN0r_GP_bgAAANE"]
[Tue Mar 31 16:14:49.022873 2026] [:error] [pid 36892:tid 36966] [client 20.216.187.161:14244] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-conflg.php"] [unique_id "acuCeUyj9S4G0ek3O4JMmAAAAI8"]
[Tue Mar 31 16:14:49.604149 2026] [:error] [pid 6548:tid 6567] [client 20.216.187.161:14248] [client 20.216.187.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "acuCebgIz9HgMl9YwE6cXAAAAVE"]
[Tue Mar 31 16:14:50.163045 2026] [:error] [pid 36891:tid 36925] [client 20.216.187.161:14313] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plss3.php"] [unique_id "acuCepJhiMaJUqoqfl6bfAAAAEE"]
[Tue Mar 31 16:14:50.680636 2026] [:error] [pid 36892:tid 36971] [client 20.216.187.161:14254] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plss3.php"] [unique_id "acuCekyj9S4G0ek3O4JMmwAAAJQ"]
[Tue Mar 31 16:14:51.261401 2026] [:error] [pid 36892:tid 36965] [client 20.216.187.161:14287] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plss3.php"] [unique_id "acuCe0yj9S4G0ek3O4JMnwAAAI4"]
[Tue Mar 31 16:14:51.746942 2026] [:error] [pid 36890:tid 36900] [client 20.216.187.161:14263] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plss3.php"] [unique_id "acuCe58FASPd_uH8z7fmNgAAAAU"]
[Tue Mar 31 16:14:52.248746 2026] [:error] [pid 36891:tid 36946] [client 20.216.187.161:14219] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "acuCfJJhiMaJUqoqfl6bfgAAAFY"]
[Tue Mar 31 16:14:52.734481 2026] [:error] [pid 41421:tid 41436] [client 20.216.187.161:14180] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "acuCfBSaDjY9kKFtUQA1-wAAAQw"]
[Tue Mar 31 16:14:53.267323 2026] [:error] [pid 36892:tid 36971] [client 20.216.187.161:14284] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "acuCfUyj9S4G0ek3O4JMpgAAAJQ"]
[Tue Mar 31 16:14:53.777505 2026] [:error] [pid 6548:tid 6562] [client 20.216.187.161:14324] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "acuCfbgIz9HgMl9YwE6cYQAAAUw"]
[Tue Mar 31 16:14:54.337359 2026] [:error] [pid 6548:tid 6573] [client 20.216.187.161:14222] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "acuCfrgIz9HgMl9YwE6cZAAAAVc"]
[Tue Mar 31 16:14:54.810455 2026] [:error] [pid 6548:tid 6558] [client 20.216.187.161:14145] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "acuCfrgIz9HgMl9YwE6cZQAAAUg"]
[Tue Mar 31 16:14:55.352906 2026] [:error] [pid 36982:tid 37006] [client 20.216.187.161:14220] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "acuCf_lMmeoQKN0r_GP_egAAANU"]
[Tue Mar 31 16:14:55.921819 2026] [:error] [pid 36982:tid 36987] [client 20.216.187.161:14280] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "acuCf_lMmeoQKN0r_GP_fQAAAMI"]
[Tue Mar 31 16:14:56.447468 2026] [:error] [pid 36892:tid 36964] [client 20.216.187.161:14169] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "acuCgEyj9S4G0ek3O4JMqQAAAI0"]
[Tue Mar 31 16:14:56.987802 2026] [:error] [pid 36890:tid 36913] [client 20.216.187.161:14149] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "acuCgJ8FASPd_uH8z7fmOQAAABI"]
[Tue Mar 31 16:14:57.688138 2026] [:error] [pid 6548:tid 6563] [client 20.216.187.161:14225] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "acuCgbgIz9HgMl9YwE6ccgAAAU0"]
[Tue Mar 31 16:14:58.176703 2026] [:error] [pid 36892:tid 36960] [client 20.216.187.161:14309] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "acuCgkyj9S4G0ek3O4JMqwAAAIk"]
[Tue Mar 31 16:14:58.698916 2026] [:error] [pid 6548:tid 6550] [client 20.216.187.161:14245] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file15.php"] [unique_id "acuCgrgIz9HgMl9YwE6ccwAAAUA"]
[Tue Mar 31 16:14:59.318205 2026] [:error] [pid 36982:tid 36990] [client 20.216.187.161:14277] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file15.php"] [unique_id "acuCg_lMmeoQKN0r_GP_gAAAAMU"]
[Tue Mar 31 16:14:59.828852 2026] [:error] [pid 41421:tid 41440] [client 20.216.187.161:14325] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file15.php"] [unique_id "acuCgxSaDjY9kKFtUQA2AwAAARA"]
[Tue Mar 31 16:15:00.414863 2026] [:error] [pid 41421:tid 41425] [client 20.216.187.161:14241] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file15.php"] [unique_id "acuChBSaDjY9kKFtUQA2BAAAAQE"]
[Tue Mar 31 16:15:00.965395 2026] [:error] [pid 36982:tid 36994] [client 20.216.187.161:14264] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/031.php"] [unique_id "acuChPlMmeoQKN0r_GP_gQAAAMk"]
[Tue Mar 31 16:15:01.452051 2026] [:error] [pid 36982:tid 36993] [client 20.216.187.161:14293] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/031.php"] [unique_id "acuChflMmeoQKN0r_GP_gwAAAMg"]
[Tue Mar 31 16:15:01.983564 2026] [:error] [pid 36890:tid 36905] [client 20.216.187.161:14214] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/031.php"] [unique_id "acuChZ8FASPd_uH8z7fmOgAAAAo"]
[Tue Mar 31 16:15:02.533974 2026] [:error] [pid 36982:tid 37001] [client 20.216.187.161:14166] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/031.php"] [unique_id "acuChvlMmeoQKN0r_GP_iwAAANA"]
[Tue Mar 31 16:15:03.054748 2026] [:error] [pid 36892:tid 36974] [client 20.216.187.161:14294] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "acuCh0yj9S4G0ek3O4JMsgAAAJc"]
[Tue Mar 31 16:15:03.575124 2026] [:error] [pid 36982:tid 37009] [client 20.216.187.161:14238] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "acuCh_lMmeoQKN0r_GP_kgAAANg"]
[Tue Mar 31 16:15:04.085158 2026] [:error] [pid 36891:tid 36935] [client 20.216.187.161:14231] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "acuCiJJhiMaJUqoqfl6biQAAAEs"]
[Tue Mar 31 16:15:04.587251 2026] [:error] [pid 41421:tid 41428] [client 20.216.187.161:14272] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "acuCiBSaDjY9kKFtUQA2CQAAAQQ"]
[Tue Mar 31 16:15:05.140760 2026] [:error] [pid 36982:tid 36998] [client 20.216.187.161:14148] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "acuCiflMmeoQKN0r_GP_mQAAAM0"]
[Tue Mar 31 16:15:05.650279 2026] [:error] [pid 36982:tid 36988] [client 20.216.187.161:14312] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "acuCiflMmeoQKN0r_GP_nAAAAMM"]
[Tue Mar 31 16:15:06.135925 2026] [:error] [pid 36982:tid 36999] [client 20.216.187.161:14308] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "acuCivlMmeoQKN0r_GP_ngAAAM4"]
[Tue Mar 31 16:15:06.627459 2026] [:error] [pid 36890:tid 36897] [client 20.216.187.161:14333] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "acuCip8FASPd_uH8z7fmQgAAAAI"]
[Tue Mar 31 16:15:07.144765 2026] [:error] [pid 36982:tid 36987] [client 20.216.187.161:14274] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "acuCi_lMmeoQKN0r_GP_ogAAAMI"]
[Tue Mar 31 16:15:07.658975 2026] [:error] [pid 36982:tid 36996] [client 20.216.187.161:14157] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "acuCi_lMmeoQKN0r_GP_pQAAAMs"]
[Tue Mar 31 16:15:08.167454 2026] [:error] [pid 36982:tid 36995] [client 20.216.187.161:14156] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "acuCjPlMmeoQKN0r_GP_pwAAAMo"]
[Tue Mar 31 16:15:08.671868 2026] [:error] [pid 36892:tid 36958] [client 20.216.187.161:14223] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "acuCjEyj9S4G0ek3O4JMtgAAAIc"]
[Tue Mar 31 16:15:09.215002 2026] [:error] [pid 36982:tid 36996] [client 20.216.187.161:14217] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "acuCjflMmeoQKN0r_GP_rAAAAMs"]
[Tue Mar 31 16:15:09.731002 2026] [:error] [pid 36890:tid 36914] [client 20.216.187.161:14283] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "acuCjZ8FASPd_uH8z7fmRQAAABM"]
[Tue Mar 31 16:15:10.208884 2026] [:error] [pid 36982:tid 36989] [client 20.216.187.161:14246] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "acuCjvlMmeoQKN0r_GP_sAAAAMQ"]
[Tue Mar 31 16:15:10.730088 2026] [:error] [pid 36982:tid 37003] [client 20.216.187.161:14236] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "acuCjvlMmeoQKN0r_GP_sgAAANI"]
[Tue Mar 31 16:15:11.235376 2026] [:error] [pid 36891:tid 36924] [client 20.216.187.161:14200] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hly.php"] [unique_id "acuCj5JhiMaJUqoqfl6biwAAAEA"]
[Tue Mar 31 16:15:11.707536 2026] [:error] [pid 36982:tid 36998] [client 20.216.187.161:14237] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hly.php"] [unique_id "acuCj_lMmeoQKN0r_GP_twAAAM0"]
[Tue Mar 31 16:15:12.183136 2026] [:error] [pid 36890:tid 36917] [client 20.216.187.161:14234] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hly.php"] [unique_id "acuCkJ8FASPd_uH8z7fmRwAAABY"]
[Tue Mar 31 16:15:12.695491 2026] [:error] [pid 36890:tid 36915] [client 20.216.187.161:14144] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hly.php"] [unique_id "acuCkJ8FASPd_uH8z7fmSAAAABQ"]
[Tue Mar 31 16:15:13.202987 2026] [:error] [pid 36982:tid 37005] [client 20.216.187.161:14298] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "acuCkflMmeoQKN0r_GP_vAAAANQ"]
[Tue Mar 31 16:15:13.714522 2026] [:error] [pid 36982:tid 37003] [client 20.216.187.161:14199] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "acuCkflMmeoQKN0r_GP_vgAAANI"]
[Tue Mar 31 16:15:14.199852 2026] [:error] [pid 36890:tid 36900] [client 20.216.187.161:14177] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "acuCkp8FASPd_uH8z7fmSwAAAAU"]
[Tue Mar 31 16:15:14.697848 2026] [:error] [pid 36982:tid 37000] [client 20.216.187.161:14253] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "acuCkvlMmeoQKN0r_GP_xQAAAM8"]
[Tue Mar 31 16:15:15.830580 2026] [:error] [pid 41421:tid 41436] [client 20.216.187.161:14247] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "acuCkxSaDjY9kKFtUQA2DgAAAQw"]
[Tue Mar 31 16:15:16.363389 2026] [:error] [pid 36890:tid 36896] [client 20.216.187.161:14216] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "acuClJ8FASPd_uH8z7fmTgAAAAE"]
[Tue Mar 31 16:15:16.856435 2026] [:error] [pid 41421:tid 41426] [client 20.216.187.161:14240] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "acuClBSaDjY9kKFtUQA2EAAAAQI"]
[Tue Mar 31 16:15:17.353795 2026] [:error] [pid 36890:tid 36914] [client 20.216.187.161:14082] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file7.php"] [unique_id "acuClZ8FASPd_uH8z7fmUgAAABM"]
[Tue Mar 31 16:15:17.851387 2026] [:error] [pid 36890:tid 36906] [client 20.216.187.161:14305] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/logain5.php"] [unique_id "acuClZ8FASPd_uH8z7fmVAAAAAs"]
[Tue Mar 31 16:15:18.364841 2026] [:error] [pid 41421:tid 41443] [client 20.216.187.161:14161] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/logain5.php"] [unique_id "acuClhSaDjY9kKFtUQA2EwAAARM"]
[Tue Mar 31 16:15:18.844384 2026] [:error] [pid 36890:tid 36908] [client 20.216.187.161:14151] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/logain5.php"] [unique_id "acuClp8FASPd_uH8z7fmWgAAAA0"]
[Tue Mar 31 16:15:19.340638 2026] [:error] [pid 36982:tid 36991] [client 20.216.187.161:14276] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/logain5.php"] [unique_id "acuCl_lMmeoQKN0r_GP_5gAAAMY"]
[Tue Mar 31 16:15:19.890515 2026] [:error] [pid 41421:tid 41427] [client 20.216.187.161:14207] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "acuClxSaDjY9kKFtUQA2GgAAAQM"]
[Tue Mar 31 16:15:20.404120 2026] [:error] [pid 6548:tid 6573] [client 20.216.187.161:14259] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "acuCmLgIz9HgMl9YwE6chAAAAVc"]
[Tue Mar 31 16:15:20.885849 2026] [:error] [pid 6548:tid 6552] [client 20.216.187.161:14226] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "acuCmLgIz9HgMl9YwE6ciAAAAUI"]
[Tue Mar 31 16:15:21.380413 2026] [:error] [pid 6548:tid 6558] [client 20.216.187.161:14285] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "acuCmbgIz9HgMl9YwE6ciwAAAUg"]
[Tue Mar 31 16:15:21.920025 2026] [:error] [pid 36982:tid 36998] [client 20.216.187.161:14243] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "acuCmflMmeoQKN0r_GMABAAAAM0"]
[Tue Mar 31 16:15:22.407000 2026] [:error] [pid 36982:tid 36995] [client 20.216.187.161:14228] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "acuCmvlMmeoQKN0r_GMAEAAAAMo"]
[Tue Mar 31 16:15:22.909231 2026] [:error] [pid 36982:tid 36998] [client 20.216.187.161:14306] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "acuCmvlMmeoQKN0r_GMAFQAAAM0"]
[Tue Mar 31 16:15:23.472130 2026] [:error] [pid 36890:tid 36915] [client 20.216.187.161:14172] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "acuCm58FASPd_uH8z7fmZAAAABQ"]
[Tue Mar 31 16:15:23.944473 2026] [:error] [pid 36982:tid 37001] [client 20.216.187.161:14235] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "acuCm_lMmeoQKN0r_GMALAAAANA"]
[Tue Mar 31 16:15:24.448941 2026] [:error] [pid 36892:tid 36960] [client 20.216.187.161:14174] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "acuCnEyj9S4G0ek3O4JM8AAAAIk"]
[Tue Mar 31 16:15:24.965840 2026] [:error] [pid 36892:tid 36959] [client 20.216.187.161:14232] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "acuCnEyj9S4G0ek3O4JM8QAAAIg"]
[Tue Mar 31 16:15:34.805507 2026] [:error] [pid 36892:tid 36955] [client 20.216.187.161:14171] [client 20.216.187.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "acuCpkyj9S4G0ek3O4JNEQAAAIQ"]
[Tue Mar 31 16:15:36.595504 2026] [:error] [pid 41421:tid 41429] [client 20.216.187.161:14242] [client 20.216.187.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/chosen.php"] [unique_id "acuCqBSaDjY9kKFtUQA2JgAAAQU"]
[Tue Mar 31 16:15:39.158584 2026] [:error] [pid 36982:tid 36985] [client 20.216.187.161:14087] [client 20.216.187.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "acuCq_lMmeoQKN0r_GMASgAAAMA"]
[Tue Mar 31 16:15:39.698187 2026] [:error] [pid 36982:tid 36988] [client 20.216.187.161:14212] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gfile.php"] [unique_id "acuCq_lMmeoQKN0r_GMATQAAAMM"]
[Tue Mar 31 16:15:40.204073 2026] [:error] [pid 36982:tid 37008] [client 20.216.187.161:14213] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gfile.php"] [unique_id "acuCrPlMmeoQKN0r_GMAUAAAANc"]
[Tue Mar 31 16:15:40.675665 2026] [:error] [pid 41421:tid 41442] [client 20.216.187.161:14104] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gfile.php"] [unique_id "acuCrBSaDjY9kKFtUQA2LQAAARI"]
[Tue Mar 31 16:15:41.261751 2026] [:error] [pid 6548:tid 6556] [client 20.216.187.161:14270] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-freya.php"] [unique_id "acuCrbgIz9HgMl9YwE6c0QAAAUY"]
[Tue Mar 31 16:15:41.790690 2026] [:error] [pid 36890:tid 36919] [client 20.216.187.161:14278] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-freya.php"] [unique_id "acuCrZ8FASPd_uH8z7fmdgAAABg"]
[Tue Mar 31 16:15:42.281731 2026] [:error] [pid 6548:tid 6553] [client 20.216.187.161:14190] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-freya.php"] [unique_id "acuCrrgIz9HgMl9YwE6c0gAAAUM"]
[Tue Mar 31 16:15:42.771312 2026] [:error] [pid 41421:tid 41429] [client 20.216.187.161:14197] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-freya.php"] [unique_id "acuCrhSaDjY9kKFtUQA2LwAAAQU"]
[Tue Mar 31 16:15:43.273159 2026] [:error] [pid 36982:tid 36997] [client 20.216.187.161:14121] [client 20.216.187.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Text/admin.php"] [unique_id "acuCr_lMmeoQKN0r_GMAUwAAAMw"]
[Tue Mar 31 16:15:43.769307 2026] [:error] [pid 36982:tid 36988] [client 20.216.187.161:13446] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "acuCr_lMmeoQKN0r_GMAVwAAAMM"]
[Tue Mar 31 16:15:44.270466 2026] [:error] [pid 6548:tid 6573] [client 20.216.187.161:14147] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "acuCsLgIz9HgMl9YwE6c1gAAAVc"]
[Tue Mar 31 16:15:44.783910 2026] [:error] [pid 41421:tid 41428] [client 20.216.187.161:14188] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "acuCsBSaDjY9kKFtUQA2MgAAAQQ"]
[Tue Mar 31 16:15:45.272798 2026] [:error] [pid 36982:tid 37003] [client 20.216.187.161:14192] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "acuCsflMmeoQKN0r_GMAWQAAANI"]
[Tue Mar 31 16:15:45.791271 2026] [:error] [pid 41421:tid 41435] [client 20.216.187.161:14250] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "acuCsRSaDjY9kKFtUQA2NAAAAQs"]
[Tue Mar 31 16:15:46.358731 2026] [:error] [pid 36890:tid 36898] [client 20.216.187.161:14262] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "acuCsp8FASPd_uH8z7fmfgAAAAM"]
[Tue Mar 31 16:15:46.833671 2026] [:error] [pid 36890:tid 36906] [client 20.216.187.161:14256] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "acuCsp8FASPd_uH8z7fmgAAAAAs"]
[Tue Mar 31 16:15:47.332672 2026] [:error] [pid 36982:tid 37009] [client 20.216.187.161:14203] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "acuCs_lMmeoQKN0r_GMAXQAAANg"]
[Tue Mar 31 16:15:47.839404 2026] [:error] [pid 36890:tid 36917] [client 20.216.187.161:14111] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X7x.php"] [unique_id "acuCs58FASPd_uH8z7fmhwAAABY"]
[Tue Mar 31 16:15:48.328885 2026] [:error] [pid 41421:tid 41445] [client 20.216.187.161:14106] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X7x.php"] [unique_id "acuCtBSaDjY9kKFtUQA2OgAAARU"]
[Tue Mar 31 16:15:48.799526 2026] [:error] [pid 36890:tid 36906] [client 20.216.187.161:14224] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X7x.php"] [unique_id "acuCtJ8FASPd_uH8z7fmiwAAAAs"]
[Tue Mar 31 16:15:49.272218 2026] [:error] [pid 6548:tid 6557] [client 20.216.187.161:14239] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/X7x.php"] [unique_id "acuCtbgIz9HgMl9YwE6c3gAAAUc"]
[Tue Mar 31 16:15:49.786121 2026] [:error] [pid 6548:tid 6553] [client 20.216.187.161:14175] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctex1.php"] [unique_id "acuCtbgIz9HgMl9YwE6c4wAAAUM"]
[Tue Mar 31 16:15:50.369426 2026] [:error] [pid 36892:tid 36956] [client 20.216.187.161:14258] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctex1.php"] [unique_id "acuCtkyj9S4G0ek3O4JNIgAAAIU"]
[Tue Mar 31 16:15:50.843512 2026] [:error] [pid 36891:tid 36934] [client 20.216.187.161:14206] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctex1.php"] [unique_id "acuCtpJhiMaJUqoqfl6btQAAAEo"]
[Tue Mar 31 16:15:51.506102 2026] [:error] [pid 36890:tid 36914] [client 20.216.187.161:14321] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctex1.php"] [unique_id "acuCt58FASPd_uH8z7fmjwAAABM"]
[Tue Mar 31 16:15:52.002490 2026] [:error] [pid 36891:tid 36948] [client 20.216.187.161:14173] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d12.php"] [unique_id "acuCuJJhiMaJUqoqfl6btgAAAFg"]
[Tue Mar 31 16:15:52.493850 2026] [:error] [pid 6548:tid 6567] [client 20.216.187.161:14269] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d12.php"] [unique_id "acuCuLgIz9HgMl9YwE6c5wAAAVE"]
[Tue Mar 31 16:15:52.977757 2026] [:error] [pid 36891:tid 36947] [client 20.216.187.161:14094] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d12.php"] [unique_id "acuCuJJhiMaJUqoqfl6bugAAAFc"]
[Tue Mar 31 16:15:53.508363 2026] [:error] [pid 36891:tid 36936] [client 20.216.187.161:14328] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d12.php"] [unique_id "acuCuZJhiMaJUqoqfl6bvQAAAEw"]
[Tue Mar 31 16:15:54.039120 2026] [:error] [pid 36892:tid 36952] [client 20.216.187.161:14268] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "acuCukyj9S4G0ek3O4JNLwAAAIE"]
[Tue Mar 31 16:15:54.596135 2026] [:error] [pid 36891:tid 36939] [client 20.216.187.161:14273] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "acuCupJhiMaJUqoqfl6bvwAAAE8"]
[Tue Mar 31 16:15:55.133538 2026] [:error] [pid 36890:tid 36907] [client 20.216.187.161:14204] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "acuCu58FASPd_uH8z7fmlwAAAAw"]
[Tue Mar 31 16:15:55.617485 2026] [:error] [pid 6548:tid 6556] [client 20.216.187.161:14163] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "acuCu7gIz9HgMl9YwE6c6wAAAUY"]
[Tue Mar 31 16:15:56.175022 2026] [:error] [pid 41421:tid 41440] [client 20.216.187.161:14297] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "acuCvBSaDjY9kKFtUQA2QAAAARA"]
[Tue Mar 31 16:15:56.682454 2026] [:error] [pid 36892:tid 36968] [client 20.216.187.161:14153] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "acuCvEyj9S4G0ek3O4JNNAAAAJE"]
[Tue Mar 31 16:15:57.191640 2026] [:error] [pid 36892:tid 36951] [client 20.216.187.161:14081] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "acuCvUyj9S4G0ek3O4JNNgAAAIA"]
[Tue Mar 31 16:15:57.688950 2026] [:error] [pid 36890:tid 36913] [client 20.216.187.161:14261] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "acuCvZ8FASPd_uH8z7fmnAAAABI"]
[Tue Mar 31 16:15:58.191272 2026] [:error] [pid 36891:tid 36934] [client 20.216.187.161:14179] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "acuCvpJhiMaJUqoqfl6bwQAAAEo"]
[Tue Mar 31 16:15:58.685528 2026] [:error] [pid 41421:tid 41447] [client 20.216.187.161:14196] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "acuCvhSaDjY9kKFtUQA2QQAAARc"]
[Tue Mar 31 16:15:59.190224 2026] [:error] [pid 41421:tid 41433] [client 20.216.187.161:14164] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "acuCvxSaDjY9kKFtUQA2QwAAAQk"]
[Tue Mar 31 16:16:00.042940 2026] [:error] [pid 6548:tid 6572] [client 20.216.187.161:14251] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "acuCwLgIz9HgMl9YwE6c-wAAAVY"]
[Tue Mar 31 16:16:00.570700 2026] [:error] [pid 36890:tid 36913] [client 20.216.187.161:14140] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thoms.php"] [unique_id "acuCwJ8FASPd_uH8z7fmpAAAABI"]
[Tue Mar 31 16:16:01.153676 2026] [:error] [pid 41421:tid 41444] [client 20.216.187.161:14146] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thoms.php"] [unique_id "acuCwRSaDjY9kKFtUQA2SgAAARQ"]
[Tue Mar 31 16:16:01.666766 2026] [:error] [pid 36890:tid 36908] [client 20.216.187.161:14105] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thoms.php"] [unique_id "acuCwZ8FASPd_uH8z7fmqQAAAA0"]
[Tue Mar 31 16:16:02.184970 2026] [:error] [pid 36982:tid 36988] [client 20.216.187.161:14187] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/thoms.php"] [unique_id "acuCwvlMmeoQKN0r_GMAagAAAMM"]
[Tue Mar 31 16:16:02.673522 2026] [:error] [pid 36982:tid 37000] [client 20.216.187.161:14318] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/O00.php"] [unique_id "acuCwvlMmeoQKN0r_GMAbwAAAM8"]
[Tue Mar 31 16:16:03.148271 2026] [:error] [pid 36982:tid 37008] [client 20.216.187.161:14186] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/O00.php"] [unique_id "acuCw_lMmeoQKN0r_GMAcgAAANc"]
[Tue Mar 31 16:16:03.701472 2026] [:error] [pid 6548:tid 6571] [client 20.216.187.161:14315] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/O00.php"] [unique_id "acuCw7gIz9HgMl9YwE6dAQAAAVU"]
[Tue Mar 31 16:16:04.273465 2026] [:error] [pid 6548:tid 6569] [client 20.216.187.161:13478] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/O00.php"] [unique_id "acuCxLgIz9HgMl9YwE6dAwAAAVM"]
[Tue Mar 31 16:16:04.745887 2026] [:error] [pid 36890:tid 36905] [client 20.216.187.161:14195] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-.php"] [unique_id "acuCxJ8FASPd_uH8z7fmqwAAAAo"]
[Tue Mar 31 16:16:05.269964 2026] [:error] [pid 36891:tid 36925] [client 20.216.187.161:14158] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-.php"] [unique_id "acuCxZJhiMaJUqoqfl6bxQAAAEE"]
[Tue Mar 31 16:16:05.768301 2026] [:error] [pid 36982:tid 37000] [client 20.216.187.161:14183] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-.php"] [unique_id "acuCxflMmeoQKN0r_GMAewAAAM8"]
[Tue Mar 31 16:16:06.275851 2026] [:error] [pid 6548:tid 6562] [client 20.216.187.161:14170] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-.php"] [unique_id "acuCxrgIz9HgMl9YwE6dBQAAAUw"]
[Tue Mar 31 16:16:06.753088 2026] [:error] [pid 36982:tid 36993] [client 20.216.187.161:14181] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "acuCxvlMmeoQKN0r_GMAfwAAAMg"]
[Tue Mar 31 16:16:07.304578 2026] [:error] [pid 36982:tid 36997] [client 20.216.187.161:14185] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "acuCx_lMmeoQKN0r_GMAggAAAMw"]
[Tue Mar 31 16:16:07.827702 2026] [:error] [pid 36982:tid 36991] [client 20.216.187.161:14152] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "acuCx_lMmeoQKN0r_GMAhQAAAMY"]
[Tue Mar 31 16:16:08.341011 2026] [:error] [pid 36982:tid 36993] [client 20.216.187.161:14266] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "acuCyPlMmeoQKN0r_GMAiAAAAMg"]
[Tue Mar 31 16:16:08.863901 2026] [:error] [pid 36982:tid 36997] [client 20.216.187.161:14091] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ee.php"] [unique_id "acuCyPlMmeoQKN0r_GMAjQAAAMw"]
[Tue Mar 31 16:16:09.366160 2026] [:error] [pid 41421:tid 41442] [client 20.216.187.161:14084] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ee.php"] [unique_id "acuCyRSaDjY9kKFtUQA2VQAAARI"]
[Tue Mar 31 16:16:09.844698 2026] [:error] [pid 36982:tid 36985] [client 20.216.187.161:14182] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ee.php"] [unique_id "acuCyflMmeoQKN0r_GMAjwAAAMA"]
[Tue Mar 31 16:16:10.331249 2026] [:error] [pid 36982:tid 36992] [client 20.216.187.161:14162] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ee.php"] [unique_id "acuCyvlMmeoQKN0r_GMAlAAAAMc"]
[Tue Mar 31 16:16:10.819557 2026] [:error] [pid 6548:tid 6571] [client 20.216.187.161:14093] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/epinyins.php"] [unique_id "acuCyrgIz9HgMl9YwE6dCQAAAVU"]
[Tue Mar 31 16:16:11.333008 2026] [:error] [pid 36890:tid 36911] [client 20.216.187.161:14124] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/epinyins.php"] [unique_id "acuCy58FASPd_uH8z7fmuwAAABA"]
[Tue Mar 31 16:16:11.818272 2026] [:error] [pid 41421:tid 41433] [client 20.216.187.161:14198] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/epinyins.php"] [unique_id "acuCyxSaDjY9kKFtUQA2VgAAAQk"]
[Tue Mar 31 16:16:12.300557 2026] [:error] [pid 41421:tid 41434] [client 20.216.187.161:14265] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/epinyins.php"] [unique_id "acuCzBSaDjY9kKFtUQA2WQAAAQo"]
[Tue Mar 31 16:16:12.851526 2026] [:error] [pid 41421:tid 41437] [client 20.216.187.161:14215] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i1.php"] [unique_id "acuCzBSaDjY9kKFtUQA2XQAAAQ0"]
[Tue Mar 31 16:16:13.397497 2026] [:error] [pid 6548:tid 6561] [client 20.216.187.161:14095] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i1.php"] [unique_id "acuCzbgIz9HgMl9YwE6dDQAAAUs"]
[Tue Mar 31 16:16:13.882895 2026] [:error] [pid 41421:tid 41425] [client 20.216.187.161:14097] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i1.php"] [unique_id "acuCzRSaDjY9kKFtUQA2ZQAAAQE"]
[Tue Mar 31 16:16:14.362999 2026] [:error] [pid 6548:tid 6572] [client 20.216.187.161:14202] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i1.php"] [unique_id "acuCzrgIz9HgMl9YwE6dDgAAAVY"]
[Tue Mar 31 16:16:14.880719 2026] [:error] [pid 36982:tid 36996] [client 20.216.187.161:14311] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vv.php"] [unique_id "acuCzvlMmeoQKN0r_GMAmAAAAMs"]
[Tue Mar 31 16:16:15.371985 2026] [:error] [pid 36982:tid 36986] [client 20.216.187.161:14103] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vv.php"] [unique_id "acuCz_lMmeoQKN0r_GMAmwAAAME"]
[Tue Mar 31 16:16:15.843494 2026] [:error] [pid 36982:tid 36995] [client 20.216.187.161:14168] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vv.php"] [unique_id "acuCz_lMmeoQKN0r_GMAnQAAAMo"]
[Tue Mar 31 16:16:16.346409 2026] [:error] [pid 36982:tid 36991] [client 20.216.187.161:14260] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vv.php"] [unique_id "acuC0PlMmeoQKN0r_GMAoQAAAMY"]
[Tue Mar 31 16:16:16.853143 2026] [:error] [pid 6548:tid 6558] [client 20.216.187.161:14117] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oo.php"] [unique_id "acuC0LgIz9HgMl9YwE6dEwAAAUg"]
[Tue Mar 31 16:16:17.335147 2026] [:error] [pid 36982:tid 36993] [client 20.216.187.161:14135] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oo.php"] [unique_id "acuC0flMmeoQKN0r_GMApAAAAMg"]
[Tue Mar 31 16:16:17.829283 2026] [:error] [pid 36891:tid 36924] [client 20.216.187.161:14257] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oo.php"] [unique_id "acuC0ZJhiMaJUqoqfl6bywAAAEA"]
[Tue Mar 31 16:16:18.329077 2026] [:error] [pid 36982:tid 36987] [client 20.216.187.161:14267] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oo.php"] [unique_id "acuC0vlMmeoQKN0r_GMAqAAAAMI"]
[Tue Mar 31 16:16:18.910202 2026] [:error] [pid 41421:tid 41443] [client 20.216.187.161:13444] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sk.php"] [unique_id "acuC0hSaDjY9kKFtUQA2ZwAAARM"]
[Tue Mar 31 16:16:19.408300 2026] [:error] [pid 6548:tid 6571] [client 20.216.187.161:14136] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sk.php"] [unique_id "acuC07gIz9HgMl9YwE6dFgAAAVU"]
[Tue Mar 31 16:16:19.880846 2026] [:error] [pid 6548:tid 6568] [client 20.216.187.161:14107] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sk.php"] [unique_id "acuC07gIz9HgMl9YwE6dFwAAAVI"]
[Tue Mar 31 16:16:20.372986 2026] [:error] [pid 36892:tid 36970] [client 20.216.187.161:14092] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sk.php"] [unique_id "acuC1Eyj9S4G0ek3O4JNawAAAJM"]
[Tue Mar 31 16:16:20.886301 2026] [:error] [pid 36890:tid 36919] [client 20.216.187.161:13483] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "acuC1J8FASPd_uH8z7fm1QAAABg"]
[Tue Mar 31 16:16:21.387990 2026] [:error] [pid 36982:tid 36988] [client 20.216.187.161:14128] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "acuC1flMmeoQKN0r_GMAsAAAAMM"]
[Tue Mar 31 16:16:21.911557 2026] [:error] [pid 6548:tid 6564] [client 20.216.187.161:14167] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "acuC1bgIz9HgMl9YwE6dHQAAAU4"]
[Tue Mar 31 16:16:22.387683 2026] [:error] [pid 36982:tid 36989] [client 20.216.187.161:14159] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "acuC1vlMmeoQKN0r_GMAswAAAMQ"]
[Tue Mar 31 16:16:22.907136 2026] [:error] [pid 36890:tid 36897] [client 20.216.187.161:14194] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "acuC1p8FASPd_uH8z7fm2QAAAAI"]
[Tue Mar 31 16:16:23.465536 2026] [:error] [pid 36890:tid 36912] [client 20.216.187.161:14189] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "acuC158FASPd_uH8z7fm2gAAABE"]
[Tue Mar 31 16:16:23.974917 2026] [:error] [pid 41421:tid 41447] [client 20.216.187.161:14300] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "acuC1xSaDjY9kKFtUQA2bwAAARc"]
[Tue Mar 31 16:16:24.492935 2026] [:error] [pid 36982:tid 36987] [client 20.216.187.161:14116] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "acuC2PlMmeoQKN0r_GMAvQAAAMI"]
[Tue Mar 31 16:16:24.990869 2026] [:error] [pid 36891:tid 36947] [client 20.216.187.161:14080] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "acuC2JJhiMaJUqoqfl6bzwAAAFc"]
[Tue Mar 31 16:16:25.517205 2026] [:error] [pid 41421:tid 41427] [client 20.216.187.161:14230] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "acuC2RSaDjY9kKFtUQA2cwAAAQM"]
[Tue Mar 31 16:16:26.023385 2026] [:error] [pid 36982:tid 36985] [client 20.216.187.161:14141] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "acuC2vlMmeoQKN0r_GMAwQAAAMA"]
[Tue Mar 31 16:16:26.576935 2026] [:error] [pid 41421:tid 41443] [client 20.216.187.161:14113] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "acuC2hSaDjY9kKFtUQA2dQAAARM"]
[Tue Mar 31 16:16:27.057683 2026] [:error] [pid 36982:tid 37000] [client 20.216.187.161:13450] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "acuC2_lMmeoQKN0r_GMAwgAAAM8"]
[Tue Mar 31 16:16:27.616765 2026] [:error] [pid 36892:tid 36952] [client 20.216.187.161:14221] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "acuC20yj9S4G0ek3O4JNcAAAAIE"]
[Tue Mar 31 16:16:28.088480 2026] [:error] [pid 6548:tid 6555] [client 20.216.187.161:13461] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "acuC3LgIz9HgMl9YwE6dLQAAAUU"]
[Tue Mar 31 16:16:28.575325 2026] [:error] [pid 6548:tid 6561] [client 20.216.187.161:13479] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "acuC3LgIz9HgMl9YwE6dMAAAAUs"]
[Tue Mar 31 16:16:29.135867 2026] [:error] [pid 36890:tid 36908] [client 20.216.187.161:14098] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "acuC3Z8FASPd_uH8z7fm4gAAAA0"]
[Tue Mar 31 16:16:29.703203 2026] [:error] [pid 41421:tid 41427] [client 20.216.187.161:13489] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "acuC3RSaDjY9kKFtUQA2fgAAAQM"]
[Tue Mar 31 16:16:30.245063 2026] [:error] [pid 36890:tid 36897] [client 20.216.187.161:14017] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "acuC3p8FASPd_uH8z7fm5QAAAAI"]
[Tue Mar 31 16:16:30.773882 2026] [:error] [pid 41421:tid 41445] [client 20.216.187.161:14193] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "acuC3hSaDjY9kKFtUQA2gAAAARU"]
[Tue Mar 31 16:16:31.252844 2026] [:error] [pid 41421:tid 41433] [client 20.216.187.161:14053] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "acuC3xSaDjY9kKFtUQA2gwAAAQk"]
[Tue Mar 31 16:16:31.820205 2026] [:error] [pid 36890:tid 36916] [client 20.216.187.161:14150] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "acuC358FASPd_uH8z7fm7AAAABU"]
[Tue Mar 31 16:16:32.292845 2026] [:error] [pid 36892:tid 36963] [client 20.216.187.161:14331] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "acuC4Eyj9S4G0ek3O4JNcgAAAIw"]
[Tue Mar 31 16:16:32.790851 2026] [:error] [pid 36891:tid 36926] [client 20.216.187.161:13487] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "acuC4JJhiMaJUqoqfl6b0wAAAEI"]
[Tue Mar 31 16:16:33.276353 2026] [:error] [pid 41421:tid 41444] [client 20.216.187.161:14271] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "acuC4RSaDjY9kKFtUQA2hgAAARQ"]
[Tue Mar 31 16:16:33.779496 2026] [:error] [pid 36982:tid 36987] [client 20.216.187.161:13462] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "acuC4flMmeoQKN0r_GMAywAAAMI"]
[Tue Mar 31 16:16:34.513557 2026] [:error] [pid 36982:tid 36994] [client 20.216.187.161:13471] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "acuC4vlMmeoQKN0r_GMAzQAAAMk"]
[Tue Mar 31 16:16:35.063796 2026] [:error] [pid 41421:tid 41441] [client 20.216.187.161:14088] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "acuC4xSaDjY9kKFtUQA2hwAAARE"]
[Tue Mar 31 16:16:35.563447 2026] [:error] [pid 6548:tid 6568] [client 20.216.187.161:13466] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "acuC47gIz9HgMl9YwE6dNwAAAVI"]
[Tue Mar 31 16:16:36.083759 2026] [:error] [pid 36891:tid 36932] [client 20.216.187.161:14090] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "acuC5JJhiMaJUqoqfl6b2gAAAEg"]
[Tue Mar 31 16:16:36.706732 2026] [:error] [pid 36892:tid 36971] [client 20.216.187.161:13503] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "acuC5Eyj9S4G0ek3O4JNegAAAJQ"]
[Tue Mar 31 16:16:37.239918 2026] [:error] [pid 36891:tid 36928] [client 20.216.187.161:13477] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "acuC5ZJhiMaJUqoqfl6b2wAAAEQ"]
[Tue Mar 31 16:16:37.840739 2026] [:error] [pid 6548:tid 6566] [client 20.216.187.161:14176] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "acuC5bgIz9HgMl9YwE6dPQAAAVA"]
[Tue Mar 31 16:16:51.689608 2026] [:error] [pid 6548:tid 6570] [client 20.216.187.161:14282] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yanz.php"] [unique_id "acuC87gIz9HgMl9YwE6dZQAAAVQ"]
[Tue Mar 31 16:16:52.214835 2026] [:error] [pid 41421:tid 41424] [client 20.216.187.161:14137] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yanz.php"] [unique_id "acuC9BSaDjY9kKFtUQA23AAAAQA"]
[Tue Mar 31 16:16:52.732507 2026] [:error] [pid 41421:tid 41441] [client 20.216.187.161:14089] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yanz.php"] [unique_id "acuC9BSaDjY9kKFtUQA23gAAARE"]
[Tue Mar 31 16:16:53.261408 2026] [:error] [pid 36891:tid 36924] [client 20.216.187.161:13455] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yanz.php"] [unique_id "acuC9ZJhiMaJUqoqfl6b8AAAAEA"]
[Tue Mar 31 16:16:53.741527 2026] [:error] [pid 6548:tid 6573] [client 20.216.187.161:14083] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "acuC9bgIz9HgMl9YwE6dZwAAAVc"]
[Tue Mar 31 16:16:54.211178 2026] [:error] [pid 36892:tid 36955] [client 20.216.187.161:14191] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "acuC9kyj9S4G0ek3O4JNiwAAAIQ"]
[Tue Mar 31 16:16:54.723962 2026] [:error] [pid 36892:tid 36954] [client 20.216.187.161:14100] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "acuC9kyj9S4G0ek3O4JNjAAAAIM"]
[Tue Mar 31 16:16:55.199402 2026] [:error] [pid 36982:tid 36988] [client 20.216.187.161:13473] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "acuC9_lMmeoQKN0r_GMBDQAAAMM"]
[Tue Mar 31 16:16:55.798011 2026] [:error] [pid 36982:tid 36985] [client 20.216.187.161:14118] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "acuC9_lMmeoQKN0r_GMBEgAAAMA"]
[Tue Mar 31 16:16:56.300612 2026] [:error] [pid 36982:tid 36990] [client 20.216.187.161:14110] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "acuC-PlMmeoQKN0r_GMBGAAAAMU"]
[Tue Mar 31 16:16:56.782686 2026] [:error] [pid 6548:tid 6570] [client 20.216.187.161:14249] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "acuC-LgIz9HgMl9YwE6dcQAAAVQ"]
[Tue Mar 31 16:16:57.255294 2026] [:error] [pid 36982:tid 36993] [client 20.216.187.161:14120] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "acuC-flMmeoQKN0r_GMBIQAAAMg"]
[Tue Mar 31 16:16:57.804259 2026] [:error] [pid 6548:tid 6564] [client 20.216.187.161:14112] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ut.php"] [unique_id "acuC-bgIz9HgMl9YwE6ddAAAAU4"]
[Tue Mar 31 16:16:58.302136 2026] [:error] [pid 36982:tid 36991] [client 20.216.187.161:13447] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ut.php"] [unique_id "acuC-vlMmeoQKN0r_GMBJwAAAMY"]
[Tue Mar 31 16:16:58.805655 2026] [:error] [pid 36982:tid 37004] [client 20.216.187.161:14233] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ut.php"] [unique_id "acuC-vlMmeoQKN0r_GMBKgAAANM"]
[Tue Mar 31 16:16:59.280975 2026] [:error] [pid 6548:tid 6568] [client 20.216.187.161:14134] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ut.php"] [unique_id "acuC-7gIz9HgMl9YwE6ddgAAAVI"]
[Tue Mar 31 16:16:59.765362 2026] [:error] [pid 41421:tid 41438] [client 20.216.187.161:13442] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wfile.php"] [unique_id "acuC-xSaDjY9kKFtUQA26wAAAQ4"]
[Tue Mar 31 16:17:00.293177 2026] [:error] [pid 36890:tid 36913] [client 20.216.187.161:14133] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wfile.php"] [unique_id "acuC_J8FASPd_uH8z7fnKAAAABI"]
[Tue Mar 31 16:17:00.792781 2026] [:error] [pid 36890:tid 36917] [client 20.216.187.161:14155] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wfile.php"] [unique_id "acuC_J8FASPd_uH8z7fnKwAAABY"]
[Tue Mar 31 16:17:01.267542 2026] [:error] [pid 36890:tid 36906] [client 20.216.187.161:14102] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wfile.php"] [unique_id "acuC_Z8FASPd_uH8z7fnLgAAAAs"]
[Tue Mar 31 16:17:01.761971 2026] [:error] [pid 41421:tid 41433] [client 20.216.187.161:14039] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "acuC_RSaDjY9kKFtUQA27gAAAQk"]
[Tue Mar 31 16:17:02.236961 2026] [:error] [pid 36892:tid 36962] [client 20.216.187.161:13460] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "acuC_kyj9S4G0ek3O4JNlwAAAIs"]
[Tue Mar 31 16:17:02.734951 2026] [:error] [pid 6548:tid 6561] [client 20.216.187.161:14085] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "acuC_rgIz9HgMl9YwE6dewAAAUs"]
[Tue Mar 31 16:17:03.223646 2026] [:error] [pid 41421:tid 41448] [client 20.216.187.161:14119] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "acuC_xSaDjY9kKFtUQA28AAAARg"]
[Tue Mar 31 16:17:03.735634 2026] [:error] [pid 36891:tid 36930] [client 20.216.187.161:14132] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admir.php"] [unique_id "acuC_5JhiMaJUqoqfl6b9QAAAEY"]
[Tue Mar 31 16:17:04.296500 2026] [:error] [pid 41421:tid 41432] [client 20.216.187.161:14115] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admir.php"] [unique_id "acuDABSaDjY9kKFtUQA28gAAAQg"]
[Tue Mar 31 16:17:04.834297 2026] [:error] [pid 6548:tid 6555] [client 20.216.187.161:14160] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admir.php"] [unique_id "acuDALgIz9HgMl9YwE6dhQAAAUU"]
[Tue Mar 31 16:17:05.319415 2026] [:error] [pid 36890:tid 36906] [client 20.216.187.161:13501] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admir.php"] [unique_id "acuDAZ8FASPd_uH8z7fnPQAAAAs"]
[Tue Mar 31 16:17:05.873811 2026] [:error] [pid 41421:tid 41427] [client 20.216.187.161:13484] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zde.php"] [unique_id "acuDARSaDjY9kKFtUQA29wAAAQM"]
[Tue Mar 31 16:17:06.432188 2026] [:error] [pid 6548:tid 6557] [client 20.216.187.161:14041] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zde.php"] [unique_id "acuDArgIz9HgMl9YwE6djAAAAUc"]
[Tue Mar 31 16:17:06.981368 2026] [:error] [pid 36892:tid 36961] [client 20.216.187.161:14109] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zde.php"] [unique_id "acuDAkyj9S4G0ek3O4JNnAAAAIo"]
[Tue Mar 31 16:17:07.465170 2026] [:error] [pid 36982:tid 37002] [client 20.216.187.161:13456] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zde.php"] [unique_id "acuDA_lMmeoQKN0r_GMBOQAAANE"]
[Tue Mar 31 16:17:08.002341 2026] [:error] [pid 36892:tid 36958] [client 20.216.187.161:13453] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpo.php"] [unique_id "acuDBEyj9S4G0ek3O4JNoAAAAIc"]
[Tue Mar 31 16:17:08.475617 2026] [:error] [pid 41421:tid 41425] [client 20.216.187.161:13488] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpo.php"] [unique_id "acuDBBSaDjY9kKFtUQA2_AAAAQE"]
[Tue Mar 31 16:17:08.947332 2026] [:error] [pid 41421:tid 41440] [client 20.216.187.161:13486] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpo.php"] [unique_id "acuDBBSaDjY9kKFtUQA3AgAAARA"]
[Tue Mar 31 16:17:09.519425 2026] [:error] [pid 36891:tid 36938] [client 20.216.187.161:14025] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpo.php"] [unique_id "acuDBZJhiMaJUqoqfl6b-QAAAE4"]
[Tue Mar 31 16:17:10.181044 2026] [:error] [pid 36892:tid 36973] [client 20.216.187.161:13474] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aj.php"] [unique_id "acuDBkyj9S4G0ek3O4JNqgAAAJY"]
[Tue Mar 31 16:17:10.733122 2026] [:error] [pid 36892:tid 36960] [client 20.216.187.161:14086] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aj.php"] [unique_id "acuDBkyj9S4G0ek3O4JNrAAAAIk"]
[Tue Mar 31 16:17:11.242193 2026] [:error] [pid 6548:tid 6573] [client 20.216.187.161:14184] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aj.php"] [unique_id "acuDB7gIz9HgMl9YwE6dlQAAAVc"]
[Tue Mar 31 16:17:11.722744 2026] [:error] [pid 36891:tid 36926] [client 20.216.187.161:14114] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aj.php"] [unique_id "acuDB5JhiMaJUqoqfl6b_gAAAEI"]
[Tue Mar 31 16:17:12.240913 2026] [:error] [pid 41421:tid 41444] [client 20.216.187.161:14016] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/opts.php"] [unique_id "acuDCBSaDjY9kKFtUQA3CgAAARQ"]
[Tue Mar 31 16:17:12.770461 2026] [:error] [pid 36890:tid 36903] [client 20.216.187.161:14126] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/opts.php"] [unique_id "acuDCJ8FASPd_uH8z7fnTAAAAAg"]
[Tue Mar 31 16:17:13.308565 2026] [:error] [pid 36982:tid 37008] [client 20.216.187.161:14205] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/opts.php"] [unique_id "acuDCflMmeoQKN0r_GMBPgAAANc"]
[Tue Mar 31 16:17:13.805589 2026] [:error] [pid 36982:tid 37007] [client 20.216.187.161:14255] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/opts.php"] [unique_id "acuDCflMmeoQKN0r_GMBRAAAANY"]
[Tue Mar 31 16:17:14.287692 2026] [:error] [pid 36982:tid 36986] [client 20.216.187.161:14048] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filer.php"] [unique_id "acuDCvlMmeoQKN0r_GMBRwAAAME"]
[Tue Mar 31 16:17:14.817154 2026] [:error] [pid 36892:tid 36951] [client 20.216.187.161:13449] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filer.php"] [unique_id "acuDCkyj9S4G0ek3O4JNsAAAAIA"]
[Tue Mar 31 16:17:15.455312 2026] [:error] [pid 41421:tid 41425] [client 20.216.187.161:14068] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filer.php"] [unique_id "acuDCxSaDjY9kKFtUQA3DQAAAQE"]
[Tue Mar 31 16:17:16.029202 2026] [:error] [pid 41421:tid 41434] [client 20.216.187.161:13451] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/filer.php"] [unique_id "acuDDBSaDjY9kKFtUQA3DgAAAQo"]
[Tue Mar 31 16:17:16.565195 2026] [:error] [pid 6548:tid 6572] [client 20.216.187.161:14131] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gorila.php"] [unique_id "acuDDLgIz9HgMl9YwE6dmAAAAVY"]
[Tue Mar 31 16:17:17.082471 2026] [:error] [pid 36982:tid 36997] [client 20.216.187.161:14031] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gorila.php"] [unique_id "acuDDflMmeoQKN0r_GMBUgAAAMw"]
[Tue Mar 31 16:17:17.688448 2026] [:error] [pid 36982:tid 36997] [client 20.216.187.161:13381] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gorila.php"] [unique_id "acuDDflMmeoQKN0r_GMBYAAAAMw"]
[Tue Mar 31 16:17:18.168335 2026] [:error] [pid 41421:tid 41424] [client 20.216.187.161:14035] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gorila.php"] [unique_id "acuDDhSaDjY9kKFtUQA3EgAAAQA"]
[Tue Mar 31 16:17:18.689580 2026] [:error] [pid 36982:tid 37003] [client 20.216.187.161:14108] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "acuDDvlMmeoQKN0r_GMBagAAANI"]
[Tue Mar 31 16:17:19.192386 2026] [:error] [pid 36891:tid 36945] [client 20.216.187.161:14101] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "acuDD5JhiMaJUqoqfl6cDgAAAFU"]
[Tue Mar 31 16:17:19.664408 2026] [:error] [pid 36890:tid 36914] [client 20.216.187.161:14178] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "acuDD58FASPd_uH8z7fnUAAAABM"]
[Tue Mar 31 16:17:20.145529 2026] [:error] [pid 36890:tid 36905] [client 20.216.187.161:14032] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/index.php"] [unique_id "acuDEJ8FASPd_uH8z7fnUgAAAAo"]
[Tue Mar 31 16:17:20.672672 2026] [:error] [pid 36890:tid 36907] [client 20.216.187.161:13452] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.php"] [unique_id "acuDEJ8FASPd_uH8z7fnVgAAAAw"]
[Tue Mar 31 16:17:21.178591 2026] [:error] [pid 36890:tid 36906] [client 20.216.187.161:13459] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.php"] [unique_id "acuDEZ8FASPd_uH8z7fnWgAAAAs"]
[Tue Mar 31 16:17:21.692099 2026] [:error] [pid 41421:tid 41441] [client 20.216.187.161:14142] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.php"] [unique_id "acuDERSaDjY9kKFtUQA3GAAAARE"]
[Tue Mar 31 16:17:22.196987 2026] [:error] [pid 6548:tid 6564] [client 20.216.187.161:14252] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/main.php"] [unique_id "acuDErgIz9HgMl9YwE6dnAAAAU4"]
[Tue Mar 31 16:17:22.697339 2026] [:error] [pid 36982:tid 37000] [client 20.216.187.161:13476] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins.php"] [unique_id "acuDEvlMmeoQKN0r_GMBbQAAAM8"]
[Tue Mar 31 16:17:23.173696 2026] [:error] [pid 41421:tid 41431] [client 20.216.187.161:14045] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins.php"] [unique_id "acuDExSaDjY9kKFtUQA3HwAAAQc"]
[Tue Mar 31 16:17:23.645719 2026] [:error] [pid 36982:tid 37004] [client 20.216.187.161:13454] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins.php"] [unique_id "acuDE_lMmeoQKN0r_GMBcQAAANM"]
[Tue Mar 31 16:17:24.180287 2026] [:error] [pid 6548:tid 6563] [client 20.216.187.161:13498] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins.php"] [unique_id "acuDFLgIz9HgMl9YwE6dnwAAAU0"]
[Tue Mar 31 16:17:24.658100 2026] [:error] [pid 6548:tid 6566] [client 20.216.187.161:13493] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f.php"] [unique_id "acuDFLgIz9HgMl9YwE6dogAAAVA"]
[Tue Mar 31 16:17:25.228363 2026] [:error] [pid 41421:tid 41433] [client 20.216.187.161:13463] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f.php"] [unique_id "acuDFRSaDjY9kKFtUQA3JgAAAQk"]
[Tue Mar 31 16:17:25.853723 2026] [:error] [pid 6548:tid 6565] [client 20.216.187.161:14028] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f.php"] [unique_id "acuDFbgIz9HgMl9YwE6dpAAAAU8"]
[Tue Mar 31 16:17:26.326291 2026] [:error] [pid 6548:tid 6568] [client 20.216.187.161:13377] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f.php"] [unique_id "acuDFrgIz9HgMl9YwE6dpQAAAVI"]
[Tue Mar 31 16:17:26.807024 2026] [:error] [pid 6548:tid 6560] [client 20.216.187.161:14022] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer.php"] [unique_id "acuDFrgIz9HgMl9YwE6dpwAAAUo"]
[Tue Mar 31 16:17:27.351958 2026] [:error] [pid 41421:tid 41430] [client 20.216.187.161:13490] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer.php"] [unique_id "acuDFxSaDjY9kKFtUQA3KgAAAQY"]
[Tue Mar 31 16:17:28.014152 2026] [:error] [pid 36890:tid 36897] [client 20.216.187.161:14165] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer.php"] [unique_id "acuDGJ8FASPd_uH8z7fnZQAAAAI"]
[Tue Mar 31 16:17:28.508709 2026] [:error] [pid 36891:tid 36937] [client 20.216.187.161:13448] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer.php"] [unique_id "acuDGJJhiMaJUqoqfl6cGAAAAE0"]
[Tue Mar 31 16:17:29.026822 2026] [:error] [pid 6548:tid 6564] [client 20.216.187.161:14139] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "acuDGbgIz9HgMl9YwE6dqwAAAU4"]
[Tue Mar 31 16:17:29.575607 2026] [:error] [pid 6548:tid 6550] [client 20.216.187.161:13378] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "acuDGbgIz9HgMl9YwE6drQAAAUA"]
[Tue Mar 31 16:17:30.057637 2026] [:error] [pid 6548:tid 6551] [client 20.216.187.161:14122] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "acuDGrgIz9HgMl9YwE6dsAAAAUE"]
[Tue Mar 31 16:17:30.719022 2026] [:error] [pid 6548:tid 6568] [client 20.216.187.161:13467] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/maint.php"] [unique_id "acuDGrgIz9HgMl9YwE6dtAAAAVI"]
[Tue Mar 31 16:17:31.222721 2026] [:error] [pid 6548:tid 6554] [client 20.216.187.161:14026] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "acuDG7gIz9HgMl9YwE6duAAAAUQ"]
[Tue Mar 31 16:17:31.713131 2026] [:error] [pid 6548:tid 6571] [client 20.216.187.161:14295] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "acuDG7gIz9HgMl9YwE6duwAAAVU"]
[Tue Mar 31 16:17:32.202025 2026] [:error] [pid 6548:tid 6563] [client 20.216.187.161:13464] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "acuDHLgIz9HgMl9YwE6dvwAAAU0"]
[Tue Mar 31 16:17:32.709604 2026] [:error] [pid 36892:tid 36959] [client 20.216.187.161:14143] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "acuDHEyj9S4G0ek3O4JNuwAAAIg"]
[Tue Mar 31 16:17:33.261534 2026] [:error] [pid 6548:tid 6554] [client 20.216.187.161:13977] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "acuDHbgIz9HgMl9YwE6dxAAAAUQ"]
[Tue Mar 31 16:17:33.766102 2026] [:error] [pid 6548:tid 6552] [client 20.216.187.161:14078] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "acuDHbgIz9HgMl9YwE6dxwAAAUI"]
[Tue Mar 31 16:17:34.465649 2026] [:error] [pid 6548:tid 6562] [client 20.216.187.161:14201] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "acuDHrgIz9HgMl9YwE6dyAAAAUw"]
[Tue Mar 31 16:17:34.979586 2026] [:error] [pid 6548:tid 6569] [client 20.216.187.161:14040] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "acuDHrgIz9HgMl9YwE6dygAAAVM"]
[Tue Mar 31 16:17:35.701529 2026] [:error] [pid 36891:tid 36945] [client 20.216.187.161:14096] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-gr.php"] [unique_id "acuDH5JhiMaJUqoqfl6cHwAAAFU"]
[Tue Mar 31 16:17:36.177188 2026] [:error] [pid 36890:tid 36913] [client 20.216.187.161:14044] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-gr.php"] [unique_id "acuDIJ8FASPd_uH8z7fnbQAAABI"]
[Tue Mar 31 16:17:36.648764 2026] [:error] [pid 36892:tid 36970] [client 20.216.187.161:13395] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-gr.php"] [unique_id "acuDIEyj9S4G0ek3O4JNwwAAAJM"]
[Tue Mar 31 16:17:37.129562 2026] [:error] [pid 6548:tid 6562] [client 20.216.187.161:13499] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-gr.php"] [unique_id "acuDIbgIz9HgMl9YwE6d0QAAAUw"]
[Tue Mar 31 16:17:37.604533 2026] [:error] [pid 36982:tid 37000] [client 20.216.187.161:14018] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aaa.php"] [unique_id "acuDIflMmeoQKN0r_GMBewAAAM8"]
[Tue Mar 31 16:17:38.127294 2026] [:error] [pid 41421:tid 41442] [client 20.216.187.161:13445] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aaa.php"] [unique_id "acuDIhSaDjY9kKFtUQA3MAAAARI"]
[Tue Mar 31 16:17:38.605715 2026] [:error] [pid 41421:tid 41425] [client 20.216.187.161:13391] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aaa.php"] [unique_id "acuDIhSaDjY9kKFtUQA3MgAAAQE"]
[Tue Mar 31 16:17:39.088644 2026] [:error] [pid 6548:tid 6561] [client 20.216.187.161:14052] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aaa.php"] [unique_id "acuDI7gIz9HgMl9YwE6d2AAAAUs"]
[Tue Mar 31 16:17:39.575288 2026] [:error] [pid 6548:tid 6560] [client 20.216.187.161:14099] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mt.php"] [unique_id "acuDI7gIz9HgMl9YwE6d3AAAAUo"]
[Tue Mar 31 16:17:40.049954 2026] [:error] [pid 6548:tid 6567] [client 20.216.187.161:14021] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mt.php"] [unique_id "acuDJLgIz9HgMl9YwE6d4AAAAVE"]
[Tue Mar 31 16:17:40.725112 2026] [:error] [pid 36892:tid 36961] [client 20.216.187.161:13482] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mt.php"] [unique_id "acuDJEyj9S4G0ek3O4JNyQAAAIo"]
[Tue Mar 31 16:17:41.216147 2026] [:error] [pid 36892:tid 36975] [client 20.216.187.161:13500] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mt.php"] [unique_id "acuDJUyj9S4G0ek3O4JNzAAAAJg"]
[Tue Mar 31 16:17:41.754033 2026] [:error] [pid 36982:tid 36986] [client 20.216.187.161:13440] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shout.php"] [unique_id "acuDJflMmeoQKN0r_GMBfwAAAME"]
[Tue Mar 31 16:17:42.248964 2026] [:error] [pid 6548:tid 6551] [client 20.216.187.161:13443] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shout.php"] [unique_id "acuDJrgIz9HgMl9YwE6eDwAAAUE"]
[Tue Mar 31 16:17:42.735100 2026] [:error] [pid 36982:tid 37006] [client 20.216.187.161:14047] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shout.php"] [unique_id "acuDJvlMmeoQKN0r_GMBhQAAANU"]
[Tue Mar 31 16:17:43.246495 2026] [:error] [pid 36982:tid 37002] [client 20.216.187.161:14129] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shout.php"] [unique_id "acuDJ_lMmeoQKN0r_GMBiQAAANE"]
[Tue Mar 31 16:17:43.729254 2026] [:error] [pid 36890:tid 36900] [client 20.216.187.161:14123] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zews.php"] [unique_id "acuDJ58FASPd_uH8z7fndgAAAAU"]
[Tue Mar 31 16:17:44.231580 2026] [:error] [pid 36890:tid 36906] [client 20.216.187.161:13472] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zews.php"] [unique_id "acuDKJ8FASPd_uH8z7fnegAAAAs"]
[Tue Mar 31 16:17:44.895902 2026] [:error] [pid 6548:tid 6563] [client 20.216.187.161:14063] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zews.php"] [unique_id "acuDKLgIz9HgMl9YwE6eEAAAAU0"]
[Tue Mar 31 16:17:45.544777 2026] [:error] [pid 41421:tid 41435] [client 20.216.187.161:14154] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zews.php"] [unique_id "acuDKRSaDjY9kKFtUQA3ZQAAAQs"]
[Tue Mar 31 16:17:46.034674 2026] [:error] [pid 41421:tid 41438] [client 20.216.187.161:14055] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "acuDKhSaDjY9kKFtUQA3ZwAAAQ4"]
[Tue Mar 31 16:17:46.552398 2026] [:error] [pid 41421:tid 41442] [client 20.216.187.161:14130] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "acuDKhSaDjY9kKFtUQA3awAAARI"]
[Tue Mar 31 16:17:47.033656 2026] [:error] [pid 36891:tid 36940] [client 20.216.187.161:13492] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "acuDK5JhiMaJUqoqfl6cJgAAAFA"]
[Tue Mar 31 16:17:47.523430 2026] [:error] [pid 6548:tid 6558] [client 20.216.187.161:14019] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "acuDK7gIz9HgMl9YwE6eFgAAAUg"]
[Tue Mar 31 16:17:47.997818 2026] [:error] [pid 41421:tid 41435] [client 20.216.187.161:14076] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "acuDKxSaDjY9kKFtUQA3bQAAAQs"]
[Tue Mar 31 16:17:48.472698 2026] [:error] [pid 36982:tid 36985] [client 20.216.187.161:14069] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "acuDLPlMmeoQKN0r_GMBlQAAAMA"]
[Tue Mar 31 16:17:48.962015 2026] [:error] [pid 6548:tid 6570] [client 20.216.187.161:14289] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "acuDLLgIz9HgMl9YwE6eGAAAAVQ"]
[Tue Mar 31 16:17:49.495701 2026] [:error] [pid 36891:tid 36946] [client 20.216.187.161:14060] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "acuDLZJhiMaJUqoqfl6cKgAAAFY"]
[Tue Mar 31 16:18:02.354879 2026] [:error] [pid 36982:tid 36999] [client 20.216.187.161:14038] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acuDOvlMmeoQKN0r_GMBywAAAM4"]
[Tue Mar 31 16:18:02.830343 2026] [:error] [pid 36982:tid 36990] [client 20.216.187.161:14127] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acuDOvlMmeoQKN0r_GMBzAAAAMU"]
[Tue Mar 31 16:18:03.310137 2026] [:error] [pid 36892:tid 36951] [client 20.216.187.161:14056] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acuDO0yj9S4G0ek3O4JN2gAAAIA"]
[Tue Mar 31 16:18:03.794281 2026] [:error] [pid 41421:tid 41447] [client 20.216.187.161:13491] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acuDOxSaDjY9kKFtUQA3fwAAARc"]
[Tue Mar 31 16:18:04.271880 2026] [:error] [pid 6548:tid 6558] [client 20.216.187.161:13497] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsvvs.php"] [unique_id "acuDPLgIz9HgMl9YwE6eMAAAAUg"]
[Tue Mar 31 16:18:04.747284 2026] [:error] [pid 36982:tid 36995] [client 20.216.187.161:13390] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsvvs.php"] [unique_id "acuDPPlMmeoQKN0r_GMB0AAAAMo"]
[Tue Mar 31 16:18:05.229923 2026] [:error] [pid 41421:tid 41430] [client 20.216.187.161:13466] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsvvs.php"] [unique_id "acuDPRSaDjY9kKFtUQA3ggAAAQY"]
[Tue Mar 31 16:18:05.729318 2026] [:error] [pid 36891:tid 36927] [client 20.216.187.161:13481] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsvvs.php"] [unique_id "acuDPZJhiMaJUqoqfl6cOAAAAEM"]
[Tue Mar 31 16:18:06.213057 2026] [:error] [pid 6548:tid 6566] [client 20.216.187.161:13380] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vbbn.php"] [unique_id "acuDPrgIz9HgMl9YwE6eMwAAAVA"]
[Tue Mar 31 16:18:06.706821 2026] [:error] [pid 41421:tid 41429] [client 20.216.187.161:14065] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vbbn.php"] [unique_id "acuDPhSaDjY9kKFtUQA3hwAAAQU"]
[Tue Mar 31 16:18:07.182084 2026] [:error] [pid 36982:tid 36996] [client 20.216.187.161:13496] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vbbn.php"] [unique_id "acuDP_lMmeoQKN0r_GMB2gAAAMs"]
[Tue Mar 31 16:18:07.670964 2026] [:error] [pid 36890:tid 36906] [client 20.216.187.161:14029] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vbbn.php"] [unique_id "acuDP58FASPd_uH8z7fnnQAAAAs"]
[Tue Mar 31 16:18:08.160802 2026] [:error] [pid 36892:tid 36966] [client 20.216.187.161:13400] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shoyo.php"] [unique_id "acuDQEyj9S4G0ek3O4JN3wAAAI8"]
[Tue Mar 31 16:18:08.636838 2026] [:error] [pid 36982:tid 36986] [client 20.216.187.161:13441] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shoyo.php"] [unique_id "acuDQPlMmeoQKN0r_GMB3QAAAME"]
[Tue Mar 31 16:18:09.115611 2026] [:error] [pid 36890:tid 36912] [client 20.216.187.161:13465] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shoyo.php"] [unique_id "acuDQZ8FASPd_uH8z7fnoAAAABE"]
[Tue Mar 31 16:18:09.592552 2026] [:error] [pid 36982:tid 36985] [client 20.216.187.161:13485] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shoyo.php"] [unique_id "acuDQflMmeoQKN0r_GMB5QAAAMA"]
[Tue Mar 31 16:18:10.267686 2026] [:error] [pid 36982:tid 37007] [client 20.216.187.161:14064] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "acuDQvlMmeoQKN0r_GMB7AAAANY"]
[Tue Mar 31 16:18:10.760069 2026] [:error] [pid 36892:tid 36953] [client 20.216.187.161:13458] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "acuDQkyj9S4G0ek3O4JN6QAAAII"]
[Tue Mar 31 16:18:11.242054 2026] [:error] [pid 36982:tid 36992] [client 20.216.187.161:14034] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "acuDQ_lMmeoQKN0r_GMB-QAAAMc"]
[Tue Mar 31 16:18:11.815500 2026] [:error] [pid 6548:tid 6552] [client 20.216.187.161:14059] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "acuDQ7gIz9HgMl9YwE6eOwAAAUI"]
[Tue Mar 31 16:18:12.329571 2026] [:error] [pid 36982:tid 37004] [client 20.216.187.161:13393] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/waq.php"] [unique_id "acuDRPlMmeoQKN0r_GMCBwAAANM"]
[Tue Mar 31 16:18:12.811800 2026] [:error] [pid 36982:tid 36997] [client 20.216.187.161:13966] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/waq.php"] [unique_id "acuDRPlMmeoQKN0r_GMCDAAAAMw"]
[Tue Mar 31 16:18:13.476317 2026] [:error] [pid 6548:tid 6559] [client 20.216.187.161:13981] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/waq.php"] [unique_id "acuDRbgIz9HgMl9YwE6eQQAAAUk"]
[Tue Mar 31 16:18:14.136386 2026] [:error] [pid 6548:tid 6565] [client 20.216.187.161:14146] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/waq.php"] [unique_id "acuDRrgIz9HgMl9YwE6eRAAAAU8"]
[Tue Mar 31 16:18:14.800341 2026] [:error] [pid 41421:tid 41426] [client 20.216.187.161:13494] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wakak.php"] [unique_id "acuDRhSaDjY9kKFtUQA3nAAAAQI"]
[Tue Mar 31 16:18:15.280220 2026] [:error] [pid 36891:tid 36934] [client 20.216.187.161:14036] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wakak.php"] [unique_id "acuDR5JhiMaJUqoqfl6cOwAAAEo"]
[Tue Mar 31 16:18:15.781648 2026] [:error] [pid 36892:tid 36966] [client 20.216.187.161:13392] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wakak.php"] [unique_id "acuDR0yj9S4G0ek3O4JN7QAAAI8"]
[Tue Mar 31 16:18:16.255348 2026] [:error] [pid 36890:tid 36903] [client 20.216.187.161:14058] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wakak.php"] [unique_id "acuDSJ8FASPd_uH8z7fnqgAAAAg"]
[Tue Mar 31 16:18:16.736210 2026] [:error] [pid 36890:tid 36899] [client 20.216.187.161:13389] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bipas.php"] [unique_id "acuDSJ8FASPd_uH8z7fnrAAAAAQ"]
[Tue Mar 31 16:18:17.217294 2026] [:error] [pid 36982:tid 36994] [client 20.216.187.161:13426] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bipas.php"] [unique_id "acuDSflMmeoQKN0r_GMCJAAAAMk"]
[Tue Mar 31 16:18:17.713539 2026] [:error] [pid 41421:tid 41436] [client 20.216.187.161:13431] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bipas.php"] [unique_id "acuDSRSaDjY9kKFtUQA3pAAAAQw"]
[Tue Mar 31 16:18:18.208014 2026] [:error] [pid 6548:tid 6560] [client 20.216.187.161:14020] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bipas.php"] [unique_id "acuDSrgIz9HgMl9YwE6eUQAAAUo"]
[Tue Mar 31 16:18:18.871918 2026] [:error] [pid 36982:tid 37001] [client 20.216.187.161:14042] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conte.php"] [unique_id "acuDSvlMmeoQKN0r_GMCJgAAANA"]
[Tue Mar 31 16:18:19.369779 2026] [:error] [pid 36982:tid 36999] [client 20.216.187.161:13414] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conte.php"] [unique_id "acuDS_lMmeoQKN0r_GMCKQAAAM4"]
[Tue Mar 31 16:18:19.854579 2026] [:error] [pid 36982:tid 36985] [client 20.216.187.161:13964] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conte.php"] [unique_id "acuDS_lMmeoQKN0r_GMCKwAAAMA"]
[Tue Mar 31 16:18:20.507849 2026] [:error] [pid 6548:tid 6574] [client 20.216.187.161:14072] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/conte.php"] [unique_id "acuDTLgIz9HgMl9YwE6eVQAAAVg"]
[Tue Mar 31 16:18:20.988557 2026] [:error] [pid 41421:tid 41433] [client 20.216.187.161:13403] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class3.php"] [unique_id "acuDTBSaDjY9kKFtUQA3qQAAAQk"]
[Tue Mar 31 16:18:21.490020 2026] [:error] [pid 36891:tid 36925] [client 20.216.187.161:13957] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class3.php"] [unique_id "acuDTZJhiMaJUqoqfl6cRgAAAEE"]
[Tue Mar 31 16:18:21.979180 2026] [:error] [pid 36891:tid 36934] [client 20.216.187.161:13387] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class3.php"] [unique_id "acuDTZJhiMaJUqoqfl6cSQAAAEo"]
[Tue Mar 31 16:18:22.648726 2026] [:error] [pid 36982:tid 36987] [client 20.216.187.161:13439] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class3.php"] [unique_id "acuDTvlMmeoQKN0r_GMCMQAAAMI"]
[Tue Mar 31 16:18:23.121308 2026] [:error] [pid 6548:tid 6557] [client 20.216.187.161:13457] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/claa.php"] [unique_id "acuDT7gIz9HgMl9YwE6eXQAAAUc"]
[Tue Mar 31 16:18:23.621683 2026] [:error] [pid 41421:tid 41446] [client 20.216.187.161:14046] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/claa.php"] [unique_id "acuDTxSaDjY9kKFtUQA3rgAAARY"]
[Tue Mar 31 16:18:24.097481 2026] [:error] [pid 41421:tid 41427] [client 20.216.187.161:13480] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/claa.php"] [unique_id "acuDUBSaDjY9kKFtUQA3tAAAAQM"]
[Tue Mar 31 16:18:24.576929 2026] [:error] [pid 36891:tid 36931] [client 20.216.187.161:14050] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/claa.php"] [unique_id "acuDUJJhiMaJUqoqfl6cSwAAAEc"]
[Tue Mar 31 16:18:25.060386 2026] [:error] [pid 36890:tid 36911] [client 20.216.187.161:14066] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "acuDUZ8FASPd_uH8z7fntgAAABA"]
[Tue Mar 31 16:18:25.733815 2026] [:error] [pid 36890:tid 36915] [client 20.216.187.161:14125] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "acuDUZ8FASPd_uH8z7fnuQAAABQ"]
[Tue Mar 31 16:18:26.385126 2026] [:error] [pid 36890:tid 36902] [client 20.216.187.161:13469] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "acuDUp8FASPd_uH8z7fnvgAAAAc"]
[Tue Mar 31 16:18:26.956194 2026] [:error] [pid 36891:tid 36928] [client 20.216.187.161:14024] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xb.php"] [unique_id "acuDUpJhiMaJUqoqfl6cTAAAAEQ"]
[Tue Mar 31 16:18:27.452503 2026] [:error] [pid 36892:tid 36974] [client 20.216.187.161:13967] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "acuDU0yj9S4G0ek3O4JN8wAAAJc"]
[Tue Mar 31 16:18:27.947186 2026] [:error] [pid 6548:tid 6553] [client 20.216.187.161:13430] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "acuDU7gIz9HgMl9YwE6eZgAAAUM"]
[Tue Mar 31 16:18:28.462598 2026] [:error] [pid 6548:tid 6559] [client 20.216.187.161:13495] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "acuDVLgIz9HgMl9YwE6ebQAAAUk"]
[Tue Mar 31 16:18:29.034982 2026] [:error] [pid 6548:tid 6558] [client 20.216.187.161:14074] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "acuDVbgIz9HgMl9YwE6ecgAAAUg"]
[Tue Mar 31 16:18:29.581008 2026] [:error] [pid 6548:tid 6568] [client 20.216.187.161:13383] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wa.php"] [unique_id "acuDVbgIz9HgMl9YwE6edwAAAVI"]
[Tue Mar 31 16:18:30.111623 2026] [:error] [pid 41421:tid 41437] [client 20.216.187.161:13379] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wa.php"] [unique_id "acuDVhSaDjY9kKFtUQA3vwAAAQ0"]
[Tue Mar 31 16:18:30.589180 2026] [:error] [pid 41421:tid 41438] [client 20.216.187.161:13382] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wa.php"] [unique_id "acuDVhSaDjY9kKFtUQA3wgAAAQ4"]
[Tue Mar 31 16:18:31.109620 2026] [:error] [pid 36891:tid 36932] [client 20.216.187.161:13411] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wa.php"] [unique_id "acuDV5JhiMaJUqoqfl6cTQAAAEg"]
[Tue Mar 31 16:18:31.697953 2026] [:error] [pid 36982:tid 37008] [client 20.216.187.161:13421] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "acuDV_lMmeoQKN0r_GMCOQAAANc"]
[Tue Mar 31 16:18:32.201373 2026] [:error] [pid 36892:tid 36965] [client 20.216.187.161:14073] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "acuDWEyj9S4G0ek3O4JN9wAAAI4"]
[Tue Mar 31 16:18:32.715029 2026] [:error] [pid 6548:tid 6568] [client 20.216.187.161:14043] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "acuDWLgIz9HgMl9YwE6efgAAAVI"]
[Tue Mar 31 16:18:33.234626 2026] [:error] [pid 36890:tid 36908] [client 20.216.187.161:14027] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ac.php"] [unique_id "acuDWZ8FASPd_uH8z7fnxgAAAA0"]
[Tue Mar 31 16:18:33.772375 2026] [:error] [pid 36890:tid 36913] [client 20.216.187.161:14320] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "acuDWZ8FASPd_uH8z7fnxwAAABI"]
[Tue Mar 31 16:18:34.265098 2026] [:error] [pid 36892:tid 36968] [client 20.216.187.161:14211] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "acuDWkyj9S4G0ek3O4JN-QAAAJE"]
[Tue Mar 31 16:18:34.854594 2026] [:error] [pid 36982:tid 36993] [client 20.216.187.161:13376] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "acuDWvlMmeoQKN0r_GMCPwAAAMg"]
[Tue Mar 31 16:18:35.460814 2026] [:error] [pid 6548:tid 6569] [client 20.216.187.161:13397] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/az.php"] [unique_id "acuDW7gIz9HgMl9YwE6eiQAAAVM"]
[Tue Mar 31 16:18:35.964652 2026] [:error] [pid 36982:tid 36994] [client 20.216.187.161:13398] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "acuDW_lMmeoQKN0r_GMCQQAAAMk"]
[Tue Mar 31 16:18:36.457747 2026] [:error] [pid 6548:tid 6567] [client 20.216.187.161:13399] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "acuDXLgIz9HgMl9YwE6ekAAAAVE"]
[Tue Mar 31 16:18:37.012815 2026] [:error] [pid 36890:tid 36919] [client 20.216.187.161:14329] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "acuDXZ8FASPd_uH8z7fnywAAABg"]
[Tue Mar 31 16:18:37.489374 2026] [:error] [pid 6548:tid 6550] [client 20.216.187.161:13423] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "acuDXbgIz9HgMl9YwE6elAAAAUA"]
[Tue Mar 31 16:18:38.023301 2026] [:error] [pid 36982:tid 36999] [client 20.216.187.161:14291] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "acuDXvlMmeoQKN0r_GMCSgAAAM4"]
[Tue Mar 31 16:18:38.541831 2026] [:error] [pid 6548:tid 6566] [client 20.216.187.161:14075] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "acuDXrgIz9HgMl9YwE6emgAAAVA"]
[Tue Mar 31 16:18:39.070553 2026] [:error] [pid 6548:tid 6573] [client 20.216.187.161:13956] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "acuDX7gIz9HgMl9YwE6engAAAVc"]
[Tue Mar 31 16:18:39.554605 2026] [:error] [pid 36982:tid 36997] [client 20.216.187.161:14049] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "acuDX_lMmeoQKN0r_GMCTgAAAMw"]
[Tue Mar 31 16:18:40.050072 2026] [:error] [pid 6548:tid 6566] [client 20.216.187.161:13972] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "acuDYLgIz9HgMl9YwE6epwAAAVA"]
[Tue Mar 31 16:18:40.521838 2026] [:error] [pid 6548:tid 6573] [client 20.216.187.161:14057] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "acuDYLgIz9HgMl9YwE6eqQAAAVc"]
[Tue Mar 31 16:18:41.046463 2026] [:error] [pid 36890:tid 36902] [client 20.216.187.161:13419] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "acuDYZ8FASPd_uH8z7fn1gAAAAc"]
[Tue Mar 31 16:18:41.569526 2026] [:error] [pid 36982:tid 37004] [client 20.216.187.161:13402] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ha.php"] [unique_id "acuDYflMmeoQKN0r_GMCVAAAANM"]
[Tue Mar 31 16:18:42.128357 2026] [:error] [pid 41421:tid 41425] [client 20.216.187.161:14006] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "acuDYhSaDjY9kKFtUQA31QAAAQE"]
[Tue Mar 31 16:18:42.623685 2026] [:error] [pid 41421:tid 41442] [client 20.216.187.161:14071] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "acuDYhSaDjY9kKFtUQA32gAAARI"]
[Tue Mar 31 16:18:43.128848 2026] [:error] [pid 41421:tid 41448] [client 20.216.187.161:13975] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "acuDYxSaDjY9kKFtUQA33wAAARg"]
[Tue Mar 31 16:18:43.699245 2026] [:error] [pid 36891:tid 36941] [client 20.216.187.161:13906] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o1.php"] [unique_id "acuDY5JhiMaJUqoqfl6cVQAAAFE"]
[Tue Mar 31 16:18:44.216317 2026] [:error] [pid 41421:tid 41429] [client 20.216.187.161:14138] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "acuDZBSaDjY9kKFtUQA35AAAAQU"]
[Tue Mar 31 16:18:44.706122 2026] [:error] [pid 36892:tid 36956] [client 20.216.187.161:14332] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "acuDZEyj9S4G0ek3O4JOBwAAAIU"]
[Tue Mar 31 16:18:45.215056 2026] [:error] [pid 36982:tid 37006] [client 20.216.187.161:13990] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "acuDZflMmeoQKN0r_GMCXwAAANU"]
[Tue Mar 31 16:18:45.721328 2026] [:error] [pid 6548:tid 6568] [client 20.216.187.161:14290] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "acuDZbgIz9HgMl9YwE6eswAAAVI"]
[Tue Mar 31 16:18:46.292502 2026] [:error] [pid 6548:tid 6559] [client 20.216.187.161:13986] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lopst.php"] [unique_id "acuDZrgIz9HgMl9YwE6etQAAAUk"]
[Tue Mar 31 16:18:46.772826 2026] [:error] [pid 6548:tid 6574] [client 20.216.187.161:13408] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lopst.php"] [unique_id "acuDZrgIz9HgMl9YwE6euQAAAVg"]
[Tue Mar 31 16:18:47.286956 2026] [:error] [pid 6548:tid 6563] [client 20.216.187.161:13384] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lopst.php"] [unique_id "acuDZ7gIz9HgMl9YwE6evAAAAU0"]
[Tue Mar 31 16:18:47.763898 2026] [:error] [pid 36982:tid 37007] [client 20.216.187.161:13415] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lopst.php"] [unique_id "acuDZ_lMmeoQKN0r_GMCZQAAANY"]
[Tue Mar 31 16:18:48.285708 2026] [:error] [pid 36891:tid 36944] [client 20.216.187.161:14227] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wft.php"] [unique_id "acuDaJJhiMaJUqoqfl6cXQAAAFQ"]
[Tue Mar 31 16:18:48.769198 2026] [:error] [pid 36892:tid 36955] [client 20.216.187.161:14317] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wft.php"] [unique_id "acuDaEyj9S4G0ek3O4JOCwAAAIQ"]
[Tue Mar 31 16:18:49.299551 2026] [:error] [pid 36982:tid 36988] [client 20.216.187.161:14218] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wft.php"] [unique_id "acuDaflMmeoQKN0r_GMCaQAAAMM"]
[Tue Mar 31 16:18:49.780149 2026] [:error] [pid 36891:tid 36925] [client 20.216.187.161:13420] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wft.php"] [unique_id "acuDaZJhiMaJUqoqfl6cXwAAAEE"]
[Tue Mar 31 16:18:50.255957 2026] [:error] [pid 36982:tid 36986] [client 20.216.187.161:14023] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "acuDavlMmeoQKN0r_GMCbgAAAME"]
[Tue Mar 31 16:18:50.753171 2026] [:error] [pid 6548:tid 6563] [client 20.216.187.161:13475] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "acuDargIz9HgMl9YwE6eygAAAU0"]
[Tue Mar 31 16:18:51.257858 2026] [:error] [pid 6548:tid 6564] [client 20.216.187.161:13955] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "acuDa7gIz9HgMl9YwE6ezAAAAU4"]
[Tue Mar 31 16:18:51.815163 2026] [:error] [pid 6548:tid 6572] [client 20.216.187.161:14304] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "acuDa7gIz9HgMl9YwE6ezgAAAVY"]
[Tue Mar 31 16:18:52.288664 2026] [:error] [pid 41421:tid 41438] [client 20.216.187.161:14226] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "acuDbBSaDjY9kKFtUQA37wAAAQ4"]
[Tue Mar 31 16:18:52.774221 2026] [:error] [pid 36892:tid 36968] [client 20.216.187.161:13407] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "acuDbEyj9S4G0ek3O4JODQAAAJE"]
[Tue Mar 31 16:18:53.317518 2026] [:error] [pid 41421:tid 41430] [client 20.216.187.161:14079] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "acuDbRSaDjY9kKFtUQA38gAAAQY"]
[Tue Mar 31 16:18:53.897412 2026] [:error] [pid 36891:tid 36948] [client 20.216.187.161:13919] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "acuDbZJhiMaJUqoqfl6cZgAAAFg"]
[Tue Mar 31 16:18:54.373046 2026] [:error] [pid 36890:tid 36910] [client 20.216.187.161:13959] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shlo.php"] [unique_id "acuDbp8FASPd_uH8z7fn3wAAAA8"]
[Tue Mar 31 16:18:54.859552 2026] [:error] [pid 6548:tid 6573] [client 20.216.187.161:13968] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shlo.php"] [unique_id "acuDbrgIz9HgMl9YwE6e0wAAAVc"]
[Tue Mar 31 16:18:55.336028 2026] [:error] [pid 36982:tid 36993] [client 20.216.187.161:13980] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shlo.php"] [unique_id "acuDb_lMmeoQKN0r_GMCfgAAAMg"]
[Tue Mar 31 16:18:55.836490 2026] [:error] [pid 36982:tid 36985] [client 20.216.187.161:14012] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shlo.php"] [unique_id "acuDb_lMmeoQKN0r_GMCgQAAAMA"]
[Tue Mar 31 16:18:56.405706 2026] [:error] [pid 6548:tid 6556] [client 20.216.187.161:14314] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "acuDcLgIz9HgMl9YwE6e2gAAAUY"]
[Tue Mar 31 16:18:56.915050 2026] [:error] [pid 36892:tid 36953] [client 20.216.187.161:14330] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "acuDcEyj9S4G0ek3O4JOFQAAAII"]
[Tue Mar 31 16:18:57.387385 2026] [:error] [pid 36892:tid 36967] [client 20.216.187.161:13974] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "acuDcUyj9S4G0ek3O4JOHgAAAJA"]
[Tue Mar 31 16:18:57.879130 2026] [:error] [pid 36982:tid 37005] [client 20.216.187.161:14180] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "acuDcflMmeoQKN0r_GMClQAAANQ"]
[Tue Mar 31 16:18:58.409634 2026] [:error] [pid 6548:tid 6556] [client 20.216.187.161:13979] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "acuDcrgIz9HgMl9YwE6e5wAAAUY"]
[Tue Mar 31 16:18:58.941769 2026] [:error] [pid 36982:tid 36990] [client 20.216.187.161:14219] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "acuDcvlMmeoQKN0r_GMCmgAAAMU"]
[Tue Mar 31 16:18:59.456532 2026] [:error] [pid 36891:tid 36943] [client 20.216.187.161:14030] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "acuDc5JhiMaJUqoqfl6ccQAAAFM"]
[Tue Mar 31 16:18:59.929839 2026] [:error] [pid 36891:tid 36926] [client 20.216.187.161:13410] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "acuDc5JhiMaJUqoqfl6cdAAAAEI"]
[Tue Mar 31 16:19:00.409682 2026] [:error] [pid 36891:tid 36927] [client 20.216.187.161:13401] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "acuDdJJhiMaJUqoqfl6ceQAAAEM"]
[Tue Mar 31 16:19:00.908027 2026] [:error] [pid 36890:tid 36914] [client 20.216.187.161:14296] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "acuDdJ8FASPd_uH8z7fn9wAAABM"]
[Tue Mar 31 16:19:04.754004 2026] [:error] [pid 6548:tid 6552] [client 20.216.187.161:13502] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/read.php"] [unique_id "acuDeLgIz9HgMl9YwE6e_AAAAUI"]
[Tue Mar 31 16:19:05.238039 2026] [:error] [pid 41421:tid 41442] [client 20.216.187.161:14334] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/read.php"] [unique_id "acuDeRSaDjY9kKFtUQA4BQAAARI"]
[Tue Mar 31 16:19:05.728620 2026] [:error] [pid 36982:tid 36989] [client 20.216.187.161:13470] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/read.php"] [unique_id "acuDeflMmeoQKN0r_GMCxgAAAMQ"]
[Tue Mar 31 16:19:06.548616 2026] [:error] [pid 36982:tid 36996] [client 20.216.187.161:14245] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/read.php"] [unique_id "acuDevlMmeoQKN0r_GMCyAAAAMs"]
[Tue Mar 31 16:19:07.217680 2026] [:error] [pid 36891:tid 36931] [client 20.216.187.161:14335] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acuDe5JhiMaJUqoqfl6cgwAAAEc"]
[Tue Mar 31 16:19:07.726435 2026] [:error] [pid 36890:tid 36901] [client 20.216.187.161:14302] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acuDe58FASPd_uH8z7foAgAAAAY"]
[Tue Mar 31 16:19:08.246568 2026] [:error] [pid 36890:tid 36912] [client 20.216.187.161:13427] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acuDfJ8FASPd_uH8z7foBgAAABE"]
[Tue Mar 31 16:19:08.738690 2026] [:error] [pid 6548:tid 6557] [client 20.216.187.161:14281] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acuDfLgIz9HgMl9YwE6fCAAAAUc"]
[Tue Mar 31 16:19:09.221635 2026] [:error] [pid 6548:tid 6553] [client 20.216.187.161:14248] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "acuDfbgIz9HgMl9YwE6fCgAAAUM"]
[Tue Mar 31 16:19:09.749326 2026] [:error] [pid 36982:tid 37003] [client 20.216.187.161:13963] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "acuDfflMmeoQKN0r_GMC0QAAANI"]
[Tue Mar 31 16:19:10.245009 2026] [:error] [pid 36892:tid 36963] [client 20.216.187.161:13412] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "acuDfkyj9S4G0ek3O4JOLgAAAIw"]
[Tue Mar 31 16:19:10.744538 2026] [:error] [pid 41421:tid 41442] [client 20.216.187.161:14238] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "acuDfhSaDjY9kKFtUQA4FAAAARI"]
[Tue Mar 31 16:19:11.255812 2026] [:error] [pid 36982:tid 36991] [client 20.216.187.161:14013] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mter.php"] [unique_id "acuDf_lMmeoQKN0r_GMC4AAAAMY"]
[Tue Mar 31 16:19:12.163982 2026] [:error] [pid 36982:tid 37000] [client 20.216.187.161:13405] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mter.php"] [unique_id "acuDgPlMmeoQKN0r_GMC4gAAAM8"]
[Tue Mar 31 16:19:12.714561 2026] [:error] [pid 41421:tid 41438] [client 20.216.187.161:13404] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mter.php"] [unique_id "acuDgBSaDjY9kKFtUQA4GwAAAQ4"]
[Tue Mar 31 16:19:13.268806 2026] [:error] [pid 41421:tid 41439] [client 20.216.187.161:14210] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mter.php"] [unique_id "acuDgRSaDjY9kKFtUQA4IQAAAQ8"]
[Tue Mar 31 16:19:13.770189 2026] [:error] [pid 36982:tid 36986] [client 20.216.187.161:14326] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "acuDgflMmeoQKN0r_GMC6wAAAME"]
[Tue Mar 31 16:19:14.286250 2026] [:error] [pid 36892:tid 36953] [client 20.216.187.161:14241] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "acuDgkyj9S4G0ek3O4JOMQAAAII"]
[Tue Mar 31 16:19:14.790344 2026] [:error] [pid 36892:tid 36955] [client 20.216.187.161:14002] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "acuDgkyj9S4G0ek3O4JOMwAAAIQ"]
[Tue Mar 31 16:19:15.332601 2026] [:error] [pid 36982:tid 37007] [client 20.216.187.161:13433] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "acuDg_lMmeoQKN0r_GMC-gAAANY"]
[Tue Mar 31 16:19:15.850173 2026] [:error] [pid 36890:tid 36903] [client 20.216.187.161:14294] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "acuDg58FASPd_uH8z7foEgAAAAg"]
[Tue Mar 31 16:19:16.323317 2026] [:error] [pid 36892:tid 36951] [client 20.216.187.161:14214] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "acuDhEyj9S4G0ek3O4JONAAAAIA"]
[Tue Mar 31 16:19:16.836696 2026] [:error] [pid 36892:tid 36960] [client 20.216.187.161:14327] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "acuDhEyj9S4G0ek3O4JONgAAAIk"]
[Tue Mar 31 16:19:17.362720 2026] [:error] [pid 6548:tid 6559] [client 20.216.187.161:14149] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "acuDhbgIz9HgMl9YwE6fGgAAAUk"]
[Tue Mar 31 16:19:17.916253 2026] [:error] [pid 36890:tid 36900] [client 20.216.187.161:13962] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "acuDhZ8FASPd_uH8z7foHwAAAAU"]
[Tue Mar 31 16:19:18.395644 2026] [:error] [pid 36982:tid 37000] [client 20.216.187.161:14192] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "acuDhvlMmeoQKN0r_GMDCgAAAM8"]
[Tue Mar 31 16:19:18.879970 2026] [:error] [pid 36982:tid 36996] [client 20.216.187.161:14303] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "acuDhvlMmeoQKN0r_GMDDAAAAMs"]
[Tue Mar 31 16:19:19.368057 2026] [:error] [pid 6548:tid 6553] [client 20.216.187.161:14263] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "acuDh7gIz9HgMl9YwE6fIAAAAUM"]
[Tue Mar 31 16:19:19.864958 2026] [:error] [pid 6548:tid 6568] [client 20.216.187.161:13983] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eee.php"] [unique_id "acuDh7gIz9HgMl9YwE6fJQAAAVI"]
[Tue Mar 31 16:19:20.384535 2026] [:error] [pid 6548:tid 6560] [client 20.216.187.161:14220] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eee.php"] [unique_id "acuDiLgIz9HgMl9YwE6fLAAAAUo"]
[Tue Mar 31 16:19:20.945425 2026] [:error] [pid 36891:tid 36945] [client 20.216.187.161:14275] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eee.php"] [unique_id "acuDiJJhiMaJUqoqfl6cjAAAAFU"]
[Tue Mar 31 16:19:21.463178 2026] [:error] [pid 6548:tid 6557] [client 20.216.187.161:13434] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eee.php"] [unique_id "acuDibgIz9HgMl9YwE6fMQAAAUc"]
[Tue Mar 31 16:19:21.944611 2026] [:error] [pid 36982:tid 36992] [client 20.216.187.161:14308] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "acuDiflMmeoQKN0r_GMDFwAAAMc"]
[Tue Mar 31 16:19:22.480609 2026] [:error] [pid 41421:tid 41433] [client 20.216.187.161:14177] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "acuDihSaDjY9kKFtUQA4PQAAAQk"]
[Tue Mar 31 16:19:22.961022 2026] [:error] [pid 36982:tid 36994] [client 20.216.187.161:14287] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "acuDivlMmeoQKN0r_GMDIwAAAMk"]
[Tue Mar 31 16:19:23.511758 2026] [:error] [pid 36892:tid 36971] [client 20.216.187.161:14246] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "acuDi0yj9S4G0ek3O4JOPAAAAJQ"]
[Tue Mar 31 16:19:24.003314 2026] [:error] [pid 41421:tid 41442] [client 20.216.187.161:14301] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/swallowable.php"] [unique_id "acuDjBSaDjY9kKFtUQA4RAAAARI"]
[Tue Mar 31 16:19:24.515102 2026] [:error] [pid 41421:tid 41440] [client 20.216.187.161:14253] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/swallowable.php"] [unique_id "acuDjBSaDjY9kKFtUQA4SAAAARA"]
[Tue Mar 31 16:19:25.003175 2026] [:error] [pid 36982:tid 36998] [client 20.216.187.161:13468] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/swallowable.php"] [unique_id "acuDjflMmeoQKN0r_GMDMAAAAM0"]
[Tue Mar 31 16:19:25.531607 2026] [:error] [pid 36892:tid 36956] [client 20.216.187.161:13936] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/swallowable.php"] [unique_id "acuDjUyj9S4G0ek3O4JOPgAAAIU"]
[Tue Mar 31 16:19:26.016708 2026] [:error] [pid 41421:tid 41438] [client 20.216.187.161:14288] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "acuDjhSaDjY9kKFtUQA4SwAAAQ4"]
[Tue Mar 31 16:19:26.493610 2026] [:error] [pid 36982:tid 36987] [client 20.216.187.161:14272] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "acuDjvlMmeoQKN0r_GMDOQAAAMI"]
[Tue Mar 31 16:19:27.008534 2026] [:error] [pid 36890:tid 36909] [client 20.216.187.161:14247] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "acuDj58FASPd_uH8z7foOAAAAA4"]
[Tue Mar 31 16:19:27.513231 2026] [:error] [pid 36891:tid 36938] [client 20.216.187.161:14207] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "acuDj5JhiMaJUqoqfl6ckQAAAE4"]
[Tue Mar 31 16:19:28.093949 2026] [:error] [pid 6548:tid 6573] [client 20.216.187.161:14244] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "acuDkLgIz9HgMl9YwE6fOQAAAVc"]
[Tue Mar 31 16:19:28.590111 2026] [:error] [pid 36982:tid 36988] [client 20.216.187.161:13406] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "acuDkPlMmeoQKN0r_GMDQAAAAMM"]
[Tue Mar 31 16:19:29.095997 2026] [:error] [pid 41421:tid 41437] [client 20.216.187.161:13409] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "acuDkRSaDjY9kKFtUQA4VQAAAQ0"]
[Tue Mar 31 16:19:29.587472 2026] [:error] [pid 36891:tid 36930] [client 20.216.187.161:14333] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "acuDkZJhiMaJUqoqfl6ckwAAAEY"]
[Tue Mar 31 16:19:30.060890 2026] [:error] [pid 36891:tid 36933] [client 20.216.187.161:13965] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "acuDkpJhiMaJUqoqfl6clwAAAEk"]
[Tue Mar 31 16:19:30.626150 2026] [:error] [pid 36891:tid 36944] [client 20.216.187.161:13911] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "acuDkpJhiMaJUqoqfl6cmAAAAFQ"]
[Tue Mar 31 16:19:31.106175 2026] [:error] [pid 36891:tid 36943] [client 20.216.187.161:13947] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "acuDk5JhiMaJUqoqfl6cmQAAAFM"]
[Tue Mar 31 16:19:31.751539 2026] [:error] [pid 36891:tid 36940] [client 20.216.187.161:14285] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "acuDk5JhiMaJUqoqfl6cnwAAAFA"]
[Tue Mar 31 16:19:32.245790 2026] [:error] [pid 36982:tid 36996] [client 20.216.187.161:14280] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "acuDlPlMmeoQKN0r_GMDSAAAAMs"]
[Tue Mar 31 16:19:32.719868 2026] [:error] [pid 36982:tid 37004] [client 20.216.187.161:14305] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "acuDlPlMmeoQKN0r_GMDTgAAANM"]
[Tue Mar 31 16:19:33.201494 2026] [:error] [pid 41421:tid 41435] [client 20.216.187.161:14151] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "acuDlRSaDjY9kKFtUQA4YAAAAQs"]
[Tue Mar 31 16:19:33.757998 2026] [:error] [pid 36890:tid 36902] [client 20.216.187.161:13942] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "acuDlZ8FASPd_uH8z7foQAAAAAc"]
[Tue Mar 31 16:19:34.262943 2026] [:error] [pid 36891:tid 36938] [client 20.216.187.161:13988] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "acuDlpJhiMaJUqoqfl6cpQAAAE4"]
[Tue Mar 31 16:19:34.873102 2026] [:error] [pid 36982:tid 37006] [client 20.216.187.161:14216] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "acuDlvlMmeoQKN0r_GMDVgAAANU"]
[Tue Mar 31 16:19:35.346793 2026] [:error] [pid 41421:tid 41440] [client 20.216.187.161:13960] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "acuDlxSaDjY9kKFtUQA4aQAAARA"]
[Tue Mar 31 16:19:35.874466 2026] [:error] [pid 41421:tid 41439] [client 20.216.187.161:14014] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "acuDlxSaDjY9kKFtUQA4bwAAAQ8"]
[Tue Mar 31 16:19:36.350267 2026] [:error] [pid 36982:tid 37000] [client 20.216.187.161:14004] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "acuDmPlMmeoQKN0r_GMDWQAAAM8"]
[Tue Mar 31 16:19:36.844820 2026] [:error] [pid 41421:tid 41430] [client 20.216.187.161:14277] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "acuDmBSaDjY9kKFtUQA4cQAAAQY"]
[Tue Mar 31 16:19:37.403792 2026] [:error] [pid 36982:tid 37003] [client 20.216.187.161:14325] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "acuDmflMmeoQKN0r_GMDXQAAANI"]
[Tue Mar 31 16:19:37.906904 2026] [:error] [pid 36891:tid 36936] [client 20.216.187.161:14237] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "acuDmZJhiMaJUqoqfl6crAAAAEw"]
[Tue Mar 31 16:19:38.393055 2026] [:error] [pid 36891:tid 36947] [client 20.216.187.161:13847] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "acuDmpJhiMaJUqoqfl6csgAAAFc"]
[Tue Mar 31 16:19:38.878828 2026] [:error] [pid 36892:tid 36974] [client 20.216.187.161:13388] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "acuDmkyj9S4G0ek3O4JOXgAAAJc"]
[Tue Mar 31 16:19:39.359135 2026] [:error] [pid 36890:tid 36913] [client 20.216.187.161:14283] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "acuDm58FASPd_uH8z7foTwAAABI"]
[Tue Mar 31 16:19:39.938093 2026] [:error] [pid 36892:tid 36966] [client 20.216.187.161:14264] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "acuDm0yj9S4G0ek3O4JOYQAAAI8"]
[Tue Mar 31 16:19:40.414155 2026] [:error] [pid 36891:tid 36942] [client 20.216.187.161:14217] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "acuDnJJhiMaJUqoqfl6cuwAAAFI"]
[Tue Mar 31 16:19:40.930420 2026] [:error] [pid 36891:tid 36935] [client 20.216.187.161:13982] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "acuDnJJhiMaJUqoqfl6cvQAAAEs"]
[Tue Mar 31 16:19:41.412571 2026] [:error] [pid 36891:tid 36937] [client 20.216.187.161:13865] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "acuDnZJhiMaJUqoqfl6cwQAAAE0"]
[Tue Mar 31 16:19:41.892509 2026] [:error] [pid 36890:tid 36895] [client 20.216.187.161:13436] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "acuDnZ8FASPd_uH8z7foVwAAAAA"]
[Tue Mar 31 16:19:42.363865 2026] [:error] [pid 36982:tid 36989] [client 20.216.187.161:14062] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "acuDnvlMmeoQKN0r_GMDYwAAAMQ"]
[Tue Mar 31 16:19:42.835406 2026] [:error] [pid 36982:tid 36994] [client 20.216.187.161:13828] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "acuDnvlMmeoQKN0r_GMDZgAAAMk"]
[Tue Mar 31 16:19:43.354252 2026] [:error] [pid 36982:tid 37000] [client 20.216.187.161:13396] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "acuDn_lMmeoQKN0r_GMDaQAAAM8"]
[Tue Mar 31 16:19:43.831307 2026] [:error] [pid 41421:tid 41440] [client 20.216.187.161:13884] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "acuDnxSaDjY9kKFtUQA4kwAAARA"]
[Tue Mar 31 16:19:44.379122 2026] [:error] [pid 41421:tid 41439] [client 20.216.187.161:14231] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "acuDoBSaDjY9kKFtUQA4lgAAAQ8"]
[Tue Mar 31 16:19:44.869232 2026] [:error] [pid 36982:tid 37005] [client 20.216.187.161:13912] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "acuDoPlMmeoQKN0r_GMDcgAAANQ"]
[Tue Mar 31 16:19:45.342245 2026] [:error] [pid 6548:tid 6564] [client 20.216.187.161:14144] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "acuDobgIz9HgMl9YwE6fTgAAAU4"]
[Tue Mar 31 16:19:45.830118 2026] [:error] [pid 36982:tid 36988] [client 20.216.187.161:13422] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "acuDoflMmeoQKN0r_GMDeAAAAMM"]
[Tue Mar 31 16:19:46.322690 2026] [:error] [pid 36982:tid 36987] [client 20.216.187.161:13984] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "acuDovlMmeoQKN0r_GMDfAAAAMI"]
[Tue Mar 31 16:19:46.804276 2026] [:error] [pid 36982:tid 36998] [client 20.216.187.161:13952] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "acuDovlMmeoQKN0r_GMDggAAAM0"]
[Tue Mar 31 16:19:47.320409 2026] [:error] [pid 36982:tid 37009] [client 20.216.187.161:13934] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "acuDo_lMmeoQKN0r_GMDhwAAANg"]
[Tue Mar 31 16:19:47.825795 2026] [:error] [pid 36982:tid 36986] [client 20.216.187.161:14104] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "acuDo_lMmeoQKN0r_GMDjwAAAME"]
[Tue Mar 31 16:19:48.316969 2026] [:error] [pid 6548:tid 6563] [client 20.216.187.161:13941] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "acuDpLgIz9HgMl9YwE6fUQAAAU0"]
[Tue Mar 31 16:19:48.895280 2026] [:error] [pid 6548:tid 6572] [client 20.216.187.161:14234] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "acuDpLgIz9HgMl9YwE6fWAAAAVY"]
[Tue Mar 31 16:19:49.395407 2026] [:error] [pid 6548:tid 6567] [client 20.216.187.161:14007] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "acuDpbgIz9HgMl9YwE6fXAAAAVE"]
[Tue Mar 31 16:19:49.893495 2026] [:error] [pid 36891:tid 36940] [client 20.216.187.161:14015] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "acuDpZJhiMaJUqoqfl6cxQAAAFA"]
[Tue Mar 31 16:19:50.383313 2026] [:error] [pid 36890:tid 36909] [client 20.216.187.161:14235] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "acuDpp8FASPd_uH8z7focgAAAA4"]
[Tue Mar 31 16:19:50.858090 2026] [:error] [pid 36891:tid 36944] [client 20.216.187.161:13997] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "acuDppJhiMaJUqoqfl6czQAAAFQ"]
[Tue Mar 31 16:19:51.342593 2026] [:error] [pid 36890:tid 36912] [client 20.216.187.161:13853] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "acuDp58FASPd_uH8z7fodQAAABE"]
[Tue Mar 31 16:19:51.983014 2026] [:error] [pid 6548:tid 6553] [client 20.216.187.161:13385] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "acuDp7gIz9HgMl9YwE6fZwAAAUM"]
[Tue Mar 31 16:19:52.495874 2026] [:error] [pid 36891:tid 36948] [client 20.216.187.161:13875] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "acuDqJJhiMaJUqoqfl6c1wAAAFg"]
[Tue Mar 31 16:19:52.975507 2026] [:error] [pid 36892:tid 36951] [client 20.216.187.161:13897] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "acuDqEyj9S4G0ek3O4JOaQAAAIA"]
[Tue Mar 31 16:19:53.469888 2026] [:error] [pid 36982:tid 36988] [client 20.216.187.161:14188] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "acuDqflMmeoQKN0r_GMDmAAAAMM"]
[Tue Mar 31 16:19:53.972080 2026] [:error] [pid 36982:tid 36991] [client 20.216.187.161:13998] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "acuDqflMmeoQKN0r_GMDngAAAMY"]
[Tue Mar 31 16:19:54.447984 2026] [:error] [pid 36890:tid 36908] [client 20.216.187.161:14010] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "acuDqp8FASPd_uH8z7foggAAAA0"]
[Tue Mar 31 16:19:54.944293 2026] [:error] [pid 36982:tid 37000] [client 20.216.187.161:13892] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "acuDqvlMmeoQKN0r_GMDqQAAAM8"]
[Tue Mar 31 16:19:55.439063 2026] [:error] [pid 36982:tid 36991] [client 20.216.187.161:14197] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "acuDq_lMmeoQKN0r_GMDrgAAAMY"]
[Tue Mar 31 16:19:55.974696 2026] [:error] [pid 41421:tid 41426] [client 20.216.187.161:13879] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "acuDqxSaDjY9kKFtUQA4oQAAAQI"]
[Tue Mar 31 16:19:56.474428 2026] [:error] [pid 36982:tid 37000] [client 20.216.187.161:13894] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "acuDrPlMmeoQKN0r_GMDuAAAAM8"]
[Tue Mar 31 16:19:56.961667 2026] [:error] [pid 41421:tid 41429] [client 20.216.187.161:14171] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "acuDrBSaDjY9kKFtUQA4pQAAAQU"]
[Tue Mar 31 16:19:57.474390 2026] [:error] [pid 36982:tid 37005] [client 20.216.187.161:13899] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "acuDrflMmeoQKN0r_GMDwgAAANQ"]
[Tue Mar 31 16:19:58.035074 2026] [:error] [pid 36892:tid 36964] [client 20.216.187.161:13925] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "acuDrkyj9S4G0ek3O4JObwAAAI0"]
[Tue Mar 31 16:19:58.534493 2026] [:error] [pid 36982:tid 36990] [client 20.216.187.161:13902] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bengi.php"] [unique_id "acuDrvlMmeoQKN0r_GMDzgAAAMU"]
[Tue Mar 31 16:19:59.020739 2026] [:error] [pid 36982:tid 37001] [client 20.216.187.161:14250] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bengi.php"] [unique_id "acuDr_lMmeoQKN0r_GMD1AAAANA"]
[Tue Mar 31 16:19:59.531377 2026] [:error] [pid 36890:tid 36899] [client 20.216.187.161:13903] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bengi.php"] [unique_id "acuDr58FASPd_uH8z7fojQAAAAQ"]
[Tue Mar 31 16:20:00.009038 2026] [:error] [pid 36892:tid 36963] [client 20.216.187.161:13913] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bengi.php"] [unique_id "acuDsEyj9S4G0ek3O4JOdwAAAIw"]
[Tue Mar 31 16:20:00.500048 2026] [:error] [pid 36982:tid 36993] [client 20.216.187.161:14254] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ew.php"] [unique_id "acuDsPlMmeoQKN0r_GMD4gAAAMg"]
[Tue Mar 31 16:20:01.023099 2026] [:error] [pid 36892:tid 36970] [client 20.216.187.161:13890] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ew.php"] [unique_id "acuDsUyj9S4G0ek3O4JOewAAAJM"]
[Tue Mar 31 16:20:01.527006 2026] [:error] [pid 36890:tid 36914] [client 20.216.187.161:13437] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ew.php"] [unique_id "acuDsZ8FASPd_uH8z7folwAAABM"]
[Tue Mar 31 16:20:02.085774 2026] [:error] [pid 36982:tid 36991] [client 20.216.187.161:13843] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ew.php"] [unique_id "acuDsvlMmeoQKN0r_GMD6QAAAMY"]
[Tue Mar 31 16:20:02.575931 2026] [:error] [pid 36982:tid 36995] [client 20.216.187.161:14011] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fffff.php"] [unique_id "acuDsvlMmeoQKN0r_GMD7wAAAMo"]
[Tue Mar 31 16:20:06.167943 2026] [:error] [pid 36892:tid 36962] [client 20.216.187.161:13858] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "acuDtkyj9S4G0ek3O4JOkAAAAIs"]
[Tue Mar 31 16:20:06.642777 2026] [:error] [pid 36982:tid 36991] [client 20.216.187.161:13841] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "acuDtvlMmeoQKN0r_GMEEQAAAMY"]
[Tue Mar 31 16:20:07.137546 2026] [:error] [pid 36982:tid 36993] [client 20.216.187.161:14094] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "acuDt_lMmeoQKN0r_GMEFwAAAMg"]
[Tue Mar 31 16:20:07.616939 2026] [:error] [pid 36982:tid 36997] [client 20.216.187.161:14239] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "acuDt_lMmeoQKN0r_GMEHAAAAMw"]
[Tue Mar 31 16:20:08.088693 2026] [:error] [pid 36982:tid 36992] [client 20.216.187.161:14172] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "acuDuPlMmeoQKN0r_GMEIgAAAMc"]
[Tue Mar 31 16:20:08.558824 2026] [:error] [pid 36982:tid 36986] [client 20.216.187.161:14111] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "acuDuPlMmeoQKN0r_GMEKQAAAME"]
[Tue Mar 31 16:20:09.050516 2026] [:error] [pid 6548:tid 6551] [client 20.216.187.161:13825] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "acuDubgIz9HgMl9YwE6fdgAAAUE"]
[Tue Mar 31 16:20:09.529988 2026] [:error] [pid 6548:tid 6570] [client 20.216.187.161:14242] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "acuDubgIz9HgMl9YwE6feAAAAVQ"]
[Tue Mar 31 16:20:10.009177 2026] [:error] [pid 6548:tid 6566] [client 20.216.187.161:13927] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "acuDurgIz9HgMl9YwE6fegAAAVA"]
[Tue Mar 31 16:20:10.497605 2026] [:error] [pid 6548:tid 6550] [client 20.216.187.161:14087] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "acuDurgIz9HgMl9YwE6ffQAAAUA"]
[Tue Mar 31 16:20:10.972467 2026] [:error] [pid 6548:tid 6560] [client 20.216.187.161:14315] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "acuDurgIz9HgMl9YwE6fggAAAUo"]
[Tue Mar 31 16:20:11.460897 2026] [:error] [pid 6548:tid 6574] [client 20.216.187.161:14261] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "acuDu7gIz9HgMl9YwE6fiQAAAVg"]
[Tue Mar 31 16:20:11.940795 2026] [:error] [pid 36892:tid 36954] [client 20.216.187.161:14170] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php/admin.php"] [unique_id "acuDu0yj9S4G0ek3O4JOkgAAAIM"]
[Tue Mar 31 16:20:12.419984 2026] [:error] [pid 36892:tid 36960] [client 20.216.187.161:13976] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php/admin.php"] [unique_id "acuDvEyj9S4G0ek3O4JOlgAAAIk"]
[Tue Mar 31 16:20:12.914324 2026] [:error] [pid 6548:tid 6573] [client 20.216.187.161:13403] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php/admin.php"] [unique_id "acuDvLgIz9HgMl9YwE6fjwAAAVc"]
[Tue Mar 31 16:20:13.407799 2026] [:error] [pid 36982:tid 36989] [client 20.216.187.161:14067] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php/admin.php"] [unique_id "acuDvflMmeoQKN0r_GMESAAAAMQ"]
[Tue Mar 31 16:20:13.897495 2026] [:error] [pid 36890:tid 36915] [client 20.216.187.161:14164] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/19.php"] [unique_id "acuDvZ8FASPd_uH8z7fouQAAABQ"]
[Tue Mar 31 16:20:14.392186 2026] [:error] [pid 6548:tid 6554] [client 20.216.187.161:14266] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/19.php"] [unique_id "acuDvrgIz9HgMl9YwE6fnAAAAUQ"]
[Tue Mar 31 16:20:14.868850 2026] [:error] [pid 36892:tid 36972] [client 20.216.187.161:14093] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/19.php"] [unique_id "acuDvkyj9S4G0ek3O4JOlwAAAJU"]
[Tue Mar 31 16:20:15.349868 2026] [:error] [pid 36982:tid 36990] [client 20.216.187.161:13404] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/19.php"] [unique_id "acuDv_lMmeoQKN0r_GMETQAAAMU"]
[Tue Mar 31 16:20:15.828451 2026] [:error] [pid 36982:tid 36988] [client 20.216.187.161:13761] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "acuDv_lMmeoQKN0r_GMEUgAAAMM"]
[Tue Mar 31 16:20:16.302696 2026] [:error] [pid 6548:tid 6571] [client 20.216.187.161:14198] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "acuDwLgIz9HgMl9YwE6fqgAAAVU"]
[Tue Mar 31 16:20:16.869937 2026] [:error] [pid 6548:tid 6574] [client 20.216.187.161:13787] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "acuDwLgIz9HgMl9YwE6fsgAAAVg"]
[Tue Mar 31 16:20:17.351524 2026] [:error] [pid 41421:tid 41440] [client 20.216.187.161:14190] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "acuDwRSaDjY9kKFtUQA4rQAAARA"]
[Tue Mar 31 16:20:17.922675 2026] [:error] [pid 41421:tid 41448] [client 20.216.187.161:14286] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa2.php"] [unique_id "acuDwRSaDjY9kKFtUQA4sgAAARg"]
[Tue Mar 31 16:20:18.425503 2026] [:error] [pid 6548:tid 6558] [client 20.216.187.161:13777] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa2.php"] [unique_id "acuDwrgIz9HgMl9YwE6fuAAAAUg"]
[Tue Mar 31 16:20:18.908135 2026] [:error] [pid 36982:tid 37007] [client 20.216.187.161:13993] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa2.php"] [unique_id "acuDwvlMmeoQKN0r_GMEWAAAANY"]
[Tue Mar 31 16:20:19.379908 2026] [:error] [pid 36982:tid 36988] [client 20.216.187.161:14269] [client 20.216.187.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa2.php"] [unique_id "acuDw_lMmeoQKN0r_GMEYQAAAMM"]
[Tue Mar 31 16:34:53.699374 2026] [:error] [pid 6548:tid 6569] [client 122.51.236.174:39050] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acuHLbgIz9HgMl9YwE6pIgAAAVM"]
[Tue Mar 31 17:05:48.049752 2026] [:error] [pid 6548:tid 6561] [client 43.163.206.70:44048] [client 43.163.206.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acuObLgIz9HgMl9YwE69LwAAAUs"]
[Tue Mar 31 21:20:47.878249 2026] [:error] [pid 36982:tid 36995] [client 43.153.58.28:35084] [client 43.153.58.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acvKL_lMmeoQKN0r_GPD-gAAAMo"]
[Tue Mar 31 23:11:54.679816 2026] [:error] [pid 41421:tid 41426] [client 43.131.45.213:37304] [client 43.131.45.213] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acvkOhSaDjY9kKFtUQDQQwAAAQI"]
[Tue Mar 31 23:16:42.990589 2026] [:error] [pid 3175:tid 3178] [client 182.42.104.32:49242] [client 182.42.104.32] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acvlWl9zJkJkv_bzqv5BaQAAAsE"]
[Wed Apr 01 01:04:09.883166 2026] [:error] [pid 52836:tid 52902] [client 1.164.97.78:61838] [client 1.164.97.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 1.164.97.78, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acv-iZjk_YTY8bXnEz4j5gAAAEo"]
[Wed Apr 01 01:09:11.521893 2026] [:error] [pid 52592:tid 52666] [client 154.161.128.160:22183] [client 154.161.128.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.161.128.160, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acv_tz-61iqkPKUhqlbJSAAAABM"]
[Wed Apr 01 01:13:44.219158 2026] [:error] [pid 52836:tid 52913] [client 154.161.128.160:22185] [client 154.161.128.160] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acwAyJjk_YTY8bXnEz4r_wAAAFU"]
[Wed Apr 01 01:15:28.669024 2026] [:error] [pid 52836:tid 52895] [client 154.161.128.160:22187] [client 154.161.128.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.161.128.160, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acwBMJjk_YTY8bXnEz4tggAAAEM"]
[Wed Apr 01 01:17:26.785476 2026] [:error] [pid 52836:tid 52896] [client 154.161.128.160:22191] [client 154.161.128.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.161.128.160, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acwBppjk_YTY8bXnEz4vIwAAAEQ"]
[Wed Apr 01 01:18:26.065911 2026] [:error] [pid 52594:tid 52718] [client 31.223.89.254:59713] [client 31.223.89.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.223.89.254, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acwB4ke53suVMS91e0QkNwAAANE"]
[Wed Apr 01 01:20:15.985462 2026] [:error] [pid 52593:tid 52683] [client 154.161.128.160:53759] [client 154.161.128.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.161.128.160, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acwCT-KOtxqtcDhRtD-FFwAAAIk"]
[Wed Apr 01 01:22:17.998401 2026] [:error] [pid 52592:tid 52654] [client 154.161.128.160:53760] [client 154.161.128.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.161.128.160, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acwCyT-61iqkPKUhqlbQHAAAAAc"]
[Wed Apr 01 01:29:33.596798 2026] [:error] [pid 52593:tid 52689] [client 31.223.89.254:60253] [client 31.223.89.254] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acwEfeKOtxqtcDhRtD-IYQAAAI8"]
[Wed Apr 01 01:31:42.491891 2026] [:error] [pid 52594:tid 52701] [client 31.223.89.254:59442] [client 31.223.89.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.223.89.254, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acwE_ke53suVMS91e0Qo7wAAAMA"]
[Wed Apr 01 01:33:50.230380 2026] [:error] [pid 52594:tid 52725] [client 31.223.89.254:59161] [client 31.223.89.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.223.89.254, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acwFfke53suVMS91e0QpogAAANg"]
[Wed Apr 01 01:35:38.209606 2026] [:error] [pid 52592:tid 52657] [client 31.223.89.254:59610] [client 31.223.89.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.223.89.254, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acwF6j-61iqkPKUhqlbXtQAAAAo"]
[Wed Apr 01 01:37:34.241622 2026] [:error] [pid 52592:tid 52671] [client 31.223.89.254:59906] [client 31.223.89.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.223.89.254, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acwGXj-61iqkPKUhqlbYwQAAABg"]
[Wed Apr 01 02:13:29.261794 2026] [:error] [pid 52836:tid 52897] [client 49.51.233.46:56874] [client 49.51.233.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acwOyZjk_YTY8bXnEz5chAAAAEU"]
[Wed Apr 01 05:19:45.254470 2026] [:error] [pid 23714:tid 23742] [client 20.212.200.71:5351] [client 20.212.200.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xleet.php"] [unique_id "acw6cUHxDDU2ETcG9DSXcAAAAAg"]
[Wed Apr 01 05:19:45.634938 2026] [:error] [pid 23819:tid 23824] [client 20.212.200.71:2014] [client 20.212.200.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xleet.php"] [unique_id "acw6cddfUS_37wFAM77VgwAAAMI"]
[Wed Apr 01 05:19:46.057336 2026] [:error] [pid 23716:tid 23789] [client 20.212.200.71:1953] [client 20.212.200.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xleet.php"] [unique_id "acw6cnVtFUg_mx-RYb5Y3wAAAIE"]
[Wed Apr 01 05:19:46.466481 2026] [:error] [pid 23819:tid 23845] [client 20.212.200.71:2027] [client 20.212.200.71] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xleet.php"] [unique_id "acw6ctdfUS_37wFAM77VhAAAANc"]
[Wed Apr 01 07:37:06.510601 2026] [:error] [pid 23714:tid 23734] [client 208.115.247.51:51902] [client 208.115.247.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.115.247.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acxaokHxDDU2ETcG9DTyLQAAAAA"]
[Wed Apr 01 07:37:12.544093 2026] [:error] [pid 23714:tid 23747] [client 208.115.247.51:59617] [client 208.115.247.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.115.247.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acxaqEHxDDU2ETcG9DTyPAAAAA0"]
[Wed Apr 01 08:06:01.453763 2026] [:error] [pid 24314:tid 24319] [client 4.205.39.97:22863] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "acxhaZRF3FCzjmMUX5b2SgAAAQE"]
[Wed Apr 01 08:06:05.671574 2026] [:error] [pid 23715:tid 23785] [client 4.205.39.97:34744] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "acxhba-REzOruNbiT9x1HwAAAFg"]
[Wed Apr 01 08:06:16.588531 2026] [:error] [pid 23715:tid 23774] [client 4.205.39.97:37643] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "acxheK-REzOruNbiT9x1fwAAAE0"]
[Wed Apr 01 08:06:24.056895 2026] [:error] [pid 23714:tid 23756] [client 4.205.39.97:34328] [client 4.205.39.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins/content/apismtp/apismtp.php"] [unique_id "acxhgEHxDDU2ETcG9DQG2AAAABY"]
[Wed Apr 01 08:15:44.239183 2026] [:error] [pid 24346:tid 24356] [client 208.115.247.51:62012] [client 208.115.247.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.115.247.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acxjsLc1l8kg9MhGHIKjlQAAAUQ"]
[Wed Apr 01 08:16:53.556141 2026] [:error] [pid 24348:tid 24384] [client 191.102.176.11:57199] [client 191.102.176.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.102.176.11, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "acxj9W0Vs69Y5nF1HA_5RQAAAYU"], referer: https://expressinteriors.com/xmlrpc.php?rsd
[Wed Apr 01 08:17:01.504856 2026] [:error] [pid 23715:tid 23784] [client 208.115.247.51:62012] [client 208.115.247.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.115.247.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acxj_a-REzOruNbiT9x7ugAAAFc"]
[Wed Apr 01 08:39:19.690577 2026] [:error] [pid 24348:tid 24393] [client 208.115.247.51:57781] [client 208.115.247.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.115.247.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acxpN20Vs69Y5nF1HA8BhwAAAY4"]
[Wed Apr 01 08:47:22.682246 2026] [:error] [pid 24346:tid 24369] [client 208.115.247.51:58055] [client 208.115.247.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.115.247.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acxrGrc1l8kg9MhGHIKrBgAAAVE"]
[Wed Apr 01 09:10:44.096357 2026] [:error] [pid 24346:tid 24376] [client 208.115.247.51:57237] [client 208.115.247.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.115.247.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acxwlLc1l8kg9MhGHIKv-wAAAVg"]
[Wed Apr 01 09:14:27.546395 2026] [:error] [pid 24348:tid 24383] [client 74.234.75.219:5100] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acxxc20Vs69Y5nF1HA8QLQAAAYQ"]
[Wed Apr 01 09:14:28.753457 2026] [:error] [pid 23716:tid 23794] [client 74.234.75.219:62471] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acxxdHVtFUg_mx-RYb6P_AAAAIY"]
[Wed Apr 01 09:14:39.662335 2026] [:error] [pid 23714:tid 23744] [client 74.234.75.219:62473] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-true.php"] [unique_id "acxxf0HxDDU2ETcG9DQ7qQAAAAo"]
[Wed Apr 01 09:14:40.427115 2026] [:error] [pid 23715:tid 23764] [client 74.234.75.219:60710] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-true.php"] [unique_id "acxxgK-REzOruNbiT9yNjAAAAEM"]
[Wed Apr 01 09:14:41.136964 2026] [:error] [pid 23716:tid 23795] [client 74.234.75.219:55630] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-true.php"] [unique_id "acxxgXVtFUg_mx-RYb6QOwAAAIc"]
[Wed Apr 01 09:14:41.882088 2026] [:error] [pid 23714:tid 23734] [client 74.234.75.219:5088] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-true.php"] [unique_id "acxxgUHxDDU2ETcG9DQ7rwAAAAA"]
[Wed Apr 01 09:14:42.773405 2026] [:error] [pid 23714:tid 23757] [client 74.234.75.219:39277] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws42.php"] [unique_id "acxxgkHxDDU2ETcG9DQ7swAAABc"]
[Wed Apr 01 09:14:43.440917 2026] [:error] [pid 23716:tid 23809] [client 74.234.75.219:61282] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws42.php"] [unique_id "acxxg3VtFUg_mx-RYb6QPwAAAJU"]
[Wed Apr 01 09:14:44.416149 2026] [:error] [pid 23716:tid 23799] [client 74.234.75.219:61272] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws42.php"] [unique_id "acxxhHVtFUg_mx-RYb6QRAAAAIs"]
[Wed Apr 01 09:14:45.910727 2026] [:error] [pid 23714:tid 23748] [client 74.234.75.219:39278] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws42.php"] [unique_id "acxxhUHxDDU2ETcG9DQ7uwAAAA4"]
[Wed Apr 01 09:14:47.000968 2026] [:error] [pid 24348:tid 24398] [client 74.234.75.219:55651] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "acxxhm0Vs69Y5nF1HA8QSQAAAZM"]
[Wed Apr 01 09:14:47.829599 2026] [:error] [pid 23714:tid 23746] [client 74.234.75.219:55645] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "acxxh0HxDDU2ETcG9DQ7vwAAAAw"]
[Wed Apr 01 09:14:48.473907 2026] [:error] [pid 24348:tid 24382] [client 74.234.75.219:52597] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "acxxiG0Vs69Y5nF1HA8QTwAAAYM"]
[Wed Apr 01 09:14:49.896572 2026] [:error] [pid 23715:tid 23775] [client 74.234.75.219:60699] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "acxxia-REzOruNbiT9yNkAAAAE4"]
[Wed Apr 01 09:14:50.777037 2026] [:error] [pid 23714:tid 23743] [client 74.234.75.219:55618] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wgift1.php"] [unique_id "acxxikHxDDU2ETcG9DQ7ygAAAAk"]
[Wed Apr 01 09:14:51.580898 2026] [:error] [pid 23714:tid 23740] [client 74.234.75.219:4977] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wgift1.php"] [unique_id "acxxi0HxDDU2ETcG9DQ70AAAAAY"]
[Wed Apr 01 09:14:52.376368 2026] [:error] [pid 23716:tid 23794] [client 74.234.75.219:52603] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wgift1.php"] [unique_id "acxxjHVtFUg_mx-RYb6QTgAAAIY"]
[Wed Apr 01 09:14:53.124293 2026] [:error] [pid 23716:tid 23806] [client 74.234.75.219:55572] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wgift1.php"] [unique_id "acxxjXVtFUg_mx-RYb6QUQAAAJI"]
[Wed Apr 01 09:14:53.875528 2026] [:error] [pid 23714:tid 23736] [client 74.234.75.219:52546] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "acxxjUHxDDU2ETcG9DQ71wAAAAI"]
[Wed Apr 01 09:14:54.630464 2026] [:error] [pid 24346:tid 24354] [client 74.234.75.219:61273] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "acxxjrc1l8kg9MhGHIKw5AAAAUI"]
[Wed Apr 01 09:14:55.226595 2026] [:error] [pid 23716:tid 23805] [client 74.234.75.219:60694] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "acxxj3VtFUg_mx-RYb6QVwAAAJE"]
[Wed Apr 01 09:14:55.814554 2026] [:error] [pid 23716:tid 23812] [client 74.234.75.219:60696] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "acxxj3VtFUg_mx-RYb6QWwAAAJg"]
[Wed Apr 01 09:14:56.401107 2026] [:error] [pid 23714:tid 23738] [client 74.234.75.219:39269] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/north1.php"] [unique_id "acxxkEHxDDU2ETcG9DQ73gAAAAQ"]
[Wed Apr 01 09:14:57.115550 2026] [:error] [pid 23714:tid 23740] [client 74.234.75.219:46344] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/north1.php"] [unique_id "acxxkUHxDDU2ETcG9DQ76AAAAAY"]
[Wed Apr 01 09:14:57.753146 2026] [:error] [pid 23714:tid 23738] [client 74.234.75.219:4971] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/north1.php"] [unique_id "acxxkUHxDDU2ETcG9DQ77QAAAAQ"]
[Wed Apr 01 09:14:58.386473 2026] [:error] [pid 23716:tid 23791] [client 74.234.75.219:55603] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/north1.php"] [unique_id "acxxknVtFUg_mx-RYb6QYwAAAIM"]
[Wed Apr 01 09:14:59.229522 2026] [:error] [pid 24346:tid 24361] [client 74.234.75.219:61284] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eee.php"] [unique_id "acxxk7c1l8kg9MhGHIKw5wAAAUk"]
[Wed Apr 01 09:15:00.496649 2026] [:error] [pid 23714:tid 23754] [client 74.234.75.219:4930] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eee.php"] [unique_id "acxxlEHxDDU2ETcG9DQ79QAAABQ"]
[Wed Apr 01 09:15:01.333201 2026] [:error] [pid 23716:tid 23801] [client 74.234.75.219:60712] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eee.php"] [unique_id "acxxlXVtFUg_mx-RYb6QbgAAAI0"]
[Wed Apr 01 09:15:02.313291 2026] [:error] [pid 23716:tid 23790] [client 74.234.75.219:39268] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eee.php"] [unique_id "acxxlnVtFUg_mx-RYb6QcQAAAII"]
[Wed Apr 01 09:15:03.099805 2026] [:error] [pid 23716:tid 23788] [client 74.234.75.219:4984] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggb.php"] [unique_id "acxxl3VtFUg_mx-RYb6QdQAAAIA"]
[Wed Apr 01 09:15:04.327968 2026] [:error] [pid 23714:tid 23735] [client 74.234.75.219:62515] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggb.php"] [unique_id "acxxmEHxDDU2ETcG9DQ8AwAAAAE"]
[Wed Apr 01 09:15:05.222107 2026] [:error] [pid 23716:tid 23796] [client 74.234.75.219:55626] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggb.php"] [unique_id "acxxmXVtFUg_mx-RYb6QggAAAIg"]
[Wed Apr 01 09:15:06.017188 2026] [:error] [pid 23714:tid 23755] [client 74.234.75.219:60687] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggb.php"] [unique_id "acxxmkHxDDU2ETcG9DQ8DgAAABU"]
[Wed Apr 01 09:15:07.210516 2026] [:error] [pid 23714:tid 23754] [client 74.234.75.219:55573] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin.php"] [unique_id "acxxm0HxDDU2ETcG9DQ8FQAAABQ"]
[Wed Apr 01 09:15:07.984556 2026] [:error] [pid 23714:tid 23740] [client 74.234.75.219:61287] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin.php"] [unique_id "acxxm0HxDDU2ETcG9DQ8GgAAAAY"]
[Wed Apr 01 09:15:08.881008 2026] [:error] [pid 23714:tid 23749] [client 74.234.75.219:52607] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin.php"] [unique_id "acxxnEHxDDU2ETcG9DQ8JAAAAA8"]
[Wed Apr 01 09:15:09.746328 2026] [:error] [pid 23819:tid 23844] [client 74.234.75.219:62465] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin.php"] [unique_id "acxxnddfUS_37wFAM74HgAAAANY"]
[Wed Apr 01 09:15:10.852128 2026] [:error] [pid 23715:tid 23761] [client 74.234.75.219:60703] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "acxxnq-REzOruNbiT9yNlgAAAEA"]
[Wed Apr 01 09:15:11.903057 2026] [:error] [pid 23714:tid 23734] [client 74.234.75.219:55662] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "acxxn0HxDDU2ETcG9DQ8KgAAAAA"]
[Wed Apr 01 09:15:12.799157 2026] [:error] [pid 23714:tid 23749] [client 74.234.75.219:55555] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "acxxoEHxDDU2ETcG9DQ8LAAAAA8"]
[Wed Apr 01 09:15:13.930014 2026] [:error] [pid 23716:tid 23801] [client 74.234.75.219:46417] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "acxxoXVtFUg_mx-RYb6QjQAAAI0"]
[Wed Apr 01 09:15:15.012803 2026] [:error] [pid 23714:tid 23739] [client 74.234.75.219:46345] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gpt-sh.php"] [unique_id "acxxo0HxDDU2ETcG9DQ8NwAAAAU"]
[Wed Apr 01 09:15:16.174541 2026] [:error] [pid 23716:tid 23796] [client 74.234.75.219:43344] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gpt-sh.php"] [unique_id "acxxpHVtFUg_mx-RYb6QlAAAAIg"]
[Wed Apr 01 09:15:18.380074 2026] [:error] [pid 23716:tid 23800] [client 74.234.75.219:55643] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gpt-sh.php"] [unique_id "acxxpnVtFUg_mx-RYb6QngAAAIw"]
[Wed Apr 01 09:15:20.453138 2026] [:error] [pid 23714:tid 23749] [client 74.234.75.219:62502] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gpt-sh.php"] [unique_id "acxxqEHxDDU2ETcG9DQ8WQAAAA8"]
[Wed Apr 01 09:15:21.393025 2026] [:error] [pid 24346:tid 24372] [client 74.234.75.219:52606] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "acxxqbc1l8kg9MhGHIKw8wAAAVQ"]
[Wed Apr 01 09:15:22.247085 2026] [:error] [pid 23714:tid 23756] [client 74.234.75.219:55566] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "acxxqkHxDDU2ETcG9DQ8ZwAAABY"]
[Wed Apr 01 09:15:22.881741 2026] [:error] [pid 23714:tid 23754] [client 74.234.75.219:39259] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "acxxqkHxDDU2ETcG9DQ8bQAAABQ"]
[Wed Apr 01 09:15:23.695086 2026] [:error] [pid 24348:tid 24401] [client 74.234.75.219:39285] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "acxxq20Vs69Y5nF1HA8QdAAAAZY"]
[Wed Apr 01 09:15:24.641633 2026] [:error] [pid 24348:tid 24384] [client 74.234.75.219:55600] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "acxxrG0Vs69Y5nF1HA8QdgAAAYU"]
[Wed Apr 01 09:15:26.126562 2026] [:error] [pid 23716:tid 23791] [client 74.234.75.219:46375] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "acxxrnVtFUg_mx-RYb6QpwAAAIM"]
[Wed Apr 01 09:15:27.305279 2026] [:error] [pid 24348:tid 24402] [client 74.234.75.219:62510] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "acxxr20Vs69Y5nF1HA8QegAAAZc"]
[Wed Apr 01 09:15:28.083471 2026] [:error] [pid 23716:tid 23798] [client 74.234.75.219:55648] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "acxxsHVtFUg_mx-RYb6QsQAAAIo"]
[Wed Apr 01 09:15:28.978950 2026] [:error] [pid 24314:tid 24335] [client 74.234.75.219:62495] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wander.php"] [unique_id "acxxsJRF3FCzjmMUX5YF1gAAARE"]
[Wed Apr 01 09:15:29.853688 2026] [:error] [pid 23714:tid 23735] [client 74.234.75.219:39279] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wander.php"] [unique_id "acxxsUHxDDU2ETcG9DQ8kQAAAAE"]
[Wed Apr 01 09:15:32.307065 2026] [:error] [pid 23714:tid 23741] [client 74.234.75.219:62525] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wander.php"] [unique_id "acxxtEHxDDU2ETcG9DQ8ngAAAAc"]
[Wed Apr 01 09:15:35.330069 2026] [:error] [pid 23819:tid 23844] [client 74.234.75.219:52581] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wander.php"] [unique_id "acxxt9dfUS_37wFAM74HugAAANY"]
[Wed Apr 01 09:15:51.750728 2026] [:error] [pid 23714:tid 23741] [client 74.234.75.219:62496] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/save.php"] [unique_id "acxxx0HxDDU2ETcG9DQ8_gAAAAc"]
[Wed Apr 01 09:15:53.484671 2026] [:error] [pid 23716:tid 23803] [client 74.234.75.219:60702] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/save.php"] [unique_id "acxxyXVtFUg_mx-RYb6Q2AAAAI8"]
[Wed Apr 01 09:15:54.722605 2026] [:error] [pid 23714:tid 23758] [client 74.234.75.219:4869] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/save.php"] [unique_id "acxxykHxDDU2ETcG9DQ9BwAAABg"]
[Wed Apr 01 09:15:56.146124 2026] [:error] [pid 23715:tid 23783] [client 74.234.75.219:55563] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/save.php"] [unique_id "acxxzK-REzOruNbiT9yNtwAAAFY"]
[Wed Apr 01 09:15:57.173355 2026] [:error] [pid 24314:tid 24341] [client 74.234.75.219:62472] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "acxxzZRF3FCzjmMUX5YF3AAAARc"]
[Wed Apr 01 09:15:58.666934 2026] [:error] [pid 24348:tid 24385] [client 74.234.75.219:39250] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "acxxzm0Vs69Y5nF1HA8QqAAAAYY"]
[Wed Apr 01 09:15:59.464940 2026] [:error] [pid 24348:tid 24390] [client 74.234.75.219:55622] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "acxxz20Vs69Y5nF1HA8QqwAAAYs"]
[Wed Apr 01 09:16:00.883165 2026] [:error] [pid 23716:tid 23789] [client 74.234.75.219:55644] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "acxx0HVtFUg_mx-RYb6Q3wAAAIE"]
[Wed Apr 01 09:16:01.927917 2026] [:error] [pid 23714:tid 23754] [client 74.234.75.219:62514] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xs.php"] [unique_id "acxx0UHxDDU2ETcG9DQ9GwAAABQ"]
[Wed Apr 01 09:16:02.886251 2026] [:error] [pid 23714:tid 23740] [client 74.234.75.219:55649] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xs.php"] [unique_id "acxx0kHxDDU2ETcG9DQ9IgAAAAY"]
[Wed Apr 01 09:16:03.616385 2026] [:error] [pid 23716:tid 23790] [client 74.234.75.219:39294] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xs.php"] [unique_id "acxx03VtFUg_mx-RYb6Q5QAAAII"]
[Wed Apr 01 09:16:04.562142 2026] [:error] [pid 23716:tid 23808] [client 74.234.75.219:60692] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xs.php"] [unique_id "acxx1HVtFUg_mx-RYb6Q6AAAAJQ"]
[Wed Apr 01 09:16:05.843169 2026] [:error] [pid 24346:tid 24368] [client 74.234.75.219:60725] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "acxx1bc1l8kg9MhGHIKxEAAAAVA"]
[Wed Apr 01 09:16:06.529615 2026] [:error] [pid 23715:tid 23765] [client 74.234.75.219:60727] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "acxx1q-REzOruNbiT9yNvwAAAEQ"]
[Wed Apr 01 09:16:07.639322 2026] [:error] [pid 23715:tid 23779] [client 74.234.75.219:61290] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "acxx16-REzOruNbiT9yNwQAAAFI"]
[Wed Apr 01 09:16:08.328926 2026] [:error] [pid 23716:tid 23808] [client 74.234.75.219:4933] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "acxx2HVtFUg_mx-RYb6Q8AAAAJQ"]
[Wed Apr 01 09:16:09.681067 2026] [:error] [pid 23714:tid 23738] [client 74.234.75.219:52602] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gelio1.php"] [unique_id "acxx2UHxDDU2ETcG9DQ9TAAAAAQ"]
[Wed Apr 01 09:16:11.079111 2026] [:error] [pid 23714:tid 23734] [client 74.234.75.219:46393] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gelio1.php"] [unique_id "acxx20HxDDU2ETcG9DQ9UwAAAAA"]
[Wed Apr 01 09:16:12.517270 2026] [:error] [pid 23714:tid 23743] [client 74.234.75.219:4976] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gelio1.php"] [unique_id "acxx3EHxDDU2ETcG9DQ9VQAAAAk"]
[Wed Apr 01 09:16:13.721170 2026] [:error] [pid 24348:tid 24384] [client 74.234.75.219:61261] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gelio1.php"] [unique_id "acxx3W0Vs69Y5nF1HA8Q0gAAAYU"]
[Wed Apr 01 09:16:14.835896 2026] [:error] [pid 23715:tid 23785] [client 74.234.75.219:5109] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "acxx3q-REzOruNbiT9yN0wAAAFg"]
[Wed Apr 01 09:16:15.994024 2026] [:error] [pid 23714:tid 23744] [client 74.234.75.219:43894] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "acxx30HxDDU2ETcG9DQ9aAAAAAo"]
[Wed Apr 01 09:16:16.850814 2026] [:error] [pid 24346:tid 24363] [client 74.234.75.219:55601] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "acxx4Lc1l8kg9MhGHIKxGQAAAUs"]
[Wed Apr 01 09:16:18.085531 2026] [:error] [pid 23714:tid 23748] [client 74.234.75.219:52544] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "acxx4kHxDDU2ETcG9DQ9cgAAAA4"]
[Wed Apr 01 09:16:19.107791 2026] [:error] [pid 23715:tid 23773] [client 74.234.75.219:55617] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yuzuru1.php"] [unique_id "acxx46-REzOruNbiT9yN2AAAAEw"]
[Wed Apr 01 09:16:20.147204 2026] [:error] [pid 23714:tid 23748] [client 74.234.75.219:43384] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yuzuru1.php"] [unique_id "acxx5EHxDDU2ETcG9DQ9fQAAAA4"]
[Wed Apr 01 09:16:21.118399 2026] [:error] [pid 23714:tid 23744] [client 74.234.75.219:62469] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yuzuru1.php"] [unique_id "acxx5UHxDDU2ETcG9DQ9gwAAAAo"]
[Wed Apr 01 09:16:22.485689 2026] [:error] [pid 24346:tid 24374] [client 74.234.75.219:60700] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yuzuru1.php"] [unique_id "acxx5rc1l8kg9MhGHIKxIQAAAVY"]
[Wed Apr 01 09:16:23.112257 2026] [:error] [pid 23716:tid 23801] [client 74.234.75.219:52595] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "acxx53VtFUg_mx-RYb6RFwAAAI0"]
[Wed Apr 01 09:16:24.079849 2026] [:error] [pid 23714:tid 23743] [client 74.234.75.219:39241] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "acxx6EHxDDU2ETcG9DQ9mAAAAAk"]
[Wed Apr 01 09:16:24.740283 2026] [:error] [pid 24348:tid 24382] [client 74.234.75.219:62497] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "acxx6G0Vs69Y5nF1HA8Q6QAAAYM"]
[Wed Apr 01 09:16:25.502974 2026] [:error] [pid 23716:tid 23804] [client 74.234.75.219:4931] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "acxx6XVtFUg_mx-RYb6RJgAAAJA"]
[Wed Apr 01 09:16:26.364794 2026] [:error] [pid 24348:tid 24396] [client 74.234.75.219:4881] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sweg.php"] [unique_id "acxx6m0Vs69Y5nF1HA8Q7AAAAZE"]
[Wed Apr 01 09:16:27.078227 2026] [:error] [pid 23716:tid 23790] [client 74.234.75.219:55553] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sweg.php"] [unique_id "acxx63VtFUg_mx-RYb6RMAAAAII"]
[Wed Apr 01 09:16:27.788425 2026] [:error] [pid 23714:tid 23736] [client 74.234.75.219:62477] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sweg.php"] [unique_id "acxx60HxDDU2ETcG9DQ9pQAAAAI"]
[Wed Apr 01 09:16:28.385953 2026] [:error] [pid 24314:tid 24341] [client 74.234.75.219:55663] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sweg.php"] [unique_id "acxx7JRF3FCzjmMUX5YF6QAAARc"]
[Wed Apr 01 09:16:29.100890 2026] [:error] [pid 23819:tid 23828] [client 74.234.75.219:55652] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xpwer1.php"] [unique_id "acxx7ddfUS_37wFAM74H5QAAAMY"]
[Wed Apr 01 09:16:29.933926 2026] [:error] [pid 24346:tid 24367] [client 74.234.75.219:60698] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xpwer1.php"] [unique_id "acxx7bc1l8kg9MhGHIKxJwAAAU8"]
[Wed Apr 01 09:16:31.312951 2026] [:error] [pid 23819:tid 23844] [client 74.234.75.219:62484] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xpwer1.php"] [unique_id "acxx79dfUS_37wFAM74H6QAAANY"]
[Wed Apr 01 09:16:32.130334 2026] [:error] [pid 24314:tid 24337] [client 74.234.75.219:60697] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xpwer1.php"] [unique_id "acxx8JRF3FCzjmMUX5YF7QAAARM"]
[Wed Apr 01 09:16:32.972737 2026] [:error] [pid 24348:tid 24388] [client 74.234.75.219:55619] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws40.php"] [unique_id "acxx8G0Vs69Y5nF1HA8Q_wAAAYk"]
[Wed Apr 01 09:16:33.798813 2026] [:error] [pid 23716:tid 23789] [client 74.234.75.219:62520] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws40.php"] [unique_id "acxx8XVtFUg_mx-RYb6RNAAAAIE"]
[Wed Apr 01 09:16:34.804814 2026] [:error] [pid 24314:tid 24318] [client 74.234.75.219:39244] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws40.php"] [unique_id "acxx8pRF3FCzjmMUX5YF8gAAAQA"]
[Wed Apr 01 09:16:35.426319 2026] [:error] [pid 24348:tid 24390] [client 74.234.75.219:46351] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws40.php"] [unique_id "acxx820Vs69Y5nF1HA8RBwAAAYs"]
[Wed Apr 01 09:16:36.285197 2026] [:error] [pid 24348:tid 24391] [client 74.234.75.219:60713] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "acxx9G0Vs69Y5nF1HA8RCwAAAYw"]
[Wed Apr 01 09:16:37.194369 2026] [:error] [pid 23716:tid 23799] [client 74.234.75.219:62523] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "acxx9XVtFUg_mx-RYb6RNwAAAIs"]
[Wed Apr 01 09:16:39.156113 2026] [:error] [pid 24348:tid 24384] [client 74.234.75.219:55631] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "acxx920Vs69Y5nF1HA8RFQAAAYU"]
[Wed Apr 01 09:16:39.969154 2026] [:error] [pid 23714:tid 23747] [client 74.234.75.219:52572] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "acxx90HxDDU2ETcG9DQ9swAAAA0"]
[Wed Apr 01 09:16:40.645828 2026] [:error] [pid 23714:tid 23758] [client 74.234.75.219:39288] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awh.php"] [unique_id "acxx-EHxDDU2ETcG9DQ9uQAAABg"]
[Wed Apr 01 09:16:41.329745 2026] [:error] [pid 24314:tid 24341] [client 74.234.75.219:52553] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awh.php"] [unique_id "acxx-ZRF3FCzjmMUX5YGAAAAARc"]
[Wed Apr 01 09:16:42.011627 2026] [:error] [pid 23716:tid 23812] [client 74.234.75.219:55658] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awh.php"] [unique_id "acxx-nVtFUg_mx-RYb6RSAAAAJg"]
[Wed Apr 01 09:16:42.642892 2026] [:error] [pid 23716:tid 23806] [client 74.234.75.219:61304] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awh.php"] [unique_id "acxx-nVtFUg_mx-RYb6RUQAAAJI"]
[Wed Apr 01 09:16:43.471101 2026] [:error] [pid 24346:tid 24363] [client 74.234.75.219:62507] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shellerr.php"] [unique_id "acxx-7c1l8kg9MhGHIKxNAAAAUs"]
[Wed Apr 01 09:16:44.572335 2026] [:error] [pid 23819:tid 23839] [client 74.234.75.219:4969] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shellerr.php"] [unique_id "acxx_NdfUS_37wFAM74ICAAAANE"]
[Wed Apr 01 09:16:45.397638 2026] [:error] [pid 23819:tid 23832] [client 74.234.75.219:52548] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shellerr.php"] [unique_id "acxx_ddfUS_37wFAM74IDgAAAMo"]
[Wed Apr 01 09:16:46.343186 2026] [:error] [pid 24348:tid 24395] [client 74.234.75.219:55602] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shellerr.php"] [unique_id "acxx_m0Vs69Y5nF1HA8RKwAAAZA"]
[Wed Apr 01 09:16:46.997059 2026] [:error] [pid 24348:tid 24388] [client 74.234.75.219:55599] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-scanner.php"] [unique_id "acxx_m0Vs69Y5nF1HA8RMQAAAYk"]
[Wed Apr 01 09:16:47.574053 2026] [:error] [pid 23714:tid 23756] [client 74.234.75.219:55580] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-scanner.php"] [unique_id "acxx_0HxDDU2ETcG9DQ9xgAAABY"]
[Wed Apr 01 09:16:48.136863 2026] [:error] [pid 24348:tid 24380] [client 74.234.75.219:39264] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-scanner.php"] [unique_id "acxyAG0Vs69Y5nF1HA8ROgAAAYE"]
[Wed Apr 01 09:16:48.790992 2026] [:error] [pid 24348:tid 24381] [client 74.234.75.219:62466] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-scanner.php"] [unique_id "acxyAG0Vs69Y5nF1HA8RPQAAAYI"]
[Wed Apr 01 09:16:49.429208 2026] [:error] [pid 23715:tid 23773] [client 74.234.75.219:5064] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "acxyAa-REzOruNbiT9yN-gAAAEw"]
[Wed Apr 01 09:17:01.558445 2026] [:error] [pid 23716:tid 23795] [client 74.234.75.219:61285] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "acxyDXVtFUg_mx-RYb6RhQAAAIc"]
[Wed Apr 01 09:17:02.278921 2026] [:error] [pid 24348:tid 24380] [client 74.234.75.219:61289] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "acxyDm0Vs69Y5nF1HA8RVwAAAYE"]
[Wed Apr 01 09:17:03.246148 2026] [:error] [pid 23715:tid 23776] [client 74.234.75.219:46378] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "acxyD6-REzOruNbiT9yOAgAAAE8"]
[Wed Apr 01 09:17:04.080013 2026] [:error] [pid 23715:tid 23777] [client 74.234.75.219:62512] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "acxyEK-REzOruNbiT9yOBAAAAFA"]
[Wed Apr 01 09:17:04.664815 2026] [:error] [pid 24348:tid 24402] [client 74.234.75.219:4949] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "acxyEG0Vs69Y5nF1HA8RWwAAAZc"]
[Wed Apr 01 09:17:05.484449 2026] [:error] [pid 23714:tid 23740] [client 74.234.75.219:52592] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "acxyEUHxDDU2ETcG9DQ9-AAAAAY"]
[Wed Apr 01 09:17:06.223931 2026] [:error] [pid 23715:tid 23762] [client 74.234.75.219:62480] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "acxyEq-REzOruNbiT9yOCQAAAEE"]
[Wed Apr 01 09:17:06.793040 2026] [:error] [pid 23715:tid 23775] [client 74.234.75.219:52594] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "acxyEq-REzOruNbiT9yODAAAAE4"]
[Wed Apr 01 09:17:07.304973 2026] [:error] [pid 24346:tid 24376] [client 74.234.75.219:45101] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/size.php"] [unique_id "acxyE7c1l8kg9MhGHIKxQQAAAVg"]
[Wed Apr 01 09:17:07.988076 2026] [:error] [pid 23714:tid 23737] [client 74.234.75.219:39235] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/size.php"] [unique_id "acxyE0HxDDU2ETcG9DQ-BgAAAAM"]
[Wed Apr 01 09:17:08.671424 2026] [:error] [pid 23819:tid 23832] [client 74.234.75.219:62503] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/size.php"] [unique_id "acxyFNdfUS_37wFAM74IKwAAAMo"]
[Wed Apr 01 09:17:09.360946 2026] [:error] [pid 24314:tid 24320] [client 74.234.75.219:4934] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/size.php"] [unique_id "acxyFZRF3FCzjmMUX5YGIwAAAQI"]
[Wed Apr 01 09:17:10.102731 2026] [:error] [pid 24348:tid 24402] [client 74.234.75.219:55615] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "acxyFm0Vs69Y5nF1HA8RZQAAAZc"]
[Wed Apr 01 09:17:10.872395 2026] [:error] [pid 24314:tid 24338] [client 74.234.75.219:45098] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "acxyFpRF3FCzjmMUX5YGJwAAARQ"]
[Wed Apr 01 09:17:11.691515 2026] [:error] [pid 24346:tid 24362] [client 74.234.75.219:5091] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "acxyF7c1l8kg9MhGHIKxRwAAAUo"]
[Wed Apr 01 09:17:12.510948 2026] [:error] [pid 24346:tid 24372] [client 74.234.75.219:62494] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "acxyGLc1l8kg9MhGHIKxSQAAAVQ"]
[Wed Apr 01 09:17:13.276771 2026] [:error] [pid 23714:tid 23753] [client 74.234.75.219:55618] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "acxyGUHxDDU2ETcG9DQ-DAAAABM"]
[Wed Apr 01 09:17:13.861006 2026] [:error] [pid 24348:tid 24389] [client 74.234.75.219:61252] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "acxyGW0Vs69Y5nF1HA8RawAAAYo"]
[Wed Apr 01 09:17:14.412668 2026] [:error] [pid 23716:tid 23805] [client 74.234.75.219:61283] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "acxyGnVtFUg_mx-RYb6RsQAAAJE"]
[Wed Apr 01 09:17:15.075911 2026] [:error] [pid 23716:tid 23798] [client 74.234.75.219:39238] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "acxyG3VtFUg_mx-RYb6RtgAAAIo"]
[Wed Apr 01 09:17:15.876969 2026] [:error] [pid 24314:tid 24336] [client 74.234.75.219:55679] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/torsa1.php"] [unique_id "acxyG5RF3FCzjmMUX5YGMgAAARI"]
[Wed Apr 01 09:17:16.678723 2026] [:error] [pid 23819:tid 23837] [client 74.234.75.219:60709] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/torsa1.php"] [unique_id "acxyHNdfUS_37wFAM74IOAAAAM8"]
[Wed Apr 01 09:17:17.304664 2026] [:error] [pid 23714:tid 23752] [client 74.234.75.219:4956] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/torsa1.php"] [unique_id "acxyHUHxDDU2ETcG9DQ-EAAAABI"]
[Wed Apr 01 09:17:18.221335 2026] [:error] [pid 23819:tid 23831] [client 74.234.75.219:43349] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/torsa1.php"] [unique_id "acxyHtdfUS_37wFAM74IOgAAAMk"]
[Wed Apr 01 09:17:19.325746 2026] [:error] [pid 23714:tid 23735] [client 74.234.75.219:46342] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "acxyH0HxDDU2ETcG9DQ-JQAAAAE"]
[Wed Apr 01 09:17:20.523330 2026] [:error] [pid 23715:tid 23767] [client 74.234.75.219:46356] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "acxyIK-REzOruNbiT9yOKAAAAEY"]
[Wed Apr 01 09:17:21.761229 2026] [:error] [pid 23715:tid 23771] [client 74.234.75.219:62467] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "acxyIa-REzOruNbiT9yOLQAAAEo"]
[Wed Apr 01 09:17:22.458207 2026] [:error] [pid 23714:tid 23737] [client 74.234.75.219:39292] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b.php"] [unique_id "acxyIkHxDDU2ETcG9DQ-PAAAAAM"]
[Wed Apr 01 09:17:23.083853 2026] [:error] [pid 23714:tid 23743] [client 74.234.75.219:52568] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vaza.php"] [unique_id "acxyI0HxDDU2ETcG9DQ-RAAAAAk"]
[Wed Apr 01 09:17:23.743574 2026] [:error] [pid 24348:tid 24385] [client 74.234.75.219:4988] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vaza.php"] [unique_id "acxyI20Vs69Y5nF1HA8RcgAAAYY"]
[Wed Apr 01 09:17:24.588436 2026] [:error] [pid 23819:tid 23826] [client 74.234.75.219:55624] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vaza.php"] [unique_id "acxyJNdfUS_37wFAM74IPQAAAMQ"]
[Wed Apr 01 09:17:25.177618 2026] [:error] [pid 23716:tid 23797] [client 74.234.75.219:4991] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vaza.php"] [unique_id "acxyJXVtFUg_mx-RYb6RyQAAAIk"]
[Wed Apr 01 09:17:25.743898 2026] [:error] [pid 24314:tid 24331] [client 74.234.75.219:55561] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bnm.php"] [unique_id "acxyJZRF3FCzjmMUX5YGPAAAAQ0"]
[Wed Apr 01 09:17:26.328455 2026] [:error] [pid 23714:tid 23744] [client 74.234.75.219:45765] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bnm.php"] [unique_id "acxyJkHxDDU2ETcG9DQ-TQAAAAo"]
[Wed Apr 01 09:17:26.993464 2026] [:error] [pid 23716:tid 23809] [client 74.234.75.219:62521] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bnm.php"] [unique_id "acxyJnVtFUg_mx-RYb6RzQAAAJU"]
[Wed Apr 01 09:17:27.566113 2026] [:error] [pid 23714:tid 23758] [client 74.234.75.219:61301] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bnm.php"] [unique_id "acxyJ0HxDDU2ETcG9DQ-UgAAABg"]
[Wed Apr 01 09:17:28.279107 2026] [:error] [pid 23714:tid 23738] [client 74.234.75.219:61256] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "acxyKEHxDDU2ETcG9DQ-VwAAAAQ"]
[Wed Apr 01 09:17:29.208735 2026] [:error] [pid 23716:tid 23802] [client 74.234.75.219:60685] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "acxyKXVtFUg_mx-RYb6R0QAAAI4"]
[Wed Apr 01 09:17:29.934093 2026] [:error] [pid 23716:tid 23799] [client 74.234.75.219:60723] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "acxyKXVtFUg_mx-RYb6R2AAAAIs"]
[Wed Apr 01 09:17:30.510694 2026] [:error] [pid 23716:tid 23798] [client 74.234.75.219:55629] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "acxyKnVtFUg_mx-RYb6R2gAAAIo"]
[Wed Apr 01 09:17:31.174307 2026] [:error] [pid 23715:tid 23771] [client 74.234.75.219:60735] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xc0252.php"] [unique_id "acxyK6-REzOruNbiT9yONAAAAEo"]
[Wed Apr 01 09:17:32.435965 2026] [:error] [pid 24348:tid 24383] [client 74.234.75.219:55592] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xc0252.php"] [unique_id "acxyLG0Vs69Y5nF1HA8RnAAAAYQ"]
[Wed Apr 01 09:17:33.361443 2026] [:error] [pid 24348:tid 24402] [client 74.234.75.219:55613] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xc0252.php"] [unique_id "acxyLW0Vs69Y5nF1HA8RtAAAAZc"]
[Wed Apr 01 09:17:33.963477 2026] [:error] [pid 24346:tid 24362] [client 74.234.75.219:39272] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xc0252.php"] [unique_id "acxyLbc1l8kg9MhGHIKxVwAAAUo"]
[Wed Apr 01 09:17:34.691696 2026] [:error] [pid 23714:tid 23734] [client 74.234.75.219:45089] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/saorix1.php"] [unique_id "acxyLkHxDDU2ETcG9DQ-YgAAAAA"]
[Wed Apr 01 09:17:35.310410 2026] [:error] [pid 23716:tid 23797] [client 74.234.75.219:55608] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/saorix1.php"] [unique_id "acxyL3VtFUg_mx-RYb6SAgAAAIk"]
[Wed Apr 01 09:17:36.052373 2026] [:error] [pid 23714:tid 23757] [client 74.234.75.219:55593] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/saorix1.php"] [unique_id "acxyMEHxDDU2ETcG9DQ-bAAAABc"]
[Wed Apr 01 09:17:36.653289 2026] [:error] [pid 23714:tid 23750] [client 74.234.75.219:62518] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/saorix1.php"] [unique_id "acxyMEHxDDU2ETcG9DQ-bgAAABA"]
[Wed Apr 01 09:17:37.658728 2026] [:error] [pid 23714:tid 23756] [client 74.234.75.219:60678] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "acxyMUHxDDU2ETcG9DQ-cgAAABY"]
[Wed Apr 01 09:17:38.389132 2026] [:error] [pid 23716:tid 23790] [client 74.234.75.219:61278] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "acxyMnVtFUg_mx-RYb6SEQAAAII"]
[Wed Apr 01 09:17:39.173735 2026] [:error] [pid 23716:tid 23800] [client 74.234.75.219:61311] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "acxyM3VtFUg_mx-RYb6SFwAAAIw"]
[Wed Apr 01 09:17:39.858050 2026] [:error] [pid 24348:tid 24380] [client 74.234.75.219:4945] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "acxyM20Vs69Y5nF1HA8RxAAAAYE"]
[Wed Apr 01 09:17:40.439388 2026] [:error] [pid 23715:tid 23771] [client 74.234.75.219:61302] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/admin.php"] [unique_id "acxyNK-REzOruNbiT9yOPQAAAEo"]
[Wed Apr 01 09:17:41.123525 2026] [:error] [pid 24348:tid 24390] [client 74.234.75.219:4945] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/admin.php"] [unique_id "acxyNW0Vs69Y5nF1HA8RxgAAAYs"]
[Wed Apr 01 09:17:41.773773 2026] [:error] [pid 23714:tid 23744] [client 74.234.75.219:4935] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/admin.php"] [unique_id "acxyNUHxDDU2ETcG9DQ-fAAAAAo"]
[Wed Apr 01 09:17:42.307736 2026] [:error] [pid 23716:tid 23797] [client 74.234.75.219:4939] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/admin.php"] [unique_id "acxyNnVtFUg_mx-RYb6SLAAAAIk"]
[Wed Apr 01 09:17:43.305773 2026] [:error] [pid 23714:tid 23743] [client 74.234.75.219:55665] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp3.php"] [unique_id "acxyN0HxDDU2ETcG9DQ-ggAAAAk"]
[Wed Apr 01 09:17:43.927379 2026] [:error] [pid 23714:tid 23740] [client 74.234.75.219:39240] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp3.php"] [unique_id "acxyN0HxDDU2ETcG9DQ-iAAAAAY"]
[Wed Apr 01 09:17:44.688261 2026] [:error] [pid 23716:tid 23794] [client 74.234.75.219:46381] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp3.php"] [unique_id "acxyOHVtFUg_mx-RYb6SMgAAAIY"]
[Wed Apr 01 09:17:45.335807 2026] [:error] [pid 23819:tid 23840] [client 74.234.75.219:61281] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp3.php"] [unique_id "acxyOddfUS_37wFAM74IhgAAANI"]
[Wed Apr 01 09:17:45.954556 2026] [:error] [pid 23714:tid 23757] [client 74.234.75.219:55583] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3.php"] [unique_id "acxyOUHxDDU2ETcG9DQ-jQAAABc"]
[Wed Apr 01 09:17:46.500434 2026] [:error] [pid 23714:tid 23748] [client 74.234.75.219:4985] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3.php"] [unique_id "acxyOkHxDDU2ETcG9DQ-kQAAAA4"]
[Wed Apr 01 09:17:47.292555 2026] [:error] [pid 23714:tid 23736] [client 74.234.75.219:52605] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3.php"] [unique_id "acxyO0HxDDU2ETcG9DQ-lwAAAAI"]
[Wed Apr 01 09:17:48.018746 2026] [:error] [pid 24348:tid 24386] [client 74.234.75.219:46352] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3.php"] [unique_id "acxyPG0Vs69Y5nF1HA8RzAAAAYc"]
[Wed Apr 01 09:17:48.784847 2026] [:error] [pid 23714:tid 23751] [client 74.234.75.219:60724] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "acxyPEHxDDU2ETcG9DQ-nQAAABE"]
[Wed Apr 01 09:17:49.573738 2026] [:error] [pid 23714:tid 23756] [client 74.234.75.219:55633] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "acxyPUHxDDU2ETcG9DQ-ogAAABY"]
[Wed Apr 01 09:17:50.562431 2026] [:error] [pid 23819:tid 23837] [client 74.234.75.219:5066] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "acxyPtdfUS_37wFAM74IiwAAAM8"]
[Wed Apr 01 09:17:51.399336 2026] [:error] [pid 23715:tid 23779] [client 74.234.75.219:39249] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "acxyP6-REzOruNbiT9yOSAAAAFI"]
[Wed Apr 01 09:17:52.161194 2026] [:error] [pid 23714:tid 23740] [client 74.234.75.219:52574] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d2.php"] [unique_id "acxyQEHxDDU2ETcG9DQ-qQAAAAY"]
[Wed Apr 01 09:17:52.878997 2026] [:error] [pid 23716:tid 23809] [client 74.234.75.219:4962] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d2.php"] [unique_id "acxyQHVtFUg_mx-RYb6SOwAAAJU"]
[Wed Apr 01 09:17:53.483401 2026] [:error] [pid 23714:tid 23752] [client 74.234.75.219:45067] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d2.php"] [unique_id "acxyQUHxDDU2ETcG9DQ-rgAAABI"]
[Wed Apr 01 09:17:54.217154 2026] [:error] [pid 23714:tid 23740] [client 74.234.75.219:43390] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d2.php"] [unique_id "acxyQkHxDDU2ETcG9DQ-tAAAAAY"]
[Wed Apr 01 09:17:54.825871 2026] [:error] [pid 23714:tid 23745] [client 74.234.75.219:61295] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xc.php"] [unique_id "acxyQkHxDDU2ETcG9DQ-uQAAAAs"]
[Wed Apr 01 09:17:55.557274 2026] [:error] [pid 24346:tid 24359] [client 74.234.75.219:39274] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xc.php"] [unique_id "acxyQ7c1l8kg9MhGHIKxYQAAAUc"]
[Wed Apr 01 09:17:56.097336 2026] [:error] [pid 23819:tid 23827] [client 74.234.75.219:5110] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xc.php"] [unique_id "acxyRNdfUS_37wFAM74ImgAAAMU"]
[Wed Apr 01 09:17:56.732179 2026] [:error] [pid 23715:tid 23771] [client 74.234.75.219:55612] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xc.php"] [unique_id "acxyRK-REzOruNbiT9yOUwAAAEo"]
[Wed Apr 01 09:17:57.497723 2026] [:error] [pid 23714:tid 23757] [client 74.234.75.219:61250] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "acxyRUHxDDU2ETcG9DQ-xQAAABc"]
[Wed Apr 01 09:17:58.318532 2026] [:error] [pid 23714:tid 23740] [client 74.234.75.219:62508] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "acxyRkHxDDU2ETcG9DQ-yQAAAAY"]
[Wed Apr 01 09:17:59.028733 2026] [:error] [pid 24348:tid 24388] [client 74.234.75.219:55637] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "acxyR20Vs69Y5nF1HA8R3AAAAYk"]
[Wed Apr 01 09:17:59.720401 2026] [:error] [pid 24348:tid 24380] [client 74.234.75.219:39270] [client 74.234.75.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "acxyR20Vs69Y5nF1HA8R3gAAAYE"]
[Wed Apr 01 09:25:15.379760 2026] [:error] [pid 23714:tid 23736] [client 43.164.195.17:58914] [client 43.164.195.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acxz-0HxDDU2ETcG9DREbAAAAAI"]
[Wed Apr 01 10:50:17.931192 2026] [:error] [pid 23716:tid 23793] [client 94.72.108.131:54505] [client 94.72.108.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.72.108.131, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acyH6XVtFUg_mx-RYb7G1AAAAIU"]
[Wed Apr 01 11:59:36.299049 2026] [:error] [pid 24348:tid 24384] [client 94.72.108.131:63307] [client 94.72.108.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.72.108.131, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "acyYKG0Vs69Y5nF1HA9T3AAAAYU"]
[Wed Apr 01 12:11:50.569939 2026] [:error] [pid 23819:tid 23844] [client 43.130.67.33:48988] [client 43.130.67.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acybBtdfUS_37wFAM75AgAAAANY"]
[Wed Apr 01 14:09:16.702167 2026] [:error] [pid 8995:tid 9010] [client 170.106.180.153:53830] [client 170.106.180.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acy2jOonaBjs3qxcRecgVgAAAAw"]
[Wed Apr 01 16:07:32.174738 2026] [:error] [pid 8909:tid 8947] [client 51.211.241.148:26321] [client 51.211.241.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.211.241.148, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aczSRDvP_a0662gDl6DYQQAAAMY"]
[Wed Apr 01 17:01:11.838893 2026] [:error] [pid 8908:tid 8925] [client 43.130.111.40:50060] [client 43.130.111.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "acze1_kmxtJXGnLdvgAXewAAAIw"]
[Wed Apr 01 17:36:50.646339 2026] [:error] [pid 8910:tid 8981] [client 141.95.193.82:35546] [client 141.95.193.82] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acznMqJZINUcF3tYgEwrBgAAAQ0"]
[Wed Apr 01 17:36:58.690930 2026] [:error] [pid 17856:tid 17881] [client 38.150.32.44:55094] [client 38.150.32.44] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acznOj7Idlm5j9frhqSukQAAAFc"]
[Wed Apr 01 17:37:08.935105 2026] [:error] [pid 8909:tid 8941] [client 51.222.15.106:39144] [client 51.222.15.106] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acznRDvP_a0662gDl6AUYQAAAMA"]
[Wed Apr 01 18:44:00.460821 2026] [:error] [pid 8909:tid 8965] [client 43.165.65.75:39628] [client 43.165.65.75] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "acz28DvP_a0662gDl6BKpAAAANg"]
[Wed Apr 01 20:45:16.766001 2026] [:error] [pid 8909:tid 8941] [client 13.239.64.54:57544] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "ac0TXDvP_a0662gDl6C2VQAAAMA"]
[Wed Apr 01 20:45:16.861041 2026] [:error] [pid 8909:tid 8963] [client 13.239.64.54:57906] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.local"] [unique_id "ac0TXDvP_a0662gDl6C2VwAAANY"]
[Wed Apr 01 20:45:16.919812 2026] [:error] [pid 8909:tid 8943] [client 13.239.64.54:57908] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.production"] [unique_id "ac0TXDvP_a0662gDl6C2WAAAAMI"]
[Wed Apr 01 20:45:16.978732 2026] [:error] [pid 8909:tid 8948] [client 13.239.64.54:57912] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.staging"] [unique_id "ac0TXDvP_a0662gDl6C2WQAAAMc"]
[Wed Apr 01 20:45:17.036870 2026] [:error] [pid 8910:tid 8985] [client 13.239.64.54:57916] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.development"] [unique_id "ac0TXaJZINUcF3tYgExciwAAARE"]
[Wed Apr 01 20:45:17.096414 2026] [:error] [pid 17856:tid 17870] [client 13.239.64.54:57918] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.test"] [unique_id "ac0TXT7Idlm5j9frhqQlawAAAEw"]
[Wed Apr 01 20:45:17.151489 2026] [:error] [pid 8909:tid 8964] [client 13.239.64.54:57920] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.remote"] [unique_id "ac0TXTvP_a0662gDl6C2WwAAANc"]
[Wed Apr 01 20:45:17.212624 2026] [:error] [pid 8910:tid 8972] [client 13.239.64.54:57924] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.bak"] [unique_id "ac0TXaJZINUcF3tYgExcjAAAAQQ"]
[Wed Apr 01 20:45:17.272698 2026] [:error] [pid 17856:tid 17860] [client 13.239.64.54:57928] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.backup"] [unique_id "ac0TXT7Idlm5j9frhqQlbQAAAEI"]
[Wed Apr 01 20:45:17.326450 2026] [:error] [pid 8909:tid 8959] [client 13.239.64.54:57930] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.save"] [unique_id "ac0TXTvP_a0662gDl6C2YAAAANI"]
[Wed Apr 01 20:45:17.425466 2026] [:error] [pid 17856:tid 17867] [client 13.239.64.54:57934] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.old"] [unique_id "ac0TXT7Idlm5j9frhqQlcAAAAEk"]
[Wed Apr 01 20:45:17.486960 2026] [:error] [pid 62559:tid 62565] [client 13.239.64.54:57936] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.sample"] [unique_id "ac0TXS7NKI8IaNKZFIeXwAAAAUQ"]
[Wed Apr 01 20:45:17.562820 2026] [:error] [pid 8909:tid 8963] [client 13.239.64.54:57938] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/vendor/.env"] [unique_id "ac0TXTvP_a0662gDl6C2YwAAANY"]
[Wed Apr 01 20:45:17.659335 2026] [:error] [pid 8910:tid 8982] [client 13.239.64.54:57942] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/lib/.env"] [unique_id "ac0TXaJZINUcF3tYgExcjgAAAQ4"]
[Wed Apr 01 20:45:17.716339 2026] [:error] [pid 8909:tid 8960] [client 13.239.64.54:57950] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/lab/.env"] [unique_id "ac0TXTvP_a0662gDl6C2ZQAAANM"]
[Wed Apr 01 20:45:17.774755 2026] [:error] [pid 8909:tid 8954] [client 13.239.64.54:57952] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/cronlab/.env"] [unique_id "ac0TXTvP_a0662gDl6C2ZwAAAM0"]
[Wed Apr 01 20:45:17.901279 2026] [:error] [pid 8910:tid 8977] [client 13.239.64.54:57956] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/cron/.env"] [unique_id "ac0TXaJZINUcF3tYgExcjwAAAQk"]
[Wed Apr 01 20:45:17.986870 2026] [:error] [pid 8909:tid 8942] [client 13.239.64.54:57958] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/core/.env"] [unique_id "ac0TXTvP_a0662gDl6C2aAAAAME"]
[Wed Apr 01 20:45:18.056725 2026] [:error] [pid 8909:tid 8959] [client 13.239.64.54:57962] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/core/app/.env"] [unique_id "ac0TXjvP_a0662gDl6C2agAAANI"]
[Wed Apr 01 20:45:18.112411 2026] [:error] [pid 8909:tid 8941] [client 13.239.64.54:57964] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/core/Datavase/.env"] [unique_id "ac0TXjvP_a0662gDl6C2bAAAAMA"]
[Wed Apr 01 20:45:18.171550 2026] [:error] [pid 8908:tid 8915] [client 13.239.64.54:57966] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/database/.env"] [unique_id "ac0TXvkmxtJXGnLdvgCBPwAAAII"]
[Wed Apr 01 20:45:18.235155 2026] [:error] [pid 8909:tid 8956] [client 13.239.64.54:57970] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/config/.env"] [unique_id "ac0TXjvP_a0662gDl6C2bwAAAM8"]
[Wed Apr 01 20:45:18.340884 2026] [:error] [pid 8909:tid 8943] [client 13.239.64.54:57976] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/assets/.env"] [unique_id "ac0TXjvP_a0662gDl6C2cQAAAMI"]
[Wed Apr 01 20:45:18.400682 2026] [:error] [pid 8909:tid 8960] [client 13.239.64.54:57978] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/app/.env"] [unique_id "ac0TXjvP_a0662gDl6C2cgAAANM"]
[Wed Apr 01 20:45:18.459492 2026] [:error] [pid 8909:tid 8957] [client 13.239.64.54:57982] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/apps/.env"] [unique_id "ac0TXjvP_a0662gDl6C2cwAAANA"]
[Wed Apr 01 20:45:18.515948 2026] [:error] [pid 17856:tid 17862] [client 13.239.64.54:57984] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/uploads/.env"] [unique_id "ac0TXj7Idlm5j9frhqQlcwAAAEQ"]
[Wed Apr 01 20:45:18.575152 2026] [:error] [pid 8909:tid 8965] [client 13.239.64.54:57986] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sitemaps/.env"] [unique_id "ac0TXjvP_a0662gDl6C2dQAAANg"]
[Wed Apr 01 20:45:18.697597 2026] [:error] [pid 8909:tid 8959] [client 13.239.64.54:57988] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/saas/.env"] [unique_id "ac0TXjvP_a0662gDl6C2dgAAANI"]
[Wed Apr 01 20:45:18.756201 2026] [:error] [pid 8909:tid 8941] [client 13.239.64.54:57992] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/api/.env"] [unique_id "ac0TXjvP_a0662gDl6C2eAAAAMA"]
[Wed Apr 01 20:45:18.865392 2026] [:error] [pid 8909:tid 8949] [client 13.239.64.54:57996] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/psnlink/.env"] [unique_id "ac0TXjvP_a0662gDl6C2egAAAMg"]
[Wed Apr 01 20:45:18.935547 2026] [:error] [pid 8909:tid 8948] [client 13.239.64.54:57998] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/exapi/.env"] [unique_id "ac0TXjvP_a0662gDl6C2fAAAAMc"]
[Wed Apr 01 20:45:19.056747 2026] [:error] [pid 8909:tid 8960] [client 13.239.64.54:58000] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/site/.env"] [unique_id "ac0TXzvP_a0662gDl6C2fgAAANM"]
[Wed Apr 01 20:45:19.115562 2026] [:error] [pid 8909:tid 8954] [client 13.239.64.54:58002] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/admin/.env"] [unique_id "ac0TXzvP_a0662gDl6C2gAAAAM0"]
[Wed Apr 01 20:45:19.171876 2026] [:error] [pid 8909:tid 8946] [client 13.239.64.54:58004] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/web/.env"] [unique_id "ac0TXzvP_a0662gDl6C2ggAAAMU"]
[Wed Apr 01 20:45:19.279779 2026] [:error] [pid 17856:tid 17877] [client 13.239.64.54:58006] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/public/.env"] [unique_id "ac0TXz7Idlm5j9frhqQldQAAAFM"]
[Wed Apr 01 20:45:19.361248 2026] [:error] [pid 17856:tid 17864] [client 13.239.64.54:58010] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/en/.env"] [unique_id "ac0TXz7Idlm5j9frhqQldwAAAEY"]
[Wed Apr 01 20:45:19.447665 2026] [:error] [pid 17856:tid 17859] [client 13.239.64.54:58014] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/tools/.env"] [unique_id "ac0TXz7Idlm5j9frhqQleQAAAEE"]
[Wed Apr 01 20:45:19.505361 2026] [:error] [pid 17856:tid 17872] [client 13.239.64.54:58016] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/v1/.env"] [unique_id "ac0TXz7Idlm5j9frhqQlegAAAE4"]
[Wed Apr 01 20:45:19.561424 2026] [:error] [pid 8909:tid 8953] [client 13.239.64.54:58018] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/v2/.env"] [unique_id "ac0TXzvP_a0662gDl6C2hwAAAMw"]
[Wed Apr 01 20:45:19.618431 2026] [:error] [pid 8909:tid 8955] [client 13.239.64.54:58020] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/administrator/.env"] [unique_id "ac0TXzvP_a0662gDl6C2iAAAAM4"]
[Wed Apr 01 20:45:19.762214 2026] [:error] [pid 8910:tid 8974] [client 13.239.64.54:58026] [client 13.239.64.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/laravel/.env"] [unique_id "ac0TX6JZINUcF3tYgExckQAAAQY"]
[Wed Apr 01 20:49:16.288999 2026] [:error] [pid 17856:tid 17860] [client 45.55.251.82:61585] [client 45.55.251.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.55.251.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ac0UTD7Idlm5j9frhqQp_gAAAEI"]
[Wed Apr 01 20:49:17.709642 2026] [:error] [pid 8910:tid 8985] [client 45.55.251.82:61699] [client 45.55.251.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.55.251.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ac0UTaJZINUcF3tYgExd_wAAARE"]
[Wed Apr 01 21:06:22.390536 2026] [:error] [pid 8908:tid 8922] [client 45.55.251.82:57878] [client 45.55.251.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.55.251.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ac0YTvkmxtJXGnLdvgCJ8AAAAIk"]
[Wed Apr 01 22:06:20.929132 2026] [:error] [pid 8910:tid 8989] [client 4.223.158.175:1415] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hnphq.php"] [unique_id "ac0mXKJZINUcF3tYgExwUQAAARU"]
[Wed Apr 01 22:06:21.476986 2026] [:error] [pid 62559:tid 62575] [client 4.223.158.175:19374] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hnphq.php"] [unique_id "ac0mXS7NKI8IaNKZFIe0AAAAAU4"]
[Wed Apr 01 22:06:22.015206 2026] [:error] [pid 8909:tid 8956] [client 4.223.158.175:1372] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hnphq.php"] [unique_id "ac0mXjvP_a0662gDl6DtTgAAAM8"]
[Wed Apr 01 22:06:22.549266 2026] [:error] [pid 8909:tid 8955] [client 4.223.158.175:18825] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hnphq.php"] [unique_id "ac0mXjvP_a0662gDl6DtVwAAAM4"]
[Wed Apr 01 22:06:23.074378 2026] [:error] [pid 8910:tid 8977] [client 4.223.158.175:19344] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "ac0mX6JZINUcF3tYgExwVAAAAQk"]
[Wed Apr 01 22:06:23.601269 2026] [:error] [pid 8995:tid 9021] [client 4.223.158.175:17570] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "ac0mX-onaBjs3qxcRefbGAAAABc"]
[Wed Apr 01 22:06:24.136651 2026] [:error] [pid 8908:tid 8927] [client 4.223.158.175:1356] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "ac0mYPkmxtJXGnLdvgCjUgAAAI4"]
[Wed Apr 01 22:06:24.668437 2026] [:error] [pid 8908:tid 8919] [client 4.223.158.175:26745] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b4txckoieeyhynhsrpi9lCdefault.php"] [unique_id "ac0mYPkmxtJXGnLdvgCjUwAAAIY"]
[Wed Apr 01 22:06:25.194485 2026] [:error] [pid 8909:tid 8952] [client 4.223.158.175:15860] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "ac0mYTvP_a0662gDl6DtZAAAAMs"]
[Wed Apr 01 22:06:25.724093 2026] [:error] [pid 17856:tid 17876] [client 4.223.158.175:9716] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "ac0mYT7Idlm5j9frhqReaQAAAFI"]
[Wed Apr 01 22:06:26.249930 2026] [:error] [pid 17856:tid 17864] [client 4.223.158.175:19332] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "ac0mYj7Idlm5j9frhqRebAAAAEY"]
[Wed Apr 01 22:06:26.776816 2026] [:error] [pid 17856:tid 17867] [client 4.223.158.175:11729] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "ac0mYj7Idlm5j9frhqRecwAAAEk"]
[Wed Apr 01 22:06:27.300087 2026] [:error] [pid 8908:tid 8923] [client 4.223.158.175:11713] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "ac0mY_kmxtJXGnLdvgCjWQAAAIo"]
[Wed Apr 01 22:06:27.824778 2026] [:error] [pid 62559:tid 62566] [client 4.223.158.175:1347] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "ac0mYy7NKI8IaNKZFIe0BgAAAUU"]
[Wed Apr 01 22:06:28.359162 2026] [:error] [pid 17856:tid 17861] [client 4.223.158.175:22914] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "ac0mZD7Idlm5j9frhqReeQAAAEM"]
[Wed Apr 01 22:06:28.884635 2026] [:error] [pid 8908:tid 8937] [client 4.223.158.175:15813] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "ac0mZPkmxtJXGnLdvgCjWwAAAJg"]
[Wed Apr 01 22:06:29.420620 2026] [:error] [pid 8908:tid 8924] [client 4.223.158.175:9709] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-class-20260318124352.php"] [unique_id "ac0mZfkmxtJXGnLdvgCjXQAAAIs"]
[Wed Apr 01 22:06:29.956188 2026] [:error] [pid 8908:tid 8916] [client 4.223.158.175:1698] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-class-20260318124352.php"] [unique_id "ac0mZfkmxtJXGnLdvgCjYAAAAIM"]
[Wed Apr 01 22:06:30.495047 2026] [:error] [pid 8908:tid 8926] [client 4.223.158.175:1035] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-class-20260318124352.php"] [unique_id "ac0mZvkmxtJXGnLdvgCjYgAAAI0"]
[Wed Apr 01 22:06:31.021674 2026] [:error] [pid 8909:tid 8951] [client 4.223.158.175:20388] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-class-20260318124352.php"] [unique_id "ac0mZzvP_a0662gDl6DtdgAAAMo"]
[Wed Apr 01 22:06:31.560586 2026] [:error] [pid 8909:tid 8950] [client 4.223.158.175:63735] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac0mZzvP_a0662gDl6DtfAAAAMk"]
[Wed Apr 01 22:06:32.093610 2026] [:error] [pid 8910:tid 8989] [client 4.223.158.175:24455] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac0maKJZINUcF3tYgExwYgAAARU"]
[Wed Apr 01 22:06:32.623292 2026] [:error] [pid 8995:tid 9019] [client 4.223.158.175:1357] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac0maOonaBjs3qxcRefbIgAAABU"]
[Wed Apr 01 22:06:33.186592 2026] [:error] [pid 17856:tid 17881] [client 4.223.158.175:26693] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5xkfgawzejgwqh9hiaznCdefault.php"] [unique_id "ac0maT7Idlm5j9frhqRehgAAAFc"]
[Wed Apr 01 22:06:33.729031 2026] [:error] [pid 62559:tid 62568] [client 4.223.158.175:17555] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "ac0maS7NKI8IaNKZFIe0FAAAAUc"]
[Wed Apr 01 22:06:34.264350 2026] [:error] [pid 8909:tid 8959] [client 4.223.158.175:16576] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "ac0majvP_a0662gDl6DtjAAAANI"]
[Wed Apr 01 22:06:34.788203 2026] [:error] [pid 62559:tid 62578] [client 4.223.158.175:18835] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "ac0mai7NKI8IaNKZFIe0GQAAAVE"]
[Wed Apr 01 22:06:35.329956 2026] [:error] [pid 62559:tid 62564] [client 4.223.158.175:1674] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "ac0may7NKI8IaNKZFIe0IAAAAUM"]
[Wed Apr 01 22:06:35.858464 2026] [:error] [pid 8908:tid 8917] [client 4.223.158.175:63728] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "ac0ma_kmxtJXGnLdvgCjaQAAAIQ"]
[Wed Apr 01 22:06:36.388353 2026] [:error] [pid 8909:tid 8951] [client 4.223.158.175:19380] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "ac0mbDvP_a0662gDl6DtjQAAAMo"]
[Wed Apr 01 22:06:36.920584 2026] [:error] [pid 8908:tid 8923] [client 4.223.158.175:15817] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "ac0mbPkmxtJXGnLdvgCjcAAAAIo"]
[Wed Apr 01 22:06:37.491507 2026] [:error] [pid 8909:tid 8948] [client 4.223.158.175:21943] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/q7lhrgzoo7ijhnkcedq2Cdefault.php"] [unique_id "ac0mbTvP_a0662gDl6DtlAAAAMc"]
[Wed Apr 01 22:06:38.018866 2026] [:error] [pid 8909:tid 8942] [client 4.223.158.175:9706] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kthusnjbc8ab0jiryls2jinCdefault.php"] [unique_id "ac0mbjvP_a0662gDl6DtlgAAAME"]
[Wed Apr 01 22:06:38.551123 2026] [:error] [pid 8909:tid 8957] [client 4.223.158.175:9704] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kthusnjbc8ab0jiryls2jinCdefault.php"] [unique_id "ac0mbjvP_a0662gDl6DtnAAAANA"]
[Wed Apr 01 22:06:39.085008 2026] [:error] [pid 8995:tid 9017] [client 4.223.158.175:1401] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kthusnjbc8ab0jiryls2jinCdefault.php"] [unique_id "ac0mb-onaBjs3qxcRefbJgAAABM"]
[Wed Apr 01 22:06:39.617770 2026] [:error] [pid 8908:tid 8933] [client 4.223.158.175:19389] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kthusnjbc8ab0jiryls2jinCdefault.php"] [unique_id "ac0mb_kmxtJXGnLdvgCjdgAAAJQ"]
[Wed Apr 01 22:06:40.151463 2026] [:error] [pid 8910:tid 8969] [client 4.223.158.175:15859] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/only.php"] [unique_id "ac0mcKJZINUcF3tYgExwbAAAAQE"]
[Wed Apr 01 22:06:40.683682 2026] [:error] [pid 8995:tid 9001] [client 4.223.158.175:29262] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/only.php"] [unique_id "ac0mcOonaBjs3qxcRefbMAAAAAM"]
[Wed Apr 01 22:06:41.238660 2026] [:error] [pid 8909:tid 8963] [client 4.223.158.175:22487] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/only.php"] [unique_id "ac0mcTvP_a0662gDl6DtoQAAANY"]
[Wed Apr 01 22:06:41.786458 2026] [:error] [pid 8909:tid 8955] [client 4.223.158.175:15811] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/only.php"] [unique_id "ac0mcTvP_a0662gDl6DtogAAAM4"]
[Wed Apr 01 22:06:42.315600 2026] [:error] [pid 8908:tid 8929] [client 4.223.158.175:19646] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/repurify.php"] [unique_id "ac0mcvkmxtJXGnLdvgCjfQAAAJA"]
[Wed Apr 01 22:06:42.847417 2026] [:error] [pid 8908:tid 8937] [client 4.223.158.175:18832] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/repurify.php"] [unique_id "ac0mcvkmxtJXGnLdvgCjfwAAAJg"]
[Wed Apr 01 22:06:43.392854 2026] [:error] [pid 8909:tid 8956] [client 4.223.158.175:1426] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/repurify.php"] [unique_id "ac0mczvP_a0662gDl6DtqAAAAM8"]
[Wed Apr 01 22:06:43.919798 2026] [:error] [pid 17856:tid 17868] [client 4.223.158.175:15320] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/repurify.php"] [unique_id "ac0mcz7Idlm5j9frhqRelwAAAEo"]
[Wed Apr 01 22:06:44.461890 2026] [:error] [pid 8910:tid 8987] [client 4.223.158.175:19599] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tdsaz.php"] [unique_id "ac0mdKJZINUcF3tYgExwcgAAARM"]
[Wed Apr 01 22:06:44.988326 2026] [:error] [pid 17856:tid 17860] [client 4.223.158.175:15825] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tdsaz.php"] [unique_id "ac0mdD7Idlm5j9frhqRemgAAAEI"]
[Wed Apr 01 22:06:45.519378 2026] [:error] [pid 8909:tid 8955] [client 4.223.158.175:1712] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tdsaz.php"] [unique_id "ac0mdTvP_a0662gDl6DtrQAAAM4"]
[Wed Apr 01 22:06:46.043695 2026] [:error] [pid 8909:tid 8965] [client 4.223.158.175:16616] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tdsaz.php"] [unique_id "ac0mdjvP_a0662gDl6DtsQAAANg"]
[Wed Apr 01 22:06:46.571434 2026] [:error] [pid 8908:tid 8919] [client 4.223.158.175:22488] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "ac0mdvkmxtJXGnLdvgCjgQAAAIY"]
[Wed Apr 01 22:06:47.097736 2026] [:error] [pid 8908:tid 8915] [client 4.223.158.175:29994] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "ac0md_kmxtJXGnLdvgCjggAAAII"]
[Wed Apr 01 22:06:47.632704 2026] [:error] [pid 17856:tid 17865] [client 4.223.158.175:15340] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "ac0mdz7Idlm5j9frhqReoAAAAEc"]
[Wed Apr 01 22:06:48.160601 2026] [:error] [pid 17856:tid 17870] [client 4.223.158.175:1451] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "ac0meD7Idlm5j9frhqReowAAAEw"]
[Wed Apr 01 22:06:48.700669 2026] [:error] [pid 17856:tid 17876] [client 4.223.158.175:29294] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hfles.php"] [unique_id "ac0meD7Idlm5j9frhqRepgAAAFI"]
[Wed Apr 01 22:06:49.232743 2026] [:error] [pid 8909:tid 8951] [client 4.223.158.175:1459] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hfles.php"] [unique_id "ac0meTvP_a0662gDl6DtuAAAAMo"]
[Wed Apr 01 22:06:49.771535 2026] [:error] [pid 62559:tid 62566] [client 4.223.158.175:12991] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hfles.php"] [unique_id "ac0meS7NKI8IaNKZFIe0PgAAAUU"]
[Wed Apr 01 22:06:50.305294 2026] [:error] [pid 8909:tid 8952] [client 4.223.158.175:18823] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hfles.php"] [unique_id "ac0mejvP_a0662gDl6DtugAAAMs"]
[Wed Apr 01 22:06:50.830496 2026] [:error] [pid 8910:tid 8989] [client 4.223.158.175:19342] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "ac0meqJZINUcF3tYgExwdgAAARU"]
[Wed Apr 01 22:06:51.363216 2026] [:error] [pid 17856:tid 17874] [client 4.223.158.175:21120] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "ac0mez7Idlm5j9frhqRergAAAFA"]
[Wed Apr 01 22:06:51.895707 2026] [:error] [pid 8995:tid 8998] [client 4.223.158.175:28700] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "ac0me-onaBjs3qxcRefbNgAAAAA"]
[Wed Apr 01 22:06:52.420059 2026] [:error] [pid 62559:tid 62576] [client 4.223.158.175:29259] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "ac0mfC7NKI8IaNKZFIe0TgAAAU8"]
[Wed Apr 01 22:06:52.945085 2026] [:error] [pid 8908:tid 8937] [client 4.223.158.175:11691] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "ac0mfPkmxtJXGnLdvgCjmwAAAJg"]
[Wed Apr 01 22:06:53.481131 2026] [:error] [pid 8910:tid 8985] [client 4.223.158.175:28680] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "ac0mfaJZINUcF3tYgExwewAAARE"]
[Wed Apr 01 22:06:54.017838 2026] [:error] [pid 17856:tid 17872] [client 4.223.158.175:1419] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "ac0mfj7Idlm5j9frhqReswAAAE4"]
[Wed Apr 01 22:06:54.556666 2026] [:error] [pid 8908:tid 8914] [client 4.223.158.175:19624] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "ac0mfvkmxtJXGnLdvgCjpQAAAIE"]
[Wed Apr 01 22:06:55.097822 2026] [:error] [pid 17856:tid 17874] [client 4.223.158.175:13050] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-class-20260318122951.php"] [unique_id "ac0mfz7Idlm5j9frhqRetwAAAFA"]
[Wed Apr 01 22:06:55.634855 2026] [:error] [pid 17856:tid 17879] [client 4.223.158.175:16623] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-class-20260318122951.php"] [unique_id "ac0mfz7Idlm5j9frhqRevAAAAFU"]
[Wed Apr 01 22:06:56.174609 2026] [:error] [pid 17856:tid 17859] [client 4.223.158.175:15771] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-class-20260318122951.php"] [unique_id "ac0mgD7Idlm5j9frhqRewQAAAEE"]
[Wed Apr 01 22:06:56.715045 2026] [:error] [pid 8908:tid 8937] [client 4.223.158.175:11648] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-class-20260318122951.php"] [unique_id "ac0mgPkmxtJXGnLdvgCjqgAAAJg"]
[Wed Apr 01 22:06:57.244682 2026] [:error] [pid 8909:tid 8951] [client 4.223.158.175:16615] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "ac0mgTvP_a0662gDl6DtywAAAMo"]
[Wed Apr 01 22:06:57.782174 2026] [:error] [pid 8909:tid 8960] [client 4.223.158.175:12982] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "ac0mgTvP_a0662gDl6DtzwAAANM"]
[Wed Apr 01 22:06:58.338679 2026] [:error] [pid 8909:tid 8941] [client 4.223.158.175:19365] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "ac0mgjvP_a0662gDl6Dt1AAAAMA"]
[Wed Apr 01 22:06:58.865347 2026] [:error] [pid 8909:tid 8951] [client 4.223.158.175:35702] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "ac0mgjvP_a0662gDl6Dt1wAAAMo"]
[Wed Apr 01 22:06:59.390252 2026] [:error] [pid 8909:tid 8955] [client 4.223.158.175:22524] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-moonka.php"] [unique_id "ac0mgzvP_a0662gDl6Dt3AAAAM4"]
[Wed Apr 01 22:06:59.920352 2026] [:error] [pid 8909:tid 8942] [client 4.223.158.175:15333] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-moonka.php"] [unique_id "ac0mgzvP_a0662gDl6Dt4wAAAME"]
[Wed Apr 01 22:07:00.457117 2026] [:error] [pid 8909:tid 8945] [client 4.223.158.175:1979] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-moonka.php"] [unique_id "ac0mhDvP_a0662gDl6Dt6wAAAMQ"]
[Wed Apr 01 22:07:00.990660 2026] [:error] [pid 8910:tid 8992] [client 4.223.158.175:29261] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-moonka.php"] [unique_id "ac0mhKJZINUcF3tYgExwfwAAARg"]
[Wed Apr 01 22:07:01.521688 2026] [:error] [pid 62559:tid 62565] [client 4.223.158.175:35673] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "ac0mhS7NKI8IaNKZFIe0VgAAAUQ"]
[Wed Apr 01 22:07:02.048074 2026] [:error] [pid 17856:tid 17863] [client 4.223.158.175:21177] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "ac0mhj7Idlm5j9frhqRe0AAAAEU"]
[Wed Apr 01 22:07:02.582904 2026] [:error] [pid 17856:tid 17868] [client 4.223.158.175:29278] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "ac0mhj7Idlm5j9frhqRe1AAAAEo"]
[Wed Apr 01 22:07:03.114883 2026] [:error] [pid 8908:tid 8934] [client 4.223.158.175:19076] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "ac0mh_kmxtJXGnLdvgCjtAAAAJU"]
[Wed Apr 01 22:07:03.657541 2026] [:error] [pid 8909:tid 8956] [client 4.223.158.175:35692] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ta0ol.php"] [unique_id "ac0mhzvP_a0662gDl6Dt_QAAAM8"]
[Wed Apr 01 22:07:04.189305 2026] [:error] [pid 8909:tid 8951] [client 4.223.158.175:22478] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ta0ol.php"] [unique_id "ac0miDvP_a0662gDl6DuAQAAAMo"]
[Wed Apr 01 22:07:04.719503 2026] [:error] [pid 17856:tid 17873] [client 4.223.158.175:1925] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ta0ol.php"] [unique_id "ac0miD7Idlm5j9frhqRe4gAAAE8"]
[Wed Apr 01 22:07:05.258478 2026] [:error] [pid 8909:tid 8953] [client 4.223.158.175:15307] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ta0ol.php"] [unique_id "ac0miTvP_a0662gDl6DuCAAAAMw"]
[Wed Apr 01 22:07:05.784319 2026] [:error] [pid 8995:tid 8999] [client 4.223.158.175:19620] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "ac0mieonaBjs3qxcRefbPwAAAAE"]
[Wed Apr 01 22:07:06.316046 2026] [:error] [pid 17856:tid 17875] [client 4.223.158.175:15031] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "ac0mij7Idlm5j9frhqRe6wAAAFE"]
[Wed Apr 01 22:07:06.859436 2026] [:error] [pid 8910:tid 8978] [client 4.223.158.175:15002] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "ac0miqJZINUcF3tYgExwgAAAAQo"]
[Wed Apr 01 22:07:07.403013 2026] [:error] [pid 62559:tid 62579] [client 4.223.158.175:11705] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/irpl4xz4fmlzm4tlvvu4h1mCdefault.php"] [unique_id "ac0miy7NKI8IaNKZFIe0ZwAAAVI"]
[Wed Apr 01 22:07:07.942811 2026] [:error] [pid 62559:tid 62565] [client 4.223.158.175:30007] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "ac0miy7NKI8IaNKZFIe0aAAAAUQ"]
[Wed Apr 01 22:07:08.470833 2026] [:error] [pid 8995:tid 9022] [client 4.223.158.175:33764] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "ac0mjOonaBjs3qxcRefbRAAAABg"]
[Wed Apr 01 22:07:09.003252 2026] [:error] [pid 8909:tid 8964] [client 4.223.158.175:29266] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "ac0mjTvP_a0662gDl6DuDwAAANc"]
[Wed Apr 01 22:07:09.532025 2026] [:error] [pid 8995:tid 9017] [client 4.223.158.175:15307] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "ac0mjeonaBjs3qxcRefbSQAAABM"]
[Wed Apr 01 22:07:10.060394 2026] [:error] [pid 62559:tid 62570] [client 4.223.158.175:21163] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "ac0mji7NKI8IaNKZFIe0bQAAAUk"]
[Wed Apr 01 22:07:10.589183 2026] [:error] [pid 17856:tid 17875] [client 4.223.158.175:12992] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "ac0mjj7Idlm5j9frhqRe8gAAAFE"]
[Wed Apr 01 22:07:11.113213 2026] [:error] [pid 17856:tid 17882] [client 4.223.158.175:19110] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "ac0mjz7Idlm5j9frhqRe-AAAAFg"]
[Wed Apr 01 22:07:11.643754 2026] [:error] [pid 8908:tid 8919] [client 4.223.158.175:29287] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "ac0mj_kmxtJXGnLdvgCjwAAAAIY"]
[Wed Apr 01 22:07:12.176142 2026] [:error] [pid 62559:tid 62575] [client 4.223.158.175:15331] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "ac0mkC7NKI8IaNKZFIe0cAAAAU4"]
[Wed Apr 01 22:07:12.720464 2026] [:error] [pid 8908:tid 8914] [client 4.223.158.175:15338] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "ac0mkPkmxtJXGnLdvgCjwwAAAIE"]
[Wed Apr 01 22:07:13.255799 2026] [:error] [pid 8909:tid 8963] [client 4.223.158.175:12983] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "ac0mkTvP_a0662gDl6DuGwAAANY"]
[Wed Apr 01 22:07:13.778874 2026] [:error] [pid 8908:tid 8934] [client 4.223.158.175:29976] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "ac0mkfkmxtJXGnLdvgCjyQAAAJU"]
[Wed Apr 01 22:07:14.309401 2026] [:error] [pid 17856:tid 17876] [client 4.223.158.175:15305] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/less.php"] [unique_id "ac0mkj7Idlm5j9frhqRfHAAAAFI"]
[Wed Apr 01 22:07:14.831137 2026] [:error] [pid 8909:tid 8953] [client 4.223.158.175:19376] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/less.php"] [unique_id "ac0mkjvP_a0662gDl6DuHwAAAMw"]
[Wed Apr 01 22:07:15.356410 2026] [:error] [pid 8909:tid 8945] [client 4.223.158.175:19346] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/less.php"] [unique_id "ac0mkzvP_a0662gDl6DuIAAAAMQ"]
[Wed Apr 01 22:07:15.881986 2026] [:error] [pid 17856:tid 17879] [client 4.223.158.175:19120] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/less.php"] [unique_id "ac0mkz7Idlm5j9frhqRfIAAAAFU"]
[Wed Apr 01 22:07:16.414445 2026] [:error] [pid 8995:tid 9002] [client 4.223.158.175:1976] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "ac0mlOonaBjs3qxcRefbWAAAAAQ"]
[Wed Apr 01 22:07:16.940845 2026] [:error] [pid 8908:tid 8934] [client 4.223.158.175:22484] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "ac0mlPkmxtJXGnLdvgCj1AAAAJU"]
[Wed Apr 01 22:07:17.484713 2026] [:error] [pid 8995:tid 9013] [client 4.223.158.175:9704] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "ac0mleonaBjs3qxcRefbWwAAAA8"]
[Wed Apr 01 22:07:18.020484 2026] [:error] [pid 62559:tid 62563] [client 4.223.158.175:1964] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t2gorhwasq4vioshtatw5eCdefault.php"] [unique_id "ac0mli7NKI8IaNKZFIe0fgAAAUI"]
[Wed Apr 01 22:07:18.555837 2026] [:error] [pid 8908:tid 8928] [client 4.223.158.175:28710] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new3.php"] [unique_id "ac0mlvkmxtJXGnLdvgCj2gAAAI8"]
[Wed Apr 01 22:07:19.096718 2026] [:error] [pid 8910:tid 8972] [client 4.223.158.175:11701] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new3.php"] [unique_id "ac0ml6JZINUcF3tYgExwlQAAAQQ"]
[Wed Apr 01 22:07:19.629213 2026] [:error] [pid 8908:tid 8926] [client 4.223.158.175:28729] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new3.php"] [unique_id "ac0ml_kmxtJXGnLdvgCj4AAAAI0"]
[Wed Apr 01 22:07:31.059859 2026] [:error] [pid 8908:tid 8916] [client 4.223.158.175:28715] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ac0mo_kmxtJXGnLdvgCkDwAAAIM"]
[Wed Apr 01 22:07:31.586161 2026] [:error] [pid 8908:tid 8926] [client 4.223.158.175:32293] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ac0mo_kmxtJXGnLdvgCkEAAAAI0"]
[Wed Apr 01 22:07:32.117769 2026] [:error] [pid 8908:tid 8924] [client 4.223.158.175:16637] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ac0mpPkmxtJXGnLdvgCkFAAAAIs"]
[Wed Apr 01 22:07:32.666265 2026] [:error] [pid 8910:tid 8979] [client 4.223.158.175:28718] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ac0mpKJZINUcF3tYgExwrwAAAQs"]
[Wed Apr 01 22:07:33.202297 2026] [:error] [pid 8908:tid 8936] [client 4.223.158.175:25344] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sts.php"] [unique_id "ac0mpfkmxtJXGnLdvgCkGAAAAJc"]
[Wed Apr 01 22:07:33.762695 2026] [:error] [pid 8909:tid 8960] [client 4.223.158.175:29998] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sts.php"] [unique_id "ac0mpTvP_a0662gDl6DuPgAAANM"]
[Wed Apr 01 22:07:34.300599 2026] [:error] [pid 8909:tid 8961] [client 4.223.158.175:19129] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sts.php"] [unique_id "ac0mpjvP_a0662gDl6DuPwAAANQ"]
[Wed Apr 01 22:07:34.833051 2026] [:error] [pid 8995:tid 9005] [client 4.223.158.175:26437] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sts.php"] [unique_id "ac0mpuonaBjs3qxcRefbYQAAAAc"]
[Wed Apr 01 22:07:35.363824 2026] [:error] [pid 17856:tid 17875] [client 4.223.158.175:19106] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hbvdoz7cy9k6xge9zhuvkvitCdefault.php"] [unique_id "ac0mpz7Idlm5j9frhqRfRgAAAFE"]
[Wed Apr 01 22:07:35.891929 2026] [:error] [pid 17856:tid 17872] [client 4.223.158.175:21140] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hbvdoz7cy9k6xge9zhuvkvitCdefault.php"] [unique_id "ac0mpz7Idlm5j9frhqRfSgAAAE4"]
[Wed Apr 01 22:07:36.423288 2026] [:error] [pid 8910:tid 8989] [client 4.223.158.175:19605] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hbvdoz7cy9k6xge9zhuvkvitCdefault.php"] [unique_id "ac0mqKJZINUcF3tYgExwtwAAARU"]
[Wed Apr 01 22:07:36.962279 2026] [:error] [pid 8995:tid 9019] [client 4.223.158.175:19131] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hbvdoz7cy9k6xge9zhuvkvitCdefault.php"] [unique_id "ac0mqOonaBjs3qxcRefbZQAAABU"]
[Wed Apr 01 22:07:37.492567 2026] [:error] [pid 8995:tid 8999] [client 4.223.158.175:13041] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wziar1.php"] [unique_id "ac0mqeonaBjs3qxcRefbagAAAAE"]
[Wed Apr 01 22:07:38.048440 2026] [:error] [pid 8908:tid 8924] [client 4.223.158.175:21146] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wziar1.php"] [unique_id "ac0mqvkmxtJXGnLdvgCkHwAAAIs"]
[Wed Apr 01 22:07:38.616502 2026] [:error] [pid 8908:tid 8919] [client 4.223.158.175:21135] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wziar1.php"] [unique_id "ac0mqvkmxtJXGnLdvgCkIAAAAIY"]
[Wed Apr 01 22:07:39.148649 2026] [:error] [pid 8909:tid 8952] [client 4.223.158.175:30517] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wziar1.php"] [unique_id "ac0mqzvP_a0662gDl6DuSAAAAMs"]
[Wed Apr 01 22:07:39.686412 2026] [:error] [pid 8995:tid 9013] [client 4.223.158.175:1436] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsgdjkl.php"] [unique_id "ac0mq-onaBjs3qxcRefbdQAAAA8"]
[Wed Apr 01 22:07:40.215797 2026] [:error] [pid 17856:tid 17861] [client 4.223.158.175:19358] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsgdjkl.php"] [unique_id "ac0mrD7Idlm5j9frhqRfWAAAAEM"]
[Wed Apr 01 22:07:40.767495 2026] [:error] [pid 17856:tid 17877] [client 4.223.158.175:22504] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsgdjkl.php"] [unique_id "ac0mrD7Idlm5j9frhqRfXAAAAFM"]
[Wed Apr 01 22:07:41.298315 2026] [:error] [pid 17856:tid 17866] [client 4.223.158.175:63747] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsgdjkl.php"] [unique_id "ac0mrT7Idlm5j9frhqRfYAAAAEg"]
[Wed Apr 01 22:07:41.828086 2026] [:error] [pid 17856:tid 17861] [client 4.223.158.175:1414] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "ac0mrT7Idlm5j9frhqRfZAAAAEM"]
[Wed Apr 01 22:07:42.381461 2026] [:error] [pid 62559:tid 62565] [client 4.223.158.175:19636] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "ac0mri7NKI8IaNKZFIe0uAAAAUQ"]
[Wed Apr 01 22:07:42.922490 2026] [:error] [pid 17856:tid 17859] [client 4.223.158.175:50620] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "ac0mrj7Idlm5j9frhqRfbwAAAEE"]
[Wed Apr 01 22:07:43.446945 2026] [:error] [pid 8995:tid 9010] [client 4.223.158.175:1938] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "ac0mr-onaBjs3qxcRefbeQAAAAw"]
[Wed Apr 01 22:07:43.977808 2026] [:error] [pid 17856:tid 17880] [client 4.223.158.175:50585] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX2.php"] [unique_id "ac0mrz7Idlm5j9frhqRfdAAAAFY"]
[Wed Apr 01 22:07:44.504810 2026] [:error] [pid 17856:tid 17858] [client 4.223.158.175:63745] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX2.php"] [unique_id "ac0msD7Idlm5j9frhqRfdgAAAEA"]
[Wed Apr 01 22:07:45.048949 2026] [:error] [pid 17856:tid 17874] [client 4.223.158.175:34545] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX2.php"] [unique_id "ac0msT7Idlm5j9frhqRfewAAAFA"]
[Wed Apr 01 22:07:45.587736 2026] [:error] [pid 8995:tid 9007] [client 4.223.158.175:15310] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX2.php"] [unique_id "ac0mseonaBjs3qxcRefbewAAAAk"]
[Wed Apr 01 22:07:46.114246 2026] [:error] [pid 8909:tid 8944] [client 4.223.158.175:16580] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a8.php"] [unique_id "ac0msjvP_a0662gDl6DuUgAAAMM"]
[Wed Apr 01 22:07:46.652035 2026] [:error] [pid 8995:tid 9019] [client 4.223.158.175:16589] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a8.php"] [unique_id "ac0msuonaBjs3qxcRefbfgAAABU"]
[Wed Apr 01 22:07:47.188484 2026] [:error] [pid 62559:tid 62565] [client 4.223.158.175:30506] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a8.php"] [unique_id "ac0msy7NKI8IaNKZFIe0vwAAAUQ"]
[Wed Apr 01 22:07:47.713566 2026] [:error] [pid 8909:tid 8959] [client 4.223.158.175:50570] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a8.php"] [unique_id "ac0mszvP_a0662gDl6DuXwAAANI"]
[Wed Apr 01 22:07:48.242068 2026] [:error] [pid 8909:tid 8960] [client 4.223.158.175:34505] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac0mtDvP_a0662gDl6DuYwAAANM"]
[Wed Apr 01 22:07:48.778082 2026] [:error] [pid 8909:tid 8954] [client 4.223.158.175:1466] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac0mtDvP_a0662gDl6DuZgAAAM0"]
[Wed Apr 01 22:07:49.319533 2026] [:error] [pid 8909:tid 8965] [client 4.223.158.175:1929] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac0mtTvP_a0662gDl6DuaQAAANg"]
[Wed Apr 01 22:07:49.855685 2026] [:error] [pid 8908:tid 8922] [client 4.223.158.175:15322] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac0mtfkmxtJXGnLdvgCkQQAAAIk"]
[Wed Apr 01 22:07:50.387243 2026] [:error] [pid 17856:tid 17867] [client 4.223.158.175:11674] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ortasekerli1.php"] [unique_id "ac0mtj7Idlm5j9frhqRfkAAAAEk"]
[Wed Apr 01 22:07:50.920793 2026] [:error] [pid 17856:tid 17866] [client 4.223.158.175:28683] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ortasekerli1.php"] [unique_id "ac0mtj7Idlm5j9frhqRfkwAAAEg"]
[Wed Apr 01 22:07:51.458120 2026] [:error] [pid 17856:tid 17867] [client 4.223.158.175:1943] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ortasekerli1.php"] [unique_id "ac0mtz7Idlm5j9frhqRfmAAAAEk"]
[Wed Apr 01 22:07:52.020330 2026] [:error] [pid 8909:tid 8952] [client 4.223.158.175:1962] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ortasekerli1.php"] [unique_id "ac0muDvP_a0662gDl6DubwAAAMs"]
[Wed Apr 01 22:07:52.551041 2026] [:error] [pid 8909:tid 8963] [client 4.223.158.175:63774] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a7.php"] [unique_id "ac0muDvP_a0662gDl6DucgAAANY"]
[Wed Apr 01 22:07:53.076491 2026] [:error] [pid 8909:tid 8948] [client 4.223.158.175:11682] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a7.php"] [unique_id "ac0muTvP_a0662gDl6DucwAAAMc"]
[Wed Apr 01 22:07:53.600472 2026] [:error] [pid 62559:tid 62565] [client 4.223.158.175:15001] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a7.php"] [unique_id "ac0muS7NKI8IaNKZFIe0ywAAAUQ"]
[Wed Apr 01 22:07:54.127374 2026] [:error] [pid 62559:tid 62568] [client 4.223.158.175:19097] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a7.php"] [unique_id "ac0mui7NKI8IaNKZFIe0zwAAAUc"]
[Wed Apr 01 22:07:54.675061 2026] [:error] [pid 8995:tid 9012] [client 4.223.158.175:12972] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index-20260330022921.php"] [unique_id "ac0muuonaBjs3qxcRefbgAAAAA4"]
[Wed Apr 01 22:07:55.205498 2026] [:error] [pid 8995:tid 9020] [client 4.223.158.175:28689] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index-20260330022921.php"] [unique_id "ac0mu-onaBjs3qxcRefbgQAAABY"]
[Wed Apr 01 22:07:55.749312 2026] [:error] [pid 62559:tid 62582] [client 4.223.158.175:15036] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index-20260330022921.php"] [unique_id "ac0muy7NKI8IaNKZFIe01gAAAVU"]
[Wed Apr 01 22:07:56.288943 2026] [:error] [pid 17856:tid 17872] [client 4.223.158.175:16622] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index-20260330022921.php"] [unique_id "ac0mvD7Idlm5j9frhqRfrgAAAE4"]
[Wed Apr 01 22:07:56.813912 2026] [:error] [pid 17856:tid 17859] [client 4.223.158.175:25407] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Geforce.php"] [unique_id "ac0mvD7Idlm5j9frhqRfsQAAAEE"]
[Wed Apr 01 22:07:57.339544 2026] [:error] [pid 17856:tid 17874] [client 4.223.158.175:25358] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Geforce.php"] [unique_id "ac0mvT7Idlm5j9frhqRftQAAAFA"]
[Wed Apr 01 22:07:57.869670 2026] [:error] [pid 17856:tid 17882] [client 4.223.158.175:16593] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Geforce.php"] [unique_id "ac0mvT7Idlm5j9frhqRfuwAAAFg"]
[Wed Apr 01 22:07:58.394622 2026] [:error] [pid 8995:tid 9006] [client 4.223.158.175:15021] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Geforce.php"] [unique_id "ac0mvuonaBjs3qxcRefbggAAAAg"]
[Wed Apr 01 22:07:58.931758 2026] [:error] [pid 8908:tid 8915] [client 4.223.158.175:29992] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "ac0mvvkmxtJXGnLdvgCkTgAAAII"]
[Wed Apr 01 22:07:59.459470 2026] [:error] [pid 8908:tid 8936] [client 4.223.158.175:8577] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "ac0mv_kmxtJXGnLdvgCkUAAAAJc"]
[Wed Apr 01 22:08:00.025106 2026] [:error] [pid 62559:tid 62576] [client 4.223.158.175:21179] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "ac0mwC7NKI8IaNKZFIe04QAAAU8"]
[Wed Apr 01 22:08:00.552014 2026] [:error] [pid 8908:tid 8925] [client 4.223.158.175:17894] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "ac0mwPkmxtJXGnLdvgCkUQAAAIw"]
[Wed Apr 01 22:08:01.079181 2026] [:error] [pid 8910:tid 8984] [client 4.223.158.175:29281] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ccv.php"] [unique_id "ac0mwaJZINUcF3tYgExwxAAAARA"]
[Wed Apr 01 22:08:01.607637 2026] [:error] [pid 8908:tid 8931] [client 4.223.158.175:1927] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ccv.php"] [unique_id "ac0mwfkmxtJXGnLdvgCkVQAAAJI"]
[Wed Apr 01 22:08:02.137314 2026] [:error] [pid 17856:tid 17859] [client 4.223.158.175:35668] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ccv.php"] [unique_id "ac0mwj7Idlm5j9frhqRf2AAAAEE"]
[Wed Apr 01 22:08:02.663348 2026] [:error] [pid 17856:tid 17875] [client 4.223.158.175:19378] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ccv.php"] [unique_id "ac0mwj7Idlm5j9frhqRf3gAAAFE"]
[Wed Apr 01 22:08:03.199534 2026] [:error] [pid 17856:tid 17863] [client 4.223.158.175:1443] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/luyuc.php"] [unique_id "ac0mwz7Idlm5j9frhqRf5AAAAEU"]
[Wed Apr 01 22:08:03.734011 2026] [:error] [pid 8908:tid 8929] [client 4.223.158.175:1449] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/luyuc.php"] [unique_id "ac0mw_kmxtJXGnLdvgCkWQAAAJA"]
[Wed Apr 01 22:08:04.262560 2026] [:error] [pid 8995:tid 9016] [client 4.223.158.175:22520] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/luyuc.php"] [unique_id "ac0mxOonaBjs3qxcRefbhgAAABI"]
[Wed Apr 01 22:08:04.788174 2026] [:error] [pid 8908:tid 8918] [client 4.223.158.175:1448] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/luyuc.php"] [unique_id "ac0mxPkmxtJXGnLdvgCkXQAAAIU"]
[Wed Apr 01 22:08:05.331586 2026] [:error] [pid 8909:tid 8949] [client 4.223.158.175:20721] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "ac0mxTvP_a0662gDl6DukQAAAMg"]
[Wed Apr 01 22:08:05.854351 2026] [:error] [pid 8909:tid 8951] [client 4.223.158.175:15313] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "ac0mxTvP_a0662gDl6DukwAAAMo"]
[Wed Apr 01 22:08:06.385991 2026] [:error] [pid 17856:tid 17860] [client 4.223.158.175:20720] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "ac0mxj7Idlm5j9frhqRf9wAAAEI"]
[Wed Apr 01 22:08:06.924169 2026] [:error] [pid 8909:tid 8954] [client 4.223.158.175:19093] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "ac0mxjvP_a0662gDl6DumgAAAM0"]
[Wed Apr 01 22:08:07.451559 2026] [:error] [pid 17856:tid 17863] [client 4.223.158.175:17111] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htto.php"] [unique_id "ac0mxz7Idlm5j9frhqRf_AAAAEU"]
[Wed Apr 01 22:08:07.980955 2026] [:error] [pid 17856:tid 17876] [client 4.223.158.175:22503] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htto.php"] [unique_id "ac0mxz7Idlm5j9frhqRf_wAAAFI"]
[Wed Apr 01 22:08:08.506624 2026] [:error] [pid 17856:tid 17862] [client 4.223.158.175:12950] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htto.php"] [unique_id "ac0myD7Idlm5j9frhqRgCAAAAEQ"]
[Wed Apr 01 22:08:09.043245 2026] [:error] [pid 17856:tid 17870] [client 4.223.158.175:22465] [client 4.223.158.175] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htto.php"] [unique_id "ac0myT7Idlm5j9frhqRgDAAAAEw"]
[Wed Apr 01 23:02:40.284289 2026] [:error] [pid 8995:tid 9010] [client 8.136.109.234:43676] [client 8.136.109.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Readme.txt"] [unique_id "ac0zkOonaBjs3qxcRefsUwAAAAw"], referer: https://expressinteriors.com/Readme.txt
[Wed Apr 01 23:02:41.301461 2026] [:error] [pid 62559:tid 62570] [client 8.136.109.234:33036] [client 8.136.109.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dayrui/Fcms/View/login.html"] [unique_id "ac0zkS7NKI8IaNKZFIfizAAAAUk"], referer: https://expressinteriors.com/dayrui/Fcms/View/login.html
[Wed Apr 01 23:02:43.547226 2026] [:error] [pid 62559:tid 62567] [client 8.136.109.234:57824] [client 8.136.109.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Readme.txt"] [unique_id "ac0zky7NKI8IaNKZFIfi2gAAAUY"], referer: http://expressinteriors.com/Readme.txt
[Wed Apr 01 23:02:49.082545 2026] [:error] [pid 8995:tid 9015] [client 8.136.109.234:57854] [client 8.136.109.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dayrui/Fcms/View/login.html"] [unique_id "ac0zmeonaBjs3qxcRefsggAAABE"], referer: http://expressinteriors.com/dayrui/Fcms/View/login.html
[Wed Apr 01 23:05:40.431849 2026] [:error] [pid 8908:tid 8927] [client 43.153.15.51:54756] [client 43.153.15.51] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac00RPkmxtJXGnLdvgDHZQAAAI4"]
[Wed Apr 01 23:36:06.785968 2026] [:error] [pid 8908:tid 8932] [client 194.5.52.18:57735] [client 194.5.52.18] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "ac07ZvkmxtJXGnLdvgDYmwAAAJM"]
[Wed Apr 01 23:37:12.509820 2026] [:error] [pid 8908:tid 8931] [client 3.254.113.79:41228] [client 3.254.113.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "ac07qPkmxtJXGnLdvgDZOgAAAJI"]
[Wed Apr 01 23:37:13.534717 2026] [:error] [pid 8908:tid 8932] [client 3.254.113.79:41316] [client 3.254.113.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.local"] [unique_id "ac07qfkmxtJXGnLdvgDZQwAAAJM"]
[Wed Apr 01 23:37:14.544361 2026] [:error] [pid 62559:tid 62573] [client 3.254.113.79:41338] [client 3.254.113.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.production"] [unique_id "ac07qi7NKI8IaNKZFIf-ZwAAAUw"]
[Wed Apr 01 23:37:15.553808 2026] [:error] [pid 62559:tid 62565] [client 3.254.113.79:41360] [client 3.254.113.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.staging"] [unique_id "ac07qy7NKI8IaNKZFIf-bwAAAUQ"]
[Wed Apr 01 23:37:16.573074 2026] [:error] [pid 8909:tid 8948] [client 3.254.113.79:41384] [client 3.254.113.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.development"] [unique_id "ac07rDvP_a0662gDl6AXTgAAAMc"]
[Wed Apr 01 23:37:17.584832 2026] [:error] [pid 8910:tid 8985] [client 3.254.113.79:41402] [client 3.254.113.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.test"] [unique_id "ac07raJZINUcF3tYgEyHDwAAARE"]
[Wed Apr 01 23:37:18.590060 2026] [:error] [pid 8908:tid 8922] [client 3.254.113.79:41426] [client 3.254.113.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.remote"] [unique_id "ac07rvkmxtJXGnLdvgDZRwAAAIk"]
[Wed Apr 01 23:37:21.021784 2026] [:error] [pid 8909:tid 8953] [client 3.254.113.79:41474] [client 3.254.113.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.backup"] [unique_id "ac07sTvP_a0662gDl6AXYQAAAMw"]
[Wed Apr 01 23:37:22.047860 2026] [:error] [pid 8909:tid 8957] [client 3.254.113.79:41532] [client 3.254.113.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.save"] [unique_id "ac07sjvP_a0662gDl6AXaQAAANA"]
[Wed Apr 01 23:37:23.071511 2026] [:error] [pid 8909:tid 8947] [client 3.254.113.79:41596] [client 3.254.113.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.old"] [unique_id "ac07szvP_a0662gDl6AXawAAAMY"]
[Wed Apr 01 23:37:24.088308 2026] [:error] [pid 8910:tid 8991] [client 3.254.113.79:41652] [client 3.254.113.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.sample"] [unique_id "ac07tKJZINUcF3tYgEyHEwAAARc"]
[Wed Apr 01 23:37:25.115583 2026] [:error] [pid 8908:tid 8920] [client 3.254.113.79:41684] [client 3.254.113.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/vendor/.env"] [unique_id "ac07tfkmxtJXGnLdvgDZXAAAAIc"]
[Wed Apr 01 23:37:26.139104 2026] [:error] [pid 8908:tid 8925] [client 3.254.113.79:41710] [client 3.254.113.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/lib/.env"] [unique_id "ac07tvkmxtJXGnLdvgDZYAAAAIw"]
[Wed Apr 01 23:37:27.165780 2026] [:error] [pid 8908:tid 8919] [client 3.254.113.79:41744] [client 3.254.113.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/lab/.env"] [unique_id "ac07t_kmxtJXGnLdvgDZZwAAAIY"]
[Wed Apr 01 23:37:28.195886 2026] [:error] [pid 8909:tid 8960] [client 3.254.113.79:41778] [client 3.254.113.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/cronlab/.env"] [unique_id "ac07uDvP_a0662gDl6AXbwAAANM"]
[Wed Apr 01 23:37:29.222578 2026] [:error] [pid 8908:tid 8934] [client 3.254.113.79:41804] [client 3.254.113.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/cron/.env"] [unique_id "ac07ufkmxtJXGnLdvgDZdwAAAJU"]
[Wed Apr 01 23:37:30.244751 2026] [:error] [pid 62559:tid 62585] [client 3.254.113.79:41834] [client 3.254.113.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/core/.env"] [unique_id "ac07ui7NKI8IaNKZFIf-qwAAAVg"]
[Thu Apr 02 00:46:35.060067 2026] [:error] [pid 16761:tid 16775] [client 185.241.150.182:55765] [client 185.241.150.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.241.150.182, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ac1L694bJXDGRqKZnzwIkwAAAEs"], referer: https://expressinteriors.com/
[Thu Apr 02 00:46:36.873384 2026] [:error] [pid 8387:tid 8460] [client 185.241.150.182:56590] [client 185.241.150.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.241.150.182, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ac1L7BdQYJ2y8LDYkv_xUQAAABM"], referer: https://expressinteriors.com/wp-login.php?action=register
[Thu Apr 02 04:16:42.662283 2026] [:error] [pid 59194:tid 59215] [client 43.159.145.149:48914] [client 43.159.145.149] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac19KhMpAeV11hcQehzLcwAAAAI"]
[Thu Apr 02 06:35:41.427777 2026] [:error] [pid 59194:tid 59236] [client 122.51.236.174:37750] [client 122.51.236.174] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac2dvRMpAeV11hcQehziPQAAABc"]
[Thu Apr 02 07:19:00.223475 2026] [:error] [pid 23927:tid 23930] [client 136.109.235.35:58864] [client 136.109.235.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.109.235.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac2n5EsZwqCndhl9uKBmUwAAAYE"]
[Thu Apr 02 09:20:08.987181 2026] [:error] [pid 23927:tid 23944] [client 43.157.158.178:38838] [client 43.157.158.178] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac3ESEsZwqCndhl9uKChEQAAAY8"]
[Thu Apr 02 13:21:30.810476 2026] [:error] [pid 59305:tid 59330] [client 121.229.185.160:34485] [client 121.229.185.160] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ac382qr2tV4rDwKFxKe2WwAAANU"]
[Thu Apr 02 16:56:37.735200 2026] [:error] [pid 54384:tid 54405] [client 43.130.37.243:48352] [client 43.130.37.243] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ac4vRdWWpaby3TVN7MfTKQAAAdM"]
[Thu Apr 02 18:37:31.906664 2026] [:error] [pid 54384:tid 54405] [client 49.51.38.193:33988] [client 49.51.38.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac5G69WWpaby3TVN7Mfw0AAAAdM"]
[Thu Apr 02 21:24:46.463948 2026] [:error] [pid 29467:tid 29486] [client 170.106.84.136:42168] [client 170.106.84.136] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ac5uHr4VUBFCJAq-WOm7bgAAARA"]
[Thu Apr 02 21:59:32.946566 2026] [:error] [pid 59305:tid 59312] [client 51.211.241.148:53524] [client 51.211.241.148] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ac52RKr2tV4rDwKFxKfJZQAAAMM"]
[Thu Apr 02 22:00:59.312585 2026] [:error] [pid 23927:tid 23950] [client 51.211.241.148:30759] [client 51.211.241.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.211.241.148, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac52m0sZwqCndhl9uKDgMwAAAZU"]
[Thu Apr 02 22:01:58.998811 2026] [:error] [pid 29467:tid 29491] [client 51.211.241.148:32809] [client 51.211.241.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.211.241.148, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac521r4VUBFCJAq-WOnXEQAAARU"]
[Thu Apr 02 22:02:56.935890 2026] [:error] [pid 59305:tid 59333] [client 51.211.241.148:50830] [client 51.211.241.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.211.241.148, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac53EKr2tV4rDwKFxKfMagAAANg"]
[Thu Apr 02 22:04:03.011969 2026] [:error] [pid 54384:tid 54399] [client 51.211.241.148:63810] [client 51.211.241.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.211.241.148, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac53U9WWpaby3TVN7Mc3XAAAAc0"]
[Thu Apr 02 22:04:56.341682 2026] [:error] [pid 37543:tid 37551] [client 51.211.241.148:34735] [client 51.211.241.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.211.241.148, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac53iHhdk2bEYJCvILYBDAAAAUY"]
[Thu Apr 02 22:14:59.866011 2026] [:error] [pid 29467:tid 29478] [client 171.250.79.187:58059] [client 171.250.79.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.250.79.187, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac55474VUBFCJAq-WOneWAAAAQg"]
[Thu Apr 02 22:22:16.687914 2026] [:error] [pid 59305:tid 59329] [client 171.250.79.187:59734] [client 171.250.79.187] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ac57mKr2tV4rDwKFxKffEwAAANQ"]
[Thu Apr 02 22:23:41.276398 2026] [:error] [pid 29467:tid 29470] [client 171.250.79.187:58575] [client 171.250.79.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.250.79.187, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac577b4VUBFCJAq-WOnkTgAAAQA"]
[Thu Apr 02 22:24:56.473869 2026] [:error] [pid 29467:tid 29486] [client 171.250.79.187:50318] [client 171.250.79.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.250.79.187, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac58OL4VUBFCJAq-WOnldQAAARA"]
[Thu Apr 02 22:26:09.371112 2026] [:error] [pid 23927:tid 23951] [client 171.250.79.187:63696] [client 171.250.79.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.250.79.187, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac58gUsZwqCndhl9uKDsDwAAAZY"]
[Thu Apr 02 22:27:29.788010 2026] [:error] [pid 59305:tid 59319] [client 171.250.79.187:60100] [client 171.250.79.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.250.79.187, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac580ar2tV4rDwKFxKfjkQAAAMo"]
[Thu Apr 02 23:10:26.521073 2026] [:error] [pid 29467:tid 29489] [client 43.156.168.214:45292] [client 43.156.168.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac6G4r4VUBFCJAq-WOn8xwAAARM"]
[Fri Apr 03 01:51:00.513440 2026] [:error] [pid 25035:tid 25442] [client 176.65.134.45:43823] [client 176.65.134.45] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "ac6shBhR292toNOkLqHAKwAAAIA"]
[Fri Apr 03 01:51:01.883740 2026] [:error] [pid 25035:tid 25448] [client 176.65.134.45:44199] [client 176.65.134.45] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "ac6shRhR292toNOkLqHALgAAAIY"]
[Fri Apr 03 02:03:17.197428 2026] [:error] [pid 25470:tid 25487] [client 162.62.213.187:45896] [client 162.62.213.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ac6vZXhROcck6_9HYyg5zQAAAM8"]
[Fri Apr 03 02:21:21.949856 2026] [:error] [pid 25470:tid 25474] [client 60.188.57.0:56085] [client 60.188.57.0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ac6zoXhROcck6_9HYyhKnwAAAMI"]
[Fri Apr 03 02:47:53.321574 2026] [:error] [pid 25035:tid 25461] [client 137.220.224.39:17435] [client 137.220.224.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac652RhR292toNOkLqHjJAAAAJM"], referer: https://duckduckgo.com/?q=online+store+setup%!(EXTRA string=online+store+setup)
[Fri Apr 03 02:47:54.004200 2026] [:error] [pid 25010:tid 25352] [client 137.220.224.7:60655] [client 137.220.224.7] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac652o_KcjFQF5TuqTXhSAAAAAQ"], referer: https://www.instagram.com/
[Fri Apr 03 02:47:56.977447 2026] [:error] [pid 25035:tid 25459] [client 137.220.224.53:36821] [client 137.220.224.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.220.224.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ac653BhR292toNOkLqHjKAAAAJE"]
[Fri Apr 03 02:47:56.980097 2026] [:error] [pid 25035:tid 25459] [client 137.220.224.53:36821] [client 137.220.224.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ac653BhR292toNOkLqHjKAAAAJE"]
[Fri Apr 03 02:47:58.026896 2026] [:error] [pid 25010:tid 25371] [client 137.220.224.39:6931] [client 137.220.224.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.220.224.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac653o_KcjFQF5TuqTXhXgAAABY"]
[Fri Apr 03 02:47:58.028714 2026] [:error] [pid 25010:tid 25371] [client 137.220.224.39:6931] [client 137.220.224.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac653o_KcjFQF5TuqTXhXgAAABY"]
[Fri Apr 03 03:05:41.244768 2026] [:error] [pid 6718:tid 6739] [client 158.158.110.103:54838] [client 158.158.110.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 158.158.110.103, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ac6-BRcJBvdSRfIrgC4fQwAAAdM"]
[Fri Apr 03 04:03:06.047725 2026] [:error] [pid 22778:tid 22798] [client 137.220.224.15:41717] [client 137.220.224.15] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac7LevS-q9hkdFqUjq8-5QAAAM0"], referer: https://www.instagram.com/
[Fri Apr 03 04:03:08.843929 2026] [:error] [pid 22778:tid 22797] [client 137.220.224.11:40059] [client 137.220.224.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac7LfPS-q9hkdFqUjq8_AQAAAMw"], referer: https://www.instagram.com/
[Fri Apr 03 04:03:11.490875 2026] [:error] [pid 22778:tid 22792] [client 137.220.224.7:40071] [client 137.220.224.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.220.224.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac7Lf_S-q9hkdFqUjq8_BwAAAMc"]
[Fri Apr 03 04:03:11.493858 2026] [:error] [pid 22778:tid 22792] [client 137.220.224.7:40071] [client 137.220.224.7] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac7Lf_S-q9hkdFqUjq8_BwAAAMc"]
[Fri Apr 03 04:09:59.382863 2026] [:error] [pid 22778:tid 22804] [client 216.24.210.171:43671] [client 216.24.210.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "ac7NF_S-q9hkdFqUjq9E_wAAANM"]
[Fri Apr 03 04:49:45.006442 2026] [:error] [pid 22778:tid 22803] [client 45.154.98.56:49671] [client 45.154.98.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/txets.php"] [unique_id "ac7WafS-q9hkdFqUjq9c4QAAANI"]
[Fri Apr 03 04:49:45.491655 2026] [:error] [pid 22671:tid 22697] [client 45.154.98.56:49852] [client 45.154.98.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "ac7WaSRuUnMW7r8hvyY22QAAAAY"]
[Fri Apr 03 04:49:45.984473 2026] [:error] [pid 22778:tid 22797] [client 45.154.98.56:50068] [client 45.154.98.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "ac7WafS-q9hkdFqUjq9c5QAAAMw"]
[Fri Apr 03 04:49:46.473823 2026] [:error] [pid 22673:tid 22749] [client 45.154.98.56:50305] [client 45.154.98.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "ac7Wau-GlVDWdWxxwJBrpwAAAIM"]
[Fri Apr 03 04:49:46.965207 2026] [:error] [pid 22671:tid 22691] [client 45.154.98.56:50461] [client 45.154.98.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/txets.php"] [unique_id "ac7WaiRuUnMW7r8hvyY22wAAAAA"]
[Fri Apr 03 04:49:47.452011 2026] [:error] [pid 22673:tid 22758] [client 45.154.98.56:50554] [client 45.154.98.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "ac7Wa--GlVDWdWxxwJBrqQAAAIw"]
[Fri Apr 03 04:49:47.948095 2026] [:error] [pid 22673:tid 22770] [client 45.154.98.56:50722] [client 45.154.98.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/schallfuns.php"] [unique_id "ac7Wa--GlVDWdWxxwJBrqwAAAJg"]
[Fri Apr 03 04:49:48.434835 2026] [:error] [pid 22778:tid 22797] [client 45.154.98.56:50916] [client 45.154.98.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/postnews.php"] [unique_id "ac7WbPS-q9hkdFqUjq9c7gAAAMw"]
[Fri Apr 03 05:42:22.569062 2026] [:error] [pid 58590:tid 58592] [client 118.107.44.96:24501] [client 118.107.44.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac7ivkze_aEPDM9xEE2_rwAAAQA"], referer: https://www.google.com/search?q=wp+security&oq=wp+security
[Fri Apr 03 05:42:23.439891 2026] [:error] [pid 22671:tid 22705] [client 118.107.44.122:48397] [client 118.107.44.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac7ivyRuUnMW7r8hvyZJrwAAAA4"], referer: https://www.instagram.com/
[Fri Apr 03 05:42:24.874301 2026] [:error] [pid 22671:tid 22697] [client 118.107.44.123:62411] [client 118.107.44.123] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac7iwCRuUnMW7r8hvyZJsgAAAAY"]
[Fri Apr 03 05:42:29.145990 2026] [:error] [pid 58590:tid 58598] [client 118.107.44.122:22947] [client 118.107.44.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.107.44.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac7ixUze_aEPDM9xEE2_zQAAAQY"]
[Fri Apr 03 05:42:29.148265 2026] [:error] [pid 58590:tid 58598] [client 118.107.44.122:22947] [client 118.107.44.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac7ixUze_aEPDM9xEE2_zQAAAQY"]
[Fri Apr 03 06:18:31.568405 2026] [:error] [pid 22673:tid 22764] [client 137.220.224.7:46281] [client 137.220.224.7] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac7rN--GlVDWdWxxwJCZNgAAAJI"], referer: https://www.linkedin.com/
[Fri Apr 03 06:18:34.251318 2026] [:error] [pid 58590:tid 58594] [client 137.220.224.18:39449] [client 137.220.224.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac7rOkze_aEPDM9xEE3dZwAAAQI"], referer: https://www.bing.com/
[Fri Apr 03 06:18:34.921529 2026] [:error] [pid 22672:tid 22741] [client 137.220.224.16:1469] [client 137.220.224.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.220.224.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ac7rOqzrgXkFSOK0fvqU4wAAAFY"], referer: https://search.yahoo.com/search?p=digital+marketing%!(EXTRA string=digital+marketing)
[Fri Apr 03 06:18:34.923672 2026] [:error] [pid 22672:tid 22741] [client 137.220.224.16:1469] [client 137.220.224.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ac7rOqzrgXkFSOK0fvqU4wAAAFY"], referer: https://search.yahoo.com/search?p=digital+marketing%!(EXTRA string=digital+marketing)
[Fri Apr 03 06:18:35.583162 2026] [:error] [pid 22673:tid 22748] [client 137.220.224.16:32111] [client 137.220.224.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.220.224.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac7rO--GlVDWdWxxwJCZPwAAAII"], referer: https://www.google.com/
[Fri Apr 03 06:18:35.585202 2026] [:error] [pid 22673:tid 22748] [client 137.220.224.16:32111] [client 137.220.224.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac7rO--GlVDWdWxxwJCZPwAAAII"], referer: https://www.google.com/
[Fri Apr 03 07:37:07.177322 2026] [:error] [pid 33542:tid 33566] [client 45.92.1.11:64893] [client 45.92.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "ac79o3wb6uB1LaGtepYk5QAAANU"]
[Fri Apr 03 07:37:07.661792 2026] [:error] [pid 40533:tid 40541] [client 45.92.1.11:65029] [client 45.92.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "ac79o_bIAA8AViDmwssSTAAAAUY"]
[Fri Apr 03 07:37:08.149787 2026] [:error] [pid 40533:tid 40554] [client 45.92.1.11:65170] [client 45.92.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "ac79pPbIAA8AViDmwssSTQAAAVM"]
[Fri Apr 03 07:37:10.259763 2026] [:error] [pid 40533:tid 40555] [client 45.92.1.11:49484] [client 45.92.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "ac79pvbIAA8AViDmwssSTwAAAVQ"]
[Fri Apr 03 07:42:38.573571 2026] [:error] [pid 33446:tid 33487] [client 137.220.224.15:58615] [client 137.220.224.15] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac7-7tg3dCqFYIIdw0oqJwAAAEo"]
[Fri Apr 03 07:42:39.336655 2026] [:error] [pid 40562:tid 40576] [client 137.220.224.7:44403] [client 137.220.224.7] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac7-7zfFMXuP9zvqCeqAGQAAAYs"], referer: https://www.bing.com/
[Fri Apr 03 07:42:43.909744 2026] [:error] [pid 33445:tid 33474] [client 137.220.224.16:57019] [client 137.220.224.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.220.224.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac7-81lRNZ0iDVmJWM2aYQAAABg"], referer: https://www.pinterest.com/
[Fri Apr 03 07:42:43.911747 2026] [:error] [pid 33445:tid 33474] [client 137.220.224.16:57019] [client 137.220.224.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac7-81lRNZ0iDVmJWM2aYQAAABg"], referer: https://www.pinterest.com/
[Fri Apr 03 07:57:45.643787 2026] [:error] [pid 33542:tid 33565] [client 137.220.224.16:27695] [client 137.220.224.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac8CeXwb6uB1LaGtepYvugAAANQ"], referer: https://www.facebook.com/
[Fri Apr 03 07:57:48.475645 2026] [:error] [pid 33447:tid 33521] [client 137.220.224.16:22369] [client 137.220.224.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac8CfEgaPmDHz92j4lOlCAAAAJE"], referer: https://www.google.com/
[Fri Apr 03 07:57:51.050573 2026] [:error] [pid 40562:tid 40586] [client 137.220.224.7:34175] [client 137.220.224.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.220.224.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac8CfzfFMXuP9zvqCeqG3QAAAZU"]
[Fri Apr 03 07:57:51.053379 2026] [:error] [pid 40562:tid 40586] [client 137.220.224.7:34175] [client 137.220.224.7] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac8CfzfFMXuP9zvqCeqG3QAAAZU"]
[Fri Apr 03 08:51:49.629573 2026] [:error] [pid 40533:tid 40543] [client 118.107.44.76:44959] [client 118.107.44.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac8PJfbIAA8AViDmwsssHgAAAUg"], referer: https://duckduckgo.com/?q=wp+admin+login%!(EXTRA string=wp+admin+login)
[Fri Apr 03 08:51:50.325021 2026] [:error] [pid 40533:tid 40540] [client 118.107.44.76:19699] [client 118.107.44.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac8PJvbIAA8AViDmwsssJgAAAUU"], referer: https://www.youtube.com/
[Fri Apr 03 08:51:52.182183 2026] [:error] [pid 33446:tid 33500] [client 118.107.44.122:3143] [client 118.107.44.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac8PKNg3dCqFYIIdw0o8CAAAAFc"], referer: https://search.yahoo.com/
[Fri Apr 03 08:51:53.492689 2026] [:error] [pid 33542:tid 33557] [client 118.107.44.123:10069] [client 118.107.44.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 118.107.44.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ac8PKXwb6uB1LaGtepZPagAAAMw"], referer: https://search.yahoo.com/search?p=digital+marketing%!(EXTRA string=digital+marketing)
[Fri Apr 03 08:51:53.495333 2026] [:error] [pid 33542:tid 33557] [client 118.107.44.123:10069] [client 118.107.44.123] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ac8PKXwb6uB1LaGtepZPagAAAMw"], referer: https://search.yahoo.com/search?p=digital+marketing%!(EXTRA string=digital+marketing)
[Fri Apr 03 08:51:54.481251 2026] [:error] [pid 35469:tid 35480] [client 118.107.44.96:21215] [client 118.107.44.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.107.44.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac8PKqGvTIc8-wY3jUQ59gAAAQk"], referer: https://search.yahoo.com/
[Fri Apr 03 08:51:54.483200 2026] [:error] [pid 35469:tid 35480] [client 118.107.44.96:21215] [client 118.107.44.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac8PKqGvTIc8-wY3jUQ59gAAAQk"], referer: https://search.yahoo.com/
[Fri Apr 03 09:05:02.508900 2026] [:error] [pid 33542:tid 33559] [client 118.107.44.120:62839] [client 118.107.44.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac8SPnwb6uB1LaGtepZVdwAAAM4"], referer: https://www.linkedin.com/
[Fri Apr 03 09:05:03.973731 2026] [:error] [pid 40533:tid 40549] [client 118.107.44.120:38795] [client 118.107.44.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac8SP_bIAA8AViDmwsswSAAAAU4"], referer: https://www.pinterest.com/
[Fri Apr 03 09:05:04.848148 2026] [:error] [pid 40533:tid 40535] [client 118.107.44.120:47239] [client 118.107.44.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac8SQPbIAA8AViDmwsswSgAAAUA"]
[Fri Apr 03 09:05:08.792545 2026] [:error] [pid 33542:tid 33551] [client 118.107.44.116:62411] [client 118.107.44.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.107.44.116, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac8SRHwb6uB1LaGtepZVggAAAMY"], referer: https://www.reddit.com/
[Fri Apr 03 09:05:08.794780 2026] [:error] [pid 33542:tid 33551] [client 118.107.44.116:62411] [client 118.107.44.116] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac8SRHwb6uB1LaGtepZVggAAAMY"], referer: https://www.reddit.com/
[Fri Apr 03 09:40:50.404557 2026] [:error] [pid 33542:tid 33565] [client 43.156.202.34:56502] [client 43.156.202.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac8aonwb6uB1LaGtepZolgAAANQ"]
[Fri Apr 03 10:21:40.260606 2026] [:error] [pid 33446:tid 33488] [client 137.220.224.15:65473] [client 137.220.224.15] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac8kNNg3dCqFYIIdw0pRNwAAAEs"]
[Fri Apr 03 10:21:40.995438 2026] [:error] [pid 33447:tid 33509] [client 137.220.224.7:43947] [client 137.220.224.7] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac8kNEgaPmDHz92j4lPErgAAAIU"], referer: https://www.reddit.com/
[Fri Apr 03 10:21:43.708610 2026] [:error] [pid 33446:tid 33494] [client 137.220.224.16:22955] [client 137.220.224.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.220.224.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ac8kN9g3dCqFYIIdw0pRPQAAAFE"], referer: https://www.instagram.com/
[Fri Apr 03 10:21:43.710575 2026] [:error] [pid 33446:tid 33494] [client 137.220.224.16:22955] [client 137.220.224.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ac8kN9g3dCqFYIIdw0pRPQAAAFE"], referer: https://www.instagram.com/
[Fri Apr 03 10:35:18.307548 2026] [:error] [pid 33447:tid 33504] [client 118.107.44.96:48715] [client 118.107.44.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac8nZkgaPmDHz92j4lPG9wAAAIA"], referer: https://www.instagram.com/
[Fri Apr 03 10:35:21.326901 2026] [:error] [pid 40533:tid 40556] [client 118.107.44.96:8921] [client 118.107.44.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac8nafbIAA8AViDmwstL2gAAAVU"], referer: https://search.yahoo.com/
[Fri Apr 03 11:00:22.420330 2026] [:error] [pid 33445:tid 33460] [client 137.220.224.16:8647] [client 137.220.224.16] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac8tRllRNZ0iDVmJWM27WAAAAAo"]
[Fri Apr 03 13:38:15.313677 2026] [:error] [pid 33447:tid 33514] [client 118.107.44.123:33773] [client 118.107.44.123] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac9SR0gaPmDHz92j4lPnZQAAAIo"], referer: https://www.bing.com/search?q=content+management+system%!(EXTRA string=content+management+system)
[Fri Apr 03 13:38:16.328605 2026] [:error] [pid 33445:tid 33457] [client 118.107.44.96:49919] [client 118.107.44.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac9SSFlRNZ0iDVmJWM0T5gAAAAc"], referer: https://www.bing.com/
[Fri Apr 03 13:38:17.219465 2026] [:error] [pid 40533:tid 40535] [client 118.107.44.120:42493] [client 118.107.44.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac9SSfbIAA8AViDmwstkZQAAAUA"], referer: https://www.facebook.com/
[Fri Apr 03 13:38:20.751084 2026] [:error] [pid 33445:tid 33469] [client 118.107.44.122:7173] [client 118.107.44.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.107.44.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac9STFlRNZ0iDVmJWM0T_AAAABM"], referer: https://www.linkedin.com/
[Fri Apr 03 13:38:20.752565 2026] [:error] [pid 33445:tid 33469] [client 118.107.44.122:7173] [client 118.107.44.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ac9STFlRNZ0iDVmJWM0T_AAAABM"], referer: https://www.linkedin.com/
[Fri Apr 03 17:21:22.116205 2026] [:error] [pid 33447:tid 33514] [client 43.157.188.74:59828] [client 43.157.188.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ac-GkkgaPmDHz92j4lMP_QAAAIo"]
[Fri Apr 03 18:49:15.752183 2026] [autoindex:error] [pid 33446:tid 33477] [client 74.248.137.46:6087] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 03 18:49:17.561371 2026] [:error] [pid 33446:tid 33484] [client 74.248.137.46:6087] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "ac-bLdg3dCqFYIIdw0oNNwAAAEc"]
[Fri Apr 03 18:49:18.077496 2026] [:error] [pid 33446:tid 33493] [client 74.248.137.46:6115] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "ac-bLtg3dCqFYIIdw0oNPgAAAFA"]
[Fri Apr 03 18:49:18.614346 2026] [:error] [pid 33447:tid 33515] [client 74.248.137.46:6108] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "ac-bLkgaPmDHz92j4lMnIgAAAIs"]
[Fri Apr 03 18:49:19.147028 2026] [:error] [pid 33446:tid 33501] [client 74.248.137.46:6093] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "ac-bL9g3dCqFYIIdw0oNRgAAAFg"]
[Fri Apr 03 18:49:19.667520 2026] [:error] [pid 35469:tid 35490] [client 74.248.137.46:6123] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "ac-bL6GvTIc8-wY3jUQhEAAAARM"]
[Fri Apr 03 18:49:20.180373 2026] [:error] [pid 33445:tid 33470] [client 74.248.137.46:6135] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "ac-bMFlRNZ0iDVmJWM3GkQAAABQ"]
[Fri Apr 03 18:49:20.712101 2026] [:error] [pid 33445:tid 33460] [client 74.248.137.46:6105] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "ac-bMFlRNZ0iDVmJWM3GlQAAAAo"]
[Fri Apr 03 18:49:21.242972 2026] [:error] [pid 55174:tid 55178] [client 74.248.137.46:6096] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "ac-bMZ_WKqUonPNUHYzJjgAAAcI"]
[Fri Apr 03 18:49:21.769933 2026] [:error] [pid 33445:tid 33473] [client 74.248.137.46:6084] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r4f_1.php"] [unique_id "ac-bMVlRNZ0iDVmJWM3GmAAAABc"]
[Fri Apr 03 18:49:22.297196 2026] [:error] [pid 33542:tid 33562] [client 74.248.137.46:6092] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r4f_1.php"] [unique_id "ac-bMnwb6uB1LaGtepbb_wAAANE"]
[Fri Apr 03 18:49:22.815924 2026] [:error] [pid 33446:tid 33492] [client 74.248.137.46:6060] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r4f_1.php"] [unique_id "ac-bMtg3dCqFYIIdw0oNUAAAAE8"]
[Fri Apr 03 18:49:23.343933 2026] [:error] [pid 33446:tid 33481] [client 74.248.137.46:6022] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r4f_1.php"] [unique_id "ac-bM9g3dCqFYIIdw0oNUQAAAEQ"]
[Fri Apr 03 18:49:23.877943 2026] [:error] [pid 33542:tid 33554] [client 74.248.137.46:6131] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "ac-bM3wb6uB1LaGtepbcAwAAAMk"]
[Fri Apr 03 18:49:24.392075 2026] [:error] [pid 55174:tid 55176] [client 74.248.137.46:6134] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "ac-bNJ_WKqUonPNUHYzJkgAAAcA"]
[Fri Apr 03 18:49:24.919422 2026] [:error] [pid 35469:tid 35471] [client 74.248.137.46:6114] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "ac-bNKGvTIc8-wY3jUQhGwAAAQA"]
[Fri Apr 03 18:49:25.436849 2026] [:error] [pid 33542:tid 33551] [client 74.248.137.46:6042] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/wp-is.php"] [unique_id "ac-bNXwb6uB1LaGtepbcBQAAAMY"]
[Fri Apr 03 18:49:25.958066 2026] [:error] [pid 33446:tid 33500] [client 74.248.137.46:6104] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "ac-bNdg3dCqFYIIdw0oNWAAAAFc"]
[Fri Apr 03 18:49:26.495688 2026] [:error] [pid 33542:tid 33552] [client 74.248.137.46:6028] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "ac-bNnwb6uB1LaGtepbcBgAAAMc"]
[Fri Apr 03 18:49:27.032368 2026] [:error] [pid 33445:tid 33453] [client 74.248.137.46:6055] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "ac-bN1lRNZ0iDVmJWM3GnQAAAAM"]
[Fri Apr 03 18:49:27.553958 2026] [:error] [pid 33542:tid 33557] [client 74.248.137.46:6019] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "ac-bN3wb6uB1LaGtepbcCgAAAMw"]
[Fri Apr 03 18:49:28.077674 2026] [:error] [pid 33542:tid 33549] [client 74.248.137.46:6121] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "ac-bOHwb6uB1LaGtepbcDAAAAMQ"]
[Fri Apr 03 18:49:28.616823 2026] [:error] [pid 33542:tid 33568] [client 74.248.137.46:6023] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "ac-bOHwb6uB1LaGtepbcEAAAANc"]
[Fri Apr 03 18:49:29.147334 2026] [:error] [pid 40562:tid 40574] [client 74.248.137.46:5971] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "ac-bOTfFMXuP9zvqCepRagAAAYk"]
[Fri Apr 03 18:49:29.663479 2026] [:error] [pid 33542:tid 33561] [client 74.248.137.46:6127] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "ac-bOXwb6uB1LaGtepbcFwAAANA"]
[Fri Apr 03 18:49:30.177065 2026] [:error] [pid 33446:tid 33498] [client 74.248.137.46:6141] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/o.php"] [unique_id "ac-bOtg3dCqFYIIdw0oNYwAAAFU"]
[Fri Apr 03 18:49:30.721226 2026] [:error] [pid 55174:tid 55178] [client 74.248.137.46:5975] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/o.php"] [unique_id "ac-bOp_WKqUonPNUHYzJnwAAAcI"]
[Fri Apr 03 18:49:31.251286 2026] [:error] [pid 33447:tid 33506] [client 74.248.137.46:6112] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/o.php"] [unique_id "ac-bO0gaPmDHz92j4lMnOQAAAII"]
[Fri Apr 03 18:49:31.770843 2026] [:error] [pid 35469:tid 35482] [client 74.248.137.46:6110] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/o.php"] [unique_id "ac-bO6GvTIc8-wY3jUQhJQAAAQs"]
[Fri Apr 03 18:49:32.318814 2026] [:error] [pid 40562:tid 40588] [client 74.248.137.46:6094] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "ac-bPDfFMXuP9zvqCepRbgAAAZc"]
[Fri Apr 03 18:49:32.834485 2026] [:error] [pid 33447:tid 33505] [client 74.248.137.46:6130] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "ac-bPEgaPmDHz92j4lMnOgAAAIE"]
[Fri Apr 03 18:49:33.363390 2026] [:error] [pid 55174:tid 55184] [client 74.248.137.46:6020] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "ac-bPZ_WKqUonPNUHYzJpgAAAcg"]
[Fri Apr 03 18:49:33.878718 2026] [:error] [pid 35469:tid 35495] [client 74.248.137.46:6117] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "ac-bPaGvTIc8-wY3jUQhJwAAARg"]
[Fri Apr 03 18:49:34.394872 2026] [:error] [pid 35469:tid 35472] [client 74.248.137.46:6101] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "ac-bPqGvTIc8-wY3jUQhKQAAAQE"]
[Fri Apr 03 18:49:34.923025 2026] [:error] [pid 35469:tid 35491] [client 74.248.137.46:6118] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "ac-bPqGvTIc8-wY3jUQhLQAAARQ"]
[Fri Apr 03 18:49:35.441921 2026] [:error] [pid 33445:tid 33461] [client 74.248.137.46:6018] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "ac-bP1lRNZ0iDVmJWM3GqAAAAAs"]
[Fri Apr 03 18:49:35.996047 2026] [:error] [pid 33447:tid 33506] [client 74.248.137.46:6021] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "ac-bP0gaPmDHz92j4lMnQwAAAII"]
[Fri Apr 03 18:49:36.523799 2026] [:error] [pid 55174:tid 55190] [client 74.248.137.46:6037] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/ssd/sallu.php"] [unique_id "ac-bQJ_WKqUonPNUHYzJqQAAAc4"]
[Fri Apr 03 18:49:37.044595 2026] [:error] [pid 33542:tid 33547] [client 74.248.137.46:6113] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/ssd/sallu.php"] [unique_id "ac-bQXwb6uB1LaGtepbcJwAAAMI"]
[Fri Apr 03 18:49:37.564682 2026] [:error] [pid 33446:tid 33491] [client 74.248.137.46:6017] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/ssd/sallu.php"] [unique_id "ac-bQdg3dCqFYIIdw0oNbgAAAE4"]
[Fri Apr 03 18:49:38.090980 2026] [:error] [pid 33446:tid 33496] [client 74.248.137.46:5955] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/ssd/sallu.php"] [unique_id "ac-bQtg3dCqFYIIdw0oNcQAAAFM"]
[Fri Apr 03 18:49:38.610991 2026] [:error] [pid 33446:tid 33478] [client 74.248.137.46:6025] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "ac-bQtg3dCqFYIIdw0oNdAAAAEE"]
[Fri Apr 03 18:49:39.141421 2026] [:error] [pid 33445:tid 33461] [client 74.248.137.46:6053] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "ac-bQ1lRNZ0iDVmJWM3GswAAAAs"]
[Fri Apr 03 18:49:39.663713 2026] [:error] [pid 33445:tid 33453] [client 74.248.137.46:6100] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "ac-bQ1lRNZ0iDVmJWM3GuAAAAAM"]
[Fri Apr 03 18:49:40.183870 2026] [:error] [pid 55174:tid 55180] [client 74.248.137.46:6124] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "ac-bRJ_WKqUonPNUHYzJrwAAAcQ"]
[Fri Apr 03 18:49:40.728393 2026] [:error] [pid 40533:tid 40554] [client 74.248.137.46:5961] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "ac-bRPbIAA8AViDmwsuRxgAAAVM"]
[Fri Apr 03 18:49:41.244631 2026] [:error] [pid 35469:tid 35494] [client 74.248.137.46:6139] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "ac-bRaGvTIc8-wY3jUQhRQAAARc"]
[Fri Apr 03 18:49:41.762121 2026] [:error] [pid 33542:tid 33557] [client 74.248.137.46:6103] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "ac-bRXwb6uB1LaGtepbcKwAAAMw"]
[Fri Apr 03 18:49:42.280459 2026] [:error] [pid 33542:tid 33550] [client 74.248.137.46:6125] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "ac-bRnwb6uB1LaGtepbcLQAAAMU"]
[Fri Apr 03 18:49:42.792188 2026] [:error] [pid 40562:tid 40570] [client 74.248.137.46:5974] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "ac-bRjfFMXuP9zvqCepRfwAAAYU"]
[Fri Apr 03 18:49:43.334883 2026] [:error] [pid 33445:tid 33457] [client 74.248.137.46:6027] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "ac-bR1lRNZ0iDVmJWM3GugAAAAc"]
[Fri Apr 03 18:49:43.858614 2026] [:error] [pid 40533:tid 40557] [client 74.248.137.46:6140] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "ac-bR_bIAA8AViDmwsuRzwAAAVY"]
[Fri Apr 03 18:49:44.373654 2026] [:error] [pid 35469:tid 35484] [client 74.248.137.46:6128] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "ac-bSKGvTIc8-wY3jUQhSQAAAQ0"]
[Fri Apr 03 18:49:44.883808 2026] [:error] [pid 40562:tid 40565] [client 74.248.137.46:6033] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file32.php"] [unique_id "ac-bSDfFMXuP9zvqCepRiQAAAYA"]
[Fri Apr 03 18:49:45.400431 2026] [:error] [pid 33445:tid 33458] [client 74.248.137.46:6102] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file32.php"] [unique_id "ac-bSVlRNZ0iDVmJWM3GwAAAAAg"]
[Fri Apr 03 18:49:45.919340 2026] [:error] [pid 40562:tid 40582] [client 74.248.137.46:6098] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file32.php"] [unique_id "ac-bSTfFMXuP9zvqCepRkAAAAZE"]
[Fri Apr 03 18:49:46.438564 2026] [:error] [pid 33446:tid 33487] [client 74.248.137.46:6086] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file32.php"] [unique_id "ac-bStg3dCqFYIIdw0oNkQAAAEo"]
[Fri Apr 03 18:49:46.954877 2026] [:error] [pid 33445:tid 33459] [client 74.248.137.46:6116] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nope.php"] [unique_id "ac-bSllRNZ0iDVmJWM3GyQAAAAk"]
[Fri Apr 03 18:49:47.469663 2026] [:error] [pid 35469:tid 35492] [client 74.248.137.46:6059] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nope.php"] [unique_id "ac-bS6GvTIc8-wY3jUQhTQAAARU"]
[Fri Apr 03 18:49:47.979809 2026] [:error] [pid 35469:tid 35489] [client 74.248.137.46:6069] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nope.php"] [unique_id "ac-bS6GvTIc8-wY3jUQhUAAAARI"]
[Fri Apr 03 18:49:48.499506 2026] [:error] [pid 33445:tid 33466] [client 74.248.137.46:5966] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nope.php"] [unique_id "ac-bTFlRNZ0iDVmJWM3GzwAAABA"]
[Fri Apr 03 18:49:49.015399 2026] [:error] [pid 35469:tid 35488] [client 74.248.137.46:6119] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js.php"] [unique_id "ac-bTaGvTIc8-wY3jUQhWAAAARE"]
[Fri Apr 03 18:49:49.528888 2026] [:error] [pid 35469:tid 35493] [client 74.248.137.46:6043] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js.php"] [unique_id "ac-bTaGvTIc8-wY3jUQhXQAAARY"]
[Fri Apr 03 18:49:50.041142 2026] [:error] [pid 35469:tid 35487] [client 74.248.137.46:6036] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js.php"] [unique_id "ac-bTqGvTIc8-wY3jUQhYwAAARA"]
[Fri Apr 03 18:49:50.558589 2026] [:error] [pid 33446:tid 33484] [client 74.248.137.46:6065] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js.php"] [unique_id "ac-bTtg3dCqFYIIdw0oNlgAAAEc"]
[Fri Apr 03 18:49:51.089838 2026] [:error] [pid 33446:tid 33498] [client 74.248.137.46:6035] [client 74.248.137.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "ac-bT9g3dCqFYIIdw0oNmgAAAFU"]
[Fri Apr 03 18:49:51.607189 2026] [:error] [pid 33446:tid 33487] [client 74.248.137.46:6039] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "ac-bT9g3dCqFYIIdw0oNoAAAAEo"]
[Fri Apr 03 18:49:52.125287 2026] [:error] [pid 33446:tid 33484] [client 74.248.137.46:6032] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "ac-bUNg3dCqFYIIdw0oNowAAAEc"]
[Fri Apr 03 18:49:52.654623 2026] [:error] [pid 33446:tid 33490] [client 74.248.137.46:5973] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "ac-bUNg3dCqFYIIdw0oNqgAAAE0"]
[Fri Apr 03 18:49:53.172585 2026] [:error] [pid 40562:tid 40574] [client 74.248.137.46:6068] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "ac-bUTfFMXuP9zvqCepRmQAAAYk"]
[Fri Apr 03 18:49:53.683871 2026] [:error] [pid 35469:tid 35484] [client 74.248.137.46:6137] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mah.php"] [unique_id "ac-bUaGvTIc8-wY3jUQhZQAAAQ0"]
[Fri Apr 03 18:49:54.203826 2026] [:error] [pid 33542:tid 33546] [client 74.248.137.46:6111] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mah.php"] [unique_id "ac-bUnwb6uB1LaGtepbcNQAAAME"]
[Fri Apr 03 18:49:54.753847 2026] [:error] [pid 35469:tid 35472] [client 74.248.137.46:5977] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mah.php"] [unique_id "ac-bUqGvTIc8-wY3jUQhZwAAAQE"]
[Fri Apr 03 18:49:55.264364 2026] [:error] [pid 33445:tid 33468] [client 74.248.137.46:6126] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mah.php"] [unique_id "ac-bU1lRNZ0iDVmJWM3G2AAAABI"]
[Fri Apr 03 18:49:55.781585 2026] [:error] [pid 33445:tid 33455] [client 74.248.137.46:6088] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "ac-bU1lRNZ0iDVmJWM3G3AAAAAU"]
[Fri Apr 03 18:49:56.301040 2026] [:error] [pid 40533:tid 40541] [client 74.248.137.46:6109] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "ac-bVPbIAA8AViDmwsuR1QAAAUY"]
[Fri Apr 03 18:49:56.812820 2026] [:error] [pid 33445:tid 33462] [client 74.248.137.46:5982] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "ac-bVFlRNZ0iDVmJWM3G3gAAAAw"]
[Fri Apr 03 18:49:57.326593 2026] [:error] [pid 35469:tid 35480] [client 74.248.137.46:6085] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "ac-bVaGvTIc8-wY3jUQhbAAAAQk"]
[Fri Apr 03 18:49:57.850557 2026] [:error] [pid 35469:tid 35477] [client 74.248.137.46:6097] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "ac-bVaGvTIc8-wY3jUQhcwAAAQY"]
[Fri Apr 03 18:49:58.369859 2026] [:error] [pid 35469:tid 35489] [client 74.248.137.46:5953] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "ac-bVqGvTIc8-wY3jUQhewAAARI"]
[Fri Apr 03 18:49:58.901901 2026] [:error] [pid 33542:tid 33554] [client 74.248.137.46:6024] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "ac-bVnwb6uB1LaGtepbcOAAAAMk"]
[Fri Apr 03 18:49:59.421251 2026] [:error] [pid 40562:tid 40589] [client 74.248.137.46:6047] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "ac-bVzfFMXuP9zvqCepRpgAAAZg"]
[Fri Apr 03 18:49:59.953285 2026] [:error] [pid 33542:tid 33560] [client 74.248.137.46:5972] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wfile.php"] [unique_id "ac-bV3wb6uB1LaGtepbcOQAAAM8"]
[Fri Apr 03 18:50:00.465510 2026] [:error] [pid 33445:tid 33467] [client 74.248.137.46:6078] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wfile.php"] [unique_id "ac-bWFlRNZ0iDVmJWM3G5wAAABE"]
[Fri Apr 03 18:50:00.995446 2026] [:error] [pid 33445:tid 33470] [client 74.248.137.46:6047] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wfile.php"] [unique_id "ac-bWFlRNZ0iDVmJWM3G7AAAABQ"]
[Fri Apr 03 18:50:01.532580 2026] [:error] [pid 33447:tid 33510] [client 74.248.137.46:6129] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wfile.php"] [unique_id "ac-bWUgaPmDHz92j4lMnVQAAAIY"]
[Fri Apr 03 18:50:02.092945 2026] [:error] [pid 55174:tid 55178] [client 74.248.137.46:6081] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ok.php"] [unique_id "ac-bWp_WKqUonPNUHYzJywAAAcI"]
[Fri Apr 03 18:50:02.604014 2026] [:error] [pid 35469:tid 35493] [client 74.248.137.46:6046] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ok.php"] [unique_id "ac-bWqGvTIc8-wY3jUQhgwAAARY"]
[Fri Apr 03 18:50:03.126688 2026] [:error] [pid 40533:tid 40559] [client 74.248.137.46:6030] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ok.php"] [unique_id "ac-bW_bIAA8AViDmwsuR2AAAAVg"]
[Fri Apr 03 18:50:03.641955 2026] [:error] [pid 33445:tid 33455] [client 74.248.137.46:6016] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ok.php"] [unique_id "ac-bW1lRNZ0iDVmJWM3HAgAAAAU"]
[Fri Apr 03 18:50:04.156840 2026] [:error] [pid 33445:tid 33450] [client 74.248.137.46:6095] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid3.php"] [unique_id "ac-bXFlRNZ0iDVmJWM3HAwAAAAA"]
[Fri Apr 03 18:50:04.668893 2026] [:error] [pid 35469:tid 35486] [client 74.248.137.46:6064] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid3.php"] [unique_id "ac-bXKGvTIc8-wY3jUQhjAAAAQ8"]
[Fri Apr 03 18:50:05.191561 2026] [:error] [pid 33445:tid 33470] [client 74.248.137.46:5986] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid3.php"] [unique_id "ac-bXVlRNZ0iDVmJWM3HCgAAABQ"]
[Fri Apr 03 18:50:05.702851 2026] [:error] [pid 35469:tid 35483] [client 74.248.137.46:6040] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid3.php"] [unique_id "ac-bXaGvTIc8-wY3jUQhjQAAAQw"]
[Fri Apr 03 18:50:06.214467 2026] [:error] [pid 33446:tid 33490] [client 74.248.137.46:6080] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "ac-bXtg3dCqFYIIdw0oNuwAAAE0"]
[Fri Apr 03 18:50:06.729624 2026] [:error] [pid 33446:tid 33495] [client 74.248.137.46:5963] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "ac-bXtg3dCqFYIIdw0oNvQAAAFI"]
[Fri Apr 03 18:50:07.240526 2026] [:error] [pid 33446:tid 33497] [client 74.248.137.46:5954] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "ac-bX9g3dCqFYIIdw0oNwAAAAFQ"]
[Fri Apr 03 18:50:07.754175 2026] [:error] [pid 33445:tid 33456] [client 74.248.137.46:6008] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "ac-bX1lRNZ0iDVmJWM3HDwAAAAY"]
[Fri Apr 03 18:50:08.274791 2026] [:error] [pid 33445:tid 33451] [client 74.248.137.46:6000] [client 74.248.137.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "ac-bYFlRNZ0iDVmJWM3HEgAAAAE"]
[Fri Apr 03 18:50:08.786697 2026] [:error] [pid 40533:tid 40554] [client 74.248.137.46:6041] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/123.php"] [unique_id "ac-bYPbIAA8AViDmwsuR3gAAAVM"]
[Fri Apr 03 18:50:09.307450 2026] [:error] [pid 33445:tid 33454] [client 74.248.137.46:6062] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/123.php"] [unique_id "ac-bYVlRNZ0iDVmJWM3HFAAAAAQ"]
[Fri Apr 03 18:50:09.822350 2026] [:error] [pid 55174:tid 55183] [client 74.248.137.46:6034] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/123.php"] [unique_id "ac-bYZ_WKqUonPNUHYzJ1wAAAcc"]
[Fri Apr 03 18:50:10.340049 2026] [:error] [pid 35469:tid 35492] [client 74.248.137.46:5978] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-links-opml.php"] [unique_id "ac-bYqGvTIc8-wY3jUQhlwAAARU"]
[Fri Apr 03 18:50:10.851616 2026] [:error] [pid 33445:tid 33453] [client 74.248.137.46:6010] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-links-opml.php"] [unique_id "ac-bYllRNZ0iDVmJWM3HFQAAAAM"]
[Fri Apr 03 18:50:11.364381 2026] [:error] [pid 33446:tid 33495] [client 74.248.137.46:6070] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-links-opml.php"] [unique_id "ac-bY9g3dCqFYIIdw0oNzQAAAFI"]
[Fri Apr 03 18:50:11.877248 2026] [:error] [pid 55174:tid 55178] [client 74.248.137.46:6056] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-links-opml.php"] [unique_id "ac-bY5_WKqUonPNUHYzJ2gAAAcI"]
[Fri Apr 03 18:50:12.392439 2026] [:error] [pid 35469:tid 35481] [client 74.248.137.46:6107] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp.php"] [unique_id "ac-bZKGvTIc8-wY3jUQhnQAAAQo"]
[Fri Apr 03 18:50:12.916480 2026] [:error] [pid 33542:tid 33561] [client 74.248.137.46:6038] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp.php"] [unique_id "ac-bZHwb6uB1LaGtepbcRwAAANA"]
[Fri Apr 03 18:50:13.440356 2026] [:error] [pid 35469:tid 35472] [client 74.248.137.46:5962] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp.php"] [unique_id "ac-bZaGvTIc8-wY3jUQhoQAAAQE"]
[Fri Apr 03 18:50:13.952724 2026] [:error] [pid 33446:tid 33483] [client 74.248.137.46:6091] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp.php"] [unique_id "ac-bZdg3dCqFYIIdw0oN0AAAAEY"]
[Fri Apr 03 18:50:14.464563 2026] [:error] [pid 33446:tid 33480] [client 74.248.137.46:6045] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "ac-bZtg3dCqFYIIdw0oN0QAAAEM"]
[Fri Apr 03 18:50:14.981411 2026] [:error] [pid 35469:tid 35481] [client 74.248.137.46:6058] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "ac-bZqGvTIc8-wY3jUQhqgAAAQo"]
[Fri Apr 03 18:50:15.511879 2026] [:error] [pid 33445:tid 33461] [client 74.248.137.46:6011] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moon.php"] [unique_id "ac-bZ1lRNZ0iDVmJWM3HHgAAAAs"]
[Fri Apr 03 18:50:25.874150 2026] [:error] [pid 33445:tid 33457] [client 74.248.137.46:5964] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-gr.php"] [unique_id "ac-bcVlRNZ0iDVmJWM3HOAAAAAc"]
[Fri Apr 03 18:50:26.386369 2026] [:error] [pid 55174:tid 55193] [client 74.248.137.46:5888] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-gr.php"] [unique_id "ac-bcp_WKqUonPNUHYzJ5wAAAdE"]
[Fri Apr 03 18:50:26.908459 2026] [:error] [pid 40562:tid 40580] [client 74.248.137.46:6122] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-gr.php"] [unique_id "ac-bcjfFMXuP9zvqCepR0gAAAY8"]
[Fri Apr 03 18:50:27.422604 2026] [:error] [pid 33446:tid 33498] [client 74.248.137.46:5996] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-gr.php"] [unique_id "ac-bc9g3dCqFYIIdw0oN9wAAAFU"]
[Fri Apr 03 18:50:27.934127 2026] [:error] [pid 40562:tid 40576] [client 74.248.137.46:5968] [client 74.248.137.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "ac-bczfFMXuP9zvqCepR0wAAAYs"]
[Fri Apr 03 18:50:28.457889 2026] [:error] [pid 33446:tid 33495] [client 74.248.137.46:5916] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "ac-bdNg3dCqFYIIdw0oN-gAAAFI"]
[Fri Apr 03 18:50:28.975027 2026] [:error] [pid 33445:tid 33462] [client 74.248.137.46:5979] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "ac-bdFlRNZ0iDVmJWM3HOgAAAAw"]
[Fri Apr 03 18:50:29.487821 2026] [:error] [pid 33446:tid 33479] [client 74.248.137.46:6142] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "ac-bddg3dCqFYIIdw0oOAAAAAEI"]
[Fri Apr 03 18:50:30.005466 2026] [:error] [pid 33446:tid 33498] [client 74.248.137.46:5838] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ext.php"] [unique_id "ac-bdtg3dCqFYIIdw0oOBQAAAFU"]
[Fri Apr 03 18:50:30.542007 2026] [:error] [pid 33446:tid 33482] [client 74.248.137.46:6012] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ext.php"] [unique_id "ac-bdtg3dCqFYIIdw0oOCgAAAEU"]
[Fri Apr 03 18:50:31.063693 2026] [:error] [pid 40533:tid 40550] [client 74.248.137.46:6003] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ext.php"] [unique_id "ac-bd_bIAA8AViDmwsuR5AAAAU8"]
[Fri Apr 03 18:50:31.582860 2026] [:error] [pid 33542:tid 33569] [client 74.248.137.46:5999] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ext.php"] [unique_id "ac-bd3wb6uB1LaGtepbcWAAAANg"]
[Fri Apr 03 18:50:32.093106 2026] [:error] [pid 33445:tid 33471] [client 74.248.137.46:6136] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about3.php"] [unique_id "ac-beFlRNZ0iDVmJWM3HPQAAABU"]
[Fri Apr 03 18:50:32.604504 2026] [:error] [pid 33446:tid 33499] [client 74.248.137.46:5896] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about3.php"] [unique_id "ac-beNg3dCqFYIIdw0oOEQAAAFY"]
[Fri Apr 03 18:50:33.132249 2026] [:error] [pid 33446:tid 33500] [client 74.248.137.46:6074] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about3.php"] [unique_id "ac-bedg3dCqFYIIdw0oOFgAAAFc"]
[Fri Apr 03 18:50:33.645860 2026] [:error] [pid 33446:tid 33498] [client 74.248.137.46:6007] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about3.php"] [unique_id "ac-bedg3dCqFYIIdw0oOGQAAAFU"]
[Fri Apr 03 18:50:34.159840 2026] [:error] [pid 33446:tid 33493] [client 74.248.137.46:5905] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ac-betg3dCqFYIIdw0oOHgAAAFA"]
[Fri Apr 03 18:50:34.671484 2026] [:error] [pid 33446:tid 33486] [client 74.248.137.46:6031] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ac-betg3dCqFYIIdw0oOIAAAAEk"]
[Fri Apr 03 18:50:35.187984 2026] [:error] [pid 33445:tid 33470] [client 74.248.137.46:5986] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ac-be1lRNZ0iDVmJWM3HQgAAABQ"]
[Fri Apr 03 18:50:35.712876 2026] [:error] [pid 55174:tid 55194] [client 74.248.137.46:5952] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ac-be5_WKqUonPNUHYzJ-gAAAdI"]
[Fri Apr 03 18:50:36.244043 2026] [:error] [pid 33446:tid 33497] [client 74.248.137.46:6099] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "ac-bfNg3dCqFYIIdw0oOKgAAAFQ"]
[Fri Apr 03 18:50:36.762666 2026] [:error] [pid 33445:tid 33461] [client 74.248.137.46:6083] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "ac-bfFlRNZ0iDVmJWM3HRAAAAAs"]
[Fri Apr 03 18:50:37.287570 2026] [:error] [pid 33446:tid 33482] [client 74.248.137.46:6051] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "ac-bfdg3dCqFYIIdw0oOMAAAAEU"]
[Fri Apr 03 18:50:37.815170 2026] [:error] [pid 40562:tid 40571] [client 74.248.137.46:6077] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "ac-bfTfFMXuP9zvqCepR5gAAAYY"]
[Fri Apr 03 18:50:38.340754 2026] [:error] [pid 40562:tid 40574] [client 74.248.137.46:6029] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "ac-bfjfFMXuP9zvqCepR6QAAAYk"]
[Fri Apr 03 18:50:38.854513 2026] [:error] [pid 55174:tid 55193] [client 74.248.137.46:5908] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "ac-bfp_WKqUonPNUHYzJ_QAAAdE"]
[Fri Apr 03 18:50:39.373074 2026] [:error] [pid 33446:tid 33498] [client 74.248.137.46:6133] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "ac-bf9g3dCqFYIIdw0oOPAAAAFU"]
[Fri Apr 03 18:50:39.913919 2026] [:error] [pid 33446:tid 33485] [client 74.248.137.46:6132] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "ac-bf9g3dCqFYIIdw0oOQgAAAEg"]
[Fri Apr 03 18:50:40.429894 2026] [:error] [pid 33447:tid 33521] [client 74.248.137.46:5914] [client 74.248.137.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "ac-bgEgaPmDHz92j4lMndQAAAJE"]
[Fri Apr 03 18:50:40.943796 2026] [:error] [pid 33446:tid 33487] [client 74.248.137.46:6054] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ahax.php"] [unique_id "ac-bgNg3dCqFYIIdw0oORgAAAEo"]
[Fri Apr 03 18:50:41.458051 2026] [:error] [pid 33446:tid 33493] [client 74.248.137.46:5991] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ahax.php"] [unique_id "ac-bgdg3dCqFYIIdw0oOSwAAAFA"]
[Fri Apr 03 18:50:41.970512 2026] [:error] [pid 35469:tid 35473] [client 74.248.137.46:5956] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ahax.php"] [unique_id "ac-bgaGvTIc8-wY3jUQh3AAAAQI"]
[Fri Apr 03 18:50:42.503187 2026] [:error] [pid 33446:tid 33501] [client 74.248.137.46:5895] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "ac-bgtg3dCqFYIIdw0oOUwAAAFg"]
[Fri Apr 03 18:50:43.026249 2026] [:error] [pid 33445:tid 33466] [client 74.248.137.46:6138] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "ac-bg1lRNZ0iDVmJWM3HTgAAABA"]
[Fri Apr 03 18:50:43.538594 2026] [:error] [pid 33445:tid 33461] [client 74.248.137.46:5909] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "ac-bg1lRNZ0iDVmJWM3HUgAAAAs"]
[Fri Apr 03 18:50:44.079311 2026] [:error] [pid 33445:tid 33465] [client 74.248.137.46:5890] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "ac-bhFlRNZ0iDVmJWM3HVgAAAA8"]
[Fri Apr 03 18:50:44.591204 2026] [:error] [pid 55174:tid 55199] [client 74.248.137.46:5897] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "ac-bhJ_WKqUonPNUHYzKBQAAAdc"]
[Fri Apr 03 18:50:45.111794 2026] [:error] [pid 33445:tid 33473] [client 74.248.137.46:6143] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "ac-bhVlRNZ0iDVmJWM3HXwAAABc"]
[Fri Apr 03 18:50:45.625064 2026] [:error] [pid 35469:tid 35489] [client 74.248.137.46:5959] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "ac-bhaGvTIc8-wY3jUQh4wAAARI"]
[Fri Apr 03 18:50:46.146588 2026] [:error] [pid 40562:tid 40570] [client 74.248.137.46:6079] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "ac-bhjfFMXuP9zvqCepR9AAAAYU"]
[Fri Apr 03 18:50:46.663139 2026] [:error] [pid 33447:tid 33525] [client 74.248.137.46:6048] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app/webroot/filemanager.php"] [unique_id "ac-bhkgaPmDHz92j4lMnfgAAAJU"]
[Fri Apr 03 18:50:47.180096 2026] [:error] [pid 33446:tid 33500] [client 74.248.137.46:5967] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app/webroot/filemanager.php"] [unique_id "ac-bh9g3dCqFYIIdw0oOYAAAAFc"]
[Fri Apr 03 18:50:47.694068 2026] [:error] [pid 35469:tid 35479] [client 74.248.137.46:6074] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app/webroot/filemanager.php"] [unique_id "ac-bh6GvTIc8-wY3jUQh6AAAAQg"]
[Fri Apr 03 18:50:48.205992 2026] [:error] [pid 40533:tid 40550] [client 74.248.137.46:5907] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app/webroot/filemanager.php"] [unique_id "ac-biPbIAA8AViDmwsuR9QAAAU8"]
[Fri Apr 03 18:50:48.715124 2026] [:error] [pid 35469:tid 35488] [client 74.248.137.46:5903] [client 74.248.137.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "ac-biKGvTIc8-wY3jUQh7AAAARE"]
[Fri Apr 03 18:50:49.236731 2026] [:error] [pid 33446:tid 33497] [client 74.248.137.46:6066] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "ac-bidg3dCqFYIIdw0oOZwAAAFQ"]
[Fri Apr 03 18:50:49.752491 2026] [:error] [pid 33446:tid 33478] [client 74.248.137.46:5993] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "ac-bidg3dCqFYIIdw0oOawAAAEE"]
[Fri Apr 03 18:50:50.264069 2026] [:error] [pid 33447:tid 33520] [client 74.248.137.46:6002] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "ac-bikgaPmDHz92j4lMngwAAAJA"]
[Fri Apr 03 18:50:50.776438 2026] [:error] [pid 33446:tid 33486] [client 74.248.137.46:5901] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "ac-bitg3dCqFYIIdw0oObQAAAEk"]
[Fri Apr 03 18:50:51.286802 2026] [:error] [pid 40562:tid 40586] [client 74.248.137.46:6052] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "ac-bizfFMXuP9zvqCepSAAAAAZU"]
[Fri Apr 03 18:50:51.799338 2026] [:error] [pid 33542:tid 33549] [client 74.248.137.46:5985] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "ac-bi3wb6uB1LaGtepbcZgAAAMQ"]
[Fri Apr 03 18:50:52.335642 2026] [:error] [pid 40533:tid 40546] [client 74.248.137.46:6120] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "ac-bjPbIAA8AViDmwsuR_AAAAUs"]
[Fri Apr 03 18:50:52.848385 2026] [:error] [pid 33445:tid 33465] [client 74.248.137.46:5984] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/filemanager.php"] [unique_id "ac-bjFlRNZ0iDVmJWM3HbgAAAA8"]
[Fri Apr 03 18:50:53.363091 2026] [:error] [pid 33445:tid 33462] [client 74.248.137.46:6073] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/filemanager.php"] [unique_id "ac-bjVlRNZ0iDVmJWM3HcgAAAAw"]
[Fri Apr 03 18:50:53.883278 2026] [:error] [pid 33447:tid 33527] [client 74.248.137.46:6072] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/filemanager.php"] [unique_id "ac-bjUgaPmDHz92j4lMniQAAAJc"]
[Fri Apr 03 18:50:54.395249 2026] [:error] [pid 33446:tid 33488] [client 74.248.137.46:5943] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/filemanager.php"] [unique_id "ac-bjtg3dCqFYIIdw0oOdAAAAEs"]
[Fri Apr 03 18:50:54.907191 2026] [:error] [pid 40533:tid 40557] [client 74.248.137.46:5939] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/voga/sallu.php"] [unique_id "ac-bjvbIAA8AViDmwsuR_wAAAVY"]
[Fri Apr 03 18:50:55.418717 2026] [:error] [pid 33446:tid 33484] [client 74.248.137.46:5828] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/voga/sallu.php"] [unique_id "ac-bj9g3dCqFYIIdw0oOdgAAAEc"]
[Fri Apr 03 18:50:55.956508 2026] [:error] [pid 40533:tid 40547] [client 74.248.137.46:5829] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/voga/sallu.php"] [unique_id "ac-bj_bIAA8AViDmwsuSAAAAAUw"]
[Fri Apr 03 18:50:56.492620 2026] [:error] [pid 33542:tid 33558] [client 74.248.137.46:6106] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/voga/sallu.php"] [unique_id "ac-bkHwb6uB1LaGtepbccQAAAM0"]
[Fri Apr 03 18:50:57.016205 2026] [:error] [pid 35469:tid 35472] [client 74.248.137.46:5998] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dlu.php"] [unique_id "ac-bkaGvTIc8-wY3jUQh8gAAAQE"]
[Fri Apr 03 18:50:57.528996 2026] [:error] [pid 35469:tid 35485] [client 74.248.137.46:5976] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dlu.php"] [unique_id "ac-bkaGvTIc8-wY3jUQh9gAAAQ4"]
[Fri Apr 03 18:50:58.042111 2026] [:error] [pid 40562:tid 40584] [client 74.248.137.46:6049] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dlu.php"] [unique_id "ac-bkjfFMXuP9zvqCepSBwAAAZM"]
[Fri Apr 03 18:50:58.576312 2026] [:error] [pid 35469:tid 35476] [client 74.248.137.46:5987] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dlu.php"] [unique_id "ac-bkqGvTIc8-wY3jUQh_QAAAQU"]
[Fri Apr 03 18:50:59.096707 2026] [:error] [pid 33445:tid 33454] [client 74.248.137.46:5989] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/555.php"] [unique_id "ac-bk1lRNZ0iDVmJWM3HfQAAAAQ"]
[Fri Apr 03 18:50:59.618457 2026] [:error] [pid 40562:tid 40566] [client 74.248.137.46:5904] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/555.php"] [unique_id "ac-bkzfFMXuP9zvqCepSDQAAAYE"]
[Fri Apr 03 18:51:00.136060 2026] [:error] [pid 33445:tid 33474] [client 74.248.137.46:5917] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/555.php"] [unique_id "ac-blFlRNZ0iDVmJWM3HfgAAABg"]
[Fri Apr 03 18:51:00.656904 2026] [:error] [pid 33446:tid 33482] [client 74.248.137.46:5994] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/555.php"] [unique_id "ac-blNg3dCqFYIIdw0oOfAAAAEU"]
[Fri Apr 03 18:51:01.167123 2026] [:error] [pid 33445:tid 33455] [client 74.248.137.46:5891] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "ac-blVlRNZ0iDVmJWM3HggAAAAU"]
[Fri Apr 03 18:51:01.682742 2026] [:error] [pid 33445:tid 33467] [client 74.248.137.46:5969] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "ac-blVlRNZ0iDVmJWM3HhgAAABE"]
[Fri Apr 03 18:51:02.204774 2026] [:error] [pid 33445:tid 33459] [client 74.248.137.46:5931] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "ac-blllRNZ0iDVmJWM3HjQAAAAk"]
[Fri Apr 03 18:51:02.725954 2026] [:error] [pid 35469:tid 35495] [client 74.248.137.46:5845] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "ac-blqGvTIc8-wY3jUQiCQAAARg"]
[Fri Apr 03 18:51:03.239388 2026] [:error] [pid 33446:tid 33498] [client 74.248.137.46:6005] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "ac-bl9g3dCqFYIIdw0oOgQAAAFU"]
[Fri Apr 03 18:51:03.754342 2026] [:error] [pid 35469:tid 35478] [client 74.248.137.46:5997] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "ac-bl6GvTIc8-wY3jUQiEQAAAQc"]
[Fri Apr 03 18:51:04.267084 2026] [:error] [pid 33542:tid 33562] [client 74.248.137.46:5960] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "ac-bmHwb6uB1LaGtepbceAAAANE"]
[Fri Apr 03 18:51:04.781711 2026] [:error] [pid 33446:tid 33493] [client 74.248.137.46:5869] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/403.php"] [unique_id "ac-bmNg3dCqFYIIdw0oOgwAAAFA"]
[Fri Apr 03 18:51:05.303514 2026] [:error] [pid 33542:tid 33551] [client 74.248.137.46:5913] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tox.php"] [unique_id "ac-bmXwb6uB1LaGtepbceQAAAMY"]
[Fri Apr 03 18:51:05.818428 2026] [:error] [pid 35469:tid 35478] [client 74.248.137.46:5915] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tox.php"] [unique_id "ac-bmaGvTIc8-wY3jUQiGQAAAQc"]
[Fri Apr 03 18:51:06.339130 2026] [:error] [pid 33542:tid 33546] [client 74.248.137.46:5934] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tox.php"] [unique_id "ac-bmnwb6uB1LaGtepbcewAAAME"]
[Fri Apr 03 18:51:06.857034 2026] [:error] [pid 35469:tid 35474] [client 74.248.137.46:6013] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tox.php"] [unique_id "ac-bmqGvTIc8-wY3jUQiGgAAAQM"]
[Fri Apr 03 18:51:07.402268 2026] [:error] [pid 33542:tid 33557] [client 74.248.137.46:5913] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "ac-bm3wb6uB1LaGtepbcgAAAAMw"]
[Fri Apr 03 18:51:07.918160 2026] [:error] [pid 40562:tid 40582] [client 74.248.137.46:6004] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "ac-bmzfFMXuP9zvqCepSHAAAAZE"]
[Fri Apr 03 18:51:08.445103 2026] [:error] [pid 33446:tid 33481] [client 74.248.137.46:6015] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "ac-bnNg3dCqFYIIdw0oOkAAAAEQ"]
[Fri Apr 03 18:51:08.959266 2026] [:error] [pid 33542:tid 33555] [client 74.248.137.46:5906] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "ac-bnHwb6uB1LaGtepbchgAAAMo"]
[Fri Apr 03 18:51:09.497126 2026] [:error] [pid 33447:tid 33516] [client 74.248.137.46:5893] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hook.php"] [unique_id "ac-bnUgaPmDHz92j4lMnkwAAAIw"]
[Fri Apr 03 18:51:10.017609 2026] [:error] [pid 33542:tid 33552] [client 74.248.137.46:5889] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hook.php"] [unique_id "ac-bnnwb6uB1LaGtepbcigAAAMc"]
[Fri Apr 03 18:51:10.530926 2026] [:error] [pid 33445:tid 33464] [client 74.248.137.46:6063] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hook.php"] [unique_id "ac-bnllRNZ0iDVmJWM3HkgAAAA4"]
[Fri Apr 03 18:51:11.063658 2026] [:error] [pid 33542:tid 33568] [client 74.248.137.46:6061] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hook.php"] [unique_id "ac-bn3wb6uB1LaGtepbcjAAAANc"]
[Fri Apr 03 18:51:11.581919 2026] [:error] [pid 33542:tid 33553] [client 74.248.137.46:5857] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "ac-bn3wb6uB1LaGtepbcjgAAAMg"]
[Fri Apr 03 18:51:12.112315 2026] [:error] [pid 33447:tid 33505] [client 74.248.137.46:5940] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "ac-boEgaPmDHz92j4lMnmAAAAIE"]
[Fri Apr 03 18:51:12.629419 2026] [:error] [pid 33447:tid 33528] [client 74.248.137.46:5965] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "ac-boEgaPmDHz92j4lMnmgAAAJg"]
[Fri Apr 03 18:51:13.139196 2026] [:error] [pid 33542:tid 33545] [client 74.248.137.46:5935] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "ac-boXwb6uB1LaGtepbclgAAAMA"]
[Fri Apr 03 18:51:13.655816 2026] [:error] [pid 33542:tid 33565] [client 74.248.137.46:5902] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "ac-boXwb6uB1LaGtepbcmAAAANQ"]
[Fri Apr 03 18:51:14.176949 2026] [:error] [pid 33542:tid 33547] [client 74.248.137.46:5930] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "ac-bonwb6uB1LaGtepbcnAAAAMI"]
[Fri Apr 03 18:51:14.710480 2026] [:error] [pid 33542:tid 33546] [client 74.248.137.46:5990] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "ac-bonwb6uB1LaGtepbcoQAAAME"]
[Fri Apr 03 18:51:15.258655 2026] [:error] [pid 33446:tid 33498] [client 74.248.137.46:5923] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "ac-bo9g3dCqFYIIdw0oOlwAAAFU"]
[Fri Apr 03 18:51:15.782395 2026] [:error] [pid 33447:tid 33528] [client 74.248.137.46:5933] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "ac-bo0gaPmDHz92j4lMnqQAAAJg"]
[Fri Apr 03 18:51:16.293439 2026] [:error] [pid 33447:tid 33517] [client 74.248.137.46:5884] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "ac-bpEgaPmDHz92j4lMnqgAAAI0"]
[Fri Apr 03 18:51:16.810615 2026] [:error] [pid 33446:tid 33488] [client 74.248.137.46:5983] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "ac-bpNg3dCqFYIIdw0oOmgAAAEs"]
[Fri Apr 03 18:51:17.322619 2026] [:error] [pid 35469:tid 35474] [client 74.248.137.46:5782] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v.php"] [unique_id "ac-bpaGvTIc8-wY3jUQiLwAAAQM"]
[Fri Apr 03 18:51:17.833907 2026] [:error] [pid 35469:tid 35492] [client 74.248.137.46:5898] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/te.php"] [unique_id "ac-bpaGvTIc8-wY3jUQiMwAAARU"]
[Fri Apr 03 18:51:18.352258 2026] [:error] [pid 33445:tid 33458] [client 74.248.137.46:5836] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/te.php"] [unique_id "ac-bpllRNZ0iDVmJWM3HmwAAAAg"]
[Fri Apr 03 18:51:18.875700 2026] [:error] [pid 35469:tid 35495] [client 74.248.137.46:6090] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/te.php"] [unique_id "ac-bpqGvTIc8-wY3jUQiNwAAARg"]
[Fri Apr 03 18:51:19.399323 2026] [:error] [pid 33542:tid 33557] [client 74.248.137.46:5830] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/te.php"] [unique_id "ac-bp3wb6uB1LaGtepbcpQAAAMw"]
[Fri Apr 03 18:51:19.918755 2026] [:error] [pid 35469:tid 35474] [client 74.248.137.46:5900] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "ac-bp6GvTIc8-wY3jUQiPAAAAQM"]
[Fri Apr 03 18:51:20.451582 2026] [:error] [pid 33446:tid 33484] [client 74.248.137.46:5910] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "ac-bqNg3dCqFYIIdw0oOnAAAAEc"]
[Fri Apr 03 18:51:20.999403 2026] [:error] [pid 33446:tid 33490] [client 74.248.137.46:5882] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "ac-bqNg3dCqFYIIdw0oOnQAAAE0"]
[Fri Apr 03 18:51:21.566414 2026] [:error] [pid 35469:tid 35489] [client 74.248.137.46:6014] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "ac-bqaGvTIc8-wY3jUQiRQAAARI"]
[Fri Apr 03 18:51:22.089118 2026] [:error] [pid 33445:tid 33473] [client 74.248.137.46:5947] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "ac-bqllRNZ0iDVmJWM3HoQAAABc"]
[Fri Apr 03 18:51:22.604903 2026] [:error] [pid 33446:tid 33494] [client 74.248.137.46:5981] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "ac-bqtg3dCqFYIIdw0oOowAAAFE"]
[Fri Apr 03 18:51:23.120517 2026] [:error] [pid 35469:tid 35477] [client 74.248.137.46:5826] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "ac-bq6GvTIc8-wY3jUQiSgAAAQY"]
[Fri Apr 03 18:51:23.654459 2026] [:error] [pid 40533:tid 40550] [client 74.248.137.46:5942] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "ac-bq_bIAA8AViDmwsuSEAAAAU8"]
[Fri Apr 03 18:51:24.196539 2026] [:error] [pid 55174:tid 55200] [client 74.248.137.46:5949] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "ac-brJ_WKqUonPNUHYzKLgAAAdg"]
[Fri Apr 03 18:51:24.723156 2026] [:error] [pid 40562:tid 40579] [client 74.248.137.46:5951] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "ac-brDfFMXuP9zvqCepSMgAAAY4"]
[Fri Apr 03 18:51:35.842075 2026] [:error] [pid 33542:tid 33551] [client 74.248.137.46:6082] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "ac-bt3wb6uB1LaGtepbczQAAAMY"]
[Fri Apr 03 18:51:36.360127 2026] [:error] [pid 33445:tid 33469] [client 74.248.137.46:6009] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "ac-buFlRNZ0iDVmJWM3HtwAAABM"]
[Fri Apr 03 18:51:36.877731 2026] [:error] [pid 33446:tid 33500] [client 74.248.137.46:5855] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "ac-buNg3dCqFYIIdw0oOygAAAFc"]
[Fri Apr 03 18:51:37.399736 2026] [:error] [pid 33445:tid 33463] [client 74.248.137.46:5847] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "ac-buVlRNZ0iDVmJWM3HuwAAAA0"]
[Fri Apr 03 18:51:37.915348 2026] [:error] [pid 33447:tid 33519] [client 74.248.137.46:6050] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mo.php"] [unique_id "ac-buUgaPmDHz92j4lMnuwAAAI8"]
[Fri Apr 03 18:51:38.430728 2026] [:error] [pid 35469:tid 35485] [client 74.248.137.46:5936] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mo.php"] [unique_id "ac-buqGvTIc8-wY3jUQiagAAAQ4"]
[Fri Apr 03 18:51:38.953354 2026] [:error] [pid 55174:tid 55176] [client 74.248.137.46:6075] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mo.php"] [unique_id "ac-bup_WKqUonPNUHYzKPAAAAcA"]
[Fri Apr 03 18:51:39.468357 2026] [:error] [pid 33447:tid 33512] [client 74.248.137.46:6057] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mo.php"] [unique_id "ac-bu0gaPmDHz92j4lMnwAAAAIg"]
[Fri Apr 03 18:51:39.982231 2026] [:error] [pid 40533:tid 40535] [client 74.248.137.46:5768] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "ac-bu_bIAA8AViDmwsuSHwAAAUA"]
[Fri Apr 03 18:51:40.495269 2026] [:error] [pid 35469:tid 35483] [client 74.248.137.46:5929] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "ac-bvKGvTIc8-wY3jUQicQAAAQw"]
[Fri Apr 03 18:51:41.013858 2026] [:error] [pid 33445:tid 33467] [client 74.248.137.46:5924] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "ac-bvVlRNZ0iDVmJWM3HwAAAABE"]
[Fri Apr 03 18:51:41.528500 2026] [:error] [pid 33447:tid 33509] [client 74.248.137.46:5862] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "ac-bvUgaPmDHz92j4lMnwwAAAIU"]
[Fri Apr 03 18:51:42.067706 2026] [:error] [pid 33447:tid 33511] [client 74.248.137.46:5894] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inde.php"] [unique_id "ac-bvkgaPmDHz92j4lMnxQAAAIc"]
[Fri Apr 03 18:51:42.581888 2026] [:error] [pid 55174:tid 55190] [client 74.248.137.46:5922] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inde.php"] [unique_id "ac-bvp_WKqUonPNUHYzKQgAAAc4"]
[Fri Apr 03 18:51:43.109804 2026] [:error] [pid 55174:tid 55183] [client 74.248.137.46:5912] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inde.php"] [unique_id "ac-bv5_WKqUonPNUHYzKQwAAAcc"]
[Fri Apr 03 18:51:43.629776 2026] [:error] [pid 33446:tid 33492] [client 74.248.137.46:5872] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inde.php"] [unique_id "ac-bv9g3dCqFYIIdw0oO1QAAAE8"]
[Fri Apr 03 18:51:44.144293 2026] [:error] [pid 33446:tid 33486] [client 74.248.137.46:5921] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "ac-bwNg3dCqFYIIdw0oO2gAAAEk"]
[Fri Apr 03 18:51:44.671076 2026] [:error] [pid 40533:tid 40542] [client 74.248.137.46:5899] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "ac-bwPbIAA8AViDmwsuSIwAAAUc"]
[Fri Apr 03 18:51:45.203976 2026] [:error] [pid 33446:tid 33500] [client 74.248.137.46:5824] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "ac-bwdg3dCqFYIIdw0oO3wAAAFc"]
[Fri Apr 03 18:51:45.733068 2026] [:error] [pid 35469:tid 35493] [client 74.248.137.46:5868] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "ac-bwaGvTIc8-wY3jUQifwAAARY"]
[Fri Apr 03 18:51:46.251303 2026] [:error] [pid 33446:tid 33477] [client 74.248.137.46:5840] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "ac-bwtg3dCqFYIIdw0oO4wAAAEA"]
[Fri Apr 03 18:51:46.789096 2026] [:error] [pid 33446:tid 33495] [client 74.248.137.46:5950] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "ac-bwtg3dCqFYIIdw0oO5QAAAFI"]
[Fri Apr 03 18:51:47.299537 2026] [:error] [pid 33446:tid 33487] [client 74.248.137.46:5892] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "ac-bw9g3dCqFYIIdw0oO6QAAAEo"]
[Fri Apr 03 18:51:47.814487 2026] [:error] [pid 33446:tid 33490] [client 74.248.137.46:5841] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "ac-bw9g3dCqFYIIdw0oO8AAAAE0"]
[Fri Apr 03 18:51:48.327894 2026] [:error] [pid 33445:tid 33450] [client 74.248.137.46:5920] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxin.php"] [unique_id "ac-bxFlRNZ0iDVmJWM3HxQAAAAA"]
[Fri Apr 03 18:51:48.843895 2026] [:error] [pid 35469:tid 35494] [client 74.248.137.46:5835] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxin.php"] [unique_id "ac-bxKGvTIc8-wY3jUQihgAAARc"]
[Fri Apr 03 18:51:49.388081 2026] [:error] [pid 33446:tid 33497] [client 74.248.137.46:5970] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxin.php"] [unique_id "ac-bxdg3dCqFYIIdw0oO9QAAAFQ"]
[Fri Apr 03 18:51:49.930103 2026] [:error] [pid 33446:tid 33496] [client 74.248.137.46:5827] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxin.php"] [unique_id "ac-bxdg3dCqFYIIdw0oO-AAAAFM"]
[Fri Apr 03 18:51:50.451719 2026] [:error] [pid 33446:tid 33491] [client 74.248.137.46:5881] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "ac-bxtg3dCqFYIIdw0oO-wAAAE4"]
[Fri Apr 03 18:51:50.982137 2026] [:error] [pid 35469:tid 35492] [client 74.248.137.46:5938] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "ac-bxqGvTIc8-wY3jUQijQAAARU"]
[Fri Apr 03 18:51:51.494740 2026] [:error] [pid 33446:tid 33481] [client 74.248.137.46:5858] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "ac-bx9g3dCqFYIIdw0oPAgAAAEQ"]
[Fri Apr 03 18:51:52.015369 2026] [:error] [pid 35469:tid 35477] [client 74.248.137.46:6044] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "ac-byKGvTIc8-wY3jUQikgAAAQY"]
[Fri Apr 03 18:51:52.530753 2026] [:error] [pid 40562:tid 40588] [client 74.248.137.46:5926] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NewFile.php"] [unique_id "ac-byDfFMXuP9zvqCepSQwAAAZc"]
[Fri Apr 03 18:51:53.046208 2026] [:error] [pid 33446:tid 33496] [client 74.248.137.46:5866] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NewFile.php"] [unique_id "ac-bydg3dCqFYIIdw0oPCAAAAFM"]
[Fri Apr 03 18:51:53.570886 2026] [:error] [pid 33447:tid 33527] [client 74.248.137.46:5859] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NewFile.php"] [unique_id "ac-byUgaPmDHz92j4lMn0gAAAJc"]
[Fri Apr 03 18:51:54.097090 2026] [:error] [pid 55174:tid 55200] [client 74.248.137.46:5865] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NewFile.php"] [unique_id "ac-byp_WKqUonPNUHYzKSwAAAdg"]
[Fri Apr 03 18:51:54.615044 2026] [:error] [pid 40562:tid 40586] [client 74.248.137.46:5937] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "ac-byjfFMXuP9zvqCepSRAAAAZU"]
[Fri Apr 03 18:51:55.133777 2026] [:error] [pid 40533:tid 40545] [client 74.248.137.46:5873] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "ac-by_bIAA8AViDmwsuSJwAAAUo"]
[Fri Apr 03 18:51:55.646460 2026] [:error] [pid 40533:tid 40550] [client 74.248.137.46:5860] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "ac-by_bIAA8AViDmwsuSKAAAAU8"]
[Fri Apr 03 18:51:56.177675 2026] [:error] [pid 33446:tid 33496] [client 74.248.137.46:5932] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "ac-bzNg3dCqFYIIdw0oPGQAAAFM"]
[Fri Apr 03 18:51:56.700052 2026] [:error] [pid 35469:tid 35472] [client 74.248.137.46:5766] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolv2.php"] [unique_id "ac-bzKGvTIc8-wY3jUQimAAAAQE"]
[Fri Apr 03 18:51:57.216882 2026] [:error] [pid 55174:tid 55179] [client 74.248.137.46:6026] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolv2.php"] [unique_id "ac-bzZ_WKqUonPNUHYzKTQAAAcM"]
[Fri Apr 03 18:51:57.733718 2026] [:error] [pid 35469:tid 35475] [client 74.248.137.46:5837] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolv2.php"] [unique_id "ac-bzaGvTIc8-wY3jUQimwAAAQQ"]
[Fri Apr 03 18:51:58.273492 2026] [:error] [pid 33447:tid 33518] [client 74.248.137.46:5957] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wolv2.php"] [unique_id "ac-bzkgaPmDHz92j4lMn1QAAAI4"]
[Fri Apr 03 18:51:58.783434 2026] [:error] [pid 40562:tid 40572] [client 74.248.137.46:5928] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geck.php"] [unique_id "ac-bzjfFMXuP9zvqCepSTQAAAYc"]
[Fri Apr 03 18:51:59.371452 2026] [:error] [pid 33446:tid 33486] [client 74.248.137.46:5919] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geck.php"] [unique_id "ac-bz9g3dCqFYIIdw0oPJAAAAEk"]
[Fri Apr 03 18:51:59.883108 2026] [:error] [pid 33446:tid 33478] [client 74.248.137.46:5788] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geck.php"] [unique_id "ac-bz9g3dCqFYIIdw0oPJwAAAEE"]
[Fri Apr 03 18:52:00.419354 2026] [:error] [pid 33446:tid 33487] [client 74.248.137.46:5844] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geck.php"] [unique_id "ac-b0Ng3dCqFYIIdw0oPKgAAAEo"]
[Fri Apr 03 18:52:00.938310 2026] [:error] [pid 33446:tid 33486] [client 74.248.137.46:5787] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xtt.php"] [unique_id "ac-b0Ng3dCqFYIIdw0oPLgAAAEk"]
[Fri Apr 03 18:52:01.478161 2026] [:error] [pid 33446:tid 33478] [client 74.248.137.46:5780] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xtt.php"] [unique_id "ac-b0dg3dCqFYIIdw0oPNgAAAEE"]
[Fri Apr 03 18:52:01.991406 2026] [:error] [pid 33446:tid 33497] [client 74.248.137.46:5880] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xtt.php"] [unique_id "ac-b0dg3dCqFYIIdw0oPOgAAAFQ"]
[Fri Apr 03 18:52:02.521006 2026] [:error] [pid 33446:tid 33480] [client 74.248.137.46:6076] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xtt.php"] [unique_id "ac-b0tg3dCqFYIIdw0oPQAAAAEM"]
[Fri Apr 03 18:52:03.046015 2026] [:error] [pid 35469:tid 35482] [client 74.248.137.46:5944] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "ac-b06GvTIc8-wY3jUQipAAAAQs"]
[Fri Apr 03 18:52:03.561365 2026] [:error] [pid 33445:tid 33470] [client 74.248.137.46:5853] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "ac-b01lRNZ0iDVmJWM3HzQAAABQ"]
[Fri Apr 03 18:52:04.081525 2026] [:error] [pid 40562:tid 40582] [client 74.248.137.46:5790] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "ac-b1DfFMXuP9zvqCepSVwAAAZE"]
[Fri Apr 03 18:52:04.668112 2026] [:error] [pid 35469:tid 35490] [client 74.248.137.46:5863] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "ac-b1KGvTIc8-wY3jUQirQAAARM"]
[Fri Apr 03 18:52:05.190717 2026] [:error] [pid 40533:tid 40540] [client 74.248.137.46:5843] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system.php"] [unique_id "ac-b1fbIAA8AViDmwsuSLAAAAUU"]
[Fri Apr 03 18:52:05.728595 2026] [:error] [pid 55174:tid 55194] [client 74.248.137.46:5946] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system.php"] [unique_id "ac-b1Z_WKqUonPNUHYzKVQAAAdI"]
[Fri Apr 03 18:52:06.255698 2026] [:error] [pid 33445:tid 33453] [client 74.248.137.46:5948] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system.php"] [unique_id "ac-b1llRNZ0iDVmJWM3H0QAAAAM"]
[Fri Apr 03 18:52:06.778348 2026] [:error] [pid 40533:tid 40539] [client 74.248.137.46:5918] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system.php"] [unique_id "ac-b1vbIAA8AViDmwsuSLwAAAUQ"]
[Fri Apr 03 18:52:07.303093 2026] [:error] [pid 33445:tid 33458] [client 74.248.137.46:5779] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "ac-b11lRNZ0iDVmJWM3H1QAAAAg"]
[Fri Apr 03 18:52:07.815979 2026] [:error] [pid 33446:tid 33477] [client 74.248.137.46:5992] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "ac-b19g3dCqFYIIdw0oPUAAAAEA"]
[Fri Apr 03 18:52:08.328701 2026] [:error] [pid 33445:tid 33472] [client 74.248.137.46:5871] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "ac-b2FlRNZ0iDVmJWM3H2gAAABY"]
[Fri Apr 03 18:52:08.848859 2026] [:error] [pid 35469:tid 35485] [client 74.248.137.46:5773] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/manager.php"] [unique_id "ac-b2KGvTIc8-wY3jUQisgAAAQ4"]
[Fri Apr 03 18:52:09.365839 2026] [:error] [pid 55174:tid 55199] [client 74.248.137.46:5864] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gdn.php"] [unique_id "ac-b2Z_WKqUonPNUHYzKWQAAAdc"]
[Fri Apr 03 18:52:09.904321 2026] [:error] [pid 33445:tid 33460] [client 74.248.137.46:5876] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gdn.php"] [unique_id "ac-b2VlRNZ0iDVmJWM3H3gAAAAo"]
[Fri Apr 03 18:52:10.419198 2026] [:error] [pid 35469:tid 35481] [client 74.248.137.46:5867] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gdn.php"] [unique_id "ac-b2qGvTIc8-wY3jUQitQAAAQo"]
[Fri Apr 03 18:52:10.942681 2026] [:error] [pid 35469:tid 35483] [client 74.248.137.46:6067] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gdn.php"] [unique_id "ac-b2qGvTIc8-wY3jUQiugAAAQw"]
[Fri Apr 03 18:52:11.458341 2026] [:error] [pid 33542:tid 33546] [client 74.248.137.46:5798] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "ac-b23wb6uB1LaGtepbc4AAAAME"]
[Fri Apr 03 18:52:11.969651 2026] [:error] [pid 40533:tid 40544] [client 74.248.137.46:5925] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "ac-b2_bIAA8AViDmwsuSMAAAAUk"]
[Fri Apr 03 18:52:12.494905 2026] [:error] [pid 35469:tid 35474] [client 74.248.137.46:5817] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "ac-b3KGvTIc8-wY3jUQivgAAAQM"]
[Fri Apr 03 18:52:13.027067 2026] [:error] [pid 40562:tid 40587] [client 74.248.137.46:5850] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ton.php"] [unique_id "ac-b3TfFMXuP9zvqCepSXgAAAZY"]
[Fri Apr 03 18:52:13.543731 2026] [:error] [pid 40533:tid 40551] [client 74.248.137.46:5791] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/media.php"] [unique_id "ac-b3fbIAA8AViDmwsuSMgAAAVA"]
[Fri Apr 03 18:52:14.061111 2026] [:error] [pid 40562:tid 40582] [client 74.248.137.46:5877] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/media.php"] [unique_id "ac-b3jfFMXuP9zvqCepSYwAAAZE"]
[Fri Apr 03 18:52:14.595639 2026] [:error] [pid 35469:tid 35487] [client 74.248.137.46:5718] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/media.php"] [unique_id "ac-b3qGvTIc8-wY3jUQiwAAAARA"]
[Fri Apr 03 18:52:15.108880 2026] [:error] [pid 33446:tid 33498] [client 74.248.137.46:5834] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/media.php"] [unique_id "ac-b39g3dCqFYIIdw0oPWgAAAFU"]
[Fri Apr 03 18:52:15.622418 2026] [:error] [pid 33445:tid 33459] [client 74.248.137.46:5854] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/admin.php"] [unique_id "ac-b31lRNZ0iDVmJWM3H5wAAAAk"]
[Fri Apr 03 18:52:16.134067 2026] [:error] [pid 33542:tid 33569] [client 74.248.137.46:5831] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/admin.php"] [unique_id "ac-b4Hwb6uB1LaGtepbc5QAAANg"]
[Fri Apr 03 18:52:16.647088 2026] [:error] [pid 35469:tid 35472] [client 74.248.137.46:5833] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/admin.php"] [unique_id "ac-b4KGvTIc8-wY3jUQixQAAAQE"]
[Fri Apr 03 18:52:17.159633 2026] [:error] [pid 33446:tid 33478] [client 74.248.137.46:5793] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/admin.php"] [unique_id "ac-b4dg3dCqFYIIdw0oPWwAAAEE"]
[Fri Apr 03 18:52:17.683146 2026] [:error] [pid 40533:tid 40548] [client 74.248.137.46:5856] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admir.php"] [unique_id "ac-b4fbIAA8AViDmwsuSOQAAAU0"]
[Fri Apr 03 18:52:18.197192 2026] [:error] [pid 33446:tid 33492] [client 74.248.137.46:5789] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admir.php"] [unique_id "ac-b4tg3dCqFYIIdw0oPXQAAAE8"]
[Fri Apr 03 18:52:18.716804 2026] [:error] [pid 33447:tid 33524] [client 74.248.137.46:6006] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admir.php"] [unique_id "ac-b4kgaPmDHz92j4lMn6AAAAJQ"]
[Fri Apr 03 18:52:19.233285 2026] [:error] [pid 35469:tid 35474] [client 74.248.137.46:5770] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admir.php"] [unique_id "ac-b46GvTIc8-wY3jUQiyQAAAQM"]
[Fri Apr 03 18:52:19.750496 2026] [:error] [pid 40562:tid 40565] [client 74.248.137.46:5846] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "ac-b4zfFMXuP9zvqCepSbwAAAYA"]
[Fri Apr 03 18:52:20.267332 2026] [:error] [pid 55174:tid 55185] [client 74.248.137.46:5781] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "ac-b5J_WKqUonPNUHYzKZQAAAck"]
[Fri Apr 03 18:52:20.777635 2026] [:error] [pid 33445:tid 33465] [client 74.248.137.46:5988] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "ac-b5FlRNZ0iDVmJWM3H8wAAAA8"]
[Fri Apr 03 18:52:21.298405 2026] [:error] [pid 33542:tid 33560] [client 74.248.137.46:5786] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "ac-b5Xwb6uB1LaGtepbc6QAAAM8"]
[Fri Apr 03 18:52:21.809291 2026] [:error] [pid 55174:tid 55183] [client 74.248.137.46:5927] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/error.php"] [unique_id "ac-b5Z_WKqUonPNUHYzKcAAAAcc"]
[Fri Apr 03 18:52:22.331413 2026] [:error] [pid 55174:tid 55193] [client 74.248.137.46:5911] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/error.php"] [unique_id "ac-b5p_WKqUonPNUHYzKcQAAAdE"]
[Fri Apr 03 18:52:22.844810 2026] [:error] [pid 33445:tid 33450] [client 74.248.137.46:5936] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/error.php"] [unique_id "ac-b5llRNZ0iDVmJWM3H9gAAAAA"]
[Fri Apr 03 18:52:23.358946 2026] [:error] [pid 33447:tid 33511] [client 74.248.137.46:5760] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/error.php"] [unique_id "ac-b50gaPmDHz92j4lMn7QAAAIc"]
[Fri Apr 03 18:52:23.869122 2026] [:error] [pid 33542:tid 33549] [client 74.248.137.46:5878] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colour.php"] [unique_id "ac-b53wb6uB1LaGtepbc6wAAAMQ"]
[Fri Apr 03 18:52:24.383220 2026] [:error] [pid 33446:tid 33482] [client 74.248.137.46:5839] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colour.php"] [unique_id "ac-b6Ng3dCqFYIIdw0oPaAAAAEU"]
[Fri Apr 03 18:52:24.898515 2026] [:error] [pid 33446:tid 33479] [client 74.248.137.46:5842] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colour.php"] [unique_id "ac-b6Ng3dCqFYIIdw0oPbAAAAEI"]
[Fri Apr 03 18:52:25.422719 2026] [:error] [pid 35469:tid 35473] [client 74.248.137.46:5874] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colour.php"] [unique_id "ac-b6aGvTIc8-wY3jUQizgAAAQI"]
[Fri Apr 03 18:52:25.936155 2026] [:error] [pid 33446:tid 33494] [client 74.248.137.46:5767] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "ac-b6dg3dCqFYIIdw0oPcgAAAFE"]
[Fri Apr 03 18:52:26.448291 2026] [:error] [pid 33446:tid 33495] [client 74.248.137.46:5803] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "ac-b6tg3dCqFYIIdw0oPdgAAAFI"]
[Fri Apr 03 18:52:26.960811 2026] [:error] [pid 35469:tid 35487] [client 74.248.137.46:5762] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "ac-b6qGvTIc8-wY3jUQi0QAAARA"]
[Fri Apr 03 18:52:27.477907 2026] [:error] [pid 35469:tid 35485] [client 74.248.137.46:5870] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cc.php"] [unique_id "ac-b66GvTIc8-wY3jUQi0gAAAQ4"]
[Fri Apr 03 18:52:27.989624 2026] [:error] [pid 40533:tid 40556] [client 74.248.137.46:5849] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkxzo.php"] [unique_id "ac-b6_bIAA8AViDmwsuSPQAAAVU"]
[Fri Apr 03 18:52:28.509109 2026] [:error] [pid 35469:tid 35492] [client 74.248.137.46:5811] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkxzo.php"] [unique_id "ac-b7KGvTIc8-wY3jUQi2gAAARU"]
[Fri Apr 03 18:52:29.028138 2026] [:error] [pid 35469:tid 35473] [client 74.248.137.46:5763] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkxzo.php"] [unique_id "ac-b7aGvTIc8-wY3jUQi3wAAAQI"]
[Fri Apr 03 18:52:29.552266 2026] [:error] [pid 33447:tid 33520] [client 74.248.137.46:5722] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkxzo.php"] [unique_id "ac-b7UgaPmDHz92j4lMn8AAAAJA"]
[Fri Apr 03 18:52:30.069015 2026] [:error] [pid 33446:tid 33484] [client 74.248.137.46:5776] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lo.php"] [unique_id "ac-b7tg3dCqFYIIdw0oPfQAAAEc"]
[Fri Apr 03 18:52:30.595502 2026] [:error] [pid 55174:tid 55183] [client 74.248.137.46:6029] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lo.php"] [unique_id "ac-b7p_WKqUonPNUHYzKewAAAcc"]
[Fri Apr 03 18:52:31.112688 2026] [:error] [pid 55174:tid 55182] [client 74.248.137.46:5958] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lo.php"] [unique_id "ac-b75_WKqUonPNUHYzKfAAAAcY"]
[Fri Apr 03 18:52:31.632921 2026] [:error] [pid 33542:tid 33565] [client 74.248.137.46:5802] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lo.php"] [unique_id "ac-b73wb6uB1LaGtepbc8wAAANQ"]
[Fri Apr 03 18:52:32.144501 2026] [:error] [pid 33446:tid 33478] [client 74.248.137.46:5724] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "ac-b8Ng3dCqFYIIdw0oPgwAAAEE"]
[Fri Apr 03 18:52:32.661658 2026] [:error] [pid 35469:tid 35483] [client 74.248.137.46:5777] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "ac-b8KGvTIc8-wY3jUQi4gAAAQw"]
[Fri Apr 03 18:52:33.172868 2026] [:error] [pid 33447:tid 33525] [client 74.248.137.46:5764] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "ac-b8UgaPmDHz92j4lMn_AAAAJU"]
[Fri Apr 03 18:52:33.687798 2026] [:error] [pid 40562:tid 40573] [client 74.248.137.46:5772] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "ac-b8TfFMXuP9zvqCepSfwAAAYg"]
[Fri Apr 03 18:52:34.212165 2026] [:error] [pid 33445:tid 33469] [client 74.248.137.46:5814] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/layout.php"] [unique_id "ac-b8llRNZ0iDVmJWM3IFAAAABM"]
[Fri Apr 03 18:52:34.735010 2026] [:error] [pid 55174:tid 55178] [client 74.248.137.46:5941] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/layout.php"] [unique_id "ac-b8p_WKqUonPNUHYzKhgAAAcI"]
[Fri Apr 03 18:52:43.109951 2026] [autoindex:error] [pid 40533:tid 40540] [client 74.248.137.46:6001] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 03 18:52:44.972375 2026] [autoindex:error] [pid 40533:tid 40543] [client 74.248.137.46:6001] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 03 18:52:46.881749 2026] [:error] [pid 40533:tid 40542] [client 74.248.137.46:6001] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/png.php"] [unique_id "ac-b_vbIAA8AViDmwsuSXAAAAUc"]
[Fri Apr 03 18:52:47.393827 2026] [:error] [pid 40533:tid 40547] [client 74.248.137.46:5945] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/png.php"] [unique_id "ac-b__bIAA8AViDmwsuSXQAAAUw"]
[Fri Apr 03 18:52:47.911715 2026] [:error] [pid 40533:tid 40557] [client 74.248.137.46:5794] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/png.php"] [unique_id "ac-b__bIAA8AViDmwsuSXgAAAVY"]
[Fri Apr 03 18:52:48.444546 2026] [:error] [pid 35469:tid 35480] [client 74.248.137.46:5769] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/png.php"] [unique_id "ac-cAKGvTIc8-wY3jUQi_AAAAQk"]
[Fri Apr 03 18:52:48.955061 2026] [:error] [pid 33446:tid 33487] [client 74.248.137.46:5819] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mds.php"] [unique_id "ac-cANg3dCqFYIIdw0oPmAAAAEo"]
[Fri Apr 03 18:52:49.478548 2026] [:error] [pid 33445:tid 33466] [client 74.248.137.46:5848] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mds.php"] [unique_id "ac-cAVlRNZ0iDVmJWM3IOQAAABA"]
[Fri Apr 03 18:52:49.991483 2026] [:error] [pid 35469:tid 35485] [client 74.248.137.46:5825] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mds.php"] [unique_id "ac-cAaGvTIc8-wY3jUQi_QAAAQ4"]
[Fri Apr 03 18:52:50.507904 2026] [:error] [pid 35469:tid 35477] [client 74.248.137.46:5699] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mds.php"] [unique_id "ac-cAqGvTIc8-wY3jUQjAAAAAQY"]
[Fri Apr 03 18:52:51.042778 2026] [:error] [pid 33447:tid 33520] [client 74.248.137.46:5761] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "ac-cA0gaPmDHz92j4lMoCwAAAJA"]
[Fri Apr 03 18:52:51.569432 2026] [:error] [pid 55174:tid 55189] [client 74.248.137.46:5883] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "ac-cA5_WKqUonPNUHYzKlgAAAc0"]
[Fri Apr 03 18:52:52.112032 2026] [:error] [pid 35469:tid 35474] [client 74.248.137.46:5717] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "ac-cBKGvTIc8-wY3jUQjAgAAAQM"]
[Fri Apr 03 18:52:52.632028 2026] [:error] [pid 33446:tid 33477] [client 74.248.137.46:5713] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "ac-cBNg3dCqFYIIdw0oPnQAAAEA"]
[Fri Apr 03 18:52:53.162015 2026] [:error] [pid 33446:tid 33493] [client 74.248.137.46:5875] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "ac-cBdg3dCqFYIIdw0oPnwAAAFA"]
[Fri Apr 03 18:52:53.675081 2026] [:error] [pid 33447:tid 33521] [client 74.248.137.46:5832] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "ac-cBUgaPmDHz92j4lMoDAAAAJE"]
[Fri Apr 03 18:52:54.187244 2026] [:error] [pid 33446:tid 33483] [client 74.248.137.46:5792] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "ac-cBtg3dCqFYIIdw0oPowAAAEY"]
[Fri Apr 03 18:52:54.698684 2026] [:error] [pid 33447:tid 33523] [client 74.248.137.46:5818] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/m.php"] [unique_id "ac-cBkgaPmDHz92j4lMoDQAAAJM"]
[Fri Apr 03 18:52:55.237350 2026] [:error] [pid 33445:tid 33456] [client 74.248.137.46:5667] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-is.php"] [unique_id "ac-cB1lRNZ0iDVmJWM3IRgAAAAY"]
[Fri Apr 03 18:52:55.756064 2026] [:error] [pid 55174:tid 55188] [client 74.248.137.46:5809] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-is.php"] [unique_id "ac-cB5_WKqUonPNUHYzKmQAAAcw"]
[Fri Apr 03 18:52:56.279788 2026] [:error] [pid 40533:tid 40535] [client 74.248.137.46:5778] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-is.php"] [unique_id "ac-cCPbIAA8AViDmwsuSYQAAAUA"]
[Fri Apr 03 18:52:56.795986 2026] [:error] [pid 55174:tid 55180] [client 74.248.137.46:5666] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-is.php"] [unique_id "ac-cCJ_WKqUonPNUHYzKnQAAAcQ"]
[Fri Apr 03 18:52:57.307189 2026] [:error] [pid 33542:tid 33545] [client 74.248.137.46:5753] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file15.php"] [unique_id "ac-cCXwb6uB1LaGtepbdBwAAAMA"]
[Fri Apr 03 18:52:57.820210 2026] [:error] [pid 33542:tid 33554] [client 74.248.137.46:5810] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file15.php"] [unique_id "ac-cCXwb6uB1LaGtepbdCQAAAMk"]
[Fri Apr 03 18:52:58.339388 2026] [:error] [pid 55174:tid 55186] [client 74.248.137.46:5954] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file15.php"] [unique_id "ac-cCp_WKqUonPNUHYzKoAAAAco"]
[Fri Apr 03 18:52:58.856369 2026] [:error] [pid 33446:tid 33486] [client 74.248.137.46:6071] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file15.php"] [unique_id "ac-cCtg3dCqFYIIdw0oPsgAAAEk"]
[Fri Apr 03 18:52:59.375723 2026] [:error] [pid 55174:tid 55194] [client 74.248.137.46:5725] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "ac-cC5_WKqUonPNUHYzKogAAAdI"]
[Fri Apr 03 18:52:59.898447 2026] [:error] [pid 55174:tid 55177] [client 74.248.137.46:5765] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "ac-cC5_WKqUonPNUHYzKpAAAAcE"]
[Fri Apr 03 18:53:00.424021 2026] [:error] [pid 33446:tid 33489] [client 74.248.137.46:5710] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "ac-cDNg3dCqFYIIdw0oPvAAAAEw"]
[Fri Apr 03 18:53:00.944624 2026] [:error] [pid 33542:tid 33563] [client 74.248.137.46:5805] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wsd.php"] [unique_id "ac-cDHwb6uB1LaGtepbdEgAAANI"]
[Fri Apr 03 18:53:01.492394 2026] [:error] [pid 33446:tid 33481] [client 74.248.137.46:5696] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "ac-cDdg3dCqFYIIdw0oPwAAAAEQ"]
[Fri Apr 03 18:53:02.006666 2026] [:error] [pid 33446:tid 33485] [client 74.248.137.46:5731] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "ac-cDtg3dCqFYIIdw0oPxwAAAEg"]
[Fri Apr 03 18:53:02.521273 2026] [:error] [pid 33446:tid 33499] [client 74.248.137.46:5751] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "ac-cDtg3dCqFYIIdw0oPzgAAAFY"]
[Fri Apr 03 18:53:03.036917 2026] [:error] [pid 33446:tid 33498] [client 74.248.137.46:5741] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "ac-cD9g3dCqFYIIdw0oP0gAAAFU"]
[Fri Apr 03 18:53:03.549263 2026] [:error] [pid 33446:tid 33495] [client 74.248.137.46:5800] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "ac-cD9g3dCqFYIIdw0oP1QAAAFI"]
[Fri Apr 03 18:53:04.061144 2026] [:error] [pid 33445:tid 33452] [client 74.248.137.46:5785] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "ac-cEFlRNZ0iDVmJWM3ISgAAAAI"]
[Fri Apr 03 18:53:04.573100 2026] [:error] [pid 33446:tid 33495] [client 74.248.137.46:5815] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "ac-cENg3dCqFYIIdw0oP2wAAAFI"]
[Fri Apr 03 18:53:05.092695 2026] [:error] [pid 33446:tid 33482] [client 74.248.137.46:5729] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an.php"] [unique_id "ac-cEdg3dCqFYIIdw0oP4QAAAEU"]
[Fri Apr 03 18:53:05.605539 2026] [:error] [pid 33445:tid 33464] [client 74.248.137.46:5807] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "ac-cEVlRNZ0iDVmJWM3ITQAAAA4"]
[Fri Apr 03 18:53:06.119109 2026] [:error] [pid 33446:tid 33485] [client 74.248.137.46:5711] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "ac-cEtg3dCqFYIIdw0oP6gAAAEg"]
[Fri Apr 03 18:53:06.638840 2026] [:error] [pid 33446:tid 33494] [client 74.248.137.46:5980] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "ac-cEtg3dCqFYIIdw0oP8AAAAFE"]
[Fri Apr 03 18:53:07.156869 2026] [:error] [pid 33445:tid 33469] [client 74.248.137.46:5784] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "ac-cE1lRNZ0iDVmJWM3IVgAAABM"]
[Fri Apr 03 18:53:07.669331 2026] [:error] [pid 40562:tid 40570] [client 74.248.137.46:5796] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lol.php"] [unique_id "ac-cEzfFMXuP9zvqCepSogAAAYU"]
[Fri Apr 03 18:53:08.192208 2026] [:error] [pid 35469:tid 35489] [client 74.248.137.46:5885] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lol.php"] [unique_id "ac-cFKGvTIc8-wY3jUQjEwAAARI"]
[Fri Apr 03 18:53:08.704441 2026] [:error] [pid 33445:tid 33467] [client 74.248.137.46:5887] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lol.php"] [unique_id "ac-cFFlRNZ0iDVmJWM3IXwAAABE"]
[Fri Apr 03 18:53:09.218846 2026] [:error] [pid 33445:tid 33463] [client 74.248.137.46:5775] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lol.php"] [unique_id "ac-cFVlRNZ0iDVmJWM3IYwAAAA0"]
[Fri Apr 03 18:53:09.733488 2026] [:error] [pid 33446:tid 33497] [client 74.248.137.46:5797] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "ac-cFdg3dCqFYIIdw0oQAQAAAFQ"]
[Fri Apr 03 18:53:10.244104 2026] [:error] [pid 33445:tid 33459] [client 74.248.137.46:5705] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "ac-cFllRNZ0iDVmJWM3IbAAAAAk"]
[Fri Apr 03 18:53:10.755934 2026] [:error] [pid 33446:tid 33488] [client 74.248.137.46:5702] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "ac-cFtg3dCqFYIIdw0oQCgAAAEs"]
[Fri Apr 03 18:53:11.275813 2026] [:error] [pid 40533:tid 40547] [client 74.248.137.46:5816] [client 74.248.137.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "ac-cF_bIAA8AViDmwsuSZgAAAUw"]
[Fri Apr 03 19:03:17.003152 2026] [:error] [pid 35469:tid 35475] [client 206.189.49.128:54754] [client 206.189.49.128] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/api/.env"] [unique_id "ac-edaGvTIc8-wY3jUQoEgAAAQQ"]
[Fri Apr 03 19:03:17.012513 2026] [:error] [pid 35469:tid 35474] [client 206.189.49.128:54746] [client 206.189.49.128] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/env/.env"] [unique_id "ac-edaGvTIc8-wY3jUQoEwAAAQM"]
[Fri Apr 03 19:03:18.852536 2026] [:error] [pid 40562:tid 40583] [client 206.189.49.128:46864] [client 206.189.49.128] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/env/.env"] [unique_id "ac-edjfFMXuP9zvqCepV3QAAAZI"]
[Fri Apr 03 19:03:18.854456 2026] [:error] [pid 33447:tid 33513] [client 206.189.49.128:46874] [client 206.189.49.128] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/api/.env"] [unique_id "ac-edkgaPmDHz92j4lMqEAAAAIk"]
[Fri Apr 03 19:11:30.098538 2026] [:error] [pid 35469:tid 35491] [client 170.106.165.76:59386] [client 170.106.165.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac-gYqGvTIc8-wY3jUQuFQAAARQ"]
[Fri Apr 03 20:37:21.814723 2026] [:error] [pid 35469:tid 35476] [client 62.171.171.199:33260] [client 62.171.171.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.171.171.199, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ac-0gaGvTIc8-wY3jUR2bgAAAQU"]
[Fri Apr 03 20:37:24.394188 2026] [:error] [pid 35469:tid 35482] [client 62.171.171.199:33260] [client 62.171.171.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.171.171.199, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ac-0hKGvTIc8-wY3jUR2gQAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 03 20:59:36.982747 2026] [:error] [pid 33542:tid 33569] [client 117.62.235.53:56891] [client 117.62.235.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ac-5uHwb6uB1LaGtepb3CQAAANg"]
[Fri Apr 03 21:45:22.995738 2026] [:error] [pid 33446:tid 33498] [client 68.221.68.204:58636] [client 68.221.68.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.221.68.204, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ac_Ectg3dCqFYIIdw0p6ngAAAFU"]
[Sat Apr 04 01:31:07.480759 2026] [:error] [pid 12081:tid 12118] [client 51.77.152.49:43606] [client 51.77.152.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.77.152.49, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ac_5W6MJBCYerZTQdmIBggAAAFI"]
[Sat Apr 04 01:31:08.343380 2026] [:error] [pid 12081:tid 12104] [client 51.77.152.49:43606] [client 51.77.152.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.77.152.49, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ac_5XKMJBCYerZTQdmIBhAAAAEQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 04 02:55:01.453545 2026] [:error] [pid 12097:tid 12170] [client 158.158.32.192:32801] [client 158.158.32.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/55l453.php"] [unique_id "adANBRnkcvJ01y2CY3naZAAAAM8"]
[Sat Apr 04 02:55:02.012601 2026] [:error] [pid 44382:tid 44393] [client 158.158.32.192:48024] [client 158.158.32.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "adANBppzSLFOX5FpZ8rX1AAAAAk"]
[Sat Apr 04 02:55:02.496057 2026] [:error] [pid 44382:tid 44402] [client 158.158.32.192:48047] [client 158.158.32.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "adANBppzSLFOX5FpZ8rX1wAAABI"]
[Sat Apr 04 02:55:02.984743 2026] [:error] [pid 44382:tid 44394] [client 158.158.32.192:48039] [client 158.158.32.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "adANBppzSLFOX5FpZ8rX2wAAAAo"]
[Sat Apr 04 02:55:03.462164 2026] [:error] [pid 12089:tid 12135] [client 158.158.32.192:14690] [client 158.158.32.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xx.php"] [unique_id "adANB0SCG1Z_hi7I_jKLWQAAAIg"]
[Sat Apr 04 02:55:03.941555 2026] [:error] [pid 12233:tid 12252] [client 158.158.32.192:10271] [client 158.158.32.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkyac.php"] [unique_id "adANBxQDAzkmdfiSgI3xxAAAARE"]
[Sat Apr 04 02:55:04.421571 2026] [:error] [pid 12233:tid 12239] [client 158.158.32.192:48029] [client 158.158.32.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkyac.php"] [unique_id "adANCBQDAzkmdfiSgI3xxQAAAQQ"]
[Sat Apr 04 02:55:04.912300 2026] [:error] [pid 44382:tid 44395] [client 158.158.32.192:14116] [client 158.158.32.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albrt.php"] [unique_id "adANCJpzSLFOX5FpZ8rX4gAAAAs"]
[Sat Apr 04 02:55:05.389713 2026] [:error] [pid 44382:tid 44390] [client 158.158.32.192:2203] [client 158.158.32.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albrt.php"] [unique_id "adANCZpzSLFOX5FpZ8rX5gAAAAY"]
[Sat Apr 04 02:55:05.868249 2026] [:error] [pid 12233:tid 12241] [client 158.158.32.192:21083] [client 158.158.32.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albrt.php"] [unique_id "adANCRQDAzkmdfiSgI3xygAAAQY"]
[Sat Apr 04 02:55:06.355362 2026] [:error] [pid 12233:tid 12248] [client 158.158.32.192:2199] [client 158.158.32.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albrt.php"] [unique_id "adANChQDAzkmdfiSgI3xzAAAAQ0"]
[Sat Apr 04 03:01:09.782108 2026] [:error] [pid 12097:tid 12164] [client 194.238.31.215:59276] [client 194.238.31.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.238.31.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adAOdRnkcvJ01y2CY3ncQwAAAMk"]
[Sat Apr 04 03:01:11.558668 2026] [:error] [pid 12097:tid 12168] [client 194.238.31.215:59276] [client 194.238.31.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.238.31.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adAOdxnkcvJ01y2CY3ncRwAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 04 03:27:28.409835 2026] [:error] [pid 12233:tid 12244] [client 106.119.167.146:60744] [client 106.119.167.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adAUoBQDAzkmdfiSgI0GNgAAAQk"]
[Sat Apr 04 04:12:21.604601 2026] [:error] [pid 2567:tid 2591] [client 31.56.177.209:55053] [client 31.56.177.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.56.177.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adAfJWJJmfRsTrAKjdQZPgAAANE"], referer: https://expressinteriors.com
[Sat Apr 04 05:22:18.609808 2026] [:error] [pid 2459:tid 2543] [client 18.205.231.47:60062] [client 18.205.231.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.205.231.47, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adAvigefyCmu4LR_PlpmBQAAAIs"]
[Sat Apr 04 05:22:20.076291 2026] [:error] [pid 2459:tid 2534] [client 18.205.231.47:60062] [client 18.205.231.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.205.231.47, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adAvjAefyCmu4LR_PlpmDAAAAIM"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 04 07:04:25.784752 2026] [:error] [pid 37114:tid 37129] [client 45.92.1.112:60318] [client 45.92.1.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adBHec-DnSj3fGMexeKigwAAAQ0"]
[Sat Apr 04 07:04:26.440013 2026] [:error] [pid 2459:tid 2552] [client 45.92.1.112:56595] [client 45.92.1.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adBHegefyCmu4LR_PlqJCAAAAJQ"]
[Sat Apr 04 07:04:27.108518 2026] [:error] [pid 2567:tid 2583] [client 45.92.1.112:51123] [client 45.92.1.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adBHe2JJmfRsTrAKjdSS7AAAAMk"]
[Sat Apr 04 07:04:27.682978 2026] [:error] [pid 2457:tid 2483] [client 45.92.1.112:52921] [client 45.92.1.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adBHe0mNHppaMd92ZpdmwAAAAAY"]
[Sat Apr 04 07:04:28.335420 2026] [:error] [pid 2457:tid 2501] [client 45.92.1.112:52863] [client 45.92.1.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adBHfEmNHppaMd92ZpdmwgAAABg"]
[Sat Apr 04 08:47:29.981554 2026] [:error] [pid 2458:tid 2516] [client 74.121.34.10:51875] [client 74.121.34.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.121.34.10, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adBfoSNozic5SuWqclkUDQAAAEw"]
[Sat Apr 04 08:47:31.255964 2026] [:error] [pid 2458:tid 2511] [client 74.121.34.10:51875] [client 74.121.34.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.121.34.10, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adBfoyNozic5SuWqclkUEAAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 04 12:10:24.911590 2026] [:error] [pid 2458:tid 2514] [client 43.166.255.102:55172] [client 43.166.255.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adCPMCNozic5SuWqcllOfwAAAEo"]
[Sat Apr 04 14:54:32.662466 2026] [:error] [pid 2459:tid 2553] [client 165.22.61.36:53215] [client 165.22.61.36] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "adC1qAefyCmu4LR_Plo7AAAAAJU"]
[Sat Apr 04 15:24:02.041153 2026] [:error] [pid 37114:tid 37124] [client 45.131.195.14:47629] [client 45.131.195.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "adC8ks-DnSj3fGMexeK-7gAAAQg"]
[Sat Apr 04 16:01:30.327212 2026] [:error] [pid 37114:tid 37116] [client 114.96.103.33:33224] [client 114.96.103.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adDFWs-DnSj3fGMexeLZzwAAAQA"]
[Sat Apr 04 17:17:09.994081 2026] [:error] [pid 2457:tid 2481] [client 51.161.81.177:33876] [client 51.161.81.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.161.81.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adDXFUmNHppaMd92ZpcGGgAAAAQ"]
[Sat Apr 04 17:17:12.633361 2026] [:error] [pid 2457:tid 2484] [client 51.161.81.177:33876] [client 51.161.81.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.161.81.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adDXGEmNHppaMd92ZpcGHQAAAAc"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 04 17:35:00.952932 2026] [:error] [pid 2457:tid 2484] [client 43.133.66.51:58604] [client 43.133.66.51] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adDbREmNHppaMd92ZpcMRQAAAAc"]
[Sat Apr 04 19:23:29.486611 2026] [:error] [pid 2458:tid 2511] [client 43.157.174.69:43998] [client 43.157.174.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adD0sSNozic5SuWqcln1yAAAAEc"]
[Sat Apr 04 21:42:27.754051 2026] [:error] [pid 2457:tid 2499] [client 103.255.134.61:56102] [client 103.255.134.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.255.134.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adEVQ0mNHppaMd92ZpdlHwAAABY"]
[Sat Apr 04 21:42:30.000414 2026] [:error] [pid 2457:tid 2483] [client 103.255.134.61:56102] [client 103.255.134.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.255.134.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adEVRUmNHppaMd92ZpdlMgAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 04 22:04:05.471230 2026] [:error] [pid 2459:tid 2538] [client 144.126.155.200:45680] [client 144.126.155.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 144.126.155.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adEaVQefyCmu4LR_Plo_8wAAAIY"]
[Sat Apr 04 22:04:06.853042 2026] [:error] [pid 2459:tid 2540] [client 144.126.155.200:45680] [client 144.126.155.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 144.126.155.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adEaVgefyCmu4LR_Plo_-gAAAIg"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 04 23:32:12.917491 2026] [:error] [pid 63487:tid 63498] [client 169.150.224.227:42284] [client 169.150.224.227] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 169.150.224.227, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adEu_GpqOMD5fJ8_5q06cgAAAUg"]
[Sat Apr 04 23:32:17.474587 2026] [:error] [pid 63487:tid 63499] [client 169.150.224.227:55628] [client 169.150.224.227] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 169.150.224.227, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adEvAWpqOMD5fJ8_5q06iwAAAUk"], referer: http://expressinteriors.com/wp-login.php
[Sat Apr 04 23:50:29.132997 2026] [:error] [pid 63487:tid 63494] [client 43.166.128.86:54182] [client 43.166.128.86] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adEzRWpqOMD5fJ8_5q1D-gAAAUQ"]
[Sun Apr 05 01:03:26.074117 2026] [:error] [pid 54081:tid 54157] [client 162.241.49.35:60106] [client 162.241.49.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.49.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adFEXlJcnxTrqYU7_foirwAAAM4"]
[Sun Apr 05 01:03:27.272919 2026] [:error] [pid 54081:tid 54143] [client 162.241.49.35:60106] [client 162.241.49.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.49.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adFEX1JcnxTrqYU7_foisQAAAME"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 05 02:21:58.178542 2026] [:error] [pid 53819:tid 53875] [client 129.212.238.95:35480] [client 129.212.238.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.212.238.95, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adFWxmkolvq4mv6siDP8EgAAAAI"]
[Sun Apr 05 02:21:59.495425 2026] [:error] [pid 53819:tid 53881] [client 129.212.238.95:35480] [client 129.212.238.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 129.212.238.95, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adFWx2kolvq4mv6siDP8FAAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 05 02:43:12.487006 2026] [:error] [pid 54081:tid 54161] [client 217.216.37.55:58819] [client 217.216.37.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adFbwFJcnxTrqYU7_fpRVwAAANI"]
[Sun Apr 05 02:43:12.714484 2026] [:error] [pid 53820:tid 53904] [client 217.216.37.55:53872] [client 217.216.37.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "adFbwDKzpMZSi9FOeIYxdgAAAEM"]
[Sun Apr 05 02:43:12.926891 2026] [:error] [pid 63313:tid 63320] [client 217.216.37.55:62744] [client 217.216.37.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/media/system/js/core.js"] [unique_id "adFbwO1cPeVj2b7ZXSRy2QAAAQE"]
[Sun Apr 05 03:25:06.792968 2026] [:error] [pid 53819:tid 53879] [client 43.156.204.134:34984] [client 43.156.204.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adFlkmkolvq4mv6siDMU3QAAAAY"]
[Sun Apr 05 04:47:58.275656 2026] [:error] [pid 45303:tid 45320] [client 43.138.68.113:35622] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adF4_rboQ9eViZ4hdnloVAAAAAM"]
[Sun Apr 05 06:10:09.404481 2026] [:error] [pid 45305:tid 45375] [client 43.157.142.101:46844] [client 43.157.142.101] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adGMQejDQjr7aWhjflAk7wAAAIQ"]
[Sun Apr 05 07:11:29.579305 2026] [:error] [pid 45303:tid 45331] [client 20.151.201.236:39039] [client 20.151.201.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.151.201.236, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adGaobboQ9eViZ4hdnmfTQAAAA4"]
[Sun Apr 05 07:12:49.476860 2026] [:error] [pid 45305:tid 45371] [client 74.248.146.253:39752] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/55l453.php"] [unique_id "adGa8ejDQjr7aWhjflBZWwAAAIA"]
[Sun Apr 05 07:12:50.020449 2026] [:error] [pid 45305:tid 45372] [client 74.248.146.253:9053] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/55l453.php"] [unique_id "adGa8ujDQjr7aWhjflBZYgAAAIE"]
[Sun Apr 05 07:12:50.847435 2026] [:error] [pid 30921:tid 30925] [client 74.248.146.253:48599] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/55l453.php"] [unique_id "adGa8mFGQVn8Q0ueB26RWAAAAQI"]
[Sun Apr 05 07:12:51.661043 2026] [:error] [pid 45304:tid 45367] [client 74.248.146.253:48593] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/55l453.php"] [unique_id "adGa8w5jnqDKKovdRkkdwQAAAFc"]
[Sun Apr 05 07:12:53.423341 2026] [:error] [pid 30921:tid 30942] [client 74.248.146.253:24623] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "adGa9WFGQVn8Q0ueB26RWwAAARM"]
[Sun Apr 05 07:12:54.431904 2026] [:error] [pid 45303:tid 45323] [client 74.248.146.253:57198] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "adGa9rboQ9eViZ4hdnmf8gAAAAY"]
[Sun Apr 05 07:12:55.289102 2026] [:error] [pid 45305:tid 45384] [client 74.248.146.253:8968] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "adGa9-jDQjr7aWhjflBZbAAAAI0"]
[Sun Apr 05 07:12:56.138457 2026] [:error] [pid 45305:tid 45377] [client 74.248.146.253:8974] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "adGa-OjDQjr7aWhjflBZbgAAAIY"]
[Sun Apr 05 07:12:56.977870 2026] [:error] [pid 45305:tid 45390] [client 74.248.146.253:35811] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/error_log.php"] [unique_id "adGa-OjDQjr7aWhjflBZdgAAAJM"]
[Sun Apr 05 07:12:58.508413 2026] [:error] [pid 45409:tid 45423] [client 74.248.146.253:34109] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/error_log.php"] [unique_id "adGa-tHt_Oyw03gjCNj8pwAAAMw"]
[Sun Apr 05 07:12:59.744569 2026] [:error] [pid 45409:tid 45434] [client 74.248.146.253:55910] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/error_log.php"] [unique_id "adGa-9Ht_Oyw03gjCNj8rwAAANc"]
[Sun Apr 05 07:13:00.772955 2026] [:error] [pid 45303:tid 45337] [client 74.248.146.253:34067] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/HLA-dd.php"] [unique_id "adGa_LboQ9eViZ4hdnmgAwAAABQ"]
[Sun Apr 05 07:13:01.378943 2026] [:error] [pid 30921:tid 30929] [client 74.248.146.253:8385] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/HLA-dd.php"] [unique_id "adGa_WFGQVn8Q0ueB26RegAAAQY"]
[Sun Apr 05 07:13:02.007655 2026] [:error] [pid 45303:tid 45322] [client 74.248.146.253:34058] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/HLA-dd.php"] [unique_id "adGa_rboQ9eViZ4hdnmgCQAAAAU"]
[Sun Apr 05 07:13:02.566588 2026] [:error] [pid 45305:tid 45388] [client 74.248.146.253:43615] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/HLA-dd.php"] [unique_id "adGa_ujDQjr7aWhjflBZewAAAJE"]
[Sun Apr 05 07:13:03.467206 2026] [:error] [pid 45305:tid 45386] [client 74.248.146.253:34063] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dczem.php"] [unique_id "adGa_-jDQjr7aWhjflBZhAAAAI8"]
[Sun Apr 05 07:13:04.325688 2026] [:error] [pid 45303:tid 45332] [client 74.248.146.253:8413] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dczem.php"] [unique_id "adGbALboQ9eViZ4hdnmgDgAAAA8"]
[Sun Apr 05 07:13:05.283348 2026] [:error] [pid 45409:tid 45430] [client 74.248.146.253:34084] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dczem.php"] [unique_id "adGbAdHt_Oyw03gjCNj8vgAAANM"]
[Sun Apr 05 07:13:05.802432 2026] [:error] [pid 45409:tid 45416] [client 74.248.146.253:35791] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dczem.php"] [unique_id "adGbAdHt_Oyw03gjCNj8wQAAAMU"]
[Sun Apr 05 07:13:06.599874 2026] [:error] [pid 45303:tid 45321] [client 74.248.146.253:44178] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albrt.php"] [unique_id "adGbArboQ9eViZ4hdnmgFAAAAAQ"]
[Sun Apr 05 07:13:07.209702 2026] [:error] [pid 45409:tid 45416] [client 74.248.146.253:44802] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albrt.php"] [unique_id "adGbA9Ht_Oyw03gjCNj8zQAAAMU"]
[Sun Apr 05 07:16:34.424702 2026] [:error] [pid 45305:tid 45382] [client 153.122.190.8:44414] [client 153.122.190.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 153.122.190.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adGb0ujDQjr7aWhjflBbRQAAAIs"]
[Sun Apr 05 07:16:35.708750 2026] [:error] [pid 45305:tid 45383] [client 153.122.190.8:44414] [client 153.122.190.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 153.122.190.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adGb0-jDQjr7aWhjflBbSQAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 05 08:15:43.849898 2026] [:error] [pid 45303:tid 45335] [client 162.240.233.32:55520] [client 162.240.233.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.233.32, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adGpr7boQ9eViZ4hdnmxlwAAABI"]
[Sun Apr 05 08:15:49.400030 2026] [:error] [pid 45409:tid 45423] [client 162.240.233.32:58236] [client 162.240.233.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.233.32, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adGptdHt_Oyw03gjCNgcrwAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 05 08:29:54.449074 2026] [:error] [pid 45303:tid 45335] [client 74.248.146.253:16963] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adGtArboQ9eViZ4hdnm2SwAAABI"]
[Sun Apr 05 08:29:59.457249 2026] [:error] [pid 30921:tid 30944] [client 74.248.146.253:16988] [client 74.248.146.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adGtB2FGQVn8Q0ueB26tLwAAARU"]
[Sun Apr 05 08:44:24.562250 2026] [:error] [pid 45409:tid 45425] [client 123.56.169.216:45910] [client 123.56.169.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/images/metinfo.gif"] [unique_id "adGwaNHt_Oyw03gjCNgrSQAAAM4"], referer: http://expressinteriors.com/public/images/metinfo.gif
[Sun Apr 05 09:56:33.709869 2026] [:error] [pid 45305:tid 45385] [client 43.153.35.128:38140] [client 43.153.35.128] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adHBUejDQjr7aWhjflDUtwAAAI4"]
[Sun Apr 05 10:57:54.050625 2026] [:error] [pid 30921:tid 30940] [client 49.7.227.204:38762] [client 49.7.227.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adHPsmFGQVn8Q0ueB27utQAAARE"]
[Sun Apr 05 12:02:20.098777 2026] [:error] [pid 45305:tid 45383] [client 43.153.192.98:59506] [client 43.153.192.98] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adHezOjDQjr7aWhjflBBogAAAIw"]
[Sun Apr 05 17:13:16.137767 2026] [:error] [pid 45305:tid 45375] [client 43.157.170.13:57078] [client 43.157.170.13] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adInrOjDQjr7aWhjflD5CAAAAIQ"]
[Sun Apr 05 17:28:52.141161 2026] [:error] [pid 45303:tid 45327] [client 125.94.144.102:40771] [client 125.94.144.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adIrVLboQ9eViZ4hdnmgMAAAAAo"]
[Sun Apr 05 19:20:54.270169 2026] [:error] [pid 45303:tid 45321] [client 94.140.135.56:3093] [client 94.140.135.56] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/html"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adJFlrboQ9eViZ4hdnn1CAAAAAQ"]
[Sun Apr 05 19:20:56.603918 2026] [:error] [pid 45303:tid 45335] [client 94.140.135.56:3093] [client 94.140.135.56] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=text/html"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adJFmLboQ9eViZ4hdnn1EQAAABI"]
[Sun Apr 05 19:53:35.423040 2026] [:error] [pid 45304:tid 45345] [client 43.130.131.18:49604] [client 43.130.131.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adJNPw5jnqDKKovdRkn8rgAAAEE"]
[Sun Apr 05 21:32:36.974807 2026] [:error] [pid 45409:tid 45421] [client 159.89.198.33:50476] [client 159.89.198.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.198.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adJkdNHt_Oyw03gjCNgM2wAAAMo"]
[Sun Apr 05 21:32:40.361349 2026] [:error] [pid 45409:tid 45413] [client 159.89.198.33:50476] [client 159.89.198.33] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "adJkeNHt_Oyw03gjCNgM8AAAAMI"]
[Sun Apr 05 21:32:40.456124 2026] [:error] [pid 45409:tid 45420] [client 159.89.198.33:50476] [client 159.89.198.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.198.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adJkeNHt_Oyw03gjCNgM8QAAAMk"]
[Sun Apr 05 21:32:41.630376 2026] [:error] [pid 45304:tid 45359] [client 159.89.198.33:56300] [client 159.89.198.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.198.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adJkeQ5jnqDKKovdRkkbIwAAAE8"]
[Sun Apr 05 21:32:42.515562 2026] [:error] [pid 30921:tid 30934] [client 159.89.198.33:62402] [client 159.89.198.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.198.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adJkemFGQVn8Q0ueB24hQwAAAQs"]
[Sun Apr 05 21:32:43.438415 2026] [:error] [pid 45409:tid 45430] [client 159.89.198.33:57869] [client 159.89.198.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.198.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adJke9Ht_Oyw03gjCNgM_gAAANM"]
[Sun Apr 05 21:32:44.368829 2026] [:error] [pid 45409:tid 45416] [client 159.89.198.33:64448] [client 159.89.198.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.89.198.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adJkfNHt_Oyw03gjCNgNAwAAAMU"]
[Sun Apr 05 21:32:44.368973 2026] [:error] [pid 45409:tid 45416] [client 159.89.198.33:64448] [client 159.89.198.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 159.89.198.33, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adJkfNHt_Oyw03gjCNgNAwAAAMU"]
[Sun Apr 05 21:33:35.521612 2026] [:error] [pid 45409:tid 45415] [client 216.24.210.244:30121] [client 216.24.210.244] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "adJkr9Ht_Oyw03gjCNgNjAAAAMQ"]
[Sun Apr 05 21:37:30.878412 2026] [:error] [pid 30921:tid 30942] [client 43.130.71.237:56668] [client 43.130.71.237] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adJlmmFGQVn8Q0ueB24jOAAAARM"]
[Sun Apr 05 22:26:25.645884 2026] [:error] [pid 45304:tid 45367] [client 158.158.48.159:20842] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "adJxEQ5jnqDKKovdRkktagAAAFc"]
[Sun Apr 05 22:26:26.136722 2026] [:error] [pid 45304:tid 45344] [client 158.158.48.159:21952] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "adJxEg5jnqDKKovdRkktbAAAAEA"]
[Sun Apr 05 22:26:26.681473 2026] [:error] [pid 45409:tid 45433] [client 158.158.48.159:21136] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "adJxEtHt_Oyw03gjCNg5RQAAANY"]
[Sun Apr 05 22:26:27.187272 2026] [:error] [pid 45303:tid 45322] [client 158.158.48.159:22293] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "adJxE7boQ9eViZ4hdnlkswAAAAU"]
[Sun Apr 05 22:26:27.743572 2026] [:error] [pid 45409:tid 45433] [client 158.158.48.159:21907] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "adJxE9Ht_Oyw03gjCNg5UwAAANY"]
[Sun Apr 05 22:26:28.234578 2026] [:error] [pid 45303:tid 45337] [client 158.158.48.159:22373] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "adJxFLboQ9eViZ4hdnlkuwAAABQ"]
[Sun Apr 05 22:26:28.714404 2026] [:error] [pid 45303:tid 45333] [client 158.158.48.159:21982] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "adJxFLboQ9eViZ4hdnlkwQAAABA"]
[Sun Apr 05 22:26:29.207551 2026] [:error] [pid 45409:tid 45427] [client 158.158.48.159:21960] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "adJxFdHt_Oyw03gjCNg5YgAAANA"]
[Sun Apr 05 22:26:29.690826 2026] [:error] [pid 30921:tid 30931] [client 158.158.48.159:21983] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "adJxFWFGQVn8Q0ueB246qQAAAQg"]
[Sun Apr 05 22:26:30.183709 2026] [:error] [pid 30921:tid 30923] [client 158.158.48.159:20833] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "adJxFmFGQVn8Q0ueB246qwAAAQA"]
[Sun Apr 05 22:26:30.673123 2026] [:error] [pid 45303:tid 45334] [client 158.158.48.159:22340] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "adJxFrboQ9eViZ4hdnlk3gAAABE"]
[Sun Apr 05 22:26:31.156045 2026] [:error] [pid 45303:tid 45332] [client 158.158.48.159:21228] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "adJxF7boQ9eViZ4hdnlk4wAAAA8"]
[Sun Apr 05 22:26:31.655376 2026] [:error] [pid 45409:tid 45418] [client 158.158.48.159:21901] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "adJxF9Ht_Oyw03gjCNg5cwAAAMc"]
[Sun Apr 05 22:26:32.153834 2026] [:error] [pid 45409:tid 45417] [client 158.158.48.159:22388] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "adJxGNHt_Oyw03gjCNg5dgAAAMY"]
[Sun Apr 05 22:26:32.637503 2026] [:error] [pid 45409:tid 45425] [client 158.158.48.159:21967] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "adJxGNHt_Oyw03gjCNg5egAAAM4"]
[Sun Apr 05 22:26:33.125243 2026] [:error] [pid 45304:tid 45353] [client 158.158.48.159:22279] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "adJxGQ5jnqDKKovdRkkteAAAAEk"]
[Sun Apr 05 22:26:33.603949 2026] [:error] [pid 30921:tid 30929] [client 158.158.48.159:22358] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "adJxGWFGQVn8Q0ueB246rQAAAQY"]
[Sun Apr 05 22:26:34.085518 2026] [:error] [pid 30921:tid 30933] [client 158.158.48.159:21968] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "adJxGmFGQVn8Q0ueB246rgAAAQo"]
[Sun Apr 05 22:26:34.588091 2026] [:error] [pid 45409:tid 45428] [client 158.158.48.159:22341] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "adJxGtHt_Oyw03gjCNg5hgAAANE"]
[Sun Apr 05 22:26:35.121755 2026] [:error] [pid 45409:tid 45432] [client 158.158.48.159:21970] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "adJxG9Ht_Oyw03gjCNg5iwAAANU"]
[Sun Apr 05 22:26:35.660709 2026] [:error] [pid 30921:tid 30929] [client 158.158.48.159:21595] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.mopj.php"] [unique_id "adJxG2FGQVn8Q0ueB246wQAAAQY"]
[Sun Apr 05 22:26:36.173221 2026] [:error] [pid 45304:tid 45359] [client 158.158.48.159:22327] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.mopj.php"] [unique_id "adJxHA5jnqDKKovdRkktgwAAAE8"]
[Sun Apr 05 22:26:36.655229 2026] [:error] [pid 45303:tid 45341] [client 158.158.48.159:22351] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.mopj.php"] [unique_id "adJxHLboQ9eViZ4hdnllDQAAABg"]
[Sun Apr 05 22:26:37.139995 2026] [:error] [pid 45409:tid 45417] [client 158.158.48.159:21120] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.mopj.php"] [unique_id "adJxHdHt_Oyw03gjCNg5nAAAAMY"]
[Sun Apr 05 22:26:37.623283 2026] [:error] [pid 45305:tid 45373] [client 158.158.48.159:22396] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.yuf.php"] [unique_id "adJxHejDQjr7aWhjflB1iwAAAII"]
[Sun Apr 05 22:26:38.107052 2026] [:error] [pid 45409:tid 45431] [client 158.158.48.159:21227] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.yuf.php"] [unique_id "adJxHtHt_Oyw03gjCNg5owAAANQ"]
[Sun Apr 05 22:26:38.616383 2026] [:error] [pid 45409:tid 45417] [client 158.158.48.159:21891] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.yuf.php"] [unique_id "adJxHtHt_Oyw03gjCNg5pwAAAMY"]
[Sun Apr 05 22:26:39.141120 2026] [:error] [pid 45409:tid 45413] [client 158.158.48.159:21560] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.yuf.php"] [unique_id "adJxH9Ht_Oyw03gjCNg5qwAAAMI"]
[Sun Apr 05 22:26:39.618872 2026] [:error] [pid 45305:tid 45375] [client 158.158.48.159:21184] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nano.php"] [unique_id "adJxH-jDQjr7aWhjflB1kAAAAIQ"]
[Sun Apr 05 22:26:40.126410 2026] [:error] [pid 45303:tid 45318] [client 158.158.48.159:21140] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nano.php"] [unique_id "adJxILboQ9eViZ4hdnllJgAAAAE"]
[Sun Apr 05 22:26:40.604411 2026] [:error] [pid 30921:tid 30941] [client 158.158.48.159:21586] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nano.php"] [unique_id "adJxIGFGQVn8Q0ueB2460QAAARI"]
[Sun Apr 05 22:26:41.079999 2026] [:error] [pid 45304:tid 45348] [client 158.158.48.159:21240] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nano.php"] [unique_id "adJxIQ5jnqDKKovdRkktkQAAAEQ"]
[Sun Apr 05 22:26:41.558114 2026] [:error] [pid 30921:tid 30933] [client 158.158.48.159:22318] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35_S.php"] [unique_id "adJxIWFGQVn8Q0ueB2462wAAAQo"]
[Sun Apr 05 22:26:42.035766 2026] [:error] [pid 45304:tid 45366] [client 158.158.48.159:21521] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35_S.php"] [unique_id "adJxIg5jnqDKKovdRkktlgAAAFY"]
[Sun Apr 05 22:26:42.514085 2026] [:error] [pid 45305:tid 45382] [client 158.158.48.159:21577] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35_S.php"] [unique_id "adJxIujDQjr7aWhjflB1lAAAAIs"]
[Sun Apr 05 22:26:42.998600 2026] [:error] [pid 45303:tid 45339] [client 158.158.48.159:22355] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35_S.php"] [unique_id "adJxIrboQ9eViZ4hdnllPQAAABY"]
[Sun Apr 05 22:26:43.478757 2026] [:error] [pid 45303:tid 45335] [client 158.158.48.159:22298] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "adJxI7boQ9eViZ4hdnllQAAAABI"]
[Sun Apr 05 22:26:43.956753 2026] [:error] [pid 45303:tid 45324] [client 158.158.48.159:21532] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "adJxI7boQ9eViZ4hdnllRgAAAAc"]
[Sun Apr 05 22:26:44.433108 2026] [:error] [pid 45305:tid 45374] [client 158.158.48.159:22362] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "adJxJOjDQjr7aWhjflB1lwAAAIM"]
[Sun Apr 05 22:26:44.909058 2026] [:error] [pid 45304:tid 45360] [client 158.158.48.159:21596] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "adJxJA5jnqDKKovdRkktnwAAAFA"]
[Sun Apr 05 22:26:45.384999 2026] [:error] [pid 45304:tid 45351] [client 158.158.48.159:21993] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftde.php"] [unique_id "adJxJQ5jnqDKKovdRkktoQAAAEc"]
[Sun Apr 05 22:26:45.863984 2026] [:error] [pid 45304:tid 45355] [client 158.158.48.159:21569] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftde.php"] [unique_id "adJxJQ5jnqDKKovdRkktowAAAEs"]
[Sun Apr 05 22:26:46.342138 2026] [:error] [pid 45304:tid 45363] [client 158.158.48.159:20845] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftde.php"] [unique_id "adJxJg5jnqDKKovdRkktpAAAAFM"]
[Sun Apr 05 22:26:46.819671 2026] [:error] [pid 45409:tid 45413] [client 158.158.48.159:22002] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftde.php"] [unique_id "adJxJtHt_Oyw03gjCNg5wAAAAMI"]
[Sun Apr 05 22:26:47.298052 2026] [:error] [pid 45303:tid 45335] [client 158.158.48.159:21241] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file31.php"] [unique_id "adJxJ7boQ9eViZ4hdnllUQAAABI"]
[Sun Apr 05 22:26:47.775310 2026] [:error] [pid 45305:tid 45382] [client 158.158.48.159:21242] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file31.php"] [unique_id "adJxJ-jDQjr7aWhjflB1oAAAAIs"]
[Sun Apr 05 22:26:48.255884 2026] [:error] [pid 45303:tid 45322] [client 158.158.48.159:22381] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file31.php"] [unique_id "adJxKLboQ9eViZ4hdnllVgAAAAU"]
[Sun Apr 05 22:26:48.732708 2026] [:error] [pid 45303:tid 45336] [client 158.158.48.159:22374] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file31.php"] [unique_id "adJxKLboQ9eViZ4hdnllWAAAABM"]
[Sun Apr 05 22:26:49.216497 2026] [:error] [pid 45303:tid 45338] [client 158.158.48.159:21573] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "adJxKbboQ9eViZ4hdnllXAAAABU"]
[Sun Apr 05 22:26:49.708441 2026] [:error] [pid 45303:tid 45331] [client 158.158.48.159:21194] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "adJxKbboQ9eViZ4hdnllYAAAAA4"]
[Sun Apr 05 22:26:50.301932 2026] [:error] [pid 45303:tid 45325] [client 158.158.48.159:21891] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "adJxKrboQ9eViZ4hdnllYwAAAAg"]
[Sun Apr 05 22:26:51.084656 2026] [:error] [pid 45409:tid 45435] [client 158.158.48.159:21902] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "adJxK9Ht_Oyw03gjCNg53gAAANg"]
[Sun Apr 05 22:26:51.654579 2026] [:error] [pid 45303:tid 45322] [client 158.158.48.159:22759] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/control.php"] [unique_id "adJxK7boQ9eViZ4hdnllbwAAAAU"]
[Sun Apr 05 22:26:52.208140 2026] [:error] [pid 45409:tid 45420] [client 158.158.48.159:22662] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/control.php"] [unique_id "adJxLNHt_Oyw03gjCNg56AAAAMk"]
[Sun Apr 05 22:26:52.716137 2026] [:error] [pid 45409:tid 45423] [client 158.158.48.159:21512] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/control.php"] [unique_id "adJxLNHt_Oyw03gjCNg56gAAAMw"]
[Sun Apr 05 22:26:53.366918 2026] [:error] [pid 45409:tid 45429] [client 158.158.48.159:21598] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/control.php"] [unique_id "adJxLdHt_Oyw03gjCNg57QAAANI"]
[Sun Apr 05 22:26:53.881526 2026] [:error] [pid 45303:tid 45317] [client 158.158.48.159:22656] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xozx.php"] [unique_id "adJxLbboQ9eViZ4hdnllcgAAAAA"]
[Sun Apr 05 22:26:54.437115 2026] [:error] [pid 30921:tid 30943] [client 158.158.48.159:22011] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xozx.php"] [unique_id "adJxLmFGQVn8Q0ueB247CgAAARQ"]
[Sun Apr 05 22:26:55.030202 2026] [:error] [pid 45304:tid 45352] [client 158.158.48.159:22709] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xozx.php"] [unique_id "adJxLw5jnqDKKovdRkktugAAAEg"]
[Sun Apr 05 22:26:55.630845 2026] [:error] [pid 45303:tid 45335] [client 158.158.48.159:22701] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xozx.php"] [unique_id "adJxL7boQ9eViZ4hdnllgAAAABI"]
[Sun Apr 05 22:26:56.189617 2026] [:error] [pid 45409:tid 45419] [client 158.158.48.159:22378] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1111.php"] [unique_id "adJxMNHt_Oyw03gjCNg5-QAAAMg"]
[Sun Apr 05 22:26:56.868468 2026] [:error] [pid 45304:tid 45348] [client 158.158.48.159:21996] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1111.php"] [unique_id "adJxMA5jnqDKKovdRkktvAAAAEQ"]
[Sun Apr 05 22:26:57.392375 2026] [:error] [pid 45304:tid 45366] [client 158.158.48.159:21896] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1111.php"] [unique_id "adJxMQ5jnqDKKovdRkktvwAAAFY"]
[Sun Apr 05 22:26:57.921644 2026] [:error] [pid 45304:tid 45345] [client 158.158.48.159:22378] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1111.php"] [unique_id "adJxMQ5jnqDKKovdRkktwQAAAEE"]
[Sun Apr 05 22:26:58.526911 2026] [:error] [pid 45409:tid 45413] [client 158.158.48.159:21950] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fetch.php"] [unique_id "adJxMtHt_Oyw03gjCNg6BAAAAMI"]
[Sun Apr 05 22:26:59.081353 2026] [:error] [pid 45305:tid 45387] [client 158.158.48.159:22770] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fetch.php"] [unique_id "adJxM-jDQjr7aWhjflB1qwAAAJA"]
[Sun Apr 05 22:26:59.665865 2026] [:error] [pid 45409:tid 45411] [client 158.158.48.159:21608] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fetch.php"] [unique_id "adJxM9Ht_Oyw03gjCNg6CQAAAMA"]
[Sun Apr 05 22:27:00.227849 2026] [:error] [pid 45304:tid 45357] [client 158.158.48.159:21894] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fetch.php"] [unique_id "adJxNA5jnqDKKovdRkktxwAAAE0"]
[Sun Apr 05 22:27:00.740617 2026] [:error] [pid 45303:tid 45334] [client 158.158.48.159:21510] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "adJxNLboQ9eViZ4hdnlliAAAABE"]
[Sun Apr 05 22:27:01.229168 2026] [:error] [pid 45303:tid 45341] [client 158.158.48.159:21942] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "adJxNbboQ9eViZ4hdnlligAAABg"]
[Sun Apr 05 22:27:01.874122 2026] [:error] [pid 45409:tid 45425] [client 158.158.48.159:22295] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "adJxNdHt_Oyw03gjCNg6EwAAAM4"]
[Sun Apr 05 22:27:02.389421 2026] [:error] [pid 45305:tid 45378] [client 158.158.48.159:22283] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "adJxNujDQjr7aWhjflB1sAAAAIc"]
[Sun Apr 05 22:27:03.102883 2026] [:error] [pid 45303:tid 45319] [client 158.158.48.159:22285] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "adJxN7boQ9eViZ4hdnlliwAAAAI"]
[Sun Apr 05 22:27:03.741165 2026] [:error] [pid 45303:tid 45327] [client 158.158.48.159:21924] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "adJxN7boQ9eViZ4hdnllkAAAAAo"]
[Sun Apr 05 22:27:04.344636 2026] [:error] [pid 45409:tid 45413] [client 158.158.48.159:22342] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "adJxONHt_Oyw03gjCNg6GQAAAMI"]
[Sun Apr 05 22:27:05.045730 2026] [:error] [pid 30921:tid 30947] [client 158.158.48.159:22751] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "adJxOWFGQVn8Q0ueB247GAAAARg"]
[Sun Apr 05 22:27:05.730708 2026] [:error] [pid 45305:tid 45392] [client 158.158.48.159:21541] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "adJxOejDQjr7aWhjflB1uQAAAJU"]
[Sun Apr 05 22:27:06.333117 2026] [:error] [pid 45305:tid 45393] [client 158.158.48.159:22749] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "adJxOujDQjr7aWhjflB1ugAAAJY"]
[Sun Apr 05 22:27:06.945425 2026] [:error] [pid 45305:tid 45374] [client 158.158.48.159:21972] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "adJxOujDQjr7aWhjflB1vAAAAIM"]
[Sun Apr 05 22:27:07.650575 2026] [:error] [pid 45303:tid 45319] [client 158.158.48.159:22336] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "adJxO7boQ9eViZ4hdnllmAAAAAI"]
[Sun Apr 05 22:27:08.265945 2026] [:error] [pid 45305:tid 45385] [client 158.158.48.159:22748] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwpg.php"] [unique_id "adJxPOjDQjr7aWhjflB1vwAAAI4"]
[Sun Apr 05 22:27:08.817199 2026] [:error] [pid 45303:tid 45339] [client 158.158.48.159:21917] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwpg.php"] [unique_id "adJxPLboQ9eViZ4hdnllmwAAABY"]
[Sun Apr 05 22:27:09.401316 2026] [:error] [pid 30921:tid 30942] [client 158.158.48.159:22297] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwpg.php"] [unique_id "adJxPWFGQVn8Q0ueB247KQAAARM"]
[Sun Apr 05 22:27:09.917715 2026] [:error] [pid 45303:tid 45320] [client 158.158.48.159:21170] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwpg.php"] [unique_id "adJxPbboQ9eViZ4hdnlloAAAAAM"]
[Sun Apr 05 22:27:10.666683 2026] [:error] [pid 45409:tid 45422] [client 158.158.48.159:22280] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ass.php"] [unique_id "adJxPtHt_Oyw03gjCNg6IgAAAMs"]
[Sun Apr 05 22:27:11.495581 2026] [:error] [pid 45409:tid 45428] [client 158.158.48.159:22781] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ass.php"] [unique_id "adJxP9Ht_Oyw03gjCNg6KAAAANE"]
[Sun Apr 05 22:27:12.106137 2026] [:error] [pid 45304:tid 45357] [client 158.158.48.159:21174] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ass.php"] [unique_id "adJxQA5jnqDKKovdRkktzwAAAE0"]
[Sun Apr 05 22:27:12.629617 2026] [:error] [pid 45305:tid 45390] [client 158.158.48.159:22678] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ass.php"] [unique_id "adJxQOjDQjr7aWhjflB1xgAAAJM"]
[Sun Apr 05 22:27:13.168980 2026] [:error] [pid 45303:tid 45318] [client 158.158.48.159:22684] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "adJxQbboQ9eViZ4hdnllqQAAAAE"]
[Sun Apr 05 22:27:13.765548 2026] [:error] [pid 30921:tid 30945] [client 158.158.48.159:22398] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "adJxQWFGQVn8Q0ueB247NwAAARY"]
[Sun Apr 05 22:27:14.266135 2026] [:error] [pid 45305:tid 45392] [client 158.158.48.159:22783] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "adJxQujDQjr7aWhjflB1xwAAAJU"]
[Sun Apr 05 22:27:14.797346 2026] [:error] [pid 45303:tid 45338] [client 158.158.48.159:22383] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "adJxQrboQ9eViZ4hdnllrAAAABU"]
[Sun Apr 05 22:27:15.335871 2026] [:error] [pid 30921:tid 30937] [client 158.158.48.159:21623] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "adJxQ2FGQVn8Q0ueB247OQAAAQ4"]
[Sun Apr 05 22:27:15.842279 2026] [:error] [pid 45305:tid 45385] [client 158.158.48.159:21618] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "adJxQ-jDQjr7aWhjflB1ygAAAI4"]
[Sun Apr 05 22:27:16.468714 2026] [:error] [pid 30921:tid 30930] [client 158.158.48.159:21958] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "adJxRGFGQVn8Q0ueB247PAAAAQc"]
[Sun Apr 05 22:27:17.030808 2026] [:error] [pid 30921:tid 30938] [client 158.158.48.159:22335] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "adJxRWFGQVn8Q0ueB247PwAAAQ8"]
[Sun Apr 05 22:27:17.571816 2026] [:error] [pid 30921:tid 30934] [client 158.158.48.159:21947] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fine.php"] [unique_id "adJxRWFGQVn8Q0ueB247QgAAAQs"]
[Sun Apr 05 22:27:18.162644 2026] [:error] [pid 45409:tid 45424] [client 158.158.48.159:21603] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fine.php"] [unique_id "adJxRtHt_Oyw03gjCNg6PQAAAM0"]
[Sun Apr 05 22:27:18.827062 2026] [:error] [pid 30921:tid 30937] [client 158.158.48.159:22348] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fine.php"] [unique_id "adJxRmFGQVn8Q0ueB247SAAAAQ4"]
[Sun Apr 05 22:27:19.366954 2026] [:error] [pid 45305:tid 45393] [client 158.158.48.159:21892] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fine.php"] [unique_id "adJxR-jDQjr7aWhjflB11AAAAJY"]
[Sun Apr 05 22:27:19.940210 2026] [:error] [pid 30921:tid 30934] [client 158.158.48.159:20791] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zample.php"] [unique_id "adJxR2FGQVn8Q0ueB247TwAAAQs"]
[Sun Apr 05 22:27:20.530950 2026] [:error] [pid 45303:tid 45319] [client 158.158.48.159:22353] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zample.php"] [unique_id "adJxSLboQ9eViZ4hdnlltQAAAAI"]
[Sun Apr 05 22:27:21.471962 2026] [:error] [pid 30921:tid 30927] [client 158.158.48.159:22703] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zample.php"] [unique_id "adJxSWFGQVn8Q0ueB247XQAAAQQ"]
[Sun Apr 05 22:27:22.308399 2026] [:error] [pid 45305:tid 45393] [client 158.158.48.159:21232] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zample.php"] [unique_id "adJxSujDQjr7aWhjflB14wAAAJY"]
[Sun Apr 05 22:27:23.213489 2026] [:error] [pid 45409:tid 45431] [client 158.158.48.159:22368] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/read.php"] [unique_id "adJxS9Ht_Oyw03gjCNg6WAAAANQ"]
[Sun Apr 05 22:27:23.893804 2026] [:error] [pid 45305:tid 45394] [client 158.158.48.159:21944] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/read.php"] [unique_id "adJxS-jDQjr7aWhjflB18gAAAJc"]
[Sun Apr 05 22:27:35.941471 2026] [:error] [pid 30921:tid 30925] [client 158.158.48.159:21929] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "adJxV2FGQVn8Q0ueB247tAAAAQI"]
[Sun Apr 05 22:27:36.987307 2026] [:error] [pid 45409:tid 45431] [client 158.158.48.159:23095] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "adJxWNHt_Oyw03gjCNg6ogAAANQ"]
[Sun Apr 05 22:27:37.787354 2026] [:error] [pid 45305:tid 45371] [client 158.158.48.159:22761] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "adJxWejDQjr7aWhjflB2DAAAAIA"]
[Sun Apr 05 22:27:38.515403 2026] [:error] [pid 45409:tid 45431] [client 158.158.48.159:21938] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "adJxWtHt_Oyw03gjCNg6rAAAANQ"]
[Sun Apr 05 22:27:39.380355 2026] [:error] [pid 30921:tid 30933] [client 158.158.48.159:22673] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "adJxW2FGQVn8Q0ueB247uAAAAQo"]
[Sun Apr 05 22:27:40.646886 2026] [:error] [pid 45409:tid 45414] [client 158.158.48.159:22760] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "adJxXNHt_Oyw03gjCNg6vgAAAMM"]
[Sun Apr 05 22:27:41.221636 2026] [:error] [pid 45303:tid 45328] [client 158.158.48.159:21981] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "adJxXbboQ9eViZ4hdnll6QAAAAs"]
[Sun Apr 05 22:27:42.125836 2026] [:error] [pid 45303:tid 45332] [client 158.158.48.159:22346] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "adJxXrboQ9eViZ4hdnll7gAAAA8"]
[Sun Apr 05 22:27:43.254861 2026] [:error] [pid 45305:tid 45388] [client 158.158.48.159:23155] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eee.php"] [unique_id "adJxX-jDQjr7aWhjflB2HgAAAJE"]
[Sun Apr 05 22:27:44.020179 2026] [:error] [pid 30921:tid 30931] [client 158.158.48.159:23110] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eee.php"] [unique_id "adJxYGFGQVn8Q0ueB247vgAAAQg"]
[Sun Apr 05 22:27:44.851602 2026] [:error] [pid 30921:tid 30924] [client 158.158.48.159:23098] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eee.php"] [unique_id "adJxYGFGQVn8Q0ueB247wgAAAQE"]
[Sun Apr 05 22:27:45.918305 2026] [:error] [pid 45304:tid 45362] [client 158.158.48.159:22274] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eee.php"] [unique_id "adJxYQ5jnqDKKovdRkkuIAAAAFI"]
[Sun Apr 05 22:27:46.835362 2026] [:error] [pid 30921:tid 30930] [client 158.158.48.159:21912] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "adJxYmFGQVn8Q0ueB247ywAAAQc"]
[Sun Apr 05 22:27:47.768676 2026] [:error] [pid 45409:tid 45434] [client 158.158.48.159:21211] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "adJxY9Ht_Oyw03gjCNg6ywAAANc"]
[Sun Apr 05 22:27:48.780393 2026] [:error] [pid 45303:tid 45326] [client 158.158.48.159:22677] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "adJxZLboQ9eViZ4hdnll_AAAAAk"]
[Sun Apr 05 22:27:49.569658 2026] [:error] [pid 45409:tid 45430] [client 158.158.48.159:22399] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "adJxZdHt_Oyw03gjCNg63gAAANM"]
[Sun Apr 05 22:27:50.739515 2026] [:error] [pid 45303:tid 45323] [client 158.158.48.159:21899] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "adJxZrboQ9eViZ4hdnlmBAAAAAY"]
[Sun Apr 05 22:27:51.644065 2026] [:error] [pid 45303:tid 45327] [client 158.158.48.159:22305] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "adJxZ7boQ9eViZ4hdnlmCwAAAAo"]
[Sun Apr 05 22:27:52.451200 2026] [:error] [pid 45303:tid 45338] [client 158.158.48.159:23078] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "adJxaLboQ9eViZ4hdnlmEAAAABU"]
[Sun Apr 05 22:27:53.075995 2026] [:error] [pid 45303:tid 45337] [client 158.158.48.159:21209] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "adJxabboQ9eViZ4hdnlmFAAAABQ"]
[Sun Apr 05 22:27:54.007992 2026] [:error] [pid 30921:tid 30932] [client 158.158.48.159:22698] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/swallowable.php"] [unique_id "adJxamFGQVn8Q0ueB2471AAAAQk"]
[Sun Apr 05 22:27:54.867532 2026] [:error] [pid 45409:tid 45422] [client 158.158.48.159:22705] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/swallowable.php"] [unique_id "adJxatHt_Oyw03gjCNg7AwAAAMs"]
[Sun Apr 05 22:27:56.612764 2026] [:error] [pid 45303:tid 45322] [client 158.158.48.159:23121] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/swallowable.php"] [unique_id "adJxbLboQ9eViZ4hdnlmOQAAAAU"]
[Sun Apr 05 22:27:57.505914 2026] [:error] [pid 45305:tid 45379] [client 158.158.48.159:22681] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/swallowable.php"] [unique_id "adJxbejDQjr7aWhjflB2KgAAAIg"]
[Sun Apr 05 22:27:58.767678 2026] [:error] [pid 45409:tid 45430] [client 158.158.48.159:23139] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "adJxbtHt_Oyw03gjCNg7OgAAANM"]
[Sun Apr 05 22:27:59.704150 2026] [:error] [pid 45409:tid 45422] [client 158.158.48.159:22746] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "adJxb9Ht_Oyw03gjCNg7PAAAAMs"]
[Sun Apr 05 22:28:00.440865 2026] [:error] [pid 45409:tid 45429] [client 158.158.48.159:22752] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "adJxcNHt_Oyw03gjCNg7QAAAANI"]
[Sun Apr 05 22:28:01.286633 2026] [:error] [pid 45303:tid 45335] [client 158.158.48.159:22666] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "adJxcbboQ9eViZ4hdnlmTwAAABI"]
[Sun Apr 05 22:28:02.286998 2026] [:error] [pid 45304:tid 45348] [client 158.158.48.159:23496] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "adJxcg5jnqDKKovdRkkuQAAAAEQ"]
[Sun Apr 05 22:28:03.148914 2026] [:error] [pid 45305:tid 45382] [client 158.158.48.159:23140] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "adJxc-jDQjr7aWhjflB2NgAAAIs"]
[Sun Apr 05 22:28:03.798854 2026] [:error] [pid 45409:tid 45421] [client 158.158.48.159:22762] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "adJxc9Ht_Oyw03gjCNg7TQAAAMo"]
[Sun Apr 05 22:28:04.465904 2026] [:error] [pid 45409:tid 45435] [client 158.158.48.159:23092] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "adJxdNHt_Oyw03gjCNg7UwAAANg"]
[Sun Apr 05 22:28:05.265339 2026] [:error] [pid 45409:tid 45411] [client 158.158.48.159:22724] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "adJxddHt_Oyw03gjCNg7VwAAAMA"]
[Sun Apr 05 22:28:05.947045 2026] [:error] [pid 45304:tid 45353] [client 158.158.48.159:22382] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "adJxdQ5jnqDKKovdRkkuRQAAAEk"]
[Sun Apr 05 22:28:06.600472 2026] [:error] [pid 30921:tid 30933] [client 158.158.48.159:21912] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "adJxdmFGQVn8Q0ueB2473wAAAQo"]
[Sun Apr 05 22:28:07.119994 2026] [:error] [pid 45305:tid 45384] [client 158.158.48.159:23134] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "adJxd-jDQjr7aWhjflB2PgAAAI0"]
[Sun Apr 05 22:28:07.669266 2026] [:error] [pid 45303:tid 45324] [client 158.158.48.159:23067] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "adJxd7boQ9eViZ4hdnlmWQAAAAc"]
[Sun Apr 05 22:28:08.201001 2026] [:error] [pid 45409:tid 45431] [client 158.158.48.159:22672] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "adJxeNHt_Oyw03gjCNg7XQAAANQ"]
[Sun Apr 05 22:28:08.786165 2026] [:error] [pid 45303:tid 45337] [client 158.158.48.159:23503] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "adJxeLboQ9eViZ4hdnlmXgAAABQ"]
[Sun Apr 05 22:28:09.415060 2026] [:error] [pid 45305:tid 45376] [client 158.158.48.159:23520] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "adJxeejDQjr7aWhjflB2QAAAAIU"]
[Sun Apr 05 22:28:10.031098 2026] [:error] [pid 45305:tid 45374] [client 158.158.48.159:22328] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "adJxeujDQjr7aWhjflB2QgAAAIM"]
[Sun Apr 05 22:28:10.876585 2026] [:error] [pid 45409:tid 45419] [client 158.158.48.159:22708] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "adJxetHt_Oyw03gjCNg7bQAAAMg"]
[Sun Apr 05 22:28:11.380175 2026] [:error] [pid 45305:tid 45380] [client 158.158.48.159:23101] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "adJxe-jDQjr7aWhjflB2SAAAAIk"]
[Sun Apr 05 22:28:11.948050 2026] [:error] [pid 45303:tid 45338] [client 158.158.48.159:21565] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "adJxe7boQ9eViZ4hdnlmegAAABU"]
[Sun Apr 05 22:28:12.479431 2026] [:error] [pid 30921:tid 30943] [client 158.158.48.159:22315] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "adJxfGFGQVn8Q0ueB2476AAAARQ"]
[Sun Apr 05 22:28:12.991907 2026] [:error] [pid 30921:tid 30933] [client 158.158.48.159:22289] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "adJxfGFGQVn8Q0ueB2477gAAAQo"]
[Sun Apr 05 22:28:13.516034 2026] [:error] [pid 45305:tid 45392] [client 158.158.48.159:23079] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "adJxfejDQjr7aWhjflB2UgAAAJU"]
[Sun Apr 05 22:28:14.140538 2026] [:error] [pid 45305:tid 45391] [client 158.158.48.159:23497] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "adJxfujDQjr7aWhjflB2UwAAAJQ"]
[Sun Apr 05 22:28:14.689077 2026] [:error] [pid 45409:tid 45411] [client 158.158.48.159:22347] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "adJxftHt_Oyw03gjCNg7iAAAAMA"]
[Sun Apr 05 22:28:15.199588 2026] [:error] [pid 45303:tid 45324] [client 158.158.48.159:22675] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "adJxf7boQ9eViZ4hdnlmjgAAAAc"]
[Sun Apr 05 22:28:15.756342 2026] [:error] [pid 45409:tid 45424] [client 158.158.48.159:23474] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "adJxf9Ht_Oyw03gjCNg7jgAAAM0"]
[Sun Apr 05 22:28:16.358019 2026] [:error] [pid 45303:tid 45336] [client 158.158.48.159:22691] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "adJxgLboQ9eViZ4hdnlmkgAAABM"]
[Sun Apr 05 22:28:16.940004 2026] [:error] [pid 45303:tid 45319] [client 158.158.48.159:23072] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "adJxgLboQ9eViZ4hdnlmmAAAAAI"]
[Sun Apr 05 22:28:17.523596 2026] [:error] [pid 45304:tid 45347] [client 158.158.48.159:22754] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "adJxgQ5jnqDKKovdRkkuagAAAEM"]
[Sun Apr 05 22:28:18.186977 2026] [:error] [pid 45305:tid 45372] [client 158.158.48.159:23100] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "adJxgujDQjr7aWhjflB2WwAAAIE"]
[Sun Apr 05 22:28:18.741607 2026] [:error] [pid 45303:tid 45335] [client 158.158.48.159:23527] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "adJxgrboQ9eViZ4hdnlmqAAAABI"]
[Sun Apr 05 22:28:19.281740 2026] [:error] [pid 45303:tid 45323] [client 158.158.48.159:21189] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "adJxg7boQ9eViZ4hdnlmqgAAAAY"]
[Sun Apr 05 22:28:19.870098 2026] [:error] [pid 30921:tid 30939] [client 158.158.48.159:23536] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "adJxg2FGQVn8Q0ueB247-wAAARA"]
[Sun Apr 05 22:28:20.405089 2026] [:error] [pid 30921:tid 30929] [client 158.158.48.159:22366] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "adJxhGFGQVn8Q0ueB247_gAAAQY"]
[Sun Apr 05 22:28:20.975818 2026] [:error] [pid 45303:tid 45321] [client 158.158.48.159:22777] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "adJxhLboQ9eViZ4hdnlmsgAAAAQ"]
[Sun Apr 05 22:28:21.471761 2026] [:error] [pid 45409:tid 45417] [client 158.158.48.159:21559] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "adJxhdHt_Oyw03gjCNg7nQAAAMY"]
[Sun Apr 05 22:28:21.966226 2026] [:error] [pid 45303:tid 45335] [client 158.158.48.159:22780] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "adJxhbboQ9eViZ4hdnlmtAAAABI"]
[Sun Apr 05 22:28:22.482994 2026] [:error] [pid 45409:tid 45418] [client 158.158.48.159:22767] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "adJxhtHt_Oyw03gjCNg7pAAAAMc"]
[Sun Apr 05 22:28:23.013360 2026] [:error] [pid 30921:tid 30926] [client 158.158.48.159:22331] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "adJxh2FGQVn8Q0ueB248BwAAAQM"]
[Sun Apr 05 22:28:23.782420 2026] [:error] [pid 45303:tid 45318] [client 158.158.48.159:23702] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "adJxh7boQ9eViZ4hdnlmuwAAAAE"]
[Sun Apr 05 22:28:24.314079 2026] [:error] [pid 45305:tid 45390] [client 158.158.48.159:23048] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "adJxiOjDQjr7aWhjflB2ZAAAAJM"]
[Sun Apr 05 22:28:24.851932 2026] [:error] [pid 45409:tid 45417] [client 158.158.48.159:22660] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "adJxiNHt_Oyw03gjCNg7qAAAAMY"]
[Sun Apr 05 22:28:25.373505 2026] [:error] [pid 45303:tid 45331] [client 158.158.48.159:23106] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "adJxibboQ9eViZ4hdnlmvwAAAA4"]
[Sun Apr 05 22:28:25.886754 2026] [:error] [pid 45303:tid 45334] [client 158.158.48.159:23457] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "adJxibboQ9eViZ4hdnlmwAAAABE"]
[Sun Apr 05 22:28:26.371965 2026] [:error] [pid 30921:tid 30940] [client 158.158.48.159:23750] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "adJximFGQVn8Q0ueB248DgAAARE"]
[Sun Apr 05 22:28:26.852707 2026] [:error] [pid 30921:tid 30944] [client 158.158.48.159:23069] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "adJximFGQVn8Q0ueB248EAAAARU"]
[Sun Apr 05 22:28:27.337801 2026] [:error] [pid 30921:tid 30935] [client 158.158.48.159:22288] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "adJxi2FGQVn8Q0ueB248EgAAAQw"]
[Sun Apr 05 22:28:27.843151 2026] [:error] [pid 45305:tid 45393] [client 158.158.48.159:23685] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "adJxi-jDQjr7aWhjflB2bgAAAJY"]
[Sun Apr 05 22:28:28.321324 2026] [:error] [pid 30921:tid 30930] [client 158.158.48.159:22344] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "adJxjGFGQVn8Q0ueB248FAAAAQc"]
[Sun Apr 05 22:28:28.820280 2026] [:error] [pid 45304:tid 45348] [client 158.158.48.159:23682] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "adJxjA5jnqDKKovdRkkueQAAAEQ"]
[Sun Apr 05 22:28:29.298595 2026] [:error] [pid 45304:tid 45352] [client 158.158.48.159:23693] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "adJxjQ5jnqDKKovdRkkuegAAAEg"]
[Sun Apr 05 22:28:29.777778 2026] [:error] [pid 45409:tid 45425] [client 158.158.48.159:22757] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "adJxjdHt_Oyw03gjCNg7rAAAAM4"]
[Sun Apr 05 22:28:30.259469 2026] [:error] [pid 45303:tid 45328] [client 158.158.48.159:23723] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "adJxjrboQ9eViZ4hdnlmzAAAAAs"]
[Sun Apr 05 22:28:30.736541 2026] [:error] [pid 45409:tid 45414] [client 158.158.48.159:23804] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "adJxjtHt_Oyw03gjCNg7rwAAAMM"]
[Sun Apr 05 22:28:31.213330 2026] [:error] [pid 30921:tid 30935] [client 158.158.48.159:23802] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "adJxj2FGQVn8Q0ueB248HAAAAQw"]
[Sun Apr 05 22:28:31.689459 2026] [:error] [pid 30921:tid 30940] [client 158.158.48.159:23462] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "adJxj2FGQVn8Q0ueB248HwAAARE"]
[Sun Apr 05 22:28:32.169190 2026] [:error] [pid 30921:tid 30934] [client 158.158.48.159:22765] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "adJxkGFGQVn8Q0ueB248IgAAAQs"]
[Sun Apr 05 22:28:32.647094 2026] [:error] [pid 45303:tid 45324] [client 158.158.48.159:22687] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "adJxkLboQ9eViZ4hdnlm1AAAAAc"]
[Sun Apr 05 22:28:33.124481 2026] [:error] [pid 45409:tid 45428] [client 158.158.48.159:22363] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "adJxkdHt_Oyw03gjCNg7twAAANE"]
[Sun Apr 05 22:28:33.602058 2026] [:error] [pid 45409:tid 45418] [client 158.158.48.159:22780] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "adJxkdHt_Oyw03gjCNg7vQAAAMc"]
[Sun Apr 05 22:28:34.079907 2026] [:error] [pid 30921:tid 30946] [client 158.158.48.159:23147] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "adJxkmFGQVn8Q0ueB248JgAAARc"]
[Sun Apr 05 22:28:34.564996 2026] [:error] [pid 45409:tid 45416] [client 158.158.48.159:22726] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "adJxktHt_Oyw03gjCNg7xAAAAMU"]
[Sun Apr 05 22:28:43.754007 2026] [:error] [pid 45409:tid 45432] [client 158.158.48.159:23537] [client 158.158.48.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "adJxm9Ht_Oyw03gjCNg8BgAAANU"]
[Sun Apr 05 22:28:47.180574 2026] [autoindex:error] [pid 45409:tid 45417] [client 158.158.48.159:22676] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 05 22:28:48.972344 2026] [:error] [pid 45409:tid 45435] [client 158.158.48.159:22676] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "adJxoNHt_Oyw03gjCNg8KgAAANg"]
[Sun Apr 05 22:28:49.451288 2026] [:error] [pid 45305:tid 45381] [client 158.158.48.159:23799] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "adJxoejDQjr7aWhjflB2ggAAAIo"]
[Sun Apr 05 22:28:49.929544 2026] [:error] [pid 30921:tid 30946] [client 158.158.48.159:23686] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "adJxoWFGQVn8Q0ueB248QQAAARc"]
[Sun Apr 05 22:28:50.420161 2026] [:error] [pid 45409:tid 45430] [client 158.158.48.159:22742] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "adJxotHt_Oyw03gjCNg8MQAAANM"]
[Sun Apr 05 22:28:50.948661 2026] [:error] [pid 45409:tid 45423] [client 158.158.48.159:23152] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "adJxotHt_Oyw03gjCNg8MwAAAMw"]
[Sun Apr 05 22:28:51.459376 2026] [:error] [pid 45303:tid 45337] [client 158.158.48.159:23769] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "adJxo7boQ9eViZ4hdnlm3gAAABQ"]
[Sun Apr 05 22:28:51.990450 2026] [:error] [pid 45304:tid 45362] [client 158.158.48.159:22711] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "adJxow5jnqDKKovdRkkukwAAAFI"]
[Sun Apr 05 22:28:52.501660 2026] [:error] [pid 45409:tid 45433] [client 158.158.48.159:23801] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "adJxpNHt_Oyw03gjCNg8PAAAANY"]
[Sun Apr 05 22:28:53.091799 2026] [:error] [pid 45303:tid 45321] [client 158.158.48.159:23124] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "adJxpbboQ9eViZ4hdnlm4AAAAAQ"]
[Sun Apr 05 22:28:53.758157 2026] [:error] [pid 45303:tid 45326] [client 158.158.48.159:22683] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "adJxpbboQ9eViZ4hdnlm4gAAAAk"]
[Sun Apr 05 22:28:54.566154 2026] [:error] [pid 30921:tid 30927] [client 158.158.48.159:23736] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "adJxpmFGQVn8Q0ueB248RAAAAQQ"]
[Sun Apr 05 22:28:55.429285 2026] [:error] [pid 45305:tid 45373] [client 158.158.48.159:23727] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "adJxp-jDQjr7aWhjflB2kQAAAII"]
[Sun Apr 05 22:28:56.070271 2026] [:error] [pid 45409:tid 45430] [client 158.158.48.159:22356] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "adJxqNHt_Oyw03gjCNg8SgAAANM"]
[Sun Apr 05 22:28:56.881402 2026] [:error] [pid 45305:tid 45376] [client 158.158.48.159:23700] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "adJxqOjDQjr7aWhjflB2lQAAAIU"]
[Sun Apr 05 22:28:57.504829 2026] [:error] [pid 30921:tid 30935] [client 158.158.48.159:22285] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "adJxqWFGQVn8Q0ueB248SgAAAQw"]
[Sun Apr 05 22:28:58.261309 2026] [:error] [pid 30921:tid 30925] [client 158.158.48.159:24114] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "adJxqmFGQVn8Q0ueB248TAAAAQI"]
[Sun Apr 05 22:28:59.058789 2026] [:error] [pid 45303:tid 45330] [client 158.158.48.159:23436] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "adJxq7boQ9eViZ4hdnlm8AAAAA0"]
[Sun Apr 05 22:28:59.753608 2026] [:error] [pid 30921:tid 30947] [client 158.158.48.159:23426] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "adJxq2FGQVn8Q0ueB248VAAAARg"]
[Sun Apr 05 22:29:00.326603 2026] [:error] [pid 45409:tid 45422] [client 158.158.48.159:23464] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "adJxrNHt_Oyw03gjCNg8UgAAAMs"]
[Sun Apr 05 22:29:00.942882 2026] [:error] [pid 45303:tid 45339] [client 158.158.48.159:23498] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "adJxrLboQ9eViZ4hdnlm-AAAABY"]
[Sun Apr 05 22:29:01.609668 2026] [:error] [pid 30921:tid 30944] [client 158.158.48.159:23109] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "adJxrWFGQVn8Q0ueB248XAAAARU"]
[Sun Apr 05 22:29:02.495641 2026] [:error] [pid 45303:tid 45337] [client 158.158.48.159:24166] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "adJxrrboQ9eViZ4hdnlm_QAAABQ"]
[Sun Apr 05 22:29:03.171865 2026] [:error] [pid 45409:tid 45417] [client 158.158.48.159:22731] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "adJxr9Ht_Oyw03gjCNg8WgAAAMY"]
[Sun Apr 05 22:29:03.855331 2026] [:error] [pid 45304:tid 45365] [client 158.158.48.159:24113] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "adJxrw5jnqDKKovdRkkunQAAAFU"]
[Sun Apr 05 22:29:04.487680 2026] [:error] [pid 45305:tid 45385] [client 158.158.48.159:23164] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "adJxsOjDQjr7aWhjflB2ogAAAI4"]
[Sun Apr 05 22:29:05.124634 2026] [:error] [pid 45304:tid 45349] [client 158.158.48.159:23737] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "adJxsQ5jnqDKKovdRkkupwAAAEU"]
[Sun Apr 05 22:29:05.756549 2026] [:error] [pid 45305:tid 45372] [client 158.158.48.159:23688] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "adJxsejDQjr7aWhjflB2qQAAAIE"]
[Sun Apr 05 22:29:06.496286 2026] [:error] [pid 45409:tid 45432] [client 158.158.48.159:24176] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "adJxstHt_Oyw03gjCNg8ZAAAANU"]
[Sun Apr 05 22:29:07.155977 2026] [:error] [pid 45409:tid 45428] [client 158.158.48.159:22725] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "adJxs9Ht_Oyw03gjCNg8agAAANE"]
[Sun Apr 05 22:29:07.772905 2026] [:error] [pid 45303:tid 45327] [client 158.158.48.159:21194] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "adJxs7boQ9eViZ4hdnlnBQAAAAo"]
[Sun Apr 05 22:29:08.422648 2026] [:error] [pid 45305:tid 45372] [client 158.158.48.159:23761] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "adJxtOjDQjr7aWhjflB2swAAAIE"]
[Sun Apr 05 22:29:09.015817 2026] [:error] [pid 45409:tid 45434] [client 158.158.48.159:23096] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "adJxtdHt_Oyw03gjCNg8dwAAANc"]
[Sun Apr 05 22:29:10.031218 2026] [:error] [pid 45303:tid 45328] [client 158.158.48.159:24136] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "adJxtrboQ9eViZ4hdnlnDAAAAAs"]
[Sun Apr 05 22:29:10.744924 2026] [:error] [pid 45409:tid 45418] [client 158.158.48.159:24099] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "adJxttHt_Oyw03gjCNg8ggAAAMc"]
[Sun Apr 05 22:29:11.411258 2026] [:error] [pid 30921:tid 30936] [client 158.158.48.159:23120] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "adJxt2FGQVn8Q0ueB248aQAAAQ0"]
[Sun Apr 05 22:29:12.167327 2026] [:error] [pid 45303:tid 45338] [client 158.158.48.159:23708] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "adJxuLboQ9eViZ4hdnlnDwAAABU"]
[Sun Apr 05 22:29:12.990207 2026] [:error] [pid 45409:tid 45418] [client 158.158.48.159:23516] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "adJxuNHt_Oyw03gjCNg8jQAAAMc"]
[Sun Apr 05 22:29:13.937803 2026] [:error] [pid 45409:tid 45419] [client 158.158.48.159:24077] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "adJxudHt_Oyw03gjCNg8lQAAAMg"]
[Sun Apr 05 22:29:14.471188 2026] [:error] [pid 45304:tid 45355] [client 158.158.48.159:23548] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "adJxug5jnqDKKovdRkkutAAAAEs"]
[Sun Apr 05 22:29:15.265865 2026] [:error] [pid 45303:tid 45339] [client 158.158.48.159:23502] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "adJxu7boQ9eViZ4hdnlnGAAAABY"]
[Sun Apr 05 22:29:16.307569 2026] [:error] [pid 45303:tid 45324] [client 158.158.48.159:23438] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "adJxvLboQ9eViZ4hdnlnGwAAAAc"]
[Sun Apr 05 22:29:17.082169 2026] [:error] [pid 45409:tid 45425] [client 158.158.48.159:23074] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "adJxvdHt_Oyw03gjCNg8qgAAAM4"]
[Sun Apr 05 22:29:18.007547 2026] [:error] [pid 45409:tid 45426] [client 158.158.48.159:24069] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "adJxvtHt_Oyw03gjCNg8rwAAAM8"]
[Sun Apr 05 22:29:18.913468 2026] [:error] [pid 45409:tid 45424] [client 158.158.48.159:22697] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "adJxvtHt_Oyw03gjCNg8tgAAAM0"]
[Sun Apr 05 22:29:19.489866 2026] [:error] [pid 45409:tid 45422] [client 158.158.48.159:23481] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "adJxv9Ht_Oyw03gjCNg8uQAAAMs"]
[Sun Apr 05 22:29:20.507886 2026] [:error] [pid 45409:tid 45435] [client 158.158.48.159:23730] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "adJxwNHt_Oyw03gjCNg8vgAAANg"]
[Sun Apr 05 22:29:21.624217 2026] [:error] [pid 45303:tid 45340] [client 158.158.48.159:23453] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "adJxwbboQ9eViZ4hdnlnJQAAABc"]
[Sun Apr 05 22:29:22.490891 2026] [:error] [pid 45303:tid 45325] [client 158.158.48.159:23529] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "adJxwrboQ9eViZ4hdnlnKwAAAAg"]
[Sun Apr 05 22:29:23.406795 2026] [:error] [pid 45303:tid 45335] [client 158.158.48.159:23758] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "adJxw7boQ9eViZ4hdnlnLgAAABI"]
[Sun Apr 05 22:29:23.988670 2026] [:error] [pid 45409:tid 45416] [client 158.158.48.159:22338] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "adJxw9Ht_Oyw03gjCNg8wwAAAMU"]
[Sun Apr 05 22:29:24.721345 2026] [:error] [pid 45409:tid 45422] [client 158.158.48.159:24156] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "adJxxNHt_Oyw03gjCNg8yQAAAMs"]
[Sun Apr 05 22:29:25.496625 2026] [:error] [pid 45303:tid 45321] [client 158.158.48.159:23162] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "adJxxbboQ9eViZ4hdnlnLwAAAAQ"]
[Sun Apr 05 22:29:26.152158 2026] [:error] [pid 45303:tid 45329] [client 158.158.48.159:24185] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "adJxxrboQ9eViZ4hdnlnMAAAAAw"]
[Sun Apr 05 22:29:26.862515 2026] [:error] [pid 45304:tid 45356] [client 158.158.48.159:24123] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "adJxxg5jnqDKKovdRkkuzgAAAEw"]
[Sun Apr 05 22:29:27.581735 2026] [:error] [pid 45304:tid 45347] [client 158.158.48.159:23684] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "adJxxw5jnqDKKovdRkku0AAAAEM"]
[Sun Apr 05 22:29:28.258889 2026] [:error] [pid 45304:tid 45346] [client 158.158.48.159:24090] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "adJxyA5jnqDKKovdRkku0wAAAEI"]
[Sun Apr 05 22:29:28.974707 2026] [:error] [pid 45409:tid 45433] [client 158.158.48.159:24449] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "adJxyNHt_Oyw03gjCNg81gAAANY"]
[Sun Apr 05 22:29:29.604287 2026] [:error] [pid 45303:tid 45327] [client 158.158.48.159:24536] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "adJxybboQ9eViZ4hdnlnQgAAAAo"]
[Sun Apr 05 22:29:30.235310 2026] [:error] [pid 45409:tid 45415] [client 158.158.48.159:23133] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "adJxytHt_Oyw03gjCNg82QAAAMQ"]
[Sun Apr 05 22:29:30.859469 2026] [:error] [pid 45305:tid 45395] [client 158.158.48.159:23129] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "adJxyujDQjr7aWhjflB20AAAAJg"]
[Sun Apr 05 22:29:31.496944 2026] [:error] [pid 45303:tid 45331] [client 158.158.48.159:24187] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "adJxy7boQ9eViZ4hdnlnSAAAAA4"]
[Sun Apr 05 22:29:32.066957 2026] [:error] [pid 45409:tid 45428] [client 158.158.48.159:21610] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "adJxzNHt_Oyw03gjCNg84QAAANE"]
[Sun Apr 05 22:29:32.901178 2026] [:error] [pid 30921:tid 30938] [client 158.158.48.159:23789] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "adJxzGFGQVn8Q0ueB248jQAAAQ8"]
[Sun Apr 05 22:29:33.550395 2026] [:error] [pid 45303:tid 45318] [client 158.158.48.159:24074] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "adJxzbboQ9eViZ4hdnlnTQAAAAE"]
[Sun Apr 05 22:29:34.261687 2026] [:error] [pid 45305:tid 45382] [client 158.158.48.159:23500] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "adJxzujDQjr7aWhjflB22QAAAIs"]
[Sun Apr 05 22:29:35.018334 2026] [:error] [pid 45305:tid 45375] [client 158.158.48.159:24468] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "adJxz-jDQjr7aWhjflB24QAAAIQ"]
[Sun Apr 05 22:29:35.729358 2026] [:error] [pid 30921:tid 30939] [client 158.158.48.159:23104] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "adJxz2FGQVn8Q0ueB248kAAAARA"]
[Sun Apr 05 22:29:36.325957 2026] [:error] [pid 45303:tid 45330] [client 158.158.48.159:23456] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "adJx0LboQ9eViZ4hdnlnVgAAAA0"]
[Sun Apr 05 22:29:36.978012 2026] [:error] [pid 30921:tid 30935] [client 158.158.48.159:24467] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "adJx0GFGQVn8Q0ueB248kwAAAQw"]
[Sun Apr 05 22:29:37.635664 2026] [:error] [pid 45303:tid 45327] [client 158.158.48.159:23757] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "adJx0bboQ9eViZ4hdnlnWQAAAAo"]
[Sun Apr 05 22:29:38.167287 2026] [:error] [pid 45409:tid 45421] [client 158.158.48.159:23450] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "adJx0tHt_Oyw03gjCNg87gAAAMo"]
[Sun Apr 05 22:29:38.743577 2026] [:error] [pid 45303:tid 45329] [client 158.158.48.159:24472] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "adJx0rboQ9eViZ4hdnlnWwAAAAw"]
[Sun Apr 05 22:29:39.420098 2026] [:error] [pid 45409:tid 45432] [client 158.158.48.159:23472] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "adJx09Ht_Oyw03gjCNg89wAAANU"]
[Sun Apr 05 22:29:40.010513 2026] [:error] [pid 30921:tid 30942] [client 158.158.48.159:24458] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "adJx1GFGQVn8Q0ueB248nQAAARM"]
[Sun Apr 05 22:29:40.570857 2026] [:error] [pid 45303:tid 45320] [client 158.158.48.159:23443] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "adJx1LboQ9eViZ4hdnlnYQAAAAM"]
[Sun Apr 05 22:29:41.331369 2026] [:error] [pid 45305:tid 45395] [client 158.158.48.159:23482] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "adJx1ejDQjr7aWhjflB2-QAAAJg"]
[Sun Apr 05 22:29:41.918950 2026] [:error] [pid 45409:tid 45411] [client 158.158.48.159:23707] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "adJx1dHt_Oyw03gjCNg8_QAAAMA"]
[Sun Apr 05 22:29:42.561676 2026] [:error] [pid 45304:tid 45354] [client 158.158.48.159:21995] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "adJx1g5jnqDKKovdRkku4gAAAEo"]
[Sun Apr 05 22:29:43.106849 2026] [:error] [pid 45305:tid 45394] [client 158.158.48.159:24475] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "adJx1-jDQjr7aWhjflB2_wAAAJc"]
[Sun Apr 05 22:29:43.655109 2026] [:error] [pid 45305:tid 45388] [client 158.158.48.159:24106] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "adJx1-jDQjr7aWhjflB3AQAAAJE"]
[Sun Apr 05 22:29:44.332624 2026] [:error] [pid 45304:tid 45348] [client 158.158.48.159:23790] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "adJx2A5jnqDKKovdRkku4wAAAEQ"]
[Sun Apr 05 22:29:45.075176 2026] [:error] [pid 45303:tid 45326] [client 158.158.48.159:22324] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "adJx2bboQ9eViZ4hdnlnaAAAAAk"]
[Sun Apr 05 22:29:45.631636 2026] [:error] [pid 45409:tid 45427] [client 158.158.48.159:23504] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "adJx2dHt_Oyw03gjCNg9DAAAANA"]
[Sun Apr 05 22:29:46.169328 2026] [:error] [pid 45409:tid 45411] [client 158.158.48.159:24168] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "adJx2tHt_Oyw03gjCNg9DwAAAMA"]
[Sun Apr 05 22:29:46.816987 2026] [:error] [pid 45304:tid 45345] [client 158.158.48.159:23756] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adJx2g5jnqDKKovdRkku6AAAAEE"]
[Sun Apr 05 22:29:47.439260 2026] [:error] [pid 30921:tid 30923] [client 158.158.48.159:24070] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adJx22FGQVn8Q0ueB248pgAAAQA"]
[Sun Apr 05 22:29:56.071662 2026] [:error] [pid 45409:tid 45419] [client 158.158.48.159:24495] [client 158.158.48.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adJx5NHt_Oyw03gjCNg9TgAAAMg"]
[Sun Apr 05 22:29:58.728163 2026] [autoindex:error] [pid 45303:tid 45319] [client 158.158.48.159:24463] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 05 22:29:58.974220 2026] [autoindex:error] [pid 45303:tid 45322] [client 158.158.48.159:24463] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 05 22:30:01.722246 2026] [:error] [pid 45303:tid 45337] [client 158.158.48.159:24463] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "adJx6bboQ9eViZ4hdnlnnwAAABQ"]
[Sun Apr 05 22:30:02.203632 2026] [:error] [pid 45304:tid 45353] [client 158.158.48.159:24087] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "adJx6g5jnqDKKovdRkkvAAAAAEk"]
[Sun Apr 05 22:30:02.682385 2026] [:error] [pid 45303:tid 45336] [client 158.158.48.159:23692] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "adJx6rboQ9eViZ4hdnlnpAAAABM"]
[Sun Apr 05 22:30:03.159833 2026] [:error] [pid 45304:tid 45352] [client 158.158.48.159:23742] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "adJx6w5jnqDKKovdRkkvAQAAAEg"]
[Sun Apr 05 22:30:03.637141 2026] [:error] [pid 45305:tid 45377] [client 158.158.48.159:23513] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "adJx6-jDQjr7aWhjflB3GgAAAIY"]
[Sun Apr 05 22:30:04.117241 2026] [:error] [pid 30921:tid 30938] [client 158.158.48.159:24861] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "adJx7GFGQVn8Q0ueB248xAAAAQ8"]
[Sun Apr 05 22:30:04.595459 2026] [:error] [pid 45303:tid 45325] [client 158.158.48.159:24121] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "adJx7LboQ9eViZ4hdnlnqAAAAAg"]
[Sun Apr 05 22:30:05.075311 2026] [:error] [pid 45304:tid 45363] [client 158.158.48.159:21580] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "adJx7Q5jnqDKKovdRkkvBgAAAFM"]
[Sun Apr 05 22:30:05.553289 2026] [:error] [pid 45409:tid 45432] [client 158.158.48.159:24869] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "adJx7dHt_Oyw03gjCNg9dQAAANU"]
[Sun Apr 05 22:30:06.036481 2026] [:error] [pid 30921:tid 30936] [client 158.158.48.159:23784] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "adJx7mFGQVn8Q0ueB248yQAAAQ0"]
[Sun Apr 05 22:30:06.515499 2026] [:error] [pid 45303:tid 45320] [client 158.158.48.159:24470] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "adJx7rboQ9eViZ4hdnlnsQAAAAM"]
[Sun Apr 05 22:30:06.996806 2026] [:error] [pid 45409:tid 45431] [client 158.158.48.159:24140] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "adJx7tHt_Oyw03gjCNg9fgAAANQ"]
[Sun Apr 05 22:30:07.478304 2026] [:error] [pid 45409:tid 45414] [client 158.158.48.159:24554] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "adJx79Ht_Oyw03gjCNg9hAAAAMM"]
[Sun Apr 05 22:30:07.954968 2026] [:error] [pid 45409:tid 45433] [client 158.158.48.159:24134] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "adJx79Ht_Oyw03gjCNg9hwAAANY"]
[Sun Apr 05 22:30:08.437871 2026] [:error] [pid 45409:tid 45423] [client 158.158.48.159:24540] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "adJx8NHt_Oyw03gjCNg9igAAAMw"]
[Sun Apr 05 22:30:08.914799 2026] [:error] [pid 45409:tid 45431] [client 158.158.48.159:24883] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "adJx8NHt_Oyw03gjCNg9jAAAANQ"]
[Sun Apr 05 22:30:09.398884 2026] [:error] [pid 30921:tid 30931] [client 158.158.48.159:23695] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "adJx8WFGQVn8Q0ueB248zAAAAQg"]
[Sun Apr 05 22:30:09.887426 2026] [:error] [pid 45304:tid 45356] [client 158.158.48.159:23448] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "adJx8Q5jnqDKKovdRkkvCgAAAEw"]
[Sun Apr 05 22:30:10.367744 2026] [:error] [pid 45409:tid 45413] [client 158.158.48.159:22003] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "adJx8tHt_Oyw03gjCNg9kwAAAMI"]
[Sun Apr 05 22:30:10.847873 2026] [:error] [pid 45305:tid 45379] [client 158.158.48.159:24501] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "adJx8ujDQjr7aWhjflB3JQAAAIg"]
[Sun Apr 05 22:30:11.328010 2026] [:error] [pid 45304:tid 45357] [client 158.158.48.159:24538] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bengi.php"] [unique_id "adJx8w5jnqDKKovdRkkvDAAAAE0"]
[Sun Apr 05 22:30:11.806028 2026] [:error] [pid 45409:tid 45431] [client 158.158.48.159:21953] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bengi.php"] [unique_id "adJx89Ht_Oyw03gjCNg9mgAAANQ"]
[Sun Apr 05 22:30:12.295480 2026] [:error] [pid 30921:tid 30937] [client 158.158.48.159:22723] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bengi.php"] [unique_id "adJx9GFGQVn8Q0ueB2480AAAAQ4"]
[Sun Apr 05 22:30:12.778870 2026] [:error] [pid 30921:tid 30934] [client 158.158.48.159:24076] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bengi.php"] [unique_id "adJx9GFGQVn8Q0ueB2480gAAAQs"]
[Sun Apr 05 22:30:13.259562 2026] [:error] [pid 45304:tid 45348] [client 158.158.48.159:24867] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adJx9Q5jnqDKKovdRkkvDgAAAEQ"]
[Sun Apr 05 22:30:13.738712 2026] [:error] [pid 45409:tid 45425] [client 158.158.48.159:23805] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adJx9dHt_Oyw03gjCNg9pgAAAM4"]
[Sun Apr 05 22:30:14.229722 2026] [:error] [pid 30921:tid 30930] [client 158.158.48.159:24958] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adJx9mFGQVn8Q0ueB2482gAAAQc"]
[Sun Apr 05 22:30:14.718361 2026] [:error] [pid 45305:tid 45388] [client 158.158.48.159:23518] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adJx9ujDQjr7aWhjflB3LAAAAJE"]
[Sun Apr 05 22:30:15.199175 2026] [:error] [pid 45409:tid 45413] [client 158.158.48.159:24537] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "adJx99Ht_Oyw03gjCNg9qwAAAMI"]
[Sun Apr 05 22:30:15.676726 2026] [:error] [pid 45304:tid 45365] [client 158.158.48.159:24090] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "adJx9w5jnqDKKovdRkkvEQAAAFU"]
[Sun Apr 05 22:30:16.155485 2026] [:error] [pid 30921:tid 30927] [client 158.158.48.159:24957] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "adJx-GFGQVn8Q0ueB2484AAAAQQ"]
[Sun Apr 05 22:30:16.632728 2026] [:error] [pid 45305:tid 45393] [client 158.158.48.159:23517] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "adJx-OjDQjr7aWhjflB3MQAAAJY"]
[Sun Apr 05 22:30:17.114166 2026] [:error] [pid 45409:tid 45424] [client 158.158.48.159:23766] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfashell.php"] [unique_id "adJx-dHt_Oyw03gjCNg9sgAAAM0"]
[Sun Apr 05 22:30:17.592786 2026] [:error] [pid 45305:tid 45379] [client 158.158.48.159:24072] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfashell.php"] [unique_id "adJx-ejDQjr7aWhjflB3NQAAAIg"]
[Sun Apr 05 22:30:18.070036 2026] [:error] [pid 45409:tid 45418] [client 158.158.48.159:24135] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfashell.php"] [unique_id "adJx-tHt_Oyw03gjCNg9uAAAAMc"]
[Sun Apr 05 22:30:18.549565 2026] [:error] [pid 45304:tid 45362] [client 158.158.48.159:24921] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfashell.php"] [unique_id "adJx-g5jnqDKKovdRkkvFAAAAFI"]
[Sun Apr 05 22:30:19.026786 2026] [:error] [pid 30921:tid 30938] [client 158.158.48.159:23725] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "adJx-2FGQVn8Q0ueB2485gAAAQ8"]
[Sun Apr 05 22:30:19.505413 2026] [:error] [pid 45303:tid 45324] [client 158.158.48.159:23755] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "adJx-7boQ9eViZ4hdnln0gAAAAc"]
[Sun Apr 05 22:30:19.984477 2026] [:error] [pid 30921:tid 30944] [client 158.158.48.159:24917] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "adJx-2FGQVn8Q0ueB2486QAAARU"]
[Sun Apr 05 22:30:20.468681 2026] [:error] [pid 45409:tid 45423] [client 158.158.48.159:23738] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "adJx_NHt_Oyw03gjCNg9xwAAAMw"]
[Sun Apr 05 22:30:20.945435 2026] [:error] [pid 30921:tid 30942] [client 158.158.48.159:23732] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "adJx_GFGQVn8Q0ueB2486wAAARM"]
[Sun Apr 05 22:30:21.423833 2026] [:error] [pid 45409:tid 45427] [client 158.158.48.159:24095] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "adJx_dHt_Oyw03gjCNg91AAAANA"]
[Sun Apr 05 22:30:21.902746 2026] [:error] [pid 45303:tid 45330] [client 158.158.48.159:24489] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "adJx_bboQ9eViZ4hdnln1AAAAA0"]
[Sun Apr 05 22:30:22.392174 2026] [:error] [pid 45305:tid 45372] [client 158.158.48.159:23714] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "adJx_ujDQjr7aWhjflB3SwAAAIE"]
[Sun Apr 05 22:30:22.869671 2026] [:error] [pid 45304:tid 45351] [client 158.158.48.159:21987] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "adJx_g5jnqDKKovdRkkvKQAAAEc"]
[Sun Apr 05 22:30:23.363710 2026] [:error] [pid 45303:tid 45336] [client 158.158.48.159:24568] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "adJx_7boQ9eViZ4hdnln1wAAABM"]
[Sun Apr 05 22:30:23.841174 2026] [:error] [pid 45305:tid 45374] [client 158.158.48.159:24103] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "adJx_-jDQjr7aWhjflB3WQAAAIM"]
[Sun Apr 05 22:30:24.325112 2026] [:error] [pid 45305:tid 45389] [client 158.158.48.159:22763] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "adJyAOjDQjr7aWhjflB3XgAAAJI"]
[Sun Apr 05 22:30:24.802054 2026] [:error] [pid 45409:tid 45419] [client 158.158.48.159:24887] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "adJyANHt_Oyw03gjCNg98QAAAMg"]
[Sun Apr 05 22:30:25.281815 2026] [:error] [pid 45409:tid 45430] [client 158.158.48.159:23681] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "adJyAdHt_Oyw03gjCNg9-gAAANM"]
[Sun Apr 05 22:30:25.808559 2026] [:error] [pid 45409:tid 45415] [client 158.158.48.159:23680] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "adJyAdHt_Oyw03gjCNg9_wAAAMQ"]
[Sun Apr 05 22:30:26.502102 2026] [:error] [pid 45409:tid 45424] [client 158.158.48.159:24163] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "adJyAtHt_Oyw03gjCNg-CgAAAM0"]
[Sun Apr 05 22:30:26.979318 2026] [:error] [pid 45303:tid 45320] [client 158.158.48.159:25388] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "adJyArboQ9eViZ4hdnln5QAAAAM"]
[Sun Apr 05 22:30:27.458011 2026] [:error] [pid 45409:tid 45428] [client 158.158.48.159:25439] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "adJyA9Ht_Oyw03gjCNg-DwAAANE"]
[Sun Apr 05 22:30:27.939323 2026] [:error] [pid 45409:tid 45418] [client 158.158.48.159:24902] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "adJyA9Ht_Oyw03gjCNg-EgAAAMc"]
[Sun Apr 05 22:30:28.422482 2026] [:error] [pid 45304:tid 45344] [client 158.158.48.159:24898] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "adJyBA5jnqDKKovdRkkvNAAAAEA"]
[Sun Apr 05 22:30:28.904114 2026] [:error] [pid 30921:tid 30939] [client 158.158.48.159:25427] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "adJyBGFGQVn8Q0ueB249DwAAARA"]
[Sun Apr 05 22:30:29.382568 2026] [:error] [pid 45409:tid 45431] [client 158.158.48.159:23158] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "adJyBdHt_Oyw03gjCNg-GwAAANQ"]
[Sun Apr 05 22:30:29.870192 2026] [:error] [pid 45409:tid 45427] [client 158.158.48.159:23429] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "adJyBdHt_Oyw03gjCNg-HQAAANA"]
[Sun Apr 05 22:30:30.346363 2026] [:error] [pid 45409:tid 45425] [client 158.158.48.159:24533] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "adJyBtHt_Oyw03gjCNg-IQAAAM4"]
[Sun Apr 05 22:30:30.826174 2026] [:error] [pid 45303:tid 45328] [client 158.158.48.159:24873] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ew.php"] [unique_id "adJyBrboQ9eViZ4hdnln7QAAAAs"]
[Sun Apr 05 22:30:31.303989 2026] [:error] [pid 45303:tid 45336] [client 158.158.48.159:24534] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ew.php"] [unique_id "adJyB7boQ9eViZ4hdnln8AAAABM"]
[Sun Apr 05 22:30:31.788015 2026] [:error] [pid 45303:tid 45317] [client 158.158.48.159:21192] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ew.php"] [unique_id "adJyB7boQ9eViZ4hdnln9AAAAAA"]
[Sun Apr 05 22:30:32.272327 2026] [:error] [pid 45305:tid 45375] [client 158.158.48.159:22745] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ew.php"] [unique_id "adJyCOjDQjr7aWhjflB3ZgAAAIQ"]
[Sun Apr 05 22:30:32.752526 2026] [:error] [pid 45409:tid 45412] [client 158.158.48.159:23777] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file21.php"] [unique_id "adJyCNHt_Oyw03gjCNg-MAAAAME"]
[Sun Apr 05 22:30:33.231449 2026] [:error] [pid 45304:tid 45347] [client 158.158.48.159:24066] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file21.php"] [unique_id "adJyCQ5jnqDKKovdRkkvNwAAAEM"]
[Sun Apr 05 22:30:33.708009 2026] [:error] [pid 45409:tid 45428] [client 158.158.48.159:24845] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file21.php"] [unique_id "adJyCdHt_Oyw03gjCNg-NwAAANE"]
[Sun Apr 05 22:30:34.200221 2026] [:error] [pid 45303:tid 45334] [client 158.158.48.159:24120] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file21.php"] [unique_id "adJyCrboQ9eViZ4hdnln-wAAABE"]
[Sun Apr 05 22:30:34.678148 2026] [:error] [pid 45409:tid 45434] [client 158.158.48.159:24490] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "adJyCtHt_Oyw03gjCNg-PgAAANc"]
[Sun Apr 05 22:30:35.155821 2026] [:error] [pid 45303:tid 45321] [client 158.158.48.159:24563] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "adJyC7boQ9eViZ4hdnln_gAAAAQ"]
[Sun Apr 05 22:30:35.636307 2026] [:error] [pid 45409:tid 45435] [client 158.158.48.159:24461] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "adJyC9Ht_Oyw03gjCNg-QgAAANg"]
[Sun Apr 05 22:30:36.113551 2026] [:error] [pid 45305:tid 45392] [client 158.158.48.159:24476] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "adJyDOjDQjr7aWhjflB3aAAAAJU"]
[Sun Apr 05 22:30:36.591109 2026] [:error] [pid 30921:tid 30932] [client 158.158.48.159:24130] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "adJyDGFGQVn8Q0ueB249HQAAAQk"]
[Sun Apr 05 22:30:37.069869 2026] [:error] [pid 45303:tid 45328] [client 158.158.48.159:24145] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "adJyDbboQ9eViZ4hdnloBQAAAAs"]
[Sun Apr 05 22:30:37.549612 2026] [:error] [pid 45305:tid 45394] [client 158.158.48.159:24452] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "adJyDejDQjr7aWhjflB3agAAAJc"]
[Sun Apr 05 22:30:38.027433 2026] [:error] [pid 45409:tid 45434] [client 158.158.48.159:24096] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "adJyDtHt_Oyw03gjCNg-UgAAANc"]
[Sun Apr 05 22:30:38.507079 2026] [:error] [pid 45303:tid 45329] [client 158.158.48.159:24120] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "adJyDrboQ9eViZ4hdnloCQAAAAw"]
[Sun Apr 05 22:30:38.985768 2026] [:error] [pid 45409:tid 45414] [client 158.158.48.159:24188] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "adJyDtHt_Oyw03gjCNg-WgAAAMM"]
[Sun Apr 05 22:30:39.467965 2026] [:error] [pid 30921:tid 30942] [client 158.158.48.159:24567] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "adJyD2FGQVn8Q0ueB249IgAAARM"]
[Sun Apr 05 22:30:39.945547 2026] [:error] [pid 45303:tid 45337] [client 158.158.48.159:24903] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "adJyD7boQ9eViZ4hdnloDgAAABQ"]
[Sun Apr 05 22:30:40.425254 2026] [:error] [pid 45409:tid 45413] [client 158.158.48.159:23711] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "adJyENHt_Oyw03gjCNg-ZgAAAMI"]
[Sun Apr 05 22:30:40.902643 2026] [:error] [pid 45409:tid 45411] [client 158.158.48.159:24531] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "adJyENHt_Oyw03gjCNg-awAAAMA"]
[Sun Apr 05 22:30:41.380404 2026] [:error] [pid 45409:tid 45421] [client 158.158.48.159:24102] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "adJyEdHt_Oyw03gjCNg-bwAAAMo"]
[Sun Apr 05 22:30:41.858143 2026] [:error] [pid 45409:tid 45414] [client 158.158.48.159:24840] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "adJyEdHt_Oyw03gjCNg-dAAAAMM"]
[Sun Apr 05 22:30:42.336871 2026] [:error] [pid 45409:tid 45422] [client 158.158.48.159:24849] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/efile.php"] [unique_id "adJyEtHt_Oyw03gjCNg-dwAAAMs"]
[Sun Apr 05 22:30:42.817765 2026] [:error] [pid 45303:tid 45337] [client 158.158.48.159:24558] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/efile.php"] [unique_id "adJyErboQ9eViZ4hdnloGgAAABQ"]
[Sun Apr 05 22:30:43.296206 2026] [:error] [pid 30921:tid 30932] [client 158.158.48.159:23510] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/efile.php"] [unique_id "adJyE2FGQVn8Q0ueB249JQAAAQk"]
[Sun Apr 05 22:30:43.779661 2026] [:error] [pid 45409:tid 45432] [client 158.158.48.159:24547] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/efile.php"] [unique_id "adJyE9Ht_Oyw03gjCNg-egAAANU"]
[Sun Apr 05 22:30:44.256968 2026] [:error] [pid 45304:tid 45354] [client 158.158.48.159:25457] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/afile.php"] [unique_id "adJyFA5jnqDKKovdRkkvPwAAAEo"]
[Sun Apr 05 22:30:44.735899 2026] [:error] [pid 45303:tid 45332] [client 158.158.48.159:23134] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/afile.php"] [unique_id "adJyFLboQ9eViZ4hdnloIAAAAA8"]
[Sun Apr 05 22:30:45.214726 2026] [:error] [pid 45409:tid 45418] [client 158.158.48.159:24850] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/afile.php"] [unique_id "adJyFdHt_Oyw03gjCNg-ewAAAMc"]
[Sun Apr 05 22:30:45.693011 2026] [:error] [pid 45303:tid 45329] [client 158.158.48.159:24148] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/afile.php"] [unique_id "adJyFbboQ9eViZ4hdnloJwAAAAw"]
[Sun Apr 05 22:30:46.169664 2026] [:error] [pid 30921:tid 30925] [client 158.158.48.159:24572] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cabs.php"] [unique_id "adJyFmFGQVn8Q0ueB249KwAAAQI"]
[Sun Apr 05 22:30:46.647182 2026] [:error] [pid 45303:tid 45338] [client 158.158.48.159:24942] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cabs.php"] [unique_id "adJyFrboQ9eViZ4hdnloKQAAABU"]
[Sun Apr 05 22:30:47.128483 2026] [:error] [pid 30921:tid 30935] [client 158.158.48.159:24480] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cabs.php"] [unique_id "adJyF2FGQVn8Q0ueB249LQAAAQw"]
[Sun Apr 05 22:30:47.605538 2026] [:error] [pid 45304:tid 45357] [client 158.158.48.159:23549] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cabs.php"] [unique_id "adJyFw5jnqDKKovdRkkvRQAAAE0"]
[Sun Apr 05 22:30:48.083870 2026] [:error] [pid 30921:tid 30939] [client 158.158.48.159:24562] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "adJyGGFGQVn8Q0ueB249LwAAARA"]
[Sun Apr 05 22:30:48.568169 2026] [:error] [pid 45305:tid 45393] [client 158.158.48.159:24183] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "adJyGOjDQjr7aWhjflB3cQAAAJY"]
[Sun Apr 05 22:30:49.052032 2026] [:error] [pid 30921:tid 30945] [client 158.158.48.159:23519] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "adJyGWFGQVn8Q0ueB249OQAAARY"]
[Sun Apr 05 22:30:49.533708 2026] [:error] [pid 45409:tid 45429] [client 158.158.48.159:25469] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "adJyGdHt_Oyw03gjCNg-iwAAANI"]
[Sun Apr 05 22:30:50.010879 2026] [:error] [pid 45303:tid 45333] [client 158.158.48.159:24105] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1da.php"] [unique_id "adJyGrboQ9eViZ4hdnloMwAAABA"]
[Sun Apr 05 22:30:50.488838 2026] [:error] [pid 45409:tid 45435] [client 158.158.48.159:23763] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1da.php"] [unique_id "adJyGtHt_Oyw03gjCNg-jwAAANg"]
[Sun Apr 05 22:30:50.972573 2026] [:error] [pid 45409:tid 45414] [client 158.158.48.159:25362] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1da.php"] [unique_id "adJyGtHt_Oyw03gjCNg-kAAAAMM"]
[Sun Apr 05 22:30:51.468134 2026] [:error] [pid 45304:tid 45362] [client 158.158.48.159:24082] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1da.php"] [unique_id "adJyGw5jnqDKKovdRkkvUAAAAFI"]
[Sun Apr 05 22:30:51.949302 2026] [:error] [pid 45304:tid 45361] [client 158.158.48.159:21137] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "adJyGw5jnqDKKovdRkkvUwAAAFE"]
[Sun Apr 05 22:30:52.427491 2026] [:error] [pid 30921:tid 30931] [client 158.158.48.159:25423] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "adJyHGFGQVn8Q0ueB249PgAAAQg"]
[Sun Apr 05 22:30:52.907033 2026] [:error] [pid 45304:tid 45352] [client 158.158.48.159:23760] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "adJyHA5jnqDKKovdRkkvVgAAAEg"]
[Sun Apr 05 22:30:53.385651 2026] [:error] [pid 45303:tid 45339] [client 158.158.48.159:24550] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "adJyHbboQ9eViZ4hdnloOgAAABY"]
[Sun Apr 05 22:30:53.865286 2026] [:error] [pid 45303:tid 45331] [client 158.158.48.159:24177] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "adJyHbboQ9eViZ4hdnloPgAAAA4"]
[Sun Apr 05 22:30:54.344821 2026] [:error] [pid 45303:tid 45340] [client 158.158.48.159:24908] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "adJyHrboQ9eViZ4hdnloQgAAABc"]
[Sun Apr 05 22:30:54.824328 2026] [:error] [pid 45305:tid 45371] [client 158.158.48.159:24927] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "adJyHujDQjr7aWhjflB3dwAAAIA"]
[Sun Apr 05 22:30:55.303032 2026] [:error] [pid 30921:tid 30947] [client 158.158.48.159:24110] [client 158.158.48.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "adJyH2FGQVn8Q0ueB249SAAAARg"]
[Mon Apr 06 00:09:26.545453 2026] [:error] [pid 45409:tid 45432] [client 1.15.52.154:38090] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adKJNtHt_Oyw03gjCNipRgAAANU"]
[Mon Apr 06 00:12:00.973409 2026] [:error] [pid 45409:tid 45428] [client 170.106.147.63:51946] [client 170.106.147.63] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adKJ0NHt_Oyw03gjCNirYgAAANE"]
[Mon Apr 06 01:12:35.890953 2026] [:error] [pid 51753:tid 51834] [client 115.186.169.142:63036] [client 115.186.169.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.186.169.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adKYA63pmp1JkaicYbtr4AAAARY"]
[Mon Apr 06 06:13:13.591480 2026] [:error] [pid 9442:tid 9461] [client 14.215.163.132:39801] [client 14.215.163.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adLeeUPsNnAJTnmz6sbeFgAAARE"]
[Mon Apr 06 06:18:07.185357 2026] [:error] [pid 35686:tid 35702] [client 104.244.227.179:60761] [client 104.244.227.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.244.227.179, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adLfn8MKdea6oORd2fxfFwAAAAY"]
[Mon Apr 06 06:21:11.204845 2026] [:error] [pid 35688:tid 35759] [client 104.244.227.179:60998] [client 104.244.227.179] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adLgV-Z85qg4jLsRpQy1tQAAAIk"]
[Mon Apr 06 06:22:30.417616 2026] [:error] [pid 35688:tid 35769] [client 104.244.227.179:60429] [client 104.244.227.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.244.227.179, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adLgpuZ85qg4jLsRpQy2LAAAAJM"]
[Mon Apr 06 06:23:38.256310 2026] [:error] [pid 9442:tid 9451] [client 104.244.227.179:61107] [client 104.244.227.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.244.227.179, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adLg6kPsNnAJTnmz6sbnlQAAAQc"]
[Mon Apr 06 06:24:49.808446 2026] [:error] [pid 35688:tid 35761] [client 104.244.227.179:60473] [client 104.244.227.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.244.227.179, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adLhMeZ85qg4jLsRpQy23AAAAIs"]
[Mon Apr 06 06:25:59.754069 2026] [:error] [pid 35688:tid 35772] [client 104.244.227.179:60918] [client 104.244.227.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.244.227.179, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adLhd-Z85qg4jLsRpQy3VwAAAJY"]
[Mon Apr 06 07:20:20.931149 2026] [:error] [pid 9442:tid 9462] [client 43.135.133.194:59772] [client 43.135.133.194] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adLuNEPsNnAJTnmz6sYMxQAAARI"]
[Mon Apr 06 10:37:07.150518 2026] [:error] [pid 9442:tid 9460] [client 43.159.152.187:33794] [client 43.159.152.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adMcU0PsNnAJTnmz6saFqAAAARA"]
[Mon Apr 06 18:42:33.782599 2026] [:error] [pid 38562:tid 38581] [client 20.215.208.154:45175] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "adOOGaeD6Ohe6wzRuy5k9gAAAVA"]
[Mon Apr 06 18:42:38.290153 2026] [:error] [pid 38562:tid 38572] [client 20.215.208.154:46358] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "adOOHqeD6Ohe6wzRuy5k_QAAAUc"]
[Mon Apr 06 18:42:40.654080 2026] [:error] [pid 9442:tid 9452] [client 20.215.208.154:5738] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "adOOIEPsNnAJTnmz6sZ_uwAAAQg"]
[Mon Apr 06 18:42:50.677772 2026] [:error] [pid 10280:tid 10301] [client 20.215.208.154:46461] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "adOOKl8QUJkf8g-BFfPJDQAAAdI"]
[Mon Apr 06 18:42:59.894750 2026] [:error] [pid 35686:tid 35702] [client 20.215.208.154:45787] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Sanskrit.php"] [unique_id "adOOM8MKdea6oORd2fzCaAAAAAY"]
[Mon Apr 06 18:43:03.503182 2026] [:error] [pid 9442:tid 9458] [client 20.215.208.154:47015] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Sanskrit.php"] [unique_id "adOON0PsNnAJTnmz6sZ_8AAAAQ4"]
[Mon Apr 06 18:43:07.572615 2026] [:error] [pid 9413:tid 9419] [client 20.215.208.154:46423] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adOOO3llvEK3chn01wG15AAAAYQ"]
[Mon Apr 06 18:43:19.758979 2026] [:error] [pid 35686:tid 35698] [client 20.215.208.154:47063] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adOOR8MKdea6oORd2fzCdAAAAAI"]
[Mon Apr 06 18:43:47.322984 2026] [:error] [pid 35686:tid 35707] [client 20.215.208.154:5753] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "adOOY8MKdea6oORd2fzCsAAAAAs"]
[Mon Apr 06 18:44:10.313314 2026] [:error] [pid 38562:tid 38589] [client 20.215.208.154:30929] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php"] [unique_id "adOOeqeD6Ohe6wzRuy5l5wAAAVg"]
[Mon Apr 06 18:44:13.404364 2026] [:error] [pid 35687:tid 35739] [client 20.215.208.154:30967] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php"] [unique_id "adOOfZ3LtDozV0i8BitaCwAAAFA"]
[Mon Apr 06 18:44:16.110312 2026] [:error] [pid 35688:tid 35753] [client 20.215.208.154:26992] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php"] [unique_id "adOOgOZ85qg4jLsRpQxtaAAAAIM"]
[Mon Apr 06 18:44:21.650732 2026] [:error] [pid 35687:tid 35733] [client 20.215.208.154:42902] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws.php"] [unique_id "adOOhZ3LtDozV0i8BitaEQAAAEo"]
[Mon Apr 06 18:44:23.704651 2026] [:error] [pid 10280:tid 10296] [client 20.215.208.154:42376] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "adOOh18QUJkf8g-BFfPKGQAAAc0"]
[Mon Apr 06 18:44:28.321119 2026] [:error] [pid 35688:tid 35763] [client 20.215.208.154:40410] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "adOOjOZ85qg4jLsRpQxteAAAAI0"]
[Mon Apr 06 18:45:00.673058 2026] [:error] [pid 1827:tid 1844] [client 20.215.208.154:39503] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "adOOrOVeb6S_DnjZ2xH3YQAAAg8"]
[Mon Apr 06 18:45:06.726272 2026] [:error] [pid 10280:tid 10303] [client 20.215.208.154:29337] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "adOOsl8QUJkf8g-BFfPKlAAAAdQ"]
[Mon Apr 06 18:45:22.690994 2026] [:error] [pid 1827:tid 1835] [client 20.215.208.154:48689] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "adOOwuVeb6S_DnjZ2xH3eAAAAgY"]
[Mon Apr 06 18:45:25.578402 2026] [:error] [pid 38562:tid 38567] [client 20.215.208.154:42472] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "adOOxaeD6Ohe6wzRuy5mZwAAAUI"]
[Mon Apr 06 18:45:27.200996 2026] [:error] [pid 1827:tid 1845] [client 20.215.208.154:47458] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "adOOx-Veb6S_DnjZ2xH3fAAAAhA"]
[Mon Apr 06 18:45:31.160571 2026] [:error] [pid 10280:tid 10307] [client 20.215.208.154:48748] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "adOOy18QUJkf8g-BFfPKwAAAAdg"]
[Mon Apr 06 18:45:40.730988 2026] [:error] [pid 38562:tid 38565] [client 20.215.208.154:48725] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gpt-sh.php"] [unique_id "adOO1KeD6Ohe6wzRuy5mhAAAAUA"]
[Mon Apr 06 18:45:46.887186 2026] [:error] [pid 38562:tid 38586] [client 20.215.208.154:43499] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gpt-sh.php"] [unique_id "adOO2qeD6Ohe6wzRuy5mhwAAAVU"]
[Mon Apr 06 18:45:51.079011 2026] [:error] [pid 9442:tid 9460] [client 20.215.208.154:37102] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "adOO30PsNnAJTnmz6saBaAAAARA"]
[Mon Apr 06 18:46:12.576669 2026] [:error] [pid 9442:tid 9466] [client 20.215.208.154:33737] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adOO9EPsNnAJTnmz6saBtAAAARY"]
[Mon Apr 06 18:46:14.875421 2026] [:error] [pid 35688:tid 35762] [client 20.215.208.154:37272] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adOO9uZ85qg4jLsRpQxucwAAAIw"]
[Mon Apr 06 18:46:18.276662 2026] [:error] [pid 10280:tid 10288] [client 20.215.208.154:37287] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adOO-l8QUJkf8g-BFfPLGgAAAcU"]
[Mon Apr 06 18:46:20.274662 2026] [:error] [pid 9442:tid 9452] [client 20.215.208.154:37934] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "adOO_EPsNnAJTnmz6saByAAAAQg"]
[Mon Apr 06 18:46:22.863644 2026] [:error] [pid 10280:tid 10307] [client 20.215.208.154:37604] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "adOO_l8QUJkf8g-BFfPLJgAAAdg"]
[Mon Apr 06 18:46:26.119300 2026] [:error] [pid 9442:tid 9451] [client 20.215.208.154:35479] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "adOPAkPsNnAJTnmz6saB3wAAAQc"]
[Mon Apr 06 18:46:28.708918 2026] [:error] [pid 9442:tid 9447] [client 20.215.208.154:37568] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "adOPBEPsNnAJTnmz6saB7wAAAQM"]
[Mon Apr 06 18:46:46.777385 2026] [:error] [pid 35688:tid 35774] [client 20.215.208.154:37554] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adOPFuZ85qg4jLsRpQxu_QAAAJg"]
[Mon Apr 06 18:46:50.497894 2026] [:error] [pid 10280:tid 10296] [client 20.215.208.154:37521] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "adOPGl8QUJkf8g-BFfPLQwAAAc0"]
[Mon Apr 06 18:47:08.474677 2026] [:error] [pid 1827:tid 1843] [client 20.215.208.154:38297] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "adOPLOVeb6S_DnjZ2xH31wAAAg4"]
[Mon Apr 06 18:47:33.636272 2026] [:error] [pid 9442:tid 9447] [client 20.215.208.154:40004] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "adOPRUPsNnAJTnmz6saCjwAAAQM"]
[Mon Apr 06 18:47:37.046275 2026] [:error] [pid 9413:tid 9426] [client 20.215.208.154:45116] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "adOPSXllvEK3chn01wG27gAAAYs"]
[Mon Apr 06 18:47:40.463629 2026] [:error] [pid 35688:tid 35773] [client 20.215.208.154:32093] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "adOPTOZ85qg4jLsRpQxvrAAAAJc"]
[Mon Apr 06 18:47:43.682086 2026] [:error] [pid 35688:tid 35772] [client 20.215.208.154:31673] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "adOPT-Z85qg4jLsRpQxvyAAAAJY"]
[Mon Apr 06 18:47:47.345026 2026] [:error] [pid 35688:tid 35772] [client 20.215.208.154:28836] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "adOPU-Z85qg4jLsRpQxv3AAAAJY"]
[Mon Apr 06 18:47:48.892620 2026] [:error] [pid 9442:tid 9459] [client 20.215.208.154:38290] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "adOPVEPsNnAJTnmz6saCpAAAAQ8"]
[Mon Apr 06 18:47:50.227430 2026] [:error] [pid 35687:tid 35731] [client 20.215.208.154:37927] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "adOPVp3LtDozV0i8BitafQAAAEg"]
[Mon Apr 06 18:47:53.591296 2026] [:error] [pid 35686:tid 35713] [client 20.215.208.154:40359] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "adOPWcMKdea6oORd2fzDhgAAABE"]
[Mon Apr 06 18:47:56.158598 2026] [:error] [pid 1827:tid 1843] [client 20.215.208.154:33777] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "adOPXOVeb6S_DnjZ2xH3_gAAAg4"]
[Mon Apr 06 18:48:00.474651 2026] [:error] [pid 35688:tid 35760] [client 20.215.208.154:33724] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "adOPYOZ85qg4jLsRpQxwBQAAAIo"]
[Mon Apr 06 18:48:03.552377 2026] [:error] [pid 35687:tid 35746] [client 20.215.208.154:28271] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "adOPY53LtDozV0i8BitaiwAAAFc"]
[Mon Apr 06 18:48:05.804703 2026] [:error] [pid 10280:tid 10304] [client 20.215.208.154:31244] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "adOPZV8QUJkf8g-BFfPLpwAAAdU"]
[Mon Apr 06 18:48:09.191654 2026] [:error] [pid 10280:tid 10298] [client 20.215.208.154:31240] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "adOPaV8QUJkf8g-BFfPLvgAAAc8"]
[Mon Apr 06 18:48:10.649190 2026] [:error] [pid 38562:tid 38586] [client 20.215.208.154:48314] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "adOPaqeD6Ohe6wzRuy5nKgAAAVU"]
[Mon Apr 06 18:48:15.225379 2026] [:error] [pid 10280:tid 10292] [client 20.215.208.154:31260] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "adOPb18QUJkf8g-BFfPLyQAAAck"]
[Mon Apr 06 18:48:17.998529 2026] [:error] [pid 38562:tid 38572] [client 20.215.208.154:5989] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "adOPcaeD6Ohe6wzRuy5nNQAAAUc"]
[Mon Apr 06 18:48:21.423785 2026] [:error] [pid 9442:tid 9464] [client 20.215.208.154:48299] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "adOPdUPsNnAJTnmz6saC6AAAARQ"]
[Mon Apr 06 18:48:22.081927 2026] [:error] [pid 9442:tid 9467] [client 20.215.208.154:50406] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "adOPdkPsNnAJTnmz6saC6gAAARc"]
[Mon Apr 06 18:48:24.387755 2026] [:error] [pid 38562:tid 38575] [client 20.215.208.154:50798] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "adOPeKeD6Ohe6wzRuy5nQgAAAUo"]
[Mon Apr 06 18:48:27.149413 2026] [:error] [pid 35688:tid 35773] [client 20.215.208.154:5723] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "adOPe-Z85qg4jLsRpQxwKwAAAJc"]
[Mon Apr 06 18:48:31.606678 2026] [:error] [pid 38562:tid 38588] [client 20.215.208.154:50339] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gfd.php"] [unique_id "adOPf6eD6Ohe6wzRuy5nWAAAAVc"]
[Mon Apr 06 18:48:46.182607 2026] [:error] [pid 10280:tid 10291] [client 20.215.208.154:50340] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hhxc.php"] [unique_id "adOPjl8QUJkf8g-BFfPMEQAAAcg"]
[Mon Apr 06 18:48:57.723999 2026] [:error] [pid 10280:tid 10298] [client 20.215.208.154:50694] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hhxc.php"] [unique_id "adOPmV8QUJkf8g-BFfPMFwAAAc8"]
[Mon Apr 06 18:49:00.871933 2026] [:error] [pid 10280:tid 10286] [client 20.215.208.154:51236] [client 20.215.208.154] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hhxc.php"] [unique_id "adOPnF8QUJkf8g-BFfPMHAAAAcM"]
[Mon Apr 06 19:03:07.394621 2026] [:error] [pid 35688:tid 35750] [client 49.233.45.47:46436] [client 49.233.45.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adOS6-Z85qg4jLsRpQx6SgAAAIA"]
[Mon Apr 06 19:29:16.254989 2026] [:error] [pid 9442:tid 9464] [client 122.128.111.29:58228] [client 122.128.111.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 122.128.111.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adOZDEPsNnAJTnmz6samsAAAARQ"]
[Mon Apr 06 19:29:17.647174 2026] [:error] [pid 9442:tid 9450] [client 122.128.111.29:58228] [client 122.128.111.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 122.128.111.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adOZDUPsNnAJTnmz6samuwAAAQY"], referer: https://expressinteriors.com/wp-login.php
[Mon Apr 06 19:55:53.229160 2026] [:error] [pid 9442:tid 9460] [client 43.130.102.223:53630] [client 43.130.102.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adOfSUPsNnAJTnmz6sbBOgAAARA"]
[Mon Apr 06 20:22:51.847450 2026] [:error] [pid 10280:tid 10290] [client 69.49.112.76:49574] [client 69.49.112.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.112.76, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adOlm18QUJkf8g-BFfP9OgAAAcc"]
[Mon Apr 06 20:22:53.160071 2026] [:error] [pid 10280:tid 10283] [client 69.49.112.76:49574] [client 69.49.112.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.112.76, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adOlnV8QUJkf8g-BFfP9RAAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Mon Apr 06 21:27:00.383366 2026] [:error] [pid 35786:tid 35817] [client 189.6.250.136:1446] [client 189.6.250.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.6.250.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adO0pGgkfCKTaLhwaKQk3QAAANg"]
[Mon Apr 06 21:39:02.697756 2026] [:error] [pid 38562:tid 38589] [client 43.157.46.118:60732] [client 43.157.46.118] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adO3dqeD6Ohe6wzRuy6g4wAAAVg"]
[Mon Apr 06 21:54:32.859675 2026] [:error] [pid 38562:tid 38589] [client 68.183.235.102:47100] [client 68.183.235.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.183.235.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adO7GKeD6Ohe6wzRuy6lLQAAAVg"]
[Mon Apr 06 21:54:35.953770 2026] [:error] [pid 38562:tid 38565] [client 68.183.235.102:47100] [client 68.183.235.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.183.235.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adO7G6eD6Ohe6wzRuy6lLgAAAUA"], referer: https://expressinteriors.com/wp-login.php
[Mon Apr 06 22:15:31.795319 2026] [:error] [pid 9413:tid 9419] [client 189.6.250.136:1094] [client 189.6.250.136] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adPAA3llvEK3chn01wHUxgAAAYQ"]
[Mon Apr 06 22:17:21.015390 2026] [:error] [pid 9442:tid 9467] [client 189.6.250.136:1099] [client 189.6.250.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.6.250.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adPAcUPsNnAJTnmz6sYtGgAAARc"]
[Mon Apr 06 22:19:01.154760 2026] [:error] [pid 1827:tid 1843] [client 189.6.250.136:1051] [client 189.6.250.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.6.250.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adPA1eVeb6S_DnjZ2xEyBgAAAg4"]
[Mon Apr 06 22:20:45.434297 2026] [:error] [pid 10280:tid 10288] [client 189.6.250.136:1400] [client 189.6.250.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.6.250.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adPBPV8QUJkf8g-BFfMs5AAAAcU"]
[Mon Apr 06 22:22:24.333762 2026] [:error] [pid 10280:tid 10286] [client 189.6.250.136:1123] [client 189.6.250.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.6.250.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adPBoF8QUJkf8g-BFfMtUAAAAcM"]
[Tue Apr 07 01:03:28.016551 2026] [:error] [pid 39329:tid 39415] [client 67.222.38.61:29782] [client 67.222.38.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.222.38.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adPnYFb3ztKMBQDfFByb2wAAAE0"]
[Tue Apr 07 01:03:29.011517 2026] [:error] [pid 39329:tid 39409] [client 67.222.38.61:29782] [client 67.222.38.61] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.222.38.61, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adPnYVb3ztKMBQDfFByb3AAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Tue Apr 07 02:13:57.933841 2026] [:error] [pid 55003:tid 55020] [client 43.133.69.37:43464] [client 43.133.69.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adP35QiMyAbcUkWpJeAPXQAAAQ0"]
[Tue Apr 07 02:23:55.015965 2026] [:error] [pid 39329:tid 39411] [client 143.198.190.237:40310] [client 143.198.190.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.198.190.237, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adP6O1b3ztKMBQDfFByyYgAAAEk"]
[Tue Apr 07 02:23:56.581166 2026] [:error] [pid 39329:tid 39426] [client 143.198.190.237:40310] [client 143.198.190.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.198.190.237, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adP6PFb3ztKMBQDfFByyZgAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Tue Apr 07 04:40:58.989768 2026] [:error] [pid 37598:tid 37679] [client 209.38.90.246:56712] [client 209.38.90.246] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "adQaWu9g7q_cV2WhPaxbXwAAAJI"]
[Tue Apr 07 04:40:59.068458 2026] [:error] [pid 37596:tid 37624] [client 209.38.90.246:57854] [client 209.38.90.246] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "adQaW6paAOZHEjRWjP3ceQAAABI"]
[Tue Apr 07 05:20:31.601511 2026] [:error] [pid 37596:tid 37619] [client 43.130.9.111:56298] [client 43.130.9.111] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adQjn6paAOZHEjRWjP3nwAAAAA0"]
[Tue Apr 07 07:13:04.636162 2026] [:error] [pid 37597:tid 37645] [client 43.128.156.124:46612] [client 43.128.156.124] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adQ-AA6uAY0QAy-8EEJoXAAAAEs"]
[Tue Apr 07 07:51:37.690548 2026] [:error] [pid 12948:tid 12958] [client 223.244.35.77:39797] [client 223.244.35.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adRHCcbeSPAN8LvMqsaC5gAAAQc"]
[Tue Apr 07 08:01:24.593495 2026] [:error] [pid 12948:tid 12970] [client 122.161.74.193:26969] [client 122.161.74.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.161.74.193, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adRJVMbeSPAN8LvMqsaN9AAAARM"], referer: https://expressinteriors.com/
[Tue Apr 07 10:01:13.825117 2026] [:error] [pid 12948:tid 12952] [client 104.244.79.40:57336] [client 104.244.79.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.244.79.40, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adRlacbeSPAN8LvMqsYD8gAAAQE"]
[Tue Apr 07 10:01:15.236282 2026] [:error] [pid 12948:tid 12974] [client 104.244.79.40:57336] [client 104.244.79.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.244.79.40, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adRla8beSPAN8LvMqsYD9wAAARc"], referer: https://expressinteriors.com/wp-login.php
[Tue Apr 07 10:18:02.025420 2026] [:error] [pid 37598:tid 37663] [client 43.153.204.189:54946] [client 43.153.204.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adRpWu9g7q_cV2WhPaz_aAAAAII"]
[Tue Apr 07 10:57:21.816461 2026] [:error] [pid 37597:tid 37642] [client 217.216.72.68:52928] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/"] [unique_id "adRykQ6uAY0QAy-8EELAJgAAAEg"]
[Tue Apr 07 10:57:22.252445 2026] [:error] [pid 12948:tid 12965] [client 217.216.72.68:58921] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/"] [unique_id "adRyksbeSPAN8LvMqsY3eAAAAQ4"]
[Tue Apr 07 10:57:32.337957 2026] [:error] [pid 37598:tid 37679] [client 217.216.72.68:54117] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adRynO9g7q_cV2WhPawUAwAAAJI"]
[Tue Apr 07 10:57:32.446481 2026] [:error] [pid 37596:tid 37615] [client 217.216.72.68:55337] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adRynKpaAOZHEjRWjP1XfAAAAAk"]
[Tue Apr 07 10:57:56.240740 2026] [:error] [pid 59551:tid 59572] [client 217.216.72.68:60673] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adRytF7LN7Ubyqs-sVsgbAAAAZM"]
[Tue Apr 07 11:46:01.773339 2026] [:error] [pid 37597:tid 37635] [client 152.203.53.7:59901] [client 152.203.53.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.203.53.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adR9-Q6uAY0QAy-8EELsewAAAEE"]
[Tue Apr 07 12:04:52.737347 2026] [:error] [pid 37597:tid 37650] [client 43.153.107.22:50078] [client 43.153.107.22] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adSCZA6uAY0QAy-8EEL-RAAAAFA"]
[Tue Apr 07 12:44:48.614397 2026] [:error] [pid 37597:tid 37654] [client 216.73.216.155:9653] [client 216.73.216.155] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||expressinteriors.com|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/robots.txt"] [unique_id "adSLwA6uAY0QAy-8EEIeTgAAAFQ"]
[Tue Apr 07 16:50:52.061778 2026] [:error] [pid 37719:tid 37744] [client 43.159.152.4:51956] [client 43.159.152.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adTFbE09Xv52u2xXGLCSnwAAANY"]
[Tue Apr 07 19:20:39.942828 2026] [:error] [pid 59551:tid 59562] [client 170.106.107.87:53266] [client 170.106.107.87] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adToh17LN7Ubyqs-sVvv8QAAAYk"]
[Tue Apr 07 20:30:01.914110 2026] [:error] [pid 37598:tid 37683] [client 117.33.163.216:35530] [client 117.33.163.216] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adT4ye9g7q_cV2WhPay4LwAAAJY"]
[Tue Apr 07 20:47:57.666882 2026] [:error] [pid 37719:tid 37737] [client 66.45.248.83:38368] [client 66.45.248.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.45.248.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adT8_U09Xv52u2xXGLAh4AAAAM8"]
[Tue Apr 07 20:47:59.965713 2026] [:error] [pid 59490:tid 59506] [client 66.45.248.83:38372] [client 66.45.248.83] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.45.248.83, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adT8_0cw8OFbiUZ7Rx1rwgAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Tue Apr 07 21:03:21.642631 2026] [:error] [pid 37597:tid 37656] [client 43.153.7.191:36316] [client 43.153.7.191] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adUAmQ6uAY0QAy-8EEKMXQAAAFY"]
[Tue Apr 07 21:07:47.001688 2026] [:error] [pid 37597:tid 37634] [client 151.246.132.59:53440] [client 151.246.132.59] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at REQUEST_BODY. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||www.expressinteriors.com|F|4"] [data "REQUEST_BODY=\\xb6\\xdcEy\\xf3\\xd7\\xa582\\xa6coUm\\xd2\\xe3\\x5c8\\x0e)D\\xb4#jtQ\\xa80\\xe6\\x10(\\xaa\\xa3\\x0f\\xd5\\xa5^t\\xfdR\\x14\\x5c\\xdc@\\xea\\x91n\\x1f]}\\x19h\\x01e\\xfd\\xa7\\xa4\\xb7\\x94,lp\\xce\\xb9|e\\xe30\\x7f\\x0d^h\\xe0\\x15\\xaf\\x9b-\\xda\\xb7\\xa3\\x82\\xde\\xa5-\\xaf\\x1c\\xab_\\xe8\\xaaQ\\xab\\x0d\\xc6\\x89\\xd6\\xe9\\xe4\\xcc\\x1d\\x14\\xec`\\xf4\\x9c\\xc3\\xba\\xaf\\xab\\x8b\\x85 \\x93\\x83n|\\xa5F\\xfc\\xab\\xce\\xebv\\x095\\xf6\\x09\\x09Vv\\x98\\x97\\x87\\xa7\\x89C\\x80\\xfb6\\xcc\\xb5\\x02\\x8f\\x8e\\x10\\x17\\xb6\\xf6h\\xcf:\\xe4\\x92\\xaaY$\\xbd\\xad}\\xd4\\xe4R\\xbclS4hGp\\xb..."] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adUBog6uAY0QAy-8EEKPegAAAEA"]
[Tue Apr 07 23:21:50.950575 2026] [:error] [pid 59551:tid 59557] [client 222.154.250.222:36058] [client 222.154.250.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 222.154.250.222, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adUhDl7LN7Ubyqs-sVtAGQAAAYQ"], referer: https://expressinteriors.com/
[Tue Apr 07 23:40:22.590782 2026] [:error] [pid 37719:tid 37738] [client 43.163.118.136:37314] [client 43.163.118.136] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adUlZk09Xv52u2xXGLBmkAAAANA"]
[Wed Apr 08 00:15:56.928735 2026] [autoindex:error] [pid 59804:tid 59819] [client 85.203.23.152:32113] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/php-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:15:57.029462 2026] [:error] [pid 59804:tid 59809] [client 85.203.23.152:32113] [client 85.203.23.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/config.php"] [unique_id "adUtvXYVIXiPh5_eJTkXwgAAAgM"]
[Wed Apr 08 00:15:58.173016 2026] [:error] [pid 37597:tid 37645] [client 85.203.23.108:36711] [client 85.203.23.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/header.php"] [unique_id "adUtvg6uAY0QAy-8EELq6QAAAEs"]
[Wed Apr 08 00:15:58.354929 2026] [:error] [pid 37719:tid 37743] [client 85.203.23.133:49705] [client 85.203.23.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/system_core.php"] [unique_id "adUtvk09Xv52u2xXGLBxwQAAANU"]
[Wed Apr 08 00:16:00.822486 2026] [:error] [pid 59804:tid 59809] [client 85.203.23.144:46495] [client 85.203.23.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adUtwHYVIXiPh5_eJTkXzwAAAgM"]
[Wed Apr 08 00:16:02.699607 2026] [:error] [pid 37719:tid 37735] [client 85.203.23.142:63693] [client 85.203.23.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "adUtwk09Xv52u2xXGLBx0gAAAM0"]
[Wed Apr 08 00:16:04.629775 2026] [:error] [pid 12948:tid 12962] [client 85.203.23.116:56381] [client 85.203.23.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.23.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adUtxMbeSPAN8LvMqsbUtAAAAQs"], referer: https://expressinteriors.com/wp-admin/
[Wed Apr 08 00:16:05.234907 2026] [:error] [pid 37598:tid 37674] [client 85.203.23.161:51265] [client 85.203.23.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/speculative8.php"] [unique_id "adUtxe9g7q_cV2WhPazsoAAAAI0"]
[Wed Apr 08 00:16:09.539184 2026] [:error] [pid 59551:tid 59576] [client 85.203.23.126:64095] [client 85.203.23.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "adUtyV7LN7Ubyqs-sVtLOgAAAZc"]
[Wed Apr 08 00:16:10.698881 2026] [autoindex:error] [pid 37719:tid 37745] [client 85.203.23.130:55627] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:11.533284 2026] [autoindex:error] [pid 37719:tid 37722] [client 85.203.23.130:55627] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:11.629165 2026] [autoindex:error] [pid 37719:tid 37725] [client 85.203.23.130:55627] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:13.870709 2026] [:error] [pid 37597:tid 37655] [client 85.203.23.109:37469] [client 85.203.23.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.23.109, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adUtzQ6uAY0QAy-8EELrAAAAAFU"], referer: https://expressinteriors.com/wp-admin/
[Wed Apr 08 00:16:20.484914 2026] [:error] [pid 37719:tid 37736] [client 85.203.23.130:55627] [client 85.203.23.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "adUt1E09Xv52u2xXGLBx7gAAAM4"]
[Wed Apr 08 00:16:21.509947 2026] [autoindex:error] [pid 59804:tid 59830] [client 85.203.23.148:44955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:21.603858 2026] [autoindex:error] [pid 59804:tid 59809] [client 85.203.23.148:44955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:21.697635 2026] [autoindex:error] [pid 59804:tid 59807] [client 85.203.23.148:44955] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:21.795595 2026] [autoindex:error] [pid 59804:tid 59824] [client 85.203.23.148:44955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/block-library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:22.558385 2026] [autoindex:error] [pid 59804:tid 59828] [client 85.203.23.148:44955] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:24.005013 2026] [autoindex:error] [pid 59804:tid 59828] [client 85.203.23.148:44955] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:25.467929 2026] [autoindex:error] [pid 59804:tid 59812] [client 85.203.23.148:44955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:25.562711 2026] [autoindex:error] [pid 59804:tid 59828] [client 85.203.23.148:44955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:29.018634 2026] [autoindex:error] [pid 59804:tid 59815] [client 85.203.23.148:44955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:29.112842 2026] [autoindex:error] [pid 59804:tid 59810] [client 85.203.23.148:44955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/mediaelement/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:29.206128 2026] [autoindex:error] [pid 59804:tid 59816] [client 85.203.23.148:44955] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:29.304178 2026] [autoindex:error] [pid 59804:tid 59829] [client 85.203.23.148:44955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:29.398618 2026] [autoindex:error] [pid 59804:tid 59812] [client 85.203.23.148:44955] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:29.498162 2026] [autoindex:error] [pid 59804:tid 59814] [client 85.203.23.148:44955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:29.593391 2026] [autoindex:error] [pid 59804:tid 59822] [client 85.203.23.148:44955] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:29.687522 2026] [autoindex:error] [pid 59804:tid 59817] [client 85.203.23.148:44955] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:31.907362 2026] [:error] [pid 59804:tid 59813] [client 85.203.23.148:44955] [client 85.203.23.148] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/private/"] [unique_id "adUt33YVIXiPh5_eJTkYbQAAAgc"]
[Wed Apr 08 00:16:37.072679 2026] [proxy_fcgi:error] [pid 59804:tid 59811] [client 85.203.23.119:49615] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function add_action() in /home/expressi/public_html/wp-content/plugins/hello.php:69\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/plugins/hello.php on line 69'
[Wed Apr 08 00:16:42.258574 2026] [autoindex:error] [pid 37597:tid 37641] [client 85.203.23.164:41509] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:43.254961 2026] [:error] [pid 37597:tid 37646] [client 85.203.23.130:54591] [client 85.203.23.130] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/"] [unique_id "adUt6w6uAY0QAy-8EELrOwAAAEw"], referer: http://expressinteriors.com/wp-admin/network/
[Wed Apr 08 00:16:43.348442 2026] [autoindex:error] [pid 37597:tid 37649] [client 85.203.23.164:41509] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/src/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:44.293084 2026] [autoindex:error] [pid 37597:tid 37647] [client 85.203.23.164:41509] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:44.387183 2026] [autoindex:error] [pid 37597:tid 37634] [client 85.203.23.164:41509] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/comment-content/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:46.544652 2026] [autoindex:error] [pid 37597:tid 37645] [client 85.203.23.164:41509] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/nextpage/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:47.313754 2026] [autoindex:error] [pid 37597:tid 37653] [client 85.203.23.164:41509] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:47.407924 2026] [autoindex:error] [pid 37597:tid 37647] [client 85.203.23.164:41509] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:48.166332 2026] [autoindex:error] [pid 37597:tid 37652] [client 85.203.23.164:41509] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:48.283587 2026] [autoindex:error] [pid 37597:tid 37637] [client 85.203.23.164:41509] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/image/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:49.055185 2026] [autoindex:error] [pid 37597:tid 37654] [client 85.203.23.164:41509] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:49.149861 2026] [autoindex:error] [pid 37597:tid 37638] [client 85.203.23.164:41509] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:49.931766 2026] [autoindex:error] [pid 37597:tid 37643] [client 85.203.23.164:41509] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:50.715860 2026] [autoindex:error] [pid 37597:tid 37651] [client 85.203.23.164:41509] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:51.519915 2026] [autoindex:error] [pid 37597:tid 37636] [client 85.203.23.164:41509] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/post-comments-form/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:52.254000 2026] [:error] [pid 37597:tid 37647] [client 85.203.23.164:41509] [client 85.203.23.164] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/template-singl-portfolio.php"] [unique_id "adUt9A6uAY0QAy-8EELrYgAAAE0"]
[Wed Apr 08 00:16:55.925916 2026] [autoindex:error] [pid 37598:tid 37666] [client 85.203.23.132:48651] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:56.015752 2026] [:error] [pid 37598:tid 37678] [client 85.203.23.132:48651] [client 85.203.23.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/themes/about.php"] [unique_id "adUt-O9g7q_cV2WhPazs2wAAAJE"]
[Wed Apr 08 00:16:57.705945 2026] [autoindex:error] [pid 37719:tid 37736] [client 85.203.23.137:55647] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/column/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:58.479563 2026] [autoindex:error] [pid 37719:tid 37741] [client 85.203.23.137:55647] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/post-terms/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:58.574112 2026] [autoindex:error] [pid 37719:tid 37722] [client 85.203.23.137:55647] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:16:58.668173 2026] [autoindex:error] [pid 37719:tid 37725] [client 85.203.23.137:55647] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:02.189863 2026] [autoindex:error] [pid 37719:tid 37734] [client 85.203.23.137:55647] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:04.295024 2026] [:error] [pid 37719:tid 37730] [client 85.203.23.137:55647] [client 85.203.23.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/"] [unique_id "adUuAE09Xv52u2xXGLByHQAAAMg"]
[Wed Apr 08 00:17:07.384343 2026] [autoindex:error] [pid 59804:tid 59819] [client 85.203.23.149:39101] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/pullquote/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:07.478880 2026] [autoindex:error] [pid 59804:tid 59829] [client 85.203.23.149:39101] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyone/template-parts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:08.281370 2026] [autoindex:error] [pid 59804:tid 59830] [client 85.203.23.149:39101] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/social-links/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:09.056439 2026] [autoindex:error] [pid 59804:tid 59808] [client 85.203.23.149:39101] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/navigation-submenu/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:09.156782 2026] [autoindex:error] [pid 59804:tid 59810] [client 85.203.23.149:39101] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/paragraph/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:09.920616 2026] [autoindex:error] [pid 59804:tid 59807] [client 85.203.23.149:39101] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/video/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:11.345853 2026] [autoindex:error] [pid 59804:tid 59811] [client 85.203.23.149:39101] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:11.440306 2026] [autoindex:error] [pid 59804:tid 59823] [client 85.203.23.149:39101] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:17.202965 2026] [autoindex:error] [pid 59804:tid 59825] [client 85.203.23.149:39101] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:17.296566 2026] [autoindex:error] [pid 59804:tid 59826] [client 85.203.23.149:39101] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:17.392000 2026] [:error] [pid 59804:tid 59810] [client 85.203.23.149:39101] [client 85.203.23.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/k.php"] [unique_id "adUuDXYVIXiPh5_eJTkZHgAAAgQ"]
[Wed Apr 08 00:17:18.445270 2026] [autoindex:error] [pid 59804:tid 59817] [client 85.203.23.113:45823] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:18.540655 2026] [autoindex:error] [pid 59804:tid 59816] [client 85.203.23.113:45823] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:19.297088 2026] [autoindex:error] [pid 59804:tid 59822] [client 85.203.23.113:45823] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:19.488359 2026] [autoindex:error] [pid 59804:tid 59824] [client 85.203.23.113:45823] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: http://expressinteriors.com/wp-includes/js/dist
[Wed Apr 08 00:17:19.593995 2026] [autoindex:error] [pid 59804:tid 59830] [client 85.203.23.113:45823] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:22.532485 2026] [:error] [pid 59804:tid 59817] [client 85.203.23.113:45823] [client 85.203.23.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "adUuEnYVIXiPh5_eJTkZNQAAAgs"]
[Wed Apr 08 00:17:24.293222 2026] [:error] [pid 37598:tid 37672] [client 85.203.23.144:37719] [client 85.203.23.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.203.23.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adUuFO9g7q_cV2WhPazs7gAAAIs"]
[Wed Apr 08 00:17:26.425902 2026] [autoindex:error] [pid 37598:tid 37668] [client 85.203.23.144:37719] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:27.859069 2026] [autoindex:error] [pid 37598:tid 37682] [client 85.203.23.144:37719] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:29.343289 2026] [autoindex:error] [pid 37598:tid 37673] [client 85.203.23.144:37719] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentytwo/assets/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:29.442281 2026] [autoindex:error] [pid 37598:tid 37670] [client 85.203.23.144:37719] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/customize-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:29.539051 2026] [autoindex:error] [pid 37598:tid 37666] [client 85.203.23.144:37719] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:29.633302 2026] [autoindex:error] [pid 37598:tid 37678] [client 85.203.23.144:37719] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/audio/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:31.769232 2026] [:error] [pid 37598:tid 37677] [client 85.203.23.144:37719] [client 85.203.23.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/block-bindings/"] [unique_id "adUuG-9g7q_cV2WhPaztAwAAAJA"]
[Wed Apr 08 00:17:34.836771 2026] [autoindex:error] [pid 37596:tid 37627] [client 85.203.23.153:65067] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:39.598190 2026] [:error] [pid 37596:tid 37608] [client 85.203.23.153:65067] [client 85.203.23.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/reception1/includes/tcpdf/examples/config/"] [unique_id "adUuI6paAOZHEjRWjP2zrAAAAAI"]
[Wed Apr 08 00:17:41.285806 2026] [autoindex:error] [pid 37597:tid 37654] [client 85.203.23.120:37731] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:41.382405 2026] [autoindex:error] [pid 37597:tid 37650] [client 85.203.23.120:37731] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:41.476477 2026] [autoindex:error] [pid 37597:tid 37658] [client 85.203.23.120:37731] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/Auth/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:41.678517 2026] [autoindex:error] [pid 37597:tid 37635] [client 85.203.23.120:37731] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/page-list/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:45.929072 2026] [autoindex:error] [pid 37597:tid 37635] [client 85.203.23.120:37731] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:47.386756 2026] [:error] [pid 37597:tid 37638] [client 85.203.23.120:37731] [client 85.203.23.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/"] [unique_id "adUuKw6uAY0QAy-8EELr6wAAAEQ"]
[Wed Apr 08 00:17:47.574858 2026] [autoindex:error] [pid 12948:tid 12963] [client 85.203.23.160:49859] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:47.668581 2026] [autoindex:error] [pid 12948:tid 12959] [client 85.203.23.160:49859] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/commands/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:47.763804 2026] [autoindex:error] [pid 12948:tid 12972] [client 85.203.23.160:49859] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query-title/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:47.858512 2026] [autoindex:error] [pid 12948:tid 12955] [client 85.203.23.160:49859] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/query-pagination/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:47.953567 2026] [autoindex:error] [pid 12948:tid 12965] [client 85.203.23.160:49859] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/separator/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:48.916819 2026] [autoindex:error] [pid 12948:tid 12970] [client 85.203.23.160:49859] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:50.384065 2026] [:error] [pid 12948:tid 12964] [client 85.203.23.160:49859] [client 85.203.23.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/themes.php"] [unique_id "adUuLsbeSPAN8LvMqsbU-gAAAQ0"]
[Wed Apr 08 00:17:50.571825 2026] [autoindex:error] [pid 59551:tid 59553] [client 85.203.23.145:34553] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/freeform/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:50.662481 2026] [:error] [pid 59551:tid 59573] [client 85.203.23.145:34553] [client 85.203.23.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "adUuLl7LN7Ubyqs-sVtLkQAAAZQ"]
[Wed Apr 08 00:17:50.844674 2026] [:error] [pid 37719:tid 37740] [client 85.203.23.144:49931] [client 85.203.23.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/chosen.php"] [unique_id "adUuLk09Xv52u2xXGLBybAAAANI"]
[Wed Apr 08 00:17:51.028854 2026] [:error] [pid 59804:tid 59810] [client 85.203.23.144:43735] [client 85.203.23.144] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/about.php"] [unique_id "adUuL3YVIXiPh5_eJTkZjgAAAgQ"]
[Wed Apr 08 00:17:54.047974 2026] [:error] [pid 59804:tid 59830] [client 85.203.23.141:22847] [client 85.203.23.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "adUuMnYVIXiPh5_eJTkZoQAAAhg"]
[Wed Apr 08 00:17:54.233927 2026] [autoindex:error] [pid 59804:tid 59818] [client 85.203.23.109:41743] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:55.834543 2026] [autoindex:error] [pid 59804:tid 59815] [client 85.203.23.109:41743] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:55.928983 2026] [autoindex:error] [pid 59804:tid 59810] [client 85.203.23.109:41743] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:56.029843 2026] [autoindex:error] [pid 59804:tid 59830] [client 85.203.23.109:41743] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/script-modules/block-library/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:56.124999 2026] [autoindex:error] [pid 59804:tid 59824] [client 85.203.23.109:41743] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/tag-cloud/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:17:56.918468 2026] [:error] [pid 59804:tid 59820] [client 85.203.23.109:41743] [client 85.203.23.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/about.php"] [unique_id "adUuNHYVIXiPh5_eJTkZsQAAAg4"]
[Wed Apr 08 00:17:57.102967 2026] [:error] [pid 37597:tid 37638] [client 85.203.23.129:62553] [client 85.203.23.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "adUuNQ6uAY0QAy-8EELr9wAAAEQ"]
[Wed Apr 08 00:17:57.290618 2026] [autoindex:error] [pid 37596:tid 37616] [client 85.203.23.117:46043] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:18:02.637620 2026] [autoindex:error] [pid 37596:tid 37627] [client 85.203.23.117:46043] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:18:02.728031 2026] [:error] [pid 37596:tid 37609] [client 85.203.23.117:46043] [client 85.203.23.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/template-singl-portfolio.php"] [unique_id "adUuOqpaAOZHEjRWjP2zuQAAAAM"]
[Wed Apr 08 00:18:05.778077 2026] [autoindex:error] [pid 59490:tid 59511] [client 85.203.23.116:64167] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/search/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:18:06.508454 2026] [:error] [pid 59490:tid 59508] [client 85.203.23.116:64167] [client 85.203.23.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "adUuPkcw8OFbiUZ7Rx2EGwAAAVA"]
[Wed Apr 08 00:18:07.530667 2026] [:error] [pid 37596:tid 37614] [client 85.203.23.111:48203] [client 85.203.23.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-conflg.php"] [unique_id "adUuP6paAOZHEjRWjP2zuwAAAAg"]
[Wed Apr 08 00:18:07.714868 2026] [autoindex:error] [pid 59490:tid 59505] [client 85.203.23.108:25073] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:18:09.346068 2026] [:error] [pid 59490:tid 59496] [client 85.203.23.108:25073] [client 85.203.23.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/chosen.php"] [unique_id "adUuQUcw8OFbiUZ7Rx2EHwAAAUQ"]
[Wed Apr 08 00:18:11.084356 2026] [autoindex:error] [pid 59551:tid 59576] [client 85.203.23.158:45651] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/namespaced/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:18:12.556012 2026] [autoindex:error] [pid 59551:tid 59571] [client 85.203.23.158:45651] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/post-content/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:18:14.648799 2026] [:error] [pid 59551:tid 59575] [client 85.203.23.158:45651] [client 85.203.23.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/joker.php"] [unique_id "adUuRl7LN7Ubyqs-sVtLrwAAAZY"]
[Wed Apr 08 00:18:16.989897 2026] [autoindex:error] [pid 37597:tid 37636] [client 85.203.23.136:28305] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/comment-date/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:18:17.081586 2026] [:error] [pid 37597:tid 37637] [client 85.203.23.136:28305] [client 85.203.23.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/joker.php"] [unique_id "adUuSQ6uAY0QAy-8EELsJgAAAEM"]
[Wed Apr 08 00:18:22.740502 2026] [:error] [pid 59804:tid 59813] [client 85.203.23.136:20281] [client 85.203.23.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/miniorange-malware-protection/handler/about.php"] [unique_id "adUuTnYVIXiPh5_eJTkZ9wAAAgc"]
[Wed Apr 08 00:18:24.483053 2026] [:error] [pid 12948:tid 12965] [client 85.203.23.158:51335] [client 85.203.23.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "adUuUMbeSPAN8LvMqsbVEgAAAQ4"]
[Wed Apr 08 00:18:24.663627 2026] [:error] [pid 59804:tid 59817] [client 85.203.23.152:63095] [client 85.203.23.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/mer_gagal.php"] [unique_id "adUuUHYVIXiPh5_eJTkZ-gAAAgs"]
[Wed Apr 08 00:18:27.051753 2026] [:error] [pid 59660:tid 59676] [client 85.203.23.118:25973] [client 85.203.23.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "adUuUzp3-oiX2o5bTswzoQAAAc4"]
[Wed Apr 08 00:18:27.238536 2026] [autoindex:error] [pid 37597:tid 37650] [client 85.203.23.128:39011] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/accordion/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:18:27.336413 2026] [autoindex:error] [pid 37597:tid 37639] [client 85.203.23.128:39011] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/table/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:18:27.432952 2026] [autoindex:error] [pid 37597:tid 37656] [client 85.203.23.128:39011] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentytwo/parts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:18:29.040966 2026] [autoindex:error] [pid 37597:tid 37658] [client 85.203.23.128:39011] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/edit-post/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:18:32.445162 2026] [:error] [pid 37597:tid 37647] [client 85.203.23.128:39011] [client 85.203.23.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-text-cron.php"] [unique_id "adUuWA6uAY0QAy-8EELsSAAAAE0"]
[Wed Apr 08 00:18:33.481685 2026] [autoindex:error] [pid 59660:tid 59673] [client 85.203.23.115:33725] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/buttons/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:18:33.583280 2026] [autoindex:error] [pid 59660:tid 59662] [client 85.203.23.115:33725] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/home-link/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:18:35.210092 2026] [autoindex:error] [pid 59660:tid 59670] [client 85.203.23.115:33725] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/astra/inc/builder/type/base/dynamic-css/button/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:18:35.300155 2026] [:error] [pid 59660:tid 59667] [client 85.203.23.115:33725] [client 85.203.23.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/post-template-path.php"] [unique_id "adUuWzp3-oiX2o5bTswzsAAAAcU"]
[Wed Apr 08 00:18:35.483155 2026] [:error] [pid 37719:tid 37726] [client 85.203.23.164:22781] [client 85.203.23.164] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/plex1.php"] [unique_id "adUuW009Xv52u2xXGLByrAAAAMQ"]
[Wed Apr 08 00:18:36.506466 2026] [autoindex:error] [pid 37597:tid 37656] [client 85.203.23.162:45107] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/post-template/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:18:39.310608 2026] [:error] [pid 37597:tid 37653] [client 85.203.23.162:45107] [client 85.203.23.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/nextpage/wp-cron.php"] [unique_id "adUuXw6uAY0QAy-8EELsWwAAAFM"]
[Wed Apr 08 00:18:42.732308 2026] [:error] [pid 12948:tid 12965] [client 85.203.23.114:59883] [client 85.203.23.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/button/admiin.php"] [unique_id "adUuYsbeSPAN8LvMqsbVHQAAAQ4"]
[Wed Apr 08 00:18:42.918558 2026] [autoindex:error] [pid 37598:tid 37669] [client 85.203.23.114:51979] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/src/Content/Type/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:18:48.902009 2026] [:error] [pid 37598:tid 37661] [client 85.203.23.114:51979] [client 85.203.23.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/themes/load.php"] [unique_id "adUuaO9g7q_cV2WhPaztOwAAAIA"]
[Wed Apr 08 00:18:50.582113 2026] [:error] [pid 59804:tid 59811] [client 85.203.23.122:36171] [client 85.203.23.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/users.php"] [unique_id "adUuanYVIXiPh5_eJTkaRAAAAgU"]
[Wed Apr 08 00:18:54.975046 2026] [autoindex:error] [pid 37598:tid 37671] [client 85.203.23.160:59579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/comments-pagination-next/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:18:55.068940 2026] [autoindex:error] [pid 37598:tid 37680] [client 85.203.23.160:59579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/Exception/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:18:57.347654 2026] [:error] [pid 37597:tid 37637] [client 85.203.23.141:52587] [client 85.203.23.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.23.141, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adUucQ6uAY0QAy-8EELsdAAAAEM"], referer: https://expressinteriors.com/wp-admin/options.php
[Wed Apr 08 00:19:00.741295 2026] [:error] [pid 37598:tid 37685] [client 85.203.23.160:59579] [client 85.203.23.160] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-cron.php"] [unique_id "adUudO9g7q_cV2WhPaztXwAAAJg"]
[Wed Apr 08 00:19:00.927771 2026] [:error] [pid 59551:tid 59566] [client 85.203.23.145:40181] [client 85.203.23.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/api.php"] [unique_id "adUudF7LN7Ubyqs-sVtL1QAAAY0"]
[Wed Apr 08 00:19:01.110165 2026] [:error] [pid 37596:tid 37628] [client 85.203.23.143:20429] [client 85.203.23.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/panel.php"] [unique_id "adUudapaAOZHEjRWjP2zxAAAABY"]
[Wed Apr 08 00:19:02.179698 2026] [:error] [pid 59660:tid 59664] [client 85.203.23.121:24085] [client 85.203.23.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/tx1.php"] [unique_id "adUudjp3-oiX2o5bTswzxgAAAcI"]
[Wed Apr 08 00:19:03.195335 2026] [:error] [pid 37719:tid 37746] [client 85.203.23.144:56045] [client 85.203.23.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/autoload_classmap.php"] [unique_id "adUud009Xv52u2xXGLBy3QAAANg"]
[Wed Apr 08 00:19:03.378378 2026] [:error] [pid 59551:tid 59577] [client 85.203.23.154:35761] [client 85.203.23.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "adUud17LN7Ubyqs-sVtL2AAAAZg"]
[Wed Apr 08 00:19:10.085872 2026] [:error] [pid 37719:tid 37746] [client 85.203.23.118:50531] [client 85.203.23.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-react-refresh.php"] [unique_id "adUufk09Xv52u2xXGLBy7QAAANg"]
[Wed Apr 08 00:19:15.859137 2026] [:error] [pid 59490:tid 59507] [client 85.203.23.117:42853] [client 85.203.23.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/author-template-object.php"] [unique_id "adUug0cw8OFbiUZ7Rx2EUQAAAU8"]
[Wed Apr 08 00:19:16.044626 2026] [:error] [pid 37597:tid 37658] [client 85.203.23.139:21023] [client 85.203.23.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/doc.php"] [unique_id "adUuhA6uAY0QAy-8EELsmgAAAFg"]
[Wed Apr 08 00:19:16.228793 2026] [:error] [pid 37597:tid 37646] [client 85.203.23.113:40235] [client 85.203.23.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/vendor/about.php"] [unique_id "adUuhA6uAY0QAy-8EELsnAAAAEw"]
[Wed Apr 08 00:19:16.446094 2026] [:error] [pid 37597:tid 37657] [client 85.203.23.120:25893] [client 85.203.23.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Exception/177.php"] [unique_id "adUuhA6uAY0QAy-8EELsngAAAFc"]
[Wed Apr 08 00:19:16.637053 2026] [:error] [pid 37719:tid 37743] [client 85.203.23.111:49663] [client 85.203.23.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/site-title-restful.php"] [unique_id "adUuhE09Xv52u2xXGLBy9wAAANU"]
[Wed Apr 08 00:19:16.823252 2026] [:error] [pid 59490:tid 59506] [client 85.203.23.145:25037] [client 85.203.23.145] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.203.23.145, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/fonts/poppins/wp-login.php"] [unique_id "adUuhEcw8OFbiUZ7Rx2EUgAAAU4"]
[Wed Apr 08 00:19:17.691300 2026] [:error] [pid 59490:tid 59497] [client 85.203.23.145:25037] [client 85.203.23.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/namespaced/Core/goods.php"] [unique_id "adUuhUcw8OFbiUZ7Rx2EUwAAAUU"]
[Wed Apr 08 00:19:23.466636 2026] [autoindex:error] [pid 37598:tid 37661] [client 85.203.23.145:31127] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/comment-reply-link/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:19:23.566034 2026] [autoindex:error] [pid 37598:tid 37667] [client 85.203.23.145:31127] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/pattern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:19:23.663440 2026] [autoindex:error] [pid 37598:tid 37674] [client 85.203.23.145:31127] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/comments-pagination-numbers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:19:23.758010 2026] [autoindex:error] [pid 37598:tid 37663] [client 85.203.23.145:31127] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/script-modules/block-library/navigation/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:19:23.852705 2026] [autoindex:error] [pid 37598:tid 37671] [client 85.203.23.145:31127] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/lightgray/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:19:24.615732 2026] [autoindex:error] [pid 37598:tid 37685] [client 85.203.23.145:31127] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/legacy-widget/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:19:25.955166 2026] [:error] [pid 37598:tid 37671] [client 85.203.23.145:31127] [client 85.203.23.145] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "adUuje9g7q_cV2WhPaztoQAAAIo"], referer: http://expressinteriors.com/wp-includes/customize/wp-conflg.php?p=
[Wed Apr 08 00:19:26.142691 2026] [autoindex:error] [pid 37597:tid 37649] [client 85.203.23.153:56579] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 00:19:30.597957 2026] [:error] [pid 37597:tid 37639] [client 85.203.23.153:56579] [client 85.203.23.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\/lib\\\\/php\\\\/connector\\\\.minimal\\\\.php$" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/27_Apps_WPPlugin.conf"] [line "6778"] [id "234930"] [rev "2"] [msg "COMODO WAF: File upload vulnerability in the file manager plugin before 6.9 for WordPress (CVE-2020-25213)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WPPlugin"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"] [unique_id "adUukg6uAY0QAy-8EELswgAAAEU"]
[Wed Apr 08 00:19:31.987352 2026] [proxy_fcgi:error] [pid 37597:tid 37651] [client 85.203.23.153:56579] AH01071: Got error 'PHP message: PHP Warning:  Use of undefined constant ABSPATH - assumed 'ABSPATH' (this will throw an Error in a future version of PHP) in /home/expressi/public_html/wp-settings.php on line 34PHP message: PHP Warning:  require(ABSPATHwp-includes/version.php): failed to open stream: No such file or directory in /home/expressi/public_html/wp-settings.php on line 34PHP message: PHP Warning:  require(ABSPATHwp-includes/version.php): failed to open stream: No such file or directory in /home/expressi/public_html/wp-settings.php on line 34PHP message: PHP Fatal error:  require(): Failed opening required 'ABSPATHwp-includes/version.php' (include_path='.:') in /home/expressi/public_html/wp-settings.php on line 34'
[Wed Apr 08 00:19:39.349585 2026] [:error] [pid 37596:tid 37619] [client 85.203.23.153:58107] [client 85.203.23.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/latest-posts.php"] [unique_id "adUum6paAOZHEjRWjP2z2wAAAA0"]
[Wed Apr 08 00:19:44.543289 2026] [:error] [pid 59804:tid 59813] [client 85.203.23.121:41239] [client 85.203.23.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/search.php"] [unique_id "adUuoHYVIXiPh5_eJTkaoAAAAgc"]
[Wed Apr 08 00:19:44.752472 2026] [:error] [pid 37597:tid 37652] [client 85.203.23.130:35757] [client 85.203.23.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-comments.php"] [unique_id "adUuoA6uAY0QAy-8EELs2QAAAFI"]
[Wed Apr 08 00:19:52.442137 2026] [:error] [pid 59804:tid 59827] [client 85.203.23.108:62381] [client 85.203.23.108] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/templates/[template]/error.php"] [unique_id "adUuqHYVIXiPh5_eJTkatwAAAhU"]
[Wed Apr 08 00:20:00.126426 2026] [:error] [pid 59660:tid 59683] [client 85.203.23.122:23041] [client 85.203.23.122] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin/controller/common/filemanager/core.php"] [unique_id "adUusDp3-oiX2o5bTswz5AAAAdU"]
[Wed Apr 08 01:28:36.316640 2026] [:error] [pid 5337:tid 5373] [client 142.93.249.103:54874] [client 142.93.249.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "adU-xCboIFdw6tlcN13Y_QAAAQ8"]
[Wed Apr 08 01:28:37.614339 2026] [:error] [pid 4840:tid 5174] [client 142.93.249.103:34710] [client 142.93.249.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "adU-xRsUwg2fEe9p9LS_TwAAAA4"]
[Wed Apr 08 01:43:28.823646 2026] [:error] [pid 5337:tid 5359] [client 74.7.242.2:43416] [client 74.7.242.2] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.7.242.2, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adVCQCboIFdw6tlcN13j1wAAAQE"], referer: https://expressinteriors.com/
[Wed Apr 08 01:47:29.241091 2026] [:error] [pid 5246:tid 5250] [client 162.144.3.190:51510] [client 162.144.3.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.144.3.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adVDMRLpySxaVC8kLEZuDQAAAMA"]
[Wed Apr 08 01:47:30.149075 2026] [:error] [pid 5246:tid 5251] [client 162.144.3.190:51510] [client 162.144.3.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.144.3.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adVDMhLpySxaVC8kLEZuEQAAAME"], referer: https://expressinteriors.com/wp-login.php
[Wed Apr 08 03:05:55.298960 2026] [:error] [pid 5337:tid 5371] [client 14.215.163.132:57564] [client 14.215.163.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adVVkyboIFdw6tlcN111kQAAAQ0"]
[Wed Apr 08 03:53:48.414677 2026] [:error] [pid 16644:tid 16713] [client 177.39.126.215:36136] [client 177.39.126.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.39.126.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adVgzFirUNcjkEgFsakA3gAAAIU"]
[Wed Apr 08 04:30:12.425697 2026] [:error] [pid 47732:tid 47746] [client 177.39.126.215:32638] [client 177.39.126.215] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adVpVIm4N5QW9Mh7G10JQAAAAMw"]
[Wed Apr 08 04:31:15.530836 2026] [:error] [pid 16630:tid 16647] [client 177.39.126.215:32296] [client 177.39.126.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.39.126.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adVpkyjfVAkPG-jgJEpNuQAAAQ8"]
[Wed Apr 08 04:32:14.780559 2026] [:error] [pid 16630:tid 16637] [client 177.39.126.215:32740] [client 177.39.126.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.39.126.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adVpzijfVAkPG-jgJEpO_gAAAQU"]
[Wed Apr 08 04:33:07.498172 2026] [:error] [pid 47626:tid 47673] [client 177.39.126.215:34201] [client 177.39.126.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.39.126.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adVqA6jWI8TWtHx2sdbl8wAAAEU"]
[Wed Apr 08 04:34:16.891815 2026] [:error] [pid 47626:tid 47677] [client 177.39.126.215:36165] [client 177.39.126.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.39.126.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adVqSKjWI8TWtHx2sdbmbQAAAEk"]
[Wed Apr 08 04:44:21.171621 2026] [:error] [pid 47627:tid 47705] [client 137.220.224.39:23059] [client 137.220.224.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adVspXOljf1Quv_kDjl6uAAAAIY"]
[Wed Apr 08 04:44:26.839860 2026] [:error] [pid 47732:tid 47743] [client 137.220.224.39:62127] [client 137.220.224.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 137.220.224.39, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adVsqom4N5QW9Mh7G10WsQAAAMk"]
[Wed Apr 08 04:44:26.842049 2026] [:error] [pid 47732:tid 47743] [client 137.220.224.39:62127] [client 137.220.224.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adVsqom4N5QW9Mh7G10WsQAAAMk"]
[Wed Apr 08 07:03:11.571954 2026] [:error] [pid 16630:tid 16647] [client 158.94.209.109:24732] [client 158.94.209.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "adWNLyjfVAkPG-jgJErlSgAAAQ8"]
[Wed Apr 08 07:53:53.922556 2026] [ssl:error] [pid 47625:tid 47652] [client 35.81.83.92:60702] AH02032: Hostname cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup
[Wed Apr 08 09:25:28.996268 2026] [:error] [pid 47627:tid 47719] [client 103.168.67.159:48256] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adWuiHOljf1Quv_kDjn0QAAAAJQ"]
[Wed Apr 08 09:25:29.706501 2026] [:error] [pid 47732:tid 47756] [client 103.168.67.159:48726] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adWuiYm4N5QW9Mh7G127wgAAANY"]
[Wed Apr 08 09:25:30.444251 2026] [:error] [pid 47626:tid 47674] [client 103.168.67.159:49176] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adWuiqjWI8TWtHx2sdZJ7wAAAEY"]
[Wed Apr 08 09:25:31.145053 2026] [:error] [pid 49984:tid 49997] [client 103.168.67.159:49602] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adWui-YY_Bz5lRHcJIE-SgAAAUc"]
[Wed Apr 08 09:25:31.849451 2026] [:error] [pid 47626:tid 47677] [client 103.168.67.159:2016] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dashboard"] [unique_id "adWui6jWI8TWtHx2sdZKAAAAAEk"]
[Wed Apr 08 09:25:32.559418 2026] [:error] [pid 49984:tid 50003] [client 103.168.67.159:2500] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dashboard"] [unique_id "adWujOYY_Bz5lRHcJIE-VgAAAU0"]
[Wed Apr 08 09:25:33.284252 2026] [:error] [pid 16630:tid 16653] [client 103.168.67.159:3050] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dashboard"] [unique_id "adWujSjfVAkPG-jgJEpQ9gAAARU"]
[Wed Apr 08 09:25:34.014347 2026] [:error] [pid 47626:tid 47684] [client 103.168.67.159:3532] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dashboard"] [unique_id "adWujqjWI8TWtHx2sdZKMgAAAFA"]
[Wed Apr 08 09:26:01.026616 2026] [ssl:error] [pid 47625:tid 47635] [client 44.228.129.119:59252] AH02032: Hostname www.cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup
[Wed Apr 08 09:44:39.575644 2026] [:error] [pid 49984:tid 50010] [client 43.153.119.119:59142] [client 43.153.119.119] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adWzB-YY_Bz5lRHcJIFB5wAAAVQ"]
[Wed Apr 08 09:59:14.272384 2026] [:error] [pid 47625:tid 47652] [client 159.89.204.46:59668] [client 159.89.204.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/speculative8.php"] [unique_id "adW2ciVuHyNWzZlE8PBSyAAAABI"]
[Wed Apr 08 09:59:14.452045 2026] [:error] [pid 49984:tid 50010] [client 159.89.204.46:59989] [client 159.89.204.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "adW2cuYY_Bz5lRHcJIFEJQAAAVQ"]
[Wed Apr 08 09:59:15.926088 2026] [:error] [pid 47626:tid 47690] [client 159.89.204.46:62225] [client 159.89.204.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/speculative8.php"] [unique_id "adW2c6jWI8TWtHx2sdZQrAAAAFY"]
[Wed Apr 08 09:59:16.342997 2026] [:error] [pid 47627:tid 47699] [client 159.89.204.46:62804] [client 159.89.204.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "adW2dHOljf1Quv_kDjkIFQAAAIA"]
[Wed Apr 08 15:27:34.403834 2026] [:error] [pid 12490:tid 12494] [client 122.162.148.248:6351] [client 122.162.148.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.162.148.248, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adYDZm1Fea4F4fbumr0IqAAAAMI"], referer: https://expressinteriors.com/
[Wed Apr 08 16:22:25.166219 2026] [:error] [pid 12490:tid 12501] [client 43.153.123.4:42800] [client 43.153.123.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adYQQW1Fea4F4fbumr1GEAAAAMk"]
[Wed Apr 08 17:34:12.495936 2026] [:error] [pid 12490:tid 12512] [client 210.172.223.66:45516] [client 210.172.223.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 210.172.223.66, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adYhFG1Fea4F4fbumr2QJgAAANQ"]
[Wed Apr 08 17:34:13.947083 2026] [:error] [pid 12490:tid 12513] [client 210.172.223.66:45516] [client 210.172.223.66] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 210.172.223.66, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adYhFW1Fea4F4fbumr2QLQAAANU"], referer: https://expressinteriors.com/wp-login.php
[Wed Apr 08 17:43:53.941513 2026] [:error] [pid 12453:tid 12460] [client 141.94.245.112:45974] [client 141.94.245.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.94.245.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adYjWRjtW7S6XsLPvrS3kQAAAIU"]
[Wed Apr 08 17:43:54.859587 2026] [:error] [pid 12453:tid 12467] [client 141.94.245.112:45974] [client 141.94.245.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.94.245.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adYjWhjtW7S6XsLPvrS3mwAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Wed Apr 08 19:06:26.171112 2026] [:error] [pid 64066:tid 64074] [client 43.156.156.96:59948] [client 43.156.156.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adY2slR3WucJgr2vZGYjKAAAAUU"]
[Wed Apr 08 20:52:23.300127 2026] [:error] [pid 7189:tid 7206] [client 43.173.1.57:38588] [client 43.173.1.57] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adZPhxaBqhBSu0L37lrTngAAAc8"]
[Wed Apr 08 22:37:17.932340 2026] [:error] [pid 64066:tid 64082] [client 196.43.154.23:64933] [client 196.43.154.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.43.154.23, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adZoHVR3WucJgr2vZGZxVAAAAU0"]
[Wed Apr 08 22:41:38.977094 2026] [:error] [pid 12490:tid 12512] [client 196.43.154.23:65509] [client 196.43.154.23] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adZpIm1Fea4F4fbumr0qxwAAANQ"]
[Wed Apr 08 22:43:08.069993 2026] [:error] [pid 7047:tid 7064] [client 196.43.154.23:49497] [client 196.43.154.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.43.154.23, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adZpfONh3oGO3pKiCzxEaAAAAY8"]
[Wed Apr 08 22:44:30.436744 2026] [:error] [pid 64066:tid 64089] [client 196.43.154.23:49786] [client 196.43.154.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.43.154.23, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adZpzlR3WucJgr2vZGZ2jQAAAVQ"]
[Wed Apr 08 22:45:51.940353 2026] [:error] [pid 7189:tid 7193] [client 196.43.154.23:59861] [client 196.43.154.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.43.154.23, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adZqHxaBqhBSu0L37lrz0AAAAcI"]
[Wed Apr 08 22:47:13.607508 2026] [:error] [pid 12490:tid 12513] [client 196.43.154.23:49411] [client 196.43.154.23] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.43.154.23, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adZqcW1Fea4F4fbumr0tFQAAANU"]
[Wed Apr 08 23:25:49.568249 2026] [:error] [pid 7047:tid 7061] [client 170.106.143.6:34760] [client 170.106.143.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adZzfeNh3oGO3pKiCzxPqAAAAYw"]
[Thu Apr 09 00:07:59.989519 2026] [:error] [pid 12453:tid 12458] [client 45.92.1.25:60464] [client 45.92.1.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "adZ9XxjtW7S6XsLPvrR65wAAAIM"]
[Thu Apr 09 00:08:00.872043 2026] [:error] [pid 64066:tid 64075] [client 45.92.1.25:55870] [client 45.92.1.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "adZ9YFR3WucJgr2vZGa6cQAAAUY"]
[Thu Apr 09 00:08:01.511177 2026] [:error] [pid 64066:tid 64083] [client 45.92.1.25:58428] [client 45.92.1.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "adZ9YVR3WucJgr2vZGa6dwAAAU4"]
[Thu Apr 09 00:08:03.847996 2026] [:error] [pid 12490:tid 12512] [client 45.92.1.25:59582] [client 45.92.1.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "adZ9Y21Fea4F4fbumr1dTQAAANQ"]
[Thu Apr 09 01:18:42.860422 2026] [:error] [pid 40055:tid 40141] [client 124.156.179.141:45862] [client 124.156.179.141] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adaN8n_5SjAJycOw5k-9fAAAAIs"]
[Thu Apr 09 04:14:45.794653 2026] [:error] [pid 22627:tid 22630] [client 111.172.249.49:55513] [client 111.172.249.49] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ada3Nfr8glsF_jKQpr6r5wAAAQA"]
[Thu Apr 09 05:01:53.420925 2026] [:error] [pid 20641:tid 20650] [client 43.153.204.189:59174] [client 43.153.204.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adbCQW3LksBSF-6rlkZXZAAAAMU"]
[Thu Apr 09 07:04:11.444294 2026] [:error] [pid 20537:tid 20604] [client 20.63.32.44:56113] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxcs.php"] [unique_id "adbe68STjpSeyrxLmN4q6gAAAIY"]
[Thu Apr 09 07:04:11.869564 2026] [:error] [pid 20535:tid 20561] [client 20.63.32.44:3902] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxcs.php"] [unique_id "adbe6wWiD9hWnEUHWdNMkQAAABE"]
[Thu Apr 09 07:04:12.300796 2026] [:error] [pid 20641:tid 20652] [client 20.63.32.44:56080] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxcs.php"] [unique_id "adbe7G3LksBSF-6rlkaKBAAAAMc"]
[Thu Apr 09 07:04:12.720562 2026] [:error] [pid 20535:tid 20558] [client 20.63.32.44:56134] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxcs.php"] [unique_id "adbe7AWiD9hWnEUHWdNMlwAAAA4"]
[Thu Apr 09 07:04:13.152159 2026] [:error] [pid 20537:tid 20615] [client 20.63.32.44:56135] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/btx25.php"] [unique_id "adbe7cSTjpSeyrxLmN4q6wAAAJE"]
[Thu Apr 09 07:04:13.563299 2026] [:error] [pid 22627:tid 22631] [client 20.63.32.44:3871] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/btx25.php"] [unique_id "adbe7fr8glsF_jKQpr48BgAAAQE"]
[Thu Apr 09 07:04:13.985796 2026] [:error] [pid 22627:tid 22633] [client 20.63.32.44:3865] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/btx25.php"] [unique_id "adbe7fr8glsF_jKQpr48CAAAAQM"]
[Thu Apr 09 07:04:14.396953 2026] [:error] [pid 20537:tid 20606] [client 20.63.32.44:56109] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/btx25.php"] [unique_id "adbe7sSTjpSeyrxLmN4q7wAAAIg"]
[Thu Apr 09 07:04:14.809299 2026] [:error] [pid 20641:tid 20668] [client 20.63.32.44:56074] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ca-022.php"] [unique_id "adbe7m3LksBSF-6rlkaKCwAAANc"]
[Thu Apr 09 07:04:15.223438 2026] [:error] [pid 20536:tid 20577] [client 20.63.32.44:56144] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ca-022.php"] [unique_id "adbe78PqyUJM1s3YpIY2gAAAAEY"]
[Thu Apr 09 07:04:15.633834 2026] [:error] [pid 20535:tid 20559] [client 20.63.32.44:56126] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ca-022.php"] [unique_id "adbe7wWiD9hWnEUHWdNMpwAAAA8"]
[Thu Apr 09 07:04:16.049876 2026] [:error] [pid 20535:tid 20565] [client 20.63.32.44:56142] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ca-022.php"] [unique_id "adbe8AWiD9hWnEUHWdNMqwAAABU"]
[Thu Apr 09 07:04:16.460016 2026] [:error] [pid 20537:tid 20621] [client 20.63.32.44:3849] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rnenu.php"] [unique_id "adbe8MSTjpSeyrxLmN4q8gAAAJc"]
[Thu Apr 09 07:04:16.871627 2026] [:error] [pid 20536:tid 20591] [client 20.63.32.44:3901] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rnenu.php"] [unique_id "adbe8MPqyUJM1s3YpIY2gwAAAFQ"]
[Thu Apr 09 07:04:17.282493 2026] [:error] [pid 22627:tid 22632] [client 20.63.32.44:3870] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rnenu.php"] [unique_id "adbe8fr8glsF_jKQpr48DQAAAQI"]
[Thu Apr 09 07:04:17.700838 2026] [:error] [pid 22627:tid 22651] [client 20.63.32.44:56153] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rnenu.php"] [unique_id "adbe8fr8glsF_jKQpr48EgAAARU"]
[Thu Apr 09 07:04:18.113914 2026] [:error] [pid 22627:tid 22640] [client 20.63.32.44:56156] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fallbackapi.php"] [unique_id "adbe8vr8glsF_jKQpr48EwAAAQo"]
[Thu Apr 09 07:04:18.550176 2026] [:error] [pid 22627:tid 22639] [client 20.63.32.44:56179] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fallbackapi.php"] [unique_id "adbe8vr8glsF_jKQpr48GAAAAQk"]
[Thu Apr 09 07:04:18.961678 2026] [:error] [pid 20536:tid 20572] [client 20.63.32.44:60363] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fallbackapi.php"] [unique_id "adbe8sPqyUJM1s3YpIY2hAAAAEE"]
[Thu Apr 09 07:04:19.383586 2026] [:error] [pid 20537:tid 20607] [client 20.63.32.44:56072] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fallbackapi.php"] [unique_id "adbe88STjpSeyrxLmN4q-AAAAIk"]
[Thu Apr 09 07:05:56.992518 2026] [:error] [pid 20641:tid 20666] [client 20.63.32.44:7449] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fallbackapi.php"] [unique_id "adbfVG3LksBSF-6rlkaLCgAAANU"]
[Thu Apr 09 07:05:57.405102 2026] [:error] [pid 20535:tid 20550] [client 20.63.32.44:7428] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fallbackapi.php"] [unique_id "adbfVQWiD9hWnEUHWdNOSwAAAAY"]
[Thu Apr 09 07:05:57.818958 2026] [:error] [pid 20535:tid 20544] [client 20.63.32.44:7474] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fallbackapi.php"] [unique_id "adbfVQWiD9hWnEUHWdNOUAAAAAA"]
[Thu Apr 09 07:05:58.229904 2026] [:error] [pid 20535:tid 20547] [client 20.63.32.44:7467] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fallbackapi.php"] [unique_id "adbfVgWiD9hWnEUHWdNOUwAAAAM"]
[Thu Apr 09 07:15:05.725523 2026] [:error] [pid 20537:tid 20603] [client 216.45.61.243:58544] [client 216.45.61.243] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adbhecSTjpSeyrxLmN4vAQAAAIU"], referer: https://www.google.com
[Thu Apr 09 07:17:49.340772 2026] [:error] [pid 22627:tid 22635] [client 43.130.47.33:40868] [client 43.130.47.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adbiHfr8glsF_jKQpr5IRQAAAQU"]
[Thu Apr 09 07:55:35.135191 2026] [:error] [pid 20537:tid 20618] [client 20.220.57.112:27800] [client 20.220.57.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxcs.php"] [unique_id "adbq98STjpSeyrxLmN48zgAAAJQ"]
[Thu Apr 09 07:55:35.557948 2026] [:error] [pid 20535:tid 20546] [client 20.220.57.112:27830] [client 20.220.57.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxcs.php"] [unique_id "adbq9wWiD9hWnEUHWdNuSwAAAAI"]
[Thu Apr 09 07:55:35.996159 2026] [:error] [pid 20535:tid 20547] [client 20.220.57.112:27723] [client 20.220.57.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxcs.php"] [unique_id "adbq9wWiD9hWnEUHWdNuUQAAAAM"]
[Thu Apr 09 07:55:36.436412 2026] [:error] [pid 20535:tid 20557] [client 20.220.57.112:27778] [client 20.220.57.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxcs.php"] [unique_id "adbq-AWiD9hWnEUHWdNuVAAAAA0"]
[Thu Apr 09 07:55:36.846392 2026] [:error] [pid 20535:tid 20545] [client 20.220.57.112:27811] [client 20.220.57.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/btx25.php"] [unique_id "adbq-AWiD9hWnEUHWdNuVgAAAAE"]
[Thu Apr 09 07:55:37.265157 2026] [:error] [pid 22627:tid 22634] [client 20.220.57.112:27823] [client 20.220.57.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/btx25.php"] [unique_id "adbq-fr8glsF_jKQpr5lzwAAAQQ"]
[Thu Apr 09 07:55:37.695941 2026] [:error] [pid 20535:tid 20559] [client 20.220.57.112:27739] [client 20.220.57.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fallbackapi.php"] [unique_id "adbq-QWiD9hWnEUHWdNuXgAAAA8"]
[Thu Apr 09 07:55:38.107063 2026] [:error] [pid 22627:tid 22630] [client 20.220.57.112:27795] [client 20.220.57.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fallbackapi.php"] [unique_id "adbq-vr8glsF_jKQpr5l1QAAAQA"]
[Thu Apr 09 07:55:38.561403 2026] [:error] [pid 20535:tid 20565] [client 20.220.57.112:27780] [client 20.220.57.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fallbackapi.php"] [unique_id "adbq-gWiD9hWnEUHWdNuYwAAABU"]
[Thu Apr 09 07:55:38.978287 2026] [:error] [pid 22627:tid 22650] [client 20.220.57.112:27789] [client 20.220.57.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fallbackapi.php"] [unique_id "adbq-vr8glsF_jKQpr5l2QAAARQ"]
[Thu Apr 09 12:56:32.160758 2026] [:error] [pid 24927:tid 24952] [client 43.166.136.24:58332] [client 43.166.136.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adcxgDXObuzEuw8mNJtJkQAAARY"]
[Thu Apr 09 16:39:47.738500 2026] [:error] [pid 24624:tid 24633] [client 180.110.203.108:54898] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "addl0-4Jn-WvK1ZBTvicvQAAAMc"]
[Thu Apr 09 17:06:35.870143 2026] [:error] [pid 24515:tid 24540] [client 20.240.63.86:5145] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "addsG61OMnvM2fMnB1NfRAAAABU"]
[Thu Apr 09 17:06:40.928637 2026] [:error] [pid 24927:tid 24939] [client 20.240.63.86:20122] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "addsIDXObuzEuw8mNJu_vgAAAQk"]
[Thu Apr 09 17:06:42.743613 2026] [:error] [pid 18477:tid 18503] [client 20.240.63.86:19697] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "addsIsDe826HlFeoLPJUkwAAAVg"]
[Thu Apr 09 17:50:27.727722 2026] [:error] [pid 24516:tid 24555] [client 5.155.12.33:17899] [client 5.155.12.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.155.12.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "add2Y9hW7vSS-UkeWCUZkQAAAEg"]
[Thu Apr 09 20:54:30.899845 2026] [:error] [pid 24927:tid 24938] [client 43.159.132.207:49844] [client 43.159.132.207] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adehhjXObuzEuw8mNJsimQAAAQg"]
[Thu Apr 09 22:47:04.050858 2026] [:error] [pid 24624:tid 24642] [client 4.232.89.114:51312] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cxx.php"] [unique_id "ade76O4Jn-WvK1ZBTvjz0QAAANA"]
[Thu Apr 09 22:47:04.520934 2026] [:error] [pid 24517:tid 24589] [client 4.232.89.114:34242] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cxx.php"] [unique_id "ade76HboYEn2ZFM_PS-JdgAAAI8"]
[Thu Apr 09 22:47:05.000591 2026] [:error] [pid 20837:tid 20863] [client 4.232.89.114:49634] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cxx.php"] [unique_id "ade76fSL71FHZkjrGzMOYwAAAZg"]
[Thu Apr 09 22:47:05.484862 2026] [:error] [pid 63331:tid 63355] [client 4.232.89.114:49641] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cxx.php"] [unique_id "ade76SbKfIYuVjWbE4WXnAAAAdY"]
[Thu Apr 09 22:47:05.959207 2026] [:error] [pid 24927:tid 24954] [client 4.232.89.114:49633] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/water.php"] [unique_id "ade76TXObuzEuw8mNJs1pQAAARg"]
[Thu Apr 09 22:47:06.430487 2026] [:error] [pid 24624:tid 24632] [client 4.232.89.114:55856] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/water.php"] [unique_id "ade76u4Jn-WvK1ZBTvjz0wAAAMY"]
[Thu Apr 09 22:47:06.897029 2026] [:error] [pid 20837:tid 20850] [client 4.232.89.114:34253] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/water.php"] [unique_id "ade76vSL71FHZkjrGzMOZgAAAYs"]
[Thu Apr 09 22:47:07.429338 2026] [:error] [pid 20837:tid 20859] [client 4.232.89.114:51265] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/water.php"] [unique_id "ade76_SL71FHZkjrGzMOZwAAAZQ"]
[Thu Apr 09 22:47:07.904285 2026] [:error] [pid 63331:tid 63341] [client 4.232.89.114:51310] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "ade76ybKfIYuVjWbE4WXoQAAAcg"]
[Thu Apr 09 22:47:08.383094 2026] [:error] [pid 24515:tid 24528] [client 4.232.89.114:51317] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "ade77K1OMnvM2fMnB1PsLAAAAAk"]
[Thu Apr 09 22:47:08.857023 2026] [:error] [pid 24624:tid 24627] [client 4.232.89.114:49645] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "ade77O4Jn-WvK1ZBTvjz2QAAAME"]
[Thu Apr 09 22:47:09.407532 2026] [:error] [pid 24515:tid 24527] [client 4.232.89.114:51320] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "ade77a1OMnvM2fMnB1PsLgAAAAg"]
[Thu Apr 09 22:47:09.895825 2026] [:error] [pid 24624:tid 24635] [client 4.232.89.114:51306] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggb.php"] [unique_id "ade77e4Jn-WvK1ZBTvjz3AAAAMk"]
[Thu Apr 09 22:47:10.388332 2026] [:error] [pid 63331:tid 63334] [client 4.232.89.114:49616] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggb.php"] [unique_id "ade77ibKfIYuVjWbE4WXrwAAAcE"]
[Thu Apr 09 22:47:10.880346 2026] [:error] [pid 24517:tid 24582] [client 4.232.89.114:51287] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggb.php"] [unique_id "ade77nboYEn2ZFM_PS-JegAAAIg"]
[Thu Apr 09 22:47:11.358152 2026] [:error] [pid 24517:tid 24579] [client 4.232.89.114:51303] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggb.php"] [unique_id "ade773boYEn2ZFM_PS-JfAAAAIU"]
[Thu Apr 09 22:47:11.841816 2026] [:error] [pid 24516:tid 24558] [client 4.232.89.114:55832] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "ade779hW7vSS-UkeWCU-KQAAAEs"]
[Thu Apr 09 22:47:12.344962 2026] [:error] [pid 24515:tid 24529] [client 4.232.89.114:49638] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "ade78K1OMnvM2fMnB1PsOAAAAAo"]
[Thu Apr 09 22:47:12.818217 2026] [:error] [pid 24515:tid 24528] [client 4.232.89.114:49648] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "ade78K1OMnvM2fMnB1PsPAAAAAk"]
[Thu Apr 09 22:47:13.296282 2026] [:error] [pid 24517:tid 24577] [client 4.232.89.114:3175] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "ade78XboYEn2ZFM_PS-JfgAAAIM"]
[Thu Apr 09 22:47:13.790714 2026] [:error] [pid 24515:tid 24527] [client 4.232.89.114:49624] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wert.php"] [unique_id "ade78a1OMnvM2fMnB1PsRQAAAAg"]
[Thu Apr 09 22:47:14.278593 2026] [:error] [pid 24624:tid 24646] [client 4.232.89.114:34257] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wert.php"] [unique_id "ade78u4Jn-WvK1ZBTvjz3wAAANQ"]
[Thu Apr 09 22:47:14.754486 2026] [:error] [pid 24515:tid 24523] [client 4.232.89.114:49655] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wert.php"] [unique_id "ade78q1OMnvM2fMnB1PsTgAAAAQ"]
[Thu Apr 09 22:47:15.259902 2026] [:error] [pid 24515:tid 24538] [client 4.232.89.114:34243] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wert.php"] [unique_id "ade7861OMnvM2fMnB1PsVgAAABM"]
[Thu Apr 09 22:47:15.728581 2026] [:error] [pid 24517:tid 24588] [client 4.232.89.114:49617] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "ade783boYEn2ZFM_PS-JgQAAAI4"]
[Thu Apr 09 22:47:16.236778 2026] [:error] [pid 63331:tid 63354] [client 4.232.89.114:51293] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "ade79CbKfIYuVjWbE4WXtAAAAdU"]
[Thu Apr 09 22:47:16.717915 2026] [:error] [pid 24927:tid 24946] [client 4.232.89.114:51292] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "ade79DXObuzEuw8mNJs1sAAAARA"]
[Thu Apr 09 22:47:17.192600 2026] [:error] [pid 24624:tid 24626] [client 4.232.89.114:51281] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "ade79e4Jn-WvK1ZBTvjz4gAAAMA"]
[Thu Apr 09 22:47:17.711575 2026] [:error] [pid 24515:tid 24523] [client 4.232.89.114:34270] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "ade79a1OMnvM2fMnB1PsYAAAAAQ"]
[Thu Apr 09 22:47:18.190511 2026] [:error] [pid 20837:tid 20847] [client 4.232.89.114:49603] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "ade79vSL71FHZkjrGzMOdwAAAYg"]
[Thu Apr 09 22:47:18.664341 2026] [:error] [pid 18477:tid 18482] [client 4.232.89.114:51324] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "ade79sDe826HlFeoLPKr2AAAAUM"]
[Thu Apr 09 22:47:19.145376 2026] [:error] [pid 24515:tid 24524] [client 4.232.89.114:55818] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "ade7961OMnvM2fMnB1PsaQAAAAU"]
[Thu Apr 09 22:47:19.620522 2026] [:error] [pid 24515:tid 24534] [client 4.232.89.114:55813] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oij98gy.php"] [unique_id "ade7961OMnvM2fMnB1PsbQAAAA8"]
[Thu Apr 09 22:47:20.090935 2026] [:error] [pid 24515:tid 24528] [client 4.232.89.114:49650] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oij98gy.php"] [unique_id "ade7-K1OMnvM2fMnB1PsdAAAAAk"]
[Thu Apr 09 22:47:20.586384 2026] [:error] [pid 24515:tid 24540] [client 4.232.89.114:32290] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oij98gy.php"] [unique_id "ade7-K1OMnvM2fMnB1PsewAAABU"]
[Thu Apr 09 22:47:21.060847 2026] [:error] [pid 63331:tid 63343] [client 4.232.89.114:51294] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oij98gy.php"] [unique_id "ade7-SbKfIYuVjWbE4WXvAAAAco"]
[Thu Apr 09 22:47:21.579601 2026] [:error] [pid 24515:tid 24526] [client 4.232.89.114:49658] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "ade7-a1OMnvM2fMnB1PsgwAAAAc"]
[Thu Apr 09 22:47:22.076836 2026] [:error] [pid 20837:tid 20850] [client 4.232.89.114:32260] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "ade7-vSL71FHZkjrGzMOeAAAAYs"]
[Thu Apr 09 22:47:22.604904 2026] [:error] [pid 24515:tid 24541] [client 4.232.89.114:55816] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "ade7-q1OMnvM2fMnB1PskQAAABY"]
[Thu Apr 09 22:47:23.113543 2026] [:error] [pid 24517:tid 24578] [client 4.232.89.114:51321] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "ade7-3boYEn2ZFM_PS-JiAAAAIQ"]
[Thu Apr 09 22:47:23.661720 2026] [:error] [pid 24515:tid 24539] [client 4.232.89.114:49622] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/turkshell.php"] [unique_id "ade7-61OMnvM2fMnB1PsmwAAABQ"]
[Thu Apr 09 22:47:24.151277 2026] [:error] [pid 24515:tid 24534] [client 4.232.89.114:49610] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/turkshell.php"] [unique_id "ade7_K1OMnvM2fMnB1PspgAAAA8"]
[Thu Apr 09 22:47:24.651000 2026] [:error] [pid 24515:tid 24529] [client 4.232.89.114:34256] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/turkshell.php"] [unique_id "ade7_K1OMnvM2fMnB1PsqwAAAAo"]
[Thu Apr 09 22:47:25.132682 2026] [:error] [pid 24515:tid 24528] [client 4.232.89.114:51296] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/turkshell.php"] [unique_id "ade7_a1OMnvM2fMnB1PssQAAAAk"]
[Thu Apr 09 22:47:25.627740 2026] [:error] [pid 24517:tid 24582] [client 4.232.89.114:49635] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tea.php"] [unique_id "ade7_XboYEn2ZFM_PS-JigAAAIg"]
[Thu Apr 09 22:47:26.127109 2026] [:error] [pid 24517:tid 24591] [client 4.232.89.114:55869] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tea.php"] [unique_id "ade7_nboYEn2ZFM_PS-JiwAAAJE"]
[Thu Apr 09 22:47:26.613738 2026] [:error] [pid 24515:tid 24524] [client 4.232.89.114:51282] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tea.php"] [unique_id "ade7_q1OMnvM2fMnB1PsxAAAAAU"]
[Thu Apr 09 22:47:27.098028 2026] [:error] [pid 24515:tid 24530] [client 4.232.89.114:49661] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tea.php"] [unique_id "ade7_61OMnvM2fMnB1PsywAAAAs"]
[Thu Apr 09 22:47:27.601282 2026] [:error] [pid 63331:tid 63335] [client 4.232.89.114:49637] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qqa.php"] [unique_id "ade7_ybKfIYuVjWbE4WXwgAAAcI"]
[Thu Apr 09 22:47:28.080599 2026] [:error] [pid 24515:tid 24531] [client 4.232.89.114:51327] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qqa.php"] [unique_id "ade8AK1OMnvM2fMnB1Ps2AAAAAw"]
[Thu Apr 09 22:47:28.587097 2026] [:error] [pid 18477:tid 18479] [client 4.232.89.114:55823] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qqa.php"] [unique_id "ade8AMDe826HlFeoLPKr4AAAAUA"]
[Thu Apr 09 22:47:29.070382 2026] [:error] [pid 63331:tid 63350] [client 4.232.89.114:51286] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qqa.php"] [unique_id "ade8ASbKfIYuVjWbE4WXxgAAAdE"]
[Thu Apr 09 22:47:29.571972 2026] [:error] [pid 18477:tid 18497] [client 4.232.89.114:51304] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/seo.php"] [unique_id "ade8AcDe826HlFeoLPKr6gAAAVI"]
[Thu Apr 09 22:47:30.064612 2026] [:error] [pid 24515:tid 24531] [client 4.232.89.114:34251] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/seo.php"] [unique_id "ade8Aq1OMnvM2fMnB1Ps5wAAAAw"]
[Thu Apr 09 22:47:30.542159 2026] [:error] [pid 24515:tid 24529] [client 4.232.89.114:49618] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/seo.php"] [unique_id "ade8Aq1OMnvM2fMnB1Ps8AAAAAo"]
[Thu Apr 09 22:47:31.020506 2026] [:error] [pid 24515:tid 24540] [client 4.232.89.114:32265] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/seo.php"] [unique_id "ade8A61OMnvM2fMnB1Ps9wAAABU"]
[Thu Apr 09 22:47:31.509027 2026] [:error] [pid 24624:tid 24631] [client 4.232.89.114:55860] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "ade8A-4Jn-WvK1ZBTvjz5QAAAMU"]
[Thu Apr 09 22:47:31.992670 2026] [:error] [pid 63331:tid 63344] [client 4.232.89.114:55848] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "ade8AybKfIYuVjWbE4WXywAAAcs"]
[Thu Apr 09 22:47:32.472450 2026] [:error] [pid 63331:tid 63349] [client 4.232.89.114:49628] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "ade8BCbKfIYuVjWbE4WX0AAAAdA"]
[Thu Apr 09 22:47:32.943574 2026] [:error] [pid 24517:tid 24583] [client 4.232.89.114:34262] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "ade8BHboYEn2ZFM_PS-JjwAAAIk"]
[Thu Apr 09 22:47:33.415050 2026] [:error] [pid 24624:tid 24629] [client 4.232.89.114:49660] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "ade8Be4Jn-WvK1ZBTvjz5wAAAMM"]
[Thu Apr 09 22:47:33.912548 2026] [:error] [pid 24927:tid 24937] [client 4.232.89.114:32309] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "ade8BTXObuzEuw8mNJs1vwAAAQc"]
[Thu Apr 09 22:47:34.381995 2026] [:error] [pid 63331:tid 63340] [client 4.232.89.114:55817] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "ade8BibKfIYuVjWbE4WX1QAAAcc"]
[Thu Apr 09 22:47:34.850386 2026] [:error] [pid 24517:tid 24598] [client 4.232.89.114:49613] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "ade8BnboYEn2ZFM_PS-JkwAAAJg"]
[Thu Apr 09 22:47:35.321526 2026] [:error] [pid 18477:tid 18498] [client 4.232.89.114:49643] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "ade8B8De826HlFeoLPKr_AAAAVM"]
[Thu Apr 09 22:47:35.821204 2026] [:error] [pid 24517:tid 24589] [client 4.232.89.114:49627] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "ade8B3boYEn2ZFM_PS-JlgAAAI8"]
[Thu Apr 09 22:47:36.297148 2026] [:error] [pid 63331:tid 63349] [client 4.232.89.114:51267] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "ade8CCbKfIYuVjWbE4WX3wAAAdA"]
[Thu Apr 09 22:47:36.767965 2026] [:error] [pid 18477:tid 18487] [client 4.232.89.114:55836] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "ade8CMDe826HlFeoLPKsAgAAAUg"]
[Thu Apr 09 22:47:37.250281 2026] [:error] [pid 63331:tid 63334] [client 4.232.89.114:4050] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "ade8CSbKfIYuVjWbE4WX5wAAAcE"]
[Thu Apr 09 22:47:37.741764 2026] [:error] [pid 24927:tid 24932] [client 4.232.89.114:49659] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "ade8CTXObuzEuw8mNJs1wwAAAQI"]
[Thu Apr 09 22:47:38.225884 2026] [:error] [pid 24517:tid 24581] [client 4.232.89.114:32261] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "ade8CnboYEn2ZFM_PS-JmQAAAIc"]
[Thu Apr 09 22:47:38.703788 2026] [:error] [pid 24517:tid 24594] [client 4.232.89.114:32298] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "ade8CnboYEn2ZFM_PS-JmgAAAJQ"]
[Thu Apr 09 22:47:39.179327 2026] [:error] [pid 24517:tid 24582] [client 4.232.89.114:51272] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "ade8C3boYEn2ZFM_PS-JnAAAAIg"]
[Thu Apr 09 22:47:39.658817 2026] [:error] [pid 63331:tid 63341] [client 4.232.89.114:55838] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "ade8CybKfIYuVjWbE4WX9QAAAcg"]
[Thu Apr 09 22:47:40.128900 2026] [:error] [pid 24517:tid 24577] [client 4.232.89.114:55859] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "ade8DHboYEn2ZFM_PS-JoAAAAIM"]
[Thu Apr 09 22:47:40.617405 2026] [:error] [pid 63331:tid 63340] [client 4.232.89.114:32294] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "ade8DCbKfIYuVjWbE4WX_gAAAcc"]
[Thu Apr 09 22:47:41.112942 2026] [:error] [pid 24516:tid 24550] [client 4.232.89.114:34245] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "ade8DdhW7vSS-UkeWCU-TAAAAEM"]
[Thu Apr 09 22:47:41.596697 2026] [:error] [pid 63331:tid 63334] [client 4.232.89.114:3142] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "ade8DSbKfIYuVjWbE4WYDwAAAcE"]
[Thu Apr 09 22:47:42.066991 2026] [:error] [pid 24516:tid 24558] [client 4.232.89.114:32266] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "ade8DthW7vSS-UkeWCU-TQAAAEs"]
[Thu Apr 09 22:47:42.538582 2026] [:error] [pid 18477:tid 18502] [client 4.232.89.114:55810] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "ade8DsDe826HlFeoLPKsDQAAAVc"]
[Thu Apr 09 22:47:43.030570 2026] [:error] [pid 63331:tid 63341] [client 4.232.89.114:34265] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "ade8DybKfIYuVjWbE4WYGwAAAcg"]
[Thu Apr 09 22:47:43.503247 2026] [:error] [pid 24516:tid 24567] [client 4.232.89.114:51283] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "ade8D9hW7vSS-UkeWCU-VQAAAFQ"]
[Thu Apr 09 22:47:43.981127 2026] [:error] [pid 24927:tid 24938] [client 4.232.89.114:34240] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "ade8DzXObuzEuw8mNJs1zQAAAQg"]
[Thu Apr 09 22:47:44.466512 2026] [:error] [pid 24516:tid 24565] [client 4.232.89.114:49611] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "ade8ENhW7vSS-UkeWCU-WQAAAFI"]
[Thu Apr 09 22:47:44.952898 2026] [:error] [pid 24927:tid 24934] [client 4.232.89.114:51299] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "ade8EDXObuzEuw8mNJs10gAAAQQ"]
[Thu Apr 09 22:47:45.477168 2026] [:error] [pid 24624:tid 24645] [client 4.232.89.114:55812] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "ade8Ee4Jn-WvK1ZBTvjz6AAAANM"]
[Thu Apr 09 22:47:45.974486 2026] [:error] [pid 24517:tid 24594] [client 4.232.89.114:34277] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "ade8EXboYEn2ZFM_PS-JrQAAAJQ"]
[Thu Apr 09 22:47:46.450027 2026] [:error] [pid 20837:tid 20839] [client 4.232.89.114:32288] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "ade8EvSL71FHZkjrGzMOiQAAAYA"]
[Thu Apr 09 22:47:46.923212 2026] [:error] [pid 24516:tid 24566] [client 4.232.89.114:51308] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "ade8EthW7vSS-UkeWCU-XgAAAFM"]
[Thu Apr 09 22:47:47.406247 2026] [:error] [pid 20837:tid 20850] [client 4.232.89.114:34276] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "ade8E_SL71FHZkjrGzMOiwAAAYs"]
[Thu Apr 09 22:47:47.878470 2026] [:error] [pid 20837:tid 20841] [client 4.232.89.114:51290] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "ade8E_SL71FHZkjrGzMOjQAAAYI"]
[Thu Apr 09 22:47:48.360781 2026] [:error] [pid 63331:tid 63342] [client 4.232.89.114:34249] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "ade8FCbKfIYuVjWbE4WYOAAAAck"]
[Thu Apr 09 22:47:48.828801 2026] [:error] [pid 24927:tid 24940] [client 4.232.89.114:51276] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "ade8FDXObuzEuw8mNJs14wAAAQo"]
[Thu Apr 09 22:47:49.300163 2026] [:error] [pid 24927:tid 24941] [client 4.232.89.114:3157] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "ade8FTXObuzEuw8mNJs15AAAAQs"]
[Thu Apr 09 22:47:49.783043 2026] [:error] [pid 63331:tid 63346] [client 4.232.89.114:32277] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "ade8FSbKfIYuVjWbE4WYRAAAAc0"]
[Thu Apr 09 22:47:50.301425 2026] [:error] [pid 63331:tid 63340] [client 4.232.89.114:4076] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "ade8FibKfIYuVjWbE4WYSwAAAcc"]
[Thu Apr 09 22:47:50.811493 2026] [:error] [pid 63331:tid 63349] [client 4.232.89.114:49626] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.mopj.php"] [unique_id "ade8FibKfIYuVjWbE4WYTgAAAdA"]
[Thu Apr 09 22:47:51.284646 2026] [:error] [pid 24515:tid 24531] [client 4.232.89.114:34299] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.mopj.php"] [unique_id "ade8F61OMnvM2fMnB1PtMgAAAAw"]
[Thu Apr 09 22:47:51.792316 2026] [:error] [pid 24515:tid 24540] [client 4.232.89.114:34262] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.mopj.php"] [unique_id "ade8F61OMnvM2fMnB1PtMwAAABU"]
[Thu Apr 09 22:47:52.271032 2026] [:error] [pid 63331:tid 63339] [client 4.232.89.114:34252] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.mopj.php"] [unique_id "ade8GCbKfIYuVjWbE4WYVwAAAcY"]
[Thu Apr 09 22:47:52.780885 2026] [:error] [pid 63331:tid 63345] [client 4.232.89.114:55842] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "ade8GCbKfIYuVjWbE4WYWwAAAcw"]
[Thu Apr 09 22:47:53.261176 2026] [:error] [pid 24515:tid 24526] [client 4.232.89.114:55852] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "ade8Ga1OMnvM2fMnB1PtOAAAAAc"]
[Thu Apr 09 22:47:53.745615 2026] [:error] [pid 63331:tid 63343] [client 4.232.89.114:51319] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "ade8GSbKfIYuVjWbE4WYYQAAAco"]
[Thu Apr 09 22:47:54.221927 2026] [:error] [pid 20837:tid 20863] [client 4.232.89.114:3144] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "ade8GvSL71FHZkjrGzMOmgAAAZg"]
[Thu Apr 09 22:47:54.691673 2026] [:error] [pid 18477:tid 18501] [client 4.232.89.114:55819] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nano.php"] [unique_id "ade8GsDe826HlFeoLPKsHgAAAVY"]
[Thu Apr 09 22:47:55.166400 2026] [:error] [pid 24517:tid 24585] [client 4.232.89.114:51269] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nano.php"] [unique_id "ade8G3boYEn2ZFM_PS-JswAAAIs"]
[Thu Apr 09 22:47:55.659007 2026] [:error] [pid 24515:tid 24527] [client 4.232.89.114:34246] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nano.php"] [unique_id "ade8G61OMnvM2fMnB1PtQAAAAAg"]
[Thu Apr 09 22:47:56.137536 2026] [:error] [pid 18477:tid 18498] [client 4.232.89.114:49606] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nano.php"] [unique_id "ade8HMDe826HlFeoLPKsJAAAAVM"]
[Thu Apr 09 22:47:56.610161 2026] [:error] [pid 24516:tid 24560] [client 4.232.89.114:3199] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35_S.php"] [unique_id "ade8HNhW7vSS-UkeWCU-ZAAAAE0"]
[Thu Apr 09 22:47:57.087314 2026] [:error] [pid 24515:tid 24520] [client 4.232.89.114:34278] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35_S.php"] [unique_id "ade8Ha1OMnvM2fMnB1PtSQAAAAE"]
[Thu Apr 09 22:47:57.561058 2026] [:error] [pid 24515:tid 24532] [client 4.232.89.114:51279] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35_S.php"] [unique_id "ade8Ha1OMnvM2fMnB1PtSwAAAA0"]
[Thu Apr 09 22:47:58.033860 2026] [:error] [pid 20837:tid 20856] [client 4.232.89.114:51277] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35_S.php"] [unique_id "ade8HvSL71FHZkjrGzMOogAAAZE"]
[Thu Apr 09 22:47:58.527383 2026] [:error] [pid 63331:tid 63350] [client 4.232.89.114:49621] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "ade8HibKfIYuVjWbE4WYewAAAdE"]
[Thu Apr 09 22:47:59.033484 2026] [:error] [pid 20837:tid 20862] [client 4.232.89.114:3139] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "ade8H_SL71FHZkjrGzMOpgAAAZc"]
[Thu Apr 09 22:47:59.542630 2026] [:error] [pid 24624:tid 24634] [client 4.232.89.114:3195] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "ade8H-4Jn-WvK1ZBTvjz_QAAAMg"]
[Thu Apr 09 22:48:00.025776 2026] [:error] [pid 20837:tid 20851] [client 4.232.89.114:51284] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "ade8IPSL71FHZkjrGzMOqAAAAYw"]
[Thu Apr 09 22:48:00.497472 2026] [:error] [pid 24517:tid 24593] [client 4.232.89.114:3146] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "ade8IHboYEn2ZFM_PS-JvAAAAJM"]
[Thu Apr 09 22:48:00.976988 2026] [:error] [pid 24517:tid 24582] [client 4.232.89.114:4038] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "ade8IHboYEn2ZFM_PS-JwQAAAIg"]
[Thu Apr 09 22:48:01.454782 2026] [:error] [pid 24516:tid 24565] [client 4.232.89.114:51264] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "ade8IdhW7vSS-UkeWCU-aQAAAFI"]
[Thu Apr 09 22:48:01.931122 2026] [:error] [pid 63331:tid 63348] [client 4.232.89.114:49605] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "ade8ISbKfIYuVjWbE4WYigAAAc8"]
[Thu Apr 09 22:48:02.408143 2026] [:error] [pid 24624:tid 24628] [client 4.232.89.114:55808] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "ade8Iu4Jn-WvK1ZBTvj0BQAAAMI"]
[Thu Apr 09 22:48:02.894441 2026] [:error] [pid 24624:tid 24633] [client 4.232.89.114:51309] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "ade8Iu4Jn-WvK1ZBTvj0BgAAAMc"]
[Thu Apr 09 22:48:14.226131 2026] [:error] [pid 18477:tid 18484] [client 4.232.89.114:49609] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "ade8LsDe826HlFeoLPKsTgAAAUU"]
[Thu Apr 09 22:48:14.713474 2026] [:error] [pid 24516:tid 24558] [client 4.232.89.114:32274] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "ade8LthW7vSS-UkeWCU-cgAAAEs"]
[Thu Apr 09 22:48:15.182663 2026] [:error] [pid 20837:tid 20851] [client 4.232.89.114:34254] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "ade8L_SL71FHZkjrGzMO2gAAAYw"]
[Thu Apr 09 22:48:15.680647 2026] [:error] [pid 24515:tid 24520] [client 4.232.89.114:34281] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "ade8L61OMnvM2fMnB1PtrAAAAAE"]
[Thu Apr 09 22:48:16.149740 2026] [:error] [pid 20837:tid 20857] [client 4.232.89.114:32278] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "ade8MPSL71FHZkjrGzMO4QAAAZI"]
[Thu Apr 09 22:48:16.670381 2026] [:error] [pid 24517:tid 24577] [client 4.232.89.114:49629] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "ade8MHboYEn2ZFM_PS-JzwAAAIM"]
[Thu Apr 09 22:48:17.148057 2026] [:error] [pid 20837:tid 20858] [client 4.232.89.114:55844] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "ade8MfSL71FHZkjrGzMO6gAAAZM"]
[Thu Apr 09 22:48:17.618490 2026] [:error] [pid 24624:tid 24630] [client 4.232.89.114:49631] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "ade8Me4Jn-WvK1ZBTvj0IgAAAMQ"]
[Thu Apr 09 22:48:18.204263 2026] [:error] [pid 24624:tid 24641] [client 4.232.89.114:34259] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "ade8Mu4Jn-WvK1ZBTvj0IwAAAM8"]
[Thu Apr 09 22:48:18.685004 2026] [:error] [pid 24624:tid 24626] [client 4.232.89.114:55829] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "ade8Mu4Jn-WvK1ZBTvj0JwAAAMA"]
[Thu Apr 09 22:48:19.155645 2026] [:error] [pid 24624:tid 24648] [client 4.232.89.114:51268] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "ade8M-4Jn-WvK1ZBTvj0KgAAANY"]
[Thu Apr 09 22:48:19.642393 2026] [:error] [pid 24624:tid 24634] [client 4.232.89.114:3196] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "ade8M-4Jn-WvK1ZBTvj0MQAAAMg"]
[Thu Apr 09 22:48:20.115126 2026] [:error] [pid 24624:tid 24638] [client 4.232.89.114:55858] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "ade8NO4Jn-WvK1ZBTvj0MwAAAMw"]
[Thu Apr 09 22:48:20.622412 2026] [:error] [pid 24624:tid 24650] [client 4.232.89.114:51315] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "ade8NO4Jn-WvK1ZBTvj0NQAAANg"]
[Thu Apr 09 22:48:21.161445 2026] [:error] [pid 24515:tid 24530] [client 4.232.89.114:55871] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "ade8Na1OMnvM2fMnB1PtuAAAAAs"]
[Thu Apr 09 22:48:21.705532 2026] [:error] [pid 24517:tid 24596] [client 4.232.89.114:32270] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "ade8NXboYEn2ZFM_PS-J3QAAAJY"]
[Thu Apr 09 22:48:22.199512 2026] [:error] [pid 63331:tid 63345] [client 4.232.89.114:49649] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "ade8NibKfIYuVjWbE4WYrAAAAcw"]
[Thu Apr 09 22:48:22.699138 2026] [:error] [pid 24515:tid 24520] [client 4.232.89.114:55854] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "ade8Nq1OMnvM2fMnB1PtvQAAAAE"]
[Thu Apr 09 22:48:23.222812 2026] [:error] [pid 63331:tid 63341] [client 4.232.89.114:34258] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "ade8NybKfIYuVjWbE4WYsgAAAcg"]
[Thu Apr 09 22:48:23.697416 2026] [:error] [pid 24515:tid 24539] [client 4.232.89.114:49609] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "ade8N61OMnvM2fMnB1PtwgAAABQ"]
[Thu Apr 09 22:48:24.181194 2026] [:error] [pid 18477:tid 18493] [client 4.232.89.114:3174] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "ade8OMDe826HlFeoLPKsVgAAAU4"]
[Thu Apr 09 22:48:24.697111 2026] [:error] [pid 24624:tid 24633] [client 4.232.89.114:32314] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "ade8OO4Jn-WvK1ZBTvj0OgAAAMc"]
[Thu Apr 09 22:48:25.205905 2026] [:error] [pid 24927:tid 24946] [client 4.232.89.114:49647] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "ade8OTXObuzEuw8mNJs19QAAARA"]
[Thu Apr 09 22:48:25.688974 2026] [:error] [pid 63331:tid 63336] [client 4.232.89.114:32293] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "ade8OSbKfIYuVjWbE4WYuwAAAcM"]
[Thu Apr 09 22:48:26.185442 2026] [:error] [pid 20837:tid 20861] [client 4.232.89.114:34294] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "ade8OvSL71FHZkjrGzMPBwAAAZY"]
[Thu Apr 09 22:48:26.664213 2026] [:error] [pid 24515:tid 24536] [client 4.232.89.114:49646] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "ade8Oq1OMnvM2fMnB1PtxwAAABE"]
[Thu Apr 09 22:48:27.140871 2026] [:error] [pid 24517:tid 24578] [client 4.232.89.114:3145] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "ade8O3boYEn2ZFM_PS-J8AAAAIQ"]
[Thu Apr 09 22:48:27.620685 2026] [:error] [pid 20837:tid 20856] [client 4.232.89.114:34291] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "ade8O_SL71FHZkjrGzMPDwAAAZE"]
[Thu Apr 09 22:48:28.117127 2026] [:error] [pid 24516:tid 24561] [client 4.232.89.114:34241] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "ade8PNhW7vSS-UkeWCU-ggAAAE4"]
[Thu Apr 09 22:48:28.585193 2026] [:error] [pid 20837:tid 20841] [client 4.232.89.114:49644] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "ade8PPSL71FHZkjrGzMPFwAAAYI"]
[Thu Apr 09 22:48:29.075442 2026] [:error] [pid 63331:tid 63351] [client 4.232.89.114:3156] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "ade8PSbKfIYuVjWbE4WYxQAAAdI"]
[Thu Apr 09 22:48:29.553588 2026] [:error] [pid 63331:tid 63356] [client 4.232.89.114:49614] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "ade8PSbKfIYuVjWbE4WYzQAAAdc"]
[Thu Apr 09 22:48:30.062153 2026] [:error] [pid 63331:tid 63346] [client 4.232.89.114:34247] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "ade8PibKfIYuVjWbE4WY0gAAAc0"]
[Thu Apr 09 22:48:30.536195 2026] [:error] [pid 63331:tid 63343] [client 4.232.89.114:51300] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "ade8PibKfIYuVjWbE4WY2QAAAco"]
[Thu Apr 09 22:48:31.014879 2026] [:error] [pid 63331:tid 63333] [client 4.232.89.114:49630] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "ade8PybKfIYuVjWbE4WY4AAAAcA"]
[Thu Apr 09 22:48:31.495374 2026] [:error] [pid 24516:tid 24566] [client 4.232.89.114:3176] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "ade8P9hW7vSS-UkeWCU-hAAAAFM"]
[Thu Apr 09 22:48:31.979930 2026] [:error] [pid 18477:tid 18490] [client 4.232.89.114:55839] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ade8P8De826HlFeoLPKsXgAAAUs"]
[Thu Apr 09 22:48:32.466057 2026] [:error] [pid 63331:tid 63338] [client 4.232.89.114:32291] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ade8QCbKfIYuVjWbE4WY6gAAAcU"]
[Thu Apr 09 22:48:32.947430 2026] [:error] [pid 24515:tid 24540] [client 4.232.89.114:4086] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ade8QK1OMnvM2fMnB1PtyAAAABU"]
[Thu Apr 09 22:48:33.422884 2026] [:error] [pid 63331:tid 63349] [client 4.232.89.114:49620] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ade8QSbKfIYuVjWbE4WY9AAAAdA"]
[Thu Apr 09 22:48:33.894135 2026] [:error] [pid 63331:tid 63344] [client 4.232.89.114:34274] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "ade8QSbKfIYuVjWbE4WY-wAAAcs"]
[Thu Apr 09 22:48:34.362401 2026] [:error] [pid 24624:tid 24637] [client 4.232.89.114:55826] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "ade8Qu4Jn-WvK1ZBTvj0QAAAAMs"]
[Thu Apr 09 22:48:34.841694 2026] [:error] [pid 24927:tid 24954] [client 4.232.89.114:3460] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "ade8QjXObuzEuw8mNJs1-QAAARg"]
[Thu Apr 09 22:48:35.320923 2026] [:error] [pid 24517:tid 24591] [client 4.232.89.114:34295] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "ade8Q3boYEn2ZFM_PS-J_wAAAJE"]
[Thu Apr 09 22:48:35.792191 2026] [:error] [pid 63331:tid 63345] [client 4.232.89.114:34301] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "ade8QybKfIYuVjWbE4WZBwAAAcw"]
[Thu Apr 09 22:48:36.269818 2026] [:error] [pid 63331:tid 63354] [client 4.232.89.114:49625] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "ade8RCbKfIYuVjWbE4WZCwAAAdU"]
[Thu Apr 09 22:48:36.740963 2026] [:error] [pid 63331:tid 63355] [client 4.232.89.114:49600] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "ade8RCbKfIYuVjWbE4WZEQAAAdY"]
[Thu Apr 09 22:48:37.214017 2026] [:error] [pid 24927:tid 24931] [client 4.232.89.114:32318] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "ade8RTXObuzEuw8mNJs1_AAAAQE"]
[Thu Apr 09 22:48:37.682064 2026] [:error] [pid 24927:tid 24945] [client 4.232.89.114:3470] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "ade8RTXObuzEuw8mNJs1_wAAAQ8"]
[Thu Apr 09 22:48:38.155341 2026] [:error] [pid 20837:tid 20841] [client 4.232.89.114:32257] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "ade8RvSL71FHZkjrGzMPJAAAAYI"]
[Thu Apr 09 22:48:38.619929 2026] [:error] [pid 63331:tid 63350] [client 4.232.89.114:55867] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "ade8RibKfIYuVjWbE4WZIAAAAdE"]
[Thu Apr 09 22:48:39.088424 2026] [:error] [pid 24624:tid 24627] [client 4.232.89.114:34248] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "ade8R-4Jn-WvK1ZBTvj0VAAAAME"]
[Thu Apr 09 22:48:39.560544 2026] [:error] [pid 18477:tid 18480] [client 4.232.89.114:3158] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "ade8R8De826HlFeoLPKsawAAAUE"]
[Thu Apr 09 22:48:40.030624 2026] [:error] [pid 24516:tid 24558] [client 4.232.89.114:3150] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "ade8SNhW7vSS-UkeWCU-iAAAAEs"]
[Thu Apr 09 22:48:40.506014 2026] [:error] [pid 63331:tid 63346] [client 4.232.89.114:55865] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "ade8SCbKfIYuVjWbE4WZJQAAAc0"]
[Thu Apr 09 22:48:40.972284 2026] [:error] [pid 63331:tid 63347] [client 4.232.89.114:3469] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "ade8SCbKfIYuVjWbE4WZKAAAAc4"]
[Thu Apr 09 22:48:41.456211 2026] [:error] [pid 63331:tid 63349] [client 4.232.89.114:51282] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "ade8SSbKfIYuVjWbE4WZLAAAAdA"]
[Thu Apr 09 22:48:41.920961 2026] [:error] [pid 24516:tid 24550] [client 4.232.89.114:32273] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "ade8SdhW7vSS-UkeWCU-igAAAEM"]
[Thu Apr 09 22:48:42.394197 2026] [:error] [pid 63331:tid 63341] [client 4.232.89.114:34288] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "ade8SibKfIYuVjWbE4WZLgAAAcg"]
[Thu Apr 09 22:48:42.872107 2026] [:error] [pid 18477:tid 18485] [client 4.232.89.114:32281] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "ade8SsDe826HlFeoLPKsdQAAAUY"]
[Thu Apr 09 22:48:43.349162 2026] [:error] [pid 24927:tid 24947] [client 4.232.89.114:55809] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "ade8SzXObuzEuw8mNJs2DAAAARE"]
[Thu Apr 09 22:48:43.841029 2026] [:error] [pid 24927:tid 24942] [client 4.232.89.114:49632] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "ade8SzXObuzEuw8mNJs2DgAAAQw"]
[Thu Apr 09 22:48:44.332465 2026] [:error] [pid 24927:tid 24945] [client 4.232.89.114:34260] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "ade8TDXObuzEuw8mNJs2EAAAAQ8"]
[Thu Apr 09 22:48:44.804847 2026] [:error] [pid 24517:tid 24584] [client 4.232.89.114:49653] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "ade8THboYEn2ZFM_PS-KDQAAAIo"]
[Thu Apr 09 22:48:45.274704 2026] [:error] [pid 24927:tid 24940] [client 4.232.89.114:34289] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "ade8TTXObuzEuw8mNJs2EgAAAQo"]
[Thu Apr 09 22:48:45.755178 2026] [:error] [pid 24515:tid 24522] [client 4.232.89.114:3173] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "ade8Ta1OMnvM2fMnB1Pt0AAAAAM"]
[Thu Apr 09 22:48:46.224655 2026] [:error] [pid 24515:tid 24528] [client 4.232.89.114:51270] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "ade8Tq1OMnvM2fMnB1Pt0QAAAAk"]
[Thu Apr 09 22:48:46.692637 2026] [:error] [pid 24515:tid 24541] [client 4.232.89.114:32259] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "ade8Tq1OMnvM2fMnB1Pt0wAAABY"]
[Thu Apr 09 22:48:47.164920 2026] [:error] [pid 18477:tid 18483] [client 4.232.89.114:51311] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "ade8T8De826HlFeoLPKsgAAAAUQ"]
[Thu Apr 09 22:48:47.646209 2026] [:error] [pid 63331:tid 63336] [client 4.232.89.114:34303] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "ade8TybKfIYuVjWbE4WZMgAAAcM"]
[Thu Apr 09 22:48:48.115209 2026] [:error] [pid 18477:tid 18481] [client 4.232.89.114:34267] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "ade8UMDe826HlFeoLPKshAAAAUI"]
[Thu Apr 09 22:48:48.585534 2026] [:error] [pid 24516:tid 24549] [client 4.232.89.114:55827] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "ade8UNhW7vSS-UkeWCU-kAAAAEI"]
[Thu Apr 09 22:48:49.061165 2026] [:error] [pid 24517:tid 24583] [client 4.232.89.114:32268] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "ade8UXboYEn2ZFM_PS-KFQAAAIk"]
[Thu Apr 09 22:48:49.530102 2026] [:error] [pid 24517:tid 24585] [client 4.232.89.114:49654] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "ade8UXboYEn2ZFM_PS-KGgAAAIs"]
[Thu Apr 09 22:48:50.001006 2026] [:error] [pid 24927:tid 24935] [client 4.232.89.114:49640] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "ade8UjXObuzEuw8mNJs2IgAAAQU"]
[Thu Apr 09 22:48:50.476016 2026] [:error] [pid 24624:tid 24641] [client 4.232.89.114:32308] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "ade8Uu4Jn-WvK1ZBTvj0awAAAM8"]
[Thu Apr 09 22:48:50.945488 2026] [:error] [pid 24927:tid 24939] [client 4.232.89.114:49657] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "ade8UjXObuzEuw8mNJs2JQAAAQk"]
[Thu Apr 09 22:48:51.458486 2026] [:error] [pid 24517:tid 24578] [client 4.232.89.114:51288] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "ade8U3boYEn2ZFM_PS-KIQAAAIQ"]
[Thu Apr 09 22:48:51.924871 2026] [:error] [pid 24516:tid 24557] [client 4.232.89.114:49662] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "ade8U9hW7vSS-UkeWCU-lwAAAEo"]
[Thu Apr 09 22:48:52.405832 2026] [:error] [pid 24927:tid 24944] [client 4.232.89.114:55831] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "ade8VDXObuzEuw8mNJs2JwAAAQ4"]
[Thu Apr 09 22:48:52.887613 2026] [:error] [pid 24516:tid 24553] [client 4.232.89.114:32264] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "ade8VNhW7vSS-UkeWCU-nAAAAEY"]
[Thu Apr 09 22:48:53.357575 2026] [:error] [pid 20837:tid 20860] [client 4.232.89.114:32263] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "ade8VfSL71FHZkjrGzMPNwAAAZU"]
[Thu Apr 09 22:48:53.861573 2026] [:error] [pid 20837:tid 20841] [client 4.232.89.114:32304] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "ade8VfSL71FHZkjrGzMPOAAAAYI"]
[Thu Apr 09 22:48:54.327796 2026] [:error] [pid 24624:tid 24644] [client 4.232.89.114:32315] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "ade8Vu4Jn-WvK1ZBTvj0egAAANI"]
[Thu Apr 09 22:48:54.795456 2026] [:error] [pid 24517:tid 24596] [client 4.232.89.114:49642] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless4.php"] [unique_id "ade8VnboYEn2ZFM_PS-KJQAAAJY"]
[Thu Apr 09 22:48:55.265096 2026] [:error] [pid 63331:tid 63339] [client 4.232.89.114:34282] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless4.php"] [unique_id "ade8VybKfIYuVjWbE4WZOAAAAcY"]
[Thu Apr 09 22:48:55.760197 2026] [:error] [pid 24927:tid 24945] [client 4.232.89.114:55843] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless4.php"] [unique_id "ade8VzXObuzEuw8mNJs2NQAAAQ8"]
[Thu Apr 09 22:48:56.245058 2026] [:error] [pid 24516:tid 24563] [client 4.232.89.114:55851] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless4.php"] [unique_id "ade8WNhW7vSS-UkeWCU-oQAAAFA"]
[Thu Apr 09 22:48:56.736728 2026] [:error] [pid 24517:tid 24595] [client 4.232.89.114:49636] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "ade8WHboYEn2ZFM_PS-KLAAAAJU"]
[Thu Apr 09 22:48:57.201732 2026] [:error] [pid 24517:tid 24575] [client 4.232.89.114:55824] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "ade8WXboYEn2ZFM_PS-KLgAAAIE"]
[Thu Apr 09 22:48:57.684365 2026] [:error] [pid 24516:tid 24562] [client 4.232.89.114:32283] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "ade8WdhW7vSS-UkeWCU-owAAAE8"]
[Thu Apr 09 22:48:58.158323 2026] [:error] [pid 63331:tid 63353] [client 4.232.89.114:55855] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "ade8WibKfIYuVjWbE4WZOwAAAdQ"]
[Thu Apr 09 22:48:58.640686 2026] [:error] [pid 24517:tid 24586] [client 4.232.89.114:3171] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xqq.php"] [unique_id "ade8WnboYEn2ZFM_PS-KMAAAAIw"]
[Thu Apr 09 22:48:59.133616 2026] [:error] [pid 24927:tid 24951] [client 4.232.89.114:3479] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xqq.php"] [unique_id "ade8WzXObuzEuw8mNJs2QAAAARU"]
[Thu Apr 09 22:48:59.613660 2026] [:error] [pid 24515:tid 24540] [client 4.232.89.114:55835] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xqq.php"] [unique_id "ade8W61OMnvM2fMnB1Pt7gAAABU"]
[Thu Apr 09 22:49:00.097928 2026] [:error] [pid 18477:tid 18485] [client 4.232.89.114:32272] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xqq.php"] [unique_id "ade8XMDe826HlFeoLPKsngAAAUY"]
[Thu Apr 09 22:49:00.571003 2026] [:error] [pid 24927:tid 24954] [client 4.232.89.114:3190] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plss3.php"] [unique_id "ade8XDXObuzEuw8mNJs2QwAAARg"]
[Thu Apr 09 22:49:01.062472 2026] [:error] [pid 24517:tid 24576] [client 4.232.89.114:32256] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plss3.php"] [unique_id "ade8XXboYEn2ZFM_PS-KNAAAAII"]
[Thu Apr 09 22:49:01.536540 2026] [:error] [pid 63331:tid 63334] [client 4.232.89.114:3179] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plss3.php"] [unique_id "ade8XSbKfIYuVjWbE4WZQAAAAcE"]
[Thu Apr 09 22:49:02.015862 2026] [:error] [pid 63331:tid 63344] [client 4.232.89.114:51316] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plss3.php"] [unique_id "ade8XibKfIYuVjWbE4WZQwAAAcs"]
[Thu Apr 09 22:49:02.490753 2026] [:error] [pid 63331:tid 63347] [client 4.232.89.114:3503] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "ade8XibKfIYuVjWbE4WZSAAAAc4"]
[Thu Apr 09 22:49:02.965679 2026] [:error] [pid 63331:tid 63349] [client 4.232.89.114:51323] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "ade8XibKfIYuVjWbE4WZTAAAAdA"]
[Thu Apr 09 22:49:03.441842 2026] [:error] [pid 24927:tid 24944] [client 4.232.89.114:51325] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "ade8XzXObuzEuw8mNJs2TgAAAQ4"]
[Thu Apr 09 22:49:03.908129 2026] [:error] [pid 24624:tid 24626] [client 4.232.89.114:3188] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "ade8X-4Jn-WvK1ZBTvj0igAAAMA"]
[Thu Apr 09 22:49:04.373349 2026] [:error] [pid 24927:tid 24932] [client 4.232.89.114:34263] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "ade8YDXObuzEuw8mNJs2VAAAAQI"]
[Thu Apr 09 22:49:04.847022 2026] [:error] [pid 24927:tid 24954] [client 4.232.89.114:3137] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "ade8YDXObuzEuw8mNJs2VQAAARg"]
[Thu Apr 09 22:49:05.319225 2026] [:error] [pid 24516:tid 24548] [client 4.232.89.114:49607] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "ade8YdhW7vSS-UkeWCU-pgAAAEE"]
[Thu Apr 09 22:49:05.790671 2026] [:error] [pid 24517:tid 24578] [client 4.232.89.114:49651] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "ade8YXboYEn2ZFM_PS-KNgAAAIQ"]
[Thu Apr 09 22:49:06.261893 2026] [:error] [pid 24516:tid 24558] [client 4.232.89.114:32306] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "ade8YthW7vSS-UkeWCU-qgAAAEs"]
[Thu Apr 09 22:49:06.740389 2026] [:error] [pid 18477:tid 18497] [client 4.232.89.114:55861] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "ade8YsDe826HlFeoLPKsrAAAAVI"]
[Thu Apr 09 22:49:07.209075 2026] [:error] [pid 24516:tid 24568] [client 4.232.89.114:3178] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "ade8Y9hW7vSS-UkeWCU-sgAAAFU"]
[Thu Apr 09 22:49:07.683497 2026] [:error] [pid 63331:tid 63337] [client 4.232.89.114:49608] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "ade8YybKfIYuVjWbE4WZVAAAAcQ"]
[Thu Apr 09 22:49:08.155793 2026] [:error] [pid 63331:tid 63347] [client 4.232.89.114:55830] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "ade8ZCbKfIYuVjWbE4WZVwAAAc4"]
[Thu Apr 09 22:49:08.627585 2026] [:error] [pid 24515:tid 24543] [client 4.232.89.114:3164] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "ade8ZK1OMnvM2fMnB1PuCwAAABg"]
[Thu Apr 09 22:49:09.113313 2026] [:error] [pid 24624:tid 24628] [client 4.232.89.114:4054] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "ade8Ze4Jn-WvK1ZBTvj0iwAAAMI"]
[Thu Apr 09 22:49:09.639886 2026] [:error] [pid 24624:tid 24631] [client 4.232.89.114:4061] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "ade8Ze4Jn-WvK1ZBTvj0jQAAAMU"]
[Thu Apr 09 22:49:10.117960 2026] [:error] [pid 63331:tid 63354] [client 4.232.89.114:34264] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "ade8ZibKfIYuVjWbE4WZYQAAAdU"]
[Thu Apr 09 22:49:10.618069 2026] [:error] [pid 24624:tid 24642] [client 4.232.89.114:51271] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "ade8Zu4Jn-WvK1ZBTvj0jgAAANA"]
[Thu Apr 09 22:49:11.092608 2026] [:error] [pid 20837:tid 20856] [client 4.232.89.114:51313] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "ade8Z_SL71FHZkjrGzMPQQAAAZE"]
[Thu Apr 09 22:49:11.577977 2026] [:error] [pid 18477:tid 18491] [client 4.232.89.114:3168] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "ade8Z8De826HlFeoLPKssQAAAUw"]
[Thu Apr 09 22:49:12.055883 2026] [:error] [pid 24624:tid 24627] [client 4.232.89.114:34275] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "ade8aO4Jn-WvK1ZBTvj0kAAAAME"]
[Thu Apr 09 22:49:12.537409 2026] [:error] [pid 24515:tid 24519] [client 4.232.89.114:3484] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "ade8aK1OMnvM2fMnB1PuHwAAAAA"]
[Thu Apr 09 22:49:15.189127 2026] [autoindex:error] [pid 18477:tid 18498] [client 4.232.89.114:55837] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 09 22:49:25.637420 2026] [:error] [pid 18477:tid 18496] [client 4.232.89.114:55837] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "ade8dcDe826HlFeoLPKs0AAAAVE"]
[Thu Apr 09 22:49:26.116405 2026] [:error] [pid 63331:tid 63341] [client 4.232.89.114:55846] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "ade8dibKfIYuVjWbE4WZgAAAAcg"]
[Thu Apr 09 22:49:26.637169 2026] [:error] [pid 24624:tid 24636] [client 4.232.89.114:4067] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "ade8du4Jn-WvK1ZBTvj0rgAAAMo"]
[Thu Apr 09 22:49:27.116397 2026] [:error] [pid 63331:tid 63351] [client 4.232.89.114:3159] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "ade8dybKfIYuVjWbE4WZigAAAdI"]
[Thu Apr 09 22:49:27.661920 2026] [:error] [pid 63331:tid 63349] [client 4.232.89.114:51275] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "ade8dybKfIYuVjWbE4WZjQAAAdA"]
[Thu Apr 09 22:49:28.141142 2026] [:error] [pid 63331:tid 63340] [client 4.232.89.114:51301] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "ade8eCbKfIYuVjWbE4WZlQAAAcc"]
[Thu Apr 09 22:49:28.671246 2026] [:error] [pid 63331:tid 63343] [client 4.232.89.114:49601] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "ade8eCbKfIYuVjWbE4WZmwAAAco"]
[Thu Apr 09 22:49:29.146996 2026] [:error] [pid 24927:tid 24949] [client 4.232.89.114:55841] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "ade8eTXObuzEuw8mNJs2XgAAARM"]
[Thu Apr 09 22:49:29.642517 2026] [:error] [pid 24515:tid 24541] [client 4.232.89.114:3473] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "ade8ea1OMnvM2fMnB1PuXAAAABY"]
[Thu Apr 09 22:49:30.115986 2026] [:error] [pid 24515:tid 24537] [client 4.232.89.114:3825] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "ade8eq1OMnvM2fMnB1PuYAAAABI"]
[Thu Apr 09 22:49:30.601555 2026] [:error] [pid 24515:tid 24521] [client 4.232.89.114:55834] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "ade8eq1OMnvM2fMnB1PuYQAAAAI"]
[Thu Apr 09 22:49:31.099497 2026] [:error] [pid 24515:tid 24540] [client 4.232.89.114:34292] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "ade8e61OMnvM2fMnB1PuYwAAABU"]
[Thu Apr 09 22:49:31.600681 2026] [:error] [pid 20837:tid 20858] [client 4.232.89.114:34250] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "ade8e_SL71FHZkjrGzMPaAAAAZM"]
[Thu Apr 09 22:49:32.070852 2026] [:error] [pid 24515:tid 24543] [client 4.232.89.114:32280] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "ade8fK1OMnvM2fMnB1PuZQAAABg"]
[Thu Apr 09 22:49:32.558067 2026] [:error] [pid 63331:tid 63347] [client 4.232.89.114:49652] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "ade8fCbKfIYuVjWbE4WZugAAAc4"]
[Thu Apr 09 22:49:33.030779 2026] [:error] [pid 20837:tid 20854] [client 4.232.89.114:51307] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "ade8ffSL71FHZkjrGzMPbAAAAY8"]
[Thu Apr 09 22:49:33.506209 2026] [:error] [pid 24624:tid 24629] [client 4.232.89.114:3476] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "ade8fe4Jn-WvK1ZBTvj00QAAAMM"]
[Thu Apr 09 22:49:33.976199 2026] [:error] [pid 20837:tid 20853] [client 4.232.89.114:55815] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "ade8ffSL71FHZkjrGzMPbwAAAY4"]
[Thu Apr 09 22:49:34.469605 2026] [:error] [pid 63331:tid 63355] [client 4.232.89.114:3784] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "ade8fibKfIYuVjWbE4WZzQAAAdY"]
[Thu Apr 09 22:49:34.948013 2026] [:error] [pid 24515:tid 24525] [client 4.232.89.114:55825] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "ade8fq1OMnvM2fMnB1PucAAAAAY"]
[Thu Apr 09 22:49:35.418163 2026] [:error] [pid 24515:tid 24540] [client 4.232.89.114:3194] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "ade8f61OMnvM2fMnB1PueQAAABU"]
[Thu Apr 09 22:49:35.902878 2026] [:error] [pid 63331:tid 63346] [client 4.232.89.114:3138] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "ade8fybKfIYuVjWbE4WZ1QAAAc0"]
[Thu Apr 09 22:49:36.394550 2026] [:error] [pid 63331:tid 63351] [client 4.232.89.114:3181] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "ade8gCbKfIYuVjWbE4WZ2QAAAdI"]
[Thu Apr 09 22:49:36.866981 2026] [:error] [pid 24517:tid 24586] [client 4.232.89.114:34261] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "ade8gHboYEn2ZFM_PS-KQgAAAIw"]
[Thu Apr 09 22:49:37.350176 2026] [:error] [pid 20837:tid 20845] [client 4.232.89.114:55814] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "ade8gfSL71FHZkjrGzMPeAAAAYY"]
[Thu Apr 09 22:49:37.855136 2026] [:error] [pid 20837:tid 20863] [client 4.232.89.114:32271] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "ade8gfSL71FHZkjrGzMPewAAAZg"]
[Thu Apr 09 22:49:38.332927 2026] [:error] [pid 63331:tid 63346] [client 4.232.89.114:3478] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "ade8gibKfIYuVjWbE4WZ5QAAAc0"]
[Thu Apr 09 22:49:38.814597 2026] [:error] [pid 63331:tid 63344] [client 4.232.89.114:3809] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "ade8gibKfIYuVjWbE4WZ6gAAAcs"]
[Thu Apr 09 22:49:39.295715 2026] [:error] [pid 63331:tid 63349] [client 4.232.89.114:3505] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "ade8gybKfIYuVjWbE4WZ7gAAAdA"]
[Thu Apr 09 22:49:39.766718 2026] [:error] [pid 24927:tid 24935] [client 4.232.89.114:4064] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "ade8gzXObuzEuw8mNJs2agAAAQU"]
[Thu Apr 09 22:49:40.251842 2026] [:error] [pid 18477:tid 18503] [client 4.232.89.114:32307] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "ade8hMDe826HlFeoLPKs1QAAAVg"]
[Thu Apr 09 22:49:40.719811 2026] [:error] [pid 24515:tid 24542] [client 4.232.89.114:34298] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "ade8hK1OMnvM2fMnB1PujwAAABc"]
[Thu Apr 09 22:49:41.186138 2026] [:error] [pid 24515:tid 24533] [client 4.232.89.114:51305] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ade8ha1OMnvM2fMnB1PukgAAAA4"]
[Thu Apr 09 22:49:41.655500 2026] [:error] [pid 24624:tid 24629] [client 4.232.89.114:34284] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ade8he4Jn-WvK1ZBTvj0_AAAAMM"]
[Thu Apr 09 22:49:42.121541 2026] [:error] [pid 24927:tid 24947] [client 4.232.89.114:3140] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ade8hjXObuzEuw8mNJs2bQAAARE"]
[Thu Apr 09 22:49:42.614452 2026] [:error] [pid 20837:tid 20851] [client 4.232.89.114:49611] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ade8hvSL71FHZkjrGzMPgQAAAYw"]
[Thu Apr 09 22:49:43.107119 2026] [:error] [pid 24515:tid 24537] [client 4.232.89.114:51289] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "ade8h61OMnvM2fMnB1PukwAAABI"]
[Thu Apr 09 22:49:43.577497 2026] [:error] [pid 24927:tid 24939] [client 4.232.89.114:34268] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "ade8hzXObuzEuw8mNJs2bgAAAQk"]
[Thu Apr 09 22:49:44.047430 2026] [:error] [pid 24624:tid 24639] [client 4.232.89.114:4051] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "ade8iO4Jn-WvK1ZBTvj1CgAAAM0"]
[Thu Apr 09 22:49:44.520343 2026] [:error] [pid 63331:tid 63345] [client 4.232.89.114:49639] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "ade8iCbKfIYuVjWbE4WaCQAAAcw"]
[Thu Apr 09 22:49:44.995342 2026] [:error] [pid 24515:tid 24540] [client 4.232.89.114:32262] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "ade8iK1OMnvM2fMnB1PulwAAABU"]
[Thu Apr 09 22:49:45.480921 2026] [:error] [pid 63331:tid 63348] [client 4.232.89.114:3162] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "ade8iSbKfIYuVjWbE4WaDwAAAc8"]
[Thu Apr 09 22:49:45.961101 2026] [:error] [pid 63331:tid 63356] [client 4.232.89.114:3167] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "ade8iSbKfIYuVjWbE4WaFAAAAdc"]
[Thu Apr 09 22:49:46.437968 2026] [:error] [pid 24515:tid 24526] [client 4.232.89.114:34280] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "ade8iq1OMnvM2fMnB1PumgAAAAc"]
[Thu Apr 09 22:49:46.936247 2026] [:error] [pid 24515:tid 24528] [client 4.232.89.114:51285] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "ade8iq1OMnvM2fMnB1PunQAAAAk"]
[Thu Apr 09 22:49:47.413456 2026] [:error] [pid 20837:tid 20854] [client 4.232.89.114:32310] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "ade8i_SL71FHZkjrGzMPjwAAAY8"]
[Thu Apr 09 22:49:47.896312 2026] [:error] [pid 24927:tid 24950] [client 4.232.89.114:3153] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "ade8izXObuzEuw8mNJs2dAAAARQ"]
[Thu Apr 09 22:49:48.370032 2026] [:error] [pid 18477:tid 18494] [client 4.232.89.114:55840] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "ade8jMDe826HlFeoLPKs2gAAAU8"]
[Thu Apr 09 22:49:48.839313 2026] [:error] [pid 24927:tid 24934] [client 4.232.89.114:32300] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "ade8jDXObuzEuw8mNJs2eQAAAQQ"]
[Thu Apr 09 22:49:49.327019 2026] [:error] [pid 24624:tid 24633] [client 4.232.89.114:3499] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "ade8je4Jn-WvK1ZBTvj1FQAAAMc"]
[Thu Apr 09 22:49:49.796106 2026] [:error] [pid 24624:tid 24630] [client 4.232.89.114:32301] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "ade8je4Jn-WvK1ZBTvj1FwAAAMQ"]
[Thu Apr 09 22:49:50.265698 2026] [:error] [pid 24516:tid 24550] [client 4.232.89.114:3521] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "ade8jthW7vSS-UkeWCU-7wAAAEM"]
[Thu Apr 09 22:49:50.744152 2026] [:error] [pid 24927:tid 24935] [client 4.232.89.114:4093] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "ade8jjXObuzEuw8mNJs2fgAAAQU"]
[Thu Apr 09 22:49:51.211805 2026] [:error] [pid 24515:tid 24529] [client 4.232.89.114:3502] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "ade8j61OMnvM2fMnB1PusQAAAAo"]
[Thu Apr 09 22:49:51.691634 2026] [:error] [pid 24624:tid 24642] [client 4.232.89.114:3151] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "ade8j-4Jn-WvK1ZBTvj1GgAAANA"]
[Thu Apr 09 22:49:52.166588 2026] [:error] [pid 24624:tid 24627] [client 4.232.89.114:49602] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "ade8kO4Jn-WvK1ZBTvj1GwAAAME"]
[Thu Apr 09 22:49:52.660637 2026] [:error] [pid 63331:tid 63337] [client 4.232.89.114:49656] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "ade8kCbKfIYuVjWbE4WaHgAAAcQ"]
[Thu Apr 09 22:49:53.134122 2026] [:error] [pid 24517:tid 24590] [client 4.232.89.114:3467] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "ade8kXboYEn2ZFM_PS-KXQAAAJA"]
[Thu Apr 09 22:49:53.605856 2026] [:error] [pid 24624:tid 24639] [client 4.232.89.114:3193] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "ade8ke4Jn-WvK1ZBTvj1HQAAAM0"]
[Thu Apr 09 22:49:54.082223 2026] [:error] [pid 20837:tid 20848] [client 4.232.89.114:4057] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "ade8kvSL71FHZkjrGzMPlgAAAYk"]
[Thu Apr 09 22:49:54.557339 2026] [:error] [pid 24517:tid 24592] [client 4.232.89.114:51314] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "ade8knboYEn2ZFM_PS-KXgAAAJI"]
[Thu Apr 09 22:49:55.034849 2026] [:error] [pid 24517:tid 24593] [client 4.232.89.114:4095] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "ade8k3boYEn2ZFM_PS-KXwAAAJM"]
[Thu Apr 09 22:49:55.504633 2026] [:error] [pid 24517:tid 24587] [client 4.232.89.114:3793] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "ade8k3boYEn2ZFM_PS-KYAAAAI0"]
[Thu Apr 09 22:49:55.971771 2026] [:error] [pid 24927:tid 24953] [client 4.232.89.114:32299] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "ade8kzXObuzEuw8mNJs2hQAAARc"]
[Thu Apr 09 22:49:56.460829 2026] [:error] [pid 20837:tid 20840] [client 4.232.89.114:34279] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "ade8lPSL71FHZkjrGzMPmgAAAYE"]
[Thu Apr 09 22:49:56.938558 2026] [:error] [pid 24517:tid 24577] [client 4.232.89.114:32317] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "ade8lHboYEn2ZFM_PS-KZQAAAIM"]
[Thu Apr 09 22:49:57.417404 2026] [:error] [pid 24515:tid 24534] [client 4.232.89.114:55863] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "ade8la1OMnvM2fMnB1PuuQAAAA8"]
[Thu Apr 09 22:49:57.884424 2026] [:error] [pid 24624:tid 24628] [client 4.232.89.114:32312] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "ade8le4Jn-WvK1ZBTvj1JwAAAMI"]
[Thu Apr 09 22:49:58.377109 2026] [:error] [pid 24927:tid 24932] [client 4.232.89.114:34297] [client 4.232.89.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ade8ljXObuzEuw8mNJs2jAAAAQI"]
[Thu Apr 09 22:49:58.851651 2026] [:error] [pid 20837:tid 20850] [client 4.232.89.114:3161] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "ade8lvSL71FHZkjrGzMPoQAAAYs"]
[Thu Apr 09 22:49:59.321168 2026] [:error] [pid 24517:tid 24583] [client 4.232.89.114:55820] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "ade8l3boYEn2ZFM_PS-KcAAAAIk"]
[Thu Apr 09 22:49:59.790669 2026] [:error] [pid 20837:tid 20860] [client 4.232.89.114:3136] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "ade8l_SL71FHZkjrGzMPowAAAZU"]
[Thu Apr 09 22:50:00.276022 2026] [:error] [pid 24624:tid 24633] [client 4.232.89.114:32258] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "ade8mO4Jn-WvK1ZBTvj1NwAAAMc"]
[Thu Apr 09 22:50:00.755642 2026] [:error] [pid 24515:tid 24540] [client 4.232.89.114:34266] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "ade8mK1OMnvM2fMnB1PuuwAAABU"]
[Thu Apr 09 22:50:01.221676 2026] [:error] [pid 24515:tid 24543] [client 4.232.89.114:3779] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "ade8ma1OMnvM2fMnB1PuvQAAABg"]
[Thu Apr 09 22:50:01.687318 2026] [:error] [pid 24515:tid 24539] [client 4.232.89.114:3461] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "ade8ma1OMnvM2fMnB1PuwQAAABQ"]
[Thu Apr 09 22:50:02.156648 2026] [:error] [pid 20837:tid 20852] [client 4.232.89.114:51278] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "ade8mvSL71FHZkjrGzMPrQAAAY0"]
[Thu Apr 09 22:50:02.625631 2026] [:error] [pid 20837:tid 20858] [client 4.232.89.114:32292] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "ade8mvSL71FHZkjrGzMPsQAAAZM"]
[Thu Apr 09 22:50:03.092703 2026] [:error] [pid 24515:tid 24523] [client 4.232.89.114:4044] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "ade8m61OMnvM2fMnB1PuxwAAAAQ"]
[Thu Apr 09 22:50:03.574184 2026] [:error] [pid 24517:tid 24579] [client 4.232.89.114:34272] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "ade8m3boYEn2ZFM_PS-KfwAAAIU"]
[Thu Apr 09 22:50:03.992333 2026] [:error] [pid 63331:tid 63356] [client 43.153.74.75:33900] [client 43.153.74.75] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ade8mybKfIYuVjWbE4WaJQAAAdc"]
[Thu Apr 09 22:50:04.040810 2026] [:error] [pid 24927:tid 24947] [client 4.232.89.114:3482] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/prv8.php"] [unique_id "ade8nDXObuzEuw8mNJs2kQAAARE"]
[Thu Apr 09 22:50:04.509061 2026] [:error] [pid 63331:tid 63339] [client 4.232.89.114:3155] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/prv8.php"] [unique_id "ade8nCbKfIYuVjWbE4WaKgAAAcY"]
[Thu Apr 09 22:50:05.002902 2026] [:error] [pid 63331:tid 63336] [client 4.232.89.114:3143] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/prv8.php"] [unique_id "ade8nSbKfIYuVjWbE4WaLQAAAcM"]
[Thu Apr 09 22:50:05.495488 2026] [:error] [pid 63331:tid 63345] [client 4.232.89.114:32282] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/prv8.php"] [unique_id "ade8nSbKfIYuVjWbE4WaMAAAAcw"]
[Thu Apr 09 22:50:06.048987 2026] [:error] [pid 63331:tid 63346] [client 4.232.89.114:4087] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "ade8nibKfIYuVjWbE4WaMgAAAc0"]
[Thu Apr 09 22:50:06.604034 2026] [:error] [pid 20837:tid 20852] [client 4.232.89.114:34244] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "ade8nvSL71FHZkjrGzMPwAAAAY0"]
[Thu Apr 09 22:50:07.229634 2026] [:error] [pid 24927:tid 24946] [client 4.232.89.114:3152] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "ade8nzXObuzEuw8mNJs2mwAAARA"]
[Thu Apr 09 22:50:07.711021 2026] [:error] [pid 63331:tid 63338] [client 4.232.89.114:51291] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "ade8nybKfIYuVjWbE4WaNgAAAcU"]
[Thu Apr 09 22:50:08.267010 2026] [:error] [pid 24515:tid 24519] [client 4.232.89.114:4063] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev.php"] [unique_id "ade8oK1OMnvM2fMnB1Pu1wAAAAA"]
[Thu Apr 09 22:50:09.154922 2026] [:error] [pid 24515:tid 24540] [client 4.232.89.114:3184] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev.php"] [unique_id "ade8oa1OMnvM2fMnB1Pu3wAAABU"]
[Thu Apr 09 22:50:10.520599 2026] [:error] [pid 63331:tid 63345] [client 4.232.89.114:3486] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev.php"] [unique_id "ade8oibKfIYuVjWbE4WaQwAAAcw"]
[Thu Apr 09 22:50:14.056459 2026] [:error] [pid 24515:tid 24540] [client 4.232.89.114:32267] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev.php"] [unique_id "ade8pq1OMnvM2fMnB1PvAgAAABU"]
[Thu Apr 09 22:50:15.003018 2026] [:error] [pid 24517:tid 24595] [client 4.232.89.114:55849] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "ade8p3boYEn2ZFM_PS-KhAAAAJU"]
[Thu Apr 09 22:50:15.656748 2026] [:error] [pid 24515:tid 24528] [client 4.232.89.114:3197] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "ade8p61OMnvM2fMnB1PvFQAAAAk"]
[Thu Apr 09 22:50:16.141481 2026] [:error] [pid 63331:tid 63356] [client 4.232.89.114:51295] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "ade8qCbKfIYuVjWbE4WaUwAAAdc"]
[Thu Apr 09 22:50:16.617673 2026] [:error] [pid 63331:tid 63354] [client 4.232.89.114:3493] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "ade8qCbKfIYuVjWbE4WaWAAAAdU"]
[Thu Apr 09 22:50:17.103685 2026] [:error] [pid 24515:tid 24520] [client 4.232.89.114:4094] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "ade8qa1OMnvM2fMnB1PvGQAAAAE"]
[Thu Apr 09 22:50:17.616603 2026] [:error] [pid 63331:tid 63341] [client 4.232.89.114:55866] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "ade8qSbKfIYuVjWbE4WaXAAAAcg"]
[Thu Apr 09 22:50:18.194652 2026] [:error] [pid 20837:tid 20843] [client 4.232.89.114:32295] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "ade8qvSL71FHZkjrGzMP1QAAAYQ"]
[Thu Apr 09 22:50:18.765083 2026] [:error] [pid 63331:tid 63333] [client 4.232.89.114:3147] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "ade8qibKfIYuVjWbE4WaaAAAAcA"]
[Thu Apr 09 22:50:19.549574 2026] [:error] [pid 24515:tid 24542] [client 4.232.89.114:3818] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "ade8q61OMnvM2fMnB1PvIgAAABc"]
[Thu Apr 09 22:50:20.190521 2026] [:error] [pid 20837:tid 20845] [client 4.232.89.114:55821] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "ade8rPSL71FHZkjrGzMP3AAAAYY"]
[Thu Apr 09 22:50:20.713274 2026] [:error] [pid 24927:tid 24952] [client 4.232.89.114:51274] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "ade8rDXObuzEuw8mNJs2qAAAARY"]
[Thu Apr 09 22:50:21.261728 2026] [:error] [pid 24624:tid 24631] [client 4.232.89.114:3496] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "ade8re4Jn-WvK1ZBTvj1WwAAAMU"]
[Thu Apr 09 22:50:21.736686 2026] [:error] [pid 18477:tid 18484] [client 4.232.89.114:55850] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "ade8rcDe826HlFeoLPKs-AAAAUU"]
[Thu Apr 09 22:50:22.271044 2026] [:error] [pid 24516:tid 24553] [client 4.232.89.114:32276] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "ade8rthW7vSS-UkeWCU_DAAAAEY"]
[Thu Apr 09 22:50:22.928550 2026] [:error] [pid 24927:tid 24953] [client 4.232.89.114:51326] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "ade8rjXObuzEuw8mNJs2qwAAARc"]
[Thu Apr 09 22:50:23.584039 2026] [:error] [pid 24927:tid 24933] [client 4.232.89.114:3541] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "ade8rzXObuzEuw8mNJs2rQAAAQM"]
[Thu Apr 09 22:50:34.298963 2026] [:error] [pid 63331:tid 63355] [client 4.232.89.114:55845] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file21.php"] [unique_id "ade8uibKfIYuVjWbE4WaoQAAAdY"]
[Thu Apr 09 22:50:34.822719 2026] [:error] [pid 24515:tid 24520] [client 4.232.89.114:3510] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file21.php"] [unique_id "ade8uq1OMnvM2fMnB1PvdQAAAAE"]
[Thu Apr 09 22:50:35.315557 2026] [:error] [pid 24515:tid 24519] [client 4.232.89.114:49604] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file21.php"] [unique_id "ade8u61OMnvM2fMnB1PveQAAAAA"]
[Thu Apr 09 22:50:35.791363 2026] [:error] [pid 24624:tid 24627] [client 4.232.89.114:3488] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file21.php"] [unique_id "ade8u-4Jn-WvK1ZBTvj1bgAAAME"]
[Thu Apr 09 22:50:36.268961 2026] [:error] [pid 20837:tid 20860] [client 4.232.89.114:3515] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "ade8vPSL71FHZkjrGzMP8wAAAZU"]
[Thu Apr 09 22:50:36.782168 2026] [:error] [pid 63331:tid 63337] [client 4.232.89.114:34286] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "ade8vCbKfIYuVjWbE4WaowAAAcQ"]
[Thu Apr 09 22:50:37.273819 2026] [:error] [pid 63331:tid 63342] [client 4.232.89.114:32313] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "ade8vSbKfIYuVjWbE4WaqAAAAck"]
[Thu Apr 09 22:50:37.750910 2026] [:error] [pid 63331:tid 63340] [client 4.232.89.114:3501] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "ade8vSbKfIYuVjWbE4WaqwAAAcc"]
[Thu Apr 09 22:50:38.249585 2026] [:error] [pid 63331:tid 63346] [client 4.232.89.114:3166] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "ade8vibKfIYuVjWbE4WargAAAc0"]
[Thu Apr 09 22:50:38.768246 2026] [:error] [pid 63331:tid 63336] [client 4.232.89.114:3664] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "ade8vibKfIYuVjWbE4WatQAAAcM"]
[Thu Apr 09 22:50:39.263738 2026] [:error] [pid 63331:tid 63341] [client 4.232.89.114:55811] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "ade8vybKfIYuVjWbE4WauAAAAcg"]
[Thu Apr 09 22:50:39.783945 2026] [:error] [pid 24927:tid 24931] [client 4.232.89.114:3492] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "ade8vzXObuzEuw8mNJs2twAAAQE"]
[Thu Apr 09 22:50:40.251124 2026] [:error] [pid 63331:tid 63350] [client 4.232.89.114:55847] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "ade8wCbKfIYuVjWbE4WavgAAAdE"]
[Thu Apr 09 22:50:40.740443 2026] [:error] [pid 24516:tid 24548] [client 4.232.89.114:4092] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "ade8wNhW7vSS-UkeWCU_GAAAAEE"]
[Thu Apr 09 22:50:41.235676 2026] [:error] [pid 63331:tid 63345] [client 4.232.89.114:4049] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "ade8wSbKfIYuVjWbE4WawQAAAcw"]
[Thu Apr 09 22:50:41.706093 2026] [:error] [pid 24515:tid 24519] [client 4.232.89.114:49615] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "ade8wa1OMnvM2fMnB1PvgwAAAAA"]
[Thu Apr 09 22:50:42.215169 2026] [:error] [pid 24515:tid 24524] [client 4.232.89.114:4036] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "ade8wq1OMnvM2fMnB1PviAAAAAU"]
[Thu Apr 09 22:50:42.720154 2026] [:error] [pid 18477:tid 18497] [client 4.232.89.114:3165] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "ade8wsDe826HlFeoLPKtEAAAAVI"]
[Thu Apr 09 22:50:43.247852 2026] [:error] [pid 24515:tid 24539] [client 4.232.89.114:32302] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "ade8w61OMnvM2fMnB1PvjQAAABQ"]
[Thu Apr 09 22:50:43.763632 2026] [:error] [pid 24515:tid 24536] [client 4.232.89.114:3663] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "ade8w61OMnvM2fMnB1PvkQAAABE"]
[Thu Apr 09 22:50:44.246778 2026] [:error] [pid 63331:tid 63342] [client 4.232.89.114:49612] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cabs.php"] [unique_id "ade8xCbKfIYuVjWbE4WazwAAAck"]
[Thu Apr 09 22:50:44.739338 2026] [:error] [pid 63331:tid 63340] [client 4.232.89.114:34300] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cabs.php"] [unique_id "ade8xCbKfIYuVjWbE4Wa0QAAAcc"]
[Thu Apr 09 22:50:45.232342 2026] [:error] [pid 24515:tid 24534] [client 4.232.89.114:3812] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cabs.php"] [unique_id "ade8xa1OMnvM2fMnB1PvmwAAAA8"]
[Thu Apr 09 22:50:45.718546 2026] [:error] [pid 24515:tid 24539] [client 4.232.89.114:3465] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cabs.php"] [unique_id "ade8xa1OMnvM2fMnB1PvnwAAABQ"]
[Thu Apr 09 22:50:46.193513 2026] [:error] [pid 20837:tid 20852] [client 4.232.89.114:51302] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "ade8xvSL71FHZkjrGzMP-wAAAY0"]
[Thu Apr 09 22:50:46.724352 2026] [:error] [pid 20837:tid 20850] [client 4.232.89.114:3513] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "ade8xvSL71FHZkjrGzMP_QAAAYs"]
[Thu Apr 09 22:50:47.260482 2026] [:error] [pid 63331:tid 63357] [client 4.232.89.114:3466] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "ade8xybKfIYuVjWbE4Wa2gAAAdg"]
[Thu Apr 09 22:50:47.869103 2026] [:error] [pid 24515:tid 24524] [client 4.232.89.114:55833] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "ade8x61OMnvM2fMnB1PvqwAAAAU"]
[Thu Apr 09 22:50:48.353499 2026] [:error] [pid 24515:tid 24537] [client 4.232.89.114:51280] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1da.php"] [unique_id "ade8yK1OMnvM2fMnB1PvrwAAABI"]
[Thu Apr 09 22:50:48.828828 2026] [:error] [pid 24515:tid 24542] [client 4.232.89.114:4065] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1da.php"] [unique_id "ade8yK1OMnvM2fMnB1PvswAAABc"]
[Thu Apr 09 22:50:49.328478 2026] [:error] [pid 24515:tid 24530] [client 4.232.89.114:4034] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1da.php"] [unique_id "ade8ya1OMnvM2fMnB1PvuwAAAAs"]
[Thu Apr 09 22:50:49.830916 2026] [:error] [pid 24515:tid 24537] [client 4.232.89.114:3472] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1da.php"] [unique_id "ade8ya1OMnvM2fMnB1PvvgAAABI"]
[Thu Apr 09 22:50:50.321881 2026] [:error] [pid 24515:tid 24527] [client 4.232.89.114:4048] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "ade8yq1OMnvM2fMnB1PvxAAAAAg"]
[Thu Apr 09 22:50:50.798824 2026] [:error] [pid 20837:tid 20858] [client 4.232.89.114:4079] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "ade8yvSL71FHZkjrGzMQAgAAAZM"]
[Thu Apr 09 22:50:51.294696 2026] [:error] [pid 20837:tid 20848] [client 4.232.89.114:3475] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "ade8y_SL71FHZkjrGzMQBAAAAYk"]
[Thu Apr 09 22:50:51.796602 2026] [:error] [pid 63331:tid 63344] [client 4.232.89.114:4040] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "ade8yybKfIYuVjWbE4Wa4gAAAcs"]
[Thu Apr 09 22:50:52.283100 2026] [:error] [pid 24515:tid 24535] [client 4.232.89.114:3457] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "ade8zK1OMnvM2fMnB1PvzAAAABA"]
[Thu Apr 09 22:50:52.786209 2026] [:error] [pid 24515:tid 24533] [client 4.232.89.114:4062] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "ade8zK1OMnvM2fMnB1Pv0gAAAA4"]
[Thu Apr 09 22:50:53.339411 2026] [:error] [pid 24515:tid 24529] [client 4.232.89.114:3552] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "ade8za1OMnvM2fMnB1Pv1gAAAAo"]
[Thu Apr 09 22:50:53.845802 2026] [:error] [pid 24624:tid 24641] [client 4.232.89.114:3506] [client 4.232.89.114] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "ade8ze4Jn-WvK1ZBTvj1fQAAAM8"]
[Fri Apr 10 00:11:46.150694 2026] [:error] [pid 63331:tid 63338] [client 62.60.131.159:7642] [client 62.60.131.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adfPwibKfIYuVjWbE4WyQgAAAcU"]
[Fri Apr 10 00:11:48.626644 2026] [:error] [pid 24517:tid 24587] [client 62.60.131.159:7590] [client 62.60.131.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adfPxHboYEn2ZFM_PS-RnAAAAI0"]
[Fri Apr 10 00:11:49.158779 2026] [:error] [pid 24927:tid 24952] [client 62.60.131.159:7628] [client 62.60.131.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adfPxTXObuzEuw8mNJtCAQAAARY"]
[Fri Apr 10 00:11:49.208008 2026] [:error] [pid 20837:tid 20843] [client 62.60.131.159:7660] [client 62.60.131.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adfPxfSL71FHZkjrGzMhkgAAAYQ"]
[Fri Apr 10 00:11:50.448689 2026] [:error] [pid 24927:tid 24949] [client 62.60.131.159:7600] [client 62.60.131.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adfPxjXObuzEuw8mNJtCAgAAARM"]
[Fri Apr 10 00:11:51.350802 2026] [:error] [pid 24517:tid 24574] [client 62.60.131.159:7576] [client 62.60.131.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adfPx3boYEn2ZFM_PS-RpQAAAIA"]
[Fri Apr 10 00:11:51.904920 2026] [:error] [pid 18477:tid 18503] [client 62.60.131.159:47478] [client 62.60.131.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adfPx8De826HlFeoLPK1vAAAAVg"]
[Fri Apr 10 00:11:51.907753 2026] [:error] [pid 24624:tid 24637] [client 62.60.131.159:47488] [client 62.60.131.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adfPx-4Jn-WvK1ZBTvgEVQAAAMs"]
[Fri Apr 10 00:11:52.706045 2026] [:error] [pid 18477:tid 18495] [client 62.60.131.159:47494] [client 62.60.131.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adfPyMDe826HlFeoLPK1vgAAAVA"]
[Fri Apr 10 00:11:54.895647 2026] [:error] [pid 24516:tid 24570] [client 62.60.131.159:47522] [client 62.60.131.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adfPythW7vSS-UkeWCVHaQAAAFc"]
[Fri Apr 10 00:11:54.895651 2026] [:error] [pid 63331:tid 63352] [client 62.60.131.159:47534] [client 62.60.131.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adfPyibKfIYuVjWbE4WyUQAAAdM"]
[Fri Apr 10 00:11:56.179811 2026] [:error] [pid 24927:tid 24933] [client 62.60.131.159:47550] [client 62.60.131.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adfPzDXObuzEuw8mNJtCDgAAAQM"]
[Fri Apr 10 00:11:56.897962 2026] [:error] [pid 24927:tid 24934] [client 62.60.131.159:47558] [client 62.60.131.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adfPzDXObuzEuw8mNJtCFQAAAQQ"]
[Fri Apr 10 00:11:58.782592 2026] [:error] [pid 24516:tid 24560] [client 62.60.131.159:47576] [client 62.60.131.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/..;/"] [unique_id "adfPzthW7vSS-UkeWCVHawAAAE0"]
[Fri Apr 10 00:11:58.802859 2026] [:error] [pid 20837:tid 20858] [client 62.60.131.159:47562] [client 62.60.131.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adfPzvSL71FHZkjrGzMhngAAAZM"]
[Fri Apr 10 00:11:59.102469 2026] [:error] [pid 24624:tid 24650] [client 62.60.131.159:47582] [client 62.60.131.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adfPz-4Jn-WvK1ZBTvgEXAAAANg"]
[Fri Apr 10 00:12:01.323744 2026] [:error] [pid 18477:tid 18480] [client 62.60.131.159:29034] [client 62.60.131.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/..;/"] [unique_id "adfP0cDe826HlFeoLPK1zAAAAUE"]
[Fri Apr 10 00:12:03.536220 2026] [:error] [pid 24927:tid 24952] [client 62.60.131.159:29038] [client 62.60.131.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adfP0zXObuzEuw8mNJtCIQAAARY"]
[Fri Apr 10 00:12:04.608546 2026] [:error] [pid 18477:tid 18492] [client 62.60.131.159:29042] [client 62.60.131.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/..;/"] [unique_id "adfP1MDe826HlFeoLPK1zwAAAU0"]
[Fri Apr 10 00:12:09.659364 2026] [:error] [pid 63331:tid 63342] [client 62.60.131.159:34726] [client 62.60.131.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/..;/"] [unique_id "adfP2SbKfIYuVjWbE4WyaAAAAck"]
[Fri Apr 10 02:00:43.025199 2026] [:error] [pid 36399:tid 36464] [client 43.159.152.187:50550] [client 43.159.152.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adfpS68Hkxpyh6_TlVQ8GAAAAIk"]
[Fri Apr 10 06:59:28.919107 2026] [:error] [pid 12575:tid 12629] [client 4.204.215.156:63534] [client 4.204.215.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adgvUCjFTOT5X6zsPClSlwAAAEc"]
[Fri Apr 10 06:59:31.553297 2026] [:error] [pid 12574:tid 12610] [client 4.204.215.156:63564] [client 4.204.215.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adgvU3w-1tvJISKJyrTc_gAAABA"]
[Fri Apr 10 06:59:36.966757 2026] [:error] [pid 59144:tid 59159] [client 4.204.215.156:63529] [client 4.204.215.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adgvWBta6MlufQo3_or0CQAAAU0"]
[Fri Apr 10 07:46:08.660452 2026] [:error] [pid 12685:tid 12710] [client 116.206.156.107:18495] [client 116.206.156.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.206.156.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adg6QM8f5ssYShsynaqWSwAAANc"], referer: https://expressinteriors.com/
[Fri Apr 10 08:01:10.290520 2026] [:error] [pid 59098:tid 59117] [client 43.173.1.69:34460] [client 43.173.1.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adg9xiZshs05JVy8bJ4jUgAAARA"]
[Fri Apr 10 10:36:14.061988 2026] [:error] [pid 13189:tid 13202] [client 43.130.139.177:56490] [client 43.130.139.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adhiHpAxiJKPums3eBAKAgAAAEo"]
[Fri Apr 10 10:44:51.949577 2026] [:error] [pid 13101:tid 13133] [client 136.112.9.246:63352] [client 136.112.9.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.9.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adhkI98Ldw85818pj2rRWgAAAIA"]
[Fri Apr 10 10:44:54.088950 2026] [:error] [pid 13101:tid 13140] [client 136.112.9.246:63352] [client 136.112.9.246] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "adhkJt8Ldw85818pj2rRYAAAAIc"]
[Fri Apr 10 10:44:54.282335 2026] [:error] [pid 13101:tid 13148] [client 136.112.9.246:63352] [client 136.112.9.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.9.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adhkJt8Ldw85818pj2rRYQAAAI8"]
[Fri Apr 10 10:44:56.099310 2026] [:error] [pid 13102:tid 13183] [client 136.112.9.246:55681] [client 136.112.9.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.9.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adhkKP9xLvjW2guI55ZRVQAAABc"]
[Fri Apr 10 10:44:58.219724 2026] [:error] [pid 13189:tid 13215] [client 136.112.9.246:62778] [client 136.112.9.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.9.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adhkKpAxiJKPums3eBARQgAAAFc"]
[Fri Apr 10 10:45:00.252344 2026] [:error] [pid 13189:tid 13204] [client 136.112.9.246:51776] [client 136.112.9.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.9.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adhkLJAxiJKPums3eBARRgAAAEw"]
[Fri Apr 10 10:45:02.937730 2026] [:error] [pid 13102:tid 13181] [client 136.112.9.246:60738] [client 136.112.9.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.9.246, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adhkLv9xLvjW2guI55ZRXwAAABU"]
[Fri Apr 10 10:45:02.937908 2026] [:error] [pid 13102:tid 13181] [client 136.112.9.246:60738] [client 136.112.9.246] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 136.112.9.246, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adhkLv9xLvjW2guI55ZRXwAAABU"]
[Fri Apr 10 13:54:56.701578 2026] [:error] [pid 13101:tid 13157] [client 43.156.202.34:57568] [client 43.156.202.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adiQsN8Ldw85818pj2ooRgAAAJg"]
[Fri Apr 10 14:05:30.754737 2026] [:error] [pid 13101:tid 13135] [client 24.98.60.173:55954] [client 24.98.60.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.98.60.173, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adiTKt8Ldw85818pj2orVQAAAII"]
[Fri Apr 10 16:09:29.641569 2026] [:error] [pid 13100:tid 13105] [client 193.189.100.195:64343] [client 193.189.100.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php.ca"] [unique_id "adiwOVzg-ZkZ0InWIP1OQAAAAQA"]
[Fri Apr 10 17:15:44.721302 2026] [:error] [pid 13101:tid 13148] [client 161.97.77.0:45788] [client 161.97.77.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.97.77.0, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adi_wN8Ldw85818pj2p7rwAAAI8"]
[Fri Apr 10 17:15:45.741395 2026] [:error] [pid 13101:tid 13137] [client 161.97.77.0:45788] [client 161.97.77.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.97.77.0, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adi_wd8Ldw85818pj2p7tQAAAIQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 10 17:18:42.066535 2026] [:error] [pid 13102:tid 13170] [client 122.128.111.29:58974] [client 122.128.111.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 122.128.111.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adjAcv9xLvjW2guI55Y0HAAAAAo"]
[Fri Apr 10 17:36:39.588741 2026] [:error] [pid 13189:tid 13213] [client 216.250.12.125:41402] [client 216.250.12.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.250.12.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adjEp5AxiJKPums3eBBPawAAAFU"]
[Fri Apr 10 17:36:40.863216 2026] [:error] [pid 13189:tid 13199] [client 216.250.12.125:41402] [client 216.250.12.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.250.12.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adjEqJAxiJKPums3eBBPdQAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 10 18:00:39.815827 2026] [:error] [pid 3934:tid 3942] [client 122.117.193.160:60192] [client 122.117.193.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 122.117.193.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adjKR4a41m-BS8mg82d4JQAAAMM"]
[Fri Apr 10 18:00:41.081752 2026] [:error] [pid 3934:tid 3959] [client 122.117.193.160:60192] [client 122.117.193.160] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 122.117.193.160, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adjKSYa41m-BS8mg82d4NgAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 10 18:01:15.468800 2026] [ssl:error] [pid 3934:tid 3956] [client 104.168.98.195:35968] AH02032: Hostname www.cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup, referer: http://www.cdbdinteriors.com.au/
[Fri Apr 10 18:09:25.002222 2026] [:error] [pid 13102:tid 13174] [client 180.110.203.108:44645] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adjMVP9xLvjW2guI55ZTOwAAAA4"]
[Fri Apr 10 19:07:22.949696 2026] [:error] [pid 25984:tid 26004] [client 139.59.37.0:58102] [client 139.59.37.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 139.59.37.0, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adjZ6rsdbY_MC14OH16jKwAAAU8"]
[Fri Apr 10 19:07:24.097628 2026] [:error] [pid 25984:tid 26013] [client 139.59.37.0:58102] [client 139.59.37.0] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 139.59.37.0, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adjZ7LsdbY_MC14OH16jMgAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 10 19:08:09.433366 2026] [:error] [pid 25984:tid 26002] [client 94.247.172.129:36052] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adjaGbsdbY_MC14OH16j1AAAAU0"]
[Fri Apr 10 19:19:08.458180 2026] [:error] [pid 13100:tid 13120] [client 159.223.76.255:44806] [client 159.223.76.255] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.223.76.255, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adjcrFzg-ZkZ0InWIP2XdQAAAQ8"]
[Fri Apr 10 19:19:11.309665 2026] [:error] [pid 25984:tid 25993] [client 159.223.76.255:44812] [client 159.223.76.255] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.223.76.255, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adjcr7sdbY_MC14OH16vfwAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 10 22:23:06.070157 2026] [:error] [pid 13101:tid 13153] [client 50.6.138.81:32200] [client 50.6.138.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.138.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adkHyt8Ldw85818pj2r1DQAAAJQ"]
[Fri Apr 10 22:23:09.796225 2026] [:error] [pid 13101:tid 13155] [client 50.6.138.81:32204] [client 50.6.138.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.138.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adkHzd8Ldw85818pj2r1GAAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 10 22:40:10.920186 2026] [:error] [pid 62884:tid 62909] [client 143.198.210.125:59846] [client 143.198.210.125] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adkLyuUCK1xrhnnmpo2P_gAAAtI"]
[Fri Apr 10 22:40:13.397240 2026] [:error] [pid 13101:tid 13147] [client 178.128.89.25:47712] [client 178.128.89.25] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adkLzd8Ldw85818pj2oAEgAAAI4"]
[Fri Apr 10 22:41:49.068174 2026] [:error] [pid 62769:tid 62780] [client 172.213.241.33:46792] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nwflm.php"] [unique_id "adkMLcWsSnfLoB8ifjCOsgAAAkk"]
[Fri Apr 10 22:41:49.560055 2026] [:error] [pid 13101:tid 13141] [client 172.213.241.33:54034] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nwflm.php"] [unique_id "adkMLd8Ldw85818pj2oBIwAAAIg"]
[Fri Apr 10 22:41:50.053608 2026] [:error] [pid 13189:tid 13208] [client 172.213.241.33:53483] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nwflm.php"] [unique_id "adkMLpAxiJKPums3eBDlvwAAAFA"]
[Fri Apr 10 22:41:50.540414 2026] [:error] [pid 13189:tid 13204] [client 172.213.241.33:55951] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nwflm.php"] [unique_id "adkMLpAxiJKPums3eBDlxQAAAEw"]
[Fri Apr 10 22:41:51.110571 2026] [:error] [pid 62769:tid 62791] [client 172.213.241.33:46815] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "adkML8WsSnfLoB8ifjCOuAAAAlQ"]
[Fri Apr 10 22:41:51.862556 2026] [:error] [pid 62769:tid 62775] [client 172.213.241.33:51067] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "adkML8WsSnfLoB8ifjCOvwAAAkQ"]
[Fri Apr 10 22:41:52.475608 2026] [:error] [pid 62769:tid 62776] [client 172.213.241.33:44973] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "adkMMMWsSnfLoB8ifjCOyAAAAkU"]
[Fri Apr 10 22:41:53.148342 2026] [:error] [pid 63062:tid 63080] [client 172.213.241.33:44968] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "adkMMZ2HtsmV85NqkMcBrQAAA5A"]
[Fri Apr 10 22:41:53.677498 2026] [:error] [pid 62769:tid 62773] [client 172.213.241.33:44988] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "adkMMcWsSnfLoB8ifjCOzgAAAkI"]
[Fri Apr 10 22:41:54.251113 2026] [:error] [pid 62769:tid 62791] [client 172.213.241.33:53488] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "adkMMsWsSnfLoB8ifjCO1gAAAlQ"]
[Fri Apr 10 22:41:54.736635 2026] [:error] [pid 62769:tid 62790] [client 172.213.241.33:55997] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "adkMMsWsSnfLoB8ifjCO2wAAAlM"]
[Fri Apr 10 22:41:55.218477 2026] [:error] [pid 62819:tid 62844] [client 172.213.241.33:51051] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "adkMM_U20EyPf7Nlsld4TQAAApY"]
[Fri Apr 10 22:41:55.735292 2026] [:error] [pid 62819:tid 62837] [client 172.213.241.33:51662] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "adkMM_U20EyPf7Nlsld4TwAAAo8"]
[Fri Apr 10 22:41:56.197892 2026] [:error] [pid 62769:tid 62782] [client 172.213.241.33:61453] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "adkMNMWsSnfLoB8ifjCO5gAAAks"]
[Fri Apr 10 22:41:56.662718 2026] [:error] [pid 62769:tid 62778] [client 172.213.241.33:61468] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "adkMNMWsSnfLoB8ifjCO6wAAAkc"]
[Fri Apr 10 22:41:57.147428 2026] [:error] [pid 13189:tid 13198] [client 172.213.241.33:46788] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "adkMNZAxiJKPums3eBDl0gAAAEY"]
[Fri Apr 10 22:41:57.655018 2026] [:error] [pid 13101:tid 13136] [client 172.213.241.33:51703] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "adkMNd8Ldw85818pj2oBLwAAAIM"]
[Fri Apr 10 22:41:58.221790 2026] [:error] [pid 13101:tid 13142] [client 172.213.241.33:62804] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "adkMNt8Ldw85818pj2oBMQAAAIk"]
[Fri Apr 10 22:41:58.730619 2026] [:error] [pid 63134:tid 63143] [client 172.213.241.33:51652] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "adkMNtFALqPDwWi6eJK4gAAAA8Y"]
[Fri Apr 10 22:41:59.194684 2026] [:error] [pid 13100:tid 13122] [client 172.213.241.33:55986] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "adkMN1zg-ZkZ0InWIP3JNgAAARE"]
[Fri Apr 10 22:41:59.678523 2026] [:error] [pid 62884:tid 62894] [client 172.213.241.33:54066] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "adkMN-UCK1xrhnnmpo2QVwAAAsM"]
[Fri Apr 10 22:42:00.365566 2026] [:error] [pid 62769:tid 62782] [client 172.213.241.33:44952] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "adkMOMWsSnfLoB8ifjCO8gAAAks"]
[Fri Apr 10 22:42:01.087615 2026] [:error] [pid 13189:tid 13194] [client 172.213.241.33:53497] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "adkMOZAxiJKPums3eBDl4QAAAEI"]
[Fri Apr 10 22:42:01.810461 2026] [:error] [pid 63134:tid 63150] [client 172.213.241.33:62844] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "adkMOdFALqPDwWi6eJK4ggAAA80"]
[Fri Apr 10 22:42:02.277379 2026] [:error] [pid 13189:tid 13205] [client 172.213.241.33:55940] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "adkMOpAxiJKPums3eBDl6gAAAE0"]
[Fri Apr 10 22:42:02.825048 2026] [:error] [pid 62769:tid 62771] [client 172.213.241.33:55968] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "adkMOsWsSnfLoB8ifjCO9wAAAkA"]
[Fri Apr 10 22:42:03.404643 2026] [:error] [pid 13189:tid 13208] [client 172.213.241.33:51064] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "adkMO5AxiJKPums3eBDl7wAAAFA"]
[Fri Apr 10 22:42:03.876035 2026] [:error] [pid 62769:tid 62787] [client 172.213.241.33:46843] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "adkMO8WsSnfLoB8ifjCO_AAAAlA"]
[Fri Apr 10 22:42:04.415626 2026] [:error] [pid 62769:tid 62776] [client 172.213.241.33:44929] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/water.php"] [unique_id "adkMPMWsSnfLoB8ifjCO_wAAAkU"]
[Fri Apr 10 22:42:05.141074 2026] [:error] [pid 62769:tid 62772] [client 172.213.241.33:46827] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/water.php"] [unique_id "adkMPcWsSnfLoB8ifjCPCQAAAkE"]
[Fri Apr 10 22:42:05.633297 2026] [:error] [pid 63062:tid 63070] [client 172.213.241.33:51706] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/water.php"] [unique_id "adkMPZ2HtsmV85NqkMcBrwAAA4Y"]
[Fri Apr 10 22:42:06.167808 2026] [:error] [pid 13189:tid 13202] [client 172.213.241.33:53499] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/water.php"] [unique_id "adkMPpAxiJKPums3eBDl-AAAAEo"]
[Fri Apr 10 22:42:06.684513 2026] [:error] [pid 62819:tid 62836] [client 172.213.241.33:54030] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggb.php"] [unique_id "adkMPvU20EyPf7Nlsld4VwAAAo4"]
[Fri Apr 10 22:42:07.509912 2026] [:error] [pid 13101:tid 13145] [client 172.213.241.33:51650] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggb.php"] [unique_id "adkMP98Ldw85818pj2oBTgAAAIw"]
[Fri Apr 10 22:42:08.150339 2026] [:error] [pid 62769:tid 62784] [client 172.213.241.33:54038] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggb.php"] [unique_id "adkMQMWsSnfLoB8ifjCPEwAAAk0"]
[Fri Apr 10 22:42:08.870838 2026] [:error] [pid 13189:tid 13211] [client 172.213.241.33:46832] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggb.php"] [unique_id "adkMQJAxiJKPums3eBDl_AAAAFM"]
[Fri Apr 10 22:42:09.583522 2026] [:error] [pid 62651:tid 62661] [client 172.213.241.33:44974] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "adkMQTbAH0le57SIaqwwNAAAAcg"]
[Fri Apr 10 22:42:10.145760 2026] [:error] [pid 13189:tid 13216] [client 172.213.241.33:62818] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "adkMQpAxiJKPums3eBDmBQAAAFg"]
[Fri Apr 10 22:42:10.643012 2026] [:error] [pid 13189:tid 13197] [client 172.213.241.33:44958] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "adkMQpAxiJKPums3eBDmCwAAAEU"]
[Fri Apr 10 22:42:11.130674 2026] [:error] [pid 13100:tid 13108] [client 172.213.241.33:62795] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "adkMQ1zg-ZkZ0InWIP3JQwAAAQM"]
[Fri Apr 10 22:42:11.647772 2026] [:error] [pid 13100:tid 13115] [client 172.213.241.33:55943] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wert.php"] [unique_id "adkMQ1zg-ZkZ0InWIP3JSAAAAQo"]
[Fri Apr 10 22:42:12.188417 2026] [:error] [pid 62710:tid 62727] [client 172.213.241.33:62845] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wert.php"] [unique_id "adkMROME7qrf5xEWWJsxxgAAAg4"]
[Fri Apr 10 22:42:12.746181 2026] [:error] [pid 62769:tid 62785] [client 172.213.241.33:62787] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wert.php"] [unique_id "adkMRMWsSnfLoB8ifjCPIAAAAk4"]
[Fri Apr 10 22:42:13.241918 2026] [:error] [pid 62769:tid 62782] [client 172.213.241.33:46818] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wert.php"] [unique_id "adkMRcWsSnfLoB8ifjCPJgAAAks"]
[Fri Apr 10 22:42:13.761934 2026] [:error] [pid 62769:tid 62786] [client 172.213.241.33:53501] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "adkMRcWsSnfLoB8ifjCPKgAAAk8"]
[Fri Apr 10 22:42:14.265598 2026] [:error] [pid 13189:tid 13197] [client 172.213.241.33:55971] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "adkMRpAxiJKPums3eBDmGQAAAEU"]
[Fri Apr 10 22:42:14.739419 2026] [:error] [pid 62769:tid 62779] [client 172.213.241.33:51669] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "adkMRsWsSnfLoB8ifjCPMgAAAkg"]
[Fri Apr 10 22:42:15.255169 2026] [:error] [pid 62710:tid 62716] [client 172.213.241.33:62811] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "adkMR-ME7qrf5xEWWJsxygAAAgM"]
[Fri Apr 10 22:42:15.820450 2026] [:error] [pid 13101:tid 13147] [client 172.213.241.33:51029] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "adkMR98Ldw85818pj2oBUwAAAI4"]
[Fri Apr 10 22:42:16.325529 2026] [:error] [pid 13100:tid 13114] [client 172.213.241.33:55963] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "adkMSFzg-ZkZ0InWIP3JTgAAAQk"]
[Fri Apr 10 22:42:16.834616 2026] [:error] [pid 13101:tid 13144] [client 172.213.241.33:62828] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "adkMSN8Ldw85818pj2oBWAAAAIs"]
[Fri Apr 10 22:42:17.304111 2026] [:error] [pid 13101:tid 13136] [client 172.213.241.33:51060] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "adkMSd8Ldw85818pj2oBXQAAAIM"]
[Fri Apr 10 22:42:17.784614 2026] [:error] [pid 62710:tid 62735] [client 172.213.241.33:54044] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oij98gy.php"] [unique_id "adkMSeME7qrf5xEWWJsx1AAAAhY"]
[Fri Apr 10 22:42:18.317657 2026] [:error] [pid 62710:tid 62724] [client 172.213.241.33:47128] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oij98gy.php"] [unique_id "adkMSuME7qrf5xEWWJsx1wAAAgs"]
[Fri Apr 10 22:42:18.888779 2026] [:error] [pid 13101:tid 13150] [client 172.213.241.33:55982] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oij98gy.php"] [unique_id "adkMSt8Ldw85818pj2oBYQAAAJE"]
[Fri Apr 10 22:42:19.363800 2026] [:error] [pid 62710:tid 62734] [client 172.213.241.33:51018] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oij98gy.php"] [unique_id "adkMS-ME7qrf5xEWWJsx4AAAAhU"]
[Fri Apr 10 22:42:19.872121 2026] [:error] [pid 13101:tid 13140] [client 172.213.241.33:46808] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "adkMS98Ldw85818pj2oBZgAAAIc"]
[Fri Apr 10 22:42:20.401457 2026] [:error] [pid 13189:tid 13207] [client 172.213.241.33:54069] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "adkMTJAxiJKPums3eBDmJAAAAE8"]
[Fri Apr 10 22:42:20.894420 2026] [:error] [pid 62819:tid 62846] [client 172.213.241.33:51031] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "adkMTPU20EyPf7Nlsld4WwAAApg"]
[Fri Apr 10 22:42:21.418689 2026] [:error] [pid 62884:tid 62907] [client 172.213.241.33:51692] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "adkMTeUCK1xrhnnmpo2QXwAAAtA"]
[Fri Apr 10 22:42:21.901932 2026] [:error] [pid 63062:tid 63088] [client 172.213.241.33:53443] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/turkshell.php"] [unique_id "adkMTZ2HtsmV85NqkMcBuAAAA5g"]
[Fri Apr 10 22:42:22.395223 2026] [:error] [pid 62769:tid 62784] [client 172.213.241.33:57903] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/turkshell.php"] [unique_id "adkMTsWsSnfLoB8ifjCPOAAAAk0"]
[Fri Apr 10 22:42:22.870761 2026] [:error] [pid 13189:tid 13215] [client 172.213.241.33:46799] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/turkshell.php"] [unique_id "adkMTpAxiJKPums3eBDmMAAAAFc"]
[Fri Apr 10 22:42:23.427338 2026] [:error] [pid 62769:tid 62777] [client 172.213.241.33:62816] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/turkshell.php"] [unique_id "adkMT8WsSnfLoB8ifjCPOgAAAkY"]
[Fri Apr 10 22:42:23.968871 2026] [:error] [pid 13101:tid 13155] [client 172.213.241.33:46787] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tea.php"] [unique_id "adkMT98Ldw85818pj2oBbAAAAJY"]
[Fri Apr 10 22:42:24.437899 2026] [:error] [pid 13189:tid 13206] [client 172.213.241.33:54043] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tea.php"] [unique_id "adkMUJAxiJKPums3eBDmNwAAAE4"]
[Fri Apr 10 22:42:24.998494 2026] [:error] [pid 13100:tid 13108] [client 172.213.241.33:44991] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tea.php"] [unique_id "adkMUFzg-ZkZ0InWIP3JTwAAAQM"]
[Fri Apr 10 22:42:25.497464 2026] [:error] [pid 13189:tid 13210] [client 172.213.241.33:44948] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tea.php"] [unique_id "adkMUZAxiJKPums3eBDmQQAAAFI"]
[Fri Apr 10 22:42:25.984210 2026] [:error] [pid 62651:tid 62658] [client 172.213.241.33:54041] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/seo.php"] [unique_id "adkMUTbAH0le57SIaqwwPQAAAcU"]
[Fri Apr 10 22:42:26.491577 2026] [:error] [pid 13189:tid 13209] [client 172.213.241.33:62791] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/seo.php"] [unique_id "adkMUpAxiJKPums3eBDmSwAAAFE"]
[Fri Apr 10 22:42:26.996728 2026] [:error] [pid 13101:tid 13135] [client 172.213.241.33:55950] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/seo.php"] [unique_id "adkMUt8Ldw85818pj2oBdQAAAII"]
[Fri Apr 10 22:42:27.557569 2026] [:error] [pid 13100:tid 13115] [client 172.213.241.33:44977] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/seo.php"] [unique_id "adkMU1zg-ZkZ0InWIP3JUAAAAQo"]
[Fri Apr 10 22:42:28.029310 2026] [:error] [pid 63134:tid 63154] [client 172.213.241.33:53474] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "adkMVNFALqPDwWi6eJK4oQAAA9E"]
[Fri Apr 10 22:42:28.503286 2026] [:error] [pid 63134:tid 63159] [client 172.213.241.33:46800] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "adkMVNFALqPDwWi6eJK4ogAAA9Y"]
[Fri Apr 10 22:42:29.016744 2026] [:error] [pid 62819:tid 62831] [client 172.213.241.33:51688] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "adkMVfU20EyPf7Nlsld4XwAAAok"]
[Fri Apr 10 22:42:29.521346 2026] [:error] [pid 62884:tid 62891] [client 172.213.241.33:44942] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "adkMVeUCK1xrhnnmpo2QbAAAAsA"]
[Fri Apr 10 22:42:30.113312 2026] [:error] [pid 13189:tid 13208] [client 172.213.241.33:53469] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "adkMVpAxiJKPums3eBDmWwAAAFA"]
[Fri Apr 10 22:42:30.641559 2026] [:error] [pid 13101:tid 13138] [client 172.213.241.33:53458] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "adkMVt8Ldw85818pj2oBeQAAAIU"]
[Fri Apr 10 22:42:31.164834 2026] [:error] [pid 63062:tid 63077] [client 172.213.241.33:53460] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "adkMV52HtsmV85NqkMcBwQAAA40"]
[Fri Apr 10 22:42:31.673707 2026] [:error] [pid 13189:tid 13195] [client 172.213.241.33:53442] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "adkMV5AxiJKPums3eBDmZgAAAEM"]
[Fri Apr 10 22:42:32.217816 2026] [:error] [pid 13189:tid 13192] [client 172.213.241.33:53482] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "adkMWJAxiJKPums3eBDmbAAAAEA"]
[Fri Apr 10 22:42:32.777008 2026] [:error] [pid 62710:tid 62715] [client 172.213.241.33:55993] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "adkMWOME7qrf5xEWWJsx8wAAAgI"]
[Fri Apr 10 22:42:33.245224 2026] [:error] [pid 62769:tid 62783] [client 172.213.241.33:53490] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "adkMWcWsSnfLoB8ifjCPRwAAAkw"]
[Fri Apr 10 22:42:33.767134 2026] [:error] [pid 62651:tid 62654] [client 172.213.241.33:46810] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "adkMWTbAH0le57SIaqwwSwAAAcE"]
[Fri Apr 10 22:42:34.431747 2026] [:error] [pid 62710:tid 62724] [client 172.213.241.33:46823] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "adkMWuME7qrf5xEWWJsx-AAAAgs"]
[Fri Apr 10 22:42:34.968588 2026] [:error] [pid 62710:tid 62713] [client 172.213.241.33:46789] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "adkMWuME7qrf5xEWWJsx-gAAAgA"]
[Fri Apr 10 22:42:35.441558 2026] [:error] [pid 13189:tid 13208] [client 172.213.241.33:62806] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "adkMW5AxiJKPums3eBDmgwAAAFA"]
[Fri Apr 10 22:42:35.959351 2026] [:error] [pid 13189:tid 13212] [client 172.213.241.33:53466] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "adkMW5AxiJKPums3eBDmiAAAAFQ"]
[Fri Apr 10 22:42:36.443526 2026] [:error] [pid 62819:tid 62835] [client 172.213.241.33:51670] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "adkMXPU20EyPf7Nlsld4ZQAAAo0"]
[Fri Apr 10 22:42:36.953721 2026] [:error] [pid 13189:tid 13202] [client 172.213.241.33:44954] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "adkMXJAxiJKPums3eBDmjgAAAEo"]
[Fri Apr 10 22:42:37.478529 2026] [:error] [pid 13189:tid 13195] [client 172.213.241.33:53489] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "adkMXZAxiJKPums3eBDmkgAAAEM"]
[Fri Apr 10 22:42:37.991743 2026] [:error] [pid 13189:tid 13212] [client 172.213.241.33:46807] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "adkMXZAxiJKPums3eBDmlgAAAFQ"]
[Fri Apr 10 22:42:38.461653 2026] [:error] [pid 13100:tid 13122] [client 172.213.241.33:61480] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "adkMXlzg-ZkZ0InWIP3JWwAAARE"]
[Fri Apr 10 22:42:38.949133 2026] [:error] [pid 13189:tid 13192] [client 172.213.241.33:54040] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "adkMXpAxiJKPums3eBDmngAAAEA"]
[Fri Apr 10 22:42:39.451329 2026] [:error] [pid 13189:tid 13195] [client 172.213.241.33:51676] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "adkMX5AxiJKPums3eBDmoQAAAEM"]
[Fri Apr 10 22:42:39.928315 2026] [:error] [pid 62884:tid 62908] [client 172.213.241.33:61459] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "adkMX-UCK1xrhnnmpo2QcwAAAtE"]
[Fri Apr 10 22:42:40.433880 2026] [:error] [pid 13189:tid 13203] [client 172.213.241.33:55958] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "adkMYJAxiJKPums3eBDmpgAAAEs"]
[Fri Apr 10 22:42:40.936077 2026] [:error] [pid 13189:tid 13208] [client 172.213.241.33:61451] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "adkMYJAxiJKPums3eBDmsAAAAFA"]
[Fri Apr 10 22:42:41.428717 2026] [:error] [pid 62884:tid 62912] [client 172.213.241.33:51053] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "adkMYeUCK1xrhnnmpo2QdQAAAtU"]
[Fri Apr 10 22:42:41.999328 2026] [:error] [pid 63062:tid 63077] [client 172.213.241.33:51680] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "adkMYZ2HtsmV85NqkMcBzQAAA40"]
[Fri Apr 10 22:42:42.471959 2026] [:error] [pid 62819:tid 62842] [client 172.213.241.33:51666] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "adkMYvU20EyPf7Nlsld4cAAAApQ"]
[Fri Apr 10 22:42:43.008898 2026] [:error] [pid 13100:tid 13113] [client 172.213.241.33:46835] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "adkMY1zg-ZkZ0InWIP3JXQAAAQg"]
[Fri Apr 10 22:42:43.627398 2026] [:error] [pid 13189:tid 13202] [client 172.213.241.33:46798] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "adkMY5AxiJKPums3eBDmxQAAAEo"]
[Fri Apr 10 22:42:44.198065 2026] [:error] [pid 13189:tid 13204] [client 172.213.241.33:53455] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "adkMZJAxiJKPums3eBDmzgAAAEw"]
[Fri Apr 10 22:42:44.791691 2026] [:error] [pid 63062:tid 63068] [client 172.213.241.33:51010] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "adkMZJ2HtsmV85NqkMcB1gAAA4Q"]
[Fri Apr 10 22:42:45.490598 2026] [:error] [pid 63062:tid 63082] [client 172.213.241.33:57879] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "adkMZZ2HtsmV85NqkMcB2gAAA5I"]
[Fri Apr 10 22:42:46.577822 2026] [:error] [pid 13189:tid 13193] [client 172.213.241.33:62808] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "adkMZpAxiJKPums3eBDm4AAAAEE"]
[Fri Apr 10 22:42:47.276845 2026] [:error] [pid 62710:tid 62716] [client 172.213.241.33:55959] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "adkMZ-ME7qrf5xEWWJsyCAAAAgM"]
[Fri Apr 10 22:43:03.117068 2026] [:error] [pid 62710:tid 62718] [client 172.213.241.33:53464] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ass.php"] [unique_id "adkMd-ME7qrf5xEWWJsyOAAAAgU"]
[Fri Apr 10 22:43:03.850069 2026] [:error] [pid 62651:tid 62673] [client 172.213.241.33:44938] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ass.php"] [unique_id "adkMdzbAH0le57SIaqwwZwAAAdQ"]
[Fri Apr 10 22:43:05.175991 2026] [:error] [pid 62769:tid 62783] [client 172.213.241.33:51701] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ass.php"] [unique_id "adkMecWsSnfLoB8ifjCP0wAAAkw"]
[Fri Apr 10 22:43:06.582984 2026] [:error] [pid 62819:tid 62836] [client 172.213.241.33:54019] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ass.php"] [unique_id "adkMevU20EyPf7Nlsld4gAAAAo4"]
[Fri Apr 10 22:43:07.337511 2026] [:error] [pid 62884:tid 62892] [client 172.213.241.33:47106] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "adkMe-UCK1xrhnnmpo2QggAAAsE"]
[Fri Apr 10 22:43:08.148990 2026] [:error] [pid 13101:tid 13139] [client 172.213.241.33:55949] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "adkMfN8Ldw85818pj2oB1QAAAIY"]
[Fri Apr 10 22:43:09.121064 2026] [:error] [pid 13189:tid 13193] [client 172.213.241.33:53473] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "adkMfZAxiJKPums3eBDnRwAAAEE"]
[Fri Apr 10 22:43:11.990900 2026] [:error] [pid 13101:tid 13137] [client 172.213.241.33:55969] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "adkMf98Ldw85818pj2oB5AAAAIQ"]
[Fri Apr 10 22:43:13.065924 2026] [:error] [pid 62769:tid 62784] [client 172.213.241.33:55961] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "adkMgcWsSnfLoB8ifjCP-gAAAk0"]
[Fri Apr 10 22:43:13.703135 2026] [:error] [pid 63134:tid 63152] [client 172.213.241.33:51052] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "adkMgdFALqPDwWi6eJK40AAAA88"]
[Fri Apr 10 22:43:14.396631 2026] [:error] [pid 62710:tid 62717] [client 172.213.241.33:55966] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "adkMguME7qrf5xEWWJsyRAAAAgQ"]
[Fri Apr 10 22:43:14.948046 2026] [:error] [pid 13100:tid 13108] [client 172.213.241.33:61460] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "adkMglzg-ZkZ0InWIP3JcwAAAQM"]
[Fri Apr 10 22:43:15.535990 2026] [:error] [pid 62769:tid 62779] [client 172.213.241.33:62805] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fine.php"] [unique_id "adkMg8WsSnfLoB8ifjCQAAAAAkg"]
[Fri Apr 10 22:43:16.052022 2026] [:error] [pid 63134:tid 63145] [client 172.213.241.33:55981] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fine.php"] [unique_id "adkMhNFALqPDwWi6eJK43AAAA8g"]
[Fri Apr 10 22:43:16.572893 2026] [:error] [pid 62710:tid 62713] [client 172.213.241.33:46839] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fine.php"] [unique_id "adkMhOME7qrf5xEWWJsyVQAAAgA"]
[Fri Apr 10 22:43:17.223906 2026] [:error] [pid 62769:tid 62778] [client 172.213.241.33:51042] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fine.php"] [unique_id "adkMhcWsSnfLoB8ifjCQCAAAAkc"]
[Fri Apr 10 22:43:17.954775 2026] [:error] [pid 62884:tid 62912] [client 172.213.241.33:48474] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zample.php"] [unique_id "adkMheUCK1xrhnnmpo2QkQAAAtU"]
[Fri Apr 10 22:43:18.512161 2026] [:error] [pid 62651:tid 62662] [client 172.213.241.33:44984] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zample.php"] [unique_id "adkMhjbAH0le57SIaqwwbQAAAck"]
[Fri Apr 10 22:43:19.130531 2026] [:error] [pid 13100:tid 13125] [client 172.213.241.33:54032] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zample.php"] [unique_id "adkMh1zg-ZkZ0InWIP3JdwAAARQ"]
[Fri Apr 10 22:43:19.660563 2026] [:error] [pid 13100:tid 13118] [client 172.213.241.33:55999] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zample.php"] [unique_id "adkMh1zg-ZkZ0InWIP3JeQAAAQ0"]
[Fri Apr 10 22:43:20.240970 2026] [:error] [pid 63134:tid 63137] [client 172.213.241.33:51062] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "adkMiNFALqPDwWi6eJK47QAAA8A"]
[Fri Apr 10 22:43:20.840572 2026] [:error] [pid 63134:tid 63147] [client 172.213.241.33:54026] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "adkMiNFALqPDwWi6eJK4_AAAA8o"]
[Fri Apr 10 22:43:21.356687 2026] [:error] [pid 62769:tid 62781] [client 172.213.241.33:46837] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "adkMicWsSnfLoB8ifjCQFgAAAko"]
[Fri Apr 10 22:43:21.867833 2026] [:error] [pid 62769:tid 62779] [client 172.213.241.33:62822] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "adkMicWsSnfLoB8ifjCQGwAAAkg"]
[Fri Apr 10 22:43:22.391745 2026] [:error] [pid 62710:tid 62714] [client 172.213.241.33:62842] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "adkMiuME7qrf5xEWWJsyYAAAAgE"]
[Fri Apr 10 22:43:22.936751 2026] [:error] [pid 13101:tid 13154] [client 172.213.241.33:62841] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "adkMit8Ldw85818pj2oB_wAAAJU"]
[Fri Apr 10 22:43:23.490746 2026] [:error] [pid 62769:tid 62786] [client 172.213.241.33:44979] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "adkMi8WsSnfLoB8ifjCQNwAAAk8"]
[Fri Apr 10 22:43:24.011963 2026] [:error] [pid 13101:tid 13135] [client 172.213.241.33:57919] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "adkMjN8Ldw85818pj2oCBAAAAII"]
[Fri Apr 10 22:43:24.525094 2026] [:error] [pid 13101:tid 13157] [client 172.213.241.33:51687] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "adkMjN8Ldw85818pj2oCDQAAAJg"]
[Fri Apr 10 22:43:25.142874 2026] [:error] [pid 62769:tid 62783] [client 172.213.241.33:55964] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "adkMjcWsSnfLoB8ifjCQPgAAAkw"]
[Fri Apr 10 22:43:25.682018 2026] [:error] [pid 62710:tid 62724] [client 172.213.241.33:49060] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "adkMjeME7qrf5xEWWJsyYwAAAgs"]
[Fri Apr 10 22:43:26.148555 2026] [:error] [pid 13189:tid 13204] [client 172.213.241.33:54028] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "adkMjpAxiJKPums3eBDncAAAAEw"]
[Fri Apr 10 22:43:26.719993 2026] [:error] [pid 13101:tid 13151] [client 172.213.241.33:62825] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "adkMjt8Ldw85818pj2oCGgAAAJI"]
[Fri Apr 10 22:43:27.252610 2026] [:error] [pid 62819:tid 62836] [client 172.213.241.33:51672] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "adkMj_U20EyPf7Nlsld4rAAAAo4"]
[Fri Apr 10 22:43:27.759109 2026] [:error] [pid 63062:tid 63087] [client 172.213.241.33:51047] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "adkMj52HtsmV85NqkMcCCgAAA5c"]
[Fri Apr 10 22:43:28.397845 2026] [:error] [pid 62769:tid 62780] [client 172.213.241.33:54016] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "adkMkMWsSnfLoB8ifjCQTQAAAkk"]
[Fri Apr 10 22:43:28.936722 2026] [:error] [pid 13189:tid 13216] [client 172.213.241.33:53454] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "adkMkJAxiJKPums3eBDniAAAAFg"]
[Fri Apr 10 22:43:29.455540 2026] [:error] [pid 63062:tid 63066] [client 172.213.241.33:44946] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "adkMkZ2HtsmV85NqkMcCEQAAA4I"]
[Fri Apr 10 22:43:29.927367 2026] [:error] [pid 62769:tid 62775] [client 172.213.241.33:55965] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "adkMkcWsSnfLoB8ifjCQXgAAAkQ"]
[Fri Apr 10 22:43:30.403759 2026] [:error] [pid 62710:tid 62721] [client 172.213.241.33:54035] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "adkMkuME7qrf5xEWWJsyagAAAgg"]
[Fri Apr 10 22:43:30.866308 2026] [:error] [pid 13101:tid 13139] [client 172.213.241.33:46824] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "adkMkt8Ldw85818pj2oCKgAAAIY"]
[Fri Apr 10 22:43:31.416632 2026] [:error] [pid 62651:tid 62659] [client 172.213.241.33:51677] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "adkMkzbAH0le57SIaqwwdwAAAcY"]
[Fri Apr 10 22:43:31.887044 2026] [:error] [pid 62769:tid 62790] [client 172.213.241.33:53498] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "adkMk8WsSnfLoB8ifjCQawAAAlM"]
[Fri Apr 10 22:43:32.368519 2026] [:error] [pid 62819:tid 62844] [client 172.213.241.33:51068] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "adkMlPU20EyPf7Nlsld4uQAAApY"]
[Fri Apr 10 22:43:32.889211 2026] [:error] [pid 62769:tid 62790] [client 172.213.241.33:51679] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "adkMlMWsSnfLoB8ifjCQdgAAAlM"]
[Fri Apr 10 22:43:33.428699 2026] [:error] [pid 62769:tid 62785] [client 172.213.241.33:54030] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "adkMlcWsSnfLoB8ifjCQgQAAAk4"]
[Fri Apr 10 22:43:33.936981 2026] [:error] [pid 62769:tid 62788] [client 172.213.241.33:44951] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "adkMlcWsSnfLoB8ifjCQhwAAAlE"]
[Fri Apr 10 22:43:34.419015 2026] [:error] [pid 62819:tid 62835] [client 172.213.241.33:44964] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "adkMlvU20EyPf7Nlsld4wgAAAo0"]
[Fri Apr 10 22:43:34.917778 2026] [:error] [pid 62769:tid 62780] [client 172.213.241.33:61442] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "adkMlsWsSnfLoB8ifjCQiwAAAkk"]
[Fri Apr 10 22:43:35.440773 2026] [:error] [pid 63134:tid 63148] [client 172.213.241.33:62807] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "adkMl9FALqPDwWi6eJK5DgAAA8s"]
[Fri Apr 10 22:43:35.905566 2026] [:error] [pid 13101:tid 13140] [client 172.213.241.33:44937] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "adkMl98Ldw85818pj2oCRAAAAIc"]
[Fri Apr 10 22:43:36.379663 2026] [:error] [pid 13100:tid 13125] [client 172.213.241.33:44966] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "adkMmFzg-ZkZ0InWIP3JiwAAARQ"]
[Fri Apr 10 22:43:36.908118 2026] [:error] [pid 13101:tid 13149] [client 172.213.241.33:55990] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "adkMmN8Ldw85818pj2oCTAAAAJA"]
[Fri Apr 10 22:43:37.418076 2026] [:error] [pid 62710:tid 62723] [client 172.213.241.33:44941] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "adkMmeME7qrf5xEWWJsyewAAAgo"]
[Fri Apr 10 22:43:37.929740 2026] [:error] [pid 62710:tid 62731] [client 172.213.241.33:54057] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "adkMmeME7qrf5xEWWJsygAAAAhI"]
[Fri Apr 10 22:43:38.404696 2026] [:error] [pid 62769:tid 62794] [client 172.213.241.33:44971] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "adkMmsWsSnfLoB8ifjCQmQAAAlc"]
[Fri Apr 10 22:43:38.902291 2026] [:error] [pid 62819:tid 62846] [client 172.213.241.33:62793] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "adkMmvU20EyPf7Nlsld40wAAApg"]
[Fri Apr 10 22:43:39.395710 2026] [:error] [pid 62651:tid 62677] [client 172.213.241.33:44953] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "adkMmzbAH0le57SIaqwwjQAAAdg"]
[Fri Apr 10 22:43:39.862399 2026] [:error] [pid 62710:tid 62723] [client 172.213.241.33:46814] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "adkMm-ME7qrf5xEWWJsyjAAAAgo"]
[Fri Apr 10 22:43:40.367881 2026] [:error] [pid 63062:tid 63073] [client 172.213.241.33:49054] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "adkMnJ2HtsmV85NqkMcCMAAAA4k"]
[Fri Apr 10 22:43:40.875644 2026] [:error] [pid 62769:tid 62793] [client 172.213.241.33:49049] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "adkMnMWsSnfLoB8ifjCQrAAAAlY"]
[Fri Apr 10 22:43:41.462465 2026] [:error] [pid 62769:tid 62795] [client 172.213.241.33:46844] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "adkMncWsSnfLoB8ifjCQswAAAlg"]
[Fri Apr 10 22:43:41.966316 2026] [:error] [pid 62884:tid 62912] [client 172.213.241.33:49081] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "adkMneUCK1xrhnnmpo2QoAAAAtU"]
[Fri Apr 10 22:43:42.440656 2026] [:error] [pid 62819:tid 62835] [client 172.213.241.33:53495] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "adkMnvU20EyPf7Nlsld44wAAAo0"]
[Fri Apr 10 22:43:42.939088 2026] [:error] [pid 62884:tid 62915] [client 172.213.241.33:50330] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "adkMnuUCK1xrhnnmpo2QoQAAAtg"]
[Fri Apr 10 22:43:43.462921 2026] [:error] [pid 13101:tid 13150] [client 172.213.241.33:46847] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "adkMn98Ldw85818pj2oCVwAAAJE"]
[Fri Apr 10 22:43:43.930059 2026] [:error] [pid 62819:tid 62828] [client 172.213.241.33:61465] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "adkMn_U20EyPf7Nlsld46AAAAoY"]
[Fri Apr 10 22:43:44.424392 2026] [:error] [pid 13100:tid 13113] [client 172.213.241.33:46796] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "adkMoFzg-ZkZ0InWIP3JmwAAAQg"]
[Fri Apr 10 22:43:44.897001 2026] [:error] [pid 13101:tid 13153] [client 172.213.241.33:62797] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "adkMoN8Ldw85818pj2oCWwAAAJQ"]
[Fri Apr 10 22:43:45.383281 2026] [:error] [pid 13189:tid 13203] [client 172.213.241.33:44928] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "adkMoZAxiJKPums3eBDnmwAAAEs"]
[Fri Apr 10 22:43:45.955692 2026] [:error] [pid 63062:tid 63080] [client 172.213.241.33:53502] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "adkMoZ2HtsmV85NqkMcCNwAAA5A"]
[Fri Apr 10 22:43:46.479143 2026] [:error] [pid 63062:tid 63088] [client 172.213.241.33:54023] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "adkMop2HtsmV85NqkMcCPAAAA5g"]
[Fri Apr 10 22:43:46.961706 2026] [:error] [pid 13189:tid 13195] [client 172.213.241.33:55988] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "adkMopAxiJKPums3eBDnpQAAAEM"]
[Fri Apr 10 22:43:47.487363 2026] [:error] [pid 62710:tid 62713] [client 172.213.241.33:54058] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "adkMo-ME7qrf5xEWWJsyoQAAAgA"]
[Fri Apr 10 22:43:47.950889 2026] [:error] [pid 62710:tid 62716] [client 172.213.241.33:51049] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "adkMo-ME7qrf5xEWWJsyogAAAgM"]
[Fri Apr 10 22:43:48.421398 2026] [:error] [pid 62819:tid 62826] [client 172.213.241.33:61470] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "adkMpPU20EyPf7Nlsld46gAAAoQ"]
[Fri Apr 10 22:43:48.914685 2026] [:error] [pid 62884:tid 62897] [client 172.213.241.33:54077] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "adkMpOUCK1xrhnnmpo2QrAAAAsY"]
[Fri Apr 10 22:43:49.426120 2026] [:error] [pid 62710:tid 62731] [client 172.213.241.33:57896] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "adkMpeME7qrf5xEWWJsypwAAAhI"]
[Fri Apr 10 22:43:49.973137 2026] [:error] [pid 62884:tid 62898] [client 172.213.241.33:49025] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "adkMpeUCK1xrhnnmpo2QrwAAAsc"]
[Fri Apr 10 22:43:50.508325 2026] [:error] [pid 13189:tid 13200] [client 172.213.241.33:46833] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "adkMppAxiJKPums3eBDnrgAAAEg"]
[Fri Apr 10 22:43:50.973668 2026] [:error] [pid 13101:tid 13150] [client 172.213.241.33:46790] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "adkMpt8Ldw85818pj2oCZQAAAJE"]
[Fri Apr 10 22:43:51.449423 2026] [:error] [pid 13100:tid 13123] [client 172.213.241.33:55989] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "adkMp1zg-ZkZ0InWIP3JpwAAARI"]
[Fri Apr 10 22:43:51.924381 2026] [:error] [pid 13101:tid 13155] [client 172.213.241.33:54056] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "adkMp98Ldw85818pj2oCaAAAAJY"]
[Fri Apr 10 22:43:52.396084 2026] [:error] [pid 63062:tid 63064] [client 172.213.241.33:48504] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "adkMqJ2HtsmV85NqkMcCRQAAA4A"]
[Fri Apr 10 22:43:52.872910 2026] [:error] [pid 13189:tid 13202] [client 172.213.241.33:44963] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "adkMqJAxiJKPums3eBDnuQAAAEo"]
[Fri Apr 10 22:43:53.380605 2026] [:error] [pid 62769:tid 62795] [client 172.213.241.33:54051] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "adkMqcWsSnfLoB8ifjCQ8QAAAlg"]
[Fri Apr 10 22:43:53.845687 2026] [:error] [pid 62769:tid 62794] [client 172.213.241.33:51026] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "adkMqcWsSnfLoB8ifjCQ9QAAAlc"]
[Fri Apr 10 22:43:54.335176 2026] [:error] [pid 13189:tid 13211] [client 172.213.241.33:39493] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "adkMqpAxiJKPums3eBDnxQAAAFM"]
[Fri Apr 10 22:43:54.894342 2026] [:error] [pid 62710:tid 62726] [client 172.213.241.33:53485] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "adkMquME7qrf5xEWWJsyrgAAAg0"]
[Fri Apr 10 22:43:55.372944 2026] [:error] [pid 62710:tid 62724] [client 172.213.241.33:61443] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "adkMq-ME7qrf5xEWWJsysgAAAgs"]
[Fri Apr 10 22:43:55.953321 2026] [:error] [pid 62710:tid 62721] [client 172.213.241.33:54054] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "adkMq-ME7qrf5xEWWJsyvAAAAgg"]
[Fri Apr 10 22:43:56.616528 2026] [:error] [pid 62710:tid 62727] [client 172.213.241.33:49044] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "adkMrOME7qrf5xEWWJsyxgAAAg4"]
[Fri Apr 10 22:43:57.268086 2026] [:error] [pid 13189:tid 13206] [client 172.213.241.33:54070] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "adkMrZAxiJKPums3eBDnzwAAAE4"]
[Fri Apr 10 22:43:57.812128 2026] [:error] [pid 13189:tid 13213] [client 172.213.241.33:44990] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "adkMrZAxiJKPums3eBDn1QAAAFU"]
[Fri Apr 10 22:43:58.371169 2026] [:error] [pid 13189:tid 13208] [client 172.213.241.33:55991] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "adkMrpAxiJKPums3eBDn3wAAAFA"]
[Fri Apr 10 22:43:58.858798 2026] [:error] [pid 63134:tid 63154] [client 172.213.241.33:51009] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "adkMrtFALqPDwWi6eJK5NAAAA9E"]
[Fri Apr 10 22:43:59.385763 2026] [:error] [pid 62769:tid 62778] [client 172.213.241.33:44934] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "adkMr8WsSnfLoB8ifjCRBAAAAkc"]
[Fri Apr 10 22:43:59.909286 2026] [:error] [pid 62769:tid 62793] [client 172.213.241.33:62835] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "adkMr8WsSnfLoB8ifjCRCgAAAlY"]
[Fri Apr 10 22:44:00.471417 2026] [:error] [pid 62769:tid 62794] [client 172.213.241.33:47105] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "adkMsMWsSnfLoB8ifjCRDwAAAlc"]
[Fri Apr 10 22:44:00.950329 2026] [:error] [pid 13189:tid 13198] [client 172.213.241.33:55938] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "adkMsJAxiJKPums3eBDn8wAAAEY"]
[Fri Apr 10 22:44:01.605596 2026] [:error] [pid 62769:tid 62775] [client 172.213.241.33:51707] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "adkMscWsSnfLoB8ifjCRFwAAAkQ"]
[Fri Apr 10 22:44:15.634377 2026] [:error] [pid 62710:tid 62731] [client 172.213.241.33:57891] [client 172.213.241.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "adkMv-ME7qrf5xEWWJsy7wAAAhI"]
[Fri Apr 10 22:44:18.467322 2026] [:error] [pid 13101:tid 13138] [client 172.213.241.33:44982] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "adkMwt8Ldw85818pj2oCoAAAAIU"]
[Fri Apr 10 22:44:18.935165 2026] [:error] [pid 13189:tid 13204] [client 172.213.241.33:54068] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "adkMwpAxiJKPums3eBDoNgAAAEw"]
[Fri Apr 10 22:44:19.406070 2026] [:error] [pid 13100:tid 13125] [client 172.213.241.33:62799] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "adkMw1zg-ZkZ0InWIP3JvQAAARQ"]
[Fri Apr 10 22:44:19.871161 2026] [:error] [pid 62769:tid 62784] [client 172.213.241.33:53468] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "adkMw8WsSnfLoB8ifjCRqAAAAk0"]
[Fri Apr 10 22:44:20.376078 2026] [:error] [pid 62769:tid 62785] [client 172.213.241.33:62785] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "adkMxMWsSnfLoB8ifjCRrAAAAk4"]
[Fri Apr 10 22:44:20.843077 2026] [:error] [pid 62710:tid 62728] [client 172.213.241.33:44943] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "adkMxOME7qrf5xEWWJsy-wAAAg8"]
[Fri Apr 10 22:44:21.329120 2026] [:error] [pid 13189:tid 13205] [client 172.213.241.33:61482] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "adkMxZAxiJKPums3eBDoPwAAAE0"]
[Fri Apr 10 22:44:21.875436 2026] [:error] [pid 62769:tid 62795] [client 172.213.241.33:54045] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "adkMxcWsSnfLoB8ifjCRsQAAAlg"]
[Fri Apr 10 22:44:22.418150 2026] [:error] [pid 62769:tid 62774] [client 172.213.241.33:44955] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "adkMxsWsSnfLoB8ifjCRvAAAAkM"]
[Fri Apr 10 22:44:22.929816 2026] [:error] [pid 62769:tid 62771] [client 172.213.241.33:51664] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "adkMxsWsSnfLoB8ifjCRxAAAAkA"]
[Fri Apr 10 22:44:23.466017 2026] [:error] [pid 62651:tid 62674] [client 172.213.241.33:46794] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "adkMxzbAH0le57SIaqwwtwAAAdU"]
[Fri Apr 10 22:44:23.987288 2026] [:error] [pid 62769:tid 62774] [client 172.213.241.33:48501] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "adkMx8WsSnfLoB8ifjCRygAAAkM"]
[Fri Apr 10 22:44:24.462147 2026] [:error] [pid 62651:tid 62673] [client 172.213.241.33:62838] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "adkMyDbAH0le57SIaqwwuQAAAdQ"]
[Fri Apr 10 22:44:24.929274 2026] [:error] [pid 13100:tid 13115] [client 172.213.241.33:48484] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "adkMyFzg-ZkZ0InWIP3JwgAAAQo"]
[Fri Apr 10 22:44:25.427628 2026] [:error] [pid 62819:tid 62834] [client 172.213.241.33:51044] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "adkMyfU20EyPf7Nlsld5AwAAAow"]
[Fri Apr 10 22:44:25.947975 2026] [:error] [pid 62769:tid 62794] [client 172.213.241.33:51702] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "adkMycWsSnfLoB8ifjCR0AAAAlc"]
[Fri Apr 10 22:44:26.456957 2026] [:error] [pid 13189:tid 13216] [client 172.213.241.33:54076] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "adkMypAxiJKPums3eBDoTwAAAFg"]
[Fri Apr 10 22:44:26.941017 2026] [:error] [pid 62884:tid 62896] [client 172.213.241.33:54071] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "adkMyuUCK1xrhnnmpo2Q0AAAAsU"]
[Fri Apr 10 22:44:27.486783 2026] [:error] [pid 13189:tid 13209] [client 172.213.241.33:53440] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "adkMy5AxiJKPums3eBDoVgAAAFE"]
[Fri Apr 10 22:44:27.993098 2026] [:error] [pid 62769:tid 62782] [client 172.213.241.33:44965] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "adkMy8WsSnfLoB8ifjCR1AAAAks"]
[Fri Apr 10 22:44:28.473341 2026] [:error] [pid 62884:tid 62904] [client 172.213.241.33:50308] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "adkMzOUCK1xrhnnmpo2Q1QAAAs0"]
[Fri Apr 10 22:44:28.982984 2026] [:error] [pid 62710:tid 62722] [client 172.213.241.33:51037] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "adkMzOME7qrf5xEWWJszDgAAAgk"]
[Fri Apr 10 22:44:29.482249 2026] [:error] [pid 13189:tid 13203] [client 172.213.241.33:61466] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "adkMzZAxiJKPums3eBDoXQAAAEs"]
[Fri Apr 10 22:44:29.996014 2026] [:error] [pid 63134:tid 63138] [client 172.213.241.33:44931] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "adkMzdFALqPDwWi6eJK5ZwAAA8E"]
[Fri Apr 10 22:44:30.459884 2026] [:error] [pid 62769:tid 62781] [client 172.213.241.33:44989] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "adkMzsWsSnfLoB8ifjCR3QAAAko"]
[Fri Apr 10 22:44:31.042798 2026] [:error] [pid 62769:tid 62776] [client 172.213.241.33:62833] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "adkMz8WsSnfLoB8ifjCR4gAAAkU"]
[Fri Apr 10 22:44:31.511360 2026] [:error] [pid 62710:tid 62729] [client 172.213.241.33:49061] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "adkMz-ME7qrf5xEWWJszFgAAAhA"]
[Fri Apr 10 22:44:31.987397 2026] [:error] [pid 13101:tid 13147] [client 172.213.241.33:46830] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "adkMz98Ldw85818pj2oCyAAAAI4"]
[Fri Apr 10 22:44:32.452889 2026] [:error] [pid 13101:tid 13156] [client 172.213.241.33:62846] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "adkM0N8Ldw85818pj2oCzgAAAJc"]
[Fri Apr 10 22:44:32.944637 2026] [:error] [pid 62769:tid 62786] [client 172.213.241.33:51032] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "adkM0MWsSnfLoB8ifjCR7AAAAk8"]
[Fri Apr 10 22:44:33.464402 2026] [:error] [pid 13101:tid 13144] [client 172.213.241.33:62809] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "adkM0d8Ldw85818pj2oC2AAAAIs"]
[Fri Apr 10 22:44:33.924379 2026] [:error] [pid 13101:tid 13136] [client 172.213.241.33:53486] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "adkM0d8Ldw85818pj2oC2wAAAIM"]
[Fri Apr 10 22:44:34.408398 2026] [:error] [pid 62884:tid 62907] [client 172.213.241.33:61489] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "adkM0uUCK1xrhnnmpo2Q7AAAAtA"]
[Fri Apr 10 22:44:34.873155 2026] [:error] [pid 62651:tid 62672] [client 172.213.241.33:62821] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "adkM0jbAH0le57SIaqwwygAAAdM"]
[Fri Apr 10 22:44:35.392078 2026] [:error] [pid 62884:tid 62913] [client 172.213.241.33:46793] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "adkM0-UCK1xrhnnmpo2Q8gAAAtY"]
[Fri Apr 10 22:44:35.898938 2026] [:error] [pid 62769:tid 62784] [client 172.213.241.33:51660] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "adkM08WsSnfLoB8ifjCR9wAAAk0"]
[Fri Apr 10 22:44:36.512712 2026] [:error] [pid 62710:tid 62737] [client 172.213.241.33:61478] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "adkM1OME7qrf5xEWWJszGwAAAhg"]
[Fri Apr 10 22:44:37.051188 2026] [:error] [pid 62769:tid 62794] [client 172.213.241.33:46810] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "adkM1cWsSnfLoB8ifjCSCAAAAlc"]
[Fri Apr 10 22:44:37.524510 2026] [:error] [pid 62769:tid 62783] [client 172.213.241.33:39502] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "adkM1cWsSnfLoB8ifjCSEQAAAkw"]
[Fri Apr 10 22:44:38.040847 2026] [:error] [pid 63062:tid 63065] [client 172.213.241.33:62803] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "adkM1p2HtsmV85NqkMcCfgAAA4E"]
[Fri Apr 10 22:44:38.519960 2026] [:error] [pid 62769:tid 62781] [client 172.213.241.33:54047] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "adkM1sWsSnfLoB8ifjCSGAAAAko"]
[Fri Apr 10 22:44:39.075212 2026] [:error] [pid 63134:tid 63154] [client 172.213.241.33:39516] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "adkM19FALqPDwWi6eJK5awAAA9E"]
[Fri Apr 10 22:44:39.648722 2026] [:error] [pid 13189:tid 13199] [client 172.213.241.33:46802] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "adkM15AxiJKPums3eBDocQAAAEc"]
[Fri Apr 10 22:44:40.153351 2026] [:error] [pid 62769:tid 62777] [client 172.213.241.33:54073] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "adkM2MWsSnfLoB8ifjCSKQAAAkY"]
[Fri Apr 10 22:44:40.773464 2026] [:error] [pid 13101:tid 13152] [client 172.213.241.33:54055] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "adkM2N8Ldw85818pj2oC6wAAAJM"]
[Fri Apr 10 22:44:41.330314 2026] [:error] [pid 13189:tid 13193] [client 172.213.241.33:57892] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "adkM2ZAxiJKPums3eBDodQAAAEE"]
[Fri Apr 10 22:44:41.847565 2026] [:error] [pid 13101:tid 13138] [client 172.213.241.33:57916] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "adkM2d8Ldw85818pj2oC9AAAAIU"]
[Fri Apr 10 22:44:42.325658 2026] [:error] [pid 13189:tid 13196] [client 172.213.241.33:53474] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "adkM2pAxiJKPums3eBDodgAAAEQ"]
[Fri Apr 10 22:44:43.512887 2026] [:error] [pid 62769:tid 62771] [client 172.213.241.33:54020] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "adkM28WsSnfLoB8ifjCSNAAAAkA"]
[Fri Apr 10 22:44:44.034614 2026] [:error] [pid 62769:tid 62784] [client 172.213.241.33:51028] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "adkM3MWsSnfLoB8ifjCSNgAAAk0"]
[Fri Apr 10 22:44:44.610121 2026] [:error] [pid 62710:tid 62728] [client 172.213.241.33:62796] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "adkM3OME7qrf5xEWWJszLQAAAg8"]
[Fri Apr 10 22:44:45.128337 2026] [:error] [pid 13189:tid 13204] [client 172.213.241.33:54053] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "adkM3ZAxiJKPums3eBDoegAAAEw"]
[Fri Apr 10 22:44:45.671822 2026] [:error] [pid 63134:tid 63141] [client 172.213.241.33:61446] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "adkM3dFALqPDwWi6eJK5dgAAA8Q"]
[Fri Apr 10 22:44:46.267860 2026] [:error] [pid 63062:tid 63088] [client 172.213.241.33:51674] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "adkM3p2HtsmV85NqkMcCjAAAA5g"]
[Fri Apr 10 22:44:47.019056 2026] [:error] [pid 62819:tid 62837] [client 172.213.241.33:51699] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "adkM3_U20EyPf7Nlsld5GwAAAo8"]
[Fri Apr 10 22:44:47.526156 2026] [:error] [pid 62769:tid 62771] [client 172.213.241.33:62800] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "adkM38WsSnfLoB8ifjCSPwAAAkA"]
[Fri Apr 10 22:44:48.050351 2026] [:error] [pid 62769:tid 62775] [client 172.213.241.33:53503] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "adkM4MWsSnfLoB8ifjCSRAAAAkQ"]
[Fri Apr 10 22:44:48.546291 2026] [:error] [pid 13189:tid 13198] [client 172.213.241.33:61496] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "adkM4JAxiJKPums3eBDofwAAAEY"]
[Fri Apr 10 22:44:49.055976 2026] [:error] [pid 62769:tid 62777] [client 172.213.241.33:39511] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "adkM4cWsSnfLoB8ifjCSVQAAAkY"]
[Fri Apr 10 22:44:49.548563 2026] [:error] [pid 13101:tid 13146] [client 172.213.241.33:55944] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "adkM4d8Ldw85818pj2oDHwAAAI0"]
[Fri Apr 10 22:44:50.092534 2026] [:error] [pid 62769:tid 62774] [client 172.213.241.33:62834] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "adkM4sWsSnfLoB8ifjCSZwAAAkM"]
[Fri Apr 10 22:44:50.670931 2026] [:error] [pid 13101:tid 13137] [client 172.213.241.33:62832] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "adkM4t8Ldw85818pj2oDIwAAAIQ"]
[Fri Apr 10 22:44:51.133347 2026] [:error] [pid 13100:tid 13118] [client 172.213.241.33:51017] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "adkM41zg-ZkZ0InWIP3J5AAAAQ0"]
[Fri Apr 10 22:44:51.629352 2026] [:error] [pid 62769:tid 62793] [client 172.213.241.33:49064] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "adkM48WsSnfLoB8ifjCSeQAAAlY"]
[Fri Apr 10 22:44:52.121987 2026] [:error] [pid 62769:tid 62783] [client 172.213.241.33:57871] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "adkM5MWsSnfLoB8ifjCSgAAAAkw"]
[Fri Apr 10 22:44:52.621134 2026] [:error] [pid 63062:tid 63077] [client 172.213.241.33:49036] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "adkM5J2HtsmV85NqkMcCmwAAA40"]
[Fri Apr 10 22:44:53.096400 2026] [:error] [pid 62710:tid 62735] [client 172.213.241.33:61474] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "adkM5eME7qrf5xEWWJszOwAAAhY"]
[Fri Apr 10 22:44:53.575739 2026] [:error] [pid 62769:tid 62777] [client 172.213.241.33:55957] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "adkM5cWsSnfLoB8ifjCSkQAAAkY"]
[Fri Apr 10 22:44:54.064669 2026] [:error] [pid 62769:tid 62789] [client 172.213.241.33:44985] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "adkM5sWsSnfLoB8ifjCSmAAAAlI"]
[Fri Apr 10 22:44:54.561157 2026] [:error] [pid 62769:tid 62775] [client 172.213.241.33:51689] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "adkM5sWsSnfLoB8ifjCSowAAAkQ"]
[Fri Apr 10 22:44:55.093770 2026] [:error] [pid 62651:tid 62666] [client 172.213.241.33:54033] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "adkM5zbAH0le57SIaqww5AAAAc0"]
[Fri Apr 10 22:44:55.672295 2026] [:error] [pid 62710:tid 62719] [client 172.213.241.33:51656] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "adkM5-ME7qrf5xEWWJszPAAAAgY"]
[Fri Apr 10 22:44:56.211741 2026] [:error] [pid 62769:tid 62791] [client 172.213.241.33:55936] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "adkM6MWsSnfLoB8ifjCStgAAAlQ"]
[Fri Apr 10 22:44:56.678472 2026] [:error] [pid 62710:tid 62717] [client 172.213.241.33:51014] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "adkM6OME7qrf5xEWWJszPgAAAgQ"]
[Fri Apr 10 22:44:57.171299 2026] [:error] [pid 63134:tid 63159] [client 172.213.241.33:55978] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "adkM6dFALqPDwWi6eJK5iQAAA9Y"]
[Fri Apr 10 22:44:57.832393 2026] [:error] [pid 63134:tid 63152] [client 172.213.241.33:54050] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "adkM6dFALqPDwWi6eJK5jwAAA88"]
[Fri Apr 10 22:44:58.693218 2026] [:error] [pid 13101:tid 13147] [client 172.213.241.33:44949] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "adkM6t8Ldw85818pj2oDQgAAAI4"]
[Fri Apr 10 22:44:59.352817 2026] [:error] [pid 13189:tid 13202] [client 172.213.241.33:51041] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "adkM65AxiJKPums3eBDokAAAAEo"]
[Fri Apr 10 22:45:00.487323 2026] [:error] [pid 63134:tid 63157] [client 172.213.241.33:62814] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "adkM7NFALqPDwWi6eJK5nQAAA9Q"]
[Fri Apr 10 22:45:01.450107 2026] [:error] [pid 62884:tid 62895] [client 172.213.241.33:54017] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "adkM7eUCK1xrhnnmpo2RFQAAAsQ"]
[Fri Apr 10 22:45:02.094691 2026] [:error] [pid 13101:tid 13144] [client 172.213.241.33:48448] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "adkM7t8Ldw85818pj2oDXQAAAIs"]
[Fri Apr 10 22:45:02.841940 2026] [:error] [pid 13189:tid 13192] [client 172.213.241.33:55945] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "adkM7pAxiJKPums3eBDonAAAAEA"]
[Fri Apr 10 22:45:03.357318 2026] [:error] [pid 62710:tid 62716] [client 172.213.241.33:51675] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "adkM7-ME7qrf5xEWWJszSAAAAgM"]
[Fri Apr 10 22:45:03.868734 2026] [:error] [pid 62884:tid 62897] [client 172.213.241.33:51690] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "adkM7-UCK1xrhnnmpo2RHAAAAsY"]
[Fri Apr 10 22:45:04.371962 2026] [:error] [pid 62651:tid 62676] [client 172.213.241.33:39547] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "adkM8DbAH0le57SIaqww8gAAAdc"]
[Fri Apr 10 22:45:04.841963 2026] [:error] [pid 13101:tid 13134] [client 172.213.241.33:46846] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "adkM8N8Ldw85818pj2oDZAAAAIE"]
[Fri Apr 10 22:45:05.313282 2026] [:error] [pid 63134:tid 63148] [client 172.213.241.33:53491] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "adkM8dFALqPDwWi6eJK5rgAAA8s"]
[Fri Apr 10 22:45:05.781064 2026] [:error] [pid 62884:tid 62914] [client 172.213.241.33:46812] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "adkM8eUCK1xrhnnmpo2RIQAAAtc"]
[Fri Apr 10 22:45:06.258843 2026] [:error] [pid 13189:tid 13213] [client 172.213.241.33:51036] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "adkM8pAxiJKPums3eBDorAAAAFU"]
[Fri Apr 10 22:45:06.719797 2026] [:error] [pid 13189:tid 13201] [client 172.213.241.33:61486] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "adkM8pAxiJKPums3eBDosgAAAEk"]
[Fri Apr 10 22:45:07.192408 2026] [:error] [pid 13189:tid 13207] [client 172.213.241.33:44950] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "adkM85AxiJKPums3eBDouQAAAE8"]
[Fri Apr 10 22:45:07.682746 2026] [:error] [pid 13189:tid 13214] [client 172.213.241.33:53500] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "adkM85AxiJKPums3eBDowQAAAFY"]
[Fri Apr 10 22:45:08.198136 2026] [:error] [pid 62769:tid 62778] [client 172.213.241.33:61454] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adkM9MWsSnfLoB8ifjCSyAAAAkc"]
[Fri Apr 10 22:45:08.664644 2026] [:error] [pid 62651:tid 62656] [client 172.213.241.33:44947] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adkM9DbAH0le57SIaqww-gAAAcM"]
[Fri Apr 10 22:45:09.125547 2026] [:error] [pid 62819:tid 62844] [client 172.213.241.33:51694] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adkM9fU20EyPf7Nlsld5IAAAApY"]
[Fri Apr 10 22:45:09.643440 2026] [:error] [pid 13101:tid 13141] [client 172.213.241.33:55953] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "adkM9d8Ldw85818pj2oDcAAAAIg"]
[Fri Apr 10 22:45:10.117837 2026] [:error] [pid 13101:tid 13137] [client 172.213.241.33:55979] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "adkM9t8Ldw85818pj2oDdQAAAIQ"]
[Fri Apr 10 22:45:10.590009 2026] [:error] [pid 62769:tid 62773] [client 172.213.241.33:44939] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "adkM9sWsSnfLoB8ifjCS1AAAAkI"]
[Fri Apr 10 22:45:11.085000 2026] [:error] [pid 13189:tid 13196] [client 172.213.241.33:46819] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "adkM95AxiJKPums3eBDozQAAAEQ"]
[Fri Apr 10 22:45:11.558723 2026] [:error] [pid 62769:tid 62795] [client 172.213.241.33:61499] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "adkM98WsSnfLoB8ifjCS2wAAAlg"]
[Fri Apr 10 22:45:12.025791 2026] [:error] [pid 62769:tid 62788] [client 172.213.241.33:39542] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "adkM-MWsSnfLoB8ifjCS4wAAAlE"]
[Fri Apr 10 22:45:12.506576 2026] [:error] [pid 62819:tid 62839] [client 172.213.241.33:51013] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "adkM-PU20EyPf7Nlsld5JAAAApE"]
[Fri Apr 10 22:45:12.971312 2026] [:error] [pid 62884:tid 62915] [client 172.213.241.33:53462] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "adkM-OUCK1xrhnnmpo2RJwAAAtg"]
[Fri Apr 10 22:45:13.453656 2026] [:error] [pid 63134:tid 63137] [client 172.213.241.33:48454] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "adkM-dFALqPDwWi6eJK5xwAAA8A"]
[Fri Apr 10 22:45:13.918622 2026] [:error] [pid 13189:tid 13215] [client 172.213.241.33:46825] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "adkM-ZAxiJKPums3eBDo1wAAAFc"]
[Fri Apr 10 22:45:14.384861 2026] [:error] [pid 62769:tid 62773] [client 172.213.241.33:46809] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "adkM-sWsSnfLoB8ifjCS-QAAAkI"]
[Fri Apr 10 22:45:14.856532 2026] [:error] [pid 13189:tid 13195] [client 172.213.241.33:39494] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "adkM-pAxiJKPums3eBDo4gAAAEM"]
[Fri Apr 10 22:45:15.390109 2026] [:error] [pid 13189:tid 13216] [client 172.213.241.33:61455] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "adkM-5AxiJKPums3eBDo7wAAAFg"]
[Fri Apr 10 22:45:15.926075 2026] [:error] [pid 62769:tid 62772] [client 172.213.241.33:57869] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "adkM-8WsSnfLoB8ifjCTAQAAAkE"]
[Fri Apr 10 22:45:16.427707 2026] [:error] [pid 62769:tid 62794] [client 172.213.241.33:47151] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "adkM_MWsSnfLoB8ifjCTAwAAAlc"]
[Fri Apr 10 22:45:16.924924 2026] [:error] [pid 62769:tid 62795] [client 172.213.241.33:46822] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "adkM_MWsSnfLoB8ifjCTCAAAAlg"]
[Fri Apr 10 22:45:20.567151 2026] [:error] [pid 62769:tid 62778] [client 172.213.241.33:55967] [client 172.213.241.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adkNAMWsSnfLoB8ifjCTHwAAAkc"]
[Fri Apr 10 22:45:23.055331 2026] [autoindex:error] [pid 13101:tid 13134] [client 172.213.241.33:57911] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 10 22:45:23.290604 2026] [autoindex:error] [pid 13101:tid 13156] [client 172.213.241.33:57911] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 10 22:45:31.201674 2026] [:error] [pid 13101:tid 13157] [client 172.213.241.33:57911] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bengi.php"] [unique_id "adkNC98Ldw85818pj2oD3AAAAJg"]
[Fri Apr 10 22:45:31.744687 2026] [:error] [pid 13189:tid 13199] [client 172.213.241.33:55985] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bengi.php"] [unique_id "adkNC5AxiJKPums3eBDpZwAAAEc"]
[Fri Apr 10 22:45:32.242667 2026] [:error] [pid 62769:tid 62791] [client 172.213.241.33:62789] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bengi.php"] [unique_id "adkNDMWsSnfLoB8ifjCTQgAAAlQ"]
[Fri Apr 10 22:45:32.767712 2026] [:error] [pid 62884:tid 62892] [client 172.213.241.33:57906] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bengi.php"] [unique_id "adkNDOUCK1xrhnnmpo2RPQAAAsE"]
[Fri Apr 10 22:45:33.248495 2026] [:error] [pid 62769:tid 62780] [client 172.213.241.33:61483] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adkNDcWsSnfLoB8ifjCTTwAAAkk"]
[Fri Apr 10 22:45:33.729447 2026] [:error] [pid 62710:tid 62713] [client 172.213.241.33:39512] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adkNDeME7qrf5xEWWJszpQAAAgA"]
[Fri Apr 10 22:45:34.345055 2026] [:error] [pid 62769:tid 62772] [client 172.213.241.33:57899] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adkNDsWsSnfLoB8ifjCTUwAAAkE"]
[Fri Apr 10 22:45:34.826380 2026] [:error] [pid 63062:tid 63067] [client 172.213.241.33:62790] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "adkNDp2HtsmV85NqkMcC4QAAA4M"]
[Fri Apr 10 22:45:35.305368 2026] [:error] [pid 63134:tid 63156] [client 172.213.241.33:39546] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "adkND9FALqPDwWi6eJK58AAAA9M"]
[Fri Apr 10 22:45:35.830790 2026] [:error] [pid 63062:tid 63087] [client 172.213.241.33:57883] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "adkND52HtsmV85NqkMcC5AAAA5c"]
[Fri Apr 10 22:45:36.324165 2026] [:error] [pid 13189:tid 13194] [client 172.213.241.33:55956] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "adkNEJAxiJKPums3eBDpiQAAAEI"]
[Fri Apr 10 22:45:36.796718 2026] [:error] [pid 62769:tid 62779] [client 172.213.241.33:53472] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "adkNEMWsSnfLoB8ifjCTXQAAAkg"]
[Fri Apr 10 22:45:37.332187 2026] [:error] [pid 62769:tid 62783] [client 172.213.241.33:53449] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfashell.php"] [unique_id "adkNEcWsSnfLoB8ifjCTZgAAAkw"]
[Fri Apr 10 22:45:37.845989 2026] [:error] [pid 13189:tid 13208] [client 172.213.241.33:55987] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfashell.php"] [unique_id "adkNEZAxiJKPums3eBDpmQAAAFA"]
[Fri Apr 10 22:45:38.350078 2026] [:error] [pid 13101:tid 13138] [client 172.213.241.33:53457] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfashell.php"] [unique_id "adkNEt8Ldw85818pj2oD6AAAAIU"]
[Fri Apr 10 22:45:38.831465 2026] [:error] [pid 62884:tid 62902] [client 172.213.241.33:51022] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfashell.php"] [unique_id "adkNEuUCK1xrhnnmpo2RQwAAAss"]
[Fri Apr 10 22:45:39.332585 2026] [:error] [pid 13101:tid 13151] [client 172.213.241.33:49047] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "adkNE98Ldw85818pj2oD7gAAAJI"]
[Fri Apr 10 22:45:39.974362 2026] [:error] [pid 62769:tid 62771] [client 172.213.241.33:47156] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "adkNE8WsSnfLoB8ifjCTcQAAAkA"]
[Fri Apr 10 22:45:40.469311 2026] [:error] [pid 62769:tid 62794] [client 172.213.241.33:52750] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "adkNFMWsSnfLoB8ifjCTeAAAAlc"]
[Fri Apr 10 22:45:41.002572 2026] [:error] [pid 62710:tid 62720] [client 172.213.241.33:39532] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "adkNFeME7qrf5xEWWJszrAAAAgc"]
[Fri Apr 10 22:45:41.540266 2026] [:error] [pid 62710:tid 62716] [client 172.213.241.33:62840] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "adkNFeME7qrf5xEWWJszrQAAAgM"]
[Fri Apr 10 22:45:42.049646 2026] [:error] [pid 62769:tid 62789] [client 172.213.241.33:62829] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "adkNFsWsSnfLoB8ifjCTggAAAlI"]
[Fri Apr 10 22:45:42.515043 2026] [:error] [pid 62651:tid 62657] [client 172.213.241.33:44980] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "adkNFjbAH0le57SIaqwxEwAAAcQ"]
[Fri Apr 10 22:45:43.158118 2026] [:error] [pid 62710:tid 62732] [client 172.213.241.33:48506] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "adkNF-ME7qrf5xEWWJszswAAAhM"]
[Fri Apr 10 22:45:43.657765 2026] [:error] [pid 62651:tid 62661] [client 172.213.241.33:51044] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "adkNFzbAH0le57SIaqwxFQAAAcg"]
[Fri Apr 10 22:45:44.125777 2026] [:error] [pid 62769:tid 62779] [client 172.213.241.33:48479] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "adkNGMWsSnfLoB8ifjCTjgAAAkg"]
[Fri Apr 10 22:45:44.647249 2026] [:error] [pid 63062:tid 63087] [client 172.213.241.33:55974] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "adkNGJ2HtsmV85NqkMcC-QAAA5c"]
[Fri Apr 10 22:45:45.176422 2026] [:error] [pid 62769:tid 62778] [client 172.213.241.33:61494] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "adkNGcWsSnfLoB8ifjCTlwAAAkc"]
[Fri Apr 10 22:45:45.713792 2026] [:error] [pid 62769:tid 62776] [client 172.213.241.33:51039] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "adkNGcWsSnfLoB8ifjCTnAAAAkU"]
[Fri Apr 10 22:45:46.478195 2026] [:error] [pid 62769:tid 62779] [client 172.213.241.33:61462] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "adkNGsWsSnfLoB8ifjCTqAAAAkg"]
[Fri Apr 10 22:45:46.956022 2026] [:error] [pid 62651:tid 62671] [client 172.213.241.33:54024] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "adkNGjbAH0le57SIaqwxHwAAAdI"]
[Fri Apr 10 22:45:47.443250 2026] [:error] [pid 62769:tid 62777] [client 172.213.241.33:61464] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "adkNG8WsSnfLoB8ifjCTuQAAAkY"]
[Fri Apr 10 22:45:47.922039 2026] [:error] [pid 62710:tid 62735] [client 172.213.241.33:61485] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "adkNG-ME7qrf5xEWWJszvwAAAhY"]
[Fri Apr 10 22:45:48.529022 2026] [:error] [pid 13100:tid 13106] [client 172.213.241.33:61447] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "adkNHFzg-ZkZ0InWIP3KCAAAAQE"]
[Fri Apr 10 22:45:49.173138 2026] [:error] [pid 13101:tid 13154] [client 172.213.241.33:46838] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "adkNHd8Ldw85818pj2oEDwAAAJU"]
[Fri Apr 10 22:45:49.672305 2026] [:error] [pid 63134:tid 63160] [client 172.213.241.33:52751] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "adkNHdFALqPDwWi6eJK6BQAAA9c"]
[Fri Apr 10 22:45:50.193129 2026] [:error] [pid 13101:tid 13136] [client 172.213.241.33:53463] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "adkNHt8Ldw85818pj2oEGQAAAIM"]
[Fri Apr 10 22:45:50.681212 2026] [:error] [pid 62819:tid 62830] [client 172.213.241.33:55954] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "adkNHvU20EyPf7Nlsld5RQAAAog"]
[Fri Apr 10 22:45:51.142428 2026] [:error] [pid 13189:tid 13213] [client 172.213.241.33:57904] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "adkNH5AxiJKPums3eBDpwwAAAFU"]
[Fri Apr 10 22:45:51.649101 2026] [:error] [pid 13101:tid 13152] [client 172.213.241.33:51681] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "adkNH98Ldw85818pj2oEHwAAAJM"]
[Fri Apr 10 22:45:52.112680 2026] [:error] [pid 13101:tid 13137] [client 172.213.241.33:44976] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ew.php"] [unique_id "adkNIN8Ldw85818pj2oEJAAAAIQ"]
[Fri Apr 10 22:45:52.614341 2026] [:error] [pid 13189:tid 13199] [client 172.213.241.33:51671] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ew.php"] [unique_id "adkNIJAxiJKPums3eBDpygAAAEc"]
[Fri Apr 10 22:45:53.136443 2026] [:error] [pid 63134:tid 63137] [client 172.213.241.33:62801] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ew.php"] [unique_id "adkNIdFALqPDwWi6eJK6DwAAA8A"]
[Fri Apr 10 22:45:53.612378 2026] [:error] [pid 13189:tid 13200] [client 172.213.241.33:49042] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ew.php"] [unique_id "adkNIZAxiJKPums3eBDpzAAAAEg"]
[Fri Apr 10 22:45:54.093517 2026] [:error] [pid 13189:tid 13202] [client 172.213.241.33:55960] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file21.php"] [unique_id "adkNIpAxiJKPums3eBDp0QAAAEo"]
[Fri Apr 10 22:45:54.605954 2026] [:error] [pid 62769:tid 62773] [client 172.213.241.33:54067] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file21.php"] [unique_id "adkNIsWsSnfLoB8ifjCT0wAAAkI"]
[Fri Apr 10 22:45:55.099148 2026] [:error] [pid 13189:tid 13216] [client 172.213.241.33:55996] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file21.php"] [unique_id "adkNI5AxiJKPums3eBDp1gAAAFg"]
[Fri Apr 10 22:45:55.578911 2026] [:error] [pid 62769:tid 62781] [client 172.213.241.33:52789] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file21.php"] [unique_id "adkNI8WsSnfLoB8ifjCT3AAAAko"]
[Fri Apr 10 22:45:56.157914 2026] [:error] [pid 62769:tid 62791] [client 172.213.241.33:53441] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "adkNJMWsSnfLoB8ifjCT4gAAAlQ"]
[Fri Apr 10 22:45:56.653519 2026] [:error] [pid 62710:tid 62737] [client 172.213.241.33:44970] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "adkNJOME7qrf5xEWWJszzwAAAhg"]
[Fri Apr 10 22:45:57.225771 2026] [:error] [pid 62884:tid 62913] [client 172.213.241.33:54029] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "adkNJeUCK1xrhnnmpo2RWQAAAtY"]
[Fri Apr 10 22:45:57.693803 2026] [:error] [pid 62710:tid 62722] [client 172.213.241.33:61497] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class19.php"] [unique_id "adkNJeME7qrf5xEWWJsz1AAAAgk"]
[Fri Apr 10 22:45:58.163725 2026] [:error] [pid 62710:tid 62718] [client 172.213.241.33:54034] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "adkNJuME7qrf5xEWWJsz1gAAAgU"]
[Fri Apr 10 22:45:58.640371 2026] [:error] [pid 62769:tid 62791] [client 172.213.241.33:62839] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "adkNJsWsSnfLoB8ifjCT7gAAAlQ"]
[Fri Apr 10 22:45:59.188886 2026] [:error] [pid 62769:tid 62782] [client 172.213.241.33:39538] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "adkNJ8WsSnfLoB8ifjCT9wAAAks"]
[Fri Apr 10 22:45:59.659401 2026] [:error] [pid 13101:tid 13153] [client 172.213.241.33:54062] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class20.php"] [unique_id "adkNJ98Ldw85818pj2oEMgAAAJQ"]
[Fri Apr 10 22:46:00.123918 2026] [:error] [pid 63134:tid 63150] [client 172.213.241.33:62847] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "adkNKNFALqPDwWi6eJK6GQAAA80"]
[Fri Apr 10 22:46:00.606816 2026] [:error] [pid 13189:tid 13210] [client 172.213.241.33:51695] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "adkNKJAxiJKPums3eBDp2gAAAFI"]
[Fri Apr 10 22:46:01.099359 2026] [:error] [pid 62710:tid 62735] [client 172.213.241.33:61448] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "adkNKeME7qrf5xEWWJsz3AAAAhY"]
[Fri Apr 10 22:46:01.642421 2026] [:error] [pid 62710:tid 62728] [client 172.213.241.33:54031] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "adkNKeME7qrf5xEWWJsz4gAAAg8"]
[Fri Apr 10 22:46:02.195812 2026] [:error] [pid 62769:tid 62781] [client 172.213.241.33:61485] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "adkNKsWsSnfLoB8ifjCT_gAAAko"]
[Fri Apr 10 22:46:02.733576 2026] [:error] [pid 62769:tid 62777] [client 172.213.241.33:54048] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "adkNKsWsSnfLoB8ifjCUAgAAAkY"]
[Fri Apr 10 22:46:03.206101 2026] [:error] [pid 13189:tid 13212] [client 172.213.241.33:54073] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "adkNK5AxiJKPums3eBDp5AAAAFQ"]
[Fri Apr 10 22:46:03.733553 2026] [:error] [pid 13189:tid 13200] [client 172.213.241.33:39519] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "adkNK5AxiJKPums3eBDp7QAAAEg"]
[Fri Apr 10 22:46:04.314331 2026] [:error] [pid 62710:tid 62719] [client 172.213.241.33:51659] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cabs.php"] [unique_id "adkNLOME7qrf5xEWWJsz6AAAAgY"]
[Fri Apr 10 22:46:04.907948 2026] [:error] [pid 13189:tid 13195] [client 172.213.241.33:44972] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cabs.php"] [unique_id "adkNLJAxiJKPums3eBDp9AAAAEM"]
[Fri Apr 10 22:46:05.482073 2026] [:error] [pid 63062:tid 63083] [client 172.213.241.33:51035] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cabs.php"] [unique_id "adkNLZ2HtsmV85NqkMcDFAAAA5M"]
[Fri Apr 10 22:46:06.014483 2026] [:error] [pid 13100:tid 13124] [client 172.213.241.33:46805] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cabs.php"] [unique_id "adkNLlzg-ZkZ0InWIP3KEAAAARM"]
[Fri Apr 10 22:46:06.525267 2026] [:error] [pid 13189:tid 13211] [client 172.213.241.33:46828] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "adkNLpAxiJKPums3eBDp-AAAAFM"]
[Fri Apr 10 22:46:06.995072 2026] [:error] [pid 13101:tid 13145] [client 172.213.241.33:62812] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "adkNLt8Ldw85818pj2oEPAAAAIw"]
[Fri Apr 10 22:46:07.514481 2026] [:error] [pid 13101:tid 13157] [client 172.213.241.33:47123] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "adkNL98Ldw85818pj2oEQgAAAJg"]
[Fri Apr 10 22:46:07.979015 2026] [:error] [pid 13101:tid 13136] [client 172.213.241.33:44960] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "adkNL98Ldw85818pj2oERwAAAIM"]
[Fri Apr 10 22:46:08.472452 2026] [:error] [pid 13101:tid 13150] [client 172.213.241.33:61452] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1da.php"] [unique_id "adkNMN8Ldw85818pj2oESgAAAJE"]
[Fri Apr 10 22:46:08.986745 2026] [:error] [pid 62769:tid 62787] [client 172.213.241.33:55976] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1da.php"] [unique_id "adkNMMWsSnfLoB8ifjCUEwAAAlA"]
[Fri Apr 10 22:46:09.570660 2026] [:error] [pid 13189:tid 13213] [client 172.213.241.33:51698] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1da.php"] [unique_id "adkNMZAxiJKPums3eBDqAAAAAFU"]
[Fri Apr 10 22:46:10.102949 2026] [:error] [pid 13189:tid 13214] [client 172.213.241.33:51008] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1da.php"] [unique_id "adkNMpAxiJKPums3eBDqBgAAAFY"]
[Fri Apr 10 22:46:10.584559 2026] [:error] [pid 13189:tid 13196] [client 172.213.241.33:47112] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "adkNMpAxiJKPums3eBDqDQAAAEQ"]
[Fri Apr 10 22:46:11.077072 2026] [:error] [pid 63134:tid 63151] [client 172.213.241.33:61500] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "adkNM9FALqPDwWi6eJK6HgAAA84"]
[Fri Apr 10 22:46:11.546312 2026] [:error] [pid 63134:tid 63141] [client 172.213.241.33:39497] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "adkNM9FALqPDwWi6eJK6IgAAA8Q"]
[Fri Apr 10 22:46:12.008634 2026] [:error] [pid 13101:tid 13134] [client 172.213.241.33:47144] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "adkNNN8Ldw85818pj2oEWAAAAIE"]
[Fri Apr 10 22:46:12.483196 2026] [:error] [pid 13101:tid 13142] [client 172.213.241.33:44975] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "adkNNN8Ldw85818pj2oEXAAAAIk"]
[Fri Apr 10 22:46:13.977691 2026] [:error] [pid 62651:tid 62660] [client 172.213.241.33:46841] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "adkNNTbAH0le57SIaqwxKQAAAcc"]
[Fri Apr 10 22:46:14.549091 2026] [:error] [pid 13100:tid 13110] [client 172.213.241.33:52769] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "adkNNlzg-ZkZ0InWIP3KFgAAAQU"]
[Fri Apr 10 22:46:15.139671 2026] [:error] [pid 13189:tid 13201] [client 172.213.241.33:54064] [client 172.213.241.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "adkNN5AxiJKPums3eBDqDwAAAEk"]
[Fri Apr 10 23:00:52.253389 2026] [:error] [pid 63062:tid 63080] [client 20.240.45.10:33030] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/option.php"] [unique_id "adkQpJ2HtsmV85NqkMcHUwAAA5A"]
[Fri Apr 10 23:00:52.976738 2026] [:error] [pid 13189:tid 13201] [client 20.240.45.10:26798] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/option.php"] [unique_id "adkQpJAxiJKPums3eBD0FAAAAEk"]
[Fri Apr 10 23:00:53.553130 2026] [:error] [pid 62651:tid 62668] [client 20.240.45.10:27567] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/option.php"] [unique_id "adkQpTbAH0le57SIaqwzowAAAc8"]
[Fri Apr 10 23:00:54.443002 2026] [:error] [pid 62884:tid 62900] [client 20.240.45.10:23056] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/option.php"] [unique_id "adkQpuUCK1xrhnnmpo2ULQAAAsk"]
[Fri Apr 10 23:00:55.103056 2026] [:error] [pid 62769:tid 62795] [client 20.240.45.10:61629] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/OK.php"] [unique_id "adkQp8WsSnfLoB8ifjCfbAAAAlg"]
[Fri Apr 10 23:00:55.906623 2026] [:error] [pid 62819:tid 62823] [client 20.240.45.10:54148] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/OK.php"] [unique_id "adkQp_U20EyPf7Nlsld8nAAAAoE"]
[Fri Apr 10 23:00:56.917397 2026] [:error] [pid 62819:tid 62837] [client 20.240.45.10:54173] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/OK.php"] [unique_id "adkQqPU20EyPf7Nlsld8ngAAAo8"]
[Fri Apr 10 23:00:57.701295 2026] [:error] [pid 63062:tid 63075] [client 20.240.45.10:33141] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/OK.php"] [unique_id "adkQqZ2HtsmV85NqkMcHVQAAA4s"]
[Fri Apr 10 23:00:58.462115 2026] [:error] [pid 62819:tid 62842] [client 20.240.45.10:26753] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "adkQqvU20EyPf7Nlsld8oQAAApQ"]
[Fri Apr 10 23:00:59.229884 2026] [:error] [pid 63134:tid 63149] [client 20.240.45.10:54194] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "adkQq9FALqPDwWi6eJK-WwAAA8w"]
[Fri Apr 10 23:00:59.828211 2026] [:error] [pid 63134:tid 63148] [client 20.240.45.10:39190] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "adkQq9FALqPDwWi6eJK-XAAAA8s"]
[Fri Apr 10 23:01:00.424017 2026] [:error] [pid 62819:tid 62836] [client 20.240.45.10:22883] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "adkQrPU20EyPf7Nlsld8pAAAAo4"]
[Fri Apr 10 23:01:01.167404 2026] [:error] [pid 13100:tid 13107] [client 20.240.45.10:23072] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/F1jgmosvPbq.php"] [unique_id "adkQrVzg-ZkZ0InWIP3NIwAAAQI"]
[Fri Apr 10 23:01:01.788949 2026] [:error] [pid 13100:tid 13115] [client 20.240.45.10:36659] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/F1jgmosvPbq.php"] [unique_id "adkQrVzg-ZkZ0InWIP3NJQAAAQo"]
[Fri Apr 10 23:01:02.406779 2026] [:error] [pid 62651:tid 62676] [client 20.240.45.10:27579] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/F1jgmosvPbq.php"] [unique_id "adkQrjbAH0le57SIaqwzrAAAAdc"]
[Fri Apr 10 23:01:02.971845 2026] [:error] [pid 62710:tid 62721] [client 20.240.45.10:33121] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/F1jgmosvPbq.php"] [unique_id "adkQruME7qrf5xEWWJs5RQAAAgg"]
[Fri Apr 10 23:01:03.751418 2026] [:error] [pid 13101:tid 13143] [client 20.240.45.10:23101] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v1Cd9rWaZMx.php"] [unique_id "adkQr98Ldw85818pj2oNcgAAAIo"]
[Fri Apr 10 23:01:04.278970 2026] [:error] [pid 62769:tid 62780] [client 20.240.45.10:33059] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v1Cd9rWaZMx.php"] [unique_id "adkQsMWsSnfLoB8ifjCfbgAAAkk"]
[Fri Apr 10 23:01:04.912431 2026] [:error] [pid 13101:tid 13138] [client 20.240.45.10:26755] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v1Cd9rWaZMx.php"] [unique_id "adkQsN8Ldw85818pj2oNdgAAAIU"]
[Fri Apr 10 23:01:05.535520 2026] [:error] [pid 62710:tid 62734] [client 20.240.45.10:39217] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v1Cd9rWaZMx.php"] [unique_id "adkQseME7qrf5xEWWJs5RwAAAhU"]
[Fri Apr 10 23:01:06.123640 2026] [:error] [pid 62710:tid 62713] [client 20.240.45.10:27521] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NexusLeads.php"] [unique_id "adkQsuME7qrf5xEWWJs5SgAAAgA"]
[Fri Apr 10 23:01:06.702150 2026] [:error] [pid 63134:tid 63138] [client 20.240.45.10:39175] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NexusLeads.php"] [unique_id "adkQstFALqPDwWi6eJK-YgAAA8E"]
[Fri Apr 10 23:01:07.262427 2026] [:error] [pid 63134:tid 63155] [client 20.240.45.10:36876] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NexusLeads.php"] [unique_id "adkQs9FALqPDwWi6eJK-YwAAA9I"]
[Fri Apr 10 23:01:07.876176 2026] [:error] [pid 63134:tid 63137] [client 20.240.45.10:33054] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/NexusLeads.php"] [unique_id "adkQs9FALqPDwWi6eJK-ZQAAA8A"]
[Fri Apr 10 23:01:08.506044 2026] [:error] [pid 13189:tid 13210] [client 20.240.45.10:26778] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rfzhh.php"] [unique_id "adkQtJAxiJKPums3eBD0IgAAAFI"]
[Fri Apr 10 23:01:09.256063 2026] [:error] [pid 62769:tid 62781] [client 20.240.45.10:61595] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rfzhh.php"] [unique_id "adkQtcWsSnfLoB8ifjCfcwAAAko"]
[Fri Apr 10 23:01:09.923272 2026] [:error] [pid 62769:tid 62787] [client 20.240.45.10:39215] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rfzhh.php"] [unique_id "adkQtcWsSnfLoB8ifjCfeQAAAlA"]
[Fri Apr 10 23:01:10.526930 2026] [:error] [pid 62769:tid 62795] [client 20.240.45.10:33086] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rfzhh.php"] [unique_id "adkQtsWsSnfLoB8ifjCffAAAAlg"]
[Fri Apr 10 23:01:11.058813 2026] [:error] [pid 62769:tid 62786] [client 20.240.45.10:39173] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugin-wp.php"] [unique_id "adkQt8WsSnfLoB8ifjCfgQAAAk8"]
[Fri Apr 10 23:01:11.604297 2026] [:error] [pid 62769:tid 62784] [client 20.240.45.10:26766] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugin-wp.php"] [unique_id "adkQt8WsSnfLoB8ifjCfgwAAAk0"]
[Fri Apr 10 23:01:12.122786 2026] [:error] [pid 62769:tid 62789] [client 20.240.45.10:54152] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugin-wp.php"] [unique_id "adkQuMWsSnfLoB8ifjCfhwAAAlI"]
[Fri Apr 10 23:01:12.645825 2026] [:error] [pid 62769:tid 62778] [client 20.240.45.10:54164] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugin-wp.php"] [unique_id "adkQuMWsSnfLoB8ifjCfiQAAAkc"]
[Fri Apr 10 23:01:13.169937 2026] [:error] [pid 63134:tid 63148] [client 20.240.45.10:36890] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uplozyu.php"] [unique_id "adkQudFALqPDwWi6eJK-awAAA8s"]
[Fri Apr 10 23:01:13.702260 2026] [:error] [pid 62819:tid 62839] [client 20.240.45.10:22861] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uplozyu.php"] [unique_id "adkQufU20EyPf7Nlsld8sAAAApE"]
[Fri Apr 10 23:01:14.220143 2026] [:error] [pid 63134:tid 63138] [client 20.240.45.10:39454] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uplozyu.php"] [unique_id "adkQutFALqPDwWi6eJK-bAAAA8E"]
[Fri Apr 10 23:01:14.778248 2026] [:error] [pid 62884:tid 62905] [client 20.240.45.10:26782] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uplozyu.php"] [unique_id "adkQuuUCK1xrhnnmpo2UVgAAAs4"]
[Fri Apr 10 23:01:15.341809 2026] [:error] [pid 62710:tid 62734] [client 20.240.45.10:54181] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4oivIQALaOZ.php"] [unique_id "adkQu-ME7qrf5xEWWJs5UAAAAhU"]
[Fri Apr 10 23:01:15.872645 2026] [:error] [pid 63062:tid 63080] [client 20.240.45.10:61582] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4oivIQALaOZ.php"] [unique_id "adkQu52HtsmV85NqkMcHXgAAA5A"]
[Fri Apr 10 23:01:16.402185 2026] [:error] [pid 62884:tid 62915] [client 20.240.45.10:23055] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4oivIQALaOZ.php"] [unique_id "adkQvOUCK1xrhnnmpo2UVwAAAtg"]
[Fri Apr 10 23:01:16.954462 2026] [:error] [pid 63134:tid 63158] [client 20.240.45.10:36612] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4oivIQALaOZ.php"] [unique_id "adkQvNFALqPDwWi6eJK-bgAAA9U"]
[Fri Apr 10 23:01:17.499121 2026] [:error] [pid 13101:tid 13149] [client 20.240.45.10:36922] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lpktuneq.php"] [unique_id "adkQvd8Ldw85818pj2oNtAAAAJA"]
[Fri Apr 10 23:01:18.034810 2026] [:error] [pid 63134:tid 63137] [client 20.240.45.10:27539] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lpktuneq.php"] [unique_id "adkQvtFALqPDwWi6eJK-bwAAA8A"]
[Fri Apr 10 23:01:18.581004 2026] [:error] [pid 62884:tid 62902] [client 20.240.45.10:23090] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lpktuneq.php"] [unique_id "adkQvuUCK1xrhnnmpo2UWQAAAss"]
[Fri Apr 10 23:01:19.128917 2026] [:error] [pid 13101:tid 13153] [client 20.240.45.10:54204] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lpktuneq.php"] [unique_id "adkQv98Ldw85818pj2oNuwAAAJQ"]
[Fri Apr 10 23:01:19.687409 2026] [:error] [pid 63134:tid 63151] [client 20.240.45.10:54162] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5cnobsvIfGg.php"] [unique_id "adkQv9FALqPDwWi6eJK-cQAAA84"]
[Fri Apr 10 23:01:20.321060 2026] [:error] [pid 63134:tid 63152] [client 20.240.45.10:61587] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5cnobsvIfGg.php"] [unique_id "adkQwNFALqPDwWi6eJK-cwAAA88"]
[Fri Apr 10 23:01:20.878651 2026] [:error] [pid 62769:tid 62788] [client 20.240.45.10:36614] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5cnobsvIfGg.php"] [unique_id "adkQwMWsSnfLoB8ifjCfkgAAAlE"]
[Fri Apr 10 23:01:21.439648 2026] [:error] [pid 63134:tid 63149] [client 20.240.45.10:39222] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5cnobsvIfGg.php"] [unique_id "adkQwdFALqPDwWi6eJK-dwAAA8w"]
[Fri Apr 10 23:01:22.000675 2026] [:error] [pid 63062:tid 63083] [client 20.240.45.10:36887] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-widgets.php"] [unique_id "adkQwZ2HtsmV85NqkMcHZQAAA5M"]
[Fri Apr 10 23:01:22.526884 2026] [:error] [pid 62651:tid 62677] [client 20.240.45.10:33096] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-widgets.php"] [unique_id "adkQwjbAH0le57SIaqwzsQAAAdg"]
[Fri Apr 10 23:01:23.077351 2026] [:error] [pid 13100:tid 13106] [client 20.240.45.10:39187] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-widgets.php"] [unique_id "adkQw1zg-ZkZ0InWIP3NNgAAAQE"]
[Fri Apr 10 23:01:23.603862 2026] [:error] [pid 13101:tid 13151] [client 20.240.45.10:33065] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-widgets.php"] [unique_id "adkQw98Ldw85818pj2oNvQAAAJI"]
[Fri Apr 10 23:01:24.161550 2026] [:error] [pid 63134:tid 63139] [client 20.240.45.10:36609] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tsconfig.php"] [unique_id "adkQxNFALqPDwWi6eJK-eQAAA8I"]
[Fri Apr 10 23:01:24.706964 2026] [:error] [pid 13101:tid 13156] [client 20.240.45.10:26805] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tsconfig.php"] [unique_id "adkQxN8Ldw85818pj2oNvgAAAJc"]
[Fri Apr 10 23:01:25.244136 2026] [:error] [pid 13189:tid 13206] [client 20.240.45.10:26813] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tsconfig.php"] [unique_id "adkQxZAxiJKPums3eBD0OgAAAE4"]
[Fri Apr 10 23:01:25.918629 2026] [:error] [pid 63062:tid 63076] [client 20.240.45.10:23073] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tsconfig.php"] [unique_id "adkQxZ2HtsmV85NqkMcHaAAAA4w"]
[Fri Apr 10 23:01:26.473473 2026] [:error] [pid 62769:tid 62784] [client 20.240.45.10:23102] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ptFWN5XHUb1.php"] [unique_id "adkQxsWsSnfLoB8ifjCfnQAAAk0"]
[Fri Apr 10 23:01:27.163015 2026] [:error] [pid 62769:tid 62785] [client 20.240.45.10:36889] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ptFWN5XHUb1.php"] [unique_id "adkQx8WsSnfLoB8ifjCfogAAAk4"]
[Fri Apr 10 23:01:27.708399 2026] [:error] [pid 62769:tid 62786] [client 20.240.45.10:61593] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ptFWN5XHUb1.php"] [unique_id "adkQx8WsSnfLoB8ifjCfpQAAAk8"]
[Fri Apr 10 23:01:28.255136 2026] [:error] [pid 62769:tid 62771] [client 20.240.45.10:39184] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ptFWN5XHUb1.php"] [unique_id "adkQyMWsSnfLoB8ifjCfqwAAAkA"]
[Fri Apr 10 23:01:28.823774 2026] [:error] [pid 62710:tid 62721] [client 20.240.45.10:10678] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/YpWD4kv2sPG.php"] [unique_id "adkQyOME7qrf5xEWWJs5WQAAAgg"]
[Fri Apr 10 23:01:29.360850 2026] [:error] [pid 13101:tid 13153] [client 20.240.45.10:36670] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/YpWD4kv2sPG.php"] [unique_id "adkQyd8Ldw85818pj2oNwQAAAJQ"]
[Fri Apr 10 23:01:29.914747 2026] [:error] [pid 62651:tid 62665] [client 20.240.45.10:54169] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/YpWD4kv2sPG.php"] [unique_id "adkQyTbAH0le57SIaqwztwAAAcw"]
[Fri Apr 10 23:01:30.449435 2026] [:error] [pid 62769:tid 62784] [client 20.240.45.10:54178] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/YpWD4kv2sPG.php"] [unique_id "adkQysWsSnfLoB8ifjCftgAAAk0"]
[Fri Apr 10 23:01:31.013935 2026] [:error] [pid 63062:tid 63083] [client 20.240.45.10:36633] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/turbo.php"] [unique_id "adkQy52HtsmV85NqkMcHcgAAA5M"]
[Fri Apr 10 23:01:31.559190 2026] [:error] [pid 62651:tid 62667] [client 20.240.45.10:33056] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/turbo.php"] [unique_id "adkQyzbAH0le57SIaqwzuAAAAc4"]
[Fri Apr 10 23:01:32.097206 2026] [:error] [pid 63062:tid 63064] [client 20.240.45.10:36655] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/turbo.php"] [unique_id "adkQzJ2HtsmV85NqkMcHdwAAA4A"]
[Fri Apr 10 23:01:32.617037 2026] [:error] [pid 62769:tid 62789] [client 20.240.45.10:36662] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/turbo.php"] [unique_id "adkQzMWsSnfLoB8ifjCfuwAAAlI"]
[Fri Apr 10 23:01:33.154352 2026] [:error] [pid 62884:tid 62911] [client 20.240.45.10:39225] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/small.php"] [unique_id "adkQzeUCK1xrhnnmpo2UXQAAAtQ"]
[Fri Apr 10 23:01:33.699474 2026] [:error] [pid 13100:tid 13119] [client 20.240.45.10:39479] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/small.php"] [unique_id "adkQzVzg-ZkZ0InWIP3NPAAAAQ4"]
[Fri Apr 10 23:01:34.253990 2026] [:error] [pid 13101:tid 13139] [client 20.240.45.10:39205] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/small.php"] [unique_id "adkQzt8Ldw85818pj2oNygAAAIY"]
[Fri Apr 10 23:01:34.796870 2026] [:error] [pid 13101:tid 13149] [client 20.240.45.10:23095] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/small.php"] [unique_id "adkQzt8Ldw85818pj2oNzQAAAJA"]
[Fri Apr 10 23:01:35.316670 2026] [:error] [pid 62651:tid 62661] [client 20.240.45.10:39186] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/SE6yfkFKuQA.php"] [unique_id "adkQzzbAH0le57SIaqwzvgAAAcg"]
[Fri Apr 10 23:01:35.841509 2026] [:error] [pid 62769:tid 62784] [client 20.240.45.10:54185] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/SE6yfkFKuQA.php"] [unique_id "adkQz8WsSnfLoB8ifjCf0wAAAk0"]
[Fri Apr 10 23:01:36.371754 2026] [:error] [pid 63062:tid 63079] [client 20.240.45.10:27545] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/SE6yfkFKuQA.php"] [unique_id "adkQ0J2HtsmV85NqkMcHgQAAA48"]
[Fri Apr 10 23:01:36.914862 2026] [:error] [pid 62769:tid 62783] [client 20.240.45.10:36642] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/SE6yfkFKuQA.php"] [unique_id "adkQ0MWsSnfLoB8ifjCf9gAAAkw"]
[Fri Apr 10 23:01:37.458836 2026] [:error] [pid 13101:tid 13141] [client 20.240.45.10:33044] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6Vtfo6i9f2.php"] [unique_id "adkQ0d8Ldw85818pj2oN0QAAAIg"]
[Fri Apr 10 23:01:37.985019 2026] [:error] [pid 62710:tid 62718] [client 20.240.45.10:54183] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6Vtfo6i9f2.php"] [unique_id "adkQ0eME7qrf5xEWWJs5aAAAAgU"]
[Fri Apr 10 23:01:38.558765 2026] [:error] [pid 13189:tid 13192] [client 20.240.45.10:23092] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6Vtfo6i9f2.php"] [unique_id "adkQ0pAxiJKPums3eBD0ZAAAAEA"]
[Fri Apr 10 23:01:39.086696 2026] [:error] [pid 62769:tid 62792] [client 20.240.45.10:20173] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6Vtfo6i9f2.php"] [unique_id "adkQ08WsSnfLoB8ifjCgNwAAAlU"]
[Fri Apr 10 23:01:39.684106 2026] [:error] [pid 63134:tid 63148] [client 20.240.45.10:36883] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/veoblmpa.php"] [unique_id "adkQ09FALqPDwWi6eJK-fwAAA8s"]
[Fri Apr 10 23:01:40.201903 2026] [:error] [pid 13189:tid 13207] [client 20.240.45.10:22864] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/veoblmpa.php"] [unique_id "adkQ1JAxiJKPums3eBD0ZwAAAE8"]
[Fri Apr 10 23:01:40.725798 2026] [:error] [pid 63062:tid 63068] [client 20.240.45.10:39179] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/veoblmpa.php"] [unique_id "adkQ1J2HtsmV85NqkMcHnQAAA4Q"]
[Fri Apr 10 23:01:41.247574 2026] [:error] [pid 13189:tid 13215] [client 20.240.45.10:26762] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/veoblmpa.php"] [unique_id "adkQ1ZAxiJKPums3eBD0aAAAAFc"]
[Fri Apr 10 23:01:41.786130 2026] [:error] [pid 62769:tid 62771] [client 20.240.45.10:39434] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-wp-pagebuilders-1QlZPC.php"] [unique_id "adkQ1cWsSnfLoB8ifjCgdQAAAkA"]
[Fri Apr 10 23:01:42.310783 2026] [:error] [pid 13101:tid 13140] [client 20.240.45.10:22891] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-wp-pagebuilders-1QlZPC.php"] [unique_id "adkQ1t8Ldw85818pj2oN2gAAAIc"]
[Fri Apr 10 23:01:42.827850 2026] [:error] [pid 62769:tid 62792] [client 20.240.45.10:33118] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-wp-pagebuilders-1QlZPC.php"] [unique_id "adkQ1sWsSnfLoB8ifjCgfgAAAlU"]
[Fri Apr 10 23:01:43.348845 2026] [:error] [pid 63134:tid 63147] [client 20.240.45.10:22857] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-wp-pagebuilders-1QlZPC.php"] [unique_id "adkQ19FALqPDwWi6eJK-hQAAA8o"]
[Fri Apr 10 23:01:43.888698 2026] [:error] [pid 13189:tid 13209] [client 20.240.45.10:39212] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/levyzxsb.php"] [unique_id "adkQ15AxiJKPums3eBD0agAAAFE"]
[Fri Apr 10 23:01:44.409485 2026] [:error] [pid 13101:tid 13139] [client 20.240.45.10:22853] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/levyzxsb.php"] [unique_id "adkQ2N8Ldw85818pj2oN4AAAAIY"]
[Fri Apr 10 23:01:44.954746 2026] [:error] [pid 62710:tid 62713] [client 20.240.45.10:33095] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/levyzxsb.php"] [unique_id "adkQ2OME7qrf5xEWWJs5ggAAAgA"]
[Fri Apr 10 23:01:45.486105 2026] [:error] [pid 13189:tid 13200] [client 20.240.45.10:36870] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/levyzxsb.php"] [unique_id "adkQ2ZAxiJKPums3eBD0bwAAAEg"]
[Fri Apr 10 23:01:46.022500 2026] [:error] [pid 62769:tid 62772] [client 20.240.45.10:39462] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/HtQmJOArI4R.php"] [unique_id "adkQ2sWsSnfLoB8ifjCgmwAAAkE"]
[Fri Apr 10 23:01:46.549436 2026] [:error] [pid 13100:tid 13117] [client 20.240.45.10:39470] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/HtQmJOArI4R.php"] [unique_id "adkQ2lzg-ZkZ0InWIP3NggAAAQw"]
[Fri Apr 10 23:01:47.074669 2026] [:error] [pid 13189:tid 13201] [client 20.240.45.10:27555] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/HtQmJOArI4R.php"] [unique_id "adkQ25AxiJKPums3eBD0cQAAAEk"]
[Fri Apr 10 23:01:47.605531 2026] [:error] [pid 62769:tid 62772] [client 20.240.45.10:61588] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/HtQmJOArI4R.php"] [unique_id "adkQ28WsSnfLoB8ifjCgpgAAAkE"]
[Fri Apr 10 23:01:48.151500 2026] [:error] [pid 13101:tid 13134] [client 20.240.45.10:33050] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2whl5XBpvzE.php"] [unique_id "adkQ3N8Ldw85818pj2oN6QAAAIE"]
[Fri Apr 10 23:01:48.679302 2026] [:error] [pid 62769:tid 62783] [client 20.240.45.10:26797] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2whl5XBpvzE.php"] [unique_id "adkQ3MWsSnfLoB8ifjCgqwAAAkw"]
[Fri Apr 10 23:01:49.204526 2026] [:error] [pid 13101:tid 13137] [client 20.240.45.10:10651] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2whl5XBpvzE.php"] [unique_id "adkQ3d8Ldw85818pj2oN6wAAAIQ"]
[Fri Apr 10 23:01:49.795792 2026] [:error] [pid 62769:tid 62772] [client 20.240.45.10:54207] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2whl5XBpvzE.php"] [unique_id "adkQ3cWsSnfLoB8ifjCgtQAAAkE"]
[Fri Apr 10 23:01:50.375726 2026] [:error] [pid 13101:tid 13143] [client 20.240.45.10:22870] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jtMi25FrDCR.php"] [unique_id "adkQ3t8Ldw85818pj2oN7gAAAIo"]
[Fri Apr 10 23:01:50.905682 2026] [:error] [pid 62769:tid 62777] [client 20.240.45.10:54175] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jtMi25FrDCR.php"] [unique_id "adkQ3sWsSnfLoB8ifjCgvwAAAkY"]
[Fri Apr 10 23:02:03.025097 2026] [:error] [pid 63134:tid 63156] [client 20.240.45.10:36901] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kmsOihDGg24.php"] [unique_id "adkQ69FALqPDwWi6eJK-rwAAA9M"]
[Fri Apr 10 23:02:03.544382 2026] [:error] [pid 62710:tid 62734] [client 20.240.45.10:61589] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kmsOihDGg24.php"] [unique_id "adkQ6-ME7qrf5xEWWJs5kAAAAhU"]
[Fri Apr 10 23:02:04.065847 2026] [:error] [pid 62884:tid 62901] [client 20.240.45.10:36627] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kmsOihDGg24.php"] [unique_id "adkQ7OUCK1xrhnnmpo2UbQAAAso"]
[Fri Apr 10 23:02:04.595964 2026] [:error] [pid 62884:tid 62909] [client 20.240.45.10:39482] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kmsOihDGg24.php"] [unique_id "adkQ7OUCK1xrhnnmpo2UbgAAAtI"]
[Fri Apr 10 23:02:05.127006 2026] [:error] [pid 63062:tid 63064] [client 20.240.45.10:27578] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-wp-more.php"] [unique_id "adkQ7Z2HtsmV85NqkMcHqAAAA4A"]
[Fri Apr 10 23:02:05.664688 2026] [:error] [pid 62884:tid 62892] [client 20.240.45.10:27569] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-wp-more.php"] [unique_id "adkQ7eUCK1xrhnnmpo2UcAAAAsE"]
[Fri Apr 10 23:02:06.201819 2026] [:error] [pid 62710:tid 62733] [client 20.240.45.10:36879] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-wp-more.php"] [unique_id "adkQ7uME7qrf5xEWWJs5lwAAAhQ"]
[Fri Apr 10 23:02:06.729522 2026] [:error] [pid 63062:tid 63071] [client 20.240.45.10:27558] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-wp-more.php"] [unique_id "adkQ7p2HtsmV85NqkMcHsQAAA4c"]
[Fri Apr 10 23:02:07.251912 2026] [:error] [pid 62710:tid 62718] [client 20.240.45.10:36915] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zMjcvbswY.php"] [unique_id "adkQ7-ME7qrf5xEWWJs5owAAAgU"]
[Fri Apr 10 23:02:07.771530 2026] [:error] [pid 62819:tid 62826] [client 20.240.45.10:61589] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zMjcvbswY.php"] [unique_id "adkQ7_U20EyPf7Nlsld8ygAAAoQ"]
[Fri Apr 10 23:02:08.298419 2026] [:error] [pid 13100:tid 13108] [client 20.240.45.10:61586] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zMjcvbswY.php"] [unique_id "adkQ8Fzg-ZkZ0InWIP3NiwAAAQM"]
[Fri Apr 10 23:02:08.847919 2026] [:error] [pid 62819:tid 62846] [client 20.240.45.10:39218] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zMjcvbswY.php"] [unique_id "adkQ8PU20EyPf7Nlsld8zgAAApg"]
[Fri Apr 10 23:02:09.370298 2026] [:error] [pid 63134:tid 63147] [client 20.240.45.10:33087] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4SnNfidKMe3.php"] [unique_id "adkQ8dFALqPDwWi6eJK-sgAAA8o"]
[Fri Apr 10 23:02:09.892637 2026] [:error] [pid 13101:tid 13143] [client 20.240.45.10:26785] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4SnNfidKMe3.php"] [unique_id "adkQ8d8Ldw85818pj2oOCwAAAIo"]
[Fri Apr 10 23:02:10.445854 2026] [:error] [pid 63062:tid 63066] [client 20.240.45.10:36885] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4SnNfidKMe3.php"] [unique_id "adkQ8p2HtsmV85NqkMcHxgAAA4I"]
[Fri Apr 10 23:02:11.004067 2026] [:error] [pid 62710:tid 62719] [client 20.240.45.10:19371] [client 20.240.45.10] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4SnNfidKMe3.php"] [unique_id "adkQ8-ME7qrf5xEWWJs5pwAAAgY"]
[Sat Apr 11 01:21:39.817935 2026] [:error] [pid 21570:tid 21690] [client 107.3.193.3:53292] [client 107.3.193.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.3.193.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adkxozKs5t9xRSNL6cm0egAAAFA"]
[Sat Apr 11 01:21:41.800703 2026] [:error] [pid 55451:tid 55472] [client 107.3.193.3:53307] [client 107.3.193.3] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adkxpXApxuyB7yCS5RnkIAAAANM"]
[Sat Apr 11 01:21:44.306643 2026] [:error] [pid 55451:tid 55467] [client 107.3.193.3:53307] [client 107.3.193.3] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adkxqHApxuyB7yCS5RnkKwAAAM4"]
[Sat Apr 11 02:10:49.907978 2026] [:error] [pid 21570:tid 21665] [client 216.24.210.67:60351] [client 216.24.210.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "adk9KTKs5t9xRSNL6cnPPAAAAEI"]
[Sat Apr 11 03:06:58.300209 2026] [:error] [pid 21569:tid 21667] [client 65.254.225.211:50566] [client 65.254.225.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adlKUnAvQTgvXJ6vHoq7dgAAAJE"]
[Sat Apr 11 03:06:59.573836 2026] [:error] [pid 21569:tid 21669] [client 65.254.225.211:50566] [client 65.254.225.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adlKU3AvQTgvXJ6vHoq7eQAAAJI"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 11 03:39:49.963247 2026] [autoindex:error] [pid 55451:tid 55475] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:39:51.809744 2026] [autoindex:error] [pid 55451:tid 55459] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:39:57.573474 2026] [autoindex:error] [pid 55451:tid 55469] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:39:58.568378 2026] [autoindex:error] [pid 55451:tid 55471] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:02.396733 2026] [autoindex:error] [pid 55451:tid 55455] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:02.631621 2026] [autoindex:error] [pid 55451:tid 55464] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:03.905955 2026] [autoindex:error] [pid 55451:tid 55462] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:04.123107 2026] [autoindex:error] [pid 55451:tid 55474] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:04.367447 2026] [autoindex:error] [pid 55451:tid 55471] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:05.311687 2026] [autoindex:error] [pid 55451:tid 55469] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:05.531544 2026] [autoindex:error] [pid 55451:tid 55461] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:05.751686 2026] [autoindex:error] [pid 55451:tid 55475] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:07.558379 2026] [autoindex:error] [pid 55451:tid 55468] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:07.770310 2026] [autoindex:error] [pid 55451:tid 55465] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:07.984750 2026] [autoindex:error] [pid 55451:tid 55467] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:10.676580 2026] [autoindex:error] [pid 55451:tid 55460] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:10.895174 2026] [autoindex:error] [pid 55451:tid 55457] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:11.113199 2026] [autoindex:error] [pid 55451:tid 55453] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:11.329403 2026] [autoindex:error] [pid 55451:tid 55463] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:11.543841 2026] [autoindex:error] [pid 55451:tid 55471] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:11.762633 2026] [autoindex:error] [pid 55451:tid 55465] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:12.798753 2026] [autoindex:error] [pid 55451:tid 55477] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:13.017706 2026] [autoindex:error] [pid 55451:tid 55473] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:15.586173 2026] [autoindex:error] [pid 55451:tid 55460] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:17.342929 2026] [autoindex:error] [pid 55451:tid 55464] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:17.594475 2026] [autoindex:error] [pid 55451:tid 55466] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:17.806759 2026] [autoindex:error] [pid 55451:tid 55465] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:20.372854 2026] [autoindex:error] [pid 55451:tid 55469] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:20.605950 2026] [autoindex:error] [pid 55451:tid 55457] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:23.193805 2026] [autoindex:error] [pid 55451:tid 55468] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:24.205656 2026] [autoindex:error] [pid 55451:tid 55466] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:25.201543 2026] [autoindex:error] [pid 55451:tid 55454] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:25.415046 2026] [autoindex:error] [pid 55451:tid 55456] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentythree/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:25.628464 2026] [autoindex:error] [pid 55451:tid 55475] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:25.840439 2026] [autoindex:error] [pid 55451:tid 55461] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:26.070297 2026] [autoindex:error] [pid 55451:tid 55464] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:27.794842 2026] [autoindex:error] [pid 55451:tid 55467] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:29.597932 2026] [autoindex:error] [pid 55451:tid 55464] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:29.811596 2026] [autoindex:error] [pid 55451:tid 55469] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:32.347898 2026] [autoindex:error] [pid 55451:tid 55468] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:33.315518 2026] [autoindex:error] [pid 55451:tid 55464] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:35.126559 2026] [autoindex:error] [pid 55451:tid 55465] [client 173.239.214.56:58691] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:37.766624 2026] [autoindex:error] [pid 55451:tid 55457] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:37.997707 2026] [autoindex:error] [pid 55451:tid 55476] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:38.206700 2026] [autoindex:error] [pid 55451:tid 55459] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:38.428009 2026] [autoindex:error] [pid 55451:tid 55466] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:38.638963 2026] [autoindex:error] [pid 55451:tid 55455] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:40:38.852688 2026] [autoindex:error] [pid 55451:tid 55473] [client 173.239.214.56:58691] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentytwo/assets/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 11 03:44:13.373037 2026] [:error] [pid 21569:tid 21680] [client 4.219.9.127:45158] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adlTDXAvQTgvXJ6vHorKXgAAAJc"]
[Sat Apr 11 03:44:14.139477 2026] [:error] [pid 21706:tid 21709] [client 4.219.9.127:45144] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adlTDiGQ1M5d8fQSsLEbfQAAAAE"]
[Sat Apr 11 03:44:14.973177 2026] [:error] [pid 55451:tid 55463] [client 4.219.9.127:3578] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adlTDnApxuyB7yCS5RlfSgAAAMo"]
[Sat Apr 11 03:44:15.760052 2026] [:error] [pid 21706:tid 21715] [client 4.219.9.127:23125] [client 4.219.9.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adlTDyGQ1M5d8fQSsLEbgQAAAAc"]
[Sat Apr 11 04:51:05.290612 2026] [:error] [pid 33288:tid 33294] [client 20.215.250.26:55086] [client 20.215.250.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.215.250.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adliuWJmwJFFPEgRHfH56AAAAMQ"]
[Sat Apr 11 06:25:42.309151 2026] [:error] [pid 15244:tid 15264] [client 24.78.106.29:57706] [client 24.78.106.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.78.106.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adl45okdEsz5NeAq8w03sAAAARI"]
[Sat Apr 11 06:44:17.001562 2026] [:error] [pid 33288:tid 33307] [client 36.41.75.167:52941] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adl9QGJmwJFFPEgRHfFj_gAAANE"]
[Sat Apr 11 07:53:28.404885 2026] [:error] [pid 33172:tid 33233] [client 212.87.219.102:32765] [client 212.87.219.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "admNeDn2G0IJw5EZY9l2GgAAAE8"]
[Sat Apr 11 07:53:30.268348 2026] [:error] [pid 33173:tid 33262] [client 212.87.219.102:52747] [client 212.87.219.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "admNeq8109xRDP2izWggcAAAAJE"]
[Sat Apr 11 09:16:43.745919 2026] [:error] [pid 19483:tid 19505] [client 24.78.106.29:61365] [client 24.78.106.29] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "admg-0fhEoDX8oI2QgsbyAAAAJQ"]
[Sat Apr 11 09:17:45.522300 2026] [:error] [pid 22756:tid 22778] [client 24.78.106.29:62470] [client 24.78.106.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.78.106.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "admhOWfoSJ40LEm6kfqrfgAAABQ"]
[Sat Apr 11 09:18:45.146413 2026] [:error] [pid 22663:tid 22682] [client 24.78.106.29:59321] [client 24.78.106.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.78.106.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "admhdY1p7ez17BT2hZYFuwAAAQ4"]
[Sat Apr 11 09:19:43.901966 2026] [:error] [pid 22756:tid 22774] [client 24.78.106.29:61053] [client 24.78.106.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.78.106.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "admhr2foSJ40LEm6kfquLAAAABA"]
[Sat Apr 11 09:20:48.152437 2026] [:error] [pid 22756:tid 22761] [client 24.78.106.29:62642] [client 24.78.106.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.78.106.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "admh8GfoSJ40LEm6kfqvIwAAAAM"]
[Sat Apr 11 09:21:40.961118 2026] [:error] [pid 22664:tid 22697] [client 24.78.106.29:62312] [client 24.78.106.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 24.78.106.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "admiJARS_OPFpcXOZmWFKgAAAUA"]
[Sat Apr 11 09:42:47.168966 2026] [:error] [pid 34911:tid 34927] [client 157.15.40.61:60215] [client 157.15.40.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/media/system/js/core.js"] [unique_id "admnFw4Dca235WG8VGLIDQAAAA4"]
[Sat Apr 11 09:47:39.736791 2026] [:error] [pid 35633:tid 35659] [client 43.130.16.140:44172] [client 43.130.16.140] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "admoO2UQo_ah7EEEnqfGHAAAANg"]
[Sat Apr 11 11:43:11.077984 2026] [:error] [pid 2187:tid 2240] [client 175.136.143.229:26268] [client 175.136.143.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.136.143.229, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adnDTw4J29_qQi0Fkjhe_wAAAAw"]
[Sat Apr 11 11:45:50.830366 2026] [:error] [pid 2187:tid 2228] [client 175.136.143.229:26254] [client 175.136.143.229] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adnD7g4J29_qQi0FkjhfzwAAAAI"]
[Sat Apr 11 11:47:21.897896 2026] [:error] [pid 11067:tid 11075] [client 175.136.143.229:3125] [client 175.136.143.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.136.143.229, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adnEScW3w7N67R04YCItPwAAAEY"]
[Sat Apr 11 11:48:56.324089 2026] [:error] [pid 2297:tid 2311] [client 175.136.143.229:44943] [client 175.136.143.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.136.143.229, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adnEqLXJS-Jji11jZk2YSgAAAQo"]
[Sat Apr 11 11:50:25.752765 2026] [:error] [pid 2188:tid 2261] [client 175.136.143.229:45026] [client 175.136.143.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.136.143.229, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adnFAYDhDA-Xtn2nRSfYDwAAAMU"]
[Sat Apr 11 11:51:57.523845 2026] [:error] [pid 11067:tid 11072] [client 175.136.143.229:22701] [client 175.136.143.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.136.143.229, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adnFXcW3w7N67R04YCIw6QAAAEM"]
[Sat Apr 11 11:56:21.354605 2026] [:error] [pid 2188:tid 2262] [client 67.222.38.94:58322] [client 67.222.38.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.222.38.94, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adnGZYDhDA-Xtn2nRSfamgAAAMY"]
[Sat Apr 11 11:56:21.879193 2026] [:error] [pid 2188:tid 2276] [client 67.222.38.94:58322] [client 67.222.38.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.222.38.94, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adnGZYDhDA-Xtn2nRSfanAAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 11 13:40:57.821952 2026] [:error] [pid 11067:tid 11084] [client 140.213.173.65:14512] [client 140.213.173.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 140.213.173.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adne6cW3w7N67R04YCJ9OgAAAE8"]
[Sat Apr 11 13:40:59.016875 2026] [:error] [pid 11067:tid 11078] [client 140.213.173.65:13813] [client 140.213.173.65] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adne68W3w7N67R04YCJ9QQAAAEk"]
[Sat Apr 11 13:41:00.305468 2026] [:error] [pid 11067:tid 11092] [client 140.213.173.65:13813] [client 140.213.173.65] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adne7MW3w7N67R04YCJ9RQAAAFc"]
[Sat Apr 11 13:48:30.063097 2026] [:error] [pid 2188:tid 2272] [client 159.65.142.144:56233] [client 159.65.142.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.65.142.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adngroDhDA-Xtn2nRScCQAAAANA"]
[Sat Apr 11 14:11:42.602177 2026] [:error] [pid 2187:tid 2244] [client 157.15.40.61:57300] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "adnmHg4J29_qQi0FkjiIcwAAABA"]
[Sat Apr 11 14:11:45.864360 2026] [:error] [pid 11067:tid 11076] [client 157.15.40.61:57364] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/style.php"] [unique_id "adnmIcW3w7N67R04YCKSGQAAAEc"]
[Sat Apr 11 14:11:48.290709 2026] [:error] [pid 2297:tid 2324] [client 157.15.40.61:57908] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/style.php"] [unique_id "adnmJLXJS-Jji11jZk3ayAAAARc"]
[Sat Apr 11 14:11:49.985228 2026] [:error] [pid 2297:tid 2320] [client 157.15.40.61:58390] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/style.php"] [unique_id "adnmJbXJS-Jji11jZk3bDQAAARM"]
[Sat Apr 11 14:11:50.632705 2026] [:error] [pid 2188:tid 2263] [client 157.15.40.61:58777] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style.php"] [unique_id "adnmJoDhDA-Xtn2nRScKzAAAAMc"]
[Sat Apr 11 14:11:50.892401 2026] [:error] [pid 2188:tid 2269] [client 157.15.40.61:58828] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "adnmJoDhDA-Xtn2nRScK2AAAAM0"]
[Sat Apr 11 14:11:52.153281 2026] [:error] [pid 11067:tid 11085] [client 157.15.40.61:59088] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "adnmKMW3w7N67R04YCKTZwAAAFA"]
[Sat Apr 11 14:11:52.846102 2026] [:error] [pid 2186:tid 2213] [client 157.15.40.61:59223] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "adnmKMibnOEEvcO8wPL-TQAAAJY"]
[Sat Apr 11 14:11:53.100569 2026] [:error] [pid 2187:tid 2240] [client 157.15.40.61:59273] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "adnmKQ4J29_qQi0FkjiJGQAAAAw"]
[Sat Apr 11 14:11:57.346281 2026] [:error] [pid 11067:tid 11075] [client 157.15.40.61:59645] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "adnmLcW3w7N67R04YCKVKwAAAEY"]
[Sat Apr 11 14:11:57.613008 2026] [:error] [pid 2186:tid 2209] [client 157.15.40.61:60220] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "adnmLcibnOEEvcO8wPL-4gAAAJM"]
[Sat Apr 11 14:11:57.882372 2026] [:error] [pid 2297:tid 2301] [client 157.15.40.61:60296] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/blurbs.php"] [unique_id "adnmLbXJS-Jji11jZk3cBwAAAQA"]
[Sat Apr 11 14:11:59.186094 2026] [:error] [pid 2188:tid 2270] [client 157.15.40.61:60678] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "adnmL4DhDA-Xtn2nRScLywAAAM4"]
[Sat Apr 11 14:11:59.447949 2026] [:error] [pid 11067:tid 11088] [client 157.15.40.61:60730] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "adnmL8W3w7N67R04YCKWCAAAAFM"]
[Sat Apr 11 14:12:01.541431 2026] [:error] [pid 11067:tid 11086] [client 157.15.40.61:60942] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/shelp.php"] [unique_id "adnmMcW3w7N67R04YCKWggAAAFE"]
[Sat Apr 11 14:12:02.322935 2026] [:error] [pid 2297:tid 2322] [client 157.15.40.61:61265] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/cord.php"] [unique_id "adnmMrXJS-Jji11jZk3cXAAAARU"]
[Sat Apr 11 14:12:03.605947 2026] [:error] [pid 11067:tid 11076] [client 157.15.40.61:61564] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/dex.php"] [unique_id "adnmM8W3w7N67R04YCKWxwAAAEc"]
[Sat Apr 11 14:12:03.871064 2026] [:error] [pid 11067:tid 11085] [client 157.15.40.61:61705] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "adnmM8W3w7N67R04YCKW1gAAAFA"]
[Sat Apr 11 14:12:16.556372 2026] [:error] [pid 2187:tid 2243] [client 157.15.40.61:51261] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/file2.php"] [unique_id "adnmQA4J29_qQi0FkjiKVAAAAA8"]
[Sat Apr 11 14:12:16.811417 2026] [:error] [pid 11067:tid 11074] [client 157.15.40.61:51298] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/zwso.php"] [unique_id "adnmQMW3w7N67R04YCKXpwAAAEU"]
[Sat Apr 11 14:12:20.581808 2026] [:error] [pid 2297:tid 2309] [client 157.15.40.61:51477] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/zwso.php"] [unique_id "adnmRLXJS-Jji11jZk3dcAAAAQg"]
[Sat Apr 11 14:12:32.363839 2026] [:error] [pid 11067:tid 11075] [client 157.15.40.61:52875] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "adnmUMW3w7N67R04YCKYfgAAAEY"]
[Sat Apr 11 14:12:33.490711 2026] [:error] [pid 2297:tid 2306] [client 157.15.40.61:53373] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "adnmUbXJS-Jji11jZk3d3wAAAQU"]
[Sat Apr 11 14:12:34.583559 2026] [:error] [pid 2297:tid 2306] [client 157.15.40.61:53547] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/shlo.php"] [unique_id "adnmUrXJS-Jji11jZk3d6QAAAQU"]
[Sat Apr 11 14:12:35.358260 2026] [:error] [pid 11067:tid 11079] [client 157.15.40.61:53673] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/133.php"] [unique_id "adnmU8W3w7N67R04YCKYngAAAEo"]
[Sat Apr 11 14:12:37.613875 2026] [:error] [pid 2297:tid 2311] [client 157.15.40.61:53859] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ahax.php"] [unique_id "adnmVbXJS-Jji11jZk3d_gAAAQo"]
[Sat Apr 11 14:12:43.892739 2026] [:error] [pid 2188:tid 2267] [client 157.15.40.61:54419] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/php8.php"] [unique_id "adnmW4DhDA-Xtn2nRScNQwAAAMs"]
[Sat Apr 11 14:12:44.155311 2026] [:error] [pid 2188:tid 2263] [client 157.15.40.61:54873] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/lufix1.php"] [unique_id "adnmXIDhDA-Xtn2nRScNRQAAAMc"]
[Sat Apr 11 15:22:37.841439 2026] [:error] [pid 2187:tid 2228] [client 58.69.65.55:55562] [client 58.69.65.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 58.69.65.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adn2vQ4J29_qQi0FkjifSgAAAAI"]
[Sat Apr 11 15:22:39.174019 2026] [:error] [pid 11067:tid 11091] [client 58.69.65.55:55576] [client 58.69.65.55] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adn2v8W3w7N67R04YCLGdgAAAFY"]
[Sat Apr 11 15:22:41.221157 2026] [:error] [pid 11067:tid 11093] [client 58.69.65.55:55576] [client 58.69.65.55] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adn2wcW3w7N67R04YCLGhQAAAFg"]
[Sat Apr 11 16:24:42.048201 2026] [:error] [pid 2188:tid 2267] [client 165.255.240.138:51288] [client 165.255.240.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.255.240.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adoFSoDhDA-Xtn2nRSc35AAAAMs"]
[Sat Apr 11 16:24:43.749510 2026] [:error] [pid 2188:tid 2256] [client 165.255.240.138:51288] [client 165.255.240.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.255.240.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adoFS4DhDA-Xtn2nRSc35wAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 11 17:00:20.975378 2026] [:error] [pid 11067:tid 11093] [client 43.134.186.61:59766] [client 43.134.186.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adoNpMW3w7N67R04YCL_AwAAAFg"]
[Sat Apr 11 18:34:39.388123 2026] [:error] [pid 65248:tid 65265] [client 178.128.105.125:65055] [client 178.128.105.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.128.105.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adojvzI-iGHcq-8gSqrqFQAAAA8"]
[Sat Apr 11 18:52:29.618140 2026] [:error] [pid 54520:tid 54578] [client 45.39.230.179:38892] [client 45.39.230.179] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=image/jpeg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adon7cOfMlnGwwoJrMCTkwAAAEI"]
[Sat Apr 11 19:15:30.311310 2026] [:error] [pid 54519:tid 54551] [client 43.166.129.247:56008] [client 43.166.129.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adotUh3fdONpCON3MUijWwAAAMI"]
[Sat Apr 11 19:27:38.434816 2026] [:error] [pid 54610:tid 54636] [client 192.144.148.122:49978] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adowKge-u3uFASN-RPGyHgAAARc"]
[Sat Apr 11 20:14:01.292908 2026] [:error] [pid 18629:tid 18642] [client 168.144.39.166:59971] [client 168.144.39.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 168.144.39.166, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ado7CWW1jXPD9CXRfNRLsgAAAUs"]
[Sat Apr 11 22:23:56.621344 2026] [:error] [pid 42219:tid 42227] [client 43.167.241.46:39210] [client 43.167.241.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adpZfA-4IkVbTQx_J-2OwQAAAIQ"]
[Sat Apr 11 22:53:13.765151 2026] [:error] [pid 42219:tid 42246] [client 116.75.67.8:59417] [client 116.75.67.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.75.67.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adpgWQ-4IkVbTQx_J-2ZJgAAAJc"]
[Sun Apr 12 00:09:15.542696 2026] [autoindex:error] [pid 52608:tid 52611] [client 13.71.185.179:4084] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 00:09:22.874760 2026] [:error] [pid 52608:tid 52634] [client 13.71.185.179:4084] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "adpyMiY5wH-BLt5QEKia6wAAARc"]
[Sun Apr 12 00:09:24.839135 2026] [:error] [pid 52608:tid 52633] [client 13.71.185.179:3988] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "adpyNCY5wH-BLt5QEKia8gAAARY"]
[Sun Apr 12 00:09:28.480351 2026] [:error] [pid 42219:tid 42236] [client 13.71.185.179:4053] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "adpyOA-4IkVbTQx_J-25BQAAAI0"]
[Sun Apr 12 00:09:31.449769 2026] [:error] [pid 52608:tid 52631] [client 13.71.185.179:3985] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xv.php"] [unique_id "adpyOyY5wH-BLt5QEKibBAAAARQ"]
[Sun Apr 12 00:09:36.129043 2026] [:error] [pid 42219:tid 42242] [client 13.71.185.179:4091] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x56.php"] [unique_id "adpyQA-4IkVbTQx_J-25EQAAAJM"]
[Sun Apr 12 00:09:37.696569 2026] [:error] [pid 42313:tid 42327] [client 13.71.185.179:4038] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x56.php"] [unique_id "adpyQV2P8TxdbaN018J6JgAAAAs"]
[Sun Apr 12 00:09:39.436959 2026] [:error] [pid 42313:tid 42321] [client 13.71.185.179:3969] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x56.php"] [unique_id "adpyQ12P8TxdbaN018J6MAAAAAU"]
[Sun Apr 12 00:09:41.391984 2026] [:error] [pid 42219:tid 42242] [client 13.71.185.179:4088] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x56.php"] [unique_id "adpyRQ-4IkVbTQx_J-25HwAAAJM"]
[Sun Apr 12 00:09:44.087142 2026] [:error] [pid 42219:tid 42225] [client 13.71.185.179:3980] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "adpySA-4IkVbTQx_J-25IwAAAII"]
[Sun Apr 12 00:09:46.104106 2026] [:error] [pid 42219:tid 42239] [client 13.71.185.179:4040] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "adpySg-4IkVbTQx_J-25JgAAAJA"]
[Sun Apr 12 00:09:47.876362 2026] [:error] [pid 42219:tid 42231] [client 13.71.185.179:3983] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "adpySw-4IkVbTQx_J-25KgAAAIg"]
[Sun Apr 12 00:09:48.564134 2026] [:error] [pid 42313:tid 42331] [client 13.71.185.179:3984] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htaccess.php"] [unique_id "adpyTF2P8TxdbaN018J6QgAAAA8"]
[Sun Apr 12 00:09:50.734019 2026] [:error] [pid 42313:tid 42328] [client 13.71.185.179:4052] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "adpyTl2P8TxdbaN018J6RgAAAAw"]
[Sun Apr 12 00:09:52.575585 2026] [:error] [pid 42219:tid 42229] [client 13.71.185.179:4036] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "adpyUA-4IkVbTQx_J-25LwAAAIY"]
[Sun Apr 12 00:09:53.083221 2026] [:error] [pid 52608:tid 52622] [client 13.71.185.179:3998] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "adpyUSY5wH-BLt5QEKibIAAAAQs"]
[Sun Apr 12 00:09:54.463489 2026] [:error] [pid 52608:tid 52627] [client 13.71.185.179:3975] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/readme.php"] [unique_id "adpyUiY5wH-BLt5QEKibIwAAARA"]
[Sun Apr 12 00:09:58.238148 2026] [:error] [pid 52608:tid 52628] [client 13.71.185.179:4071] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x50.php"] [unique_id "adpyViY5wH-BLt5QEKibMQAAARE"]
[Sun Apr 12 00:10:05.347615 2026] [:error] [pid 42219:tid 42225] [client 13.71.185.179:3935] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x50.php"] [unique_id "adpyXQ-4IkVbTQx_J-25OwAAAII"]
[Sun Apr 12 00:10:08.711159 2026] [:error] [pid 52608:tid 52628] [client 13.71.185.179:4032] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x50.php"] [unique_id "adpyYCY5wH-BLt5QEKibOQAAARE"]
[Sun Apr 12 00:10:11.325646 2026] [:error] [pid 52608:tid 52620] [client 13.71.185.179:4090] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "adpyYyY5wH-BLt5QEKibOwAAAQk"]
[Sun Apr 12 00:10:12.551099 2026] [:error] [pid 42219:tid 42230] [client 13.71.185.179:3994] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "adpyZA-4IkVbTQx_J-25QAAAAIc"]
[Sun Apr 12 00:10:13.670201 2026] [:error] [pid 52608:tid 52618] [client 13.71.185.179:4080] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "adpyZSY5wH-BLt5QEKibQAAAAQc"]
[Sun Apr 12 00:10:14.162467 2026] [:error] [pid 52608:tid 52621] [client 13.71.185.179:3995] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fv.php"] [unique_id "adpyZiY5wH-BLt5QEKibRAAAAQo"]
[Sun Apr 12 00:10:15.043544 2026] [:error] [pid 42313:tid 42322] [client 13.71.185.179:4093] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "adpyZ12P8TxdbaN018J6ZQAAAAY"]
[Sun Apr 12 00:10:16.006692 2026] [:error] [pid 52608:tid 52628] [client 13.71.185.179:3974] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "adpyaCY5wH-BLt5QEKibRwAAARE"]
[Sun Apr 12 00:10:16.480591 2026] [:error] [pid 52608:tid 52620] [client 13.71.185.179:3973] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "adpyaCY5wH-BLt5QEKibSAAAAQk"]
[Sun Apr 12 00:10:17.474863 2026] [:error] [pid 42221:tid 42293] [client 13.71.185.179:4041] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "adpyaU2gt0pb_0-cc6m0dwAAAE8"]
[Sun Apr 12 00:10:18.632270 2026] [:error] [pid 42221:tid 42295] [client 13.71.185.179:4033] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "adpyak2gt0pb_0-cc6m0fQAAAFE"]
[Sun Apr 12 00:10:19.712077 2026] [:error] [pid 42219:tid 42224] [client 13.71.185.179:4042] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "adpyaw-4IkVbTQx_J-25RgAAAIE"]
[Sun Apr 12 00:10:20.789291 2026] [:error] [pid 42221:tid 42289] [client 13.71.185.179:4074] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lsd.php"] [unique_id "adpybE2gt0pb_0-cc6m0gAAAAEs"]
[Sun Apr 12 00:10:32.949668 2026] [:error] [pid 52608:tid 52617] [client 13.71.185.179:4055] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "adpyeCY5wH-BLt5QEKibowAAAQY"]
[Sun Apr 12 00:10:36.432050 2026] [:error] [pid 52608:tid 52618] [client 13.71.185.179:4083] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "adpyfCY5wH-BLt5QEKibpQAAAQc"]
[Sun Apr 12 00:10:39.076829 2026] [:error] [pid 42313:tid 42329] [client 13.71.185.179:3968] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "adpyf12P8TxdbaN018J6jQAAAA0"]
[Sun Apr 12 00:10:40.876753 2026] [:error] [pid 42219:tid 42223] [client 13.71.185.179:4094] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "adpygA-4IkVbTQx_J-25YAAAAIA"]
[Sun Apr 12 00:10:43.133986 2026] [:error] [pid 52608:tid 52623] [client 13.71.185.179:4012] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "adpygyY5wH-BLt5QEKibswAAAQw"]
[Sun Apr 12 00:10:45.142875 2026] [:error] [pid 42219:tid 42231] [client 13.71.185.179:4049] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "adpyhQ-4IkVbTQx_J-25aAAAAIg"]
[Sun Apr 12 00:10:48.197746 2026] [:error] [pid 42313:tid 42318] [client 13.71.185.179:4059] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "adpyiF2P8TxdbaN018J6kwAAAAI"]
[Sun Apr 12 00:10:52.152692 2026] [:error] [pid 42313:tid 42323] [client 13.71.185.179:4092] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "adpyjF2P8TxdbaN018J6nwAAAAc"]
[Sun Apr 12 00:10:54.513722 2026] [:error] [pid 52608:tid 52634] [client 13.71.185.179:4016] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "adpyjiY5wH-BLt5QEKibugAAARc"]
[Sun Apr 12 00:10:55.863939 2026] [:error] [pid 52608:tid 52628] [client 13.71.185.179:4068] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "adpyjyY5wH-BLt5QEKibvgAAARE"]
[Sun Apr 12 00:10:57.622411 2026] [:error] [pid 52608:tid 52635] [client 13.71.185.179:4029] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "adpykSY5wH-BLt5QEKibwgAAARg"]
[Sun Apr 12 00:10:59.686469 2026] [:error] [pid 42219:tid 42240] [client 13.71.185.179:4095] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "adpykw-4IkVbTQx_J-25cQAAAJE"]
[Sun Apr 12 00:11:02.534649 2026] [:error] [pid 52608:tid 52623] [client 13.71.185.179:4069] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "adpyliY5wH-BLt5QEKibzwAAAQw"]
[Sun Apr 12 00:11:05.331990 2026] [:error] [pid 52608:tid 52614] [client 13.71.185.179:4061] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "adpymSY5wH-BLt5QEKib0wAAAQM"]
[Sun Apr 12 00:11:09.155927 2026] [:error] [pid 52608:tid 52616] [client 13.71.185.179:4082] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "adpynSY5wH-BLt5QEKib4AAAAQU"]
[Sun Apr 12 00:11:15.272329 2026] [:error] [pid 42313:tid 42335] [client 13.71.185.179:4056] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "adpyo12P8TxdbaN018J6ygAAABM"]
[Sun Apr 12 00:11:21.742205 2026] [:error] [pid 42219:tid 42232] [client 13.71.185.179:3976] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "adpyqQ-4IkVbTQx_J-25mQAAAIk"]
[Sun Apr 12 00:11:26.109634 2026] [:error] [pid 52608:tid 52628] [client 13.71.185.179:3911] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "adpyriY5wH-BLt5QEKicSQAAARE"]
[Sun Apr 12 00:11:28.586446 2026] [:error] [pid 42219:tid 42237] [client 13.71.185.179:4046] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css.php"] [unique_id "adpysA-4IkVbTQx_J-25oQAAAI4"]
[Sun Apr 12 00:11:33.969567 2026] [:error] [pid 42219:tid 42240] [client 13.71.185.179:4089] [client 13.71.185.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "adpytQ-4IkVbTQx_J-25sAAAAJE"]
[Sun Apr 12 00:11:45.083720 2026] [:error] [pid 52608:tid 52614] [client 13.71.185.179:4001] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "adpywSY5wH-BLt5QEKicfQAAAQM"]
[Sun Apr 12 00:11:47.086449 2026] [:error] [pid 42219:tid 42226] [client 13.71.185.179:4013] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "adpyww-4IkVbTQx_J-25xgAAAIM"]
[Sun Apr 12 00:11:48.366837 2026] [:error] [pid 42221:tid 42283] [client 13.71.185.179:3978] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "adpyxE2gt0pb_0-cc6m01wAAAEU"]
[Sun Apr 12 00:11:49.845163 2026] [:error] [pid 52608:tid 52618] [client 13.71.185.179:4065] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "adpyxSY5wH-BLt5QEKiciAAAAQc"]
[Sun Apr 12 00:11:51.249647 2026] [:error] [pid 42313:tid 42323] [client 13.71.185.179:4011] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "adpyx12P8TxdbaN018J7GQAAAAc"]
[Sun Apr 12 00:11:52.396847 2026] [:error] [pid 52608:tid 52619] [client 13.71.185.179:4067] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "adpyyCY5wH-BLt5QEKicjgAAAQg"]
[Sun Apr 12 00:11:54.982409 2026] [:error] [pid 52608:tid 52628] [client 13.71.185.179:3999] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "adpyyiY5wH-BLt5QEKiclAAAARE"]
[Sun Apr 12 00:11:56.275616 2026] [:error] [pid 42219:tid 42237] [client 13.71.185.179:4086] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/autoload_classmap.php"] [unique_id "adpyzA-4IkVbTQx_J-25zwAAAI4"]
[Sun Apr 12 00:11:59.159668 2026] [:error] [pid 42221:tid 42289] [client 13.71.185.179:4023] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "adpyz02gt0pb_0-cc6m04AAAAEs"]
[Sun Apr 12 00:12:02.107792 2026] [:error] [pid 42221:tid 42295] [client 13.71.185.179:3972] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "adpy0k2gt0pb_0-cc6m05AAAAFE"]
[Sun Apr 12 00:12:06.127126 2026] [:error] [pid 42313:tid 42338] [client 13.71.185.179:3942] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "adpy1l2P8TxdbaN018J7NAAAABY"]
[Sun Apr 12 00:12:08.957856 2026] [:error] [pid 42221:tid 42284] [client 13.71.185.179:4064] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "adpy2E2gt0pb_0-cc6m07wAAAEY"]
[Sun Apr 12 00:12:10.037438 2026] [:error] [pid 42313:tid 42325] [client 13.71.185.179:4048] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "adpy2l2P8TxdbaN018J7OwAAAAk"]
[Sun Apr 12 00:12:11.665520 2026] [:error] [pid 42219:tid 42234] [client 13.71.185.179:3907] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "adpy2w-4IkVbTQx_J-253QAAAIs"]
[Sun Apr 12 00:12:16.109693 2026] [:error] [pid 52608:tid 52635] [client 13.71.185.179:3914] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "adpy4CY5wH-BLt5QEKicpwAAARg"]
[Sun Apr 12 00:12:28.437058 2026] [:error] [pid 42220:tid 42271] [client 13.71.185.179:3982] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "adpy7Ez5c3Cs6a8B5QuqKQAAANQ"]
[Sun Apr 12 00:12:32.552046 2026] [:error] [pid 42313:tid 42327] [client 13.71.185.179:4006] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "adpy8F2P8TxdbaN018J7cgAAAAs"]
[Sun Apr 12 00:12:33.524085 2026] [:error] [pid 42220:tid 42255] [client 13.71.185.179:4060] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "adpy8Uz5c3Cs6a8B5QuqMQAAAMQ"]
[Sun Apr 12 00:12:35.788140 2026] [:error] [pid 42220:tid 42267] [client 13.71.185.179:3929] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "adpy80z5c3Cs6a8B5QuqNwAAANA"]
[Sun Apr 12 00:12:36.438426 2026] [:error] [pid 42313:tid 42320] [client 13.71.185.179:3908] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "adpy9F2P8TxdbaN018J7fwAAAAQ"]
[Sun Apr 12 00:12:38.149442 2026] [:error] [pid 52608:tid 52611] [client 13.71.185.179:4000] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "adpy9iY5wH-BLt5QEKicwwAAAQA"]
[Sun Apr 12 00:12:41.194351 2026] [:error] [pid 52608:tid 52626] [client 13.71.185.179:3992] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes/twentytwentytwo/index.php"] [unique_id "adpy-SY5wH-BLt5QEKicxQAAAQ8"]
[Sun Apr 12 00:13:00.187828 2026] [:error] [pid 42220:tid 42267] [client 13.71.185.179:3996] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "adpzDEz5c3Cs6a8B5QuqYgAAANA"]
[Sun Apr 12 00:13:08.413542 2026] [:error] [pid 42221:tid 42280] [client 13.71.185.179:3989] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "adpzFE2gt0pb_0-cc6m1IwAAAEI"]
[Sun Apr 12 00:13:10.949940 2026] [:error] [pid 42313:tid 42340] [client 13.71.185.179:4051] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "adpzFl2P8TxdbaN018J7sQAAABg"]
[Sun Apr 12 00:13:15.111196 2026] [:error] [pid 42313:tid 42331] [client 13.71.185.179:4087] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "adpzG12P8TxdbaN018J7ugAAAA8"]
[Sun Apr 12 00:13:17.430529 2026] [:error] [pid 42219:tid 42233] [client 13.71.185.179:3926] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "adpzHQ-4IkVbTQx_J-26NgAAAIo"]
[Sun Apr 12 00:13:21.441874 2026] [:error] [pid 52608:tid 52628] [client 13.71.185.179:3841] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "adpzISY5wH-BLt5QEKic8QAAARE"]
[Sun Apr 12 00:13:23.996653 2026] [:error] [pid 52608:tid 52611] [client 13.71.185.179:3840] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "adpzIyY5wH-BLt5QEKic-wAAAQA"]
[Sun Apr 12 00:13:25.950232 2026] [:error] [pid 42221:tid 42287] [client 13.71.185.179:4021] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "adpzJU2gt0pb_0-cc6m1OgAAAEk"]
[Sun Apr 12 00:13:29.205703 2026] [:error] [pid 52608:tid 52627] [client 13.71.185.179:3941] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "adpzKSY5wH-BLt5QEKic_wAAARA"]
[Sun Apr 12 00:13:32.814017 2026] [:error] [pid 42221:tid 42294] [client 13.71.185.179:3981] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "adpzLE2gt0pb_0-cc6m1QgAAAFA"]
[Sun Apr 12 00:13:41.170455 2026] [:error] [pid 42221:tid 42284] [client 13.71.185.179:4062] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "adpzNU2gt0pb_0-cc6m1UQAAAEY"]
[Sun Apr 12 00:13:43.538721 2026] [:error] [pid 42313:tid 42322] [client 13.71.185.179:4063] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "adpzN12P8TxdbaN018J74gAAAAY"]
[Sun Apr 12 00:13:46.406799 2026] [:error] [pid 52608:tid 52628] [client 13.71.185.179:4053] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "adpzOiY5wH-BLt5QEKidUwAAARE"]
[Sun Apr 12 00:13:51.186510 2026] [:error] [pid 52608:tid 52630] [client 13.71.185.179:3979] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "adpzPyY5wH-BLt5QEKidaAAAARM"]
[Sun Apr 12 00:13:53.770969 2026] [:error] [pid 52608:tid 52635] [client 13.71.185.179:3905] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "adpzQSY5wH-BLt5QEKidcgAAARg"]
[Sun Apr 12 00:14:19.895700 2026] [:error] [pid 42221:tid 42281] [client 13.71.185.179:3970] [client 13.71.185.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 13.71.185.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adpzW02gt0pb_0-cc6m1aAAAAEM"]
[Sun Apr 12 00:14:52.142736 2026] [:error] [pid 42313:tid 42339] [client 13.71.185.179:3970] [client 13.71.185.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "adpzfF2P8TxdbaN018J8cwAAABc"]
[Sun Apr 12 00:14:55.295102 2026] [:error] [pid 52608:tid 52616] [client 13.71.185.179:4073] [client 13.71.185.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "adpzfyY5wH-BLt5QEKieAgAAAQU"]
[Sun Apr 12 00:15:04.074098 2026] [autoindex:error] [pid 42313:tid 42325] [client 13.71.185.179:3986] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 00:15:04.314376 2026] [:error] [pid 42313:tid 42338] [client 13.71.185.179:3986] [client 13.71.185.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/about.php"] [unique_id "adpziF2P8TxdbaN018J8igAAABY"]
[Sun Apr 12 00:15:11.352607 2026] [:error] [pid 42221:tid 42287] [client 13.71.185.179:4057] [client 13.71.185.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/about.php"] [unique_id "adpzj02gt0pb_0-cc6m1iAAAAEk"]
[Sun Apr 12 00:15:16.507273 2026] [proxy_fcgi:error] [pid 42313:tid 42318] [client 13.71.185.179:4001] AH01071: Got error 'Primary script unknown'
[Sun Apr 12 00:15:16.722943 2026] [:error] [pid 42313:tid 42325] [client 13.71.185.179:4001] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/colors/blue/index.php"] [unique_id "adpzlF2P8TxdbaN018J8tAAAAAk"]
[Sun Apr 12 00:15:18.833960 2026] [:error] [pid 42219:tid 42227] [client 13.71.185.179:4052] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/colors/blue/index.php"] [unique_id "adpzlg-4IkVbTQx_J-26rwAAAIQ"]
[Sun Apr 12 00:15:20.035010 2026] [:error] [pid 42219:tid 42247] [client 13.71.185.179:3915] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/colors/blue/index.php"] [unique_id "adpzmA-4IkVbTQx_J-26sAAAAJg"]
[Sun Apr 12 00:15:21.003502 2026] [:error] [pid 52608:tid 52625] [client 13.71.185.179:4078] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/colors/blue/index.php"] [unique_id "adpzmSY5wH-BLt5QEKiecAAAAQ4"]
[Sun Apr 12 00:15:22.140962 2026] [:error] [pid 42219:tid 42244] [client 13.71.185.179:3973] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/security.php"] [unique_id "adpzmg-4IkVbTQx_J-26twAAAJU"]
[Sun Apr 12 00:15:24.112829 2026] [:error] [pid 42313:tid 42321] [client 13.71.185.179:4066] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/security.php"] [unique_id "adpznF2P8TxdbaN018J8twAAAAU"]
[Sun Apr 12 00:15:25.874102 2026] [:error] [pid 42313:tid 42316] [client 13.71.185.179:3980] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/security.php"] [unique_id "adpznV2P8TxdbaN018J8vwAAAAA"]
[Sun Apr 12 00:15:28.176199 2026] [:error] [pid 42220:tid 42258] [client 13.71.185.179:4084] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/security.php"] [unique_id "adpzoEz5c3Cs6a8B5Quq3wAAAMc"]
[Sun Apr 12 00:15:31.343925 2026] [:error] [pid 42221:tid 42299] [client 13.71.185.179:4072] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "adpzo02gt0pb_0-cc6m1mgAAAFU"]
[Sun Apr 12 00:15:39.390846 2026] [:error] [pid 42221:tid 42290] [client 13.71.185.179:3975] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "adpzq02gt0pb_0-cc6m1pAAAAEw"]
[Sun Apr 12 00:15:41.152971 2026] [:error] [pid 42313:tid 42340] [client 13.71.185.179:4070] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "adpzrV2P8TxdbaN018J8ywAAABg"]
[Sun Apr 12 00:15:43.764457 2026] [:error] [pid 42313:tid 42339] [client 13.71.185.179:3983] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/about.php"] [unique_id "adpzr12P8TxdbaN018J80QAAABc"]
[Sun Apr 12 00:15:44.846063 2026] [:error] [pid 42221:tid 42295] [client 13.71.185.179:4002] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "adpzsE2gt0pb_0-cc6m1rAAAAFE"]
[Sun Apr 12 00:15:46.373353 2026] [:error] [pid 42221:tid 42290] [client 13.71.185.179:4082] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "adpzsk2gt0pb_0-cc6m1sQAAAEw"]
[Sun Apr 12 00:15:47.822831 2026] [:error] [pid 52608:tid 52625] [client 13.71.185.179:4071] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "adpzsyY5wH-BLt5QEKieoAAAAQ4"]
[Sun Apr 12 00:15:48.788167 2026] [:error] [pid 52608:tid 52634] [client 13.71.185.179:4092] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "adpztCY5wH-BLt5QEKieowAAARc"]
[Sun Apr 12 00:15:50.173049 2026] [:error] [pid 42220:tid 42259] [client 13.71.185.179:4093] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/about.php"] [unique_id "adpztkz5c3Cs6a8B5Quq8AAAAMg"]
[Sun Apr 12 00:15:52.204057 2026] [:error] [pid 42220:tid 42257] [client 13.71.185.179:3988] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/about.php"] [unique_id "adpzuEz5c3Cs6a8B5Quq8gAAAMY"]
[Sun Apr 12 00:15:54.926807 2026] [:error] [pid 42221:tid 42278] [client 13.71.185.179:4079] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/about.php"] [unique_id "adpzuk2gt0pb_0-cc6m1uwAAAEA"]
[Sun Apr 12 00:15:57.496469 2026] [:error] [pid 52608:tid 52623] [client 13.71.185.179:4037] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/about.php"] [unique_id "adpzvSY5wH-BLt5QEKieuwAAAQw"]
[Sun Apr 12 00:15:58.176634 2026] [:error] [pid 52608:tid 52628] [client 13.71.185.179:4005] [client 13.71.185.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "adpzviY5wH-BLt5QEKievgAAARE"]
[Sun Apr 12 00:16:00.263710 2026] [:error] [pid 42313:tid 42325] [client 13.71.185.179:4090] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "adpzwF2P8TxdbaN018J8_wAAAAk"]
[Sun Apr 12 00:16:02.709414 2026] [:error] [pid 42313:tid 42339] [client 13.71.185.179:4065] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "adpzwl2P8TxdbaN018J9BgAAABc"]
[Sun Apr 12 00:16:03.736459 2026] [:error] [pid 52608:tid 52628] [client 13.71.185.179:4034] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "adpzwyY5wH-BLt5QEKie2wAAARE"]
[Sun Apr 12 00:16:05.371423 2026] [:error] [pid 52608:tid 52631] [client 13.71.185.179:4094] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/radio.php"] [unique_id "adpzxSY5wH-BLt5QEKie3gAAARQ"]
[Sun Apr 12 00:16:07.704269 2026] [:error] [pid 42219:tid 42235] [client 13.71.185.179:3916] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "adpzxw-4IkVbTQx_J-268AAAAIw"]
[Sun Apr 12 00:16:10.281111 2026] [:error] [pid 42220:tid 42254] [client 13.71.185.179:4055] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "adpzykz5c3Cs6a8B5QurAQAAAMM"]
[Sun Apr 12 00:16:13.686507 2026] [:error] [pid 42313:tid 42339] [client 13.71.185.179:3969] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "adpzzV2P8TxdbaN018J9HwAAABc"]
[Sun Apr 12 00:16:17.523784 2026] [autoindex:error] [pid 42220:tid 42257] [client 13.71.185.179:3985] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 12 00:16:23.644123 2026] [:error] [pid 42220:tid 42264] [client 13.71.185.179:3985] [client 13.71.185.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "adpz10z5c3Cs6a8B5QurFwAAAM0"]
[Sun Apr 12 00:16:24.579158 2026] [:error] [pid 42219:tid 42237] [client 13.71.185.179:4074] [client 13.71.185.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "adpz2A-4IkVbTQx_J-27AQAAAI4"]
[Sun Apr 12 00:16:31.128161 2026] [:error] [pid 42221:tid 42301] [client 13.71.185.179:4059] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "adpz302gt0pb_0-cc6m18AAAAFc"]
[Sun Apr 12 00:16:33.385251 2026] [:error] [pid 42313:tid 42327] [client 13.71.185.179:4047] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "adpz4V2P8TxdbaN018J9RgAAAAs"]
[Sun Apr 12 00:16:36.024719 2026] [:error] [pid 42219:tid 42242] [client 13.71.185.179:4091] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "adpz5A-4IkVbTQx_J-27JAAAAJM"]
[Sun Apr 12 00:16:38.306744 2026] [:error] [pid 42219:tid 42232] [client 13.71.185.179:3998] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gg.php"] [unique_id "adpz5g-4IkVbTQx_J-27MAAAAIk"]
[Sun Apr 12 00:16:41.807079 2026] [:error] [pid 42313:tid 42327] [client 13.71.185.179:4076] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "adpz6V2P8TxdbaN018J9UwAAAAs"]
[Sun Apr 12 00:16:43.444312 2026] [:error] [pid 42313:tid 42316] [client 13.71.185.179:4060] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "adpz612P8TxdbaN018J9VgAAAAA"]
[Sun Apr 12 00:16:46.362780 2026] [:error] [pid 42220:tid 42268] [client 13.71.185.179:4040] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "adpz7kz5c3Cs6a8B5QurKQAAANE"]
[Sun Apr 12 00:16:47.526093 2026] [:error] [pid 52608:tid 52629] [client 13.71.185.179:4042] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "adpz7yY5wH-BLt5QEKifZwAAARI"]
[Sun Apr 12 00:16:48.619087 2026] [:error] [pid 52608:tid 52623] [client 13.71.185.179:3974] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/04.php"] [unique_id "adpz8CY5wH-BLt5QEKifbgAAAQw"]
[Sun Apr 12 00:16:50.030846 2026] [:error] [pid 42219:tid 42241] [client 13.71.185.179:3978] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/04.php"] [unique_id "adpz8g-4IkVbTQx_J-27PQAAAJI"]
[Sun Apr 12 00:16:52.172325 2026] [:error] [pid 42219:tid 42223] [client 13.71.185.179:4004] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/04.php"] [unique_id "adpz9A-4IkVbTQx_J-27QAAAAIA"]
[Sun Apr 12 00:16:54.017326 2026] [:error] [pid 52608:tid 52630] [client 13.71.185.179:4080] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/04.php"] [unique_id "adpz9iY5wH-BLt5QEKifgwAAARM"]
[Sun Apr 12 00:16:56.219368 2026] [:error] [pid 52608:tid 52633] [client 13.71.185.179:4088] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "adpz-CY5wH-BLt5QEKifjAAAARY"]
[Sun Apr 12 00:16:59.272521 2026] [:error] [pid 52608:tid 52630] [client 13.71.185.179:3923] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "adpz-yY5wH-BLt5QEKifmwAAARM"]
[Sun Apr 12 00:17:01.534940 2026] [:error] [pid 42313:tid 42330] [client 13.71.185.179:4026] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "adpz_V2P8TxdbaN018J9fgAAAA4"]
[Sun Apr 12 00:17:03.301293 2026] [:error] [pid 42219:tid 42238] [client 13.71.185.179:4085] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/333.php"] [unique_id "adpz_w-4IkVbTQx_J-27WAAAAI8"]
[Sun Apr 12 00:17:04.306849 2026] [:error] [pid 42219:tid 42247] [client 13.71.185.179:4003] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/520.php"] [unique_id "adp0AA-4IkVbTQx_J-27WgAAAJg"]
[Sun Apr 12 00:17:05.568162 2026] [:error] [pid 42313:tid 42321] [client 13.71.185.179:3982] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/520.php"] [unique_id "adp0AV2P8TxdbaN018J9igAAAAU"]
[Sun Apr 12 00:17:07.530865 2026] [:error] [pid 52608:tid 52620] [client 13.71.185.179:4023] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/520.php"] [unique_id "adp0AyY5wH-BLt5QEKif2QAAAQk"]
[Sun Apr 12 00:17:10.097881 2026] [:error] [pid 42220:tid 42270] [client 13.71.185.179:3974] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/520.php"] [unique_id "adp0Bkz5c3Cs6a8B5QurSwAAANM"]
[Sun Apr 12 00:17:11.311247 2026] [:error] [pid 52608:tid 52633] [client 13.71.185.179:4027] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "adp0ByY5wH-BLt5QEKigLAAAARY"]
[Sun Apr 12 00:17:13.300920 2026] [:error] [pid 42220:tid 42269] [client 13.71.185.179:4029] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "adp0CUz5c3Cs6a8B5QurTwAAANI"]
[Sun Apr 12 00:17:16.298054 2026] [:error] [pid 52608:tid 52613] [client 13.71.185.179:3925] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "adp0DCY5wH-BLt5QEKigRgAAAQI"]
[Sun Apr 12 00:17:23.405920 2026] [:error] [pid 52608:tid 52624] [client 13.71.185.179:4007] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ar.php"] [unique_id "adp0EyY5wH-BLt5QEKigfgAAAQ0"]
[Sun Apr 12 00:17:24.994234 2026] [:error] [pid 52608:tid 52623] [client 13.71.185.179:3961] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "adp0FCY5wH-BLt5QEKigjAAAAQw"]
[Sun Apr 12 00:17:27.093284 2026] [:error] [pid 42220:tid 42263] [client 13.71.185.179:3908] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "adp0F0z5c3Cs6a8B5QurYAAAAMw"]
[Sun Apr 12 00:17:29.534607 2026] [:error] [pid 42221:tid 42290] [client 13.71.185.179:4081] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "adp0GU2gt0pb_0-cc6m2MgAAAEw"]
[Sun Apr 12 00:17:41.148453 2026] [:error] [pid 42221:tid 42283] [client 13.71.185.179:4044] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "adp0JU2gt0pb_0-cc6m2RwAAAEU"]
[Sun Apr 12 00:17:53.468568 2026] [:error] [pid 42220:tid 42259] [client 13.71.185.179:4064] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/about.php"] [unique_id "adp0MUz5c3Cs6a8B5QurfQAAAMg"]
[Sun Apr 12 00:18:00.743919 2026] [:error] [pid 42313:tid 42320] [client 13.71.185.179:3968] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "adp0OF2P8TxdbaN018J-AAAAAAQ"]
[Sun Apr 12 00:18:03.173765 2026] [:error] [pid 42313:tid 42335] [client 13.71.185.179:4062] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "adp0O12P8TxdbaN018J-DwAAABM"]
[Sun Apr 12 00:18:06.952738 2026] [:error] [pid 42221:tid 42287] [client 13.71.185.179:3977] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "adp0Pk2gt0pb_0-cc6m2ZAAAAEk"]
[Sun Apr 12 00:18:10.411679 2026] [:error] [pid 42221:tid 42285] [client 13.71.185.179:3841] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nox.php"] [unique_id "adp0Qk2gt0pb_0-cc6m2awAAAEc"]
[Sun Apr 12 00:18:13.219818 2026] [:error] [pid 42313:tid 42326] [client 13.71.185.179:4019] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "adp0RV2P8TxdbaN018J-OgAAAAo"]
[Sun Apr 12 00:18:16.101314 2026] [:error] [pid 52608:tid 52613] [client 13.71.185.179:4056] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "adp0SCY5wH-BLt5QEKihMAAAAQI"]
[Sun Apr 12 00:18:18.247293 2026] [:error] [pid 42221:tid 42284] [client 13.71.185.179:4024] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "adp0Sk2gt0pb_0-cc6m2eAAAAEY"]
[Sun Apr 12 00:18:20.318608 2026] [:error] [pid 42221:tid 42297] [client 13.71.185.179:4006] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "adp0TE2gt0pb_0-cc6m2fgAAAFM"]
[Sun Apr 12 00:18:21.756884 2026] [:error] [pid 52608:tid 52613] [client 13.71.185.179:3984] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "adp0TSY5wH-BLt5QEKihVAAAAQI"]
[Sun Apr 12 00:18:22.939555 2026] [:error] [pid 42313:tid 42325] [client 13.71.185.179:3917] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "adp0Tl2P8TxdbaN018J-ZgAAAAk"]
[Sun Apr 12 00:18:24.220313 2026] [:error] [pid 42313:tid 42317] [client 13.71.185.179:3928] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "adp0UF2P8TxdbaN018J-cgAAAAE"]
[Sun Apr 12 00:18:26.173948 2026] [:error] [pid 42219:tid 42229] [client 13.71.185.179:3904] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "adp0Ug-4IkVbTQx_J-27wQAAAIY"]
[Sun Apr 12 00:18:30.231627 2026] [:error] [pid 52608:tid 52624] [client 13.71.185.179:3919] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "adp0ViY5wH-BLt5QEKihdgAAAQ0"]
[Sun Apr 12 00:18:34.187708 2026] [:error] [pid 52608:tid 52631] [client 13.71.185.179:3924] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "adp0WiY5wH-BLt5QEKihiwAAARQ"]
[Sun Apr 12 00:18:36.691511 2026] [:error] [pid 42313:tid 42327] [client 13.71.185.179:3987] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class9.php"] [unique_id "adp0XF2P8TxdbaN018J-pAAAAAs"]
[Sun Apr 12 00:18:52.416711 2026] [:error] [pid 42313:tid 42334] [client 13.71.185.179:3894] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xaz.php"] [unique_id "adp0bF2P8TxdbaN018J-1gAAABI"]
[Sun Apr 12 00:18:57.268927 2026] [:error] [pid 42219:tid 42239] [client 13.71.185.179:4061] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xaz.php"] [unique_id "adp0cQ-4IkVbTQx_J-28CAAAAJA"]
[Sun Apr 12 00:19:00.180355 2026] [:error] [pid 42220:tid 42266] [client 13.71.185.179:4045] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xaz.php"] [unique_id "adp0dEz5c3Cs6a8B5QurwQAAAM8"]
[Sun Apr 12 00:19:02.262702 2026] [:error] [pid 52608:tid 52616] [client 13.71.185.179:4016] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xaz.php"] [unique_id "adp0diY5wH-BLt5QEKih5wAAAQU"]
[Sun Apr 12 00:19:04.186474 2026] [:error] [pid 52608:tid 52611] [client 13.71.185.179:4036] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up4.php"] [unique_id "adp0eCY5wH-BLt5QEKih7gAAAQA"]
[Sun Apr 12 00:19:07.187456 2026] [:error] [pid 42221:tid 42283] [client 13.71.185.179:4083] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up4.php"] [unique_id "adp0e02gt0pb_0-cc6m2tgAAAEU"]
[Sun Apr 12 00:19:10.277304 2026] [:error] [pid 42219:tid 42223] [client 13.71.185.179:4086] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up4.php"] [unique_id "adp0fg-4IkVbTQx_J-28KAAAAIA"]
[Sun Apr 12 00:19:13.310424 2026] [:error] [pid 42313:tid 42323] [client 13.71.185.179:4035] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up4.php"] [unique_id "adp0gV2P8TxdbaN018J_BgAAAAc"]
[Sun Apr 12 00:19:15.685564 2026] [:error] [pid 42219:tid 42227] [client 13.71.185.179:4049] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1aa.php"] [unique_id "adp0gw-4IkVbTQx_J-28LgAAAIQ"]
[Sun Apr 12 00:19:17.727941 2026] [:error] [pid 42313:tid 42318] [client 13.71.185.179:3958] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1aa.php"] [unique_id "adp0hV2P8TxdbaN018J_EQAAAAI"]
[Sun Apr 12 00:19:18.787193 2026] [:error] [pid 42221:tid 42285] [client 13.71.185.179:4073] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1aa.php"] [unique_id "adp0hk2gt0pb_0-cc6m2zQAAAEc"]
[Sun Apr 12 00:19:20.685938 2026] [:error] [pid 42219:tid 42236] [client 13.71.185.179:4039] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1aa.php"] [unique_id "adp0iA-4IkVbTQx_J-28PAAAAI0"]
[Sun Apr 12 00:19:22.257650 2026] [:error] [pid 42313:tid 42326] [client 13.71.185.179:3914] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "adp0il2P8TxdbaN018J_HQAAAAo"]
[Sun Apr 12 00:19:24.101401 2026] [:error] [pid 52608:tid 52635] [client 13.71.185.179:3953] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "adp0jCY5wH-BLt5QEKiiGAAAARg"]
[Sun Apr 12 00:19:25.755131 2026] [:error] [pid 42313:tid 42334] [client 13.71.185.179:3932] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "adp0jV2P8TxdbaN018J_LQAAABI"]
[Sun Apr 12 00:19:27.062313 2026] [:error] [pid 42219:tid 42231] [client 13.71.185.179:3840] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "adp0jw-4IkVbTQx_J-28RwAAAIg"]
[Sun Apr 12 00:19:28.962323 2026] [:error] [pid 42313:tid 42340] [client 13.71.185.179:4012] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtz.php"] [unique_id "adp0kF2P8TxdbaN018J_PQAAABg"]
[Sun Apr 12 00:19:32.063273 2026] [:error] [pid 42313:tid 42340] [client 13.71.185.179:4000] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtz.php"] [unique_id "adp0lF2P8TxdbaN018J_TAAAABg"]
[Sun Apr 12 00:19:34.317348 2026] [:error] [pid 42313:tid 42326] [client 13.71.185.179:4017] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtz.php"] [unique_id "adp0ll2P8TxdbaN018J_TQAAAAo"]
[Sun Apr 12 00:20:02.520513 2026] [:error] [pid 52608:tid 52627] [client 13.71.185.179:3918] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "adp0siY5wH-BLt5QEKii_gAAARA"]
[Sun Apr 12 00:20:06.239000 2026] [:error] [pid 42219:tid 42225] [client 13.71.185.179:4089] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "adp0tg-4IkVbTQx_J-28hAAAAII"]
[Sun Apr 12 00:20:08.246732 2026] [:error] [pid 42313:tid 42324] [client 13.71.185.179:4095] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "adp0uF2P8TxdbaN018J_iQAAAAg"]
[Sun Apr 12 00:20:10.188600 2026] [:error] [pid 42313:tid 42329] [client 13.71.185.179:4090] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byp.php"] [unique_id "adp0ul2P8TxdbaN018J_jwAAAA0"]
[Sun Apr 12 00:20:12.156686 2026] [:error] [pid 42220:tid 42263] [client 13.71.185.179:3954] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "adp0vEz5c3Cs6a8B5QusEwAAAMw"]
[Sun Apr 12 00:20:14.171176 2026] [:error] [pid 52608:tid 52634] [client 13.71.185.179:4067] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "adp0viY5wH-BLt5QEKijGgAAARc"]
[Sun Apr 12 00:20:15.519200 2026] [:error] [pid 42221:tid 42298] [client 13.71.185.179:3911] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "adp0v02gt0pb_0-cc6m3KgAAAFQ"]
[Sun Apr 12 00:20:16.748094 2026] [:error] [pid 42313:tid 42320] [client 13.71.185.179:3994] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "adp0wF2P8TxdbaN018J_mAAAAAQ"]
[Sun Apr 12 00:20:17.964461 2026] [:error] [pid 42219:tid 42238] [client 13.71.185.179:3976] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "adp0wQ-4IkVbTQx_J-28lQAAAI8"]
[Sun Apr 12 00:20:19.098002 2026] [:error] [pid 52608:tid 52616] [client 13.71.185.179:4069] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "adp0wyY5wH-BLt5QEKijHwAAAQU"]
[Sun Apr 12 00:20:20.632131 2026] [:error] [pid 52608:tid 52626] [client 13.71.185.179:3940] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "adp0xCY5wH-BLt5QEKijJAAAAQ8"]
[Sun Apr 12 00:20:21.949246 2026] [:error] [pid 42313:tid 42328] [client 13.71.185.179:4041] [client 13.71.185.179] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "adp0xV2P8TxdbaN018J_ogAAAAw"]
[Sun Apr 12 00:52:15.658523 2026] [:error] [pid 45064:tid 45103] [client 72.76.132.156:63315] [client 72.76.132.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.76.132.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adp8P5cHBvLyJ6EUhUrfqwAAAUo"]
[Sun Apr 12 00:52:25.823162 2026] [:error] [pid 44701:tid 44800] [client 72.76.132.156:63722] [client 72.76.132.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.76.132.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adp8SRGZAP4MrlxEPFchxAAAAFg"]
[Sun Apr 12 00:52:36.515394 2026] [:error] [pid 44700:tid 44747] [client 72.76.132.156:64080] [client 72.76.132.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.76.132.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adp8VGryPgh_uW4QPClS-AAAAMM"]
[Sun Apr 12 00:52:47.117600 2026] [:error] [pid 45064:tid 45111] [client 72.76.132.156:64446] [client 72.76.132.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.76.132.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adp8X5cHBvLyJ6EUhUrgIAAAAVI"]
[Sun Apr 12 00:52:57.763050 2026] [:error] [pid 44700:tid 44749] [client 72.76.132.156:64817] [client 72.76.132.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 72.76.132.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adp8aWryPgh_uW4QPClTLAAAAMU"]
[Sun Apr 12 01:11:22.655950 2026] [:error] [pid 44701:tid 44775] [client 86.81.103.109:61684] [client 86.81.103.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.81.103.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adqAuhGZAP4MrlxEPFctOAAAAEM"]
[Sun Apr 12 01:11:33.415866 2026] [:error] [pid 45064:tid 45109] [client 86.81.103.109:62124] [client 86.81.103.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.81.103.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adqAxZcHBvLyJ6EUhUrx-gAAAVA"]
[Sun Apr 12 01:11:43.961380 2026] [:error] [pid 44701:tid 44781] [client 86.81.103.109:62808] [client 86.81.103.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.81.103.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adqAzxGZAP4MrlxEPFctmgAAAEg"]
[Sun Apr 12 01:11:55.020989 2026] [:error] [pid 45064:tid 45095] [client 86.81.103.109:63461] [client 86.81.103.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.81.103.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adqA25cHBvLyJ6EUhUrywwAAAUM"]
[Sun Apr 12 01:12:05.871642 2026] [:error] [pid 44700:tid 44765] [client 86.81.103.109:64058] [client 86.81.103.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.81.103.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adqA5WryPgh_uW4QPClcmQAAANU"]
[Sun Apr 12 01:21:48.175719 2026] [:error] [pid 34152:tid 34161] [client 65.254.225.217:38794] [client 65.254.225.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adqDLIFtE4RhFslT1Dq36AAAAAc"]
[Sun Apr 12 01:21:49.020392 2026] [:error] [pid 34152:tid 34154] [client 65.254.225.217:38794] [client 65.254.225.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adqDLYFtE4RhFslT1Dq39AAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 12 01:27:48.222117 2026] [:error] [pid 34152:tid 34154] [client 20.220.11.224:63691] [client 20.220.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adqElIFtE4RhFslT1Dq75gAAAAA"]
[Sun Apr 12 01:27:57.242702 2026] [:error] [pid 44701:tid 44774] [client 20.220.11.224:63709] [client 20.220.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adqEnRGZAP4MrlxEPFc2NAAAAEI"]
[Sun Apr 12 01:28:12.367420 2026] [:error] [pid 44698:tid 44727] [client 103.126.60.80:59406] [client 103.126.60.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.126.60.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adqErBgoH9UWd-U3D55fGQAAAJg"]
[Sun Apr 12 01:28:13.690993 2026] [:error] [pid 44698:tid 44705] [client 103.126.60.80:59417] [client 103.126.60.80] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adqErRgoH9UWd-U3D55fHwAAAII"]
[Sun Apr 12 01:28:15.606907 2026] [:error] [pid 44698:tid 44704] [client 103.126.60.80:59417] [client 103.126.60.80] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adqErxgoH9UWd-U3D55fKAAAAIE"]
[Sun Apr 12 01:56:28.469313 2026] [:error] [pid 44700:tid 44763] [client 209.38.77.153:53843] [client 209.38.77.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "adqLTGryPgh_uW4QPClr1gAAANM"]
[Sun Apr 12 02:05:38.289618 2026] [:error] [pid 36938:tid 36952] [client 151.237.138.20:57016] [client 151.237.138.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 151.237.138.20, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adqNcoSWpa_VL1JPU6zo-AAAAYw"]
[Sun Apr 12 02:05:39.292849 2026] [:error] [pid 36938:tid 36945] [client 151.237.138.20:57016] [client 151.237.138.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 151.237.138.20, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adqNc4SWpa_VL1JPU6zo-gAAAYU"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 12 02:23:10.258818 2026] [:error] [pid 36938:tid 36964] [client 176.61.154.89:30982] [client 176.61.154.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.61.154.89, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adqRjoSWpa_VL1JPU6z1-AAAAZg"]
[Sun Apr 12 02:43:41.476146 2026] [:error] [pid 44700:tid 44766] [client 105.235.137.169:34563] [client 105.235.137.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.235.137.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adqWXWryPgh_uW4QPCl--wAAANY"]
[Sun Apr 12 02:43:51.725930 2026] [:error] [pid 45064:tid 45095] [client 105.235.137.169:46912] [client 105.235.137.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.235.137.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adqWZ5cHBvLyJ6EUhUoVuwAAAUM"]
[Sun Apr 12 02:44:01.846563 2026] [:error] [pid 44700:tid 44765] [client 105.235.137.169:40829] [client 105.235.137.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.235.137.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adqWcWryPgh_uW4QPCl_UQAAANU"]
[Sun Apr 12 02:44:12.485797 2026] [:error] [pid 44700:tid 44745] [client 105.235.137.169:47893] [client 105.235.137.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.235.137.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adqWfGryPgh_uW4QPCl_jgAAAME"]
[Sun Apr 12 02:44:22.269507 2026] [:error] [pid 45064:tid 45113] [client 105.235.137.169:39797] [client 105.235.137.169] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 105.235.137.169, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adqWhpcHBvLyJ6EUhUoV5QAAAVQ"]
[Sun Apr 12 02:47:50.472441 2026] [:error] [pid 36909:tid 36915] [client 176.61.154.89:30629] [client 176.61.154.89] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adqXVkGk5GhxTCzHUOo4EAAAAQQ"]
[Sun Apr 12 02:48:41.812225 2026] [:error] [pid 44700:tid 44757] [client 176.61.154.89:29813] [client 176.61.154.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.61.154.89, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adqXiWryPgh_uW4QPCmC8gAAAM0"]
[Sun Apr 12 02:49:43.348475 2026] [:error] [pid 44698:tid 44715] [client 176.61.154.89:30464] [client 176.61.154.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.61.154.89, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adqXxxgoH9UWd-U3D56RNQAAAIw"]
[Sun Apr 12 02:50:39.651711 2026] [:error] [pid 36909:tid 36932] [client 176.61.154.89:31104] [client 176.61.154.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.61.154.89, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adqX_0Gk5GhxTCzHUOo5SAAAARU"]
[Sun Apr 12 02:51:42.384772 2026] [:error] [pid 44700:tid 44756] [client 176.61.154.89:29706] [client 176.61.154.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.61.154.89, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adqYPmryPgh_uW4QPCmFfwAAAMw"]
[Sun Apr 12 02:55:49.902343 2026] [:error] [pid 44698:tid 44724] [client 41.56.177.164:19630] [client 41.56.177.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.56.177.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adqZNRgoH9UWd-U3D56VdAAAAJU"]
[Sun Apr 12 02:55:59.802555 2026] [:error] [pid 44698:tid 44716] [client 41.56.177.164:19631] [client 41.56.177.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.56.177.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adqZPxgoH9UWd-U3D56VrgAAAI0"]
[Sun Apr 12 02:56:10.312203 2026] [:error] [pid 34152:tid 34167] [client 41.56.177.164:19632] [client 41.56.177.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.56.177.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adqZSoFtE4RhFslT1DrUiQAAAA0"]
[Sun Apr 12 02:56:20.982579 2026] [:error] [pid 34152:tid 34160] [client 41.56.177.164:19633] [client 41.56.177.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.56.177.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adqZVIFtE4RhFslT1DrUkAAAAAY"]
[Sun Apr 12 02:56:31.472618 2026] [:error] [pid 44698:tid 44714] [client 41.56.177.164:19634] [client 41.56.177.164] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.56.177.164, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adqZXxgoH9UWd-U3D56WBQAAAIs"]
[Sun Apr 12 05:36:49.939109 2026] [:error] [pid 26567:tid 26569] [client 43.156.204.134:58624] [client 43.156.204.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adq-8XhRpg6ptWFyFx38xQAAAQA"]
[Sun Apr 12 07:54:26.546970 2026] [:error] [pid 25329:tid 25384] [client 20.223.145.95:54097] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adrfMmdcIYsS8Iyaj11YCgAAAIU"]
[Sun Apr 12 07:54:27.405216 2026] [:error] [pid 26599:tid 26608] [client 20.223.145.95:47124] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adrfM3G89LXoQbk_rwBlvgAAAUY"]
[Sun Apr 12 07:54:28.489709 2026] [:error] [pid 26599:tid 26611] [client 20.223.145.95:43184] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adrfNHG89LXoQbk_rwBlwAAAAUk"]
[Sun Apr 12 07:54:30.644407 2026] [:error] [pid 60280:tid 60299] [client 20.223.145.95:28855] [client 20.223.145.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adrfNnBlLnDOYuIykkgR8gAAAdE"]
[Sun Apr 12 08:20:00.077565 2026] [:error] [pid 26600:tid 26647] [client 182.44.12.37:36596] [client 182.44.12.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adrlMO1YwAZiXhQKLYqaIgAAAZI"]
[Sun Apr 12 08:28:40.084733 2026] [:error] [pid 25437:tid 25451] [client 65.254.225.220:47630] [client 65.254.225.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adrnOHf97wYZje1ep_N_nQAAAMw"]
[Sun Apr 12 08:28:41.438699 2026] [:error] [pid 25437:tid 25461] [client 65.254.225.220:47630] [client 65.254.225.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adrnOXf97wYZje1ep_N_oAAAANY"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 12 08:52:53.517059 2026] [:error] [pid 60280:tid 60306] [client 154.161.249.1:20750] [client 154.161.249.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.161.249.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adrs5XBlLnDOYuIykkgv7gAAAdg"]
[Sun Apr 12 08:57:21.688176 2026] [:error] [pid 26567:tid 26573] [client 154.161.249.1:20755] [client 154.161.249.1] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adrt8XhRpg6ptWFyFx01BwAAAQQ"]
[Sun Apr 12 08:58:54.905148 2026] [:error] [pid 25327:tid 25343] [client 154.161.249.1:20758] [client 154.161.249.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.161.249.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adruTi6h2tZEVJo9JFJv6wAAAAc"]
[Sun Apr 12 09:00:25.785097 2026] [:error] [pid 25437:tid 25448] [client 154.161.249.1:20760] [client 154.161.249.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.161.249.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adruqXf97wYZje1ep_OJEAAAAMk"]
[Sun Apr 12 09:01:53.065124 2026] [:error] [pid 25328:tid 25375] [client 154.161.249.1:20761] [client 154.161.249.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.161.249.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adrvAcxUaQZxT-e0YsAwPwAAAEk"]
[Sun Apr 12 09:03:17.238538 2026] [:error] [pid 25328:tid 25367] [client 154.161.249.1:20763] [client 154.161.249.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.161.249.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adrvVcxUaQZxT-e0YsAw0AAAAEM"]
[Sun Apr 12 10:49:57.720081 2026] [:error] [pid 60280:tid 60282] [client 187.49.186.234:57843] [client 187.49.186.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.49.186.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsIVXBlLnDOYuIykkhzPAAAAcA"]
[Sun Apr 12 10:50:07.747895 2026] [:error] [pid 26599:tid 26617] [client 187.49.186.234:65490] [client 187.49.186.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.49.186.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsIX3G89LXoQbk_rwCJpgAAAU8"]
[Sun Apr 12 10:50:42.647719 2026] [:error] [pid 26567:tid 26574] [client 187.49.186.234:39150] [client 187.49.186.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.49.186.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsIgnhRpg6ptWFyFx1MOgAAAQU"]
[Sun Apr 12 10:51:00.914373 2026] [:error] [pid 60280:tid 60300] [client 187.49.186.234:38974] [client 187.49.186.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.49.186.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsIlHBlLnDOYuIykkhzsQAAAdI"]
[Sun Apr 12 10:51:11.517041 2026] [:error] [pid 26600:tid 26646] [client 187.49.186.234:65339] [client 187.49.186.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.49.186.234, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsIn-1YwAZiXhQKLYrDdgAAAZE"]
[Sun Apr 12 11:26:45.277207 2026] [:error] [pid 60280:tid 60296] [client 111.220.100.242:52810] [client 111.220.100.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 111.220.100.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsQ9XBlLnDOYuIykkiJjAAAAc4"]
[Sun Apr 12 11:26:56.144498 2026] [:error] [pid 26599:tid 26620] [client 111.220.100.242:53358] [client 111.220.100.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 111.220.100.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsRAHG89LXoQbk_rwCQBAAAAVI"]
[Sun Apr 12 11:27:06.715113 2026] [:error] [pid 26600:tid 26629] [client 111.220.100.242:53786] [client 111.220.100.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 111.220.100.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsRCu1YwAZiXhQKLYrNkwAAAYA"]
[Sun Apr 12 11:27:17.349247 2026] [:error] [pid 25329:tid 25374] [client 111.220.100.242:54219] [client 111.220.100.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 111.220.100.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsRFWdcIYsS8Iyaj112fAAAAIA"]
[Sun Apr 12 11:27:27.985185 2026] [:error] [pid 25328:tid 25375] [client 111.220.100.242:54657] [client 111.220.100.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 111.220.100.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsRH8xUaQZxT-e0YsBv8wAAAEk"]
[Sun Apr 12 11:32:08.848061 2026] [:error] [pid 25329:tid 25413] [client 144.31.151.48:59235] [client 144.31.151.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 144.31.151.48, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adsSOGdcIYsS8Iyaj113DAAAAJY"], referer: https://www.google.com/
[Sun Apr 12 11:32:10.418571 2026] [:error] [pid 25329:tid 25374] [client 144.31.151.48:59235] [client 144.31.151.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsSOmdcIYsS8Iyaj113DgAAAIA"]
[Sun Apr 12 11:32:11.390511 2026] [:error] [pid 25327:tid 25343] [client 144.31.151.48:59937] [client 144.31.151.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsSOy6h2tZEVJo9JFKL9wAAAAc"]
[Sun Apr 12 11:32:12.365521 2026] [:error] [pid 25329:tid 25386] [client 144.31.151.48:60066] [client 144.31.151.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsSPGdcIYsS8Iyaj113EAAAAIY"]
[Sun Apr 12 11:32:13.335610 2026] [:error] [pid 26599:tid 26616] [client 144.31.151.48:60170] [client 144.31.151.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsSPXG89LXoQbk_rwCQtQAAAU4"]
[Sun Apr 12 11:32:14.305064 2026] [:error] [pid 25437:tid 25459] [client 144.31.151.48:51005] [client 144.31.151.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsSPnf97wYZje1ep_O6vgAAANQ"]
[Sun Apr 12 11:32:15.277598 2026] [:error] [pid 25327:tid 25353] [client 144.31.151.48:51110] [client 144.31.151.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsSPy6h2tZEVJo9JFKL-wAAABE"]
[Sun Apr 12 11:32:16.248425 2026] [:error] [pid 26567:tid 26582] [client 144.31.151.48:55154] [client 144.31.151.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsSQHhRpg6ptWFyFx1VkgAAAQ0"]
[Sun Apr 12 11:48:39.565327 2026] [:error] [pid 25437:tid 25441] [client 189.6.35.107:6074] [client 189.6.35.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.6.35.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsWF3f97wYZje1ep_PADAAAAMI"]
[Sun Apr 12 11:48:50.194168 2026] [:error] [pid 25437:tid 25440] [client 189.6.35.107:14565] [client 189.6.35.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.6.35.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsWInf97wYZje1ep_PAFwAAAME"]
[Sun Apr 12 11:49:00.195651 2026] [:error] [pid 26599:tid 26622] [client 189.6.35.107:5755] [client 189.6.35.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.6.35.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsWLHG89LXoQbk_rwCTuQAAAVQ"]
[Sun Apr 12 11:49:11.131721 2026] [:error] [pid 60280:tid 60287] [client 189.6.35.107:14572] [client 189.6.35.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.6.35.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsWN3BlLnDOYuIykkiVmgAAAcU"]
[Sun Apr 12 11:49:20.862523 2026] [:error] [pid 26567:tid 26588] [client 189.6.35.107:5949] [client 189.6.35.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.6.35.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsWQHhRpg6ptWFyFx1ZZgAAARM"]
[Sun Apr 12 12:55:13.063058 2026] [:error] [pid 60280:tid 60283] [client 180.151.192.175:54159] [client 180.151.192.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.151.192.175, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adslsXBlLnDOYuIykki4PQAAAcE"]
[Sun Apr 12 12:55:23.749697 2026] [:error] [pid 25328:tid 25398] [client 180.151.192.175:54686] [client 180.151.192.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.151.192.175, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adslu8xUaQZxT-e0YsCRBQAAAFQ"]
[Sun Apr 12 12:55:35.066901 2026] [:error] [pid 25327:tid 25352] [client 180.151.192.175:55282] [client 180.151.192.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.151.192.175, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adslxy6h2tZEVJo9JFKZYgAAABA"]
[Sun Apr 12 12:55:45.447321 2026] [:error] [pid 26567:tid 26593] [client 180.151.192.175:55746] [client 180.151.192.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.151.192.175, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsl0XhRpg6ptWFyFx1kZAAAARg"]
[Sun Apr 12 12:55:56.118446 2026] [:error] [pid 25328:tid 25389] [client 180.151.192.175:56228] [client 180.151.192.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.151.192.175, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adsl3MxUaQZxT-e0YsCRMgAAAFA"]
[Sun Apr 12 14:27:18.390900 2026] [autoindex:error] [pid 60280:tid 60305] [client 143.110.240.70:56201] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun Apr 12 14:40:24.862450 2026] [:error] [pid 26567:tid 26574] [client 43.140.247.223:45142] [client 43.140.247.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ads-WHhRpg6ptWFyFx149wAAAQU"]
[Sun Apr 12 14:50:13.036458 2026] [:error] [pid 25328:tid 25377] [client 97.74.93.106:36104] [client 97.74.93.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 97.74.93.106, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adtApcxUaQZxT-e0YsDBZQAAAEo"]
[Sun Apr 12 14:50:13.533894 2026] [:error] [pid 25328:tid 25370] [client 121.200.217.28:36986] [client 121.200.217.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 121.200.217.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adtApcxUaQZxT-e0YsDBaAAAAEY"]
[Sun Apr 12 14:50:18.385940 2026] [:error] [pid 26567:tid 26578] [client 97.74.93.106:60632] [client 97.74.93.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 97.74.93.106, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adtAqnhRpg6ptWFyFx16owAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 12 14:50:20.064807 2026] [:error] [pid 60280:tid 60299] [client 121.200.217.28:33506] [client 121.200.217.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 121.200.217.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adtArHBlLnDOYuIykkj4DwAAAdE"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 12 15:18:45.488495 2026] [:error] [pid 25328:tid 25364] [client 43.167.157.80:36460] [client 43.167.157.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adtHVcxUaQZxT-e0YsDJnAAAAEA"]
[Sun Apr 12 15:53:33.490702 2026] [:error] [pid 25437:tid 25461] [client 39.97.110.217:35928] [client 39.97.110.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 39.97.110.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adtPfXf97wYZje1ep_MErAAAANY"]
[Sun Apr 12 15:53:39.870758 2026] [:error] [pid 26600:tid 26646] [client 39.97.110.217:37204] [client 39.97.110.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 39.97.110.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adtPg-1YwAZiXhQKLYoGrgAAAZE"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 12 18:46:55.785419 2026] [:error] [pid 25328:tid 25408] [client 43.166.128.187:52646] [client 43.166.128.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adt4H8xUaQZxT-e0YsAagAAAAFg"]
[Sun Apr 12 22:59:11.908360 2026] [:error] [pid 26599:tid 26617] [client 111.92.135.157:36785] [client 111.92.135.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 111.92.135.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aduzP3G89LXoQbk_rwDwdwAAAU8"]
[Sun Apr 12 22:59:22.108496 2026] [:error] [pid 26599:tid 26615] [client 111.92.135.157:36825] [client 111.92.135.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 111.92.135.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aduzSnG89LXoQbk_rwDwewAAAU0"]
[Sun Apr 12 22:59:32.795184 2026] [:error] [pid 25327:tid 25340] [client 111.92.135.157:36121] [client 111.92.135.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 111.92.135.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aduzVC6h2tZEVJo9JFIRpwAAAAQ"]
[Sun Apr 12 22:59:43.317888 2026] [:error] [pid 25328:tid 25389] [client 111.92.135.157:36089] [client 111.92.135.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 111.92.135.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aduzX8xUaQZxT-e0YsB-XQAAAFA"]
[Sun Apr 12 22:59:53.900080 2026] [:error] [pid 25328:tid 25370] [client 111.92.135.157:36123] [client 111.92.135.157] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 111.92.135.157, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aduzacxUaQZxT-e0YsB-bgAAAEY"]
[Mon Apr 13 00:01:20.431183 2026] [:error] [pid 26599:tid 26619] [client 49.51.39.209:39990] [client 49.51.39.209] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "advB0HG89LXoQbk_rwD5FwAAAVE"]
[Mon Apr 13 01:21:51.179121 2026] [:error] [pid 31607:tid 31759] [client 31.223.14.162:8835] [client 31.223.14.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.223.14.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "advUr2jn_I-KYTWngjIt8wAAAJY"]
[Mon Apr 13 01:42:22.957015 2026] [:error] [pid 54671:tid 54681] [client 31.223.14.162:9407] [client 31.223.14.162] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "advZfmyJMmaONUqF0tBxsgAAAQY"]
[Mon Apr 13 01:43:23.047442 2026] [:error] [pid 54671:tid 54694] [client 31.223.14.162:9577] [client 31.223.14.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.223.14.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "advZu2yJMmaONUqF0tByVQAAARM"]
[Mon Apr 13 01:44:17.401787 2026] [:error] [pid 31606:tid 31719] [client 31.223.14.162:9890] [client 31.223.14.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.223.14.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "advZ8T9vCsshNhLmCiB3KwAAAE0"]
[Mon Apr 13 01:45:23.016488 2026] [:error] [pid 54671:tid 54684] [client 31.223.14.162:9522] [client 31.223.14.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.223.14.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "advaM2yJMmaONUqF0tBzLQAAAQk"]
[Mon Apr 13 01:46:09.451674 2026] [:error] [pid 54671:tid 54696] [client 31.223.14.162:9827] [client 31.223.14.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 31.223.14.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "advaYWyJMmaONUqF0tBzkgAAARU"]
[Mon Apr 13 02:15:01.829494 2026] [:error] [pid 54671:tid 54691] [client 34.75.248.196:61717] [client 34.75.248.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.75.248.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "advhJWyJMmaONUqF0tCHQAAAARA"]
[Mon Apr 13 02:15:02.956128 2026] [:error] [pid 54671:tid 54682] [client 34.75.248.196:61717] [client 34.75.248.196] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "advhJmyJMmaONUqF0tCHTAAAAQc"]
[Mon Apr 13 02:15:03.190442 2026] [:error] [pid 54671:tid 54698] [client 34.75.248.196:61717] [client 34.75.248.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.75.248.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "advhJ2yJMmaONUqF0tCHTQAAARc"]
[Mon Apr 13 02:15:04.218468 2026] [:error] [pid 54671:tid 54687] [client 34.75.248.196:62204] [client 34.75.248.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.75.248.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "advhKGyJMmaONUqF0tCHVQAAAQw"]
[Mon Apr 13 02:15:05.249844 2026] [:error] [pid 54671:tid 54676] [client 34.75.248.196:62338] [client 34.75.248.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.75.248.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "advhKWyJMmaONUqF0tCHWQAAAQE"]
[Mon Apr 13 02:15:06.264488 2026] [:error] [pid 54671:tid 54698] [client 34.75.248.196:62485] [client 34.75.248.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.75.248.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "advhKmyJMmaONUqF0tCHXgAAARc"]
[Mon Apr 13 02:15:07.427314 2026] [:error] [pid 31607:tid 31758] [client 34.75.248.196:62664] [client 34.75.248.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.75.248.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "advhK2jn_I-KYTWngjI9IAAAAJU"]
[Mon Apr 13 02:15:07.427468 2026] [:error] [pid 31607:tid 31758] [client 34.75.248.196:62664] [client 34.75.248.196] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.75.248.196, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "advhK2jn_I-KYTWngjI9IAAAAJU"]
[Mon Apr 13 02:24:24.686855 2026] [:error] [pid 54671:tid 54692] [client 170.106.179.68:38004] [client 170.106.179.68] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "advjWGyJMmaONUqF0tCOTQAAARE"]
[Mon Apr 13 02:36:27.346656 2026] [:error] [pid 32010:tid 32028] [client 162.241.226.175:30218] [client 162.241.226.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.226.175, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "advmKw0nq-t9pXyV1fyvIAAAANA"]
[Mon Apr 13 02:36:28.387352 2026] [:error] [pid 32010:tid 32030] [client 162.241.226.175:30218] [client 162.241.226.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.226.175, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "advmLA0nq-t9pXyV1fyvIwAAANI"], referer: https://expressinteriors.com/wp-login.php
[Mon Apr 13 04:12:37.368912 2026] [:error] [pid 33941:tid 33962] [client 129.159.56.14:51750] [client 129.159.56.14] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "adv8tW_NKERAxgG-rYMO2gAAAAs"]
[Mon Apr 13 05:30:25.140383 2026] [:error] [pid 11325:tid 11341] [client 74.248.16.65:22557] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa-rex1.php"] [unique_id "adwO8eCGj3EEJtCwa0OJhAAAAQ4"]
[Mon Apr 13 05:30:31.660634 2026] [:error] [pid 11325:tid 11339] [client 74.248.16.65:40475] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa-rex1.php"] [unique_id "adwO9-CGj3EEJtCwa0OJtAAAAQw"]
[Mon Apr 13 05:30:36.735966 2026] [:error] [pid 33942:tid 33995] [client 74.248.16.65:29020] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa-rex1.php"] [unique_id "adwO_BNHe8geO_lMeFaX0AAAAFA"]
[Mon Apr 13 05:30:38.020195 2026] [:error] [pid 33941:tid 33975] [client 74.248.16.65:9994] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa-rex1.php"] [unique_id "adwO_m_NKERAxgG-rYM2EgAAABg"]
[Mon Apr 13 05:30:40.552995 2026] [:error] [pid 33942:tid 34003] [client 74.248.16.65:18031] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/suck.php"] [unique_id "adwPABNHe8geO_lMeFaX2wAAAFg"]
[Mon Apr 13 05:30:41.927161 2026] [:error] [pid 11325:tid 11333] [client 74.248.16.65:17984] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/suck.php"] [unique_id "adwPAeCGj3EEJtCwa0OJ2QAAAQY"]
[Mon Apr 13 05:30:42.583838 2026] [:error] [pid 11325:tid 11346] [client 74.248.16.65:39119] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/suck.php"] [unique_id "adwPAuCGj3EEJtCwa0OJ2wAAARM"]
[Mon Apr 13 05:30:43.279960 2026] [:error] [pid 33942:tid 34000] [client 74.248.16.65:27693] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/suck.php"] [unique_id "adwPAxNHe8geO_lMeFaX4QAAAFU"]
[Mon Apr 13 05:30:44.167809 2026] [:error] [pid 33943:tid 34026] [client 74.248.16.65:34602] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hikudpno.php"] [unique_id "adwPBKyoXuZjocnxM5Fl4wAAAJQ"]
[Mon Apr 13 05:30:45.181136 2026] [:error] [pid 11325:tid 11327] [client 74.248.16.65:59756] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hikudpno.php"] [unique_id "adwPBeCGj3EEJtCwa0OJ3wAAAQA"]
[Mon Apr 13 05:30:46.665961 2026] [:error] [pid 11325:tid 11344] [client 74.248.16.65:9834] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hikudpno.php"] [unique_id "adwPBuCGj3EEJtCwa0OJ4gAAARE"]
[Mon Apr 13 05:30:47.472462 2026] [:error] [pid 33943:tid 34027] [client 74.248.16.65:34528] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hikudpno.php"] [unique_id "adwPB6yoXuZjocnxM5Fl7AAAAJU"]
[Mon Apr 13 05:30:49.016503 2026] [:error] [pid 34048:tid 34056] [client 74.248.16.65:34604] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.tmb/moon.php"] [unique_id "adwPCfSiQ_PJjlY5EhzzuQAAAMY"]
[Mon Apr 13 05:30:49.987758 2026] [:error] [pid 33941:tid 33969] [client 74.248.16.65:9336] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.tmb/moon.php"] [unique_id "adwPCW_NKERAxgG-rYM2KwAAABI"]
[Mon Apr 13 05:30:51.032530 2026] [:error] [pid 11325:tid 11348] [client 74.248.16.65:59733] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.tmb/moon.php"] [unique_id "adwPC-CGj3EEJtCwa0OJ9AAAARU"]
[Mon Apr 13 05:30:52.163285 2026] [:error] [pid 33941:tid 33963] [client 74.248.16.65:19489] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.tmb/moon.php"] [unique_id "adwPDG_NKERAxgG-rYM2LgAAAAw"]
[Mon Apr 13 05:30:53.762090 2026] [:error] [pid 33943:tid 34009] [client 74.248.16.65:19504] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sure.php"] [unique_id "adwPDayoXuZjocnxM5Fl-AAAAIM"]
[Mon Apr 13 05:30:55.638962 2026] [:error] [pid 33943:tid 34014] [client 74.248.16.65:32405] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sure.php"] [unique_id "adwPD6yoXuZjocnxM5Fl_gAAAIg"]
[Mon Apr 13 05:31:00.569136 2026] [:error] [pid 34048:tid 34055] [client 74.248.16.65:18039] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sure.php"] [unique_id "adwPFPSiQ_PJjlY5EhzzvwAAAMU"]
[Mon Apr 13 05:31:05.750897 2026] [:error] [pid 11325:tid 11345] [client 74.248.16.65:9821] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sure.php"] [unique_id "adwPGeCGj3EEJtCwa0OKKwAAARI"]
[Mon Apr 13 05:31:12.858432 2026] [:error] [pid 33943:tid 34024] [client 74.248.16.65:48076] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoo.php"] [unique_id "adwPIKyoXuZjocnxM5FmIQAAAJI"]
[Mon Apr 13 05:31:44.039688 2026] [:error] [pid 33943:tid 34015] [client 74.248.16.65:48072] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up-kon.php"] [unique_id "adwPQKyoXuZjocnxM5FmcAAAAIk"]
[Mon Apr 13 05:32:55.448518 2026] [:error] [pid 33943:tid 34024] [client 74.248.16.65:21384] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple-shell.php"] [unique_id "adwPh6yoXuZjocnxM5Fm-gAAAJI"]
[Mon Apr 13 05:32:56.244150 2026] [:error] [pid 33942:tid 33995] [client 74.248.16.65:42235] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple-shell.php"] [unique_id "adwPiBNHe8geO_lMeFaY3QAAAFA"]
[Mon Apr 13 05:32:57.058088 2026] [:error] [pid 34048:tid 34068] [client 74.248.16.65:42226] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple-shell.php"] [unique_id "adwPifSiQ_PJjlY5Ehz0TQAAANI"]
[Mon Apr 13 05:32:57.751995 2026] [:error] [pid 33941:tid 33969] [client 74.248.16.65:44299] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple-shell.php"] [unique_id "adwPiW_NKERAxgG-rYM2xwAAABI"]
[Mon Apr 13 05:32:58.955069 2026] [:error] [pid 33943:tid 34021] [client 74.248.16.65:36261] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/dist/vendor/about.php"] [unique_id "adwPiqyoXuZjocnxM5FnAAAAAI8"]
[Mon Apr 13 05:33:00.216615 2026] [:error] [pid 11325:tid 11337] [client 74.248.16.65:28621] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/dist/vendor/about.php"] [unique_id "adwPjOCGj3EEJtCwa0OMCgAAAQo"]
[Mon Apr 13 05:33:02.108012 2026] [:error] [pid 33941:tid 33972] [client 74.248.16.65:31846] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/dist/vendor/about.php"] [unique_id "adwPjm_NKERAxgG-rYM2zQAAABU"]
[Mon Apr 13 05:33:04.121986 2026] [:error] [pid 33942:tid 33983] [client 74.248.16.65:31002] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/dist/vendor/about.php"] [unique_id "adwPkBNHe8geO_lMeFaY7QAAAEQ"]
[Mon Apr 13 05:33:06.533296 2026] [:error] [pid 33943:tid 34011] [client 74.248.16.65:33380] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2Vu80QG.php"] [unique_id "adwPkqyoXuZjocnxM5FnEQAAAIU"]
[Mon Apr 13 05:33:08.577728 2026] [:error] [pid 33943:tid 34021] [client 74.248.16.65:26026] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2Vu80QG.php"] [unique_id "adwPlKyoXuZjocnxM5FnGwAAAI8"]
[Mon Apr 13 05:33:11.142613 2026] [:error] [pid 11325:tid 11332] [client 74.248.16.65:28570] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2Vu80QG.php"] [unique_id "adwPl-CGj3EEJtCwa0OMIAAAAQU"]
[Mon Apr 13 05:33:12.372426 2026] [:error] [pid 11325:tid 11329] [client 74.248.16.65:28205] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2Vu80QG.php"] [unique_id "adwPmOCGj3EEJtCwa0OMKwAAAQI"]
[Mon Apr 13 05:33:13.451738 2026] [:error] [pid 33943:tid 34023] [client 74.248.16.65:33378] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bsr.php"] [unique_id "adwPmayoXuZjocnxM5FnKAAAAJE"]
[Mon Apr 13 05:33:14.848188 2026] [:error] [pid 33942:tid 33988] [client 74.248.16.65:31863] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bsr.php"] [unique_id "adwPmhNHe8geO_lMeFaZEAAAAEk"]
[Mon Apr 13 05:33:15.970142 2026] [:error] [pid 33943:tid 34023] [client 74.248.16.65:24137] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bsr.php"] [unique_id "adwPm6yoXuZjocnxM5FnNQAAAJE"]
[Mon Apr 13 05:33:17.106794 2026] [:error] [pid 33943:tid 34009] [client 74.248.16.65:43267] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bsr.php"] [unique_id "adwPnayoXuZjocnxM5FnPAAAAIM"]
[Mon Apr 13 05:33:18.217687 2026] [:error] [pid 33941:tid 33966] [client 74.248.16.65:26046] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ans.php"] [unique_id "adwPnm_NKERAxgG-rYM27QAAAA8"]
[Mon Apr 13 05:33:19.494424 2026] [:error] [pid 11325:tid 11344] [client 74.248.16.65:28161] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ans.php"] [unique_id "adwPn-CGj3EEJtCwa0OMNQAAARE"]
[Mon Apr 13 05:33:21.279697 2026] [:error] [pid 33942:tid 33990] [client 74.248.16.65:35106] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ans.php"] [unique_id "adwPoRNHe8geO_lMeFaZIAAAAEs"]
[Mon Apr 13 05:33:21.898383 2026] [:error] [pid 11325:tid 11328] [client 74.248.16.65:17271] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ans.php"] [unique_id "adwPoeCGj3EEJtCwa0OMOgAAAQE"]
[Mon Apr 13 05:33:22.886661 2026] [:error] [pid 33942:tid 33985] [client 74.248.16.65:31860] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tot.php"] [unique_id "adwPohNHe8geO_lMeFaZJgAAAEY"]
[Mon Apr 13 05:33:24.236263 2026] [:error] [pid 33942:tid 33998] [client 74.248.16.65:18733] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tot.php"] [unique_id "adwPpBNHe8geO_lMeFaZKAAAAFM"]
[Mon Apr 13 05:33:24.976844 2026] [:error] [pid 33943:tid 34028] [client 74.248.16.65:59016] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tot.php"] [unique_id "adwPpKyoXuZjocnxM5FnXgAAAJY"]
[Mon Apr 13 05:33:25.911318 2026] [:error] [pid 33943:tid 34013] [client 74.248.16.65:44316] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tot.php"] [unique_id "adwPpayoXuZjocnxM5FnaQAAAIc"]
[Mon Apr 13 05:33:26.935306 2026] [:error] [pid 11325:tid 11332] [client 74.248.16.65:20261] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Core-wp.php"] [unique_id "adwPpuCGj3EEJtCwa0OMQwAAAQU"]
[Mon Apr 13 05:33:27.731017 2026] [:error] [pid 11325:tid 11333] [client 74.248.16.65:19570] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Core-wp.php"] [unique_id "adwPp-CGj3EEJtCwa0OMRgAAAQY"]
[Mon Apr 13 05:33:28.580890 2026] [:error] [pid 11325:tid 11329] [client 74.248.16.65:32683] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Core-wp.php"] [unique_id "adwPqOCGj3EEJtCwa0OMTQAAAQI"]
[Mon Apr 13 05:33:29.409307 2026] [:error] [pid 11325:tid 11350] [client 74.248.16.65:36266] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Core-wp.php"] [unique_id "adwPqeCGj3EEJtCwa0OMUwAAARc"]
[Mon Apr 13 05:33:30.532104 2026] [:error] [pid 33943:tid 34016] [client 74.248.16.65:20235] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/src.php"] [unique_id "adwPqqyoXuZjocnxM5FndgAAAIo"]
[Mon Apr 13 05:33:31.579489 2026] [:error] [pid 11325:tid 11347] [client 74.248.16.65:20290] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/src.php"] [unique_id "adwPq-CGj3EEJtCwa0OMXQAAARQ"]
[Mon Apr 13 05:33:32.490715 2026] [:error] [pid 11325:tid 11338] [client 74.248.16.65:40943] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/src.php"] [unique_id "adwPrOCGj3EEJtCwa0OMYQAAAQs"]
[Mon Apr 13 05:33:33.404011 2026] [:error] [pid 11325:tid 11345] [client 74.248.16.65:40951] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/src.php"] [unique_id "adwPreCGj3EEJtCwa0OMZgAAARI"]
[Mon Apr 13 05:33:34.610732 2026] [:error] [pid 11325:tid 11348] [client 74.248.16.65:17584] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pomo/v2.php"] [unique_id "adwPruCGj3EEJtCwa0OMawAAARU"]
[Mon Apr 13 05:33:35.891754 2026] [:error] [pid 11325:tid 11347] [client 74.248.16.65:44338] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pomo/v2.php"] [unique_id "adwPr-CGj3EEJtCwa0OMbwAAARQ"]
[Mon Apr 13 05:33:37.010370 2026] [:error] [pid 33942:tid 33993] [client 74.248.16.65:21064] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pomo/v2.php"] [unique_id "adwPsRNHe8geO_lMeFaZNwAAAE4"]
[Mon Apr 13 05:33:37.777501 2026] [:error] [pid 34048:tid 34069] [client 74.248.16.65:17542] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pomo/v2.php"] [unique_id "adwPsfSiQ_PJjlY5Ehz0gAAAANM"]
[Mon Apr 13 05:33:38.543383 2026] [:error] [pid 33943:tid 34025] [client 74.248.16.65:43767] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nxd.php"] [unique_id "adwPsqyoXuZjocnxM5FniQAAAJM"]
[Mon Apr 13 05:33:39.225585 2026] [:error] [pid 33943:tid 34022] [client 74.248.16.65:17579] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nxd.php"] [unique_id "adwPs6yoXuZjocnxM5FnkQAAAJA"]
[Mon Apr 13 05:33:40.036247 2026] [:error] [pid 11325:tid 11343] [client 74.248.16.65:41557] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nxd.php"] [unique_id "adwPtOCGj3EEJtCwa0OMcwAAARA"]
[Mon Apr 13 05:33:40.806336 2026] [:error] [pid 11325:tid 11334] [client 74.248.16.65:44319] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nxd.php"] [unique_id "adwPtOCGj3EEJtCwa0OMdgAAAQc"]
[Mon Apr 13 05:33:41.617635 2026] [:error] [pid 11325:tid 11350] [client 74.248.16.65:26561] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/payout.php"] [unique_id "adwPteCGj3EEJtCwa0OMfwAAARc"]
[Mon Apr 13 05:33:42.610980 2026] [:error] [pid 34048:tid 34061] [client 74.248.16.65:36232] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/payout.php"] [unique_id "adwPtvSiQ_PJjlY5Ehz0hgAAAMs"]
[Mon Apr 13 05:33:44.253137 2026] [:error] [pid 33943:tid 34020] [client 74.248.16.65:44349] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/payout.php"] [unique_id "adwPuKyoXuZjocnxM5FnogAAAI4"]
[Mon Apr 13 05:33:46.116564 2026] [:error] [pid 33942:tid 33994] [client 74.248.16.65:21074] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/payout.php"] [unique_id "adwPuhNHe8geO_lMeFaZVwAAAE8"]
[Mon Apr 13 05:33:48.737047 2026] [:error] [pid 33941:tid 33956] [client 74.248.16.65:36286] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uxquidwa.php"] [unique_id "adwPvG_NKERAxgG-rYM3CAAAAAY"]
[Mon Apr 13 05:33:50.160266 2026] [:error] [pid 33941:tid 33955] [client 74.248.16.65:36264] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uxquidwa.php"] [unique_id "adwPvm_NKERAxgG-rYM3DwAAAAU"]
[Mon Apr 13 05:33:52.489566 2026] [:error] [pid 33941:tid 33965] [client 74.248.16.65:30483] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uxquidwa.php"] [unique_id "adwPwG_NKERAxgG-rYM3GgAAAA4"]
[Mon Apr 13 05:34:01.622552 2026] [:error] [pid 11325:tid 11329] [client 74.248.16.65:41576] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vcard.php"] [unique_id "adwPyeCGj3EEJtCwa0OMtgAAAQI"]
[Mon Apr 13 05:34:03.559265 2026] [:error] [pid 33941:tid 33975] [client 74.248.16.65:18401] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vcard.php"] [unique_id "adwPy2_NKERAxgG-rYM3NAAAABg"]
[Mon Apr 13 05:34:04.679660 2026] [:error] [pid 33943:tid 34027] [client 74.248.16.65:33849] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vcard.php"] [unique_id "adwPzKyoXuZjocnxM5FnsAAAAJU"]
[Mon Apr 13 05:34:06.163291 2026] [:error] [pid 34048:tid 34059] [client 74.248.16.65:41581] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vcard.php"] [unique_id "adwPzvSiQ_PJjlY5Ehz0pwAAAMk"]
[Mon Apr 13 05:34:08.292834 2026] [:error] [pid 33942:tid 33998] [client 74.248.16.65:30149] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/file2.php"] [unique_id "adwP0BNHe8geO_lMeFaZhgAAAFM"]
[Mon Apr 13 05:34:09.710435 2026] [:error] [pid 11325:tid 11327] [client 74.248.16.65:48049] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/file2.php"] [unique_id "adwP0eCGj3EEJtCwa0OMxgAAAQA"]
[Mon Apr 13 05:34:10.705574 2026] [:error] [pid 33942:tid 33987] [client 74.248.16.65:41568] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/file2.php"] [unique_id "adwP0hNHe8geO_lMeFaZjQAAAEg"]
[Mon Apr 13 05:34:11.479130 2026] [:error] [pid 11325:tid 11351] [client 74.248.16.65:22643] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/file2.php"] [unique_id "adwP0-CGj3EEJtCwa0OMygAAARg"]
[Mon Apr 13 05:34:12.349138 2026] [:error] [pid 11325:tid 11328] [client 74.248.16.65:35578] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ddgg.php"] [unique_id "adwP1OCGj3EEJtCwa0OMzAAAAQE"]
[Mon Apr 13 05:34:13.199253 2026] [:error] [pid 33942:tid 33983] [client 74.248.16.65:33833] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ddgg.php"] [unique_id "adwP1RNHe8geO_lMeFaZlgAAAEQ"]
[Mon Apr 13 05:34:13.950659 2026] [:error] [pid 11325:tid 11350] [client 74.248.16.65:22598] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ddgg.php"] [unique_id "adwP1eCGj3EEJtCwa0OMzgAAARc"]
[Mon Apr 13 05:34:14.645695 2026] [:error] [pid 33942:tid 33985] [client 74.248.16.65:30186] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ddgg.php"] [unique_id "adwP1hNHe8geO_lMeFaZnAAAAEY"]
[Mon Apr 13 05:34:15.265749 2026] [:error] [pid 11325:tid 11339] [client 74.248.16.65:22627] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rc.php7"] [unique_id "adwP1-CGj3EEJtCwa0OM0QAAAQw"]
[Mon Apr 13 05:34:16.095228 2026] [:error] [pid 33942:tid 33999] [client 74.248.16.65:33839] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rc.php7"] [unique_id "adwP2BNHe8geO_lMeFaZowAAAFQ"]
[Mon Apr 13 05:34:17.741649 2026] [:error] [pid 33942:tid 33990] [client 74.248.16.65:30162] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rc.php7"] [unique_id "adwP2RNHe8geO_lMeFaZrAAAAEs"]
[Mon Apr 13 05:34:18.673946 2026] [:error] [pid 33943:tid 34029] [client 74.248.16.65:47497] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rc.php7"] [unique_id "adwP2qyoXuZjocnxM5FnvAAAAJc"]
[Mon Apr 13 05:34:19.590468 2026] [:error] [pid 34048:tid 34074] [client 74.248.16.65:33814] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/indo.php"] [unique_id "adwP2_SiQ_PJjlY5Ehz0uQAAANg"]
[Mon Apr 13 05:34:21.404270 2026] [:error] [pid 11325:tid 11348] [client 74.248.16.65:27758] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/indo.php"] [unique_id "adwP3eCGj3EEJtCwa0OM3QAAARU"]
[Mon Apr 13 05:34:22.987449 2026] [:error] [pid 34048:tid 34050] [client 74.248.16.65:27746] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/indo.php"] [unique_id "adwP3vSiQ_PJjlY5Ehz0wgAAAMA"]
[Mon Apr 13 05:34:24.590185 2026] [:error] [pid 33942:tid 33983] [client 74.248.16.65:21493] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/indo.php"] [unique_id "adwP4BNHe8geO_lMeFaZxgAAAEQ"]
[Mon Apr 13 05:34:26.306443 2026] [:error] [pid 34048:tid 34063] [client 74.248.16.65:24612] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pu.php"] [unique_id "adwP4vSiQ_PJjlY5Ehz0xwAAAM0"]
[Mon Apr 13 05:34:27.889807 2026] [:error] [pid 11325:tid 11331] [client 74.248.16.65:47595] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pu.php"] [unique_id "adwP4-CGj3EEJtCwa0OM5AAAAQQ"]
[Mon Apr 13 05:34:32.037273 2026] [:error] [pid 11325:tid 11337] [client 74.248.16.65:22622] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pu.php"] [unique_id "adwP6OCGj3EEJtCwa0OM6QAAAQo"]
[Mon Apr 13 05:34:35.769730 2026] [:error] [pid 33942:tid 34000] [client 74.248.16.65:24581] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pu.php"] [unique_id "adwP6xNHe8geO_lMeFaZ1AAAAFU"]
[Mon Apr 13 05:34:39.750999 2026] [:error] [pid 34048:tid 34060] [client 74.248.16.65:47526] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/docs.php"] [unique_id "adwP7_SiQ_PJjlY5Ehz03wAAAMo"]
[Mon Apr 13 05:34:41.349945 2026] [:error] [pid 33941:tid 33951] [client 74.248.16.65:35587] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/docs.php"] [unique_id "adwP8W_NKERAxgG-rYM3ZwAAAAE"]
[Mon Apr 13 05:34:42.730067 2026] [:error] [pid 34048:tid 34051] [client 74.248.16.65:23638] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/docs.php"] [unique_id "adwP8vSiQ_PJjlY5Ehz05AAAAME"]
[Mon Apr 13 05:34:51.025197 2026] [:error] [pid 33943:tid 34010] [client 74.248.16.65:24588] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/docs.php"] [unique_id "adwP-6yoXuZjocnxM5Fn8QAAAIQ"]
[Mon Apr 13 05:34:52.220071 2026] [:error] [pid 33943:tid 34027] [client 74.248.16.65:29774] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/cache.php"] [unique_id "adwP_KyoXuZjocnxM5Fn9wAAAJU"]
[Mon Apr 13 05:34:55.230112 2026] [:error] [pid 33943:tid 34024] [client 74.248.16.65:22184] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/cache.php"] [unique_id "adwP_6yoXuZjocnxM5Fn_wAAAJI"]
[Mon Apr 13 05:34:57.212883 2026] [:error] [pid 33943:tid 34013] [client 74.248.16.65:9365] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/cache.php"] [unique_id "adwQAayoXuZjocnxM5FoAgAAAIc"]
[Mon Apr 13 05:34:59.087297 2026] [:error] [pid 11325:tid 11327] [client 74.248.16.65:37106] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/js/cache.php"] [unique_id "adwQA-CGj3EEJtCwa0ONAQAAAQA"]
[Mon Apr 13 05:35:08.125523 2026] [:error] [pid 33943:tid 34013] [client 74.248.16.65:9997] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/taff.php"] [unique_id "adwQDKyoXuZjocnxM5FoKAAAAIc"]
[Mon Apr 13 05:35:11.185637 2026] [:error] [pid 33941:tid 33955] [client 74.248.16.65:21473] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/taff.php"] [unique_id "adwQD2_NKERAxgG-rYM3gAAAAAU"]
[Mon Apr 13 05:35:14.078497 2026] [:error] [pid 11325:tid 11337] [client 74.248.16.65:9348] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/taff.php"] [unique_id "adwQEuCGj3EEJtCwa0ONJQAAAQo"]
[Mon Apr 13 05:35:16.688636 2026] [:error] [pid 11325:tid 11334] [client 74.248.16.65:22152] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/taff.php"] [unique_id "adwQFOCGj3EEJtCwa0ONMwAAAQc"]
[Mon Apr 13 05:35:18.598327 2026] [:error] [pid 11325:tid 11348] [client 74.248.16.65:22161] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/set.php"] [unique_id "adwQFuCGj3EEJtCwa0ONOwAAARU"]
[Mon Apr 13 05:35:20.242295 2026] [:error] [pid 33942:tid 33993] [client 74.248.16.65:24692] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/set.php"] [unique_id "adwQGBNHe8geO_lMeFaaFQAAAE4"]
[Mon Apr 13 05:35:21.788480 2026] [:error] [pid 34048:tid 34060] [client 74.248.16.65:17154] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/set.php"] [unique_id "adwQGfSiQ_PJjlY5Ehz1CgAAAMo"]
[Mon Apr 13 05:35:23.305692 2026] [:error] [pid 34048:tid 34064] [client 74.248.16.65:21472] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/set.php"] [unique_id "adwQG_SiQ_PJjlY5Ehz1DQAAAM4"]
[Mon Apr 13 05:35:25.063627 2026] [:error] [pid 11325:tid 11331] [client 74.248.16.65:22640] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/133.php"] [unique_id "adwQHeCGj3EEJtCwa0ONSQAAAQQ"]
[Mon Apr 13 05:35:28.453430 2026] [:error] [pid 34048:tid 34064] [client 74.248.16.65:45329] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/133.php"] [unique_id "adwQIPSiQ_PJjlY5Ehz1GQAAAM4"]
[Mon Apr 13 05:35:30.888681 2026] [:error] [pid 33943:tid 34019] [client 74.248.16.65:48004] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/133.php"] [unique_id "adwQIqyoXuZjocnxM5FoTQAAAI0"]
[Mon Apr 13 05:35:33.053427 2026] [:error] [pid 33943:tid 34026] [client 74.248.16.65:59712] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/133.php"] [unique_id "adwQJayoXuZjocnxM5FoWQAAAJQ"]
[Mon Apr 13 05:35:34.802521 2026] [:error] [pid 33943:tid 34013] [client 74.248.16.65:24672] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ssxsl.php"] [unique_id "adwQJqyoXuZjocnxM5FoZQAAAIc"]
[Mon Apr 13 05:35:36.263609 2026] [:error] [pid 33941:tid 33968] [client 74.248.16.65:21469] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ssxsl.php"] [unique_id "adwQKG_NKERAxgG-rYM3nQAAABE"]
[Mon Apr 13 05:35:37.283003 2026] [:error] [pid 33943:tid 34016] [client 74.248.16.65:31818] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ssxsl.php"] [unique_id "adwQKayoXuZjocnxM5FocAAAAIo"]
[Mon Apr 13 05:35:39.010584 2026] [:error] [pid 11325:tid 11341] [client 74.248.16.65:21465] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ssxsl.php"] [unique_id "adwQK-CGj3EEJtCwa0ONbgAAAQ4"]
[Mon Apr 13 05:35:39.834909 2026] [:error] [pid 11325:tid 11336] [client 74.248.16.65:29765] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/AE5VAL.php"] [unique_id "adwQK-CGj3EEJtCwa0ONcAAAAQk"]
[Mon Apr 13 05:35:40.520267 2026] [:error] [pid 33942:tid 33988] [client 74.248.16.65:9356] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/AE5VAL.php"] [unique_id "adwQLBNHe8geO_lMeFaaMQAAAEk"]
[Mon Apr 13 05:35:41.675503 2026] [:error] [pid 33941:tid 33961] [client 74.248.16.65:24651] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/AE5VAL.php"] [unique_id "adwQLW_NKERAxgG-rYM3owAAAAo"]
[Mon Apr 13 05:35:43.498678 2026] [:error] [pid 33943:tid 34016] [client 74.248.16.65:9367] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/AE5VAL.php"] [unique_id "adwQL6yoXuZjocnxM5FocgAAAIo"]
[Mon Apr 13 05:35:44.552533 2026] [:error] [pid 33943:tid 34029] [client 74.248.16.65:37115] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gold.php"] [unique_id "adwQMKyoXuZjocnxM5FodQAAAJc"]
[Mon Apr 13 05:35:45.756200 2026] [:error] [pid 34048:tid 34074] [client 74.248.16.65:9732] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gold.php"] [unique_id "adwQMfSiQ_PJjlY5Ehz1JwAAANg"]
[Mon Apr 13 05:35:46.573894 2026] [:error] [pid 34048:tid 34061] [client 74.248.16.65:48020] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gold.php"] [unique_id "adwQMvSiQ_PJjlY5Ehz1KwAAAMs"]
[Mon Apr 13 05:35:47.415649 2026] [:error] [pid 34048:tid 34069] [client 74.248.16.65:24655] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gold.php"] [unique_id "adwQM_SiQ_PJjlY5Ehz1MAAAANM"]
[Mon Apr 13 05:35:48.312956 2026] [:error] [pid 33942:tid 33980] [client 74.248.16.65:22597] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gely.php"] [unique_id "adwQNBNHe8geO_lMeFaaQQAAAEE"]
[Mon Apr 13 05:35:49.051905 2026] [:error] [pid 33943:tid 34030] [client 74.248.16.65:45319] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gely.php"] [unique_id "adwQNayoXuZjocnxM5FodgAAAJg"]
[Mon Apr 13 05:35:49.826806 2026] [:error] [pid 34048:tid 34066] [client 74.248.16.65:9355] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gely.php"] [unique_id "adwQNfSiQ_PJjlY5Ehz1NAAAANA"]
[Mon Apr 13 05:35:51.233907 2026] [:error] [pid 34048:tid 34060] [client 74.248.16.65:37085] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gely.php"] [unique_id "adwQN_SiQ_PJjlY5Ehz1OwAAAMo"]
[Mon Apr 13 05:35:52.201592 2026] [:error] [pid 11325:tid 11327] [client 74.248.16.65:37162] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xBrain.php"] [unique_id "adwQOOCGj3EEJtCwa0ONhAAAAQA"]
[Mon Apr 13 05:35:53.012264 2026] [:error] [pid 34048:tid 34060] [client 74.248.16.65:24661] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xBrain.php"] [unique_id "adwQOfSiQ_PJjlY5Ehz1QwAAAMo"]
[Mon Apr 13 05:35:54.278889 2026] [:error] [pid 11325:tid 11333] [client 74.248.16.65:37127] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xBrain.php"] [unique_id "adwQOuCGj3EEJtCwa0ONhwAAAQY"]
[Mon Apr 13 05:35:55.902682 2026] [:error] [pid 34048:tid 34070] [client 74.248.16.65:24700] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xBrain.php"] [unique_id "adwQO_SiQ_PJjlY5Ehz1SgAAANQ"]
[Mon Apr 13 05:35:58.617282 2026] [:error] [pid 33941:tid 33959] [client 74.248.16.65:19092] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sagafif.php"] [unique_id "adwQPm_NKERAxgG-rYM3ugAAAAg"]
[Mon Apr 13 05:35:59.895175 2026] [:error] [pid 11325:tid 11333] [client 74.248.16.65:9406] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sagafif.php"] [unique_id "adwQP-CGj3EEJtCwa0ONlwAAAQY"]
[Mon Apr 13 05:36:01.459074 2026] [:error] [pid 33942:tid 34001] [client 74.248.16.65:39772] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sagafif.php"] [unique_id "adwQQRNHe8geO_lMeFaaUAAAAFY"]
[Mon Apr 13 05:36:02.906616 2026] [:error] [pid 33943:tid 34020] [client 74.248.16.65:19105] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sagafif.php"] [unique_id "adwQQqyoXuZjocnxM5FokQAAAI4"]
[Mon Apr 13 05:36:04.174570 2026] [:error] [pid 34048:tid 34061] [client 74.248.16.65:45332] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trc.php"] [unique_id "adwQRPSiQ_PJjlY5Ehz1WwAAAMs"]
[Mon Apr 13 05:36:05.595077 2026] [:error] [pid 33941:tid 33952] [client 74.248.16.65:30122] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trc.php"] [unique_id "adwQRW_NKERAxgG-rYM3vwAAAAI"]
[Mon Apr 13 05:36:06.475744 2026] [:error] [pid 33941:tid 33951] [client 74.248.16.65:39768] [client 74.248.16.65] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trc.php"] [unique_id "adwQRm_NKERAxgG-rYM3wQAAAAE"]
[Mon Apr 13 06:37:21.793732 2026] [:error] [pid 11325:tid 11349] [client 173.239.214.254:38157] [client 173.239.214.254] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "adweoeCGj3EEJtCwa0Or1wAAARY"]
[Mon Apr 13 07:24:59.319326 2026] [:error] [pid 33941:tid 33973] [client 217.150.80.109:63135] [client 217.150.80.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.150.80.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adwpy2_NKERAxgG-rYNSbQAAABY"]
[Mon Apr 13 07:25:01.773661 2026] [:error] [pid 33941:tid 33950] [client 217.150.80.109:63168] [client 217.150.80.109] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adwpzW_NKERAxgG-rYNSbgAAAAA"]
[Mon Apr 13 07:25:04.632472 2026] [:error] [pid 33941:tid 33956] [client 217.150.80.109:63168] [client 217.150.80.109] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adwp0G_NKERAxgG-rYNSdAAAAAY"]
[Mon Apr 13 08:16:48.666898 2026] [:error] [pid 7228:tid 7239] [client 45.187.165.196:45965] [client 45.187.165.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.187.165.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adw18AEnn1dQrOSHHNXnMgAAAQk"]
[Mon Apr 13 08:17:01.123251 2026] [:error] [pid 63309:tid 63320] [client 45.187.165.196:45810] [client 45.187.165.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.187.165.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adw1_UpIKZ10weXpf0WSTwAAAAc"]
[Mon Apr 13 08:17:12.160813 2026] [:error] [pid 63310:tid 63356] [client 45.187.165.196:1931] [client 45.187.165.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.187.165.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adw2CHoXpRU5ztmwPjKosQAAAEw"]
[Mon Apr 13 08:17:25.147251 2026] [:error] [pid 63406:tid 63424] [client 45.187.165.196:10441] [client 45.187.165.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.187.165.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adw2FbHZEIkQ0Zmgp5oAUAAAAM0"]
[Mon Apr 13 08:17:37.710657 2026] [:error] [pid 63406:tid 63417] [client 45.187.165.196:10381] [client 45.187.165.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.187.165.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adw2IbHZEIkQ0Zmgp5oAZwAAAMY"]
[Mon Apr 13 08:46:40.868594 2026] [:error] [pid 63311:tid 63391] [client 43.157.153.236:38200] [client 43.157.153.236] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adw88KHjrGN1MqBCVFkzHwAAAJQ"]
[Mon Apr 13 09:30:53.070122 2026] [:error] [pid 63310:tid 63361] [client 103.117.180.206:33610] [client 103.117.180.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.117.180.206, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adxHTXoXpRU5ztmwPjLCYwAAAFE"]
[Mon Apr 13 09:30:57.677978 2026] [:error] [pid 63310:tid 63364] [client 103.117.180.206:33610] [client 103.117.180.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.117.180.206, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adxHUXoXpRU5ztmwPjLCagAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Mon Apr 13 13:03:41.451788 2026] [:error] [pid 7228:tid 7233] [client 223.176.61.180:62673] [client 223.176.61.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.176.61.180, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adx5LQEnn1dQrOSHHNXBsAAAAQM"]
[Mon Apr 13 13:03:55.971875 2026] [:error] [pid 63309:tid 63321] [client 223.176.61.180:63011] [client 223.176.61.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.176.61.180, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adx5O0pIKZ10weXpf0XX0gAAAAg"]
[Mon Apr 13 13:04:03.656964 2026] [:error] [pid 57183:tid 57204] [client 223.176.61.180:63419] [client 223.176.61.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.176.61.180, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adx5QzDO3t8R5NaxzYQ_mAAAAVM"]
[Mon Apr 13 13:04:13.998870 2026] [:error] [pid 57183:tid 57207] [client 223.176.61.180:63856] [client 223.176.61.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.176.61.180, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adx5TTDO3t8R5NaxzYQ_vAAAAVY"]
[Mon Apr 13 13:04:24.572502 2026] [:error] [pid 7228:tid 7235] [client 223.176.61.180:64250] [client 223.176.61.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.176.61.180, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adx5WAEnn1dQrOSHHNXB6gAAAQU"]
[Mon Apr 13 13:37:04.729355 2026] [:error] [pid 7228:tid 7252] [client 142.93.83.180:57608] [client 142.93.83.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.93.83.180, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adyBAAEnn1dQrOSHHNXaoAAAARY"]
[Mon Apr 13 13:37:05.953329 2026] [:error] [pid 7228:tid 7238] [client 142.93.83.180:57608] [client 142.93.83.180] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.93.83.180, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adyBAQEnn1dQrOSHHNXapwAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Mon Apr 13 16:00:50.075753 2026] [:error] [pid 63406:tid 63425] [client 182.42.105.144:40492] [client 182.42.105.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "adyisrHZEIkQ0Zmgp5rd0AAAAM4"]
[Mon Apr 13 16:22:47.189842 2026] [:error] [pid 63406:tid 63423] [client 217.160.175.86:55836] [client 217.160.175.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.160.175.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adyn17HZEIkQ0Zmgp5r0fQAAAMw"]
[Mon Apr 13 16:22:48.387391 2026] [:error] [pid 63406:tid 63421] [client 217.160.175.86:55836] [client 217.160.175.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.160.175.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adyn2LHZEIkQ0Zmgp5r0hQAAAMo"], referer: https://expressinteriors.com/wp-login.php
[Mon Apr 13 17:20:28.340088 2026] [:error] [pid 7228:tid 7247] [client 65.254.225.233:34586] [client 65.254.225.233] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.233, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ady1XAEnn1dQrOSHHNVcFQAAARE"]
[Mon Apr 13 17:20:30.779185 2026] [:error] [pid 7228:tid 7248] [client 65.254.225.233:34586] [client 65.254.225.233] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.233, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ady1XgEnn1dQrOSHHNVcGAAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon Apr 13 17:40:06.310348 2026] [:error] [pid 63311:tid 63379] [client 212.47.78.118:52356] [client 212.47.78.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ady59qHjrGN1MqBCVFnXPAAAAIg"]
[Mon Apr 13 17:40:06.861371 2026] [:error] [pid 7228:tid 7234] [client 212.47.78.118:50184] [client 212.47.78.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "ady59gEnn1dQrOSHHNViwQAAAQQ"]
[Mon Apr 13 17:40:08.438306 2026] [:error] [pid 63310:tid 63355] [client 212.47.78.118:55521] [client 212.47.78.118] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/media/system/js/core.js"] [unique_id "ady5-HoXpRU5ztmwPjI0XAAAAEs"]
[Mon Apr 13 19:03:56.926507 2026] [:error] [pid 63406:tid 63429] [client 172.213.213.128:62974] [client 172.213.213.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adzNnLHZEIkQ0Zmgp5prLAAAANI"]
[Mon Apr 13 19:03:57.531555 2026] [:error] [pid 63311:tid 63386] [client 172.213.213.128:54852] [client 172.213.213.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adzNnaHjrGN1MqBCVFnrEAAAAI8"]
[Mon Apr 13 19:03:58.251346 2026] [:error] [pid 63406:tid 63421] [client 172.213.213.128:57876] [client 172.213.213.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adzNnrHZEIkQ0Zmgp5prMgAAAMo"]
[Mon Apr 13 19:03:58.883607 2026] [:error] [pid 63406:tid 63429] [client 172.213.213.128:57909] [client 172.213.213.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adzNnrHZEIkQ0Zmgp5prNwAAANI"]
[Mon Apr 13 19:14:00.535664 2026] [:error] [pid 63406:tid 63422] [client 37.9.192.213:49615] [client 37.9.192.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.9.192.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adzP-LHZEIkQ0Zmgp5pw2wAAAMs"]
[Mon Apr 13 19:29:10.184340 2026] [:error] [pid 57183:tid 57197] [client 45.130.202.107:64395] [client 45.130.202.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adzThjDO3t8R5NaxzYQXqgAAAUw"]
[Mon Apr 13 19:29:14.185765 2026] [:error] [pid 57183:tid 57196] [client 45.130.202.71:62163] [client 45.130.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "adzTijDO3t8R5NaxzYQXtAAAAUs"]
[Mon Apr 13 19:29:20.688794 2026] [:error] [pid 63311:tid 63389] [client 45.130.202.74:29419] [client 45.130.202.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "adzTkKHjrGN1MqBCVFnwsAAAAJI"]
[Mon Apr 13 19:29:25.099107 2026] [:error] [pid 57183:tid 57186] [client 45.130.202.76:37459] [client 45.130.202.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "adzTlTDO3t8R5NaxzYQXywAAAUE"]
[Mon Apr 13 19:29:31.955347 2026] [:error] [pid 7228:tid 7247] [client 45.130.202.106:22057] [client 45.130.202.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "adzTmwEnn1dQrOSHHNV_6wAAARE"]
[Mon Apr 13 19:29:34.615798 2026] [:error] [pid 9314:tid 9318] [client 45.130.202.71:48205] [client 45.130.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "adzTnm_r4W8fX2GWyGT8jQAAAYI"]
[Mon Apr 13 19:29:35.809554 2026] [:error] [pid 63311:tid 63372] [client 45.130.202.107:55323] [client 45.130.202.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "adzTn6HjrGN1MqBCVFnwvAAAAIE"]
[Mon Apr 13 19:29:36.917305 2026] [:error] [pid 57183:tid 57195] [client 45.130.202.86:38897] [client 45.130.202.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "adzToDDO3t8R5NaxzYQX5gAAAUo"]
[Mon Apr 13 19:29:38.023580 2026] [:error] [pid 57183:tid 57194] [client 45.130.202.65:33115] [client 45.130.202.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "adzTojDO3t8R5NaxzYQX7wAAAUk"]
[Mon Apr 13 19:29:39.053516 2026] [:error] [pid 9314:tid 9320] [client 45.130.202.65:65469] [client 45.130.202.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "adzTo2_r4W8fX2GWyGT8kwAAAYQ"]
[Mon Apr 13 19:29:40.920187 2026] [:error] [pid 7228:tid 7251] [client 45.130.202.95:44763] [client 45.130.202.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "adzTpAEnn1dQrOSHHNV_8AAAARU"]
[Mon Apr 13 19:29:44.253651 2026] [:error] [pid 63310:tid 63345] [client 45.130.202.85:53365] [client 45.130.202.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "adzTqHoXpRU5ztmwPjJLNwAAAEE"]
[Mon Apr 13 19:29:49.431730 2026] [:error] [pid 63406:tid 63415] [client 45.130.202.68:29469] [client 45.130.202.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "adzTrbHZEIkQ0Zmgp5p61AAAAMQ"]
[Mon Apr 13 19:29:52.146615 2026] [:error] [pid 63310:tid 63346] [client 45.130.202.55:37915] [client 45.130.202.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "adzTsHoXpRU5ztmwPjJLPQAAAEI"]
[Mon Apr 13 19:29:55.270913 2026] [:error] [pid 63309:tid 63325] [client 45.130.202.71:56863] [client 45.130.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "adzTs0pIKZ10weXpf0UcswAAAAw"]
[Mon Apr 13 19:30:01.805929 2026] [:error] [pid 63310:tid 63356] [client 45.130.202.106:55633] [client 45.130.202.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "adzTuXoXpRU5ztmwPjJLRgAAAEw"]
[Mon Apr 13 19:30:04.438049 2026] [:error] [pid 57183:tid 57193] [client 45.130.202.88:40813] [client 45.130.202.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "adzTvDDO3t8R5NaxzYQYbQAAAUg"]
[Mon Apr 13 19:30:09.882697 2026] [:error] [pid 63406:tid 63419] [client 45.130.202.58:54111] [client 45.130.202.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/defaults.php"] [unique_id "adzTwbHZEIkQ0Zmgp5p7CwAAAMg"]
[Mon Apr 13 19:30:12.397988 2026] [:error] [pid 63309:tid 63335] [client 45.130.202.96:59039] [client 45.130.202.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "adzTxEpIKZ10weXpf0UcxAAAABY"]
[Mon Apr 13 19:30:17.468658 2026] [:error] [pid 63406:tid 63431] [client 45.130.202.90:41059] [client 45.130.202.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "adzTybHZEIkQ0Zmgp5p7QAAAANQ"]
[Mon Apr 13 19:30:19.754982 2026] [:error] [pid 63406:tid 63412] [client 45.130.202.109:40855] [client 45.130.202.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "adzTy7HZEIkQ0Zmgp5p7VgAAAME"]
[Mon Apr 13 19:30:22.431924 2026] [:error] [pid 57183:tid 57194] [client 45.130.202.82:34923] [client 45.130.202.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "adzTzjDO3t8R5NaxzYQYggAAAUk"]
[Mon Apr 13 19:30:23.710656 2026] [:error] [pid 57183:tid 57209] [client 45.130.202.71:26385] [client 45.130.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "adzTzzDO3t8R5NaxzYQYhQAAAVg"]
[Mon Apr 13 19:30:24.830846 2026] [:error] [pid 57183:tid 57202] [client 45.130.202.58:24427] [client 45.130.202.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "adzT0DDO3t8R5NaxzYQYiAAAAVE"]
[Mon Apr 13 19:30:29.171491 2026] [:error] [pid 57183:tid 57195] [client 45.130.202.81:55577] [client 45.130.202.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/info.php"] [unique_id "adzT1TDO3t8R5NaxzYQYoQAAAUo"]
[Mon Apr 13 19:30:31.954264 2026] [:error] [pid 7228:tid 7251] [client 45.130.202.56:52215] [client 45.130.202.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class.api.php"] [unique_id "adzT1wEnn1dQrOSHHNWALwAAARU"]
[Mon Apr 13 19:30:33.027303 2026] [:error] [pid 63406:tid 63424] [client 45.130.202.105:46869] [client 45.130.202.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "adzT2bHZEIkQ0Zmgp5p7qgAAAM0"]
[Mon Apr 13 19:30:43.861337 2026] [:error] [pid 63311:tid 63391] [client 45.130.202.109:41329] [client 45.130.202.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/admin.php"] [unique_id "adzT46HjrGN1MqBCVFnxBgAAAJQ"]
[Mon Apr 13 19:30:47.913337 2026] [:error] [pid 63406:tid 63419] [client 45.130.202.82:62581] [client 45.130.202.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.202.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "adzT57HZEIkQ0Zmgp5p70AAAAMg"]
[Mon Apr 13 19:30:58.013594 2026] [:error] [pid 63406:tid 63417] [client 45.130.202.82:62581] [client 45.130.202.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "adzT8rHZEIkQ0Zmgp5p73gAAAMY"]
[Mon Apr 13 19:31:03.337046 2026] [:error] [pid 63406:tid 63419] [client 45.130.202.69:28195] [client 45.130.202.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.202.69, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "adzT97HZEIkQ0Zmgp5p79AAAAMg"]
[Mon Apr 13 19:31:05.019386 2026] [:error] [pid 63406:tid 63430] [client 45.130.202.69:28195] [client 45.130.202.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/item.php"] [unique_id "adzT-bHZEIkQ0Zmgp5p7-AAAANM"]
[Mon Apr 13 19:31:12.998166 2026] [:error] [pid 57183:tid 57188] [client 45.130.202.86:37243] [client 45.130.202.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "adzUADDO3t8R5NaxzYQZWgAAAUM"]
[Mon Apr 13 19:31:21.762143 2026] [:error] [pid 7228:tid 7253] [client 45.130.202.63:52925] [client 45.130.202.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "adzUCQEnn1dQrOSHHNWAhgAAARc"]
[Mon Apr 13 19:31:26.194212 2026] [:error] [pid 63406:tid 63419] [client 45.130.202.55:63759] [client 45.130.202.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "adzUDrHZEIkQ0Zmgp5p8PgAAAMg"]
[Mon Apr 13 19:31:31.273904 2026] [:error] [pid 9314:tid 9325] [client 45.130.202.68:51939] [client 45.130.202.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.202.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-login.php"] [unique_id "adzUE2_r4W8fX2GWyGT94QAAAYk"]
[Mon Apr 13 19:31:32.161681 2026] [:error] [pid 9314:tid 9327] [client 45.130.202.68:51939] [client 45.130.202.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "adzUFG_r4W8fX2GWyGT95AAAAYs"]
[Mon Apr 13 19:31:48.570683 2026] [:error] [pid 63406:tid 63413] [client 45.130.202.78:32349] [client 45.130.202.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "adzUJLHZEIkQ0Zmgp5p8mgAAAMI"]
[Mon Apr 13 19:31:52.856196 2026] [:error] [pid 63406:tid 63428] [client 45.130.202.87:30199] [client 45.130.202.87] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.202.87, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "adzUKLHZEIkQ0Zmgp5p8pgAAANE"]
[Mon Apr 13 19:31:56.170009 2026] [:error] [pid 63406:tid 63424] [client 45.130.202.87:30199] [client 45.130.202.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "adzULLHZEIkQ0Zmgp5p8vAAAAM0"]
[Mon Apr 13 19:31:58.617564 2026] [:error] [pid 7228:tid 7254] [client 45.130.202.63:39849] [client 45.130.202.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/infi.php"] [unique_id "adzULgEnn1dQrOSHHNWAvgAAARg"]
[Mon Apr 13 19:32:01.865218 2026] [:error] [pid 63406:tid 63413] [client 45.130.202.60:29437] [client 45.130.202.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "adzUMbHZEIkQ0Zmgp5p85wAAAMI"]
[Mon Apr 13 19:32:06.134246 2026] [:error] [pid 63311:tid 63388] [client 45.130.202.102:60909] [client 45.130.202.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "adzUNqHjrGN1MqBCVFnxRgAAAJE"]
[Mon Apr 13 19:32:06.691027 2026] [:error] [pid 63309:tid 63328] [client 45.130.202.109:31613] [client 45.130.202.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "adzUNkpIKZ10weXpf0Uc-gAAAA8"]
[Mon Apr 13 19:32:13.161406 2026] [:error] [pid 63406:tid 63426] [client 45.130.202.75:41261] [client 45.130.202.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "adzUPbHZEIkQ0Zmgp5p9KgAAAM8"]
[Mon Apr 13 19:32:15.594876 2026] [:error] [pid 63309:tid 63317] [client 45.130.202.74:51693] [client 45.130.202.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "adzUP0pIKZ10weXpf0UdAAAAAAQ"]
[Mon Apr 13 19:32:19.830182 2026] [:error] [pid 57183:tid 57200] [client 45.130.202.68:51805] [client 45.130.202.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/edit.php"] [unique_id "adzUQzDO3t8R5NaxzYQaBgAAAU8"]
[Mon Apr 13 19:32:24.298392 2026] [:error] [pid 63406:tid 63414] [client 45.130.202.54:55587] [client 45.130.202.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "adzUSLHZEIkQ0Zmgp5p9UQAAAMM"]
[Mon Apr 13 19:32:27.776015 2026] [:error] [pid 63310:tid 63345] [client 45.130.202.107:43507] [client 45.130.202.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/click.php"] [unique_id "adzUS3oXpRU5ztmwPjJL5gAAAEE"]
[Mon Apr 13 19:32:32.643621 2026] [:error] [pid 57183:tid 57207] [client 45.130.202.104:31357] [client 45.130.202.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "adzUUDDO3t8R5NaxzYQaOAAAAVY"]
[Mon Apr 13 19:32:40.424431 2026] [:error] [pid 63406:tid 63419] [client 45.130.202.84:53515] [client 45.130.202.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "adzUWLHZEIkQ0Zmgp5p9jgAAAMg"]
[Mon Apr 13 19:32:40.946034 2026] [:error] [pid 57183:tid 57204] [client 45.130.202.80:50785] [client 45.130.202.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/xl2023.php"] [unique_id "adzUWDDO3t8R5NaxzYQaVAAAAVM"]
[Mon Apr 13 19:32:41.533669 2026] [:error] [pid 57183:tid 57194] [client 45.130.202.80:65367] [client 45.130.202.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "adzUWTDO3t8R5NaxzYQaXgAAAUk"]
[Mon Apr 13 19:32:43.328787 2026] [:error] [pid 63406:tid 63432] [client 45.130.202.55:47739] [client 45.130.202.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "adzUW7HZEIkQ0Zmgp5p9mgAAANU"]
[Mon Apr 13 19:32:46.992972 2026] [:error] [pid 7228:tid 7241] [client 45.130.202.79:63721] [client 45.130.202.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "adzUXgEnn1dQrOSHHNWA7gAAAQs"]
[Mon Apr 13 19:32:49.386668 2026] [:error] [pid 63406:tid 63414] [client 45.130.202.61:44465] [client 45.130.202.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "adzUYbHZEIkQ0Zmgp5p9wQAAAMM"]
[Mon Apr 13 19:32:54.428517 2026] [:error] [pid 7228:tid 7249] [client 45.130.202.93:40097] [client 45.130.202.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "adzUZgEnn1dQrOSHHNWA-QAAARM"]
[Mon Apr 13 19:32:55.658666 2026] [:error] [pid 63406:tid 63434] [client 45.130.202.65:24733] [client 45.130.202.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "adzUZ7HZEIkQ0Zmgp5p95wAAANc"]
[Mon Apr 13 19:32:56.741475 2026] [:error] [pid 9314:tid 9330] [client 45.130.202.77:22223] [client 45.130.202.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "adzUaG_r4W8fX2GWyGT-xAAAAY4"]
[Mon Apr 13 19:32:58.064589 2026] [:error] [pid 9314:tid 9319] [client 45.130.202.59:48751] [client 45.130.202.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "adzUam_r4W8fX2GWyGT-ygAAAYM"]
[Mon Apr 13 19:33:00.685254 2026] [:error] [pid 9314:tid 9328] [client 45.130.202.56:38895] [client 45.130.202.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "adzUbG_r4W8fX2GWyGT-2gAAAYw"]
[Mon Apr 13 19:33:02.212895 2026] [proxy_fcgi:error] [pid 57183:tid 57197] [client 45.130.202.102:35351] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function add_action() in /home/expressi/public_html/wp-content/plugins/hello.php:69\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/plugins/hello.php on line 69'
[Mon Apr 13 19:33:04.692557 2026] [:error] [pid 9314:tid 9338] [client 45.130.202.109:49943] [client 45.130.202.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "adzUcG_r4W8fX2GWyGT-4gAAAZY"]
[Mon Apr 13 19:33:11.275723 2026] [:error] [pid 57183:tid 57197] [client 45.130.202.67:29833] [client 45.130.202.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "adzUdzDO3t8R5NaxzYQalgAAAUw"]
[Mon Apr 13 19:33:18.527720 2026] [:error] [pid 9314:tid 9332] [client 45.130.202.97:62531] [client 45.130.202.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/file.php"] [unique_id "adzUfm_r4W8fX2GWyGT-_AAAAZA"]
[Mon Apr 13 19:33:22.665961 2026] [:error] [pid 63309:tid 63313] [client 45.130.202.77:25683] [client 45.130.202.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "adzUgkpIKZ10weXpf0UdKAAAAAA"]
[Mon Apr 13 19:33:24.891169 2026] [:error] [pid 9314:tid 9334] [client 45.130.202.91:21731] [client 45.130.202.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "adzUhG_r4W8fX2GWyGT_BgAAAZI"]
[Mon Apr 13 19:33:29.647920 2026] [:error] [pid 63406:tid 63426] [client 45.130.202.93:33495] [client 45.130.202.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "adzUibHZEIkQ0Zmgp5p-fQAAAM8"]
[Mon Apr 13 19:33:34.366446 2026] [proxy_fcgi:error] [pid 7228:tid 7250] [client 45.130.202.108:60601] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 19:33:34.641291 2026] [proxy_fcgi:error] [pid 7228:tid 7231] [client 45.130.202.108:60601] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 19:33:35.269335 2026] [proxy_fcgi:error] [pid 7228:tid 7240] [client 45.130.202.108:60601] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 19:33:39.822514 2026] [:error] [pid 7228:tid 7241] [client 45.130.202.108:60601] [client 45.130.202.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "adzUkwEnn1dQrOSHHNWBTgAAAQs"]
[Mon Apr 13 19:33:41.014890 2026] [:error] [pid 63310:tid 63347] [client 45.130.202.72:37807] [client 45.130.202.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "adzUlXoXpRU5ztmwPjJMBQAAAEM"]
[Mon Apr 13 19:33:42.049008 2026] [:error] [pid 63406:tid 63426] [client 45.130.202.67:58699] [client 45.130.202.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "adzUlrHZEIkQ0Zmgp5p-pAAAAM8"]
[Mon Apr 13 19:33:43.408637 2026] [:error] [pid 63406:tid 63423] [client 45.130.202.69:27295] [client 45.130.202.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "adzUl7HZEIkQ0Zmgp5p-rgAAAMw"]
[Mon Apr 13 19:33:45.788322 2026] [:error] [pid 57183:tid 57209] [client 45.130.202.55:60699] [client 45.130.202.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "adzUmTDO3t8R5NaxzYQa2gAAAVg"]
[Mon Apr 13 19:33:47.715845 2026] [:error] [pid 57183:tid 57201] [client 45.130.202.104:45187] [client 45.130.202.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "adzUmzDO3t8R5NaxzYQa3gAAAVA"]
[Mon Apr 13 19:33:50.126810 2026] [:error] [pid 9314:tid 9329] [client 45.130.202.90:41305] [client 45.130.202.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "adzUnm_r4W8fX2GWyGT_NAAAAY0"]
[Mon Apr 13 19:33:52.172251 2026] [:error] [pid 57183:tid 57209] [client 45.130.202.79:60279] [client 45.130.202.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "adzUoDDO3t8R5NaxzYQa5wAAAVg"]
[Mon Apr 13 19:33:52.706386 2026] [:error] [pid 57183:tid 57206] [client 45.130.202.78:56385] [client 45.130.202.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "adzUoDDO3t8R5NaxzYQa6wAAAVU"]
[Mon Apr 13 19:33:53.233491 2026] [:error] [pid 63310:tid 63348] [client 45.130.202.85:24971] [client 45.130.202.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "adzUoXoXpRU5ztmwPjJMCgAAAEQ"]
[Mon Apr 13 19:33:56.082067 2026] [:error] [pid 63311:tid 63389] [client 45.130.202.62:35243] [client 45.130.202.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "adzUpKHjrGN1MqBCVFnxowAAAJI"]
[Mon Apr 13 19:33:58.364073 2026] [:error] [pid 57183:tid 57194] [client 45.130.202.109:22813] [client 45.130.202.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "adzUpjDO3t8R5NaxzYQbCwAAAUk"]
[Mon Apr 13 19:34:01.787649 2026] [:error] [pid 63406:tid 63421] [client 45.130.202.87:28697] [client 45.130.202.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "adzUqbHZEIkQ0Zmgp5p-_AAAAMo"]
[Mon Apr 13 19:34:06.007408 2026] [:error] [pid 63406:tid 63425] [client 45.130.202.73:21089] [client 45.130.202.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/about.php"] [unique_id "adzUrrHZEIkQ0Zmgp5p_EQAAAM4"]
[Mon Apr 13 19:34:10.235904 2026] [:error] [pid 63310:tid 63363] [client 45.130.202.87:57879] [client 45.130.202.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "adzUsnoXpRU5ztmwPjJMFQAAAFM"]
[Mon Apr 13 19:34:16.077246 2026] [:error] [pid 63311:tid 63387] [client 45.130.202.107:57459] [client 45.130.202.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "adzUuKHjrGN1MqBCVFnxrgAAAJA"]
[Mon Apr 13 19:34:18.639517 2026] [:error] [pid 63406:tid 63417] [client 45.130.202.100:53683] [client 45.130.202.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-class.php"] [unique_id "adzUurHZEIkQ0Zmgp5p_RAAAAMY"]
[Mon Apr 13 19:34:35.383857 2026] [:error] [pid 63309:tid 63313] [client 45.130.202.94:51701] [client 45.130.202.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "adzUy0pIKZ10weXpf0UdUAAAAAA"]
[Mon Apr 13 19:34:36.449845 2026] [:error] [pid 63311:tid 63371] [client 45.130.202.68:61183] [client 45.130.202.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "adzUzKHjrGN1MqBCVFnxvAAAAIA"]
[Mon Apr 13 19:34:40.248873 2026] [:error] [pid 7228:tid 7241] [client 45.130.202.94:60915] [client 45.130.202.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "adzU0AEnn1dQrOSHHNWBjQAAAQs"]
[Mon Apr 13 19:34:42.880567 2026] [:error] [pid 57183:tid 57193] [client 45.130.202.88:61719] [client 45.130.202.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "adzU0jDO3t8R5NaxzYQbeAAAAUg"]
[Mon Apr 13 19:34:44.490361 2026] [:error] [pid 7228:tid 7243] [client 45.130.202.78:32859] [client 45.130.202.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "adzU1AEnn1dQrOSHHNWBkgAAAQ0"]
[Mon Apr 13 19:34:49.910135 2026] [:error] [pid 63309:tid 63329] [client 45.130.202.100:39759] [client 45.130.202.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adzU2UpIKZ10weXpf0UdWgAAABA"]
[Mon Apr 13 19:34:51.312168 2026] [:error] [pid 63406:tid 63419] [client 45.130.202.68:36795] [client 45.130.202.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "adzU27HZEIkQ0Zmgp5p_hQAAAMg"]
[Mon Apr 13 19:34:56.825060 2026] [:error] [pid 63311:tid 63388] [client 45.130.202.102:42415] [client 45.130.202.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "adzU4KHjrGN1MqBCVFnx4gAAAJE"]
[Mon Apr 13 19:34:59.392672 2026] [proxy_fcgi:error] [pid 57183:tid 57195] [client 45.130.202.94:27683] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 19:35:00.479145 2026] [:error] [pid 57183:tid 57205] [client 45.130.202.94:27683] [client 45.130.202.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/function.php"] [unique_id "adzU5DDO3t8R5NaxzYQbwQAAAVQ"]
[Mon Apr 13 19:35:01.636602 2026] [:error] [pid 57183:tid 57200] [client 45.130.202.55:42979] [client 45.130.202.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/plugins.php"] [unique_id "adzU5TDO3t8R5NaxzYQbxAAAAU8"]
[Mon Apr 13 19:35:05.104376 2026] [:error] [pid 57183:tid 57187] [client 45.130.202.97:56773] [client 45.130.202.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "adzU6TDO3t8R5NaxzYQb0wAAAUI"]
[Mon Apr 13 19:35:08.132030 2026] [:error] [pid 63309:tid 63336] [client 45.130.202.93:20595] [client 45.130.202.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "adzU7EpIKZ10weXpf0UdXAAAABc"]
[Mon Apr 13 19:35:16.081096 2026] [:error] [pid 57183:tid 57198] [client 45.130.202.67:61623] [client 45.130.202.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/atomlib.php"] [unique_id "adzU9DDO3t8R5NaxzYQb7gAAAU0"]
[Mon Apr 13 19:35:17.684979 2026] [:error] [pid 63309:tid 63329] [client 45.130.202.65:49887] [client 45.130.202.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "adzU9UpIKZ10weXpf0UdZAAAABA"]
[Mon Apr 13 19:35:23.798430 2026] [:error] [pid 63406:tid 63425] [client 45.130.202.101:58311] [client 45.130.202.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "adzU-7HZEIkQ0Zmgp5p_2AAAAM4"]
[Mon Apr 13 19:35:24.898281 2026] [:error] [pid 57183:tid 57188] [client 45.130.202.80:32797] [client 45.130.202.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "adzU_DDO3t8R5NaxzYQcCgAAAUM"]
[Mon Apr 13 19:35:26.207297 2026] [:error] [pid 63310:tid 63368] [client 45.130.202.76:38657] [client 45.130.202.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "adzU_noXpRU5ztmwPjJMNAAAAFg"]
[Mon Apr 13 19:35:33.081904 2026] [:error] [pid 63406:tid 63427] [client 45.130.202.101:26381] [client 45.130.202.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "adzVBbHZEIkQ0Zmgp5p_9gAAANA"]
[Mon Apr 13 19:35:36.291099 2026] [:error] [pid 7228:tid 7234] [client 45.130.202.109:52899] [client 45.130.202.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "adzVCAEnn1dQrOSHHNWBzgAAAQQ"]
[Mon Apr 13 19:35:42.903713 2026] [:error] [pid 9314:tid 9328] [client 45.130.202.65:31917] [client 45.130.202.65] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.202.65, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/js/wp-login.php"] [unique_id "adzVDm_r4W8fX2GWyGT_oQAAAYw"]
[Mon Apr 13 19:35:47.838499 2026] [:error] [pid 9314:tid 9331] [client 45.130.202.65:31917] [client 45.130.202.65] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.202.65, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "adzVE2_r4W8fX2GWyGT_rQAAAY8"]
[Mon Apr 13 19:35:57.023622 2026] [proxy_fcgi:error] [pid 9314:tid 9321] [client 45.130.202.65:31917] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 19:36:08.890257 2026] [:error] [pid 9314:tid 9318] [client 45.130.202.65:31917] [client 45.130.202.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/about.php"] [unique_id "adzVKG_r4W8fX2GWyGT_5gAAAYI"]
[Mon Apr 13 19:36:12.980920 2026] [:error] [pid 7228:tid 7247] [client 45.130.202.91:60135] [client 45.130.202.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "adzVLAEnn1dQrOSHHNWCBQAAARE"]
[Mon Apr 13 19:36:16.173322 2026] [:error] [pid 63406:tid 63433] [client 45.130.202.100:35683] [client 45.130.202.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/atomlib.php"] [unique_id "adzVMLHZEIkQ0Zmgp5qAUQAAANY"]
[Mon Apr 13 19:36:25.836893 2026] [:error] [pid 63406:tid 63427] [client 45.130.202.76:30315] [client 45.130.202.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "adzVObHZEIkQ0Zmgp5qAhwAAANA"]
[Mon Apr 13 19:36:29.188887 2026] [:error] [pid 63406:tid 63416] [client 45.130.202.78:58225] [client 45.130.202.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "adzVPbHZEIkQ0Zmgp5qAkQAAAMU"]
[Mon Apr 13 19:36:31.651301 2026] [:error] [pid 63406:tid 63434] [client 45.130.202.59:53771] [client 45.130.202.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "adzVP7HZEIkQ0Zmgp5qAlwAAANc"]
[Mon Apr 13 19:36:36.584014 2026] [proxy_fcgi:error] [pid 63311:tid 63382] [client 45.130.202.65:30759] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 19:36:36.835870 2026] [proxy_fcgi:error] [pid 63311:tid 63378] [client 45.130.202.65:30759] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 19:36:38.207969 2026] [:error] [pid 63311:tid 63393] [client 45.130.202.65:30759] [client 45.130.202.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "adzVRqHjrGN1MqBCVFnyNgAAAJY"]
[Mon Apr 13 19:36:39.484955 2026] [:error] [pid 7228:tid 7236] [client 45.130.202.75:32787] [client 45.130.202.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "adzVRwEnn1dQrOSHHNWCCwAAAQY"]
[Mon Apr 13 19:36:46.748900 2026] [:error] [pid 63406:tid 63411] [client 45.130.202.91:58703] [client 45.130.202.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/default.php"] [unique_id "adzVTrHZEIkQ0Zmgp5qAzwAAAMA"]
[Mon Apr 13 19:36:49.074086 2026] [:error] [pid 63406:tid 63431] [client 45.130.202.91:45819] [client 45.130.202.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "adzVUbHZEIkQ0Zmgp5qA3AAAANQ"]
[Mon Apr 13 19:36:53.120868 2026] [:error] [pid 63406:tid 63427] [client 45.130.202.74:62647] [client 45.130.202.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "adzVVbHZEIkQ0Zmgp5qA7AAAANA"]
[Mon Apr 13 19:37:00.312765 2026] [:error] [pid 63406:tid 63435] [client 45.130.202.97:57361] [client 45.130.202.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "adzVXLHZEIkQ0Zmgp5qBCAAAANg"]
[Mon Apr 13 19:37:00.959668 2026] [proxy_fcgi:error] [pid 63311:tid 63384] [client 45.130.202.97:26499] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 19:37:04.496051 2026] [:error] [pid 63311:tid 63371] [client 45.130.202.97:26499] [client 45.130.202.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "adzVYKHjrGN1MqBCVFnyTgAAAIA"]
[Mon Apr 13 19:37:10.035839 2026] [proxy_fcgi:error] [pid 9314:tid 9332] [client 45.130.202.107:47831] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 19:37:11.117077 2026] [:error] [pid 9314:tid 9329] [client 45.130.202.107:47831] [client 45.130.202.107] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.202.107, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "adzVZ2_r4W8fX2GWyGQAOQAAAY0"]
[Mon Apr 13 19:37:15.337613 2026] [:error] [pid 9314:tid 9323] [client 45.130.202.107:47831] [client 45.130.202.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "adzVa2_r4W8fX2GWyGQARwAAAYc"]
[Mon Apr 13 19:37:17.807066 2026] [:error] [pid 9314:tid 9332] [client 45.130.202.57:20495] [client 45.130.202.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "adzVbW_r4W8fX2GWyGQAUgAAAZA"]
[Mon Apr 13 19:37:22.599599 2026] [:error] [pid 63406:tid 63428] [client 45.130.202.81:29087] [client 45.130.202.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "adzVcrHZEIkQ0Zmgp5qBYAAAANE"]
[Mon Apr 13 19:37:26.022309 2026] [:error] [pid 57183:tid 57202] [client 45.130.202.105:36057] [client 45.130.202.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "adzVdjDO3t8R5NaxzYQdGAAAAVE"]
[Mon Apr 13 19:37:27.099439 2026] [:error] [pid 63406:tid 63429] [client 45.130.202.60:47471] [client 45.130.202.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "adzVd7HZEIkQ0Zmgp5qBewAAANI"]
[Mon Apr 13 19:37:31.743308 2026] [:error] [pid 63406:tid 63413] [client 45.130.202.101:44059] [client 45.130.202.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-feed-index.php"] [unique_id "adzVe7HZEIkQ0Zmgp5qBmgAAAMI"]
[Mon Apr 13 19:37:35.138443 2026] [proxy_fcgi:error] [pid 63311:tid 63375] [client 45.130.202.58:53773] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 19:37:35.388911 2026] [:error] [pid 63311:tid 63395] [client 45.130.202.58:53773] [client 45.130.202.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "adzVf6HjrGN1MqBCVFnyaQAAAJg"]
[Mon Apr 13 19:37:36.514047 2026] [proxy_fcgi:error] [pid 57183:tid 57189] [client 45.130.202.80:27461] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function add_action() in /home/expressi/public_html/wp-content/themes/twentytwentyfour/functions.php:147\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/themes/twentytwentyfour/functions.php on line 147'
[Mon Apr 13 19:37:37.578876 2026] [:error] [pid 63311:tid 63393] [client 45.130.202.108:63141] [client 45.130.202.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/db.php"] [unique_id "adzVgaHjrGN1MqBCVFnycAAAAJY"]
[Mon Apr 13 19:37:38.648601 2026] [:error] [pid 9314:tid 9333] [client 45.130.202.93:45987] [client 45.130.202.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "adzVgm_r4W8fX2GWyGQAgQAAAZE"]
[Mon Apr 13 19:37:39.843974 2026] [:error] [pid 7228:tid 7230] [client 45.130.202.95:60921] [client 45.130.202.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "adzVgwEnn1dQrOSHHNWCMAAAAQA"]
[Mon Apr 13 19:37:40.895940 2026] [:error] [pid 63406:tid 63414] [client 45.130.202.100:24721] [client 45.130.202.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "adzVhLHZEIkQ0Zmgp5qBrwAAAMM"]
[Mon Apr 13 19:37:42.204041 2026] [:error] [pid 57183:tid 57201] [client 45.130.202.103:27535] [client 45.130.202.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "adzVhjDO3t8R5NaxzYQdUgAAAVA"]
[Mon Apr 13 19:37:43.234450 2026] [:error] [pid 63406:tid 63432] [client 45.130.202.79:43139] [client 45.130.202.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "adzVh7HZEIkQ0Zmgp5qBugAAANU"]
[Mon Apr 13 19:37:46.677960 2026] [:error] [pid 9314:tid 9337] [client 45.130.202.87:62813] [client 45.130.202.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "adzVim_r4W8fX2GWyGQAjQAAAZU"]
[Mon Apr 13 19:37:48.510123 2026] [:error] [pid 7228:tid 7244] [client 45.130.202.64:24197] [client 45.130.202.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "adzVjAEnn1dQrOSHHNWCNwAAAQ4"]
[Mon Apr 13 19:37:49.913187 2026] [:error] [pid 63311:tid 63394] [client 45.130.202.68:44731] [client 45.130.202.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "adzVjaHjrGN1MqBCVFnyjwAAAJc"]
[Mon Apr 13 19:37:51.016083 2026] [:error] [pid 63310:tid 63345] [client 45.130.202.108:61885] [client 45.130.202.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "adzVj3oXpRU5ztmwPjJMdgAAAEE"]
[Mon Apr 13 19:37:52.111967 2026] [:error] [pid 63311:tid 63375] [client 45.130.202.60:52149] [client 45.130.202.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/options.php"] [unique_id "adzVkKHjrGN1MqBCVFnylQAAAIQ"]
[Mon Apr 13 19:37:54.870104 2026] [proxy_fcgi:error] [pid 63310:tid 63348] [client 45.130.202.96:64307] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 19:37:57.238850 2026] [:error] [pid 63310:tid 63360] [client 45.130.202.96:64307] [client 45.130.202.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.202.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "adzVlXoXpRU5ztmwPjJMfQAAAFA"]
[Mon Apr 13 19:38:01.546392 2026] [:error] [pid 63310:tid 63365] [client 45.130.202.96:64307] [client 45.130.202.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/goto.php"] [unique_id "adzVmXoXpRU5ztmwPjJMgwAAAFU"]
[Mon Apr 13 19:38:17.584686 2026] [:error] [pid 9314:tid 9339] [client 45.130.202.100:64803] [client 45.130.202.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "adzVqW_r4W8fX2GWyGQA2QAAAZc"]
[Mon Apr 13 19:38:20.469671 2026] [:error] [pid 7228:tid 7232] [client 45.130.202.54:53323] [client 45.130.202.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "adzVrAEnn1dQrOSHHNWCbQAAAQI"]
[Mon Apr 13 19:38:22.205980 2026] [:error] [pid 7228:tid 7235] [client 45.130.202.101:59163] [client 45.130.202.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "adzVrgEnn1dQrOSHHNWCdAAAAQU"]
[Mon Apr 13 19:38:29.873742 2026] [:error] [pid 63406:tid 63427] [client 45.130.202.96:61481] [client 45.130.202.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "adzVtbHZEIkQ0Zmgp5qCFwAAANA"]
[Mon Apr 13 19:38:31.990520 2026] [:error] [pid 57183:tid 57188] [client 45.130.202.58:33415] [client 45.130.202.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "adzVtzDO3t8R5NaxzYQdyAAAAUM"]
[Mon Apr 13 19:38:34.150697 2026] [:error] [pid 57183:tid 57195] [client 45.130.202.54:57515] [client 45.130.202.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "adzVujDO3t8R5NaxzYQd1QAAAUo"]
[Mon Apr 13 19:38:39.973957 2026] [:error] [pid 63309:tid 63332] [client 45.130.202.71:47781] [client 45.130.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "adzVv0pIKZ10weXpf0Ud9gAAABM"]
[Mon Apr 13 19:38:43.220336 2026] [:error] [pid 63406:tid 63420] [client 45.130.202.69:53461] [client 45.130.202.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "adzVw7HZEIkQ0Zmgp5qCNwAAAMk"]
[Mon Apr 13 19:38:47.766154 2026] [:error] [pid 57183:tid 57189] [client 45.130.202.77:60149] [client 45.130.202.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "adzVxzDO3t8R5NaxzYQd9AAAAUQ"]
[Mon Apr 13 19:38:59.387148 2026] [:error] [pid 63310:tid 63350] [client 45.130.202.90:36411] [client 45.130.202.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/index.php"] [unique_id "adzV03oXpRU5ztmwPjJNAgAAAEY"]
[Mon Apr 13 19:39:03.125660 2026] [:error] [pid 7228:tid 7251] [client 45.130.202.68:56317] [client 45.130.202.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/about.php"] [unique_id "adzV1wEnn1dQrOSHHNWCpwAAARU"]
[Mon Apr 13 19:39:10.983064 2026] [:error] [pid 63406:tid 63429] [client 45.130.202.86:41303] [client 45.130.202.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-sup.php"] [unique_id "adzV3rHZEIkQ0Zmgp5qCjQAAANI"]
[Mon Apr 13 19:39:14.819125 2026] [:error] [pid 7228:tid 7247] [client 45.130.202.80:47037] [client 45.130.202.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "adzV4gEnn1dQrOSHHNWCtQAAARE"]
[Mon Apr 13 19:39:21.734645 2026] [:error] [pid 57183:tid 57204] [client 45.130.202.82:53287] [client 45.130.202.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "adzV6TDO3t8R5NaxzYQeNgAAAVM"]
[Mon Apr 13 19:39:28.693572 2026] [:error] [pid 63311:tid 63380] [client 45.130.202.88:51691] [client 45.130.202.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "adzV8KHjrGN1MqBCVFny6gAAAIk"]
[Mon Apr 13 19:39:33.006917 2026] [:error] [pid 7228:tid 7245] [client 45.130.202.103:64365] [client 45.130.202.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "adzV9QEnn1dQrOSHHNWCzQAAAQ8"]
[Mon Apr 13 19:39:35.649650 2026] [:error] [pid 9314:tid 9337] [client 45.130.202.101:45667] [client 45.130.202.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "adzV92_r4W8fX2GWyGQBXAAAAZU"]
[Mon Apr 13 19:39:42.366409 2026] [:error] [pid 63311:tid 63382] [client 45.130.202.108:46057] [client 45.130.202.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "adzV_qHjrGN1MqBCVFny-AAAAIs"]
[Mon Apr 13 19:39:48.932163 2026] [:error] [pid 63310:tid 63350] [client 45.130.202.69:62311] [client 45.130.202.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine-session.php"] [unique_id "adzWBHoXpRU5ztmwPjJNOgAAAEY"]
[Mon Apr 13 19:39:54.635696 2026] [:error] [pid 9314:tid 9325] [client 45.130.202.71:58595] [client 45.130.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "adzWCm_r4W8fX2GWyGQBfgAAAYk"]
[Mon Apr 13 19:39:57.759788 2026] [:error] [pid 9314:tid 9321] [client 45.130.202.96:65435] [client 45.130.202.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "adzWDW_r4W8fX2GWyGQBgwAAAYU"]
[Mon Apr 13 19:40:01.262008 2026] [:error] [pid 63406:tid 63428] [client 45.130.202.68:50523] [client 45.130.202.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "adzWEbHZEIkQ0Zmgp5qCpgAAANE"]
[Mon Apr 13 19:40:06.249351 2026] [:error] [pid 9314:tid 9320] [client 45.130.202.108:64805] [client 45.130.202.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/install.php"] [unique_id "adzWFm_r4W8fX2GWyGQBlAAAAYQ"]
[Mon Apr 13 19:40:08.284126 2026] [:error] [pid 63311:tid 63379] [client 45.130.202.74:53649] [client 45.130.202.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "adzWGKHjrGN1MqBCVFnzJgAAAIg"]
[Mon Apr 13 19:40:17.075881 2026] [:error] [pid 57183:tid 57201] [client 45.130.202.108:63039] [client 45.130.202.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/category-double.php"] [unique_id "adzWITDO3t8R5NaxzYQeaAAAAVA"]
[Mon Apr 13 19:40:21.211550 2026] [:error] [pid 57183:tid 57189] [client 45.130.202.82:55777] [client 45.130.202.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/db.php"] [unique_id "adzWJTDO3t8R5NaxzYQecwAAAUQ"]
[Mon Apr 13 19:40:23.473409 2026] [:error] [pid 57183:tid 57197] [client 45.130.202.64:38031] [client 45.130.202.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/security.php"] [unique_id "adzWJzDO3t8R5NaxzYQegwAAAUw"]
[Mon Apr 13 19:40:28.886864 2026] [:error] [pid 63310:tid 63362] [client 45.130.202.84:47753] [client 45.130.202.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "adzWLHoXpRU5ztmwPjJNVgAAAFI"]
[Mon Apr 13 19:40:32.234298 2026] [:error] [pid 7228:tid 7236] [client 45.130.202.87:54867] [client 45.130.202.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "adzWMAEnn1dQrOSHHNWDFQAAAQY"]
[Mon Apr 13 19:40:39.081129 2026] [:error] [pid 63406:tid 63419] [client 45.130.202.60:53395] [client 45.130.202.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "adzWN7HZEIkQ0Zmgp5qC7wAAAMg"]
[Mon Apr 13 19:40:43.344431 2026] [:error] [pid 63310:tid 63352] [client 45.130.202.77:29111] [client 45.130.202.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "adzWO3oXpRU5ztmwPjJNXAAAAEg"]
[Mon Apr 13 19:40:48.112500 2026] [:error] [pid 7228:tid 7252] [client 45.130.202.86:47273] [client 45.130.202.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "adzWQAEnn1dQrOSHHNWDLgAAARY"]
[Mon Apr 13 19:40:51.552183 2026] [:error] [pid 57183:tid 57198] [client 45.130.202.68:54129] [client 45.130.202.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/as.php"] [unique_id "adzWQzDO3t8R5NaxzYQevwAAAU0"]
[Mon Apr 13 19:40:54.356404 2026] [:error] [pid 63309:tid 63332] [client 45.130.202.76:22727] [client 45.130.202.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "adzWRkpIKZ10weXpf0UeOgAAABM"]
[Mon Apr 13 19:40:55.685843 2026] [:error] [pid 63311:tid 63389] [client 45.130.202.61:61221] [client 45.130.202.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/install.php"] [unique_id "adzWR6HjrGN1MqBCVFnzXwAAAJI"]
[Mon Apr 13 19:40:56.976861 2026] [:error] [pid 63406:tid 63414] [client 45.130.202.65:63517] [client 45.130.202.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/db.php"] [unique_id "adzWSLHZEIkQ0Zmgp5qDGAAAAMM"]
[Mon Apr 13 19:41:04.548026 2026] [:error] [pid 63406:tid 63426] [client 45.130.202.108:21191] [client 45.130.202.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "adzWULHZEIkQ0Zmgp5qDNgAAAM8"]
[Mon Apr 13 19:41:08.870805 2026] [:error] [pid 63311:tid 63390] [client 45.130.202.78:55789] [client 45.130.202.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rk2.php"] [unique_id "adzWVKHjrGN1MqBCVFnzeQAAAJM"]
[Mon Apr 13 19:41:12.800780 2026] [:error] [pid 63310:tid 63344] [client 45.130.202.90:44605] [client 45.130.202.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/past.php"] [unique_id "adzWWHoXpRU5ztmwPjJNiwAAAEA"]
[Mon Apr 13 19:41:17.369315 2026] [:error] [pid 63406:tid 63424] [client 45.130.202.76:37543] [client 45.130.202.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/edit-tags.php"] [unique_id "adzWXbHZEIkQ0Zmgp5qDZQAAAM0"]
[Mon Apr 13 19:41:23.049647 2026] [:error] [pid 7228:tid 7248] [client 45.130.202.97:21511] [client 45.130.202.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "adzWYwEnn1dQrOSHHNWDRwAAARI"]
[Mon Apr 13 19:41:25.459603 2026] [:error] [pid 57183:tid 57208] [client 45.130.202.106:60665] [client 45.130.202.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "adzWZTDO3t8R5NaxzYQfAQAAAVc"]
[Mon Apr 13 19:41:29.200589 2026] [:error] [pid 9314:tid 9338] [client 45.130.202.82:61277] [client 45.130.202.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "adzWaW_r4W8fX2GWyGQB6QAAAZY"]
[Mon Apr 13 19:41:32.490116 2026] [:error] [pid 63406:tid 63413] [client 45.130.202.85:50011] [client 45.130.202.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "adzWbLHZEIkQ0Zmgp5qDuwAAAMI"]
[Mon Apr 13 19:41:43.327166 2026] [:error] [pid 9314:tid 9335] [client 45.130.202.90:37919] [client 45.130.202.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "adzWd2_r4W8fX2GWyGQB_wAAAZM"]
[Mon Apr 13 19:41:44.685847 2026] [:error] [pid 9314:tid 9321] [client 45.130.202.94:25299] [client 45.130.202.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "adzWeG_r4W8fX2GWyGQCAQAAAYU"]
[Mon Apr 13 19:41:48.972681 2026] [:error] [pid 63310:tid 63363] [client 45.130.202.79:40791] [client 45.130.202.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "adzWfHoXpRU5ztmwPjJNwgAAAFM"]
[Mon Apr 13 19:41:50.076981 2026] [:error] [pid 63406:tid 63421] [client 45.130.202.57:31557] [client 45.130.202.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "adzWfrHZEIkQ0Zmgp5qD8AAAAMo"]
[Mon Apr 13 19:41:54.690970 2026] [:error] [pid 57183:tid 57186] [client 45.130.202.71:55719] [client 45.130.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "adzWgjDO3t8R5NaxzYQfVwAAAUE"]
[Mon Apr 13 19:41:55.865505 2026] [:error] [pid 7228:tid 7253] [client 45.130.202.95:52635] [client 45.130.202.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ms-file.php"] [unique_id "adzWgwEnn1dQrOSHHNWDfAAAARc"]
[Mon Apr 13 19:41:57.167366 2026] [:error] [pid 63406:tid 63416] [client 45.130.202.85:21017] [client 45.130.202.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.202.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "adzWhbHZEIkQ0Zmgp5qECQAAAMU"]
[Mon Apr 13 19:41:57.170498 2026] [proxy_fcgi:error] [pid 63406:tid 63416] [client 45.130.202.85:21017] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 19:41:57.597034 2026] [:error] [pid 63406:tid 63412] [client 45.130.202.85:21017] [client 45.130.202.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/av.php"] [unique_id "adzWhbHZEIkQ0Zmgp5qEDQAAAME"]
[Mon Apr 13 19:42:00.674412 2026] [:error] [pid 63406:tid 63418] [client 45.130.202.106:63903] [client 45.130.202.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "adzWiLHZEIkQ0Zmgp5qEJgAAAMc"]
[Mon Apr 13 19:42:02.220576 2026] [:error] [pid 63311:tid 63373] [client 45.130.202.86:21151] [client 45.130.202.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/network.php"] [unique_id "adzWiqHjrGN1MqBCVFnz_wAAAII"]
[Mon Apr 13 19:42:10.311995 2026] [:error] [pid 7228:tid 7241] [client 45.130.202.68:57905] [client 45.130.202.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "adzWkgEnn1dQrOSHHNWDjQAAAQs"]
[Mon Apr 13 19:42:11.381662 2026] [:error] [pid 57183:tid 57200] [client 45.130.202.90:44773] [client 45.130.202.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/item.php"] [unique_id "adzWkzDO3t8R5NaxzYQfdwAAAU8"]
[Mon Apr 13 19:42:14.033516 2026] [:error] [pid 57183:tid 57194] [client 45.130.202.101:22559] [client 45.130.202.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "adzWljDO3t8R5NaxzYQfgwAAAUk"]
[Mon Apr 13 19:42:15.330989 2026] [:error] [pid 63406:tid 63428] [client 45.130.202.96:65513] [client 45.130.202.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/install.php"] [unique_id "adzWl7HZEIkQ0Zmgp5qEZAAAANE"]
[Mon Apr 13 19:42:16.149210 2026] [proxy_fcgi:error] [pid 9314:tid 9325] [client 45.130.202.74:43265] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 19:42:16.392121 2026] [:error] [pid 9314:tid 9316] [client 45.130.202.74:43265] [client 45.130.202.74] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.202.74, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "adzWmG_r4W8fX2GWyGQCIAAAAYA"]
[Mon Apr 13 19:42:18.485537 2026] [:error] [pid 9314:tid 9318] [client 45.130.202.74:43265] [client 45.130.202.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "adzWmm_r4W8fX2GWyGQCJgAAAYI"]
[Mon Apr 13 19:42:23.388391 2026] [:error] [pid 9314:tid 9336] [client 45.130.202.87:39417] [client 45.130.202.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "adzWn2_r4W8fX2GWyGQCMAAAAZQ"]
[Mon Apr 13 19:42:26.492929 2026] [:error] [pid 63406:tid 63433] [client 45.130.202.102:30379] [client 45.130.202.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/1.php"] [unique_id "adzWorHZEIkQ0Zmgp5qEpwAAANY"]
[Mon Apr 13 19:42:30.078260 2026] [:error] [pid 63311:tid 63379] [client 45.130.202.106:58271] [client 45.130.202.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "adzWpqHjrGN1MqBCVFn0EQAAAIg"]
[Mon Apr 13 19:42:35.026690 2026] [:error] [pid 63406:tid 63435] [client 45.130.202.68:56801] [client 45.130.202.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "adzWq7HZEIkQ0Zmgp5qEzQAAANg"]
[Mon Apr 13 19:42:39.307776 2026] [:error] [pid 9314:tid 9319] [client 45.130.202.102:27301] [client 45.130.202.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "adzWr2_r4W8fX2GWyGQCYgAAAYM"]
[Mon Apr 13 19:42:44.389015 2026] [:error] [pid 57183:tid 57200] [client 45.130.202.82:26159] [client 45.130.202.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "adzWtDDO3t8R5NaxzYQftQAAAU8"]
[Mon Apr 13 19:42:45.530434 2026] [:error] [pid 9314:tid 9318] [client 45.130.202.95:61743] [client 45.130.202.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bypass.php"] [unique_id "adzWtW_r4W8fX2GWyGQCdwAAAYI"]
[Mon Apr 13 19:42:47.922803 2026] [:error] [pid 63310:tid 63351] [client 45.130.202.89:65177] [client 45.130.202.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/count.php"] [unique_id "adzWt3oXpRU5ztmwPjJN1wAAAEc"]
[Mon Apr 13 19:42:55.819673 2026] [:error] [pid 57183:tid 57186] [client 45.130.202.63:46317] [client 45.130.202.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "adzWvzDO3t8R5NaxzYQf0gAAAUE"]
[Mon Apr 13 19:42:59.516015 2026] [:error] [pid 9314:tid 9331] [client 45.130.202.58:27971] [client 45.130.202.58] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "expressinteriors.com"] [uri "/images/stories/themes.php"] [unique_id "adzWw2_r4W8fX2GWyGQCqAAAAY8"]
[Mon Apr 13 19:42:59.804364 2026] [:error] [pid 9314:tid 9340] [client 45.130.202.58:27971] [client 45.130.202.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "adzWw2_r4W8fX2GWyGQCqQAAAZg"]
[Mon Apr 13 19:43:03.447006 2026] [:error] [pid 57183:tid 57200] [client 45.130.202.90:59409] [client 45.130.202.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "adzWxzDO3t8R5NaxzYQf9QAAAU8"]
[Mon Apr 13 19:43:04.611202 2026] [:error] [pid 63406:tid 63428] [client 45.130.202.71:35463] [client 45.130.202.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/vars-soap.php"] [unique_id "adzWyLHZEIkQ0Zmgp5qFEgAAANE"]
[Mon Apr 13 19:43:11.735277 2026] [:error] [pid 9314:tid 9316] [client 45.130.202.88:34833] [client 45.130.202.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "adzWz2_r4W8fX2GWyGQCxAAAAYA"]
[Mon Apr 13 19:43:17.198307 2026] [:error] [pid 63310:tid 63353] [client 45.130.202.55:49111] [client 45.130.202.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "adzW1XoXpRU5ztmwPjJN5wAAAEk"]
[Mon Apr 13 19:43:20.635120 2026] [:error] [pid 63406:tid 63426] [client 45.130.202.105:55743] [client 45.130.202.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "adzW2LHZEIkQ0Zmgp5qFZQAAAM8"]
[Mon Apr 13 19:43:28.097107 2026] [:error] [pid 63406:tid 63435] [client 45.130.202.58:31609] [client 45.130.202.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "adzW4LHZEIkQ0Zmgp5qFjAAAANg"]
[Mon Apr 13 19:43:29.748453 2026] [:error] [pid 57183:tid 57192] [client 45.130.202.100:30617] [client 45.130.202.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/colour.php"] [unique_id "adzW4TDO3t8R5NaxzYQgFgAAAUc"]
[Mon Apr 13 19:43:32.686693 2026] [:error] [pid 63406:tid 63432] [client 45.130.202.108:43623] [client 45.130.202.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "adzW5LHZEIkQ0Zmgp5qFlwAAANU"]
[Mon Apr 13 19:43:33.952948 2026] [:error] [pid 63310:tid 63352] [client 45.130.202.65:24499] [client 45.130.202.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/include.php"] [unique_id "adzW5XoXpRU5ztmwPjJN7gAAAEg"]
[Mon Apr 13 19:43:37.397064 2026] [:error] [pid 57183:tid 57189] [client 45.130.202.64:45781] [client 45.130.202.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "adzW6TDO3t8R5NaxzYQgLQAAAUQ"]
[Mon Apr 13 19:43:40.754822 2026] [:error] [pid 57183:tid 57187] [client 45.130.202.60:24975] [client 45.130.202.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "adzW7DDO3t8R5NaxzYQgOgAAAUI"]
[Mon Apr 13 19:43:41.906381 2026] [:error] [pid 9314:tid 9340] [client 45.130.202.78:28375] [client 45.130.202.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about5.php"] [unique_id "adzW7W_r4W8fX2GWyGQC8wAAAZg"]
[Mon Apr 13 19:43:47.321377 2026] [:error] [pid 57183:tid 57199] [client 45.130.202.76:31377] [client 45.130.202.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/db.php"] [unique_id "adzW8zDO3t8R5NaxzYQgSwAAAU4"]
[Mon Apr 13 19:43:50.509093 2026] [:error] [pid 63311:tid 63373] [client 45.130.202.106:50093] [client 45.130.202.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "adzW9qHjrGN1MqBCVFn0WQAAAII"]
[Mon Apr 13 19:43:55.674062 2026] [:error] [pid 9314:tid 9332] [client 45.130.202.105:20843] [client 45.130.202.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "adzW-2_r4W8fX2GWyGQDGgAAAZA"]
[Mon Apr 13 19:43:56.716245 2026] [:error] [pid 63406:tid 63433] [client 45.130.202.64:49799] [client 45.130.202.64] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "adzW_LHZEIkQ0Zmgp5qF5AAAANY"]
[Mon Apr 13 19:43:57.917960 2026] [:error] [pid 57183:tid 57204] [client 45.130.202.58:51691] [client 45.130.202.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "adzW_TDO3t8R5NaxzYQgdAAAAVM"]
[Mon Apr 13 19:44:02.353576 2026] [:error] [pid 63311:tid 63375] [client 45.130.202.93:65389] [client 45.130.202.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "adzXAqHjrGN1MqBCVFn0bwAAAIQ"]
[Mon Apr 13 19:44:06.172628 2026] [:error] [pid 63406:tid 63422] [client 45.130.202.89:52413] [client 45.130.202.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "adzXBrHZEIkQ0Zmgp5qGDQAAAMs"]
[Mon Apr 13 19:44:07.280646 2026] [:error] [pid 63406:tid 63428] [client 45.130.202.54:43351] [client 45.130.202.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/about.php"] [unique_id "adzXB7HZEIkQ0Zmgp5qGFgAAANE"]
[Mon Apr 13 19:44:09.717035 2026] [:error] [pid 63406:tid 63430] [client 45.130.202.89:36079] [client 45.130.202.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/about.php"] [unique_id "adzXCbHZEIkQ0Zmgp5qGLAAAANM"]
[Mon Apr 13 19:44:10.704811 2026] [:error] [pid 57183:tid 57205] [client 45.130.202.65:40817] [client 45.130.202.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/simi.php"] [unique_id "adzXCjDO3t8R5NaxzYQgowAAAVQ"]
[Mon Apr 13 19:44:14.143452 2026] [:error] [pid 63309:tid 63318] [client 45.130.202.54:39149] [client 45.130.202.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "adzXDkpIKZ10weXpf0UeqgAAAAU"]
[Mon Apr 13 19:44:15.954774 2026] [:error] [pid 63406:tid 63425] [client 45.130.202.55:64757] [client 45.130.202.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "adzXD7HZEIkQ0Zmgp5qGOQAAAM4"]
[Mon Apr 13 19:44:18.207828 2026] [:error] [pid 9314:tid 9320] [client 45.130.202.74:38463] [client 45.130.202.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "adzXEm_r4W8fX2GWyGQDOAAAAYQ"]
[Mon Apr 13 19:44:19.398643 2026] [:error] [pid 57183:tid 57185] [client 45.130.202.62:35981] [client 45.130.202.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "adzXEzDO3t8R5NaxzYQgxQAAAUA"]
[Mon Apr 13 19:44:22.980675 2026] [:error] [pid 63406:tid 63422] [client 45.130.202.72:38747] [client 45.130.202.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "adzXFrHZEIkQ0Zmgp5qGUQAAAMs"]
[Mon Apr 13 19:44:31.219313 2026] [:error] [pid 63311:tid 63381] [client 45.130.202.63:26077] [client 45.130.202.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "adzXH6HjrGN1MqBCVFn0twAAAIo"]
[Mon Apr 13 19:44:35.257550 2026] [:error] [pid 7228:tid 7248] [client 45.130.202.94:25315] [client 45.130.202.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "adzXIwEnn1dQrOSHHNWEIAAAARI"]
[Mon Apr 13 19:44:36.978846 2026] [proxy_fcgi:error] [pid 63406:tid 63434] [client 45.130.202.95:61361] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_locale() in /home/expressi/public_html/wp-admin/includes/admin.php:16\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-admin/includes/admin.php on line 16'
[Mon Apr 13 19:44:38.034567 2026] [:error] [pid 9314:tid 9328] [client 45.130.202.73:55775] [client 45.130.202.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "adzXJm_r4W8fX2GWyGQDZAAAAYw"]
[Mon Apr 13 19:44:46.400833 2026] [:error] [pid 63406:tid 63430] [client 45.130.202.54:31605] [client 45.130.202.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/plugin.php"] [unique_id "adzXLrHZEIkQ0Zmgp5qGnAAAANM"]
[Mon Apr 13 19:44:48.201115 2026] [:error] [pid 57183:tid 57187] [client 45.130.202.107:46621] [client 45.130.202.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "adzXMDDO3t8R5NaxzYQhAgAAAUI"]
[Mon Apr 13 19:44:51.678098 2026] [:error] [pid 63406:tid 63429] [client 45.130.202.63:59613] [client 45.130.202.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "adzXM7HZEIkQ0Zmgp5qGtAAAANI"]
[Mon Apr 13 19:44:57.402469 2026] [:error] [pid 57183:tid 57190] [client 45.130.202.102:53125] [client 45.130.202.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "adzXOTDO3t8R5NaxzYQhLQAAAUU"]
[Mon Apr 13 19:45:00.730350 2026] [:error] [pid 63406:tid 63427] [client 45.130.202.67:39853] [client 45.130.202.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/litespeed.php"] [unique_id "adzXPLHZEIkQ0Zmgp5qG6wAAANA"]
[Mon Apr 13 19:45:04.988038 2026] [:error] [pid 9314:tid 9331] [client 45.130.202.90:40307] [client 45.130.202.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "adzXQG_r4W8fX2GWyGQDigAAAY8"]
[Mon Apr 13 19:45:08.083245 2026] [:error] [pid 9314:tid 9319] [client 45.130.202.83:64139] [client 45.130.202.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "adzXRG_r4W8fX2GWyGQDjgAAAYM"]
[Mon Apr 13 19:45:11.270699 2026] [:error] [pid 63406:tid 63427] [client 45.130.202.69:50307] [client 45.130.202.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "adzXR7HZEIkQ0Zmgp5qG_QAAANA"]
[Mon Apr 13 19:45:18.258732 2026] [:error] [pid 63310:tid 63344] [client 45.130.202.89:55881] [client 45.130.202.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "adzXTnoXpRU5ztmwPjJOEQAAAEA"]
[Mon Apr 13 19:45:23.287928 2026] [:error] [pid 63311:tid 63385] [client 45.130.202.58:64269] [client 45.130.202.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "adzXU6HjrGN1MqBCVFn1CwAAAI4"]
[Mon Apr 13 19:45:24.963561 2026] [proxy_fcgi:error] [pid 63309:tid 63331] [client 45.130.202.104:38085] AH01071: Got error 'Primary script unknown'
[Mon Apr 13 19:45:49.995479 2026] [autoindex:error] [pid 7228:tid 7252] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:45:52.208811 2026] [autoindex:error] [pid 7228:tid 7249] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:45:58.609866 2026] [autoindex:error] [pid 7228:tid 7235] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:45:59.809584 2026] [autoindex:error] [pid 7228:tid 7230] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:04.181305 2026] [autoindex:error] [pid 7228:tid 7241] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:04.511714 2026] [autoindex:error] [pid 7228:tid 7240] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:06.040957 2026] [autoindex:error] [pid 7228:tid 7251] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:06.377718 2026] [autoindex:error] [pid 7228:tid 7249] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:06.689516 2026] [autoindex:error] [pid 7228:tid 7238] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:07.838248 2026] [autoindex:error] [pid 7228:tid 7236] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:08.206470 2026] [autoindex:error] [pid 7228:tid 7250] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:08.513189 2026] [autoindex:error] [pid 7228:tid 7246] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:11.160721 2026] [autoindex:error] [pid 7228:tid 7245] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:11.643587 2026] [autoindex:error] [pid 7228:tid 7241] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:11.983717 2026] [autoindex:error] [pid 7228:tid 7233] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:14.810200 2026] [autoindex:error] [pid 7228:tid 7242] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:15.146448 2026] [autoindex:error] [pid 7228:tid 7239] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:15.489984 2026] [autoindex:error] [pid 7228:tid 7234] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:15.771837 2026] [autoindex:error] [pid 7228:tid 7251] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:16.083061 2026] [autoindex:error] [pid 7228:tid 7249] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:16.420623 2026] [autoindex:error] [pid 7228:tid 7235] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:17.588670 2026] [autoindex:error] [pid 7228:tid 7248] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:17.856690 2026] [autoindex:error] [pid 7228:tid 7250] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:20.858426 2026] [autoindex:error] [pid 7228:tid 7233] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:23.059215 2026] [autoindex:error] [pid 7228:tid 7250] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:23.336015 2026] [autoindex:error] [pid 7228:tid 7246] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:23.603448 2026] [autoindex:error] [pid 7228:tid 7244] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:26.565370 2026] [autoindex:error] [pid 7228:tid 7253] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:26.929680 2026] [autoindex:error] [pid 7228:tid 7239] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:29.977456 2026] [autoindex:error] [pid 7228:tid 7237] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:31.342848 2026] [autoindex:error] [pid 7228:tid 7245] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:32.439370 2026] [autoindex:error] [pid 7228:tid 7252] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:32.711646 2026] [autoindex:error] [pid 7228:tid 7241] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentythree/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:33.039411 2026] [autoindex:error] [pid 7228:tid 7253] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:33.493022 2026] [autoindex:error] [pid 7228:tid 7240] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:33.795485 2026] [autoindex:error] [pid 7228:tid 7239] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:35.959156 2026] [autoindex:error] [pid 7228:tid 7244] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:38.085469 2026] [autoindex:error] [pid 7228:tid 7245] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:38.361464 2026] [autoindex:error] [pid 7228:tid 7252] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:42.874784 2026] [autoindex:error] [pid 7228:tid 7243] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:44.011927 2026] [autoindex:error] [pid 7228:tid 7245] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:46.702089 2026] [autoindex:error] [pid 7228:tid 7243] [client 91.217.249.44:48201] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:48.493494 2026] [autoindex:error] [pid 7228:tid 7234] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:48.774087 2026] [autoindex:error] [pid 7228:tid 7251] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:49.100410 2026] [autoindex:error] [pid 7228:tid 7243] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:49.414666 2026] [autoindex:error] [pid 7228:tid 7247] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:49.790844 2026] [autoindex:error] [pid 7228:tid 7238] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:50.069138 2026] [autoindex:error] [pid 7228:tid 7250] [client 91.217.249.44:48201] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentytwo/assets/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:56.436544 2026] [autoindex:error] [pid 57183:tid 57203] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:56.745278 2026] [autoindex:error] [pid 57183:tid 57195] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:57.074430 2026] [autoindex:error] [pid 57183:tid 57205] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:57.353795 2026] [autoindex:error] [pid 57183:tid 57196] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:57.674800 2026] [autoindex:error] [pid 57183:tid 57197] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/calendar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:46:58.953734 2026] [autoindex:error] [pid 57183:tid 57207] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:01.166358 2026] [autoindex:error] [pid 57183:tid 57191] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/05/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:02.966446 2026] [autoindex:error] [pid 57183:tid 57187] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:03.255120 2026] [autoindex:error] [pid 57183:tid 57199] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:03.860695 2026] [autoindex:error] [pid 57183:tid 57193] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:04.191270 2026] [autoindex:error] [pid 57183:tid 57198] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:04.806311 2026] [autoindex:error] [pid 57183:tid 57188] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:09.586897 2026] [autoindex:error] [pid 57183:tid 57208] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:12.609148 2026] [autoindex:error] [pid 57183:tid 57189] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:13.017955 2026] [autoindex:error] [pid 57183:tid 57207] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:14.216559 2026] [autoindex:error] [pid 57183:tid 57190] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:19.306409 2026] [autoindex:error] [pid 57183:tid 57188] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:19.581130 2026] [autoindex:error] [pid 57183:tid 57202] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:20.375000 2026] [autoindex:error] [pid 57183:tid 57190] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:20.653793 2026] [autoindex:error] [pid 57183:tid 57200] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:25.198743 2026] [autoindex:error] [pid 57183:tid 57188] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:28.671909 2026] [autoindex:error] [pid 57183:tid 57200] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:33.187518 2026] [autoindex:error] [pid 57183:tid 57190] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:40.028652 2026] [autoindex:error] [pid 57183:tid 57188] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:43.003409 2026] [autoindex:error] [pid 57183:tid 57207] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:43.291553 2026] [autoindex:error] [pid 57183:tid 57193] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:45.782421 2026] [autoindex:error] [pid 57183:tid 57201] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:46.972866 2026] [autoindex:error] [pid 57183:tid 57198] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:47:47.294552 2026] [autoindex:error] [pid 57183:tid 57206] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/classic-editor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:48:00.426580 2026] [autoindex:error] [pid 57183:tid 57187] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:48:02.546505 2026] [autoindex:error] [pid 57183:tid 57192] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/ui/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:48:04.800685 2026] [autoindex:error] [pid 57183:tid 57185] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:48:06.777648 2026] [autoindex:error] [pid 57183:tid 57189] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:48:07.964909 2026] [autoindex:error] [pid 57183:tid 57185] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:48:08.358039 2026] [autoindex:error] [pid 57183:tid 57193] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:48:09.922381 2026] [autoindex:error] [pid 57183:tid 57186] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:48:10.196895 2026] [autoindex:error] [pid 57183:tid 57189] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 19:48:10.540897 2026] [autoindex:error] [pid 57183:tid 57203] [client 91.217.249.45:27053] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 13 20:12:34.272079 2026] [:error] [pid 57183:tid 57197] [client 101.33.55.204:56442] [client 101.33.55.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adzdsjDO3t8R5NaxzYQw3QAAAUw"]
[Mon Apr 13 20:35:56.011927 2026] [:error] [pid 63311:tid 63393] [client 45.229.176.213:5381] [client 45.229.176.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.229.176.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adzjLKHjrGN1MqBCVFkAYAAAAJY"]
[Mon Apr 13 20:36:05.706908 2026] [:error] [pid 63406:tid 63423] [client 45.229.176.213:11779] [client 45.229.176.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.229.176.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adzjNbHZEIkQ0Zmgp5qoIwAAAMw"]
[Mon Apr 13 20:36:16.276777 2026] [:error] [pid 7228:tid 7237] [client 45.229.176.213:26163] [client 45.229.176.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.229.176.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adzjQAEnn1dQrOSHHNWUcAAAAQc"]
[Mon Apr 13 20:36:26.869629 2026] [:error] [pid 9314:tid 9333] [client 45.229.176.213:62629] [client 45.229.176.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.229.176.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adzjSm_r4W8fX2GWyGQXBAAAAZE"]
[Mon Apr 13 20:36:37.490962 2026] [:error] [pid 63311:tid 63372] [client 45.229.176.213:25902] [client 45.229.176.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.229.176.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "adzjVaHjrGN1MqBCVFkAgAAAAIE"]
[Mon Apr 13 20:38:40.801562 2026] [:error] [pid 63406:tid 63414] [client 103.77.107.178:55438] [client 103.77.107.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "adzj0LHZEIkQ0Zmgp5qpNAAAAMM"]
[Mon Apr 13 20:40:18.354365 2026] [:error] [pid 63406:tid 63432] [client 65.254.225.229:48888] [client 65.254.225.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adzkMrHZEIkQ0Zmgp5qqXQAAANU"]
[Mon Apr 13 20:40:19.325183 2026] [:error] [pid 63406:tid 63435] [client 65.254.225.229:48888] [client 65.254.225.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adzkM7HZEIkQ0Zmgp5qqYQAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon Apr 13 20:52:19.282497 2026] [:error] [pid 9314:tid 9317] [client 67.222.38.94:46630] [client 67.222.38.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.222.38.94, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adznA2_r4W8fX2GWyGQc1QAAAYE"]
[Mon Apr 13 20:52:20.459218 2026] [:error] [pid 9314:tid 9332] [client 67.222.38.94:46630] [client 67.222.38.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.222.38.94, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adznBG_r4W8fX2GWyGQc2AAAAZA"], referer: https://expressinteriors.com/wp-login.php
[Mon Apr 13 21:04:07.210108 2026] [:error] [pid 63406:tid 63435] [client 50.87.253.32:53740] [client 50.87.253.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.253.32, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adzpx7HZEIkQ0Zmgp5q5SAAAANg"]
[Mon Apr 13 21:04:08.124338 2026] [:error] [pid 63406:tid 63416] [client 50.87.253.32:53740] [client 50.87.253.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.87.253.32, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adzpyLHZEIkQ0Zmgp5q5TQAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Mon Apr 13 21:57:31.046998 2026] [:error] [pid 63310:tid 63358] [client 35.176.63.104:40918] [client 35.176.63.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.176.63.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adz2S3oXpRU5ztmwPjJraAAAAE4"]
[Mon Apr 13 21:57:32.121754 2026] [:error] [pid 63310:tid 63365] [client 35.176.63.104:40918] [client 35.176.63.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.176.63.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adz2THoXpRU5ztmwPjJragAAAFU"], referer: https://expressinteriors.com/wp-login.php
[Mon Apr 13 22:13:15.790803 2026] [:error] [pid 57183:tid 57207] [client 178.33.251.48:44680] [client 178.33.251.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.33.251.48, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adz5-zDO3t8R5NaxzYRvdgAAAVY"]
[Mon Apr 13 22:13:18.367791 2026] [:error] [pid 57183:tid 57200] [client 178.33.251.48:44680] [client 178.33.251.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.33.251.48, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "adz5_jDO3t8R5NaxzYRveAAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Mon Apr 13 22:25:45.886192 2026] [:error] [pid 63309:tid 63319] [client 180.110.203.108:42118] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "adz86UpIKZ10weXpf0U8awAAAAY"]
[Mon Apr 13 22:53:47.825719 2026] [:error] [pid 63309:tid 63331] [client 183.207.45.113:29282] [client 183.207.45.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.207.45.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad0De0pIKZ10weXpf0VBOgAAABI"]
[Mon Apr 13 23:27:09.742441 2026] [:error] [pid 9314:tid 9321] [client 43.163.206.70:53210] [client 43.163.206.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ad0LTW_r4W8fX2GWyGRh-wAAAYU"]
[Tue Apr 14 01:44:55.619677 2026] [:error] [pid 59915:tid 59989] [client 170.106.84.136:46530] [client 170.106.84.136] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ad0rl4eTNdEemByf99g8agAAAJI"]
[Tue Apr 14 03:59:25.227232 2026] [:error] [pid 19687:tid 19705] [client 74.220.219.97:24014] [client 74.220.219.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.220.219.97, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad1LHWBZImnR12CCWFokXQAAAAk"]
[Tue Apr 14 03:59:26.434987 2026] [:error] [pid 19687:tid 19696] [client 74.220.219.97:24014] [client 74.220.219.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.220.219.97, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad1LHmBZImnR12CCWFokXgAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Tue Apr 14 05:39:49.529662 2026] [:error] [pid 19687:tid 19712] [client 49.51.204.74:49908] [client 49.51.204.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ad1ipWBZImnR12CCWFo4oAAAABA"]
[Tue Apr 14 06:36:56.380022 2026] [:error] [pid 35630:tid 35694] [client 185.82.72.121:44209] [client 185.82.72.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "ad1wCDer0pVFxOiOauWUlgAAAIg"]
[Tue Apr 14 06:37:08.736300 2026] [:error] [pid 35713:tid 35722] [client 185.82.72.195:25499] [client 185.82.72.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "ad1wFK6-hhx6ZepqOSleOQAAAMY"]
[Tue Apr 14 06:37:30.425207 2026] [:error] [pid 37226:tid 37237] [client 185.82.72.161:59135] [client 185.82.72.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "ad1wKpOA5-IQ0IVmQCp35wAAAUk"]
[Tue Apr 14 06:37:44.879929 2026] [:error] [pid 35713:tid 35725] [client 185.82.72.159:37551] [client 185.82.72.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "ad1wOK6-hhx6ZepqOSljZQAAAMk"]
[Tue Apr 14 06:38:04.454044 2026] [autoindex:error] [pid 37226:tid 37247] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:38:12.916697 2026] [autoindex:error] [pid 37226:tid 37235] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:38:41.486590 2026] [autoindex:error] [pid 37226:tid 37241] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:38:45.536719 2026] [autoindex:error] [pid 37226:tid 37239] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:39:10.041520 2026] [autoindex:error] [pid 37226:tid 37233] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:39:10.325060 2026] [autoindex:error] [pid 37226:tid 37251] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:39:18.813178 2026] [autoindex:error] [pid 37226:tid 37229] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:39:19.132590 2026] [autoindex:error] [pid 37226:tid 37242] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:39:19.420403 2026] [autoindex:error] [pid 37226:tid 37229] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:39:22.369740 2026] [autoindex:error] [pid 37226:tid 37244] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:39:22.673930 2026] [autoindex:error] [pid 37226:tid 37243] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:39:22.963526 2026] [autoindex:error] [pid 37226:tid 37248] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:39:27.216390 2026] [autoindex:error] [pid 37226:tid 37251] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:39:27.501733 2026] [autoindex:error] [pid 37226:tid 37230] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:39:27.801092 2026] [autoindex:error] [pid 37226:tid 37248] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:39:43.236363 2026] [autoindex:error] [pid 37226:tid 37230] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:39:43.530749 2026] [autoindex:error] [pid 37226:tid 37244] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:39:43.811502 2026] [autoindex:error] [pid 37226:tid 37242] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:39:44.099983 2026] [autoindex:error] [pid 37226:tid 37234] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:39:44.391963 2026] [autoindex:error] [pid 37226:tid 37236] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:39:44.695762 2026] [autoindex:error] [pid 37226:tid 37245] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:39:47.872956 2026] [autoindex:error] [pid 37226:tid 37238] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:39:48.154310 2026] [autoindex:error] [pid 37226:tid 37246] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:39:57.937048 2026] [autoindex:error] [pid 37226:tid 37236] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:40:07.030190 2026] [autoindex:error] [pid 37226:tid 37245] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:40:07.325656 2026] [autoindex:error] [pid 37226:tid 37243] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:40:07.608529 2026] [autoindex:error] [pid 37226:tid 37230] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:40:16.047428 2026] [autoindex:error] [pid 37226:tid 37228] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:40:16.336098 2026] [autoindex:error] [pid 37226:tid 37235] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:40:23.858067 2026] [autoindex:error] [pid 37226:tid 37229] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:40:28.768983 2026] [autoindex:error] [pid 37226:tid 37237] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:40:32.467612 2026] [autoindex:error] [pid 37226:tid 37246] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:40:32.763029 2026] [autoindex:error] [pid 37226:tid 37239] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentythree/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:40:33.057177 2026] [autoindex:error] [pid 37226:tid 37251] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:40:33.342847 2026] [autoindex:error] [pid 37226:tid 37234] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:40:33.628407 2026] [autoindex:error] [pid 37226:tid 37230] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:40:40.486841 2026] [autoindex:error] [pid 37226:tid 37234] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:40:47.540744 2026] [autoindex:error] [pid 37226:tid 37236] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:40:47.846043 2026] [autoindex:error] [pid 37226:tid 37249] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:40:59.647069 2026] [autoindex:error] [pid 37226:tid 37242] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:02.516136 2026] [autoindex:error] [pid 37226:tid 37247] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:08.120670 2026] [autoindex:error] [pid 37226:tid 37237] [client 185.82.72.174:61401] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:10.600849 2026] [autoindex:error] [pid 37226:tid 37249] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:10.887521 2026] [autoindex:error] [pid 37226:tid 37235] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:11.175990 2026] [autoindex:error] [pid 37226:tid 37237] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:11.463001 2026] [autoindex:error] [pid 37226:tid 37239] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:11.760364 2026] [autoindex:error] [pid 37226:tid 37248] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:12.052026 2026] [autoindex:error] [pid 37226:tid 37245] [client 185.82.72.174:61401] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentytwo/assets/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:25.579759 2026] [autoindex:error] [pid 37048:tid 37054] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:25.863998 2026] [autoindex:error] [pid 37048:tid 37062] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:26.165074 2026] [autoindex:error] [pid 37048:tid 37071] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:26.446051 2026] [autoindex:error] [pid 37048:tid 37065] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:26.726609 2026] [autoindex:error] [pid 37048:tid 37051] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/calendar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:31.599763 2026] [autoindex:error] [pid 37048:tid 37060] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:37.509169 2026] [autoindex:error] [pid 37048:tid 37066] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/05/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:40.808860 2026] [autoindex:error] [pid 37048:tid 37075] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:41.080755 2026] [autoindex:error] [pid 37048:tid 37055] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:41.353449 2026] [autoindex:error] [pid 37048:tid 37064] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:41.635392 2026] [autoindex:error] [pid 37048:tid 37059] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:41.916380 2026] [autoindex:error] [pid 37048:tid 37056] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:41:56.114452 2026] [autoindex:error] [pid 37048:tid 37072] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:42:02.778208 2026] [autoindex:error] [pid 37048:tid 37062] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:42:03.050991 2026] [autoindex:error] [pid 37048:tid 37069] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:42:05.640600 2026] [autoindex:error] [pid 37048:tid 37075] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:42:15.709135 2026] [autoindex:error] [pid 37048:tid 37072] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:42:15.981988 2026] [autoindex:error] [pid 37048:tid 37056] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:42:16.257641 2026] [autoindex:error] [pid 37048:tid 37074] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:42:16.551854 2026] [autoindex:error] [pid 37048:tid 37055] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:42:22.525943 2026] [autoindex:error] [pid 37048:tid 37064] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:42:26.089777 2026] [autoindex:error] [pid 37048:tid 37051] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:42:31.400786 2026] [autoindex:error] [pid 37048:tid 37052] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:42:38.238694 2026] [autoindex:error] [pid 37048:tid 37063] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:42:41.239010 2026] [autoindex:error] [pid 37048:tid 37073] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:42:42.121767 2026] [autoindex:error] [pid 37048:tid 37065] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:42:48.102339 2026] [autoindex:error] [pid 37048:tid 37074] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:42:49.712016 2026] [autoindex:error] [pid 37048:tid 37071] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:42:49.997640 2026] [autoindex:error] [pid 37048:tid 37073] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/classic-editor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:43:10.028423 2026] [autoindex:error] [pid 37048:tid 37073] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:43:13.869894 2026] [autoindex:error] [pid 37048:tid 37070] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/ui/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:43:16.400474 2026] [autoindex:error] [pid 37048:tid 37066] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:43:19.563050 2026] [autoindex:error] [pid 37048:tid 37053] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:43:21.056856 2026] [autoindex:error] [pid 37048:tid 37059] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:43:22.842334 2026] [autoindex:error] [pid 37048:tid 37059] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:43:24.159460 2026] [autoindex:error] [pid 37048:tid 37074] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:43:24.456156 2026] [autoindex:error] [pid 37048:tid 37072] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:43:24.743449 2026] [autoindex:error] [pid 37048:tid 37053] [client 185.82.72.194:28229] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:43:29.810138 2026] [autoindex:error] [pid 37226:tid 37234] [client 185.82.72.171:27591] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/pullquote/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:43:32.871048 2026] [autoindex:error] [pid 37226:tid 37229] [client 185.82.72.171:27591] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/comments-pagination-numbers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:43:43.017380 2026] [autoindex:error] [pid 37226:tid 37251] [client 185.82.72.171:27591] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:43:43.313647 2026] [autoindex:error] [pid 37226:tid 37241] [client 185.82.72.171:27591] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/post-terms/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:43:45.015473 2026] [autoindex:error] [pid 37226:tid 37244] [client 185.82.72.171:27591] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:43:47.190511 2026] [autoindex:error] [pid 37226:tid 37247] [client 185.82.72.171:27591] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/namespaced/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:43:52.272934 2026] [autoindex:error] [pid 37226:tid 37238] [client 185.82.72.171:27591] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:44:00.133943 2026] [autoindex:error] [pid 37226:tid 37250] [client 185.82.72.171:27591] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/site-title/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:44:07.568203 2026] [autoindex:error] [pid 37226:tid 37234] [client 185.82.72.171:27591] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:44:14.587029 2026] [autoindex:error] [pid 37226:tid 37242] [client 185.82.72.171:27591] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 06:44:14.870863 2026] [autoindex:error] [pid 37226:tid 37244] [client 185.82.72.171:27591] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2026/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 14 10:21:12.012822 2026] [:error] [pid 35629:tid 35665] [client 37.9.192.213:49255] [client 37.9.192.213] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ad2kmDY8VahzC1YJBSjKUwAAAEY"]
[Tue Apr 14 10:22:00.047743 2026] [:error] [pid 35713:tid 35736] [client 37.9.192.213:50377] [client 37.9.192.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.9.192.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad2kyK6-hhx6ZepqOSkCpAAAANQ"]
[Tue Apr 14 10:22:33.019440 2026] [:error] [pid 35713:tid 35733] [client 43.156.202.34:55934] [client 43.156.202.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ad2k6a6-hhx6ZepqOSkC_QAAANE"]
[Tue Apr 14 10:23:02.033300 2026] [:error] [pid 37226:tid 37233] [client 37.9.192.213:51829] [client 37.9.192.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.9.192.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad2lBpOA5-IQ0IVmQCrrBQAAAUU"]
[Tue Apr 14 10:24:00.014472 2026] [:error] [pid 35713:tid 35735] [client 37.9.192.213:53068] [client 37.9.192.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.9.192.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad2lQK6-hhx6ZepqOSkEEwAAANM"]
[Tue Apr 14 10:25:02.654756 2026] [:error] [pid 35629:tid 35666] [client 37.9.192.213:54437] [client 37.9.192.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.9.192.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad2lfjY8VahzC1YJBSjKzgAAAEc"]
[Tue Apr 14 10:26:00.996994 2026] [:error] [pid 37226:tid 37230] [client 37.9.192.213:55487] [client 37.9.192.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.9.192.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad2luJOA5-IQ0IVmQCrryQAAAUI"]
[Tue Apr 14 12:49:43.748111 2026] [:error] [pid 37226:tid 37238] [client 43.153.122.30:47836] [client 43.153.122.30] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ad3HZ5OA5-IQ0IVmQCoc-gAAAUo"]
[Tue Apr 14 12:50:43.396320 2026] [:error] [pid 37226:tid 37247] [client 103.93.219.135:55837] [client 103.93.219.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.93.219.135, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad3Ho5OA5-IQ0IVmQCodUQAAAVM"]
[Tue Apr 14 12:51:18.349715 2026] [:error] [pid 37048:tid 37069] [client 114.80.36.40:36962] [client 114.80.36.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ad3Hxp52Bo1OyzeXo_zXvwAAARI"]
[Tue Apr 14 15:54:13.879786 2026] [:error] [pid 60074:tid 60098] [client 117.235.24.24:54708] [client 117.235.24.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.235.24.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad3ypetqnEmNU9vpHCn29QAAANY"]
[Tue Apr 14 15:54:24.318420 2026] [:error] [pid 59986:tid 60027] [client 117.235.24.24:55362] [client 117.235.24.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.235.24.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad3ysJ6axKeW6bX4H7f4agAAAEc"]
[Tue Apr 14 15:54:35.140459 2026] [:error] [pid 60074:tid 60095] [client 117.235.24.24:55869] [client 117.235.24.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.235.24.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad3yu-tqnEmNU9vpHCn3LQAAANM"]
[Tue Apr 14 15:54:45.868661 2026] [:error] [pid 59985:tid 59999] [client 117.235.24.24:56359] [client 117.235.24.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.235.24.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad3yxegHaxkvLE6V1kkYswAAAAY"]
[Tue Apr 14 15:54:56.752476 2026] [:error] [pid 60074:tid 60076] [client 117.235.24.24:56870] [client 117.235.24.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.235.24.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad3y0OtqnEmNU9vpHCn3SwAAAMA"]
[Tue Apr 14 16:08:51.664795 2026] [:error] [pid 60074:tid 60089] [client 196.189.98.186:54864] [client 196.189.98.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.189.98.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad32E-tqnEmNU9vpHCkAuwAAAM0"]
[Tue Apr 14 16:09:01.871276 2026] [:error] [pid 60074:tid 60079] [client 196.189.98.186:55234] [client 196.189.98.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.189.98.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad32HetqnEmNU9vpHCkAxAAAAMM"]
[Tue Apr 14 16:09:12.529571 2026] [:error] [pid 60074:tid 60077] [client 196.189.98.186:55596] [client 196.189.98.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.189.98.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad32KOtqnEmNU9vpHCkA2gAAAME"]
[Tue Apr 14 16:09:23.236800 2026] [:error] [pid 60074:tid 60098] [client 196.189.98.186:55945] [client 196.189.98.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.189.98.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad32M-tqnEmNU9vpHCkBIQAAANY"]
[Tue Apr 14 16:09:34.056962 2026] [:error] [pid 60074:tid 60098] [client 196.189.98.186:56295] [client 196.189.98.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.189.98.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad32PutqnEmNU9vpHCkBOQAAANY"]
[Tue Apr 14 18:17:44.104844 2026] [:error] [pid 59986:tid 60031] [client 152.58.131.16:52578] [client 152.58.131.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.58.131.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad4USJ6axKeW6bX4H7codAAAAEs"]
[Tue Apr 14 18:19:13.118872 2026] [:error] [pid 59987:tid 60050] [client 152.58.131.16:51886] [client 152.58.131.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.58.131.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad4UoVWpk-Tfi6_vLKrzLQAAAIM"]
[Tue Apr 14 18:19:19.785418 2026] [:error] [pid 59985:tid 60002] [client 152.58.131.16:52459] [client 152.58.131.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.58.131.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad4Up-gHaxkvLE6V1klAaAAAAAk"]
[Tue Apr 14 18:19:30.196296 2026] [:error] [pid 60074:tid 60087] [client 152.58.131.16:53300] [client 152.58.131.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.58.131.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad4UsutqnEmNU9vpHClbTQAAAMs"]
[Tue Apr 14 18:19:42.459753 2026] [:error] [pid 59985:tid 60001] [client 152.58.131.16:13507] [client 152.58.131.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.58.131.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad4UvugHaxkvLE6V1klAeQAAAAg"]
[Tue Apr 14 18:54:23.027804 2026] [:error] [pid 59987:tid 60071] [client 103.59.160.151:61222] [client 103.59.160.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.59.160.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad4c31Wpk-Tfi6_vLKr-2QAAAJg"], referer: https://www.google.com/search?q=wordpress+2026
[Tue Apr 14 18:55:12.481682 2026] [:error] [pid 60074:tid 60089] [client 103.59.160.151:55014] [client 103.59.160.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.59.160.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad4dEOtqnEmNU9vpHClxOQAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Tue Apr 14 18:55:47.553382 2026] [:error] [pid 59985:tid 60010] [client 103.59.160.151:62987] [client 103.59.160.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.59.160.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad4dM-gHaxkvLE6V1klIgAAAABE"], referer: https://expressinteriors.com/wp-login.php
[Tue Apr 14 18:56:16.389586 2026] [:error] [pid 22177:tid 22203] [client 103.59.160.151:52198] [client 103.59.160.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.59.160.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad4dUITVeJSXHDIlEDtaoAAAARg"], referer: https://expressinteriors.com/wp-login.php
[Tue Apr 14 18:56:21.279085 2026] [:error] [pid 22177:tid 22197] [client 103.59.160.151:52198] [client 103.59.160.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.59.160.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad4dVYTVeJSXHDIlEDtapAAAARI"], referer: https://expressinteriors.com/wp-login.php
[Tue Apr 14 18:56:21.985012 2026] [:error] [pid 22177:tid 22195] [client 103.59.160.151:52198] [client 103.59.160.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.59.160.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad4dVYTVeJSXHDIlEDtapgAAARA"], referer: https://expressinteriors.com/wp-login.php
[Tue Apr 14 18:56:23.900861 2026] [:error] [pid 22177:tid 22187] [client 103.59.160.151:52198] [client 103.59.160.151] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.59.160.151, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad4dV4TVeJSXHDIlEDtaqwAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Tue Apr 14 19:08:09.887940 2026] [:error] [pid 59987:tid 60071] [client 49.233.45.47:53768] [client 49.233.45.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ad4gGVWpk-Tfi6_vLKoENgAAAJg"]
[Tue Apr 14 21:16:51.428311 2026] [:error] [pid 59986:tid 60032] [client 51.103.118.101:4571] [client 51.103.118.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "ad4-Q56axKeW6bX4H7d6NAAAAEw"]
[Tue Apr 14 21:16:55.230355 2026] [:error] [pid 60074:tid 60087] [client 51.103.118.101:43673] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "ad4-R-tqnEmNU9vpHCmlkAAAAMs"]
[Tue Apr 14 21:17:01.000669 2026] [:error] [pid 3778:tid 3787] [client 51.103.118.101:29663] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "ad4-TBx5DfpNmYF_PaHpGgAAAUc"]
[Tue Apr 14 21:17:04.970141 2026] [:error] [pid 60074:tid 60087] [client 51.103.118.101:31516] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "ad4-UOtqnEmNU9vpHCmlmwAAAMs"]
[Tue Apr 14 21:17:13.378185 2026] [:error] [pid 59987:tid 60063] [client 51.103.118.101:41503] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tiny2.php"] [unique_id "ad4-WVWpk-Tfi6_vLKo2aAAAAJA"]
[Tue Apr 14 21:17:18.070334 2026] [:error] [pid 3810:tid 3837] [client 51.103.118.101:41489] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tiny2.php"] [unique_id "ad4-Xsqc5XaYZhFXVGejuQAAAZg"]
[Tue Apr 14 21:17:19.361647 2026] [:error] [pid 59987:tid 60071] [client 51.103.118.101:34449] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tiny2.php"] [unique_id "ad4-X1Wpk-Tfi6_vLKo2bgAAAJg"]
[Tue Apr 14 21:17:21.567043 2026] [:error] [pid 3810:tid 3830] [client 51.103.118.101:31071] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tiny2.php"] [unique_id "ad4-Ycqc5XaYZhFXVGejxgAAAZE"]
[Tue Apr 14 21:17:23.506880 2026] [:error] [pid 59986:tid 60025] [client 51.103.118.101:4599] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/state.php"] [unique_id "ad4-Y56axKeW6bX4H7d6agAAAEU"]
[Tue Apr 14 21:17:25.801510 2026] [:error] [pid 3810:tid 3818] [client 51.103.118.101:4601] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/state.php"] [unique_id "ad4-Zcqc5XaYZhFXVGej0AAAAYU"]
[Tue Apr 14 21:17:26.966965 2026] [:error] [pid 59987:tid 60070] [client 51.103.118.101:41518] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/state.php"] [unique_id "ad4-ZlWpk-Tfi6_vLKo2iwAAAJc"]
[Tue Apr 14 21:17:28.406735 2026] [:error] [pid 60074:tid 60100] [client 51.103.118.101:4593] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/state.php"] [unique_id "ad4-aOtqnEmNU9vpHCmlqgAAANg"]
[Tue Apr 14 21:17:39.855052 2026] [:error] [pid 59986:tid 60025] [client 51.103.118.101:43670] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "ad4-c56axKeW6bX4H7d6fQAAAEU"]
[Tue Apr 14 21:17:41.946062 2026] [:error] [pid 59986:tid 60026] [client 51.103.118.101:42818] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "ad4-dZ6axKeW6bX4H7d6hAAAAEY"]
[Tue Apr 14 21:17:43.178474 2026] [:error] [pid 3778:tid 3801] [client 51.103.118.101:41483] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "ad4-dxx5DfpNmYF_PaHpQgAAAVU"]
[Tue Apr 14 21:17:45.532415 2026] [:error] [pid 59986:tid 60024] [client 51.103.118.101:42808] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wps.php"] [unique_id "ad4-eZ6axKeW6bX4H7d6iAAAAEQ"]
[Tue Apr 14 21:17:46.600474 2026] [:error] [pid 22177:tid 22184] [client 51.103.118.101:4576] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wps.php"] [unique_id "ad4-eoTVeJSXHDIlEDuICgAAAQU"]
[Tue Apr 14 21:17:50.732343 2026] [:error] [pid 60074:tid 60086] [client 51.103.118.101:39647] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wps.php"] [unique_id "ad4-futqnEmNU9vpHCmlvwAAAMo"]
[Tue Apr 14 21:17:53.934032 2026] [:error] [pid 22177:tid 22185] [client 51.103.118.101:39653] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wps.php"] [unique_id "ad4-gYTVeJSXHDIlEDuIEwAAAQY"]
[Tue Apr 14 21:18:03.253441 2026] [:error] [pid 22177:tid 22191] [client 51.103.118.101:42801] [client 51.103.118.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "ad4-i4TVeJSXHDIlEDuIJgAAAQw"]
[Tue Apr 14 21:18:08.256705 2026] [:error] [pid 59987:tid 60050] [client 51.103.118.101:4581] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "ad4-kFWpk-Tfi6_vLKo3CQAAAIM"]
[Tue Apr 14 21:18:13.506867 2026] [:error] [pid 59987:tid 60062] [client 51.103.118.101:42800] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "ad4-lVWpk-Tfi6_vLKo3EgAAAI8"]
[Tue Apr 14 21:18:15.343129 2026] [:error] [pid 59986:tid 60038] [client 51.103.118.101:4974] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "ad4-l56axKeW6bX4H7d6vQAAAFI"]
[Tue Apr 14 21:18:16.791665 2026] [:error] [pid 59987:tid 60052] [client 51.103.118.101:42794] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "ad4-mFWpk-Tfi6_vLKo3GwAAAIU"]
[Tue Apr 14 21:18:17.772452 2026] [:error] [pid 59985:tid 59998] [client 51.103.118.101:41519] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "ad4-megHaxkvLE6V1klkPAAAAAU"]
[Tue Apr 14 21:18:19.861787 2026] [:error] [pid 59986:tid 60020] [client 51.103.118.101:42759] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "ad4-m56axKeW6bX4H7d6zQAAAEA"]
[Tue Apr 14 21:18:21.496125 2026] [:error] [pid 22177:tid 22183] [client 51.103.118.101:41533] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "ad4-nYTVeJSXHDIlEDuILgAAAQQ"]
[Tue Apr 14 21:18:23.538787 2026] [:error] [pid 59986:tid 60028] [client 51.103.118.101:41528] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "ad4-n56axKeW6bX4H7d62gAAAEg"]
[Tue Apr 14 21:18:24.603317 2026] [:error] [pid 3810:tid 3825] [client 51.103.118.101:34115] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/footer.php"] [unique_id "ad4-oMqc5XaYZhFXVGekPgAAAYw"]
[Tue Apr 14 21:18:26.590895 2026] [:error] [pid 59986:tid 60044] [client 51.103.118.101:37339] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/footer.php"] [unique_id "ad4-op6axKeW6bX4H7d64wAAAFg"]
[Tue Apr 14 21:18:29.718160 2026] [:error] [pid 59985:tid 60007] [client 51.103.118.101:37348] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/footer.php"] [unique_id "ad4-pegHaxkvLE6V1klkRwAAAA4"]
[Tue Apr 14 21:18:33.740710 2026] [:error] [pid 22177:tid 22184] [client 51.103.118.101:39646] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/footer.php"] [unique_id "ad4-qYTVeJSXHDIlEDuIRQAAAQU"]
[Tue Apr 14 21:18:36.739175 2026] [:error] [pid 60074:tid 60090] [client 51.103.118.101:42877] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/img.php"] [unique_id "ad4-rOtqnEmNU9vpHCmmMgAAAM4"]
[Tue Apr 14 21:18:38.115821 2026] [:error] [pid 22177:tid 22194] [client 51.103.118.101:34444] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/img.php"] [unique_id "ad4-roTVeJSXHDIlEDuISQAAAQ8"]
[Tue Apr 14 21:18:39.495850 2026] [:error] [pid 59986:tid 60041] [client 51.103.118.101:41512] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/img.php"] [unique_id "ad4-r56axKeW6bX4H7d6-gAAAFU"]
[Tue Apr 14 21:18:41.317693 2026] [:error] [pid 3810:tid 3818] [client 51.103.118.101:4552] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/img.php"] [unique_id "ad4-scqc5XaYZhFXVGekYQAAAYU"]
[Tue Apr 14 21:18:42.503479 2026] [:error] [pid 59986:tid 60037] [client 51.103.118.101:34465] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "ad4-sp6axKeW6bX4H7d6_QAAAFE"]
[Tue Apr 14 21:18:43.394841 2026] [:error] [pid 3810:tid 3816] [client 51.103.118.101:4598] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "ad4-s8qc5XaYZhFXVGekaQAAAYM"]
[Tue Apr 14 21:18:45.283299 2026] [:error] [pid 59986:tid 60021] [client 51.103.118.101:34130] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "ad4-tZ6axKeW6bX4H7d7AgAAAEE"]
[Tue Apr 14 21:18:46.086560 2026] [:error] [pid 3810:tid 3813] [client 51.103.118.101:39643] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "ad4-tsqc5XaYZhFXVGekawAAAYA"]
[Tue Apr 14 21:18:46.715405 2026] [:error] [pid 3810:tid 3824] [client 51.103.118.101:43038] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "ad4-tsqc5XaYZhFXVGekbwAAAYs"]
[Tue Apr 14 21:18:47.653355 2026] [:error] [pid 59986:tid 60029] [client 51.103.118.101:41485] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "ad4-t56axKeW6bX4H7d7DQAAAEk"]
[Tue Apr 14 21:18:48.357077 2026] [:error] [pid 3778:tid 3787] [client 51.103.118.101:4968] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "ad4-uBx5DfpNmYF_PaHpgQAAAUc"]
[Tue Apr 14 21:18:49.203158 2026] [:error] [pid 60074:tid 60094] [client 51.103.118.101:37352] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "ad4-uetqnEmNU9vpHCmmNwAAANI"]
[Tue Apr 14 21:18:49.987383 2026] [:error] [pid 59985:tid 60013] [client 51.103.118.101:34166] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "ad4-uegHaxkvLE6V1klkXAAAABQ"]
[Tue Apr 14 21:18:51.201344 2026] [:error] [pid 3778:tid 3790] [client 51.103.118.101:42765] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "ad4-uxx5DfpNmYF_PaHphwAAAUo"]
[Tue Apr 14 21:18:52.114400 2026] [:error] [pid 59985:tid 59999] [client 51.103.118.101:46269] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "ad4-vOgHaxkvLE6V1klkXgAAAAY"]
[Tue Apr 14 21:18:52.964875 2026] [:error] [pid 59986:tid 60043] [client 51.103.118.101:41530] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "ad4-vJ6axKeW6bX4H7d7GgAAAFc"]
[Tue Apr 14 21:18:54.328039 2026] [:error] [pid 59986:tid 60037] [client 51.103.118.101:42769] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "ad4-vp6axKeW6bX4H7d7JQAAAFE"]
[Tue Apr 14 21:18:55.051177 2026] [:error] [pid 59986:tid 60031] [client 51.103.118.101:34124] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "ad4-v56axKeW6bX4H7d7KgAAAEs"]
[Tue Apr 14 21:18:55.972364 2026] [:error] [pid 59986:tid 60037] [client 51.103.118.101:45089] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "ad4-v56axKeW6bX4H7d7MQAAAFE"]
[Tue Apr 14 21:18:56.963123 2026] [:error] [pid 59986:tid 60020] [client 51.103.118.101:37373] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "ad4-wJ6axKeW6bX4H7d7NgAAAEA"]
[Tue Apr 14 21:18:59.601258 2026] [:error] [pid 3810:tid 3817] [client 51.103.118.101:37371] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/roksad1.php"] [unique_id "ad4-w8qc5XaYZhFXVGekhgAAAYQ"]
[Tue Apr 14 21:19:22.417176 2026] [:error] [pid 59986:tid 60040] [client 51.103.118.101:33170] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bdktk.php"] [unique_id "ad4-2p6axKeW6bX4H7d7ggAAAFQ"]
[Tue Apr 14 21:19:23.966793 2026] [:error] [pid 59986:tid 60041] [client 51.103.118.101:32377] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bdktk.php"] [unique_id "ad4-256axKeW6bX4H7d7hAAAAFU"]
[Tue Apr 14 21:19:24.933311 2026] [:error] [pid 3810:tid 3828] [client 51.103.118.101:46543] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bdktk.php"] [unique_id "ad4-3Mqc5XaYZhFXVGekogAAAY8"]
[Tue Apr 14 21:19:25.833459 2026] [:error] [pid 3778:tid 3803] [client 51.103.118.101:4188] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bdktk.php"] [unique_id "ad4-3Rx5DfpNmYF_PaHptgAAAVc"]
[Tue Apr 14 21:19:26.571311 2026] [:error] [pid 59987:tid 60057] [client 51.103.118.101:46597] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v5.php"] [unique_id "ad4-3lWpk-Tfi6_vLKo3XwAAAIo"]
[Tue Apr 14 21:19:27.754555 2026] [:error] [pid 3778:tid 3795] [client 51.103.118.101:37558] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v5.php"] [unique_id "ad4-3xx5DfpNmYF_PaHptwAAAU8"]
[Tue Apr 14 21:19:29.043445 2026] [:error] [pid 60074:tid 60085] [client 51.103.118.101:44237] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v5.php"] [unique_id "ad4-4etqnEmNU9vpHCmmggAAAMk"]
[Tue Apr 14 21:19:34.415710 2026] [:error] [pid 22177:tid 22203] [client 51.103.118.101:30146] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v5.php"] [unique_id "ad4-5oTVeJSXHDIlEDuIiQAAARg"]
[Tue Apr 14 21:19:35.154308 2026] [:error] [pid 3778:tid 3783] [client 51.103.118.101:41076] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "ad4-5xx5DfpNmYF_PaHpvgAAAUM"]
[Tue Apr 14 21:19:38.462970 2026] [:error] [pid 3810:tid 3815] [client 51.103.118.101:33092] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "ad4-6sqc5XaYZhFXVGekxwAAAYI"]
[Tue Apr 14 21:19:41.590042 2026] [:error] [pid 59985:tid 60007] [client 51.103.118.101:30237] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "ad4-7egHaxkvLE6V1klkiAAAAA4"]
[Tue Apr 14 21:19:45.879057 2026] [:error] [pid 59987:tid 60071] [client 51.103.118.101:46873] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "ad4-8VWpk-Tfi6_vLKo3aAAAAJg"]
[Tue Apr 14 21:19:46.766633 2026] [:error] [pid 59986:tid 60025] [client 51.103.118.101:41929] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "ad4-8p6axKeW6bX4H7d7pwAAAEU"]
[Tue Apr 14 21:19:48.983269 2026] [:error] [pid 60074:tid 60096] [client 51.103.118.101:40008] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "ad4-9OtqnEmNU9vpHCmmnQAAANQ"]
[Tue Apr 14 21:19:50.267665 2026] [:error] [pid 60074:tid 60098] [client 51.103.118.101:39509] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "ad4-9utqnEmNU9vpHCmmoQAAANY"]
[Tue Apr 14 21:19:51.488805 2026] [:error] [pid 22177:tid 22199] [client 51.103.118.101:43215] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "ad4-94TVeJSXHDIlEDuIlQAAARQ"]
[Tue Apr 14 21:19:53.143688 2026] [:error] [pid 59986:tid 60026] [client 51.103.118.101:40062] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/layout.php"] [unique_id "ad4--Z6axKeW6bX4H7d7xQAAAEY"]
[Tue Apr 14 21:19:55.241856 2026] [:error] [pid 3778:tid 3782] [client 51.103.118.101:35850] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/layout.php"] [unique_id "ad4--xx5DfpNmYF_PaHqJAAAAUI"]
[Tue Apr 14 21:19:56.700364 2026] [:error] [pid 3778:tid 3795] [client 51.103.118.101:4663] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/layout.php"] [unique_id "ad4-_Bx5DfpNmYF_PaHqJgAAAU8"]
[Tue Apr 14 21:20:01.066069 2026] [:error] [pid 3778:tid 3793] [client 51.103.118.101:41895] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/layout.php"] [unique_id "ad4_ARx5DfpNmYF_PaHqLwAAAU0"]
[Tue Apr 14 21:20:06.054484 2026] [:error] [pid 3810:tid 3814] [client 51.103.118.101:37507] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r2.php"] [unique_id "ad4_Bsqc5XaYZhFXVGelFwAAAYE"]
[Tue Apr 14 21:20:11.140990 2026] [:error] [pid 59986:tid 60029] [client 51.103.118.101:33196] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r2.php"] [unique_id "ad4_C56axKeW6bX4H7d77gAAAEk"]
[Tue Apr 14 21:20:14.736793 2026] [:error] [pid 3778:tid 3795] [client 51.103.118.101:41465] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/r2.php"] [unique_id "ad4_Dhx5DfpNmYF_PaHqOQAAAU8"]
[Tue Apr 14 21:20:19.281045 2026] [:error] [pid 3810:tid 3829] [client 51.103.118.101:44348] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "ad4_E8qc5XaYZhFXVGelQgAAAZA"]
[Tue Apr 14 21:20:33.913283 2026] [:error] [pid 3810:tid 3834] [client 51.103.118.101:5070] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ga.php"] [unique_id "ad4_Icqc5XaYZhFXVGelYAAAAZU"]
[Tue Apr 14 21:20:34.904849 2026] [:error] [pid 60074:tid 60096] [client 51.103.118.101:4500] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ga.php"] [unique_id "ad4_IutqnEmNU9vpHCmm1QAAANQ"]
[Tue Apr 14 21:20:36.372144 2026] [:error] [pid 59985:tid 60002] [client 51.103.118.101:42407] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ga.php"] [unique_id "ad4_JOgHaxkvLE6V1klkrgAAAAk"]
[Tue Apr 14 21:20:39.145129 2026] [:error] [pid 3778:tid 3780] [client 51.103.118.101:39917] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ga.php"] [unique_id "ad4_Jxx5DfpNmYF_PaHqhAAAAUA"]
[Tue Apr 14 21:20:39.883510 2026] [:error] [pid 3778:tid 3803] [client 51.103.118.101:39868] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xozx.php"] [unique_id "ad4_Jxx5DfpNmYF_PaHqiAAAAVc"]
[Tue Apr 14 21:20:44.090815 2026] [:error] [pid 3778:tid 3802] [client 51.103.118.101:33626] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xozx.php"] [unique_id "ad4_LBx5DfpNmYF_PaHqmwAAAVY"]
[Tue Apr 14 21:20:44.771311 2026] [:error] [pid 3810:tid 3831] [client 51.103.118.101:40760] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xozx.php"] [unique_id "ad4_LMqc5XaYZhFXVGeldQAAAZI"]
[Tue Apr 14 21:20:46.481028 2026] [:error] [pid 3810:tid 3833] [client 51.103.118.101:37944] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xozx.php"] [unique_id "ad4_Lsqc5XaYZhFXVGelewAAAZQ"]
[Tue Apr 14 21:20:47.920211 2026] [:error] [pid 3810:tid 3836] [client 51.103.118.101:44658] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1100.php"] [unique_id "ad4_L8qc5XaYZhFXVGelfwAAAZc"]
[Tue Apr 14 21:20:50.297032 2026] [:error] [pid 3810:tid 3824] [client 51.103.118.101:44754] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1100.php"] [unique_id "ad4_Msqc5XaYZhFXVGelgwAAAYs"]
[Tue Apr 14 21:20:52.551554 2026] [:error] [pid 3778:tid 3799] [client 51.103.118.101:35794] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1100.php"] [unique_id "ad4_NBx5DfpNmYF_PaHqvgAAAVM"]
[Tue Apr 14 21:20:54.025018 2026] [:error] [pid 3810:tid 3831] [client 51.103.118.101:40742] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1100.php"] [unique_id "ad4_Nsqc5XaYZhFXVGeljwAAAZI"]
[Tue Apr 14 21:21:04.129675 2026] [:error] [pid 3810:tid 3824] [client 51.103.118.101:4443] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "ad4_QMqc5XaYZhFXVGelugAAAYs"]
[Tue Apr 14 21:21:05.953750 2026] [:error] [pid 60074:tid 60077] [client 51.103.118.101:45004] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "ad4_QetqnEmNU9vpHCmm5wAAAME"]
[Tue Apr 14 21:21:08.005423 2026] [:error] [pid 3810:tid 3827] [client 51.103.118.101:40970] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "ad4_RMqc5XaYZhFXVGelyQAAAY4"]
[Tue Apr 14 21:21:08.692869 2026] [:error] [pid 59986:tid 60031] [client 51.103.118.101:5072] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "ad4_RJ6axKeW6bX4H7d8zgAAAEs"]
[Tue Apr 14 21:21:09.375844 2026] [:error] [pid 60074:tid 60091] [client 51.103.118.101:5092] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "ad4_RetqnEmNU9vpHCmm7AAAAM8"]
[Tue Apr 14 21:21:10.071534 2026] [:error] [pid 59986:tid 60034] [client 51.103.118.101:4852] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "ad4_Rp6axKeW6bX4H7d82gAAAE4"]
[Tue Apr 14 21:21:10.981568 2026] [:error] [pid 22177:tid 22185] [client 51.103.118.101:39693] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "ad4_RoTVeJSXHDIlEDuIxwAAAQY"]
[Tue Apr 14 21:21:11.997402 2026] [:error] [pid 60074:tid 60088] [client 51.103.118.101:44658] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "ad4_R-tqnEmNU9vpHCmm9AAAAMw"]
[Tue Apr 14 21:21:12.926875 2026] [:error] [pid 59986:tid 60036] [client 51.103.118.101:4862] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kz.php"] [unique_id "ad4_SJ6axKeW6bX4H7d87AAAAFA"]
[Tue Apr 14 21:21:14.237041 2026] [:error] [pid 60074:tid 60082] [client 51.103.118.101:35796] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kz.php"] [unique_id "ad4_SutqnEmNU9vpHCmm-AAAAMY"]
[Tue Apr 14 21:21:15.313592 2026] [:error] [pid 60074:tid 60095] [client 51.103.118.101:44016] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kz.php"] [unique_id "ad4_S-tqnEmNU9vpHCmm-wAAANM"]
[Tue Apr 14 21:21:16.889150 2026] [:error] [pid 59986:tid 60039] [client 51.103.118.101:5074] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kz.php"] [unique_id "ad4_TJ6axKeW6bX4H7d9AQAAAFM"]
[Tue Apr 14 21:21:17.856955 2026] [:error] [pid 59986:tid 60044] [client 51.103.118.101:44017] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-lo.php"] [unique_id "ad4_TZ6axKeW6bX4H7d9BwAAAFg"]
[Tue Apr 14 21:21:19.055704 2026] [:error] [pid 59986:tid 60034] [client 51.103.118.101:35825] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-lo.php"] [unique_id "ad4_T56axKeW6bX4H7d9EAAAAE4"]
[Tue Apr 14 21:21:24.975926 2026] [:error] [pid 59986:tid 60026] [client 51.103.118.101:43982] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-lo.php"] [unique_id "ad4_VJ6axKeW6bX4H7d9KgAAAEY"]
[Tue Apr 14 21:21:25.994541 2026] [:error] [pid 60074:tid 60095] [client 51.103.118.101:43108] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-lo.php"] [unique_id "ad4_VetqnEmNU9vpHCmnCAAAANM"]
[Tue Apr 14 21:21:29.036977 2026] [:error] [pid 59986:tid 60030] [client 51.103.118.101:41275] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "ad4_WZ6axKeW6bX4H7d9PgAAAEo"]
[Tue Apr 14 21:21:31.896333 2026] [:error] [pid 59986:tid 60024] [client 51.103.118.101:40733] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "ad4_W56axKeW6bX4H7d9TgAAAEQ"]
[Tue Apr 14 21:21:45.055028 2026] [:error] [pid 3810:tid 3816] [client 51.103.118.101:45199] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x3x.php"] [unique_id "ad4_acqc5XaYZhFXVGemJgAAAYM"]
[Tue Apr 14 21:21:46.680640 2026] [:error] [pid 60074:tid 60082] [client 51.103.118.101:35464] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x3x.php"] [unique_id "ad4_autqnEmNU9vpHCmnGwAAAMY"]
[Tue Apr 14 21:21:49.150519 2026] [:error] [pid 59986:tid 60028] [client 51.103.118.101:35230] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x3x.php"] [unique_id "ad4_bZ6axKeW6bX4H7d-MAAAAEg"]
[Tue Apr 14 21:21:51.829953 2026] [:error] [pid 60074:tid 60098] [client 51.103.118.101:41305] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x3x.php"] [unique_id "ad4_b-tqnEmNU9vpHCmnIAAAANY"]
[Tue Apr 14 21:21:52.528064 2026] [:error] [pid 3778:tid 3793] [client 51.103.118.101:44518] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xy.php"] [unique_id "ad4_cBx5DfpNmYF_PaHq7wAAAU0"]
[Tue Apr 14 21:21:53.508891 2026] [:error] [pid 3778:tid 3781] [client 51.103.118.101:35484] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xy.php"] [unique_id "ad4_cRx5DfpNmYF_PaHq9AAAAUE"]
[Tue Apr 14 21:21:54.559114 2026] [:error] [pid 22177:tid 22181] [client 51.103.118.101:29967] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xy.php"] [unique_id "ad4_coTVeJSXHDIlEDuI3AAAAQI"]
[Tue Apr 14 21:21:55.180608 2026] [:error] [pid 59987:tid 60048] [client 51.103.118.101:45219] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xy.php"] [unique_id "ad4_c1Wpk-Tfi6_vLKo3tQAAAIE"]
[Tue Apr 14 21:21:57.944556 2026] [:error] [pid 59986:tid 60031] [client 51.103.118.101:46179] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/global.php"] [unique_id "ad4_dZ6axKeW6bX4H7d-RgAAAEs"]
[Tue Apr 14 21:21:59.560908 2026] [:error] [pid 59986:tid 60033] [client 51.103.118.101:45225] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/global.php"] [unique_id "ad4_d56axKeW6bX4H7d-SwAAAE0"]
[Tue Apr 14 21:22:00.973748 2026] [:error] [pid 3778:tid 3795] [client 51.103.118.101:45017] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/global.php"] [unique_id "ad4_eBx5DfpNmYF_PaHrDAAAAU8"]
[Tue Apr 14 21:22:02.180626 2026] [:error] [pid 3810:tid 3814] [client 51.103.118.101:42488] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/global.php"] [unique_id "ad4_esqc5XaYZhFXVGemTgAAAYE"]
[Tue Apr 14 21:22:05.061105 2026] [:error] [pid 59985:tid 60005] [client 51.103.118.101:38017] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "ad4_fegHaxkvLE6V1klk4QAAAAw"]
[Tue Apr 14 21:22:06.866678 2026] [:error] [pid 60074:tid 60098] [client 51.103.118.101:44336] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "ad4_futqnEmNU9vpHCmnKgAAANY"]
[Tue Apr 14 21:22:14.388697 2026] [:error] [pid 59986:tid 60030] [client 51.103.118.101:4832] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "ad4_hp6axKeW6bX4H7d-VwAAAEo"]
[Tue Apr 14 21:22:17.235766 2026] [:error] [pid 59985:tid 59997] [client 51.103.118.101:44489] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "ad4_iegHaxkvLE6V1klk6wAAAAQ"]
[Tue Apr 14 21:22:21.004845 2026] [:error] [pid 3810:tid 3819] [client 51.103.118.101:42451] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "ad4_jcqc5XaYZhFXVGemdAAAAYY"]
[Tue Apr 14 21:22:22.322098 2026] [:error] [pid 3810:tid 3836] [client 51.103.118.101:37717] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "ad4_jsqc5XaYZhFXVGemewAAAZc"]
[Tue Apr 14 21:22:23.309660 2026] [:error] [pid 59986:tid 60043] [client 51.103.118.101:42485] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "ad4_j56axKeW6bX4H7d-XwAAAFc"]
[Tue Apr 14 21:22:24.049350 2026] [:error] [pid 59986:tid 60021] [client 51.103.118.101:33881] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "ad4_kJ6axKeW6bX4H7d-YQAAAEE"]
[Tue Apr 14 21:22:25.166153 2026] [:error] [pid 3778:tid 3798] [client 51.103.118.101:32433] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ortasekerli1.php"] [unique_id "ad4_kRx5DfpNmYF_PaHrKgAAAVI"]
[Tue Apr 14 21:22:26.425100 2026] [:error] [pid 59986:tid 60028] [client 51.103.118.101:42464] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ortasekerli1.php"] [unique_id "ad4_kp6axKeW6bX4H7d-ZQAAAEg"]
[Tue Apr 14 21:22:27.083835 2026] [:error] [pid 3778:tid 3781] [client 51.103.118.101:44292] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ortasekerli1.php"] [unique_id "ad4_kxx5DfpNmYF_PaHrLgAAAUE"]
[Tue Apr 14 21:22:27.807442 2026] [:error] [pid 3778:tid 3800] [client 51.103.118.101:34999] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ortasekerli1.php"] [unique_id "ad4_kxx5DfpNmYF_PaHrMgAAAVQ"]
[Tue Apr 14 21:22:28.413867 2026] [:error] [pid 59986:tid 60039] [client 51.103.118.101:29999] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-block.php"] [unique_id "ad4_lJ6axKeW6bX4H7d-cQAAAFM"]
[Tue Apr 14 21:22:29.427866 2026] [:error] [pid 59986:tid 60028] [client 51.103.118.101:32391] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-block.php"] [unique_id "ad4_lZ6axKeW6bX4H7d-eAAAAEg"]
[Tue Apr 14 21:22:31.096652 2026] [:error] [pid 59986:tid 60041] [client 51.103.118.101:30774] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-block.php"] [unique_id "ad4_l56axKeW6bX4H7d-fwAAAFU"]
[Tue Apr 14 21:22:33.219125 2026] [:error] [pid 3778:tid 3792] [client 51.103.118.101:37706] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-block.php"] [unique_id "ad4_mRx5DfpNmYF_PaHrOwAAAUw"]
[Tue Apr 14 21:22:34.060869 2026] [:error] [pid 3778:tid 3790] [client 51.103.118.101:29993] [client 51.103.118.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wincust.php"] [unique_id "ad4_mhx5DfpNmYF_PaHrPQAAAUo"]
[Tue Apr 14 21:22:35.004607 2026] [:error] [pid 59986:tid 60027] [client 51.103.118.101:30008] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "ad4_m56axKeW6bX4H7d-igAAAEc"]
[Tue Apr 14 21:22:36.941023 2026] [:error] [pid 59986:tid 60034] [client 51.103.118.101:34950] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "ad4_nJ6axKeW6bX4H7d-kgAAAE4"]
[Tue Apr 14 21:22:37.849593 2026] [:error] [pid 59987:tid 60070] [client 51.103.118.101:29994] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "ad4_nVWpk-Tfi6_vLKo36wAAAJc"]
[Tue Apr 14 21:22:38.699848 2026] [:error] [pid 60074:tid 60100] [client 51.103.118.101:30768] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "ad4_nutqnEmNU9vpHCmnRgAAANg"]
[Tue Apr 14 21:22:39.554389 2026] [:error] [pid 3810:tid 3828] [client 51.103.118.101:42438] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "ad4_n8qc5XaYZhFXVGemrAAAAY8"]
[Tue Apr 14 21:22:40.468930 2026] [:error] [pid 59986:tid 60028] [client 51.103.118.101:44318] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "ad4_oJ6axKeW6bX4H7d-nwAAAEg"]
[Tue Apr 14 21:22:41.463436 2026] [:error] [pid 3810:tid 3816] [client 51.103.118.101:45858] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "ad4_ocqc5XaYZhFXVGemsgAAAYM"]
[Tue Apr 14 21:22:42.180544 2026] [:error] [pid 60074:tid 60078] [client 51.103.118.101:34206] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "ad4_outqnEmNU9vpHCmnSQAAAMI"]
[Tue Apr 14 21:22:43.034784 2026] [:error] [pid 3810:tid 3837] [client 51.103.118.101:45862] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xltt.php"] [unique_id "ad4_o8qc5XaYZhFXVGemuQAAAZg"]
[Tue Apr 14 21:22:43.855533 2026] [:error] [pid 59986:tid 60035] [client 51.103.118.101:42479] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xltt.php"] [unique_id "ad4_o56axKeW6bX4H7d-qgAAAE8"]
[Tue Apr 14 21:22:56.565144 2026] [:error] [pid 3778:tid 3791] [client 51.103.118.101:30502] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-class.php"] [unique_id "ad4_sBx5DfpNmYF_PaHrdQAAAUs"]
[Tue Apr 14 21:22:57.503399 2026] [:error] [pid 59985:tid 60001] [client 51.103.118.101:34968] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-class.php"] [unique_id "ad4_segHaxkvLE6V1kllEAAAAAg"]
[Tue Apr 14 21:22:58.462512 2026] [:error] [pid 59986:tid 60043] [client 51.103.118.101:4890] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-class.php"] [unique_id "ad4_sp6axKeW6bX4H7d-2AAAAFc"]
[Tue Apr 14 21:22:59.094346 2026] [:error] [pid 60074:tid 60090] [client 51.103.118.101:38920] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-class.php"] [unique_id "ad4_s-tqnEmNU9vpHCmnfQAAAM4"]
[Tue Apr 14 21:22:59.894954 2026] [:error] [pid 59986:tid 60035] [client 51.103.118.101:34978] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "ad4_s56axKeW6bX4H7d-2QAAAE8"]
[Tue Apr 14 21:23:01.142705 2026] [:error] [pid 3810:tid 3816] [client 51.103.118.101:34698] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "ad4_tcqc5XaYZhFXVGemzwAAAYM"]
[Tue Apr 14 21:23:01.805671 2026] [:error] [pid 59986:tid 60020] [client 51.103.118.101:43366] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "ad4_tZ6axKeW6bX4H7d-5gAAAEA"]
[Tue Apr 14 21:23:02.782643 2026] [:error] [pid 3778:tid 3799] [client 51.103.118.101:34688] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "ad4_thx5DfpNmYF_PaHriQAAAVM"]
[Tue Apr 14 21:23:04.549078 2026] [:error] [pid 59986:tid 60041] [client 51.103.118.101:43655] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d.php"] [unique_id "ad4_uJ6axKeW6bX4H7d-8AAAAFU"]
[Tue Apr 14 21:23:05.832583 2026] [:error] [pid 60074:tid 60095] [client 51.103.118.101:40818] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d.php"] [unique_id "ad4_uetqnEmNU9vpHCmniAAAANM"]
[Tue Apr 14 21:23:07.036570 2026] [:error] [pid 59986:tid 60036] [client 51.103.118.101:29642] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d.php"] [unique_id "ad4_u56axKeW6bX4H7d--wAAAFA"]
[Tue Apr 14 21:23:08.078380 2026] [:error] [pid 59986:tid 60020] [client 51.103.118.101:41975] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d.php"] [unique_id "ad4_vJ6axKeW6bX4H7d-_wAAAEA"]
[Tue Apr 14 21:23:08.679132 2026] [:error] [pid 59987:tid 60068] [client 51.103.118.101:43711] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/error_log.php"] [unique_id "ad4_vFWpk-Tfi6_vLKo4CgAAAJU"]
[Tue Apr 14 21:23:09.448772 2026] [:error] [pid 60074:tid 60091] [client 51.103.118.101:41931] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/error_log.php"] [unique_id "ad4_vetqnEmNU9vpHCmnjgAAAM8"]
[Tue Apr 14 21:23:10.159635 2026] [:error] [pid 60074:tid 60084] [client 51.103.118.101:40786] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/error_log.php"] [unique_id "ad4_vutqnEmNU9vpHCmnkQAAAMg"]
[Tue Apr 14 21:23:12.384419 2026] [:error] [pid 59985:tid 60010] [client 51.103.118.101:44715] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/error_log.php"] [unique_id "ad4_wOgHaxkvLE6V1kllFAAAABE"]
[Tue Apr 14 21:23:13.489631 2026] [:error] [pid 59985:tid 60011] [client 51.103.118.101:44692] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Ov-Simple1.php"] [unique_id "ad4_wegHaxkvLE6V1kllFgAAABI"]
[Tue Apr 14 21:23:14.541056 2026] [:error] [pid 59986:tid 60034] [client 51.103.118.101:43707] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Ov-Simple1.php"] [unique_id "ad4_wp6axKeW6bX4H7d_DAAAAE4"]
[Tue Apr 14 21:23:15.217742 2026] [:error] [pid 59986:tid 60039] [client 51.103.118.101:44698] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Ov-Simple1.php"] [unique_id "ad4_w56axKeW6bX4H7d_DwAAAFM"]
[Tue Apr 14 21:23:17.229312 2026] [:error] [pid 22177:tid 22182] [client 51.103.118.101:43654] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Ov-Simple1.php"] [unique_id "ad4_xYTVeJSXHDIlEDuJKgAAAQM"]
[Tue Apr 14 21:23:18.032199 2026] [:error] [pid 22177:tid 22197] [client 51.103.118.101:30656] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/curl.php"] [unique_id "ad4_xoTVeJSXHDIlEDuJLQAAARI"]
[Tue Apr 14 21:23:24.022342 2026] [:error] [pid 60074:tid 60095] [client 51.103.118.101:46216] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/curl.php"] [unique_id "ad4_zOtqnEmNU9vpHCmnrAAAANM"]
[Tue Apr 14 21:23:25.466746 2026] [:error] [pid 59987:tid 60065] [client 51.103.118.101:36596] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/curl.php"] [unique_id "ad4_zVWpk-Tfi6_vLKo4HQAAAJI"]
[Tue Apr 14 21:23:27.011059 2026] [:error] [pid 22177:tid 22202] [client 51.103.118.101:39363] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/curl.php"] [unique_id "ad4_z4TVeJSXHDIlEDuJNQAAARc"]
[Tue Apr 14 21:23:27.601443 2026] [:error] [pid 60074:tid 60077] [client 51.103.118.101:36606] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sallu.php"] [unique_id "ad4_z-tqnEmNU9vpHCmnrwAAAME"]
[Tue Apr 14 21:23:29.901722 2026] [:error] [pid 60074:tid 60089] [client 51.103.118.101:32333] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sallu.php"] [unique_id "ad4_0etqnEmNU9vpHCmnugAAAM0"]
[Tue Apr 14 21:23:38.389855 2026] [:error] [pid 59986:tid 60025] [client 51.103.118.101:39408] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sallu.php"] [unique_id "ad4_2p6axKeW6bX4H7d_dwAAAEU"]
[Tue Apr 14 21:23:39.156192 2026] [:error] [pid 59986:tid 60021] [client 51.103.118.101:4950] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sallu.php"] [unique_id "ad4_256axKeW6bX4H7d_eQAAAEE"]
[Tue Apr 14 21:23:40.241845 2026] [:error] [pid 59985:tid 60008] [client 51.103.118.101:41481] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "ad4_3OgHaxkvLE6V1kllKQAAAA8"]
[Tue Apr 14 21:23:42.135997 2026] [:error] [pid 59986:tid 60040] [client 51.103.118.101:35188] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "ad4_3p6axKeW6bX4H7d_hAAAAFQ"]
[Tue Apr 14 21:23:42.754044 2026] [:error] [pid 59987:tid 60071] [client 51.103.118.101:32379] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "ad4_3lWpk-Tfi6_vLKo4MQAAAJg"]
[Tue Apr 14 21:23:43.272899 2026] [:error] [pid 60074:tid 60100] [client 51.103.118.101:46248] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "ad4_3-tqnEmNU9vpHCmnxAAAANg"]
[Tue Apr 14 21:23:44.585878 2026] [:error] [pid 22177:tid 22194] [client 51.103.118.101:29735] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ad4_4ITVeJSXHDIlEDuJPAAAAQ8"]
[Tue Apr 14 21:23:46.910689 2026] [:error] [pid 59987:tid 60058] [client 51.103.118.101:33210] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ad4_4lWpk-Tfi6_vLKo4NAAAAIs"]
[Tue Apr 14 21:23:49.743451 2026] [:error] [pid 60074:tid 60086] [client 51.103.118.101:42766] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ad4_5etqnEmNU9vpHCmn1QAAAMo"]
[Tue Apr 14 21:23:51.384993 2026] [:error] [pid 59986:tid 60035] [client 51.103.118.101:41499] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ad4_556axKeW6bX4H7d_mAAAAE8"]
[Tue Apr 14 21:23:54.379024 2026] [:error] [pid 3810:tid 3813] [client 51.103.118.101:29911] [client 51.103.118.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "ad4_6sqc5XaYZhFXVGenKQAAAYA"]
[Tue Apr 14 22:09:04.757560 2026] [:error] [pid 59986:tid 60035] [client 103.93.219.135:56148] [client 103.93.219.135] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ad5KgJ6axKeW6bX4H7eZ5wAAAE8"]
[Tue Apr 14 22:10:41.656153 2026] [:error] [pid 3778:tid 3798] [client 103.93.219.135:56839] [client 103.93.219.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.93.219.135, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad5K4Rx5DfpNmYF_PaH5oAAAAVI"]
[Tue Apr 14 22:12:05.799970 2026] [:error] [pid 3810:tid 3821] [client 103.93.219.135:54196] [client 103.93.219.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.93.219.135, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad5LNcqc5XaYZhFXVGe-RwAAAYg"]
[Tue Apr 14 22:13:26.161248 2026] [:error] [pid 59987:tid 60057] [client 103.93.219.135:55764] [client 103.93.219.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.93.219.135, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad5LhlWpk-Tfi6_vLKpERAAAAIo"]
[Tue Apr 14 22:14:55.023463 2026] [:error] [pid 3810:tid 3826] [client 103.93.219.135:57468] [client 103.93.219.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.93.219.135, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad5L38qc5XaYZhFXVGe_RQAAAY0"]
[Tue Apr 14 22:16:10.343399 2026] [:error] [pid 22177:tid 22185] [client 103.93.219.135:55082] [client 103.93.219.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.93.219.135, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad5MKoTVeJSXHDIlEDuVMgAAAQY"]
[Wed Apr 15 01:36:00.377601 2026] [:error] [pid 62296:tid 62338] [client 43.153.27.244:50710] [client 43.153.27.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ad57AMTNd04nWM2DK4SMLAAAAEs"]
[Wed Apr 15 02:52:05.271599 2026] [:error] [pid 62432:tid 62435] [client 82.102.18.220:54700] [client 82.102.18.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.102.18.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad6M1bPtNET7V_vfTPfo4QAAAUA"]
[Wed Apr 15 02:52:08.751446 2026] [:error] [pid 62432:tid 62454] [client 82.102.18.220:54700] [client 82.102.18.220] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ad6M2LPtNET7V_vfTPfo5AAAAVM"]
[Wed Apr 15 02:52:09.025198 2026] [:error] [pid 62432:tid 62440] [client 82.102.18.220:54700] [client 82.102.18.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.102.18.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad6M2bPtNET7V_vfTPfo5QAAAUU"]
[Wed Apr 15 02:52:10.648028 2026] [:error] [pid 17734:tid 17743] [client 82.102.18.220:47150] [client 82.102.18.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.102.18.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad6M2tN3xsztF3DFLWwcQAAAAIQ"]
[Wed Apr 15 02:52:12.240168 2026] [:error] [pid 62296:tid 62327] [client 82.102.18.220:47162] [client 82.102.18.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.102.18.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad6M3MTNd04nWM2DK4SuaAAAAEA"]
[Wed Apr 15 02:52:13.832293 2026] [:error] [pid 62296:tid 62347] [client 82.102.18.220:59416] [client 82.102.18.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.102.18.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad6M3cTNd04nWM2DK4SubwAAAFQ"]
[Wed Apr 15 02:52:15.553973 2026] [:error] [pid 62297:tid 62373] [client 82.102.18.220:59418] [client 82.102.18.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.102.18.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad6M36vogcWlrafOEaHmsAAAARM"]
[Wed Apr 15 02:52:15.554108 2026] [:error] [pid 62297:tid 62373] [client 82.102.18.220:59418] [client 82.102.18.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 82.102.18.220, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad6M36vogcWlrafOEaHmsAAAARM"]
[Wed Apr 15 03:29:28.490381 2026] [:error] [pid 62297:tid 62371] [client 154.54.100.171:49962] [client 154.54.100.171] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "ad6VmKvogcWlrafOEaHylQAAARE"]
[Wed Apr 15 04:03:58.285829 2026] [:error] [pid 4169:tid 4197] [client 186.204.88.182:5619] [client 186.204.88.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.204.88.182, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad6drh15U5D-N99n_jI_OAAAANY"]
[Wed Apr 15 04:26:10.647380 2026] [:error] [pid 4066:tid 4119] [client 119.252.192.249:10593] [client 119.252.192.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 119.252.192.249, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad6i4oC2YXfSPsC9O_BOEwAAAE8"], referer: https://expressinteriors.com/
[Wed Apr 15 05:25:17.676512 2026] [:error] [pid 45504:tid 45523] [client 43.167.239.66:45850] [client 43.167.239.66] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ad6wva3iO9_fE_IQEMkjSgAAARE"]
[Wed Apr 15 06:07:06.980426 2026] [:error] [pid 4067:tid 4143] [client 186.204.88.182:54014] [client 186.204.88.182] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ad66iu5XHBJU8ZrRxZ0-KwAAAIw"]
[Wed Apr 15 06:08:53.150150 2026] [:error] [pid 4169:tid 4176] [client 186.204.88.182:62410] [client 186.204.88.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.204.88.182, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad669R15U5D-N99n_jKGwAAAAMQ"]
[Wed Apr 15 06:10:38.364972 2026] [:error] [pid 4067:tid 4154] [client 186.204.88.182:59811] [client 186.204.88.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.204.88.182, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad67Xu5XHBJU8ZrRxZ0_ogAAAJc"]
[Wed Apr 15 06:12:17.955224 2026] [:error] [pid 4169:tid 4172] [client 186.204.88.182:65180] [client 186.204.88.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.204.88.182, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad67wR15U5D-N99n_jKI1AAAAMA"]
[Wed Apr 15 06:12:28.302396 2026] [:error] [pid 4067:tid 4144] [client 45.169.161.67:37235] [client 45.169.161.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.169.161.67, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad67zO5XHBJU8ZrRxZ1AKgAAAI0"]
[Wed Apr 15 06:12:38.750909 2026] [:error] [pid 4065:tid 4082] [client 45.169.161.67:36651] [client 45.169.161.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.169.161.67, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad671gWArgJTHu2_6OzLIAAAAAY"]
[Wed Apr 15 06:12:49.421968 2026] [:error] [pid 45504:tid 45519] [client 45.169.161.67:37069] [client 45.169.161.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.169.161.67, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad674a3iO9_fE_IQEMlC2QAAAQ0"]
[Wed Apr 15 06:13:00.215219 2026] [:error] [pid 4169:tid 4195] [client 45.169.161.67:37295] [client 45.169.161.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.169.161.67, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad677B15U5D-N99n_jKJSgAAANQ"]
[Wed Apr 15 06:13:10.688581 2026] [:error] [pid 4066:tid 4107] [client 45.169.161.67:36618] [client 45.169.161.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.169.161.67, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad679oC2YXfSPsC9O_BvDwAAAEM"]
[Wed Apr 15 06:13:56.005647 2026] [:error] [pid 4169:tid 4196] [client 186.204.88.182:54278] [client 186.204.88.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.204.88.182, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad68JB15U5D-N99n_jKJ6wAAANU"]
[Wed Apr 15 06:15:26.986334 2026] [:error] [pid 4169:tid 4181] [client 186.204.88.182:61361] [client 186.204.88.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.204.88.182, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad68fh15U5D-N99n_jKKygAAAMk"]
[Wed Apr 15 06:56:37.688756 2026] [:error] [pid 4065:tid 4100] [client 107.3.193.3:56555] [client 107.3.193.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.3.193.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad7GJQWArgJTHu2_6OzX1wAAABg"]
[Wed Apr 15 06:56:47.910086 2026] [:error] [pid 45504:tid 45522] [client 107.3.193.3:56814] [client 107.3.193.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.3.193.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad7GL63iO9_fE_IQEMllDQAAARA"]
[Wed Apr 15 06:56:58.561087 2026] [:error] [pid 45504:tid 45511] [client 107.3.193.3:57068] [client 107.3.193.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.3.193.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad7GOq3iO9_fE_IQEMllLAAAAQU"]
[Wed Apr 15 06:57:09.253671 2026] [:error] [pid 4066:tid 4118] [client 107.3.193.3:57333] [client 107.3.193.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.3.193.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad7GRYC2YXfSPsC9O_CAHAAAAE4"]
[Wed Apr 15 06:57:19.958880 2026] [:error] [pid 4169:tid 4189] [client 107.3.193.3:57593] [client 107.3.193.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.3.193.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad7GTx15U5D-N99n_jKjOwAAANA"]
[Wed Apr 15 07:47:31.316036 2026] [:error] [pid 30554:tid 30610] [client 43.153.113.127:35994] [client 43.153.113.127] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ad7SE16Jrdy3caXvUkuRSQAAAFc"]
[Wed Apr 15 10:49:55.066674 2026] [:error] [pid 50234:tid 50251] [client 139.255.100.186:63127] [client 139.255.100.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.255.100.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad7809r0cDjH19-BoGy-5gAAAQ8"]
[Wed Apr 15 10:50:02.248251 2026] [:error] [pid 30644:tid 30671] [client 139.255.100.186:63548] [client 139.255.100.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.255.100.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad782q8vuyJ0N41zsM8TGAAAANU"]
[Wed Apr 15 10:50:20.354353 2026] [:error] [pid 50234:tid 50251] [client 139.255.100.186:63951] [client 139.255.100.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.255.100.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad787Nr0cDjH19-BoGy_DgAAAQ8"]
[Wed Apr 15 10:50:24.599777 2026] [:error] [pid 30644:tid 30659] [client 139.255.100.186:64337] [client 139.255.100.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.255.100.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad788K8vuyJ0N41zsM8TKgAAAMk"]
[Wed Apr 15 10:50:45.075128 2026] [:error] [pid 30553:tid 30580] [client 139.255.100.186:64826] [client 139.255.100.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.255.100.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad79BaWezn1lK_o0Brr1CwAAABU"]
[Wed Apr 15 11:00:23.692531 2026] [:error] [pid 50234:tid 50255] [client 119.252.192.249:47138] [client 119.252.192.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 119.252.192.249, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad7_R9r0cDjH19-BoGzCBQAAARM"], referer: https://expressinteriors.com/
[Wed Apr 15 14:23:31.959611 2026] [:error] [pid 12433:tid 12447] [client 114.80.36.40:56272] [client 114.80.36.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ad8u47wxDHWF005pP_58BgAAAQw"]
[Wed Apr 15 15:15:07.938534 2026] [:error] [pid 11385:tid 11471] [client 213.154.14.120:62157] [client 213.154.14.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.154.14.120, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad86-x_mZoXMMCiUoKUwhQAAANY"]
[Wed Apr 15 15:15:17.615937 2026] [:error] [pid 12433:tid 12447] [client 213.154.14.120:62488] [client 213.154.14.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.154.14.120, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad87BbwxDHWF005pP_6WTgAAAQw"]
[Wed Apr 15 15:15:28.179441 2026] [:error] [pid 11475:tid 11489] [client 213.154.14.120:62819] [client 213.154.14.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.154.14.120, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad87EJ7upE98bj816HO-5QAAAUw"]
[Wed Apr 15 15:15:38.704192 2026] [:error] [pid 11384:tid 11435] [client 213.154.14.120:63063] [client 213.154.14.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.154.14.120, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad87GnOhpt4MrQIXF7B_sQAAAE0"]
[Wed Apr 15 15:15:49.352317 2026] [:error] [pid 11385:tid 11472] [client 213.154.14.120:63311] [client 213.154.14.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.154.14.120, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad87JR_mZoXMMCiUoKUwrwAAANc"]
[Wed Apr 15 17:15:19.116047 2026] [:error] [pid 65412:tid 65420] [client 43.156.232.190:46746] [client 43.156.232.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ad9XJ_EYT61VHfhVE5fzZQAAAYY"]
[Wed Apr 15 18:04:23.508659 2026] [:error] [pid 12396:tid 12422] [client 216.73.216.46:11020] [client 216.73.216.46] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||expressinteriors.com|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/robots.txt"] [unique_id "ad9ip8CQWGYUWgxc5kgRRwAAAJg"]
[Wed Apr 15 19:51:06.304728 2026] [:error] [pid 37370:tid 37392] [client 34.182.150.178:49974] [client 34.182.150.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.182.150.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad97qng-gnM2Ga0cGAAcygAAARQ"]
[Wed Apr 15 19:51:08.472691 2026] [:error] [pid 37370:tid 37387] [client 34.182.150.178:49974] [client 34.182.150.178] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ad97rHg-gnM2Ga0cGAAc0QAAAQ8"]
[Wed Apr 15 19:51:08.685173 2026] [:error] [pid 37370:tid 37374] [client 34.182.150.178:49974] [client 34.182.150.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.182.150.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad97rHg-gnM2Ga0cGAAc0gAAAQI"]
[Wed Apr 15 19:51:10.173259 2026] [:error] [pid 37370:tid 37373] [client 34.182.150.178:51912] [client 34.182.150.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.182.150.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad97rng-gnM2Ga0cGAAc2AAAAQE"]
[Wed Apr 15 19:51:11.606315 2026] [:error] [pid 37370:tid 37372] [client 34.182.150.178:54934] [client 34.182.150.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.182.150.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad97r3g-gnM2Ga0cGAAc3wAAAQA"]
[Wed Apr 15 19:51:13.031753 2026] [:error] [pid 37370:tid 37383] [client 34.182.150.178:49264] [client 34.182.150.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.182.150.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad97sXg-gnM2Ga0cGAAc5QAAAQs"]
[Wed Apr 15 19:51:14.454249 2026] [:error] [pid 37370:tid 37385] [client 34.182.150.178:63831] [client 34.182.150.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.182.150.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad97sng-gnM2Ga0cGAAc6AAAAQ0"]
[Wed Apr 15 19:51:14.454450 2026] [:error] [pid 37370:tid 37385] [client 34.182.150.178:63831] [client 34.182.150.178] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.182.150.178, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad97sng-gnM2Ga0cGAAc6AAAAQ0"]
[Wed Apr 15 20:06:27.991220 2026] [:error] [pid 30958:tid 31021] [client 196.11.235.80:56066] [client 196.11.235.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.11.235.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad9_Q8eG3wSKTO7NWFGckAAAAMU"]
[Wed Apr 15 20:10:54.354726 2026] [:error] [pid 37370:tid 37386] [client 196.11.235.80:33569] [client 196.11.235.80] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ad-ATng-gnM2Ga0cGAAocAAAAQ4"]
[Wed Apr 15 20:12:27.272336 2026] [:error] [pid 37370:tid 37392] [client 196.11.235.80:56776] [client 196.11.235.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.11.235.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad-Aq3g-gnM2Ga0cGAApTwAAARQ"]
[Wed Apr 15 20:13:56.008366 2026] [:error] [pid 31053:tid 31078] [client 196.11.235.80:17364] [client 196.11.235.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.11.235.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad-BBBcEkLCmvF0fjDfFawAAAJY"]
[Wed Apr 15 20:15:09.677567 2026] [:error] [pid 37370:tid 37383] [client 196.11.235.80:54039] [client 196.11.235.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.11.235.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad-BTXg-gnM2Ga0cGAArEwAAAQs"]
[Wed Apr 15 20:16:30.673182 2026] [:error] [pid 30957:tid 31009] [client 196.11.235.80:54992] [client 196.11.235.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.11.235.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad-Bnn5gwVEVXHfVSip_awAAAFQ"]
[Wed Apr 15 20:44:06.268128 2026] [:error] [pid 30958:tid 31018] [client 193.39.143.4:50070] [client 193.39.143.4] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.expressinteriors.com|F|2"] [data "TX:0=video/webm"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ad-IFseG3wSKTO7NWFGo0wAAAMI"]
[Wed Apr 15 21:36:55.713386 2026] [:error] [pid 30956:tid 30960] [client 216.73.216.46:55587] [client 216.73.216.46] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||expressinteriors.com|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/robots.txt"] [unique_id "ad-Ud0BGUpjaWntNYq2NNgAAAAA"]
[Wed Apr 15 21:46:48.626521 2026] [:error] [pid 30958:tid 31035] [client 68.221.132.192:42916] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "ad-WyMeG3wSKTO7NWFHP-QAAANM"]
[Wed Apr 15 21:46:49.103819 2026] [:error] [pid 31053:tid 31056] [client 68.221.132.192:32694] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "ad-WyRcEkLCmvF0fjDcLzQAAAIA"]
[Wed Apr 15 21:46:49.598047 2026] [:error] [pid 30956:tid 30979] [client 68.221.132.192:61578] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "ad-WyUBGUpjaWntNYq2TDwAAABM"]
[Wed Apr 15 21:46:50.087050 2026] [:error] [pid 30957:tid 31001] [client 68.221.132.192:32682] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "ad-Wyn5gwVEVXHfVSiqqZgAAAEw"]
[Wed Apr 15 21:46:50.565680 2026] [:error] [pid 30956:tid 30960] [client 68.221.132.192:42936] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "ad-WykBGUpjaWntNYq2TEwAAAAA"]
[Wed Apr 15 21:46:51.047027 2026] [:error] [pid 23913:tid 23934] [client 68.221.132.192:32663] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "ad-Wy1UaK3MLdSaLOyiwtQAAAVM"]
[Wed Apr 15 21:46:51.528497 2026] [:error] [pid 37370:tid 37396] [client 68.221.132.192:4760] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "ad-Wy3g-gnM2Ga0cGACFXQAAARg"]
[Wed Apr 15 21:46:52.009827 2026] [:error] [pid 31053:tid 31078] [client 68.221.132.192:62915] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "ad-WzBcEkLCmvF0fjDcL4wAAAJY"]
[Wed Apr 15 21:46:52.490365 2026] [:error] [pid 31053:tid 31074] [client 68.221.132.192:38440] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "ad-WzBcEkLCmvF0fjDcL7AAAAJI"]
[Wed Apr 15 21:46:52.974184 2026] [:error] [pid 37370:tid 37379] [client 68.221.132.192:38414] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "ad-WzHg-gnM2Ga0cGACFZAAAAQc"]
[Wed Apr 15 21:46:53.455859 2026] [:error] [pid 31053:tid 31056] [client 68.221.132.192:50538] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "ad-WzRcEkLCmvF0fjDcL-gAAAIA"]
[Wed Apr 15 21:46:53.942598 2026] [:error] [pid 31053:tid 31068] [client 68.221.132.192:32750] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "ad-WzRcEkLCmvF0fjDcL_gAAAIw"]
[Wed Apr 15 21:46:54.421186 2026] [:error] [pid 31053:tid 31059] [client 68.221.132.192:42465] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jquery.php"] [unique_id "ad-WzhcEkLCmvF0fjDcMAgAAAIM"]
[Wed Apr 15 21:46:54.902656 2026] [:error] [pid 31053:tid 31062] [client 68.221.132.192:42928] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jquery.php"] [unique_id "ad-WzhcEkLCmvF0fjDcMBgAAAIY"]
[Wed Apr 15 21:46:55.390061 2026] [:error] [pid 23913:tid 23934] [client 68.221.132.192:57590] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jquery.php"] [unique_id "ad-Wz1UaK3MLdSaLOyiwwQAAAVM"]
[Wed Apr 15 21:46:55.869445 2026] [:error] [pid 31053:tid 31077] [client 68.221.132.192:4984] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jquery.php"] [unique_id "ad-WzxcEkLCmvF0fjDcMEgAAAJU"]
[Wed Apr 15 21:46:56.349157 2026] [:error] [pid 31053:tid 31066] [client 68.221.132.192:43586] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "ad-W0BcEkLCmvF0fjDcMFAAAAIo"]
[Wed Apr 15 21:46:56.832140 2026] [:error] [pid 31053:tid 31062] [client 68.221.132.192:32662] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "ad-W0BcEkLCmvF0fjDcMGgAAAIY"]
[Wed Apr 15 21:46:57.316044 2026] [:error] [pid 30957:tid 31003] [client 68.221.132.192:50522] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "ad-W0X5gwVEVXHfVSiqqewAAAE4"]
[Wed Apr 15 21:46:57.798016 2026] [:error] [pid 31053:tid 31068] [client 68.221.132.192:4936] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "ad-W0RcEkLCmvF0fjDcMIgAAAIw"]
[Wed Apr 15 21:46:58.281528 2026] [:error] [pid 37370:tid 37380] [client 68.221.132.192:38425] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "ad-W0ng-gnM2Ga0cGACFawAAAQg"]
[Wed Apr 15 21:46:58.764896 2026] [:error] [pid 31053:tid 31065] [client 68.221.132.192:42884] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "ad-W0hcEkLCmvF0fjDcMKQAAAIk"]
[Wed Apr 15 21:46:59.246263 2026] [:error] [pid 37370:tid 37395] [client 68.221.132.192:43642] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "ad-W03g-gnM2Ga0cGACFcQAAARc"]
[Wed Apr 15 21:46:59.726698 2026] [:error] [pid 37370:tid 37388] [client 68.221.132.192:42482] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bolt.php"] [unique_id "ad-W03g-gnM2Ga0cGACFdQAAARA"]
[Wed Apr 15 21:47:00.206517 2026] [:error] [pid 30958:tid 31018] [client 68.221.132.192:43613] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "ad-W1MeG3wSKTO7NWFHQBAAAAMI"]
[Wed Apr 15 21:47:00.686424 2026] [:error] [pid 31053:tid 31080] [client 68.221.132.192:42882] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "ad-W1BcEkLCmvF0fjDcMOQAAAJg"]
[Wed Apr 15 21:47:01.163918 2026] [:error] [pid 23913:tid 23925] [client 68.221.132.192:32677] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "ad-W1VUaK3MLdSaLOyiwygAAAUo"]
[Wed Apr 15 21:47:01.642006 2026] [:error] [pid 31053:tid 31079] [client 68.221.132.192:61589] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "ad-W1RcEkLCmvF0fjDcMTAAAAJc"]
[Wed Apr 15 21:47:02.122140 2026] [:error] [pid 23913:tid 23926] [client 68.221.132.192:43633] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "ad-W1lUaK3MLdSaLOyiw2AAAAUs"]
[Wed Apr 15 21:47:02.604711 2026] [:error] [pid 31053:tid 31077] [client 68.221.132.192:57563] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "ad-W1hcEkLCmvF0fjDcMVQAAAJU"]
[Wed Apr 15 21:47:03.085645 2026] [:error] [pid 31053:tid 31067] [client 68.221.132.192:32763] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "ad-W1xcEkLCmvF0fjDcMXQAAAIs"]
[Wed Apr 15 21:47:03.565007 2026] [:error] [pid 31053:tid 31073] [client 68.221.132.192:32738] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "ad-W1xcEkLCmvF0fjDcMZwAAAJE"]
[Wed Apr 15 21:47:04.043745 2026] [:error] [pid 31053:tid 31067] [client 68.221.132.192:41608] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "ad-W2BcEkLCmvF0fjDcMbwAAAIs"]
[Wed Apr 15 21:47:04.521810 2026] [:error] [pid 31053:tid 31060] [client 68.221.132.192:62920] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "ad-W2BcEkLCmvF0fjDcMdQAAAIQ"]
[Wed Apr 15 21:47:05.004189 2026] [:error] [pid 31053:tid 31069] [client 68.221.132.192:61583] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "ad-W2RcEkLCmvF0fjDcMfQAAAI0"]
[Wed Apr 15 21:47:05.486598 2026] [:error] [pid 30958:tid 31035] [client 68.221.132.192:61594] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "ad-W2ceG3wSKTO7NWFHQCAAAANM"]
[Wed Apr 15 21:47:05.967029 2026] [:error] [pid 31053:tid 31059] [client 68.221.132.192:62945] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "ad-W2RcEkLCmvF0fjDcMjQAAAIM"]
[Wed Apr 15 21:47:06.447458 2026] [:error] [pid 30956:tid 30967] [client 68.221.132.192:41621] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "ad-W2kBGUpjaWntNYq2TRAAAAAc"]
[Wed Apr 15 21:47:06.928924 2026] [:error] [pid 30956:tid 30975] [client 68.221.132.192:62921] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "ad-W2kBGUpjaWntNYq2TRgAAAA8"]
[Wed Apr 15 21:47:07.409887 2026] [:error] [pid 31053:tid 31076] [client 68.221.132.192:42439] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "ad-W2xcEkLCmvF0fjDcMmAAAAJQ"]
[Wed Apr 15 21:47:07.908547 2026] [:error] [pid 31053:tid 31064] [client 68.221.132.192:4928] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "ad-W2xcEkLCmvF0fjDcMoQAAAIg"]
[Wed Apr 15 21:47:08.388322 2026] [:error] [pid 31053:tid 31057] [client 68.221.132.192:41605] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "ad-W3BcEkLCmvF0fjDcMrAAAAIE"]
[Wed Apr 15 21:47:08.883153 2026] [:error] [pid 37370:tid 37379] [client 68.221.132.192:42927] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "ad-W3Hg-gnM2Ga0cGACFhwAAAQc"]
[Wed Apr 15 21:47:09.373886 2026] [:error] [pid 31053:tid 31062] [client 68.221.132.192:57541] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/admin.php"] [unique_id "ad-W3RcEkLCmvF0fjDcMsAAAAIY"]
[Wed Apr 15 21:47:09.860529 2026] [:error] [pid 30958:tid 31025] [client 68.221.132.192:42483] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "ad-W3ceG3wSKTO7NWFHQEQAAAMk"]
[Wed Apr 15 21:47:10.340097 2026] [:error] [pid 23913:tid 23931] [client 68.221.132.192:44378] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "ad-W3lUaK3MLdSaLOyixDQAAAVA"]
[Wed Apr 15 21:47:10.823868 2026] [:error] [pid 31053:tid 31076] [client 68.221.132.192:43612] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "ad-W3hcEkLCmvF0fjDcMtwAAAJQ"]
[Wed Apr 15 21:47:11.303776 2026] [:error] [pid 30957:tid 31001] [client 68.221.132.192:43635] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "ad-W335gwVEVXHfVSiqqjgAAAEw"]
[Wed Apr 15 21:47:11.788404 2026] [:error] [pid 23913:tid 23916] [client 68.221.132.192:42450] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "ad-W31UaK3MLdSaLOyixGgAAAUE"]
[Wed Apr 15 21:47:12.266596 2026] [:error] [pid 23913:tid 23929] [client 68.221.132.192:57565] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "ad-W4FUaK3MLdSaLOyixHgAAAU4"]
[Wed Apr 15 21:47:12.745319 2026] [:error] [pid 30957:tid 31005] [client 68.221.132.192:42909] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "ad-W4H5gwVEVXHfVSiqqkwAAAFA"]
[Wed Apr 15 21:47:13.225179 2026] [:error] [pid 31053:tid 31067] [client 68.221.132.192:62924] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "ad-W4RcEkLCmvF0fjDcMyQAAAIs"]
[Wed Apr 15 21:47:13.710010 2026] [:error] [pid 30956:tid 30981] [client 68.221.132.192:57579] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad-W4UBGUpjaWntNYq2TVgAAABU"]
[Wed Apr 15 21:47:14.191441 2026] [:error] [pid 30957:tid 31004] [client 68.221.132.192:57595] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad-W4n5gwVEVXHfVSiqqlwAAAE8"]
[Wed Apr 15 21:47:14.671794 2026] [:error] [pid 37370:tid 37391] [client 68.221.132.192:32756] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad-W4ng-gnM2Ga0cGACFlwAAARM"]
[Wed Apr 15 21:47:15.150131 2026] [:error] [pid 37370:tid 37389] [client 68.221.132.192:42921] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad-W43g-gnM2Ga0cGACFmwAAARE"]
[Wed Apr 15 21:47:15.628063 2026] [:error] [pid 30956:tid 30973] [client 68.221.132.192:42460] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "ad-W40BGUpjaWntNYq2TXAAAAA0"]
[Wed Apr 15 21:47:16.108377 2026] [:error] [pid 30958:tid 31017] [client 68.221.132.192:32756] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "ad-W5MeG3wSKTO7NWFHQIQAAAME"]
[Wed Apr 15 21:47:16.592554 2026] [:error] [pid 30958:tid 31025] [client 68.221.132.192:32649] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "ad-W5MeG3wSKTO7NWFHQIgAAAMk"]
[Wed Apr 15 21:47:17.071487 2026] [:error] [pid 23913:tid 23937] [client 68.221.132.192:32679] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "ad-W5VUaK3MLdSaLOyixQAAAAVY"]
[Wed Apr 15 21:47:17.550487 2026] [:error] [pid 31053:tid 31060] [client 68.221.132.192:4991] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "ad-W5RcEkLCmvF0fjDcM4gAAAIQ"]
[Wed Apr 15 21:47:18.030907 2026] [:error] [pid 30957:tid 31010] [client 68.221.132.192:4975] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "ad-W5n5gwVEVXHfVSiqqogAAAFU"]
[Wed Apr 15 21:47:18.511558 2026] [:error] [pid 30958:tid 31024] [client 68.221.132.192:4785] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "ad-W5seG3wSKTO7NWFHQLQAAAMg"]
[Wed Apr 15 21:47:18.993616 2026] [:error] [pid 23913:tid 23919] [client 68.221.132.192:43614] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "ad-W5lUaK3MLdSaLOyixTQAAAUQ"]
[Wed Apr 15 21:47:19.472246 2026] [:error] [pid 30958:tid 31040] [client 68.221.132.192:39607] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "ad-W58eG3wSKTO7NWFHQMAAAANg"]
[Wed Apr 15 21:47:19.953248 2026] [:error] [pid 30956:tid 30973] [client 68.221.132.192:42918] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "ad-W50BGUpjaWntNYq2TbQAAAA0"]
[Wed Apr 15 21:47:20.437698 2026] [:error] [pid 30956:tid 30982] [client 68.221.132.192:62919] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "ad-W6EBGUpjaWntNYq2TdgAAABY"]
[Wed Apr 15 21:47:20.921660 2026] [:error] [pid 30958:tid 31025] [client 68.221.132.192:32686] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "ad-W6MeG3wSKTO7NWFHQNwAAAMk"]
[Wed Apr 15 21:47:21.399669 2026] [:error] [pid 31053:tid 31064] [client 68.221.132.192:62964] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "ad-W6RcEkLCmvF0fjDcM9wAAAIg"]
[Wed Apr 15 21:47:21.882532 2026] [:error] [pid 30956:tid 30966] [client 68.221.132.192:32710] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "ad-W6UBGUpjaWntNYq2TgAAAAAY"]
[Wed Apr 15 21:47:22.363446 2026] [:error] [pid 30957:tid 31004] [client 68.221.132.192:62946] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "ad-W6n5gwVEVXHfVSiqquwAAAE8"]
[Wed Apr 15 21:47:22.841097 2026] [:error] [pid 30956:tid 30968] [client 68.221.132.192:42902] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/default.php"] [unique_id "ad-W6kBGUpjaWntNYq2TiAAAAAg"]
[Wed Apr 15 21:47:23.319359 2026] [:error] [pid 30956:tid 30979] [client 68.221.132.192:32652] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "ad-W60BGUpjaWntNYq2TjAAAABM"]
[Wed Apr 15 21:47:23.803359 2026] [:error] [pid 23913:tid 23924] [client 68.221.132.192:25087] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "ad-W61UaK3MLdSaLOyixdAAAAUk"]
[Wed Apr 15 21:47:24.281131 2026] [:error] [pid 31053:tid 31060] [client 68.221.132.192:38436] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "ad-W7BcEkLCmvF0fjDcNBwAAAIQ"]
[Wed Apr 15 21:47:24.762468 2026] [:error] [pid 30958:tid 31035] [client 68.221.132.192:57562] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "ad-W7MeG3wSKTO7NWFHQQwAAANM"]
[Wed Apr 15 21:47:25.241775 2026] [:error] [pid 30957:tid 31013] [client 68.221.132.192:62950] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file61.php"] [unique_id "ad-W7X5gwVEVXHfVSiqqvwAAAFg"]
[Wed Apr 15 21:47:25.720328 2026] [:error] [pid 31053:tid 31060] [client 68.221.132.192:42924] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file61.php"] [unique_id "ad-W7RcEkLCmvF0fjDcNEwAAAIQ"]
[Wed Apr 15 21:47:26.201638 2026] [:error] [pid 30957:tid 31001] [client 68.221.132.192:4778] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file61.php"] [unique_id "ad-W7n5gwVEVXHfVSiqqwwAAAEw"]
[Wed Apr 15 21:47:26.686336 2026] [:error] [pid 31053:tid 31072] [client 68.221.132.192:43632] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file61.php"] [unique_id "ad-W7hcEkLCmvF0fjDcNHgAAAJA"]
[Wed Apr 15 21:47:27.173958 2026] [:error] [pid 37370:tid 37389] [client 68.221.132.192:42892] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "ad-W73g-gnM2Ga0cGACFyAAAARE"]
[Wed Apr 15 21:47:27.658648 2026] [:error] [pid 30956:tid 30966] [client 68.221.132.192:50536] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "ad-W70BGUpjaWntNYq2TmwAAAAY"]
[Wed Apr 15 21:47:28.152930 2026] [:error] [pid 23913:tid 23930] [client 68.221.132.192:42919] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "ad-W8FUaK3MLdSaLOyixkQAAAU8"]
[Wed Apr 15 21:47:28.639291 2026] [:error] [pid 23913:tid 23921] [client 68.221.132.192:42452] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "ad-W8FUaK3MLdSaLOyixlwAAAUY"]
[Wed Apr 15 21:47:29.117895 2026] [:error] [pid 30958:tid 31035] [client 68.221.132.192:4957] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d.php"] [unique_id "ad-W8ceG3wSKTO7NWFHQVgAAANM"]
[Wed Apr 15 21:47:29.598063 2026] [:error] [pid 30956:tid 30974] [client 68.221.132.192:42930] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d.php"] [unique_id "ad-W8UBGUpjaWntNYq2TpAAAAA4"]
[Wed Apr 15 21:47:30.076165 2026] [:error] [pid 30956:tid 30978] [client 68.221.132.192:41610] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d.php"] [unique_id "ad-W8kBGUpjaWntNYq2TpgAAABI"]
[Wed Apr 15 21:47:30.554785 2026] [:error] [pid 30956:tid 30983] [client 68.221.132.192:32759] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/d.php"] [unique_id "ad-W8kBGUpjaWntNYq2TqwAAABc"]
[Wed Apr 15 21:47:31.032897 2026] [:error] [pid 37370:tid 37372] [client 68.221.132.192:36803] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "ad-W83g-gnM2Ga0cGACF5QAAAQA"]
[Wed Apr 15 21:47:31.510710 2026] [:error] [pid 23913:tid 23924] [client 68.221.132.192:4741] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "ad-W81UaK3MLdSaLOyixqgAAAUk"]
[Wed Apr 15 21:47:31.988271 2026] [:error] [pid 31053:tid 31075] [client 68.221.132.192:40872] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "ad-W8xcEkLCmvF0fjDcNPAAAAJM"]
[Wed Apr 15 21:47:32.469530 2026] [:error] [pid 23913:tid 23935] [client 68.221.132.192:50542] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "ad-W9FUaK3MLdSaLOyixtAAAAVQ"]
[Wed Apr 15 21:47:32.948451 2026] [:error] [pid 30957:tid 30999] [client 68.221.132.192:32641] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admins.php"] [unique_id "ad-W9H5gwVEVXHfVSiqqxwAAAEo"]
[Wed Apr 15 21:47:33.426944 2026] [:error] [pid 23913:tid 23931] [client 68.221.132.192:42487] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admins.php"] [unique_id "ad-W9VUaK3MLdSaLOyixvQAAAVA"]
[Wed Apr 15 21:47:33.910833 2026] [:error] [pid 30956:tid 30977] [client 68.221.132.192:4737] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admins.php"] [unique_id "ad-W9UBGUpjaWntNYq2TxAAAABE"]
[Wed Apr 15 21:47:34.389921 2026] [:error] [pid 37370:tid 37391] [client 68.221.132.192:41601] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admins.php"] [unique_id "ad-W9ng-gnM2Ga0cGACF6wAAARM"]
[Wed Apr 15 21:47:34.868519 2026] [:error] [pid 37370:tid 37386] [client 68.221.132.192:50516] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config-sample.php"] [unique_id "ad-W9ng-gnM2Ga0cGACF7QAAAQ4"]
[Wed Apr 15 21:47:35.346247 2026] [:error] [pid 23913:tid 23922] [client 68.221.132.192:32655] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config-sample.php"] [unique_id "ad-W91UaK3MLdSaLOyixxQAAAUc"]
[Wed Apr 15 21:47:35.823718 2026] [:error] [pid 31053:tid 31077] [client 68.221.132.192:42444] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config-sample.php"] [unique_id "ad-W9xcEkLCmvF0fjDcNYQAAAJU"]
[Wed Apr 15 21:47:36.306644 2026] [:error] [pid 30956:tid 30972] [client 68.221.132.192:32751] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-config-sample.php"] [unique_id "ad-W-EBGUpjaWntNYq2T0gAAAAw"]
[Wed Apr 15 21:47:36.787199 2026] [:error] [pid 31053:tid 31065] [client 68.221.132.192:50553] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file6.php"] [unique_id "ad-W-BcEkLCmvF0fjDcNZAAAAIk"]
[Wed Apr 15 21:47:37.266351 2026] [:error] [pid 30958:tid 31030] [client 68.221.132.192:57596] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file6.php"] [unique_id "ad-W-ceG3wSKTO7NWFHQdgAAAM4"]
[Wed Apr 15 21:47:37.746739 2026] [:error] [pid 31053:tid 31079] [client 68.221.132.192:57542] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file6.php"] [unique_id "ad-W-RcEkLCmvF0fjDcNZgAAAJc"]
[Wed Apr 15 21:47:38.224722 2026] [:error] [pid 30956:tid 30976] [client 68.221.132.192:43622] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file6.php"] [unique_id "ad-W-kBGUpjaWntNYq2T0wAAABA"]
[Wed Apr 15 21:47:38.702441 2026] [:error] [pid 23913:tid 23931] [client 68.221.132.192:42449] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up.php"] [unique_id "ad-W-lUaK3MLdSaLOyix1gAAAVA"]
[Wed Apr 15 21:47:39.183385 2026] [:error] [pid 37370:tid 37382] [client 68.221.132.192:4781] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up.php"] [unique_id "ad-W-3g-gnM2Ga0cGACGAAAAAQo"]
[Wed Apr 15 21:47:39.667221 2026] [:error] [pid 23913:tid 23925] [client 68.221.132.192:44363] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up.php"] [unique_id "ad-W-1UaK3MLdSaLOyix3gAAAUo"]
[Wed Apr 15 21:47:40.147081 2026] [:error] [pid 37370:tid 37385] [client 68.221.132.192:50498] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/up.php"] [unique_id "ad-W_Hg-gnM2Ga0cGACGAwAAAQ0"]
[Wed Apr 15 21:47:40.625956 2026] [:error] [pid 31053:tid 31069] [client 68.221.132.192:4958] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi002.PhP7"] [unique_id "ad-W_BcEkLCmvF0fjDcNeQAAAI0"]
[Wed Apr 15 21:47:41.107880 2026] [:error] [pid 31053:tid 31077] [client 68.221.132.192:42479] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi002.PhP7"] [unique_id "ad-W_RcEkLCmvF0fjDcNfwAAAJU"]
[Wed Apr 15 21:47:41.589340 2026] [:error] [pid 31053:tid 31071] [client 68.221.132.192:4963] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi002.PhP7"] [unique_id "ad-W_RcEkLCmvF0fjDcNhAAAAI8"]
[Wed Apr 15 21:47:42.070778 2026] [:error] [pid 30957:tid 31010] [client 68.221.132.192:38432] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi002.PhP7"] [unique_id "ad-W_n5gwVEVXHfVSiqq0gAAAFU"]
[Wed Apr 15 21:47:42.553071 2026] [:error] [pid 31053:tid 31078] [client 68.221.132.192:4945] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ad-W_hcEkLCmvF0fjDcNiAAAAJY"]
[Wed Apr 15 21:47:43.036593 2026] [:error] [pid 37370:tid 37382] [client 68.221.132.192:62943] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ad-W_3g-gnM2Ga0cGACGFAAAAQo"]
[Wed Apr 15 21:47:43.515008 2026] [:error] [pid 37370:tid 37390] [client 68.221.132.192:41616] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ad-W_3g-gnM2Ga0cGACGGgAAARI"]
[Wed Apr 15 21:47:43.995621 2026] [:error] [pid 30957:tid 30992] [client 68.221.132.192:61625] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ad-W_35gwVEVXHfVSiqq4wAAAEM"]
[Wed Apr 15 21:47:44.475223 2026] [:error] [pid 31053:tid 31068] [client 68.221.132.192:57555] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "ad-XABcEkLCmvF0fjDcNkAAAAIw"]
[Wed Apr 15 21:47:44.956112 2026] [:error] [pid 30957:tid 31013] [client 68.221.132.192:41662] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "ad-XAH5gwVEVXHfVSiqq5wAAAFg"]
[Wed Apr 15 21:47:45.435644 2026] [:error] [pid 37370:tid 37373] [client 68.221.132.192:44365] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "ad-XAXg-gnM2Ga0cGACGIQAAAQE"]
[Wed Apr 15 21:47:45.918844 2026] [:error] [pid 30958:tid 31033] [client 68.221.132.192:41661] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "ad-XAceG3wSKTO7NWFHQqAAAANE"]
[Wed Apr 15 21:47:46.397015 2026] [:error] [pid 30957:tid 31001] [client 68.221.132.192:36816] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ca.php"] [unique_id "ad-XAn5gwVEVXHfVSiqq6wAAAEw"]
[Wed Apr 15 21:47:46.877593 2026] [:error] [pid 30957:tid 31006] [client 68.221.132.192:36822] [client 68.221.132.192] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ca.php"] [unique_id "ad-XAn5gwVEVXHfVSiqq7wAAAFE"]
[Thu Apr 16 00:11:05.053524 2026] [:error] [pid 23913:tid 23927] [client 173.239.254.43:51245] [client 173.239.254.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.254.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad-4mVUaK3MLdSaLOyjvPwAAAUw"]
[Thu Apr 16 00:50:42.880903 2026] [:error] [pid 30957:tid 31002] [client 104.164.173.211:5198] [client 104.164.173.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.164.173.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/https%3A/expressinteriors.com/xmlrpc.php%3Frsd"] [unique_id "ad_B4n5gwVEVXHfVSirYNwAAAE0"]
[Thu Apr 16 00:51:40.458774 2026] [:error] [pid 30957:tid 30993] [client 103.4.251.3:50752] [client 103.4.251.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.251.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/https%3A/expressinteriors.com/xmlrpc.php%3Frsd"] [unique_id "ad_CHH5gwVEVXHfVSirYYQAAAEQ"]
[Thu Apr 16 01:06:18.490394 2026] [:error] [pid 16664:tid 16742] [client 104.252.191.117:19900] [client 104.252.191.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.252.191.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/https%3A/expressinteriors.com/xmlrpc.php%3Frsd"] [unique_id "ad_Fijdzt684awDJwRTeigAAAZc"]
[Thu Apr 16 01:06:21.089488 2026] [:error] [pid 30958:tid 31025] [client 104.252.191.117:20060] [client 104.252.191.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/https%3A/gmpg.org/xfn/https%3A/gmpg.org/xfn/11"] [unique_id "ad_FjceG3wSKTO7NWFEQSQAAAMk"]
[Thu Apr 16 01:06:21.141403 2026] [:error] [pid 23913:tid 23934] [client 104.252.191.117:20140] [client 104.252.191.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/https%3A/gmpg.org/xfn/https%3A/expressinteriors.com/wp-json/"] [unique_id "ad_FjVUaK3MLdSaLOygQrAAAAVM"]
[Thu Apr 16 01:06:21.142350 2026] [:error] [pid 23913:tid 23924] [client 104.252.191.117:20136] [client 104.252.191.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/https%3A/gmpg.org/xfn/%23content"] [unique_id "ad_FjVUaK3MLdSaLOygQrQAAAUk"]
[Thu Apr 16 01:06:21.153545 2026] [:error] [pid 16664:tid 16733] [client 104.252.191.117:20154] [client 104.252.191.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/https%3A/gmpg.org/xfn/https%3A/expressinteriors.com/xmlrpc.php%3Frsd"] [unique_id "ad_FjTdzt684awDJwRTelgAAAY4"]
[Thu Apr 16 01:06:21.165967 2026] [:error] [pid 23913:tid 23935] [client 104.252.191.117:20076] [client 104.252.191.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/https%3A/gmpg.org/xfn/https%3A/expressinteriors.com/wp-content/themes/astra/assets/css/minified/main.min.css%3Fver%3D4.0.2"] [unique_id "ad_FjVUaK3MLdSaLOygQrwAAAVQ"]
[Thu Apr 16 01:06:21.175470 2026] [:error] [pid 23913:tid 23919] [client 104.252.191.117:20134] [client 104.252.191.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/https%3A/gmpg.org/xfn/https%3A/expressinteriors.com/comments/feed/"] [unique_id "ad_FjVUaK3MLdSaLOygQsAAAAUQ"]
[Thu Apr 16 01:06:21.200904 2026] [:error] [pid 23913:tid 23927] [client 104.252.191.117:20132] [client 104.252.191.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/https%3A/gmpg.org/xfn/https%3A/expressinteriors.com/wp-content/uploads/useanyfont/uaf.css%3Fver%3D1677478928"] [unique_id "ad_FjVUaK3MLdSaLOygQsQAAAUw"]
[Thu Apr 16 01:06:21.212034 2026] [:error] [pid 30958:tid 31034] [client 104.252.191.117:20116] [client 104.252.191.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/https%3A/gmpg.org/xfn/https%3A/expressinteriors.com/wp-content/themes/astra/assets/css/minified/compatibility/contact-form-7-main.min.css%3Fver%3D4.0.2"] [unique_id "ad_FjceG3wSKTO7NWFEQSwAAANI"]
[Thu Apr 16 01:06:21.247811 2026] [:error] [pid 30958:tid 31032] [client 104.252.191.117:20098] [client 104.252.191.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/https%3A/gmpg.org/xfn/https%3A/expressinteriors.com/wp-includes/css/dist/block-library/style.min.css%3Fver%3D6.9.4"] [unique_id "ad_FjceG3wSKTO7NWFEQTAAAANA"]
[Thu Apr 16 01:06:21.250607 2026] [:error] [pid 30958:tid 31033] [client 104.252.191.117:20062] [client 104.252.191.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/https%3A/gmpg.org/xfn/https%3A/expressinteriors.com/feed/"] [unique_id "ad_FjceG3wSKTO7NWFEQTQAAANE"]
[Thu Apr 16 01:43:05.660581 2026] [:error] [pid 30956:tid 30967] [client 172.68.195.159:9601] [client 172.68.195.159] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ad_OKUBGUpjaWntNYq3E4wAAAAc"]
[Thu Apr 16 02:28:30.282338 2026] [:error] [pid 54814:tid 54840] [client 216.73.216.46:55608] [client 216.73.216.46] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||www.expressinteriors.com|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/robots.txt"] [unique_id "ad_YzjrHu_-tAAe-BOW4BQAAAZQ"]
[Thu Apr 16 02:28:31.013471 2026] [:error] [pid 34542:tid 34562] [client 216.73.216.46:27947] [client 216.73.216.46] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||expressinteriors.com|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/robots.txt"] [unique_id "ad_YzwdF4OGi-asleB6b9AAAAVI"], referer: https://www.expressinteriors.com/robots.txt
[Thu Apr 16 03:12:47.173380 2026] [:error] [pid 20548:tid 20570] [client 193.19.109.215:65397] [client 193.19.109.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad_jL6kpqgnqCHq6bJbYcwAAAJM"]
[Thu Apr 16 03:30:20.161319 2026] [:error] [pid 52897:tid 52936] [client 193.19.109.237:38943] [client 193.19.109.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.237, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad_nTAq344eHXyGigQ1cHgAAAIg"]
[Thu Apr 16 03:30:21.785232 2026] [:error] [pid 52897:tid 52936] [client 193.19.109.237:38943] [client 193.19.109.237] ModSecurity: Audit log: Failed to lock global mutex: Invalid argument [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad_nTAq344eHXyGigQ1cHgAAAIg"]
[Thu Apr 16 03:30:21.785458 2026] [:error] [pid 52897:tid 52936] [client 193.19.109.237:38943] [client 193.19.109.237] ModSecurity: Audit log: Failed to unlock global mutex: Invalid argument [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad_nTAq344eHXyGigQ1cHgAAAIg"]
[Thu Apr 16 03:47:28.856289 2026] [:error] [pid 27094:tid 27098] [client 193.19.109.228:23703] [client 193.19.109.228] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.228, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad_rUEp8xZTAwXToMIHEigAAAMI"]
[Thu Apr 16 03:55:17.890963 2026] [:error] [pid 57536:tid 57557] [client 164.92.212.216:39002] [client 164.92.212.216] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/wp-content/debug.log"] [unique_id "ad_tJSQU4faGja6jpDtfEAAAAAk"]
[Thu Apr 16 03:55:17.895913 2026] [:error] [pid 57538:tid 57603] [client 164.92.212.216:39024] [client 164.92.212.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.92.212.216, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad_tJcuMaiEF5SVR2BfuoAAAAIE"]
[Thu Apr 16 04:05:49.317739 2026] [:error] [pid 57537:tid 57586] [client 193.37.33.3:39645] [client 193.37.33.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.33.3, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad_vnVVQRS8nm73ENAkLlQAAAEs"]
[Thu Apr 16 04:24:57.034526 2026] [:error] [pid 57536:tid 57549] [client 216.73.216.46:42981] [client 216.73.216.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.73.216.46, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad_0GSQU4faGja6jpDtnvgAAAAE"]
[Thu Apr 16 04:25:59.793221 2026] [:error] [pid 29603:tid 29607] [client 193.37.33.1:52163] [client 193.37.33.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.33.1, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad_0V1fGOR6fpTWUAzp1aAAAAQI"]
[Thu Apr 16 04:46:26.516451 2026] [:error] [pid 57536:tid 57548] [client 193.37.33.5:29243] [client 193.37.33.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.33.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad_5IiQU4faGja6jpDttTQAAAAA"]
[Thu Apr 16 04:57:23.226318 2026] [:error] [pid 57537:tid 57588] [client 74.7.241.5:59246] [client 74.7.241.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.7.241.5, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ad_7s1VQRS8nm73ENAkcgQAAAE0"], referer: https://expressinteriors.com/
[Thu Apr 16 05:06:39.555688 2026] [:error] [pid 57536:tid 57558] [client 193.19.109.225:20679] [client 193.19.109.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ad_93yQU4faGja6jpDtyXAAAAAo"]
[Thu Apr 16 05:07:17.379649 2026] [:error] [pid 57639:tid 57652] [client 43.157.158.178:35738] [client 43.157.158.178] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ad_-BaMCQoTw7TsxWumwVQAAAMY"]
[Thu Apr 16 05:21:44.745378 2026] [:error] [pid 57538:tid 57618] [client 103.100.188.109:50604] [client 103.100.188.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.100.188.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeABaMuMaiEF5SVR2Bce8gAAAJA"]
[Thu Apr 16 05:26:16.395156 2026] [autoindex:error] [pid 29603:tid 29613] [client 151.158.1.202:36963] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 16 05:27:08.964846 2026] [:error] [pid 49094:tid 49108] [client 193.19.109.229:23175] [client 193.19.109.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeACrDbDwvcXorHR_MxpKgAAAUw"]
[Thu Apr 16 05:47:19.916596 2026] [:error] [pid 57639:tid 57648] [client 193.19.109.237:41939] [client 193.19.109.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.237, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeAHZ6MCQoTw7TsxWunBTQAAAMI"]
[Thu Apr 16 06:07:43.162866 2026] [:error] [pid 57538:tid 57611] [client 193.19.109.216:33591] [client 193.19.109.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeAML8uMaiEF5SVR2BcxXgAAAIk"]
[Thu Apr 16 06:28:18.571567 2026] [:error] [pid 57639:tid 57650] [client 193.19.109.229:55687] [client 193.19.109.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeARAqMCQoTw7TsxWunI7AAAAMQ"]
[Thu Apr 16 06:48:52.283485 2026] [:error] [pid 49094:tid 49097] [client 193.19.109.249:27859] [client 193.19.109.249] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.249, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeAV1DbDwvcXorHR_MyePAAAAUE"]
[Thu Apr 16 07:09:09.851282 2026] [:error] [pid 49094:tid 49119] [client 193.19.109.227:22457] [client 193.19.109.227] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.227, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeAalTbDwvcXorHR_MyqfgAAAVc"]
[Thu Apr 16 07:20:40.671366 2026] [:error] [pid 29603:tid 29609] [client 40.115.139.4:2544] [client 40.115.139.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.dj/index.php"] [unique_id "aeAdSFfGOR6fpTWUAzrewwAAAQQ"]
[Thu Apr 16 07:20:41.141048 2026] [:error] [pid 57538:tid 57617] [client 40.115.139.4:3069] [client 40.115.139.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.dj/index.php"] [unique_id "aeAdScuMaiEF5SVR2BdIgAAAAI8"]
[Thu Apr 16 07:20:41.646793 2026] [:error] [pid 49094:tid 49096] [client 40.115.139.4:4635] [client 40.115.139.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.dj/index.php"] [unique_id "aeAdSTbDwvcXorHR_MyvlQAAAUA"]
[Thu Apr 16 07:20:42.105580 2026] [:error] [pid 57537:tid 57587] [client 40.115.139.4:3659] [client 40.115.139.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.dj/index.php"] [unique_id "aeAdSlVQRS8nm73ENAk-NwAAAEw"]
[Thu Apr 16 07:29:47.870019 2026] [:error] [pid 57639:tid 57646] [client 193.19.109.214:21483] [client 193.19.109.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.214, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeAfa6MCQoTw7TsxWunZLgAAAMA"]
[Thu Apr 16 07:33:34.602937 2026] [:error] [pid 57536:tid 57563] [client 43.135.142.37:37130] [client 43.135.142.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeAgTiQU4faGja6jpDuL1gAAAA8"]
[Thu Apr 16 07:50:16.520865 2026] [:error] [pid 57639:tid 57666] [client 193.19.109.250:41709] [client 193.19.109.250] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.250, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeAkOKMCQoTw7TsxWunmmAAAANQ"]
[Thu Apr 16 08:10:50.778775 2026] [:error] [pid 29603:tid 29609] [client 193.19.109.222:51855] [client 193.19.109.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.222, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeApClfGOR6fpTWUAzrxKQAAAQQ"]
[Thu Apr 16 08:31:30.118872 2026] [:error] [pid 57639:tid 57656] [client 193.19.109.231:52929] [client 193.19.109.231] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.231, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeAt4qMCQoTw7TsxWun_1wAAAMo"]
[Thu Apr 16 08:51:56.289294 2026] [:error] [pid 57537:tid 57585] [client 193.19.109.213:30527] [client 193.19.109.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.213, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeAyrFVQRS8nm73ENAlS8gAAAEo"]
[Thu Apr 16 09:12:15.962142 2026] [:error] [pid 29603:tid 29621] [client 193.19.109.244:63365] [client 193.19.109.244] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.244, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeA3b1fGOR6fpTWUAzoHLwAAARA"]
[Thu Apr 16 09:14:09.188666 2026] [:error] [pid 57639:tid 57666] [client 203.2.64.59:40795] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aeA34aMCQoTw7TsxWukapQAAANQ"]
[Thu Apr 16 09:32:41.463341 2026] [:error] [pid 57639:tid 57658] [client 193.19.109.241:59603] [client 193.19.109.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.241, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeA8OaMCQoTw7TsxWukjKAAAAMw"]
[Thu Apr 16 09:44:15.975790 2026] [:error] [pid 57639:tid 57651] [client 36.77.222.136:30237] [client 36.77.222.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.77.222.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeA-76MCQoTw7TsxWukoZwAAAMU"]
[Thu Apr 16 09:44:26.574637 2026] [:error] [pid 57639:tid 57663] [client 36.77.222.136:50467] [client 36.77.222.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.77.222.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeA--qMCQoTw7TsxWukoeAAAANE"]
[Thu Apr 16 09:44:37.127349 2026] [:error] [pid 49094:tid 49104] [client 36.77.222.136:30977] [client 36.77.222.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.77.222.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeA_BTbDwvcXorHR_MzuiQAAAUg"]
[Thu Apr 16 09:44:48.023609 2026] [:error] [pid 29603:tid 29622] [client 36.77.222.136:16035] [client 36.77.222.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.77.222.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeA_EFfGOR6fpTWUAzoOrwAAARE"]
[Thu Apr 16 09:44:58.540806 2026] [:error] [pid 49094:tid 49115] [client 36.77.222.136:51190] [client 36.77.222.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.77.222.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeA_GjbDwvcXorHR_MzukgAAAVM"]
[Thu Apr 16 09:45:09.223471 2026] [:error] [pid 57538:tid 57618] [client 36.77.222.136:31891] [client 36.77.222.136] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.77.222.136, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeA_JcuMaiEF5SVR2BdrwAAAAJA"]
[Thu Apr 16 09:53:20.502141 2026] [:error] [pid 57639:tid 57650] [client 193.19.109.230:62411] [client 193.19.109.230] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.230, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeBBEKMCQoTw7TsxWuktVgAAAMQ"]
[Thu Apr 16 09:54:15.867785 2026] [autoindex:error] [pid 29603:tid 29618] [client 82.26.82.157:34531] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 16 10:13:28.499756 2026] [:error] [pid 57536:tid 57554] [client 193.19.109.240:29541] [client 193.19.109.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.19.109.240, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeBFyCQU4faGja6jpDumlAAAAAY"]
[Thu Apr 16 11:09:36.260867 2026] [:error] [pid 57639:tid 57648] [client 98.93.160.221:43224] [client 98.93.160.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aeBS8KMCQoTw7TsxWulUIgAAAMI"]
[Thu Apr 16 12:11:16.458590 2026] [:error] [pid 57536:tid 57551] [client 158.173.20.23:31663] [client 158.173.20.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 158.173.20.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeBhZCQU4faGja6jpDu2DwAAAAM"], referer: https://expressinteriors.com/wp-login.php?action=register
[Thu Apr 16 12:11:18.183921 2026] [:error] [pid 49094:tid 49108] [client 158.173.20.23:4463] [client 158.173.20.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 158.173.20.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeBhZjbDwvcXorHR_MwakgAAAUw"], referer: https://expressinteriors.com/wp-login.php?registration=disabled
[Thu Apr 16 12:49:46.133945 2026] [:error] [pid 57639:tid 57650] [client 59.97.84.255:53697] [client 59.97.84.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.97.84.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeBqaqMCQoTw7TsxWul4zgAAAMQ"]
[Thu Apr 16 12:49:56.064052 2026] [:error] [pid 57536:tid 57550] [client 59.97.84.255:54011] [client 59.97.84.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.97.84.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeBqdCQU4faGja6jpDvNygAAAAI"]
[Thu Apr 16 12:50:06.614696 2026] [:error] [pid 57639:tid 57658] [client 59.97.84.255:54419] [client 59.97.84.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.97.84.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeBqfqMCQoTw7TsxWul46gAAAMw"]
[Thu Apr 16 12:50:17.306204 2026] [:error] [pid 57639:tid 57669] [client 59.97.84.255:54698] [client 59.97.84.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.97.84.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeBqiaMCQoTw7TsxWul5AAAAANc"]
[Thu Apr 16 12:50:27.811725 2026] [:error] [pid 57538:tid 57604] [client 59.97.84.255:54956] [client 59.97.84.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.97.84.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeBqk8uMaiEF5SVR2BeKgwAAAII"]
[Thu Apr 16 14:07:59.835903 2026] [:error] [pid 57536:tid 57558] [client 43.228.157.68:37630] [client 43.228.157.68] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/HEAD"] [unique_id "aeB8vyQU4faGja6jpDvkNQAAAAo"]
[Thu Apr 16 14:41:29.318096 2026] [:error] [pid 7880:tid 7898] [client 103.4.122.14:34422] [client 103.4.122.14] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "8.218.0.141_08bcdb8b5addbb80b0dcf079559495f42e13bcbd"): Internal error (specific information not available) [hostname "expressinteriors.com"] [uri "/wp-cron.php"] [unique_id "aeCElqaezm4fSGc0yUI6aAAAAY0"]
[Thu Apr 16 14:41:56.319948 2026] [:error] [pid 57538:tid 57621] [client 103.4.250.145:17484] [client 103.4.250.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.250.145, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/https%3A/expressinteriors.com/xmlrpc.php%3Frsd"] [unique_id "aeCEtMuMaiEF5SVR2BeXpAAAAJM"]
[Thu Apr 16 14:41:57.880721 2026] [:error] [pid 29603:tid 29626] [client 103.4.250.145:17718] [client 103.4.250.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.250.145, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/https%3A/gmpg.org/xfn/https%3A/expressinteriors.com/xmlrpc.php%3Frsd"] [unique_id "aeCEtVfGOR6fpTWUAzpD1AAAARU"]
[Thu Apr 16 14:41:57.897591 2026] [:error] [pid 57538:tid 57616] [client 103.4.250.145:17618] [client 103.4.250.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/https%3A/gmpg.org/xfn/https%3A/expressinteriors.com/wp-content/themes/astra/assets/css/minified/main.min.css%3Fver%3D4.0.2"] [unique_id "aeCEtcuMaiEF5SVR2BeXrAAAAI4"]
[Thu Apr 16 14:41:57.908442 2026] [:error] [pid 57538:tid 57604] [client 103.4.250.145:17684] [client 103.4.250.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/https%3A/gmpg.org/xfn/%23content"] [unique_id "aeCEtcuMaiEF5SVR2BeXrQAAAII"]
[Thu Apr 16 14:41:57.946273 2026] [:error] [pid 29603:tid 29606] [client 103.4.250.145:17646] [client 103.4.250.145] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/https%3A/gmpg.org/xfn/https%3A/fonts.googleapis.com/css%3Ffamily%3DOpen%2BSans%3A400%7CPlayfair%2BDisplay%3A600%2C700%26display%3Dfallback%26ver%3D4.0.2"] [unique_id "aeCEtVfGOR6fpTWUAzpD1QAAAQE"]
[Thu Apr 16 15:46:32.715535 2026] [:error] [pid 57639:tid 57663] [client 43.153.86.78:47868] [client 43.153.86.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aeCT2KMCQoTw7TsxWunBggAAANE"]
[Thu Apr 16 15:50:22.318126 2026] [:error] [pid 57538:tid 57626] [client 103.4.250.121:38320] [client 103.4.250.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.250.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/https%3A/expressinteriors.com/xmlrpc.php%3Frsd"] [unique_id "aeCUvsuMaiEF5SVR2Bee3AAAAJg"]
[Thu Apr 16 17:43:02.659533 2026] [:error] [pid 57639:tid 57668] [client 170.106.11.6:54474] [client 170.106.11.6] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeCvJqMCQoTw7TsxWukEKwAAANY"]
[Thu Apr 16 18:06:41.490863 2026] [:error] [pid 57536:tid 57559] [client 117.207.59.1:59482] [client 117.207.59.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.207.59.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeC0sSQU4faGja6jpDsrTgAAAAs"]
[Thu Apr 16 18:07:41.519514 2026] [:error] [pid 7880:tid 7902] [client 117.207.59.1:12713] [client 117.207.59.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.207.59.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeC07aaezm4fSGc0yUJpmgAAAZE"]
[Thu Apr 16 18:07:52.203717 2026] [:error] [pid 57537:tid 57595] [client 117.207.59.1:49231] [client 117.207.59.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.207.59.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeC0-FVQRS8nm73ENAmYEgAAAFQ"]
[Thu Apr 16 18:08:02.095430 2026] [:error] [pid 57639:tid 57670] [client 117.207.59.1:49457] [client 117.207.59.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.207.59.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeC1AqMCQoTw7TsxWukT7wAAANg"]
[Thu Apr 16 18:08:12.177931 2026] [:error] [pid 57639:tid 57653] [client 117.207.59.1:49840] [client 117.207.59.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.207.59.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeC1DKMCQoTw7TsxWukUCwAAAMc"]
[Thu Apr 16 18:08:21.499233 2026] [:error] [pid 7880:tid 7889] [client 117.207.59.1:55787] [client 117.207.59.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.207.59.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeC1Faaezm4fSGc0yUJp0wAAAYQ"]
[Thu Apr 16 18:14:01.289536 2026] [:error] [pid 49094:tid 49116] [client 45.94.31.15:52035] [client 45.94.31.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "aeC2aTbDwvcXorHR_Mx0CQAAAVQ"]
[Thu Apr 16 18:14:01.782627 2026] [:error] [pid 57536:tid 57567] [client 45.94.31.15:50642] [client 45.94.31.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "aeC2aSQU4faGja6jpDsuKAAAABM"]
[Thu Apr 16 18:14:02.276375 2026] [:error] [pid 57536:tid 57559] [client 45.94.31.15:51790] [client 45.94.31.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "aeC2aiQU4faGja6jpDsuKgAAAAs"]
[Thu Apr 16 18:14:04.310724 2026] [:error] [pid 49094:tid 49099] [client 45.94.31.15:51737] [client 45.94.31.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "aeC2bDbDwvcXorHR_Mx0GwAAAUM"]
[Thu Apr 16 21:11:22.905891 2026] [:error] [pid 29603:tid 29606] [client 158.158.35.197:2629] [client 158.158.35.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aeDf-lfGOR6fpTWUAzqVBAAAAQE"]
[Thu Apr 16 21:11:28.561300 2026] [:error] [pid 49094:tid 49115] [client 158.158.35.197:35264] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "aeDgADbDwvcXorHR_MzXOAAAAVM"]
[Thu Apr 16 21:11:36.005542 2026] [:error] [pid 57639:tid 57653] [client 158.158.35.197:21272] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "aeDgCKMCQoTw7TsxWumjrgAAAMc"]
[Thu Apr 16 21:11:36.822975 2026] [:error] [pid 57639:tid 57665] [client 158.158.35.197:19550] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "aeDgCKMCQoTw7TsxWumjwgAAANM"]
[Thu Apr 16 21:11:38.529762 2026] [:error] [pid 57639:tid 57670] [client 158.158.35.197:24648] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "aeDgCqMCQoTw7TsxWumj2wAAANg"]
[Thu Apr 16 21:11:40.826373 2026] [:error] [pid 49094:tid 49100] [client 158.158.35.197:42486] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tiny2.php"] [unique_id "aeDgDDbDwvcXorHR_MzXngAAAUQ"]
[Thu Apr 16 21:11:41.892760 2026] [:error] [pid 49094:tid 49109] [client 158.158.35.197:23052] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tiny2.php"] [unique_id "aeDgDTbDwvcXorHR_MzXsAAAAU0"]
[Thu Apr 16 21:11:42.857171 2026] [:error] [pid 7880:tid 7895] [client 158.158.35.197:24680] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tiny2.php"] [unique_id "aeDgDqaezm4fSGc0yUKmowAAAYo"]
[Thu Apr 16 21:11:44.369355 2026] [:error] [pid 49094:tid 49112] [client 158.158.35.197:26418] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tiny2.php"] [unique_id "aeDgEDbDwvcXorHR_MzX7gAAAVA"]
[Thu Apr 16 21:11:45.302151 2026] [:error] [pid 57536:tid 57554] [client 158.158.35.197:26371] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/state.php"] [unique_id "aeDgESQU4faGja6jpDt5hwAAAAY"]
[Thu Apr 16 21:11:46.345888 2026] [:error] [pid 29603:tid 29608] [client 158.158.35.197:42461] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/state.php"] [unique_id "aeDgElfGOR6fpTWUAzqVJQAAAQM"]
[Thu Apr 16 21:11:48.766009 2026] [:error] [pid 49094:tid 49118] [client 158.158.35.197:41949] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/state.php"] [unique_id "aeDgFDbDwvcXorHR_MzYGgAAAVY"]
[Thu Apr 16 21:11:53.808660 2026] [:error] [pid 49094:tid 49118] [client 158.158.35.197:41939] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/state.php"] [unique_id "aeDgGTbDwvcXorHR_MzYMgAAAVY"]
[Thu Apr 16 21:12:03.888369 2026] [:error] [pid 57537:tid 57591] [client 158.158.35.197:31762] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aeDgI1VQRS8nm73ENAm2yAAAAFA"]
[Thu Apr 16 21:12:05.338318 2026] [:error] [pid 49094:tid 49108] [client 158.158.35.197:26651] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aeDgJTbDwvcXorHR_MzYZAAAAUw"]
[Thu Apr 16 21:12:07.483180 2026] [:error] [pid 49094:tid 49120] [client 158.158.35.197:25012] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aeDgJzbDwvcXorHR_MzYbAAAAVg"]
[Thu Apr 16 21:12:08.880027 2026] [:error] [pid 57639:tid 57652] [client 158.158.35.197:21339] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aeDgKKMCQoTw7TsxWumkgAAAAMY"]
[Thu Apr 16 21:12:10.224907 2026] [:error] [pid 57538:tid 57620] [client 158.158.35.197:26596] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wps.php"] [unique_id "aeDgKsuMaiEF5SVR2BfhWwAAAJI"]
[Thu Apr 16 21:12:12.173053 2026] [:error] [pid 29603:tid 29627] [client 158.158.35.197:21336] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wps.php"] [unique_id "aeDgLFfGOR6fpTWUAzqVVAAAARY"]
[Thu Apr 16 21:12:23.273156 2026] [:error] [pid 29603:tid 29609] [client 158.158.35.197:20286] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wps.php"] [unique_id "aeDgN1fGOR6fpTWUAzqVYwAAAQQ"]
[Thu Apr 16 21:12:37.918089 2026] [:error] [pid 49094:tid 49117] [client 158.158.35.197:24968] [client 158.158.35.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "aeDgRTbDwvcXorHR_MzY9gAAAVU"]
[Thu Apr 16 21:12:42.490405 2026] [:error] [pid 57639:tid 57654] [client 158.158.35.197:21606] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aeDgSqMCQoTw7TsxWumlOwAAAMg"]
[Thu Apr 16 21:12:45.190150 2026] [:error] [pid 57639:tid 57661] [client 158.158.35.197:27642] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aeDgTaMCQoTw7TsxWumlRAAAAM8"]
[Thu Apr 16 21:12:50.095698 2026] [:error] [pid 7880:tid 7891] [client 158.158.35.197:25849] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aeDgUqaezm4fSGc0yUKnZwAAAYY"]
[Thu Apr 16 21:12:51.166824 2026] [:error] [pid 57639:tid 57646] [client 158.158.35.197:23385] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aeDgU6MCQoTw7TsxWumlfgAAAMA"]
[Thu Apr 16 21:12:51.990975 2026] [:error] [pid 49094:tid 49116] [client 158.158.35.197:21787] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "aeDgUzbDwvcXorHR_MzZCAAAAVQ"]
[Thu Apr 16 21:12:53.030969 2026] [:error] [pid 57538:tid 57615] [client 158.158.35.197:3037] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "aeDgVcuMaiEF5SVR2BfhngAAAI0"]
[Thu Apr 16 21:12:55.646394 2026] [:error] [pid 29603:tid 29605] [client 158.158.35.197:24739] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "aeDgV1fGOR6fpTWUAzqVpAAAAQA"]
[Thu Apr 16 21:12:58.093081 2026] [:error] [pid 7880:tid 7889] [client 158.158.35.197:23874] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "aeDgWqaezm4fSGc0yUKnfQAAAYQ"]
[Thu Apr 16 21:12:59.009057 2026] [:error] [pid 57536:tid 57566] [client 158.158.35.197:25806] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/footer.php"] [unique_id "aeDgWyQU4faGja6jpDt6dQAAABI"]
[Thu Apr 16 21:12:59.967826 2026] [:error] [pid 29603:tid 29606] [client 158.158.35.197:18531] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/footer.php"] [unique_id "aeDgW1fGOR6fpTWUAzqVtAAAAQE"]
[Thu Apr 16 21:13:00.702145 2026] [:error] [pid 7880:tid 7904] [client 158.158.35.197:18507] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/footer.php"] [unique_id "aeDgXKaezm4fSGc0yUKngwAAAZM"]
[Thu Apr 16 21:13:02.922097 2026] [:error] [pid 57538:tid 57621] [client 158.158.35.197:24199] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/footer.php"] [unique_id "aeDgXsuMaiEF5SVR2BfhsAAAAJM"]
[Thu Apr 16 21:13:04.602054 2026] [:error] [pid 57538:tid 57602] [client 158.158.35.197:17664] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/img.php"] [unique_id "aeDgYMuMaiEF5SVR2BfhuQAAAIA"]
[Thu Apr 16 21:13:05.783362 2026] [:error] [pid 7880:tid 7905] [client 158.158.35.197:25661] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/img.php"] [unique_id "aeDgYaaezm4fSGc0yUKnrAAAAZQ"]
[Thu Apr 16 21:13:06.986562 2026] [:error] [pid 57639:tid 57664] [client 158.158.35.197:17687] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/img.php"] [unique_id "aeDgYqMCQoTw7TsxWumllAAAANI"]
[Thu Apr 16 21:13:09.931674 2026] [:error] [pid 49094:tid 49101] [client 158.158.35.197:25027] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/img.php"] [unique_id "aeDgZTbDwvcXorHR_MzZQgAAAUU"]
[Thu Apr 16 21:13:10.802019 2026] [:error] [pid 57639:tid 57669] [client 158.158.35.197:30990] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "aeDgZqMCQoTw7TsxWumltQAAANc"]
[Thu Apr 16 21:13:11.667359 2026] [:error] [pid 7880:tid 7899] [client 158.158.35.197:25043] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "aeDgZ6aezm4fSGc0yUKnvQAAAY4"]
[Thu Apr 16 21:13:12.654384 2026] [:error] [pid 57538:tid 57605] [client 158.158.35.197:23135] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "aeDgaMuMaiEF5SVR2BfhwwAAAIM"]
[Thu Apr 16 21:13:13.565697 2026] [:error] [pid 57639:tid 57658] [client 158.158.35.197:30189] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "aeDgaaMCQoTw7TsxWumlvQAAAMw"]
[Thu Apr 16 21:13:14.557104 2026] [:error] [pid 49094:tid 49107] [client 158.158.35.197:40395] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "aeDgajbDwvcXorHR_MzZWAAAAUs"]
[Thu Apr 16 21:13:15.237215 2026] [:error] [pid 7880:tid 7888] [client 158.158.35.197:43355] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "aeDga6aezm4fSGc0yUKnywAAAYM"]
[Thu Apr 16 21:13:16.079379 2026] [:error] [pid 57639:tid 57654] [client 158.158.35.197:24892] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "aeDgbKMCQoTw7TsxWumlxQAAAMg"]
[Thu Apr 16 21:13:19.422738 2026] [:error] [pid 57639:tid 57657] [client 158.158.35.197:24865] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "aeDgb6MCQoTw7TsxWuml2gAAAMs"]
[Thu Apr 16 21:13:21.953779 2026] [:error] [pid 57537:tid 57594] [client 158.158.35.197:27964] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "aeDgcVVQRS8nm73ENAm3IgAAAFM"]
[Thu Apr 16 21:13:22.571849 2026] [:error] [pid 57537:tid 57587] [client 158.158.35.197:43352] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "aeDgclVQRS8nm73ENAm3JQAAAEw"]
[Thu Apr 16 21:14:00.040962 2026] [:error] [pid 7880:tid 7902] [client 158.158.35.197:27951] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1s7y8wt9dz.php"] [unique_id "aeDgmKaezm4fSGc0yUKoIAAAAZE"]
[Thu Apr 16 21:14:00.992876 2026] [:error] [pid 57538:tid 57603] [client 158.158.35.197:25052] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1s7y8wt9dz.php"] [unique_id "aeDgmMuMaiEF5SVR2BfiBAAAAIE"]
[Thu Apr 16 21:14:16.070266 2026] [:error] [pid 49094:tid 49105] [client 158.158.35.197:26383] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bdktk.php"] [unique_id "aeDgqDbDwvcXorHR_MzaQQAAAUk"]
[Thu Apr 16 21:14:16.907293 2026] [:error] [pid 57538:tid 57602] [client 158.158.35.197:24663] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bdktk.php"] [unique_id "aeDgqMuMaiEF5SVR2BfiEAAAAIA"]
[Thu Apr 16 21:14:18.163745 2026] [:error] [pid 57538:tid 57617] [client 158.158.35.197:18689] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bdktk.php"] [unique_id "aeDgqsuMaiEF5SVR2BfiFgAAAI8"]
[Thu Apr 16 21:14:19.769163 2026] [:error] [pid 7880:tid 7909] [client 158.158.35.197:19066] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bdktk.php"] [unique_id "aeDgq6aezm4fSGc0yUKoOQAAAZg"]
[Thu Apr 16 21:14:22.344436 2026] [:error] [pid 57536:tid 57566] [client 158.158.35.197:23327] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v5.php"] [unique_id "aeDgriQU4faGja6jpDt7eAAAABI"]
[Thu Apr 16 21:14:23.126160 2026] [:error] [pid 57537:tid 57577] [client 158.158.35.197:21249] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v5.php"] [unique_id "aeDgr1VQRS8nm73ENAm3WQAAAEI"]
[Thu Apr 16 21:14:24.633950 2026] [:error] [pid 57639:tid 57668] [client 158.158.35.197:26335] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v5.php"] [unique_id "aeDgsKMCQoTw7TsxWumm9AAAANY"]
[Thu Apr 16 21:14:27.775911 2026] [:error] [pid 57538:tid 57603] [client 158.158.35.197:30435] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v5.php"] [unique_id "aeDgs8uMaiEF5SVR2BfiIwAAAIE"]
[Thu Apr 16 21:14:28.838541 2026] [:error] [pid 57639:tid 57664] [client 158.158.35.197:26325] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "aeDgtKMCQoTw7TsxWumnAAAAANI"]
[Thu Apr 16 21:14:30.997415 2026] [:error] [pid 57536:tid 57548] [client 158.158.35.197:23337] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "aeDgtiQU4faGja6jpDt7jgAAAAA"]
[Thu Apr 16 21:14:31.672301 2026] [:error] [pid 57536:tid 57551] [client 158.158.35.197:22650] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "aeDgtyQU4faGja6jpDt7kAAAAAM"]
[Thu Apr 16 21:14:32.611621 2026] [:error] [pid 49094:tid 49115] [client 158.158.35.197:22646] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "aeDguDbDwvcXorHR_MzahgAAAVM"]
[Thu Apr 16 21:14:33.224742 2026] [:error] [pid 49094:tid 49101] [client 158.158.35.197:35296] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "aeDguTbDwvcXorHR_MzaiQAAAUU"]
[Thu Apr 16 21:14:33.971773 2026] [:error] [pid 57639:tid 57670] [client 158.158.35.197:18726] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "aeDguaMCQoTw7TsxWumnCQAAANg"]
[Thu Apr 16 21:14:35.479789 2026] [:error] [pid 57536:tid 57564] [client 158.158.35.197:30075] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "aeDguyQU4faGja6jpDt7mgAAABA"]
[Thu Apr 16 21:14:43.502662 2026] [:error] [pid 57536:tid 57551] [client 158.158.35.197:28186] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "aeDgwyQU4faGja6jpDt7nQAAAAM"]
[Thu Apr 16 21:14:46.407283 2026] [:error] [pid 57639:tid 57665] [client 158.158.35.197:41373] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/layout.php"] [unique_id "aeDgxqMCQoTw7TsxWumnTwAAANM"]
[Thu Apr 16 21:14:48.391460 2026] [:error] [pid 49094:tid 49109] [client 158.158.35.197:29820] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/layout.php"] [unique_id "aeDgyDbDwvcXorHR_MzawwAAAU0"]
[Thu Apr 16 21:14:56.928215 2026] [:error] [pid 57538:tid 57616] [client 158.158.35.197:31285] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/layout.php"] [unique_id "aeDg0MuMaiEF5SVR2BfiSwAAAI4"]
[Thu Apr 16 21:14:58.877990 2026] [:error] [pid 57536:tid 57564] [client 158.158.35.197:41863] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/layout.php"] [unique_id "aeDg0iQU4faGja6jpDt7uwAAABA"]
[Thu Apr 16 21:15:11.464513 2026] [:error] [pid 57639:tid 57670] [client 158.158.35.197:29772] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aeDg36MCQoTw7TsxWumnswAAANg"]
[Thu Apr 16 21:15:12.712307 2026] [:error] [pid 7880:tid 7908] [client 158.158.35.197:20840] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aeDg4Kaezm4fSGc0yUKoiAAAAZc"]
[Thu Apr 16 21:15:13.475793 2026] [:error] [pid 57536:tid 57559] [client 158.158.35.197:18212] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aeDg4SQU4faGja6jpDt7yQAAAAs"]
[Thu Apr 16 21:15:16.291850 2026] [:error] [pid 57538:tid 57609] [client 158.158.35.197:21539] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aeDg5MuMaiEF5SVR2BfiYgAAAIc"]
[Thu Apr 16 21:15:21.200029 2026] [:error] [pid 57536:tid 57560] [client 158.158.35.197:18231] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ga.php"] [unique_id "aeDg6SQU4faGja6jpDt70wAAAAw"]
[Thu Apr 16 21:15:23.124885 2026] [:error] [pid 49094:tid 49107] [client 158.158.35.197:29500] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ga.php"] [unique_id "aeDg6zbDwvcXorHR_MzbJgAAAUs"]
[Thu Apr 16 21:15:24.302930 2026] [:error] [pid 57537:tid 57593] [client 158.158.35.197:25152] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ga.php"] [unique_id "aeDg7FVQRS8nm73ENAm3fAAAAFI"]
[Thu Apr 16 21:15:26.933703 2026] [:error] [pid 57536:tid 57568] [client 158.158.35.197:2254] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ga.php"] [unique_id "aeDg7iQU4faGja6jpDt74AAAABQ"]
[Thu Apr 16 21:15:29.596674 2026] [:error] [pid 57536:tid 57552] [client 158.158.35.197:2952] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xozx.php"] [unique_id "aeDg8SQU4faGja6jpDt76gAAAAQ"]
[Thu Apr 16 21:15:30.396384 2026] [:error] [pid 57639:tid 57655] [client 158.158.35.197:26741] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xozx.php"] [unique_id "aeDg8qMCQoTw7TsxWumnugAAAMk"]
[Thu Apr 16 21:15:33.527445 2026] [:error] [pid 57537:tid 57588] [client 158.158.35.197:25184] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xozx.php"] [unique_id "aeDg9VVQRS8nm73ENAm3gwAAAE0"]
[Thu Apr 16 21:15:35.267998 2026] [:error] [pid 49094:tid 49114] [client 158.158.35.197:26786] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xozx.php"] [unique_id "aeDg9zbDwvcXorHR_MzbTQAAAVI"]
[Thu Apr 16 21:15:41.260426 2026] [:error] [pid 57536:tid 57569] [client 158.158.35.197:18808] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1100.php"] [unique_id "aeDg_SQU4faGja6jpDt8DwAAABU"]
[Thu Apr 16 21:15:44.828076 2026] [:error] [pid 49094:tid 49100] [client 158.158.35.197:27970] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1100.php"] [unique_id "aeDhADbDwvcXorHR_MzbgwAAAUQ"]
[Thu Apr 16 21:15:46.804356 2026] [:error] [pid 57536:tid 57568] [client 158.158.35.197:2955] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1100.php"] [unique_id "aeDhAiQU4faGja6jpDt8JwAAABQ"]
[Thu Apr 16 21:15:56.792876 2026] [:error] [pid 29603:tid 29608] [client 158.158.35.197:28428] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "aeDhDFfGOR6fpTWUAzqWpQAAAQM"]
[Thu Apr 16 21:16:00.799462 2026] [:error] [pid 57537:tid 57576] [client 158.158.35.197:28027] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "aeDhEFVQRS8nm73ENAm3lwAAAEE"]
[Thu Apr 16 21:16:01.901488 2026] [:error] [pid 57639:tid 57653] [client 158.158.35.197:2626] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "aeDhEaMCQoTw7TsxWumoEwAAAMc"]
[Thu Apr 16 21:16:02.671411 2026] [:error] [pid 49094:tid 49120] [client 158.158.35.197:30946] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "aeDhEjbDwvcXorHR_MzbxgAAAVg"]
[Thu Apr 16 21:16:03.856702 2026] [:error] [pid 7880:tid 7898] [client 158.158.35.197:2660] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aeDhE6aezm4fSGc0yUKovAAAAY0"]
[Thu Apr 16 21:16:05.781883 2026] [:error] [pid 7880:tid 7894] [client 158.158.35.197:28467] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aeDhFaaezm4fSGc0yUKovwAAAYk"]
[Thu Apr 16 21:16:07.051795 2026] [:error] [pid 57537:tid 57587] [client 158.158.35.197:24362] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aeDhF1VQRS8nm73ENAm3ngAAAEw"]
[Thu Apr 16 21:16:42.030162 2026] [:error] [pid 57639:tid 57656] [client 158.158.35.197:22029] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/000.php"] [unique_id "aeDhOqMCQoTw7TsxWumoYAAAAMo"]
[Thu Apr 16 21:16:43.502318 2026] [:error] [pid 7880:tid 7900] [client 158.158.35.197:22873] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/000.php"] [unique_id "aeDhO6aezm4fSGc0yUKo8wAAAY8"]
[Thu Apr 16 21:16:44.126595 2026] [:error] [pid 57537:tid 57590] [client 158.158.35.197:26170] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/000.php"] [unique_id "aeDhPFVQRS8nm73ENAm33wAAAE8"]
[Thu Apr 16 21:16:45.027889 2026] [:error] [pid 57537:tid 57595] [client 158.158.35.197:28432] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/000.php"] [unique_id "aeDhPVVQRS8nm73ENAm34gAAAFQ"]
[Thu Apr 16 21:16:46.327251 2026] [:error] [pid 57536:tid 57560] [client 158.158.35.197:18275] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.php"] [unique_id "aeDhPiQU4faGja6jpDt87QAAAAw"]
[Thu Apr 16 21:16:48.037156 2026] [:error] [pid 57639:tid 57650] [client 158.158.35.197:18250] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.php"] [unique_id "aeDhQKMCQoTw7TsxWumobAAAAMQ"]
[Thu Apr 16 21:16:53.385921 2026] [:error] [pid 29603:tid 29629] [client 158.158.35.197:17747] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.php"] [unique_id "aeDhRVfGOR6fpTWUAzqW2AAAARg"]
[Thu Apr 16 21:16:55.206361 2026] [:error] [pid 57536:tid 57555] [client 158.158.35.197:18300] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.php"] [unique_id "aeDhRyQU4faGja6jpDt9BQAAAAc"]
[Thu Apr 16 21:17:00.073781 2026] [:error] [pid 57639:tid 57649] [client 158.158.35.197:2645] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x3x.php"] [unique_id "aeDhTKMCQoTw7TsxWumonQAAAMM"]
[Thu Apr 16 21:17:01.893835 2026] [:error] [pid 57536:tid 57561] [client 158.158.35.197:22109] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x3x.php"] [unique_id "aeDhTSQU4faGja6jpDt9JAAAAA0"]
[Thu Apr 16 21:17:06.844629 2026] [:error] [pid 57639:tid 57670] [client 158.158.35.197:18248] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x3x.php"] [unique_id "aeDhUqMCQoTw7TsxWumovQAAANg"]
[Thu Apr 16 21:17:07.473317 2026] [:error] [pid 57639:tid 57649] [client 158.158.35.197:22085] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x3x.php"] [unique_id "aeDhU6MCQoTw7TsxWumowQAAAMM"]
[Thu Apr 16 21:17:08.188063 2026] [:error] [pid 57639:tid 57657] [client 158.158.35.197:22084] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xy.php"] [unique_id "aeDhVKMCQoTw7TsxWumoywAAAMs"]
[Thu Apr 16 21:17:09.921732 2026] [:error] [pid 57639:tid 57653] [client 158.158.35.197:19567] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xy.php"] [unique_id "aeDhVaMCQoTw7TsxWumo1wAAAMc"]
[Thu Apr 16 21:17:11.802990 2026] [:error] [pid 57538:tid 57616] [client 158.158.35.197:2539] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xy.php"] [unique_id "aeDhV8uMaiEF5SVR2BfjJAAAAI4"]
[Thu Apr 16 21:17:14.360612 2026] [:error] [pid 57536:tid 57554] [client 158.158.35.197:22028] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xy.php"] [unique_id "aeDhWiQU4faGja6jpDt9TgAAAAY"]
[Thu Apr 16 21:17:21.745714 2026] [:error] [pid 49094:tid 49097] [client 158.158.35.197:17755] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/global.php"] [unique_id "aeDhYTbDwvcXorHR_MzcmAAAAUE"]
[Thu Apr 16 21:17:23.621824 2026] [:error] [pid 49094:tid 49100] [client 158.158.35.197:2637] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/global.php"] [unique_id "aeDhYzbDwvcXorHR_MzcpgAAAUQ"]
[Thu Apr 16 21:17:24.939540 2026] [:error] [pid 57639:tid 57657] [client 158.158.35.197:22079] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/global.php"] [unique_id "aeDhZKMCQoTw7TsxWumpJQAAAMs"]
[Thu Apr 16 21:17:27.483322 2026] [:error] [pid 57536:tid 57550] [client 158.158.35.197:2535] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/global.php"] [unique_id "aeDhZyQU4faGja6jpDt9bgAAAAI"]
[Thu Apr 16 21:17:30.555576 2026] [:error] [pid 57536:tid 57571] [client 158.158.35.197:2629] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aeDhaiQU4faGja6jpDt9iwAAABc"]
[Thu Apr 16 21:17:33.706129 2026] [:error] [pid 49094:tid 49110] [client 158.158.35.197:24360] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aeDhbTbDwvcXorHR_MzcyQAAAU4"]
[Thu Apr 16 21:17:35.042023 2026] [:error] [pid 49094:tid 49115] [client 158.158.35.197:26124] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aeDhbzbDwvcXorHR_MzczgAAAVM"]
[Thu Apr 16 21:17:36.673086 2026] [:error] [pid 57536:tid 57557] [client 158.158.35.197:17789] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aeDhcCQU4faGja6jpDt9rAAAAAk"]
[Thu Apr 16 21:17:38.121338 2026] [:error] [pid 57538:tid 57624] [client 158.158.35.197:40908] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "aeDhcsuMaiEF5SVR2BfjQwAAAJY"]
[Thu Apr 16 21:17:49.448817 2026] [:error] [pid 57639:tid 57660] [client 158.158.35.197:2503] [client 158.158.35.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wincust.php"] [unique_id "aeDhfaMCQoTw7TsxWumppAAAAM4"]
[Thu Apr 16 21:17:58.911714 2026] [:error] [pid 7880:tid 7899] [client 158.158.35.197:28513] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-01ul.php"] [unique_id "aeDhhqaezm4fSGc0yUKpkgAAAY4"]
[Thu Apr 16 21:18:12.410494 2026] [:error] [pid 49094:tid 49108] [client 158.158.35.197:19273] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-01ul.php"] [unique_id "aeDhlDbDwvcXorHR_MzdLAAAAUw"]
[Thu Apr 16 21:18:13.782846 2026] [:error] [pid 7880:tid 7904] [client 158.158.35.197:30157] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-01ul.php"] [unique_id "aeDhlaaezm4fSGc0yUKpqAAAAZM"]
[Thu Apr 16 21:18:16.040800 2026] [:error] [pid 49094:tid 49112] [client 158.158.35.197:24464] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e7.php"] [unique_id "aeDhmDbDwvcXorHR_MzdMQAAAVA"]
[Thu Apr 16 21:18:22.720790 2026] [:error] [pid 57538:tid 57626] [client 158.158.35.197:25584] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e7.php"] [unique_id "aeDhnsuMaiEF5SVR2BfjcQAAAJg"]
[Thu Apr 16 21:18:24.180995 2026] [:error] [pid 7880:tid 7898] [client 158.158.35.197:25563] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e7.php"] [unique_id "aeDhoKaezm4fSGc0yUKp1AAAAY0"]
[Thu Apr 16 21:18:33.605864 2026] [:error] [pid 57536:tid 57558] [client 158.158.35.197:25575] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e3.php"] [unique_id "aeDhqSQU4faGja6jpDt-IgAAAAo"]
[Thu Apr 16 21:18:52.931708 2026] [:error] [pid 29603:tid 29609] [client 158.158.35.197:18488] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "aeDhvFfGOR6fpTWUAzqXUAAAAQQ"]
[Thu Apr 16 21:18:55.293343 2026] [:error] [pid 57639:tid 57647] [client 158.158.35.197:25068] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "aeDhv6MCQoTw7TsxWumq7wAAAME"]
[Thu Apr 16 21:18:57.891743 2026] [:error] [pid 29603:tid 29625] [client 158.158.35.197:40398] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "aeDhwVfGOR6fpTWUAzqXcQAAARQ"]
[Thu Apr 16 21:19:14.439966 2026] [:error] [pid 57536:tid 57571] [client 158.158.35.197:22310] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "aeDh0iQU4faGja6jpDt-wQAAABc"]
[Thu Apr 16 21:19:19.089822 2026] [:error] [pid 29603:tid 29609] [client 158.158.35.197:21838] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "aeDh11fGOR6fpTWUAzqXpgAAAQQ"]
[Thu Apr 16 21:19:20.577352 2026] [:error] [pid 57536:tid 57565] [client 158.158.35.197:2286] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "aeDh2CQU4faGja6jpDt-4QAAABE"]
[Thu Apr 16 21:19:21.605499 2026] [:error] [pid 7880:tid 7890] [client 158.158.35.197:25131] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "aeDh2aaezm4fSGc0yUKqfAAAAYU"]
[Thu Apr 16 21:19:23.838141 2026] [:error] [pid 57639:tid 57652] [client 158.158.35.197:25145] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods_260325043000.php"] [unique_id "aeDh26MCQoTw7TsxWumrfwAAAMY"]
[Thu Apr 16 21:19:26.951752 2026] [:error] [pid 57639:tid 57653] [client 158.158.35.197:21852] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods_260325043000.php"] [unique_id "aeDh3qMCQoTw7TsxWumrnwAAAMc"]
[Thu Apr 16 21:19:28.596336 2026] [:error] [pid 49094:tid 49107] [client 158.158.35.197:19515] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods_260325043000.php"] [unique_id "aeDh4DbDwvcXorHR_MzeMwAAAUs"]
[Thu Apr 16 21:19:29.618849 2026] [:error] [pid 57639:tid 57651] [client 158.158.35.197:26713] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods_260325043000.php"] [unique_id "aeDh4aMCQoTw7TsxWumrrwAAAMU"]
[Thu Apr 16 21:19:32.760640 2026] [:error] [pid 57639:tid 57656] [client 158.158.35.197:19472] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods_260401065719.php"] [unique_id "aeDh5KMCQoTw7TsxWumrwwAAAMo"]
[Thu Apr 16 21:19:33.512117 2026] [:error] [pid 57536:tid 57564] [client 158.158.35.197:20828] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods_260401065719.php"] [unique_id "aeDh5SQU4faGja6jpDt_LAAAABA"]
[Thu Apr 16 21:19:34.212557 2026] [:error] [pid 57537:tid 57589] [client 158.158.35.197:23643] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods_260401065719.php"] [unique_id "aeDh5lVQRS8nm73ENAm4cgAAAE4"]
[Thu Apr 16 21:19:36.205693 2026] [:error] [pid 49094:tid 49099] [client 158.158.35.197:18203] [client 158.158.35.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods_260401065719.php"] [unique_id "aeDh6DbDwvcXorHR_MzeVwAAAUM"]
[Thu Apr 16 21:55:06.596197 2026] [:error] [pid 29603:tid 29623] [client 223.15.245.170:35429] [client 223.15.245.170] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aeDqOlfGOR6fpTWUAzqh3AAAARI"]
[Thu Apr 16 22:05:17.864427 2026] [:error] [pid 7880:tid 7892] [client 49.51.33.159:52490] [client 49.51.33.159] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeDsnaaezm4fSGc0yUK7RAAAAYc"]
[Thu Apr 16 23:08:29.798068 2026] [:error] [pid 57536:tid 57571] [client 34.30.171.252:55508] [client 34.30.171.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.30.171.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeD7bSQU4faGja6jpDuw3gAAABc"]
[Thu Apr 16 23:08:31.943696 2026] [:error] [pid 57536:tid 57555] [client 34.30.171.252:55508] [client 34.30.171.252] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeD7byQU4faGja6jpDuw4QAAAAc"]
[Thu Apr 16 23:08:32.142328 2026] [:error] [pid 57536:tid 57565] [client 34.30.171.252:55508] [client 34.30.171.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.30.171.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeD7cCQU4faGja6jpDuw4wAAABE"]
[Thu Apr 16 23:08:33.482710 2026] [:error] [pid 57536:tid 57556] [client 34.30.171.252:57648] [client 34.30.171.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.30.171.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeD7cSQU4faGja6jpDuw5QAAAAg"]
[Thu Apr 16 23:08:34.886531 2026] [:error] [pid 57639:tid 57653] [client 34.30.171.252:58268] [client 34.30.171.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.30.171.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeD7cqMCQoTw7TsxWukHRAAAAMc"]
[Thu Apr 16 23:08:36.244139 2026] [:error] [pid 57639:tid 57664] [client 34.30.171.252:58978] [client 34.30.171.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.30.171.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeD7dKMCQoTw7TsxWukHVAAAANI"]
[Thu Apr 16 23:08:37.599908 2026] [:error] [pid 57639:tid 57648] [client 34.30.171.252:59838] [client 34.30.171.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.30.171.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeD7daMCQoTw7TsxWukHXgAAAMI"]
[Thu Apr 16 23:08:37.600087 2026] [:error] [pid 57639:tid 57648] [client 34.30.171.252:59838] [client 34.30.171.252] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.30.171.252, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeD7daMCQoTw7TsxWukHXgAAAMI"]
[Thu Apr 16 23:14:05.304761 2026] [:error] [pid 57536:tid 57571] [client 136.109.158.100:60037] [client 136.109.158.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.109.158.100, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeD8vSQU4faGja6jpDuzCgAAABc"]
[Thu Apr 16 23:14:07.513011 2026] [:error] [pid 57536:tid 57564] [client 136.109.158.100:60037] [client 136.109.158.100] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeD8vyQU4faGja6jpDuzIgAAABA"]
[Thu Apr 16 23:14:07.677952 2026] [:error] [pid 57536:tid 57569] [client 136.109.158.100:60037] [client 136.109.158.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.109.158.100, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeD8vyQU4faGja6jpDuzIwAAABU"]
[Thu Apr 16 23:14:09.057321 2026] [:error] [pid 57639:tid 57646] [client 136.109.158.100:57231] [client 136.109.158.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.109.158.100, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeD8waMCQoTw7TsxWukL6wAAAMA"]
[Thu Apr 16 23:15:03.616996 2026] [:error] [pid 7880:tid 7902] [client 45.130.203.150:47531] [client 45.130.203.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/HEAD"] [unique_id "aeD896aezm4fSGc0yULU-AAAAZE"]
[Thu Apr 16 23:31:48.987735 2026] [autoindex:error] [pid 57536:tid 57563] [client 158.158.73.200:57882] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 16 23:31:51.040274 2026] [:error] [pid 57536:tid 57557] [client 158.158.73.200:57882] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/huya.php"] [unique_id "aeEA5yQU4faGja6jpDu4xgAAAAk"]
[Thu Apr 16 23:32:00.493250 2026] [:error] [pid 57639:tid 57649] [client 158.158.73.200:23684] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/huya.php"] [unique_id "aeEA8KMCQoTw7TsxWukWUgAAAMM"]
[Thu Apr 16 23:32:01.336726 2026] [:error] [pid 49094:tid 49116] [client 158.158.73.200:23683] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/huya.php"] [unique_id "aeEA8TbDwvcXorHR_MwtvgAAAVQ"]
[Thu Apr 16 23:32:02.005092 2026] [:error] [pid 57639:tid 57650] [client 158.158.73.200:61990] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/huya.php"] [unique_id "aeEA8qMCQoTw7TsxWukWWgAAAMQ"]
[Thu Apr 16 23:32:02.740716 2026] [:error] [pid 57639:tid 57666] [client 158.158.73.200:57898] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/puc.php"] [unique_id "aeEA8qMCQoTw7TsxWukWXgAAANQ"]
[Thu Apr 16 23:32:05.541346 2026] [:error] [pid 7880:tid 7904] [client 158.158.73.200:61945] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/puc.php"] [unique_id "aeEA9aaezm4fSGc0yULYsAAAAZM"]
[Thu Apr 16 23:32:11.887683 2026] [:error] [pid 57639:tid 57653] [client 158.158.73.200:26343] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/puc.php"] [unique_id "aeEA-6MCQoTw7TsxWukWawAAAMc"]
[Thu Apr 16 23:32:16.575528 2026] [:error] [pid 57536:tid 57563] [client 158.158.73.200:29563] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/puc.php"] [unique_id "aeEBACQU4faGja6jpDu46AAAAA8"]
[Thu Apr 16 23:32:17.711843 2026] [:error] [pid 7880:tid 7900] [client 158.158.73.200:29518] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aeEBAaaezm4fSGc0yULYzwAAAY8"]
[Thu Apr 16 23:32:18.608801 2026] [:error] [pid 29603:tid 29616] [client 158.158.73.200:65140] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aeEBAlfGOR6fpTWUAzq8NwAAAQs"]
[Thu Apr 16 23:32:19.434211 2026] [:error] [pid 57538:tid 57607] [client 158.158.73.200:61952] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aeEBA8uMaiEF5SVR2BcCUgAAAIU"]
[Thu Apr 16 23:32:20.197519 2026] [:error] [pid 57538:tid 57620] [client 158.158.73.200:26326] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aeEBBMuMaiEF5SVR2BcCUwAAAJI"]
[Thu Apr 16 23:32:20.857504 2026] [:error] [pid 57639:tid 57658] [client 158.158.73.200:30036] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ewp.php"] [unique_id "aeEBBKMCQoTw7TsxWukWcgAAAMw"]
[Thu Apr 16 23:32:21.692761 2026] [:error] [pid 57536:tid 57551] [client 158.158.73.200:26360] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ewp.php"] [unique_id "aeEBBSQU4faGja6jpDu47AAAAAM"]
[Thu Apr 16 23:32:22.254539 2026] [:error] [pid 7880:tid 7889] [client 158.158.73.200:61959] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ewp.php"] [unique_id "aeEBBqaezm4fSGc0yULY1AAAAYQ"]
[Thu Apr 16 23:32:22.814121 2026] [:error] [pid 57537:tid 57596] [client 158.158.73.200:23693] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ewp.php"] [unique_id "aeEBBlVQRS8nm73ENAnRPQAAAFU"]
[Thu Apr 16 23:32:23.406523 2026] [:error] [pid 29603:tid 29625] [client 158.158.73.200:57620] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kikikoko.php"] [unique_id "aeEBB1fGOR6fpTWUAzq8PAAAARQ"]
[Thu Apr 16 23:32:24.244174 2026] [:error] [pid 49094:tid 49119] [client 158.158.73.200:23530] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kikikoko.php"] [unique_id "aeEBCDbDwvcXorHR_Mwt0AAAAVc"]
[Thu Apr 16 23:32:25.168165 2026] [:error] [pid 57538:tid 57617] [client 158.158.73.200:57610] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kikikoko.php"] [unique_id "aeEBCcuMaiEF5SVR2BcCVgAAAI8"]
[Thu Apr 16 23:32:26.111701 2026] [:error] [pid 57639:tid 57656] [client 158.158.73.200:65112] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kikikoko.php"] [unique_id "aeEBCqMCQoTw7TsxWukWegAAAMo"]
[Thu Apr 16 23:32:26.816222 2026] [:error] [pid 49094:tid 49100] [client 158.158.73.200:61899] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nwflm.php"] [unique_id "aeEBCjbDwvcXorHR_Mwt1wAAAUQ"]
[Thu Apr 16 23:32:27.654778 2026] [:error] [pid 49094:tid 49105] [client 158.158.73.200:29536] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nwflm.php"] [unique_id "aeEBCzbDwvcXorHR_Mwt3AAAAUk"]
[Thu Apr 16 23:32:28.350892 2026] [:error] [pid 29603:tid 29606] [client 158.158.73.200:57636] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nwflm.php"] [unique_id "aeEBDFfGOR6fpTWUAzq8PwAAAQE"]
[Thu Apr 16 23:32:29.110290 2026] [:error] [pid 57537:tid 57577] [client 158.158.73.200:61995] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nwflm.php"] [unique_id "aeEBDVVQRS8nm73ENAnRQwAAAEI"]
[Thu Apr 16 23:32:30.001730 2026] [:error] [pid 7880:tid 7894] [client 158.158.73.200:57601] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aeEBDqaezm4fSGc0yULY3gAAAYk"]
[Thu Apr 16 23:32:30.686991 2026] [:error] [pid 7880:tid 7909] [client 158.158.73.200:30032] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aeEBDqaezm4fSGc0yULY4AAAAZg"]
[Thu Apr 16 23:32:31.473727 2026] [:error] [pid 57639:tid 57656] [client 158.158.73.200:61961] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aeEBD6MCQoTw7TsxWukWhgAAAMo"]
[Thu Apr 16 23:32:32.612347 2026] [:error] [pid 57639:tid 57657] [client 158.158.73.200:23491] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aeEBEKMCQoTw7TsxWukWjQAAAMs"]
[Thu Apr 16 23:32:33.313757 2026] [:error] [pid 57639:tid 57663] [client 158.158.73.200:57914] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "aeEBEaMCQoTw7TsxWukWkAAAANE"]
[Thu Apr 16 23:32:34.140637 2026] [:error] [pid 57639:tid 57653] [client 158.158.73.200:29534] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "aeEBEqMCQoTw7TsxWukWlQAAAMc"]
[Thu Apr 16 23:32:34.769286 2026] [:error] [pid 7880:tid 7904] [client 158.158.73.200:18265] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "aeEBEqaezm4fSGc0yULY5gAAAZM"]
[Thu Apr 16 23:32:35.372519 2026] [:error] [pid 57639:tid 57664] [client 158.158.73.200:29513] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "aeEBE6MCQoTw7TsxWukWmQAAANI"]
[Thu Apr 16 23:32:36.175111 2026] [:error] [pid 49094:tid 49101] [client 158.158.73.200:65113] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "aeEBFDbDwvcXorHR_Mwt5gAAAUU"]
[Thu Apr 16 23:32:36.904956 2026] [:error] [pid 7880:tid 7892] [client 158.158.73.200:23531] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "aeEBFKaezm4fSGc0yULY6QAAAYc"]
[Thu Apr 16 23:32:37.778369 2026] [:error] [pid 7880:tid 7896] [client 158.158.73.200:57660] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "aeEBFaaezm4fSGc0yULY7AAAAYs"]
[Thu Apr 16 23:32:38.570961 2026] [:error] [pid 49094:tid 49103] [client 158.158.73.200:19686] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "aeEBFjbDwvcXorHR_Mwt6QAAAUc"]
[Thu Apr 16 23:32:39.290128 2026] [:error] [pid 7880:tid 7885] [client 158.158.73.200:23540] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "aeEBF6aezm4fSGc0yULY8QAAAYA"]
[Thu Apr 16 23:32:39.853401 2026] [:error] [pid 57536:tid 57557] [client 158.158.73.200:57864] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "aeEBFyQU4faGja6jpDu5CQAAAAk"]
[Thu Apr 16 23:32:40.471088 2026] [:error] [pid 57537:tid 57579] [client 158.158.73.200:65119] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "aeEBGFVQRS8nm73ENAnRTQAAAEQ"]
[Thu Apr 16 23:32:41.044082 2026] [:error] [pid 57536:tid 57550] [client 158.158.73.200:23691] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "aeEBGSQU4faGja6jpDu5DQAAAAI"]
[Thu Apr 16 23:32:41.838983 2026] [:error] [pid 49094:tid 49120] [client 158.158.73.200:57894] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "aeEBGTbDwvcXorHR_Mwt6wAAAVg"]
[Thu Apr 16 23:32:42.697049 2026] [:error] [pid 49094:tid 49098] [client 158.158.73.200:65099] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "aeEBGjbDwvcXorHR_Mwt7gAAAUI"]
[Thu Apr 16 23:32:43.393600 2026] [:error] [pid 57536:tid 57563] [client 158.158.73.200:65129] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "aeEBGyQU4faGja6jpDu5FAAAAA8"]
[Thu Apr 16 23:32:44.094088 2026] [:error] [pid 57536:tid 57551] [client 158.158.73.200:30021] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "aeEBHCQU4faGja6jpDu5GAAAAAM"]
[Thu Apr 16 23:32:45.308585 2026] [:error] [pid 57536:tid 57558] [client 158.158.73.200:61998] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "aeEBHSQU4faGja6jpDu5GwAAAAo"]
[Thu Apr 16 23:32:47.016362 2026] [:error] [pid 57537:tid 57598] [client 158.158.73.200:65104] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "aeEBH1VQRS8nm73ENAnRVwAAAFc"]
[Thu Apr 16 23:32:48.000110 2026] [:error] [pid 29603:tid 29628] [client 158.158.73.200:57907] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "aeEBH1fGOR6fpTWUAzq8RwAAARc"]
[Thu Apr 16 23:32:53.688478 2026] [autoindex:error] [pid 7880:tid 7906] [client 158.158.73.200:61980] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 16 23:33:01.618732 2026] [:error] [pid 7880:tid 7888] [client 158.158.73.200:61980] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aeEBLaaezm4fSGc0yULZFwAAAYM"]
[Thu Apr 16 23:33:02.329480 2026] [:error] [pid 57536:tid 57572] [client 158.158.73.200:26329] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aeEBLiQU4faGja6jpDu5PAAAABg"]
[Thu Apr 16 23:33:03.027564 2026] [:error] [pid 57536:tid 57555] [client 158.158.73.200:23525] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aeEBLyQU4faGja6jpDu5PgAAAAc"]
[Thu Apr 16 23:33:03.541830 2026] [:error] [pid 57639:tid 57646] [client 158.158.73.200:30064] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aeEBL6MCQoTw7TsxWukWxgAAAMA"]
[Thu Apr 16 23:33:04.186625 2026] [:error] [pid 57639:tid 57663] [client 158.158.73.200:29541] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "aeEBMKMCQoTw7TsxWukWygAAANE"]
[Thu Apr 16 23:33:04.853551 2026] [:error] [pid 7880:tid 7905] [client 158.158.73.200:65096] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "aeEBMKaezm4fSGc0yULZHAAAAZQ"]
[Thu Apr 16 23:33:05.426314 2026] [:error] [pid 57639:tid 57653] [client 158.158.73.200:57631] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "aeEBMaMCQoTw7TsxWukWzAAAAMc"]
[Thu Apr 16 23:33:06.065329 2026] [:error] [pid 57639:tid 57666] [client 158.158.73.200:29507] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "aeEBMqMCQoTw7TsxWukW0AAAANQ"]
[Thu Apr 16 23:33:06.685429 2026] [:error] [pid 57639:tid 57656] [client 158.158.73.200:61938] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "aeEBMqMCQoTw7TsxWukW3QAAAMo"]
[Thu Apr 16 23:33:07.380751 2026] [:error] [pid 49094:tid 49096] [client 158.158.73.200:61963] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "aeEBMzbDwvcXorHR_MwuGQAAAUA"]
[Thu Apr 16 23:33:07.975153 2026] [:error] [pid 57639:tid 57651] [client 158.158.73.200:57880] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "aeEBM6MCQoTw7TsxWukW5AAAAMU"]
[Thu Apr 16 23:33:08.566787 2026] [:error] [pid 57536:tid 57568] [client 158.158.73.200:29516] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "aeEBNCQU4faGja6jpDu5RgAAABQ"]
[Thu Apr 16 23:33:09.348775 2026] [:error] [pid 57536:tid 57549] [client 158.158.73.200:26322] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "aeEBNSQU4faGja6jpDu5SAAAAAE"]
[Thu Apr 16 23:33:09.953584 2026] [:error] [pid 49094:tid 49111] [client 158.158.73.200:65120] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "aeEBNTbDwvcXorHR_MwuJwAAAU8"]
[Thu Apr 16 23:33:10.518782 2026] [:error] [pid 57536:tid 57559] [client 158.158.73.200:57910] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "aeEBNiQU4faGja6jpDu5SgAAAAs"]
[Thu Apr 16 23:33:11.057859 2026] [:error] [pid 57639:tid 57658] [client 158.158.73.200:21015] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "aeEBN6MCQoTw7TsxWukW8gAAAMw"]
[Thu Apr 16 23:33:11.575987 2026] [:error] [pid 49094:tid 49100] [client 158.158.73.200:26356] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "aeEBNzbDwvcXorHR_MwuMAAAAUQ"]
[Thu Apr 16 23:33:12.217297 2026] [:error] [pid 57536:tid 57560] [client 158.158.73.200:30052] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "aeEBOCQU4faGja6jpDu5TQAAAAw"]
[Thu Apr 16 23:33:12.771899 2026] [:error] [pid 57536:tid 57553] [client 158.158.73.200:30053] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "aeEBOCQU4faGja6jpDu5TwAAAAU"]
[Thu Apr 16 23:33:13.604391 2026] [:error] [pid 57639:tid 57664] [client 158.158.73.200:26316] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "aeEBOaMCQoTw7TsxWukXDQAAANI"]
[Thu Apr 16 23:33:14.792279 2026] [:error] [pid 7880:tid 7888] [client 158.158.73.200:57657] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aeEBOqaezm4fSGc0yULZJwAAAYM"]
[Thu Apr 16 23:33:15.714700 2026] [:error] [pid 57639:tid 57650] [client 158.158.73.200:57606] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aeEBO6MCQoTw7TsxWukXEwAAAMQ"]
[Thu Apr 16 23:33:16.660023 2026] [:error] [pid 57639:tid 57654] [client 158.158.73.200:57648] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aeEBPKMCQoTw7TsxWukXGwAAAMg"]
[Thu Apr 16 23:33:17.570542 2026] [:error] [pid 57536:tid 57570] [client 158.158.73.200:65123] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aeEBPSQU4faGja6jpDu5XAAAABY"]
[Thu Apr 16 23:33:20.112438 2026] [:error] [pid 57537:tid 57575] [client 158.158.73.200:57908] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "aeEBQFVQRS8nm73ENAnRZQAAAEA"]
[Thu Apr 16 23:33:20.916944 2026] [:error] [pid 49094:tid 49120] [client 158.158.73.200:21029] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "aeEBQDbDwvcXorHR_MwuUwAAAVg"]
[Thu Apr 16 23:33:22.311900 2026] [:error] [pid 57536:tid 57556] [client 158.158.73.200:23681] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "aeEBQiQU4faGja6jpDu5ZgAAAAg"]
[Thu Apr 16 23:33:23.161598 2026] [:error] [pid 49094:tid 49119] [client 158.158.73.200:23499] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "aeEBQzbDwvcXorHR_MwuXwAAAVc"]
[Thu Apr 16 23:33:26.163667 2026] [:error] [pid 57536:tid 57560] [client 158.158.73.200:23700] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/nastar.php"] [unique_id "aeEBRiQU4faGja6jpDu5bAAAAAw"]
[Thu Apr 16 23:33:27.262640 2026] [:error] [pid 57538:tid 57624] [client 158.158.73.200:62006] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/nastar.php"] [unique_id "aeEBR8uMaiEF5SVR2BcCgQAAAJY"]
[Thu Apr 16 23:33:32.297053 2026] [:error] [pid 49094:tid 49119] [client 158.158.73.200:65131] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/nastar.php"] [unique_id "aeEBTDbDwvcXorHR_MwujgAAAVc"]
[Thu Apr 16 23:33:35.685825 2026] [:error] [pid 57536:tid 57555] [client 158.158.73.200:30072] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/nastar.php"] [unique_id "aeEBTyQU4faGja6jpDu5pAAAAAc"]
[Thu Apr 16 23:33:37.432999 2026] [:error] [pid 57536:tid 57566] [client 158.158.73.200:30024] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35_S.php"] [unique_id "aeEBUSQU4faGja6jpDu5swAAABI"]
[Thu Apr 16 23:33:38.602763 2026] [:error] [pid 29603:tid 29614] [client 158.158.73.200:61889] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35_S.php"] [unique_id "aeEBUlfGOR6fpTWUAzq8egAAAQk"]
[Thu Apr 16 23:33:39.578690 2026] [:error] [pid 49094:tid 49105] [client 158.158.73.200:23538] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35_S.php"] [unique_id "aeEBUzbDwvcXorHR_MwuoAAAAUk"]
[Thu Apr 16 23:33:40.939029 2026] [:error] [pid 57639:tid 57648] [client 158.158.73.200:30077] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35_S.php"] [unique_id "aeEBVKMCQoTw7TsxWukXQAAAAMI"]
[Thu Apr 16 23:33:42.334517 2026] [:error] [pid 57536:tid 57554] [client 158.158.73.200:61896] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "aeEBViQU4faGja6jpDu5wQAAAAY"]
[Thu Apr 16 23:33:43.549689 2026] [:error] [pid 57536:tid 57555] [client 158.158.73.200:26363] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "aeEBVyQU4faGja6jpDu5yQAAAAc"]
[Thu Apr 16 23:33:44.216757 2026] [:error] [pid 57639:tid 57647] [client 158.158.73.200:57635] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "aeEBWKMCQoTw7TsxWukXSgAAAME"]
[Thu Apr 16 23:33:45.093990 2026] [:error] [pid 57639:tid 57670] [client 158.158.73.200:62008] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "aeEBWaMCQoTw7TsxWukXUQAAANg"]
[Thu Apr 16 23:33:45.841540 2026] [:error] [pid 57639:tid 57664] [client 158.158.73.200:19614] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "aeEBWaMCQoTw7TsxWukXWAAAANI"]
[Thu Apr 16 23:33:47.373655 2026] [:error] [pid 57537:tid 57576] [client 158.158.73.200:62007] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "aeEBW1VQRS8nm73ENAnRggAAAEE"]
[Thu Apr 16 23:33:47.963041 2026] [:error] [pid 57537:tid 57577] [client 158.158.73.200:29537] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "aeEBW1VQRS8nm73ENAnRgwAAAEI"]
[Thu Apr 16 23:33:48.669695 2026] [:error] [pid 7880:tid 7887] [client 158.158.73.200:26364] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "aeEBXKaezm4fSGc0yULZTAAAAYI"]
[Thu Apr 16 23:33:49.586069 2026] [:error] [pid 29603:tid 29623] [client 158.158.73.200:61933] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "aeEBXVfGOR6fpTWUAzq8gwAAARI"]
[Thu Apr 16 23:33:50.760813 2026] [:error] [pid 57639:tid 57654] [client 158.158.73.200:61939] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "aeEBXqMCQoTw7TsxWukXZAAAAMg"]
[Thu Apr 16 23:33:51.820016 2026] [:error] [pid 57639:tid 57651] [client 158.158.73.200:61969] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "aeEBX6MCQoTw7TsxWukXaAAAAMU"]
[Thu Apr 16 23:33:53.198483 2026] [:error] [pid 57639:tid 57667] [client 158.158.73.200:61918] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "aeEBYaMCQoTw7TsxWukXawAAANU"]
[Thu Apr 16 23:33:53.818280 2026] [:error] [pid 49094:tid 49104] [client 158.158.73.200:57872] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "aeEBYTbDwvcXorHR_MwuvgAAAUg"]
[Thu Apr 16 23:33:54.889360 2026] [:error] [pid 57536:tid 57568] [client 158.158.73.200:23539] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "aeEBYiQU4faGja6jpDu53gAAABQ"]
[Thu Apr 16 23:33:55.706377 2026] [:error] [pid 57639:tid 57649] [client 158.158.73.200:57640] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "aeEBY6MCQoTw7TsxWukXewAAAMM"]
[Thu Apr 16 23:33:57.222314 2026] [:error] [pid 57639:tid 57668] [client 158.158.73.200:23509] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "aeEBZaMCQoTw7TsxWukXgAAAANY"]
[Thu Apr 16 23:33:59.216496 2026] [:error] [pid 7880:tid 7891] [client 158.158.73.200:26365] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "aeEBZ6aezm4fSGc0yULZVgAAAYY"]
[Thu Apr 16 23:34:14.511682 2026] [:error] [pid 49094:tid 49106] [client 158.158.73.200:57661] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "aeEBdjbDwvcXorHR_MwvAAAAAUo"]
[Thu Apr 16 23:34:15.655022 2026] [:error] [pid 57639:tid 57660] [client 158.158.73.200:21039] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "aeEBd6MCQoTw7TsxWukXkwAAAM4"]
[Thu Apr 16 23:34:17.028439 2026] [:error] [pid 49094:tid 49105] [client 158.158.73.200:26352] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "aeEBeTbDwvcXorHR_MwvAQAAAUk"]
[Thu Apr 16 23:34:21.523564 2026] [:error] [pid 49094:tid 49102] [client 158.158.73.200:29554] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "aeEBfTbDwvcXorHR_MwvBAAAAUY"]
[Thu Apr 16 23:34:35.890556 2026] [:error] [pid 49094:tid 49115] [client 158.158.73.200:65110] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "aeEBizbDwvcXorHR_MwvKgAAAVM"]
[Thu Apr 16 23:34:39.893880 2026] [:error] [pid 49094:tid 49118] [client 158.158.73.200:61907] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "aeEBjzbDwvcXorHR_MwvPAAAAVY"]
[Thu Apr 16 23:34:41.024593 2026] [:error] [pid 49094:tid 49119] [client 158.158.73.200:19656] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "aeEBkTbDwvcXorHR_MwvQAAAAVc"]
[Thu Apr 16 23:34:41.670683 2026] [:error] [pid 57537:tid 57596] [client 158.158.73.200:30065] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "aeEBkVVQRS8nm73ENAnRmAAAAFU"]
[Thu Apr 16 23:34:42.692311 2026] [:error] [pid 57639:tid 57661] [client 158.158.73.200:57893] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "aeEBkqMCQoTw7TsxWukYXgAAAM8"]
[Thu Apr 16 23:34:43.658083 2026] [:error] [pid 49094:tid 49109] [client 158.158.73.200:23695] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "aeEBkzbDwvcXorHR_MwvRAAAAU0"]
[Thu Apr 16 23:34:44.672548 2026] [:error] [pid 7880:tid 7897] [client 158.158.73.200:57623] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "aeEBlKaezm4fSGc0yULZgwAAAYw"]
[Thu Apr 16 23:34:46.997635 2026] [:error] [pid 57536:tid 57563] [client 158.158.73.200:23496] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "aeEBliQU4faGja6jpDu6lQAAAA8"]
[Thu Apr 16 23:34:47.731528 2026] [:error] [pid 57536:tid 57556] [client 158.158.73.200:23710] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "aeEBlyQU4faGja6jpDu6nQAAAAg"]
[Thu Apr 16 23:34:48.553030 2026] [:error] [pid 57639:tid 57660] [client 158.158.73.200:23549] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aeEBmKMCQoTw7TsxWukYaAAAAM4"]
[Thu Apr 16 23:34:49.378818 2026] [:error] [pid 57639:tid 57656] [client 158.158.73.200:61930] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aeEBmaMCQoTw7TsxWukYbAAAAMo"]
[Thu Apr 16 23:34:49.964618 2026] [:error] [pid 57639:tid 57663] [client 158.158.73.200:57652] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aeEBmaMCQoTw7TsxWukYcQAAANE"]
[Thu Apr 16 23:34:50.845440 2026] [:error] [pid 57536:tid 57553] [client 158.158.73.200:57911] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aeEBmiQU4faGja6jpDu6rgAAAAU"]
[Thu Apr 16 23:34:52.223067 2026] [:error] [pid 57538:tid 57613] [client 158.158.73.200:57628] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aeEBnMuMaiEF5SVR2BcCsgAAAIs"]
[Thu Apr 16 23:34:53.692157 2026] [:error] [pid 29603:tid 29628] [client 158.158.73.200:57644] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aeEBnVfGOR6fpTWUAzq8ugAAARc"]
[Thu Apr 16 23:34:54.592956 2026] [:error] [pid 49094:tid 49096] [client 158.158.73.200:26306] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aeEBnjbDwvcXorHR_MwvSQAAAUA"]
[Thu Apr 16 23:34:55.234662 2026] [:error] [pid 49094:tid 49116] [client 158.158.73.200:23495] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aeEBnzbDwvcXorHR_MwvTAAAAVQ"]
[Thu Apr 16 23:34:55.848583 2026] [:error] [pid 49094:tid 49113] [client 158.158.73.200:23523] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aeEBnzbDwvcXorHR_MwvTgAAAVE"]
[Thu Apr 16 23:34:56.683053 2026] [:error] [pid 57639:tid 57666] [client 158.158.73.200:57653] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aeEBoKMCQoTw7TsxWukYdgAAANQ"]
[Thu Apr 16 23:34:57.457979 2026] [:error] [pid 57639:tid 57662] [client 158.158.73.200:61927] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aeEBoaMCQoTw7TsxWukYeAAAANA"]
[Thu Apr 16 23:34:58.079022 2026] [:error] [pid 57639:tid 57652] [client 158.158.73.200:62010] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aeEBoqMCQoTw7TsxWukYegAAAMY"]
[Thu Apr 16 23:34:58.819437 2026] [:error] [pid 7880:tid 7905] [client 158.158.73.200:57659] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aeEBoqaezm4fSGc0yULZlAAAAZQ"]
[Thu Apr 16 23:34:59.428933 2026] [:error] [pid 29603:tid 29620] [client 158.158.73.200:65108] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aeEBo1fGOR6fpTWUAzq8uwAAAQ8"]
[Thu Apr 16 23:35:00.481191 2026] [:error] [pid 29603:tid 29619] [client 158.158.73.200:57647] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aeEBpFfGOR6fpTWUAzq8vQAAAQ4"]
[Thu Apr 16 23:35:01.166761 2026] [:error] [pid 29603:tid 29625] [client 158.158.73.200:30060] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aeEBpVfGOR6fpTWUAzq8vgAAARQ"]
[Thu Apr 16 23:35:01.826096 2026] [:error] [pid 29603:tid 29629] [client 158.158.73.200:61891] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aeEBpVfGOR6fpTWUAzq8wQAAARg"]
[Thu Apr 16 23:35:02.763836 2026] [:error] [pid 49094:tid 49117] [client 158.158.73.200:23526] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aeEBpjbDwvcXorHR_MwvUwAAAVU"]
[Thu Apr 16 23:35:03.400768 2026] [:error] [pid 57538:tid 57622] [client 158.158.73.200:23532] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aeEBp8uMaiEF5SVR2BcCwQAAAJQ"]
[Thu Apr 16 23:35:04.080233 2026] [:error] [pid 49094:tid 49107] [client 158.158.73.200:19611] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aeEBqDbDwvcXorHR_MwvVAAAAUs"]
[Thu Apr 16 23:35:04.725064 2026] [:error] [pid 49094:tid 49103] [client 158.158.73.200:26362] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aeEBqDbDwvcXorHR_MwvVgAAAUc"]
[Thu Apr 16 23:35:05.641770 2026] [:error] [pid 49094:tid 49111] [client 158.158.73.200:29567] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aeEBqTbDwvcXorHR_MwvXAAAAU8"]
[Thu Apr 16 23:35:06.211565 2026] [:error] [pid 49094:tid 49100] [client 158.158.73.200:57869] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aeEBqjbDwvcXorHR_MwvYAAAAUQ"]
[Thu Apr 16 23:35:07.022941 2026] [:error] [pid 49094:tid 49105] [client 158.158.73.200:57871] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aeEBqzbDwvcXorHR_MwvYwAAAUk"]
[Thu Apr 16 23:35:07.988959 2026] [:error] [pid 57536:tid 57553] [client 158.158.73.200:57641] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "aeEBqyQU4faGja6jpDu61AAAAAU"]
[Thu Apr 16 23:35:08.626504 2026] [:error] [pid 49094:tid 49103] [client 158.158.73.200:57884] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "aeEBrDbDwvcXorHR_MwvaQAAAUc"]
[Thu Apr 16 23:35:09.158147 2026] [:error] [pid 57536:tid 57570] [client 158.158.73.200:30038] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "aeEBrSQU4faGja6jpDu61wAAABY"]
[Thu Apr 16 23:35:09.709078 2026] [:error] [pid 57536:tid 57561] [client 158.158.73.200:29529] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "aeEBrSQU4faGja6jpDu63wAAAA0"]
[Thu Apr 16 23:35:10.231845 2026] [:error] [pid 57536:tid 57572] [client 158.158.73.200:26331] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aeEBriQU4faGja6jpDu65AAAABg"]
[Thu Apr 16 23:35:10.831599 2026] [:error] [pid 57639:tid 57646] [client 158.158.73.200:26315] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aeEBrqMCQoTw7TsxWukYmwAAAMA"]
[Thu Apr 16 23:35:11.428771 2026] [:error] [pid 49094:tid 49100] [client 158.158.73.200:61999] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aeEBrzbDwvcXorHR_MwvbQAAAUQ"]
[Thu Apr 16 23:35:12.168453 2026] [:error] [pid 29603:tid 29627] [client 158.158.73.200:23510] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aeEBsFfGOR6fpTWUAzq8xAAAARY"]
[Thu Apr 16 23:35:12.734136 2026] [:error] [pid 49094:tid 49120] [client 158.158.73.200:65143] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aeEBsDbDwvcXorHR_MwvcQAAAVg"]
[Thu Apr 16 23:35:27.421820 2026] [:error] [pid 57538:tid 57626] [client 158.158.73.200:61912] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "aeEBv8uMaiEF5SVR2BcDJgAAAJg"]
[Thu Apr 16 23:35:28.329113 2026] [:error] [pid 49094:tid 49101] [client 158.158.73.200:26321] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "aeEBwDbDwvcXorHR_MwvhQAAAUU"]
[Thu Apr 16 23:35:29.148903 2026] [:error] [pid 49094:tid 49107] [client 158.158.73.200:23723] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "aeEBwTbDwvcXorHR_MwvigAAAUs"]
[Thu Apr 16 23:35:29.773471 2026] [:error] [pid 49094:tid 49108] [client 158.158.73.200:57870] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "aeEBwTbDwvcXorHR_MwvjQAAAUw"]
[Thu Apr 16 23:35:30.452825 2026] [:error] [pid 57536:tid 57562] [client 158.158.73.200:57614] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aeEBwiQU4faGja6jpDu68gAAAA4"]
[Thu Apr 16 23:35:31.138076 2026] [:error] [pid 49094:tid 49105] [client 158.158.73.200:23709] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aeEBwzbDwvcXorHR_MwvkAAAAUk"]
[Thu Apr 16 23:35:32.371816 2026] [:error] [pid 57536:tid 57569] [client 158.158.73.200:26346] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aeEBxCQU4faGja6jpDu69AAAABU"]
[Thu Apr 16 23:35:33.039796 2026] [:error] [pid 57639:tid 57668] [client 158.158.73.200:29509] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aeEBxaMCQoTw7TsxWukYwQAAANY"]
[Thu Apr 16 23:35:34.137082 2026] [:error] [pid 29603:tid 29625] [client 158.158.73.200:61951] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aeEBxlfGOR6fpTWUAzq8ygAAARQ"]
[Thu Apr 16 23:35:35.074163 2026] [:error] [pid 49094:tid 49110] [client 158.158.73.200:21027] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aeEBxzbDwvcXorHR_MwvmgAAAU4"]
[Thu Apr 16 23:35:36.291163 2026] [:error] [pid 49094:tid 49109] [client 158.158.73.200:16747] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aeEByDbDwvcXorHR_MwvngAAAU0"]
[Thu Apr 16 23:35:37.608196 2026] [:error] [pid 57536:tid 57560] [client 158.158.73.200:61926] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aeEBySQU4faGja6jpDu6_gAAAAw"]
[Thu Apr 16 23:35:38.256894 2026] [:error] [pid 57538:tid 57609] [client 158.158.73.200:30055] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aeEBysuMaiEF5SVR2BcDJwAAAIc"]
[Thu Apr 16 23:35:39.493724 2026] [:error] [pid 57536:tid 57562] [client 158.158.73.200:26314] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aeEByyQU4faGja6jpDu7AwAAAA4"]
[Thu Apr 16 23:35:40.883316 2026] [:error] [pid 57536:tid 57570] [client 158.158.73.200:57879] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aeEBzCQU4faGja6jpDu7CgAAABY"]
[Thu Apr 16 23:35:42.024330 2026] [:error] [pid 57639:tid 57650] [client 158.158.73.200:57857] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aeEBzqMCQoTw7TsxWukYzQAAAMQ"]
[Thu Apr 16 23:35:43.890174 2026] [:error] [pid 57639:tid 57663] [client 158.158.73.200:57649] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aeEBz6MCQoTw7TsxWukY2wAAANE"]
[Thu Apr 16 23:35:44.893460 2026] [:error] [pid 57639:tid 57649] [client 158.158.73.200:29557] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aeEB0KMCQoTw7TsxWukY4gAAAMM"]
[Thu Apr 16 23:35:45.942492 2026] [:error] [pid 57538:tid 57617] [client 158.158.73.200:62012] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aeEB0cuMaiEF5SVR2BcDMgAAAI8"]
[Thu Apr 16 23:35:46.806666 2026] [:error] [pid 57639:tid 57661] [client 158.158.73.200:21073] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aeEB0qMCQoTw7TsxWukY6gAAAM8"]
[Thu Apr 16 23:35:47.434400 2026] [:error] [pid 57536:tid 57559] [client 158.158.73.200:61988] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "aeEB0yQU4faGja6jpDu7HAAAAAs"]
[Thu Apr 16 23:35:48.437389 2026] [:error] [pid 57538:tid 57624] [client 158.158.73.200:61894] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "aeEB1MuMaiEF5SVR2BcDOAAAAJY"]
[Thu Apr 16 23:35:49.926111 2026] [:error] [pid 57536:tid 57563] [client 158.158.73.200:29544] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "aeEB1SQU4faGja6jpDu7IgAAAA8"]
[Thu Apr 16 23:35:50.587379 2026] [:error] [pid 49094:tid 49108] [client 158.158.73.200:21051] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "aeEB1jbDwvcXorHR_MwvqQAAAUw"]
[Thu Apr 16 23:35:51.412340 2026] [:error] [pid 57639:tid 57647] [client 158.158.73.200:19706] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aeEB16MCQoTw7TsxWukZAAAAAME"]
[Thu Apr 16 23:35:51.986781 2026] [:error] [pid 49094:tid 49096] [client 158.158.73.200:57887] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aeEB1zbDwvcXorHR_MwvqwAAAUA"]
[Thu Apr 16 23:35:52.577024 2026] [:error] [pid 49094:tid 49112] [client 158.158.73.200:29551] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aeEB2DbDwvcXorHR_MwvrAAAAVA"]
[Thu Apr 16 23:35:53.342618 2026] [:error] [pid 57538:tid 57610] [client 158.158.73.200:61911] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aeEB2cuMaiEF5SVR2BcDRAAAAIg"]
[Thu Apr 16 23:35:54.091890 2026] [:error] [pid 57538:tid 57625] [client 158.158.73.200:30022] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aeEB2suMaiEF5SVR2BcDRwAAAJc"]
[Thu Apr 16 23:35:54.818876 2026] [:error] [pid 57537:tid 57587] [client 158.158.73.200:21025] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aeEB2lVQRS8nm73ENAnRuQAAAEw"]
[Thu Apr 16 23:35:55.420014 2026] [:error] [pid 57538:tid 57611] [client 158.158.73.200:61917] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aeEB28uMaiEF5SVR2BcDTQAAAIk"]
[Thu Apr 16 23:35:55.982086 2026] [:error] [pid 57538:tid 57616] [client 158.158.73.200:23517] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aeEB28uMaiEF5SVR2BcDTgAAAI4"]
[Thu Apr 16 23:35:56.616565 2026] [:error] [pid 7880:tid 7885] [client 158.158.73.200:30017] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aeEB3Kaezm4fSGc0yULZyAAAAYA"]
[Thu Apr 16 23:35:57.251657 2026] [:error] [pid 57639:tid 57662] [client 158.158.73.200:65097] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aeEB3aMCQoTw7TsxWukZDAAAANA"]
[Thu Apr 16 23:35:57.988468 2026] [:error] [pid 57639:tid 57653] [client 158.158.73.200:23692] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aeEB3aMCQoTw7TsxWukZDQAAAMc"]
[Thu Apr 16 23:35:58.810425 2026] [:error] [pid 57639:tid 57659] [client 158.158.73.200:30070] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aeEB3qMCQoTw7TsxWukZEwAAAM0"]
[Thu Apr 16 23:35:59.521977 2026] [:error] [pid 49094:tid 49110] [client 158.158.73.200:18249] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aeEB3zbDwvcXorHR_MwvyAAAAU4"]
[Thu Apr 16 23:36:01.087167 2026] [:error] [pid 29603:tid 29607] [client 158.158.73.200:57885] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aeEB4VfGOR6fpTWUAzq83QAAAQI"]
[Thu Apr 16 23:36:01.738880 2026] [:error] [pid 49094:tid 49107] [client 158.158.73.200:62003] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aeEB4TbDwvcXorHR_Mwv1wAAAUs"]
[Thu Apr 16 23:36:02.539231 2026] [:error] [pid 7880:tid 7898] [client 158.158.73.200:26342] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aeEB4qaezm4fSGc0yULZ0gAAAY0"]
[Thu Apr 16 23:36:03.282507 2026] [:error] [pid 49094:tid 49114] [client 158.158.73.200:23528] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aeEB4zbDwvcXorHR_Mwv4gAAAVI"]
[Thu Apr 16 23:36:04.087871 2026] [:error] [pid 49094:tid 49105] [client 158.158.73.200:57886] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aeEB5DbDwvcXorHR_Mwv6QAAAUk"]
[Thu Apr 16 23:36:04.725225 2026] [:error] [pid 57536:tid 57566] [client 158.158.73.200:62014] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aeEB5CQU4faGja6jpDu7KgAAABI"]
[Thu Apr 16 23:36:05.568835 2026] [:error] [pid 57538:tid 57618] [client 158.158.73.200:29547] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aeEB5cuMaiEF5SVR2BcDUgAAAJA"]
[Thu Apr 16 23:36:06.155509 2026] [:error] [pid 57536:tid 57552] [client 158.158.73.200:26354] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aeEB5iQU4faGja6jpDu7LgAAAAQ"]
[Thu Apr 16 23:36:07.257671 2026] [:error] [pid 49094:tid 49103] [client 158.158.73.200:26348] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aeEB5zbDwvcXorHR_Mwv9QAAAUc"]
[Thu Apr 16 23:36:07.785790 2026] [:error] [pid 57536:tid 57555] [client 158.158.73.200:16731] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aeEB5yQU4faGja6jpDu7LwAAAAc"]
[Thu Apr 16 23:36:08.570328 2026] [:error] [pid 49094:tid 49119] [client 158.158.73.200:57858] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aeEB6DbDwvcXorHR_Mwv_wAAAVc"]
[Thu Apr 16 23:36:09.465723 2026] [:error] [pid 49094:tid 49100] [client 158.158.73.200:61944] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "aeEB6TbDwvcXorHR_MwwBQAAAUQ"]
[Thu Apr 16 23:36:10.294333 2026] [:error] [pid 49094:tid 49119] [client 158.158.73.200:29550] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "aeEB6jbDwvcXorHR_MwwCgAAAVc"]
[Thu Apr 16 23:36:11.380377 2026] [:error] [pid 29603:tid 29606] [client 158.158.73.200:23686] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "aeEB61fGOR6fpTWUAzq85QAAAQE"]
[Thu Apr 16 23:36:12.248402 2026] [:error] [pid 57536:tid 57550] [client 158.158.73.200:26351] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "aeEB7CQU4faGja6jpDu7NgAAAAI"]
[Thu Apr 16 23:36:13.206910 2026] [:error] [pid 57536:tid 57567] [client 158.158.73.200:29530] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "aeEB7SQU4faGja6jpDu7OgAAABM"]
[Thu Apr 16 23:36:13.861341 2026] [:error] [pid 7880:tid 7886] [client 158.158.73.200:29527] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "aeEB7aaezm4fSGc0yULZ3wAAAYE"]
[Thu Apr 16 23:36:14.866181 2026] [:error] [pid 57536:tid 57564] [client 158.158.73.200:61973] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "aeEB7iQU4faGja6jpDu7QgAAABA"]
[Thu Apr 16 23:36:15.914331 2026] [:error] [pid 57639:tid 57666] [client 158.158.73.200:18330] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "aeEB76MCQoTw7TsxWukZKQAAANQ"]
[Thu Apr 16 23:36:16.880136 2026] [:error] [pid 57639:tid 57648] [client 158.158.73.200:19659] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aeEB8KMCQoTw7TsxWukZLwAAAMI"]
[Thu Apr 16 23:36:17.634022 2026] [:error] [pid 57639:tid 57661] [client 158.158.73.200:57645] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aeEB8aMCQoTw7TsxWukZMwAAAM8"]
[Thu Apr 16 23:36:19.954354 2026] [:error] [pid 57537:tid 57594] [client 158.158.73.200:29535] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aeEB81VQRS8nm73ENAnRwAAAAFM"]
[Thu Apr 16 23:36:20.635411 2026] [:error] [pid 7880:tid 7895] [client 158.158.73.200:23536] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aeEB9Kaezm4fSGc0yULZ6gAAAYo"]
[Thu Apr 16 23:36:21.718525 2026] [:error] [pid 57536:tid 57548] [client 158.158.73.200:23518] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aeEB9SQU4faGja6jpDu7VgAAAAA"]
[Thu Apr 16 23:36:22.821430 2026] [:error] [pid 57537:tid 57584] [client 158.158.73.200:62005] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aeEB9lVQRS8nm73ENAnRwwAAAEk"]
[Thu Apr 16 23:36:23.536174 2026] [:error] [pid 57536:tid 57570] [client 158.158.73.200:19682] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aeEB9yQU4faGja6jpDu7bwAAABY"]
[Thu Apr 16 23:36:24.798263 2026] [:error] [pid 49094:tid 49101] [client 158.158.73.200:30043] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "aeEB-DbDwvcXorHR_MwwHQAAAUU"]
[Thu Apr 16 23:36:33.252469 2026] [autoindex:error] [pid 57538:tid 57625] [client 158.158.73.200:23689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 16 23:36:34.355839 2026] [autoindex:error] [pid 57538:tid 57611] [client 158.158.73.200:23689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 16 23:36:40.909888 2026] [:error] [pid 57538:tid 57625] [client 158.158.73.200:23689] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aeECCMuMaiEF5SVR2BcDigAAAJc"]
[Thu Apr 16 23:36:42.418847 2026] [:error] [pid 29603:tid 29612] [client 158.158.73.200:57873] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aeECClfGOR6fpTWUAzq8-wAAAQc"]
[Thu Apr 16 23:36:43.877491 2026] [:error] [pid 7880:tid 7900] [client 158.158.73.200:61992] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aeECC6aezm4fSGc0yULaCQAAAY8"]
[Thu Apr 16 23:36:44.952188 2026] [:error] [pid 57639:tid 57661] [client 158.158.73.200:23705] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aeECDKMCQoTw7TsxWukZXwAAAM8"]
[Thu Apr 16 23:36:45.957309 2026] [:error] [pid 57537:tid 57583] [client 158.158.73.200:61953] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "aeECDVVQRS8nm73ENAnR4AAAAEg"]
[Thu Apr 16 23:36:48.133852 2026] [:error] [pid 57639:tid 57661] [client 158.158.73.200:65128] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "aeECEKMCQoTw7TsxWukZaQAAAM8"]
[Thu Apr 16 23:36:52.614009 2026] [:error] [pid 57537:tid 57580] [client 158.158.73.200:65098] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "aeECFFVQRS8nm73ENAnR5AAAAEU"]
[Thu Apr 16 23:36:53.435487 2026] [:error] [pid 57536:tid 57553] [client 158.158.73.200:26313] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "aeECFSQU4faGja6jpDu7vgAAAAU"]
[Thu Apr 16 23:36:54.900546 2026] [:error] [pid 57639:tid 57653] [client 158.158.73.200:29565] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aeECFqMCQoTw7TsxWukZegAAAMc"]
[Thu Apr 16 23:36:55.883875 2026] [:error] [pid 7880:tid 7908] [client 158.158.73.200:26343] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aeECF6aezm4fSGc0yULaGQAAAZc"]
[Thu Apr 16 23:36:56.818008 2026] [:error] [pid 49094:tid 49104] [client 158.158.73.200:29562] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aeECGDbDwvcXorHR_MwwOwAAAUg"]
[Thu Apr 16 23:36:57.777900 2026] [:error] [pid 57639:tid 57669] [client 158.158.73.200:18295] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aeECGaMCQoTw7TsxWukZfQAAANc"]
[Thu Apr 16 23:36:58.425376 2026] [:error] [pid 49094:tid 49100] [client 158.158.73.200:65130] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "aeECGjbDwvcXorHR_MwwPgAAAUQ"]
[Thu Apr 16 23:36:59.529774 2026] [:error] [pid 57639:tid 57668] [client 158.158.73.200:23691] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "aeECG6MCQoTw7TsxWukZgQAAANY"]
[Thu Apr 16 23:37:00.330892 2026] [:error] [pid 57536:tid 57564] [client 158.158.73.200:26358] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "aeECHCQU4faGja6jpDu7zAAAABA"]
[Thu Apr 16 23:37:01.182523 2026] [:error] [pid 49094:tid 49097] [client 158.158.73.200:30047] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "aeECHTbDwvcXorHR_MwwRQAAAUE"]
[Thu Apr 16 23:37:02.077013 2026] [:error] [pid 49094:tid 49101] [client 158.158.73.200:57918] [client 158.158.73.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeECHjbDwvcXorHR_MwwSQAAAUU"]
[Thu Apr 16 23:37:02.997112 2026] [:error] [pid 49094:tid 49103] [client 158.158.73.200:29539] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aeECHjbDwvcXorHR_MwwTwAAAUc"]
[Thu Apr 16 23:37:03.718614 2026] [:error] [pid 57639:tid 57646] [client 158.158.73.200:30033] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aeECH6MCQoTw7TsxWukZigAAAMA"]
[Thu Apr 16 23:37:04.517531 2026] [:error] [pid 57639:tid 57657] [client 158.158.73.200:57615] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aeECIKMCQoTw7TsxWukZkAAAAMs"]
[Thu Apr 16 23:37:05.944274 2026] [:error] [pid 57639:tid 57663] [client 158.158.73.200:23698] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aeECIaMCQoTw7TsxWukZlgAAANE"]
[Thu Apr 16 23:37:06.885955 2026] [:error] [pid 57639:tid 57656] [client 158.158.73.200:21023] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aeECIqMCQoTw7TsxWukZmgAAAMo"]
[Thu Apr 16 23:37:07.661971 2026] [:error] [pid 57639:tid 57649] [client 158.158.73.200:57876] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aeECI6MCQoTw7TsxWukZngAAAMM"]
[Thu Apr 16 23:37:08.299364 2026] [:error] [pid 29603:tid 29621] [client 158.158.73.200:26337] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aeECJFfGOR6fpTWUAzq9CwAAARA"]
[Thu Apr 16 23:37:08.957954 2026] [:error] [pid 7880:tid 7887] [client 158.158.73.200:23511] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aeECJKaezm4fSGc0yULaJQAAAYI"]
[Thu Apr 16 23:37:10.016253 2026] [:error] [pid 57639:tid 57656] [client 158.158.73.200:65088] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "aeECJqMCQoTw7TsxWukZqAAAAMo"]
[Thu Apr 16 23:37:11.113315 2026] [:error] [pid 57536:tid 57567] [client 158.158.73.200:57612] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "aeECJyQU4faGja6jpDu7zgAAABM"]
[Thu Apr 16 23:37:12.166450 2026] [:error] [pid 57536:tid 57569] [client 158.158.73.200:29564] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "aeECKCQU4faGja6jpDu7zwAAABU"]
[Thu Apr 16 23:37:13.038099 2026] [:error] [pid 49094:tid 49101] [client 158.158.73.200:61983] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "aeECKTbDwvcXorHR_MwwbwAAAUU"]
[Thu Apr 16 23:37:14.236688 2026] [:error] [pid 49094:tid 49115] [client 158.158.73.200:61997] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-file-manager/admin/"] [unique_id "aeECKjbDwvcXorHR_MwweQAAAVM"]
[Thu Apr 16 23:37:14.962392 2026] [:error] [pid 49094:tid 49113] [client 158.158.73.200:61993] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-file-manager/admin/"] [unique_id "aeECKjbDwvcXorHR_MwwfwAAAVE"]
[Thu Apr 16 23:37:16.325780 2026] [:error] [pid 57639:tid 57652] [client 158.158.73.200:23527] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-file-manager/admin/"] [unique_id "aeECLKMCQoTw7TsxWukZugAAAMY"]
[Thu Apr 16 23:37:17.306684 2026] [:error] [pid 57639:tid 57654] [client 158.158.73.200:57916] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-file-manager/admin/"] [unique_id "aeECLaMCQoTw7TsxWukZvgAAAMg"]
[Thu Apr 16 23:37:18.421295 2026] [:error] [pid 49094:tid 49100] [client 158.158.73.200:23505] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aeECLjbDwvcXorHR_MwwhwAAAUQ"]
[Thu Apr 16 23:37:19.569382 2026] [:error] [pid 57639:tid 57661] [client 158.158.73.200:57621] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aeECL6MCQoTw7TsxWukZwQAAAM8"]
[Thu Apr 16 23:37:20.627023 2026] [:error] [pid 49094:tid 49109] [client 158.158.73.200:23682] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aeECMDbDwvcXorHR_MwwjwAAAU0"]
[Thu Apr 16 23:37:22.062945 2026] [:error] [pid 49094:tid 49115] [client 158.158.73.200:26328] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aeECMjbDwvcXorHR_MwwkwAAAVM"]
[Thu Apr 16 23:37:23.464396 2026] [:error] [pid 57538:tid 57602] [client 158.158.73.200:29539] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev.php"] [unique_id "aeECM8uMaiEF5SVR2BcDqgAAAIA"]
[Thu Apr 16 23:37:24.438826 2026] [:error] [pid 57536:tid 57552] [client 158.158.73.200:30048] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev.php"] [unique_id "aeECNCQU4faGja6jpDu74gAAAAQ"]
[Thu Apr 16 23:37:25.870073 2026] [:error] [pid 57536:tid 57566] [client 158.158.73.200:57901] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev.php"] [unique_id "aeECNSQU4faGja6jpDu76AAAABI"]
[Thu Apr 16 23:37:27.554055 2026] [:error] [pid 49094:tid 49099] [client 158.158.73.200:61996] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev.php"] [unique_id "aeECNzbDwvcXorHR_MwwrQAAAUM"]
[Thu Apr 16 23:37:28.313576 2026] [:error] [pid 57537:tid 57590] [client 158.158.73.200:23719] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "aeECOFVQRS8nm73ENAnR_wAAAE8"]
[Thu Apr 16 23:37:29.467207 2026] [:error] [pid 49094:tid 49114] [client 158.158.73.200:65115] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "aeECOTbDwvcXorHR_MwwtgAAAVI"]
[Thu Apr 16 23:37:30.699125 2026] [:error] [pid 7880:tid 7886] [client 158.158.73.200:61940] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "aeECOqaezm4fSGc0yULaPQAAAYE"]
[Thu Apr 16 23:37:31.501250 2026] [:error] [pid 29603:tid 29622] [client 158.158.73.200:21043] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "aeECO1fGOR6fpTWUAzq9GQAAARE"]
[Thu Apr 16 23:37:32.324723 2026] [:error] [pid 57639:tid 57657] [client 158.158.73.200:26319] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "aeECPKMCQoTw7TsxWukZxAAAAMs"]
[Thu Apr 16 23:37:33.042023 2026] [:error] [pid 57639:tid 57651] [client 158.158.73.200:30025] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "aeECPaMCQoTw7TsxWukZyQAAAMU"]
[Thu Apr 16 23:37:33.784397 2026] [:error] [pid 57639:tid 57670] [client 158.158.73.200:57912] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "aeECPaMCQoTw7TsxWukZywAAANg"]
[Thu Apr 16 23:37:34.950268 2026] [:error] [pid 49094:tid 49096] [client 158.158.73.200:61898] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "aeECPjbDwvcXorHR_Mww0wAAAUA"]
[Thu Apr 16 23:37:36.429284 2026] [:error] [pid 57639:tid 57654] [client 158.158.73.200:65096] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "aeECQKMCQoTw7TsxWukZ3AAAAMg"]
[Thu Apr 16 23:37:37.659355 2026] [:error] [pid 49094:tid 49100] [client 158.158.73.200:61957] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "aeECQTbDwvcXorHR_Mww4QAAAUQ"]
[Thu Apr 16 23:37:38.617542 2026] [:error] [pid 57538:tid 57604] [client 158.158.73.200:57627] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "aeECQsuMaiEF5SVR2BcDuQAAAII"]
[Thu Apr 16 23:37:50.808509 2026] [:error] [pid 57639:tid 57665] [client 158.158.73.200:65111] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aeECTqMCQoTw7TsxWukaGQAAANM"]
[Thu Apr 16 23:37:51.371804 2026] [:error] [pid 57538:tid 57602] [client 158.158.73.200:23700] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aeECT8uMaiEF5SVR2BcDvwAAAIA"]
[Thu Apr 16 23:37:52.158972 2026] [:error] [pid 7880:tid 7895] [client 158.158.73.200:19690] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aeECUKaezm4fSGc0yULaUAAAAYo"]
[Thu Apr 16 23:37:52.793894 2026] [:error] [pid 49094:tid 49118] [client 158.158.73.200:30060] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aeECUDbDwvcXorHR_MwxAQAAAVY"]
[Thu Apr 16 23:37:53.412718 2026] [:error] [pid 57536:tid 57552] [client 158.158.73.200:18251] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aeECUSQU4faGja6jpDu8AAAAAAQ"]
[Thu Apr 16 23:37:54.060578 2026] [:error] [pid 29603:tid 29606] [client 158.158.73.200:23508] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aeECUlfGOR6fpTWUAzq9NQAAAQE"]
[Thu Apr 16 23:37:54.672970 2026] [:error] [pid 57537:tid 57582] [client 158.158.73.200:57620] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aeECUlVQRS8nm73ENAnSEQAAAEc"]
[Thu Apr 16 23:37:55.920301 2026] [:error] [pid 57538:tid 57603] [client 158.158.73.200:21072] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "aeECU8uMaiEF5SVR2BcDwAAAAIE"]
[Thu Apr 16 23:37:56.770856 2026] [:error] [pid 57639:tid 57666] [client 158.158.73.200:61909] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ew.php"] [unique_id "aeECVKMCQoTw7TsxWukaGgAAANQ"]
[Thu Apr 16 23:37:57.353657 2026] [:error] [pid 57639:tid 57658] [client 158.158.73.200:65092] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ew.php"] [unique_id "aeECVaMCQoTw7TsxWukaHgAAAMw"]
[Thu Apr 16 23:37:58.117546 2026] [:error] [pid 57538:tid 57620] [client 158.158.73.200:26357] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ew.php"] [unique_id "aeECVsuMaiEF5SVR2BcDxAAAAJI"]
[Thu Apr 16 23:37:58.827126 2026] [:error] [pid 57639:tid 57646] [client 158.158.73.200:23516] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ew.php"] [unique_id "aeECVqMCQoTw7TsxWukaIQAAAMA"]
[Thu Apr 16 23:37:59.338249 2026] [:error] [pid 57639:tid 57663] [client 158.158.73.200:26366] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file21.php"] [unique_id "aeECV6MCQoTw7TsxWukaIgAAANE"]
[Thu Apr 16 23:37:59.992700 2026] [:error] [pid 57538:tid 57614] [client 158.158.73.200:65133] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file21.php"] [unique_id "aeECV8uMaiEF5SVR2BcDxgAAAIw"]
[Thu Apr 16 23:38:00.589343 2026] [:error] [pid 57537:tid 57592] [client 158.158.73.200:57895] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file21.php"] [unique_id "aeECWFVQRS8nm73ENAnSFQAAAFE"]
[Thu Apr 16 23:38:01.167440 2026] [:error] [pid 49094:tid 49097] [client 158.158.73.200:30077] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file21.php"] [unique_id "aeECWTbDwvcXorHR_MwxDgAAAUE"]
[Thu Apr 16 23:38:01.765559 2026] [:error] [pid 57639:tid 57647] [client 158.158.73.200:61924] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hypo.php"] [unique_id "aeECWaMCQoTw7TsxWukaKAAAAME"]
[Thu Apr 16 23:38:02.321956 2026] [:error] [pid 29603:tid 29608] [client 158.158.73.200:29518] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hypo.php"] [unique_id "aeECWlfGOR6fpTWUAzq9NgAAAQM"]
[Thu Apr 16 23:38:03.089847 2026] [:error] [pid 57639:tid 57667] [client 158.158.73.200:57898] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hypo.php"] [unique_id "aeECW6MCQoTw7TsxWukaLAAAANU"]
[Thu Apr 16 23:38:03.726987 2026] [:error] [pid 29603:tid 29628] [client 158.158.73.200:61954] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hypo.php"] [unique_id "aeECW1fGOR6fpTWUAzq9NwAAARc"]
[Thu Apr 16 23:38:04.245892 2026] [:error] [pid 49094:tid 49113] [client 158.158.73.200:23490] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "aeECXDbDwvcXorHR_MwxFQAAAVE"]
[Thu Apr 16 23:38:04.768694 2026] [:error] [pid 7880:tid 7893] [client 158.158.73.200:23534] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "aeECXKaezm4fSGc0yULaVAAAAYg"]
[Thu Apr 16 23:38:05.395626 2026] [:error] [pid 57537:tid 57577] [client 158.158.73.200:62007] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "aeECXVVQRS8nm73ENAnSGQAAAEI"]
[Thu Apr 16 23:38:06.528717 2026] [:error] [pid 49094:tid 49112] [client 158.158.73.200:23533] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "aeECXjbDwvcXorHR_MwxGQAAAVA"]
[Thu Apr 16 23:38:07.311221 2026] [:error] [pid 7880:tid 7896] [client 158.158.73.200:57658] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "aeECX6aezm4fSGc0yULaVQAAAYs"]
[Thu Apr 16 23:38:08.073315 2026] [:error] [pid 49094:tid 49107] [client 158.158.73.200:30035] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "aeECYDbDwvcXorHR_MwxHwAAAUs"]
[Thu Apr 16 23:38:08.867120 2026] [:error] [pid 7880:tid 7900] [client 158.158.73.200:26309] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "aeECYKaezm4fSGc0yULaWgAAAY8"]
[Thu Apr 16 23:38:09.461639 2026] [:error] [pid 49094:tid 49104] [client 158.158.73.200:23524] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vee.php"] [unique_id "aeECYTbDwvcXorHR_MwxIwAAAUg"]
[Thu Apr 16 23:38:10.199035 2026] [:error] [pid 57537:tid 57578] [client 158.158.73.200:62002] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cabs.php"] [unique_id "aeECYlVQRS8nm73ENAnSHwAAAEM"]
[Thu Apr 16 23:38:10.757756 2026] [:error] [pid 57536:tid 57571] [client 158.158.73.200:61950] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cabs.php"] [unique_id "aeECYiQU4faGja6jpDu8BgAAABc"]
[Thu Apr 16 23:38:11.644937 2026] [:error] [pid 57538:tid 57613] [client 158.158.73.200:65140] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cabs.php"] [unique_id "aeECY8uMaiEF5SVR2BcDzAAAAIs"]
[Thu Apr 16 23:38:12.294013 2026] [:error] [pid 49094:tid 49117] [client 158.158.73.200:57646] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cabs.php"] [unique_id "aeECZDbDwvcXorHR_MwxKAAAAVU"]
[Thu Apr 16 23:38:13.138167 2026] [:error] [pid 57639:tid 57651] [client 158.158.73.200:61945] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "aeECZaMCQoTw7TsxWukaOAAAAMU"]
[Thu Apr 16 23:38:13.759081 2026] [:error] [pid 57639:tid 57670] [client 158.158.73.200:21030] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "aeECZaMCQoTw7TsxWukaPQAAANg"]
[Thu Apr 16 23:38:14.969114 2026] [:error] [pid 49094:tid 49105] [client 158.158.73.200:57632] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "aeECZjbDwvcXorHR_MwxLgAAAUk"]
[Thu Apr 16 23:38:15.821116 2026] [:error] [pid 57536:tid 57551] [client 158.158.73.200:61922] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "aeECZyQU4faGja6jpDu8CQAAAAM"]
[Thu Apr 16 23:38:16.513999 2026] [:error] [pid 49094:tid 49103] [client 158.158.73.200:26329] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1da.php"] [unique_id "aeECaDbDwvcXorHR_MwxNAAAAUc"]
[Thu Apr 16 23:38:17.090503 2026] [:error] [pid 57639:tid 57663] [client 158.158.73.200:61955] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1da.php"] [unique_id "aeECaaMCQoTw7TsxWukaRgAAANE"]
[Thu Apr 16 23:38:17.944818 2026] [:error] [pid 57639:tid 57649] [client 158.158.73.200:29528] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1da.php"] [unique_id "aeECaaMCQoTw7TsxWukaSQAAAMM"]
[Thu Apr 16 23:38:18.667736 2026] [:error] [pid 57536:tid 57553] [client 158.158.73.200:61975] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x1da.php"] [unique_id "aeECaiQU4faGja6jpDu8DAAAAAU"]
[Thu Apr 16 23:38:19.235633 2026] [:error] [pid 57537:tid 57588] [client 158.158.73.200:26333] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aeECa1VQRS8nm73ENAnSIgAAAE0"]
[Thu Apr 16 23:38:19.985350 2026] [:error] [pid 7880:tid 7897] [client 158.158.73.200:29553] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aeECa6aezm4fSGc0yULacAAAAYw"]
[Thu Apr 16 23:38:20.577689 2026] [:error] [pid 49094:tid 49101] [client 158.158.73.200:30059] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aeECbDbDwvcXorHR_MwxOAAAAUU"]
[Thu Apr 16 23:38:21.163208 2026] [:error] [pid 49094:tid 49112] [client 158.158.73.200:62011] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jp.php"] [unique_id "aeECbTbDwvcXorHR_MwxOQAAAVA"]
[Thu Apr 16 23:38:21.684535 2026] [:error] [pid 49094:tid 49119] [client 158.158.73.200:21085] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aeECbTbDwvcXorHR_MwxPAAAAVc"]
[Thu Apr 16 23:38:22.218056 2026] [:error] [pid 49094:tid 49104] [client 158.158.73.200:61893] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aeECbjbDwvcXorHR_MwxQAAAAUg"]
[Thu Apr 16 23:38:22.889495 2026] [:error] [pid 49094:tid 49100] [client 158.158.73.200:29561] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aeECbjbDwvcXorHR_MwxRAAAAUQ"]
[Thu Apr 16 23:38:23.423994 2026] [:error] [pid 49094:tid 49113] [client 158.158.73.200:57889] [client 158.158.73.200] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aeECbzbDwvcXorHR_MwxRwAAAVE"]
[Thu Apr 16 23:42:49.197941 2026] [:error] [pid 57639:tid 57649] [client 34.41.91.213:64775] [client 34.41.91.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.41.91.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeEDeaMCQoTw7TsxWukc6wAAAMM"]
[Thu Apr 16 23:42:51.273582 2026] [:error] [pid 57639:tid 57652] [client 34.41.91.213:64775] [client 34.41.91.213] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeEDe6MCQoTw7TsxWukc9QAAAMY"]
[Thu Apr 16 23:42:51.471141 2026] [:error] [pid 57639:tid 57660] [client 34.41.91.213:64775] [client 34.41.91.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.41.91.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeEDe6MCQoTw7TsxWukc9gAAAM4"]
[Thu Apr 16 23:42:52.846833 2026] [:error] [pid 29603:tid 29608] [client 34.41.91.213:59598] [client 34.41.91.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.41.91.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeEDfFfGOR6fpTWUAzq-VwAAAQM"]
[Thu Apr 16 23:42:54.207023 2026] [:error] [pid 49094:tid 49118] [client 34.41.91.213:59729] [client 34.41.91.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.41.91.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeEDfjbDwvcXorHR_MwzHwAAAVY"]
[Thu Apr 16 23:42:55.540003 2026] [:error] [pid 57639:tid 57661] [client 34.41.91.213:55057] [client 34.41.91.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.41.91.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeEDf6MCQoTw7TsxWukdBAAAAM8"]
[Thu Apr 16 23:42:56.960034 2026] [:error] [pid 57639:tid 57652] [client 34.41.91.213:60651] [client 34.41.91.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.41.91.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeEDgKMCQoTw7TsxWukdEwAAAMY"]
[Thu Apr 16 23:42:56.960180 2026] [:error] [pid 57639:tid 57652] [client 34.41.91.213:60651] [client 34.41.91.213] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.41.91.213, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeEDgKMCQoTw7TsxWukdEwAAAMY"]
[Fri Apr 17 00:36:58.702521 2026] [:error] [pid 3245:tid 3286] [client 103.188.92.48:25748] [client 103.188.92.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.188.92.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeEQKqESOMTHVLs-uFC-zQAAARg"]
[Fri Apr 17 00:37:15.392829 2026] [:error] [pid 43387:tid 43453] [client 103.188.92.48:25636] [client 103.188.92.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.188.92.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeEQOyBNsONqHxWTakUtKQAAAIM"]
[Fri Apr 17 00:37:20.589643 2026] [:error] [pid 3245:tid 3280] [client 103.188.92.48:25611] [client 103.188.92.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.188.92.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeEQQKESOMTHVLs-uFC_BgAAARI"]
[Fri Apr 17 00:37:30.294683 2026] [:error] [pid 43385:tid 43405] [client 103.188.92.48:25812] [client 103.188.92.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.188.92.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeEQSsnIxkJaUI8KNs7zwwAAABA"]
[Fri Apr 17 00:37:50.028327 2026] [:error] [pid 43387:tid 43474] [client 103.188.92.48:25280] [client 103.188.92.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.188.92.48, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeEQXiBNsONqHxWTakUtSwAAAJU"]
[Fri Apr 17 01:15:47.576880 2026] [:error] [pid 43387:tid 43476] [client 185.242.3.48:49311] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp"] [unique_id "aeEZQyBNsONqHxWTakU59gAAAJc"]
[Fri Apr 17 01:15:48.078199 2026] [:error] [pid 43385:tid 43398] [client 185.242.3.48:50968] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp"] [unique_id "aeEZRMnIxkJaUI8KNs4M3AAAAAk"]
[Fri Apr 17 01:15:48.603194 2026] [:error] [pid 43482:tid 43497] [client 185.242.3.48:52368] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp"] [unique_id "aeEZRD9SZnuKxlHrct2YjQAAAM0"]
[Fri Apr 17 01:15:49.089682 2026] [:error] [pid 43482:tid 43504] [client 185.242.3.48:54525] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp"] [unique_id "aeEZRT9SZnuKxlHrct2YkwAAANQ"]
[Fri Apr 17 01:15:49.623775 2026] [:error] [pid 43387:tid 43468] [client 185.242.3.48:56092] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp"] [unique_id "aeEZRSBNsONqHxWTakU5-AAAAI8"]
[Fri Apr 17 01:15:50.260636 2026] [:error] [pid 43482:tid 43499] [client 185.242.3.48:57835] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aeEZRj9SZnuKxlHrct2YnAAAAM8"]
[Fri Apr 17 01:15:50.753460 2026] [:error] [pid 43386:tid 43421] [client 185.242.3.48:60704] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aeEZRu91GAVgUfhPVDG9fgAAAEE"]
[Fri Apr 17 01:15:51.237793 2026] [:error] [pid 26480:tid 26500] [client 185.242.3.48:61906] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aeEZRwwLDJKTQNfarA1thgAAAdI"]
[Fri Apr 17 01:15:51.780570 2026] [:error] [pid 43385:tid 43394] [client 185.242.3.48:63924] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aeEZR8nIxkJaUI8KNs4M6AAAAAU"]
[Fri Apr 17 01:15:52.287890 2026] [:error] [pid 26480:tid 26485] [client 185.242.3.48:65072] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/setup-config.php"] [unique_id "aeEZSAwLDJKTQNfarA1tjgAAAcM"]
[Fri Apr 17 01:15:52.771010 2026] [:error] [pid 43387:tid 43450] [client 185.242.3.48:50430] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/install.php"] [unique_id "aeEZSCBNsONqHxWTakU6AgAAAII"]
[Fri Apr 17 01:15:53.251207 2026] [:error] [pid 26480:tid 26491] [client 185.242.3.48:51306] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/install.php"] [unique_id "aeEZSQwLDJKTQNfarA1tlAAAAck"]
[Fri Apr 17 01:15:53.735130 2026] [:error] [pid 43482:tid 43498] [client 185.242.3.48:52177] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/install.php"] [unique_id "aeEZST9SZnuKxlHrct2YpQAAAM4"]
[Fri Apr 17 01:15:54.212578 2026] [:error] [pid 26102:tid 26105] [client 185.242.3.48:52711] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/install.php"] [unique_id "aeEZSv127aFqw6ALdngRBAAAAYA"]
[Fri Apr 17 01:15:54.728104 2026] [:error] [pid 26480:tid 26490] [client 185.242.3.48:53893] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/install.php"] [unique_id "aeEZSgwLDJKTQNfarA1toAAAAcg"]
[Fri Apr 17 01:15:55.256709 2026] [:error] [pid 26102:tid 26126] [client 185.242.3.48:55186] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blog"] [unique_id "aeEZS_127aFqw6ALdngRCwAAAZU"]
[Fri Apr 17 01:15:55.741408 2026] [:error] [pid 43386:tid 43423] [client 185.242.3.48:56541] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blog"] [unique_id "aeEZS-91GAVgUfhPVDG9igAAAEM"]
[Fri Apr 17 01:15:56.234879 2026] [:error] [pid 43386:tid 43426] [client 185.242.3.48:57390] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blog"] [unique_id "aeEZTO91GAVgUfhPVDG9jQAAAEY"]
[Fri Apr 17 01:15:56.723890 2026] [:error] [pid 26102:tid 26109] [client 185.242.3.48:58622] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blog"] [unique_id "aeEZTP127aFqw6ALdngRIQAAAYQ"]
[Fri Apr 17 01:15:57.218242 2026] [:error] [pid 43385:tid 43415] [client 185.242.3.48:60036] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blog"] [unique_id "aeEZTcnIxkJaUI8KNs4M9gAAABg"]
[Fri Apr 17 01:15:57.713099 2026] [:error] [pid 43387:tid 43456] [client 185.242.3.48:61061] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new"] [unique_id "aeEZTSBNsONqHxWTakU6BQAAAIU"]
[Fri Apr 17 01:15:58.238224 2026] [:error] [pid 26102:tid 26125] [client 185.242.3.48:61886] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new"] [unique_id "aeEZTv127aFqw6ALdngRLgAAAZQ"]
[Fri Apr 17 01:15:58.736368 2026] [:error] [pid 4086:tid 4090] [client 185.242.3.48:62707] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new"] [unique_id "aeEZTllz7gxl_exM0FpD5wAAAUI"]
[Fri Apr 17 01:15:59.251739 2026] [:error] [pid 43482:tid 43501] [client 185.242.3.48:64644] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new"] [unique_id "aeEZTz9SZnuKxlHrct2YtgAAANE"]
[Fri Apr 17 01:15:59.757488 2026] [:error] [pid 26480:tid 26497] [client 185.242.3.48:51891] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new"] [unique_id "aeEZTwwLDJKTQNfarA1ttgAAAc8"]
[Fri Apr 17 01:16:00.360075 2026] [:error] [pid 43386:tid 43435] [client 185.242.3.48:56415] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/old"] [unique_id "aeEZUO91GAVgUfhPVDG9lQAAAE8"]
[Fri Apr 17 01:16:00.861795 2026] [:error] [pid 43387:tid 43461] [client 185.242.3.48:60525] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/old"] [unique_id "aeEZUCBNsONqHxWTakU6CQAAAIo"]
[Fri Apr 17 01:16:01.423843 2026] [:error] [pid 26102:tid 26116] [client 185.242.3.48:65177] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/old"] [unique_id "aeEZUf127aFqw6ALdngRRwAAAYs"]
[Fri Apr 17 01:16:01.951917 2026] [:error] [pid 26102:tid 26125] [client 185.242.3.48:65117] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/old"] [unique_id "aeEZUf127aFqw6ALdngRUAAAAZQ"]
[Fri Apr 17 01:16:02.523712 2026] [:error] [pid 26480:tid 26487] [client 185.242.3.48:58238] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/old"] [unique_id "aeEZUgwLDJKTQNfarA1tvwAAAcU"]
[Fri Apr 17 01:16:03.202535 2026] [:error] [pid 26480:tid 26486] [client 185.242.3.48:59311] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/newsite"] [unique_id "aeEZUwwLDJKTQNfarA1t0QAAAcQ"]
[Fri Apr 17 01:16:03.731635 2026] [:error] [pid 26480:tid 26491] [client 185.242.3.48:63832] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/newsite"] [unique_id "aeEZUwwLDJKTQNfarA1t3AAAAck"]
[Fri Apr 17 01:16:04.244860 2026] [:error] [pid 4086:tid 4105] [client 185.242.3.48:50375] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/newsite"] [unique_id "aeEZVFlz7gxl_exM0FpD9AAAAVE"]
[Fri Apr 17 01:16:04.785338 2026] [:error] [pid 26102:tid 26113] [client 185.242.3.48:54030] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/newsite"] [unique_id "aeEZVP127aFqw6ALdngRWAAAAYg"]
[Fri Apr 17 01:16:05.305764 2026] [:error] [pid 26480:tid 26502] [client 185.242.3.48:56273] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/newsite"] [unique_id "aeEZVQwLDJKTQNfarA1t9gAAAdQ"]
[Fri Apr 17 01:16:05.804617 2026] [:error] [pid 43482:tid 43504] [client 185.242.3.48:58916] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test"] [unique_id "aeEZVT9SZnuKxlHrct2YwAAAANQ"]
[Fri Apr 17 01:16:06.352702 2026] [:error] [pid 43482:tid 43491] [client 185.242.3.48:63637] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test"] [unique_id "aeEZVj9SZnuKxlHrct2YwQAAAMc"]
[Fri Apr 17 01:16:07.039440 2026] [:error] [pid 43385:tid 43396] [client 185.242.3.48:54610] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test"] [unique_id "aeEZV8nIxkJaUI8KNs4NHwAAAAc"]
[Fri Apr 17 01:16:07.663154 2026] [:error] [pid 43385:tid 43413] [client 185.242.3.48:60275] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test"] [unique_id "aeEZV8nIxkJaUI8KNs4NKQAAABc"]
[Fri Apr 17 01:16:08.167649 2026] [:error] [pid 3245:tid 3279] [client 185.242.3.48:52704] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test"] [unique_id "aeEZWKESOMTHVLs-uFDR3wAAARE"]
[Fri Apr 17 01:16:08.671830 2026] [:error] [pid 43387:tid 43462] [client 185.242.3.48:65088] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core"] [unique_id "aeEZWCBNsONqHxWTakU6FQAAAIs"]
[Fri Apr 17 01:16:09.319709 2026] [:error] [pid 43385:tid 43390] [client 185.242.3.48:56496] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core"] [unique_id "aeEZWcnIxkJaUI8KNs4NPQAAAAE"]
[Fri Apr 17 01:16:11.125570 2026] [:error] [pid 43385:tid 43390] [client 185.242.3.48:57744] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core"] [unique_id "aeEZW8nIxkJaUI8KNs4NRwAAAAE"]
[Fri Apr 17 01:16:11.869012 2026] [:error] [pid 43385:tid 43393] [client 185.242.3.48:57034] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core"] [unique_id "aeEZW8nIxkJaUI8KNs4NWAAAAAQ"]
[Fri Apr 17 01:16:12.615138 2026] [:error] [pid 3245:tid 3280] [client 185.242.3.48:53147] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core"] [unique_id "aeEZXKESOMTHVLs-uFDR6gAAARI"]
[Fri Apr 17 01:16:13.358726 2026] [:error] [pid 43385:tid 43395] [client 185.242.3.48:58894] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/testing"] [unique_id "aeEZXcnIxkJaUI8KNs4NbgAAAAY"]
[Fri Apr 17 01:16:14.346556 2026] [:error] [pid 26480:tid 26502] [client 185.242.3.48:58680] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/testing"] [unique_id "aeEZXgwLDJKTQNfarA1uKAAAAdQ"]
[Fri Apr 17 01:16:15.447059 2026] [:error] [pid 26480:tid 26493] [client 185.242.3.48:54567] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/testing"] [unique_id "aeEZXwwLDJKTQNfarA1uMgAAAcs"]
[Fri Apr 17 01:16:16.291864 2026] [:error] [pid 4086:tid 4095] [client 185.242.3.48:56160] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/testing"] [unique_id "aeEZYFlz7gxl_exM0FpEDAAAAUc"]
[Fri Apr 17 01:16:17.017783 2026] [:error] [pid 43387:tid 43472] [client 185.242.3.48:52209] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/testing"] [unique_id "aeEZYSBNsONqHxWTakU6IAAAAJM"]
[Fri Apr 17 01:16:17.884683 2026] [:error] [pid 43385:tid 43396] [client 185.242.3.48:58759] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/home"] [unique_id "aeEZYcnIxkJaUI8KNs4NhAAAAAc"]
[Fri Apr 17 01:16:20.679317 2026] [:error] [pid 43482:tid 43504] [client 185.242.3.48:55384] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/home"] [unique_id "aeEZZD9SZnuKxlHrct2Y6gAAANQ"]
[Fri Apr 17 01:16:22.660985 2026] [:error] [pid 43385:tid 43403] [client 185.242.3.48:64511] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/home"] [unique_id "aeEZZsnIxkJaUI8KNs4NuAAAAA4"]
[Fri Apr 17 01:16:24.900917 2026] [:error] [pid 26480:tid 26501] [client 185.242.3.48:59911] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/home"] [unique_id "aeEZaAwLDJKTQNfarA1udgAAAdM"]
[Fri Apr 17 01:16:27.306275 2026] [:error] [pid 43482:tid 43495] [client 185.242.3.48:62728] [client 185.242.3.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/home"] [unique_id "aeEZaz9SZnuKxlHrct2Y-gAAAMs"]
[Fri Apr 17 01:18:59.100594 2026] [:error] [pid 43482:tid 43496] [client 62.60.131.232:17358] [client 62.60.131.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeEaAz9SZnuKxlHrct2b3gAAAMw"]
[Fri Apr 17 01:19:00.363018 2026] [:error] [pid 43482:tid 43484] [client 62.60.131.232:61232] [client 62.60.131.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeEaBD9SZnuKxlHrct2b5QAAAMA"]
[Fri Apr 17 01:19:04.613725 2026] [:error] [pid 3245:tid 3281] [client 62.60.131.232:61276] [client 62.60.131.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeEaCKESOMTHVLs-uFDTmwAAARM"]
[Fri Apr 17 01:19:08.641424 2026] [:error] [pid 26480:tid 26497] [client 62.60.131.232:61332] [client 62.60.131.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeEaDAwLDJKTQNfarA1xqAAAAc8"]
[Fri Apr 17 01:19:08.752379 2026] [:error] [pid 26480:tid 26499] [client 62.60.131.232:61304] [client 62.60.131.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeEaDAwLDJKTQNfarA1xqQAAAdE"]
[Fri Apr 17 01:19:09.736646 2026] [:error] [pid 43482:tid 43501] [client 62.60.131.232:54150] [client 62.60.131.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/..;/"] [unique_id "aeEaDT9SZnuKxlHrct2cEgAAANE"]
[Fri Apr 17 01:19:10.868857 2026] [:error] [pid 26480:tid 26485] [client 62.60.131.232:54160] [client 62.60.131.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeEaDgwLDJKTQNfarA1xuwAAAcM"]
[Fri Apr 17 01:19:12.491903 2026] [:error] [pid 26102:tid 26111] [client 62.60.131.232:54186] [client 62.60.131.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/..;/"] [unique_id "aeEaEP127aFqw6ALdngThgAAAYY"]
[Fri Apr 17 01:19:13.127346 2026] [:error] [pid 43482:tid 43508] [client 62.60.131.232:54208] [client 62.60.131.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeEaET9SZnuKxlHrct2cPAAAANg"]
[Fri Apr 17 01:19:13.241014 2026] [:error] [pid 43385:tid 43401] [client 62.60.131.232:54178] [client 62.60.131.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeEaEcnIxkJaUI8KNs4SEwAAAAw"]
[Fri Apr 17 01:19:13.347147 2026] [:error] [pid 43482:tid 43493] [client 62.60.131.232:54196] [client 62.60.131.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeEaET9SZnuKxlHrct2cQAAAAMk"]
[Fri Apr 17 01:19:15.522674 2026] [:error] [pid 43482:tid 43492] [client 62.60.131.232:54222] [client 62.60.131.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeEaEz9SZnuKxlHrct2cWAAAAMg"]
[Fri Apr 17 01:19:15.524313 2026] [:error] [pid 43482:tid 43501] [client 62.60.131.232:54226] [client 62.60.131.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeEaEz9SZnuKxlHrct2cWQAAANE"]
[Fri Apr 17 01:19:15.529231 2026] [:error] [pid 43482:tid 43499] [client 62.60.131.232:54224] [client 62.60.131.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/..;/"] [unique_id "aeEaEz9SZnuKxlHrct2cWgAAAM8"]
[Fri Apr 17 01:19:17.156583 2026] [:error] [pid 43482:tid 43490] [client 62.60.131.232:54254] [client 62.60.131.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeEaFT9SZnuKxlHrct2ccwAAAMY"]
[Fri Apr 17 01:19:18.556698 2026] [:error] [pid 26480:tid 26490] [client 62.60.131.232:54270] [client 62.60.131.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeEaFgwLDJKTQNfarA1x2QAAAcg"]
[Fri Apr 17 01:19:19.274056 2026] [:error] [pid 26480:tid 26491] [client 62.60.131.232:54284] [client 62.60.131.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeEaFwwLDJKTQNfarA1x3AAAAck"]
[Fri Apr 17 01:19:19.828784 2026] [:error] [pid 43386:tid 43422] [client 62.60.131.232:33954] [client 62.60.131.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/..;/"] [unique_id "aeEaF-91GAVgUfhPVDG-1AAAAEI"]
[Fri Apr 17 01:19:23.515128 2026] [:error] [pid 3245:tid 3272] [client 62.60.131.232:33966] [client 62.60.131.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeEaG6ESOMTHVLs-uFDTvQAAAQo"]
[Fri Apr 17 01:19:23.515169 2026] [:error] [pid 43385:tid 43413] [client 62.60.131.232:33964] [client 62.60.131.232] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeEaG8nIxkJaUI8KNs4SMwAAABc"]
[Fri Apr 17 01:39:11.403651 2026] [:error] [pid 43385:tid 43399] [client 159.65.142.144:53256] [client 159.65.142.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.65.142.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeEev8nIxkJaUI8KNs4mEwAAAAo"]
[Fri Apr 17 01:48:57.990561 2026] [:error] [pid 26480:tid 26493] [client 140.245.33.62:50368] [client 140.245.33.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.245.33.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeEhCQwLDJKTQNfarA2CkAAAAcs"]
[Fri Apr 17 01:49:03.140167 2026] [:error] [pid 26480:tid 26490] [client 140.245.33.62:50368] [client 140.245.33.62] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeEhDwwLDJKTQNfarA2CqAAAAcg"]
[Fri Apr 17 01:49:03.230581 2026] [:error] [pid 26480:tid 26484] [client 140.245.33.62:50368] [client 140.245.33.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.245.33.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeEhDwwLDJKTQNfarA2CqQAAAcI"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 17 01:49:04.405909 2026] [:error] [pid 26480:tid 26495] [client 140.245.33.62:50368] [client 140.245.33.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.245.33.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeEhEAwLDJKTQNfarA2CrAAAAc0"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 17 01:49:05.025473 2026] [:error] [pid 26480:tid 26506] [client 140.245.33.62:50368] [client 140.245.33.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.245.33.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeEhEQwLDJKTQNfarA2CrQAAAdg"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 17 01:49:06.182503 2026] [:error] [pid 26480:tid 26487] [client 140.245.33.62:50368] [client 140.245.33.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.245.33.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeEhEgwLDJKTQNfarA2CsAAAAcU"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 17 01:49:06.754252 2026] [:error] [pid 26480:tid 26501] [client 140.245.33.62:50368] [client 140.245.33.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.245.33.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeEhEgwLDJKTQNfarA2CswAAAdM"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 17 01:49:07.958441 2026] [:error] [pid 26480:tid 26490] [client 140.245.33.62:50368] [client 140.245.33.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.245.33.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeEhEwwLDJKTQNfarA2CtQAAAcg"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 17 03:33:22.017425 2026] [:error] [pid 43743:tid 43827] [client 213.35.105.89:54578] [client 213.35.105.89] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aeE5gmkwDSHwg5viI8ir9wAAAJY"]
[Fri Apr 17 04:13:42.564853 2026] [:error] [pid 9151:tid 9185] [client 209.38.89.62:34106] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/install.php"] [unique_id "aeFC9shTVuRPkua22vRm-wAAABg"]
[Fri Apr 17 04:13:42.741906 2026] [:error] [pid 9151:tid 9175] [client 209.38.89.62:34118] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp/wp-admin/install.php"] [unique_id "aeFC9shTVuRPkua22vRm_wAAAA4"]
[Fri Apr 17 04:13:42.826117 2026] [:error] [pid 9152:tid 9197] [client 209.38.89.62:34134] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new/wp-admin/install.php"] [unique_id "aeFC9pJYca8I3TNCwIfT7AAAAEc"]
[Fri Apr 17 04:13:42.881037 2026] [:error] [pid 9151:tid 9184] [client 209.38.89.62:34144] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/old/wp-admin/install.php"] [unique_id "aeFC9shTVuRPkua22vRnAAAAABc"]
[Fri Apr 17 04:13:43.018592 2026] [:error] [pid 9151:tid 9174] [client 209.38.89.62:34160] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-admin/install.php"] [unique_id "aeFC98hTVuRPkua22vRnAgAAAA0"]
[Fri Apr 17 04:13:43.083962 2026] [:error] [pid 9151:tid 9165] [client 209.38.89.62:34164] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test/wp-admin/install.php"] [unique_id "aeFC98hTVuRPkua22vRnAwAAAAQ"]
[Fri Apr 17 04:13:43.315447 2026] [:error] [pid 9153:tid 9231] [client 209.38.89.62:34176] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blog/wp-admin/install.php"] [unique_id "aeFC9-MHGxkTZX3c45e0SgAAAI0"]
[Fri Apr 17 04:13:43.452389 2026] [:error] [pid 9153:tid 9230] [client 209.38.89.62:34188] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cms/wp-admin/install.php"] [unique_id "aeFC9-MHGxkTZX3c45e0SwAAAIw"]
[Fri Apr 17 04:13:43.792725 2026] [:error] [pid 9153:tid 9222] [client 209.38.89.62:34190] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/web/wp-admin/install.php"] [unique_id "aeFC9-MHGxkTZX3c45e0TwAAAIQ"]
[Fri Apr 17 04:13:44.053226 2026] [:error] [pid 9151:tid 9169] [client 209.38.89.62:34196] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/backup/wp-admin/install.php"] [unique_id "aeFC-MhTVuRPkua22vRnBAAAAAg"]
[Fri Apr 17 04:13:44.086406 2026] [:error] [pid 9151:tid 9182] [client 209.38.89.62:34206] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/site/wp-admin/install.php"] [unique_id "aeFC-MhTVuRPkua22vRnBQAAABU"]
[Fri Apr 17 04:13:44.272574 2026] [:error] [pid 9153:tid 9226] [client 209.38.89.62:34218] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oldsite/wp-admin/install.php"] [unique_id "aeFC-OMHGxkTZX3c45e0UwAAAIg"]
[Fri Apr 17 04:13:44.320338 2026] [:error] [pid 9151:tid 9179] [client 209.38.89.62:34226] [client 209.38.89.62] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop/wp-admin/install.php"] [unique_id "aeFC-MhTVuRPkua22vRnBgAAABI"]
[Fri Apr 17 06:25:51.552671 2026] [:error] [pid 9263:tid 9285] [client 43.133.69.37:43930] [client 43.133.69.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aeFh7xP68VyHNvj1e54V_QAAANQ"]
[Fri Apr 17 10:18:01.016656 2026] [:error] [pid 34273:tid 34287] [client 43.140.247.223:46402] [client 43.140.247.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aeGYWWuQDW686mK3dgGFYgAAAYw"]
[Fri Apr 17 12:12:19.506744 2026] [ssl:error] [pid 34273:tid 34291] [client 15.204.182.106:37234] AH02032: Hostname cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup, referer: https://cdbdinteriors.com.au/
[Fri Apr 17 12:37:49.189424 2026] [:error] [pid 9152:tid 9191] [client 62.60.131.233:8484] [client 62.60.131.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeG5HZJYca8I3TNCwIfj4AAAAEE"]
[Fri Apr 17 12:37:50.686163 2026] [:error] [pid 51878:tid 51904] [client 62.60.131.233:8506] [client 62.60.131.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeG5HknQhUtMbw9EsgYGqwAAARg"]
[Fri Apr 17 12:37:52.152255 2026] [:error] [pid 34273:tid 34290] [client 62.60.131.233:8518] [client 62.60.131.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeG5IGuQDW686mK3dgGyIgAAAY8"]
[Fri Apr 17 12:37:52.152693 2026] [:error] [pid 34273:tid 34287] [client 62.60.131.233:8540] [client 62.60.131.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeG5IGuQDW686mK3dgGyIwAAAYw"]
[Fri Apr 17 12:37:52.941591 2026] [:error] [pid 34273:tid 34279] [client 62.60.131.233:8544] [client 62.60.131.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeG5IGuQDW686mK3dgGyKAAAAYQ"]
[Fri Apr 17 12:37:53.410747 2026] [:error] [pid 34273:tid 34282] [client 62.60.131.233:8530] [client 62.60.131.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeG5IWuQDW686mK3dgGyKQAAAYc"]
[Fri Apr 17 12:37:53.689007 2026] [:error] [pid 9152:tid 9194] [client 62.60.131.233:8560] [client 62.60.131.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeG5IZJYca8I3TNCwIfkAAAAAEQ"]
[Fri Apr 17 12:37:57.311624 2026] [:error] [pid 9152:tid 9205] [client 62.60.131.233:8598] [client 62.60.131.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeG5JZJYca8I3TNCwIfkDwAAAE8"]
[Fri Apr 17 12:37:57.318728 2026] [:error] [pid 9152:tid 9190] [client 62.60.131.233:8574] [client 62.60.131.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeG5JZJYca8I3TNCwIfkEQAAAEA"]
[Fri Apr 17 12:37:57.319470 2026] [:error] [pid 9152:tid 9195] [client 62.60.131.233:8596] [client 62.60.131.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeG5JZJYca8I3TNCwIfkEAAAAEU"]
[Fri Apr 17 12:38:01.492383 2026] [:error] [pid 34273:tid 34286] [client 62.60.131.233:7728] [client 62.60.131.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeG5KWuQDW686mK3dgGyMgAAAYs"]
[Fri Apr 17 12:38:01.502613 2026] [:error] [pid 9152:tid 9196] [client 62.60.131.233:7720] [client 62.60.131.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeG5KZJYca8I3TNCwIfkHwAAAEY"]
[Fri Apr 17 12:38:03.290412 2026] [:error] [pid 9152:tid 9202] [client 62.60.131.233:7762] [client 62.60.131.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/..;/"] [unique_id "aeG5K5JYca8I3TNCwIfkJwAAAEw"]
[Fri Apr 17 12:38:04.792438 2026] [:error] [pid 34273:tid 34298] [client 62.60.131.233:7784] [client 62.60.131.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/..;/"] [unique_id "aeG5LGuQDW686mK3dgGyOwAAAZc"]
[Fri Apr 17 12:38:06.382078 2026] [:error] [pid 25010:tid 25022] [client 62.60.131.233:7798] [client 62.60.131.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeG5Lo-7kkf42RarqQ06QgAAAUk"]
[Fri Apr 17 12:38:07.050498 2026] [:error] [pid 9151:tid 9162] [client 62.60.131.233:7808] [client 62.60.131.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/..;/"] [unique_id "aeG5L8hTVuRPkua22vQLHgAAAAE"]
[Fri Apr 17 12:38:08.700690 2026] [:error] [pid 9151:tid 9163] [client 62.60.131.233:15080] [client 62.60.131.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeG5MMhTVuRPkua22vQLIAAAAAI"]
[Fri Apr 17 12:38:11.235301 2026] [:error] [pid 34273:tid 34292] [client 62.60.131.233:15118] [client 62.60.131.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/..;/"] [unique_id "aeG5M2uQDW686mK3dgGyTQAAAZE"]
[Fri Apr 17 12:38:11.985608 2026] [:error] [pid 9151:tid 9179] [client 62.60.131.233:15124] [client 62.60.131.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeG5M8hTVuRPkua22vQLJwAAABI"]
[Fri Apr 17 12:38:16.276701 2026] [:error] [pid 9153:tid 9220] [client 62.60.131.233:15176] [client 62.60.131.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeG5OOMHGxkTZX3c45fBuQAAAII"]
[Fri Apr 17 13:19:37.677119 2026] [:error] [pid 61523:tid 61559] [client 216.24.210.139:33327] [client 216.24.210.139] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aeHC6cOaH-Pgc7WEf4MwxQAAAdE"]
[Fri Apr 17 13:19:41.925389 2026] [:error] [pid 9263:tid 9272] [client 98.159.37.52:38587] [client 98.159.37.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aeHC7RP68VyHNvj1e56DuAAAAMc"]
[Fri Apr 17 13:19:47.827329 2026] [:error] [pid 9152:tid 9203] [client 98.159.37.65:36955] [client 98.159.37.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aeHC85JYca8I3TNCwIfuBAAAAE0"]
[Fri Apr 17 13:19:51.543428 2026] [:error] [pid 9152:tid 9194] [client 98.159.37.54:35527] [client 98.159.37.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aeHC95JYca8I3TNCwIfuDwAAAEQ"]
[Fri Apr 17 13:19:59.596756 2026] [:error] [pid 51878:tid 51888] [client 216.24.210.138:45599] [client 216.24.210.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aeHC_0nQhUtMbw9EsgYNQgAAAQg"]
[Fri Apr 17 13:20:01.379494 2026] [:error] [pid 51878:tid 51881] [client 216.24.210.135:29521] [client 216.24.210.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aeHDAUnQhUtMbw9EsgYNRAAAAQE"]
[Fri Apr 17 13:20:03.969824 2026] [:error] [pid 9263:tid 9288] [client 98.159.37.61:37163] [client 98.159.37.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aeHDAxP68VyHNvj1e56D1gAAANc"]
[Fri Apr 17 13:20:04.507958 2026] [:error] [pid 9263:tid 9267] [client 216.24.210.144:37903] [client 216.24.210.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aeHDBBP68VyHNvj1e56D2QAAAMI"]
[Fri Apr 17 13:20:05.022482 2026] [:error] [pid 9263:tid 9284] [client 98.159.37.48:52567] [client 98.159.37.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aeHDBRP68VyHNvj1e56D2wAAANM"]
[Fri Apr 17 13:20:05.561473 2026] [:error] [pid 9152:tid 9206] [client 98.159.37.66:55643] [client 98.159.37.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aeHDBZJYca8I3TNCwIfuGAAAAFA"]
[Fri Apr 17 13:20:06.764966 2026] [:error] [pid 61523:tid 61561] [client 98.159.37.48:60375] [client 98.159.37.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aeHDBsOaH-Pgc7WEf4Mw2wAAAdM"]
[Fri Apr 17 13:20:09.013437 2026] [:error] [pid 9152:tid 9214] [client 98.159.37.55:41299] [client 98.159.37.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aeHDCZJYca8I3TNCwIfuHAAAAFg"]
[Fri Apr 17 13:20:12.583338 2026] [:error] [pid 9263:tid 9287] [client 98.159.37.51:20125] [client 98.159.37.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aeHDDBP68VyHNvj1e56D8QAAANY"]
[Fri Apr 17 13:20:14.056889 2026] [:error] [pid 9153:tid 9241] [client 98.159.37.58:39273] [client 98.159.37.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aeHDDuMHGxkTZX3c45fG8QAAAJc"]
[Fri Apr 17 13:20:16.814710 2026] [:error] [pid 9263:tid 9268] [client 98.159.37.51:38627] [client 98.159.37.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aeHDEBP68VyHNvj1e56D-QAAAMM"]
[Fri Apr 17 13:20:23.579964 2026] [:error] [pid 25010:tid 25027] [client 216.24.210.142:29713] [client 216.24.210.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aeHDF4-7kkf42RarqQ0-QgAAAU4"]
[Fri Apr 17 13:20:25.287006 2026] [:error] [pid 9263:tid 9266] [client 216.24.210.140:56271] [client 216.24.210.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aeHDGRP68VyHNvj1e56EBQAAAME"]
[Fri Apr 17 13:20:28.245924 2026] [:error] [pid 25010:tid 25023] [client 98.159.37.61:60895] [client 98.159.37.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/defaults.php"] [unique_id "aeHDHI-7kkf42RarqQ0-RQAAAUo"]
[Fri Apr 17 13:20:31.009967 2026] [:error] [pid 61523:tid 61548] [client 98.159.37.46:61483] [client 98.159.37.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aeHDH8OaH-Pgc7WEf4Mw6AAAAcY"]
[Fri Apr 17 13:20:35.706542 2026] [:error] [pid 61523:tid 61547] [client 216.24.210.133:44181] [client 216.24.210.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aeHDI8OaH-Pgc7WEf4Mw8QAAAcU"]
[Fri Apr 17 13:20:37.529609 2026] [:error] [pid 61523:tid 61565] [client 98.159.37.60:50199] [client 98.159.37.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aeHDJcOaH-Pgc7WEf4Mw8wAAAdc"]
[Fri Apr 17 13:20:39.050981 2026] [:error] [pid 51878:tid 51891] [client 98.159.37.59:54159] [client 98.159.37.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aeHDJ0nQhUtMbw9EsgYNUQAAAQs"]
[Fri Apr 17 13:20:39.490893 2026] [:error] [pid 34273:tid 34298] [client 98.159.37.56:40335] [client 98.159.37.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aeHDJ2uQDW686mK3dgG4WwAAAZc"]
[Fri Apr 17 13:20:40.036284 2026] [:error] [pid 51878:tid 51898] [client 98.159.37.63:52711] [client 98.159.37.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aeHDKEnQhUtMbw9EsgYNUwAAARI"]
[Fri Apr 17 13:20:43.872304 2026] [:error] [pid 34273:tid 34280] [client 216.24.210.143:38923] [client 216.24.210.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/info.php"] [unique_id "aeHDK2uQDW686mK3dgG4XwAAAYU"]
[Fri Apr 17 13:20:44.246440 2026] [:error] [pid 9153:tid 9237] [client 216.24.210.140:57037] [client 216.24.210.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class.api.php"] [unique_id "aeHDLOMHGxkTZX3c45fG8wAAAJM"]
[Fri Apr 17 13:20:44.938085 2026] [:error] [pid 9152:tid 9195] [client 98.159.37.55:41441] [client 98.159.37.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aeHDLJJYca8I3TNCwIfuLgAAAEU"]
[Fri Apr 17 13:20:52.519748 2026] [:error] [pid 9152:tid 9200] [client 216.24.210.129:62291] [client 216.24.210.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/admin.php"] [unique_id "aeHDNJJYca8I3TNCwIfuOgAAAEo"]
[Fri Apr 17 13:20:56.623438 2026] [:error] [pid 9152:tid 9203] [client 216.24.210.141:61105] [client 216.24.210.141] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.141, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aeHDOJJYca8I3TNCwIfuPwAAAE0"]
[Fri Apr 17 13:21:09.951464 2026] [:error] [pid 9152:tid 9197] [client 216.24.210.141:61105] [client 216.24.210.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aeHDRZJYca8I3TNCwIfuUQAAAEc"]
[Fri Apr 17 13:21:13.022136 2026] [:error] [pid 9263:tid 9287] [client 216.24.210.130:29651] [client 216.24.210.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.130, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aeHDSRP68VyHNvj1e56EOAAAANY"]
[Fri Apr 17 13:21:14.609756 2026] [:error] [pid 9263:tid 9269] [client 216.24.210.130:29651] [client 216.24.210.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/item.php"] [unique_id "aeHDShP68VyHNvj1e56EOwAAAMQ"]
[Fri Apr 17 13:21:22.397663 2026] [:error] [pid 9152:tid 9207] [client 216.24.210.131:40257] [client 216.24.210.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aeHDUpJYca8I3TNCwIfuXwAAAFE"]
[Fri Apr 17 13:21:30.419667 2026] [:error] [pid 9263:tid 9277] [client 98.159.37.65:48497] [client 98.159.37.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aeHDWhP68VyHNvj1e56EWwAAAMw"]
[Fri Apr 17 13:21:33.238151 2026] [:error] [pid 34273:tid 34282] [client 98.159.37.46:49595] [client 98.159.37.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aeHDXWuQDW686mK3dgG4bQAAAYc"]
[Fri Apr 17 13:21:37.444041 2026] [:error] [pid 9151:tid 9183] [client 216.24.210.130:65491] [client 216.24.210.130] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.130, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aeHDYchTVuRPkua22vQN8AAAABY"]
[Fri Apr 17 13:21:38.351940 2026] [:error] [pid 9151:tid 9181] [client 216.24.210.130:65491] [client 216.24.210.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aeHDYshTVuRPkua22vQN8QAAABQ"]
[Fri Apr 17 13:21:59.750628 2026] [:error] [pid 9263:tid 9281] [client 98.159.37.49:42389] [client 98.159.37.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aeHDdxP68VyHNvj1e56EigAAANA"]
[Fri Apr 17 13:22:05.657180 2026] [:error] [pid 61523:tid 61546] [client 216.24.210.123:48751] [client 216.24.210.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.210.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aeHDfcOaH-Pgc7WEf4MxEQAAAcQ"]
[Fri Apr 17 13:22:09.738768 2026] [:error] [pid 61523:tid 61561] [client 216.24.210.123:48751] [client 216.24.210.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aeHDgcOaH-Pgc7WEf4MxHQAAAdM"]
[Fri Apr 17 13:22:11.468662 2026] [:error] [pid 9263:tid 9289] [client 98.159.37.61:54791] [client 98.159.37.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/infi.php"] [unique_id "aeHDgxP68VyHNvj1e56EkgAAANg"]
[Fri Apr 17 13:22:14.156865 2026] [:error] [pid 9152:tid 9211] [client 98.159.37.51:43141] [client 98.159.37.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aeHDhpJYca8I3TNCwIfucgAAAFU"]
[Fri Apr 17 13:22:17.668057 2026] [:error] [pid 9152:tid 9194] [client 98.159.37.49:30181] [client 98.159.37.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aeHDiZJYca8I3TNCwIfudgAAAEQ"]
[Fri Apr 17 13:22:18.537419 2026] [:error] [pid 9263:tid 9269] [client 98.159.37.58:28031] [client 98.159.37.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aeHDihP68VyHNvj1e56EmQAAAMQ"]
[Fri Apr 17 13:22:23.156660 2026] [:error] [pid 9153:tid 9232] [client 216.24.210.125:64611] [client 216.24.210.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aeHDj-MHGxkTZX3c45fHBgAAAI4"]
[Fri Apr 17 13:22:24.974131 2026] [:error] [pid 9263:tid 9271] [client 216.24.210.138:34919] [client 216.24.210.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "aeHDkBP68VyHNvj1e56EpgAAAMY"]
[Fri Apr 17 13:22:28.267539 2026] [:error] [pid 61523:tid 61561] [client 216.24.210.126:20989] [client 216.24.210.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/edit.php"] [unique_id "aeHDlMOaH-Pgc7WEf4MxJwAAAdM"]
[Fri Apr 17 13:22:31.663279 2026] [:error] [pid 9263:tid 9288] [client 216.24.210.147:45151] [client 216.24.210.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aeHDlxP68VyHNvj1e56EuQAAANc"]
[Fri Apr 17 13:22:34.976775 2026] [:error] [pid 9263:tid 9287] [client 98.159.37.58:35403] [client 98.159.37.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/click.php"] [unique_id "aeHDmhP68VyHNvj1e56EwwAAANY"]
[Fri Apr 17 13:22:39.148460 2026] [:error] [pid 9263:tid 9284] [client 98.159.37.47:21633] [client 98.159.37.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aeHDnxP68VyHNvj1e56E2QAAANM"]
[Fri Apr 17 13:22:46.342843 2026] [:error] [pid 9263:tid 9280] [client 216.24.210.129:38941] [client 216.24.210.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aeHDphP68VyHNvj1e56E8gAAAM8"]
[Fri Apr 17 13:22:47.267814 2026] [:error] [pid 9263:tid 9288] [client 98.159.37.66:32329] [client 98.159.37.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/xl2023.php"] [unique_id "aeHDpxP68VyHNvj1e56E9gAAANc"]
[Fri Apr 17 13:22:59.108748 2026] [autoindex:error] [pid 51878:tid 51897] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:01.677098 2026] [autoindex:error] [pid 51878:tid 51888] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:07.902486 2026] [autoindex:error] [pid 51878:tid 51880] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:10.388375 2026] [autoindex:error] [pid 51878:tid 51881] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:14.905020 2026] [autoindex:error] [pid 51878:tid 51886] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:15.136472 2026] [autoindex:error] [pid 51878:tid 51891] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:16.463444 2026] [autoindex:error] [pid 51878:tid 51888] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:16.666634 2026] [autoindex:error] [pid 51878:tid 51892] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:16.872130 2026] [autoindex:error] [pid 51878:tid 51894] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:17.854276 2026] [autoindex:error] [pid 51878:tid 51904] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:18.064440 2026] [autoindex:error] [pid 51878:tid 51887] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:18.317564 2026] [autoindex:error] [pid 51878:tid 51899] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:19.547010 2026] [autoindex:error] [pid 51878:tid 51890] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:20.038420 2026] [autoindex:error] [pid 51878:tid 51880] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:20.304278 2026] [autoindex:error] [pid 51878:tid 51885] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:23.370056 2026] [autoindex:error] [pid 51878:tid 51901] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:24.936303 2026] [autoindex:error] [pid 51878:tid 51895] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:25.177469 2026] [autoindex:error] [pid 51878:tid 51896] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:25.418305 2026] [autoindex:error] [pid 51878:tid 51886] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:25.667906 2026] [autoindex:error] [pid 51878:tid 51891] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:25.963817 2026] [autoindex:error] [pid 51878:tid 51893] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:27.245512 2026] [autoindex:error] [pid 51878:tid 51888] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:27.465743 2026] [autoindex:error] [pid 51878:tid 51892] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:30.471751 2026] [autoindex:error] [pid 51878:tid 51890] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:33.006613 2026] [autoindex:error] [pid 51878:tid 51884] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:33.608359 2026] [autoindex:error] [pid 51878:tid 51900] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:33.837958 2026] [autoindex:error] [pid 51878:tid 51883] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:37.068294 2026] [autoindex:error] [pid 51878:tid 51891] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:37.369265 2026] [autoindex:error] [pid 51878:tid 51893] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:40.477439 2026] [autoindex:error] [pid 51878:tid 51882] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:41.912017 2026] [autoindex:error] [pid 51878:tid 51898] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:43.185810 2026] [autoindex:error] [pid 51878:tid 51900] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:43.677620 2026] [autoindex:error] [pid 51878:tid 51883] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentythree/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:43.907813 2026] [autoindex:error] [pid 51878:tid 51901] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:44.136967 2026] [autoindex:error] [pid 51878:tid 51895] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:44.707241 2026] [autoindex:error] [pid 51878:tid 51897] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:46.935119 2026] [autoindex:error] [pid 51878:tid 51893] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:49.999383 2026] [autoindex:error] [pid 51878:tid 51882] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:50.459661 2026] [autoindex:error] [pid 51878:tid 51880] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:54.387330 2026] [autoindex:error] [pid 51878:tid 51881] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:55.722953 2026] [autoindex:error] [pid 51878:tid 51883] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:58.022883 2026] [autoindex:error] [pid 51878:tid 51889] [client 98.159.37.52:64751] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:59.445107 2026] [autoindex:error] [pid 51878:tid 51891] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:59.728551 2026] [autoindex:error] [pid 51878:tid 51886] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:23:59.905959 2026] [autoindex:error] [pid 51878:tid 51893] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:00.103589 2026] [autoindex:error] [pid 51878:tid 51903] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:00.359190 2026] [autoindex:error] [pid 51878:tid 51892] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:00.871632 2026] [autoindex:error] [pid 51878:tid 51894] [client 98.159.37.52:64751] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentytwo/assets/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:07.926853 2026] [autoindex:error] [pid 25010:tid 25035] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:08.254472 2026] [autoindex:error] [pid 25010:tid 25029] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:08.458213 2026] [autoindex:error] [pid 25010:tid 25026] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:08.691754 2026] [autoindex:error] [pid 25010:tid 25019] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:08.885812 2026] [autoindex:error] [pid 25010:tid 25025] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/calendar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:10.052966 2026] [autoindex:error] [pid 25010:tid 25020] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:13.356115 2026] [autoindex:error] [pid 25010:tid 25031] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/05/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:14.628071 2026] [autoindex:error] [pid 25010:tid 25022] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:14.817455 2026] [autoindex:error] [pid 25010:tid 25033] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:15.059036 2026] [autoindex:error] [pid 25010:tid 25015] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:15.315183 2026] [autoindex:error] [pid 25010:tid 25017] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:15.590909 2026] [autoindex:error] [pid 25010:tid 25016] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:19.467510 2026] [autoindex:error] [pid 25010:tid 25029] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:22.658774 2026] [autoindex:error] [pid 25010:tid 25036] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:22.998106 2026] [autoindex:error] [pid 25010:tid 25025] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:24.203184 2026] [autoindex:error] [pid 25010:tid 25020] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:29.449575 2026] [autoindex:error] [pid 25010:tid 25031] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:29.724867 2026] [autoindex:error] [pid 25010:tid 25024] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:30.022740 2026] [autoindex:error] [pid 25010:tid 25022] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:30.248373 2026] [autoindex:error] [pid 25010:tid 25033] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:35.395782 2026] [autoindex:error] [pid 25010:tid 25013] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:38.596415 2026] [autoindex:error] [pid 25010:tid 25021] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:42.532305 2026] [autoindex:error] [pid 25010:tid 25014] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:47.160332 2026] [autoindex:error] [pid 25010:tid 25030] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:49.493743 2026] [autoindex:error] [pid 25010:tid 25015] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:49.891531 2026] [autoindex:error] [pid 25010:tid 25017] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:51.839776 2026] [autoindex:error] [pid 25010:tid 25013] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:53.007368 2026] [autoindex:error] [pid 25010:tid 25035] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:24:53.256509 2026] [autoindex:error] [pid 25010:tid 25029] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/classic-editor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:25:07.573117 2026] [autoindex:error] [pid 25010:tid 25033] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:25:09.385850 2026] [autoindex:error] [pid 25010:tid 25016] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/ui/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:25:11.555776 2026] [autoindex:error] [pid 25010:tid 25028] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:25:13.551069 2026] [autoindex:error] [pid 25010:tid 25021] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:25:14.695168 2026] [autoindex:error] [pid 25010:tid 25019] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:25:14.949961 2026] [autoindex:error] [pid 25010:tid 25025] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:25:16.343048 2026] [autoindex:error] [pid 25010:tid 25020] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:25:16.577764 2026] [autoindex:error] [pid 25010:tid 25014] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:25:16.816602 2026] [autoindex:error] [pid 25010:tid 25018] [client 98.159.37.61:38037] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:25:20.956067 2026] [autoindex:error] [pid 25010:tid 25023] [client 216.24.210.136:28995] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/pullquote/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:25:23.614296 2026] [autoindex:error] [pid 25010:tid 25033] [client 216.24.210.136:28995] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/comments-pagination-numbers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:25:30.384902 2026] [autoindex:error] [pid 25010:tid 25026] [client 216.24.210.136:28995] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:25:30.754695 2026] [autoindex:error] [pid 25010:tid 25019] [client 216.24.210.136:28995] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/post-terms/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:25:31.965019 2026] [autoindex:error] [pid 25010:tid 25036] [client 216.24.210.136:28995] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:25:34.508552 2026] [autoindex:error] [pid 25010:tid 25014] [client 216.24.210.136:28995] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/namespaced/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:25:37.461564 2026] [autoindex:error] [pid 25010:tid 25032] [client 216.24.210.136:28995] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:25:41.699592 2026] [autoindex:error] [pid 25010:tid 25031] [client 216.24.210.136:28995] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/site-title/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:25:46.796578 2026] [autoindex:error] [pid 25010:tid 25035] [client 216.24.210.136:28995] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:25:50.519982 2026] [autoindex:error] [pid 25010:tid 25019] [client 216.24.210.136:28995] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:25:50.762528 2026] [autoindex:error] [pid 25010:tid 25025] [client 216.24.210.136:28995] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2026/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 17 13:32:57.916725 2026] [ssl:error] [pid 61523:tid 61550] [client 15.204.182.106:39782] AH02032: Hostname www.cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup, referer: https://www.cdbdinteriors.com.au/
[Fri Apr 17 13:47:09.724666 2026] [:error] [pid 9152:tid 9204] [client 23.234.93.175:59203] [client 23.234.93.175] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.234.93.175, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeHJXZJYca8I3TNCwIfzwAAAAE4"]
[Fri Apr 17 15:34:28.168577 2026] [:error] [pid 61523:tid 61561] [client 59.97.248.10:62437] [client 59.97.248.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.97.248.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeHihMOaH-Pgc7WEf4Nb1gAAAdM"]
[Fri Apr 17 15:34:39.574458 2026] [:error] [pid 51878:tid 51884] [client 59.97.248.10:62792] [client 59.97.248.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.97.248.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeHij0nQhUtMbw9EsgYo3wAAAQQ"]
[Fri Apr 17 15:34:51.080884 2026] [:error] [pid 9263:tid 9272] [client 59.97.248.10:63121] [client 59.97.248.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.97.248.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeHimxP68VyHNvj1e56_uAAAAMc"]
[Fri Apr 17 15:35:03.687824 2026] [:error] [pid 34273:tid 34297] [client 59.97.248.10:63412] [client 59.97.248.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.97.248.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeHip2uQDW686mK3dgHNZwAAAZY"]
[Fri Apr 17 15:35:16.181738 2026] [:error] [pid 61523:tid 61546] [client 59.97.248.10:63680] [client 59.97.248.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.97.248.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeHitMOaH-Pgc7WEf4NcIQAAAcQ"]
[Fri Apr 17 15:48:02.983616 2026] [:error] [pid 51878:tid 51882] [client 216.172.172.50:47042] [client 216.172.172.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.172.172.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeHlsknQhUtMbw9EsgYsHwAAAQI"]
[Fri Apr 17 16:13:28.974814 2026] [:error] [pid 51878:tid 51901] [client 103.69.15.94:57006] [client 103.69.15.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.69.15.94, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeHrqEnQhUtMbw9EsgYyUQAAARU"]
[Fri Apr 17 16:13:37.883014 2026] [:error] [pid 9151:tid 9165] [client 103.69.15.94:57380] [client 103.69.15.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.69.15.94, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeHrschTVuRPkua22vQerwAAAAQ"]
[Fri Apr 17 16:13:48.867252 2026] [:error] [pid 51878:tid 51904] [client 103.69.15.94:56903] [client 103.69.15.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.69.15.94, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeHrvEnQhUtMbw9EsgYycwAAARg"]
[Fri Apr 17 16:13:59.156153 2026] [:error] [pid 25010:tid 25033] [client 103.69.15.94:56548] [client 103.69.15.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.69.15.94, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeHrx4-7kkf42RarqQ1ReAAAAVQ"]
[Fri Apr 17 16:14:11.778955 2026] [:error] [pid 9263:tid 9279] [client 103.69.15.94:56658] [client 103.69.15.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.69.15.94, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeHr0xP68VyHNvj1e57UrQAAAM4"]
[Fri Apr 17 16:14:58.250955 2026] [:error] [pid 9152:tid 9204] [client 66.175.239.195:36532] [client 66.175.239.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.239.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeHsApJYca8I3TNCwIcYvAAAAE4"]
[Fri Apr 17 16:15:08.639178 2026] [:error] [pid 34273:tid 34275] [client 66.175.239.195:36014] [client 66.175.239.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.175.239.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeHsDGuQDW686mK3dgHUwwAAAYA"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 17 16:17:14.270734 2026] [:error] [pid 9152:tid 9202] [client 103.93.94.155:51174] [client 103.93.94.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.93.94.155, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeHsipJYca8I3TNCwIcZiwAAAEw"]
[Fri Apr 17 16:17:17.558429 2026] [:error] [pid 25010:tid 25030] [client 103.93.94.155:37650] [client 103.93.94.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.93.94.155, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeHsjY-7kkf42RarqQ1SIAAAAVE"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 17 16:28:44.632527 2026] [:error] [pid 61523:tid 61551] [client 66.94.101.63:53392] [client 66.94.101.63] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.94.101.63, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeHvPMOaH-Pgc7WEf4NuewAAAck"]
[Fri Apr 17 16:28:46.759826 2026] [:error] [pid 61523:tid 61548] [client 66.94.101.63:53392] [client 66.94.101.63] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.94.101.63, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeHvPsOaH-Pgc7WEf4NufAAAAcY"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 17 16:36:30.724841 2026] [:error] [pid 9153:tid 9239] [client 182.44.2.148:47730] [client 182.44.2.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeHxDuMHGxkTZX3c45fgxAAAAJU"]
[Fri Apr 17 16:50:44.785198 2026] [:error] [pid 9152:tid 9190] [client 43.130.106.18:44154] [client 43.130.106.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aeH0ZJJYca8I3TNCwIciKwAAAEA"]
[Fri Apr 17 17:55:01.784063 2026] [:error] [pid 34273:tid 34286] [client 115.73.221.158:34696] [client 115.73.221.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 115.73.221.158, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeIDdWuQDW686mK3dgHkAQAAAYs"]
[Fri Apr 17 17:55:02.695146 2026] [:error] [pid 34273:tid 34278] [client 115.73.221.158:34696] [client 115.73.221.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 115.73.221.158, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeIDdmuQDW686mK3dgHkAwAAAYM"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 17 18:27:05.382433 2026] [:error] [pid 25010:tid 25037] [client 34.82.166.166:36276] [client 34.82.166.166] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.local"] [unique_id "aeIK-Y-7kkf42RarqQ1hrQAAAVg"]
[Fri Apr 17 18:27:24.941715 2026] [:error] [pid 61523:tid 61565] [client 34.82.166.166:39598] [client 34.82.166.166] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.development"] [unique_id "aeILDMOaH-Pgc7WEf4OU_wAAAdc"]
[Fri Apr 17 18:28:25.067122 2026] [:error] [pid 51878:tid 51896] [client 34.82.166.166:47570] [client 34.82.166.166] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.save"] [unique_id "aeILSUnQhUtMbw9EsgZO7gAAARA"]
[Fri Apr 17 18:29:04.953940 2026] [:error] [pid 9263:tid 9277] [client 217.154.37.58:39846] [client 217.154.37.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.154.37.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeILcBP68VyHNvj1e54OrwAAAMw"]
[Fri Apr 17 18:29:06.946972 2026] [:error] [pid 9263:tid 9270] [client 217.154.37.58:39846] [client 217.154.37.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.154.37.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeILchP68VyHNvj1e54OsgAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 17 18:29:28.987680 2026] [:error] [pid 9263:tid 9271] [client 34.82.166.166:54316] [client 34.82.166.166] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/src/.env"] [unique_id "aeILiBP68VyHNvj1e54O3gAAAMY"]
[Fri Apr 17 18:41:01.489854 2026] [:error] [pid 9263:tid 9282] [client 43.166.251.233:38354] [client 43.166.251.233] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeIOPRP68VyHNvj1e54RsAAAANE"]
[Fri Apr 17 18:47:20.125819 2026] [:error] [pid 34273:tid 34279] [client 115.73.221.158:33734] [client 115.73.221.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 115.73.221.158, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeIPuGuQDW686mK3dgHspgAAAYQ"]
[Fri Apr 17 18:47:21.264057 2026] [:error] [pid 34273:tid 34293] [client 115.73.221.158:33734] [client 115.73.221.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 115.73.221.158, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeIPuWuQDW686mK3dgHspwAAAZI"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 17 18:53:03.291225 2026] [:error] [pid 61523:tid 61551] [client 168.187.5.210:35120] [client 168.187.5.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 168.187.5.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeIRD8OaH-Pgc7WEf4OaVAAAAck"]
[Fri Apr 17 18:53:05.143130 2026] [:error] [pid 61523:tid 61541] [client 168.187.5.210:35120] [client 168.187.5.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 168.187.5.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeIREcOaH-Pgc7WEf4OaVgAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 17 21:01:28.774224 2026] [:error] [pid 9153:tid 9239] [client 49.35.192.165:61769] [client 49.35.192.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.35.192.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeIvKOMHGxkTZX3c45cLpQAAAJU"]
[Fri Apr 17 21:54:24.610675 2026] [:error] [pid 9153:tid 9238] [client 49.35.192.165:45768] [client 49.35.192.165] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeI7kOMHGxkTZX3c45cWKQAAAJQ"]
[Fri Apr 17 21:56:12.658501 2026] [:error] [pid 25010:tid 25019] [client 49.35.192.165:61949] [client 49.35.192.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.35.192.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeI7_I-7kkf42RarqQ2CdAAAAUY"]
[Fri Apr 17 21:57:56.256115 2026] [:error] [pid 25010:tid 25033] [client 49.35.192.165:63207] [client 49.35.192.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.35.192.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeI8ZI-7kkf42RarqQ2CtwAAAVQ"]
[Fri Apr 17 21:59:37.080684 2026] [:error] [pid 61523:tid 61552] [client 49.35.192.165:64015] [client 49.35.192.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.35.192.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeI8ycOaH-Pgc7WEf4Pm-gAAAco"]
[Fri Apr 17 22:01:33.961788 2026] [:error] [pid 9152:tid 9212] [client 49.35.192.165:64588] [client 49.35.192.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.35.192.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeI9PZJYca8I3TNCwIdyzwAAAFY"]
[Fri Apr 17 22:03:24.761794 2026] [:error] [pid 51878:tid 51893] [client 49.35.192.165:52421] [client 49.35.192.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.35.192.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeI9rEnQhUtMbw9Esga3JwAAAQ0"]
[Fri Apr 17 22:46:48.680773 2026] [:error] [pid 9152:tid 9193] [client 159.65.142.144:54830] [client 159.65.142.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.65.142.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeJH2JJYca8I3TNCwId-pQAAAEM"]
[Fri Apr 17 23:14:44.654878 2026] [:error] [pid 25010:tid 25014] [client 42.96.40.62:36956] [client 42.96.40.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 42.96.40.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeJOZI-7kkf42RarqQ2O0wAAAUE"]
[Fri Apr 17 23:14:47.753062 2026] [:error] [pid 25010:tid 25031] [client 42.96.40.62:36956] [client 42.96.40.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 42.96.40.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeJOZ4-7kkf42RarqQ2O2AAAAVI"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 17 23:52:46.407297 2026] [:error] [pid 51878:tid 51902] [client 91.148.168.105:43990] [client 91.148.168.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.148.168.105, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeJXTknQhUtMbw9EsgbnRwAAARY"]
[Fri Apr 17 23:52:47.340857 2026] [:error] [pid 51878:tid 51901] [client 91.148.168.105:43990] [client 91.148.168.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.148.168.105, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeJXT0nQhUtMbw9EsgbnSwAAARU"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 18 01:04:59.388974 2026] [:error] [pid 63702:tid 63765] [client 50.6.229.148:57886] [client 50.6.229.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.229.148, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeJoO8TL05PWYsKqTEYF9QAAAVg"]
[Sat Apr 18 01:05:14.051072 2026] [:error] [pid 42442:tid 42466] [client 50.6.229.148:50428] [client 50.6.229.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.229.148, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeJoSj4PBGqL_yqPJ8kedwAAARY"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 18 01:11:04.450884 2026] [:error] [pid 42442:tid 42450] [client 34.132.20.231:62356] [client 34.132.20.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.132.20.231, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeJpqD4PBGqL_yqPJ8kiSQAAAQY"]
[Sat Apr 18 01:11:06.660794 2026] [:error] [pid 42442:tid 42449] [client 34.132.20.231:62356] [client 34.132.20.231] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeJpqj4PBGqL_yqPJ8kiTgAAAQU"]
[Sat Apr 18 01:11:06.917547 2026] [:error] [pid 42442:tid 42446] [client 34.132.20.231:62356] [client 34.132.20.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.132.20.231, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeJpqj4PBGqL_yqPJ8kiUQAAAQI"]
[Sat Apr 18 01:11:08.399782 2026] [:error] [pid 63702:tid 63754] [client 34.132.20.231:65137] [client 34.132.20.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.132.20.231, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeJprMTL05PWYsKqTEYJMgAAAU0"]
[Sat Apr 18 01:11:09.821635 2026] [:error] [pid 63702:tid 63751] [client 34.132.20.231:59272] [client 34.132.20.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.132.20.231, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeJprcTL05PWYsKqTEYJOgAAAUs"]
[Sat Apr 18 01:11:11.211677 2026] [:error] [pid 59044:tid 59108] [client 34.132.20.231:63693] [client 34.132.20.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.132.20.231, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeJprwFamkFyEtD_SMG73gAAAIc"]
[Sat Apr 18 01:11:12.594933 2026] [:error] [pid 42442:tid 42448] [client 34.132.20.231:62979] [client 34.132.20.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.132.20.231, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeJpsD4PBGqL_yqPJ8kiXwAAAQQ"]
[Sat Apr 18 01:11:12.595158 2026] [:error] [pid 42442:tid 42448] [client 34.132.20.231:62979] [client 34.132.20.231] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.132.20.231, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeJpsD4PBGqL_yqPJ8kiXwAAAQQ"]
[Sat Apr 18 01:16:20.143799 2026] [:error] [pid 59042:tid 59048] [client 34.66.2.35:59708] [client 34.66.2.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.66.2.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeJq5J6p5oql0UklEBJMigAAAAE"]
[Sat Apr 18 01:16:22.295845 2026] [:error] [pid 59042:tid 59052] [client 34.66.2.35:59708] [client 34.66.2.35] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeJq5p6p5oql0UklEBJMlgAAAAU"]
[Sat Apr 18 01:16:22.494356 2026] [:error] [pid 59042:tid 59063] [client 34.66.2.35:59708] [client 34.66.2.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.66.2.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeJq5p6p5oql0UklEBJMlwAAABA"]
[Sat Apr 18 01:16:23.854059 2026] [:error] [pid 42442:tid 42464] [client 34.66.2.35:55202] [client 34.66.2.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.66.2.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeJq5z4PBGqL_yqPJ8kngQAAARQ"]
[Sat Apr 18 01:16:25.253945 2026] [:error] [pid 42442:tid 42454] [client 34.66.2.35:52774] [client 34.66.2.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.66.2.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeJq6T4PBGqL_yqPJ8kniQAAAQo"]
[Sat Apr 18 01:16:26.598953 2026] [:error] [pid 59043:tid 59075] [client 34.66.2.35:56221] [client 34.66.2.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.66.2.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeJq6oRtUGE9SfUh2wwRhAAAAEE"]
[Sat Apr 18 01:16:28.027936 2026] [:error] [pid 42442:tid 42464] [client 34.66.2.35:59237] [client 34.66.2.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.66.2.35, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeJq7D4PBGqL_yqPJ8knjwAAARQ"]
[Sat Apr 18 01:16:28.028134 2026] [:error] [pid 42442:tid 42464] [client 34.66.2.35:59237] [client 34.66.2.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.66.2.35, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeJq7D4PBGqL_yqPJ8knjwAAARQ"]
[Sat Apr 18 01:29:16.459474 2026] [:error] [pid 59044:tid 59111] [client 20.239.240.186:35866] [client 20.239.240.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/request"] [unique_id "aeJt7AFamkFyEtD_SMHAKwAAAIo"]
[Sat Apr 18 01:29:16.616436 2026] [:error] [pid 42442:tid 42451] [client 20.239.240.186:35885] [client 20.239.240.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inquiry-form"] [unique_id "aeJt7D4PBGqL_yqPJ8kuswAAAQc"]
[Sat Apr 18 01:29:16.727122 2026] [:error] [pid 59042:tid 59071] [client 20.239.240.186:35892] [client 20.239.240.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/faq"] [unique_id "aeJt7J6p5oql0UklEBJRRgAAABg"]
[Sat Apr 18 01:29:16.927762 2026] [:error] [pid 59044:tid 59119] [client 20.239.240.186:35872] [client 20.239.240.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/help"] [unique_id "aeJt7AFamkFyEtD_SMHALAAAAJI"]
[Sat Apr 18 01:29:17.000522 2026] [:error] [pid 59043:tid 59076] [client 20.239.240.186:35886] [client 20.239.240.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/access"] [unique_id "aeJt7IRtUGE9SfUh2wwUVQAAAEI"]
[Sat Apr 18 02:15:16.816539 2026] [:error] [pid 59136:tid 59139] [client 185.85.241.123:38550] [client 185.85.241.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.85.241.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeJ4tCaoiUyiIR3EhLXJGQAAAMA"]
[Sat Apr 18 02:15:17.823041 2026] [:error] [pid 59136:tid 59147] [client 185.85.241.123:38550] [client 185.85.241.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.85.241.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeJ4tSaoiUyiIR3EhLXJGgAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 18 03:41:06.792839 2026] [:error] [pid 9970:tid 9974] [client 4.223.163.152:61053] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nwflm.php"] [unique_id "aeKM0iYdRLRhVmaIMx1hRwAAAMA"]
[Sat Apr 18 03:41:08.694195 2026] [:error] [pid 9863:tid 9883] [client 4.223.163.152:58492] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nwflm.php"] [unique_id "aeKM1DjjiypiFrTucbLeEgAAAAo"]
[Sat Apr 18 03:41:13.123745 2026] [:error] [pid 9863:tid 9896] [client 4.223.163.152:58876] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nwflm.php"] [unique_id "aeKM2TjjiypiFrTucbLeGAAAABc"]
[Sat Apr 18 03:41:15.397722 2026] [:error] [pid 9864:tid 9918] [client 4.223.163.152:31436] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nwflm.php"] [unique_id "aeKM24CFeowknfXHM7kAhwAAAEw"]
[Sat Apr 18 03:41:17.276435 2026] [:error] [pid 9970:tid 9995] [client 4.223.163.152:52368] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aeKM3SYdRLRhVmaIMx1hZwAAANU"]
[Sat Apr 18 03:41:21.394968 2026] [:error] [pid 9863:tid 9875] [client 4.223.163.152:62544] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aeKM4TjjiypiFrTucbLeJgAAAAI"]
[Sat Apr 18 03:41:23.789390 2026] [:error] [pid 9864:tid 9923] [client 4.223.163.152:10691] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aeKM44CFeowknfXHM7kAjwAAAFE"]
[Sat Apr 18 03:41:25.765085 2026] [:error] [pid 9863:tid 9880] [client 4.223.163.152:63009] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aeKM5TjjiypiFrTucbLeOQAAAAc"]
[Sat Apr 18 03:41:27.387384 2026] [:error] [pid 9864:tid 9919] [client 4.223.163.152:62989] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "aeKM54CFeowknfXHM7kAlQAAAE0"]
[Sat Apr 18 03:41:29.586743 2026] [:error] [pid 9970:tid 9983] [client 4.223.163.152:62646] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "aeKM6SYdRLRhVmaIMx1hhgAAAMk"]
[Sat Apr 18 03:41:33.135209 2026] [:error] [pid 9970:tid 9974] [client 4.223.163.152:55217] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "aeKM7SYdRLRhVmaIMx1hmAAAAMA"]
[Sat Apr 18 03:41:35.527953 2026] [:error] [pid 9970:tid 9990] [client 4.223.163.152:56869] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "aeKM7yYdRLRhVmaIMx1hogAAANA"]
[Sat Apr 18 03:41:37.497354 2026] [:error] [pid 9865:tid 9940] [client 4.223.163.152:10518] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "aeKM8azb5knECIY-C-hhdwAAAIM"]
[Sat Apr 18 03:41:39.351202 2026] [:error] [pid 9865:tid 9942] [client 4.223.163.152:59158] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "aeKM86zb5knECIY-C-hhfAAAAIU"]
[Sat Apr 18 03:41:40.428282 2026] [:error] [pid 9865:tid 9954] [client 4.223.163.152:54996] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "aeKM9Kzb5knECIY-C-hhgAAAAJE"]
[Sat Apr 18 03:41:41.666814 2026] [:error] [pid 9970:tid 9982] [client 4.223.163.152:52029] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "aeKM9SYdRLRhVmaIMx1hsQAAAMg"]
[Sat Apr 18 03:41:42.467156 2026] [:error] [pid 9970:tid 9989] [client 4.223.163.152:59162] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "aeKM9iYdRLRhVmaIMx1htQAAAM8"]
[Sat Apr 18 03:41:43.935149 2026] [:error] [pid 9863:tid 9879] [client 4.223.163.152:56343] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "aeKM9zjjiypiFrTucbLeUQAAAAY"]
[Sat Apr 18 03:41:45.606171 2026] [:error] [pid 9863:tid 9897] [client 4.223.163.152:52475] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "aeKM-TjjiypiFrTucbLeVgAAABg"]
[Sat Apr 18 03:41:48.243442 2026] [:error] [pid 9864:tid 9923] [client 4.223.163.152:55042] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "aeKM_ICFeowknfXHM7kAwQAAAFE"]
[Sat Apr 18 03:41:50.877754 2026] [:error] [pid 9970:tid 9974] [client 4.223.163.152:60522] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "aeKM_iYdRLRhVmaIMx1h0AAAAMA"]
[Sat Apr 18 03:41:52.424484 2026] [:error] [pid 9865:tid 9940] [client 4.223.163.152:56622] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "aeKNAKzb5knECIY-C-hhkwAAAIM"]
[Sat Apr 18 03:41:53.733851 2026] [:error] [pid 9865:tid 9950] [client 4.223.163.152:57824] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "aeKNAazb5knECIY-C-hhnwAAAI0"]
[Sat Apr 18 03:41:54.529702 2026] [:error] [pid 9865:tid 9958] [client 4.223.163.152:10665] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "aeKNAqzb5knECIY-C-hhpQAAAJU"]
[Sat Apr 18 03:41:55.661882 2026] [:error] [pid 9865:tid 9953] [client 4.223.163.152:10519] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "aeKNA6zb5knECIY-C-hhpgAAAJA"]
[Sat Apr 18 03:41:57.094492 2026] [:error] [pid 9863:tid 9876] [client 4.223.163.152:57800] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "aeKNBTjjiypiFrTucbLeaAAAAAM"]
[Sat Apr 18 03:41:58.403090 2026] [:error] [pid 9863:tid 9893] [client 4.223.163.152:56331] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "aeKNBjjjiypiFrTucbLecgAAABQ"]
[Sat Apr 18 03:41:59.952740 2026] [:error] [pid 9970:tid 9982] [client 4.223.163.152:57796] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "aeKNByYdRLRhVmaIMx1h8QAAAMg"]
[Sat Apr 18 03:42:03.271501 2026] [:error] [pid 9863:tid 9886] [client 4.223.163.152:61984] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/water.php"] [unique_id "aeKNCzjjiypiFrTucbLefAAAAA0"]
[Sat Apr 18 03:42:16.166352 2026] [:error] [pid 9863:tid 9894] [client 4.223.163.152:53722] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "aeKNGDjjiypiFrTucbLenAAAABU"]
[Sat Apr 18 03:42:17.242206 2026] [:error] [pid 9863:tid 9875] [client 4.223.163.152:59842] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "aeKNGTjjiypiFrTucbLenwAAAAI"]
[Sat Apr 18 03:42:17.978447 2026] [:error] [pid 9970:tid 9979] [client 4.223.163.152:53010] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "aeKNGSYdRLRhVmaIMx1iSwAAAMU"]
[Sat Apr 18 03:42:19.107099 2026] [:error] [pid 9863:tid 9889] [client 4.223.163.152:55149] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "aeKNGzjjiypiFrTucbLeogAAABA"]
[Sat Apr 18 03:42:20.239110 2026] [:error] [pid 9970:tid 9992] [client 4.223.163.152:57873] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aeKNHCYdRLRhVmaIMx1iXwAAANI"]
[Sat Apr 18 03:42:20.521960 2026] [:error] [pid 9863:tid 9875] [client 4.223.163.152:59842] [client 4.223.163.152] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "57.141.14.63_bb694759cd2c22a01c1316c1c32e166b75850636"): Internal error (specific information not available) [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "aeKNGTjjiypiFrTucbLenwAAAAI"]
[Sat Apr 18 03:42:22.287689 2026] [:error] [pid 9865:tid 9949] [client 4.223.163.152:63767] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aeKNHqzb5knECIY-C-hh0gAAAIw"]
[Sat Apr 18 03:42:24.768094 2026] [:error] [pid 9863:tid 9890] [client 4.223.163.152:53023] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aeKNIDjjiypiFrTucbLeqwAAABE"]
[Sat Apr 18 03:42:27.510353 2026] [:error] [pid 9970:tid 9987] [client 4.223.163.152:54354] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aeKNIyYdRLRhVmaIMx1ihwAAAM0"]
[Sat Apr 18 03:42:31.373323 2026] [:error] [pid 9970:tid 9977] [client 4.223.163.152:60253] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aeKNJyYdRLRhVmaIMx1ipQAAAMM"]
[Sat Apr 18 03:42:33.238107 2026] [:error] [pid 9865:tid 9943] [client 4.223.163.152:63793] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aeKNKazb5knECIY-C-hh4gAAAIY"]
[Sat Apr 18 03:42:34.770140 2026] [:error] [pid 9865:tid 9958] [client 4.223.163.152:63323] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aeKNKqzb5knECIY-C-hh5wAAAJU"]
[Sat Apr 18 03:42:35.580380 2026] [:error] [pid 9970:tid 9978] [client 4.223.163.152:63779] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aeKNKyYdRLRhVmaIMx1iwAAAAMQ"]
[Sat Apr 18 03:42:36.256890 2026] [:error] [pid 9865:tid 9946] [client 4.223.163.152:10819] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aeKNLKzb5knECIY-C-hh6wAAAIk"]
[Sat Apr 18 03:42:37.492911 2026] [:error] [pid 9863:tid 9880] [client 4.223.163.152:55122] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aeKNLTjjiypiFrTucbLexAAAAAc"]
[Sat Apr 18 03:42:38.203588 2026] [:error] [pid 9863:tid 9874] [client 4.223.163.152:54346] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aeKNLjjjiypiFrTucbLexgAAAAE"]
[Sat Apr 18 03:42:38.784701 2026] [:error] [pid 9863:tid 9875] [client 4.223.163.152:55153] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aeKNLjjjiypiFrTucbLeyAAAAAI"]
[Sat Apr 18 03:42:39.649540 2026] [:error] [pid 9970:tid 9991] [client 4.223.163.152:57692] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aeKNLyYdRLRhVmaIMx1iyAAAANE"]
[Sat Apr 18 03:42:40.382700 2026] [:error] [pid 9970:tid 9996] [client 4.223.163.152:57679] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aeKNMCYdRLRhVmaIMx1izAAAANY"]
[Sat Apr 18 03:42:41.122653 2026] [:error] [pid 9970:tid 9980] [client 4.223.163.152:55645] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aeKNMSYdRLRhVmaIMx1i0AAAAMY"]
[Sat Apr 18 03:42:41.775627 2026] [:error] [pid 9970:tid 9998] [client 4.223.163.152:63813] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aeKNMSYdRLRhVmaIMx1i0wAAANg"]
[Sat Apr 18 03:42:42.725411 2026] [:error] [pid 9970:tid 9991] [client 4.223.163.152:59224] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "aeKNMiYdRLRhVmaIMx1i2QAAANE"]
[Sat Apr 18 03:42:43.754521 2026] [:error] [pid 9865:tid 9952] [client 4.223.163.152:59846] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "aeKNM6zb5knECIY-C-hh-QAAAI8"]
[Sat Apr 18 03:42:44.598451 2026] [:error] [pid 9865:tid 9937] [client 4.223.163.152:55622] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "aeKNNKzb5knECIY-C-hh_QAAAIA"]
[Sat Apr 18 03:42:45.438852 2026] [:error] [pid 9863:tid 9890] [client 4.223.163.152:55668] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "aeKNNTjjiypiFrTucbLe4AAAABE"]
[Sat Apr 18 03:42:46.152105 2026] [:error] [pid 9863:tid 9880] [client 4.223.163.152:55145] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "aeKNNjjjiypiFrTucbLe4QAAAAc"]
[Sat Apr 18 03:42:46.958252 2026] [:error] [pid 9863:tid 9881] [client 4.223.163.152:57909] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "aeKNNjjjiypiFrTucbLe4gAAAAg"]
[Sat Apr 18 03:42:48.444362 2026] [:error] [pid 9863:tid 9874] [client 4.223.163.152:59243] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "aeKNODjjiypiFrTucbLe5QAAAAE"]
[Sat Apr 18 03:42:51.094405 2026] [:error] [pid 9970:tid 9986] [client 4.223.163.152:55619] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "aeKNOyYdRLRhVmaIMx1jBAAAAMw"]
[Sat Apr 18 03:42:55.293412 2026] [:error] [pid 9863:tid 9896] [client 4.223.163.152:62950] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "aeKNPzjjiypiFrTucbLfCgAAABc"]
[Sat Apr 18 03:42:58.167293 2026] [:error] [pid 9864:tid 9909] [client 4.223.163.152:55652] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "aeKNQoCFeowknfXHM7kBJAAAAEQ"]
[Sat Apr 18 03:42:59.228574 2026] [:error] [pid 9865:tid 9942] [client 4.223.163.152:54369] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "aeKNQ6zb5knECIY-C-hiBwAAAIU"]
[Sat Apr 18 03:43:00.007408 2026] [:error] [pid 9864:tid 9917] [client 4.223.163.152:55283] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "aeKNRICFeowknfXHM7kBJwAAAEs"]
[Sat Apr 18 03:43:00.705682 2026] [:error] [pid 9865:tid 9937] [client 4.223.163.152:52500] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "aeKNRKzb5knECIY-C-hiCAAAAIA"]
[Sat Apr 18 03:43:01.537553 2026] [:error] [pid 9865:tid 9944] [client 4.223.163.152:60727] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "aeKNRazb5knECIY-C-hiCQAAAIc"]
[Sat Apr 18 03:43:02.431799 2026] [:error] [pid 9863:tid 9886] [client 4.223.163.152:52808] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "aeKNRjjjiypiFrTucbLfFgAAAA0"]
[Sat Apr 18 03:43:03.138707 2026] [:error] [pid 9970:tid 9998] [client 4.223.163.152:60725] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "aeKNRyYdRLRhVmaIMx1jTQAAANg"]
[Sat Apr 18 03:43:03.719313 2026] [:error] [pid 9970:tid 9974] [client 4.223.163.152:62918] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aeKNRyYdRLRhVmaIMx1jVgAAAMA"]
[Sat Apr 18 03:43:04.353385 2026] [:error] [pid 9863:tid 9873] [client 4.223.163.152:15793] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aeKNSDjjiypiFrTucbLfGAAAAAA"]
[Sat Apr 18 03:43:05.000905 2026] [:error] [pid 9863:tid 9875] [client 4.223.163.152:55263] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aeKNSDjjiypiFrTucbLfGQAAAAI"]
[Sat Apr 18 03:43:05.598853 2026] [:error] [pid 9970:tid 9976] [client 4.223.163.152:60688] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aeKNSSYdRLRhVmaIMx1jZwAAAMI"]
[Sat Apr 18 03:43:06.252756 2026] [:error] [pid 9863:tid 9879] [client 4.223.163.152:15756] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.mopj.php"] [unique_id "aeKNSjjjiypiFrTucbLfHQAAAAY"]
[Sat Apr 18 03:43:06.835938 2026] [:error] [pid 9865:tid 9950] [client 4.223.163.152:54391] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.mopj.php"] [unique_id "aeKNSqzb5knECIY-C-hiEQAAAI0"]
[Sat Apr 18 03:43:07.466684 2026] [:error] [pid 9970:tid 9995] [client 4.223.163.152:55638] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.mopj.php"] [unique_id "aeKNSyYdRLRhVmaIMx1jdQAAANU"]
[Sat Apr 18 03:43:08.198898 2026] [:error] [pid 9970:tid 9992] [client 4.223.163.152:55258] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.mopj.php"] [unique_id "aeKNTCYdRLRhVmaIMx1jfAAAANI"]
[Sat Apr 18 03:43:08.838084 2026] [:error] [pid 9864:tid 9915] [client 4.223.163.152:55798] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "aeKNTICFeowknfXHM7kBPgAAAEk"]
[Sat Apr 18 03:43:09.384582 2026] [:error] [pid 9864:tid 9919] [client 4.223.163.152:65488] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "aeKNTYCFeowknfXHM7kBRAAAAE0"]
[Sat Apr 18 03:43:09.997679 2026] [:error] [pid 9864:tid 9928] [client 4.223.163.152:62946] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "aeKNTYCFeowknfXHM7kBRQAAAFY"]
[Sat Apr 18 03:43:11.195653 2026] [:error] [pid 9864:tid 9905] [client 4.223.163.152:15799] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "aeKNT4CFeowknfXHM7kBSgAAAEA"]
[Sat Apr 18 03:43:11.955903 2026] [:error] [pid 9865:tid 9957] [client 4.223.163.152:57701] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nano.php"] [unique_id "aeKNT6zb5knECIY-C-hiIgAAAJQ"]
[Sat Apr 18 03:43:12.548723 2026] [:error] [pid 9970:tid 9998] [client 4.223.163.152:57441] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nano.php"] [unique_id "aeKNUCYdRLRhVmaIMx1jlAAAANg"]
[Sat Apr 18 03:43:13.303830 2026] [:error] [pid 9970:tid 9994] [client 4.223.163.152:62182] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nano.php"] [unique_id "aeKNUSYdRLRhVmaIMx1jmgAAANQ"]
[Sat Apr 18 03:43:14.269022 2026] [:error] [pid 9863:tid 9893] [client 4.223.163.152:62971] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nano.php"] [unique_id "aeKNUjjjiypiFrTucbLfNwAAABQ"]
[Sat Apr 18 03:43:27.104321 2026] [:error] [pid 9865:tid 9946] [client 4.223.163.152:65478] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zample.php"] [unique_id "aeKNX6zb5knECIY-C-hicwAAAIk"]
[Sat Apr 18 03:43:28.501317 2026] [:error] [pid 9863:tid 9874] [client 4.223.163.152:59682] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zample.php"] [unique_id "aeKNYDjjiypiFrTucbLfTQAAAAE"]
[Sat Apr 18 03:43:31.180375 2026] [:error] [pid 9863:tid 9887] [client 4.223.163.152:52673] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zample.php"] [unique_id "aeKNYzjjiypiFrTucbLfVAAAAA4"]
[Sat Apr 18 03:43:33.010624 2026] [:error] [pid 9864:tid 9905] [client 4.223.163.152:57107] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zample.php"] [unique_id "aeKNZYCFeowknfXHM7kBdAAAAEA"]
[Sat Apr 18 03:43:34.782512 2026] [:error] [pid 9863:tid 9892] [client 4.223.163.152:55371] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aeKNZjjjiypiFrTucbLfawAAABM"]
[Sat Apr 18 03:43:37.193197 2026] [:error] [pid 9865:tid 9945] [client 4.223.163.152:15765] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aeKNaazb5knECIY-C-hiiAAAAIg"]
[Sat Apr 18 03:43:38.969860 2026] [:error] [pid 9864:tid 9919] [client 4.223.163.152:58334] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aeKNaoCFeowknfXHM7kBhAAAAE0"]
[Sat Apr 18 03:43:39.732407 2026] [:error] [pid 9864:tid 9913] [client 4.223.163.152:63123] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aeKNa4CFeowknfXHM7kBhwAAAEc"]
[Sat Apr 18 03:43:40.638450 2026] [:error] [pid 9864:tid 9930] [client 4.223.163.152:58891] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aeKNbICFeowknfXHM7kBjgAAAFg"]
[Sat Apr 18 03:43:41.727138 2026] [:error] [pid 9970:tid 9997] [client 4.223.163.152:60290] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aeKNbSYdRLRhVmaIMx1j8AAAANc"]
[Sat Apr 18 03:43:42.589802 2026] [:error] [pid 9970:tid 9974] [client 4.223.163.152:15796] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aeKNbiYdRLRhVmaIMx1j9QAAAMA"]
[Sat Apr 18 03:43:43.601048 2026] [:error] [pid 9970:tid 9975] [client 4.223.163.152:55398] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aeKNbyYdRLRhVmaIMx1j_QAAAME"]
[Sat Apr 18 03:43:44.536011 2026] [:error] [pid 9864:tid 9906] [client 4.223.163.152:55408] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aeKNcICFeowknfXHM7kBmgAAAEE"]
[Sat Apr 18 03:43:45.369982 2026] [:error] [pid 9864:tid 9909] [client 4.223.163.152:60200] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aeKNcYCFeowknfXHM7kBnAAAAEQ"]
[Sat Apr 18 03:43:46.108127 2026] [:error] [pid 9863:tid 9879] [client 4.223.163.152:15788] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aeKNcjjjiypiFrTucbLfgQAAAAY"]
[Sat Apr 18 03:43:46.820619 2026] [:error] [pid 9863:tid 9885] [client 4.223.163.152:58876] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aeKNcjjjiypiFrTucbLfhAAAAAw"]
[Sat Apr 18 03:43:47.605507 2026] [:error] [pid 9864:tid 9919] [client 4.223.163.152:53244] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aeKNc4CFeowknfXHM7kBqgAAAE0"]
[Sat Apr 18 03:43:48.213026 2026] [:error] [pid 9863:tid 9897] [client 4.223.163.152:44031] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aeKNdDjjiypiFrTucbLfjAAAABg"]
[Sat Apr 18 03:43:48.941465 2026] [:error] [pid 9970:tid 9985] [client 4.223.163.152:53209] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aeKNdCYdRLRhVmaIMx1kDQAAAMs"]
[Sat Apr 18 03:43:50.151005 2026] [:error] [pid 9864:tid 9907] [client 4.223.163.152:61400] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aeKNdoCFeowknfXHM7kBrgAAAEI"]
[Sat Apr 18 03:43:50.889897 2026] [:error] [pid 9864:tid 9924] [client 4.223.163.152:33186] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "aeKNdoCFeowknfXHM7kBsgAAAFI"]
[Sat Apr 18 03:43:52.061124 2026] [:error] [pid 9864:tid 9906] [client 4.223.163.152:55414] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "aeKNeICFeowknfXHM7kBuAAAAEE"]
[Sat Apr 18 03:43:52.802721 2026] [:error] [pid 9863:tid 9875] [client 4.223.163.152:59676] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "aeKNeDjjiypiFrTucbLfowAAAAI"]
[Sat Apr 18 03:43:53.766373 2026] [:error] [pid 9865:tid 9950] [client 4.223.163.152:63130] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "aeKNeazb5knECIY-C-hingAAAI0"]
[Sat Apr 18 03:43:54.990562 2026] [:error] [pid 9865:tid 9958] [client 4.223.163.152:63147] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "aeKNeqzb5knECIY-C-hirgAAAJU"]
[Sat Apr 18 03:43:56.247077 2026] [:error] [pid 9864:tid 9921] [client 4.223.163.152:53825] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "aeKNfICFeowknfXHM7kBvwAAAE8"]
[Sat Apr 18 03:43:57.748031 2026] [:error] [pid 9865:tid 9955] [client 4.223.163.152:52673] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "aeKNfazb5knECIY-C-hiuQAAAJI"]
[Sat Apr 18 03:43:59.553877 2026] [:error] [pid 9865:tid 9943] [client 4.223.163.152:33200] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "aeKNf6zb5knECIY-C-hivgAAAIY"]
[Sat Apr 18 03:44:01.263641 2026] [:error] [pid 9864:tid 9925] [client 4.223.163.152:44011] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "aeKNgYCFeowknfXHM7kB0wAAAFM"]
[Sat Apr 18 03:44:02.584329 2026] [:error] [pid 9864:tid 9910] [client 4.223.163.152:58354] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "aeKNgoCFeowknfXHM7kB2QAAAEU"]
[Sat Apr 18 03:44:03.597478 2026] [:error] [pid 9865:tid 9952] [client 4.223.163.152:60186] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "aeKNg6zb5knECIY-C-hiyAAAAI8"]
[Sat Apr 18 03:44:04.983135 2026] [:error] [pid 9970:tid 9996] [client 4.223.163.152:44020] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "aeKNhCYdRLRhVmaIMx1kLQAAANY"]
[Sat Apr 18 03:44:06.432375 2026] [:error] [pid 9863:tid 9889] [client 4.223.163.152:52919] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "aeKNhjjjiypiFrTucbLf9gAAABA"]
[Sat Apr 18 03:44:07.656322 2026] [:error] [pid 9863:tid 9884] [client 4.223.163.152:57762] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "aeKNhzjjiypiFrTucbLf_QAAAAs"]
[Sat Apr 18 03:44:08.783844 2026] [:error] [pid 9864:tid 9919] [client 4.223.163.152:60175] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "aeKNiICFeowknfXHM7kB7gAAAE0"]
[Sat Apr 18 03:44:10.600029 2026] [:error] [pid 9864:tid 9913] [client 4.223.163.152:60197] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "aeKNioCFeowknfXHM7kB8wAAAEc"]
[Sat Apr 18 03:44:12.366249 2026] [:error] [pid 9970:tid 9993] [client 4.223.163.152:57108] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "aeKNjCYdRLRhVmaIMx1kUwAAANM"]
[Sat Apr 18 03:44:13.550423 2026] [:error] [pid 9865:tid 9955] [client 4.223.163.152:57790] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "aeKNjazb5knECIY-C-hi4gAAAJI"]
[Sat Apr 18 03:44:14.755815 2026] [:error] [pid 9970:tid 9985] [client 4.223.163.152:52885] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "aeKNjiYdRLRhVmaIMx1kXwAAAMs"]
[Sat Apr 18 03:44:15.932085 2026] [:error] [pid 9863:tid 9882] [client 4.223.163.152:56981] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "aeKNjzjjiypiFrTucbLgHgAAAAk"]
[Sat Apr 18 03:44:17.526769 2026] [:error] [pid 9970:tid 9975] [client 4.223.163.152:54958] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "aeKNkSYdRLRhVmaIMx1kbQAAAME"]
[Sat Apr 18 03:44:18.887354 2026] [:error] [pid 9865:tid 9956] [client 4.223.163.152:57753] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "aeKNkqzb5knECIY-C-hi9AAAAJM"]
[Sat Apr 18 03:44:19.692539 2026] [:error] [pid 9864:tid 9908] [client 4.223.163.152:62240] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "aeKNk4CFeowknfXHM7kCEgAAAEM"]
[Sat Apr 18 03:44:21.333336 2026] [:error] [pid 9863:tid 9880] [client 4.223.163.152:22596] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "aeKNlTjjiypiFrTucbLgLwAAAAc"]
[Sat Apr 18 03:44:22.642196 2026] [:error] [pid 9863:tid 9887] [client 4.223.163.152:60054] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aeKNljjjiypiFrTucbLgNAAAAA4"]
[Sat Apr 18 03:44:25.596679 2026] [:error] [pid 9864:tid 9915] [client 4.223.163.152:52115] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aeKNmYCFeowknfXHM7kCHAAAAEk"]
[Sat Apr 18 03:44:47.321604 2026] [:error] [pid 9865:tid 9960] [client 4.223.163.152:54307] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aeKNr6zb5knECIY-C-hjQgAAAJc"]
[Sat Apr 18 03:44:49.534572 2026] [:error] [pid 9865:tid 9945] [client 4.223.163.152:54243] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aeKNsazb5knECIY-C-hjSAAAAIg"]
[Sat Apr 18 03:44:51.328316 2026] [:error] [pid 9864:tid 9929] [client 4.223.163.152:62367] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aeKNs4CFeowknfXHM7kCQwAAAFc"]
[Sat Apr 18 03:44:52.727229 2026] [:error] [pid 9970:tid 9982] [client 4.223.163.152:65429] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aeKNtCYdRLRhVmaIMx1kzgAAAMg"]
[Sat Apr 18 03:44:53.470823 2026] [:error] [pid 9970:tid 9991] [client 4.223.163.152:58631] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeKNtSYdRLRhVmaIMx1k0AAAANE"]
[Sat Apr 18 03:44:54.089184 2026] [:error] [pid 9865:tid 9937] [client 4.223.163.152:65464] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeKNtqzb5knECIY-C-hjTQAAAIA"]
[Sat Apr 18 03:44:54.814648 2026] [:error] [pid 9863:tid 9891] [client 4.223.163.152:10793] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeKNtjjjiypiFrTucbLgYQAAABI"]
[Sat Apr 18 03:44:55.489943 2026] [:error] [pid 9863:tid 9877] [client 4.223.163.152:54650] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aeKNtzjjiypiFrTucbLgYwAAAAQ"]
[Sat Apr 18 03:44:56.277136 2026] [:error] [pid 9864:tid 9907] [client 4.223.163.152:53890] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless4.php"] [unique_id "aeKNuICFeowknfXHM7kCRwAAAEI"]
[Sat Apr 18 03:44:57.063700 2026] [:error] [pid 9970:tid 9989] [client 4.223.163.152:37559] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless4.php"] [unique_id "aeKNuSYdRLRhVmaIMx1k2wAAAM8"]
[Sat Apr 18 03:44:57.954572 2026] [:error] [pid 9970:tid 9990] [client 4.223.163.152:63597] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless4.php"] [unique_id "aeKNuSYdRLRhVmaIMx1k3wAAANA"]
[Sat Apr 18 03:44:58.843463 2026] [:error] [pid 9970:tid 9993] [client 4.223.163.152:58773] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless4.php"] [unique_id "aeKNuiYdRLRhVmaIMx1k5QAAANM"]
[Sat Apr 18 03:44:59.856144 2026] [:error] [pid 9970:tid 9985] [client 4.223.163.152:60396] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aeKNuyYdRLRhVmaIMx1k6wAAAMs"]
[Sat Apr 18 03:45:01.133555 2026] [:error] [pid 9970:tid 9991] [client 4.223.163.152:65232] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aeKNvSYdRLRhVmaIMx1k7wAAANE"]
[Sat Apr 18 03:45:01.976783 2026] [:error] [pid 9970:tid 9993] [client 4.223.163.152:65262] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aeKNvSYdRLRhVmaIMx1k8gAAANM"]
[Sat Apr 18 03:45:04.215166 2026] [:error] [pid 9970:tid 9981] [client 4.223.163.152:65425] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aeKNwCYdRLRhVmaIMx1k_AAAAMc"]
[Sat Apr 18 03:45:07.989605 2026] [:error] [pid 9865:tid 9954] [client 4.223.163.152:60394] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xqq.php"] [unique_id "aeKNw6zb5knECIY-C-hjXQAAAJE"]
[Sat Apr 18 03:45:10.585241 2026] [:error] [pid 9865:tid 9961] [client 4.223.163.152:53789] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xqq.php"] [unique_id "aeKNxqzb5knECIY-C-hjZAAAAJg"]
[Sat Apr 18 03:45:12.857965 2026] [:error] [pid 9863:tid 9889] [client 4.223.163.152:61087] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xqq.php"] [unique_id "aeKNyDjjiypiFrTucbLgawAAABA"]
[Sat Apr 18 03:45:14.282154 2026] [:error] [pid 9864:tid 9905] [client 4.223.163.152:56660] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xqq.php"] [unique_id "aeKNyoCFeowknfXHM7kCWgAAAEA"]
[Sat Apr 18 03:45:15.230504 2026] [:error] [pid 9864:tid 9913] [client 4.223.163.152:58719] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plss3.php"] [unique_id "aeKNy4CFeowknfXHM7kCXQAAAEc"]
[Sat Apr 18 03:45:16.209229 2026] [:error] [pid 9863:tid 9878] [client 4.223.163.152:56658] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plss3.php"] [unique_id "aeKNzDjjiypiFrTucbLgbQAAAAU"]
[Sat Apr 18 03:45:17.276094 2026] [:error] [pid 9863:tid 9877] [client 4.223.163.152:59087] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plss3.php"] [unique_id "aeKNzTjjiypiFrTucbLgbwAAAAQ"]
[Sat Apr 18 03:45:17.969015 2026] [:error] [pid 9865:tid 9943] [client 4.223.163.152:61163] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plss3.php"] [unique_id "aeKNzazb5knECIY-C-hjdwAAAIY"]
[Sat Apr 18 03:45:19.092306 2026] [:error] [pid 9863:tid 9895] [client 4.223.163.152:61124] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "aeKNzzjjiypiFrTucbLgdgAAABY"]
[Sat Apr 18 03:45:19.871311 2026] [:error] [pid 9865:tid 9951] [client 4.223.163.152:61071] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "aeKNz6zb5knECIY-C-hjegAAAI4"]
[Sat Apr 18 03:45:20.589514 2026] [:error] [pid 9863:tid 9888] [client 4.223.163.152:60780] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "aeKN0DjjiypiFrTucbLgfQAAAA8"]
[Sat Apr 18 03:45:21.823469 2026] [:error] [pid 9865:tid 9946] [client 4.223.163.152:61196] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "aeKN0azb5knECIY-C-hjfgAAAIk"]
[Sat Apr 18 03:45:22.631980 2026] [:error] [pid 9865:tid 9941] [client 4.223.163.152:59587] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aeKN0qzb5knECIY-C-hjggAAAIQ"]
[Sat Apr 18 03:45:23.660466 2026] [:error] [pid 9863:tid 9884] [client 4.223.163.152:58696] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aeKN0zjjiypiFrTucbLgggAAAAs"]
[Sat Apr 18 03:45:25.735144 2026] [:error] [pid 9865:tid 9954] [client 4.223.163.152:55530] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aeKN1azb5knECIY-C-hjmQAAAJE"]
[Sat Apr 18 03:45:27.326850 2026] [:error] [pid 9865:tid 9943] [client 4.223.163.152:61138] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aeKN16zb5knECIY-C-hjmgAAAIY"]
[Sat Apr 18 03:45:29.043650 2026] [:error] [pid 9863:tid 9891] [client 4.223.163.152:57173] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "aeKN2TjjiypiFrTucbLgiAAAABI"]
[Sat Apr 18 03:45:30.066292 2026] [:error] [pid 9865:tid 9958] [client 4.223.163.152:21173] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "aeKN2qzb5knECIY-C-hjnwAAAJU"]
[Sat Apr 18 03:45:31.068909 2026] [:error] [pid 9863:tid 9884] [client 4.223.163.152:56458] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "aeKN2zjjiypiFrTucbLgjwAAAAs"]
[Sat Apr 18 03:45:31.806759 2026] [:error] [pid 9863:tid 9896] [client 4.223.163.152:58495] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "aeKN2zjjiypiFrTucbLgkQAAABc"]
[Sat Apr 18 03:45:32.439932 2026] [:error] [pid 9865:tid 9954] [client 4.223.163.152:10884] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aeKN3Kzb5knECIY-C-hjowAAAJE"]
[Sat Apr 18 03:45:33.116891 2026] [:error] [pid 9970:tid 9988] [client 4.223.163.152:58490] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aeKN3SYdRLRhVmaIMx1lJAAAAM4"]
[Sat Apr 18 03:45:34.834979 2026] [:error] [pid 9864:tid 9905] [client 4.223.163.152:54860] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aeKN3oCFeowknfXHM7kCbQAAAEA"]
[Sat Apr 18 03:45:35.555930 2026] [:error] [pid 9970:tid 9998] [client 4.223.163.152:54455] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aeKN3yYdRLRhVmaIMx1lKQAAANg"]
[Sat Apr 18 03:45:36.395778 2026] [:error] [pid 9863:tid 9895] [client 4.223.163.152:52366] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aeKN4DjjiypiFrTucbLglAAAABY"]
[Sat Apr 18 03:45:37.671649 2026] [:error] [pid 9970:tid 9974] [client 4.223.163.152:10904] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aeKN4SYdRLRhVmaIMx1lLQAAAMA"]
[Sat Apr 18 03:45:39.095969 2026] [:error] [pid 9970:tid 9983] [client 4.223.163.152:54153] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aeKN4yYdRLRhVmaIMx1lNwAAAMk"]
[Sat Apr 18 03:45:40.174507 2026] [:error] [pid 9865:tid 9950] [client 4.223.163.152:52377] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "aeKN5Kzb5knECIY-C-hjswAAAI0"]
[Sat Apr 18 03:45:41.911697 2026] [:error] [pid 9865:tid 9956] [client 4.223.163.152:60634] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aeKN5azb5knECIY-C-hjtwAAAJM"]
[Sat Apr 18 03:45:49.487156 2026] [autoindex:error] [pid 9863:tid 9889] [client 4.223.163.152:61658] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 18 03:46:01.283654 2026] [:error] [pid 9863:tid 9896] [client 4.223.163.152:61658] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "aeKN-TjjiypiFrTucbLgugAAABc"]
[Sat Apr 18 03:46:02.606702 2026] [:error] [pid 9970:tid 9975] [client 4.223.163.152:62493] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "aeKN-iYdRLRhVmaIMx1lWgAAAME"]
[Sat Apr 18 03:46:03.435976 2026] [:error] [pid 9864:tid 9925] [client 4.223.163.152:55945] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "aeKN-4CFeowknfXHM7kCeQAAAFM"]
[Sat Apr 18 03:46:04.093889 2026] [:error] [pid 9970:tid 9980] [client 4.223.163.152:59184] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "aeKN_CYdRLRhVmaIMx1lXwAAAMY"]
[Sat Apr 18 03:46:04.788831 2026] [:error] [pid 9970:tid 9981] [client 4.223.163.152:63373] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aeKN_CYdRLRhVmaIMx1lYAAAAMc"]
[Sat Apr 18 03:46:05.663751 2026] [:error] [pid 9863:tid 9890] [client 4.223.163.152:63130] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aeKN_TjjiypiFrTucbLgvgAAABE"]
[Sat Apr 18 03:46:06.250077 2026] [:error] [pid 9863:tid 9880] [client 4.223.163.152:55034] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aeKN_jjjiypiFrTucbLgwQAAAAc"]
[Sat Apr 18 03:46:07.242019 2026] [:error] [pid 9865:tid 9940] [client 4.223.163.152:60124] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "aeKN_6zb5knECIY-C-hjzQAAAIM"]
[Sat Apr 18 03:46:08.174742 2026] [:error] [pid 9864:tid 9928] [client 4.223.163.152:59140] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "aeKOAICFeowknfXHM7kCgAAAAFY"]
[Sat Apr 18 03:46:09.148920 2026] [:error] [pid 9865:tid 9939] [client 4.223.163.152:53430] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "aeKOAazb5knECIY-C-hj0wAAAII"]
[Sat Apr 18 03:46:10.971707 2026] [:error] [pid 9864:tid 9927] [client 4.223.163.152:60106] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "aeKOAoCFeowknfXHM7kChQAAAFU"]
[Sat Apr 18 03:46:12.721185 2026] [:error] [pid 9863:tid 9897] [client 4.223.163.152:63384] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-michan.php"] [unique_id "aeKOBDjjiypiFrTucbLgxQAAABg"]
[Sat Apr 18 03:46:16.203381 2026] [:error] [pid 9865:tid 9937] [client 4.223.163.152:54813] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aeKOCKzb5knECIY-C-hj1wAAAIA"]
[Sat Apr 18 03:46:18.475175 2026] [:error] [pid 9864:tid 9924] [client 4.223.163.152:63597] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aeKOCoCFeowknfXHM7kCjgAAAFI"]
[Sat Apr 18 03:46:19.956668 2026] [:error] [pid 9865:tid 9949] [client 4.223.163.152:53737] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aeKOC6zb5knECIY-C-hj2QAAAIw"]
[Sat Apr 18 03:46:21.709955 2026] [:error] [pid 9863:tid 9882] [client 4.223.163.152:63625] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aeKODTjjiypiFrTucbLgygAAAAk"]
[Sat Apr 18 03:46:23.040312 2026] [:error] [pid 9865:tid 9959] [client 4.223.163.152:63618] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "aeKOD6zb5knECIY-C-hj4QAAAJY"]
[Sat Apr 18 03:46:24.111367 2026] [:error] [pid 9970:tid 9977] [client 4.223.163.152:53697] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "aeKOECYdRLRhVmaIMx1laQAAAMM"]
[Sat Apr 18 03:46:25.513960 2026] [:error] [pid 9864:tid 9918] [client 4.223.163.152:57830] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "aeKOEYCFeowknfXHM7kClwAAAEw"]
[Sat Apr 18 03:46:27.884178 2026] [:error] [pid 9865:tid 9937] [client 4.223.163.152:55318] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "aeKOE6zb5knECIY-C-hj5QAAAIA"]
[Sat Apr 18 03:46:31.502307 2026] [:error] [pid 9970:tid 9977] [client 4.223.163.152:36926] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "aeKOFyYdRLRhVmaIMx1leQAAAMM"]
[Sat Apr 18 03:46:32.446340 2026] [:error] [pid 9863:tid 9897] [client 4.223.163.152:57985] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "aeKOGDjjiypiFrTucbLg0QAAABg"]
[Sat Apr 18 03:46:33.868113 2026] [:error] [pid 9863:tid 9887] [client 4.223.163.152:10667] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "aeKOGTjjiypiFrTucbLg0wAAAA4"]
[Sat Apr 18 03:46:37.171611 2026] [:error] [pid 9865:tid 9955] [client 4.223.163.152:53708] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "aeKOHazb5knECIY-C-hj7gAAAJI"]
[Sat Apr 18 03:46:37.773054 2026] [:error] [pid 9970:tid 9997] [client 4.223.163.152:10665] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "aeKOHSYdRLRhVmaIMx1liQAAANc"]
[Sat Apr 18 03:46:38.646611 2026] [:error] [pid 9863:tid 9890] [client 4.223.163.152:55297] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "aeKOHjjjiypiFrTucbLg2QAAABE"]
[Sat Apr 18 03:46:39.522455 2026] [:error] [pid 9865:tid 9937] [client 4.223.163.152:61896] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "aeKOH6zb5knECIY-C-hj8AAAAIA"]
[Sat Apr 18 03:46:41.120580 2026] [:error] [pid 9863:tid 9878] [client 4.223.163.152:53715] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "aeKOITjjiypiFrTucbLg2wAAAAU"]
[Sat Apr 18 03:46:42.000171 2026] [:error] [pid 9864:tid 9918] [client 4.223.163.152:55356] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "aeKOIYCFeowknfXHM7kCnwAAAEw"]
[Sat Apr 18 03:46:42.746117 2026] [:error] [pid 9864:tid 9928] [client 4.223.163.152:55562] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "aeKOIoCFeowknfXHM7kCoQAAAFY"]
[Sat Apr 18 03:46:43.701225 2026] [:error] [pid 9864:tid 9909] [client 4.223.163.152:56259] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "aeKOI4CFeowknfXHM7kCogAAAEQ"]
[Sat Apr 18 03:46:44.899056 2026] [:error] [pid 9864:tid 9920] [client 4.223.163.152:53737] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wen.php"] [unique_id "aeKOJICFeowknfXHM7kCpQAAAE4"]
[Sat Apr 18 03:46:46.151735 2026] [:error] [pid 9970:tid 9989] [client 4.223.163.152:10977] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aeKOJiYdRLRhVmaIMx1lmAAAAM8"]
[Sat Apr 18 03:46:46.893065 2026] [:error] [pid 9970:tid 9994] [client 4.223.163.152:57400] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aeKOJiYdRLRhVmaIMx1lmgAAANQ"]
[Sat Apr 18 03:46:48.061280 2026] [:error] [pid 9970:tid 9988] [client 4.223.163.152:63336] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aeKOKCYdRLRhVmaIMx1lowAAAM4"]
[Sat Apr 18 03:46:49.374058 2026] [:error] [pid 9970:tid 9976] [client 4.223.163.152:11007] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aeKOKSYdRLRhVmaIMx1lqAAAAMI"]
[Sat Apr 18 03:46:50.075325 2026] [:error] [pid 9970:tid 9997] [client 4.223.163.152:11052] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "aeKOKiYdRLRhVmaIMx1lqgAAANc"]
[Sat Apr 18 03:46:50.792280 2026] [:error] [pid 9864:tid 9915] [client 4.223.163.152:55326] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "aeKOKoCFeowknfXHM7kCqAAAAEk"]
[Sat Apr 18 03:46:51.453749 2026] [:error] [pid 9970:tid 9978] [client 4.223.163.152:61925] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "aeKOKyYdRLRhVmaIMx1lqwAAAMQ"]
[Sat Apr 18 03:46:52.051486 2026] [:error] [pid 9970:tid 9989] [client 4.223.163.152:10982] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "aeKOLCYdRLRhVmaIMx1lrwAAAM8"]
[Sat Apr 18 03:46:53.218938 2026] [:error] [pid 9970:tid 9979] [client 4.223.163.152:11010] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "aeKOLSYdRLRhVmaIMx1lsgAAAMU"]
[Sat Apr 18 03:46:54.001921 2026] [:error] [pid 9865:tid 9950] [client 4.223.163.152:65180] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "aeKOLqzb5knECIY-C-hj_gAAAI0"]
[Sat Apr 18 03:46:54.740377 2026] [:error] [pid 9865:tid 9961] [client 4.223.163.152:58949] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "aeKOLqzb5knECIY-C-hj_wAAAJg"]
[Sat Apr 18 03:46:55.468863 2026] [:error] [pid 9970:tid 9984] [client 4.223.163.152:63845] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "aeKOLyYdRLRhVmaIMx1lugAAAMo"]
[Sat Apr 18 03:46:56.028301 2026] [:error] [pid 9863:tid 9878] [client 4.223.163.152:10648] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeKOMDjjiypiFrTucbLg6wAAAAU"]
[Sat Apr 18 03:46:56.642812 2026] [:error] [pid 9863:tid 9883] [client 4.223.163.152:63786] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeKOMDjjiypiFrTucbLg7QAAAAo"]
[Sat Apr 18 03:46:57.386817 2026] [:error] [pid 9864:tid 9924] [client 4.223.163.152:36884] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeKOMYCFeowknfXHM7kCrAAAAFI"]
[Sat Apr 18 03:46:58.225796 2026] [:error] [pid 9970:tid 9988] [client 4.223.163.152:63335] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aeKOMiYdRLRhVmaIMx1lvwAAAM4"]
[Sat Apr 18 03:46:58.956929 2026] [:error] [pid 9970:tid 9997] [client 4.223.163.152:10674] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aeKOMiYdRLRhVmaIMx1lwQAAANc"]
[Sat Apr 18 03:46:59.842117 2026] [:error] [pid 9970:tid 9993] [client 4.223.163.152:60418] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aeKOMyYdRLRhVmaIMx1lwgAAANM"]
[Sat Apr 18 03:47:06.984127 2026] [:error] [pid 9970:tid 9975] [client 4.223.163.152:58957] [client 4.223.163.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeKOOiYdRLRhVmaIMx1l2QAAAME"]
[Sat Apr 18 03:47:09.900471 2026] [autoindex:error] [pid 9865:tid 9957] [client 4.223.163.152:60454] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 18 03:47:10.166348 2026] [autoindex:error] [pid 9865:tid 9953] [client 4.223.163.152:60454] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 18 03:47:14.610154 2026] [:error] [pid 9865:tid 9947] [client 4.223.163.152:60454] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "aeKOQqzb5knECIY-C-hkIwAAAIo"]
[Sat Apr 18 03:47:15.291321 2026] [:error] [pid 9970:tid 9990] [client 4.223.163.152:63838] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "aeKOQyYdRLRhVmaIMx1l3QAAANA"]
[Sat Apr 18 03:47:15.951684 2026] [:error] [pid 9970:tid 9981] [client 4.223.163.152:51952] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "aeKOQyYdRLRhVmaIMx1l3wAAAMc"]
[Sat Apr 18 03:47:16.771188 2026] [:error] [pid 9864:tid 9910] [client 4.223.163.152:63840] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "aeKORICFeowknfXHM7kCuAAAAEU"]
[Sat Apr 18 03:47:17.430708 2026] [:error] [pid 9864:tid 9908] [client 4.223.163.152:65214] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aeKORYCFeowknfXHM7kCuQAAAEM"]
[Sat Apr 18 03:47:18.017576 2026] [:error] [pid 9864:tid 9930] [client 4.223.163.152:63798] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aeKORoCFeowknfXHM7kCuwAAAFg"]
[Sat Apr 18 03:47:18.885288 2026] [:error] [pid 9865:tid 9947] [client 4.223.163.152:63842] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aeKORqzb5knECIY-C-hkLAAAAIo"]
[Sat Apr 18 03:47:19.939425 2026] [:error] [pid 9865:tid 9952] [client 4.223.163.152:60431] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aeKOR6zb5knECIY-C-hkLQAAAI8"]
[Sat Apr 18 03:47:20.767886 2026] [:error] [pid 9864:tid 9922] [client 4.223.163.152:55337] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aeKOSICFeowknfXHM7kCxQAAAFA"]
[Sat Apr 18 03:47:22.145151 2026] [:error] [pid 9864:tid 9918] [client 4.223.163.152:55317] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aeKOSoCFeowknfXHM7kCzAAAAEw"]
[Sat Apr 18 03:47:23.520898 2026] [:error] [pid 9865:tid 9942] [client 4.223.163.152:63320] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aeKOS6zb5knECIY-C-hkNwAAAIU"]
[Sat Apr 18 03:47:24.539694 2026] [:error] [pid 9864:tid 9916] [client 4.223.163.152:59249] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aeKOTICFeowknfXHM7kC1AAAAEo"]
[Sat Apr 18 03:47:25.202735 2026] [:error] [pid 9864:tid 9927] [client 4.223.163.152:60236] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bengi.php"] [unique_id "aeKOTYCFeowknfXHM7kC2AAAAFU"]
[Sat Apr 18 03:47:26.489111 2026] [:error] [pid 9864:tid 9912] [client 4.223.163.152:57873] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bengi.php"] [unique_id "aeKOToCFeowknfXHM7kC4QAAAEY"]
[Sat Apr 18 03:47:27.165557 2026] [:error] [pid 9864:tid 9915] [client 4.223.163.152:57884] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bengi.php"] [unique_id "aeKOT4CFeowknfXHM7kC4wAAAEk"]
[Sat Apr 18 03:47:27.999750 2026] [:error] [pid 9864:tid 9924] [client 4.223.163.152:60455] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bengi.php"] [unique_id "aeKOT4CFeowknfXHM7kC5gAAAFI"]
[Sat Apr 18 03:47:29.108753 2026] [:error] [pid 9864:tid 9925] [client 4.223.163.152:63822] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeKOUYCFeowknfXHM7kC7AAAAFM"]
[Sat Apr 18 03:47:29.745670 2026] [:error] [pid 9864:tid 9919] [client 4.223.163.152:63334] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeKOUYCFeowknfXHM7kC7QAAAE0"]
[Sat Apr 18 03:47:30.293983 2026] [:error] [pid 9864:tid 9915] [client 4.223.163.152:60259] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeKOUoCFeowknfXHM7kC8AAAAEk"]
[Sat Apr 18 03:47:31.539656 2026] [:error] [pid 9865:tid 9957] [client 4.223.163.152:10358] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aeKOU6zb5knECIY-C-hkSwAAAJQ"]
[Sat Apr 18 03:47:32.353615 2026] [:error] [pid 9864:tid 9913] [client 4.223.163.152:57411] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "aeKOVICFeowknfXHM7kC8wAAAEc"]
[Sat Apr 18 03:47:33.154923 2026] [:error] [pid 9970:tid 9988] [client 4.223.163.152:10866] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "aeKOVSYdRLRhVmaIMx1mGAAAAM4"]
[Sat Apr 18 03:47:33.980599 2026] [:error] [pid 9970:tid 9996] [client 4.223.163.152:57457] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "aeKOVSYdRLRhVmaIMx1mHAAAANY"]
[Sat Apr 18 03:47:34.698908 2026] [:error] [pid 9864:tid 9928] [client 4.223.163.152:10323] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "aeKOVoCFeowknfXHM7kC9gAAAFY"]
[Sat Apr 18 03:47:35.316464 2026] [:error] [pid 9864:tid 9924] [client 4.223.163.152:57452] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfashell.php"] [unique_id "aeKOV4CFeowknfXHM7kC9wAAAFI"]
[Sat Apr 18 03:47:36.527973 2026] [:error] [pid 9864:tid 9921] [client 4.223.163.152:65473] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfashell.php"] [unique_id "aeKOWICFeowknfXHM7kC_gAAAE8"]
[Sat Apr 18 03:47:37.248668 2026] [:error] [pid 9865:tid 9948] [client 4.223.163.152:59885] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfashell.php"] [unique_id "aeKOWazb5knECIY-C-hkXAAAAIs"]
[Sat Apr 18 03:47:38.361689 2026] [:error] [pid 9865:tid 9942] [client 4.223.163.152:10304] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfashell.php"] [unique_id "aeKOWqzb5knECIY-C-hkXwAAAIU"]
[Sat Apr 18 03:47:39.640414 2026] [:error] [pid 9863:tid 9895] [client 4.223.163.152:57691] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aeKOWzjjiypiFrTucbLg_gAAABY"]
[Sat Apr 18 03:47:42.716778 2026] [:error] [pid 9865:tid 9955] [client 4.223.163.152:57871] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aeKOXqzb5knECIY-C-hkZgAAAJI"]
[Sat Apr 18 03:47:44.835933 2026] [:error] [pid 9863:tid 9893] [client 4.223.163.152:59886] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aeKOYDjjiypiFrTucbLhDQAAABQ"]
[Sat Apr 18 03:47:48.158864 2026] [:error] [pid 9865:tid 9960] [client 4.223.163.152:62944] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aeKOZKzb5knECIY-C-hkcAAAAJc"]
[Sat Apr 18 03:47:52.006444 2026] [:error] [pid 9864:tid 9906] [client 4.223.163.152:52486] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "aeKOaICFeowknfXHM7kDGwAAAEE"]
[Sat Apr 18 03:47:55.330423 2026] [:error] [pid 9865:tid 9960] [client 4.223.163.152:65478] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "aeKOa6zb5knECIY-C-hkewAAAJc"]
[Sat Apr 18 03:47:56.502626 2026] [:error] [pid 9864:tid 9918] [client 4.223.163.152:60349] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "aeKObICFeowknfXHM7kDIwAAAEw"]
[Sat Apr 18 03:47:57.212574 2026] [:error] [pid 9865:tid 9947] [client 4.223.163.152:55293] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "aeKObazb5knECIY-C-hkfgAAAIo"]
[Sat Apr 18 03:47:58.195869 2026] [:error] [pid 9970:tid 9976] [client 4.223.163.152:55245] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aeKObiYdRLRhVmaIMx1mfQAAAMI"]
[Sat Apr 18 03:47:58.862672 2026] [:error] [pid 9864:tid 9906] [client 4.223.163.152:52492] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aeKOboCFeowknfXHM7kDJwAAAEE"]
[Sat Apr 18 03:48:00.255122 2026] [:error] [pid 9864:tid 9910] [client 4.223.163.152:52517] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aeKOcICFeowknfXHM7kDKgAAAEU"]
[Sat Apr 18 03:48:01.056361 2026] [:error] [pid 9863:tid 9873] [client 4.223.163.152:62145] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aeKOcTjjiypiFrTucbLhIwAAAAA"]
[Sat Apr 18 03:48:02.458920 2026] [:error] [pid 9863:tid 9877] [client 4.223.163.152:62199] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aeKOcjjjiypiFrTucbLhKQAAAAQ"]
[Sat Apr 18 03:48:03.820634 2026] [:error] [pid 9863:tid 9890] [client 4.223.163.152:57412] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aeKOczjjiypiFrTucbLhMAAAABE"]
[Sat Apr 18 03:48:05.654306 2026] [:error] [pid 9970:tid 9998] [client 4.223.163.152:54346] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aeKOdSYdRLRhVmaIMx1mgAAAANg"]
[Sat Apr 18 03:48:07.964653 2026] [:error] [pid 9864:tid 9906] [client 4.223.163.152:55782] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/g.php"] [unique_id "aeKOd4CFeowknfXHM7kDNgAAAEE"]
[Sat Apr 18 03:48:10.095881 2026] [:error] [pid 9863:tid 9877] [client 4.223.163.152:52825] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aeKOejjjiypiFrTucbLhNwAAAAQ"]
[Sat Apr 18 03:48:11.175654 2026] [:error] [pid 9863:tid 9892] [client 4.223.163.152:52820] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aeKOezjjiypiFrTucbLhOQAAABM"]
[Sat Apr 18 03:48:24.945983 2026] [:error] [pid 9863:tid 9884] [client 4.223.163.152:60691] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aeKOiDjjiypiFrTucbLhVwAAAAs"]
[Sat Apr 18 03:48:25.879844 2026] [:error] [pid 9863:tid 9876] [client 4.223.163.152:58309] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aeKOiTjjiypiFrTucbLhWQAAAAM"]
[Sat Apr 18 03:48:27.377579 2026] [:error] [pid 9864:tid 9925] [client 4.223.163.152:58936] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aeKOi4CFeowknfXHM7kDnQAAAFM"]
[Sat Apr 18 03:48:29.648423 2026] [:error] [pid 9863:tid 9887] [client 4.223.163.152:57732] [client 4.223.163.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aeKOjTjjiypiFrTucbLhXwAAAA4"]
[Sat Apr 18 04:02:30.640573 2026] [:error] [pid 9864:tid 9929] [client 146.70.194.220:48020] [client 146.70.194.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.70.194.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeKR1oCFeowknfXHM7kK_QAAAFc"]
[Sat Apr 18 04:02:33.016043 2026] [:error] [pid 9864:tid 9910] [client 146.70.194.220:48020] [client 146.70.194.220] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeKR2YCFeowknfXHM7kLBQAAAEU"]
[Sat Apr 18 04:02:33.311761 2026] [:error] [pid 9864:tid 9906] [client 146.70.194.220:48020] [client 146.70.194.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.70.194.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeKR2YCFeowknfXHM7kLBgAAAEE"]
[Sat Apr 18 04:02:34.924495 2026] [:error] [pid 9864:tid 9917] [client 146.70.194.220:48028] [client 146.70.194.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.70.194.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeKR2oCFeowknfXHM7kLDAAAAEs"]
[Sat Apr 18 04:02:36.556326 2026] [:error] [pid 9864:tid 9930] [client 146.70.194.220:52344] [client 146.70.194.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.70.194.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeKR3ICFeowknfXHM7kLFwAAAFg"]
[Sat Apr 18 04:02:38.182519 2026] [:error] [pid 9865:tid 9948] [client 146.70.194.220:52350] [client 146.70.194.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.70.194.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeKR3qzb5knECIY-C-hu1wAAAIs"]
[Sat Apr 18 04:02:39.832448 2026] [:error] [pid 9863:tid 9880] [client 146.70.194.220:52362] [client 146.70.194.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.70.194.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeKR3zjjiypiFrTucbLoJwAAAAc"]
[Sat Apr 18 04:02:39.832597 2026] [:error] [pid 9863:tid 9880] [client 146.70.194.220:52362] [client 146.70.194.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 146.70.194.220, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeKR3zjjiypiFrTucbLoJwAAAAc"]
[Sat Apr 18 04:03:42.500643 2026] [:error] [pid 9864:tid 9905] [client 15.236.53.122:38546] [client 15.236.53.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.236.53.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeKSHoCFeowknfXHM7kLdwAAAEA"]
[Sat Apr 18 04:03:44.489282 2026] [:error] [pid 9864:tid 9918] [client 15.236.53.122:38546] [client 15.236.53.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.236.53.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeKSIICFeowknfXHM7kLeAAAAEw"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 18 04:13:43.813776 2026] [:error] [pid 9865:tid 9952] [client 217.13.104.156:45410] [client 217.13.104.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.13.104.156, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeKUd6zb5knECIY-C-hzjAAAAI8"]
[Sat Apr 18 04:13:45.003557 2026] [:error] [pid 9865:tid 9954] [client 217.13.104.156:45410] [client 217.13.104.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.13.104.156, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeKUeazb5knECIY-C-hzjgAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 18 05:10:32.056632 2026] [:error] [pid 9864:tid 9914] [client 86.110.247.136:59712] [client 86.110.247.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 86.110.247.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeKhyICFeowknfXHM7kk4AAAAEg"]
[Sat Apr 18 05:10:34.540612 2026] [:error] [pid 9864:tid 9913] [client 86.110.247.136:59712] [client 86.110.247.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 86.110.247.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeKhyoCFeowknfXHM7kk4wAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 18 05:17:15.822805 2026] [:error] [pid 9863:tid 9873] [client 163.61.73.35:42736] [client 163.61.73.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 163.61.73.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeKjWzjjiypiFrTucbIAsgAAAAA"]
[Sat Apr 18 05:17:16.762231 2026] [:error] [pid 9863:tid 9882] [client 163.61.73.35:42736] [client 163.61.73.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 163.61.73.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeKjXDjjiypiFrTucbIAtQAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 18 05:23:02.035445 2026] [:error] [pid 9864:tid 9924] [client 75.119.135.239:45950] [client 75.119.135.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 75.119.135.239, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeKktoCFeowknfXHM7kouwAAAFI"]
[Sat Apr 18 05:23:04.697783 2026] [:error] [pid 9864:tid 9920] [client 75.119.135.239:45950] [client 75.119.135.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 75.119.135.239, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeKkuICFeowknfXHM7kovAAAAE4"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 18 05:34:24.920952 2026] [:error] [pid 9865:tid 9957] [client 138.197.106.215:43626] [client 138.197.106.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.197.106.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeKnYKzb5knECIY-C-idEAAAAJQ"]
[Sat Apr 18 05:38:05.589666 2026] [:error] [pid 9970:tid 9988] [client 114.10.39.153:17955] [client 114.10.39.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 114.10.39.153, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeKoPSYdRLRhVmaIMx262gAAAM4"]
[Sat Apr 18 05:38:15.972642 2026] [:error] [pid 9865:tid 9961] [client 114.10.39.153:17956] [client 114.10.39.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 114.10.39.153, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeKoR6zb5knECIY-C-igGgAAAJg"]
[Sat Apr 18 05:38:26.395521 2026] [:error] [pid 9970:tid 9986] [client 114.10.39.153:17957] [client 114.10.39.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 114.10.39.153, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeKoUiYdRLRhVmaIMx27JgAAAMw"]
[Sat Apr 18 05:38:36.824792 2026] [:error] [pid 9970:tid 9977] [client 114.10.39.153:22398] [client 114.10.39.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 114.10.39.153, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeKoXCYdRLRhVmaIMx27QwAAAMM"]
[Sat Apr 18 05:38:57.684860 2026] [:error] [pid 9865:tid 9959] [client 114.10.39.153:22399] [client 114.10.39.153] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 114.10.39.153, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeKocazb5knECIY-C-igZAAAAJY"]
[Sat Apr 18 05:45:58.400387 2026] [:error] [pid 9970:tid 9997] [client 66.94.101.63:45604] [client 66.94.101.63] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.94.101.63, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeKqFiYdRLRhVmaIMx3CDQAAANc"]
[Sat Apr 18 06:19:48.008924 2026] [:error] [pid 9865:tid 9944] [client 94.187.171.125:60933] [client 94.187.171.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.187.171.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeKyBKzb5knECIY-C-i0RwAAAIc"]
[Sat Apr 18 07:08:20.442390 2026] [:error] [pid 9865:tid 9954] [client 94.187.171.125:51977] [client 94.187.171.125] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeK9ZKzb5knECIY-C-jCrgAAAJE"]
[Sat Apr 18 07:10:00.767704 2026] [:error] [pid 13023:tid 13033] [client 94.187.171.125:57773] [client 94.187.171.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.187.171.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeK9yP1e7hG8DAeABB8c0AAAAQg"]
[Sat Apr 18 07:11:10.841080 2026] [:error] [pid 9865:tid 9943] [client 94.187.171.125:58604] [client 94.187.171.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.187.171.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeK-Dqzb5knECIY-C-jDTwAAAIY"]
[Sat Apr 18 07:12:17.004147 2026] [:error] [pid 13023:tid 13029] [client 94.187.171.125:59425] [client 94.187.171.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.187.171.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeK-Uf1e7hG8DAeABB8eSQAAAQQ"]
[Sat Apr 18 07:13:21.148970 2026] [:error] [pid 13023:tid 13044] [client 94.187.171.125:60160] [client 94.187.171.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.187.171.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeK-kf1e7hG8DAeABB8fWwAAARM"]
[Sat Apr 18 07:57:52.700619 2026] [:error] [pid 9970:tid 9993] [client 43.166.1.243:53850] [client 43.166.1.243] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeLJACYdRLRhVmaIMx3-2QAAANM"]
[Sat Apr 18 08:43:27.037113 2026] [:error] [pid 9864:tid 9930] [client 146.190.155.17:47100] [client 146.190.155.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.155.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeLTr4CFeowknfXHM7lc4wAAAFg"]
[Sat Apr 18 08:49:44.318168 2026] [:error] [pid 9863:tid 9875] [client 51.159.214.31:57264] [client 51.159.214.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.214.31, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeLVKDjjiypiFrTucbIzkAAAAAI"]
[Sat Apr 18 08:54:00.033679 2026] [:error] [pid 34237:tid 34251] [client 67.205.159.76:52526] [client 67.205.159.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.159.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeLWKBBmX4Wq5a6rxfbvUAAAAUw"]
[Sat Apr 18 09:00:49.254422 2026] [:error] [pid 9865:tid 9938] [client 147.182.250.143:52138] [client 147.182.250.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.182.250.143, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeLXwazb5knECIY-C-jf3gAAAIE"]
[Sat Apr 18 09:11:16.619763 2026] [:error] [pid 34288:tid 34299] [client 200.107.116.117:41212] [client 200.107.116.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.107.116.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeLaNOTIiy__PtiLmplYbQAAAYc"]
[Sat Apr 18 09:11:26.448290 2026] [:error] [pid 34237:tid 34250] [client 200.107.116.117:39819] [client 200.107.116.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.107.116.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeLaPhBmX4Wq5a6rxfb3MgAAAUs"]
[Sat Apr 18 09:11:36.984526 2026] [:error] [pid 13023:tid 13031] [client 200.107.116.117:40468] [client 200.107.116.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.107.116.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeLaSP1e7hG8DAeABB9Z-QAAAQY"]
[Sat Apr 18 09:11:47.433013 2026] [:error] [pid 13023:tid 13045] [client 200.107.116.117:41196] [client 200.107.116.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.107.116.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeLaU_1e7hG8DAeABB9aDgAAARQ"]
[Sat Apr 18 09:11:58.019658 2026] [:error] [pid 9863:tid 9883] [client 200.107.116.117:39792] [client 200.107.116.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.107.116.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeLaXjjjiypiFrTucbI5lgAAAAo"]
[Sat Apr 18 09:37:14.474413 2026] [:error] [pid 9865:tid 9960] [client 196.27.114.137:34952] [client 196.27.114.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.27.114.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeLgSqzb5knECIY-C-jt6QAAAJc"]
[Sat Apr 18 10:49:21.023651 2026] [:error] [pid 34237:tid 34250] [client 95.26.207.113:7117] [client 95.26.207.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.26.207.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeLxMRBmX4Wq5a6rxfYbIAAAAUs"]
[Sat Apr 18 10:49:31.185674 2026] [:error] [pid 9970:tid 9976] [client 95.26.207.113:9001] [client 95.26.207.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.26.207.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeLxOyYdRLRhVmaIMx00LgAAAMI"]
[Sat Apr 18 10:49:41.565254 2026] [:error] [pid 13023:tid 13025] [client 95.26.207.113:7678] [client 95.26.207.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.26.207.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeLxRf1e7hG8DAeABB971gAAAQA"]
[Sat Apr 18 10:49:51.980700 2026] [:error] [pid 13023:tid 13038] [client 95.26.207.113:8032] [client 95.26.207.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.26.207.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeLxT_1e7hG8DAeABB975QAAAQ0"]
[Sat Apr 18 10:50:02.361586 2026] [:error] [pid 9970:tid 9993] [client 95.26.207.113:7085] [client 95.26.207.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.26.207.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeLxWiYdRLRhVmaIMx00YwAAANM"]
[Sat Apr 18 10:51:47.163551 2026] [:error] [pid 9864:tid 9913] [client 35.212.184.240:53856] [client 35.212.184.240] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.local"] [unique_id "aeLxw4CFeowknfXHM7lwsQAAAEc"]
[Sat Apr 18 10:52:14.695127 2026] [:error] [pid 9863:tid 9885] [client 35.212.184.240:33286] [client 35.212.184.240] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.staging"] [unique_id "aeLx3jjjiypiFrTucbJeaQAAAAw"]
[Sat Apr 18 10:52:40.350975 2026] [:error] [pid 9864:tid 9918] [client 35.212.184.240:37448] [client 35.212.184.240] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.old"] [unique_id "aeLx-ICFeowknfXHM7lwyAAAAEw"]
[Sat Apr 18 10:52:45.733097 2026] [:error] [pid 13023:tid 13031] [client 35.212.184.240:45140] [client 35.212.184.240] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.example"] [unique_id "aeLx_f1e7hG8DAeABB99GwAAAQY"]
[Sat Apr 18 10:52:51.965204 2026] [:error] [pid 34288:tid 34307] [client 35.212.184.240:48684] [client 35.212.184.240] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.save"] [unique_id "aeLyA-TIiy__PtiLmpl-jQAAAY8"]
[Sat Apr 18 10:53:19.591452 2026] [:error] [pid 34290:tid 34324] [client 35.212.184.240:40516] [client 35.212.184.240] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/backend/.env"] [unique_id "aeLyHxqX6WpmmAXOBi-cZgAAAcU"]
[Sat Apr 18 10:53:44.601912 2026] [:error] [pid 34290:tid 34341] [client 35.212.184.240:58150] [client 35.212.184.240] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/web/.env"] [unique_id "aeLyOBqX6WpmmAXOBi-ckwAAAdY"]
[Sat Apr 18 10:54:09.182305 2026] [:error] [pid 34290:tid 34341] [client 35.212.184.240:57350] [client 35.212.184.240] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/config/.env"] [unique_id "aeLyURqX6WpmmAXOBi-cuwAAAdY"]
[Sat Apr 18 10:54:37.037822 2026] [:error] [pid 34290:tid 34343] [client 35.212.184.240:37570] [client 35.212.184.240] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.vercel/.env.production.local"] [unique_id "aeLybRqX6WpmmAXOBi-c6QAAAdg"]
[Sat Apr 18 11:08:27.195823 2026] [:error] [pid 34290:tid 34325] [client 180.110.203.108:36146] [client 180.110.203.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aeL1qxqX6WpmmAXOBi-hAwAAAcY"]
[Sat Apr 18 11:16:51.371042 2026] [:error] [pid 9863:tid 9876] [client 200.152.177.16:45340] [client 200.152.177.16] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.152.177.16, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeL3ozjjiypiFrTucbJk-AAAAAM"]
[Sat Apr 18 11:28:27.167192 2026] [:error] [pid 34290:tid 34330] [client 118.68.41.64:55637] [client 118.68.41.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 118.68.41.64, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeL6WxqX6WpmmAXOBi-mpQAAAcs"]
[Sat Apr 18 11:28:28.445458 2026] [:error] [pid 34290:tid 34319] [client 118.68.41.64:55637] [client 118.68.41.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 118.68.41.64, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeL6XBqX6WpmmAXOBi-mpwAAAcA"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 18 11:59:08.430484 2026] [:error] [pid 34290:tid 34342] [client 172.213.216.54:15061] [client 172.213.216.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeMBjBqX6WpmmAXOBi-s-gAAAdc"]
[Sat Apr 18 11:59:09.094318 2026] [:error] [pid 9865:tid 9943] [client 172.213.216.54:22127] [client 172.213.216.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeMBjazb5knECIY-C-gRXQAAAIY"]
[Sat Apr 18 11:59:11.152041 2026] [:error] [pid 9970:tid 9993] [client 172.213.216.54:25450] [client 172.213.216.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeMBjyYdRLRhVmaIMx1E1QAAANM"]
[Sat Apr 18 11:59:12.285810 2026] [:error] [pid 9864:tid 9930] [client 172.213.216.54:15074] [client 172.213.216.54] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeMBkICFeowknfXHM7mOYQAAAFg"]
[Sat Apr 18 12:00:06.648134 2026] [:error] [pid 34290:tid 34324] [client 223.185.14.60:10839] [client 223.185.14.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.14.60, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeMBxhqX6WpmmAXOBi-tPQAAAcU"]
[Sat Apr 18 12:00:17.561507 2026] [:error] [pid 34237:tid 34253] [client 223.185.14.60:24579] [client 223.185.14.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.14.60, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeMB0RBmX4Wq5a6rxfYmnAAAAU4"]
[Sat Apr 18 12:00:29.542975 2026] [:error] [pid 9865:tid 9958] [client 223.185.14.60:5707] [client 223.185.14.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.14.60, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeMB3azb5knECIY-C-gR_AAAAJU"]
[Sat Apr 18 12:00:40.042465 2026] [:error] [pid 34290:tid 34319] [client 223.185.14.60:17609] [client 223.185.14.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.14.60, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeMB6BqX6WpmmAXOBi-tWQAAAcA"]
[Sat Apr 18 12:00:50.679303 2026] [:error] [pid 9864:tid 9916] [client 223.185.14.60:23353] [client 223.185.14.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.14.60, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeMB8oCFeowknfXHM7mO9AAAAEo"]
[Sat Apr 18 12:04:02.060484 2026] [:error] [pid 9865:tid 9951] [client 192.111.137.37:41337] [client 192.111.137.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.111.137.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeMCsqzb5knECIY-C-gSvgAAAI4"], referer: https://expressinteriors.com/
[Sat Apr 18 12:21:34.045984 2026] [:error] [pid 9865:tid 9960] [client 198.199.77.203:43926] [client 198.199.77.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 198.199.77.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeMGzqzb5knECIY-C-gWfQAAAJc"]
[Sat Apr 18 12:32:08.332848 2026] [:error] [pid 9864:tid 9916] [client 74.208.229.14:44620] [client 74.208.229.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.208.229.14, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeMJSICFeowknfXHM7mWswAAAEo"]
[Sat Apr 18 14:46:48.756295 2026] [:error] [pid 9865:tid 9959] [client 71.172.26.220:51687] [client 71.172.26.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 71.172.26.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeMo2Kzb5knECIY-C-g8vAAAAJY"]
[Sat Apr 18 14:46:58.739341 2026] [:error] [pid 34290:tid 34341] [client 71.172.26.220:52078] [client 71.172.26.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 71.172.26.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeMo4hqX6WpmmAXOBi_EfgAAAdY"]
[Sat Apr 18 14:47:09.177624 2026] [:error] [pid 9865:tid 9954] [client 71.172.26.220:52348] [client 71.172.26.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 71.172.26.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeMo7azb5knECIY-C-g8wQAAAJE"]
[Sat Apr 18 14:47:19.688243 2026] [:error] [pid 34290:tid 34337] [client 71.172.26.220:52605] [client 71.172.26.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 71.172.26.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeMo9xqX6WpmmAXOBi_EhgAAAdI"]
[Sat Apr 18 14:47:30.210203 2026] [:error] [pid 9865:tid 9955] [client 71.172.26.220:52851] [client 71.172.26.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 71.172.26.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeMpAqzb5knECIY-C-g80QAAAJI"]
[Sat Apr 18 15:06:37.863540 2026] [:error] [pid 34237:tid 34262] [client 159.65.142.144:62486] [client 159.65.142.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.65.142.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeMtfRBmX4Wq5a6rxfY9ZgAAAVc"]
[Sat Apr 18 15:14:10.963002 2026] [:error] [pid 34237:tid 34252] [client 43.166.134.47:52214] [client 43.166.134.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeMvQhBmX4Wq5a6rxfY-3AAAAU0"]
[Sat Apr 18 15:50:17.489946 2026] [:error] [pid 13023:tid 13029] [client 64.226.92.6:57604] [client 64.226.92.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.226.92.6, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeM3uf1e7hG8DAeABB_KAgAAAQQ"]
[Sat Apr 18 15:50:20.757423 2026] [:error] [pid 13023:tid 13039] [client 64.226.92.6:57604] [client 64.226.92.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.226.92.6, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeM3vP1e7hG8DAeABB_KEAAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 18 15:51:07.384898 2026] [:error] [pid 13023:tid 13027] [client 23.105.193.86:46896] [client 23.105.193.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.105.193.86, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeM36_1e7hG8DAeABB_KLwAAAQI"]
[Sat Apr 18 16:01:45.559682 2026] [:error] [pid 34290:tid 34331] [client 34.10.126.193:60493] [client 34.10.126.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.10.126.193, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeM6aRqX6WpmmAXOBi_UdAAAAcw"]
[Sat Apr 18 16:01:47.606648 2026] [:error] [pid 34290:tid 34328] [client 34.10.126.193:60493] [client 34.10.126.193] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeM6axqX6WpmmAXOBi_UeQAAAck"]
[Sat Apr 18 16:01:47.822597 2026] [:error] [pid 34290:tid 34321] [client 34.10.126.193:60493] [client 34.10.126.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.10.126.193, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeM6axqX6WpmmAXOBi_UegAAAcI"]
[Sat Apr 18 16:01:49.152753 2026] [:error] [pid 34288:tid 34293] [client 34.10.126.193:64907] [client 34.10.126.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.10.126.193, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeM6beTIiy__PtiLmpm0tgAAAYE"]
[Sat Apr 18 16:42:08.087886 2026] [:error] [pid 34290:tid 34323] [client 15.235.163.7:56428] [client 15.235.163.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 15.235.163.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeND4BqX6WpmmAXOBi_eewAAAcQ"]
[Sat Apr 18 16:50:06.330486 2026] [:error] [pid 34288:tid 34299] [client 208.97.187.39:57954] [client 208.97.187.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.97.187.39, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeNFvuTIiy__PtiLmpm5-gAAAYc"]
[Sat Apr 18 16:50:07.484405 2026] [:error] [pid 34288:tid 34316] [client 208.97.187.39:57954] [client 208.97.187.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.97.187.39, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeNFv-TIiy__PtiLmpm5-wAAAZg"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 18 17:00:33.956209 2026] [:error] [pid 9864:tid 9927] [client 35.233.169.216:64378] [client 35.233.169.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.233.169.216, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeNIMYCFeowknfXHM7nUeQAAAFU"]
[Sat Apr 18 17:00:35.995895 2026] [:error] [pid 9864:tid 9915] [client 35.233.169.216:64378] [client 35.233.169.216] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeNIM4CFeowknfXHM7nUfQAAAEk"]
[Sat Apr 18 17:00:36.182910 2026] [:error] [pid 9864:tid 9909] [client 35.233.169.216:64378] [client 35.233.169.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.233.169.216, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeNINICFeowknfXHM7nUfgAAAEQ"]
[Sat Apr 18 17:00:37.530543 2026] [:error] [pid 9865:tid 9961] [client 35.233.169.216:54775] [client 35.233.169.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.233.169.216, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeNINazb5knECIY-C-hgSAAAAJg"]
[Sat Apr 18 17:00:38.786979 2026] [:error] [pid 9970:tid 9995] [client 35.233.169.216:60991] [client 35.233.169.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.233.169.216, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeNINiYdRLRhVmaIMx2H8wAAANU"]
[Sat Apr 18 17:00:40.068906 2026] [:error] [pid 13023:tid 13026] [client 35.233.169.216:57468] [client 35.233.169.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.233.169.216, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeNIOP1e7hG8DAeABB_T7gAAAQE"]
[Sat Apr 18 17:00:41.336254 2026] [:error] [pid 13023:tid 13043] [client 35.233.169.216:50849] [client 35.233.169.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.233.169.216, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeNIOf1e7hG8DAeABB_T8QAAARI"]
[Sat Apr 18 17:00:41.336479 2026] [:error] [pid 13023:tid 13043] [client 35.233.169.216:50849] [client 35.233.169.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.233.169.216, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeNIOf1e7hG8DAeABB_T8QAAARI"]
[Sat Apr 18 17:57:09.916485 2026] [:error] [pid 34290:tid 34323] [client 51.83.35.19:34124] [client 51.83.35.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.83.35.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeNVdRqX6WpmmAXOBi_0BQAAAcQ"]
[Sat Apr 18 18:29:38.438473 2026] [:error] [pid 13023:tid 13047] [client 43.130.174.37:41596] [client 43.130.174.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aeNdEv1e7hG8DAeABB_vKgAAARY"]
[Sat Apr 18 20:16:09.030390 2026] [:error] [pid 9970:tid 9983] [client 3.220.243.128:35676] [client 3.220.243.128] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.220.243.128, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeN2CSYdRLRhVmaIMx2zTwAAAMk"]
[Sat Apr 18 20:16:09.931444 2026] [:error] [pid 9970:tid 9992] [client 3.220.243.128:35676] [client 3.220.243.128] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.220.243.128, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeN2CSYdRLRhVmaIMx2zUAAAANI"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 18 20:32:16.588837 2026] [:error] [pid 13023:tid 13029] [client 43.153.71.132:37426] [client 43.153.71.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeN50P1e7hG8DAeABB8ImQAAAQQ"]
[Sat Apr 18 20:49:05.931296 2026] [:error] [pid 9970:tid 9987] [client 103.72.212.62:60948] [client 103.72.212.62] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.72.212.62, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeN9wSYdRLRhVmaIMx252gAAAM0"]
[Sat Apr 18 20:49:16.540210 2026] [:error] [pid 9865:tid 9947] [client 103.72.212.58:61266] [client 103.72.212.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.72.212.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeN9zKzb5knECIY-C-iH2AAAAIo"]
[Sat Apr 18 20:49:27.237281 2026] [:error] [pid 9970:tid 9989] [client 103.72.212.58:61495] [client 103.72.212.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.72.212.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeN91yYdRLRhVmaIMx259AAAAM8"]
[Sat Apr 18 20:49:37.893813 2026] [:error] [pid 9864:tid 9927] [client 103.72.212.58:61728] [client 103.72.212.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.72.212.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeN94YCFeowknfXHM7khbAAAAFU"]
[Sat Apr 18 20:49:48.592828 2026] [:error] [pid 32678:tid 32708] [client 103.72.212.58:61960] [client 103.72.212.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.72.212.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeN97BUlAXU_ZWUu5y_40QAAAoE"]
[Sat Apr 18 20:49:59.238066 2026] [:error] [pid 34290:tid 34343] [client 103.72.212.58:62194] [client 103.72.212.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.72.212.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeN99xqX6WpmmAXOBi8hWQAAAdg"]
[Sat Apr 18 21:15:14.902737 2026] [:error] [pid 13023:tid 13039] [client 139.99.61.38:37998] [client 139.99.61.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.99.61.38, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeOD4v1e7hG8DAeABB8YJwAAAQ4"]
[Sat Apr 18 21:28:39.601167 2026] [:error] [pid 9864:tid 9920] [client 45.87.221.196:46020] [client 45.87.221.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.87.221.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeOHB4CFeowknfXHM7kmcgAAAE4"]
[Sat Apr 18 22:06:46.825746 2026] [:error] [pid 13023:tid 13046] [client 5.9.109.189:38652] [client 5.9.109.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.9.109.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeOP9v1e7hG8DAeABB8uKAAAARU"]
[Sat Apr 18 22:16:19.649021 2026] [:error] [pid 9865:tid 9937] [client 52.236.80.95:65132] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/php.php"] [unique_id "aeOSM6zb5knECIY-C-ibngAAAIA"]
[Sat Apr 18 22:16:20.709632 2026] [:error] [pid 34290:tid 34339] [client 52.236.80.95:64063] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/php.php"] [unique_id "aeOSNBqX6WpmmAXOBi8pJgAAAdQ"]
[Sat Apr 18 22:16:21.616934 2026] [:error] [pid 13023:tid 13034] [client 52.236.80.95:65089] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/php.php"] [unique_id "aeOSNf1e7hG8DAeABB8ySgAAAQk"]
[Sat Apr 18 22:16:24.067410 2026] [:error] [pid 13023:tid 13047] [client 52.236.80.95:65192] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/php.php"] [unique_id "aeOSOP1e7hG8DAeABB8yUAAAARY"]
[Sat Apr 18 22:16:27.878672 2026] [:error] [pid 32677:tid 32700] [client 52.236.80.95:64596] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aeOSOxngmUE3LdC-wP7rHgAAAlQ"]
[Sat Apr 18 22:16:30.070757 2026] [:error] [pid 13023:tid 13047] [client 52.236.80.95:65204] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aeOSPv1e7hG8DAeABB8yXQAAARY"]
[Sat Apr 18 22:16:33.795645 2026] [:error] [pid 32647:tid 32662] [client 52.236.80.95:6177] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aeOSQUkxooM0iRo6e54t6gAAAgw"]
[Sat Apr 18 22:16:36.061931 2026] [:error] [pid 9970:tid 9983] [client 52.236.80.95:65095] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "aeOSRCYdRLRhVmaIMx3WGgAAAMk"]
[Sat Apr 18 22:16:43.490620 2026] [:error] [pid 9970:tid 9995] [client 52.236.80.95:64701] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/defeg.php"] [unique_id "aeOSSyYdRLRhVmaIMx3WLwAAANU"]
[Sat Apr 18 22:16:44.775505 2026] [:error] [pid 9970:tid 9987] [client 52.236.80.95:63609] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/defeg.php"] [unique_id "aeOSTCYdRLRhVmaIMx3WMQAAAM0"]
[Sat Apr 18 22:16:45.908859 2026] [:error] [pid 32677:tid 32704] [client 52.236.80.95:63146] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/defeg.php"] [unique_id "aeOSTRngmUE3LdC-wP7rKwAAAlg"]
[Sat Apr 18 22:16:46.686009 2026] [:error] [pid 34290:tid 34321] [client 52.236.80.95:65209] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/defeg.php"] [unique_id "aeOSThqX6WpmmAXOBi8pLAAAAcI"]
[Sat Apr 18 22:16:47.536447 2026] [:error] [pid 32647:tid 32673] [client 52.236.80.95:65189] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/C1.php"] [unique_id "aeOST0kxooM0iRo6e54t8gAAAhc"]
[Sat Apr 18 22:16:48.892592 2026] [:error] [pid 32678:tid 32715] [client 52.236.80.95:64658] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/C1.php"] [unique_id "aeOSUBUlAXU_ZWUu5y8KUQAAAog"]
[Sat Apr 18 22:16:49.733877 2026] [:error] [pid 34288:tid 34310] [client 52.236.80.95:63123] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/C1.php"] [unique_id "aeOSUeTIiy__PtiLmpnbbgAAAZI"]
[Sat Apr 18 22:16:50.755145 2026] [:error] [pid 9970:tid 9977] [client 52.236.80.95:64629] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/C1.php"] [unique_id "aeOSUiYdRLRhVmaIMx3WPAAAAMM"]
[Sat Apr 18 22:16:51.439555 2026] [:error] [pid 9970:tid 9978] [client 52.236.80.95:63554] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bfasb.php"] [unique_id "aeOSUyYdRLRhVmaIMx3WSAAAAMQ"]
[Sat Apr 18 22:16:52.218245 2026] [:error] [pid 32677:tid 32697] [client 52.236.80.95:65196] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bfasb.php"] [unique_id "aeOSVBngmUE3LdC-wP7rNwAAAlE"]
[Sat Apr 18 22:16:52.884217 2026] [:error] [pid 32678:tid 32708] [client 52.236.80.95:63557] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bfasb.php"] [unique_id "aeOSVBUlAXU_ZWUu5y8KYAAAAoE"]
[Sat Apr 18 22:16:53.816959 2026] [:error] [pid 32678:tid 32711] [client 52.236.80.95:63969] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bfasb.php"] [unique_id "aeOSVRUlAXU_ZWUu5y8KYwAAAoQ"]
[Sat Apr 18 22:16:54.347228 2026] [:error] [pid 9865:tid 9949] [client 52.236.80.95:63045] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clcdu.php"] [unique_id "aeOSVqzb5knECIY-C-ibuQAAAIw"]
[Sat Apr 18 22:16:55.119496 2026] [:error] [pid 34290:tid 34339] [client 52.236.80.95:63137] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clcdu.php"] [unique_id "aeOSVxqX6WpmmAXOBi8pLgAAAdQ"]
[Sat Apr 18 22:16:55.745929 2026] [:error] [pid 32677:tid 32685] [client 52.236.80.95:65096] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clcdu.php"] [unique_id "aeOSVxngmUE3LdC-wP7rPAAAAkU"]
[Sat Apr 18 22:16:56.314818 2026] [:error] [pid 34290:tid 34322] [client 52.236.80.95:63153] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clcdu.php"] [unique_id "aeOSWBqX6WpmmAXOBi8pMAAAAcM"]
[Sat Apr 18 22:16:57.538617 2026] [:error] [pid 34290:tid 34337] [client 52.236.80.95:63618] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dgmry.php"] [unique_id "aeOSWRqX6WpmmAXOBi8pMgAAAdI"]
[Sat Apr 18 22:16:58.161495 2026] [:error] [pid 32678:tid 32720] [client 52.236.80.95:64017] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dgmry.php"] [unique_id "aeOSWhUlAXU_ZWUu5y8KcAAAAo0"]
[Sat Apr 18 22:16:58.974822 2026] [:error] [pid 9865:tid 9940] [client 52.236.80.95:63156] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dgmry.php"] [unique_id "aeOSWqzb5knECIY-C-ibvAAAAIM"]
[Sat Apr 18 22:17:00.006159 2026] [:error] [pid 13023:tid 13046] [client 52.236.80.95:65107] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dgmry.php"] [unique_id "aeOSXP1e7hG8DAeABB8ypQAAARU"]
[Sat Apr 18 22:17:00.782216 2026] [:error] [pid 9865:tid 9953] [client 52.236.80.95:63578] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eursi.php"] [unique_id "aeOSXKzb5knECIY-C-ibwgAAAJA"]
[Sat Apr 18 22:17:01.417598 2026] [:error] [pid 32678:tid 32731] [client 52.236.80.95:61484] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eursi.php"] [unique_id "aeOSXRUlAXU_ZWUu5y8KdgAAApg"]
[Sat Apr 18 22:17:02.294220 2026] [:error] [pid 13023:tid 13031] [client 52.236.80.95:65106] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eursi.php"] [unique_id "aeOSXv1e7hG8DAeABB8yqgAAAQY"]
[Sat Apr 18 22:17:03.033471 2026] [:error] [pid 9864:tid 9928] [client 52.236.80.95:65208] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eursi.php"] [unique_id "aeOSX4CFeowknfXHM7ktuQAAAFY"]
[Sat Apr 18 22:17:03.655654 2026] [:error] [pid 13023:tid 13035] [client 52.236.80.95:64663] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gkojz.php"] [unique_id "aeOSX_1e7hG8DAeABB8ysAAAAQo"]
[Sat Apr 18 22:17:04.280320 2026] [:error] [pid 13023:tid 13046] [client 52.236.80.95:64058] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gkojz.php"] [unique_id "aeOSYP1e7hG8DAeABB8ysgAAARU"]
[Sat Apr 18 22:17:04.976471 2026] [:error] [pid 34288:tid 34315] [client 52.236.80.95:64641] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gkojz.php"] [unique_id "aeOSYOTIiy__PtiLmpnbdwAAAZc"]
[Sat Apr 18 22:17:05.720850 2026] [:error] [pid 34288:tid 34306] [client 52.236.80.95:64703] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gkojz.php"] [unique_id "aeOSYeTIiy__PtiLmpnbeQAAAY4"]
[Sat Apr 18 22:17:06.608434 2026] [:error] [pid 9865:tid 9943] [client 52.236.80.95:64048] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/isvqf.php"] [unique_id "aeOSYqzb5knECIY-C-ibxgAAAIY"]
[Sat Apr 18 22:17:07.338973 2026] [:error] [pid 9865:tid 9939] [client 52.236.80.95:63124] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/isvqf.php"] [unique_id "aeOSY6zb5knECIY-C-ibyAAAAII"]
[Sat Apr 18 22:17:07.961399 2026] [:error] [pid 9865:tid 9956] [client 52.236.80.95:64635] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/isvqf.php"] [unique_id "aeOSY6zb5knECIY-C-ibygAAAJM"]
[Sat Apr 18 22:17:08.526286 2026] [:error] [pid 9864:tid 9910] [client 52.236.80.95:64037] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/isvqf.php"] [unique_id "aeOSZICFeowknfXHM7ktuwAAAEU"]
[Sat Apr 18 22:17:09.084320 2026] [:error] [pid 13023:tid 13033] [client 52.236.80.95:63639] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ppxhp.php"] [unique_id "aeOSZf1e7hG8DAeABB8yuQAAAQg"]
[Sat Apr 18 22:17:09.709169 2026] [:error] [pid 9865:tid 9949] [client 52.236.80.95:64640] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ppxhp.php"] [unique_id "aeOSZazb5knECIY-C-ib0wAAAIw"]
[Sat Apr 18 22:17:10.405304 2026] [:error] [pid 34288:tid 34314] [client 52.236.80.95:65151] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ppxhp.php"] [unique_id "aeOSZuTIiy__PtiLmpnbewAAAZY"]
[Sat Apr 18 22:17:11.003838 2026] [:error] [pid 9865:tid 9941] [client 52.236.80.95:64627] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ppxhp.php"] [unique_id "aeOSZ6zb5knECIY-C-ib2AAAAIQ"]
[Sat Apr 18 22:17:11.785479 2026] [:error] [pid 9865:tid 9942] [client 52.236.80.95:64589] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/whtrq.php"] [unique_id "aeOSZ6zb5knECIY-C-ib3AAAAIU"]
[Sat Apr 18 22:17:12.460713 2026] [:error] [pid 9865:tid 9959] [client 52.236.80.95:63645] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/whtrq.php"] [unique_id "aeOSaKzb5knECIY-C-ib3gAAAJY"]
[Sat Apr 18 22:17:13.040859 2026] [:error] [pid 32677:tid 32699] [client 52.236.80.95:63654] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/whtrq.php"] [unique_id "aeOSaRngmUE3LdC-wP7rRQAAAlM"]
[Sat Apr 18 22:17:13.765362 2026] [:error] [pid 9863:tid 9886] [client 52.236.80.95:6153] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/whtrq.php"] [unique_id "aeOSaTjjiypiFrTucbLW5wAAAA0"]
[Sat Apr 18 22:17:14.314023 2026] [:error] [pid 32677:tid 32703] [client 52.236.80.95:63942] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rkiea.php"] [unique_id "aeOSahngmUE3LdC-wP7rSwAAAlc"]
[Sat Apr 18 22:17:15.023709 2026] [:error] [pid 32677:tid 32696] [client 52.236.80.95:63042] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rkiea.php"] [unique_id "aeOSaxngmUE3LdC-wP7rTQAAAlA"]
[Sat Apr 18 22:17:15.644370 2026] [:error] [pid 32647:tid 32674] [client 52.236.80.95:63939] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rkiea.php"] [unique_id "aeOSa0kxooM0iRo6e54t_QAAAhg"]
[Sat Apr 18 22:17:16.325555 2026] [:error] [pid 32678:tid 32714] [client 52.236.80.95:63649] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rkiea.php"] [unique_id "aeOSbBUlAXU_ZWUu5y8KiQAAAoc"]
[Sat Apr 18 22:17:16.880383 2026] [:error] [pid 9863:tid 9896] [client 52.236.80.95:63560] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ckk.php"] [unique_id "aeOSbDjjiypiFrTucbLW6wAAABc"]
[Sat Apr 18 22:17:17.651936 2026] [:error] [pid 13023:tid 13041] [client 52.236.80.95:63052] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ckk.php"] [unique_id "aeOSbf1e7hG8DAeABB8ywAAAARA"]
[Sat Apr 18 22:17:26.610047 2026] [:error] [pid 13023:tid 13041] [client 52.236.80.95:64676] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aeOSdv1e7hG8DAeABB8y4AAAARA"]
[Sat Apr 18 22:17:27.228298 2026] [:error] [pid 9970:tid 9995] [client 52.236.80.95:6186] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aeOSdyYdRLRhVmaIMx3WfQAAANU"]
[Sat Apr 18 22:17:27.789951 2026] [:error] [pid 13023:tid 13037] [client 52.236.80.95:63952] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aeOSd_1e7hG8DAeABB8y6gAAAQw"]
[Sat Apr 18 22:17:28.377624 2026] [:error] [pid 13023:tid 13042] [client 52.236.80.95:63579] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aeOSeP1e7hG8DAeABB8y7gAAARE"]
[Sat Apr 18 22:17:28.964216 2026] [:error] [pid 13023:tid 13045] [client 52.236.80.95:63134] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aeOSeP1e7hG8DAeABB8y8wAAARQ"]
[Sat Apr 18 22:17:29.524585 2026] [:error] [pid 9970:tid 9992] [client 52.236.80.95:65116] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aeOSeSYdRLRhVmaIMx3WgQAAANI"]
[Sat Apr 18 22:17:30.085811 2026] [:error] [pid 9863:tid 9881] [client 52.236.80.95:63629] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aeOSejjjiypiFrTucbLW7QAAAAg"]
[Sat Apr 18 22:17:30.647599 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:64639] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aeOSev1e7hG8DAeABB8y_AAAAQE"]
[Sat Apr 18 22:17:31.299501 2026] [:error] [pid 9865:tid 9956] [client 52.236.80.95:6170] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mjq.php"] [unique_id "aeOSe6zb5knECIY-C-ib6AAAAJM"]
[Sat Apr 18 22:17:31.850544 2026] [:error] [pid 13023:tid 13048] [client 52.236.80.95:65172] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mjq.php"] [unique_id "aeOSe_1e7hG8DAeABB8zBQAAARc"]
[Sat Apr 18 22:17:32.463159 2026] [:error] [pid 13023:tid 13049] [client 52.236.80.95:63677] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mjq.php"] [unique_id "aeOSfP1e7hG8DAeABB8zCgAAARg"]
[Sat Apr 18 22:17:33.042908 2026] [:error] [pid 34288:tid 34308] [client 52.236.80.95:65142] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mjq.php"] [unique_id "aeOSfeTIiy__PtiLmpnbfQAAAZA"]
[Sat Apr 18 22:17:33.611090 2026] [:error] [pid 32677:tid 32699] [client 52.236.80.95:63670] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zu.php"] [unique_id "aeOSfRngmUE3LdC-wP7rXgAAAlM"]
[Sat Apr 18 22:17:34.289591 2026] [:error] [pid 9865:tid 9960] [client 52.236.80.95:63142] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zu.php"] [unique_id "aeOSfqzb5knECIY-C-ib7QAAAJc"]
[Sat Apr 18 22:17:34.881531 2026] [:error] [pid 13023:tid 13044] [client 52.236.80.95:64593] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zu.php"] [unique_id "aeOSfv1e7hG8DAeABB8zEAAAARM"]
[Sat Apr 18 22:17:35.468461 2026] [:error] [pid 9865:tid 9945] [client 52.236.80.95:6170] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zu.php"] [unique_id "aeOSf6zb5knECIY-C-ib8QAAAIg"]
[Sat Apr 18 22:17:36.147607 2026] [:error] [pid 32678:tid 32715] [client 52.236.80.95:64046] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws53.php"] [unique_id "aeOSgBUlAXU_ZWUu5y8KmgAAAog"]
[Sat Apr 18 22:17:36.682688 2026] [:error] [pid 9970:tid 9975] [client 52.236.80.95:64675] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws53.php"] [unique_id "aeOSgCYdRLRhVmaIMx3WhQAAAME"]
[Sat Apr 18 22:17:37.364660 2026] [:error] [pid 32647:tid 32665] [client 52.236.80.95:64644] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws53.php"] [unique_id "aeOSgUkxooM0iRo6e54uBgAAAg8"]
[Sat Apr 18 22:17:38.130835 2026] [:error] [pid 9863:tid 9883] [client 52.236.80.95:63150] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws53.php"] [unique_id "aeOSgjjjiypiFrTucbLW8AAAAAo"]
[Sat Apr 18 22:17:38.646328 2026] [:error] [pid 32677:tid 32698] [client 52.236.80.95:64685] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws56.php"] [unique_id "aeOSghngmUE3LdC-wP7rZQAAAlI"]
[Sat Apr 18 22:17:39.245172 2026] [:error] [pid 9970:tid 9982] [client 52.236.80.95:64022] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws56.php"] [unique_id "aeOSgyYdRLRhVmaIMx3WjQAAAMg"]
[Sat Apr 18 22:17:39.911082 2026] [:error] [pid 32678:tid 32731] [client 52.236.80.95:63663] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws56.php"] [unique_id "aeOSgxUlAXU_ZWUu5y8KnQAAApg"]
[Sat Apr 18 22:17:40.485140 2026] [:error] [pid 32677:tid 32694] [client 52.236.80.95:63588] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws56.php"] [unique_id "aeOShBngmUE3LdC-wP7raAAAAk4"]
[Sat Apr 18 22:17:41.596622 2026] [:error] [pid 9970:tid 9991] [client 52.236.80.95:63976] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws58.php"] [unique_id "aeOShSYdRLRhVmaIMx3WlAAAANE"]
[Sat Apr 18 22:17:42.235090 2026] [:error] [pid 9970:tid 9990] [client 52.236.80.95:65098] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws58.php"] [unique_id "aeOShiYdRLRhVmaIMx3WlwAAANA"]
[Sat Apr 18 22:17:42.781986 2026] [:error] [pid 13023:tid 13029] [client 52.236.80.95:63998] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws58.php"] [unique_id "aeOShv1e7hG8DAeABB8zLgAAAQQ"]
[Sat Apr 18 22:17:43.312565 2026] [:error] [pid 9970:tid 9988] [client 52.236.80.95:6204] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws58.php"] [unique_id "aeOShyYdRLRhVmaIMx3WnQAAAM4"]
[Sat Apr 18 22:17:43.860164 2026] [:error] [pid 9970:tid 9978] [client 52.236.80.95:63657] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws59.php"] [unique_id "aeOShyYdRLRhVmaIMx3WnwAAAMQ"]
[Sat Apr 18 22:17:44.394913 2026] [:error] [pid 9864:tid 9907] [client 52.236.80.95:63138] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws59.php"] [unique_id "aeOSiICFeowknfXHM7ktygAAAEI"]
[Sat Apr 18 22:17:45.131812 2026] [:error] [pid 9863:tid 9880] [client 52.236.80.95:64656] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws59.php"] [unique_id "aeOSiTjjiypiFrTucbLW9QAAAAc"]
[Sat Apr 18 22:17:45.798227 2026] [:error] [pid 9863:tid 9879] [client 52.236.80.95:63581] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws59.php"] [unique_id "aeOSiTjjiypiFrTucbLW9wAAAAY"]
[Sat Apr 18 22:17:46.378453 2026] [:error] [pid 34290:tid 34342] [client 52.236.80.95:63672] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/utchiha_O1JFaUaF.php"] [unique_id "aeOSihqX6WpmmAXOBi8pOwAAAdc"]
[Sat Apr 18 22:17:47.002522 2026] [:error] [pid 13023:tid 13044] [client 52.236.80.95:64585] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/utchiha_O1JFaUaF.php"] [unique_id "aeOSi_1e7hG8DAeABB8zMwAAARM"]
[Sat Apr 18 22:17:47.737020 2026] [:error] [pid 9865:tid 9945] [client 52.236.80.95:64679] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/utchiha_O1JFaUaF.php"] [unique_id "aeOSi6zb5knECIY-C-icCwAAAIg"]
[Sat Apr 18 22:17:48.406220 2026] [:error] [pid 9864:tid 9916] [client 52.236.80.95:63058] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/utchiha_O1JFaUaF.php"] [unique_id "aeOSjICFeowknfXHM7ktzgAAAEo"]
[Sat Apr 18 22:17:49.084556 2026] [:error] [pid 9970:tid 9986] [client 52.236.80.95:60680] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mga.php"] [unique_id "aeOSjSYdRLRhVmaIMx3WpQAAAMw"]
[Sat Apr 18 22:17:49.589587 2026] [:error] [pid 34290:tid 34337] [client 52.236.80.95:63116] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mga.php"] [unique_id "aeOSjRqX6WpmmAXOBi8pPQAAAdI"]
[Sat Apr 18 22:17:50.141748 2026] [:error] [pid 32678:tid 32719] [client 52.236.80.95:65104] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mga.php"] [unique_id "aeOSjhUlAXU_ZWUu5y8KowAAAow"]
[Sat Apr 18 22:17:50.714677 2026] [:error] [pid 13023:tid 13031] [client 52.236.80.95:63572] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mga.php"] [unique_id "aeOSjv1e7hG8DAeABB8zNgAAAQY"]
[Sat Apr 18 22:17:51.272561 2026] [:error] [pid 32677:tid 32700] [client 52.236.80.95:6198] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mds.php"] [unique_id "aeOSjxngmUE3LdC-wP7ragAAAlQ"]
[Sat Apr 18 22:17:52.035055 2026] [:error] [pid 32677:tid 32703] [client 52.236.80.95:64615] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mds.php"] [unique_id "aeOSkBngmUE3LdC-wP7rbAAAAlc"]
[Sat Apr 18 22:17:52.655958 2026] [:error] [pid 32677:tid 32702] [client 52.236.80.95:63556] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mds.php"] [unique_id "aeOSkBngmUE3LdC-wP7rbgAAAlY"]
[Sat Apr 18 22:17:53.271550 2026] [:error] [pid 32647:tid 32653] [client 52.236.80.95:64040] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mds.php"] [unique_id "aeOSkUkxooM0iRo6e54uDwAAAgM"]
[Sat Apr 18 22:17:54.022944 2026] [:error] [pid 32678:tid 32715] [client 52.236.80.95:63046] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/auth.php"] [unique_id "aeOSkhUlAXU_ZWUu5y8KpAAAAog"]
[Sat Apr 18 22:17:54.801672 2026] [:error] [pid 32678:tid 32731] [client 52.236.80.95:63130] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/auth.php"] [unique_id "aeOSkhUlAXU_ZWUu5y8KpQAAApg"]
[Sat Apr 18 22:17:55.627604 2026] [:error] [pid 34290:tid 34323] [client 52.236.80.95:64003] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/auth.php"] [unique_id "aeOSkxqX6WpmmAXOBi8pQgAAAcQ"]
[Sat Apr 18 22:17:56.281077 2026] [:error] [pid 9970:tid 9979] [client 52.236.80.95:65160] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/auth.php"] [unique_id "aeOSlCYdRLRhVmaIMx3WqwAAAMU"]
[Sat Apr 18 22:17:56.936601 2026] [:error] [pid 9970:tid 9993] [client 52.236.80.95:63583] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/iov.php"] [unique_id "aeOSlCYdRLRhVmaIMx3WrAAAANM"]
[Sat Apr 18 22:17:57.492026 2026] [:error] [pid 32678:tid 32708] [client 52.236.80.95:65163] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/iov.php"] [unique_id "aeOSlRUlAXU_ZWUu5y8KsAAAAoE"]
[Sat Apr 18 22:17:58.856438 2026] [:error] [pid 9970:tid 9976] [client 52.236.80.95:62575] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/iov.php"] [unique_id "aeOSliYdRLRhVmaIMx3WsgAAAMI"]
[Sat Apr 18 22:18:00.996560 2026] [:error] [pid 13023:tid 13030] [client 52.236.80.95:64594] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/iov.php"] [unique_id "aeOSmP1e7hG8DAeABB8zRAAAAQU"]
[Sat Apr 18 22:18:05.191679 2026] [:error] [pid 9864:tid 9912] [client 52.236.80.95:63596] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jodohghi.php"] [unique_id "aeOSnYCFeowknfXHM7kt3QAAAEY"]
[Sat Apr 18 22:18:20.933624 2026] [:error] [pid 9864:tid 9909] [client 52.236.80.95:64021] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jodohghi.php"] [unique_id "aeOSrICFeowknfXHM7kt6AAAAEQ"]
[Sat Apr 18 22:18:35.917899 2026] [:error] [pid 9970:tid 9998] [client 52.236.80.95:64012] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bykdo.php"] [unique_id "aeOSuyYdRLRhVmaIMx3W-AAAANg"]
[Sat Apr 18 22:18:36.651812 2026] [:error] [pid 13023:tid 13047] [client 52.236.80.95:6182] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bykdo.php"] [unique_id "aeOSvP1e7hG8DAeABB8zdwAAARY"]
[Sat Apr 18 22:18:37.315911 2026] [:error] [pid 13023:tid 13034] [client 52.236.80.95:6164] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bykdo.php"] [unique_id "aeOSvf1e7hG8DAeABB8zewAAAQk"]
[Sat Apr 18 22:18:38.140933 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:63053] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bykdo.php"] [unique_id "aeOSvv1e7hG8DAeABB8zfwAAAQE"]
[Sat Apr 18 22:18:38.732097 2026] [:error] [pid 32647:tid 32651] [client 52.236.80.95:63612] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byueb.php"] [unique_id "aeOSvkkxooM0iRo6e54uGAAAAgE"]
[Sat Apr 18 22:18:39.386502 2026] [:error] [pid 9970:tid 9993] [client 52.236.80.95:64643] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byueb.php"] [unique_id "aeOSvyYdRLRhVmaIMx3W_AAAANM"]
[Sat Apr 18 22:18:39.972544 2026] [:error] [pid 9970:tid 9979] [client 52.236.80.95:63117] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byueb.php"] [unique_id "aeOSvyYdRLRhVmaIMx3XAAAAAMU"]
[Sat Apr 18 22:18:40.479866 2026] [:error] [pid 9970:tid 9990] [client 52.236.80.95:64661] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byueb.php"] [unique_id "aeOSwCYdRLRhVmaIMx3XBAAAANA"]
[Sat Apr 18 22:18:41.069516 2026] [:error] [pid 32678:tid 32713] [client 52.236.80.95:64625] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cjndd.php"] [unique_id "aeOSwRUlAXU_ZWUu5y8KxAAAAoY"]
[Sat Apr 18 22:18:41.631739 2026] [:error] [pid 9864:tid 9923] [client 52.236.80.95:63138] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cjndd.php"] [unique_id "aeOSwYCFeowknfXHM7kt-wAAAFE"]
[Sat Apr 18 22:18:42.147683 2026] [:error] [pid 32678:tid 32707] [client 52.236.80.95:63562] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cjndd.php"] [unique_id "aeOSwhUlAXU_ZWUu5y8KxQAAAoA"]
[Sat Apr 18 22:18:42.646563 2026] [:error] [pid 13023:tid 13038] [client 52.236.80.95:64055] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cjndd.php"] [unique_id "aeOSwv1e7hG8DAeABB8zhgAAAQ0"]
[Sat Apr 18 22:18:43.215679 2026] [:error] [pid 32677:tid 32683] [client 52.236.80.95:64041] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/coiuz.php"] [unique_id "aeOSwxngmUE3LdC-wP7rlQAAAkM"]
[Sat Apr 18 22:18:43.743381 2026] [:error] [pid 32678:tid 32727] [client 52.236.80.95:6165] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/coiuz.php"] [unique_id "aeOSwxUlAXU_ZWUu5y8KyAAAApQ"]
[Sat Apr 18 22:18:44.282919 2026] [:error] [pid 13023:tid 13047] [client 52.236.80.95:62062] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/coiuz.php"] [unique_id "aeOSxP1e7hG8DAeABB8ziAAAARY"]
[Sat Apr 18 22:18:44.825720 2026] [:error] [pid 9970:tid 9997] [client 52.236.80.95:62084] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/coiuz.php"] [unique_id "aeOSxCYdRLRhVmaIMx3XCwAAANc"]
[Sat Apr 18 22:18:45.342629 2026] [:error] [pid 9864:tid 9913] [client 52.236.80.95:6183] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aeOSxYCFeowknfXHM7kuBgAAAEc"]
[Sat Apr 18 22:18:45.884064 2026] [:error] [pid 9865:tid 9944] [client 52.236.80.95:63936] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aeOSxazb5knECIY-C-icJwAAAIc"]
[Sat Apr 18 22:18:46.435477 2026] [:error] [pid 13023:tid 13041] [client 52.236.80.95:65157] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aeOSxv1e7hG8DAeABB8zjAAAARA"]
[Sat Apr 18 22:18:46.945318 2026] [:error] [pid 9865:tid 9939] [client 52.236.80.95:60186] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aeOSxqzb5knECIY-C-icKgAAAII"]
[Sat Apr 18 22:18:47.524187 2026] [:error] [pid 9970:tid 9982] [client 52.236.80.95:64023] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctjpseby.php"] [unique_id "aeOSxyYdRLRhVmaIMx3XDQAAAMg"]
[Sat Apr 18 22:18:48.034200 2026] [:error] [pid 32647:tid 32672] [client 52.236.80.95:64056] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctjpseby.php"] [unique_id "aeOSyEkxooM0iRo6e54uHwAAAhY"]
[Sat Apr 18 22:18:48.659708 2026] [:error] [pid 9970:tid 9988] [client 52.236.80.95:64624] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctjpseby.php"] [unique_id "aeOSyCYdRLRhVmaIMx3XDwAAAM4"]
[Sat Apr 18 22:18:49.210326 2026] [:error] [pid 9970:tid 9995] [client 52.236.80.95:64014] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctjpseby.php"] [unique_id "aeOSySYdRLRhVmaIMx3XEQAAANU"]
[Sat Apr 18 22:18:49.761108 2026] [:error] [pid 34288:tid 34311] [client 52.236.80.95:64626] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cxxuv.php"] [unique_id "aeOSyeTIiy__PtiLmpnblAAAAZM"]
[Sat Apr 18 22:18:50.315115 2026] [:error] [pid 32647:tid 32664] [client 52.236.80.95:64006] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cxxuv.php"] [unique_id "aeOSykkxooM0iRo6e54uJQAAAg4"]
[Sat Apr 18 22:18:50.898699 2026] [:error] [pid 9970:tid 9997] [client 52.236.80.95:65152] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cxxuv.php"] [unique_id "aeOSyiYdRLRhVmaIMx3XFgAAANc"]
[Sat Apr 18 22:18:51.418302 2026] [:error] [pid 9864:tid 9913] [client 52.236.80.95:64587] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cxxuv.php"] [unique_id "aeOSy4CFeowknfXHM7kuDgAAAEc"]
[Sat Apr 18 22:18:52.025686 2026] [:error] [pid 9865:tid 9946] [client 52.236.80.95:62624] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dawvg.php"] [unique_id "aeOSzKzb5knECIY-C-icLwAAAIk"]
[Sat Apr 18 22:18:52.557421 2026] [:error] [pid 9865:tid 9947] [client 52.236.80.95:6156] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dawvg.php"] [unique_id "aeOSzKzb5knECIY-C-icMgAAAIo"]
[Sat Apr 18 22:18:53.091067 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:64005] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dawvg.php"] [unique_id "aeOSzf1e7hG8DAeABB8zmAAAAQE"]
[Sat Apr 18 22:18:53.873390 2026] [:error] [pid 34288:tid 34312] [client 52.236.80.95:65181] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dawvg.php"] [unique_id "aeOSzeTIiy__PtiLmpnblwAAAZQ"]
[Sat Apr 18 22:18:54.508056 2026] [:error] [pid 9863:tid 9884] [client 52.236.80.95:63971] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dhjqs.php"] [unique_id "aeOSzjjjiypiFrTucbLXDQAAAAs"]
[Sat Apr 18 22:18:55.368287 2026] [:error] [pid 9863:tid 9885] [client 52.236.80.95:62095] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dhjqs.php"] [unique_id "aeOSzzjjiypiFrTucbLXDgAAAAw"]
[Sat Apr 18 22:18:56.116794 2026] [:error] [pid 13023:tid 13025] [client 52.236.80.95:63633] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dhjqs.php"] [unique_id "aeOS0P1e7hG8DAeABB8zqwAAAQA"]
[Sat Apr 18 22:18:56.711873 2026] [:error] [pid 9864:tid 9906] [client 52.236.80.95:63571] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dhjqs.php"] [unique_id "aeOS0ICFeowknfXHM7kuEgAAAEE"]
[Sat Apr 18 22:18:57.299754 2026] [:error] [pid 32678:tid 32719] [client 52.236.80.95:61480] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/diayd.php"] [unique_id "aeOS0RUlAXU_ZWUu5y8K1AAAAow"]
[Sat Apr 18 22:18:57.868557 2026] [:error] [pid 32678:tid 32722] [client 52.236.80.95:65122] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/diayd.php"] [unique_id "aeOS0RUlAXU_ZWUu5y8K1gAAAo8"]
[Sat Apr 18 22:18:58.618020 2026] [:error] [pid 32678:tid 32710] [client 52.236.80.95:63127] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/diayd.php"] [unique_id "aeOS0hUlAXU_ZWUu5y8K2QAAAoM"]
[Sat Apr 18 22:18:59.506697 2026] [:error] [pid 32647:tid 32650] [client 52.236.80.95:65166] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/diayd.php"] [unique_id "aeOS00kxooM0iRo6e54uKwAAAgA"]
[Sat Apr 18 22:19:00.055917 2026] [:error] [pid 32647:tid 32670] [client 52.236.80.95:64576] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dljpy.php"] [unique_id "aeOS1EkxooM0iRo6e54uLQAAAhQ"]
[Sat Apr 18 22:19:00.559343 2026] [:error] [pid 32647:tid 32663] [client 52.236.80.95:64671] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dljpy.php"] [unique_id "aeOS1EkxooM0iRo6e54uLgAAAg0"]
[Sat Apr 18 22:19:01.196624 2026] [:error] [pid 13023:tid 13031] [client 52.236.80.95:64677] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dljpy.php"] [unique_id "aeOS1f1e7hG8DAeABB8zvAAAAQY"]
[Sat Apr 18 22:19:01.833044 2026] [:error] [pid 32677:tid 32687] [client 52.236.80.95:63958] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dljpy.php"] [unique_id "aeOS1RngmUE3LdC-wP7rmwAAAkc"]
[Sat Apr 18 22:19:02.349195 2026] [:error] [pid 9865:tid 9958] [client 52.236.80.95:65155] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dqagu.php"] [unique_id "aeOS1qzb5knECIY-C-icOQAAAJU"]
[Sat Apr 18 22:19:02.960287 2026] [:error] [pid 32677:tid 32702] [client 52.236.80.95:6205] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dqagu.php"] [unique_id "aeOS1hngmUE3LdC-wP7rnQAAAlY"]
[Sat Apr 18 22:19:03.522627 2026] [:error] [pid 32647:tid 32666] [client 52.236.80.95:63944] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dqagu.php"] [unique_id "aeOS10kxooM0iRo6e54uNAAAAhA"]
[Sat Apr 18 22:19:04.251077 2026] [:error] [pid 9865:tid 9938] [client 52.236.80.95:63565] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dqagu.php"] [unique_id "aeOS2Kzb5knECIY-C-icOwAAAIE"]
[Sat Apr 18 22:19:05.063395 2026] [:error] [pid 9865:tid 9947] [client 52.236.80.95:6165] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/druqr.php"] [unique_id "aeOS2azb5knECIY-C-icPgAAAIo"]
[Sat Apr 18 22:19:05.690045 2026] [:error] [pid 9970:tid 9987] [client 52.236.80.95:63978] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/druqr.php"] [unique_id "aeOS2SYdRLRhVmaIMx3XJwAAAM0"]
[Sat Apr 18 22:19:06.412225 2026] [:error] [pid 32677:tid 32704] [client 52.236.80.95:63628] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/druqr.php"] [unique_id "aeOS2hngmUE3LdC-wP7rogAAAlg"]
[Sat Apr 18 22:19:07.233210 2026] [:error] [pid 13023:tid 13025] [client 52.236.80.95:63624] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/druqr.php"] [unique_id "aeOS2_1e7hG8DAeABB8zyAAAAQA"]
[Sat Apr 18 22:19:07.919954 2026] [:error] [pid 13023:tid 13027] [client 52.236.80.95:62016] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dyxbc.php"] [unique_id "aeOS2_1e7hG8DAeABB8zzQAAAQI"]
[Sat Apr 18 22:19:08.874550 2026] [:error] [pid 32647:tid 32663] [client 52.236.80.95:6146] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dyxbc.php"] [unique_id "aeOS3EkxooM0iRo6e54uPQAAAg0"]
[Sat Apr 18 22:19:09.765088 2026] [:error] [pid 9865:tid 9957] [client 52.236.80.95:65113] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dyxbc.php"] [unique_id "aeOS3azb5knECIY-C-icQgAAAJQ"]
[Sat Apr 18 22:19:10.513674 2026] [:error] [pid 9865:tid 9949] [client 52.236.80.95:64606] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dyxbc.php"] [unique_id "aeOS3qzb5knECIY-C-icQwAAAIw"]
[Sat Apr 18 22:19:11.075687 2026] [:error] [pid 9970:tid 9998] [client 52.236.80.95:63558] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eapjf.php"] [unique_id "aeOS3yYdRLRhVmaIMx3XLAAAANg"]
[Sat Apr 18 22:19:11.648580 2026] [:error] [pid 32647:tid 32667] [client 52.236.80.95:63986] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eapjf.php"] [unique_id "aeOS30kxooM0iRo6e54uQwAAAhE"]
[Sat Apr 18 22:19:12.244753 2026] [:error] [pid 34290:tid 34322] [client 52.236.80.95:63962] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eapjf.php"] [unique_id "aeOS4BqX6WpmmAXOBi8pXAAAAcM"]
[Sat Apr 18 22:19:12.942447 2026] [:error] [pid 9970:tid 9982] [client 52.236.80.95:64036] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eapjf.php"] [unique_id "aeOS4CYdRLRhVmaIMx3XLwAAAMg"]
[Sat Apr 18 22:19:13.730105 2026] [:error] [pid 9970:tid 9985] [client 52.236.80.95:65105] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ebuom.php"] [unique_id "aeOS4SYdRLRhVmaIMx3XMQAAAMs"]
[Sat Apr 18 22:19:14.445659 2026] [:error] [pid 13023:tid 13049] [client 52.236.80.95:61481] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ebuom.php"] [unique_id "aeOS4v1e7hG8DAeABB8z0QAAARg"]
[Sat Apr 18 22:19:15.382176 2026] [:error] [pid 32678:tid 32721] [client 52.236.80.95:64029] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ebuom.php"] [unique_id "aeOS4xUlAXU_ZWUu5y8K7QAAAo4"]
[Sat Apr 18 22:19:15.948841 2026] [:error] [pid 9970:tid 9994] [client 52.236.80.95:63599] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ebuom.php"] [unique_id "aeOS4yYdRLRhVmaIMx3XOgAAANQ"]
[Sat Apr 18 22:19:16.564475 2026] [:error] [pid 32678:tid 32724] [client 52.236.80.95:64601] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/emcgm.php"] [unique_id "aeOS5BUlAXU_ZWUu5y8K7wAAApE"]
[Sat Apr 18 22:19:17.567882 2026] [:error] [pid 34288:tid 34294] [client 52.236.80.95:64690] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/emcgm.php"] [unique_id "aeOS5eTIiy__PtiLmpnbogAAAYI"]
[Sat Apr 18 22:19:18.131161 2026] [:error] [pid 9970:tid 9974] [client 52.236.80.95:64033] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/emcgm.php"] [unique_id "aeOS5iYdRLRhVmaIMx3XPgAAAMA"]
[Sat Apr 18 22:19:18.672310 2026] [:error] [pid 9864:tid 9908] [client 52.236.80.95:63599] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/emcgm.php"] [unique_id "aeOS5oCFeowknfXHM7kuGgAAAEM"]
[Sat Apr 18 22:19:19.351620 2026] [:error] [pid 9970:tid 9986] [client 52.236.80.95:61496] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/euocu.php"] [unique_id "aeOS5yYdRLRhVmaIMx3XQwAAAMw"]
[Sat Apr 18 22:19:20.006113 2026] [:error] [pid 9970:tid 9979] [client 52.236.80.95:65115] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/euocu.php"] [unique_id "aeOS6CYdRLRhVmaIMx3XRgAAAMU"]
[Sat Apr 18 22:19:20.772758 2026] [:error] [pid 13023:tid 13047] [client 52.236.80.95:62082] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/euocu.php"] [unique_id "aeOS6P1e7hG8DAeABB8z2wAAARY"]
[Sat Apr 18 22:19:21.408829 2026] [:error] [pid 13023:tid 13038] [client 52.236.80.95:65092] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/euocu.php"] [unique_id "aeOS6f1e7hG8DAeABB8z4AAAAQ0"]
[Sat Apr 18 22:19:22.215995 2026] [:error] [pid 9865:tid 9939] [client 52.236.80.95:64669] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aeOS6qzb5knECIY-C-icUAAAAII"]
[Sat Apr 18 22:19:23.263332 2026] [:error] [pid 13023:tid 13028] [client 52.236.80.95:65121] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aeOS6_1e7hG8DAeABB8z5QAAAQM"]
[Sat Apr 18 22:19:23.899132 2026] [:error] [pid 13023:tid 13039] [client 52.236.80.95:64588] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aeOS6_1e7hG8DAeABB8z5wAAAQ4"]
[Sat Apr 18 22:19:24.982769 2026] [:error] [pid 9970:tid 9985] [client 52.236.80.95:63975] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aeOS7CYdRLRhVmaIMx3XSwAAAMs"]
[Sat Apr 18 22:19:25.781966 2026] [:error] [pid 32678:tid 32728] [client 52.236.80.95:62602] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/frdyx.php"] [unique_id "aeOS7RUlAXU_ZWUu5y8LAgAAApU"]
[Sat Apr 18 22:19:26.553565 2026] [:error] [pid 9865:tid 9958] [client 52.236.80.95:64582] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/frdyx.php"] [unique_id "aeOS7qzb5knECIY-C-icUwAAAJU"]
[Sat Apr 18 22:19:27.315566 2026] [:error] [pid 9865:tid 9945] [client 52.236.80.95:63669] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/frdyx.php"] [unique_id "aeOS76zb5knECIY-C-icVQAAAIg"]
[Sat Apr 18 22:19:28.057794 2026] [:error] [pid 13023:tid 13035] [client 52.236.80.95:65213] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/frdyx.php"] [unique_id "aeOS8P1e7hG8DAeABB8z9AAAAQo"]
[Sat Apr 18 22:19:28.966637 2026] [:error] [pid 9970:tid 9989] [client 52.236.80.95:63126] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsjzs.php"] [unique_id "aeOS8CYdRLRhVmaIMx3XVAAAAM8"]
[Sat Apr 18 22:19:30.032207 2026] [:error] [pid 9970:tid 9998] [client 52.236.80.95:65190] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsjzs.php"] [unique_id "aeOS8iYdRLRhVmaIMx3XVwAAANg"]
[Sat Apr 18 22:19:31.359812 2026] [:error] [pid 13023:tid 13036] [client 52.236.80.95:62623] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsjzs.php"] [unique_id "aeOS8_1e7hG8DAeABB8z_gAAAQs"]
[Sat Apr 18 22:19:33.329440 2026] [:error] [pid 32677:tid 32682] [client 52.236.80.95:63667] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsjzs.php"] [unique_id "aeOS9RngmUE3LdC-wP7rtAAAAkI"]
[Sat Apr 18 22:19:34.408296 2026] [:error] [pid 34290:tid 34326] [client 52.236.80.95:63577] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fwtoa.php"] [unique_id "aeOS9hqX6WpmmAXOBi8pZgAAAcc"]
[Sat Apr 18 22:19:44.098827 2026] [:error] [pid 9865:tid 9950] [client 52.236.80.95:64668] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jvtsa.php"] [unique_id "aeOTAKzb5knECIY-C-icbQAAAI0"]
[Sat Apr 18 22:19:44.878261 2026] [:error] [pid 9864:tid 9924] [client 52.236.80.95:64025] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jvtsa.php"] [unique_id "aeOTAICFeowknfXHM7kuIgAAAFI"]
[Sat Apr 18 22:19:45.958534 2026] [:error] [pid 9970:tid 9976] [client 52.236.80.95:65187] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jvtsa.php"] [unique_id "aeOTASYdRLRhVmaIMx3XcQAAAMI"]
[Sat Apr 18 22:19:47.591366 2026] [:error] [pid 32677:tid 32702] [client 52.236.80.95:64605] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jvtsa.php"] [unique_id "aeOTAxngmUE3LdC-wP7rvAAAAlY"]
[Sat Apr 18 22:19:48.898526 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:65202] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kaduu.php"] [unique_id "aeOTBP1e7hG8DAeABB80JgAAAQE"]
[Sat Apr 18 22:19:50.316883 2026] [:error] [pid 32678:tid 32728] [client 52.236.80.95:64688] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kaduu.php"] [unique_id "aeOTBhUlAXU_ZWUu5y8LCQAAApU"]
[Sat Apr 18 22:19:52.039518 2026] [:error] [pid 32677:tid 32685] [client 52.236.80.95:62110] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kaduu.php"] [unique_id "aeOTCBngmUE3LdC-wP7rwAAAAkU"]
[Sat Apr 18 22:19:53.772873 2026] [:error] [pid 32678:tid 32707] [client 52.236.80.95:63120] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kaduu.php"] [unique_id "aeOTCRUlAXU_ZWUu5y8LCgAAAoA"]
[Sat Apr 18 22:19:54.821126 2026] [:error] [pid 13023:tid 13031] [client 52.236.80.95:63164] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kagug.php"] [unique_id "aeOTCv1e7hG8DAeABB80NwAAAQY"]
[Sat Apr 18 22:19:56.197652 2026] [:error] [pid 13023:tid 13040] [client 52.236.80.95:63979] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kagug.php"] [unique_id "aeOTDP1e7hG8DAeABB80PgAAAQ8"]
[Sat Apr 18 22:19:58.262825 2026] [:error] [pid 32678:tid 32712] [client 52.236.80.95:65140] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kagug.php"] [unique_id "aeOTDhUlAXU_ZWUu5y8LDQAAAoU"]
[Sat Apr 18 22:20:00.100248 2026] [:error] [pid 13023:tid 13025] [client 52.236.80.95:64586] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kagug.php"] [unique_id "aeOTEP1e7hG8DAeABB80RwAAAQA"]
[Sat Apr 18 22:20:01.372514 2026] [:error] [pid 34290:tid 34320] [client 52.236.80.95:6190] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kandw.php"] [unique_id "aeOTERqX6WpmmAXOBi8pawAAAcE"]
[Sat Apr 18 22:20:02.092458 2026] [:error] [pid 9970:tid 9993] [client 52.236.80.95:62025] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kandw.php"] [unique_id "aeOTEiYdRLRhVmaIMx3XgQAAANM"]
[Sat Apr 18 22:20:02.799404 2026] [:error] [pid 13023:tid 13025] [client 52.236.80.95:65214] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kandw.php"] [unique_id "aeOTEv1e7hG8DAeABB80UgAAAQA"]
[Sat Apr 18 22:20:03.638603 2026] [:error] [pid 13023:tid 13049] [client 52.236.80.95:63970] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kandw.php"] [unique_id "aeOTE_1e7hG8DAeABB80WAAAARg"]
[Sat Apr 18 22:20:04.423931 2026] [:error] [pid 9970:tid 9994] [client 52.236.80.95:6197] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kduhq.php"] [unique_id "aeOTFCYdRLRhVmaIMx3XhgAAANQ"]
[Sat Apr 18 22:20:05.838198 2026] [:error] [pid 9970:tid 9995] [client 52.236.80.95:65123] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kduhq.php"] [unique_id "aeOTFSYdRLRhVmaIMx3XjwAAANU"]
[Sat Apr 18 22:20:07.044429 2026] [:error] [pid 9864:tid 9925] [client 52.236.80.95:63108] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kduhq.php"] [unique_id "aeOTF4CFeowknfXHM7kuKwAAAFM"]
[Sat Apr 18 22:20:07.674617 2026] [:error] [pid 9864:tid 9917] [client 52.236.80.95:63144] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kduhq.php"] [unique_id "aeOTF4CFeowknfXHM7kuLAAAAEs"]
[Sat Apr 18 22:20:08.561250 2026] [:error] [pid 32678:tid 32731] [client 52.236.80.95:64659] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rgjrq.php"] [unique_id "aeOTGBUlAXU_ZWUu5y8LGgAAApg"]
[Sat Apr 18 22:20:09.442823 2026] [:error] [pid 32677:tid 32701] [client 52.236.80.95:63674] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rgjrq.php"] [unique_id "aeOTGRngmUE3LdC-wP7rxgAAAlU"]
[Sat Apr 18 22:20:10.821777 2026] [:error] [pid 32678:tid 32722] [client 52.236.80.95:62598] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rgjrq.php"] [unique_id "aeOTGhUlAXU_ZWUu5y8LIAAAAo8"]
[Sat Apr 18 22:20:11.612399 2026] [:error] [pid 32678:tid 32729] [client 52.236.80.95:61433] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rgjrq.php"] [unique_id "aeOTGxUlAXU_ZWUu5y8LIQAAApY"]
[Sat Apr 18 22:20:13.741104 2026] [:error] [pid 13023:tid 13048] [client 52.236.80.95:63044] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vopxx.php"] [unique_id "aeOTHf1e7hG8DAeABB80XwAAARc"]
[Sat Apr 18 22:20:15.216322 2026] [:error] [pid 32677:tid 32704] [client 52.236.80.95:63153] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vopxx.php"] [unique_id "aeOTHxngmUE3LdC-wP7rzQAAAlg"]
[Sat Apr 18 22:20:16.038979 2026] [:error] [pid 9970:tid 9979] [client 52.236.80.95:65143] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vopxx.php"] [unique_id "aeOTICYdRLRhVmaIMx3XlgAAAMU"]
[Sat Apr 18 22:20:17.278840 2026] [:error] [pid 34290:tid 34342] [client 52.236.80.95:64664] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vopxx.php"] [unique_id "aeOTIRqX6WpmmAXOBi8pcwAAAdc"]
[Sat Apr 18 22:20:18.351770 2026] [:error] [pid 13023:tid 13042] [client 52.236.80.95:63653] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wcoiw.php"] [unique_id "aeOTIv1e7hG8DAeABB80YQAAARE"]
[Sat Apr 18 22:20:19.345929 2026] [:error] [pid 13023:tid 13027] [client 52.236.80.95:63073] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wcoiw.php"] [unique_id "aeOTI_1e7hG8DAeABB80ZQAAAQI"]
[Sat Apr 18 22:20:20.521123 2026] [:error] [pid 13023:tid 13038] [client 52.236.80.95:62626] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wcoiw.php"] [unique_id "aeOTJP1e7hG8DAeABB80cQAAAQ0"]
[Sat Apr 18 22:20:21.344085 2026] [:error] [pid 13023:tid 13028] [client 52.236.80.95:63649] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wcoiw.php"] [unique_id "aeOTJf1e7hG8DAeABB80eAAAAQM"]
[Sat Apr 18 22:20:22.131541 2026] [:error] [pid 32647:tid 32658] [client 52.236.80.95:64010] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtogs.php"] [unique_id "aeOTJkkxooM0iRo6e54uWwAAAgg"]
[Sat Apr 18 22:20:22.743822 2026] [:error] [pid 13023:tid 13047] [client 52.236.80.95:65171] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtogs.php"] [unique_id "aeOTJv1e7hG8DAeABB80fgAAARY"]
[Sat Apr 18 22:20:23.552635 2026] [:error] [pid 13023:tid 13044] [client 52.236.80.95:63586] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtogs.php"] [unique_id "aeOTJ_1e7hG8DAeABB80hAAAARM"]
[Sat Apr 18 22:20:24.651880 2026] [:error] [pid 9970:tid 9989] [client 52.236.80.95:64020] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtogs.php"] [unique_id "aeOTKCYdRLRhVmaIMx3XnAAAAM8"]
[Sat Apr 18 22:20:25.504085 2026] [:error] [pid 34290:tid 34319] [client 52.236.80.95:63623] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xbbih.php"] [unique_id "aeOTKRqX6WpmmAXOBi8pdgAAAcA"]
[Sat Apr 18 22:20:28.831035 2026] [:error] [pid 13023:tid 13029] [client 52.236.80.95:63584] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xbbih.php"] [unique_id "aeOTLP1e7hG8DAeABB80jAAAAQQ"]
[Sat Apr 18 22:20:29.678516 2026] [:error] [pid 13023:tid 13038] [client 52.236.80.95:64604] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xbbih.php"] [unique_id "aeOTLf1e7hG8DAeABB80jgAAAQ0"]
[Sat Apr 18 22:20:31.543199 2026] [:error] [pid 13023:tid 13037] [client 52.236.80.95:63937] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xbbih.php"] [unique_id "aeOTL_1e7hG8DAeABB80lwAAAQw"]
[Sat Apr 18 22:20:32.488835 2026] [:error] [pid 32647:tid 32662] [client 52.236.80.95:61411] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xcakx.php"] [unique_id "aeOTMEkxooM0iRo6e54uYQAAAgw"]
[Sat Apr 18 22:20:33.297606 2026] [:error] [pid 9863:tid 9894] [client 52.236.80.95:62083] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xcakx.php"] [unique_id "aeOTMTjjiypiFrTucbLXIAAAABU"]
[Sat Apr 18 22:20:34.080332 2026] [:error] [pid 34288:tid 34315] [client 52.236.80.95:63608] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xcakx.php"] [unique_id "aeOTMuTIiy__PtiLmpnbtQAAAZc"]
[Sat Apr 18 22:20:34.758181 2026] [:error] [pid 34290:tid 34342] [client 52.236.80.95:62586] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xcakx.php"] [unique_id "aeOTMhqX6WpmmAXOBi8pgAAAAdc"]
[Sat Apr 18 22:20:35.424348 2026] [:error] [pid 13023:tid 13046] [client 52.236.80.95:64061] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xjgdw.php"] [unique_id "aeOTM_1e7hG8DAeABB80mwAAARU"]
[Sat Apr 18 22:20:36.021120 2026] [:error] [pid 13023:tid 13028] [client 52.236.80.95:64621] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xjgdw.php"] [unique_id "aeOTNP1e7hG8DAeABB80oQAAAQM"]
[Sat Apr 18 22:20:36.653702 2026] [:error] [pid 9970:tid 9991] [client 52.236.80.95:63953] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xjgdw.php"] [unique_id "aeOTNCYdRLRhVmaIMx3XrwAAANE"]
[Sat Apr 18 22:20:37.261684 2026] [:error] [pid 9970:tid 9981] [client 52.236.80.95:62553] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xjgdw.php"] [unique_id "aeOTNSYdRLRhVmaIMx3XtQAAAMc"]
[Sat Apr 18 22:20:37.810473 2026] [:error] [pid 9970:tid 9985] [client 52.236.80.95:64059] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xopgt.php"] [unique_id "aeOTNSYdRLRhVmaIMx3XuwAAAMs"]
[Sat Apr 18 22:20:38.442225 2026] [:error] [pid 32678:tid 32716] [client 52.236.80.95:63981] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xopgt.php"] [unique_id "aeOTNhUlAXU_ZWUu5y8LOgAAAok"]
[Sat Apr 18 22:20:39.089182 2026] [:error] [pid 9864:tid 9916] [client 52.236.80.95:63613] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xopgt.php"] [unique_id "aeOTN4CFeowknfXHM7kuQgAAAEo"]
[Sat Apr 18 22:20:40.001605 2026] [:error] [pid 9970:tid 9996] [client 52.236.80.95:62550] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xopgt.php"] [unique_id "aeOTOCYdRLRhVmaIMx3XwwAAANY"]
[Sat Apr 18 22:20:40.758869 2026] [:error] [pid 9970:tid 9990] [client 52.236.80.95:64597] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsjtz.php"] [unique_id "aeOTOCYdRLRhVmaIMx3XxQAAANA"]
[Sat Apr 18 22:20:41.373770 2026] [:error] [pid 32647:tid 32661] [client 52.236.80.95:63954] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsjtz.php"] [unique_id "aeOTOUkxooM0iRo6e54uZwAAAgs"]
[Sat Apr 18 22:20:41.994277 2026] [:error] [pid 9970:tid 9992] [client 52.236.80.95:64050] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xsjtz.php"] [unique_id "aeOTOSYdRLRhVmaIMx3XyAAAANI"]
[Sat Apr 18 22:20:52.362941 2026] [:error] [pid 34288:tid 34314] [client 52.236.80.95:63129] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fetch.php"] [unique_id "aeOTROTIiy__PtiLmpnbxQAAAZY"]
[Sat Apr 18 22:20:52.946921 2026] [:error] [pid 9970:tid 9987] [client 52.236.80.95:61449] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fetch.php"] [unique_id "aeOTRCYdRLRhVmaIMx3X4AAAAM0"]
[Sat Apr 18 22:20:54.151191 2026] [:error] [pid 32678:tid 32710] [client 52.236.80.95:65185] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fetch.php"] [unique_id "aeOTRhUlAXU_ZWUu5y8LRgAAAoM"]
[Sat Apr 18 22:20:54.733111 2026] [:error] [pid 32647:tid 32650] [client 52.236.80.95:64042] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fetch.php"] [unique_id "aeOTRkkxooM0iRo6e54udQAAAgA"]
[Sat Apr 18 22:20:56.150367 2026] [:error] [pid 32677:tid 32704] [client 52.236.80.95:62556] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jnhddqyz.php"] [unique_id "aeOTSBngmUE3LdC-wP7r4AAAAlg"]
[Sat Apr 18 22:20:56.816745 2026] [:error] [pid 32678:tid 32731] [client 52.236.80.95:63600] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jnhddqyz.php"] [unique_id "aeOTSBUlAXU_ZWUu5y8LSAAAApg"]
[Sat Apr 18 22:20:57.655567 2026] [:error] [pid 32678:tid 32723] [client 52.236.80.95:64062] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jnhddqyz.php"] [unique_id "aeOTSRUlAXU_ZWUu5y8LTwAAApA"]
[Sat Apr 18 22:20:58.318471 2026] [:error] [pid 9970:tid 9991] [client 52.236.80.95:63641] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jnhddqyz.php"] [unique_id "aeOTSiYdRLRhVmaIMx3X-wAAANE"]
[Sat Apr 18 22:20:58.909278 2026] [:error] [pid 9970:tid 9981] [client 52.236.80.95:61469] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin_bkp.php"] [unique_id "aeOTSiYdRLRhVmaIMx3YBAAAAMc"]
[Sat Apr 18 22:20:59.511728 2026] [:error] [pid 32678:tid 32712] [client 52.236.80.95:63104] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin_bkp.php"] [unique_id "aeOTSxUlAXU_ZWUu5y8LWAAAAoU"]
[Sat Apr 18 22:21:00.025982 2026] [:error] [pid 34290:tid 34327] [client 52.236.80.95:62593] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin_bkp.php"] [unique_id "aeOTTBqX6WpmmAXOBi8pjwAAAcg"]
[Sat Apr 18 22:21:00.576805 2026] [:error] [pid 9970:tid 9979] [client 52.236.80.95:63637] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin_bkp.php"] [unique_id "aeOTTCYdRLRhVmaIMx3YEAAAAMU"]
[Sat Apr 18 22:21:01.286681 2026] [:error] [pid 9864:tid 9906] [client 52.236.80.95:6171] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/l10n.php"] [unique_id "aeOTTYCFeowknfXHM7kuUAAAAEE"]
[Sat Apr 18 22:21:01.842004 2026] [:error] [pid 13023:tid 13039] [client 52.236.80.95:64001] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/l10n.php"] [unique_id "aeOTTf1e7hG8DAeABB80vAAAAQ4"]
[Sat Apr 18 22:21:02.427418 2026] [:error] [pid 32677:tid 32691] [client 52.236.80.95:62086] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/l10n.php"] [unique_id "aeOTThngmUE3LdC-wP7r4gAAAks"]
[Sat Apr 18 22:21:02.962305 2026] [:error] [pid 32677:tid 32680] [client 52.236.80.95:63611] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/l10n.php"] [unique_id "aeOTThngmUE3LdC-wP7r4wAAAkA"]
[Sat Apr 18 22:21:03.673453 2026] [:error] [pid 32677:tid 32697] [client 52.236.80.95:62060] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abpxrnwe.php"] [unique_id "aeOTTxngmUE3LdC-wP7r5QAAAlE"]
[Sat Apr 18 22:21:04.280288 2026] [:error] [pid 9865:tid 9956] [client 52.236.80.95:63110] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abpxrnwe.php"] [unique_id "aeOTUKzb5knECIY-C-ictAAAAJM"]
[Sat Apr 18 22:21:04.837528 2026] [:error] [pid 9865:tid 9949] [client 52.236.80.95:65090] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abpxrnwe.php"] [unique_id "aeOTUKzb5knECIY-C-ictwAAAIw"]
[Sat Apr 18 22:21:05.395510 2026] [:error] [pid 9865:tid 9939] [client 52.236.80.95:63118] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abpxrnwe.php"] [unique_id "aeOTUazb5knECIY-C-icugAAAII"]
[Sat Apr 18 22:21:06.198831 2026] [:error] [pid 9970:tid 9983] [client 52.236.80.95:64613] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abalqdol.php"] [unique_id "aeOTUiYdRLRhVmaIMx3YGQAAAMk"]
[Sat Apr 18 22:21:06.782341 2026] [:error] [pid 9970:tid 9977] [client 52.236.80.95:65103] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abalqdol.php"] [unique_id "aeOTUiYdRLRhVmaIMx3YGgAAAMM"]
[Sat Apr 18 22:21:07.589899 2026] [:error] [pid 13023:tid 13025] [client 52.236.80.95:63609] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abalqdol.php"] [unique_id "aeOTU_1e7hG8DAeABB80wAAAAQA"]
[Sat Apr 18 22:21:08.165000 2026] [:error] [pid 32647:tid 32652] [client 52.236.80.95:63605] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abalqdol.php"] [unique_id "aeOTVEkxooM0iRo6e54ueAAAAgI"]
[Sat Apr 18 22:21:08.695604 2026] [:error] [pid 13023:tid 13042] [client 52.236.80.95:63987] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aqotrjkg.php"] [unique_id "aeOTVP1e7hG8DAeABB80wgAAARE"]
[Sat Apr 18 22:21:09.329084 2026] [:error] [pid 9865:tid 9938] [client 52.236.80.95:62570] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aqotrjkg.php"] [unique_id "aeOTVazb5knECIY-C-icvQAAAIE"]
[Sat Apr 18 22:21:09.948136 2026] [:error] [pid 32677:tid 32688] [client 52.236.80.95:6148] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aqotrjkg.php"] [unique_id "aeOTVRngmUE3LdC-wP7r6gAAAkg"]
[Sat Apr 18 22:21:10.626935 2026] [:error] [pid 32677:tid 32702] [client 52.236.80.95:64607] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aqotrjkg.php"] [unique_id "aeOTVhngmUE3LdC-wP7r7QAAAlY"]
[Sat Apr 18 22:21:11.291384 2026] [:error] [pid 32677:tid 32693] [client 52.236.80.95:64629] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bhigtouj.php"] [unique_id "aeOTVxngmUE3LdC-wP7r7gAAAk0"]
[Sat Apr 18 22:21:11.842780 2026] [:error] [pid 32677:tid 32701] [client 52.236.80.95:64603] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bhigtouj.php"] [unique_id "aeOTVxngmUE3LdC-wP7r8AAAAlU"]
[Sat Apr 18 22:21:12.415462 2026] [:error] [pid 9865:tid 9939] [client 52.236.80.95:65183] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bhigtouj.php"] [unique_id "aeOTWKzb5knECIY-C-icvwAAAII"]
[Sat Apr 18 22:21:12.951516 2026] [:error] [pid 9970:tid 9997] [client 52.236.80.95:63940] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bhigtouj.php"] [unique_id "aeOTWCYdRLRhVmaIMx3YKQAAANc"]
[Sat Apr 18 22:21:13.880143 2026] [:error] [pid 9865:tid 9957] [client 52.236.80.95:63575] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bxhnfdgd.php"] [unique_id "aeOTWazb5knECIY-C-icxAAAAJQ"]
[Sat Apr 18 22:21:14.602949 2026] [:error] [pid 13023:tid 13040] [client 52.236.80.95:63070] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bxhnfdgd.php"] [unique_id "aeOTWv1e7hG8DAeABB80xAAAAQ8"]
[Sat Apr 18 22:21:15.360679 2026] [:error] [pid 13023:tid 13045] [client 52.236.80.95:63966] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bxhnfdgd.php"] [unique_id "aeOTW_1e7hG8DAeABB80xwAAARQ"]
[Sat Apr 18 22:21:15.866697 2026] [:error] [pid 34288:tid 34305] [client 52.236.80.95:63147] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bxhnfdgd.php"] [unique_id "aeOTW-TIiy__PtiLmpnbyQAAAY0"]
[Sat Apr 18 22:21:16.496010 2026] [:error] [pid 13023:tid 13049] [client 52.236.80.95:63651] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccrheegr.php"] [unique_id "aeOTXP1e7hG8DAeABB80zAAAARg"]
[Sat Apr 18 22:21:16.996363 2026] [:error] [pid 13023:tid 13027] [client 52.236.80.95:63964] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccrheegr.php"] [unique_id "aeOTXP1e7hG8DAeABB800AAAAQI"]
[Sat Apr 18 22:21:17.555780 2026] [:error] [pid 9970:tid 9982] [client 52.236.80.95:63102] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccrheegr.php"] [unique_id "aeOTXSYdRLRhVmaIMx3YLgAAAMg"]
[Sat Apr 18 22:21:18.060200 2026] [:error] [pid 13023:tid 13036] [client 52.236.80.95:65174] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccrheegr.php"] [unique_id "aeOTXv1e7hG8DAeABB801gAAAQs"]
[Sat Apr 18 22:21:18.716448 2026] [:error] [pid 13023:tid 13040] [client 52.236.80.95:63049] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ckmtelzy.php"] [unique_id "aeOTXv1e7hG8DAeABB802QAAAQ8"]
[Sat Apr 18 22:21:19.304710 2026] [:error] [pid 13023:tid 13028] [client 52.236.80.95:62618] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ckmtelzy.php"] [unique_id "aeOTX_1e7hG8DAeABB803gAAAQM"]
[Sat Apr 18 22:21:19.884082 2026] [:error] [pid 32678:tid 32712] [client 52.236.80.95:64678] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ckmtelzy.php"] [unique_id "aeOTXxUlAXU_ZWUu5y8LXQAAAoU"]
[Sat Apr 18 22:21:20.405101 2026] [:error] [pid 13023:tid 13027] [client 52.236.80.95:64047] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ckmtelzy.php"] [unique_id "aeOTYP1e7hG8DAeABB804wAAAQI"]
[Sat Apr 18 22:21:20.975125 2026] [:error] [pid 32647:tid 32669] [client 52.236.80.95:60635] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggddssvl.php"] [unique_id "aeOTYEkxooM0iRo6e54ueQAAAhM"]
[Sat Apr 18 22:21:21.852437 2026] [:error] [pid 9864:tid 9923] [client 52.236.80.95:60170] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggddssvl.php"] [unique_id "aeOTYYCFeowknfXHM7kuVwAAAFE"]
[Sat Apr 18 22:21:22.637725 2026] [:error] [pid 34288:tid 34295] [client 52.236.80.95:64042] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggddssvl.php"] [unique_id "aeOTYuTIiy__PtiLmpnbygAAAYM"]
[Sat Apr 18 22:21:23.171918 2026] [:error] [pid 32647:tid 32674] [client 52.236.80.95:65124] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggddssvl.php"] [unique_id "aeOTY0kxooM0iRo6e54ufwAAAhg"]
[Sat Apr 18 22:21:23.829356 2026] [:error] [pid 34290:tid 34333] [client 52.236.80.95:63948] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ovajckrrj.php"] [unique_id "aeOTYxqX6WpmmAXOBi8plgAAAc4"]
[Sat Apr 18 22:21:24.428113 2026] [:error] [pid 34290:tid 34341] [client 52.236.80.95:65178] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ovajckrrj.php"] [unique_id "aeOTZBqX6WpmmAXOBi8pmgAAAdY"]
[Sat Apr 18 22:21:25.026002 2026] [:error] [pid 9864:tid 9922] [client 52.236.80.95:63115] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ovajckrrj.php"] [unique_id "aeOTZYCFeowknfXHM7kuXAAAAFA"]
[Sat Apr 18 22:21:25.673579 2026] [:error] [pid 32647:tid 32660] [client 52.236.80.95:65156] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ovajckrrj.php"] [unique_id "aeOTZUkxooM0iRo6e54uhgAAAgo"]
[Sat Apr 18 22:21:26.373893 2026] [:error] [pid 13023:tid 13045] [client 52.236.80.95:62092] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ovajelmxf.php"] [unique_id "aeOTZv1e7hG8DAeABB806AAAARQ"]
[Sat Apr 18 22:21:27.081788 2026] [:error] [pid 9970:tid 9976] [client 52.236.80.95:64702] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ovajelmxf.php"] [unique_id "aeOTZyYdRLRhVmaIMx3YMwAAAMI"]
[Sat Apr 18 22:21:27.606229 2026] [:error] [pid 32677:tid 32701] [client 52.236.80.95:65205] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ovajelmxf.php"] [unique_id "aeOTZxngmUE3LdC-wP7r-wAAAlU"]
[Sat Apr 18 22:21:28.167577 2026] [:error] [pid 32677:tid 32685] [client 52.236.80.95:64683] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ovajelmxf.php"] [unique_id "aeOTaBngmUE3LdC-wP7r_QAAAkU"]
[Sat Apr 18 22:21:28.829062 2026] [:error] [pid 32677:tid 32692] [client 52.236.80.95:64652] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ovajkgsbb.php"] [unique_id "aeOTaBngmUE3LdC-wP7sAAAAAkw"]
[Sat Apr 18 22:21:29.634568 2026] [:error] [pid 13023:tid 13037] [client 52.236.80.95:65212] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ovajkgsbb.php"] [unique_id "aeOTaf1e7hG8DAeABB807AAAAQw"]
[Sat Apr 18 22:21:30.217639 2026] [:error] [pid 9865:tid 9959] [client 52.236.80.95:61443] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ovajkgsbb.php"] [unique_id "aeOTaqzb5knECIY-C-icyAAAAJY"]
[Sat Apr 18 22:21:30.753927 2026] [:error] [pid 9865:tid 9960] [client 52.236.80.95:62103] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ovajkgsbb.php"] [unique_id "aeOTaqzb5knECIY-C-icygAAAJc"]
[Sat Apr 18 22:21:31.284839 2026] [:error] [pid 13023:tid 13036] [client 52.236.80.95:6160] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/erty.php"] [unique_id "aeOTa_1e7hG8DAeABB808wAAAQs"]
[Sat Apr 18 22:21:31.822976 2026] [:error] [pid 34290:tid 34337] [client 52.236.80.95:63603] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/erty.php"] [unique_id "aeOTaxqX6WpmmAXOBi8pnwAAAdI"]
[Sat Apr 18 22:21:32.361393 2026] [:error] [pid 9865:tid 9948] [client 52.236.80.95:64590] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/erty.php"] [unique_id "aeOTbKzb5knECIY-C-iczgAAAIs"]
[Sat Apr 18 22:21:33.000043 2026] [:error] [pid 9864:tid 9913] [client 52.236.80.95:61381] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/erty.php"] [unique_id "aeOTbICFeowknfXHM7kuYQAAAEc"]
[Sat Apr 18 22:21:33.576107 2026] [:error] [pid 34288:tid 34303] [client 52.236.80.95:63156] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aeOTbeTIiy__PtiLmpnbzQAAAYs"]
[Sat Apr 18 22:21:34.194441 2026] [:error] [pid 9864:tid 9924] [client 52.236.80.95:63997] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aeOTboCFeowknfXHM7kuZAAAAFI"]
[Sat Apr 18 22:21:34.788677 2026] [:error] [pid 34288:tid 34310] [client 52.236.80.95:63052] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aeOTbuTIiy__PtiLmpnbzgAAAZI"]
[Sat Apr 18 22:21:35.520379 2026] [:error] [pid 32677:tid 32701] [client 52.236.80.95:62543] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aeOTbxngmUE3LdC-wP7sDAAAAlU"]
[Sat Apr 18 22:21:36.156157 2026] [:error] [pid 9864:tid 9921] [client 52.236.80.95:62138] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "aeOTcICFeowknfXHM7kuZwAAAE8"]
[Sat Apr 18 22:21:36.800719 2026] [:error] [pid 9863:tid 9888] [client 52.236.80.95:64669] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "aeOTcDjjiypiFrTucbLXOAAAAA8"]
[Sat Apr 18 22:21:37.328067 2026] [:error] [pid 13023:tid 13043] [client 52.236.80.95:62540] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "aeOTcf1e7hG8DAeABB80-wAAARI"]
[Sat Apr 18 22:21:37.882384 2026] [:error] [pid 32677:tid 32695] [client 52.236.80.95:64038] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "aeOTcRngmUE3LdC-wP7sDgAAAk8"]
[Sat Apr 18 22:21:38.382678 2026] [:error] [pid 9865:tid 9940] [client 52.236.80.95:63154] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0xD.php"] [unique_id "aeOTcqzb5knECIY-C-ic0wAAAIM"]
[Sat Apr 18 22:21:38.906550 2026] [:error] [pid 13023:tid 13048] [client 52.236.80.95:61421] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0xD.php"] [unique_id "aeOTcv1e7hG8DAeABB81AQAAARc"]
[Sat Apr 18 22:21:39.449593 2026] [:error] [pid 13023:tid 13046] [client 52.236.80.95:64052] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0xD.php"] [unique_id "aeOTc_1e7hG8DAeABB81BQAAARU"]
[Sat Apr 18 22:21:40.045608 2026] [:error] [pid 34288:tid 34292] [client 52.236.80.95:63122] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0xD.php"] [unique_id "aeOTdOTIiy__PtiLmpnb0QAAAYA"]
[Sat Apr 18 22:21:40.547045 2026] [:error] [pid 13023:tid 13041] [client 52.236.80.95:63973] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gh.php"] [unique_id "aeOTdP1e7hG8DAeABB81DQAAARA"]
[Sat Apr 18 22:21:41.256486 2026] [:error] [pid 13023:tid 13039] [client 52.236.80.95:63131] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gh.php"] [unique_id "aeOTdf1e7hG8DAeABB81EwAAAQ4"]
[Sat Apr 18 22:21:42.012131 2026] [:error] [pid 34290:tid 34339] [client 52.236.80.95:64676] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gh.php"] [unique_id "aeOTdhqX6WpmmAXOBi8pqwAAAdQ"]
[Sat Apr 18 22:21:42.696978 2026] [:error] [pid 9970:tid 9996] [client 52.236.80.95:62034] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gh.php"] [unique_id "aeOTdiYdRLRhVmaIMx3YOwAAANY"]
[Sat Apr 18 22:21:43.241317 2026] [:error] [pid 13023:tid 13041] [client 52.236.80.95:65192] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "aeOTd_1e7hG8DAeABB81HgAAARA"]
[Sat Apr 18 22:21:43.760922 2026] [:error] [pid 13023:tid 13039] [client 52.236.80.95:65194] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "aeOTd_1e7hG8DAeABB81IwAAAQ4"]
[Sat Apr 18 22:21:44.311269 2026] [:error] [pid 9863:tid 9893] [client 52.236.80.95:63140] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "aeOTeDjjiypiFrTucbLXOwAAABQ"]
[Sat Apr 18 22:21:44.827903 2026] [:error] [pid 13023:tid 13032] [client 52.236.80.95:63671] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "aeOTeP1e7hG8DAeABB81KQAAAQc"]
[Sat Apr 18 22:21:45.396670 2026] [:error] [pid 13023:tid 13037] [client 52.236.80.95:63119] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php7"] [unique_id "aeOTef1e7hG8DAeABB81KwAAAQw"]
[Sat Apr 18 22:21:45.933580 2026] [:error] [pid 9863:tid 9886] [client 52.236.80.95:63995] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php7"] [unique_id "aeOTeTjjiypiFrTucbLXPQAAAA0"]
[Sat Apr 18 22:21:46.474865 2026] [:error] [pid 9970:tid 9978] [client 52.236.80.95:64647] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php7"] [unique_id "aeOTeiYdRLRhVmaIMx3YSAAAAMQ"]
[Sat Apr 18 22:21:47.067998 2026] [:error] [pid 9970:tid 9990] [client 52.236.80.95:63969] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php7"] [unique_id "aeOTeyYdRLRhVmaIMx3YTwAAANA"]
[Sat Apr 18 22:21:47.814466 2026] [:error] [pid 32678:tid 32729] [client 52.236.80.95:65173] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xigmltad.php"] [unique_id "aeOTexUlAXU_ZWUu5y8LcwAAApY"]
[Sat Apr 18 22:21:48.797976 2026] [:error] [pid 9970:tid 9989] [client 52.236.80.95:63157] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xigmltad.php"] [unique_id "aeOTfCYdRLRhVmaIMx3YVAAAAM8"]
[Sat Apr 18 22:21:49.543759 2026] [:error] [pid 34288:tid 34316] [client 52.236.80.95:64611] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xigmltad.php"] [unique_id "aeOTfeTIiy__PtiLmpnb1gAAAZg"]
[Sat Apr 18 22:21:50.109095 2026] [:error] [pid 9865:tid 9955] [client 52.236.80.95:60727] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xigmltad.php"] [unique_id "aeOTfqzb5knECIY-C-ic2wAAAJI"]
[Sat Apr 18 22:21:50.652051 2026] [:error] [pid 32678:tid 32717] [client 52.236.80.95:63949] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lb.php"] [unique_id "aeOTfhUlAXU_ZWUu5y8LfAAAAoo"]
[Sat Apr 18 22:22:00.172909 2026] [:error] [pid 32678:tid 32715] [client 52.236.80.95:63155] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uujuu.php"] [unique_id "aeOTiBUlAXU_ZWUu5y8LlQAAAog"]
[Sat Apr 18 22:22:00.705723 2026] [:error] [pid 13023:tid 13028] [client 52.236.80.95:6169] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uujuu.php"] [unique_id "aeOTiP1e7hG8DAeABB81SgAAAQM"]
[Sat Apr 18 22:22:01.284439 2026] [:error] [pid 34290:tid 34341] [client 52.236.80.95:64638] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uujuu.php"] [unique_id "aeOTiRqX6WpmmAXOBi8pwAAAAdY"]
[Sat Apr 18 22:22:01.802162 2026] [:error] [pid 13023:tid 13045] [client 52.236.80.95:63141] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uujuu.php"] [unique_id "aeOTif1e7hG8DAeABB81UQAAARQ"]
[Sat Apr 18 22:22:02.333317 2026] [:error] [pid 9864:tid 9925] [client 52.236.80.95:63132] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wdf.php"] [unique_id "aeOTioCFeowknfXHM7kueQAAAFM"]
[Sat Apr 18 22:22:02.942699 2026] [:error] [pid 34288:tid 34295] [client 52.236.80.95:65101] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wdf.php"] [unique_id "aeOTiuTIiy__PtiLmpnb2AAAAYM"]
[Sat Apr 18 22:22:03.545620 2026] [:error] [pid 34288:tid 34312] [client 52.236.80.95:65127] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wdf.php"] [unique_id "aeOTi-TIiy__PtiLmpnb2wAAAZQ"]
[Sat Apr 18 22:22:04.259492 2026] [:error] [pid 13023:tid 13028] [client 52.236.80.95:59232] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wdf.php"] [unique_id "aeOTjP1e7hG8DAeABB81WAAAAQM"]
[Sat Apr 18 22:22:05.038619 2026] [:error] [pid 13023:tid 13049] [client 52.236.80.95:63678] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aeOTjf1e7hG8DAeABB81XAAAARg"]
[Sat Apr 18 22:22:05.577848 2026] [:error] [pid 13023:tid 13039] [client 52.236.80.95:65162] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aeOTjf1e7hG8DAeABB81XwAAAQ4"]
[Sat Apr 18 22:22:06.230520 2026] [:error] [pid 13023:tid 13040] [client 52.236.80.95:63040] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aeOTjv1e7hG8DAeABB81YwAAAQ8"]
[Sat Apr 18 22:22:06.960508 2026] [:error] [pid 9865:tid 9944] [client 52.236.80.95:62608] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aeOTjqzb5knECIY-C-ic7wAAAIc"]
[Sat Apr 18 22:22:07.524359 2026] [:error] [pid 9970:tid 9989] [client 52.236.80.95:65164] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aeOTjyYdRLRhVmaIMx3YdgAAAM8"]
[Sat Apr 18 22:22:08.024151 2026] [:error] [pid 9864:tid 9923] [client 52.236.80.95:65204] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aeOTkICFeowknfXHM7kugwAAAFE"]
[Sat Apr 18 22:22:08.568542 2026] [:error] [pid 32677:tid 32687] [client 52.236.80.95:64615] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aeOTkBngmUE3LdC-wP7sIQAAAkc"]
[Sat Apr 18 22:22:09.212757 2026] [:error] [pid 32647:tid 32665] [client 52.236.80.95:63945] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aeOTkUkxooM0iRo6e54ungAAAg8"]
[Sat Apr 18 22:22:09.776316 2026] [:error] [pid 9863:tid 9885] [client 52.236.80.95:65168] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zyjhr.php"] [unique_id "aeOTkTjjiypiFrTucbLXSgAAAAw"]
[Sat Apr 18 22:22:10.293085 2026] [:error] [pid 13023:tid 13029] [client 52.236.80.95:63569] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zyjhr.php"] [unique_id "aeOTkv1e7hG8DAeABB81bwAAAQQ"]
[Sat Apr 18 22:22:10.895268 2026] [:error] [pid 9864:tid 9906] [client 52.236.80.95:63109] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zyjhr.php"] [unique_id "aeOTkoCFeowknfXHM7kuhgAAAEE"]
[Sat Apr 18 22:22:11.466296 2026] [:error] [pid 13023:tid 13040] [client 52.236.80.95:65095] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zyjhr.php"] [unique_id "aeOTk_1e7hG8DAeABB81dgAAAQ8"]
[Sat Apr 18 22:22:12.001024 2026] [:error] [pid 32647:tid 32661] [client 52.236.80.95:65169] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b7cdb465.php"] [unique_id "aeOTlEkxooM0iRo6e54uowAAAgs"]
[Sat Apr 18 22:22:12.524551 2026] [:error] [pid 9863:tid 9874] [client 52.236.80.95:65130] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b7cdb465.php"] [unique_id "aeOTlDjjiypiFrTucbLXTQAAAAE"]
[Sat Apr 18 22:22:13.085054 2026] [:error] [pid 34288:tid 34296] [client 52.236.80.95:63566] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b7cdb465.php"] [unique_id "aeOTleTIiy__PtiLmpnb3wAAAYQ"]
[Sat Apr 18 22:22:13.614895 2026] [:error] [pid 32647:tid 32667] [client 52.236.80.95:64691] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b7cdb465.php"] [unique_id "aeOTlUkxooM0iRo6e54upwAAAhE"]
[Sat Apr 18 22:22:14.206638 2026] [:error] [pid 32678:tid 32721] [client 52.236.80.95:63939] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x123.php"] [unique_id "aeOTlhUlAXU_ZWUu5y8LpQAAAo4"]
[Sat Apr 18 22:22:14.790119 2026] [:error] [pid 34288:tid 34306] [client 52.236.80.95:63951] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x123.php"] [unique_id "aeOTluTIiy__PtiLmpnb4AAAAY4"]
[Sat Apr 18 22:22:15.369703 2026] [:error] [pid 9865:tid 9954] [client 52.236.80.95:65114] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x123.php"] [unique_id "aeOTl6zb5knECIY-C-ic9AAAAJE"]
[Sat Apr 18 22:22:16.006797 2026] [:error] [pid 32678:tid 32716] [client 52.236.80.95:63968] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x123.php"] [unique_id "aeOTmBUlAXU_ZWUu5y8LrwAAAok"]
[Sat Apr 18 22:22:16.534581 2026] [:error] [pid 9865:tid 9942] [client 52.236.80.95:63160] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/trx24.php"] [unique_id "aeOTmKzb5knECIY-C-ic9gAAAIU"]
[Sat Apr 18 22:22:17.123164 2026] [:error] [pid 9863:tid 9895] [client 52.236.80.95:62582] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/trx24.php"] [unique_id "aeOTmTjjiypiFrTucbLXTwAAABY"]
[Sat Apr 18 22:22:17.681637 2026] [:error] [pid 9970:tid 9978] [client 52.236.80.95:63604] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/trx24.php"] [unique_id "aeOTmSYdRLRhVmaIMx3YhQAAAMQ"]
[Sat Apr 18 22:22:18.303348 2026] [:error] [pid 13023:tid 13045] [client 52.236.80.95:63943] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/trx24.php"] [unique_id "aeOTmv1e7hG8DAeABB81ggAAARQ"]
[Sat Apr 18 22:22:18.933556 2026] [:error] [pid 13023:tid 13040] [client 52.236.80.95:65182] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lp5.php"] [unique_id "aeOTmv1e7hG8DAeABB81iQAAAQ8"]
[Sat Apr 18 22:22:19.475278 2026] [:error] [pid 32677:tid 32698] [client 52.236.80.95:63976] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lp5.php"] [unique_id "aeOTmxngmUE3LdC-wP7sJgAAAlI"]
[Sat Apr 18 22:22:19.978473 2026] [:error] [pid 9864:tid 9927] [client 52.236.80.95:64640] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lp5.php"] [unique_id "aeOTm4CFeowknfXHM7kuiAAAAFU"]
[Sat Apr 18 22:22:20.615146 2026] [:error] [pid 9970:tid 9974] [client 52.236.80.95:62122] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lp5.php"] [unique_id "aeOTnCYdRLRhVmaIMx3YiAAAAMA"]
[Sat Apr 18 22:22:21.148277 2026] [:error] [pid 9865:tid 9944] [client 52.236.80.95:64639] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws78.php"] [unique_id "aeOTnazb5knECIY-C-ic-wAAAIc"]
[Sat Apr 18 22:22:21.765289 2026] [:error] [pid 9865:tid 9950] [client 52.236.80.95:63055] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws78.php"] [unique_id "aeOTnazb5knECIY-C-ic_wAAAI0"]
[Sat Apr 18 22:22:22.325250 2026] [:error] [pid 34290:tid 34326] [client 52.236.80.95:63640] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws78.php"] [unique_id "aeOTnhqX6WpmmAXOBi8pxgAAAcc"]
[Sat Apr 18 22:22:22.891128 2026] [:error] [pid 9863:tid 9893] [client 52.236.80.95:65091] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws78.php"] [unique_id "aeOTnjjjiypiFrTucbLXVQAAABQ"]
[Sat Apr 18 22:22:23.483495 2026] [:error] [pid 9970:tid 9986] [client 52.236.80.95:60098] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit-tags.php"] [unique_id "aeOTnyYdRLRhVmaIMx3YkQAAAMw"]
[Sat Apr 18 22:22:24.040420 2026] [:error] [pid 9865:tid 9960] [client 52.236.80.95:60612] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit-tags.php"] [unique_id "aeOToKzb5knECIY-C-idAQAAAJc"]
[Sat Apr 18 22:22:24.618312 2026] [:error] [pid 9865:tid 9961] [client 52.236.80.95:65147] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit-tags.php"] [unique_id "aeOToKzb5knECIY-C-idAwAAAJg"]
[Sat Apr 18 22:22:25.149507 2026] [:error] [pid 32678:tid 32709] [client 52.236.80.95:62078] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit-tags.php"] [unique_id "aeOToRUlAXU_ZWUu5y8LwgAAAoI"]
[Sat Apr 18 22:22:25.856854 2026] [:error] [pid 9970:tid 9995] [client 52.236.80.95:65172] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-png.php"] [unique_id "aeOToSYdRLRhVmaIMx3YlgAAANU"]
[Sat Apr 18 22:22:26.481380 2026] [:error] [pid 9865:tid 9942] [client 52.236.80.95:63572] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-png.php"] [unique_id "aeOToqzb5knECIY-C-idBgAAAIU"]
[Sat Apr 18 22:22:27.057859 2026] [:error] [pid 9864:tid 9905] [client 52.236.80.95:64591] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-png.php"] [unique_id "aeOTo4CFeowknfXHM7kukAAAAEA"]
[Sat Apr 18 22:22:27.752350 2026] [:error] [pid 9970:tid 9997] [client 52.236.80.95:60165] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-png.php"] [unique_id "aeOToyYdRLRhVmaIMx3YmwAAANc"]
[Sat Apr 18 22:22:28.343735 2026] [:error] [pid 34288:tid 34305] [client 52.236.80.95:63992] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpc2.php"] [unique_id "aeOTpOTIiy__PtiLmpnb5AAAAY0"]
[Sat Apr 18 22:22:28.888868 2026] [:error] [pid 13023:tid 13034] [client 52.236.80.95:63105] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpc2.php"] [unique_id "aeOTpP1e7hG8DAeABB81jwAAAQk"]
[Sat Apr 18 22:22:29.449285 2026] [:error] [pid 13023:tid 13042] [client 52.236.80.95:63597] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpc2.php"] [unique_id "aeOTpf1e7hG8DAeABB81kQAAARE"]
[Sat Apr 18 22:22:31.113471 2026] [:error] [pid 13023:tid 13028] [client 52.236.80.95:63114] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpc2.php"] [unique_id "aeOTp_1e7hG8DAeABB81lwAAAQM"]
[Sat Apr 18 22:22:32.087551 2026] [:error] [pid 13023:tid 13044] [client 52.236.80.95:63047] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/intall.php"] [unique_id "aeOTqP1e7hG8DAeABB81ngAAARM"]
[Sat Apr 18 22:22:32.748079 2026] [:error] [pid 32678:tid 32726] [client 52.236.80.95:65211] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/intall.php"] [unique_id "aeOTqBUlAXU_ZWUu5y8LxwAAApM"]
[Sat Apr 18 22:22:33.326130 2026] [:error] [pid 32678:tid 32731] [client 52.236.80.95:64637] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/intall.php"] [unique_id "aeOTqRUlAXU_ZWUu5y8LygAAApg"]
[Sat Apr 18 22:22:33.925716 2026] [:error] [pid 13023:tid 13033] [client 52.236.80.95:65119] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/intall.php"] [unique_id "aeOTqf1e7hG8DAeABB81pAAAAQg"]
[Sat Apr 18 22:22:34.496949 2026] [:error] [pid 32678:tid 32709] [client 52.236.80.95:62572] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "aeOTqhUlAXU_ZWUu5y8L0AAAAoI"]
[Sat Apr 18 22:22:35.130824 2026] [:error] [pid 9970:tid 9985] [client 52.236.80.95:63606] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "aeOTqyYdRLRhVmaIMx3YpgAAAMs"]
[Sat Apr 18 22:22:35.667064 2026] [:error] [pid 9970:tid 9980] [client 52.236.80.95:63999] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "aeOTqyYdRLRhVmaIMx3YqAAAAMY"]
[Sat Apr 18 22:22:36.223126 2026] [:error] [pid 13023:tid 13033] [client 52.236.80.95:64660] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "aeOTrP1e7hG8DAeABB81rAAAAQg"]
[Sat Apr 18 22:22:36.865368 2026] [:error] [pid 13023:tid 13047] [client 52.236.80.95:63675] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/callback.php"] [unique_id "aeOTrP1e7hG8DAeABB81rgAAARY"]
[Sat Apr 18 22:22:37.560833 2026] [:error] [pid 9970:tid 9987] [client 52.236.80.95:60706] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/callback.php"] [unique_id "aeOTrSYdRLRhVmaIMx3YrgAAAM0"]
[Sat Apr 18 22:22:38.108016 2026] [:error] [pid 9864:tid 9906] [client 52.236.80.95:65186] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/callback.php"] [unique_id "aeOTroCFeowknfXHM7kukQAAAEE"]
[Sat Apr 18 22:22:38.801773 2026] [:error] [pid 9865:tid 9938] [client 52.236.80.95:63048] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/callback.php"] [unique_id "aeOTrqzb5knECIY-C-idEAAAAIE"]
[Sat Apr 18 22:22:39.412050 2026] [:error] [pid 34288:tid 34311] [client 52.236.80.95:62112] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "aeOTr-TIiy__PtiLmpnb5wAAAZM"]
[Sat Apr 18 22:22:39.956797 2026] [:error] [pid 9864:tid 9926] [client 52.236.80.95:62048] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "aeOTr4CFeowknfXHM7kulAAAAFQ"]
[Sat Apr 18 22:22:40.623764 2026] [:error] [pid 13023:tid 13048] [client 52.236.80.95:62081] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "aeOTsP1e7hG8DAeABB81swAAARc"]
[Sat Apr 18 22:22:41.183737 2026] [:error] [pid 13023:tid 13046] [client 52.236.80.95:63984] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "aeOTsf1e7hG8DAeABB81tQAAARU"]
[Sat Apr 18 22:22:41.713589 2026] [:error] [pid 13023:tid 13034] [client 52.236.80.95:63994] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abrand.php"] [unique_id "aeOTsf1e7hG8DAeABB81ugAAAQk"]
[Sat Apr 18 22:22:42.233468 2026] [:error] [pid 9865:tid 9961] [client 52.236.80.95:65206] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abrand.php"] [unique_id "aeOTsqzb5knECIY-C-idFQAAAJg"]
[Sat Apr 18 22:22:43.112798 2026] [:error] [pid 9970:tid 9983] [client 52.236.80.95:62546] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abrand.php"] [unique_id "aeOTsyYdRLRhVmaIMx3YuQAAAMk"]
[Sat Apr 18 22:22:43.640858 2026] [:error] [pid 32678:tid 32731] [client 52.236.80.95:63647] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abrand.php"] [unique_id "aeOTsxUlAXU_ZWUu5y8L1wAAApg"]
[Sat Apr 18 22:22:44.171487 2026] [:error] [pid 32678:tid 32713] [client 52.236.80.95:63652] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/camara.php"] [unique_id "aeOTtBUlAXU_ZWUu5y8L2gAAAoY"]
[Sat Apr 18 22:22:44.771532 2026] [:error] [pid 32678:tid 32727] [client 52.236.80.95:63051] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/camara.php"] [unique_id "aeOTtBUlAXU_ZWUu5y8L3gAAApQ"]
[Sat Apr 18 22:22:45.308322 2026] [:error] [pid 32678:tid 32717] [client 52.236.80.95:6147] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/camara.php"] [unique_id "aeOTtRUlAXU_ZWUu5y8L4AAAAoo"]
[Sat Apr 18 22:22:45.824468 2026] [:error] [pid 32678:tid 32724] [client 52.236.80.95:64665] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/camara.php"] [unique_id "aeOTtRUlAXU_ZWUu5y8L4gAAApE"]
[Sat Apr 18 22:22:46.417264 2026] [:error] [pid 9864:tid 9913] [client 52.236.80.95:6200] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assacc.php"] [unique_id "aeOTtoCFeowknfXHM7kumQAAAEc"]
[Sat Apr 18 22:22:47.030959 2026] [:error] [pid 32647:tid 32660] [client 52.236.80.95:64687] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assacc.php"] [unique_id "aeOTt0kxooM0iRo6e54uqwAAAgo"]
[Sat Apr 18 22:22:47.738797 2026] [:error] [pid 9970:tid 9980] [client 52.236.80.95:63111] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assacc.php"] [unique_id "aeOTtyYdRLRhVmaIMx3YwQAAAMY"]
[Sat Apr 18 22:22:48.484739 2026] [:error] [pid 9864:tid 9924] [client 52.236.80.95:64044] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/assacc.php"] [unique_id "aeOTuICFeowknfXHM7kumgAAAFI"]
[Sat Apr 18 22:22:49.297107 2026] [:error] [pid 32647:tid 32664] [client 52.236.80.95:64658] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws83.php"] [unique_id "aeOTuUkxooM0iRo6e54urgAAAg4"]
[Sat Apr 18 22:22:49.919484 2026] [:error] [pid 9865:tid 9960] [client 52.236.80.95:63561] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws83.php"] [unique_id "aeOTuazb5knECIY-C-idGwAAAJc"]
[Sat Apr 18 22:22:50.487743 2026] [:error] [pid 9865:tid 9943] [client 52.236.80.95:63060] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws83.php"] [unique_id "aeOTuqzb5knECIY-C-idHQAAAIY"]
[Sat Apr 18 22:22:51.065826 2026] [:error] [pid 9865:tid 9951] [client 52.236.80.95:62651] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws83.php"] [unique_id "aeOTu6zb5knECIY-C-idIQAAAI4"]
[Sat Apr 18 22:22:51.606698 2026] [:error] [pid 9865:tid 9953] [client 52.236.80.95:60160] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aeOTu6zb5knECIY-C-idJAAAAJA"]
[Sat Apr 18 22:22:52.138114 2026] [:error] [pid 9865:tid 9937] [client 52.236.80.95:63610] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aeOTvKzb5knECIY-C-idKAAAAIA"]
[Sat Apr 18 22:22:52.706180 2026] [:error] [pid 9863:tid 9877] [client 52.236.80.95:64581] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aeOTvDjjiypiFrTucbLXZQAAAAQ"]
[Sat Apr 18 22:22:53.306774 2026] [:error] [pid 9864:tid 9909] [client 52.236.80.95:63128] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aeOTvYCFeowknfXHM7kumwAAAEQ"]
[Sat Apr 18 22:22:54.026251 2026] [:error] [pid 9863:tid 9890] [client 52.236.80.95:64011] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/%E3%81%AE.php"] [unique_id "aeOTvjjjiypiFrTucbLXawAAABE"]
[Sat Apr 18 22:22:54.833203 2026] [:error] [pid 9863:tid 9879] [client 52.236.80.95:64680] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/%E3%81%AE.php"] [unique_id "aeOTvjjjiypiFrTucbLXbAAAAAY"]
[Sat Apr 18 22:22:55.571044 2026] [:error] [pid 32647:tid 32653] [client 52.236.80.95:64608] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/%E3%81%AE.php"] [unique_id "aeOTv0kxooM0iRo6e54uvAAAAgM"]
[Sat Apr 18 22:22:56.197917 2026] [:error] [pid 32678:tid 32711] [client 52.236.80.95:64617] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/%E3%81%AE.php"] [unique_id "aeOTwBUlAXU_ZWUu5y8L6QAAAoQ"]
[Sat Apr 18 22:22:56.768333 2026] [:error] [pid 9865:tid 9950] [client 52.236.80.95:62560] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xtsr.php"] [unique_id "aeOTwKzb5knECIY-C-idLAAAAI0"]
[Sat Apr 18 22:22:57.341650 2026] [:error] [pid 9970:tid 9983] [client 52.236.80.95:65207] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xtsr.php"] [unique_id "aeOTwSYdRLRhVmaIMx3Y0AAAAMk"]
[Sat Apr 18 22:23:06.613483 2026] [:error] [pid 9970:tid 9982] [client 52.236.80.95:64650] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vhwwnrnmqc.php"] [unique_id "aeOTyiYdRLRhVmaIMx3Y9gAAAMg"]
[Sat Apr 18 22:23:07.142416 2026] [:error] [pid 9970:tid 9992] [client 52.236.80.95:63579] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vhwwnrnmqc.php"] [unique_id "aeOTyyYdRLRhVmaIMx3Y9wAAANI"]
[Sat Apr 18 22:23:07.664996 2026] [:error] [pid 9865:tid 9955] [client 52.236.80.95:63573] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vhwwnrnmqc.php"] [unique_id "aeOTy6zb5knECIY-C-idNwAAAJI"]
[Sat Apr 18 22:23:08.190013 2026] [:error] [pid 9865:tid 9948] [client 52.236.80.95:63648] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vhwwnrnmqc.php"] [unique_id "aeOTzKzb5knECIY-C-idOgAAAIs"]
[Sat Apr 18 22:23:08.935920 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:63591] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenium4.php"] [unique_id "aeOTzP1e7hG8DAeABB811wAAAQE"]
[Sat Apr 18 22:23:09.577146 2026] [:error] [pid 9865:tid 9944] [client 52.236.80.95:63045] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenium4.php"] [unique_id "aeOTzazb5knECIY-C-idQQAAAIc"]
[Sat Apr 18 22:23:10.202330 2026] [:error] [pid 9970:tid 9982] [client 52.236.80.95:60694] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenium4.php"] [unique_id "aeOTziYdRLRhVmaIMx3Y_QAAAMg"]
[Sat Apr 18 22:23:10.870672 2026] [:error] [pid 13023:tid 13049] [client 52.236.80.95:62136] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenium4.php"] [unique_id "aeOTzv1e7hG8DAeABB814QAAARg"]
[Sat Apr 18 22:23:11.439144 2026] [:error] [pid 9865:tid 9942] [client 52.236.80.95:63563] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vaza.php"] [unique_id "aeOTz6zb5knECIY-C-idXQAAAIU"]
[Sat Apr 18 22:23:11.993053 2026] [:error] [pid 13023:tid 13031] [client 52.236.80.95:6153] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vaza.php"] [unique_id "aeOTz_1e7hG8DAeABB815wAAAQY"]
[Sat Apr 18 22:23:12.544582 2026] [:error] [pid 13023:tid 13041] [client 52.236.80.95:6202] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vaza.php"] [unique_id "aeOT0P1e7hG8DAeABB816gAAARA"]
[Sat Apr 18 22:23:13.055587 2026] [:error] [pid 13023:tid 13048] [client 52.236.80.95:61450] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vaza.php"] [unique_id "aeOT0f1e7hG8DAeABB817gAAARc"]
[Sat Apr 18 22:23:13.602379 2026] [:error] [pid 9970:tid 9977] [client 52.236.80.95:63117] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8573.php"] [unique_id "aeOT0SYdRLRhVmaIMx3ZCwAAAMM"]
[Sat Apr 18 22:23:14.214531 2026] [:error] [pid 9865:tid 9939] [client 52.236.80.95:62107] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8573.php"] [unique_id "aeOT0qzb5knECIY-C-idcAAAAII"]
[Sat Apr 18 22:23:14.763024 2026] [:error] [pid 34290:tid 34333] [client 52.236.80.95:63083] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8573.php"] [unique_id "aeOT0hqX6WpmmAXOBi8p1wAAAc4"]
[Sat Apr 18 22:23:15.382195 2026] [:error] [pid 9864:tid 9923] [client 52.236.80.95:63165] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8573.php"] [unique_id "aeOT04CFeowknfXHM7kupAAAAFE"]
[Sat Apr 18 22:23:16.022136 2026] [:error] [pid 9970:tid 9987] [client 52.236.80.95:62615] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rip.php"] [unique_id "aeOT1CYdRLRhVmaIMx3ZGAAAAM0"]
[Sat Apr 18 22:23:16.568568 2026] [:error] [pid 32677:tid 32694] [client 52.236.80.95:63982] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rip.php"] [unique_id "aeOT1BngmUE3LdC-wP7sSAAAAk4"]
[Sat Apr 18 22:23:17.393415 2026] [:error] [pid 13023:tid 13035] [client 52.236.80.95:60699] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rip.php"] [unique_id "aeOT1f1e7hG8DAeABB82BAAAAQo"]
[Sat Apr 18 22:23:18.186629 2026] [:error] [pid 32647:tid 32651] [client 52.236.80.95:65106] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rip.php"] [unique_id "aeOT1kkxooM0iRo6e54uyAAAAgE"]
[Sat Apr 18 22:23:18.699493 2026] [:error] [pid 9865:tid 9951] [client 52.236.80.95:64656] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drhunthq.php"] [unique_id "aeOT1qzb5knECIY-C-idhwAAAI4"]
[Sat Apr 18 22:23:19.363923 2026] [:error] [pid 9970:tid 9976] [client 52.236.80.95:62622] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drhunthq.php"] [unique_id "aeOT1yYdRLRhVmaIMx3ZHAAAAMI"]
[Sat Apr 18 22:23:19.864545 2026] [:error] [pid 9865:tid 9952] [client 52.236.80.95:63582] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drhunthq.php"] [unique_id "aeOT16zb5knECIY-C-idiwAAAI8"]
[Sat Apr 18 22:23:20.400498 2026] [:error] [pid 9865:tid 9946] [client 52.236.80.95:63158] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drhunthq.php"] [unique_id "aeOT2Kzb5knECIY-C-idjQAAAIk"]
[Sat Apr 18 22:23:20.905764 2026] [:error] [pid 13023:tid 13035] [client 52.236.80.95:60614] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aeOT2P1e7hG8DAeABB82DQAAAQo"]
[Sat Apr 18 22:23:21.602837 2026] [:error] [pid 32678:tid 32727] [client 52.236.80.95:63556] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aeOT2RUlAXU_ZWUu5y8L-gAAApQ"]
[Sat Apr 18 22:23:22.246531 2026] [:error] [pid 34288:tid 34294] [client 52.236.80.95:65185] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aeOT2uTIiy__PtiLmpnb7gAAAYI"]
[Sat Apr 18 22:23:22.806784 2026] [:error] [pid 9863:tid 9877] [client 52.236.80.95:64694] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aeOT2jjjiypiFrTucbLXcwAAAAQ"]
[Sat Apr 18 22:23:23.309885 2026] [:error] [pid 32677:tid 32685] [client 52.236.80.95:63585] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hots.php"] [unique_id "aeOT2xngmUE3LdC-wP7sTgAAAkU"]
[Sat Apr 18 22:23:23.870646 2026] [:error] [pid 34290:tid 34339] [client 52.236.80.95:64035] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hots.php"] [unique_id "aeOT2xqX6WpmmAXOBi8p2wAAAdQ"]
[Sat Apr 18 22:23:24.561350 2026] [:error] [pid 34290:tid 34337] [client 52.236.80.95:64041] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hots.php"] [unique_id "aeOT3BqX6WpmmAXOBi8p3gAAAdI"]
[Sat Apr 18 22:23:25.187679 2026] [:error] [pid 9970:tid 9990] [client 52.236.80.95:63589] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hots.php"] [unique_id "aeOT3SYdRLRhVmaIMx3ZKQAAANA"]
[Sat Apr 18 22:23:25.954202 2026] [:error] [pid 9970:tid 9984] [client 52.236.80.95:64692] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aeOT3SYdRLRhVmaIMx3ZLQAAAMo"]
[Sat Apr 18 22:23:26.583324 2026] [:error] [pid 9970:tid 9976] [client 52.236.80.95:63622] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aeOT3iYdRLRhVmaIMx3ZNQAAAMI"]
[Sat Apr 18 22:23:27.121534 2026] [:error] [pid 32677:tid 32680] [client 52.236.80.95:65138] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aeOT3xngmUE3LdC-wP7sVAAAAkA"]
[Sat Apr 18 22:23:27.704537 2026] [:error] [pid 32678:tid 32720] [client 52.236.80.95:62647] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aeOT3xUlAXU_ZWUu5y8L_QAAAo0"]
[Sat Apr 18 22:23:28.335045 2026] [:error] [pid 32647:tid 32662] [client 52.236.80.95:6179] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "aeOT4EkxooM0iRo6e54uzQAAAgw"]
[Sat Apr 18 22:23:28.974533 2026] [:error] [pid 34288:tid 34302] [client 52.236.80.95:6188] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "aeOT4OTIiy__PtiLmpnb9QAAAYo"]
[Sat Apr 18 22:23:29.725468 2026] [:error] [pid 32677:tid 32703] [client 52.236.80.95:63050] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "aeOT4RngmUE3LdC-wP7sWwAAAlc"]
[Sat Apr 18 22:23:30.339030 2026] [:error] [pid 32647:tid 32671] [client 52.236.80.95:61427] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "aeOT4kkxooM0iRo6e54uzwAAAhU"]
[Sat Apr 18 22:23:30.941354 2026] [:error] [pid 9863:tid 9879] [client 52.236.80.95:63588] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/c4.php"] [unique_id "aeOT4jjjiypiFrTucbLXegAAAAY"]
[Sat Apr 18 22:23:31.540802 2026] [:error] [pid 32647:tid 32664] [client 52.236.80.95:64017] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/c4.php"] [unique_id "aeOT40kxooM0iRo6e54u0gAAAg4"]
[Sat Apr 18 22:23:32.412101 2026] [:error] [pid 34288:tid 34301] [client 52.236.80.95:64672] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/c4.php"] [unique_id "aeOT5OTIiy__PtiLmpnb9wAAAYk"]
[Sat Apr 18 22:23:32.957962 2026] [:error] [pid 34288:tid 34316] [client 52.236.80.95:6192] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/c4.php"] [unique_id "aeOT5OTIiy__PtiLmpnb-AAAAZg"]
[Sat Apr 18 22:23:33.601740 2026] [:error] [pid 9864:tid 9925] [client 52.236.80.95:63598] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lclnqiii.php"] [unique_id "aeOT5YCFeowknfXHM7kurQAAAFM"]
[Sat Apr 18 22:23:34.152348 2026] [:error] [pid 9864:tid 9920] [client 52.236.80.95:63555] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lclnqiii.php"] [unique_id "aeOT5oCFeowknfXHM7kurgAAAE4"]
[Sat Apr 18 22:23:34.933123 2026] [:error] [pid 32678:tid 32714] [client 52.236.80.95:6194] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lclnqiii.php"] [unique_id "aeOT5hUlAXU_ZWUu5y8MAQAAAoc"]
[Sat Apr 18 22:23:35.479198 2026] [:error] [pid 9865:tid 9941] [client 52.236.80.95:65153] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lclnqiii.php"] [unique_id "aeOT56zb5knECIY-C-idmQAAAIQ"]
[Sat Apr 18 22:23:36.089434 2026] [:error] [pid 9970:tid 9986] [client 52.236.80.95:60625] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat.php"] [unique_id "aeOT6CYdRLRhVmaIMx3ZTAAAAMw"]
[Sat Apr 18 22:23:36.674370 2026] [:error] [pid 13023:tid 13044] [client 52.236.80.95:63663] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat.php"] [unique_id "aeOT6P1e7hG8DAeABB82GwAAARM"]
[Sat Apr 18 22:23:37.176988 2026] [:error] [pid 9970:tid 9989] [client 52.236.80.95:65209] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat.php"] [unique_id "aeOT6SYdRLRhVmaIMx3ZTgAAAM8"]
[Sat Apr 18 22:23:37.743834 2026] [:error] [pid 13023:tid 13042] [client 52.236.80.95:64690] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat.php"] [unique_id "aeOT6f1e7hG8DAeABB82IQAAARE"]
[Sat Apr 18 22:23:38.285571 2026] [:error] [pid 9970:tid 9992] [client 52.236.80.95:63978] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tot.php"] [unique_id "aeOT6iYdRLRhVmaIMx3ZUgAAANI"]
[Sat Apr 18 22:23:38.812783 2026] [:error] [pid 32678:tid 32722] [client 52.236.80.95:64684] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tot.php"] [unique_id "aeOT6hUlAXU_ZWUu5y8MBQAAAo8"]
[Sat Apr 18 22:23:39.382580 2026] [:error] [pid 13023:tid 13025] [client 52.236.80.95:63626] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tot.php"] [unique_id "aeOT6_1e7hG8DAeABB82JAAAAQA"]
[Sat Apr 18 22:23:39.922079 2026] [:error] [pid 32647:tid 32668] [client 52.236.80.95:63557] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tot.php"] [unique_id "aeOT60kxooM0iRo6e54u1gAAAhI"]
[Sat Apr 18 22:23:40.522110 2026] [:error] [pid 32678:tid 32729] [client 52.236.80.95:63656] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tap.php"] [unique_id "aeOT7BUlAXU_ZWUu5y8MCAAAApY"]
[Sat Apr 18 22:23:41.027063 2026] [:error] [pid 32678:tid 32709] [client 52.236.80.95:63631] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tap.php"] [unique_id "aeOT7RUlAXU_ZWUu5y8MDQAAAoI"]
[Sat Apr 18 22:23:41.645117 2026] [:error] [pid 32678:tid 32707] [client 52.236.80.95:63665] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tap.php"] [unique_id "aeOT7RUlAXU_ZWUu5y8MEAAAAoA"]
[Sat Apr 18 22:23:42.281874 2026] [:error] [pid 13023:tid 13040] [client 52.236.80.95:63624] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tap.php"] [unique_id "aeOT7v1e7hG8DAeABB82KAAAAQ8"]
[Sat Apr 18 22:23:42.974470 2026] [:error] [pid 9970:tid 9981] [client 52.236.80.95:63942] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vrhiw.php"] [unique_id "aeOT7iYdRLRhVmaIMx3ZXQAAAMc"]
[Sat Apr 18 22:23:43.544963 2026] [:error] [pid 32678:tid 32729] [client 52.236.80.95:62126] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vrhiw.php"] [unique_id "aeOT7xUlAXU_ZWUu5y8MGAAAApY"]
[Sat Apr 18 22:23:44.044774 2026] [:error] [pid 13023:tid 13031] [client 52.236.80.95:63130] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vrhiw.php"] [unique_id "aeOT8P1e7hG8DAeABB82KQAAAQY"]
[Sat Apr 18 22:23:44.566351 2026] [:error] [pid 9970:tid 9974] [client 52.236.80.95:62058] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vrhiw.php"] [unique_id "aeOT8CYdRLRhVmaIMx3ZZAAAAMA"]
[Sat Apr 18 22:23:45.160179 2026] [:error] [pid 9970:tid 9996] [client 52.236.80.95:62124] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qqjki.php"] [unique_id "aeOT8SYdRLRhVmaIMx3ZZwAAANY"]
[Sat Apr 18 22:23:45.705024 2026] [:error] [pid 32678:tid 32716] [client 52.236.80.95:63975] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qqjki.php"] [unique_id "aeOT8RUlAXU_ZWUu5y8MGwAAAok"]
[Sat Apr 18 22:23:46.322399 2026] [:error] [pid 13023:tid 13035] [client 52.236.80.95:65104] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qqjki.php"] [unique_id "aeOT8v1e7hG8DAeABB82LgAAAQo"]
[Sat Apr 18 22:23:46.856590 2026] [:error] [pid 9970:tid 9993] [client 52.236.80.95:63134] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qqjki.php"] [unique_id "aeOT8iYdRLRhVmaIMx3ZcAAAANM"]
[Sat Apr 18 22:23:47.567143 2026] [:error] [pid 9970:tid 9976] [client 52.236.80.95:63936] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/koiy.php"] [unique_id "aeOT8yYdRLRhVmaIMx3ZcwAAAMI"]
[Sat Apr 18 22:23:48.105541 2026] [:error] [pid 9970:tid 9995] [client 52.236.80.95:63053] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/koiy.php"] [unique_id "aeOT9CYdRLRhVmaIMx3ZeAAAANU"]
[Sat Apr 18 22:23:48.685335 2026] [:error] [pid 32678:tid 32722] [client 52.236.80.95:62576] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/koiy.php"] [unique_id "aeOT9BUlAXU_ZWUu5y8MHwAAAo8"]
[Sat Apr 18 22:23:49.274814 2026] [:error] [pid 9864:tid 9923] [client 52.236.80.95:62528] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/koiy.php"] [unique_id "aeOT9YCFeowknfXHM7kuswAAAFE"]
[Sat Apr 18 22:23:49.832757 2026] [:error] [pid 13023:tid 13038] [client 52.236.80.95:61389] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "aeOT9f1e7hG8DAeABB82MQAAAQ0"]
[Sat Apr 18 22:23:50.349583 2026] [:error] [pid 13023:tid 13036] [client 52.236.80.95:64697] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "aeOT9v1e7hG8DAeABB82MwAAAQs"]
[Sat Apr 18 22:23:50.870162 2026] [:error] [pid 13023:tid 13037] [client 52.236.80.95:65197] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "aeOT9v1e7hG8DAeABB82NgAAAQw"]
[Sat Apr 18 22:23:51.384099 2026] [:error] [pid 13023:tid 13025] [client 52.236.80.95:63952] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "aeOT9_1e7hG8DAeABB82OQAAAQA"]
[Sat Apr 18 22:23:51.945805 2026] [:error] [pid 9970:tid 9987] [client 52.236.80.95:65098] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "aeOT9yYdRLRhVmaIMx3ZhgAAAM0"]
[Sat Apr 18 22:23:52.461778 2026] [:error] [pid 9865:tid 9939] [client 52.236.80.95:62604] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "aeOT-Kzb5knECIY-C-idngAAAII"]
[Sat Apr 18 22:23:53.085171 2026] [:error] [pid 9970:tid 9979] [client 52.236.80.95:64642] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "aeOT-SYdRLRhVmaIMx3ZigAAAMU"]
[Sat Apr 18 22:23:53.623074 2026] [:error] [pid 9864:tid 9908] [client 52.236.80.95:64057] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "aeOT-YCFeowknfXHM7kutQAAAEM"]
[Sat Apr 18 22:23:54.147531 2026] [:error] [pid 9970:tid 9990] [client 52.236.80.95:65100] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/torsa1.php"] [unique_id "aeOT-iYdRLRhVmaIMx3ZjgAAANA"]
[Sat Apr 18 22:23:54.727951 2026] [:error] [pid 13023:tid 13045] [client 52.236.80.95:63080] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/torsa1.php"] [unique_id "aeOT-v1e7hG8DAeABB82PAAAARQ"]
[Sat Apr 18 22:23:55.298665 2026] [:error] [pid 9865:tid 9951] [client 52.236.80.95:60710] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/torsa1.php"] [unique_id "aeOT-6zb5knECIY-C-idoQAAAI4"]
[Sat Apr 18 22:23:55.892982 2026] [:error] [pid 34290:tid 34323] [client 52.236.80.95:63156] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/torsa1.php"] [unique_id "aeOT-xqX6WpmmAXOBi8p6QAAAcQ"]
[Sat Apr 18 22:23:56.454148 2026] [:error] [pid 13023:tid 13037] [client 52.236.80.95:64033] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "aeOT_P1e7hG8DAeABB82QAAAAQw"]
[Sat Apr 18 22:23:57.005942 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:63142] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "aeOT_f1e7hG8DAeABB82QQAAAQE"]
[Sat Apr 18 22:23:57.544724 2026] [:error] [pid 34290:tid 34325] [client 52.236.80.95:63618] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "aeOT_RqX6WpmmAXOBi8p6gAAAcY"]
[Sat Apr 18 22:23:58.100781 2026] [:error] [pid 32678:tid 32730] [client 52.236.80.95:64643] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bjfl.php"] [unique_id "aeOT_hUlAXU_ZWUu5y8MJgAAApc"]
[Sat Apr 18 22:23:58.860447 2026] [:error] [pid 32678:tid 32723] [client 52.236.80.95:65112] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "aeOT_hUlAXU_ZWUu5y8MKAAAApA"]
[Sat Apr 18 22:23:59.360569 2026] [:error] [pid 32678:tid 32725] [client 52.236.80.95:64028] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "aeOT_xUlAXU_ZWUu5y8MKgAAApI"]
[Sat Apr 18 22:23:59.929172 2026] [:error] [pid 32678:tid 32727] [client 52.236.80.95:63667] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "aeOT_xUlAXU_ZWUu5y8MKwAAApQ"]
[Sat Apr 18 22:24:00.435835 2026] [:error] [pid 9970:tid 9990] [client 52.236.80.95:64032] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buc.php"] [unique_id "aeOUACYdRLRhVmaIMx3ZlgAAANA"]
[Sat Apr 18 22:24:01.030108 2026] [:error] [pid 32677:tid 32685] [client 52.236.80.95:6158] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "aeOUARngmUE3LdC-wP7sZQAAAkU"]
[Sat Apr 18 22:24:01.537529 2026] [:error] [pid 9865:tid 9961] [client 52.236.80.95:60690] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "aeOUAazb5knECIY-C-idqgAAAJg"]
[Sat Apr 18 22:24:02.082939 2026] [:error] [pid 9865:tid 9952] [client 52.236.80.95:63638] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "aeOUAqzb5knECIY-C-idrgAAAI8"]
[Sat Apr 18 22:24:02.940860 2026] [:error] [pid 13023:tid 13038] [client 52.236.80.95:63578] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "aeOUAv1e7hG8DAeABB82UQAAAQ0"]
[Sat Apr 18 22:24:03.499893 2026] [:error] [pid 13023:tid 13047] [client 52.236.80.95:65199] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aeOUA_1e7hG8DAeABB82UwAAARY"]
[Sat Apr 18 22:24:04.522894 2026] [:error] [pid 13023:tid 13029] [client 52.236.80.95:6187] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aeOUBP1e7hG8DAeABB82WAAAAQQ"]
[Sat Apr 18 22:24:05.156293 2026] [:error] [pid 13023:tid 13034] [client 52.236.80.95:60608] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aeOUBf1e7hG8DAeABB82WgAAAQk"]
[Sat Apr 18 22:24:14.056567 2026] [:error] [pid 32677:tid 32686] [client 52.236.80.95:63977] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aeOUDhngmUE3LdC-wP7scgAAAkY"]
[Sat Apr 18 22:24:14.730104 2026] [:error] [pid 9970:tid 9990] [client 52.236.80.95:63164] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aeOUDiYdRLRhVmaIMx3ZowAAANA"]
[Sat Apr 18 22:24:15.349191 2026] [:error] [pid 9970:tid 9984] [client 52.236.80.95:63627] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aeOUDyYdRLRhVmaIMx3ZpwAAAMo"]
[Sat Apr 18 22:24:15.948528 2026] [:error] [pid 32678:tid 32713] [client 52.236.80.95:62097] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aeOUDxUlAXU_ZWUu5y8MNgAAAoY"]
[Sat Apr 18 22:24:16.541609 2026] [:error] [pid 9865:tid 9955] [client 52.236.80.95:63133] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lowpr.php"] [unique_id "aeOUEKzb5knECIY-C-idzgAAAJI"]
[Sat Apr 18 22:24:17.154249 2026] [:error] [pid 32678:tid 32721] [client 52.236.80.95:64668] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lowpr.php"] [unique_id "aeOUERUlAXU_ZWUu5y8MPAAAAo4"]
[Sat Apr 18 22:24:17.862097 2026] [:error] [pid 32677:tid 32698] [client 52.236.80.95:62024] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lowpr.php"] [unique_id "aeOUERngmUE3LdC-wP7sdgAAAlI"]
[Sat Apr 18 22:24:18.605678 2026] [:error] [pid 9864:tid 9913] [client 52.236.80.95:61417] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lowpr.php"] [unique_id "aeOUEoCFeowknfXHM7kuxQAAAEc"]
[Sat Apr 18 22:24:19.229870 2026] [:error] [pid 9864:tid 9921] [client 52.236.80.95:64040] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "aeOUE4CFeowknfXHM7kuxwAAAE8"]
[Sat Apr 18 22:24:20.158999 2026] [:error] [pid 34290:tid 34328] [client 52.236.80.95:64023] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "aeOUFBqX6WpmmAXOBi8p8AAAAck"]
[Sat Apr 18 22:24:20.844707 2026] [:error] [pid 34288:tid 34307] [client 52.236.80.95:60641] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "aeOUFOTIiy__PtiLmpnb_AAAAY8"]
[Sat Apr 18 22:24:21.424726 2026] [:error] [pid 13023:tid 13040] [client 52.236.80.95:63639] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "aeOUFf1e7hG8DAeABB82eQAAAQ8"]
[Sat Apr 18 22:24:21.975701 2026] [:error] [pid 32678:tid 32725] [client 52.236.80.95:63560] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "aeOUFRUlAXU_ZWUu5y8MRgAAApI"]
[Sat Apr 18 22:24:22.492122 2026] [:error] [pid 32678:tid 32709] [client 52.236.80.95:64599] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "aeOUFhUlAXU_ZWUu5y8MSQAAAoI"]
[Sat Apr 18 22:24:23.219927 2026] [:error] [pid 9864:tid 9923] [client 52.236.80.95:64053] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "aeOUF4CFeowknfXHM7kuygAAAFE"]
[Sat Apr 18 22:24:23.827375 2026] [:error] [pid 13023:tid 13045] [client 52.236.80.95:61431] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "aeOUF_1e7hG8DAeABB82fAAAARQ"]
[Sat Apr 18 22:24:24.373690 2026] [:error] [pid 13023:tid 13039] [client 52.236.80.95:64628] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "aeOUGP1e7hG8DAeABB82fwAAAQ4"]
[Sat Apr 18 22:24:25.095009 2026] [:error] [pid 32647:tid 32667] [client 52.236.80.95:63664] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "aeOUGUkxooM0iRo6e54u6AAAAhE"]
[Sat Apr 18 22:24:25.655767 2026] [:error] [pid 9970:tid 9988] [client 52.236.80.95:65191] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "aeOUGSYdRLRhVmaIMx3ZuQAAAM4"]
[Sat Apr 18 22:24:26.270039 2026] [:error] [pid 32677:tid 32693] [client 52.236.80.95:63054] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "aeOUGhngmUE3LdC-wP7sewAAAk0"]
[Sat Apr 18 22:24:26.790963 2026] [:error] [pid 32677:tid 32680] [client 52.236.80.95:62558] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/csv.php"] [unique_id "aeOUGhngmUE3LdC-wP7sfQAAAkA"]
[Sat Apr 18 22:24:27.490410 2026] [:error] [pid 9970:tid 9992] [client 52.236.80.95:64582] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/csv.php"] [unique_id "aeOUGyYdRLRhVmaIMx3ZwwAAANI"]
[Sat Apr 18 22:24:28.269999 2026] [:error] [pid 32677:tid 32694] [client 52.236.80.95:63971] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/csv.php"] [unique_id "aeOUHBngmUE3LdC-wP7sgQAAAk4"]
[Sat Apr 18 22:24:28.869592 2026] [:error] [pid 32677:tid 32686] [client 52.236.80.95:63568] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/csv.php"] [unique_id "aeOUHBngmUE3LdC-wP7sgwAAAkY"]
[Sat Apr 18 22:24:29.474945 2026] [:error] [pid 9863:tid 9895] [client 52.236.80.95:65158] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "aeOUHTjjiypiFrTucbLXkAAAABY"]
[Sat Apr 18 22:24:30.090474 2026] [:error] [pid 32677:tid 32682] [client 52.236.80.95:63645] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "aeOUHhngmUE3LdC-wP7shwAAAkI"]
[Sat Apr 18 22:24:30.603033 2026] [:error] [pid 9863:tid 9894] [client 52.236.80.95:63644] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "aeOUHjjjiypiFrTucbLXkwAAABU"]
[Sat Apr 18 22:24:31.146045 2026] [:error] [pid 13023:tid 13044] [client 52.236.80.95:61485] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "aeOUH_1e7hG8DAeABB82kgAAARM"]
[Sat Apr 18 22:24:33.293905 2026] [:error] [pid 9970:tid 9986] [client 52.236.80.95:65193] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa21.php"] [unique_id "aeOUISYdRLRhVmaIMx3ZzgAAAMw"]
[Sat Apr 18 22:24:34.089329 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:65145] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa21.php"] [unique_id "aeOUIv1e7hG8DAeABB82owAAAQE"]
[Sat Apr 18 22:24:34.615094 2026] [:error] [pid 34288:tid 34315] [client 52.236.80.95:63583] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa21.php"] [unique_id "aeOUIuTIiy__PtiLmpncBgAAAZc"]
[Sat Apr 18 22:24:35.167652 2026] [:error] [pid 9970:tid 9976] [client 52.236.80.95:63135] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa21.php"] [unique_id "aeOUIyYdRLRhVmaIMx3Z0gAAAMI"]
[Sat Apr 18 22:24:35.710799 2026] [:error] [pid 13023:tid 13043] [client 52.236.80.95:62653] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "aeOUI_1e7hG8DAeABB822gAAARI"]
[Sat Apr 18 22:24:36.307737 2026] [:error] [pid 32678:tid 32712] [client 52.236.80.95:63564] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "aeOUJBUlAXU_ZWUu5y8MdAAAAoU"]
[Sat Apr 18 22:24:36.839334 2026] [:error] [pid 13023:tid 13040] [client 52.236.80.95:64689] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "aeOUJP1e7hG8DAeABB829gAAAQ8"]
[Sat Apr 18 22:24:37.442683 2026] [:error] [pid 32678:tid 32717] [client 52.236.80.95:63937] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "aeOUJRUlAXU_ZWUu5y8MgAAAAoo"]
[Sat Apr 18 22:24:38.079674 2026] [:error] [pid 9863:tid 9886] [client 52.236.80.95:63559] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bootstrap.php"] [unique_id "aeOUJjjjiypiFrTucbLXlAAAAA0"]
[Sat Apr 18 22:24:38.665077 2026] [:error] [pid 9865:tid 9952] [client 52.236.80.95:64004] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bootstrap.php"] [unique_id "aeOUJqzb5knECIY-C-id_QAAAI8"]
[Sat Apr 18 22:24:39.263048 2026] [:error] [pid 32677:tid 32691] [client 52.236.80.95:6170] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bootstrap.php"] [unique_id "aeOUJxngmUE3LdC-wP7siwAAAks"]
[Sat Apr 18 22:24:39.823960 2026] [:error] [pid 32678:tid 32722] [client 52.236.80.95:64649] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bootstrap.php"] [unique_id "aeOUJxUlAXU_ZWUu5y8MhwAAAo8"]
[Sat Apr 18 22:24:40.409757 2026] [:error] [pid 9970:tid 9974] [client 52.236.80.95:63075] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aeOUKCYdRLRhVmaIMx3Z4AAAAMA"]
[Sat Apr 18 22:24:41.047825 2026] [:error] [pid 9970:tid 9978] [client 52.236.80.95:65110] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aeOUKSYdRLRhVmaIMx3Z5gAAAMQ"]
[Sat Apr 18 22:24:41.613119 2026] [:error] [pid 9865:tid 9951] [client 52.236.80.95:65129] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aeOUKazb5knECIY-C-ieBQAAAI4"]
[Sat Apr 18 22:24:42.571582 2026] [:error] [pid 9865:tid 9945] [client 52.236.80.95:63056] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aeOUKqzb5knECIY-C-ieBwAAAIg"]
[Sat Apr 18 22:24:43.567950 2026] [:error] [pid 34290:tid 34332] [client 52.236.80.95:63967] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Sanskrit.php"] [unique_id "aeOUKxqX6WpmmAXOBi8p-AAAAc0"]
[Sat Apr 18 22:24:44.326045 2026] [:error] [pid 9864:tid 9926] [client 52.236.80.95:63938] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Sanskrit.php"] [unique_id "aeOULICFeowknfXHM7kuzgAAAFQ"]
[Sat Apr 18 22:24:44.927793 2026] [:error] [pid 32647:tid 32650] [client 52.236.80.95:63988] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Sanskrit.php"] [unique_id "aeOULEkxooM0iRo6e54u7wAAAgA"]
[Sat Apr 18 22:24:45.488862 2026] [:error] [pid 9970:tid 9987] [client 52.236.80.95:63946] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Sanskrit.php"] [unique_id "aeOULSYdRLRhVmaIMx3Z7gAAAM0"]
[Sat Apr 18 22:24:45.993730 2026] [:error] [pid 32677:tid 32686] [client 52.236.80.95:63043] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/green.php"] [unique_id "aeOULRngmUE3LdC-wP7skQAAAkY"]
[Sat Apr 18 22:24:46.549749 2026] [:error] [pid 32677:tid 32687] [client 52.236.80.95:64598] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/green.php"] [unique_id "aeOULhngmUE3LdC-wP7skwAAAkc"]
[Sat Apr 18 22:24:47.133026 2026] [:error] [pid 32647:tid 32655] [client 52.236.80.95:63574] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/green.php"] [unique_id "aeOUL0kxooM0iRo6e54u9AAAAgU"]
[Sat Apr 18 22:24:47.706461 2026] [:error] [pid 32647:tid 32656] [client 52.236.80.95:60648] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/green.php"] [unique_id "aeOUL0kxooM0iRo6e54u9gAAAgY"]
[Sat Apr 18 22:24:48.238793 2026] [:error] [pid 9865:tid 9938] [client 52.236.80.95:63580] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "aeOUMKzb5knECIY-C-ieEAAAAIE"]
[Sat Apr 18 22:24:48.826891 2026] [:error] [pid 34290:tid 34326] [client 52.236.80.95:64666] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "aeOUMBqX6WpmmAXOBi8p_AAAAcc"]
[Sat Apr 18 22:24:49.810017 2026] [:error] [pid 32677:tid 32685] [client 52.236.80.95:60671] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "aeOUMRngmUE3LdC-wP7slgAAAkU"]
[Sat Apr 18 22:24:50.398887 2026] [:error] [pid 34288:tid 34305] [client 52.236.80.95:64060] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws87.php"] [unique_id "aeOUMuTIiy__PtiLmpncCwAAAY0"]
[Sat Apr 18 22:24:50.918096 2026] [:error] [pid 9970:tid 9991] [client 52.236.80.95:62616] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wxfyf.php"] [unique_id "aeOUMiYdRLRhVmaIMx3Z9QAAANE"]
[Sat Apr 18 22:24:51.494906 2026] [:error] [pid 32678:tid 32718] [client 52.236.80.95:62084] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wxfyf.php"] [unique_id "aeOUMxUlAXU_ZWUu5y8MkQAAAos"]
[Sat Apr 18 22:24:52.064701 2026] [:error] [pid 34290:tid 34342] [client 52.236.80.95:63079] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wxfyf.php"] [unique_id "aeOUNBqX6WpmmAXOBi8qAAAAAdc"]
[Sat Apr 18 22:24:52.615179 2026] [:error] [pid 9865:tid 9961] [client 52.236.80.95:64670] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wxfyf.php"] [unique_id "aeOUNKzb5knECIY-C-ieFgAAAJg"]
[Sat Apr 18 22:24:53.163070 2026] [:error] [pid 9863:tid 9875] [client 52.236.80.95:65117] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aeOUNTjjiypiFrTucbLXoAAAAAI"]
[Sat Apr 18 22:24:53.692594 2026] [:error] [pid 32647:tid 32660] [client 52.236.80.95:63953] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aeOUNUkxooM0iRo6e54u_QAAAgo"]
[Sat Apr 18 22:24:54.215713 2026] [:error] [pid 32647:tid 32672] [client 52.236.80.95:6205] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aeOUNkkxooM0iRo6e54u_wAAAhY"]
[Sat Apr 18 22:24:54.879460 2026] [:error] [pid 9970:tid 9996] [client 52.236.80.95:64583] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aeOUNiYdRLRhVmaIMx3Z_QAAANY"]
[Sat Apr 18 22:24:55.485723 2026] [:error] [pid 9970:tid 9992] [client 52.236.80.95:65188] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gpt-sh.php"] [unique_id "aeOUNyYdRLRhVmaIMx3Z_wAAANI"]
[Sat Apr 18 22:24:56.108348 2026] [:error] [pid 32677:tid 32686] [client 52.236.80.95:65123] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gpt-sh.php"] [unique_id "aeOUOBngmUE3LdC-wP7sngAAAkY"]
[Sat Apr 18 22:24:56.693561 2026] [:error] [pid 32678:tid 32713] [client 52.236.80.95:63159] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gpt-sh.php"] [unique_id "aeOUOBUlAXU_ZWUu5y8MlwAAAoY"]
[Sat Apr 18 22:24:57.248041 2026] [:error] [pid 34290:tid 34325] [client 52.236.80.95:63137] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gpt-sh.php"] [unique_id "aeOUORqX6WpmmAXOBi8qBAAAAcY"]
[Sat Apr 18 22:24:58.148426 2026] [:error] [pid 32677:tid 32699] [client 52.236.80.95:6172] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ne2026.php"] [unique_id "aeOUOhngmUE3LdC-wP7spAAAAlM"]
[Sat Apr 18 22:24:58.939155 2026] [:error] [pid 32678:tid 32709] [client 52.236.80.95:64686] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ne2026.php"] [unique_id "aeOUOhUlAXU_ZWUu5y8MmQAAAoI"]
[Sat Apr 18 22:24:59.491816 2026] [:error] [pid 32647:tid 32655] [client 52.236.80.95:65141] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ne2026.php"] [unique_id "aeOUO0kxooM0iRo6e54vAgAAAgU"]
[Sat Apr 18 22:24:59.996514 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:65109] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ne2026.php"] [unique_id "aeOUO_1e7hG8DAeABB83IAAAAQE"]
[Sat Apr 18 22:25:00.540989 2026] [:error] [pid 13023:tid 13034] [client 52.236.80.95:60628] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2ksm17n.php"] [unique_id "aeOUPP1e7hG8DAeABB83IQAAAQk"]
[Sat Apr 18 22:25:01.156482 2026] [:error] [pid 9970:tid 9978] [client 52.236.80.95:63986] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2ksm17n.php"] [unique_id "aeOUPSYdRLRhVmaIMx3aBAAAAMQ"]
[Sat Apr 18 22:25:01.715323 2026] [:error] [pid 9970:tid 9984] [client 52.236.80.95:64016] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2ksm17n.php"] [unique_id "aeOUPSYdRLRhVmaIMx3aBwAAAMo"]
[Sat Apr 18 22:25:02.304883 2026] [:error] [pid 9970:tid 9994] [client 52.236.80.95:63112] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2ksm17n.php"] [unique_id "aeOUPiYdRLRhVmaIMx3aDAAAANQ"]
[Sat Apr 18 22:25:02.847915 2026] [:error] [pid 9865:tid 9941] [client 52.236.80.95:62638] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/less.php"] [unique_id "aeOUPqzb5knECIY-C-ieIAAAAIQ"]
[Sat Apr 18 22:25:03.556097 2026] [:error] [pid 32678:tid 32730] [client 52.236.80.95:6191] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/less.php"] [unique_id "aeOUPxUlAXU_ZWUu5y8MnAAAApc"]
[Sat Apr 18 22:25:04.352875 2026] [:error] [pid 9865:tid 9956] [client 52.236.80.95:63150] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/less.php"] [unique_id "aeOUQKzb5knECIY-C-ieIgAAAJM"]
[Sat Apr 18 22:25:04.959583 2026] [:error] [pid 9864:tid 9920] [client 52.236.80.95:62575] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/less.php"] [unique_id "aeOUQICFeowknfXHM7ku3QAAAE4"]
[Sat Apr 18 22:25:05.610140 2026] [:error] [pid 34290:tid 34328] [client 52.236.80.95:63576] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aeOUQRqX6WpmmAXOBi8qCgAAAck"]
[Sat Apr 18 22:25:06.296860 2026] [:error] [pid 32678:tid 32716] [client 52.236.80.95:62096] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aeOUQhUlAXU_ZWUu5y8MngAAAok"]
[Sat Apr 18 22:25:06.840579 2026] [:error] [pid 32647:tid 32673] [client 52.236.80.95:64034] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aeOUQkkxooM0iRo6e54vDAAAAhc"]
[Sat Apr 18 22:25:07.396828 2026] [:error] [pid 13023:tid 13031] [client 52.236.80.95:63672] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aeOUQ_1e7hG8DAeABB83MAAAAQY"]
[Sat Apr 18 22:25:07.995536 2026] [:error] [pid 32647:tid 32653] [client 52.236.80.95:62612] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "aeOUQ0kxooM0iRo6e54vDwAAAgM"]
[Sat Apr 18 22:25:08.565110 2026] [:error] [pid 9865:tid 9955] [client 52.236.80.95:62088] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "aeOURKzb5knECIY-C-ieJwAAAJI"]
[Sat Apr 18 22:25:09.112721 2026] [:error] [pid 32647:tid 32668] [client 52.236.80.95:62135] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "aeOURUkxooM0iRo6e54vEgAAAhI"]
[Sat Apr 18 22:25:09.757492 2026] [:error] [pid 9864:tid 9923] [client 52.236.80.95:61503] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "aeOURYCFeowknfXHM7ku5QAAAFE"]
[Sat Apr 18 22:25:10.373333 2026] [:error] [pid 32647:tid 32659] [client 52.236.80.95:63138] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsgdjkl.php"] [unique_id "aeOURkkxooM0iRo6e54vFAAAAgk"]
[Sat Apr 18 22:25:11.197943 2026] [:error] [pid 13023:tid 13044] [client 52.236.80.95:65184] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsgdjkl.php"] [unique_id "aeOUR_1e7hG8DAeABB83NQAAARM"]
[Sat Apr 18 22:25:11.811982 2026] [:error] [pid 9864:tid 9920] [client 52.236.80.95:64584] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsgdjkl.php"] [unique_id "aeOUR4CFeowknfXHM7ku6gAAAE4"]
[Sat Apr 18 22:25:12.480782 2026] [:error] [pid 9970:tid 9975] [client 52.236.80.95:64699] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsgdjkl.php"] [unique_id "aeOUSCYdRLRhVmaIMx3aEwAAAME"]
[Sat Apr 18 22:25:22.460933 2026] [:error] [pid 9865:tid 9938] [client 52.236.80.95:63587] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-moonka.php"] [unique_id "aeOUUqzb5knECIY-C-ieRAAAAIE"]
[Sat Apr 18 22:25:23.001334 2026] [:error] [pid 9970:tid 9990] [client 52.236.80.95:63990] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-moonka.php"] [unique_id "aeOUUyYdRLRhVmaIMx3aJwAAANA"]
[Sat Apr 18 22:25:23.604947 2026] [:error] [pid 9970:tid 9982] [client 52.236.80.95:65208] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-moonka.php"] [unique_id "aeOUUyYdRLRhVmaIMx3aKwAAAMg"]
[Sat Apr 18 22:25:24.114949 2026] [:error] [pid 9970:tid 9998] [client 52.236.80.95:61490] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-moonka.php"] [unique_id "aeOUVCYdRLRhVmaIMx3aLgAAANg"]
[Sat Apr 18 22:25:24.655934 2026] [:error] [pid 34290:tid 34335] [client 52.236.80.95:63669] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX1.php"] [unique_id "aeOUVBqX6WpmmAXOBi8qEgAAAdA"]
[Sat Apr 18 22:25:25.226893 2026] [:error] [pid 34290:tid 34326] [client 52.236.80.95:63979] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX1.php"] [unique_id "aeOUVRqX6WpmmAXOBi8qFAAAAcc"]
[Sat Apr 18 22:25:25.808104 2026] [:error] [pid 9865:tid 9937] [client 52.236.80.95:57859] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX1.php"] [unique_id "aeOUVazb5knECIY-C-ieUQAAAIA"]
[Sat Apr 18 22:25:26.320338 2026] [:error] [pid 34290:tid 34322] [client 52.236.80.95:65195] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX1.php"] [unique_id "aeOUVhqX6WpmmAXOBi8qFwAAAcM"]
[Sat Apr 18 22:25:26.873635 2026] [:error] [pid 13023:tid 13042] [client 52.236.80.95:61456] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX2.php"] [unique_id "aeOUVv1e7hG8DAeABB83TgAAARE"]
[Sat Apr 18 22:25:27.436465 2026] [:error] [pid 13023:tid 13039] [client 52.236.80.95:65097] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX2.php"] [unique_id "aeOUV_1e7hG8DAeABB83UQAAAQ4"]
[Sat Apr 18 22:25:28.033880 2026] [:error] [pid 9970:tid 9984] [client 52.236.80.95:63128] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX2.php"] [unique_id "aeOUWCYdRLRhVmaIMx3aOwAAAMo"]
[Sat Apr 18 22:25:28.547788 2026] [:error] [pid 9863:tid 9875] [client 52.236.80.95:64633] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX2.php"] [unique_id "aeOUWDjjiypiFrTucbLXqAAAAAI"]
[Sat Apr 18 22:25:29.148145 2026] [:error] [pid 9865:tid 9940] [client 52.236.80.95:64003] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/only.php"] [unique_id "aeOUWazb5knECIY-C-ieWAAAAIM"]
[Sat Apr 18 22:25:29.725967 2026] [:error] [pid 32678:tid 32720] [client 52.236.80.95:6180] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/only.php"] [unique_id "aeOUWRUlAXU_ZWUu5y8MrgAAAo0"]
[Sat Apr 18 22:25:30.378295 2026] [:error] [pid 13023:tid 13038] [client 52.236.80.95:65089] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/only.php"] [unique_id "aeOUWv1e7hG8DAeABB83XAAAAQ0"]
[Sat Apr 18 22:25:30.969811 2026] [:error] [pid 13023:tid 13039] [client 52.236.80.95:62640] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/only.php"] [unique_id "aeOUWv1e7hG8DAeABB83YgAAAQ4"]
[Sat Apr 18 22:25:31.622524 2026] [:error] [pid 13023:tid 13046] [client 52.236.80.95:62102] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sts.php"] [unique_id "aeOUW_1e7hG8DAeABB83bAAAARU"]
[Sat Apr 18 22:25:32.200790 2026] [:error] [pid 32677:tid 32685] [client 52.236.80.95:64622] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sts.php"] [unique_id "aeOUXBngmUE3LdC-wP7szAAAAkU"]
[Sat Apr 18 22:25:32.757048 2026] [:error] [pid 13023:tid 13045] [client 52.236.80.95:64664] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sts.php"] [unique_id "aeOUXP1e7hG8DAeABB83dgAAARQ"]
[Sat Apr 18 22:25:33.265223 2026] [:error] [pid 34288:tid 34300] [client 52.236.80.95:64613] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sts.php"] [unique_id "aeOUXeTIiy__PtiLmpncEQAAAYg"]
[Sat Apr 18 22:25:33.800344 2026] [:error] [pid 13023:tid 13041] [client 52.236.80.95:63166] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Geforce.php"] [unique_id "aeOUXf1e7hG8DAeABB83fQAAARA"]
[Sat Apr 18 22:25:34.401166 2026] [:error] [pid 13023:tid 13039] [client 52.236.80.95:63115] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Geforce.php"] [unique_id "aeOUXv1e7hG8DAeABB83ggAAAQ4"]
[Sat Apr 18 22:25:34.986062 2026] [:error] [pid 13023:tid 13044] [client 52.236.80.95:6144] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Geforce.php"] [unique_id "aeOUXv1e7hG8DAeABB83hAAAARM"]
[Sat Apr 18 22:25:35.614892 2026] [:error] [pid 9864:tid 9914] [client 52.236.80.95:6157] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Geforce.php"] [unique_id "aeOUX4CFeowknfXHM7ku_QAAAEg"]
[Sat Apr 18 22:25:36.152978 2026] [:error] [pid 9970:tid 9977] [client 52.236.80.95:63607] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dichku.php"] [unique_id "aeOUYCYdRLRhVmaIMx3aQQAAAMM"]
[Sat Apr 18 22:25:36.721033 2026] [:error] [pid 34290:tid 34329] [client 52.236.80.95:65140] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dichku.php"] [unique_id "aeOUYBqX6WpmmAXOBi8qGQAAAco"]
[Sat Apr 18 22:25:37.319398 2026] [:error] [pid 32678:tid 32714] [client 52.236.80.95:64659] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dichku.php"] [unique_id "aeOUYRUlAXU_ZWUu5y8MswAAAoc"]
[Sat Apr 18 22:25:37.954797 2026] [:error] [pid 32678:tid 32729] [client 52.236.80.95:61470] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dichku.php"] [unique_id "aeOUYRUlAXU_ZWUu5y8MtgAAApY"]
[Sat Apr 18 22:25:38.626974 2026] [:error] [pid 9865:tid 9938] [client 52.236.80.95:63125] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aeOUYqzb5knECIY-C-ieYwAAAIE"]
[Sat Apr 18 22:25:39.246293 2026] [:error] [pid 13023:tid 13037] [client 52.236.80.95:64657] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aeOUY_1e7hG8DAeABB83jgAAAQw"]
[Sat Apr 18 22:25:39.777726 2026] [:error] [pid 32677:tid 32692] [client 52.236.80.95:65189] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aeOUYxngmUE3LdC-wP7s0QAAAkw"]
[Sat Apr 18 22:25:40.335840 2026] [:error] [pid 13023:tid 13028] [client 52.236.80.95:63149] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aeOUZP1e7hG8DAeABB83kQAAAQM"]
[Sat Apr 18 22:25:40.974055 2026] [:error] [pid 13023:tid 13029] [client 52.236.80.95:64577] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htto.php"] [unique_id "aeOUZP1e7hG8DAeABB83lwAAAQQ"]
[Sat Apr 18 22:25:41.486786 2026] [:error] [pid 13023:tid 13028] [client 52.236.80.95:63652] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htto.php"] [unique_id "aeOUZf1e7hG8DAeABB83ogAAAQM"]
[Sat Apr 18 22:25:42.056243 2026] [:error] [pid 9970:tid 9980] [client 52.236.80.95:63567] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htto.php"] [unique_id "aeOUZiYdRLRhVmaIMx3aTwAAAMY"]
[Sat Apr 18 22:25:42.629043 2026] [:error] [pid 34290:tid 34323] [client 52.236.80.95:63613] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htto.php"] [unique_id "aeOUZhqX6WpmmAXOBi8qHQAAAcQ"]
[Sat Apr 18 22:25:43.189367 2026] [:error] [pid 13023:tid 13034] [client 52.236.80.95:64661] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ccv.php"] [unique_id "aeOUZ_1e7hG8DAeABB83qwAAAQk"]
[Sat Apr 18 22:25:43.781292 2026] [:error] [pid 9865:tid 9956] [client 52.236.80.95:6196] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ccv.php"] [unique_id "aeOUZ6zb5knECIY-C-iebQAAAJM"]
[Sat Apr 18 22:25:44.353347 2026] [:error] [pid 9970:tid 9975] [client 52.236.80.95:62120] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ccv.php"] [unique_id "aeOUaCYdRLRhVmaIMx3aVgAAAME"]
[Sat Apr 18 22:25:44.901851 2026] [:error] [pid 9970:tid 9998] [client 52.236.80.95:63153] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ccv.php"] [unique_id "aeOUaCYdRLRhVmaIMx3aWgAAANg"]
[Sat Apr 18 22:25:45.453583 2026] [:error] [pid 13023:tid 13040] [client 52.236.80.95:63646] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hfles.php"] [unique_id "aeOUaf1e7hG8DAeABB83rQAAAQ8"]
[Sat Apr 18 22:25:45.998050 2026] [:error] [pid 32647:tid 32666] [client 52.236.80.95:62016] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hfles.php"] [unique_id "aeOUaUkxooM0iRo6e54vIgAAAhA"]
[Sat Apr 18 22:25:46.609897 2026] [:error] [pid 13023:tid 13045] [client 52.236.80.95:63143] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hfles.php"] [unique_id "aeOUav1e7hG8DAeABB83sAAAARQ"]
[Sat Apr 18 22:25:47.203415 2026] [:error] [pid 9970:tid 9989] [client 52.236.80.95:65124] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hfles.php"] [unique_id "aeOUayYdRLRhVmaIMx3aXwAAAM8"]
[Sat Apr 18 22:25:47.771046 2026] [:error] [pid 9865:tid 9948] [client 52.236.80.95:61479] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "aeOUa6zb5knECIY-C-iedgAAAIs"]
[Sat Apr 18 22:25:48.391598 2026] [:error] [pid 13023:tid 13025] [client 52.236.80.95:63947] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "aeOUbP1e7hG8DAeABB83sgAAAQA"]
[Sat Apr 18 22:25:48.984295 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:63670] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "aeOUbP1e7hG8DAeABB83tQAAAQE"]
[Sat Apr 18 22:25:49.588871 2026] [:error] [pid 32647:tid 32651] [client 52.236.80.95:62036] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "aeOUbUkxooM0iRo6e54vJwAAAgE"]
[Sat Apr 18 22:25:50.170507 2026] [:error] [pid 34288:tid 34294] [client 52.236.80.95:63110] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "aeOUbuTIiy__PtiLmpncHwAAAYI"]
[Sat Apr 18 22:25:50.700493 2026] [:error] [pid 9865:tid 9952] [client 52.236.80.95:63570] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "aeOUbqzb5knECIY-C-iegAAAAI8"]
[Sat Apr 18 22:25:51.248982 2026] [:error] [pid 9865:tid 9954] [client 52.236.80.95:65125] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "aeOUb6zb5knECIY-C-iehQAAAJE"]
[Sat Apr 18 22:25:51.792363 2026] [:error] [pid 9864:tid 9905] [client 52.236.80.95:63126] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "aeOUb4CFeowknfXHM7kvDwAAAEA"]
[Sat Apr 18 22:25:52.300275 2026] [:error] [pid 9865:tid 9937] [client 52.236.80.95:63600] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "aeOUcKzb5knECIY-C-iekQAAAIA"]
[Sat Apr 18 22:25:52.871138 2026] [:error] [pid 34288:tid 34312] [client 52.236.80.95:62631] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "aeOUcOTIiy__PtiLmpncIQAAAZQ"]
[Sat Apr 18 22:25:53.565465 2026] [:error] [pid 34290:tid 34332] [client 52.236.80.95:61445] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "aeOUcRqX6WpmmAXOBi8qJAAAAc0"]
[Sat Apr 18 22:25:54.474965 2026] [:error] [pid 34288:tid 34300] [client 52.236.80.95:63562] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "aeOUcuTIiy__PtiLmpncIwAAAYg"]
[Sat Apr 18 22:25:55.169700 2026] [:error] [pid 34288:tid 34309] [client 52.236.80.95:65183] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "aeOUc-TIiy__PtiLmpncJAAAAZE"]
[Sat Apr 18 22:25:55.746572 2026] [:error] [pid 9970:tid 9974] [client 52.236.80.95:62094] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "aeOUcyYdRLRhVmaIMx3agAAAAMA"]
[Sat Apr 18 22:25:56.350911 2026] [:error] [pid 32678:tid 32716] [client 52.236.80.95:62624] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "aeOUdBUlAXU_ZWUu5y8M1AAAAok"]
[Sat Apr 18 22:25:56.889881 2026] [:error] [pid 32678:tid 32726] [client 52.236.80.95:64006] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "aeOUdBUlAXU_ZWUu5y8M1wAAApM"]
[Sat Apr 18 22:25:57.510160 2026] [:error] [pid 9970:tid 9983] [client 52.236.80.95:62558] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file61.php"] [unique_id "aeOUdSYdRLRhVmaIMx3aiwAAAMk"]
[Sat Apr 18 22:25:58.119206 2026] [:error] [pid 32647:tid 32652] [client 52.236.80.95:63637] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file61.php"] [unique_id "aeOUdkkxooM0iRo6e54vLwAAAgI"]
[Sat Apr 18 22:25:58.658305 2026] [:error] [pid 9970:tid 9980] [client 52.236.80.95:61472] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file61.php"] [unique_id "aeOUdiYdRLRhVmaIMx3ajgAAAMY"]
[Sat Apr 18 22:25:59.267759 2026] [:error] [pid 13023:tid 13029] [client 52.236.80.95:64046] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file61.php"] [unique_id "aeOUd_1e7hG8DAeABB83uwAAAQQ"]
[Sat Apr 18 22:25:59.936499 2026] [:error] [pid 13023:tid 13042] [client 52.236.80.95:62626] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tdsaz.php"] [unique_id "aeOUd_1e7hG8DAeABB83wgAAARE"]
[Sat Apr 18 22:26:00.482194 2026] [:error] [pid 13023:tid 13035] [client 52.236.80.95:64701] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tdsaz.php"] [unique_id "aeOUeP1e7hG8DAeABB83xwAAAQo"]
[Sat Apr 18 22:26:01.023122 2026] [:error] [pid 32678:tid 32713] [client 52.236.80.95:64639] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tdsaz.php"] [unique_id "aeOUeRUlAXU_ZWUu5y8M3QAAAoY"]
[Sat Apr 18 22:26:01.570562 2026] [:error] [pid 32678:tid 32719] [client 52.236.80.95:64042] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tdsaz.php"] [unique_id "aeOUeRUlAXU_ZWUu5y8M3wAAAow"]
[Sat Apr 18 22:26:02.284269 2026] [:error] [pid 13023:tid 13029] [client 52.236.80.95:64674] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ynjli.php"] [unique_id "aeOUev1e7hG8DAeABB83zgAAAQQ"]
[Sat Apr 18 22:26:02.881992 2026] [:error] [pid 32678:tid 32721] [client 52.236.80.95:62125] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ynjli.php"] [unique_id "aeOUehUlAXU_ZWUu5y8M4AAAAo4"]
[Sat Apr 18 22:26:03.448727 2026] [:error] [pid 13023:tid 13039] [client 52.236.80.95:62062] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ynjli.php"] [unique_id "aeOUe_1e7hG8DAeABB830gAAAQ4"]
[Sat Apr 18 22:26:04.122539 2026] [:error] [pid 9970:tid 9975] [client 52.236.80.95:65176] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ynjli.php"] [unique_id "aeOUfCYdRLRhVmaIMx3alAAAAME"]
[Sat Apr 18 22:26:04.622121 2026] [:error] [pid 9865:tid 9946] [client 52.236.80.95:63997] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "aeOUfKzb5knECIY-C-iemAAAAIk"]
[Sat Apr 18 22:26:05.162929 2026] [:error] [pid 34290:tid 34328] [client 52.236.80.95:64025] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "aeOUfRqX6WpmmAXOBi8qKAAAAck"]
[Sat Apr 18 22:26:05.746846 2026] [:error] [pid 13023:tid 13042] [client 52.236.80.95:63957] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "aeOUff1e7hG8DAeABB83_QAAARE"]
[Sat Apr 18 22:26:06.269480 2026] [:error] [pid 13023:tid 13048] [client 52.236.80.95:63109] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "aeOUfv1e7hG8DAeABB84CQAAARc"]
[Sat Apr 18 22:26:06.788008 2026] [:error] [pid 34290:tid 34343] [client 52.236.80.95:62565] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rogsa.php"] [unique_id "aeOUfhqX6WpmmAXOBi8qKgAAAdg"]
[Sat Apr 18 22:26:07.416127 2026] [:error] [pid 34288:tid 34293] [client 52.236.80.95:6195] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rogsa.php"] [unique_id "aeOUf-TIiy__PtiLmpncKQAAAYE"]
[Sat Apr 18 22:26:07.938846 2026] [:error] [pid 9863:tid 9874] [client 52.236.80.95:62548] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rogsa.php"] [unique_id "aeOUfzjjiypiFrTucbLXuAAAAAE"]
[Sat Apr 18 22:26:08.589909 2026] [:error] [pid 34288:tid 34316] [client 52.236.80.95:62577] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rogsa.php"] [unique_id "aeOUgOTIiy__PtiLmpncKgAAAZg"]
[Sat Apr 18 22:26:09.118935 2026] [:error] [pid 32647:tid 32663] [client 52.236.80.95:63162] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "aeOUgUkxooM0iRo6e54vRAAAAg0"]
[Sat Apr 18 22:26:09.735592 2026] [:error] [pid 9970:tid 9977] [client 52.236.80.95:62529] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "aeOUgSYdRLRhVmaIMx3aogAAAMM"]
[Sat Apr 18 22:26:10.261573 2026] [:error] [pid 9970:tid 9995] [client 52.236.80.95:64014] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "aeOUgiYdRLRhVmaIMx3apwAAANU"]
[Sat Apr 18 22:26:10.932679 2026] [:error] [pid 34288:tid 34299] [client 52.236.80.95:65165] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "aeOUguTIiy__PtiLmpncLAAAAYc"]
[Sat Apr 18 22:26:11.466564 2026] [:error] [pid 34290:tid 34337] [client 52.236.80.95:61381] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new3.php"] [unique_id "aeOUgxqX6WpmmAXOBi8qLgAAAdI"]
[Sat Apr 18 22:26:12.012166 2026] [:error] [pid 9970:tid 9997] [client 52.236.80.95:63973] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new3.php"] [unique_id "aeOUhCYdRLRhVmaIMx3arAAAANc"]
[Sat Apr 18 22:26:12.687855 2026] [:error] [pid 13023:tid 13041] [client 52.236.80.95:63602] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new3.php"] [unique_id "aeOUhP1e7hG8DAeABB84DQAAARA"]
[Sat Apr 18 22:26:13.509578 2026] [:error] [pid 9970:tid 9990] [client 52.236.80.95:63611] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new3.php"] [unique_id "aeOUhSYdRLRhVmaIMx3asAAAANA"]
[Sat Apr 18 22:26:14.341866 2026] [:error] [pid 9865:tid 9960] [client 52.236.80.95:65202] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0yellow.php"] [unique_id "aeOUhqzb5knECIY-C-ieqwAAAJc"]
[Sat Apr 18 22:26:15.057439 2026] [:error] [pid 9865:tid 9950] [client 52.236.80.95:6154] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0yellow.php"] [unique_id "aeOUh6zb5knECIY-C-iesAAAAI0"]
[Sat Apr 18 22:26:16.355855 2026] [:error] [pid 9970:tid 9998] [client 52.236.80.95:62618] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0yellow.php"] [unique_id "aeOUiCYdRLRhVmaIMx3atgAAANg"]
[Sat Apr 18 22:26:17.155372 2026] [:error] [pid 32677:tid 32704] [client 52.236.80.95:63061] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0yellow.php"] [unique_id "aeOUiRngmUE3LdC-wP7s5gAAAlg"]
[Sat Apr 18 22:26:17.833278 2026] [:error] [pid 32677:tid 32683] [client 52.236.80.95:64025] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ortasekerli1.php"] [unique_id "aeOUiRngmUE3LdC-wP7s5wAAAkM"]
[Sat Apr 18 22:26:18.366671 2026] [:error] [pid 9865:tid 9947] [client 52.236.80.95:62047] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ortasekerli1.php"] [unique_id "aeOUiqzb5knECIY-C-ieugAAAIo"]
[Sat Apr 18 22:26:18.922731 2026] [:error] [pid 9863:tid 9890] [client 52.236.80.95:63596] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ortasekerli1.php"] [unique_id "aeOUijjjiypiFrTucbLXwgAAABE"]
[Sat Apr 18 22:26:19.496482 2026] [:error] [pid 34290:tid 34343] [client 52.236.80.95:63119] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ortasekerli1.php"] [unique_id "aeOUixqX6WpmmAXOBi8qNgAAAdg"]
[Sat Apr 18 22:26:20.079555 2026] [:error] [pid 13023:tid 13038] [client 52.236.80.95:64000] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "aeOUjP1e7hG8DAeABB84EwAAAQ0"]
[Sat Apr 18 22:26:20.702013 2026] [:error] [pid 9864:tid 9919] [client 52.236.80.95:64641] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "aeOUjICFeowknfXHM7kvJgAAAE0"]
[Sat Apr 18 22:26:29.446778 2026] [:error] [pid 9970:tid 9991] [client 52.236.80.95:62592] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "aeOUlSYdRLRhVmaIMx3a0AAAANE"]
[Sat Apr 18 22:26:30.213606 2026] [:error] [pid 13023:tid 13031] [client 52.236.80.95:60621] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "aeOUlv1e7hG8DAeABB84GQAAAQY"]
[Sat Apr 18 22:26:30.742028 2026] [:error] [pid 13023:tid 13043] [client 52.236.80.95:64651] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "aeOUlv1e7hG8DAeABB84HAAAARI"]
[Sat Apr 18 22:26:31.630037 2026] [:error] [pid 9970:tid 9979] [client 52.236.80.95:64054] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "aeOUlyYdRLRhVmaIMx3a2AAAAMU"]
[Sat Apr 18 22:26:32.223884 2026] [:error] [pid 13023:tid 13049] [client 52.236.80.95:64055] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-942.php"] [unique_id "aeOUmP1e7hG8DAeABB84IAAAARg"]
[Sat Apr 18 22:26:32.797534 2026] [:error] [pid 9970:tid 9984] [client 52.236.80.95:6145] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-942.php"] [unique_id "aeOUmCYdRLRhVmaIMx3a2QAAAMo"]
[Sat Apr 18 22:26:41.918645 2026] [:error] [pid 9970:tid 9994] [client 52.236.80.95:62648] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-942.php"] [unique_id "aeOUoSYdRLRhVmaIMx3a5wAAANQ"]
[Sat Apr 18 22:26:43.601345 2026] [:error] [pid 9865:tid 9954] [client 52.236.80.95:6204] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-942.php"] [unique_id "aeOUo6zb5knECIY-C-iexQAAAJE"]
[Sat Apr 18 22:26:44.588517 2026] [:error] [pid 9864:tid 9923] [client 52.236.80.95:64703] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-243.php"] [unique_id "aeOUpICFeowknfXHM7kvOgAAAFE"]
[Sat Apr 18 22:26:45.164449 2026] [:error] [pid 13023:tid 13032] [client 52.236.80.95:6190] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-243.php"] [unique_id "aeOUpf1e7hG8DAeABB84QAAAAQc"]
[Sat Apr 18 22:26:45.992427 2026] [:error] [pid 13023:tid 13038] [client 52.236.80.95:62562] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-243.php"] [unique_id "aeOUpf1e7hG8DAeABB84QwAAAQ0"]
[Sat Apr 18 22:26:46.596166 2026] [:error] [pid 9865:tid 9940] [client 52.236.80.95:62642] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-243.php"] [unique_id "aeOUpqzb5knECIY-C-iezgAAAIM"]
[Sat Apr 18 22:26:47.832091 2026] [:error] [pid 13023:tid 13034] [client 52.236.80.95:62107] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hanyatersenyum.php"] [unique_id "aeOUp_1e7hG8DAeABB84SwAAAQk"]
[Sat Apr 18 22:26:48.573363 2026] [:error] [pid 9864:tid 9909] [client 52.236.80.95:60665] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hanyatersenyum.php"] [unique_id "aeOUqICFeowknfXHM7kvQgAAAEQ"]
[Sat Apr 18 22:26:49.102278 2026] [:error] [pid 9865:tid 9945] [client 52.236.80.95:62534] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hanyatersenyum.php"] [unique_id "aeOUqazb5knECIY-C-ie0AAAAIg"]
[Sat Apr 18 22:26:50.512879 2026] [:error] [pid 9864:tid 9907] [client 52.236.80.95:63996] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hanyatersenyum.php"] [unique_id "aeOUqoCFeowknfXHM7kvRQAAAEI"]
[Sat Apr 18 22:26:51.141579 2026] [:error] [pid 13023:tid 13041] [client 52.236.80.95:62073] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/161dfd072f.php"] [unique_id "aeOUq_1e7hG8DAeABB84UAAAARA"]
[Sat Apr 18 22:26:51.720127 2026] [:error] [pid 9865:tid 9940] [client 52.236.80.95:63147] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/161dfd072f.php"] [unique_id "aeOUq6zb5knECIY-C-ie1QAAAIM"]
[Sat Apr 18 22:26:52.304398 2026] [:error] [pid 34288:tid 34297] [client 52.236.80.95:63121] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/161dfd072f.php"] [unique_id "aeOUrOTIiy__PtiLmpncMwAAAYU"]
[Sat Apr 18 22:26:53.025366 2026] [:error] [pid 9865:tid 9938] [client 52.236.80.95:64020] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/161dfd072f.php"] [unique_id "aeOUrazb5knECIY-C-ie2gAAAIE"]
[Sat Apr 18 22:26:53.697663 2026] [:error] [pid 13023:tid 13025] [client 52.236.80.95:6165] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maintura.php"] [unique_id "aeOUrf1e7hG8DAeABB84VwAAAQA"]
[Sat Apr 18 22:26:54.434745 2026] [:error] [pid 32647:tid 32665] [client 52.236.80.95:65111] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maintura.php"] [unique_id "aeOUrkkxooM0iRo6e54vXQAAAg8"]
[Sat Apr 18 22:26:55.189897 2026] [:error] [pid 34288:tid 34306] [client 52.236.80.95:63108] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maintura.php"] [unique_id "aeOUr-TIiy__PtiLmpncNgAAAY4"]
[Sat Apr 18 22:26:55.734374 2026] [:error] [pid 32678:tid 32724] [client 52.236.80.95:65204] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maintura.php"] [unique_id "aeOUrxUlAXU_ZWUu5y8NKQAAApE"]
[Sat Apr 18 22:26:56.332673 2026] [:error] [pid 32678:tid 32712] [client 52.236.80.95:65142] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/RIP.php"] [unique_id "aeOUsBUlAXU_ZWUu5y8NLQAAAoU"]
[Sat Apr 18 22:26:57.632609 2026] [:error] [pid 32678:tid 32718] [client 52.236.80.95:65143] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/RIP.php"] [unique_id "aeOUsRUlAXU_ZWUu5y8NMwAAAos"]
[Sat Apr 18 22:26:58.596670 2026] [:error] [pid 9970:tid 9992] [client 52.236.80.95:64611] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/RIP.php"] [unique_id "aeOUsiYdRLRhVmaIMx3a9gAAANI"]
[Sat Apr 18 22:26:59.375649 2026] [:error] [pid 9864:tid 9915] [client 52.236.80.95:65128] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/RIP.php"] [unique_id "aeOUs4CFeowknfXHM7kvVAAAAEk"]
[Sat Apr 18 22:26:59.972892 2026] [:error] [pid 34290:tid 34325] [client 52.236.80.95:65212] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aeOUsxqX6WpmmAXOBi8qOwAAAcY"]
[Sat Apr 18 22:27:00.711990 2026] [:error] [pid 32647:tid 32664] [client 52.236.80.95:65169] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aeOUtEkxooM0iRo6e54vXgAAAg4"]
[Sat Apr 18 22:27:01.580215 2026] [:error] [pid 32678:tid 32708] [client 52.236.80.95:63071] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aeOUtRUlAXU_ZWUu5y8NOgAAAoE"]
[Sat Apr 18 22:27:02.333271 2026] [:error] [pid 32678:tid 32715] [client 52.236.80.95:64586] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aeOUthUlAXU_ZWUu5y8NPgAAAog"]
[Sat Apr 18 22:27:03.348630 2026] [:error] [pid 34290:tid 34340] [client 52.236.80.95:64667] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aeOUtxqX6WpmmAXOBi8qPgAAAdU"]
[Sat Apr 18 22:27:04.903918 2026] [:error] [pid 13023:tid 13037] [client 52.236.80.95:62609] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aeOUuP1e7hG8DAeABB84XwAAAQw"]
[Sat Apr 18 22:27:05.620976 2026] [:error] [pid 13023:tid 13034] [client 52.236.80.95:64062] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aeOUuf1e7hG8DAeABB84YgAAAQk"]
[Sat Apr 18 22:27:06.222128 2026] [:error] [pid 9970:tid 9991] [client 52.236.80.95:63615] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aeOUuiYdRLRhVmaIMx3a-gAAANE"]
[Sat Apr 18 22:27:06.744910 2026] [:error] [pid 9970:tid 9993] [client 52.236.80.95:64579] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sk25_1.php"] [unique_id "aeOUuiYdRLRhVmaIMx3a_AAAANM"]
[Sat Apr 18 22:27:07.703652 2026] [:error] [pid 32678:tid 32709] [client 52.236.80.95:64001] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sk25_1.php"] [unique_id "aeOUuxUlAXU_ZWUu5y8NSAAAAoI"]
[Sat Apr 18 22:27:08.357434 2026] [:error] [pid 13023:tid 13043] [client 52.236.80.95:60688] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sk25_1.php"] [unique_id "aeOUvP1e7hG8DAeABB84agAAARI"]
[Sat Apr 18 22:27:09.010108 2026] [:error] [pid 32678:tid 32726] [client 52.236.80.95:63606] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sk25_1.php"] [unique_id "aeOUvRUlAXU_ZWUu5y8NSQAAApM"]
[Sat Apr 18 22:27:09.591166 2026] [:error] [pid 9864:tid 9916] [client 52.236.80.95:60618] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BhqKs28Cw94.php"] [unique_id "aeOUvYCFeowknfXHM7kvXAAAAEo"]
[Sat Apr 18 22:27:10.228904 2026] [:error] [pid 9863:tid 9889] [client 52.236.80.95:63619] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BhqKs28Cw94.php"] [unique_id "aeOUvjjjiypiFrTucbLXzgAAABA"]
[Sat Apr 18 22:27:11.082749 2026] [:error] [pid 32647:tid 32656] [client 52.236.80.95:64594] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BhqKs28Cw94.php"] [unique_id "aeOUv0kxooM0iRo6e54vXwAAAgY"]
[Sat Apr 18 22:27:11.722888 2026] [:error] [pid 9863:tid 9892] [client 52.236.80.95:64608] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BhqKs28Cw94.php"] [unique_id "aeOUvzjjiypiFrTucbLX0QAAABM"]
[Sat Apr 18 22:27:12.390938 2026] [:error] [pid 32677:tid 32690] [client 52.236.80.95:61446] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/beerd.php"] [unique_id "aeOUwBngmUE3LdC-wP7tEwAAAko"]
[Sat Apr 18 22:27:12.934079 2026] [:error] [pid 9865:tid 9955] [client 52.236.80.95:63141] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/beerd.php"] [unique_id "aeOUwKzb5knECIY-C-ie4AAAAJI"]
[Sat Apr 18 22:27:13.739573 2026] [:error] [pid 9864:tid 9914] [client 52.236.80.95:61491] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/beerd.php"] [unique_id "aeOUwYCFeowknfXHM7kvYAAAAEg"]
[Sat Apr 18 22:27:14.461847 2026] [:error] [pid 13023:tid 13025] [client 52.236.80.95:62075] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/beerd.php"] [unique_id "aeOUwv1e7hG8DAeABB84bwAAAQA"]
[Sat Apr 18 22:27:15.113100 2026] [:error] [pid 9970:tid 9979] [client 52.236.80.95:65150] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3Cr1w6dfjTK.php"] [unique_id "aeOUwyYdRLRhVmaIMx3bEwAAAMU"]
[Sat Apr 18 22:27:15.834737 2026] [:error] [pid 9970:tid 9986] [client 52.236.80.95:62614] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3Cr1w6dfjTK.php"] [unique_id "aeOUwyYdRLRhVmaIMx3bGAAAAMw"]
[Sat Apr 18 22:27:16.504675 2026] [:error] [pid 9863:tid 9876] [client 52.236.80.95:63041] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3Cr1w6dfjTK.php"] [unique_id "aeOUxDjjiypiFrTucbLX1wAAAAM"]
[Sat Apr 18 22:27:17.435614 2026] [:error] [pid 9970:tid 9997] [client 52.236.80.95:63612] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3Cr1w6dfjTK.php"] [unique_id "aeOUxSYdRLRhVmaIMx3bIQAAANc"]
[Sat Apr 18 22:27:18.938494 2026] [:error] [pid 32647:tid 32652] [client 52.236.80.95:65174] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpb.php"] [unique_id "aeOUxkkxooM0iRo6e54vcAAAAgI"]
[Sat Apr 18 22:27:19.855706 2026] [:error] [pid 32647:tid 32666] [client 52.236.80.95:6166] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpb.php"] [unique_id "aeOUx0kxooM0iRo6e54vcgAAAhA"]
[Sat Apr 18 22:27:20.459485 2026] [:error] [pid 32647:tid 32658] [client 52.236.80.95:63106] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpb.php"] [unique_id "aeOUyEkxooM0iRo6e54vdgAAAgg"]
[Sat Apr 18 22:27:21.092385 2026] [:error] [pid 9864:tid 9919] [client 52.236.80.95:64655] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpb.php"] [unique_id "aeOUyYCFeowknfXHM7kvZgAAAE0"]
[Sat Apr 18 22:27:21.864993 2026] [:error] [pid 9864:tid 9912] [client 52.236.80.95:63154] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oircv.php"] [unique_id "aeOUyYCFeowknfXHM7kvaAAAAEY"]
[Sat Apr 18 22:27:22.521061 2026] [:error] [pid 9863:tid 9890] [client 52.236.80.95:63610] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oircv.php"] [unique_id "aeOUyjjjiypiFrTucbLX3QAAABE"]
[Sat Apr 18 22:27:23.920719 2026] [:error] [pid 13023:tid 13038] [client 52.236.80.95:63571] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oircv.php"] [unique_id "aeOUy_1e7hG8DAeABB84fgAAAQ0"]
[Sat Apr 18 22:27:24.753092 2026] [:error] [pid 9970:tid 9982] [client 52.236.80.95:64062] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oircv.php"] [unique_id "aeOUzCYdRLRhVmaIMx3bMwAAAMg"]
[Sat Apr 18 22:27:25.433741 2026] [:error] [pid 13023:tid 13028] [client 52.236.80.95:6160] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bfil.php"] [unique_id "aeOUzf1e7hG8DAeABB84hgAAAQM"]
[Sat Apr 18 22:27:26.112056 2026] [:error] [pid 32677:tid 32684] [client 52.236.80.95:64620] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bfil.php"] [unique_id "aeOUzhngmUE3LdC-wP7tIgAAAkQ"]
[Sat Apr 18 22:27:26.782048 2026] [:error] [pid 32677:tid 32693] [client 52.236.80.95:63636] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bfil.php"] [unique_id "aeOUzhngmUE3LdC-wP7tJwAAAk0"]
[Sat Apr 18 22:27:27.407622 2026] [:error] [pid 32647:tid 32665] [client 52.236.80.95:63152] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bfil.php"] [unique_id "aeOUz0kxooM0iRo6e54vggAAAg8"]
[Sat Apr 18 22:27:36.314711 2026] [:error] [pid 9865:tid 9938] [client 52.236.80.95:63956] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Spow_SRw.php"] [unique_id "aeOU2Kzb5knECIY-C-ifAgAAAIE"]
[Sat Apr 18 22:27:37.307661 2026] [:error] [pid 9970:tid 9986] [client 52.236.80.95:63609] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Spow_SRw.php"] [unique_id "aeOU2SYdRLRhVmaIMx3bVgAAAMw"]
[Sat Apr 18 22:27:38.476972 2026] [:error] [pid 9970:tid 9993] [client 52.236.80.95:65178] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Spow_SRw.php"] [unique_id "aeOU2iYdRLRhVmaIMx3bXAAAANM"]
[Sat Apr 18 22:27:39.417389 2026] [:error] [pid 13023:tid 13044] [client 52.236.80.95:63062] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Spow_SRw.php"] [unique_id "aeOU2_1e7hG8DAeABB84kQAAARM"]
[Sat Apr 18 22:27:40.268250 2026] [:error] [pid 13023:tid 13034] [client 52.236.80.95:6178] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blnux.php"] [unique_id "aeOU3P1e7hG8DAeABB84lwAAAQk"]
[Sat Apr 18 22:27:41.102677 2026] [:error] [pid 13023:tid 13046] [client 52.236.80.95:65182] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blnux.php"] [unique_id "aeOU3f1e7hG8DAeABB84nQAAARU"]
[Sat Apr 18 22:27:41.762906 2026] [:error] [pid 9970:tid 9983] [client 52.236.80.95:63113] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blnux.php"] [unique_id "aeOU3SYdRLRhVmaIMx3baQAAAMk"]
[Sat Apr 18 22:27:42.342830 2026] [:error] [pid 9970:tid 9996] [client 52.236.80.95:61426] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blnux.php"] [unique_id "aeOU3iYdRLRhVmaIMx3bbgAAANY"]
[Sat Apr 18 22:27:42.937996 2026] [:error] [pid 9970:tid 9986] [client 52.236.80.95:65115] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blqjs.php"] [unique_id "aeOU3iYdRLRhVmaIMx3bdAAAAMw"]
[Sat Apr 18 22:27:43.615573 2026] [:error] [pid 13023:tid 13035] [client 52.236.80.95:63146] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blqjs.php"] [unique_id "aeOU3_1e7hG8DAeABB84pQAAAQo"]
[Sat Apr 18 22:27:44.400160 2026] [:error] [pid 13023:tid 13036] [client 52.236.80.95:64583] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blqjs.php"] [unique_id "aeOU4P1e7hG8DAeABB84qwAAAQs"]
[Sat Apr 18 22:27:45.184456 2026] [:error] [pid 13023:tid 13027] [client 52.236.80.95:6173] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blqjs.php"] [unique_id "aeOU4f1e7hG8DAeABB84sQAAAQI"]
[Sat Apr 18 22:27:45.861349 2026] [:error] [pid 13023:tid 13043] [client 52.236.80.95:62587] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fyflv.php"] [unique_id "aeOU4f1e7hG8DAeABB84uQAAARI"]
[Sat Apr 18 22:27:46.395698 2026] [:error] [pid 13023:tid 13029] [client 52.236.80.95:63634] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fyflv.php"] [unique_id "aeOU4v1e7hG8DAeABB84vQAAAQQ"]
[Sat Apr 18 22:27:46.948363 2026] [:error] [pid 9970:tid 9978] [client 52.236.80.95:64683] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fyflv.php"] [unique_id "aeOU4iYdRLRhVmaIMx3beQAAAMQ"]
[Sat Apr 18 22:27:47.497693 2026] [:error] [pid 13023:tid 13032] [client 52.236.80.95:65157] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fyflv.php"] [unique_id "aeOU4_1e7hG8DAeABB84wQAAAQc"]
[Sat Apr 18 22:27:48.077869 2026] [:error] [pid 9864:tid 9930] [client 52.236.80.95:63058] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/iindv.php"] [unique_id "aeOU5ICFeowknfXHM7kvdAAAAFg"]
[Sat Apr 18 22:27:48.682000 2026] [:error] [pid 34288:tid 34306] [client 52.236.80.95:63044] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/iindv.php"] [unique_id "aeOU5OTIiy__PtiLmpncQgAAAY4"]
[Sat Apr 18 22:27:49.237250 2026] [:error] [pid 13023:tid 13041] [client 52.236.80.95:63101] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/iindv.php"] [unique_id "aeOU5f1e7hG8DAeABB84xQAAARA"]
[Sat Apr 18 22:27:49.790541 2026] [:error] [pid 9865:tid 9937] [client 52.236.80.95:65154] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/iindv.php"] [unique_id "aeOU5azb5knECIY-C-ifBQAAAIA"]
[Sat Apr 18 22:27:50.326020 2026] [:error] [pid 32647:tid 32665] [client 52.236.80.95:63970] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wkogn.php"] [unique_id "aeOU5kkxooM0iRo6e54viQAAAg8"]
[Sat Apr 18 22:27:50.881690 2026] [:error] [pid 32647:tid 32653] [client 52.236.80.95:64692] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wkogn.php"] [unique_id "aeOU5kkxooM0iRo6e54vjAAAAgM"]
[Sat Apr 18 22:27:51.449372 2026] [:error] [pid 9865:tid 9948] [client 52.236.80.95:63042] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wkogn.php"] [unique_id "aeOU56zb5knECIY-C-ifCgAAAIs"]
[Sat Apr 18 22:27:51.950389 2026] [:error] [pid 9865:tid 9942] [client 52.236.80.95:63090] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wkogn.php"] [unique_id "aeOU56zb5knECIY-C-ifDwAAAIU"]
[Sat Apr 18 22:27:52.591413 2026] [:error] [pid 9970:tid 9979] [client 52.236.80.95:63132] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wwdgl.php"] [unique_id "aeOU6CYdRLRhVmaIMx3bgAAAAMU"]
[Sat Apr 18 22:27:53.167073 2026] [:error] [pid 9863:tid 9884] [client 52.236.80.95:65198] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wwdgl.php"] [unique_id "aeOU6TjjiypiFrTucbLX4wAAAAs"]
[Sat Apr 18 22:27:53.727275 2026] [:error] [pid 32678:tid 32720] [client 52.236.80.95:60611] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wwdgl.php"] [unique_id "aeOU6RUlAXU_ZWUu5y8NWAAAAo0"]
[Sat Apr 18 22:27:54.374133 2026] [:error] [pid 32677:tid 32684] [client 52.236.80.95:64669] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wwdgl.php"] [unique_id "aeOU6hngmUE3LdC-wP7tPAAAAkQ"]
[Sat Apr 18 22:27:54.957479 2026] [:error] [pid 9970:tid 9983] [client 52.236.80.95:65103] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wxeyc.php"] [unique_id "aeOU6iYdRLRhVmaIMx3bjQAAAMk"]
[Sat Apr 18 22:27:55.503581 2026] [:error] [pid 9970:tid 9991] [client 52.236.80.95:63167] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wxeyc.php"] [unique_id "aeOU6yYdRLRhVmaIMx3blAAAANE"]
[Sat Apr 18 22:27:56.141898 2026] [:error] [pid 32647:tid 32669] [client 52.236.80.95:63936] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wxeyc.php"] [unique_id "aeOU7EkxooM0iRo6e54vkgAAAhM"]
[Sat Apr 18 22:27:56.724463 2026] [:error] [pid 9863:tid 9874] [client 52.236.80.95:62074] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wxeyc.php"] [unique_id "aeOU7DjjiypiFrTucbLX6gAAAAE"]
[Sat Apr 18 22:27:57.338743 2026] [:error] [pid 13023:tid 13049] [client 52.236.80.95:63957] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxiviLDIot.php"] [unique_id "aeOU7f1e7hG8DAeABB84zAAAARg"]
[Sat Apr 18 22:27:57.940526 2026] [:error] [pid 32677:tid 32686] [client 52.236.80.95:65161] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxiviLDIot.php"] [unique_id "aeOU7RngmUE3LdC-wP7tPgAAAkY"]
[Sat Apr 18 22:27:58.464394 2026] [:error] [pid 9970:tid 9986] [client 52.236.80.95:64692] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxiviLDIot.php"] [unique_id "aeOU7iYdRLRhVmaIMx3bmAAAAMw"]
[Sat Apr 18 22:27:59.258607 2026] [:error] [pid 9970:tid 9989] [client 52.236.80.95:63633] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxiviLDIot.php"] [unique_id "aeOU7yYdRLRhVmaIMx3bnQAAAM8"]
[Sat Apr 18 22:27:59.879893 2026] [:error] [pid 9970:tid 9977] [client 52.236.80.95:60102] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxivicLhot.php"] [unique_id "aeOU7yYdRLRhVmaIMx3boAAAAMM"]
[Sat Apr 18 22:28:00.599312 2026] [:error] [pid 9970:tid 9995] [client 52.236.80.95:62622] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxivicLhot.php"] [unique_id "aeOU8CYdRLRhVmaIMx3bpAAAANU"]
[Sat Apr 18 22:28:01.426186 2026] [:error] [pid 9865:tid 9948] [client 52.236.80.95:65209] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxivicLhot.php"] [unique_id "aeOU8azb5knECIY-C-ifFgAAAIs"]
[Sat Apr 18 22:28:02.188182 2026] [:error] [pid 32677:tid 32681] [client 52.236.80.95:62635] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxivicLhot.php"] [unique_id "aeOU8hngmUE3LdC-wP7tQgAAAkE"]
[Sat Apr 18 22:28:03.078179 2026] [:error] [pid 32677:tid 32690] [client 52.236.80.95:63069] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3akp.php"] [unique_id "aeOU8xngmUE3LdC-wP7tRQAAAko"]
[Sat Apr 18 22:28:03.619399 2026] [:error] [pid 32677:tid 32688] [client 52.236.80.95:63949] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3akp.php"] [unique_id "aeOU8xngmUE3LdC-wP7tSgAAAkg"]
[Sat Apr 18 22:28:04.401857 2026] [:error] [pid 9970:tid 9992] [client 52.236.80.95:6150] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3akp.php"] [unique_id "aeOU9CYdRLRhVmaIMx3btAAAANI"]
[Sat Apr 18 22:28:05.114578 2026] [:error] [pid 9970:tid 9976] [client 52.236.80.95:64035] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3akp.php"] [unique_id "aeOU9SYdRLRhVmaIMx3btwAAAMI"]
[Sat Apr 18 22:28:05.678033 2026] [:error] [pid 9970:tid 9989] [client 52.236.80.95:63136] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sde.php"] [unique_id "aeOU9SYdRLRhVmaIMx3bvAAAAM8"]
[Sat Apr 18 22:28:06.275951 2026] [:error] [pid 32677:tid 32687] [client 52.236.80.95:64061] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sde.php"] [unique_id "aeOU9hngmUE3LdC-wP7tUQAAAkc"]
[Sat Apr 18 22:28:06.856120 2026] [:error] [pid 32647:tid 32651] [client 52.236.80.95:65172] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sde.php"] [unique_id "aeOU9kkxooM0iRo6e54vnAAAAgE"]
[Sat Apr 18 22:28:07.355664 2026] [:error] [pid 34288:tid 34298] [client 52.236.80.95:60612] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sde.php"] [unique_id "aeOU9-TIiy__PtiLmpncRgAAAYY"]
[Sat Apr 18 22:28:07.946090 2026] [:error] [pid 34288:tid 34304] [client 52.236.80.95:65214] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cdn3.php"] [unique_id "aeOU9-TIiy__PtiLmpncSAAAAYw"]
[Sat Apr 18 22:28:08.479981 2026] [:error] [pid 34288:tid 34312] [client 52.236.80.95:63048] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cdn3.php"] [unique_id "aeOU-OTIiy__PtiLmpncTAAAAZQ"]
[Sat Apr 18 22:28:08.983780 2026] [:error] [pid 32678:tid 32711] [client 52.236.80.95:63976] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cdn3.php"] [unique_id "aeOU-BUlAXU_ZWUu5y8NYgAAAoQ"]
[Sat Apr 18 22:28:09.668430 2026] [:error] [pid 32647:tid 32655] [client 52.236.80.95:63612] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cdn3.php"] [unique_id "aeOU-UkxooM0iRo6e54voAAAAgU"]
[Sat Apr 18 22:28:10.404416 2026] [:error] [pid 32678:tid 32722] [client 52.236.80.95:63651] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "aeOU-hUlAXU_ZWUu5y8NZgAAAo8"]
[Sat Apr 18 22:28:11.020639 2026] [:error] [pid 32678:tid 32713] [client 52.236.80.95:63105] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "aeOU-xUlAXU_ZWUu5y8NaQAAAoY"]
[Sat Apr 18 22:28:11.536545 2026] [:error] [pid 9865:tid 9949] [client 52.236.80.95:60172] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "aeOU-6zb5knECIY-C-ifGgAAAIw"]
[Sat Apr 18 22:28:12.037673 2026] [:error] [pid 32677:tid 32696] [client 52.236.80.95:64019] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "aeOU_BngmUE3LdC-wP7tWwAAAlA"]
[Sat Apr 18 22:28:12.585950 2026] [:error] [pid 32677:tid 32699] [client 52.236.80.95:65092] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-220.php"] [unique_id "aeOU_BngmUE3LdC-wP7tXQAAAlM"]
[Sat Apr 18 22:28:13.086801 2026] [:error] [pid 9864:tid 9922] [client 52.236.80.95:62651] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-220.php"] [unique_id "aeOU_YCFeowknfXHM7kvegAAAFA"]
[Sat Apr 18 22:28:13.647558 2026] [:error] [pid 32677:tid 32703] [client 52.236.80.95:63594] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-220.php"] [unique_id "aeOU_RngmUE3LdC-wP7tXwAAAlc"]
[Sat Apr 18 22:28:14.243791 2026] [:error] [pid 32677:tid 32681] [client 52.236.80.95:6171] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-220.php"] [unique_id "aeOU_hngmUE3LdC-wP7tYAAAAkE"]
[Sat Apr 18 22:28:14.835087 2026] [:error] [pid 32677:tid 32689] [client 52.236.80.95:63163] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "aeOU_hngmUE3LdC-wP7tYgAAAkk"]
[Sat Apr 18 22:28:15.366411 2026] [:error] [pid 13023:tid 13029] [client 52.236.80.95:63982] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "aeOU__1e7hG8DAeABB842AAAAQQ"]
[Sat Apr 18 22:28:16.617344 2026] [:error] [pid 9865:tid 9959] [client 52.236.80.95:63116] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "aeOVAKzb5knECIY-C-ifHwAAAJY"]
[Sat Apr 18 22:28:17.170322 2026] [:error] [pid 34290:tid 34337] [client 52.236.80.95:63558] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "aeOVARqX6WpmmAXOBi8qWQAAAdI"]
[Sat Apr 18 22:28:17.996399 2026] [:error] [pid 13023:tid 13048] [client 52.236.80.95:65151] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uazsl.php"] [unique_id "aeOVAf1e7hG8DAeABB843QAAARc"]
[Sat Apr 18 22:28:18.603867 2026] [:error] [pid 32678:tid 32707] [client 52.236.80.95:65100] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uazsl.php"] [unique_id "aeOVAhUlAXU_ZWUu5y8NfgAAAoA"]
[Sat Apr 18 22:28:19.322497 2026] [:error] [pid 13023:tid 13038] [client 52.236.80.95:63050] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uazsl.php"] [unique_id "aeOVA_1e7hG8DAeABB844gAAAQ0"]
[Sat Apr 18 22:28:19.890899 2026] [:error] [pid 13023:tid 13028] [client 52.236.80.95:63621] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uazsl.php"] [unique_id "aeOVA_1e7hG8DAeABB845QAAAQM"]
[Sat Apr 18 22:28:20.849406 2026] [:error] [pid 13023:tid 13036] [client 52.236.80.95:65207] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/saorix1.php"] [unique_id "aeOVBP1e7hG8DAeABB845wAAAQs"]
[Sat Apr 18 22:28:21.540941 2026] [:error] [pid 34290:tid 34323] [client 52.236.80.95:64660] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/saorix1.php"] [unique_id "aeOVBRqX6WpmmAXOBi8qWwAAAcQ"]
[Sat Apr 18 22:28:22.173466 2026] [:error] [pid 13023:tid 13032] [client 52.236.80.95:62050] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/saorix1.php"] [unique_id "aeOVBv1e7hG8DAeABB846QAAAQc"]
[Sat Apr 18 22:28:22.734763 2026] [:error] [pid 34290:tid 34319] [client 52.236.80.95:62580] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/saorix1.php"] [unique_id "aeOVBhqX6WpmmAXOBi8qXAAAAcA"]
[Sat Apr 18 22:28:23.702007 2026] [:error] [pid 13023:tid 13025] [client 52.236.80.95:63047] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-denmono.php"] [unique_id "aeOVB_1e7hG8DAeABB847AAAAQA"]
[Sat Apr 18 22:28:24.736929 2026] [:error] [pid 13023:tid 13028] [client 52.236.80.95:65187] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-denmono.php"] [unique_id "aeOVCP1e7hG8DAeABB848wAAAQM"]
[Sat Apr 18 22:28:25.526338 2026] [:error] [pid 13023:tid 13030] [client 52.236.80.95:65153] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-denmono.php"] [unique_id "aeOVCf1e7hG8DAeABB849wAAAQU"]
[Sat Apr 18 22:28:26.180322 2026] [:error] [pid 13023:tid 13042] [client 52.236.80.95:63623] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-denmono.php"] [unique_id "aeOVCv1e7hG8DAeABB84-gAAARE"]
[Sat Apr 18 22:28:26.901942 2026] [:error] [pid 9865:tid 9937] [client 52.236.80.95:63569] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aeOVCqzb5knECIY-C-ifKgAAAIA"]
[Sat Apr 18 22:28:27.573430 2026] [:error] [pid 9865:tid 9943] [client 52.236.80.95:64687] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aeOVC6zb5knECIY-C-ifLwAAAIY"]
[Sat Apr 18 22:28:28.403621 2026] [:error] [pid 9863:tid 9897] [client 52.236.80.95:64614] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aeOVDDjjiypiFrTucbLX-AAAABg"]
[Sat Apr 18 22:28:29.441019 2026] [:error] [pid 34288:tid 34312] [client 52.236.80.95:64033] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aeOVDeTIiy__PtiLmpncVgAAAZQ"]
[Sat Apr 18 22:28:30.156270 2026] [:error] [pid 34288:tid 34296] [client 52.236.80.95:65144] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bypltspd.php"] [unique_id "aeOVDuTIiy__PtiLmpncWgAAAYQ"]
[Sat Apr 18 22:28:30.696666 2026] [:error] [pid 9864:tid 9907] [client 52.236.80.95:63560] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bypltspd.php"] [unique_id "aeOVDoCFeowknfXHM7kvfgAAAEI"]
[Sat Apr 18 22:28:31.266581 2026] [:error] [pid 13023:tid 13048] [client 52.236.80.95:63991] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bypltspd.php"] [unique_id "aeOVD_1e7hG8DAeABB84_gAAARc"]
[Sat Apr 18 22:28:31.783715 2026] [:error] [pid 32677:tid 32694] [client 52.236.80.95:65201] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bypltspd.php"] [unique_id "aeOVDxngmUE3LdC-wP7tawAAAk4"]
[Sat Apr 18 22:28:32.333433 2026] [:error] [pid 32647:tid 32657] [client 52.236.80.95:63557] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yee.php"] [unique_id "aeOVEEkxooM0iRo6e54vtQAAAgc"]
[Sat Apr 18 22:28:32.907607 2026] [:error] [pid 32677:tid 32687] [client 52.236.80.95:65108] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yee.php"] [unique_id "aeOVEBngmUE3LdC-wP7tdAAAAkc"]
[Sat Apr 18 22:28:33.507572 2026] [:error] [pid 32677:tid 32683] [client 52.236.80.95:60658] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yee.php"] [unique_id "aeOVERngmUE3LdC-wP7tegAAAkM"]
[Sat Apr 18 22:28:34.153456 2026] [:error] [pid 32677:tid 32688] [client 52.236.80.95:63944] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yee.php"] [unique_id "aeOVEhngmUE3LdC-wP7tfgAAAkg"]
[Sat Apr 18 22:28:34.753517 2026] [:error] [pid 9865:tid 9961] [client 52.236.80.95:64662] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/userfuns.php"] [unique_id "aeOVEqzb5knECIY-C-ifOwAAAJg"]
[Sat Apr 18 22:29:30.994199 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:63629] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fss.php"] [unique_id "aeOVSv1e7hG8DAeABB85eQAAAQE"]
[Sat Apr 18 22:33:24.369167 2026] [:error] [pid 9865:tid 9951] [client 141.95.19.158:39522] [client 141.95.19.158] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 141.95.19.158, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeOWNKzb5knECIY-C-igcAAAAI4"]
[Sat Apr 18 22:36:44.299247 2026] [:error] [pid 13023:tid 13048] [client 37.157.193.125:59740] [client 37.157.193.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.157.193.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeOW_P1e7hG8DAeABB88nQAAARc"]
[Sat Apr 18 22:36:46.059218 2026] [:error] [pid 13023:tid 13044] [client 37.157.193.125:59740] [client 37.157.193.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.157.193.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeOW_v1e7hG8DAeABB88ngAAARM"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 18 22:39:42.770989 2026] [:error] [pid 13023:tid 13042] [client 52.236.80.95:65173] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eursi.php"] [unique_id "aeOXrv1e7hG8DAeABB89ogAAARE"]
[Sat Apr 18 22:39:44.059757 2026] [:error] [pid 13023:tid 13032] [client 52.236.80.95:65106] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eursi.php"] [unique_id "aeOXsP1e7hG8DAeABB89pQAAAQc"]
[Sat Apr 18 22:39:47.897546 2026] [:error] [pid 32647:tid 32653] [client 52.236.80.95:63982] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eursi.php"] [unique_id "aeOXs0kxooM0iRo6e54xPAAAAgM"]
[Sat Apr 18 22:39:51.571247 2026] [:error] [pid 32647:tid 32668] [client 52.236.80.95:65176] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eursi.php"] [unique_id "aeOXt0kxooM0iRo6e54xVAAAAhI"]
[Sat Apr 18 22:39:55.053856 2026] [:error] [pid 32677:tid 32682] [client 52.236.80.95:63586] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gkojz.php"] [unique_id "aeOXuxngmUE3LdC-wP7vegAAAkI"]
[Sat Apr 18 22:39:56.216356 2026] [:error] [pid 32647:tid 32666] [client 52.236.80.95:63558] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gkojz.php"] [unique_id "aeOXvEkxooM0iRo6e54xVQAAAhA"]
[Sat Apr 18 22:39:57.032458 2026] [:error] [pid 32647:tid 32650] [client 52.236.80.95:63138] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gkojz.php"] [unique_id "aeOXvUkxooM0iRo6e54xWAAAAgA"]
[Sat Apr 18 22:39:57.791067 2026] [:error] [pid 32647:tid 32663] [client 52.236.80.95:65135] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gkojz.php"] [unique_id "aeOXvUkxooM0iRo6e54xWQAAAg0"]
[Sat Apr 18 22:39:58.343662 2026] [:error] [pid 9970:tid 9978] [client 52.236.80.95:64591] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/isvqf.php"] [unique_id "aeOXviYdRLRhVmaIMx3fmAAAAMQ"]
[Sat Apr 18 22:39:58.971746 2026] [:error] [pid 9970:tid 9986] [client 52.236.80.95:64693] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/isvqf.php"] [unique_id "aeOXviYdRLRhVmaIMx3fmQAAAMw"]
[Sat Apr 18 22:39:59.565760 2026] [:error] [pid 9970:tid 9990] [client 52.236.80.95:65091] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/isvqf.php"] [unique_id "aeOXvyYdRLRhVmaIMx3fmwAAANA"]
[Sat Apr 18 22:40:00.162204 2026] [:error] [pid 9970:tid 9991] [client 52.236.80.95:64004] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/isvqf.php"] [unique_id "aeOXwCYdRLRhVmaIMx3fngAAANE"]
[Sat Apr 18 22:40:00.940020 2026] [:error] [pid 9970:tid 9979] [client 52.236.80.95:63124] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ppxhp.php"] [unique_id "aeOXwCYdRLRhVmaIMx3foAAAAMU"]
[Sat Apr 18 22:40:01.658172 2026] [:error] [pid 13023:tid 13045] [client 52.236.80.95:63605] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ppxhp.php"] [unique_id "aeOXwf1e7hG8DAeABB891AAAARQ"]
[Sat Apr 18 22:40:02.695718 2026] [:error] [pid 32678:tid 32713] [client 52.236.80.95:6200] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ppxhp.php"] [unique_id "aeOXwhUlAXU_ZWUu5y8PvwAAAoY"]
[Sat Apr 18 22:40:03.359120 2026] [:error] [pid 34290:tid 34337] [client 52.236.80.95:63584] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ppxhp.php"] [unique_id "aeOXwxqX6WpmmAXOBi8rqAAAAdI"]
[Sat Apr 18 22:40:03.967933 2026] [:error] [pid 9864:tid 9910] [client 52.236.80.95:63983] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/whtrq.php"] [unique_id "aeOXw4CFeowknfXHM7kxPwAAAEU"]
[Sat Apr 18 22:40:04.541231 2026] [:error] [pid 34290:tid 34338] [client 52.236.80.95:63567] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/whtrq.php"] [unique_id "aeOXxBqX6WpmmAXOBi8rqQAAAdM"]
[Sat Apr 18 22:40:05.152331 2026] [:error] [pid 9970:tid 9995] [client 52.236.80.95:64650] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/whtrq.php"] [unique_id "aeOXxSYdRLRhVmaIMx3fogAAANU"]
[Sat Apr 18 22:40:05.893268 2026] [:error] [pid 32647:tid 32652] [client 52.236.80.95:63647] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/whtrq.php"] [unique_id "aeOXxUkxooM0iRo6e54xWgAAAgI"]
[Sat Apr 18 22:40:06.505590 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:6157] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rkiea.php"] [unique_id "aeOXxv1e7hG8DAeABB892wAAAQE"]
[Sat Apr 18 22:40:07.143628 2026] [:error] [pid 9865:tid 9948] [client 52.236.80.95:63954] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rkiea.php"] [unique_id "aeOXx6zb5knECIY-C-ih2gAAAIs"]
[Sat Apr 18 22:40:07.728169 2026] [:error] [pid 9865:tid 9942] [client 52.236.80.95:65211] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rkiea.php"] [unique_id "aeOXx6zb5knECIY-C-ih3AAAAIU"]
[Sat Apr 18 22:40:08.320125 2026] [:error] [pid 32678:tid 32731] [client 52.236.80.95:64051] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rkiea.php"] [unique_id "aeOXyBUlAXU_ZWUu5y8PwgAAApg"]
[Sat Apr 18 22:40:08.916082 2026] [:error] [pid 9970:tid 9994] [client 52.236.80.95:64641] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ckk.php"] [unique_id "aeOXyCYdRLRhVmaIMx3fpQAAANQ"]
[Sat Apr 18 22:40:09.665918 2026] [:error] [pid 9865:tid 9945] [client 52.236.80.95:64041] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ckk.php"] [unique_id "aeOXyazb5knECIY-C-ih3QAAAIg"]
[Sat Apr 18 22:40:10.274435 2026] [:error] [pid 13023:tid 13045] [client 52.236.80.95:63959] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ckk.php"] [unique_id "aeOXyv1e7hG8DAeABB894gAAARQ"]
[Sat Apr 18 22:40:10.902382 2026] [:error] [pid 13023:tid 13032] [client 52.236.80.95:65143] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ckk.php"] [unique_id "aeOXyv1e7hG8DAeABB895QAAAQc"]
[Sat Apr 18 22:40:11.502562 2026] [:error] [pid 13023:tid 13040] [client 52.236.80.95:6172] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "aeOXy_1e7hG8DAeABB895wAAAQ8"]
[Sat Apr 18 22:40:12.038060 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:65109] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "aeOXzP1e7hG8DAeABB896AAAAQE"]
[Sat Apr 18 22:40:12.619748 2026] [:error] [pid 13023:tid 13039] [client 52.236.80.95:63579] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "aeOXzP1e7hG8DAeABB896gAAAQ4"]
[Sat Apr 18 22:40:13.175754 2026] [:error] [pid 13023:tid 13033] [client 52.236.80.95:6173] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/baixy.php"] [unique_id "aeOXzf1e7hG8DAeABB896wAAAQg"]
[Sat Apr 18 22:40:13.722706 2026] [:error] [pid 32678:tid 32730] [client 52.236.80.95:65123] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8xyz.php"] [unique_id "aeOXzRUlAXU_ZWUu5y8PyAAAApc"]
[Sat Apr 18 22:40:14.595571 2026] [:error] [pid 32677:tid 32703] [client 52.236.80.95:63626] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8xyz.php"] [unique_id "aeOXzhngmUE3LdC-wP7vfQAAAlc"]
[Sat Apr 18 22:40:15.606779 2026] [:error] [pid 13023:tid 13045] [client 52.236.80.95:65156] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8xyz.php"] [unique_id "aeOXz_1e7hG8DAeABB897QAAARQ"]
[Sat Apr 18 22:40:16.782838 2026] [:error] [pid 13023:tid 13047] [client 52.236.80.95:63595] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8xyz.php"] [unique_id "aeOX0P1e7hG8DAeABB898AAAARY"]
[Sat Apr 18 22:40:17.968746 2026] [:error] [pid 13023:tid 13040] [client 52.236.80.95:63668] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/106.php"] [unique_id "aeOX0f1e7hG8DAeABB899AAAAQ8"]
[Sat Apr 18 22:40:18.565398 2026] [:error] [pid 13023:tid 13048] [client 52.236.80.95:64692] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/106.php"] [unique_id "aeOX0v1e7hG8DAeABB899QAAARc"]
[Sat Apr 18 22:40:19.164816 2026] [:error] [pid 9864:tid 9926] [client 52.236.80.95:65158] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/106.php"] [unique_id "aeOX04CFeowknfXHM7kxQgAAAFQ"]
[Sat Apr 18 22:40:19.750431 2026] [:error] [pid 9970:tid 9983] [client 52.236.80.95:65188] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/106.php"] [unique_id "aeOX0yYdRLRhVmaIMx3fsQAAAMk"]
[Sat Apr 18 22:40:20.255427 2026] [:error] [pid 13023:tid 13038] [client 52.236.80.95:64606] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aeOX1P1e7hG8DAeABB89-QAAAQ0"]
[Sat Apr 18 22:40:20.821759 2026] [:error] [pid 13023:tid 13049] [client 52.236.80.95:63645] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aeOX1P1e7hG8DAeABB89-gAAARg"]
[Sat Apr 18 22:40:21.428869 2026] [:error] [pid 13023:tid 13028] [client 52.236.80.95:64690] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aeOX1f1e7hG8DAeABB89_QAAAQM"]
[Sat Apr 18 22:40:22.015852 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:6167] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aeOX1v1e7hG8DAeABB8-AAAAAQE"]
[Sat Apr 18 22:40:22.573319 2026] [:error] [pid 13023:tid 13048] [client 52.236.80.95:63617] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cwclass.php"] [unique_id "aeOX1v1e7hG8DAeABB8-AgAAARc"]
[Sat Apr 18 22:40:23.120960 2026] [:error] [pid 9970:tid 9977] [client 52.236.80.95:62133] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cwclass.php"] [unique_id "aeOX1yYdRLRhVmaIMx3ftQAAAMM"]
[Sat Apr 18 22:40:23.749634 2026] [:error] [pid 32677:tid 32681] [client 52.236.80.95:64680] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cwclass.php"] [unique_id "aeOX1xngmUE3LdC-wP7vfgAAAkE"]
[Sat Apr 18 22:40:24.305635 2026] [:error] [pid 9970:tid 9985] [client 52.236.80.95:6193] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cwclass.php"] [unique_id "aeOX2CYdRLRhVmaIMx3ftgAAAMs"]
[Sat Apr 18 22:40:24.994379 2026] [:error] [pid 9970:tid 9980] [client 52.236.80.95:6168] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aeOX2CYdRLRhVmaIMx3ftwAAAMY"]
[Sat Apr 18 22:40:25.556122 2026] [:error] [pid 9970:tid 9997] [client 52.236.80.95:64684] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aeOX2SYdRLRhVmaIMx3fvAAAANc"]
[Sat Apr 18 22:40:26.128091 2026] [:error] [pid 9970:tid 9978] [client 52.236.80.95:63049] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aeOX2iYdRLRhVmaIMx3fwAAAAMQ"]
[Sat Apr 18 22:40:26.701147 2026] [:error] [pid 9864:tid 9905] [client 52.236.80.95:63961] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "aeOX2oCFeowknfXHM7kxSQAAAEA"]
[Sat Apr 18 22:40:27.256120 2026] [:error] [pid 9864:tid 9927] [client 52.236.80.95:60702] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/41.php"] [unique_id "aeOX24CFeowknfXHM7kxSwAAAFU"]
[Sat Apr 18 22:40:27.847352 2026] [:error] [pid 13023:tid 13045] [client 52.236.80.95:64063] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/41.php"] [unique_id "aeOX2_1e7hG8DAeABB8-BgAAARQ"]
[Sat Apr 18 22:40:28.438070 2026] [:error] [pid 9865:tid 9951] [client 52.236.80.95:62093] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/41.php"] [unique_id "aeOX3Kzb5knECIY-C-ih3gAAAI4"]
[Sat Apr 18 22:40:28.973555 2026] [:error] [pid 9864:tid 9921] [client 52.236.80.95:63652] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/41.php"] [unique_id "aeOX3ICFeowknfXHM7kxTgAAAE8"]
[Sat Apr 18 22:40:29.478611 2026] [:error] [pid 9970:tid 9974] [client 52.236.80.95:63110] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "aeOX3SYdRLRhVmaIMx3fxwAAAMA"]
[Sat Apr 18 22:40:30.026291 2026] [:error] [pid 9970:tid 9992] [client 52.236.80.95:63651] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "aeOX3iYdRLRhVmaIMx3fyAAAANI"]
[Sat Apr 18 22:40:30.567196 2026] [:error] [pid 32647:tid 32669] [client 52.236.80.95:63560] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "aeOX3kkxooM0iRo6e54xXwAAAhM"]
[Sat Apr 18 22:40:31.145762 2026] [:error] [pid 9865:tid 9954] [client 52.236.80.95:63666] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "aeOX36zb5knECIY-C-ih4QAAAJE"]
[Sat Apr 18 22:40:31.707799 2026] [:error] [pid 32678:tid 32714] [client 52.236.80.95:64659] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aeOX3xUlAXU_ZWUu5y8PzAAAAoc"]
[Sat Apr 18 22:40:32.248517 2026] [:error] [pid 32677:tid 32687] [client 52.236.80.95:65088] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aeOX4BngmUE3LdC-wP7vgAAAAkc"]
[Sat Apr 18 22:40:32.779027 2026] [:error] [pid 9865:tid 9955] [client 52.236.80.95:6152] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aeOX4Kzb5knECIY-C-ih4wAAAJI"]
[Sat Apr 18 22:40:33.301582 2026] [:error] [pid 32647:tid 32661] [client 52.236.80.95:64030] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "aeOX4UkxooM0iRo6e54xYAAAAgs"]
[Sat Apr 18 22:40:33.806926 2026] [:error] [pid 32678:tid 32731] [client 52.236.80.95:64611] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aeOX4RUlAXU_ZWUu5y8PzgAAApg"]
[Sat Apr 18 22:40:34.321472 2026] [:error] [pid 34288:tid 34297] [client 52.236.80.95:63622] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aeOX4uTIiy__PtiLmpnddgAAAYU"]
[Sat Apr 18 22:40:34.849974 2026] [:error] [pid 32678:tid 32712] [client 52.236.80.95:6147] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aeOX4hUlAXU_ZWUu5y8P0AAAAoU"]
[Sat Apr 18 22:40:35.367098 2026] [:error] [pid 34288:tid 34316] [client 52.236.80.95:63158] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aeOX4-TIiy__PtiLmpnddwAAAZg"]
[Sat Apr 18 22:40:35.889049 2026] [:error] [pid 32677:tid 32701] [client 52.236.80.95:64664] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mjq.php"] [unique_id "aeOX4xngmUE3LdC-wP7vggAAAlU"]
[Sat Apr 18 22:40:36.429974 2026] [:error] [pid 9865:tid 9953] [client 52.236.80.95:65199] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mjq.php"] [unique_id "aeOX5Kzb5knECIY-C-ih5gAAAJA"]
[Sat Apr 18 22:40:36.944103 2026] [:error] [pid 9864:tid 9928] [client 52.236.80.95:63574] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mjq.php"] [unique_id "aeOX5ICFeowknfXHM7kxXQAAAFY"]
[Sat Apr 18 22:40:37.521604 2026] [:error] [pid 9865:tid 9960] [client 52.236.80.95:64037] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mjq.php"] [unique_id "aeOX5azb5knECIY-C-ih5wAAAJc"]
[Sat Apr 18 22:40:38.057379 2026] [:error] [pid 9864:tid 9917] [client 52.236.80.95:64049] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zu.php"] [unique_id "aeOX5oCFeowknfXHM7kxYQAAAEs"]
[Sat Apr 18 22:40:38.600971 2026] [:error] [pid 9865:tid 9942] [client 52.236.80.95:65105] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zu.php"] [unique_id "aeOX5qzb5knECIY-C-ih6QAAAIU"]
[Sat Apr 18 22:40:39.138463 2026] [:error] [pid 9865:tid 9951] [client 52.236.80.95:65119] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zu.php"] [unique_id "aeOX56zb5knECIY-C-ih6gAAAI4"]
[Sat Apr 18 22:40:39.644006 2026] [:error] [pid 9865:tid 9946] [client 52.236.80.95:63658] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zu.php"] [unique_id "aeOX56zb5knECIY-C-ih7QAAAIk"]
[Sat Apr 18 22:40:40.153309 2026] [:error] [pid 9865:tid 9954] [client 52.236.80.95:63552] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws53.php"] [unique_id "aeOX6Kzb5knECIY-C-ih8AAAAJE"]
[Sat Apr 18 22:40:40.684663 2026] [:error] [pid 9865:tid 9955] [client 52.236.80.95:63160] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws53.php"] [unique_id "aeOX6Kzb5knECIY-C-ih8QAAAJI"]
[Sat Apr 18 22:40:51.014184 2026] [:error] [pid 9865:tid 9952] [client 52.236.80.95:63971] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/users.php"] [unique_id "aeOX86zb5knECIY-C-iiAwAAAI8"]
[Sat Apr 18 22:40:51.748750 2026] [:error] [pid 32678:tid 32717] [client 52.236.80.95:6160] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/users.php"] [unique_id "aeOX8xUlAXU_ZWUu5y8P1wAAAoo"]
[Sat Apr 18 22:40:52.361643 2026] [:error] [pid 32678:tid 32715] [client 52.236.80.95:64600] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/users.php"] [unique_id "aeOX9BUlAXU_ZWUu5y8P2QAAAog"]
[Sat Apr 18 22:40:52.968926 2026] [:error] [pid 34290:tid 34325] [client 52.236.80.95:65118] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/users.php"] [unique_id "aeOX9BqX6WpmmAXOBi8rwwAAAcY"]
[Sat Apr 18 22:40:53.475744 2026] [:error] [pid 32678:tid 32713] [client 52.236.80.95:65161] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftde.php"] [unique_id "aeOX9RUlAXU_ZWUu5y8P3AAAAoY"]
[Sat Apr 18 22:40:53.999628 2026] [:error] [pid 34290:tid 34320] [client 52.236.80.95:65151] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftde.php"] [unique_id "aeOX9RqX6WpmmAXOBi8rxAAAAcE"]
[Sat Apr 18 22:40:54.570953 2026] [:error] [pid 9864:tid 9910] [client 52.236.80.95:63580] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftde.php"] [unique_id "aeOX9oCFeowknfXHM7kxYwAAAEU"]
[Sat Apr 18 22:40:55.663734 2026] [:error] [pid 32677:tid 32686] [client 52.236.80.95:64624] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftde.php"] [unique_id "aeOX9xngmUE3LdC-wP7viQAAAkY"]
[Sat Apr 18 22:40:56.627860 2026] [:error] [pid 32677:tid 32691] [client 52.236.80.95:64038] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kbfr.php"] [unique_id "aeOX-BngmUE3LdC-wP7vjAAAAks"]
[Sat Apr 18 22:40:57.540924 2026] [:error] [pid 13023:tid 13029] [client 52.236.80.95:6150] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kbfr.php"] [unique_id "aeOX-f1e7hG8DAeABB8-DgAAAQQ"]
[Sat Apr 18 22:40:58.304283 2026] [:error] [pid 34288:tid 34313] [client 52.236.80.95:63941] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kbfr.php"] [unique_id "aeOX-uTIiy__PtiLmpndgQAAAZU"]
[Sat Apr 18 22:40:59.470152 2026] [:error] [pid 13023:tid 13033] [client 52.236.80.95:64616] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kbfr.php"] [unique_id "aeOX-_1e7hG8DAeABB8-EAAAAQg"]
[Sat Apr 18 22:41:00.445005 2026] [:error] [pid 9970:tid 9976] [client 52.236.80.95:64677] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abhjr.php"] [unique_id "aeOX_CYdRLRhVmaIMx3fygAAAMI"]
[Sat Apr 18 22:41:01.062743 2026] [:error] [pid 9864:tid 9925] [client 52.236.80.95:65152] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abhjr.php"] [unique_id "aeOX_YCFeowknfXHM7kxZAAAAFM"]
[Sat Apr 18 22:41:01.599453 2026] [:error] [pid 9970:tid 9981] [client 52.236.80.95:65214] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abhjr.php"] [unique_id "aeOX_SYdRLRhVmaIMx3fzAAAAMc"]
[Sat Apr 18 22:41:02.178973 2026] [:error] [pid 9970:tid 9993] [client 52.236.80.95:63677] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abhjr.php"] [unique_id "aeOX_iYdRLRhVmaIMx3fzQAAANM"]
[Sat Apr 18 22:41:02.716009 2026] [:error] [pid 9970:tid 9977] [client 52.236.80.95:64053] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/anczg.php"] [unique_id "aeOX_iYdRLRhVmaIMx3fzgAAAMM"]
[Sat Apr 18 22:41:03.323103 2026] [:error] [pid 13023:tid 13037] [client 52.236.80.95:63143] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/anczg.php"] [unique_id "aeOX__1e7hG8DAeABB8-FQAAAQw"]
[Sat Apr 18 22:41:03.851831 2026] [:error] [pid 13023:tid 13040] [client 52.236.80.95:63655] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/anczg.php"] [unique_id "aeOX__1e7hG8DAeABB8-GAAAAQ8"]
[Sat Apr 18 22:41:04.430862 2026] [:error] [pid 13023:tid 13044] [client 52.236.80.95:60673] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/anczg.php"] [unique_id "aeOYAP1e7hG8DAeABB8-GwAAARM"]
[Sat Apr 18 22:41:05.052201 2026] [:error] [pid 13023:tid 13035] [client 52.236.80.95:64060] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ardsw.php"] [unique_id "aeOYAf1e7hG8DAeABB8-HAAAAQo"]
[Sat Apr 18 22:41:05.637947 2026] [:error] [pid 13023:tid 13029] [client 52.236.80.95:64029] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ardsw.php"] [unique_id "aeOYAf1e7hG8DAeABB8-HgAAAQQ"]
[Sat Apr 18 22:41:06.273222 2026] [:error] [pid 13023:tid 13049] [client 52.236.80.95:64020] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ardsw.php"] [unique_id "aeOYAv1e7hG8DAeABB8-IgAAARg"]
[Sat Apr 18 22:41:06.814685 2026] [:error] [pid 9970:tid 9986] [client 52.236.80.95:63980] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ardsw.php"] [unique_id "aeOYAiYdRLRhVmaIMx3fzwAAAMw"]
[Sat Apr 18 22:41:07.386211 2026] [:error] [pid 9970:tid 9985] [client 52.236.80.95:63953] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atfis.php"] [unique_id "aeOYAyYdRLRhVmaIMx3f0QAAAMs"]
[Sat Apr 18 22:41:08.034341 2026] [:error] [pid 9970:tid 9997] [client 52.236.80.95:63120] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atfis.php"] [unique_id "aeOYBCYdRLRhVmaIMx3f1AAAANc"]
[Sat Apr 18 22:41:08.612413 2026] [:error] [pid 13023:tid 13027] [client 52.236.80.95:64629] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atfis.php"] [unique_id "aeOYBP1e7hG8DAeABB8-JgAAAQI"]
[Sat Apr 18 22:41:09.221216 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:65160] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atfis.php"] [unique_id "aeOYBf1e7hG8DAeABB8-KgAAAQE"]
[Sat Apr 18 22:41:10.256628 2026] [:error] [pid 9865:tid 9949] [client 52.236.80.95:64676] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/azpaq.php"] [unique_id "aeOYBqzb5knECIY-C-iiBAAAAIw"]
[Sat Apr 18 22:41:10.890437 2026] [:error] [pid 13023:tid 13039] [client 52.236.80.95:61461] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/azpaq.php"] [unique_id "aeOYBv1e7hG8DAeABB8-MAAAAQ4"]
[Sat Apr 18 22:41:11.738118 2026] [:error] [pid 13023:tid 13045] [client 52.236.80.95:63571] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/azpaq.php"] [unique_id "aeOYB_1e7hG8DAeABB8-MwAAARQ"]
[Sat Apr 18 22:41:12.287033 2026] [:error] [pid 13023:tid 13032] [client 52.236.80.95:63583] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/azpaq.php"] [unique_id "aeOYCP1e7hG8DAeABB8-OAAAAQc"]
[Sat Apr 18 22:41:12.839118 2026] [:error] [pid 32678:tid 32715] [client 52.236.80.95:63999] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bclms.php"] [unique_id "aeOYCBUlAXU_ZWUu5y8P4wAAAog"]
[Sat Apr 18 22:41:13.388695 2026] [:error] [pid 32678:tid 32711] [client 52.236.80.95:64673] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bclms.php"] [unique_id "aeOYCRUlAXU_ZWUu5y8P5AAAAoQ"]
[Sat Apr 18 22:41:13.987544 2026] [:error] [pid 13023:tid 13044] [client 52.236.80.95:64044] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bclms.php"] [unique_id "aeOYCf1e7hG8DAeABB8-PgAAARM"]
[Sat Apr 18 22:41:14.554909 2026] [:error] [pid 32677:tid 32690] [client 52.236.80.95:65095] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bclms.php"] [unique_id "aeOYChngmUE3LdC-wP7vkAAAAko"]
[Sat Apr 18 22:41:15.108941 2026] [:error] [pid 34288:tid 34297] [client 52.236.80.95:65167] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bivvw.php"] [unique_id "aeOYC-TIiy__PtiLmpndgwAAAYU"]
[Sat Apr 18 22:41:15.823375 2026] [:error] [pid 13023:tid 13038] [client 52.236.80.95:64012] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bivvw.php"] [unique_id "aeOYC_1e7hG8DAeABB8-QgAAAQ0"]
[Sat Apr 18 22:41:16.361593 2026] [:error] [pid 9864:tid 9905] [client 52.236.80.95:63993] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bivvw.php"] [unique_id "aeOYDICFeowknfXHM7kxbQAAAEA"]
[Sat Apr 18 22:41:16.933932 2026] [:error] [pid 9970:tid 9974] [client 52.236.80.95:65153] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bivvw.php"] [unique_id "aeOYDCYdRLRhVmaIMx3f1gAAAMA"]
[Sat Apr 18 22:41:17.455084 2026] [:error] [pid 9970:tid 9983] [client 52.236.80.95:63136] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bykdo.php"] [unique_id "aeOYDSYdRLRhVmaIMx3f2AAAAMk"]
[Sat Apr 18 22:41:18.002295 2026] [:error] [pid 9970:tid 9996] [client 52.236.80.95:64001] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bykdo.php"] [unique_id "aeOYDiYdRLRhVmaIMx3f3AAAANY"]
[Sat Apr 18 22:41:18.552334 2026] [:error] [pid 9970:tid 9988] [client 52.236.80.95:65165] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bykdo.php"] [unique_id "aeOYDiYdRLRhVmaIMx3f3QAAAM4"]
[Sat Apr 18 22:41:19.124828 2026] [:error] [pid 9970:tid 9977] [client 52.236.80.95:64057] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bykdo.php"] [unique_id "aeOYDyYdRLRhVmaIMx3f4AAAAMM"]
[Sat Apr 18 22:41:19.889967 2026] [:error] [pid 32677:tid 32698] [client 52.236.80.95:62632] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byueb.php"] [unique_id "aeOYDxngmUE3LdC-wP7vkQAAAlI"]
[Sat Apr 18 22:41:20.466066 2026] [:error] [pid 32677:tid 32699] [client 52.236.80.95:64013] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byueb.php"] [unique_id "aeOYEBngmUE3LdC-wP7vkgAAAlM"]
[Sat Apr 18 22:41:21.017413 2026] [:error] [pid 9864:tid 9913] [client 52.236.80.95:62542] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byueb.php"] [unique_id "aeOYEYCFeowknfXHM7kxbwAAAEc"]
[Sat Apr 18 22:41:21.546967 2026] [:error] [pid 32678:tid 32723] [client 52.236.80.95:63041] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byueb.php"] [unique_id "aeOYERUlAXU_ZWUu5y8P7QAAApA"]
[Sat Apr 18 22:41:22.068508 2026] [:error] [pid 9970:tid 9988] [client 52.236.80.95:6205] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cjndd.php"] [unique_id "aeOYEiYdRLRhVmaIMx3f7QAAAM4"]
[Sat Apr 18 22:41:22.611943 2026] [:error] [pid 9970:tid 9981] [client 52.236.80.95:64613] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cjndd.php"] [unique_id "aeOYEiYdRLRhVmaIMx3f8AAAAMc"]
[Sat Apr 18 22:41:23.267846 2026] [:error] [pid 9970:tid 9995] [client 52.236.80.95:63646] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cjndd.php"] [unique_id "aeOYEyYdRLRhVmaIMx3f9AAAANU"]
[Sat Apr 18 22:41:23.895807 2026] [:error] [pid 13023:tid 13045] [client 52.236.80.95:62638] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cjndd.php"] [unique_id "aeOYE_1e7hG8DAeABB8-SQAAARQ"]
[Sat Apr 18 22:41:24.532894 2026] [:error] [pid 9970:tid 9981] [client 52.236.80.95:64026] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/coiuz.php"] [unique_id "aeOYFCYdRLRhVmaIMx3f-AAAAMc"]
[Sat Apr 18 22:41:25.084385 2026] [:error] [pid 32678:tid 32721] [client 52.236.80.95:63593] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/coiuz.php"] [unique_id "aeOYFRUlAXU_ZWUu5y8P7gAAAo4"]
[Sat Apr 18 22:41:25.612307 2026] [:error] [pid 34290:tid 34337] [client 52.236.80.95:64628] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/coiuz.php"] [unique_id "aeOYFRqX6WpmmAXOBi8r0QAAAdI"]
[Sat Apr 18 22:41:26.371682 2026] [:error] [pid 34288:tid 34316] [client 52.236.80.95:64650] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/coiuz.php"] [unique_id "aeOYFuTIiy__PtiLmpndhAAAAZg"]
[Sat Apr 18 22:41:27.576294 2026] [:error] [pid 32678:tid 32707] [client 52.236.80.95:64682] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aeOYFxUlAXU_ZWUu5y8P9QAAAoA"]
[Sat Apr 18 22:41:28.262249 2026] [:error] [pid 9864:tid 9923] [client 52.236.80.95:63628] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aeOYGICFeowknfXHM7kxdAAAAFE"]
[Sat Apr 18 22:41:28.905166 2026] [:error] [pid 32647:tid 32652] [client 52.236.80.95:58566] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aeOYGEkxooM0iRo6e54xZAAAAgI"]
[Sat Apr 18 22:41:29.574177 2026] [:error] [pid 32678:tid 32731] [client 52.236.80.95:63071] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/click.php"] [unique_id "aeOYGRUlAXU_ZWUu5y8P-AAAApg"]
[Sat Apr 18 22:41:30.246814 2026] [:error] [pid 13023:tid 13044] [client 52.236.80.95:64021] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctjpseby.php"] [unique_id "aeOYGv1e7hG8DAeABB8-UgAAARM"]
[Sat Apr 18 22:41:30.893473 2026] [:error] [pid 13023:tid 13034] [client 52.236.80.95:65113] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctjpseby.php"] [unique_id "aeOYGv1e7hG8DAeABB8-UwAAAQk"]
[Sat Apr 18 22:41:31.507975 2026] [:error] [pid 32647:tid 32654] [client 52.236.80.95:63563] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctjpseby.php"] [unique_id "aeOYG0kxooM0iRo6e54xaAAAAgQ"]
[Sat Apr 18 22:41:32.132437 2026] [:error] [pid 34290:tid 34328] [client 52.236.80.95:63607] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctjpseby.php"] [unique_id "aeOYHBqX6WpmmAXOBi8r1QAAAck"]
[Sat Apr 18 22:41:32.759926 2026] [:error] [pid 34290:tid 34339] [client 52.236.80.95:65096] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cxxuv.php"] [unique_id "aeOYHBqX6WpmmAXOBi8r1gAAAdQ"]
[Sat Apr 18 22:41:33.697417 2026] [:error] [pid 9970:tid 9998] [client 52.236.80.95:63134] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cxxuv.php"] [unique_id "aeOYHSYdRLRhVmaIMx3f-wAAANg"]
[Sat Apr 18 22:41:34.271432 2026] [:error] [pid 9970:tid 9981] [client 52.236.80.95:6180] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cxxuv.php"] [unique_id "aeOYHiYdRLRhVmaIMx3f_gAAAMc"]
[Sat Apr 18 22:41:34.856651 2026] [:error] [pid 9970:tid 9994] [client 52.236.80.95:63140] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cxxuv.php"] [unique_id "aeOYHiYdRLRhVmaIMx3gAgAAANQ"]
[Sat Apr 18 22:41:35.391650 2026] [:error] [pid 9970:tid 9986] [client 52.236.80.95:65179] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dawvg.php"] [unique_id "aeOYHyYdRLRhVmaIMx3gBgAAAMw"]
[Sat Apr 18 22:41:36.087741 2026] [:error] [pid 9970:tid 9982] [client 52.236.80.95:63566] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dawvg.php"] [unique_id "aeOYICYdRLRhVmaIMx3gCwAAAMg"]
[Sat Apr 18 22:41:36.646054 2026] [:error] [pid 9970:tid 9979] [client 52.236.80.95:62137] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dawvg.php"] [unique_id "aeOYICYdRLRhVmaIMx3gDQAAAMU"]
[Sat Apr 18 22:41:37.225831 2026] [:error] [pid 13023:tid 13043] [client 52.236.80.95:63059] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dawvg.php"] [unique_id "aeOYIf1e7hG8DAeABB8-YAAAARI"]
[Sat Apr 18 22:41:37.796317 2026] [:error] [pid 9864:tid 9927] [client 52.236.80.95:6149] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dhjqs.php"] [unique_id "aeOYIYCFeowknfXHM7kxdwAAAFU"]
[Sat Apr 18 22:41:38.381709 2026] [:error] [pid 13023:tid 13042] [client 52.236.80.95:63937] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dhjqs.php"] [unique_id "aeOYIv1e7hG8DAeABB8-YwAAARE"]
[Sat Apr 18 22:41:38.929542 2026] [:error] [pid 13023:tid 13046] [client 52.236.80.95:63564] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dhjqs.php"] [unique_id "aeOYIv1e7hG8DAeABB8-ZAAAARU"]
[Sat Apr 18 22:41:39.487658 2026] [:error] [pid 13023:tid 13038] [client 52.236.80.95:64665] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dhjqs.php"] [unique_id "aeOYI_1e7hG8DAeABB8-ZgAAAQ0"]
[Sat Apr 18 22:41:40.448470 2026] [:error] [pid 32677:tid 32680] [client 52.236.80.95:63162] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/diayd.php"] [unique_id "aeOYJBngmUE3LdC-wP7vngAAAkA"]
[Sat Apr 18 22:41:41.031944 2026] [:error] [pid 9970:tid 9988] [client 52.236.80.95:65208] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/diayd.php"] [unique_id "aeOYJSYdRLRhVmaIMx3gDwAAAM4"]
[Sat Apr 18 22:41:41.650935 2026] [:error] [pid 32678:tid 32716] [client 52.236.80.95:63976] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/diayd.php"] [unique_id "aeOYJRUlAXU_ZWUu5y8P_wAAAok"]
[Sat Apr 18 22:41:42.218128 2026] [:error] [pid 34290:tid 34330] [client 52.236.80.95:6185] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/diayd.php"] [unique_id "aeOYJhqX6WpmmAXOBi8r3gAAAcs"]
[Sat Apr 18 22:41:42.783564 2026] [:error] [pid 9864:tid 9930] [client 52.236.80.95:65102] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dljpy.php"] [unique_id "aeOYJoCFeowknfXHM7kxgAAAAFg"]
[Sat Apr 18 22:41:43.365028 2026] [:error] [pid 32677:tid 32696] [client 52.236.80.95:65122] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dljpy.php"] [unique_id "aeOYJxngmUE3LdC-wP7voQAAAlA"]
[Sat Apr 18 22:41:44.207430 2026] [:error] [pid 34288:tid 34300] [client 52.236.80.95:64023] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dljpy.php"] [unique_id "aeOYKOTIiy__PtiLmpndjAAAAYg"]
[Sat Apr 18 22:41:44.876993 2026] [:error] [pid 32677:tid 32691] [client 52.236.80.95:63052] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dljpy.php"] [unique_id "aeOYKBngmUE3LdC-wP7vowAAAks"]
[Sat Apr 18 22:41:45.449695 2026] [:error] [pid 13023:tid 13036] [client 52.236.80.95:64689] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dqagu.php"] [unique_id "aeOYKf1e7hG8DAeABB8-eQAAAQs"]
[Sat Apr 18 22:41:46.039422 2026] [:error] [pid 9863:tid 9885] [client 52.236.80.95:63156] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dqagu.php"] [unique_id "aeOYKjjjiypiFrTucbLY9gAAAAw"]
[Sat Apr 18 22:41:46.595740 2026] [:error] [pid 9970:tid 9995] [client 52.236.80.95:64059] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dqagu.php"] [unique_id "aeOYKiYdRLRhVmaIMx3gEQAAANU"]
[Sat Apr 18 22:41:47.222337 2026] [:error] [pid 34288:tid 34293] [client 52.236.80.95:63615] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dqagu.php"] [unique_id "aeOYK-TIiy__PtiLmpndkQAAAYE"]
[Sat Apr 18 22:41:47.854353 2026] [:error] [pid 32678:tid 32725] [client 52.236.80.95:64653] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/druqr.php"] [unique_id "aeOYKxUlAXU_ZWUu5y8QBAAAApI"]
[Sat Apr 18 22:41:48.714768 2026] [:error] [pid 32647:tid 32665] [client 52.236.80.95:64645] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/druqr.php"] [unique_id "aeOYLEkxooM0iRo6e54xdQAAAg8"]
[Sat Apr 18 22:41:49.499070 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:65164] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/druqr.php"] [unique_id "aeOYLf1e7hG8DAeABB8-hQAAAQE"]
[Sat Apr 18 22:41:59.667874 2026] [:error] [pid 34290:tid 34335] [client 52.236.80.95:63554] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gedim.php"] [unique_id "aeOYNxqX6WpmmAXOBi8r9QAAAdA"]
[Sat Apr 18 22:42:00.440075 2026] [:error] [pid 32677:tid 32698] [client 52.236.80.95:64683] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gedim.php"] [unique_id "aeOYOBngmUE3LdC-wP7vswAAAlI"]
[Sat Apr 18 22:42:01.087815 2026] [:error] [pid 13023:tid 13031] [client 52.236.80.95:62556] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gedim.php"] [unique_id "aeOYOf1e7hG8DAeABB8-kQAAAQY"]
[Sat Apr 18 22:42:01.682337 2026] [:error] [pid 32677:tid 32693] [client 52.236.80.95:62085] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gedim.php"] [unique_id "aeOYORngmUE3LdC-wP7vuAAAAk0"]
[Sat Apr 18 22:42:02.327142 2026] [:error] [pid 9865:tid 9960] [client 52.236.80.95:64054] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ibano.php"] [unique_id "aeOYOqzb5knECIY-C-iiIAAAAJc"]
[Sat Apr 18 22:42:03.041071 2026] [:error] [pid 13023:tid 13035] [client 52.236.80.95:65130] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ibano.php"] [unique_id "aeOYO_1e7hG8DAeABB8-lAAAAQo"]
[Sat Apr 18 22:42:03.751010 2026] [:error] [pid 32678:tid 32715] [client 52.236.80.95:63073] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ibano.php"] [unique_id "aeOYOxUlAXU_ZWUu5y8QHAAAAog"]
[Sat Apr 18 22:42:04.607412 2026] [:error] [pid 13023:tid 13039] [client 52.236.80.95:64700] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ibano.php"] [unique_id "aeOYPP1e7hG8DAeABB8-lgAAAQ4"]
[Sat Apr 18 22:42:05.427964 2026] [:error] [pid 13023:tid 13045] [client 52.236.80.95:63636] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ifrea.php"] [unique_id "aeOYPf1e7hG8DAeABB8-mAAAARQ"]
[Sat Apr 18 22:42:06.025766 2026] [:error] [pid 13023:tid 13030] [client 52.236.80.95:63952] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ifrea.php"] [unique_id "aeOYPv1e7hG8DAeABB8-mgAAAQU"]
[Sat Apr 18 22:42:06.626868 2026] [:error] [pid 9970:tid 9979] [client 52.236.80.95:64581] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ifrea.php"] [unique_id "aeOYPiYdRLRhVmaIMx3gKQAAAMU"]
[Sat Apr 18 22:42:07.223812 2026] [:error] [pid 9865:tid 9945] [client 52.236.80.95:64670] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ifrea.php"] [unique_id "aeOYP6zb5knECIY-C-iiJQAAAIg"]
[Sat Apr 18 22:42:08.195993 2026] [:error] [pid 13023:tid 13029] [client 52.236.80.95:61455] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/itlvk.php"] [unique_id "aeOYQP1e7hG8DAeABB8-oQAAAQQ"]
[Sat Apr 18 22:42:08.993413 2026] [:error] [pid 32677:tid 32699] [client 52.236.80.95:63151] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/itlvk.php"] [unique_id "aeOYQBngmUE3LdC-wP7v3wAAAlM"]
[Sat Apr 18 22:42:10.596948 2026] [:error] [pid 13023:tid 13036] [client 52.236.80.95:61395] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/itlvk.php"] [unique_id "aeOYQv1e7hG8DAeABB8-pwAAAQs"]
[Sat Apr 18 22:42:11.904813 2026] [:error] [pid 13023:tid 13043] [client 52.236.80.95:64579] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/itlvk.php"] [unique_id "aeOYQ_1e7hG8DAeABB8-rwAAARI"]
[Sat Apr 18 22:42:13.899317 2026] [:error] [pid 13023:tid 13029] [client 52.236.80.95:63166] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jctyd.php"] [unique_id "aeOYRf1e7hG8DAeABB8-twAAAQQ"]
[Sat Apr 18 22:42:16.505927 2026] [:error] [pid 9865:tid 9948] [client 52.236.80.95:64631] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jctyd.php"] [unique_id "aeOYSKzb5knECIY-C-iiNwAAAIs"]
[Sat Apr 18 22:42:30.894992 2026] [:error] [pid 9865:tid 9952] [client 52.236.80.95:63056] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jctyd.php"] [unique_id "aeOYVqzb5knECIY-C-iiUAAAAI8"]
[Sat Apr 18 22:42:31.869029 2026] [:error] [pid 9863:tid 9878] [client 52.236.80.95:63147] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jtfocpif.php"] [unique_id "aeOYVzjjiypiFrTucbLZAgAAAAU"]
[Sat Apr 18 22:42:45.448899 2026] [:error] [pid 32678:tid 32722] [client 52.236.80.95:6178] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jtfocpif.php"] [unique_id "aeOYZRUlAXU_ZWUu5y8QLQAAAo8"]
[Sat Apr 18 22:43:48.709979 2026] [:error] [pid 32677:tid 32690] [client 52.236.80.95:65090] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xcakx.php"] [unique_id "aeOYpBngmUE3LdC-wP7wMgAAAko"]
[Sat Apr 18 22:44:21.932485 2026] [:error] [pid 9863:tid 9880] [client 52.236.80.95:63135] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xjgdw.php"] [unique_id "aeOYxTjjiypiFrTucbLZNwAAAAc"]
[Sat Apr 18 22:45:37.948313 2026] [:error] [pid 13023:tid 13029] [client 52.236.80.95:63595] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jnhddqyz.php"] [unique_id "aeOZEf1e7hG8DAeABB9BFAAAAQQ"]
[Sat Apr 18 22:49:53.547569 2026] [:error] [pid 32678:tid 32721] [client 52.236.80.95:63148] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gh.php"] [unique_id "aeOaERUlAXU_ZWUu5y8SiwAAAo4"]
[Sat Apr 18 22:49:54.135006 2026] [:error] [pid 13023:tid 13035] [client 52.236.80.95:65112] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gh.php"] [unique_id "aeOaEv1e7hG8DAeABB9DuAAAAQo"]
[Sat Apr 18 22:49:54.678859 2026] [:error] [pid 9865:tid 9947] [client 52.236.80.95:63990] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gh.php"] [unique_id "aeOaEqzb5knECIY-C-ikngAAAIo"]
[Sat Apr 18 22:49:55.231886 2026] [:error] [pid 32677:tid 32691] [client 52.236.80.95:63994] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gh.php"] [unique_id "aeOaExngmUE3LdC-wP7xfwAAAks"]
[Sat Apr 18 22:49:55.771273 2026] [:error] [pid 9970:tid 9997] [client 52.236.80.95:64056] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "aeOaEyYdRLRhVmaIMx3jaAAAANc"]
[Sat Apr 18 22:49:56.353070 2026] [:error] [pid 9970:tid 9986] [client 52.236.80.95:6157] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "aeOaFCYdRLRhVmaIMx3jbQAAAMw"]
[Sat Apr 18 22:49:56.905760 2026] [:error] [pid 9970:tid 9989] [client 52.236.80.95:64597] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "aeOaFCYdRLRhVmaIMx3jbwAAAM8"]
[Sat Apr 18 22:49:57.470729 2026] [:error] [pid 34290:tid 34327] [client 52.236.80.95:63120] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "aeOaFRqX6WpmmAXOBi8s8wAAAcg"]
[Sat Apr 18 22:49:58.108626 2026] [:error] [pid 9865:tid 9937] [client 52.236.80.95:64026] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php7"] [unique_id "aeOaFqzb5knECIY-C-ikoAAAAIA"]
[Sat Apr 18 22:49:59.013713 2026] [:error] [pid 9864:tid 9927] [client 52.236.80.95:63673] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php7"] [unique_id "aeOaF4CFeowknfXHM7ky1AAAAFU"]
[Sat Apr 18 22:49:59.558408 2026] [:error] [pid 9865:tid 9958] [client 52.236.80.95:63555] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php7"] [unique_id "aeOaF6zb5knECIY-C-ikowAAAJU"]
[Sat Apr 18 22:50:00.162864 2026] [:error] [pid 32677:tid 32687] [client 52.236.80.95:63041] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php7"] [unique_id "aeOaGBngmUE3LdC-wP7xhQAAAkc"]
[Sat Apr 18 22:50:00.718962 2026] [:error] [pid 13023:tid 13047] [client 52.236.80.95:63593] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xigmltad.php"] [unique_id "aeOaGP1e7hG8DAeABB9DwwAAARY"]
[Sat Apr 18 22:50:01.274505 2026] [:error] [pid 9864:tid 9924] [client 52.236.80.95:63991] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xigmltad.php"] [unique_id "aeOaGYCFeowknfXHM7ky1QAAAFI"]
[Sat Apr 18 22:50:01.891328 2026] [:error] [pid 9865:tid 9955] [client 52.236.80.95:63638] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xigmltad.php"] [unique_id "aeOaGazb5knECIY-C-ikpQAAAJI"]
[Sat Apr 18 22:50:02.703781 2026] [:error] [pid 9970:tid 9985] [client 52.236.80.95:63558] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xigmltad.php"] [unique_id "aeOaGiYdRLRhVmaIMx3jeQAAAMs"]
[Sat Apr 18 22:50:03.269485 2026] [:error] [pid 13023:tid 13041] [client 52.236.80.95:64009] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lb.php"] [unique_id "aeOaG_1e7hG8DAeABB9DzQAAARA"]
[Sat Apr 18 22:50:03.804425 2026] [:error] [pid 9865:tid 9959] [client 52.236.80.95:64628] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lb.php"] [unique_id "aeOaG6zb5knECIY-C-ikpgAAAJY"]
[Sat Apr 18 22:50:04.515557 2026] [:error] [pid 32678:tid 32724] [client 52.236.80.95:63564] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lb.php"] [unique_id "aeOaHBUlAXU_ZWUu5y8SuQAAApE"]
[Sat Apr 18 22:50:05.061389 2026] [:error] [pid 9865:tid 9945] [client 52.236.80.95:63666] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lb.php"] [unique_id "aeOaHazb5knECIY-C-ikpwAAAIg"]
[Sat Apr 18 22:50:05.679294 2026] [:error] [pid 9865:tid 9960] [client 52.236.80.95:65098] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aeOaHazb5knECIY-C-ikqQAAAJc"]
[Sat Apr 18 22:50:06.262389 2026] [:error] [pid 9865:tid 9943] [client 52.236.80.95:64636] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aeOaHqzb5knECIY-C-ikqgAAAIY"]
[Sat Apr 18 22:50:06.902729 2026] [:error] [pid 9864:tid 9920] [client 52.236.80.95:6161] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aeOaHoCFeowknfXHM7ky2gAAAE4"]
[Sat Apr 18 22:50:07.546817 2026] [:error] [pid 9865:tid 9939] [client 52.236.80.95:65202] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aeOaH6zb5knECIY-C-ikrAAAAII"]
[Sat Apr 18 22:50:08.072634 2026] [:error] [pid 13023:tid 13046] [client 52.236.80.95:63639] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sad.php"] [unique_id "aeOaIP1e7hG8DAeABB9D1QAAARU"]
[Sat Apr 18 22:50:08.619656 2026] [:error] [pid 13023:tid 13037] [client 52.236.80.95:63050] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sad.php"] [unique_id "aeOaIP1e7hG8DAeABB9D2QAAAQw"]
[Sat Apr 18 22:50:09.466412 2026] [:error] [pid 9863:tid 9888] [client 52.236.80.95:65214] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sad.php"] [unique_id "aeOaITjjiypiFrTucbLZpwAAAA8"]
[Sat Apr 18 22:50:10.030448 2026] [:error] [pid 34288:tid 34300] [client 52.236.80.95:64670] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sad.php"] [unique_id "aeOaIuTIiy__PtiLmpneTQAAAYg"]
[Sat Apr 18 22:50:10.630770 2026] [:error] [pid 9865:tid 9944] [client 52.236.80.95:64037] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "aeOaIqzb5knECIY-C-iksAAAAIc"]
[Sat Apr 18 22:50:11.133738 2026] [:error] [pid 9863:tid 9889] [client 52.236.80.95:64605] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "aeOaIzjjiypiFrTucbLZrAAAABA"]
[Sat Apr 18 22:50:11.636330 2026] [:error] [pid 13023:tid 13044] [client 52.236.80.95:6165] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "aeOaI_1e7hG8DAeABB9D4QAAARM"]
[Sat Apr 18 22:50:12.161294 2026] [:error] [pid 9865:tid 9953] [client 52.236.80.95:63585] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws77.php"] [unique_id "aeOaJKzb5knECIY-C-iktAAAAJA"]
[Sat Apr 18 22:50:12.723545 2026] [:error] [pid 9865:tid 9945] [client 52.236.80.95:63668] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gi.php"] [unique_id "aeOaJKzb5knECIY-C-ikuAAAAIg"]
[Sat Apr 18 22:50:13.450385 2026] [:error] [pid 32678:tid 32721] [client 52.236.80.95:64609] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gi.php"] [unique_id "aeOaJRUlAXU_ZWUu5y8SzQAAAo4"]
[Sat Apr 18 22:50:14.176120 2026] [:error] [pid 13023:tid 13031] [client 52.236.80.95:65204] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gi.php"] [unique_id "aeOaJv1e7hG8DAeABB9D5gAAAQY"]
[Sat Apr 18 22:50:15.069603 2026] [:error] [pid 13023:tid 13049] [client 52.236.80.95:63613] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gi.php"] [unique_id "aeOaJ_1e7hG8DAeABB9D6gAAARg"]
[Sat Apr 18 22:50:16.292566 2026] [:error] [pid 9970:tid 9989] [client 52.236.80.95:64691] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aeOaKCYdRLRhVmaIMx3jhAAAAM8"]
[Sat Apr 18 22:50:17.068161 2026] [:error] [pid 9970:tid 9988] [client 52.236.80.95:63138] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aeOaKSYdRLRhVmaIMx3jiQAAAM4"]
[Sat Apr 18 22:50:17.671894 2026] [:error] [pid 9863:tid 9883] [client 52.236.80.95:63128] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aeOaKTjjiypiFrTucbLZrgAAAAo"]
[Sat Apr 18 22:50:18.228365 2026] [:error] [pid 9863:tid 9885] [client 52.236.80.95:6206] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "aeOaKjjjiypiFrTucbLZrwAAAAw"]
[Sat Apr 18 22:50:18.887250 2026] [:error] [pid 9970:tid 9998] [client 52.236.80.95:6189] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lp6.php"] [unique_id "aeOaKiYdRLRhVmaIMx3jjgAAANg"]
[Sat Apr 18 22:50:19.467404 2026] [:error] [pid 9970:tid 9997] [client 52.236.80.95:64620] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lp6.php"] [unique_id "aeOaKyYdRLRhVmaIMx3jkQAAANc"]
[Sat Apr 18 22:50:20.021515 2026] [:error] [pid 9970:tid 9990] [client 52.236.80.95:63954] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lp6.php"] [unique_id "aeOaLCYdRLRhVmaIMx3jlAAAANA"]
[Sat Apr 18 22:50:20.600518 2026] [:error] [pid 9970:tid 9989] [client 52.236.80.95:63565] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lp6.php"] [unique_id "aeOaLCYdRLRhVmaIMx3jmAAAAM8"]
[Sat Apr 18 22:50:21.124370 2026] [:error] [pid 9865:tid 9940] [client 52.236.80.95:63628] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pass4.php"] [unique_id "aeOaLazb5knECIY-C-ikxAAAAIM"]
[Sat Apr 18 22:50:21.660309 2026] [:error] [pid 9970:tid 9988] [client 52.236.80.95:64658] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pass4.php"] [unique_id "aeOaLSYdRLRhVmaIMx3jnAAAAM4"]
[Sat Apr 18 22:50:22.449909 2026] [:error] [pid 9970:tid 9984] [client 52.236.80.95:6181] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pass4.php"] [unique_id "aeOaLiYdRLRhVmaIMx3jngAAAMo"]
[Sat Apr 18 22:50:23.077812 2026] [:error] [pid 13023:tid 13041] [client 52.236.80.95:64021] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pass4.php"] [unique_id "aeOaL_1e7hG8DAeABB9D7QAAARA"]
[Sat Apr 18 22:50:23.609089 2026] [:error] [pid 13023:tid 13043] [client 52.236.80.95:64646] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aeOaL_1e7hG8DAeABB9D8AAAARI"]
[Sat Apr 18 22:50:24.206592 2026] [:error] [pid 13023:tid 13042] [client 52.236.80.95:63679] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aeOaMP1e7hG8DAeABB9D8gAAARE"]
[Sat Apr 18 22:50:24.804123 2026] [:error] [pid 32647:tid 32662] [client 52.236.80.95:63595] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aeOaMEkxooM0iRo6e54ylwAAAgw"]
[Sat Apr 18 22:50:25.323072 2026] [:error] [pid 9865:tid 9938] [client 52.236.80.95:62630] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "aeOaMazb5knECIY-C-ikzAAAAIE"]
[Sat Apr 18 22:50:25.843983 2026] [:error] [pid 9863:tid 9881] [client 52.236.80.95:63620] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sh.php"] [unique_id "aeOaMTjjiypiFrTucbLZsgAAAAg"]
[Sat Apr 18 22:50:26.442868 2026] [:error] [pid 34288:tid 34301] [client 52.236.80.95:64674] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sh.php"] [unique_id "aeOaMuTIiy__PtiLmpneUwAAAYk"]
[Sat Apr 18 22:50:26.960564 2026] [:error] [pid 13023:tid 13032] [client 52.236.80.95:65170] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sh.php"] [unique_id "aeOaMv1e7hG8DAeABB9D9QAAAQc"]
[Sat Apr 18 22:50:27.554267 2026] [:error] [pid 9970:tid 9989] [client 52.236.80.95:65184] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sh.php"] [unique_id "aeOaMyYdRLRhVmaIMx3jpQAAAM8"]
[Sat Apr 18 22:50:28.089473 2026] [:error] [pid 32677:tid 32702] [client 52.236.80.95:65105] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uujuu.php"] [unique_id "aeOaNBngmUE3LdC-wP7xjAAAAlY"]
[Sat Apr 18 22:50:28.906774 2026] [:error] [pid 9863:tid 9890] [client 52.236.80.95:65195] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uujuu.php"] [unique_id "aeOaNDjjiypiFrTucbLZtAAAABE"]
[Sat Apr 18 22:50:29.487923 2026] [:error] [pid 9865:tid 9958] [client 52.236.80.95:60675] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uujuu.php"] [unique_id "aeOaNazb5knECIY-C-ikzwAAAJU"]
[Sat Apr 18 22:50:30.169336 2026] [:error] [pid 9970:tid 9985] [client 52.236.80.95:64023] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uujuu.php"] [unique_id "aeOaNiYdRLRhVmaIMx3jqAAAAMs"]
[Sat Apr 18 22:50:30.700852 2026] [:error] [pid 13023:tid 13040] [client 52.236.80.95:65147] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wdf.php"] [unique_id "aeOaNv1e7hG8DAeABB9D_gAAAQ8"]
[Sat Apr 18 22:50:31.209389 2026] [:error] [pid 32677:tid 32684] [client 52.236.80.95:63629] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wdf.php"] [unique_id "aeOaNxngmUE3LdC-wP7xkAAAAkQ"]
[Sat Apr 18 22:50:31.787543 2026] [:error] [pid 9863:tid 9874] [client 52.236.80.95:64625] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wdf.php"] [unique_id "aeOaNzjjiypiFrTucbLZuAAAAAE"]
[Sat Apr 18 22:50:32.355765 2026] [:error] [pid 9863:tid 9879] [client 52.236.80.95:63610] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wdf.php"] [unique_id "aeOaODjjiypiFrTucbLZugAAAAY"]
[Sat Apr 18 22:50:32.905390 2026] [:error] [pid 13023:tid 13033] [client 52.236.80.95:6201] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aeOaOP1e7hG8DAeABB9EAAAAAQg"]
[Sat Apr 18 22:50:33.428910 2026] [:error] [pid 13023:tid 13042] [client 52.236.80.95:65206] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aeOaOf1e7hG8DAeABB9EBQAAARE"]
[Sat Apr 18 22:50:34.019398 2026] [:error] [pid 32647:tid 32650] [client 52.236.80.95:65129] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aeOaOkkxooM0iRo6e54ynQAAAgA"]
[Sat Apr 18 22:50:34.534659 2026] [:error] [pid 34290:tid 34343] [client 52.236.80.95:64030] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/nc4.php"] [unique_id "aeOaOhqX6WpmmAXOBi8s_wAAAdg"]
[Sat Apr 18 22:50:35.077501 2026] [:error] [pid 34290:tid 34319] [client 52.236.80.95:65124] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aeOaOxqX6WpmmAXOBi8tAQAAAcA"]
[Sat Apr 18 22:50:35.628490 2026] [:error] [pid 34290:tid 34321] [client 52.236.80.95:65099] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aeOaOxqX6WpmmAXOBi8tBAAAAcI"]
[Sat Apr 18 22:50:36.205413 2026] [:error] [pid 34290:tid 34336] [client 52.236.80.95:63584] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aeOaPBqX6WpmmAXOBi8tBwAAAdE"]
[Sat Apr 18 22:50:36.714142 2026] [:error] [pid 9865:tid 9953] [client 52.236.80.95:62024] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aeOaPKzb5knECIY-C-ik0wAAAJA"]
[Sat Apr 18 22:50:37.284340 2026] [:error] [pid 32677:tid 32698] [client 52.236.80.95:63938] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zyjhr.php"] [unique_id "aeOaPRngmUE3LdC-wP7xkgAAAlI"]
[Sat Apr 18 22:50:37.858776 2026] [:error] [pid 32677:tid 32686] [client 52.236.80.95:6163] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zyjhr.php"] [unique_id "aeOaPRngmUE3LdC-wP7xlQAAAkY"]
[Sat Apr 18 22:50:38.362616 2026] [:error] [pid 32677:tid 32690] [client 52.236.80.95:64595] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zyjhr.php"] [unique_id "aeOaPhngmUE3LdC-wP7xmgAAAko"]
[Sat Apr 18 22:50:39.128374 2026] [:error] [pid 34290:tid 34333] [client 52.236.80.95:64673] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zyjhr.php"] [unique_id "aeOaPxqX6WpmmAXOBi8tCgAAAc4"]
[Sat Apr 18 22:50:39.630083 2026] [:error] [pid 32647:tid 32655] [client 52.236.80.95:65102] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b7cdb465.php"] [unique_id "aeOaP0kxooM0iRo6e54yogAAAgU"]
[Sat Apr 18 22:50:40.207609 2026] [:error] [pid 9864:tid 9916] [client 52.236.80.95:64062] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b7cdb465.php"] [unique_id "aeOaQICFeowknfXHM7ky4AAAAEo"]
[Sat Apr 18 22:50:40.742802 2026] [:error] [pid 32647:tid 32670] [client 52.236.80.95:63052] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b7cdb465.php"] [unique_id "aeOaQEkxooM0iRo6e54ypgAAAhQ"]
[Sat Apr 18 22:50:41.305873 2026] [:error] [pid 9970:tid 9987] [client 52.236.80.95:64657] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/b7cdb465.php"] [unique_id "aeOaQSYdRLRhVmaIMx3jsAAAAM0"]
[Sat Apr 18 22:50:41.915923 2026] [:error] [pid 13023:tid 13049] [client 52.236.80.95:64667] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x123.php"] [unique_id "aeOaQf1e7hG8DAeABB9ECQAAARg"]
[Sat Apr 18 22:50:42.484760 2026] [:error] [pid 9970:tid 9985] [client 52.236.80.95:6153] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x123.php"] [unique_id "aeOaQiYdRLRhVmaIMx3jtgAAAMs"]
[Sat Apr 18 22:50:43.222962 2026] [:error] [pid 9864:tid 9909] [client 52.236.80.95:62581] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x123.php"] [unique_id "aeOaQ4CFeowknfXHM7ky4QAAAEQ"]
[Sat Apr 18 22:50:44.080322 2026] [:error] [pid 9970:tid 9994] [client 52.236.80.95:63943] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x123.php"] [unique_id "aeOaRCYdRLRhVmaIMx3juQAAANQ"]
[Sat Apr 18 22:50:44.732618 2026] [:error] [pid 32677:tid 32689] [client 52.236.80.95:63141] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/trx24.php"] [unique_id "aeOaRBngmUE3LdC-wP7xnwAAAkk"]
[Sat Apr 18 22:50:45.373840 2026] [:error] [pid 9865:tid 9947] [client 52.236.80.95:63572] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/trx24.php"] [unique_id "aeOaRazb5knECIY-C-ik1wAAAIo"]
[Sat Apr 18 22:50:45.880489 2026] [:error] [pid 32677:tid 32696] [client 52.236.80.95:63965] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/trx24.php"] [unique_id "aeOaRRngmUE3LdC-wP7xoQAAAlA"]
[Sat Apr 18 22:50:46.411288 2026] [:error] [pid 32677:tid 32698] [client 52.236.80.95:63644] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/trx24.php"] [unique_id "aeOaRhngmUE3LdC-wP7xpAAAAlI"]
[Sat Apr 18 22:50:47.220602 2026] [:error] [pid 32647:tid 32663] [client 52.236.80.95:64616] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lp5.php"] [unique_id "aeOaR0kxooM0iRo6e54yqAAAAg0"]
[Sat Apr 18 22:50:47.840716 2026] [:error] [pid 9864:tid 9924] [client 52.236.80.95:64663] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lp5.php"] [unique_id "aeOaR4CFeowknfXHM7ky4wAAAFI"]
[Sat Apr 18 22:50:48.669866 2026] [:error] [pid 32677:tid 32683] [client 52.236.80.95:60729] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lp5.php"] [unique_id "aeOaSBngmUE3LdC-wP7xqQAAAkM"]
[Sat Apr 18 22:50:49.265561 2026] [:error] [pid 9970:tid 9990] [client 52.236.80.95:65119] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lp5.php"] [unique_id "aeOaSSYdRLRhVmaIMx3jvwAAANA"]
[Sat Apr 18 22:50:49.815001 2026] [:error] [pid 9970:tid 9979] [client 52.236.80.95:65176] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws78.php"] [unique_id "aeOaSSYdRLRhVmaIMx3jwQAAAMU"]
[Sat Apr 18 22:50:50.474323 2026] [:error] [pid 9970:tid 9977] [client 52.236.80.95:63573] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws78.php"] [unique_id "aeOaSiYdRLRhVmaIMx3jxwAAAMM"]
[Sat Apr 18 22:50:50.996603 2026] [:error] [pid 9864:tid 9928] [client 52.236.80.95:63662] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws78.php"] [unique_id "aeOaSoCFeowknfXHM7ky6QAAAFY"]
[Sat Apr 18 22:50:51.733829 2026] [:error] [pid 32678:tid 32720] [client 52.236.80.95:64660] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws78.php"] [unique_id "aeOaSxUlAXU_ZWUu5y8S1gAAAo0"]
[Sat Apr 18 22:51:01.945703 2026] [:error] [pid 32678:tid 32724] [client 52.236.80.95:64053] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aeOaVRUlAXU_ZWUu5y8S7QAAApE"]
[Sat Apr 18 22:51:02.469741 2026] [:error] [pid 9865:tid 9955] [client 52.236.80.95:63982] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aeOaVqzb5knECIY-C-ik6AAAAJI"]
[Sat Apr 18 22:51:02.999511 2026] [:error] [pid 32678:tid 32707] [client 52.236.80.95:63109] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aeOaVhUlAXU_ZWUu5y8S7gAAAoA"]
[Sat Apr 18 22:51:03.544865 2026] [:error] [pid 9970:tid 9979] [client 52.236.80.95:64602] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aeOaVyYdRLRhVmaIMx3jzwAAAMU"]
[Sat Apr 18 22:51:04.078854 2026] [:error] [pid 32678:tid 32729] [client 52.236.80.95:60726] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/%E3%81%AE.php"] [unique_id "aeOaWBUlAXU_ZWUu5y8S8AAAApY"]
[Sat Apr 18 22:51:04.655709 2026] [:error] [pid 32647:tid 32653] [client 52.236.80.95:63142] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/%E3%81%AE.php"] [unique_id "aeOaWEkxooM0iRo6e54yrQAAAgM"]
[Sat Apr 18 22:51:05.189334 2026] [:error] [pid 9970:tid 9975] [client 52.236.80.95:64044] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/%E3%81%AE.php"] [unique_id "aeOaWSYdRLRhVmaIMx3j0QAAAME"]
[Sat Apr 18 22:51:05.798828 2026] [:error] [pid 9970:tid 9977] [client 52.236.80.95:63617] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/%E3%81%AE.php"] [unique_id "aeOaWSYdRLRhVmaIMx3j1QAAAMM"]
[Sat Apr 18 22:51:06.334394 2026] [:error] [pid 32678:tid 32726] [client 52.236.80.95:65090] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xtsr.php"] [unique_id "aeOaWhUlAXU_ZWUu5y8S8gAAApM"]
[Sat Apr 18 22:51:06.985763 2026] [:error] [pid 9970:tid 9997] [client 52.236.80.95:64676] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xtsr.php"] [unique_id "aeOaWiYdRLRhVmaIMx3j3wAAANc"]
[Sat Apr 18 22:51:07.547415 2026] [:error] [pid 9970:tid 9978] [client 52.236.80.95:63612] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xtsr.php"] [unique_id "aeOaWyYdRLRhVmaIMx3j5AAAAMQ"]
[Sat Apr 18 22:51:08.124093 2026] [:error] [pid 9970:tid 9989] [client 52.236.80.95:65144] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xtsr.php"] [unique_id "aeOaXCYdRLRhVmaIMx3j6AAAAM8"]
[Sat Apr 18 22:51:08.678990 2026] [:error] [pid 13023:tid 13043] [client 52.236.80.95:63159] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zz8.php"] [unique_id "aeOaXP1e7hG8DAeABB9EDQAAARI"]
[Sat Apr 18 22:51:09.213056 2026] [:error] [pid 9864:tid 9919] [client 52.236.80.95:6163] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zz8.php"] [unique_id "aeOaXYCFeowknfXHM7ky7gAAAE0"]
[Sat Apr 18 22:51:09.779671 2026] [:error] [pid 9865:tid 9943] [client 52.236.80.95:62614] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zz8.php"] [unique_id "aeOaXazb5knECIY-C-ik6gAAAIY"]
[Sat Apr 18 22:51:10.286804 2026] [:error] [pid 9865:tid 9941] [client 52.236.80.95:64675] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zz8.php"] [unique_id "aeOaXqzb5knECIY-C-ik7AAAAIQ"]
[Sat Apr 18 22:51:10.859101 2026] [:error] [pid 9865:tid 9949] [client 52.236.80.95:63967] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "aeOaXqzb5knECIY-C-ik7gAAAIw"]
[Sat Apr 18 22:51:11.504426 2026] [:error] [pid 9865:tid 9944] [client 52.236.80.95:63656] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "aeOaX6zb5knECIY-C-ik8QAAAIc"]
[Sat Apr 18 22:51:12.056658 2026] [:error] [pid 13023:tid 13034] [client 52.236.80.95:63609] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "aeOaYP1e7hG8DAeABB9EEQAAAQk"]
[Sat Apr 18 22:51:12.602565 2026] [:error] [pid 32678:tid 32716] [client 52.236.80.95:65154] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "aeOaYBUlAXU_ZWUu5y8S-wAAAok"]
[Sat Apr 18 22:51:13.240882 2026] [:error] [pid 9970:tid 9997] [client 52.236.80.95:64654] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aeOaYSYdRLRhVmaIMx3j8QAAANc"]
[Sat Apr 18 22:51:13.762198 2026] [:error] [pid 9970:tid 9986] [client 52.236.80.95:62097] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aeOaYSYdRLRhVmaIMx3j9QAAAMw"]
[Sat Apr 18 22:51:14.357149 2026] [:error] [pid 9970:tid 9995] [client 52.236.80.95:63111] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aeOaYiYdRLRhVmaIMx3j-QAAANU"]
[Sat Apr 18 22:51:14.955452 2026] [:error] [pid 32678:tid 32731] [client 52.236.80.95:62130] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aeOaYhUlAXU_ZWUu5y8S_AAAApg"]
[Sat Apr 18 22:51:15.541299 2026] [:error] [pid 9970:tid 9989] [client 52.236.80.95:63140] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ai.php"] [unique_id "aeOaYyYdRLRhVmaIMx3kAgAAAM8"]
[Sat Apr 18 22:51:16.077459 2026] [:error] [pid 13023:tid 13046] [client 52.236.80.95:64664] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ai.php"] [unique_id "aeOaZP1e7hG8DAeABB9EGQAAARU"]
[Sat Apr 18 22:51:16.581053 2026] [:error] [pid 9970:tid 9974] [client 52.236.80.95:64665] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ai.php"] [unique_id "aeOaZCYdRLRhVmaIMx3kBwAAAMA"]
[Sat Apr 18 22:51:17.712892 2026] [:error] [pid 9970:tid 9986] [client 52.236.80.95:64584] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ai.php"] [unique_id "aeOaZSYdRLRhVmaIMx3kEgAAAMw"]
[Sat Apr 18 22:51:18.758713 2026] [:error] [pid 9970:tid 9983] [client 52.236.80.95:65215] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amwxl.php"] [unique_id "aeOaZiYdRLRhVmaIMx3kFwAAAMk"]
[Sat Apr 18 22:51:19.437919 2026] [:error] [pid 34290:tid 34322] [client 52.236.80.95:65212] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amwxl.php"] [unique_id "aeOaZxqX6WpmmAXOBi8tHAAAAcM"]
[Sat Apr 18 22:51:20.019822 2026] [:error] [pid 13023:tid 13043] [client 52.236.80.95:62533] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amwxl.php"] [unique_id "aeOaaP1e7hG8DAeABB9EGgAAARI"]
[Sat Apr 18 22:51:20.581644 2026] [:error] [pid 9864:tid 9920] [client 52.236.80.95:64688] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amwxl.php"] [unique_id "aeOaaICFeowknfXHM7ky9QAAAE4"]
[Sat Apr 18 22:51:21.129580 2026] [:error] [pid 9865:tid 9941] [client 52.236.80.95:63049] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awdld.php"] [unique_id "aeOaaazb5knECIY-C-ik9gAAAIQ"]
[Sat Apr 18 22:51:21.632141 2026] [:error] [pid 9865:tid 9950] [client 52.236.80.95:63165] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awdld.php"] [unique_id "aeOaaazb5knECIY-C-ik-AAAAI0"]
[Sat Apr 18 22:51:22.209894 2026] [:error] [pid 13023:tid 13045] [client 52.236.80.95:63955] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awdld.php"] [unique_id "aeOaav1e7hG8DAeABB9EGwAAARQ"]
[Sat Apr 18 22:51:22.806538 2026] [:error] [pid 32647:tid 32651] [client 52.236.80.95:64679] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awdld.php"] [unique_id "aeOaakkxooM0iRo6e54ytQAAAgE"]
[Sat Apr 18 22:51:23.378034 2026] [:error] [pid 9865:tid 9961] [client 52.236.80.95:63587] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkyac.php"] [unique_id "aeOaa6zb5knECIY-C-ilAgAAAJg"]
[Sat Apr 18 22:51:23.901989 2026] [:error] [pid 9865:tid 9953] [client 52.236.80.95:63664] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkyac.php"] [unique_id "aeOaa6zb5knECIY-C-ilCAAAAJA"]
[Sat Apr 18 22:51:24.447383 2026] [:error] [pid 9865:tid 9946] [client 52.236.80.95:64577] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkyac.php"] [unique_id "aeOabKzb5knECIY-C-ilCgAAAIk"]
[Sat Apr 18 22:51:24.950063 2026] [:error] [pid 9864:tid 9910] [client 52.236.80.95:63962] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkyac.php"] [unique_id "aeOabICFeowknfXHM7ky-QAAAEU"]
[Sat Apr 18 22:51:25.514676 2026] [:error] [pid 9863:tid 9875] [client 52.236.80.95:62049] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/krntz.php"] [unique_id "aeOabTjjiypiFrTucbLZwwAAAAI"]
[Sat Apr 18 22:51:26.091130 2026] [:error] [pid 13023:tid 13032] [client 52.236.80.95:63590] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/krntz.php"] [unique_id "aeOabv1e7hG8DAeABB9EHQAAAQc"]
[Sat Apr 18 22:51:26.747618 2026] [:error] [pid 34290:tid 34327] [client 52.236.80.95:64060] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/krntz.php"] [unique_id "aeOabhqX6WpmmAXOBi8tIQAAAcg"]
[Sat Apr 18 22:51:27.299770 2026] [:error] [pid 32647:tid 32652] [client 52.236.80.95:63563] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/krntz.php"] [unique_id "aeOab0kxooM0iRo6e54yuQAAAgI"]
[Sat Apr 18 22:51:27.819763 2026] [:error] [pid 9863:tid 9888] [client 52.236.80.95:61435] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vhwwnrnmqc.php"] [unique_id "aeOabzjjiypiFrTucbLZxgAAAA8"]
[Sat Apr 18 22:51:28.359330 2026] [:error] [pid 13023:tid 13031] [client 52.236.80.95:65103] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vhwwnrnmqc.php"] [unique_id "aeOacP1e7hG8DAeABB9EHwAAAQY"]
[Sat Apr 18 22:51:28.903072 2026] [:error] [pid 32647:tid 32657] [client 52.236.80.95:64034] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vhwwnrnmqc.php"] [unique_id "aeOacEkxooM0iRo6e54yugAAAgc"]
[Sat Apr 18 22:51:29.432686 2026] [:error] [pid 13023:tid 13044] [client 52.236.80.95:63636] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vhwwnrnmqc.php"] [unique_id "aeOacf1e7hG8DAeABB9EIAAAARM"]
[Sat Apr 18 22:51:30.020450 2026] [:error] [pid 9970:tid 9985] [client 52.236.80.95:63946] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenium4.php"] [unique_id "aeOaciYdRLRhVmaIMx3kIAAAAMs"]
[Sat Apr 18 22:51:30.679245 2026] [:error] [pid 13023:tid 13039] [client 52.236.80.95:63056] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenium4.php"] [unique_id "aeOacv1e7hG8DAeABB9EIwAAAQ4"]
[Sat Apr 18 22:51:31.244593 2026] [:error] [pid 34290:tid 34332] [client 52.236.80.95:63568] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenium4.php"] [unique_id "aeOacxqX6WpmmAXOBi8tKQAAAc0"]
[Sat Apr 18 22:51:31.777064 2026] [:error] [pid 13023:tid 13037] [client 52.236.80.95:63121] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenium4.php"] [unique_id "aeOac_1e7hG8DAeABB9EJAAAAQw"]
[Sat Apr 18 22:51:32.384564 2026] [:error] [pid 9865:tid 9952] [client 52.236.80.95:62582] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vaza.php"] [unique_id "aeOadKzb5knECIY-C-ilFgAAAI8"]
[Sat Apr 18 22:51:32.939183 2026] [:error] [pid 32677:tid 32700] [client 52.236.80.95:64643] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vaza.php"] [unique_id "aeOadBngmUE3LdC-wP7xywAAAlQ"]
[Sat Apr 18 22:51:33.501994 2026] [:error] [pid 9970:tid 9974] [client 52.236.80.95:63968] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vaza.php"] [unique_id "aeOadSYdRLRhVmaIMx3kJwAAAMA"]
[Sat Apr 18 22:51:34.108046 2026] [:error] [pid 9970:tid 9977] [client 52.236.80.95:63646] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vaza.php"] [unique_id "aeOadiYdRLRhVmaIMx3kKQAAAMM"]
[Sat Apr 18 22:51:34.667014 2026] [:error] [pid 9970:tid 9981] [client 52.236.80.95:64687] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8573.php"] [unique_id "aeOadiYdRLRhVmaIMx3kLgAAAMc"]
[Sat Apr 18 22:51:35.398457 2026] [:error] [pid 32677:tid 32687] [client 52.236.80.95:63654] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8573.php"] [unique_id "aeOadxngmUE3LdC-wP7xzgAAAkc"]
[Sat Apr 18 22:51:35.959330 2026] [:error] [pid 32678:tid 32710] [client 52.236.80.95:63164] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8573.php"] [unique_id "aeOadxUlAXU_ZWUu5y8TCQAAAoM"]
[Sat Apr 18 22:51:36.542681 2026] [:error] [pid 13023:tid 13042] [client 52.236.80.95:64672] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8573.php"] [unique_id "aeOaeP1e7hG8DAeABB9EKgAAARE"]
[Sat Apr 18 22:51:37.315938 2026] [:error] [pid 32677:tid 32696] [client 52.236.80.95:62581] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rip.php"] [unique_id "aeOaeRngmUE3LdC-wP7x0QAAAlA"]
[Sat Apr 18 22:51:37.829221 2026] [:error] [pid 32647:tid 32658] [client 52.236.80.95:63597] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rip.php"] [unique_id "aeOaeUkxooM0iRo6e54yzQAAAgg"]
[Sat Apr 18 22:51:38.373965 2026] [:error] [pid 9970:tid 9978] [client 52.236.80.95:63975] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rip.php"] [unique_id "aeOaeiYdRLRhVmaIMx3kNwAAAMQ"]
[Sat Apr 18 22:51:38.926336 2026] [:error] [pid 9865:tid 9938] [client 52.236.80.95:64007] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rip.php"] [unique_id "aeOaeqzb5knECIY-C-ilHAAAAIE"]
[Sat Apr 18 22:51:39.468607 2026] [:error] [pid 13023:tid 13044] [client 52.236.80.95:65157] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drhunthq.php"] [unique_id "aeOae_1e7hG8DAeABB9ELwAAARM"]
[Sat Apr 18 22:51:39.973008 2026] [:error] [pid 9865:tid 9955] [client 52.236.80.95:65189] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drhunthq.php"] [unique_id "aeOae6zb5knECIY-C-ilIQAAAJI"]
[Sat Apr 18 22:51:40.588981 2026] [:error] [pid 9970:tid 9976] [client 52.236.80.95:65106] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drhunthq.php"] [unique_id "aeOafCYdRLRhVmaIMx3kPQAAAMI"]
[Sat Apr 18 22:51:44.589890 2026] [:error] [pid 9865:tid 9946] [client 52.236.80.95:65160] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drhunthq.php"] [unique_id "aeOagKzb5knECIY-C-ilKwAAAIk"]
[Sat Apr 18 22:51:45.203170 2026] [:error] [pid 9970:tid 9985] [client 52.236.80.95:63989] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aeOagSYdRLRhVmaIMx3kUgAAAMs"]
[Sat Apr 18 22:51:45.751703 2026] [:error] [pid 9970:tid 9987] [client 52.236.80.95:63091] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aeOagSYdRLRhVmaIMx3kUwAAAM0"]
[Sat Apr 18 22:51:46.448447 2026] [:error] [pid 9970:tid 9979] [client 52.236.80.95:64639] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aeOagiYdRLRhVmaIMx3kVwAAAMU"]
[Sat Apr 18 22:51:47.011571 2026] [:error] [pid 9970:tid 9996] [client 52.236.80.95:63561] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aeOagyYdRLRhVmaIMx3kXgAAANY"]
[Sat Apr 18 22:51:47.574540 2026] [:error] [pid 9864:tid 9908] [client 52.236.80.95:64599] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hots.php"] [unique_id "aeOag4CFeowknfXHM7kzAAAAAEM"]
[Sat Apr 18 22:51:48.175481 2026] [:error] [pid 32647:tid 32655] [client 52.236.80.95:63055] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hots.php"] [unique_id "aeOahEkxooM0iRo6e54y0AAAAgU"]
[Sat Apr 18 22:51:48.831529 2026] [:error] [pid 32677:tid 32702] [client 52.236.80.95:63156] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hots.php"] [unique_id "aeOahBngmUE3LdC-wP7x4AAAAlY"]
[Sat Apr 18 22:51:49.404185 2026] [:error] [pid 9970:tid 9993] [client 52.236.80.95:63988] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hots.php"] [unique_id "aeOahSYdRLRhVmaIMx3kaAAAANM"]
[Sat Apr 18 22:51:49.941728 2026] [:error] [pid 9970:tid 9985] [client 52.236.80.95:62107] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aeOahSYdRLRhVmaIMx3kbAAAAMs"]
[Sat Apr 18 22:51:50.481977 2026] [:error] [pid 34288:tid 34300] [client 52.236.80.95:65213] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aeOahuTIiy__PtiLmpneaQAAAYg"]
[Sat Apr 18 22:51:51.031570 2026] [:error] [pid 9865:tid 9940] [client 52.236.80.95:65166] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aeOah6zb5knECIY-C-ilLwAAAIM"]
[Sat Apr 18 22:51:51.568249 2026] [:error] [pid 32678:tid 32726] [client 52.236.80.95:65107] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aeOahxUlAXU_ZWUu5y8TEQAAApM"]
[Sat Apr 18 22:51:52.103670 2026] [:error] [pid 9865:tid 9939] [client 52.236.80.95:62548] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "aeOaiKzb5knECIY-C-ilMgAAAII"]
[Sat Apr 18 22:51:52.825808 2026] [:error] [pid 9970:tid 9984] [client 52.236.80.95:65152] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "aeOaiCYdRLRhVmaIMx3kcwAAAMo"]
[Sat Apr 18 22:51:53.390120 2026] [:error] [pid 32678:tid 32727] [client 52.236.80.95:63936] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "aeOaiRUlAXU_ZWUu5y8TGAAAApQ"]
[Sat Apr 18 22:51:54.081693 2026] [:error] [pid 9865:tid 9956] [client 52.236.80.95:63104] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws84.php"] [unique_id "aeOaiqzb5knECIY-C-ilNwAAAJM"]
[Sat Apr 18 22:51:54.594523 2026] [:error] [pid 9970:tid 9975] [client 52.236.80.95:64040] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/c4.php"] [unique_id "aeOaiiYdRLRhVmaIMx3kdgAAAME"]
[Sat Apr 18 22:51:55.117917 2026] [:error] [pid 32678:tid 32709] [client 52.236.80.95:65207] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/c4.php"] [unique_id "aeOaixUlAXU_ZWUu5y8TGwAAAoI"]
[Sat Apr 18 22:51:55.765886 2026] [:error] [pid 32678:tid 32724] [client 52.236.80.95:61486] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/c4.php"] [unique_id "aeOaixUlAXU_ZWUu5y8TIAAAApE"]
[Sat Apr 18 22:51:56.314777 2026] [:error] [pid 9865:tid 9961] [client 52.236.80.95:63572] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/c4.php"] [unique_id "aeOajKzb5knECIY-C-ilPQAAAJg"]
[Sat Apr 18 22:51:56.900337 2026] [:error] [pid 32647:tid 32661] [client 52.236.80.95:63140] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lclnqiii.php"] [unique_id "aeOajEkxooM0iRo6e54y2AAAAgs"]
[Sat Apr 18 22:51:57.403736 2026] [:error] [pid 9865:tid 9960] [client 52.236.80.95:60666] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lclnqiii.php"] [unique_id "aeOajazb5knECIY-C-ilPwAAAJc"]
[Sat Apr 18 22:51:58.152759 2026] [:error] [pid 32677:tid 32693] [client 52.236.80.95:64681] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lclnqiii.php"] [unique_id "aeOajhngmUE3LdC-wP7x5AAAAk0"]
[Sat Apr 18 22:51:58.702939 2026] [:error] [pid 9970:tid 9993] [client 52.236.80.95:63166] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lclnqiii.php"] [unique_id "aeOajiYdRLRhVmaIMx3kdwAAANM"]
[Sat Apr 18 22:51:59.261977 2026] [:error] [pid 32647:tid 32663] [client 52.236.80.95:63653] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat.php"] [unique_id "aeOaj0kxooM0iRo6e54y2gAAAg0"]
[Sat Apr 18 22:51:59.813318 2026] [:error] [pid 34288:tid 34313] [client 52.236.80.95:63142] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat.php"] [unique_id "aeOaj-TIiy__PtiLmpneagAAAZU"]
[Sat Apr 18 22:52:00.357756 2026] [:error] [pid 32677:tid 32690] [client 52.236.80.95:63552] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goat.php"] [unique_id "aeOakBngmUE3LdC-wP7x6AAAAko"]
[Sat Apr 18 22:52:12.300649 2026] [:error] [pid 32678:tid 32716] [client 52.236.80.95:64036] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "aeOanBUlAXU_ZWUu5y8TOAAAAok"]
[Sat Apr 18 22:52:12.929903 2026] [:error] [pid 32678:tid 32715] [client 52.236.80.95:6147] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "aeOanBUlAXU_ZWUu5y8TOgAAAog"]
[Sat Apr 18 22:52:13.630147 2026] [:error] [pid 32678:tid 32710] [client 52.236.80.95:65096] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "aeOanRUlAXU_ZWUu5y8TPgAAAoM"]
[Sat Apr 18 22:52:14.241089 2026] [:error] [pid 9863:tid 9873] [client 52.236.80.95:64586] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rithin.php"] [unique_id "aeOanjjjiypiFrTucbLZ1QAAAAA"]
[Sat Apr 18 22:52:14.945542 2026] [:error] [pid 34290:tid 34334] [client 52.236.80.95:64622] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aeOanhqX6WpmmAXOBi8tOQAAAc8"]
[Sat Apr 18 22:52:15.566696 2026] [:error] [pid 9865:tid 9960] [client 52.236.80.95:63614] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aeOan6zb5knECIY-C-ilTAAAAJc"]
[Sat Apr 18 22:52:16.136151 2026] [:error] [pid 9865:tid 9953] [client 52.236.80.95:6204] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aeOaoKzb5knECIY-C-ilTgAAAJA"]
[Sat Apr 18 22:52:16.689651 2026] [:error] [pid 9865:tid 9952] [client 52.236.80.95:6172] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aeOaoKzb5knECIY-C-ilUQAAAI8"]
[Sat Apr 18 22:52:17.235469 2026] [:error] [pid 13023:tid 13040] [client 52.236.80.95:62625] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xfun.php"] [unique_id "aeOaof1e7hG8DAeABB9EXAAAAQ8"]
[Sat Apr 18 22:52:17.818071 2026] [:error] [pid 13023:tid 13042] [client 52.236.80.95:63996] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xfun.php"] [unique_id "aeOaof1e7hG8DAeABB9EXgAAARE"]
[Sat Apr 18 22:52:18.366504 2026] [:error] [pid 32677:tid 32697] [client 52.236.80.95:64655] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xfun.php"] [unique_id "aeOaohngmUE3LdC-wP7x7wAAAlE"]
[Sat Apr 18 22:52:18.879860 2026] [:error] [pid 9863:tid 9884] [client 52.236.80.95:64703] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xfun.php"] [unique_id "aeOaojjjiypiFrTucbLZ2gAAAAs"]
[Sat Apr 18 22:52:19.465783 2026] [:error] [pid 32678:tid 32707] [client 52.236.80.95:60731] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws88.php"] [unique_id "aeOaoxUlAXU_ZWUu5y8TRwAAAoA"]
[Sat Apr 18 22:52:19.993244 2026] [:error] [pid 9863:tid 9875] [client 52.236.80.95:63578] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws88.php"] [unique_id "aeOaozjjiypiFrTucbLZ2wAAAAI"]
[Sat Apr 18 22:52:20.604251 2026] [:error] [pid 32677:tid 32685] [client 52.236.80.95:64587] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws88.php"] [unique_id "aeOapBngmUE3LdC-wP7x8QAAAkU"]
[Sat Apr 18 22:52:21.184781 2026] [:error] [pid 9865:tid 9940] [client 52.236.80.95:60629] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws88.php"] [unique_id "aeOapazb5knECIY-C-ilWQAAAIM"]
[Sat Apr 18 22:52:21.866787 2026] [:error] [pid 32647:tid 32668] [client 52.236.80.95:64601] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "aeOapUkxooM0iRo6e54y3wAAAhI"]
[Sat Apr 18 22:52:22.409003 2026] [:error] [pid 32647:tid 32661] [client 52.236.80.95:65181] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "aeOapkkxooM0iRo6e54y4AAAAgs"]
[Sat Apr 18 22:52:23.117334 2026] [:error] [pid 32677:tid 32700] [client 52.236.80.95:63999] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "aeOapxngmUE3LdC-wP7x8wAAAlQ"]
[Sat Apr 18 22:52:23.680601 2026] [:error] [pid 32677:tid 32703] [client 52.236.80.95:65133] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "aeOapxngmUE3LdC-wP7x9gAAAlc"]
[Sat Apr 18 22:52:24.203728 2026] [:error] [pid 9970:tid 9989] [client 52.236.80.95:64607] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "aeOaqCYdRLRhVmaIMx3kkAAAAM8"]
[Sat Apr 18 22:52:25.074218 2026] [:error] [pid 9864:tid 9914] [client 52.236.80.95:64690] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "aeOaqYCFeowknfXHM7kzDwAAAEg"]
[Sat Apr 18 22:52:25.607172 2026] [:error] [pid 32678:tid 32712] [client 52.236.80.95:63116] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "aeOaqRUlAXU_ZWUu5y8TTgAAAoU"]
[Sat Apr 18 22:52:26.145733 2026] [:error] [pid 9864:tid 9919] [client 52.236.80.95:65208] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws85.php"] [unique_id "aeOaqoCFeowknfXHM7kzEQAAAE0"]
[Sat Apr 18 22:52:26.755757 2026] [:error] [pid 32678:tid 32715] [client 52.236.80.95:63113] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "aeOaqhUlAXU_ZWUu5y8TUQAAAog"]
[Sat Apr 18 22:52:27.372609 2026] [:error] [pid 9865:tid 9951] [client 52.236.80.95:64001] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "aeOaq6zb5knECIY-C-ilXQAAAI4"]
[Sat Apr 18 22:52:27.973543 2026] [:error] [pid 32678:tid 32713] [client 52.236.80.95:63139] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "aeOaqxUlAXU_ZWUu5y8TVwAAAoY"]
[Sat Apr 18 22:52:28.562426 2026] [:error] [pid 32678:tid 32730] [client 52.236.80.95:63125] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "aeOarBUlAXU_ZWUu5y8TWwAAApc"]
[Sat Apr 18 22:52:29.115722 2026] [:error] [pid 13023:tid 13027] [client 52.236.80.95:64627] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/h2.php"] [unique_id "aeOarf1e7hG8DAeABB9EZQAAAQI"]
[Sat Apr 18 22:52:29.687132 2026] [:error] [pid 34288:tid 34310] [client 52.236.80.95:64011] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/h2.php"] [unique_id "aeOareTIiy__PtiLmpnebgAAAZI"]
[Sat Apr 18 22:52:30.353516 2026] [:error] [pid 34288:tid 34316] [client 52.236.80.95:65113] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/h2.php"] [unique_id "aeOaruTIiy__PtiLmpnebwAAAZg"]
[Sat Apr 18 22:52:31.255770 2026] [:error] [pid 9970:tid 9981] [client 52.236.80.95:62643] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/h2.php"] [unique_id "aeOaryYdRLRhVmaIMx3kkQAAAMc"]
[Sat Apr 18 22:52:31.819931 2026] [:error] [pid 9970:tid 9984] [client 52.236.80.95:64049] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dass.php"] [unique_id "aeOaryYdRLRhVmaIMx3kkgAAAMo"]
[Sat Apr 18 22:52:32.334982 2026] [:error] [pid 9970:tid 9975] [client 52.236.80.95:63588] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dass.php"] [unique_id "aeOasCYdRLRhVmaIMx3kkwAAAME"]
[Sat Apr 18 22:52:32.893299 2026] [:error] [pid 9970:tid 9997] [client 52.236.80.95:64631] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dass.php"] [unique_id "aeOasCYdRLRhVmaIMx3klQAAANc"]
[Sat Apr 18 22:52:33.507147 2026] [:error] [pid 9970:tid 9978] [client 52.236.80.95:6168] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dass.php"] [unique_id "aeOasSYdRLRhVmaIMx3klwAAAMQ"]
[Sat Apr 18 22:52:34.165970 2026] [:error] [pid 9970:tid 9988] [client 52.236.80.95:63095] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "aeOasiYdRLRhVmaIMx3knQAAAM4"]
[Sat Apr 18 22:52:34.784770 2026] [:error] [pid 9970:tid 9990] [client 52.236.80.95:64031] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "aeOasiYdRLRhVmaIMx3kogAAANA"]
[Sat Apr 18 22:52:35.838294 2026] [:error] [pid 13023:tid 13036] [client 52.236.80.95:60669] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "aeOas_1e7hG8DAeABB9EawAAAQs"]
[Sat Apr 18 22:52:36.751368 2026] [:error] [pid 9970:tid 9980] [client 52.236.80.95:64701] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "aeOatCYdRLRhVmaIMx3kqgAAAMY"]
[Sat Apr 18 22:52:37.316103 2026] [:error] [pid 9970:tid 9993] [client 52.236.80.95:63615] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aeOatSYdRLRhVmaIMx3krAAAANM"]
[Sat Apr 18 22:52:38.016157 2026] [:error] [pid 9970:tid 9989] [client 52.236.80.95:63966] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aeOatiYdRLRhVmaIMx3krwAAAM8"]
[Sat Apr 18 22:52:38.582387 2026] [:error] [pid 9970:tid 9987] [client 52.236.80.95:6173] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aeOatiYdRLRhVmaIMx3ksgAAAM0"]
[Sat Apr 18 22:52:39.187182 2026] [:error] [pid 9970:tid 9976] [client 52.236.80.95:63970] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aeOatyYdRLRhVmaIMx3ktQAAAMI"]
[Sat Apr 18 22:52:39.864289 2026] [:error] [pid 9970:tid 9982] [client 52.236.80.95:64697] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lowpr.php"] [unique_id "aeOatyYdRLRhVmaIMx3kuQAAAMg"]
[Sat Apr 18 22:52:41.268564 2026] [:error] [pid 32678:tid 32710] [client 52.236.80.95:63047] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lowpr.php"] [unique_id "aeOauRUlAXU_ZWUu5y8TXwAAAoM"]
[Sat Apr 18 22:52:42.072093 2026] [:error] [pid 32677:tid 32693] [client 52.236.80.95:62083] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lowpr.php"] [unique_id "aeOauhngmUE3LdC-wP7yAAAAAk0"]
[Sat Apr 18 22:52:42.842224 2026] [:error] [pid 32677:tid 32699] [client 52.236.80.95:65196] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lowpr.php"] [unique_id "aeOauhngmUE3LdC-wP7yBAAAAlM"]
[Sat Apr 18 22:52:43.578980 2026] [:error] [pid 32678:tid 32731] [client 52.236.80.95:64050] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "aeOauxUlAXU_ZWUu5y8TYAAAApg"]
[Sat Apr 18 22:52:44.265699 2026] [:error] [pid 32647:tid 32651] [client 52.236.80.95:64581] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "aeOavEkxooM0iRo6e54y5QAAAgE"]
[Sat Apr 18 22:52:44.830410 2026] [:error] [pid 32677:tid 32684] [client 52.236.80.95:65177] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "aeOavBngmUE3LdC-wP7yCAAAAkQ"]
[Sat Apr 18 22:52:45.452624 2026] [:error] [pid 9864:tid 9908] [client 52.236.80.95:61387] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wtiiy.php"] [unique_id "aeOavYCFeowknfXHM7kzFQAAAEM"]
[Sat Apr 18 22:52:46.020845 2026] [:error] [pid 32677:tid 32704] [client 52.236.80.95:63124] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "aeOavhngmUE3LdC-wP7yCgAAAlg"]
[Sat Apr 18 22:52:46.774956 2026] [:error] [pid 9864:tid 9930] [client 52.236.80.95:63157] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "aeOavoCFeowknfXHM7kzGAAAAFg"]
[Sat Apr 18 22:52:47.655575 2026] [:error] [pid 32678:tid 32713] [client 52.236.80.95:64642] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "aeOavxUlAXU_ZWUu5y8TZQAAAoY"]
[Sat Apr 18 22:52:48.256123 2026] [:error] [pid 9864:tid 9922] [client 52.236.80.95:63670] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "aeOawICFeowknfXHM7kzHgAAAFA"]
[Sat Apr 18 22:52:48.836812 2026] [:error] [pid 9864:tid 9929] [client 52.236.80.95:6155] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "aeOawICFeowknfXHM7kzIAAAAFc"]
[Sat Apr 18 22:52:49.524208 2026] [:error] [pid 32678:tid 32719] [client 52.236.80.95:65139] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "aeOawRUlAXU_ZWUu5y8TaAAAAow"]
[Sat Apr 18 22:52:50.133484 2026] [:error] [pid 9865:tid 9937] [client 52.236.80.95:64659] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "aeOawqzb5knECIY-C-ilZwAAAIA"]
[Sat Apr 18 22:52:51.042097 2026] [:error] [pid 9970:tid 9979] [client 52.236.80.95:62528] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "aeOawyYdRLRhVmaIMx3kwwAAAMU"]
[Sat Apr 18 22:52:51.657369 2026] [:error] [pid 32647:tid 32659] [client 52.236.80.95:63147] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/csv.php"] [unique_id "aeOaw0kxooM0iRo6e54y6wAAAgk"]
[Sat Apr 18 22:52:52.275282 2026] [:error] [pid 9863:tid 9892] [client 52.236.80.95:65146] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/csv.php"] [unique_id "aeOaxDjjiypiFrTucbLZ4gAAABM"]
[Sat Apr 18 22:52:52.864649 2026] [:error] [pid 32678:tid 32729] [client 52.236.80.95:65088] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/csv.php"] [unique_id "aeOaxBUlAXU_ZWUu5y8TdgAAApY"]
[Sat Apr 18 22:52:53.569265 2026] [:error] [pid 32678:tid 32722] [client 52.236.80.95:65187] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/csv.php"] [unique_id "aeOaxRUlAXU_ZWUu5y8TeQAAAo8"]
[Sat Apr 18 22:52:54.350563 2026] [:error] [pid 13023:tid 13043] [client 52.236.80.95:65100] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "aeOaxv1e7hG8DAeABB9EfQAAARI"]
[Sat Apr 18 22:52:54.942662 2026] [:error] [pid 9970:tid 9977] [client 52.236.80.95:63979] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "aeOaxiYdRLRhVmaIMx3kxQAAAMM"]
[Sat Apr 18 22:52:55.768447 2026] [:error] [pid 13023:tid 13032] [client 52.236.80.95:64583] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "aeOax_1e7hG8DAeABB9EggAAAQc"]
[Sat Apr 18 22:52:56.557749 2026] [:error] [pid 13023:tid 13025] [client 52.236.80.95:61442] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sale.php"] [unique_id "aeOayP1e7hG8DAeABB9EhgAAAQA"]
[Sat Apr 18 22:52:57.227901 2026] [:error] [pid 32678:tid 32713] [client 52.236.80.95:64648] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa21.php"] [unique_id "aeOayRUlAXU_ZWUu5y8TfgAAAoY"]
[Sat Apr 18 22:52:57.865931 2026] [:error] [pid 32677:tid 32684] [client 52.236.80.95:64652] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa21.php"] [unique_id "aeOayRngmUE3LdC-wP7yGwAAAkQ"]
[Sat Apr 18 22:52:58.512205 2026] [:error] [pid 32678:tid 32729] [client 52.236.80.95:63660] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa21.php"] [unique_id "aeOayhUlAXU_ZWUu5y8TgAAAApY"]
[Sat Apr 18 22:52:59.225888 2026] [:error] [pid 32678:tid 32727] [client 52.236.80.95:64004] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa21.php"] [unique_id "aeOayxUlAXU_ZWUu5y8TggAAApQ"]
[Sat Apr 18 22:52:59.865421 2026] [:error] [pid 32678:tid 32731] [client 52.236.80.95:63642] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "aeOayxUlAXU_ZWUu5y8ThQAAApg"]
[Sat Apr 18 22:53:00.516785 2026] [:error] [pid 32678:tid 32709] [client 52.236.80.95:62594] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "aeOazBUlAXU_ZWUu5y8TiQAAAoI"]
[Sat Apr 18 22:53:01.135100 2026] [:error] [pid 32678:tid 32719] [client 52.236.80.95:63596] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "aeOazRUlAXU_ZWUu5y8TjQAAAow"]
[Sat Apr 18 22:53:01.840691 2026] [:error] [pid 9864:tid 9929] [client 52.236.80.95:65123] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws73.php"] [unique_id "aeOazYCFeowknfXHM7kzJgAAAFc"]
[Sat Apr 18 22:53:02.677211 2026] [:error] [pid 13023:tid 13030] [client 52.236.80.95:63622] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bootstrap.php"] [unique_id "aeOazv1e7hG8DAeABB9EjAAAAQU"]
[Sat Apr 18 22:53:03.259622 2026] [:error] [pid 34288:tid 34312] [client 52.236.80.95:64626] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bootstrap.php"] [unique_id "aeOaz-TIiy__PtiLmpnedAAAAZQ"]
[Sat Apr 18 22:53:04.004720 2026] [:error] [pid 9864:tid 9927] [client 52.236.80.95:63119] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bootstrap.php"] [unique_id "aeOa0ICFeowknfXHM7kzJwAAAFU"]
[Sat Apr 18 22:53:04.752016 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:63575] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bootstrap.php"] [unique_id "aeOa0P1e7hG8DAeABB9EjQAAAQE"]
[Sat Apr 18 22:53:05.518367 2026] [:error] [pid 32647:tid 32657] [client 52.236.80.95:65135] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aeOa0UkxooM0iRo6e54y7AAAAgc"]
[Sat Apr 18 22:53:06.185864 2026] [:error] [pid 13023:tid 13039] [client 52.236.80.95:63153] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aeOa0v1e7hG8DAeABB9EkQAAAQ4"]
[Sat Apr 18 22:53:08.442762 2026] [:error] [pid 9865:tid 9944] [client 52.236.80.95:64692] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aeOa1Kzb5knECIY-C-ilcwAAAIc"]
[Sat Apr 18 22:53:09.654464 2026] [:error] [pid 9865:tid 9947] [client 52.236.80.95:65151] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aeOa1azb5knECIY-C-ildgAAAIo"]
[Sat Apr 18 22:53:10.555485 2026] [:error] [pid 32647:tid 32665] [client 52.236.80.95:63645] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Sanskrit.php"] [unique_id "aeOa1kkxooM0iRo6e54y7wAAAg8"]
[Sat Apr 18 22:53:21.426957 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:63042] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsgdjkl.php"] [unique_id "aeOa4f1e7hG8DAeABB9EsAAAAQE"]
[Sat Apr 18 22:53:22.563453 2026] [:error] [pid 13023:tid 13037] [client 52.236.80.95:6184] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsgdjkl.php"] [unique_id "aeOa4v1e7hG8DAeABB9EtAAAAQw"]
[Sat Apr 18 22:53:23.462093 2026] [:error] [pid 32677:tid 32689] [client 52.236.80.95:64059] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsgdjkl.php"] [unique_id "aeOa4xngmUE3LdC-wP7yJQAAAkk"]
[Sat Apr 18 22:53:24.384407 2026] [:error] [pid 34288:tid 34311] [client 52.236.80.95:63574] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsgdjkl.php"] [unique_id "aeOa5OTIiy__PtiLmpneegAAAZM"]
[Sat Apr 18 22:53:25.383466 2026] [:error] [pid 32647:tid 32674] [client 52.236.80.95:62624] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aeOa5UkxooM0iRo6e54y8gAAAhg"]
[Sat Apr 18 22:53:26.563117 2026] [:error] [pid 9865:tid 9937] [client 52.236.80.95:62641] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aeOa5qzb5knECIY-C-ilewAAAIA"]
[Sat Apr 18 22:53:27.407097 2026] [:error] [pid 32647:tid 32663] [client 52.236.80.95:63591] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aeOa50kxooM0iRo6e54y9AAAAg0"]
[Sat Apr 18 22:53:28.148481 2026] [:error] [pid 9865:tid 9945] [client 52.236.80.95:63663] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "aeOa6Kzb5knECIY-C-ilgAAAAIg"]
[Sat Apr 18 22:53:29.088464 2026] [:error] [pid 9970:tid 9983] [client 52.236.80.95:64610] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "aeOa6SYdRLRhVmaIMx3kxwAAAMk"]
[Sat Apr 18 22:53:30.185192 2026] [:error] [pid 32678:tid 32726] [client 52.236.80.95:6196] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "aeOa6hUlAXU_ZWUu5y8TmQAAApM"]
[Sat Apr 18 22:53:31.396565 2026] [:error] [pid 9970:tid 9998] [client 52.236.80.95:62638] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "aeOa6yYdRLRhVmaIMx3kygAAANg"]
[Sat Apr 18 22:53:32.034727 2026] [:error] [pid 34290:tid 34325] [client 52.236.80.95:64613] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "aeOa7BqX6WpmmAXOBi8tSQAAAcY"]
[Sat Apr 18 22:53:32.922703 2026] [:error] [pid 32678:tid 32727] [client 52.236.80.95:62081] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ta0ol.php"] [unique_id "aeOa7BUlAXU_ZWUu5y8TnAAAApQ"]
[Sat Apr 18 22:53:33.845409 2026] [:error] [pid 32647:tid 32657] [client 52.236.80.95:6187] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ta0ol.php"] [unique_id "aeOa7UkxooM0iRo6e54y9wAAAgc"]
[Sat Apr 18 22:53:34.361833 2026] [:error] [pid 32677:tid 32702] [client 52.236.80.95:60692] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ta0ol.php"] [unique_id "aeOa7hngmUE3LdC-wP7yLAAAAlY"]
[Sat Apr 18 22:53:35.715287 2026] [:error] [pid 32647:tid 32666] [client 52.236.80.95:65188] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ta0ol.php"] [unique_id "aeOa70kxooM0iRo6e54y-QAAAhA"]
[Sat Apr 18 22:53:36.570775 2026] [:error] [pid 34290:tid 34332] [client 52.236.80.95:6202] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a6.php"] [unique_id "aeOa8BqX6WpmmAXOBi8tSgAAAc0"]
[Sat Apr 18 22:53:37.750973 2026] [:error] [pid 32677:tid 32680] [client 52.236.80.95:64063] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a6.php"] [unique_id "aeOa8RngmUE3LdC-wP7yLQAAAkA"]
[Sat Apr 18 22:53:38.447273 2026] [:error] [pid 32678:tid 32730] [client 52.236.80.95:64671] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a6.php"] [unique_id "aeOa8hUlAXU_ZWUu5y8TowAAApc"]
[Sat Apr 18 22:53:39.497622 2026] [:error] [pid 32677:tid 32684] [client 52.236.80.95:64689] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a6.php"] [unique_id "aeOa8xngmUE3LdC-wP7yLwAAAkQ"]
[Sat Apr 18 22:53:40.223198 2026] [:error] [pid 9865:tid 9943] [client 52.236.80.95:63096] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a7.php"] [unique_id "aeOa9Kzb5knECIY-C-iljwAAAIY"]
[Sat Apr 18 22:53:41.232582 2026] [:error] [pid 32677:tid 32701] [client 52.236.80.95:6148] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a7.php"] [unique_id "aeOa9RngmUE3LdC-wP7yMQAAAlU"]
[Sat Apr 18 22:53:42.048567 2026] [:error] [pid 9970:tid 9979] [client 52.236.80.95:63108] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a7.php"] [unique_id "aeOa9iYdRLRhVmaIMx3kzAAAAMU"]
[Sat Apr 18 22:53:43.017804 2026] [:error] [pid 9865:tid 9953] [client 52.236.80.95:64685] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a7.php"] [unique_id "aeOa96zb5knECIY-C-ilmQAAAJA"]
[Sat Apr 18 22:53:43.681530 2026] [:error] [pid 13023:tid 13029] [client 52.236.80.95:61462] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a8.php"] [unique_id "aeOa9_1e7hG8DAeABB9EwgAAAQQ"]
[Sat Apr 18 22:53:44.324580 2026] [:error] [pid 13023:tid 13049] [client 52.236.80.95:63073] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a8.php"] [unique_id "aeOa-P1e7hG8DAeABB9ExAAAARg"]
[Sat Apr 18 22:53:47.477338 2026] [:error] [pid 32677:tid 32695] [client 52.236.80.95:62606] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a8.php"] [unique_id "aeOa-xngmUE3LdC-wP7yMwAAAk8"]
[Sat Apr 18 22:53:48.124643 2026] [:error] [pid 32678:tid 32728] [client 52.236.80.95:63984] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a8.php"] [unique_id "aeOa_BUlAXU_ZWUu5y8TqAAAApU"]
[Sat Apr 18 22:53:48.943337 2026] [:error] [pid 34290:tid 34330] [client 52.236.80.95:63131] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a9.php"] [unique_id "aeOa_BqX6WpmmAXOBi8tTQAAAcs"]
[Sat Apr 18 22:53:49.640960 2026] [:error] [pid 32677:tid 32682] [client 52.236.80.95:64629] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a9.php"] [unique_id "aeOa_RngmUE3LdC-wP7yNQAAAkI"]
[Sat Apr 18 22:53:50.257268 2026] [:error] [pid 13023:tid 13033] [client 52.236.80.95:62532] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a9.php"] [unique_id "aeOa_v1e7hG8DAeABB9E0AAAAQg"]
[Sat Apr 18 22:53:51.134165 2026] [:error] [pid 13023:tid 13045] [client 52.236.80.95:63651] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a9.php"] [unique_id "aeOa__1e7hG8DAeABB9E1AAAARQ"]
[Sat Apr 18 22:53:51.775999 2026] [:error] [pid 9865:tid 9949] [client 52.236.80.95:61410] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hnphq.php"] [unique_id "aeOa_6zb5knECIY-C-iloQAAAIw"]
[Sat Apr 18 22:53:52.444349 2026] [:error] [pid 32678:tid 32729] [client 52.236.80.95:63606] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hnphq.php"] [unique_id "aeObABUlAXU_ZWUu5y8TqgAAApY"]
[Sat Apr 18 22:53:53.050541 2026] [:error] [pid 9863:tid 9879] [client 52.236.80.95:63075] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hnphq.php"] [unique_id "aeObATjjiypiFrTucbLZ8AAAAAY"]
[Sat Apr 18 22:53:53.840704 2026] [:error] [pid 9863:tid 9889] [client 52.236.80.95:64592] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hnphq.php"] [unique_id "aeObATjjiypiFrTucbLZ8wAAABA"]
[Sat Apr 18 22:53:54.403167 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:63082] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/luyuc.php"] [unique_id "aeObAv1e7hG8DAeABB9E2AAAAQE"]
[Sat Apr 18 22:53:55.060013 2026] [:error] [pid 32647:tid 32667] [client 52.236.80.95:64645] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/luyuc.php"] [unique_id "aeObA0kxooM0iRo6e54zBwAAAhE"]
[Sat Apr 18 22:53:55.662780 2026] [:error] [pid 9865:tid 9947] [client 52.236.80.95:63556] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/luyuc.php"] [unique_id "aeObA6zb5knECIY-C-ilpgAAAIo"]
[Sat Apr 18 22:53:56.264320 2026] [:error] [pid 13023:tid 13033] [client 52.236.80.95:61388] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/luyuc.php"] [unique_id "aeObBP1e7hG8DAeABB9E2wAAAQg"]
[Sat Apr 18 22:53:56.822689 2026] [:error] [pid 32678:tid 32724] [client 52.236.80.95:63162] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-moonka.php"] [unique_id "aeObBBUlAXU_ZWUu5y8TrAAAApE"]
[Sat Apr 18 22:53:57.530796 2026] [:error] [pid 9864:tid 9909] [client 52.236.80.95:63671] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-moonka.php"] [unique_id "aeObBYCFeowknfXHM7kzNwAAAEQ"]
[Sat Apr 18 22:53:58.177086 2026] [:error] [pid 9865:tid 9951] [client 52.236.80.95:65156] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-moonka.php"] [unique_id "aeObBqzb5knECIY-C-ilqQAAAI4"]
[Sat Apr 18 22:53:58.735792 2026] [:error] [pid 9865:tid 9961] [client 52.236.80.95:63604] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-moonka.php"] [unique_id "aeObBqzb5knECIY-C-ilqwAAAJg"]
[Sat Apr 18 22:53:59.695404 2026] [:error] [pid 32677:tid 32697] [client 52.236.80.95:63151] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX1.php"] [unique_id "aeObBxngmUE3LdC-wP7yOwAAAlE"]
[Sat Apr 18 22:54:00.450188 2026] [:error] [pid 32678:tid 32725] [client 52.236.80.95:62122] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX1.php"] [unique_id "aeObCBUlAXU_ZWUu5y8TrQAAApI"]
[Sat Apr 18 22:54:01.022945 2026] [:error] [pid 32678:tid 32712] [client 52.236.80.95:63117] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX1.php"] [unique_id "aeObCRUlAXU_ZWUu5y8TrgAAAoU"]
[Sat Apr 18 22:54:01.548730 2026] [:error] [pid 9970:tid 9974] [client 52.236.80.95:61469] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX1.php"] [unique_id "aeObCSYdRLRhVmaIMx3k3AAAAMA"]
[Sat Apr 18 22:54:02.210798 2026] [:error] [pid 32678:tid 32717] [client 52.236.80.95:64045] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX2.php"] [unique_id "aeObChUlAXU_ZWUu5y8TsQAAAoo"]
[Sat Apr 18 22:54:02.795929 2026] [:error] [pid 13023:tid 13042] [client 52.236.80.95:63154] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX2.php"] [unique_id "aeObCv1e7hG8DAeABB9E4gAAARE"]
[Sat Apr 18 22:54:03.455944 2026] [:error] [pid 13023:tid 13031] [client 52.236.80.95:64005] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX2.php"] [unique_id "aeObC_1e7hG8DAeABB9E5QAAAQY"]
[Sat Apr 18 22:54:04.145711 2026] [:error] [pid 13023:tid 13038] [client 52.236.80.95:63605] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX2.php"] [unique_id "aeObDP1e7hG8DAeABB9E6QAAAQ0"]
[Sat Apr 18 22:54:05.097888 2026] [:error] [pid 9865:tid 9937] [client 52.236.80.95:64702] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/only.php"] [unique_id "aeObDazb5knECIY-C-ilrwAAAIA"]
[Sat Apr 18 22:54:05.669471 2026] [:error] [pid 32678:tid 32723] [client 52.236.80.95:6179] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/only.php"] [unique_id "aeObDRUlAXU_ZWUu5y8TtAAAApA"]
[Sat Apr 18 22:54:06.306377 2026] [:error] [pid 32677:tid 32693] [client 52.236.80.95:65159] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/only.php"] [unique_id "aeObDhngmUE3LdC-wP7yPwAAAk0"]
[Sat Apr 18 22:54:06.832096 2026] [:error] [pid 9865:tid 9960] [client 52.236.80.95:63948] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/only.php"] [unique_id "aeObDqzb5knECIY-C-iltAAAAJc"]
[Sat Apr 18 22:54:07.422931 2026] [:error] [pid 13023:tid 13027] [client 52.236.80.95:61447] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sts.php"] [unique_id "aeObD_1e7hG8DAeABB9E9AAAAQI"]
[Sat Apr 18 22:54:08.407815 2026] [:error] [pid 13023:tid 13031] [client 52.236.80.95:64051] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sts.php"] [unique_id "aeObEP1e7hG8DAeABB9E9gAAAQY"]
[Sat Apr 18 22:54:08.968697 2026] [:error] [pid 13023:tid 13049] [client 52.236.80.95:64013] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sts.php"] [unique_id "aeObEP1e7hG8DAeABB9E9wAAARg"]
[Sat Apr 18 22:54:09.536643 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:65161] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sts.php"] [unique_id "aeObEf1e7hG8DAeABB9E_AAAAQE"]
[Sat Apr 18 22:54:10.069204 2026] [:error] [pid 13023:tid 13031] [client 52.236.80.95:65185] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Geforce.php"] [unique_id "aeObEv1e7hG8DAeABB9E_wAAAQY"]
[Sat Apr 18 22:54:10.761047 2026] [:error] [pid 9865:tid 9953] [client 52.236.80.95:63994] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Geforce.php"] [unique_id "aeObEqzb5knECIY-C-iltwAAAJA"]
[Sat Apr 18 22:54:11.342937 2026] [:error] [pid 9865:tid 9942] [client 52.236.80.95:63998] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Geforce.php"] [unique_id "aeObE6zb5knECIY-C-iluAAAAIU"]
[Sat Apr 18 22:54:11.967486 2026] [:error] [pid 34290:tid 34341] [client 52.236.80.95:62621] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Geforce.php"] [unique_id "aeObExqX6WpmmAXOBi8tUgAAAdY"]
[Sat Apr 18 22:54:12.755024 2026] [:error] [pid 13023:tid 13029] [client 52.236.80.95:63661] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dichku.php"] [unique_id "aeObFP1e7hG8DAeABB9FAwAAAQQ"]
[Sat Apr 18 22:54:13.470982 2026] [:error] [pid 34290:tid 34326] [client 52.236.80.95:63099] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dichku.php"] [unique_id "aeObFRqX6WpmmAXOBi8tUwAAAcc"]
[Sat Apr 18 22:54:14.044266 2026] [:error] [pid 34290:tid 34320] [client 52.236.80.95:60651] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dichku.php"] [unique_id "aeObFhqX6WpmmAXOBi8tVQAAAcE"]
[Sat Apr 18 22:54:14.591803 2026] [:error] [pid 9863:tid 9893] [client 52.236.80.95:63640] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dichku.php"] [unique_id "aeObFjjjiypiFrTucbLZ_gAAABQ"]
[Sat Apr 18 22:54:15.118924 2026] [:error] [pid 34290:tid 34330] [client 52.236.80.95:63554] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aeObFxqX6WpmmAXOBi8tVwAAAcs"]
[Sat Apr 18 22:54:15.646781 2026] [:error] [pid 34290:tid 34322] [client 52.236.80.95:64661] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aeObFxqX6WpmmAXOBi8tWgAAAcM"]
[Sat Apr 18 22:54:16.173708 2026] [:error] [pid 34288:tid 34298] [client 52.236.80.95:64696] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aeObGOTIiy__PtiLmpneggAAAYY"]
[Sat Apr 18 22:54:16.732848 2026] [:error] [pid 13023:tid 13043] [client 52.236.80.95:64010] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "aeObGP1e7hG8DAeABB9FBAAAARI"]
[Sat Apr 18 22:54:17.267831 2026] [:error] [pid 32647:tid 32653] [client 52.236.80.95:63677] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htto.php"] [unique_id "aeObGUkxooM0iRo6e54zDgAAAgM"]
[Sat Apr 18 22:54:17.813353 2026] [:error] [pid 9865:tid 9952] [client 52.236.80.95:64033] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htto.php"] [unique_id "aeObGazb5knECIY-C-ilwAAAAI8"]
[Sat Apr 18 22:54:18.338967 2026] [:error] [pid 9863:tid 9883] [client 52.236.80.95:65201] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htto.php"] [unique_id "aeObGjjjiypiFrTucbLaAAAAAAo"]
[Sat Apr 18 22:54:19.022933 2026] [:error] [pid 32647:tid 32656] [client 52.236.80.95:64000] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htto.php"] [unique_id "aeObG0kxooM0iRo6e54zDwAAAgY"]
[Sat Apr 18 22:54:19.574854 2026] [:error] [pid 32678:tid 32720] [client 52.236.80.95:63603] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ccv.php"] [unique_id "aeObGxUlAXU_ZWUu5y8TwwAAAo0"]
[Sat Apr 18 22:54:29.744968 2026] [:error] [pid 9865:tid 9943] [client 52.236.80.95:64016] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "aeObJazb5knECIY-C-il0QAAAIY"]
[Sat Apr 18 22:54:30.531796 2026] [:error] [pid 32677:tid 32694] [client 52.236.80.95:65193] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "aeObJhngmUE3LdC-wP7ySQAAAk4"]
[Sat Apr 18 22:54:31.141136 2026] [:error] [pid 9863:tid 9892] [client 52.236.80.95:63120] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "aeObJzjjiypiFrTucbLaBgAAABM"]
[Sat Apr 18 22:54:31.690949 2026] [:error] [pid 9863:tid 9883] [client 52.236.80.95:65180] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "aeObJzjjiypiFrTucbLaCAAAAAo"]
[Sat Apr 18 22:54:32.276158 2026] [:error] [pid 9865:tid 9939] [client 52.236.80.95:64651] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new3.php"] [unique_id "aeObKKzb5knECIY-C-il1gAAAII"]
[Sat Apr 18 22:54:32.818099 2026] [:error] [pid 9865:tid 9951] [client 52.236.80.95:63569] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new3.php"] [unique_id "aeObKKzb5knECIY-C-il2AAAAI4"]
[Sat Apr 18 22:54:33.358696 2026] [:error] [pid 32678:tid 32714] [client 52.236.80.95:60696] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new3.php"] [unique_id "aeObKRUlAXU_ZWUu5y8TywAAAoc"]
[Sat Apr 18 22:54:33.925564 2026] [:error] [pid 32678:tid 32720] [client 52.236.80.95:65148] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new3.php"] [unique_id "aeObKRUlAXU_ZWUu5y8TzQAAAo0"]
[Sat Apr 18 22:54:34.438533 2026] [:error] [pid 9970:tid 9980] [client 52.236.80.95:63555] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0yellow.php"] [unique_id "aeObKiYdRLRhVmaIMx3k4AAAAMY"]
[Sat Apr 18 22:54:35.031684 2026] [:error] [pid 32678:tid 32710] [client 52.236.80.95:63105] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0yellow.php"] [unique_id "aeObKxUlAXU_ZWUu5y8TzgAAAoM"]
[Sat Apr 18 22:54:35.533939 2026] [:error] [pid 32678:tid 32729] [client 52.236.80.95:61417] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0yellow.php"] [unique_id "aeObKxUlAXU_ZWUu5y8TzwAAApY"]
[Sat Apr 18 22:54:36.284008 2026] [:error] [pid 32678:tid 32726] [client 52.236.80.95:61440] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0yellow.php"] [unique_id "aeObLBUlAXU_ZWUu5y8T0AAAApM"]
[Sat Apr 18 22:54:36.810251 2026] [:error] [pid 9865:tid 9950] [client 52.236.80.95:63110] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ortasekerli1.php"] [unique_id "aeObLKzb5knECIY-C-il3AAAAI0"]
[Sat Apr 18 22:54:37.362606 2026] [:error] [pid 9970:tid 9984] [client 52.236.80.95:63641] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ortasekerli1.php"] [unique_id "aeObLSYdRLRhVmaIMx3k4gAAAMo"]
[Sat Apr 18 22:54:37.959742 2026] [:error] [pid 9863:tid 9888] [client 52.236.80.95:63950] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ortasekerli1.php"] [unique_id "aeObLTjjiypiFrTucbLaEAAAAA8"]
[Sat Apr 18 22:54:38.489789 2026] [:error] [pid 32677:tid 32701] [client 52.236.80.95:63633] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ortasekerli1.php"] [unique_id "aeObLhngmUE3LdC-wP7yTQAAAlU"]
[Sat Apr 18 22:54:39.020359 2026] [:error] [pid 32678:tid 32725] [client 52.236.80.95:63631] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "aeObLxUlAXU_ZWUu5y8T1gAAApI"]
[Sat Apr 18 22:54:39.769782 2026] [:error] [pid 32647:tid 32673] [client 52.236.80.95:64686] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "aeObL0kxooM0iRo6e54zEgAAAhc"]
[Sat Apr 18 22:54:40.293848 2026] [:error] [pid 32647:tid 32650] [client 52.236.80.95:63107] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "aeObMEkxooM0iRo6e54zEwAAAgA"]
[Sat Apr 18 22:54:40.804815 2026] [:error] [pid 34290:tid 34330] [client 52.236.80.95:61434] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "aeObMBqX6WpmmAXOBi8tYQAAAcs"]
[Sat Apr 18 22:54:41.550112 2026] [:error] [pid 9863:tid 9895] [client 52.236.80.95:63940] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wziar1.php"] [unique_id "aeObMTjjiypiFrTucbLaEQAAABY"]
[Sat Apr 18 22:54:42.087567 2026] [:error] [pid 32647:tid 32674] [client 52.236.80.95:62535] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wziar1.php"] [unique_id "aeObMkkxooM0iRo6e54zFQAAAhg"]
[Sat Apr 18 22:54:42.709769 2026] [:error] [pid 34290:tid 34322] [client 52.236.80.95:64666] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wziar1.php"] [unique_id "aeObMhqX6WpmmAXOBi8tYwAAAcM"]
[Sat Apr 18 22:54:43.280158 2026] [:error] [pid 9865:tid 9957] [client 52.236.80.95:61499] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wziar1.php"] [unique_id "aeObM6zb5knECIY-C-il4QAAAJQ"]
[Sat Apr 18 22:54:44.008496 2026] [:error] [pid 9970:tid 9981] [client 52.236.80.95:65121] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/repurify.php"] [unique_id "aeObNCYdRLRhVmaIMx3k5wAAAMc"]
[Sat Apr 18 22:54:44.622542 2026] [:error] [pid 9970:tid 9989] [client 52.236.80.95:65155] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/repurify.php"] [unique_id "aeObNCYdRLRhVmaIMx3k6AAAAM8"]
[Sat Apr 18 22:54:45.231037 2026] [:error] [pid 32678:tid 32712] [client 52.236.80.95:63951] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/repurify.php"] [unique_id "aeObNRUlAXU_ZWUu5y8T2AAAAoU"]
[Sat Apr 18 22:54:45.949881 2026] [:error] [pid 32678:tid 32731] [client 52.236.80.95:63064] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/repurify.php"] [unique_id "aeObNRUlAXU_ZWUu5y8T2QAAApg"]
[Sat Apr 18 22:54:46.502391 2026] [:error] [pid 13023:tid 13039] [client 52.236.80.95:63616] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4GrJSiwkF3A.php"] [unique_id "aeObNv1e7hG8DAeABB9FCwAAAQ4"]
[Sat Apr 18 22:54:47.057749 2026] [:error] [pid 34290:tid 34319] [client 52.236.80.95:64650] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4GrJSiwkF3A.php"] [unique_id "aeObNxqX6WpmmAXOBi8tZQAAAcA"]
[Sat Apr 18 22:54:47.632260 2026] [:error] [pid 9865:tid 9960] [client 52.236.80.95:61437] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4GrJSiwkF3A.php"] [unique_id "aeObN6zb5knECIY-C-il4wAAAJc"]
[Sat Apr 18 22:54:48.193332 2026] [:error] [pid 9970:tid 9992] [client 52.236.80.95:64038] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4GrJSiwkF3A.php"] [unique_id "aeObOCYdRLRhVmaIMx3k7AAAANI"]
[Sat Apr 18 22:54:48.921887 2026] [:error] [pid 9970:tid 9983] [client 52.236.80.95:62578] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "aeObOCYdRLRhVmaIMx3k7QAAAMk"]
[Sat Apr 18 22:54:49.481374 2026] [:error] [pid 34290:tid 34335] [client 52.236.80.95:62142] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "aeObORqX6WpmmAXOBi8tZgAAAdA"]
[Sat Apr 18 22:54:50.081804 2026] [:error] [pid 9970:tid 9995] [client 52.236.80.95:63986] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "aeObOiYdRLRhVmaIMx3k8AAAANU"]
[Sat Apr 18 22:54:50.853995 2026] [:error] [pid 34288:tid 34297] [client 52.236.80.95:64641] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "aeObOuTIiy__PtiLmpnehwAAAYU"]
[Sat Apr 18 22:54:51.438667 2026] [:error] [pid 9970:tid 9994] [client 52.236.80.95:61393] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpxl.php"] [unique_id "aeObOyYdRLRhVmaIMx3k8gAAANQ"]
[Sat Apr 18 22:54:52.053781 2026] [:error] [pid 13023:tid 13025] [client 52.236.80.95:65142] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpxl.php"] [unique_id "aeObPP1e7hG8DAeABB9FDQAAAQA"]
[Sat Apr 18 22:54:52.732571 2026] [:error] [pid 32678:tid 32729] [client 52.236.80.95:63065] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpxl.php"] [unique_id "aeObPBUlAXU_ZWUu5y8T3QAAApY"]
[Sat Apr 18 22:54:53.296398 2026] [:error] [pid 9863:tid 9893] [client 52.236.80.95:6195] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpxl.php"] [unique_id "aeObPTjjiypiFrTucbLaFQAAABQ"]
[Sat Apr 18 22:54:53.881808 2026] [:error] [pid 9970:tid 9977] [client 52.236.80.95:63567] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "aeObPSYdRLRhVmaIMx3k9gAAAMM"]
[Sat Apr 18 22:54:54.553648 2026] [:error] [pid 9970:tid 9987] [client 52.236.80.95:65168] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "aeObPiYdRLRhVmaIMx3k-AAAAM0"]
[Sat Apr 18 22:54:55.284546 2026] [:error] [pid 34290:tid 34327] [client 52.236.80.95:61391] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "aeObPxqX6WpmmAXOBi8taQAAAcg"]
[Sat Apr 18 22:54:55.798928 2026] [:error] [pid 34288:tid 34300] [client 52.236.80.95:6183] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "aeObP-TIiy__PtiLmpneiQAAAYg"]
[Sat Apr 18 22:54:56.337392 2026] [:error] [pid 34290:tid 34328] [client 52.236.80.95:65098] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upll22.php"] [unique_id "aeObQBqX6WpmmAXOBi8tagAAAck"]
[Sat Apr 18 22:54:56.860165 2026] [:error] [pid 9970:tid 9993] [client 52.236.80.95:63974] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upll22.php"] [unique_id "aeObQCYdRLRhVmaIMx3k_AAAANM"]
[Sat Apr 18 22:54:57.386558 2026] [:error] [pid 34290:tid 34343] [client 52.236.80.95:64624] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upll22.php"] [unique_id "aeObQRqX6WpmmAXOBi8tawAAAdg"]
[Sat Apr 18 22:54:57.934709 2026] [:error] [pid 34288:tid 34302] [client 52.236.80.95:64043] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upll22.php"] [unique_id "aeObQeTIiy__PtiLmpnejAAAAYo"]
[Sat Apr 18 22:54:58.490513 2026] [:error] [pid 32677:tid 32698] [client 52.236.80.95:64620] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "aeObQhngmUE3LdC-wP7yUgAAAlI"]
[Sat Apr 18 22:54:59.068642 2026] [:error] [pid 34290:tid 34336] [client 52.236.80.95:64635] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "aeObQxqX6WpmmAXOBi8tbAAAAdE"]
[Sat Apr 18 22:54:59.779576 2026] [:error] [pid 34288:tid 34301] [client 52.236.80.95:63960] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "aeObQ-TIiy__PtiLmpnejQAAAYk"]
[Sat Apr 18 22:55:00.311806 2026] [:error] [pid 32677:tid 32688] [client 52.236.80.95:64611] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "aeObRBngmUE3LdC-wP7yVQAAAkg"]
[Sat Apr 18 22:55:02.447925 2026] [:error] [pid 32677:tid 32704] [client 52.236.80.95:63629] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "aeObRhngmUE3LdC-wP7yVwAAAlg"]
[Sat Apr 18 22:55:03.484087 2026] [:error] [pid 34288:tid 34309] [client 52.236.80.95:65120] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "aeObR-TIiy__PtiLmpnejgAAAZE"]
[Sat Apr 18 22:55:04.392024 2026] [:error] [pid 9865:tid 9938] [client 52.236.80.95:63094] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "aeObSKzb5knECIY-C-il6QAAAIE"]
[Sat Apr 18 22:55:05.135138 2026] [:error] [pid 32677:tid 32697] [client 52.236.80.95:63997] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "aeObSRngmUE3LdC-wP7yWgAAAlE"]
[Sat Apr 18 22:55:06.091198 2026] [:error] [pid 9970:tid 9989] [client 52.236.80.95:64623] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-942.php"] [unique_id "aeObSiYdRLRhVmaIMx3lAwAAAM8"]
[Sat Apr 18 22:55:06.742310 2026] [:error] [pid 9970:tid 9993] [client 52.236.80.95:63945] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-942.php"] [unique_id "aeObSiYdRLRhVmaIMx3lBAAAANM"]
[Sat Apr 18 22:55:07.639441 2026] [:error] [pid 32678:tid 32722] [client 52.236.80.95:60706] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-942.php"] [unique_id "aeObSxUlAXU_ZWUu5y8T4QAAAo8"]
[Sat Apr 18 22:55:08.659399 2026] [:error] [pid 32678:tid 32709] [client 52.236.80.95:63634] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-942.php"] [unique_id "aeObTBUlAXU_ZWUu5y8T5AAAAoI"]
[Sat Apr 18 22:55:09.388628 2026] [:error] [pid 9970:tid 9986] [client 52.236.80.95:62544] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-243.php"] [unique_id "aeObTSYdRLRhVmaIMx3lCAAAAMw"]
[Sat Apr 18 22:55:10.067190 2026] [:error] [pid 13023:tid 13028] [client 52.236.80.95:65174] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-243.php"] [unique_id "aeObTv1e7hG8DAeABB9FDwAAAQM"]
[Sat Apr 18 22:55:11.642388 2026] [:error] [pid 34290:tid 34321] [client 52.236.80.95:62649] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-243.php"] [unique_id "aeObTxqX6WpmmAXOBi8tbQAAAcI"]
[Sat Apr 18 22:55:13.382412 2026] [:error] [pid 13023:tid 13029] [client 52.236.80.95:63626] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-243.php"] [unique_id "aeObUf1e7hG8DAeABB9FEgAAAQQ"]
[Sat Apr 18 22:55:14.113661 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:6201] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hanyatersenyum.php"] [unique_id "aeObUv1e7hG8DAeABB9FFgAAAQE"]
[Sat Apr 18 22:55:14.655829 2026] [:error] [pid 9864:tid 9926] [client 52.236.80.95:63607] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hanyatersenyum.php"] [unique_id "aeObUoCFeowknfXHM7kzSAAAAFQ"]
[Sat Apr 18 22:55:15.181684 2026] [:error] [pid 13023:tid 13035] [client 52.236.80.95:65116] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hanyatersenyum.php"] [unique_id "aeObU_1e7hG8DAeABB9FGAAAAQo"]
[Sat Apr 18 22:55:15.698968 2026] [:error] [pid 13023:tid 13039] [client 52.236.80.95:6158] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hanyatersenyum.php"] [unique_id "aeObU_1e7hG8DAeABB9FGQAAAQ4"]
[Sat Apr 18 22:55:16.244780 2026] [:error] [pid 32677:tid 32700] [client 52.236.80.95:62552] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/161dfd072f.php"] [unique_id "aeObVBngmUE3LdC-wP7yWwAAAlQ"]
[Sat Apr 18 22:55:17.263482 2026] [:error] [pid 34288:tid 34310] [client 52.236.80.95:64030] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/161dfd072f.php"] [unique_id "aeObVeTIiy__PtiLmpnejwAAAZI"]
[Sat Apr 18 22:55:17.790351 2026] [:error] [pid 9865:tid 9944] [client 52.236.80.95:63144] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/161dfd072f.php"] [unique_id "aeObVazb5knECIY-C-il6gAAAIc"]
[Sat Apr 18 22:55:18.416545 2026] [:error] [pid 9970:tid 9977] [client 52.236.80.95:64029] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/161dfd072f.php"] [unique_id "aeObViYdRLRhVmaIMx3lCgAAAMM"]
[Sat Apr 18 22:55:18.989058 2026] [:error] [pid 34288:tid 34311] [client 52.236.80.95:63077] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maintura.php"] [unique_id "aeObVuTIiy__PtiLmpnekQAAAZM"]
[Sat Apr 18 22:55:19.594932 2026] [:error] [pid 9864:tid 9920] [client 52.236.80.95:6164] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maintura.php"] [unique_id "aeObV4CFeowknfXHM7kzSQAAAE4"]
[Sat Apr 18 22:55:20.327410 2026] [:error] [pid 9970:tid 9987] [client 52.236.80.95:63579] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maintura.php"] [unique_id "aeObWCYdRLRhVmaIMx3lCwAAAM0"]
[Sat Apr 18 22:55:20.872181 2026] [:error] [pid 13023:tid 13049] [client 52.236.80.95:64035] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/maintura.php"] [unique_id "aeObWP1e7hG8DAeABB9FHgAAARg"]
[Sat Apr 18 22:55:21.429140 2026] [:error] [pid 9865:tid 9957] [client 52.236.80.95:63586] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/RIP.php"] [unique_id "aeObWazb5knECIY-C-il8AAAAJQ"]
[Sat Apr 18 22:55:22.055288 2026] [:error] [pid 32677:tid 32685] [client 52.236.80.95:63980] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/RIP.php"] [unique_id "aeObWhngmUE3LdC-wP7yXQAAAkU"]
[Sat Apr 18 22:55:22.759847 2026] [:error] [pid 9865:tid 9937] [client 52.236.80.95:62615] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/RIP.php"] [unique_id "aeObWqzb5knECIY-C-il9AAAAIA"]
[Sat Apr 18 22:55:23.312313 2026] [:error] [pid 32677:tid 32684] [client 52.236.80.95:64585] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/RIP.php"] [unique_id "aeObWxngmUE3LdC-wP7yXgAAAkQ"]
[Sat Apr 18 22:55:23.832006 2026] [:error] [pid 34290:tid 34334] [client 52.236.80.95:6157] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aeObWxqX6WpmmAXOBi8tbwAAAc8"]
[Sat Apr 18 22:55:24.393399 2026] [:error] [pid 9864:tid 9906] [client 52.236.80.95:63659] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aeObXICFeowknfXHM7kzTAAAAEE"]
[Sat Apr 18 22:55:25.036730 2026] [:error] [pid 32678:tid 32721] [client 52.236.80.95:65215] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aeObXRUlAXU_ZWUu5y8T7gAAAo4"]
[Sat Apr 18 22:55:25.561020 2026] [:error] [pid 9864:tid 9925] [client 52.236.80.95:64016] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aeObXYCFeowknfXHM7kzTQAAAFM"]
[Sat Apr 18 22:55:26.136852 2026] [:error] [pid 9864:tid 9921] [client 52.236.80.95:65205] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aeObXoCFeowknfXHM7kzTwAAAE8"]
[Sat Apr 18 22:55:26.643827 2026] [:error] [pid 9865:tid 9940] [client 52.236.80.95:63973] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aeObXqzb5knECIY-C-il-AAAAIM"]
[Sat Apr 18 22:55:27.159573 2026] [:error] [pid 9865:tid 9943] [client 52.236.80.95:63562] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aeObX6zb5knECIY-C-il-QAAAIY"]
[Sat Apr 18 22:55:27.736149 2026] [:error] [pid 9864:tid 9922] [client 52.236.80.95:63041] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aeObX4CFeowknfXHM7kzUAAAAFA"]
[Sat Apr 18 22:55:38.061020 2026] [:error] [pid 9864:tid 9929] [client 52.236.80.95:65154] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2nzyHnOkEg.php"] [unique_id "aeObaoCFeowknfXHM7kzYQAAAFc"]
[Sat Apr 18 22:55:38.618686 2026] [:error] [pid 32678:tid 32716] [client 52.236.80.95:60710] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2nzyHnOkEg.php"] [unique_id "aeObahUlAXU_ZWUu5y8T-AAAAok"]
[Sat Apr 18 22:55:39.124179 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:62651] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2nzyHnOkEg.php"] [unique_id "aeOba_1e7hG8DAeABB9FJwAAAQE"]
[Sat Apr 18 22:55:39.648414 2026] [:error] [pid 34290:tid 34323] [client 52.236.80.95:60647] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2nzyHnOkEg.php"] [unique_id "aeObaxqX6WpmmAXOBi8tcQAAAcQ"]
[Sat Apr 18 22:55:40.202837 2026] [:error] [pid 13023:tid 13035] [client 52.236.80.95:62054] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acc.php"] [unique_id "aeObbP1e7hG8DAeABB9FKQAAAQo"]
[Sat Apr 18 22:55:40.721067 2026] [:error] [pid 9970:tid 9996] [client 52.236.80.95:64598] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acc.php"] [unique_id "aeObbCYdRLRhVmaIMx3lEAAAANY"]
[Sat Apr 18 22:55:41.278607 2026] [:error] [pid 13023:tid 13039] [client 52.236.80.95:65097] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acc.php"] [unique_id "aeObbf1e7hG8DAeABB9FKwAAAQ4"]
[Sat Apr 18 22:55:41.858591 2026] [:error] [pid 34290:tid 34332] [client 52.236.80.95:65191] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acc.php"] [unique_id "aeObbRqX6WpmmAXOBi8tcgAAAc0"]
[Sat Apr 18 22:55:42.504355 2026] [:error] [pid 34290:tid 34330] [client 52.236.80.95:63937] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/HLA-dd.php"] [unique_id "aeObbhqX6WpmmAXOBi8tcwAAAcs"]
[Sat Apr 18 22:55:43.047696 2026] [:error] [pid 34290:tid 34322] [client 52.236.80.95:63958] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/HLA-dd.php"] [unique_id "aeObbxqX6WpmmAXOBi8tdAAAAcM"]
[Sat Apr 18 22:55:43.596325 2026] [:error] [pid 9865:tid 9957] [client 52.236.80.95:63163] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/HLA-dd.php"] [unique_id "aeObb6zb5knECIY-C-imBgAAAJQ"]
[Sat Apr 18 22:55:44.296993 2026] [:error] [pid 9865:tid 9944] [client 52.236.80.95:63593] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/HLA-dd.php"] [unique_id "aeObcKzb5knECIY-C-imBwAAAIc"]
[Sat Apr 18 22:55:45.009892 2026] [:error] [pid 9865:tid 9946] [client 52.236.80.95:63992] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7logs.php"] [unique_id "aeObcazb5knECIY-C-imCgAAAIk"]
[Sat Apr 18 22:55:45.617382 2026] [:error] [pid 34290:tid 34319] [client 52.236.80.95:64637] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7logs.php"] [unique_id "aeObcRqX6WpmmAXOBi8teAAAAcA"]
[Sat Apr 18 22:55:46.169697 2026] [:error] [pid 9864:tid 9913] [client 52.236.80.95:65162] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7logs.php"] [unique_id "aeObcoCFeowknfXHM7kzZAAAAEc"]
[Sat Apr 18 22:55:46.740884 2026] [:error] [pid 9864:tid 9917] [client 52.236.80.95:62629] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7logs.php"] [unique_id "aeObcoCFeowknfXHM7kzZgAAAEs"]
[Sat Apr 18 22:55:47.287309 2026] [:error] [pid 9864:tid 9926] [client 52.236.80.95:62536] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/SS72_kKKjT.php"] [unique_id "aeObc4CFeowknfXHM7kzaAAAAFQ"]
[Sat Apr 18 22:55:50.138769 2026] [:error] [pid 9865:tid 9952] [client 52.236.80.95:64026] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/SS72_kKKjT.php"] [unique_id "aeObdqzb5knECIY-C-imEAAAAI8"]
[Sat Apr 18 22:55:53.742398 2026] [:error] [pid 32647:tid 32658] [client 52.236.80.95:62054] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/SS72_kKKjT.php"] [unique_id "aeObeUkxooM0iRo6e54zIAAAAgg"]
[Sat Apr 18 22:55:54.971691 2026] [:error] [pid 9865:tid 9946] [client 52.236.80.95:63577] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/SS72_kKKjT.php"] [unique_id "aeObeqzb5knECIY-C-imFQAAAIk"]
[Sat Apr 18 22:55:55.724891 2026] [:error] [pid 9970:tid 9994] [client 52.236.80.95:64625] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Spow_SRw.php"] [unique_id "aeObeyYdRLRhVmaIMx3lFgAAANQ"]
[Sat Apr 18 22:55:56.330972 2026] [:error] [pid 9970:tid 9988] [client 52.236.80.95:63611] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Spow_SRw.php"] [unique_id "aeObfCYdRLRhVmaIMx3lGAAAAM4"]
[Sat Apr 18 22:55:56.889894 2026] [:error] [pid 9970:tid 9977] [client 52.236.80.95:63044] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Spow_SRw.php"] [unique_id "aeObfCYdRLRhVmaIMx3lGQAAAMM"]
[Sat Apr 18 22:55:57.668900 2026] [:error] [pid 9864:tid 9922] [client 52.236.80.95:62034] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Spow_SRw.php"] [unique_id "aeObfYCFeowknfXHM7kzbAAAAFA"]
[Sat Apr 18 22:55:58.287537 2026] [:error] [pid 13023:tid 13043] [client 52.236.80.95:63976] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blnux.php"] [unique_id "aeObfv1e7hG8DAeABB9FOAAAARI"]
[Sat Apr 18 22:55:59.266270 2026] [:error] [pid 9865:tid 9954] [client 52.236.80.95:62114] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blnux.php"] [unique_id "aeObf6zb5knECIY-C-imFwAAAJE"]
[Sat Apr 18 22:55:59.997136 2026] [:error] [pid 9970:tid 9976] [client 52.236.80.95:61415] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blnux.php"] [unique_id "aeObfyYdRLRhVmaIMx3lHwAAAMI"]
[Sat Apr 18 22:56:00.596501 2026] [:error] [pid 9970:tid 9986] [client 52.236.80.95:63609] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blnux.php"] [unique_id "aeObgCYdRLRhVmaIMx3lIQAAAMw"]
[Sat Apr 18 22:56:01.165316 2026] [:error] [pid 9970:tid 9998] [client 52.236.80.95:63635] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blqjs.php"] [unique_id "aeObgSYdRLRhVmaIMx3lIgAAANg"]
[Sat Apr 18 22:56:01.793670 2026] [:error] [pid 9970:tid 9991] [client 52.236.80.95:59272] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blqjs.php"] [unique_id "aeObgSYdRLRhVmaIMx3lJAAAANE"]
[Sat Apr 18 22:56:02.501900 2026] [:error] [pid 9970:tid 9988] [client 52.236.80.95:62545] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blqjs.php"] [unique_id "aeObgiYdRLRhVmaIMx3lJQAAAM4"]
[Sat Apr 18 22:56:03.152109 2026] [:error] [pid 9865:tid 9940] [client 52.236.80.95:63956] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blqjs.php"] [unique_id "aeObg6zb5knECIY-C-imGwAAAIM"]
[Sat Apr 18 22:56:03.729433 2026] [:error] [pid 34288:tid 34299] [client 52.236.80.95:63590] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fyflv.php"] [unique_id "aeObg-TIiy__PtiLmpnemgAAAYc"]
[Sat Apr 18 22:56:04.459274 2026] [:error] [pid 9865:tid 9961] [client 52.236.80.95:62093] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fyflv.php"] [unique_id "aeObhKzb5knECIY-C-imHQAAAJg"]
[Sat Apr 18 22:56:04.984566 2026] [:error] [pid 34288:tid 34309] [client 52.236.80.95:62041] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fyflv.php"] [unique_id "aeObhOTIiy__PtiLmpnenAAAAZE"]
[Sat Apr 18 22:56:05.709764 2026] [:error] [pid 9864:tid 9905] [client 52.236.80.95:62597] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fyflv.php"] [unique_id "aeObhYCFeowknfXHM7kzbwAAAEA"]
[Sat Apr 18 22:56:06.320508 2026] [:error] [pid 9863:tid 9889] [client 52.236.80.95:63589] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/iindv.php"] [unique_id "aeObhjjjiypiFrTucbLaHQAAABA"]
[Sat Apr 18 22:56:06.927340 2026] [:error] [pid 9865:tid 9947] [client 52.236.80.95:65160] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/iindv.php"] [unique_id "aeObhqzb5knECIY-C-imIAAAAIo"]
[Sat Apr 18 22:56:07.489774 2026] [:error] [pid 32647:tid 32671] [client 52.236.80.95:62075] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/iindv.php"] [unique_id "aeObh0kxooM0iRo6e54zJQAAAhU"]
[Sat Apr 18 22:56:08.147764 2026] [:error] [pid 9863:tid 9873] [client 52.236.80.95:65124] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/iindv.php"] [unique_id "aeObiDjjiypiFrTucbLaHwAAAAA"]
[Sat Apr 18 22:56:08.712969 2026] [:error] [pid 9865:tid 9939] [client 52.236.80.95:6181] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wkogn.php"] [unique_id "aeObiKzb5knECIY-C-imIwAAAII"]
[Sat Apr 18 22:56:09.314124 2026] [:error] [pid 9865:tid 9957] [client 52.236.80.95:64055] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wkogn.php"] [unique_id "aeObiazb5knECIY-C-imJQAAAJQ"]
[Sat Apr 18 22:56:10.013227 2026] [:error] [pid 9865:tid 9941] [client 52.236.80.95:64616] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wkogn.php"] [unique_id "aeObiqzb5knECIY-C-imJgAAAIQ"]
[Sat Apr 18 22:56:10.753784 2026] [:error] [pid 34290:tid 34323] [client 52.236.80.95:64060] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wkogn.php"] [unique_id "aeObihqX6WpmmAXOBi8tfQAAAcQ"]
[Sat Apr 18 22:56:11.387094 2026] [:error] [pid 9865:tid 9948] [client 52.236.80.95:64008] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wwdgl.php"] [unique_id "aeObi6zb5knECIY-C-imKgAAAIs"]
[Sat Apr 18 22:56:12.183693 2026] [:error] [pid 9864:tid 9919] [client 52.236.80.95:62640] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wwdgl.php"] [unique_id "aeObjICFeowknfXHM7kzcAAAAE0"]
[Sat Apr 18 22:56:12.798621 2026] [:error] [pid 9865:tid 9940] [client 52.236.80.95:65152] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wwdgl.php"] [unique_id "aeObjKzb5knECIY-C-imLQAAAIM"]
[Sat Apr 18 22:56:13.366161 2026] [:error] [pid 9863:tid 9876] [client 52.236.80.95:63553] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wwdgl.php"] [unique_id "aeObjTjjiypiFrTucbLaIAAAAAM"]
[Sat Apr 18 22:56:13.976766 2026] [:error] [pid 32678:tid 32730] [client 52.236.80.95:63602] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wxeyc.php"] [unique_id "aeObjRUlAXU_ZWUu5y8UAAAAApc"]
[Sat Apr 18 22:56:14.612952 2026] [:error] [pid 9865:tid 9953] [client 52.236.80.95:63584] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wxeyc.php"] [unique_id "aeObjqzb5knECIY-C-imMAAAAJA"]
[Sat Apr 18 22:56:15.244890 2026] [:error] [pid 9865:tid 9954] [client 52.236.80.95:63613] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wxeyc.php"] [unique_id "aeObj6zb5knECIY-C-imNQAAAJE"]
[Sat Apr 18 22:56:15.894142 2026] [:error] [pid 9865:tid 9937] [client 52.236.80.95:62559] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wxeyc.php"] [unique_id "aeObj6zb5knECIY-C-imNgAAAIA"]
[Sat Apr 18 22:56:16.466525 2026] [:error] [pid 9864:tid 9907] [client 52.236.80.95:64026] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxiviLDIot.php"] [unique_id "aeObkICFeowknfXHM7kzcwAAAEI"]
[Sat Apr 18 22:56:16.987525 2026] [:error] [pid 9864:tid 9923] [client 52.236.80.95:64673] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxiviLDIot.php"] [unique_id "aeObkICFeowknfXHM7kzdAAAAFE"]
[Sat Apr 18 22:56:17.622180 2026] [:error] [pid 9864:tid 9920] [client 52.236.80.95:6170] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxiviLDIot.php"] [unique_id "aeObkYCFeowknfXHM7kzdQAAAE4"]
[Sat Apr 18 22:56:18.125052 2026] [:error] [pid 32647:tid 32667] [client 52.236.80.95:64057] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxiviLDIot.php"] [unique_id "aeObkkkxooM0iRo6e54zKQAAAhE"]
[Sat Apr 18 22:56:18.687300 2026] [:error] [pid 9864:tid 9928] [client 52.236.80.95:63581] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxivicLhot.php"] [unique_id "aeObkoCFeowknfXHM7kzdgAAAFY"]
[Sat Apr 18 22:56:19.287977 2026] [:error] [pid 9865:tid 9949] [client 52.236.80.95:63054] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxivicLhot.php"] [unique_id "aeObk6zb5knECIY-C-imPAAAAIw"]
[Sat Apr 18 22:56:19.829124 2026] [:error] [pid 9865:tid 9951] [client 52.236.80.95:63655] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxivicLhot.php"] [unique_id "aeObk6zb5knECIY-C-imPgAAAI4"]
[Sat Apr 18 22:56:20.348878 2026] [:error] [pid 9865:tid 9941] [client 52.236.80.95:63141] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxivicLhot.php"] [unique_id "aeOblKzb5knECIY-C-imQAAAAIQ"]
[Sat Apr 18 22:56:21.077449 2026] [:error] [pid 9865:tid 9937] [client 52.236.80.95:63082] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3akp.php"] [unique_id "aeOblazb5knECIY-C-imQgAAAIA"]
[Sat Apr 18 22:56:21.688721 2026] [:error] [pid 9970:tid 9981] [client 52.236.80.95:63160] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3akp.php"] [unique_id "aeOblSYdRLRhVmaIMx3lJgAAAMc"]
[Sat Apr 18 22:56:22.242114 2026] [:error] [pid 34290:tid 34328] [client 52.236.80.95:61456] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3akp.php"] [unique_id "aeOblhqX6WpmmAXOBi8thAAAAck"]
[Sat Apr 18 22:56:22.795296 2026] [:error] [pid 9865:tid 9948] [client 52.236.80.95:62568] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3akp.php"] [unique_id "aeOblqzb5knECIY-C-imQwAAAIs"]
[Sat Apr 18 22:56:23.334889 2026] [:error] [pid 9865:tid 9959] [client 52.236.80.95:63129] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sde.php"] [unique_id "aeObl6zb5knECIY-C-imRAAAAJY"]
[Sat Apr 18 22:56:23.910679 2026] [:error] [pid 9864:tid 9930] [client 52.236.80.95:63625] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sde.php"] [unique_id "aeObl4CFeowknfXHM7kzdwAAAFg"]
[Sat Apr 18 22:56:24.440092 2026] [:error] [pid 34290:tid 34338] [client 52.236.80.95:63121] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sde.php"] [unique_id "aeObmBqX6WpmmAXOBi8thwAAAdM"]
[Sat Apr 18 22:56:25.096987 2026] [:error] [pid 9865:tid 9944] [client 52.236.80.95:64012] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sde.php"] [unique_id "aeObmazb5knECIY-C-imRgAAAIc"]
[Sat Apr 18 22:56:25.667763 2026] [:error] [pid 9865:tid 9950] [client 52.236.80.95:65108] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cdn3.php"] [unique_id "aeObmazb5knECIY-C-imSQAAAI0"]
[Sat Apr 18 22:56:26.321135 2026] [:error] [pid 9864:tid 9908] [client 52.236.80.95:64580] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cdn3.php"] [unique_id "aeObmoCFeowknfXHM7kzeAAAAEM"]
[Sat Apr 18 22:56:26.885547 2026] [:error] [pid 9864:tid 9918] [client 52.236.80.95:60725] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cdn3.php"] [unique_id "aeObmoCFeowknfXHM7kzeQAAAEw"]
[Sat Apr 18 22:56:27.760859 2026] [:error] [pid 34290:tid 34334] [client 52.236.80.95:64028] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cdn3.php"] [unique_id "aeObmxqX6WpmmAXOBi8tigAAAc8"]
[Sat Apr 18 22:56:28.531896 2026] [:error] [pid 34290:tid 34337] [client 52.236.80.95:62605] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "aeObnBqX6WpmmAXOBi8tiwAAAdI"]
[Sat Apr 18 22:56:29.666906 2026] [:error] [pid 13023:tid 13044] [client 52.236.80.95:63155] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "aeObnf1e7hG8DAeABB9FOwAAARM"]
[Sat Apr 18 22:56:30.467958 2026] [:error] [pid 13023:tid 13049] [client 52.236.80.95:63673] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "aeObnv1e7hG8DAeABB9FPQAAARg"]
[Sat Apr 18 22:56:31.024178 2026] [:error] [pid 9864:tid 9915] [client 52.236.80.95:64681] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "aeObn4CFeowknfXHM7kzewAAAEk"]
[Sat Apr 18 22:56:31.919826 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:63113] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-220.php"] [unique_id "aeObn_1e7hG8DAeABB9FQQAAAQE"]
[Sat Apr 18 22:56:32.643455 2026] [:error] [pid 32647:tid 32651] [client 52.236.80.95:63972] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-220.php"] [unique_id "aeOboEkxooM0iRo6e54zLAAAAgE"]
[Sat Apr 18 22:56:33.256668 2026] [:error] [pid 34290:tid 34335] [client 52.236.80.95:63084] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-220.php"] [unique_id "aeOboRqX6WpmmAXOBi8tjwAAAdA"]
[Sat Apr 18 22:56:33.956329 2026] [:error] [pid 9865:tid 9958] [client 52.236.80.95:6185] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-220.php"] [unique_id "aeOboazb5knECIY-C-imTQAAAJU"]
[Sat Apr 18 22:56:34.503690 2026] [:error] [pid 9970:tid 9989] [client 52.236.80.95:64603] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "aeOboiYdRLRhVmaIMx3lKAAAAM8"]
[Sat Apr 18 22:56:35.118569 2026] [:error] [pid 9865:tid 9960] [client 52.236.80.95:63676] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "aeObo6zb5knECIY-C-imUQAAAJc"]
[Sat Apr 18 22:56:35.819623 2026] [:error] [pid 13023:tid 13037] [client 52.236.80.95:63964] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "aeObo_1e7hG8DAeABB9FQgAAAQw"]
[Sat Apr 18 22:56:36.381019 2026] [:error] [pid 13023:tid 13035] [client 52.236.80.95:62099] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "aeObpP1e7hG8DAeABB9FRAAAAQo"]
[Sat Apr 18 22:56:47.185458 2026] [:error] [pid 9970:tid 9994] [client 52.236.80.95:62574] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oco.php"] [unique_id "aeObryYdRLRhVmaIMx3lQAAAANQ"]
[Sat Apr 18 22:56:47.832499 2026] [:error] [pid 9970:tid 9982] [client 52.236.80.95:62569] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oco.php"] [unique_id "aeObryYdRLRhVmaIMx3lQgAAAMg"]
[Sat Apr 18 22:56:48.537063 2026] [:error] [pid 32677:tid 32689] [client 52.236.80.95:63961] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oco.php"] [unique_id "aeObsBngmUE3LdC-wP7yZQAAAkk"]
[Sat Apr 18 22:56:49.102020 2026] [:error] [pid 9865:tid 9944] [client 52.236.80.95:64027] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oco.php"] [unique_id "aeObsazb5knECIY-C-imVAAAAIc"]
[Sat Apr 18 22:56:49.616988 2026] [:error] [pid 9970:tid 9987] [client 52.236.80.95:62631] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ogr.php"] [unique_id "aeObsSYdRLRhVmaIMx3lQwAAAM0"]
[Sat Apr 18 22:56:50.147408 2026] [:error] [pid 9970:tid 9975] [client 52.236.80.95:60676] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ogr.php"] [unique_id "aeObsiYdRLRhVmaIMx3lRAAAAME"]
[Sat Apr 18 22:56:50.709587 2026] [:error] [pid 9864:tid 9913] [client 52.236.80.95:65207] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ogr.php"] [unique_id "aeObsoCFeowknfXHM7kzgQAAAEc"]
[Sat Apr 18 22:56:51.248958 2026] [:error] [pid 13023:tid 13028] [client 52.236.80.95:63098] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ogr.php"] [unique_id "aeObs_1e7hG8DAeABB9FSAAAAQM"]
[Sat Apr 18 22:56:51.795381 2026] [:error] [pid 32678:tid 32731] [client 52.236.80.95:63583] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oti.php"] [unique_id "aeObsxUlAXU_ZWUu5y8UBAAAApg"]
[Sat Apr 18 22:56:52.353044 2026] [:error] [pid 32678:tid 32714] [client 52.236.80.95:6200] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oti.php"] [unique_id "aeObtBUlAXU_ZWUu5y8UBgAAAoc"]
[Sat Apr 18 22:56:52.939975 2026] [:error] [pid 13023:tid 13036] [client 52.236.80.95:64665] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oti.php"] [unique_id "aeObtP1e7hG8DAeABB9FSwAAAQs"]
[Sat Apr 18 22:56:53.502122 2026] [:error] [pid 32677:tid 32691] [client 52.236.80.95:60702] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/oti.php"] [unique_id "aeObtRngmUE3LdC-wP7yZgAAAks"]
[Sat Apr 18 22:56:54.044853 2026] [:error] [pid 13023:tid 13049] [client 52.236.80.95:62091] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-124.php"] [unique_id "aeObtv1e7hG8DAeABB9FTAAAARg"]
[Sat Apr 18 22:56:55.058112 2026] [:error] [pid 13023:tid 13040] [client 52.236.80.95:65165] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-124.php"] [unique_id "aeObt_1e7hG8DAeABB9FTgAAAQ8"]
[Sat Apr 18 22:56:55.648030 2026] [:error] [pid 13023:tid 13047] [client 52.236.80.95:63140] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-124.php"] [unique_id "aeObt_1e7hG8DAeABB9FUQAAARY"]
[Sat Apr 18 22:56:56.175319 2026] [:error] [pid 13023:tid 13039] [client 52.236.80.95:62085] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-124.php"] [unique_id "aeObuP1e7hG8DAeABB9FUwAAAQ4"]
[Sat Apr 18 22:56:56.798757 2026] [:error] [pid 13023:tid 13033] [client 52.236.80.95:63617] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpls.php"] [unique_id "aeObuP1e7hG8DAeABB9FVgAAAQg"]
[Sat Apr 18 22:56:57.446309 2026] [:error] [pid 13023:tid 13044] [client 52.236.80.95:63040] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpls.php"] [unique_id "aeObuf1e7hG8DAeABB9FWgAAARM"]
[Sat Apr 18 22:56:58.039166 2026] [:error] [pid 13023:tid 13040] [client 52.236.80.95:64612] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpls.php"] [unique_id "aeObuv1e7hG8DAeABB9FXQAAAQ8"]
[Sat Apr 18 22:56:59.543993 2026] [:error] [pid 13023:tid 13033] [client 52.236.80.95:63049] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wpls.php"] [unique_id "aeObu_1e7hG8DAeABB9FYgAAAQg"]
[Sat Apr 18 22:57:00.184050 2026] [:error] [pid 13023:tid 13030] [client 52.236.80.95:63056] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp1.php"] [unique_id "aeObvP1e7hG8DAeABB9FaAAAAQU"]
[Sat Apr 18 22:57:00.712393 2026] [:error] [pid 34290:tid 34334] [client 52.236.80.95:61417] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp1.php"] [unique_id "aeObvBqX6WpmmAXOBi8tkgAAAc8"]
[Sat Apr 18 22:57:01.258066 2026] [:error] [pid 9970:tid 9992] [client 52.236.80.95:61460] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp1.php"] [unique_id "aeObvSYdRLRhVmaIMx3lRQAAANI"]
[Sat Apr 18 22:57:01.962225 2026] [:error] [pid 32647:tid 32663] [client 52.236.80.95:6194] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp1.php"] [unique_id "aeObvUkxooM0iRo6e54zMQAAAg0"]
[Sat Apr 18 22:57:02.631371 2026] [:error] [pid 9970:tid 9985] [client 52.236.80.95:64576] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aeObviYdRLRhVmaIMx3lSAAAAMs"]
[Sat Apr 18 22:57:03.250393 2026] [:error] [pid 32678:tid 32707] [client 52.236.80.95:61452] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aeObvxUlAXU_ZWUu5y8UCQAAAoA"]
[Sat Apr 18 22:57:03.983818 2026] [:error] [pid 9970:tid 9979] [client 52.236.80.95:63632] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aeObvyYdRLRhVmaIMx3lTgAAAMU"]
[Sat Apr 18 22:57:04.580906 2026] [:error] [pid 32678:tid 32721] [client 52.236.80.95:63657] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aeObwBUlAXU_ZWUu5y8UCgAAAo4"]
[Sat Apr 18 22:57:05.321042 2026] [:error] [pid 32678:tid 32715] [client 52.236.80.95:64022] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fss.php"] [unique_id "aeObwRUlAXU_ZWUu5y8UCwAAAog"]
[Sat Apr 18 22:57:06.007859 2026] [:error] [pid 9970:tid 9994] [client 52.236.80.95:64058] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fss.php"] [unique_id "aeObwiYdRLRhVmaIMx3lUAAAANQ"]
[Sat Apr 18 22:57:06.617970 2026] [:error] [pid 9864:tid 9920] [client 52.236.80.95:63051] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fss.php"] [unique_id "aeObwoCFeowknfXHM7kzgwAAAE4"]
[Sat Apr 18 22:57:07.307930 2026] [:error] [pid 9970:tid 9983] [client 52.236.80.95:62594] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fss.php"] [unique_id "aeObwyYdRLRhVmaIMx3lUQAAAMk"]
[Sat Apr 18 22:57:07.907010 2026] [:error] [pid 32678:tid 32728] [client 52.236.80.95:64642] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctex1.php"] [unique_id "aeObwxUlAXU_ZWUu5y8UDgAAApU"]
[Sat Apr 18 22:57:08.614380 2026] [:error] [pid 32678:tid 32708] [client 52.236.80.95:63988] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctex1.php"] [unique_id "aeObxBUlAXU_ZWUu5y8UEQAAAoE"]
[Sat Apr 18 22:57:09.190125 2026] [:error] [pid 32677:tid 32685] [client 52.236.80.95:65103] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctex1.php"] [unique_id "aeObxRngmUE3LdC-wP7yagAAAkU"]
[Sat Apr 18 22:57:09.797594 2026] [:error] [pid 32678:tid 32710] [client 52.236.80.95:65158] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctex1.php"] [unique_id "aeObxRUlAXU_ZWUu5y8UFgAAAoM"]
[Sat Apr 18 22:57:10.344602 2026] [:error] [pid 9970:tid 9993] [client 52.236.80.95:64596] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/011i.php"] [unique_id "aeObxiYdRLRhVmaIMx3lVwAAANM"]
[Sat Apr 18 22:57:10.936083 2026] [:error] [pid 9970:tid 9976] [client 52.236.80.95:64011] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/011i.php"] [unique_id "aeObxiYdRLRhVmaIMx3lWQAAAMI"]
[Sat Apr 18 22:57:11.521576 2026] [:error] [pid 9970:tid 9984] [client 52.236.80.95:65136] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/011i.php"] [unique_id "aeObxyYdRLRhVmaIMx3lWwAAAMo"]
[Sat Apr 18 22:57:12.147727 2026] [:error] [pid 9970:tid 9992] [client 52.236.80.95:6173] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/011i.php"] [unique_id "aeObyCYdRLRhVmaIMx3lXgAAANI"]
[Sat Apr 18 22:57:12.758857 2026] [:error] [pid 9970:tid 9997] [client 52.236.80.95:60218] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gk.php"] [unique_id "aeObyCYdRLRhVmaIMx3lYAAAANc"]
[Sat Apr 18 22:57:13.424769 2026] [:error] [pid 32677:tid 32692] [client 52.236.80.95:63103] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gk.php"] [unique_id "aeObyRngmUE3LdC-wP7ybgAAAkw"]
[Sat Apr 18 22:57:14.033515 2026] [:error] [pid 32677:tid 32680] [client 52.236.80.95:64688] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gk.php"] [unique_id "aeObyhngmUE3LdC-wP7ycQAAAkA"]
[Sat Apr 18 22:57:14.682280 2026] [:error] [pid 9864:tid 9910] [client 52.236.80.95:60718] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gk.php"] [unique_id "aeObyoCFeowknfXHM7kzhwAAAEU"]
[Sat Apr 18 22:57:15.570872 2026] [:error] [pid 9970:tid 9994] [client 52.236.80.95:65199] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "aeObyyYdRLRhVmaIMx3lZAAAANQ"]
[Sat Apr 18 22:57:16.550925 2026] [:error] [pid 9865:tid 9939] [client 52.236.80.95:62113] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "aeObzKzb5knECIY-C-imXQAAAII"]
[Sat Apr 18 22:57:17.567997 2026] [:error] [pid 32677:tid 32697] [client 52.236.80.95:65212] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "aeObzRngmUE3LdC-wP7ydwAAAlE"]
[Sat Apr 18 22:57:18.683790 2026] [:error] [pid 32647:tid 32660] [client 52.236.80.95:62591] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "aeObzkkxooM0iRo6e54zOAAAAgo"]
[Sat Apr 18 22:57:19.718717 2026] [:error] [pid 9970:tid 9995] [client 52.236.80.95:63597] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fssxwoyh.php"] [unique_id "aeObzyYdRLRhVmaIMx3lbgAAANU"]
[Sat Apr 18 22:57:20.610533 2026] [:error] [pid 9864:tid 9929] [client 52.236.80.95:63953] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fssxwoyh.php"] [unique_id "aeOb0ICFeowknfXHM7kziQAAAFc"]
[Sat Apr 18 22:57:21.470405 2026] [:error] [pid 32647:tid 32671] [client 52.236.80.95:6205] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fssxwoyh.php"] [unique_id "aeOb0UkxooM0iRo6e54zPAAAAhU"]
[Sat Apr 18 22:57:22.145252 2026] [:error] [pid 32677:tid 32680] [client 52.236.80.95:63137] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fssxwoyh.php"] [unique_id "aeOb0hngmUE3LdC-wP7yfgAAAkA"]
[Sat Apr 18 22:57:22.816839 2026] [:error] [pid 32677:tid 32702] [client 52.236.80.95:63076] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wcvejtpr.php"] [unique_id "aeOb0hngmUE3LdC-wP7ygQAAAlY"]
[Sat Apr 18 22:57:23.378499 2026] [:error] [pid 9865:tid 9942] [client 52.236.80.95:63615] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wcvejtpr.php"] [unique_id "aeOb06zb5knECIY-C-imYAAAAIU"]
[Sat Apr 18 22:57:23.900421 2026] [:error] [pid 13023:tid 13047] [client 52.236.80.95:64062] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wcvejtpr.php"] [unique_id "aeOb0_1e7hG8DAeABB9FbQAAARY"]
[Sat Apr 18 22:57:24.494528 2026] [:error] [pid 13023:tid 13025] [client 52.236.80.95:63155] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wcvejtpr.php"] [unique_id "aeOb1P1e7hG8DAeABB9FcgAAAQA"]
[Sat Apr 18 22:57:25.151143 2026] [:error] [pid 9970:tid 9974] [client 52.236.80.95:64643] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/home.php"] [unique_id "aeOb1SYdRLRhVmaIMx3lcgAAAMA"]
[Sat Apr 18 22:57:25.723555 2026] [:error] [pid 13023:tid 13026] [client 52.236.80.95:63595] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/home.php"] [unique_id "aeOb1f1e7hG8DAeABB9FeAAAAQE"]
[Sat Apr 18 22:57:26.367772 2026] [:error] [pid 13023:tid 13048] [client 52.236.80.95:64040] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/home.php"] [unique_id "aeOb1v1e7hG8DAeABB9FfAAAARc"]
[Sat Apr 18 22:57:26.972216 2026] [:error] [pid 34288:tid 34307] [client 52.236.80.95:61458] [client 52.236.80.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/home.php"] [unique_id "aeOb1uTIiy__PtiLmpneowAAAY8"]
[Sat Apr 18 23:19:12.426337 2026] [:error] [pid 9865:tid 9943] [client 51.159.190.214:51664] [client 51.159.190.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.190.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeOg8Kzb5knECIY-C-irJwAAAIY"]
[Sun Apr 19 00:32:28.368530 2026] [:error] [pid 32166:tid 32220] [client 109.176.198.138:34392] [client 109.176.198.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.176.198.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeOyHJCHNkWwdiZnafK7bwAAAFY"]
[Sun Apr 19 00:40:06.331910 2026] [:error] [pid 33517:tid 33524] [client 211.23.42.84:37038] [client 211.23.42.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 211.23.42.84, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeOz5n4Zz-rubR1wiZ-MhgAAAMU"]
[Sun Apr 19 00:40:08.951757 2026] [:error] [pid 33517:tid 33537] [client 211.23.42.84:37038] [client 211.23.42.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 211.23.42.84, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeOz6H4Zz-rubR1wiZ-MjwAAANI"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 19 00:42:31.858124 2026] [:error] [pid 32167:tid 32248] [client 204.244.162.193:61349] [client 204.244.162.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.244.162.193, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeO0d0yD4Jm27Mb3NJhhkAAAAJc"]
[Sun Apr 19 00:42:42.167118 2026] [:error] [pid 32167:tid 32240] [client 204.244.162.193:61696] [client 204.244.162.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.244.162.193, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeO0gkyD4Jm27Mb3NJhhlAAAAI8"]
[Sun Apr 19 00:42:52.687791 2026] [:error] [pid 33517:tid 33526] [client 204.244.162.193:61960] [client 204.244.162.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.244.162.193, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeO0jH4Zz-rubR1wiZ-OEAAAAMc"]
[Sun Apr 19 00:43:03.338016 2026] [:error] [pid 32252:tid 32277] [client 204.244.162.193:62182] [client 204.244.162.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.244.162.193, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeO0l-Xl4Yc-Lt5fJ9iKvgAAARc"]
[Sun Apr 19 00:43:13.883746 2026] [:error] [pid 32166:tid 32210] [client 204.244.162.193:62410] [client 204.244.162.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 204.244.162.193, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeO0oZCHNkWwdiZnafK9dwAAAEw"]
[Sun Apr 19 00:43:28.106918 2026] [:error] [pid 32252:tid 32274] [client 149.202.83.206:35964] [client 149.202.83.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.83.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeO0sOXl4Yc-Lt5fJ9iK6QAAARQ"]
[Sun Apr 19 00:50:47.236058 2026] [:error] [pid 60910:tid 60917] [client 89.125.209.209:56714] [client 89.125.209.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.125.209.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeO2Z3FWunkyacYqsD0ZCwAAAUU"]
[Sun Apr 19 00:55:38.986956 2026] [:error] [pid 32165:tid 32187] [client 192.185.4.57:12348] [client 192.185.4.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.4.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeO3iqe2vKwEk_N0BrbqGwAAABI"]
[Sun Apr 19 00:55:42.304931 2026] [:error] [pid 60910:tid 60917] [client 192.185.4.57:12364] [client 192.185.4.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.4.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeO3jnFWunkyacYqsD0aHQAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 19 01:06:47.728874 2026] [:error] [pid 32166:tid 32222] [client 159.223.103.141:42032] [client 159.223.103.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.103.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeO6J5CHNkWwdiZnafLEOwAAAFg"]
[Sun Apr 19 02:00:10.086975 2026] [:error] [pid 32166:tid 32216] [client 45.246.41.125:51365] [client 45.246.41.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.246.41.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aePGqpCHNkWwdiZnafLO-gAAAFI"]
[Sun Apr 19 02:00:19.504424 2026] [:error] [pid 41277:tid 41294] [client 45.246.41.125:51747] [client 45.246.41.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.246.41.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aePGs0H3ayszMLZYflv5UwAAAY8"]
[Sun Apr 19 02:00:29.939644 2026] [:error] [pid 60910:tid 60925] [client 45.246.41.125:51950] [client 45.246.41.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.246.41.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aePGvXFWunkyacYqsD08hgAAAU0"]
[Sun Apr 19 02:00:40.497105 2026] [:error] [pid 41277:tid 41283] [client 45.246.41.125:52154] [client 45.246.41.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.246.41.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aePGyEH3ayszMLZYflv5agAAAYQ"]
[Sun Apr 19 02:00:51.032278 2026] [:error] [pid 32167:tid 32242] [client 45.246.41.125:52362] [client 45.246.41.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.246.41.125, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aePG00yD4Jm27Mb3NJiAiwAAAJE"]
[Sun Apr 19 02:01:19.139647 2026] [:error] [pid 60910:tid 60927] [client 103.110.127.136:57760] [client 103.110.127.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.110.127.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aePG73FWunkyacYqsD080QAAAU8"]
[Sun Apr 19 02:01:20.160530 2026] [:error] [pid 60910:tid 60932] [client 103.110.127.136:57760] [client 103.110.127.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.110.127.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aePG8HFWunkyacYqsD080wAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 19 02:14:24.076326 2026] [:error] [pid 32165:tid 32185] [client 51.79.180.242:51115] [client 51.79.180.242] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1/wp-admin/install.php"] [unique_id "aePKAKe2vKwEk_N0Brb6dwAAABA"]
[Sun Apr 19 03:07:57.516725 2026] [:error] [pid 32252:tid 32276] [client 82.223.33.117:35488] [client 82.223.33.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.33.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aePWjeXl4Yc-Lt5fJ9iy0QAAARY"]
[Sun Apr 19 03:14:06.385732 2026] [:error] [pid 32166:tid 32201] [client 103.110.84.178:38166] [client 103.110.84.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.110.84.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aePX_pCHNkWwdiZnafLdHAAAAEM"]
[Sun Apr 19 03:17:05.218549 2026] [:error] [pid 32166:tid 32205] [client 172.98.33.62:56661] [client 172.98.33.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.33.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aePYsZCHNkWwdiZnafLdbgAAAEc"]
[Sun Apr 19 04:40:51.738442 2026] [:error] [pid 47775:tid 47850] [client 223.181.119.165:33105] [client 223.181.119.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.181.119.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aePsU7mztjlk9tsmoexdoAAAAIc"]
[Sun Apr 19 04:44:04.469818 2026] [:error] [pid 47886:tid 47892] [client 223.181.119.165:4010] [client 223.181.119.165] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aePtFESe8yiyuPrD7yPcgwAAAMQ"]
[Sun Apr 19 04:45:14.448597 2026] [:error] [pid 47773:tid 47832] [client 223.181.119.165:1052] [client 223.181.119.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.181.119.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aePtWuiBHdnCJDuPq9Az_wAAAFA"]
[Sun Apr 19 04:46:15.601013 2026] [:error] [pid 47773:tid 47822] [client 223.181.119.165:23122] [client 223.181.119.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.181.119.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aePtl-iBHdnCJDuPq9A0ogAAAEY"]
[Sun Apr 19 04:47:30.796555 2026] [:error] [pid 47772:tid 47805] [client 223.181.119.165:24287] [client 223.181.119.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.181.119.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aePt4oc0L16cb4smAz-KggAAABA"]
[Sun Apr 19 04:48:31.936731 2026] [:error] [pid 47772:tid 47797] [client 223.181.119.165:8261] [client 223.181.119.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.181.119.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aePuH4c0L16cb4smAz-K6gAAAAg"]
[Sun Apr 19 05:04:15.223835 2026] [:error] [pid 15765:tid 15856] [client 3.109.221.136:35782] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aePxz_Rqinw-W5EwQ756wwAAAoM"]
[Sun Apr 19 05:04:16.780907 2026] [:error] [pid 15765:tid 15871] [client 3.109.221.136:35786] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aePx0PRqinw-W5EwQ756yQAAApI"]
[Sun Apr 19 05:04:17.421592 2026] [:error] [pid 15765:tid 15857] [client 3.109.221.136:35790] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.local"] [unique_id "aePx0fRqinw-W5EwQ7560QAAAoQ"]
[Sun Apr 19 05:04:18.056893 2026] [:error] [pid 15760:tid 15792] [client 3.109.221.136:37040] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.production"] [unique_id "aePx0vSdD_XHQMJ_ISsUYgAAAdg"]
[Sun Apr 19 05:04:18.693099 2026] [:error] [pid 47886:tid 47901] [client 3.109.221.136:37042] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.staging"] [unique_id "aePx0kSe8yiyuPrD7yPi0AAAAM0"]
[Sun Apr 19 05:04:19.330652 2026] [:error] [pid 47886:tid 47904] [client 3.109.221.136:37054] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.development"] [unique_id "aePx00Se8yiyuPrD7yPi0wAAANA"]
[Sun Apr 19 05:04:19.964309 2026] [:error] [pid 47775:tid 47852] [client 3.109.221.136:37060] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.test"] [unique_id "aePx07mztjlk9tsmoexmxQAAAIk"]
[Sun Apr 19 05:04:20.597422 2026] [:error] [pid 15760:tid 15789] [client 3.109.221.136:37074] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.remote"] [unique_id "aePx1PSdD_XHQMJ_ISsUZAAAAdU"]
[Sun Apr 19 05:04:21.349012 2026] [:error] [pid 47773:tid 47833] [client 3.109.221.136:37088] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.bak"] [unique_id "aePx1eiBHdnCJDuPq9BCWAAAAFE"]
[Sun Apr 19 05:04:21.997547 2026] [:error] [pid 47772:tid 47801] [client 3.109.221.136:37096] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.backup"] [unique_id "aePx1Yc0L16cb4smAz-TjAAAAAw"]
[Sun Apr 19 05:04:22.629889 2026] [:error] [pid 47886:tid 47893] [client 3.109.221.136:37100] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.save"] [unique_id "aePx1kSe8yiyuPrD7yPi2QAAAMU"]
[Sun Apr 19 05:04:23.270948 2026] [:error] [pid 47772:tid 47790] [client 3.109.221.136:37114] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.old"] [unique_id "aePx14c0L16cb4smAz-TkgAAAAE"]
[Sun Apr 19 05:04:23.911059 2026] [:error] [pid 15763:tid 15819] [client 3.109.221.136:37124] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.sample"] [unique_id "aePx17MXv1Y1THOoxaAexQAAAhc"]
[Sun Apr 19 05:04:24.555434 2026] [:error] [pid 47775:tid 47855] [client 3.109.221.136:37130] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.example"] [unique_id "aePx2Lmztjlk9tsmoexm3QAAAIw"]
[Sun Apr 19 05:04:25.202169 2026] [:error] [pid 47772:tid 47797] [client 3.109.221.136:37144] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.dev"] [unique_id "aePx2Yc0L16cb4smAz-TmQAAAAg"]
[Sun Apr 19 05:04:25.840299 2026] [:error] [pid 47775:tid 47844] [client 3.109.221.136:37152] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.prod"] [unique_id "aePx2bmztjlk9tsmoexm7gAAAIE"]
[Sun Apr 19 05:04:26.479758 2026] [:error] [pid 47772:tid 47813] [client 3.109.221.136:37162] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.stage"] [unique_id "aePx2oc0L16cb4smAz-TogAAABg"]
[Sun Apr 19 05:04:27.170489 2026] [:error] [pid 15760:tid 15787] [client 3.109.221.136:37174] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.ci"] [unique_id "aePx2_SdD_XHQMJ_ISsUbAAAAdM"]
[Sun Apr 19 05:04:27.803593 2026] [:error] [pid 15694:tid 15739] [client 3.109.221.136:36336] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.docker"] [unique_id "aePx27imB-jol1fwqAq2_QAAAY0"]
[Sun Apr 19 05:04:28.435378 2026] [:error] [pid 47772:tid 47799] [client 3.109.221.136:36346] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.live"] [unique_id "aePx3Ic0L16cb4smAz-TqQAAAAo"]
[Sun Apr 19 05:04:29.076060 2026] [:error] [pid 15694:tid 15743] [client 3.109.221.136:36356] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.preprod"] [unique_id "aePx3bimB-jol1fwqAq2_wAAAZE"]
[Sun Apr 19 05:04:29.716059 2026] [:error] [pid 15764:tid 15839] [client 3.109.221.136:36372] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.uat"] [unique_id "aePx3WLL_sqdSHoVp-TlPwAAAk0"]
[Sun Apr 19 05:04:30.356999 2026] [:error] [pid 47772:tid 47793] [client 3.109.221.136:36374] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.dist"] [unique_id "aePx3oc0L16cb4smAz-TrAAAAAQ"]
[Sun Apr 19 05:04:30.996578 2026] [:error] [pid 47772:tid 47804] [client 3.109.221.136:36384] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.swp"] [unique_id "aePx3oc0L16cb4smAz-TsgAAAA8"]
[Sun Apr 19 05:04:31.636700 2026] [:error] [pid 47775:tid 47855] [client 3.109.221.136:36394] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env~"] [unique_id "aePx37mztjlk9tsmoexnGQAAAIw"]
[Sun Apr 19 05:04:32.278830 2026] [:error] [pid 15763:tid 15817] [client 3.109.221.136:36402] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/app/.env"] [unique_id "aePx4LMXv1Y1THOoxaAe1AAAAhU"]
[Sun Apr 19 05:04:32.930887 2026] [:error] [pid 15693:tid 15701] [client 3.109.221.136:36404] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/apps/.env"] [unique_id "aePx4MNMD-ccazQlTskTAwAAAUU"]
[Sun Apr 19 05:04:35.024596 2026] [:error] [pid 47772:tid 47811] [client 3.109.221.136:36418] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/web/.env"] [unique_id "aePx44c0L16cb4smAz-T3QAAABY"]
[Sun Apr 19 05:04:35.675072 2026] [:error] [pid 47772:tid 47799] [client 3.109.221.136:36420] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/site/.env"] [unique_id "aePx44c0L16cb4smAz-T4AAAAAo"]
[Sun Apr 19 05:04:36.311071 2026] [:error] [pid 15765:tid 15865] [client 3.109.221.136:36426] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/public/.env"] [unique_id "aePx5PRqinw-W5EwQ757AAAAAow"]
[Sun Apr 19 05:04:36.943089 2026] [:error] [pid 47773:tid 47823] [client 3.109.221.136:36430] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/admin/.env"] [unique_id "aePx5OiBHdnCJDuPq9BCfQAAAEc"]
[Sun Apr 19 05:04:37.583681 2026] [:error] [pid 15763:tid 15803] [client 3.109.221.136:39388] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/backend/.env"] [unique_id "aePx5bMXv1Y1THOoxaAe1gAAAgc"]
[Sun Apr 19 05:04:38.223709 2026] [:error] [pid 47886:tid 47906] [client 3.109.221.136:39392] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/server/.env"] [unique_id "aePx5kSe8yiyuPrD7yPi5wAAANI"]
[Sun Apr 19 05:04:38.868622 2026] [:error] [pid 47772:tid 47801] [client 3.109.221.136:39404] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/frontend/.env"] [unique_id "aePx5oc0L16cb4smAz-T5wAAAAw"]
[Sun Apr 19 05:04:39.508152 2026] [:error] [pid 47886:tid 47896] [client 3.109.221.136:39410] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/src/.env"] [unique_id "aePx50Se8yiyuPrD7yPi6wAAAMg"]
[Sun Apr 19 05:04:40.150537 2026] [:error] [pid 15694:tid 15749] [client 3.109.221.136:39420] [client 3.109.221.136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/core/.env"] [unique_id "aePx6LimB-jol1fwqAq3AwAAAZc"]
[Sun Apr 19 05:29:43.330456 2026] [:error] [pid 15764:tid 15832] [client 180.93.52.173:49470] [client 180.93.52.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.93.52.173, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeP3x2LL_sqdSHoVp-Tp6gAAAkY"]
[Sun Apr 19 05:52:43.046566 2026] [:error] [pid 15763:tid 15809] [client 192.206.141.63:58870] [client 192.206.141.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.206.141.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeP9K7MXv1Y1THOoxaAmWQAAAg0"]
[Sun Apr 19 06:03:42.512757 2026] [:error] [pid 47775:tid 47856] [client 54.37.239.214:57726] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeP_vrmztjlk9tsmoex6jAAAAI0"]
[Sun Apr 19 07:13:36.466233 2026] [:error] [pid 47772:tid 47797] [client 202.155.90.202:43956] [client 202.155.90.202] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.155.90.202, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeQQIIc0L16cb4smAz_FNQAAAAg"]
[Sun Apr 19 07:13:37.618047 2026] [:error] [pid 47772:tid 47808] [client 202.155.90.202:43956] [client 202.155.90.202] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.155.90.202, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeQQIYc0L16cb4smAz_FNgAAABM"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 19 07:32:11.056451 2026] [:error] [pid 15764:tid 15833] [client 185.113.100.4:39172] [client 185.113.100.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.113.100.4, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeQUe2LL_sqdSHoVp-QAPQAAAkc"]
[Sun Apr 19 07:35:07.682578 2026] [:error] [pid 15764:tid 15834] [client 115.187.19.110:47014] [client 115.187.19.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 115.187.19.110, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeQVK2LL_sqdSHoVp-QB2QAAAkg"]
[Sun Apr 19 07:35:08.754229 2026] [:error] [pid 15764:tid 15839] [client 115.187.19.110:47014] [client 115.187.19.110] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 115.187.19.110, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeQVLGLL_sqdSHoVp-QB2gAAAk0"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 19 08:04:14.484067 2026] [:error] [pid 15765:tid 15859] [client 20.12.204.106:17719] [client 20.12.204.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aeQb_vRqinw-W5EwQ76fEQAAAoY"]
[Sun Apr 19 08:04:19.239265 2026] [:error] [pid 15763:tid 15817] [client 20.12.204.106:17789] [client 20.12.204.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aeQcA7MXv1Y1THOoxaA2pgAAAhU"]
[Sun Apr 19 08:04:22.977689 2026] [:error] [pid 15765:tid 15863] [client 20.12.204.106:17738] [client 20.12.204.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aeQcBvRqinw-W5EwQ76fHwAAAoo"]
[Sun Apr 19 08:04:24.428503 2026] [:error] [pid 15763:tid 15814] [client 20.12.204.106:17759] [client 20.12.204.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "aeQcCLMXv1Y1THOoxaA2rgAAAhI"]
[Sun Apr 19 08:12:10.841069 2026] [:error] [pid 47773:tid 47824] [client 65.254.225.222:53674] [client 65.254.225.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.222, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeQd2uiBHdnCJDuPq9CjigAAAEg"]
[Sun Apr 19 08:12:18.104160 2026] [:error] [pid 47886:tid 47906] [client 65.254.225.219:41510] [client 65.254.225.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.219, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeQd4kSe8yiyuPrD7yMPuAAAANI"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 19 08:15:27.041830 2026] [:error] [pid 15694:tid 15748] [client 185.199.223.93:53128] [client 185.199.223.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.199.223.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeQen7imB-jol1fwqArIdgAAAZY"]
[Sun Apr 19 08:54:23.296574 2026] [:error] [pid 15765:tid 15873] [client 45.132.115.91:45203] [client 45.132.115.91] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.91, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeQnv_Rqinw-W5EwQ76k-wAAApQ"]
[Sun Apr 19 09:12:49.867842 2026] [:error] [pid 15765:tid 15857] [client 45.132.115.86:32391] [client 45.132.115.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeQsEfRqinw-W5EwQ76nqAAAAoQ"]
[Sun Apr 19 09:18:03.451986 2026] [:error] [pid 15763:tid 15804] [client 65.254.225.222:51542] [client 65.254.225.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.222, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeQtS7MXv1Y1THOoxaBKkgAAAgg"]
[Sun Apr 19 09:18:06.789966 2026] [:error] [pid 15763:tid 15803] [client 65.254.225.220:51546] [client 65.254.225.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeQtTrMXv1Y1THOoxaBKmAAAAgc"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 19 09:21:04.302992 2026] [:error] [pid 15763:tid 15815] [client 43.166.255.102:37954] [client 43.166.255.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeQuALMXv1Y1THOoxaBL5QAAAhM"]
[Sun Apr 19 09:33:33.114822 2026] [:error] [pid 15763:tid 15800] [client 178.62.32.109:51730] [client 178.62.32.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.62.32.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeQw7bMXv1Y1THOoxaBQkgAAAgQ"]
[Sun Apr 19 09:35:08.897568 2026] [:error] [pid 47886:tid 47897] [client 4.204.200.16:33579] [client 4.204.200.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aeQxTESe8yiyuPrD7yMcTQAAAMk"]
[Sun Apr 19 09:35:11.913941 2026] [:error] [pid 15764:tid 15844] [client 4.204.200.16:33480] [client 4.204.200.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aeQxT2LL_sqdSHoVp-QjwwAAAlI"]
[Sun Apr 19 09:35:14.748095 2026] [:error] [pid 15764:tid 15834] [client 4.204.200.16:47082] [client 4.204.200.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aeQxUmLL_sqdSHoVp-QjywAAAkg"]
[Sun Apr 19 09:35:21.094080 2026] [:error] [pid 47775:tid 47853] [client 4.204.200.16:42311] [client 4.204.200.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "aeQxWbmztjlk9tsmoeyp4gAAAIo"]
[Sun Apr 19 09:45:26.166954 2026] [:error] [pid 15764:tid 15835] [client 149.202.76.92:46182] [client 149.202.76.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.76.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeQztmLL_sqdSHoVp-QnOQAAAkk"]
[Sun Apr 19 09:47:02.583012 2026] [:error] [pid 15764:tid 15843] [client 159.223.61.19:34714] [client 159.223.61.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.61.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeQ0FmLL_sqdSHoVp-Qn0QAAAlE"]
[Sun Apr 19 09:53:52.689075 2026] [:error] [pid 47772:tid 47794] [client 23.98.148.92:39278] [client 23.98.148.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.98.148.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeQ1sIc0L16cb4smAz_3cwAAAAU"]
[Sun Apr 19 10:15:08.615489 2026] [:error] [pid 15764:tid 15844] [client 159.65.130.72:44436] [client 159.65.130.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.65.130.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeQ6rGLL_sqdSHoVp-QvDQAAAlI"]
[Sun Apr 19 10:26:59.796920 2026] [:error] [pid 47775:tid 47844] [client 80.239.207.207:53294] [client 80.239.207.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.239.207.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeQ9c7mztjlk9tsmoeyyRQAAAIE"]
[Sun Apr 19 10:32:47.174649 2026] [:error] [pid 15764:tid 15840] [client 192.176.172.166:59144] [client 192.176.172.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.176.172.166, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeQ-z2LL_sqdSHoVp-Qz0QAAAk4"]
[Sun Apr 19 10:33:05.451490 2026] [:error] [pid 47773:tid 47840] [client 192.176.172.166:39284] [client 192.176.172.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.176.172.166, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeQ-4eiBHdnCJDuPq9DNPgAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 19 10:41:29.711158 2026] [:error] [pid 47772:tid 47795] [client 37.128.148.215:35578] [client 37.128.148.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.128.148.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeRA2Yc0L16cb4smAz8LrgAAAAY"]
[Sun Apr 19 11:09:34.826949 2026] [:error] [pid 47775:tid 47863] [client 77.95.113.65:54498] [client 77.95.113.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.95.113.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeRHbrmztjlk9tsmoey5rwAAAJQ"]
[Sun Apr 19 11:26:34.620062 2026] [:error] [pid 15694:tid 15735] [client 195.3.220.88:48670] [client 195.3.220.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aeRLarimB-jol1fwqArYrQAAAYk"]
[Sun Apr 19 11:27:26.329983 2026] [proxy_fcgi:error] [pid 15763:tid 15797] [client 195.3.220.88:60746] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_header() in /home/expressi/public_html/wp-content/themes/twentytwentyone/404.php:12\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/themes/twentytwentyone/404.php on line 12'
[Sun Apr 19 11:28:14.943834 2026] [autoindex:error] [pid 15764:tid 15837] [client 195.3.220.88:40002] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 11:28:17.318330 2026] [autoindex:error] [pid 47772:tid 47801] [client 195.3.220.88:45648] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 19 11:28:28.515664 2026] [:error] [pid 15763:tid 15813] [client 195.3.220.88:54102] [client 195.3.220.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 195.3.220.88, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeRL3LMXv1Y1THOoxaB1swAAAhE"]
[Sun Apr 19 11:28:39.122101 2026] [:error] [pid 15764:tid 15847] [client 195.3.220.88:44846] [client 195.3.220.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/index.php"] [unique_id "aeRL52LL_sqdSHoVp-RKtQAAAlU"]
[Sun Apr 19 12:32:38.219885 2026] [:error] [pid 15764:tid 15835] [client 178.124.129.153:35378] [client 178.124.129.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.124.129.153, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeRa5mLL_sqdSHoVp-RodwAAAkk"]
[Sun Apr 19 12:32:45.498556 2026] [:error] [pid 47773:tid 47835] [client 178.124.129.153:33498] [client 178.124.129.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.124.129.153, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeRa7eiBHdnCJDuPq9DnKQAAAFM"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 19 12:35:19.523415 2026] [:error] [pid 15760:tid 15780] [client 64.92.9.212:55924] [client 64.92.9.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.92.9.212, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeRbh_SdD_XHQMJ_IStIdQAAAcw"]
[Sun Apr 19 12:44:10.248976 2026] [:error] [pid 15693:tid 15720] [client 195.142.136.26:39152] [client 195.142.136.26] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.142.136.26, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeRdmsNMD-ccazQlTsk04wAAAVg"]
[Sun Apr 19 12:54:22.727897 2026] [:error] [pid 47773:tid 47828] [client 35.242.254.186:55750] [client 35.242.254.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.242.254.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeRf_uiBHdnCJDuPq9Dr1gAAAEw"]
[Sun Apr 19 13:21:50.582615 2026] [:error] [pid 47773:tid 47828] [client 137.184.69.218:19258] [client 137.184.69.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.69.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeRmbuiBHdnCJDuPq9DwEQAAAEw"]
[Sun Apr 19 14:22:48.881085 2026] [:error] [pid 15693:tid 15697] [client 64.92.9.212:41882] [client 64.92.9.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.92.9.212, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeR0uMNMD-ccazQlTsk6lwAAAUE"]
[Sun Apr 19 14:50:31.633444 2026] [:error] [pid 15765:tid 15863] [client 45.5.100.126:42758] [client 45.5.100.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.5.100.126, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeR7N_Rqinw-W5EwQ77OQwAAAoo"]
[Sun Apr 19 14:50:43.793776 2026] [:error] [pid 15693:tid 15719] [client 45.5.100.126:42998] [client 45.5.100.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.5.100.126, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeR7Q8NMD-ccazQlTsk8MQAAAVc"]
[Sun Apr 19 14:50:51.252610 2026] [:error] [pid 15764:tid 15850] [client 45.5.100.126:42557] [client 45.5.100.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.5.100.126, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeR7S2LL_sqdSHoVp-SVugAAAlc"]
[Sun Apr 19 14:51:02.741487 2026] [:error] [pid 47775:tid 47861] [client 45.5.100.126:42779] [client 45.5.100.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.5.100.126, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeR7Vrmztjlk9tsmoezcoAAAAJI"]
[Sun Apr 19 14:51:15.181568 2026] [:error] [pid 47886:tid 47901] [client 45.5.100.126:42379] [client 45.5.100.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.5.100.126, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeR7Y0Se8yiyuPrD7yNGVwAAAM0"]
[Sun Apr 19 15:31:00.013455 2026] [:error] [pid 15763:tid 15818] [client 91.204.161.79:51486] [client 91.204.161.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.204.161.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeSEtLMXv1Y1THOoxaCskwAAAhY"]
[Sun Apr 19 16:06:50.955396 2026] [:error] [pid 47772:tid 47794] [client 109.172.115.12:34442] [client 109.172.115.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.172.115.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeSNGoc0L16cb4smAz9miAAAAAU"]
[Sun Apr 19 17:08:44.406832 2026] [:error] [pid 15764:tid 15848] [client 163.61.60.30:38198] [client 163.61.60.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.61.60.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeSbnGLL_sqdSHoVp-S89wAAAlY"]
[Sun Apr 19 17:50:59.297390 2026] [:error] [pid 15760:tid 15779] [client 68.183.124.132:34288] [client 68.183.124.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.124.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeSlg_SdD_XHQMJ_ISvHewAAAcs"]
[Sun Apr 19 20:38:11.851175 2026] [:error] [pid 47772:tid 47805] [client 43.153.48.240:59432] [client 43.153.48.240] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeTMs4c0L16cb4smAz-rzwAAABA"]
[Sun Apr 19 20:46:39.699310 2026] [:error] [pid 15760:tid 15768] [client 185.98.139.110:59382] [client 185.98.139.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.98.139.110, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeTOr_SdD_XHQMJ_ISsV6wAAAcA"]
[Sun Apr 19 22:03:29.098871 2026] [:error] [pid 15763:tid 15817] [client 81.181.68.123:39238] [client 81.181.68.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.181.68.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeTgsbMXv1Y1THOoxaAGGAAAAhU"]
[Sun Apr 19 22:50:51.099940 2026] [:error] [pid 15764:tid 15834] [client 146.70.194.222:47416] [client 146.70.194.222] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeTry2LL_sqdSHoVp-Q6ewAAAkg"]
[Sun Apr 19 23:19:11.924500 2026] [:error] [pid 47886:tid 47904] [client 148.251.46.181:33588] [client 148.251.46.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.46.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeTyb0Se8yiyuPrD7yOJVgAAANA"]
[Sun Apr 19 23:34:00.236416 2026] [:error] [pid 47773:tid 47823] [client 34.68.20.85:50135] [client 34.68.20.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.68.20.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeT16OiBHdnCJDuPq9BfnwAAAEc"]
[Sun Apr 19 23:34:02.348403 2026] [:error] [pid 47773:tid 47840] [client 34.68.20.85:50135] [client 34.68.20.85] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeT16uiBHdnCJDuPq9BfowAAAFg"]
[Sun Apr 19 23:34:02.647086 2026] [:error] [pid 47773:tid 47827] [client 34.68.20.85:50135] [client 34.68.20.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.68.20.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeT16uiBHdnCJDuPq9BfpAAAAEs"]
[Sun Apr 19 23:34:04.231423 2026] [:error] [pid 15694:tid 15747] [client 34.68.20.85:65284] [client 34.68.20.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.68.20.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeT17LimB-jol1fwqAodeAAAAZU"]
[Sun Apr 19 23:34:05.588848 2026] [:error] [pid 47886:tid 47904] [client 34.68.20.85:60524] [client 34.68.20.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.68.20.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeT17USe8yiyuPrD7yOLOwAAANA"]
[Sun Apr 19 23:34:07.181482 2026] [:error] [pid 15760:tid 15776] [client 34.68.20.85:59007] [client 34.68.20.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.68.20.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeT17_SdD_XHQMJ_ISt01AAAAcg"]
[Sun Apr 19 23:34:08.695452 2026] [:error] [pid 15764:tid 15842] [client 34.68.20.85:58456] [client 34.68.20.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.68.20.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeT18GLL_sqdSHoVp-RIlQAAAlA"]
[Sun Apr 19 23:34:08.695608 2026] [:error] [pid 15764:tid 15842] [client 34.68.20.85:58456] [client 34.68.20.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.68.20.85, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeT18GLL_sqdSHoVp-RIlQAAAlA"]
[Sun Apr 19 23:45:39.816128 2026] [:error] [pid 15764:tid 15834] [client 45.250.44.189:63886] [client 45.250.44.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.250.44.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeT4o2LL_sqdSHoVp-ROBAAAAkg"]
[Sun Apr 19 23:45:49.471120 2026] [:error] [pid 47773:tid 47839] [client 45.250.44.189:64196] [client 45.250.44.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.250.44.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeT4reiBHdnCJDuPq9BhxwAAAFc"]
[Sun Apr 19 23:45:59.796276 2026] [:error] [pid 15760:tid 15776] [client 45.250.44.189:64447] [client 45.250.44.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.250.44.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeT4t_SdD_XHQMJ_ISt65wAAAcg"]
[Sun Apr 19 23:46:10.206065 2026] [:error] [pid 15764:tid 15839] [client 45.250.44.189:64706] [client 45.250.44.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.250.44.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeT4wmLL_sqdSHoVp-ROPAAAAk0"]
[Sun Apr 19 23:46:21.264310 2026] [:error] [pid 15763:tid 15819] [client 45.250.44.189:64968] [client 45.250.44.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.250.44.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeT4zbMXv1Y1THOoxaAf_QAAAhc"]
[Sun Apr 19 23:46:30.905565 2026] [:error] [pid 15764:tid 15835] [client 45.250.44.189:65223] [client 45.250.44.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.250.44.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeT41mLL_sqdSHoVp-ROZwAAAkk"]
[Mon Apr 20 00:08:17.639726 2026] [:error] [pid 15760:tid 15772] [client 197.113.250.25:53184] [client 197.113.250.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.113.250.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeT98fSdD_XHQMJ_ISuGYgAAAcQ"]
[Mon Apr 20 00:08:28.128059 2026] [:error] [pid 15763:tid 15818] [client 197.113.250.25:53468] [client 197.113.250.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.113.250.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeT9_LMXv1Y1THOoxaAlLwAAAhY"]
[Mon Apr 20 00:08:38.879741 2026] [:error] [pid 15760:tid 15782] [client 197.113.250.25:53819] [client 197.113.250.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.113.250.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeT-BvSdD_XHQMJ_ISuGdgAAAc4"]
[Mon Apr 20 00:08:49.763814 2026] [:error] [pid 47772:tid 47806] [client 197.113.250.25:54049] [client 197.113.250.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.113.250.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeT-EYc0L16cb4smAz_wAgAAABE"]
[Mon Apr 20 00:09:00.593268 2026] [:error] [pid 15763:tid 15803] [client 197.113.250.25:54284] [client 197.113.250.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.113.250.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeT-HLMXv1Y1THOoxaAlPgAAAgc"]
[Mon Apr 20 00:17:50.685765 2026] [:error] [pid 47773:tid 47836] [client 20.203.188.128:36202] [client 20.203.188.128] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.203.188.128, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeUALuiBHdnCJDuPq9Bm8QAAAFQ"]
[Mon Apr 20 01:08:57.073825 2026] [:error] [pid 15760:tid 15781] [client 36.41.75.167:44005] [client 36.41.75.167] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aeUMKfSdD_XHQMJ_ISugpwAAAc0"]
[Mon Apr 20 01:30:55.318936 2026] [:error] [pid 15694:tid 15732] [client 147.93.39.188:21886] [client 147.93.39.188] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/core/.env"] [unique_id "aeURT7imB-jol1fwqAonoAAAAYY"]
[Mon Apr 20 01:30:55.322264 2026] [:error] [pid 47772:tid 47793] [client 147.93.39.188:21898] [client 147.93.39.188] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aeURT4c0L16cb4smAz8FdQAAAAQ"]
[Mon Apr 20 02:03:09.971809 2026] [:error] [pid 47772:tid 47801] [client 103.59.153.96:51477] [client 103.59.153.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.59.153.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeUY3Yc0L16cb4smAz8LVwAAAAw"]
[Mon Apr 20 02:03:19.135790 2026] [:error] [pid 15694:tid 15745] [client 103.59.153.96:51850] [client 103.59.153.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.59.153.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeUY57imB-jol1fwqAorswAAAZM"]
[Mon Apr 20 02:03:29.747397 2026] [:error] [pid 47772:tid 47797] [client 103.59.153.96:52137] [client 103.59.153.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.59.153.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeUY8Yc0L16cb4smAz8LbQAAAAg"]
[Mon Apr 20 02:03:40.171851 2026] [:error] [pid 47772:tid 47813] [client 103.59.153.96:52424] [client 103.59.153.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.59.153.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeUY_Ic0L16cb4smAz8LgwAAABg"]
[Mon Apr 20 02:03:51.130340 2026] [:error] [pid 47772:tid 47798] [client 103.59.153.96:52708] [client 103.59.153.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.59.153.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeUZB4c0L16cb4smAz8LkQAAAAk"]
[Mon Apr 20 02:04:01.489862 2026] [:error] [pid 15694:tid 15743] [client 103.59.153.96:52998] [client 103.59.153.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.59.153.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeUZEbimB-jol1fwqAor7wAAAZE"]
[Mon Apr 20 05:07:35.711175 2026] [:error] [pid 47731:tid 47737] [client 112.208.180.30:26227] [client 112.208.180.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.208.180.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeVEF1Owpc-h7Nzn-iOP9gAAAQQ"]
[Mon Apr 20 05:10:17.982277 2026] [:error] [pid 48101:tid 48124] [client 43.159.149.56:51872] [client 43.159.149.56] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aeVEufIgenNbs2bVQGsKqwAAAZQ"]
[Mon Apr 20 05:10:20.878391 2026] [:error] [pid 64334:tid 64417] [client 112.208.180.30:28778] [client 112.208.180.30] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeVEvMNh9IxxDqsrPyOJPgAAAI4"]
[Mon Apr 20 05:10:56.039970 2026] [:error] [pid 64440:tid 64449] [client 112.208.180.30:29332] [client 112.208.180.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.208.180.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeVE4NkVUvTgp8p7mrPdBwAAAMY"]
[Mon Apr 20 05:11:23.250294 2026] [:error] [pid 64440:tid 64457] [client 112.208.180.30:25722] [client 112.208.180.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.208.180.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeVE-9kVUvTgp8p7mrPdIAAAAM4"]
[Mon Apr 20 05:11:53.129528 2026] [:error] [pid 64334:tid 64413] [client 112.208.180.30:26119] [client 112.208.180.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.208.180.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeVFGcNh9IxxDqsrPyOJ2QAAAIo"]
[Mon Apr 20 05:12:20.341900 2026] [:error] [pid 47731:tid 47741] [client 112.208.180.30:26491] [client 112.208.180.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.208.180.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeVFNFOwpc-h7Nzn-iORAAAAAQg"]
[Mon Apr 20 05:24:37.228995 2026] [:error] [pid 47779:tid 47805] [client 54.36.181.89:49334] [client 54.36.181.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.36.181.89, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeVIFYahGl1n9UkmcNjqUwAAAVg"]
[Mon Apr 20 06:21:29.451152 2026] [:error] [pid 64332:tid 64346] [client 54.37.239.214:54614] [client 54.37.239.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.37.239.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeVVacAQ57uMKAVSYEkCdAAAAAQ"]
[Mon Apr 20 06:56:52.058661 2026] [:error] [pid 47731:tid 47755] [client 159.203.177.184:39758] [client 159.203.177.184] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.203.177.184, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeVdtFOwpc-h7Nzn-iOqjQAAARY"]
[Mon Apr 20 07:15:13.406027 2026] [:error] [pid 64332:tid 64365] [client 182.44.9.147:57735] [client 182.44.9.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeViAcAQ57uMKAVSYEkUawAAABc"]
[Mon Apr 20 07:16:29.533776 2026] [:error] [pid 47779:tid 47788] [client 43.131.36.84:34782] [client 43.131.36.84] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeViTYahGl1n9UkmcNj2VwAAAUc"]
[Mon Apr 20 07:25:29.160037 2026] [:error] [pid 64332:tid 64342] [client 172.176.155.194:48466] [client 172.176.155.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.176.155.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeVkacAQ57uMKAVSYEkYMQAAAAA"]
[Mon Apr 20 07:43:40.273787 2026] [:error] [pid 64333:tid 64386] [client 184.22.62.90:61531] [client 184.22.62.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.22.62.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeVorHZav9wH8wxMd_t6lAAAAEo"]
[Mon Apr 20 07:43:50.370448 2026] [:error] [pid 64333:tid 64382] [client 184.22.62.90:61853] [client 184.22.62.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.22.62.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeVotnZav9wH8wxMd_t6oQAAAEY"]
[Mon Apr 20 07:44:00.813907 2026] [:error] [pid 48101:tid 48113] [client 184.22.62.90:62069] [client 184.22.62.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.22.62.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeVowPIgenNbs2bVQGsiNwAAAYk"]
[Mon Apr 20 07:44:11.209104 2026] [:error] [pid 64333:tid 64383] [client 184.22.62.90:62288] [client 184.22.62.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.22.62.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeVoy3Zav9wH8wxMd_t6-wAAAEc"]
[Mon Apr 20 07:44:21.585697 2026] [:error] [pid 64333:tid 64381] [client 184.22.62.90:62504] [client 184.22.62.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.22.62.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeVo1XZav9wH8wxMd_t7EAAAAEU"]
[Mon Apr 20 07:50:04.164079 2026] [:error] [pid 60072:tid 60089] [client 84.86.190.63:38966] [client 84.86.190.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.86.190.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeVqLPuj5dzu2v3Qr6GtVQAAAc8"]
[Mon Apr 20 09:03:25.786186 2026] [:error] [pid 48101:tid 48124] [client 107.180.252.236:36674] [client 107.180.252.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.252.236, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeV7XfIgenNbs2bVQGsqzQAAAZQ"]
[Mon Apr 20 09:43:24.896013 2026] [:error] [pid 64334:tid 64420] [client 130.131.243.198:21823] [client 130.131.243.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aeWEvMNh9IxxDqsrPyPPegAAAJE"]
[Mon Apr 20 09:43:26.707854 2026] [:error] [pid 57636:tid 57650] [client 130.131.243.198:13550] [client 130.131.243.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aeWEvs52DhTnUHRKyRFqBwAAAgw"]
[Mon Apr 20 09:43:28.440879 2026] [:error] [pid 48101:tid 48127] [client 130.131.243.198:13538] [client 130.131.243.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aeWEwPIgenNbs2bVQGswNwAAAZc"]
[Mon Apr 20 09:43:39.599691 2026] [:error] [pid 48101:tid 48119] [client 130.131.243.198:13344] [client 130.131.243.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aeWEy_IgenNbs2bVQGswPgAAAY8"]
[Mon Apr 20 10:58:15.459462 2026] [:error] [pid 11441:tid 11446] [client 209.38.204.226:44186] [client 209.38.204.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.38.204.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeWWR8ixByFUvmh319CjJAAAAMM"]
[Mon Apr 20 10:58:20.152733 2026] [:error] [pid 11441:tid 11445] [client 209.38.204.226:44186] [client 209.38.204.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.38.204.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeWWTMixByFUvmh319CjPAAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Mon Apr 20 10:59:45.209947 2026] [:error] [pid 11352:tid 11429] [client 80.239.207.207:56362] [client 80.239.207.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.239.207.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeWWoWl10mhMSfJ7ir88VwAAAI8"]
[Mon Apr 20 11:03:53.510253 2026] [:error] [pid 11352:tid 11419] [client 202.157.175.19:35996] [client 202.157.175.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.157.175.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeWXmWl10mhMSfJ7ir8-RQAAAIU"]
[Mon Apr 20 12:44:52.926930 2026] [:error] [pid 42014:tid 42018] [client 36.50.26.140:35844] [client 36.50.26.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 36.50.26.140, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeWvRMek-00-ZI0f1NrWlwAAAQI"]
[Mon Apr 20 12:44:54.902230 2026] [:error] [pid 42014:tid 42023] [client 36.50.26.140:35844] [client 36.50.26.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 36.50.26.140, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeWvRsek-00-ZI0f1NrWnAAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Mon Apr 20 12:53:38.467939 2026] [:error] [pid 42014:tid 42025] [client 82.154.116.112:34196] [client 82.154.116.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.154.116.112, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeWxUsek-00-ZI0f1NrbpQAAAQk"]
[Mon Apr 20 13:06:19.417063 2026] [:error] [pid 42014:tid 42022] [client 36.111.67.189:58642] [client 36.111.67.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aeW0S8ek-00-ZI0f1NriMwAAAQY"]
[Mon Apr 20 13:14:48.721165 2026] [:error] [pid 11350:tid 11361] [client 128.199.223.38:38820] [client 128.199.223.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.223.38, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeW2SP4EoMBgOJuJnT0q7AAAAAI"]
[Mon Apr 20 13:33:30.044714 2026] [:error] [pid 11441:tid 11462] [client 103.65.237.216:49530] [client 103.65.237.216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "aeW6qsixByFUvmh319D10gAAANM"]
[Mon Apr 20 13:33:30.299095 2026] [:error] [pid 11441:tid 11458] [client 103.65.237.216:49588] [client 103.65.237.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "aeW6qsixByFUvmh319D10wAAAM8"]
[Mon Apr 20 13:48:03.543146 2026] [:error] [pid 11441:tid 11454] [client 103.57.225.32:62460] [client 103.57.225.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.57.225.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeW-E8ixByFUvmh319D_uAAAAMs"]
[Mon Apr 20 13:48:12.793727 2026] [:error] [pid 11441:tid 11443] [client 103.57.225.32:62882] [client 103.57.225.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.57.225.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeW-HMixByFUvmh319D_zQAAAMA"]
[Mon Apr 20 13:48:23.601187 2026] [:error] [pid 11441:tid 11451] [client 103.57.225.32:63236] [client 103.57.225.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.57.225.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeW-J8ixByFUvmh319D_3AAAAMg"]
[Mon Apr 20 13:48:34.149881 2026] [:error] [pid 42014:tid 42023] [client 103.57.225.32:17274] [client 103.57.225.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.57.225.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeW-Msek-00-ZI0f1Nr6-AAAAQc"]
[Mon Apr 20 13:48:44.684007 2026] [:error] [pid 11352:tid 11426] [client 103.57.225.32:63932] [client 103.57.225.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.57.225.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeW-PGl10mhMSfJ7ir953AAAAIw"]
[Mon Apr 20 14:02:07.102816 2026] [:error] [pid 42014:tid 42020] [client 103.153.117.24:60434] [client 103.153.117.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.117.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXBX8ek-00-ZI0f1NoBqgAAAQQ"]
[Mon Apr 20 14:02:14.408749 2026] [:error] [pid 11350:tid 11376] [client 103.153.117.24:60470] [client 103.153.117.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.117.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXBZv4EoMBgOJuJnT0y6wAAABE"]
[Mon Apr 20 14:02:23.677396 2026] [:error] [pid 6928:tid 6948] [client 103.153.117.24:60594] [client 103.153.117.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.117.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXBbx3y7MHq1iB0qYoARgAAAVI"]
[Mon Apr 20 14:02:36.412738 2026] [:error] [pid 6928:tid 6946] [client 103.153.117.24:60718] [client 103.153.117.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.117.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXBfB3y7MHq1iB0qYoAdQAAAVA"]
[Mon Apr 20 14:02:49.800412 2026] [:error] [pid 42014:tid 42017] [client 103.153.117.24:60866] [client 103.153.117.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.117.24, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXBicek-00-ZI0f1NoB5wAAAQE"]
[Mon Apr 20 14:27:13.200920 2026] [:error] [pid 6928:tid 6952] [client 82.102.18.118:34668] [client 82.102.18.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.102.18.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXHQR3y7MHq1iB0qYoOyAAAAVY"]
[Mon Apr 20 14:27:13.225995 2026] [:error] [pid 6928:tid 6947] [client 82.102.18.118:34682] [client 82.102.18.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.102.18.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXHQR3y7MHq1iB0qYoOyQAAAVE"]
[Mon Apr 20 14:27:15.767066 2026] [:error] [pid 6928:tid 6943] [client 82.102.18.118:34668] [client 82.102.18.118] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeXHQx3y7MHq1iB0qYoO2QAAAU0"]
[Mon Apr 20 14:27:15.808272 2026] [:error] [pid 6928:tid 6952] [client 82.102.18.118:34682] [client 82.102.18.118] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeXHQx3y7MHq1iB0qYoO2gAAAVY"]
[Mon Apr 20 14:27:16.028791 2026] [:error] [pid 6928:tid 6947] [client 82.102.18.118:34668] [client 82.102.18.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.102.18.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXHRB3y7MHq1iB0qYoO2wAAAVE"]
[Mon Apr 20 14:27:16.066285 2026] [:error] [pid 6928:tid 6946] [client 82.102.18.118:34682] [client 82.102.18.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.102.18.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXHRB3y7MHq1iB0qYoO3AAAAVA"]
[Mon Apr 20 14:27:17.703792 2026] [:error] [pid 42014:tid 42040] [client 82.102.18.118:47238] [client 82.102.18.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.102.18.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXHRcek-00-ZI0f1NoLSgAAARg"]
[Mon Apr 20 14:27:17.708539 2026] [:error] [pid 42014:tid 42029] [client 82.102.18.118:47244] [client 82.102.18.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.102.18.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXHRcek-00-ZI0f1NoLSwAAAQ0"]
[Mon Apr 20 14:27:19.369625 2026] [:error] [pid 11352:tid 11422] [client 82.102.18.118:47246] [client 82.102.18.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.102.18.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXHR2l10mhMSfJ7ir-CugAAAIg"]
[Mon Apr 20 14:27:19.369838 2026] [:error] [pid 11352:tid 11422] [client 82.102.18.118:47246] [client 82.102.18.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 82.102.18.118, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXHR2l10mhMSfJ7ir-CugAAAIg"]
[Mon Apr 20 14:27:19.414372 2026] [:error] [pid 6928:tid 6952] [client 82.102.18.118:47262] [client 82.102.18.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.102.18.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXHRx3y7MHq1iB0qYoO5gAAAVY"]
[Mon Apr 20 14:27:19.414550 2026] [:error] [pid 6928:tid 6952] [client 82.102.18.118:47262] [client 82.102.18.118] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 82.102.18.118, counter = 8"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXHRx3y7MHq1iB0qYoO5gAAAVY"]
[Mon Apr 20 14:36:45.175735 2026] [:error] [pid 11350:tid 11371] [client 141.98.11.134:60440] [client 141.98.11.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.98.11.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeXJff4EoMBgOJuJnT03QAAAAAw"]
[Mon Apr 20 14:37:25.399401 2026] [:error] [pid 6928:tid 6949] [client 178.236.245.227:56493] [client 178.236.245.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.236.245.227, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXJpR3y7MHq1iB0qYoWsAAAAVM"]
[Mon Apr 20 14:43:37.151532 2026] [:error] [pid 11350:tid 11363] [client 34.48.45.161:64574] [client 34.48.45.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.45.161, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXLGf4EoMBgOJuJnT05HgAAAAQ"]
[Mon Apr 20 14:43:39.525683 2026] [:error] [pid 11350:tid 11381] [client 34.48.45.161:64574] [client 34.48.45.161] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeXLG_4EoMBgOJuJnT05IQAAABY"]
[Mon Apr 20 14:43:39.743659 2026] [:error] [pid 11350:tid 11360] [client 34.48.45.161:64574] [client 34.48.45.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.45.161, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXLG_4EoMBgOJuJnT05IgAAAAE"]
[Mon Apr 20 14:43:41.499030 2026] [:error] [pid 6928:tid 6953] [client 34.48.45.161:62670] [client 34.48.45.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.45.161, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXLHR3y7MHq1iB0qYoawQAAAVc"]
[Mon Apr 20 14:43:43.167109 2026] [:error] [pid 42014:tid 42021] [client 34.48.45.161:64416] [client 34.48.45.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.45.161, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXLH8ek-00-ZI0f1NoSuQAAAQU"]
[Mon Apr 20 14:43:44.837522 2026] [:error] [pid 11352:tid 11427] [client 34.48.45.161:61334] [client 34.48.45.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.45.161, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXLIGl10mhMSfJ7ir-G4AAAAI0"]
[Mon Apr 20 14:43:46.578192 2026] [:error] [pid 6928:tid 6932] [client 34.48.45.161:53095] [client 34.48.45.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.48.45.161, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXLIh3y7MHq1iB0qYoazwAAAUI"]
[Mon Apr 20 14:43:46.578391 2026] [:error] [pid 6928:tid 6932] [client 34.48.45.161:53095] [client 34.48.45.161] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.48.45.161, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXLIh3y7MHq1iB0qYoazwAAAUI"]
[Mon Apr 20 15:25:13.945251 2026] [:error] [pid 42014:tid 42027] [client 89.163.159.173:39840] [client 89.163.159.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.163.159.173, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXU2cek-00-ZI0f1NojCgAAAQs"]
[Mon Apr 20 15:58:01.594713 2026] [:error] [pid 6928:tid 6941] [client 152.53.87.236:47174] [client 152.53.87.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.53.87.236, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXciR3y7MHq1iB0qYpIqwAAAUs"]
[Mon Apr 20 16:10:53.043940 2026] [:error] [pid 11352:tid 11422] [client 155.133.142.66:45738] [client 155.133.142.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.142.66, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXfjWl10mhMSfJ7ir-dJQAAAIg"]
[Mon Apr 20 16:14:10.693378 2026] [:error] [pid 6928:tid 6936] [client 23.239.25.95:47894] [client 23.239.25.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 23.239.25.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXgUh3y7MHq1iB0qYpTVwAAAUY"]
[Mon Apr 20 16:35:13.414660 2026] [:error] [pid 6928:tid 6949] [client 121.200.217.27:44230] [client 121.200.217.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 121.200.217.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeXlQR3y7MHq1iB0qYpdPgAAAVM"]
[Mon Apr 20 16:35:15.147712 2026] [:error] [pid 6928:tid 6951] [client 121.200.217.27:44230] [client 121.200.217.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 121.200.217.27, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeXlQx3y7MHq1iB0qYpdQwAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Mon Apr 20 16:46:44.075467 2026] [:error] [pid 42014:tid 42028] [client 89.251.0.50:59363] [client 89.251.0.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aeXn9Mek-00-ZI0f1NpFPQAAAQw"]
[Mon Apr 20 16:46:49.830426 2026] [:error] [pid 11350:tid 11370] [client 89.251.0.45:22699] [client 89.251.0.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aeXn-f4EoMBgOJuJnT1OjgAAAAs"]
[Mon Apr 20 16:47:05.848820 2026] [:error] [pid 6928:tid 6945] [client 89.251.0.56:24877] [client 89.251.0.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aeXoCR3y7MHq1iB0qYpkcwAAAU8"]
[Mon Apr 20 16:47:10.763600 2026] [:error] [pid 42014:tid 42017] [client 89.251.0.62:28425] [client 89.251.0.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aeXoDsek-00-ZI0f1NpFcwAAAQE"]
[Mon Apr 20 16:47:18.416004 2026] [:error] [pid 11351:tid 11397] [client 89.251.0.45:62229] [client 89.251.0.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aeXoFgN8Z1-vktaI_tOr6gAAAEo"]
[Mon Apr 20 16:47:20.521273 2026] [:error] [pid 6928:tid 6944] [client 89.251.0.61:50999] [client 89.251.0.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aeXoGB3y7MHq1iB0qYpkhwAAAU4"]
[Mon Apr 20 16:47:21.449731 2026] [:error] [pid 6928:tid 6947] [client 89.251.0.68:58667] [client 89.251.0.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aeXoGR3y7MHq1iB0qYpkigAAAVE"]
[Mon Apr 20 16:47:22.463431 2026] [:error] [pid 42014:tid 42033] [client 89.251.0.60:38305] [client 89.251.0.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aeXoGsek-00-ZI0f1NpFggAAARE"]
[Mon Apr 20 16:47:23.426363 2026] [:error] [pid 11351:tid 11398] [client 89.251.0.57:44541] [client 89.251.0.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aeXoGwN8Z1-vktaI_tOr7QAAAEs"]
[Mon Apr 20 16:47:24.530881 2026] [:error] [pid 11441:tid 11444] [client 89.251.0.72:21861] [client 89.251.0.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aeXoHMixByFUvmh319A3vgAAAME"]
[Mon Apr 20 16:47:26.043278 2026] [:error] [pid 11351:tid 11390] [client 89.251.0.59:48647] [client 89.251.0.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aeXoHgN8Z1-vktaI_tOr8AAAAEM"]
[Mon Apr 20 16:47:38.697609 2026] [autoindex:error] [pid 42014:tid 42032] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:47:40.909971 2026] [autoindex:error] [pid 42014:tid 42020] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:47:46.823555 2026] [autoindex:error] [pid 42014:tid 42036] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:47:47.906156 2026] [autoindex:error] [pid 42014:tid 42017] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:47:52.320247 2026] [autoindex:error] [pid 42014:tid 42040] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:47:52.564907 2026] [autoindex:error] [pid 42014:tid 42034] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:47:54.177310 2026] [autoindex:error] [pid 42014:tid 42032] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:47:55.177620 2026] [autoindex:error] [pid 42014:tid 42019] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:47:55.395515 2026] [autoindex:error] [pid 42014:tid 42026] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:47:56.359290 2026] [autoindex:error] [pid 42014:tid 42028] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:47:56.587501 2026] [autoindex:error] [pid 42014:tid 42018] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:47:56.814353 2026] [autoindex:error] [pid 42014:tid 42038] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:47:58.030059 2026] [autoindex:error] [pid 42014:tid 42025] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:47:58.257387 2026] [autoindex:error] [pid 42014:tid 42037] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:47:58.477419 2026] [autoindex:error] [pid 42014:tid 42026] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:01.390928 2026] [autoindex:error] [pid 42014:tid 42033] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:01.785997 2026] [autoindex:error] [pid 42014:tid 42020] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:02.171532 2026] [autoindex:error] [pid 42014:tid 42022] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:02.425222 2026] [autoindex:error] [pid 42014:tid 42019] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:02.996212 2026] [autoindex:error] [pid 42014:tid 42036] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:03.490029 2026] [autoindex:error] [pid 42014:tid 42016] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:04.585203 2026] [autoindex:error] [pid 42014:tid 42033] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:04.828659 2026] [autoindex:error] [pid 42014:tid 42040] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:08.066167 2026] [autoindex:error] [pid 42014:tid 42035] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:09.982976 2026] [autoindex:error] [pid 42014:tid 42040] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:10.215450 2026] [autoindex:error] [pid 42014:tid 42018] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:10.476136 2026] [autoindex:error] [pid 42014:tid 42022] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:13.896304 2026] [autoindex:error] [pid 42014:tid 42027] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:14.135062 2026] [autoindex:error] [pid 42014:tid 42024] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:17.156469 2026] [autoindex:error] [pid 42014:tid 42031] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:18.233031 2026] [autoindex:error] [pid 42014:tid 42030] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:19.602308 2026] [autoindex:error] [pid 42014:tid 42017] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:19.884542 2026] [autoindex:error] [pid 42014:tid 42040] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentythree/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:20.129821 2026] [autoindex:error] [pid 42014:tid 42029] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:20.387383 2026] [autoindex:error] [pid 42014:tid 42034] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:20.679888 2026] [autoindex:error] [pid 42014:tid 42031] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:24.115340 2026] [autoindex:error] [pid 42014:tid 42032] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:26.308274 2026] [autoindex:error] [pid 42014:tid 42018] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:26.533419 2026] [autoindex:error] [pid 42014:tid 42029] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:30.949384 2026] [autoindex:error] [pid 42014:tid 42022] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:32.131516 2026] [autoindex:error] [pid 42014:tid 42037] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:34.383785 2026] [autoindex:error] [pid 42014:tid 42023] [client 89.251.0.48:64875] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:35.771760 2026] [autoindex:error] [pid 42014:tid 42026] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:36.017013 2026] [autoindex:error] [pid 42014:tid 42031] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:36.241695 2026] [autoindex:error] [pid 42014:tid 42035] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:36.609998 2026] [autoindex:error] [pid 42014:tid 42020] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:36.862460 2026] [autoindex:error] [pid 42014:tid 42017] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:37.094928 2026] [autoindex:error] [pid 42014:tid 42016] [client 89.251.0.48:64875] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentytwo/assets/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon Apr 20 16:48:55.672153 2026] [:error] [pid 42014:tid 42020] [client 143.110.142.50:57758] [client 143.110.142.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.142.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeXod8ek-00-ZI0f1NpGZQAAAQQ"]
[Mon Apr 20 16:48:56.491253 2026] [:error] [pid 42014:tid 42030] [client 143.110.142.50:57758] [client 143.110.142.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.110.142.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeXoeMek-00-ZI0f1NpGZwAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Mon Apr 20 17:12:33.404924 2026] [:error] [pid 11352:tid 11430] [client 34.42.100.231:36447] [client 34.42.100.231] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeXuAWl10mhMSfJ7ir-sjwAAAJA"]
[Mon Apr 20 17:17:17.771895 2026] [:error] [pid 11441:tid 11456] [client 117.20.30.210:56802] [client 117.20.30.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.20.30.210, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXvHcixByFUvmh319BHqgAAAM0"]
[Mon Apr 20 17:28:32.254407 2026] [:error] [pid 6928:tid 6930] [client 3.8.117.15:46940] [client 3.8.117.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.8.117.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXxwB3y7MHq1iB0qYp1lwAAAUA"]
[Mon Apr 20 17:29:15.019764 2026] [:error] [pid 11350:tid 11376] [client 117.20.30.210:56351] [client 117.20.30.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.20.30.210, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeXx6_4EoMBgOJuJnT1UXAAAABE"]
[Mon Apr 20 18:04:48.102481 2026] [:error] [pid 42014:tid 42021] [client 129.226.174.80:33964] [client 129.226.174.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeX6QMek-00-ZI0f1NpfWgAAAQU"]
[Mon Apr 20 18:34:11.644190 2026] [:error] [pid 11351:tid 11391] [client 148.251.75.145:48050] [client 148.251.75.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.75.145, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeYBIwN8Z1-vktaI_tPEjwAAAEQ"]
[Mon Apr 20 18:38:31.179615 2026] [:error] [pid 6928:tid 6940] [client 5.193.60.25:50456] [client 5.193.60.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.193.60.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeYCJx3y7MHq1iB0qYqVCgAAAUo"]
[Mon Apr 20 18:38:41.450880 2026] [:error] [pid 11351:tid 11389] [client 5.193.60.25:50681] [client 5.193.60.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.193.60.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeYCMQN8Z1-vktaI_tPGIgAAAEI"]
[Mon Apr 20 18:38:51.735997 2026] [:error] [pid 11441:tid 11443] [client 5.193.60.25:50880] [client 5.193.60.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.193.60.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeYCO8ixByFUvmh319B6xgAAAMA"]
[Mon Apr 20 18:39:02.149069 2026] [:error] [pid 6928:tid 6942] [client 5.193.60.25:51078] [client 5.193.60.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.193.60.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeYCRh3y7MHq1iB0qYqVQgAAAUw"]
[Mon Apr 20 18:39:12.542878 2026] [:error] [pid 42014:tid 42034] [client 5.193.60.25:51277] [client 5.193.60.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.193.60.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeYCUMek-00-ZI0f1NpqwgAAARI"]
[Mon Apr 20 18:40:34.609596 2026] [:error] [pid 6928:tid 6941] [client 34.51.123.217:52496] [client 34.51.123.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.51.123.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeYCoh3y7MHq1iB0qYqV0QAAAUs"]
[Mon Apr 20 18:40:35.764831 2026] [:error] [pid 6928:tid 6936] [client 34.51.123.217:52496] [client 34.51.123.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.51.123.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeYCox3y7MHq1iB0qYqV2AAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Mon Apr 20 18:47:26.086179 2026] [autoindex:error] [pid 11441:tid 11453] [client 212.47.77.99:61107] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon Apr 20 18:47:52.481249 2026] [:error] [pid 11494:tid 11514] [client 167.160.190.163:33946] [client 167.160.190.163] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeYEWMgko5iFiE8YoyS99QAAAZI"], referer: https://www.google.com
[Mon Apr 20 19:04:00.748189 2026] [:error] [pid 42014:tid 42035] [client 65.21.85.169:38304] [client 65.21.85.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.21.85.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeYIIMek-00-ZI0f1NpueQAAARM"]
[Mon Apr 20 19:04:05.659149 2026] [:error] [pid 42014:tid 42031] [client 65.21.85.169:38304] [client 65.21.85.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.21.85.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeYIJcek-00-ZI0f1NpufAAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Mon Apr 20 19:24:13.974170 2026] [:error] [pid 11351:tid 11406] [client 182.44.8.254:59938] [client 182.44.8.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeYM3QN8Z1-vktaI_tPZ-AAAAFM"]
[Mon Apr 20 21:06:50.694958 2026] [:error] [pid 42014:tid 42026] [client 43.130.40.120:38230] [client 43.130.40.120] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aeYk6sek-00-ZI0f1NqCPAAAAQo"]
[Mon Apr 20 22:00:16.522205 2026] [:error] [pid 11351:tid 11397] [client 62.60.131.177:3044] [client 62.60.131.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.60.131.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeYxcAN8Z1-vktaI_tMbMQAAAEo"]
[Mon Apr 20 22:00:17.410939 2026] [:error] [pid 11351:tid 11405] [client 62.60.131.177:3044] [client 62.60.131.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.60.131.177, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeYxcQN8Z1-vktaI_tMbMgAAAFI"]
[Mon Apr 20 22:14:11.345464 2026] [:error] [pid 11350:tid 11376] [client 213.160.75.126:43218] [client 213.160.75.126] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.160.75.126, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeY0s_4EoMBgOJuJnT3TqwAAABE"]
[Mon Apr 20 22:32:11.832607 2026] [:error] [pid 11351:tid 11402] [client 109.228.52.205:57596] [client 109.228.52.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.228.52.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeY46wN8Z1-vktaI_tMrJwAAAE8"]
[Mon Apr 20 22:54:00.445408 2026] [:error] [pid 42014:tid 42020] [client 3.8.117.15:40630] [client 3.8.117.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.8.117.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeY-CMek-00-ZI0f1NqQSgAAAQQ"]
[Mon Apr 20 23:06:45.247966 2026] [:error] [pid 11350:tid 11377] [client 162.19.25.160:48244] [client 162.19.25.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.19.25.160, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeZBBf4EoMBgOJuJnT3pMwAAABI"]
[Mon Apr 20 23:12:42.159356 2026] [:error] [pid 6928:tid 6951] [client 86.97.165.63:64313] [client 86.97.165.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.97.165.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeZCah3y7MHq1iB0qYrLhwAAAVU"]
[Mon Apr 20 23:14:07.256791 2026] [:error] [pid 11350:tid 11383] [client 86.97.165.63:50782] [client 86.97.165.63] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aeZCv_4EoMBgOJuJnT3rsgAAABg"]
[Mon Apr 20 23:14:35.314669 2026] [:error] [pid 11350:tid 11380] [client 86.97.165.63:51242] [client 86.97.165.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.97.165.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeZC2_4EoMBgOJuJnT3r8AAAABU"]
[Mon Apr 20 23:15:08.169509 2026] [:error] [pid 11494:tid 11510] [client 86.97.165.63:51746] [client 86.97.165.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.97.165.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeZC_Mgko5iFiE8YoyQIawAAAY4"]
[Mon Apr 20 23:15:33.472284 2026] [:error] [pid 11494:tid 11520] [client 86.97.165.63:52146] [client 86.97.165.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.97.165.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeZDFcgko5iFiE8YoyQInwAAAZg"]
[Mon Apr 20 23:16:00.090641 2026] [:error] [pid 11494:tid 11515] [client 86.97.165.63:52558] [client 86.97.165.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.97.165.63, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeZDMMgko5iFiE8YoyQIwwAAAZM"]
[Mon Apr 20 23:40:12.813779 2026] [:error] [pid 11351:tid 11410] [client 45.131.195.185:31241] [client 45.131.195.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "aeZI3AN8Z1-vktaI_tNOrQAAAFc"]
[Tue Apr 21 00:06:13.116907 2026] [:error] [pid 6928:tid 6940] [client 34.121.143.199:55417] [client 34.121.143.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.121.143.199, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeZO9R3y7MHq1iB0qYrWmAAAAUo"]
[Tue Apr 21 00:06:13.496514 2026] [:error] [pid 42014:tid 42029] [client 34.121.143.199:55554] [client 34.121.143.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.121.143.199, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeZO9cek-00-ZI0f1NqdegAAAQ0"]
[Tue Apr 21 00:06:15.289676 2026] [:error] [pid 6928:tid 6948] [client 34.121.143.199:55417] [client 34.121.143.199] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeZO9x3y7MHq1iB0qYrWngAAAVI"]
[Tue Apr 21 00:06:15.490623 2026] [:error] [pid 6928:tid 6938] [client 34.121.143.199:55417] [client 34.121.143.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.121.143.199, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeZO9x3y7MHq1iB0qYrWnwAAAUg"]
[Tue Apr 21 00:06:15.703586 2026] [:error] [pid 42014:tid 42040] [client 34.121.143.199:55554] [client 34.121.143.199] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeZO98ek-00-ZI0f1NqdfwAAARg"]
[Tue Apr 21 00:06:15.940024 2026] [:error] [pid 42014:tid 42023] [client 34.121.143.199:55554] [client 34.121.143.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.121.143.199, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeZO98ek-00-ZI0f1NqdgAAAAQc"]
[Tue Apr 21 00:06:16.918727 2026] [:error] [pid 11441:tid 11463] [client 34.121.143.199:58482] [client 34.121.143.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.121.143.199, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeZO-MixByFUvmh319DHxQAAANQ"]
[Tue Apr 21 00:06:17.333533 2026] [:error] [pid 11351:tid 11390] [client 34.121.143.199:58697] [client 34.121.143.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.121.143.199, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeZO-QN8Z1-vktaI_tNcQAAAAEM"]
[Tue Apr 21 00:06:18.279662 2026] [:error] [pid 11351:tid 11406] [client 34.121.143.199:59260] [client 34.121.143.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.121.143.199, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeZO-gN8Z1-vktaI_tNcRgAAAFM"]
[Tue Apr 21 00:06:18.279826 2026] [:error] [pid 11351:tid 11406] [client 34.121.143.199:59260] [client 34.121.143.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.121.143.199, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeZO-gN8Z1-vktaI_tNcRgAAAFM"]
[Tue Apr 21 00:06:18.685101 2026] [:error] [pid 11351:tid 11404] [client 34.121.143.199:59493] [client 34.121.143.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.121.143.199, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeZO-gN8Z1-vktaI_tNcSAAAAFE"]
[Tue Apr 21 00:06:18.685313 2026] [:error] [pid 11351:tid 11404] [client 34.121.143.199:59493] [client 34.121.143.199] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.121.143.199, counter = 8"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeZO-gN8Z1-vktaI_tNcSAAAAFE"]
[Tue Apr 21 00:39:54.183427 2026] [autoindex:error] [pid 11351:tid 11396] [client 20.100.178.47:18395] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:39:56.808343 2026] [autoindex:error] [pid 11351:tid 11393] [client 20.100.178.47:18395] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/audio/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:40:03.136094 2026] [autoindex:error] [pid 11351:tid 11393] [client 20.100.178.47:18395] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfive/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:40:03.411629 2026] [autoindex:error] [pid 11351:tid 11388] [client 20.100.178.47:18395] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/buttons/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:40:04.526591 2026] [:error] [pid 11351:tid 11390] [client 20.100.178.47:18395] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bhm.php"] [unique_id "aeZW5AN8Z1-vktaI_tNybQAAAEM"]
[Tue Apr 21 00:40:05.892671 2026] [:error] [pid 11441:tid 11450] [client 20.100.178.47:38386] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bhm.php"] [unique_id "aeZW5cixByFUvmh319DPjwAAAMc"]
[Tue Apr 21 00:40:06.892033 2026] [:error] [pid 11351:tid 11410] [client 20.100.178.47:31807] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bhm.php"] [unique_id "aeZW5gN8Z1-vktaI_tNyfwAAAFc"]
[Tue Apr 21 00:40:08.125339 2026] [:error] [pid 11351:tid 11397] [client 20.100.178.47:38371] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bhm.php"] [unique_id "aeZW6AN8Z1-vktaI_tNyiQAAAEo"]
[Tue Apr 21 00:40:09.170072 2026] [:error] [pid 6928:tid 6933] [client 20.100.178.47:18394] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xozx.php"] [unique_id "aeZW6R3y7MHq1iB0qYrcwAAAAUM"]
[Tue Apr 21 00:40:11.040135 2026] [:error] [pid 11351:tid 11410] [client 20.100.178.47:60461] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xozx.php"] [unique_id "aeZW6wN8Z1-vktaI_tNyoAAAAFc"]
[Tue Apr 21 00:40:12.216836 2026] [:error] [pid 11352:tid 11421] [client 20.100.178.47:23310] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xozx.php"] [unique_id "aeZW7Gl10mhMSfJ7ir_2mAAAAIc"]
[Tue Apr 21 00:40:13.423851 2026] [:error] [pid 11351:tid 11399] [client 20.100.178.47:31778] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xozx.php"] [unique_id "aeZW7QN8Z1-vktaI_tNyrwAAAEw"]
[Tue Apr 21 00:40:14.204103 2026] [:error] [pid 11350:tid 11376] [client 20.100.178.47:23346] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-Blogs.php"] [unique_id "aeZW7v4EoMBgOJuJnT0MqwAAABE"]
[Tue Apr 21 00:40:15.034446 2026] [:error] [pid 11494:tid 11507] [client 20.100.178.47:51567] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-Blogs.php"] [unique_id "aeZW78gko5iFiE8YoyQjmAAAAYs"]
[Tue Apr 21 00:40:15.882819 2026] [:error] [pid 11351:tid 11405] [client 20.100.178.47:37035] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-Blogs.php"] [unique_id "aeZW7wN8Z1-vktaI_tNywQAAAFI"]
[Tue Apr 21 00:40:16.798385 2026] [:error] [pid 11351:tid 11392] [client 20.100.178.47:33564] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-Blogs.php"] [unique_id "aeZW8AN8Z1-vktaI_tNyygAAAEU"]
[Tue Apr 21 00:40:18.699339 2026] [:error] [pid 6928:tid 6947] [client 20.100.178.47:41843] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmu.php"] [unique_id "aeZW8h3y7MHq1iB0qYrc_AAAAVE"]
[Tue Apr 21 00:40:19.492560 2026] [:error] [pid 11441:tid 11465] [client 20.100.178.47:47385] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmu.php"] [unique_id "aeZW88ixByFUvmh319DPngAAANY"]
[Tue Apr 21 00:40:20.530882 2026] [:error] [pid 42014:tid 42031] [client 20.100.178.47:23299] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmu.php"] [unique_id "aeZW9Mek-00-ZI0f1NqihwAAAQ8"]
[Tue Apr 21 00:40:21.678785 2026] [:error] [pid 6928:tid 6941] [client 20.100.178.47:33566] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmu.php"] [unique_id "aeZW9R3y7MHq1iB0qYrdAwAAAUs"]
[Tue Apr 21 00:40:22.672603 2026] [:error] [pid 11351:tid 11408] [client 20.100.178.47:41831] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ref.php"] [unique_id "aeZW9gN8Z1-vktaI_tNy4AAAAFU"]
[Tue Apr 21 00:40:23.958955 2026] [:error] [pid 11494:tid 11504] [client 20.100.178.47:37039] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ref.php"] [unique_id "aeZW98gko5iFiE8YoyQjvQAAAYg"]
[Tue Apr 21 00:40:25.155794 2026] [:error] [pid 11350:tid 11367] [client 20.100.178.47:18403] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ref.php"] [unique_id "aeZW-f4EoMBgOJuJnT0MxwAAAAg"]
[Tue Apr 21 00:40:25.946964 2026] [:error] [pid 11352:tid 11423] [client 20.100.178.47:38364] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ref.php"] [unique_id "aeZW-Wl10mhMSfJ7ir_2ogAAAIk"]
[Tue Apr 21 00:40:26.676517 2026] [:error] [pid 11441:tid 11451] [client 20.100.178.47:37000] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-xme.php"] [unique_id "aeZW-sixByFUvmh319DPqAAAAMg"]
[Tue Apr 21 00:40:27.420869 2026] [:error] [pid 11441:tid 11459] [client 20.100.178.47:47402] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-xme.php"] [unique_id "aeZW-8ixByFUvmh319DPrAAAANA"]
[Tue Apr 21 00:40:28.674168 2026] [:error] [pid 11441:tid 11449] [client 20.100.178.47:23889] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-xme.php"] [unique_id "aeZW_MixByFUvmh319DPrgAAAMY"]
[Tue Apr 21 00:40:29.354130 2026] [:error] [pid 11494:tid 11501] [client 20.100.178.47:60433] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-xme.php"] [unique_id "aeZW_cgko5iFiE8YoyQjwwAAAYU"]
[Tue Apr 21 00:40:30.216762 2026] [:error] [pid 6928:tid 6946] [client 20.100.178.47:41827] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer.php"] [unique_id "aeZW_h3y7MHq1iB0qYrdCgAAAVA"]
[Tue Apr 21 00:40:31.437253 2026] [:error] [pid 11351:tid 11396] [client 20.100.178.47:41840] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer.php"] [unique_id "aeZW_wN8Z1-vktaI_tNzDwAAAEk"]
[Tue Apr 21 00:40:32.417149 2026] [:error] [pid 11441:tid 11452] [client 20.100.178.47:44163] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer.php"] [unique_id "aeZXAMixByFUvmh319DPswAAAMk"]
[Tue Apr 21 00:40:33.603388 2026] [:error] [pid 11351:tid 11401] [client 20.100.178.47:48029] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer.php"] [unique_id "aeZXAQN8Z1-vktaI_tNzGQAAAE4"]
[Tue Apr 21 00:40:34.655869 2026] [:error] [pid 11351:tid 11404] [client 20.100.178.47:47397] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ktfow.php"] [unique_id "aeZXAgN8Z1-vktaI_tNzHgAAAFE"]
[Tue Apr 21 00:40:35.398862 2026] [:error] [pid 6928:tid 6942] [client 20.100.178.47:37003] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ktfow.php"] [unique_id "aeZXAx3y7MHq1iB0qYrdDwAAAUw"]
[Tue Apr 21 00:40:36.594986 2026] [:error] [pid 11351:tid 11393] [client 20.100.178.47:50322] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ktfow.php"] [unique_id "aeZXBAN8Z1-vktaI_tNzJQAAAEY"]
[Tue Apr 21 00:40:37.336453 2026] [:error] [pid 11351:tid 11398] [client 20.100.178.47:38362] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ktfow.php"] [unique_id "aeZXBQN8Z1-vktaI_tNzKgAAAEs"]
[Tue Apr 21 00:40:38.485354 2026] [:error] [pid 42014:tid 42029] [client 20.100.178.47:25471] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mode.php"] [unique_id "aeZXBsek-00-ZI0f1NqimwAAAQ0"]
[Tue Apr 21 00:40:39.906192 2026] [:error] [pid 11351:tid 11403] [client 20.100.178.47:23116] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mode.php"] [unique_id "aeZXBwN8Z1-vktaI_tNzNAAAAFA"]
[Tue Apr 21 00:40:41.411352 2026] [:error] [pid 11494:tid 11507] [client 20.100.178.47:32383] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mode.php"] [unique_id "aeZXCcgko5iFiE8YoyQjywAAAYs"]
[Tue Apr 21 00:40:42.228201 2026] [:error] [pid 6928:tid 6951] [client 20.100.178.47:49839] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mode.php"] [unique_id "aeZXCh3y7MHq1iB0qYrdGQAAAVU"]
[Tue Apr 21 00:40:43.541306 2026] [:error] [pid 11351:tid 11406] [client 20.100.178.47:39658] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Xx.php"] [unique_id "aeZXCwN8Z1-vktaI_tNzQAAAAFM"]
[Tue Apr 21 00:40:45.161637 2026] [:error] [pid 11350:tid 11372] [client 20.100.178.47:32320] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Xx.php"] [unique_id "aeZXDf4EoMBgOJuJnT0M3gAAAA0"]
[Tue Apr 21 00:40:46.647201 2026] [:error] [pid 11351:tid 11388] [client 20.100.178.47:17015] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Xx.php"] [unique_id "aeZXDgN8Z1-vktaI_tNzTQAAAEE"]
[Tue Apr 21 00:40:47.455938 2026] [:error] [pid 11351:tid 11400] [client 20.100.178.47:36549] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Xx.php"] [unique_id "aeZXDwN8Z1-vktaI_tNzUgAAAE0"]
[Tue Apr 21 00:40:48.290454 2026] [:error] [pid 6928:tid 6938] [client 20.100.178.47:45389] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmini.php"] [unique_id "aeZXEB3y7MHq1iB0qYrdJwAAAUg"]
[Tue Apr 21 00:40:49.055745 2026] [:error] [pid 11352:tid 11420] [client 20.100.178.47:36569] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmini.php"] [unique_id "aeZXEWl10mhMSfJ7ir_2wQAAAIY"]
[Tue Apr 21 00:40:49.998172 2026] [:error] [pid 11352:tid 11434] [client 20.100.178.47:40103] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmini.php"] [unique_id "aeZXEWl10mhMSfJ7ir_2yAAAAJQ"]
[Tue Apr 21 00:40:50.796319 2026] [:error] [pid 11350:tid 11360] [client 20.100.178.47:42920] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmini.php"] [unique_id "aeZXEv4EoMBgOJuJnT0M4wAAAAE"]
[Tue Apr 21 00:40:51.887800 2026] [:error] [pid 42014:tid 42037] [client 20.100.178.47:2582] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2468.php"] [unique_id "aeZXE8ek-00-ZI0f1NqioQAAARU"]
[Tue Apr 21 00:40:53.356489 2026] [:error] [pid 11351:tid 11394] [client 20.100.178.47:36575] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2468.php"] [unique_id "aeZXFQN8Z1-vktaI_tNzYQAAAEc"]
[Tue Apr 21 00:40:54.453996 2026] [:error] [pid 11351:tid 11397] [client 20.100.178.47:17903] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2468.php"] [unique_id "aeZXFgN8Z1-vktaI_tNzYwAAAEo"]
[Tue Apr 21 00:40:55.976993 2026] [:error] [pid 11351:tid 11399] [client 20.100.178.47:63217] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2468.php"] [unique_id "aeZXFwN8Z1-vktaI_tNzbgAAAEw"]
[Tue Apr 21 00:40:57.320795 2026] [:error] [pid 11351:tid 11389] [client 20.100.178.47:2657] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aeZXGQN8Z1-vktaI_tNzegAAAEI"]
[Tue Apr 21 00:41:00.637312 2026] [:error] [pid 6928:tid 6951] [client 20.100.178.47:34007] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aeZXHB3y7MHq1iB0qYrdPgAAAVU"]
[Tue Apr 21 00:41:01.712963 2026] [:error] [pid 11441:tid 11443] [client 20.100.178.47:45458] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aeZXHcixByFUvmh319DPwQAAAMA"]
[Tue Apr 21 00:41:02.596553 2026] [:error] [pid 6928:tid 6936] [client 20.100.178.47:42904] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aeZXHh3y7MHq1iB0qYrdQQAAAUY"]
[Tue Apr 21 00:41:15.756054 2026] [:error] [pid 11351:tid 11400] [client 20.100.178.47:36534] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "aeZXKwN8Z1-vktaI_tNzygAAAE0"]
[Tue Apr 21 00:41:16.520642 2026] [:error] [pid 42014:tid 42021] [client 20.100.178.47:16584] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "aeZXLMek-00-ZI0f1NqitQAAAQU"]
[Tue Apr 21 00:41:17.349699 2026] [:error] [pid 11350:tid 11363] [client 20.100.178.47:51109] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "aeZXLf4EoMBgOJuJnT0NCAAAAAQ"]
[Tue Apr 21 00:41:18.636691 2026] [:error] [pid 11351:tid 11403] [client 20.100.178.47:30977] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "aeZXLgN8Z1-vktaI_tNz1wAAAFA"]
[Tue Apr 21 00:41:19.720510 2026] [:error] [pid 11350:tid 11366] [client 20.100.178.47:33112] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "aeZXL_4EoMBgOJuJnT0NFAAAAAc"]
[Tue Apr 21 00:41:20.679896 2026] [:error] [pid 11350:tid 11381] [client 20.100.178.47:16586] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "aeZXMP4EoMBgOJuJnT0NFwAAABY"]
[Tue Apr 21 00:41:21.472780 2026] [:error] [pid 6928:tid 6950] [client 20.100.178.47:19856] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "aeZXMR3y7MHq1iB0qYrdVQAAAVQ"]
[Tue Apr 21 00:41:24.389477 2026] [:error] [pid 6928:tid 6940] [client 20.100.178.47:38329] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "aeZXNB3y7MHq1iB0qYrdWgAAAUo"]
[Tue Apr 21 00:41:28.304741 2026] [:error] [pid 11441:tid 11459] [client 20.100.178.47:16625] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aeZXOMixByFUvmh319DP7wAAANA"]
[Tue Apr 21 00:41:31.897955 2026] [:error] [pid 11441:tid 11448] [client 20.100.178.47:31005] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aeZXO8ixByFUvmh319DP-wAAAMU"]
[Tue Apr 21 00:41:33.131719 2026] [:error] [pid 11351:tid 11392] [client 20.100.178.47:31023] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aeZXPQN8Z1-vktaI_tNz_wAAAEU"]
[Tue Apr 21 00:41:38.611340 2026] [:error] [pid 11350:tid 11362] [client 20.100.178.47:29235] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aeZXQv4EoMBgOJuJnT0NMgAAAAM"]
[Tue Apr 21 00:41:41.596743 2026] [:error] [pid 11351:tid 11399] [client 20.100.178.47:19530] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "aeZXRQN8Z1-vktaI_tN0FwAAAEw"]
[Tue Apr 21 00:41:43.858354 2026] [:error] [pid 11352:tid 11422] [client 20.100.178.47:51615] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "aeZXR2l10mhMSfJ7ir_29wAAAIg"]
[Tue Apr 21 00:41:44.643873 2026] [:error] [pid 11351:tid 11394] [client 20.100.178.47:40645] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "aeZXSAN8Z1-vktaI_tN0IAAAAEc"]
[Tue Apr 21 00:41:45.596788 2026] [:error] [pid 11441:tid 11451] [client 20.100.178.47:59159] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "aeZXScixByFUvmh319DQCwAAAMg"]
[Tue Apr 21 00:41:46.622562 2026] [:error] [pid 11352:tid 11416] [client 20.100.178.47:37652] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/"] [unique_id "aeZXSml10mhMSfJ7ir_2-wAAAII"]
[Tue Apr 21 00:41:48.890112 2026] [:error] [pid 11352:tid 11423] [client 20.100.178.47:51109] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/"] [unique_id "aeZXTGl10mhMSfJ7ir_3AAAAAIk"]
[Tue Apr 21 00:41:49.698149 2026] [:error] [pid 11494:tid 11519] [client 20.100.178.47:51585] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/"] [unique_id "aeZXTcgko5iFiE8YoyQkPAAAAZc"]
[Tue Apr 21 00:41:50.700867 2026] [:error] [pid 6928:tid 6943] [client 20.100.178.47:59191] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/"] [unique_id "aeZXTh3y7MHq1iB0qYrdhQAAAU0"]
[Tue Apr 21 00:41:52.289711 2026] [:error] [pid 11494:tid 11507] [client 20.100.178.47:51628] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "aeZXUMgko5iFiE8YoyQkRAAAAYs"]
[Tue Apr 21 00:41:53.099832 2026] [:error] [pid 11494:tid 11505] [client 20.100.178.47:22342] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "aeZXUcgko5iFiE8YoyQkSQAAAYk"]
[Tue Apr 21 00:41:54.004658 2026] [:error] [pid 11494:tid 11498] [client 20.100.178.47:22681] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "aeZXUsgko5iFiE8YoyQkUQAAAYI"]
[Tue Apr 21 00:41:55.397223 2026] [:error] [pid 11351:tid 11397] [client 20.100.178.47:41731] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "aeZXUwN8Z1-vktaI_tN0QgAAAEo"]
[Tue Apr 21 00:41:58.304517 2026] [:error] [pid 11351:tid 11409] [client 20.100.178.47:17352] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "aeZXVgN8Z1-vktaI_tN0TAAAAFY"]
[Tue Apr 21 00:41:58.950736 2026] [:error] [pid 11351:tid 11389] [client 20.100.178.47:22670] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "aeZXVgN8Z1-vktaI_tN0VgAAAEI"]
[Tue Apr 21 00:42:00.008329 2026] [:error] [pid 11351:tid 11394] [client 20.100.178.47:22717] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "aeZXWAN8Z1-vktaI_tN0WwAAAEc"]
[Tue Apr 21 00:42:01.084841 2026] [:error] [pid 11441:tid 11465] [client 20.100.178.47:22706] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "aeZXWcixByFUvmh319DQIAAAANY"]
[Tue Apr 21 00:42:02.532077 2026] [:error] [pid 11351:tid 11411] [client 20.100.178.47:51624] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tea.php"] [unique_id "aeZXWgN8Z1-vktaI_tN0bgAAAFg"]
[Tue Apr 21 00:42:03.818287 2026] [:error] [pid 11441:tid 11454] [client 20.100.178.47:53695] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tea.php"] [unique_id "aeZXW8ixByFUvmh319DQJgAAAMs"]
[Tue Apr 21 00:42:04.761692 2026] [:error] [pid 42014:tid 42036] [client 20.100.178.47:19565] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tea.php"] [unique_id "aeZXXMek-00-ZI0f1Nqi3QAAARQ"]
[Tue Apr 21 00:42:05.550675 2026] [:error] [pid 6928:tid 6945] [client 20.100.178.47:15885] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tea.php"] [unique_id "aeZXXR3y7MHq1iB0qYrdkAAAAU8"]
[Tue Apr 21 00:42:06.899309 2026] [:error] [pid 6928:tid 6950] [client 20.100.178.47:59188] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/seo.php"] [unique_id "aeZXXh3y7MHq1iB0qYrdkwAAAVQ"]
[Tue Apr 21 00:42:07.547858 2026] [:error] [pid 11350:tid 11364] [client 20.100.178.47:17381] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/seo.php"] [unique_id "aeZXX_4EoMBgOJuJnT0NRwAAAAU"]
[Tue Apr 21 00:42:08.658103 2026] [:error] [pid 11494:tid 11514] [client 20.100.178.47:19567] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/seo.php"] [unique_id "aeZXYMgko5iFiE8YoyQkgQAAAZI"]
[Tue Apr 21 00:42:09.694339 2026] [:error] [pid 11441:tid 11464] [client 20.100.178.47:15879] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/seo.php"] [unique_id "aeZXYcixByFUvmh319DQKAAAANU"]
[Tue Apr 21 00:42:10.503803 2026] [:error] [pid 11350:tid 11382] [client 20.100.178.47:16931] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "aeZXYv4EoMBgOJuJnT0NVAAAABc"]
[Tue Apr 21 00:42:11.593610 2026] [:error] [pid 11350:tid 11368] [client 20.100.178.47:44852] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "aeZXY_4EoMBgOJuJnT0NWQAAAAk"]
[Tue Apr 21 00:42:12.889896 2026] [:error] [pid 11441:tid 11446] [client 20.100.178.47:51620] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "aeZXZMixByFUvmh319DQLQAAAMM"]
[Tue Apr 21 00:42:28.903955 2026] [:error] [pid 11351:tid 11391] [client 20.100.178.47:2160] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/nastar.php"] [unique_id "aeZXdAN8Z1-vktaI_tN1BAAAAEQ"]
[Tue Apr 21 00:42:29.620931 2026] [:error] [pid 11350:tid 11371] [client 20.100.178.47:42985] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/nastar.php"] [unique_id "aeZXdf4EoMBgOJuJnT0NugAAAAw"]
[Tue Apr 21 00:42:30.608721 2026] [:error] [pid 11350:tid 11363] [client 20.100.178.47:43000] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/nastar.php"] [unique_id "aeZXdv4EoMBgOJuJnT0NwwAAAAQ"]
[Tue Apr 21 00:42:31.327515 2026] [:error] [pid 11494:tid 11498] [client 20.100.178.47:65201] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/nastar.php"] [unique_id "aeZXd8gko5iFiE8YoyQkmQAAAYI"]
[Tue Apr 21 00:42:32.181662 2026] [:error] [pid 11350:tid 11372] [client 20.100.178.47:17570] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35_S.php"] [unique_id "aeZXeP4EoMBgOJuJnT0N0QAAAA0"]
[Tue Apr 21 00:42:33.959830 2026] [:error] [pid 11494:tid 11513] [client 20.100.178.47:16946] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35_S.php"] [unique_id "aeZXecgko5iFiE8YoyQkmgAAAZE"]
[Tue Apr 21 00:42:34.791465 2026] [:error] [pid 11441:tid 11444] [client 20.100.178.47:16896] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35_S.php"] [unique_id "aeZXesixByFUvmh319DQfAAAAME"]
[Tue Apr 21 00:42:37.146135 2026] [:error] [pid 42014:tid 42033] [client 20.100.178.47:16955] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35_S.php"] [unique_id "aeZXfcek-00-ZI0f1Nqi_AAAARE"]
[Tue Apr 21 00:42:38.253387 2026] [:error] [pid 11441:tid 11443] [client 20.100.178.47:20272] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "aeZXfsixByFUvmh319DQgQAAAMA"]
[Tue Apr 21 00:42:39.742789 2026] [:error] [pid 11494:tid 11515] [client 20.100.178.47:15875] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "aeZXf8gko5iFiE8YoyQkqgAAAZM"]
[Tue Apr 21 00:42:40.906566 2026] [:error] [pid 11494:tid 11518] [client 20.100.178.47:23366] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "aeZXgMgko5iFiE8YoyQksQAAAZY"]
[Tue Apr 21 00:42:42.534737 2026] [:error] [pid 6928:tid 6953] [client 20.100.178.47:2969] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "aeZXgh3y7MHq1iB0qYrdsgAAAVc"]
[Tue Apr 21 00:42:43.491081 2026] [:error] [pid 6928:tid 6944] [client 20.100.178.47:2982] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "aeZXgx3y7MHq1iB0qYrdtQAAAU4"]
[Tue Apr 21 00:42:44.335954 2026] [:error] [pid 11441:tid 11448] [client 20.100.178.47:16947] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "aeZXhMixByFUvmh319DQkgAAAMU"]
[Tue Apr 21 00:42:45.209248 2026] [:error] [pid 11351:tid 11404] [client 20.100.178.47:41753] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "aeZXhQN8Z1-vktaI_tN1HwAAAFE"]
[Tue Apr 21 00:42:46.529381 2026] [:error] [pid 11351:tid 11399] [client 20.100.178.47:15882] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "aeZXhgN8Z1-vktaI_tN1IAAAAEw"]
[Tue Apr 21 00:42:48.381132 2026] [:error] [pid 42014:tid 42029] [client 20.100.178.47:2813] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "aeZXiMek-00-ZI0f1NqjCQAAAQ0"]
[Tue Apr 21 00:42:50.105181 2026] [:error] [pid 11441:tid 11457] [client 20.100.178.47:17567] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "aeZXisixByFUvmh319DQoQAAAM4"]
[Tue Apr 21 00:42:51.261976 2026] [:error] [pid 11350:tid 11363] [client 20.100.178.47:18349] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "aeZXi_4EoMBgOJuJnT0N6QAAAAQ"]
[Tue Apr 21 00:42:52.385442 2026] [:error] [pid 42014:tid 42016] [client 20.100.178.47:61950] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "aeZXjMek-00-ZI0f1NqjEAAAAQA"]
[Tue Apr 21 00:42:55.617676 2026] [:error] [pid 6928:tid 6933] [client 20.100.178.47:49767] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "aeZXjx3y7MHq1iB0qYrdwAAAAUM"]
[Tue Apr 21 00:42:56.394766 2026] [:error] [pid 6928:tid 6930] [client 20.100.178.47:17583] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "aeZXkB3y7MHq1iB0qYrdwgAAAUA"]
[Tue Apr 21 00:42:57.103541 2026] [:error] [pid 11441:tid 11454] [client 20.100.178.47:49730] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "aeZXkcixByFUvmh319DQuAAAAMs"]
[Tue Apr 21 00:42:57.870319 2026] [:error] [pid 11494:tid 11497] [client 20.100.178.47:44118] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "aeZXkcgko5iFiE8YoyQk5QAAAYE"]
[Tue Apr 21 00:42:58.704207 2026] [:error] [pid 11351:tid 11409] [client 20.100.178.47:61935] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "aeZXkgN8Z1-vktaI_tN1kwAAAFY"]
[Tue Apr 21 00:42:59.400334 2026] [:error] [pid 6928:tid 6938] [client 20.100.178.47:3007] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "aeZXkx3y7MHq1iB0qYrdxQAAAUg"]
[Tue Apr 21 00:43:00.504473 2026] [:error] [pid 11351:tid 11396] [client 20.100.178.47:20237] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "aeZXlAN8Z1-vktaI_tN1twAAAEk"]
[Tue Apr 21 00:43:01.873648 2026] [:error] [pid 11351:tid 11394] [client 20.100.178.47:2802] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "aeZXlQN8Z1-vktaI_tN1xQAAAEc"]
[Tue Apr 21 00:43:03.314548 2026] [:error] [pid 11494:tid 11510] [client 20.100.178.47:23398] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwpg.php"] [unique_id "aeZXl8gko5iFiE8YoyQk7AAAAY4"]
[Tue Apr 21 00:43:04.632503 2026] [:error] [pid 11351:tid 11389] [client 20.100.178.47:22720] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwpg.php"] [unique_id "aeZXmAN8Z1-vktaI_tN17AAAAEI"]
[Tue Apr 21 00:43:05.627714 2026] [:error] [pid 11351:tid 11403] [client 20.100.178.47:17587] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwpg.php"] [unique_id "aeZXmQN8Z1-vktaI_tN19wAAAFA"]
[Tue Apr 21 00:43:06.280031 2026] [:error] [pid 11350:tid 11383] [client 20.100.178.47:41738] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwpg.php"] [unique_id "aeZXmv4EoMBgOJuJnT0OJwAAABg"]
[Tue Apr 21 00:43:08.050841 2026] [:error] [pid 11351:tid 11394] [client 20.100.178.47:19199] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ass.php"] [unique_id "aeZXnAN8Z1-vktaI_tN2AgAAAEc"]
[Tue Apr 21 00:43:08.869548 2026] [:error] [pid 11494:tid 11497] [client 20.100.178.47:17564] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ass.php"] [unique_id "aeZXnMgko5iFiE8YoyQk9AAAAYE"]
[Tue Apr 21 00:43:09.482630 2026] [:error] [pid 11350:tid 11361] [client 20.100.178.47:15501] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ass.php"] [unique_id "aeZXnf4EoMBgOJuJnT0OMQAAAAI"]
[Tue Apr 21 00:43:10.446859 2026] [:error] [pid 11350:tid 11366] [client 20.100.178.47:18353] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ass.php"] [unique_id "aeZXnv4EoMBgOJuJnT0ONAAAAAc"]
[Tue Apr 21 00:43:11.697765 2026] [:error] [pid 11351:tid 11401] [client 20.100.178.47:24991] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aeZXnwN8Z1-vktaI_tN2FAAAAE4"]
[Tue Apr 21 00:43:13.148128 2026] [:error] [pid 11441:tid 11467] [client 20.100.178.47:46054] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aeZXocixByFUvmh319DQ8gAAANg"]
[Tue Apr 21 00:43:15.155438 2026] [:error] [pid 11494:tid 11498] [client 20.100.178.47:63819] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aeZXo8gko5iFiE8YoyQk_AAAAYI"]
[Tue Apr 21 00:43:16.434507 2026] [:error] [pid 11494:tid 11503] [client 20.100.178.47:49212] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "aeZXpMgko5iFiE8YoyQk_wAAAYc"]
[Tue Apr 21 00:43:18.117904 2026] [:error] [pid 11350:tid 11360] [client 20.100.178.47:24984] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "aeZXpv4EoMBgOJuJnT0OTQAAAAE"]
[Tue Apr 21 00:43:19.213701 2026] [:error] [pid 6928:tid 6944] [client 20.100.178.47:2225] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "aeZXpx3y7MHq1iB0qYrd3wAAAU4"]
[Tue Apr 21 00:43:22.908981 2026] [:error] [pid 11494:tid 11511] [client 20.100.178.47:22285] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "aeZXqsgko5iFiE8YoyQlGwAAAY8"]
[Tue Apr 21 00:43:23.871731 2026] [:error] [pid 11352:tid 11433] [client 20.100.178.47:18807] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "aeZXq2l10mhMSfJ7ir_3SgAAAJM"]
[Tue Apr 21 00:43:25.131332 2026] [:error] [pid 11350:tid 11370] [client 20.100.178.47:17336] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fine.php"] [unique_id "aeZXrf4EoMBgOJuJnT0OawAAAAs"]
[Tue Apr 21 00:43:40.701548 2026] [:error] [pid 11352:tid 11429] [client 20.100.178.47:27332] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aeZXvGl10mhMSfJ7ir_3WwAAAI8"]
[Tue Apr 21 00:43:44.102980 2026] [:error] [pid 42014:tid 42018] [client 20.100.178.47:65124] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aeZXwMek-00-ZI0f1NqjNwAAAQI"]
[Tue Apr 21 00:43:47.618721 2026] [:error] [pid 6928:tid 6940] [client 20.100.178.47:20488] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aeZXwx3y7MHq1iB0qYreDQAAAUo"]
[Tue Apr 21 00:43:50.303620 2026] [:error] [pid 11351:tid 11399] [client 20.100.178.47:29950] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aeZXxgN8Z1-vktaI_tN2fQAAAEw"]
[Tue Apr 21 00:43:51.771146 2026] [:error] [pid 11352:tid 11435] [client 20.100.178.47:24677] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aeZXx2l10mhMSfJ7ir_3aAAAAJU"]
[Tue Apr 21 00:43:52.995536 2026] [:error] [pid 11350:tid 11360] [client 20.100.178.47:2865] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aeZXyP4EoMBgOJuJnT0OuQAAAAE"]
[Tue Apr 21 00:43:54.033938 2026] [:error] [pid 11352:tid 11427] [client 20.100.178.47:46671] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aeZXyml10mhMSfJ7ir_3bgAAAI0"]
[Tue Apr 21 00:43:55.025129 2026] [:error] [pid 42014:tid 42033] [client 20.100.178.47:65122] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aeZXy8ek-00-ZI0f1NqjVgAAARE"]
[Tue Apr 21 00:43:55.959939 2026] [:error] [pid 11351:tid 11397] [client 20.100.178.47:24703] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aeZXywN8Z1-vktaI_tN2kgAAAEo"]
[Tue Apr 21 00:43:57.177758 2026] [:error] [pid 11351:tid 11404] [client 20.100.178.47:2845] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aeZXzQN8Z1-vktaI_tN2nQAAAFE"]
[Tue Apr 21 00:43:58.066177 2026] [:error] [pid 11351:tid 11402] [client 20.100.178.47:65101] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aeZXzgN8Z1-vktaI_tN2pQAAAE8"]
[Tue Apr 21 00:43:59.919129 2026] [:error] [pid 11350:tid 11366] [client 20.100.178.47:63912] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aeZXz_4EoMBgOJuJnT0OxwAAAAc"]
[Tue Apr 21 00:44:00.781723 2026] [:error] [pid 11441:tid 11455] [client 20.100.178.47:20538] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aeZX0MixByFUvmh319DRBwAAAMw"]
[Tue Apr 21 00:44:02.108024 2026] [:error] [pid 11351:tid 11402] [client 20.100.178.47:19128] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aeZX0gN8Z1-vktaI_tN2sAAAAE8"]
[Tue Apr 21 00:44:04.085585 2026] [:error] [pid 11494:tid 11506] [client 20.100.178.47:46693] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aeZX1Mgko5iFiE8YoyQlUwAAAYo"]
[Tue Apr 21 00:44:06.219470 2026] [:error] [pid 11351:tid 11405] [client 20.100.178.47:21162] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aeZX1gN8Z1-vktaI_tN2uQAAAFI"]
[Tue Apr 21 00:44:07.196250 2026] [:error] [pid 11441:tid 11455] [client 20.100.178.47:24679] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aeZX18ixByFUvmh319DRGgAAAMw"]
[Tue Apr 21 00:44:08.588483 2026] [:error] [pid 42014:tid 42017] [client 20.100.178.47:21172] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aeZX2Mek-00-ZI0f1NqjYQAAAQE"]
[Tue Apr 21 00:44:10.419480 2026] [:error] [pid 11441:tid 11454] [client 20.100.178.47:26649] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aeZX2sixByFUvmh319DRIAAAAMs"]
[Tue Apr 21 00:44:11.803591 2026] [:error] [pid 11351:tid 11395] [client 20.100.178.47:24689] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aeZX2wN8Z1-vktaI_tN2yAAAAEg"]
[Tue Apr 21 00:44:13.058672 2026] [:error] [pid 11494:tid 11498] [client 20.100.178.47:65106] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "aeZX3cgko5iFiE8YoyQlfQAAAYI"]
[Tue Apr 21 00:44:14.018780 2026] [:error] [pid 11352:tid 11432] [client 20.100.178.47:63918] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "aeZX3ml10mhMSfJ7ir_3fgAAAJI"]
[Tue Apr 21 00:44:15.825481 2026] [:error] [pid 11351:tid 11388] [client 20.100.178.47:52384] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "aeZX3wN8Z1-vktaI_tN23AAAAEE"]
[Tue Apr 21 00:44:16.888711 2026] [:error] [pid 11350:tid 11373] [client 20.100.178.47:27279] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "aeZX4P4EoMBgOJuJnT0O7QAAAA4"]
[Tue Apr 21 00:44:17.870248 2026] [:error] [pid 11352:tid 11425] [client 20.100.178.47:2542] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aeZX4Wl10mhMSfJ7ir_3ggAAAIs"]
[Tue Apr 21 00:44:21.230016 2026] [:error] [pid 11351:tid 11390] [client 20.100.178.47:17323] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aeZX5QN8Z1-vktaI_tN28AAAAEM"]
[Tue Apr 21 00:44:23.195006 2026] [:error] [pid 11441:tid 11461] [client 20.100.178.47:53572] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aeZX58ixByFUvmh319DROwAAANI"]
[Tue Apr 21 00:44:27.887726 2026] [:error] [pid 11350:tid 11379] [client 20.100.178.47:24202] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aeZX6_4EoMBgOJuJnT0PXAAAABQ"]
[Tue Apr 21 00:44:30.327626 2026] [:error] [pid 11441:tid 11459] [client 20.100.178.47:3018] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aeZX7sixByFUvmh319DRUwAAANA"]
[Tue Apr 21 00:44:32.789512 2026] [:error] [pid 11494:tid 11511] [client 20.100.178.47:54195] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aeZX8Mgko5iFiE8YoyQlogAAAY8"]
[Tue Apr 21 00:44:33.965425 2026] [:error] [pid 11441:tid 11446] [client 20.100.178.47:22290] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aeZX8cixByFUvmh319DRWQAAAMM"]
[Tue Apr 21 00:44:35.517339 2026] [:error] [pid 11350:tid 11379] [client 20.100.178.47:65481] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aeZX8_4EoMBgOJuJnT0PgQAAABQ"]
[Tue Apr 21 00:44:53.052048 2026] [:error] [pid 11350:tid 11379] [client 20.100.178.47:48520] [client 20.100.178.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aeZYBf4EoMBgOJuJnT0PugAAABQ"]
[Tue Apr 21 00:44:57.250800 2026] [:error] [pid 11350:tid 11381] [client 20.100.178.47:35245] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aeZYCf4EoMBgOJuJnT0PyAAAABY"]
[Tue Apr 21 00:44:58.194453 2026] [:error] [pid 11441:tid 11444] [client 20.100.178.47:30512] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aeZYCsixByFUvmh319DRaQAAAME"]
[Tue Apr 21 00:44:59.094650 2026] [:error] [pid 11494:tid 11514] [client 20.100.178.47:18056] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aeZYC8gko5iFiE8YoyQl1wAAAZI"]
[Tue Apr 21 00:44:59.941085 2026] [:error] [pid 11350:tid 11368] [client 20.100.178.47:35250] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aeZYC_4EoMBgOJuJnT0PzQAAAAk"]
[Tue Apr 21 00:45:02.385484 2026] [:error] [pid 11350:tid 11369] [client 20.100.178.47:20742] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "aeZYDv4EoMBgOJuJnT0P1AAAAAo"]
[Tue Apr 21 00:45:03.126877 2026] [:error] [pid 6928:tid 6950] [client 20.100.178.47:2436] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "aeZYDx3y7MHq1iB0qYreawAAAVQ"]
[Tue Apr 21 00:45:05.371370 2026] [:error] [pid 11351:tid 11408] [client 20.100.178.47:22713] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "aeZYEQN8Z1-vktaI_tN3iwAAAFU"]
[Tue Apr 21 00:45:07.493360 2026] [:error] [pid 11494:tid 11504] [client 20.100.178.47:22708] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "aeZYE8gko5iFiE8YoyQl6gAAAYg"]
[Tue Apr 21 00:45:09.956093 2026] [:error] [pid 11351:tid 11411] [client 20.100.178.47:34689] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aeZYFQN8Z1-vktaI_tN3owAAAFg"]
[Tue Apr 21 00:45:11.317598 2026] [:error] [pid 6928:tid 6945] [client 20.100.178.47:38377] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aeZYFx3y7MHq1iB0qYrecgAAAU8"]
[Tue Apr 21 00:45:12.232767 2026] [:error] [pid 6928:tid 6946] [client 20.100.178.47:34744] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aeZYGB3y7MHq1iB0qYredAAAAVA"]
[Tue Apr 21 00:45:13.517105 2026] [:error] [pid 6928:tid 6948] [client 20.100.178.47:2470] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aeZYGR3y7MHq1iB0qYreegAAAVI"]
[Tue Apr 21 00:45:14.382724 2026] [:error] [pid 42014:tid 42037] [client 20.100.178.47:38338] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aeZYGsek-00-ZI0f1NqjoAAAARU"]
[Tue Apr 21 00:45:15.847863 2026] [:error] [pid 11350:tid 11376] [client 20.100.178.47:34708] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aeZYG_4EoMBgOJuJnT0P6wAAABE"]
[Tue Apr 21 00:45:17.053818 2026] [:error] [pid 42014:tid 42036] [client 20.100.178.47:30561] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aeZYHcek-00-ZI0f1NqjpAAAARQ"]
[Tue Apr 21 00:45:18.385485 2026] [:error] [pid 11494:tid 11505] [client 20.100.178.47:48028] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aeZYHsgko5iFiE8YoyQl_QAAAYk"]
[Tue Apr 21 00:45:19.207387 2026] [:error] [pid 11352:tid 11418] [client 20.100.178.47:40680] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aeZYH2l10mhMSfJ7ir_3vQAAAIQ"]
[Tue Apr 21 00:45:21.156142 2026] [:error] [pid 6928:tid 6930] [client 20.100.178.47:29296] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aeZYIR3y7MHq1iB0qYreiQAAAUA"]
[Tue Apr 21 00:45:21.874461 2026] [:error] [pid 11352:tid 11434] [client 20.100.178.47:16301] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aeZYIWl10mhMSfJ7ir_3wQAAAJQ"]
[Tue Apr 21 00:45:22.480881 2026] [:error] [pid 11351:tid 11404] [client 20.100.178.47:30490] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aeZYIgN8Z1-vktaI_tN3wQAAAFE"]
[Tue Apr 21 00:45:23.170398 2026] [:error] [pid 11351:tid 11396] [client 20.100.178.47:34740] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aeZYIwN8Z1-vktaI_tN3xQAAAEk"]
[Tue Apr 21 00:45:24.065896 2026] [:error] [pid 11351:tid 11411] [client 20.100.178.47:2479] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aeZYJAN8Z1-vktaI_tN3yQAAAFg"]
[Tue Apr 21 00:45:25.120495 2026] [:error] [pid 11441:tid 11467] [client 20.100.178.47:38372] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aeZYJcixByFUvmh319DRjQAAANg"]
[Tue Apr 21 00:45:26.650502 2026] [:error] [pid 11494:tid 11518] [client 20.100.178.47:29843] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "aeZYJsgko5iFiE8YoyQmDwAAAZY"]
[Tue Apr 21 00:45:27.506991 2026] [:error] [pid 11494:tid 11516] [client 20.100.178.47:40642] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aeZYJ8gko5iFiE8YoyQmEgAAAZQ"]
[Tue Apr 21 00:45:28.246842 2026] [:error] [pid 11350:tid 11382] [client 20.100.178.47:30521] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aeZYKP4EoMBgOJuJnT0P9wAAABc"]
[Tue Apr 21 00:45:29.423264 2026] [:error] [pid 11441:tid 11455] [client 20.100.178.47:39616] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aeZYKcixByFUvmh319DRlQAAAMw"]
[Tue Apr 21 00:45:30.443133 2026] [:error] [pid 11352:tid 11431] [client 20.100.178.47:29867] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aeZYKml10mhMSfJ7ir_31gAAAJE"]
[Tue Apr 21 00:45:31.536183 2026] [:error] [pid 11352:tid 11423] [client 20.100.178.47:34728] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aeZYK2l10mhMSfJ7ir_32QAAAIk"]
[Tue Apr 21 00:45:32.558394 2026] [:error] [pid 11352:tid 11426] [client 20.100.178.47:48063] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aeZYLGl10mhMSfJ7ir_34QAAAIw"]
[Tue Apr 21 00:45:34.265700 2026] [:error] [pid 6928:tid 6941] [client 20.100.178.47:34717] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aeZYLh3y7MHq1iB0qYreqQAAAUs"]
[Tue Apr 21 00:45:36.883905 2026] [:error] [pid 11351:tid 11391] [client 20.100.178.47:16291] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "aeZYMAN8Z1-vktaI_tN4BQAAAEQ"]
[Tue Apr 21 00:45:38.358177 2026] [:error] [pid 11351:tid 11402] [client 20.100.178.47:16318] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "aeZYMgN8Z1-vktaI_tN4DgAAAE8"]
[Tue Apr 21 00:45:39.229660 2026] [:error] [pid 11494:tid 11498] [client 20.100.178.47:61977] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "aeZYM8gko5iFiE8YoyQmIwAAAYI"]
[Tue Apr 21 00:45:41.468420 2026] [:error] [pid 11441:tid 11465] [client 20.100.178.47:46092] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "aeZYNcixByFUvmh319DRpQAAANY"]
[Tue Apr 21 00:45:43.135940 2026] [:error] [pid 11441:tid 11454] [client 20.100.178.47:40072] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "aeZYN8ixByFUvmh319DRrQAAAMs"]
[Tue Apr 21 00:45:44.056242 2026] [:error] [pid 11494:tid 11499] [client 20.100.178.47:46143] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "aeZYOMgko5iFiE8YoyQmMwAAAYM"]
[Tue Apr 21 00:45:44.990957 2026] [:error] [pid 11494:tid 11519] [client 20.100.178.47:28592] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "aeZYOMgko5iFiE8YoyQmNgAAAZc"]
[Tue Apr 21 00:45:48.656502 2026] [:error] [pid 11352:tid 11417] [client 20.100.178.47:40069] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "aeZYPGl10mhMSfJ7ir_37QAAAIM"]
[Tue Apr 21 00:45:50.245411 2026] [:error] [pid 11494:tid 11511] [client 20.100.178.47:31840] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "aeZYPsgko5iFiE8YoyQmQgAAAY8"]
[Tue Apr 21 00:45:51.793734 2026] [:error] [pid 11350:tid 11375] [client 20.100.178.47:33065] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aeZYP_4EoMBgOJuJnT0QIwAAABA"]
[Tue Apr 21 00:45:53.337781 2026] [:error] [pid 11441:tid 11464] [client 20.100.178.47:2690] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aeZYQcixByFUvmh319DRxgAAANU"]
[Tue Apr 21 00:45:54.365965 2026] [:error] [pid 11494:tid 11503] [client 20.100.178.47:63206] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aeZYQsgko5iFiE8YoyQmRAAAAYc"]
[Tue Apr 21 00:46:02.483945 2026] [autoindex:error] [pid 11441:tid 11447] [client 20.100.178.47:59089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:46:03.567350 2026] [autoindex:error] [pid 11441:tid 11443] [client 20.100.178.47:59089] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:46:03.831199 2026] [autoindex:error] [pid 11441:tid 11456] [client 20.100.178.47:59089] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:46:09.180042 2026] [:error] [pid 11441:tid 11462] [client 20.100.178.47:59089] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aeZYUcixByFUvmh319DR8QAAANM"]
[Tue Apr 21 00:46:10.985796 2026] [:error] [pid 11494:tid 11503] [client 20.100.178.47:49810] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aeZYUsgko5iFiE8YoyQmTgAAAYc"]
[Tue Apr 21 00:46:12.232135 2026] [:error] [pid 11441:tid 11449] [client 20.100.178.47:38939] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aeZYVMixByFUvmh319DR-gAAAMY"]
[Tue Apr 21 00:46:14.841044 2026] [:error] [pid 11352:tid 11429] [client 20.100.178.47:38941] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aeZYVml10mhMSfJ7ir_4DAAAAI8"]
[Tue Apr 21 00:46:17.122331 2026] [:error] [pid 11441:tid 11467] [client 20.100.178.47:44810] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "aeZYWcixByFUvmh319DSBQAAANg"]
[Tue Apr 21 00:46:18.146016 2026] [:error] [pid 11351:tid 11389] [client 20.100.178.47:50342] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "aeZYWgN8Z1-vktaI_tN4aQAAAEI"]
[Tue Apr 21 00:46:18.947246 2026] [:error] [pid 11351:tid 11410] [client 20.100.178.47:50312] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "aeZYWgN8Z1-vktaI_tN4agAAAFc"]
[Tue Apr 21 00:46:20.868387 2026] [:error] [pid 11351:tid 11405] [client 20.100.178.47:33966] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "aeZYXAN8Z1-vktaI_tN4dQAAAFI"]
[Tue Apr 21 00:46:22.282318 2026] [:error] [pid 11350:tid 11375] [client 20.100.178.47:26701] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aeZYXv4EoMBgOJuJnT0QOgAAABA"]
[Tue Apr 21 00:46:23.896253 2026] [:error] [pid 11351:tid 11399] [client 20.100.178.47:26013] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aeZYXwN8Z1-vktaI_tN4gQAAAEw"]
[Tue Apr 21 00:46:24.939489 2026] [:error] [pid 42014:tid 42019] [client 20.100.178.47:26035] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aeZYYMek-00-ZI0f1NqjxwAAAQM"]
[Tue Apr 21 00:46:25.823675 2026] [:error] [pid 11351:tid 11408] [client 20.100.178.47:25463] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aeZYYQN8Z1-vktaI_tN4jgAAAFU"]
[Tue Apr 21 00:46:26.669838 2026] [:error] [pid 11494:tid 11520] [client 20.100.178.47:26742] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "aeZYYsgko5iFiE8YoyQmVQAAAZg"]
[Tue Apr 21 00:46:27.744815 2026] [:error] [pid 11351:tid 11393] [client 20.100.178.47:25350] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "aeZYYwN8Z1-vktaI_tN4mgAAAEY"]
[Tue Apr 21 00:46:28.360460 2026] [:error] [pid 11441:tid 11462] [client 20.100.178.47:25434] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "aeZYZMixByFUvmh319DSFQAAANM"]
[Tue Apr 21 00:46:29.270047 2026] [:error] [pid 11494:tid 11496] [client 20.100.178.47:41823] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "aeZYZcgko5iFiE8YoyQmXgAAAYA"]
[Tue Apr 21 00:46:30.356250 2026] [:error] [pid 11351:tid 11392] [client 20.100.178.47:41845] [client 20.100.178.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeZYZgN8Z1-vktaI_tN4nwAAAEU"]
[Tue Apr 21 00:46:31.453173 2026] [:error] [pid 6928:tid 6944] [client 20.100.178.47:41831] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aeZYZx3y7MHq1iB0qYre2wAAAU4"]
[Tue Apr 21 00:46:32.274314 2026] [:error] [pid 11351:tid 11387] [client 20.100.178.47:31757] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aeZYaAN8Z1-vktaI_tN4rQAAAEA"]
[Tue Apr 21 00:46:33.029671 2026] [:error] [pid 11351:tid 11393] [client 20.100.178.47:23167] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aeZYaQN8Z1-vktaI_tN4swAAAEY"]
[Tue Apr 21 00:46:34.155208 2026] [:error] [pid 42014:tid 42033] [client 20.100.178.47:15574] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aeZYasek-00-ZI0f1NqjywAAARE"]
[Tue Apr 21 00:46:35.089176 2026] [:error] [pid 11350:tid 11378] [client 20.100.178.47:33554] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aeZYa_4EoMBgOJuJnT0QQQAAABM"]
[Tue Apr 21 00:46:36.701988 2026] [:error] [pid 11351:tid 11402] [client 20.100.178.47:60474] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aeZYbAN8Z1-vktaI_tN4vgAAAE8"]
[Tue Apr 21 00:46:37.735447 2026] [:error] [pid 11350:tid 11374] [client 20.100.178.47:23141] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aeZYbf4EoMBgOJuJnT0QTgAAAA8"]
[Tue Apr 21 00:46:38.940529 2026] [:error] [pid 11494:tid 11518] [client 20.100.178.47:54087] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "aeZYbsgko5iFiE8YoyQmaAAAAZY"]
[Tue Apr 21 00:46:39.915688 2026] [:error] [pid 11351:tid 11410] [client 20.100.178.47:26039] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "aeZYbwN8Z1-vktaI_tN4wQAAAFc"]
[Tue Apr 21 00:46:41.436212 2026] [:error] [pid 11350:tid 11361] [client 20.100.178.47:33594] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "aeZYcf4EoMBgOJuJnT0QWQAAAAI"]
[Tue Apr 21 00:46:42.586569 2026] [:error] [pid 42014:tid 42028] [client 20.100.178.47:26047] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "aeZYcsek-00-ZI0f1NqjzwAAAQw"]
[Tue Apr 21 00:46:44.110350 2026] [:error] [pid 6928:tid 6949] [client 20.100.178.47:2068] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aeZYdB3y7MHq1iB0qYre8AAAAVM"]
[Tue Apr 21 00:46:45.070565 2026] [:error] [pid 6928:tid 6953] [client 20.100.178.47:29843] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aeZYdR3y7MHq1iB0qYre9QAAAVc"]
[Tue Apr 21 00:46:47.404056 2026] [:error] [pid 11351:tid 11395] [client 20.100.178.47:31789] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aeZYdwN8Z1-vktaI_tN40gAAAEg"]
[Tue Apr 21 00:46:48.204121 2026] [:error] [pid 11351:tid 11396] [client 20.100.178.47:37027] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aeZYeAN8Z1-vktaI_tN41QAAAEk"]
[Tue Apr 21 00:46:48.918864 2026] [:error] [pid 11494:tid 11510] [client 20.100.178.47:50307] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev.php"] [unique_id "aeZYeMgko5iFiE8YoyQmhAAAAY4"]
[Tue Apr 21 00:46:49.514122 2026] [:error] [pid 11351:tid 11392] [client 20.100.178.47:50318] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev.php"] [unique_id "aeZYeQN8Z1-vktaI_tN41wAAAEU"]
[Tue Apr 21 00:46:50.173139 2026] [:error] [pid 11351:tid 11404] [client 20.100.178.47:28623] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev.php"] [unique_id "aeZYegN8Z1-vktaI_tN43QAAAFE"]
[Tue Apr 21 00:46:50.772181 2026] [:error] [pid 6928:tid 6932] [client 20.100.178.47:23108] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev.php"] [unique_id "aeZYeh3y7MHq1iB0qYre_gAAAUI"]
[Tue Apr 21 00:46:51.797881 2026] [:error] [pid 11350:tid 11378] [client 20.100.178.47:19537] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "aeZYe_4EoMBgOJuJnT0QdwAAABM"]
[Tue Apr 21 00:46:52.521956 2026] [:error] [pid 11441:tid 11444] [client 20.100.178.47:2048] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "aeZYfMixByFUvmh319DSGwAAAME"]
[Tue Apr 21 00:46:53.738840 2026] [:error] [pid 6928:tid 6931] [client 20.100.178.47:2099] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "aeZYfR3y7MHq1iB0qYrfAAAAAUE"]
[Tue Apr 21 00:46:54.512085 2026] [:error] [pid 42014:tid 42035] [client 20.100.178.47:60450] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "aeZYfsek-00-ZI0f1Nqj5gAAARM"]
[Tue Apr 21 00:46:55.433577 2026] [:error] [pid 6928:tid 6937] [client 20.100.178.47:60441] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "aeZYfx3y7MHq1iB0qYrfBQAAAUc"]
[Tue Apr 21 00:46:56.145138 2026] [:error] [pid 11441:tid 11446] [client 20.100.178.47:33596] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "aeZYgMixByFUvmh319DSIgAAAMM"]
[Tue Apr 21 00:46:56.976180 2026] [:error] [pid 11351:tid 11390] [client 20.100.178.47:29204] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "aeZYgAN8Z1-vktaI_tN4-AAAAEM"]
[Tue Apr 21 00:46:58.182795 2026] [:error] [pid 11351:tid 11409] [client 20.100.178.47:33611] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "aeZYggN8Z1-vktaI_tN5BQAAAFY"]
[Tue Apr 21 00:46:58.907840 2026] [:error] [pid 11494:tid 11498] [client 20.100.178.47:2105] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "aeZYgsgko5iFiE8YoyQmmQAAAYI"]
[Tue Apr 21 00:46:59.845345 2026] [:error] [pid 6928:tid 6934] [client 20.100.178.47:54129] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "aeZYgx3y7MHq1iB0qYrfFAAAAUQ"]
[Tue Apr 21 00:47:00.959673 2026] [:error] [pid 6928:tid 6950] [client 20.100.178.47:17826] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "aeZYhB3y7MHq1iB0qYrfGQAAAVQ"]
[Tue Apr 21 00:47:01.727904 2026] [:error] [pid 11441:tid 11455] [client 20.100.178.47:17814] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "aeZYhcixByFUvmh319DSKQAAAMw"]
[Tue Apr 21 00:47:02.422252 2026] [:error] [pid 11351:tid 11396] [client 20.100.178.47:33625] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/admin.php"] [unique_id "aeZYhgN8Z1-vktaI_tN5GAAAAEk"]
[Tue Apr 21 00:47:03.105342 2026] [:error] [pid 11351:tid 11390] [client 20.100.178.47:17855] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/admin.php"] [unique_id "aeZYhwN8Z1-vktaI_tN5HQAAAEM"]
[Tue Apr 21 00:47:04.203651 2026] [:error] [pid 11351:tid 11399] [client 20.100.178.47:29224] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/admin.php"] [unique_id "aeZYiAN8Z1-vktaI_tN5IAAAAEw"]
[Tue Apr 21 00:47:04.980024 2026] [:error] [pid 11350:tid 11373] [client 20.100.178.47:33655] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/admin.php"] [unique_id "aeZYiP4EoMBgOJuJnT0QfgAAAA4"]
[Tue Apr 21 00:47:07.497995 2026] [:error] [pid 42014:tid 42022] [client 20.100.178.47:17821] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aeZYi8ek-00-ZI0f1NqkAgAAAQY"]
[Tue Apr 21 00:47:22.860198 2026] [:error] [pid 11351:tid 11408] [client 20.100.178.47:23043] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hypo.php"] [unique_id "aeZYmgN8Z1-vktaI_tN5awAAAFU"]
[Tue Apr 21 00:47:23.870867 2026] [:error] [pid 11494:tid 11502] [client 20.100.178.47:17833] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hypo.php"] [unique_id "aeZYm8gko5iFiE8YoyQmyAAAAYY"]
[Tue Apr 21 00:47:24.600644 2026] [:error] [pid 11351:tid 11398] [client 20.100.178.47:53646] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hypo.php"] [unique_id "aeZYnAN8Z1-vktaI_tN5cQAAAEs"]
[Tue Apr 21 00:47:25.796127 2026] [:error] [pid 11494:tid 11497] [client 20.100.178.47:50268] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hypo.php"] [unique_id "aeZYncgko5iFiE8YoyQmywAAAYE"]
[Tue Apr 21 00:47:26.588290 2026] [:error] [pid 11494:tid 11519] [client 20.100.178.47:45477] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "aeZYnsgko5iFiE8YoyQm1AAAAZc"]
[Tue Apr 21 00:47:27.263057 2026] [:error] [pid 6928:tid 6942] [client 20.100.178.47:51546] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "aeZYnx3y7MHq1iB0qYrfNAAAAUw"]
[Tue Apr 21 00:47:28.215117 2026] [:error] [pid 11494:tid 11501] [client 20.100.178.47:28610] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "aeZYoMgko5iFiE8YoyQm3wAAAYU"]
[Tue Apr 21 00:47:29.031931 2026] [:error] [pid 11350:tid 11373] [client 20.100.178.47:23041] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file18.php"] [unique_id "aeZYof4EoMBgOJuJnT0QnwAAAA4"]
[Tue Apr 21 00:47:30.058464 2026] [:error] [pid 11441:tid 11465] [client 20.100.178.47:33661] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "aeZYosixByFUvmh319DSSwAAANY"]
[Tue Apr 21 00:47:30.681006 2026] [:error] [pid 11351:tid 11389] [client 20.100.178.47:23074] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "aeZYogN8Z1-vktaI_tN5fwAAAEI"]
[Tue Apr 21 00:47:31.469129 2026] [:error] [pid 11494:tid 11497] [client 20.100.178.47:59176] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "aeZYo8gko5iFiE8YoyQm8gAAAYE"]
[Tue Apr 21 00:47:32.859080 2026] [:error] [pid 11352:tid 11423] [client 20.100.178.47:17803] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "aeZYpGl10mhMSfJ7ir_4OgAAAIk"]
[Tue Apr 21 00:47:33.675817 2026] [:error] [pid 11352:tid 11434] [client 20.100.178.47:45445] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aeZYpWl10mhMSfJ7ir_4PAAAAJQ"]
[Tue Apr 21 00:47:34.365762 2026] [:error] [pid 11494:tid 11515] [client 20.100.178.47:17823] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aeZYpsgko5iFiE8YoyQm-gAAAZM"]
[Tue Apr 21 00:47:35.151244 2026] [:error] [pid 6928:tid 6930] [client 20.100.178.47:51552] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aeZYpx3y7MHq1iB0qYrfOgAAAUA"]
[Tue Apr 21 00:47:35.984228 2026] [:error] [pid 6928:tid 6952] [client 20.100.178.47:53688] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "aeZYpx3y7MHq1iB0qYrfPQAAAVY"]
[Tue Apr 21 00:47:37.598435 2026] [:error] [pid 11350:tid 11361] [client 20.100.178.47:51051] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aeZYqf4EoMBgOJuJnT0QsgAAAAI"]
[Tue Apr 21 00:47:38.730558 2026] [:error] [pid 11351:tid 11388] [client 20.100.178.47:53640] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aeZYqgN8Z1-vktaI_tN5iQAAAEE"]
[Tue Apr 21 00:47:39.382313 2026] [:error] [pid 11441:tid 11457] [client 20.100.178.47:17836] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aeZYq8ixByFUvmh319DSVwAAAM4"]
[Tue Apr 21 00:47:40.157661 2026] [:error] [pid 11441:tid 11453] [client 20.100.178.47:21600] [client 20.100.178.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aeZYrMixByFUvmh319DSWgAAAMo"]
[Tue Apr 21 00:52:14.146250 2026] [:error] [pid 11351:tid 11390] [client 98.159.37.83:29171] [client 98.159.37.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aeZZvgN8Z1-vktaI_tN8wAAAAEM"]
[Tue Apr 21 00:52:25.881467 2026] [autoindex:error] [pid 11352:tid 11417] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:27.876124 2026] [autoindex:error] [pid 11352:tid 11433] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:33.203777 2026] [autoindex:error] [pid 11352:tid 11423] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:34.132734 2026] [autoindex:error] [pid 11352:tid 11416] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:38.114737 2026] [autoindex:error] [pid 11352:tid 11433] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:41.365304 2026] [autoindex:error] [pid 11352:tid 11428] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:42.623711 2026] [autoindex:error] [pid 11352:tid 11432] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:42.820953 2026] [autoindex:error] [pid 11352:tid 11421] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:43.017106 2026] [autoindex:error] [pid 11352:tid 11438] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:43.984515 2026] [autoindex:error] [pid 11352:tid 11437] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:44.164954 2026] [autoindex:error] [pid 11352:tid 11435] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:44.400746 2026] [autoindex:error] [pid 11352:tid 11422] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:45.361114 2026] [autoindex:error] [pid 11352:tid 11423] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:45.529592 2026] [autoindex:error] [pid 11352:tid 11430] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:45.736163 2026] [autoindex:error] [pid 11352:tid 11416] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:48.292590 2026] [autoindex:error] [pid 11352:tid 11417] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:48.464876 2026] [autoindex:error] [pid 11352:tid 11415] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:48.634191 2026] [autoindex:error] [pid 11352:tid 11426] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:48.800804 2026] [autoindex:error] [pid 11352:tid 11431] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:48.965043 2026] [autoindex:error] [pid 11352:tid 11419] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:49.193024 2026] [autoindex:error] [pid 11352:tid 11432] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:50.267447 2026] [autoindex:error] [pid 11352:tid 11438] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:50.484442 2026] [autoindex:error] [pid 11352:tid 11436] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:52.997224 2026] [autoindex:error] [pid 11352:tid 11422] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:55.018175 2026] [autoindex:error] [pid 11352:tid 11430] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:55.198996 2026] [autoindex:error] [pid 11352:tid 11416] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:55.369647 2026] [autoindex:error] [pid 11352:tid 11418] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:57.884771 2026] [autoindex:error] [pid 11352:tid 11434] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:52:58.218780 2026] [autoindex:error] [pid 11352:tid 11417] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:01.137713 2026] [autoindex:error] [pid 11352:tid 11431] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:02.343034 2026] [autoindex:error] [pid 11352:tid 11421] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:03.386713 2026] [autoindex:error] [pid 11352:tid 11436] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:03.678595 2026] [autoindex:error] [pid 11352:tid 11424] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentythree/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:03.953238 2026] [autoindex:error] [pid 11352:tid 11435] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:04.158598 2026] [autoindex:error] [pid 11352:tid 11422] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:04.379746 2026] [autoindex:error] [pid 11352:tid 11425] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:06.216495 2026] [autoindex:error] [pid 11352:tid 11429] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:08.075773 2026] [autoindex:error] [pid 11352:tid 11415] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:08.238815 2026] [autoindex:error] [pid 11352:tid 11426] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:11.005495 2026] [autoindex:error] [pid 11352:tid 11437] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:11.905901 2026] [autoindex:error] [pid 11352:tid 11417] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:13.603875 2026] [autoindex:error] [pid 11352:tid 11420] [client 216.24.210.153:28599] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:15.223222 2026] [autoindex:error] [pid 11352:tid 11431] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:15.501816 2026] [autoindex:error] [pid 11352:tid 11432] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:15.724166 2026] [autoindex:error] [pid 11352:tid 11418] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:15.891648 2026] [autoindex:error] [pid 11352:tid 11419] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:16.135932 2026] [autoindex:error] [pid 11352:tid 11438] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:16.449601 2026] [autoindex:error] [pid 11352:tid 11428] [client 216.24.210.153:28599] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentytwo/assets/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:21.299595 2026] [autoindex:error] [pid 11352:tid 11429] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:21.461080 2026] [autoindex:error] [pid 11352:tid 11430] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:21.678383 2026] [autoindex:error] [pid 11352:tid 11414] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:21.946847 2026] [autoindex:error] [pid 11352:tid 11427] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:22.109939 2026] [autoindex:error] [pid 11352:tid 11434] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/calendar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:23.503647 2026] [autoindex:error] [pid 11352:tid 11420] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:26.078970 2026] [autoindex:error] [pid 11352:tid 11419] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/05/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:27.668606 2026] [autoindex:error] [pid 11352:tid 11436] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:27.949540 2026] [autoindex:error] [pid 11352:tid 11435] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:28.123024 2026] [autoindex:error] [pid 11352:tid 11422] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:28.313336 2026] [autoindex:error] [pid 11352:tid 11425] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:28.493443 2026] [autoindex:error] [pid 11352:tid 11421] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:33.189977 2026] [autoindex:error] [pid 11352:tid 11432] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:36.548685 2026] [autoindex:error] [pid 11352:tid 11424] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:36.763605 2026] [autoindex:error] [pid 11352:tid 11437] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:38.022129 2026] [autoindex:error] [pid 11352:tid 11417] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:42.968147 2026] [autoindex:error] [pid 11352:tid 11418] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:43.185973 2026] [autoindex:error] [pid 11352:tid 11436] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:43.512112 2026] [autoindex:error] [pid 11352:tid 11435] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:43.676824 2026] [autoindex:error] [pid 11352:tid 11422] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:47.654191 2026] [autoindex:error] [pid 11352:tid 11437] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:50.888963 2026] [autoindex:error] [pid 11352:tid 11415] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:54.761791 2026] [autoindex:error] [pid 11352:tid 11419] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:53:59.374152 2026] [autoindex:error] [pid 11352:tid 11416] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:01.461902 2026] [autoindex:error] [pid 11352:tid 11434] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:01.648327 2026] [autoindex:error] [pid 11352:tid 11431] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:03.609432 2026] [autoindex:error] [pid 11352:tid 11428] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:05.112425 2026] [autoindex:error] [pid 11352:tid 11423] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:05.274373 2026] [autoindex:error] [pid 11352:tid 11425] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/classic-editor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:17.312655 2026] [autoindex:error] [pid 11352:tid 11421] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:19.012740 2026] [autoindex:error] [pid 11352:tid 11424] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/ui/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:20.733350 2026] [autoindex:error] [pid 11352:tid 11420] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:23.845127 2026] [autoindex:error] [pid 11352:tid 11415] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:24.957581 2026] [autoindex:error] [pid 11352:tid 11427] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:25.224654 2026] [autoindex:error] [pid 11352:tid 11431] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:26.250100 2026] [autoindex:error] [pid 11352:tid 11433] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:26.418035 2026] [autoindex:error] [pid 11352:tid 11426] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:26.692353 2026] [autoindex:error] [pid 11352:tid 11437] [client 216.24.210.161:26251] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:30.866450 2026] [autoindex:error] [pid 11494:tid 11512] [client 98.159.37.88:32225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/pullquote/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:32.962617 2026] [autoindex:error] [pid 11494:tid 11515] [client 98.159.37.88:32225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/comments-pagination-numbers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:39.642802 2026] [autoindex:error] [pid 11494:tid 11497] [client 98.159.37.88:32225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:39.827111 2026] [autoindex:error] [pid 11494:tid 11499] [client 98.159.37.88:32225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/post-terms/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:40.853040 2026] [autoindex:error] [pid 11494:tid 11513] [client 98.159.37.88:32225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:41.935144 2026] [autoindex:error] [pid 11494:tid 11511] [client 98.159.37.88:32225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/namespaced/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:44.797594 2026] [autoindex:error] [pid 11494:tid 11507] [client 98.159.37.88:32225] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:48.392464 2026] [autoindex:error] [pid 11494:tid 11504] [client 98.159.37.88:32225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/site-title/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:52.544645 2026] [autoindex:error] [pid 11494:tid 11498] [client 98.159.37.88:32225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:55.511727 2026] [autoindex:error] [pid 11494:tid 11505] [client 98.159.37.88:32225] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 00:54:55.787744 2026] [autoindex:error] [pid 11494:tid 11515] [client 98.159.37.88:32225] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2026/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 01:35:52.233869 2026] [:error] [pid 11494:tid 11509] [client 45.233.148.131:38022] [client 45.233.148.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.233.148.131, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeZj-Mgko5iFiE8YoyQ6GgAAAY0"]
[Tue Apr 21 01:38:35.365608 2026] [:error] [pid 11494:tid 11497] [client 101.42.46.71:51392] [client 101.42.46.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aeZkm8gko5iFiE8YoyQ7KAAAAYE"]
[Tue Apr 21 02:15:59.223364 2026] [:error] [pid 11494:tid 11500] [client 137.184.230.10:56382] [client 137.184.230.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.230.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeZtX8gko5iFiE8YoyRKYQAAAYQ"]
[Tue Apr 21 04:00:30.061251 2026] [:error] [pid 4777:tid 4810] [client 185.194.178.23:52869] [client 185.194.178.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeaF3qxXur6bykKyLZT9nAAAARY"]
[Tue Apr 21 05:11:05.320657 2026] [:error] [pid 4823:tid 4856] [client 43.135.145.117:46774] [client 43.135.145.117] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeaWafc8mke3PfHqsxF8mQAAAYM"]
[Tue Apr 21 05:58:34.172898 2026] [:error] [pid 5377:tid 5400] [client 146.190.84.203:35458] [client 146.190.84.203] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.190.84.203, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeahirBKychFlrHBdvsRgQAAAc4"]
[Tue Apr 21 07:45:06.878152 2026] [:error] [pid 4823:tid 4859] [client 49.7.227.204:57410] [client 49.7.227.204] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aea6gvc8mke3PfHqsxG66gAAAYY"]
[Tue Apr 21 09:18:14.965786 2026] [:error] [pid 4823:tid 4857] [client 43.157.38.131:52954] [client 43.157.38.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aebQVvc8mke3PfHqsxHvbAAAAYQ"]
[Tue Apr 21 09:33:45.222505 2026] [:error] [pid 4822:tid 4828] [client 184.178.172.13:39003] [client 184.178.172.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.178.172.13, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aebT-SAteFQFwS_23JnPhQAAAUI"], referer: https://expressinteriors.com/
[Tue Apr 21 10:08:25.798400 2026] [:error] [pid 35415:tid 35438] [client 128.199.223.38:57256] [client 128.199.223.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 128.199.223.38, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aebcGUiqDinI4_22zzgYNgAAAMs"]
[Tue Apr 21 11:15:29.495548 2026] [:error] [pid 4822:tid 4834] [client 51.159.214.31:40014] [client 51.159.214.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.159.214.31, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aebr0SAteFQFwS_23Jn7UwAAAUg"]
[Tue Apr 21 11:20:09.797086 2026] [:error] [pid 4822:tid 4844] [client 185.194.178.50:62437] [client 185.194.178.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.50, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aebs6SAteFQFwS_23Jn9AwAAAVI"]
[Tue Apr 21 11:51:59.760709 2026] [:error] [pid 4822:tid 4834] [client 185.194.178.17:27465] [client 185.194.178.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.17, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeb0XyAteFQFwS_23JkMRQAAAUg"]
[Tue Apr 21 11:55:06.330098 2026] [:error] [pid 4823:tid 4877] [client 43.166.128.187:46186] [client 43.166.128.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeb1Gvc8mke3PfHqsxExNQAAAZg"]
[Tue Apr 21 12:26:49.101903 2026] [:error] [pid 4822:tid 4842] [client 185.194.178.15:48795] [client 185.194.178.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.15, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeb8iSAteFQFwS_23JkdBAAAAVA"]
[Tue Apr 21 12:27:49.360522 2026] [:error] [pid 35322:tid 35373] [client 96.9.125.116:59006] [client 96.9.125.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.9.125.116, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeb8xaPoAfV40BTfVKybBwAAAJA"]
[Tue Apr 21 13:12:12.457952 2026] [:error] [pid 35320:tid 35353] [client 152.59.205.117:18707] [client 152.59.205.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.205.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aecHLIJW6fdXWO6agMHjHwAAABc"]
[Tue Apr 21 13:12:22.082901 2026] [:error] [pid 4822:tid 4828] [client 152.59.205.117:56386] [client 152.59.205.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.205.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aecHNiAteFQFwS_23Jk6WgAAAUI"]
[Tue Apr 21 13:12:32.608480 2026] [:error] [pid 5377:tid 5390] [client 152.59.205.117:55848] [client 152.59.205.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.205.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aecHQLBKychFlrHBdvuXJQAAAcQ"]
[Tue Apr 21 13:12:43.157360 2026] [:error] [pid 5377:tid 5392] [client 152.59.205.117:56260] [client 152.59.205.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.205.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aecHS7BKychFlrHBdvuXKAAAAcY"]
[Tue Apr 21 13:12:53.836231 2026] [:error] [pid 5377:tid 5386] [client 152.59.205.117:60625] [client 152.59.205.117] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.205.117, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aecHVbBKychFlrHBdvuXOAAAAcA"]
[Tue Apr 21 13:40:08.560822 2026] [:error] [pid 4822:tid 4828] [client 185.194.178.22:37331] [client 185.194.178.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aecNuCAteFQFwS_23JlIeQAAAUI"]
[Tue Apr 21 13:45:50.041717 2026] [:error] [pid 4823:tid 4861] [client 82.64.81.82:35764] [client 82.64.81.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.64.81.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aecPDvc8mke3PfHqsxFegQAAAYg"]
[Tue Apr 21 14:24:20.338732 2026] [:error] [pid 35320:tid 35332] [client 54.215.236.69:51668] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "aecYFIJW6fdXWO6agMH2MAAAAAI"]
[Tue Apr 21 14:24:22.040978 2026] [:error] [pid 35321:tid 35404] [client 54.215.236.69:54122] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "aecYFjeHLhVUuu8cVXyEvgAAAFQ"]
[Tue Apr 21 14:24:22.702989 2026] [:error] [pid 4822:tid 4829] [client 54.215.236.69:54134] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.local"] [unique_id "aecYFiAteFQFwS_23JlsIgAAAUM"]
[Tue Apr 21 14:24:23.368317 2026] [:error] [pid 4822:tid 4841] [client 54.215.236.69:54144] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.production"] [unique_id "aecYFyAteFQFwS_23JlsKAAAAU8"]
[Tue Apr 21 14:24:24.027198 2026] [:error] [pid 35320:tid 35339] [client 54.215.236.69:54154] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.staging"] [unique_id "aecYGIJW6fdXWO6agMH2NwAAAAk"]
[Tue Apr 21 14:24:24.691088 2026] [:error] [pid 5377:tid 5405] [client 54.215.236.69:54170] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.development"] [unique_id "aecYGLBKychFlrHBdvuwtwAAAdM"]
[Tue Apr 21 14:24:25.347546 2026] [:error] [pid 4823:tid 4859] [client 54.215.236.69:54172] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.test"] [unique_id "aecYGfc8mke3PfHqsxF16gAAAYY"]
[Tue Apr 21 14:24:26.011827 2026] [:error] [pid 4823:tid 4876] [client 54.215.236.69:54182] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.remote"] [unique_id "aecYGvc8mke3PfHqsxF18gAAAZc"]
[Tue Apr 21 14:24:26.665002 2026] [:error] [pid 35320:tid 35335] [client 54.215.236.69:42300] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.bak"] [unique_id "aecYGoJW6fdXWO6agMH2OgAAAAU"]
[Tue Apr 21 14:24:27.319289 2026] [:error] [pid 4777:tid 4799] [client 54.215.236.69:42316] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.backup"] [unique_id "aecYG6xXur6bykKyLZRpygAAAQs"]
[Tue Apr 21 14:24:27.980956 2026] [:error] [pid 35415:tid 35431] [client 54.215.236.69:42324] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.save"] [unique_id "aecYG0iqDinI4_22zzg9KAAAAMQ"]
[Tue Apr 21 14:24:28.635980 2026] [:error] [pid 4777:tid 4805] [client 54.215.236.69:42340] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.old"] [unique_id "aecYHKxXur6bykKyLZRpzQAAARE"]
[Tue Apr 21 14:24:29.319776 2026] [:error] [pid 4823:tid 4874] [client 54.215.236.69:42356] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.sample"] [unique_id "aecYHfc8mke3PfHqsxF2DAAAAZU"]
[Tue Apr 21 14:24:29.981644 2026] [:error] [pid 4777:tid 4796] [client 54.215.236.69:42360] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.example"] [unique_id "aecYHaxXur6bykKyLZRp1AAAAQg"]
[Tue Apr 21 14:24:30.656751 2026] [:error] [pid 4822:tid 4837] [client 54.215.236.69:42374] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.dev"] [unique_id "aecYHiAteFQFwS_23JlsZwAAAUs"]
[Tue Apr 21 14:24:31.316139 2026] [:error] [pid 35322:tid 35362] [client 54.215.236.69:42376] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.prod"] [unique_id "aecYH6PoAfV40BTfVKyrtgAAAIU"]
[Tue Apr 21 14:24:31.978840 2026] [:error] [pid 35321:tid 35401] [client 54.215.236.69:42392] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.stage"] [unique_id "aecYHzeHLhVUuu8cVXyEyAAAAFE"]
[Tue Apr 21 14:24:32.634708 2026] [:error] [pid 5377:tid 5409] [client 54.215.236.69:42402] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.ci"] [unique_id "aecYILBKychFlrHBdvuwxQAAAdc"]
[Tue Apr 21 14:24:33.296680 2026] [:error] [pid 4823:tid 4857] [client 54.215.236.69:42414] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.docker"] [unique_id "aecYIfc8mke3PfHqsxF2LAAAAYQ"]
[Tue Apr 21 14:24:33.958246 2026] [:error] [pid 4823:tid 4864] [client 54.215.236.69:42426] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.live"] [unique_id "aecYIfc8mke3PfHqsxF2MwAAAYs"]
[Tue Apr 21 14:24:34.617776 2026] [:error] [pid 35322:tid 35368] [client 54.215.236.69:42434] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.preprod"] [unique_id "aecYIqPoAfV40BTfVKyrugAAAIs"]
[Tue Apr 21 14:24:35.281340 2026] [:error] [pid 35322:tid 35369] [client 54.215.236.69:42438] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.uat"] [unique_id "aecYI6PoAfV40BTfVKyruwAAAIw"]
[Tue Apr 21 14:24:35.932215 2026] [:error] [pid 4822:tid 4839] [client 54.215.236.69:42450] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.dist"] [unique_id "aecYIyAteFQFwS_23JlsiAAAAU0"]
[Tue Apr 21 14:24:36.592118 2026] [:error] [pid 35320:tid 35352] [client 54.215.236.69:58228] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.swp"] [unique_id "aecYJIJW6fdXWO6agMH2SQAAABY"]
[Tue Apr 21 14:24:37.252580 2026] [:error] [pid 4823:tid 4854] [client 54.215.236.69:58238] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env~"] [unique_id "aecYJfc8mke3PfHqsxF2RwAAAYE"]
[Tue Apr 21 14:24:37.910670 2026] [:error] [pid 5377:tid 5392] [client 54.215.236.69:58246] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/app/.env"] [unique_id "aecYJbBKychFlrHBdvuw1gAAAcY"]
[Tue Apr 21 14:24:38.566822 2026] [:error] [pid 4777:tid 4812] [client 54.215.236.69:58254] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/apps/.env"] [unique_id "aecYJqxXur6bykKyLZRqAQAAARg"]
[Tue Apr 21 14:24:39.225881 2026] [:error] [pid 35320:tid 35348] [client 54.215.236.69:58258] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/api/.env"] [unique_id "aecYJ4JW6fdXWO6agMH2SgAAABI"]
[Tue Apr 21 14:24:39.883280 2026] [:error] [pid 4823:tid 4856] [client 54.215.236.69:58270] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/web/.env"] [unique_id "aecYJ_c8mke3PfHqsxF2WwAAAYM"]
[Tue Apr 21 14:24:40.545926 2026] [:error] [pid 4822:tid 4843] [client 54.215.236.69:58276] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/site/.env"] [unique_id "aecYKCAteFQFwS_23JlsuAAAAVE"]
[Tue Apr 21 14:24:41.210859 2026] [:error] [pid 5377:tid 5403] [client 54.215.236.69:58280] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/public/.env"] [unique_id "aecYKbBKychFlrHBdvuw3QAAAdE"]
[Tue Apr 21 14:24:41.871406 2026] [:error] [pid 4822:tid 4826] [client 54.215.236.69:58294] [client 54.215.236.69] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/admin/.env"] [unique_id "aecYKSAteFQFwS_23JlsyAAAAUA"]
[Tue Apr 21 14:37:20.621711 2026] [:error] [pid 4822:tid 4826] [client 52.57.152.51:60676] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aecbICAteFQFwS_23Jl5wAAAAUA"]
[Tue Apr 21 14:37:23.425992 2026] [:error] [pid 4777:tid 4791] [client 52.57.152.51:33140] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aecbI6xXur6bykKyLZRvGwAAAQM"]
[Tue Apr 21 14:37:24.486496 2026] [:error] [pid 4822:tid 4830] [client 52.57.152.51:33150] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.local"] [unique_id "aecbJCAteFQFwS_23Jl5xwAAAUQ"]
[Tue Apr 21 14:37:25.813551 2026] [:error] [pid 4822:tid 4827] [client 52.57.152.51:33164] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.production"] [unique_id "aecbJSAteFQFwS_23Jl5ywAAAUE"]
[Tue Apr 21 14:37:27.058631 2026] [:error] [pid 4822:tid 4843] [client 52.57.152.51:33172] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.staging"] [unique_id "aecbJyAteFQFwS_23Jl5zgAAAVE"]
[Tue Apr 21 14:37:28.229171 2026] [:error] [pid 4823:tid 4859] [client 52.57.152.51:50446] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.development"] [unique_id "aecbKPc8mke3PfHqsxGAOAAAAYY"]
[Tue Apr 21 14:37:29.327228 2026] [:error] [pid 35322:tid 35357] [client 52.57.152.51:50458] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.test"] [unique_id "aecbKaPoAfV40BTfVKyu4AAAAIA"]
[Tue Apr 21 14:37:30.523434 2026] [:error] [pid 4777:tid 4792] [client 52.57.152.51:50472] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.remote"] [unique_id "aecbKqxXur6bykKyLZRvLgAAAQQ"]
[Tue Apr 21 14:37:31.690937 2026] [:error] [pid 4822:tid 4848] [client 52.57.152.51:50482] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.bak"] [unique_id "aecbKyAteFQFwS_23Jl51QAAAVY"]
[Tue Apr 21 14:37:32.907099 2026] [:error] [pid 35320:tid 35339] [client 52.57.152.51:50484] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.backup"] [unique_id "aecbLIJW6fdXWO6agMH75gAAAAk"]
[Tue Apr 21 14:37:34.120839 2026] [:error] [pid 35320:tid 35354] [client 52.57.152.51:50492] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.save"] [unique_id "aecbLoJW6fdXWO6agMH76wAAABg"]
[Tue Apr 21 14:37:35.407044 2026] [:error] [pid 5377:tid 5395] [client 52.57.152.51:50508] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.old"] [unique_id "aecbL7BKychFlrHBdvu37AAAAck"]
[Tue Apr 21 14:37:36.592106 2026] [:error] [pid 35320:tid 35345] [client 52.57.152.51:50516] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.sample"] [unique_id "aecbMIJW6fdXWO6agMH77gAAAA8"]
[Tue Apr 21 14:37:37.874451 2026] [:error] [pid 4822:tid 4834] [client 52.57.152.51:50526] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.example"] [unique_id "aecbMSAteFQFwS_23Jl58QAAAUg"]
[Tue Apr 21 14:37:39.407598 2026] [:error] [pid 35322:tid 35363] [client 52.57.152.51:47594] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.dev"] [unique_id "aecbM6PoAfV40BTfVKyu6gAAAIY"]
[Tue Apr 21 14:37:40.523965 2026] [:error] [pid 35320:tid 35353] [client 52.57.152.51:47604] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.prod"] [unique_id "aecbNIJW6fdXWO6agMH79AAAABc"]
[Tue Apr 21 14:37:41.599265 2026] [:error] [pid 35415:tid 35434] [client 52.57.152.51:47610] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.stage"] [unique_id "aecbNUiqDinI4_22zzhCHQAAAMc"]
[Tue Apr 21 14:37:42.713438 2026] [:error] [pid 35320:tid 35331] [client 52.57.152.51:47624] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.ci"] [unique_id "aecbNoJW6fdXWO6agMH7-AAAAAE"]
[Tue Apr 21 14:37:43.892413 2026] [:error] [pid 4822:tid 4846] [client 52.57.152.51:47636] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.docker"] [unique_id "aecbNyAteFQFwS_23Jl6CAAAAVQ"]
[Tue Apr 21 14:37:45.203908 2026] [:error] [pid 5377:tid 5390] [client 52.57.152.51:47638] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.live"] [unique_id "aecbObBKychFlrHBdvu4BgAAAcQ"]
[Tue Apr 21 14:37:46.447560 2026] [:error] [pid 35320:tid 35344] [client 52.57.152.51:47640] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.preprod"] [unique_id "aecbOoJW6fdXWO6agMH7-wAAAA4"]
[Tue Apr 21 14:37:47.539219 2026] [:error] [pid 35320:tid 35342] [client 52.57.152.51:47642] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.uat"] [unique_id "aecbO4JW6fdXWO6agMH7_wAAAAw"]
[Tue Apr 21 14:37:48.789001 2026] [:error] [pid 4823:tid 4854] [client 52.57.152.51:58666] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.dist"] [unique_id "aecbPPc8mke3PfHqsxGAXgAAAYE"]
[Tue Apr 21 14:37:49.979078 2026] [:error] [pid 4822:tid 4850] [client 52.57.152.51:58676] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.swp"] [unique_id "aecbPSAteFQFwS_23Jl6MAAAAVg"]
[Tue Apr 21 14:37:51.218027 2026] [:error] [pid 5377:tid 5401] [client 52.57.152.51:58688] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env~"] [unique_id "aecbP7BKychFlrHBdvu4GQAAAc8"]
[Tue Apr 21 14:37:52.455007 2026] [:error] [pid 4822:tid 4837] [client 52.57.152.51:58696] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/app/.env"] [unique_id "aecbQCAteFQFwS_23Jl6XgAAAUs"]
[Tue Apr 21 14:37:53.587409 2026] [:error] [pid 4823:tid 4858] [client 52.57.152.51:58700] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/apps/.env"] [unique_id "aecbQfc8mke3PfHqsxGAawAAAYU"]
[Tue Apr 21 14:37:54.906043 2026] [:error] [pid 4822:tid 4833] [client 52.57.152.51:58712] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/api/.env"] [unique_id "aecbQiAteFQFwS_23Jl6kwAAAUc"]
[Tue Apr 21 14:37:56.077860 2026] [:error] [pid 4822:tid 4847] [client 52.57.152.51:58716] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/web/.env"] [unique_id "aecbRCAteFQFwS_23Jl6mQAAAVU"]
[Tue Apr 21 14:37:57.115990 2026] [:error] [pid 4777:tid 4790] [client 52.57.152.51:58718] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/site/.env"] [unique_id "aecbRaxXur6bykKyLZRvQAAAAQI"]
[Tue Apr 21 14:37:58.255150 2026] [:error] [pid 5377:tid 5407] [client 52.57.152.51:42582] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/public/.env"] [unique_id "aecbRrBKychFlrHBdvu4MAAAAdU"]
[Tue Apr 21 14:37:59.542835 2026] [:error] [pid 35320:tid 35330] [client 52.57.152.51:42586] [client 52.57.152.51] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/admin/.env"] [unique_id "aecbR4JW6fdXWO6agMH8EgAAAAA"]
[Tue Apr 21 15:00:31.955779 2026] [:error] [pid 4822:tid 4841] [client 157.66.27.55:57044] [client 157.66.27.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.66.27.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aecgjyAteFQFwS_23JmWMwAAAU8"]
[Tue Apr 21 15:02:02.049277 2026] [:error] [pid 35322:tid 35376] [client 211.21.61.224:44754] [client 211.21.61.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aecg6qPoAfV40BTfVKyzJwAAAJM"]
[Tue Apr 21 15:13:25.175767 2026] [:error] [pid 4822:tid 4846] [client 212.132.70.123:39518] [client 212.132.70.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.132.70.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aecjlSAteFQFwS_23JmjbwAAAVQ"]
[Tue Apr 21 15:28:31.610122 2026] [:error] [pid 4823:tid 4853] [client 80.239.207.207:54776] [client 80.239.207.207] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.239.207.207, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aecnH_c8mke3PfHqsxGpIQAAAYA"]
[Tue Apr 21 15:32:50.692296 2026] [:error] [pid 35321:tid 35407] [client 45.86.200.241:31541] [client 45.86.200.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "aecoIjeHLhVUuu8cVXyUawAAAFc"]
[Tue Apr 21 15:32:57.476710 2026] [:error] [pid 35320:tid 35334] [client 185.82.72.10:60413] [client 185.82.72.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aecoKYJW6fdXWO6agMEUwAAAAAQ"]
[Tue Apr 21 15:33:18.875261 2026] [:error] [pid 35321:tid 35404] [client 45.86.200.213:33519] [client 45.86.200.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aecoPjeHLhVUuu8cVXyXDAAAAFQ"]
[Tue Apr 21 15:33:50.802847 2026] [:error] [pid 53832:tid 53842] [client 185.82.72.103:52023] [client 185.82.72.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aecoXtzkuxsE_OhM9UIMZgAAAkc"]
[Tue Apr 21 15:35:55.219274 2026] [proxy_fcgi:error] [pid 54080:tid 54087] [client 45.86.200.246:43903] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Undefined constant "ABSPATH" in /home/expressi/public_html/wp-settings.php:34\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-settings.php on line 34'
[Tue Apr 21 15:41:38.699773 2026] [:error] [pid 54080:tid 54083] [client 45.86.200.243:62965] [client 45.86.200.243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/execute.php"] [unique_id "aecqMozEbQHHxtmWbaZaMwAAAsE"]
[Tue Apr 21 15:42:38.386447 2026] [:error] [pid 4823:tid 4870] [client 45.86.200.239:20511] [client 45.86.200.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aecqbvc8mke3PfHqsxHDQAAAAZE"]
[Tue Apr 21 15:42:38.939820 2026] [:error] [pid 53978:tid 54000] [client 45.86.200.227:23261] [client 45.86.200.227] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/chosen.php"] [unique_id "aecqbp1ivsR4hcOSQba4HwAAApQ"]
[Tue Apr 21 15:42:41.884085 2026] [:error] [pid 54080:tid 54106] [client 45.86.200.236:33413] [client 45.86.200.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aecqcYzEbQHHxtmWbaZbqQAAAtg"]
[Tue Apr 21 15:42:42.418967 2026] [:error] [pid 35321:tid 35393] [client 45.86.200.225:39825] [client 45.86.200.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aecqcjeHLhVUuu8cVXy4mQAAAEk"]
[Tue Apr 21 15:42:44.818978 2026] [:error] [pid 35321:tid 35384] [client 45.86.200.247:51885] [client 45.86.200.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aecqdDeHLhVUuu8cVXy4rwAAAEA"]
[Tue Apr 21 15:42:54.975213 2026] [:error] [pid 53978:tid 54002] [client 45.86.200.213:40185] [client 45.86.200.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aecqfp1ivsR4hcOSQba4TQAAApY"]
[Tue Apr 21 15:42:55.557069 2026] [:error] [pid 53731:tid 53754] [client 45.86.200.246:63363] [client 45.86.200.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aecqf12I9THUR-bRVGzgaAAAAhI"]
[Tue Apr 21 15:43:02.204971 2026] [:error] [pid 53832:tid 53844] [client 185.82.72.104:27149] [client 185.82.72.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aecqhtzkuxsE_OhM9UIhZQAAAkk"]
[Tue Apr 21 15:43:08.753813 2026] [:error] [pid 53832:tid 53854] [client 45.86.200.216:59129] [client 45.86.200.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aecqjNzkuxsE_OhM9UIhjQAAAlM"]
[Tue Apr 21 15:43:09.402493 2026] [:error] [pid 53832:tid 53837] [client 45.86.200.219:32637] [client 45.86.200.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aecqjdzkuxsE_OhM9UIhkQAAAkI"]
[Tue Apr 21 15:43:09.988724 2026] [:error] [pid 54080:tid 54086] [client 185.82.72.102:63165] [client 185.82.72.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/about.php"] [unique_id "aecqjYzEbQHHxtmWbaZcCAAAAsQ"]
[Tue Apr 21 15:43:10.592307 2026] [:error] [pid 4823:tid 4861] [client 45.86.200.225:41963] [client 45.86.200.225] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/about.php"] [unique_id "aecqjvc8mke3PfHqsxHDvgAAAYg"]
[Tue Apr 21 15:43:22.773523 2026] [:error] [pid 54080:tid 54088] [client 45.86.200.219:52811] [client 45.86.200.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aecqmozEbQHHxtmWbaZcVAAAAsY"]
[Tue Apr 21 15:43:26.626715 2026] [:error] [pid 4823:tid 4876] [client 185.82.72.206:52873] [client 185.82.72.206] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.82.72.206, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aecqnvc8mke3PfHqsxHEIgAAAZc"]
[Tue Apr 21 15:43:32.264427 2026] [:error] [pid 4823:tid 4863] [client 185.82.72.206:52873] [client 185.82.72.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/class-config.php"] [unique_id "aecqpPc8mke3PfHqsxHEUAAAAYo"]
[Tue Apr 21 15:43:44.173510 2026] [:error] [pid 4823:tid 4876] [client 45.86.200.231:21799] [client 45.86.200.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aecqsPc8mke3PfHqsxHExAAAAZc"]
[Tue Apr 21 15:43:50.908182 2026] [:error] [pid 35320:tid 35335] [client 45.86.200.228:40417] [client 45.86.200.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bak.php"] [unique_id "aecqtoJW6fdXWO6agMEmGQAAAAU"]
[Tue Apr 21 15:43:51.669561 2026] [:error] [pid 35321:tid 35392] [client 45.86.200.232:51067] [client 45.86.200.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aecqtzeHLhVUuu8cVXy6nwAAAEg"]
[Tue Apr 21 15:43:55.959917 2026] [:error] [pid 53832:tid 53853] [client 45.86.200.220:65263] [client 45.86.200.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aecqu9zkuxsE_OhM9UIi0QAAAlI"]
[Tue Apr 21 15:44:02.756952 2026] [:error] [pid 53832:tid 53855] [client 45.86.200.239:61377] [client 45.86.200.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/about.php"] [unique_id "aecqwtzkuxsE_OhM9UIi_QAAAlQ"]
[Tue Apr 21 15:44:03.418955 2026] [:error] [pid 35321:tid 35393] [client 185.82.72.107:53505] [client 185.82.72.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aecqwzeHLhVUuu8cVXy65gAAAEk"]
[Tue Apr 21 15:44:07.424617 2026] [:error] [pid 35321:tid 35394] [client 45.86.200.228:49981] [client 45.86.200.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/index.php"] [unique_id "aecqxzeHLhVUuu8cVXy7EwAAAEo"]
[Tue Apr 21 15:44:08.004860 2026] [:error] [pid 53832:tid 53837] [client 45.86.200.241:28737] [client 45.86.200.241] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aecqyNzkuxsE_OhM9UIjDQAAAkI"]
[Tue Apr 21 15:44:22.067825 2026] [autoindex:error] [pid 35321:tid 35385] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:44:42.649312 2026] [autoindex:error] [pid 35321:tid 35384] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/wordpress/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:44:45.789772 2026] [autoindex:error] [pid 35321:tid 35406] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/ui/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:44:49.835206 2026] [autoindex:error] [pid 35321:tid 35397] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:44:52.868938 2026] [autoindex:error] [pid 35321:tid 35389] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:44:53.155178 2026] [autoindex:error] [pid 35321:tid 35401] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:44:56.038429 2026] [autoindex:error] [pid 35321:tid 35399] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:44:56.321713 2026] [autoindex:error] [pid 35321:tid 35407] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:44:56.598065 2026] [autoindex:error] [pid 35321:tid 35401] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:44:57.878338 2026] [autoindex:error] [pid 35321:tid 35403] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:44:59.593723 2026] [autoindex:error] [pid 35321:tid 35406] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:44:59.887974 2026] [autoindex:error] [pid 35321:tid 35388] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:45:00.177469 2026] [autoindex:error] [pid 35321:tid 35393] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:45:03.944547 2026] [autoindex:error] [pid 35321:tid 35386] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/pullquote/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:45:08.737667 2026] [autoindex:error] [pid 35321:tid 35403] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/comments-pagination-numbers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:45:10.284620 2026] [autoindex:error] [pid 35321:tid 35407] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:45:14.896086 2026] [autoindex:error] [pid 35321:tid 35393] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:45:20.454451 2026] [autoindex:error] [pid 35321:tid 35389] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:45:20.731281 2026] [autoindex:error] [pid 35321:tid 35394] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/post-terms/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:45:22.991934 2026] [autoindex:error] [pid 35321:tid 35388] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:45:25.449387 2026] [autoindex:error] [pid 35321:tid 35385] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/namespaced/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:45:25.731409 2026] [autoindex:error] [pid 35321:tid 35406] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:45:31.278979 2026] [autoindex:error] [pid 35321:tid 35386] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:45:31.556569 2026] [autoindex:error] [pid 35321:tid 35402] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:45:37.403373 2026] [autoindex:error] [pid 35321:tid 35406] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/site-title/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:45:46.206919 2026] [autoindex:error] [pid 35321:tid 35396] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:45:52.050319 2026] [autoindex:error] [pid 35321:tid 35395] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:45:52.323964 2026] [autoindex:error] [pid 35321:tid 35408] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2026/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:45:53.976764 2026] [autoindex:error] [pid 35321:tid 35384] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:45:55.364628 2026] [autoindex:error] [pid 35321:tid 35385] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:45:57.758281 2026] [autoindex:error] [pid 35321:tid 35395] [client 45.86.200.241:64917] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 21 15:51:43.676597 2026] [:error] [pid 54080:tid 54089] [client 185.194.178.22:43419] [client 185.194.178.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aecsj4zEbQHHxtmWbaZiLQAAAsc"]
[Tue Apr 21 15:53:57.563943 2026] [:error] [pid 54080:tid 54102] [client 162.19.25.160:48688] [client 162.19.25.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.19.25.160, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aectFYzEbQHHxtmWbaZixwAAAtQ"]
[Tue Apr 21 17:04:47.981736 2026] [:error] [pid 35320:tid 35351] [client 109.228.52.205:58380] [client 109.228.52.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.228.52.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aec9r4JW6fdXWO6agMFMUAAAABU"]
[Tue Apr 21 17:19:46.193269 2026] [:error] [pid 53978:tid 53982] [client 151.29.153.127:58474] [client 151.29.153.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 151.29.153.127, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aedBMp1ivsR4hcOSQbbXiwAAAoI"]
[Tue Apr 21 17:22:17.679762 2026] [:error] [pid 53731:tid 53739] [client 151.29.153.127:60007] [client 151.29.153.127] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aedByV2I9THUR-bRVGwJ1AAAAgQ"]
[Tue Apr 21 17:23:26.616826 2026] [:error] [pid 35321:tid 35407] [client 151.29.153.127:60705] [client 151.29.153.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 151.29.153.127, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aedCDjeHLhVUuu8cVXz3IgAAAFc"]
[Tue Apr 21 17:24:07.238210 2026] [:error] [pid 35322:tid 35372] [client 170.64.159.212:59126] [client 170.64.159.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 170.64.159.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aedCN6PoAfV40BTfVKzOVAAAAI8"]
[Tue Apr 21 17:24:07.919109 2026] [:error] [pid 35320:tid 35334] [client 170.64.159.212:49155] [client 170.64.159.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 170.64.159.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aedCN4JW6fdXWO6agMFS5AAAAAQ"]
[Tue Apr 21 17:24:23.216472 2026] [:error] [pid 53978:tid 53988] [client 151.29.153.127:61209] [client 151.29.153.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 151.29.153.127, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aedCR51ivsR4hcOSQbbaMQAAAog"]
[Tue Apr 21 17:25:01.454377 2026] [:error] [pid 53731:tid 53745] [client 151.29.153.127:61641] [client 151.29.153.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 151.29.153.127, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aedCbV2I9THUR-bRVGwMaAAAAgo"]
[Tue Apr 21 17:25:45.496456 2026] [:error] [pid 35321:tid 35397] [client 151.29.153.127:62087] [client 151.29.153.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 151.29.153.127, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aedCmTeHLhVUuu8cVXz37QAAAE0"]
[Tue Apr 21 17:46:15.388081 2026] [:error] [pid 53731:tid 53744] [client 185.194.178.21:52685] [client 185.194.178.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aedHZ12I9THUR-bRVGwb7AAAAgk"]
[Tue Apr 21 17:47:23.437117 2026] [:error] [pid 35321:tid 35385] [client 170.64.159.212:61961] [client 170.64.159.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 170.64.159.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aedHqzeHLhVUuu8cVXwHWwAAAEE"]
[Tue Apr 21 17:56:16.561213 2026] [:error] [pid 4823:tid 4867] [client 170.64.159.212:58840] [client 170.64.159.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 170.64.159.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aedJwPc8mke3PfHqsxHldwAAAY4"]
[Tue Apr 21 18:07:15.226772 2026] [:error] [pid 35322:tid 35366] [client 170.64.159.212:54573] [client 170.64.159.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 170.64.159.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aedMU6PoAfV40BTfVKzQkAAAAIk"]
[Tue Apr 21 18:47:07.191031 2026] [:error] [pid 53978:tid 53995] [client 182.8.97.122:4366] [client 182.8.97.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.8.97.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aedVq51ivsR4hcOSQbb5bQAAAo8"]
[Tue Apr 21 18:47:17.260029 2026] [:error] [pid 35320:tid 35332] [client 182.8.97.122:36974] [client 182.8.97.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.8.97.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aedVtYJW6fdXWO6agMF9CgAAAAI"]
[Tue Apr 21 18:47:27.707347 2026] [:error] [pid 54080:tid 54101] [client 182.8.97.122:32058] [client 182.8.97.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.8.97.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aedVv4zEbQHHxtmWbaaYcAAAAtM"]
[Tue Apr 21 18:47:38.091676 2026] [:error] [pid 35320:tid 35341] [client 182.8.97.122:9680] [client 182.8.97.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.8.97.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aedVyoJW6fdXWO6agMF9QQAAAAs"]
[Tue Apr 21 18:47:48.592117 2026] [:error] [pid 53731:tid 53760] [client 182.8.97.122:4389] [client 182.8.97.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.8.97.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aedV1F2I9THUR-bRVGwxoAAAAhg"]
[Tue Apr 21 19:12:48.166804 2026] [:error] [pid 35320:tid 35353] [client 137.184.69.218:16552] [client 137.184.69.218] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 137.184.69.218, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aedbsIJW6fdXWO6agMGMPAAAABc"]
[Tue Apr 21 19:33:48.305433 2026] [:error] [pid 35322:tid 35369] [client 223.235.101.231:18169] [client 223.235.101.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.235.101.231, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aedgnKPoAfV40BTfVKzWqQAAAIw"]
[Tue Apr 21 19:33:59.873213 2026] [:error] [pid 35320:tid 35343] [client 223.235.101.231:21980] [client 223.235.101.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.235.101.231, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aedgp4JW6fdXWO6agMGWCgAAAA0"]
[Tue Apr 21 19:34:12.288745 2026] [:error] [pid 35321:tid 35399] [client 223.235.101.231:32602] [client 223.235.101.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.235.101.231, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aedgtDeHLhVUuu8cVXxchgAAAE8"]
[Tue Apr 21 19:34:24.341201 2026] [:error] [pid 53832:tid 53836] [client 223.235.101.231:4344] [client 223.235.101.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.235.101.231, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aedgwNzkuxsE_OhM9UJeAwAAAkE"]
[Tue Apr 21 19:34:34.709913 2026] [:error] [pid 35320:tid 35340] [client 223.235.101.231:26240] [client 223.235.101.231] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.235.101.231, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aedgyoJW6fdXWO6agMGWTwAAAAo"]
[Tue Apr 21 20:27:09.577719 2026] [:error] [pid 35320:tid 35337] [client 1.15.52.154:43458] [client 1.15.52.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aedtHYJW6fdXWO6agMGy9AAAAAc"]
[Tue Apr 21 21:07:05.161422 2026] [:error] [pid 53978:tid 53988] [client 164.132.207.73:56206] [client 164.132.207.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.207.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aed2eZ1ivsR4hcOSQbYjxwAAAog"]
[Tue Apr 21 21:27:32.555370 2026] [:error] [pid 35321:tid 35385] [client 162.19.25.160:44560] [client 162.19.25.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.19.25.160, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aed7RDeHLhVUuu8cVXy2QwAAAEE"]
[Tue Apr 21 21:43:10.829352 2026] [:error] [pid 53731:tid 53737] [client 63.33.214.123:51696] [client 63.33.214.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.33.214.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aed-7l2I9THUR-bRVGx4MwAAAgI"]
[Tue Apr 21 21:43:12.556501 2026] [:error] [pid 53731:tid 53755] [client 63.33.214.123:51834] [client 63.33.214.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.33.214.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aed-8F2I9THUR-bRVGx4QQAAAhM"]
[Tue Apr 21 21:43:14.216740 2026] [:error] [pid 35320:tid 35331] [client 63.33.214.123:52008] [client 63.33.214.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.33.214.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aed-8oJW6fdXWO6agMHbrAAAAAE"]
[Tue Apr 21 21:43:28.169345 2026] [:error] [pid 35321:tid 35389] [client 43.153.74.75:41052] [client 43.153.74.75] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aed_ADeHLhVUuu8cVXzDlwAAAEU"]
[Tue Apr 21 21:56:22.817057 2026] [:error] [pid 53731:tid 53740] [client 51.210.113.223:33760] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeeCBl2I9THUR-bRVGx-4gAAAgU"]
[Tue Apr 21 22:29:45.934302 2026] [:error] [pid 35321:tid 35400] [client 51.75.54.138:41088] [client 51.75.54.138] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.75.54.138, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeeJ2TeHLhVUuu8cVXzoBQAAAFA"]
[Tue Apr 21 22:43:14.166987 2026] [:error] [pid 53978:tid 53999] [client 68.183.13.1:36550] [client 68.183.13.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.183.13.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeeNAp1ivsR4hcOSQbY-CAAAApM"]
[Tue Apr 21 23:05:08.721276 2026] [:error] [pid 4777:tid 4789] [client 35.226.125.165:51118] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeeSJKxXur6bykKyLZS5IAAAAQE"]
[Tue Apr 21 23:08:40.629290 2026] [:error] [pid 35320:tid 35334] [client 18.100.242.156:56156] [client 18.100.242.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.100.242.156, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeeS-IJW6fdXWO6agMENNQAAAAQ"]
[Tue Apr 21 23:52:52.407495 2026] [:error] [pid 35321:tid 35400] [client 43.157.168.43:34914] [client 43.157.168.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeedVDeHLhVUuu8cVXwgkAAAAFA"]
[Tue Apr 21 23:54:04.542433 2026] [:error] [pid 35320:tid 35337] [client 34.121.34.133:60075] [client 34.121.34.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.121.34.133, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeednIJW6fdXWO6agME1YQAAAAc"]
[Tue Apr 21 23:54:06.928867 2026] [:error] [pid 35320:tid 35337] [client 34.121.34.133:60075] [client 34.121.34.133] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeednoJW6fdXWO6agME1cgAAAAc"]
[Tue Apr 21 23:54:07.156523 2026] [:error] [pid 35320:tid 35348] [client 34.121.34.133:60075] [client 34.121.34.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.121.34.133, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeedn4JW6fdXWO6agME1cwAAABI"]
[Tue Apr 21 23:54:08.608986 2026] [:error] [pid 53978:tid 53991] [client 34.121.34.133:63727] [client 34.121.34.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.121.34.133, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeedoJ1ivsR4hcOSQbZZLAAAAos"]
[Tue Apr 21 23:54:10.101396 2026] [:error] [pid 35320:tid 35337] [client 34.121.34.133:63191] [client 34.121.34.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.121.34.133, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeedooJW6fdXWO6agME1eAAAAAc"]
[Tue Apr 21 23:54:11.628379 2026] [:error] [pid 35320:tid 35354] [client 34.121.34.133:50656] [client 34.121.34.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.121.34.133, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeedo4JW6fdXWO6agME1ggAAABg"]
[Tue Apr 21 23:54:13.099649 2026] [:error] [pid 54080:tid 54089] [client 34.121.34.133:50853] [client 34.121.34.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.121.34.133, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeedpYzEbQHHxtmWbabnTgAAAsc"]
[Tue Apr 21 23:54:13.099841 2026] [:error] [pid 54080:tid 54089] [client 34.121.34.133:50853] [client 34.121.34.133] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.121.34.133, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeedpYzEbQHHxtmWbabnTgAAAsc"]
[Tue Apr 21 23:57:01.891365 2026] [:error] [pid 35321:tid 35400] [client 136.113.132.46:50223] [client 136.113.132.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.113.132.46, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeeeTTeHLhVUuu8cVXwjAgAAAFA"]
[Tue Apr 21 23:57:04.420438 2026] [:error] [pid 35321:tid 35408] [client 136.113.132.46:50223] [client 136.113.132.46] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeeeUDeHLhVUuu8cVXwjDAAAAFg"]
[Tue Apr 21 23:57:04.647306 2026] [:error] [pid 35321:tid 35386] [client 136.113.132.46:50223] [client 136.113.132.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.113.132.46, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeeeUDeHLhVUuu8cVXwjDgAAAEI"]
[Tue Apr 21 23:57:06.186708 2026] [:error] [pid 53978:tid 53989] [client 136.113.132.46:49460] [client 136.113.132.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.113.132.46, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeeeUp1ivsR4hcOSQbZZ6QAAAok"]
[Tue Apr 21 23:57:07.723689 2026] [:error] [pid 35322:tid 35376] [client 136.113.132.46:62481] [client 136.113.132.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.113.132.46, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeeeU6PoAfV40BTfVKzqUgAAAJM"]
[Tue Apr 21 23:57:09.246082 2026] [:error] [pid 35320:tid 35330] [client 136.113.132.46:63626] [client 136.113.132.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.113.132.46, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeeeVYJW6fdXWO6agME3FAAAAAA"]
[Tue Apr 21 23:57:10.839640 2026] [:error] [pid 35320:tid 35338] [client 136.113.132.46:61275] [client 136.113.132.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.113.132.46, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeeeVoJW6fdXWO6agME3IAAAAAg"]
[Tue Apr 21 23:57:10.839857 2026] [:error] [pid 35320:tid 35338] [client 136.113.132.46:61275] [client 136.113.132.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 136.113.132.46, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeeeVoJW6fdXWO6agME3IAAAAAg"]
[Tue Apr 21 23:59:56.183329 2026] [:error] [pid 53832:tid 53839] [client 34.135.189.17:61609] [client 34.135.189.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.135.189.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeee_NzkuxsE_OhM9UKM0QAAAkQ"]
[Tue Apr 21 23:59:58.401371 2026] [:error] [pid 53832:tid 53841] [client 34.135.189.17:61609] [client 34.135.189.17] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeee_tzkuxsE_OhM9UKM2AAAAkY"]
[Tue Apr 21 23:59:58.628271 2026] [:error] [pid 53832:tid 53835] [client 34.135.189.17:61609] [client 34.135.189.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.135.189.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeee_tzkuxsE_OhM9UKM2QAAAkA"]
[Wed Apr 22 00:00:00.105008 2026] [:error] [pid 35321:tid 35395] [client 34.135.189.17:58672] [client 34.135.189.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.135.189.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeefADeHLhVUuu8cVXwkqAAAAEs"]
[Wed Apr 22 00:00:01.801909 2026] [:error] [pid 35321:tid 35388] [client 34.135.189.17:57039] [client 34.135.189.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.135.189.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeefATeHLhVUuu8cVXwkrgAAAEQ"]
[Wed Apr 22 00:00:03.373844 2026] [:error] [pid 54080:tid 54090] [client 34.135.189.17:54016] [client 34.135.189.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.135.189.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeefA4zEbQHHxtmWbabo8QAAAsg"]
[Wed Apr 22 00:00:04.864639 2026] [:error] [pid 35321:tid 35390] [client 34.135.189.17:56196] [client 34.135.189.17] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.135.189.17, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeefBDeHLhVUuu8cVXwkvgAAAEY"]
[Wed Apr 22 00:00:04.864848 2026] [:error] [pid 35321:tid 35390] [client 34.135.189.17:56196] [client 34.135.189.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.135.189.17, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeefBDeHLhVUuu8cVXwkvgAAAEY"]
[Wed Apr 22 00:03:44.180428 2026] [:error] [pid 35320:tid 35336] [client 51.178.27.107:38274] [client 51.178.27.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.178.27.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeef4IJW6fdXWO6agME-fgAAAAY"]
[Wed Apr 22 00:29:38.712719 2026] [:error] [pid 35321:tid 35405] [client 35.203.184.76:57928] [client 35.203.184.76] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aeel8jeHLhVUuu8cVXwzoQAAAFU"]
[Wed Apr 22 00:56:17.443871 2026] [:error] [pid 53731:tid 53748] [client 165.22.37.239:33856] [client 165.22.37.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.22.37.239, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeesMV2I9THUR-bRVGzFkAAAAg0"]
[Wed Apr 22 00:57:24.335282 2026] [:error] [pid 54080:tid 54099] [client 45.137.126.50:22013] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aeesdIzEbQHHxtmWbab0UAAAAtE"]
[Wed Apr 22 00:57:29.649706 2026] [:error] [pid 35322:tid 35366] [client 45.137.126.22:52289] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aeeseaPoAfV40BTfVKzuLQAAAIk"]
[Wed Apr 22 00:57:39.231574 2026] [:error] [pid 53978:tid 54003] [client 45.137.126.35:52651] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aeesg51ivsR4hcOSQbZqcgAAApc"]
[Wed Apr 22 00:57:44.598817 2026] [:error] [pid 53978:tid 53987] [client 45.137.126.48:27489] [client 45.137.126.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "aeesiJ1ivsR4hcOSQbZqggAAAoc"]
[Wed Apr 22 00:57:53.611445 2026] [:error] [pid 35321:tid 35397] [client 45.137.126.38:61637] [client 45.137.126.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aeeskTeHLhVUuu8cVXw9xQAAAE0"]
[Wed Apr 22 00:57:56.425045 2026] [:error] [pid 35320:tid 35330] [client 45.137.126.32:29343] [client 45.137.126.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aeeslIJW6fdXWO6agMFhCgAAAAA"]
[Wed Apr 22 00:57:57.407646 2026] [:error] [pid 35321:tid 35385] [client 45.137.126.4:35669] [client 45.137.126.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aeeslTeHLhVUuu8cVXw9yQAAAEE"]
[Wed Apr 22 00:57:58.390183 2026] [:error] [pid 4777:tid 4810] [client 45.137.126.7:61169] [client 45.137.126.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aeeslqxXur6bykKyLZTHqAAAARY"]
[Wed Apr 22 00:57:59.443828 2026] [:error] [pid 35321:tid 35402] [client 45.137.126.24:57653] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aeeslzeHLhVUuu8cVXw9ywAAAFI"]
[Wed Apr 22 00:58:00.431895 2026] [:error] [pid 35320:tid 35345] [client 45.137.126.5:57903] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aeesmIJW6fdXWO6agMFhFgAAAA8"]
[Wed Apr 22 00:58:02.749401 2026] [:error] [pid 35415:tid 35443] [client 45.137.126.41:48571] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aeesmkiqDinI4_22zziLogAAANA"]
[Wed Apr 22 00:58:06.004498 2026] [:error] [pid 35320:tid 35350] [client 45.137.126.51:49727] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aeesnoJW6fdXWO6agMFhKAAAABQ"]
[Wed Apr 22 00:58:10.062976 2026] [:error] [pid 35320:tid 35340] [client 45.137.126.31:32787] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aeesooJW6fdXWO6agMFhQQAAAAo"]
[Wed Apr 22 00:58:12.088726 2026] [:error] [pid 35321:tid 35389] [client 45.137.126.14:35889] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aeespDeHLhVUuu8cVXw93wAAAEU"]
[Wed Apr 22 00:58:14.815494 2026] [:error] [pid 53978:tid 53980] [client 45.137.126.4:51885] [client 45.137.126.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aeespp1ivsR4hcOSQbZqrwAAAoA"]
[Wed Apr 22 00:58:23.462202 2026] [:error] [pid 35321:tid 35395] [client 45.137.126.11:22685] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aeesrzeHLhVUuu8cVXw97wAAAEs"]
[Wed Apr 22 00:58:26.226518 2026] [:error] [pid 53731:tid 53742] [client 45.137.126.44:49743] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aeessl2I9THUR-bRVGzGJwAAAgc"]
[Wed Apr 22 00:58:30.476042 2026] [:error] [pid 35415:tid 35427] [client 45.137.126.35:60931] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/defaults.php"] [unique_id "aeestkiqDinI4_22zziLrAAAAMA"]
[Wed Apr 22 00:58:33.314589 2026] [:error] [pid 35320:tid 35337] [client 45.137.126.16:31987] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "aeesuYJW6fdXWO6agMFhbwAAAAc"]
[Wed Apr 22 00:58:39.883344 2026] [:error] [pid 53978:tid 53998] [client 45.137.126.51:42197] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aeesv51ivsR4hcOSQbZqyQAAApI"]
[Wed Apr 22 00:58:42.601315 2026] [:error] [pid 53731:tid 53745] [client 45.137.126.49:29045] [client 45.137.126.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aeeswl2I9THUR-bRVGzGSQAAAgo"]
[Wed Apr 22 00:58:45.341179 2026] [:error] [pid 35320:tid 35346] [client 45.137.126.36:22281] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "aeesxYJW6fdXWO6agMFhmwAAABA"]
[Wed Apr 22 00:58:46.572040 2026] [:error] [pid 35320:tid 35353] [client 45.137.126.38:63775] [client 45.137.126.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aeesxoJW6fdXWO6agMFhnQAAABc"]
[Wed Apr 22 00:58:47.559494 2026] [:error] [pid 35320:tid 35341] [client 45.137.126.44:20295] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "aeesx4JW6fdXWO6agMFhnwAAAAs"]
[Wed Apr 22 00:58:52.822155 2026] [:error] [pid 53731:tid 53741] [client 45.137.126.50:57455] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/info.php"] [unique_id "aeeszF2I9THUR-bRVGzGeAAAAgY"]
[Wed Apr 22 00:58:53.802225 2026] [:error] [pid 53731:tid 53753] [client 45.137.126.22:58125] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class.api.php"] [unique_id "aeeszV2I9THUR-bRVGzGfwAAAhE"]
[Wed Apr 22 00:58:54.808295 2026] [:error] [pid 35320:tid 35342] [client 45.137.126.10:54861] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "aeeszoJW6fdXWO6agMFhpAAAAAw"]
[Wed Apr 22 00:59:06.390991 2026] [:error] [pid 53731:tid 53758] [client 45.137.126.8:23915] [client 45.137.126.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/admin.php"] [unique_id "aees2l2I9THUR-bRVGzGoAAAAhY"]
[Wed Apr 22 00:59:11.440653 2026] [:error] [pid 35321:tid 35404] [client 45.137.126.29:39387] [client 45.137.126.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.29, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aees3zeHLhVUuu8cVXw-fAAAAFQ"]
[Wed Apr 22 00:59:25.866543 2026] [:error] [pid 35321:tid 35406] [client 45.137.126.29:39387] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aees7TeHLhVUuu8cVXw-0AAAAFY"]
[Wed Apr 22 00:59:29.871314 2026] [:error] [pid 35320:tid 35352] [client 45.137.126.23:50077] [client 45.137.126.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aees8YJW6fdXWO6agMFhxwAAABY"]
[Wed Apr 22 00:59:32.319987 2026] [:error] [pid 35320:tid 35339] [client 45.137.126.23:50077] [client 45.137.126.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/item.php"] [unique_id "aees9IJW6fdXWO6agMFh0gAAAAk"]
[Wed Apr 22 00:59:43.099364 2026] [:error] [pid 53978:tid 53990] [client 45.137.126.16:34859] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aees_51ivsR4hcOSQbZq_gAAAoo"]
[Wed Apr 22 00:59:56.880711 2026] [:error] [pid 53978:tid 53985] [client 45.137.126.28:53771] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aeetDJ1ivsR4hcOSQbZrCgAAAoU"]
[Wed Apr 22 01:00:01.189889 2026] [:error] [pid 53832:tid 53836] [client 45.137.126.22:57569] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aeetEdzkuxsE_OhM9UKVaQAAAkE"]
[Wed Apr 22 01:00:06.513646 2026] [:error] [pid 35320:tid 35332] [client 45.137.126.39:60229] [client 45.137.126.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.39, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-login.php"] [unique_id "aeetFoJW6fdXWO6agMFiKwAAAAI"]
[Wed Apr 22 01:00:07.713482 2026] [:error] [pid 35320:tid 35353] [client 45.137.126.39:60229] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aeetF4JW6fdXWO6agMFiLwAAABc"]
[Wed Apr 22 01:00:29.030454 2026] [:error] [pid 53978:tid 53994] [client 45.137.126.47:55383] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aeetLZ1ivsR4hcOSQbZrMgAAAo4"]
[Wed Apr 22 01:00:34.331715 2026] [:error] [pid 35320:tid 35344] [client 45.137.126.18:30507] [client 45.137.126.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.18, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aeetMoJW6fdXWO6agMFiiwAAAA4"]
[Wed Apr 22 01:00:39.160129 2026] [:error] [pid 35320:tid 35338] [client 45.137.126.18:30507] [client 45.137.126.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "aeetN4JW6fdXWO6agMFiogAAAAg"]
[Wed Apr 22 01:00:41.927607 2026] [:error] [pid 53978:tid 53992] [client 45.137.126.4:37447] [client 45.137.126.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/infi.php"] [unique_id "aeetOZ1ivsR4hcOSQbZrQgAAAow"]
[Wed Apr 22 01:00:45.710815 2026] [:error] [pid 53731:tid 53758] [client 45.137.126.15:27653] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "aeetPV2I9THUR-bRVGzHLwAAAhY"]
[Wed Apr 22 01:00:50.581654 2026] [:error] [pid 35321:tid 35394] [client 45.137.126.31:65079] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "aeetQjeHLhVUuu8cVXw_gwAAAEo"]
[Wed Apr 22 01:00:51.558995 2026] [:error] [pid 35321:tid 35391] [client 45.137.126.42:50969] [client 45.137.126.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "aeetQzeHLhVUuu8cVXw_hwAAAEc"]
[Wed Apr 22 01:00:59.021660 2026] [:error] [pid 35321:tid 35385] [client 45.137.126.13:54389] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aeetSzeHLhVUuu8cVXw_mgAAAEE"]
[Wed Apr 22 01:01:02.003099 2026] [:error] [pid 35321:tid 35387] [client 45.137.126.10:50209] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "aeetTjeHLhVUuu8cVXw_rAAAAEM"]
[Wed Apr 22 01:01:07.007799 2026] [:error] [pid 35320:tid 35341] [client 45.137.126.46:29941] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/edit.php"] [unique_id "aeetU4JW6fdXWO6agMFi4QAAAAs"]
[Wed Apr 22 01:01:12.218826 2026] [:error] [pid 35320:tid 35332] [client 45.137.126.52:51657] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aeetWIJW6fdXWO6agMFi9QAAAAI"]
[Wed Apr 22 01:01:16.291044 2026] [:error] [pid 4823:tid 4857] [client 45.137.126.37:65179] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/click.php"] [unique_id "aeetXPc8mke3PfHqsxEfmQAAAYQ"]
[Wed Apr 22 01:01:21.681716 2026] [:error] [pid 4777:tid 4807] [client 45.137.126.35:37563] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aeetYaxXur6bykKyLZTIAwAAARM"]
[Wed Apr 22 01:01:31.285814 2026] [:error] [pid 53832:tid 53844] [client 45.137.126.34:49667] [client 45.137.126.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aeeta9zkuxsE_OhM9UKVlwAAAkk"]
[Wed Apr 22 01:01:32.270576 2026] [:error] [pid 53731:tid 53760] [client 45.137.126.36:29563] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/xl2023.php"] [unique_id "aeetbF2I9THUR-bRVGzHjAAAAhg"]
[Wed Apr 22 01:01:33.248064 2026] [:error] [pid 53731:tid 53753] [client 45.137.126.52:28407] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aeetbV2I9THUR-bRVGzHjwAAAhE"]
[Wed Apr 22 01:01:34.225320 2026] [:error] [pid 53832:tid 53846] [client 45.137.126.25:32809] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aeetbtzkuxsE_OhM9UKVmQAAAks"]
[Wed Apr 22 01:01:36.957248 2026] [:error] [pid 53731:tid 53760] [client 45.137.126.29:22337] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aeetcF2I9THUR-bRVGzHngAAAhg"]
[Wed Apr 22 01:01:37.936614 2026] [:error] [pid 53978:tid 53992] [client 45.137.126.47:27951] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/index.php"] [unique_id "aeetcZ1ivsR4hcOSQbZrewAAAow"]
[Wed Apr 22 01:01:41.906122 2026] [:error] [pid 35415:tid 35444] [client 45.137.126.44:62537] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aeetdUiqDinI4_22zziL0gAAANE"]
[Wed Apr 22 01:01:42.886528 2026] [:error] [pid 35320:tid 35339] [client 45.137.126.51:53595] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/index.php"] [unique_id "aeetdoJW6fdXWO6agMFjTQAAAAk"]
[Wed Apr 22 01:01:43.858843 2026] [:error] [pid 35320:tid 35343] [client 45.137.126.33:49201] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aeetd4JW6fdXWO6agMFjUAAAAA0"]
[Wed Apr 22 01:01:46.549529 2026] [:error] [pid 35321:tid 35393] [client 45.137.126.30:25595] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/security.php"] [unique_id "aeetejeHLhVUuu8cVXw_6gAAAEk"]
[Wed Apr 22 01:01:49.241252 2026] [:error] [pid 53832:tid 53853] [client 45.137.126.25:35913] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aeetfdzkuxsE_OhM9UKVoAAAAlI"]
[Wed Apr 22 01:01:50.225524 2026] [proxy_fcgi:error] [pid 35321:tid 35397] [client 45.137.126.16:46739] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function add_action() in /home/expressi/public_html/wp-content/plugins/hello.php:69\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/plugins/hello.php on line 69'
[Wed Apr 22 01:01:53.982353 2026] [:error] [pid 35321:tid 35392] [client 45.137.126.51:46343] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/about.php"] [unique_id "aeetgTeHLhVUuu8cVXw_-gAAAEg"]
[Wed Apr 22 01:01:59.937874 2026] [:error] [pid 54080:tid 54093] [client 45.137.126.3:35063] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aeeth4zEbQHHxtmWbab1GAAAAss"]
[Wed Apr 22 01:02:10.498751 2026] [:error] [pid 35320:tid 35347] [client 45.137.126.32:65407] [client 45.137.126.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/file.php"] [unique_id "aeetkoJW6fdXWO6agMFjdgAAABE"]
[Wed Apr 22 01:02:15.387694 2026] [:error] [pid 35320:tid 35353] [client 45.137.126.52:36985] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aeetl4JW6fdXWO6agMFjiAAAABc"]
[Wed Apr 22 01:02:16.358393 2026] [:error] [pid 35321:tid 35408] [client 45.137.126.52:20255] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aeetmDeHLhVUuu8cVXxAawAAAFg"]
[Wed Apr 22 01:02:22.434666 2026] [:error] [pid 35321:tid 35406] [client 45.137.126.6:22527] [client 45.137.126.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aeetnjeHLhVUuu8cVXxAoAAAAFY"]
[Wed Apr 22 01:02:27.728538 2026] [proxy_fcgi:error] [pid 54080:tid 54101] [client 45.137.126.21:31511] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 01:02:28.217789 2026] [proxy_fcgi:error] [pid 54080:tid 54096] [client 45.137.126.21:31511] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 01:02:28.709941 2026] [proxy_fcgi:error] [pid 54080:tid 54090] [client 45.137.126.21:31511] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 01:02:33.172992 2026] [:error] [pid 54080:tid 54095] [client 45.137.126.21:31511] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/about.php"] [unique_id "aeetqYzEbQHHxtmWbab1OQAAAs0"]
[Wed Apr 22 01:02:34.182593 2026] [:error] [pid 53731:tid 53741] [client 45.137.126.28:51229] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aeetql2I9THUR-bRVGzIBQAAAgY"]
[Wed Apr 22 01:02:35.159505 2026] [:error] [pid 4823:tid 4865] [client 45.137.126.14:43511] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aeetq_c8mke3PfHqsxEfygAAAYw"]
[Wed Apr 22 01:02:36.131586 2026] [:error] [pid 53731:tid 53757] [client 45.137.126.52:53353] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aeetrF2I9THUR-bRVGzIEAAAAhU"]
[Wed Apr 22 01:02:37.111045 2026] [:error] [pid 35321:tid 35388] [client 45.137.126.21:28239] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aeetrTeHLhVUuu8cVXxA2AAAAEQ"]
[Wed Apr 22 01:02:38.081511 2026] [:error] [pid 35321:tid 35400] [client 45.137.126.40:49381] [client 45.137.126.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aeetrjeHLhVUuu8cVXxA2gAAAFA"]
[Wed Apr 22 01:02:40.046186 2026] [:error] [pid 54080:tid 54101] [client 45.137.126.27:56599] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/index.php"] [unique_id "aeetsIzEbQHHxtmWbab1PgAAAtM"]
[Wed Apr 22 01:02:41.021906 2026] [:error] [pid 35415:tid 35447] [client 45.137.126.6:28427] [client 45.137.126.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aeetsUiqDinI4_22zziL2wAAANQ"]
[Wed Apr 22 01:02:41.998424 2026] [:error] [pid 35320:tid 35353] [client 45.137.126.10:48969] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aeetsYJW6fdXWO6agMFjtQAAABc"]
[Wed Apr 22 01:02:42.973276 2026] [:error] [pid 53731:tid 53740] [client 45.137.126.8:37107] [client 45.137.126.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aeetsl2I9THUR-bRVGzIKwAAAgU"]
[Wed Apr 22 01:02:46.763243 2026] [:error] [pid 35320:tid 35353] [client 45.137.126.19:28349] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aeettoJW6fdXWO6agMFjxAAAABc"]
[Wed Apr 22 01:02:48.755447 2026] [:error] [pid 53731:tid 53750] [client 45.137.126.51:61541] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/index.php"] [unique_id "aeetuF2I9THUR-bRVGzIRAAAAg8"]
[Wed Apr 22 01:02:52.809421 2026] [:error] [pid 35320:tid 35352] [client 45.137.126.22:59773] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aeetvIJW6fdXWO6agMFj1QAAABY"]
[Wed Apr 22 01:02:56.924196 2026] [:error] [pid 53978:tid 53981] [client 45.137.126.35:42999] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/about.php"] [unique_id "aeetwJ1ivsR4hcOSQbZryQAAAoE"]
[Wed Apr 22 01:03:02.516730 2026] [:error] [pid 35320:tid 35333] [client 45.137.126.28:46933] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aeetxoJW6fdXWO6agMFj5wAAAAM"]
[Wed Apr 22 01:03:09.589310 2026] [:error] [pid 35320:tid 35344] [client 45.137.126.4:60617] [client 45.137.126.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/about.php"] [unique_id "aeetzYJW6fdXWO6agMFj_gAAAA4"]
[Wed Apr 22 01:03:12.318124 2026] [:error] [pid 53832:tid 53848] [client 45.137.126.27:51299] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-class.php"] [unique_id "aeet0NzkuxsE_OhM9UKVtQAAAk0"]
[Wed Apr 22 01:03:32.410103 2026] [:error] [pid 54080:tid 54088] [client 45.137.126.14:42905] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aeet5IzEbQHHxtmWbab1dAAAAsY"]
[Wed Apr 22 01:03:33.394446 2026] [:error] [pid 53731:tid 53756] [client 45.137.126.5:33711] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aeet5V2I9THUR-bRVGzIjgAAAhQ"]
[Wed Apr 22 01:03:36.138513 2026] [:error] [pid 54080:tid 54087] [client 45.137.126.46:52125] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aeet6IzEbQHHxtmWbab1eQAAAsU"]
[Wed Apr 22 01:03:40.240062 2026] [:error] [pid 35321:tid 35384] [client 45.137.126.32:23943] [client 45.137.126.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aeet7DeHLhVUuu8cVXxBZgAAAEA"]
[Wed Apr 22 01:03:41.210145 2026] [:error] [pid 53978:tid 53992] [client 45.137.126.11:56789] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aeet7Z1ivsR4hcOSQbZsAAAAAow"]
[Wed Apr 22 01:03:47.739248 2026] [:error] [pid 35320:tid 35343] [client 45.137.126.10:62419] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeet84JW6fdXWO6agMFkKgAAAA0"]
[Wed Apr 22 01:03:48.738292 2026] [:error] [pid 4823:tid 4875] [client 45.137.126.40:62137] [client 45.137.126.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aeet9Pc8mke3PfHqsxEf6AAAAZY"]
[Wed Apr 22 01:03:56.493247 2026] [:error] [pid 53731:tid 53748] [client 45.137.126.25:32513] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aeet_F2I9THUR-bRVGzIpwAAAg0"]
[Wed Apr 22 01:03:59.227004 2026] [proxy_fcgi:error] [pid 35320:tid 35336] [client 45.137.126.35:46051] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 01:04:01.205922 2026] [:error] [pid 35320:tid 35349] [client 45.137.126.35:46051] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/function.php"] [unique_id "aeeuAYJW6fdXWO6agMFkTAAAABM"]
[Wed Apr 22 01:04:02.178544 2026] [:error] [pid 35320:tid 35346] [client 45.137.126.30:22561] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/plugins.php"] [unique_id "aeeuAoJW6fdXWO6agMFkVAAAABA"]
[Wed Apr 22 01:04:06.194906 2026] [:error] [pid 35320:tid 35344] [client 45.137.126.34:32681] [client 45.137.126.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/chosen.php"] [unique_id "aeeuBoJW6fdXWO6agMFkaQAAAA4"]
[Wed Apr 22 01:04:07.221958 2026] [:error] [pid 53832:tid 53853] [client 45.137.126.32:42583] [client 45.137.126.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aeeuB9zkuxsE_OhM9UKV3wAAAlI"]
[Wed Apr 22 01:04:17.247706 2026] [:error] [pid 35320:tid 35351] [client 45.137.126.45:27705] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/atomlib.php"] [unique_id "aeeuEYJW6fdXWO6agMFkeAAAABU"]
[Wed Apr 22 01:04:18.226192 2026] [:error] [pid 53731:tid 53754] [client 45.137.126.40:47687] [client 45.137.126.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aeeuEl2I9THUR-bRVGzIwwAAAhI"]
[Wed Apr 22 01:04:24.889251 2026] [:error] [pid 4823:tid 4866] [client 45.137.126.35:54865] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/index.php"] [unique_id "aeeuGPc8mke3PfHqsxEf8gAAAY0"]
[Wed Apr 22 01:04:25.864062 2026] [:error] [pid 4823:tid 4859] [client 45.137.126.4:29929] [client 45.137.126.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aeeuGfc8mke3PfHqsxEf8wAAAYY"]
[Wed Apr 22 01:04:26.845958 2026] [:error] [pid 35321:tid 35400] [client 45.137.126.18:54753] [client 45.137.126.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aeeuGjeHLhVUuu8cVXxBsQAAAFA"]
[Wed Apr 22 01:04:34.877807 2026] [:error] [pid 53731:tid 53749] [client 45.137.126.28:44451] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aeeuIl2I9THUR-bRVGzIzgAAAg4"]
[Wed Apr 22 01:04:37.607741 2026] [:error] [pid 53731:tid 53736] [client 45.137.126.53:36037] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aeeuJV2I9THUR-bRVGzI0gAAAgE"]
[Wed Apr 22 01:04:47.609252 2026] [:error] [pid 35320:tid 35331] [client 45.137.126.12:63643] [client 45.137.126.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/js/wp-login.php"] [unique_id "aeeuL4JW6fdXWO6agMFkiAAAAAE"]
[Wed Apr 22 01:04:54.953287 2026] [:error] [pid 35320:tid 35349] [client 45.137.126.12:63643] [client 45.137.126.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aeeuNoJW6fdXWO6agMFklAAAABM"]
[Wed Apr 22 01:05:02.062380 2026] [:error] [pid 35320:tid 35340] [client 45.137.126.12:63643] [client 45.137.126.12] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "45.137.126.40_a55e5ff7b5a5bd370e5f2751eabd22df4ac4f3dd"): Internal error (specific information not available) [hostname "expressinteriors.com"] [uri "/index.php"] [unique_id "aeeuOoJW6fdXWO6agMFkmQAAAAo"]
[Wed Apr 22 01:05:10.513792 2026] [proxy_fcgi:error] [pid 35320:tid 35345] [client 45.137.126.12:63643] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 01:05:27.732575 2026] [:error] [pid 35320:tid 35351] [client 45.137.126.12:63643] [client 45.137.126.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/about.php"] [unique_id "aeeuV4JW6fdXWO6agMFlIQAAABU"]
[Wed Apr 22 01:05:32.917456 2026] [:error] [pid 4777:tid 4788] [client 45.137.126.38:22809] [client 45.137.126.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aeeuXKxXur6bykKyLZTIXQAAAQA"]
[Wed Apr 22 01:05:36.911091 2026] [:error] [pid 54080:tid 54103] [client 45.137.126.15:50329] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aeeuYIzEbQHHxtmWbab1xgAAAtU"]
[Wed Apr 22 01:05:49.302150 2026] [:error] [pid 35415:tid 35434] [client 45.137.126.17:49367] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aeeubUiqDinI4_22zziMAgAAAMc"]
[Wed Apr 22 01:05:53.272798 2026] [:error] [pid 53731:tid 53750] [client 45.137.126.41:61749] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aeeucV2I9THUR-bRVGzJMAAAAg8"]
[Wed Apr 22 01:05:57.458558 2026] [:error] [pid 35320:tid 35331] [client 45.137.126.4:51471] [client 45.137.126.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aeeudYJW6fdXWO6agMFlngAAAAE"]
[Wed Apr 22 01:06:04.263935 2026] [proxy_fcgi:error] [pid 35320:tid 35338] [client 45.137.126.37:39987] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 01:06:04.754145 2026] [proxy_fcgi:error] [pid 35320:tid 35347] [client 45.137.126.37:39987] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 01:06:05.239898 2026] [:error] [pid 35320:tid 35351] [client 45.137.126.37:39987] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aeeufYJW6fdXWO6agMFltwAAABU"]
[Wed Apr 22 01:06:06.218171 2026] [:error] [pid 35320:tid 35333] [client 45.137.126.35:32845] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aeeufoJW6fdXWO6agMFluAAAAAM"]
[Wed Apr 22 01:06:16.108710 2026] [:error] [pid 53731:tid 53759] [client 45.137.126.13:28207] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aeeuiF2I9THUR-bRVGzJgAAAAhc"]
[Wed Apr 22 01:06:18.807709 2026] [:error] [pid 53731:tid 53759] [client 45.137.126.46:36253] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "aeeuil2I9THUR-bRVGzJkQAAAhc"]
[Wed Apr 22 01:06:24.620430 2026] [:error] [pid 35321:tid 35394] [client 45.137.126.20:49577] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aeeukDeHLhVUuu8cVXxCqgAAAEo"]
[Wed Apr 22 01:06:34.628924 2026] [:error] [pid 54080:tid 54095] [client 45.137.126.17:28063] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aeeumozEbQHHxtmWbab2EgAAAs0"]
[Wed Apr 22 01:06:35.630596 2026] [proxy_fcgi:error] [pid 53731:tid 53737] [client 45.137.126.35:54395] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 01:06:39.181933 2026] [:error] [pid 53731:tid 53748] [client 45.137.126.35:54395] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aeeun12I9THUR-bRVGzJ4AAAAg0"]
[Wed Apr 22 01:06:46.643953 2026] [proxy_fcgi:error] [pid 35320:tid 35340] [client 45.137.126.49:45707] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 01:06:48.413353 2026] [:error] [pid 35320:tid 35331] [client 45.137.126.49:45707] [client 45.137.126.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.49, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aeeuqIJW6fdXWO6agMFmNwAAAAE"]
[Wed Apr 22 01:06:54.457544 2026] [:error] [pid 35320:tid 35345] [client 45.137.126.49:45707] [client 45.137.126.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aeeuroJW6fdXWO6agMFmUAAAAA8"]
[Wed Apr 22 01:06:57.151085 2026] [:error] [pid 35321:tid 35405] [client 45.137.126.35:40779] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aeeusTeHLhVUuu8cVXxC7AAAAFU"]
[Wed Apr 22 01:07:03.576810 2026] [:error] [pid 35321:tid 35384] [client 45.137.126.42:30669] [client 45.137.126.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aeeutzeHLhVUuu8cVXxDFgAAAEA"]
[Wed Apr 22 01:07:08.650091 2026] [:error] [pid 35320:tid 35354] [client 45.137.126.35:35067] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aeeuvIJW6fdXWO6agMFmaQAAABg"]
[Wed Apr 22 01:07:09.622168 2026] [:error] [pid 4823:tid 4875] [client 45.137.126.12:40965] [client 45.137.126.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aeeuvfc8mke3PfHqsxEgTQAAAZY"]
[Wed Apr 22 01:07:14.781022 2026] [:error] [pid 35320:tid 35342] [client 45.137.126.20:58843] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aeeuwoJW6fdXWO6agMFmiwAAAAw"]
[Wed Apr 22 01:07:18.808856 2026] [proxy_fcgi:error] [pid 4777:tid 4811] [client 45.137.126.26:49297] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 01:07:19.294800 2026] [:error] [pid 4777:tid 4805] [client 45.137.126.26:49297] [client 45.137.126.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aeeux6xXur6bykKyLZTIigAAARE"]
[Wed Apr 22 01:07:20.277942 2026] [proxy_fcgi:error] [pid 35321:tid 35395] [client 45.137.126.29:39979] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function add_action() in /home/expressi/public_html/wp-content/themes/twentytwentyfour/functions.php:147\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/themes/twentytwentyfour/functions.php on line 147'
[Wed Apr 22 01:07:21.252996 2026] [:error] [pid 54080:tid 54100] [client 45.137.126.46:52429] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/db.php"] [unique_id "aeeuyYzEbQHHxtmWbab2KQAAAtI"]
[Wed Apr 22 01:07:22.228019 2026] [:error] [pid 35320:tid 35349] [client 45.137.126.16:24641] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aeeuyoJW6fdXWO6agMFmpgAAABM"]
[Wed Apr 22 01:07:23.209191 2026] [:error] [pid 35320:tid 35331] [client 45.137.126.8:33545] [client 45.137.126.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aeeuy4JW6fdXWO6agMFmrQAAAAE"]
[Wed Apr 22 01:07:24.182392 2026] [:error] [pid 53731:tid 53735] [client 45.137.126.43:22675] [client 45.137.126.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aeeuzF2I9THUR-bRVGzKIQAAAgA"]
[Wed Apr 22 01:07:25.159081 2026] [:error] [pid 35320:tid 35333] [client 45.137.126.10:30579] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aeeuzYJW6fdXWO6agMFmtQAAAAM"]
[Wed Apr 22 01:07:26.142682 2026] [:error] [pid 35320:tid 35331] [client 45.137.126.23:45499] [client 45.137.126.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aeeuzoJW6fdXWO6agMFmuQAAAAE"]
[Wed Apr 22 01:07:30.219220 2026] [:error] [pid 53978:tid 53987] [client 45.137.126.18:40677] [client 45.137.126.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aeeu0p1ivsR4hcOSQbZs7wAAAoc"]
[Wed Apr 22 01:07:31.398847 2026] [:error] [pid 35320:tid 35347] [client 45.137.126.37:40617] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aeeu04JW6fdXWO6agMFmzAAAABE"]
[Wed Apr 22 01:07:32.372929 2026] [:error] [pid 35321:tid 35392] [client 45.137.126.29:32831] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aeeu1DeHLhVUuu8cVXxDNwAAAEg"]
[Wed Apr 22 01:07:33.346277 2026] [:error] [pid 53978:tid 53980] [client 45.137.126.22:50271] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aeeu1Z1ivsR4hcOSQbZs8gAAAoA"]
[Wed Apr 22 01:07:34.321270 2026] [:error] [pid 35321:tid 35402] [client 45.137.126.33:57209] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/options.php"] [unique_id "aeeu1jeHLhVUuu8cVXxDOgAAAFI"]
[Wed Apr 22 01:07:35.303024 2026] [proxy_fcgi:error] [pid 35321:tid 35407] [client 45.137.126.20:24927] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 01:07:38.829898 2026] [:error] [pid 35321:tid 35403] [client 45.137.126.20:24927] [client 45.137.126.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.20, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aeeu2jeHLhVUuu8cVXxDRgAAAFM"]
[Wed Apr 22 01:07:44.973458 2026] [:error] [pid 35321:tid 35408] [client 45.137.126.20:24927] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aeeu4DeHLhVUuu8cVXxDdQAAAFg"]
[Wed Apr 22 01:08:05.455274 2026] [:error] [pid 53832:tid 53842] [client 45.137.126.40:29529] [client 45.137.126.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aeeu9dzkuxsE_OhM9UKWhgAAAkc"]
[Wed Apr 22 01:08:06.434444 2026] [:error] [pid 35320:tid 35352] [client 45.137.126.50:61117] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aeeu9oJW6fdXWO6agMFnWwAAABY"]
[Wed Apr 22 01:08:07.407261 2026] [:error] [pid 35320:tid 35353] [client 45.137.126.51:61915] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aeeu94JW6fdXWO6agMFnYwAAABc"]
[Wed Apr 22 01:08:16.253990 2026] [:error] [pid 35322:tid 35365] [client 45.137.126.34:27257] [client 45.137.126.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aeevAKPoAfV40BTfVKzuqwAAAIg"]
[Wed Apr 22 01:08:17.226571 2026] [:error] [pid 4823:tid 4866] [client 45.137.126.22:28531] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aeevAfc8mke3PfHqsxEgdAAAAY0"]
[Wed Apr 22 01:08:18.205966 2026] [:error] [pid 4823:tid 4877] [client 45.137.126.47:28655] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aeevAvc8mke3PfHqsxEgdQAAAZg"]
[Wed Apr 22 01:08:24.450853 2026] [:error] [pid 35320:tid 35334] [client 45.137.126.29:33883] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aeevCIJW6fdXWO6agMFnoQAAAAQ"]
[Wed Apr 22 01:08:27.162001 2026] [:error] [pid 4777:tid 4806] [client 45.137.126.38:54615] [client 45.137.126.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aeevC6xXur6bykKyLZTIsQAAARI"]
[Wed Apr 22 01:08:31.200667 2026] [:error] [pid 53731:tid 53741] [client 45.137.126.28:45701] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aeevD12I9THUR-bRVGzKngAAAgY"]
[Wed Apr 22 01:08:46.261372 2026] [:error] [pid 54080:tid 54098] [client 45.137.126.18:24339] [client 45.137.126.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/index.php"] [unique_id "aeevHozEbQHHxtmWbab2ngAAAtA"]
[Wed Apr 22 01:08:49.007677 2026] [:error] [pid 35320:tid 35337] [client 45.137.126.47:51907] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/about.php"] [unique_id "aeevIYJW6fdXWO6agMFn1QAAAAc"]
[Wed Apr 22 01:08:59.783050 2026] [:error] [pid 35320:tid 35343] [client 45.137.126.25:22727] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-sup.php"] [unique_id "aeevK4JW6fdXWO6agMFoAgAAAA0"]
[Wed Apr 22 01:09:03.786864 2026] [:error] [pid 53832:tid 53838] [client 45.137.126.25:21681] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aeevL9zkuxsE_OhM9UKWrAAAAkM"]
[Wed Apr 22 01:09:10.191047 2026] [:error] [pid 4777:tid 4805] [client 45.137.126.15:63091] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aeevNqxXur6bykKyLZTIzQAAARE"]
[Wed Apr 22 01:09:16.388773 2026] [:error] [pid 54080:tid 54090] [client 45.137.126.28:64043] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aeevPIzEbQHHxtmWbab20gAAAsg"]
[Wed Apr 22 01:09:20.375202 2026] [:error] [pid 35321:tid 35406] [client 45.137.126.26:22689] [client 45.137.126.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aeevQDeHLhVUuu8cVXxECwAAAFY"]
[Wed Apr 22 01:09:21.372499 2026] [:error] [pid 53731:tid 53740] [client 45.137.126.31:54631] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aeevQV2I9THUR-bRVGzK1QAAAgU"]
[Wed Apr 22 01:09:29.103786 2026] [:error] [pid 53832:tid 53847] [client 45.137.126.14:59697] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aeevSdzkuxsE_OhM9UKWygAAAkw"]
[Wed Apr 22 01:09:36.427688 2026] [:error] [pid 35320:tid 35349] [client 45.137.126.30:55147] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aeevUIJW6fdXWO6agMFoSAAAABM"]
[Wed Apr 22 01:09:42.856924 2026] [:error] [pid 4823:tid 4857] [client 45.137.126.43:60049] [client 45.137.126.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aeevVvc8mke3PfHqsxEglQAAAYQ"]
[Wed Apr 22 01:09:43.852223 2026] [:error] [pid 53978:tid 53987] [client 45.137.126.47:41715] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aeevV51ivsR4hcOSQbZtnQAAAoc"]
[Wed Apr 22 01:09:46.597951 2026] [:error] [pid 35322:tid 35358] [client 45.137.126.28:52143] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aeevWqPoAfV40BTfVKzuvAAAAIE"]
[Wed Apr 22 01:09:50.538385 2026] [:error] [pid 35320:tid 35339] [client 45.137.126.33:57447] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/install.php"] [unique_id "aeevXoJW6fdXWO6agMFoYgAAAAk"]
[Wed Apr 22 01:09:51.522737 2026] [:error] [pid 53978:tid 54003] [client 45.137.126.33:52745] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aeevX51ivsR4hcOSQbZtpQAAApc"]
[Wed Apr 22 01:10:00.452912 2026] [:error] [pid 53731:tid 53752] [client 45.137.126.5:50807] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/category-double.php"] [unique_id "aeevaF2I9THUR-bRVGzLJQAAAhA"]
[Wed Apr 22 01:10:05.037408 2026] [:error] [pid 54080:tid 54100] [client 45.137.126.8:42599] [client 45.137.126.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/db.php"] [unique_id "aeevbYzEbQHHxtmWbab3FAAAAtI"]
[Wed Apr 22 01:10:06.016384 2026] [:error] [pid 53731:tid 53740] [client 45.137.126.3:49903] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/security.php"] [unique_id "aeevbl2I9THUR-bRVGzLNgAAAgU"]
[Wed Apr 22 01:10:10.255972 2026] [:error] [pid 35320:tid 35350] [client 45.137.126.4:46477] [client 45.137.126.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aeevcoJW6fdXWO6agMFojAAAABQ"]
[Wed Apr 22 01:10:12.955331 2026] [:error] [pid 54080:tid 54105] [client 45.137.126.22:21383] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aeevdIzEbQHHxtmWbab3HgAAAtc"]
[Wed Apr 22 01:10:20.488665 2026] [:error] [pid 35321:tid 35390] [client 45.137.126.22:56803] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aeevfDeHLhVUuu8cVXxEkAAAAEY"]
[Wed Apr 22 01:10:24.526780 2026] [:error] [pid 53978:tid 53991] [client 45.137.126.26:31619] [client 45.137.126.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aeevgJ1ivsR4hcOSQbZtxwAAAos"]
[Wed Apr 22 01:10:28.516497 2026] [:error] [pid 35321:tid 35390] [client 45.137.126.41:59509] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aeevhDeHLhVUuu8cVXxEqQAAAEY"]
[Wed Apr 22 01:10:31.358445 2026] [:error] [pid 35321:tid 35387] [client 45.137.126.25:64367] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/as.php"] [unique_id "aeevhzeHLhVUuu8cVXxEtgAAAEM"]
[Wed Apr 22 01:10:34.116472 2026] [:error] [pid 53978:tid 54004] [client 45.137.126.50:21979] [client 45.137.126.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aeevip1ivsR4hcOSQbZt1QAAApg"]
[Wed Apr 22 01:10:35.123931 2026] [:error] [pid 35415:tid 35439] [client 45.137.126.27:43061] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/install.php"] [unique_id "aeevi0iqDinI4_22zziMZAAAAMw"]
[Wed Apr 22 01:10:36.102425 2026] [:error] [pid 35321:tid 35404] [client 45.137.126.3:54695] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/db.php"] [unique_id "aeevjDeHLhVUuu8cVXxEwgAAAFQ"]
[Wed Apr 22 01:10:44.977583 2026] [:error] [pid 35320:tid 35347] [client 45.137.126.21:46059] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aeevlIJW6fdXWO6agMFovAAAABE"]
[Wed Apr 22 01:10:50.266132 2026] [:error] [pid 35320:tid 35335] [client 45.137.126.46:48959] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rk2.php"] [unique_id "aeevmoJW6fdXWO6agMFo1AAAAAU"]
[Wed Apr 22 01:10:54.484031 2026] [:error] [pid 35321:tid 35385] [client 45.137.126.32:51029] [client 45.137.126.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/past.php"] [unique_id "aeevnjeHLhVUuu8cVXxE8AAAAEE"]
[Wed Apr 22 01:10:58.472883 2026] [:error] [pid 53731:tid 53758] [client 45.137.126.21:51779] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/edit-tags.php"] [unique_id "aeevol2I9THUR-bRVGzLtwAAAhY"]
[Wed Apr 22 01:11:06.156124 2026] [:error] [pid 54080:tid 54086] [client 45.137.126.30:34083] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aeevqozEbQHHxtmWbab3UQAAAsQ"]
[Wed Apr 22 01:11:08.950919 2026] [:error] [pid 4823:tid 4874] [client 45.137.126.37:37565] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aeevrPc8mke3PfHqsxEgzAAAAZU"]
[Wed Apr 22 01:11:11.698736 2026] [:error] [pid 53731:tid 53760] [client 45.137.126.39:59561] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aeevr12I9THUR-bRVGzL3QAAAhg"]
[Wed Apr 22 01:11:15.785041 2026] [:error] [pid 53731:tid 53736] [client 45.137.126.18:37881] [client 45.137.126.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aeevs12I9THUR-bRVGzL6wAAAgE"]
[Wed Apr 22 01:11:27.211461 2026] [:error] [pid 53731:tid 53755] [client 45.137.126.22:24693] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aeevv12I9THUR-bRVGzMCwAAAhM"]
[Wed Apr 22 01:11:28.194503 2026] [:error] [pid 35321:tid 35387] [client 45.137.126.17:44179] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aeevwDeHLhVUuu8cVXxFGAAAAEM"]
[Wed Apr 22 01:11:33.199742 2026] [:error] [pid 35320:tid 35347] [client 45.137.126.27:43711] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aeevxYJW6fdXWO6agMFpHwAAABE"]
[Wed Apr 22 01:11:34.181795 2026] [:error] [pid 4823:tid 4865] [client 45.137.126.45:34707] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aeevxvc8mke3PfHqsxEg_QAAAYw"]
[Wed Apr 22 01:11:38.217818 2026] [:error] [pid 35322:tid 35374] [client 45.137.126.38:40347] [client 45.137.126.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aeevyqPoAfV40BTfVKzu0gAAAJE"]
[Wed Apr 22 01:11:39.210440 2026] [:error] [pid 35321:tid 35388] [client 45.137.126.13:55933] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ms-file.php"] [unique_id "aeevyzeHLhVUuu8cVXxFHgAAAEQ"]
[Wed Apr 22 01:11:40.192778 2026] [:error] [pid 35415:tid 35432] [client 45.137.126.45:22219] [client 45.137.126.45] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.45, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aeevzEiqDinI4_22zziMdgAAAMU"]
[Wed Apr 22 01:11:40.196886 2026] [proxy_fcgi:error] [pid 35415:tid 35432] [client 45.137.126.45:22219] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 01:11:40.687424 2026] [:error] [pid 35415:tid 35431] [client 45.137.126.45:22219] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/av.php"] [unique_id "aeevzEiqDinI4_22zziMdwAAAMQ"]
[Wed Apr 22 01:11:44.411007 2026] [:error] [pid 53978:tid 53988] [client 45.137.126.47:44965] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aeev0J1ivsR4hcOSQbZuHQAAAog"]
[Wed Apr 22 01:11:45.396124 2026] [:error] [pid 53731:tid 53744] [client 45.137.126.13:49175] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/network.php"] [unique_id "aeev0V2I9THUR-bRVGzMFgAAAgk"]
[Wed Apr 22 01:11:55.304350 2026] [:error] [pid 35321:tid 35385] [client 45.137.126.52:34333] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aeev2zeHLhVUuu8cVXxFOgAAAEE"]
[Wed Apr 22 01:11:56.299417 2026] [:error] [pid 35321:tid 35389] [client 45.137.126.9:42087] [client 45.137.126.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/item.php"] [unique_id "aeev3DeHLhVUuu8cVXxFPgAAAEU"]
[Wed Apr 22 01:11:59.378827 2026] [:error] [pid 35320:tid 35331] [client 45.137.126.8:45477] [client 45.137.126.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aeev34JW6fdXWO6agMFpYAAAAAE"]
[Wed Apr 22 01:12:00.360014 2026] [:error] [pid 35320:tid 35352] [client 45.137.126.8:41551] [client 45.137.126.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/install.php"] [unique_id "aeev4IJW6fdXWO6agMFpZwAAABY"]
[Wed Apr 22 01:12:01.350489 2026] [proxy_fcgi:error] [pid 35321:tid 35385] [client 45.137.126.49:21237] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 01:12:01.894420 2026] [:error] [pid 35321:tid 35393] [client 45.137.126.49:21237] [client 45.137.126.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.49, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aeev4TeHLhVUuu8cVXxFTQAAAEk"]
[Wed Apr 22 01:12:04.980543 2026] [:error] [pid 35321:tid 35408] [client 45.137.126.49:21237] [client 45.137.126.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aeev5DeHLhVUuu8cVXxFVgAAAFg"]
[Wed Apr 22 01:12:10.032041 2026] [:error] [pid 35320:tid 35346] [client 45.137.126.38:32581] [client 45.137.126.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aeev6oJW6fdXWO6agMFpnAAAABA"]
[Wed Apr 22 01:12:12.834811 2026] [:error] [pid 4823:tid 4870] [client 45.137.126.16:31869] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aeev7Pc8mke3PfHqsxEhOAAAAZE"]
[Wed Apr 22 01:12:13.817247 2026] [:error] [pid 35320:tid 35350] [client 45.137.126.22:24177] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aeev7YJW6fdXWO6agMFprQAAABQ"]
[Wed Apr 22 01:12:19.100079 2026] [:error] [pid 53978:tid 53990] [client 45.137.126.49:25323] [client 45.137.126.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aeev851ivsR4hcOSQbZuQQAAAoo"]
[Wed Apr 22 01:12:23.159570 2026] [:error] [pid 35321:tid 35408] [client 45.137.126.49:25221] [client 45.137.126.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/about.php"] [unique_id "aeev9zeHLhVUuu8cVXxFbgAAAFg"]
[Wed Apr 22 01:12:29.479823 2026] [:error] [pid 35321:tid 35392] [client 45.137.126.16:54239] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aeev_TeHLhVUuu8cVXxFfwAAAEg"]
[Wed Apr 22 01:12:30.461394 2026] [:error] [pid 53978:tid 53992] [client 45.137.126.17:48621] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bypass.php"] [unique_id "aeev_p1ivsR4hcOSQbZuRgAAAow"]
[Wed Apr 22 01:12:33.238183 2026] [:error] [pid 54080:tid 54090] [client 45.137.126.30:33263] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/count.php"] [unique_id "aeewAYzEbQHHxtmWbab3ewAAAsg"]
[Wed Apr 22 01:12:41.900942 2026] [:error] [pid 35321:tid 35387] [client 45.137.126.24:56807] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aeewCTeHLhVUuu8cVXxFnAAAAEM"]
[Wed Apr 22 01:12:45.863253 2026] [:error] [pid 53731:tid 53736] [client 45.137.126.31:50173] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "expressinteriors.com"] [uri "/images/stories/themes.php"] [unique_id "aeewDV2I9THUR-bRVGzMXQAAAgE"]
[Wed Apr 22 01:12:46.348950 2026] [:error] [pid 53731:tid 53750] [client 45.137.126.31:50173] [client 45.137.126.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aeewDl2I9THUR-bRVGzMXwAAAg8"]
[Wed Apr 22 01:12:50.362981 2026] [:error] [pid 35320:tid 35339] [client 45.137.126.44:24979] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aeewEoJW6fdXWO6agMFp-gAAAAk"]
[Wed Apr 22 01:12:51.332221 2026] [:error] [pid 4777:tid 4793] [client 45.137.126.7:25735] [client 45.137.126.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/vars-soap.php"] [unique_id "aeewE6xXur6bykKyLZTJIAAAAQU"]
[Wed Apr 22 01:13:00.113479 2026] [:error] [pid 53731:tid 53738] [client 45.137.126.29:47249] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aeewHF2I9THUR-bRVGzMgAAAAgM"]
[Wed Apr 22 01:13:04.276050 2026] [:error] [pid 35320:tid 35337] [client 45.137.126.16:35343] [client 45.137.126.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aeewIIJW6fdXWO6agMFqLQAAAAc"]
[Wed Apr 22 01:13:08.005995 2026] [:error] [pid 35320:tid 35352] [client 45.137.126.10:27063] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aeewJIJW6fdXWO6agMFqPAAAABY"]
[Wed Apr 22 01:13:15.714353 2026] [:error] [pid 53832:tid 53848] [client 45.137.126.51:62491] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aeewK9zkuxsE_OhM9UKXfwAAAk0"]
[Wed Apr 22 01:13:16.689777 2026] [:error] [pid 35321:tid 35385] [client 45.137.126.46:35325] [client 45.137.126.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/colour.php"] [unique_id "aeewLDeHLhVUuu8cVXxFwwAAAEE"]
[Wed Apr 22 01:13:19.407144 2026] [:error] [pid 54080:tid 54083] [client 45.137.126.39:29189] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aeewL4zEbQHHxtmWbab3lwAAAsE"]
[Wed Apr 22 01:13:20.383266 2026] [:error] [pid 53731:tid 53745] [client 45.137.126.35:51183] [client 45.137.126.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/include.php"] [unique_id "aeewMF2I9THUR-bRVGzMpwAAAgo"]
[Wed Apr 22 01:13:24.355404 2026] [:error] [pid 35320:tid 35353] [client 45.137.126.44:23549] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aeewNIJW6fdXWO6agMFqYgAAABc"]
[Wed Apr 22 01:13:28.299181 2026] [:error] [pid 35320:tid 35333] [client 45.137.126.38:33649] [client 45.137.126.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aeewOIJW6fdXWO6agMFqcgAAAAM"]
[Wed Apr 22 01:13:29.287046 2026] [:error] [pid 35320:tid 35342] [client 45.137.126.3:40201] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about5.php"] [unique_id "aeewOYJW6fdXWO6agMFqdwAAAAw"]
[Wed Apr 22 01:13:35.680899 2026] [:error] [pid 35322:tid 35377] [client 45.137.126.20:40833] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/db.php"] [unique_id "aeewP6PoAfV40BTfVKzu8gAAAJQ"]
[Wed Apr 22 01:13:39.653757 2026] [:error] [pid 35320:tid 35346] [client 45.137.126.42:38821] [client 45.137.126.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aeewQ4JW6fdXWO6agMFq3gAAABA"]
[Wed Apr 22 01:13:44.846717 2026] [:error] [pid 35321:tid 35386] [client 45.137.126.29:32473] [client 45.137.126.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aeewSDeHLhVUuu8cVXxGEgAAAEI"]
[Wed Apr 22 01:13:45.831592 2026] [:error] [pid 35415:tid 35441] [client 45.137.126.44:58029] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aeewSUiqDinI4_22zziMogAAAM4"]
[Wed Apr 22 01:13:46.805357 2026] [:error] [pid 4823:tid 4858] [client 45.137.126.21:36401] [client 45.137.126.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aeewSvc8mke3PfHqsxEhbQAAAYU"]
[Wed Apr 22 01:13:50.704927 2026] [:error] [pid 35320:tid 35354] [client 45.137.126.39:22407] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aeewToJW6fdXWO6agMFq9gAAABg"]
[Wed Apr 22 01:13:54.755795 2026] [:error] [pid 53832:tid 53840] [client 45.137.126.52:38009] [client 45.137.126.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aeewUtzkuxsE_OhM9UKXtQAAAkU"]
[Wed Apr 22 01:13:55.731645 2026] [:error] [pid 53832:tid 53838] [client 45.137.126.10:30635] [client 45.137.126.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aeewU9zkuxsE_OhM9UKXuAAAAkM"]
[Wed Apr 22 01:13:58.497902 2026] [:error] [pid 53978:tid 53986] [client 45.137.126.24:50187] [client 45.137.126.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/about.php"] [unique_id "aeewVp1ivsR4hcOSQbZuoQAAAoY"]
[Wed Apr 22 01:13:59.476627 2026] [:error] [pid 53731:tid 53740] [client 45.137.126.11:62503] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/simi.php"] [unique_id "aeewV12I9THUR-bRVGzM-QAAAgU"]
[Wed Apr 22 01:14:03.553741 2026] [:error] [pid 35320:tid 35341] [client 45.137.126.45:53395] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aeewW4JW6fdXWO6agMFrCQAAAAs"]
[Wed Apr 22 01:14:05.527731 2026] [:error] [pid 4777:tid 4801] [client 45.137.126.51:28917] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aeewXaxXur6bykKyLZTJTAAAAQ0"]
[Wed Apr 22 01:14:06.502012 2026] [:error] [pid 53832:tid 53842] [client 45.137.126.19:52659] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aeewXtzkuxsE_OhM9UKX1gAAAkc"]
[Wed Apr 22 01:14:07.473574 2026] [:error] [pid 35320:tid 35347] [client 45.137.126.42:45771] [client 45.137.126.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aeewX4JW6fdXWO6agMFrDAAAABE"]
[Wed Apr 22 01:14:11.628790 2026] [:error] [pid 35320:tid 35334] [client 45.137.126.18:49935] [client 45.137.126.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aeewY4JW6fdXWO6agMFrIwAAAAQ"]
[Wed Apr 22 01:14:15.670167 2026] [:error] [pid 53978:tid 53990] [client 45.137.126.13:39473] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aeewZ51ivsR4hcOSQbZuqAAAAoo"]
[Wed Apr 22 01:14:18.373692 2026] [:error] [pid 35320:tid 35348] [client 45.137.126.18:64145] [client 45.137.126.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aeewaoJW6fdXWO6agMFrVAAAABI"]
[Wed Apr 22 01:14:19.359020 2026] [proxy_fcgi:error] [pid 35321:tid 35399] [client 45.137.126.40:58519] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_locale() in /home/expressi/public_html/wp-admin/includes/admin.php:16\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-admin/includes/admin.php on line 16'
[Wed Apr 22 01:14:20.328915 2026] [:error] [pid 4823:tid 4864] [client 45.137.126.44:39989] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aeewbPc8mke3PfHqsxEhhAAAAYs"]
[Wed Apr 22 01:14:29.029427 2026] [:error] [pid 53978:tid 54004] [client 45.137.126.34:43143] [client 45.137.126.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/plugin.php"] [unique_id "aeewdZ1ivsR4hcOSQbZuxgAAApg"]
[Wed Apr 22 01:14:30.001673 2026] [:error] [pid 53731:tid 53753] [client 45.137.126.22:33055] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aeewdl2I9THUR-bRVGzNKAAAAhE"]
[Wed Apr 22 01:14:33.976980 2026] [:error] [pid 35321:tid 35384] [client 45.137.126.25:33633] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aeeweTeHLhVUuu8cVXxGXgAAAEA"]
[Wed Apr 22 01:14:40.792803 2026] [:error] [pid 4777:tid 4792] [client 45.137.126.41:29421] [client 45.137.126.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aeewgKxXur6bykKyLZTJZAAAAQQ"]
[Wed Apr 22 01:14:44.739609 2026] [:error] [pid 35321:tid 35403] [client 45.137.126.37:57965] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aeewhDeHLhVUuu8cVXxGfwAAAFM"]
[Wed Apr 22 01:14:48.348281 2026] [:error] [pid 35321:tid 35396] [client 45.137.126.3:51279] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aeewiDeHLhVUuu8cVXxGhQAAAEw"]
[Wed Apr 22 01:14:51.130137 2026] [:error] [pid 35320:tid 35332] [client 45.137.126.8:60135] [client 45.137.126.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aeewi4JW6fdXWO6agMFroQAAAAI"]
[Wed Apr 22 01:14:53.880884 2026] [:error] [pid 53731:tid 53739] [client 45.137.126.39:38701] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aeewjV2I9THUR-bRVGzNQQAAAgQ"]
[Wed Apr 22 01:15:00.281027 2026] [:error] [pid 54080:tid 54085] [client 45.137.126.39:25699] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aeewlIzEbQHHxtmWbab4MwAAAsM"]
[Wed Apr 22 01:15:05.693558 2026] [:error] [pid 35321:tid 35385] [client 45.137.126.22:21387] [client 45.137.126.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aeewmTeHLhVUuu8cVXxGnwAAAEE"]
[Wed Apr 22 01:15:06.676102 2026] [proxy_fcgi:error] [pid 54080:tid 54082] [client 45.137.126.15:45469] AH01071: Got error 'Primary script unknown'
[Wed Apr 22 01:15:07.163557 2026] [:error] [pid 54080:tid 54099] [client 45.137.126.15:45469] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aeewm4zEbQHHxtmWbab4RAAAAtE"]
[Wed Apr 22 01:15:08.139362 2026] [:error] [pid 35320:tid 35332] [client 45.137.126.37:27571] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aeewnIJW6fdXWO6agMFrxwAAAAI"]
[Wed Apr 22 01:15:12.256560 2026] [:error] [pid 35320:tid 35346] [client 45.137.126.20:60787] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aeewoIJW6fdXWO6agMFr4wAAABA"]
[Wed Apr 22 01:15:13.235182 2026] [:error] [pid 53731:tid 53748] [client 45.137.126.25:34613] [client 45.137.126.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aeewoV2I9THUR-bRVGzNVwAAAg0"]
[Wed Apr 22 01:15:21.815354 2026] [:error] [pid 35322:tid 35377] [client 45.137.126.45:24793] [client 45.137.126.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-2019.php"] [unique_id "aeewqaPoAfV40BTfVKzvJAAAAJQ"]
[Wed Apr 22 01:15:22.792756 2026] [:error] [pid 35415:tid 35429] [client 45.137.126.15:49629] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aeewqkiqDinI4_22zziM0gAAAMI"]
[Wed Apr 22 01:15:25.526527 2026] [:error] [pid 35322:tid 35361] [client 45.137.126.39:34027] [client 45.137.126.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/log.php"] [unique_id "aeewraPoAfV40BTfVKzvKAAAAIQ"]
[Wed Apr 22 01:15:26.508879 2026] [:error] [pid 53978:tid 54003] [client 45.137.126.36:57659] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aeewrp1ivsR4hcOSQbZu8gAAApc"]
[Wed Apr 22 01:15:27.477719 2026] [:error] [pid 53731:tid 53758] [client 45.137.126.33:56159] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aeewr12I9THUR-bRVGzNgAAAAhY"]
[Wed Apr 22 01:15:28.450388 2026] [:error] [pid 54080:tid 54085] [client 45.137.126.30:31053] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/aw.php"] [unique_id "aeewsIzEbQHHxtmWbab4cQAAAsM"]
[Wed Apr 22 01:15:35.024728 2026] [:error] [pid 4777:tid 4811] [client 45.137.126.51:22379] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/db.php"] [unique_id "aeewt6xXur6bykKyLZTJpQAAARc"]
[Wed Apr 22 01:15:35.999907 2026] [:error] [pid 35320:tid 35334] [client 45.137.126.38:59605] [client 45.137.126.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/install.php"] [unique_id "aeewt4JW6fdXWO6agMFsKQAAAAQ"]
[Wed Apr 22 01:15:39.685322 2026] [:error] [pid 53832:tid 53847] [client 45.137.126.9:29251] [client 45.137.126.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aeewu9zkuxsE_OhM9UKYmQAAAkw"]
[Wed Apr 22 01:15:40.659122 2026] [:error] [pid 35320:tid 35340] [client 45.137.126.51:31039] [client 45.137.126.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aeewvIJW6fdXWO6agMFsMwAAAAo"]
[Wed Apr 22 01:15:44.629446 2026] [:error] [pid 35321:tid 35386] [client 45.137.126.14:47875] [client 45.137.126.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/template-less.php"] [unique_id "aeewwDeHLhVUuu8cVXxG3AAAAEI"]
[Wed Apr 22 01:15:45.603001 2026] [:error] [pid 4777:tid 4800] [client 45.137.126.19:53009] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aeewwaxXur6bykKyLZTJqwAAAQw"]
[Wed Apr 22 01:15:56.586229 2026] [:error] [pid 35415:tid 35448] [client 45.137.126.53:28189] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/min.php"] [unique_id "aeewzEiqDinI4_22zziM5wAAANU"]
[Wed Apr 22 01:15:57.555853 2026] [:error] [pid 4823:tid 4865] [client 45.137.126.53:58943] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aeewzfc8mke3PfHqsxEiKwAAAYw"]
[Wed Apr 22 01:16:01.584002 2026] [:error] [pid 53832:tid 53853] [client 45.137.126.18:33315] [client 45.137.126.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/file.php"] [unique_id "aeew0dzkuxsE_OhM9UKYqAAAAlI"]
[Wed Apr 22 01:16:04.361931 2026] [:error] [pid 35320:tid 35354] [client 45.137.126.27:24153] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aeew1IJW6fdXWO6agMFsgAAAABg"]
[Wed Apr 22 01:16:07.096475 2026] [:error] [pid 53978:tid 53993] [client 45.137.126.20:49625] [client 45.137.126.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/load.php"] [unique_id "aeew151ivsR4hcOSQbZvAgAAAo0"]
[Wed Apr 22 01:16:08.071684 2026] [:error] [pid 35321:tid 35397] [client 45.137.126.17:27073] [client 45.137.126.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aeew2DeHLhVUuu8cVXxHBAAAAE0"]
[Wed Apr 22 01:16:09.047733 2026] [:error] [pid 35320:tid 35342] [client 45.137.126.5:39565] [client 45.137.126.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aeew2YJW6fdXWO6agMFsjAAAAAw"]
[Wed Apr 22 01:16:14.525919 2026] [:error] [pid 35320:tid 35340] [client 45.137.126.15:23085] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aeew3oJW6fdXWO6agMFssAAAAAo"]
[Wed Apr 22 01:16:17.206484 2026] [:error] [pid 53731:tid 53747] [client 45.137.126.28:59409] [client 45.137.126.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aeew4V2I9THUR-bRVGzN2gAAAgw"]
[Wed Apr 22 01:16:21.166929 2026] [:error] [pid 35320:tid 35331] [client 45.137.126.44:40787] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aeew5YJW6fdXWO6agMFszwAAAAE"]
[Wed Apr 22 01:16:22.139299 2026] [:error] [pid 53832:tid 53835] [client 45.137.126.19:36723] [client 45.137.126.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aeew5tzkuxsE_OhM9UKYsgAAAkA"]
[Wed Apr 22 01:16:23.110445 2026] [:error] [pid 53978:tid 53991] [client 45.137.126.3:28133] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aeew551ivsR4hcOSQbZvBgAAAos"]
[Wed Apr 22 01:16:34.169388 2026] [:error] [pid 35320:tid 35350] [client 45.137.126.44:36731] [client 45.137.126.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/system.php"] [unique_id "aeew8oJW6fdXWO6agMFs7QAAABQ"]
[Wed Apr 22 01:16:36.159204 2026] [:error] [pid 35320:tid 35344] [client 45.137.126.53:41561] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aeew9IJW6fdXWO6agMFs8wAAAA4"]
[Wed Apr 22 01:16:40.155849 2026] [:error] [pid 35320:tid 35353] [client 45.137.126.53:22893] [client 45.137.126.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "aeew-IJW6fdXWO6agMFs_gAAABc"]
[Wed Apr 22 01:16:41.131966 2026] [:error] [pid 53978:tid 53980] [client 45.137.126.15:49131] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/simi.php"] [unique_id "aeew-Z1ivsR4hcOSQbZvDAAAAoA"]
[Wed Apr 22 01:16:42.117048 2026] [:error] [pid 53832:tid 53850] [client 45.137.126.32:23979] [client 45.137.126.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "aeew-tzkuxsE_OhM9UKYvQAAAk8"]
[Wed Apr 22 01:16:45.771062 2026] [:error] [pid 4777:tid 4796] [client 45.137.126.23:35309] [client 45.137.126.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aeew_axXur6bykKyLZTJugAAAQg"]
[Wed Apr 22 01:16:55.640332 2026] [:error] [pid 53731:tid 53738] [client 45.137.126.6:37089] [client 45.137.126.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ms-pie.php"] [unique_id "aeexB12I9THUR-bRVGzOEAAAAgM"]
[Wed Apr 22 01:17:01.757799 2026] [:error] [pid 53832:tid 53859] [client 45.137.126.11:32973] [client 45.137.126.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/index.php"] [unique_id "aeexDdzkuxsE_OhM9UKY8gAAAlg"]
[Wed Apr 22 01:17:05.869279 2026] [:error] [pid 35320:tid 35343] [client 45.137.126.13:52855] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/nav-menu.php"] [unique_id "aeexEYJW6fdXWO6agMFtLgAAAA0"]
[Wed Apr 22 01:17:06.852296 2026] [:error] [pid 35320:tid 35333] [client 45.137.126.37:51987] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/user.php"] [unique_id "aeexEoJW6fdXWO6agMFtMwAAAAM"]
[Wed Apr 22 01:17:21.929789 2026] [:error] [pid 35320:tid 35343] [client 45.137.126.13:54277] [client 45.137.126.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "aeexIYJW6fdXWO6agMFtbwAAAA0"]
[Wed Apr 22 01:17:22.908642 2026] [:error] [pid 53978:tid 53992] [client 45.137.126.12:20127] [client 45.137.126.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "aeexIp1ivsR4hcOSQbZvKgAAAow"]
[Wed Apr 22 01:17:23.885047 2026] [:error] [pid 35320:tid 35346] [client 45.137.126.48:50771] [client 45.137.126.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "aeexI4JW6fdXWO6agMFtcwAAABA"]
[Wed Apr 22 01:17:26.667765 2026] [:error] [pid 54080:tid 54084] [client 45.137.126.18:24657] [client 45.137.126.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.137.126.18, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "aeexJozEbQHHxtmWbab44gAAAsI"]
[Wed Apr 22 01:17:29.340519 2026] [:error] [pid 54080:tid 54093] [client 45.137.126.18:24657] [client 45.137.126.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "aeexKYzEbQHHxtmWbab46wAAAss"]
[Wed Apr 22 01:17:30.314333 2026] [:error] [pid 53731:tid 53735] [client 45.137.126.15:34019] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/media-text/index.php"] [unique_id "aeexKl2I9THUR-bRVGzOOAAAAgA"]
[Wed Apr 22 01:17:31.369360 2026] [:error] [pid 35320:tid 35341] [client 45.137.126.33:47701] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/phpmailer/phpmailer.php"] [unique_id "aeexK4JW6fdXWO6agMFthAAAAAs"]
[Wed Apr 22 01:17:39.938201 2026] [:error] [pid 35320:tid 35354] [client 45.137.126.33:51955] [client 45.137.126.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "aeexM4JW6fdXWO6agMFtqwAAABg"]
[Wed Apr 22 01:17:49.928684 2026] [:error] [pid 35322:tid 35358] [client 45.137.126.27:23495] [client 45.137.126.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/nextpage/index.php"] [unique_id "aeexPaPoAfV40BTfVKzvUQAAAIE"]
[Wed Apr 22 01:17:50.917625 2026] [authz_core:error] [pid 4777:tid 4808] [client 45.137.126.15:44185] AH01630: client denied by server configuration: /home/expressi/public_html/wp-content/plugins/akismet/views/cmd.php
[Wed Apr 22 01:17:53.077153 2026] [:error] [pid 4777:tid 4801] [client 45.137.126.15:44185] [client 45.137.126.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/link-template-firewall.php"] [unique_id "aeexQaxXur6bykKyLZTJxwAAAQ0"]
[Wed Apr 22 01:18:09.107397 2026] [:error] [pid 35320:tid 35341] [client 45.137.126.49:37789] [client 45.137.126.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "aeexUYJW6fdXWO6agMFuEQAAAAs"]
[Wed Apr 22 01:18:10.078647 2026] [:error] [pid 53978:tid 53986] [client 45.137.126.4:25699] [client 45.137.126.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "aeexUp1ivsR4hcOSQbZvTwAAAoY"]
[Wed Apr 22 01:18:11.059052 2026] [:error] [pid 35415:tid 35443] [client 45.137.126.3:40155] [client 45.137.126.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/mer_gagal.php"] [unique_id "aeexU0iqDinI4_22zziNHQAAANA"]
[Wed Apr 22 01:18:12.076850 2026] [:error] [pid 4823:tid 4866] [client 45.137.126.30:42369] [client 45.137.126.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "aeexVPc8mke3PfHqsxEiTgAAAY0"]
[Wed Apr 22 01:18:17.546000 2026] [:error] [pid 54080:tid 54094] [client 45.137.126.37:40461] [client 45.137.126.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "aeexWYzEbQHHxtmWbab5GwAAAsw"]
[Wed Apr 22 01:18:18.546062 2026] [:error] [pid 53731:tid 53743] [client 45.137.126.36:25571] [client 45.137.126.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/Core32.php"] [unique_id "aeexWl2I9THUR-bRVGzOhQAAAgg"]
[Wed Apr 22 01:18:26.099673 2026] [:error] [pid 53731:tid 53743] [client 45.137.126.47:22101] [client 45.137.126.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "aeexYl2I9THUR-bRVGzOogAAAgg"]
[Wed Apr 22 01:18:32.629781 2026] [:error] [pid 35321:tid 35403] [client 45.137.126.18:28943] [client 45.137.126.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "aeexaDeHLhVUuu8cVXxIbgAAAFM"]
[Wed Apr 22 01:18:33.669276 2026] [:error] [pid 53731:tid 53753] [client 45.137.126.48:63039] [client 45.137.126.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "aeexaV2I9THUR-bRVGzOvAAAAhE"]
[Wed Apr 22 01:18:37.053382 2026] [autoindex:error] [pid 35320:tid 35344] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:18:40.447348 2026] [autoindex:error] [pid 35320:tid 35350] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:18:49.141851 2026] [autoindex:error] [pid 35320:tid 35333] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:18:50.899818 2026] [autoindex:error] [pid 35320:tid 35348] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:18:57.083294 2026] [autoindex:error] [pid 35320:tid 35332] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:18:57.580501 2026] [autoindex:error] [pid 35320:tid 35339] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:18:59.715897 2026] [autoindex:error] [pid 35320:tid 35350] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:00.207352 2026] [autoindex:error] [pid 35320:tid 35333] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:00.714768 2026] [autoindex:error] [pid 35320:tid 35337] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:02.258710 2026] [autoindex:error] [pid 35320:tid 35332] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:02.770398 2026] [autoindex:error] [pid 35320:tid 35350] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:03.260433 2026] [autoindex:error] [pid 35320:tid 35339] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:04.909774 2026] [autoindex:error] [pid 35320:tid 35351] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:05.400073 2026] [autoindex:error] [pid 35320:tid 35352] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:05.891918 2026] [autoindex:error] [pid 35320:tid 35335] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:09.641765 2026] [autoindex:error] [pid 35320:tid 35343] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:10.136732 2026] [autoindex:error] [pid 35320:tid 35352] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:10.628600 2026] [autoindex:error] [pid 35320:tid 35336] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:11.122632 2026] [autoindex:error] [pid 35320:tid 35334] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:11.611924 2026] [autoindex:error] [pid 35320:tid 35340] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:12.111034 2026] [autoindex:error] [pid 35320:tid 35350] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:13.742065 2026] [autoindex:error] [pid 35320:tid 35343] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:14.233949 2026] [autoindex:error] [pid 35320:tid 35352] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:18.627341 2026] [autoindex:error] [pid 35320:tid 35350] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:21.462764 2026] [autoindex:error] [pid 35320:tid 35342] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:21.954795 2026] [autoindex:error] [pid 35320:tid 35331] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:22.445048 2026] [autoindex:error] [pid 35320:tid 35347] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:26.385910 2026] [autoindex:error] [pid 35320:tid 35337] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:26.879875 2026] [autoindex:error] [pid 35320:tid 35333] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:30.861405 2026] [autoindex:error] [pid 35320:tid 35340] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:32.539578 2026] [autoindex:error] [pid 35320:tid 35344] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:34.191706 2026] [autoindex:error] [pid 35320:tid 35336] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:34.681459 2026] [autoindex:error] [pid 35320:tid 35346] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentythree/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:35.171419 2026] [autoindex:error] [pid 35320:tid 35354] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:35.664087 2026] [autoindex:error] [pid 35320:tid 35352] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:36.160326 2026] [autoindex:error] [pid 35320:tid 35335] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:38.965140 2026] [autoindex:error] [pid 35320:tid 35349] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:41.749094 2026] [autoindex:error] [pid 35320:tid 35351] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:42.238806 2026] [autoindex:error] [pid 35320:tid 35348] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:46.211650 2026] [autoindex:error] [pid 35320:tid 35345] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:47.855586 2026] [autoindex:error] [pid 35320:tid 35336] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:50.621139 2026] [autoindex:error] [pid 35320:tid 35350] [client 45.137.126.35:50377] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:52.974813 2026] [autoindex:error] [pid 35320:tid 35353] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:53.470352 2026] [autoindex:error] [pid 35320:tid 35339] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:53.963096 2026] [autoindex:error] [pid 35320:tid 35352] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:54.455775 2026] [autoindex:error] [pid 35320:tid 35335] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:54.949572 2026] [autoindex:error] [pid 35320:tid 35332] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:19:55.440537 2026] [autoindex:error] [pid 35320:tid 35340] [client 45.137.126.35:50377] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentytwo/assets/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:02.883333 2026] [autoindex:error] [pid 35321:tid 35393] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:03.375327 2026] [autoindex:error] [pid 35321:tid 35402] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:03.876025 2026] [autoindex:error] [pid 35321:tid 35405] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:04.371449 2026] [autoindex:error] [pid 35321:tid 35399] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:04.863506 2026] [autoindex:error] [pid 35321:tid 35394] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/calendar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:06.617287 2026] [autoindex:error] [pid 35321:tid 35387] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:09.592652 2026] [autoindex:error] [pid 35321:tid 35406] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/05/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:11.318167 2026] [autoindex:error] [pid 35321:tid 35395] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:11.810061 2026] [autoindex:error] [pid 35321:tid 35387] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:12.314911 2026] [autoindex:error] [pid 35321:tid 35390] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:12.809689 2026] [autoindex:error] [pid 35321:tid 35385] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:13.303621 2026] [autoindex:error] [pid 35321:tid 35401] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:18.589677 2026] [autoindex:error] [pid 35321:tid 35397] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:22.619047 2026] [autoindex:error] [pid 35321:tid 35399] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:23.117734 2026] [autoindex:error] [pid 35321:tid 35387] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:24.838610 2026] [autoindex:error] [pid 35321:tid 35388] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:31.421799 2026] [autoindex:error] [pid 35321:tid 35398] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:31.978507 2026] [autoindex:error] [pid 35321:tid 35407] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:32.471324 2026] [autoindex:error] [pid 35321:tid 35389] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:32.964273 2026] [autoindex:error] [pid 35321:tid 35406] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:38.954514 2026] [autoindex:error] [pid 35321:tid 35393] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:43.081379 2026] [autoindex:error] [pid 35321:tid 35389] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:48.308330 2026] [autoindex:error] [pid 35321:tid 35384] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:54.887049 2026] [autoindex:error] [pid 35321:tid 35386] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:57.900386 2026] [autoindex:error] [pid 35321:tid 35389] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:20:58.394076 2026] [autoindex:error] [pid 35321:tid 35392] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:21:01.399025 2026] [autoindex:error] [pid 35321:tid 35388] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:21:03.082182 2026] [autoindex:error] [pid 35321:tid 35404] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:21:03.573654 2026] [autoindex:error] [pid 35321:tid 35395] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/classic-editor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:21:19.883189 2026] [autoindex:error] [pid 35321:tid 35397] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:21:22.668604 2026] [autoindex:error] [pid 35321:tid 35401] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/ui/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:21:26.236849 2026] [autoindex:error] [pid 35321:tid 35399] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:21:28.973703 2026] [autoindex:error] [pid 35321:tid 35401] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:21:30.791970 2026] [autoindex:error] [pid 35321:tid 35400] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:21:31.300785 2026] [autoindex:error] [pid 35321:tid 35394] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:21:33.032957 2026] [autoindex:error] [pid 35321:tid 35403] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:21:33.525486 2026] [autoindex:error] [pid 35321:tid 35387] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:21:34.039005 2026] [autoindex:error] [pid 35321:tid 35389] [client 45.137.126.30:64149] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:21:39.156857 2026] [autoindex:error] [pid 35320:tid 35337] [client 45.137.126.20:37313] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/pullquote/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:21:42.276308 2026] [autoindex:error] [pid 35320:tid 35339] [client 45.137.126.20:37313] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/comments-pagination-numbers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:21:51.652568 2026] [autoindex:error] [pid 35320:tid 35337] [client 45.137.126.20:37313] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:21:52.149343 2026] [autoindex:error] [pid 35320:tid 35343] [client 45.137.126.20:37313] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/post-terms/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:21:53.980480 2026] [autoindex:error] [pid 35320:tid 35334] [client 45.137.126.20:37313] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:21:55.715106 2026] [autoindex:error] [pid 35320:tid 35337] [client 45.137.126.20:37313] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/namespaced/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:21:59.793866 2026] [autoindex:error] [pid 35320:tid 35347] [client 45.137.126.20:37313] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:22:05.147890 2026] [autoindex:error] [pid 35320:tid 35351] [client 45.137.126.20:37313] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/site-title/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:22:12.579647 2026] [autoindex:error] [pid 35320:tid 35334] [client 45.137.126.20:37313] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:22:16.966205 2026] [autoindex:error] [pid 35320:tid 35353] [client 45.137.126.20:37313] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 01:22:17.456822 2026] [autoindex:error] [pid 35320:tid 35332] [client 45.137.126.20:37313] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2026/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 22 03:15:39.761770 2026] [:error] [pid 18795:tid 18802] [client 115.242.55.154:27561] [client 115.242.55.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.242.55.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aefM2_pmfB6aIfcKgXcQ9wAAAMQ"]
[Wed Apr 22 04:30:33.936408 2026] [:error] [pid 21681:tid 21705] [client 117.250.209.37:53518] [client 117.250.209.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.250.209.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aefead5LmJziq-yZYawYKQAAAA8"]
[Wed Apr 22 04:30:44.466429 2026] [:error] [pid 21682:tid 21747] [client 117.250.209.37:53889] [client 117.250.209.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.250.209.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aefedJlXWQZUlmPHS3rX6QAAAFg"]
[Wed Apr 22 04:30:55.081312 2026] [:error] [pid 23041:tid 23060] [client 117.250.209.37:54134] [client 117.250.209.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.250.209.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aefef0TXx_lUa7xwAb6PHQAAARA"]
[Wed Apr 22 04:31:05.944206 2026] [:error] [pid 21683:tid 21770] [client 117.250.209.37:54352] [client 117.250.209.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.250.209.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aefeiVZBWT-0diZyYyZiSQAAAJQ"]
[Wed Apr 22 04:31:16.753579 2026] [:error] [pid 23041:tid 23056] [client 117.250.209.37:54574] [client 117.250.209.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.250.209.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aefelETXx_lUa7xwAb6PhAAAAQw"]
[Wed Apr 22 06:10:40.982115 2026] [:error] [pid 18698:tid 18716] [client 2.58.56.211:56180] [client 2.58.56.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "aef14MHDGrKprtci7-HpxAAAAVA"]
[Wed Apr 22 06:10:41.483155 2026] [:error] [pid 18698:tid 18700] [client 2.58.56.211:56678] [client 2.58.56.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "aef14cHDGrKprtci7-HpxgAAAUA"]
[Wed Apr 22 06:10:41.985796 2026] [:error] [pid 21788:tid 21792] [client 2.58.56.211:56942] [client 2.58.56.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "aef14X7OM27rzVpef26fNQAAAMI"]
[Wed Apr 22 06:10:44.119808 2026] [:error] [pid 21788:tid 21801] [client 2.58.56.211:59070] [client 2.58.56.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "aef15H7OM27rzVpef26fOAAAAMs"]
[Wed Apr 22 06:11:42.341203 2026] [:error] [pid 21788:tid 21793] [client 185.5.70.154:60444] [client 185.5.70.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.5.70.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aef2Hn7OM27rzVpef26fxwAAAMM"]
[Wed Apr 22 06:11:52.623934 2026] [:error] [pid 21788:tid 21806] [client 185.5.70.154:60717] [client 185.5.70.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.5.70.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aef2KH7OM27rzVpef26f3QAAANA"]
[Wed Apr 22 06:12:03.304381 2026] [:error] [pid 21683:tid 21770] [client 185.5.70.154:60954] [client 185.5.70.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.5.70.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aef2M1ZBWT-0diZyYyaNIQAAAJQ"]
[Wed Apr 22 06:12:13.905711 2026] [:error] [pid 23041:tid 23067] [client 185.5.70.154:61193] [client 185.5.70.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.5.70.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aef2PUTXx_lUa7xwAb7IzQAAARc"]
[Wed Apr 22 06:12:24.472213 2026] [:error] [pid 21681:tid 21709] [client 185.5.70.154:61430] [client 185.5.70.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.5.70.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aef2SN5LmJziq-yZYawvpAAAABM"]
[Wed Apr 22 06:27:45.275553 2026] [:error] [pid 21788:tid 21812] [client 158.173.67.219:22181] [client 158.173.67.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.173.67.219, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aef54X7OM27rzVpef26qwAAAANY"]
[Wed Apr 22 08:17:35.106484 2026] [:error] [pid 31755:tid 31781] [client 165.99.50.226:36136] [client 165.99.50.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 165.99.50.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aegTnwz2mYMkg3X8q1uMcwAAAhI"], referer: https://expressinteriors.com/
[Wed Apr 22 08:56:33.000373 2026] [:error] [pid 31755:tid 31780] [client 20.111.37.69:15458] [client 20.111.37.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.111.37.69, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aegcwAz2mYMkg3X8q1umUQAAAhE"]
[Wed Apr 22 09:46:35.744609 2026] [:error] [pid 23041:tid 23064] [client 91.230.225.167:63581] [client 91.230.225.167] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aegoe0TXx_lUa7xwAb40awAAARQ"]
[Wed Apr 22 09:46:43.503977 2026] [:error] [pid 21683:tid 21773] [client 185.92.25.102:38971] [client 185.92.25.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aegog1ZBWT-0diZyYya2kQAAAJc"]
[Wed Apr 22 10:14:42.701179 2026] [:error] [pid 21683:tid 21752] [client 129.222.109.8:24373] [client 129.222.109.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.222.109.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aegvElZBWT-0diZyYya87AAAAII"]
[Wed Apr 22 10:16:03.377923 2026] [:error] [pid 32053:tid 32059] [client 129.222.109.8:53249] [client 129.222.109.8] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aegvYwzPjXx_ocfbYhtKTQAAA0Q"]
[Wed Apr 22 10:16:35.445557 2026] [:error] [pid 21682:tid 21723] [client 129.222.109.8:37176] [client 129.222.109.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.222.109.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aegvg5lXWQZUlmPHS3pF0QAAAEA"]
[Wed Apr 22 10:17:12.499078 2026] [:error] [pid 21682:tid 21741] [client 129.222.109.8:3317] [client 129.222.109.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.222.109.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aegvqJlXWQZUlmPHS3pGAQAAAFI"]
[Wed Apr 22 10:17:46.171517 2026] [:error] [pid 31755:tid 31771] [client 129.222.109.8:22002] [client 129.222.109.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.222.109.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aegvygz2mYMkg3X8q1vRkAAAAgg"]
[Wed Apr 22 10:18:26.285597 2026] [:error] [pid 23041:tid 23056] [client 129.222.109.8:24479] [client 129.222.109.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.222.109.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aegv8kTXx_lUa7xwAb5CswAAAQw"]
[Wed Apr 22 14:04:00.309166 2026] [:error] [pid 6344:tid 6360] [client 203.106.65.55:59939] [client 203.106.65.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.106.65.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aehk0EDOTF-pkQnDeUlqYwAAAAs"]
[Wed Apr 22 14:04:10.332221 2026] [:error] [pid 6252:tid 6312] [client 203.106.65.55:60303] [client 203.106.65.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.106.65.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aehk2utGYuiYb1nWBpT0qwAAAQA"]
[Wed Apr 22 14:04:20.946022 2026] [:error] [pid 6252:tid 6313] [client 203.106.65.55:60621] [client 203.106.65.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.106.65.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aehk5OtGYuiYb1nWBpT0vAAAAQE"]
[Wed Apr 22 14:04:31.761060 2026] [:error] [pid 6251:tid 6304] [client 203.106.65.55:60930] [client 203.106.65.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.106.65.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aehk7ysFAzbyObL-SQ4wIQAAAJM"]
[Wed Apr 22 14:04:42.583197 2026] [:error] [pid 6384:tid 6408] [client 203.106.65.55:61242] [client 203.106.65.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.106.65.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aehk-j58M3t15ICeWHV-KQAAANU"]
[Wed Apr 22 14:38:42.013995 2026] [:error] [pid 9085:tid 9106] [client 203.2.64.59:47433] [client 203.2.64.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aehs8t-_-or9vQnlWnqD0wAAAVM"]
[Wed Apr 22 15:11:19.215856 2026] [:error] [pid 9085:tid 9099] [client 43.157.153.236:52204] [client 43.157.153.236] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aeh0l9-_-or9vQnlWnqa0AAAAUw"]
[Wed Apr 22 17:30:01.894692 2026] [:error] [pid 6344:tid 6368] [client 47.82.180.81:57197] [client 47.82.180.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.82.180.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeiVGUDOTF-pkQnDeUmtAAAAABM"]
[Wed Apr 22 17:30:13.398995 2026] [:error] [pid 9085:tid 9100] [client 47.82.180.81:58191] [client 47.82.180.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.82.180.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeiVJd-_-or9vQnlWnrjXQAAAU0"], referer: https://cdbdinteriors.com.au/wp-login.php
[Wed Apr 22 17:30:15.328967 2026] [:error] [pid 9085:tid 9106] [client 47.82.180.81:58191] [client 47.82.180.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.82.180.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeiVJ9-_-or9vQnlWnrjYAAAAVM"], referer: https://cdbdinteriors.com.au/wp-login.php
[Wed Apr 22 17:30:17.262741 2026] [:error] [pid 9085:tid 9095] [client 47.82.180.81:58191] [client 47.82.180.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.82.180.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeiVKd-_-or9vQnlWnrjYQAAAUg"], referer: https://cdbdinteriors.com.au/wp-login.php
[Wed Apr 22 18:22:49.297575 2026] [:error] [pid 6384:tid 6407] [client 89.117.79.118:47626] [client 89.117.79.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.117.79.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeiheT58M3t15ICeWHXxpwAAANQ"]
[Wed Apr 22 18:22:52.565415 2026] [:error] [pid 6384:tid 6392] [client 89.117.79.118:47626] [client 89.117.79.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.117.79.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeihfD58M3t15ICeWHXxsgAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Wed Apr 22 18:27:33.460534 2026] [:error] [pid 9085:tid 9089] [client 64.226.92.6:50750] [client 64.226.92.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.226.92.6, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeiild-_-or9vQnlWnoQ_QAAAUI"]
[Wed Apr 22 18:27:34.367183 2026] [:error] [pid 9085:tid 9098] [client 64.226.92.6:50750] [client 64.226.92.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.226.92.6, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeiilt-_-or9vQnlWnoRAwAAAUs"], referer: https://expressinteriors.com/wp-login.php
[Wed Apr 22 18:35:46.479736 2026] [:error] [pid 9085:tid 9088] [client 103.197.74.143:32803] [client 103.197.74.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.197.74.143, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeikgt-_-or9vQnlWnoVtQAAAUE"]
[Wed Apr 22 18:36:06.789109 2026] [:error] [pid 6344:tid 6363] [client 103.197.74.143:42207] [client 103.197.74.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.197.74.143, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeiklkDOTF-pkQnDeUnKdwAAAA4"]
[Wed Apr 22 18:36:20.577001 2026] [:error] [pid 6344:tid 6363] [client 103.197.74.143:62486] [client 103.197.74.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.197.74.143, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeikpEDOTF-pkQnDeUnKfwAAAA4"]
[Wed Apr 22 18:36:32.739712 2026] [:error] [pid 9085:tid 9111] [client 103.197.74.143:14652] [client 103.197.74.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.197.74.143, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeiksN-_-or9vQnlWnoWXgAAAVg"]
[Wed Apr 22 18:36:40.612440 2026] [:error] [pid 6384:tid 6394] [client 103.197.74.143:30111] [client 103.197.74.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.197.74.143, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeikuD58M3t15ICeWHX3EQAAAMc"]
[Wed Apr 22 18:43:59.546560 2026] [:error] [pid 6384:tid 6400] [client 46.202.196.20:38208] [client 46.202.196.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.202.196.20, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeimbz58M3t15ICeWHX7FgAAAM0"]
[Wed Apr 22 18:44:00.558402 2026] [:error] [pid 6384:tid 6393] [client 46.202.196.20:38208] [client 46.202.196.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.202.196.20, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeimcD58M3t15ICeWHX7GQAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Wed Apr 22 18:49:32.782092 2026] [:error] [pid 6344:tid 6373] [client 121.200.217.28:47500] [client 121.200.217.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 121.200.217.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeinvEDOTF-pkQnDeUnPUwAAABg"]
[Wed Apr 22 18:49:33.844177 2026] [:error] [pid 6344:tid 6364] [client 121.200.217.28:47500] [client 121.200.217.28] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 121.200.217.28, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeinvUDOTF-pkQnDeUnPWQAAAA8"], referer: https://expressinteriors.com/wp-login.php
[Wed Apr 22 19:04:25.129276 2026] [:error] [pid 9085:tid 9099] [client 103.213.38.172:58198] [client 103.213.38.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.213.38.172, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeirOd-_-or9vQnlWnooJQAAAUw"]
[Wed Apr 22 19:04:26.089369 2026] [:error] [pid 9085:tid 9107] [client 103.213.38.172:58198] [client 103.213.38.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.213.38.172, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeirOt-_-or9vQnlWnooKQAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Wed Apr 22 19:41:51.881619 2026] [:error] [pid 6250:tid 6254] [client 173.249.205.94:33258] [client 173.249.205.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.249.205.94, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeiz_w-iZeQkqmQVfj7-UwAAAEA"]
[Wed Apr 22 19:42:08.813509 2026] [:error] [pid 9085:tid 9111] [client 173.249.205.94:38508] [client 173.249.205.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.249.205.94, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aei0EN-_-or9vQnlWnpBDwAAAVg"], referer: https://expressinteriors.com/wp-login.php
[Wed Apr 22 20:12:44.570993 2026] [:error] [pid 6251:tid 6308] [client 162.241.219.101:14206] [client 162.241.219.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.219.101, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aei7PCsFAzbyObL-SQ53EwAAAJc"]
[Wed Apr 22 20:12:45.721708 2026] [:error] [pid 6251:tid 6291] [client 162.241.219.101:14206] [client 162.241.219.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.219.101, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aei7PSsFAzbyObL-SQ53FQAAAIY"], referer: https://expressinteriors.com/wp-login.php
[Wed Apr 22 20:46:54.802607 2026] [:error] [pid 9085:tid 9091] [client 65.254.225.225:52258] [client 65.254.225.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aejDPt-_-or9vQnlWnpmPwAAAUQ"]
[Wed Apr 22 20:46:56.176438 2026] [:error] [pid 9085:tid 9092] [client 65.254.225.225:52258] [client 65.254.225.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aejDQN-_-or9vQnlWnpmQwAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Wed Apr 22 20:57:04.965374 2026] [:error] [pid 6384:tid 6410] [client 43.130.125.193:48318] [client 43.130.125.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aejFoD58M3t15ICeWHU7ogAAANc"]
[Wed Apr 22 21:14:44.191288 2026] [:error] [pid 6344:tid 6349] [client 43.140.247.223:36196] [client 43.140.247.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aejJxEDOTF-pkQnDeUn3HAAAAAA"]
[Wed Apr 22 21:27:39.344816 2026] [:error] [pid 23776:tid 23780] [client 74.248.33.208:20192] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "aejMy7RExf-1pAbSeJv97QAAAYI"]
[Wed Apr 22 21:27:42.940788 2026] [:error] [pid 6251:tid 6308] [client 74.248.33.208:29340] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "aejMzisFAzbyObL-SQ6FdAAAAJc"]
[Wed Apr 22 21:27:44.222952 2026] [:error] [pid 9085:tid 9109] [client 74.248.33.208:29375] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "aejM0N-_-or9vQnlWnqGIQAAAVY"]
[Wed Apr 22 21:27:46.205503 2026] [:error] [pid 9085:tid 9111] [client 74.248.33.208:40116] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/vx.php"] [unique_id "aejM0t-_-or9vQnlWnqGKwAAAVg"]
[Wed Apr 22 21:27:48.198392 2026] [:error] [pid 6250:tid 6274] [client 74.248.33.208:40084] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aejM1A-iZeQkqmQVfj4XDgAAAFQ"]
[Wed Apr 22 21:27:49.628277 2026] [:error] [pid 9085:tid 9101] [client 74.248.33.208:29329] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aejM1d-_-or9vQnlWnqGNAAAAU4"]
[Wed Apr 22 21:27:50.615307 2026] [:error] [pid 6384:tid 6406] [client 74.248.33.208:22878] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aejM1j58M3t15ICeWHVQeQAAANM"]
[Wed Apr 22 21:27:52.044897 2026] [:error] [pid 6252:tid 6319] [client 74.248.33.208:28294] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "aejM2OtGYuiYb1nWBpRV-gAAAQc"]
[Wed Apr 22 21:27:54.205816 2026] [:error] [pid 9085:tid 9100] [client 74.248.33.208:21298] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-243.php"] [unique_id "aejM2t-_-or9vQnlWnqGSAAAAU0"]
[Wed Apr 22 21:27:55.148850 2026] [:error] [pid 23776:tid 23793] [client 74.248.33.208:19555] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-243.php"] [unique_id "aejM27RExf-1pAbSeJv-DAAAAY8"]
[Wed Apr 22 21:27:56.132763 2026] [:error] [pid 6384:tid 6409] [client 74.248.33.208:14685] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-243.php"] [unique_id "aejM3D58M3t15ICeWHVQfgAAANY"]
[Wed Apr 22 21:27:57.192263 2026] [:error] [pid 6251:tid 6305] [client 74.248.33.208:28348] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-243.php"] [unique_id "aejM3SsFAzbyObL-SQ6FegAAAJQ"]
[Wed Apr 22 21:27:58.062429 2026] [:error] [pid 6344:tid 6373] [client 74.248.33.208:34322] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkyac.php"] [unique_id "aejM3kDOTF-pkQnDeUn7qQAAABg"]
[Wed Apr 22 21:27:58.695539 2026] [:error] [pid 9085:tid 9094] [client 74.248.33.208:20223] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkyac.php"] [unique_id "aejM3t-_-or9vQnlWnqGSgAAAUc"]
[Wed Apr 22 21:27:59.785230 2026] [:error] [pid 6384:tid 6390] [client 74.248.33.208:19557] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkyac.php"] [unique_id "aejM3z58M3t15ICeWHVQggAAAMM"]
[Wed Apr 22 21:28:01.378194 2026] [:error] [pid 9085:tid 9098] [client 74.248.33.208:21268] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkyac.php"] [unique_id "aejM4d-_-or9vQnlWnqGUQAAAUs"]
[Wed Apr 22 21:28:02.950943 2026] [:error] [pid 23776:tid 23796] [client 74.248.33.208:22903] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wziar1.php"] [unique_id "aejM4rRExf-1pAbSeJv-FQAAAZI"]
[Wed Apr 22 21:28:04.334895 2026] [:error] [pid 6384:tid 6391] [client 74.248.33.208:19569] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wziar1.php"] [unique_id "aejM5D58M3t15ICeWHVQiAAAAMQ"]
[Wed Apr 22 21:28:05.154558 2026] [:error] [pid 6384:tid 6398] [client 74.248.33.208:22859] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wziar1.php"] [unique_id "aejM5T58M3t15ICeWHVQiQAAAMs"]
[Wed Apr 22 21:28:06.739674 2026] [:error] [pid 9085:tid 9093] [client 74.248.33.208:40074] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wziar1.php"] [unique_id "aejM5t-_-or9vQnlWnqGWQAAAUY"]
[Wed Apr 22 21:28:08.142642 2026] [:error] [pid 9085:tid 9099] [client 74.248.33.208:40114] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aejM6N-_-or9vQnlWnqGXgAAAUw"]
[Wed Apr 22 21:28:09.010697 2026] [:error] [pid 6384:tid 6397] [client 74.248.33.208:21249] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aejM6T58M3t15ICeWHVQkQAAAMo"]
[Wed Apr 22 21:28:09.816145 2026] [:error] [pid 23776:tid 23796] [client 74.248.33.208:29354] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aejM6bRExf-1pAbSeJv-KAAAAZI"]
[Wed Apr 22 21:28:10.480352 2026] [:error] [pid 9085:tid 9089] [client 74.248.33.208:28297] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "aejM6t-_-or9vQnlWnqGaAAAAUI"]
[Wed Apr 22 21:28:11.669521 2026] [:error] [pid 9085:tid 9110] [client 74.248.33.208:20186] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7logs.php"] [unique_id "aejM69-_-or9vQnlWnqGawAAAVc"]
[Wed Apr 22 21:28:13.264348 2026] [:error] [pid 9085:tid 9101] [client 74.248.33.208:20215] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7logs.php"] [unique_id "aejM7d-_-or9vQnlWnqGcQAAAU4"]
[Wed Apr 22 21:28:14.502512 2026] [:error] [pid 6384:tid 6403] [client 74.248.33.208:14672] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7logs.php"] [unique_id "aejM7j58M3t15ICeWHVQmQAAANA"]
[Wed Apr 22 21:28:16.428856 2026] [:error] [pid 6344:tid 6349] [client 74.248.33.208:24615] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7logs.php"] [unique_id "aejM8EDOTF-pkQnDeUn74AAAAAA"]
[Wed Apr 22 21:28:19.029370 2026] [:error] [pid 9085:tid 9109] [client 74.248.33.208:15136] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aejM89-_-or9vQnlWnqGsAAAAVY"]
[Wed Apr 22 21:28:21.237484 2026] [:error] [pid 6252:tid 6324] [client 74.248.33.208:28079] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aejM9etGYuiYb1nWBpRWEwAAAQw"]
[Wed Apr 22 21:28:24.384994 2026] [:error] [pid 9085:tid 9098] [client 74.248.33.208:23655] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aejM-N-_-or9vQnlWnqGxQAAAUs"]
[Wed Apr 22 21:28:27.754732 2026] [:error] [pid 6384:tid 6387] [client 74.248.33.208:8983] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "aejM-z58M3t15ICeWHVQygAAAMA"]
[Wed Apr 22 21:28:30.313560 2026] [:error] [pid 9085:tid 9095] [client 74.248.33.208:8682] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aejM_t-_-or9vQnlWnqG6gAAAUg"]
[Wed Apr 22 21:28:33.416073 2026] [:error] [pid 6251:tid 6287] [client 74.248.33.208:23671] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aejNASsFAzbyObL-SQ6FgAAAAII"]
[Wed Apr 22 21:28:34.755846 2026] [:error] [pid 9085:tid 9106] [client 74.248.33.208:17425] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aejNAt-_-or9vQnlWnqG8wAAAVM"]
[Wed Apr 22 21:28:35.798956 2026] [:error] [pid 6250:tid 6272] [client 74.248.33.208:20917] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "aejNAw-iZeQkqmQVfj4XJQAAAFI"]
[Wed Apr 22 21:28:37.323988 2026] [:error] [pid 23776:tid 23799] [client 74.248.33.208:16687] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctex1.php"] [unique_id "aejNBbRExf-1pAbSeJv-YgAAAZU"]
[Wed Apr 22 21:28:49.331222 2026] [:error] [pid 6384:tid 6400] [client 74.248.33.208:28121] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aejNET58M3t15ICeWHVQ5AAAAM0"]
[Wed Apr 22 21:28:54.610780 2026] [:error] [pid 6384:tid 6392] [client 74.248.33.208:19910] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aejNFj58M3t15ICeWHVQ6AAAAMU"]
[Wed Apr 22 21:28:56.472824 2026] [:error] [pid 6344:tid 6357] [client 74.248.33.208:27882] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aejNGEDOTF-pkQnDeUn7_AAAAAg"]
[Wed Apr 22 21:28:57.297576 2026] [:error] [pid 6344:tid 6371] [client 74.248.33.208:19945] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "aejNGUDOTF-pkQnDeUn7_wAAABY"]
[Wed Apr 22 21:28:57.974223 2026] [:error] [pid 6344:tid 6370] [client 74.248.33.208:22363] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bfil.php"] [unique_id "aejNGUDOTF-pkQnDeUn8AgAAABU"]
[Wed Apr 22 21:28:59.689678 2026] [:error] [pid 6344:tid 6368] [client 74.248.33.208:23692] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bfil.php"] [unique_id "aejNG0DOTF-pkQnDeUn8BAAAABM"]
[Wed Apr 22 21:29:00.284802 2026] [:error] [pid 6344:tid 6365] [client 74.248.33.208:28127] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bfil.php"] [unique_id "aejNHEDOTF-pkQnDeUn8BQAAABA"]
[Wed Apr 22 21:29:01.202504 2026] [:error] [pid 6344:tid 6362] [client 74.248.33.208:15960] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bfil.php"] [unique_id "aejNHUDOTF-pkQnDeUn8BwAAAA0"]
[Wed Apr 22 21:29:02.300020 2026] [:error] [pid 23776:tid 23798] [client 74.248.33.208:27853] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abrand.php"] [unique_id "aejNHrRExf-1pAbSeJv-3AAAAZQ"]
[Wed Apr 22 21:29:03.502081 2026] [:error] [pid 6384:tid 6390] [client 74.248.33.208:27843] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abrand.php"] [unique_id "aejNHz58M3t15ICeWHVQ9QAAAMM"]
[Wed Apr 22 21:29:05.395427 2026] [:error] [pid 6384:tid 6411] [client 74.248.33.208:38203] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abrand.php"] [unique_id "aejNIT58M3t15ICeWHVQ-gAAANg"]
[Wed Apr 22 21:29:07.266587 2026] [:error] [pid 23776:tid 23781] [client 74.248.33.208:30273] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abrand.php"] [unique_id "aejNI7RExf-1pAbSeJv-4AAAAYM"]
[Wed Apr 22 21:29:08.225390 2026] [:error] [pid 6384:tid 6405] [client 74.248.33.208:30292] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aejNJD58M3t15ICeWHVRAQAAANI"]
[Wed Apr 22 21:29:10.293797 2026] [:error] [pid 9085:tid 9095] [client 74.248.33.208:23345] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aejNJt-_-or9vQnlWnqHZgAAAUg"]
[Wed Apr 22 21:29:12.672818 2026] [:error] [pid 6250:tid 6267] [client 74.248.33.208:8870] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aejNKA-iZeQkqmQVfj4XOQAAAE0"]
[Wed Apr 22 21:29:13.562388 2026] [:error] [pid 6251:tid 6300] [client 74.248.33.208:20980] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "aejNKSsFAzbyObL-SQ6FhAAAAI8"]
[Wed Apr 22 21:29:15.616564 2026] [:error] [pid 6384:tid 6389] [client 74.248.33.208:8836] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aejNKz58M3t15ICeWHVRCgAAAMI"]
[Wed Apr 22 21:29:16.507861 2026] [:error] [pid 6384:tid 6409] [client 74.248.33.208:33199] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aejNLD58M3t15ICeWHVRDQAAANY"]
[Wed Apr 22 21:29:17.440488 2026] [:error] [pid 6252:tid 6330] [client 74.248.33.208:23308] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aejNLetGYuiYb1nWBpRWIwAAARI"]
[Wed Apr 22 21:29:18.523997 2026] [:error] [pid 6384:tid 6400] [client 74.248.33.208:27394] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aejNLj58M3t15ICeWHVRGQAAAM0"]
[Wed Apr 22 21:29:20.738153 2026] [:error] [pid 6344:tid 6357] [client 74.248.33.208:39528] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amwxl.php"] [unique_id "aejNMEDOTF-pkQnDeUn8XgAAAAg"]
[Wed Apr 22 21:29:23.410153 2026] [:error] [pid 23776:tid 23780] [client 74.248.33.208:32668] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amwxl.php"] [unique_id "aejNM7RExf-1pAbSeJv--gAAAYI"]
[Wed Apr 22 21:29:26.905452 2026] [:error] [pid 6251:tid 6287] [client 74.248.33.208:8473] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amwxl.php"] [unique_id "aejNNisFAzbyObL-SQ6FigAAAII"]
[Wed Apr 22 21:29:27.808195 2026] [:error] [pid 9085:tid 9099] [client 74.248.33.208:26166] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amwxl.php"] [unique_id "aejNN9-_-or9vQnlWnqHsAAAAUw"]
[Wed Apr 22 21:29:29.236800 2026] [:error] [pid 6384:tid 6390] [client 74.248.33.208:23335] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "aejNOT58M3t15ICeWHVROgAAAMM"]
[Wed Apr 22 21:29:30.012989 2026] [:error] [pid 9085:tid 9089] [client 74.248.33.208:31576] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "aejNOt-_-or9vQnlWnqHygAAAUI"]
[Wed Apr 22 21:29:31.275762 2026] [:error] [pid 9085:tid 9111] [client 74.248.33.208:23312] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "aejNO9-_-or9vQnlWnqH2AAAAVg"]
[Wed Apr 22 21:29:32.205733 2026] [:error] [pid 6252:tid 6320] [client 74.248.33.208:16339] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "aejNPOtGYuiYb1nWBpRWKQAAAQg"]
[Wed Apr 22 21:29:33.297815 2026] [:error] [pid 6250:tid 6255] [client 74.248.33.208:16341] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/userfuns.php"] [unique_id "aejNPQ-iZeQkqmQVfj4XTgAAAEE"]
[Wed Apr 22 21:29:34.261300 2026] [:error] [pid 9085:tid 9111] [client 74.248.33.208:30293] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/userfuns.php"] [unique_id "aejNPt-_-or9vQnlWnqIDgAAAVg"]
[Wed Apr 22 21:29:35.014347 2026] [:error] [pid 23776:tid 23788] [client 74.248.33.208:16356] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/userfuns.php"] [unique_id "aejNP7RExf-1pAbSeJv_OAAAAYo"]
[Wed Apr 22 21:29:35.713459 2026] [:error] [pid 9085:tid 9096] [client 74.248.33.208:17487] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/userfuns.php"] [unique_id "aejNP9-_-or9vQnlWnqIHQAAAUk"]
[Wed Apr 22 21:29:36.713082 2026] [:error] [pid 9085:tid 9094] [client 74.248.33.208:8405] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aejNQN-_-or9vQnlWnqILAAAAUc"]
[Wed Apr 22 21:29:37.831250 2026] [:error] [pid 23776:tid 23800] [client 74.248.33.208:26159] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aejNQbRExf-1pAbSeJv_RQAAAZY"]
[Wed Apr 22 21:29:38.916745 2026] [:error] [pid 6384:tid 6411] [client 74.248.33.208:15225] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aejNQj58M3t15ICeWHVRXgAAANg"]
[Wed Apr 22 21:29:39.589719 2026] [:error] [pid 6384:tid 6391] [client 74.248.33.208:23355] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "aejNQz58M3t15ICeWHVRYQAAAMQ"]
[Wed Apr 22 21:29:40.336657 2026] [:error] [pid 23776:tid 23780] [client 74.248.33.208:17480] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aejNRLRExf-1pAbSeJv_VAAAAYI"]
[Wed Apr 22 21:29:41.281696 2026] [:error] [pid 9085:tid 9098] [client 74.248.33.208:48740] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aejNRd-_-or9vQnlWnqITgAAAUs"]
[Wed Apr 22 21:29:42.107796 2026] [:error] [pid 6252:tid 6322] [client 74.248.33.208:16323] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aejNRutGYuiYb1nWBpRWNgAAAQo"]
[Wed Apr 22 21:29:42.857592 2026] [:error] [pid 6344:tid 6360] [client 74.248.33.208:31602] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "aejNRkDOTF-pkQnDeUn8lwAAAAs"]
[Wed Apr 22 21:29:43.758112 2026] [:error] [pid 9085:tid 9098] [client 74.248.33.208:48765] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/saorix1.php"] [unique_id "aejNR9-_-or9vQnlWnqIXAAAAUs"]
[Wed Apr 22 21:29:45.913934 2026] [:error] [pid 9085:tid 9107] [client 74.248.33.208:16370] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/saorix1.php"] [unique_id "aejNSd-_-or9vQnlWnqIYQAAAVQ"]
[Wed Apr 22 21:29:47.102565 2026] [:error] [pid 23776:tid 23792] [client 74.248.33.208:8397] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/saorix1.php"] [unique_id "aejNS7RExf-1pAbSeJv_cwAAAY4"]
[Wed Apr 22 21:30:00.035221 2026] [:error] [pid 6250:tid 6269] [client 74.248.33.208:15197] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php7"] [unique_id "aejNWA-iZeQkqmQVfj4XbAAAAE8"]
[Wed Apr 22 21:30:01.467752 2026] [:error] [pid 6344:tid 6360] [client 74.248.33.208:29806] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php7"] [unique_id "aejNWUDOTF-pkQnDeUn8sAAAAAs"]
[Wed Apr 22 21:30:03.056334 2026] [:error] [pid 9085:tid 9096] [client 74.248.33.208:37471] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php7"] [unique_id "aejNW9-_-or9vQnlWnqIsQAAAUk"]
[Wed Apr 22 21:30:04.066248 2026] [:error] [pid 6384:tid 6405] [client 74.248.33.208:15188] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sa.php7"] [unique_id "aejNXD58M3t15ICeWHVRgAAAANI"]
[Wed Apr 22 21:30:05.018870 2026] [:error] [pid 9085:tid 9109] [client 74.248.33.208:43904] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a7.php"] [unique_id "aejNXd-_-or9vQnlWnqIwAAAAVY"]
[Wed Apr 22 21:30:05.859769 2026] [:error] [pid 23776:tid 23801] [client 74.248.33.208:16352] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a7.php"] [unique_id "aejNXbRExf-1pAbSeJv_kwAAAZc"]
[Wed Apr 22 21:30:06.853075 2026] [:error] [pid 6252:tid 6317] [client 74.248.33.208:41771] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a7.php"] [unique_id "aejNXutGYuiYb1nWBpRWPgAAAQU"]
[Wed Apr 22 21:30:08.149208 2026] [:error] [pid 6250:tid 6264] [client 74.248.33.208:29765] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a7.php"] [unique_id "aejNYA-iZeQkqmQVfj4XbQAAAEo"]
[Wed Apr 22 21:30:09.035751 2026] [:error] [pid 6344:tid 6361] [client 74.248.33.208:28519] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aejNYUDOTF-pkQnDeUn8uAAAAAw"]
[Wed Apr 22 21:30:10.417065 2026] [:error] [pid 6384:tid 6409] [client 74.248.33.208:24349] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aejNYj58M3t15ICeWHVRhAAAANY"]
[Wed Apr 22 21:30:11.551121 2026] [:error] [pid 6384:tid 6403] [client 74.248.33.208:17033] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aejNYz58M3t15ICeWHVRhgAAANA"]
[Wed Apr 22 21:30:13.272814 2026] [:error] [pid 23776:tid 23780] [client 74.248.33.208:24103] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp9.php"] [unique_id "aejNZbRExf-1pAbSeJv_nQAAAYI"]
[Wed Apr 22 21:30:13.986423 2026] [:error] [pid 23776:tid 23793] [client 74.248.33.208:8618] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "aejNZbRExf-1pAbSeJv_nwAAAY8"]
[Wed Apr 22 21:30:15.099793 2026] [:error] [pid 9085:tid 9107] [client 74.248.33.208:28528] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "aejNZ9-_-or9vQnlWnqI7QAAAVQ"]
[Wed Apr 22 21:30:16.929069 2026] [:error] [pid 6344:tid 6351] [client 74.248.33.208:39213] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "aejNaEDOTF-pkQnDeUn8vgAAAAI"]
[Wed Apr 22 21:30:17.846117 2026] [:error] [pid 9085:tid 9093] [client 74.248.33.208:39199] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "aejNad-_-or9vQnlWnqI9AAAAUY"]
[Wed Apr 22 21:30:19.141352 2026] [:error] [pid 6250:tid 6273] [client 74.248.33.208:43939] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "aejNaw-iZeQkqmQVfj4XcgAAAFM"]
[Wed Apr 22 21:30:20.765945 2026] [:error] [pid 6344:tid 6369] [client 74.248.33.208:31630] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "aejNbEDOTF-pkQnDeUn8wAAAABQ"]
[Wed Apr 22 21:30:21.700208 2026] [:error] [pid 6344:tid 6359] [client 74.248.33.208:24365] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "aejNbUDOTF-pkQnDeUn8wQAAAAo"]
[Wed Apr 22 21:30:22.680832 2026] [:error] [pid 9085:tid 9095] [client 74.248.33.208:24356] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp5.php"] [unique_id "aejNbt-_-or9vQnlWnqJBgAAAUg"]
[Wed Apr 22 21:30:23.549449 2026] [:error] [pid 6344:tid 6352] [client 74.248.33.208:24331] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yuzuru1.php"] [unique_id "aejNb0DOTF-pkQnDeUn8xAAAAAM"]
[Wed Apr 22 21:30:24.880571 2026] [:error] [pid 6344:tid 6362] [client 74.248.33.208:20114] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yuzuru1.php"] [unique_id "aejNcEDOTF-pkQnDeUn8ywAAAA0"]
[Wed Apr 22 21:30:26.046913 2026] [:error] [pid 6344:tid 6353] [client 74.248.33.208:8598] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yuzuru1.php"] [unique_id "aejNckDOTF-pkQnDeUn8zgAAAAQ"]
[Wed Apr 22 21:30:26.904154 2026] [:error] [pid 9085:tid 9106] [client 74.248.33.208:41732] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yuzuru1.php"] [unique_id "aejNct-_-or9vQnlWnqJGgAAAVM"]
[Wed Apr 22 21:30:28.011309 2026] [:error] [pid 6344:tid 6355] [client 74.248.33.208:24345] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file61.php"] [unique_id "aejNdEDOTF-pkQnDeUn8zwAAAAY"]
[Wed Apr 22 21:30:28.714618 2026] [:error] [pid 9085:tid 9092] [client 74.248.33.208:39200] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file61.php"] [unique_id "aejNdN-_-or9vQnlWnqJIQAAAUU"]
[Wed Apr 22 21:30:29.355702 2026] [:error] [pid 6384:tid 6404] [client 74.248.33.208:40008] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file61.php"] [unique_id "aejNdT58M3t15ICeWHVRiQAAANE"]
[Wed Apr 22 21:30:30.599853 2026] [:error] [pid 23776:tid 23795] [client 74.248.33.208:41734] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file61.php"] [unique_id "aejNdrRExf-1pAbSeJv_qQAAAZE"]
[Wed Apr 22 21:30:31.693228 2026] [:error] [pid 6251:tid 6300] [client 74.248.33.208:24124] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "aejNdysFAzbyObL-SQ6FnQAAAI8"]
[Wed Apr 22 21:30:32.357854 2026] [:error] [pid 9085:tid 9105] [client 74.248.33.208:39177] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "aejNeN-_-or9vQnlWnqJLwAAAVI"]
[Wed Apr 22 21:30:33.118599 2026] [:error] [pid 9085:tid 9096] [client 74.248.33.208:20146] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "aejNed-_-or9vQnlWnqJMgAAAUk"]
[Wed Apr 22 21:30:34.189606 2026] [:error] [pid 6252:tid 6324] [client 74.248.33.208:24338] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "aejNeutGYuiYb1nWBpRWRAAAAQw"]
[Wed Apr 22 21:30:35.158937 2026] [:error] [pid 6344:tid 6356] [client 74.248.33.208:31619] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "aejNe0DOTF-pkQnDeUn80gAAAAc"]
[Wed Apr 22 21:30:36.042544 2026] [:error] [pid 6344:tid 6358] [client 74.248.33.208:40034] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "aejNfEDOTF-pkQnDeUn81AAAAAk"]
[Wed Apr 22 21:30:37.258602 2026] [:error] [pid 23776:tid 23785] [client 74.248.33.208:31667] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "aejNfbRExf-1pAbSeJv_sgAAAYc"]
[Wed Apr 22 21:30:38.211479 2026] [:error] [pid 9085:tid 9111] [client 74.248.33.208:43960] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "aejNft-_-or9vQnlWnqJPwAAAVg"]
[Wed Apr 22 21:30:39.751262 2026] [:error] [pid 9085:tid 9098] [client 74.248.33.208:20098] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xper1.php"] [unique_id "aejNf9-_-or9vQnlWnqJQgAAAUs"]
[Wed Apr 22 21:30:40.985021 2026] [:error] [pid 9085:tid 9110] [client 74.248.33.208:41776] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xper1.php"] [unique_id "aejNgN-_-or9vQnlWnqJRwAAAVc"]
[Wed Apr 22 21:30:42.674736 2026] [:error] [pid 6344:tid 6350] [client 74.248.33.208:28541] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xper1.php"] [unique_id "aejNgkDOTF-pkQnDeUn84AAAAAE"]
[Wed Apr 22 21:30:43.606814 2026] [:error] [pid 23776:tid 23782] [client 74.248.33.208:8629] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xper1.php"] [unique_id "aejNg7RExf-1pAbSeJv_vQAAAYQ"]
[Wed Apr 22 21:30:44.371446 2026] [:error] [pid 9085:tid 9094] [client 74.248.33.208:8613] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t00l.php"] [unique_id "aejNhN-_-or9vQnlWnqJVgAAAUc"]
[Wed Apr 22 21:30:45.306941 2026] [:error] [pid 9085:tid 9090] [client 74.248.33.208:8906] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t00l.php"] [unique_id "aejNhd-_-or9vQnlWnqJWwAAAUM"]
[Wed Apr 22 21:30:45.962300 2026] [:error] [pid 9085:tid 9092] [client 74.248.33.208:8580] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t00l.php"] [unique_id "aejNhd-_-or9vQnlWnqJYAAAAUU"]
[Wed Apr 22 21:30:46.941203 2026] [:error] [pid 9085:tid 9105] [client 74.248.33.208:40031] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t00l.php"] [unique_id "aejNht-_-or9vQnlWnqJZAAAAVI"]
[Wed Apr 22 21:30:47.689910 2026] [:error] [pid 9085:tid 9089] [client 74.248.33.208:8950] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp1.php"] [unique_id "aejNh9-_-or9vQnlWnqJagAAAUI"]
[Wed Apr 22 21:30:48.706589 2026] [:error] [pid 9085:tid 9097] [client 74.248.33.208:37487] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp1.php"] [unique_id "aejNiN-_-or9vQnlWnqJcAAAAUo"]
[Wed Apr 22 21:30:50.018728 2026] [:error] [pid 9085:tid 9103] [client 74.248.33.208:39192] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp1.php"] [unique_id "aejNit-_-or9vQnlWnqJdwAAAVA"]
[Wed Apr 22 21:30:51.057966 2026] [:error] [pid 6344:tid 6371] [client 74.248.33.208:40024] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp1.php"] [unique_id "aejNi0DOTF-pkQnDeUn86QAAABY"]
[Wed Apr 22 21:30:51.764314 2026] [:error] [pid 6251:tid 6309] [client 74.248.33.208:31675] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acc.php"] [unique_id "aejNiysFAzbyObL-SQ6FoAAAAJg"]
[Wed Apr 22 21:30:52.484725 2026] [:error] [pid 9085:tid 9099] [client 74.248.33.208:8900] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acc.php"] [unique_id "aejNjN-_-or9vQnlWnqJfgAAAUw"]
[Wed Apr 22 21:30:53.696999 2026] [:error] [pid 9085:tid 9096] [client 74.248.33.208:43955] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acc.php"] [unique_id "aejNjd-_-or9vQnlWnqJhQAAAUk"]
[Wed Apr 22 21:30:54.875853 2026] [:error] [pid 23776:tid 23791] [client 74.248.33.208:17041] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acc.php"] [unique_id "aejNjrRExf-1pAbSeJv_yQAAAY0"]
[Wed Apr 22 21:30:55.915485 2026] [:error] [pid 6250:tid 6269] [client 74.248.33.208:28481] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aejNjw-iZeQkqmQVfj4XdwAAAE8"]
[Wed Apr 22 21:30:56.806150 2026] [:error] [pid 6384:tid 6387] [client 74.248.33.208:24067] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aejNkD58M3t15ICeWHVRmAAAAMA"]
[Wed Apr 22 21:30:58.543039 2026] [:error] [pid 23776:tid 23802] [client 74.248.33.208:43933] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "aejNkrRExf-1pAbSeJv_zAAAAZg"]
[Wed Apr 22 21:31:10.630375 2026] [:error] [pid 9085:tid 9095] [client 74.248.33.208:31659] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "aejNnt-_-or9vQnlWnqJ2wAAAUg"]
[Wed Apr 22 21:31:12.083935 2026] [:error] [pid 23776:tid 23792] [client 74.248.33.208:20110] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "aejNoLRExf-1pAbSeJv_4gAAAY4"]
[Wed Apr 22 21:31:13.177490 2026] [:error] [pid 23776:tid 23779] [client 74.248.33.208:18179] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "aejNobRExf-1pAbSeJv_5QAAAYE"]
[Wed Apr 22 21:31:14.703806 2026] [:error] [pid 6384:tid 6388] [client 74.248.33.208:31620] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "aejNoj58M3t15ICeWHVRrwAAAME"]
[Wed Apr 22 21:31:15.617025 2026] [:error] [pid 23776:tid 23790] [client 74.248.33.208:39148] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/prosellers8.php"] [unique_id "aejNo7RExf-1pAbSeJv_6gAAAYw"]
[Wed Apr 22 21:31:16.587413 2026] [:error] [pid 6384:tid 6399] [client 74.248.33.208:16306] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/prosellers8.php"] [unique_id "aejNpD58M3t15ICeWHVRyQAAAMw"]
[Wed Apr 22 21:31:17.512791 2026] [:error] [pid 6344:tid 6372] [client 74.248.33.208:18851] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/prosellers8.php"] [unique_id "aejNpUDOTF-pkQnDeUn9TQAAABc"]
[Wed Apr 22 21:31:18.405003 2026] [:error] [pid 9085:tid 9096] [client 74.248.33.208:16313] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/prosellers8.php"] [unique_id "aejNpt-_-or9vQnlWnqJ7gAAAUk"]
[Wed Apr 22 21:31:19.201201 2026] [:error] [pid 9085:tid 9090] [client 74.248.33.208:30364] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aejNp9-_-or9vQnlWnqJ9QAAAUM"]
[Wed Apr 22 21:31:20.410722 2026] [:error] [pid 9085:tid 9089] [client 74.248.33.208:32128] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aejNqN-_-or9vQnlWnqJ-wAAAUI"]
[Wed Apr 22 21:31:23.101115 2026] [:error] [pid 9085:tid 9089] [client 74.248.33.208:18645] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aejNq9-_-or9vQnlWnqKBgAAAUI"]
[Wed Apr 22 21:31:24.227499 2026] [:error] [pid 23776:tid 23800] [client 74.248.33.208:38095] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "aejNrLRExf-1pAbSeJv_8wAAAZY"]
[Wed Apr 22 21:31:25.294972 2026] [:error] [pid 9085:tid 9090] [client 74.248.33.208:38129] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "aejNrd-_-or9vQnlWnqKEAAAAUM"]
[Wed Apr 22 21:31:26.787597 2026] [:error] [pid 6384:tid 6411] [client 74.248.33.208:22427] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "aejNrj58M3t15ICeWHVR1gAAANg"]
[Wed Apr 22 21:31:27.916124 2026] [:error] [pid 23776:tid 23783] [client 74.248.33.208:40461] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "aejNr7RExf-1pAbSeJv_9QAAAYU"]
[Wed Apr 22 21:31:28.893246 2026] [:error] [pid 9085:tid 9094] [client 74.248.33.208:40408] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "aejNsN-_-or9vQnlWnqKIAAAAUc"]
[Wed Apr 22 21:31:29.911309 2026] [:error] [pid 9085:tid 9095] [client 74.248.33.208:38114] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsjzs.php"] [unique_id "aejNsd-_-or9vQnlWnqKJAAAAUg"]
[Wed Apr 22 21:31:31.044528 2026] [:error] [pid 9085:tid 9091] [client 74.248.33.208:27779] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsjzs.php"] [unique_id "aejNs9-_-or9vQnlWnqKLQAAAUQ"]
[Wed Apr 22 21:31:31.764819 2026] [:error] [pid 23776:tid 23792] [client 74.248.33.208:8749] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsjzs.php"] [unique_id "aejNs7RExf-1pAbSeJv_-QAAAY4"]
[Wed Apr 22 21:31:32.464194 2026] [:error] [pid 23776:tid 23782] [client 74.248.33.208:38081] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsjzs.php"] [unique_id "aejNtLRExf-1pAbSeJv__QAAAYQ"]
[Wed Apr 22 21:31:33.246979 2026] [:error] [pid 23776:tid 23800] [client 74.248.33.208:8704] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cwclass.php"] [unique_id "aejNtbRExf-1pAbSeJsAAAAAAZY"]
[Wed Apr 22 21:31:34.057943 2026] [:error] [pid 6384:tid 6395] [client 74.248.33.208:21644] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cwclass.php"] [unique_id "aejNtj58M3t15ICeWHVR3gAAAMg"]
[Wed Apr 22 21:31:34.937249 2026] [:error] [pid 9085:tid 9087] [client 74.248.33.208:44680] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cwclass.php"] [unique_id "aejNtt-_-or9vQnlWnqKVwAAAUA"]
[Wed Apr 22 21:31:35.492626 2026] [:error] [pid 6252:tid 6327] [client 74.248.33.208:34938] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cwclass.php"] [unique_id "aejNt-tGYuiYb1nWBpRWZwAAAQ8"]
[Wed Apr 22 21:31:36.130964 2026] [:error] [pid 6384:tid 6403] [client 74.248.33.208:9205] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit-tags.php"] [unique_id "aejNuD58M3t15ICeWHVR4wAAANA"]
[Wed Apr 22 21:31:36.827128 2026] [:error] [pid 9085:tid 9108] [client 74.248.33.208:31069] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit-tags.php"] [unique_id "aejNuN-_-or9vQnlWnqKXAAAAVU"]
[Wed Apr 22 21:31:37.504446 2026] [:error] [pid 23776:tid 23795] [client 74.248.33.208:31097] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit-tags.php"] [unique_id "aejNubRExf-1pAbSeJsACgAAAZE"]
[Wed Apr 22 21:31:38.233592 2026] [:error] [pid 6250:tid 6275] [client 74.248.33.208:35292] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit-tags.php"] [unique_id "aejNug-iZeQkqmQVfj4XhwAAAFU"]
[Wed Apr 22 21:31:39.013205 2026] [:error] [pid 23776:tid 23779] [client 74.248.33.208:8776] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aejNu7RExf-1pAbSeJsADAAAAYE"]
[Wed Apr 22 21:31:40.280862 2026] [:error] [pid 23776:tid 23783] [client 74.248.33.208:48987] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aejNvLRExf-1pAbSeJsAEQAAAYU"]
[Wed Apr 22 21:31:41.059379 2026] [:error] [pid 23776:tid 23781] [client 74.248.33.208:8825] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aejNvbRExf-1pAbSeJsAFQAAAYM"]
[Wed Apr 22 21:31:41.933916 2026] [:error] [pid 23776:tid 23793] [client 74.248.33.208:29302] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "aejNvbRExf-1pAbSeJsAGAAAAY8"]
[Wed Apr 22 21:31:43.482927 2026] [:error] [pid 9085:tid 9094] [client 74.248.33.208:8770] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "aejNv9-_-or9vQnlWnqKawAAAUc"]
[Wed Apr 22 21:31:44.311173 2026] [:error] [pid 6344:tid 6354] [client 74.248.33.208:14213] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "aejNwEDOTF-pkQnDeUn9VQAAAAU"]
[Wed Apr 22 21:31:46.067475 2026] [:error] [pid 9085:tid 9097] [client 74.248.33.208:17845] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "aejNwt-_-or9vQnlWnqKcwAAAUo"]
[Wed Apr 22 21:31:47.031634 2026] [:error] [pid 23776:tid 23785] [client 74.248.33.208:30686] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "aejNw7RExf-1pAbSeJsAJQAAAYc"]
[Wed Apr 22 21:31:47.762876 2026] [:error] [pid 9085:tid 9088] [client 74.248.33.208:48977] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aejNw9-_-or9vQnlWnqKegAAAUE"]
[Wed Apr 22 21:31:48.801325 2026] [:error] [pid 9085:tid 9091] [client 74.248.33.208:30708] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aejNxN-_-or9vQnlWnqKfgAAAUQ"]
[Wed Apr 22 21:31:49.670512 2026] [:error] [pid 9085:tid 9088] [client 74.248.33.208:20444] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aejNxd-_-or9vQnlWnqKhQAAAUE"]
[Wed Apr 22 21:31:50.472365 2026] [:error] [pid 6250:tid 6261] [client 74.248.33.208:28408] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aejNxg-iZeQkqmQVfj4XiAAAAEc"]
[Wed Apr 22 21:31:51.269650 2026] [:error] [pid 9085:tid 9092] [client 74.248.33.208:28367] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ai.php"] [unique_id "aejNx9-_-or9vQnlWnqKjQAAAUU"]
[Wed Apr 22 21:31:52.106459 2026] [:error] [pid 9085:tid 9100] [client 74.248.33.208:8800] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ai.php"] [unique_id "aejNyN-_-or9vQnlWnqKjwAAAU0"]
[Wed Apr 22 21:31:52.866592 2026] [:error] [pid 6344:tid 6351] [client 74.248.33.208:21636] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ai.php"] [unique_id "aejNyEDOTF-pkQnDeUn9XgAAAAI"]
[Wed Apr 22 21:31:54.093442 2026] [:error] [pid 6252:tid 6320] [client 74.248.33.208:20448] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ai.php"] [unique_id "aejNyutGYuiYb1nWBpRWcwAAAQg"]
[Wed Apr 22 21:31:54.920537 2026] [:error] [pid 9085:tid 9106] [client 74.248.33.208:30698] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "aejNyt-_-or9vQnlWnqKkwAAAVM"]
[Wed Apr 22 21:31:55.745148 2026] [:error] [pid 23776:tid 23782] [client 74.248.33.208:35268] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "aejNy7RExf-1pAbSeJsAMwAAAYQ"]
[Wed Apr 22 21:31:56.482627 2026] [:error] [pid 23776:tid 23781] [client 74.248.33.208:48973] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "aejNzLRExf-1pAbSeJsANgAAAYM"]
[Wed Apr 22 21:31:57.463761 2026] [:error] [pid 9085:tid 9105] [client 74.248.33.208:29272] [client 74.248.33.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "aejNzd-_-or9vQnlWnqKlwAAAVI"]
[Wed Apr 22 22:04:06.370814 2026] [:error] [pid 6384:tid 6403] [client 1.53.5.5:60797] [client 1.53.5.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 1.53.5.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aejVVj58M3t15ICeWHVpXQAAANA"]
[Wed Apr 22 22:04:10.533317 2026] [:error] [pid 6384:tid 6401] [client 1.53.5.5:60797] [client 1.53.5.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 1.53.5.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aejVWj58M3t15ICeWHVpbAAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Wed Apr 22 22:28:00.235231 2026] [:error] [pid 9085:tid 9109] [client 125.162.216.192:58198] [client 125.162.216.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 125.162.216.192, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeja8N-_-or9vQnlWnq9twAAAVY"]
[Wed Apr 22 22:28:10.070183 2026] [:error] [pid 6344:tid 6365] [client 125.162.216.192:58506] [client 125.162.216.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 125.162.216.192, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeja-kDOTF-pkQnDeUkOdwAAABA"]
[Wed Apr 22 22:28:20.539357 2026] [:error] [pid 6252:tid 6330] [client 125.162.216.192:58765] [client 125.162.216.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 125.162.216.192, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aejbBOtGYuiYb1nWBpRhxgAAARI"]
[Wed Apr 22 22:28:30.962424 2026] [:error] [pid 9085:tid 9108] [client 125.162.216.192:59023] [client 125.162.216.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 125.162.216.192, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aejbDt-_-or9vQnlWnq-ygAAAVU"]
[Wed Apr 22 22:28:41.823227 2026] [:error] [pid 23776:tid 23790] [client 125.162.216.192:59292] [client 125.162.216.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 125.162.216.192, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aejbGbRExf-1pAbSeJsbBwAAAYw"]
[Wed Apr 22 22:28:52.202745 2026] [:error] [pid 9085:tid 9102] [client 125.162.216.192:59547] [client 125.162.216.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 125.162.216.192, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aejbJN-_-or9vQnlWnq_BwAAAU8"]
[Wed Apr 22 22:49:47.589376 2026] [:error] [pid 6384:tid 6393] [client 165.22.95.96:38552] [client 165.22.95.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.95.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aejgCz58M3t15ICeWHWFDgAAAMY"]
[Wed Apr 22 22:49:49.252905 2026] [:error] [pid 6384:tid 6405] [client 165.22.95.96:38552] [client 165.22.95.96] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.95.96, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aejgDT58M3t15ICeWHWFEwAAANI"], referer: https://expressinteriors.com/wp-login.php
[Wed Apr 22 23:15:44.009760 2026] [:error] [pid 9085:tid 9108] [client 43.130.131.18:59488] [client 43.130.131.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aejmIN-_-or9vQnlWnrZOQAAAVU"]
[Wed Apr 22 23:47:18.010653 2026] [:error] [pid 6251:tid 6303] [client 194.26.192.99:51460] [client 194.26.192.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "aejthisFAzbyObL-SQ6ZvgAAAJI"]
[Wed Apr 22 23:47:18.510436 2026] [:error] [pid 6344:tid 6355] [client 194.26.192.99:62790] [client 194.26.192.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "aejthkDOTF-pkQnDeUkfbwAAAAY"]
[Wed Apr 22 23:47:19.010287 2026] [:error] [pid 6344:tid 6366] [client 194.26.192.99:57602] [client 194.26.192.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "aejth0DOTF-pkQnDeUkfcgAAABE"]
[Wed Apr 22 23:47:21.147753 2026] [:error] [pid 6344:tid 6359] [client 194.26.192.99:61653] [client 194.26.192.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "aejtiUDOTF-pkQnDeUkfewAAAAo"]
[Wed Apr 22 23:47:22.612863 2026] [:error] [pid 6252:tid 6335] [client 74.208.218.185:59582] [client 74.208.218.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.208.218.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aejtiutGYuiYb1nWBpRtNgAAARc"]
[Wed Apr 22 23:47:27.367619 2026] [:error] [pid 6252:tid 6316] [client 74.208.218.185:59582] [client 74.208.218.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.208.218.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aejtj-tGYuiYb1nWBpRtPAAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Apr 23 00:33:19.010748 2026] [:error] [pid 9085:tid 9088] [client 142.93.214.154:57964] [client 142.93.214.154] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.93.214.154, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aej4T9-_-or9vQnlWnoFcwAAAUE"]
[Thu Apr 23 00:33:20.496832 2026] [:error] [pid 9085:tid 9101] [client 142.93.214.154:57964] [client 142.93.214.154] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.93.214.154, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aej4UN-_-or9vQnlWnoFdwAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Thu Apr 23 00:50:56.311086 2026] [:error] [pid 9085:tid 9092] [client 14.176.235.239:52700] [client 14.176.235.239] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 14.176.235.239, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aej8cN-_-or9vQnlWnoQbQAAAUU"], referer: https://expressinteriors.com/
[Thu Apr 23 01:02:15.587028 2026] [:error] [pid 6344:tid 6365] [client 213.55.96.154:52136] [client 213.55.96.154] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.55.96.154, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aej_F0DOTF-pkQnDeUkz3wAAABA"]
[Thu Apr 23 01:02:27.082941 2026] [:error] [pid 9085:tid 9095] [client 213.55.96.154:47960] [client 213.55.96.154] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.55.96.154, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aej_I9-_-or9vQnlWnoXQAAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Thu Apr 23 01:33:15.985827 2026] [:error] [pid 9085:tid 9108] [client 138.201.23.123:36556] [client 138.201.23.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.201.23.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aekGW9-_-or9vQnlWnopigAAAVU"]
[Thu Apr 23 01:33:17.227481 2026] [:error] [pid 9085:tid 9106] [client 138.201.23.123:36556] [client 138.201.23.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.201.23.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aekGXd-_-or9vQnlWnopjQAAAVM"], referer: https://expressinteriors.com/wp-login.php
[Thu Apr 23 01:58:11.595321 2026] [:error] [pid 9085:tid 9111] [client 18.60.137.201:35128] [client 18.60.137.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.60.137.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aekMM9-_-or9vQnlWno6ZgAAAVg"]
[Thu Apr 23 01:58:17.099367 2026] [:error] [pid 9085:tid 9104] [client 18.60.137.201:35128] [client 18.60.137.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.60.137.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aekMOd-_-or9vQnlWno6bQAAAVE"], referer: https://expressinteriors.com/wp-login.php
[Thu Apr 23 03:07:37.468250 2026] [:error] [pid 6344:tid 6366] [client 173.239.218.120:56933] [client 173.239.218.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "aekceUDOTF-pkQnDeUlRJwAAABE"]
[Thu Apr 23 03:07:38.796414 2026] [:error] [pid 9085:tid 9106] [client 173.239.218.92:41107] [client 173.239.218.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "aekcet-_-or9vQnlWnpb4AAAAVM"]
[Thu Apr 23 03:07:42.955196 2026] [:error] [pid 23776:tid 23791] [client 173.239.218.91:59843] [client 173.239.218.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "aekcfrRExf-1pAbSeJt1QgAAAY0"]
[Thu Apr 23 03:07:46.556272 2026] [:error] [pid 9085:tid 9104] [client 173.239.218.80:42089] [client 173.239.218.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "aekcgt-_-or9vQnlWnpb9AAAAVE"]
[Thu Apr 23 03:08:02.710274 2026] [proxy_fcgi:error] [pid 9085:tid 9095] [client 173.239.218.126:23973] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Undefined constant "ABSPATH" in /home/expressi/public_html/wp-settings.php:34\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-settings.php on line 34'
[Thu Apr 23 03:08:14.839477 2026] [autoindex:error] [pid 6251:tid 6294] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:23.978257 2026] [autoindex:error] [pid 6251:tid 6286] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/thickbox/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:28.570462 2026] [autoindex:error] [pid 6251:tid 6294] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/wordpress/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:30.870178 2026] [autoindex:error] [pid 6251:tid 6285] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/ui/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:35.872465 2026] [autoindex:error] [pid 6251:tid 6298] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:37.514428 2026] [autoindex:error] [pid 6251:tid 6286] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:37.681366 2026] [autoindex:error] [pid 6251:tid 6288] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:39.340201 2026] [autoindex:error] [pid 6251:tid 6292] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:39.510086 2026] [autoindex:error] [pid 6251:tid 6305] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:39.672844 2026] [autoindex:error] [pid 6251:tid 6287] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:40.648905 2026] [autoindex:error] [pid 6251:tid 6294] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:41.533514 2026] [autoindex:error] [pid 6251:tid 6301] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:41.696386 2026] [autoindex:error] [pid 6251:tid 6306] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:41.867579 2026] [autoindex:error] [pid 6251:tid 6293] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:44.224252 2026] [autoindex:error] [pid 6251:tid 6308] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/pullquote/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:46.587512 2026] [autoindex:error] [pid 6251:tid 6302] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/comments-pagination-numbers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:47.499742 2026] [autoindex:error] [pid 6251:tid 6298] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:49.230956 2026] [autoindex:error] [pid 6251:tid 6286] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:53.455031 2026] [autoindex:error] [pid 6251:tid 6287] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:53.618883 2026] [autoindex:error] [pid 6251:tid 6303] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/post-terms/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:54.527481 2026] [autoindex:error] [pid 6251:tid 6295] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:56.158160 2026] [autoindex:error] [pid 6251:tid 6293] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/namespaced/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:08:56.324628 2026] [autoindex:error] [pid 6251:tid 6309] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:00.097595 2026] [autoindex:error] [pid 6251:tid 6302] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:00.260450 2026] [autoindex:error] [pid 6251:tid 6296] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:03.326998 2026] [autoindex:error] [pid 6251:tid 6305] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/site-title/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:07.757536 2026] [autoindex:error] [pid 6251:tid 6309] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:11.580978 2026] [autoindex:error] [pid 6251:tid 6302] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:11.744283 2026] [autoindex:error] [pid 6251:tid 6296] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2026/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:12.627290 2026] [autoindex:error] [pid 6251:tid 6298] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:13.523328 2026] [autoindex:error] [pid 6251:tid 6297] [client 173.239.218.121:28467] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:15.599208 2026] [autoindex:error] [pid 23776:tid 23790] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:16.479057 2026] [autoindex:error] [pid 23776:tid 23786] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:16.645184 2026] [autoindex:error] [pid 23776:tid 23789] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:16.811590 2026] [autoindex:error] [pid 23776:tid 23781] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:16.975404 2026] [autoindex:error] [pid 23776:tid 23798] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:17.316403 2026] [autoindex:error] [pid 23776:tid 23791] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:17.479733 2026] [autoindex:error] [pid 23776:tid 23792] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:17.650961 2026] [autoindex:error] [pid 23776:tid 23782] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:17.815691 2026] [autoindex:error] [pid 23776:tid 23787] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:20.959798 2026] [autoindex:error] [pid 23776:tid 23799] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:33.257326 2026] [autoindex:error] [pid 23776:tid 23796] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:33.427804 2026] [autoindex:error] [pid 23776:tid 23785] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:33.590838 2026] [autoindex:error] [pid 23776:tid 23802] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:35.165353 2026] [autoindex:error] [pid 23776:tid 23786] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:36.094321 2026] [autoindex:error] [pid 23776:tid 23788] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:36.996586 2026] [autoindex:error] [pid 23776:tid 23801] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:37.165361 2026] [autoindex:error] [pid 23776:tid 23791] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:37.337308 2026] [autoindex:error] [pid 23776:tid 23792] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:37.502048 2026] [autoindex:error] [pid 23776:tid 23787] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:37.667094 2026] [autoindex:error] [pid 23776:tid 23782] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:37.833409 2026] [autoindex:error] [pid 23776:tid 23800] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:38.000827 2026] [autoindex:error] [pid 23776:tid 23795] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:42.632653 2026] [autoindex:error] [pid 23776:tid 23798] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:49.045962 2026] [autoindex:error] [pid 23776:tid 23780] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:51.372665 2026] [autoindex:error] [pid 23776:tid 23781] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:51.541170 2026] [autoindex:error] [pid 23776:tid 23801] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:53.281388 2026] [autoindex:error] [pid 23776:tid 23784] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:53.448540 2026] [autoindex:error] [pid 23776:tid 23798] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:53.610644 2026] [autoindex:error] [pid 23776:tid 23782] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:53.775601 2026] [autoindex:error] [pid 23776:tid 23793] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:53.945937 2026] [autoindex:error] [pid 23776:tid 23785] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:54.109066 2026] [autoindex:error] [pid 23776:tid 23790] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:54.271351 2026] [autoindex:error] [pid 23776:tid 23780] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:54.438283 2026] [autoindex:error] [pid 23776:tid 23786] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:54.604862 2026] [autoindex:error] [pid 23776:tid 23794] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:09:59.491283 2026] [autoindex:error] [pid 23776:tid 23782] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:10:06.667200 2026] [autoindex:error] [pid 23776:tid 23794] [client 173.239.218.116:53617] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:10:06.994818 2026] [autoindex:error] [pid 6344:tid 6364] [client 173.239.218.96:45271] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:10:20.031973 2026] [autoindex:error] [pid 6344:tid 6361] [client 173.239.218.96:45271] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/paste/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:10:21.641474 2026] [autoindex:error] [pid 6344:tid 6354] [client 173.239.218.96:45271] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:10:22.602818 2026] [autoindex:error] [pid 6344:tid 6351] [client 173.239.218.96:45271] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/directionality/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:10:23.494343 2026] [autoindex:error] [pid 6344:tid 6359] [client 173.239.218.96:45271] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/search/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:10:23.661334 2026] [autoindex:error] [pid 6344:tid 6367] [client 173.239.218.96:45271] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/compat3x/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:10:24.599208 2026] [autoindex:error] [pid 6344:tid 6353] [client 173.239.218.96:45271] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:10:25.515391 2026] [autoindex:error] [pid 6344:tid 6356] [client 173.239.218.96:45271] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:10:25.680780 2026] [autoindex:error] [pid 6344:tid 6350] [client 173.239.218.96:45271] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/classic-editor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:10:25.854653 2026] [proxy_fcgi:error] [pid 6344:tid 6366] [client 173.239.218.96:45271] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_header() in /home/expressi/public_html/wp-content/themes/twentytwentyone/index.php:17\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/themes/twentytwentyone/index.php on line 17'
[Thu Apr 23 03:10:28.235153 2026] [autoindex:error] [pid 6384:tid 6405] [client 173.239.218.91:52143] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:10:32.959830 2026] [autoindex:error] [pid 6384:tid 6391] [client 173.239.218.91:52143] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/paragraph/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 03:17:57.895635 2026] [:error] [pid 40382:tid 40408] [client 170.106.163.155:53834] [client 170.106.163.155] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aeke5VgwLEgwLqWlJksY-gAAANU"]
[Thu Apr 23 03:40:15.774753 2026] [:error] [pid 43083:tid 43106] [client 49.235.136.28:60600] [client 49.235.136.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aekkHzC5hrvNXosL83JFLgAAANU"]
[Thu Apr 23 05:58:02.413400 2026] [:error] [pid 25635:tid 25656] [client 195.3.220.88:49100] [client 195.3.220.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aelEasRxv6UsgRGKB3KavAAAARE"]
[Thu Apr 23 05:58:49.828327 2026] [proxy_fcgi:error] [pid 25635:tid 25642] [client 195.3.220.88:35810] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to undefined function get_header() in /home/expressi/public_html/wp-content/themes/twentytwentyone/404.php:12\nStack trace:\n#0 {main}\n  thrown in /home/expressi/public_html/wp-content/themes/twentytwentyone/404.php on line 12'
[Thu Apr 23 06:55:36.129946 2026] [:error] [pid 42971:tid 43007] [client 109.123.255.195:33976] [client 109.123.255.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.123.255.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aelR6DEP2_5RswrH8bGG2gAAABU"]
[Thu Apr 23 06:55:37.145915 2026] [:error] [pid 42971:tid 42986] [client 109.123.255.195:33976] [client 109.123.255.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.123.255.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aelR6TEP2_5RswrH8bGG2wAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Thu Apr 23 07:15:01.203923 2026] [autoindex:error] [pid 42973:tid 43057] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:15:15.444649 2026] [autoindex:error] [pid 42973:tid 43062] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:15:41.489727 2026] [autoindex:error] [pid 42973:tid 43056] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:15:45.556884 2026] [autoindex:error] [pid 42973:tid 43065] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:03.341246 2026] [autoindex:error] [pid 42973:tid 43059] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:03.656095 2026] [autoindex:error] [pid 42973:tid 43049] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:06.839023 2026] [autoindex:error] [pid 42973:tid 43053] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:07.128474 2026] [autoindex:error] [pid 42973:tid 43066] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:07.453948 2026] [autoindex:error] [pid 42973:tid 43046] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:10.639649 2026] [autoindex:error] [pid 42973:tid 43056] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:11.022456 2026] [autoindex:error] [pid 42973:tid 43044] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:11.370431 2026] [autoindex:error] [pid 42973:tid 43046] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:15.681094 2026] [autoindex:error] [pid 42973:tid 43056] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:15.972555 2026] [autoindex:error] [pid 42973:tid 43057] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:16.302030 2026] [autoindex:error] [pid 42973:tid 43053] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:26.489368 2026] [autoindex:error] [pid 42973:tid 43063] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:26.818563 2026] [autoindex:error] [pid 42973:tid 43050] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:27.170053 2026] [autoindex:error] [pid 42973:tid 43054] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:27.490743 2026] [autoindex:error] [pid 42973:tid 43058] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:27.806710 2026] [autoindex:error] [pid 42973:tid 43047] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:28.184302 2026] [autoindex:error] [pid 42973:tid 43063] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:34.311538 2026] [autoindex:error] [pid 42973:tid 43048] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:34.612909 2026] [autoindex:error] [pid 42973:tid 43055] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:47.677327 2026] [autoindex:error] [pid 42973:tid 43052] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:56.630127 2026] [autoindex:error] [pid 42973:tid 43053] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:58.720763 2026] [autoindex:error] [pid 42973:tid 43057] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:16:59.456870 2026] [autoindex:error] [pid 42973:tid 43043] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:17:10.234202 2026] [autoindex:error] [pid 42973:tid 43055] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:17:10.554675 2026] [autoindex:error] [pid 42973:tid 43048] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:17:23.751615 2026] [autoindex:error] [pid 42973:tid 43063] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:17:28.729875 2026] [autoindex:error] [pid 42973:tid 43056] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:17:34.334215 2026] [autoindex:error] [pid 42973:tid 43045] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:17:34.630202 2026] [autoindex:error] [pid 42973:tid 43054] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentythree/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:17:34.954269 2026] [autoindex:error] [pid 42973:tid 43063] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:17:35.266583 2026] [autoindex:error] [pid 42973:tid 43047] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:17:35.561657 2026] [autoindex:error] [pid 42973:tid 43067] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:17:43.032539 2026] [autoindex:error] [pid 42973:tid 43050] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:17:54.574854 2026] [autoindex:error] [pid 42973:tid 43061] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:17:54.911959 2026] [autoindex:error] [pid 42973:tid 43064] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:18:09.033360 2026] [autoindex:error] [pid 42973:tid 43048] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:18:15.315720 2026] [autoindex:error] [pid 42973:tid 43063] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:18:27.747762 2026] [autoindex:error] [pid 42973:tid 43058] [client 89.251.0.135:27747] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:18:33.667059 2026] [autoindex:error] [pid 42973:tid 43053] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:18:33.980650 2026] [autoindex:error] [pid 42973:tid 43057] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:18:34.382139 2026] [autoindex:error] [pid 42973:tid 43067] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:18:34.706502 2026] [autoindex:error] [pid 42973:tid 43045] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:18:35.027185 2026] [autoindex:error] [pid 42973:tid 43051] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:18:35.486256 2026] [autoindex:error] [pid 42973:tid 43056] [client 89.251.0.135:27747] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentytwo/assets/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:19:02.527545 2026] [autoindex:error] [pid 59700:tid 59705] [client 89.251.0.121:50905] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:19:02.876476 2026] [autoindex:error] [pid 59700:tid 59716] [client 89.251.0.121:50905] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:19:03.231638 2026] [autoindex:error] [pid 59700:tid 59726] [client 89.251.0.121:50905] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:19:03.585886 2026] [:error] [pid 59700:tid 59713] [client 89.251.0.121:50905] [client 89.251.0.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/coffee/"] [unique_id "aelXZ5XyGZJFeAIDWtlHHAAAAUs"]
[Thu Apr 23 07:19:04.337260 2026] [autoindex:error] [pid 64998:tid 65022] [client 89.251.0.141:28575] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:19:04.682438 2026] [autoindex:error] [pid 64998:tid 65017] [client 89.251.0.141:28575] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/calendar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:19:10.816934 2026] [autoindex:error] [pid 64998:tid 65016] [client 89.251.0.141:28575] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:19:23.676761 2026] [autoindex:error] [pid 64998:tid 65009] [client 89.251.0.141:28575] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/05/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:19:33.631828 2026] [autoindex:error] [pid 64998:tid 65006] [client 89.251.0.141:28575] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:19:34.045192 2026] [autoindex:error] [pid 64998:tid 65015] [client 89.251.0.141:28575] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:19:34.371040 2026] [autoindex:error] [pid 64998:tid 65017] [client 89.251.0.141:28575] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:19:34.686562 2026] [autoindex:error] [pid 64998:tid 65020] [client 89.251.0.141:28575] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:19:35.094716 2026] [autoindex:error] [pid 64998:tid 65012] [client 89.251.0.141:28575] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:20:01.313972 2026] [autoindex:error] [pid 64998:tid 65023] [client 89.251.0.141:28575] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:20:14.474253 2026] [autoindex:error] [pid 64998:tid 65023] [client 89.251.0.141:28575] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:20:14.797605 2026] [autoindex:error] [pid 64998:tid 65013] [client 89.251.0.141:28575] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:20:18.765009 2026] [autoindex:error] [pid 64998:tid 65004] [client 89.251.0.141:28575] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:20:40.169934 2026] [autoindex:error] [pid 64998:tid 65026] [client 89.251.0.141:28575] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:20:40.535580 2026] [autoindex:error] [pid 64998:tid 65010] [client 89.251.0.141:28575] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:20:40.882086 2026] [autoindex:error] [pid 64998:tid 65014] [client 89.251.0.141:28575] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:20:41.230849 2026] [autoindex:error] [pid 64998:tid 65008] [client 89.251.0.141:28575] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:20:57.179279 2026] [autoindex:error] [pid 64998:tid 65015] [client 89.251.0.141:28575] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:21:07.244293 2026] [autoindex:error] [pid 64998:tid 65020] [client 89.251.0.141:28575] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 07:53:41.137084 2026] [:error] [pid 64998:tid 65010] [client 116.118.44.53:56570] [client 116.118.44.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.118.44.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aelfhYV5EysYcTLjmwgoOQAAAcg"]
[Thu Apr 23 07:53:42.188188 2026] [:error] [pid 64998:tid 65006] [client 116.118.44.53:56570] [client 116.118.44.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.118.44.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aelfhoV5EysYcTLjmwgoQQAAAcQ"], referer: https://expressinteriors.com/wp-login.php
[Thu Apr 23 08:11:07.202220 2026] [:error] [pid 65000:tid 65030] [client 193.181.221.105:42762] [client 193.181.221.105] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.expressinteriors.com|F|2"] [data "TX:0=audio/mpeg"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aeljm76vRb9j6psK2ZbMFwAAAgE"]
[Thu Apr 23 08:30:18.387773 2026] [:error] [pid 65000:tid 65043] [client 116.118.44.53:32932] [client 116.118.44.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.118.44.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeloGr6vRb9j6psK2ZbS-AAAAgo"]
[Thu Apr 23 08:30:20.594962 2026] [:error] [pid 65000:tid 65051] [client 116.118.44.53:32932] [client 116.118.44.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.118.44.53, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeloHL6vRb9j6psK2ZbS-wAAAhI"], referer: https://expressinteriors.com/wp-login.php
[Thu Apr 23 09:12:34.193626 2026] [:error] [pid 25635:tid 25643] [client 152.57.30.199:54518] [client 152.57.30.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.57.30.199, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aelyAsRxv6UsgRGKB3LwkAAAAQQ"]
[Thu Apr 23 09:12:45.559756 2026] [:error] [pid 65000:tid 65042] [client 152.57.30.199:54923] [client 152.57.30.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.57.30.199, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aelyDb6vRb9j6psK2ZbhKgAAAgk"]
[Thu Apr 23 09:13:26.466064 2026] [:error] [pid 64998:tid 65017] [client 152.57.30.199:55455] [client 152.57.30.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.57.30.199, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aelyNoV5EysYcTLjmwhQzwAAAc8"]
[Thu Apr 23 09:13:35.998912 2026] [:error] [pid 59700:tid 59713] [client 152.57.30.199:55681] [client 152.57.30.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.57.30.199, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aelyP5XyGZJFeAIDWtmBKwAAAUs"]
[Thu Apr 23 09:13:47.816137 2026] [:error] [pid 65000:tid 65029] [client 152.57.30.199:55909] [client 152.57.30.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.57.30.199, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aelyS76vRb9j6psK2ZbhiAAAAgA"]
[Thu Apr 23 09:13:59.634158 2026] [:error] [pid 25635:tid 25640] [client 152.57.30.199:56150] [client 152.57.30.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.57.30.199, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aelyV8Rxv6UsgRGKB3LwrAAAAQE"]
[Thu Apr 23 09:24:58.875923 2026] [:error] [pid 43083:tid 43098] [client 41.60.247.228:52822] [client 41.60.247.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.60.247.228, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ael06jC5hrvNXosL83IDmAAAAM0"]
[Thu Apr 23 09:25:09.541595 2026] [:error] [pid 64998:tid 65012] [client 41.60.247.228:53195] [client 41.60.247.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.60.247.228, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ael09YV5EysYcTLjmwhYGgAAAco"]
[Thu Apr 23 09:25:20.142894 2026] [:error] [pid 42971:tid 42990] [client 41.60.247.228:53444] [client 41.60.247.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.60.247.228, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ael1ADEP2_5RswrH8bHMOAAAAAQ"]
[Thu Apr 23 09:25:31.926361 2026] [:error] [pid 25635:tid 25642] [client 41.60.247.228:53696] [client 41.60.247.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.60.247.228, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ael1C8Rxv6UsgRGKB3Lx9gAAAQM"]
[Thu Apr 23 09:25:41.335037 2026] [:error] [pid 64998:tid 65021] [client 41.60.247.228:53949] [client 41.60.247.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 41.60.247.228, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ael1FYV5EysYcTLjmwhYXwAAAdM"]
[Thu Apr 23 10:01:08.368995 2026] [:error] [pid 25635:tid 25655] [client 20.215.251.95:41620] [client 20.215.251.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.215.251.95, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ael9ZMRxv6UsgRGKB3IGpAAAARA"]
[Thu Apr 23 10:02:39.975524 2026] [:error] [pid 46953:tid 46980] [client 20.215.251.95:49133] [client 20.215.251.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.215.251.95, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ael9v0nlpdHh-P6wKbrRPQAAAlc"]
[Thu Apr 23 10:02:46.286417 2026] [:error] [pid 42973:tid 43061] [client 182.42.110.255:52690] [client 182.42.110.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ael9xm6I0QqmmmLTHE0DqgAAAJI"]
[Thu Apr 23 10:16:30.455020 2026] [:error] [pid 42971:tid 43001] [client 43.130.60.195:40390] [client 43.130.60.195] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aemA_jEP2_5RswrH8bHsnAAAAA8"]
[Thu Apr 23 10:17:13.415794 2026] [:error] [pid 42973:tid 43051] [client 101.100.234.23:43166] [client 101.100.234.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.100.234.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aemBKW6I0QqmmmLTHE0VLAAAAIg"]
[Thu Apr 23 10:17:17.908943 2026] [:error] [pid 42973:tid 43059] [client 101.100.234.23:43166] [client 101.100.234.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 101.100.234.23, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aemBLW6I0QqmmmLTHE0VZAAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Thu Apr 23 10:24:32.366153 2026] [:error] [pid 64998:tid 65006] [client 84.239.47.12:62329] [client 84.239.47.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/robots.txt"] [unique_id "aemC4IV5EysYcTLjmwig6wAAAcQ"]
[Thu Apr 23 10:24:34.466644 2026] [:error] [pid 65000:tid 65043] [client 84.239.47.12:52688] [client 84.239.47.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aemC4r6vRb9j6psK2ZYv6QAAAgo"]
[Thu Apr 23 10:24:34.946839 2026] [:error] [pid 65000:tid 65039] [client 84.239.47.12:39276] [client 84.239.47.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/robots.txt"] [unique_id "aemC4r6vRb9j6psK2ZYv7gAAAgY"]
[Thu Apr 23 10:24:35.621361 2026] [:error] [pid 42971:tid 43008] [client 84.239.47.12:4032] [client 84.239.47.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aemC4zEP2_5RswrH8bHuCAAAABY"]
[Thu Apr 23 10:24:37.019828 2026] [:error] [pid 42971:tid 42992] [client 84.239.47.12:40595] [client 84.239.47.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/robots.txt"] [unique_id "aemC5TEP2_5RswrH8bHuCwAAAAY"]
[Thu Apr 23 10:24:38.549912 2026] [:error] [pid 59700:tid 59702] [client 84.239.47.12:45210] [client 84.239.47.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aemC5pXyGZJFeAIDWtmuegAAAUA"]
[Thu Apr 23 10:24:38.872601 2026] [:error] [pid 65000:tid 65042] [client 84.239.47.12:39276] [client 84.239.47.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/robots.txt"] [unique_id "aemC5r6vRb9j6psK2ZYv_gAAAgk"]
[Thu Apr 23 10:24:39.869713 2026] [:error] [pid 65000:tid 65030] [client 84.239.47.12:2906] [client 84.239.47.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aemC576vRb9j6psK2ZYwBgAAAgE"]
[Thu Apr 23 10:24:40.364696 2026] [:error] [pid 65000:tid 65050] [client 84.239.47.12:12885] [client 84.239.47.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/robots.txt"] [unique_id "aemC6L6vRb9j6psK2ZYwCQAAAhE"]
[Thu Apr 23 10:24:40.919583 2026] [:error] [pid 65000:tid 65042] [client 84.239.47.12:44596] [client 84.239.47.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aemC6L6vRb9j6psK2ZYwCwAAAgk"]
[Thu Apr 23 10:24:42.318092 2026] [:error] [pid 64998:tid 65019] [client 84.239.47.12:47339] [client 84.239.47.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/robots.txt"] [unique_id "aemC6oV5EysYcTLjmwig7gAAAdE"]
[Thu Apr 23 10:24:43.596993 2026] [:error] [pid 43083:tid 43093] [client 84.239.47.12:45519] [client 84.239.47.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aemC6zC5hrvNXosL83IuVwAAAMg"]
[Thu Apr 23 10:24:45.670985 2026] [:error] [pid 65000:tid 65040] [client 84.239.47.12:44488] [client 84.239.47.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/robots.txt"] [unique_id "aemC7b6vRb9j6psK2ZYwEwAAAgc"]
[Thu Apr 23 10:24:46.188874 2026] [:error] [pid 65000:tid 65051] [client 84.239.47.12:28923] [client 84.239.47.12] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.expressinteriors.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aemC7r6vRb9j6psK2ZYwFQAAAhI"]
[Thu Apr 23 10:41:21.779987 2026] [:error] [pid 42972:tid 43039] [client 173.180.83.90:63519] [client 173.180.83.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.180.83.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aemG0cOAb-3sOknsk4dXTAAAAFc"]
[Thu Apr 23 10:41:24.434763 2026] [:error] [pid 43083:tid 43102] [client 170.168.96.36:54571] [client 170.168.96.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 170.168.96.36, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aemG1DC5hrvNXosL83IvngAAANE"]
[Thu Apr 23 10:41:25.481670 2026] [:error] [pid 43083:tid 43100] [client 170.168.96.36:54571] [client 170.168.96.36] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 170.168.96.36, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aemG1TC5hrvNXosL83IvnwAAAM8"]
[Thu Apr 23 10:43:13.950651 2026] [:error] [pid 46953:tid 46956] [client 103.30.72.102:37286] [client 103.30.72.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.30.72.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aemHQUnlpdHh-P6wKbrbBwAAAkA"]
[Thu Apr 23 10:43:15.232423 2026] [:error] [pid 46953:tid 46980] [client 103.30.72.102:37286] [client 103.30.72.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.30.72.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aemHQ0nlpdHh-P6wKbrbCAAAAlc"], referer: https://expressinteriors.com/wp-login.php
[Thu Apr 23 14:15:26.680055 2026] [:error] [pid 42973:tid 43064] [client 202.183.141.189:54714] [client 202.183.141.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.183.141.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aem4_m6I0QqmmmLTHE2F2AAAAJU"]
[Thu Apr 23 14:15:30.797289 2026] [:error] [pid 42972:tid 43039] [client 202.183.141.189:59650] [client 202.183.141.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.183.141.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aem5AsOAb-3sOknsk4ebaQAAAFc"], referer: https://expressinteriors.com/wp-login.php
[Thu Apr 23 14:47:08.170695 2026] [:error] [pid 42973:tid 43056] [client 67.207.86.6:55808] [client 67.207.86.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.207.86.6, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aenAbG6I0QqmmmLTHE2XQQAAAI0"]
[Thu Apr 23 14:47:11.859701 2026] [:error] [pid 46953:tid 46958] [client 67.207.86.6:57700] [client 67.207.86.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.207.86.6, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aenAb0nlpdHh-P6wKbr58AAAAkI"], referer: https://expressinteriors.com/wp-login.php
[Thu Apr 23 16:09:19.043350 2026] [:error] [pid 43083:tid 43104] [client 217.195.202.8:51820] [client 217.195.202.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.195.202.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aenTrzC5hrvNXosL83JRhwAAANM"]
[Thu Apr 23 16:09:19.964645 2026] [:error] [pid 43083:tid 43098] [client 217.195.202.8:51820] [client 217.195.202.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.195.202.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aenTrzC5hrvNXosL83JRigAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Thu Apr 23 16:09:43.838744 2026] [:error] [pid 59700:tid 59719] [client 43.130.150.80:50632] [client 43.130.150.80] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aenTx5XyGZJFeAIDWtnnygAAAVE"]
[Thu Apr 23 16:14:37.197911 2026] [:error] [pid 59700:tid 59703] [client 202.47.68.98:59826] [client 202.47.68.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.47.68.98, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aenU7ZXyGZJFeAIDWtnogwAAAUE"]
[Thu Apr 23 16:14:38.101086 2026] [:error] [pid 59700:tid 59704] [client 202.47.68.98:59826] [client 202.47.68.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 202.47.68.98, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aenU7pXyGZJFeAIDWtnohAAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Thu Apr 23 16:25:33.882471 2026] [:error] [pid 65000:tid 65037] [client 121.229.185.160:35143] [client 121.229.185.160] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aenXfb6vRb9j6psK2ZbBLAAAAgQ"]
[Thu Apr 23 18:07:07.051507 2026] [:error] [pid 64998:tid 65018] [client 43.153.73.200:57706] [client 43.153.73.200] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aenvS4V5EysYcTLjmwgWkgAAAdA"]
[Thu Apr 23 19:00:53.438710 2026] [:error] [pid 42971:tid 42994] [client 158.62.35.156:12834] [client 158.62.35.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.62.35.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aen75TEP2_5RswrH8bEa-QAAAAg"]
[Thu Apr 23 19:01:34.403931 2026] [:error] [pid 46953:tid 46974] [client 158.62.35.156:12805] [client 158.62.35.156] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aen8DknlpdHh-P6wKbogBgAAAlI"]
[Thu Apr 23 19:02:06.000680 2026] [:error] [pid 64998:tid 65014] [client 158.62.35.156:12900] [client 158.62.35.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.62.35.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aen8LYV5EysYcTLjmwgzwwAAAcw"]
[Thu Apr 23 19:02:32.573653 2026] [:error] [pid 42971:tid 42999] [client 158.62.35.156:13012] [client 158.62.35.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.62.35.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aen8SDEP2_5RswrH8bEbIAAAAA0"]
[Thu Apr 23 19:02:55.261614 2026] [:error] [pid 65000:tid 65049] [client 158.62.35.156:65066] [client 158.62.35.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.62.35.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aen8X76vRb9j6psK2ZYeTgAAAhA"]
[Thu Apr 23 19:03:20.287893 2026] [:error] [pid 59700:tid 59722] [client 158.62.35.156:65488] [client 158.62.35.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.62.35.156, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aen8eJXyGZJFeAIDWtkKowAAAVQ"]
[Thu Apr 23 21:20:06.678746 2026] [:error] [pid 65000:tid 65045] [client 176.123.23.211:63491] [client 176.123.23.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.123.23.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeochr6vRb9j6psK2ZaEGQAAAgw"]
[Thu Apr 23 21:20:32.889057 2026] [:error] [pid 65000:tid 65055] [client 176.123.23.211:11676] [client 176.123.23.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.123.23.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeocoL6vRb9j6psK2ZaEawAAAhY"]
[Thu Apr 23 21:20:39.874998 2026] [:error] [pid 64967:tid 64988] [client 176.123.23.211:20235] [client 176.123.23.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.123.23.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeocp4AV4GfOOdX8Qzp1ZAAAAZM"]
[Thu Apr 23 21:20:48.454050 2026] [:error] [pid 43083:tid 43096] [client 176.123.23.211:43930] [client 176.123.23.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.123.23.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeocsDC5hrvNXosL83J4CwAAAMs"]
[Thu Apr 23 21:20:59.258317 2026] [:error] [pid 65000:tid 65043] [client 176.123.23.211:61030] [client 176.123.23.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.123.23.211, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeocu76vRb9j6psK2ZaFKgAAAgo"]
[Thu Apr 23 21:20:59.261756 2026] [:error] [pid 65000:tid 65043] [client 176.123.23.211:61030] [client 176.123.23.211] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "73"] [id "210380"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||expressinteriors.com|F|4"] [data "XML=metaWeblog.newPost1acs@c$@@%wpp@ss_u%titlesrq99mdkfrg62gdescription8mz7ik89u6ra94r5yllbl0mt_keywordskksch1uzk56atvmt_excerptyhneukyo1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeocu76vRb9j6psK2ZaFKgAAAgo"]
[Thu Apr 23 21:26:24.782011 2026] [:error] [pid 64967:tid 64969] [client 135.225.37.79:20162] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxa.php"] [unique_id "aeoeAIAV4GfOOdX8Qzp2KwAAAYA"]
[Thu Apr 23 21:26:27.817524 2026] [:error] [pid 42972:tid 43019] [client 135.225.37.79:16743] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxa.php"] [unique_id "aeoeA8OAb-3sOknsk4c9PgAAAEM"]
[Thu Apr 23 21:26:29.804265 2026] [:error] [pid 46953:tid 46972] [client 135.225.37.79:44538] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxa.php"] [unique_id "aeoeBUnlpdHh-P6wKbo5zwAAAlA"]
[Thu Apr 23 21:26:38.294745 2026] [:error] [pid 42972:tid 43029] [client 135.225.37.79:38810] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxa.php"] [unique_id "aeoeDsOAb-3sOknsk4c9ZQAAAE0"]
[Thu Apr 23 21:26:41.066289 2026] [:error] [pid 65000:tid 65046] [client 135.225.37.79:27184] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aeoeEb6vRb9j6psK2ZaLUQAAAg0"]
[Thu Apr 23 21:26:44.593900 2026] [:error] [pid 42971:tid 42993] [client 135.225.37.79:51277] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aeoeFDEP2_5RswrH8bEr1AAAAAc"]
[Thu Apr 23 21:26:45.901758 2026] [:error] [pid 42972:tid 43032] [client 135.225.37.79:44036] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aeoeFcOAb-3sOknsk4c9ewAAAFA"]
[Thu Apr 23 21:26:47.487501 2026] [:error] [pid 65000:tid 65045] [client 135.225.37.79:40533] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aeoeF76vRb9j6psK2ZaLawAAAgw"]
[Thu Apr 23 21:26:50.710050 2026] [:error] [pid 46953:tid 46965] [client 135.225.37.79:50047] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxcs.php"] [unique_id "aeoeGknlpdHh-P6wKbo50wAAAkk"]
[Thu Apr 23 21:26:59.534206 2026] [:error] [pid 43083:tid 43100] [client 135.225.37.79:51298] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zxcs.php"] [unique_id "aeoeIzC5hrvNXosL83J5PgAAAM8"]
[Thu Apr 23 21:27:04.876925 2026] [:error] [pid 65000:tid 65042] [client 135.225.37.79:4713] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s1.php"] [unique_id "aeoeKL6vRb9j6psK2ZaLqAAAAgk"]
[Thu Apr 23 21:27:07.673946 2026] [:error] [pid 42973:tid 43045] [client 135.225.37.79:44075] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s1.php"] [unique_id "aeoeK26I0QqmmmLTHE0cawAAAII"]
[Thu Apr 23 21:27:10.195660 2026] [:error] [pid 43083:tid 43102] [client 135.225.37.79:4710] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s1.php"] [unique_id "aeoeLjC5hrvNXosL83J5RAAAANE"]
[Thu Apr 23 21:27:11.668038 2026] [:error] [pid 65000:tid 65030] [client 135.225.37.79:16284] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s1.php"] [unique_id "aeoeL76vRb9j6psK2ZaL0gAAAgE"]
[Thu Apr 23 21:27:15.805159 2026] [:error] [pid 42973:tid 43065] [client 135.225.37.79:28510] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kz.php"] [unique_id "aeoeM26I0QqmmmLTHE0ccAAAAJY"]
[Thu Apr 23 21:27:38.223568 2026] [:error] [pid 64998:tid 65002] [client 135.225.37.79:12830] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "aeoeSoV5EysYcTLjmwh_NAAAAcA"]
[Thu Apr 23 21:27:39.851191 2026] [:error] [pid 42973:tid 43052] [client 135.225.37.79:16280] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "aeoeS26I0QqmmmLTHE0ctQAAAIk"]
[Thu Apr 23 21:27:43.769020 2026] [:error] [pid 64998:tid 65009] [client 135.225.37.79:60791] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "aeoeT4V5EysYcTLjmwh_SwAAAcc"]
[Thu Apr 23 21:27:46.178679 2026] [:error] [pid 42972:tid 43033] [client 135.225.37.79:4677] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "aeoeUsOAb-3sOknsk4c-SwAAAFE"]
[Thu Apr 23 21:27:50.154075 2026] [:error] [pid 65000:tid 65048] [client 135.225.37.79:42902] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/man.php"] [unique_id "aeoeVr6vRb9j6psK2ZaMMgAAAg8"]
[Thu Apr 23 21:27:51.849429 2026] [:error] [pid 46953:tid 46956] [client 135.225.37.79:28543] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/man.php"] [unique_id "aeoeV0nlpdHh-P6wKbo6EAAAAkA"]
[Thu Apr 23 21:27:54.075774 2026] [:error] [pid 64998:tid 65025] [client 135.225.37.79:20817] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/man.php"] [unique_id "aeoeWoV5EysYcTLjmwh_bQAAAdc"]
[Thu Apr 23 21:27:56.800644 2026] [:error] [pid 42972:tid 43036] [client 135.225.37.79:4706] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/man.php"] [unique_id "aeoeXMOAb-3sOknsk4c-agAAAFQ"]
[Thu Apr 23 21:27:58.898682 2026] [:error] [pid 65000:tid 65029] [client 135.225.37.79:60788] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aboute.php"] [unique_id "aeoeXr6vRb9j6psK2ZaMRgAAAgA"]
[Thu Apr 23 21:28:00.284017 2026] [:error] [pid 42972:tid 43030] [client 135.225.37.79:60792] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aboute.php"] [unique_id "aeoeYMOAb-3sOknsk4c-bQAAAE4"]
[Thu Apr 23 21:28:03.816411 2026] [:error] [pid 42972:tid 43027] [client 135.225.37.79:16260] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aboute.php"] [unique_id "aeoeY8OAb-3sOknsk4c-dgAAAEs"]
[Thu Apr 23 21:28:07.252534 2026] [:error] [pid 25635:tid 25658] [client 135.225.37.79:50005] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aboute.php"] [unique_id "aeoeZ8Rxv6UsgRGKB3I0gQAAARM"]
[Thu Apr 23 21:28:09.303937 2026] [:error] [pid 46953:tid 46974] [client 135.225.37.79:4696] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ayk.php"] [unique_id "aeoeaUnlpdHh-P6wKbo6HwAAAlI"]
[Thu Apr 23 21:28:10.925360 2026] [:error] [pid 42971:tid 42988] [client 135.225.37.79:29929] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ayk.php"] [unique_id "aeoeajEP2_5RswrH8bEsDgAAAAI"]
[Thu Apr 23 21:28:13.472692 2026] [:error] [pid 42972:tid 43038] [client 135.225.37.79:16273] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ayk.php"] [unique_id "aeoebcOAb-3sOknsk4c-kQAAAFY"]
[Thu Apr 23 21:28:14.499448 2026] [:error] [pid 43083:tid 43099] [client 135.225.37.79:39895] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ayk.php"] [unique_id "aeoebjC5hrvNXosL83J5ewAAAM4"]
[Thu Apr 23 21:28:15.363591 2026] [:error] [pid 43083:tid 43108] [client 135.225.37.79:62276] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wps.php"] [unique_id "aeoebzC5hrvNXosL83J5fAAAANc"]
[Thu Apr 23 21:28:19.838509 2026] [:error] [pid 65000:tid 65047] [client 135.225.37.79:62398] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wps.php"] [unique_id "aeoec76vRb9j6psK2ZaMmQAAAg4"]
[Thu Apr 23 21:28:21.118500 2026] [:error] [pid 42972:tid 43034] [client 135.225.37.79:44044] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wps.php"] [unique_id "aeoedcOAb-3sOknsk4c-nwAAAFI"]
[Thu Apr 23 21:28:21.947530 2026] [:error] [pid 65000:tid 65051] [client 135.225.37.79:62389] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wps.php"] [unique_id "aeoedb6vRb9j6psK2ZaMqwAAAhI"]
[Thu Apr 23 21:28:23.181442 2026] [:error] [pid 42972:tid 43031] [client 135.225.37.79:16320] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aeoed8OAb-3sOknsk4c-pwAAAE8"]
[Thu Apr 23 21:28:24.327750 2026] [:error] [pid 64967:tid 64976] [client 135.225.37.79:63851] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aeoeeIAV4GfOOdX8Qzp2YAAAAYc"]
[Thu Apr 23 21:28:27.640265 2026] [:error] [pid 64998:tid 65009] [client 135.225.37.79:49999] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aeoee4V5EysYcTLjmwh_1QAAAcc"]
[Thu Apr 23 21:28:30.771373 2026] [:error] [pid 46953:tid 46963] [client 135.225.37.79:16293] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aeoefknlpdHh-P6wKbo6NwAAAkc"]
[Thu Apr 23 21:28:47.315358 2026] [:error] [pid 64998:tid 65021] [client 135.225.37.79:29902] [client 135.225.37.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "aeoej4V5EysYcTLjmwiABAAAAdM"]
[Thu Apr 23 21:28:54.861339 2026] [:error] [pid 64998:tid 65009] [client 135.225.37.79:29874] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/roksad1.php"] [unique_id "aeoeloV5EysYcTLjmwiAIQAAAcc"]
[Thu Apr 23 21:28:56.774949 2026] [:error] [pid 42973:tid 43064] [client 135.225.37.79:65266] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/roksad1.php"] [unique_id "aeoemG6I0QqmmmLTHE0ddgAAAJU"]
[Thu Apr 23 21:28:58.025940 2026] [:error] [pid 64998:tid 65008] [client 135.225.37.79:16285] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/roksad1.php"] [unique_id "aeoemoV5EysYcTLjmwiAKwAAAcY"]
[Thu Apr 23 21:28:59.748640 2026] [:error] [pid 59700:tid 59702] [client 135.225.37.79:43545] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/roksad1.php"] [unique_id "aeoem5XyGZJFeAIDWtkqsgAAAUA"]
[Thu Apr 23 21:29:03.855215 2026] [:error] [pid 46953:tid 46963] [client 135.225.37.79:29922] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "aeoen0nlpdHh-P6wKbo6VwAAAkc"]
[Thu Apr 23 21:29:08.044124 2026] [:error] [pid 42971:tid 43005] [client 135.225.37.79:63833] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "aeoepDEP2_5RswrH8bEsLAAAABM"]
[Thu Apr 23 21:29:10.400529 2026] [:error] [pid 42973:tid 43063] [client 135.225.37.79:20803] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "aeoepm6I0QqmmmLTHE0dgAAAAJQ"]
[Thu Apr 23 21:29:14.103907 2026] [:error] [pid 43083:tid 43091] [client 135.225.37.79:50042] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "aeoeqjC5hrvNXosL83J50gAAAMY"]
[Thu Apr 23 21:29:17.388545 2026] [:error] [pid 42973:tid 43054] [client 135.225.37.79:60764] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.php"] [unique_id "aeoerW6I0QqmmmLTHE0dlwAAAIs"]
[Thu Apr 23 21:29:21.288231 2026] [:error] [pid 64998:tid 65021] [client 135.225.37.79:50713] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.php"] [unique_id "aeoesYV5EysYcTLjmwiAYgAAAdM"]
[Thu Apr 23 21:29:23.343185 2026] [:error] [pid 59700:tid 59713] [client 135.225.37.79:62364] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.php"] [unique_id "aeoes5XyGZJFeAIDWtkq2gAAAUs"]
[Thu Apr 23 21:29:27.011552 2026] [:error] [pid 65000:tid 65037] [client 135.225.37.79:37759] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/config.php"] [unique_id "aeoet76vRb9j6psK2ZaNkgAAAgQ"]
[Thu Apr 23 21:29:29.154063 2026] [:error] [pid 65000:tid 65046] [client 135.225.37.79:62858] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xltt.php"] [unique_id "aeoeub6vRb9j6psK2ZaNnQAAAg0"]
[Thu Apr 23 21:29:30.230757 2026] [:error] [pid 42971:tid 42994] [client 135.225.37.79:64968] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xltt.php"] [unique_id "aeoeujEP2_5RswrH8bEsOQAAAAg"]
[Thu Apr 23 21:29:31.297656 2026] [:error] [pid 64998:tid 65012] [client 135.225.37.79:4751] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xltt.php"] [unique_id "aeoeu4V5EysYcTLjmwiAhQAAAco"]
[Thu Apr 23 21:29:33.741685 2026] [:error] [pid 42971:tid 43008] [client 135.225.37.79:41482] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xltt.php"] [unique_id "aeoevTEP2_5RswrH8bEsPwAAABY"]
[Thu Apr 23 21:29:36.040846 2026] [:error] [pid 42972:tid 43037] [client 135.225.37.79:61670] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "aeoewMOAb-3sOknsk4c_AwAAAFU"]
[Thu Apr 23 21:29:39.431410 2026] [:error] [pid 65000:tid 65051] [client 135.225.37.79:54573] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "aeoew76vRb9j6psK2ZaNrgAAAhI"]
[Thu Apr 23 21:29:40.729772 2026] [:error] [pid 64998:tid 65023] [client 135.225.37.79:15943] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "aeoexIV5EysYcTLjmwiApAAAAdU"]
[Thu Apr 23 21:29:45.014567 2026] [:error] [pid 65000:tid 65052] [client 135.225.37.79:15898] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "aeoeyb6vRb9j6psK2ZaN0AAAAhM"]
[Thu Apr 23 21:29:52.658166 2026] [:error] [pid 42972:tid 43034] [client 135.225.37.79:13079] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aeoe0MOAb-3sOknsk4c_HgAAAFI"]
[Thu Apr 23 21:30:09.055960 2026] [:error] [pid 46953:tid 46960] [client 135.225.37.79:54579] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aeoe4UnlpdHh-P6wKbo6gAAAAkQ"]
[Thu Apr 23 21:30:13.501302 2026] [:error] [pid 65000:tid 65057] [client 135.225.37.79:30564] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aeoe5b6vRb9j6psK2ZaOIAAAAhg"]
[Thu Apr 23 21:30:14.859887 2026] [:error] [pid 65000:tid 65032] [client 135.225.37.79:54551] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aeoe5r6vRb9j6psK2ZaOMAAAAgM"]
[Thu Apr 23 21:30:15.979745 2026] [:error] [pid 65000:tid 65038] [client 135.225.37.79:37794] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aeoe576vRb9j6psK2ZaOPgAAAgU"]
[Thu Apr 23 21:30:18.210935 2026] [:error] [pid 65000:tid 65031] [client 135.225.37.79:14835] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/view.php"] [unique_id "aeoe6r6vRb9j6psK2ZaOSwAAAgI"]
[Thu Apr 23 21:30:20.334693 2026] [:error] [pid 65000:tid 65037] [client 135.225.37.79:53436] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/view.php"] [unique_id "aeoe7L6vRb9j6psK2ZaOVAAAAgQ"]
[Thu Apr 23 21:30:21.692315 2026] [:error] [pid 64998:tid 65024] [client 135.225.37.79:14825] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/view.php"] [unique_id "aeoe7YV5EysYcTLjmwiBMAAAAdY"]
[Thu Apr 23 21:30:23.258930 2026] [:error] [pid 65000:tid 65050] [client 135.225.37.79:41530] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/view.php"] [unique_id "aeoe776vRb9j6psK2ZaOfAAAAhE"]
[Thu Apr 23 21:30:27.491387 2026] [:error] [pid 42971:tid 42989] [client 135.225.37.79:14832] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "aeoe8zEP2_5RswrH8bEsUwAAAAM"]
[Thu Apr 23 21:30:30.700936 2026] [:error] [pid 64998:tid 65020] [client 135.225.37.79:26613] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "aeoe9oV5EysYcTLjmwiBSgAAAdI"]
[Thu Apr 23 21:30:32.808102 2026] [:error] [pid 59700:tid 59725] [client 135.225.37.79:42919] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "aeoe-JXyGZJFeAIDWtkrHwAAAVc"]
[Thu Apr 23 21:30:37.195547 2026] [:error] [pid 64998:tid 65017] [client 135.225.37.79:28486] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "aeoe_YV5EysYcTLjmwiBYgAAAc8"]
[Thu Apr 23 21:30:39.255062 2026] [:error] [pid 42973:tid 43065] [client 135.225.37.79:44042] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aeoe_26I0QqmmmLTHE0d9gAAAJY"]
[Thu Apr 23 21:30:42.931813 2026] [:error] [pid 59700:tid 59712] [client 135.225.37.79:43998] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aeofApXyGZJFeAIDWtkrLQAAAUo"]
[Thu Apr 23 21:30:44.867561 2026] [:error] [pid 64967:tid 64982] [client 135.225.37.79:49398] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aeofBIAV4GfOOdX8Qzp2ggAAAY0"]
[Thu Apr 23 21:30:47.371469 2026] [:error] [pid 42972:tid 43024] [client 135.225.37.79:35706] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aeofB8OAb-3sOknsk4c_0wAAAEg"]
[Thu Apr 23 21:30:51.767946 2026] [:error] [pid 46953:tid 46974] [client 135.225.37.79:48710] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aeofC0nlpdHh-P6wKbo6uAAAAlI"]
[Thu Apr 23 21:30:55.403503 2026] [:error] [pid 42971:tid 43004] [client 135.225.37.79:4279] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aeofDzEP2_5RswrH8bEsYwAAABI"]
[Thu Apr 23 21:30:57.896962 2026] [:error] [pid 59700:tid 59702] [client 135.225.37.79:60016] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aeofEZXyGZJFeAIDWtkrNAAAAUA"]
[Thu Apr 23 21:31:01.362505 2026] [:error] [pid 64998:tid 65026] [client 135.225.37.79:20101] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "aeofFYV5EysYcTLjmwiBmgAAAdg"]
[Thu Apr 23 21:31:03.127049 2026] [:error] [pid 42972:tid 43035] [client 135.225.37.79:20136] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xper1.php"] [unique_id "aeofF8OAb-3sOknsk4c_4gAAAFM"]
[Thu Apr 23 21:31:04.435032 2026] [:error] [pid 65000:tid 65053] [client 135.225.37.79:36723] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xper1.php"] [unique_id "aeofGL6vRb9j6psK2ZaO2QAAAhQ"]
[Thu Apr 23 21:31:05.647771 2026] [:error] [pid 43083:tid 43102] [client 135.225.37.79:27879] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xper1.php"] [unique_id "aeofGTC5hrvNXosL83J6IAAAANE"]
[Thu Apr 23 21:31:15.410957 2026] [:error] [pid 42971:tid 42990] [client 135.225.37.79:24791] [client 135.225.37.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aeofIzEP2_5RswrH8bEsfAAAAAQ"]
[Thu Apr 23 21:31:25.710164 2026] [:error] [pid 64998:tid 65016] [client 135.225.37.79:48145] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mifta.php"] [unique_id "aeofLYV5EysYcTLjmwiCDwAAAc4"]
[Thu Apr 23 21:31:28.605178 2026] [:error] [pid 43083:tid 43096] [client 135.225.37.79:31667] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mifta.php"] [unique_id "aeofMDC5hrvNXosL83J6MgAAAMs"]
[Thu Apr 23 21:31:30.343856 2026] [:error] [pid 42972:tid 43022] [client 135.225.37.79:39335] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mifta.php"] [unique_id "aeofMsOAb-3sOknsk4dABgAAAEY"]
[Thu Apr 23 21:31:32.879117 2026] [:error] [pid 64998:tid 65021] [client 135.225.37.79:32752] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mifta.php"] [unique_id "aeofNIV5EysYcTLjmwiCGwAAAdM"]
[Thu Apr 23 21:31:34.045303 2026] [:error] [pid 25635:tid 25646] [client 135.225.37.79:17194] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws57.php"] [unique_id "aeofNsRxv6UsgRGKB3I01QAAAQc"]
[Thu Apr 23 21:31:35.802668 2026] [:error] [pid 65000:tid 65044] [client 135.225.37.79:55095] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws57.php"] [unique_id "aeofN76vRb9j6psK2ZaPGgAAAgs"]
[Thu Apr 23 21:31:40.980373 2026] [:error] [pid 46953:tid 46968] [client 135.225.37.79:4365] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws57.php"] [unique_id "aeofPEnlpdHh-P6wKbo62AAAAkw"]
[Thu Apr 23 21:31:42.299973 2026] [:error] [pid 64998:tid 65006] [client 135.225.37.79:49398] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws57.php"] [unique_id "aeofPoV5EysYcTLjmwiCPgAAAcQ"]
[Thu Apr 23 21:31:44.543488 2026] [:error] [pid 64998:tid 65019] [client 135.225.37.79:32704] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "aeofQIV5EysYcTLjmwiCTwAAAdE"]
[Thu Apr 23 21:31:46.387925 2026] [:error] [pid 42973:tid 43044] [client 135.225.37.79:53344] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "aeofQm6I0QqmmmLTHE0eIAAAAIE"]
[Thu Apr 23 21:31:49.579254 2026] [:error] [pid 64998:tid 65009] [client 135.225.37.79:23435] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "aeofRYV5EysYcTLjmwiCYAAAAcc"]
[Thu Apr 23 21:31:51.214045 2026] [:error] [pid 65000:tid 65051] [client 135.225.37.79:47010] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws86.php"] [unique_id "aeofR76vRb9j6psK2ZaPOQAAAhI"]
[Thu Apr 23 21:31:51.887815 2026] [:error] [pid 64998:tid 65008] [client 135.225.37.79:47024] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aeofR4V5EysYcTLjmwiCbgAAAcY"]
[Thu Apr 23 21:31:52.476829 2026] [:error] [pid 64998:tid 65020] [client 135.225.37.79:15156] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aeofSIV5EysYcTLjmwiCcgAAAdI"]
[Thu Apr 23 21:31:53.607280 2026] [:error] [pid 65000:tid 65029] [client 135.225.37.79:18328] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aeofSb6vRb9j6psK2ZaPQQAAAgA"]
[Thu Apr 23 21:31:54.776460 2026] [:error] [pid 64998:tid 65007] [client 135.225.37.79:25279] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "aeofSoV5EysYcTLjmwiCfAAAAcU"]
[Thu Apr 23 21:31:56.203327 2026] [:error] [pid 42971:tid 43001] [client 135.225.37.79:51929] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/packsin1.php"] [unique_id "aeofTDEP2_5RswrH8bEsgwAAAA8"]
[Thu Apr 23 21:31:57.452310 2026] [:error] [pid 65000:tid 65032] [client 135.225.37.79:59494] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/packsin1.php"] [unique_id "aeofTb6vRb9j6psK2ZaPSQAAAgM"]
[Thu Apr 23 21:31:58.646631 2026] [:error] [pid 65000:tid 65043] [client 135.225.37.79:35053] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/packsin1.php"] [unique_id "aeofTr6vRb9j6psK2ZaPTwAAAgo"]
[Thu Apr 23 21:32:00.443967 2026] [:error] [pid 42972:tid 43032] [client 135.225.37.79:13360] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/packsin1.php"] [unique_id "aeofUMOAb-3sOknsk4dAQwAAAFA"]
[Thu Apr 23 21:32:02.788163 2026] [:error] [pid 59700:tid 59708] [client 135.225.37.79:4384] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xs.php"] [unique_id "aeofUpXyGZJFeAIDWtkrSQAAAUY"]
[Thu Apr 23 21:32:03.609016 2026] [:error] [pid 25635:tid 25653] [client 135.225.37.79:51937] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xs.php"] [unique_id "aeofU8Rxv6UsgRGKB3I03AAAAQ4"]
[Thu Apr 23 21:32:04.280690 2026] [:error] [pid 25635:tid 25639] [client 135.225.37.79:13631] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xs.php"] [unique_id "aeofVMRxv6UsgRGKB3I03QAAAQA"]
[Thu Apr 23 21:32:05.199769 2026] [:error] [pid 64998:tid 65012] [client 135.225.37.79:48090] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xs.php"] [unique_id "aeofVYV5EysYcTLjmwiCmAAAAco"]
[Thu Apr 23 21:32:06.516211 2026] [:error] [pid 46953:tid 46980] [client 135.225.37.79:32235] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/img.php"] [unique_id "aeofVknlpdHh-P6wKbo66AAAAlc"]
[Thu Apr 23 21:32:09.351069 2026] [:error] [pid 59700:tid 59713] [client 135.225.37.79:47025] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/img.php"] [unique_id "aeofWZXyGZJFeAIDWtkrUQAAAUs"]
[Thu Apr 23 21:32:12.439183 2026] [:error] [pid 42972:tid 43034] [client 135.225.37.79:18340] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/img.php"] [unique_id "aeofXMOAb-3sOknsk4dAVAAAAFI"]
[Thu Apr 23 21:32:13.938891 2026] [:error] [pid 65000:tid 65044] [client 135.225.37.79:45619] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/img.php"] [unique_id "aeofXb6vRb9j6psK2ZaPegAAAgs"]
[Thu Apr 23 21:32:16.912850 2026] [:error] [pid 59700:tid 59724] [client 135.225.37.79:65039] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aeofYJXyGZJFeAIDWtkrUwAAAVY"]
[Thu Apr 23 21:32:20.817028 2026] [:error] [pid 65000:tid 65048] [client 135.225.37.79:18430] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "aeofZL6vRb9j6psK2ZaPfwAAAg8"]
[Thu Apr 23 21:32:38.731633 2026] [:error] [pid 43083:tid 43099] [client 135.225.37.79:48086] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aeofdjC5hrvNXosL83J6XAAAAM4"]
[Thu Apr 23 21:32:40.183310 2026] [:error] [pid 59700:tid 59721] [client 135.225.37.79:64746] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aeofeJXyGZJFeAIDWtkreAAAAVM"]
[Thu Apr 23 21:32:42.157828 2026] [:error] [pid 65000:tid 65032] [client 135.225.37.79:22863] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aeofer6vRb9j6psK2ZaPtwAAAgM"]
[Thu Apr 23 21:32:45.499913 2026] [:error] [pid 64998:tid 65022] [client 135.225.37.79:53353] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gecko.php"] [unique_id "aeoffYV5EysYcTLjmwiDAAAAAdQ"]
[Thu Apr 23 21:32:47.509803 2026] [:error] [pid 25635:tid 25656] [client 135.225.37.79:48066] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "aeoff8Rxv6UsgRGKB3I04AAAARE"]
[Thu Apr 23 21:32:51.839940 2026] [:error] [pid 65000:tid 65042] [client 135.225.37.79:4360] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "aeofg76vRb9j6psK2ZaPxgAAAgk"]
[Thu Apr 23 21:32:53.313516 2026] [:error] [pid 65000:tid 65038] [client 135.225.37.79:28446] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "aeofhb6vRb9j6psK2ZaPyQAAAgU"]
[Thu Apr 23 21:32:57.044027 2026] [:error] [pid 65000:tid 65039] [client 135.225.37.79:21427] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "aeofib6vRb9j6psK2ZaP2QAAAgY"]
[Thu Apr 23 21:32:58.659037 2026] [:error] [pid 65000:tid 65042] [client 135.225.37.79:53314] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws68.php"] [unique_id "aeofir6vRb9j6psK2ZaP4QAAAgk"]
[Thu Apr 23 21:33:03.330739 2026] [:error] [pid 46953:tid 46968] [client 135.225.37.79:47026] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws68.php"] [unique_id "aeofj0nlpdHh-P6wKbo7CAAAAkw"]
[Thu Apr 23 21:33:05.091288 2026] [:error] [pid 65000:tid 65029] [client 135.225.37.79:21387] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws68.php"] [unique_id "aeofkb6vRb9j6psK2ZaQAAAAAgA"]
[Thu Apr 23 21:33:06.615920 2026] [:error] [pid 42972:tid 43016] [client 135.225.37.79:22903] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws68.php"] [unique_id "aeofksOAb-3sOknsk4dAywAAAEA"]
[Thu Apr 23 21:33:08.748207 2026] [:error] [pid 64998:tid 65013] [client 135.225.37.79:12554] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "aeoflIV5EysYcTLjmwiDLQAAAcs"]
[Thu Apr 23 21:33:13.864112 2026] [:error] [pid 64967:tid 64992] [client 135.225.37.79:18002] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "aeofmYAV4GfOOdX8Qzp2wAAAAZc"]
[Thu Apr 23 21:33:16.038881 2026] [:error] [pid 65000:tid 65052] [client 135.225.37.79:4328] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "aeofnL6vRb9j6psK2ZaQJgAAAhM"]
[Thu Apr 23 21:33:19.026792 2026] [:error] [pid 65000:tid 65056] [client 135.225.37.79:52456] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "aeofn76vRb9j6psK2ZaQNwAAAhc"]
[Thu Apr 23 21:33:32.399535 2026] [:error] [pid 65000:tid 65044] [client 135.225.37.79:21406] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yuzuru1.php"] [unique_id "aeofrL6vRb9j6psK2ZaQTAAAAgs"]
[Thu Apr 23 21:33:36.884639 2026] [:error] [pid 46953:tid 46971] [client 135.225.37.79:31714] [client 135.225.37.79] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/son1.php"] [unique_id "aeofsEnlpdHh-P6wKbo7EAAAAk8"]
[Thu Apr 23 21:44:13.269463 2026] [:error] [pid 42972:tid 43018] [client 43.131.26.226:58082] [client 43.131.26.226] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aeoiLcOAb-3sOknsk4dEuwAAAEI"]
[Thu Apr 23 22:55:22.837208 2026] [:error] [pid 65000:tid 65047] [client 45.94.31.16:56874] [client 45.94.31.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "aeoy2r6vRb9j6psK2ZbHxgAAAg4"]
[Thu Apr 23 22:55:23.325818 2026] [:error] [pid 42972:tid 43028] [client 45.94.31.16:54089] [client 45.94.31.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "aeoy28OAb-3sOknsk4dfawAAAEw"]
[Thu Apr 23 22:55:23.818903 2026] [:error] [pid 42971:tid 42998] [client 45.94.31.16:52959] [client 45.94.31.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "aeoy2zEP2_5RswrH8bE1fwAAAAw"]
[Thu Apr 23 22:55:25.892082 2026] [:error] [pid 65000:tid 65045] [client 45.94.31.16:56967] [client 45.94.31.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "aeoy3b6vRb9j6psK2ZbH1QAAAgw"]
[Fri Apr 24 00:11:33.417368 2026] [:error] [pid 65000:tid 65046] [client 43.159.143.139:58164] [client 43.159.143.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aepEtb6vRb9j6psK2ZYQegAAAg0"]
[Fri Apr 24 00:22:24.178428 2026] [:error] [pid 42973:tid 43054] [client 34.72.91.80:35644] [client 34.72.91.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.72.91.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aepHQG6I0QqmmmLTHE1c7QAAAIs"]
[Fri Apr 24 00:22:26.864439 2026] [:error] [pid 42973:tid 43058] [client 34.72.91.80:35644] [client 34.72.91.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.72.91.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aepHQm6I0QqmmmLTHE1c7wAAAI8"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 24 01:27:20.663111 2026] [:error] [pid 64998:tid 65017] [client 197.237.100.214:53789] [client 197.237.100.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.237.100.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aepWeIV5EysYcTLjmwgkPgAAAc8"]
[Fri Apr 24 01:27:30.831487 2026] [:error] [pid 42972:tid 43033] [client 197.237.100.214:54034] [client 197.237.100.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.237.100.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aepWgsOAb-3sOknsk4e4PQAAAFE"]
[Fri Apr 24 01:27:41.306595 2026] [:error] [pid 64998:tid 65006] [client 197.237.100.214:54329] [client 197.237.100.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.237.100.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aepWjYV5EysYcTLjmwgkWQAAAcQ"]
[Fri Apr 24 01:27:51.850574 2026] [:error] [pid 64998:tid 65014] [client 197.237.100.214:54573] [client 197.237.100.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.237.100.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aepWl4V5EysYcTLjmwgkaQAAAcw"]
[Fri Apr 24 01:28:02.378132 2026] [:error] [pid 42972:tid 43027] [client 197.237.100.214:54854] [client 197.237.100.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.237.100.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aepWosOAb-3sOknsk4e4bwAAAEs"]
[Fri Apr 24 02:23:29.510828 2026] [:error] [pid 43083:tid 43091] [client 20.203.242.251:27819] [client 20.203.242.251] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.203.242.251, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aepjoTC5hrvNXosL83Ky3wAAAMY"]
[Fri Apr 24 03:42:37.614883 2026] [:error] [pid 15860:tid 15898] [client 20.203.241.106:34199] [client 20.203.241.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aep2LUKqEQvTD271xN7wogAAANc"]
[Fri Apr 24 03:43:15.821534 2026] [:error] [pid 15860:tid 15899] [client 20.203.241.106:10262] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blogs.php"] [unique_id "aep2U0KqEQvTD271xN7xKQAAANg"]
[Fri Apr 24 03:43:17.384091 2026] [:error] [pid 15724:tid 15828] [client 20.203.241.106:10253] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blogs.php"] [unique_id "aep2VTe3nAL-uT5ByouMSwAAAIA"]
[Fri Apr 24 03:43:19.778380 2026] [:error] [pid 15718:tid 15800] [client 20.203.241.106:38781] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blogs.php"] [unique_id "aep2Vxm_-1ZQP4eeQgYuPAAAAEI"]
[Fri Apr 24 03:43:21.281520 2026] [:error] [pid 15860:tid 15895] [client 20.203.241.106:36815] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blogs.php"] [unique_id "aep2WUKqEQvTD271xN7xOAAAANQ"]
[Fri Apr 24 03:43:23.985657 2026] [:error] [pid 15724:tid 15842] [client 20.203.241.106:32576] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aep2Wze3nAL-uT5ByouMZAAAAI4"]
[Fri Apr 24 03:43:26.932181 2026] [:error] [pid 15718:tid 15809] [client 20.203.241.106:38600] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aep2Xhm_-1ZQP4eeQgYuSwAAAEs"]
[Fri Apr 24 03:43:34.054425 2026] [:error] [pid 15860:tid 15870] [client 20.203.241.106:10301] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "aep2ZkKqEQvTD271xN7xRgAAAME"]
[Fri Apr 24 03:43:37.660690 2026] [:error] [pid 15860:tid 15878] [client 20.203.241.106:32576] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/export.php"] [unique_id "aep2aUKqEQvTD271xN7xSQAAAMU"]
[Fri Apr 24 03:43:39.724485 2026] [:error] [pid 15724:tid 15833] [client 20.203.241.106:31923] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/export.php"] [unique_id "aep2aze3nAL-uT5ByouMtAAAAIU"]
[Fri Apr 24 03:43:40.615340 2026] [:error] [pid 15704:tid 15770] [client 20.203.241.106:38010] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/export.php"] [unique_id "aep2bBLMBOJnY1h7qi-uogAAAAU"]
[Fri Apr 24 03:43:43.197176 2026] [:error] [pid 15704:tid 15789] [client 20.203.241.106:37971] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/export.php"] [unique_id "aep2bxLMBOJnY1h7qi-uqgAAABg"]
[Fri Apr 24 03:43:45.074301 2026] [:error] [pid 15718:tid 15819] [client 20.203.241.106:31593] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aep2cRm_-1ZQP4eeQgYuiAAAAFU"]
[Fri Apr 24 03:43:54.318383 2026] [:error] [pid 15860:tid 15870] [client 20.203.241.106:8107] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aep2ekKqEQvTD271xN7xdgAAAME"]
[Fri Apr 24 03:43:55.121676 2026] [:error] [pid 15860:tid 15899] [client 20.203.241.106:38721] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aep2e0KqEQvTD271xN7xfAAAANg"]
[Fri Apr 24 03:43:57.507347 2026] [:error] [pid 15860:tid 15879] [client 20.203.241.106:8087] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "aep2fUKqEQvTD271xN7xiQAAAMY"]
[Fri Apr 24 03:44:00.727251 2026] [:error] [pid 15860:tid 15894] [client 20.203.241.106:13275] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gdn.php"] [unique_id "aep2gEKqEQvTD271xN7xkwAAANM"]
[Fri Apr 24 03:44:03.147727 2026] [:error] [pid 15724:tid 15852] [client 20.203.241.106:37740] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gdn.php"] [unique_id "aep2gze3nAL-uT5ByouNBAAAAJg"]
[Fri Apr 24 03:44:06.271999 2026] [:error] [pid 15718:tid 15820] [client 20.203.241.106:31919] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gdn.php"] [unique_id "aep2hhm_-1ZQP4eeQgYuqQAAAFY"]
[Fri Apr 24 03:44:07.277735 2026] [:error] [pid 15860:tid 15898] [client 20.203.241.106:8061] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gdn.php"] [unique_id "aep2h0KqEQvTD271xN7xoAAAANc"]
[Fri Apr 24 03:44:08.980546 2026] [:error] [pid 15860:tid 15895] [client 20.203.241.106:37858] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bootstrap.php"] [unique_id "aep2iEKqEQvTD271xN7xpQAAANQ"]
[Fri Apr 24 03:44:09.926092 2026] [:error] [pid 15724:tid 15835] [client 20.203.241.106:36576] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bootstrap.php"] [unique_id "aep2iTe3nAL-uT5ByouNIwAAAIc"]
[Fri Apr 24 03:44:11.041796 2026] [:error] [pid 15704:tid 15765] [client 20.203.241.106:40047] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bootstrap.php"] [unique_id "aep2ixLMBOJnY1h7qi-vAAAAAAA"]
[Fri Apr 24 03:44:11.876753 2026] [:error] [pid 15704:tid 15782] [client 20.203.241.106:36937] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bootstrap.php"] [unique_id "aep2ixLMBOJnY1h7qi-vBwAAABE"]
[Fri Apr 24 03:44:13.737053 2026] [:error] [pid 15724:tid 15849] [client 20.203.241.106:30873] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws66.php"] [unique_id "aep2jTe3nAL-uT5ByouNNQAAAJU"]
[Fri Apr 24 03:44:25.551284 2026] [:error] [pid 15724:tid 15839] [client 20.203.241.106:30905] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/easy.php"] [unique_id "aep2mTe3nAL-uT5ByouNdAAAAIs"]
[Fri Apr 24 03:44:26.133692 2026] [:error] [pid 15860:tid 15889] [client 20.203.241.106:37623] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/easy.php"] [unique_id "aep2mkKqEQvTD271xN7x0wAAANA"]
[Fri Apr 24 03:44:26.672646 2026] [:error] [pid 15860:tid 15871] [client 20.203.241.106:32913] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/easy.php"] [unique_id "aep2mkKqEQvTD271xN7x2AAAAMI"]
[Fri Apr 24 03:44:27.228524 2026] [:error] [pid 15860:tid 15872] [client 20.203.241.106:14680] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/easy.php"] [unique_id "aep2m0KqEQvTD271xN7x3QAAAMM"]
[Fri Apr 24 03:44:27.843620 2026] [:error] [pid 15724:tid 15836] [client 20.203.241.106:7811] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "aep2mze3nAL-uT5ByouNiAAAAIg"]
[Fri Apr 24 03:44:28.452007 2026] [:error] [pid 15860:tid 15883] [client 20.203.241.106:32160] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "aep2nEKqEQvTD271xN7x4gAAAMo"]
[Fri Apr 24 03:44:28.989375 2026] [:error] [pid 15724:tid 15850] [client 20.203.241.106:34589] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "aep2nDe3nAL-uT5ByouNkwAAAJY"]
[Fri Apr 24 03:44:29.514280 2026] [:error] [pid 15860:tid 15881] [client 20.203.241.106:38996] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abc.php"] [unique_id "aep2nUKqEQvTD271xN7x5AAAAMg"]
[Fri Apr 24 03:44:30.041506 2026] [:error] [pid 15860:tid 15892] [client 20.203.241.106:22987] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aep2nkKqEQvTD271xN7x6QAAANI"]
[Fri Apr 24 03:44:30.605778 2026] [:error] [pid 15718:tid 15802] [client 20.203.241.106:33649] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aep2nhm_-1ZQP4eeQgYu8QAAAEQ"]
[Fri Apr 24 03:44:31.131580 2026] [:error] [pid 15860:tid 15869] [client 20.203.241.106:22988] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aep2n0KqEQvTD271xN7x8QAAAMA"]
[Fri Apr 24 03:44:31.665911 2026] [:error] [pid 15704:tid 15781] [client 20.203.241.106:35621] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aep2nxLMBOJnY1h7qi-vJAAAABA"]
[Fri Apr 24 03:44:32.212629 2026] [:error] [pid 15724:tid 15848] [client 20.203.241.106:32159] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a332.php"] [unique_id "aep2oDe3nAL-uT5ByouNrQAAAJQ"]
[Fri Apr 24 03:44:32.765798 2026] [:error] [pid 15724:tid 15837] [client 20.203.241.106:35617] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a332.php"] [unique_id "aep2oDe3nAL-uT5ByouNsgAAAIk"]
[Fri Apr 24 03:44:33.338114 2026] [:error] [pid 15704:tid 15789] [client 20.203.241.106:32695] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a332.php"] [unique_id "aep2oRLMBOJnY1h7qi-vKQAAABg"]
[Fri Apr 24 03:44:33.879106 2026] [:error] [pid 15860:tid 15898] [client 20.203.241.106:38862] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a332.php"] [unique_id "aep2oUKqEQvTD271xN7yAwAAANc"]
[Fri Apr 24 03:44:34.457069 2026] [:error] [pid 15860:tid 15896] [client 20.203.241.106:23409] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/about.php"] [unique_id "aep2okKqEQvTD271xN7yBgAAANU"]
[Fri Apr 24 03:44:35.010793 2026] [:error] [pid 15704:tid 15783] [client 20.203.241.106:31675] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/about.php"] [unique_id "aep2oxLMBOJnY1h7qi-vLAAAABI"]
[Fri Apr 24 03:44:35.555618 2026] [:error] [pid 15704:tid 15772] [client 20.203.241.106:31645] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/about.php"] [unique_id "aep2oxLMBOJnY1h7qi-vLgAAAAc"]
[Fri Apr 24 03:44:36.166566 2026] [:error] [pid 15718:tid 15800] [client 20.203.241.106:34381] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/about.php"] [unique_id "aep2pBm_-1ZQP4eeQgYvCwAAAEI"]
[Fri Apr 24 03:44:36.701111 2026] [:error] [pid 15718:tid 15819] [client 20.203.241.106:33659] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aep2pBm_-1ZQP4eeQgYvDgAAAFU"]
[Fri Apr 24 03:44:37.262656 2026] [:error] [pid 15860:tid 15895] [client 20.203.241.106:7486] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aep2pUKqEQvTD271xN7yCwAAANQ"]
[Fri Apr 24 03:44:37.852667 2026] [:error] [pid 15860:tid 15880] [client 20.203.241.106:7957] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aep2pUKqEQvTD271xN7yDAAAAMc"]
[Fri Apr 24 03:44:38.399024 2026] [:error] [pid 15860:tid 15881] [client 20.203.241.106:31634] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/index.php"] [unique_id "aep2pkKqEQvTD271xN7yDQAAAMg"]
[Fri Apr 24 03:44:38.957993 2026] [:error] [pid 15704:tid 15784] [client 20.203.241.106:33614] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/166.php"] [unique_id "aep2phLMBOJnY1h7qi-vNQAAABM"]
[Fri Apr 24 03:44:39.499395 2026] [:error] [pid 15718:tid 15798] [client 20.203.241.106:31648] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/166.php"] [unique_id "aep2pxm_-1ZQP4eeQgYvIQAAAEA"]
[Fri Apr 24 03:44:40.109086 2026] [:error] [pid 15704:tid 15785] [client 20.203.241.106:23420] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/166.php"] [unique_id "aep2qBLMBOJnY1h7qi-vNgAAABQ"]
[Fri Apr 24 03:44:40.621389 2026] [:error] [pid 15704:tid 15777] [client 20.203.241.106:34372] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/166.php"] [unique_id "aep2qBLMBOJnY1h7qi-vNwAAAAw"]
[Fri Apr 24 03:44:41.163089 2026] [:error] [pid 15860:tid 15897] [client 20.203.241.106:7895] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/to.php"] [unique_id "aep2qUKqEQvTD271xN7yEwAAANY"]
[Fri Apr 24 03:44:41.810083 2026] [:error] [pid 15860:tid 15896] [client 20.203.241.106:7953] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/to.php"] [unique_id "aep2qUKqEQvTD271xN7yFgAAANU"]
[Fri Apr 24 03:44:42.397703 2026] [:error] [pid 15724:tid 15834] [client 20.203.241.106:7592] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/to.php"] [unique_id "aep2qje3nAL-uT5ByouN7QAAAIY"]
[Fri Apr 24 03:44:42.919095 2026] [:error] [pid 15860:tid 15881] [client 20.203.241.106:37282] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/to.php"] [unique_id "aep2qkKqEQvTD271xN7yGAAAAMg"]
[Fri Apr 24 03:44:43.471819 2026] [:error] [pid 15704:tid 15781] [client 20.203.241.106:31622] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "aep2qxLMBOJnY1h7qi-vOQAAABA"]
[Fri Apr 24 03:44:44.031648 2026] [:error] [pid 15860:tid 15888] [client 20.203.241.106:13395] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "aep2rEKqEQvTD271xN7yHgAAAM8"]
[Fri Apr 24 03:44:44.548412 2026] [:error] [pid 15860:tid 15898] [client 20.203.241.106:7596] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "aep2rEKqEQvTD271xN7yIgAAANc"]
[Fri Apr 24 03:44:45.105399 2026] [:error] [pid 15724:tid 15849] [client 20.203.241.106:38402] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mini.php"] [unique_id "aep2rTe3nAL-uT5ByouN_QAAAJU"]
[Fri Apr 24 03:44:45.619765 2026] [:error] [pid 15724:tid 15852] [client 20.203.241.106:32544] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aep2rTe3nAL-uT5ByouOAwAAAJg"]
[Fri Apr 24 03:44:46.164688 2026] [:error] [pid 15860:tid 15889] [client 20.203.241.106:22815] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aep2rkKqEQvTD271xN7yLAAAANA"]
[Fri Apr 24 03:44:46.786657 2026] [:error] [pid 15724:tid 15828] [client 20.203.241.106:38416] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aep2rje3nAL-uT5ByouOEAAAAIA"]
[Fri Apr 24 03:44:47.422052 2026] [:error] [pid 15724:tid 15851] [client 20.203.241.106:35781] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aep2rze3nAL-uT5ByouOGgAAAJc"]
[Fri Apr 24 03:44:47.997625 2026] [:error] [pid 15724:tid 15831] [client 20.203.241.106:32551] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "aep2rze3nAL-uT5ByouOHwAAAIM"]
[Fri Apr 24 03:44:48.572709 2026] [:error] [pid 15860:tid 15880] [client 20.203.241.106:33224] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "aep2sEKqEQvTD271xN7yOQAAAMc"]
[Fri Apr 24 03:44:49.133216 2026] [:error] [pid 15860:tid 15888] [client 20.203.241.106:35783] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "aep2sUKqEQvTD271xN7yPAAAAM8"]
[Fri Apr 24 03:44:49.675188 2026] [:error] [pid 15704:tid 15785] [client 20.203.241.106:31702] [client 20.203.241.106] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "aep2sRLMBOJnY1h7qi-vQAAAABQ"]
[Fri Apr 24 04:29:58.185307 2026] [:error] [pid 19101:tid 19140] [client 74.206.180.196:50552] [client 74.206.180.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.206.180.196, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeqBRmAHj9bEvrTgbO2wnQAAAEM"]
[Fri Apr 24 04:29:59.206899 2026] [:error] [pid 19101:tid 19141] [client 74.206.180.196:50552] [client 74.206.180.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.206.180.196, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeqBR2AHj9bEvrTgbO2wngAAAEQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 24 04:41:53.635442 2026] [:error] [pid 19102:tid 19167] [client 103.124.95.161:38322] [client 103.124.95.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.124.95.161, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeqEEQDSgrbLEZbkqD6d5gAAAIM"]
[Fri Apr 24 04:41:55.795333 2026] [:error] [pid 19200:tid 19225] [client 103.124.95.161:54588] [client 103.124.95.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.124.95.161, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeqEEzQ--M3-tsKAnhFwEwAAANE"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 24 04:54:30.397845 2026] [:error] [pid 19200:tid 19232] [client 43.152.72.244:59176] [client 43.152.72.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aeqHBjQ--M3-tsKAnhF4nAAAANg"]
[Fri Apr 24 08:07:32.856346 2026] [:error] [pid 19102:tid 19165] [client 158.158.123.88:43151] [client 158.158.123.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeq0RADSgrbLEZbkqD4a6QAAAIE"]
[Fri Apr 24 08:07:33.705841 2026] [:error] [pid 19200:tid 19218] [client 158.158.123.88:45401] [client 158.158.123.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeq0RTQ--M3-tsKAnhEHvAAAAMo"]
[Fri Apr 24 08:07:34.497186 2026] [:error] [pid 19200:tid 19232] [client 158.158.123.88:27441] [client 158.158.123.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeq0RjQ--M3-tsKAnhEHxwAAANg"]
[Fri Apr 24 08:07:35.446227 2026] [:error] [pid 52129:tid 52146] [client 158.158.123.88:35035] [client 158.158.123.88] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeq0R-KCZKf8_u2LKiD5zQAAAQ0"]
[Fri Apr 24 08:47:28.766200 2026] [:error] [pid 19200:tid 19224] [client 141.164.37.171:35584] [client 141.164.37.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.164.37.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeq9oDQ--M3-tsKAnhEgjwAAANA"]
[Fri Apr 24 08:47:36.700159 2026] [:error] [pid 19102:tid 19176] [client 141.164.37.171:35594] [client 141.164.37.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 141.164.37.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeq9qADSgrbLEZbkqD4tiAAAAIw"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 24 09:57:25.453247 2026] [:error] [pid 19102:tid 19168] [client 103.124.95.161:39094] [client 103.124.95.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.124.95.161, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aerOBQDSgrbLEZbkqD5PbgAAAIQ"]
[Fri Apr 24 09:57:26.493024 2026] [:error] [pid 19102:tid 19165] [client 103.124.95.161:39094] [client 103.124.95.161] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.124.95.161, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aerOBgDSgrbLEZbkqD5PcAAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 24 10:32:05.675151 2026] [:error] [pid 17808:tid 17832] [client 194.26.192.182:59779] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aerWJearbOEFI8qshvI8CwAAAFY"]
[Fri Apr 24 10:32:06.186760 2026] [:error] [pid 22114:tid 22135] [client 194.26.192.182:60068] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aerWJoAuWGz3WlMQjodqDQAAARI"]
[Fri Apr 24 10:32:06.700513 2026] [:error] [pid 22114:tid 22138] [client 194.26.192.182:60389] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aerWJoAuWGz3WlMQjodqJQAAARU"]
[Fri Apr 24 10:32:07.208942 2026] [:error] [pid 22114:tid 22132] [client 194.26.192.182:60780] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aerWJ4AuWGz3WlMQjodqNQAAAQ8"]
[Fri Apr 24 10:32:07.775059 2026] [:error] [pid 17721:tid 17804] [client 194.26.192.182:61132] [client 194.26.192.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aerWJ-FXXkLeyDnfk_97XAAAABc"]
[Fri Apr 24 10:32:58.328586 2026] [autoindex:error] [pid 17808:tid 17811] [client 20.188.32.78:19420] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 10:33:00.476130 2026] [autoindex:error] [pid 17808:tid 17829] [client 20.188.32.78:19420] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/audio/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 10:33:02.107014 2026] [:error] [pid 17808:tid 17826] [client 20.188.32.78:19420] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.admin.php"] [unique_id "aerWXuarbOEFI8qshvI9CAAAAFA"]
[Fri Apr 24 10:33:03.774690 2026] [:error] [pid 17720:tid 17759] [client 20.188.32.78:19711] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.admin.php"] [unique_id "aerWX-hlUs6BS3Ng7_WpEAAAAMU"]
[Fri Apr 24 10:33:05.457887 2026] [:error] [pid 17808:tid 17812] [client 20.188.32.78:21051] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.admin.php"] [unique_id "aerWYearbOEFI8qshvI9CQAAAEI"]
[Fri Apr 24 10:33:07.044070 2026] [:error] [pid 17719:tid 17745] [client 20.188.32.78:30068] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.admin.php"] [unique_id "aerWY8TZ9gzEyL1BkPrHzwAAAJI"]
[Fri Apr 24 10:33:08.339627 2026] [:error] [pid 17720:tid 17776] [client 20.188.32.78:26955] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sw.php"] [unique_id "aerWZOhlUs6BS3Ng7_WpGAAAANY"]
[Fri Apr 24 10:33:09.431013 2026] [:error] [pid 17808:tid 17813] [client 20.188.32.78:9486] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sw.php"] [unique_id "aerWZearbOEFI8qshvI9EAAAAEM"]
[Fri Apr 24 10:33:10.168377 2026] [:error] [pid 17721:tid 17788] [client 20.188.32.78:19402] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sw.php"] [unique_id "aerWZuFXXkLeyDnfk_97zAAAAAc"]
[Fri Apr 24 10:33:10.914196 2026] [:error] [pid 17720:tid 17763] [client 20.188.32.78:33032] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sw.php"] [unique_id "aerWZuhlUs6BS3Ng7_WpHgAAAMk"]
[Fri Apr 24 10:33:12.033560 2026] [:error] [pid 17719:tid 17730] [client 20.188.32.78:9522] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vuln.php"] [unique_id "aerWaMTZ9gzEyL1BkPrH3AAAAIM"]
[Fri Apr 24 10:33:13.028314 2026] [:error] [pid 17721:tid 17791] [client 20.188.32.78:26911] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vuln.php"] [unique_id "aerWaeFXXkLeyDnfk_970AAAAAo"]
[Fri Apr 24 10:33:13.701854 2026] [:error] [pid 17719:tid 17751] [client 20.188.32.78:26938] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vuln.php"] [unique_id "aerWacTZ9gzEyL1BkPrH4gAAAJg"]
[Fri Apr 24 10:33:14.903425 2026] [:error] [pid 22114:tid 22141] [client 20.188.32.78:8722] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vuln.php"] [unique_id "aerWaoAuWGz3WlMQjodq6wAAARg"]
[Fri Apr 24 10:33:15.628575 2026] [:error] [pid 22114:tid 22139] [client 20.188.32.78:7188] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-temp.php"] [unique_id "aerWa4AuWGz3WlMQjodq7gAAARY"]
[Fri Apr 24 10:33:26.334065 2026] [:error] [pid 22114:tid 22127] [client 20.188.32.78:30044] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-temp.php"] [unique_id "aerWdoAuWGz3WlMQjodrAgAAAQo"]
[Fri Apr 24 10:33:28.882567 2026] [:error] [pid 22114:tid 22139] [client 20.188.32.78:11560] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-temp.php"] [unique_id "aerWeIAuWGz3WlMQjodrCAAAARY"]
[Fri Apr 24 10:34:23.219922 2026] [autoindex:error] [pid 17720:tid 17767] [client 20.188.32.78:16848] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfive/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 10:34:23.503983 2026] [autoindex:error] [pid 17720:tid 17772] [client 20.188.32.78:16848] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/buttons/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 10:34:33.447500 2026] [:error] [pid 17720:tid 17772] [client 20.188.32.78:16848] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2468.php"] [unique_id "aerWuehlUs6BS3Ng7_WqQgAAANI"]
[Fri Apr 24 10:34:35.077959 2026] [:error] [pid 17808:tid 17811] [client 20.188.32.78:19338] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2468.php"] [unique_id "aerWu-arbOEFI8qshvI9aAAAAEE"]
[Fri Apr 24 10:34:36.043170 2026] [:error] [pid 17720:tid 17756] [client 20.188.32.78:14728] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2468.php"] [unique_id "aerWvOhlUs6BS3Ng7_WqRwAAAMI"]
[Fri Apr 24 10:34:36.849764 2026] [:error] [pid 17721:tid 17783] [client 20.188.32.78:11347] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2468.php"] [unique_id "aerWvOFXXkLeyDnfk_98CAAAAAI"]
[Fri Apr 24 10:34:38.091592 2026] [:error] [pid 22114:tid 22117] [client 20.188.32.78:9900] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aerWvoAuWGz3WlMQjodrfgAAAQA"]
[Fri Apr 24 10:34:39.563503 2026] [:error] [pid 22114:tid 22139] [client 20.188.32.78:10072] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aerWv4AuWGz3WlMQjodrggAAARY"]
[Fri Apr 24 10:34:40.308359 2026] [:error] [pid 17721:tid 17781] [client 20.188.32.78:11507] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aerWwOFXXkLeyDnfk_98DgAAAAA"]
[Fri Apr 24 10:34:41.227455 2026] [:error] [pid 17721:tid 17801] [client 20.188.32.78:12235] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "aerWweFXXkLeyDnfk_98EwAAABQ"]
[Fri Apr 24 10:34:42.771805 2026] [:error] [pid 22114:tid 22126] [client 20.188.32.78:11491] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aerWwoAuWGz3WlMQjodrjQAAAQk"]
[Fri Apr 24 10:34:44.028568 2026] [:error] [pid 22114:tid 22133] [client 20.188.32.78:12253] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aerWxIAuWGz3WlMQjodrjwAAARA"]
[Fri Apr 24 10:34:45.733845 2026] [:error] [pid 17719:tid 17736] [client 20.188.32.78:14770] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aerWxcTZ9gzEyL1BkPrIQAAAAIk"]
[Fri Apr 24 10:34:46.935758 2026] [:error] [pid 17720:tid 17778] [client 20.188.32.78:14756] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aerWxuhlUs6BS3Ng7_WqWgAAANg"]
[Fri Apr 24 10:34:49.081554 2026] [:error] [pid 17719:tid 17731] [client 20.188.32.78:10067] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amdin.php"] [unique_id "aerWycTZ9gzEyL1BkPrISgAAAIQ"]
[Fri Apr 24 10:34:50.154682 2026] [:error] [pid 17720:tid 17766] [client 20.188.32.78:18860] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amdin.php"] [unique_id "aerWyuhlUs6BS3Ng7_WqZwAAAMw"]
[Fri Apr 24 10:34:51.015109 2026] [:error] [pid 17808:tid 17830] [client 20.188.32.78:15778] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amdin.php"] [unique_id "aerWy-arbOEFI8qshvI9cgAAAFQ"]
[Fri Apr 24 10:34:51.875603 2026] [:error] [pid 17719:tid 17732] [client 20.188.32.78:10434] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amdin.php"] [unique_id "aerWy8TZ9gzEyL1BkPrITwAAAIU"]
[Fri Apr 24 10:34:53.536468 2026] [:error] [pid 17721:tid 17801] [client 20.188.32.78:10470] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/huya.php"] [unique_id "aerWzeFXXkLeyDnfk_98GgAAABQ"]
[Fri Apr 24 10:34:54.786030 2026] [:error] [pid 17808:tid 17834] [client 20.188.32.78:12266] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/huya.php"] [unique_id "aerWzuarbOEFI8qshvI9eAAAAFg"]
[Fri Apr 24 10:34:56.143731 2026] [:error] [pid 17808:tid 17818] [client 20.188.32.78:11348] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/huya.php"] [unique_id "aerW0OarbOEFI8qshvI9ewAAAEg"]
[Fri Apr 24 10:34:57.317926 2026] [:error] [pid 22114:tid 22122] [client 20.188.32.78:11308] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/huya.php"] [unique_id "aerW0YAuWGz3WlMQjodrowAAAQU"]
[Fri Apr 24 10:34:58.435467 2026] [:error] [pid 17720:tid 17769] [client 20.188.32.78:11283] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/puc.php"] [unique_id "aerW0uhlUs6BS3Ng7_WqdAAAAM8"]
[Fri Apr 24 10:34:59.457841 2026] [:error] [pid 17808:tid 17815] [client 20.188.32.78:12262] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/puc.php"] [unique_id "aerW0-arbOEFI8qshvI9fgAAAEU"]
[Fri Apr 24 10:35:01.324341 2026] [:error] [pid 17719:tid 17730] [client 20.188.32.78:15755] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/puc.php"] [unique_id "aerW1cTZ9gzEyL1BkPrIVwAAAIM"]
[Fri Apr 24 10:35:02.964704 2026] [:error] [pid 17720:tid 17763] [client 20.188.32.78:10048] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/puc.php"] [unique_id "aerW1uhlUs6BS3Ng7_WqfgAAAMk"]
[Fri Apr 24 10:35:03.721687 2026] [:error] [pid 17808:tid 17813] [client 20.188.32.78:19358] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aerW1-arbOEFI8qshvI9gwAAAEM"]
[Fri Apr 24 10:35:05.206312 2026] [:error] [pid 17720:tid 17764] [client 20.188.32.78:15803] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aerW2ehlUs6BS3Ng7_WqiQAAAMo"]
[Fri Apr 24 10:35:06.312928 2026] [:error] [pid 17720:tid 17769] [client 20.188.32.78:14735] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aerW2uhlUs6BS3Ng7_WqjwAAAM8"]
[Fri Apr 24 10:35:08.334290 2026] [:error] [pid 17720:tid 17764] [client 20.188.32.78:15091] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "aerW3OhlUs6BS3Ng7_WqlAAAAMo"]
[Fri Apr 24 10:35:10.276254 2026] [:error] [pid 17808:tid 17812] [client 20.188.32.78:12225] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ewp.php"] [unique_id "aerW3uarbOEFI8qshvI9iwAAAEI"]
[Fri Apr 24 10:35:11.613466 2026] [:error] [pid 17721:tid 17787] [client 20.188.32.78:14739] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ewp.php"] [unique_id "aerW3-FXXkLeyDnfk_98LAAAAAY"]
[Fri Apr 24 10:35:12.976125 2026] [:error] [pid 22114:tid 22141] [client 20.188.32.78:9523] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ewp.php"] [unique_id "aerW4IAuWGz3WlMQjodrtgAAARg"]
[Fri Apr 24 10:35:15.361328 2026] [:error] [pid 17719:tid 17739] [client 20.188.32.78:15807] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ewp.php"] [unique_id "aerW48TZ9gzEyL1BkPrIYQAAAIw"]
[Fri Apr 24 10:35:16.929451 2026] [:error] [pid 17720:tid 17754] [client 20.188.32.78:15793] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kikikoko.php"] [unique_id "aerW5OhlUs6BS3Ng7_WqqgAAAMA"]
[Fri Apr 24 10:35:18.368913 2026] [:error] [pid 17720:tid 17761] [client 20.188.32.78:11356] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kikikoko.php"] [unique_id "aerW5uhlUs6BS3Ng7_WqsAAAAMc"]
[Fri Apr 24 10:35:19.869570 2026] [:error] [pid 17720:tid 17767] [client 20.188.32.78:36214] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kikikoko.php"] [unique_id "aerW5-hlUs6BS3Ng7_WqtgAAAM0"]
[Fri Apr 24 10:35:20.975355 2026] [:error] [pid 17719:tid 17749] [client 20.188.32.78:15089] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kikikoko.php"] [unique_id "aerW6MTZ9gzEyL1BkPrIYgAAAJY"]
[Fri Apr 24 10:35:21.878164 2026] [:error] [pid 22114:tid 22134] [client 20.188.32.78:11324] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aerW6YAuWGz3WlMQjodrwAAAARE"]
[Fri Apr 24 10:35:22.623859 2026] [:error] [pid 17808:tid 17827] [client 20.188.32.78:44153] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aerW6uarbOEFI8qshvI9lwAAAFE"]
[Fri Apr 24 10:35:23.745859 2026] [:error] [pid 17721:tid 17791] [client 20.188.32.78:21582] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aerW6-FXXkLeyDnfk_98NAAAAAo"]
[Fri Apr 24 10:35:25.806534 2026] [:error] [pid 17721:tid 17799] [client 20.188.32.78:9478] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "aerW7eFXXkLeyDnfk_98PgAAABI"]
[Fri Apr 24 10:35:27.185468 2026] [:error] [pid 17808:tid 17826] [client 20.188.32.78:9513] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "aerW7-arbOEFI8qshvI9ogAAAFA"]
[Fri Apr 24 10:35:28.026158 2026] [:error] [pid 17721:tid 17784] [client 20.188.32.78:18908] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "aerW8OFXXkLeyDnfk_98SQAAAAM"]
[Fri Apr 24 10:35:29.792310 2026] [:error] [pid 17720:tid 17766] [client 20.188.32.78:18829] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "aerW8ehlUs6BS3Ng7_WqxAAAAMw"]
[Fri Apr 24 10:35:30.902397 2026] [:error] [pid 17720:tid 17764] [client 20.188.32.78:19084] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "aerW8uhlUs6BS3Ng7_WqyQAAAMo"]
[Fri Apr 24 10:35:41.440586 2026] [autoindex:error] [pid 17720:tid 17765] [client 20.188.32.78:14732] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Apr 24 10:35:48.139574 2026] [:error] [pid 17720:tid 17757] [client 20.188.32.78:14732] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aerXBOhlUs6BS3Ng7_Wq8wAAAMM"]
[Fri Apr 24 10:35:48.948253 2026] [:error] [pid 17720:tid 17756] [client 20.188.32.78:22770] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aerXBOhlUs6BS3Ng7_Wq9wAAAMI"]
[Fri Apr 24 10:35:49.588341 2026] [:error] [pid 17808:tid 17825] [client 20.188.32.78:11301] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aerXBearbOEFI8qshvI9vwAAAE8"]
[Fri Apr 24 10:35:50.994540 2026] [:error] [pid 22114:tid 22134] [client 20.188.32.78:16009] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aerXBoAuWGz3WlMQjodr6AAAARE"]
[Fri Apr 24 10:35:51.658359 2026] [:error] [pid 22114:tid 22117] [client 20.188.32.78:15043] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aerXB4AuWGz3WlMQjodr7QAAAQA"]
[Fri Apr 24 10:35:52.484335 2026] [:error] [pid 17720:tid 17767] [client 20.188.32.78:19090] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aerXCOhlUs6BS3Ng7_WrBAAAAM0"]
[Fri Apr 24 10:35:53.471127 2026] [:error] [pid 17720:tid 17772] [client 20.188.32.78:36202] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aerXCehlUs6BS3Ng7_WrCQAAANI"]
[Fri Apr 24 10:35:54.500497 2026] [:error] [pid 17808:tid 17820] [client 20.188.32.78:10085] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aerXCuarbOEFI8qshvI9wgAAAEo"]
[Fri Apr 24 10:35:55.646357 2026] [:error] [pid 17721:tid 17802] [client 20.188.32.78:16102] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aerXC-FXXkLeyDnfk_98ZwAAABU"]
[Fri Apr 24 10:35:56.811459 2026] [:error] [pid 22114:tid 22117] [client 20.188.32.78:19096] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aerXDIAuWGz3WlMQjodr-QAAAQA"]
[Fri Apr 24 10:35:57.871852 2026] [:error] [pid 17720:tid 17760] [client 20.188.32.78:12228] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aerXDehlUs6BS3Ng7_WrFwAAAMY"]
[Fri Apr 24 10:35:58.820967 2026] [:error] [pid 17720:tid 17754] [client 20.188.32.78:10442] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aerXDuhlUs6BS3Ng7_WrGgAAAMA"]
[Fri Apr 24 10:35:59.773412 2026] [:error] [pid 17719:tid 17738] [client 20.188.32.78:19359] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aerXD8TZ9gzEyL1BkPrIfQAAAIs"]
[Fri Apr 24 10:36:00.798006 2026] [:error] [pid 17719:tid 17745] [client 20.188.32.78:44122] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aerXEMTZ9gzEyL1BkPrIfgAAAJI"]
[Fri Apr 24 10:36:02.135213 2026] [:error] [pid 17808:tid 17816] [client 20.188.32.78:10473] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aerXEuarbOEFI8qshvI9zAAAAEY"]
[Fri Apr 24 10:36:03.841131 2026] [:error] [pid 17719:tid 17742] [client 20.188.32.78:18835] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aerXE8TZ9gzEyL1BkPrIgwAAAI8"]
[Fri Apr 24 10:36:04.644523 2026] [:error] [pid 17721:tid 17797] [client 20.188.32.78:11364] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "aerXFOFXXkLeyDnfk_98bQAAABA"]
[Fri Apr 24 10:36:05.584528 2026] [:error] [pid 17719:tid 17740] [client 20.188.32.78:18866] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "aerXFcTZ9gzEyL1BkPrIhAAAAI0"]
[Fri Apr 24 10:36:06.792836 2026] [:error] [pid 17808:tid 17810] [client 20.188.32.78:36179] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "aerXFuarbOEFI8qshvI91AAAAEA"]
[Fri Apr 24 10:36:07.817916 2026] [:error] [pid 17721:tid 17805] [client 20.188.32.78:18896] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "aerXF-FXXkLeyDnfk_98dQAAABg"]
[Fri Apr 24 10:36:08.460515 2026] [:error] [pid 22114:tid 22127] [client 20.188.32.78:36164] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "aerXGIAuWGz3WlMQjodsBQAAAQo"]
[Fri Apr 24 10:36:09.706317 2026] [:error] [pid 17721:tid 17783] [client 20.188.32.78:18858] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "aerXGeFXXkLeyDnfk_98eQAAAAI"]
[Fri Apr 24 10:36:10.974126 2026] [:error] [pid 17719:tid 17730] [client 20.188.32.78:11458] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "aerXGsTZ9gzEyL1BkPrIkwAAAIM"]
[Fri Apr 24 10:36:11.988577 2026] [:error] [pid 17719:tid 17735] [client 20.188.32.78:10099] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "aerXG8TZ9gzEyL1BkPrImgAAAIg"]
[Fri Apr 24 10:36:13.507204 2026] [:error] [pid 17721:tid 17803] [client 20.188.32.78:19371] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "aerXHeFXXkLeyDnfk_98ewAAABY"]
[Fri Apr 24 10:36:14.803569 2026] [:error] [pid 17720:tid 17757] [client 20.188.32.78:21599] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "aerXHuhlUs6BS3Ng7_WrOAAAAMM"]
[Fri Apr 24 10:36:16.311652 2026] [:error] [pid 17720:tid 17758] [client 20.188.32.78:19382] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "aerXIOhlUs6BS3Ng7_WrPQAAAMQ"]
[Fri Apr 24 10:36:17.688578 2026] [:error] [pid 17720:tid 17768] [client 20.188.32.78:12244] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "aerXIehlUs6BS3Ng7_WrQgAAAM4"]
[Fri Apr 24 10:36:18.874525 2026] [:error] [pid 17720:tid 17777] [client 20.188.32.78:44107] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "aerXIuhlUs6BS3Ng7_WrSQAAANc"]
[Fri Apr 24 10:36:20.292149 2026] [:error] [pid 17808:tid 17830] [client 20.188.32.78:22751] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "aerXJOarbOEFI8qshvI-EgAAAFQ"]
[Fri Apr 24 10:36:21.037504 2026] [:error] [pid 17720:tid 17768] [client 20.188.32.78:18861] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "aerXJehlUs6BS3Ng7_WrSwAAAM4"]
[Fri Apr 24 10:36:23.386108 2026] [:error] [pid 17720:tid 17766] [client 20.188.32.78:21590] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "aerXJ-hlUs6BS3Ng7_WrWgAAAMw"]
[Fri Apr 24 10:36:25.514444 2026] [:error] [pid 17808:tid 17823] [client 20.188.32.78:15077] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aerXKearbOEFI8qshvI-KgAAAE0"]
[Fri Apr 24 10:36:26.936834 2026] [:error] [pid 17808:tid 17822] [client 20.188.32.78:19113] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aerXKuarbOEFI8qshvI-NwAAAEw"]
[Fri Apr 24 10:36:30.148300 2026] [:error] [pid 22114:tid 22132] [client 20.188.32.78:19360] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aerXLoAuWGz3WlMQjodsJQAAAQ8"]
[Fri Apr 24 10:37:05.214978 2026] [:error] [pid 17720:tid 17778] [client 20.188.32.78:18901] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "aerXUehlUs6BS3Ng7_WsSQAAANg"]
[Fri Apr 24 10:37:07.151279 2026] [:error] [pid 22114:tid 22128] [client 20.188.32.78:16103] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "aerXU4AuWGz3WlMQjodstgAAAQs"]
[Fri Apr 24 10:37:07.974137 2026] [:error] [pid 17719:tid 17731] [client 20.188.32.78:28109] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "aerXU8TZ9gzEyL1BkPrI4AAAAIQ"]
[Fri Apr 24 10:37:09.798468 2026] [:error] [pid 17720:tid 17763] [client 20.188.32.78:15074] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "aerXVehlUs6BS3Ng7_WsVgAAAMk"]
[Fri Apr 24 10:37:10.862689 2026] [:error] [pid 17721:tid 17798] [client 20.188.32.78:18922] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fine.php"] [unique_id "aerXVuFXXkLeyDnfk_985QAAABE"]
[Fri Apr 24 10:37:12.442420 2026] [:error] [pid 17719:tid 17730] [client 20.188.32.78:16037] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fine.php"] [unique_id "aerXWMTZ9gzEyL1BkPrI4gAAAIM"]
[Fri Apr 24 10:37:16.383987 2026] [:error] [pid 17721:tid 17800] [client 20.188.32.78:9507] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fine.php"] [unique_id "aerXXOFXXkLeyDnfk_989AAAABM"]
[Fri Apr 24 10:37:17.549872 2026] [:error] [pid 17720:tid 17764] [client 20.188.32.78:18828] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fine.php"] [unique_id "aerXXehlUs6BS3Ng7_WsZAAAAMo"]
[Fri Apr 24 10:37:19.151750 2026] [:error] [pid 22114:tid 22118] [client 20.188.32.78:16080] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aerXX4AuWGz3WlMQjodszAAAAQE"]
[Fri Apr 24 10:37:21.132548 2026] [:error] [pid 17808:tid 17830] [client 20.188.32.78:36192] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aerXYearbOEFI8qshvI-0gAAAFQ"]
[Fri Apr 24 10:37:22.550960 2026] [:error] [pid 17720:tid 17762] [client 20.188.32.78:14781] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aerXYuhlUs6BS3Ng7_WsawAAAMg"]
[Fri Apr 24 10:37:23.847125 2026] [:error] [pid 22114:tid 22119] [client 20.188.32.78:16124] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "aerXY4AuWGz3WlMQjods1gAAAQI"]
[Fri Apr 24 10:37:25.360503 2026] [:error] [pid 17721:tid 17799] [client 20.188.32.78:10635] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aerXZeFXXkLeyDnfk_99CQAAABI"]
[Fri Apr 24 10:37:26.180803 2026] [:error] [pid 22114:tid 22124] [client 20.188.32.78:12285] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aerXZoAuWGz3WlMQjods3AAAAQc"]
[Fri Apr 24 10:37:27.999173 2026] [:error] [pid 17808:tid 17819] [client 20.188.32.78:18881] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aerXZ-arbOEFI8qshvI-3QAAAEk"]
[Fri Apr 24 10:37:31.050310 2026] [:error] [pid 17720:tid 17762] [client 20.188.32.78:1241] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "aerXa-hlUs6BS3Ng7_WsigAAAMg"]
[Fri Apr 24 10:37:32.655711 2026] [:error] [pid 17720:tid 17757] [client 20.188.32.78:44126] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aerXbOhlUs6BS3Ng7_WslAAAAMM"]
[Fri Apr 24 10:37:33.372609 2026] [:error] [pid 17719:tid 17749] [client 20.188.32.78:18880] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aerXbcTZ9gzEyL1BkPrI-gAAAJY"]
[Fri Apr 24 10:37:34.601943 2026] [:error] [pid 17720:tid 17778] [client 20.188.32.78:1261] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aerXbuhlUs6BS3Ng7_WsnAAAANg"]
[Fri Apr 24 10:37:36.249701 2026] [:error] [pid 17720:tid 17775] [client 20.188.32.78:1239] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "aerXcOhlUs6BS3Ng7_WspAAAANU"]
[Fri Apr 24 10:37:38.230695 2026] [:error] [pid 17720:tid 17778] [client 20.188.32.78:19345] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aerXcuhlUs6BS3Ng7_WssAAAANg"]
[Fri Apr 24 10:37:40.328613 2026] [:error] [pid 17808:tid 17828] [client 20.188.32.78:36190] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aerXdOarbOEFI8qshvI-5wAAAFI"]
[Fri Apr 24 10:37:42.348660 2026] [:error] [pid 22114:tid 22123] [client 20.188.32.78:36201] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aerXdoAuWGz3WlMQjods8gAAAQY"]
[Fri Apr 24 10:37:43.748685 2026] [:error] [pid 17721:tid 17799] [client 20.188.32.78:21005] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aerXd-FXXkLeyDnfk_99IwAAABI"]
[Fri Apr 24 10:37:45.545998 2026] [:error] [pid 17720:tid 17769] [client 20.188.32.78:10635] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "aerXeehlUs6BS3Ng7_Ws4AAAAM8"]
[Fri Apr 24 10:37:46.495760 2026] [:error] [pid 22114:tid 22117] [client 20.188.32.78:44130] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "aerXeoAuWGz3WlMQjods9gAAAQA"]
[Fri Apr 24 10:37:49.605196 2026] [:error] [pid 17719:tid 17736] [client 20.188.32.78:19380] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "aerXfcTZ9gzEyL1BkPrJBwAAAIk"]
[Fri Apr 24 10:37:51.735977 2026] [:error] [pid 22114:tid 22119] [client 20.188.32.78:11472] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "aerXf4AuWGz3WlMQjodtAgAAAQI"]
[Fri Apr 24 10:37:52.844580 2026] [:error] [pid 17721:tid 17796] [client 20.188.32.78:26894] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "aerXgOFXXkLeyDnfk_99LgAAAA8"]
[Fri Apr 24 10:37:54.164961 2026] [:error] [pid 17721:tid 17791] [client 20.188.32.78:10971] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "aerXguFXXkLeyDnfk_99MQAAAAo"]
[Fri Apr 24 10:37:55.338496 2026] [:error] [pid 17721:tid 17802] [client 20.188.32.78:21629] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "aerXg-FXXkLeyDnfk_99OQAAABU"]
[Fri Apr 24 10:37:56.492157 2026] [:error] [pid 22114:tid 22118] [client 20.188.32.78:26985] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "aerXhIAuWGz3WlMQjodtBwAAAQE"]
[Fri Apr 24 10:37:58.148571 2026] [:error] [pid 17719:tid 17728] [client 20.188.32.78:10641] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "aerXhsTZ9gzEyL1BkPrJEgAAAIE"]
[Fri Apr 24 10:37:59.309354 2026] [:error] [pid 17721:tid 17781] [client 20.188.32.78:26947] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "aerXh-FXXkLeyDnfk_99UQAAAAA"]
[Fri Apr 24 10:38:00.225095 2026] [:error] [pid 17719:tid 17740] [client 20.188.32.78:21016] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "aerXiMTZ9gzEyL1BkPrJFAAAAI0"]
[Fri Apr 24 10:38:02.029653 2026] [:error] [pid 17719:tid 17751] [client 20.188.32.78:10389] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "aerXisTZ9gzEyL1BkPrJFwAAAJg"]
[Fri Apr 24 10:38:03.227494 2026] [:error] [pid 22114:tid 22131] [client 20.188.32.78:10645] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "aerXi4AuWGz3WlMQjodtEwAAAQ4"]
[Fri Apr 24 10:38:17.626979 2026] [:error] [pid 22114:tid 22130] [client 20.188.32.78:27735] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aerXmYAuWGz3WlMQjodtSQAAAQ0"]
[Fri Apr 24 10:38:20.107105 2026] [:error] [pid 17721:tid 17803] [client 20.188.32.78:18923] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aerXnOFXXkLeyDnfk_99aAAAABY"]
[Fri Apr 24 10:38:21.563614 2026] [:error] [pid 22114:tid 22128] [client 20.188.32.78:10637] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aerXnYAuWGz3WlMQjodtUgAAAQs"]
[Fri Apr 24 10:38:22.514613 2026] [:error] [pid 17720:tid 17764] [client 20.188.32.78:14741] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aerXnuhlUs6BS3Ng7_WtMQAAAMo"]
[Fri Apr 24 10:38:23.662356 2026] [:error] [pid 17720:tid 17777] [client 20.188.32.78:19075] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aerXn-hlUs6BS3Ng7_WtNQAAANc"]
[Fri Apr 24 10:38:24.792453 2026] [:error] [pid 17808:tid 17831] [client 20.188.32.78:18941] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aerXoOarbOEFI8qshvI_MAAAAFU"]
[Fri Apr 24 10:38:25.938432 2026] [:error] [pid 17808:tid 17828] [client 20.188.32.78:19112] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aerXoearbOEFI8qshvI_NQAAAFI"]
[Fri Apr 24 10:38:27.000104 2026] [:error] [pid 22114:tid 22122] [client 20.188.32.78:36176] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aerXooAuWGz3WlMQjodtXQAAAQU"]
[Fri Apr 24 10:38:28.011195 2026] [:error] [pid 17720:tid 17760] [client 20.188.32.78:15052] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aerXpOhlUs6BS3Ng7_WtPwAAAMY"]
[Fri Apr 24 10:38:29.354385 2026] [:error] [pid 17720:tid 17766] [client 20.188.32.78:11281] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aerXpehlUs6BS3Ng7_WtSAAAAMw"]
[Fri Apr 24 10:38:30.202621 2026] [:error] [pid 22114:tid 22120] [client 20.188.32.78:10268] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aerXpoAuWGz3WlMQjodtZQAAAQM"]
[Fri Apr 24 10:38:31.126900 2026] [:error] [pid 17720:tid 17765] [client 20.188.32.78:10481] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aerXp-hlUs6BS3Ng7_WtTgAAAMs"]
[Fri Apr 24 10:38:31.980913 2026] [:error] [pid 17720:tid 17774] [client 20.188.32.78:28152] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aerXp-hlUs6BS3Ng7_WtVAAAANQ"]
[Fri Apr 24 10:38:32.805615 2026] [:error] [pid 17808:tid 17829] [client 20.188.32.78:21601] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aerXqOarbOEFI8qshvI_QAAAAFM"]
[Fri Apr 24 10:38:33.914745 2026] [:error] [pid 22114:tid 22132] [client 20.188.32.78:1166] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aerXqYAuWGz3WlMQjodtbAAAAQ8"]
[Fri Apr 24 10:38:34.855804 2026] [:error] [pid 22114:tid 22139] [client 20.188.32.78:52131] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aerXqoAuWGz3WlMQjodtbgAAARY"]
[Fri Apr 24 10:38:35.691207 2026] [:error] [pid 17721:tid 17796] [client 20.188.32.78:8218] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "aerXq-FXXkLeyDnfk_99fQAAAA8"]
[Fri Apr 24 10:38:36.378918 2026] [:error] [pid 17808:tid 17822] [client 20.188.32.78:30347] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "aerXrOarbOEFI8qshvI_SgAAAEw"]
[Fri Apr 24 10:38:37.092510 2026] [:error] [pid 22114:tid 22136] [client 20.188.32.78:8600] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "aerXrYAuWGz3WlMQjodtcwAAARM"]
[Fri Apr 24 10:38:37.893178 2026] [:error] [pid 22114:tid 22118] [client 20.188.32.78:8522] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "aerXrYAuWGz3WlMQjodtdQAAAQE"]
[Fri Apr 24 10:38:39.379557 2026] [:error] [pid 17721:tid 17796] [client 20.188.32.78:8527] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aerXr-FXXkLeyDnfk_99hgAAAA8"]
[Fri Apr 24 10:38:40.561221 2026] [:error] [pid 17720:tid 17763] [client 20.188.32.78:35041] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aerXsOhlUs6BS3Ng7_WtagAAAMk"]
[Fri Apr 24 10:38:41.351922 2026] [:error] [pid 17719:tid 17735] [client 20.188.32.78:15305] [client 20.188.32.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aerXscTZ9gzEyL1BkPrJmQAAAIg"]
[Fri Apr 24 11:55:06.979588 2026] [:error] [pid 17808:tid 17830] [client 103.75.185.25:38330] [client 103.75.185.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.75.185.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aerpmuarbOEFI8qshvJnVAAAAFQ"]
[Fri Apr 24 11:55:08.062411 2026] [:error] [pid 17808:tid 17816] [client 103.75.185.25:38330] [client 103.75.185.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.75.185.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aerpnOarbOEFI8qshvJnVwAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 24 12:05:31.717336 2026] [:error] [pid 17719:tid 17736] [client 65.108.239.60:59422] [client 65.108.239.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.108.239.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aersC8TZ9gzEyL1BkPoGIgAAAIk"]
[Fri Apr 24 12:05:32.747289 2026] [:error] [pid 17719:tid 17733] [client 65.108.239.60:59422] [client 65.108.239.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.108.239.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aersDMTZ9gzEyL1BkPoGJAAAAIY"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 24 12:10:19.789986 2026] [:error] [pid 17808:tid 17824] [client 192.144.148.122:33886] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aertK-arbOEFI8qshvJx3wAAAE4"]
[Fri Apr 24 12:22:14.769038 2026] [:error] [pid 17721:tid 17791] [client 43.131.39.179:38176] [client 43.131.39.179] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aerv9uFXXkLeyDnfk_-ptQAAAAo"]
[Fri Apr 24 14:00:11.770147 2026] [:error] [pid 17719:tid 17746] [client 208.122.213.225:54968] [client 208.122.213.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.122.213.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aesG68TZ9gzEyL1BkPpHgwAAAJM"]
[Fri Apr 24 14:00:12.716422 2026] [:error] [pid 17719:tid 17744] [client 208.122.213.225:54968] [client 208.122.213.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.122.213.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aesG7MTZ9gzEyL1BkPpHhAAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 24 14:21:05.890141 2026] [:error] [pid 17719:tid 17743] [client 51.254.34.62:56324] [client 51.254.34.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.254.34.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aesL0cTZ9gzEyL1BkPpTQgAAAJA"]
[Fri Apr 24 14:21:06.766342 2026] [:error] [pid 17719:tid 17750] [client 51.254.34.62:56324] [client 51.254.34.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.254.34.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aesL0sTZ9gzEyL1BkPpTRgAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 24 14:31:24.996410 2026] [:error] [pid 17721:tid 17798] [client 34.32.244.138:48018] [client 34.32.244.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.32.244.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aesOPOFXXkLeyDnfk__U9gAAABE"]
[Fri Apr 24 14:31:25.884814 2026] [:error] [pid 17721:tid 17789] [client 34.32.244.138:48018] [client 34.32.244.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.32.244.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aesOPeFXXkLeyDnfk__U-AAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 24 14:36:34.880754 2026] [:error] [pid 17720:tid 17771] [client 114.111.32.40:33783] [client 114.111.32.40] ModSecurity: Access denied with code 403 (phase 1). Match of "endsWith /wp-cron.php" against "REQUEST_FILENAME" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "103"] [id "217200"] [rev "2"] [msg "COMODO WAF: HTTP/1.1 POST request missing Content-Length Header||expressinteriors.com|F|2"] [data "/2023/02/27/hello-world/"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/2023/02/27/hello-world/"] [unique_id "aesPcuhlUs6BS3Ng7_X5VgAAANE"]
[Fri Apr 24 15:17:57.132557 2026] [:error] [pid 17808:tid 17829] [client 43.166.251.233:59584] [client 43.166.251.233] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aesZJearbOEFI8qshvK0iQAAAFM"]
[Fri Apr 24 16:08:41.667865 2026] [:error] [pid 17808:tid 17811] [client 136.232.164.194:63317] [client 136.232.164.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.232.164.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeslCearbOEFI8qshvLJlwAAAEE"]
[Fri Apr 24 16:08:51.821163 2026] [:error] [pid 17808:tid 17829] [client 136.232.164.194:63665] [client 136.232.164.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.232.164.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeslE-arbOEFI8qshvLJrAAAAFM"]
[Fri Apr 24 16:09:02.333846 2026] [:error] [pid 17808:tid 17823] [client 136.232.164.194:63925] [client 136.232.164.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.232.164.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeslHuarbOEFI8qshvLJxAAAAE0"]
[Fri Apr 24 16:09:12.941210 2026] [:error] [pid 17721:tid 17803] [client 136.232.164.194:64191] [client 136.232.164.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.232.164.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeslKOFXXkLeyDnfk__0nAAAABY"]
[Fri Apr 24 16:09:24.190314 2026] [:error] [pid 17808:tid 17834] [client 136.232.164.194:64455] [client 136.232.164.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.232.164.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeslNOarbOEFI8qshvLJ9gAAAFg"]
[Fri Apr 24 17:01:02.090485 2026] [:error] [pid 22114:tid 22136] [client 208.97.187.39:49578] [client 208.97.187.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.97.187.39, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aesxToAuWGz3WlMQjofFIwAAARM"]
[Fri Apr 24 17:01:05.392232 2026] [:error] [pid 17721:tid 17797] [client 208.97.187.39:49586] [client 208.97.187.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.97.187.39, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aesxUeFXXkLeyDnfk_8EBgAAABA"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 24 17:25:14.267173 2026] [:error] [pid 17720:tid 17757] [client 195.178.110.241:38834] [client 195.178.110.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aes2-uhlUs6BS3Ng7_VIRAAAAMM"]
[Fri Apr 24 18:27:18.662181 2026] [:error] [pid 4177:tid 4199] [client 65.254.225.234:38412] [client 65.254.225.234] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.234, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aetFhn2asKnvdrSe0x63qgAAAY4"]
[Fri Apr 24 18:27:20.019280 2026] [:error] [pid 4177:tid 4197] [client 65.254.225.234:38412] [client 65.254.225.234] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.234, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aetFiH2asKnvdrSe0x63qwAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 24 19:22:12.521328 2026] [:error] [pid 4177:tid 4194] [client 43.157.82.252:48718] [client 43.157.82.252] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aetSZH2asKnvdrSe0x7ajgAAAYk"]
[Fri Apr 24 19:53:43.637423 2026] [:error] [pid 17808:tid 17819] [client 50.30.32.22:59176] [client 50.30.32.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.30.32.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aetZx-arbOEFI8qshvImHgAAAEk"]
[Fri Apr 24 19:53:44.518303 2026] [:error] [pid 17808:tid 17821] [client 50.30.32.22:59176] [client 50.30.32.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.30.32.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aetZyOarbOEFI8qshvImHwAAAEs"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 24 20:23:16.015328 2026] [:error] [pid 17719:tid 17733] [client 34.32.244.138:59238] [client 34.32.244.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.32.244.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aetgtMTZ9gzEyL1BkPqmMgAAAIY"]
[Fri Apr 24 20:23:16.843445 2026] [:error] [pid 17719:tid 17732] [client 34.32.244.138:59238] [client 34.32.244.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.32.244.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aetgtMTZ9gzEyL1BkPqmMwAAAIU"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 24 20:42:29.412572 2026] [:error] [pid 4177:tid 4189] [client 47.251.53.97:52296] [client 47.251.53.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.251.53.97, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aetlNX2asKnvdrSe0x4LVwAAAYQ"]
[Fri Apr 24 20:42:30.395830 2026] [:error] [pid 4177:tid 4191] [client 47.251.53.97:52296] [client 47.251.53.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.251.53.97, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aetlNn2asKnvdrSe0x4LXgAAAYY"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 24 20:46:31.546896 2026] [:error] [pid 22114:tid 22120] [client 72.146.1.209:32401] [client 72.146.1.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aetmJ4AuWGz3WlMQjofrRAAAAQM"]
[Fri Apr 24 20:46:32.300176 2026] [:error] [pid 17808:tid 17825] [client 72.146.1.209:39622] [client 72.146.1.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aetmKOarbOEFI8qshvI3AQAAAE8"]
[Fri Apr 24 20:46:32.913808 2026] [:error] [pid 17808:tid 17815] [client 72.146.1.209:39636] [client 72.146.1.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aetmKOarbOEFI8qshvI3CQAAAEU"]
[Fri Apr 24 20:46:33.693012 2026] [:error] [pid 17721:tid 17794] [client 72.146.1.209:54130] [client 72.146.1.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aetmKeFXXkLeyDnfk_87fQAAAA0"]
[Fri Apr 24 20:49:45.968157 2026] [:error] [pid 4177:tid 4188] [client 69.49.112.68:45422] [client 69.49.112.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.112.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aetm6X2asKnvdrSe0x4PQQAAAYM"]
[Fri Apr 24 20:49:46.898296 2026] [:error] [pid 4177:tid 4189] [client 69.49.112.68:45422] [client 69.49.112.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.112.68, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aetm6n2asKnvdrSe0x4PQgAAAYQ"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 24 21:11:11.203720 2026] [:error] [pid 14531:tid 14543] [client 98.88.113.35:52318] [client 98.88.113.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.88.113.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aetr73fLU2gw-6KR-GbODAAAAUo"]
[Fri Apr 24 21:11:13.116869 2026] [:error] [pid 17719:tid 17736] [client 98.88.113.35:52324] [client 98.88.113.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 98.88.113.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aetr8cTZ9gzEyL1BkPqvjgAAAIk"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 24 21:22:35.326359 2026] [:error] [pid 17720:tid 17765] [client 124.150.141.236:33588] [client 124.150.141.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 124.150.141.236, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aetum-hlUs6BS3Ng7_WzxQAAAMs"]
[Fri Apr 24 21:22:36.708162 2026] [:error] [pid 17720:tid 17777] [client 124.150.141.236:33588] [client 124.150.141.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 124.150.141.236, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aetunOhlUs6BS3Ng7_WzywAAANc"], referer: https://expressinteriors.com/wp-login.php
[Fri Apr 24 22:46:03.631728 2026] [:error] [pid 17808:tid 17827] [client 212.64.199.62:38442] [client 212.64.199.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.64.199.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeuCK-arbOEFI8qshvJioAAAAFE"]
[Fri Apr 24 22:46:04.742284 2026] [:error] [pid 17808:tid 17817] [client 212.64.199.62:38442] [client 212.64.199.62] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 212.64.199.62, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeuCLOarbOEFI8qshvJiqAAAAEc"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 25 00:31:41.359001 2026] [:error] [pid 42852:tid 42874] [client 183.90.242.47:39236] [client 183.90.242.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 183.90.242.47, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeua7TMEwxhhak_EhMJ17QAAAlM"]
[Sat Apr 25 01:08:21.523420 2026] [:error] [pid 42852:tid 42869] [client 20.203.128.117:33739] [client 20.203.128.117] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.203.128.117, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeujhTMEwxhhak_EhMKLLwAAAk4"]
[Sat Apr 25 01:14:14.540287 2026] [:error] [pid 14989:tid 15011] [client 20.89.236.85:4180] [client 20.89.236.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aeuk5nhRYjsAsZTO4EOUdwAAABQ"]
[Sat Apr 25 01:14:15.027001 2026] [:error] [pid 42791:tid 42816] [client 20.89.236.85:5918] [client 20.89.236.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aeuk57KmN9doraCEWKXp-QAAAdU"]
[Sat Apr 25 01:14:15.543801 2026] [:error] [pid 42755:tid 42760] [client 20.89.236.85:5915] [client 20.89.236.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aeuk59H7__k0j6aa600CwgAAAIM"]
[Sat Apr 25 01:14:16.049085 2026] [:error] [pid 14989:tid 14994] [client 20.89.236.85:4172] [client 20.89.236.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "aeuk6HhRYjsAsZTO4EOUfAAAAAM"]
[Sat Apr 25 02:21:48.990806 2026] [:error] [pid 42791:tid 42801] [client 223.15.245.170:39759] [client 223.15.245.170] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeu0vLKmN9doraCEWKX_ygAAAcY"]
[Sat Apr 25 02:31:18.234966 2026] [:error] [pid 42792:tid 42827] [client 182.8.66.226:16306] [client 182.8.66.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.8.66.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeu29tNi9qR4GtafpfHxWgAAAgU"]
[Sat Apr 25 02:31:31.631027 2026] [:error] [pid 42792:tid 42838] [client 182.8.66.226:12577] [client 182.8.66.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.8.66.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeu3A9Ni9qR4GtafpfHxbQAAAhA"]
[Sat Apr 25 02:31:39.092640 2026] [:error] [pid 42852:tid 42870] [client 182.8.66.226:16303] [client 182.8.66.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.8.66.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeu3CzMEwxhhak_EhMKz4QAAAk8"]
[Sat Apr 25 02:32:00.486980 2026] [:error] [pid 14989:tid 15000] [client 182.8.66.226:16301] [client 182.8.66.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.8.66.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeu3IHhRYjsAsZTO4EPEEQAAAAk"]
[Sat Apr 25 02:32:10.347185 2026] [:error] [pid 42755:tid 42759] [client 69.49.112.71:57512] [client 69.49.112.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.112.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeu3KtH7__k0j6aa600WlwAAAII"]
[Sat Apr 25 02:32:11.232183 2026] [:error] [pid 42755:tid 42776] [client 69.49.112.71:57512] [client 69.49.112.71] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.112.71, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeu3K9H7__k0j6aa600WmQAAAJM"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 25 02:32:21.385940 2026] [:error] [pid 14989:tid 15000] [client 182.8.66.226:16316] [client 182.8.66.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.8.66.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeu3NXhRYjsAsZTO4EPEOQAAAAk"]
[Sat Apr 25 03:21:44.890424 2026] [:error] [pid 28786:tid 28809] [client 192.185.4.35:45288] [client 192.185.4.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.4.35, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aevCyNmKAVQi4GwijepT5wAAAZQ"]
[Sat Apr 25 03:31:27.693601 2026] [:error] [pid 40829:tid 40843] [client 91.206.201.136:17396] [client 91.206.201.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.206.201.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aevFD39aBLbh2KXOloOQ3AAAAAo"]
[Sat Apr 25 03:31:29.391957 2026] [:error] [pid 40829:tid 40853] [client 91.206.201.136:17396] [client 91.206.201.136] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.206.201.136, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aevFEX9aBLbh2KXOloOQ4QAAABQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 25 03:32:57.499909 2026] [:error] [pid 40830:tid 40878] [client 20.251.112.6:33422] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pinfo.php"] [unique_id "aevFaWbs17K4x2MIwqGB1QAAAFA"]
[Sat Apr 25 03:32:58.257622 2026] [:error] [pid 40831:tid 40910] [client 20.251.112.6:57941] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pinfo.php"] [unique_id "aevFasC1ApXgo_VIxksj2wAAAJU"]
[Sat Apr 25 03:32:59.245509 2026] [:error] [pid 40831:tid 40894] [client 20.251.112.6:37859] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pinfo.php"] [unique_id "aevFa8C1ApXgo_VIxksj4QAAAIU"]
[Sat Apr 25 03:33:00.040955 2026] [:error] [pid 40831:tid 40891] [client 20.251.112.6:44409] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pinfo.php"] [unique_id "aevFbMC1ApXgo_VIxksj5QAAAII"]
[Sat Apr 25 03:33:00.928556 2026] [:error] [pid 40830:tid 40870] [client 20.251.112.6:33467] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/litespeed.php"] [unique_id "aevFbGbs17K4x2MIwqGB3AAAAEg"]
[Sat Apr 25 03:33:01.665811 2026] [:error] [pid 40830:tid 40878] [client 20.251.112.6:53020] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/litespeed.php"] [unique_id "aevFbWbs17K4x2MIwqGB3QAAAFA"]
[Sat Apr 25 03:33:02.407031 2026] [:error] [pid 40830:tid 40883] [client 20.251.112.6:44383] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/litespeed.php"] [unique_id "aevFbmbs17K4x2MIwqGB3wAAAFU"]
[Sat Apr 25 03:33:03.262077 2026] [:error] [pid 40831:tid 40896] [client 20.251.112.6:60427] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/litespeed.php"] [unique_id "aevFb8C1ApXgo_VIxksj8wAAAIc"]
[Sat Apr 25 03:33:03.988315 2026] [:error] [pid 40919:tid 40958] [client 20.251.112.6:53005] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/environments.php"] [unique_id "aevFb0MtsB8Y96nC3cnlFQAAANg"]
[Sat Apr 25 03:33:04.656305 2026] [:error] [pid 40831:tid 40890] [client 20.251.112.6:33420] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/environments.php"] [unique_id "aevFcMC1ApXgo_VIxksj-AAAAIE"]
[Sat Apr 25 03:33:05.515626 2026] [:error] [pid 40831:tid 40911] [client 20.251.112.6:61894] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/environments.php"] [unique_id "aevFccC1ApXgo_VIxksj_AAAAJY"]
[Sat Apr 25 03:33:06.607118 2026] [:error] [pid 40830:tid 40871] [client 20.251.112.6:61904] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/environments.php"] [unique_id "aevFcmbs17K4x2MIwqGB5QAAAEk"]
[Sat Apr 25 03:33:07.517247 2026] [:error] [pid 40830:tid 40867] [client 20.251.112.6:57945] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/raf.php"] [unique_id "aevFc2bs17K4x2MIwqGB6gAAAEU"]
[Sat Apr 25 03:33:08.101426 2026] [:error] [pid 40831:tid 40891] [client 20.251.112.6:60458] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/raf.php"] [unique_id "aevFdMC1ApXgo_VIxkskAgAAAII"]
[Sat Apr 25 03:33:08.912550 2026] [:error] [pid 40830:tid 40885] [client 20.251.112.6:53027] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/raf.php"] [unique_id "aevFdGbs17K4x2MIwqGB7AAAAFc"]
[Sat Apr 25 03:33:09.518739 2026] [:error] [pid 40830:tid 40879] [client 20.251.112.6:60420] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/raf.php"] [unique_id "aevFdWbs17K4x2MIwqGB7gAAAFE"]
[Sat Apr 25 03:33:10.072016 2026] [:error] [pid 40830:tid 40865] [client 20.251.112.6:46556] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ayk.php"] [unique_id "aevFdmbs17K4x2MIwqGB7wAAAEM"]
[Sat Apr 25 03:33:10.624877 2026] [:error] [pid 40830:tid 40875] [client 20.251.112.6:44360] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ayk.php"] [unique_id "aevFdmbs17K4x2MIwqGB8AAAAE0"]
[Sat Apr 25 03:33:11.169882 2026] [:error] [pid 40830:tid 40880] [client 20.251.112.6:46588] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ayk.php"] [unique_id "aevFd2bs17K4x2MIwqGB8QAAAFI"]
[Sat Apr 25 03:33:11.750535 2026] [:error] [pid 40831:tid 40890] [client 20.251.112.6:53008] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ayk.php"] [unique_id "aevFd8C1ApXgo_VIxkskCgAAAIE"]
[Sat Apr 25 03:33:12.622713 2026] [:error] [pid 40831:tid 40889] [client 20.251.112.6:49225] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/infos.php"] [unique_id "aevFeMC1ApXgo_VIxkskCwAAAIA"]
[Sat Apr 25 03:33:13.204953 2026] [:error] [pid 40829:tid 40834] [client 20.251.112.6:48847] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/infos.php"] [unique_id "aevFeX9aBLbh2KXOloORjgAAAAE"]
[Sat Apr 25 03:33:13.849346 2026] [:error] [pid 40829:tid 40838] [client 20.251.112.6:60469] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/infos.php"] [unique_id "aevFeX9aBLbh2KXOloORkAAAAAU"]
[Sat Apr 25 03:33:14.678663 2026] [:error] [pid 40830:tid 40865] [client 20.251.112.6:44359] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/infos.php"] [unique_id "aevFembs17K4x2MIwqGB-AAAAEM"]
[Sat Apr 25 03:33:15.646781 2026] [:error] [pid 40830:tid 40886] [client 20.251.112.6:64762] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aws.php"] [unique_id "aevFe2bs17K4x2MIwqGB-gAAAFg"]
[Sat Apr 25 03:33:16.824056 2026] [:error] [pid 40831:tid 40889] [client 20.251.112.6:53043] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aws.php"] [unique_id "aevFfMC1ApXgo_VIxkskGAAAAIA"]
[Sat Apr 25 03:33:17.803416 2026] [:error] [pid 40831:tid 40892] [client 20.251.112.6:57976] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aws.php"] [unique_id "aevFfcC1ApXgo_VIxkskHgAAAIM"]
[Sat Apr 25 03:33:18.451389 2026] [:error] [pid 40919:tid 40940] [client 20.251.112.6:37863] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aws.php"] [unique_id "aevFfkMtsB8Y96nC3cnlIwAAAMY"]
[Sat Apr 25 03:33:19.700576 2026] [:error] [pid 40919:tid 40955] [client 20.251.112.6:44415] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/embed.php"] [unique_id "aevFf0MtsB8Y96nC3cnlKAAAANU"]
[Sat Apr 25 03:33:20.759919 2026] [:error] [pid 40919:tid 40944] [client 20.251.112.6:60465] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/embed.php"] [unique_id "aevFgEMtsB8Y96nC3cnlNAAAAMo"]
[Sat Apr 25 03:33:21.698073 2026] [:error] [pid 40829:tid 40856] [client 20.251.112.6:46642] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/embed.php"] [unique_id "aevFgX9aBLbh2KXOloORqAAAABc"]
[Sat Apr 25 03:33:23.157698 2026] [:error] [pid 40830:tid 40868] [client 20.251.112.6:33429] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/embed.php"] [unique_id "aevFg2bs17K4x2MIwqGCKwAAAEY"]
[Sat Apr 25 03:33:24.088853 2026] [:error] [pid 40919:tid 40934] [client 20.251.112.6:61905] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/stat.php"] [unique_id "aevFhEMtsB8Y96nC3cnlbAAAAMA"]
[Sat Apr 25 03:33:24.741662 2026] [:error] [pid 40831:tid 40892] [client 20.251.112.6:37842] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/stat.php"] [unique_id "aevFhMC1ApXgo_VIxkskWgAAAIM"]
[Sat Apr 25 03:33:25.377931 2026] [:error] [pid 40829:tid 40836] [client 20.251.112.6:60421] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/stat.php"] [unique_id "aevFhX9aBLbh2KXOloORtwAAAAM"]
[Sat Apr 25 03:33:26.087330 2026] [:error] [pid 40831:tid 40910] [client 20.251.112.6:49250] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/stat.php"] [unique_id "aevFhsC1ApXgo_VIxkskXQAAAJU"]
[Sat Apr 25 03:33:27.298327 2026] [:error] [pid 40830:tid 40884] [client 20.251.112.6:48852] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/setup.php"] [unique_id "aevFh2bs17K4x2MIwqGCPgAAAFY"]
[Sat Apr 25 03:33:28.135485 2026] [:error] [pid 40829:tid 40834] [client 20.251.112.6:61924] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/setup.php"] [unique_id "aevFiH9aBLbh2KXOloORvgAAAAE"]
[Sat Apr 25 03:33:29.004272 2026] [:error] [pid 40919:tid 40949] [client 20.251.112.6:60453] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/setup.php"] [unique_id "aevFiUMtsB8Y96nC3cnliAAAAM8"]
[Sat Apr 25 03:33:29.940586 2026] [:error] [pid 40831:tid 40895] [client 20.251.112.6:60424] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/setup.php"] [unique_id "aevFicC1ApXgo_VIxkskZQAAAIY"]
[Sat Apr 25 03:33:30.587296 2026] [:error] [pid 40829:tid 40839] [client 20.251.112.6:44393] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/development.php"] [unique_id "aevFin9aBLbh2KXOloORxAAAAAY"]
[Sat Apr 25 03:33:31.271811 2026] [:error] [pid 40831:tid 40902] [client 20.251.112.6:44372] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/development.php"] [unique_id "aevFi8C1ApXgo_VIxkskagAAAI0"]
[Sat Apr 25 03:33:32.109612 2026] [:error] [pid 40829:tid 40857] [client 20.251.112.6:59204] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/development.php"] [unique_id "aevFjH9aBLbh2KXOloORyAAAABg"]
[Sat Apr 25 03:33:32.865884 2026] [:error] [pid 40829:tid 40845] [client 20.251.112.6:64707] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/development.php"] [unique_id "aevFjH9aBLbh2KXOloORygAAAAw"]
[Sat Apr 25 03:33:33.764794 2026] [:error] [pid 40919:tid 40954] [client 20.251.112.6:33462] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/environment.php"] [unique_id "aevFjUMtsB8Y96nC3cnliwAAANQ"]
[Sat Apr 25 03:33:34.419393 2026] [:error] [pid 40830:tid 40862] [client 20.251.112.6:57949] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/environment.php"] [unique_id "aevFjmbs17K4x2MIwqGCQgAAAEA"]
[Sat Apr 25 03:33:35.109784 2026] [:error] [pid 40831:tid 40902] [client 20.251.112.6:37853] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/environment.php"] [unique_id "aevFj8C1ApXgo_VIxkskegAAAI0"]
[Sat Apr 25 03:33:35.797298 2026] [:error] [pid 40830:tid 40872] [client 20.251.112.6:53018] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/environment.php"] [unique_id "aevFj2bs17K4x2MIwqGCRgAAAEo"]
[Sat Apr 25 03:33:36.519535 2026] [:error] [pid 40831:tid 40901] [client 20.251.112.6:48863] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/db_config.php"] [unique_id "aevFkMC1ApXgo_VIxkskfQAAAIw"]
[Sat Apr 25 03:33:37.198634 2026] [:error] [pid 40830:tid 40873] [client 20.251.112.6:48852] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/db_config.php"] [unique_id "aevFkWbs17K4x2MIwqGCSgAAAEs"]
[Sat Apr 25 03:33:37.836442 2026] [:error] [pid 40919:tid 40940] [client 20.251.112.6:57939] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/db_config.php"] [unique_id "aevFkUMtsB8Y96nC3cnlkAAAAMY"]
[Sat Apr 25 03:33:38.443539 2026] [:error] [pid 40919:tid 40956] [client 20.251.112.6:44361] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/db_config.php"] [unique_id "aevFkkMtsB8Y96nC3cnlkwAAANY"]
[Sat Apr 25 03:33:39.031147 2026] [:error] [pid 40919:tid 40955] [client 20.251.112.6:51155] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Get_Site_Info.php"] [unique_id "aevFk0MtsB8Y96nC3cnllQAAANU"]
[Sat Apr 25 03:33:39.808908 2026] [:error] [pid 40919:tid 40938] [client 20.251.112.6:64753] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Get_Site_Info.php"] [unique_id "aevFk0MtsB8Y96nC3cnlmQAAAMQ"]
[Sat Apr 25 03:33:40.575993 2026] [:error] [pid 40831:tid 40892] [client 20.251.112.6:57927] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Get_Site_Info.php"] [unique_id "aevFlMC1ApXgo_VIxkskhQAAAIM"]
[Sat Apr 25 03:33:41.274071 2026] [:error] [pid 40919:tid 40950] [client 20.251.112.6:46547] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Get_Site_Info.php"] [unique_id "aevFlUMtsB8Y96nC3cnlnQAAANA"]
[Sat Apr 25 03:33:41.836857 2026] [:error] [pid 40830:tid 40882] [client 20.251.112.6:64763] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/deploy.php"] [unique_id "aevFlWbs17K4x2MIwqGCVQAAAFQ"]
[Sat Apr 25 03:33:42.869204 2026] [:error] [pid 40830:tid 40868] [client 20.251.112.6:57956] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/deploy.php"] [unique_id "aevFlmbs17K4x2MIwqGCWAAAAEY"]
[Sat Apr 25 03:33:43.683557 2026] [:error] [pid 40919:tid 40946] [client 20.251.112.6:64758] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/deploy.php"] [unique_id "aevFl0MtsB8Y96nC3cnlowAAAMw"]
[Sat Apr 25 03:33:44.856051 2026] [:error] [pid 40919:tid 40944] [client 20.251.112.6:44407] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/deploy.php"] [unique_id "aevFmEMtsB8Y96nC3cnlqgAAAMo"]
[Sat Apr 25 03:33:45.851080 2026] [:error] [pid 40829:tid 40846] [client 20.251.112.6:38223] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/apis.php"] [unique_id "aevFmX9aBLbh2KXOloOR3gAAAA0"]
[Sat Apr 25 03:33:47.006439 2026] [:error] [pid 40919:tid 40941] [client 20.251.112.6:64706] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/apis.php"] [unique_id "aevFm0MtsB8Y96nC3cnlrwAAAMc"]
[Sat Apr 25 03:33:47.819816 2026] [:error] [pid 40919:tid 40944] [client 20.251.112.6:44358] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/apis.php"] [unique_id "aevFm0MtsB8Y96nC3cnlsgAAAMo"]
[Sat Apr 25 03:33:48.429073 2026] [:error] [pid 40829:tid 40845] [client 20.251.112.6:60423] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/apis.php"] [unique_id "aevFnH9aBLbh2KXOloOR4QAAAAw"]
[Sat Apr 25 03:33:48.982570 2026] [:error] [pid 40831:tid 40911] [client 20.251.112.6:61925] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asdf.php"] [unique_id "aevFnMC1ApXgo_VIxksklAAAAJY"]
[Sat Apr 25 03:33:49.709695 2026] [:error] [pid 40919:tid 40947] [client 20.251.112.6:61913] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asdf.php"] [unique_id "aevFnUMtsB8Y96nC3cnltAAAAM0"]
[Sat Apr 25 03:33:50.854280 2026] [:error] [pid 40919:tid 40957] [client 20.251.112.6:44389] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asdf.php"] [unique_id "aevFnkMtsB8Y96nC3cnlugAAANc"]
[Sat Apr 25 03:33:51.634327 2026] [:error] [pid 40829:tid 40842] [client 20.251.112.6:51549] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asdf.php"] [unique_id "aevFn39aBLbh2KXOloOR5AAAAAk"]
[Sat Apr 25 03:33:52.165062 2026] [:error] [pid 40829:tid 40841] [client 20.251.112.6:37845] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1100.php"] [unique_id "aevFoH9aBLbh2KXOloOR5gAAAAg"]
[Sat Apr 25 03:33:52.697165 2026] [:error] [pid 40829:tid 40855] [client 20.251.112.6:33426] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1100.php"] [unique_id "aevFoH9aBLbh2KXOloOR6QAAABY"]
[Sat Apr 25 03:33:53.232775 2026] [:error] [pid 40829:tid 40839] [client 20.251.112.6:48841] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1100.php"] [unique_id "aevFoX9aBLbh2KXOloOR6gAAAAY"]
[Sat Apr 25 03:33:53.774088 2026] [:error] [pid 40831:tid 40911] [client 20.251.112.6:52999] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1100.php"] [unique_id "aevFocC1ApXgo_VIxkskoAAAAJY"]
[Sat Apr 25 03:33:54.391506 2026] [:error] [pid 40831:tid 40909] [client 20.251.112.6:64750] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/._info.php"] [unique_id "aevFosC1ApXgo_VIxkskoQAAAJQ"]
[Sat Apr 25 03:33:55.198477 2026] [:error] [pid 40919:tid 40949] [client 20.251.112.6:60460] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/._info.php"] [unique_id "aevFo0MtsB8Y96nC3cnlwgAAAM8"]
[Sat Apr 25 03:33:55.722604 2026] [:error] [pid 40831:tid 40910] [client 20.251.112.6:53048] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/._info.php"] [unique_id "aevFo8C1ApXgo_VIxkskpAAAAJU"]
[Sat Apr 25 03:34:06.431771 2026] [:error] [pid 40831:tid 40908] [client 20.251.112.6:51194] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makecvs.php"] [unique_id "aevFrsC1ApXgo_VIxkskvwAAAJM"]
[Sat Apr 25 03:34:06.974014 2026] [:error] [pid 40919:tid 40944] [client 20.251.112.6:46581] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makecvs.php"] [unique_id "aevFrkMtsB8Y96nC3cnl9QAAAMo"]
[Sat Apr 25 03:34:07.665939 2026] [:error] [pid 40919:tid 40958] [client 20.251.112.6:37858] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makecvs.php"] [unique_id "aevFr0MtsB8Y96nC3cnl9wAAANg"]
[Sat Apr 25 03:34:08.428608 2026] [:error] [pid 40831:tid 40894] [client 20.251.112.6:51150] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makecvs.php"] [unique_id "aevFsMC1ApXgo_VIxkskwwAAAIU"]
[Sat Apr 25 03:34:08.974037 2026] [:error] [pid 40829:tid 40856] [client 20.251.112.6:48865] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/phpreleaseinfo.php"] [unique_id "aevFsH9aBLbh2KXOloOR8wAAABc"]
[Sat Apr 25 03:34:09.530844 2026] [:error] [pid 40830:tid 40872] [client 20.251.112.6:48868] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/phpreleaseinfo.php"] [unique_id "aevFsWbs17K4x2MIwqGCaQAAAEo"]
[Sat Apr 25 03:34:10.442047 2026] [:error] [pid 40829:tid 40844] [client 20.251.112.6:57967] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/phpreleaseinfo.php"] [unique_id "aevFsn9aBLbh2KXOloOR9QAAAAs"]
[Sat Apr 25 03:34:11.116939 2026] [:error] [pid 40919:tid 40955] [client 20.251.112.6:57965] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/phpreleaseinfo.php"] [unique_id "aevFs0MtsB8Y96nC3cnl-gAAANU"]
[Sat Apr 25 03:34:11.669935 2026] [:error] [pid 40829:tid 40852] [client 20.251.112.6:49260] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/configuration.php"] [unique_id "aevFs39aBLbh2KXOloOR9gAAABM"]
[Sat Apr 25 03:34:12.288498 2026] [:error] [pid 40829:tid 40843] [client 20.251.112.6:38230] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/configuration.php"] [unique_id "aevFtH9aBLbh2KXOloOR-wAAAAo"]
[Sat Apr 25 03:34:13.145740 2026] [:error] [pid 40830:tid 40886] [client 20.251.112.6:64764] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/configuration.php"] [unique_id "aevFtWbs17K4x2MIwqGCcQAAAFg"]
[Sat Apr 25 03:34:13.721255 2026] [:error] [pid 40829:tid 40841] [client 20.251.112.6:51167] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/configuration.php"] [unique_id "aevFtX9aBLbh2KXOloOSAgAAAAg"]
[Sat Apr 25 03:34:14.395327 2026] [:error] [pid 40831:tid 40894] [client 20.251.112.6:57952] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ay.php"] [unique_id "aevFtsC1ApXgo_VIxkskzwAAAIU"]
[Sat Apr 25 03:34:15.185280 2026] [:error] [pid 40831:tid 40912] [client 20.251.112.6:55365] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ay.php"] [unique_id "aevFt8C1ApXgo_VIxksk0wAAAJc"]
[Sat Apr 25 03:34:16.334447 2026] [:error] [pid 40831:tid 40907] [client 20.251.112.6:60477] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ay.php"] [unique_id "aevFuMC1ApXgo_VIxksk2AAAAJI"]
[Sat Apr 25 03:34:17.471292 2026] [:error] [pid 40919:tid 40957] [client 20.251.112.6:48862] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ay.php"] [unique_id "aevFuUMtsB8Y96nC3cnl_AAAANc"]
[Sat Apr 25 03:34:18.187948 2026] [:error] [pid 40831:tid 40911] [client 20.251.112.6:48858] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hkvkjguw.php"] [unique_id "aevFusC1ApXgo_VIxksk4AAAAJY"]
[Sat Apr 25 03:34:19.146434 2026] [:error] [pid 40829:tid 40842] [client 20.251.112.6:49218] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hkvkjguw.php"] [unique_id "aevFu39aBLbh2KXOloOSDQAAAAk"]
[Sat Apr 25 03:34:19.924810 2026] [:error] [pid 40830:tid 40881] [client 20.251.112.6:51145] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hkvkjguw.php"] [unique_id "aevFu2bs17K4x2MIwqGCeAAAAFM"]
[Sat Apr 25 03:34:20.681507 2026] [:error] [pid 40829:tid 40838] [client 20.251.112.6:64724] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hkvkjguw.php"] [unique_id "aevFvH9aBLbh2KXOloOSQQAAAAU"]
[Sat Apr 25 03:34:21.853323 2026] [:error] [pid 40830:tid 40863] [client 20.251.112.6:46587] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Black.php"] [unique_id "aevFvWbs17K4x2MIwqGCegAAAEE"]
[Sat Apr 25 03:34:22.529858 2026] [:error] [pid 40830:tid 40866] [client 20.251.112.6:61945] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Black.php"] [unique_id "aevFvmbs17K4x2MIwqGCfQAAAEQ"]
[Sat Apr 25 03:34:23.189856 2026] [:error] [pid 40830:tid 40882] [client 20.251.112.6:61927] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Black.php"] [unique_id "aevFv2bs17K4x2MIwqGCfgAAAFQ"]
[Sat Apr 25 03:34:23.914667 2026] [:error] [pid 40919:tid 40949] [client 20.251.112.6:53054] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Black.php"] [unique_id "aevFv0MtsB8Y96nC3cnl_wAAAM8"]
[Sat Apr 25 03:34:24.950502 2026] [:error] [pid 40919:tid 40944] [client 20.251.112.6:61912] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/infoinfo.php"] [unique_id "aevFwEMtsB8Y96nC3cnmBwAAAMo"]
[Sat Apr 25 03:34:25.508576 2026] [:error] [pid 40919:tid 40948] [client 20.251.112.6:57979] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/infoinfo.php"] [unique_id "aevFwUMtsB8Y96nC3cnmDgAAAM4"]
[Sat Apr 25 03:34:26.188879 2026] [:error] [pid 40919:tid 40935] [client 20.251.112.6:60429] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/infoinfo.php"] [unique_id "aevFwkMtsB8Y96nC3cnmFwAAAME"]
[Sat Apr 25 03:34:26.747825 2026] [:error] [pid 40830:tid 40868] [client 20.251.112.6:61903] [client 20.251.112.6] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/infoinfo.php"] [unique_id "aevFwmbs17K4x2MIwqGCgAAAAEY"]
[Sat Apr 25 04:14:38.838491 2026] [:error] [pid 46083:tid 46090] [client 139.59.102.237:38708] [client 139.59.102.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 139.59.102.237, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aevPLjxw_Zq74vWdjmnugwAAAQM"]
[Sat Apr 25 04:14:39.957819 2026] [:error] [pid 46083:tid 46100] [client 139.59.102.237:38708] [client 139.59.102.237] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 139.59.102.237, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aevPLzxw_Zq74vWdjmnuiQAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 25 04:54:33.489115 2026] [:error] [pid 44321:tid 44405] [client 167.99.74.72:45592] [client 167.99.74.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.99.74.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aevYiY1b5lV-asWa_Y4UnAAAAJY"]
[Sat Apr 25 04:54:34.389707 2026] [:error] [pid 44321:tid 44388] [client 167.99.74.72:45592] [client 167.99.74.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.99.74.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aevYio1b5lV-asWa_Y4UnQAAAIU"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 25 05:25:22.101706 2026] [:error] [pid 46083:tid 46090] [client 172.70.251.236:12793] [client 172.70.251.236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aevfwjxw_Zq74vWdjmkZnwAAAQM"]
[Sat Apr 25 05:44:15.376848 2026] [:error] [pid 44320:tid 44358] [client 165.22.61.123:44764] [client 165.22.61.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.61.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aevkLzmFqSpku_dij8huGQAAAEI"]
[Sat Apr 25 05:44:22.034355 2026] [:error] [pid 46083:tid 46101] [client 165.22.61.123:44774] [client 165.22.61.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.22.61.123, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aevkNjxw_Zq74vWdjmkjWwAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 25 06:02:20.260350 2026] [:error] [pid 44425:tid 44448] [client 154.54.100.172:34406] [client 154.54.100.172] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "aevobCUl-VlItvY2tR8DOAAAANU"]
[Sat Apr 25 06:48:38.799471 2026] [autoindex:error] [pid 44320:tid 44377] [client 213.136.67.3:53993] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat Apr 25 08:17:41.049746 2026] [:error] [pid 44425:tid 44449] [client 60.188.57.0:53121] [client 60.188.57.0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aewIJSUl-VlItvY2tR8xEwAAANY"]
[Sat Apr 25 10:54:40.658049 2026] [:error] [pid 44319:tid 44330] [client 5.161.84.165:49490] [client 5.161.84.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.161.84.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aews8MzJPAVLUb2pWtJ8ggAAAAE"]
[Sat Apr 25 10:54:41.607209 2026] [:error] [pid 44319:tid 44346] [client 5.161.84.165:49490] [client 5.161.84.165] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.161.84.165, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aews8czJPAVLUb2pWtJ8gwAAABE"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 25 11:24:12.607393 2026] [:error] [pid 46083:tid 46087] [client 85.204.70.98:53580] [client 85.204.70.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.204.70.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aewz3Dxw_Zq74vWdjmm5wgAAAQA"]
[Sat Apr 25 11:24:14.872762 2026] [:error] [pid 46083:tid 46091] [client 85.204.70.98:53580] [client 85.204.70.98] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aewz3jxw_Zq74vWdjmm5xwAAAQQ"]
[Sat Apr 25 11:24:15.108997 2026] [:error] [pid 46083:tid 46109] [client 85.204.70.98:53580] [client 85.204.70.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.204.70.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aewz3zxw_Zq74vWdjmm5ygAAARU"]
[Sat Apr 25 11:24:16.667158 2026] [:error] [pid 46083:tid 46088] [client 85.204.70.98:53594] [client 85.204.70.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.204.70.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aewz4Dxw_Zq74vWdjmm50AAAAQE"]
[Sat Apr 25 11:24:18.228377 2026] [:error] [pid 44319:tid 44346] [client 85.204.70.98:53606] [client 85.204.70.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.204.70.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aewz4szJPAVLUb2pWtKA3wAAABE"]
[Sat Apr 25 11:24:19.848703 2026] [:error] [pid 44320:tid 44374] [client 85.204.70.98:38770] [client 85.204.70.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.204.70.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aewz4zmFqSpku_dij8ip_wAAAFI"]
[Sat Apr 25 11:24:21.331424 2026] [:error] [pid 44425:tid 44442] [client 85.204.70.98:38772] [client 85.204.70.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.204.70.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aewz5SUl-VlItvY2tR9qTwAAAM8"]
[Sat Apr 25 11:24:21.331596 2026] [:error] [pid 44425:tid 44442] [client 85.204.70.98:38772] [client 85.204.70.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 85.204.70.98, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aewz5SUl-VlItvY2tR9qTwAAAM8"]
[Sat Apr 25 13:36:10.986249 2026] [:error] [pid 44321:tid 44389] [client 122.180.84.151:63929] [client 122.180.84.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.180.84.151, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aexSyo1b5lV-asWa_Y6K3QAAAIY"]
[Sat Apr 25 13:36:21.764315 2026] [:error] [pid 44321:tid 44401] [client 122.180.84.151:64352] [client 122.180.84.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.180.84.151, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aexS1Y1b5lV-asWa_Y6LAwAAAJI"]
[Sat Apr 25 13:36:32.754559 2026] [:error] [pid 44321:tid 44389] [client 122.180.84.151:64638] [client 122.180.84.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.180.84.151, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aexS4I1b5lV-asWa_Y6LHwAAAIY"]
[Sat Apr 25 13:36:43.757553 2026] [:error] [pid 44319:tid 44342] [client 122.180.84.151:64936] [client 122.180.84.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.180.84.151, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aexS68zJPAVLUb2pWtKRYAAAAA0"]
[Sat Apr 25 13:36:54.394273 2026] [:error] [pid 44321:tid 44384] [client 122.180.84.151:65234] [client 122.180.84.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.180.84.151, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aexS9o1b5lV-asWa_Y6LPwAAAIE"]
[Sat Apr 25 14:59:11.647195 2026] [:error] [pid 44320:tid 44359] [client 182.44.10.67:34960] [client 182.44.10.67] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aexmPzmFqSpku_dij8jRngAAAEM"]
[Sat Apr 25 15:00:34.056675 2026] [:error] [pid 44321:tid 44393] [client 49.51.243.156:54122] [client 49.51.243.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aexmko1b5lV-asWa_Y6rvAAAAIo"]
[Sat Apr 25 15:53:32.745970 2026] [:error] [pid 46083:tid 46091] [client 203.86.122.1:40952] [client 203.86.122.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.86.122.1, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aexy_Dxw_Zq74vWdjmn_fwAAAQQ"]
[Sat Apr 25 15:53:35.810829 2026] [:error] [pid 46083:tid 46091] [client 203.86.122.1:40952] [client 203.86.122.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.86.122.1, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aexy_zxw_Zq74vWdjmn_iwAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 25 17:18:57.154118 2026] [:error] [pid 62632:tid 62752] [client 185.193.158.58:6852] [client 185.193.158.58] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.expressinteriors.com|F|2"] [data "TX:0=application/xhtml+xml"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aeyHAQo5oFy5kfJhz1ZRIgAAAM8"]
[Sat Apr 25 17:54:59.613335 2026] [:error] [pid 62632:tid 62740] [client 69.49.241.26:31568] [client 69.49.241.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.241.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeyPcwo5oFy5kfJhz1ZjfgAAAMM"]
[Sat Apr 25 17:55:00.877345 2026] [:error] [pid 62632:tid 62755] [client 69.49.241.26:31568] [client 69.49.241.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.49.241.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeyPdAo5oFy5kfJhz1ZjjQAAANI"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 25 18:00:40.699750 2026] [:error] [pid 62630:tid 62690] [client 43.155.140.157:40208] [client 43.155.140.157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aeyQyHCJIizbz7HiRHTQkAAAAEg"]
[Sat Apr 25 18:21:28.600223 2026] [:error] [pid 16195:tid 16213] [client 65.254.225.233:46312] [client 65.254.225.233] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.233, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeyVqDVPLvrpvXaNQOkHIAAAAA8"]
[Sat Apr 25 18:21:29.835052 2026] [:error] [pid 16195:tid 16211] [client 65.254.225.233:46312] [client 65.254.225.233] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.233, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aeyVqTVPLvrpvXaNQOkHJgAAAA0"], referer: https://expressinteriors.com/wp-login.php
[Sat Apr 25 19:18:40.218741 2026] [:error] [pid 16195:tid 16209] [client 167.99.133.206:51030] [client 167.99.133.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.133.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeyjEDVPLvrpvXaNQOkflQAAAAs"]
[Sat Apr 25 19:18:42.461837 2026] [:error] [pid 16195:tid 16202] [client 167.99.133.206:51030] [client 167.99.133.206] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aeyjEjVPLvrpvXaNQOkfmQAAAAQ"]
[Sat Apr 25 19:18:42.710111 2026] [:error] [pid 16195:tid 16211] [client 167.99.133.206:51030] [client 167.99.133.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.133.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeyjEjVPLvrpvXaNQOkfmgAAAA0"]
[Sat Apr 25 19:18:44.222445 2026] [:error] [pid 16195:tid 16200] [client 167.99.133.206:52697] [client 167.99.133.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.133.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeyjFDVPLvrpvXaNQOkfmwAAAAI"]
[Sat Apr 25 19:18:45.739910 2026] [:error] [pid 29049:tid 29056] [client 167.99.133.206:50050] [client 167.99.133.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.133.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeyjFSfsWHIvmg63qcV4EQAAAQU"]
[Sat Apr 25 19:18:47.270297 2026] [:error] [pid 16107:tid 16141] [client 167.99.133.206:64355] [client 167.99.133.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.133.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeyjF9IfF7Hy3tw0sYRx5gAAAIQ"]
[Sat Apr 25 19:18:48.791130 2026] [:error] [pid 29049:tid 29053] [client 167.99.133.206:58076] [client 167.99.133.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 167.99.133.206, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeyjGCfsWHIvmg63qcV4FQAAAQI"]
[Sat Apr 25 19:18:48.791368 2026] [:error] [pid 29049:tid 29053] [client 167.99.133.206:58076] [client 167.99.133.206] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 167.99.133.206, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeyjGCfsWHIvmg63qcV4FQAAAQI"]
[Sat Apr 25 21:12:56.259850 2026] [:error] [pid 59985:tid 59990] [client 168.181.217.198:53100] [client 168.181.217.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.181.217.198, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aey92AF_zDvEhKvyTH6wKgAAAAM"]
[Sat Apr 25 21:13:05.307848 2026] [:error] [pid 59985:tid 59997] [client 168.181.217.198:53422] [client 168.181.217.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.181.217.198, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aey94QF_zDvEhKvyTH6wMQAAAAo"]
[Sat Apr 25 21:13:15.818372 2026] [:error] [pid 59896:tid 59920] [client 168.181.217.198:53716] [client 168.181.217.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.181.217.198, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aey967LLzhtkd-OXUgDxeAAAAFQ"]
[Sat Apr 25 21:13:26.353963 2026] [:error] [pid 59896:tid 59912] [client 168.181.217.198:53956] [client 168.181.217.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.181.217.198, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aey99rLLzhtkd-OXUgDxhgAAAEw"]
[Sat Apr 25 21:13:36.900852 2026] [:error] [pid 59897:tid 59948] [client 168.181.217.198:54197] [client 168.181.217.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.181.217.198, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aey-APBrrkdzpEbmK4eE6gAAAJU"]
[Sat Apr 25 21:27:40.299032 2026] [:error] [pid 59896:tid 59912] [client 168.181.217.133:59803] [client 168.181.217.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 168.181.217.133, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aezBTLLLzhtkd-OXUgD2EQAAAEw"]
[Sat Apr 25 21:47:58.850246 2026] [:error] [pid 59985:tid 60010] [client 111.172.249.49:41898] [client 111.172.249.49] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aezGDgF_zDvEhKvyTH65fgAAABc"]
[Sat Apr 25 22:14:30.145726 2026] [:error] [pid 3212:tid 3236] [client 78.147.196.4:65148] [client 78.147.196.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.147.196.4, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aezMRvg-28TY8_YLtUdNvgAAARY"]
[Sat Apr 25 22:15:06.733963 2026] [:error] [pid 59897:tid 59951] [client 78.147.196.4:50011] [client 78.147.196.4] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aezMavBrrkdzpEbmK4eROgAAAJg"]
[Sat Apr 25 22:15:24.426079 2026] [:error] [pid 59985:tid 60005] [client 78.147.196.4:50643] [client 78.147.196.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.147.196.4, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aezMfAF_zDvEhKvyTH7AjAAAABI"]
[Sat Apr 25 22:15:43.279415 2026] [:error] [pid 59897:tid 59935] [client 78.147.196.4:51259] [client 78.147.196.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.147.196.4, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aezMj_BrrkdzpEbmK4eRSwAAAIg"]
[Sat Apr 25 22:15:59.920907 2026] [:error] [pid 59896:tid 59903] [client 78.147.196.4:51783] [client 78.147.196.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.147.196.4, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aezMn7LLzhtkd-OXUgAIUwAAAEM"]
[Sat Apr 25 22:16:23.654722 2026] [:error] [pid 59896:tid 59915] [client 78.147.196.4:52561] [client 78.147.196.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.147.196.4, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aezMt7LLzhtkd-OXUgAIeAAAAE8"]
[Sun Apr 26 00:36:22.624902 2026] [:error] [pid 59898:tid 59973] [client 103.117.163.29:54528] [client 103.117.163.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.117.163.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aezthh-4vImxb0kbdzfR3QAAANM"]
[Sun Apr 26 00:36:32.874000 2026] [:error] [pid 59897:tid 59936] [client 103.117.163.29:54818] [client 103.117.163.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.117.163.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeztkPBrrkdzpEbmK4ezBQAAAIk"]
[Sun Apr 26 00:36:43.416080 2026] [:error] [pid 59897:tid 59934] [client 103.117.163.29:55030] [client 103.117.163.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.117.163.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeztm_BrrkdzpEbmK4ezCgAAAIc"]
[Sun Apr 26 00:36:54.046537 2026] [:error] [pid 59898:tid 59978] [client 103.117.163.29:55208] [client 103.117.163.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.117.163.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeztph-4vImxb0kbdzfSAwAAANg"]
[Sun Apr 26 00:37:04.642847 2026] [:error] [pid 59897:tid 59945] [client 103.117.163.29:28335] [client 103.117.163.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.117.163.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeztsPBrrkdzpEbmK4ezIwAAAJI"]
[Sun Apr 26 00:37:15.345946 2026] [:error] [pid 3212:tid 3222] [client 103.117.163.29:55580] [client 103.117.163.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.117.163.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aeztu_g-28TY8_YLtUedNgAAAQg"]
[Sun Apr 26 00:41:12.160308 2026] [:error] [pid 3212:tid 3230] [client 43.159.152.184:56998] [client 43.159.152.184] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aezuqPg-28TY8_YLtUefOQAAARA"]
[Sun Apr 26 00:59:37.180249 2026] [:error] [pid 59897:tid 59945] [client 20.199.101.230:61523] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/solo1.php"] [unique_id "aezy-fBrrkdzpEbmK4e5xAAAAJI"]
[Sun Apr 26 00:59:38.119482 2026] [:error] [pid 3212:tid 3214] [client 20.199.101.230:42007] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/solo1.php"] [unique_id "aezy-vg-28TY8_YLtUetewAAAQA"]
[Sun Apr 26 00:59:39.853226 2026] [:error] [pid 59897:tid 59933] [client 20.199.101.230:24392] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/solo1.php"] [unique_id "aezy-_BrrkdzpEbmK4e5xwAAAIY"]
[Sun Apr 26 00:59:40.527562 2026] [:error] [pid 59898:tid 59968] [client 20.199.101.230:45613] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/solo1.php"] [unique_id "aezy_B-4vImxb0kbdzfXiwAAAM4"]
[Sun Apr 26 00:59:41.162217 2026] [:error] [pid 3212:tid 3225] [client 20.199.101.230:61542] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/locales.php"] [unique_id "aezy_fg-28TY8_YLtUetggAAAQs"]
[Sun Apr 26 00:59:41.775706 2026] [:error] [pid 3212:tid 3227] [client 20.199.101.230:24386] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/locales.php"] [unique_id "aezy_fg-28TY8_YLtUetgwAAAQ0"]
[Sun Apr 26 00:59:42.298288 2026] [:error] [pid 59985:tid 60006] [client 20.199.101.230:45617] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/locales.php"] [unique_id "aezy_gF_zDvEhKvyTH703wAAABM"]
[Sun Apr 26 00:59:42.872194 2026] [:error] [pid 59985:tid 60000] [client 20.199.101.230:37812] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/locales.php"] [unique_id "aezy_gF_zDvEhKvyTH704QAAAA0"]
[Sun Apr 26 00:59:43.435054 2026] [:error] [pid 59898:tid 59960] [client 20.199.101.230:44760] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aezy_x-4vImxb0kbdzfXjgAAAMY"]
[Sun Apr 26 00:59:44.000415 2026] [:error] [pid 59898:tid 59955] [client 20.199.101.230:44779] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aezy_x-4vImxb0kbdzfXkAAAAME"]
[Sun Apr 26 00:59:44.552735 2026] [:error] [pid 59985:tid 59988] [client 20.199.101.230:45573] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aezzAAF_zDvEhKvyTH705QAAAAE"]
[Sun Apr 26 00:59:45.065396 2026] [:error] [pid 59896:tid 59915] [client 20.199.101.230:42034] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "aezzAbLLzhtkd-OXUgBISgAAAE8"]
[Sun Apr 26 00:59:45.565670 2026] [:error] [pid 59898:tid 59972] [client 20.199.101.230:42029] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pucci.php"] [unique_id "aezzAR-4vImxb0kbdzfXkgAAANI"]
[Sun Apr 26 00:59:46.068757 2026] [:error] [pid 59896:tid 59914] [client 20.199.101.230:44754] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pucci.php"] [unique_id "aezzArLLzhtkd-OXUgBITQAAAE4"]
[Sun Apr 26 00:59:46.658097 2026] [:error] [pid 3212:tid 3237] [client 20.199.101.230:48133] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pucci.php"] [unique_id "aezzAvg-28TY8_YLtUethAAAARc"]
[Sun Apr 26 00:59:47.228100 2026] [:error] [pid 59985:tid 60002] [client 20.199.101.230:37809] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pucci.php"] [unique_id "aezzAwF_zDvEhKvyTH705gAAAA8"]
[Sun Apr 26 00:59:47.778624 2026] [:error] [pid 59898:tid 59974] [client 20.199.101.230:44751] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/details/"] [unique_id "aezzAx-4vImxb0kbdzfXlQAAANQ"]
[Sun Apr 26 00:59:48.351602 2026] [:error] [pid 59897:tid 59935] [client 20.199.101.230:42044] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/details/"] [unique_id "aezzBPBrrkdzpEbmK4e5yQAAAIg"]
[Sun Apr 26 00:59:48.933466 2026] [:error] [pid 59897:tid 59941] [client 20.199.101.230:42004] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/details/"] [unique_id "aezzBPBrrkdzpEbmK4e5ywAAAI4"]
[Sun Apr 26 00:59:49.470632 2026] [:error] [pid 59897:tid 59939] [client 20.199.101.230:48268] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/details/"] [unique_id "aezzBfBrrkdzpEbmK4e5zQAAAIw"]
[Sun Apr 26 00:59:49.975390 2026] [:error] [pid 59985:tid 60001] [client 20.199.101.230:54843] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.dj/index.php"] [unique_id "aezzBQF_zDvEhKvyTH706QAAAA4"]
[Sun Apr 26 00:59:50.458700 2026] [:error] [pid 59985:tid 59989] [client 20.199.101.230:54828] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.dj/index.php"] [unique_id "aezzBgF_zDvEhKvyTH706wAAAAI"]
[Sun Apr 26 00:59:50.964822 2026] [:error] [pid 59985:tid 60005] [client 20.199.101.230:41986] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.dj/index.php"] [unique_id "aezzBgF_zDvEhKvyTH707gAAABI"]
[Sun Apr 26 00:59:51.487342 2026] [:error] [pid 3212:tid 3221] [client 20.199.101.230:37780] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.dj/index.php"] [unique_id "aezzB_g-28TY8_YLtUetiAAAAQc"]
[Sun Apr 26 00:59:52.029962 2026] [:error] [pid 3212:tid 3218] [client 20.199.101.230:61515] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "aezzCPg-28TY8_YLtUetiwAAAQQ"]
[Sun Apr 26 00:59:52.551340 2026] [:error] [pid 3212:tid 3232] [client 20.199.101.230:43836] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "aezzCPg-28TY8_YLtUetjQAAARI"]
[Sun Apr 26 00:59:53.086025 2026] [:error] [pid 59898:tid 59978] [client 20.199.101.230:48319] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "aezzCR-4vImxb0kbdzfXmAAAANg"]
[Sun Apr 26 00:59:53.591761 2026] [:error] [pid 59985:tid 59992] [client 20.199.101.230:61557] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "aezzCQF_zDvEhKvyTH708QAAAAU"]
[Sun Apr 26 00:59:54.155264 2026] [:error] [pid 59985:tid 60004] [client 20.199.101.230:45622] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.tmb/"] [unique_id "aezzCgF_zDvEhKvyTH708wAAABE"]
[Sun Apr 26 00:59:54.713814 2026] [:error] [pid 59985:tid 60007] [client 20.199.101.230:24435] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.tmb/"] [unique_id "aezzCgF_zDvEhKvyTH709AAAABQ"]
[Sun Apr 26 00:59:55.191919 2026] [:error] [pid 59896:tid 59912] [client 20.199.101.230:54836] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.tmb/"] [unique_id "aezzC7LLzhtkd-OXUgBIVQAAAEw"]
[Sun Apr 26 00:59:55.741086 2026] [:error] [pid 3212:tid 3231] [client 20.199.101.230:43807] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.tmb/"] [unique_id "aezzC_g-28TY8_YLtUetkAAAARE"]
[Sun Apr 26 00:59:56.288787 2026] [:error] [pid 3212:tid 3225] [client 20.199.101.230:48258] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/one.php"] [unique_id "aezzDPg-28TY8_YLtUetkgAAAQs"]
[Sun Apr 26 00:59:56.796057 2026] [:error] [pid 3212:tid 3233] [client 20.199.101.230:48265] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/one.php"] [unique_id "aezzDPg-28TY8_YLtUetkwAAARM"]
[Sun Apr 26 00:59:57.375260 2026] [:error] [pid 3212:tid 3220] [client 20.199.101.230:54837] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/one.php"] [unique_id "aezzDfg-28TY8_YLtUetlgAAAQY"]
[Sun Apr 26 00:59:57.947806 2026] [:error] [pid 3212:tid 3228] [client 20.199.101.230:43820] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/one.php"] [unique_id "aezzDfg-28TY8_YLtUetmAAAAQ4"]
[Sun Apr 26 00:59:58.463680 2026] [:error] [pid 59898:tid 59956] [client 20.199.101.230:4939] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no20.php"] [unique_id "aezzDh-4vImxb0kbdzfXmwAAAMI"]
[Sun Apr 26 00:59:59.016261 2026] [:error] [pid 3212:tid 3219] [client 20.199.101.230:37767] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no20.php"] [unique_id "aezzD_g-28TY8_YLtUetmwAAAQU"]
[Sun Apr 26 00:59:59.616188 2026] [:error] [pid 3212:tid 3236] [client 20.199.101.230:43792] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no20.php"] [unique_id "aezzD_g-28TY8_YLtUetngAAARY"]
[Sun Apr 26 01:00:00.235523 2026] [:error] [pid 59985:tid 60008] [client 20.199.101.230:37818] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no20.php"] [unique_id "aezzEAF_zDvEhKvyTH70-QAAABU"]
[Sun Apr 26 01:00:00.835843 2026] [:error] [pid 59985:tid 59990] [client 20.199.101.230:48292] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-alone.php"] [unique_id "aezzEAF_zDvEhKvyTH70-wAAAAM"]
[Sun Apr 26 01:00:01.394040 2026] [:error] [pid 3212:tid 3220] [client 20.199.101.230:48257] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-alone.php"] [unique_id "aezzEfg-28TY8_YLtUetpQAAAQY"]
[Sun Apr 26 01:00:01.935729 2026] [:error] [pid 3212:tid 3235] [client 20.199.101.230:42020] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-alone.php"] [unique_id "aezzEfg-28TY8_YLtUetpgAAARU"]
[Sun Apr 26 01:00:02.544850 2026] [:error] [pid 59897:tid 59948] [client 20.199.101.230:48262] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-alone.php"] [unique_id "aezzEvBrrkdzpEbmK4e50wAAAJU"]
[Sun Apr 26 01:00:03.091993 2026] [:error] [pid 59898:tid 59960] [client 20.199.101.230:61507] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yasnu.php"] [unique_id "aezzEx-4vImxb0kbdzfXnAAAAMY"]
[Sun Apr 26 01:00:03.611544 2026] [:error] [pid 59898:tid 59976] [client 20.199.101.230:45601] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yasnu.php"] [unique_id "aezzEx-4vImxb0kbdzfXnQAAANY"]
[Sun Apr 26 01:00:04.140661 2026] [:error] [pid 59896:tid 59910] [client 20.199.101.230:54841] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yasnu.php"] [unique_id "aezzFLLLzhtkd-OXUgBIVgAAAEo"]
[Sun Apr 26 01:00:04.726586 2026] [:error] [pid 59897:tid 59936] [client 20.199.101.230:61565] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yasnu.php"] [unique_id "aezzFPBrrkdzpEbmK4e51QAAAIk"]
[Sun Apr 26 01:00:05.306486 2026] [:error] [pid 59897:tid 59931] [client 20.199.101.230:42022] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sl.php"] [unique_id "aezzFfBrrkdzpEbmK4e53gAAAIQ"]
[Sun Apr 26 01:00:05.987997 2026] [:error] [pid 59896:tid 59924] [client 20.199.101.230:44736] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sl.php"] [unique_id "aezzFbLLzhtkd-OXUgBIVwAAAFg"]
[Sun Apr 26 01:00:06.496965 2026] [:error] [pid 3212:tid 3221] [client 20.199.101.230:44258] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sl.php"] [unique_id "aezzFvg-28TY8_YLtUettgAAAQc"]
[Sun Apr 26 01:00:07.010280 2026] [:error] [pid 3212:tid 3222] [client 20.199.101.230:42040] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sl.php"] [unique_id "aezzF_g-28TY8_YLtUetuwAAAQg"]
[Sun Apr 26 01:00:07.496479 2026] [:error] [pid 59896:tid 59923] [client 20.199.101.230:41995] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vuln.php"] [unique_id "aezzF7LLzhtkd-OXUgBIWgAAAFc"]
[Sun Apr 26 01:00:08.088686 2026] [:error] [pid 59896:tid 59907] [client 20.199.101.230:45596] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vuln.php"] [unique_id "aezzGLLLzhtkd-OXUgBIWwAAAEc"]
[Sun Apr 26 01:00:08.670709 2026] [:error] [pid 59896:tid 59902] [client 20.199.101.230:44788] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vuln.php"] [unique_id "aezzGLLLzhtkd-OXUgBIXQAAAEI"]
[Sun Apr 26 01:00:09.237414 2026] [:error] [pid 59985:tid 59990] [client 20.199.101.230:37813] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vuln.php"] [unique_id "aezzGQF_zDvEhKvyTH71BgAAAAM"]
[Sun Apr 26 01:00:09.847618 2026] [:error] [pid 59896:tid 59904] [client 20.199.101.230:44744] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-temp.php"] [unique_id "aezzGbLLzhtkd-OXUgBIYwAAAEQ"]
[Sun Apr 26 01:00:10.507674 2026] [:error] [pid 3212:tid 3238] [client 20.199.101.230:48301] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-temp.php"] [unique_id "aezzGvg-28TY8_YLtUetwQAAARg"]
[Sun Apr 26 01:00:11.084059 2026] [:error] [pid 59896:tid 59905] [client 20.199.101.230:42019] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-temp.php"] [unique_id "aezzG7LLzhtkd-OXUgBIaQAAAEU"]
[Sun Apr 26 01:00:11.705756 2026] [:error] [pid 59896:tid 59902] [client 20.199.101.230:61511] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-temp.php"] [unique_id "aezzG7LLzhtkd-OXUgBIbwAAAEI"]
[Sun Apr 26 01:00:12.234162 2026] [:error] [pid 59896:tid 59904] [client 20.199.101.230:42017] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aezzHLLLzhtkd-OXUgBIcAAAAEQ"]
[Sun Apr 26 01:00:12.761985 2026] [:error] [pid 59897:tid 59929] [client 20.199.101.230:37782] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aezzHPBrrkdzpEbmK4e57wAAAII"]
[Sun Apr 26 01:00:13.252642 2026] [:error] [pid 59896:tid 59901] [client 20.199.101.230:48264] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aezzHbLLzhtkd-OXUgBIcgAAAEE"]
[Sun Apr 26 01:00:13.792153 2026] [:error] [pid 59896:tid 59915] [client 20.199.101.230:43781] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "aezzHbLLzhtkd-OXUgBIdAAAAE8"]
[Sun Apr 26 01:00:14.407332 2026] [:error] [pid 3212:tid 3217] [client 20.199.101.230:44759] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aezzHvg-28TY8_YLtUetwwAAAQM"]
[Sun Apr 26 01:00:14.917288 2026] [:error] [pid 3212:tid 3236] [client 20.199.101.230:37769] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aezzHvg-28TY8_YLtUetxQAAARY"]
[Sun Apr 26 01:00:15.448149 2026] [:error] [pid 3212:tid 3226] [client 20.199.101.230:4957] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aezzH_g-28TY8_YLtUetyAAAAQw"]
[Sun Apr 26 01:00:15.965105 2026] [:error] [pid 59898:tid 59966] [client 20.199.101.230:37777] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "aezzHx-4vImxb0kbdzfXwAAAAMw"]
[Sun Apr 26 01:00:16.443786 2026] [:error] [pid 59896:tid 59907] [client 20.199.101.230:44792] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-bda.php"] [unique_id "aezzILLLzhtkd-OXUgBIdwAAAEc"]
[Sun Apr 26 01:00:16.969443 2026] [:error] [pid 59985:tid 59987] [client 20.199.101.230:48161] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-bda.php"] [unique_id "aezzIAF_zDvEhKvyTH71CwAAAAA"]
[Sun Apr 26 01:00:17.488913 2026] [:error] [pid 59985:tid 59997] [client 20.199.101.230:43778] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-bda.php"] [unique_id "aezzIQF_zDvEhKvyTH71DgAAAAo"]
[Sun Apr 26 01:00:18.006645 2026] [:error] [pid 59896:tid 59904] [client 20.199.101.230:48304] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-bda.php"] [unique_id "aezzIrLLzhtkd-OXUgBIegAAAEQ"]
[Sun Apr 26 01:00:18.622654 2026] [:error] [pid 59985:tid 60009] [client 20.199.101.230:45569] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bhm.php"] [unique_id "aezzIgF_zDvEhKvyTH71DwAAABY"]
[Sun Apr 26 01:00:19.387014 2026] [:error] [pid 59896:tid 59921] [client 20.199.101.230:37801] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bhm.php"] [unique_id "aezzI7LLzhtkd-OXUgBIfAAAAFU"]
[Sun Apr 26 01:00:19.975010 2026] [:error] [pid 3212:tid 3220] [client 20.199.101.230:61555] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bhm.php"] [unique_id "aezzI_g-28TY8_YLtUet0AAAAQY"]
[Sun Apr 26 01:00:20.599416 2026] [:error] [pid 3212:tid 3234] [client 20.199.101.230:43781] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bhm.php"] [unique_id "aezzJPg-28TY8_YLtUet0wAAARQ"]
[Sun Apr 26 01:00:21.220454 2026] [:error] [pid 59896:tid 59917] [client 20.199.101.230:24424] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmu.php"] [unique_id "aezzJbLLzhtkd-OXUgBIgAAAAFE"]
[Sun Apr 26 01:00:21.734502 2026] [:error] [pid 3212:tid 3237] [client 20.199.101.230:37810] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmu.php"] [unique_id "aezzJfg-28TY8_YLtUet1gAAARc"]
[Sun Apr 26 01:00:22.267067 2026] [:error] [pid 59896:tid 59924] [client 20.199.101.230:42039] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmu.php"] [unique_id "aezzJrLLzhtkd-OXUgBIgwAAAFg"]
[Sun Apr 26 01:00:22.976160 2026] [:error] [pid 59985:tid 59989] [client 20.199.101.230:37779] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmu.php"] [unique_id "aezzJgF_zDvEhKvyTH71EQAAAAI"]
[Sun Apr 26 01:00:23.495948 2026] [:error] [pid 59985:tid 60001] [client 20.199.101.230:61530] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ref.php"] [unique_id "aezzJwF_zDvEhKvyTH71FAAAAA4"]
[Sun Apr 26 01:00:24.139422 2026] [:error] [pid 59897:tid 59945] [client 20.199.101.230:24425] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ref.php"] [unique_id "aezzKPBrrkdzpEbmK4e58wAAAJI"]
[Sun Apr 26 01:00:24.726609 2026] [:error] [pid 59897:tid 59940] [client 20.199.101.230:44234] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ref.php"] [unique_id "aezzKPBrrkdzpEbmK4e59gAAAI0"]
[Sun Apr 26 01:00:25.335367 2026] [:error] [pid 59896:tid 59903] [client 20.199.101.230:50924] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ref.php"] [unique_id "aezzKbLLzhtkd-OXUgBIiQAAAEM"]
[Sun Apr 26 01:00:25.832836 2026] [:error] [pid 59896:tid 59904] [client 20.199.101.230:42023] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-xme.php"] [unique_id "aezzKbLLzhtkd-OXUgBIigAAAEQ"]
[Sun Apr 26 01:00:26.401160 2026] [:error] [pid 59985:tid 59996] [client 20.199.101.230:24429] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-xme.php"] [unique_id "aezzKgF_zDvEhKvyTH71GAAAAAk"]
[Sun Apr 26 01:00:26.888400 2026] [:error] [pid 59896:tid 59902] [client 20.199.101.230:48147] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-xme.php"] [unique_id "aezzKrLLzhtkd-OXUgBIjQAAAEI"]
[Sun Apr 26 01:00:27.395118 2026] [:error] [pid 59896:tid 59915] [client 20.199.101.230:44764] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-xme.php"] [unique_id "aezzK7LLzhtkd-OXUgBIjwAAAE8"]
[Sun Apr 26 01:00:28.008251 2026] [:error] [pid 3212:tid 3215] [client 20.199.101.230:43826] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer.php"] [unique_id "aezzLPg-28TY8_YLtUet3QAAAQE"]
[Sun Apr 26 01:00:28.642180 2026] [:error] [pid 3212:tid 3214] [client 20.199.101.230:36119] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer.php"] [unique_id "aezzLPg-28TY8_YLtUet3gAAAQA"]
[Sun Apr 26 01:00:29.278152 2026] [:error] [pid 59896:tid 59920] [client 20.199.101.230:61556] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer.php"] [unique_id "aezzLbLLzhtkd-OXUgBIkwAAAFQ"]
[Sun Apr 26 01:00:29.828252 2026] [:error] [pid 3212:tid 3229] [client 20.199.101.230:61545] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer.php"] [unique_id "aezzLfg-28TY8_YLtUet4wAAAQ8"]
[Sun Apr 26 01:00:30.469954 2026] [:error] [pid 3212:tid 3237] [client 20.199.101.230:61512] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ktfow.php"] [unique_id "aezzLvg-28TY8_YLtUet5AAAARc"]
[Sun Apr 26 01:00:31.101997 2026] [:error] [pid 59896:tid 59922] [client 20.199.101.230:44786] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ktfow.php"] [unique_id "aezzL7LLzhtkd-OXUgBIlAAAAFY"]
[Sun Apr 26 01:00:31.616685 2026] [:error] [pid 3212:tid 3230] [client 20.199.101.230:54809] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ktfow.php"] [unique_id "aezzL_g-28TY8_YLtUet5gAAARA"]
[Sun Apr 26 01:00:32.177339 2026] [:error] [pid 59896:tid 59900] [client 20.199.101.230:24403] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ktfow.php"] [unique_id "aezzMLLLzhtkd-OXUgBIlgAAAEA"]
[Sun Apr 26 01:00:32.861620 2026] [:error] [pid 59896:tid 59907] [client 20.199.101.230:48300] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mode.php"] [unique_id "aezzMLLLzhtkd-OXUgBImAAAAEc"]
[Sun Apr 26 01:00:33.585124 2026] [:error] [pid 59985:tid 59987] [client 20.199.101.230:61561] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mode.php"] [unique_id "aezzMQF_zDvEhKvyTH71HAAAAAA"]
[Sun Apr 26 01:00:34.101790 2026] [:error] [pid 59896:tid 59913] [client 20.199.101.230:48305] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mode.php"] [unique_id "aezzMrLLzhtkd-OXUgBImwAAAE0"]
[Sun Apr 26 01:00:34.629268 2026] [:error] [pid 59985:tid 59988] [client 20.199.101.230:41996] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mode.php"] [unique_id "aezzMgF_zDvEhKvyTH71HQAAAAE"]
[Sun Apr 26 01:00:35.238258 2026] [:error] [pid 59898:tid 59973] [client 20.199.101.230:24404] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2468.php"] [unique_id "aezzMx-4vImxb0kbdzfXxwAAANM"]
[Sun Apr 26 01:00:35.749130 2026] [:error] [pid 59985:tid 59997] [client 20.199.101.230:37821] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2468.php"] [unique_id "aezzMwF_zDvEhKvyTH71HwAAAAo"]
[Sun Apr 26 01:00:38.521752 2026] [autoindex:error] [pid 59985:tid 60001] [client 20.199.101.230:45606] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 01:00:49.309931 2026] [:error] [pid 59985:tid 59995] [client 20.199.101.230:45606] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "aezzQQF_zDvEhKvyTH71MwAAAAg"]
[Sun Apr 26 01:00:50.109644 2026] [:error] [pid 59896:tid 59917] [client 20.199.101.230:42045] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "aezzQrLLzhtkd-OXUgBIsQAAAFE"]
[Sun Apr 26 01:00:50.715306 2026] [:error] [pid 59896:tid 59902] [client 20.199.101.230:61513] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "aezzQrLLzhtkd-OXUgBItAAAAEI"]
[Sun Apr 26 01:00:51.398326 2026] [:error] [pid 3212:tid 3215] [client 20.199.101.230:61510] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "aezzQ_g-28TY8_YLtUet7AAAAQE"]
[Sun Apr 26 01:00:52.133177 2026] [:error] [pid 59897:tid 59944] [client 20.199.101.230:45620] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "aezzRPBrrkdzpEbmK4e6AgAAAJE"]
[Sun Apr 26 01:00:52.916970 2026] [:error] [pid 59896:tid 59908] [client 20.199.101.230:42010] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "aezzRLLLzhtkd-OXUgBIvQAAAEg"]
[Sun Apr 26 01:00:53.771922 2026] [:error] [pid 3212:tid 3234] [client 20.199.101.230:42028] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "aezzRfg-28TY8_YLtUet7gAAARQ"]
[Sun Apr 26 01:00:54.522484 2026] [:error] [pid 3212:tid 3221] [client 20.199.101.230:45618] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "aezzRvg-28TY8_YLtUet8QAAAQc"]
[Sun Apr 26 01:00:55.623731 2026] [:error] [pid 59896:tid 59920] [client 20.199.101.230:48151] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "aezzR7LLzhtkd-OXUgBIyAAAAFQ"]
[Sun Apr 26 01:00:56.264327 2026] [:error] [pid 59897:tid 59939] [client 20.199.101.230:48314] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "aezzSPBrrkdzpEbmK4e6AwAAAIw"]
[Sun Apr 26 01:00:56.904785 2026] [:error] [pid 59985:tid 59987] [client 20.199.101.230:44770] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "aezzSAF_zDvEhKvyTH71OQAAAAA"]
[Sun Apr 26 01:00:57.613399 2026] [:error] [pid 59896:tid 59904] [client 20.199.101.230:48185] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "aezzSbLLzhtkd-OXUgBI0AAAAEQ"]
[Sun Apr 26 01:00:58.253062 2026] [:error] [pid 59985:tid 59991] [client 20.199.101.230:48175] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aezzSgF_zDvEhKvyTH71QAAAAAQ"]
[Sun Apr 26 01:00:58.919439 2026] [:error] [pid 59985:tid 60005] [client 20.199.101.230:48267] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aezzSgF_zDvEhKvyTH71QgAAABI"]
[Sun Apr 26 01:00:59.601781 2026] [:error] [pid 3212:tid 3231] [client 20.199.101.230:4987] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aezzS_g-28TY8_YLtUet9gAAARE"]
[Sun Apr 26 01:01:00.470295 2026] [:error] [pid 59896:tid 59905] [client 20.199.101.230:48259] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "aezzTLLLzhtkd-OXUgBI1wAAAEU"]
[Sun Apr 26 01:01:01.436092 2026] [:error] [pid 3212:tid 3228] [client 20.199.101.230:48287] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "aezzTfg-28TY8_YLtUet_AAAAQ4"]
[Sun Apr 26 01:01:02.153069 2026] [:error] [pid 59897:tid 59943] [client 20.199.101.230:44757] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "aezzTvBrrkdzpEbmK4e6CAAAAJA"]
[Sun Apr 26 01:01:02.939010 2026] [:error] [pid 59985:tid 60009] [client 20.199.101.230:54839] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "aezzTgF_zDvEhKvyTH71RwAAABY"]
[Sun Apr 26 01:01:03.579548 2026] [:error] [pid 59985:tid 59988] [client 20.199.101.230:24405] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "aezzTwF_zDvEhKvyTH71SAAAAAE"]
[Sun Apr 26 01:01:04.117590 2026] [:error] [pid 59985:tid 59995] [client 20.199.101.230:4623] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/"] [unique_id "aezzUAF_zDvEhKvyTH71SQAAAAg"]
[Sun Apr 26 01:01:04.760924 2026] [:error] [pid 59985:tid 60000] [client 20.199.101.230:48162] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/"] [unique_id "aezzUAF_zDvEhKvyTH71SgAAAA0"]
[Sun Apr 26 01:01:05.486575 2026] [:error] [pid 3212:tid 3224] [client 20.199.101.230:54838] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/"] [unique_id "aezzUfg-28TY8_YLtUeuAwAAAQo"]
[Sun Apr 26 01:01:06.738936 2026] [:error] [pid 59897:tid 59951] [client 20.199.101.230:42009] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/"] [unique_id "aezzUvBrrkdzpEbmK4e6EAAAAJg"]
[Sun Apr 26 01:01:08.085013 2026] [:error] [pid 59985:tid 59987] [client 20.199.101.230:61509] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "aezzVAF_zDvEhKvyTH71UQAAAAA"]
[Sun Apr 26 01:01:08.897849 2026] [:error] [pid 59896:tid 59912] [client 20.199.101.230:4988] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "aezzVLLLzhtkd-OXUgBI5QAAAEw"]
[Sun Apr 26 01:01:09.712707 2026] [:error] [pid 59896:tid 59909] [client 20.199.101.230:43788] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "aezzVbLLzhtkd-OXUgBI6gAAAEk"]
[Sun Apr 26 01:01:10.426010 2026] [:error] [pid 3212:tid 3217] [client 20.199.101.230:61520] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "aezzVvg-28TY8_YLtUeuDAAAAQM"]
[Sun Apr 26 01:01:11.056000 2026] [:error] [pid 59896:tid 59916] [client 20.199.101.230:54815] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "aezzV7LLzhtkd-OXUgBI7QAAAFA"]
[Sun Apr 26 01:01:11.724310 2026] [:error] [pid 59896:tid 59920] [client 20.199.101.230:54816] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "aezzV7LLzhtkd-OXUgBI7gAAAFQ"]
[Sun Apr 26 01:01:12.610634 2026] [:error] [pid 59985:tid 60008] [client 20.199.101.230:54820] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "aezzWAF_zDvEhKvyTH71VgAAABU"]
[Sun Apr 26 01:01:13.174697 2026] [:error] [pid 3212:tid 3225] [client 20.199.101.230:54824] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell.php"] [unique_id "aezzWfg-28TY8_YLtUeuEwAAAQs"]
[Sun Apr 26 01:01:13.927400 2026] [:error] [pid 3212:tid 3237] [client 20.199.101.230:48293] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/seo.php"] [unique_id "aezzWfg-28TY8_YLtUeuFQAAARc"]
[Sun Apr 26 01:01:14.527010 2026] [:error] [pid 3212:tid 3229] [client 20.199.101.230:42024] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/seo.php"] [unique_id "aezzWvg-28TY8_YLtUeuFwAAAQ8"]
[Sun Apr 26 01:01:15.218573 2026] [:error] [pid 59897:tid 59937] [client 20.199.101.230:37789] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/seo.php"] [unique_id "aezzW_BrrkdzpEbmK4e6FgAAAIo"]
[Sun Apr 26 01:01:15.975309 2026] [:error] [pid 59985:tid 59990] [client 20.199.101.230:45582] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/seo.php"] [unique_id "aezzWwF_zDvEhKvyTH71VwAAAAM"]
[Sun Apr 26 01:01:16.753486 2026] [:error] [pid 3212:tid 3232] [client 20.199.101.230:43795] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "aezzXPg-28TY8_YLtUeuHQAAARI"]
[Sun Apr 26 01:01:17.388836 2026] [:error] [pid 3212:tid 3235] [client 20.199.101.230:24438] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "aezzXfg-28TY8_YLtUeuIAAAARU"]
[Sun Apr 26 01:01:18.118132 2026] [:error] [pid 3212:tid 3237] [client 20.199.101.230:61529] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "aezzXvg-28TY8_YLtUeuJwAAARc"]
[Sun Apr 26 01:01:18.702525 2026] [:error] [pid 3212:tid 3221] [client 20.199.101.230:54833] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "aezzXvg-28TY8_YLtUeuKAAAAQc"]
[Sun Apr 26 01:01:19.225458 2026] [:error] [pid 59896:tid 59924] [client 20.199.101.230:54812] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aezzX7LLzhtkd-OXUgBI8QAAAFg"]
[Sun Apr 26 01:01:20.420008 2026] [:error] [pid 3212:tid 3226] [client 20.199.101.230:24415] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aezzYPg-28TY8_YLtUeuKwAAAQw"]
[Sun Apr 26 01:01:25.238832 2026] [:error] [pid 3212:tid 3231] [client 20.199.101.230:42013] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aezzZfg-28TY8_YLtUeuNgAAARE"]
[Sun Apr 26 01:01:25.870166 2026] [:error] [pid 59985:tid 59991] [client 20.199.101.230:4636] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "aezzZQF_zDvEhKvyTH71XAAAAAQ"]
[Sun Apr 26 01:01:26.557473 2026] [:error] [pid 59985:tid 59999] [client 20.199.101.230:42042] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aezzZgF_zDvEhKvyTH71XwAAAAw"]
[Sun Apr 26 01:01:27.228805 2026] [:error] [pid 59985:tid 60006] [client 20.199.101.230:48270] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aezzZwF_zDvEhKvyTH71YAAAABM"]
[Sun Apr 26 01:01:27.779136 2026] [:error] [pid 3212:tid 3234] [client 20.199.101.230:24444] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aezzZ_g-28TY8_YLtUeuOgAAARQ"]
[Sun Apr 26 01:01:28.759143 2026] [:error] [pid 3212:tid 3227] [client 20.199.101.230:44772] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "aezzaPg-28TY8_YLtUeuPAAAAQ0"]
[Sun Apr 26 01:01:29.669776 2026] [:error] [pid 59898:tid 59970] [client 20.199.101.230:48276] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aezzaR-4vImxb0kbdzfX0AAAANA"]
[Sun Apr 26 01:01:30.312650 2026] [:error] [pid 59985:tid 60009] [client 20.199.101.230:45631] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aezzagF_zDvEhKvyTH71ZAAAABY"]
[Sun Apr 26 01:01:31.274094 2026] [:error] [pid 3212:tid 3220] [client 20.199.101.230:4630] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aezza_g-28TY8_YLtUeuQAAAAQY"]
[Sun Apr 26 01:01:31.855646 2026] [:error] [pid 3212:tid 3219] [client 20.199.101.230:61524] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "aezza_g-28TY8_YLtUeuQQAAAQU"]
[Sun Apr 26 01:01:32.357359 2026] [:error] [pid 59897:tid 59943] [client 20.199.101.230:43780] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aezzbPBrrkdzpEbmK4e6HwAAAJA"]
[Sun Apr 26 01:01:32.881963 2026] [:error] [pid 59985:tid 59990] [client 20.199.101.230:54813] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aezzbAF_zDvEhKvyTH71ZQAAAAM"]
[Sun Apr 26 01:01:33.395052 2026] [:error] [pid 59896:tid 59917] [client 20.199.101.230:37800] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aezzbbLLzhtkd-OXUgBI9QAAAFE"]
[Sun Apr 26 01:01:33.931987 2026] [:error] [pid 59896:tid 59909] [client 20.199.101.230:61543] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "aezzbbLLzhtkd-OXUgBI-QAAAEk"]
[Sun Apr 26 01:01:34.750596 2026] [:error] [pid 59897:tid 59947] [client 20.199.101.230:48153] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "aezzbvBrrkdzpEbmK4e6IwAAAJQ"]
[Sun Apr 26 01:01:35.275081 2026] [:error] [pid 59897:tid 59945] [client 20.199.101.230:37771] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "aezzb_BrrkdzpEbmK4e6JQAAAJI"]
[Sun Apr 26 01:01:35.845559 2026] [:error] [pid 59898:tid 59961] [client 20.199.101.230:48285] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "aezzbx-4vImxb0kbdzfX3QAAAMc"]
[Sun Apr 26 01:01:36.607433 2026] [:error] [pid 59896:tid 59902] [client 20.199.101.230:48269] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "aezzcLLLzhtkd-OXUgBJAAAAAEI"]
[Sun Apr 26 01:01:37.380364 2026] [:error] [pid 59896:tid 59924] [client 20.199.101.230:45585] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "aezzcbLLzhtkd-OXUgBJBAAAAFg"]
[Sun Apr 26 01:01:38.177445 2026] [:error] [pid 59896:tid 59917] [client 20.199.101.230:54790] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "aezzcrLLzhtkd-OXUgBJCQAAAFE"]
[Sun Apr 26 01:01:38.687485 2026] [:error] [pid 3212:tid 3227] [client 20.199.101.230:43825] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "aezzcvg-28TY8_YLtUeuSQAAAQ0"]
[Sun Apr 26 01:01:39.266923 2026] [:error] [pid 59898:tid 59965] [client 20.199.101.230:24390] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "aezzcx-4vImxb0kbdzfX5gAAAMs"]
[Sun Apr 26 01:01:39.764724 2026] [:error] [pid 59897:tid 59951] [client 20.199.101.230:44743] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "aezzc_BrrkdzpEbmK4e6KAAAAJg"]
[Sun Apr 26 01:01:40.359070 2026] [:error] [pid 59898:tid 59963] [client 20.199.101.230:24389] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "aezzdB-4vImxb0kbdzfX6QAAAMk"]
[Sun Apr 26 01:01:40.964222 2026] [:error] [pid 59897:tid 59950] [client 20.199.101.230:43831] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "aezzdPBrrkdzpEbmK4e6KwAAAJc"]
[Sun Apr 26 01:01:41.626068 2026] [:error] [pid 3212:tid 3237] [client 20.199.101.230:45621] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "aezzdfg-28TY8_YLtUeuTQAAARc"]
[Sun Apr 26 01:01:42.254613 2026] [:error] [pid 59896:tid 59923] [client 20.199.101.230:42030] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "aezzdrLLzhtkd-OXUgBJGwAAAFc"]
[Sun Apr 26 01:01:42.757373 2026] [:error] [pid 3212:tid 3220] [client 20.199.101.230:43812] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "aezzdvg-28TY8_YLtUeuTwAAAQY"]
[Sun Apr 26 01:01:43.474925 2026] [:error] [pid 3212:tid 3219] [client 20.199.101.230:45578] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "aezzd_g-28TY8_YLtUeuUQAAAQU"]
[Sun Apr 26 01:01:44.025182 2026] [:error] [pid 3212:tid 3222] [client 20.199.101.230:37768] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "aezzePg-28TY8_YLtUeuVAAAAQg"]
[Sun Apr 26 01:01:44.621585 2026] [:error] [pid 59897:tid 59949] [client 20.199.101.230:45584] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aezzePBrrkdzpEbmK4e6LQAAAJY"]
[Sun Apr 26 01:01:45.448903 2026] [:error] [pid 3212:tid 3215] [client 20.199.101.230:48168] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aezzefg-28TY8_YLtUeuVwAAAQE"]
[Sun Apr 26 01:01:45.947942 2026] [:error] [pid 3212:tid 3230] [client 20.199.101.230:44768] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aezzefg-28TY8_YLtUeuWAAAARA"]
[Sun Apr 26 01:01:46.471795 2026] [:error] [pid 3212:tid 3227] [client 20.199.101.230:61526] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "aezzevg-28TY8_YLtUeuWQAAAQ0"]
[Sun Apr 26 01:01:47.019028 2026] [:error] [pid 59896:tid 59904] [client 20.199.101.230:43818] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "aezze7LLzhtkd-OXUgBJLwAAAEQ"]
[Sun Apr 26 01:01:47.545682 2026] [:error] [pid 59897:tid 59932] [client 20.199.101.230:48133] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "aezze_BrrkdzpEbmK4e6MAAAAIU"]
[Sun Apr 26 01:01:58.944418 2026] [:error] [pid 59896:tid 59914] [client 20.199.101.230:44791] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aezzhrLLzhtkd-OXUgBJdgAAAE4"]
[Sun Apr 26 01:01:59.450816 2026] [:error] [pid 3212:tid 3226] [client 20.199.101.230:43804] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aezzh_g-28TY8_YLtUeuYwAAAQw"]
[Sun Apr 26 01:01:59.983519 2026] [:error] [pid 3212:tid 3224] [client 20.199.101.230:37795] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aezzh_g-28TY8_YLtUeuZAAAAQo"]
[Sun Apr 26 01:02:00.516322 2026] [:error] [pid 59896:tid 59913] [client 20.199.101.230:24418] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "aezziLLLzhtkd-OXUgBJfQAAAE0"]
[Sun Apr 26 01:02:01.128387 2026] [:error] [pid 3212:tid 3230] [client 20.199.101.230:54802] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "aezzifg-28TY8_YLtUeuaAAAARA"]
[Sun Apr 26 01:02:02.051936 2026] [:error] [pid 3212:tid 3225] [client 20.199.101.230:48290] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "aezzivg-28TY8_YLtUeuawAAAQs"]
[Sun Apr 26 01:02:02.647277 2026] [:error] [pid 3212:tid 3220] [client 20.199.101.230:61518] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "aezzivg-28TY8_YLtUeubgAAAQY"]
[Sun Apr 26 01:02:03.284018 2026] [:error] [pid 3212:tid 3219] [client 20.199.101.230:45515] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "aezzi_g-28TY8_YLtUeucAAAAQU"]
[Sun Apr 26 01:02:03.815895 2026] [:error] [pid 59898:tid 59969] [client 20.199.101.230:62923] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "aezzix-4vImxb0kbdzfX9QAAAM8"]
[Sun Apr 26 01:02:04.404546 2026] [:error] [pid 59898:tid 59968] [client 20.199.101.230:37775] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "aezzjB-4vImxb0kbdzfX-gAAAM4"]
[Sun Apr 26 01:02:04.954831 2026] [:error] [pid 59896:tid 59914] [client 20.199.101.230:54834] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "aezzjLLLzhtkd-OXUgBJiQAAAE4"]
[Sun Apr 26 01:02:05.518754 2026] [:error] [pid 59897:tid 59934] [client 20.199.101.230:45581] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "aezzjfBrrkdzpEbmK4e6NAAAAIc"]
[Sun Apr 26 01:02:06.275892 2026] [:error] [pid 59985:tid 60006] [client 20.199.101.230:44283] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "aezzjgF_zDvEhKvyTH71aQAAABM"]
[Sun Apr 26 01:02:06.872176 2026] [:error] [pid 59896:tid 59904] [client 20.199.101.230:54808] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "aezzjrLLzhtkd-OXUgBJjAAAAEQ"]
[Sun Apr 26 01:02:07.663325 2026] [:error] [pid 59897:tid 59946] [client 20.199.101.230:48308] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "aezzj_BrrkdzpEbmK4e6OAAAAJM"]
[Sun Apr 26 01:02:08.196526 2026] [:error] [pid 59898:tid 59969] [client 20.199.101.230:54807] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "aezzkB-4vImxb0kbdzfYCwAAAM8"]
[Sun Apr 26 01:02:08.712146 2026] [:error] [pid 59896:tid 59913] [client 20.199.101.230:48136] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "aezzkLLLzhtkd-OXUgBJjQAAAE0"]
[Sun Apr 26 01:02:09.241546 2026] [:error] [pid 3212:tid 3216] [client 20.199.101.230:37806] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "aezzkfg-28TY8_YLtUeucgAAAQI"]
[Sun Apr 26 01:02:09.829963 2026] [:error] [pid 59898:tid 59976] [client 20.199.101.230:44758] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "aezzkR-4vImxb0kbdzfYEgAAANY"]
[Sun Apr 26 01:02:10.322965 2026] [:error] [pid 3212:tid 3215] [client 20.199.101.230:48135] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "aezzkvg-28TY8_YLtUeucwAAAQE"]
[Sun Apr 26 01:02:10.865341 2026] [:error] [pid 3212:tid 3234] [client 20.199.101.230:45575] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aezzkvg-28TY8_YLtUeudwAAARQ"]
[Sun Apr 26 01:02:11.440005 2026] [:error] [pid 3212:tid 3223] [client 20.199.101.230:44771] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aezzk_g-28TY8_YLtUeuegAAAQk"]
[Sun Apr 26 01:02:12.164003 2026] [:error] [pid 59985:tid 60004] [client 20.199.101.230:42035] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aezzlAF_zDvEhKvyTH71bgAAABE"]
[Sun Apr 26 01:02:12.679824 2026] [:error] [pid 59985:tid 60009] [client 20.199.101.230:54831] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "aezzlAF_zDvEhKvyTH71bwAAABY"]
[Sun Apr 26 01:02:13.322856 2026] [:error] [pid 59898:tid 59964] [client 20.199.101.230:42018] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aezzlR-4vImxb0kbdzfYJAAAAMo"]
[Sun Apr 26 01:02:13.857304 2026] [:error] [pid 59896:tid 59907] [client 20.199.101.230:44778] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aezzlbLLzhtkd-OXUgBJlgAAAEc"]
[Sun Apr 26 01:02:14.681926 2026] [:error] [pid 3212:tid 3233] [client 20.199.101.230:61553] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aezzlvg-28TY8_YLtUeufwAAARM"]
[Sun Apr 26 01:02:15.158436 2026] [:error] [pid 3212:tid 3232] [client 20.199.101.230:43829] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "aezzl_g-28TY8_YLtUeuggAAARI"]
[Sun Apr 26 01:02:15.638895 2026] [:error] [pid 3212:tid 3222] [client 20.199.101.230:45540] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aezzl_g-28TY8_YLtUeuhAAAAQg"]
[Sun Apr 26 01:02:16.190608 2026] [:error] [pid 59896:tid 59921] [client 20.199.101.230:43791] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aezzmLLLzhtkd-OXUgBJmQAAAFU"]
[Sun Apr 26 01:02:16.785170 2026] [:error] [pid 59896:tid 59908] [client 20.199.101.230:45574] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aezzmLLLzhtkd-OXUgBJnAAAAEg"]
[Sun Apr 26 01:02:17.389635 2026] [:error] [pid 59898:tid 59969] [client 20.199.101.230:45576] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "aezzmR-4vImxb0kbdzfYNQAAAM8"]
[Sun Apr 26 01:02:17.945103 2026] [:error] [pid 59898:tid 59964] [client 20.199.101.230:44765] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aezzmR-4vImxb0kbdzfYNgAAAMo"]
[Sun Apr 26 01:02:18.522781 2026] [:error] [pid 59896:tid 59903] [client 20.199.101.230:4968] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aezzmrLLzhtkd-OXUgBJnQAAAEM"]
[Sun Apr 26 01:02:19.097901 2026] [:error] [pid 59897:tid 59932] [client 20.199.101.230:48170] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aezzm_BrrkdzpEbmK4e6PwAAAIU"]
[Sun Apr 26 01:02:19.578388 2026] [:error] [pid 3212:tid 3221] [client 20.199.101.230:45630] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aezzm_g-28TY8_YLtUeuhwAAAQc"]
[Sun Apr 26 01:02:20.130916 2026] [:error] [pid 59896:tid 59912] [client 20.199.101.230:48164] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aezznLLLzhtkd-OXUgBJnwAAAEw"]
[Sun Apr 26 01:02:20.763393 2026] [:error] [pid 3212:tid 3231] [client 20.199.101.230:45603] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aezznPg-28TY8_YLtUeuigAAARE"]
[Sun Apr 26 01:02:21.404211 2026] [:error] [pid 3212:tid 3218] [client 20.199.101.230:44264] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aezznfg-28TY8_YLtUeuiwAAAQQ"]
[Sun Apr 26 01:02:22.000518 2026] [:error] [pid 3212:tid 3228] [client 20.199.101.230:48280] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "aezznfg-28TY8_YLtUeujQAAAQ4"]
[Sun Apr 26 01:02:22.579050 2026] [:error] [pid 59985:tid 60006] [client 20.199.101.230:24427] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aezzngF_zDvEhKvyTH71ewAAABM"]
[Sun Apr 26 01:02:23.154939 2026] [:error] [pid 3212:tid 3234] [client 20.199.101.230:4971] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aezzn_g-28TY8_YLtUeukAAAARQ"]
[Sun Apr 26 01:02:23.648425 2026] [:error] [pid 3212:tid 3227] [client 20.199.101.230:61525] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aezzn_g-28TY8_YLtUeukgAAAQ0"]
[Sun Apr 26 01:02:24.180721 2026] [:error] [pid 59898:tid 59968] [client 20.199.101.230:41985] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "aezzoB-4vImxb0kbdzfYOQAAAM4"]
[Sun Apr 26 01:02:24.742228 2026] [:error] [pid 59898:tid 59976] [client 20.199.101.230:48299] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "aezzoB-4vImxb0kbdzfYOgAAANY"]
[Sun Apr 26 01:02:25.309937 2026] [:error] [pid 59898:tid 59956] [client 20.199.101.230:24422] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "aezzoR-4vImxb0kbdzfYPAAAAMI"]
[Sun Apr 26 01:02:25.846176 2026] [:error] [pid 59898:tid 59959] [client 20.199.101.230:54793] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "aezzoR-4vImxb0kbdzfYPQAAAMU"]
[Sun Apr 26 01:02:26.453825 2026] [:error] [pid 59896:tid 59907] [client 20.199.101.230:45624] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "aezzorLLzhtkd-OXUgBJpQAAAEc"]
[Sun Apr 26 01:02:26.996602 2026] [:error] [pid 59898:tid 59971] [client 20.199.101.230:44242] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aezzoh-4vImxb0kbdzfYPgAAANE"]
[Sun Apr 26 01:02:27.633420 2026] [:error] [pid 59985:tid 60000] [client 20.199.101.230:45623] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aezzowF_zDvEhKvyTH71hwAAAA0"]
[Sun Apr 26 01:02:28.214503 2026] [:error] [pid 3212:tid 3225] [client 20.199.101.230:4638] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aezzpPg-28TY8_YLtUeulQAAAQs"]
[Sun Apr 26 01:02:28.826522 2026] [:error] [pid 59896:tid 59922] [client 20.199.101.230:37811] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "aezzpLLLzhtkd-OXUgBJpwAAAFY"]
[Sun Apr 26 01:02:29.359005 2026] [:error] [pid 59985:tid 60005] [client 20.199.101.230:61505] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aezzpQF_zDvEhKvyTH71iwAAABI"]
[Sun Apr 26 01:02:29.903411 2026] [:error] [pid 59896:tid 59914] [client 20.199.101.230:54796] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aezzpbLLzhtkd-OXUgBJqAAAAE4"]
[Sun Apr 26 01:02:30.430389 2026] [:error] [pid 3212:tid 3219] [client 20.199.101.230:42000] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aezzpvg-28TY8_YLtUeulgAAAQU"]
[Sun Apr 26 01:02:30.991648 2026] [:error] [pid 3212:tid 3214] [client 20.199.101.230:43823] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "aezzpvg-28TY8_YLtUeulwAAAQA"]
[Sun Apr 26 01:02:31.474991 2026] [:error] [pid 3212:tid 3231] [client 20.199.101.230:24417] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aezzp_g-28TY8_YLtUeumAAAARE"]
[Sun Apr 26 01:02:32.117063 2026] [:error] [pid 59896:tid 59909] [client 20.199.101.230:48317] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aezzqLLLzhtkd-OXUgBJqgAAAEk"]
[Sun Apr 26 01:02:32.606705 2026] [:error] [pid 59898:tid 59955] [client 20.199.101.230:42003] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aezzqB-4vImxb0kbdzfYPwAAAME"]
[Sun Apr 26 01:02:33.162033 2026] [:error] [pid 59897:tid 59934] [client 20.199.101.230:48178] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "aezzqfBrrkdzpEbmK4e6QwAAAIc"]
[Sun Apr 26 01:02:33.687027 2026] [:error] [pid 59897:tid 59942] [client 20.199.101.230:37776] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aezzqfBrrkdzpEbmK4e6RAAAAI8"]
[Sun Apr 26 01:02:34.246516 2026] [:error] [pid 3212:tid 3224] [client 20.199.101.230:54805] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aezzqvg-28TY8_YLtUeumwAAAQo"]
[Sun Apr 26 01:02:34.836358 2026] [:error] [pid 59897:tid 59938] [client 20.199.101.230:43833] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aezzqvBrrkdzpEbmK4e6RgAAAIs"]
[Sun Apr 26 01:02:35.475201 2026] [:error] [pid 59897:tid 59936] [client 20.199.101.230:24414] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aezzq_BrrkdzpEbmK4e6RwAAAIk"]
[Sun Apr 26 01:02:36.241139 2026] [:error] [pid 3212:tid 3216] [client 20.199.101.230:54827] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aezzrPg-28TY8_YLtUeunAAAAQI"]
[Sun Apr 26 01:02:36.934623 2026] [:error] [pid 3212:tid 3229] [client 20.199.101.230:37786] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aezzrPg-28TY8_YLtUeuoAAAAQ8"]
[Sun Apr 26 01:02:37.474742 2026] [:error] [pid 3212:tid 3223] [client 20.199.101.230:24444] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aezzrfg-28TY8_YLtUeuogAAAQk"]
[Sun Apr 26 01:02:37.961949 2026] [:error] [pid 59898:tid 59965] [client 20.199.101.230:54825] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "aezzrR-4vImxb0kbdzfYQgAAAMs"]
[Sun Apr 26 01:02:38.506598 2026] [:error] [pid 59898:tid 59974] [client 20.199.101.230:54811] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aezzrh-4vImxb0kbdzfYRAAAANQ"]
[Sun Apr 26 01:02:39.163795 2026] [:error] [pid 59897:tid 59950] [client 20.199.101.230:48170] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aezzr_BrrkdzpEbmK4e6SQAAAJc"]
[Sun Apr 26 01:02:39.672635 2026] [:error] [pid 59896:tid 59918] [client 20.199.101.230:48176] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aezzr7LLzhtkd-OXUgBJsgAAAFI"]
[Sun Apr 26 01:02:40.248181 2026] [:error] [pid 59897:tid 59941] [client 20.199.101.230:45592] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "aezzsPBrrkdzpEbmK4e6SgAAAI4"]
[Sun Apr 26 01:02:40.750820 2026] [:error] [pid 59896:tid 59902] [client 20.199.101.230:45580] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aezzsLLLzhtkd-OXUgBJtgAAAEI"]
[Sun Apr 26 01:02:41.234647 2026] [:error] [pid 59896:tid 59917] [client 20.199.101.230:4935] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aezzsbLLzhtkd-OXUgBJuAAAAFE"]
[Sun Apr 26 01:02:41.803881 2026] [:error] [pid 59896:tid 59900] [client 20.199.101.230:54821] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aezzsbLLzhtkd-OXUgBJugAAAEA"]
[Sun Apr 26 01:02:42.489871 2026] [:error] [pid 59896:tid 59916] [client 20.199.101.230:43815] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "aezzsrLLzhtkd-OXUgBJvQAAAFA"]
[Sun Apr 26 01:02:43.113646 2026] [:error] [pid 3212:tid 3219] [client 20.199.101.230:28394] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "aezzs_g-28TY8_YLtUeuqAAAAQU"]
[Sun Apr 26 01:02:43.710201 2026] [:error] [pid 59985:tid 60000] [client 20.199.101.230:61538] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "aezzswF_zDvEhKvyTH71mQAAAA0"]
[Sun Apr 26 01:02:44.546033 2026] [:error] [pid 3212:tid 3226] [client 20.199.101.230:60850] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "aezztPg-28TY8_YLtUeuqwAAAQw"]
[Sun Apr 26 01:02:45.134082 2026] [:error] [pid 59985:tid 59991] [client 20.199.101.230:61551] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "aezztQF_zDvEhKvyTH71nAAAAAQ"]
[Sun Apr 26 01:02:45.712790 2026] [:error] [pid 59898:tid 59961] [client 20.199.101.230:63382] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aezztR-4vImxb0kbdzfYSgAAAMc"]
[Sun Apr 26 01:02:46.240162 2026] [:error] [pid 59898:tid 59967] [client 20.199.101.230:24393] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aezzth-4vImxb0kbdzfYSwAAAM0"]
[Sun Apr 26 01:02:46.766601 2026] [:error] [pid 59897:tid 59929] [client 20.199.101.230:44755] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aezztvBrrkdzpEbmK4e6UAAAAII"]
[Sun Apr 26 01:02:47.319320 2026] [:error] [pid 59898:tid 59968] [client 20.199.101.230:44265] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "aezztx-4vImxb0kbdzfYTAAAAM4"]
[Sun Apr 26 01:02:47.896734 2026] [:error] [pid 59898:tid 59976] [client 20.199.101.230:48312] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aezztx-4vImxb0kbdzfYTQAAANY"]
[Sun Apr 26 01:02:48.480841 2026] [:error] [pid 59896:tid 59907] [client 20.199.101.230:24385] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aezzuLLLzhtkd-OXUgBJwwAAAEc"]
[Sun Apr 26 01:02:49.056457 2026] [:error] [pid 3212:tid 3222] [client 20.199.101.230:43839] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aezzufg-28TY8_YLtUeurQAAAQg"]
[Sun Apr 26 01:02:49.582762 2026] [:error] [pid 3212:tid 3228] [client 20.199.101.230:44747] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "aezzufg-28TY8_YLtUeurwAAAQ4"]
[Sun Apr 26 01:02:50.109252 2026] [:error] [pid 3212:tid 3232] [client 20.199.101.230:28358] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "aezzuvg-28TY8_YLtUeusAAAARI"]
[Sun Apr 26 01:02:50.658193 2026] [:error] [pid 3212:tid 3223] [client 20.199.101.230:61521] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "aezzuvg-28TY8_YLtUeusgAAAQk"]
[Sun Apr 26 01:02:51.195661 2026] [:error] [pid 3212:tid 3230] [client 20.199.101.230:24416] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "aezzu_g-28TY8_YLtUeutgAAARA"]
[Sun Apr 26 01:02:51.777521 2026] [:error] [pid 3212:tid 3219] [client 20.199.101.230:44799] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "aezzu_g-28TY8_YLtUeuuwAAAQU"]
[Sun Apr 26 01:02:52.307608 2026] [:error] [pid 59897:tid 59940] [client 20.199.101.230:42002] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aezzvPBrrkdzpEbmK4e6UwAAAI0"]
[Sun Apr 26 01:02:52.847318 2026] [:error] [pid 59898:tid 59955] [client 20.199.101.230:4983] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aezzvB-4vImxb0kbdzfYTwAAAME"]
[Sun Apr 26 01:02:53.457583 2026] [:error] [pid 59897:tid 59934] [client 20.199.101.230:48316] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aezzvfBrrkdzpEbmK4e6VQAAAIc"]
[Sun Apr 26 01:02:54.343306 2026] [:error] [pid 59898:tid 59960] [client 20.199.101.230:48286] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "aezzvh-4vImxb0kbdzfYUQAAAMY"]
[Sun Apr 26 01:02:54.884955 2026] [:error] [pid 59898:tid 59974] [client 20.199.101.230:48190] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aezzvh-4vImxb0kbdzfYUgAAANQ"]
[Sun Apr 26 01:02:55.491915 2026] [:error] [pid 59985:tid 60009] [client 20.199.101.230:41222] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aezzvwF_zDvEhKvyTH71ogAAABY"]
[Sun Apr 26 01:02:56.067668 2026] [:error] [pid 59985:tid 60008] [client 20.199.101.230:4938] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aezzwAF_zDvEhKvyTH71pAAAABU"]
[Sun Apr 26 01:02:56.607430 2026] [:error] [pid 59897:tid 59951] [client 20.199.101.230:48289] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "aezzwPBrrkdzpEbmK4e6VwAAAJg"]
[Sun Apr 26 01:02:57.382115 2026] [:error] [pid 59897:tid 59938] [client 20.199.101.230:24402] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aezzwfBrrkdzpEbmK4e6WAAAAIs"]
[Sun Apr 26 01:02:57.907255 2026] [:error] [pid 59985:tid 59989] [client 20.199.101.230:63418] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "aezzwQF_zDvEhKvyTH71pwAAAAI"]
[Sun Apr 26 01:03:09.679618 2026] [autoindex:error] [pid 59985:tid 59990] [client 20.199.101.230:44775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 01:03:10.886854 2026] [autoindex:error] [pid 59985:tid 59991] [client 20.199.101.230:44775] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 01:03:11.165714 2026] [autoindex:error] [pid 59985:tid 60003] [client 20.199.101.230:44775] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 01:03:13.165596 2026] [:error] [pid 59985:tid 59996] [client 20.199.101.230:44775] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "aezz0QF_zDvEhKvyTH71wAAAAAk"]
[Sun Apr 26 01:03:13.740686 2026] [:error] [pid 3212:tid 3227] [client 20.199.101.230:61514] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "aezz0fg-28TY8_YLtUeu4QAAAQ0"]
[Sun Apr 26 01:03:14.337084 2026] [:error] [pid 3212:tid 3235] [client 20.199.101.230:45589] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "aezz0vg-28TY8_YLtUeu5gAAARU"]
[Sun Apr 26 01:03:14.945043 2026] [:error] [pid 59897:tid 59932] [client 20.199.101.230:24442] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "aezz0vBrrkdzpEbmK4e6XgAAAIU"]
[Sun Apr 26 01:03:15.613127 2026] [:error] [pid 59896:tid 59902] [client 20.199.101.230:54789] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aezz07LLzhtkd-OXUgBJ1QAAAEI"]
[Sun Apr 26 01:03:16.193321 2026] [:error] [pid 59897:tid 59929] [client 20.199.101.230:43785] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aezz1PBrrkdzpEbmK4e6YAAAAII"]
[Sun Apr 26 01:03:16.718421 2026] [:error] [pid 3212:tid 3237] [client 20.199.101.230:44230] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aezz1Pg-28TY8_YLtUeu7AAAARc"]
[Sun Apr 26 01:03:17.345047 2026] [:error] [pid 59898:tid 59967] [client 20.199.101.230:4990] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "aezz1R-4vImxb0kbdzfYWQAAAM0"]
[Sun Apr 26 01:03:17.869275 2026] [:error] [pid 3212:tid 3236] [client 20.199.101.230:37799] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aezz1fg-28TY8_YLtUeu7wAAARY"]
[Sun Apr 26 01:03:18.424809 2026] [:error] [pid 3212:tid 3238] [client 20.199.101.230:45571] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aezz1vg-28TY8_YLtUeu8QAAARg"]
[Sun Apr 26 01:03:18.938561 2026] [:error] [pid 59897:tid 59934] [client 20.199.101.230:45628] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aezz1vBrrkdzpEbmK4e6aAAAAIc"]
[Sun Apr 26 01:03:19.592478 2026] [:error] [pid 3212:tid 3218] [client 20.199.101.230:45614] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "aezz1_g-28TY8_YLtUeu9gAAAQQ"]
[Sun Apr 26 01:03:20.101784 2026] [:error] [pid 3212:tid 3229] [client 20.199.101.230:45568] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aezz2Pg-28TY8_YLtUeu-gAAAQ8"]
[Sun Apr 26 01:03:20.634056 2026] [:error] [pid 3212:tid 3231] [client 20.199.101.230:50927] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aezz2Pg-28TY8_YLtUeu_gAAARE"]
[Sun Apr 26 01:03:21.194145 2026] [:error] [pid 3212:tid 3238] [client 20.199.101.230:48191] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aezz2fg-28TY8_YLtUevAgAAARg"]
[Sun Apr 26 01:03:21.799981 2026] [:error] [pid 59897:tid 59938] [client 20.199.101.230:28352] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "aezz2fBrrkdzpEbmK4e6aQAAAIs"]
[Sun Apr 26 01:03:22.326072 2026] [:error] [pid 59897:tid 59935] [client 20.199.101.230:61524] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aezz2vBrrkdzpEbmK4e6agAAAIg"]
[Sun Apr 26 01:03:22.863670 2026] [:error] [pid 59896:tid 59922] [client 20.199.101.230:61548] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aezz2rLLzhtkd-OXUgBJ3QAAAFY"]
[Sun Apr 26 01:03:23.430022 2026] [:error] [pid 3212:tid 3234] [client 20.199.101.230:44793] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aezz2_g-28TY8_YLtUevBQAAARQ"]
[Sun Apr 26 01:03:23.995161 2026] [:error] [pid 59985:tid 60008] [client 20.199.101.230:48256] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "aezz2wF_zDvEhKvyTH71xAAAABU"]
[Sun Apr 26 01:03:24.580635 2026] [:error] [pid 59897:tid 59931] [client 20.199.101.230:44281] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "aezz3PBrrkdzpEbmK4e6bQAAAIQ"]
[Sun Apr 26 01:03:27.339723 2026] [:error] [pid 59898:tid 59971] [client 20.199.101.230:63362] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "aezz3x-4vImxb0kbdzfYXQAAANE"]
[Sun Apr 26 01:03:29.074291 2026] [:error] [pid 3212:tid 3236] [client 20.199.101.230:37820] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "aezz4fg-28TY8_YLtUevDAAAARY"]
[Sun Apr 26 01:03:30.254736 2026] [:error] [pid 59896:tid 59910] [client 20.199.101.230:61533] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "aezz4rLLzhtkd-OXUgBJ6QAAAEo"]
[Sun Apr 26 01:03:30.905030 2026] [:error] [pid 3212:tid 3216] [client 20.199.101.230:44753] [client 20.199.101.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aezz4vg-28TY8_YLtUevDwAAAQI"]
[Sun Apr 26 01:03:31.519188 2026] [:error] [pid 59898:tid 59978] [client 20.199.101.230:44789] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aezz4x-4vImxb0kbdzfYXwAAANg"]
[Sun Apr 26 01:03:32.636330 2026] [:error] [pid 3212:tid 3215] [client 20.199.101.230:37783] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aezz5Pg-28TY8_YLtUevFwAAAQE"]
[Sun Apr 26 01:03:33.825188 2026] [:error] [pid 3212:tid 3227] [client 20.199.101.230:37796] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "aezz5fg-28TY8_YLtUevGQAAAQ0"]
[Sun Apr 26 01:03:34.621900 2026] [:error] [pid 59985:tid 59999] [client 20.199.101.230:45607] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aezz5gF_zDvEhKvyTH710gAAAAw"]
[Sun Apr 26 01:03:35.425485 2026] [:error] [pid 59985:tid 59987] [client 20.199.101.230:48318] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aezz5wF_zDvEhKvyTH711AAAAAA"]
[Sun Apr 26 01:03:36.348122 2026] [:error] [pid 59985:tid 60000] [client 20.199.101.230:43822] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aezz6AF_zDvEhKvyTH711wAAAA0"]
[Sun Apr 26 01:03:37.677696 2026] [:error] [pid 3212:tid 3238] [client 20.199.101.230:48309] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "aezz6fg-28TY8_YLtUevHAAAARg"]
[Sun Apr 26 01:03:38.673587 2026] [:error] [pid 59896:tid 59920] [client 20.199.101.230:48315] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "aezz6rLLzhtkd-OXUgBJ8gAAAFQ"]
[Sun Apr 26 01:03:39.517674 2026] [:error] [pid 59985:tid 60011] [client 20.199.101.230:42006] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "aezz6wF_zDvEhKvyTH713wAAABg"]
[Sun Apr 26 01:03:40.904516 2026] [:error] [pid 59896:tid 59907] [client 20.199.101.230:45577] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "aezz7LLLzhtkd-OXUgBJ-AAAAEc"]
[Sun Apr 26 01:03:42.934491 2026] [:error] [pid 3212:tid 3215] [client 20.199.101.230:4963] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "aezz7vg-28TY8_YLtUevIAAAAQE"]
[Sun Apr 26 01:03:44.043111 2026] [:error] [pid 59985:tid 59995] [client 20.199.101.230:63396] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aezz8AF_zDvEhKvyTH715AAAAAg"]
[Sun Apr 26 01:03:44.640985 2026] [:error] [pid 3212:tid 3218] [client 20.199.101.230:43819] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aezz8Pg-28TY8_YLtUevIgAAAQQ"]
[Sun Apr 26 01:03:45.184905 2026] [:error] [pid 3212:tid 3227] [client 20.199.101.230:4969] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aezz8fg-28TY8_YLtUevJAAAAQ0"]
[Sun Apr 26 01:03:45.904315 2026] [:error] [pid 59985:tid 59991] [client 20.199.101.230:37793] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "aezz8QF_zDvEhKvyTH715QAAAAQ"]
[Sun Apr 26 01:03:46.618493 2026] [:error] [pid 59898:tid 59960] [client 20.199.101.230:24394] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "aezz8h-4vImxb0kbdzfYbwAAAMY"]
[Sun Apr 26 01:03:47.227569 2026] [:error] [pid 59896:tid 59915] [client 20.199.101.230:37762] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "aezz87LLzhtkd-OXUgBJ-gAAAE8"]
[Sun Apr 26 01:03:47.810774 2026] [:error] [pid 59896:tid 59906] [client 20.199.101.230:24398] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "aezz87LLzhtkd-OXUgBJ-wAAAEY"]
[Sun Apr 26 01:03:48.405279 2026] [:error] [pid 59985:tid 60011] [client 20.199.101.230:61542] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "aezz9AF_zDvEhKvyTH716gAAABg"]
[Sun Apr 26 01:03:48.959269 2026] [:error] [pid 3212:tid 3219] [client 20.199.101.230:44284] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "aezz9Pg-28TY8_YLtUevJgAAAQU"]
[Sun Apr 26 01:03:49.510944 2026] [:error] [pid 59896:tid 59913] [client 20.199.101.230:48313] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "aezz9bLLzhtkd-OXUgBJ_QAAAE0"]
[Sun Apr 26 01:03:50.183701 2026] [:error] [pid 59985:tid 59997] [client 20.199.101.230:4609] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "aezz9gF_zDvEhKvyTH717wAAAAo"]
[Sun Apr 26 01:03:50.797980 2026] [:error] [pid 59896:tid 59908] [client 20.199.101.230:45591] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "aezz9rLLzhtkd-OXUgBJ_wAAAEg"]
[Sun Apr 26 01:03:51.431690 2026] [:error] [pid 3212:tid 3217] [client 20.199.101.230:48146] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "aezz9_g-28TY8_YLtUevJwAAAQM"]
[Sun Apr 26 01:03:52.077319 2026] [:error] [pid 3212:tid 3220] [client 20.199.101.230:44269] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "aezz-Pg-28TY8_YLtUevKQAAAQY"]
[Sun Apr 26 01:03:52.617711 2026] [:error] [pid 3212:tid 3236] [client 20.199.101.230:44746] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "aezz-Pg-28TY8_YLtUevKgAAARY"]
[Sun Apr 26 01:03:53.161024 2026] [:error] [pid 3212:tid 3216] [client 20.199.101.230:37764] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "aezz-fg-28TY8_YLtUevKwAAAQI"]
[Sun Apr 26 01:03:53.693563 2026] [:error] [pid 59896:tid 59902] [client 20.199.101.230:48274] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/admin.php"] [unique_id "aezz-bLLzhtkd-OXUgBKAAAAAEI"]
[Sun Apr 26 01:03:54.251816 2026] [:error] [pid 3212:tid 3221] [client 20.199.101.230:37822] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/admin.php"] [unique_id "aezz-vg-28TY8_YLtUevLAAAAQc"]
[Sun Apr 26 01:03:54.832421 2026] [:error] [pid 3212:tid 3214] [client 20.199.101.230:37819] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/admin.php"] [unique_id "aezz-vg-28TY8_YLtUevLgAAAQA"]
[Sun Apr 26 01:03:55.378862 2026] [:error] [pid 3212:tid 3237] [client 20.199.101.230:45598] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/admin.php"] [unique_id "aezz-_g-28TY8_YLtUevMAAAARc"]
[Sun Apr 26 01:03:55.903991 2026] [:error] [pid 59896:tid 59904] [client 20.199.101.230:54819] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aezz-7LLzhtkd-OXUgBKAQAAAEQ"]
[Sun Apr 26 01:03:56.519659 2026] [:error] [pid 59896:tid 59903] [client 20.199.101.230:60814] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aezz_LLLzhtkd-OXUgBKAgAAAEM"]
[Sun Apr 26 01:03:57.243320 2026] [:error] [pid 59897:tid 59939] [client 20.199.101.230:42014] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aezz_fBrrkdzpEbmK4e6fwAAAIw"]
[Sun Apr 26 01:03:57.836820 2026] [:error] [pid 59898:tid 59974] [client 20.199.101.230:45594] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "aezz_R-4vImxb0kbdzfYcAAAANQ"]
[Sun Apr 26 01:03:58.447505 2026] [:error] [pid 59896:tid 59917] [client 20.199.101.230:48157] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aezz_rLLzhtkd-OXUgBKAwAAAFE"]
[Sun Apr 26 01:03:59.047493 2026] [:error] [pid 3212:tid 3223] [client 20.199.101.230:28374] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aezz__g-28TY8_YLtUevNQAAAQk"]
[Sun Apr 26 01:03:59.644633 2026] [:error] [pid 3212:tid 3233] [client 20.199.101.230:24437] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aezz__g-28TY8_YLtUevNgAAARM"]
[Sun Apr 26 01:04:00.315581 2026] [:error] [pid 59985:tid 60000] [client 20.199.101.230:42015] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "aez0AAF_zDvEhKvyTH71-AAAAA0"]
[Sun Apr 26 01:04:01.133587 2026] [:error] [pid 59896:tid 59920] [client 20.199.101.230:43814] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "aez0AbLLzhtkd-OXUgBKBQAAAFQ"]
[Sun Apr 26 01:04:02.205175 2026] [:error] [pid 59985:tid 59991] [client 20.199.101.230:43798] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "aez0AgF_zDvEhKvyTH71-wAAAAQ"]
[Sun Apr 26 01:04:02.728950 2026] [:error] [pid 3212:tid 3221] [client 20.199.101.230:63370] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "aez0Avg-28TY8_YLtUevOgAAAQc"]
[Sun Apr 26 01:04:03.447970 2026] [:error] [pid 3212:tid 3231] [client 20.199.101.230:48131] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "aez0A_g-28TY8_YLtUevPQAAARE"]
[Sun Apr 26 01:04:03.999989 2026] [:error] [pid 59896:tid 59900] [client 20.199.101.230:43805] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aez0A7LLzhtkd-OXUgBKBgAAAEA"]
[Sun Apr 26 01:04:04.528886 2026] [:error] [pid 59896:tid 59905] [client 20.199.101.230:4955] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aez0BLLLzhtkd-OXUgBKBwAAAEU"]
[Sun Apr 26 01:04:05.123497 2026] [:error] [pid 3212:tid 3218] [client 20.199.101.230:54844] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aez0Bfg-28TY8_YLtUevPgAAAQQ"]
[Sun Apr 26 01:04:05.681394 2026] [:error] [pid 3212:tid 3227] [client 20.199.101.230:45610] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "aez0Bfg-28TY8_YLtUevPwAAAQ0"]
[Sun Apr 26 01:04:06.242861 2026] [:error] [pid 3212:tid 3225] [client 20.199.101.230:41989] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "aez0Bvg-28TY8_YLtUevQAAAAQs"]
[Sun Apr 26 01:04:06.857067 2026] [:error] [pid 3212:tid 3223] [client 20.199.101.230:4612] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "aez0Bvg-28TY8_YLtUevQQAAAQk"]
[Sun Apr 26 01:04:07.526961 2026] [:error] [pid 3212:tid 3219] [client 20.199.101.230:44750] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "aez0B_g-28TY8_YLtUevQwAAAQU"]
[Sun Apr 26 01:04:08.059323 2026] [:error] [pid 59896:tid 59922] [client 20.199.101.230:54784] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "aez0CLLLzhtkd-OXUgBKCAAAAFY"]
[Sun Apr 26 01:04:08.586186 2026] [:error] [pid 3212:tid 3222] [client 20.199.101.230:28411] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aez0CPg-28TY8_YLtUevRgAAAQg"]
[Sun Apr 26 01:04:09.149476 2026] [:error] [pid 3212:tid 3216] [client 20.199.101.230:48166] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aez0Cfg-28TY8_YLtUevRwAAAQI"]
[Sun Apr 26 01:04:09.662351 2026] [:error] [pid 59896:tid 59915] [client 20.199.101.230:63387] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aez0CbLLzhtkd-OXUgBKCwAAAE8"]
[Sun Apr 26 01:04:10.149747 2026] [:error] [pid 59985:tid 59999] [client 20.199.101.230:50934] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file48.php"] [unique_id "aez0CgF_zDvEhKvyTH72BwAAAAw"]
[Sun Apr 26 01:04:10.676136 2026] [:error] [pid 59896:tid 59906] [client 20.199.101.230:45519] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aez0CrLLzhtkd-OXUgBKDAAAAEY"]
[Sun Apr 26 01:04:11.298787 2026] [:error] [pid 59985:tid 59987] [client 20.199.101.230:61508] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aez0CwF_zDvEhKvyTH72CQAAAAA"]
[Sun Apr 26 01:04:11.820766 2026] [:error] [pid 59985:tid 59989] [client 20.199.101.230:44756] [client 20.199.101.230] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "aez0CwF_zDvEhKvyTH72DQAAAAI"]
[Sun Apr 26 01:04:18.107319 2026] [autoindex:error] [pid 59985:tid 59988] [client 20.199.101.230:45611] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 02:03:13.558589 2026] [autoindex:error] [pid 59985:tid 59997] [client 74.249.155.150:6994] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 02:03:13.794411 2026] [:error] [pid 59985:tid 59992] [client 74.249.155.150:6994] [client 74.249.155.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.249.155.150, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "ae0B4QF_zDvEhKvyTH4KhwAAAAU"]
[Sun Apr 26 02:03:15.447249 2026] [autoindex:error] [pid 59985:tid 59999] [client 74.249.155.150:6994] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 02:03:17.891968 2026] [autoindex:error] [pid 59985:tid 60006] [client 74.249.155.150:6994] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 02:03:18.084036 2026] [autoindex:error] [pid 59985:tid 60003] [client 74.249.155.150:6994] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 02:03:19.090453 2026] [autoindex:error] [pid 59985:tid 59993] [client 74.249.155.150:6994] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 02:03:23.146035 2026] [autoindex:error] [pid 59985:tid 59998] [client 74.249.155.150:6994] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 02:03:24.165657 2026] [:error] [pid 59985:tid 59988] [client 74.249.155.150:6994] [client 74.249.155.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "ae0B7AF_zDvEhKvyTH4KogAAAAE"]
[Sun Apr 26 02:03:26.520319 2026] [:error] [pid 3212:tid 3220] [client 74.249.155.150:7007] [client 74.249.155.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "ae0B7vg-28TY8_YLtUfRJwAAAQY"]
[Sun Apr 26 02:03:27.446710 2026] [:error] [pid 59897:tid 59927] [client 74.249.155.150:6984] [client 74.249.155.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "ae0B7_BrrkdzpEbmK4fJ6wAAAIA"]
[Sun Apr 26 02:03:28.480138 2026] [:error] [pid 59896:tid 59909] [client 74.249.155.150:6606] [client 74.249.155.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "ae0B8LLLzhtkd-OXUgBiugAAAEk"]
[Sun Apr 26 02:03:29.442351 2026] [:error] [pid 3212:tid 3233] [client 74.249.155.150:6991] [client 74.249.155.150] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "ae0B8fg-28TY8_YLtUfRMgAAARM"]
[Sun Apr 26 04:50:35.537274 2026] [:error] [pid 10315:tid 10340] [client 110.166.71.39:56503] [client 110.166.71.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ae0pG6JIw2vjkleLIaB2-gAAARc"]
[Sun Apr 26 04:55:31.051492 2026] [autoindex:error] [pid 8491:tid 8513] [client 52.253.104.46:7186] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 04:55:32.658479 2026] [autoindex:error] [pid 8491:tid 8516] [client 52.253.104.46:7186] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 04:55:35.088820 2026] [:error] [pid 8491:tid 8503] [client 52.253.104.46:7186] [client 52.253.104.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "ae0qRyq7I7e6CJooQM18TwAAAMQ"]
[Sun Apr 26 04:55:35.566771 2026] [:error] [pid 8491:tid 8502] [client 52.253.104.46:6850] [client 52.253.104.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "ae0qRyq7I7e6CJooQM18UQAAAMM"]
[Sun Apr 26 04:55:36.020644 2026] [:error] [pid 8491:tid 8521] [client 52.253.104.46:2354] [client 52.253.104.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "ae0qSCq7I7e6CJooQM18VgAAANY"]
[Sun Apr 26 04:55:36.477924 2026] [:error] [pid 8385:tid 8437] [client 52.253.104.46:2349] [client 52.253.104.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aa.php"] [unique_id "ae0qSDOy7_J84Wx3-oxR4QAAAE0"]
[Sun Apr 26 05:09:59.811502 2026] [:error] [pid 8491:tid 8521] [client 20.5.74.70:14038] [client 20.5.74.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ae0tpyq7I7e6CJooQM2AcQAAANY"]
[Sun Apr 26 05:09:59.903171 2026] [:error] [pid 10315:tid 10319] [client 20.5.74.70:14061] [client 20.5.74.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ae0tp6JIw2vjkleLIaB-FwAAAQI"]
[Sun Apr 26 05:09:59.962645 2026] [:error] [pid 10315:tid 10331] [client 20.5.74.70:6844] [client 20.5.74.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ae0tp6JIw2vjkleLIaB-GAAAAQ4"]
[Sun Apr 26 05:10:00.024887 2026] [:error] [pid 10315:tid 10339] [client 20.5.74.70:14063] [client 20.5.74.70] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ae0tqKJIw2vjkleLIaB-GgAAARY"]
[Sun Apr 26 06:16:20.843703 2026] [:error] [pid 8491:tid 8515] [client 49.51.132.100:48362] [client 49.51.132.100] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ae09NCq7I7e6CJooQM2YeQAAANA"]
[Sun Apr 26 07:46:40.666676 2026] [:error] [pid 13197:tid 13238] [client 64.23.173.155:40068] [client 64.23.173.155] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "ae1SYN3kktFKdSxTrBuVxgAAAsc"]
[Sun Apr 26 07:54:40.827381 2026] [:error] [pid 13137:tid 13142] [client 160.30.179.124:39012] [client 160.30.179.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "ae1UQN0RB4J0o4h5neHp8gAAAgI"]
[Sun Apr 26 08:49:00.585282 2026] [:error] [pid 8491:tid 8510] [client 65.254.225.231:55974] [client 65.254.225.231] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.231, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ae1g_Cq7I7e6CJooQM20ygAAAMs"]
[Sun Apr 26 09:03:50.607092 2026] [:error] [pid 22573:tid 22624] [client 103.30.72.102:56754] [client 103.30.72.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.30.72.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ae1kdnB3EmQlD4yKUt8-pAAAAZE"]
[Sun Apr 26 09:03:51.544514 2026] [:error] [pid 22573:tid 22613] [client 103.30.72.102:56754] [client 103.30.72.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.30.72.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ae1kd3B3EmQlD4yKUt8-qAAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 26 09:26:01.198700 2026] [:error] [pid 8385:tid 8425] [client 142.189.221.81:54686] [client 142.189.221.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.189.221.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ae1pqTOy7_J84Wx3-oyCRwAAAEE"]
[Sun Apr 26 09:26:01.282085 2026] [:error] [pid 8385:tid 8430] [client 190.92.174.21:55392] [client 190.92.174.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.92.174.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ae1pqTOy7_J84Wx3-oyCSAAAAEY"]
[Sun Apr 26 09:26:02.174770 2026] [:error] [pid 8385:tid 8442] [client 190.92.174.21:55392] [client 190.92.174.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.92.174.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ae1pqjOy7_J84Wx3-oyCSQAAAFI"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 26 09:26:05.060160 2026] [:error] [pid 8383:tid 8404] [client 142.189.221.81:54694] [client 142.189.221.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 142.189.221.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ae1prdFa2S3EsATMdWPZGQAAAAc"], referer: https://expressinteriors.com/wp-login.php
[Sun Apr 26 10:12:49.146317 2026] [:error] [pid 22573:tid 22626] [client 49.51.252.146:43702] [client 49.51.252.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ae10oXB3EmQlD4yKUt9X7QAAAZM"]
[Sun Apr 26 11:13:27.025963 2026] [:error] [pid 22573:tid 22610] [client 14.215.163.132:38748] [client 14.215.163.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ae2C13B3EmQlD4yKUt9zDAAAAYQ"]
[Sun Apr 26 12:51:04.276146 2026] [autoindex:error] [pid 8383:tid 8407] [client 52.253.104.46:7175] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 12:51:04.396532 2026] [autoindex:error] [pid 8383:tid 8408] [client 52.253.104.46:7175] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 12:51:04.514500 2026] [autoindex:error] [pid 8383:tid 8412] [client 52.253.104.46:7175] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 12:51:06.271516 2026] [autoindex:error] [pid 8383:tid 8405] [client 52.253.104.46:7175] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 12:51:07.073170 2026] [autoindex:error] [pid 8383:tid 8416] [client 52.253.104.46:7175] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 12:51:08.553495 2026] [autoindex:error] [pid 8383:tid 8409] [client 52.253.104.46:7175] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 12:51:08.696148 2026] [autoindex:error] [pid 8383:tid 8407] [client 52.253.104.46:7175] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 12:51:08.818971 2026] [autoindex:error] [pid 8383:tid 8412] [client 52.253.104.46:7175] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 12:51:10.962778 2026] [autoindex:error] [pid 8383:tid 8405] [client 52.253.104.46:7175] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 12:51:12.999136 2026] [:error] [pid 8383:tid 8421] [client 52.253.104.46:7175] [client 52.253.104.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "ae2ZwNFa2S3EsATMdWPrnAAAABg"]
[Sun Apr 26 12:51:13.463548 2026] [autoindex:error] [pid 8491:tid 8510] [client 52.253.104.46:2539] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 12:51:13.581315 2026] [autoindex:error] [pid 8491:tid 8508] [client 52.253.104.46:2539] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 12:51:13.698948 2026] [autoindex:error] [pid 8491:tid 8512] [client 52.253.104.46:2539] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 12:51:13.816596 2026] [autoindex:error] [pid 8491:tid 8503] [client 52.253.104.46:2539] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 12:51:13.934923 2026] [autoindex:error] [pid 8491:tid 8515] [client 52.253.104.46:2539] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/search/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 12:51:14.943901 2026] [:error] [pid 8491:tid 8516] [client 52.253.104.46:2539] [client 52.253.104.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "ae2Zwiq7I7e6CJooQM3VVQAAANE"]
[Sun Apr 26 12:51:15.406625 2026] [:error] [pid 13137:tid 13141] [client 52.253.104.46:7210] [client 52.253.104.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "ae2Zw90RB4J0o4h5neEspAAAAgE"]
[Sun Apr 26 12:51:15.886031 2026] [:error] [pid 22572:tid 22596] [client 52.253.104.46:2514] [client 52.253.104.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "ae2Zw9XOViWCFU-pZzDODgAAAVI"]
[Sun Apr 26 12:51:16.387393 2026] [:error] [pid 22573:tid 22627] [client 52.253.104.46:2505] [client 52.253.104.46] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/akcc.php"] [unique_id "ae2ZxHB3EmQlD4yKUt-P5wAAAZQ"]
[Sun Apr 26 16:54:14.493515 2026] [autoindex:error] [pid 16515:tid 16533] [client 168.138.172.235:51220] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 16:54:16.287062 2026] [autoindex:error] [pid 16515:tid 16541] [client 168.138.172.235:51220] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun Apr 26 16:54:17.850043 2026] [:error] [pid 16515:tid 16535] [client 168.138.172.235:51774] [client 168.138.172.235] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 168.138.172.235, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ae3SuVtDrUmgHSvpuLwkZwAAAlE"]
[Sun Apr 26 17:52:33.145771 2026] [:error] [pid 8383:tid 8397] [client 43.153.123.3:51938] [client 43.153.123.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ae3gYdFa2S3EsATMdWMnegAAAAA"]
[Sun Apr 26 18:11:45.516132 2026] [:error] [pid 13137:tid 13163] [client 175.6.217.4:37363] [client 175.6.217.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ae3k4d0RB4J0o4h5neFhQAAAAhY"]
[Sun Apr 26 19:19:38.525504 2026] [:error] [pid 22573:tid 22616] [client 74.7.243.194:41384] [client 74.7.243.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.7.243.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae30ynB3EmQlD4yKUt_uEwAAAYk"], referer: https://expressinteriors.com/
[Sun Apr 26 19:37:59.372662 2026] [:error] [pid 22572:tid 22587] [client 49.204.140.144:45068] [client 49.204.140.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.204.140.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae35F9XOViWCFU-pZzAeygAAAUk"]
[Sun Apr 26 19:38:09.690076 2026] [:error] [pid 22572:tid 22582] [client 49.204.140.144:3490] [client 49.204.140.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.204.140.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae35IdXOViWCFU-pZzAe1QAAAUQ"]
[Sun Apr 26 19:38:22.212452 2026] [:error] [pid 22572:tid 22581] [client 49.204.140.144:44509] [client 49.204.140.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.204.140.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae35LtXOViWCFU-pZzAe3gAAAUM"]
[Sun Apr 26 19:38:30.502066 2026] [:error] [pid 16515:tid 16541] [client 49.204.140.144:3400] [client 49.204.140.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.204.140.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae35NltDrUmgHSvpuLw8VwAAAlc"]
[Sun Apr 26 19:38:41.045106 2026] [:error] [pid 8385:tid 8436] [client 49.204.140.144:3091] [client 49.204.140.144] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.204.140.144, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae35QTOy7_J84Wx3-ozNoQAAAEw"]
[Sun Apr 26 21:43:03.237141 2026] [:error] [pid 8390:tid 8475] [client 162.62.213.165:53940] [client 162.62.213.165] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ae4WZ4GPtFK_i9p5yxSG4wAAAJg"]
[Sun Apr 26 22:16:58.475690 2026] [:error] [pid 8390:tid 8451] [client 80.31.251.181:53925] [client 80.31.251.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.31.251.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae4eWoGPtFK_i9p5yxSS0wAAAIA"]
[Sun Apr 26 22:18:38.844123 2026] [:error] [pid 8383:tid 8416] [client 80.31.251.181:55739] [client 80.31.251.181] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ae4evtFa2S3EsATMdWN1cgAAABM"]
[Sun Apr 26 22:19:02.326055 2026] [:error] [pid 16515:tid 16538] [client 80.31.251.181:56238] [client 80.31.251.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.31.251.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae4e1ltDrUmgHSvpuLxRqQAAAlQ"]
[Sun Apr 26 22:19:24.755016 2026] [:error] [pid 8385:tid 8444] [client 80.31.251.181:56663] [client 80.31.251.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.31.251.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae4e7DOy7_J84Wx3-ozfCQAAAFQ"]
[Sun Apr 26 22:19:47.608123 2026] [:error] [pid 8383:tid 8405] [client 80.31.251.181:57142] [client 80.31.251.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.31.251.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae4fA9Fa2S3EsATMdWN1qAAAAAg"]
[Sun Apr 26 22:20:11.980250 2026] [:error] [pid 16574:tid 16643] [client 80.31.251.181:57611] [client 80.31.251.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.31.251.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae4fG35MsX8wRQr99nY-5wAAA1g"]
[Mon Apr 27 00:13:37.891606 2026] [:error] [pid 16515:tid 16522] [client 129.226.93.214:58264] [client 129.226.93.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ae45sVtDrUmgHSvpuLxhdQAAAkQ"]
[Mon Apr 27 01:13:13.622336 2026] [:error] [pid 13197:tid 13256] [client 106.54.62.156:48754] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ae5Hqd3kktFKdSxTrBvxDwAAAtg"]
[Mon Apr 27 04:18:49.458504 2026] [:error] [pid 22751:tid 22768] [client 172.94.9.79:58544] [client 172.94.9.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "ae5zKSc0tCpVyVdFok9nqwAAAM4"]
[Mon Apr 27 04:48:40.495930 2026] [:error] [pid 22647:tid 22713] [client 4.217.194.63:5281] [client 4.217.194.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "ae56KGjfVULTjnk5SzN5ogAAAIM"]
[Mon Apr 27 04:48:41.050337 2026] [:error] [pid 22751:tid 22765] [client 4.217.194.63:5972] [client 4.217.194.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "ae56KSc0tCpVyVdFok9-QgAAAMs"]
[Mon Apr 27 04:48:41.621742 2026] [:error] [pid 22646:tid 22692] [client 4.217.194.63:5993] [client 4.217.194.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "ae56KYk_HyZhTP6AYadytQAAAEk"]
[Mon Apr 27 04:48:42.182580 2026] [:error] [pid 22646:tid 22698] [client 4.217.194.63:5960] [client 4.217.194.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "ae56Kok_HyZhTP6AYadyuQAAAE8"]
[Mon Apr 27 07:38:05.645568 2026] [:error] [pid 36575:tid 36595] [client 182.42.110.255:60925] [client 182.42.110.255] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ae6h3beGZIkifrMjcl9PWgAAARI"]
[Mon Apr 27 07:38:26.412999 2026] [:error] [pid 36575:tid 36582] [client 43.166.247.155:47886] [client 43.166.247.155] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ae6h8reGZIkifrMjcl9PcAAAAQU"]
[Mon Apr 27 09:14:20.008071 2026] [:error] [pid 7056:tid 7068] [client 172.212.183.249:21473] [client 172.212.183.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae64bCaiHlvwyvjHbet3OgAAAQk"]
[Mon Apr 27 09:14:20.389970 2026] [:error] [pid 10926:tid 10930] [client 172.212.183.249:21448] [client 172.212.183.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae64bM5JVz6UQRubscMEkQAAAYI"]
[Mon Apr 27 09:14:20.791606 2026] [:error] [pid 10926:tid 10939] [client 172.212.183.249:21378] [client 172.212.183.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae64bM5JVz6UQRubscMEkwAAAYs"]
[Mon Apr 27 09:14:21.187334 2026] [:error] [pid 6970:tid 6982] [client 172.212.183.249:21502] [client 172.212.183.249] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae64bSs_dFVzfQoHW0RCagAAAIg"]
[Mon Apr 27 13:51:53.047712 2026] [:error] [pid 62607:tid 62628] [client 34.55.86.97:59220] [client 34.55.86.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/media/system/js/core.js"] [unique_id "ae75eYXk80_zcPo33vevnwAAAFM"]
[Mon Apr 27 15:04:19.911358 2026] [:error] [pid 41098:tid 41123] [client 223.236.187.154:63320] [client 223.236.187.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.236.187.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae8Kc-IJ72vFwurGAAs4ewAAABc"], referer: https://expressinteriors.com/
[Mon Apr 27 15:23:08.635067 2026] [:error] [pid 41010:tid 41050] [client 43.130.72.40:32938] [client 43.130.72.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ae8O3Dc-oOrM_e97_4Dj6AAAAcg"]
[Mon Apr 27 16:24:48.794683 2026] [:error] [pid 41009:tid 41028] [client 106.219.168.70:12089] [client 106.219.168.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.168.70, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae8dUNANrlkTbZMXYE2YSwAAAY4"]
[Mon Apr 27 16:24:59.128096 2026] [:error] [pid 41009:tid 41029] [client 106.219.168.70:1787] [client 106.219.168.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.168.70, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae8dW9ANrlkTbZMXYE2YZQAAAY8"]
[Mon Apr 27 16:25:09.791197 2026] [:error] [pid 41011:tid 41083] [client 106.219.168.70:7203] [client 106.219.168.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.168.70, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae8dZQsl5QfsSXIdF6EcjwAAAg4"]
[Mon Apr 27 16:25:20.812863 2026] [:error] [pid 61339:tid 61356] [client 106.219.168.70:24951] [client 106.219.168.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.168.70, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae8dcCHHVuv2RN6lIrgKKgAAAE8"]
[Mon Apr 27 16:25:31.249414 2026] [:error] [pid 41098:tid 41117] [client 106.219.168.70:23959] [client 106.219.168.70] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.168.70, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae8de-IJ72vFwurGAAtXQgAAABE"]
[Mon Apr 27 16:45:17.265022 2026] [:error] [pid 41011:tid 41070] [client 45.80.107.117:15679] [client 45.80.107.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ae8iHQsl5QfsSXIdF6EhaQAAAgE"]
[Mon Apr 27 16:45:18.749907 2026] [:error] [pid 61339:tid 61351] [client 45.80.107.117:11301] [client 45.80.107.117] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ae8iHiHHVuv2RN6lIrgVCAAAAEo"]
[Mon Apr 27 17:28:54.781804 2026] [:error] [pid 41010:tid 41042] [client 112.134.210.84:60107] [client 112.134.210.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.134.210.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae8sVjc-oOrM_e97_4Aa4gAAAcA"]
[Mon Apr 27 17:30:35.236963 2026] [:error] [pid 41011:tid 41079] [client 103.142.255.218:53452] [client 103.142.255.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.142.255.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ae8suwsl5QfsSXIdF6EyNwAAAgo"]
[Mon Apr 27 17:30:36.316890 2026] [:error] [pid 41011:tid 41092] [client 103.142.255.218:53452] [client 103.142.255.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.142.255.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ae8svAsl5QfsSXIdF6EyQwAAAhc"], referer: https://expressinteriors.com/wp-login.php
[Mon Apr 27 17:31:19.916544 2026] [:error] [pid 41098:tid 41107] [client 112.134.210.84:60769] [client 112.134.210.84] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ae8s5-IJ72vFwurGAAtpOwAAAAc"]
[Mon Apr 27 17:32:00.453420 2026] [:error] [pid 41011:tid 41070] [client 112.134.210.84:61146] [client 112.134.210.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.134.210.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae8tEAsl5QfsSXIdF6EzHwAAAgE"]
[Mon Apr 27 17:32:31.932575 2026] [:error] [pid 41009:tid 41038] [client 112.134.210.84:60739] [client 112.134.210.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.134.210.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae8tL9ANrlkTbZMXYE21iQAAAZg"]
[Mon Apr 27 17:33:04.860936 2026] [:error] [pid 61339:tid 61349] [client 112.134.210.84:60626] [client 112.134.210.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.134.210.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae8tUCHHVuv2RN6lIrg-vgAAAEg"]
[Mon Apr 27 17:33:34.720593 2026] [:error] [pid 41098:tid 41113] [client 112.134.210.84:60425] [client 112.134.210.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.134.210.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae8tbuIJ72vFwurGAAtqugAAAA0"]
[Mon Apr 27 18:18:34.647793 2026] [:error] [pid 61339:tid 61363] [client 103.174.31.253:51507] [client 103.174.31.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.174.31.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae83-iHHVuv2RN6lIrheCQAAAFY"]
[Mon Apr 27 18:18:45.488887 2026] [:error] [pid 41011:tid 41087] [client 103.174.31.253:51881] [client 103.174.31.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.174.31.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae84BQsl5QfsSXIdF6FDrQAAAhI"]
[Mon Apr 27 18:18:55.322056 2026] [:error] [pid 41098:tid 41111] [client 103.174.31.253:52197] [client 103.174.31.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.174.31.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae84D-IJ72vFwurGAAt3awAAAAs"]
[Mon Apr 27 18:19:05.783926 2026] [:error] [pid 41009:tid 41015] [client 103.174.31.253:52512] [client 103.174.31.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.174.31.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae84GdANrlkTbZMXYE3IpQAAAYE"]
[Mon Apr 27 18:19:16.222353 2026] [:error] [pid 41009:tid 41036] [client 103.174.31.253:52840] [client 103.174.31.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.174.31.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae84JNANrlkTbZMXYE3IsgAAAZY"]
[Mon Apr 27 19:35:54.507549 2026] [:error] [pid 41009:tid 41021] [client 185.77.220.227:17391] [client 185.77.220.227] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.expressinteriors.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/s3cmd.ini"] [unique_id "ae9KGtANrlkTbZMXYE3e3QAAAYc"]
[Mon Apr 27 19:50:51.717567 2026] [:error] [pid 5688:tid 5760] [client 77.221.152.243:49946] [client 77.221.152.243] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ae9Nm_ODqzfytZx8bbwgJgAAAAk"]
[Mon Apr 27 20:27:56.385984 2026] [:error] [pid 13464:tid 13487] [client 125.75.66.97:55059] [client 125.75.66.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ae9WTGIEa0q6oQ95zvEbKAAAAdM"]
[Mon Apr 27 22:22:22.675065 2026] [:error] [pid 13523:tid 13535] [client 43.130.101.151:52620] [client 43.130.101.151] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ae9xHueav51IXKv1ebEKTQAAAIo"]
[Tue Apr 28 00:02:25.287077 2026] [:error] [pid 31555:tid 31568] [client 5.31.232.98:51573] [client 5.31.232.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.31.232.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae-IkbJDZf3DNaSMAJ2ZogAAAAs"]
[Tue Apr 28 00:02:35.533691 2026] [:error] [pid 31555:tid 31567] [client 5.31.232.98:51455] [client 5.31.232.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.31.232.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae-Im7JDZf3DNaSMAJ2ZywAAAAo"]
[Tue Apr 28 00:02:45.951694 2026] [:error] [pid 13464:tid 13471] [client 5.31.232.98:23140] [client 5.31.232.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.31.232.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae-IpWIEa0q6oQ95zvFC7AAAAcM"]
[Tue Apr 28 00:02:56.568168 2026] [:error] [pid 13523:tid 13533] [client 5.31.232.98:51415] [client 5.31.232.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.31.232.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae-IsOeav51IXKv1ebEmMwAAAIg"]
[Tue Apr 28 00:03:06.446988 2026] [:error] [pid 13523:tid 13542] [client 5.31.232.98:23140] [client 5.31.232.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.31.232.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae-Iuueav51IXKv1ebEmTwAAAJE"]
[Tue Apr 28 01:36:51.138719 2026] [:error] [pid 13554:tid 13575] [client 194.26.192.131:57297] [client 194.26.192.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "ae-es3Jx87Dl-xMmL93cVgAAANM"]
[Tue Apr 28 01:36:51.642513 2026] [:error] [pid 13554:tid 13571] [client 194.26.192.131:57495] [client 194.26.192.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "ae-es3Jx87Dl-xMmL93cVwAAAM8"]
[Tue Apr 28 01:36:52.155936 2026] [:error] [pid 13554:tid 13573] [client 194.26.192.131:57705] [client 194.26.192.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "ae-etHJx87Dl-xMmL93cWQAAANE"]
[Tue Apr 28 01:36:54.220475 2026] [:error] [pid 13523:tid 13538] [client 194.26.192.131:58330] [client 194.26.192.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "ae-etueav51IXKv1ebE0HwAAAI0"]
[Tue Apr 28 03:08:02.658703 2026] [:error] [pid 48914:tid 48937] [client 185.194.178.90:56561] [client 185.194.178.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ae-0EnwuHR_nwT9alH8q_AAAAVQ"]
[Tue Apr 28 04:17:06.528378 2026] [:error] [pid 14579:tid 14663] [client 185.194.178.90:60257] [client 185.194.178.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ae_EQhrUiOG83qKKuuDCgQAAAJc"]
[Tue Apr 28 04:25:13.924340 2026] [:error] [pid 14686:tid 14706] [client 185.194.178.63:38409] [client 185.194.178.63] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.63, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ae_GKe-YPF1Xm7uiWQ71ZwAAANE"]
[Tue Apr 28 05:34:31.916330 2026] [:error] [pid 56602:tid 56627] [client 43.163.206.70:36426] [client 43.163.206.70] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ae_WZ_CwhMxzNW_lZSwomwAAARc"]
[Tue Apr 28 05:46:27.218062 2026] [:error] [pid 56602:tid 56611] [client 201.162.119.179:51662] [client 201.162.119.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.162.119.179, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae_ZM_CwhMxzNW_lZSwuZQAAAQc"]
[Tue Apr 28 05:46:37.141566 2026] [:error] [pid 14686:tid 14696] [client 201.162.119.179:2789] [client 201.162.119.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.162.119.179, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae_ZPe-YPF1Xm7uiWQ4qBwAAAMc"]
[Tue Apr 28 05:46:47.451532 2026] [:error] [pid 14579:tid 14660] [client 201.162.119.179:52336] [client 201.162.119.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.162.119.179, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae_ZRxrUiOG83qKKuuDs7wAAAJQ"]
[Tue Apr 28 05:46:57.758549 2026] [:error] [pid 14686:tid 14709] [client 201.162.119.179:52578] [client 201.162.119.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.162.119.179, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae_ZUe-YPF1Xm7uiWQ4qFAAAANQ"]
[Tue Apr 28 05:47:08.044833 2026] [:error] [pid 56602:tid 56622] [client 201.162.119.179:3311] [client 201.162.119.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.162.119.179, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae_ZXPCwhMxzNW_lZSwuiAAAARI"]
[Tue Apr 28 06:03:05.708839 2026] [:error] [pid 14577:tid 14592] [client 185.194.178.57:54829] [client 185.194.178.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ae_dGSzBH-jwzlgiBdGxQwAAAAY"]
[Tue Apr 28 07:23:37.193890 2026] [:error] [pid 33864:tid 33887] [client 20.215.53.78:11576] [client 20.215.53.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae_v-TXchLGZ4QggCslz7AAAAJU"]
[Tue Apr 28 07:23:37.765504 2026] [:error] [pid 33864:tid 33868] [client 20.215.53.78:51718] [client 20.215.53.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae_v-TXchLGZ4QggCslz8AAAAII"]
[Tue Apr 28 07:23:38.309913 2026] [:error] [pid 33864:tid 33867] [client 20.215.53.78:25314] [client 20.215.53.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae_v-jXchLGZ4QggCslz8QAAAIE"]
[Tue Apr 28 07:23:38.883763 2026] [:error] [pid 33776:tid 33818] [client 20.215.53.78:37648] [client 20.215.53.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "ae_v-l-bEJ2CKP3iKAC0GAAAAEo"]
[Tue Apr 28 08:09:20.371056 2026] [:error] [pid 33777:tid 33836] [client 103.47.132.90:20040] [client 103.47.132.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.47.132.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae_6sLXUCFWqmordGGLPfwAAAQE"]
[Tue Apr 28 08:09:51.900780 2026] [:error] [pid 33777:tid 33845] [client 103.47.132.90:27434] [client 103.47.132.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.47.132.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae_6z7XUCFWqmordGGLP2QAAAQo"]
[Tue Apr 28 08:10:02.385479 2026] [:error] [pid 33864:tid 33878] [client 103.47.132.90:30141] [client 103.47.132.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.47.132.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae_62jXchLGZ4QggCsmM_wAAAIw"]
[Tue Apr 28 08:10:12.847548 2026] [:error] [pid 33864:tid 33867] [client 103.47.132.90:32903] [client 103.47.132.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.47.132.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae_65DXchLGZ4QggCsmNCQAAAIE"]
[Tue Apr 28 08:10:23.323057 2026] [:error] [pid 33864:tid 33868] [client 103.47.132.90:35400] [client 103.47.132.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.47.132.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ae_67zXchLGZ4QggCsmNGwAAAII"]
[Tue Apr 28 08:45:39.704342 2026] [autoindex:error] [pid 33777:tid 33835] [client 52.141.35.48:7814] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 08:45:39.850072 2026] [:error] [pid 33777:tid 33840] [client 52.141.35.48:7814] [client 52.141.35.48] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.141.35.48, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "afADM7XUCFWqmordGGLaOwAAAQU"]
[Tue Apr 28 08:45:41.362506 2026] [autoindex:error] [pid 33777:tid 33839] [client 52.141.35.48:7814] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 08:45:43.991201 2026] [autoindex:error] [pid 33777:tid 33858] [client 52.141.35.48:7814] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 08:45:44.141292 2026] [autoindex:error] [pid 33777:tid 33848] [client 52.141.35.48:7814] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 08:45:45.047534 2026] [autoindex:error] [pid 33777:tid 33840] [client 52.141.35.48:7814] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 08:45:48.960437 2026] [autoindex:error] [pid 33777:tid 33851] [client 52.141.35.48:7814] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 28 08:45:49.892567 2026] [:error] [pid 33777:tid 33835] [client 52.141.35.48:7814] [client 52.141.35.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "afADPbXUCFWqmordGGLaWgAAAQA"]
[Tue Apr 28 08:45:51.578550 2026] [:error] [pid 33777:tid 33845] [client 52.141.35.48:11065] [client 52.141.35.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "afADP7XUCFWqmordGGLaYQAAAQo"]
[Tue Apr 28 08:45:52.303848 2026] [:error] [pid 33775:tid 33803] [client 52.141.35.48:11352] [client 52.141.35.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "afADQJsYOcoQrq88YbXaGwAAANg"]
[Tue Apr 28 08:45:52.943369 2026] [:error] [pid 33776:tid 33811] [client 52.141.35.48:3344] [client 52.141.35.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "afADQF-bEJ2CKP3iKADIGgAAAEM"]
[Tue Apr 28 08:45:53.517214 2026] [:error] [pid 33776:tid 33813] [client 52.141.35.48:11389] [client 52.141.35.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "afADQV-bEJ2CKP3iKADIGwAAAEU"]
[Tue Apr 28 12:22:33.520967 2026] [:error] [pid 33864:tid 33873] [client 223.181.50.205:7190] [client 223.181.50.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.181.50.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afA2CTXchLGZ4QggCsnNcQAAAIc"]
[Tue Apr 28 12:23:45.992324 2026] [:error] [pid 2741:tid 2756] [client 223.181.50.205:14478] [client 223.181.50.205] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afA2Ufp92FeOz1h6ILxn4wAAAUo"]
[Tue Apr 28 12:24:21.732419 2026] [:error] [pid 2741:tid 2756] [client 223.181.50.205:1295] [client 223.181.50.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.181.50.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afA2dfp92FeOz1h6ILxoNwAAAUo"]
[Tue Apr 28 12:24:54.711065 2026] [:error] [pid 33864:tid 33882] [client 223.181.50.205:21457] [client 223.181.50.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.181.50.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afA2ljXchLGZ4QggCsnN1wAAAJA"]
[Tue Apr 28 12:25:29.940276 2026] [:error] [pid 50889:tid 50903] [client 223.181.50.205:14621] [client 223.181.50.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.181.50.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afA2uYzszBr00txEzGjfAwAAAAs"]
[Tue Apr 28 12:26:10.091343 2026] [:error] [pid 33777:tid 33835] [client 223.181.50.205:25606] [client 223.181.50.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.181.50.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afA24rXUCFWqmordGGIdIAAAAQA"]
[Tue Apr 28 12:43:00.948315 2026] [:error] [pid 2741:tid 2760] [client 43.156.204.134:52624] [client 43.156.204.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afA61Pp92FeOz1h6ILxuVAAAAU4"]
[Tue Apr 28 15:04:14.416663 2026] [:error] [pid 50889:tid 50916] [client 210.212.97.243:10400] [client 210.212.97.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 210.212.97.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afBb7ozszBr00txEzGgEIAAAABg"]
[Tue Apr 28 15:04:24.489673 2026] [:error] [pid 2741:tid 2746] [client 210.212.97.243:10401] [client 210.212.97.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 210.212.97.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afBb-Pp92FeOz1h6ILyb9AAAAUA"]
[Tue Apr 28 15:04:33.680285 2026] [:error] [pid 33777:tid 33850] [client 210.212.97.243:10402] [client 210.212.97.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 210.212.97.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afBcAbXUCFWqmordGGJpbAAAAQ8"]
[Tue Apr 28 15:04:44.801373 2026] [:error] [pid 33777:tid 33843] [client 210.212.97.243:10403] [client 210.212.97.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 210.212.97.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afBcDLXUCFWqmordGGJpeQAAAQg"]
[Tue Apr 28 15:04:53.891774 2026] [:error] [pid 33776:tid 33811] [client 210.212.97.243:10404] [client 210.212.97.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 210.212.97.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afBcFV-bEJ2CKP3iKAAFfQAAAEM"]
[Tue Apr 28 15:43:10.669011 2026] [:error] [pid 33777:tid 33855] [client 103.235.0.7:56358] [client 103.235.0.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.235.0.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afBlDrXUCFWqmordGGJ32QAAARQ"]
[Tue Apr 28 15:43:20.748334 2026] [:error] [pid 50889:tid 50894] [client 103.235.0.7:56751] [client 103.235.0.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.235.0.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afBlGIzszBr00txEzGgLnAAAAAI"]
[Tue Apr 28 15:43:31.183969 2026] [:error] [pid 2741:tid 2765] [client 103.235.0.7:57128] [client 103.235.0.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.235.0.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afBlI_p92FeOz1h6ILym9QAAAVM"]
[Tue Apr 28 15:43:41.772836 2026] [:error] [pid 33777:tid 33838] [client 103.235.0.7:57422] [client 103.235.0.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.235.0.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afBlLbXUCFWqmordGGJ3_wAAAQM"]
[Tue Apr 28 15:43:51.925534 2026] [:error] [pid 2741:tid 2753] [client 103.235.0.7:57714] [client 103.235.0.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.235.0.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afBlN_p92FeOz1h6ILynDwAAAUc"]
[Tue Apr 28 16:54:57.496520 2026] [:error] [pid 33777:tid 33858] [client 216.26.230.20:33449] [client 216.26.230.20] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/s3cmd.ini"] [unique_id "afB14bXUCFWqmordGGKQkwAAARc"]
[Tue Apr 28 16:55:38.092893 2026] [:error] [pid 2741:tid 2758] [client 65.111.24.77:63041] [client 65.111.24.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 65.111.24.77, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/expressinteriors.com/xmlrpc.php"] [unique_id "afB2Cvp92FeOz1h6ILy8RwAAAUw"]
[Tue Apr 28 17:01:58.078372 2026] [:error] [pid 33777:tid 33839] [client 43.155.27.244:35542] [client 43.155.27.244] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afB3hrXUCFWqmordGGKUxgAAAQQ"]
[Tue Apr 28 19:25:26.061431 2026] [:error] [pid 33777:tid 33851] [client 182.191.107.194:58688] [client 182.191.107.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.191.107.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afCZJrXUCFWqmordGGLJHwAAARA"]
[Tue Apr 28 19:25:34.873246 2026] [:error] [pid 33864:tid 33876] [client 182.191.107.194:58926] [client 182.191.107.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.191.107.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afCZLjXchLGZ4QggCskV9gAAAIo"]
[Tue Apr 28 19:25:45.298086 2026] [:error] [pid 33864:tid 33890] [client 182.191.107.194:45401] [client 182.191.107.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.191.107.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afCZOTXchLGZ4QggCskV-AAAAJg"]
[Tue Apr 28 19:25:55.940208 2026] [:error] [pid 33776:tid 33825] [client 182.191.107.194:59522] [client 182.191.107.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.191.107.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afCZQ1-bEJ2CKP3iKAAqNwAAAFE"]
[Tue Apr 28 19:26:06.338532 2026] [:error] [pid 33777:tid 33856] [client 182.191.107.194:46679] [client 182.191.107.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.191.107.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afCZTrXUCFWqmordGGLJSgAAARU"]
[Tue Apr 28 22:39:25.274583 2026] [:error] [pid 33777:tid 33840] [client 182.42.105.85:46346] [client 182.42.105.85] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afDGnbXUCFWqmordGGIV3wAAAQU"]
[Tue Apr 28 23:21:41.678321 2026] [:error] [pid 2741:tid 2766] [client 43.159.152.4:58064] [client 43.159.152.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afDQhfp92FeOz1h6ILwioQAAAVQ"]
[Wed Apr 29 00:13:31.883207 2026] [:error] [pid 33777:tid 33850] [client 40.85.240.33:24400] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tmpls.php"] [unique_id "afDcq7XUCFWqmordGGI1EQAAAQ8"]
[Wed Apr 29 00:13:34.361039 2026] [:error] [pid 33776:tid 33822] [client 40.85.240.33:52374] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tmpls.php"] [unique_id "afDcrl-bEJ2CKP3iKABWfAAAAE4"]
[Wed Apr 29 00:13:42.582952 2026] [:error] [pid 2741:tid 2763] [client 40.85.240.33:43717] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tmpls.php"] [unique_id "afDctvp92FeOz1h6ILwxmgAAAVE"]
[Wed Apr 29 00:13:44.415314 2026] [:error] [pid 33864:tid 33870] [client 40.85.240.33:24737] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tmpls.php"] [unique_id "afDcuDXchLGZ4QggCslHUQAAAIQ"]
[Wed Apr 29 00:13:50.263461 2026] [:error] [pid 2741:tid 2754] [client 40.85.240.33:41896] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/n3.php"] [unique_id "afDcvvp92FeOz1h6ILwxqAAAAUg"]
[Wed Apr 29 00:13:53.386710 2026] [:error] [pid 2741:tid 2755] [client 40.85.240.33:58582] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/n3.php"] [unique_id "afDcwfp92FeOz1h6ILwxrQAAAUk"]
[Wed Apr 29 00:13:55.654225 2026] [:error] [pid 33775:tid 33787] [client 40.85.240.33:58595] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/n3.php"] [unique_id "afDcw5sYOcoQrq88YbVIbwAAAMg"]
[Wed Apr 29 00:13:57.691293 2026] [:error] [pid 33777:tid 33858] [client 40.85.240.33:43744] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/n3.php"] [unique_id "afDcxbXUCFWqmordGGI1NQAAARc"]
[Wed Apr 29 00:13:58.860054 2026] [:error] [pid 50889:tid 50903] [client 40.85.240.33:25092] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aaa.php"] [unique_id "afDcxozszBr00txEzGh2SAAAAAs"]
[Wed Apr 29 00:14:00.067337 2026] [:error] [pid 33777:tid 33848] [client 40.85.240.33:58586] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aaa.php"] [unique_id "afDcyLXUCFWqmordGGI1OwAAAQ0"]
[Wed Apr 29 00:14:07.740047 2026] [:error] [pid 33776:tid 33831] [client 40.85.240.33:24754] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aaa.php"] [unique_id "afDcz1-bEJ2CKP3iKABWkwAAAFc"]
[Wed Apr 29 00:14:08.491012 2026] [:error] [pid 2741:tid 2765] [client 40.85.240.33:10438] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-aaa.php"] [unique_id "afDc0Pp92FeOz1h6ILwxuQAAAVM"]
[Wed Apr 29 00:14:13.914828 2026] [:error] [pid 33776:tid 33819] [client 40.85.240.33:56683] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afDc1V-bEJ2CKP3iKABWlwAAAEs"]
[Wed Apr 29 00:14:16.765812 2026] [:error] [pid 2741:tid 2769] [client 40.85.240.33:10267] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afDc2Pp92FeOz1h6ILwxxAAAAVc"]
[Wed Apr 29 00:14:19.326702 2026] [:error] [pid 2741:tid 2756] [client 40.85.240.33:51353] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afDc2_p92FeOz1h6ILwxxQAAAUo"]
[Wed Apr 29 00:14:28.402586 2026] [:error] [pid 2741:tid 2769] [client 40.85.240.33:10275] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mo.php"] [unique_id "afDc5Pp92FeOz1h6ILwxzQAAAVc"]
[Wed Apr 29 00:14:42.293336 2026] [:error] [pid 33777:tid 33844] [client 40.85.240.33:45625] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1vx.php"] [unique_id "afDc8rXUCFWqmordGGI2DQAAAQk"]
[Wed Apr 29 00:14:43.663773 2026] [:error] [pid 2741:tid 2763] [client 40.85.240.33:60687] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1vx.php"] [unique_id "afDc8_p92FeOz1h6ILwx4wAAAVE"]
[Wed Apr 29 00:14:47.816440 2026] [:error] [pid 33777:tid 33847] [client 40.85.240.33:48132] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1vx.php"] [unique_id "afDc97XUCFWqmordGGI2GgAAAQw"]
[Wed Apr 29 00:14:52.019275 2026] [:error] [pid 33864:tid 33877] [client 40.85.240.33:51833] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1vx.php"] [unique_id "afDc_DXchLGZ4QggCslHgAAAAIs"]
[Wed Apr 29 00:14:53.594978 2026] [:error] [pid 33777:tid 33841] [client 40.85.240.33:45575] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "afDc_bXUCFWqmordGGI2HAAAAQY"]
[Wed Apr 29 00:14:57.197306 2026] [:error] [pid 50889:tid 50899] [client 40.85.240.33:64542] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "afDdAYzszBr00txEzGh2hAAAAAc"]
[Wed Apr 29 00:14:59.596465 2026] [:error] [pid 33864:tid 33882] [client 40.85.240.33:62079] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "afDdAzXchLGZ4QggCslHjAAAAJA"]
[Wed Apr 29 00:15:05.411178 2026] [:error] [pid 33777:tid 33852] [client 40.85.240.33:43701] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "afDdCbXUCFWqmordGGI2KQAAARE"]
[Wed Apr 29 00:15:09.288292 2026] [:error] [pid 50889:tid 50911] [client 40.85.240.33:57906] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "afDdDYzszBr00txEzGh2qwAAABM"]
[Wed Apr 29 00:15:11.704498 2026] [:error] [pid 2741:tid 2753] [client 40.85.240.33:43683] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "afDdD_p92FeOz1h6ILwyDQAAAUc"]
[Wed Apr 29 00:15:15.199650 2026] [:error] [pid 50889:tid 50903] [client 40.85.240.33:56120] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "afDdE4zszBr00txEzGh2sAAAAAs"]
[Wed Apr 29 00:15:22.040065 2026] [:error] [pid 33777:tid 33850] [client 40.85.240.33:61954] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "afDdGrXUCFWqmordGGI2QwAAAQ8"]
[Wed Apr 29 00:15:24.259651 2026] [:error] [pid 33777:tid 33858] [client 40.85.240.33:61974] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "afDdHLXUCFWqmordGGI2RgAAARc"]
[Wed Apr 29 00:15:26.276967 2026] [:error] [pid 33777:tid 33836] [client 40.85.240.33:42443] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "afDdHrXUCFWqmordGGI2SwAAAQE"]
[Wed Apr 29 00:15:53.555055 2026] [:error] [pid 2741:tid 2764] [client 40.85.240.33:11083] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-at.php"] [unique_id "afDdOfp92FeOz1h6ILwyNgAAAVI"]
[Wed Apr 29 00:16:00.671938 2026] [:error] [pid 2741:tid 2761] [client 40.85.240.33:56186] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-at.php"] [unique_id "afDdQPp92FeOz1h6ILwyPgAAAU8"]
[Wed Apr 29 00:16:04.483342 2026] [:error] [pid 33777:tid 33846] [client 40.85.240.33:54721] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-at.php"] [unique_id "afDdRLXUCFWqmordGGI2nQAAAQs"]
[Wed Apr 29 00:16:11.099328 2026] [:error] [pid 33776:tid 33831] [client 40.85.240.33:61537] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hk.php"] [unique_id "afDdS1-bEJ2CKP3iKABW4wAAAFc"]
[Wed Apr 29 00:16:20.767324 2026] [:error] [pid 2741:tid 2759] [client 40.85.240.33:44979] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hk.php"] [unique_id "afDdVPp92FeOz1h6ILwyWwAAAU0"]
[Wed Apr 29 00:16:23.675510 2026] [:error] [pid 50889:tid 50911] [client 40.85.240.33:10376] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hk.php"] [unique_id "afDdV4zszBr00txEzGh2_gAAABM"]
[Wed Apr 29 00:16:25.740573 2026] [:error] [pid 2741:tid 2752] [client 40.85.240.33:62786] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lco.php"] [unique_id "afDdWfp92FeOz1h6ILwyYAAAAUY"]
[Wed Apr 29 00:16:27.054734 2026] [:error] [pid 33777:tid 33852] [client 40.85.240.33:42380] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lco.php"] [unique_id "afDdW7XUCFWqmordGGI28QAAARE"]
[Wed Apr 29 00:16:31.341436 2026] [:error] [pid 33777:tid 33849] [client 40.85.240.33:48778] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lco.php"] [unique_id "afDdX7XUCFWqmordGGI2-AAAAQ4"]
[Wed Apr 29 00:16:33.785926 2026] [:error] [pid 2741:tid 2754] [client 40.85.240.33:51754] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lco.php"] [unique_id "afDdYfp92FeOz1h6ILwyaAAAAUg"]
[Wed Apr 29 00:16:36.880684 2026] [:error] [pid 33775:tid 33788] [client 40.85.240.33:10741] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fun.php"] [unique_id "afDdZJsYOcoQrq88YbVIsgAAAMk"]
[Wed Apr 29 00:17:04.363334 2026] [:error] [pid 50889:tid 50896] [client 40.85.240.33:11123] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/usep.php"] [unique_id "afDdgIzszBr00txEzGh3MgAAAAQ"]
[Wed Apr 29 00:17:05.971461 2026] [:error] [pid 2741:tid 2766] [client 40.85.240.33:63265] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/usep.php"] [unique_id "afDdgfp92FeOz1h6ILwykgAAAVQ"]
[Wed Apr 29 00:17:10.306623 2026] [:error] [pid 33777:tid 33847] [client 40.85.240.33:27229] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/usep.php"] [unique_id "afDdhrXUCFWqmordGGI3VQAAAQw"]
[Wed Apr 29 00:17:23.989954 2026] [:error] [pid 50889:tid 50893] [client 40.85.240.33:27714] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "afDdk4zszBr00txEzGh3RwAAAAE"]
[Wed Apr 29 00:17:27.268563 2026] [:error] [pid 33777:tid 33852] [client 40.85.240.33:56609] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "afDdl7XUCFWqmordGGI3iwAAARE"]
[Wed Apr 29 00:17:30.147195 2026] [:error] [pid 33777:tid 33839] [client 40.85.240.33:49362] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "afDdmrXUCFWqmordGGI3lAAAAQQ"]
[Wed Apr 29 00:17:38.576058 2026] [:error] [pid 50889:tid 50895] [client 40.85.240.33:53012] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v4.php"] [unique_id "afDdoozszBr00txEzGh3YAAAAAM"]
[Wed Apr 29 00:17:40.899710 2026] [:error] [pid 50889:tid 50899] [client 40.85.240.33:25211] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v4.php"] [unique_id "afDdpIzszBr00txEzGh3ZAAAAAc"]
[Wed Apr 29 00:17:42.673665 2026] [:error] [pid 33777:tid 33857] [client 40.85.240.33:25507] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v4.php"] [unique_id "afDdprXUCFWqmordGGI31AAAARY"]
[Wed Apr 29 00:17:43.794522 2026] [:error] [pid 33776:tid 33814] [client 40.85.240.33:54018] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v4.php"] [unique_id "afDdp1-bEJ2CKP3iKABXHwAAAEY"]
[Wed Apr 29 00:17:45.468700 2026] [:error] [pid 33776:tid 33827] [client 40.85.240.33:49966] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp4.php"] [unique_id "afDdqV-bEJ2CKP3iKABXIgAAAFM"]
[Wed Apr 29 00:17:50.217712 2026] [:error] [pid 33777:tid 33856] [client 40.85.240.33:25523] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp4.php"] [unique_id "afDdrrXUCFWqmordGGI33AAAARU"]
[Wed Apr 29 00:17:52.442349 2026] [:error] [pid 33775:tid 33784] [client 40.85.240.33:24412] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp4.php"] [unique_id "afDdsJsYOcoQrq88YbVIxgAAAMU"]
[Wed Apr 29 00:18:14.753924 2026] [:error] [pid 2741:tid 2767] [client 40.85.240.33:50597] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/row.php"] [unique_id "afDdxvp92FeOz1h6ILwy8gAAAVU"]
[Wed Apr 29 00:18:19.298637 2026] [:error] [pid 33776:tid 33818] [client 40.85.240.33:24706] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/row.php"] [unique_id "afDdy1-bEJ2CKP3iKABXLwAAAEo"]
[Wed Apr 29 00:18:21.595109 2026] [:error] [pid 50889:tid 50912] [client 40.85.240.33:10346] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/row.php"] [unique_id "afDdzYzszBr00txEzGh3ggAAABQ"]
[Wed Apr 29 00:18:37.513586 2026] [:error] [pid 33777:tid 33847] [client 40.85.240.33:64583] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/555.php"] [unique_id "afDd3bXUCFWqmordGGI4DwAAAQw"]
[Wed Apr 29 00:18:43.597404 2026] [:error] [pid 50889:tid 50907] [client 40.85.240.33:57248] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/555.php"] [unique_id "afDd44zszBr00txEzGh3mAAAAA8"]
[Wed Apr 29 00:18:44.921311 2026] [:error] [pid 50889:tid 50895] [client 40.85.240.33:57969] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/555.php"] [unique_id "afDd5IzszBr00txEzGh3mQAAAAM"]
[Wed Apr 29 00:18:46.047073 2026] [:error] [pid 33864:tid 33887] [client 40.85.240.33:57923] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/555.php"] [unique_id "afDd5jXchLGZ4QggCslINQAAAJU"]
[Wed Apr 29 00:18:48.957379 2026] [:error] [pid 33776:tid 33821] [client 40.85.240.33:57937] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-conflg.php"] [unique_id "afDd6F-bEJ2CKP3iKABXNgAAAE0"]
[Wed Apr 29 00:18:49.648900 2026] [:error] [pid 33776:tid 33817] [client 40.85.240.33:51365] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-conflg.php"] [unique_id "afDd6V-bEJ2CKP3iKABXOAAAAEk"]
[Wed Apr 29 00:19:10.460138 2026] [:error] [pid 2741:tid 2768] [client 40.85.240.33:62074] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xqq.php"] [unique_id "afDd_vp92FeOz1h6ILwzFgAAAVY"]
[Wed Apr 29 00:19:12.524142 2026] [:error] [pid 33777:tid 33852] [client 40.85.240.33:62071] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xqq.php"] [unique_id "afDeALXUCFWqmordGGI4KQAAARE"]
[Wed Apr 29 00:19:25.966864 2026] [:error] [pid 33777:tid 33859] [client 40.85.240.33:48150] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/444.php"] [unique_id "afDeDbXUCFWqmordGGI4SQAAARg"]
[Wed Apr 29 00:19:37.329934 2026] [:error] [pid 33777:tid 33859] [client 40.85.240.33:64126] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/444.php"] [unique_id "afDeGbXUCFWqmordGGI4YAAAARg"]
[Wed Apr 29 00:19:47.174214 2026] [:error] [pid 33777:tid 33837] [client 40.85.240.33:11059] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bnm.php"] [unique_id "afDeI7XUCFWqmordGGI4gAAAAQI"]
[Wed Apr 29 00:19:50.860680 2026] [:error] [pid 33776:tid 33808] [client 40.85.240.33:29267] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bnm.php"] [unique_id "afDeJl-bEJ2CKP3iKABXUAAAAEA"]
[Wed Apr 29 00:19:52.837152 2026] [:error] [pid 33775:tid 33780] [client 40.85.240.33:42469] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bnm.php"] [unique_id "afDeKJsYOcoQrq88YbVI4QAAAME"]
[Wed Apr 29 00:19:55.061087 2026] [:error] [pid 50889:tid 50898] [client 40.85.240.33:11024] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bnm.php"] [unique_id "afDeK4zszBr00txEzGh4BwAAAAY"]
[Wed Apr 29 00:20:14.283175 2026] [:error] [pid 33864:tid 33883] [client 40.85.240.33:54684] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "afDePjXchLGZ4QggCslIZAAAAJE"]
[Wed Apr 29 00:20:22.733216 2026] [:error] [pid 33864:tid 33890] [client 40.85.240.33:64009] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "afDeRjXchLGZ4QggCslIbwAAAJg"]
[Wed Apr 29 00:20:24.491324 2026] [:error] [pid 33777:tid 33851] [client 40.85.240.33:64612] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "afDeSLXUCFWqmordGGI45gAAARA"]
[Wed Apr 29 00:20:38.894799 2026] [:error] [pid 33777:tid 33849] [client 40.85.240.33:60769] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "afDeVrXUCFWqmordGGI5MgAAAQ4"]
[Wed Apr 29 00:20:43.619404 2026] [:error] [pid 33864:tid 33883] [client 40.85.240.33:29186] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "afDeWzXchLGZ4QggCslIdgAAAJE"]
[Wed Apr 29 00:20:45.723953 2026] [:error] [pid 33777:tid 33835] [client 40.85.240.33:63249] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "afDeXbXUCFWqmordGGI5QgAAAQA"]
[Wed Apr 29 00:20:47.316966 2026] [:error] [pid 33777:tid 33852] [client 40.85.240.33:11133] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we2.php"] [unique_id "afDeX7XUCFWqmordGGI5SgAAARE"]
[Wed Apr 29 00:20:48.727589 2026] [:error] [pid 33777:tid 33857] [client 40.85.240.33:49991] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zicgg.php"] [unique_id "afDeYLXUCFWqmordGGI5TQAAARY"]
[Wed Apr 29 00:20:51.129890 2026] [:error] [pid 33777:tid 33841] [client 40.85.240.33:61561] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zicgg.php"] [unique_id "afDeY7XUCFWqmordGGI5VAAAAQY"]
[Wed Apr 29 00:20:53.085468 2026] [:error] [pid 33864:tid 33878] [client 40.85.240.33:45681] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zicgg.php"] [unique_id "afDeZTXchLGZ4QggCslIfgAAAIw"]
[Wed Apr 29 00:20:54.061898 2026] [:error] [pid 33776:tid 33809] [client 40.85.240.33:11192] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zicgg.php"] [unique_id "afDeZl-bEJ2CKP3iKABXbAAAAEE"]
[Wed Apr 29 00:20:55.588915 2026] [:error] [pid 33864:tid 33869] [client 40.85.240.33:10690] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pouhg.php"] [unique_id "afDeZzXchLGZ4QggCslIgwAAAIM"]
[Wed Apr 29 00:20:56.980154 2026] [:error] [pid 33775:tid 33792] [client 40.85.240.33:51765] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pouhg.php"] [unique_id "afDeaJsYOcoQrq88YbVJSAAAAM0"]
[Wed Apr 29 00:20:59.839049 2026] [:error] [pid 50889:tid 50909] [client 40.85.240.33:11194] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pouhg.php"] [unique_id "afDea4zszBr00txEzGh4RwAAABE"]
[Wed Apr 29 00:21:03.243791 2026] [:error] [pid 2741:tid 2746] [client 40.85.240.33:51747] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pouhg.php"] [unique_id "afDeb_p92FeOz1h6ILwzWwAAAUA"]
[Wed Apr 29 00:21:05.223501 2026] [:error] [pid 33777:tid 33847] [client 40.85.240.33:42426] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file88.php"] [unique_id "afDecbXUCFWqmordGGI5YwAAAQw"]
[Wed Apr 29 00:21:06.813755 2026] [:error] [pid 2741:tid 2769] [client 40.85.240.33:53110] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file88.php"] [unique_id "afDecvp92FeOz1h6ILwzYgAAAVc"]
[Wed Apr 29 00:21:08.206765 2026] [:error] [pid 50889:tid 50895] [client 40.85.240.33:53105] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file88.php"] [unique_id "afDedIzszBr00txEzGh4UAAAAAM"]
[Wed Apr 29 00:21:12.152116 2026] [:error] [pid 33777:tid 33853] [client 40.85.240.33:24361] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file88.php"] [unique_id "afDeeLXUCFWqmordGGI5dAAAARI"]
[Wed Apr 29 00:21:16.041451 2026] [:error] [pid 2741:tid 2746] [client 40.85.240.33:61491] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenon1337.php"] [unique_id "afDefPp92FeOz1h6ILwzbAAAAUA"]
[Wed Apr 29 00:21:16.841563 2026] [:error] [pid 2741:tid 2747] [client 40.85.240.33:61446] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenon1337.php"] [unique_id "afDefPp92FeOz1h6ILwzbgAAAUE"]
[Wed Apr 29 00:21:20.737189 2026] [:error] [pid 33776:tid 33819] [client 40.85.240.33:60187] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenon1337.php"] [unique_id "afDegF-bEJ2CKP3iKABXfwAAAEs"]
[Wed Apr 29 00:21:21.866479 2026] [:error] [pid 33775:tid 33796] [client 40.85.240.33:54734] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xenon1337.php"] [unique_id "afDegZsYOcoQrq88YbVJUgAAANE"]
[Wed Apr 29 00:21:27.583671 2026] [:error] [pid 2741:tid 2749] [client 40.85.240.33:60220] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1index.php"] [unique_id "afDeh_p92FeOz1h6ILwzfwAAAUM"]
[Wed Apr 29 00:21:30.696075 2026] [:error] [pid 33776:tid 33819] [client 40.85.240.33:48239] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1index.php"] [unique_id "afDeil-bEJ2CKP3iKABXiwAAAEs"]
[Wed Apr 29 00:21:31.798756 2026] [:error] [pid 2741:tid 2768] [client 40.85.240.33:61474] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1index.php"] [unique_id "afDei_p92FeOz1h6ILwzigAAAVY"]
[Wed Apr 29 00:21:55.072389 2026] [:error] [pid 33777:tid 33857] [client 40.85.240.33:26071] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shellalfa.php"] [unique_id "afDeo7XUCFWqmordGGI5twAAARY"]
[Wed Apr 29 00:21:57.066435 2026] [:error] [pid 33776:tid 33824] [client 40.85.240.33:51403] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shellalfa.php"] [unique_id "afDepV-bEJ2CKP3iKABXjgAAAFA"]
[Wed Apr 29 00:21:59.248628 2026] [:error] [pid 33864:tid 33870] [client 40.85.240.33:25199] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shellalfa.php"] [unique_id "afDepzXchLGZ4QggCslIuAAAAIQ"]
[Wed Apr 29 00:22:01.378656 2026] [:error] [pid 2741:tid 2752] [client 40.85.240.33:62782] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shellalfa.php"] [unique_id "afDeqfp92FeOz1h6ILwzogAAAUY"]
[Wed Apr 29 00:22:06.606148 2026] [:error] [pid 2741:tid 2760] [client 40.85.240.33:50012] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "afDervp92FeOz1h6ILwzpgAAAU4"]
[Wed Apr 29 00:22:08.667479 2026] [:error] [pid 33775:tid 33780] [client 40.85.240.33:25185] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "afDesJsYOcoQrq88YbVJcgAAAME"]
[Wed Apr 29 00:22:09.840088 2026] [:error] [pid 33775:tid 33800] [client 40.85.240.33:55422] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "afDesZsYOcoQrq88YbVJcwAAANU"]
[Wed Apr 29 00:22:13.765603 2026] [:error] [pid 2741:tid 2758] [client 40.85.240.33:49359] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bless11.php"] [unique_id "afDetfp92FeOz1h6ILwzqgAAAUw"]
[Wed Apr 29 00:22:15.843789 2026] [:error] [pid 50889:tid 50910] [client 40.85.240.33:24397] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmu.php"] [unique_id "afDet4zszBr00txEzGh4fQAAABI"]
[Wed Apr 29 00:22:16.871670 2026] [:error] [pid 33864:tid 33882] [client 40.85.240.33:46932] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmu.php"] [unique_id "afDeuDXchLGZ4QggCslIvwAAAJA"]
[Wed Apr 29 00:22:20.261311 2026] [:error] [pid 33777:tid 33854] [client 40.85.240.33:46956] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmu.php"] [unique_id "afDevLXUCFWqmordGGI51AAAARM"]
[Wed Apr 29 00:22:21.251318 2026] [:error] [pid 2741:tid 2761] [client 40.85.240.33:25486] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmu.php"] [unique_id "afDevfp92FeOz1h6ILwztwAAAU8"]
[Wed Apr 29 00:22:23.046551 2026] [:error] [pid 33864:tid 33887] [client 40.85.240.33:53638] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shelp.php"] [unique_id "afDevzXchLGZ4QggCslIxAAAAJU"]
[Wed Apr 29 00:22:34.579989 2026] [:error] [pid 33775:tid 33787] [client 40.85.240.33:46935] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shelp.php"] [unique_id "afDeypsYOcoQrq88YbVJggAAAMg"]
[Wed Apr 29 00:22:37.869218 2026] [:error] [pid 50889:tid 50911] [client 40.85.240.33:60777] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "afDezYzszBr00txEzGh4jQAAABM"]
[Wed Apr 29 00:22:39.343157 2026] [:error] [pid 33777:tid 33849] [client 40.85.240.33:44465] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "afDez7XUCFWqmordGGI58wAAAQ4"]
[Wed Apr 29 00:22:41.619341 2026] [:error] [pid 50889:tid 50895] [client 40.85.240.33:41860] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "afDe0YzszBr00txEzGh4kAAAAAM"]
[Wed Apr 29 00:22:43.308424 2026] [:error] [pid 33776:tid 33823] [client 40.85.240.33:41857] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "afDe01-bEJ2CKP3iKABXlwAAAE8"]
[Wed Apr 29 00:22:45.323902 2026] [:error] [pid 33864:tid 33887] [client 40.85.240.33:58529] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pucci.php"] [unique_id "afDe1TXchLGZ4QggCslI1AAAAJU"]
[Wed Apr 29 00:22:53.755966 2026] [:error] [pid 50889:tid 50912] [client 40.85.240.33:56653] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pucci.php"] [unique_id "afDe3YzszBr00txEzGh4pwAAABQ"]
[Wed Apr 29 00:23:07.113751 2026] [:error] [pid 2741:tid 2769] [client 40.85.240.33:56688] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/06.php"] [unique_id "afDe6_p92FeOz1h6ILwz_wAAAVc"]
[Wed Apr 29 00:23:20.972005 2026] [:error] [pid 33777:tid 33846] [client 40.85.240.33:64582] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/06.php"] [unique_id "afDe-LXUCFWqmordGGI6GQAAAQs"]
[Wed Apr 29 00:23:34.078439 2026] [:error] [pid 33777:tid 33836] [client 40.85.240.33:45627] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "afDfBrXUCFWqmordGGI6MAAAAQE"]
[Wed Apr 29 00:23:35.520951 2026] [:error] [pid 33776:tid 33829] [client 40.85.240.33:43681] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "afDfB1-bEJ2CKP3iKABXtwAAAFU"]
[Wed Apr 29 00:23:40.586896 2026] [:error] [pid 2741:tid 2770] [client 40.85.240.33:64563] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/owl.php"] [unique_id "afDfDPp92FeOz1h6ILw0LAAAAVg"]
[Wed Apr 29 00:23:42.176244 2026] [:error] [pid 33777:tid 33855] [client 40.85.240.33:44999] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/owl.php"] [unique_id "afDfDrXUCFWqmordGGI6OgAAARQ"]
[Wed Apr 29 00:23:45.626151 2026] [:error] [pid 33777:tid 33853] [client 40.85.240.33:64535] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/owl.php"] [unique_id "afDfEbXUCFWqmordGGI6RwAAARI"]
[Wed Apr 29 00:23:52.158981 2026] [:error] [pid 2741:tid 2764] [client 40.85.240.33:54117] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/owl.php"] [unique_id "afDfGPp92FeOz1h6ILw0QQAAAVI"]
[Wed Apr 29 00:23:59.556506 2026] [:error] [pid 33777:tid 33856] [client 40.85.240.33:54141] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hook.php"] [unique_id "afDfH7XUCFWqmordGGI6eAAAARU"]
[Wed Apr 29 00:24:02.765779 2026] [:error] [pid 33777:tid 33844] [client 40.85.240.33:64101] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hook.php"] [unique_id "afDfIrXUCFWqmordGGI6iwAAAQk"]
[Wed Apr 29 00:24:16.417174 2026] [:error] [pid 33777:tid 33836] [client 40.85.240.33:54120] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "afDfMLXUCFWqmordGGI6vgAAAQE"]
[Wed Apr 29 00:24:18.887839 2026] [:error] [pid 2741:tid 2747] [client 40.85.240.33:10934] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "afDfMvp92FeOz1h6ILw0ZgAAAUE"]
[Wed Apr 29 00:24:21.251138 2026] [:error] [pid 33775:tid 33803] [client 40.85.240.33:28498] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "afDfNZsYOcoQrq88YbVJuAAAANg"]
[Wed Apr 29 00:24:24.235491 2026] [:error] [pid 33776:tid 33811] [client 40.85.240.33:49337] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "afDfOF-bEJ2CKP3iKABXygAAAEM"]
[Wed Apr 29 00:24:26.491727 2026] [:error] [pid 33777:tid 33837] [client 40.85.240.33:10666] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid3.php"] [unique_id "afDfOrXUCFWqmordGGI60wAAAQI"]
[Wed Apr 29 00:24:36.212838 2026] [:error] [pid 33777:tid 33849] [client 40.85.240.33:47557] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid3.php"] [unique_id "afDfRLXUCFWqmordGGI64AAAAQ4"]
[Wed Apr 29 00:24:37.240058 2026] [:error] [pid 33777:tid 33855] [client 40.85.240.33:62001] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid3.php"] [unique_id "afDfRbXUCFWqmordGGI64QAAARQ"]
[Wed Apr 29 00:24:37.916783 2026] [:error] [pid 33777:tid 33844] [client 40.85.240.33:11060] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sid3.php"] [unique_id "afDfRbXUCFWqmordGGI65wAAAQk"]
[Wed Apr 29 00:24:40.678814 2026] [:error] [pid 2741:tid 2762] [client 40.85.240.33:46881] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cliner.php"] [unique_id "afDfSPp92FeOz1h6ILw0fgAAAVA"]
[Wed Apr 29 00:24:42.212685 2026] [:error] [pid 2741:tid 2758] [client 40.85.240.33:54113] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cliner.php"] [unique_id "afDfSvp92FeOz1h6ILw0gQAAAUw"]
[Wed Apr 29 00:24:43.792981 2026] [:error] [pid 2741:tid 2755] [client 40.85.240.33:44526] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-cliner.php"] [unique_id "afDfS_p92FeOz1h6ILw0hAAAAUk"]
[Wed Apr 29 00:24:55.446051 2026] [:error] [pid 50889:tid 50896] [client 40.85.240.33:55386] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3.php"] [unique_id "afDfV4zszBr00txEzGh5AwAAAAQ"]
[Wed Apr 29 00:24:57.717508 2026] [:error] [pid 33776:tid 33808] [client 40.85.240.33:46279] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3.php"] [unique_id "afDfWV-bEJ2CKP3iKABX5wAAAEA"]
[Wed Apr 29 00:24:58.921333 2026] [:error] [pid 33777:tid 33844] [client 40.85.240.33:51824] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3.php"] [unique_id "afDfWrXUCFWqmordGGI7BQAAAQk"]
[Wed Apr 29 00:25:01.059839 2026] [:error] [pid 33775:tid 33786] [client 40.85.240.33:49936] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/v3.php"] [unique_id "afDfXZsYOcoQrq88YbVJ0QAAAMc"]
[Wed Apr 29 00:25:02.472405 2026] [:error] [pid 33864:tid 33871] [client 40.85.240.33:65279] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "afDfXjXchLGZ4QggCslJHwAAAIU"]
[Wed Apr 29 00:25:04.878922 2026] [:error] [pid 33864:tid 33883] [client 40.85.240.33:46319] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "afDfYDXchLGZ4QggCslJIAAAAJE"]
[Wed Apr 29 00:25:09.929146 2026] [:error] [pid 33776:tid 33812] [client 40.85.240.33:27236] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "afDfZV-bEJ2CKP3iKABX8gAAAEQ"]
[Wed Apr 29 00:25:14.435999 2026] [:error] [pid 33777:tid 33846] [client 40.85.240.33:49345] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "afDfarXUCFWqmordGGI7IAAAAQs"]
[Wed Apr 29 00:25:32.400128 2026] [:error] [pid 50889:tid 50901] [client 40.85.240.33:27250] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wuasr.php"] [unique_id "afDffIzszBr00txEzGh5KwAAAAk"]
[Wed Apr 29 00:25:34.418125 2026] [:error] [pid 33864:tid 33875] [client 40.85.240.33:27242] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wuasr.php"] [unique_id "afDffjXchLGZ4QggCslJNgAAAIk"]
[Wed Apr 29 00:25:36.525191 2026] [:error] [pid 33864:tid 33878] [client 40.85.240.33:51838] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wuasr.php"] [unique_id "afDfgDXchLGZ4QggCslJNwAAAIw"]
[Wed Apr 29 00:25:37.747970 2026] [:error] [pid 50889:tid 50910] [client 40.85.240.33:55392] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wuasr.php"] [unique_id "afDfgYzszBr00txEzGh5MwAAABI"]
[Wed Apr 29 00:25:39.143348 2026] [:error] [pid 50889:tid 50902] [client 40.85.240.33:55406] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "afDfg4zszBr00txEzGh5NwAAAAo"]
[Wed Apr 29 00:25:44.100447 2026] [:error] [pid 50889:tid 50900] [client 40.85.240.33:27221] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "afDfiIzszBr00txEzGh5PwAAAAg"]
[Wed Apr 29 00:25:46.651614 2026] [:error] [pid 33777:tid 33840] [client 40.85.240.33:55409] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "afDfirXUCFWqmordGGI7OAAAAQU"]
[Wed Apr 29 00:25:49.070639 2026] [:error] [pid 50889:tid 50901] [client 40.85.240.33:46295] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "afDfjYzszBr00txEzGh5TAAAAAk"]
[Wed Apr 29 00:25:50.044491 2026] [:error] [pid 50889:tid 50907] [client 40.85.240.33:26615] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sko.php"] [unique_id "afDfjozszBr00txEzGh5TwAAAA8"]
[Wed Apr 29 00:25:51.776964 2026] [:error] [pid 33776:tid 33816] [client 40.85.240.33:49920] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sko.php"] [unique_id "afDfj1-bEJ2CKP3iKABYCQAAAEg"]
[Wed Apr 29 00:25:55.298952 2026] [:error] [pid 33864:tid 33885] [client 40.85.240.33:65221] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sko.php"] [unique_id "afDfkzXchLGZ4QggCslJQwAAAJM"]
[Wed Apr 29 00:25:56.412798 2026] [:error] [pid 33775:tid 33786] [client 40.85.240.33:49931] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sko.php"] [unique_id "afDflJsYOcoQrq88YbVJ6wAAAMc"]
[Wed Apr 29 00:25:57.377612 2026] [:error] [pid 33776:tid 33824] [client 40.85.240.33:40482] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "afDflV-bEJ2CKP3iKABYDAAAAFA"]
[Wed Apr 29 00:25:58.893002 2026] [:error] [pid 33775:tid 33796] [client 40.85.240.33:28428] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "afDflpsYOcoQrq88YbVJ7AAAANE"]
[Wed Apr 29 00:26:01.063310 2026] [:error] [pid 33776:tid 33822] [client 40.85.240.33:27256] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "afDfmV-bEJ2CKP3iKABYDwAAAE4"]
[Wed Apr 29 00:26:04.379482 2026] [:error] [pid 33775:tid 33802] [client 40.85.240.33:54739] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "afDfnJsYOcoQrq88YbVJ7gAAANc"]
[Wed Apr 29 00:26:13.971458 2026] [:error] [pid 50889:tid 50899] [client 40.85.240.33:51440] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myfile.php"] [unique_id "afDfpYzszBr00txEzGh5fAAAAAc"]
[Wed Apr 29 00:26:18.481825 2026] [:error] [pid 33777:tid 33843] [client 40.85.240.33:48796] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/myfile.php"] [unique_id "afDfqrXUCFWqmordGGI7VQAAAQg"]
[Wed Apr 29 00:26:20.677533 2026] [:error] [pid 33864:tid 33876] [client 40.85.240.33:10370] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fileas.php"] [unique_id "afDfrDXchLGZ4QggCslJSgAAAIo"]
[Wed Apr 29 00:26:21.770851 2026] [:error] [pid 33864:tid 33888] [client 40.85.240.33:11170] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fileas.php"] [unique_id "afDfrTXchLGZ4QggCslJSwAAAJY"]
[Wed Apr 29 00:26:23.210959 2026] [:error] [pid 33777:tid 33851] [client 40.85.240.33:10588] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fileas.php"] [unique_id "afDfr7XUCFWqmordGGI7XAAAARA"]
[Wed Apr 29 00:26:24.684221 2026] [:error] [pid 33776:tid 33827] [client 40.85.240.33:11194] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fileas.php"] [unique_id "afDfsF-bEJ2CKP3iKABYEwAAAFM"]
[Wed Apr 29 00:26:26.652487 2026] [:error] [pid 33864:tid 33889] [client 40.85.240.33:54672] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/system.php"] [unique_id "afDfsjXchLGZ4QggCslJTwAAAJc"]
[Wed Apr 29 00:26:42.700140 2026] [:error] [pid 33777:tid 33858] [client 40.85.240.33:10856] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/packed.php"] [unique_id "afDfwrXUCFWqmordGGI7yQAAARc"]
[Wed Apr 29 00:26:44.018274 2026] [:error] [pid 33777:tid 33859] [client 40.85.240.33:11182] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/packed.php"] [unique_id "afDfxLXUCFWqmordGGI7ywAAARg"]
[Wed Apr 29 00:26:45.522781 2026] [:error] [pid 50889:tid 50908] [client 40.85.240.33:61450] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/packed.php"] [unique_id "afDfxYzszBr00txEzGh5igAAABA"]
[Wed Apr 29 00:26:48.935023 2026] [:error] [pid 33775:tid 33798] [client 40.85.240.33:62745] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/packed.php"] [unique_id "afDfyJsYOcoQrq88YbVKGQAAANM"]
[Wed Apr 29 00:26:51.407440 2026] [:error] [pid 2741:tid 2769] [client 40.85.240.33:47511] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "afDfy_p92FeOz1h6ILw05QAAAVc"]
[Wed Apr 29 00:26:53.999033 2026] [:error] [pid 2741:tid 2766] [client 40.85.240.33:63262] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "afDfzfp92FeOz1h6ILw05wAAAVQ"]
[Wed Apr 29 00:26:55.132919 2026] [:error] [pid 2741:tid 2753] [client 40.85.240.33:48231] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "afDfz_p92FeOz1h6ILw06AAAAUc"]
[Wed Apr 29 00:27:06.209166 2026] [:error] [pid 33864:tid 33890] [client 40.85.240.33:11079] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccu.php"] [unique_id "afDf2jXchLGZ4QggCslJcQAAAJg"]
[Wed Apr 29 00:27:07.272291 2026] [:error] [pid 50889:tid 50896] [client 40.85.240.33:29208] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccu.php"] [unique_id "afDf24zszBr00txEzGh5jgAAAAQ"]
[Wed Apr 29 00:27:12.215024 2026] [:error] [pid 33777:tid 33842] [client 40.85.240.33:44476] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccu.php"] [unique_id "afDf4LXUCFWqmordGGI73QAAAQc"]
[Wed Apr 29 00:27:14.305138 2026] [:error] [pid 2741:tid 2766] [client 40.85.240.33:41900] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccu.php"] [unique_id "afDf4vp92FeOz1h6ILw08AAAAVQ"]
[Wed Apr 29 00:27:15.218496 2026] [:error] [pid 33777:tid 33855] [client 40.85.240.33:57305] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ffile.php"] [unique_id "afDf47XUCFWqmordGGI74QAAARQ"]
[Wed Apr 29 00:27:16.647898 2026] [:error] [pid 2741:tid 2763] [client 40.85.240.33:44463] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ffile.php"] [unique_id "afDf5Pp92FeOz1h6ILw09AAAAVE"]
[Wed Apr 29 00:27:17.919188 2026] [:error] [pid 50889:tid 50894] [client 40.85.240.33:57285] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ffile.php"] [unique_id "afDf5YzszBr00txEzGh5lgAAAAI"]
[Wed Apr 29 00:27:26.073810 2026] [:error] [pid 33775:tid 33799] [client 40.85.240.33:57333] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ffile.php"] [unique_id "afDf7psYOcoQrq88YbVKIwAAANQ"]
[Wed Apr 29 00:27:31.378046 2026] [:error] [pid 33777:tid 33858] [client 40.85.240.33:10245] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.1.php"] [unique_id "afDf87XUCFWqmordGGI7-AAAARc"]
[Wed Apr 29 00:27:35.825765 2026] [:error] [pid 33864:tid 33881] [client 40.85.240.33:53693] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.1.php"] [unique_id "afDf9zXchLGZ4QggCslJdwAAAI8"]
[Wed Apr 29 00:27:38.191186 2026] [:error] [pid 33864:tid 33871] [client 40.85.240.33:25998] [client 40.85.240.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.1.php"] [unique_id "afDf-jXchLGZ4QggCslJeAAAAIU"]
[Wed Apr 29 03:58:58.587146 2026] [:error] [pid 56755:tid 56773] [client 77.162.214.240:50890] [client 77.162.214.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.162.214.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afERgvdXjiwtyGfj4lw-TAAAAAk"]
[Wed Apr 29 04:00:32.647965 2026] [:error] [pid 56756:tid 56792] [client 77.162.214.240:54144] [client 77.162.214.240] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afER4HDi78vq-l2wwMz_oQAAAEA"]
[Wed Apr 29 04:01:00.563587 2026] [:error] [pid 56757:tid 56843] [client 77.162.214.240:54881] [client 77.162.214.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.162.214.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afER_Pj76quHaaG1miSDbAAAAJg"]
[Wed Apr 29 04:01:30.544503 2026] [:error] [pid 56757:tid 56842] [client 77.162.214.240:55626] [client 77.162.214.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.162.214.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afESGvj76quHaaG1miSDdwAAAJc"]
[Wed Apr 29 04:01:58.522348 2026] [:error] [pid 56756:tid 56800] [client 77.162.214.240:56290] [client 77.162.214.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.162.214.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afESNnDi78vq-l2wwMz_2QAAAEg"]
[Wed Apr 29 04:02:26.391115 2026] [:error] [pid 56863:tid 56886] [client 77.162.214.240:56930] [client 77.162.214.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.162.214.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afESUmQQTEnvYCOsiwK-DwAAANU"]
[Wed Apr 29 04:41:29.078445 2026] [:error] [pid 26594:tid 26609] [client 104.207.40.120:29065] [client 104.207.40.120] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.expressinteriors.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/s3cmd.ini"] [unique_id "afEbeds-37Kay1vO52knKgAAAQ0"]
[Wed Apr 29 04:43:45.444936 2026] [:error] [pid 56863:tid 56874] [client 20.12.211.211:1616] [client 20.12.211.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "afEcAWQQTEnvYCOsiwLHgwAAAMk"]
[Wed Apr 29 04:43:49.876351 2026] [:error] [pid 26594:tid 26619] [client 20.12.211.211:1459] [client 20.12.211.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "afEcBds-37Kay1vO52knlAAAARc"]
[Wed Apr 29 04:43:53.146173 2026] [:error] [pid 56757:tid 56828] [client 20.12.211.211:1468] [client 20.12.211.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "afEcCfj76quHaaG1miSKGAAAAIk"]
[Wed Apr 29 04:43:57.794503 2026] [:error] [pid 56757:tid 56837] [client 20.12.211.211:1448] [client 20.12.211.211] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "afEcDfj76quHaaG1miSKGwAAAJI"]
[Wed Apr 29 05:01:06.167309 2026] [:error] [pid 26594:tid 26618] [client 125.94.144.102:56953] [client 125.94.144.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afEgEts-37Kay1vO52kruQAAARY"]
[Wed Apr 29 05:48:33.082724 2026] [:error] [pid 40343:tid 40352] [client 194.26.192.146:62771] [client 194.26.192.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "afErMWiaWCZjSxz2ZNtlXwAAAYU"]
[Wed Apr 29 05:48:33.599967 2026] [:error] [pid 40343:tid 40363] [client 194.26.192.146:62790] [client 194.26.192.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "afErMWiaWCZjSxz2ZNtlYQAAAY8"]
[Wed Apr 29 05:48:34.115115 2026] [:error] [pid 56863:tid 56887] [client 194.26.192.146:62811] [client 194.26.192.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "afErMmQQTEnvYCOsiwLSngAAANY"]
[Wed Apr 29 05:48:36.207616 2026] [:error] [pid 26594:tid 26610] [client 194.26.192.146:62897] [client 194.26.192.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "afErNNs-37Kay1vO52kxhgAAAQ4"]
[Wed Apr 29 10:08:58.996408 2026] [:error] [pid 52292:tid 52330] [client 43.166.255.102:45970] [client 43.166.255.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afFoOhq6POOrkcVw80veJQAAAIg"]
[Wed Apr 29 10:41:33.328039 2026] [:error] [pid 61540:tid 61595] [client 49.144.197.220:25266] [client 49.144.197.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.144.197.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afFv3eQ8cJB7pQslzIeckAAAAJY"]
[Wed Apr 29 10:41:43.843958 2026] [:error] [pid 61628:tid 61657] [client 49.144.197.220:21570] [client 49.144.197.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.144.197.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afFv5_XzdLVcrP-YPZgOqgAAANg"]
[Wed Apr 29 10:41:54.416778 2026] [:error] [pid 61541:tid 61601] [client 49.144.197.220:21872] [client 49.144.197.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.144.197.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afFv8loqNK1GZvjPpy5YhAAAAgE"]
[Wed Apr 29 10:42:05.069318 2026] [:error] [pid 61628:tid 61646] [client 49.144.197.220:22176] [client 49.144.197.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.144.197.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afFv_fXzdLVcrP-YPZgOxQAAAM0"]
[Wed Apr 29 10:42:15.705006 2026] [:error] [pid 61539:tid 61566] [client 49.144.197.220:22498] [client 49.144.197.220] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.144.197.220, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afFwB13XmLvOLqFtXVElEwAAABc"]
[Wed Apr 29 11:24:39.268904 2026] [:error] [pid 61628:tid 61635] [client 194.26.192.146:52735] [client 194.26.192.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "afF59_XzdLVcrP-YPZgYwAAAAMI"]
[Wed Apr 29 11:24:39.847787 2026] [:error] [pid 61628:tid 61637] [client 194.26.192.146:62705] [client 194.26.192.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "afF59_XzdLVcrP-YPZgYwgAAAMQ"]
[Wed Apr 29 11:24:40.457305 2026] [:error] [pid 2604:tid 2612] [client 194.26.192.146:52582] [client 194.26.192.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "afF5-Bx5WQMU1W68tTb8bwAAAEY"]
[Wed Apr 29 11:24:42.732443 2026] [:error] [pid 2604:tid 2606] [client 194.26.192.146:62000] [client 194.26.192.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "afF5-hx5WQMU1W68tTb8dQAAAEA"]
[Wed Apr 29 13:40:47.484675 2026] [:error] [pid 44860:tid 44879] [client 43.159.57.144:36662] [client 43.159.57.144] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afGZ30Q82el2g7ESJ152qwAAAlE"]
[Wed Apr 29 14:11:34.825500 2026] [:error] [pid 44860:tid 44871] [client 49.234.192.248:49712] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afGhFkQ82el2g7ESJ1558gAAAkk"]
[Wed Apr 29 15:19:38.549512 2026] [:error] [pid 61628:tid 61639] [client 43.130.72.150:47288] [client 43.130.72.150] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afGxCvXzdLVcrP-YPZg-twAAAMY"]
[Wed Apr 29 15:35:43.644519 2026] [:error] [pid 45054:tid 45064] [client 45.119.85.39:49279] [client 45.119.85.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.119.85.39, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-login.php"] [unique_id "afG0z4tL6SUL31r23c-jSQAAAog"], referer: https://www.google.com
[Wed Apr 29 15:35:43.644519 2026] [:error] [pid 45054:tid 45064] [client 45.119.85.39:49279] [client 45.119.85.39] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 45.119.85.39 on wp-login.php, counter = 124"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-login.php"] [unique_id "afG0z4tL6SUL31r23c-jSQAAAog"], referer: https://www.google.com
[Wed Apr 29 16:02:04.205421 2026] [:error] [pid 45085:tid 45096] [client 119.156.90.57:51982] [client 119.156.90.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 119.156.90.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afG6_NS7eNjgd8gD6Zz4JgAAAsk"]
[Wed Apr 29 16:02:14.273375 2026] [:error] [pid 2604:tid 2613] [client 119.156.90.57:52213] [client 119.156.90.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 119.156.90.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afG7Bhx5WQMU1W68tTYlAgAAAEc"]
[Wed Apr 29 16:02:24.674497 2026] [:error] [pid 61540:tid 61579] [client 119.156.90.57:52566] [client 119.156.90.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 119.156.90.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afG7EOQ8cJB7pQslzIfYfQAAAIY"]
[Wed Apr 29 16:02:35.169637 2026] [:error] [pid 22901:tid 22922] [client 119.156.90.57:52845] [client 119.156.90.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 119.156.90.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afG7GxvfVEXI-f42iRRRfAAAARM"]
[Wed Apr 29 16:02:45.760193 2026] [:error] [pid 44860:tid 44864] [client 119.156.90.57:53105] [client 119.156.90.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 119.156.90.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afG7JUQ82el2g7ESJ16KjAAAAkI"]
[Wed Apr 29 18:11:06.431779 2026] [:error] [pid 45085:tid 45110] [client 43.166.134.47:60430] [client 43.166.134.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afHZOtS7eNjgd8gD6ZwNrQAAAtc"]
[Wed Apr 29 20:07:43.938979 2026] [:error] [pid 21136:tid 21151] [client 43.130.131.18:48552] [client 43.130.131.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afH0jylIfGGQdPVv8_PgBAAAAEo"]
[Wed Apr 29 21:41:15.040025 2026] [:error] [pid 21137:tid 21193] [client 136.118.172.182:20881] [client 136.118.172.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.118.172.182, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afIKe_w-HnaioFPIurVieQAAABg"]
[Wed Apr 29 22:09:07.756914 2026] [:error] [pid 21138:tid 21210] [client 178.165.160.155:6305] [client 178.165.160.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.165.160.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afIRA5uzwUiyMeUnp335lQAAAQ0"]
[Wed Apr 29 22:11:41.597301 2026] [:error] [pid 21138:tid 21211] [client 178.165.160.155:5000] [client 178.165.160.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.165.160.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afIRnZuzwUiyMeUnp336cwAAAQ4"]
[Wed Apr 29 22:12:51.771925 2026] [:error] [pid 21137:tid 21186] [client 178.165.160.155:4048] [client 178.165.160.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.165.160.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afIR4_w-HnaioFPIurVp3wAAABE"]
[Wed Apr 29 22:13:15.022766 2026] [:error] [pid 21138:tid 21215] [client 178.165.160.155:5024] [client 178.165.160.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.165.160.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afIR-5uzwUiyMeUnp3369QAAARI"]
[Wed Apr 29 22:13:40.153710 2026] [:error] [pid 21138:tid 21208] [client 178.165.160.155:4904] [client 178.165.160.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.165.160.155, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afISFJuzwUiyMeUnp337AwAAAQs"]
[Wed Apr 29 23:17:17.954100 2026] [:error] [pid 21138:tid 21207] [client 43.167.241.46:55380] [client 43.167.241.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afIg_ZuzwUiyMeUnp30JngAAAQo"]
[Thu Apr 30 01:32:12.119154 2026] [:error] [pid 21137:tid 21172] [client 43.156.228.27:44678] [client 43.156.228.27] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afJAnPw-HnaioFPIurWRIQAAAAM"]
[Thu Apr 30 02:36:05.002046 2026] [:error] [pid 47618:tid 47625] [client 51.12.91.158:18250] [client 51.12.91.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "afJPlXHYUSxIrhce2OBVMwAAAUQ"]
[Thu Apr 30 02:36:06.104876 2026] [:error] [pid 21137:tid 21173] [client 51.12.91.158:12854] [client 51.12.91.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "afJPlvw-HnaioFPIurWj2AAAAAQ"]
[Thu Apr 30 02:36:07.172493 2026] [:error] [pid 21137:tid 21192] [client 51.12.91.158:1319] [client 51.12.91.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "afJPl_w-HnaioFPIurWj2gAAABc"]
[Thu Apr 30 02:36:08.283518 2026] [:error] [pid 21137:tid 21175] [client 51.12.91.158:1314] [client 51.12.91.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "afJPmPw-HnaioFPIurWj3AAAAAY"]
[Thu Apr 30 03:22:53.760034 2026] [:error] [pid 21136:tid 21163] [client 49.234.192.248:44674] [client 49.234.192.248] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afJajSlIfGGQdPVv8_MJWQAAAFY"]
[Thu Apr 30 05:36:21.170370 2026] [:error] [pid 52436:tid 52440] [client 43.157.168.43:48568] [client 43.157.168.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afJ51QLFWPk_P7AfE8ffZgAAAUE"]
[Thu Apr 30 08:20:11.354084 2026] [:error] [pid 18220:tid 18231] [client 43.130.15.147:42318] [client 43.130.15.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afKgO8yESVSfAPebmxYAuAAAAMg"]
[Thu Apr 30 08:37:19.228056 2026] [:error] [pid 52436:tid 52462] [client 188.166.176.171:49635] [client 188.166.176.171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/db_backup.sql"] [unique_id "afKkPwLFWPk_P7AfE8cBSgAAAVc"]
[Thu Apr 30 08:37:19.229775 2026] [:error] [pid 52436:tid 52450] [client 188.166.176.171:49636] [client 188.166.176.171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/1.sql"] [unique_id "afKkPwLFWPk_P7AfE8cBSwAAAUs"]
[Thu Apr 30 08:37:19.231315 2026] [:error] [pid 53641:tid 53674] [client 188.166.176.171:49642] [client 188.166.176.171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/database.sql"] [unique_id "afKkP2C119wja3QGeAF6igAAAZY"]
[Thu Apr 30 08:37:19.231420 2026] [:error] [pid 53641:tid 53666] [client 188.166.176.171:49638] [client 188.166.176.171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/backup.sql"] [unique_id "afKkP2C119wja3QGeAF6iQAAAY4"]
[Thu Apr 30 08:37:19.231703 2026] [:error] [pid 18111:tid 18145] [client 188.166.176.171:49639] [client 188.166.176.171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".com_db.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/expressinteriors.com_db.sql"] [unique_id "afKkP2ctLbxB7Q1_oK2a8gAAABc"]
[Thu Apr 30 08:37:19.232738 2026] [:error] [pid 18111:tid 18125] [client 188.166.176.171:49641] [client 188.166.176.171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/mysqldump.sql"] [unique_id "afKkP2ctLbxB7Q1_oK2a9gAAAAM"]
[Thu Apr 30 08:37:19.232783 2026] [:error] [pid 18111:tid 18146] [client 188.166.176.171:49645] [client 188.166.176.171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/data.sql"] [unique_id "afKkP2ctLbxB7Q1_oK2a8wAAABg"]
[Thu Apr 30 08:37:19.233139 2026] [:error] [pid 18111:tid 18136] [client 188.166.176.171:49646] [client 188.166.176.171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/sql.sql"] [unique_id "afKkP2ctLbxB7Q1_oK2a9wAAAA4"]
[Thu Apr 30 08:37:19.233388 2026] [:error] [pid 52350:tid 52377] [client 188.166.176.171:49644] [client 188.166.176.171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/site.sql"] [unique_id "afKkP_1j4GHE9hm7bfddwwAAARM"]
[Thu Apr 30 08:37:19.233405 2026] [:error] [pid 18111:tid 18140] [client 188.166.176.171:49640] [client 188.166.176.171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/localhost.sql"] [unique_id "afKkP2ctLbxB7Q1_oK2a9AAAABI"]
[Thu Apr 30 08:37:19.233405 2026] [:error] [pid 18111:tid 18122] [client 188.166.176.171:49643] [client 188.166.176.171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/mysql.sql"] [unique_id "afKkP2ctLbxB7Q1_oK2a9QAAAAA"]
[Thu Apr 30 08:37:19.238327 2026] [:error] [pid 18111:tid 18133] [client 188.166.176.171:49647] [client 188.166.176.171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/dump.sql"] [unique_id "afKkP2ctLbxB7Q1_oK2a-AAAAAs"]
[Thu Apr 30 08:37:19.238557 2026] [:error] [pid 18111:tid 18130] [client 188.166.176.171:49655] [client 188.166.176.171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/expressinteriors.com.sql"] [unique_id "afKkP2ctLbxB7Q1_oK2a-QAAAAg"]
[Thu Apr 30 08:37:19.239088 2026] [:error] [pid 18111:tid 18134] [client 188.166.176.171:49656] [client 188.166.176.171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/db.sql"] [unique_id "afKkP2ctLbxB7Q1_oK2a-gAAAAw"]
[Thu Apr 30 08:37:19.239448 2026] [:error] [pid 18111:tid 18138] [client 188.166.176.171:49651] [client 188.166.176.171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/users.sql"] [unique_id "afKkP2ctLbxB7Q1_oK2a_AAAABA"]
[Thu Apr 30 08:37:19.239544 2026] [:error] [pid 18111:tid 18124] [client 188.166.176.171:49653] [client 188.166.176.171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/www.sql"] [unique_id "afKkP2ctLbxB7Q1_oK2a-wAAAAI"]
[Thu Apr 30 08:37:19.240026 2026] [:error] [pid 18111:tid 18126] [client 188.166.176.171:49654] [client 188.166.176.171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/dump.sql"] [unique_id "afKkP2ctLbxB7Q1_oK2a_QAAAAQ"]
[Thu Apr 30 08:37:19.240446 2026] [:error] [pid 18111:tid 18129] [client 188.166.176.171:49649] [client 188.166.176.171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/translate.sql"] [unique_id "afKkP2ctLbxB7Q1_oK2a_wAAAAc"]
[Thu Apr 30 08:37:19.240775 2026] [:error] [pid 18111:tid 18144] [client 188.166.176.171:49650] [client 188.166.176.171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/wp-content/mysql.sql"] [unique_id "afKkP2ctLbxB7Q1_oK2bAAAAABY"]
[Thu Apr 30 08:37:19.241507 2026] [:error] [pid 18111:tid 18142] [client 188.166.176.171:49648] [client 188.166.176.171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/temp.sql"] [unique_id "afKkP2ctLbxB7Q1_oK2bAQAAABQ"]
[Thu Apr 30 08:37:19.241642 2026] [:error] [pid 18111:tid 18141] [client 188.166.176.171:49652] [client 188.166.176.171] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/dbdump.sql"] [unique_id "afKkP2ctLbxB7Q1_oK2a_gAAABM"]
[Thu Apr 30 09:18:21.771725 2026] [:error] [pid 18111:tid 18140] [client 51.12.91.158:19742] [client 51.12.91.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/randkeyword.php7"] [unique_id "afKt3WctLbxB7Q1_oK2o4wAAABI"]
[Thu Apr 30 09:18:22.907849 2026] [:error] [pid 18111:tid 18141] [client 51.12.91.158:14532] [client 51.12.91.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/randkeyword.php7"] [unique_id "afKt3mctLbxB7Q1_oK2o5AAAABM"]
[Thu Apr 30 09:18:24.033458 2026] [:error] [pid 18112:tid 18163] [client 51.12.91.158:17514] [client 51.12.91.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/randkeyword.php7"] [unique_id "afKt4CUrJv3y8j6Lm1vH8gAAAE0"]
[Thu Apr 30 09:18:25.200795 2026] [:error] [pid 52350:tid 52381] [client 51.12.91.158:13674] [client 51.12.91.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/randkeyword.php7"] [unique_id "afKt4f1j4GHE9hm7bfdjjwAAARc"]
[Thu Apr 30 09:38:59.446323 2026] [:error] [pid 52350:tid 52362] [client 165.227.224.86:63406] [client 165.227.224.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.224.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "afKys_1j4GHE9hm7bfdmnAAAAQQ"], referer: https://wordpress.org/
[Thu Apr 30 09:39:32.426818 2026] [:error] [pid 18111:tid 18123] [client 165.227.224.86:50427] [client 165.227.224.86] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afKy1GctLbxB7Q1_oK2wFAAAAAE"], referer: https://t.co/
[Thu Apr 30 09:39:36.215939 2026] [:error] [pid 18111:tid 18134] [client 165.227.224.86:50427] [client 165.227.224.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.224.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "afKy2GctLbxB7Q1_oK2wIQAAAAw"], referer: https://expressinteriors.com/wp-login.php
[Thu Apr 30 09:39:37.884831 2026] [:error] [pid 18111:tid 18122] [client 165.227.224.86:50427] [client 165.227.224.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.224.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "afKy2WctLbxB7Q1_oK2wJwAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Thu Apr 30 09:39:38.669422 2026] [:error] [pid 18111:tid 18124] [client 165.227.224.86:50427] [client 165.227.224.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.224.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "afKy2mctLbxB7Q1_oK2wKgAAAAI"], referer: https://expressinteriors.com/wp-login.php
[Thu Apr 30 09:39:40.208757 2026] [:error] [pid 18111:tid 18128] [client 165.227.224.86:50427] [client 165.227.224.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.224.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "afKy3GctLbxB7Q1_oK2wLQAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Thu Apr 30 09:39:40.943166 2026] [:error] [pid 18111:tid 18140] [client 165.227.224.86:50427] [client 165.227.224.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.224.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "afKy3GctLbxB7Q1_oK2wLgAAABI"], referer: https://expressinteriors.com/wp-login.php
[Thu Apr 30 09:39:42.453429 2026] [:error] [pid 18111:tid 18143] [client 165.227.224.86:50427] [client 165.227.224.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 165.227.224.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "afKy3mctLbxB7Q1_oK2wMQAAABU"], referer: https://expressinteriors.com/wp-login.php
[Thu Apr 30 11:59:38.909056 2026] [:error] [pid 18111:tid 18124] [client 91.132.135.16:47638] [client 91.132.135.16] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.expressinteriors.com|F|2"] [data "TX:0=video/x-ms-wmv"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afLTqmctLbxB7Q1_oK3howAAAAI"]
[Thu Apr 30 12:02:31.109211 2026] [:error] [pid 18111:tid 18135] [client 43.166.244.192:39898] [client 43.166.244.192] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afLUV2ctLbxB7Q1_oK3i8QAAAA0"]
[Thu Apr 30 13:15:55.490098 2026] [:error] [pid 18112:tid 18172] [client 109.205.208.238:55825] [client 109.205.208.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.205.208.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afLliyUrJv3y8j6Lm1vwDAAAAFY"]
[Thu Apr 30 13:16:04.823569 2026] [:error] [pid 53641:tid 53657] [client 109.205.208.238:56095] [client 109.205.208.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.205.208.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afLllGC119wja3QGeAG50wAAAYU"]
[Thu Apr 30 13:16:14.792779 2026] [:error] [pid 52436:tid 52446] [client 109.205.208.238:56389] [client 109.205.208.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.205.208.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afLlngLFWPk_P7AfE8ca7AAAAUc"]
[Thu Apr 30 13:16:24.749426 2026] [:error] [pid 52436:tid 52450] [client 109.205.208.238:56681] [client 109.205.208.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.205.208.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afLlqALFWPk_P7AfE8ca8QAAAUs"]
[Thu Apr 30 13:16:34.660480 2026] [:error] [pid 52350:tid 52357] [client 109.205.208.238:56978] [client 109.205.208.238] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.205.208.238, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afLlsv1j4GHE9hm7bfeBkwAAAQA"]
[Thu Apr 30 14:11:47.963702 2026] [:error] [pid 18111:tid 18131] [client 79.21.180.213:62079] [client 79.21.180.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.21.180.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afLyo2ctLbxB7Q1_oK0UUgAAAAk"]
[Thu Apr 30 14:11:58.037492 2026] [:error] [pid 53641:tid 53671] [client 79.21.180.213:62507] [client 79.21.180.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.21.180.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afLyrmC119wja3QGeAHJpQAAAZM"]
[Thu Apr 30 14:12:08.643427 2026] [:error] [pid 18111:tid 18146] [client 79.21.180.213:62853] [client 79.21.180.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.21.180.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afLyuGctLbxB7Q1_oK0UXgAAABg"]
[Thu Apr 30 14:12:19.354361 2026] [:error] [pid 18111:tid 18124] [client 79.21.180.213:63202] [client 79.21.180.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.21.180.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afLyw2ctLbxB7Q1_oK0UawAAAAI"]
[Thu Apr 30 14:12:29.808140 2026] [:error] [pid 18113:tid 18180] [client 79.21.180.213:63558] [client 79.21.180.213] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.21.180.213, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afLyzXiIjwsVGkvz5Il_jQAAAIM"]
[Thu Apr 30 14:35:53.987243 2026] [:error] [pid 53641:tid 53663] [client 146.56.197.150:33828] [client 146.56.197.150] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afL4SWC119wja3QGeAHRWQAAAYs"]
[Thu Apr 30 14:53:06.377870 2026] [:error] [pid 53641:tid 53661] [client 43.135.134.127:43426] [client 43.135.134.127] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afL8UmC119wja3QGeAHUvgAAAYk"]
[Thu Apr 30 16:32:26.968006 2026] [:error] [pid 40003:tid 40016] [client 117.212.172.180:55716] [client 117.212.172.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.212.172.180, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afMTmjIyJ-Orl-2KA1K9pAAAAMo"]
[Thu Apr 30 16:39:33.567387 2026] [:error] [pid 39912:tid 39973] [client 35.169.119.108:31888] [client 35.169.119.108] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "afMVRa8-s8fTICYp_ct7PQAAAII"]
[Thu Apr 30 17:33:18.717341 2026] [:error] [pid 46062:tid 46077] [client 118.91.191.168:60984] [client 118.91.191.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.91.191.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afMh3o67WLjbPQfxr6zYJAAAAQw"]
[Thu Apr 30 17:33:26.966131 2026] [:error] [pid 46062:tid 46075] [client 118.91.191.168:61312] [client 118.91.191.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.91.191.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afMh5o67WLjbPQfxr6zYKwAAAQo"]
[Thu Apr 30 17:33:37.253909 2026] [:error] [pid 39912:tid 39972] [client 118.91.191.168:61615] [client 118.91.191.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.91.191.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afMh8a8-s8fTICYp_cuHMQAAAIE"]
[Thu Apr 30 17:33:47.997005 2026] [:error] [pid 46062:tid 46076] [client 118.91.191.168:61922] [client 118.91.191.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.91.191.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afMh-467WLjbPQfxr6zYRgAAAQs"]
[Thu Apr 30 17:33:58.055716 2026] [:error] [pid 40003:tid 40021] [client 118.91.191.168:62234] [client 118.91.191.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.91.191.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afMiBjIyJ-Orl-2KA1LTzQAAAM8"]
[Thu Apr 30 17:34:08.107220 2026] [:error] [pid 40003:tid 40022] [client 118.91.191.168:62541] [client 118.91.191.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.91.191.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afMiEDIyJ-Orl-2KA1LT2wAAANA"]
[Thu Apr 30 19:43:52.704437 2026] [:error] [pid 5733:tid 5802] [client 43.159.139.164:35422] [client 43.159.139.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afNAePT55_Ioa9J2OpLoAgAAAQw"]
[Thu Apr 30 21:48:16.312805 2026] [:error] [pid 5733:tid 5806] [client 78.29.52.101:60466] [client 78.29.52.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.29.52.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afNdoPT55_Ioa9J2OpL4wgAAARA"]
[Thu Apr 30 21:48:26.024874 2026] [:error] [pid 5733:tid 5808] [client 78.29.52.101:60816] [client 78.29.52.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.29.52.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afNdqvT55_Ioa9J2OpL40QAAARI"]
[Thu Apr 30 21:48:36.384429 2026] [:error] [pid 5820:tid 5840] [client 78.29.52.101:61175] [client 78.29.52.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.29.52.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afNdtAyrLh3-LgH3Xv9bTQAAABI"]
[Thu Apr 30 21:48:46.776987 2026] [:error] [pid 5820:tid 5824] [client 78.29.52.101:61526] [client 78.29.52.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.29.52.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afNdvgyrLh3-LgH3Xv9bVgAAAAI"]
[Thu Apr 30 21:48:57.226293 2026] [:error] [pid 5732:tid 5772] [client 78.29.52.101:61877] [client 78.29.52.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.29.52.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afNdyduJ3iSd5GdjqlhKmAAAAMk"]
[Thu Apr 30 22:05:57.321500 2026] [autoindex:error] [pid 5820:tid 5841] [client 80.241.213.248:58694] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri May 01 00:35:52.739653 2026] [:error] [pid 6456:tid 6473] [client 43.165.174.53:35410] [client 43.165.174.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afOE6EOBwsDodnkJK5ybggAAAE8"]
[Fri May 01 01:51:47.556008 2026] [:error] [pid 47620:tid 47652] [client 77.162.214.240:55196] [client 77.162.214.240] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afOWs79bO-ytgFJ2lwOE1AAAAZg"]
[Fri May 01 01:51:47.968404 2026] [:error] [pid 5733:tid 5803] [client 77.162.214.240:55206] [client 77.162.214.240] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afOWs_T55_Ioa9J2OpIdtAAAAQ0"]
[Fri May 01 01:52:21.492615 2026] [:error] [pid 5732:tid 5782] [client 77.162.214.240:56313] [client 77.162.214.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.162.214.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afOW1duJ3iSd5GdjqlhlSQAAANM"]
[Fri May 01 01:52:21.508898 2026] [:error] [pid 5732:tid 5778] [client 77.162.214.240:56314] [client 77.162.214.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.162.214.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afOW1duJ3iSd5GdjqlhlSgAAAM8"]
[Fri May 01 01:52:45.185535 2026] [:error] [pid 47620:tid 47648] [client 77.162.214.240:57195] [client 77.162.214.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.162.214.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afOW7b9bO-ytgFJ2lwOFBwAAAZQ"]
[Fri May 01 01:52:46.692563 2026] [:error] [pid 5733:tid 5811] [client 77.162.214.240:57247] [client 77.162.214.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.162.214.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afOW7vT55_Ioa9J2OpId0wAAARU"]
[Fri May 01 01:53:03.879203 2026] [:error] [pid 5820:tid 5844] [client 77.162.214.240:57896] [client 77.162.214.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.162.214.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afOW_wyrLh3-LgH3Xv-DJwAAABY"]
[Fri May 01 01:53:03.893965 2026] [:error] [pid 5732:tid 5772] [client 77.162.214.240:57897] [client 77.162.214.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 77.162.214.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afOW_9uJ3iSd5GdjqlhlYgAAAMk"]
[Fri May 01 02:32:32.248614 2026] [:error] [pid 21839:tid 21856] [client 149.202.183.73:49780] [client 149.202.183.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.202.183.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afOgQJ_Sh66m95WwxJ4fUwAAAU4"]
[Fri May 01 03:05:06.224928 2026] [:error] [pid 5820:tid 5832] [client 119.91.20.139:53362] [client 119.91.20.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afOn4gyrLh3-LgH3Xv-NiwAAAAo"]
[Fri May 01 03:08:30.165889 2026] [:error] [pid 47620:tid 47638] [client 109.74.14.122:35732] [client 109.74.14.122] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.74.14.122, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afOorr9bO-ytgFJ2lwOVLwAAAYo"]
[Fri May 01 03:27:27.036488 2026] [:error] [pid 5732:tid 5775] [client 191.37.88.78:60329] [client 191.37.88.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.37.88.78, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afOtH9uJ3iSd5Gdjqlh-qAAAAMw"]
[Fri May 01 03:27:37.014978 2026] [:error] [pid 47620:tid 47629] [client 191.37.88.78:60655] [client 191.37.88.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.37.88.78, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afOtKb9bO-ytgFJ2lwOYngAAAYE"]
[Fri May 01 03:27:47.746269 2026] [:error] [pid 21839:tid 21852] [client 191.37.88.78:60961] [client 191.37.88.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.37.88.78, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afOtM5_Sh66m95WwxJ4lAQAAAUo"]
[Fri May 01 03:27:58.458886 2026] [:error] [pid 21839:tid 21861] [client 191.37.88.78:61255] [client 191.37.88.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.37.88.78, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afOtPp_Sh66m95WwxJ4lBQAAAVM"]
[Fri May 01 03:28:09.084705 2026] [:error] [pid 21839:tid 21853] [client 191.37.88.78:61557] [client 191.37.88.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.37.88.78, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afOtSZ_Sh66m95WwxJ4lCgAAAUs"]
[Fri May 01 04:01:12.998313 2026] [:error] [pid 11946:tid 11971] [client 43.135.148.92:54038] [client 43.135.148.92] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afO1CLNgEmCRQlqcS4UwQgAAANc"]
[Fri May 01 04:01:49.617487 2026] [:error] [pid 15239:tid 15260] [client 183.96.254.8:38044] [client 183.96.254.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 183.96.254.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afO1Lb9xlzHGmxyw6W65pwAAARM"]
[Fri May 01 05:00:41.363565 2026] [:error] [pid 6045:tid 6062] [client 211.21.61.224:51390] [client 211.21.61.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afPC-T4a1vLt_qHgXBSUcwAAAUc"]
[Fri May 01 06:13:50.490921 2026] [:error] [pid 5976:tid 6003] [client 43.157.147.3:52638] [client 43.157.147.3] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afPUHrbCb0ye2WjKldeAJQAAARc"]
[Fri May 01 09:39:52.886019 2026] [:error] [pid 38117:tid 38142] [client 43.165.198.5:39022] [client 43.165.198.5] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afQEaGhRYBrFpu8czJpMIQAAANE"]
[Fri May 01 11:43:03.130387 2026] [:error] [pid 33791:tid 33805] [client 43.134.186.61:56158] [client 43.134.186.61] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afQhR29ixd-moLycM9Aw_AAAAAs"]
[Fri May 01 14:05:04.444006 2026] [:error] [pid 33791:tid 33809] [client 190.133.136.167:40367] [client 190.133.136.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.133.136.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afRCkG9ixd-moLycM9B3SAAAAA8"]
[Fri May 01 14:07:35.816026 2026] [:error] [pid 33791:tid 33814] [client 190.133.136.167:11774] [client 190.133.136.167] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afRDJ29ixd-moLycM9B4uQAAABQ"]
[Fri May 01 14:08:21.723202 2026] [:error] [pid 25085:tid 25111] [client 190.133.136.167:61819] [client 190.133.136.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.133.136.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afRDVfuD8fWRiE0RX0GwkQAAAVQ"]
[Fri May 01 14:09:08.126252 2026] [:error] [pid 24997:tid 25074] [client 190.133.136.167:59272] [client 190.133.136.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.133.136.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afRDhPOkHa4ScY5oo8xmBQAAANI"]
[Fri May 01 14:09:49.750616 2026] [:error] [pid 25085:tid 25099] [client 190.133.136.167:50472] [client 190.133.136.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.133.136.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afRDrfuD8fWRiE0RX0Gw3QAAAUg"]
[Fri May 01 14:10:33.829773 2026] [:error] [pid 24996:tid 25032] [client 190.133.136.167:59882] [client 190.133.136.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 190.133.136.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afRD2SDBq9mMfUWQQeoUJQAAAIQ"]
[Fri May 01 14:58:29.447788 2026] [:error] [pid 24995:tid 25013] [client 43.165.186.188:36352] [client 43.165.186.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afRPFedJG9WB_Q_ne0uBygAAAE4"]
[Fri May 01 15:05:00.164592 2026] [:error] [pid 33791:tid 33796] [client 192.144.148.122:41526] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afRQnG9ixd-moLycM9CWcAAAAAI"]
[Fri May 01 15:32:50.719216 2026] [:error] [pid 24997:tid 25075] [client 193.105.134.150:50126] [client 193.105.134.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "afRXIvOkHa4ScY5oo8yFnQAAANM"]
[Fri May 01 15:32:51.537050 2026] [:error] [pid 24997:tid 25080] [client 109.70.100.13:41646] [client 109.70.100.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/.DS_Store"] [unique_id "afRXI_OkHa4ScY5oo8yFoAAAANg"]
[Fri May 01 17:03:54.597966 2026] [:error] [pid 25085:tid 25091] [client 43.157.156.190:49280] [client 43.157.156.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afRsevuD8fWRiE0RX0HcmQAAAUA"]
[Fri May 01 17:09:50.350036 2026] [:error] [pid 25085:tid 25106] [client 135.232.201.224:29662] [client 135.232.201.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 135.232.201.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/wp/xmlrpc.php"] [unique_id "afRt3vuD8fWRiE0RX0HdkQAAAU8"]
[Fri May 01 20:50:52.282713 2026] [:error] [pid 33791:tid 33803] [client 217.114.214.248:39520] [client 217.114.214.248] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.114.214.248, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afShrG9ixd-moLycM9AVKwAAAAk"]
[Fri May 01 21:15:39.702553 2026] [:error] [pid 24996:tid 25044] [client 196.27.114.137:34830] [client 196.27.114.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.27.114.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afSneyDBq9mMfUWQQepv2QAAAI8"]
[Fri May 01 21:42:54.299692 2026] [:error] [pid 25085:tid 25100] [client 101.33.66.34:38472] [client 101.33.66.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afSt3vuD8fWRiE0RX0ERJQAAAUk"]
[Fri May 01 21:46:59.699881 2026] [:error] [pid 24997:tid 25076] [client 79.137.80.80:52024] [client 79.137.80.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 79.137.80.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afSu0_OkHa4ScY5oo8zg-gAAANQ"]
[Fri May 01 22:53:45.194142 2026] [:error] [pid 25320:tid 25343] [client 47.130.205.94:37276] [client 47.130.205.94] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.130.205.94, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afS-eVc3wJ-3-XaXB3ojtAAAARQ"]
[Fri May 01 23:12:53.787539 2026] [:error] [pid 24996:tid 25034] [client 66.70.178.228:42290] [client 66.70.178.228] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.70.178.228, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afTC9SDBq9mMfUWQQeqJAQAAAIY"]
[Sat May 02 00:31:29.617710 2026] [:error] [pid 25320:tid 25344] [client 43.157.149.188:37040] [client 43.157.149.188] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afTVYVc3wJ-3-XaXB3pCdgAAARU"]
[Sat May 02 00:31:38.429117 2026] [:error] [pid 25320:tid 25325] [client 194.164.161.199:56782] [client 194.164.161.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.161.199, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afTValc3wJ-3-XaXB3pChwAAAQI"]
[Sat May 02 00:37:00.364907 2026] [:error] [pid 24997:tid 25062] [client 159.223.103.141:42504] [client 159.223.103.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.103.141, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afTWrPOkHa4ScY5oo8z1NAAAAMY"]
[Sat May 02 02:24:24.862012 2026] [:error] [pid 24997:tid 25060] [client 8.231.184.93:49163] [client 8.231.184.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.231.184.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afTv2POkHa4ScY5oo8wCRAAAAMU"]
[Sat May 02 02:24:26.813948 2026] [:error] [pid 24997:tid 25079] [client 8.231.184.93:49163] [client 8.231.184.93] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "afTv2vOkHa4ScY5oo8wCRwAAANc"]
[Sat May 02 02:24:26.978128 2026] [:error] [pid 24997:tid 25069] [client 8.231.184.93:49163] [client 8.231.184.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.231.184.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afTv2vOkHa4ScY5oo8wCSAAAAM0"]
[Sat May 02 02:24:28.173011 2026] [:error] [pid 25320:tid 25340] [client 8.231.184.93:59113] [client 8.231.184.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.231.184.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afTv3Fc3wJ-3-XaXB3pe9QAAARE"]
[Sat May 02 02:24:29.361390 2026] [:error] [pid 33791:tid 33812] [client 8.231.184.93:61330] [client 8.231.184.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.231.184.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afTv3W9ixd-moLycM9CJIwAAABI"]
[Sat May 02 02:24:30.553107 2026] [:error] [pid 25320:tid 25334] [client 8.231.184.93:63364] [client 8.231.184.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.231.184.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afTv3lc3wJ-3-XaXB3pe_wAAAQs"]
[Sat May 02 02:24:31.755454 2026] [:error] [pid 33791:tid 33796] [client 8.231.184.93:49168] [client 8.231.184.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 8.231.184.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afTv329ixd-moLycM9CJKgAAAAI"]
[Sat May 02 02:24:31.755612 2026] [:error] [pid 33791:tid 33796] [client 8.231.184.93:49168] [client 8.231.184.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 8.231.184.93, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afTv329ixd-moLycM9CJKgAAAAI"]
[Sat May 02 02:50:20.642741 2026] [:error] [pid 50214:tid 50218] [client 194.164.168.219:37180] [client 194.164.168.219] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.168.219, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afT17Is0pgrtfZkbhjOk0QAAAYA"]
[Sat May 02 04:11:59.545971 2026] [:error] [pid 53434:tid 53451] [client 106.54.62.156:35734] [client 106.54.62.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afUJD-9BXmRQcbfsxly2DgAAAAg"]
[Sat May 02 04:22:58.076515 2026] [:error] [pid 53434:tid 53448] [client 139.59.224.88:39030] [client 139.59.224.88] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "afULou9BXmRQcbfsxly5VAAAAAU"]
[Sat May 02 04:33:41.804354 2026] [:error] [pid 53436:tid 53505] [client 43.131.26.226:39974] [client 43.131.26.226] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afUOJa9N0xp8fccVM0Al0QAAAIY"]
[Sat May 02 05:47:05.057136 2026] [:error] [pid 22846:tid 22871] [client 185.74.81.105:52990] [client 185.74.81.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.74.81.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afUfWYm1Ms03Mfhp3aafCQAAARc"]
[Sat May 02 06:03:40.402164 2026] [:error] [pid 53540:tid 53556] [client 191.252.92.249:50676] [client 191.252.92.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.252.92.249, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afUjPNQYV6qJFftBNymuAwAAAM4"]
[Sat May 02 06:46:37.709384 2026] [:error] [pid 53435:tid 53481] [client 35.226.125.165:58520] [client 35.226.125.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.226.125.165, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afUtTYDmp7_z8QkjSzM1FAAAAEk"]
[Sat May 02 06:51:15.577345 2026] [:error] [pid 53436:tid 53506] [client 164.92.93.29:38880] [client 164.92.93.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.92.93.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afUuY69N0xp8fccVM0BtXgAAAIc"]
[Sat May 02 08:20:16.428945 2026] [:error] [pid 53436:tid 53522] [client 82.135.101.195:57074] [client 82.135.101.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.135.101.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afVDQK9N0xp8fccVM0CJfwAAAJc"]
[Sat May 02 08:59:28.139195 2026] [:error] [pid 53434:tid 53459] [client 202.61.232.118:49296] [client 202.61.232.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.61.232.118, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afVMcO9BXmRQcbfsxlwA4QAAABA"]
[Sat May 02 09:05:07.003895 2026] [:error] [pid 53435:tid 53492] [client 91.98.158.245:36278] [client 91.98.158.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.98.158.245, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afVNw4Dmp7_z8QkjSzNbdgAAAFQ"]
[Sat May 02 09:34:26.708764 2026] [:error] [pid 53434:tid 53464] [client 43.130.9.111:36852] [client 43.130.9.111] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afVUou9BXmRQcbfsxlwN8gAAABU"]
[Sat May 02 09:43:38.322574 2026] [:error] [pid 21339:tid 21364] [client 69.42.222.40:46314] [client 69.42.222.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.42.222.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afVWygN2KhHZavn0Te1uYQAAAZc"]
[Sat May 02 10:19:04.718515 2026] [:error] [pid 11894:tid 11917] [client 100.52.25.12:59190] [client 100.52.25.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 100.52.25.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afVfGDHh6DQF1tkXIKyPCwAAAVQ"]
[Sat May 02 10:23:08.298804 2026] [:error] [pid 53435:tid 53496] [client 93.190.48.15:58448] [client 93.190.48.15] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.190.48.15, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afVgDIDmp7_z8QkjSzNuMQAAAFg"]
[Sat May 02 10:40:06.663277 2026] [:error] [pid 53540:tid 53556] [client 67.205.159.76:59684] [client 67.205.159.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.205.159.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afVkBtQYV6qJFftBNynSNQAAAM4"]
[Sat May 02 11:39:39.100045 2026] [:error] [pid 53435:tid 53478] [client 176.119.210.223:39730] [client 176.119.210.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.119.210.223, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afVx-4Dmp7_z8QkjSzN4OQAAAEY"]
[Sat May 02 12:14:14.971202 2026] [:error] [pid 51950:tid 51980] [client 95.110.143.247:42404] [client 95.110.143.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.110.143.247, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afV6FooBJzYZ3RKUhdjriwAAAkA"]
[Sat May 02 12:56:39.347789 2026] [:error] [pid 51950:tid 51992] [client 78.46.197.51:58706] [client 78.46.197.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.46.197.51, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afWEB4oBJzYZ3RKUhdjzugAAAkw"]
[Sat May 02 13:54:43.087124 2026] [:error] [pid 53434:tid 53461] [client 35.234.37.132:53748] [client 35.234.37.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.234.37.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afWRo-9BXmRQcbfsxlxDIgAAABI"]
[Sat May 02 15:25:56.774313 2026] [:error] [pid 51950:tid 51989] [client 211.21.61.225:43520] [client 211.21.61.225] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.225, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afWnBIoBJzYZ3RKUhdgTDgAAAkk"]
[Sat May 02 15:38:38.084299 2026] [:error] [pid 52124:tid 52143] [client 4.236.158.82:59372] [client 4.236.158.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.236.158.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/wp/xmlrpc.php"] [unique_id "afWp_jjabaZ9NMm8eQt28AAAA44"]
[Sat May 02 15:42:34.034758 2026] [:error] [pid 53435:tid 53472] [client 150.109.230.210:43976] [client 150.109.230.210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afWq6oDmp7_z8QkjSzOIEgAAAEA"]
[Sat May 02 16:30:45.462204 2026] [:error] [pid 52010:tid 52064] [client 142.93.114.194:58114] [client 142.93.114.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.93.114.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afW2NQiR6wohDtdeJMDtnQAAAtU"]
[Sat May 02 17:03:04.476616 2026] [:error] [pid 11894:tid 11915] [client 188.166.14.36:44836] [client 188.166.14.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.14.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afW9yDHh6DQF1tkXIKzEvgAAAVI"]
[Sat May 02 17:27:07.768127 2026] [:error] [pid 52010:tid 52060] [client 81.8.91.201:54610] [client 81.8.91.201] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.8.91.201, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afXDawiR6wohDtdeJMAAXQAAAtE"]
[Sat May 02 17:51:44.828940 2026] [:error] [pid 52010:tid 52048] [client 43.135.211.148:34330] [client 43.135.211.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afXJMAiR6wohDtdeJMAFYQAAAsU"]
[Sat May 02 18:13:36.118190 2026] [:error] [pid 52124:tid 52136] [client 5.141.84.215:54914] [client 5.141.84.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.141.84.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afXOUDjabaZ9NMm8eQuA4QAAA4c"]
[Sat May 02 18:52:32.261768 2026] [:error] [pid 53435:tid 53478] [client 147.93.157.194:35402] [client 147.93.157.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 147.93.157.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afXXcIDmp7_z8QkjSzOklQAAAEY"]
[Sat May 02 20:47:15.701026 2026] [:error] [pid 52012:tid 52099] [client 43.154.250.181:45624] [client 43.154.250.181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afXyU0zSWr-8cpS83mipMQAAA1Y"]
[Sat May 02 20:57:43.050107 2026] [:error] [pid 52012:tid 52088] [client 194.164.161.199:38886] [client 194.164.161.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.161.199, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afX0x0zSWr-8cpS83mitaQAAA0s"]
[Sat May 02 21:31:11.489615 2026] [:error] [pid 53434:tid 53456] [client 64.225.112.39:39046] [client 64.225.112.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.225.112.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afX8n-9BXmRQcbfsxlyQaQAAAA0"]
[Sat May 02 21:33:42.057047 2026] [:error] [pid 51917:tid 51928] [client 188.166.244.214:57028] [client 188.166.244.214] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.166.244.214, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afX9Nq7wZviJ7BgcCi9TcQAAAck"]
[Sat May 02 22:01:06.811585 2026] [:error] [pid 53435:tid 53477] [client 200.234.226.232:51778] [client 200.234.226.232] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 200.234.226.232, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afYDooDmp7_z8QkjSzPQ8gAAAEU"]
[Sat May 02 22:33:11.002710 2026] [:error] [pid 51950:tid 51998] [client 49.51.233.95:45272] [client 49.51.233.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afYLJooBJzYZ3RKUhdhoNwAAAlI"]
[Sat May 02 22:51:25.867704 2026] [:error] [pid 52010:tid 52045] [client 42.105.181.39:10866] [client 42.105.181.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 42.105.181.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afYPbQiR6wohDtdeJMA-JgAAAsI"]
[Sat May 02 23:44:44.225013 2026] [:error] [pid 52124:tid 52144] [client 163.61.60.30:38092] [client 163.61.60.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 163.61.60.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afYb7DjabaZ9NMm8eQuVvQAAA48"]
[Sun May 03 00:10:04.332371 2026] [:error] [pid 52010:tid 52059] [client 211.21.61.224:45726] [client 211.21.61.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 211.21.61.224, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afYh3AiR6wohDtdeJMBRZgAAAtA"]
[Sun May 03 01:43:25.226087 2026] [:error] [pid 52010:tid 52058] [client 101.32.52.164:39544] [client 101.32.52.164] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afY3vQiR6wohDtdeJMBpGQAAAs8"]
[Sun May 03 02:12:20.214717 2026] [:error] [pid 22846:tid 22855] [client 35.234.37.132:53776] [client 35.234.37.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.234.37.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afY-hIm1Ms03Mfhp3aYXrgAAAQc"]
[Sun May 03 02:17:33.198732 2026] [:error] [pid 53434:tid 53445] [client 20.251.169.172:52732] [client 20.251.169.172] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "afY_ve9BXmRQcbfsxly8_QAAAAI"]
[Sun May 03 02:22:31.731792 2026] [:error] [pid 53434:tid 53460] [client 157.230.98.91:54286] [client 157.230.98.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.230.98.91, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afZA5-9BXmRQcbfsxly9sgAAABE"]
[Sun May 03 03:05:06.928364 2026] [:error] [pid 52010:tid 52051] [client 82.223.165.55:49364] [client 82.223.165.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.165.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afZK4giR6wohDtdeJMB6qQAAAsg"]
[Sun May 03 03:22:06.734682 2026] [:error] [pid 52010:tid 52065] [client 45.154.98.197:50595] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "afZO3giR6wohDtdeJMB-0gAAAtY"]
[Sun May 03 03:22:07.238061 2026] [:error] [pid 52010:tid 52055] [client 45.154.98.197:64871] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "afZO3wiR6wohDtdeJMB-0wAAAsw"]
[Sun May 03 03:22:07.745631 2026] [:error] [pid 22846:tid 22870] [client 45.154.98.197:53622] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "afZO34m1Ms03Mfhp3aYdLwAAARY"]
[Sun May 03 03:22:09.843814 2026] [:error] [pid 53435:tid 53481] [client 45.154.98.197:60702] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "afZO4YDmp7_z8QkjSzMw-gAAAEk"]
[Sun May 03 04:39:56.419519 2026] [:error] [pid 40638:tid 40679] [client 194.164.173.215:47294] [client 194.164.173.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.164.173.215, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afZhHPh3VcFjJ7H1mBaZngAAAEU"]
[Sun May 03 04:44:15.377745 2026] [:error] [pid 40638:tid 40689] [client 43.161.234.148:59896] [client 43.161.234.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afZiH_h3VcFjJ7H1mBacAAAAAE8"]
[Sun May 03 05:32:57.715821 2026] [:error] [pid 21934:tid 21955] [client 95.173.103.120:34748] [client 95.173.103.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.173.103.120, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afZtiXWfIjnWjXCxeM4qaQAAARM"]
[Sun May 03 06:52:49.827430 2026] [:error] [pid 37246:tid 37259] [client 185.23.117.167:52498] [client 185.23.117.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.23.117.167, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afaAQThvYFGNwhnPampVagAAAQo"]
[Sun May 03 07:00:05.582921 2026] [:error] [pid 37126:tid 37174] [client 138.252.198.202:44904] [client 138.252.198.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.252.198.202, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afaB9fR_A42N-LtDyrvV6gAAABU"]
[Sun May 03 07:00:35.609262 2026] [autoindex:error] [pid 37130:tid 37216] [client 20.43.1.132:36324] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 03 07:00:37.305854 2026] [autoindex:error] [pid 37130:tid 37226] [client 20.43.1.132:36324] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/audio/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 03 07:00:38.274835 2026] [:error] [pid 37130:tid 37218] [client 20.43.1.132:36324] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.admin.php"] [unique_id "afaCFqIu7bmXKXicRk8lqgAAAIU"]
[Sun May 03 07:00:38.708850 2026] [:error] [pid 37246:tid 37261] [client 20.43.1.132:36242] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.admin.php"] [unique_id "afaCFjhvYFGNwhnPampY-AAAAQs"]
[Sun May 03 07:00:39.123714 2026] [:error] [pid 40456:tid 40467] [client 20.43.1.132:36344] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.admin.php"] [unique_id "afaCFzSujTvwdzEkjSfEIAAAAYk"]
[Sun May 03 07:00:39.552580 2026] [:error] [pid 37246:tid 37254] [client 20.43.1.132:36238] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.admin.php"] [unique_id "afaCFzhvYFGNwhnPampY-gAAAQY"]
[Sun May 03 07:00:39.968848 2026] [:error] [pid 37127:tid 37208] [client 20.43.1.132:36291] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sw.php"] [unique_id "afaCF_8khJXb5O5aWVXOBgAAAFY"]
[Sun May 03 07:00:40.380501 2026] [:error] [pid 40386:tid 40389] [client 20.43.1.132:36308] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sw.php"] [unique_id "afaCGFHJDYRXUf3IbRTRJQAAAME"]
[Sun May 03 07:00:40.810499 2026] [:error] [pid 37126:tid 37172] [client 20.43.1.132:36349] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sw.php"] [unique_id "afaCGPR_A42N-LtDyrvV9gAAABM"]
[Sun May 03 07:00:41.248101 2026] [:error] [pid 40422:tid 40429] [client 20.43.1.132:36341] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sw.php"] [unique_id "afaCGUHBbBLrXh6PButgiwAAAUM"]
[Sun May 03 07:00:41.670024 2026] [:error] [pid 40386:tid 40395] [client 20.43.1.132:36334] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vuln.php"] [unique_id "afaCGVHJDYRXUf3IbRTRJgAAAMc"]
[Sun May 03 07:00:42.104951 2026] [:error] [pid 37126:tid 37169] [client 20.43.1.132:36252] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vuln.php"] [unique_id "afaCGvR_A42N-LtDyrvV9wAAABA"]
[Sun May 03 07:00:42.538704 2026] [:error] [pid 40456:tid 40478] [client 20.43.1.132:36261] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-temp.php"] [unique_id "afaCGjSujTvwdzEkjSfEIwAAAZQ"]
[Sun May 03 07:00:42.955570 2026] [:error] [pid 40456:tid 40461] [client 20.43.1.132:36317] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-temp.php"] [unique_id "afaCGjSujTvwdzEkjSfEJgAAAYM"]
[Sun May 03 07:00:43.372274 2026] [:error] [pid 40456:tid 40482] [client 20.43.1.132:36227] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-temp.php"] [unique_id "afaCGzSujTvwdzEkjSfEKAAAAZg"]
[Sun May 03 07:00:43.817133 2026] [:error] [pid 37126:tid 37151] [client 20.43.1.132:36321] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-temp.php"] [unique_id "afaCG_R_A42N-LtDyrvV-AAAAAA"]
[Sun May 03 07:00:44.230462 2026] [:error] [pid 37127:tid 37199] [client 20.43.1.132:36318] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sxdfrt.php"] [unique_id "afaCHP8khJXb5O5aWVXOCwAAAE4"]
[Sun May 03 07:00:44.651776 2026] [:error] [pid 40456:tid 40473] [client 20.43.1.132:36254] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sxdfrt.php"] [unique_id "afaCHDSujTvwdzEkjSfELAAAAY8"]
[Sun May 03 07:00:45.075274 2026] [:error] [pid 40456:tid 40476] [client 20.43.1.132:36316] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sxdfrt.php"] [unique_id "afaCHTSujTvwdzEkjSfELQAAAZI"]
[Sun May 03 07:00:45.498659 2026] [:error] [pid 37246:tid 37248] [client 20.43.1.132:36337] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sxdfrt.php"] [unique_id "afaCHThvYFGNwhnPampZAgAAAQA"]
[Sun May 03 07:00:45.933631 2026] [:error] [pid 37246:tid 37272] [client 20.43.1.132:36263] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "afaCHThvYFGNwhnPampZAwAAARY"]
[Sun May 03 07:00:46.357933 2026] [:error] [pid 37246:tid 37254] [client 20.43.1.132:36249] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "afaCHjhvYFGNwhnPampZBgAAAQY"]
[Sun May 03 07:00:46.772983 2026] [:error] [pid 37246:tid 37267] [client 20.43.1.132:36338] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "afaCHjhvYFGNwhnPampZCgAAARE"]
[Sun May 03 07:00:47.191151 2026] [:error] [pid 37246:tid 37256] [client 20.43.1.132:36239] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfive/assets/"] [unique_id "afaCHzhvYFGNwhnPampZDAAAAQg"]
[Sun May 03 07:00:47.606096 2026] [:error] [pid 37130:tid 37230] [client 20.43.1.132:36253] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afaCH6Iu7bmXKXicRk8lrAAAAJE"]
[Sun May 03 07:00:48.025056 2026] [:error] [pid 40386:tid 40400] [client 20.43.1.132:36294] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afaCIFHJDYRXUf3IbRTRKQAAAMw"]
[Sun May 03 07:00:48.490978 2026] [:error] [pid 37130:tid 37233] [client 20.43.1.132:36232] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afaCIKIu7bmXKXicRk8lrQAAAJQ"]
[Sun May 03 07:00:49.150524 2026] [:error] [pid 37127:tid 37185] [client 20.43.1.132:36228] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afaCIf8khJXb5O5aWVXODwAAAEE"]
[Sun May 03 07:00:49.763638 2026] [:error] [pid 37126:tid 37167] [client 20.43.1.132:36345] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-bda.php"] [unique_id "afaCIfR_A42N-LtDyrvV-gAAAA4"]
[Sun May 03 07:00:50.391653 2026] [:error] [pid 40456:tid 40480] [client 20.43.1.132:64326] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-bda.php"] [unique_id "afaCIjSujTvwdzEkjSfEMgAAAZY"]
[Sun May 03 07:00:51.206557 2026] [:error] [pid 37130:tid 37219] [client 20.43.1.132:64367] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-bda.php"] [unique_id "afaCI6Iu7bmXKXicRk8lrgAAAIY"]
[Sun May 03 07:00:52.381062 2026] [:error] [pid 37127:tid 37195] [client 20.43.1.132:36333] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-bda.php"] [unique_id "afaCJP8khJXb5O5aWVXOFAAAAEs"]
[Sun May 03 07:00:52.883511 2026] [:error] [pid 37246:tid 37255] [client 20.43.1.132:36231] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bhm.php"] [unique_id "afaCJDhvYFGNwhnPampZFAAAAQc"]
[Sun May 03 07:00:53.312656 2026] [:error] [pid 37246:tid 37256] [client 20.43.1.132:64345] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bhm.php"] [unique_id "afaCJThvYFGNwhnPampZFgAAAQg"]
[Sun May 03 07:00:53.737231 2026] [:error] [pid 40456:tid 40482] [client 20.43.1.132:36260] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bhm.php"] [unique_id "afaCJTSujTvwdzEkjSfEMwAAAZg"]
[Sun May 03 07:00:54.156756 2026] [:error] [pid 40422:tid 40428] [client 20.43.1.132:36301] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bhm.php"] [unique_id "afaCJkHBbBLrXh6PButgjgAAAUI"]
[Sun May 03 07:00:54.575413 2026] [:error] [pid 40422:tid 40434] [client 20.43.1.132:36300] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmu.php"] [unique_id "afaCJkHBbBLrXh6PButgjwAAAUg"]
[Sun May 03 07:00:54.994551 2026] [:error] [pid 40456:tid 40460] [client 20.43.1.132:36348] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmu.php"] [unique_id "afaCJjSujTvwdzEkjSfENgAAAYI"]
[Sun May 03 07:00:55.418828 2026] [:error] [pid 40456:tid 40476] [client 20.43.1.132:36250] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmu.php"] [unique_id "afaCJzSujTvwdzEkjSfENwAAAZI"]
[Sun May 03 07:00:55.841521 2026] [:error] [pid 40456:tid 40468] [client 20.43.1.132:36332] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmu.php"] [unique_id "afaCJzSujTvwdzEkjSfEOgAAAYo"]
[Sun May 03 07:00:56.258387 2026] [:error] [pid 40456:tid 40465] [client 20.43.1.132:36311] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ref.php"] [unique_id "afaCKDSujTvwdzEkjSfEPAAAAYc"]
[Sun May 03 07:00:56.691075 2026] [:error] [pid 40456:tid 40478] [client 20.43.1.132:36302] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ref.php"] [unique_id "afaCKDSujTvwdzEkjSfEPQAAAZQ"]
[Sun May 03 07:00:57.121774 2026] [:error] [pid 37126:tid 37152] [client 20.43.1.132:36322] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ref.php"] [unique_id "afaCKfR_A42N-LtDyrvV-wAAAAE"]
[Sun May 03 07:00:57.547233 2026] [:error] [pid 40456:tid 40472] [client 20.43.1.132:36278] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ref.php"] [unique_id "afaCKTSujTvwdzEkjSfEPwAAAY4"]
[Sun May 03 07:00:57.970585 2026] [:error] [pid 40456:tid 40480] [client 20.43.1.132:36329] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-xme.php"] [unique_id "afaCKTSujTvwdzEkjSfEQAAAAZY"]
[Sun May 03 07:00:58.400333 2026] [:error] [pid 37127:tid 37200] [client 20.43.1.132:36264] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-xme.php"] [unique_id "afaCKv8khJXb5O5aWVXOGAAAAE8"]
[Sun May 03 07:00:58.827607 2026] [:error] [pid 37246:tid 37273] [client 20.43.1.132:36226] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-xme.php"] [unique_id "afaCKjhvYFGNwhnPampZGAAAARc"]
[Sun May 03 07:00:59.261895 2026] [:error] [pid 37246:tid 37255] [client 20.43.1.132:36330] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-xme.php"] [unique_id "afaCKzhvYFGNwhnPampZGQAAAQc"]
[Sun May 03 07:00:59.706166 2026] [:error] [pid 40386:tid 40411] [client 20.43.1.132:36243] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer.php"] [unique_id "afaCK1HJDYRXUf3IbRTRLwAAANc"]
[Sun May 03 07:01:00.135310 2026] [:error] [pid 37126:tid 37162] [client 20.43.1.132:36269] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer.php"] [unique_id "afaCLPR_A42N-LtDyrvV_QAAAAk"]
[Sun May 03 07:01:00.567650 2026] [:error] [pid 37126:tid 37163] [client 20.43.1.132:36236] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer.php"] [unique_id "afaCLPR_A42N-LtDyrvV_gAAAAo"]
[Sun May 03 07:01:01.015904 2026] [:error] [pid 37130:tid 37214] [client 20.43.1.132:36244] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminer.php"] [unique_id "afaCLaIu7bmXKXicRk8ltAAAAIE"]
[Sun May 03 07:01:01.445852 2026] [:error] [pid 37127:tid 37208] [client 20.43.1.132:36326] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ktfow.php"] [unique_id "afaCLf8khJXb5O5aWVXOHQAAAFY"]
[Sun May 03 07:01:01.892188 2026] [:error] [pid 37127:tid 37190] [client 20.43.1.132:36236] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ktfow.php"] [unique_id "afaCLf8khJXb5O5aWVXOHwAAAEY"]
[Sun May 03 07:01:02.367323 2026] [:error] [pid 40386:tid 40391] [client 20.43.1.132:36331] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ktfow.php"] [unique_id "afaCLlHJDYRXUf3IbRTRMAAAAMM"]
[Sun May 03 07:01:02.787252 2026] [:error] [pid 40386:tid 40400] [client 20.43.1.132:36293] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ktfow.php"] [unique_id "afaCLlHJDYRXUf3IbRTRMwAAAMw"]
[Sun May 03 07:01:03.221536 2026] [:error] [pid 40386:tid 40390] [client 20.43.1.132:36310] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mode.php"] [unique_id "afaCL1HJDYRXUf3IbRTRNQAAAMI"]
[Sun May 03 07:01:03.643946 2026] [:error] [pid 40386:tid 40403] [client 20.43.1.132:64341] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mode.php"] [unique_id "afaCL1HJDYRXUf3IbRTRNgAAAM8"]
[Sun May 03 07:01:04.085126 2026] [:error] [pid 40456:tid 40475] [client 20.43.1.132:36255] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mode.php"] [unique_id "afaCMDSujTvwdzEkjSfERQAAAZE"]
[Sun May 03 07:01:04.500981 2026] [:error] [pid 37126:tid 37159] [client 20.43.1.132:64342] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mode.php"] [unique_id "afaCMPR_A42N-LtDyrvWBQAAAAY"]
[Sun May 03 07:01:04.928383 2026] [:error] [pid 40422:tid 40427] [client 20.43.1.132:64362] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Xx.php"] [unique_id "afaCMEHBbBLrXh6PButgnwAAAUE"]
[Sun May 03 07:01:05.379357 2026] [:error] [pid 40422:tid 40437] [client 20.43.1.132:36335] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Xx.php"] [unique_id "afaCMUHBbBLrXh6PButgogAAAUs"]
[Sun May 03 07:01:05.799623 2026] [:error] [pid 40422:tid 40446] [client 20.43.1.132:64321] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Xx.php"] [unique_id "afaCMUHBbBLrXh6PButgpQAAAVQ"]
[Sun May 03 07:01:06.246487 2026] [:error] [pid 40422:tid 40444] [client 20.43.1.132:64331] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Xx.php"] [unique_id "afaCMkHBbBLrXh6PButgqQAAAVI"]
[Sun May 03 07:01:06.666947 2026] [:error] [pid 40456:tid 40471] [client 20.43.1.132:36342] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmini.php"] [unique_id "afaCMjSujTvwdzEkjSfESgAAAY0"]
[Sun May 03 07:01:07.097746 2026] [:error] [pid 37130:tid 37233] [client 20.43.1.132:36268] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmini.php"] [unique_id "afaCM6Iu7bmXKXicRk8luQAAAJQ"]
[Sun May 03 07:01:07.523040 2026] [:error] [pid 37130:tid 37220] [client 20.43.1.132:64379] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmini.php"] [unique_id "afaCM6Iu7bmXKXicRk8lugAAAIc"]
[Sun May 03 07:01:07.992167 2026] [:error] [pid 37130:tid 37213] [client 20.43.1.132:36287] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmini.php"] [unique_id "afaCM6Iu7bmXKXicRk8lvAAAAIA"]
[Sun May 03 07:01:08.422059 2026] [:error] [pid 37130:tid 37226] [client 20.43.1.132:36245] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2468.php"] [unique_id "afaCNKIu7bmXKXicRk8lvgAAAI0"]
[Sun May 03 07:01:08.844014 2026] [:error] [pid 37130:tid 37218] [client 20.43.1.132:36339] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2468.php"] [unique_id "afaCNKIu7bmXKXicRk8lwQAAAIU"]
[Sun May 03 07:01:09.260066 2026] [:error] [pid 37246:tid 37253] [client 20.43.1.132:36271] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2468.php"] [unique_id "afaCNThvYFGNwhnPampZIQAAAQU"]
[Sun May 03 07:01:09.676411 2026] [:error] [pid 40456:tid 40470] [client 20.43.1.132:36233] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2468.php"] [unique_id "afaCNTSujTvwdzEkjSfETQAAAYw"]
[Sun May 03 07:01:10.091087 2026] [:error] [pid 40456:tid 40465] [client 20.43.1.132:36328] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "afaCNjSujTvwdzEkjSfEUQAAAYc"]
[Sun May 03 07:01:10.511485 2026] [:error] [pid 40456:tid 40464] [client 20.43.1.132:36288] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "afaCNjSujTvwdzEkjSfEUgAAAYY"]
[Sun May 03 07:01:10.931834 2026] [:error] [pid 37246:tid 37267] [client 20.43.1.132:36303] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "afaCNjhvYFGNwhnPampZIwAAARE"]
[Sun May 03 07:01:11.365280 2026] [:error] [pid 40422:tid 40431] [client 20.43.1.132:64340] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "afaCN0HBbBLrXh6PButgqwAAAUU"]
[Sun May 03 07:01:11.779834 2026] [:error] [pid 37126:tid 37175] [client 20.43.1.132:36272] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "afaCN_R_A42N-LtDyrvWCwAAABY"]
[Sun May 03 07:01:12.203798 2026] [:error] [pid 40386:tid 40388] [client 20.43.1.132:36283] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "afaCOFHJDYRXUf3IbRTROgAAAMA"]
[Sun May 03 07:01:12.663082 2026] [:error] [pid 37246:tid 37255] [client 20.43.1.132:36347] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "afaCODhvYFGNwhnPampZJQAAAQc"]
[Sun May 03 07:01:13.087826 2026] [:error] [pid 37246:tid 37268] [client 20.43.1.132:64324] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "afaCOThvYFGNwhnPampZJwAAARI"]
[Sun May 03 07:01:13.539151 2026] [:error] [pid 37246:tid 37256] [client 20.43.1.132:36319] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amdin.php"] [unique_id "afaCOThvYFGNwhnPampZKgAAAQg"]
[Sun May 03 07:01:13.959577 2026] [:error] [pid 37126:tid 37173] [client 20.43.1.132:36267] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amdin.php"] [unique_id "afaCOfR_A42N-LtDyrvWDAAAABQ"]
[Sun May 03 07:01:14.385024 2026] [:error] [pid 37127:tid 37201] [client 20.43.1.132:36314] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amdin.php"] [unique_id "afaCOv8khJXb5O5aWVXOJgAAAFA"]
[Sun May 03 07:01:14.805053 2026] [:error] [pid 37246:tid 37269] [client 20.43.1.132:36225] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amdin.php"] [unique_id "afaCOjhvYFGNwhnPampZMAAAARM"]
[Sun May 03 07:01:15.221473 2026] [:error] [pid 37130:tid 37213] [client 20.43.1.132:36259] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/huya.php"] [unique_id "afaCO6Iu7bmXKXicRk8lxgAAAIA"]
[Sun May 03 07:01:15.649849 2026] [:error] [pid 37127:tid 37192] [client 20.43.1.132:64353] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/huya.php"] [unique_id "afaCO_8khJXb5O5aWVXOKAAAAEg"]
[Sun May 03 07:01:16.085665 2026] [:error] [pid 37130:tid 37227] [client 20.43.1.132:36281] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/huya.php"] [unique_id "afaCPKIu7bmXKXicRk8lyAAAAI4"]
[Sun May 03 07:01:16.505970 2026] [:error] [pid 37126:tid 37166] [client 20.43.1.132:64328] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/huya.php"] [unique_id "afaCPPR_A42N-LtDyrvWDgAAAA0"]
[Sun May 03 07:01:16.921892 2026] [:error] [pid 40386:tid 40393] [client 20.43.1.132:36298] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/puc.php"] [unique_id "afaCPFHJDYRXUf3IbRTROwAAAMU"]
[Sun May 03 07:01:17.355525 2026] [:error] [pid 37130:tid 37237] [client 20.43.1.132:64383] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/puc.php"] [unique_id "afaCPaIu7bmXKXicRk8lzAAAAJg"]
[Sun May 03 07:01:17.788046 2026] [:error] [pid 37126:tid 37160] [client 20.43.1.132:36242] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/puc.php"] [unique_id "afaCPfR_A42N-LtDyrvWEAAAAAc"]
[Sun May 03 07:01:18.205412 2026] [:error] [pid 37130:tid 37230] [client 20.43.1.132:64360] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/puc.php"] [unique_id "afaCPqIu7bmXKXicRk8l0AAAAJE"]
[Sun May 03 07:01:18.643878 2026] [:error] [pid 37126:tid 37161] [client 20.43.1.132:64378] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "afaCPvR_A42N-LtDyrvWEgAAAAg"]
[Sun May 03 07:01:19.058746 2026] [:error] [pid 37126:tid 37170] [client 20.43.1.132:36257] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "afaCP_R_A42N-LtDyrvWFAAAABE"]
[Sun May 03 07:01:19.487829 2026] [:error] [pid 37246:tid 37249] [client 20.43.1.132:64323] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "afaCPzhvYFGNwhnPampZNAAAAQE"]
[Sun May 03 07:01:19.910687 2026] [:error] [pid 37246:tid 37263] [client 20.43.1.132:64339] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "afaCPzhvYFGNwhnPampZNgAAAQ0"]
[Sun May 03 07:01:20.332067 2026] [:error] [pid 37246:tid 37274] [client 20.43.1.132:36312] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ewp.php"] [unique_id "afaCQDhvYFGNwhnPampZOAAAARg"]
[Sun May 03 07:01:20.801061 2026] [:error] [pid 40456:tid 40469] [client 20.43.1.132:36247] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ewp.php"] [unique_id "afaCQDSujTvwdzEkjSfEVgAAAYs"]
[Sun May 03 07:01:21.257883 2026] [:error] [pid 40422:tid 40438] [client 20.43.1.132:36299] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ewp.php"] [unique_id "afaCQUHBbBLrXh6PButgrQAAAUw"]
[Sun May 03 07:01:21.672775 2026] [:error] [pid 40456:tid 40466] [client 20.43.1.132:36235] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ewp.php"] [unique_id "afaCQTSujTvwdzEkjSfEWAAAAYg"]
[Sun May 03 07:01:22.092368 2026] [:error] [pid 37130:tid 37224] [client 20.43.1.132:36246] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kikikoko.php"] [unique_id "afaCQqIu7bmXKXicRk8l0wAAAIs"]
[Sun May 03 07:01:22.541896 2026] [:error] [pid 37130:tid 37219] [client 20.43.1.132:36327] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kikikoko.php"] [unique_id "afaCQqIu7bmXKXicRk8l1AAAAIY"]
[Sun May 03 07:01:22.983960 2026] [:error] [pid 37127:tid 37187] [client 20.43.1.132:36320] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kikikoko.php"] [unique_id "afaCQv8khJXb5O5aWVXOLQAAAEM"]
[Sun May 03 07:01:23.405939 2026] [:error] [pid 37127:tid 37188] [client 20.43.1.132:36237] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kikikoko.php"] [unique_id "afaCQ_8khJXb5O5aWVXOLwAAAEQ"]
[Sun May 03 07:01:23.863495 2026] [:error] [pid 37126:tid 37156] [client 20.43.1.132:36289] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "afaCQ_R_A42N-LtDyrvWGwAAAAM"]
[Sun May 03 07:01:24.322540 2026] [:error] [pid 40422:tid 40447] [client 20.43.1.132:36234] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "afaCREHBbBLrXh6PButgsAAAAVU"]
[Sun May 03 07:01:24.739927 2026] [:error] [pid 40422:tid 40444] [client 20.43.1.132:64373] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "afaCREHBbBLrXh6PButgsgAAAVI"]
[Sun May 03 07:01:25.159911 2026] [:error] [pid 40422:tid 40436] [client 20.43.1.132:64370] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "afaCRUHBbBLrXh6PButgtgAAAUo"]
[Sun May 03 07:01:25.574286 2026] [:error] [pid 40422:tid 40432] [client 20.43.1.132:64322] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "afaCRUHBbBLrXh6PButguAAAAUY"]
[Sun May 03 07:01:25.991299 2026] [:error] [pid 40386:tid 40399] [client 20.43.1.132:36275] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "afaCRVHJDYRXUf3IbRTRUgAAAMs"]
[Sun May 03 07:01:26.418359 2026] [:error] [pid 37127:tid 37202] [client 20.43.1.132:36240] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "afaCRv8khJXb5O5aWVXONAAAAFE"]
[Sun May 03 07:01:26.855851 2026] [:error] [pid 40422:tid 40427] [client 20.43.1.132:36343] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "afaCRkHBbBLrXh6PButguwAAAUE"]
[Sun May 03 07:01:27.270046 2026] [:error] [pid 40386:tid 40400] [client 20.43.1.132:36230] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "afaCR1HJDYRXUf3IbRTRWQAAAMw"]
[Sun May 03 07:01:27.689052 2026] [:error] [pid 37126:tid 37153] [client 20.43.1.132:64334] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "afaCR_R_A42N-LtDyrvWHgAAAAI"]
[Sun May 03 07:01:28.117434 2026] [:error] [pid 37246:tid 37263] [client 20.43.1.132:64337] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "afaCSDhvYFGNwhnPampZRgAAAQ0"]
[Sun May 03 07:01:28.535392 2026] [:error] [pid 37130:tid 37230] [client 20.43.1.132:64343] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "afaCSKIu7bmXKXicRk8l2gAAAJE"]
[Sun May 03 07:01:28.991902 2026] [:error] [pid 37127:tid 37207] [client 20.43.1.132:64329] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "afaCSP8khJXb5O5aWVXONwAAAFU"]
[Sun May 03 07:01:29.405591 2026] [:error] [pid 37126:tid 37159] [client 20.43.1.132:36323] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "afaCSfR_A42N-LtDyrvWIAAAAAY"]
[Sun May 03 07:01:29.830144 2026] [:error] [pid 40456:tid 40463] [client 20.43.1.132:36350] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "afaCSTSujTvwdzEkjSfEYQAAAYU"]
[Sun May 03 07:01:30.246520 2026] [:error] [pid 37246:tid 37248] [client 20.43.1.132:36224] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "afaCSjhvYFGNwhnPampZSQAAAQA"]
[Sun May 03 07:01:30.664049 2026] [:error] [pid 37127:tid 37209] [client 20.43.1.132:36265] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "afaCSv8khJXb5O5aWVXOOQAAAFc"]
[Sun May 03 07:01:31.086003 2026] [:error] [pid 37126:tid 37176] [client 20.43.1.132:36346] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "afaCS_R_A42N-LtDyrvWIQAAABc"]
[Sun May 03 07:01:31.508096 2026] [:error] [pid 40422:tid 40440] [client 20.43.1.132:36258] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "afaCS0HBbBLrXh6PButgwgAAAU4"]
[Sun May 03 07:01:31.934189 2026] [:error] [pid 37126:tid 37160] [client 20.43.1.132:64261] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "afaCS_R_A42N-LtDyrvWJQAAAAc"]
[Sun May 03 07:01:32.351707 2026] [:error] [pid 37126:tid 37168] [client 20.43.1.132:64332] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "afaCTPR_A42N-LtDyrvWJwAAAA8"]
[Sun May 03 07:01:32.766139 2026] [:error] [pid 37126:tid 37167] [client 20.43.1.132:64371] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "afaCTPR_A42N-LtDyrvWKQAAAA4"]
[Sun May 03 07:01:33.181958 2026] [:error] [pid 40456:tid 40464] [client 20.43.1.132:64365] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "afaCTTSujTvwdzEkjSfEZwAAAYY"]
[Sun May 03 07:01:33.594071 2026] [:error] [pid 40456:tid 40478] [client 20.43.1.132:36292] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "afaCTTSujTvwdzEkjSfEagAAAZQ"]
[Sun May 03 07:01:34.020524 2026] [:error] [pid 37127:tid 37208] [client 20.43.1.132:36306] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "afaCTv8khJXb5O5aWVXOQgAAAFY"]
[Sun May 03 07:01:34.434361 2026] [:error] [pid 37126:tid 37153] [client 20.43.1.132:36282] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "afaCTvR_A42N-LtDyrvWKwAAAAI"]
[Sun May 03 07:01:34.853189 2026] [:error] [pid 37246:tid 37266] [client 20.43.1.132:64306] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "afaCTjhvYFGNwhnPampZSwAAARA"]
[Sun May 03 07:01:35.272375 2026] [:error] [pid 37246:tid 37271] [client 20.43.1.132:64308] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "afaCTzhvYFGNwhnPampZTQAAARU"]
[Sun May 03 07:01:35.686816 2026] [:error] [pid 37246:tid 37270] [client 20.43.1.132:36279] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "afaCTzhvYFGNwhnPampZTgAAARQ"]
[Sun May 03 07:01:36.103762 2026] [:error] [pid 37246:tid 37249] [client 20.43.1.132:36280] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "afaCUDhvYFGNwhnPampZUAAAAQE"]
[Sun May 03 07:01:36.534378 2026] [:error] [pid 37246:tid 37273] [client 20.43.1.132:64310] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "afaCUDhvYFGNwhnPampZUgAAARc"]
[Sun May 03 07:01:36.950733 2026] [:error] [pid 40456:tid 40474] [client 20.43.1.132:36289] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "afaCUDSujTvwdzEkjSfEdgAAAZA"]
[Sun May 03 07:01:37.369611 2026] [autoindex:error] [pid 40422:tid 40428] [client 20.43.1.132:64276] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 03 07:01:47.466689 2026] [:error] [pid 40422:tid 40443] [client 20.43.1.132:64276] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "afaCW0HBbBLrXh6PButg0QAAAVE"]
[Sun May 03 07:01:47.881954 2026] [:error] [pid 40386:tid 40394] [client 20.43.1.132:36248] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "afaCW1HJDYRXUf3IbRTRvwAAAMY"]
[Sun May 03 07:01:48.295725 2026] [:error] [pid 37127:tid 37198] [client 20.43.1.132:36336] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "afaCXP8khJXb5O5aWVXOVwAAAE0"]
[Sun May 03 07:01:48.710351 2026] [:error] [pid 37130:tid 37214] [client 20.43.1.132:64351] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "afaCXKIu7bmXKXicRk8l9wAAAIE"]
[Sun May 03 07:01:49.130199 2026] [:error] [pid 37246:tid 37272] [client 20.43.1.132:36251] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "afaCXThvYFGNwhnPampZbgAAARY"]
[Sun May 03 07:01:49.543682 2026] [:error] [pid 40456:tid 40480] [client 20.43.1.132:64301] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "afaCXTSujTvwdzEkjSfEhQAAAZY"]
[Sun May 03 07:01:49.962994 2026] [:error] [pid 37127:tid 37203] [client 20.43.1.132:64382] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "afaCXf8khJXb5O5aWVXOXQAAAFI"]
[Sun May 03 07:01:50.405728 2026] [:error] [pid 40456:tid 40481] [client 20.43.1.132:64335] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/9.php"] [unique_id "afaCXjSujTvwdzEkjSfEiQAAAZc"]
[Sun May 03 07:01:50.823442 2026] [:error] [pid 37126:tid 37170] [client 20.43.1.132:64356] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "afaCXvR_A42N-LtDyrvWMwAAABE"]
[Sun May 03 07:01:51.249871 2026] [:error] [pid 37126:tid 37167] [client 20.43.1.132:36225] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "afaCX_R_A42N-LtDyrvWNAAAAA4"]
[Sun May 03 07:01:51.664285 2026] [:error] [pid 40456:tid 40473] [client 20.43.1.132:64262] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "afaCXzSujTvwdzEkjSfEjgAAAY8"]
[Sun May 03 07:01:52.088591 2026] [:error] [pid 40456:tid 40467] [client 20.43.1.132:36285] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/10.php"] [unique_id "afaCYDSujTvwdzEkjSfEjwAAAYk"]
[Sun May 03 07:01:52.501156 2026] [:error] [pid 40456:tid 40460] [client 20.43.1.132:64374] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "afaCYDSujTvwdzEkjSfEkAAAAYI"]
[Sun May 03 07:01:52.925287 2026] [:error] [pid 40456:tid 40478] [client 20.43.1.132:64258] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "afaCYDSujTvwdzEkjSfEkwAAAZQ"]
[Sun May 03 07:01:53.348595 2026] [:error] [pid 37246:tid 37271] [client 20.43.1.132:36351] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "afaCYThvYFGNwhnPampZdgAAARU"]
[Sun May 03 07:01:53.770162 2026] [:error] [pid 37130:tid 37232] [client 20.43.1.132:36290] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "afaCYaIu7bmXKXicRk8mEQAAAJM"]
[Sun May 03 07:01:54.180878 2026] [:error] [pid 40456:tid 40468] [client 20.43.1.132:64349] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/nastar.php"] [unique_id "afaCYjSujTvwdzEkjSfElwAAAYo"]
[Sun May 03 07:01:54.604868 2026] [:error] [pid 40456:tid 40475] [client 20.43.1.132:64363] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/nastar.php"] [unique_id "afaCYjSujTvwdzEkjSfEmgAAAZE"]
[Sun May 03 07:01:55.030825 2026] [:error] [pid 37126:tid 37177] [client 20.43.1.132:64263] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/nastar.php"] [unique_id "afaCY_R_A42N-LtDyrvWOgAAABg"]
[Sun May 03 07:01:55.449474 2026] [:error] [pid 37130:tid 37228] [client 20.43.1.132:36256] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/nastar.php"] [unique_id "afaCY6Iu7bmXKXicRk8mHgAAAI8"]
[Sun May 03 07:01:55.875157 2026] [:error] [pid 37126:tid 37175] [client 20.43.1.132:64280] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35_S.php"] [unique_id "afaCY_R_A42N-LtDyrvWPgAAABY"]
[Sun May 03 07:01:56.304013 2026] [:error] [pid 40386:tid 40407] [client 20.43.1.132:36325] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35_S.php"] [unique_id "afaCZFHJDYRXUf3IbRTRwgAAANM"]
[Sun May 03 07:01:56.726295 2026] [:error] [pid 37130:tid 37220] [client 20.43.1.132:64325] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35_S.php"] [unique_id "afaCZKIu7bmXKXicRk8mJwAAAIc"]
[Sun May 03 07:01:57.141167 2026] [:error] [pid 37130:tid 37214] [client 20.43.1.132:64357] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35_S.php"] [unique_id "afaCZaIu7bmXKXicRk8mKgAAAIE"]
[Sun May 03 07:01:57.581451 2026] [:error] [pid 37246:tid 37252] [client 20.43.1.132:64364] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "afaCZThvYFGNwhnPampZdwAAAQQ"]
[Sun May 03 07:01:57.994268 2026] [:error] [pid 37246:tid 37264] [client 20.43.1.132:64307] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "afaCZThvYFGNwhnPampZeAAAAQ4"]
[Sun May 03 07:01:58.416160 2026] [:error] [pid 37246:tid 37251] [client 20.43.1.132:36296] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "afaCZjhvYFGNwhnPampZewAAAQM"]
[Sun May 03 07:01:58.832373 2026] [:error] [pid 37126:tid 37171] [client 20.43.1.132:36305] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "afaCZvR_A42N-LtDyrvWQwAAABI"]
[Sun May 03 07:01:59.245357 2026] [:error] [pid 37127:tid 37190] [client 20.43.1.132:21380] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "afaCZ_8khJXb5O5aWVXOYQAAAEY"]
[Sun May 03 07:01:59.670339 2026] [:error] [pid 40386:tid 40408] [client 20.43.1.132:64320] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "afaCZ1HJDYRXUf3IbRTRyAAAANQ"]
[Sun May 03 07:02:00.087038 2026] [:error] [pid 40386:tid 40400] [client 20.43.1.132:64336] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "afaCaFHJDYRXUf3IbRTRyQAAAMw"]
[Sun May 03 07:02:00.506125 2026] [:error] [pid 40456:tid 40458] [client 20.43.1.132:64266] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/111.php"] [unique_id "afaCaDSujTvwdzEkjSfEpQAAAYA"]
[Sun May 03 07:02:00.917946 2026] [:error] [pid 37246:tid 37250] [client 20.43.1.132:64330] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "afaCaDhvYFGNwhnPampZfwAAAQI"]
[Sun May 03 07:02:01.348887 2026] [:error] [pid 40456:tid 40473] [client 20.43.1.132:36273] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "afaCaTSujTvwdzEkjSfErQAAAY8"]
[Sun May 03 07:02:01.802624 2026] [:error] [pid 37246:tid 37255] [client 20.43.1.132:36278] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "afaCaThvYFGNwhnPampZgwAAAQc"]
[Sun May 03 07:02:02.224105 2026] [:error] [pid 37246:tid 37273] [client 20.43.1.132:21464] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp1.php"] [unique_id "afaCajhvYFGNwhnPampZhgAAARc"]
[Sun May 03 07:02:02.660762 2026] [:error] [pid 37246:tid 37264] [client 20.43.1.132:64359] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "afaCajhvYFGNwhnPampZiQAAAQ4"]
[Sun May 03 07:02:03.078195 2026] [:error] [pid 40456:tid 40463] [client 20.43.1.132:64380] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "afaCazSujTvwdzEkjSfEsgAAAYU"]
[Sun May 03 07:02:03.502732 2026] [:error] [pid 40422:tid 40442] [client 20.43.1.132:64295] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "afaCa0HBbBLrXh6PButg0gAAAVA"]
[Sun May 03 07:02:03.919017 2026] [:error] [pid 40456:tid 40462] [client 20.43.1.132:64264] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aligk.php"] [unique_id "afaCazSujTvwdzEkjSfEtgAAAYQ"]
[Sun May 03 07:02:04.334458 2026] [:error] [pid 40456:tid 40458] [client 20.43.1.132:36274] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "afaCbDSujTvwdzEkjSfEtwAAAYA"]
[Sun May 03 07:02:04.751468 2026] [:error] [pid 40456:tid 40470] [client 20.43.1.132:36340] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "afaCbDSujTvwdzEkjSfEuQAAAYw"]
[Sun May 03 07:02:05.162731 2026] [:error] [pid 37246:tid 37259] [client 20.43.1.132:64302] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "afaCbThvYFGNwhnPampZkgAAAQo"]
[Sun May 03 07:02:05.610112 2026] [:error] [pid 37246:tid 37249] [client 20.43.1.132:21470] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byrgo.php"] [unique_id "afaCbThvYFGNwhnPampZlQAAAQE"]
[Sun May 03 07:02:06.022502 2026] [:error] [pid 37246:tid 37269] [client 20.43.1.132:64350] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwpg.php"] [unique_id "afaCbjhvYFGNwhnPampZnAAAARM"]
[Sun May 03 07:02:06.444865 2026] [:error] [pid 37246:tid 37268] [client 20.43.1.132:64312] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwpg.php"] [unique_id "afaCbjhvYFGNwhnPampZngAAARI"]
[Sun May 03 07:02:06.856198 2026] [:error] [pid 37126:tid 37168] [client 20.43.1.132:64344] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwpg.php"] [unique_id "afaCbvR_A42N-LtDyrvWSwAAAA8"]
[Sun May 03 07:02:07.274668 2026] [:error] [pid 37246:tid 37274] [client 20.43.1.132:36295] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwpg.php"] [unique_id "afaCbzhvYFGNwhnPampZoQAAARg"]
[Sun May 03 07:02:07.687487 2026] [:error] [pid 37126:tid 37171] [client 20.43.1.132:64272] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ass.php"] [unique_id "afaCb_R_A42N-LtDyrvWTAAAABI"]
[Sun May 03 07:02:08.099684 2026] [:error] [pid 37130:tid 37214] [client 20.43.1.132:21459] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ass.php"] [unique_id "afaCcKIu7bmXKXicRk8mNQAAAIE"]
[Sun May 03 07:02:08.511082 2026] [:error] [pid 37130:tid 37231] [client 20.43.1.132:64358] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ass.php"] [unique_id "afaCcKIu7bmXKXicRk8mNgAAAJI"]
[Sun May 03 07:02:08.936946 2026] [:error] [pid 40422:tid 40446] [client 20.43.1.132:64267] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ass.php"] [unique_id "afaCcEHBbBLrXh6PButg1AAAAVQ"]
[Sun May 03 07:02:09.349718 2026] [:error] [pid 37130:tid 37235] [client 20.43.1.132:64298] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "afaCcaIu7bmXKXicRk8mOwAAAJY"]
[Sun May 03 07:02:09.784727 2026] [:error] [pid 37246:tid 37254] [client 20.43.1.132:21447] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "afaCcThvYFGNwhnPampZqAAAAQY"]
[Sun May 03 07:02:10.199904 2026] [:error] [pid 37246:tid 37251] [client 20.43.1.132:21498] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "afaCcjhvYFGNwhnPampZqgAAAQM"]
[Sun May 03 07:02:10.613900 2026] [:error] [pid 37127:tid 37189] [client 20.43.1.132:64354] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "afaCcv8khJXb5O5aWVXOZAAAAEU"]
[Sun May 03 07:02:11.027797 2026] [:error] [pid 37126:tid 37174] [client 20.43.1.132:21419] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "afaCc_R_A42N-LtDyrvWTQAAABU"]
[Sun May 03 07:02:11.450429 2026] [:error] [pid 40386:tid 40401] [client 20.43.1.132:64346] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "afaCc1HJDYRXUf3IbRTR1AAAAM0"]
[Sun May 03 07:02:11.891963 2026] [:error] [pid 40456:tid 40472] [client 20.43.1.132:64314] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "afaCczSujTvwdzEkjSfEwwAAAY4"]
[Sun May 03 07:02:12.306435 2026] [:error] [pid 40456:tid 40482] [client 20.43.1.132:36309] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no18.php"] [unique_id "afaCdDSujTvwdzEkjSfExAAAAZg"]
[Sun May 03 07:02:12.719169 2026] [:error] [pid 40456:tid 40463] [client 20.43.1.132:64333] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fine.php"] [unique_id "afaCdDSujTvwdzEkjSfExwAAAYU"]
[Sun May 03 07:02:13.141132 2026] [:error] [pid 40456:tid 40478] [client 20.43.1.132:64348] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fine.php"] [unique_id "afaCdTSujTvwdzEkjSfEyQAAAZQ"]
[Sun May 03 07:02:13.556307 2026] [:error] [pid 37130:tid 37232] [client 20.43.1.132:64381] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fine.php"] [unique_id "afaCdaIu7bmXKXicRk8mPgAAAJM"]
[Sun May 03 07:02:13.978532 2026] [:error] [pid 40422:tid 40447] [client 20.43.1.132:64338] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fine.php"] [unique_id "afaCdUHBbBLrXh6PButg2QAAAVU"]
[Sun May 03 07:02:14.411100 2026] [:error] [pid 37127:tid 37206] [client 20.43.1.132:36229] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "afaCdv8khJXb5O5aWVXOaAAAAFQ"]
[Sun May 03 07:02:14.833711 2026] [:error] [pid 37127:tid 37192] [client 20.43.1.132:21500] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "afaCdv8khJXb5O5aWVXOaQAAAEg"]
[Sun May 03 07:02:15.250044 2026] [:error] [pid 40386:tid 40408] [client 20.43.1.132:36262] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "afaCd1HJDYRXUf3IbRTR1wAAANQ"]
[Sun May 03 07:02:15.669294 2026] [:error] [pid 37246:tid 37251] [client 20.43.1.132:64319] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "afaCdzhvYFGNwhnPampZuwAAAQM"]
[Sun May 03 07:02:16.086357 2026] [:error] [pid 40422:tid 40444] [client 20.43.1.132:64347] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "afaCeEHBbBLrXh6PButg2gAAAVI"]
[Sun May 03 07:02:16.497967 2026] [:error] [pid 40456:tid 40470] [client 20.43.1.132:64376] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "afaCeDSujTvwdzEkjSfEzwAAAYw"]
[Sun May 03 07:02:16.933539 2026] [:error] [pid 40386:tid 40412] [client 20.43.1.132:21476] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "afaCeFHJDYRXUf3IbRTR2AAAANg"]
[Sun May 03 07:02:17.356596 2026] [:error] [pid 37127:tid 37198] [client 20.43.1.132:64291] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "afaCef8khJXb5O5aWVXOagAAAE0"]
[Sun May 03 07:02:17.772855 2026] [:error] [pid 37246:tid 37254] [client 20.43.1.132:64256] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "afaCeThvYFGNwhnPampZxAAAAQY"]
[Sun May 03 07:02:18.191753 2026] [:error] [pid 37246:tid 37274] [client 20.43.1.132:64283] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "afaCejhvYFGNwhnPampZxgAAARg"]
[Sun May 03 07:02:18.606484 2026] [:error] [pid 37127:tid 37208] [client 20.43.1.132:64366] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "afaCev8khJXb5O5aWVXObQAAAFY"]
[Sun May 03 07:02:19.027359 2026] [:error] [pid 37127:tid 37188] [client 20.43.1.132:21450] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "afaCe_8khJXb5O5aWVXObwAAAEQ"]
[Sun May 03 07:02:19.443213 2026] [:error] [pid 37126:tid 37156] [client 20.43.1.132:21448] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "afaCe_R_A42N-LtDyrvWTwAAAAM"]
[Sun May 03 07:02:19.862133 2026] [:error] [pid 37246:tid 37248] [client 20.43.1.132:64283] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "afaCezhvYFGNwhnPampZzAAAAQA"]
[Sun May 03 07:02:20.279331 2026] [:error] [pid 37130:tid 37231] [client 20.43.1.132:64372] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "afaCfKIu7bmXKXicRk8mQAAAAJI"]
[Sun May 03 07:02:20.692158 2026] [:error] [pid 37130:tid 37229] [client 20.43.1.132:21451] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inege.php"] [unique_id "afaCfKIu7bmXKXicRk8mQQAAAJA"]
[Sun May 03 07:02:21.113153 2026] [:error] [pid 37246:tid 37265] [client 20.43.1.132:64317] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "afaCfThvYFGNwhnPampZ0QAAAQ8"]
[Sun May 03 07:02:21.535458 2026] [:error] [pid 37246:tid 37256] [client 20.43.1.132:36241] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "afaCfThvYFGNwhnPampZ1QAAAQg"]
[Sun May 03 07:02:21.957564 2026] [:error] [pid 40456:tid 40463] [client 20.43.1.132:64355] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "afaCfTSujTvwdzEkjSfE0gAAAYU"]
[Sun May 03 07:02:22.370511 2026] [:error] [pid 37130:tid 37222] [client 20.43.1.132:64303] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "afaCfqIu7bmXKXicRk8mQwAAAIk"]
[Sun May 03 07:02:22.786897 2026] [:error] [pid 40456:tid 40474] [client 20.43.1.132:64375] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "afaCfjSujTvwdzEkjSfE0wAAAZA"]
[Sun May 03 07:02:23.213133 2026] [:error] [pid 40422:tid 40435] [client 20.43.1.132:21392] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "afaCf0HBbBLrXh6PButg2wAAAUk"]
[Sun May 03 07:02:23.630075 2026] [:error] [pid 40456:tid 40476] [client 20.43.1.132:64352] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "afaCfzSujTvwdzEkjSfE1QAAAZI"]
[Sun May 03 07:02:24.041183 2026] [:error] [pid 40456:tid 40462] [client 20.43.1.132:64368] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uuu.php"] [unique_id "afaCgDSujTvwdzEkjSfE2QAAAYQ"]
[Sun May 03 07:02:24.467410 2026] [:error] [pid 37246:tid 37265] [client 20.43.1.132:64257] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "afaCgDhvYFGNwhnPampZ2gAAAQ8"]
[Sun May 03 07:02:24.880993 2026] [:error] [pid 40456:tid 40458] [client 20.43.1.132:64369] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "afaCgDSujTvwdzEkjSfE2gAAAYA"]
[Sun May 03 07:02:25.307299 2026] [:error] [pid 40456:tid 40471] [client 20.43.1.132:64289] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "afaCgTSujTvwdzEkjSfE2wAAAY0"]
[Sun May 03 07:02:25.727388 2026] [:error] [pid 40456:tid 40469] [client 20.43.1.132:64297] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/no1.php"] [unique_id "afaCgTSujTvwdzEkjSfE3AAAAYs"]
[Sun May 03 07:02:26.171191 2026] [:error] [pid 40456:tid 40477] [client 20.43.1.132:21383] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "afaCgjSujTvwdzEkjSfE3gAAAZM"]
[Sun May 03 07:02:26.582768 2026] [:error] [pid 40422:tid 40426] [client 20.43.1.132:64279] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "afaCgkHBbBLrXh6PButg3wAAAUA"]
[Sun May 03 07:02:26.996100 2026] [:error] [pid 40456:tid 40467] [client 20.43.1.132:64315] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "afaCgjSujTvwdzEkjSfE4QAAAYk"]
[Sun May 03 07:02:27.415640 2026] [:error] [pid 37126:tid 37160] [client 20.43.1.132:64260] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/w2025.php"] [unique_id "afaCg_R_A42N-LtDyrvWVAAAAAc"]
[Sun May 03 07:02:27.833925 2026] [:error] [pid 40456:tid 40479] [client 20.43.1.132:21478] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "afaCgzSujTvwdzEkjSfE5AAAAZU"]
[Sun May 03 07:02:28.265325 2026] [:error] [pid 40456:tid 40464] [client 20.43.1.132:21453] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "afaChDSujTvwdzEkjSfE5wAAAYY"]
[Sun May 03 07:02:28.678554 2026] [:error] [pid 37130:tid 37233] [client 20.43.1.132:21474] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "afaChKIu7bmXKXicRk8mSwAAAJQ"]
[Sun May 03 07:02:29.107737 2026] [:error] [pid 37246:tid 37255] [client 20.43.1.132:64285] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fvvff.php"] [unique_id "afaChThvYFGNwhnPampZ6QAAAQc"]
[Sun May 03 07:02:29.530244 2026] [:error] [pid 40386:tid 40391] [client 20.43.1.132:21379] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "afaChVHJDYRXUf3IbRTR3QAAAMM"]
[Sun May 03 07:02:29.948384 2026] [:error] [pid 37126:tid 37162] [client 20.43.1.132:64282] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "afaChfR_A42N-LtDyrvWVgAAAAk"]
[Sun May 03 07:02:30.379879 2026] [:error] [pid 37246:tid 37261] [client 20.43.1.132:21460] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "afaChjhvYFGNwhnPampZ7AAAAQs"]
[Sun May 03 07:02:30.803615 2026] [:error] [pid 37246:tid 37253] [client 20.43.1.132:21391] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a2.php"] [unique_id "afaChjhvYFGNwhnPampZ7QAAAQU"]
[Sun May 03 07:02:31.216618 2026] [:error] [pid 40422:tid 40427] [client 20.43.1.132:36315] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "afaCh0HBbBLrXh6PButg5AAAAUE"]
[Sun May 03 07:02:31.631961 2026] [:error] [pid 37130:tid 37231] [client 20.43.1.132:21443] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "afaCh6Iu7bmXKXicRk8mUAAAAJI"]
[Sun May 03 07:02:32.048398 2026] [:error] [pid 37130:tid 37229] [client 20.43.1.132:64318] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "afaCiKIu7bmXKXicRk8mUQAAAJA"]
[Sun May 03 07:02:32.475012 2026] [:error] [pid 40386:tid 40403] [client 20.43.1.132:21415] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "afaCiFHJDYRXUf3IbRTR4QAAAM8"]
[Sun May 03 07:02:32.895942 2026] [:error] [pid 40422:tid 40430] [client 20.43.1.132:21487] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "afaCiEHBbBLrXh6PButg5wAAAUQ"]
[Sun May 03 07:02:33.314784 2026] [:error] [pid 37130:tid 37227] [client 20.43.1.132:21457] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "afaCiaIu7bmXKXicRk8mVgAAAI4"]
[Sun May 03 07:02:33.731562 2026] [:error] [pid 37130:tid 37213] [client 20.43.1.132:64277] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "afaCiaIu7bmXKXicRk8mWQAAAIA"]
[Sun May 03 07:02:34.171651 2026] [:error] [pid 37130:tid 37234] [client 20.43.1.132:21440] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "afaCiqIu7bmXKXicRk8mXAAAAJU"]
[Sun May 03 07:02:34.584020 2026] [:error] [pid 37130:tid 37219] [client 20.43.1.132:64309] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "afaCiqIu7bmXKXicRk8mXwAAAIY"]
[Sun May 03 07:02:35.001505 2026] [:error] [pid 40386:tid 40408] [client 20.43.1.132:21488] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "afaCi1HJDYRXUf3IbRTR5QAAANQ"]
[Sun May 03 07:02:35.450541 2026] [:error] [pid 40386:tid 40410] [client 20.43.1.132:21385] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "afaCi1HJDYRXUf3IbRTR6QAAANY"]
[Sun May 03 07:02:35.870051 2026] [:error] [pid 40422:tid 40426] [client 20.43.1.132:21455] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "afaCi0HBbBLrXh6PButg6gAAAUA"]
[Sun May 03 07:02:36.291837 2026] [:error] [pid 40386:tid 40393] [client 20.43.1.132:64287] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "afaCjFHJDYRXUf3IbRTR7QAAAMU"]
[Sun May 03 07:02:36.709766 2026] [:error] [pid 40422:tid 40443] [client 20.43.1.132:21489] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "afaCjEHBbBLrXh6PButg7QAAAVE"]
[Sun May 03 07:02:37.126353 2026] [:error] [pid 40422:tid 40450] [client 20.43.1.132:21490] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "afaCjUHBbBLrXh6PButg8AAAAVg"]
[Sun May 03 07:02:37.545082 2026] [:error] [pid 40456:tid 40468] [client 20.43.1.132:64286] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/66.php"] [unique_id "afaCjTSujTvwdzEkjSfE9AAAAYo"]
[Sun May 03 07:02:37.963052 2026] [:error] [pid 37130:tid 37231] [client 20.43.1.132:36307] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "afaCjaIu7bmXKXicRk8mYwAAAJI"]
[Sun May 03 07:02:38.379408 2026] [:error] [pid 37246:tid 37253] [client 20.43.1.132:64269] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "afaCjjhvYFGNwhnPampZ8gAAAQU"]
[Sun May 03 07:02:38.799304 2026] [:error] [pid 40422:tid 40447] [client 20.43.1.132:64377] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "afaCjkHBbBLrXh6PButg9gAAAVU"]
[Sun May 03 07:02:39.219172 2026] [:error] [pid 37246:tid 37254] [client 20.43.1.132:21445] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "afaCjzhvYFGNwhnPampZ8wAAAQY"]
[Sun May 03 07:02:39.641073 2026] [:error] [pid 40422:tid 40439] [client 20.43.1.132:36297] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "afaCj0HBbBLrXh6PButg-QAAAU0"]
[Sun May 03 07:02:40.064630 2026] [:error] [pid 37127:tid 37202] [client 20.43.1.132:64327] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "afaCkP8khJXb5O5aWVXOdgAAAFE"]
[Sun May 03 07:02:40.475380 2026] [:error] [pid 37130:tid 37233] [client 20.43.1.132:64311] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "afaCkKIu7bmXKXicRk8maAAAAJQ"]
[Sun May 03 07:02:40.890614 2026] [:error] [pid 37127:tid 37207] [client 20.43.1.132:64305] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ol.php"] [unique_id "afaCkP8khJXb5O5aWVXOegAAAFU"]
[Sun May 03 07:02:41.320006 2026] [:error] [pid 37127:tid 37188] [client 20.43.1.132:64292] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "afaCkf8khJXb5O5aWVXOfAAAAEQ"]
[Sun May 03 07:02:41.740916 2026] [:error] [pid 37130:tid 37220] [client 20.43.1.132:64290] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "afaCkaIu7bmXKXicRk8mawAAAIc"]
[Sun May 03 07:02:42.154823 2026] [:error] [pid 40422:tid 40442] [client 20.43.1.132:21385] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "afaCkkHBbBLrXh6PButg-wAAAVA"]
[Sun May 03 07:02:42.615101 2026] [:error] [pid 40456:tid 40469] [client 20.43.1.132:21469] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "afaCkjSujTvwdzEkjSfE_wAAAYs"]
[Sun May 03 07:02:43.033517 2026] [:error] [pid 40456:tid 40477] [client 20.43.1.132:21465] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "afaCkzSujTvwdzEkjSfFAgAAAZM"]
[Sun May 03 07:02:43.446925 2026] [:error] [pid 37130:tid 37230] [client 20.43.1.132:21397] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "afaCk6Iu7bmXKXicRk8mbgAAAJE"]
[Sun May 03 07:02:43.859771 2026] [:error] [pid 37130:tid 37222] [client 20.43.1.132:64281] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "afaCk6Iu7bmXKXicRk8mcAAAAIk"]
[Sun May 03 07:02:44.273058 2026] [:error] [pid 40386:tid 40401] [client 20.43.1.132:21502] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "afaClFHJDYRXUf3IbRTR8gAAAM0"]
[Sun May 03 07:02:44.702562 2026] [:error] [pid 37126:tid 37171] [client 20.43.1.132:21475] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "afaClPR_A42N-LtDyrvWZgAAABI"]
[Sun May 03 07:02:45.119443 2026] [:error] [pid 37127:tid 37195] [client 20.43.1.132:21480] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "afaClf8khJXb5O5aWVXOhAAAAEs"]
[Sun May 03 07:02:45.535008 2026] [:error] [pid 40386:tid 40398] [client 20.43.1.132:36270] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "afaClVHJDYRXUf3IbRTR9QAAAMo"]
[Sun May 03 07:02:45.950925 2026] [:error] [pid 40386:tid 40393] [client 20.43.1.132:21472] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/style.php"] [unique_id "afaClVHJDYRXUf3IbRTR9gAAAMU"]
[Sun May 03 07:02:54.797763 2026] [autoindex:error] [pid 37126:tid 37173] [client 20.43.1.132:21384] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 03 07:02:59.472425 2026] [:error] [pid 37126:tid 37174] [client 20.43.1.132:21384] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "afaCo_R_A42N-LtDyrvWiQAAABU"]
[Sun May 03 07:02:59.892934 2026] [:error] [pid 40386:tid 40399] [client 20.43.1.132:64265] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "afaCo1HJDYRXUf3IbRTSBQAAAMs"]
[Sun May 03 07:03:00.315980 2026] [:error] [pid 37126:tid 37165] [client 20.43.1.132:21446] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "afaCpPR_A42N-LtDyrvWiwAAAAw"]
[Sun May 03 07:03:00.737715 2026] [:error] [pid 40456:tid 40462] [client 20.43.1.132:21326] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "afaCpDSujTvwdzEkjSfFIAAAAYQ"]
[Sun May 03 07:03:01.165067 2026] [:error] [pid 37126:tid 37175] [client 20.43.1.132:36286] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "afaCpfR_A42N-LtDyrvWjQAAABY"]
[Sun May 03 07:03:01.586005 2026] [:error] [pid 40422:tid 40442] [client 20.43.1.132:64316] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "afaCpUHBbBLrXh6PButhBQAAAVA"]
[Sun May 03 07:03:01.997698 2026] [:error] [pid 40422:tid 40449] [client 20.43.1.132:64284] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "afaCpUHBbBLrXh6PButhCQAAAVc"]
[Sun May 03 07:03:02.410885 2026] [:error] [pid 40422:tid 40430] [client 20.43.1.132:21442] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "afaCpkHBbBLrXh6PButhCgAAAUQ"]
[Sun May 03 07:03:02.826297 2026] [:error] [pid 40386:tid 40406] [client 20.43.1.132:64274] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "afaCplHJDYRXUf3IbRTSCAAAANI"]
[Sun May 03 07:03:03.246721 2026] [:error] [pid 40422:tid 40447] [client 20.43.1.132:64304] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "afaCp0HBbBLrXh6PButhDQAAAVU"]
[Sun May 03 07:03:03.671853 2026] [:error] [pid 40422:tid 40438] [client 20.43.1.132:21449] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "afaCp0HBbBLrXh6PButhDgAAAUw"]
[Sun May 03 07:03:04.120413 2026] [:error] [pid 40422:tid 40444] [client 20.43.1.132:21477] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fff.php"] [unique_id "afaCqEHBbBLrXh6PButhEQAAAVI"]
[Sun May 03 07:03:04.550857 2026] [:error] [pid 40386:tid 40401] [client 20.43.1.132:21463] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "afaCqFHJDYRXUf3IbRTSDQAAAM0"]
[Sun May 03 07:03:04.968186 2026] [:error] [pid 40422:tid 40439] [client 20.43.1.132:21492] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "afaCqEHBbBLrXh6PButhFAAAAU0"]
[Sun May 03 07:03:05.381883 2026] [:error] [pid 40422:tid 40436] [client 20.43.1.132:21452] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "afaCqUHBbBLrXh6PButhFgAAAUo"]
[Sun May 03 07:03:05.800090 2026] [:error] [pid 40422:tid 40442] [client 20.43.1.132:21503] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "afaCqUHBbBLrXh6PButhGAAAAVA"]
[Sun May 03 07:03:06.222952 2026] [:error] [pid 40422:tid 40443] [client 20.43.1.132:21454] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "afaCqkHBbBLrXh6PButhGwAAAVE"]
[Sun May 03 07:03:06.643314 2026] [:error] [pid 40422:tid 40447] [client 20.43.1.132:21429] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "afaCqkHBbBLrXh6PButhHQAAAVU"]
[Sun May 03 07:03:07.069540 2026] [:error] [pid 40422:tid 40439] [client 20.43.1.132:21467] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "afaCq0HBbBLrXh6PButhHgAAAU0"]
[Sun May 03 07:03:07.508738 2026] [:error] [pid 37126:tid 37171] [client 20.43.1.132:21461] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "afaCq_R_A42N-LtDyrvWjgAAABI"]
[Sun May 03 07:03:07.925964 2026] [:error] [pid 37126:tid 37151] [client 20.43.1.132:21404] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "afaCq_R_A42N-LtDyrvWkAAAAAA"]
[Sun May 03 07:03:08.375990 2026] [:error] [pid 40456:tid 40480] [client 20.43.1.132:21497] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "afaCrDSujTvwdzEkjSfFIgAAAZY"]
[Sun May 03 07:03:08.799036 2026] [:error] [pid 40386:tid 40397] [client 20.43.1.132:21325] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "afaCrFHJDYRXUf3IbRTSFAAAAMk"]
[Sun May 03 07:03:09.235254 2026] [:error] [pid 40386:tid 40407] [client 20.43.1.132:21377] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/makeasmtp.php"] [unique_id "afaCrVHJDYRXUf3IbRTSFgAAANM"]
[Sun May 03 07:03:09.653968 2026] [:error] [pid 37127:tid 37184] [client 20.43.1.132:21485] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin1.php"] [unique_id "afaCrf8khJXb5O5aWVXOkwAAAEA"]
[Sun May 03 07:03:10.085025 2026] [:error] [pid 37246:tid 37263] [client 20.43.1.132:36284] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin1.php"] [unique_id "afaCrjhvYFGNwhnPampZ-gAAAQ0"]
[Sun May 03 07:03:10.504576 2026] [:error] [pid 40386:tid 40401] [client 20.43.1.132:64268] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin1.php"] [unique_id "afaCrlHJDYRXUf3IbRTSGgAAAM0"]
[Sun May 03 07:03:10.930576 2026] [:error] [pid 37127:tid 37209] [client 20.43.1.132:21433] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin1.php"] [unique_id "afaCrv8khJXb5O5aWVXOlAAAAFc"]
[Sun May 03 07:03:11.366837 2026] [:error] [pid 40386:tid 40402] [client 20.43.1.132:21471] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "afaCr1HJDYRXUf3IbRTSHAAAAM4"]
[Sun May 03 07:03:11.792635 2026] [:error] [pid 37127:tid 37187] [client 20.43.1.132:64313] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "afaCr_8khJXb5O5aWVXOlQAAAEM"]
[Sun May 03 07:03:12.208509 2026] [:error] [pid 37130:tid 37233] [client 20.43.1.132:21412] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "afaCsKIu7bmXKXicRk8mkAAAAJQ"]
[Sun May 03 07:03:12.624099 2026] [:error] [pid 40386:tid 40396] [client 20.43.1.132:21387] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "afaCsFHJDYRXUf3IbRTSIQAAAMg"]
[Sun May 03 07:03:13.043775 2026] [:error] [pid 37127:tid 37194] [client 20.43.1.132:21386] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "afaCsf8khJXb5O5aWVXOlgAAAEo"]
[Sun May 03 07:03:13.469657 2026] [:error] [pid 40386:tid 40407] [client 20.43.1.132:36304] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "afaCsVHJDYRXUf3IbRTSJAAAANM"]
[Sun May 03 07:03:13.889290 2026] [:error] [pid 37246:tid 37252] [client 20.43.1.132:21381] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "afaCsThvYFGNwhnPampZ_QAAAQQ"]
[Sun May 03 07:03:14.311380 2026] [:error] [pid 37126:tid 37159] [client 20.43.1.132:21435] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "afaCsvR_A42N-LtDyrvWlgAAAAY"]
[Sun May 03 07:03:14.742218 2026] [:error] [pid 37127:tid 37193] [client 20.43.1.132:64300] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "afaCsv8khJXb5O5aWVXOmAAAAEk"]
[Sun May 03 07:03:15.163841 2026] [:error] [pid 40456:tid 40466] [client 20.43.1.132:21366] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "afaCszSujTvwdzEkjSfFKgAAAYg"]
[Sun May 03 07:03:15.585917 2026] [:error] [pid 40422:tid 40436] [client 20.43.1.132:64288] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "afaCs0HBbBLrXh6PButhIQAAAUo"]
[Sun May 03 07:03:16.002169 2026] [:error] [pid 40422:tid 40433] [client 20.43.1.132:21323] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "afaCtEHBbBLrXh6PButhIgAAAUc"]
[Sun May 03 07:03:16.441022 2026] [:error] [pid 40422:tid 40450] [client 20.43.1.132:36313] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "afaCtEHBbBLrXh6PButhIwAAAVg"]
[Sun May 03 07:03:16.863299 2026] [:error] [pid 40422:tid 40449] [client 20.43.1.132:21499] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "afaCtEHBbBLrXh6PButhJQAAAVc"]
[Sun May 03 07:03:17.299716 2026] [:error] [pid 37127:tid 37189] [client 20.43.1.132:64273] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "afaCtf8khJXb5O5aWVXOmwAAAEU"]
[Sun May 03 07:03:17.725515 2026] [:error] [pid 37127:tid 37195] [client 20.43.1.132:21421] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "afaCtf8khJXb5O5aWVXOnAAAAEs"]
[Sun May 03 07:03:18.151697 2026] [:error] [pid 37246:tid 37259] [client 20.43.1.132:21416] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "afaCtjhvYFGNwhnPampaAAAAAQo"]
[Sun May 03 07:03:18.568889 2026] [:error] [pid 37246:tid 37250] [client 20.43.1.132:21427] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "afaCtjhvYFGNwhnPampaAgAAAQI"]
[Sun May 03 07:03:18.987014 2026] [:error] [pid 40422:tid 40447] [client 20.43.1.132:36266] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "afaCtkHBbBLrXh6PButhLgAAAVU"]
[Sun May 03 07:03:19.405890 2026] [:error] [pid 37130:tid 37222] [client 20.43.1.132:21361] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "afaCt6Iu7bmXKXicRk8mkwAAAIk"]
[Sun May 03 07:03:19.827003 2026] [:error] [pid 37130:tid 37231] [client 20.43.1.132:21458] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "afaCt6Iu7bmXKXicRk8mlAAAAJI"]
[Sun May 03 07:03:20.245574 2026] [:error] [pid 40386:tid 40404] [client 20.43.1.132:21491] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "afaCuFHJDYRXUf3IbRTSLAAAANA"]
[Sun May 03 07:03:20.657778 2026] [:error] [pid 40422:tid 40437] [client 20.43.1.132:21441] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "afaCuEHBbBLrXh6PButhLwAAAUs"]
[Sun May 03 07:03:21.074090 2026] [:error] [pid 37126:tid 37171] [client 20.43.1.132:21483] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/fi.php"] [unique_id "afaCufR_A42N-LtDyrvWmwAAABI"]
[Sun May 03 07:03:21.486550 2026] [:error] [pid 40386:tid 40400] [client 20.43.1.132:21423] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "afaCuVHJDYRXUf3IbRTSLwAAAMw"]
[Sun May 03 07:03:21.907730 2026] [:error] [pid 37127:tid 37199] [client 20.43.1.132:21329] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "afaCuf8khJXb5O5aWVXOnwAAAE4"]
[Sun May 03 07:03:22.328995 2026] [:error] [pid 37246:tid 37264] [client 20.43.1.132:21418] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "afaCujhvYFGNwhnPampaBgAAAQ4"]
[Sun May 03 07:03:22.746401 2026] [:error] [pid 37130:tid 37220] [client 20.43.1.132:21481] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fe5.php"] [unique_id "afaCuqIu7bmXKXicRk8mmAAAAIc"]
[Sun May 03 07:03:23.163737 2026] [:error] [pid 37130:tid 37221] [client 20.43.1.132:21462] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "afaCu6Iu7bmXKXicRk8mmQAAAIg"]
[Sun May 03 07:03:23.603182 2026] [:error] [pid 37246:tid 37268] [client 20.43.1.132:21378] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "afaCuzhvYFGNwhnPampaCQAAARI"]
[Sun May 03 07:03:24.022787 2026] [:error] [pid 37246:tid 37272] [client 20.43.1.132:21312] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "afaCvDhvYFGNwhnPampaCwAAARY"]
[Sun May 03 07:03:24.454972 2026] [:error] [pid 37246:tid 37248] [client 20.43.1.132:21315] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "afaCvDhvYFGNwhnPampaDQAAAQA"]
[Sun May 03 07:03:24.873158 2026] [:error] [pid 37246:tid 37273] [client 20.43.1.132:64299] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "afaCvDhvYFGNwhnPampaEQAAARc"]
[Sun May 03 07:03:25.296787 2026] [:error] [pid 40386:tid 40397] [client 20.43.1.132:21355] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "afaCvVHJDYRXUf3IbRTSMwAAAMk"]
[Sun May 03 07:03:25.725412 2026] [:error] [pid 40386:tid 40396] [client 20.43.1.132:21411] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "afaCvVHJDYRXUf3IbRTSNAAAAMg"]
[Sun May 03 07:03:26.142536 2026] [:error] [pid 40386:tid 40395] [client 20.43.1.132:36344] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "afaCvlHJDYRXUf3IbRTSOAAAAMc"]
[Sun May 03 07:03:26.566674 2026] [:error] [pid 40456:tid 40459] [client 20.43.1.132:64259] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "afaCvjSujTvwdzEkjSfFLgAAAYE"]
[Sun May 03 07:03:26.982100 2026] [:error] [pid 37246:tid 37271] [client 20.43.1.132:64361] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "afaCvjhvYFGNwhnPampaEwAAARU"]
[Sun May 03 07:03:27.399568 2026] [:error] [pid 37246:tid 37252] [client 20.43.1.132:21482] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "afaCvzhvYFGNwhnPampaFgAAAQQ"]
[Sun May 03 07:03:27.820032 2026] [:error] [pid 37246:tid 37251] [client 20.43.1.132:21468] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "afaCvzhvYFGNwhnPampaGAAAAQM"]
[Sun May 03 07:03:28.241335 2026] [:error] [pid 37246:tid 37250] [client 20.43.1.132:21400] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "afaCwDhvYFGNwhnPampaGQAAAQI"]
[Sun May 03 07:03:28.661218 2026] [:error] [pid 40456:tid 40478] [client 20.43.1.132:21398] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "afaCwDSujTvwdzEkjSfFLwAAAZQ"]
[Sun May 03 07:03:29.073714 2026] [:error] [pid 37126:tid 37166] [client 20.43.1.132:21410] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "afaCwfR_A42N-LtDyrvWoAAAAA0"]
[Sun May 03 07:03:29.493511 2026] [:error] [pid 40456:tid 40474] [client 20.43.1.132:21331] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "afaCwTSujTvwdzEkjSfFMQAAAZA"]
[Sun May 03 07:03:29.913748 2026] [:error] [pid 40422:tid 40433] [client 20.43.1.132:64271] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "afaCwUHBbBLrXh6PButhOQAAAUc"]
[Sun May 03 07:03:30.334295 2026] [:error] [pid 37246:tid 37268] [client 20.43.1.132:21324] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "afaCwjhvYFGNwhnPampaHgAAARI"]
[Sun May 03 07:03:30.764626 2026] [:error] [pid 37246:tid 37251] [client 20.43.1.132:64275] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "afaCwjhvYFGNwhnPampaIAAAAQM"]
[Sun May 03 07:03:31.185434 2026] [:error] [pid 37246:tid 37255] [client 20.43.1.132:21335] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "afaCwzhvYFGNwhnPampaJQAAAQc"]
[Sun May 03 07:03:31.609638 2026] [:error] [pid 37246:tid 37256] [client 20.43.1.132:21486] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "afaCwzhvYFGNwhnPampaJwAAAQg"]
[Sun May 03 07:03:32.030609 2026] [:error] [pid 37127:tid 37195] [client 20.43.1.132:21405] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "afaCxP8khJXb5O5aWVXOpgAAAEs"]
[Sun May 03 07:03:32.452504 2026] [:error] [pid 37126:tid 37152] [client 20.43.1.132:21425] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "afaCxPR_A42N-LtDyrvWoQAAAAE"]
[Sun May 03 07:03:32.874172 2026] [:error] [pid 40386:tid 40405] [client 20.43.1.132:21390] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "afaCxFHJDYRXUf3IbRTSPAAAANE"]
[Sun May 03 07:03:33.291217 2026] [:error] [pid 37130:tid 37231] [client 20.43.1.132:21484] [client 20.43.1.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afaCxaIu7bmXKXicRk8moAAAAJI"]
[Sun May 03 07:03:33.714496 2026] [:error] [pid 37127:tid 37198] [client 20.43.1.132:64294] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "afaCxf8khJXb5O5aWVXOpwAAAE0"]
[Sun May 03 07:03:34.134140 2026] [:error] [pid 37130:tid 37221] [client 20.43.1.132:21420] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "afaCxqIu7bmXKXicRk8moQAAAIg"]
[Sun May 03 07:03:34.558900 2026] [:error] [pid 37127:tid 37210] [client 20.43.1.132:21414] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "afaCxv8khJXb5O5aWVXOqgAAAFg"]
[Sun May 03 07:03:34.977873 2026] [:error] [pid 37127:tid 37209] [client 20.43.1.132:21319] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "afaCxv8khJXb5O5aWVXOqwAAAFc"]
[Sun May 03 07:03:35.395877 2026] [:error] [pid 37246:tid 37257] [client 20.43.1.132:21343] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "afaCxzhvYFGNwhnPampaKgAAAQk"]
[Sun May 03 07:03:35.813449 2026] [:error] [pid 37130:tid 37218] [client 20.43.1.132:21437] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "afaCx6Iu7bmXKXicRk8mpAAAAIU"]
[Sun May 03 07:03:36.227590 2026] [:error] [pid 40386:tid 40395] [client 20.43.1.132:21284] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "afaCyFHJDYRXUf3IbRTSPQAAAMc"]
[Sun May 03 07:03:36.645052 2026] [:error] [pid 37127:tid 37200] [client 20.43.1.132:21431] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "afaCyP8khJXb5O5aWVXOrgAAAE8"]
[Sun May 03 07:03:37.065916 2026] [:error] [pid 40456:tid 40477] [client 20.43.1.132:21496] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "afaCyTSujTvwdzEkjSfFNQAAAZM"]
[Sun May 03 07:03:37.478877 2026] [:error] [pid 37130:tid 37223] [client 20.43.1.132:21394] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "afaCyaIu7bmXKXicRk8mpwAAAIo"]
[Sun May 03 07:03:37.899846 2026] [:error] [pid 37127:tid 37185] [client 20.43.1.132:21424] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "afaCyf8khJXb5O5aWVXOsAAAAEE"]
[Sun May 03 07:03:38.328998 2026] [:error] [pid 37246:tid 37272] [client 20.43.1.132:21340] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "afaCyjhvYFGNwhnPampaMQAAARY"]
[Sun May 03 07:03:38.751805 2026] [:error] [pid 37246:tid 37269] [client 20.43.1.132:21271] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "afaCyjhvYFGNwhnPampaNQAAARM"]
[Sun May 03 07:03:39.176726 2026] [:error] [pid 37246:tid 37252] [client 20.43.1.132:21402] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "afaCyzhvYFGNwhnPampaOAAAAQQ"]
[Sun May 03 07:03:39.610890 2026] [:error] [pid 37246:tid 37270] [client 20.43.1.132:21409] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "afaCyzhvYFGNwhnPampaOgAAARQ"]
[Sun May 03 07:03:40.028706 2026] [:error] [pid 37246:tid 37262] [client 20.43.1.132:21264] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev.php"] [unique_id "afaCzDhvYFGNwhnPampaPwAAAQw"]
[Sun May 03 07:03:40.452220 2026] [:error] [pid 37130:tid 37235] [client 20.43.1.132:21339] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev.php"] [unique_id "afaCzKIu7bmXKXicRk8mqQAAAJY"]
[Sun May 03 07:03:40.874605 2026] [:error] [pid 37246:tid 37265] [client 20.43.1.132:21493] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev.php"] [unique_id "afaCzDhvYFGNwhnPampaQgAAAQ8"]
[Sun May 03 07:03:41.295791 2026] [:error] [pid 40386:tid 40409] [client 20.43.1.132:21362] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev.php"] [unique_id "afaCzVHJDYRXUf3IbRTSPgAAANU"]
[Sun May 03 07:03:41.723185 2026] [:error] [pid 37127:tid 37209] [client 20.43.1.132:21501] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "afaCzf8khJXb5O5aWVXOtQAAAFc"]
[Sun May 03 07:03:42.140453 2026] [:error] [pid 37130:tid 37224] [client 20.43.1.132:21382] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "afaCzqIu7bmXKXicRk8mrQAAAIs"]
[Sun May 03 07:03:42.569732 2026] [:error] [pid 40456:tid 40469] [client 20.43.1.132:64270] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "afaCzjSujTvwdzEkjSfFNwAAAYs"]
[Sun May 03 07:03:42.984099 2026] [:error] [pid 40456:tid 40473] [client 20.43.1.132:21479] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "afaCzjSujTvwdzEkjSfFOAAAAY8"]
[Sun May 03 07:03:43.412445 2026] [:error] [pid 40422:tid 40426] [client 20.43.1.132:21266] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "afaCz0HBbBLrXh6PButhQQAAAUA"]
[Sun May 03 07:03:43.828725 2026] [:error] [pid 37126:tid 37174] [client 20.43.1.132:36295] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "afaCz_R_A42N-LtDyrvWowAAABU"]
[Sun May 03 07:03:44.246402 2026] [:error] [pid 40386:tid 40390] [client 20.43.1.132:21260] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "afaC0FHJDYRXUf3IbRTSQAAAAMI"]
[Sun May 03 07:03:44.672782 2026] [:error] [pid 40422:tid 40448] [client 20.43.1.132:21300] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "afaC0EHBbBLrXh6PButhRAAAAVY"]
[Sun May 03 07:03:45.105813 2026] [:error] [pid 40386:tid 40403] [client 20.43.1.132:21327] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "afaC0VHJDYRXUf3IbRTSQgAAAM8"]
[Sun May 03 07:03:45.546324 2026] [:error] [pid 40422:tid 40432] [client 20.43.1.132:21495] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "afaC0UHBbBLrXh6PButhRQAAAUY"]
[Sun May 03 07:03:45.966579 2026] [:error] [pid 40386:tid 40401] [client 20.43.1.132:21389] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "afaC0VHJDYRXUf3IbRTSRAAAAM0"]
[Sun May 03 07:03:46.414047 2026] [:error] [pid 40422:tid 40438] [client 20.43.1.132:21316] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gssdd.php"] [unique_id "afaC0kHBbBLrXh6PButhRwAAAUw"]
[Sun May 03 07:03:46.828140 2026] [:error] [pid 37127:tid 37186] [client 20.43.1.132:21313] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/admin.php"] [unique_id "afaC0v8khJXb5O5aWVXOuAAAAEI"]
[Sun May 03 07:03:47.257732 2026] [:error] [pid 40386:tid 40398] [client 20.43.1.132:21359] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/admin.php"] [unique_id "afaC01HJDYRXUf3IbRTSSAAAAMo"]
[Sun May 03 07:03:47.674317 2026] [:error] [pid 40386:tid 40392] [client 20.43.1.132:21466] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/admin.php"] [unique_id "afaC01HJDYRXUf3IbRTSSgAAAMQ"]
[Sun May 03 07:03:48.100603 2026] [:error] [pid 37127:tid 37202] [client 20.43.1.132:21401] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/admin.php"] [unique_id "afaC1P8khJXb5O5aWVXOuwAAAFE"]
[Sun May 03 07:03:48.534091 2026] [:error] [pid 37127:tid 37196] [client 20.43.1.132:21422] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "afaC1P8khJXb5O5aWVXOvQAAAEw"]
[Sun May 03 07:03:48.992220 2026] [:error] [pid 40422:tid 40435] [client 20.43.1.132:64335] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "afaC1EHBbBLrXh6PButhSgAAAUk"]
[Sun May 03 07:03:49.419604 2026] [:error] [pid 40386:tid 40393] [client 20.43.1.132:21406] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "afaC1VHJDYRXUf3IbRTSSwAAAMU"]
[Sun May 03 07:03:49.899619 2026] [:error] [pid 40456:tid 40469] [client 20.43.1.132:21314] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "afaC1TSujTvwdzEkjSfFQwAAAYs"]
[Sun May 03 07:03:50.348622 2026] [:error] [pid 37127:tid 37188] [client 20.43.1.132:21396] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afaC1v8khJXb5O5aWVXOvgAAAEQ"]
[Sun May 03 07:03:50.788719 2026] [:error] [pid 40456:tid 40475] [client 20.43.1.132:36276] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afaC1jSujTvwdzEkjSfFRwAAAZE"]
[Sun May 03 07:03:51.219288 2026] [:error] [pid 40456:tid 40459] [client 20.43.1.132:21224] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afaC1zSujTvwdzEkjSfFSgAAAYE"]
[Sun May 03 07:03:51.643064 2026] [:error] [pid 37130:tid 37225] [client 20.43.1.132:21434] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afaC16Iu7bmXKXicRk8msQAAAIw"]
[Sun May 03 07:03:52.070665 2026] [:error] [pid 40422:tid 40445] [client 20.43.1.132:64293] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "afaC2EHBbBLrXh6PButhTgAAAVM"]
[Sun May 03 07:03:52.488035 2026] [:error] [pid 40422:tid 40448] [client 20.43.1.132:21363] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "afaC2EHBbBLrXh6PButhUAAAAVY"]
[Sun May 03 07:03:52.901874 2026] [:error] [pid 40422:tid 40428] [client 20.43.1.132:21334] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "afaC2EHBbBLrXh6PButhUQAAAUI"]
[Sun May 03 07:03:53.333998 2026] [:error] [pid 37126:tid 37175] [client 20.43.1.132:21330] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/axx.php"] [unique_id "afaC2fR_A42N-LtDyrvWpwAAABY"]
[Sun May 03 07:03:53.750889 2026] [:error] [pid 37127:tid 37193] [client 20.43.1.132:21320] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfashell.php"] [unique_id "afaC2f8khJXb5O5aWVXOxAAAAEk"]
[Sun May 03 07:03:54.182262 2026] [:error] [pid 40456:tid 40458] [client 20.43.1.132:21347] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfashell.php"] [unique_id "afaC2jSujTvwdzEkjSfFTwAAAYA"]
[Sun May 03 07:03:54.631176 2026] [:error] [pid 40456:tid 40479] [client 20.43.1.132:36277] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfashell.php"] [unique_id "afaC2jSujTvwdzEkjSfFUAAAAZU"]
[Sun May 03 07:03:55.063882 2026] [:error] [pid 40456:tid 40463] [client 20.43.1.132:21369] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfashell.php"] [unique_id "afaC2zSujTvwdzEkjSfFUQAAAYU"]
[Sun May 03 07:03:55.512950 2026] [:error] [pid 37130:tid 37228] [client 20.43.1.132:21075] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "afaC26Iu7bmXKXicRk8msgAAAI8"]
[Sun May 03 07:03:55.935395 2026] [:error] [pid 40422:tid 40442] [client 20.43.1.132:21291] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "afaC20HBbBLrXh6PButhVQAAAVA"]
[Sun May 03 07:03:56.356966 2026] [:error] [pid 37127:tid 37189] [client 20.43.1.132:21370] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "afaC3P8khJXb5O5aWVXOxwAAAEU"]
[Sun May 03 07:03:56.784290 2026] [:error] [pid 37127:tid 37207] [client 20.43.1.132:21357] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "afaC3P8khJXb5O5aWVXOyAAAAFU"]
[Sun May 03 07:03:57.229748 2026] [:error] [pid 37127:tid 37198] [client 20.43.1.132:21355] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "afaC3f8khJXb5O5aWVXOywAAAE0"]
[Sun May 03 07:03:57.678301 2026] [:error] [pid 40386:tid 40410] [client 20.43.1.132:36225] [client 20.43.1.132] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acp.php"] [unique_id "afaC3VHJDYRXUf3IbRTSTwAAANY"]
[Sun May 03 07:04:05.789887 2026] [autoindex:error] [pid 37246:tid 37256] [client 20.43.1.132:21297] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sun May 03 08:06:16.158311 2026] [:error] [pid 37126:tid 37170] [client 203.211.74.111:41944] [client 203.211.74.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.211.74.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afaRePR_A42N-LtDyrveHAAAABE"]
[Sun May 03 08:07:47.623547 2026] [:error] [pid 37130:tid 37236] [client 203.211.74.111:26106] [client 203.211.74.111] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afaR06Iu7bmXKXicRk8yegAAAJc"]
[Sun May 03 08:08:19.053841 2026] [:error] [pid 37246:tid 37253] [client 203.211.74.111:33674] [client 203.211.74.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.211.74.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afaR8zhvYFGNwhnPamp1PAAAAQU"]
[Sun May 03 08:08:46.996982 2026] [:error] [pid 40456:tid 40478] [client 203.211.74.111:31288] [client 203.211.74.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.211.74.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afaSDjSujTvwdzEkjSfXIwAAAZQ"]
[Sun May 03 08:09:15.763568 2026] [:error] [pid 37246:tid 37255] [client 203.211.74.111:41964] [client 203.211.74.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.211.74.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afaSKzhvYFGNwhnPamp1ygAAAQc"]
[Sun May 03 08:09:42.399060 2026] [:error] [pid 37246:tid 37263] [client 203.211.74.111:59392] [client 203.211.74.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.211.74.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afaSRjhvYFGNwhnPamp2PAAAAQ0"]
[Sun May 03 08:28:12.728237 2026] [:error] [pid 37246:tid 37269] [client 170.106.181.163:39396] [client 170.106.181.163] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afaWnDhvYFGNwhnPamp8KgAAARM"]
[Sun May 03 08:31:07.493966 2026] [:error] [pid 40456:tid 40476] [client 59.125.102.142:58368] [client 59.125.102.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.125.102.142, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afaXSzSujTvwdzEkjSfeHAAAAZI"]
[Sun May 03 08:54:59.513636 2026] [:error] [pid 37127:tid 37210] [client 81.181.68.123:36020] [client 81.181.68.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.181.68.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afac4_8khJXb5O5aWVXlPAAAAFg"]
[Sun May 03 09:41:52.008131 2026] [:error] [pid 40386:tid 40405] [client 104.248.22.119:56740] [client 104.248.22.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.248.22.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afan4FHJDYRXUf3IbRTrLgAAANE"]
[Sun May 03 09:52:31.823838 2026] [:error] [pid 37127:tid 37198] [client 191.252.92.249:51458] [client 191.252.92.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.252.92.249, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afaqX_8khJXb5O5aWVXyTgAAAE0"]
[Sun May 03 10:05:54.346905 2026] [:error] [pid 40456:tid 40464] [client 51.210.113.223:35556] [client 51.210.113.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.210.113.223, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afatgjSujTvwdzEkjSf2fgAAAYY"]
[Sun May 03 10:45:58.369341 2026] [:error] [pid 40422:tid 40449] [client 172.245.70.151:40762] [client 172.245.70.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.245.70.151, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afa25kHBbBLrXh6PBuu_eAAAAVc"]
[Sun May 03 11:00:22.929178 2026] [:error] [pid 37246:tid 37257] [client 43.166.255.102:46672] [client 43.166.255.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afa6RjhvYFGNwhnPamqoggAAAQk"]
[Sun May 03 11:16:44.760305 2026] [:error] [pid 37246:tid 37271] [client 45.190.159.253:25218] [client 45.190.159.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.190.159.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afa-HDhvYFGNwhnPamqr9AAAARU"]
[Sun May 03 11:16:54.979428 2026] [:error] [pid 37126:tid 37170] [client 45.190.159.253:37616] [client 45.190.159.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.190.159.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afa-JvR_A42N-LtDyrvzKwAAABE"]
[Sun May 03 11:17:05.532446 2026] [:error] [pid 37246:tid 37263] [client 45.190.159.253:17527] [client 45.190.159.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.190.159.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afa-MThvYFGNwhnPamqsAQAAAQ0"]
[Sun May 03 11:17:16.100051 2026] [:error] [pid 40456:tid 40466] [client 45.190.159.253:32462] [client 45.190.159.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.190.159.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afa-PDSujTvwdzEkjScDxgAAAYg"]
[Sun May 03 11:17:27.317995 2026] [:error] [pid 37246:tid 37272] [client 45.190.159.253:32630] [client 45.190.159.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.190.159.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afa-RzhvYFGNwhnPamqsFgAAARY"]
[Sun May 03 11:35:10.281769 2026] [:error] [pid 40456:tid 40480] [client 37.210.42.187:58284] [client 37.210.42.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.210.42.187, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afbCbjSujTvwdzEkjScHxQAAAZY"]
[Sun May 03 11:35:19.814986 2026] [:error] [pid 40456:tid 40480] [client 37.210.42.187:58614] [client 37.210.42.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.210.42.187, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afbCdzSujTvwdzEkjScH1AAAAZY"]
[Sun May 03 11:35:30.300370 2026] [:error] [pid 40422:tid 40449] [client 37.210.42.187:59059] [client 37.210.42.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.210.42.187, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afbCgkHBbBLrXh6PBuvQeAAAAVc"]
[Sun May 03 11:35:40.831927 2026] [:error] [pid 40456:tid 40478] [client 37.210.42.187:59422] [client 37.210.42.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.210.42.187, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afbCjDSujTvwdzEkjScH9wAAAZQ"]
[Sun May 03 11:35:51.329301 2026] [:error] [pid 40456:tid 40465] [client 37.210.42.187:59785] [client 37.210.42.187] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.210.42.187, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afbClzSujTvwdzEkjScIBAAAAYc"]
[Sun May 03 11:43:08.931509 2026] [:error] [pid 37246:tid 37272] [client 186.225.225.110:9916] [client 186.225.225.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.225.225.110, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afbETDhvYFGNwhnPamqzmgAAARY"]
[Sun May 03 11:43:19.406869 2026] [:error] [pid 40456:tid 40472] [client 186.225.225.110:10059] [client 186.225.225.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.225.225.110, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afbEVzSujTvwdzEkjScJswAAAY4"]
[Sun May 03 11:43:29.973601 2026] [:error] [pid 40456:tid 40477] [client 186.225.225.110:9730] [client 186.225.225.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.225.225.110, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afbEYTSujTvwdzEkjScJtwAAAZM"]
[Sun May 03 11:43:40.568609 2026] [:error] [pid 37127:tid 37188] [client 186.225.225.110:6855] [client 186.225.225.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.225.225.110, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afbEbP8khJXb5O5aWVUEHQAAAEQ"]
[Sun May 03 11:43:51.126549 2026] [:error] [pid 40386:tid 40401] [client 186.225.225.110:8092] [client 186.225.225.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.225.225.110, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afbEd1HJDYRXUf3IbRT6AwAAAM0"]
[Sun May 03 11:56:52.551154 2026] [:error] [pid 37127:tid 37190] [client 82.223.24.195:38762] [client 82.223.24.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 82.223.24.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afbHhP8khJXb5O5aWVUFvQAAAEY"]
[Sun May 03 12:03:18.502309 2026] [:error] [pid 40422:tid 40434] [client 121.200.216.6:55308] [client 121.200.216.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 121.200.216.6, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afbJBkHBbBLrXh6PBuvYtwAAAUg"]
[Sun May 03 12:47:14.276823 2026] [:error] [pid 40456:tid 40466] [client 85.203.23.88:34797] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afbTUjSujTvwdzEkjScUiwAAAYg"]
[Sun May 03 12:47:14.501749 2026] [:error] [pid 40456:tid 40461] [client 85.203.23.103:35557] [client 85.203.23.103] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "afbTUjSujTvwdzEkjScUjAAAAYM"]
[Sun May 03 12:47:15.079844 2026] [:error] [pid 40456:tid 40474] [client 85.203.23.68:53167] [client 85.203.23.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "afbTUzSujTvwdzEkjScUjQAAAZA"]
[Sun May 03 12:47:15.268059 2026] [:error] [pid 37246:tid 37257] [client 85.203.23.98:23655] [client 85.203.23.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "afbTUzhvYFGNwhnPamrDUAAAAQk"]
[Sun May 03 12:47:15.479370 2026] [:error] [pid 37126:tid 37173] [client 85.203.23.84:48303] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/users.php"] [unique_id "afbTU_R_A42N-LtDyrv74wAAABQ"]
[Sun May 03 12:47:15.664683 2026] [:error] [pid 40456:tid 40481] [client 85.203.23.90:24351] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "afbTUzSujTvwdzEkjScUjwAAAZc"]
[Sun May 03 12:47:15.860756 2026] [:error] [pid 37127:tid 37190] [client 85.203.23.83:50135] [client 85.203.23.83] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/enhanced-text-widget/analyst/src/403.php"] [unique_id "afbTU_8khJXb5O5aWVUNRAAAAEY"]
[Sun May 03 12:47:16.084354 2026] [:error] [pid 40456:tid 40469] [client 85.203.23.58:20513] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "afbTVDSujTvwdzEkjScUkQAAAYs"]
[Sun May 03 12:47:16.273443 2026] [:error] [pid 37246:tid 37269] [client 85.203.23.62:38135] [client 85.203.23.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "afbTVDhvYFGNwhnPamrDUQAAARM"]
[Sun May 03 12:47:16.502490 2026] [:error] [pid 37246:tid 37255] [client 85.203.23.80:23155] [client 85.203.23.80] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/3PJcpMFsD8B.php"] [unique_id "afbTVDhvYFGNwhnPamrDUgAAAQc"]
[Sun May 03 12:47:16.692767 2026] [:error] [pid 37246:tid 37267] [client 85.203.23.105:56853] [client 85.203.23.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "afbTVDhvYFGNwhnPamrDUwAAARE"]
[Sun May 03 12:47:16.955227 2026] [:error] [pid 37126:tid 37160] [client 85.203.23.88:50963] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "afbTVPR_A42N-LtDyrv75QAAAAc"]
[Sun May 03 12:47:17.271229 2026] [:error] [pid 37246:tid 37271] [client 85.203.23.61:46981] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/"] [unique_id "afbTVThvYFGNwhnPamrDVAAAARU"]
[Sun May 03 12:47:17.467794 2026] [:error] [pid 40456:tid 40470] [client 85.203.23.88:50199] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/posts"] [unique_id "afbTVTSujTvwdzEkjScUkgAAAYw"]
[Sun May 03 12:47:17.670397 2026] [:error] [pid 37246:tid 37256] [client 85.203.23.63:50817] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "afbTVThvYFGNwhnPamrDVQAAAQg"]
[Sun May 03 12:47:17.900945 2026] [:error] [pid 37126:tid 37167] [client 85.203.23.99:27551] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/admin.php"] [unique_id "afbTVfR_A42N-LtDyrv76gAAAA4"]
[Sun May 03 12:47:18.100002 2026] [:error] [pid 37126:tid 37171] [client 85.203.23.87:33967] [client 85.203.23.87] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "afbTVvR_A42N-LtDyrv77AAAABI"]
[Sun May 03 12:47:18.356895 2026] [:error] [pid 37126:tid 37165] [client 85.203.23.66:23149] [client 85.203.23.66] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/assets/images/selam.php"] [unique_id "afbTVvR_A42N-LtDyrv77gAAAAw"]
[Sun May 03 12:47:18.585395 2026] [:error] [pid 37126:tid 37176] [client 85.203.23.85:60803] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/item.php"] [unique_id "afbTVvR_A42N-LtDyrv77wAAABc"]
[Sun May 03 12:47:18.792288 2026] [:error] [pid 37126:tid 37172] [client 85.203.23.100:62323] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hello-plus/classes/ehp-sarang.php"] [unique_id "afbTVvR_A42N-LtDyrv78AAAABM"]
[Sun May 03 12:47:23.987265 2026] [:error] [pid 40422:tid 40430] [client 85.203.23.97:28815] [client 85.203.23.97] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-config-sample.php"] [unique_id "afbTW0HBbBLrXh6PBuvmsAAAAUQ"]
[Sun May 03 12:47:29.564599 2026] [:error] [pid 37127:tid 37188] [client 85.203.23.103:39165] [client 85.203.23.103] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "afbTYf8khJXb5O5aWVUNSQAAAEQ"]
[Sun May 03 12:47:34.968346 2026] [:error] [pid 40456:tid 40458] [client 85.203.23.94:57637] [client 85.203.23.94] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/system.php"] [unique_id "afbTZjSujTvwdzEkjScUlQAAAYA"]
[Sun May 03 12:47:35.260385 2026] [:error] [pid 40456:tid 40472] [client 85.203.23.85:55789] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/"] [unique_id "afbTZzSujTvwdzEkjScUlgAAAY4"]
[Sun May 03 12:47:35.471988 2026] [:error] [pid 37246:tid 37262] [client 85.203.23.99:63223] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/core.php"] [unique_id "afbTZzhvYFGNwhnPamrDYgAAAQw"]
[Sun May 03 12:47:35.667534 2026] [:error] [pid 37246:tid 37248] [client 85.203.23.87:45299] [client 85.203.23.87] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-wlx.php"] [unique_id "afbTZzhvYFGNwhnPamrDZAAAAQA"]
[Sun May 03 12:47:35.873996 2026] [:error] [pid 37246:tid 37250] [client 85.203.23.91:23541] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/updates.php"] [unique_id "afbTZzhvYFGNwhnPamrDZQAAAQI"]
[Sun May 03 12:47:36.078676 2026] [:error] [pid 37246:tid 37257] [client 85.203.23.70:23655] [client 85.203.23.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/speculative8.php"] [unique_id "afbTaDhvYFGNwhnPamrDZgAAAQk"]
[Sun May 03 12:47:36.365250 2026] [:error] [pid 40456:tid 40474] [client 85.203.23.60:45157] [client 85.203.23.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "afbTaDSujTvwdzEkjScUmAAAAZA"]
[Sun May 03 12:47:36.576632 2026] [:error] [pid 40456:tid 40481] [client 85.203.23.82:31857] [client 85.203.23.82] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/PHPMailer/s"] [unique_id "afbTaDSujTvwdzEkjScUmQAAAZc"]
[Sun May 03 12:47:36.780587 2026] [:error] [pid 37246:tid 37261] [client 85.203.23.57:64473] [client 85.203.23.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "afbTaDhvYFGNwhnPamrDZwAAAQs"]
[Sun May 03 12:47:41.994757 2026] [:error] [pid 40422:tid 40433] [client 85.203.23.82:20339] [client 85.203.23.82] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/shell/"] [unique_id "afbTbUHBbBLrXh6PBuvmuwAAAUc"]
[Sun May 03 12:47:47.188055 2026] [:error] [pid 40422:tid 40448] [client 85.203.23.85:54621] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/mah.php"] [unique_id "afbTc0HBbBLrXh6PBuvmvgAAAVY"]
[Sun May 03 12:47:47.895507 2026] [:error] [pid 40422:tid 40447] [client 85.203.23.66:28245] [client 85.203.23.66] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "afbTc0HBbBLrXh6PBuvmwAAAAVU"]
[Sun May 03 12:47:48.572114 2026] [:error] [pid 40422:tid 40437] [client 85.203.23.88:35705] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/news-portal/sitebar.php"] [unique_id "afbTdEHBbBLrXh6PBuvmwwAAAUs"]
[Sun May 03 12:47:48.872430 2026] [:error] [pid 40422:tid 40427] [client 85.203.23.103:64037] [client 85.203.23.103] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "afbTdEHBbBLrXh6PBuvmxAAAAUE"]
[Sun May 03 12:47:54.158837 2026] [:error] [pid 40422:tid 40439] [client 85.203.23.68:34245] [client 85.203.23.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "afbTekHBbBLrXh6PBuvmyQAAAU0"]
[Sun May 03 12:47:54.449198 2026] [:error] [pid 40422:tid 40432] [client 85.203.23.101:22229] [client 85.203.23.101] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afbTekHBbBLrXh6PBuvmygAAAUY"]
[Sun May 03 12:47:54.743867 2026] [:error] [pid 37130:tid 37228] [client 85.203.23.91:33355] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/plugins/"] [unique_id "afbTeqIu7bmXKXicRk9buQAAAI8"]
[Sun May 03 12:47:55.082913 2026] [:error] [pid 40422:tid 40441] [client 85.203.23.106:21883] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/"] [unique_id "afbTe0HBbBLrXh6PBuvmywAAAU8"]
[Sun May 03 12:47:55.275532 2026] [:error] [pid 40422:tid 40437] [client 85.203.23.86:63931] [client 85.203.23.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/fukasawa/inc/classes/403.php"] [unique_id "afbTe0HBbBLrXh6PBuvmzQAAAUs"]
[Sun May 03 12:47:55.473959 2026] [:error] [pid 40422:tid 40427] [client 85.203.23.90:44851] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/admin.php"] [unique_id "afbTe0HBbBLrXh6PBuvmzgAAAUE"]
[Sun May 03 12:47:55.693490 2026] [:error] [pid 40422:tid 40429] [client 85.203.23.102:57853] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/system_core.php"] [unique_id "afbTe0HBbBLrXh6PBuvmzwAAAUM"]
[Sun May 03 12:48:00.965721 2026] [:error] [pid 40422:tid 40448] [client 85.203.23.72:59559] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/"] [unique_id "afbTgEHBbBLrXh6PBuvm1QAAAVY"]
[Sun May 03 12:48:01.185615 2026] [:error] [pid 40422:tid 40441] [client 85.203.23.54:20741] [client 85.203.23.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/"] [unique_id "afbTgUHBbBLrXh6PBuvm1gAAAU8"]
[Sun May 03 12:48:01.459832 2026] [:error] [pid 37130:tid 37222] [client 85.203.23.101:20335] [client 85.203.23.101] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "afbTgaIu7bmXKXicRk9bugAAAIk"]
[Sun May 03 12:48:02.346869 2026] [:error] [pid 37246:tid 37264] [client 85.203.23.85:58243] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin.php"] [unique_id "afbTgjhvYFGNwhnPamrDbQAAAQ4"]
[Sun May 03 12:48:02.860127 2026] [:error] [pid 37246:tid 37268] [client 85.203.23.83:50285] [client 85.203.23.83] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/"] [unique_id "afbTgjhvYFGNwhnPamrDcAAAARI"]
[Sun May 03 12:48:03.088242 2026] [:error] [pid 37246:tid 37259] [client 85.203.23.70:27515] [client 85.203.23.70] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/components/"] [unique_id "afbTgzhvYFGNwhnPamrDcQAAAQo"]
[Sun May 03 12:48:03.273175 2026] [:error] [pid 37127:tid 37203] [client 85.203.23.104:45901] [client 85.203.23.104] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/images/"] [unique_id "afbTg_8khJXb5O5aWVUNTQAAAFI"]
[Sun May 03 12:48:03.483660 2026] [:error] [pid 37127:tid 37206] [client 85.203.23.89:27647] [client 85.203.23.89] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/radio.php"] [unique_id "afbTg_8khJXb5O5aWVUNTwAAAFQ"]
[Sun May 03 12:48:18.674438 2026] [:error] [pid 37246:tid 37255] [client 85.203.23.83:56717] [client 85.203.23.83] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/"] [unique_id "afbTkjhvYFGNwhnPamrDfQAAAQc"]
[Sun May 03 12:48:18.967132 2026] [:error] [pid 37130:tid 37236] [client 85.203.23.78:43181] [client 85.203.23.78] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "afbTkqIu7bmXKXicRk9bvwAAAJc"]
[Sun May 03 12:48:19.168712 2026] [:error] [pid 40386:tid 40399] [client 85.203.23.101:30913] [client 85.203.23.101] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "afbTk1HJDYRXUf3IbRQAIQAAAMs"]
[Sun May 03 12:48:29.383702 2026] [:error] [pid 37127:tid 37187] [client 85.203.23.104:21665] [client 85.203.23.104] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "afbTnf8khJXb5O5aWVUNWwAAAEM"]
[Sun May 03 12:48:34.654698 2026] [:error] [pid 37126:tid 37156] [client 85.203.23.84:31999] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade/"] [unique_id "afbTovR_A42N-LtDyrv7-wAAAAM"]
[Sun May 03 12:48:34.881340 2026] [:error] [pid 37246:tid 37271] [client 85.203.23.100:33351] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/index/function.php"] [unique_id "afbTojhvYFGNwhnPamrDgAAAARU"]
[Sun May 03 12:48:35.068855 2026] [:error] [pid 37246:tid 37250] [client 85.203.23.100:33971] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/light/"] [unique_id "afbTozhvYFGNwhnPamrDgQAAAQI"]
[Sun May 03 12:48:40.269156 2026] [:error] [pid 37127:tid 37206] [client 85.203.23.101:25625] [client 85.203.23.101] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/plugin/"] [unique_id "afbTqP8khJXb5O5aWVUNZAAAAFQ"]
[Sun May 03 12:48:40.466821 2026] [:error] [pid 37127:tid 37187] [client 85.203.23.103:52829] [client 85.203.23.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/chosen.php"] [unique_id "afbTqP8khJXb5O5aWVUNZgAAAEM"]
[Sun May 03 12:48:40.682142 2026] [:error] [pid 37127:tid 37196] [client 85.203.23.63:51811] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/"] [unique_id "afbTqP8khJXb5O5aWVUNZwAAAEw"]
[Sun May 03 12:48:40.866619 2026] [:error] [pid 37127:tid 37194] [client 85.203.23.85:60725] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "afbTqP8khJXb5O5aWVUNaAAAAEo"]
[Sun May 03 12:48:41.066477 2026] [:error] [pid 37246:tid 37273] [client 85.203.23.103:21325] [client 85.203.23.103] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ioxi-o.php"] [unique_id "afbTqThvYFGNwhnPamrDgwAAARc"]
[Sun May 03 12:48:41.278951 2026] [:error] [pid 37246:tid 37267] [client 85.203.23.93:34191] [client 85.203.23.93] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/enhanced-text-widget/analyst/src/403x.php"] [unique_id "afbTqThvYFGNwhnPamrDhAAAARE"]
[Sun May 03 12:48:46.472720 2026] [:error] [pid 37126:tid 37152] [client 85.203.23.72:41527] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/"] [unique_id "afbTrvR_A42N-LtDyrv8AAAAAAE"]
[Sun May 03 12:49:06.678605 2026] [:error] [pid 37127:tid 37207] [client 85.203.23.98:38181] [client 85.203.23.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/pullquote/"] [unique_id "afbTwv8khJXb5O5aWVUNcAAAAFU"]
[Sun May 03 12:49:06.888909 2026] [:error] [pid 40456:tid 40482] [client 85.203.23.75:22059] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2024/"] [unique_id "afbTwjSujTvwdzEkjScUqAAAAZg"]
[Sun May 03 12:49:07.177708 2026] [:error] [pid 37126:tid 37173] [client 85.203.23.68:64695] [client 85.203.23.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/src/Core/"] [unique_id "afbTw_R_A42N-LtDyrv8BQAAABQ"]
[Sun May 03 12:49:12.362624 2026] [:error] [pid 37127:tid 37195] [client 85.203.23.90:24107] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/"] [unique_id "afbTyP8khJXb5O5aWVUNcQAAAEs"]
[Sun May 03 12:49:12.570119 2026] [:error] [pid 40422:tid 40439] [client 85.203.23.105:34733] [client 85.203.23.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/filester/assets/css/404.php"] [unique_id "afbTyEHBbBLrXh6PBuvm2wAAAU0"]
[Sun May 03 12:49:12.753975 2026] [:error] [pid 37246:tid 37256] [client 85.203.23.86:56151] [client 85.203.23.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ws.php"] [unique_id "afbTyDhvYFGNwhnPamrDmwAAAQg"]
[Sun May 03 12:49:12.968082 2026] [:error] [pid 37130:tid 37234] [client 85.203.23.81:23083] [client 85.203.23.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "afbTyKIu7bmXKXicRk9bxAAAAJU"]
[Sun May 03 12:49:13.171577 2026] [:error] [pid 37246:tid 37262] [client 85.203.23.55:34973] [client 85.203.23.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/"] [unique_id "afbTyThvYFGNwhnPamrDnQAAAQw"]
[Sun May 03 12:49:13.396731 2026] [:error] [pid 37126:tid 37156] [client 85.203.23.61:27393] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/"] [unique_id "afbTyfR_A42N-LtDyrv8BgAAAAM"]
[Sun May 03 12:49:13.658787 2026] [:error] [pid 40422:tid 40448] [client 85.203.23.54:64203] [client 85.203.23.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/edit-post/"] [unique_id "afbTyUHBbBLrXh6PBuvm3AAAAVY"]
[Sun May 03 12:49:18.872573 2026] [:error] [pid 37246:tid 37274] [client 85.203.23.91:43751] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "afbTzjhvYFGNwhnPamrDoAAAARg"]
[Sun May 03 12:49:19.057796 2026] [:error] [pid 40422:tid 40430] [client 85.203.23.85:65401] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/themes.php"] [unique_id "afbTz0HBbBLrXh6PBuvm4AAAAUQ"]
[Sun May 03 12:49:29.271481 2026] [:error] [pid 40422:tid 40442] [client 85.203.23.84:26035] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/"] [unique_id "afbT2UHBbBLrXh6PBuvm6QAAAVA"]
[Sun May 03 12:49:29.494600 2026] [:error] [pid 37246:tid 37267] [client 85.203.23.62:24695] [client 85.203.23.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wa/"] [unique_id "afbT2ThvYFGNwhnPamrDowAAARE"]
[Sun May 03 12:49:34.679006 2026] [:error] [pid 40422:tid 40438] [client 85.203.23.89:30547] [client 85.203.23.89] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/404.php"] [unique_id "afbT3kHBbBLrXh6PBuvm9gAAAUw"]
[Sun May 03 12:49:39.859774 2026] [:error] [pid 37246:tid 37266] [client 85.203.23.75:22641] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/buy.php"] [unique_id "afbT4zhvYFGNwhnPamrDrQAAARA"]
[Sun May 03 12:49:45.071794 2026] [:error] [pid 37127:tid 37190] [client 85.203.23.84:58927] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/admin.php"] [unique_id "afbT6f8khJXb5O5aWVUNdwAAAEY"]
[Sun May 03 12:49:45.279374 2026] [:error] [pid 40386:tid 40392] [client 85.203.23.58:59857] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "afbT6VHJDYRXUf3IbRQAMgAAAMQ"]
[Sun May 03 12:49:45.461528 2026] [:error] [pid 40456:tid 40468] [client 85.203.23.68:52989] [client 85.203.23.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/fields/"] [unique_id "afbT6TSujTvwdzEkjScUrAAAAYo"]
[Sun May 03 12:49:45.664419 2026] [:error] [pid 40456:tid 40477] [client 85.203.23.84:40213] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/log.php"] [unique_id "afbT6TSujTvwdzEkjScUrQAAAZM"]
[Sun May 03 12:49:50.872274 2026] [:error] [pid 40422:tid 40441] [client 85.203.23.82:48489] [client 85.203.23.82] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wp-conflg.php"] [unique_id "afbT7kHBbBLrXh6PBuvnVAAAAU8"]
[Sun May 03 12:49:51.071603 2026] [:error] [pid 40422:tid 40426] [client 85.203.23.86:52687] [client 85.203.23.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/"] [unique_id "afbT70HBbBLrXh6PBuvnVQAAAUA"]
[Sun May 03 12:50:01.268479 2026] [:error] [pid 40456:tid 40465] [client 85.203.23.84:27131] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/panel.php"] [unique_id "afbT-TSujTvwdzEkjScUugAAAYc"]
[Sun May 03 12:50:07.556188 2026] [:error] [pid 37130:tid 37237] [client 85.203.23.60:50895] [client 85.203.23.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/root.php"] [unique_id "afbT_6Iu7bmXKXicRk9cFgAAAJg"]
[Sun May 03 12:50:07.779887 2026] [:error] [pid 40422:tid 40443] [client 85.203.23.100:45119] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/development/"] [unique_id "afbT_0HBbBLrXh6PBuvnbwAAAVE"]
[Sun May 03 12:50:17.983875 2026] [:error] [pid 40422:tid 40431] [client 85.203.23.66:64229] [client 85.203.23.66] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/admin/function.php"] [unique_id "afbUCUHBbBLrXh6PBuvncwAAAUU"]
[Sun May 03 12:50:18.173477 2026] [:error] [pid 37130:tid 37228] [client 85.203.23.82:21235] [client 85.203.23.82] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/code/"] [unique_id "afbUCqIu7bmXKXicRk9cFwAAAI8"]
[Sun May 03 12:50:18.369350 2026] [:error] [pid 40422:tid 40429] [client 85.203.23.88:23483] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "afbUCkHBbBLrXh6PBuvndgAAAUM"]
[Sun May 03 12:50:18.567011 2026] [:error] [pid 37246:tid 37248] [client 85.203.23.70:60099] [client 85.203.23.70] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comments-pagination-numbers/"] [unique_id "afbUCjhvYFGNwhnPamrDugAAAQA"]
[Sun May 03 12:50:18.762038 2026] [:error] [pid 37127:tid 37185] [client 85.203.23.101:41187] [client 85.203.23.101] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "afbUCv8khJXb5O5aWVUNfAAAAEE"]
[Sun May 03 12:50:18.974208 2026] [:error] [pid 37127:tid 37192] [client 85.203.23.98:25955] [client 85.203.23.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/includes/"] [unique_id "afbUCv8khJXb5O5aWVUNfQAAAEg"]
[Sun May 03 12:50:19.774653 2026] [:error] [pid 40422:tid 40434] [client 85.203.23.67:25579] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/themes/"] [unique_id "afbUC0HBbBLrXh6PBuvndwAAAUg"]
[Sun May 03 12:50:30.170125 2026] [:error] [pid 40422:tid 40435] [client 85.203.23.75:59641] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/theme-check/main.php"] [unique_id "afbUFkHBbBLrXh6PBuvnfwAAAUk"]
[Sun May 03 12:50:30.360886 2026] [:error] [pid 40456:tid 40474] [client 85.203.23.105:43699] [client 85.203.23.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/lib/"] [unique_id "afbUFjSujTvwdzEkjScUvQAAAZA"]
[Sun May 03 12:50:30.561987 2026] [:error] [pid 40456:tid 40468] [client 85.203.23.83:29839] [client 85.203.23.83] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/upload.php"] [unique_id "afbUFjSujTvwdzEkjScUvgAAAYo"]
[Sun May 03 12:50:40.772362 2026] [:error] [pid 37126:tid 37166] [client 85.203.23.81:38559] [client 85.203.23.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/rip.php"] [unique_id "afbUIPR_A42N-LtDyrv8GAAAAA0"]
[Sun May 03 12:50:40.982673 2026] [:error] [pid 40386:tid 40399] [client 85.203.23.101:44931] [client 85.203.23.101] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/fukasawa/inc/classes/403x.php"] [unique_id "afbUIFHJDYRXUf3IbRQAPwAAAMs"]
[Sun May 03 12:50:41.165806 2026] [:error] [pid 37126:tid 37162] [client 85.203.23.58:56659] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/options.php"] [unique_id "afbUIfR_A42N-LtDyrv8GQAAAAk"]
[Sun May 03 12:50:41.372335 2026] [:error] [pid 40386:tid 40409] [client 85.203.23.86:53135] [client 85.203.23.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/config.php"] [unique_id "afbUIVHJDYRXUf3IbRQAQAAAANU"]
[Sun May 03 12:50:41.593475 2026] [:error] [pid 40386:tid 40389] [client 85.203.23.94:33041] [client 85.203.23.94] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/src/Content/Type/"] [unique_id "afbUIVHJDYRXUf3IbRQAQgAAAME"]
[Sun May 03 12:50:46.959749 2026] [:error] [pid 37246:tid 37271] [client 85.203.23.59:38307] [client 85.203.23.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/freeform/"] [unique_id "afbUJjhvYFGNwhnPamrDxQAAARU"]
[Sun May 03 12:50:47.154628 2026] [:error] [pid 37246:tid 37253] [client 85.203.23.70:38449] [client 85.203.23.70] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "afbUJzhvYFGNwhnPamrDxgAAAQU"]
[Sun May 03 12:50:47.354549 2026] [:error] [pid 37127:tid 37196] [client 85.203.23.86:53385] [client 85.203.23.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/system_log.php"] [unique_id "afbUJ_8khJXb5O5aWVUNgQAAAEw"]
[Sun May 03 12:50:52.555900 2026] [:error] [pid 37127:tid 37198] [client 85.203.23.85:63937] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/"] [unique_id "afbULP8khJXb5O5aWVUNggAAAE0"]
[Sun May 03 12:50:57.768542 2026] [:error] [pid 37127:tid 37195] [client 85.203.23.62:30905] [client 85.203.23.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/ocean/"] [unique_id "afbUMf8khJXb5O5aWVUNhAAAAEs"]
[Sun May 03 12:50:57.995287 2026] [:error] [pid 37127:tid 37209] [client 85.203.23.83:35753] [client 85.203.23.83] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/"] [unique_id "afbUMf8khJXb5O5aWVUNhgAAAFc"]
[Sun May 03 12:50:58.189444 2026] [:error] [pid 37246:tid 37263] [client 85.203.23.63:39629] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comment-content/"] [unique_id "afbUMjhvYFGNwhnPamrDygAAAQ0"]
[Sun May 03 12:50:58.401177 2026] [:error] [pid 37130:tid 37225] [client 85.203.23.91:51623] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/"] [unique_id "afbUMqIu7bmXKXicRk9cIwAAAIw"]
[Sun May 03 12:51:03.643616 2026] [:error] [pid 40422:tid 40430] [client 85.203.23.67:60645] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/packed.php"] [unique_id "afbUN0HBbBLrXh6PBuvniAAAAUQ"]
[Sun May 03 12:51:04.077397 2026] [:error] [pid 40422:tid 40448] [client 85.203.23.58:61143] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/cache/"] [unique_id "afbUOEHBbBLrXh6PBuvniQAAAVY"]
[Sun May 03 12:51:04.282521 2026] [:error] [pid 40422:tid 40439] [client 85.203.23.97:65167] [client 85.203.23.97] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfour/patterns/file.php"] [unique_id "afbUOEHBbBLrXh6PBuvnigAAAU0"]
[Sun May 03 12:51:04.483019 2026] [:error] [pid 40422:tid 40435] [client 85.203.23.66:31947] [client 85.203.23.66] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/admin-header.php"] [unique_id "afbUOEHBbBLrXh6PBuvniwAAAUk"]
[Sun May 03 12:51:04.959472 2026] [:error] [pid 37246:tid 37256] [client 85.203.23.93:42323] [client 85.203.23.93] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/details/"] [unique_id "afbUODhvYFGNwhnPamrDywAAAQg"]
[Sun May 03 12:51:05.345559 2026] [:error] [pid 37246:tid 37251] [client 85.203.23.72:24779] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/"] [unique_id "afbUOThvYFGNwhnPamrDzAAAAQM"]
[Sun May 03 12:51:05.967328 2026] [:error] [pid 37246:tid 37255] [client 85.203.23.75:27827] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/"] [unique_id "afbUOThvYFGNwhnPamrDzQAAAQc"]
[Sun May 03 12:51:16.276364 2026] [:error] [pid 37127:tid 37199] [client 85.203.23.100:24025] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/config.php"] [unique_id "afbURP8khJXb5O5aWVUNkwAAAE4"]
[Sun May 03 12:51:16.489389 2026] [:error] [pid 40456:tid 40465] [client 85.203.23.66:41991] [client 85.203.23.66] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/maint/chosen.php"] [unique_id "afbURDSujTvwdzEkjScU5gAAAYc"]
[Sun May 03 12:51:16.687662 2026] [:error] [pid 40386:tid 40404] [client 85.203.23.68:31903] [client 85.203.23.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/admin.php"] [unique_id "afbURFHJDYRXUf3IbRQARwAAANA"]
[Sun May 03 12:51:21.942578 2026] [:error] [pid 40422:tid 40431] [client 85.203.23.98:54617] [client 85.203.23.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/vendor/about.php"] [unique_id "afbUSUHBbBLrXh6PBuvnsgAAAUU"]
[Sun May 03 12:51:22.245894 2026] [:error] [pid 40422:tid 40446] [client 85.203.23.81:41445] [client 85.203.23.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfour/"] [unique_id "afbUSkHBbBLrXh6PBuvntAAAAVQ"]
[Sun May 03 12:51:22.466439 2026] [:error] [pid 40422:tid 40428] [client 85.203.23.106:37059] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/maint/"] [unique_id "afbUSkHBbBLrXh6PBuvntQAAAUI"]
[Sun May 03 12:51:22.673619 2026] [:error] [pid 40422:tid 40442] [client 85.203.23.91:36601] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/media/"] [unique_id "afbUSkHBbBLrXh6PBuvntgAAAVA"]
[Sun May 03 12:51:22.900314 2026] [:error] [pid 37126:tid 37176] [client 85.203.23.106:42693] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/customize-widgets/"] [unique_id "afbUSvR_A42N-LtDyrv8JwAAABc"]
[Sun May 03 12:51:23.084152 2026] [:error] [pid 37246:tid 37270] [client 85.203.23.102:56591] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/separator/"] [unique_id "afbUSzhvYFGNwhnPamrD9AAAARQ"]
[Sun May 03 12:51:28.278670 2026] [:error] [pid 37130:tid 37236] [client 85.203.23.72:44727] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afbUUKIu7bmXKXicRk9cLAAAAJc"]
[Sun May 03 12:51:33.886612 2026] [:error] [pid 40456:tid 40480] [client 85.203.23.54:36501] [client 85.203.23.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "afbUVTSujTvwdzEkjScU-QAAAZY"]
[Sun May 03 12:51:34.548477 2026] [:error] [pid 40456:tid 40475] [client 85.203.23.57:48747] [client 85.203.23.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/.well-known/acme-challenge/"] [unique_id "afbUVjSujTvwdzEkjScU-gAAAZE"]
[Sun May 03 12:51:34.764762 2026] [:error] [pid 40456:tid 40461] [client 85.203.23.90:63873] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/shell.php"] [unique_id "afbUVjSujTvwdzEkjScU-wAAAYM"]
[Sun May 03 12:51:34.982726 2026] [:error] [pid 40456:tid 40478] [client 85.203.23.81:56541] [client 85.203.23.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/image/"] [unique_id "afbUVjSujTvwdzEkjScU_AAAAZQ"]
[Sun May 03 12:51:35.171682 2026] [:error] [pid 40456:tid 40460] [client 85.203.23.100:20911] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/files.php"] [unique_id "afbUVzSujTvwdzEkjScU_QAAAYI"]
[Sun May 03 12:51:35.385727 2026] [:error] [pid 40422:tid 40427] [client 85.203.23.55:22189] [client 85.203.23.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/video/"] [unique_id "afbUV0HBbBLrXh6PBuvnxAAAAUE"]
[Sun May 03 12:51:35.569823 2026] [:error] [pid 37246:tid 37265] [client 85.203.23.84:43093] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfive/"] [unique_id "afbUVzhvYFGNwhnPamrD-wAAAQ8"]
[Sun May 03 12:51:40.756795 2026] [:error] [pid 37127:tid 37198] [client 85.203.23.80:42677] [client 85.203.23.80] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wp-activate.php"] [unique_id "afbUXP8khJXb5O5aWVUN0gAAAE0"]
[Sun May 03 12:51:40.957880 2026] [:error] [pid 40422:tid 40429] [client 85.203.23.99:39937] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/chosen.php"] [unique_id "afbUXEHBbBLrXh6PBuvnygAAAUM"]
[Sun May 03 12:51:41.156292 2026] [:error] [pid 40422:tid 40434] [client 85.203.23.54:29185] [client 85.203.23.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/backup.php"] [unique_id "afbUXUHBbBLrXh6PBuvnywAAAUg"]
[Sun May 03 12:51:41.355836 2026] [:error] [pid 37246:tid 37251] [client 85.203.23.54:22643] [client 85.203.23.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/"] [unique_id "afbUXThvYFGNwhnPamrEAQAAAQM"]
[Sun May 03 12:51:41.572951 2026] [:error] [pid 40422:tid 40428] [client 85.203.23.106:26607] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/login.php"] [unique_id "afbUXUHBbBLrXh6PBuvnzAAAAUI"]
[Sun May 03 12:51:41.768825 2026] [:error] [pid 40422:tid 40436] [client 85.203.23.100:35645] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfour/assets/"] [unique_id "afbUXUHBbBLrXh6PBuvnzQAAAUo"]
[Sun May 03 12:51:41.974536 2026] [:error] [pid 40422:tid 40427] [client 85.203.23.105:63481] [client 85.203.23.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ab.php"] [unique_id "afbUXUHBbBLrXh6PBuvnzgAAAUE"]
[Sun May 03 12:51:42.186206 2026] [:error] [pid 37127:tid 37207] [client 85.203.23.80:46061] [client 85.203.23.80] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/login.php"] [unique_id "afbUXv8khJXb5O5aWVUN0wAAAFU"]
[Sun May 03 12:51:47.371421 2026] [:error] [pid 37246:tid 37249] [client 85.203.23.90:48443] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/script-modules/block-library/navigation/"] [unique_id "afbUYzhvYFGNwhnPamrEBgAAAQE"]
[Sun May 03 12:51:47.558932 2026] [:error] [pid 40422:tid 40433] [client 85.203.23.102:50937] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/panel.php"] [unique_id "afbUY0HBbBLrXh6PBuvn0gAAAUc"]
[Sun May 03 12:51:47.782080 2026] [:error] [pid 40456:tid 40468] [client 85.203.23.88:22417] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/commands/"] [unique_id "afbUYzSujTvwdzEkjScU_wAAAYo"]
[Sun May 03 12:51:47.989990 2026] [:error] [pid 37246:tid 37256] [client 85.203.23.103:59491] [client 85.203.23.103] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "afbUYzhvYFGNwhnPamrECgAAAQg"]
[Sun May 03 12:51:48.170222 2026] [:error] [pid 40456:tid 40459] [client 85.203.23.90:36159] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/t.php"] [unique_id "afbUZDSujTvwdzEkjScVAAAAAYE"]
[Sun May 03 12:51:48.365291 2026] [:error] [pid 40456:tid 40464] [client 85.203.23.78:38155] [client 85.203.23.78] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/about.php"] [unique_id "afbUZDSujTvwdzEkjScVAQAAAYY"]
[Sun May 03 12:51:48.558093 2026] [:error] [pid 37246:tid 37248] [client 85.203.23.83:27943] [client 85.203.23.83] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jcrop/"] [unique_id "afbUZDhvYFGNwhnPamrEDAAAAQA"]
[Sun May 03 12:51:48.756738 2026] [:error] [pid 37126:tid 37157] [client 85.203.23.81:44239] [client 85.203.23.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/library/"] [unique_id "afbUZPR_A42N-LtDyrv8KAAAAAQ"]
[Sun May 03 12:51:48.957055 2026] [:error] [pid 40456:tid 40476] [client 85.203.23.63:59265] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/assets/fonts/"] [unique_id "afbUZDSujTvwdzEkjScVAgAAAZI"]
[Sun May 03 12:51:49.157437 2026] [:error] [pid 40422:tid 40446] [client 85.203.23.66:42305] [client 85.203.23.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/chosen.php"] [unique_id "afbUZUHBbBLrXh6PBuvn1QAAAVQ"]
[Sun May 03 12:51:49.369430 2026] [:error] [pid 40456:tid 40462] [client 85.203.23.61:57591] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-signin.php"] [unique_id "afbUZTSujTvwdzEkjScVAwAAAYQ"]
[Sun May 03 12:52:09.646085 2026] [:error] [pid 40422:tid 40434] [client 85.203.23.99:45051] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/widgets/"] [unique_id "afbUeUHBbBLrXh6PBuvn8AAAAUg"]
[Sun May 03 12:52:10.069541 2026] [:error] [pid 40422:tid 40428] [client 85.203.23.84:49323] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/000.php"] [unique_id "afbUekHBbBLrXh6PBuvn9AAAAUI"]
[Sun May 03 12:52:15.702407 2026] [:error] [pid 37127:tid 37198] [client 85.203.23.102:33423] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "afbUf_8khJXb5O5aWVUN4AAAAE0"]
[Sun May 03 12:52:15.882607 2026] [:error] [pid 40456:tid 40459] [client 85.203.23.102:35363] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/system.php"] [unique_id "afbUfzSujTvwdzEkjScVDQAAAYE"]
[Sun May 03 12:52:16.067679 2026] [:error] [pid 37246:tid 37269] [client 85.203.23.62:42075] [client 85.203.23.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "afbUgDhvYFGNwhnPamrEHQAAARM"]
[Sun May 03 12:52:16.257470 2026] [:error] [pid 37246:tid 37253] [client 85.203.23.85:24943] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/abcd.php"] [unique_id "afbUgDhvYFGNwhnPamrEHwAAAQU"]
[Sun May 03 12:52:16.462770 2026] [:error] [pid 37246:tid 37250] [client 85.203.23.97:40007] [client 85.203.23.97] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/adminfuns.php"] [unique_id "afbUgDhvYFGNwhnPamrEIAAAAQI"]
[Sun May 03 12:52:16.665322 2026] [:error] [pid 37246:tid 37259] [client 85.203.23.85:41227] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "afbUgDhvYFGNwhnPamrEIgAAAQo"]
[Sun May 03 12:52:16.863908 2026] [:error] [pid 37127:tid 37199] [client 85.203.23.104:38779] [client 85.203.23.104] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/files/"] [unique_id "afbUgP8khJXb5O5aWVUN4gAAAE4"]
[Sun May 03 12:52:22.063726 2026] [:error] [pid 40386:tid 40393] [client 85.203.23.59:38147] [client 85.203.23.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/template-singl-portfolio.php"] [unique_id "afbUhlHJDYRXUf3IbRQAUAAAAMU"]
[Sun May 03 12:52:22.261583 2026] [:error] [pid 40456:tid 40476] [client 85.203.23.104:52021] [client 85.203.23.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/chosen.php"] [unique_id "afbUhjSujTvwdzEkjScVEgAAAZI"]
[Sun May 03 12:52:22.455732 2026] [:error] [pid 40456:tid 40462] [client 85.203.23.62:25635] [client 85.203.23.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/"] [unique_id "afbUhjSujTvwdzEkjScVEwAAAYQ"]
[Sun May 03 12:52:22.674382 2026] [:error] [pid 40456:tid 40480] [client 85.203.23.106:38421] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/comments-pagination-next/"] [unique_id "afbUhjSujTvwdzEkjScVFAAAAZY"]
[Sun May 03 12:52:22.877960 2026] [:error] [pid 40456:tid 40466] [client 85.203.23.72:36129] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/html-api/"] [unique_id "afbUhjSujTvwdzEkjScVFQAAAYg"]
[Sun May 03 12:52:23.090396 2026] [:error] [pid 40386:tid 40400] [client 85.203.23.100:33437] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/class.php"] [unique_id "afbUh1HJDYRXUf3IbRQAUgAAAMw"]
[Sun May 03 12:52:23.283723 2026] [:error] [pid 40456:tid 40461] [client 85.203.23.67:38493] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/network/colors/"] [unique_id "afbUhzSujTvwdzEkjScVFwAAAYM"]
[Sun May 03 12:52:23.477144 2026] [:error] [pid 40456:tid 40478] [client 85.203.23.91:64511] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/group/"] [unique_id "afbUhzSujTvwdzEkjScVGAAAAZQ"]
[Sun May 03 12:52:23.667722 2026] [:error] [pid 40456:tid 40460] [client 85.203.23.105:45915] [client 85.203.23.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "afbUhzSujTvwdzEkjScVGQAAAYI"]
[Sun May 03 12:52:23.865737 2026] [:error] [pid 37127:tid 37185] [client 85.203.23.94:48517] [client 85.203.23.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/module.php"] [unique_id "afbUh_8khJXb5O5aWVUN5wAAAEE"]
[Sun May 03 12:52:24.165162 2026] [:error] [pid 40456:tid 40468] [client 85.203.23.75:50323] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/user.php"] [unique_id "afbUiDSujTvwdzEkjScVGwAAAYo"]
[Sun May 03 12:52:24.953654 2026] [:error] [pid 40456:tid 40465] [client 85.203.23.99:27863] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/about.php"] [unique_id "afbUiDSujTvwdzEkjScVHQAAAYc"]
[Sun May 03 12:52:25.153122 2026] [:error] [pid 40456:tid 40463] [client 85.203.23.86:59333] [client 85.203.23.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/widget-group/"] [unique_id "afbUiTSujTvwdzEkjScVHgAAAYU"]
[Sun May 03 12:52:30.377594 2026] [:error] [pid 37127:tid 37191] [client 85.203.23.67:22305] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/2025/"] [unique_id "afbUjv8khJXb5O5aWVUN7AAAAEc"]
[Sun May 03 12:52:30.735129 2026] [:error] [pid 37127:tid 37187] [client 85.203.23.91:53789] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/install.php"] [unique_id "afbUjv8khJXb5O5aWVUN7QAAAEM"]
[Sun May 03 12:52:30.913982 2026] [:error] [pid 37127:tid 37198] [client 85.203.23.81:41231] [client 85.203.23.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-content/"] [unique_id "afbUjv8khJXb5O5aWVUN7gAAAE0"]
[Sun May 03 12:52:31.095547 2026] [:error] [pid 37127:tid 37199] [client 85.203.23.88:24537] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-blog.php"] [unique_id "afbUj_8khJXb5O5aWVUN8AAAAE4"]
[Sun May 03 12:52:31.283888 2026] [:error] [pid 37127:tid 37195] [client 85.203.23.59:24567] [client 85.203.23.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/chosen.php"] [unique_id "afbUj_8khJXb5O5aWVUN8QAAAEs"]
[Sun May 03 12:52:36.479940 2026] [:error] [pid 37130:tid 37233] [client 85.203.23.59:58399] [client 85.203.23.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/"] [unique_id "afbUlKIu7bmXKXicRk9cPwAAAJQ"]
[Sun May 03 12:52:46.691142 2026] [:error] [pid 40422:tid 40450] [client 85.203.23.90:41587] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/we.php"] [unique_id "afbUnkHBbBLrXh6PBuvoAgAAAVg"]
[Sun May 03 12:52:46.878228 2026] [:error] [pid 40422:tid 40438] [client 85.203.23.62:64409] [client 85.203.23.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/legacy-widget/"] [unique_id "afbUnkHBbBLrXh6PBuvoAwAAAUw"]
[Sun May 03 12:52:47.067505 2026] [:error] [pid 37127:tid 37186] [client 85.203.23.101:48983] [client 85.203.23.101] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/lock360.php"] [unique_id "afbUn_8khJXb5O5aWVUN-AAAAEI"]
[Sun May 03 12:52:47.268369 2026] [:error] [pid 37126:tid 37160] [client 85.203.23.97:52493] [client 85.203.23.97] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/"] [unique_id "afbUn_R_A42N-LtDyrv8MgAAAAc"]
[Sun May 03 12:52:47.455180 2026] [:error] [pid 37126:tid 37170] [client 85.203.23.66:33907] [client 85.203.23.66] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/navigation-submenu/"] [unique_id "afbUn_R_A42N-LtDyrv8MwAAABE"]
[Sun May 03 12:52:47.659179 2026] [:error] [pid 40386:tid 40405] [client 85.203.23.94:32433] [client 85.203.23.94] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/file.php"] [unique_id "afbUn1HJDYRXUf3IbRQAXAAAANE"]
[Sun May 03 12:52:47.883837 2026] [:error] [pid 40422:tid 40435] [client 85.203.23.62:34767] [client 85.203.23.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/users.php"] [unique_id "afbUn0HBbBLrXh6PBuvoBQAAAUk"]
[Sun May 03 12:52:53.105048 2026] [:error] [pid 37127:tid 37194] [client 85.203.23.104:54563] [client 85.203.23.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/library/222.php"] [unique_id "afbUpf8khJXb5O5aWVUN_wAAAEo"]
[Sun May 03 12:52:53.287064 2026] [:error] [pid 40422:tid 40437] [client 85.203.23.81:52673] [client 85.203.23.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-update.php"] [unique_id "afbUpUHBbBLrXh6PBuvoDgAAAUs"]
[Sun May 03 12:52:53.477556 2026] [:error] [pid 40422:tid 40445] [client 85.203.23.62:41821] [client 85.203.23.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/database.php"] [unique_id "afbUpUHBbBLrXh6PBuvoDwAAAVM"]
[Sun May 03 12:52:55.677210 2026] [:error] [pid 40386:tid 40406] [client 148.113.189.81:50992] [client 148.113.189.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.113.189.81, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afbUp1HJDYRXUf3IbRQAXgAAANI"]
[Sun May 03 12:53:08.803323 2026] [:error] [pid 37246:tid 37249] [client 85.203.23.84:42733] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/widgets/"] [unique_id "afbUtDhvYFGNwhnPamrEMQAAAQE"]
[Sun May 03 12:53:13.988342 2026] [:error] [pid 40422:tid 40449] [client 85.203.23.91:21833] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/"] [unique_id "afbUuUHBbBLrXh6PBuvoMAAAAVc"]
[Sun May 03 12:53:14.187480 2026] [:error] [pid 40422:tid 40443] [client 85.203.23.75:22277] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/woocommerce/includes/import/about.php"] [unique_id "afbUukHBbBLrXh6PBuvoMQAAAVE"]
[Sun May 03 12:53:24.376269 2026] [:error] [pid 40456:tid 40470] [client 85.203.23.63:52919] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/crystal/"] [unique_id "afbUxDSujTvwdzEkjScVPgAAAYw"]
[Sun May 03 12:53:34.596092 2026] [:error] [pid 40422:tid 40447] [client 85.203.23.58:24151] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/astra/assets/css/"] [unique_id "afbUzkHBbBLrXh6PBuvoewAAAVU"]
[Sun May 03 12:53:34.782555 2026] [:error] [pid 40386:tid 40399] [client 85.203.23.82:53893] [client 85.203.23.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/222.php"] [unique_id "afbUzlHJDYRXUf3IbRQAYQAAAMs"]
[Sun May 03 12:53:34.970495 2026] [:error] [pid 37130:tid 37222] [client 85.203.23.58:42117] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/"] [unique_id "afbUzqIu7bmXKXicRk9cVAAAAIk"]
[Sun May 03 12:53:35.173248 2026] [:error] [pid 37246:tid 37267] [client 85.203.23.54:47785] [client 85.203.23.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyfour/patterns/template-singl-portfolio.php"] [unique_id "afbUzzhvYFGNwhnPamrEQAAAARE"]
[Sun May 03 12:53:45.479512 2026] [:error] [pid 37127:tid 37185] [client 85.203.23.58:52489] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Exception/"] [unique_id "afbU2f8khJXb5O5aWVUOLAAAAEE"]
[Sun May 03 12:53:45.681816 2026] [:error] [pid 37130:tid 37216] [client 85.203.23.84:39955] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/pattern/"] [unique_id "afbU2aIu7bmXKXicRk9cVwAAAIM"]
[Sun May 03 12:53:50.865746 2026] [:error] [pid 40422:tid 40445] [client 85.203.23.99:36723] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/news-portal/user-install.php"] [unique_id "afbU3kHBbBLrXh6PBuvotAAAAVM"]
[Sun May 03 12:53:51.054116 2026] [:error] [pid 40422:tid 40435] [client 85.203.23.91:54557] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/"] [unique_id "afbU30HBbBLrXh6PBuvotgAAAUk"]
[Sun May 03 12:53:51.256773 2026] [:error] [pid 37130:tid 37229] [client 85.203.23.94:39099] [client 85.203.23.94] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/block-bindings/"] [unique_id "afbU36Iu7bmXKXicRk9cWQAAAJA"]
[Sun May 03 12:53:51.476524 2026] [:error] [pid 40386:tid 40391] [client 85.203.23.83:64691] [client 85.203.23.83] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-cache-sys/"] [unique_id "afbU31HJDYRXUf3IbRQAaAAAAMM"]
[Sun May 03 12:53:51.686726 2026] [:error] [pid 37127:tid 37184] [client 85.203.23.58:63049] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist"] [unique_id "afbU3_8khJXb5O5aWVUOLwAAAEA"]
[Sun May 03 12:53:56.870619 2026] [:error] [pid 37130:tid 37215] [client 85.203.23.66:20999] [client 85.203.23.66] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/script-loader-react-refresh.php"] [unique_id "afbU5KIu7bmXKXicRk9cXAAAAII"]
[Sun May 03 12:53:57.068166 2026] [:error] [pid 40386:tid 40402] [client 85.203.23.102:47727] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/accordion/"] [unique_id "afbU5VHJDYRXUf3IbRQAagAAAM4"]
[Sun May 03 12:53:57.282184 2026] [:error] [pid 40456:tid 40481] [client 85.203.23.91:55359] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/Nxploited/class-payment.php"] [unique_id "afbU5TSujTvwdzEkjScVgQAAAZc"]
[Sun May 03 12:54:07.692694 2026] [:error] [pid 37246:tid 37270] [client 85.203.23.72:55299] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/sodium_compat/namespaced/Core/"] [unique_id "afbU7zhvYFGNwhnPamrEnwAAARQ"]
[Sun May 03 12:54:07.896629 2026] [:error] [pid 40386:tid 40401] [client 85.203.23.58:47879] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/dist/script-modules/block-library/file/"] [unique_id "afbU71HJDYRXUf3IbRQAdAAAAM0"]
[Sun May 03 12:54:08.085123 2026] [:error] [pid 40422:tid 40450] [client 85.203.23.88:56967] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-theme-json-resolver-sql.php"] [unique_id "afbU8EHBbBLrXh6PBuvo-AAAAVg"]
[Sun May 03 12:54:08.268588 2026] [:error] [pid 40456:tid 40469] [client 85.203.23.55:24945] [client 85.203.23.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/classwithtostring.php"] [unique_id "afbU8DSujTvwdzEkjScVlwAAAYs"]
[Sun May 03 12:54:08.558450 2026] [:error] [pid 37130:tid 37220] [client 85.203.23.84:44545] [client 85.203.23.84] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/widgets/"] [unique_id "afbU8KIu7bmXKXicRk9cZgAAAIc"]
[Sun May 03 12:54:23.766538 2026] [:error] [pid 40456:tid 40461] [client 85.203.23.70:55429] [client 85.203.23.70] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentyone/assets/"] [unique_id "afbU_zSujTvwdzEkjScVsAAAAYM"]
[Sun May 03 12:54:23.972940 2026] [:error] [pid 37127:tid 37185] [client 85.203.23.104:49019] [client 85.203.23.104] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/aboutc.php"] [unique_id "afbU__8khJXb5O5aWVUOOAAAAEE"]
[Sun May 03 12:54:24.170325 2026] [:error] [pid 37246:tid 37271] [client 85.203.23.67:23489] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "afbVADhvYFGNwhnPamrEwwAAARU"]
[Sun May 03 12:54:24.366024 2026] [:error] [pid 37246:tid 37254] [client 85.203.23.68:41029] [client 85.203.23.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/Content/Type/Sniffer.plugin.php"] [unique_id "afbVADhvYFGNwhnPamrExAAAAQY"]
[Sun May 03 12:54:29.560899 2026] [:error] [pid 40422:tid 40439] [client 85.203.23.70:41671] [client 85.203.23.70] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/cgi-bin/cgi-bin/config.php"] [unique_id "afbVBUHBbBLrXh6PBuvpEwAAAU0"]
[Sun May 03 12:54:29.762253 2026] [:error] [pid 40422:tid 40438] [client 85.203.23.106:39865] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/nbpmo.php"] [unique_id "afbVBUHBbBLrXh6PBuvpFAAAAUw"]
[Sun May 03 12:54:29.961406 2026] [:error] [pid 37127:tid 37186] [client 85.203.23.72:30871] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/system.php"] [unique_id "afbVBf8khJXb5O5aWVUOOwAAAEI"]
[Sun May 03 12:54:30.170293 2026] [:error] [pid 37127:tid 37206] [client 85.203.23.89:36957] [client 85.203.23.89] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/login.php"] [unique_id "afbVBv8khJXb5O5aWVUOPQAAAFQ"]
[Sun May 03 12:54:35.361210 2026] [:error] [pid 37246:tid 37269] [client 85.203.23.72:43909] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/gk.php"] [unique_id "afbVCzhvYFGNwhnPamrEzwAAARM"]
[Sun May 03 12:54:35.553922 2026] [:error] [pid 37127:tid 37196] [client 85.203.23.103:59205] [client 85.203.23.103] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/about/system_core.php"] [unique_id "afbVC_8khJXb5O5aWVUOPgAAAEw"]
[Sun May 03 12:54:35.761595 2026] [:error] [pid 37130:tid 37215] [client 85.203.23.78:63181] [client 85.203.23.78] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/system_core.php"] [unique_id "afbVC6Iu7bmXKXicRk9cdwAAAII"]
[Sun May 03 12:54:35.997138 2026] [:error] [pid 40456:tid 40475] [client 85.203.23.60:50685] [client 85.203.23.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/system_core.php"] [unique_id "afbVCzSujTvwdzEkjScVuQAAAZE"]
[Sun May 03 12:54:36.181033 2026] [:error] [pid 37126:tid 37151] [client 85.203.23.102:34905] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/contact/system_core.php"] [unique_id "afbVDPR_A42N-LtDyrv8UgAAAAA"]
[Sun May 03 12:54:36.379318 2026] [:error] [pid 37127:tid 37189] [client 85.203.23.60:49489] [client 85.203.23.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/ai-builder/system_core.php"] [unique_id "afbVDP8khJXb5O5aWVUOQAAAAEU"]
[Sun May 03 12:54:36.589422 2026] [:error] [pid 37127:tid 37207] [client 85.203.23.102:29101] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/ast-block-templates-json/system_core.php"] [unique_id "afbVDP8khJXb5O5aWVUOQgAAAFU"]
[Sun May 03 12:54:36.778817 2026] [:error] [pid 37127:tid 37200] [client 85.203.23.94:49275] [client 85.203.23.94] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/astra-sites/json/system_core.php"] [unique_id "afbVDP8khJXb5O5aWVUOQwAAAE8"]
[Sun May 03 12:54:47.002433 2026] [:error] [pid 37246:tid 37262] [client 85.203.23.98:22915] [client 85.203.23.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/elementor/system_core.php"] [unique_id "afbVFzhvYFGNwhnPamrE5AAAAQw"]
[Sun May 03 12:54:47.552283 2026] [:error] [pid 37246:tid 37265] [client 85.203.23.99:47695] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/simply-static/temp-files/system_core.php"] [unique_id "afbVFzhvYFGNwhnPamrE5gAAAQ8"]
[Sun May 03 12:54:52.991802 2026] [:error] [pid 40456:tid 40458] [client 85.203.23.55:64479] [client 85.203.23.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/system_core.php"] [unique_id "afbVHDSujTvwdzEkjScVywAAAYA"]
[Sun May 03 12:54:53.182750 2026] [:error] [pid 40386:tid 40399] [client 85.203.23.66:42659] [client 85.203.23.66] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wc-logs/system_core.php"] [unique_id "afbVHVHJDYRXUf3IbRQAgQAAAMs"]
[Sun May 03 12:54:53.389029 2026] [:error] [pid 40422:tid 40440] [client 85.203.23.63:62733] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/woocommerce_uploads/system_core.php"] [unique_id "afbVHUHBbBLrXh6PBuvpJgAAAU4"]
[Sun May 03 12:54:53.586158 2026] [:error] [pid 37246:tid 37267] [client 85.203.23.78:42561] [client 85.203.23.78] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wpforms/cache/system_core.php"] [unique_id "afbVHThvYFGNwhnPamrE7gAAARE"]
[Sun May 03 12:54:53.769988 2026] [:error] [pid 37246:tid 37262] [client 85.203.23.99:26963] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp-file-manager-pro/"] [unique_id "afbVHThvYFGNwhnPamrE7wAAAQw"]
[Sun May 03 12:54:53.964652 2026] [:error] [pid 37246:tid 37251] [client 85.203.23.97:23215] [client 85.203.23.97] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/db-status.php"] [unique_id "afbVHThvYFGNwhnPamrE8AAAAQM"]
[Sun May 03 12:54:54.174515 2026] [:error] [pid 40422:tid 40433] [client 85.203.23.100:64161] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wp-content/uploads/"] [unique_id "afbVHkHBbBLrXh6PBuvpKwAAAUc"]
[Sun May 03 12:54:54.358921 2026] [:error] [pid 40422:tid 40429] [client 85.203.23.83:24421] [client 85.203.23.83] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/elementor/css/"] [unique_id "afbVHkHBbBLrXh6PBuvpLAAAAUM"]
[Sun May 03 12:54:54.558931 2026] [:error] [pid 37126:tid 37162] [client 85.203.23.93:32011] [client 85.203.23.93] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp-file-manager-pro/fm_backup/"] [unique_id "afbVHvR_A42N-LtDyrv8XQAAAAk"]
[Sun May 03 12:54:59.802292 2026] [:error] [pid 40422:tid 40448] [client 85.203.23.68:25263] [client 85.203.23.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/well-known/pki-validation/"] [unique_id "afbVI0HBbBLrXh6PBuvpMwAAAVY"]
[Sun May 03 12:55:15.446050 2026] [:error] [pid 40422:tid 40429] [client 85.203.23.88:41035] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/uploads/wp.php"] [unique_id "afbVM0HBbBLrXh6PBuvpSgAAAUM"]
[Sun May 03 12:55:20.772308 2026] [:error] [pid 40422:tid 40441] [client 85.203.23.80:47833] [client 85.203.23.80] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/media/system_core.php"] [unique_id "afbVOEHBbBLrXh6PBuvpWAAAAU8"]
[Sun May 03 12:55:20.969125 2026] [:error] [pid 37126:tid 37171] [client 85.203.23.89:22967] [client 85.203.23.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/system_core.php"] [unique_id "afbVOPR_A42N-LtDyrv8aQAAABI"]
[Sun May 03 12:55:22.596530 2026] [:error] [pid 37126:tid 37170] [client 85.203.23.82:40443] [client 85.203.23.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/system_core.php"] [unique_id "afbVOvR_A42N-LtDyrv8agAAABE"]
[Sun May 03 12:55:22.953656 2026] [:error] [pid 40422:tid 40427] [client 85.203.23.61:22307] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/system_core.php"] [unique_id "afbVOkHBbBLrXh6PBuvpYAAAAUE"]
[Sun May 03 12:55:23.159249 2026] [:error] [pid 40422:tid 40437] [client 85.203.23.93:47847] [client 85.203.23.93] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/oembed/system_core.php"] [unique_id "afbVO0HBbBLrXh6PBuvpYwAAAUs"]
[Sun May 03 12:55:23.370711 2026] [:error] [pid 40422:tid 40447] [client 85.203.23.70:48551] [client 85.203.23.70] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/system_core.php"] [unique_id "afbVO0HBbBLrXh6PBuvpZAAAAVU"]
[Sun May 03 12:55:23.568528 2026] [:error] [pid 40422:tid 40433] [client 85.203.23.87:42497] [client 85.203.23.87] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/system_core.php"] [unique_id "afbVO0HBbBLrXh6PBuvpZgAAAUc"]
[Sun May 03 12:55:23.775378 2026] [:error] [pid 40422:tid 40429] [client 85.203.23.68:34185] [client 85.203.23.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/system_core.php"] [unique_id "afbVO0HBbBLrXh6PBuvpZwAAAUM"]
[Sun May 03 12:55:23.988729 2026] [:error] [pid 40422:tid 40450] [client 85.203.23.62:30919] [client 85.203.23.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wp-content/wp-config-backup.php"] [unique_id "afbVO0HBbBLrXh6PBuvpaQAAAVg"]
[Sun May 03 12:55:24.175969 2026] [:error] [pid 37130:tid 37217] [client 85.203.23.60:32623] [client 85.203.23.60] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-content/wp-config.php"] [unique_id "afbVPKIu7bmXKXicRk9cgAAAAIQ"]
[Sun May 03 12:55:24.371069 2026] [:error] [pid 37130:tid 37226] [client 85.203.23.102:39949] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/js_composer/bak.php"] [unique_id "afbVPKIu7bmXKXicRk9cgQAAAI0"]
[Sun May 03 12:55:24.667440 2026] [:error] [pid 37127:tid 37194] [client 85.203.23.62:42499] [client 85.203.23.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/elementor/assets/css/conditionals/system_core.php"] [unique_id "afbVPP8khJXb5O5aWVUOXAAAAEo"]
[Sun May 03 12:55:24.870889 2026] [:error] [pid 37126:tid 37162] [client 85.203.23.72:51147] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/system_core.php"] [unique_id "afbVPPR_A42N-LtDyrv8bAAAAAk"]
[Sun May 03 12:55:25.073284 2026] [:error] [pid 40422:tid 40445] [client 85.203.23.60:44629] [client 85.203.23.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wpforms-lite/assets/css/frontend/modern/system_core.php"] [unique_id "afbVPUHBbBLrXh6PBuvpbAAAAVM"]
[Sun May 03 12:55:25.471491 2026] [:error] [pid 40422:tid 40427] [client 85.203.23.67:59097] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wp-content/plugins/wp-config-backup.php"] [unique_id "afbVPUHBbBLrXh6PBuvpbQAAAUE"]
[Sun May 03 12:55:25.673093 2026] [:error] [pid 37126:tid 37169] [client 85.203.23.83:45577] [client 85.203.23.83] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-config-backup.php"] [unique_id "afbVPfR_A42N-LtDyrv8bgAAABA"]
[Sun May 03 12:55:25.867785 2026] [:error] [pid 37126:tid 37175] [client 85.203.23.75:26541] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/cielhpn/"] [unique_id "afbVPfR_A42N-LtDyrv8cAAAABY"]
[Sun May 03 12:55:31.075118 2026] [:error] [pid 40456:tid 40481] [client 85.203.23.97:37105] [client 85.203.23.97] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/forminator/library/field-autofill-providers/contracts/wp-login.php"] [unique_id "afbVQzSujTvwdzEkjScV6wAAAZc"]
[Sun May 03 12:55:32.759584 2026] [:error] [pid 40422:tid 40430] [client 85.203.23.67:21063] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/advanced-custom-fields-pro/includes/Updater/about.php"] [unique_id "afbVREHBbBLrXh6PBuvpfwAAAUQ"]
[Sun May 03 12:55:32.965382 2026] [:error] [pid 40386:tid 40398] [client 85.203.23.80:27145] [client 85.203.23.80] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/enhanced-text-widget/analyst/src/class-wp-logo.php"] [unique_id "afbVRFHJDYRXUf3IbRQAjAAAAMo"]
[Sun May 03 12:55:33.167345 2026] [:error] [pid 40386:tid 40412] [client 85.203.23.94:52583] [client 85.203.23.94] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/js_composer/include/classes/vendors/plugins/test.php"] [unique_id "afbVRVHJDYRXUf3IbRQAjQAAANg"]
[Sun May 03 12:55:33.355706 2026] [:error] [pid 37126:tid 37174] [client 85.203.23.100:60181] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/revslider/admin/assets/js/plugins/maintenance.php"] [unique_id "afbVRfR_A42N-LtDyrv8cwAAABU"]
[Sun May 03 12:55:33.568588 2026] [:error] [pid 37126:tid 37177] [client 85.203.23.70:48163] [client 85.203.23.70] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/includes/js/jquery-ui/themes/wp-mail.php"] [unique_id "afbVRfR_A42N-LtDyrv8dAAAABg"]
[Sun May 03 12:55:33.760944 2026] [:error] [pid 40422:tid 40441] [client 85.203.23.86:34563] [client 85.203.23.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/sitepress-multilingual-cms/classes/plugins/wp-blog-header.php"] [unique_id "afbVRUHBbBLrXh6PBuvpgAAAAU8"]
[Sun May 03 12:55:33.969276 2026] [:error] [pid 40422:tid 40429] [client 85.203.23.82:39955] [client 85.203.23.82] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/updraftplus/includes/jstree/themes/wp-activate.php"] [unique_id "afbVRUHBbBLrXh6PBuvpgQAAAUM"]
[Sun May 03 12:55:34.165255 2026] [:error] [pid 37246:tid 37270] [client 85.203.23.55:43975] [client 85.203.23.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wp-file-manager/lib/themes/options.php"] [unique_id "afbVRjhvYFGNwhnPamrFEAAAARQ"]
[Sun May 03 12:55:39.385492 2026] [:error] [pid 40456:tid 40476] [client 85.203.23.90:24977] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/elementor/assets/lib/pickr/themes/wp-blog-header.php"] [unique_id "afbVSzSujTvwdzEkjScV7wAAAZI"]
[Sun May 03 12:55:39.566133 2026] [:error] [pid 37130:tid 37222] [client 85.203.23.82:47533] [client 85.203.23.82] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/contact-form-7/uoyaugar.php"] [unique_id "afbVS6Iu7bmXKXicRk9cjgAAAIk"]
[Sun May 03 12:55:39.766812 2026] [:error] [pid 40422:tid 40432] [client 85.203.23.91:45617] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/check-email/config.php"] [unique_id "afbVS0HBbBLrXh6PBuvpggAAAUY"]
[Sun May 03 12:55:39.957533 2026] [:error] [pid 40386:tid 40392] [client 85.203.23.58:40019] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/file-manager-advanced/config.php"] [unique_id "afbVS1HJDYRXUf3IbRQAjwAAAMQ"]
[Sun May 03 12:55:40.153450 2026] [:error] [pid 37130:tid 37220] [client 85.203.23.61:38679] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/autoload_classmap.php"] [unique_id "afbVTKIu7bmXKXicRk9cjwAAAIc"]
[Sun May 03 12:55:40.367281 2026] [:error] [pid 40456:tid 40462] [client 85.203.23.68:56825] [client 85.203.23.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/elementor/lndex.php"] [unique_id "afbVTDSujTvwdzEkjScV8AAAAYQ"]
[Sun May 03 12:55:40.557283 2026] [:error] [pid 40456:tid 40466] [client 85.203.23.66:22037] [client 85.203.23.66] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/wordpress-seo/wp-seo-trigger-table.php"] [unique_id "afbVTDSujTvwdzEkjScV8gAAAYg"]
[Sun May 03 12:55:45.766879 2026] [:error] [pid 37246:tid 37266] [client 85.203.23.88:37911] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/star-addons-for-elementor/includes/class-star-addons-uploads.php"] [unique_id "afbVUThvYFGNwhnPamrFFQAAARA"]
[Sun May 03 12:55:50.959067 2026] [:error] [pid 40386:tid 40407] [client 85.203.23.55:60913] [client 85.203.23.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/js_composer/include/classes/vendors/plugins/panel.php"] [unique_id "afbVVlHJDYRXUf3IbRQAkwAAANM"]
[Sun May 03 12:55:56.171229 2026] [:error] [pid 40386:tid 40405] [client 85.203.23.99:45267] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/updraftplus/includes/jstree/themes/config.php"] [unique_id "afbVXFHJDYRXUf3IbRQAmAAAANE"]
[Sun May 03 12:56:06.375728 2026] [:error] [pid 40422:tid 40429] [client 85.203.23.75:40293] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/tiktok-for-business/"] [unique_id "afbVZkHBbBLrXh6PBuvpjgAAAUM"]
[Sun May 03 12:56:11.580757 2026] [:error] [pid 40422:tid 40442] [client 85.203.23.93:30295] [client 85.203.23.93] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/hello-plus/classes/ehp-bes.php"] [unique_id "afbVa0HBbBLrXh6PBuvpkQAAAVA"]
[Sun May 03 12:56:11.776635 2026] [:error] [pid 40422:tid 40432] [client 85.203.23.88:29381] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/mu-plugins/config.php"] [unique_id "afbVa0HBbBLrXh6PBuvpkgAAAUY"]
[Sun May 03 12:56:16.969341 2026] [:error] [pid 40456:tid 40463] [client 85.203.23.78:59731] [client 85.203.23.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/site-logo/about.php"] [unique_id "afbVcDSujTvwdzEkjScWAQAAAYU"]
[Sun May 03 12:56:17.165064 2026] [:error] [pid 40422:tid 40434] [client 85.203.23.61:26399] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/newfold-page-cachesocial/about.php"] [unique_id "afbVcUHBbBLrXh6PBuvpmgAAAUg"]
[Sun May 03 12:56:17.397375 2026] [:error] [pid 40422:tid 40446] [client 85.203.23.68:58565] [client 85.203.23.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/file61.php"] [unique_id "afbVcUHBbBLrXh6PBuvpmwAAAVQ"]
[Sun May 03 12:56:22.601886 2026] [:error] [pid 37246:tid 37254] [client 85.203.23.102:47611] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/plugin-editor-trigger.php"] [unique_id "afbVdjhvYFGNwhnPamrFLQAAAQY"]
[Sun May 03 12:56:22.793807 2026] [:error] [pid 37246:tid 37262] [client 85.203.23.62:46969] [client 85.203.23.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/query-pagination-numbers/wp-cron.php"] [unique_id "afbVdjhvYFGNwhnPamrFLgAAAQw"]
[Sun May 03 12:56:27.988264 2026] [:error] [pid 40456:tid 40461] [client 85.203.23.72:62301] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade-temp-backup/media/files/files/cache/ulnc/wbdo/"] [unique_id "afbVezSujTvwdzEkjScWBAAAAYM"]
[Sun May 03 12:56:28.183290 2026] [:error] [pid 40456:tid 40473] [client 85.203.23.88:64885] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/backup/js/build/kys/admin.php"] [unique_id "afbVfDSujTvwdzEkjScWBQAAAY8"]
[Sun May 03 12:56:28.387489 2026] [:error] [pid 40456:tid 40469] [client 85.203.23.61:42361] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/src/v1/dist/build/uols/"] [unique_id "afbVfDSujTvwdzEkjScWBgAAAYs"]
[Sun May 03 12:56:28.673364 2026] [:error] [pid 40422:tid 40441] [client 85.203.23.72:58937] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/css/cache/piwk/admin.php"] [unique_id "afbVfEHBbBLrXh6PBuvpoQAAAU8"]
[Sun May 03 12:56:28.875977 2026] [:error] [pid 40422:tid 40429] [client 85.203.23.90:38039] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/plugins/test.php"] [unique_id "afbVfEHBbBLrXh6PBuvpogAAAUM"]
[Sun May 03 12:56:29.074510 2026] [:error] [pid 40422:tid 40446] [client 85.203.23.75:33183] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/themes/maintenance.php"] [unique_id "afbVfUHBbBLrXh6PBuvpowAAAVQ"]
[Sun May 03 12:56:29.292586 2026] [:error] [pid 40422:tid 40431] [client 85.203.23.80:45085] [client 85.203.23.80] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins_new/sitepress-multilingual-cms/classes/plugins/about.php"] [unique_id "afbVfUHBbBLrXh6PBuvppAAAAUU"]
[Sun May 03 12:56:29.493831 2026] [:error] [pid 40422:tid 40426] [client 85.203.23.58:40515] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins_new/wordpress-seo/admin/import/plugins/wp-blog-header.php"] [unique_id "afbVfUHBbBLrXh6PBuvppQAAAUA"]
[Sun May 03 12:56:29.678531 2026] [:error] [pid 40456:tid 40460] [client 85.203.23.58:59307] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/cs.php"] [unique_id "afbVfTSujTvwdzEkjScWCAAAAYI"]
[Sun May 03 12:56:29.878105 2026] [:error] [pid 40456:tid 40476] [client 85.203.23.66:49851] [client 85.203.23.66] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/IXR/met/uploads/"] [unique_id "afbVfTSujTvwdzEkjScWCQAAAZI"]
[Sun May 03 12:56:31.465287 2026] [:error] [pid 37127:tid 37194] [client 85.203.23.81:62611] [client 85.203.23.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/wdf.php"] [unique_id "afbVf_8khJXb5O5aWVUOZwAAAEo"]
[Sun May 03 12:56:31.676150 2026] [:error] [pid 40422:tid 40438] [client 85.203.23.86:61371] [client 85.203.23.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/koiy.php"] [unique_id "afbVf0HBbBLrXh6PBuvppgAAAUw"]
[Sun May 03 12:56:31.868528 2026] [:error] [pid 40456:tid 40467] [client 85.203.23.98:23651] [client 85.203.23.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/query/"] [unique_id "afbVfzSujTvwdzEkjScWCwAAAYk"]
[Sun May 03 12:56:32.107436 2026] [:error] [pid 40422:tid 40443] [client 85.203.23.89:20251] [client 85.203.23.89] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/spacer/"] [unique_id "afbVgEHBbBLrXh6PBuvppwAAAVE"]
[Sun May 03 12:56:32.289504 2026] [:error] [pid 40456:tid 40475] [client 85.203.23.70:28631] [client 85.203.23.70] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/"] [unique_id "afbVgDSujTvwdzEkjScWDAAAAZE"]
[Sun May 03 12:56:32.501446 2026] [:error] [pid 40456:tid 40471] [client 85.203.23.97:34755] [client 85.203.23.97] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/plugins/media/v3/js/build/icdxa/"] [unique_id "afbVgDSujTvwdzEkjScWDQAAAY0"]
[Sun May 03 12:56:47.699997 2026] [:error] [pid 40456:tid 40464] [client 85.203.23.100:62945] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-wolf.php"] [unique_id "afbVjzSujTvwdzEkjScWFAAAAYY"]
[Sun May 03 12:57:07.964292 2026] [:error] [pid 37246:tid 37261] [client 85.203.23.90:25361] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/theme/about.php"] [unique_id "afbVozhvYFGNwhnPamrFSwAAAQs"]
[Sun May 03 12:57:08.183397 2026] [:error] [pid 37246:tid 37270] [client 85.203.23.54:32659] [client 85.203.23.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/sinatra/inc/customizer/controls/color/about.php"] [unique_id "afbVpDhvYFGNwhnPamrFTQAAARQ"]
[Sun May 03 12:57:08.374159 2026] [:error] [pid 37246:tid 37269] [client 85.203.23.78:35163] [client 85.203.23.78] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/blocksy/inc/panel-builder/footer/widget-area-3/"] [unique_id "afbVpDhvYFGNwhnPamrFTgAAARM"]
[Sun May 03 12:57:23.573746 2026] [:error] [pid 40456:tid 40459] [client 85.203.23.106:46069] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/maintenance.php"] [unique_id "afbVszSujTvwdzEkjScWHgAAAYE"]
[Sun May 03 12:57:28.777026 2026] [:error] [pid 37246:tid 37265] [client 85.203.23.57:23037] [client 85.203.23.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/proton/content-index.php"] [unique_id "afbVuDhvYFGNwhnPamrFYAAAAQ8"]
[Sun May 03 12:57:33.969541 2026] [:error] [pid 40422:tid 40450] [client 85.203.23.102:46183] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentytwentytwo/assets/fonts/inter/"] [unique_id "afbVvUHBbBLrXh6PBuvp5gAAAVg"]
[Sun May 03 12:57:34.281354 2026] [:error] [pid 37127:tid 37191] [client 85.203.23.105:58987] [client 85.203.23.105] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/yootheme/content-index.php"] [unique_id "afbVvv8khJXb5O5aWVUO1AAAAEc"]
[Sun May 03 12:57:39.602819 2026] [:error] [pid 40386:tid 40412] [client 85.203.23.67:27549] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/promobox/"] [unique_id "afbVw1HJDYRXUf3IbRQArwAAANg"]
[Sun May 03 12:57:39.782863 2026] [:error] [pid 40456:tid 40463] [client 85.203.23.99:29769] [client 85.203.23.99] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-signup.php"] [unique_id "afbVwzSujTvwdzEkjScWLQAAAYU"]
[Sun May 03 12:57:39.976997 2026] [:error] [pid 40386:tid 40400] [client 85.203.23.85:22461] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/wp-config-backup.php"] [unique_id "afbVw1HJDYRXUf3IbRQAsAAAAMw"]
[Sun May 03 12:57:50.468999 2026] [:error] [pid 37246:tid 37269] [client 85.203.23.94:59957] [client 85.203.23.94] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/twentynineteen/sass/site/primary/"] [unique_id "afbVzjhvYFGNwhnPamrFawAAARM"]
[Sun May 03 12:57:50.985178 2026] [:error] [pid 40422:tid 40437] [client 85.203.23.83:27577] [client 85.203.23.83] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wp-content/themes/admin.php"] [unique_id "afbVzkHBbBLrXh6PBuvp6wAAAUs"]
[Sun May 03 12:57:56.585133 2026] [:error] [pid 37246:tid 37262] [client 85.203.23.100:52745] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/blogger-buzz/welcome/js/"] [unique_id "afbV1DhvYFGNwhnPamrFbwAAAQw"]
[Sun May 03 12:57:56.778456 2026] [:error] [pid 40422:tid 40445] [client 85.203.23.93:57353] [client 85.203.23.93] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/mesmerize/page-templates/"] [unique_id "afbV1EHBbBLrXh6PBuvp7gAAAVM"]
[Sun May 03 12:57:56.969422 2026] [:error] [pid 37246:tid 37254] [client 85.203.23.67:30405] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/theme-check/theme-check.php"] [unique_id "afbV1DhvYFGNwhnPamrFcAAAAQY"]
[Sun May 03 12:57:57.165675 2026] [:error] [pid 37246:tid 37249] [client 85.203.23.91:59397] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/hello-elementor/template-parts/"] [unique_id "afbV1ThvYFGNwhnPamrFcQAAAQE"]
[Sun May 03 12:57:57.359224 2026] [:error] [pid 37246:tid 37263] [client 85.203.23.66:36579] [client 85.203.23.66] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/Divi/includes/builder/post/taxonomy/"] [unique_id "afbV1ThvYFGNwhnPamrFcgAAAQ0"]
[Sun May 03 12:57:57.560806 2026] [:error] [pid 37246:tid 37268] [client 85.203.23.75:59689] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/system.php"] [unique_id "afbV1ThvYFGNwhnPamrFcwAAARI"]
[Sun May 03 12:58:07.771196 2026] [:error] [pid 37246:tid 37266] [client 85.203.23.62:50017] [client 85.203.23.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/blog-kit/inc/demo/demo-content/"] [unique_id "afbV3zhvYFGNwhnPamrFdwAAARA"]
[Sun May 03 12:58:08.093842 2026] [:error] [pid 37127:tid 37186] [client 85.203.23.86:36455] [client 85.203.23.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/flatsome/inc/"] [unique_id "afbV4P8khJXb5O5aWVUO4wAAAEI"]
[Sun May 03 12:58:08.296841 2026] [:error] [pid 37126:tid 37170] [client 85.203.23.102:46141] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/config.php"] [unique_id "afbV4PR_A42N-LtDyrv8nAAAABE"]
[Sun May 03 12:58:08.482271 2026] [:error] [pid 37126:tid 37172] [client 85.203.23.98:43329] [client 85.203.23.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/config.php"] [unique_id "afbV4PR_A42N-LtDyrv8nQAAABM"]
[Sun May 03 12:58:08.669880 2026] [:error] [pid 37246:tid 37255] [client 85.203.23.63:38675] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/providers/config.php"] [unique_id "afbV4DhvYFGNwhnPamrFeQAAAQc"]
[Sun May 03 12:58:08.877908 2026] [:error] [pid 37130:tid 37222] [client 85.203.23.106:33405] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/sitemaps/config.php"] [unique_id "afbV4KIu7bmXKXicRk9cywAAAIk"]
[Sun May 03 12:58:09.084332 2026] [:error] [pid 37246:tid 37272] [client 85.203.23.54:63435] [client 85.203.23.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/bootstrap.php"] [unique_id "afbV4ThvYFGNwhnPamrFegAAARY"]
[Sun May 03 12:58:09.267076 2026] [:error] [pid 40422:tid 40443] [client 85.203.23.91:63377] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/panel.php"] [unique_id "afbV4UHBbBLrXh6PBuvp8AAAAVE"]
[Sun May 03 12:58:09.460812 2026] [:error] [pid 40422:tid 40450] [client 85.203.23.87:47057] [client 85.203.23.87] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/"] [unique_id "afbV4UHBbBLrXh6PBuvp8QAAAVg"]
[Sun May 03 12:58:09.670191 2026] [:error] [pid 40422:tid 40426] [client 85.203.23.75:29125] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/class-wp-image.php"] [unique_id "afbV4UHBbBLrXh6PBuvp8gAAAUA"]
[Sun May 03 12:58:09.866590 2026] [:error] [pid 40422:tid 40449] [client 85.203.23.83:57009] [client 85.203.23.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/chosen.php"] [unique_id "afbV4UHBbBLrXh6PBuvp8wAAAVc"]
[Sun May 03 12:58:10.065149 2026] [:error] [pid 40422:tid 40430] [client 85.203.23.102:58051] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/php-compat/shadow-bot.php"] [unique_id "afbV4kHBbBLrXh6PBuvp9AAAAUQ"]
[Sun May 03 12:58:10.264165 2026] [:error] [pid 37246:tid 37274] [client 85.203.23.54:25603] [client 85.203.23.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/cgi-bin/config.php"] [unique_id "afbV4jhvYFGNwhnPamrFfAAAARg"]
[Sun May 03 12:58:15.479763 2026] [:error] [pid 37127:tid 37191] [client 85.203.23.105:61887] [client 85.203.23.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/src/config.php"] [unique_id "afbV5_8khJXb5O5aWVUO5QAAAEc"]
[Sun May 03 12:58:16.204512 2026] [:error] [pid 40386:tid 40394] [client 85.203.23.58:37401] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/config.php"] [unique_id "afbV6FHJDYRXUf3IbRQAuAAAAMY"]
[Sun May 03 12:58:16.400067 2026] [:error] [pid 37246:tid 37256] [client 85.203.23.85:36139] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/config.php"] [unique_id "afbV6DhvYFGNwhnPamrFgAAAAQg"]
[Sun May 03 12:58:16.584515 2026] [:error] [pid 37246:tid 37271] [client 85.203.23.55:57463] [client 85.203.23.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/config.php"] [unique_id "afbV6DhvYFGNwhnPamrFgQAAARU"]
[Sun May 03 12:58:21.777591 2026] [:error] [pid 40422:tid 40427] [client 85.203.23.106:43699] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/config.php"] [unique_id "afbV7UHBbBLrXh6PBuvp-AAAAUE"]
[Sun May 03 12:58:21.970587 2026] [:error] [pid 40422:tid 40441] [client 85.203.23.60:24563] [client 85.203.23.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/config.php"] [unique_id "afbV7UHBbBLrXh6PBuvp-QAAAU8"]
[Sun May 03 12:58:22.170574 2026] [:error] [pid 40422:tid 40446] [client 85.203.23.58:22703] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/plugins/config.php"] [unique_id "afbV7kHBbBLrXh6PBuvp-gAAAVQ"]
[Sun May 03 12:58:22.390519 2026] [:error] [pid 37246:tid 37252] [client 85.203.23.104:20917] [client 85.203.23.104] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/config.php"] [unique_id "afbV7jhvYFGNwhnPamrFiAAAAQQ"]
[Sun May 03 12:58:22.573843 2026] [:error] [pid 37246:tid 37259] [client 85.203.23.94:48459] [client 85.203.23.94] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/cache/config.php"] [unique_id "afbV7jhvYFGNwhnPamrFigAAAQo"]
[Sun May 03 12:58:22.781143 2026] [:error] [pid 37246:tid 37267] [client 85.203.23.87:59719] [client 85.203.23.87] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wp-cloudflare-super-page-cache/config.php"] [unique_id "afbV7jhvYFGNwhnPamrFiwAAARE"]
[Sun May 03 12:58:22.976893 2026] [:error] [pid 40422:tid 40438] [client 85.203.23.90:59169] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/library/"] [unique_id "afbV7kHBbBLrXh6PBuvp-wAAAUw"]
[Sun May 03 12:58:28.187758 2026] [:error] [pid 37126:tid 37173] [client 85.203.23.67:24167] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/loco/"] [unique_id "afbV9PR_A42N-LtDyrv8oQAAABQ"]
[Sun May 03 12:58:28.498313 2026] [:error] [pid 37126:tid 37174] [client 85.203.23.98:60727] [client 85.203.23.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade-temp-backup/"] [unique_id "afbV9PR_A42N-LtDyrv8ogAAABU"]
[Sun May 03 12:58:43.685188 2026] [:error] [pid 40422:tid 40450] [client 85.203.23.91:20761] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/vendor/stripe/stripe-php/lib/FinancialConnections/"] [unique_id "afbWA0HBbBLrXh6PBuvqEwAAAVg"]
[Sun May 03 12:58:43.903121 2026] [:error] [pid 40456:tid 40460] [client 85.203.23.75:44077] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/vendor/stripe/stripe-php/lib/Service/FinancialConnections/"] [unique_id "afbWAzSujTvwdzEkjScWSwAAAYI"]
[Sun May 03 12:58:49.089441 2026] [:error] [pid 40422:tid 40446] [client 85.203.23.57:60159] [client 85.203.23.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/module.audio-video.riff-http.php"] [unique_id "afbWCUHBbBLrXh6PBuvqGQAAAVQ"]
[Sun May 03 12:58:49.278162 2026] [:error] [pid 37246:tid 37252] [client 85.203.23.81:51073] [client 85.203.23.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/admin.php"] [unique_id "afbWCThvYFGNwhnPamrFkgAAAQQ"]
[Sun May 03 12:58:49.499521 2026] [:error] [pid 40386:tid 40388] [client 85.203.23.67:61777] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin.php"] [unique_id "afbWCVHJDYRXUf3IbRQAvwAAAMA"]
[Sun May 03 12:58:49.743516 2026] [:error] [pid 37246:tid 37259] [client 85.203.23.55:30199] [client 85.203.23.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "afbWCThvYFGNwhnPamrFkwAAAQo"]
[Sun May 03 12:58:49.977953 2026] [:error] [pid 37246:tid 37267] [client 85.203.23.54:34981] [client 85.203.23.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/thickbox/logs1.php"] [unique_id "afbWCThvYFGNwhnPamrFlAAAARE"]
[Sun May 03 12:58:50.171905 2026] [:error] [pid 40422:tid 40437] [client 85.203.23.55:42713] [client 85.203.23.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/admin.php"] [unique_id "afbWCkHBbBLrXh6PBuvqHAAAAUs"]
[Sun May 03 12:58:50.361268 2026] [:error] [pid 37126:tid 37167] [client 85.203.23.91:25013] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/xy.php"] [unique_id "afbWCvR_A42N-LtDyrv8pQAAAA4"]
[Sun May 03 12:58:50.583701 2026] [:error] [pid 37126:tid 37171] [client 85.203.23.85:36497] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/xy.php"] [unique_id "afbWCvR_A42N-LtDyrv8pgAAABI"]
[Sun May 03 12:58:50.863920 2026] [:error] [pid 40422:tid 40450] [client 85.203.23.61:56733] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/footer-class.php"] [unique_id "afbWCkHBbBLrXh6PBuvqHQAAAVg"]
[Sun May 03 12:58:51.061952 2026] [:error] [pid 40456:tid 40470] [client 85.203.23.89:32113] [client 85.203.23.89] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/good.php"] [unique_id "afbWCzSujTvwdzEkjScWVAAAAYw"]
[Sun May 03 12:58:56.266035 2026] [:error] [pid 37246:tid 37251] [client 85.203.23.61:44843] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/profile/admin.php"] [unique_id "afbWEDhvYFGNwhnPamrFngAAAQM"]
[Sun May 03 12:58:56.898559 2026] [:error] [pid 37126:tid 37157] [client 85.203.23.81:31925] [client 85.203.23.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/summia/"] [unique_id "afbWEPR_A42N-LtDyrv8qQAAAAQ"]
[Sun May 03 12:58:57.148972 2026] [:error] [pid 40422:tid 40433] [client 85.203.23.91:24933] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wp-content/languages/config.php"] [unique_id "afbWEUHBbBLrXh6PBuvqIQAAAUc"]
[Sun May 03 12:58:57.400568 2026] [:error] [pid 40422:tid 40443] [client 85.203.23.87:29741] [client 85.203.23.87] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/wp-content/admin.php"] [unique_id "afbWEUHBbBLrXh6PBuvqIgAAAVE"]
[Sun May 03 12:58:57.592771 2026] [:error] [pid 40422:tid 40428] [client 85.203.23.106:43663] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/autoload_classmap.php"] [unique_id "afbWEUHBbBLrXh6PBuvqIwAAAUI"]
[Sun May 03 12:58:57.774423 2026] [:error] [pid 40422:tid 40435] [client 85.203.23.78:38089] [client 85.203.23.78] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/h2.php"] [unique_id "afbWEUHBbBLrXh6PBuvqJAAAAUk"]
[Sun May 03 12:59:02.974067 2026] [:error] [pid 40456:tid 40459] [client 85.203.23.66:33199] [client 85.203.23.66] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/upgrade-temp-backup/autoload_classmap.php"] [unique_id "afbWFjSujTvwdzEkjScWWgAAAYE"]
[Sun May 03 12:59:03.392118 2026] [:error] [pid 40386:tid 40409] [client 85.203.23.83:20251] [client 85.203.23.83] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/images/Base.php"] [unique_id "afbWF1HJDYRXUf3IbRQAyQAAANU"]
[Sun May 03 12:59:03.845880 2026] [:error] [pid 37130:tid 37233] [client 85.203.23.94:45809] [client 85.203.23.94] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins.bk/contact-form-7/includes/js/jquery-ui/themes/admin.php"] [unique_id "afbWF6Iu7bmXKXicRk9c1wAAAJQ"]
[Sun May 03 12:59:04.186823 2026] [:error] [pid 37127:tid 37199] [client 85.203.23.103:47649] [client 85.203.23.103] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins.bk/js_composer/include/classes/vendors/plugins/system.php"] [unique_id "afbWGP8khJXb5O5aWVUO9QAAAE4"]
[Sun May 03 12:59:04.366401 2026] [:error] [pid 37127:tid 37190] [client 85.203.23.94:41041] [client 85.203.23.94] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins.bk/wordpress-seo/admin/import/plugins/maintenance.php"] [unique_id "afbWGP8khJXb5O5aWVUO9gAAAEY"]
[Sun May 03 12:59:04.551009 2026] [:error] [pid 37246:tid 37252] [client 85.203.23.90:45543] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/wp-mail.php"] [unique_id "afbWGDhvYFGNwhnPamrFpwAAAQQ"]
[Sun May 03 12:59:09.772739 2026] [:error] [pid 40456:tid 40474] [client 85.203.23.90:29283] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php"] [unique_id "afbWHTSujTvwdzEkjScWYgAAAZA"]
[Sun May 03 12:59:09.957096 2026] [:error] [pid 40386:tid 40405] [client 85.203.23.61:27467] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/lock.php"] [unique_id "afbWHVHJDYRXUf3IbRQAzAAAANE"]
[Sun May 03 12:59:10.185046 2026] [:error] [pid 37130:tid 37217] [client 85.203.23.88:33455] [client 85.203.23.88] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/com.php"] [unique_id "afbWHqIu7bmXKXicRk9c2gAAAIQ"]
[Sun May 03 12:59:20.369961 2026] [:error] [pid 37246:tid 37266] [client 85.203.23.61:54255] [client 85.203.23.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/plugins/colors/"] [unique_id "afbWKDhvYFGNwhnPamrFswAAARA"]
[Sun May 03 12:59:20.573769 2026] [:error] [pid 37246:tid 37251] [client 85.203.23.67:22095] [client 85.203.23.67] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/backups-dup-pro/imports/network/"] [unique_id "afbWKDhvYFGNwhnPamrFtAAAAQM"]
[Sun May 03 12:59:20.763057 2026] [:error] [pid 37246:tid 37271] [client 85.203.23.87:41231] [client 85.203.23.87] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/ai1wm-backups/includes/"] [unique_id "afbWKDhvYFGNwhnPamrFtQAAARU"]
[Sun May 03 12:59:21.187532 2026] [:error] [pid 40422:tid 40435] [client 85.203.23.100:21239] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "afbWKUHBbBLrXh6PBuvqOgAAAUk"]
[Sun May 03 12:59:21.464447 2026] [:error] [pid 37130:tid 37222] [client 85.203.23.103:26529] [client 85.203.23.103] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "afbWKaIu7bmXKXicRk9c4gAAAIk"]
[Sun May 03 12:59:21.670343 2026] [:error] [pid 37127:tid 37190] [client 85.203.23.106:29853] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/panel.php"] [unique_id "afbWKf8khJXb5O5aWVUO_AAAAEY"]
[Sun May 03 12:59:21.880355 2026] [:error] [pid 37126:tid 37169] [client 85.203.23.90:55593] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-themes.php"] [unique_id "afbWKfR_A42N-LtDyrv8swAAABA"]
[Sun May 03 12:59:22.068351 2026] [:error] [pid 37126:tid 37176] [client 85.203.23.106:49149] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/widgets/maint/"] [unique_id "afbWKvR_A42N-LtDyrv8tAAAABc"]
[Sun May 03 12:59:22.271252 2026] [:error] [pid 40386:tid 40408] [client 85.203.23.59:47863] [client 85.203.23.59] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Exception/Transport/"] [unique_id "afbWKlHJDYRXUf3IbRQA2QAAANQ"]
[Sun May 03 12:59:22.484025 2026] [:error] [pid 37126:tid 37151] [client 85.203.23.100:49909] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/src/Response/"] [unique_id "afbWKvR_A42N-LtDyrv8tgAAAAA"]
[Sun May 03 12:59:22.786689 2026] [:error] [pid 37127:tid 37203] [client 85.203.23.75:51315] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/wp-sing.php"] [unique_id "afbWKv8khJXb5O5aWVUO_wAAAFI"]
[Sun May 03 12:59:23.045826 2026] [:error] [pid 37246:tid 37249] [client 85.203.23.57:34149] [client 85.203.23.57] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/button/"] [unique_id "afbWKzhvYFGNwhnPamrFtwAAAQE"]
[Sun May 03 12:59:23.491728 2026] [:error] [pid 37126:tid 37160] [client 85.203.23.62:61269] [client 85.203.23.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/media-text/"] [unique_id "afbWK_R_A42N-LtDyrv8ugAAAAc"]
[Sun May 03 12:59:23.697874 2026] [:error] [pid 40456:tid 40462] [client 85.203.23.106:50871] [client 85.203.23.106] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/missing/"] [unique_id "afbWKzSujTvwdzEkjScWbQAAAYQ"]
[Sun May 03 12:59:23.894951 2026] [:error] [pid 37126:tid 37168] [client 85.203.23.60:36137] [client 85.203.23.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "afbWK_R_A42N-LtDyrv8vAAAAA8"]
[Sun May 03 12:59:24.081651 2026] [:error] [pid 40386:tid 40393] [client 85.203.23.101:40811] [client 85.203.23.101] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/img/content/media/lnl/"] [unique_id "afbWLFHJDYRXUf3IbRQA2gAAAMU"]
[Sun May 03 12:59:24.275377 2026] [:error] [pid 40456:tid 40473] [client 85.203.23.97:60695] [client 85.203.23.97] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/gallery/"] [unique_id "afbWLDSujTvwdzEkjScWcAAAAY8"]
[Sun May 03 12:59:24.488249 2026] [:error] [pid 40386:tid 40411] [client 85.203.23.87:62085] [client 85.203.23.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/l10n/includes/content/v2/uploads/docs/yat/admin.php"] [unique_id "afbWLFHJDYRXUf3IbRQA3QAAANc"]
[Sun May 03 12:59:24.698171 2026] [:error] [pid 40386:tid 40401] [client 85.203.23.90:60215] [client 85.203.23.90] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/cache/adminkontol.php"] [unique_id "afbWLFHJDYRXUf3IbRQA3gAAAM0"]
[Sun May 03 12:59:29.963641 2026] [:error] [pid 40386:tid 40394] [client 85.203.23.100:57841] [client 85.203.23.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/database/"] [unique_id "afbWMVHJDYRXUf3IbRQA4gAAAMY"]
[Sun May 03 12:59:30.156807 2026] [:error] [pid 37246:tid 37273] [client 85.203.23.83:55183] [client 85.203.23.83] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/uploads/system.php"] [unique_id "afbWMjhvYFGNwhnPamrF1AAAARc"]
[Sun May 03 12:59:30.364228 2026] [:error] [pid 37127:tid 37209] [client 85.203.23.91:21787] [client 85.203.23.91] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/block/img/themes/"] [unique_id "afbWMv8khJXb5O5aWVUPCAAAAFc"]
[Sun May 03 12:59:30.564494 2026] [:error] [pid 40456:tid 40462] [client 85.203.23.70:25329] [client 85.203.23.70] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/preformatted/"] [unique_id "afbWMjSujTvwdzEkjScWeAAAAYQ"]
[Sun May 03 12:59:30.750140 2026] [:error] [pid 37246:tid 37271] [client 85.203.23.63:60899] [client 85.203.23.63] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-content/languages/themes/wp-load.php"] [unique_id "afbWMjhvYFGNwhnPamrF1QAAARU"]
[Sun May 03 12:59:30.953609 2026] [:error] [pid 40456:tid 40481] [client 85.203.23.58:46765] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/plugins/home.php"] [unique_id "afbWMjSujTvwdzEkjScWeQAAAZc"]
[Sun May 03 12:59:31.206144 2026] [:error] [pid 37246:tid 37248] [client 85.203.23.89:40761] [client 85.203.23.89] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/themes/"] [unique_id "afbWMzhvYFGNwhnPamrF2AAAAQA"]
[Sun May 03 12:59:31.390751 2026] [:error] [pid 37246:tid 37274] [client 85.203.23.75:25077] [client 85.203.23.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/system_core.php"] [unique_id "afbWMzhvYFGNwhnPamrF2QAAARg"]
[Sun May 03 12:59:31.683557 2026] [:error] [pid 40386:tid 40393] [client 85.203.23.81:20345] [client 85.203.23.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/maintenance.php"] [unique_id "afbWM1HJDYRXUf3IbRQA5QAAAMU"]
[Sun May 03 12:59:37.201450 2026] [:error] [pid 37246:tid 37266] [client 85.203.23.72:49079] [client 85.203.23.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/w.php"] [unique_id "afbWOThvYFGNwhnPamrF6AAAARA"]
[Sun May 03 12:59:37.384038 2026] [:error] [pid 37246:tid 37252] [client 85.203.23.62:35383] [client 85.203.23.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class-wp-http-client.php"] [unique_id "afbWOThvYFGNwhnPamrF6gAAAQQ"]
[Sun May 03 12:59:42.577380 2026] [:error] [pid 40456:tid 40481] [client 85.203.23.104:60387] [client 85.203.23.104] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/tag-cloud/"] [unique_id "afbWPjSujTvwdzEkjScWhAAAAZc"]
[Sun May 03 12:59:42.842295 2026] [:error] [pid 37127:tid 37206] [client 85.203.23.104:52971] [client 85.203.23.104] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/nic.php"] [unique_id "afbWPv8khJXb5O5aWVUPEAAAAFQ"]
[Sun May 03 12:59:43.064080 2026] [:error] [pid 40422:tid 40446] [client 85.203.23.58:56209] [client 85.203.23.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/wp-conflg.php"] [unique_id "afbWP0HBbBLrXh6PBuvqPgAAAVQ"]
[Sun May 03 12:59:43.270680 2026] [:error] [pid 40422:tid 40428] [client 85.203.23.70:53057] [client 85.203.23.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/wp-conflg.php"] [unique_id "afbWP0HBbBLrXh6PBuvqPwAAAUI"]
[Sun May 03 12:59:43.455594 2026] [:error] [pid 40422:tid 40439] [client 85.203.23.102:48865] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/autoload_classmap.php"] [unique_id "afbWP0HBbBLrXh6PBuvqQAAAAU0"]
[Sun May 03 12:59:43.659288 2026] [:error] [pid 40422:tid 40450] [client 85.203.23.102:56955] [client 85.203.23.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/autoload_classmap.php"] [unique_id "afbWP0HBbBLrXh6PBuvqQgAAAVg"]
[Sun May 03 12:59:43.965401 2026] [:error] [pid 37130:tid 37219] [client 85.203.23.86:24593] [client 85.203.23.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-admin/autoload_classmap.php"] [unique_id "afbWP6Iu7bmXKXicRk9c6wAAAIY"]
[Sun May 03 12:59:44.395679 2026] [:error] [pid 40422:tid 40449] [client 85.203.23.104:30215] [client 85.203.23.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/tinymce/themes/api.php"] [unique_id "afbWQEHBbBLrXh6PBuvqRgAAAVc"]
[Sun May 03 12:59:49.672656 2026] [:error] [pid 40456:tid 40473] [client 85.203.23.85:30113] [client 85.203.23.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/components/wp-cron-activation.php"] [unique_id "afbWRTSujTvwdzEkjScWkAAAAY8"]
[Sun May 03 12:59:54.858038 2026] [:error] [pid 40386:tid 40389] [client 85.203.23.60:57765] [client 85.203.23.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/dist/base-styles/user/"] [unique_id "afbWSlHJDYRXUf3IbRQA9gAAAME"]
[Sun May 03 12:59:55.051460 2026] [:error] [pid 37127:tid 37209] [client 85.203.23.80:43003] [client 85.203.23.80] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/wp-includes/abilities-api/Parse/"] [unique_id "afbWS_8khJXb5O5aWVUPGgAAAFc"]
[Sun May 03 13:26:54.268804 2026] [:error] [pid 40422:tid 40429] [client 173.214.162.14:55718] [client 173.214.162.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 173.214.162.14, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afbcnkHBbBLrXh6PBuv1xwAAAUM"]
[Sun May 03 14:37:46.071880 2026] [:error] [pid 37246:tid 37254] [client 152.58.133.240:65471] [client 152.58.133.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.58.133.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afbtOjhvYFGNwhnPamrkwgAAAQY"]
[Sun May 03 14:37:54.852215 2026] [:error] [pid 40422:tid 40441] [client 152.58.133.240:49394] [client 152.58.133.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.58.133.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afbtQkHBbBLrXh6PBusTHwAAAU8"]
[Sun May 03 14:38:04.906359 2026] [:error] [pid 37246:tid 37257] [client 152.58.133.240:49662] [client 152.58.133.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.58.133.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afbtTDhvYFGNwhnPamrk3gAAAQk"]
[Sun May 03 14:38:15.058486 2026] [:error] [pid 37126:tid 37168] [client 152.58.133.240:49925] [client 152.58.133.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.58.133.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afbtV_R_A42N-LtDyrsIIAAAAA8"]
[Sun May 03 14:38:25.181649 2026] [:error] [pid 40422:tid 40439] [client 152.58.133.240:50164] [client 152.58.133.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.58.133.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afbtYUHBbBLrXh6PBusTXQAAAU0"]
[Sun May 03 14:38:35.323871 2026] [:error] [pid 37246:tid 37259] [client 152.58.133.240:50405] [client 152.58.133.240] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.58.133.240, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afbtazhvYFGNwhnPamrk_AAAAQo"]
[Sun May 03 15:20:05.874480 2026] [:error] [pid 40422:tid 40431] [client 45.233.148.131:60084] [client 45.233.148.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.233.148.131, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afb3JUHBbBLrXh6PBuseuAAAAUU"]
[Sun May 03 15:38:40.745744 2026] [:error] [pid 37246:tid 37259] [client 195.201.243.162:36808] [client 195.201.243.162] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.201.243.162, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afb7gDhvYFGNwhnPamr1zgAAAQo"]
[Sun May 03 16:03:56.371805 2026] [ssl:error] [pid 37126:tid 37174] [client 46.101.80.192:51663] AH02032: Hostname www.nnyvfa.com provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup
[Sun May 03 16:22:09.636462 2026] [:error] [pid 34432:tid 34444] [client 170.106.193.108:47832] [client 170.106.193.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afcFsZ73JKVQ0wlof4IlPgAAAco"]
[Sun May 03 17:15:52.664980 2026] [:error] [pid 37126:tid 37159] [client 155.133.132.65:56460] [client 155.133.132.65] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 155.133.132.65, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afcSSPR_A42N-LtDyrssIgAAAAY"]
[Sun May 03 18:03:55.712040 2026] [:error] [pid 37130:tid 37220] [client 164.132.49.123:54848] [client 164.132.49.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.132.49.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afcdi6Iu7bmXKXicRk-AiQAAAIc"]
[Sun May 03 18:20:54.612205 2026] [:error] [pid 40422:tid 40439] [client 91.245.210.195:57576] [client 91.245.210.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.245.210.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afchhkHBbBLrXh6PBus84wAAAU0"]
[Sun May 03 19:25:18.818406 2026] [:error] [pid 54535:tid 54540] [client 179.41.7.254:57880] [client 179.41.7.254] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.41.7.254, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afcwnvRyz79iR-ntJRLl2AAAAgM"]
[Sun May 03 20:11:01.192332 2026] [:error] [pid 37127:tid 37199] [client 96.9.125.116:46024] [client 96.9.125.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 96.9.125.116, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afc7Vf8khJXb5O5aWVVEzgAAAE4"]
[Sun May 03 21:19:16.908110 2026] [:error] [pid 40456:tid 40467] [client 43.165.198.224:57344] [client 43.165.198.224] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afdLVDSujTvwdzEkjSdaTAAAAYk"]
[Sun May 03 22:17:56.407049 2026] [:error] [pid 34432:tid 34446] [client 103.240.97.39:63197] [client 103.240.97.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.240.97.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afdZFJ73JKVQ0wlof4KObwAAAcw"]
[Sun May 03 22:18:06.790869 2026] [:error] [pid 37127:tid 37190] [client 103.240.97.39:63558] [client 103.240.97.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.240.97.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afdZHv8khJXb5O5aWVVNMQAAAEY"]
[Sun May 03 22:18:17.393655 2026] [:error] [pid 37246:tid 37250] [client 103.240.97.39:63904] [client 103.240.97.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.240.97.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afdZKThvYFGNwhnPamo5TgAAAQI"]
[Sun May 03 22:18:27.957315 2026] [:error] [pid 34432:tid 34441] [client 103.240.97.39:64159] [client 103.240.97.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.240.97.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afdZM573JKVQ0wlof4KOiAAAAcc"]
[Sun May 03 22:18:38.430936 2026] [:error] [pid 37246:tid 37252] [client 103.240.97.39:64412] [client 103.240.97.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.240.97.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afdZPjhvYFGNwhnPamo5YQAAAQQ"]
[Sun May 03 22:51:56.978606 2026] [:error] [pid 40386:tid 40406] [client 37.78.222.168:50010] [client 37.78.222.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.78.222.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afdhDFHJDYRXUf3IbRQvfAAAANI"]
[Sun May 03 22:52:06.717784 2026] [:error] [pid 37126:tid 37172] [client 37.78.222.168:63226] [client 37.78.222.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.78.222.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afdhFvR_A42N-LtDyrtVIgAAABM"]
[Sun May 03 22:52:16.957305 2026] [:error] [pid 40386:tid 40403] [client 37.78.222.168:53665] [client 37.78.222.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.78.222.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afdhIFHJDYRXUf3IbRQvgAAAAM8"]
[Sun May 03 22:52:27.150068 2026] [:error] [pid 37130:tid 37221] [client 37.78.222.168:61574] [client 37.78.222.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.78.222.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afdhK6Iu7bmXKXicRk-RoQAAAIg"]
[Sun May 03 22:52:37.398324 2026] [:error] [pid 37130:tid 37233] [client 37.78.222.168:64648] [client 37.78.222.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 37.78.222.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afdhNaIu7bmXKXicRk-RwwAAAJQ"]
[Sun May 03 22:57:41.204651 2026] [:error] [pid 37127:tid 37203] [client 89.216.87.109:64935] [client 89.216.87.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.216.87.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afdiZf8khJXb5O5aWVVQBwAAAFI"]
[Sun May 03 22:57:51.315111 2026] [:error] [pid 54535:tid 54560] [client 89.216.87.109:65301] [client 89.216.87.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.216.87.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afdib_Ryz79iR-ntJRILvQAAAhc"]
[Sun May 03 22:58:01.847690 2026] [:error] [pid 37126:tid 37153] [client 89.216.87.109:49364] [client 89.216.87.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.216.87.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afdiefR_A42N-LtDyrtVlwAAAAI"]
[Sun May 03 22:58:12.436608 2026] [:error] [pid 37130:tid 37216] [client 89.216.87.109:49731] [client 89.216.87.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.216.87.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afdihKIu7bmXKXicRk-SyQAAAIM"]
[Sun May 03 22:58:23.027098 2026] [:error] [pid 37126:tid 37158] [client 89.216.87.109:50231] [client 89.216.87.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.216.87.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afdij_R_A42N-LtDyrtVqAAAAAU"]
[Mon May 04 02:13:29.257254 2026] [:error] [pid 37126:tid 37175] [client 43.130.141.193:36834] [client 43.130.141.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afeQSfR_A42N-LtDyrtfMAAAABY"]
[Mon May 04 02:38:12.873754 2026] [:error] [pid 40456:tid 40477] [client 43.243.81.205:50766] [client 43.243.81.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.243.81.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afeWFDSujTvwdzEkjSd5qgAAAZM"]
[Mon May 04 02:38:23.160315 2026] [:error] [pid 37127:tid 37185] [client 43.243.81.205:51078] [client 43.243.81.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.243.81.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afeWH_8khJXb5O5aWVVY8wAAAEE"]
[Mon May 04 02:38:33.813308 2026] [:error] [pid 54535:tid 54550] [client 43.243.81.205:51298] [client 43.243.81.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.243.81.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afeWKfRyz79iR-ntJRIv8QAAAg0"]
[Mon May 04 02:38:44.446781 2026] [:error] [pid 37127:tid 37201] [client 43.243.81.205:51523] [client 43.243.81.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.243.81.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afeWNP8khJXb5O5aWVVZAgAAAFA"]
[Mon May 04 02:38:55.226365 2026] [:error] [pid 54535:tid 54543] [client 43.243.81.205:51729] [client 43.243.81.205] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 43.243.81.205, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afeWP_Ryz79iR-ntJRIwJAAAAgY"]
[Mon May 04 04:29:01.310103 2026] [:error] [pid 31168:tid 31172] [client 20.104.98.52:56179] [client 20.104.98.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "afewDbJUVgN8GV2P4h49oAAAAUI"]
[Mon May 04 04:29:03.903927 2026] [:error] [pid 31168:tid 31177] [client 20.104.98.52:34411] [client 20.104.98.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "afewD7JUVgN8GV2P4h49oQAAAUc"]
[Mon May 04 04:29:05.697729 2026] [:error] [pid 57047:tid 57100] [client 20.104.98.52:8805] [client 20.104.98.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "afewEVtCAxKLCAMkLV2LRgAAAEo"]
[Mon May 04 04:29:07.228963 2026] [:error] [pid 31168:tid 31181] [client 20.104.98.52:58016] [client 20.104.98.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "afewE7JUVgN8GV2P4h49pgAAAUs"]
[Mon May 04 05:35:47.408132 2026] [:error] [pid 57154:tid 57172] [client 43.138.68.113:38812] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afe_s_4DAn7umy_ATRzb0gAAAM8"]
[Mon May 04 06:39:54.678324 2026] [:error] [pid 57154:tid 57173] [client 85.87.160.135:15128] [client 85.87.160.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.87.160.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affOuv4DAn7umy_ATRzuoAAAANA"], referer: https://t.co/
[Mon May 04 06:40:15.792644 2026] [:error] [pid 58625:tid 58635] [client 171.248.112.196:43052] [client 171.248.112.196] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "affOz_ZfjPGFqq6KSLkxdgAAAQc"]
[Mon May 04 06:40:18.643581 2026] [:error] [pid 58625:tid 58628] [client 37.120.90.26:59532] [client 37.120.90.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.120.90.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO0vZfjPGFqq6KSLkxdwAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:18.712348 2026] [:error] [pid 57048:tid 57134] [client 199.241.131.172:35738] [client 199.241.131.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.241.131.172, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO0oZINtpBgqE164JZGgAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:19.683150 2026] [:error] [pid 58625:tid 58633] [client 37.120.90.26:59532] [client 37.120.90.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.120.90.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO0_ZfjPGFqq6KSLkxeQAAAQU"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:19.779970 2026] [:error] [pid 57048:tid 57140] [client 199.241.131.172:35738] [client 199.241.131.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.241.131.172, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO04ZINtpBgqE164JZGwAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:20.655190 2026] [:error] [pid 58625:tid 58644] [client 37.120.90.26:59532] [client 37.120.90.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.120.90.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO1PZfjPGFqq6KSLkxewAAARA"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:20.786555 2026] [:error] [pid 57048:tid 57139] [client 199.241.131.172:35738] [client 199.241.131.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.241.131.172, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO1IZINtpBgqE164JZHQAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:21.662550 2026] [:error] [pid 58625:tid 58650] [client 37.120.90.26:59532] [client 37.120.90.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.120.90.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO1fZfjPGFqq6KSLkxfAAAARY"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:21.785855 2026] [:error] [pid 57048:tid 57124] [client 199.241.131.172:35738] [client 199.241.131.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.241.131.172, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO1YZINtpBgqE164JZHgAAAIc"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:22.660938 2026] [:error] [pid 58625:tid 58641] [client 37.120.90.26:59532] [client 37.120.90.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.120.90.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO1vZfjPGFqq6KSLkxfgAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:22.808287 2026] [:error] [pid 57048:tid 57126] [client 199.241.131.172:35738] [client 199.241.131.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.241.131.172, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO1oZINtpBgqE164JZHwAAAIk"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:23.587900 2026] [:error] [pid 58625:tid 58635] [client 37.120.90.26:59532] [client 37.120.90.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.120.90.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO1_ZfjPGFqq6KSLkxfwAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:23.921426 2026] [:error] [pid 57048:tid 57120] [client 199.241.131.172:35738] [client 199.241.131.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.241.131.172, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO14ZINtpBgqE164JZIAAAAIM"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:24.509969 2026] [:error] [pid 58625:tid 58639] [client 37.120.90.26:59532] [client 37.120.90.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.120.90.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO2PZfjPGFqq6KSLkxgAAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:24.987442 2026] [:error] [pid 57048:tid 57119] [client 199.241.131.172:35738] [client 199.241.131.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.241.131.172, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO2IZINtpBgqE164JZIQAAAII"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:25.476628 2026] [:error] [pid 58625:tid 58630] [client 37.120.90.26:59532] [client 37.120.90.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 37.120.90.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO2fZfjPGFqq6KSLkxgQAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:26.217409 2026] [:error] [pid 57048:tid 57121] [client 199.241.131.172:35738] [client 199.241.131.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.241.131.172, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO2oZINtpBgqE164JZIwAAAIQ"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:27.752999 2026] [:error] [pid 57048:tid 57135] [client 199.241.131.172:35738] [client 199.241.131.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.241.131.172, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO24ZINtpBgqE164JZJgAAAJI"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:28.794762 2026] [:error] [pid 57048:tid 57138] [client 199.241.131.172:35738] [client 199.241.131.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.241.131.172, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO3IZINtpBgqE164JZJwAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:30.075597 2026] [:error] [pid 57048:tid 57123] [client 199.241.131.172:35738] [client 199.241.131.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.241.131.172, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO3oZINtpBgqE164JZKgAAAIY"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:31.100980 2026] [:error] [pid 57048:tid 57125] [client 199.241.131.172:35738] [client 199.241.131.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.241.131.172, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO34ZINtpBgqE164JZKwAAAIg"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:32.201474 2026] [:error] [pid 57048:tid 57137] [client 199.241.131.172:35738] [client 199.241.131.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.241.131.172, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO4IZINtpBgqE164JZLAAAAJQ"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:33.347152 2026] [:error] [pid 57048:tid 57126] [client 199.241.131.172:35738] [client 199.241.131.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.241.131.172, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO4YZINtpBgqE164JZLQAAAIk"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:34.780724 2026] [:error] [pid 57048:tid 57132] [client 199.241.131.172:35738] [client 199.241.131.172] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 199.241.131.172, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO4oZINtpBgqE164JZMQAAAI8"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:38.086911 2026] [:error] [pid 58625:tid 58631] [client 69.79.206.82:51620] [client 69.79.206.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.79.206.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO5vZfjPGFqq6KSLkxlAAAAQM"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:39.181955 2026] [:error] [pid 58625:tid 58644] [client 69.79.206.82:51620] [client 69.79.206.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.79.206.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO5_ZfjPGFqq6KSLkxlQAAARA"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:40.241456 2026] [:error] [pid 58625:tid 58638] [client 69.79.206.82:51620] [client 69.79.206.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.79.206.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO6PZfjPGFqq6KSLkxlgAAAQo"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:41.362476 2026] [:error] [pid 58625:tid 58636] [client 69.79.206.82:51620] [client 69.79.206.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.79.206.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO6fZfjPGFqq6KSLkxlwAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:42.467053 2026] [:error] [pid 58625:tid 58650] [client 69.79.206.82:51620] [client 69.79.206.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.79.206.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO6vZfjPGFqq6KSLkxmAAAARY"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:43.572053 2026] [:error] [pid 58625:tid 58646] [client 69.79.206.82:51620] [client 69.79.206.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.79.206.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO6_ZfjPGFqq6KSLkxmQAAARI"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:44.850406 2026] [:error] [pid 58625:tid 58634] [client 69.79.206.82:51620] [client 69.79.206.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.79.206.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO7PZfjPGFqq6KSLkxmgAAAQY"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:46.000104 2026] [:error] [pid 58625:tid 58647] [client 69.79.206.82:51620] [client 69.79.206.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 69.79.206.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO7fZfjPGFqq6KSLkxoAAAARM"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:46.864733 2026] [:error] [pid 58625:tid 58637] [client 187.183.39.139:16407] [client 187.183.39.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 187.183.39.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO7vZfjPGFqq6KSLkxowAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:48.134813 2026] [:error] [pid 58625:tid 58644] [client 187.183.39.139:16407] [client 187.183.39.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 187.183.39.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO8PZfjPGFqq6KSLkxpAAAARA"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:49.297023 2026] [:error] [pid 58625:tid 58636] [client 187.183.39.139:16407] [client 187.183.39.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 187.183.39.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO8fZfjPGFqq6KSLkxqAAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:50.442467 2026] [:error] [pid 58625:tid 58632] [client 187.183.39.139:16407] [client 187.183.39.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 187.183.39.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO8vZfjPGFqq6KSLkxqgAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:51.789814 2026] [:error] [pid 58625:tid 58644] [client 187.183.39.139:16407] [client 187.183.39.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 187.183.39.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO8_ZfjPGFqq6KSLkxsAAAARA"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:53.028398 2026] [:error] [pid 58625:tid 58645] [client 187.183.39.139:16407] [client 187.183.39.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 187.183.39.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO9fZfjPGFqq6KSLkxtgAAARE"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:54.251837 2026] [:error] [pid 58625:tid 58628] [client 187.183.39.139:16407] [client 187.183.39.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 187.183.39.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO9vZfjPGFqq6KSLkxwQAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:55.416423 2026] [:error] [pid 58625:tid 58637] [client 187.183.39.139:16407] [client 187.183.39.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 187.183.39.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO9_ZfjPGFqq6KSLkxzgAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:57.211507 2026] [:error] [pid 57048:tid 57133] [client 148.252.156.229:23072] [client 148.252.156.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.252.156.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO-YZINtpBgqE164JZewAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:58.227120 2026] [:error] [pid 57048:tid 57118] [client 148.252.156.229:23072] [client 148.252.156.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.252.156.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO-oZINtpBgqE164JZfQAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:40:59.663912 2026] [:error] [pid 57048:tid 57134] [client 148.252.156.229:23072] [client 148.252.156.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.252.156.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO-4ZINtpBgqE164JZfgAAAJE"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:00.770048 2026] [:error] [pid 57048:tid 57125] [client 148.252.156.229:23072] [client 148.252.156.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.252.156.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO_IZINtpBgqE164JZfwAAAIg"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:01.903285 2026] [:error] [pid 57048:tid 57124] [client 148.252.156.229:23072] [client 148.252.156.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.252.156.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO_YZINtpBgqE164JZgAAAAIc"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:02.829796 2026] [:error] [pid 57048:tid 57127] [client 148.252.156.229:23072] [client 148.252.156.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.252.156.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO_oZINtpBgqE164JZgQAAAIo"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:03.974772 2026] [:error] [pid 57048:tid 57137] [client 148.252.156.229:23072] [client 148.252.156.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.252.156.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affO_4ZINtpBgqE164JZggAAAJQ"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:04.967039 2026] [:error] [pid 57048:tid 57119] [client 148.252.156.229:23072] [client 148.252.156.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.252.156.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPAIZINtpBgqE164JZgwAAAII"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:07.441033 2026] [:error] [pid 57048:tid 57131] [client 187.109.205.90:6319] [client 187.109.205.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 187.109.205.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPA4ZINtpBgqE164JZhwAAAI4"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:08.731683 2026] [:error] [pid 57048:tid 57130] [client 187.109.205.90:6319] [client 187.109.205.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 187.109.205.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPBIZINtpBgqE164JZiQAAAI0"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:10.067866 2026] [:error] [pid 57048:tid 57140] [client 187.109.205.90:6319] [client 187.109.205.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 187.109.205.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPBoZINtpBgqE164JZigAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:11.446045 2026] [:error] [pid 57048:tid 57118] [client 187.109.205.90:6319] [client 187.109.205.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 187.109.205.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPB4ZINtpBgqE164JZiwAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:12.637297 2026] [:error] [pid 57048:tid 57138] [client 187.109.205.90:6319] [client 187.109.205.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 187.109.205.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPCIZINtpBgqE164JZjAAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:17.724857 2026] [:error] [pid 57154:tid 57167] [client 177.37.88.134:21665] [client 177.37.88.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 177.37.88.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPDf4DAn7umy_ATRzu9QAAAMo"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:19.037020 2026] [:error] [pid 57154:tid 57181] [client 177.37.88.134:21665] [client 177.37.88.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 177.37.88.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPD_4DAn7umy_ATRzu9gAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:20.308599 2026] [:error] [pid 57154:tid 57171] [client 177.37.88.134:21665] [client 177.37.88.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 177.37.88.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPEP4DAn7umy_ATRzu-AAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:21.601464 2026] [:error] [pid 57154:tid 57159] [client 177.37.88.134:21665] [client 177.37.88.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 177.37.88.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPEf4DAn7umy_ATRzu-gAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:23.026836 2026] [:error] [pid 57154:tid 57179] [client 177.37.88.134:21665] [client 177.37.88.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 177.37.88.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPE_4DAn7umy_ATRzu-wAAANY"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:24.608602 2026] [:error] [pid 57154:tid 57164] [client 177.37.88.134:21665] [client 177.37.88.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 177.37.88.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPFP4DAn7umy_ATRzu_wAAAMc"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:25.895108 2026] [:error] [pid 57154:tid 57162] [client 177.37.88.134:21665] [client 177.37.88.134] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 177.37.88.134, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPFf4DAn7umy_ATRzvBAAAAMU"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:26.861153 2026] [:error] [pid 31168:tid 31180] [client 95.18.44.147:34804] [client 95.18.44.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.18.44.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPFrJUVgN8GV2P4h5dxwAAAUo"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:27.755032 2026] [:error] [pid 31168:tid 31174] [client 95.18.44.147:34804] [client 95.18.44.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.18.44.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPF7JUVgN8GV2P4h5dyAAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:28.828873 2026] [:error] [pid 31168:tid 31187] [client 95.18.44.147:34804] [client 95.18.44.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.18.44.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPGLJUVgN8GV2P4h5dyQAAAVE"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:29.908661 2026] [:error] [pid 31168:tid 31184] [client 95.18.44.147:34804] [client 95.18.44.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.18.44.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPGbJUVgN8GV2P4h5dygAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:30.974584 2026] [:error] [pid 31168:tid 31175] [client 95.18.44.147:34804] [client 95.18.44.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.18.44.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPGrJUVgN8GV2P4h5dzwAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:31.849400 2026] [:error] [pid 31168:tid 31190] [client 95.18.44.147:34804] [client 95.18.44.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.18.44.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPG7JUVgN8GV2P4h5d1AAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:32.751861 2026] [:error] [pid 31168:tid 31178] [client 95.18.44.147:34804] [client 95.18.44.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.18.44.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPHLJUVgN8GV2P4h5d1QAAAUg"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:33.648988 2026] [:error] [pid 31168:tid 31183] [client 95.18.44.147:34804] [client 95.18.44.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.18.44.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPHbJUVgN8GV2P4h5d1gAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:34.636021 2026] [:error] [pid 31168:tid 31185] [client 95.18.44.147:34804] [client 95.18.44.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.18.44.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPHrJUVgN8GV2P4h5d2AAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:35.592757 2026] [:error] [pid 31168:tid 31182] [client 95.18.44.147:34804] [client 95.18.44.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.18.44.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPH7JUVgN8GV2P4h5d2QAAAUw"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:37.194047 2026] [:error] [pid 31168:tid 31187] [client 70.81.12.8:50500] [client 70.81.12.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.81.12.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPIbJUVgN8GV2P4h5d3AAAAVE"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:38.176472 2026] [:error] [pid 31168:tid 31171] [client 70.81.12.8:50500] [client 70.81.12.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.81.12.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPIrJUVgN8GV2P4h5d3wAAAUE"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:39.192338 2026] [:error] [pid 31168:tid 31176] [client 70.81.12.8:50500] [client 70.81.12.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.81.12.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPI7JUVgN8GV2P4h5d4wAAAUY"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:40.257464 2026] [:error] [pid 31168:tid 31183] [client 70.81.12.8:50500] [client 70.81.12.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.81.12.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPJLJUVgN8GV2P4h5d5wAAAU0"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:41.291698 2026] [:error] [pid 31168:tid 31174] [client 70.81.12.8:50500] [client 70.81.12.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.81.12.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPJbJUVgN8GV2P4h5d6QAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:42.361898 2026] [:error] [pid 31168:tid 31185] [client 70.81.12.8:50500] [client 70.81.12.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.81.12.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPJrJUVgN8GV2P4h5d6gAAAU8"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:43.478027 2026] [:error] [pid 31168:tid 31179] [client 70.81.12.8:50500] [client 70.81.12.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.81.12.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPJ7JUVgN8GV2P4h5d6wAAAUk"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:44.677744 2026] [:error] [pid 31168:tid 31191] [client 70.81.12.8:50500] [client 70.81.12.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.81.12.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPKLJUVgN8GV2P4h5d7AAAAVU"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:45.798592 2026] [:error] [pid 31168:tid 31173] [client 70.81.12.8:50500] [client 70.81.12.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 70.81.12.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPKbJUVgN8GV2P4h5d7QAAAUM"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:47.942188 2026] [:error] [pid 57154:tid 57157] [client 89.144.192.168:63197] [client 89.144.192.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.144.192.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPK_4DAn7umy_ATRzvHwAAAMA"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:48.888028 2026] [:error] [pid 57154:tid 57158] [client 89.144.192.168:63197] [client 89.144.192.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.144.192.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPLP4DAn7umy_ATRzvIgAAAME"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:49.867546 2026] [:error] [pid 57154:tid 57171] [client 89.144.192.168:63197] [client 89.144.192.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.144.192.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPLf4DAn7umy_ATRzvIwAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:50.806947 2026] [:error] [pid 57154:tid 57167] [client 89.144.192.168:63197] [client 89.144.192.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.144.192.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPLv4DAn7umy_ATRzvJQAAAMo"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:51.747159 2026] [:error] [pid 57154:tid 57178] [client 89.144.192.168:63197] [client 89.144.192.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.144.192.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPL_4DAn7umy_ATRzvJgAAANU"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:52.707336 2026] [:error] [pid 57154:tid 57159] [client 89.144.192.168:63197] [client 89.144.192.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.144.192.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPMP4DAn7umy_ATRzvKAAAAMI"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:53.647311 2026] [:error] [pid 57154:tid 57181] [client 89.144.192.168:63197] [client 89.144.192.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.144.192.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPMf4DAn7umy_ATRzvKQAAANg"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:54.606858 2026] [:error] [pid 57154:tid 57175] [client 89.144.192.168:63197] [client 89.144.192.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.144.192.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPMv4DAn7umy_ATRzvKgAAANI"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:55.527358 2026] [:error] [pid 57154:tid 57160] [client 89.144.192.168:63197] [client 89.144.192.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 89.144.192.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPM_4DAn7umy_ATRzvKwAAAMM"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:56.951963 2026] [:error] [pid 57046:tid 57061] [client 97.227.211.112:50400] [client 97.227.211.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 97.227.211.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPNIDA4d1tYGL7mqApJwAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:58.052782 2026] [:error] [pid 57046:tid 57072] [client 97.227.211.112:50400] [client 97.227.211.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 97.227.211.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPNoDA4d1tYGL7mqApKAAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:41:59.132117 2026] [:error] [pid 57046:tid 57069] [client 97.227.211.112:50400] [client 97.227.211.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 97.227.211.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPN4DA4d1tYGL7mqApKgAAAAg"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:42:00.132407 2026] [:error] [pid 57046:tid 57068] [client 97.227.211.112:50400] [client 97.227.211.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 97.227.211.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPOIDA4d1tYGL7mqApKwAAAAc"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:42:01.257089 2026] [:error] [pid 57046:tid 57076] [client 97.227.211.112:50400] [client 97.227.211.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 97.227.211.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPOYDA4d1tYGL7mqApLAAAAA8"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:42:02.352034 2026] [:error] [pid 57046:tid 57064] [client 97.227.211.112:50400] [client 97.227.211.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 97.227.211.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPOoDA4d1tYGL7mqApLQAAAAM"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:42:03.521964 2026] [:error] [pid 57046:tid 57077] [client 97.227.211.112:50400] [client 97.227.211.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 97.227.211.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPO4DA4d1tYGL7mqApLgAAABA"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:42:04.616996 2026] [:error] [pid 57046:tid 57071] [client 97.227.211.112:50400] [client 97.227.211.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 97.227.211.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPPIDA4d1tYGL7mqApLwAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:42:05.817029 2026] [:error] [pid 57046:tid 57067] [client 97.227.211.112:50400] [client 97.227.211.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 97.227.211.112, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPPYDA4d1tYGL7mqApMAAAAAY"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:42:07.933445 2026] [:error] [pid 57154:tid 57170] [client 82.20.41.203:47450] [client 82.20.41.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.20.41.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPP_4DAn7umy_ATRzvNQAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:42:08.902089 2026] [:error] [pid 57154:tid 57165] [client 82.20.41.203:47450] [client 82.20.41.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.20.41.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPQP4DAn7umy_ATRzvOAAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:42:09.934139 2026] [:error] [pid 57154:tid 57168] [client 82.20.41.203:47450] [client 82.20.41.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.20.41.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPQf4DAn7umy_ATRzvOgAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:42:10.895351 2026] [:error] [pid 57154:tid 57179] [client 82.20.41.203:47450] [client 82.20.41.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.20.41.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPQv4DAn7umy_ATRzvOwAAANY"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:42:11.973209 2026] [:error] [pid 57154:tid 57158] [client 82.20.41.203:47450] [client 82.20.41.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.20.41.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPQ_4DAn7umy_ATRzvPQAAAME"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:42:12.920808 2026] [:error] [pid 57154:tid 57173] [client 82.20.41.203:47450] [client 82.20.41.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.20.41.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPRP4DAn7umy_ATRzvPgAAANA"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:42:14.133957 2026] [:error] [pid 57154:tid 57176] [client 82.20.41.203:47450] [client 82.20.41.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.20.41.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPRv4DAn7umy_ATRzvPwAAANM"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:42:18.568935 2026] [:error] [pid 58625:tid 58640] [client 41.133.230.12:42952] [client 41.133.230.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.133.230.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPSvZfjPGFqq6KSLkyFAAAAQw"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:42:20.503909 2026] [:error] [pid 58625:tid 58641] [client 41.133.230.12:42952] [client 41.133.230.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.133.230.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPTPZfjPGFqq6KSLkyGAAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:42:21.834498 2026] [:error] [pid 58625:tid 58645] [client 41.133.230.12:42952] [client 41.133.230.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.133.230.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPTfZfjPGFqq6KSLkyHAAAARE"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:42:23.127103 2026] [:error] [pid 58625:tid 58628] [client 41.133.230.12:42952] [client 41.133.230.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.133.230.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPT_ZfjPGFqq6KSLkyHgAAAQA"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:42:24.307987 2026] [:error] [pid 58625:tid 58643] [client 41.133.230.12:42952] [client 41.133.230.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.133.230.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPUPZfjPGFqq6KSLkyHwAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:42:25.521911 2026] [:error] [pid 58625:tid 58629] [client 41.133.230.12:42952] [client 41.133.230.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.133.230.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPUfZfjPGFqq6KSLkyIQAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 06:42:26.646742 2026] [:error] [pid 58625:tid 58636] [client 41.133.230.12:42952] [client 41.133.230.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 41.133.230.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "affPUvZfjPGFqq6KSLkyIgAAAQg"], referer: https://expressinteriors.com/wp-login.php
[Mon May 04 07:59:42.157449 2026] [:error] [pid 12022:tid 12024] [client 45.94.31.15:61539] [client 45.94.31.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "affhbkVhgvCNKBWnaTIfsgAAAIA"]
[Mon May 04 07:59:42.648767 2026] [:error] [pid 12022:tid 12046] [client 45.94.31.15:61614] [client 45.94.31.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "affhbkVhgvCNKBWnaTIftAAAAJY"]
[Mon May 04 07:59:43.146771 2026] [:error] [pid 12051:tid 12060] [client 45.94.31.15:61708] [client 45.94.31.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "affhb-rVB-w_PyOHK6krOgAAAUc"]
[Mon May 04 07:59:45.212330 2026] [:error] [pid 12022:tid 12034] [client 45.94.31.15:62058] [client 45.94.31.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "affhcUVhgvCNKBWnaTIfugAAAIo"]
[Mon May 04 09:01:25.007329 2026] [:error] [pid 12051:tid 12077] [client 20.104.97.84:49124] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/G-In.php"] [unique_id "affv5erVB-w_PyOHK6lKuAAAAVg"]
[Mon May 04 09:01:26.873839 2026] [:error] [pid 12051:tid 12074] [client 20.104.97.84:49040] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/G-In.php"] [unique_id "affv5urVB-w_PyOHK6lKuwAAAVU"]
[Mon May 04 09:01:30.885249 2026] [:error] [pid 11958:tid 11962] [client 20.104.97.84:49108] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/G-In.php"] [unique_id "affv6jAK_o2NLEdfAUkyIQAAAEE"]
[Mon May 04 09:01:33.459408 2026] [:error] [pid 11959:tid 11996] [client 20.104.97.84:49149] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/G-In.php"] [unique_id "affv7Qojk2nvxs7h5KvShwAAAMg"]
[Mon May 04 09:01:34.305409 2026] [:error] [pid 11959:tid 11998] [client 20.104.97.84:49033] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aj11.php"] [unique_id "affv7gojk2nvxs7h5KvSiQAAAMo"]
[Mon May 04 09:01:37.283043 2026] [:error] [pid 12022:tid 12032] [client 20.104.97.84:49151] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aj11.php"] [unique_id "affv8UVhgvCNKBWnaTIzvwAAAIg"]
[Mon May 04 09:01:39.551056 2026] [:error] [pid 12022:tid 12025] [client 20.104.97.84:49142] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aj11.php"] [unique_id "affv80VhgvCNKBWnaTIzwAAAAIE"]
[Mon May 04 09:01:40.973149 2026] [:error] [pid 11959:tid 12011] [client 20.104.97.84:49148] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aj11.php"] [unique_id "affv9Aojk2nvxs7h5KvSkAAAANc"]
[Mon May 04 09:01:42.950993 2026] [:error] [pid 11959:tid 11992] [client 20.104.97.84:49038] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tires.php"] [unique_id "affv9gojk2nvxs7h5KvSkgAAAMQ"]
[Mon May 04 09:01:44.161170 2026] [:error] [pid 11958:tid 11962] [client 20.104.97.84:48990] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tires.php"] [unique_id "affv-DAK_o2NLEdfAUkyKQAAAEE"]
[Mon May 04 09:01:48.221313 2026] [:error] [pid 11959:tid 12006] [client 20.104.97.84:49097] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tires.php"] [unique_id "affv_Aojk2nvxs7h5KvSlQAAANI"]
[Mon May 04 09:01:50.938104 2026] [:error] [pid 12051:tid 12054] [client 20.104.97.84:49112] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tires.php"] [unique_id "affv_urVB-w_PyOHK6lKxQAAAUE"]
[Mon May 04 09:01:53.028504 2026] [:error] [pid 12022:tid 12038] [client 20.104.97.84:49128] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xroot.php"] [unique_id "affwAUVhgvCNKBWnaTIz0QAAAI4"]
[Mon May 04 09:01:54.201754 2026] [:error] [pid 11958:tid 11975] [client 20.104.97.84:49099] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xroot.php"] [unique_id "affwAjAK_o2NLEdfAUkyMQAAAE4"]
[Mon May 04 09:01:56.381156 2026] [:error] [pid 12051:tid 12076] [client 20.104.97.84:49138] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xroot.php"] [unique_id "affwBOrVB-w_PyOHK6lKywAAAVc"]
[Mon May 04 09:01:57.443800 2026] [:error] [pid 33186:tid 33205] [client 20.104.97.84:49113] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xroot.php"] [unique_id "affwBbqlqe0DcmBS9VzN6QAAABA"]
[Mon May 04 09:01:59.025265 2026] [:error] [pid 33186:tid 33208] [client 20.104.97.84:49028] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tea.php"] [unique_id "affwB7qlqe0DcmBS9VzN7wAAABM"]
[Mon May 04 09:02:00.336059 2026] [:error] [pid 12051:tid 12056] [client 20.104.97.84:49027] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tea.php"] [unique_id "affwCOrVB-w_PyOHK6lKzwAAAUM"]
[Mon May 04 09:02:01.171026 2026] [:error] [pid 12022:tid 12047] [client 20.104.97.84:49143] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tea.php"] [unique_id "affwCUVhgvCNKBWnaTIz1gAAAJc"]
[Mon May 04 09:02:02.146083 2026] [:error] [pid 33186:tid 33202] [client 20.104.97.84:49131] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tea.php"] [unique_id "affwCrqlqe0DcmBS9VzN9AAAAA0"]
[Mon May 04 09:02:03.120877 2026] [:error] [pid 12051:tid 12070] [client 20.104.97.84:49024] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uwu.php"] [unique_id "affwC-rVB-w_PyOHK6lK0QAAAVE"]
[Mon May 04 09:02:04.522920 2026] [:error] [pid 12051:tid 12075] [client 20.104.97.84:49123] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uwu.php"] [unique_id "affwDOrVB-w_PyOHK6lK0wAAAVY"]
[Mon May 04 09:02:06.125927 2026] [:error] [pid 11958:tid 11972] [client 20.104.97.84:49141] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uwu.php"] [unique_id "affwDjAK_o2NLEdfAUkyOwAAAEs"]
[Mon May 04 09:02:07.776926 2026] [:error] [pid 11958:tid 11966] [client 20.104.97.84:49109] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uwu.php"] [unique_id "affwDzAK_o2NLEdfAUkyPQAAAEU"]
[Mon May 04 09:02:11.651379 2026] [:error] [pid 12051:tid 12058] [client 20.104.97.84:49051] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aios-bootstrap.php"] [unique_id "affwE-rVB-w_PyOHK6lK1QAAAUU"]
[Mon May 04 09:02:14.069685 2026] [:error] [pid 11958:tid 11962] [client 20.104.97.84:49117] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aios-bootstrap.php"] [unique_id "affwFjAK_o2NLEdfAUkyQAAAAEE"]
[Mon May 04 09:02:20.358474 2026] [:error] [pid 33186:tid 33198] [client 20.104.97.84:49101] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aios-bootstrap.php"] [unique_id "affwHLqlqe0DcmBS9VzN-QAAAAk"]
[Mon May 04 09:02:38.303183 2026] [:error] [pid 11958:tid 11981] [client 20.104.97.84:49098] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "affwLjAK_o2NLEdfAUkyUQAAAFQ"]
[Mon May 04 09:02:39.380056 2026] [:error] [pid 11958:tid 11961] [client 20.104.97.84:49127] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "affwLzAK_o2NLEdfAUkyUgAAAEA"]
[Mon May 04 09:02:41.314182 2026] [:error] [pid 11959:tid 12000] [client 20.104.97.84:49096] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "affwMQojk2nvxs7h5KvSswAAAMw"]
[Mon May 04 09:02:42.548775 2026] [:error] [pid 33186:tid 33205] [client 20.104.97.84:49114] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "affwMrqlqe0DcmBS9VzOFwAAABA"]
[Mon May 04 09:02:47.111060 2026] [:error] [pid 12051:tid 12063] [client 20.104.97.84:49042] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "affwN-rVB-w_PyOHK6lK8AAAAUo"]
[Mon May 04 09:02:54.572395 2026] [:error] [pid 12022:tid 12025] [client 20.104.97.84:49150] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "affwPkVhgvCNKBWnaTIz5QAAAIE"]
[Mon May 04 09:02:55.559369 2026] [:error] [pid 33186:tid 33203] [client 20.104.97.84:49037] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "affwP7qlqe0DcmBS9VzOKwAAAA4"]
[Mon May 04 09:02:56.717577 2026] [:error] [pid 33186:tid 33205] [client 20.104.97.84:49053] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "affwQLqlqe0DcmBS9VzOLgAAABA"]
[Mon May 04 09:02:59.018774 2026] [:error] [pid 33186:tid 33203] [client 20.104.97.84:48973] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zogy1.php"] [unique_id "affwQ7qlqe0DcmBS9VzONwAAAA4"]
[Mon May 04 09:03:00.320398 2026] [:error] [pid 33186:tid 33191] [client 20.104.97.84:49088] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zogy1.php"] [unique_id "affwRLqlqe0DcmBS9VzOPgAAAAI"]
[Mon May 04 09:03:03.394294 2026] [:error] [pid 12051:tid 12077] [client 20.104.97.84:49052] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zogy1.php"] [unique_id "affwR-rVB-w_PyOHK6lK-gAAAVg"]
[Mon May 04 09:03:12.488109 2026] [:error] [pid 12022:tid 12048] [client 20.104.97.84:49025] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zogy1.php"] [unique_id "affwUEVhgvCNKBWnaTIz9AAAAJg"]
[Mon May 04 09:03:15.423646 2026] [:error] [pid 33186:tid 33197] [client 20.104.97.84:49034] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "affwU7qlqe0DcmBS9VzOWAAAAAg"]
[Mon May 04 09:03:17.768977 2026] [:error] [pid 12022:tid 12025] [client 20.104.97.84:49056] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "affwVUVhgvCNKBWnaTIz_wAAAIE"]
[Mon May 04 09:03:19.387530 2026] [:error] [pid 11958:tid 11978] [client 20.104.97.84:49089] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "affwVzAK_o2NLEdfAUkyXwAAAFE"]
[Mon May 04 09:03:21.065270 2026] [:error] [pid 12022:tid 12048] [client 20.104.97.84:48960] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "affwWUVhgvCNKBWnaTI0FAAAAJg"]
[Mon May 04 09:03:25.098076 2026] [:error] [pid 33186:tid 33208] [client 20.104.97.84:49095] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atkno.php"] [unique_id "affwXbqlqe0DcmBS9VzObgAAABM"]
[Mon May 04 09:03:26.867308 2026] [:error] [pid 11958:tid 11964] [client 20.104.97.84:49044] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atkno.php"] [unique_id "affwXjAK_o2NLEdfAUkybQAAAEM"]
[Mon May 04 09:03:27.724714 2026] [:error] [pid 11958:tid 11961] [client 20.104.97.84:48978] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atkno.php"] [unique_id "affwXzAK_o2NLEdfAUkybwAAAEA"]
[Mon May 04 09:03:29.869108 2026] [:error] [pid 12051:tid 12060] [client 20.104.97.84:49083] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atkno.php"] [unique_id "affwYerVB-w_PyOHK6lLGAAAAUc"]
[Mon May 04 09:03:31.408548 2026] [:error] [pid 12051:tid 12066] [client 20.104.97.84:49085] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/de.php"] [unique_id "affwY-rVB-w_PyOHK6lLGgAAAU0"]
[Mon May 04 09:03:33.051534 2026] [:error] [pid 11959:tid 11990] [client 20.104.97.84:49057] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/de.php"] [unique_id "affwZQojk2nvxs7h5KvS0AAAAMI"]
[Mon May 04 09:03:47.632704 2026] [:error] [pid 12051:tid 12074] [client 20.104.97.84:49026] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index0.php"] [unique_id "affwc-rVB-w_PyOHK6lLNAAAAVU"]
[Mon May 04 09:03:50.725464 2026] [:error] [pid 12022:tid 12031] [client 20.104.97.84:49135] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index0.php"] [unique_id "affwdkVhgvCNKBWnaTI0RwAAAIc"]
[Mon May 04 09:03:52.545322 2026] [:error] [pid 12051:tid 12069] [client 20.104.97.84:49075] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index0.php"] [unique_id "affweOrVB-w_PyOHK6lLOwAAAVA"]
[Mon May 04 09:03:55.441423 2026] [:error] [pid 12022:tid 12039] [client 20.104.97.84:49065] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index0.php"] [unique_id "affwe0VhgvCNKBWnaTI0SQAAAI8"]
[Mon May 04 09:04:03.140795 2026] [:error] [pid 12022:tid 12038] [client 20.104.97.84:48972] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-01ul.php"] [unique_id "affwg0VhgvCNKBWnaTI0TQAAAI4"]
[Mon May 04 09:04:04.905968 2026] [:error] [pid 33186:tid 33201] [client 20.104.97.84:49029] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-01ul.php"] [unique_id "affwhLqlqe0DcmBS9VzOuQAAAAw"]
[Mon May 04 09:04:06.642839 2026] [:error] [pid 12051:tid 12055] [client 20.104.97.84:49032] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-01ul.php"] [unique_id "affwhurVB-w_PyOHK6lLSgAAAUI"]
[Mon May 04 09:04:08.454569 2026] [:error] [pid 33186:tid 33193] [client 20.104.97.84:49049] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-01ul.php"] [unique_id "affwiLqlqe0DcmBS9VzOvgAAAAQ"]
[Mon May 04 09:04:11.688415 2026] [:error] [pid 11959:tid 12002] [client 20.104.97.84:49140] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e3.php"] [unique_id "affwiwojk2nvxs7h5KvS9QAAAM4"]
[Mon May 04 09:04:17.276704 2026] [:error] [pid 33186:tid 33194] [client 20.104.97.84:49130] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e3.php"] [unique_id "affwkbqlqe0DcmBS9VzO1AAAAAU"]
[Mon May 04 09:04:24.048046 2026] [:error] [pid 33186:tid 33208] [client 20.104.97.84:49094] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/e3.php"] [unique_id "affwmLqlqe0DcmBS9VzO7QAAABM"]
[Mon May 04 09:04:26.764301 2026] [:error] [pid 11958:tid 11972] [client 20.104.97.84:49133] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fkohd.php"] [unique_id "affwmjAK_o2NLEdfAUkykwAAAEs"]
[Mon May 04 09:04:30.165796 2026] [:error] [pid 11959:tid 12008] [client 20.104.97.84:49064] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fkohd.php"] [unique_id "affwngojk2nvxs7h5KvTDQAAANQ"]
[Mon May 04 09:04:31.055018 2026] [:error] [pid 33186:tid 33204] [client 20.104.97.84:49016] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fkohd.php"] [unique_id "affwn7qlqe0DcmBS9VzO-gAAAA8"]
[Mon May 04 09:04:31.966526 2026] [:error] [pid 33186:tid 33191] [client 20.104.97.84:49120] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fkohd.php"] [unique_id "affwn7qlqe0DcmBS9VzO_gAAAAI"]
[Mon May 04 09:04:37.354577 2026] [:error] [pid 33186:tid 33192] [client 20.9.90.138:19153] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "affwpbqlqe0DcmBS9VzPFAAAAAM"]
[Mon May 04 09:04:38.110960 2026] [:error] [pid 12022:tid 12026] [client 20.9.90.138:17470] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "affwpkVhgvCNKBWnaTI0fwAAAII"]
[Mon May 04 09:04:38.923194 2026] [:error] [pid 11958:tid 11983] [client 20.9.90.138:25033] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "affwpjAK_o2NLEdfAUkynQAAAFY"]
[Mon May 04 09:04:39.665572 2026] [:error] [pid 33186:tid 33207] [client 20.104.97.84:49118] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws78.php"] [unique_id "affwp7qlqe0DcmBS9VzPMQAAABI"]
[Mon May 04 09:04:39.675396 2026] [:error] [pid 11959:tid 12004] [client 20.9.90.138:18475] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "affwpwojk2nvxs7h5KvTLAAAANA"]
[Mon May 04 09:04:40.875190 2026] [:error] [pid 12051:tid 12077] [client 20.104.97.84:49126] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws78.php"] [unique_id "affwqOrVB-w_PyOHK6lLsgAAAVg"]
[Mon May 04 09:04:42.650647 2026] [:error] [pid 11958:tid 11963] [client 20.104.97.84:48994] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws78.php"] [unique_id "affwqjAK_o2NLEdfAUkyogAAAEI"]
[Mon May 04 09:05:00.813150 2026] [:error] [pid 11959:tid 11995] [client 20.104.97.84:49136] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/000.php"] [unique_id "affwvAojk2nvxs7h5KvTjwAAAMc"]
[Mon May 04 09:05:03.998010 2026] [:error] [pid 33186:tid 33202] [client 20.104.97.84:49146] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/000.php"] [unique_id "affwv7qlqe0DcmBS9VzPsQAAAA0"]
[Mon May 04 09:05:05.001915 2026] [:error] [pid 12022:tid 12026] [client 20.104.97.84:48966] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/000.php"] [unique_id "affwwUVhgvCNKBWnaTI0_QAAAII"]
[Mon May 04 09:05:06.062601 2026] [:error] [pid 12051:tid 12070] [client 20.104.97.84:49050] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/000.php"] [unique_id "affwwurVB-w_PyOHK6lMhwAAAVE"]
[Mon May 04 09:05:08.122041 2026] [:error] [pid 12022:tid 12024] [client 20.104.97.84:49047] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "affwxEVhgvCNKBWnaTI1BAAAAIA"]
[Mon May 04 09:05:15.853669 2026] [:error] [pid 12051:tid 12063] [client 20.104.97.84:49106] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "affwy-rVB-w_PyOHK6lMlgAAAUo"]
[Mon May 04 09:05:24.705898 2026] [:error] [pid 33186:tid 33209] [client 20.104.97.84:49121] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/iov.php"] [unique_id "affw1Lqlqe0DcmBS9VzQOAAAABQ"]
[Mon May 04 09:05:27.769123 2026] [:error] [pid 12051:tid 12074] [client 20.104.97.84:48967] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/iov.php"] [unique_id "affw1-rVB-w_PyOHK6lMuAAAAVU"]
[Mon May 04 09:05:29.378188 2026] [:error] [pid 12051:tid 12069] [client 20.104.97.84:49043] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/iov.php"] [unique_id "affw2erVB-w_PyOHK6lMvQAAAVA"]
[Mon May 04 09:05:33.413877 2026] [:error] [pid 11958:tid 11968] [client 20.104.97.84:49078] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/iov.php"] [unique_id "affw3TAK_o2NLEdfAUkyzwAAAEc"]
[Mon May 04 09:05:39.221463 2026] [:error] [pid 11958:tid 11974] [client 20.104.97.84:48997] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jodohghi.php"] [unique_id "affw4zAK_o2NLEdfAUky1AAAAE0"]
[Mon May 04 09:05:42.330458 2026] [:error] [pid 11958:tid 11965] [client 20.104.97.84:49107] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jodohghi.php"] [unique_id "affw5jAK_o2NLEdfAUky1wAAAEQ"]
[Mon May 04 09:05:44.321047 2026] [:error] [pid 11958:tid 11973] [client 20.104.97.84:49115] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jodohghi.php"] [unique_id "affw6DAK_o2NLEdfAUky2wAAAEw"]
[Mon May 04 09:05:45.206996 2026] [:error] [pid 11958:tid 11984] [client 20.104.97.84:49129] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jodohghi.php"] [unique_id "affw6TAK_o2NLEdfAUky3gAAAFc"]
[Mon May 04 09:05:46.604183 2026] [:error] [pid 11959:tid 11990] [client 20.104.97.84:48964] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rendi59.php"] [unique_id "affw6gojk2nvxs7h5KvTywAAAMI"]
[Mon May 04 09:05:48.443042 2026] [:error] [pid 33186:tid 33201] [client 20.104.97.84:49091] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rendi59.php"] [unique_id "affw7Lqlqe0DcmBS9VzQVgAAAAw"]
[Mon May 04 09:05:51.227484 2026] [:error] [pid 11958:tid 11967] [client 20.104.97.84:49036] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rendi59.php"] [unique_id "affw7zAK_o2NLEdfAUky6QAAAEY"]
[Mon May 04 09:05:57.861348 2026] [:error] [pid 11958:tid 11966] [client 20.104.97.84:49040] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rendi59.php"] [unique_id "affw9TAK_o2NLEdfAUky8QAAAEU"]
[Mon May 04 09:06:10.693914 2026] [:error] [pid 12051:tid 12077] [client 20.104.97.84:49081] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp1.php"] [unique_id "affxAurVB-w_PyOHK6lNIAAAAVg"]
[Mon May 04 09:06:11.502944 2026] [:error] [pid 12022:tid 12036] [client 20.104.97.84:48974] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp1.php"] [unique_id "affxA0VhgvCNKBWnaTI1iAAAAIw"]
[Mon May 04 09:06:12.838327 2026] [:error] [pid 12051:tid 12064] [client 20.104.97.84:49122] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp1.php"] [unique_id "affxBOrVB-w_PyOHK6lNRwAAAUs"]
[Mon May 04 09:06:14.111560 2026] [:error] [pid 12022:tid 12028] [client 20.104.97.84:49039] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp1.php"] [unique_id "affxBkVhgvCNKBWnaTI1jAAAAIQ"]
[Mon May 04 09:06:15.598184 2026] [:error] [pid 33186:tid 33201] [client 20.104.97.84:49038] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftde.php"] [unique_id "affxB7qlqe0DcmBS9VzQ1QAAAAw"]
[Mon May 04 09:06:17.781278 2026] [:error] [pid 33186:tid 33204] [client 20.104.97.84:49148] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftde.php"] [unique_id "affxCbqlqe0DcmBS9VzQ4gAAAA8"]
[Mon May 04 09:06:20.465316 2026] [:error] [pid 11959:tid 12012] [client 20.104.97.84:49132] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftde.php"] [unique_id "affxDAojk2nvxs7h5KvUHAAAANg"]
[Mon May 04 09:06:21.751551 2026] [:error] [pid 33186:tid 33198] [client 20.104.97.84:49099] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftde.php"] [unique_id "affxDbqlqe0DcmBS9VzQ5AAAAAk"]
[Mon May 04 09:06:26.919222 2026] [:error] [pid 12022:tid 12028] [client 20.104.97.84:49128] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lov.php"] [unique_id "affxEkVhgvCNKBWnaTI1mwAAAIQ"]
[Mon May 04 09:06:32.814067 2026] [:error] [pid 11959:tid 12012] [client 20.104.97.84:49113] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lov.php"] [unique_id "affxGAojk2nvxs7h5KvUJQAAANg"]
[Mon May 04 09:06:34.682150 2026] [:error] [pid 33186:tid 33198] [client 20.104.97.84:49024] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lov.php"] [unique_id "affxGrqlqe0DcmBS9VzQ6wAAAAk"]
[Mon May 04 09:06:40.061076 2026] [:error] [pid 33186:tid 33206] [client 20.104.97.84:48982] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/knw.php"] [unique_id "affxILqlqe0DcmBS9VzQ7wAAABE"]
[Mon May 04 09:06:41.573797 2026] [:error] [pid 12051:tid 12062] [client 20.104.97.84:48961] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/knw.php"] [unique_id "affxIerVB-w_PyOHK6lNZgAAAUk"]
[Mon May 04 09:06:44.591774 2026] [:error] [pid 11958:tid 11965] [client 20.104.97.84:49141] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/knw.php"] [unique_id "affxJDAK_o2NLEdfAUky_gAAAEQ"]
[Mon May 04 09:06:47.258658 2026] [:error] [pid 33186:tid 33206] [client 20.104.97.84:49055] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/knw.php"] [unique_id "affxJ7qlqe0DcmBS9VzRAQAAABE"]
[Mon May 04 09:06:49.346689 2026] [:error] [pid 12022:tid 12028] [client 20.104.97.84:49125] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "affxKUVhgvCNKBWnaTI1pwAAAIQ"]
[Mon May 04 09:06:50.553173 2026] [:error] [pid 12051:tid 12071] [client 20.104.97.84:49151] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "affxKurVB-w_PyOHK6lNcgAAAVI"]
[Mon May 04 09:06:52.915054 2026] [:error] [pid 33186:tid 33189] [client 20.104.97.84:49027] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "affxLLqlqe0DcmBS9VzRBQAAAAA"]
[Mon May 04 09:06:55.238973 2026] [:error] [pid 33186:tid 33213] [client 20.104.97.84:49123] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fi.php"] [unique_id "affxL7qlqe0DcmBS9VzREQAAABg"]
[Mon May 04 09:06:59.660356 2026] [:error] [pid 12022:tid 12036] [client 20.104.97.84:49067] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "affxM0VhgvCNKBWnaTI1rQAAAIw"]
[Mon May 04 09:07:03.986289 2026] [:error] [pid 33186:tid 33206] [client 20.104.97.84:49092] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "affxN7qlqe0DcmBS9VzRRAAAABE"]
[Mon May 04 09:07:08.232354 2026] [:error] [pid 11958:tid 11982] [client 20.104.97.84:49150] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jlex.php"] [unique_id "affxPDAK_o2NLEdfAUkzJQAAAFU"]
[Mon May 04 09:07:22.102536 2026] [:error] [pid 12051:tid 12060] [client 20.104.97.84:49042] [client 20.104.97.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/options.php"] [unique_id "affxSurVB-w_PyOHK6lNrwAAAUc"]
[Mon May 04 09:07:27.034163 2026] [:error] [pid 33186:tid 33199] [client 20.104.97.84:49071] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file-kikikoko.php"] [unique_id "affxT7qlqe0DcmBS9VzRogAAAAo"]
[Mon May 04 09:07:30.050990 2026] [:error] [pid 33186:tid 33198] [client 20.104.97.84:49031] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file-kikikoko.php"] [unique_id "affxUrqlqe0DcmBS9VzRpwAAAAk"]
[Mon May 04 09:07:32.907457 2026] [:error] [pid 11959:tid 11997] [client 20.104.97.84:49147] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file-kikikoko.php"] [unique_id "affxVAojk2nvxs7h5KvUiwAAAMk"]
[Mon May 04 09:07:34.590186 2026] [:error] [pid 11959:tid 12003] [client 20.104.97.84:49025] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file-kikikoko.php"] [unique_id "affxVgojk2nvxs7h5KvUkAAAAM8"]
[Mon May 04 09:07:37.940046 2026] [:error] [pid 33186:tid 33210] [client 20.104.97.84:48995] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "affxWbqlqe0DcmBS9VzRtgAAABU"]
[Mon May 04 09:07:39.557294 2026] [:error] [pid 33186:tid 33190] [client 20.104.97.84:48991] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "affxW7qlqe0DcmBS9VzRwAAAAAE"]
[Mon May 04 09:07:43.797807 2026] [:error] [pid 33186:tid 33208] [client 20.104.97.84:49056] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "affxX7qlqe0DcmBS9VzRxwAAABM"]
[Mon May 04 09:07:47.216681 2026] [:error] [pid 33186:tid 33199] [client 20.104.97.84:49145] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cu.php"] [unique_id "affxY7qlqe0DcmBS9VzRzAAAAAo"]
[Mon May 04 09:07:49.912054 2026] [:error] [pid 11959:tid 12006] [client 20.104.97.84:48984] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tramuibs.php"] [unique_id "affxZQojk2nvxs7h5KvUnwAAANI"]
[Mon May 04 09:07:51.675951 2026] [:error] [pid 11959:tid 12000] [client 20.104.97.84:49101] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tramuibs.php"] [unique_id "affxZwojk2nvxs7h5KvUqAAAAMw"]
[Mon May 04 09:07:54.378010 2026] [:error] [pid 33186:tid 33201] [client 20.104.97.84:49119] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tramuibs.php"] [unique_id "affxarqlqe0DcmBS9VzRzwAAAAw"]
[Mon May 04 09:07:59.393026 2026] [:error] [pid 11958:tid 11970] [client 20.104.97.84:49030] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tramuibs.php"] [unique_id "affxbzAK_o2NLEdfAUkzSwAAAEk"]
[Mon May 04 09:08:02.834819 2026] [:error] [pid 11959:tid 11988] [client 20.104.97.84:49137] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/19.php"] [unique_id "affxcgojk2nvxs7h5KvUtAAAAMA"]
[Mon May 04 09:08:08.239681 2026] [:error] [pid 12022:tid 12031] [client 20.104.97.84:49068] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/19.php"] [unique_id "affxeEVhgvCNKBWnaTI1zwAAAIc"]
[Mon May 04 09:08:11.216230 2026] [:error] [pid 11959:tid 12008] [client 20.104.97.84:49114] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/19.php"] [unique_id "affxewojk2nvxs7h5KvUtgAAANQ"]
[Mon May 04 09:08:13.989705 2026] [:error] [pid 11958:tid 11970] [client 20.104.97.84:49074] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/19.php"] [unique_id "affxfTAK_o2NLEdfAUkzVQAAAEk"]
[Mon May 04 09:08:14.990524 2026] [:error] [pid 12022:tid 12033] [client 20.104.97.84:49131] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test1.php"] [unique_id "affxfkVhgvCNKBWnaTI10gAAAIk"]
[Mon May 04 09:08:17.783463 2026] [:error] [pid 11958:tid 11964] [client 20.104.97.84:48965] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test1.php"] [unique_id "affxgTAK_o2NLEdfAUkzVwAAAEM"]
[Mon May 04 09:08:20.189108 2026] [:error] [pid 11959:tid 11997] [client 20.104.97.84:49053] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test1.php"] [unique_id "affxhAojk2nvxs7h5KvUvgAAAMk"]
[Mon May 04 09:08:39.211157 2026] [:error] [pid 11959:tid 12002] [client 20.104.97.84:49103] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/trx24.php"] [unique_id "affxlwojk2nvxs7h5KvU0gAAAM4"]
[Mon May 04 09:08:41.140777 2026] [:error] [pid 12022:tid 12035] [client 20.104.97.84:49110] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/trx24.php"] [unique_id "affxmUVhgvCNKBWnaTI14gAAAIs"]
[Mon May 04 09:08:45.676583 2026] [:error] [pid 12051:tid 12077] [client 20.104.97.84:48963] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/trx24.php"] [unique_id "affxnerVB-w_PyOHK6lN6wAAAVg"]
[Mon May 04 09:08:47.834492 2026] [:error] [pid 33186:tid 33198] [client 20.104.97.84:49063] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/trx24.php"] [unique_id "affxn7qlqe0DcmBS9VzR9wAAAAk"]
[Mon May 04 09:08:48.884131 2026] [:error] [pid 12051:tid 12056] [client 20.104.97.84:49048] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blox.php"] [unique_id "affxoOrVB-w_PyOHK6lN8QAAAUM"]
[Mon May 04 09:08:49.922054 2026] [:error] [pid 33186:tid 33211] [client 20.104.97.84:49046] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blox.php"] [unique_id "affxobqlqe0DcmBS9VzR-wAAABY"]
[Mon May 04 09:08:52.787340 2026] [:error] [pid 33186:tid 33205] [client 20.104.97.84:49034] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blox.php"] [unique_id "affxpLqlqe0DcmBS9VzR_QAAABA"]
[Mon May 04 09:08:55.881147 2026] [:error] [pid 33186:tid 33190] [client 20.104.97.84:49094] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/blox.php"] [unique_id "affxp7qlqe0DcmBS9VzSAAAAAAE"]
[Mon May 04 09:08:59.765474 2026] [:error] [pid 33186:tid 33199] [client 20.104.97.84:49140] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/berax.php"] [unique_id "affxq7qlqe0DcmBS9VzSAwAAAAo"]
[Mon May 04 09:09:04.502718 2026] [:error] [pid 33186:tid 33191] [client 20.104.97.84:48975] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/berax.php"] [unique_id "affxsLqlqe0DcmBS9VzSBgAAAAI"]
[Mon May 04 09:09:08.789303 2026] [:error] [pid 33186:tid 33200] [client 20.104.97.84:49076] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/berax.php"] [unique_id "affxtLqlqe0DcmBS9VzSDAAAAAs"]
[Mon May 04 09:09:12.817799 2026] [:error] [pid 33186:tid 33191] [client 20.104.97.84:49089] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkxzo.php"] [unique_id "affxuLqlqe0DcmBS9VzSEQAAAAI"]
[Mon May 04 09:09:15.706296 2026] [:error] [pid 12051:tid 12070] [client 20.104.97.84:49144] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkxzo.php"] [unique_id "affxu-rVB-w_PyOHK6lN-QAAAVE"]
[Mon May 04 09:09:16.954486 2026] [:error] [pid 11958:tid 11965] [client 20.104.97.84:48962] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkxzo.php"] [unique_id "affxvDAK_o2NLEdfAUkzcgAAAEQ"]
[Mon May 04 09:09:18.889621 2026] [:error] [pid 33186:tid 33190] [client 20.104.97.84:49117] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkxzo.php"] [unique_id "affxvrqlqe0DcmBS9VzSFwAAAAE"]
[Mon May 04 09:09:20.656251 2026] [:error] [pid 11958:tid 11983] [client 20.104.97.84:49066] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cdxadmin.php"] [unique_id "affxwDAK_o2NLEdfAUkzcwAAAFY"]
[Mon May 04 09:09:23.078902 2026] [:error] [pid 11959:tid 12004] [client 20.104.97.84:49002] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cdxadmin.php"] [unique_id "affxwwojk2nvxs7h5KvU1QAAANA"]
[Mon May 04 09:09:26.782734 2026] [:error] [pid 33186:tid 33205] [client 20.104.97.84:49104] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cdxadmin.php"] [unique_id "affxxrqlqe0DcmBS9VzSIgAAABA"]
[Mon May 04 09:09:28.062912 2026] [:error] [pid 33186:tid 33190] [client 20.104.97.84:49032] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cdxadmin.php"] [unique_id "affxyLqlqe0DcmBS9VzSJAAAAAE"]
[Mon May 04 09:09:29.186471 2026] [:error] [pid 12051:tid 12075] [client 20.104.97.84:49041] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dfre.php"] [unique_id "affxyerVB-w_PyOHK6lN_QAAAVY"]
[Mon May 04 09:09:31.160938 2026] [:error] [pid 12022:tid 12045] [client 20.104.97.84:49049] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dfre.php"] [unique_id "affxy0VhgvCNKBWnaTI2IwAAAJU"]
[Mon May 04 09:09:35.351946 2026] [:error] [pid 11958:tid 11967] [client 20.104.97.84:49023] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dfre.php"] [unique_id "affxzzAK_o2NLEdfAUkzeAAAAEY"]
[Mon May 04 09:09:51.054205 2026] [:error] [pid 12022:tid 12034] [client 20.104.97.84:49079] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sderty5u.php"] [unique_id "affx30VhgvCNKBWnaTI2PgAAAIo"]
[Mon May 04 09:09:52.134935 2026] [:error] [pid 12051:tid 12074] [client 20.104.97.84:48977] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sderty5u.php"] [unique_id "affx4OrVB-w_PyOHK6lOAwAAAVU"]
[Mon May 04 09:09:53.554479 2026] [:error] [pid 33186:tid 33208] [client 20.104.97.84:49059] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sderty5u.php"] [unique_id "affx4bqlqe0DcmBS9VzSTwAAABM"]
[Mon May 04 09:09:56.288111 2026] [:error] [pid 12051:tid 12057] [client 20.104.97.84:49146] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sderty5u.php"] [unique_id "affx5OrVB-w_PyOHK6lOBAAAAUQ"]
[Mon May 04 09:09:57.603443 2026] [:error] [pid 11959:tid 12006] [client 20.104.97.84:49108] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hilk.php"] [unique_id "affx5Qojk2nvxs7h5KvU3QAAANI"]
[Mon May 04 09:10:00.491830 2026] [:error] [pid 12051:tid 12056] [client 20.104.97.84:49112] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hilk.php"] [unique_id "affx6OrVB-w_PyOHK6lOCAAAAUM"]
[Mon May 04 09:10:01.601520 2026] [:error] [pid 12051:tid 12073] [client 20.104.97.84:49060] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hilk.php"] [unique_id "affx6erVB-w_PyOHK6lOCgAAAVQ"]
[Mon May 04 09:10:04.861601 2026] [:error] [pid 11959:tid 11993] [client 20.104.97.84:49091] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hilk.php"] [unique_id "affx7Aojk2nvxs7h5KvU4gAAAMU"]
[Mon May 04 09:10:08.490364 2026] [:error] [pid 12051:tid 12063] [client 20.104.97.84:49075] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/miso.php"] [unique_id "affx8OrVB-w_PyOHK6lOFAAAAUo"]
[Mon May 04 09:10:10.902331 2026] [:error] [pid 11959:tid 12002] [client 20.104.97.84:48985] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/miso.php"] [unique_id "affx8gojk2nvxs7h5KvU7AAAAM4"]
[Mon May 04 09:10:12.658768 2026] [:error] [pid 12051:tid 12059] [client 20.104.97.84:48973] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/miso.php"] [unique_id "affx9OrVB-w_PyOHK6lOGAAAAUY"]
[Mon May 04 09:10:20.716694 2026] [:error] [pid 33186:tid 33201] [client 20.104.97.84:49090] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yuzuru1.php"] [unique_id "affx_Lqlqe0DcmBS9VzSbgAAAAw"]
[Mon May 04 09:10:29.589783 2026] [:error] [pid 12022:tid 12044] [client 20.104.97.84:49149] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yuzuru1.php"] [unique_id "affyBUVhgvCNKBWnaTI2RgAAAJQ"]
[Mon May 04 09:10:33.229106 2026] [:error] [pid 12022:tid 12045] [client 20.104.97.84:49100] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yuzuru1.php"] [unique_id "affyCUVhgvCNKBWnaTI2RwAAAJU"]
[Mon May 04 09:10:37.036119 2026] [:error] [pid 12051:tid 12058] [client 20.104.97.84:48976] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/checkout.php"] [unique_id "affyDerVB-w_PyOHK6lOGgAAAUU"]
[Mon May 04 09:10:38.730688 2026] [:error] [pid 12051:tid 12077] [client 20.104.97.84:48988] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/checkout.php"] [unique_id "affyDurVB-w_PyOHK6lOHAAAAVg"]
[Mon May 04 09:10:41.209593 2026] [:error] [pid 12051:tid 12060] [client 20.104.97.84:49029] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/checkout.php"] [unique_id "affyEerVB-w_PyOHK6lOHgAAAUc"]
[Mon May 04 09:10:43.152874 2026] [:error] [pid 11959:tid 12009] [client 20.104.97.84:49044] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/checkout.php"] [unique_id "affyEwojk2nvxs7h5KvU-gAAANU"]
[Mon May 04 09:10:48.126048 2026] [:error] [pid 12051:tid 12076] [client 20.104.97.84:49148] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fictioner.php"] [unique_id "affyGOrVB-w_PyOHK6lOJAAAAVc"]
[Mon May 04 09:10:49.826382 2026] [:error] [pid 12022:tid 12045] [client 20.104.97.84:49028] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fictioner.php"] [unique_id "affyGUVhgvCNKBWnaTI2bAAAAJU"]
[Mon May 04 09:11:13.984987 2026] [:error] [pid 33186:tid 33189] [client 20.104.97.84:49127] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drykl.php"] [unique_id "affyMbqlqe0DcmBS9VzTIQAAAAA"]
[Mon May 04 09:11:17.352128 2026] [:error] [pid 12051:tid 12061] [client 20.104.97.84:49065] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drykl.php"] [unique_id "affyNerVB-w_PyOHK6lONwAAAUg"]
[Mon May 04 09:11:28.372892 2026] [:error] [pid 11958:tid 11961] [client 20.104.97.84:49120] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drykl.php"] [unique_id "affyQDAK_o2NLEdfAUkz2wAAAEA"]
[Mon May 04 09:11:29.834606 2026] [:error] [pid 12051:tid 12075] [client 20.104.97.84:48981] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxx.php"] [unique_id "affyQerVB-w_PyOHK6lOOgAAAVY"]
[Mon May 04 09:11:32.645970 2026] [:error] [pid 12051:tid 12065] [client 20.104.97.84:49088] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxx.php"] [unique_id "affyROrVB-w_PyOHK6lOQQAAAUw"]
[Mon May 04 09:11:36.377733 2026] [:error] [pid 11958:tid 11980] [client 20.104.97.84:49093] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxx.php"] [unique_id "affySDAK_o2NLEdfAUkz3gAAAFM"]
[Mon May 04 09:11:38.459513 2026] [:error] [pid 11959:tid 11988] [client 20.104.97.84:49125] [client 20.104.97.84] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxx.php"] [unique_id "affySgojk2nvxs7h5KvVjgAAAMA"]
[Mon May 04 10:55:42.081709 2026] [:error] [pid 33186:tid 33199] [client 43.131.253.14:32782] [client 43.131.253.14] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afgKrrqlqe0DcmBS9VwRTAAAAAo"]
[Mon May 04 12:50:49.995800 2026] [:error] [pid 12051:tid 12061] [client 43.166.130.123:56694] [client 43.166.130.123] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afglqerVB-w_PyOHK6mNtAAAAUg"]
[Mon May 04 15:06:25.370173 2026] [:error] [pid 61150:tid 61171] [client 35.209.242.34:45272] [client 35.209.242.34] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.209.242.34, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "afhFce8QXWVLiwIGVpce9wAAAVI"], referer: https://expressinteriors.com/login/
[Mon May 04 15:45:07.543172 2026] [:error] [pid 61042:tid 61070] [client 136.107.232.91:52064] [client 136.107.232.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afhOg0nAPPS1fjubA9QrAQAAANg"]
[Mon May 04 15:45:07.976951 2026] [:error] [pid 61044:tid 61110] [client 136.107.232.91:54912] [client 136.107.232.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afhOg0w8w2zZZXI6H1tmSwAAAAg"]
[Mon May 04 15:45:08.419337 2026] [:error] [pid 61042:tid 61046] [client 136.107.232.91:57912] [client 136.107.232.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "afhOhEnAPPS1fjubA9QrDwAAAMA"]
[Mon May 04 15:47:51.366696 2026] [:error] [pid 61150:tid 61153] [client 43.166.255.102:36506] [client 43.166.255.102] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afhPJ-8QXWVLiwIGVpc-DQAAAUA"]
[Mon May 04 17:38:13.072874 2026] [:error] [pid 32471:tid 32477] [client 139.155.134.17:53144] [client 139.155.134.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afhpBXmjpb9EYq6AqhIkQgAAAQM"]
[Mon May 04 18:57:36.690584 2026] [:error] [pid 61043:tid 61079] [client 192.81.211.247:36566] [client 192.81.211.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "afh7oJ8-LwtfURjiAbCokQAAAEQ"]
[Mon May 04 18:57:36.690638 2026] [:error] [pid 3341:tid 3366] [client 192.81.211.247:36582] [client 192.81.211.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/HEAD"] [unique_id "afh7oE9o3_LordU0wW4r1gAAAJY"]
[Mon May 04 20:24:08.519192 2026] [:error] [pid 3341:tid 3365] [client 34.24.211.32:53429] [client 34.24.211.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afiP6E9o3_LordU0wW5SeAAAAJU"]
[Mon May 04 20:24:09.006317 2026] [:error] [pid 3341:tid 3357] [client 34.24.211.32:60702] [client 34.24.211.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afiP6U9o3_LordU0wW5SuQAAAI0"]
[Mon May 04 20:24:09.496209 2026] [:error] [pid 32471:tid 32497] [client 34.24.211.32:53529] [client 34.24.211.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "afiP6Xmjpb9EYq6AqhJVHAAAARc"]
[Mon May 04 20:40:18.211420 2026] [:error] [pid 3341:tid 3351] [client 43.153.79.218:41212] [client 43.153.79.218] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afiTsk9o3_LordU0wW5ZlgAAAIc"]
[Tue May 05 01:17:20.873402 2026] [:error] [pid 3341:tid 3358] [client 43.156.202.34:43212] [client 43.156.202.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afjUoE9o3_LordU0wW7COgAAAI4"]
[Tue May 05 03:35:43.963347 2026] [:error] [pid 32471:tid 32481] [client 49.51.33.159:38758] [client 49.51.33.159] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afj1D3mjpb9EYq6AqhLXHgAAAQc"]
[Tue May 05 03:55:35.297179 2026] [:error] [pid 37236:tid 37240] [client 209.87.169.37:35603] [client 209.87.169.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/wp-includes/css/buttons.css"] [unique_id "afj5t-S0LZrk2TjixztWKwAAAMA"]
[Tue May 05 04:31:30.800202 2026] [:error] [pid 39073:tid 39135] [client 136.158.82.137:32534] [client 136.158.82.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.158.82.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkCIv0kT1BNjk46BkcI3wAAAIE"]
[Tue May 05 04:35:26.316642 2026] [:error] [pid 39178:tid 39186] [client 136.158.82.137:38597] [client 136.158.82.137] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afkDDjaPrgTaiOD_15siPAAAAMY"]
[Tue May 05 04:35:59.240798 2026] [:error] [pid 39073:tid 39153] [client 136.158.82.137:39478] [client 136.158.82.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.158.82.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkDL_0kT1BNjk46BkcJmAAAAJM"]
[Tue May 05 04:36:30.452071 2026] [:error] [pid 39178:tid 39181] [client 136.158.82.137:40318] [client 136.158.82.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.158.82.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkDTjaPrgTaiOD_15sijAAAAME"]
[Tue May 05 04:36:55.534406 2026] [:error] [pid 41055:tid 41065] [client 136.158.82.137:40967] [client 136.158.82.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.158.82.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkDZyepFwKgA_SKOHidyQAAAQc"]
[Tue May 05 04:37:19.527462 2026] [:error] [pid 39072:tid 39127] [client 136.158.82.137:41638] [client 136.158.82.137] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.158.82.137, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkDf_olSHl4aAnrIovPJQAAAFQ"]
[Tue May 05 06:30:59.226831 2026] [:error] [pid 39178:tid 39200] [client 45.130.81.97:41469] [client 45.130.81.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.97, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeIzaPrgTaiOD_15tRugAAANQ"]
[Tue May 05 06:31:03.276628 2026] [:error] [pid 41055:tid 41064] [client 45.130.81.114:35159] [client 45.130.81.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.114, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeJyepFwKgA_SKOHi_qwAAAQY"]
[Tue May 05 06:31:07.685955 2026] [:error] [pid 39178:tid 39197] [client 45.130.81.119:41485] [client 45.130.81.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeKzaPrgTaiOD_15tRygAAANE"]
[Tue May 05 06:31:12.228104 2026] [:error] [pid 39072:tid 39117] [client 45.130.81.110:52261] [client 45.130.81.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.110, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeMPolSHl4aAnrIovlogAAAEo"]
[Tue May 05 06:31:16.860582 2026] [:error] [pid 39071:tid 39093] [client 45.130.81.105:23991] [client 45.130.81.105] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.105, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeNIvmnRMz9gRzix1giwAAAA0"]
[Tue May 05 06:31:21.179760 2026] [:error] [pid 39072:tid 39114] [client 45.130.81.113:21491] [client 45.130.81.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeOfolSHl4aAnrIovlrAAAAEc"]
[Tue May 05 06:31:24.988960 2026] [:error] [pid 39178:tid 39193] [client 45.130.81.91:56667] [client 45.130.81.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.91, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkePDaPrgTaiOD_15tR0QAAAM0"]
[Tue May 05 06:31:28.550043 2026] [:error] [pid 41055:tid 41059] [client 45.130.81.76:48139] [client 45.130.81.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeQCepFwKgA_SKOHi_3AAAAQE"]
[Tue May 05 06:31:33.002681 2026] [:error] [pid 39072:tid 39120] [client 45.130.81.112:36513] [client 45.130.81.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.112, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeRfolSHl4aAnrIovlsAAAAE0"]
[Tue May 05 06:31:36.867144 2026] [:error] [pid 39073:tid 39153] [client 45.130.81.112:36773] [client 45.130.81.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.112, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeSP0kT1BNjk46BkckDwAAAJM"]
[Tue May 05 06:31:40.742074 2026] [:error] [pid 39178:tid 39188] [client 45.130.81.93:54815] [client 45.130.81.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.93, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeTDaPrgTaiOD_15tR2wAAAMg"]
[Tue May 05 06:31:44.837912 2026] [:error] [pid 39073:tid 39136] [client 45.130.81.79:65105] [client 45.130.81.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeUP0kT1BNjk46BkckFAAAAII"]
[Tue May 05 06:31:48.833429 2026] [:error] [pid 39072:tid 39125] [client 45.130.81.101:38227] [client 45.130.81.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeVPolSHl4aAnrIovluAAAAFI"]
[Tue May 05 06:31:53.026436 2026] [:error] [pid 39072:tid 39113] [client 45.130.81.59:46737] [client 45.130.81.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.59, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeWfolSHl4aAnrIovlvAAAAEY"]
[Tue May 05 06:31:57.227468 2026] [:error] [pid 41055:tid 41065] [client 45.130.81.98:34605] [client 45.130.81.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeXSepFwKgA_SKOHi_9QAAAQc"]
[Tue May 05 06:32:01.339350 2026] [:error] [pid 39072:tid 39108] [client 45.130.81.103:25959] [client 45.130.81.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeYfolSHl4aAnrIovlwgAAAEE"]
[Tue May 05 06:32:05.361809 2026] [:error] [pid 41055:tid 41082] [client 45.130.81.107:35299] [client 45.130.81.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeZSepFwKgA_SKOHi_-gAAARg"]
[Tue May 05 06:32:09.308496 2026] [:error] [pid 39071:tid 39090] [client 45.130.81.113:29609] [client 45.130.81.113] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.113, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeaYvmnRMz9gRzix1gowAAAAo"]
[Tue May 05 06:32:13.155000 2026] [:error] [pid 41055:tid 41063] [client 45.130.81.95:24659] [client 45.130.81.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.95, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkebSepFwKgA_SKOHi__gAAAQU"]
[Tue May 05 06:32:16.748002 2026] [:error] [pid 39178:tid 39192] [client 45.130.81.80:40937] [client 45.130.81.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkecDaPrgTaiOD_15tR4gAAAMw"]
[Tue May 05 06:32:20.423825 2026] [:error] [pid 39178:tid 39181] [client 45.130.81.73:37783] [client 45.130.81.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkedDaPrgTaiOD_15tR5QAAAME"]
[Tue May 05 06:32:24.460774 2026] [:error] [pid 39178:tid 39193] [client 45.130.81.110:48731] [client 45.130.81.110] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.110, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeeDaPrgTaiOD_15tR7gAAAM0"]
[Tue May 05 06:32:28.802119 2026] [:error] [pid 39072:tid 39121] [client 45.130.81.116:56185] [client 45.130.81.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.116, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkefPolSHl4aAnrIovlzgAAAE4"]
[Tue May 05 06:32:33.105851 2026] [:error] [pid 39178:tid 39184] [client 45.130.81.73:56589] [client 45.130.81.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkegTaPrgTaiOD_15tR-QAAAMQ"]
[Tue May 05 06:32:36.975439 2026] [:error] [pid 39072:tid 39108] [client 45.130.81.72:62063] [client 45.130.81.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkehPolSHl4aAnrIovl1wAAAEE"]
[Tue May 05 06:32:41.058096 2026] [:error] [pid 39072:tid 39110] [client 45.130.81.72:39801] [client 45.130.81.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeifolSHl4aAnrIovl3QAAAEM"]
[Tue May 05 06:32:45.268782 2026] [:error] [pid 39178:tid 39193] [client 45.130.81.104:60567] [client 45.130.81.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkejTaPrgTaiOD_15tSBwAAAM0"]
[Tue May 05 06:32:49.190804 2026] [:error] [pid 39178:tid 39186] [client 45.130.81.98:46585] [client 45.130.81.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkekTaPrgTaiOD_15tSCAAAAMY"]
[Tue May 05 06:32:52.756362 2026] [:error] [pid 39178:tid 39192] [client 45.130.81.75:43033] [client 45.130.81.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.75, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkelDaPrgTaiOD_15tSDQAAAMw"]
[Tue May 05 06:32:55.960695 2026] [:error] [pid 41055:tid 41077] [client 45.130.81.104:25967] [client 45.130.81.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkelyepFwKgA_SKOHjAFAAAARM"]
[Tue May 05 06:32:59.451841 2026] [:error] [pid 39072:tid 39107] [client 45.130.81.82:58563] [client 45.130.81.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkem_olSHl4aAnrIovl4QAAAEA"]
[Tue May 05 06:33:03.253764 2026] [:error] [pid 39072:tid 39115] [client 45.130.81.112:47651] [client 45.130.81.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.112, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afken_olSHl4aAnrIovl4gAAAEg"]
[Tue May 05 06:33:06.956502 2026] [:error] [pid 41055:tid 41075] [client 45.130.81.104:64171] [client 45.130.81.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeoiepFwKgA_SKOHjAGQAAARE"]
[Tue May 05 06:33:11.405184 2026] [:error] [pid 39178:tid 39184] [client 45.130.81.92:52933] [client 45.130.81.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkepzaPrgTaiOD_15tSKQAAAMQ"]
[Tue May 05 06:33:15.830395 2026] [:error] [pid 41055:tid 41058] [client 45.130.81.116:28023] [client 45.130.81.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.116, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeqyepFwKgA_SKOHjAIAAAAQA"]
[Tue May 05 06:33:20.316878 2026] [:error] [pid 39178:tid 39204] [client 45.130.81.109:47175] [client 45.130.81.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkesDaPrgTaiOD_15tSNQAAANg"]
[Tue May 05 06:33:24.763325 2026] [:error] [pid 39178:tid 39194] [client 45.130.81.114:49339] [client 45.130.81.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.114, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afketDaPrgTaiOD_15tSNwAAAM4"]
[Tue May 05 06:33:28.817551 2026] [:error] [pid 39072:tid 39123] [client 45.130.81.72:27793] [client 45.130.81.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.72, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeuPolSHl4aAnrIovl7AAAAFA"]
[Tue May 05 06:33:33.553147 2026] [:error] [pid 41055:tid 41081] [client 45.130.81.102:45665] [client 45.130.81.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkevSepFwKgA_SKOHjALwAAARc"]
[Tue May 05 06:33:37.857691 2026] [:error] [pid 39073:tid 39142] [client 45.130.81.112:56965] [client 45.130.81.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.112, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkewf0kT1BNjk46BkckNwAAAIg"]
[Tue May 05 06:33:42.038468 2026] [:error] [pid 39178:tid 39183] [client 45.130.81.88:31475] [client 45.130.81.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkexjaPrgTaiOD_15tSTAAAAMM"]
[Tue May 05 06:33:45.907505 2026] [:error] [pid 39072:tid 39121] [client 45.130.81.111:20747] [client 45.130.81.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.111, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeyfolSHl4aAnrIovl8wAAAE4"]
[Tue May 05 06:33:50.011859 2026] [:error] [pid 41055:tid 41076] [client 45.130.81.71:44515] [client 45.130.81.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.71, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkeziepFwKgA_SKOHjANwAAARI"]
[Tue May 05 06:33:53.943811 2026] [:error] [pid 39071:tid 39086] [client 45.130.81.84:58439] [client 45.130.81.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afke0YvmnRMz9gRzix1guQAAAAY"]
[Tue May 05 06:33:58.236217 2026] [:error] [pid 39073:tid 39135] [client 45.130.81.119:46373] [client 45.130.81.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afke1v0kT1BNjk46BkckPwAAAIE"]
[Tue May 05 06:34:01.818901 2026] [:error] [pid 39072:tid 39118] [client 45.130.81.100:32757] [client 45.130.81.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.100, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afke2folSHl4aAnrIovl-AAAAEs"]
[Tue May 05 06:34:05.534008 2026] [:error] [pid 39072:tid 39114] [client 45.130.81.84:44099] [client 45.130.81.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afke3folSHl4aAnrIovl-QAAAEc"]
[Tue May 05 06:34:09.473427 2026] [:error] [pid 39071:tid 39085] [client 45.130.81.87:62469] [client 45.130.81.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.87, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afke4YvmnRMz9gRzix1gvgAAAAU"]
[Tue May 05 06:34:13.480203 2026] [:error] [pid 41055:tid 41059] [client 45.130.81.85:61207] [client 45.130.81.85] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.85, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afke5SepFwKgA_SKOHjAQwAAAQE"]
[Tue May 05 06:34:17.069551 2026] [:error] [pid 39071:tid 39100] [client 45.130.81.80:49691] [client 45.130.81.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afke6YvmnRMz9gRzix1gvwAAABQ"]
[Tue May 05 06:34:20.702463 2026] [:error] [pid 39072:tid 39130] [client 45.130.81.100:57041] [client 45.130.81.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.100, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afke7PolSHl4aAnrIovmAQAAAFc"]
[Tue May 05 06:34:24.888917 2026] [:error] [pid 39178:tid 39201] [client 45.130.81.104:38405] [client 45.130.81.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afke8DaPrgTaiOD_15tSVwAAANU"]
[Tue May 05 06:34:29.370923 2026] [:error] [pid 39178:tid 39186] [client 45.130.81.102:40639] [client 45.130.81.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.102, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afke9TaPrgTaiOD_15tSYAAAAMY"]
[Tue May 05 06:34:33.694414 2026] [:error] [pid 41055:tid 41073] [client 45.130.81.120:48363] [client 45.130.81.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.120, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afke-SepFwKgA_SKOHjATAAAAQ8"]
[Tue May 05 06:34:38.098343 2026] [:error] [pid 41055:tid 41060] [client 45.130.81.86:47165] [client 45.130.81.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.86, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afke_iepFwKgA_SKOHjAUAAAAQI"]
[Tue May 05 06:34:42.375341 2026] [:error] [pid 39178:tid 39189] [client 45.130.81.109:23983] [client 45.130.81.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfAjaPrgTaiOD_15tSpwAAAMk"]
[Tue May 05 06:34:46.487839 2026] [:error] [pid 39178:tid 39203] [client 45.130.81.59:61255] [client 45.130.81.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.59, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfBjaPrgTaiOD_15tSrwAAANc"]
[Tue May 05 06:34:50.819210 2026] [:error] [pid 39178:tid 39199] [client 45.130.81.101:36099] [client 45.130.81.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfCjaPrgTaiOD_15tSswAAANM"]
[Tue May 05 06:34:55.678382 2026] [:error] [pid 39072:tid 39108] [client 45.130.81.75:55773] [client 45.130.81.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.75, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfD_olSHl4aAnrIovmEQAAAEE"]
[Tue May 05 06:35:00.200335 2026] [:error] [pid 41055:tid 41080] [client 45.130.81.108:48255] [client 45.130.81.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfFCepFwKgA_SKOHjAYAAAARY"]
[Tue May 05 06:35:04.717681 2026] [:error] [pid 39073:tid 39150] [client 45.130.81.59:52989] [client 45.130.81.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.59, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfGP0kT1BNjk46BkckXQAAAJA"]
[Tue May 05 06:35:08.901497 2026] [:error] [pid 39178:tid 39199] [client 45.130.81.96:34469] [client 45.130.81.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfHDaPrgTaiOD_15tSwQAAANM"]
[Tue May 05 06:35:12.829047 2026] [:error] [pid 41055:tid 41063] [client 45.130.81.115:37801] [client 45.130.81.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.115, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfICepFwKgA_SKOHjAcAAAAQU"]
[Tue May 05 06:35:16.802035 2026] [:error] [pid 39073:tid 39138] [client 45.130.81.107:27889] [client 45.130.81.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.107, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfJP0kT1BNjk46BkckZAAAAIQ"]
[Tue May 05 06:35:20.869534 2026] [:error] [pid 39178:tid 39201] [client 45.130.81.120:57037] [client 45.130.81.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.120, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfKDaPrgTaiOD_15tS0gAAANU"]
[Tue May 05 06:35:25.015392 2026] [:error] [pid 39073:tid 39158] [client 45.130.81.112:48521] [client 45.130.81.112] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.112, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfLf0kT1BNjk46BkckZgAAAJg"]
[Tue May 05 06:35:29.470950 2026] [:error] [pid 41055:tid 41072] [client 45.130.81.119:39745] [client 45.130.81.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfMSepFwKgA_SKOHjAdgAAAQ4"]
[Tue May 05 06:35:33.438510 2026] [:error] [pid 39178:tid 39202] [client 45.130.81.103:52249] [client 45.130.81.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfNTaPrgTaiOD_15tS4gAAANY"]
[Tue May 05 06:35:37.212896 2026] [:error] [pid 39178:tid 39184] [client 45.130.81.116:20403] [client 45.130.81.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.116, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfOTaPrgTaiOD_15tS5QAAAMQ"]
[Tue May 05 06:35:41.097775 2026] [:error] [pid 39178:tid 39197] [client 45.130.81.99:26527] [client 45.130.81.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfPTaPrgTaiOD_15tS6AAAANE"]
[Tue May 05 06:35:45.328187 2026] [:error] [pid 39073:tid 39151] [client 45.130.81.80:37075] [client 45.130.81.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfQf0kT1BNjk46BkckcAAAAJE"]
[Tue May 05 06:35:48.995365 2026] [:error] [pid 41055:tid 41077] [client 45.130.81.97:44791] [client 45.130.81.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.97, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfRCepFwKgA_SKOHjAhgAAARM"]
[Tue May 05 06:35:52.876465 2026] [:error] [pid 39071:tid 39085] [client 45.130.81.103:59091] [client 45.130.81.103] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.103, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfSIvmnRMz9gRzix1g0gAAAAU"]
[Tue May 05 06:35:56.685344 2026] [:error] [pid 39178:tid 39202] [client 45.130.81.99:41557] [client 45.130.81.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.99, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfTDaPrgTaiOD_15tS7QAAANY"]
[Tue May 05 06:36:00.949098 2026] [:error] [pid 41055:tid 41080] [client 45.130.81.78:61731] [client 45.130.81.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.78, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfUCepFwKgA_SKOHjAigAAARY"]
[Tue May 05 06:36:06.753084 2026] [:error] [pid 41055:tid 41076] [client 45.130.81.100:51713] [client 45.130.81.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.100, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfViepFwKgA_SKOHjAjAAAARI"]
[Tue May 05 06:36:11.113612 2026] [:error] [pid 39072:tid 39127] [client 45.130.81.91:22285] [client 45.130.81.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.91, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfW_olSHl4aAnrIovmLQAAAFQ"]
[Tue May 05 06:36:15.192932 2026] [:error] [pid 39178:tid 39199] [client 45.130.81.97:53367] [client 45.130.81.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.97, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfXzaPrgTaiOD_15tS-AAAANM"]
[Tue May 05 06:36:19.377001 2026] [:error] [pid 41055:tid 41059] [client 45.130.81.90:51695] [client 45.130.81.90] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.90, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfYyepFwKgA_SKOHjAkQAAAQE"]
[Tue May 05 06:36:23.148972 2026] [:error] [pid 39178:tid 39182] [client 45.130.81.76:41485] [client 45.130.81.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfZzaPrgTaiOD_15tTAgAAAMI"]
[Tue May 05 06:36:27.147688 2026] [:error] [pid 41055:tid 41078] [client 45.130.81.101:55979] [client 45.130.81.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfayepFwKgA_SKOHjAlQAAARQ"]
[Tue May 05 06:36:31.256169 2026] [:error] [pid 39072:tid 39107] [client 45.130.81.71:41843] [client 45.130.81.71] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.71, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfb_olSHl4aAnrIovmPQAAAEA"]
[Tue May 05 06:36:34.841382 2026] [:error] [pid 39072:tid 39113] [client 45.130.81.91:21983] [client 45.130.81.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.91, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfcvolSHl4aAnrIovmPgAAAEY"]
[Tue May 05 06:36:38.889355 2026] [:error] [pid 39071:tid 39083] [client 45.130.81.96:29869] [client 45.130.81.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfdovmnRMz9gRzix1g2gAAAAM"]
[Tue May 05 06:36:42.493212 2026] [:error] [pid 41055:tid 41080] [client 45.130.81.101:51335] [client 45.130.81.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.101, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkfeiepFwKgA_SKOHjApgAAARY"]
[Tue May 05 06:36:46.285616 2026] [:error] [pid 39178:tid 39181] [client 45.130.81.89:60847] [client 45.130.81.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.130.81.89, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afkffjaPrgTaiOD_15tTIgAAAME"]
[Tue May 05 07:40:48.017300 2026] [:error] [pid 39178:tid 39201] [client 45.86.200.107:23977] [client 45.86.200.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "afkugDaPrgTaiOD_15uNCQAAANU"]
[Tue May 05 07:40:56.057617 2026] [:error] [pid 39071:tid 39091] [client 45.86.200.101:59801] [client 45.86.200.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "afkuiIvmnRMz9gRzix2AAgAAAAs"]
[Tue May 05 07:41:08.316472 2026] [:error] [pid 39178:tid 39194] [client 45.86.200.110:49307] [client 45.86.200.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tinyfilemanager.php"] [unique_id "afkulDaPrgTaiOD_15uQCwAAAM4"]
[Tue May 05 07:41:14.389835 2026] [:error] [pid 41055:tid 41064] [client 45.86.200.83:48355] [client 45.86.200.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/index.php"] [unique_id "afkumiepFwKgA_SKOHjyhgAAAQY"]
[Tue May 05 07:41:22.106814 2026] [:error] [pid 39071:tid 39089] [client 45.86.200.86:52215] [client 45.86.200.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/classwithtostring.php"] [unique_id "afkuoovmnRMz9gRzix2DbwAAAAk"]
[Tue May 05 07:41:28.049158 2026] [:error] [pid 41055:tid 41074] [client 45.86.200.57:43743] [client 45.86.200.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "afkuqCepFwKgA_SKOHjz-AAAARA"]
[Tue May 05 07:41:30.785336 2026] [:error] [pid 41055:tid 41067] [client 45.86.200.93:47921] [client 45.86.200.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "afkuqiepFwKgA_SKOHj0PwAAAQk"]
[Tue May 05 07:41:31.333097 2026] [:error] [pid 39072:tid 39111] [client 45.86.200.88:61099] [client 45.86.200.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "afkuq_olSHl4aAnrIosLMgAAAEQ"]
[Tue May 05 07:41:31.916961 2026] [:error] [pid 53856:tid 53886] [client 45.86.200.95:48485] [client 45.86.200.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "afkuq3G_NPOxSH0O9aTj3wAAAVU"]
[Tue May 05 07:41:32.460633 2026] [:error] [pid 39073:tid 39152] [client 45.86.200.56:58029] [client 45.86.200.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "afkurP0kT1BNjk46BkdOHgAAAJI"]
[Tue May 05 07:41:33.077452 2026] [:error] [pid 53856:tid 53882] [client 45.86.200.96:52773] [client 45.86.200.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "afkurXG_NPOxSH0O9aTkIgAAAVE"]
[Tue May 05 07:41:35.782430 2026] [:error] [pid 41055:tid 41071] [client 45.86.200.106:32357] [client 45.86.200.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "afkuryepFwKgA_SKOHj0pwAAAQ0"]
[Tue May 05 07:41:40.989061 2026] [:error] [pid 41055:tid 41080] [client 45.86.200.76:49581] [client 45.86.200.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/filemanager.php"] [unique_id "afkutCepFwKgA_SKOHj1GAAAARY"]
[Tue May 05 07:41:46.438032 2026] [:error] [pid 53856:tid 53868] [client 45.86.200.91:30379] [client 45.86.200.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/admin.php"] [unique_id "afkuunG_NPOxSH0O9aTmxAAAAUM"]
[Tue May 05 07:41:48.450076 2026] [:error] [pid 39071:tid 39087] [client 45.86.200.87:58071] [client 45.86.200.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "afkuvIvmnRMz9gRzix2HFwAAAAc"]
[Tue May 05 07:41:51.468873 2026] [:error] [pid 39073:tid 39149] [client 185.82.72.3:36249] [client 185.82.72.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "afkuv_0kT1BNjk46BkdPmgAAAI8"]
[Tue May 05 07:42:02.665132 2026] [:error] [pid 53856:tid 53883] [client 45.86.200.88:37897] [client 45.86.200.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "afkuynG_NPOxSH0O9aTqLgAAAVI"]
[Tue May 05 07:42:06.115584 2026] [:error] [pid 39072:tid 39120] [client 45.86.200.100:43933] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "afkuzvolSHl4aAnrIosP5QAAAE0"]
[Tue May 05 07:42:12.088823 2026] [:error] [pid 39072:tid 39112] [client 45.86.200.100:31077] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/defaults.php"] [unique_id "afku1PolSHl4aAnrIosQpQAAAEU"]
[Tue May 05 07:42:14.636951 2026] [:error] [pid 39072:tid 39111] [client 45.86.200.93:23781] [client 45.86.200.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/customize/index.php"] [unique_id "afku1volSHl4aAnrIosRDAAAAEQ"]
[Tue May 05 07:42:23.523871 2026] [:error] [pid 39071:tid 39083] [client 45.86.200.96:34571] [client 45.86.200.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "afku34vmnRMz9gRzix2K4gAAAAM"]
[Tue May 05 07:42:26.630069 2026] [:error] [pid 39071:tid 39101] [client 45.86.200.103:39073] [client 45.86.200.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "afku4ovmnRMz9gRzix2LMgAAABU"]
[Tue May 05 07:42:30.889834 2026] [:error] [pid 39071:tid 39097] [client 45.86.200.84:32941] [client 45.86.200.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/index.php"] [unique_id "afku5ovmnRMz9gRzix2LngAAABE"]
[Tue May 05 07:42:31.421965 2026] [:error] [pid 53856:tid 53888] [client 45.86.200.100:28191] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "afku53G_NPOxSH0O9aTvIAAAAVc"]
[Tue May 05 07:42:32.048372 2026] [:error] [pid 39073:tid 39145] [client 45.86.200.60:42375] [client 45.86.200.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "afku6P0kT1BNjk46BkdUXgAAAIs"]
[Tue May 05 07:42:40.918257 2026] [:error] [pid 39072:tid 39124] [client 45.86.200.94:62583] [client 45.86.200.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/info.php"] [unique_id "afku8PolSHl4aAnrIosUiAAAAFE"]
[Tue May 05 07:42:41.481148 2026] [:error] [pid 53856:tid 53886] [client 45.86.200.91:39955] [client 45.86.200.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/class.api.php"] [unique_id "afku8XG_NPOxSH0O9aTxAAAAAVU"]
[Tue May 05 07:42:42.026146 2026] [:error] [pid 39178:tid 39200] [client 45.86.200.74:53197] [client 45.86.200.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/fonts/index.php"] [unique_id "afku8jaPrgTaiOD_15uZ7QAAANQ"]
[Tue May 05 07:43:04.835533 2026] [:error] [pid 39072:tid 39121] [client 45.86.200.85:32179] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/admin.php"] [unique_id "afkvCPolSHl4aAnrIosXXAAAAE4"]
[Tue May 05 07:43:17.532068 2026] [:error] [pid 39178:tid 39204] [client 45.86.200.58:33989] [client 45.86.200.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/wp-login.php"] [unique_id "afkvFTaPrgTaiOD_15udOwAAANg"]
[Tue May 05 07:43:55.490034 2026] [:error] [pid 39178:tid 39182] [client 45.86.200.58:33989] [client 45.86.200.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/about.php"] [unique_id "afkvOzaPrgTaiOD_15ugpAAAAMI"]
[Tue May 05 07:44:02.432207 2026] [:error] [pid 41055:tid 41082] [client 45.86.200.85:50909] [client 45.86.200.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/user/wp-login.php"] [unique_id "afkvQiepFwKgA_SKOHgFXgAAARg"]
[Tue May 05 07:44:06.625253 2026] [:error] [pid 41055:tid 41079] [client 45.86.200.85:50909] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/item.php"] [unique_id "afkvRiepFwKgA_SKOHgF3gAAARU"]
[Tue May 05 07:44:27.015536 2026] [:error] [pid 39178:tid 39181] [client 45.86.200.97:60439] [client 45.86.200.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/husky301.php"] [unique_id "afkvWzaPrgTaiOD_15ukHQAAAME"]
[Tue May 05 07:45:00.500380 2026] [:error] [pid 41055:tid 41071] [client 185.82.72.4:23965] [client 185.82.72.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "afkvfCepFwKgA_SKOHgLcQAAAQ0"]
[Tue May 05 07:45:09.093519 2026] [:error] [pid 39073:tid 39157] [client 45.86.200.81:62377] [client 45.86.200.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/classwithtostring.php"] [unique_id "afkvhf0kT1BNjk46BkdkkQAAAJc"]
[Tue May 05 07:45:22.067373 2026] [:error] [pid 53856:tid 53888] [client 45.86.200.105:56115] [client 45.86.200.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.105, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/wp-login.php"] [unique_id "afkvknG_NPOxSH0O9aQLZAAAAVc"]
[Tue May 05 07:45:25.686114 2026] [:error] [pid 53856:tid 53885] [client 45.86.200.105:56115] [client 45.86.200.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "afkvlXG_NPOxSH0O9aQMDgAAAVQ"]
[Tue May 05 07:45:42.350506 2026] [:error] [pid 53856:tid 53881] [client 45.86.200.82:31133] [client 45.86.200.82] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/index.php"] [unique_id "afkvpnG_NPOxSH0O9aQO2AAAAVA"]
[Tue May 05 07:46:08.651752 2026] [:error] [pid 39073:tid 39153] [client 45.86.200.79:47519] [client 45.86.200.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "afkvwP0kT1BNjk46BkdrtgAAAJM"]
[Tue May 05 07:46:16.361543 2026] [:error] [pid 53856:tid 53882] [client 45.86.200.59:36411] [client 45.86.200.59] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.59, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "afkvyHG_NPOxSH0O9aQVtQAAAVE"]
[Tue May 05 07:46:24.281130 2026] [:error] [pid 53856:tid 53889] [client 45.86.200.59:36411] [client 45.86.200.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/about.php"] [unique_id "afkv0HG_NPOxSH0O9aQXlAAAAVg"]
[Tue May 05 07:46:26.979101 2026] [:error] [pid 39073:tid 39147] [client 45.86.200.54:47515] [client 45.86.200.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/infi.php"] [unique_id "afkv0v0kT1BNjk46BkdtVQAAAI0"]
[Tue May 05 07:46:32.379927 2026] [:error] [pid 53856:tid 53889] [client 45.86.200.78:23759] [client 45.86.200.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/IXR/index.php"] [unique_id "afkv2HG_NPOxSH0O9aQZaQAAAVg"]
[Tue May 05 07:46:34.172174 2026] [:error] [pid 53856:tid 53869] [client 45.86.200.92:34105] [client 45.86.200.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/images/index22.php"] [unique_id "afkv2nG_NPOxSH0O9aQZxwAAAUQ"]
[Tue May 05 07:46:42.561145 2026] [:error] [pid 53856:tid 53885] [client 45.86.200.73:23241] [client 45.86.200.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/about.php"] [unique_id "afkv4nG_NPOxSH0O9aQbXwAAAVQ"]
[Tue May 05 07:46:43.098388 2026] [:error] [pid 41055:tid 41082] [client 45.86.200.82:29881] [client 45.86.200.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/pomo/index.php"] [unique_id "afkv4yepFwKgA_SKOHgWuwAAARg"]
[Tue May 05 07:47:01.145392 2026] [:error] [pid 53856:tid 53869] [client 45.86.200.95:64849] [client 45.86.200.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "afkv9XG_NPOxSH0O9aQfaAAAAUQ"]
[Tue May 05 07:47:08.326113 2026] [:error] [pid 41055:tid 41068] [client 45.86.200.82:60175] [client 45.86.200.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/certificates/about.php"] [unique_id "afkv_CepFwKgA_SKOHgZ9wAAAQo"]
[Tue May 05 07:47:14.994138 2026] [:error] [pid 39072:tid 39122] [client 185.82.72.3:35047] [client 185.82.72.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/edit.php"] [unique_id "afkwAvolSHl4aAnrIoszGQAAAE8"]
[Tue May 05 07:47:20.481062 2026] [:error] [pid 53856:tid 53885] [client 45.86.200.108:50429] [client 45.86.200.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "afkwCHG_NPOxSH0O9aQiKwAAAVQ"]
[Tue May 05 07:47:26.153188 2026] [:error] [pid 39072:tid 39112] [client 45.86.200.56:58635] [client 45.86.200.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/click.php"] [unique_id "afkwDvolSHl4aAnrIos1CwAAAEU"]
[Tue May 05 07:47:38.917428 2026] [autoindex:error] [pid 39178:tid 39193] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/maint/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:43.367093 2026] [autoindex:error] [pid 39178:tid 39201] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:54.876393 2026] [autoindex:error] [pid 39178:tid 39196] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:47:56.972846 2026] [autoindex:error] [pid 39178:tid 39201] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/style-engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:03.584751 2026] [autoindex:error] [pid 39178:tid 39194] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:03.878389 2026] [autoindex:error] [pid 39178:tid 39187] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:06.983108 2026] [autoindex:error] [pid 39178:tid 39198] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:07.263570 2026] [autoindex:error] [pid 39178:tid 39182] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/IXR/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:07.548259 2026] [autoindex:error] [pid 39178:tid 39180] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:07.840007 2026] [autoindex:error] [pid 39178:tid 39197] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/smilies/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:08.131191 2026] [autoindex:error] [pid 39178:tid 39198] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:08.426208 2026] [autoindex:error] [pid 39178:tid 39201] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:11.055609 2026] [autoindex:error] [pid 39178:tid 39200] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:11.338985 2026] [autoindex:error] [pid 39178:tid 39197] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:11.614090 2026] [autoindex:error] [pid 39178:tid 39202] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:18.675823 2026] [autoindex:error] [pid 39178:tid 39184] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:18.969220 2026] [autoindex:error] [pid 39178:tid 39183] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/customize/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:19.248675 2026] [autoindex:error] [pid 39178:tid 39192] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/SimplePie/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:19.526532 2026] [autoindex:error] [pid 39178:tid 39195] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/theme-compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:19.802030 2026] [autoindex:error] [pid 39178:tid 39187] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:20.079696 2026] [autoindex:error] [pid 39178:tid 39184] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/ID3/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:24.493295 2026] [autoindex:error] [pid 39178:tid 39185] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:24.781842 2026] [autoindex:error] [pid 39178:tid 39198] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:33.184903 2026] [autoindex:error] [pid 39178:tid 39189] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:37.853771 2026] [autoindex:error] [pid 39178:tid 39180] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/light/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:38.154658 2026] [autoindex:error] [pid 39178:tid 39182] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:38.431511 2026] [autoindex:error] [pid 39178:tid 39184] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:49.652195 2026] [autoindex:error] [pid 39178:tid 39197] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:49.931672 2026] [autoindex:error] [pid 39178:tid 39192] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/endpoints/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:48:59.318641 2026] [autoindex:error] [pid 39178:tid 39193] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:03.151158 2026] [autoindex:error] [pid 39178:tid 39197] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:08.084846 2026] [autoindex:error] [pid 39178:tid 39191] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:08.399081 2026] [autoindex:error] [pid 39178:tid 39187] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentythree/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:08.686839 2026] [autoindex:error] [pid 39178:tid 39201] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:09.070598 2026] [autoindex:error] [pid 39178:tid 39189] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:09.425487 2026] [autoindex:error] [pid 39178:tid 39198] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:16.205304 2026] [autoindex:error] [pid 39178:tid 39198] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:22.527591 2026] [autoindex:error] [pid 39178:tid 39200] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/media/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:22.821141 2026] [autoindex:error] [pid 39178:tid 39194] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:32.458378 2026] [autoindex:error] [pid 39178:tid 39186] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:37.186951 2026] [autoindex:error] [pid 39178:tid 39201] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/images/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:44.023571 2026] [autoindex:error] [pid 39178:tid 39204] [client 45.86.200.102:45689] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:47.932942 2026] [autoindex:error] [pid 39178:tid 39196] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/edit-widgets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:48.218643 2026] [autoindex:error] [pid 39178:tid 39182] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/src/Exception/Http/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:48.506039 2026] [autoindex:error] [pid 39178:tid 39196] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Renderer/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:48.796565 2026] [autoindex:error] [pid 39178:tid 39183] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:49.085760 2026] [autoindex:error] [pid 39178:tid 39201] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/lightgray/img/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:49:49.386944 2026] [autoindex:error] [pid 39178:tid 39197] [client 45.86.200.102:45689] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentytwo/assets/fonts/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:50:02.991516 2026] [autoindex:error] [pid 39178:tid 39188] [client 45.86.200.91:35783] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:50:03.312972 2026] [autoindex:error] [pid 39178:tid 39204] [client 45.86.200.91:35783] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:50:03.621545 2026] [autoindex:error] [pid 39178:tid 39194] [client 45.86.200.91:35783] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/Diff/Engine/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:50:03.909616 2026] [autoindex:error] [pid 39178:tid 39182] [client 45.86.200.91:35783] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/coffee/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:50:04.195995 2026] [autoindex:error] [pid 39178:tid 39184] [client 45.86.200.91:35783] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/calendar/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:50:07.983035 2026] [autoindex:error] [pid 39178:tid 39182] [client 45.86.200.91:35783] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:50:14.467397 2026] [autoindex:error] [pid 39178:tid 39180] [client 45.86.200.91:35783] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2023/05/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:50:17.792313 2026] [autoindex:error] [pid 39178:tid 39190] [client 45.86.200.91:35783] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:50:18.091997 2026] [autoindex:error] [pid 39178:tid 39198] [client 45.86.200.91:35783] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sitemaps/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:50:18.386770 2026] [autoindex:error] [pid 39178:tid 39180] [client 45.86.200.91:35783] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:50:18.694304 2026] [autoindex:error] [pid 39178:tid 39185] [client 45.86.200.91:35783] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:50:18.984654 2026] [autoindex:error] [pid 39178:tid 39189] [client 45.86.200.91:35783] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/src/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:50:33.959905 2026] [autoindex:error] [pid 39178:tid 39182] [client 45.86.200.91:35783] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/fullscreen/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:50:45.704352 2026] [autoindex:error] [pid 39178:tid 39200] [client 45.86.200.91:35783] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/interactivity-api/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:50:46.032270 2026] [autoindex:error] [pid 39178:tid 39196] [client 45.86.200.91:35783] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:50:49.691810 2026] [autoindex:error] [pid 39178:tid 39197] [client 45.86.200.91:35783] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/utils/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:51:05.063430 2026] [autoindex:error] [pid 39178:tid 39201] [client 45.86.200.91:35783] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/codemirror/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:51:05.362841 2026] [autoindex:error] [pid 39178:tid 39199] [client 45.86.200.91:35783] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/langs/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:51:05.652737 2026] [autoindex:error] [pid 39178:tid 39202] [client 45.86.200.91:35783] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:51:05.950211 2026] [autoindex:error] [pid 39178:tid 39185] [client 45.86.200.91:35783] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/group/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:51:22.448814 2026] [autoindex:error] [pid 53856:tid 53869] [client 45.86.200.75:58397] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:51:29.775684 2026] [autoindex:error] [pid 53856:tid 53871] [client 45.86.200.75:58397] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/file/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:51:43.899798 2026] [autoindex:error] [pid 53856:tid 53865] [client 45.86.200.75:58397] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfour/patterns/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:51:57.360590 2026] [autoindex:error] [pid 53856:tid 53882] [client 45.86.200.75:58397] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/imgareaselect/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:52:01.807700 2026] [autoindex:error] [pid 53856:tid 53888] [client 45.86.200.75:58397] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/lib/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:52:02.094740 2026] [autoindex:error] [pid 53856:tid 53888] [client 45.86.200.75:58397] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jcrop/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:52:14.476251 2026] [autoindex:error] [pid 39178:tid 39193] [client 45.86.200.51:46771] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:52:17.767803 2026] [autoindex:error] [pid 39178:tid 39200] [client 45.86.200.51:46771] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:52:18.039735 2026] [autoindex:error] [pid 39178:tid 39184] [client 45.86.200.51:46771] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/classic-editor/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:53:13.372961 2026] [autoindex:error] [pid 39178:tid 39193] [client 45.86.200.51:46771] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/skins/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:53:26.800647 2026] [autoindex:error] [pid 39178:tid 39199] [client 45.86.200.51:46771] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/ui/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:53:39.372289 2026] [autoindex:error] [pid 39178:tid 39200] [client 45.86.200.51:46771] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/themes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:53:47.242293 2026] [autoindex:error] [pid 39178:tid 39196] [client 45.86.200.51:46771] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/themes/inlite/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:53:51.108157 2026] [autoindex:error] [pid 39178:tid 39189] [client 45.86.200.51:46771] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/plupload/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:53:51.413882 2026] [autoindex:error] [pid 39178:tid 39187] [client 45.86.200.51:46771] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:53:56.490170 2026] [autoindex:error] [pid 39178:tid 39192] [client 45.86.200.51:46771] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/code/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:53:56.773030 2026] [autoindex:error] [pid 39178:tid 39188] [client 45.86.200.51:46771] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/archives/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:53:57.050008 2026] [autoindex:error] [pid 39178:tid 39192] [client 45.86.200.51:46771] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/components/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:54:06.436528 2026] [autoindex:error] [pid 39178:tid 39180] [client 45.86.200.51:46771] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/pullquote/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:54:18.816253 2026] [autoindex:error] [pid 41055:tid 41078] [client 45.86.200.83:20225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/comments-pagination-numbers/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:54:29.094983 2026] [autoindex:error] [pid 41055:tid 41072] [client 45.86.200.83:20225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:54:29.393482 2026] [autoindex:error] [pid 41055:tid 41077] [client 45.86.200.83:20225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/post-terms/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:54:31.008688 2026] [autoindex:error] [pid 41055:tid 41071] [client 45.86.200.83:20225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/dist/development/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:54:32.476601 2026] [autoindex:error] [pid 41055:tid 41068] [client 45.86.200.83:20225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/sodium_compat/namespaced/Core/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:54:36.370998 2026] [autoindex:error] [pid 41055:tid 41070] [client 45.86.200.83:20225] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:54:42.977915 2026] [autoindex:error] [pid 41055:tid 41068] [client 45.86.200.83:20225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/site-title/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:54:50.327374 2026] [autoindex:error] [pid 41055:tid 41077] [client 45.86.200.83:20225] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/tinymce/plugins/compat3x/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:54:54.772923 2026] [autoindex:error] [pid 41055:tid 41066] [client 45.86.200.83:20225] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2025/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 07:54:55.043704 2026] [autoindex:error] [pid 41055:tid 41060] [client 45.86.200.83:20225] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/2026/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue May 05 11:22:54.532723 2026] [:error] [pid 25744:tid 25796] [client 117.235.93.55:13617] [client 117.235.93.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.235.93.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aflijiR8IuyzjkW06ON3fAAAAJY"]
[Tue May 05 11:23:04.545909 2026] [:error] [pid 25743:tid 25768] [client 117.235.93.55:13981] [client 117.235.93.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.235.93.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aflimG-PCMRhF5DdUnNxAwAAABU"]
[Tue May 05 11:23:15.021483 2026] [:error] [pid 25835:tid 25845] [client 117.235.93.55:14253] [client 117.235.93.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.235.93.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aflio1DT5nGJyh1439xEUwAAAQg"]
[Tue May 05 11:23:39.047920 2026] [:error] [pid 25835:tid 25853] [client 117.235.93.55:14803] [client 117.235.93.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.235.93.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afliu1DT5nGJyh1439xEnQAAARA"]
[Tue May 05 11:23:45.965967 2026] [:error] [pid 25745:tid 25810] [client 117.235.93.55:55890] [client 117.235.93.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.235.93.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afliwZsd7hb7vrvCNBnLlQAAAMk"]
[Tue May 05 12:19:34.824316 2026] [:error] [pid 25835:tid 25851] [client 152.57.177.88:55559] [client 152.57.177.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.57.177.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aflv1lDT5nGJyh1439xjYwAAAQ4"]
[Tue May 05 12:19:46.301840 2026] [:error] [pid 54732:tid 54748] [client 152.57.177.88:55785] [client 152.57.177.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.57.177.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aflv4rGgYlDOb3nfuJRmAwAAAE4"]
[Tue May 05 12:19:59.030147 2026] [:error] [pid 54732:tid 54746] [client 152.57.177.88:55967] [client 152.57.177.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.57.177.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aflv77GgYlDOb3nfuJRmPgAAAEw"]
[Tue May 05 12:20:16.174190 2026] [:error] [pid 54732:tid 54748] [client 152.57.177.88:56282] [client 152.57.177.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.57.177.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aflwALGgYlDOb3nfuJRmUQAAAE4"]
[Tue May 05 12:20:26.788652 2026] [:error] [pid 25835:tid 25841] [client 152.57.177.88:56518] [client 152.57.177.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.57.177.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aflwClDT5nGJyh1439xjkAAAAQQ"]
[Tue May 05 12:20:37.185010 2026] [:error] [pid 25743:tid 25767] [client 152.57.177.88:56743] [client 152.57.177.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.57.177.88, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aflwFW-PCMRhF5DdUnN-vQAAABQ"]
[Tue May 05 13:38:59.750399 2026] [:error] [pid 54732:tid 54751] [client 40.83.75.73:1353] [client 40.83.75.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "afmCc7GgYlDOb3nfuJSQlgAAAFE"]
[Tue May 05 13:39:00.465621 2026] [:error] [pid 25835:tid 25845] [client 40.83.75.73:3474] [client 40.83.75.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "afmCdFDT5nGJyh1439x-2gAAAQg"]
[Tue May 05 13:39:01.251000 2026] [:error] [pid 25835:tid 25841] [client 40.83.75.73:5381] [client 40.83.75.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "afmCdVDT5nGJyh1439x-2wAAAQQ"]
[Tue May 05 13:39:01.859629 2026] [:error] [pid 54732:tid 54747] [client 40.83.75.73:3501] [client 40.83.75.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "afmCdbGgYlDOb3nfuJSQlwAAAE0"]
[Tue May 05 14:55:35.941580 2026] [:error] [pid 25835:tid 25846] [client 216.81.248.217:60340] [client 216.81.248.217] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "afmUZ1DT5nGJyh1439yX5AAAAQk"]
[Tue May 05 16:14:57.775834 2026] [:error] [pid 25835:tid 25852] [client 222.154.250.222:33526] [client 222.154.250.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 222.154.250.222, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afmnAVDT5nGJyh1439ywJgAAAQ8"], referer: https://expressinteriors.com/
[Tue May 05 17:01:57.801970 2026] [:error] [pid 25744:tid 25779] [client 43.164.3.182:42890] [client 43.164.3.182] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afmyBSR8IuyzjkW06OPBUgAAAIU"]
[Tue May 05 18:36:43.992449 2026] [:error] [pid 2324:tid 2342] [client 154.146.254.39:49950] [client 154.146.254.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.146.254.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnIO2qe2hrcI52A1HxR8wAAAVA"]
[Tue May 05 18:36:53.851524 2026] [:error] [pid 54732:tid 54753] [client 160.160.154.243:53022] [client 160.160.154.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.160.154.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnIRbGgYlDOb3nfuJQNpAAAAFM"]
[Tue May 05 18:37:04.258715 2026] [:error] [pid 25743:tid 25771] [client 154.146.254.39:59166] [client 154.146.254.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.146.254.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnIUG-PCMRhF5DdUnPEAgAAABg"]
[Tue May 05 18:37:14.826214 2026] [:error] [pid 25743:tid 25751] [client 154.146.254.40:4126] [client 154.146.254.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.146.254.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnIWm-PCMRhF5DdUnPEEgAAAAQ"]
[Tue May 05 18:37:26.814563 2026] [:error] [pid 25743:tid 25749] [client 197.230.142.50:27678] [client 197.230.142.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.230.142.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnIZm-PCMRhF5DdUnPEHwAAAAI"]
[Tue May 05 18:37:35.775368 2026] [:error] [pid 25744:tid 25782] [client 154.146.254.40:9758] [client 154.146.254.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.146.254.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnIbyR8IuyzjkW06OPXNwAAAIg"]
[Tue May 05 18:37:46.719595 2026] [:error] [pid 2324:tid 2330] [client 154.146.254.40:55070] [client 154.146.254.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.146.254.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnIemqe2hrcI52A1HxSVAAAAUQ"]
[Tue May 05 18:37:56.922905 2026] [:error] [pid 25744:tid 25787] [client 154.146.254.39:34846] [client 154.146.254.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.146.254.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnIhCR8IuyzjkW06OPXRgAAAI0"]
[Tue May 05 18:38:10.136021 2026] [:error] [pid 54732:tid 54755] [client 154.146.254.39:52510] [client 154.146.254.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.146.254.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnIkrGgYlDOb3nfuJQNygAAAFU"]
[Tue May 05 18:38:21.004085 2026] [:error] [pid 25744:tid 25781] [client 197.230.119.178:14366] [client 197.230.119.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.230.119.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnInSR8IuyzjkW06OPXUgAAAIc"]
[Tue May 05 18:38:31.591439 2026] [:error] [pid 2324:tid 2335] [client 160.160.154.243:5150] [client 160.160.154.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.160.154.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnIp2qe2hrcI52A1HxShQAAAUk"]
[Tue May 05 18:38:42.521201 2026] [:error] [pid 25744:tid 25776] [client 197.230.119.178:43550] [client 197.230.119.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.230.119.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnIsiR8IuyzjkW06OPXYQAAAII"]
[Tue May 05 18:38:53.258510 2026] [:error] [pid 25743:tid 25747] [client 197.230.119.178:25886] [client 197.230.119.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.230.119.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnIvW-PCMRhF5DdUnPEcQAAAAA"]
[Tue May 05 18:39:06.158780 2026] [:error] [pid 25835:tid 25854] [client 160.160.154.243:26654] [client 160.160.154.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.160.154.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnIylDT5nGJyh1439zR3QAAARE"]
[Tue May 05 18:39:20.306134 2026] [:error] [pid 25745:tid 25818] [client 197.230.142.50:12318] [client 197.230.142.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.230.142.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnI2Jsd7hb7vrvCNBk8tAAAANE"]
[Tue May 05 18:39:29.711333 2026] [:error] [pid 2324:tid 2344] [client 154.146.254.39:15134] [client 154.146.254.39] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.146.254.39, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnI4Wqe2hrcI52A1HxStwAAAVI"]
[Tue May 05 18:39:40.935182 2026] [:error] [pid 2324:tid 2341] [client 197.230.119.178:11550] [client 197.230.119.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.230.119.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnI7Gqe2hrcI52A1HxSyAAAAU8"]
[Tue May 05 18:40:03.093912 2026] [:error] [pid 2324:tid 2328] [client 197.230.119.178:34590] [client 197.230.119.178] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.230.119.178, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnJA2qe2hrcI52A1HxS4AAAAUI"]
[Tue May 05 18:40:12.938939 2026] [:error] [pid 25744:tid 25796] [client 160.160.154.243:58398] [client 160.160.154.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.160.154.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnJDCR8IuyzjkW06OPXzQAAAJY"]
[Tue May 05 18:40:25.909670 2026] [:error] [pid 25743:tid 25771] [client 197.230.142.50:26910] [client 197.230.142.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.230.142.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnJGW-PCMRhF5DdUnPE7gAAABg"]
[Tue May 05 18:40:35.366291 2026] [:error] [pid 25744:tid 25784] [client 154.146.254.40:6430] [client 154.146.254.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.146.254.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnJIyR8IuyzjkW06OPX3AAAAIo"]
[Tue May 05 18:40:45.774965 2026] [:error] [pid 25744:tid 25774] [client 154.146.254.40:7710] [client 154.146.254.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.146.254.40, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnJLSR8IuyzjkW06OPX6wAAAIA"]
[Tue May 05 18:41:10.935466 2026] [:error] [pid 25744:tid 25797] [client 197.230.142.50:57374] [client 197.230.142.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.230.142.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnJRiR8IuyzjkW06OPYCAAAAJc"]
[Tue May 05 18:43:37.750670 2026] [:error] [pid 25743:tid 25748] [client 197.230.142.50:58398] [client 197.230.142.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.230.142.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnJ2W-PCMRhF5DdUnPFqQAAAAE"]
[Tue May 05 18:43:58.407527 2026] [:error] [pid 2324:tid 2332] [client 160.160.154.243:23838] [client 160.160.154.243] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.160.154.243, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afnJ7mqe2hrcI52A1HxUjwAAAUY"]
[Tue May 05 18:54:13.884137 2026] [:error] [pid 25743:tid 25765] [client 43.165.167.69:37154] [client 43.165.167.69] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afnMVW-PCMRhF5DdUnPIGwAAABI"]
[Tue May 05 19:48:21.884650 2026] [:error] [pid 54732:tid 54756] [client 212.237.121.222:21357] [client 212.237.121.222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/HEAD"] [unique_id "afnZBbGgYlDOb3nfuJQZsAAAAFY"]
[Tue May 05 19:48:22.633460 2026] [:error] [pid 54732:tid 54742] [client 212.237.121.222:22887] [client 212.237.121.222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/HEAD"] [unique_id "afnZBrGgYlDOb3nfuJQZtwAAAEg"]
[Tue May 05 19:48:23.349555 2026] [:error] [pid 2324:tid 2333] [client 212.237.121.222:21891] [client 212.237.121.222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/HEAD"] [unique_id "afnZB2qe2hrcI52A1HxsTAAAAUc"]
[Tue May 05 19:48:27.318504 2026] [:error] [pid 25835:tid 25861] [client 212.237.121.222:22875] [client 212.237.121.222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "afnZC1DT5nGJyh1439zbdAAAARg"]
[Tue May 05 19:48:27.318718 2026] [:error] [pid 25835:tid 25851] [client 212.237.121.222:22133] [client 212.237.121.222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/app/.env"] [unique_id "afnZC1DT5nGJyh1439zbdQAAAQ4"]
[Tue May 05 21:40:44.140378 2026] [:error] [pid 25835:tid 25850] [client 43.166.244.66:47668] [client 43.166.244.66] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afnzXFDT5nGJyh1439zr9gAAAQ0"]
[Tue May 05 22:08:02.440564 2026] [:error] [pid 25835:tid 25841] [client 194.62.107.131:45741] [client 194.62.107.131] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "afn5wlDT5nGJyh1439zvXAAAAQQ"]
[Tue May 05 23:21:57.017201 2026] [:error] [pid 54732:tid 54758] [client 45.154.98.197:53228] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "afoLFbGgYlDOb3nfuJQ-iQAAAFg"]
[Tue May 05 23:21:57.518110 2026] [:error] [pid 25743:tid 25750] [client 45.154.98.197:53311] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "afoLFW-PCMRhF5DdUnMTegAAAAM"]
[Tue May 05 23:21:58.021389 2026] [:error] [pid 25743:tid 25754] [client 45.154.98.197:53461] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "afoLFm-PCMRhF5DdUnMTewAAAAc"]
[Tue May 05 23:22:00.094259 2026] [:error] [pid 25743:tid 25771] [client 45.154.98.197:53966] [client 45.154.98.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "afoLGG-PCMRhF5DdUnMTgQAAABg"]
[Tue May 05 23:25:18.791268 2026] [:error] [pid 25835:tid 25843] [client 43.165.195.234:47230] [client 43.165.195.234] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afoL3lDT5nGJyh1439z6FwAAAQY"]
[Wed May 06 00:04:56.171946 2026] [:error] [pid 54732:tid 54741] [client 70.24.245.82:60237] [client 70.24.245.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 70.24.245.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afoVKLGgYlDOb3nfuJRGUgAAAEc"]
[Wed May 06 00:06:12.302760 2026] [:error] [pid 25835:tid 25852] [client 70.24.245.82:61638] [client 70.24.245.82] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afoVdFDT5nGJyh1439z_8gAAAQ8"]
[Wed May 06 00:06:40.435668 2026] [:error] [pid 25743:tid 25748] [client 70.24.245.82:62134] [client 70.24.245.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 70.24.245.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afoVkG-PCMRhF5DdUnMgcAAAAAE"]
[Wed May 06 00:07:06.205252 2026] [:error] [pid 54732:tid 54756] [client 70.24.245.82:62620] [client 70.24.245.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 70.24.245.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afoVqrGgYlDOb3nfuJRGxwAAAFY"]
[Wed May 06 00:07:24.705431 2026] [:error] [pid 25744:tid 25776] [client 70.24.245.82:62899] [client 70.24.245.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 70.24.245.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afoVvCR8IuyzjkW06OMbowAAAII"]
[Wed May 06 00:07:43.819893 2026] [:error] [pid 25835:tid 25852] [client 70.24.245.82:63191] [client 70.24.245.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 70.24.245.82, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afoVz1DT5nGJyh1439wAPgAAAQ8"]
[Wed May 06 00:33:55.787539 2026] [:error] [pid 25743:tid 25751] [client 103.57.92.36:1354] [client 103.57.92.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.57.92.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afob82-PCMRhF5DdUnMmPQAAAAQ"]
[Wed May 06 00:34:05.906558 2026] [:error] [pid 25744:tid 25797] [client 103.57.92.36:1131] [client 103.57.92.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.57.92.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afob_SR8IuyzjkW06OMgzgAAAJc"]
[Wed May 06 00:34:16.426616 2026] [:error] [pid 25743:tid 25761] [client 103.57.92.36:1437] [client 103.57.92.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.57.92.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afocCG-PCMRhF5DdUnMmTAAAAA4"]
[Wed May 06 00:34:28.419552 2026] [:error] [pid 25743:tid 25754] [client 103.57.92.36:1352] [client 103.57.92.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.57.92.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afocFG-PCMRhF5DdUnMmXgAAAAc"]
[Wed May 06 00:34:38.917532 2026] [:error] [pid 54732:tid 54739] [client 103.57.92.36:1235] [client 103.57.92.36] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.57.92.36, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afocHrGgYlDOb3nfuJRLWAAAAEU"]
[Wed May 06 00:46:47.798214 2026] [:error] [pid 2324:tid 2327] [client 34.132.27.89:63058] [client 34.132.27.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.132.27.89, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afoe92qe2hrcI52A1HzTrwAAAUE"]
[Wed May 06 00:46:49.831418 2026] [:error] [pid 2324:tid 2347] [client 34.132.27.89:63058] [client 34.132.27.89] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "afoe-Wqe2hrcI52A1HzTtAAAAVU"]
[Wed May 06 00:46:50.024921 2026] [:error] [pid 2324:tid 2345] [client 34.132.27.89:63058] [client 34.132.27.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.132.27.89, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afoe-mqe2hrcI52A1HzTtQAAAVM"]
[Wed May 06 00:46:51.494655 2026] [:error] [pid 2324:tid 2331] [client 34.132.27.89:64703] [client 34.132.27.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.132.27.89, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afoe-2qe2hrcI52A1HzTtgAAAUU"]
[Wed May 06 00:46:52.853474 2026] [:error] [pid 25835:tid 25839] [client 34.132.27.89:53675] [client 34.132.27.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.132.27.89, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afoe_FDT5nGJyh1439wFcQAAAQI"]
[Wed May 06 00:46:54.182977 2026] [:error] [pid 54732:tid 54737] [client 34.132.27.89:59616] [client 34.132.27.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.132.27.89, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afoe_rGgYlDOb3nfuJRNSQAAAEM"]
[Wed May 06 00:46:55.489895 2026] [:error] [pid 54732:tid 54744] [client 34.132.27.89:51615] [client 34.132.27.89] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.132.27.89, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afoe_7GgYlDOb3nfuJRNSwAAAEo"]
[Wed May 06 00:46:55.490067 2026] [:error] [pid 54732:tid 54744] [client 34.132.27.89:51615] [client 34.132.27.89] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.132.27.89, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afoe_7GgYlDOb3nfuJRNSwAAAEo"]
[Wed May 06 00:48:02.529747 2026] [:error] [pid 54732:tid 54756] [client 104.197.228.188:57425] [client 104.197.228.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.197.228.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afofQrGgYlDOb3nfuJRNjAAAAFY"]
[Wed May 06 00:48:05.983416 2026] [:error] [pid 54732:tid 54757] [client 104.197.228.188:57425] [client 104.197.228.188] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "afofRbGgYlDOb3nfuJRNjwAAAFc"]
[Wed May 06 00:48:06.177531 2026] [:error] [pid 54732:tid 54744] [client 104.197.228.188:57425] [client 104.197.228.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.197.228.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afofRrGgYlDOb3nfuJRNkAAAAEo"]
[Wed May 06 00:48:07.621425 2026] [:error] [pid 25835:tid 25858] [client 104.197.228.188:61777] [client 104.197.228.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.197.228.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afofR1DT5nGJyh1439wFoAAAARU"]
[Wed May 06 00:48:08.964514 2026] [:error] [pid 25835:tid 25846] [client 104.197.228.188:55849] [client 104.197.228.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.197.228.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afofSFDT5nGJyh1439wFowAAAQk"]
[Wed May 06 00:48:10.304825 2026] [:error] [pid 25744:tid 25776] [client 104.197.228.188:60008] [client 104.197.228.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.197.228.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afofSiR8IuyzjkW06OMj_AAAAII"]
[Wed May 06 00:48:11.655843 2026] [:error] [pid 2324:tid 2328] [client 104.197.228.188:64792] [client 104.197.228.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.197.228.188, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afofS2qe2hrcI52A1HzUFwAAAUI"]
[Wed May 06 00:48:11.656019 2026] [:error] [pid 2324:tid 2328] [client 104.197.228.188:64792] [client 104.197.228.188] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 104.197.228.188, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afofS2qe2hrcI52A1HzUFwAAAUI"]
[Wed May 06 02:21:41.107557 2026] [:error] [pid 25744:tid 25774] [client 43.155.140.157:49024] [client 43.155.140.157] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afo1NSR8IuyzjkW06OM00QAAAIA"]
[Wed May 06 02:49:27.150586 2026] [:error] [pid 54732:tid 54742] [client 34.9.194.25:57236] [client 34.9.194.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.9.194.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afo7t7GgYlDOb3nfuJRgdQAAAEg"]
[Wed May 06 02:49:29.204154 2026] [:error] [pid 54732:tid 54753] [client 34.9.194.25:57236] [client 34.9.194.25] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "afo7ubGgYlDOb3nfuJRgeQAAAFM"]
[Wed May 06 02:59:05.622031 2026] [:error] [pid 25744:tid 25774] [client 181.224.94.124:60062] [client 181.224.94.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.224.94.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afo9-SR8IuyzjkW06OM98QAAAIA"]
[Wed May 06 02:59:15.659081 2026] [:error] [pid 25743:tid 25768] [client 181.224.94.124:38017] [client 181.224.94.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.224.94.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afo-A2-PCMRhF5DdUnNKVgAAABU"]
[Wed May 06 02:59:26.097265 2026] [:error] [pid 25743:tid 25763] [client 181.224.94.124:3802] [client 181.224.94.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.224.94.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afo-Dm-PCMRhF5DdUnNKWwAAABA"]
[Wed May 06 02:59:36.529398 2026] [:error] [pid 2324:tid 2329] [client 181.224.94.124:21691] [client 181.224.94.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.224.94.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afo-GGqe2hrcI52A1Hz-twAAAUM"]
[Wed May 06 02:59:46.958142 2026] [:error] [pid 2324:tid 2349] [client 181.224.94.124:10487] [client 181.224.94.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.224.94.124, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afo-Imqe2hrcI52A1Hz-wgAAAVc"]
[Wed May 06 04:41:14.967537 2026] [:error] [pid 48867:tid 48888] [client 119.28.89.249:44228] [client 119.28.89.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afpV6lZQ-8ZcCbMZPy7zXQAAANI"]
[Wed May 06 07:33:22.800009 2026] [:error] [pid 9789:tid 9801] [client 43.153.36.110:46178] [client 43.153.36.110] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afp-Qj_YStPJSCHPkUX3wQAAAEo"]
[Wed May 06 09:21:08.621621 2026] [:error] [pid 9664:tid 9786] [client 5.227.40.166:51229] [client 5.227.40.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.227.40.166, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afqXhAH4OZbrg1SjsBPWfgAAAJg"]
[Wed May 06 09:21:18.568022 2026] [:error] [pid 9653:tid 9712] [client 5.227.40.166:51525] [client 5.227.40.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.227.40.166, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afqXjqhJ49Xc4dqq0B5jdwAAAA4"]
[Wed May 06 09:21:29.161989 2026] [:error] [pid 13443:tid 13457] [client 5.227.40.166:51936] [client 5.227.40.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.227.40.166, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afqXmQCyfZallDmsQrdmSwAAAUw"]
[Wed May 06 09:21:39.689341 2026] [:error] [pid 9664:tid 9779] [client 5.227.40.166:52231] [client 5.227.40.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.227.40.166, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afqXowH4OZbrg1SjsBPWmgAAAJE"]
[Wed May 06 09:21:50.280384 2026] [:error] [pid 9664:tid 9775] [client 5.227.40.166:52541] [client 5.227.40.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.227.40.166, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afqXrgH4OZbrg1SjsBPWqQAAAI0"]
[Wed May 06 09:47:01.432800 2026] [:error] [pid 9659:tid 9748] [client 68.183.200.51:49801] [client 68.183.200.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.183.200.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "afqdlfwJnWjd8JHpBttKmgAAAM4"]
[Wed May 06 09:47:02.904662 2026] [:error] [pid 9653:tid 9699] [client 68.183.200.51:56314] [client 68.183.200.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 68.183.200.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "afqdlqhJ49Xc4dqq0B5mMgAAAAE"]
[Wed May 06 11:03:44.931141 2026] [:error] [pid 482:tid 484] [client 209.112.91.75:60974] [client 209.112.91.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "afqvkMxs8HOc_nWgOW69bgAAAcA"]
[Wed May 06 11:03:44.958542 2026] [:error] [pid 482:tid 491] [client 209.112.91.75:60970] [client 209.112.91.75] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/HEAD"] [unique_id "afqvkMxs8HOc_nWgOW69cAAAAcc"]
[Wed May 06 11:06:31.059431 2026] [:error] [pid 9789:tid 9814] [client 167.71.104.22:64575] [client 167.71.104.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.104.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "afqwNz_YStPJSCHPkUUvNwAAAFc"]
[Wed May 06 11:06:32.539291 2026] [:error] [pid 9789:tid 9796] [client 167.71.104.22:65308] [client 167.71.104.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.104.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "afqwOD_YStPJSCHPkUUvOwAAAEU"]
[Wed May 06 12:11:00.913643 2026] [:error] [pid 482:tid 497] [client 49.36.243.252:57183] [client 49.36.243.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.243.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afq_VMxs8HOc_nWgOW7UdAAAAc0"]
[Wed May 06 12:11:12.600928 2026] [:error] [pid 482:tid 486] [client 49.36.243.252:57409] [client 49.36.243.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.243.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afq_YMxs8HOc_nWgOW7UgQAAAcI"]
[Wed May 06 12:11:22.842547 2026] [:error] [pid 9664:tid 9771] [client 49.36.243.252:57778] [client 49.36.243.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.243.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afq_agH4OZbrg1SjsBP_mwAAAIk"]
[Wed May 06 12:11:32.335846 2026] [:error] [pid 592:tid 609] [client 49.36.243.252:58066] [client 49.36.243.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.243.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afq_dJiX28mb6xLi2PyGuAAAAo0"]
[Wed May 06 12:11:42.993955 2026] [:error] [pid 482:tid 488] [client 49.36.243.252:58307] [client 49.36.243.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.243.252, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afq_fsxs8HOc_nWgOW7UlAAAAcQ"]
[Wed May 06 13:14:49.299429 2026] [:error] [pid 482:tid 500] [client 49.51.166.228:51598] [client 49.51.166.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afrOScxs8HOc_nWgOW7mmwAAAdA"]
[Wed May 06 15:35:39.713656 2026] [:error] [pid 63810:tid 63823] [client 103.153.130.37:58860] [client 103.153.130.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.130.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afrvS3pnbsN9Zf6i5IEoagAAAYk"]
[Wed May 06 15:35:49.352594 2026] [:error] [pid 9659:tid 9737] [client 103.153.130.46:59065] [client 103.153.130.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.130.46, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afrvVfwJnWjd8JHpBttvtAAAAMM"]
[Wed May 06 15:35:59.332382 2026] [:error] [pid 13443:tid 13466] [client 103.153.130.55:57294] [client 103.153.130.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.130.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afrvXwCyfZallDmsQreG9gAAAVU"]
[Wed May 06 15:36:09.233104 2026] [:error] [pid 482:tid 502] [client 103.153.130.55:57504] [client 103.153.130.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.130.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afrvacxs8HOc_nWgOW4P6wAAAdI"]
[Wed May 06 15:36:19.046696 2026] [:error] [pid 592:tid 607] [client 103.153.130.55:57726] [client 103.153.130.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.130.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afrvc5iX28mb6xLi2PyWNgAAAos"]
[Wed May 06 15:36:28.831594 2026] [:error] [pid 592:tid 624] [client 103.153.130.55:57938] [client 103.153.130.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.130.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afrvfJiX28mb6xLi2PyWOgAAApg"]
[Wed May 06 15:36:38.704019 2026] [:error] [pid 482:tid 497] [client 103.153.130.55:58160] [client 103.153.130.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.130.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afrvhsxs8HOc_nWgOW4QBwAAAc0"]
[Wed May 06 15:36:48.592065 2026] [:error] [pid 9664:tid 9771] [client 103.153.130.55:58371] [client 103.153.130.55] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.130.55, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afrvkAH4OZbrg1SjsBMeZwAAAIk"]
[Wed May 06 15:45:32.585204 2026] [:error] [pid 9664:tid 9778] [client 103.153.130.34:56019] [client 103.153.130.34] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.153.130.34, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afrxnAH4OZbrg1SjsBMfswAAAJA"]
[Wed May 06 18:26:23.104461 2026] [:error] [pid 9789:tid 9795] [client 101.42.46.71:35270] [client 101.42.46.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afsXTz_YStPJSCHPkUV6fQAAAEQ"]
[Wed May 06 18:26:25.251849 2026] [:error] [pid 482:tid 495] [client 43.164.131.148:53858] [client 43.164.131.148] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afsXUcxs8HOc_nWgOW4yQQAAAcs"]
[Wed May 06 19:32:11.979397 2026] [:error] [pid 592:tid 620] [client 74.7.241.37:43912] [client 74.7.241.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.7.241.37, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afsmu5iX28mb6xLi2PyoygAAApU"], referer: https://expressinteriors.com/
[Wed May 06 19:39:55.750927 2026] [:error] [pid 482:tid 507] [client 52.159.226.3:48732] [client 52.159.226.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.159.226.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/wp/xmlrpc.php"] [unique_id "afsoi8xs8HOc_nWgOW5AfAAAAdU"]
[Wed May 06 20:29:24.605756 2026] [:error] [pid 9789:tid 9801] [client 43.159.135.203:52960] [client 43.159.135.203] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afs0JD_YStPJSCHPkUWNSwAAAEo"]
[Wed May 06 22:53:08.773577 2026] [:error] [pid 13443:tid 13462] [client 34.158.8.186:56082] [client 34.158.8.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.158.8.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aftV1ACyfZallDmsQrejYQAAAVE"]
[Wed May 06 22:53:11.093250 2026] [:error] [pid 13443:tid 13459] [client 34.158.8.186:56082] [client 34.158.8.186] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aftV1wCyfZallDmsQrejZwAAAU4"]
[Wed May 06 22:53:11.297355 2026] [:error] [pid 13443:tid 13460] [client 34.158.8.186:56082] [client 34.158.8.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.158.8.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aftV1wCyfZallDmsQrejaAAAAU8"]
[Wed May 06 22:53:12.695488 2026] [:error] [pid 9664:tid 9783] [client 34.158.8.186:57443] [client 34.158.8.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.158.8.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aftV2AH4OZbrg1SjsBNXtwAAAJU"]
[Wed May 06 22:53:13.968038 2026] [:error] [pid 557:tid 559] [client 34.158.8.186:54461] [client 34.158.8.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.158.8.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aftV2TZjFR8Vd8ce80A1NwAAAkA"]
[Wed May 06 22:53:15.371834 2026] [:error] [pid 9664:tid 9775] [client 34.158.8.186:61689] [client 34.158.8.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.158.8.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aftV2wH4OZbrg1SjsBNXuwAAAI0"]
[Wed May 06 22:53:15.375868 2026] [:error] [pid 9664:tid 9775] [client 34.158.8.186:61689] [client 34.158.8.186] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/usr/local/apache/modsecurity-cwaf/rules/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 34.158.8.186 (+1 hits since last alert)|expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aftV2wH4OZbrg1SjsBNXuwAAAI0"]
[Wed May 06 23:17:14.013078 2026] [:error] [pid 9664:tid 9763] [client 43.130.67.33:33408] [client 43.130.67.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aftbegH4OZbrg1SjsBNbNgAAAIE"]
[Wed May 06 23:44:01.484148 2026] [:error] [pid 9653:tid 9720] [client 167.71.104.22:57693] [client 167.71.104.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.104.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "afthwahJ49Xc4dqq0B5GdAAAABY"]
[Wed May 06 23:55:50.356500 2026] [:error] [pid 9659:tid 9752] [client 167.71.104.22:65261] [client 167.71.104.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.104.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aftkhvwJnWjd8JHpBtum-wAAANI"]
[Thu May 07 00:06:54.705545 2026] [:error] [pid 9653:tid 9706] [client 167.71.104.22:53778] [client 167.71.104.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.104.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aftnHqhJ49Xc4dqq0B5MowAAAAg"]
[Thu May 07 00:18:13.679847 2026] [:error] [pid 63810:tid 63830] [client 167.71.104.22:55998] [client 167.71.104.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.104.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aftpxXpnbsN9Zf6i5IFKsAAAAZA"]
[Thu May 07 00:30:02.396887 2026] [:error] [pid 9664:tid 9763] [client 167.71.104.22:52540] [client 167.71.104.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.104.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aftsigH4OZbrg1SjsBNocAAAAIE"]
[Thu May 07 00:41:48.231790 2026] [:error] [pid 9653:tid 9698] [client 167.71.104.22:52692] [client 167.71.104.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.104.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aftvTKhJ49Xc4dqq0B5ciQAAAAA"]
[Thu May 07 00:53:33.258554 2026] [:error] [pid 63810:tid 63823] [client 167.71.104.22:63401] [client 167.71.104.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.104.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aftyDXpnbsN9Zf6i5IFOPAAAAYk"]
[Thu May 07 01:18:29.702691 2026] [:error] [pid 9653:tid 9698] [client 35.223.16.208:59663] [client 35.223.16.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.223.16.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aft35ahJ49Xc4dqq0B5rQQAAAAA"]
[Thu May 07 01:18:31.879326 2026] [:error] [pid 9653:tid 9714] [client 35.223.16.208:59663] [client 35.223.16.208] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aft356hJ49Xc4dqq0B5rSgAAABA"]
[Thu May 07 01:18:32.105869 2026] [:error] [pid 9653:tid 9712] [client 35.223.16.208:59663] [client 35.223.16.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.223.16.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aft36KhJ49Xc4dqq0B5rSwAAAA4"]
[Thu May 07 01:20:45.084750 2026] [:error] [pid 482:tid 493] [client 43.157.188.74:47232] [client 43.157.188.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aft4bcxs8HOc_nWgOW6YsAAAAck"]
[Thu May 07 01:32:53.602461 2026] [:error] [pid 9659:tid 9748] [client 34.61.128.38:55561] [client 34.61.128.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.61.128.38, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aft7RfwJnWjd8JHpBtu1kQAAAM4"]
[Thu May 07 01:32:55.651793 2026] [:error] [pid 9659:tid 9735] [client 34.61.128.38:55561] [client 34.61.128.38] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aft7R_wJnWjd8JHpBtu1lwAAAME"]
[Thu May 07 01:32:55.858955 2026] [:error] [pid 9659:tid 9745] [client 34.61.128.38:55561] [client 34.61.128.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.61.128.38, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aft7R_wJnWjd8JHpBtu1mAAAAMs"]
[Thu May 07 01:42:44.466298 2026] [:error] [pid 13443:tid 13464] [client 195.140.224.132:28700] [client 195.140.224.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.140.224.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aft9lACyfZallDmsQrezNgAAAVM"]
[Thu May 07 01:42:53.979648 2026] [:error] [pid 9664:tid 9769] [client 195.140.224.132:34000] [client 195.140.224.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.140.224.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aft9nQH4OZbrg1SjsBN2LAAAAIc"]
[Thu May 07 01:43:04.270364 2026] [:error] [pid 13414:tid 13421] [client 195.140.224.132:33957] [client 195.140.224.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.140.224.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aft9qEuJQpWjVpJTu_k9RgAAAQU"]
[Thu May 07 01:43:14.436533 2026] [:error] [pid 9664:tid 9786] [client 195.140.224.132:33821] [client 195.140.224.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.140.224.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aft9sgH4OZbrg1SjsBN2QQAAAJg"]
[Thu May 07 01:43:24.850444 2026] [:error] [pid 13414:tid 13440] [client 195.140.224.132:28866] [client 195.140.224.132] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 195.140.224.132, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aft9vEuJQpWjVpJTu_k9VQAAARg"]
[Thu May 07 02:25:00.397118 2026] [:error] [pid 63810:tid 63819] [client 52.138.0.210:11911] [client 52.138.0.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "afuHfHpnbsN9Zf6i5IFV0gAAAYU"]
[Thu May 07 02:25:01.226578 2026] [:error] [pid 9664:tid 9775] [client 52.138.0.210:11929] [client 52.138.0.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "afuHfQH4OZbrg1SjsBOEcQAAAI0"]
[Thu May 07 02:25:02.084113 2026] [:error] [pid 9789:tid 9815] [client 52.138.0.210:11983] [client 52.138.0.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "afuHfj_YStPJSCHPkUXasQAAAFg"]
[Thu May 07 02:25:02.926045 2026] [:error] [pid 9664:tid 9774] [client 52.138.0.210:11918] [client 52.138.0.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "afuHfgH4OZbrg1SjsBOEeQAAAIw"]
[Thu May 07 02:43:53.652962 2026] [:error] [pid 482:tid 495] [client 197.238.119.172:60316] [client 197.238.119.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.238.119.172, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afuL6cxs8HOc_nWgOW6s3AAAAcs"]
[Thu May 07 02:44:03.898957 2026] [:error] [pid 9789:tid 9815] [client 197.238.119.172:60531] [client 197.238.119.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.238.119.172, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afuL8z_YStPJSCHPkUXfIAAAAFg"]
[Thu May 07 02:44:15.960141 2026] [:error] [pid 9653:tid 9702] [client 197.238.119.172:60757] [client 197.238.119.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.238.119.172, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afuL_6hJ49Xc4dqq0B6F8QAAAAQ"]
[Thu May 07 02:44:26.091474 2026] [:error] [pid 9659:tid 9746] [client 197.238.119.172:60940] [client 197.238.119.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.238.119.172, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afuMCvwJnWjd8JHpBtvAhAAAAMw"]
[Thu May 07 02:44:36.720847 2026] [:error] [pid 9789:tid 9792] [client 197.238.119.172:61144] [client 197.238.119.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.238.119.172, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afuMFD_YStPJSCHPkUXfQQAAAEE"]
[Thu May 07 03:03:09.655462 2026] [:error] [pid 13443:tid 13446] [client 102.170.8.151:7152] [client 102.170.8.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.170.8.151, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afuQbQCyfZallDmsQre81QAAAUE"]
[Thu May 07 03:03:35.065042 2026] [:error] [pid 482:tid 488] [client 102.170.8.151:7442] [client 102.170.8.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.170.8.151, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afuQh8xs8HOc_nWgOW6yMQAAAcQ"]
[Thu May 07 03:03:44.263338 2026] [:error] [pid 63810:tid 63824] [client 102.170.8.151:7155] [client 102.170.8.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.170.8.151, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afuQkHpnbsN9Zf6i5IFabAAAAYo"]
[Thu May 07 03:03:56.096632 2026] [:error] [pid 13414:tid 13431] [client 102.170.8.151:7123] [client 102.170.8.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.170.8.151, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afuQnEuJQpWjVpJTu_lI4gAAAQ8"]
[Thu May 07 03:04:06.825649 2026] [:error] [pid 482:tid 502] [client 102.170.8.151:7263] [client 102.170.8.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.170.8.151, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afuQpsxs8HOc_nWgOW6ycwAAAdI"]
[Thu May 07 03:39:30.442734 2026] [:error] [pid 13414:tid 13427] [client 52.138.0.210:11501] [client 52.138.0.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "afuY8kuJQpWjVpJTu_lNkgAAAQs"]
[Thu May 07 03:39:31.275544 2026] [:error] [pid 9653:tid 9712] [client 52.138.0.210:11447] [client 52.138.0.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "afuY86hJ49Xc4dqq0B6VOAAAAA4"]
[Thu May 07 03:39:32.114825 2026] [:error] [pid 9653:tid 9705] [client 52.138.0.210:11499] [client 52.138.0.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "afuY9KhJ49Xc4dqq0B6VPAAAAAc"]
[Thu May 07 03:39:32.964535 2026] [:error] [pid 13443:tid 13448] [client 52.138.0.210:11502] [client 52.138.0.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "afuY9ACyfZallDmsQrfAswAAAUM"]
[Thu May 07 04:41:28.904856 2026] [:error] [pid 29607:tid 29687] [client 20.9.85.117:35903] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "afuneKbP7TJOAh7WSUNT7wAAAJM"]
[Thu May 07 04:41:29.289868 2026] [:error] [pid 29605:tid 29636] [client 20.9.85.117:35783] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "afuneYnxrTjETioEY0TSOAAAABY"]
[Thu May 07 04:41:29.679754 2026] [:error] [pid 29710:tid 29730] [client 20.9.85.117:35887] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "afunef0atTQld9Y2ht_DKAAAANI"]
[Thu May 07 04:41:30.054128 2026] [:error] [pid 29606:tid 29653] [client 20.9.85.117:35844] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "afunehR5HjZ1PlSAiKtSfgAAAEw"]
[Thu May 07 04:41:30.503543 2026] [:error] [pid 29606:tid 29658] [client 20.9.85.117:35836] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "afunehR5HjZ1PlSAiKtSgQAAAFE"]
[Thu May 07 04:41:30.910665 2026] [:error] [pid 29710:tid 29714] [client 20.9.85.117:35776] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "afunev0atTQld9Y2ht_DLwAAAMI"]
[Thu May 07 04:41:31.329616 2026] [:error] [pid 29710:tid 29715] [client 20.9.85.117:35890] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "afune_0atTQld9Y2ht_DMwAAAMM"]
[Thu May 07 04:41:31.704918 2026] [:error] [pid 29606:tid 29657] [client 20.9.85.117:35876] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "afunexR5HjZ1PlSAiKtShQAAAFA"]
[Thu May 07 04:41:32.107527 2026] [:error] [pid 29710:tid 29725] [client 20.9.85.117:35790] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "afunfP0atTQld9Y2ht_DOQAAAM0"]
[Thu May 07 04:41:32.480976 2026] [:error] [pid 29606:tid 29664] [client 20.9.85.117:35849] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "afunfBR5HjZ1PlSAiKtShgAAAFc"]
[Thu May 07 04:41:33.331995 2026] [:error] [pid 29607:tid 29677] [client 20.9.85.117:35778] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "afunfabP7TJOAh7WSUNT9AAAAIk"]
[Thu May 07 04:41:33.780614 2026] [:error] [pid 29607:tid 29686] [client 20.9.85.117:35847] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "afunfabP7TJOAh7WSUNT-AAAAJI"]
[Thu May 07 04:41:34.170148 2026] [:error] [pid 29710:tid 29734] [client 20.9.85.117:35788] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "afunfv0atTQld9Y2ht_DSAAAANY"]
[Thu May 07 04:41:34.546053 2026] [:error] [pid 29710:tid 29716] [client 20.9.85.117:35896] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "afunfv0atTQld9Y2ht_DSwAAAMQ"]
[Thu May 07 04:41:34.919703 2026] [:error] [pid 29605:tid 29632] [client 20.9.85.117:35863] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "afunfonxrTjETioEY0TSQQAAABI"]
[Thu May 07 04:41:35.367891 2026] [:error] [pid 29710:tid 29726] [client 20.9.85.117:35803] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "afunf_0atTQld9Y2ht_DVAAAAM4"]
[Thu May 07 04:41:35.754933 2026] [:error] [pid 29607:tid 29672] [client 20.9.85.117:35854] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "afunf6bP7TJOAh7WSUNUBAAAAIQ"]
[Thu May 07 04:41:36.614763 2026] [:error] [pid 29606:tid 29647] [client 20.9.85.117:35877] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "afungBR5HjZ1PlSAiKtSigAAAEY"]
[Thu May 07 04:41:37.096484 2026] [:error] [pid 29710:tid 29724] [client 20.9.85.117:35869] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "afungf0atTQld9Y2ht_DYgAAAMw"]
[Thu May 07 04:41:37.471054 2026] [:error] [pid 29710:tid 29725] [client 20.9.85.117:35892] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "afungf0atTQld9Y2ht_DaAAAAM0"]
[Thu May 07 04:41:37.844663 2026] [:error] [pid 29605:tid 29630] [client 20.9.85.117:35868] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/revealability.php"] [unique_id "afungYnxrTjETioEY0TSQwAAABA"]
[Thu May 07 04:41:38.218949 2026] [:error] [pid 29605:tid 29620] [client 20.9.85.117:35855] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/revealability.php"] [unique_id "afungonxrTjETioEY0TSRAAAAAY"]
[Thu May 07 04:41:38.634354 2026] [:error] [pid 29710:tid 29729] [client 20.9.85.117:35787] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/revealability.php"] [unique_id "afungv0atTQld9Y2ht_DcAAAANE"]
[Thu May 07 04:41:39.006994 2026] [:error] [pid 29606:tid 29663] [client 20.9.85.117:35866] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/revealability.php"] [unique_id "afungxR5HjZ1PlSAiKtSjwAAAFY"]
[Thu May 07 04:41:39.458249 2026] [:error] [pid 29710:tid 29714] [client 20.9.85.117:35851] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "afung_0atTQld9Y2ht_DdwAAAMI"]
[Thu May 07 04:41:39.838593 2026] [:error] [pid 29710:tid 29733] [client 20.9.85.117:35893] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "afung_0atTQld9Y2ht_DfQAAANU"]
[Thu May 07 04:41:40.210721 2026] [:error] [pid 29605:tid 29614] [client 20.9.85.117:35852] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "afunhInxrTjETioEY0TSTAAAAAA"]
[Thu May 07 04:41:40.608661 2026] [:error] [pid 29606:tid 29644] [client 20.9.85.117:35846] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "afunhBR5HjZ1PlSAiKtSkQAAAEM"]
[Thu May 07 04:41:40.982963 2026] [:error] [pid 29710:tid 29713] [client 20.9.85.117:35786] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "afunhP0atTQld9Y2ht_DiAAAAME"]
[Thu May 07 04:41:41.453342 2026] [:error] [pid 29710:tid 29728] [client 20.9.85.117:35900] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "afunhf0atTQld9Y2ht_DjgAAANA"]
[Thu May 07 04:41:41.827090 2026] [:error] [pid 29606:tid 29648] [client 20.9.85.117:35841] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "afunhRR5HjZ1PlSAiKtSkwAAAEc"]
[Thu May 07 04:41:42.267631 2026] [:error] [pid 29607:tid 29673] [client 20.9.85.117:35878] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "afunhqbP7TJOAh7WSUNUGAAAAIU"]
[Thu May 07 04:41:43.741057 2026] [:error] [pid 29605:tid 29620] [client 20.9.85.117:35895] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "afunh4nxrTjETioEY0TSVAAAAAY"]
[Thu May 07 04:41:44.113676 2026] [:error] [pid 29605:tid 29616] [client 20.9.85.117:35812] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "afuniInxrTjETioEY0TSVwAAAAI"]
[Thu May 07 04:41:44.517425 2026] [:error] [pid 29605:tid 29633] [client 20.9.85.117:35858] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "afuniInxrTjETioEY0TSWgAAABM"]
[Thu May 07 04:41:44.894537 2026] [:error] [pid 29710:tid 29730] [client 20.9.85.117:35880] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "afuniP0atTQld9Y2ht_DpgAAANI"]
[Thu May 07 04:41:45.278359 2026] [:error] [pid 29710:tid 29722] [client 20.9.85.117:35881] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/forbidals.php"] [unique_id "afunif0atTQld9Y2ht_DqgAAAMo"]
[Thu May 07 04:41:45.651154 2026] [:error] [pid 29606:tid 29645] [client 20.9.85.117:35791] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/forbidals.php"] [unique_id "afuniRR5HjZ1PlSAiKtSmAAAAEQ"]
[Thu May 07 04:41:46.043175 2026] [:error] [pid 29710:tid 29726] [client 20.9.85.117:35870] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/forbidals.php"] [unique_id "afuniv0atTQld9Y2ht_DswAAAM4"]
[Thu May 07 04:41:46.419747 2026] [:error] [pid 29710:tid 29713] [client 20.9.85.117:35780] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/forbidals.php"] [unique_id "afuniv0atTQld9Y2ht_DtQAAAME"]
[Thu May 07 04:41:46.791297 2026] [:error] [pid 29710:tid 29719] [client 20.9.85.117:35782] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-firewall.php"] [unique_id "afuniv0atTQld9Y2ht_DuQAAAMc"]
[Thu May 07 04:41:47.213506 2026] [:error] [pid 29710:tid 29723] [client 20.9.85.117:35829] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-firewall.php"] [unique_id "afuni_0atTQld9Y2ht_DvwAAAMs"]
[Thu May 07 04:41:47.588760 2026] [:error] [pid 29605:tid 29636] [client 20.9.85.117:35801] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-firewall.php"] [unique_id "afuni4nxrTjETioEY0TSZQAAABY"]
[Thu May 07 04:41:47.964751 2026] [:error] [pid 29710:tid 29725] [client 20.9.85.117:35808] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-firewall.php"] [unique_id "afuni_0atTQld9Y2ht_DxwAAAM0"]
[Thu May 07 04:41:48.340667 2026] [:error] [pid 29606:tid 29643] [client 20.9.85.117:35834] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "afunjBR5HjZ1PlSAiKtSmgAAAEI"]
[Thu May 07 04:41:48.725458 2026] [:error] [pid 29606:tid 29642] [client 20.9.85.117:35522] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "afunjBR5HjZ1PlSAiKtSngAAAEE"]
[Thu May 07 04:41:49.105790 2026] [:error] [pid 29606:tid 29664] [client 20.9.85.117:35549] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "afunjRR5HjZ1PlSAiKtSoAAAAFc"]
[Thu May 07 04:41:49.478105 2026] [:error] [pid 29710:tid 29714] [client 20.9.85.117:35811] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "afunjf0atTQld9Y2ht_DzwAAAMI"]
[Thu May 07 04:41:49.880293 2026] [:error] [pid 29605:tid 29616] [client 20.9.85.117:35853] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wuasr.php"] [unique_id "afunjYnxrTjETioEY0TSaAAAAAI"]
[Thu May 07 04:41:51.309485 2026] [:error] [pid 29710:tid 29722] [client 20.9.85.117:35898] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wuasr.php"] [unique_id "afunj_0atTQld9Y2ht_D2QAAAMo"]
[Thu May 07 04:41:51.687470 2026] [:error] [pid 29606:tid 29657] [client 20.9.85.117:35830] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wuasr.php"] [unique_id "afunjxR5HjZ1PlSAiKtSpAAAAFA"]
[Thu May 07 04:41:52.071444 2026] [:error] [pid 29710:tid 29716] [client 20.9.85.117:35879] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wuasr.php"] [unique_id "afunkP0atTQld9Y2ht_D3AAAAMQ"]
[Thu May 07 04:41:52.547303 2026] [:error] [pid 29710:tid 29720] [client 20.9.85.117:35835] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1index.php"] [unique_id "afunkP0atTQld9Y2ht_D4gAAAMg"]
[Thu May 07 04:41:52.930485 2026] [:error] [pid 29606:tid 29651] [client 20.9.85.117:35889] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1index.php"] [unique_id "afunkBR5HjZ1PlSAiKtSpwAAAEo"]
[Thu May 07 04:41:53.326511 2026] [:error] [pid 29607:tid 29679] [client 20.9.85.117:35793] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1index.php"] [unique_id "afunkabP7TJOAh7WSUNUJAAAAIs"]
[Thu May 07 04:41:53.744640 2026] [:error] [pid 29605:tid 29625] [client 20.9.85.117:35536] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1index.php"] [unique_id "afunkYnxrTjETioEY0TSbgAAAAs"]
[Thu May 07 04:41:54.125677 2026] [:error] [pid 29605:tid 29632] [client 20.9.85.117:35901] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/png.php"] [unique_id "afunkonxrTjETioEY0TSbwAAABI"]
[Thu May 07 04:41:54.522561 2026] [:error] [pid 29606:tid 29643] [client 20.9.85.117:35882] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/png.php"] [unique_id "afunkhR5HjZ1PlSAiKtSrAAAAEI"]
[Thu May 07 04:41:54.897676 2026] [:error] [pid 29605:tid 29636] [client 20.9.85.117:35533] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/png.php"] [unique_id "afunkonxrTjETioEY0TScQAAABY"]
[Thu May 07 04:41:55.283501 2026] [:error] [pid 29607:tid 29681] [client 20.9.85.117:35573] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/png.php"] [unique_id "afunk6bP7TJOAh7WSUNUMQAAAI0"]
[Thu May 07 04:41:55.658741 2026] [:error] [pid 29605:tid 29626] [client 20.9.85.117:35809] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "afunk4nxrTjETioEY0TScwAAAAw"]
[Thu May 07 04:41:56.043358 2026] [:error] [pid 29605:tid 29638] [client 20.9.85.117:35826] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "afunlInxrTjETioEY0TSdgAAABg"]
[Thu May 07 04:41:56.418267 2026] [:error] [pid 29606:tid 29644] [client 20.9.85.117:35802] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "afunlBR5HjZ1PlSAiKtSsAAAAEM"]
[Thu May 07 04:41:57.879741 2026] [:error] [pid 29607:tid 29688] [client 20.9.85.117:35871] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "afunlabP7TJOAh7WSUNUOgAAAJQ"]
[Thu May 07 04:41:58.251268 2026] [:error] [pid 29605:tid 29621] [client 20.9.85.117:35810] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "afunlonxrTjETioEY0TSfQAAAAc"]
[Thu May 07 04:41:58.621412 2026] [:error] [pid 29607:tid 29677] [client 20.9.85.117:35792] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "afunlqbP7TJOAh7WSUNUPQAAAIk"]
[Thu May 07 04:41:59.097214 2026] [:error] [pid 29605:tid 29619] [client 20.9.85.117:35537] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "afunl4nxrTjETioEY0TSfwAAAAU"]
[Thu May 07 04:41:59.471590 2026] [:error] [pid 29710:tid 29721] [client 20.9.85.117:35843] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "afunl_0atTQld9Y2ht_D-gAAAMk"]
[Thu May 07 04:41:59.995723 2026] [:error] [pid 29606:tid 29649] [client 20.9.85.117:35872] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "afunlxR5HjZ1PlSAiKtSsQAAAEg"]
[Thu May 07 04:42:00.408179 2026] [:error] [pid 29605:tid 29632] [client 20.9.85.117:35520] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "afunmInxrTjETioEY0TSgAAAABI"]
[Thu May 07 04:42:00.781661 2026] [:error] [pid 29607:tid 29674] [client 20.9.85.117:35817] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "afunmKbP7TJOAh7WSUNUSQAAAIY"]
[Thu May 07 04:42:01.299768 2026] [:error] [pid 29606:tid 29642] [client 20.9.85.117:35828] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "afunmRR5HjZ1PlSAiKtStwAAAEE"]
[Thu May 07 04:42:01.673650 2026] [:error] [pid 29606:tid 29662] [client 20.9.85.117:35860] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "afunmRR5HjZ1PlSAiKtSuQAAAFU"]
[Thu May 07 04:42:02.176473 2026] [:error] [pid 29606:tid 29657] [client 20.9.85.117:35550] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "afunmhR5HjZ1PlSAiKtSuwAAAFA"]
[Thu May 07 04:42:02.577861 2026] [:error] [pid 29710:tid 29723] [client 20.9.85.117:35823] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "afunmv0atTQld9Y2ht_D_wAAAMs"]
[Thu May 07 04:42:02.958091 2026] [:error] [pid 29607:tid 29676] [client 20.9.85.117:35824] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "afunmqbP7TJOAh7WSUNUSwAAAIg"]
[Thu May 07 04:42:03.391502 2026] [:error] [pid 29605:tid 29634] [client 20.9.85.117:35894] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fun.php"] [unique_id "afunm4nxrTjETioEY0TSjQAAABQ"]
[Thu May 07 04:42:03.764114 2026] [:error] [pid 29607:tid 29668] [client 20.9.85.117:35779] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fun.php"] [unique_id "afunm6bP7TJOAh7WSUNUUQAAAIA"]
[Thu May 07 04:42:04.140444 2026] [:error] [pid 29607:tid 29687] [client 20.9.85.117:35554] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fun.php"] [unique_id "afunnKbP7TJOAh7WSUNUVQAAAJM"]
[Thu May 07 04:42:05.534738 2026] [:error] [pid 29710:tid 29719] [client 20.9.85.117:35542] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fun.php"] [unique_id "afunnf0atTQld9Y2ht_EAgAAAMc"]
[Thu May 07 04:42:05.938703 2026] [:error] [pid 29710:tid 29736] [client 20.9.85.117:35864] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afunnf0atTQld9Y2ht_EBgAAANg"]
[Thu May 07 04:42:07.320135 2026] [:error] [pid 29605:tid 29635] [client 20.9.85.117:35847] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afunn4nxrTjETioEY0TSkQAAABU"]
[Thu May 07 04:42:07.693163 2026] [:error] [pid 29605:tid 29616] [client 20.9.85.117:35891] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afunn4nxrTjETioEY0TSkgAAAAI"]
[Thu May 07 04:42:08.078112 2026] [:error] [pid 29710:tid 29724] [client 20.9.85.117:35839] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "afunoP0atTQld9Y2ht_EDgAAAMw"]
[Thu May 07 04:42:08.476509 2026] [:error] [pid 29605:tid 29628] [client 20.9.85.117:35785] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/explorer/index_.php"] [unique_id "afunoInxrTjETioEY0TSlQAAAA4"]
[Thu May 07 04:42:08.978293 2026] [:error] [pid 29605:tid 29621] [client 20.9.85.117:35899] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/explorer/index_.php"] [unique_id "afunoInxrTjETioEY0TSmAAAAAc"]
[Thu May 07 04:42:09.367672 2026] [:error] [pid 29605:tid 29618] [client 20.9.85.117:35777] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/explorer/index_.php"] [unique_id "afunoYnxrTjETioEY0TSmgAAAAQ"]
[Thu May 07 04:42:09.740799 2026] [:error] [pid 29710:tid 29734] [client 20.9.85.117:35541] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/explorer/index_.php"] [unique_id "afunof0atTQld9Y2ht_EFAAAANY"]
[Thu May 07 04:42:10.116942 2026] [:error] [pid 29607:tid 29684] [client 20.9.85.117:35883] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "afunoqbP7TJOAh7WSUNUYgAAAJA"]
[Thu May 07 04:42:10.502774 2026] [:error] [pid 29607:tid 29692] [client 20.9.85.117:35532] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "afunoqbP7TJOAh7WSUNUZQAAAJg"]
[Thu May 07 04:42:10.966647 2026] [:error] [pid 29710:tid 29719] [client 20.9.85.117:35848] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "afunov0atTQld9Y2ht_EFgAAAMc"]
[Thu May 07 04:42:11.368179 2026] [:error] [pid 29710:tid 29735] [client 20.9.85.117:35867] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "afuno_0atTQld9Y2ht_EGQAAANc"]
[Thu May 07 04:42:12.760206 2026] [:error] [pid 29607:tid 29687] [client 20.9.85.117:35857] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "afunpKbP7TJOAh7WSUNUawAAAJM"]
[Thu May 07 04:42:13.138786 2026] [:error] [pid 29710:tid 29734] [client 20.9.85.117:35796] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "afunpf0atTQld9Y2ht_EJgAAANY"]
[Thu May 07 04:42:13.536544 2026] [:error] [pid 29710:tid 29721] [client 20.9.85.117:35886] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "afunpf0atTQld9Y2ht_EKgAAAMk"]
[Thu May 07 04:42:13.912372 2026] [:error] [pid 29606:tid 29662] [client 20.9.85.117:35807] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "afunpRR5HjZ1PlSAiKtSwwAAAFU"]
[Thu May 07 04:42:14.317082 2026] [:error] [pid 29606:tid 29665] [client 20.9.85.117:35850] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "afunphR5HjZ1PlSAiKtSyAAAAFg"]
[Thu May 07 04:42:14.724858 2026] [:error] [pid 29607:tid 29679] [client 20.9.85.117:35897] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "afunpqbP7TJOAh7WSUNUbgAAAIs"]
[Thu May 07 04:42:15.102462 2026] [:error] [pid 29605:tid 29630] [client 20.9.85.117:35529] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "afunp4nxrTjETioEY0TSngAAABA"]
[Thu May 07 04:42:16.486961 2026] [:error] [pid 29605:tid 29618] [client 20.9.85.117:35820] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "afunqInxrTjETioEY0TSoQAAAAQ"]
[Thu May 07 04:42:16.859947 2026] [:error] [pid 29606:tid 29665] [client 20.9.85.117:35804] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "afunqBR5HjZ1PlSAiKtS0wAAAFg"]
[Thu May 07 04:42:17.271947 2026] [:error] [pid 29710:tid 29715] [client 20.9.85.117:35732] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "afunqf0atTQld9Y2ht_EMwAAAMM"]
[Thu May 07 04:42:17.688355 2026] [:error] [pid 29710:tid 29716] [client 20.9.85.117:35784] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "afunqf0atTQld9Y2ht_ENAAAAMQ"]
[Thu May 07 04:42:18.078138 2026] [:error] [pid 29606:tid 29649] [client 20.9.85.117:35539] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "afunqhR5HjZ1PlSAiKtS1QAAAEg"]
[Thu May 07 04:42:18.451543 2026] [:error] [pid 29606:tid 29651] [client 20.9.85.117:35789] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "afunqhR5HjZ1PlSAiKtS1gAAAEo"]
[Thu May 07 04:42:18.829914 2026] [:error] [pid 29605:tid 29635] [client 20.9.85.117:35795] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "afunqonxrTjETioEY0TSqQAAABU"]
[Thu May 07 04:42:19.208560 2026] [:error] [pid 29605:tid 29619] [client 20.9.85.117:35861] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "afunq4nxrTjETioEY0TSqwAAAAU"]
[Thu May 07 04:42:19.592326 2026] [:error] [pid 29607:tid 29684] [client 20.9.85.117:35888] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "afunq6bP7TJOAh7WSUNUeAAAAJA"]
[Thu May 07 04:42:20.005041 2026] [:error] [pid 29710:tid 29724] [client 20.9.85.117:35523] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "afunrP0atTQld9Y2ht_EOAAAAMw"]
[Thu May 07 04:42:20.402082 2026] [:error] [pid 29605:tid 29631] [client 20.9.85.117:35799] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "afunrInxrTjETioEY0TSrQAAABE"]
[Thu May 07 04:42:20.808976 2026] [:error] [pid 29710:tid 29712] [client 20.9.85.117:35569] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "afunrP0atTQld9Y2ht_EPwAAAMA"]
[Thu May 07 04:42:21.199665 2026] [:error] [pid 29605:tid 29628] [client 20.9.85.117:35543] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "afunrYnxrTjETioEY0TSrgAAAA4"]
[Thu May 07 04:42:21.575539 2026] [:error] [pid 29710:tid 29722] [client 20.9.85.117:35528] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file59.php"] [unique_id "afunrf0atTQld9Y2ht_EQQAAAMo"]
[Thu May 07 04:42:21.949554 2026] [:error] [pid 29710:tid 29727] [client 20.9.85.117:35862] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file59.php"] [unique_id "afunrf0atTQld9Y2ht_ERQAAAM8"]
[Thu May 07 04:42:22.341571 2026] [:error] [pid 29605:tid 29636] [client 20.9.85.117:35875] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file59.php"] [unique_id "afunronxrTjETioEY0TSsAAAABY"]
[Thu May 07 04:42:22.715727 2026] [:error] [pid 29710:tid 29724] [client 20.9.85.117:35545] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file59.php"] [unique_id "afunrv0atTQld9Y2ht_ESwAAAMw"]
[Thu May 07 04:42:23.189410 2026] [:error] [pid 29710:tid 29712] [client 20.9.85.117:35873] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "afunr_0atTQld9Y2ht_EUQAAAMA"]
[Thu May 07 04:42:23.571689 2026] [:error] [pid 29710:tid 29718] [client 20.9.85.117:35798] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "afunr_0atTQld9Y2ht_EUwAAAMY"]
[Thu May 07 04:42:23.950101 2026] [:error] [pid 29710:tid 29728] [client 20.9.85.117:35885] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "afunr_0atTQld9Y2ht_EVgAAANA"]
[Thu May 07 04:42:24.322529 2026] [:error] [pid 29607:tid 29671] [client 20.9.85.117:35838] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "afunsKbP7TJOAh7WSUNUhAAAAIM"]
[Thu May 07 04:42:24.696559 2026] [:error] [pid 29607:tid 29689] [client 20.9.85.117:35559] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-at.php"] [unique_id "afunsKbP7TJOAh7WSUNUhQAAAJU"]
[Thu May 07 04:42:25.079522 2026] [:error] [pid 29607:tid 29670] [client 20.9.85.117:35818] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-at.php"] [unique_id "afunsabP7TJOAh7WSUNUiAAAAII"]
[Thu May 07 04:42:25.454150 2026] [:error] [pid 29710:tid 29731] [client 20.9.85.117:35752] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-at.php"] [unique_id "afunsf0atTQld9Y2ht_EWQAAANM"]
[Thu May 07 04:42:25.899588 2026] [:error] [pid 29607:tid 29669] [client 20.9.85.117:35902] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-at.php"] [unique_id "afunsabP7TJOAh7WSUNUjgAAAIE"]
[Thu May 07 04:42:26.308877 2026] [:error] [pid 29710:tid 29730] [client 20.9.85.117:35561] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "afunsv0atTQld9Y2ht_EXAAAANI"]
[Thu May 07 04:42:26.697514 2026] [:error] [pid 29710:tid 29732] [client 20.9.85.117:35833] [client 20.9.85.117] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "afunsv0atTQld9Y2ht_EXwAAANQ"]
[Thu May 07 05:00:29.358740 2026] [:error] [pid 29605:tid 29620] [client 216.128.9.221:56080] [client 216.128.9.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.128.9.221, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afur7YnxrTjETioEY0TW_wAAAAY"]
[Thu May 07 05:00:38.716021 2026] [:error] [pid 4539:tid 4544] [client 216.128.9.221:37657] [client 216.128.9.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.128.9.221, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afur9oPEZE1565sDGnwOcgAAAQM"]
[Thu May 07 05:00:49.123683 2026] [:error] [pid 29605:tid 29624] [client 216.128.9.221:44538] [client 216.128.9.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.128.9.221, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afusAYnxrTjETioEY0TXCQAAAAo"]
[Thu May 07 05:00:59.592868 2026] [:error] [pid 4539:tid 4558] [client 216.128.9.221:14079] [client 216.128.9.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.128.9.221, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afusC4PEZE1565sDGnwOjwAAARE"]
[Thu May 07 05:01:10.066943 2026] [:error] [pid 29607:tid 29678] [client 216.128.9.221:8366] [client 216.128.9.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 216.128.9.221, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afusFqbP7TJOAh7WSUNb9wAAAIo"]
[Thu May 07 05:04:19.871955 2026] [:error] [pid 29710:tid 29722] [client 49.51.72.236:55248] [client 49.51.72.236] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afus0_0atTQld9Y2ht_PkAAAAMo"]
[Thu May 07 06:34:51.236330 2026] [:error] [pid 29607:tid 29679] [client 129.211.172.249:39910] [client 129.211.172.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afvCC6bP7TJOAh7WSUN68AAAAIs"]
[Thu May 07 07:13:41.293171 2026] [:error] [pid 4539:tid 4545] [client 43.164.197.117:33696] [client 43.164.197.117] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afvLJYPEZE1565sDGnxeOwAAAQQ"]
[Thu May 07 07:40:26.249191 2026] [:error] [pid 29606:tid 29648] [client 4.206.17.23:43995] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "afvRahR5HjZ1PlSAiKuDlgAAAEc"]
[Thu May 07 07:40:26.715990 2026] [:error] [pid 29607:tid 29672] [client 4.206.17.23:44029] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "afvRaqbP7TJOAh7WSUORBAAAAIQ"]
[Thu May 07 07:40:27.141897 2026] [:error] [pid 4539:tid 4542] [client 4.206.17.23:44004] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "afvRa4PEZE1565sDGnxuFwAAAQE"]
[Thu May 07 07:40:27.581511 2026] [:error] [pid 4539:tid 4556] [client 4.206.17.23:44019] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/elp.php"] [unique_id "afvRa4PEZE1565sDGnxuGQAAAQ8"]
[Thu May 07 07:40:27.996144 2026] [:error] [pid 29710:tid 29727] [client 4.206.17.23:43907] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-243.php"] [unique_id "afvRa_0atTQld9Y2ht8OpQAAAM8"]
[Thu May 07 07:40:28.432128 2026] [:error] [pid 29607:tid 29681] [client 4.206.17.23:43996] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-243.php"] [unique_id "afvRbKbP7TJOAh7WSUORCAAAAI0"]
[Thu May 07 07:40:28.855223 2026] [:error] [pid 29710:tid 29712] [client 4.206.17.23:43991] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-243.php"] [unique_id "afvRbP0atTQld9Y2ht8OqQAAAMA"]
[Thu May 07 07:40:29.270498 2026] [:error] [pid 29605:tid 29621] [client 4.206.17.23:44028] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zc-243.php"] [unique_id "afvRbYnxrTjETioEY0T9_AAAAAc"]
[Thu May 07 07:40:29.693141 2026] [:error] [pid 29607:tid 29675] [client 4.206.17.23:43984] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkyac.php"] [unique_id "afvRbabP7TJOAh7WSUORFgAAAIc"]
[Thu May 07 07:40:30.114490 2026] [:error] [pid 4539:tid 4541] [client 4.206.17.23:43906] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkyac.php"] [unique_id "afvRboPEZE1565sDGnxuJgAAAQA"]
[Thu May 07 07:40:30.543952 2026] [:error] [pid 29710:tid 29716] [client 4.206.17.23:43909] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkyac.php"] [unique_id "afvRbv0atTQld9Y2ht8OrAAAAMQ"]
[Thu May 07 07:40:30.957775 2026] [:error] [pid 29606:tid 29649] [client 4.206.17.23:43988] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bkyac.php"] [unique_id "afvRbhR5HjZ1PlSAiKuDmQAAAEg"]
[Thu May 07 07:40:31.390445 2026] [:error] [pid 29710:tid 29715] [client 4.206.17.23:44006] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wziar1.php"] [unique_id "afvRb_0atTQld9Y2ht8OsAAAAMM"]
[Thu May 07 07:40:31.805504 2026] [:error] [pid 29607:tid 29687] [client 4.206.17.23:43948] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wziar1.php"] [unique_id "afvRb6bP7TJOAh7WSUORGwAAAJM"]
[Thu May 07 07:40:32.218471 2026] [:error] [pid 29607:tid 29691] [client 4.206.17.23:44017] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wziar1.php"] [unique_id "afvRcKbP7TJOAh7WSUORHAAAAJc"]
[Thu May 07 07:40:32.646517 2026] [:error] [pid 4539:tid 4551] [client 4.206.17.23:43976] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wziar1.php"] [unique_id "afvRcIPEZE1565sDGnxuLgAAAQo"]
[Thu May 07 07:40:33.084805 2026] [:error] [pid 29710:tid 29712] [client 4.206.17.23:44003] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "afvRcf0atTQld9Y2ht8OtwAAAMA"]
[Thu May 07 07:40:33.495773 2026] [:error] [pid 29710:tid 29722] [client 4.206.17.23:43990] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "afvRcf0atTQld9Y2ht8OuAAAAMo"]
[Thu May 07 07:40:33.917364 2026] [:error] [pid 4539:tid 4557] [client 4.206.17.23:44016] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "afvRcYPEZE1565sDGnxuMQAAARA"]
[Thu May 07 07:40:34.344823 2026] [:error] [pid 29605:tid 29619] [client 4.206.17.23:44021] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/oLEzRVqmJJPFSucdefault.php"] [unique_id "afvRconxrTjETioEY0T-AQAAAAU"]
[Thu May 07 07:40:34.766096 2026] [:error] [pid 29606:tid 29653] [client 4.206.17.23:43910] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7logs.php"] [unique_id "afvRchR5HjZ1PlSAiKuDmgAAAEw"]
[Thu May 07 07:40:35.185823 2026] [:error] [pid 29607:tid 29679] [client 4.206.17.23:43997] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7logs.php"] [unique_id "afvRc6bP7TJOAh7WSUORIwAAAIs"]
[Thu May 07 07:40:35.603300 2026] [:error] [pid 29606:tid 29647] [client 4.206.17.23:44015] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7logs.php"] [unique_id "afvRcxR5HjZ1PlSAiKuDngAAAEY"]
[Thu May 07 07:40:36.018359 2026] [:error] [pid 29606:tid 29659] [client 4.206.17.23:43913] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7logs.php"] [unique_id "afvRdBR5HjZ1PlSAiKuDoAAAAFI"]
[Thu May 07 07:40:36.435658 2026] [:error] [pid 29710:tid 29729] [client 4.206.17.23:43905] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "afvRdP0atTQld9Y2ht8OvQAAANE"]
[Thu May 07 07:40:36.852773 2026] [:error] [pid 29710:tid 29736] [client 4.206.17.23:43994] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "afvRdP0atTQld9Y2ht8OwAAAANg"]
[Thu May 07 07:40:37.281140 2026] [:error] [pid 4539:tid 4542] [client 4.206.17.23:44000] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "afvRdYPEZE1565sDGnxuOgAAAQE"]
[Thu May 07 07:40:37.698381 2026] [:error] [pid 4539:tid 4555] [client 4.206.17.23:43985] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "afvRdYPEZE1565sDGnxuPgAAAQ4"]
[Thu May 07 07:40:38.115819 2026] [:error] [pid 4539:tid 4545] [client 4.206.17.23:43983] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "afvRdoPEZE1565sDGnxuQgAAAQQ"]
[Thu May 07 07:40:38.534848 2026] [:error] [pid 29605:tid 29634] [client 4.206.17.23:44013] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "afvRdonxrTjETioEY0T-BgAAABQ"]
[Thu May 07 07:40:38.956321 2026] [:error] [pid 4539:tid 4550] [client 4.206.17.23:43972] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "afvRdoPEZE1565sDGnxuSgAAAQk"]
[Thu May 07 07:40:39.376990 2026] [:error] [pid 29607:tid 29677] [client 4.206.17.23:43922] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "afvRd6bP7TJOAh7WSUORKAAAAIk"]
[Thu May 07 07:40:39.797151 2026] [:error] [pid 29710:tid 29722] [client 4.206.17.23:43974] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctex1.php"] [unique_id "afvRd_0atTQld9Y2ht8OwwAAAMo"]
[Thu May 07 07:40:40.226544 2026] [:error] [pid 4539:tid 4557] [client 4.206.17.23:43912] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctex1.php"] [unique_id "afvReIPEZE1565sDGnxuVQAAARA"]
[Thu May 07 07:40:40.646774 2026] [:error] [pid 29710:tid 29730] [client 4.206.17.23:43924] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctex1.php"] [unique_id "afvReP0atTQld9Y2ht8OxAAAANI"]
[Thu May 07 07:40:41.104758 2026] [:error] [pid 29605:tid 29622] [client 4.206.17.23:43956] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ctex1.php"] [unique_id "afvReYnxrTjETioEY0T-BwAAAAg"]
[Thu May 07 07:40:41.525789 2026] [:error] [pid 29605:tid 29629] [client 4.206.17.23:43919] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lb.php"] [unique_id "afvReYnxrTjETioEY0T-CQAAAA8"]
[Thu May 07 07:40:41.952966 2026] [:error] [pid 29607:tid 29679] [client 4.206.17.23:44031] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lb.php"] [unique_id "afvReabP7TJOAh7WSUORLwAAAIs"]
[Thu May 07 07:40:42.373945 2026] [:error] [pid 29607:tid 29672] [client 4.206.17.23:44005] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lb.php"] [unique_id "afvReqbP7TJOAh7WSUORMgAAAIQ"]
[Thu May 07 07:40:42.786577 2026] [:error] [pid 4539:tid 4564] [client 4.206.17.23:43915] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lb.php"] [unique_id "afvReoPEZE1565sDGnxuXwAAARc"]
[Thu May 07 07:40:43.256981 2026] [:error] [pid 4539:tid 4554] [client 4.206.17.23:43979] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "afvRe4PEZE1565sDGnxuYAAAAQ0"]
[Thu May 07 07:40:43.697414 2026] [:error] [pid 29605:tid 29633] [client 4.206.17.23:43929] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "afvRe4nxrTjETioEY0T-CgAAABM"]
[Thu May 07 07:40:44.133400 2026] [:error] [pid 4539:tid 4548] [client 4.206.17.23:43981] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "afvRfIPEZE1565sDGnxuZwAAAQc"]
[Thu May 07 07:40:44.550369 2026] [:error] [pid 4539:tid 4549] [client 4.206.17.23:44030] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "afvRfIPEZE1565sDGnxuagAAAQg"]
[Thu May 07 07:40:44.966398 2026] [:error] [pid 4539:tid 4545] [client 4.206.17.23:43998] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "afvRfIPEZE1565sDGnxubAAAAQQ"]
[Thu May 07 07:40:45.385930 2026] [:error] [pid 4539:tid 4552] [client 4.206.17.23:43856] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "afvRfYPEZE1565sDGnxucAAAAQs"]
[Thu May 07 07:40:45.796562 2026] [:error] [pid 4539:tid 4564] [client 4.206.17.23:44027] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "afvRfYPEZE1565sDGnxucwAAARc"]
[Thu May 07 07:40:46.210851 2026] [:error] [pid 29710:tid 29714] [client 4.206.17.23:43921] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mh.php"] [unique_id "afvRfv0atTQld9Y2ht8OxgAAAMI"]
[Thu May 07 07:40:46.632046 2026] [:error] [pid 29710:tid 29721] [client 4.206.17.23:43944] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "afvRfv0atTQld9Y2ht8OxwAAAMk"]
[Thu May 07 07:40:47.050942 2026] [:error] [pid 29607:tid 29677] [client 4.206.17.23:43942] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "afvRf6bP7TJOAh7WSUOROAAAAIk"]
[Thu May 07 07:40:47.476804 2026] [:error] [pid 4539:tid 4545] [client 4.206.17.23:43986] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "afvRf4PEZE1565sDGnxuegAAAQQ"]
[Thu May 07 07:40:47.900997 2026] [:error] [pid 29710:tid 29717] [client 4.206.17.23:44020] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "afvRf_0atTQld9Y2ht8O0AAAAMU"]
[Thu May 07 07:40:48.327178 2026] [:error] [pid 4539:tid 4562] [client 4.206.17.23:43846] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/auth.php"] [unique_id "afvRgIPEZE1565sDGnxufgAAARU"]
[Thu May 07 07:40:48.742721 2026] [:error] [pid 4539:tid 4564] [client 4.206.17.23:44001] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/auth.php"] [unique_id "afvRgIPEZE1565sDGnxuggAAARc"]
[Thu May 07 07:40:49.196096 2026] [:error] [pid 29607:tid 29675] [client 4.206.17.23:43917] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/auth.php"] [unique_id "afvRgabP7TJOAh7WSUOROwAAAIc"]
[Thu May 07 07:40:49.661448 2026] [:error] [pid 29605:tid 29630] [client 4.206.17.23:44024] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/auth.php"] [unique_id "afvRgYnxrTjETioEY0T-DwAAABA"]
[Thu May 07 07:40:50.087917 2026] [:error] [pid 4539:tid 4563] [client 4.206.17.23:43999] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ortasekerli1.php"] [unique_id "afvRgoPEZE1565sDGnxuiAAAARY"]
[Thu May 07 07:40:50.517058 2026] [:error] [pid 4539:tid 4548] [client 4.206.17.23:44002] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ortasekerli1.php"] [unique_id "afvRgoPEZE1565sDGnxuiQAAAQc"]
[Thu May 07 07:40:50.947386 2026] [:error] [pid 4539:tid 4550] [client 4.206.17.23:43959] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ortasekerli1.php"] [unique_id "afvRgoPEZE1565sDGnxuiwAAAQk"]
[Thu May 07 07:40:51.384964 2026] [:error] [pid 29607:tid 29687] [client 4.206.17.23:43932] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ortasekerli1.php"] [unique_id "afvRg6bP7TJOAh7WSUORQAAAAJM"]
[Thu May 07 07:40:51.853101 2026] [:error] [pid 29710:tid 29713] [client 4.206.17.23:43982] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "afvRg_0atTQld9Y2ht8O0QAAAME"]
[Thu May 07 07:40:52.287596 2026] [:error] [pid 4539:tid 4552] [client 4.206.17.23:43971] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "afvRhIPEZE1565sDGnxukgAAAQs"]
[Thu May 07 07:40:52.747341 2026] [:error] [pid 29710:tid 29730] [client 4.206.17.23:43970] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "afvRhP0atTQld9Y2ht8O0wAAANI"]
[Thu May 07 07:40:53.191187 2026] [:error] [pid 29710:tid 29726] [client 4.206.17.23:43925] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "afvRhf0atTQld9Y2ht8O1QAAAM4"]
[Thu May 07 07:40:53.695292 2026] [:error] [pid 4539:tid 4543] [client 4.206.17.23:44023] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-png.php"] [unique_id "afvRhYPEZE1565sDGnxumQAAAQI"]
[Thu May 07 07:40:54.126980 2026] [:error] [pid 4539:tid 4558] [client 4.206.17.23:43935] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-png.php"] [unique_id "afvRhoPEZE1565sDGnxunQAAARE"]
[Thu May 07 07:40:54.574567 2026] [:error] [pid 29606:tid 29643] [client 4.206.17.23:43918] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-png.php"] [unique_id "afvRhhR5HjZ1PlSAiKuDqwAAAEI"]
[Thu May 07 07:40:55.030792 2026] [:error] [pid 29606:tid 29650] [client 4.206.17.23:44018] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-png.php"] [unique_id "afvRhxR5HjZ1PlSAiKuDrQAAAEk"]
[Thu May 07 07:40:55.459373 2026] [:error] [pid 29606:tid 29664] [client 4.206.17.23:43938] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "afvRhxR5HjZ1PlSAiKuDrwAAAFc"]
[Thu May 07 07:40:55.909062 2026] [:error] [pid 29710:tid 29736] [client 4.206.17.23:43920] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "afvRh_0atTQld9Y2ht8O1wAAANg"]
[Thu May 07 07:40:56.324148 2026] [:error] [pid 29606:tid 29641] [client 4.206.17.23:43911] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "afvRiBR5HjZ1PlSAiKuDswAAAEA"]
[Thu May 07 07:40:56.782733 2026] [:error] [pid 4539:tid 4542] [client 4.206.17.23:43980] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "afvRiIPEZE1565sDGnxuoQAAAQE"]
[Thu May 07 07:40:57.210762 2026] [:error] [pid 29606:tid 29649] [client 4.206.17.23:44016] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "afvRiRR5HjZ1PlSAiKuDuAAAAEg"]
[Thu May 07 07:40:57.627880 2026] [:error] [pid 29710:tid 29717] [client 4.206.17.23:43927] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "afvRif0atTQld9Y2ht8O2gAAAMU"]
[Thu May 07 07:40:58.051570 2026] [:error] [pid 29710:tid 29734] [client 4.206.17.23:44014] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "afvRiv0atTQld9Y2ht8O3QAAANY"]
[Thu May 07 07:40:58.476987 2026] [:error] [pid 29607:tid 29690] [client 4.206.17.23:43949] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "afvRiqbP7TJOAh7WSUORSgAAAJY"]
[Thu May 07 07:40:58.891835 2026] [:error] [pid 29607:tid 29683] [client 4.206.17.23:44007] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "afvRiqbP7TJOAh7WSUORSwAAAI8"]
[Thu May 07 07:40:59.311042 2026] [:error] [pid 29607:tid 29691] [client 4.206.17.23:43963] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "afvRi6bP7TJOAh7WSUORTgAAAJc"]
[Thu May 07 07:40:59.733342 2026] [:error] [pid 29606:tid 29647] [client 4.206.17.23:43850] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "afvRixR5HjZ1PlSAiKuDuwAAAEY"]
[Thu May 07 07:41:00.156629 2026] [:error] [pid 29606:tid 29664] [client 4.206.17.23:43939] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "afvRjBR5HjZ1PlSAiKuDvQAAAFc"]
[Thu May 07 07:41:00.570860 2026] [:error] [pid 29606:tid 29662] [client 4.206.17.23:43868] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bfil.php"] [unique_id "afvRjBR5HjZ1PlSAiKuDvwAAAFU"]
[Thu May 07 07:41:00.997768 2026] [:error] [pid 29710:tid 29714] [client 4.206.17.23:43945] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bfil.php"] [unique_id "afvRjP0atTQld9Y2ht8O5AAAAMI"]
[Thu May 07 07:41:01.418169 2026] [:error] [pid 29710:tid 29721] [client 4.206.17.23:43904] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bfil.php"] [unique_id "afvRjf0atTQld9Y2ht8O5gAAAMk"]
[Thu May 07 07:41:01.839984 2026] [:error] [pid 4539:tid 4552] [client 4.206.17.23:43973] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bfil.php"] [unique_id "afvRjYPEZE1565sDGnxuqgAAAQs"]
[Thu May 07 07:41:02.265506 2026] [:error] [pid 29710:tid 29716] [client 4.206.17.23:43993] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abrand.php"] [unique_id "afvRjv0atTQld9Y2ht8O6AAAAMQ"]
[Thu May 07 07:41:02.682428 2026] [:error] [pid 29607:tid 29671] [client 4.206.17.23:44026] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abrand.php"] [unique_id "afvRjqbP7TJOAh7WSUORVwAAAIM"]
[Thu May 07 07:41:03.108058 2026] [:error] [pid 29710:tid 29735] [client 4.206.17.23:43969] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abrand.php"] [unique_id "afvRj_0atTQld9Y2ht8O7AAAANc"]
[Thu May 07 07:41:03.529147 2026] [:error] [pid 29710:tid 29734] [client 4.206.17.23:43923] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/abrand.php"] [unique_id "afvRj_0atTQld9Y2ht8O7gAAANY"]
[Thu May 07 07:41:03.954369 2026] [:error] [pid 29710:tid 29719] [client 4.206.17.23:43855] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "afvRj_0atTQld9Y2ht8O8QAAAMc"]
[Thu May 07 07:41:04.396980 2026] [:error] [pid 29605:tid 29635] [client 4.206.17.23:43860] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "afvRkInxrTjETioEY0T-FQAAABU"]
[Thu May 07 07:41:04.814000 2026] [:error] [pid 29606:tid 29658] [client 4.206.17.23:43870] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "afvRkBR5HjZ1PlSAiKuDwwAAAFE"]
[Thu May 07 07:41:05.228689 2026] [:error] [pid 29605:tid 29624] [client 4.206.17.23:43853] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amax.php"] [unique_id "afvRkYnxrTjETioEY0T-GAAAAAo"]
[Thu May 07 07:41:05.646201 2026] [:error] [pid 29710:tid 29731] [client 4.206.17.23:43930] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amwxl.php"] [unique_id "afvRkf0atTQld9Y2ht8O9AAAANM"]
[Thu May 07 07:41:06.059546 2026] [:error] [pid 29605:tid 29623] [client 4.206.17.23:43958] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amwxl.php"] [unique_id "afvRkonxrTjETioEY0T-GQAAAAk"]
[Thu May 07 07:41:06.474886 2026] [:error] [pid 29605:tid 29625] [client 4.206.17.23:43851] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amwxl.php"] [unique_id "afvRkonxrTjETioEY0T-GgAAAAs"]
[Thu May 07 07:41:06.889622 2026] [:error] [pid 29607:tid 29672] [client 4.206.17.23:43957] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amwxl.php"] [unique_id "afvRkqbP7TJOAh7WSUORXQAAAIQ"]
[Thu May 07 07:41:07.310416 2026] [:error] [pid 4539:tid 4564] [client 4.206.17.23:44010] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "afvRk4PEZE1565sDGnxusAAAARc"]
[Thu May 07 07:41:07.727359 2026] [:error] [pid 29710:tid 29716] [client 4.206.17.23:43864] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "afvRk_0atTQld9Y2ht8O9gAAAMQ"]
[Thu May 07 07:41:08.156253 2026] [:error] [pid 29710:tid 29736] [client 4.206.17.23:43894] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "afvRlP0atTQld9Y2ht8O9wAAANg"]
[Thu May 07 07:41:08.599370 2026] [:error] [pid 4539:tid 4550] [client 4.206.17.23:44012] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "afvRlIPEZE1565sDGnxutgAAAQk"]
[Thu May 07 07:41:09.022585 2026] [:error] [pid 4539:tid 4541] [client 4.206.17.23:43897] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/userfuns.php"] [unique_id "afvRlYPEZE1565sDGnxuuwAAAQA"]
[Thu May 07 07:41:09.449636 2026] [:error] [pid 29710:tid 29720] [client 4.206.17.23:43786] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/userfuns.php"] [unique_id "afvRlf0atTQld9Y2ht8O-AAAAMg"]
[Thu May 07 07:41:09.878540 2026] [:error] [pid 29710:tid 29732] [client 4.206.17.23:43869] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/userfuns.php"] [unique_id "afvRlf0atTQld9Y2ht8O-QAAANQ"]
[Thu May 07 07:41:10.296512 2026] [:error] [pid 4539:tid 4546] [client 4.206.17.23:43791] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/userfuns.php"] [unique_id "afvRloPEZE1565sDGnxuxgAAAQU"]
[Thu May 07 07:41:10.716226 2026] [:error] [pid 29607:tid 29692] [client 4.206.17.23:43787] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "afvRlqbP7TJOAh7WSUORZAAAAJg"]
[Thu May 07 07:41:11.150054 2026] [:error] [pid 4539:tid 4549] [client 4.206.17.23:43992] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "afvRl4PEZE1565sDGnxuzwAAAQg"]
[Thu May 07 07:41:11.586321 2026] [:error] [pid 4539:tid 4558] [client 4.206.17.23:43916] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "afvRl4PEZE1565sDGnxu1AAAARE"]
[Thu May 07 07:41:12.020195 2026] [:error] [pid 29605:tid 29628] [client 4.206.17.23:43889] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/menu.php"] [unique_id "afvRmInxrTjETioEY0T-HQAAAA4"]
[Thu May 07 07:41:12.462440 2026] [:error] [pid 4539:tid 4560] [client 4.206.17.23:43847] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "afvRmIPEZE1565sDGnxu2wAAARM"]
[Thu May 07 07:41:12.913105 2026] [:error] [pid 4539:tid 4561] [client 4.206.17.23:43953] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "afvRmIPEZE1565sDGnxu4QAAARQ"]
[Thu May 07 07:41:13.343764 2026] [:error] [pid 4539:tid 4545] [client 4.206.17.23:43943] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "afvRmYPEZE1565sDGnxu5AAAAQQ"]
[Thu May 07 07:41:13.776062 2026] [:error] [pid 29605:tid 29618] [client 4.206.17.23:43955] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "afvRmYnxrTjETioEY0T-IAAAAAQ"]
[Thu May 07 07:41:14.200087 2026] [:error] [pid 29605:tid 29634] [client 4.206.17.23:43842] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/saorix1.php"] [unique_id "afvRmonxrTjETioEY0T-IQAAABQ"]
[Thu May 07 07:41:14.618185 2026] [:error] [pid 4539:tid 4552] [client 4.206.17.23:43898] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/saorix1.php"] [unique_id "afvRmoPEZE1565sDGnxu7QAAAQs"]
[Thu May 07 07:41:15.055004 2026] [:error] [pid 4539:tid 4549] [client 4.206.17.23:43776] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/saorix1.php"] [unique_id "afvRm4PEZE1565sDGnxu9QAAAQg"]
[Thu May 07 07:41:15.485547 2026] [:error] [pid 29605:tid 29622] [client 4.206.17.23:43848] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/saorix1.php"] [unique_id "afvRm4nxrTjETioEY0T-IwAAAAg"]
[Thu May 07 07:41:15.912060 2026] [:error] [pid 29710:tid 29715] [client 4.206.17.23:43793] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "afvRm_0atTQld9Y2ht8O_gAAAMM"]
[Thu May 07 07:41:16.328544 2026] [:error] [pid 4539:tid 4542] [client 4.206.17.23:43975] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "afvRnIPEZE1565sDGnxu_gAAAQE"]
[Thu May 07 07:41:16.773644 2026] [:error] [pid 29710:tid 29718] [client 4.206.17.23:43877] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "afvRnP0atTQld9Y2ht8PBgAAAMY"]
[Thu May 07 07:41:17.196349 2026] [:error] [pid 4539:tid 4541] [client 4.206.17.23:43931] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "afvRnYPEZE1565sDGnxvBQAAAQA"]
[Thu May 07 07:41:17.614889 2026] [:error] [pid 4539:tid 4556] [client 4.206.17.23:43951] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rip.php"] [unique_id "afvRnYPEZE1565sDGnxvCQAAAQ8"]
[Thu May 07 07:41:18.029703 2026] [:error] [pid 4539:tid 4543] [client 4.206.17.23:43861] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rip.php"] [unique_id "afvRnoPEZE1565sDGnxvDgAAAQI"]
[Thu May 07 07:41:18.454734 2026] [:error] [pid 29710:tid 29713] [client 4.206.17.23:43781] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rip.php"] [unique_id "afvRnv0atTQld9Y2ht8PDgAAAME"]
[Thu May 07 07:41:18.870562 2026] [:error] [pid 29710:tid 29732] [client 4.206.17.23:43987] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rip.php"] [unique_id "afvRnv0atTQld9Y2ht8PDwAAANQ"]
[Thu May 07 07:41:19.319363 2026] [:error] [pid 29607:tid 29670] [client 4.206.17.23:44025] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "afvRn6bP7TJOAh7WSUORZwAAAII"]
[Thu May 07 07:41:19.779609 2026] [:error] [pid 4539:tid 4547] [client 4.206.17.23:43933] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "afvRn4PEZE1565sDGnxvIwAAAQY"]
[Thu May 07 07:41:20.225924 2026] [:error] [pid 4539:tid 4559] [client 4.206.17.23:43960] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "afvRoIPEZE1565sDGnxvLQAAARI"]
[Thu May 07 07:41:20.653038 2026] [:error] [pid 4539:tid 4554] [client 4.206.17.23:43940] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gptsh.php"] [unique_id "afvRoIPEZE1565sDGnxvMQAAAQ0"]
[Thu May 07 07:41:21.067872 2026] [:error] [pid 29605:tid 29636] [client 4.206.17.23:43967] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "afvRoYnxrTjETioEY0T-JQAAABY"]
[Thu May 07 07:41:21.487752 2026] [:error] [pid 4539:tid 4546] [client 4.206.17.23:43914] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "afvRoYPEZE1565sDGnxvPgAAAQU"]
[Thu May 07 07:41:21.903569 2026] [:error] [pid 29606:tid 29645] [client 4.206.17.23:43887] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "afvRoRR5HjZ1PlSAiKuDyAAAAEQ"]
[Thu May 07 07:41:22.354123 2026] [:error] [pid 4539:tid 4543] [client 4.206.17.23:43962] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/0x.php"] [unique_id "afvRooPEZE1565sDGnxvSgAAAQI"]
[Thu May 07 07:41:22.771382 2026] [:error] [pid 29607:tid 29678] [client 4.206.17.23:43928] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "afvRoqbP7TJOAh7WSUORbAAAAIo"]
[Thu May 07 07:41:23.200565 2026] [:error] [pid 29607:tid 29687] [client 4.206.17.23:43823] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "afvRo6bP7TJOAh7WSUORbwAAAJM"]
[Thu May 07 07:41:23.637163 2026] [:error] [pid 29605:tid 29614] [client 4.206.17.23:44008] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "afvRo4nxrTjETioEY0T-JwAAAAA"]
[Thu May 07 07:41:24.058144 2026] [:error] [pid 29605:tid 29635] [client 4.206.17.23:43807] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "afvRpInxrTjETioEY0T-KAAAABU"]
[Thu May 07 07:41:24.511347 2026] [:error] [pid 4539:tid 4560] [client 4.206.17.23:43989] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "afvRpIPEZE1565sDGnxvYwAAARM"]
[Thu May 07 07:41:24.934633 2026] [:error] [pid 29710:tid 29724] [client 4.206.17.23:43901] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "afvRpP0atTQld9Y2ht8PFwAAAMw"]
[Thu May 07 07:41:37.261965 2026] [:error] [pid 29710:tid 29712] [client 4.206.17.23:43954] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file61.php"] [unique_id "afvRsf0atTQld9Y2ht8PTAAAAMA"]
[Thu May 07 07:41:37.700197 2026] [:error] [pid 29710:tid 29721] [client 4.206.17.23:43926] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file61.php"] [unique_id "afvRsf0atTQld9Y2ht8PTgAAAMk"]
[Thu May 07 07:41:38.138866 2026] [:error] [pid 29710:tid 29731] [client 4.206.17.23:43874] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file61.php"] [unique_id "afvRsv0atTQld9Y2ht8PUAAAANM"]
[Thu May 07 07:41:38.578347 2026] [:error] [pid 29710:tid 29712] [client 4.206.17.23:43968] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file61.php"] [unique_id "afvRsv0atTQld9Y2ht8PVQAAAMA"]
[Thu May 07 07:41:39.003095 2026] [:error] [pid 29605:tid 29637] [client 4.206.17.23:43908] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "afvRs4nxrTjETioEY0T-KgAAABc"]
[Thu May 07 07:41:39.422165 2026] [:error] [pid 29710:tid 29721] [client 4.206.17.23:43803] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "afvRs_0atTQld9Y2ht8PWwAAAMk"]
[Thu May 07 07:41:39.859343 2026] [:error] [pid 4539:tid 4554] [client 4.206.17.23:43845] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "afvRs4PEZE1565sDGnxv2QAAAQ0"]
[Thu May 07 07:41:40.280036 2026] [:error] [pid 29710:tid 29712] [client 4.206.17.23:43890] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Cap.php"] [unique_id "afvRtP0atTQld9Y2ht8PYQAAAMA"]
[Thu May 07 07:41:40.708605 2026] [:error] [pid 4539:tid 4553] [client 4.206.17.23:43859] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "afvRtIPEZE1565sDGnxv2gAAAQw"]
[Thu May 07 07:41:41.168046 2026] [:error] [pid 4539:tid 4556] [client 4.206.17.23:43947] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "afvRtYPEZE1565sDGnxv3gAAAQ8"]
[Thu May 07 07:41:41.589966 2026] [:error] [pid 4539:tid 4562] [client 4.206.17.23:43865] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "afvRtYPEZE1565sDGnxv4AAAARU"]
[Thu May 07 07:41:42.012248 2026] [:error] [pid 4539:tid 4565] [client 4.206.17.23:43876] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tfm.php"] [unique_id "afvRtoPEZE1565sDGnxv5wAAARg"]
[Thu May 07 07:41:42.439931 2026] [:error] [pid 29607:tid 29676] [client 4.206.17.23:43867] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xper1.php"] [unique_id "afvRtqbP7TJOAh7WSUORgQAAAIg"]
[Thu May 07 07:41:42.853815 2026] [:error] [pid 29606:tid 29648] [client 4.206.17.23:43840] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xper1.php"] [unique_id "afvRthR5HjZ1PlSAiKuD0AAAAEc"]
[Thu May 07 07:41:43.270817 2026] [:error] [pid 29607:tid 29686] [client 4.206.17.23:44022] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xper1.php"] [unique_id "afvRt6bP7TJOAh7WSUORhQAAAJI"]
[Thu May 07 07:41:43.696083 2026] [:error] [pid 29605:tid 29638] [client 4.206.17.23:43846] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xper1.php"] [unique_id "afvRt4nxrTjETioEY0T-LgAAABg"]
[Thu May 07 07:41:44.118654 2026] [:error] [pid 29607:tid 29670] [client 4.206.17.23:43961] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t00l.php"] [unique_id "afvRuKbP7TJOAh7WSUORiQAAAII"]
[Thu May 07 07:41:44.551704 2026] [:error] [pid 4539:tid 4556] [client 4.206.17.23:43862] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t00l.php"] [unique_id "afvRuIPEZE1565sDGnxv7AAAAQ8"]
[Thu May 07 07:41:44.973680 2026] [:error] [pid 29607:tid 29690] [client 4.206.17.23:43885] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t00l.php"] [unique_id "afvRuKbP7TJOAh7WSUORiwAAAJY"]
[Thu May 07 07:41:45.442841 2026] [:error] [pid 29606:tid 29660] [client 4.206.17.23:43857] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t00l.php"] [unique_id "afvRuRR5HjZ1PlSAiKuD0wAAAFM"]
[Thu May 07 07:41:45.871970 2026] [:error] [pid 29607:tid 29681] [client 4.206.17.23:43886] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp1.php"] [unique_id "afvRuabP7TJOAh7WSUORjgAAAI0"]
[Thu May 07 07:41:46.292607 2026] [:error] [pid 4539:tid 4551] [client 4.206.17.23:43830] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp1.php"] [unique_id "afvRuoPEZE1565sDGnxv8AAAAQo"]
[Thu May 07 07:41:46.739418 2026] [:error] [pid 29605:tid 29622] [client 4.206.17.23:43799] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp1.php"] [unique_id "afvRuonxrTjETioEY0T-NQAAAAg"]
[Thu May 07 07:41:47.172712 2026] [:error] [pid 29605:tid 29627] [client 4.206.17.23:43966] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp1.php"] [unique_id "afvRu4nxrTjETioEY0T-NgAAAA0"]
[Thu May 07 07:41:47.597389 2026] [:error] [pid 29607:tid 29691] [client 4.206.17.23:43883] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acc.php"] [unique_id "afvRu6bP7TJOAh7WSUORkgAAAJc"]
[Thu May 07 07:41:48.056012 2026] [:error] [pid 29607:tid 29682] [client 4.206.17.23:43871] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/acc.php"] [unique_id "afvRvKbP7TJOAh7WSUORlAAAAI4"]
[Thu May 07 07:41:48.482864 2026] [:error] [pid 29606:tid 29653] [client 4.206.17.23:43977] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "afvRvBR5HjZ1PlSAiKuD1wAAAEw"]
[Thu May 07 07:41:48.907408 2026] [:error] [pid 29605:tid 29635] [client 4.206.17.23:43849] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "afvRvInxrTjETioEY0T-OgAAABU"]
[Thu May 07 07:41:49.335147 2026] [:error] [pid 4539:tid 4542] [client 4.206.17.23:43934] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "afvRvYPEZE1565sDGnxv8wAAAQE"]
[Thu May 07 07:41:49.772055 2026] [:error] [pid 29605:tid 29624] [client 4.206.17.23:43896] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "afvRvYnxrTjETioEY0T-PgAAAAo"]
[Thu May 07 07:41:50.191886 2026] [:error] [pid 29607:tid 29678] [client 4.206.17.23:43950] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xltt.php"] [unique_id "afvRvqbP7TJOAh7WSUORmAAAAIo"]
[Thu May 07 07:41:50.607913 2026] [:error] [pid 29710:tid 29714] [client 4.206.17.23:44011] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xltt.php"] [unique_id "afvRvv0atTQld9Y2ht8PfAAAAMI"]
[Thu May 07 07:41:51.063874 2026] [:error] [pid 29606:tid 29662] [client 4.206.17.23:43784] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xltt.php"] [unique_id "afvRvxR5HjZ1PlSAiKuD2gAAAFU"]
[Thu May 07 07:41:51.526492 2026] [:error] [pid 29606:tid 29650] [client 4.206.17.23:43964] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xltt.php"] [unique_id "afvRvxR5HjZ1PlSAiKuD3AAAAEk"]
[Thu May 07 07:41:51.959184 2026] [:error] [pid 29607:tid 29690] [client 4.206.17.23:43881] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/packsin1.php"] [unique_id "afvRv6bP7TJOAh7WSUORmQAAAJY"]
[Thu May 07 07:41:52.395529 2026] [:error] [pid 29607:tid 29680] [client 4.206.17.23:43806] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/packsin1.php"] [unique_id "afvRwKbP7TJOAh7WSUORmwAAAIw"]
[Thu May 07 07:41:52.847467 2026] [:error] [pid 29607:tid 29691] [client 4.206.17.23:43937] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/packsin1.php"] [unique_id "afvRwKbP7TJOAh7WSUORngAAAJc"]
[Thu May 07 07:41:53.265146 2026] [:error] [pid 29607:tid 29685] [client 4.206.17.23:43891] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/packsin1.php"] [unique_id "afvRwabP7TJOAh7WSUORoQAAAJE"]
[Thu May 07 07:41:53.700065 2026] [:error] [pid 4539:tid 4544] [client 4.206.17.23:43880] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "afvRwYPEZE1565sDGnxv-wAAAQM"]
[Thu May 07 07:41:54.162706 2026] [:error] [pid 4539:tid 4557] [client 4.206.17.23:43854] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "afvRwoPEZE1565sDGnxv_QAAARA"]
[Thu May 07 07:41:54.607412 2026] [:error] [pid 29710:tid 29720] [client 4.206.17.23:43778] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "afvRwv0atTQld9Y2ht8PggAAAMg"]
[Thu May 07 07:41:55.058787 2026] [:error] [pid 29710:tid 29727] [client 4.206.17.23:43809] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "afvRw_0atTQld9Y2ht8PhQAAAM8"]
[Thu May 07 07:41:55.486644 2026] [:error] [pid 29710:tid 29713] [client 4.206.17.23:43884] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws78.php"] [unique_id "afvRw_0atTQld9Y2ht8PhwAAAME"]
[Thu May 07 07:41:55.907185 2026] [:error] [pid 29606:tid 29654] [client 4.206.17.23:43785] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws78.php"] [unique_id "afvRwxR5HjZ1PlSAiKuD3wAAAE0"]
[Thu May 07 07:41:56.343183 2026] [:error] [pid 4539:tid 4560] [client 4.206.17.23:43788] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws78.php"] [unique_id "afvRxIPEZE1565sDGnxwBAAAARM"]
[Thu May 07 07:41:56.771709 2026] [:error] [pid 29710:tid 29714] [client 4.206.17.23:43852] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws78.php"] [unique_id "afvRxP0atTQld9Y2ht8PjQAAAMI"]
[Thu May 07 07:41:57.205411 2026] [:error] [pid 29710:tid 29718] [client 4.206.17.23:43796] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "afvRxf0atTQld9Y2ht8PkAAAAMY"]
[Thu May 07 07:41:57.643878 2026] [:error] [pid 29710:tid 29735] [client 4.206.17.23:43800] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "afvRxf0atTQld9Y2ht8PkQAAANc"]
[Thu May 07 07:41:58.083600 2026] [:error] [pid 29607:tid 29686] [client 4.206.17.23:43952] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "afvRxqbP7TJOAh7WSUORpgAAAJI"]
[Thu May 07 07:41:58.537313 2026] [:error] [pid 29606:tid 29665] [client 4.206.17.23:43724] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/motu.php"] [unique_id "afvRxhR5HjZ1PlSAiKuD4gAAAFg"]
[Thu May 07 07:41:58.966292 2026] [:error] [pid 29606:tid 29649] [client 4.206.17.23:43727] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "afvRxhR5HjZ1PlSAiKuD4wAAAEg"]
[Thu May 07 07:41:59.390975 2026] [:error] [pid 29605:tid 29628] [client 4.206.17.23:43804] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "afvRx4nxrTjETioEY0T-RwAAAA4"]
[Thu May 07 07:41:59.815708 2026] [:error] [pid 29710:tid 29712] [client 4.206.17.23:43773] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "afvRx_0atTQld9Y2ht8PmQAAAMA"]
[Thu May 07 07:42:00.230721 2026] [:error] [pid 29710:tid 29714] [client 4.206.17.23:43936] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "afvRyP0atTQld9Y2ht8PmwAAAMI"]
[Thu May 07 07:42:00.668459 2026] [:error] [pid 29607:tid 29681] [client 4.206.17.23:43808] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "afvRyKbP7TJOAh7WSUORqAAAAI0"]
[Thu May 07 07:42:01.099583 2026] [:error] [pid 29607:tid 29680] [client 4.206.17.23:43875] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "afvRyabP7TJOAh7WSUORqQAAAIw"]
[Thu May 07 07:42:01.519038 2026] [:error] [pid 29606:tid 29662] [client 4.206.17.23:43813] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "afvRyRR5HjZ1PlSAiKuD6QAAAFU"]
[Thu May 07 07:42:01.950424 2026] [:error] [pid 29607:tid 29679] [client 4.206.17.23:43812] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "afvRyabP7TJOAh7WSUORqwAAAIs"]
[Thu May 07 07:42:02.381581 2026] [:error] [pid 29710:tid 29721] [client 4.206.17.23:43882] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8573.php"] [unique_id "afvRyv0atTQld9Y2ht8PoQAAAMk"]
[Thu May 07 07:42:02.821055 2026] [:error] [pid 29607:tid 29671] [client 4.206.17.23:43878] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8573.php"] [unique_id "afvRyqbP7TJOAh7WSUORrwAAAIM"]
[Thu May 07 07:42:03.250967 2026] [:error] [pid 4539:tid 4549] [client 4.206.17.23:43873] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8573.php"] [unique_id "afvRy4PEZE1565sDGnxwEAAAAQg"]
[Thu May 07 07:42:03.670016 2026] [:error] [pid 4539:tid 4560] [client 4.206.17.23:43795] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8573.php"] [unique_id "afvRy4PEZE1565sDGnxwEQAAARM"]
[Thu May 07 07:42:04.087657 2026] [:error] [pid 29710:tid 29715] [client 4.206.17.23:43815] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "afvRzP0atTQld9Y2ht8PpgAAAMM"]
[Thu May 07 07:42:04.514404 2026] [:error] [pid 29710:tid 29729] [client 4.206.17.23:43739] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "afvRzP0atTQld9Y2ht8PqAAAANE"]
[Thu May 07 07:42:04.938048 2026] [:error] [pid 29607:tid 29686] [client 4.206.17.23:43892] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "afvRzKbP7TJOAh7WSUORsgAAAJI"]
[Thu May 07 07:42:05.368147 2026] [:error] [pid 29607:tid 29673] [client 4.206.17.23:43789] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "afvRzabP7TJOAh7WSUORswAAAIU"]
[Thu May 07 07:42:05.796255 2026] [:error] [pid 29607:tid 29675] [client 4.206.17.23:43723] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "afvRzabP7TJOAh7WSUORtgAAAIc"]
[Thu May 07 07:42:06.221186 2026] [:error] [pid 29606:tid 29660] [client 4.206.17.23:43762] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "afvRzhR5HjZ1PlSAiKuD8AAAAFM"]
[Thu May 07 07:42:06.639462 2026] [:error] [pid 29710:tid 29728] [client 4.206.17.23:43775] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "afvRzv0atTQld9Y2ht8PrgAAANA"]
[Thu May 07 07:42:07.052010 2026] [:error] [pid 29606:tid 29659] [client 4.206.17.23:43978] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/666.php"] [unique_id "afvRzxR5HjZ1PlSAiKuD8wAAAFI"]
[Thu May 07 07:42:07.472826 2026] [:error] [pid 29710:tid 29736] [client 4.206.17.23:43721] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "afvRz_0atTQld9Y2ht8PsAAAANg"]
[Thu May 07 07:42:07.901856 2026] [:error] [pid 29710:tid 29735] [client 4.206.17.23:43895] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "afvRz_0atTQld9Y2ht8PsgAAANc"]
[Thu May 07 07:42:08.314639 2026] [:error] [pid 29606:tid 29664] [client 4.206.17.23:43818] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "afvR0BR5HjZ1PlSAiKuD-AAAAFc"]
[Thu May 07 07:42:08.746591 2026] [:error] [pid 29607:tid 29691] [client 4.206.17.23:43903] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "afvR0KbP7TJOAh7WSUORugAAAJc"]
[Thu May 07 07:42:09.176637 2026] [:error] [pid 4539:tid 4550] [client 4.206.17.23:43899] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/prosellers8.php"] [unique_id "afvR0YPEZE1565sDGnxwFQAAAQk"]
[Thu May 07 07:42:09.611101 2026] [:error] [pid 29606:tid 29646] [client 4.206.17.23:44009] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/prosellers8.php"] [unique_id "afvR0RR5HjZ1PlSAiKuD-wAAAEU"]
[Thu May 07 07:42:10.043317 2026] [:error] [pid 29607:tid 29682] [client 4.206.17.23:43717] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/prosellers8.php"] [unique_id "afvR0qbP7TJOAh7WSUORvQAAAI4"]
[Thu May 07 07:42:10.511127 2026] [:error] [pid 29607:tid 29686] [client 4.206.17.23:43820] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/prosellers8.php"] [unique_id "afvR0qbP7TJOAh7WSUORvgAAAJI"]
[Thu May 07 07:42:10.960039 2026] [:error] [pid 4539:tid 4557] [client 4.206.17.23:43866] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "afvR0oPEZE1565sDGnxwFwAAARA"]
[Thu May 07 07:42:11.458218 2026] [:error] [pid 4539:tid 4545] [client 4.206.17.23:43751] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "afvR04PEZE1565sDGnxwGQAAAQQ"]
[Thu May 07 07:42:11.879696 2026] [:error] [pid 29710:tid 29722] [client 4.206.17.23:43825] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "afvR0_0atTQld9Y2ht8PvAAAAMo"]
[Thu May 07 07:42:12.326455 2026] [:error] [pid 29710:tid 29723] [client 4.206.17.23:43720] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shop.php"] [unique_id "afvR1P0atTQld9Y2ht8PvgAAAMs"]
[Thu May 07 07:42:12.746903 2026] [:error] [pid 29710:tid 29718] [client 4.206.17.23:43726] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "afvR1P0atTQld9Y2ht8PwQAAAMY"]
[Thu May 07 07:42:13.164564 2026] [:error] [pid 29710:tid 29730] [client 4.206.17.23:43946] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "afvR1f0atTQld9Y2ht8PxQAAANI"]
[Thu May 07 07:42:13.583643 2026] [:error] [pid 29710:tid 29732] [client 4.206.17.23:43794] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "afvR1f0atTQld9Y2ht8PygAAANQ"]
[Thu May 07 07:42:13.997401 2026] [:error] [pid 29605:tid 29625] [client 4.206.17.23:43827] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "afvR1YnxrTjETioEY0T-WAAAAAs"]
[Thu May 07 07:42:14.424213 2026] [:error] [pid 29606:tid 29645] [client 4.206.17.23:43826] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsjzs.php"] [unique_id "afvR1hR5HjZ1PlSAiKuD_wAAAEQ"]
[Thu May 07 07:42:14.844001 2026] [:error] [pid 29607:tid 29670] [client 4.206.17.23:43802] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsjzs.php"] [unique_id "afvR1qbP7TJOAh7WSUORxAAAAII"]
[Thu May 07 07:42:15.259844 2026] [:error] [pid 29710:tid 29717] [client 4.206.17.23:43766] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsjzs.php"] [unique_id "afvR1_0atTQld9Y2ht8P0AAAAMU"]
[Thu May 07 07:42:15.679666 2026] [:error] [pid 29605:tid 29635] [client 4.206.17.23:43844] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fsjzs.php"] [unique_id "afvR14nxrTjETioEY0T-WwAAABU"]
[Thu May 07 07:42:16.102157 2026] [:error] [pid 29605:tid 29633] [client 4.206.17.23:43858] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cwclass.php"] [unique_id "afvR2InxrTjETioEY0T-XgAAABM"]
[Thu May 07 07:42:16.529314 2026] [:error] [pid 29607:tid 29672] [client 4.206.17.23:43872] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cwclass.php"] [unique_id "afvR2KbP7TJOAh7WSUORxgAAAIQ"]
[Thu May 07 07:42:16.949940 2026] [:error] [pid 4539:tid 4560] [client 4.206.17.23:42894] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cwclass.php"] [unique_id "afvR2IPEZE1565sDGnxwHAAAARM"]
[Thu May 07 07:42:17.384703 2026] [:error] [pid 4539:tid 4553] [client 4.206.17.23:43719] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cwclass.php"] [unique_id "afvR2YPEZE1565sDGnxwHgAAAQw"]
[Thu May 07 07:42:17.815498 2026] [:error] [pid 29605:tid 29638] [client 4.206.17.23:43777] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit-tags.php"] [unique_id "afvR2YnxrTjETioEY0T-YgAAABg"]
[Thu May 07 07:42:18.235275 2026] [:error] [pid 29605:tid 29624] [client 4.206.17.23:43801] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit-tags.php"] [unique_id "afvR2onxrTjETioEY0T-YwAAAAo"]
[Thu May 07 07:42:18.655344 2026] [:error] [pid 4539:tid 4555] [client 4.206.17.23:43718] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit-tags.php"] [unique_id "afvR2oPEZE1565sDGnxwIwAAAQ4"]
[Thu May 07 07:42:19.071902 2026] [:error] [pid 29607:tid 29686] [client 4.206.17.23:43728] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit-tags.php"] [unique_id "afvR26bP7TJOAh7WSUOR1AAAAJI"]
[Thu May 07 07:42:19.504837 2026] [:error] [pid 4539:tid 4546] [client 4.206.17.23:43819] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "afvR24PEZE1565sDGnxwJgAAAQU"]
[Thu May 07 07:42:19.922032 2026] [:error] [pid 29607:tid 29672] [client 4.206.17.23:43748] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "afvR26bP7TJOAh7WSUOR2gAAAIQ"]
[Thu May 07 07:42:20.365657 2026] [:error] [pid 29607:tid 29680] [client 4.206.17.23:43754] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "afvR3KbP7TJOAh7WSUOR3AAAAIw"]
[Thu May 07 07:42:20.781957 2026] [:error] [pid 29605:tid 29636] [client 4.206.17.23:43749] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "afvR3InxrTjETioEY0T-aQAAABY"]
[Thu May 07 07:42:21.225356 2026] [:error] [pid 4539:tid 4547] [client 4.206.17.23:43863] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "afvR3YPEZE1565sDGnxwLgAAAQY"]
[Thu May 07 07:42:21.697546 2026] [:error] [pid 29605:tid 29629] [client 4.206.17.23:43732] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "afvR3YnxrTjETioEY0T-agAAAA8"]
[Thu May 07 07:42:22.115702 2026] [:error] [pid 29605:tid 29617] [client 4.206.17.23:43811] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "afvR3onxrTjETioEY0T-bQAAAAM"]
[Thu May 07 07:42:22.554013 2026] [:error] [pid 29605:tid 29621] [client 4.206.17.23:43965] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "afvR3onxrTjETioEY0T-cAAAAAc"]
[Thu May 07 07:42:22.973422 2026] [:error] [pid 29607:tid 29684] [client 4.206.17.23:43763] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "afvR3qbP7TJOAh7WSUOR3gAAAJA"]
[Thu May 07 07:42:23.400397 2026] [:error] [pid 4539:tid 4542] [client 4.206.17.23:43797] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "afvR34PEZE1565sDGnxwNQAAAQE"]
[Thu May 07 07:42:23.819805 2026] [:error] [pid 4539:tid 4543] [client 4.206.17.23:42902] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "afvR34PEZE1565sDGnxwOQAAAQI"]
[Thu May 07 07:42:24.235075 2026] [:error] [pid 4539:tid 4560] [client 4.206.17.23:43831] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "afvR4IPEZE1565sDGnxwOwAAARM"]
[Thu May 07 07:42:24.662381 2026] [:error] [pid 29606:tid 29653] [client 4.206.17.23:43790] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ai.php"] [unique_id "afvR4BR5HjZ1PlSAiKuEAwAAAEw"]
[Thu May 07 07:42:25.084113 2026] [:error] [pid 29605:tid 29615] [client 4.206.17.23:43829] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ai.php"] [unique_id "afvR4YnxrTjETioEY0T-dgAAAAE"]
[Thu May 07 07:42:25.501515 2026] [:error] [pid 4539:tid 4553] [client 4.206.17.23:43843] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ai.php"] [unique_id "afvR4YPEZE1565sDGnxwPgAAAQw"]
[Thu May 07 07:42:25.921952 2026] [:error] [pid 29710:tid 29713] [client 4.206.17.23:43841] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ai.php"] [unique_id "afvR4f0atTQld9Y2ht8P1gAAAME"]
[Thu May 07 07:42:26.337343 2026] [:error] [pid 4539:tid 4543] [client 4.206.17.23:43879] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "afvR4oPEZE1565sDGnxwRgAAAQI"]
[Thu May 07 07:42:26.777448 2026] [:error] [pid 29710:tid 29732] [client 4.206.17.23:43816] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "afvR4v0atTQld9Y2ht8P2QAAANQ"]
[Thu May 07 07:42:27.191193 2026] [:error] [pid 29710:tid 29731] [client 4.206.17.23:43765] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "afvR4_0atTQld9Y2ht8P2gAAANM"]
[Thu May 07 07:42:27.624199 2026] [:error] [pid 29710:tid 29721] [client 4.206.17.23:43834] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jga.php"] [unique_id "afvR4_0atTQld9Y2ht8P3QAAAMk"]
[Thu May 07 07:42:28.054440 2026] [:error] [pid 4539:tid 4554] [client 4.206.17.23:43774] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/term.php"] [unique_id "afvR5IPEZE1565sDGnxwTQAAAQ0"]
[Thu May 07 07:42:28.470323 2026] [:error] [pid 4539:tid 4542] [client 4.206.17.23:43902] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/term.php"] [unique_id "afvR5IPEZE1565sDGnxwTwAAAQE"]
[Thu May 07 07:42:28.885762 2026] [:error] [pid 4539:tid 4550] [client 4.206.17.23:42905] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/term.php"] [unique_id "afvR5IPEZE1565sDGnxwUgAAAQk"]
[Thu May 07 07:42:29.299327 2026] [:error] [pid 4539:tid 4562] [client 4.206.17.23:43828] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/term.php"] [unique_id "afvR5YPEZE1565sDGnxwVAAAARU"]
[Thu May 07 07:42:29.755167 2026] [:error] [pid 29607:tid 29692] [client 4.206.17.23:43821] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gk.php"] [unique_id "afvR5abP7TJOAh7WSUOR6wAAAJg"]
[Thu May 07 07:42:30.184063 2026] [:error] [pid 4539:tid 4544] [client 4.206.17.23:43741] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gk.php"] [unique_id "afvR5oPEZE1565sDGnxwVQAAAQM"]
[Thu May 07 07:42:30.608902 2026] [:error] [pid 29607:tid 29686] [client 4.206.17.23:43798] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gk.php"] [unique_id "afvR5qbP7TJOAh7WSUOR7QAAAJI"]
[Thu May 07 07:42:31.047175 2026] [:error] [pid 29710:tid 29729] [client 4.206.17.23:42891] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gk.php"] [unique_id "afvR5_0atTQld9Y2ht8P4AAAANE"]
[Thu May 07 07:42:31.545411 2026] [:error] [pid 29710:tid 29727] [client 4.206.17.23:43888] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmu.php"] [unique_id "afvR5_0atTQld9Y2ht8P4QAAAM8"]
[Thu May 07 07:42:31.996464 2026] [:error] [pid 4539:tid 4543] [client 4.206.17.23:43736] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmu.php"] [unique_id "afvR54PEZE1565sDGnxwXwAAAQI"]
[Thu May 07 07:42:32.419645 2026] [:error] [pid 29605:tid 29614] [client 4.206.17.23:43825] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmu.php"] [unique_id "afvR6InxrTjETioEY0T-eAAAAAA"]
[Thu May 07 07:42:32.842308 2026] [:error] [pid 29605:tid 29621] [client 4.206.17.23:43713] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xmu.php"] [unique_id "afvR6InxrTjETioEY0T-eQAAAAc"]
[Thu May 07 07:42:33.298480 2026] [:error] [pid 29605:tid 29632] [client 4.206.17.23:42882] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sd.php"] [unique_id "afvR6YnxrTjETioEY0T-egAAABI"]
[Thu May 07 07:42:33.724557 2026] [:error] [pid 4539:tid 4546] [client 4.206.17.23:43760] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sd.php"] [unique_id "afvR6YPEZE1565sDGnxwagAAAQU"]
[Thu May 07 07:42:34.196521 2026] [:error] [pid 29607:tid 29680] [client 4.206.17.23:43817] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sd.php"] [unique_id "afvR6qbP7TJOAh7WSUOR7wAAAIw"]
[Thu May 07 07:42:34.663567 2026] [:error] [pid 29607:tid 29681] [client 4.206.17.23:43783] [client 4.206.17.23] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sd.php"] [unique_id "afvR6qbP7TJOAh7WSUOR8AAAAI0"]
[Thu May 07 10:33:15.602663 2026] [:error] [pid 1143:tid 1157] [client 43.153.15.51:46948] [client 43.153.15.51] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afv565b7qeI8X5VYRr5LRwAAAQw"]
[Thu May 07 12:42:34.685290 2026] [:error] [pid 56065:tid 56102] [client 43.153.96.233:60394] [client 43.153.96.233] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afwYOndV4hYThdnhfxDfqQAAAIY"]
[Thu May 07 13:19:57.421842 2026] [autoindex:error] [pid 56066:tid 56146] [client 20.9.31.235:61835] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/post-comments-form/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 13:19:57.613570 2026] [autoindex:error] [pid 56066:tid 56139] [client 20.9.31.235:61835] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 13:19:58.564811 2026] [:error] [pid 56066:tid 56126] [client 20.9.31.235:61835] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/wp-info.php"] [unique_id "afwg_kYS8DGwDvklLv6-MgAAAMM"]
[Thu May 07 13:19:59.195442 2026] [:error] [pid 1143:tid 1163] [client 20.9.31.235:27317] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/wp-info.php"] [unique_id "afwg_5b7qeI8X5VYRr6MhwAAARI"]
[Thu May 07 13:20:00.826150 2026] [:error] [pid 56150:tid 56169] [client 20.9.31.235:27302] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/wp-info.php"] [unique_id "afwhANu4duXJJeTigXRJ6gAAAFE"]
[Thu May 07 13:20:03.278848 2026] [:error] [pid 56064:tid 56071] [client 20.9.31.235:32073] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/upload/wp-info.php"] [unique_id "afwhAysGkZZUEf_7QCMuhAAAAAI"]
[Thu May 07 13:20:04.510278 2026] [:error] [pid 1143:tid 1150] [client 20.9.31.235:27355] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colour.php"] [unique_id "afwhBJb7qeI8X5VYRr6MwwAAAQU"]
[Thu May 07 13:20:05.632872 2026] [:error] [pid 1143:tid 1162] [client 20.9.31.235:61916] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colour.php"] [unique_id "afwhBZb7qeI8X5VYRr6MxQAAARE"]
[Thu May 07 13:20:06.816599 2026] [:error] [pid 56066:tid 56126] [client 20.9.31.235:27348] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colour.php"] [unique_id "afwhBkYS8DGwDvklLv6-RgAAAMM"]
[Thu May 07 13:20:07.556129 2026] [:error] [pid 56150:tid 56165] [client 20.9.31.235:27336] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colour.php"] [unique_id "afwhB9u4duXJJeTigXRJ8QAAAE0"]
[Thu May 07 13:20:08.729473 2026] [:error] [pid 56056:tid 56190] [client 20.9.31.235:32040] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/half.php"] [unique_id "afwhCAMt_VAuBmZ2nR9nqgAAAVg"]
[Thu May 07 13:20:10.157941 2026] [:error] [pid 56056:tid 56179] [client 20.9.31.235:32082] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/half.php"] [unique_id "afwhCgMt_VAuBmZ2nR9nrAAAAU0"]
[Thu May 07 13:20:11.917715 2026] [:error] [pid 56056:tid 56187] [client 20.9.31.235:32121] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/half.php"] [unique_id "afwhCwMt_VAuBmZ2nR9nsgAAAVU"]
[Thu May 07 13:20:12.691033 2026] [:error] [pid 56066:tid 56123] [client 20.9.31.235:27380] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/half.php"] [unique_id "afwhDEYS8DGwDvklLv6-SAAAAMA"]
[Thu May 07 13:20:13.662589 2026] [:error] [pid 56064:tid 56087] [client 20.9.31.235:24512] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2P.php"] [unique_id "afwhDSsGkZZUEf_7QCMuhwAAABI"]
[Thu May 07 13:20:14.815989 2026] [:error] [pid 56056:tid 56186] [client 20.9.31.235:61836] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2P.php"] [unique_id "afwhDgMt_VAuBmZ2nR9nvQAAAVQ"]
[Thu May 07 13:20:17.597598 2026] [:error] [pid 56056:tid 56063] [client 20.9.31.235:61923] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2P.php"] [unique_id "afwhEQMt_VAuBmZ2nR9nygAAAUU"]
[Thu May 07 13:20:18.913848 2026] [:error] [pid 56056:tid 56182] [client 20.9.31.235:27281] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2P.php"] [unique_id "afwhEgMt_VAuBmZ2nR9nzwAAAVA"]
[Thu May 07 13:20:20.106643 2026] [:error] [pid 56065:tid 56103] [client 20.9.31.235:24530] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tires.php"] [unique_id "afwhFHdV4hYThdnhfxDkiAAAAIc"]
[Thu May 07 13:20:21.114258 2026] [:error] [pid 56150:tid 56154] [client 20.9.31.235:27268] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tires.php"] [unique_id "afwhFdu4duXJJeTigXRKAAAAAEI"]
[Thu May 07 13:20:22.305589 2026] [:error] [pid 56064:tid 56079] [client 20.9.31.235:32113] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tires.php"] [unique_id "afwhFisGkZZUEf_7QCMukQAAAAo"]
[Thu May 07 13:20:24.180534 2026] [:error] [pid 1143:tid 1152] [client 20.9.31.235:23709] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tires.php"] [unique_id "afwhGJb7qeI8X5VYRr6M2wAAAQc"]
[Thu May 07 13:20:26.065488 2026] [:error] [pid 1143:tid 1168] [client 20.9.31.235:27389] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "afwhGpb7qeI8X5VYRr6M4QAAARc"]
[Thu May 07 13:20:27.227366 2026] [:error] [pid 56065:tid 56096] [client 20.9.31.235:32002] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "afwhG3dV4hYThdnhfxDkiwAAAIA"]
[Thu May 07 13:20:27.870943 2026] [:error] [pid 56064:tid 56080] [client 20.9.31.235:27386] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "afwhGysGkZZUEf_7QCMulAAAAAs"]
[Thu May 07 13:20:29.197670 2026] [:error] [pid 56056:tid 56186] [client 20.9.31.235:27299] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "afwhHQMt_VAuBmZ2nR9n2wAAAVQ"]
[Thu May 07 13:20:30.471494 2026] [:error] [pid 56066:tid 56141] [client 20.9.31.235:32025] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "afwhHkYS8DGwDvklLv6-VQAAANI"]
[Thu May 07 13:20:31.646026 2026] [:error] [pid 56065:tid 56119] [client 20.9.31.235:61842] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "afwhH3dV4hYThdnhfxDkjgAAAJc"]
[Thu May 07 13:20:32.882085 2026] [:error] [pid 56056:tid 56058] [client 20.9.31.235:32019] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "afwhIAMt_VAuBmZ2nR9n3gAAAUA"]
[Thu May 07 13:20:33.654549 2026] [:error] [pid 56056:tid 56189] [client 20.9.31.235:27338] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "afwhIQMt_VAuBmZ2nR9n3wAAAVc"]
[Thu May 07 13:20:35.159283 2026] [:error] [pid 56056:tid 56183] [client 20.9.31.235:27313] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-block.php"] [unique_id "afwhIwMt_VAuBmZ2nR9n5gAAAVE"]
[Thu May 07 13:20:37.001050 2026] [:error] [pid 56056:tid 56062] [client 20.9.31.235:32110] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-block.php"] [unique_id "afwhJQMt_VAuBmZ2nR9n9QAAAUQ"]
[Thu May 07 13:20:38.347840 2026] [:error] [pid 1143:tid 1155] [client 20.9.31.235:32046] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-block.php"] [unique_id "afwhJpb7qeI8X5VYRr6M7AAAAQo"]
[Thu May 07 13:20:40.188149 2026] [:error] [pid 1143:tid 1164] [client 20.9.31.235:27384] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-block.php"] [unique_id "afwhKJb7qeI8X5VYRr6M9AAAARM"]
[Thu May 07 13:20:40.967535 2026] [:error] [pid 1143:tid 1146] [client 20.9.31.235:27286] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/like.php"] [unique_id "afwhKJb7qeI8X5VYRr6M-QAAAQE"]
[Thu May 07 13:20:41.546349 2026] [:error] [pid 1143:tid 1150] [client 20.9.31.235:27347] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/like.php"] [unique_id "afwhKZb7qeI8X5VYRr6M_QAAAQU"]
[Thu May 07 13:20:42.583385 2026] [:error] [pid 56064:tid 56078] [client 20.9.31.235:27350] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/like.php"] [unique_id "afwhKisGkZZUEf_7QCMumQAAAAk"]
[Thu May 07 13:20:43.092348 2026] [:error] [pid 56066:tid 56137] [client 20.9.31.235:24529] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/like.php"] [unique_id "afwhK0YS8DGwDvklLv6-WwAAAM4"]
[Thu May 07 13:20:44.426766 2026] [:error] [pid 1143:tid 1161] [client 20.9.31.235:61917] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/olik.php"] [unique_id "afwhLJb7qeI8X5VYRr6NBQAAARA"]
[Thu May 07 13:20:45.521336 2026] [:error] [pid 1143:tid 1160] [client 20.9.31.235:61896] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/olik.php"] [unique_id "afwhLZb7qeI8X5VYRr6NBgAAAQ8"]
[Thu May 07 13:20:46.934478 2026] [:error] [pid 56056:tid 56095] [client 20.9.31.235:27330] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/olik.php"] [unique_id "afwhLgMt_VAuBmZ2nR9n_wAAAUg"]
[Thu May 07 13:20:47.711630 2026] [:error] [pid 56056:tid 56179] [client 20.9.31.235:32106] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/olik.php"] [unique_id "afwhLwMt_VAuBmZ2nR9oAwAAAU0"]
[Thu May 07 13:20:48.545285 2026] [:error] [pid 1143:tid 1165] [client 20.9.31.235:27357] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/h.php"] [unique_id "afwhMJb7qeI8X5VYRr6NCgAAARQ"]
[Thu May 07 13:20:49.324289 2026] [:error] [pid 1143:tid 1161] [client 20.9.31.235:27364] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/h.php"] [unique_id "afwhMZb7qeI8X5VYRr6NDgAAARA"]
[Thu May 07 13:20:50.680207 2026] [:error] [pid 56064:tid 56088] [client 20.9.31.235:27306] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/h.php"] [unique_id "afwhMisGkZZUEf_7QCMumwAAABM"]
[Thu May 07 13:20:52.213856 2026] [:error] [pid 1143:tid 1149] [client 20.9.31.235:61883] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/h.php"] [unique_id "afwhNJb7qeI8X5VYRr6NEwAAAQQ"]
[Thu May 07 13:20:53.558078 2026] [:error] [pid 56065:tid 56112] [client 20.9.31.235:27269] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "afwhNXdV4hYThdnhfxDknQAAAJA"]
[Thu May 07 13:20:55.428085 2026] [:error] [pid 56056:tid 56063] [client 20.9.31.235:27337] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "afwhNwMt_VAuBmZ2nR9oHAAAAUU"]
[Thu May 07 13:20:56.114794 2026] [:error] [pid 1143:tid 1146] [client 20.9.31.235:32024] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kj.php"] [unique_id "afwhOJb7qeI8X5VYRr6NOQAAAQE"]
[Thu May 07 13:21:00.651116 2026] [:error] [pid 1143:tid 1155] [client 20.9.31.235:27378] [client 20.9.31.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "afwhPJb7qeI8X5VYRr6NqQAAAQo"]
[Thu May 07 13:21:06.291210 2026] [autoindex:error] [pid 56150:tid 56168] [client 20.9.31.235:32057] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 13:21:07.277779 2026] [autoindex:error] [pid 56150:tid 56174] [client 20.9.31.235:32057] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 13:21:09.561966 2026] [autoindex:error] [pid 56150:tid 56170] [client 20.9.31.235:32057] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 13:21:11.462727 2026] [:error] [pid 56150:tid 56164] [client 20.9.31.235:32057] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/crgio.php"] [unique_id "afwhR9u4duXJJeTigXRKKwAAAEw"]
[Thu May 07 13:21:13.530482 2026] [:error] [pid 56056:tid 56183] [client 20.9.31.235:61880] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/crgio.php"] [unique_id "afwhSQMt_VAuBmZ2nR9ogQAAAVE"]
[Thu May 07 13:21:14.754025 2026] [:error] [pid 56056:tid 56061] [client 20.9.31.235:61946] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/crgio.php"] [unique_id "afwhSgMt_VAuBmZ2nR9ohgAAAUM"]
[Thu May 07 13:21:16.433393 2026] [:error] [pid 56056:tid 56179] [client 20.9.31.235:61931] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/crgio.php"] [unique_id "afwhTAMt_VAuBmZ2nR9ojgAAAU0"]
[Thu May 07 13:21:17.282164 2026] [:error] [pid 56056:tid 56187] [client 20.9.31.235:24519] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geforce.php"] [unique_id "afwhTQMt_VAuBmZ2nR9olQAAAVU"]
[Thu May 07 13:21:18.019933 2026] [:error] [pid 56150:tid 56176] [client 20.9.31.235:32006] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geforce.php"] [unique_id "afwhTtu4duXJJeTigXRKMQAAAFg"]
[Thu May 07 13:21:19.386065 2026] [:error] [pid 1143:tid 1154] [client 20.9.31.235:23791] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geforce.php"] [unique_id "afwhT5b7qeI8X5VYRr6N1gAAAQk"]
[Thu May 07 13:21:20.343037 2026] [:error] [pid 1143:tid 1155] [client 20.9.31.235:27280] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/geforce.php"] [unique_id "afwhUJb7qeI8X5VYRr6N2AAAAQo"]
[Thu May 07 13:21:21.304978 2026] [:error] [pid 1143:tid 1158] [client 20.9.31.235:27298] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "afwhUZb7qeI8X5VYRr6N2gAAAQ0"]
[Thu May 07 13:21:22.544041 2026] [:error] [pid 56056:tid 56189] [client 20.9.31.235:61903] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "afwhUgMt_VAuBmZ2nR9oqAAAAVc"]
[Thu May 07 13:21:23.722781 2026] [:error] [pid 56056:tid 56095] [client 20.9.31.235:32125] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "afwhUwMt_VAuBmZ2nR9otgAAAUg"]
[Thu May 07 13:21:24.505198 2026] [:error] [pid 1143:tid 1165] [client 20.9.31.235:61947] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "afwhVJb7qeI8X5VYRr6N3gAAARQ"]
[Thu May 07 13:21:25.989393 2026] [:error] [pid 56056:tid 56189] [client 20.9.31.235:61875] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "afwhVQMt_VAuBmZ2nR9ougAAAVc"]
[Thu May 07 13:21:26.732046 2026] [:error] [pid 56056:tid 56061] [client 20.9.31.235:27284] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "afwhVgMt_VAuBmZ2nR9ovAAAAUM"]
[Thu May 07 13:21:27.440003 2026] [:error] [pid 56056:tid 56181] [client 20.9.31.235:27308] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "afwhVwMt_VAuBmZ2nR9ovgAAAU8"]
[Thu May 07 13:21:28.061438 2026] [:error] [pid 56066:tid 56141] [client 20.9.31.235:61870] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/byypas.php"] [unique_id "afwhWEYS8DGwDvklLv6-dgAAANI"]
[Thu May 07 13:21:29.045105 2026] [:error] [pid 56056:tid 56151] [client 20.9.31.235:24515] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.sghb.php"] [unique_id "afwhWQMt_VAuBmZ2nR9oxAAAAUs"]
[Thu May 07 13:21:30.300288 2026] [:error] [pid 56150:tid 56160] [client 20.9.31.235:24525] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.sghb.php"] [unique_id "afwhWtu4duXJJeTigXRKPwAAAEg"]
[Thu May 07 13:21:31.495442 2026] [:error] [pid 1143:tid 1155] [client 20.9.31.235:27272] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.sghb.php"] [unique_id "afwhW5b7qeI8X5VYRr6N5QAAAQo"]
[Thu May 07 13:21:33.026776 2026] [:error] [pid 56066:tid 56123] [client 20.9.31.235:27307] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.sghb.php"] [unique_id "afwhXUYS8DGwDvklLv6-eAAAAMA"]
[Thu May 07 13:21:34.003094 2026] [:error] [pid 56056:tid 56187] [client 20.9.31.235:24521] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoko.php"] [unique_id "afwhXgMt_VAuBmZ2nR9ozQAAAVU"]
[Thu May 07 13:21:35.147493 2026] [:error] [pid 1143:tid 1149] [client 20.9.31.235:32027] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoko.php"] [unique_id "afwhX5b7qeI8X5VYRr6N6wAAAQQ"]
[Thu May 07 13:21:36.571450 2026] [:error] [pid 56056:tid 56185] [client 20.9.31.235:24450] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoko.php"] [unique_id "afwhYAMt_VAuBmZ2nR9o0wAAAVM"]
[Thu May 07 13:21:38.227982 2026] [:error] [pid 56150:tid 56173] [client 20.9.31.235:27349] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoko.php"] [unique_id "afwhYtu4duXJJeTigXRKVAAAAFU"]
[Thu May 07 13:21:39.031970 2026] [:error] [pid 56150:tid 56166] [client 20.9.31.235:24527] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class892.php"] [unique_id "afwhY9u4duXJJeTigXRKWgAAAE4"]
[Thu May 07 13:21:39.987760 2026] [:error] [pid 1143:tid 1150] [client 20.9.31.235:27383] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class892.php"] [unique_id "afwhY5b7qeI8X5VYRr6N9QAAAQU"]
[Thu May 07 13:21:40.842375 2026] [:error] [pid 56056:tid 56060] [client 20.9.31.235:27360] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class892.php"] [unique_id "afwhZAMt_VAuBmZ2nR9o2gAAAUI"]
[Thu May 07 13:21:41.929932 2026] [:error] [pid 56150:tid 56157] [client 20.9.31.235:27367] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class892.php"] [unique_id "afwhZdu4duXJJeTigXRKYAAAAEU"]
[Thu May 07 13:21:42.905798 2026] [:error] [pid 56065:tid 56109] [client 20.9.31.235:27288] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/locales.php"] [unique_id "afwhZndV4hYThdnhfxDkuAAAAI0"]
[Thu May 07 13:21:44.484023 2026] [:error] [pid 56066:tid 56140] [client 20.9.31.235:27334] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/locales.php"] [unique_id "afwhaEYS8DGwDvklLv6-fwAAANE"]
[Thu May 07 13:21:45.947100 2026] [:error] [pid 56150:tid 56156] [client 20.9.31.235:32005] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/locales.php"] [unique_id "afwhadu4duXJJeTigXRKaQAAAEQ"]
[Thu May 07 13:21:47.164403 2026] [:error] [pid 1143:tid 1157] [client 20.9.31.235:32011] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/locales.php"] [unique_id "afwha5b7qeI8X5VYRr6OBgAAAQw"]
[Thu May 07 13:21:48.082926 2026] [:error] [pid 1143:tid 1156] [client 20.9.31.235:32055] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "afwhbJb7qeI8X5VYRr6OBwAAAQs"]
[Thu May 07 13:21:49.157910 2026] [:error] [pid 56056:tid 56178] [client 20.9.31.235:61926] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "afwhbQMt_VAuBmZ2nR9o8QAAAUw"]
[Thu May 07 13:21:50.983387 2026] [:error] [pid 1143:tid 1158] [client 20.9.31.235:27278] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "afwhbpb7qeI8X5VYRr6OFQAAAQ0"]
[Thu May 07 13:21:51.865291 2026] [:error] [pid 56064:tid 56075] [client 20.9.31.235:32052] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bgymj.php"] [unique_id "afwhbysGkZZUEf_7QCMuuAAAAAY"]
[Thu May 07 13:21:52.603490 2026] [:error] [pid 56056:tid 56185] [client 20.9.31.235:61858] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pucci.php"] [unique_id "afwhcAMt_VAuBmZ2nR9o9wAAAVM"]
[Thu May 07 13:21:53.410890 2026] [:error] [pid 1143:tid 1164] [client 20.9.31.235:61848] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pucci.php"] [unique_id "afwhcZb7qeI8X5VYRr6OHQAAARM"]
[Thu May 07 13:21:54.186481 2026] [:error] [pid 1143:tid 1157] [client 20.9.31.235:61928] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pucci.php"] [unique_id "afwhcpb7qeI8X5VYRr6OHgAAAQw"]
[Thu May 07 13:21:55.204535 2026] [:error] [pid 1143:tid 1162] [client 20.9.31.235:61854] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pucci.php"] [unique_id "afwhc5b7qeI8X5VYRr6OIwAAARE"]
[Thu May 07 13:21:56.023037 2026] [:error] [pid 1143:tid 1169] [client 20.9.31.235:24498] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/details/"] [unique_id "afwhdJb7qeI8X5VYRr6OJwAAARg"]
[Thu May 07 13:21:56.758027 2026] [:error] [pid 56066:tid 56139] [client 20.9.31.235:32030] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/details/"] [unique_id "afwhdEYS8DGwDvklLv6-lQAAANA"]
[Thu May 07 13:21:57.471929 2026] [:error] [pid 56056:tid 56184] [client 20.9.31.235:32017] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/details/"] [unique_id "afwhdQMt_VAuBmZ2nR9o_QAAAVI"]
[Thu May 07 13:21:58.612524 2026] [:error] [pid 56150:tid 56165] [client 20.9.31.235:32035] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/details/"] [unique_id "afwhdtu4duXJJeTigXRKgAAAAE0"]
[Thu May 07 13:21:59.555196 2026] [:error] [pid 1143:tid 1164] [client 20.9.31.235:15102] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.dj/index.php"] [unique_id "afwhd5b7qeI8X5VYRr6OLgAAARM"]
[Thu May 07 13:22:00.323529 2026] [:error] [pid 56066:tid 56146] [client 20.9.31.235:27264] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.dj/index.php"] [unique_id "afwheEYS8DGwDvklLv6-lwAAANc"]
[Thu May 07 13:22:01.638884 2026] [:error] [pid 56150:tid 56154] [client 20.9.31.235:32009] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.dj/index.php"] [unique_id "afwhedu4duXJJeTigXRKhQAAAEI"]
[Thu May 07 13:22:02.758039 2026] [:error] [pid 56066:tid 56136] [client 20.9.31.235:61908] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.dj/index.php"] [unique_id "afwhekYS8DGwDvklLv6-nAAAAM0"]
[Thu May 07 13:22:03.732702 2026] [:error] [pid 56150:tid 56172] [client 20.9.31.235:32036] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "afwhe9u4duXJJeTigXRKhwAAAFQ"]
[Thu May 07 13:22:04.699184 2026] [:error] [pid 1143:tid 1163] [client 20.9.31.235:32033] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "afwhfJb7qeI8X5VYRr6OOAAAARI"]
[Thu May 07 13:22:06.032443 2026] [:error] [pid 1143:tid 1155] [client 20.9.31.235:61876] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "afwhfpb7qeI8X5VYRr6OOQAAAQo"]
[Thu May 07 13:22:07.591503 2026] [:error] [pid 56065:tid 56103] [client 20.9.31.235:27324] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/audio/"] [unique_id "afwhf3dV4hYThdnhfxDkzAAAAIc"]
[Thu May 07 13:22:08.491921 2026] [:error] [pid 1143:tid 1159] [client 20.9.31.235:27331] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.tmb/"] [unique_id "afwhgJb7qeI8X5VYRr6OPAAAAQ4"]
[Thu May 07 13:22:09.510449 2026] [:error] [pid 1143:tid 1169] [client 20.9.31.235:24517] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.tmb/"] [unique_id "afwhgZb7qeI8X5VYRr6OQAAAARg"]
[Thu May 07 13:22:16.135151 2026] [autoindex:error] [pid 56065:tid 56115] [client 20.9.31.235:24509] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/themes/twentytwentyfive/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 13:22:16.334374 2026] [autoindex:error] [pid 56065:tid 56104] [client 20.9.31.235:24509] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/buttons/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 13:22:20.352099 2026] [:error] [pid 56065:tid 56106] [client 20.9.31.235:24509] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2468.php"] [unique_id "afwhjHdV4hYThdnhfxDk5QAAAIo"]
[Thu May 07 13:22:21.500163 2026] [:error] [pid 56056:tid 56178] [client 20.9.31.235:61892] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2468.php"] [unique_id "afwhjQMt_VAuBmZ2nR9pIwAAAUw"]
[Thu May 07 13:22:22.244686 2026] [:error] [pid 56056:tid 56182] [client 20.9.31.235:32120] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2468.php"] [unique_id "afwhjgMt_VAuBmZ2nR9pKQAAAVA"]
[Thu May 07 13:22:23.282477 2026] [:error] [pid 1143:tid 1168] [client 20.9.31.235:24454] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2468.php"] [unique_id "afwhj5b7qeI8X5VYRr6OTwAAARc"]
[Thu May 07 13:22:24.585352 2026] [:error] [pid 56066:tid 56123] [client 20.9.31.235:27279] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "afwhkEYS8DGwDvklLv6-pQAAAMA"]
[Thu May 07 13:22:25.462513 2026] [:error] [pid 56056:tid 56190] [client 20.9.31.235:32091] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "afwhkQMt_VAuBmZ2nR9pSQAAAVg"]
[Thu May 07 13:22:26.341135 2026] [:error] [pid 1143:tid 1153] [client 20.9.31.235:27320] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "afwhkpb7qeI8X5VYRr6OVwAAAQg"]
[Thu May 07 13:22:27.054349 2026] [:error] [pid 56056:tid 56179] [client 20.9.31.235:32071] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/index.php"] [unique_id "afwhkwMt_VAuBmZ2nR9pVAAAAU0"]
[Thu May 07 13:22:27.548594 2026] [:error] [pid 56064:tid 56082] [client 20.9.31.235:24524] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "afwhkysGkZZUEf_7QCMu3AAAAA0"]
[Thu May 07 13:22:28.302250 2026] [:error] [pid 56065:tid 56098] [client 20.9.31.235:61921] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "afwhlHdV4hYThdnhfxDk6AAAAII"]
[Thu May 07 13:22:28.919229 2026] [:error] [pid 56056:tid 56184] [client 20.9.31.235:27371] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "afwhlAMt_VAuBmZ2nR9pYQAAAVI"]
[Thu May 07 13:22:29.915913 2026] [:error] [pid 56066:tid 56130] [client 20.9.31.235:61881] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "afwhlUYS8DGwDvklLv6-qAAAAMc"]
[Thu May 07 13:22:30.963340 2026] [:error] [pid 56150:tid 56164] [client 20.9.31.235:24463] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amdin.php"] [unique_id "afwhltu4duXJJeTigXRKmQAAAEw"]
[Thu May 07 13:22:31.758601 2026] [:error] [pid 1143:tid 1168] [client 20.9.31.235:61867] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amdin.php"] [unique_id "afwhl5b7qeI8X5VYRr6OXgAAARc"]
[Thu May 07 13:22:32.618047 2026] [:error] [pid 56150:tid 56169] [client 20.9.31.235:61829] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amdin.php"] [unique_id "afwhmNu4duXJJeTigXRKngAAAFE"]
[Thu May 07 13:22:33.614359 2026] [:error] [pid 56065:tid 56119] [client 20.9.31.235:27266] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amdin.php"] [unique_id "afwhmXdV4hYThdnhfxDk8QAAAJc"]
[Thu May 07 13:22:34.215083 2026] [:error] [pid 56056:tid 56178] [client 20.9.31.235:32051] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/huya.php"] [unique_id "afwhmgMt_VAuBmZ2nR9pbgAAAUw"]
[Thu May 07 13:22:35.387217 2026] [:error] [pid 56150:tid 56176] [client 20.9.31.235:27282] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/huya.php"] [unique_id "afwhm9u4duXJJeTigXRKoAAAAFg"]
[Thu May 07 13:22:36.202351 2026] [:error] [pid 56056:tid 56188] [client 20.9.31.235:27362] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/huya.php"] [unique_id "afwhnAMt_VAuBmZ2nR9pcwAAAVY"]
[Thu May 07 13:22:36.755134 2026] [:error] [pid 56150:tid 56153] [client 20.9.31.235:27368] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/huya.php"] [unique_id "afwhnNu4duXJJeTigXRKpQAAAEE"]
[Thu May 07 13:22:37.545560 2026] [:error] [pid 1143:tid 1146] [client 20.9.31.235:15042] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/puc.php"] [unique_id "afwhnZb7qeI8X5VYRr6OYgAAAQE"]
[Thu May 07 13:22:38.120325 2026] [:error] [pid 56065:tid 56098] [client 20.9.31.235:32028] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/puc.php"] [unique_id "afwhnndV4hYThdnhfxDk9wAAAII"]
[Thu May 07 13:22:39.220466 2026] [:error] [pid 56056:tid 56182] [client 20.9.31.235:24514] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/puc.php"] [unique_id "afwhnwMt_VAuBmZ2nR9peAAAAVA"]
[Thu May 07 13:22:39.844077 2026] [:error] [pid 56056:tid 56068] [client 20.9.31.235:32044] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/puc.php"] [unique_id "afwhnwMt_VAuBmZ2nR9pegAAAUc"]
[Thu May 07 13:22:40.633562 2026] [:error] [pid 56065:tid 56120] [client 20.9.31.235:15086] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "afwhoHdV4hYThdnhfxDk-QAAAJg"]
[Thu May 07 13:22:41.397685 2026] [:error] [pid 1143:tid 1145] [client 20.9.31.235:27381] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "afwhoZb7qeI8X5VYRr6OcgAAAQA"]
[Thu May 07 13:22:42.656762 2026] [:error] [pid 56056:tid 56190] [client 20.9.31.235:27319] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "afwhogMt_VAuBmZ2nR9phQAAAVg"]
[Thu May 07 13:22:43.785041 2026] [:error] [pid 56056:tid 56062] [client 20.9.31.235:61912] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "afwhowMt_VAuBmZ2nR9piAAAAUQ"]
[Thu May 07 13:22:45.655734 2026] [:error] [pid 56056:tid 56151] [client 20.9.31.235:61834] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ewp.php"] [unique_id "afwhpQMt_VAuBmZ2nR9pkQAAAUs"]
[Thu May 07 13:22:47.030503 2026] [:error] [pid 56056:tid 56061] [client 20.9.31.235:61948] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ewp.php"] [unique_id "afwhpwMt_VAuBmZ2nR9pkgAAAUM"]
[Thu May 07 13:22:47.709791 2026] [:error] [pid 56056:tid 56122] [client 20.9.31.235:61843] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ewp.php"] [unique_id "afwhpwMt_VAuBmZ2nR9pkwAAAUk"]
[Thu May 07 13:22:49.108644 2026] [:error] [pid 56056:tid 56180] [client 20.9.31.235:61833] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ewp.php"] [unique_id "afwhqQMt_VAuBmZ2nR9pmQAAAU4"]
[Thu May 07 13:22:50.256687 2026] [:error] [pid 56056:tid 56186] [client 20.9.31.235:24453] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "afwhqgMt_VAuBmZ2nR9pngAAAVQ"]
[Thu May 07 13:22:51.228681 2026] [:error] [pid 56056:tid 56063] [client 20.9.31.235:24516] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "afwhqwMt_VAuBmZ2nR9pogAAAUU"]
[Thu May 07 13:22:53.087334 2026] [:error] [pid 56064:tid 56090] [client 20.9.31.235:32001] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "afwhrSsGkZZUEf_7QCMu6AAAABU"]
[Thu May 07 13:22:54.475666 2026] [:error] [pid 56150:tid 56159] [client 20.9.31.235:32047] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "afwhrtu4duXJJeTigXRKuAAAAEc"]
[Thu May 07 13:22:55.400826 2026] [:error] [pid 56056:tid 56058] [client 20.9.31.235:27356] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "afwhrwMt_VAuBmZ2nR9ptwAAAUA"]
[Thu May 07 13:22:56.771146 2026] [:error] [pid 56056:tid 56058] [client 20.9.31.235:61924] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "afwhsAMt_VAuBmZ2nR9pzwAAAUA"]
[Thu May 07 13:22:58.041113 2026] [:error] [pid 56056:tid 56061] [client 20.9.31.235:61865] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "afwhsgMt_VAuBmZ2nR9p1wAAAUM"]
[Thu May 07 13:22:59.917572 2026] [:error] [pid 56056:tid 56060] [client 20.9.31.235:24573] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xff.php"] [unique_id "afwhswMt_VAuBmZ2nR9p4wAAAUI"]
[Thu May 07 13:23:01.311318 2026] [:error] [pid 56065:tid 56107] [client 20.9.31.235:32016] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "afwhtXdV4hYThdnhfxDlBQAAAIs"]
[Thu May 07 13:23:02.700713 2026] [:error] [pid 56150:tid 56157] [client 20.9.31.235:61837] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "afwhttu4duXJJeTigXRKwAAAAEU"]
[Thu May 07 13:23:03.441989 2026] [:error] [pid 56066:tid 56136] [client 20.9.31.235:61838] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "afwht0YS8DGwDvklLv6-twAAAM0"]
[Thu May 07 13:23:05.397451 2026] [:error] [pid 1143:tid 1155] [client 20.9.31.235:23699] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lupo.php"] [unique_id "afwhuZb7qeI8X5VYRr6O1QAAAQo"]
[Thu May 07 13:23:06.074562 2026] [:error] [pid 1143:tid 1151] [client 20.9.31.235:27377] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "afwhupb7qeI8X5VYRr6O1gAAAQY"]
[Thu May 07 13:23:07.362304 2026] [:error] [pid 1143:tid 1162] [client 20.9.31.235:32097] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "afwhu5b7qeI8X5VYRr6O2QAAARE"]
[Thu May 07 13:23:08.400834 2026] [:error] [pid 56150:tid 56163] [client 20.9.31.235:61860] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "afwhvNu4duXJJeTigXRKxQAAAEs"]
[Thu May 07 13:23:10.688446 2026] [:error] [pid 56150:tid 56165] [client 20.9.31.235:32076] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/awa.php"] [unique_id "afwhvtu4duXJJeTigXRKywAAAE0"]
[Thu May 07 13:23:11.928545 2026] [:error] [pid 56064:tid 56077] [client 20.9.31.235:32087] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "afwhvysGkZZUEf_7QCMvNQAAAAg"]
[Thu May 07 13:23:12.749274 2026] [:error] [pid 56064:tid 56071] [client 20.9.31.235:23769] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "afwhwCsGkZZUEf_7QCMvNwAAAAI"]
[Thu May 07 13:23:13.465890 2026] [:error] [pid 56056:tid 56060] [client 20.9.31.235:61941] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "afwhwQMt_VAuBmZ2nR9p-AAAAUI"]
[Thu May 07 13:23:14.435946 2026] [:error] [pid 56065:tid 56116] [client 20.9.31.235:27287] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/popo.php"] [unique_id "afwhwndV4hYThdnhfxDlDwAAAJQ"]
[Thu May 07 13:23:15.419943 2026] [:error] [pid 56150:tid 56169] [client 20.9.31.235:27390] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "afwhw9u4duXJJeTigXRKzgAAAFE"]
[Thu May 07 13:23:16.554890 2026] [:error] [pid 56056:tid 56095] [client 20.9.31.235:24484] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "afwhxAMt_VAuBmZ2nR9qAAAAAUg"]
[Thu May 07 13:23:18.357587 2026] [:error] [pid 56066:tid 56142] [client 20.9.31.235:61925] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/13.php"] [unique_id "afwhxkYS8DGwDvklLv6-ygAAANM"]
[Thu May 07 13:23:25.223866 2026] [autoindex:error] [pid 56065:tid 56100] [client 20.9.31.235:27343] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 13:23:30.946058 2026] [:error] [pid 56065:tid 56113] [client 20.9.31.235:27343] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "afwh0ndV4hYThdnhfxDlIQAAAJE"]
[Thu May 07 13:23:31.679435 2026] [:error] [pid 1143:tid 1154] [client 20.9.31.235:32026] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "afwh05b7qeI8X5VYRr6O7QAAAQk"]
[Thu May 07 13:23:32.367449 2026] [:error] [pid 56066:tid 56133] [client 20.9.31.235:24555] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "afwh1EYS8DGwDvklLv6-0wAAAMo"]
[Thu May 07 13:23:33.184707 2026] [:error] [pid 56056:tid 56067] [client 20.9.31.235:27379] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "afwh1QMt_VAuBmZ2nR9qKQAAAUY"]
[Thu May 07 13:23:34.305180 2026] [:error] [pid 56150:tid 56166] [client 20.9.31.235:61882] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "afwh1tu4duXJJeTigXRK1AAAAE4"]
[Thu May 07 13:23:35.373209 2026] [:error] [pid 1143:tid 1161] [client 20.9.31.235:61934] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "afwh15b7qeI8X5VYRr6O8QAAARA"]
[Thu May 07 13:23:36.727533 2026] [:error] [pid 1143:tid 1163] [client 20.9.31.235:24562] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "afwh2Jb7qeI8X5VYRr6O8wAAARI"]
[Thu May 07 13:23:37.745013 2026] [:error] [pid 1143:tid 1151] [client 20.9.31.235:27382] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3.php"] [unique_id "afwh2Zb7qeI8X5VYRr6O9gAAAQY"]
[Thu May 07 13:23:38.648814 2026] [:error] [pid 1143:tid 1147] [client 20.9.31.235:32123] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "afwh2pb7qeI8X5VYRr6O-gAAAQI"]
[Thu May 07 13:23:39.333913 2026] [:error] [pid 56150:tid 56171] [client 20.9.31.235:32045] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "afwh29u4duXJJeTigXRK2wAAAFM"]
[Thu May 07 13:23:40.017768 2026] [:error] [pid 1143:tid 1152] [client 20.9.31.235:27305] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "afwh3Jb7qeI8X5VYRr6O_gAAAQc"]
[Thu May 07 13:23:41.193344 2026] [:error] [pid 1143:tid 1168] [client 20.9.31.235:32093] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "afwh3Zb7qeI8X5VYRr6PAQAAARc"]
[Thu May 07 13:23:42.594495 2026] [:error] [pid 56150:tid 56152] [client 20.9.31.235:32018] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "afwh3tu4duXJJeTigXRK3gAAAEA"]
[Thu May 07 13:23:43.575604 2026] [:error] [pid 1143:tid 1165] [client 20.9.31.235:32098] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "afwh35b7qeI8X5VYRr6PDQAAARQ"]
[Thu May 07 13:23:44.651347 2026] [:error] [pid 56150:tid 56156] [client 20.9.31.235:61927] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "afwh4Nu4duXJJeTigXRK3wAAAEQ"]
[Thu May 07 13:23:45.967804 2026] [:error] [pid 56150:tid 56162] [client 20.9.31.235:27304] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5.php"] [unique_id "afwh4du4duXJJeTigXRK4QAAAEo"]
[Thu May 07 13:23:46.772780 2026] [:error] [pid 56056:tid 56190] [client 20.9.31.235:32031] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "afwh4gMt_VAuBmZ2nR9qOQAAAVg"]
[Thu May 07 13:23:47.593846 2026] [:error] [pid 1143:tid 1154] [client 20.9.31.235:23766] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "afwh45b7qeI8X5VYRr6PEAAAAQk"]
[Thu May 07 13:23:48.758826 2026] [:error] [pid 1143:tid 1169] [client 20.9.31.235:24475] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "afwh5Jb7qeI8X5VYRr6PFwAAARg"]
[Thu May 07 13:23:49.437052 2026] [:error] [pid 1143:tid 1163] [client 20.9.31.235:27328] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/6.php"] [unique_id "afwh5Zb7qeI8X5VYRr6PGQAAARI"]
[Thu May 07 13:23:51.490351 2026] [:error] [pid 1143:tid 1165] [client 20.9.31.235:27376] [client 20.9.31.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/nss.php"] [unique_id "afwh55b7qeI8X5VYRr6PIAAAARQ"]
[Thu May 07 13:23:53.723041 2026] [:error] [pid 1143:tid 1168] [client 20.9.31.235:27290] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "afwh6Zb7qeI8X5VYRr6POwAAARc"]
[Thu May 07 13:23:54.739781 2026] [:error] [pid 1143:tid 1165] [client 20.9.31.235:24507] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "afwh6pb7qeI8X5VYRr6PPwAAARQ"]
[Thu May 07 13:23:55.525336 2026] [:error] [pid 56056:tid 56182] [client 20.9.31.235:27354] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "afwh6wMt_VAuBmZ2nR9qYwAAAVA"]
[Thu May 07 13:23:56.565333 2026] [:error] [pid 56056:tid 56181] [client 20.9.31.235:27303] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "afwh7AMt_VAuBmZ2nR9qaAAAAU8"]
[Thu May 07 13:23:57.558201 2026] [:error] [pid 56065:tid 56107] [client 20.9.31.235:23794] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "afwh7XdV4hYThdnhfxDlJwAAAIs"]
[Thu May 07 13:23:59.532420 2026] [:error] [pid 56064:tid 56074] [client 20.9.31.235:27374] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "afwh7ysGkZZUEf_7QCMvRgAAAAU"]
[Thu May 07 13:24:01.732750 2026] [:error] [pid 56065:tid 56111] [client 20.9.31.235:27333] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "afwh8XdV4hYThdnhfxDlKgAAAI8"]
[Thu May 07 13:24:04.247132 2026] [:error] [pid 56066:tid 56136] [client 20.9.31.235:32127] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "afwh9EYS8DGwDvklLv6-3wAAAM0"]
[Thu May 07 13:24:05.199189 2026] [:error] [pid 56066:tid 56145] [client 20.9.31.235:61844] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/nastar.php"] [unique_id "afwh9UYS8DGwDvklLv6-4AAAANY"]
[Thu May 07 13:24:06.859534 2026] [:error] [pid 56066:tid 56129] [client 20.9.31.235:32114] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/nastar.php"] [unique_id "afwh9kYS8DGwDvklLv6-5gAAAMY"]
[Thu May 07 13:24:08.326712 2026] [:error] [pid 56066:tid 56132] [client 20.9.31.235:27326] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/nastar.php"] [unique_id "afwh-EYS8DGwDvklLv6-7AAAAMk"]
[Thu May 07 13:24:09.520233 2026] [:error] [pid 56064:tid 56090] [client 20.9.31.235:24477] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/nastar.php"] [unique_id "afwh-SsGkZZUEf_7QCMvSQAAABU"]
[Thu May 07 13:24:11.044708 2026] [:error] [pid 56065:tid 56112] [client 20.9.31.235:32053] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "afwh-3dV4hYThdnhfxDlLgAAAJA"]
[Thu May 07 13:24:12.078959 2026] [:error] [pid 56066:tid 56131] [client 20.9.31.235:23687] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "afwh_EYS8DGwDvklLv6-8QAAAMg"]
[Thu May 07 13:24:13.246603 2026] [:error] [pid 56150:tid 56152] [client 20.9.31.235:15087] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "afwh_du4duXJJeTigXRK7gAAAEA"]
[Thu May 07 13:24:14.684939 2026] [:error] [pid 56066:tid 56140] [client 20.9.31.235:27335] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "afwh_kYS8DGwDvklLv6-9QAAANE"]
[Thu May 07 13:24:15.442322 2026] [:error] [pid 56056:tid 56059] [client 20.9.31.235:32094] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "afwh_wMt_VAuBmZ2nR9qdwAAAUE"]
[Thu May 07 13:24:16.436592 2026] [:error] [pid 56056:tid 56185] [client 20.9.31.235:24471] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "afwiAAMt_VAuBmZ2nR9qeQAAAVM"]
[Thu May 07 13:24:17.942689 2026] [:error] [pid 56065:tid 56103] [client 20.9.31.235:32081] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "afwiAXdV4hYThdnhfxDlMgAAAIc"]
[Thu May 07 13:24:19.154410 2026] [:error] [pid 56065:tid 56102] [client 20.9.31.235:15085] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "afwiA3dV4hYThdnhfxDlMwAAAIY"]
[Thu May 07 13:24:22.649929 2026] [:error] [pid 56150:tid 56174] [client 20.9.31.235:24564] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "afwiBtu4duXJJeTigXRK9QAAAFY"]
[Thu May 07 13:24:23.479113 2026] [:error] [pid 56064:tid 56072] [client 20.9.31.235:27322] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "afwiBysGkZZUEf_7QCMvTQAAAAM"]
[Thu May 07 13:24:24.668164 2026] [:error] [pid 56065:tid 56100] [client 20.9.31.235:61868] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "afwiCHdV4hYThdnhfxDlOwAAAIQ"]
[Thu May 07 13:24:25.445727 2026] [:error] [pid 56065:tid 56108] [client 20.9.31.235:15080] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hplfuns.php"] [unique_id "afwiCXdV4hYThdnhfxDlPQAAAIw"]
[Thu May 07 13:24:26.556365 2026] [:error] [pid 56065:tid 56105] [client 20.9.31.235:32090] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "afwiCndV4hYThdnhfxDlPwAAAIk"]
[Thu May 07 13:24:27.416105 2026] [:error] [pid 1143:tid 1147] [client 20.9.31.235:24513] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "afwiC5b7qeI8X5VYRr6PWAAAAQI"]
[Thu May 07 13:24:28.356380 2026] [:error] [pid 1143:tid 1169] [client 20.9.31.235:61885] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "afwiDJb7qeI8X5VYRr6PXAAAARg"]
[Thu May 07 13:24:34.282768 2026] [autoindex:error] [pid 1143:tid 1163] [client 20.9.31.235:24552] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/midnight/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 13:24:42.539629 2026] [:error] [pid 1143:tid 1158] [client 20.9.31.235:24552] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "afwiGpb7qeI8X5VYRr6PeAAAAQ0"]
[Thu May 07 13:24:44.879141 2026] [:error] [pid 56056:tid 56188] [client 20.9.31.235:27370] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "afwiHAMt_VAuBmZ2nR9qmgAAAVY"]
[Thu May 07 13:24:46.020176 2026] [:error] [pid 56150:tid 56154] [client 20.9.31.235:61920] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "afwiHtu4duXJJeTigXRLBQAAAEI"]
[Thu May 07 13:24:47.021878 2026] [:error] [pid 56056:tid 56063] [client 20.9.31.235:27316] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "afwiHwMt_VAuBmZ2nR9qmwAAAUU"]
[Thu May 07 13:24:48.110948 2026] [:error] [pid 56056:tid 56068] [client 20.9.31.235:61935] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "afwiIAMt_VAuBmZ2nR9qnAAAAUc"]
[Thu May 07 13:24:49.032089 2026] [:error] [pid 56056:tid 56187] [client 20.9.31.235:23753] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "afwiIQMt_VAuBmZ2nR9qngAAAVU"]
[Thu May 07 13:24:49.607156 2026] [:error] [pid 56056:tid 56067] [client 20.9.31.235:32046] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "afwiIQMt_VAuBmZ2nR9qnwAAAUY"]
[Thu May 07 13:24:51.055508 2026] [:error] [pid 56150:tid 56172] [client 20.9.31.235:32029] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "afwiI9u4duXJJeTigXRLBgAAAFQ"]
[Thu May 07 13:24:51.641731 2026] [:error] [pid 1143:tid 1163] [client 20.9.31.235:32065] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "afwiI5b7qeI8X5VYRr6PeQAAARI"]
[Thu May 07 13:24:53.030441 2026] [:error] [pid 56065:tid 56097] [client 20.9.31.235:61871] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "afwiJXdV4hYThdnhfxDlRQAAAIE"]
[Thu May 07 13:24:55.223330 2026] [:error] [pid 56056:tid 56059] [client 20.9.31.235:27387] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "afwiJwMt_VAuBmZ2nR9qpAAAAUE"]
[Thu May 07 13:24:56.609007 2026] [:error] [pid 56064:tid 56091] [client 20.9.31.235:61923] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/bolt.php"] [unique_id "afwiKCsGkZZUEf_7QCMvVgAAABY"]
[Thu May 07 13:24:57.929320 2026] [:error] [pid 56056:tid 56062] [client 20.9.31.235:61872] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "afwiKQMt_VAuBmZ2nR9qpgAAAUQ"]
[Thu May 07 13:24:59.450564 2026] [:error] [pid 56150:tid 56154] [client 20.9.31.235:61883] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "afwiK9u4duXJJeTigXRLEQAAAEI"]
[Thu May 07 13:25:01.721084 2026] [:error] [pid 56056:tid 56068] [client 20.9.31.235:27352] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "afwiLQMt_VAuBmZ2nR9qqgAAAUc"]
[Thu May 07 13:25:03.187543 2026] [:error] [pid 56064:tid 56074] [client 20.9.31.235:27332] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-act.php"] [unique_id "afwiLysGkZZUEf_7QCMvWAAAAAU"]
[Thu May 07 13:25:04.040779 2026] [:error] [pid 56066:tid 56133] [client 20.9.31.235:32072] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "afwiMEYS8DGwDvklLv6_AQAAAMo"]
[Thu May 07 13:25:05.529610 2026] [:error] [pid 56065:tid 56118] [client 20.9.31.235:24559] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "afwiMXdV4hYThdnhfxDlRwAAAJY"]
[Thu May 07 13:25:06.212165 2026] [:error] [pid 56065:tid 56107] [client 20.9.31.235:15057] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "afwiMndV4hYThdnhfxDlSQAAAIs"]
[Thu May 07 13:25:07.318740 2026] [:error] [pid 56056:tid 56059] [client 20.9.31.235:27329] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "afwiMwMt_VAuBmZ2nR9qrwAAAUE"]
[Thu May 07 13:25:08.053219 2026] [:error] [pid 1143:tid 1163] [client 20.9.31.235:23779] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "afwiNJb7qeI8X5VYRr6PhQAAARI"]
[Thu May 07 13:25:09.399562 2026] [:error] [pid 56150:tid 56165] [client 20.9.31.235:24529] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "afwiNdu4duXJJeTigXRLEgAAAE0"]
[Thu May 07 13:25:10.201829 2026] [:error] [pid 56066:tid 56143] [client 20.9.31.235:27271] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "afwiNkYS8DGwDvklLv6_AgAAANQ"]
[Thu May 07 13:25:11.156875 2026] [:error] [pid 56056:tid 56058] [client 20.9.31.235:15037] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/index.php"] [unique_id "afwiNwMt_VAuBmZ2nR9qsAAAAUA"]
[Thu May 07 13:25:12.014749 2026] [:error] [pid 56056:tid 56062] [client 20.9.31.235:32002] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "afwiOAMt_VAuBmZ2nR9qtAAAAUQ"]
[Thu May 07 13:25:12.918880 2026] [:error] [pid 1143:tid 1155] [client 20.9.31.235:15089] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "afwiOJb7qeI8X5VYRr6PhgAAAQo"]
[Thu May 07 13:25:13.744980 2026] [:error] [pid 56065:tid 56098] [client 20.9.31.235:24462] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "afwiOXdV4hYThdnhfxDlSgAAAII"]
[Thu May 07 13:25:14.616353 2026] [:error] [pid 1143:tid 1147] [client 20.9.31.235:15049] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "afwiOpb7qeI8X5VYRr6PhwAAAQI"]
[Thu May 07 13:25:15.869446 2026] [:error] [pid 56150:tid 56159] [client 20.9.31.235:32122] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "afwiO9u4duXJJeTigXRLFgAAAEc"]
[Thu May 07 13:25:17.063754 2026] [:error] [pid 56065:tid 56105] [client 20.9.31.235:24489] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "afwiPXdV4hYThdnhfxDlTQAAAIk"]
[Thu May 07 13:25:18.389782 2026] [:error] [pid 56064:tid 56082] [client 20.9.31.235:27372] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "afwiPisGkZZUEf_7QCMvXAAAAA0"]
[Thu May 07 13:25:19.698112 2026] [:error] [pid 56065:tid 56113] [client 20.9.31.235:27344] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "afwiP3dV4hYThdnhfxDlUAAAAJE"]
[Thu May 07 13:25:20.866912 2026] [:error] [pid 1143:tid 1169] [client 20.9.31.235:32043] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "afwiQJb7qeI8X5VYRr6PjAAAARg"]
[Thu May 07 13:25:22.367167 2026] [:error] [pid 56056:tid 56068] [client 20.9.31.235:32110] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "afwiQgMt_VAuBmZ2nR9qtgAAAUc"]
[Thu May 07 13:25:23.445668 2026] [:error] [pid 1143:tid 1166] [client 20.9.31.235:27325] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "afwiQ5b7qeI8X5VYRr6PjwAAARU"]
[Thu May 07 13:25:24.209913 2026] [:error] [pid 1143:tid 1164] [client 20.9.31.235:27389] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/js/jquery/"] [unique_id "afwiRJb7qeI8X5VYRr6PkAAAARM"]
[Thu May 07 13:25:25.318298 2026] [:error] [pid 1143:tid 1158] [client 20.9.31.235:23751] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "afwiRZb7qeI8X5VYRr6PkwAAAQ0"]
[Thu May 07 13:25:26.305384 2026] [:error] [pid 1143:tid 1154] [client 20.9.31.235:24465] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "afwiRpb7qeI8X5VYRr6PlQAAAQk"]
[Thu May 07 13:25:27.161218 2026] [:error] [pid 1143:tid 1165] [client 20.9.31.235:27391] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "afwiR5b7qeI8X5VYRr6PmQAAARQ"]
[Thu May 07 13:25:28.056027 2026] [:error] [pid 56064:tid 56073] [client 20.9.31.235:27339] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "afwiSCsGkZZUEf_7QCMvXgAAAAQ"]
[Thu May 07 13:25:28.851771 2026] [:error] [pid 56056:tid 56187] [client 20.9.31.235:61945] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "afwiSAMt_VAuBmZ2nR9quwAAAVU"]
[Thu May 07 13:25:29.625375 2026] [:error] [pid 56065:tid 56097] [client 20.9.31.235:27375] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "afwiSXdV4hYThdnhfxDlUgAAAIE"]
[Thu May 07 13:25:30.122416 2026] [:error] [pid 56066:tid 56140] [client 20.9.31.235:32112] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "afwiSkYS8DGwDvklLv6_BAAAANE"]
[Thu May 07 13:25:30.659263 2026] [:error] [pid 56064:tid 56075] [client 20.9.31.235:32096] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "afwiSisGkZZUEf_7QCMvXwAAAAY"]
[Thu May 07 13:25:31.214541 2026] [:error] [pid 56066:tid 56139] [client 20.9.31.235:61828] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "afwiS0YS8DGwDvklLv6_BwAAANA"]
[Thu May 07 13:25:31.712516 2026] [:error] [pid 56066:tid 56127] [client 20.9.31.235:15099] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "afwiS0YS8DGwDvklLv6_CAAAAMQ"]
[Thu May 07 13:25:32.335851 2026] [:error] [pid 56066:tid 56146] [client 20.9.31.235:27342] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "afwiTEYS8DGwDvklLv6_CgAAANc"]
[Thu May 07 13:25:32.983537 2026] [:error] [pid 1143:tid 1155] [client 20.9.31.235:27294] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "afwiTJb7qeI8X5VYRr6PpQAAAQo"]
[Thu May 07 13:25:33.629264 2026] [:error] [pid 1143:tid 1162] [client 20.9.31.235:61919] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "afwiTZb7qeI8X5VYRr6PpgAAARE"]
[Thu May 07 13:25:35.129957 2026] [:error] [pid 1143:tid 1146] [client 20.9.31.235:61911] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "afwiT5b7qeI8X5VYRr6PqwAAAQE"]
[Thu May 07 13:25:36.246991 2026] [:error] [pid 56056:tid 56182] [client 20.9.31.235:61851] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "afwiUAMt_VAuBmZ2nR9qwgAAAVA"]
[Thu May 07 13:25:37.005727 2026] [:error] [pid 1143:tid 1153] [client 20.9.31.235:23757] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "afwiUZb7qeI8X5VYRr6PrgAAAQg"]
[Thu May 07 13:25:37.773628 2026] [:error] [pid 56056:tid 56185] [client 20.9.31.235:32008] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "afwiUQMt_VAuBmZ2nR9qxAAAAVM"]
[Thu May 07 13:25:38.542465 2026] [:error] [pid 56065:tid 56106] [client 20.9.31.235:27355] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "afwiUndV4hYThdnhfxDlVAAAAIo"]
[Thu May 07 13:25:39.384124 2026] [:error] [pid 56065:tid 56118] [client 20.9.31.235:32057] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "afwiU3dV4hYThdnhfxDlVQAAAJY"]
[Thu May 07 13:25:39.976885 2026] [:error] [pid 56150:tid 56165] [client 20.9.31.235:61943] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "afwiU9u4duXJJeTigXRLHQAAAE0"]
[Thu May 07 13:25:40.607544 2026] [:error] [pid 56065:tid 56101] [client 20.9.31.235:61896] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/index.php"] [unique_id "afwiVHdV4hYThdnhfxDlVgAAAIU"]
[Thu May 07 13:25:46.577646 2026] [autoindex:error] [pid 56056:tid 56183] [client 20.9.31.235:24520] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 13:25:47.601835 2026] [autoindex:error] [pid 56056:tid 56095] [client 20.9.31.235:24520] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 13:25:47.828294 2026] [autoindex:error] [pid 56056:tid 56180] [client 20.9.31.235:24520] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 13:25:53.586677 2026] [:error] [pid 56056:tid 56058] [client 20.9.31.235:24520] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "afwiYQMt_VAuBmZ2nR9q4QAAAUA"]
[Thu May 07 13:25:54.428940 2026] [:error] [pid 56064:tid 56076] [client 20.9.31.235:61869] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "afwiYisGkZZUEf_7QCMvZAAAAAc"]
[Thu May 07 13:25:55.193568 2026] [:error] [pid 1143:tid 1150] [client 20.9.31.235:61863] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "afwiY5b7qeI8X5VYRr6PvQAAAQU"]
[Thu May 07 13:25:56.293923 2026] [:error] [pid 1143:tid 1162] [client 20.9.31.235:61901] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "afwiZJb7qeI8X5VYRr6PvwAAARE"]
[Thu May 07 13:25:57.339863 2026] [:error] [pid 1143:tid 1146] [client 20.9.31.235:27311] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "afwiZZb7qeI8X5VYRr6PwgAAAQE"]
[Thu May 07 13:25:58.248730 2026] [:error] [pid 1143:tid 1145] [client 20.9.31.235:27359] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "afwiZpb7qeI8X5VYRr6PwwAAAQA"]
[Thu May 07 13:25:59.056428 2026] [:error] [pid 56056:tid 56190] [client 20.9.31.235:27301] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "afwiZwMt_VAuBmZ2nR9q5AAAAVg"]
[Thu May 07 13:25:59.938794 2026] [:error] [pid 56056:tid 56062] [client 20.9.31.235:61940] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/update/f35.php"] [unique_id "afwiZwMt_VAuBmZ2nR9q6gAAAUQ"]
[Thu May 07 13:26:00.804857 2026] [:error] [pid 1143:tid 1151] [client 20.9.31.235:61914] [client 20.9.31.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afwiaJb7qeI8X5VYRr6PyAAAAQY"]
[Thu May 07 13:26:02.115290 2026] [:error] [pid 56056:tid 56190] [client 20.9.31.235:24523] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "afwiagMt_VAuBmZ2nR9q7gAAAVg"]
[Thu May 07 13:26:02.865123 2026] [:error] [pid 56056:tid 56180] [client 20.9.31.235:24525] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "afwiagMt_VAuBmZ2nR9q8gAAAU4"]
[Thu May 07 13:26:04.155169 2026] [:error] [pid 1143:tid 1146] [client 20.9.31.235:32084] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "afwibJb7qeI8X5VYRr6PygAAAQE"]
[Thu May 07 13:26:04.750645 2026] [:error] [pid 56064:tid 56070] [client 20.9.31.235:24528] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "afwibCsGkZZUEf_7QCMvZQAAAAE"]
[Thu May 07 13:26:05.340410 2026] [:error] [pid 1143:tid 1145] [client 20.9.31.235:32052] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "afwibZb7qeI8X5VYRr6PywAAAQA"]
[Thu May 07 13:26:06.231360 2026] [:error] [pid 56066:tid 56128] [client 20.9.31.235:23692] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "afwibkYS8DGwDvklLv6_FAAAAMU"]
[Thu May 07 13:26:06.980923 2026] [:error] [pid 56056:tid 56185] [client 20.9.31.235:15009] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "afwibgMt_VAuBmZ2nR9q9wAAAVM"]
[Thu May 07 13:26:07.596368 2026] [:error] [pid 56056:tid 56183] [client 20.9.31.235:17358] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/css/index.php"] [unique_id "afwibwMt_VAuBmZ2nR9q-AAAAVE"]
[Thu May 07 13:26:08.342689 2026] [:error] [pid 56150:tid 56160] [client 20.9.31.235:61874] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "afwicNu4duXJJeTigXRLLwAAAEg"]
[Thu May 07 13:26:09.138081 2026] [:error] [pid 56064:tid 56072] [client 20.9.31.235:32012] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "afwicSsGkZZUEf_7QCMvaQAAAAM"]
[Thu May 07 13:26:10.336665 2026] [:error] [pid 56066:tid 56146] [client 20.9.31.235:27323] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "afwickYS8DGwDvklLv6_FwAAANc"]
[Thu May 07 13:26:11.367577 2026] [:error] [pid 56056:tid 56189] [client 20.9.31.235:27288] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/SimplePie/"] [unique_id "afwicwMt_VAuBmZ2nR9q-QAAAVc"]
[Thu May 07 13:26:13.840263 2026] [:error] [pid 56064:tid 56087] [client 20.9.31.235:24567] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "afwidSsGkZZUEf_7QCMvawAAABI"]
[Thu May 07 13:26:14.511835 2026] [:error] [pid 56056:tid 56190] [client 20.9.31.235:32066] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "afwidgMt_VAuBmZ2nR9q-gAAAVg"]
[Thu May 07 13:26:15.891129 2026] [:error] [pid 56056:tid 56059] [client 20.9.31.235:61917] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "afwidwMt_VAuBmZ2nR9q_AAAAUE"]
[Thu May 07 13:26:17.197031 2026] [:error] [pid 1143:tid 1147] [client 20.9.31.235:61898] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "afwieZb7qeI8X5VYRr6P0wAAAQI"]
[Thu May 07 13:26:18.563670 2026] [:error] [pid 56056:tid 56186] [client 20.9.31.235:24508] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "afwiegMt_VAuBmZ2nR9q_gAAAVQ"]
[Thu May 07 13:26:19.555727 2026] [:error] [pid 56056:tid 56060] [client 20.9.31.235:27285] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "afwiewMt_VAuBmZ2nR9q_wAAAUI"]
[Thu May 07 13:26:20.734801 2026] [:error] [pid 56065:tid 56116] [client 20.9.31.235:27292] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "afwifHdV4hYThdnhfxDlXQAAAJQ"]
[Thu May 07 13:26:21.778282 2026] [:error] [pid 56056:tid 56181] [client 20.9.31.235:27277] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/in.php"] [unique_id "afwifQMt_VAuBmZ2nR9rBQAAAU8"]
[Thu May 07 13:26:22.519771 2026] [:error] [pid 56150:tid 56169] [client 20.9.31.235:13519] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-widgets.php"] [unique_id "afwiftu4duXJJeTigXRLMQAAAFE"]
[Thu May 07 13:26:23.595077 2026] [:error] [pid 56056:tid 56190] [client 20.9.31.235:32027] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-widgets.php"] [unique_id "afwifwMt_VAuBmZ2nR9rCAAAAVg"]
[Thu May 07 13:26:24.412929 2026] [:error] [pid 56066:tid 56147] [client 20.9.31.235:32003] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-widgets.php"] [unique_id "afwigEYS8DGwDvklLv6_GgAAANg"]
[Thu May 07 13:26:25.419752 2026] [:error] [pid 56056:tid 56068] [client 20.9.31.235:27280] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-widgets.php"] [unique_id "afwigQMt_VAuBmZ2nR9rCgAAAUc"]
[Thu May 07 13:26:26.263920 2026] [:error] [pid 56056:tid 56186] [client 20.9.31.235:32000] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/admin.php"] [unique_id "afwiggMt_VAuBmZ2nR9rCwAAAVQ"]
[Thu May 07 13:26:27.582089 2026] [:error] [pid 1143:tid 1153] [client 20.9.31.235:24534] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/admin.php"] [unique_id "afwig5b7qeI8X5VYRr6P2QAAAQg"]
[Thu May 07 13:26:28.283526 2026] [:error] [pid 1143:tid 1151] [client 20.9.31.235:23744] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/admin.php"] [unique_id "afwihJb7qeI8X5VYRr6P2wAAAQY"]
[Thu May 07 13:26:29.249496 2026] [:error] [pid 56065:tid 56103] [client 20.9.31.235:27281] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/admin.php"] [unique_id "afwihXdV4hYThdnhfxDlXgAAAIc"]
[Thu May 07 13:26:30.504498 2026] [:error] [pid 1143:tid 1149] [client 20.9.31.235:32054] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "afwihpb7qeI8X5VYRr6P3QAAAQQ"]
[Thu May 07 13:26:31.314009 2026] [:error] [pid 56064:tid 56091] [client 20.9.31.235:13535] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "afwihysGkZZUEf_7QCMvbQAAABY"]
[Thu May 07 13:26:32.144693 2026] [:error] [pid 56066:tid 56134] [client 20.9.31.235:61939] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "afwiiEYS8DGwDvklLv6_HAAAAMs"]
[Thu May 07 13:26:32.665282 2026] [:error] [pid 1143:tid 1152] [client 20.9.31.235:23705] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bs1.php"] [unique_id "afwiiJb7qeI8X5VYRr6P4AAAAQc"]
[Thu May 07 13:26:33.301639 2026] [:error] [pid 56056:tid 56179] [client 20.9.31.235:27346] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afwiiQMt_VAuBmZ2nR9rEAAAAU0"]
[Thu May 07 13:26:33.884966 2026] [:error] [pid 56066:tid 56136] [client 20.9.31.235:24448] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afwiiUYS8DGwDvklLv6_HQAAAM0"]
[Thu May 07 13:26:34.402691 2026] [:error] [pid 56056:tid 56122] [client 20.9.31.235:27341] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afwiigMt_VAuBmZ2nR9rEQAAAUk"]
[Thu May 07 13:26:34.975594 2026] [:error] [pid 56056:tid 56184] [client 20.9.31.235:23688] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "afwiigMt_VAuBmZ2nR9rEgAAAVI"]
[Thu May 07 13:26:35.685410 2026] [:error] [pid 56056:tid 56189] [client 20.9.31.235:61926] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "afwiiwMt_VAuBmZ2nR9rFAAAAVc"]
[Thu May 07 13:26:36.440456 2026] [:error] [pid 56150:tid 56163] [client 20.9.31.235:61899] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "afwijNu4duXJJeTigXRLMwAAAEs"]
[Thu May 07 13:26:39.015565 2026] [:error] [pid 56056:tid 56151] [client 20.9.31.235:61887] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "afwijwMt_VAuBmZ2nR9rIwAAAUs"]
[Thu May 07 13:26:41.210291 2026] [:error] [pid 1143:tid 1149] [client 20.9.31.235:61864] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "afwikZb7qeI8X5VYRr6QGQAAAQQ"]
[Thu May 07 13:26:41.777330 2026] [:error] [pid 1143:tid 1148] [client 20.9.31.235:15037] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/BypassBest.php"] [unique_id "afwikZb7qeI8X5VYRr6QHAAAAQM"]
[Thu May 07 13:26:43.441886 2026] [:error] [pid 56150:tid 56173] [client 20.9.31.235:61950] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/BypassBest.php"] [unique_id "afwik9u4duXJJeTigXRLPQAAAFU"]
[Thu May 07 13:26:44.298765 2026] [:error] [pid 1143:tid 1148] [client 20.9.31.235:32044] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/BypassBest.php"] [unique_id "afwilJb7qeI8X5VYRr6QLwAAAQM"]
[Thu May 07 13:26:45.670663 2026] [:error] [pid 56065:tid 56097] [client 20.9.31.235:27385] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/BypassBest.php"] [unique_id "afwilXdV4hYThdnhfxDleQAAAIE"]
[Thu May 07 13:26:46.934806 2026] [:error] [pid 1143:tid 1158] [client 20.9.31.235:23787] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "afwilpb7qeI8X5VYRr6QMQAAAQ0"]
[Thu May 07 13:26:48.084256 2026] [:error] [pid 1143:tid 1150] [client 20.9.31.235:27299] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "afwimJb7qeI8X5VYRr6QNAAAAQU"]
[Thu May 07 13:26:49.197122 2026] [:error] [pid 56150:tid 56158] [client 20.9.31.235:61840] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "afwimdu4duXJJeTigXRLPwAAAEY"]
[Thu May 07 13:26:50.726016 2026] [:error] [pid 56056:tid 56058] [client 20.9.31.235:24518] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "afwimgMt_VAuBmZ2nR9rOAAAAUA"]
[Thu May 07 13:26:51.832140 2026] [:error] [pid 56056:tid 56187] [client 20.9.31.235:24452] [client 20.9.31.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "afwimwMt_VAuBmZ2nR9rPAAAAVU"]
[Thu May 07 13:26:57.169979 2026] [autoindex:error] [pid 56064:tid 56082] [client 20.9.31.235:23703] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 13:26:58.903185 2026] [autoindex:error] [pid 56064:tid 56073] [client 20.9.31.235:23703] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu May 07 16:48:04.880048 2026] [:error] [pid 28098:tid 28110] [client 34.57.184.21:50797] [client 34.57.184.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.57.184.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afxRxMvhwfljlt8trSqouAAAAEo"]
[Thu May 07 16:48:06.981187 2026] [:error] [pid 28098:tid 28104] [client 34.57.184.21:50797] [client 34.57.184.21] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "afxRxsvhwfljlt8trSqouwAAAEQ"]
[Thu May 07 16:48:07.196986 2026] [:error] [pid 28098:tid 28111] [client 34.57.184.21:50797] [client 34.57.184.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.57.184.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afxRx8vhwfljlt8trSqovAAAAEs"]
[Thu May 07 16:48:08.587491 2026] [:error] [pid 15715:tid 15720] [client 34.57.184.21:49304] [client 34.57.184.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.57.184.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afxRyCY4dZsLOttMkcd0EQAAAQM"]
[Thu May 07 16:48:09.890376 2026] [:error] [pid 15715:tid 15721] [client 34.57.184.21:62504] [client 34.57.184.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.57.184.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afxRySY4dZsLOttMkcd0EgAAAQQ"]
[Thu May 07 16:48:11.212393 2026] [:error] [pid 28098:tid 28120] [client 34.57.184.21:63820] [client 34.57.184.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.57.184.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afxRy8vhwfljlt8trSqovwAAAFQ"]
[Thu May 07 16:48:12.535163 2026] [:error] [pid 15631:tid 15692] [client 34.57.184.21:50475] [client 34.57.184.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.57.184.21, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afxRzHvP1GkPUuuLfqUc6AAAAMU"]
[Thu May 07 16:48:12.535376 2026] [:error] [pid 15631:tid 15692] [client 34.57.184.21:50475] [client 34.57.184.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.57.184.21, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afxRzHvP1GkPUuuLfqUc6AAAAMU"]
[Thu May 07 18:27:57.420950 2026] [:error] [pid 15631:tid 15705] [client 49.233.45.47:56832] [client 49.233.45.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afxpLXvP1GkPUuuLfqUs9wAAANI"]
[Thu May 07 19:39:19.910487 2026] [:error] [pid 28098:tid 28100] [client 136.107.16.198:58841] [client 136.107.16.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.107.16.198, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afx558vhwfljlt8trSrj-AAAAEA"]
[Thu May 07 19:39:22.035044 2026] [:error] [pid 28098:tid 28114] [client 136.107.16.198:58841] [client 136.107.16.198] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "afx56svhwfljlt8trSrkCAAAAE4"]
[Thu May 07 19:39:22.321388 2026] [:error] [pid 28098:tid 28100] [client 136.107.16.198:58841] [client 136.107.16.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.107.16.198, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afx56svhwfljlt8trSrkDwAAAEA"]
[Thu May 07 19:39:24.178880 2026] [:error] [pid 28098:tid 28123] [client 136.107.16.198:49599] [client 136.107.16.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.107.16.198, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afx57Mvhwfljlt8trSrkIgAAAFc"]
[Thu May 07 19:39:25.767954 2026] [:error] [pid 15715:tid 15742] [client 136.107.16.198:56503] [client 136.107.16.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.107.16.198, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afx57SY4dZsLOttMkceZqQAAARY"]
[Thu May 07 19:39:27.418150 2026] [:error] [pid 15631:tid 15705] [client 136.107.16.198:59765] [client 136.107.16.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.107.16.198, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afx573vP1GkPUuuLfqU4ggAAANI"]
[Thu May 07 19:39:28.961212 2026] [:error] [pid 15630:tid 15680] [client 136.107.16.198:52386] [client 136.107.16.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.107.16.198, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afx58HTithRAi4821quw0gAAAJQ"]
[Thu May 07 19:39:28.961394 2026] [:error] [pid 15630:tid 15680] [client 136.107.16.198:52386] [client 136.107.16.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 136.107.16.198, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afx58HTithRAi4821quw0gAAAJQ"]
[Thu May 07 20:46:55.565321 2026] [:error] [pid 28098:tid 28122] [client 106.219.161.168:5285] [client 106.219.161.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.161.168, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afyJv8vhwfljlt8trSr4CgAAAFY"], referer: https://expressinteriors.com/
[Thu May 07 21:12:58.545325 2026] [:error] [pid 15630:tid 15668] [client 43.153.7.191:52964] [client 43.153.7.191] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "afyP2nTithRAi4821qu9WQAAAIg"]
[Thu May 07 21:57:19.762767 2026] [:error] [pid 15631:tid 15701] [client 5.230.54.27:51543] [client 5.230.54.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "afyaP3vP1GkPUuuLfqVRfgAAAM4"]
[Thu May 07 23:18:10.226546 2026] [:error] [pid 28098:tid 28110] [client 158.173.67.227:26499] [client 158.173.67.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "afytMsvhwfljlt8trSo2HAAAAEo"]
[Thu May 07 23:59:33.648038 2026] [:error] [pid 28098:tid 28121] [client 136.112.241.76:50786] [client 136.112.241.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.241.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afy25cvhwfljlt8trSo5MAAAAFU"]
[Thu May 07 23:59:36.379473 2026] [:error] [pid 28098:tid 28102] [client 136.112.241.76:50786] [client 136.112.241.76] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "afy26Mvhwfljlt8trSo5NAAAAEI"]
[Thu May 07 23:59:36.604770 2026] [:error] [pid 28098:tid 28106] [client 136.112.241.76:50786] [client 136.112.241.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.241.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afy26Mvhwfljlt8trSo5NQAAAEY"]
[Thu May 07 23:59:37.967882 2026] [:error] [pid 28098:tid 28105] [client 136.112.241.76:58492] [client 136.112.241.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.241.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afy26cvhwfljlt8trSo5OQAAAEU"]
[Thu May 07 23:59:39.311401 2026] [:error] [pid 15629:tid 15648] [client 136.112.241.76:59317] [client 136.112.241.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.241.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afy26_rIJCALdUrO43mX_wAAAA8"]
[Thu May 07 23:59:40.640575 2026] [:error] [pid 15715:tid 15732] [client 136.112.241.76:60152] [client 136.112.241.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.241.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afy27CY4dZsLOttMkcfgVwAAAQw"]
[Thu May 07 23:59:42.112070 2026] [:error] [pid 15715:tid 15737] [client 136.112.241.76:61041] [client 136.112.241.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.112.241.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afy27iY4dZsLOttMkcfgWQAAARE"]
[Thu May 07 23:59:42.112297 2026] [:error] [pid 15715:tid 15737] [client 136.112.241.76:61041] [client 136.112.241.76] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 136.112.241.76, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "afy27iY4dZsLOttMkcfgWQAAARE"]
[Fri May 08 03:35:18.208788 2026] [:error] [pid 20906:tid 20978] [client 34.17.109.130:46560] [client 34.17.109.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "afzpdv145ZP3PR5_M8S1uwAAAIg"]
[Fri May 08 05:15:17.887198 2026] [:error] [pid 34318:tid 34332] [client 43.157.179.227:59192] [client 43.157.179.227] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "af0A5cr3guirgJiKhzA91AAAAQw"]
[Fri May 08 05:53:15.107286 2026] [:error] [pid 51113:tid 51120] [client 74.7.227.10:44106] [client 74.7.227.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.7.227.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af0Jy0Qfs7sWtqkpQIcZUAAAAMU"], referer: https://expressinteriors.com/
[Fri May 08 05:53:35.168111 2026] [:error] [pid 34318:tid 34321] [client 74.7.227.10:43964] [client 74.7.227.10] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "af0J38r3guirgJiKhzBigAAAAQE"], referer: https://expressinteriors.com/author/acs/
[Fri May 08 05:53:40.005217 2026] [:error] [pid 34318:tid 34340] [client 74.7.227.10:43964] [client 74.7.227.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.7.227.10, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af0J5Mr3guirgJiKhzBikQAAARQ"], referer: https://expressinteriors.com/2023/02/27/hello-world/
[Fri May 08 06:54:35.396541 2026] [:error] [pid 61317:tid 61323] [client 123.207.65.62:37860] [client 123.207.65.62] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "af0YK8-fFk_CedOCOYstigAAAUM"]
[Fri May 08 11:10:28.909970 2026] [:error] [pid 61356:tid 61401] [client 104.234.19.72:60311] [client 104.234.19.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.19.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af1UJIx3vpB8oWhUq2PfRgAAAc0"]
[Fri May 08 11:46:04.721327 2026] [:error] [pid 51007:tid 51042] [client 4.193.137.131:29833] [client 4.193.137.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "af1cfFMagSGstWKyzzWwqQAAABQ"]
[Fri May 08 11:46:05.096963 2026] [:error] [pid 51008:tid 51055] [client 4.193.137.131:10406] [client 4.193.137.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "af1cfXB58C2Y1tgLtuJXfwAAAEY"]
[Fri May 08 11:46:05.451439 2026] [:error] [pid 61317:tid 61341] [client 4.193.137.131:10385] [client 4.193.137.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "af1cfc-fFk_CedOCOYtxYgAAAVU"]
[Fri May 08 11:46:05.828308 2026] [:error] [pid 61356:tid 61393] [client 4.193.137.131:10375] [client 4.193.137.131] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfa.php"] [unique_id "af1cfYx3vpB8oWhUq2PmvgAAAcU"]
[Fri May 08 12:57:12.303001 2026] [:error] [pid 61317:tid 61336] [client 95.159.25.143:6552] [client 95.159.25.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.159.25.143, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af1tKM-fFk_CedOCOYt7MQAAAVA"]
[Fri May 08 12:59:03.295739 2026] [:error] [pid 61355:tid 61371] [client 95.159.25.143:7823] [client 95.159.25.143] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "af1tl_khJTi30CBXmMk3gQAAAYo"]
[Fri May 08 12:59:49.261823 2026] [:error] [pid 61355:tid 61368] [client 95.159.25.143:8445] [client 95.159.25.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.159.25.143, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af1txfkhJTi30CBXmMk3nQAAAYc"]
[Fri May 08 13:00:24.436008 2026] [:error] [pid 61355:tid 61368] [client 95.159.25.143:8888] [client 95.159.25.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.159.25.143, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af1t6PkhJTi30CBXmMk3yAAAAYc"]
[Fri May 08 13:00:55.743334 2026] [:error] [pid 61355:tid 61375] [client 95.159.25.143:9315] [client 95.159.25.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.159.25.143, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af1uB_khJTi30CBXmMk36AAAAY4"]
[Fri May 08 13:01:26.197021 2026] [:error] [pid 51008:tid 51058] [client 95.159.25.143:9752] [client 95.159.25.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.159.25.143, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af1uJnB58C2Y1tgLtuJfmQAAAEk"]
[Fri May 08 14:05:47.422188 2026] [:error] [pid 51009:tid 51094] [client 92.205.25.61:38230] [client 92.205.25.61] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "af19O-B0GbUWhxgzX9XlgAAAAJI"]
[Fri May 08 14:31:35.935271 2026] [:error] [pid 51009:tid 51076] [client 34.32.7.127:48074] [client 34.32.7.127] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "af2DR-B0GbUWhxgzX9XsYAAAAIA"]
[Fri May 08 15:28:57.181613 2026] [:error] [pid 61355:tid 61384] [client 34.122.144.100:63039] [client 34.122.144.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "af2QufkhJTi30CBXmMleqgAAAZc"]
[Fri May 08 15:28:57.634033 2026] [:error] [pid 61355:tid 61383] [client 34.122.144.100:62602] [client 34.122.144.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "af2QufkhJTi30CBXmMletgAAAZY"]
[Fri May 08 15:28:58.088510 2026] [:error] [pid 51009:tid 51083] [client 34.122.144.100:60215] [client 34.122.144.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "af2QuuB0GbUWhxgzX9X4vwAAAIc"]
[Fri May 08 15:52:46.435653 2026] [:error] [pid 51113:tid 51129] [client 141.94.139.189:60540] [client 141.94.139.189] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "af2WTkQfs7sWtqkpQIde5AAAAM4"]
[Fri May 08 16:21:47.016545 2026] [:error] [pid 61317:tid 61323] [client 193.36.224.201:20197] [client 193.36.224.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.224.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af2dG8-fFk_CedOCOYuaSgAAAUM"]
[Fri May 08 16:26:12.057754 2026] [:error] [pid 51009:tid 51083] [client 170.106.167.214:41672] [client 170.106.167.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "af2eJOB0GbUWhxgzX9UAKAAAAIc"]
[Fri May 08 16:56:41.180369 2026] [:error] [pid 61356:tid 61404] [client 104.234.19.70:53259] [client 104.234.19.70] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.19.70, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af2lSYx3vpB8oWhUq2NPPQAAAdA"]
[Fri May 08 17:29:46.803163 2026] [:error] [pid 51009:tid 51097] [client 193.36.224.205:32887] [client 193.36.224.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.224.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af2tCuB0GbUWhxgzX9UMnwAAAJU"]
[Fri May 08 18:03:08.506560 2026] [:error] [pid 51009:tid 51085] [client 216.24.219.5:32525] [client 216.24.219.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.219.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af203OB0GbUWhxgzX9UUrwAAAIk"]
[Fri May 08 18:15:30.451124 2026] [:error] [pid 61317:tid 61325] [client 103.127.218.15:1400] [client 103.127.218.15] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "af23ws-fFk_CedOCOYutKgAAAUU"]
[Fri May 08 18:36:36.484876 2026] [:error] [pid 51008:tid 51066] [client 193.36.224.80:34577] [client 193.36.224.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.224.80, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af28tHB58C2Y1tgLtuKOuQAAAFE"]
[Fri May 08 18:46:40.550844 2026] [:error] [pid 61355:tid 61366] [client 172.70.247.169:10979] [client 172.70.247.169] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "af2_EPkhJTi30CBXmMmSsQAAAYU"]
[Fri May 08 18:57:23.695192 2026] [:error] [pid 61356:tid 61394] [client 129.211.172.249:43536] [client 129.211.172.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "af3Bk4x3vpB8oWhUq2ODWgAAAcY"]
[Fri May 08 19:10:24.289760 2026] [:error] [pid 51007:tid 51041] [client 136.144.19.174:37259] [client 136.144.19.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.19.174, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af3EoFMagSGstWKyzzXhbgAAABM"]
[Fri May 08 19:43:26.141522 2026] [:error] [pid 61355:tid 61373] [client 136.144.19.175:64111] [client 136.144.19.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.19.175, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af3MXvkhJTi30CBXmMmj1gAAAYw"]
[Fri May 08 20:02:37.676658 2026] [:error] [pid 61317:tid 61332] [client 103.16.31.25:64994] [client 103.16.31.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.16.31.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af3Q3c-fFk_CedOCOYvCxAAAAUw"]
[Fri May 08 20:02:48.651954 2026] [:error] [pid 51008:tid 51051] [client 103.16.31.25:64987] [client 103.16.31.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.16.31.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af3Q6HB58C2Y1tgLtuKd9gAAAEI"]
[Fri May 08 20:02:59.354481 2026] [:error] [pid 51008:tid 51060] [client 103.16.31.25:64899] [client 103.16.31.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.16.31.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af3Q83B58C2Y1tgLtuKd-wAAAEs"]
[Fri May 08 20:03:10.851667 2026] [:error] [pid 61356:tid 61408] [client 103.16.31.25:64964] [client 103.16.31.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.16.31.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af3Q_ox3vpB8oWhUq2OhfwAAAdQ"]
[Fri May 08 20:03:21.926858 2026] [:error] [pid 51009:tid 51092] [client 103.16.31.25:65002] [client 103.16.31.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.16.31.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af3RCeB0GbUWhxgzX9U4agAAAJA"]
[Fri May 08 20:17:53.197269 2026] [:error] [pid 51113:tid 51115] [client 216.24.219.8:46083] [client 216.24.219.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.219.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af3UcUQfs7sWtqkpQId3wQAAAMA"]
[Fri May 08 20:51:06.446324 2026] [:error] [pid 61356:tid 61411] [client 193.36.224.25:39555] [client 193.36.224.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.224.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af3cOox3vpB8oWhUq2O02wAAAdc"]
[Fri May 08 21:24:46.570360 2026] [:error] [pid 51113:tid 51123] [client 136.144.19.174:24141] [client 136.144.19.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.19.174, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af3kHkQfs7sWtqkpQId_owAAAMg"]
[Fri May 08 21:38:52.590432 2026] [:error] [pid 61355:tid 61382] [client 167.172.147.84:58591] [client 167.172.147.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.147.84, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af3nbPkhJTi30CBXmMnGXAAAAZU"]
[Fri May 08 21:38:54.468331 2026] [:error] [pid 34318:tid 34330] [client 167.172.147.84:58820] [client 167.172.147.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.147.84, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af3nbsr3guirgJiKhzDj0AAAAQo"]
[Fri May 08 21:47:22.882260 2026] [:error] [pid 61355:tid 61374] [client 136.116.225.242:59342] [client 136.116.225.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.116.225.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af3pavkhJTi30CBXmMnI3wAAAY0"]
[Fri May 08 21:47:25.056519 2026] [:error] [pid 61355:tid 61384] [client 136.116.225.242:59342] [client 136.116.225.242] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "af3pbfkhJTi30CBXmMnI4gAAAZc"]
[Fri May 08 21:47:25.281979 2026] [:error] [pid 61355:tid 61363] [client 136.116.225.242:59342] [client 136.116.225.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.116.225.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af3pbfkhJTi30CBXmMnI4wAAAYI"]
[Fri May 08 21:47:26.655411 2026] [:error] [pid 34318:tid 34327] [client 136.116.225.242:51749] [client 136.116.225.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.116.225.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af3pbsr3guirgJiKhzDkogAAAQc"]
[Fri May 08 21:47:26.659228 2026] [:error] [pid 34318:tid 34327] [client 136.116.225.242:51749] [client 136.116.225.242] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/usr/local/apache/modsecurity-cwaf/rules/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 136.116.225.242 (+1 hits since last alert)|expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af3pbsr3guirgJiKhzDkogAAAQc"]
[Fri May 08 21:58:09.678515 2026] [:error] [pid 61355:tid 61373] [client 193.36.224.25:53497] [client 193.36.224.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.224.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af3r8fkhJTi30CBXmMnLbQAAAYw"]
[Fri May 08 22:15:33.450606 2026] [:error] [pid 61317:tid 61326] [client 167.172.147.84:52292] [client 167.172.147.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.147.84, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af3wBc-fFk_CedOCOYvc1gAAAUY"]
[Fri May 08 22:28:01.254442 2026] [:error] [pid 51009:tid 51100] [client 167.172.147.84:63928] [client 167.172.147.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.147.84, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af3y8eB0GbUWhxgzX9VcxQAAAJg"]
[Fri May 08 22:31:24.650543 2026] [:error] [pid 51009:tid 51091] [client 216.24.219.5:27739] [client 216.24.219.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.219.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af3zvOB0GbUWhxgzX9VdyAAAAI8"]
[Fri May 08 22:37:14.545711 2026] [:error] [pid 61355:tid 61378] [client 20.48.164.116:4943] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "af31GvkhJTi30CBXmMnaLgAAAZE"]
[Fri May 08 22:37:15.000854 2026] [:error] [pid 34318:tid 34335] [client 20.48.164.116:44357] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "af31G8r3guirgJiKhzDqpwAAAQ8"]
[Fri May 08 22:37:15.451401 2026] [:error] [pid 61356:tid 61389] [client 20.48.164.116:32036] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "af31G4x3vpB8oWhUq2PmFwAAAcE"]
[Fri May 08 22:37:15.890764 2026] [:error] [pid 51009:tid 51077] [client 20.48.164.116:4234] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "af31G-B0GbUWhxgzX9VfdwAAAIE"]
[Fri May 08 22:37:16.323168 2026] [:error] [pid 51008:tid 51062] [client 20.48.164.116:47057] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "af31HHB58C2Y1tgLtuK4KQAAAE0"]
[Fri May 08 22:37:16.764557 2026] [:error] [pid 61317:tid 61335] [client 20.48.164.116:22139] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "af31HM-fFk_CedOCOYvhIwAAAU8"]
[Fri May 08 22:37:17.205617 2026] [:error] [pid 61317:tid 61322] [client 20.48.164.116:31599] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "af31Hc-fFk_CedOCOYvhJAAAAUI"]
[Fri May 08 22:37:17.654035 2026] [:error] [pid 51009:tid 51100] [client 20.48.164.116:32044] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "af31HeB0GbUWhxgzX9VfegAAAJg"]
[Fri May 08 22:37:18.100999 2026] [:error] [pid 34318:tid 34338] [client 20.48.164.116:28936] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "af31Hsr3guirgJiKhzDqrAAAARI"]
[Fri May 08 22:37:18.559137 2026] [:error] [pid 61356:tid 61398] [client 20.48.164.116:4284] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "af31Hox3vpB8oWhUq2PmHgAAAco"]
[Fri May 08 22:37:19.010151 2026] [:error] [pid 51007:tid 51029] [client 20.48.164.116:31555] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "af31H1MagSGstWKyzzX_tgAAAAc"]
[Fri May 08 22:37:19.449851 2026] [:error] [pid 61356:tid 61410] [client 20.48.164.116:42417] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "af31H4x3vpB8oWhUq2PmIgAAAdY"]
[Fri May 08 22:37:19.932046 2026] [:error] [pid 51009:tid 51088] [client 20.48.164.116:4965] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "af31H-B0GbUWhxgzX9VffgAAAIw"]
[Fri May 08 22:37:20.444412 2026] [:error] [pid 61355:tid 61361] [client 20.48.164.116:32041] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "af31IPkhJTi30CBXmMnaLwAAAYA"]
[Fri May 08 22:37:20.962193 2026] [:error] [pid 51009:tid 51085] [client 20.48.164.116:44361] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "af31IOB0GbUWhxgzX9VfgAAAAIk"]
[Fri May 08 22:37:21.463453 2026] [:error] [pid 61356:tid 61395] [client 20.48.164.116:4983] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "af31IYx3vpB8oWhUq2PmKQAAAcc"]
[Fri May 08 22:37:21.930551 2026] [:error] [pid 61317:tid 61321] [client 20.48.164.116:44371] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "af31Ic-fFk_CedOCOYvhKAAAAUE"]
[Fri May 08 22:37:22.393806 2026] [:error] [pid 61356:tid 61396] [client 20.48.164.116:44409] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "af31Iox3vpB8oWhUq2PmMAAAAcg"]
[Fri May 08 22:37:22.856864 2026] [:error] [pid 51113:tid 51138] [client 20.48.164.116:4939] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "af31IkQfs7sWtqkpQIeG_wAAANc"]
[Fri May 08 22:37:23.285069 2026] [:error] [pid 51008:tid 51073] [client 20.48.164.116:32012] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "af31I3B58C2Y1tgLtuK4MQAAAFg"]
[Fri May 08 22:37:23.711996 2026] [:error] [pid 61356:tid 61402] [client 20.48.164.116:4620] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/revealability.php"] [unique_id "af31I4x3vpB8oWhUq2PmNgAAAc4"]
[Fri May 08 22:37:24.168560 2026] [:error] [pid 51009:tid 51082] [client 20.48.164.116:44413] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/revealability.php"] [unique_id "af31JOB0GbUWhxgzX9VfhQAAAIY"]
[Fri May 08 22:37:24.628157 2026] [:error] [pid 61356:tid 61388] [client 20.48.164.116:31561] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/revealability.php"] [unique_id "af31JIx3vpB8oWhUq2PmOwAAAcA"]
[Fri May 08 22:37:25.089277 2026] [:error] [pid 51009:tid 51092] [client 20.48.164.116:41138] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/revealability.php"] [unique_id "af31JeB0GbUWhxgzX9VfiAAAAJA"]
[Fri May 08 22:37:25.510246 2026] [:error] [pid 51008:tid 51054] [client 20.48.164.116:31562] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "af31JXB58C2Y1tgLtuK4NgAAAEU"]
[Fri May 08 22:37:25.936536 2026] [:error] [pid 51009:tid 51088] [client 20.48.164.116:26217] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "af31JeB0GbUWhxgzX9VfiwAAAIw"]
[Fri May 08 22:37:26.364782 2026] [:error] [pid 51009:tid 51077] [client 20.48.164.116:4239] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "af31JuB0GbUWhxgzX9VfkAAAAIE"]
[Fri May 08 22:37:26.807460 2026] [:error] [pid 51009:tid 51078] [client 20.48.164.116:4481] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "af31JuB0GbUWhxgzX9VfkgAAAII"]
[Fri May 08 22:37:27.263801 2026] [:error] [pid 61356:tid 61402] [client 20.48.164.116:22098] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "af31J4x3vpB8oWhUq2PmQgAAAc4"]
[Fri May 08 22:37:27.712254 2026] [:error] [pid 61355:tid 61370] [client 20.48.164.116:4524] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "af31J_khJTi30CBXmMnaMQAAAYk"]
[Fri May 08 22:37:28.150669 2026] [:error] [pid 61356:tid 61408] [client 20.48.164.116:4224] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "af31KIx3vpB8oWhUq2PmRwAAAdQ"]
[Fri May 08 22:37:28.562982 2026] [:error] [pid 61356:tid 61404] [client 20.48.164.116:34661] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "af31KIx3vpB8oWhUq2PmTAAAAdA"]
[Fri May 08 22:37:29.001067 2026] [:error] [pid 51008:tid 51049] [client 20.48.164.116:42371] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "af31KXB58C2Y1tgLtuK4OAAAAEA"]
[Fri May 08 22:37:29.422596 2026] [:error] [pid 61355:tid 61374] [client 20.48.164.116:22128] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "af31KfkhJTi30CBXmMnaNQAAAY0"]
[Fri May 08 22:37:29.855427 2026] [:error] [pid 51008:tid 51059] [client 20.48.164.116:47092] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "af31KXB58C2Y1tgLtuK4PAAAAEo"]
[Fri May 08 22:37:30.294554 2026] [:error] [pid 51008:tid 51073] [client 20.48.164.116:4493] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "af31KnB58C2Y1tgLtuK4PwAAAFg"]
[Fri May 08 22:37:30.709404 2026] [:error] [pid 51007:tid 51038] [client 20.48.164.116:32009] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/forbidals.php"] [unique_id "af31KlMagSGstWKyzzX_wwAAABA"]
[Fri May 08 22:37:31.125075 2026] [:error] [pid 51113:tid 51120] [client 20.48.164.116:28989] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/forbidals.php"] [unique_id "af31K0Qfs7sWtqkpQIeHBAAAAMU"]
[Fri May 08 22:37:31.545476 2026] [:error] [pid 51007:tid 51028] [client 20.48.164.116:31590] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/forbidals.php"] [unique_id "af31K1MagSGstWKyzzX_xQAAAAY"]
[Fri May 08 22:37:32.000833 2026] [:error] [pid 61355:tid 61372] [client 20.48.164.116:4492] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/forbidals.php"] [unique_id "af31K_khJTi30CBXmMnaNgAAAYs"]
[Fri May 08 22:37:32.470130 2026] [:error] [pid 61317:tid 61332] [client 20.48.164.116:4267] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-firewall.php"] [unique_id "af31LM-fFk_CedOCOYvhLAAAAUw"]
[Fri May 08 22:37:32.930967 2026] [:error] [pid 61355:tid 61366] [client 20.48.164.116:47060] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-firewall.php"] [unique_id "af31LPkhJTi30CBXmMnaOgAAAYU"]
[Fri May 08 22:37:33.380193 2026] [:error] [pid 51008:tid 51056] [client 20.48.164.116:31558] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-firewall.php"] [unique_id "af31LXB58C2Y1tgLtuK4RAAAAEc"]
[Fri May 08 22:37:33.802664 2026] [:error] [pid 51007:tid 51043] [client 20.48.164.116:26224] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-firewall.php"] [unique_id "af31LVMagSGstWKyzzX_yAAAABU"]
[Fri May 08 22:37:34.264032 2026] [:error] [pid 51113:tid 51124] [client 20.48.164.116:26178] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "af31LkQfs7sWtqkpQIeHBwAAAMk"]
[Fri May 08 22:37:34.717548 2026] [:error] [pid 51008:tid 51057] [client 20.48.164.116:44400] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "af31LnB58C2Y1tgLtuK4RgAAAEg"]
[Fri May 08 22:37:35.170869 2026] [:error] [pid 61317:tid 61343] [client 20.48.164.116:28934] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "af31L8-fFk_CedOCOYvhMQAAAVc"]
[Fri May 08 22:37:35.654982 2026] [:error] [pid 34318:tid 34326] [client 20.48.164.116:22121] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "af31L8r3guirgJiKhzDqwQAAAQY"]
[Fri May 08 22:37:36.119532 2026] [:error] [pid 61355:tid 61361] [client 20.48.164.116:4278] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wuasr.php"] [unique_id "af31MPkhJTi30CBXmMnaPQAAAYA"]
[Fri May 08 22:37:36.541603 2026] [:error] [pid 51009:tid 51095] [client 20.48.164.116:4610] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wuasr.php"] [unique_id "af31MOB0GbUWhxgzX9VflAAAAJM"]
[Fri May 08 22:37:36.963374 2026] [:error] [pid 51009:tid 51076] [client 20.48.164.116:44359] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wuasr.php"] [unique_id "af31MOB0GbUWhxgzX9VflwAAAIA"]
[Fri May 08 22:37:37.417418 2026] [:error] [pid 61355:tid 61370] [client 20.48.164.116:4248] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wuasr.php"] [unique_id "af31MfkhJTi30CBXmMnaPwAAAYk"]
[Fri May 08 22:37:37.902374 2026] [:error] [pid 61355:tid 61364] [client 20.48.164.116:43130] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1index.php"] [unique_id "af31MfkhJTi30CBXmMnaQQAAAYM"]
[Fri May 08 22:37:38.351527 2026] [:error] [pid 61317:tid 61333] [client 20.48.164.116:22093] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1index.php"] [unique_id "af31Ms-fFk_CedOCOYvhNQAAAU0"]
[Fri May 08 22:37:38.778085 2026] [:error] [pid 61356:tid 61392] [client 20.48.164.116:4984] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1index.php"] [unique_id "af31Mox3vpB8oWhUq2PmVAAAAcQ"]
[Fri May 08 22:37:39.198283 2026] [:error] [pid 51007:tid 51023] [client 20.48.164.116:4256] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1index.php"] [unique_id "af31M1MagSGstWKyzzX_zgAAAAE"]
[Fri May 08 22:37:39.643595 2026] [:error] [pid 61356:tid 61395] [client 20.48.164.116:31563] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/png.php"] [unique_id "af31M4x3vpB8oWhUq2PmVQAAAcc"]
[Fri May 08 22:37:40.099356 2026] [:error] [pid 61355:tid 61378] [client 20.48.164.116:31592] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/png.php"] [unique_id "af31NPkhJTi30CBXmMnaSwAAAZE"]
[Fri May 08 22:37:40.537869 2026] [:error] [pid 61356:tid 61394] [client 20.48.164.116:4255] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/png.php"] [unique_id "af31NIx3vpB8oWhUq2PmVgAAAcY"]
[Fri May 08 22:37:40.973182 2026] [:error] [pid 61355:tid 61364] [client 20.48.164.116:22126] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/png.php"] [unique_id "af31NPkhJTi30CBXmMnaTgAAAYM"]
[Fri May 08 22:37:41.400257 2026] [:error] [pid 61355:tid 61374] [client 20.48.164.116:47101] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "af31NfkhJTi30CBXmMnaTwAAAY0"]
[Fri May 08 22:37:41.825731 2026] [:error] [pid 61317:tid 61325] [client 20.48.164.116:41088] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "af31Nc-fFk_CedOCOYvhOAAAAUU"]
[Fri May 08 22:37:42.251653 2026] [:error] [pid 34318:tid 34326] [client 20.48.164.116:47077] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "af31Nsr3guirgJiKhzDqxwAAAQY"]
[Fri May 08 22:37:42.671842 2026] [:error] [pid 34318:tid 34340] [client 20.48.164.116:4489] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "af31Nsr3guirgJiKhzDqyAAAARQ"]
[Fri May 08 22:37:43.090186 2026] [:error] [pid 61317:tid 61344] [client 20.48.164.116:58554] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "af31N8-fFk_CedOCOYvhOQAAAVg"]
[Fri May 08 22:37:43.511646 2026] [:error] [pid 61355:tid 61368] [client 20.48.164.116:43098] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "af31N_khJTi30CBXmMnaVAAAAYc"]
[Fri May 08 22:37:43.938135 2026] [:error] [pid 51113:tid 51126] [client 20.48.164.116:32039] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "af31N0Qfs7sWtqkpQIeHCQAAAMs"]
[Fri May 08 22:37:44.377317 2026] [:error] [pid 61355:tid 61361] [client 20.48.164.116:4542] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "af31OPkhJTi30CBXmMnaWQAAAYA"]
[Fri May 08 22:37:44.810316 2026] [:error] [pid 61355:tid 61385] [client 20.48.164.116:44391] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "af31OPkhJTi30CBXmMnaXgAAAZg"]
[Fri May 08 22:37:45.245402 2026] [:error] [pid 61356:tid 61412] [client 20.48.164.116:4511] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "af31OYx3vpB8oWhUq2PmVwAAAdg"]
[Fri May 08 22:37:45.688089 2026] [:error] [pid 61355:tid 61373] [client 20.48.164.116:44407] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "af31OfkhJTi30CBXmMnaYgAAAYw"]
[Fri May 08 22:37:46.135367 2026] [:error] [pid 51008:tid 51057] [client 20.48.164.116:31558] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "af31OnB58C2Y1tgLtuK4TAAAAEg"]
[Fri May 08 22:37:46.554903 2026] [:error] [pid 51008:tid 51061] [client 20.48.164.116:4485] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "af31OnB58C2Y1tgLtuK4TQAAAEw"]
[Fri May 08 22:37:46.978960 2026] [:error] [pid 61317:tid 61339] [client 20.48.164.116:4623] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "af31Os-fFk_CedOCOYvhPAAAAVM"]
[Fri May 08 22:37:47.400064 2026] [:error] [pid 61356:tid 61411] [client 20.48.164.116:4978] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "af31O4x3vpB8oWhUq2PmXQAAAdc"]
[Fri May 08 22:37:47.830866 2026] [:error] [pid 61317:tid 61335] [client 20.48.164.116:42370] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "af31O8-fFk_CedOCOYvhPwAAAU8"]
[Fri May 08 22:37:48.280200 2026] [:error] [pid 51008:tid 51064] [client 20.48.164.116:31575] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fun.php"] [unique_id "af31PHB58C2Y1tgLtuK4TwAAAE8"]
[Fri May 08 22:37:48.735882 2026] [:error] [pid 34318:tid 34320] [client 20.48.164.116:22108] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fun.php"] [unique_id "af31PMr3guirgJiKhzDqzgAAAQA"]
[Fri May 08 22:37:49.170933 2026] [:error] [pid 51008:tid 51058] [client 20.48.164.116:32056] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fun.php"] [unique_id "af31PXB58C2Y1tgLtuK4UQAAAEk"]
[Fri May 08 22:37:49.602724 2026] [:error] [pid 51009:tid 51085] [client 20.48.164.116:4226] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fun.php"] [unique_id "af31PeB0GbUWhxgzX9VfngAAAIk"]
[Fri May 08 22:37:50.012374 2026] [:error] [pid 61355:tid 61373] [client 20.48.164.116:42422] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "af31PvkhJTi30CBXmMnacAAAAYw"]
[Fri May 08 22:37:50.457123 2026] [:error] [pid 51008:tid 51071] [client 20.48.164.116:28972] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "af31PnB58C2Y1tgLtuK4VAAAAFY"]
[Fri May 08 22:37:50.921585 2026] [:error] [pid 61355:tid 61370] [client 20.48.164.116:28931] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "af31PvkhJTi30CBXmMnadQAAAYk"]
[Fri May 08 22:37:51.374320 2026] [:error] [pid 61355:tid 61380] [client 20.48.164.116:22110] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "af31P_khJTi30CBXmMnadwAAAZM"]
[Fri May 08 22:37:51.827920 2026] [:error] [pid 61355:tid 61364] [client 20.48.164.116:26203] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/explorer/index_.php"] [unique_id "af31P_khJTi30CBXmMnaeQAAAYM"]
[Fri May 08 22:37:52.242459 2026] [:error] [pid 61355:tid 61377] [client 20.48.164.116:22122] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/explorer/index_.php"] [unique_id "af31QPkhJTi30CBXmMnaegAAAZA"]
[Fri May 08 22:37:52.657331 2026] [:error] [pid 61356:tid 61392] [client 20.48.164.116:31568] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/explorer/index_.php"] [unique_id "af31QIx3vpB8oWhUq2PmZAAAAcQ"]
[Fri May 08 22:37:53.072554 2026] [:error] [pid 61356:tid 61412] [client 20.48.164.116:47078] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/explorer/index_.php"] [unique_id "af31QYx3vpB8oWhUq2PmZQAAAdg"]
[Fri May 08 22:37:53.493010 2026] [:error] [pid 61356:tid 61390] [client 20.48.164.116:28991] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "af31QYx3vpB8oWhUq2PmZwAAAcI"]
[Fri May 08 22:37:53.954150 2026] [:error] [pid 34318:tid 34329] [client 20.48.164.116:22103] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "af31Qcr3guirgJiKhzDq0AAAAQk"]
[Fri May 08 22:37:54.400076 2026] [:error] [pid 34318:tid 34340] [client 20.48.164.116:4504] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "af31Qsr3guirgJiKhzDq0QAAARQ"]
[Fri May 08 22:37:54.828182 2026] [:error] [pid 61356:tid 61404] [client 20.48.164.116:47058] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-trackback.php"] [unique_id "af31Qox3vpB8oWhUq2PmagAAAdA"]
[Fri May 08 22:37:55.253497 2026] [:error] [pid 61356:tid 61401] [client 20.48.164.116:4981] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "af31Q4x3vpB8oWhUq2PmawAAAc0"]
[Fri May 08 22:37:55.663639 2026] [:error] [pid 51113:tid 51120] [client 20.48.164.116:4286] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "af31Q0Qfs7sWtqkpQIeHDwAAAMU"]
[Fri May 08 22:37:56.100790 2026] [:error] [pid 51009:tid 51076] [client 20.48.164.116:32052] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "af31ROB0GbUWhxgzX9VfnwAAAIA"]
[Fri May 08 22:37:56.526852 2026] [:error] [pid 61317:tid 61328] [client 20.48.164.116:4950] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "af31RM-fFk_CedOCOYvhQQAAAUg"]
[Fri May 08 22:37:56.956279 2026] [:error] [pid 61356:tid 61407] [client 20.48.164.116:58481] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "af31RIx3vpB8oWhUq2PmbgAAAdM"]
[Fri May 08 22:37:57.376175 2026] [:error] [pid 61355:tid 61368] [client 20.48.164.116:28937] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "af31RfkhJTi30CBXmMnafwAAAYc"]
[Fri May 08 22:37:57.819120 2026] [:error] [pid 61356:tid 61401] [client 20.48.164.116:42410] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "af31RYx3vpB8oWhUq2PmfAAAAc0"]
[Fri May 08 22:37:58.275356 2026] [:error] [pid 51113:tid 51124] [client 20.48.164.116:58485] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "af31RkQfs7sWtqkpQIeHEQAAAMk"]
[Fri May 08 22:37:58.687168 2026] [:error] [pid 61356:tid 61400] [client 20.48.164.116:31586] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "af31Rox3vpB8oWhUq2PmjQAAAcw"]
[Fri May 08 22:37:59.107600 2026] [:error] [pid 61317:tid 61337] [client 20.48.164.116:44354] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "af31R8-fFk_CedOCOYvhRAAAAVE"]
[Fri May 08 22:37:59.522412 2026] [:error] [pid 61317:tid 61336] [client 20.48.164.116:34687] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "af31R8-fFk_CedOCOYvhRQAAAVA"]
[Fri May 08 22:37:59.940554 2026] [:error] [pid 61356:tid 61397] [client 20.48.164.116:32043] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "af31R4x3vpB8oWhUq2PmoQAAAck"]
[Fri May 08 22:38:00.356053 2026] [:error] [pid 61356:tid 61403] [client 20.48.164.116:4482] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "af31SIx3vpB8oWhUq2PmpgAAAc8"]
[Fri May 08 22:38:00.768173 2026] [:error] [pid 34318:tid 34336] [client 20.48.164.116:28975] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "af31SMr3guirgJiKhzDq0gAAARA"]
[Fri May 08 22:38:01.184865 2026] [:error] [pid 51008:tid 51060] [client 20.48.164.116:31595] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "af31SXB58C2Y1tgLtuK4XQAAAEs"]
[Fri May 08 22:38:01.637830 2026] [:error] [pid 51007:tid 51033] [client 20.48.164.116:44364] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "af31SVMagSGstWKyzzX_0gAAAAs"]
[Fri May 08 22:38:02.087784 2026] [:error] [pid 51007:tid 51034] [client 20.48.164.116:4959] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "af31SlMagSGstWKyzzX_0wAAAAw"]
[Fri May 08 22:38:02.507864 2026] [:error] [pid 51009:tid 51099] [client 20.48.164.116:4637] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "af31SuB0GbUWhxgzX9VfpQAAAJc"]
[Fri May 08 22:38:02.926511 2026] [:error] [pid 61356:tid 61397] [client 20.48.164.116:53723] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "af31Sox3vpB8oWhUq2PmsQAAAck"]
[Fri May 08 22:38:03.355999 2026] [:error] [pid 61356:tid 61409] [client 20.48.164.116:42373] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "af31S4x3vpB8oWhUq2PmswAAAdU"]
[Fri May 08 22:38:03.775817 2026] [:error] [pid 61356:tid 61392] [client 20.48.164.116:4957] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file59.php"] [unique_id "af31S4x3vpB8oWhUq2PmtwAAAcQ"]
[Fri May 08 22:38:04.221210 2026] [:error] [pid 61356:tid 61388] [client 20.48.164.116:4236] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file59.php"] [unique_id "af31TIx3vpB8oWhUq2PmvAAAAcA"]
[Fri May 08 22:38:04.644666 2026] [:error] [pid 51009:tid 51087] [client 20.48.164.116:22134] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file59.php"] [unique_id "af31TOB0GbUWhxgzX9VfqAAAAIs"]
[Fri May 08 22:38:05.054173 2026] [:error] [pid 34318:tid 34337] [client 20.48.164.116:4616] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file59.php"] [unique_id "af31Tcr3guirgJiKhzDq1AAAARE"]
[Fri May 08 22:38:05.482024 2026] [:error] [pid 51009:tid 51086] [client 20.48.164.116:4253] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "af31TeB0GbUWhxgzX9VfqQAAAIo"]
[Fri May 08 22:38:05.913960 2026] [:error] [pid 61356:tid 61397] [client 20.48.164.116:47048] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "af31TYx3vpB8oWhUq2PmwQAAAck"]
[Fri May 08 22:38:06.350270 2026] [:error] [pid 61355:tid 61384] [client 20.48.164.116:4644] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "af31TvkhJTi30CBXmMnarAAAAZc"]
[Fri May 08 22:38:06.774137 2026] [:error] [pid 61355:tid 61383] [client 20.48.164.116:22099] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "af31TvkhJTi30CBXmMnarQAAAZY"]
[Fri May 08 22:38:07.198170 2026] [:error] [pid 51009:tid 51083] [client 20.48.164.116:4638] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-at.php"] [unique_id "af31T-B0GbUWhxgzX9VfqgAAAIc"]
[Fri May 08 22:38:07.616574 2026] [:error] [pid 51009:tid 51076] [client 20.48.164.116:58486] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-at.php"] [unique_id "af31T-B0GbUWhxgzX9VfrQAAAIA"]
[Fri May 08 22:38:08.070529 2026] [:error] [pid 51009:tid 51084] [client 20.48.164.116:30522] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-at.php"] [unique_id "af31UOB0GbUWhxgzX9VfrgAAAIg"]
[Fri May 08 22:38:08.557194 2026] [:error] [pid 51009:tid 51090] [client 20.48.164.116:4949] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-at.php"] [unique_id "af31UOB0GbUWhxgzX9VfrwAAAI4"]
[Fri May 08 22:38:09.040776 2026] [:error] [pid 61355:tid 61361] [client 20.48.164.116:4539] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "af31UfkhJTi30CBXmMnatQAAAYA"]
[Fri May 08 22:38:09.506302 2026] [:error] [pid 61355:tid 61381] [client 20.48.164.116:42388] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "af31UfkhJTi30CBXmMnatgAAAZQ"]
[Fri May 08 22:38:09.919002 2026] [:error] [pid 51008:tid 51059] [client 20.48.164.116:26180] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "af31UXB58C2Y1tgLtuK4YgAAAEo"]
[Fri May 08 22:38:10.414659 2026] [:error] [pid 51008:tid 51063] [client 20.48.164.116:26179] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "af31UnB58C2Y1tgLtuK4ZAAAAE4"]
[Fri May 08 22:38:10.878248 2026] [:error] [pid 34318:tid 34322] [client 20.48.164.116:4246] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sys.php"] [unique_id "af31Usr3guirgJiKhzDq1gAAAQI"]
[Fri May 08 22:38:11.340898 2026] [:error] [pid 51007:tid 51032] [client 20.48.164.116:31612] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sys.php"] [unique_id "af31U1MagSGstWKyzzX_2QAAAAo"]
[Fri May 08 22:38:11.786109 2026] [:error] [pid 51008:tid 51073] [client 20.48.164.116:4283] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sys.php"] [unique_id "af31U3B58C2Y1tgLtuK4aQAAAFg"]
[Fri May 08 22:38:12.268080 2026] [:error] [pid 51113:tid 51123] [client 20.48.164.116:26238] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sys.php"] [unique_id "af31VEQfs7sWtqkpQIeHGAAAAMg"]
[Fri May 08 22:38:12.721479 2026] [:error] [pid 51113:tid 51131] [client 20.48.164.116:4283] [client 20.48.164.116] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "af31VEQfs7sWtqkpQIeHGgAAANA"]
[Fri May 08 22:40:30.886805 2026] [:error] [pid 61355:tid 61376] [client 167.172.147.84:58221] [client 167.172.147.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.147.84, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af313vkhJTi30CBXmMnbZQAAAY8"]
[Fri May 08 23:04:30.746814 2026] [:error] [pid 61317:tid 61338] [client 136.144.19.5:32415] [client 136.144.19.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.19.5, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af37fs-fFk_CedOCOYvmgwAAAVI"]
[Fri May 08 23:37:20.530108 2026] [:error] [pid 51008:tid 51056] [client 136.144.19.43:53745] [client 136.144.19.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.19.43, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af4DMHB58C2Y1tgLtuLC3gAAAEc"]
[Sat May 09 00:09:46.585824 2026] [:error] [pid 51009:tid 51082] [client 136.144.19.47:57089] [client 136.144.19.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.19.47, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af4KyuB0GbUWhxgzX9V0sAAAAIY"]
[Sat May 09 00:42:10.129051 2026] [:error] [pid 61355:tid 61381] [client 193.36.224.203:31097] [client 193.36.224.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.224.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af4SYvkhJTi30CBXmMkMIQAAAZQ"]
[Sat May 09 00:59:11.282140 2026] [:error] [pid 61355:tid 61372] [client 49.51.243.156:34114] [client 49.51.243.156] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "af4WX_khJTi30CBXmMkUmwAAAYs"]
[Sat May 09 01:20:21.619024 2026] [:error] [pid 61317:tid 61329] [client 54.176.28.156:57788] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "af4bVc-fFk_CedOCOYsHsQAAAUk"]
[Sat May 09 01:20:23.785355 2026] [:error] [pid 61356:tid 61397] [client 54.176.28.156:57792] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env/.env.local/.env.production/.env.staging/.env.development/.env.test/.env.remote/.env.bak/.env.backup/.env.save/.env.old/.env.sample/.env.example/.env.dev/.env.prod/.env.stage/.env.ci/.env.docker/.env.live/.env.preprod/.env.uat/.env.dist/.env.swp/.env~/.env1/.env2/.env_copy/.env.txt/.env.json/.env.yaml/.env.yml/app/.env/apps/.env/api/.env/web/.env/site/.env/public/.env/admin/.env/backend/.env/server/.env/frontend/.env/src/.env/core/.env/core/app/.env/config/.env/private/.env/application/.env/bootstrap/.env/database/.env/storage/.env/var/www/.env/var/www/html/.env/current/.env/release/.env/releases/.env/shared/.env/deploy/.env/build/.env/dist/.env/public_html/.env/htdocs/.env/www/.env/html/.env/live/.env/prod/.env/dev/.env/staging/.env/opt/.env/laravel/.env/symfony/.env/wordpress/.env/wp/.env/cms/.env/drupal/.env/joomla/.env/magento/.env/shopify/.env/prestashop/.env/codeigniter/.env/cakephp/.env/zend/.env/yii/.env/laravel5/.env/v1/.env/v2/.env/v3/.env/api/v1/.env/api/v2/.env/rest/.env/graphql/.env/gateway/.env/microservice/.env/service/.env/api/v3/.env/api/dev/.env/api/staging/.env/vendor/.env/lib/.env/resources/.env/assets/.env/uploads/.env/internal/.env/tools/.env/scripts/.env/bin/.env/sbin/.env/local/.env/portal/.env/dashboard/.env/panel/.env/crm/.env/erp/.env/shop/.env/store/.env/saas/.env/client/.env/project/.env/admin-panel/.env/control-panel/.env/user-panel/.env/node/.env/express/.env/next/.env/nuxt/.env/nest/.env/react/.env/vue/.env/angular/.env/svelte/.env/vite/.env/backup/.env/backups/.env/old/.env/tmp/.env/temp/.env/lab/.env/cronlab/.env/cron/.env/en/.env/administrator/.env/psnlink/.env/exapi/.env/sitemaps/.env/.env.backup1/.env.backup2/logs/.env/cache/.env/mailer/.env/mail/.env/email/.env/smtp/.env/mailing/.env/notifications/.env/notify/.env/sender/.env/campaign/.env/newsletter/.env/ses/.env/sendgrid/.env/sparkpost/.env/postmark/.env/mailgun/.env/mandrill/.env/mailjet/.env/brevo/.env/transactional/.env/bulk/.env/aws/.env/azure/.env/gcp/.env/cloud/.env/infrastructure/.env/docker/.env/k8s/.env/kubernetes/.env/terraform/.env/ansible/.env/.git/.env/ci/.env/cd/.env/jenkins/.env/gitlab/.env/github/.env/actions/.env/circleci/.env/travis/.env/buildkite/.env/mysql/.env/postgres/.env/mongodb/.env/redis/.env/elasticsearch/.env/rabbitmq/.env/kafka/.env/queue/.env/worker/.env/job/.env/test/.env/qa/.env/preview/.env/beta/.env/uat/.env/stage/.env/development/.env/production/.env/config/app/.env"] [unique_id "af4bV4x3vpB8oWhUq2Mg4AAAAck"]
[Sat May 09 01:20:35.172167 2026] [:error] [pid 51008:tid 51051] [client 54.176.28.156:57800] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test/phpinfo.php"] [unique_id "af4bY3B58C2Y1tgLtuLWtwAAAEI"]
[Sat May 09 01:20:36.051741 2026] [:error] [pid 51009:tid 51089] [client 54.176.28.156:57642] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dev/phpinfo.php"] [unique_id "af4bZOB0GbUWhxgzX9WL8wAAAI0"]
[Sat May 09 01:20:36.840562 2026] [:error] [pid 51009:tid 51086] [client 54.176.28.156:57646] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/old/phpinfo.php"] [unique_id "af4bZOB0GbUWhxgzX9WL_QAAAIo"]
[Sat May 09 01:20:37.628806 2026] [:error] [pid 61356:tid 61411] [client 54.176.28.156:57652] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tmp/phpinfo.php"] [unique_id "af4bZYx3vpB8oWhUq2MhIwAAAdc"]
[Sat May 09 01:20:38.395938 2026] [:error] [pid 61317:tid 61331] [client 54.176.28.156:57654] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public/phpinfo.php"] [unique_id "af4bZs-fFk_CedOCOYsHxQAAAUs"]
[Sat May 09 01:20:39.171125 2026] [:error] [pid 61356:tid 61392] [client 54.176.28.156:57666] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info"] [unique_id "af4bZ4x3vpB8oWhUq2MhLQAAAcQ"]
[Sat May 09 01:20:40.000006 2026] [:error] [pid 61355:tid 61385] [client 54.176.28.156:57670] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/php-info.php"] [unique_id "af4bZ_khJTi30CBXmMkl5AAAAZg"]
[Sat May 09 01:20:40.801172 2026] [:error] [pid 61356:tid 61393] [client 54.176.28.156:57684] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/phpversion.php"] [unique_id "af4baIx3vpB8oWhUq2MhNAAAAcU"]
[Sat May 09 01:20:41.599465 2026] [:error] [pid 61356:tid 61397] [client 54.176.28.156:57700] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/_phpinfo.php"] [unique_id "af4baYx3vpB8oWhUq2MhOQAAAck"]
[Sat May 09 01:20:42.334221 2026] [:error] [pid 51007:tid 51026] [client 54.176.28.156:57708] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/old_phpinfo.php"] [unique_id "af4balMagSGstWKyzzUXbwAAAAQ"]
[Sat May 09 01:20:43.207591 2026] [:error] [pid 61355:tid 61380] [client 54.176.28.156:57714] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server-info.php"] [unique_id "af4ba_khJTi30CBXmMkl6AAAAZM"]
[Sat May 09 01:20:44.004303 2026] [:error] [pid 61356:tid 61393] [client 54.176.28.156:57724] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/server-status.php"] [unique_id "af4bbIx3vpB8oWhUq2MhQgAAAcU"]
[Sat May 09 01:20:44.827175 2026] [:error] [pid 34318:tid 34325] [client 54.176.28.156:57738] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/_profiler/phpinfo"] [unique_id "af4bbMr3guirgJiKhzABngAAAQU"]
[Sat May 09 01:20:45.577503 2026] [:error] [pid 61355:tid 61361] [client 54.176.28.156:41780] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/_environment"] [unique_id "af4bbfkhJTi30CBXmMkl-wAAAYA"]
[Sat May 09 01:20:46.446345 2026] [:error] [pid 61356:tid 61392] [client 54.176.28.156:41788] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/webroot/index.php/_environment"] [unique_id "af4bbox3vpB8oWhUq2MhSwAAAcQ"]
[Sat May 09 01:20:47.256945 2026] [:error] [pid 51008:tid 51072] [client 54.176.28.156:41798] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mail/phpinfo.php"] [unique_id "af4bb3B58C2Y1tgLtuLW2QAAAFc"]
[Sat May 09 01:20:48.160162 2026] [:error] [pid 51009:tid 51082] [client 54.176.28.156:41808] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cpanel/phpinfo.php"] [unique_id "af4bcOB0GbUWhxgzX9WMLQAAAIY"]
[Sat May 09 01:20:48.993566 2026] [:error] [pid 61317:tid 61328] [client 54.176.28.156:41824] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hosting/phpinfo.php"] [unique_id "af4bcM-fFk_CedOCOYsH0gAAAUg"]
[Sat May 09 01:20:49.858617 2026] [:error] [pid 51007:tid 51031] [client 54.176.28.156:41828] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/webmail/phpinfo.php"] [unique_id "af4bcVMagSGstWKyzzUXfAAAAAk"]
[Sat May 09 01:20:50.735621 2026] [:error] [pid 61317:tid 61326] [client 54.176.28.156:41842] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/smtp/phpinfo.php"] [unique_id "af4bcs-fFk_CedOCOYsH1wAAAUY"]
[Sat May 09 01:20:51.621212 2026] [:error] [pid 51009:tid 51093] [client 54.176.28.156:41854] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/phpinfo.php.bak"] [unique_id "af4bc-B0GbUWhxgzX9WMNwAAAJE"]
[Sat May 09 01:20:52.403014 2026] [:error] [pid 61355:tid 61367] [client 54.176.28.156:41860] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/phpinfo.php.old"] [unique_id "af4bdPkhJTi30CBXmMkmKQAAAYY"]
[Sat May 09 01:20:53.203224 2026] [:error] [pid 51009:tid 51078] [client 54.176.28.156:41864] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/phpinfo.php~"] [unique_id "af4bdeB0GbUWhxgzX9WMQgAAAII"]
[Sat May 09 01:20:54.004592 2026] [:error] [pid 61356:tid 61410] [client 54.176.28.156:41878] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php.bak"] [unique_id "af4bdox3vpB8oWhUq2MhZAAAAdY"]
[Sat May 09 01:20:54.730001 2026] [:error] [pid 51009:tid 51094] [client 54.176.28.156:41890] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/phpinfo.php.save"] [unique_id "af4bduB0GbUWhxgzX9WMUAAAAJI"]
[Sat May 09 01:20:55.532032 2026] [:error] [pid 61355:tid 61366] [client 54.176.28.156:59374] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/staging/phpinfo.php"] [unique_id "af4bd_khJTi30CBXmMkmNgAAAYU"]
[Sat May 09 01:20:56.315093 2026] [:error] [pid 51009:tid 51083] [client 54.176.28.156:59376] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/beta/phpinfo.php"] [unique_id "af4beOB0GbUWhxgzX9WMXQAAAIc"]
[Sat May 09 01:20:57.111116 2026] [:error] [pid 51007:tid 51025] [client 54.176.28.156:59392] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/uat/phpinfo.php"] [unique_id "af4beVMagSGstWKyzzUXhgAAAAM"]
[Sat May 09 01:20:57.980704 2026] [:error] [pid 51008:tid 51054] [client 54.176.28.156:59408] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/qa/phpinfo.php"] [unique_id "af4beXB58C2Y1tgLtuLW5wAAAEU"]
[Sat May 09 01:21:11.493369 2026] [:error] [pid 51007:tid 51046] [client 54.176.28.156:59424] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/preview/phpinfo.php"] [unique_id "af4bh1MagSGstWKyzzUXlgAAABg"]
[Sat May 09 01:21:12.610738 2026] [:error] [pid 61355:tid 61377] [client 54.176.28.156:48478] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/www/phpinfo.php"] [unique_id "af4biPkhJTi30CBXmMkmtAAAAZA"]
[Sat May 09 01:21:13.362746 2026] [:error] [pid 61317:tid 61338] [client 54.176.28.156:48488] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/htdocs/phpinfo.php"] [unique_id "af4bic-fFk_CedOCOYsH6AAAAVI"]
[Sat May 09 01:21:14.196921 2026] [:error] [pid 61317:tid 61331] [client 54.176.28.156:48504] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/public_html/phpinfo.php"] [unique_id "af4bis-fFk_CedOCOYsH7QAAAUs"]
[Sat May 09 01:21:15.010596 2026] [:error] [pid 61356:tid 61393] [client 54.176.28.156:48510] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/site/phpinfo.php"] [unique_id "af4bi4x3vpB8oWhUq2MhjgAAAcU"]
[Sat May 09 01:21:15.831728 2026] [:error] [pid 61356:tid 61396] [client 54.176.28.156:37092] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/docs/phpinfo.php"] [unique_id "af4bi4x3vpB8oWhUq2MhlAAAAcg"]
[Sat May 09 01:21:16.618026 2026] [:error] [pid 61355:tid 61364] [client 54.176.28.156:37106] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/phpinfo.php"] [unique_id "af4bjPkhJTi30CBXmMkmvAAAAYM"]
[Sat May 09 01:21:17.420460 2026] [:error] [pid 61355:tid 61362] [client 54.176.28.156:37110] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/administrator/phpinfo.php"] [unique_id "af4bjfkhJTi30CBXmMkmwgAAAYE"]
[Sat May 09 01:21:18.195458 2026] [:error] [pid 51009:tid 51096] [client 54.176.28.156:37126] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core/phpinfo.php"] [unique_id "af4bjuB0GbUWhxgzX9WMcAAAAJQ"]
[Sat May 09 01:21:18.962154 2026] [:error] [pid 61317:tid 61328] [client 54.176.28.156:37136] [client 54.176.28.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/includes/phpinfo.php"] [unique_id "af4bjs-fFk_CedOCOYsH9wAAAUg"]
[Sat May 09 01:29:58.844277 2026] [:error] [pid 51007:tid 51025] [client 35.189.85.80:40524] [client 35.189.85.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "af4dllMagSGstWKyzzUZxgAAAAM"]
[Sat May 09 01:54:29.538064 2026] [:error] [pid 61356:tid 61400] [client 54.167.80.127:38036] [client 54.167.80.127] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "af4jVYx3vpB8oWhUq2M1cAAAAcw"]
[Sat May 09 01:54:31.513889 2026] [:error] [pid 61355:tid 61379] [client 54.167.80.127:38038] [client 54.167.80.127] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env/.env.local/.env.production/.env.staging/.env.development/.env.test/.env.remote/.env.bak/.env.backup/.env.save/.env.old/.env.sample/.env.example/.env.dev/.env.prod/.env.stage/.env.ci/.env.docker/.env.live/.env.preprod/.env.uat/.env.dist/.env.swp/.env~/.env1/.env2/.env_copy/.env.txt/.env.json/.env.yaml/.env.yml/app/.env/apps/.env/api/.env/web/.env/site/.env/public/.env/admin/.env/backend/.env/server/.env/frontend/.env/src/.env/core/.env/core/app/.env/config/.env/private/.env/application/.env/bootstrap/.env/database/.env/storage/.env/var/www/.env/var/www/html/.env/current/.env/release/.env/releases/.env/shared/.env/deploy/.env/build/.env/dist/.env/public_html/.env/htdocs/.env/www/.env/html/.env/live/.env/prod/.env/dev/.env/staging/.env/opt/.env/laravel/.env/symfony/.env/wordpress/.env/wp/.env/cms/.env/drupal/.env/joomla/.env/magento/.env/shopify/.env/prestashop/.env/codeigniter/.env/cakephp/.env/zend/.env/yii/.env/laravel5/.env/v1/.env/v2/.env/v3/.env/api/v1/.env/api/v2/.env/rest/.env/graphql/.env/gateway/.env/microservice/.env/service/.env/api/v3/.env/api/dev/.env/api/staging/.env/vendor/.env/lib/.env/resources/.env/assets/.env/uploads/.env/internal/.env/tools/.env/scripts/.env/bin/.env/sbin/.env/local/.env/portal/.env/dashboard/.env/panel/.env/crm/.env/erp/.env/shop/.env/store/.env/saas/.env/client/.env/project/.env/admin-panel/.env/control-panel/.env/user-panel/.env/node/.env/express/.env/next/.env/nuxt/.env/nest/.env/react/.env/vue/.env/angular/.env/svelte/.env/vite/.env/backup/.env/backups/.env/old/.env/tmp/.env/temp/.env/lab/.env/cronlab/.env/cron/.env/en/.env/administrator/.env/psnlink/.env/exapi/.env/sitemaps/.env/.env.backup1/.env.backup2/logs/.env/cache/.env/mailer/.env/mail/.env/email/.env/smtp/.env/mailing/.env/notifications/.env/notify/.env/sender/.env/campaign/.env/newsletter/.env/ses/.env/sendgrid/.env/sparkpost/.env/postmark/.env/mailgun/.env/mandrill/.env/mailjet/.env/brevo/.env/transactional/.env/bulk/.env/aws/.env/azure/.env/gcp/.env/cloud/.env/infrastructure/.env/docker/.env/k8s/.env/kubernetes/.env/terraform/.env/ansible/.env/.git/.env/ci/.env/cd/.env/jenkins/.env/gitlab/.env/github/.env/actions/.env/circleci/.env/travis/.env/buildkite/.env/mysql/.env/postgres/.env/mongodb/.env/redis/.env/elasticsearch/.env/rabbitmq/.env/kafka/.env/queue/.env/worker/.env/job/.env/test/.env/qa/.env/preview/.env/beta/.env/uat/.env/stage/.env/development/.env/production/.env/config/app/.env"] [unique_id "af4jV_khJTi30CBXmMlF5wAAAZI"]
[Sat May 09 01:54:49.778553 2026] [:error] [pid 61355:tid 61384] [client 54.167.80.127:38044] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/test/phpinfo.php"] [unique_id "af4jafkhJTi30CBXmMlF9gAAAZc"]
[Sat May 09 01:54:50.606578 2026] [:error] [pid 61356:tid 61412] [client 54.167.80.127:44710] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/dev/phpinfo.php"] [unique_id "af4jaox3vpB8oWhUq2M1qgAAAdg"]
[Sat May 09 01:54:51.437161 2026] [:error] [pid 51009:tid 51082] [client 54.167.80.127:44712] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/old/phpinfo.php"] [unique_id "af4ja-B0GbUWhxgzX9WdWwAAAIY"]
[Sat May 09 01:54:52.268169 2026] [:error] [pid 51009:tid 51096] [client 54.167.80.127:44726] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/tmp/phpinfo.php"] [unique_id "af4jbOB0GbUWhxgzX9WdXwAAAJQ"]
[Sat May 09 01:54:53.097172 2026] [:error] [pid 51113:tid 51119] [client 54.167.80.127:44738] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/public/phpinfo.php"] [unique_id "af4jbUQfs7sWtqkpQIeepQAAAMQ"]
[Sat May 09 01:54:53.930095 2026] [:error] [pid 51009:tid 51083] [client 54.167.80.127:44740] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/info"] [unique_id "af4jbeB0GbUWhxgzX9WdZQAAAIc"]
[Sat May 09 01:54:54.754694 2026] [:error] [pid 61356:tid 61401] [client 54.167.80.127:44742] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/php-info.php"] [unique_id "af4jbox3vpB8oWhUq2M1rQAAAc0"]
[Sat May 09 01:54:55.590818 2026] [:error] [pid 61355:tid 61361] [client 54.167.80.127:44756] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/phpversion.php"] [unique_id "af4jb_khJTi30CBXmMlF-gAAAYA"]
[Sat May 09 01:54:56.419701 2026] [:error] [pid 61355:tid 61365] [client 54.167.80.127:44762] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/_phpinfo.php"] [unique_id "af4jcPkhJTi30CBXmMlGAAAAAYQ"]
[Sat May 09 01:54:57.251166 2026] [:error] [pid 61317:tid 61322] [client 54.167.80.127:44768] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/old_phpinfo.php"] [unique_id "af4jcc-fFk_CedOCOYsUFAAAAUI"]
[Sat May 09 01:54:58.082749 2026] [:error] [pid 61356:tid 61395] [client 54.167.80.127:44778] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/server-info.php"] [unique_id "af4jcox3vpB8oWhUq2M1sgAAAcc"]
[Sat May 09 01:54:58.907677 2026] [:error] [pid 61355:tid 61380] [client 54.167.80.127:36232] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/server-status.php"] [unique_id "af4jcvkhJTi30CBXmMlGDAAAAZM"]
[Sat May 09 01:54:59.732300 2026] [:error] [pid 61317:tid 61338] [client 54.167.80.127:36246] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/_profiler/phpinfo"] [unique_id "af4jc8-fFk_CedOCOYsUHQAAAVI"]
[Sat May 09 01:55:00.565859 2026] [:error] [pid 61317:tid 61337] [client 54.167.80.127:36250] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/_environment"] [unique_id "af4jdM-fFk_CedOCOYsUIAAAAVE"]
[Sat May 09 01:55:01.461798 2026] [:error] [pid 61317:tid 61336] [client 54.167.80.127:36260] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/webroot/index.php/_environment"] [unique_id "af4jdc-fFk_CedOCOYsUJAAAAVA"]
[Sat May 09 01:55:02.295204 2026] [:error] [pid 51008:tid 51065] [client 54.167.80.127:36266] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/mail/phpinfo.php"] [unique_id "af4jdnB58C2Y1tgLtuLhkAAAAFA"]
[Sat May 09 01:55:03.121918 2026] [:error] [pid 61317:tid 61332] [client 54.167.80.127:36268] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/cpanel/phpinfo.php"] [unique_id "af4jd8-fFk_CedOCOYsUKwAAAUw"]
[Sat May 09 01:55:03.948632 2026] [:error] [pid 61317:tid 61341] [client 54.167.80.127:36282] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/hosting/phpinfo.php"] [unique_id "af4jd8-fFk_CedOCOYsULAAAAVU"]
[Sat May 09 01:55:04.776530 2026] [:error] [pid 61356:tid 61393] [client 54.167.80.127:36296] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/webmail/phpinfo.php"] [unique_id "af4jeIx3vpB8oWhUq2M1xQAAAcU"]
[Sat May 09 01:55:05.604660 2026] [:error] [pid 51007:tid 51030] [client 54.167.80.127:36312] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/smtp/phpinfo.php"] [unique_id "af4jeVMagSGstWKyzzUgdgAAAAg"]
[Sat May 09 01:55:06.434393 2026] [:error] [pid 34318:tid 34331] [client 54.167.80.127:36318] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/phpinfo.php.bak"] [unique_id "af4jesr3guirgJiKhzAIEQAAAQs"]
[Sat May 09 01:55:07.325334 2026] [:error] [pid 51007:tid 51043] [client 54.167.80.127:36332] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/phpinfo.php.old"] [unique_id "af4je1MagSGstWKyzzUgeQAAABU"]
[Sat May 09 01:55:08.155688 2026] [:error] [pid 51009:tid 51078] [client 54.167.80.127:36342] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/phpinfo.php~"] [unique_id "af4jfOB0GbUWhxgzX9WdcQAAAII"]
[Sat May 09 01:55:08.987434 2026] [:error] [pid 61355:tid 61365] [client 54.167.80.127:45654] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/info.php.bak"] [unique_id "af4jfPkhJTi30CBXmMlGHwAAAYQ"]
[Sat May 09 01:55:09.818150 2026] [:error] [pid 61317:tid 61326] [client 54.167.80.127:45660] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/phpinfo.php.save"] [unique_id "af4jfc-fFk_CedOCOYsUPQAAAUY"]
[Sat May 09 01:55:10.648246 2026] [:error] [pid 61356:tid 61402] [client 54.167.80.127:45664] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/staging/phpinfo.php"] [unique_id "af4jfox3vpB8oWhUq2M16QAAAc4"]
[Sat May 09 01:55:11.474948 2026] [:error] [pid 61356:tid 61396] [client 54.167.80.127:45680] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/beta/phpinfo.php"] [unique_id "af4jf4x3vpB8oWhUq2M17QAAAcg"]
[Sat May 09 01:55:12.306217 2026] [:error] [pid 61356:tid 61405] [client 54.167.80.127:45690] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/uat/phpinfo.php"] [unique_id "af4jgIx3vpB8oWhUq2M18QAAAdE"]
[Sat May 09 01:55:13.140359 2026] [:error] [pid 61317:tid 61330] [client 54.167.80.127:45694] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/qa/phpinfo.php"] [unique_id "af4jgc-fFk_CedOCOYsUSAAAAUo"]
[Sat May 09 01:55:13.969967 2026] [:error] [pid 61355:tid 61371] [client 54.167.80.127:45700] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/preview/phpinfo.php"] [unique_id "af4jgfkhJTi30CBXmMlGKQAAAYo"]
[Sat May 09 01:55:14.808687 2026] [:error] [pid 51008:tid 51050] [client 54.167.80.127:45716] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/www/phpinfo.php"] [unique_id "af4jgnB58C2Y1tgLtuLhoQAAAEE"]
[Sat May 09 01:55:15.639091 2026] [:error] [pid 61317:tid 61321] [client 54.167.80.127:45732] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/htdocs/phpinfo.php"] [unique_id "af4jg8-fFk_CedOCOYsUTgAAAUE"]
[Sat May 09 01:55:16.471538 2026] [:error] [pid 51009:tid 51082] [client 54.167.80.127:45746] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/public_html/phpinfo.php"] [unique_id "af4jhOB0GbUWhxgzX9WddwAAAIY"]
[Sat May 09 01:55:17.294202 2026] [:error] [pid 61356:tid 61403] [client 54.167.80.127:45748] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/site/phpinfo.php"] [unique_id "af4jhYx3vpB8oWhUq2M1_AAAAc8"]
[Sat May 09 01:55:18.124501 2026] [:error] [pid 61356:tid 61391] [client 54.167.80.127:45750] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/docs/phpinfo.php"] [unique_id "af4jhox3vpB8oWhUq2M1_wAAAcM"]
[Sat May 09 01:55:18.976319 2026] [:error] [pid 61355:tid 61381] [client 54.167.80.127:39004] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/wp-admin/phpinfo.php"] [unique_id "af4jhvkhJTi30CBXmMlGQQAAAZQ"]
[Sat May 09 01:55:19.816127 2026] [:error] [pid 61355:tid 61385] [client 54.167.80.127:39018] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/administrator/phpinfo.php"] [unique_id "af4jh_khJTi30CBXmMlGRgAAAZg"]
[Sat May 09 01:55:20.646301 2026] [:error] [pid 61355:tid 61372] [client 54.167.80.127:39026] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/core/phpinfo.php"] [unique_id "af4jiPkhJTi30CBXmMlGTQAAAYs"]
[Sat May 09 01:55:21.547948 2026] [:error] [pid 51009:tid 51079] [client 54.167.80.127:39042] [client 54.167.80.127] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.expressinteriors.com"] [uri "/includes/phpinfo.php"] [unique_id "af4jieB0GbUWhxgzX9WdeAAAAIM"]
[Sat May 09 02:38:35.226527 2026] [:error] [pid 51008:tid 51063] [client 13.74.146.113:16287] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "af4tq3B58C2Y1tgLtuLsDQAAAE4"]
[Sat May 09 02:38:35.803553 2026] [:error] [pid 61317:tid 61327] [client 13.74.146.113:10816] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "af4tq8-fFk_CedOCOYseNAAAAUc"]
[Sat May 09 02:38:36.383342 2026] [:error] [pid 51009:tid 51076] [client 13.74.146.113:13490] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "af4trOB0GbUWhxgzX9WqcAAAAIA"]
[Sat May 09 02:38:36.943862 2026] [:error] [pid 51113:tid 51139] [client 13.74.146.113:10824] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "af4trEQfs7sWtqkpQIejeAAAANg"]
[Sat May 09 02:38:37.539006 2026] [:error] [pid 34318:tid 34337] [client 13.74.146.113:2673] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tymanage.php"] [unique_id "af4trcr3guirgJiKhzAOnQAAARE"]
[Sat May 09 02:38:38.107996 2026] [:error] [pid 51007:tid 51033] [client 13.74.146.113:8269] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tymanage.php"] [unique_id "af4trlMagSGstWKyzzUnogAAAAs"]
[Sat May 09 02:38:38.729831 2026] [:error] [pid 61355:tid 61362] [client 13.74.146.113:7028] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tymanage.php"] [unique_id "af4trvkhJTi30CBXmMlfyQAAAYE"]
[Sat May 09 02:38:39.399567 2026] [:error] [pid 61355:tid 61361] [client 13.74.146.113:18298] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tymanage.php"] [unique_id "af4tr_khJTi30CBXmMlfzAAAAYA"]
[Sat May 09 02:38:39.933534 2026] [:error] [pid 61356:tid 61394] [client 13.74.146.113:16274] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws88.php"] [unique_id "af4tr4x3vpB8oWhUq2NKFwAAAcY"]
[Sat May 09 02:38:40.563535 2026] [:error] [pid 61356:tid 61396] [client 13.74.146.113:13588] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws88.php"] [unique_id "af4tsIx3vpB8oWhUq2NKGgAAAcg"]
[Sat May 09 02:38:41.162754 2026] [:error] [pid 61317:tid 61331] [client 13.74.146.113:15054] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws88.php"] [unique_id "af4tsc-fFk_CedOCOYseRQAAAUs"]
[Sat May 09 02:38:41.742864 2026] [:error] [pid 61356:tid 61408] [client 13.74.146.113:10872] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws88.php"] [unique_id "af4tsYx3vpB8oWhUq2NKJgAAAdQ"]
[Sat May 09 02:38:42.327985 2026] [:error] [pid 61317:tid 61335] [client 13.74.146.113:17053] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/r.php"] [unique_id "af4tss-fFk_CedOCOYseRwAAAU8"]
[Sat May 09 02:38:42.943929 2026] [:error] [pid 51009:tid 51098] [client 13.74.146.113:2625] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/r.php"] [unique_id "af4tsuB0GbUWhxgzX9WqeQAAAJY"]
[Sat May 09 02:38:43.502060 2026] [:error] [pid 51009:tid 51078] [client 13.74.146.113:3058] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/r.php"] [unique_id "af4ts-B0GbUWhxgzX9WqewAAAII"]
[Sat May 09 02:38:44.140693 2026] [:error] [pid 61317:tid 61320] [client 13.74.146.113:15042] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/r.php"] [unique_id "af4ttM-fFk_CedOCOYseSwAAAUA"]
[Sat May 09 02:38:44.678305 2026] [:error] [pid 61356:tid 61398] [client 13.74.146.113:17417] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "af4ttIx3vpB8oWhUq2NKMwAAAco"]
[Sat May 09 02:38:45.249118 2026] [:error] [pid 61355:tid 61385] [client 13.74.146.113:2666] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "af4ttfkhJTi30CBXmMlf0wAAAZg"]
[Sat May 09 02:38:45.931150 2026] [:error] [pid 51007:tid 51044] [client 13.74.146.113:17038] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "af4ttVMagSGstWKyzzUnrAAAABY"]
[Sat May 09 02:38:46.476595 2026] [:error] [pid 61317:tid 61331] [client 13.74.146.113:5860] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "af4tts-fFk_CedOCOYseTQAAAUs"]
[Sat May 09 02:38:46.994379 2026] [:error] [pid 61356:tid 61408] [client 13.74.146.113:13584] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tymi.php"] [unique_id "af4ttox3vpB8oWhUq2NKQAAAAdQ"]
[Sat May 09 02:38:47.803171 2026] [:error] [pid 51009:tid 51098] [client 13.74.146.113:5398] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tymi.php"] [unique_id "af4tt-B0GbUWhxgzX9WqhQAAAJY"]
[Sat May 09 02:38:48.456196 2026] [:error] [pid 51009:tid 51082] [client 13.74.146.113:15068] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tymi.php"] [unique_id "af4tuOB0GbUWhxgzX9WqiAAAAIY"]
[Sat May 09 02:38:49.031442 2026] [:error] [pid 51008:tid 51072] [client 13.74.146.113:16292] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tymi.php"] [unique_id "af4tuXB58C2Y1tgLtuLsEgAAAFc"]
[Sat May 09 02:38:49.687066 2026] [:error] [pid 61355:tid 61365] [client 13.74.146.113:16286] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lolz.php"] [unique_id "af4tufkhJTi30CBXmMlf4gAAAYQ"]
[Sat May 09 02:38:50.214845 2026] [:error] [pid 61356:tid 61409] [client 13.74.146.113:5429] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lolz.php"] [unique_id "af4tuox3vpB8oWhUq2NKSgAAAdU"]
[Sat May 09 02:38:50.973355 2026] [:error] [pid 61317:tid 61338] [client 13.74.146.113:2681] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lolz.php"] [unique_id "af4tus-fFk_CedOCOYseUQAAAVI"]
[Sat May 09 02:38:51.771963 2026] [:error] [pid 61355:tid 61385] [client 13.74.146.113:13527] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lolz.php"] [unique_id "af4tu_khJTi30CBXmMlf6wAAAZg"]
[Sat May 09 02:38:52.601222 2026] [:error] [pid 51008:tid 51070] [client 13.74.146.113:13482] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd67.php"] [unique_id "af4tvHB58C2Y1tgLtuLsFAAAAFU"]
[Sat May 09 02:38:53.190667 2026] [:error] [pid 51007:tid 51030] [client 13.74.146.113:6430] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd67.php"] [unique_id "af4tvVMagSGstWKyzzUntwAAAAg"]
[Sat May 09 02:38:53.903084 2026] [:error] [pid 61355:tid 61375] [client 13.74.146.113:15082] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd67.php"] [unique_id "af4tvfkhJTi30CBXmMlf9wAAAY4"]
[Sat May 09 02:38:54.759659 2026] [:error] [pid 51113:tid 51116] [client 13.74.146.113:18665] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd67.php"] [unique_id "af4tvkQfs7sWtqkpQIejhgAAAME"]
[Sat May 09 02:38:55.338555 2026] [:error] [pid 61355:tid 61376] [client 13.74.146.113:14957] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i6z19N.php"] [unique_id "af4tv_khJTi30CBXmMlf-wAAAY8"]
[Sat May 09 02:38:56.178803 2026] [:error] [pid 61317:tid 61325] [client 13.74.146.113:14020] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i6z19N.php"] [unique_id "af4twM-fFk_CedOCOYseVwAAAUU"]
[Sat May 09 02:38:56.812291 2026] [:error] [pid 61355:tid 61379] [client 13.74.146.113:9352] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i6z19N.php"] [unique_id "af4twPkhJTi30CBXmMlgBgAAAZI"]
[Sat May 09 02:38:57.538731 2026] [:error] [pid 51008:tid 51064] [client 13.74.146.113:5847] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i6z19N.php"] [unique_id "af4twXB58C2Y1tgLtuLsHgAAAE8"]
[Sat May 09 02:38:58.261917 2026] [:error] [pid 51007:tid 51040] [client 13.74.146.113:18671] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clque.php"] [unique_id "af4twlMagSGstWKyzzUnugAAABI"]
[Sat May 09 02:38:59.038728 2026] [:error] [pid 51008:tid 51050] [client 13.74.146.113:16316] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clque.php"] [unique_id "af4tw3B58C2Y1tgLtuLsIgAAAEE"]
[Sat May 09 02:38:59.650889 2026] [:error] [pid 61317:tid 61324] [client 13.74.146.113:3314] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clque.php"] [unique_id "af4tw8-fFk_CedOCOYseWgAAAUQ"]
[Sat May 09 02:39:00.249819 2026] [:error] [pid 51113:tid 51136] [client 13.74.146.113:2651] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clque.php"] [unique_id "af4txEQfs7sWtqkpQIejjQAAANU"]
[Sat May 09 02:39:00.767903 2026] [:error] [pid 61355:tid 61383] [client 13.74.146.113:3009] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ver.php"] [unique_id "af4txPkhJTi30CBXmMlgHQAAAZY"]
[Sat May 09 02:39:01.442640 2026] [:error] [pid 34318:tid 34332] [client 13.74.146.113:14935] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ver.php"] [unique_id "af4txcr3guirgJiKhzAOvAAAAQw"]
[Sat May 09 02:39:02.308985 2026] [:error] [pid 34318:tid 34325] [client 13.74.146.113:15057] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wert.php"] [unique_id "af4txsr3guirgJiKhzAOvwAAAQU"]
[Sat May 09 02:39:02.932154 2026] [:error] [pid 61355:tid 61363] [client 13.74.146.113:3886] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wert.php"] [unique_id "af4txvkhJTi30CBXmMlgJwAAAYI"]
[Sat May 09 02:39:03.675846 2026] [:error] [pid 61355:tid 61375] [client 13.74.146.113:9039] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wert.php"] [unique_id "af4tx_khJTi30CBXmMlgLgAAAY4"]
[Sat May 09 02:39:04.461909 2026] [:error] [pid 51008:tid 51073] [client 13.74.146.113:9370] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wert.php"] [unique_id "af4tyHB58C2Y1tgLtuLsKgAAAFg"]
[Sat May 09 02:39:05.250323 2026] [:error] [pid 34318:tid 34329] [client 13.74.146.113:13541] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "af4tycr3guirgJiKhzAOxgAAAQk"]
[Sat May 09 02:39:05.930037 2026] [:error] [pid 51009:tid 51080] [client 13.74.146.113:2645] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "af4tyeB0GbUWhxgzX9WqpwAAAIQ"]
[Sat May 09 02:39:07.224472 2026] [:error] [pid 61355:tid 61377] [client 13.74.146.113:16307] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "af4ty_khJTi30CBXmMlgNwAAAZA"]
[Sat May 09 02:39:08.357284 2026] [:error] [pid 61355:tid 61384] [client 13.74.146.113:3890] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "af4tzPkhJTi30CBXmMlgRgAAAZc"]
[Sat May 09 02:39:09.266252 2026] [:error] [pid 61356:tid 61398] [client 13.74.146.113:11219] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "af4tzYx3vpB8oWhUq2NKWgAAAco"]
[Sat May 09 02:39:10.027251 2026] [:error] [pid 61356:tid 61392] [client 13.74.146.113:5401] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "af4tzox3vpB8oWhUq2NKXQAAAcQ"]
[Sat May 09 02:39:11.369279 2026] [:error] [pid 61355:tid 61365] [client 13.74.146.113:3039] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "af4tz_khJTi30CBXmMlgXAAAAYQ"]
[Sat May 09 02:39:12.783317 2026] [:error] [pid 61317:tid 61334] [client 13.74.146.113:10109] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "af4t0M-fFk_CedOCOYseagAAAU4"]
[Sat May 09 02:39:13.899399 2026] [:error] [pid 61355:tid 61361] [client 13.74.146.113:13519] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xslclbn.php"] [unique_id "af4t0fkhJTi30CBXmMlgaQAAAYA"]
[Sat May 09 02:39:14.896683 2026] [:error] [pid 51113:tid 51133] [client 13.74.146.113:2664] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xslclbn.php"] [unique_id "af4t0kQfs7sWtqkpQIejnQAAANI"]
[Sat May 09 02:39:15.585390 2026] [:error] [pid 61356:tid 61412] [client 13.74.146.113:7082] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xslclbn.php"] [unique_id "af4t04x3vpB8oWhUq2NKcQAAAdg"]
[Sat May 09 02:39:16.526545 2026] [:error] [pid 51009:tid 51089] [client 13.74.146.113:15027] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xslclbn.php"] [unique_id "af4t1OB0GbUWhxgzX9WqwAAAAI0"]
[Sat May 09 02:39:17.359796 2026] [:error] [pid 51009:tid 51100] [client 13.74.146.113:6431] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/less.php"] [unique_id "af4t1eB0GbUWhxgzX9WqxAAAAJg"]
[Sat May 09 02:39:17.946463 2026] [:error] [pid 51113:tid 51117] [client 13.74.146.113:18647] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/less.php"] [unique_id "af4t1UQfs7sWtqkpQIejngAAAMI"]
[Sat May 09 02:39:19.068164 2026] [:error] [pid 61355:tid 61376] [client 13.74.146.113:3264] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/less.php"] [unique_id "af4t1_khJTi30CBXmMlgeAAAAY8"]
[Sat May 09 02:39:20.142919 2026] [:error] [pid 61355:tid 61382] [client 13.74.146.113:13547] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/less.php"] [unique_id "af4t2PkhJTi30CBXmMlgfwAAAZU"]
[Sat May 09 02:39:21.245099 2026] [:error] [pid 51007:tid 51024] [client 13.74.146.113:11700] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albrt.php"] [unique_id "af4t2VMagSGstWKyzzUnyQAAAAI"]
[Sat May 09 02:39:21.941216 2026] [:error] [pid 34318:tid 34342] [client 13.74.146.113:14966] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albrt.php"] [unique_id "af4t2cr3guirgJiKhzAOzQAAARY"]
[Sat May 09 02:39:22.704750 2026] [:error] [pid 61355:tid 61377] [client 13.74.146.113:13514] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albrt.php"] [unique_id "af4t2vkhJTi30CBXmMlghQAAAZA"]
[Sat May 09 02:39:23.887456 2026] [:error] [pid 61356:tid 61404] [client 13.74.146.113:9046] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albrt.php"] [unique_id "af4t24x3vpB8oWhUq2NKeQAAAdA"]
[Sat May 09 02:39:24.849284 2026] [:error] [pid 51009:tid 51099] [client 13.74.146.113:6168] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tiny2.php"] [unique_id "af4t3OB0GbUWhxgzX9Wq1AAAAJc"]
[Sat May 09 02:39:26.432397 2026] [:error] [pid 34318:tid 34323] [client 13.74.146.113:3757] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "af4t3sr3guirgJiKhzAO0QAAAQM"]
[Sat May 09 02:39:27.298994 2026] [:error] [pid 51009:tid 51083] [client 13.74.146.113:2356] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "af4t3-B0GbUWhxgzX9Wq1wAAAIc"]
[Sat May 09 02:39:27.976411 2026] [:error] [pid 61356:tid 61389] [client 13.74.146.113:11519] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "af4t34x3vpB8oWhUq2NKhgAAAcE"]
[Sat May 09 02:39:28.791169 2026] [:error] [pid 51009:tid 51085] [client 13.74.146.113:6459] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "af4t4OB0GbUWhxgzX9Wq3AAAAIk"]
[Sat May 09 02:39:29.661570 2026] [:error] [pid 61355:tid 61361] [client 13.74.146.113:7103] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwq.php"] [unique_id "af4t4fkhJTi30CBXmMlgrwAAAYA"]
[Sat May 09 02:39:30.717251 2026] [:error] [pid 61356:tid 61390] [client 13.74.146.113:9077] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwq.php"] [unique_id "af4t4ox3vpB8oWhUq2NKlAAAAcI"]
[Sat May 09 02:39:31.538427 2026] [:error] [pid 51008:tid 51061] [client 13.74.146.113:3266] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwq.php"] [unique_id "af4t43B58C2Y1tgLtuLsQAAAAEw"]
[Sat May 09 02:39:32.608830 2026] [:error] [pid 51009:tid 51076] [client 13.74.146.113:11256] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwq.php"] [unique_id "af4t5OB0GbUWhxgzX9Wq4QAAAIA"]
[Sat May 09 02:39:33.553651 2026] [:error] [pid 51009:tid 51097] [client 13.74.146.113:9056] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new4.php"] [unique_id "af4t5eB0GbUWhxgzX9Wq5gAAAJU"]
[Sat May 09 02:39:45.225908 2026] [:error] [pid 61356:tid 61392] [client 13.74.146.113:13566] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kaza.php"] [unique_id "af4t8Yx3vpB8oWhUq2NKwgAAAcQ"]
[Sat May 09 02:39:46.073168 2026] [:error] [pid 34318:tid 34322] [client 13.74.146.113:12733] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kaza.php"] [unique_id "af4t8sr3guirgJiKhzAO4wAAAQI"]
[Sat May 09 02:39:46.613105 2026] [:error] [pid 61356:tid 61399] [client 13.74.146.113:3046] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kaza.php"] [unique_id "af4t8ox3vpB8oWhUq2NKyAAAAcs"]
[Sat May 09 02:39:47.202767 2026] [:error] [pid 61355:tid 61372] [client 13.74.146.113:10071] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kaza.php"] [unique_id "af4t8_khJTi30CBXmMlg-AAAAYs"]
[Sat May 09 02:39:47.865003 2026] [:error] [pid 61355:tid 61379] [client 13.74.146.113:3726] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rrr.php"] [unique_id "af4t8_khJTi30CBXmMlg_wAAAZI"]
[Sat May 09 02:39:48.509877 2026] [:error] [pid 61317:tid 61340] [client 13.74.146.113:18283] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rrr.php"] [unique_id "af4t9M-fFk_CedOCOYseoAAAAVQ"]
[Sat May 09 02:39:49.143816 2026] [:error] [pid 51008:tid 51068] [client 13.74.146.113:12351] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rrr.php"] [unique_id "af4t9XB58C2Y1tgLtuLsSAAAAFM"]
[Sat May 09 02:39:49.821858 2026] [:error] [pid 61317:tid 61341] [client 13.74.146.113:5880] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rrr.php"] [unique_id "af4t9c-fFk_CedOCOYsepQAAAVU"]
[Sat May 09 02:39:50.361257 2026] [:error] [pid 61355:tid 61367] [client 13.74.146.113:13510] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/img.php"] [unique_id "af4t9vkhJTi30CBXmMlhBQAAAYY"]
[Sat May 09 02:39:50.923149 2026] [:error] [pid 61355:tid 61381] [client 13.74.146.113:5388] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/img.php"] [unique_id "af4t9vkhJTi30CBXmMlhBgAAAZQ"]
[Sat May 09 02:39:51.477724 2026] [:error] [pid 51007:tid 51024] [client 13.74.146.113:13054] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/img.php"] [unique_id "af4t91MagSGstWKyzzUn7QAAAAI"]
[Sat May 09 02:39:52.017824 2026] [:error] [pid 34318:tid 34331] [client 13.74.146.113:3325] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/img.php"] [unique_id "af4t-Mr3guirgJiKhzAO6wAAAQs"]
[Sat May 09 02:39:52.570370 2026] [:error] [pid 51009:tid 51086] [client 13.74.146.113:1774] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ayk.php"] [unique_id "af4t-OB0GbUWhxgzX9Wq9QAAAIo"]
[Sat May 09 02:39:53.124182 2026] [:error] [pid 51009:tid 51100] [client 13.74.146.113:9659] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ayk.php"] [unique_id "af4t-eB0GbUWhxgzX9Wq-QAAAJg"]
[Sat May 09 02:39:53.662080 2026] [:error] [pid 51009:tid 51092] [client 13.74.146.113:5382] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ayk.php"] [unique_id "af4t-eB0GbUWhxgzX9Wq_AAAAJA"]
[Sat May 09 02:39:54.181312 2026] [:error] [pid 51007:tid 51042] [client 13.74.146.113:16881] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ayk.php"] [unique_id "af4t-lMagSGstWKyzzUn9QAAABQ"]
[Sat May 09 02:39:54.778737 2026] [:error] [pid 61355:tid 61362] [client 13.74.146.113:13554] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/22name.php"] [unique_id "af4t-vkhJTi30CBXmMlhDQAAAYE"]
[Sat May 09 02:39:55.307630 2026] [:error] [pid 61355:tid 61379] [client 13.74.146.113:11851] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/22name.php"] [unique_id "af4t-_khJTi30CBXmMlhEQAAAZI"]
[Sat May 09 02:39:55.883058 2026] [:error] [pid 34318:tid 34330] [client 13.74.146.113:9654] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/22name.php"] [unique_id "af4t-8r3guirgJiKhzAO8gAAAQo"]
[Sat May 09 02:39:56.393892 2026] [:error] [pid 51113:tid 51118] [client 13.74.146.113:2061] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/22name.php"] [unique_id "af4t_EQfs7sWtqkpQIej0AAAAMM"]
[Sat May 09 02:39:57.011508 2026] [:error] [pid 61317:tid 61321] [client 13.74.146.113:6149] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "af4t_c-fFk_CedOCOYserwAAAUE"]
[Sat May 09 02:39:57.642086 2026] [:error] [pid 51008:tid 51069] [client 13.74.146.113:12720] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "af4t_XB58C2Y1tgLtuLsUwAAAFQ"]
[Sat May 09 02:39:58.218370 2026] [:error] [pid 51009:tid 51083] [client 13.74.146.113:13961] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "af4t_uB0GbUWhxgzX9WrAQAAAIc"]
[Sat May 09 02:39:58.943216 2026] [:error] [pid 51113:tid 51126] [client 13.74.146.113:4523] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "af4t_kQfs7sWtqkpQIej2AAAAMs"]
[Sat May 09 02:39:59.548008 2026] [:error] [pid 34318:tid 34324] [client 13.74.146.113:3737] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xse.php"] [unique_id "af4t_8r3guirgJiKhzAO9QAAAQQ"]
[Sat May 09 02:40:00.280981 2026] [:error] [pid 34318:tid 34342] [client 13.74.146.113:12703] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xse.php"] [unique_id "af4uAMr3guirgJiKhzAO-QAAARY"]
[Sat May 09 02:40:00.957065 2026] [:error] [pid 51007:tid 51038] [client 13.74.146.113:13520] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xse.php"] [unique_id "af4uAFMagSGstWKyzzUn9gAAABA"]
[Sat May 09 02:40:01.758814 2026] [:error] [pid 51008:tid 51071] [client 13.74.146.113:17082] [client 13.74.146.113] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xse.php"] [unique_id "af4uAXB58C2Y1tgLtuLsYAAAAFY"]
[Sat May 09 02:49:20.336640 2026] [:error] [pid 34318:tid 34342] [client 45.132.115.126:25467] [client 45.132.115.126] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.126, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af4wMMr3guirgJiKhzARZQAAARY"]
[Sat May 09 02:49:28.545646 2026] [:error] [pid 51007:tid 51025] [client 20.123.33.13:14944] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "af4wOFMagSGstWKyzzUq8gAAAAM"]
[Sat May 09 02:49:29.116213 2026] [:error] [pid 51008:tid 51063] [client 20.123.33.13:5214] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "af4wOXB58C2Y1tgLtuLvPAAAAE4"]
[Sat May 09 02:49:29.685977 2026] [:error] [pid 51007:tid 51046] [client 20.123.33.13:1946] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "af4wOVMagSGstWKyzzUq8wAAABg"]
[Sat May 09 02:49:30.251680 2026] [:error] [pid 51007:tid 51037] [client 20.123.33.13:1499] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "af4wOlMagSGstWKyzzUq9QAAAA8"]
[Sat May 09 02:49:30.796173 2026] [:error] [pid 51009:tid 51087] [client 20.123.33.13:1277] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tymanage.php"] [unique_id "af4wOuB0GbUWhxgzX9WwjgAAAIs"]
[Sat May 09 02:49:31.362889 2026] [:error] [pid 61317:tid 61342] [client 20.123.33.13:11898] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tymanage.php"] [unique_id "af4wO8-fFk_CedOCOYsh9QAAAVY"]
[Sat May 09 02:49:31.894614 2026] [:error] [pid 51008:tid 51064] [client 20.123.33.13:11864] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tymanage.php"] [unique_id "af4wO3B58C2Y1tgLtuLvRAAAAE8"]
[Sat May 09 02:49:32.419629 2026] [:error] [pid 61356:tid 61407] [client 20.123.33.13:14929] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-tymanage.php"] [unique_id "af4wPIx3vpB8oWhUq2NRTQAAAdM"]
[Sat May 09 02:49:32.947536 2026] [:error] [pid 61317:tid 61341] [client 20.123.33.13:15217] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws88.php"] [unique_id "af4wPM-fFk_CedOCOYsh-gAAAVU"]
[Sat May 09 02:49:33.484269 2026] [:error] [pid 34318:tid 34333] [client 20.123.33.13:14988] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws88.php"] [unique_id "af4wPcr3guirgJiKhzARcgAAAQ0"]
[Sat May 09 02:49:34.023130 2026] [:error] [pid 61356:tid 61394] [client 20.123.33.13:11893] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws88.php"] [unique_id "af4wPox3vpB8oWhUq2NRUQAAAcY"]
[Sat May 09 02:49:34.572214 2026] [:error] [pid 51009:tid 51084] [client 20.123.33.13:11651] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws88.php"] [unique_id "af4wPuB0GbUWhxgzX9WwkAAAAIg"]
[Sat May 09 02:49:35.120812 2026] [:error] [pid 34318:tid 34321] [client 20.123.33.13:15226] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/r.php"] [unique_id "af4wP8r3guirgJiKhzARcwAAAQE"]
[Sat May 09 02:49:35.650857 2026] [:error] [pid 61317:tid 61327] [client 20.123.33.13:12571] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/r.php"] [unique_id "af4wP8-fFk_CedOCOYsh_AAAAUc"]
[Sat May 09 02:49:36.201455 2026] [:error] [pid 51113:tid 51136] [client 20.123.33.13:11696] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/r.php"] [unique_id "af4wQEQfs7sWtqkpQIem9wAAANU"]
[Sat May 09 02:49:36.735931 2026] [:error] [pid 51008:tid 51060] [client 20.123.33.13:17533] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/r.php"] [unique_id "af4wQHB58C2Y1tgLtuLvTwAAAEs"]
[Sat May 09 02:49:37.251513 2026] [:error] [pid 51007:tid 51023] [client 20.123.33.13:12582] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "af4wQVMagSGstWKyzzUq9wAAAAE"]
[Sat May 09 02:49:37.784461 2026] [:error] [pid 51008:tid 51066] [client 20.123.33.13:13371] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "af4wQXB58C2Y1tgLtuLvUgAAAFE"]
[Sat May 09 02:49:38.305261 2026] [:error] [pid 51008:tid 51057] [client 20.123.33.13:5221] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "af4wQnB58C2Y1tgLtuLvUwAAAEg"]
[Sat May 09 02:49:38.870993 2026] [:error] [pid 61356:tid 61401] [client 20.123.33.13:17186] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "af4wQox3vpB8oWhUq2NRWAAAAc0"]
[Sat May 09 02:49:39.445163 2026] [:error] [pid 51008:tid 51059] [client 20.123.33.13:11677] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tymi.php"] [unique_id "af4wQ3B58C2Y1tgLtuLvWQAAAEo"]
[Sat May 09 02:49:39.961891 2026] [:error] [pid 51009:tid 51086] [client 20.123.33.13:10205] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tymi.php"] [unique_id "af4wQ-B0GbUWhxgzX9WwmAAAAIo"]
[Sat May 09 02:49:40.475385 2026] [:error] [pid 61355:tid 61377] [client 20.123.33.13:10192] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tymi.php"] [unique_id "af4wRPkhJTi30CBXmMln7QAAAZA"]
[Sat May 09 02:49:41.019996 2026] [:error] [pid 51009:tid 51089] [client 20.123.33.13:12910] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tymi.php"] [unique_id "af4wReB0GbUWhxgzX9WwnwAAAI0"]
[Sat May 09 02:49:41.602444 2026] [:error] [pid 51007:tid 51030] [client 20.123.33.13:17475] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lolz.php"] [unique_id "af4wRVMagSGstWKyzzUq-gAAAAg"]
[Sat May 09 02:49:42.142765 2026] [:error] [pid 51009:tid 51100] [client 20.123.33.13:12547] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lolz.php"] [unique_id "af4wRuB0GbUWhxgzX9WwpAAAAJg"]
[Sat May 09 02:49:42.666378 2026] [:error] [pid 51009:tid 51076] [client 20.123.33.13:2315] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lolz.php"] [unique_id "af4wRuB0GbUWhxgzX9WwpgAAAIA"]
[Sat May 09 02:49:43.196125 2026] [:error] [pid 51113:tid 51116] [client 20.123.33.13:2308] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lolz.php"] [unique_id "af4wR0Qfs7sWtqkpQIem_AAAAME"]
[Sat May 09 02:49:43.701583 2026] [:error] [pid 61355:tid 61364] [client 20.123.33.13:15024] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd67.php"] [unique_id "af4wR_khJTi30CBXmMln9AAAAYM"]
[Sat May 09 02:49:44.234982 2026] [:error] [pid 51007:tid 51042] [client 20.123.33.13:2228] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd67.php"] [unique_id "af4wSFMagSGstWKyzzUq_QAAABQ"]
[Sat May 09 02:49:44.761081 2026] [:error] [pid 61356:tid 61397] [client 20.123.33.13:11560] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd67.php"] [unique_id "af4wSIx3vpB8oWhUq2NRaAAAAck"]
[Sat May 09 02:49:45.263479 2026] [:error] [pid 61355:tid 61363] [client 20.123.33.13:11845] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asd67.php"] [unique_id "af4wSfkhJTi30CBXmMln_wAAAYI"]
[Sat May 09 02:49:45.837387 2026] [:error] [pid 61355:tid 61385] [client 20.123.33.13:5216] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i6z19N.php"] [unique_id "af4wSfkhJTi30CBXmMloAgAAAZg"]
[Sat May 09 02:49:46.422487 2026] [:error] [pid 51008:tid 51065] [client 20.123.33.13:1922] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i6z19N.php"] [unique_id "af4wSnB58C2Y1tgLtuLvXgAAAFA"]
[Sat May 09 02:49:46.947674 2026] [:error] [pid 61356:tid 61406] [client 20.123.33.13:11564] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i6z19N.php"] [unique_id "af4wSox3vpB8oWhUq2NRbQAAAdI"]
[Sat May 09 02:49:47.465195 2026] [:error] [pid 51007:tid 51024] [client 20.123.33.13:10200] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i6z19N.php"] [unique_id "af4wS1MagSGstWKyzzUrAAAAAAI"]
[Sat May 09 02:49:47.998352 2026] [:error] [pid 61355:tid 61382] [client 20.123.33.13:10987] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clque.php"] [unique_id "af4wS_khJTi30CBXmMloFAAAAZU"]
[Sat May 09 02:49:48.504777 2026] [:error] [pid 61355:tid 61385] [client 20.123.33.13:11751] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clque.php"] [unique_id "af4wTPkhJTi30CBXmMloGgAAAZg"]
[Sat May 09 02:49:49.040560 2026] [:error] [pid 61355:tid 61363] [client 20.123.33.13:5539] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clque.php"] [unique_id "af4wTfkhJTi30CBXmMloHwAAAYI"]
[Sat May 09 02:49:49.582176 2026] [:error] [pid 51008:tid 51050] [client 20.123.33.13:15204] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clque.php"] [unique_id "af4wTXB58C2Y1tgLtuLvXwAAAEE"]
[Sat May 09 02:49:50.091080 2026] [:error] [pid 51008:tid 51062] [client 20.123.33.13:10039] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ver.php"] [unique_id "af4wTnB58C2Y1tgLtuLvYwAAAE0"]
[Sat May 09 02:49:50.627778 2026] [:error] [pid 61355:tid 61373] [client 20.123.33.13:5199] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ver.php"] [unique_id "af4wTvkhJTi30CBXmMloLAAAAYw"]
[Sat May 09 02:49:51.187950 2026] [:error] [pid 61356:tid 61388] [client 20.123.33.13:12475] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ver.php"] [unique_id "af4wT4x3vpB8oWhUq2NRggAAAcA"]
[Sat May 09 02:49:51.748730 2026] [:error] [pid 61356:tid 61408] [client 20.123.33.13:5107] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "af4wT4x3vpB8oWhUq2NRhwAAAdQ"]
[Sat May 09 02:49:52.308459 2026] [:error] [pid 61356:tid 61402] [client 20.123.33.13:5302] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "af4wUIx3vpB8oWhUq2NRjAAAAc4"]
[Sat May 09 02:49:52.863896 2026] [:error] [pid 61356:tid 61388] [client 20.123.33.13:10208] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "af4wUIx3vpB8oWhUq2NRkQAAAcA"]
[Sat May 09 02:49:53.394514 2026] [:error] [pid 51007:tid 51041] [client 20.123.33.13:11875] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-blog.php"] [unique_id "af4wUVMagSGstWKyzzUrBQAAABM"]
[Sat May 09 02:49:53.922772 2026] [:error] [pid 51008:tid 51069] [client 20.123.33.13:11700] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "af4wUXB58C2Y1tgLtuLvagAAAFQ"]
[Sat May 09 02:49:54.481879 2026] [:error] [pid 61355:tid 61379] [client 20.123.33.13:14993] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "af4wUvkhJTi30CBXmMloPQAAAZI"]
[Sat May 09 02:49:55.060988 2026] [:error] [pid 61355:tid 61384] [client 20.123.33.13:15020] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "af4wU_khJTi30CBXmMloQQAAAZc"]
[Sat May 09 02:49:55.611930 2026] [:error] [pid 51007:tid 51023] [client 20.123.33.13:15032] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "af4wU1MagSGstWKyzzUrBwAAAAE"]
[Sat May 09 02:49:56.168080 2026] [:error] [pid 61355:tid 61385] [client 20.123.33.13:17682] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xslclbn.php"] [unique_id "af4wVPkhJTi30CBXmMloRwAAAZg"]
[Sat May 09 02:49:56.701573 2026] [:error] [pid 61355:tid 61364] [client 20.123.33.13:5305] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xslclbn.php"] [unique_id "af4wVPkhJTi30CBXmMloSwAAAYM"]
[Sat May 09 02:49:57.212927 2026] [:error] [pid 51009:tid 51099] [client 20.123.33.13:4723] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xslclbn.php"] [unique_id "af4wVeB0GbUWhxgzX9WwqQAAAJc"]
[Sat May 09 02:49:57.771643 2026] [:error] [pid 61356:tid 61392] [client 20.123.33.13:3529] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xslclbn.php"] [unique_id "af4wVYx3vpB8oWhUq2NRmwAAAcQ"]
[Sat May 09 02:49:58.309018 2026] [:error] [pid 61355:tid 61381] [client 20.123.33.13:10042] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/less.php"] [unique_id "af4wVvkhJTi30CBXmMloWwAAAZQ"]
[Sat May 09 02:49:58.875482 2026] [:error] [pid 34318:tid 34335] [client 20.123.33.13:17328] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/less.php"] [unique_id "af4wVsr3guirgJiKhzARfQAAAQ8"]
[Sat May 09 02:49:59.434578 2026] [:error] [pid 51009:tid 51086] [client 20.123.33.13:2577] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/less.php"] [unique_id "af4wV-B0GbUWhxgzX9WwsAAAAIo"]
[Sat May 09 02:49:59.977589 2026] [:error] [pid 51113:tid 51130] [client 20.123.33.13:2579] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/less.php"] [unique_id "af4wV0Qfs7sWtqkpQIenBgAAAM8"]
[Sat May 09 02:50:00.520116 2026] [:error] [pid 61355:tid 61363] [client 20.123.33.13:10041] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albrt.php"] [unique_id "af4wWPkhJTi30CBXmMloawAAAYI"]
[Sat May 09 02:50:01.058745 2026] [:error] [pid 61355:tid 61385] [client 20.123.33.13:13916] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albrt.php"] [unique_id "af4wWfkhJTi30CBXmMlocQAAAZg"]
[Sat May 09 02:50:01.628440 2026] [:error] [pid 61356:tid 61389] [client 20.123.33.13:13929] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albrt.php"] [unique_id "af4wWYx3vpB8oWhUq2NRowAAAcE"]
[Sat May 09 02:50:02.182325 2026] [:error] [pid 61355:tid 61385] [client 20.123.33.13:8094] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albrt.php"] [unique_id "af4wWvkhJTi30CBXmMlofAAAAZg"]
[Sat May 09 02:50:02.705218 2026] [:error] [pid 61356:tid 61392] [client 20.123.33.13:13442] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tiny2.php"] [unique_id "af4wWox3vpB8oWhUq2NRpwAAAcQ"]
[Sat May 09 02:50:03.247516 2026] [:error] [pid 51009:tid 51087] [client 20.123.33.13:5079] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tiny2.php"] [unique_id "af4wW-B0GbUWhxgzX9WwsgAAAIs"]
[Sat May 09 02:50:03.827153 2026] [:error] [pid 61355:tid 61363] [client 20.123.33.13:4021] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tiny2.php"] [unique_id "af4wW_khJTi30CBXmMloiAAAAYI"]
[Sat May 09 02:50:04.389948 2026] [:error] [pid 51007:tid 51030] [client 20.123.33.13:1444] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tiny2.php"] [unique_id "af4wXFMagSGstWKyzzUrCAAAAAg"]
[Sat May 09 02:50:04.916756 2026] [:error] [pid 51008:tid 51061] [client 20.123.33.13:13922] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an8.php"] [unique_id "af4wXHB58C2Y1tgLtuLvbgAAAEw"]
[Sat May 09 02:50:05.457638 2026] [:error] [pid 34318:tid 34326] [client 20.123.33.13:17852] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an8.php"] [unique_id "af4wXcr3guirgJiKhzARiwAAAQY"]
[Sat May 09 02:50:05.987539 2026] [:error] [pid 51008:tid 51068] [client 20.123.33.13:6694] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/an8.php"] [unique_id "af4wXXB58C2Y1tgLtuLvcQAAAFM"]
[Sat May 09 02:50:06.551765 2026] [:error] [pid 61355:tid 61375] [client 20.123.33.13:15468] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "af4wXvkhJTi30CBXmMlonQAAAY4"]
[Sat May 09 02:50:07.092156 2026] [:error] [pid 61317:tid 61324] [client 20.123.33.13:1600] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "af4wX8-fFk_CedOCOYsiDgAAAUQ"]
[Sat May 09 02:50:07.647637 2026] [:error] [pid 51009:tid 51082] [client 20.123.33.13:14722] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "af4wX-B0GbUWhxgzX9WwtAAAAIY"]
[Sat May 09 02:50:08.167782 2026] [:error] [pid 61356:tid 61409] [client 20.123.33.13:13943] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ww.php"] [unique_id "af4wYIx3vpB8oWhUq2NRsAAAAdU"]
[Sat May 09 02:50:08.688291 2026] [:error] [pid 61356:tid 61406] [client 20.123.33.13:8489] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwq.php"] [unique_id "af4wYIx3vpB8oWhUq2NRsgAAAdI"]
[Sat May 09 02:50:09.241295 2026] [:error] [pid 61356:tid 61398] [client 20.123.33.13:2878] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwq.php"] [unique_id "af4wYYx3vpB8oWhUq2NRtQAAAco"]
[Sat May 09 02:50:09.743216 2026] [:error] [pid 51009:tid 51080] [client 20.123.33.13:9596] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwq.php"] [unique_id "af4wYeB0GbUWhxgzX9WwtwAAAIQ"]
[Sat May 09 02:50:10.276393 2026] [:error] [pid 51009:tid 51086] [client 20.123.33.13:4421] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zwq.php"] [unique_id "af4wYuB0GbUWhxgzX9WwuwAAAIo"]
[Sat May 09 02:50:10.836334 2026] [:error] [pid 34318:tid 34335] [client 20.123.33.13:6677] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ups.php"] [unique_id "af4wYsr3guirgJiKhzARkAAAAQ8"]
[Sat May 09 02:50:11.359677 2026] [:error] [pid 61355:tid 61383] [client 20.123.33.13:4718] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ups.php"] [unique_id "af4wY_khJTi30CBXmMlosgAAAZY"]
[Sat May 09 02:50:11.911767 2026] [:error] [pid 34318:tid 34333] [client 20.123.33.13:6704] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ups.php"] [unique_id "af4wY8r3guirgJiKhzARkwAAAQ0"]
[Sat May 09 02:50:12.441028 2026] [:error] [pid 61317:tid 61334] [client 20.123.33.13:4701] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ups.php"] [unique_id "af4wZM-fFk_CedOCOYsiFQAAAU4"]
[Sat May 09 02:50:12.979699 2026] [:error] [pid 61356:tid 61403] [client 20.123.33.13:4678] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-demomav.php"] [unique_id "af4wZIx3vpB8oWhUq2NRvAAAAc8"]
[Sat May 09 02:50:13.523616 2026] [:error] [pid 61356:tid 61408] [client 20.123.33.13:6715] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-demomav.php"] [unique_id "af4wZYx3vpB8oWhUq2NRvwAAAdQ"]
[Sat May 09 02:50:14.041058 2026] [:error] [pid 61356:tid 61399] [client 20.123.33.13:7974] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-demomav.php"] [unique_id "af4wZox3vpB8oWhUq2NRxgAAAcs"]
[Sat May 09 02:50:14.585686 2026] [:error] [pid 51009:tid 51096] [client 20.123.33.13:8502] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-demomav.php"] [unique_id "af4wZuB0GbUWhxgzX9WwxQAAAJQ"]
[Sat May 09 02:50:15.098996 2026] [:error] [pid 51009:tid 51094] [client 20.123.33.13:13473] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/greateb.php"] [unique_id "af4wZ-B0GbUWhxgzX9WwyQAAAJI"]
[Sat May 09 02:50:15.636422 2026] [:error] [pid 34318:tid 34328] [client 20.123.33.13:4004] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/greateb.php"] [unique_id "af4wZ8r3guirgJiKhzARlwAAAQg"]
[Sat May 09 02:50:16.195146 2026] [:error] [pid 51009:tid 51084] [client 20.123.33.13:13245] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/greateb.php"] [unique_id "af4waOB0GbUWhxgzX9WwzwAAAIg"]
[Sat May 09 02:50:16.698104 2026] [:error] [pid 61355:tid 61375] [client 20.123.33.13:15811] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/greateb.php"] [unique_id "af4waPkhJTi30CBXmMlouAAAAY4"]
[Sat May 09 02:50:17.242203 2026] [:error] [pid 61355:tid 61370] [client 20.123.33.13:13133] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/co.php"] [unique_id "af4wafkhJTi30CBXmMlovAAAAYk"]
[Sat May 09 02:50:17.787462 2026] [:error] [pid 61355:tid 61367] [client 20.123.33.13:1187] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/co.php"] [unique_id "af4wafkhJTi30CBXmMlovgAAAYY"]
[Sat May 09 02:50:18.338494 2026] [:error] [pid 51113:tid 51136] [client 20.123.33.13:15843] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/co.php"] [unique_id "af4wakQfs7sWtqkpQIenDQAAANU"]
[Sat May 09 02:50:18.900130 2026] [:error] [pid 61317:tid 61322] [client 20.123.33.13:2988] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/co.php"] [unique_id "af4was-fFk_CedOCOYsiIAAAAUI"]
[Sat May 09 02:50:19.455589 2026] [:error] [pid 61355:tid 61376] [client 20.123.33.13:13476] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/shlo.php"] [unique_id "af4wa_khJTi30CBXmMlowwAAAY8"]
[Sat May 09 02:50:19.969053 2026] [:error] [pid 51009:tid 51095] [client 20.123.33.13:5642] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/shlo.php"] [unique_id "af4wa-B0GbUWhxgzX9Ww0wAAAJM"]
[Sat May 09 02:50:20.507559 2026] [:error] [pid 51009:tid 51098] [client 20.123.33.13:8494] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/css/shlo.php"] [unique_id "af4wbOB0GbUWhxgzX9Ww1gAAAJY"]
[Sat May 09 02:50:21.031476 2026] [:error] [pid 61317:tid 61332] [client 20.123.33.13:13199] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mamzi.php"] [unique_id "af4wbc-fFk_CedOCOYsiJQAAAUw"]
[Sat May 09 02:50:21.554875 2026] [:error] [pid 51113:tid 51138] [client 20.123.33.13:15866] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mamzi.php"] [unique_id "af4wbUQfs7sWtqkpQIenDwAAANc"]
[Sat May 09 02:50:22.091825 2026] [:error] [pid 61317:tid 61329] [client 20.123.33.13:13168] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mamzi.php"] [unique_id "af4wbs-fFk_CedOCOYsiKQAAAUk"]
[Sat May 09 02:50:22.642815 2026] [:error] [pid 61317:tid 61325] [client 20.123.33.13:16869] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mamzi.php"] [unique_id "af4wbs-fFk_CedOCOYsiLQAAAUU"]
[Sat May 09 02:50:23.180146 2026] [:error] [pid 34318:tid 34338] [client 20.123.33.13:1880] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kaza.php"] [unique_id "af4wb8r3guirgJiKhzARnAAAARI"]
[Sat May 09 02:50:23.722459 2026] [:error] [pid 61356:tid 61404] [client 20.123.33.13:18611] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kaza.php"] [unique_id "af4wb4x3vpB8oWhUq2NR1wAAAdA"]
[Sat May 09 02:50:24.276825 2026] [:error] [pid 51008:tid 51051] [client 20.123.33.13:8236] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kaza.php"] [unique_id "af4wcHB58C2Y1tgLtuLvfAAAAEI"]
[Sat May 09 02:50:24.846526 2026] [:error] [pid 34318:tid 34332] [client 20.123.33.13:12309] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/kaza.php"] [unique_id "af4wcMr3guirgJiKhzARnwAAAQw"]
[Sat May 09 02:50:25.387894 2026] [:error] [pid 34318:tid 34334] [client 20.123.33.13:2283] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rrr.php"] [unique_id "af4wccr3guirgJiKhzARoAAAAQ4"]
[Sat May 09 02:50:25.907573 2026] [:error] [pid 51009:tid 51100] [client 20.123.33.13:11996] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rrr.php"] [unique_id "af4wceB0GbUWhxgzX9Ww3AAAAJg"]
[Sat May 09 02:50:26.432409 2026] [:error] [pid 61356:tid 61391] [client 20.123.33.13:5358] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rrr.php"] [unique_id "af4wcox3vpB8oWhUq2NR4AAAAcM"]
[Sat May 09 02:50:26.948275 2026] [:error] [pid 61317:tid 61328] [client 20.123.33.13:15854] [client 20.123.33.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rrr.php"] [unique_id "af4wcs-fFk_CedOCOYsiNQAAAUg"]
[Sat May 09 02:53:44.748698 2026] [:error] [pid 51007:tid 51035] [client 102.44.218.57:53381] [client 102.44.218.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.44.218.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af4xOFMagSGstWKyzzUrrAAAAA0"]
[Sat May 09 02:53:54.591124 2026] [:error] [pid 51113:tid 51138] [client 102.44.218.57:53732] [client 102.44.218.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.44.218.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af4xQkQfs7sWtqkpQIen6AAAANc"]
[Sat May 09 02:54:04.922413 2026] [:error] [pid 51113:tid 51130] [client 102.44.218.57:54012] [client 102.44.218.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.44.218.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af4xTEQfs7sWtqkpQIen8AAAAM8"]
[Sat May 09 02:54:15.357563 2026] [:error] [pid 61356:tid 61411] [client 102.44.218.57:54265] [client 102.44.218.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.44.218.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af4xV4x3vpB8oWhUq2NTRQAAAdc"]
[Sat May 09 02:54:25.741297 2026] [:error] [pid 61356:tid 61407] [client 102.44.218.57:54502] [client 102.44.218.57] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.44.218.57, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af4xYYx3vpB8oWhUq2NTWQAAAdM"]
[Sat May 09 03:08:16.068506 2026] [:error] [pid 61355:tid 61362] [client 172.212.190.20:12909] [client 172.212.190.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "af40oPkhJTi30CBXmMlv7gAAAYE"]
[Sat May 09 03:08:16.886463 2026] [:error] [pid 51009:tid 51076] [client 172.212.190.20:34061] [client 172.212.190.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "af40oOB0GbUWhxgzX9W3SAAAAIA"]
[Sat May 09 03:08:17.646003 2026] [:error] [pid 34318:tid 34335] [client 172.212.190.20:45140] [client 172.212.190.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "af40ocr3guirgJiKhzAWFAAAAQ8"]
[Sat May 09 03:08:18.453438 2026] [:error] [pid 61355:tid 61366] [client 172.212.190.20:12906] [client 172.212.190.20] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "af40ovkhJTi30CBXmMlv7wAAAYU"]
[Sat May 09 04:00:18.221121 2026] [:error] [pid 9184:tid 9205] [client 45.130.83.92:27715] [client 45.130.83.92] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.83.92, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af5A0ojfODqb_i0Fm99KkAAAAAg"]
[Sat May 09 04:34:40.693149 2026] [:error] [pid 9293:tid 9309] [client 54.176.28.156:54886] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "af5I4JR__qEzV5O6Z2OiFgAAAMw"]
[Sat May 09 04:34:42.675348 2026] [:error] [pid 9187:tid 9271] [client 54.176.28.156:54898] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "af5I4hC7An6gkXsRsaHKSwAAAJI"]
[Sat May 09 04:34:43.544688 2026] [:error] [pid 9920:tid 9928] [client 54.176.28.156:54914] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.local"] [unique_id "af5I40xitGYhlzgZb5ZFwQAAAcY"]
[Sat May 09 04:34:44.373803 2026] [:error] [pid 9187:tid 9273] [client 54.176.28.156:54920] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.production"] [unique_id "af5I5BC7An6gkXsRsaHKTQAAAJQ"]
[Sat May 09 04:34:45.140249 2026] [:error] [pid 9187:tid 9257] [client 54.176.28.156:46602] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.staging"] [unique_id "af5I5RC7An6gkXsRsaHKUgAAAIQ"]
[Sat May 09 04:34:45.992784 2026] [:error] [pid 9187:tid 9266] [client 54.176.28.156:46616] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.development"] [unique_id "af5I5RC7An6gkXsRsaHKVgAAAI0"]
[Sat May 09 04:34:46.824274 2026] [:error] [pid 9187:tid 9262] [client 54.176.28.156:46624] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.test"] [unique_id "af5I5hC7An6gkXsRsaHKWgAAAIk"]
[Sat May 09 04:34:47.555108 2026] [:error] [pid 9184:tid 9203] [client 54.176.28.156:46634] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.remote"] [unique_id "af5I54jfODqb_i0Fm99RlQAAAAY"]
[Sat May 09 04:34:48.355147 2026] [:error] [pid 9187:tid 9265] [client 54.176.28.156:46642] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.bak"] [unique_id "af5I6BC7An6gkXsRsaHKXQAAAIw"]
[Sat May 09 04:34:49.151418 2026] [:error] [pid 9186:tid 9250] [client 54.176.28.156:46654] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.backup"] [unique_id "af5I6RW4eFOEw1mKOgJpMQAAAFg"]
[Sat May 09 04:34:49.929108 2026] [:error] [pid 9186:tid 9243] [client 54.176.28.156:46668] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.save"] [unique_id "af5I6RW4eFOEw1mKOgJpNgAAAFE"]
[Sat May 09 04:34:50.764686 2026] [:error] [pid 9184:tid 9207] [client 54.176.28.156:46680] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.old"] [unique_id "af5I6ojfODqb_i0Fm99RmwAAAAo"]
[Sat May 09 04:34:51.580213 2026] [:error] [pid 9184:tid 9211] [client 54.176.28.156:46696] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.sample"] [unique_id "af5I64jfODqb_i0Fm99RnQAAAA4"]
[Sat May 09 04:34:52.354392 2026] [:error] [pid 9760:tid 9777] [client 54.176.28.156:46698] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.example"] [unique_id "af5I7GIkCp-C_fh0s7L75QAAAUs"]
[Sat May 09 04:34:53.147882 2026] [:error] [pid 9920:tid 9929] [client 54.176.28.156:46712] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.dev"] [unique_id "af5I7UxitGYhlzgZb5ZFywAAAcc"]
[Sat May 09 04:34:53.999587 2026] [:error] [pid 9187:tid 9265] [client 54.176.28.156:46720] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.prod"] [unique_id "af5I7RC7An6gkXsRsaHKZAAAAIw"]
[Sat May 09 04:34:54.800502 2026] [:error] [pid 9187:tid 9255] [client 54.176.28.156:46728] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.stage"] [unique_id "af5I7hC7An6gkXsRsaHKZgAAAII"]
[Sat May 09 04:34:55.648276 2026] [:error] [pid 9663:tid 9679] [client 54.176.28.156:56154] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.ci"] [unique_id "af5I75cWIu01SCxbjwu2-wAAAQ0"]
[Sat May 09 04:34:56.399607 2026] [:error] [pid 9184:tid 9204] [client 54.176.28.156:56156] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.docker"] [unique_id "af5I8IjfODqb_i0Fm99RpAAAAAc"]
[Sat May 09 04:34:57.244106 2026] [:error] [pid 9186:tid 9246] [client 54.176.28.156:56172] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.live"] [unique_id "af5I8RW4eFOEw1mKOgJpRQAAAFQ"]
[Sat May 09 04:34:58.032006 2026] [:error] [pid 9186:tid 9243] [client 54.176.28.156:56178] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.preprod"] [unique_id "af5I8hW4eFOEw1mKOgJpSwAAAFE"]
[Sat May 09 04:34:58.905069 2026] [:error] [pid 9760:tid 9781] [client 54.176.28.156:56192] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.uat"] [unique_id "af5I8mIkCp-C_fh0s7L77QAAAU8"]
[Sat May 09 04:34:59.765089 2026] [:error] [pid 9187:tid 9270] [client 54.176.28.156:56208] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.dist"] [unique_id "af5I8xC7An6gkXsRsaHKagAAAJE"]
[Sat May 09 04:35:00.577937 2026] [:error] [pid 9293:tid 9302] [client 54.176.28.156:56220] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.swp"] [unique_id "af5I9JR__qEzV5O6Z2OiHwAAAMU"]
[Sat May 09 04:35:01.276629 2026] [:error] [pid 9293:tid 9318] [client 54.176.28.156:56224] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env~"] [unique_id "af5I9ZR__qEzV5O6Z2OiIwAAANU"]
[Sat May 09 04:35:02.053615 2026] [:error] [pid 9663:tid 9673] [client 54.176.28.156:56232] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env1"] [unique_id "af5I9pcWIu01SCxbjwu2_AAAAQc"]
[Sat May 09 04:35:02.863447 2026] [:error] [pid 9663:tid 9676] [client 54.176.28.156:56246] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env2"] [unique_id "af5I9pcWIu01SCxbjwu2_QAAAQo"]
[Sat May 09 04:35:03.601355 2026] [:error] [pid 9663:tid 9682] [client 54.176.28.156:56256] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env_copy"] [unique_id "af5I95cWIu01SCxbjwu2_gAAARA"]
[Sat May 09 04:35:04.378097 2026] [:error] [pid 9293:tid 9321] [client 54.176.28.156:56268] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.txt"] [unique_id "af5I-JR__qEzV5O6Z2OiJgAAANg"]
[Sat May 09 04:35:05.132868 2026] [:error] [pid 9663:tid 9670] [client 54.176.28.156:39896] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.json"] [unique_id "af5I-ZcWIu01SCxbjwu3AAAAAQQ"]
[Sat May 09 04:35:05.925843 2026] [:error] [pid 9663:tid 9667] [client 54.176.28.156:39912] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.yaml"] [unique_id "af5I-ZcWIu01SCxbjwu3BAAAAQE"]
[Sat May 09 04:35:06.751111 2026] [:error] [pid 9760:tid 9769] [client 54.176.28.156:39916] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.yml"] [unique_id "af5I-mIkCp-C_fh0s7L79wAAAUM"]
[Sat May 09 04:35:07.512702 2026] [:error] [pid 9663:tid 9669] [client 54.176.28.156:39922] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/app/.env"] [unique_id "af5I-5cWIu01SCxbjwu3BQAAAQM"]
[Sat May 09 04:35:08.344555 2026] [:error] [pid 9293:tid 9320] [client 54.176.28.156:39934] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/apps/.env"] [unique_id "af5I_JR__qEzV5O6Z2OiLAAAANc"]
[Sat May 09 04:35:09.082616 2026] [:error] [pid 9187:tid 9264] [client 54.176.28.156:39950] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/api/.env"] [unique_id "af5I_RC7An6gkXsRsaHKdQAAAIs"]
[Sat May 09 04:35:09.924531 2026] [:error] [pid 9187:tid 9262] [client 54.176.28.156:39956] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/web/.env"] [unique_id "af5I_RC7An6gkXsRsaHKegAAAIk"]
[Sat May 09 04:35:10.820648 2026] [:error] [pid 9663:tid 9684] [client 54.176.28.156:39966] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/site/.env"] [unique_id "af5I_pcWIu01SCxbjwu3CAAAARI"]
[Sat May 09 04:35:11.616147 2026] [:error] [pid 9663:tid 9690] [client 54.176.28.156:39976] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/public/.env"] [unique_id "af5I_5cWIu01SCxbjwu3CQAAARg"]
[Sat May 09 04:35:12.377221 2026] [:error] [pid 9663:tid 9668] [client 54.176.28.156:39992] [client 54.176.28.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/admin/.env"] [unique_id "af5JAJcWIu01SCxbjwu3DgAAAQI"]
[Sat May 09 06:53:08.938983 2026] [:error] [pid 9184:tid 9213] [client 45.130.83.102:36453] [client 45.130.83.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.83.102, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af5pVIjfODqb_i0Fm99hCgAAABA"]
[Sat May 09 07:33:53.381327 2026] [:error] [pid 9293:tid 9314] [client 119.91.20.139:55892] [client 119.91.20.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "af5y4ZR__qEzV5O6Z2P1rwAAANE"]
[Sat May 09 07:57:20.476296 2026] [:error] [pid 9760:tid 9766] [client 130.25.96.79:51548] [client 130.25.96.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.25.96.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af54YGIkCp-C_fh0s7IV9AAAAUA"]
[Sat May 09 07:58:00.673563 2026] [:error] [pid 9833:tid 9839] [client 130.25.96.79:52188] [client 130.25.96.79] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "af54iCM9JmxIS0KGZUBGnAAAAYE"]
[Sat May 09 07:58:26.672252 2026] [:error] [pid 9920:tid 9924] [client 130.25.96.79:52636] [client 130.25.96.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.25.96.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af54okxitGYhlzgZb5Z8cQAAAcI"]
[Sat May 09 07:58:48.718784 2026] [:error] [pid 9293:tid 9312] [client 130.25.96.79:52996] [client 130.25.96.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.25.96.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af54uJR__qEzV5O6Z2P-DAAAAM8"]
[Sat May 09 07:59:10.827095 2026] [:error] [pid 9187:tid 9274] [client 130.25.96.79:53364] [client 130.25.96.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.25.96.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af54zhC7An6gkXsRsaENPQAAAJU"]
[Sat May 09 07:59:33.285478 2026] [:error] [pid 9186:tid 9232] [client 130.25.96.79:53693] [client 130.25.96.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 130.25.96.79, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af545RW4eFOEw1mKOgKOeQAAAEY"]
[Sat May 09 10:06:46.379261 2026] [:error] [pid 9186:tid 9247] [client 101.109.119.114:50068] [client 101.109.119.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 101.109.119.114, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af6WthW4eFOEw1mKOgKhbgAAAFU"]
[Sat May 09 10:06:56.267341 2026] [:error] [pid 9760:tid 9784] [client 101.109.119.114:50344] [client 101.109.119.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 101.109.119.114, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af6WwGIkCp-C_fh0s7IjrAAAAVI"]
[Sat May 09 10:07:06.465286 2026] [:error] [pid 9293:tid 9321] [client 101.109.119.114:50630] [client 101.109.119.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 101.109.119.114, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af6WypR__qEzV5O6Z2M1ZQAAANg"]
[Sat May 09 10:07:16.621908 2026] [:error] [pid 9760:tid 9784] [client 101.109.119.114:50916] [client 101.109.119.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 101.109.119.114, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af6W1GIkCp-C_fh0s7IjtwAAAVI"]
[Sat May 09 10:07:26.868628 2026] [:error] [pid 9663:tid 9682] [client 101.109.119.114:51202] [client 101.109.119.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 101.109.119.114, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af6W3pcWIu01SCxbjwv80QAAARA"]
[Sat May 09 10:19:43.939058 2026] [:error] [pid 9833:tid 9848] [client 20.151.175.120:20147] [client 20.151.175.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "af6ZvyM9JmxIS0KGZUBY-gAAAYo"]
[Sat May 09 10:19:44.763790 2026] [:error] [pid 9833:tid 9856] [client 20.151.175.120:20139] [client 20.151.175.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "af6ZwCM9JmxIS0KGZUBZAgAAAZI"]
[Sat May 09 10:19:45.640545 2026] [:error] [pid 9293:tid 9320] [client 20.151.175.120:20126] [client 20.151.175.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "af6ZwZR__qEzV5O6Z2M6EwAAANc"]
[Sat May 09 10:19:46.477158 2026] [:error] [pid 9186:tid 9242] [client 20.151.175.120:19904] [client 20.151.175.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "af6ZwhW4eFOEw1mKOgKjXAAAAFA"]
[Sat May 09 11:03:16.353645 2026] [:error] [pid 9293:tid 9309] [client 45.154.98.198:54704] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6j9JR__qEzV5O6Z2NMrgAAAMw"], referer: www.google.com
[Sat May 09 11:03:16.355281 2026] [:error] [pid 9293:tid 9317] [client 45.154.98.198:54672] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "af6j9JR__qEzV5O6Z2NMrwAAANQ"]
[Sat May 09 11:03:16.356114 2026] [:error] [pid 9293:tid 9307] [client 45.154.98.198:54712] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6j9JR__qEzV5O6Z2NMsAAAAMo"], referer: www.google.com
[Sat May 09 11:03:16.356725 2026] [:error] [pid 9833:tid 9838] [client 45.154.98.198:54716] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "af6j9CM9JmxIS0KGZUBfOAAAAYA"]
[Sat May 09 11:03:16.854295 2026] [:error] [pid 9186:tid 9236] [client 45.154.98.198:55566] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6j9BW4eFOEw1mKOgKrWAAAAEo"], referer: www.google.com
[Sat May 09 11:03:16.858733 2026] [:error] [pid 9760:tid 9778] [client 45.154.98.198:55599] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "af6j9GIkCp-C_fh0s7IpbgAAAUw"]
[Sat May 09 11:03:16.858800 2026] [:error] [pid 9833:tid 9839] [client 45.154.98.198:55602] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "af6j9CM9JmxIS0KGZUBfOQAAAYE"]
[Sat May 09 11:03:16.859644 2026] [:error] [pid 9184:tid 9207] [client 45.154.98.198:55603] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6j9IjfODqb_i0Fm997PAAAAAo"], referer: www.google.com
[Sat May 09 11:03:17.356186 2026] [:error] [pid 9760:tid 9766] [client 45.154.98.198:56948] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6j9WIkCp-C_fh0s7IpcAAAAUA"], referer: www.google.com
[Sat May 09 11:03:17.357962 2026] [:error] [pid 9293:tid 9301] [client 45.154.98.198:56961] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "af6j9ZR__qEzV5O6Z2NMsgAAAMQ"]
[Sat May 09 11:03:17.358557 2026] [:error] [pid 9293:tid 9299] [client 45.154.98.198:56958] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6j9ZR__qEzV5O6Z2NMswAAAMI"], referer: www.google.com
[Sat May 09 11:03:17.359982 2026] [:error] [pid 9293:tid 9311] [client 45.154.98.198:56965] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "af6j9ZR__qEzV5O6Z2NMtAAAAM4"]
[Sat May 09 11:03:17.853868 2026] [:error] [pid 9184:tid 9220] [client 45.154.98.198:58559] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6j9YjfODqb_i0Fm997PQAAABc"], referer: www.google.com
[Sat May 09 11:03:17.858329 2026] [:error] [pid 9293:tid 9306] [client 45.154.98.198:58602] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "af6j9ZR__qEzV5O6Z2NMtgAAAMk"]
[Sat May 09 11:03:17.858641 2026] [:error] [pid 9293:tid 9297] [client 45.154.98.198:58565] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6j9ZR__qEzV5O6Z2NMtwAAAMA"], referer: www.google.com
[Sat May 09 11:03:17.860838 2026] [:error] [pid 9293:tid 9300] [client 45.154.98.198:58567] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "af6j9ZR__qEzV5O6Z2NMuAAAAMM"]
[Sat May 09 11:03:18.353613 2026] [:error] [pid 9184:tid 9197] [client 45.154.98.198:59506] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6j9ojfODqb_i0Fm997PgAAAAA"], referer: www.google.com
[Sat May 09 11:03:18.356167 2026] [:error] [pid 9663:tid 9690] [client 45.154.98.198:59512] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "af6j9pcWIu01SCxbjwsHjgAAARg"]
[Sat May 09 11:03:18.356359 2026] [:error] [pid 9663:tid 9669] [client 45.154.98.198:59514] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6j9pcWIu01SCxbjwsHjwAAAQM"], referer: www.google.com
[Sat May 09 11:03:18.364153 2026] [:error] [pid 9293:tid 9317] [client 45.154.98.198:59515] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "af6j9pR__qEzV5O6Z2NMuQAAANQ"]
[Sat May 09 11:03:19.355655 2026] [:error] [pid 9293:tid 9305] [client 45.154.98.198:61800] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6j95R__qEzV5O6Z2NMugAAAMg"], referer: www.google.com
[Sat May 09 11:03:19.365392 2026] [:error] [pid 9663:tid 9678] [client 45.154.98.198:61811] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6j95cWIu01SCxbjwsHkQAAAQw"], referer: www.google.com
[Sat May 09 11:03:20.363163 2026] [:error] [pid 9833:tid 9842] [client 45.154.98.198:49458] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6j-CM9JmxIS0KGZUBfPgAAAYQ"], referer: www.google.com
[Sat May 09 11:03:20.377057 2026] [:error] [pid 9186:tid 9245] [client 45.154.98.198:49492] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6j-BW4eFOEw1mKOgKrXAAAAFM"], referer: www.google.com
[Sat May 09 11:03:21.362924 2026] [:error] [pid 9293:tid 9321] [client 45.154.98.198:51730] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6j-ZR__qEzV5O6Z2NMvQAAANg"], referer: www.google.com
[Sat May 09 11:03:21.385137 2026] [:error] [pid 9293:tid 9299] [client 45.154.98.198:51732] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6j-ZR__qEzV5O6Z2NMvgAAAMI"], referer: www.google.com
[Sat May 09 11:03:22.372037 2026] [:error] [pid 9293:tid 9303] [client 45.154.98.198:53735] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6j-pR__qEzV5O6Z2NMwwAAAMY"], referer: www.google.com
[Sat May 09 11:03:22.392829 2026] [:error] [pid 9293:tid 9320] [client 45.154.98.198:53857] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6j-pR__qEzV5O6Z2NMxAAAANc"], referer: www.google.com
[Sat May 09 11:03:22.625027 2026] [:error] [pid 9833:tid 9860] [client 45.154.98.198:62659] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "af6j-iM9JmxIS0KGZUBfQAAAAZY"], referer: www.google.com
[Sat May 09 11:03:23.405462 2026] [:error] [pid 9293:tid 9310] [client 45.154.98.198:54817] [client 45.154.98.198] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "af6j-5R__qEzV5O6Z2NMxwAAAM0"], referer: www.google.com
[Sat May 09 11:07:40.681917 2026] [:error] [pid 9760:tid 9785] [client 43.160.219.138:38634] [client 43.160.219.138] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "af6k_GIkCp-C_fh0s7Ip1wAAAVM"]
[Sat May 09 11:15:04.496250 2026] [:error] [pid 9293:tid 9321] [client 143.44.197.196:55383] [client 143.44.197.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.44.197.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af6muJR__qEzV5O6Z2NSbwAAANg"]
[Sat May 09 11:15:15.115693 2026] [:error] [pid 9186:tid 9245] [client 143.44.197.196:56197] [client 143.44.197.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.44.197.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af6mwxW4eFOEw1mKOgKtugAAAFM"]
[Sat May 09 11:15:26.597369 2026] [:error] [pid 9293:tid 9319] [client 143.44.197.196:57128] [client 143.44.197.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.44.197.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af6mzpR__qEzV5O6Z2NShQAAANY"]
[Sat May 09 11:15:38.046846 2026] [:error] [pid 9184:tid 9204] [client 143.44.197.196:57925] [client 143.44.197.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.44.197.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af6m2ojfODqb_i0Fm998wAAAAAc"]
[Sat May 09 11:15:48.822392 2026] [:error] [pid 9293:tid 9316] [client 143.44.197.196:58625] [client 143.44.197.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.44.197.196, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af6m5JR__qEzV5O6Z2NSpwAAANM"]
[Sat May 09 11:23:01.679460 2026] [:error] [pid 9663:tid 9684] [client 194.87.25.79:44468] [client 194.87.25.79] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||expressinteriors.com|F|2"] [data "TX:0=audio/x-ms-wma"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "af6olZcWIu01SCxbjwsLzgAAARI"]
[Sat May 09 12:13:35.058689 2026] [:error] [pid 9293:tid 9313] [client 35.197.94.227:61999] [client 35.197.94.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.197.94.227, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af60b5R__qEzV5O6Z2NqjwAAANA"]
[Sat May 09 12:13:37.078844 2026] [:error] [pid 9293:tid 9310] [client 35.197.94.227:61999] [client 35.197.94.227] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "af60cZR__qEzV5O6Z2NqmAAAAM0"]
[Sat May 09 12:13:37.393301 2026] [:error] [pid 9293:tid 9308] [client 35.197.94.227:61999] [client 35.197.94.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.197.94.227, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af60cZR__qEzV5O6Z2NqmgAAAMs"]
[Sat May 09 12:13:38.946964 2026] [:error] [pid 9186:tid 9243] [client 35.197.94.227:63342] [client 35.197.94.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.197.94.227, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af60chW4eFOEw1mKOgK2oAAAAFE"]
[Sat May 09 12:13:40.501337 2026] [:error] [pid 9833:tid 9850] [client 35.197.94.227:51687] [client 35.197.94.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.197.94.227, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af60dCM9JmxIS0KGZUBpDwAAAYw"]
[Sat May 09 12:13:42.034286 2026] [:error] [pid 9186:tid 9230] [client 35.197.94.227:51113] [client 35.197.94.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.197.94.227, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af60dhW4eFOEw1mKOgK2ogAAAEQ"]
[Sat May 09 12:13:43.534105 2026] [:error] [pid 9187:tid 9255] [client 35.197.94.227:61092] [client 35.197.94.227] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.197.94.227, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af60dxC7An6gkXsRsaFYNwAAAII"]
[Sat May 09 12:13:43.534279 2026] [:error] [pid 9187:tid 9255] [client 35.197.94.227:61092] [client 35.197.94.227] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.197.94.227, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af60dxC7An6gkXsRsaFYNwAAAII"]
[Sat May 09 12:59:46.227780 2026] [:error] [pid 9187:tid 9265] [client 45.132.115.191:53289] [client 45.132.115.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.191, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af6_QhC7An6gkXsRsaFmhAAAAIw"]
[Sat May 09 14:09:40.720318 2026] [:error] [pid 9293:tid 9298] [client 170.106.167.214:51630] [client 170.106.167.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "af7PpJR__qEzV5O6Z2OI7gAAAME"]
[Sat May 09 15:22:09.753322 2026] [:error] [pid 9184:tid 9204] [client 34.65.8.101:33502] [client 34.65.8.101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "af7goYjfODqb_i0Fm9-SeQAAAAc"]
[Sat May 09 16:04:46.166326 2026] [:error] [pid 9184:tid 9218] [client 51.20.248.243:55040] [client 51.20.248.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.20.248.243, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af7qnojfODqb_i0Fm9-VpAAAABU"]
[Sat May 09 17:17:04.740087 2026] [:error] [pid 9187:tid 9274] [client 45.92.229.131:50755] [client 45.92.229.131] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.92.229.131, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af77kBC7An6gkXsRsaG_pwAAAJU"]
[Sat May 09 17:44:54.671701 2026] [:error] [pid 9187:tid 9271] [client 43.165.174.53:34426] [client 43.165.174.53] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "af8CFhC7An6gkXsRsaHK1gAAAJI"]
[Sat May 09 18:45:04.877763 2026] [:error] [pid 9293:tid 9317] [client 194.62.107.21:57519] [client 194.62.107.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "af8QMJR__qEzV5O6Z2PX_QAAANQ"]
[Sat May 09 19:55:13.792168 2026] [:error] [pid 9187:tid 9265] [client 119.28.140.106:43992] [client 119.28.140.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "af8goRC7An6gkXsRsaH8ggAAAIw"]
[Sat May 09 20:41:41.769621 2026] [:error] [pid 55191:tid 55280] [client 193.36.224.205:51135] [client 193.36.224.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.224.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af8rhfMcqx1kfQsw7c4AqQAAAIM"]
[Sat May 09 20:57:13.703549 2026] [:error] [pid 55353:tid 55361] [client 51.20.248.243:63876] [client 51.20.248.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.20.248.243, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af8vKSDuyNO3XosoIYQ_XQAAAQY"]
[Sat May 09 22:30:36.136299 2026] [:error] [pid 55186:tid 55254] [client 136.144.19.135:26955] [client 136.144.19.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.19.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af9FDJPIspqZdXg7QQu6XAAAAEU"]
[Sat May 09 22:57:34.202751 2026] [:error] [pid 55353:tid 55376] [client 216.24.219.2:42317] [client 216.24.219.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.219.2, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af9LXiDuyNO3XosoIYRrGQAAARU"]
[Sat May 09 23:22:37.150587 2026] [:error] [pid 55353:tid 55375] [client 43.157.52.37:53700] [client 43.157.52.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "af9RPSDuyNO3XosoIYRzpwAAARQ"]
[Sat May 09 23:56:09.796907 2026] [:error] [pid 62831:tid 62847] [client 197.240.255.208:58303] [client 197.240.255.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.240.255.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af9ZGeYBNqNhtZ_l7qBKIAAAAA4"]
[Sat May 09 23:56:19.677358 2026] [:error] [pid 62831:tid 62850] [client 197.240.255.208:58682] [client 197.240.255.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.240.255.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af9ZI-YBNqNhtZ_l7qBKLQAAABE"]
[Sat May 09 23:56:30.210323 2026] [:error] [pid 55353:tid 55373] [client 197.240.255.208:58994] [client 197.240.255.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.240.255.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af9ZLiDuyNO3XosoIYR7lAAAARI"]
[Sat May 09 23:56:40.851435 2026] [:error] [pid 55191:tid 55298] [client 197.240.255.208:59310] [client 197.240.255.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.240.255.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af9ZOPMcqx1kfQsw7c4qewAAAJU"]
[Sat May 09 23:56:51.511836 2026] [:error] [pid 55191:tid 55278] [client 197.240.255.208:59614] [client 197.240.255.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.240.255.208, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af9ZQ_Mcqx1kfQsw7c4qgAAAAIE"]
[Sun May 10 01:54:46.387546 2026] [:error] [pid 62831:tid 62855] [client 45.92.229.138:43933] [client 45.92.229.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.92.229.138, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af905uYBNqNhtZ_l7qButwAAABY"]
[Sun May 10 03:40:37.679410 2026] [:error] [pid 31297:tid 31344] [client 45.132.115.194:36981] [client 45.132.115.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af-NtSoAPjrAGv0wV_45eQAAAEU"]
[Sun May 10 05:01:24.505580 2026] [:error] [pid 32915:tid 32936] [client 45.132.115.179:58445] [client 45.132.115.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af-gpDg8EIe76RX8AUaEkQAAARA"]
[Sun May 10 06:17:01.326305 2026] [:error] [pid 62803:tid 62867] [client 187.38.60.98:5435] [client 187.38.60.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.38.60.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af-yXU5oy4jU7eVtNaX5dAAAAIM"]
[Sun May 10 06:18:58.596029 2026] [:error] [pid 62803:tid 62880] [client 187.38.60.98:5616] [client 187.38.60.98] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "af-y0k5oy4jU7eVtNaX5vAAAAJA"]
[Sun May 10 06:19:32.615708 2026] [:error] [pid 62910:tid 62916] [client 187.38.60.98:5404] [client 187.38.60.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.38.60.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af-y9N5YAy_h5VqgWqhmpgAAAMQ"]
[Sun May 10 06:20:03.739009 2026] [:error] [pid 62801:tid 62824] [client 187.38.60.98:5480] [client 187.38.60.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.38.60.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af-zExMFDul6kZmcchAxIgAAAA4"]
[Sun May 10 06:20:35.434272 2026] [:error] [pid 32915:tid 32943] [client 187.38.60.98:5491] [client 187.38.60.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.38.60.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af-zMzg8EIe76RX8AUai7wAAARc"]
[Sun May 10 06:21:06.024878 2026] [:error] [pid 62803:tid 62879] [client 187.38.60.98:5321] [client 187.38.60.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.38.60.98, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "af-zUk5oy4jU7eVtNaX6GwAAAI8"]
[Sun May 10 06:21:30.846571 2026] [:error] [pid 62802:tid 62841] [client 136.144.43.167:41983] [client 136.144.43.167] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.43.167, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af-zaqt9wnaRe0v-MkbKOQAAAEQ"]
[Sun May 10 07:22:49.029567 2026] [:error] [pid 62910:tid 62921] [client 43.153.86.78:43664] [client 43.153.86.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "af_Byd5YAy_h5VqgWqhxDAAAAMk"]
[Sun May 10 07:52:03.225680 2026] [:error] [pid 46331:tid 46380] [client 51.20.248.243:56372] [client 51.20.248.243] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.20.248.243, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af_IowP02hpYETwsZpgPQwAAAIo"]
[Sun May 10 07:57:10.821527 2026] [:error] [pid 46417:tid 46431] [client 136.144.43.158:57931] [client 136.144.43.158] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.43.158, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af_J1mInm7mhwgbe48Zj-QAAAQw"]
[Sun May 10 08:18:20.417322 2026] [:error] [pid 46417:tid 46429] [client 192.144.148.122:37068] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "af_OzGInm7mhwgbe48Zm5wAAAQo"]
[Sun May 10 09:45:12.126595 2026] [:error] [pid 52634:tid 52653] [client 172.98.33.81:62931] [client 172.98.33.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.33.81, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af_jKNwp8XoWCwFb54CnKAAAAM8"]
[Sun May 10 11:33:36.454227 2026] [:error] [pid 46329:tid 46343] [client 45.132.115.106:63421] [client 45.132.115.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.106, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "af_8kOFo7Z2I88d0gPJjbgAAAAo"]
[Sun May 10 13:06:59.300484 2026] [:error] [pid 46417:tid 46439] [client 172.98.33.82:26627] [client 172.98.33.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 172.98.33.82, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agASc2Inm7mhwgbe48ad8gAAARQ"]
[Sun May 10 13:28:07.411014 2026] [:error] [pid 52634:tid 52655] [client 154.54.100.175:53560] [client 154.54.100.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/HEAD"] [unique_id "agAXZ9wp8XoWCwFb54DkEgAAANE"]
[Sun May 10 13:42:04.396849 2026] [:error] [pid 52634:tid 52650] [client 46.235.40.21:47704] [client 46.235.40.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.235.40.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agAarNwp8XoWCwFb54Dn7QAAAMw"]
[Sun May 10 13:42:05.267138 2026] [:error] [pid 52634:tid 52660] [client 46.235.40.21:47704] [client 46.235.40.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.235.40.21, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agAardwp8XoWCwFb54Dn8gAAANY"], referer: https://expressinteriors.com/wp-login.php
[Sun May 10 13:59:54.000140 2026] [:error] [pid 46417:tid 46440] [client 45.14.225.211:52188] [client 45.14.225.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.14.225.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agAe2WInm7mhwgbe48ancQAAARU"]
[Sun May 10 13:59:54.875331 2026] [:error] [pid 46417:tid 46423] [client 45.14.225.211:52188] [client 45.14.225.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.14.225.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agAe2mInm7mhwgbe48andAAAAQQ"], referer: https://expressinteriors.com/wp-login.php
[Sun May 10 14:05:56.635092 2026] [:error] [pid 52634:tid 52657] [client 160.22.108.208:55410] [client 160.22.108.208] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 160.22.108.208, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agAgRNwp8XoWCwFb54DtlwAAANM"]
[Sun May 10 14:05:57.655372 2026] [:error] [pid 52634:tid 52661] [client 160.22.108.208:55410] [client 160.22.108.208] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 160.22.108.208, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agAgRdwp8XoWCwFb54DtmAAAANc"], referer: https://expressinteriors.com/wp-login.php
[Sun May 10 14:40:38.718697 2026] [:error] [pid 52634:tid 52648] [client 45.132.115.125:44465] [client 45.132.115.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.125, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agAoZtwp8XoWCwFb54D2kgAAAMo"]
[Sun May 10 16:20:10.729352 2026] [:error] [pid 46329:tid 46350] [client 45.132.115.177:46785] [client 45.132.115.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agA_uuFo7Z2I88d0gPKDGgAAABE"]
[Sun May 10 17:50:50.299040 2026] [:error] [pid 9394:tid 9418] [client 45.132.115.186:58851] [client 45.132.115.186] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.186, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agBU-kJUdgQGD7EiiFYdnwAAAdY"]
[Sun May 10 18:15:29.681206 2026] [:error] [pid 16096:tid 16121] [client 92.36.72.96:20727] [client 92.36.72.96] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agBawa8wyxcrT50p9ku_8gAAAFQ"]
[Sun May 10 18:49:12.726023 2026] [:error] [pid 16136:tid 16141] [client 86.134.9.195:54945] [client 86.134.9.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.134.9.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agBiqEOBGdmCMnPX0MfmDgAAAIM"]
[Sun May 10 18:49:22.685414 2026] [:error] [pid 16037:tid 16049] [client 86.134.9.195:55294] [client 86.134.9.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.134.9.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agBisnzjLQfyYTkAdSRzbQAAAAg"]
[Sun May 10 18:49:33.118894 2026] [:error] [pid 16136:tid 16158] [client 86.134.9.195:55559] [client 86.134.9.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.134.9.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agBivUOBGdmCMnPX0MfmKAAAAJQ"]
[Sun May 10 18:49:43.459503 2026] [:error] [pid 16136:tid 16150] [client 86.134.9.195:55817] [client 86.134.9.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.134.9.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agBix0OBGdmCMnPX0MfmOQAAAIw"]
[Sun May 10 18:49:53.838335 2026] [:error] [pid 16037:tid 16059] [client 86.134.9.195:56084] [client 86.134.9.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 86.134.9.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agBi0XzjLQfyYTkAdSRzkgAAABI"]
[Sun May 10 19:06:13.574803 2026] [:error] [pid 37030:tid 37054] [client 45.132.115.193:30599] [client 45.132.115.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agBmpZrBzfXWwKkDkdaEDgAAANY"]
[Sun May 10 20:22:38.850352 2026] [:error] [pid 16096:tid 16110] [client 45.132.115.182:61617] [client 45.132.115.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.182, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agB4jq8wyxcrT50p9kvVNAAAAEk"]
[Sun May 10 20:31:41.098792 2026] [:error] [pid 16136:tid 16159] [client 170.106.193.108:55772] [client 170.106.193.108] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agB6rUOBGdmCMnPX0Mf7QAAAAJU"]
[Sun May 10 21:09:01.808674 2026] [:error] [pid 37030:tid 37049] [client 65.111.4.226:43213] [client 65.111.4.226] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.svn/wc.db"] [unique_id "agCDbZrBzfXWwKkDkdanowAAANE"]
[Sun May 10 21:31:16.313584 2026] [:error] [pid 16096:tid 16114] [client 45.132.115.189:20967] [client 45.132.115.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agCIpK8wyxcrT50p9kvdPQAAAE0"]
[Sun May 10 21:47:34.820632 2026] [:error] [pid 37030:tid 37052] [client 67.20.113.139:22576] [client 67.20.113.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.20.113.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agCMdprBzfXWwKkDkdawNgAAANQ"]
[Sun May 10 21:47:35.847278 2026] [:error] [pid 37030:tid 37042] [client 67.20.113.139:22576] [client 67.20.113.139] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.20.113.139, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agCMd5rBzfXWwKkDkdawOAAAAMo"], referer: https://expressinteriors.com/wp-login.php
[Sun May 10 22:07:47.438958 2026] [autoindex:error] [pid 37030:tid 37032] [client 20.5.8.136:62600] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sun May 10 22:36:16.160340 2026] [:error] [pid 16136:tid 16142] [client 45.132.115.198:65497] [client 45.132.115.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.198, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agCX4EOBGdmCMnPX0McNsQAAAIQ"]
[Sun May 10 22:44:16.445750 2026] [:error] [pid 16136:tid 16153] [client 34.101.239.45:37502] [client 34.101.239.45] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "agCZwEOBGdmCMnPX0McOzQAAAI8"]
[Sun May 10 23:30:38.667946 2026] [:error] [pid 16136:tid 16143] [client 94.247.172.129:26046] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agCknkOBGdmCMnPX0McVRgAAAIU"]
[Sun May 10 23:33:56.144885 2026] [:error] [pid 37030:tid 37048] [client 45.132.115.175:30119] [client 45.132.115.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.175, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agClZJrBzfXWwKkDkdbJTwAAANA"]
[Sun May 10 23:39:55.332898 2026] [:error] [pid 16038:tid 16068] [client 192.176.172.166:58200] [client 192.176.172.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.176.172.166, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agCmy04hf5Tcsfa2scJpbAAAAYA"]
[Sun May 10 23:39:56.240002 2026] [:error] [pid 16038:tid 16085] [client 192.176.172.166:58200] [client 192.176.172.166] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.176.172.166, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agCmzE4hf5Tcsfa2scJpbgAAAZE"], referer: https://expressinteriors.com/wp-login.php
[Mon May 11 00:33:36.895575 2026] [:error] [pid 16038:tid 16079] [client 45.132.115.193:49893] [client 45.132.115.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agCzYE4hf5Tcsfa2scJt4gAAAYs"]
[Mon May 11 01:21:13.297288 2026] [:error] [pid 16096:tid 16119] [client 198.105.112.15:54776] [client 198.105.112.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.105.112.15, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agC-ia8wyxcrT50p9kv1JwAAAFI"]
[Mon May 11 01:21:14.597283 2026] [:error] [pid 16096:tid 16114] [client 198.105.112.15:54776] [client 198.105.112.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.105.112.15, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agC-iq8wyxcrT50p9kv1LgAAAE0"], referer: https://expressinteriors.com/wp-login.php
[Mon May 11 01:37:10.374983 2026] [:error] [pid 16038:tid 16073] [client 161.97.134.176:58284] [client 161.97.134.176] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.97.134.176, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agDCRk4hf5Tcsfa2scJ65wAAAYU"]
[Mon May 11 01:37:11.300615 2026] [:error] [pid 16038:tid 16089] [client 161.97.134.176:58284] [client 161.97.134.176] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.97.134.176, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agDCR04hf5Tcsfa2scJ66AAAAZU"], referer: https://expressinteriors.com/wp-login.php
[Mon May 11 01:38:32.024317 2026] [:error] [pid 37030:tid 37050] [client 45.132.115.198:64739] [client 45.132.115.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.132.115.198, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agDCmJrBzfXWwKkDkdbXmwAAANI"]
[Mon May 11 03:00:56.230452 2026] [:error] [pid 16136:tid 16155] [client 194.163.160.0:61021] [client 194.163.160.0] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "agDV6EOBGdmCMnPX0McpHgAAAJE"], referer: www.google.com
[Mon May 11 03:16:25.182287 2026] [:error] [pid 16096:tid 16110] [client 158.173.67.78:21565] [client 158.173.67.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agDZia8wyxcrT50p9kv9lAAAAEk"]
[Mon May 11 03:16:25.695774 2026] [:error] [pid 9842:tid 9857] [client 158.173.67.235:55807] [client 158.173.67.235] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agDZiUKCvgYKKAjiZbJ8GgAAAQw"]
[Mon May 11 03:16:25.703165 2026] [:error] [pid 16136:tid 16141] [client 158.173.67.220:35923] [client 158.173.67.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agDZiUOBGdmCMnPX0McrGAAAAIM"]
[Mon May 11 03:16:26.204632 2026] [:error] [pid 16038:tid 16080] [client 158.173.67.110:56521] [client 158.173.67.110] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agDZik4hf5Tcsfa2scKQcgAAAYw"]
[Mon May 11 03:16:26.721014 2026] [:error] [pid 16038:tid 16088] [client 158.173.67.63:33603] [client 158.173.67.63] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agDZik4hf5Tcsfa2scKQfAAAAZQ"]
[Mon May 11 03:16:26.734903 2026] [:error] [pid 37030:tid 37046] [client 158.173.67.234:28439] [client 158.173.67.234] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agDZiprBzfXWwKkDkdbiYQAAAM4"]
[Mon May 11 03:16:27.248100 2026] [:error] [pid 9842:tid 9869] [client 158.173.67.110:54191] [client 158.173.67.110] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agDZi0KCvgYKKAjiZbJ8LAAAARg"]
[Mon May 11 03:16:27.703132 2026] [:error] [pid 16136:tid 16141] [client 158.173.67.26:57489] [client 158.173.67.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agDZi0OBGdmCMnPX0McrQgAAAIM"]
[Mon May 11 03:16:27.765130 2026] [:error] [pid 16136:tid 16138] [client 158.173.67.110:30065] [client 158.173.67.110] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agDZi0OBGdmCMnPX0McrRQAAAIA"]
[Mon May 11 03:16:28.730822 2026] [:error] [pid 16037:tid 16044] [client 158.173.67.177:63445] [client 158.173.67.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agDZjHzjLQfyYTkAdSSxRgAAAAM"]
[Mon May 11 03:16:28.792184 2026] [:error] [pid 16038:tid 16081] [client 158.173.67.220:52309] [client 158.173.67.220] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agDZjE4hf5Tcsfa2scKQjQAAAY0"]
[Mon May 11 03:16:29.756760 2026] [:error] [pid 16037:tid 16044] [client 158.173.67.91:60279] [client 158.173.67.91] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agDZjXzjLQfyYTkAdSSxWAAAAAM"]
[Mon May 11 03:16:29.854633 2026] [:error] [pid 54857:tid 54872] [client 158.173.67.135:44567] [client 158.173.67.135] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agDZjcIMxCDAKjKxP7D_OAAAAUg"]
[Mon May 11 03:16:30.816977 2026] [:error] [pid 54857:tid 54864] [client 158.173.67.44:37657] [client 158.173.67.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agDZjsIMxCDAKjKxP7D_RwAAAUA"]
[Mon May 11 03:16:31.834845 2026] [:error] [pid 16037:tid 16053] [client 158.173.67.210:30563] [client 158.173.67.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agDZj3zjLQfyYTkAdSSxbgAAAAw"]
[Mon May 11 05:32:28.576009 2026] [:error] [pid 65260:tid 65311] [client 43.130.47.33:49840] [client 43.130.47.33] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agD5bDqbzwIHjP6Y_3FwZwAAAE8"]
[Mon May 11 07:03:35.620735 2026] [:error] [pid 65259:tid 65292] [client 87.120.197.135:38658] [client 87.120.197.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 87.120.197.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agEOxwPsXLnMa32ma5BYGQAAABg"]
[Mon May 11 07:03:36.672055 2026] [:error] [pid 65259:tid 65278] [client 87.120.197.135:38658] [client 87.120.197.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 87.120.197.135, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agEOyAPsXLnMa32ma5BYGwAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Mon May 11 07:11:37.489293 2026] [:error] [pid 35052:tid 35071] [client 186.22.17.80:18482] [client 186.22.17.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.22.17.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agEQqeHjpNNnFJrMXu2H0AAAAVA"]
[Mon May 11 07:13:20.073479 2026] [:error] [pid 35052:tid 35063] [client 186.22.17.80:18509] [client 186.22.17.80] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agEREOHjpNNnFJrMXu2IWgAAAUg"]
[Mon May 11 07:13:56.924252 2026] [:error] [pid 9335:tid 9345] [client 186.22.17.80:18437] [client 186.22.17.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.22.17.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agERNHmXqumINT8bKREtKwAAAQg"]
[Mon May 11 07:14:32.331942 2026] [:error] [pid 65261:tid 65347] [client 186.22.17.80:18427] [client 186.22.17.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.22.17.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agERWJu_9uQJeFrcOstAPgAAAJg"]
[Mon May 11 07:15:05.005053 2026] [:error] [pid 65366:tid 65387] [client 186.22.17.80:18479] [client 186.22.17.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.22.17.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agEReahVGdYzapDtv-H62wAAANI"]
[Mon May 11 07:15:39.328429 2026] [:error] [pid 35052:tid 35072] [client 186.22.17.80:63030] [client 186.22.17.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.22.17.80, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agERm-HjpNNnFJrMXu2JQgAAAVE"]
[Mon May 11 09:39:17.895341 2026] [:error] [pid 35052:tid 35062] [client 43.153.19.83:49714] [client 43.153.19.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agEzReHjpNNnFJrMXu2qsAAAAUc"]
[Mon May 11 12:04:32.804654 2026] [:error] [pid 65261:tid 65347] [client 43.157.180.116:48572] [client 43.157.180.116] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agFVUJu_9uQJeFrcOsthJQAAAJg"]
[Mon May 11 12:48:52.370544 2026] [:error] [pid 65366:tid 65390] [client 148.113.9.51:37614] [client 148.113.9.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.113.9.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agFftKhVGdYzapDtv-EquQAAANU"]
[Mon May 11 12:48:53.502766 2026] [:error] [pid 65366:tid 65389] [client 148.113.9.51:37614] [client 148.113.9.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.113.9.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agFftahVGdYzapDtv-EquwAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Mon May 11 13:52:48.590007 2026] [:error] [pid 35052:tid 35069] [client 103.201.127.217:56028] [client 103.201.127.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.201.127.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agFusOHjpNNnFJrMXu3zbwAAAU4"]
[Mon May 11 13:52:59.172820 2026] [:error] [pid 9335:tid 9358] [client 103.201.127.217:56414] [client 103.201.127.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.201.127.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agFuu3mXqumINT8bKRF6UAAAARU"]
[Mon May 11 13:53:09.999006 2026] [:error] [pid 9335:tid 9353] [client 103.201.127.217:56714] [client 103.201.127.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.201.127.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agFuxXmXqumINT8bKRF6VwAAARA"]
[Mon May 11 13:53:20.651783 2026] [:error] [pid 65259:tid 65275] [client 103.201.127.217:57004] [client 103.201.127.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.201.127.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agFu0APsXLnMa32ma5B5YgAAAAc"]
[Mon May 11 13:53:31.212485 2026] [:error] [pid 9335:tid 9359] [client 103.201.127.217:57288] [client 103.201.127.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.201.127.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agFu23mXqumINT8bKRF6bwAAARY"]
[Mon May 11 14:16:17.482215 2026] [:error] [pid 58750:tid 58767] [client 82.165.150.73:60180] [client 82.165.150.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.165.150.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agF0MTBVaNG3wJtPBU-IMAAAAU8"]
[Mon May 11 14:16:18.444001 2026] [:error] [pid 58750:tid 58775] [client 82.165.150.73:60180] [client 82.165.150.73] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.165.150.73, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agF0MjBVaNG3wJtPBU-IOQAAAVc"], referer: https://expressinteriors.com/wp-login.php
[Mon May 11 14:50:30.574399 2026] [:error] [pid 4645:tid 4669] [client 144.76.64.174:56358] [client 144.76.64.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 144.76.64.174, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agF8Nny4dxn8-Cx5vOWAggAAAFU"]
[Mon May 11 14:50:31.477208 2026] [:error] [pid 4645:tid 4650] [client 144.76.64.174:56358] [client 144.76.64.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 144.76.64.174, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agF8N3y4dxn8-Cx5vOWAlgAAAEI"], referer: https://expressinteriors.com/wp-login.php
[Mon May 11 15:48:20.391908 2026] [:error] [pid 4685:tid 4712] [client 34.32.31.30:54836] [client 34.32.31.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "agGJxHwrjbU4NZilCZ-3wAAAARg"]
[Mon May 11 16:21:52.580101 2026] [:error] [pid 58615:tid 58637] [client 49.36.25.64:62978] [client 49.36.25.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.25.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agGRoFK28yH055J8TSrK7gAAABI"]
[Mon May 11 16:22:02.767088 2026] [:error] [pid 58750:tid 58762] [client 49.36.25.64:49642] [client 49.36.25.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.25.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agGRqjBVaNG3wJtPBU-ayQAAAUo"]
[Mon May 11 16:22:13.293763 2026] [:error] [pid 58616:tid 58663] [client 49.36.25.64:40801] [client 49.36.25.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.25.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agGRtdnsbeF5ioCAecjYpAAAANE"]
[Mon May 11 16:22:23.832030 2026] [:error] [pid 4685:tid 4697] [client 49.36.25.64:54044] [client 49.36.25.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.25.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agGRv3wrjbU4NZilCZ_BcwAAAQk"]
[Mon May 11 16:22:34.466856 2026] [:error] [pid 58677:tid 58706] [client 49.36.25.64:18718] [client 49.36.25.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.36.25.64, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agGRyhasRhyteIXf1RVFKQAAAJI"]
[Mon May 11 16:26:54.374743 2026] [:error] [pid 4685:tid 4706] [client 103.208.218.164:33082] [client 103.208.218.164] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.208.218.164, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agGSznwrjbU4NZilCZ_CXQAAARI"]
[Mon May 11 16:27:07.806717 2026] [:error] [pid 58677:tid 58696] [client 103.208.218.164:36602] [client 103.208.218.164] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "agGS2xasRhyteIXf1RVFwgAAAIg"]
[Mon May 11 17:55:16.481467 2026] [:error] [pid 4685:tid 4702] [client 43.153.73.200:58094] [client 43.153.73.200] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agGnhHwrjbU4NZilCZ_WpQAAAQ4"]
[Mon May 11 19:31:07.263395 2026] [:error] [pid 4685:tid 4698] [client 51.195.41.174:55910] [client 51.195.41.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.195.41.174, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agG9-3wrjbU4NZilCZ_xeAAAAQo"]
[Mon May 11 19:31:08.449605 2026] [:error] [pid 4685:tid 4689] [client 51.195.41.174:55910] [client 51.195.41.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.195.41.174, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agG9_HwrjbU4NZilCZ_xegAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Mon May 11 20:45:27.239829 2026] [:error] [pid 58677:tid 58691] [client 129.226.209.117:38080] [client 129.226.209.117] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agHPZxasRhyteIXf1RVqiQAAAIM"]
[Mon May 11 21:28:21.107375 2026] [:error] [pid 58750:tid 58759] [client 49.235.136.28:49238] [client 49.235.136.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agHZdTBVaNG3wJtPBU-03wAAAUc"]
[Mon May 11 22:19:10.497365 2026] [:error] [pid 58677:tid 58698] [client 101.32.128.28:38156] [client 101.32.128.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agHlXhasRhyteIXf1RV2MgAAAIo"]
[Tue May 12 00:29:30.331380 2026] [:error] [pid 4685:tid 4690] [client 34.175.183.228:46964] [client 34.175.183.228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "agID6nwrjbU4NZilCZ8zVQAAAQI"]
[Tue May 12 00:46:39.498938 2026] [:error] [pid 4645:tid 4653] [client 92.100.111.253:59314] [client 92.100.111.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.100.111.253, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agIH73y4dxn8-Cx5vOXiwgAAAEU"]
[Tue May 12 00:46:41.296134 2026] [:error] [pid 4685:tid 4700] [client 92.100.111.253:55676] [client 92.100.111.253] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agIH8XwrjbU4NZilCZ83WQAAAQw"]
[Tue May 12 00:46:43.873779 2026] [:error] [pid 4685:tid 4692] [client 92.100.111.253:55676] [client 92.100.111.253] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agIH83wrjbU4NZilCZ83XQAAAQQ"]
[Tue May 12 02:12:41.986342 2026] [:error] [pid 4685:tid 4698] [client 43.135.36.201:56506] [client 43.135.36.201] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agIcGXwrjbU4NZilCZ9GxwAAAQo"]
[Tue May 12 02:42:52.591447 2026] [:error] [pid 4685:tid 4705] [client 146.120.212.154:1054] [client 146.120.212.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.120.212.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agIjLHwrjbU4NZilCZ9L2QAAARE"]
[Tue May 12 02:45:26.474015 2026] [:error] [pid 58677:tid 58712] [client 146.120.212.154:51095] [client 146.120.212.154] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agIjxhasRhyteIXf1RWTdAAAAJg"]
[Tue May 12 02:46:07.033609 2026] [:error] [pid 4685:tid 4709] [client 146.120.212.154:51705] [client 146.120.212.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.120.212.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agIj73wrjbU4NZilCZ9MQwAAARU"]
[Tue May 12 02:46:41.833169 2026] [:error] [pid 58616:tid 58659] [client 146.120.212.154:52053] [client 146.120.212.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.120.212.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agIkEdnsbeF5ioCAecgHdgAAAM0"]
[Tue May 12 02:47:12.796599 2026] [:error] [pid 58616:tid 58653] [client 146.120.212.154:52504] [client 146.120.212.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.120.212.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agIkMNnsbeF5ioCAecgHhQAAAMc"]
[Tue May 12 02:47:43.266990 2026] [:error] [pid 4685:tid 4688] [client 146.120.212.154:60962] [client 146.120.212.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.120.212.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agIkT3wrjbU4NZilCZ9MpgAAAQA"]
[Tue May 12 04:45:34.023614 2026] [:error] [pid 40061:tid 40079] [client 66.42.96.24:55898] [client 66.42.96.24] ModSecurity: Multipart parsing error (init): Multipart: Boundary not found in C-T. [hostname "expressinteriors.com"] [uri "/"] [unique_id "agI_7rycIKt8hxHMBYt5yAAAANA"]
[Tue May 12 04:45:34.025280 2026] [:error] [pid 40061:tid 40079] [client 66.42.96.24:55898] [client 66.42.96.24] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "Multipart: Boundary not found in C-T."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agI_7rycIKt8hxHMBYt5yAAAANA"]
[Tue May 12 04:45:34.025388 2026] [:error] [pid 40061:tid 40079] [client 66.42.96.24:55898] [client 66.42.96.24] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 0, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agI_7rycIKt8hxHMBYt5yAAAANA"]
[Tue May 12 04:59:04.493384 2026] [:error] [pid 39956:tid 39967] [client 43.166.132.142:57190] [client 43.166.132.142] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agJDGI2K3wZDsNji3My_-AAAAAI"]
[Tue May 12 05:14:10.778947 2026] [:error] [pid 40061:tid 40087] [client 176.65.139.232:33496] [client 176.65.139.232] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/app/.env"] [unique_id "agJGorycIKt8hxHMBYt9jQAAANg"]
[Tue May 12 06:28:52.351142 2026] [:error] [pid 55559:tid 55632] [client 49.51.233.46:51180] [client 49.51.233.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agJYJNj0hVMLJAOI_fxMQQAAAQ0"]
[Tue May 12 08:48:24.280868 2026] [:error] [pid 42143:tid 42165] [client 49.51.38.193:57012] [client 49.51.38.193] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agJ42ES2WmK92iCO2L12tAAAAVI"]
[Tue May 12 09:25:30.049346 2026] [:error] [pid 39958:tid 40034] [client 222.252.29.134:16322] [client 222.252.29.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 222.252.29.134, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agKBiuVI9FVDxXB2XxhCbAAAAI8"]
[Tue May 12 09:25:40.188966 2026] [:error] [pid 42143:tid 42158] [client 222.252.29.134:16240] [client 222.252.29.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 222.252.29.134, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agKBlES2WmK92iCO2L2AZAAAAUs"]
[Tue May 12 09:25:50.411942 2026] [:error] [pid 42143:tid 42151] [client 222.252.29.134:20629] [client 222.252.29.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 222.252.29.134, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agKBnkS2WmK92iCO2L2AdwAAAUQ"]
[Tue May 12 09:26:00.585033 2026] [:error] [pid 39958:tid 40040] [client 222.252.29.134:13900] [client 222.252.29.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 222.252.29.134, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agKBqOVI9FVDxXB2XxhCcwAAAJU"]
[Tue May 12 09:26:10.764698 2026] [:error] [pid 55559:tid 55618] [client 222.252.29.134:7318] [client 222.252.29.134] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 222.252.29.134, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agKBstj0hVMLJAOI_fxwCgAAAQE"]
[Tue May 12 10:14:23.826436 2026] [:error] [pid 40061:tid 40069] [client 192.144.148.122:50826] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agKM_7ycIKt8hxHMBYuuUwAAAMY"]
[Tue May 12 11:53:53.617159 2026] [autoindex:error] [pid 39957:tid 40000] [client 70.153.136.253:60651] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue May 12 11:54:55.427954 2026] [:error] [pid 39957:tid 40004] [client 104.168.115.241:57152] [client 104.168.115.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "agKkj-AfHHyq0DBh5BIsggAAAEw"]
[Tue May 12 11:54:55.427954 2026] [:error] [pid 39958:tid 40025] [client 104.168.115.241:57170] [client 104.168.115.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/HEAD"] [unique_id "agKkj-VI9FVDxXB2XxhSjgAAAIY"]
[Tue May 12 12:23:38.873636 2026] [:error] [pid 39956:tid 39982] [client 43.133.41.88:40938] [client 43.133.41.88] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agKrSo2K3wZDsNji3MzoCAAAABE"]
[Tue May 12 13:34:00.013835 2026] [:error] [pid 39956:tid 39986] [client 43.162.123.246:50250] [client 43.162.123.246] ModSecurity: Access denied with code 403 (phase 3). Match of "validateByteRange 0-31" against "ARGS:_wpnonce" required. [file "/usr/local/apache/modsecurity-cwaf/rules/30_Apps_OtherApps.conf"] [line "6640"] [id "243420"] [rev "4"] [msg "COMODO WAF: Information disclosure vulnerability in Eclipse Jetty before 9.2.9.v20150224 (CVE-2015-2080)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "expressinteriors.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "agK7xo2K3wZDsNji3Mzv3AAAABU"]
[Tue May 12 13:34:00.013939 2026] [proxy_fcgi:error] [pid 39956:tid 39986] (20014)Internal error (specific information not available): [client 43.162.123.246:50250] AH01075: Error dispatching request to : (passing brigade to output filters)
[Tue May 12 14:04:23.946610 2026] [:error] [pid 39958:tid 40028] [client 43.135.130.202:52304] [client 43.135.130.202] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agLC5-VI9FVDxXB2XxhhOAAAAIk"]
[Tue May 12 16:19:02.466271 2026] [:error] [pid 21242:tid 21266] [client 49.51.50.147:38546] [client 49.51.50.147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agLidszeh8JWZob6PnK-GAAAAZQ"]
[Tue May 12 20:08:39.606521 2026] [:error] [pid 21242:tid 21253] [client 43.131.36.84:58374] [client 43.131.36.84] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agMYR8zeh8JWZob6PnL6ygAAAYc"]
[Tue May 12 21:02:40.956636 2026] [:error] [pid 21242:tid 21263] [client 50.7.230.4:41422] [client 50.7.230.4] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.expressinteriors.com|F|2"] [data "TX:0=text/csv"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agMk8Mzeh8JWZob6PnIKlwAAAZE"]
[Tue May 12 21:25:18.580038 2026] [:error] [pid 21242:tid 21264] [client 195.154.184.61:42640] [client 195.154.184.61] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agMqPszeh8JWZob6PnISKQAAAZI"]
[Tue May 12 21:47:38.258844 2026] [:error] [pid 55559:tid 55641] [client 43.157.168.43:51400] [client 43.157.168.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agMvetj0hVMLJAOI_fy_rQAAARQ"]
[Tue May 12 22:54:41.578929 2026] [:error] [pid 42143:tid 42171] [client 146.56.197.150:45536] [client 146.56.197.150] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agM_MUS2WmK92iCO2L05RwAAAVg"]
[Tue May 12 23:13:58.570898 2026] [:error] [pid 39958:tid 40021] [client 186.224.251.195:20926] [client 186.224.251.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.224.251.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agNDtuVI9FVDxXB2XxiM1AAAAII"]
[Tue May 12 23:14:35.827267 2026] [:error] [pid 21242:tid 21270] [client 186.224.251.195:19199] [client 186.224.251.195] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agND28zeh8JWZob6PnIpSQAAAZg"]
[Tue May 12 23:15:05.869105 2026] [:error] [pid 39957:tid 40007] [client 186.224.251.195:20911] [client 186.224.251.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.224.251.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agND-eAfHHyq0DBh5BKYfQAAAE8"]
[Tue May 12 23:15:31.289443 2026] [:error] [pid 55559:tid 55637] [client 186.224.251.195:20932] [client 186.224.251.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.224.251.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agNEE9j0hVMLJAOI_fzHBgAAARE"]
[Tue May 12 23:16:00.591957 2026] [:error] [pid 39957:tid 40014] [client 186.224.251.195:19829] [client 186.224.251.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.224.251.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agNEMOAfHHyq0DBh5BKYvwAAAFY"]
[Tue May 12 23:16:25.859187 2026] [:error] [pid 40061:tid 40084] [client 186.224.251.195:19304] [client 186.224.251.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 186.224.251.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agNESbycIKt8hxHMBYsSwgAAANU"]
[Wed May 13 01:27:34.827666 2026] [:error] [pid 55559:tid 55640] [client 43.159.132.207:46676] [client 43.159.132.207] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agNjBtj0hVMLJAOI_fzR1AAAARM"]
[Wed May 13 01:36:15.505627 2026] [autoindex:error] [pid 39957:tid 40005] [client 141.98.11.120:51787] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Wed May 13 04:09:50.603148 2026] [:error] [pid 23887:tid 23919] [client 43.155.129.131:42440] [client 43.155.129.131] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agOJDtSKmvZJZkXBFDDUuwAAANg"]
[Wed May 13 04:13:26.184782 2026] [:error] [pid 23887:tid 23918] [client 178.156.155.70:49734] [client 178.156.155.70] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agOJ5tSKmvZJZkXBFDDVwgAAANc"]
[Wed May 13 04:13:30.162441 2026] [:error] [pid 23887:tid 23919] [client 51.38.81.255:54024] [client 51.38.81.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.38.81.255, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agOJ6tSKmvZJZkXBFDDV4gAAANg"]
[Wed May 13 04:13:36.677173 2026] [:error] [pid 23787:tid 23848] [client 51.91.98.45:49618] [client 51.91.98.45] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agOJ8B1cs5wE7VT6wiqISgAAAIA"]
[Wed May 13 04:13:47.306375 2026] [:error] [pid 23787:tid 23854] [client 138.201.125.140:60692] [client 138.201.125.140] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agOJ-x1cs5wE7VT6wiqIWwAAAIY"]
[Wed May 13 04:13:58.733043 2026] [:error] [pid 23780:tid 23811] [client 51.91.98.45:46394] [client 51.91.98.45] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agOKBnXgOibPjrXgeTAzKwAAABE"]
[Wed May 13 04:14:05.811746 2026] [:error] [pid 23787:tid 23863] [client 162.241.73.198:21486] [client 162.241.73.198] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agOKDR1cs5wE7VT6wiqIawAAAI8"]
[Wed May 13 05:42:42.513674 2026] [:error] [pid 3259:tid 3281] [client 118.107.44.120:7737] [client 118.107.44.120] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "agOe0uWJB4YwcPVLeAp36QAAARQ"]
[Wed May 13 05:43:51.915466 2026] [:error] [pid 3259:tid 3276] [client 118.107.44.120:12491] [client 118.107.44.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.107.44.120, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agOfF-WJB4YwcPVLeAp4gQAAAQ8"], referer: https://www.bing.com/search?q=wp+admin+login%!(EXTRA string=wp+admin+login)
[Wed May 13 05:43:52.648138 2026] [:error] [pid 3259:tid 3266] [client 118.107.44.120:12491] [client 118.107.44.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.107.44.120, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agOfGOWJB4YwcPVLeAp4ggAAAQU"], referer: https://www.linkedin.com/
[Wed May 13 05:43:52.681622 2026] [:error] [pid 3259:tid 3266] [client 118.107.44.120:12491] [client 118.107.44.120] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 10 at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/29_Apps_Drupal.conf"] [line "1211"] [id "231011"] [rev "3"] [msg "COMODO WAF: Brute-Force Amplification in Drupal 6.x before 6.38 and 7.x before 7.43 (CVE-2016-3163)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Drupal"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agOfGOWJB4YwcPVLeAp4ggAAAQU"], referer: https://www.linkedin.com/
[Wed May 13 05:43:53.816754 2026] [:error] [pid 3259:tid 3269] [client 118.107.44.120:12491] [client 118.107.44.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.107.44.120, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agOfGeWJB4YwcPVLeAp4hAAAAQg"], referer: https://www.google.com/search?q=wp+security&oq=wp+security
[Wed May 13 05:43:53.854598 2026] [:error] [pid 3259:tid 3269] [client 118.107.44.120:12491] [client 118.107.44.120] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 10 at XML. [file "/usr/local/apache/modsecurity-cwaf/rules/29_Apps_Drupal.conf"] [line "1211"] [id "231011"] [rev "3"] [msg "COMODO WAF: Brute-Force Amplification in Drupal 6.x before 6.38 and 7.x before 7.43 (CVE-2016-3163)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Drupal"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agOfGeWJB4YwcPVLeAp4hAAAAQg"], referer: https://www.google.com/search?q=wp+security&oq=wp+security
[Wed May 13 06:11:26.222547 2026] [:error] [pid 23780:tid 23808] [client 160.176.195.235:58279] [client 160.176.195.235] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php"] [unique_id "agOljnXgOibPjrXgeTBAFAAAAA4"], referer: https://www.google.com/
[Wed May 13 06:11:28.622617 2026] [:error] [pid 23780:tid 23814] [client 160.176.195.235:59159] [client 160.176.195.235] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php."] [unique_id "agOlkHXgOibPjrXgeTBAGAAAABQ"], referer: https://www.google.com/search?q=
[Wed May 13 06:11:29.786570 2026] [:error] [pid 23787:tid 23869] [client 160.176.195.235:59782] [client 160.176.195.235] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php/"] [unique_id "agOlkR1cs5wE7VT6wiqdDgAAAJU"], referer: https://www.bing.com/
[Wed May 13 06:11:33.428710 2026] [:error] [pid 23782:tid 23831] [client 160.176.195.235:60466] [client 160.176.195.235] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php%00"] [unique_id "agOllSBrKFYHXUGnR-p07AAAAEo"], referer: https://www.google.com/
[Wed May 13 06:11:34.613878 2026] [:error] [pid 23782:tid 23829] [client 160.176.195.235:61027] [client 160.176.195.235] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php%20"] [unique_id "agOlliBrKFYHXUGnR-p07QAAAEg"], referer: https://www.google.com/search?q=
[Wed May 13 06:11:35.744336 2026] [:error] [pid 23782:tid 23838] [client 160.176.195.235:61356] [client 160.176.195.235] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/wp-config.php%20"] [unique_id "agOllyBrKFYHXUGnR-p07gAAAFE"], referer: https://www.google.com/
[Wed May 13 06:53:27.608138 2026] [:error] [pid 3259:tid 3264] [client 216.81.248.129:50374] [client 216.81.248.129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "agOvZ-WJB4YwcPVLeAqORAAAAQM"]
[Wed May 13 08:14:27.552907 2026] [:error] [pid 23887:tid 23912] [client 129.226.151.24:33004] [client 129.226.151.24] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agPCY9SKmvZJZkXBFDASzAAAANE"]
[Wed May 13 08:31:21.883831 2026] [ssl:error] [pid 23780:tid 23796] [client 35.87.186.24:34074] AH02032: Hostname cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup
[Wed May 13 08:42:21.658925 2026] [ssl:error] [pid 23887:tid 23907] [client 44.248.154.18:37472] AH02032: Hostname www.cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup
[Wed May 13 10:08:12.034718 2026] [:error] [pid 23887:tid 23901] [client 43.128.73.132:57906] [client 43.128.73.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agPdDNSKmvZJZkXBFDA6TAAAAMY"]
[Wed May 13 11:09:23.682648 2026] [:error] [pid 23780:tid 23801] [client 43.138.68.113:38296] [client 43.138.68.113] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agPrY3XgOibPjrXgeTBhvwAAAAc"]
[Wed May 13 11:16:48.979351 2026] [:error] [pid 23887:tid 23903] [client 163.227.92.57:41196] [client 163.227.92.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 163.227.92.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agPtINSKmvZJZkXBFDBT4wAAAMg"]
[Wed May 13 11:16:50.138219 2026] [:error] [pid 23887:tid 23910] [client 163.227.92.57:41196] [client 163.227.92.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 163.227.92.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agPtItSKmvZJZkXBFDBT5gAAAM8"], referer: https://expressinteriors.com/wp-login.php
[Wed May 13 11:27:37.087478 2026] [:error] [pid 23782:tid 23829] [client 138.197.139.3:43842] [client 138.197.139.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.197.139.3, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agPvqSBrKFYHXUGnR-qmbAAAAEg"]
[Wed May 13 11:27:39.157023 2026] [:error] [pid 23782:tid 23845] [client 138.197.139.3:43842] [client 138.197.139.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.197.139.3, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agPvqyBrKFYHXUGnR-qmbgAAAFg"], referer: https://expressinteriors.com/wp-login.php
[Wed May 13 11:46:04.557898 2026] [:error] [pid 3259:tid 3271] [client 138.197.139.3:57200] [client 138.197.139.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.197.139.3, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agPz_OWJB4YwcPVLeArV3AAAAQo"]
[Wed May 13 11:46:06.892971 2026] [:error] [pid 3259:tid 3263] [client 138.197.139.3:57200] [client 138.197.139.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.197.139.3, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agPz_uWJB4YwcPVLeArV3gAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Wed May 13 11:55:42.386955 2026] [:error] [pid 23787:tid 23854] [client 143.244.182.226:46064] [client 143.244.182.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.244.182.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agP2Ph1cs5wE7VT6wire7gAAAIY"]
[Wed May 13 11:55:43.288200 2026] [:error] [pid 23787:tid 23871] [client 143.244.182.226:46064] [client 143.244.182.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.244.182.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agP2Px1cs5wE7VT6wire8gAAAJc"], referer: https://expressinteriors.com/wp-login.php
[Wed May 13 11:58:03.020879 2026] [:error] [pid 23887:tid 23905] [client 209.74.88.30:45228] [client 209.74.88.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.74.88.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agP2y9SKmvZJZkXBFDBnsgAAAMo"]
[Wed May 13 11:58:05.181484 2026] [:error] [pid 23887:tid 23909] [client 209.74.88.30:45228] [client 209.74.88.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.74.88.30, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agP2zdSKmvZJZkXBFDBnswAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Wed May 13 12:22:03.489069 2026] [:error] [pid 27332:tid 27353] [client 43.156.71.177:42714] [client 43.156.71.177] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agP8a46Y5F_V9bmyC4Z1-gAAAVM"]
[Wed May 13 12:36:57.244613 2026] [:error] [pid 3259:tid 3263] [client 209.182.233.132:44468] [client 209.182.233.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.182.233.132, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agP_6eWJB4YwcPVLeArw6QAAAQI"]
[Wed May 13 12:36:58.542441 2026] [:error] [pid 3259:tid 3274] [client 209.182.233.132:44468] [client 209.182.233.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.182.233.132, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agP_6uWJB4YwcPVLeArw6gAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Wed May 13 13:10:17.268276 2026] [:error] [pid 23782:tid 23829] [client 47.242.236.143:58294] [client 47.242.236.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.242.236.143, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agQHuSBrKFYHXUGnR-q6wQAAAEg"]
[Wed May 13 13:10:18.512631 2026] [:error] [pid 23782:tid 23821] [client 47.242.236.143:58294] [client 47.242.236.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.242.236.143, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agQHuiBrKFYHXUGnR-q6wgAAAEA"], referer: https://expressinteriors.com/wp-login.php
[Wed May 13 13:36:20.251950 2026] [:error] [pid 27332:tid 27351] [client 176.9.144.171:41392] [client 176.9.144.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.9.144.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agQN1I6Y5F_V9bmyC4aPlwAAAVE"]
[Wed May 13 13:36:22.666373 2026] [:error] [pid 27332:tid 27351] [client 176.9.144.171:41392] [client 176.9.144.171] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 176.9.144.171, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agQN1o6Y5F_V9bmyC4aPnQAAAVE"], referer: https://expressinteriors.com/wp-login.php
[Wed May 13 14:08:10.177586 2026] [:error] [pid 23787:tid 23854] [client 43.159.136.201:37510] [client 43.159.136.201] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agQVSh1cs5wE7VT6wir5RAAAAIY"]
[Wed May 13 14:43:34.145591 2026] [:error] [pid 3259:tid 3269] [client 124.41.228.116:51688] [client 124.41.228.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.41.228.116, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agQdluWJB4YwcPVLeAoPwAAAAQg"]
[Wed May 13 14:43:44.425249 2026] [:error] [pid 27332:tid 27347] [client 124.41.228.116:51985] [client 124.41.228.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.41.228.116, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agQdoI6Y5F_V9bmyC4asOwAAAU0"]
[Wed May 13 14:43:54.940356 2026] [:error] [pid 23887:tid 23897] [client 124.41.228.116:52349] [client 124.41.228.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.41.228.116, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agQdqtSKmvZJZkXBFDCOvgAAAMI"]
[Wed May 13 14:44:05.358682 2026] [:error] [pid 27332:tid 27354] [client 124.41.228.116:52617] [client 124.41.228.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.41.228.116, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agQdtY6Y5F_V9bmyC4asVwAAAVQ"]
[Wed May 13 14:44:15.858783 2026] [:error] [pid 3259:tid 3268] [client 124.41.228.116:52891] [client 124.41.228.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.41.228.116, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agQdv-WJB4YwcPVLeAoP5wAAAQc"]
[Wed May 13 14:47:33.895624 2026] [:error] [pid 23887:tid 23900] [client 103.28.36.122:37782] [client 103.28.36.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agQehdSKmvZJZkXBFDCPiQAAAMU"]
[Wed May 13 14:47:34.920085 2026] [:error] [pid 23887:tid 23907] [client 103.28.36.122:37782] [client 103.28.36.122] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.28.36.122, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agQehtSKmvZJZkXBFDCPigAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Wed May 13 14:49:47.301373 2026] [:error] [pid 27332:tid 27337] [client 198.38.94.67:37976] [client 198.38.94.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.38.94.67, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agQfC46Y5F_V9bmyC4avWgAAAUM"]
[Wed May 13 14:49:48.244362 2026] [:error] [pid 27332:tid 27341] [client 198.38.94.67:37976] [client 198.38.94.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.38.94.67, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agQfDI6Y5F_V9bmyC4avXQAAAUc"], referer: https://expressinteriors.com/wp-login.php
[Wed May 13 15:56:43.892095 2026] [:error] [pid 27332:tid 27336] [client 50.6.231.19:36146] [client 50.6.231.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.231.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agQuu46Y5F_V9bmyC4bIigAAAUI"]
[Wed May 13 15:56:49.468327 2026] [:error] [pid 27332:tid 27348] [client 50.6.231.19:36146] [client 50.6.231.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 50.6.231.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agQuwY6Y5F_V9bmyC4bIngAAAU4"], referer: https://expressinteriors.com/wp-login.php
[Wed May 13 16:31:43.692683 2026] [:error] [pid 23787:tid 23849] [client 49.51.72.76:58982] [client 49.51.72.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agQ27x1cs5wE7VT6wioYqgAAAIE"]
[Wed May 13 16:49:46.492321 2026] [:error] [pid 45289:tid 45304] [client 162.241.73.198:41293] [client 162.241.73.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.73.198, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agQ7KoOEpVhwFIe0NzgJPAAAAYs"]
[Wed May 13 16:49:47.783029 2026] [:error] [pid 45289:tid 45315] [client 162.241.73.198:41293] [client 162.241.73.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.241.73.198, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agQ7K4OEpVhwFIe0NzgJQAAAAZY"], referer: https://expressinteriors.com/wp-login.php
[Wed May 13 18:10:24.504884 2026] [:error] [pid 23782:tid 23844] [client 13.234.111.98:51402] [client 13.234.111.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 13.234.111.98, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agROECBrKFYHXUGnR-rxegAAAFc"]
[Wed May 13 18:10:25.429092 2026] [:error] [pid 23782:tid 23831] [client 13.234.111.98:51402] [client 13.234.111.98] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 13.234.111.98, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agROESBrKFYHXUGnR-rxfAAAAEo"], referer: https://expressinteriors.com/wp-login.php
[Wed May 13 18:15:25.303118 2026] [:error] [pid 55745:tid 55780] [client 34.124.193.25:46778] [client 34.124.193.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.124.193.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agRPPQzqD9WDZdTELeIPRwAAAsU"]
[Wed May 13 18:15:26.177226 2026] [:error] [pid 55745:tid 55779] [client 34.124.193.25:46778] [client 34.124.193.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.124.193.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agRPPgzqD9WDZdTELeIPSAAAAsQ"], referer: https://expressinteriors.com/wp-login.php
[Wed May 13 18:16:23.316632 2026] [:error] [pid 45289:tid 45311] [client 38.154.97.94:49012] [client 38.154.97.94] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agRPd4OEpVhwFIe0NzgdZwAAAZI"]
[Wed May 13 18:16:23.316635 2026] [:error] [pid 45289:tid 45294] [client 38.154.97.94:51945] [client 38.154.97.94] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/robots.txt"] [unique_id "agRPd4OEpVhwFIe0NzgdZgAAAYE"]
[Wed May 13 18:16:23.318812 2026] [:error] [pid 23782:tid 23842] [client 38.154.97.94:48443] [client 38.154.97.94] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/sitemap.xml"] [unique_id "agRPdyBrKFYHXUGnR-rzIgAAAFU"]
[Wed May 13 18:16:24.659775 2026] [:error] [pid 45289:tid 45301] [client 38.154.97.94:50467] [client 38.154.97.94] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/sitemap.xml"] [unique_id "agRPeIOEpVhwFIe0NzgdagAAAYg"]
[Wed May 13 18:16:24.659985 2026] [:error] [pid 23782:tid 23834] [client 38.154.97.94:45847] [client 38.154.97.94] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/robots.txt"] [unique_id "agRPeCBrKFYHXUGnR-rzJQAAAE0"]
[Wed May 13 19:31:16.487839 2026] [:error] [pid 45289:tid 45312] [client 151.62.8.119:55534] [client 151.62.8.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 151.62.8.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agRhBIOEpVhwFIe0NzgqsgAAAZM"]
[Wed May 13 19:31:18.189170 2026] [:error] [pid 55644:tid 55658] [client 151.62.8.119:55565] [client 151.62.8.119] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agRhBiL_V0N1iPYYj0-sBwAAAcw"]
[Wed May 13 19:31:20.626101 2026] [:error] [pid 55644:tid 55660] [client 151.62.8.119:55565] [client 151.62.8.119] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agRhCCL_V0N1iPYYj0-sCgAAAc4"]
[Wed May 13 20:02:27.227063 2026] [:error] [pid 27332:tid 27353] [client 182.64.108.33:61389] [client 182.64.108.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.64.108.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agRoU46Y5F_V9bmyC4bsxAAAAVM"]
[Wed May 13 20:04:07.077159 2026] [:error] [pid 55679:tid 55693] [client 182.64.108.33:55475] [client 182.64.108.33] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agRot6vvigowSOGkp44cHQAAAgw"]
[Wed May 13 20:04:46.802725 2026] [:error] [pid 23782:tid 23836] [client 182.64.108.33:54273] [client 182.64.108.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.64.108.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agRo3iBrKFYHXUGnR-oJQgAAAE8"]
[Wed May 13 20:05:24.856272 2026] [:error] [pid 55745:tid 55779] [client 182.64.108.33:55139] [client 182.64.108.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.64.108.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agRpBAzqD9WDZdTELeIZRwAAAsQ"]
[Wed May 13 20:05:56.774423 2026] [:error] [pid 23782:tid 23828] [client 182.64.108.33:65076] [client 182.64.108.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.64.108.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agRpJCBrKFYHXUGnR-oJfgAAAEc"]
[Wed May 13 20:06:30.199968 2026] [:error] [pid 23782:tid 23834] [client 182.64.108.33:55091] [client 182.64.108.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.64.108.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agRpRiBrKFYHXUGnR-oJ8AAAAE0"]
[Wed May 13 20:28:34.196918 2026] [:error] [pid 55744:tid 55764] [client 190.92.174.86:56626] [client 190.92.174.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.92.174.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agRucgwbbCCudzl3BmmsgQAAApA"]
[Wed May 13 20:28:35.547544 2026] [:error] [pid 55744:tid 55767] [client 190.92.174.86:56626] [client 190.92.174.86] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.92.174.86, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agRucwwbbCCudzl3BmmsgwAAApM"], referer: https://expressinteriors.com/wp-login.php
[Wed May 13 20:33:19.255147 2026] [:error] [pid 23782:tid 23837] [client 20.118.20.77:15971] [client 20.118.20.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.118.20.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agRvjyBrKFYHXUGnR-oSCAAAAFA"]
[Wed May 13 20:33:20.153759 2026] [:error] [pid 23782:tid 23824] [client 20.118.20.77:15971] [client 20.118.20.77] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.118.20.77, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agRvkCBrKFYHXUGnR-oSCQAAAEM"], referer: https://expressinteriors.com/wp-login.php
[Wed May 13 21:56:04.034362 2026] [:error] [pid 12426:tid 12436] [client 101.33.81.73:44496] [client 101.33.81.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agSC9LPw24RslX3LIcYtDgAAAMg"]
[Wed May 13 22:12:28.969691 2026] [:error] [pid 12340:tid 12420] [client 51.38.81.255:49818] [client 51.38.81.255] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.38.81.255, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agSGzMrxSPfvmN7BQjJ3qQAAAJg"]
[Wed May 13 22:12:32.145356 2026] [:error] [pid 12340:tid 12409] [client 51.38.81.255:49818] [client 51.38.81.255] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.38.81.255, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agSG0MrxSPfvmN7BQjJ3qwAAAI0"], referer: https://expressinteriors.com/wp-login.php
[Wed May 13 22:17:16.438358 2026] [:error] [pid 12340:tid 12399] [client 51.210.146.129:49792] [client 51.210.146.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.210.146.129, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agSH7MrxSPfvmN7BQjJ4gwAAAIM"]
[Wed May 13 22:17:17.275758 2026] [:error] [pid 12340:tid 12420] [client 51.210.146.129:49792] [client 51.210.146.129] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.210.146.129, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agSH7crxSPfvmN7BQjJ4hQAAAJg"], referer: https://expressinteriors.com/wp-login.php
[Wed May 13 22:41:12.272767 2026] [:error] [pid 12426:tid 12429] [client 173.212.252.15:58870] [client 173.212.252.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.212.252.15, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agSNiLPw24RslX3LIcY_UgAAAME"]
[Wed May 13 22:41:13.187551 2026] [:error] [pid 12426:tid 12432] [client 173.212.252.15:58870] [client 173.212.252.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.212.252.15, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agSNibPw24RslX3LIcY_WAAAAMQ"], referer: https://expressinteriors.com/wp-login.php
[Wed May 13 23:13:15.492845 2026] [:error] [pid 12340:tid 12411] [client 171.111.192.222:41238] [client 171.111.192.222] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "agSVC8rxSPfvmN7BQjKGagAAAI8"]
[Wed May 13 23:34:28.779190 2026] [:error] [pid 12426:tid 12431] [client 51.79.254.190:52434] [client 51.79.254.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.79.254.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agSaBLPw24RslX3LIcZOfAAAAMM"]
[Wed May 13 23:34:29.598000 2026] [:error] [pid 12426:tid 12440] [client 51.79.254.190:52434] [client 51.79.254.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.79.254.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agSaBbPw24RslX3LIcZOfwAAAMw"], referer: https://expressinteriors.com/wp-login.php
[Wed May 13 23:39:39.372310 2026] [:error] [pid 12426:tid 12443] [client 40.85.229.173:49126] [client 40.85.229.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "agSbO7Pw24RslX3LIcZPyQAAAM8"]
[Wed May 13 23:39:40.212106 2026] [:error] [pid 12340:tid 12403] [client 40.85.229.173:48048] [client 40.85.229.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "agSbPMrxSPfvmN7BQjKLEAAAAIc"]
[Wed May 13 23:39:41.077766 2026] [:error] [pid 12338:tid 12377] [client 40.85.229.173:33685] [client 40.85.229.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "agSbPcUJ87l42ffPr4wdTwAAAEg"]
[Wed May 13 23:39:41.919027 2026] [:error] [pid 12426:tid 12441] [client 40.85.229.173:48028] [client 40.85.229.173] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "agSbPbPw24RslX3LIcZPzAAAAM0"]
[Wed May 13 23:42:24.463568 2026] [:error] [pid 12426:tid 12452] [client 128.201.75.101:51080] [client 128.201.75.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 128.201.75.101, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agSb4LPw24RslX3LIcZQcwAAANg"]
[Wed May 13 23:42:25.630133 2026] [:error] [pid 12426:tid 12439] [client 128.201.75.101:51080] [client 128.201.75.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 128.201.75.101, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agSb4bPw24RslX3LIcZQdQAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Wed May 13 23:51:54.571959 2026] [:error] [pid 12337:tid 12344] [client 119.91.20.139:58994] [client 119.91.20.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agSeGg9W0E4_X4qzYUF0jQAAAAI"]
[Thu May 14 00:07:00.583607 2026] [:error] [pid 12338:tid 12371] [client 43.165.67.31:46374] [client 43.165.67.31] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agShpMUJ87l42ffPr4whIwAAAEI"]
[Thu May 14 00:42:59.902414 2026] [:error] [pid 17873:tid 17884] [client 34.10.248.209:59717] [client 34.10.248.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.10.248.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agSqE_EqBQQrkyEyu_odfQAAAQk"]
[Thu May 14 00:43:02.077972 2026] [:error] [pid 17873:tid 17888] [client 34.10.248.209:59717] [client 34.10.248.209] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "agSqFvEqBQQrkyEyu_odggAAAQ0"]
[Thu May 14 00:43:02.312322 2026] [:error] [pid 17873:tid 17890] [client 34.10.248.209:59717] [client 34.10.248.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.10.248.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agSqFvEqBQQrkyEyu_odgwAAAQ8"]
[Thu May 14 00:43:03.730770 2026] [:error] [pid 17873:tid 17889] [client 34.10.248.209:62393] [client 34.10.248.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.10.248.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agSqF_EqBQQrkyEyu_odhwAAAQ4"]
[Thu May 14 00:43:05.175222 2026] [:error] [pid 12340:tid 12401] [client 34.10.248.209:49690] [client 34.10.248.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.10.248.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agSqGcrxSPfvmN7BQjKeBwAAAIU"]
[Thu May 14 00:43:06.548454 2026] [:error] [pid 12337:tid 12343] [client 34.10.248.209:53009] [client 34.10.248.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.10.248.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agSqGg9W0E4_X4qzYUF6ZAAAAAE"]
[Thu May 14 00:43:07.894473 2026] [:error] [pid 12337:tid 12349] [client 34.10.248.209:62983] [client 34.10.248.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.10.248.209, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agSqGw9W0E4_X4qzYUF6ZQAAAAc"]
[Thu May 14 00:43:07.894681 2026] [:error] [pid 12337:tid 12349] [client 34.10.248.209:62983] [client 34.10.248.209] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.10.248.209, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agSqGw9W0E4_X4qzYUF6ZQAAAAc"]
[Thu May 14 00:45:48.400597 2026] [:error] [pid 12426:tid 12442] [client 136.113.147.3:58384] [client 136.113.147.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.113.147.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agSqvLPw24RslX3LIcZbZwAAAM4"]
[Thu May 14 00:45:50.565589 2026] [:error] [pid 12426:tid 12438] [client 136.113.147.3:58384] [client 136.113.147.3] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "agSqvrPw24RslX3LIcZbagAAAMo"]
[Thu May 14 00:45:50.760360 2026] [:error] [pid 12426:tid 12443] [client 136.113.147.3:58384] [client 136.113.147.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.113.147.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agSqvrPw24RslX3LIcZbawAAAM8"]
[Thu May 14 00:45:52.124927 2026] [:error] [pid 12338:tid 12370] [client 136.113.147.3:53127] [client 136.113.147.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.113.147.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agSqwMUJ87l42ffPr4wl7gAAAEE"]
[Thu May 14 00:45:53.743874 2026] [:error] [pid 12338:tid 12378] [client 136.113.147.3:55500] [client 136.113.147.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.113.147.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agSqwcUJ87l42ffPr4wl8gAAAEk"]
[Thu May 14 00:45:55.154135 2026] [:error] [pid 17873:tid 17886] [client 136.113.147.3:54806] [client 136.113.147.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.113.147.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agSqw_EqBQQrkyEyu_oeRwAAAQs"]
[Thu May 14 00:45:56.631420 2026] [:error] [pid 12426:tid 12435] [client 136.113.147.3:64918] [client 136.113.147.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.113.147.3, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agSqxLPw24RslX3LIcZbcAAAAMc"]
[Thu May 14 00:45:56.631604 2026] [:error] [pid 12426:tid 12435] [client 136.113.147.3:64918] [client 136.113.147.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 136.113.147.3, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agSqxLPw24RslX3LIcZbcAAAAMc"]
[Thu May 14 00:51:12.084009 2026] [:error] [pid 17873:tid 17877] [client 82.223.121.85:52976] [client 82.223.121.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.121.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agSsAPEqBQQrkyEyu_ofEAAAAQI"]
[Thu May 14 00:51:13.287081 2026] [:error] [pid 17873:tid 17886] [client 82.223.121.85:52976] [client 82.223.121.85] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 82.223.121.85, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agSsAfEqBQQrkyEyu_ofEgAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Thu May 14 01:35:20.120464 2026] [:error] [pid 12340:tid 12412] [client 194.146.44.20:36750] [client 194.146.44.20] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "agS2WMrxSPfvmN7BQjK0dgAAAJA"]
[Thu May 14 01:58:20.198700 2026] [:error] [pid 17873:tid 17882] [client 119.28.122.202:34738] [client 119.28.122.202] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agS7vPEqBQQrkyEyu_oxQgAAAQc"]
[Thu May 14 03:27:08.747096 2026] [:error] [pid 12340:tid 12416] [client 15.207.212.133:52068] [client 15.207.212.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.207.212.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agTQjMrxSPfvmN7BQjLddAAAAJQ"]
[Thu May 14 03:27:09.865114 2026] [:error] [pid 12340:tid 12418] [client 15.207.212.133:52068] [client 15.207.212.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.207.212.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agTQjcrxSPfvmN7BQjLdewAAAJY"], referer: https://expressinteriors.com/wp-login.php
[Thu May 14 03:37:40.717368 2026] [:error] [pid 8203:tid 8229] [client 15.235.193.207:53134] [client 15.235.193.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.235.193.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agTTBG3YM_UDNwFJPi71TQAAANg"]
[Thu May 14 03:37:41.581715 2026] [:error] [pid 8203:tid 8216] [client 15.235.193.207:53134] [client 15.235.193.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.235.193.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agTTBW3YM_UDNwFJPi71TwAAAMs"], referer: https://expressinteriors.com/wp-login.php
[Thu May 14 03:42:53.562030 2026] [:error] [pid 45757:tid 45815] [client 34.124.193.25:49274] [client 34.124.193.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.124.193.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agTUPTSs3G9sxsocFH-J6AAAAIA"]
[Thu May 14 03:42:54.823098 2026] [:error] [pid 45757:tid 45819] [client 34.124.193.25:49274] [client 34.124.193.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.124.193.25, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agTUPjSs3G9sxsocFH-J6QAAAIQ"], referer: https://expressinteriors.com/wp-login.php
[Thu May 14 04:03:42.643706 2026] [:error] [pid 11690:tid 11709] [client 15.207.212.133:46376] [client 15.207.212.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.207.212.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agTZHinxWuLN8Hptw8lJLwAAAMo"]
[Thu May 14 04:03:43.813033 2026] [:error] [pid 11690:tid 11713] [client 15.207.212.133:46376] [client 15.207.212.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 15.207.212.133, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agTZHynxWuLN8Hptw8lJMgAAAM4"], referer: https://expressinteriors.com/wp-login.php
[Thu May 14 04:13:26.758382 2026] [:error] [pid 11588:tid 11672] [client 158.220.82.191:34160] [client 158.220.82.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 158.220.82.191, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agTbZtUr21rOixkeGKbuWAAAAJQ"]
[Thu May 14 04:13:27.659341 2026] [:error] [pid 11588:tid 11656] [client 158.220.82.191:34160] [client 158.220.82.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 158.220.82.191, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agTbZ9Ur21rOixkeGKbuWQAAAIQ"], referer: https://expressinteriors.com/wp-login.php
[Thu May 14 05:00:34.825941 2026] [:error] [pid 63033:tid 63043] [client 43.153.54.138:33240] [client 43.153.54.138] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agTmclMY49UWn5BpqVY4_AAAAQg"]
[Thu May 14 05:03:21.810607 2026] [:error] [pid 63033:tid 63035] [client 173.236.211.239:44314] [client 173.236.211.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.211.239, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agTnGVMY49UWn5BpqVY6DAAAAQA"]
[Thu May 14 05:03:22.999970 2026] [:error] [pid 63033:tid 63052] [client 173.236.211.239:44314] [client 173.236.211.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.211.239, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agTnGlMY49UWn5BpqVY6DwAAARE"], referer: https://expressinteriors.com/wp-login.php
[Thu May 14 05:15:28.947429 2026] [:error] [pid 11690:tid 11701] [client 2.56.29.220:46670] [client 2.56.29.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.56.29.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agTp8CnxWuLN8Hptw8ll8wAAAMI"]
[Thu May 14 05:15:29.838647 2026] [:error] [pid 11690:tid 11715] [client 2.56.29.220:46670] [client 2.56.29.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.56.29.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agTp8SnxWuLN8Hptw8ll-gAAANA"], referer: https://expressinteriors.com/wp-login.php
[Thu May 14 05:51:09.483188 2026] [:error] [pid 11588:tid 11671] [client 152.32.209.93:48106] [client 152.32.209.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.32.209.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agTyTdUr21rOixkeGKYHeQAAAJM"]
[Thu May 14 05:51:10.885706 2026] [:error] [pid 11588:tid 11662] [client 152.32.209.93:48106] [client 152.32.209.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 152.32.209.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agTyTtUr21rOixkeGKYHewAAAIo"], referer: https://expressinteriors.com/wp-login.php
[Thu May 14 08:00:53.310311 2026] [:error] [pid 11690:tid 11702] [client 190.92.158.246:49644] [client 190.92.158.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.92.158.246, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agUQtSnxWuLN8Hptw8mVmQAAAMM"]
[Thu May 14 08:00:54.715730 2026] [:error] [pid 11690:tid 11709] [client 190.92.158.246:49644] [client 190.92.158.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 190.92.158.246, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agUQtinxWuLN8Hptw8mVqwAAAMo"], referer: https://expressinteriors.com/wp-login.php
[Thu May 14 09:13:13.872892 2026] [:error] [pid 11690:tid 11717] [client 43.135.144.81:51330] [client 43.135.144.81] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agUhqSnxWuLN8Hptw8mwowAAANI"]
[Thu May 14 12:56:38.314308 2026] [:error] [pid 47721:tid 47729] [client 124.156.157.91:57596] [client 124.156.157.91] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agVWBnEmh7_G0hfOa6uMpQAAAYY"]
[Thu May 14 13:15:53.654126 2026] [:error] [pid 47673:tid 47694] [client 159.89.192.15:37750] [client 159.89.192.15] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "agVaifCGe4cIn3sh5k30mwAAAVM"]
[Thu May 14 13:32:34.139460 2026] [:error] [pid 11581:tid 11604] [client 2.38.194.177:54422] [client 2.38.194.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.38.194.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agVecv0vF48FbzpvQMWz0QAAAAc"]
[Thu May 14 13:32:35.508574 2026] [:error] [pid 11581:tid 11608] [client 2.38.194.177:54422] [client 2.38.194.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.38.194.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agVec_0vF48FbzpvQMWz0wAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Thu May 14 13:50:05.896349 2026] [:error] [pid 63033:tid 63035] [client 66.116.235.214:60860] [client 66.116.235.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.116.235.214, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agVijVMY49UWn5BpqVbELgAAAQA"]
[Thu May 14 13:50:07.426675 2026] [:error] [pid 63033:tid 63042] [client 66.116.235.214:60860] [client 66.116.235.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 66.116.235.214, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agVij1MY49UWn5BpqVbELwAAAQc"], referer: https://expressinteriors.com/wp-login.php
[Thu May 14 15:11:56.379230 2026] [:error] [pid 63033:tid 63042] [client 34.57.29.8:58247] [client 34.57.29.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.57.29.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agV1vFMY49UWn5BpqVbdLgAAAQc"]
[Thu May 14 15:11:58.552492 2026] [:error] [pid 63033:tid 63055] [client 34.57.29.8:58247] [client 34.57.29.8] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "agV1vlMY49UWn5BpqVbdMgAAARQ"]
[Thu May 14 15:11:58.772365 2026] [:error] [pid 63033:tid 63041] [client 34.57.29.8:58247] [client 34.57.29.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.57.29.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agV1vlMY49UWn5BpqVbdMwAAAQY"]
[Thu May 14 15:12:00.156749 2026] [:error] [pid 11581:tid 11607] [client 34.57.29.8:65030] [client 34.57.29.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.57.29.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agV1wP0vF48FbzpvQMXFdwAAAAo"]
[Thu May 14 15:12:01.479705 2026] [:error] [pid 63033:tid 63053] [client 34.57.29.8:58926] [client 34.57.29.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.57.29.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agV1wVMY49UWn5BpqVbdNAAAARI"]
[Thu May 14 15:12:02.800469 2026] [:error] [pid 11582:tid 11648] [client 34.57.29.8:56839] [client 34.57.29.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.57.29.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agV1wvuw2cmFDpGcKhAfRQAAAFc"]
[Thu May 14 15:12:04.195812 2026] [:error] [pid 63033:tid 63054] [client 34.57.29.8:60631] [client 34.57.29.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.57.29.8, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agV1xFMY49UWn5BpqVbdNQAAARM"]
[Thu May 14 15:12:04.195995 2026] [:error] [pid 63033:tid 63054] [client 34.57.29.8:60631] [client 34.57.29.8] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.57.29.8, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agV1xFMY49UWn5BpqVbdNQAAARM"]
[Thu May 14 18:20:06.481624 2026] [:error] [pid 11588:tid 11661] [client 43.159.63.116:39264] [client 43.159.63.116] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agWh1tUr21rOixkeGKaaaQAAAIk"]
[Thu May 14 18:33:44.263770 2026] [:error] [pid 11581:tid 11618] [client 2.58.56.137:57629] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "agWlCP0vF48FbzpvQMX6WQAAABU"]
[Thu May 14 18:33:44.267901 2026] [:error] [pid 11581:tid 11607] [client 2.58.56.137:55612] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "agWlCP0vF48FbzpvQMX6WgAAAAo"], referer: www.google.com
[Thu May 14 18:33:44.303440 2026] [:error] [pid 63033:tid 63041] [client 2.58.56.137:55617] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-plain.php"] [unique_id "agWlCFMY49UWn5BpqVbxjgAAAQY"], referer: www.google.com
[Thu May 14 18:33:44.304530 2026] [:error] [pid 11581:tid 11597] [client 2.58.56.137:55618] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "agWlCP0vF48FbzpvQMX6WwAAAAA"], referer: www.google.com
[Thu May 14 18:33:44.995551 2026] [:error] [pid 47673:tid 47681] [client 2.58.56.137:53845] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "agWlCPCGe4cIn3sh5k0fAAAAAUY"]
[Thu May 14 18:33:44.996033 2026] [:error] [pid 11581:tid 11602] [client 2.58.56.137:58999] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "agWlCP0vF48FbzpvQMX6YgAAAAU"], referer: www.google.com
[Thu May 14 18:33:44.998314 2026] [:error] [pid 11581:tid 11605] [client 2.58.56.137:52641] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "agWlCP0vF48FbzpvQMX6ZQAAAAg"], referer: www.google.com
[Thu May 14 18:33:45.000136 2026] [:error] [pid 11588:tid 11659] [client 2.58.56.137:59500] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-plain.php"] [unique_id "agWlCNUr21rOixkeGKacJwAAAIc"], referer: www.google.com
[Thu May 14 18:33:45.201670 2026] [:error] [pid 11581:tid 11613] [client 2.58.56.137:55606] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agWlCf0vF48FbzpvQMX6aAAAABA"]
[Thu May 14 18:33:45.643164 2026] [:error] [pid 11588:tid 11673] [client 2.58.56.137:50332] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "agWlCdUr21rOixkeGKacMgAAAJU"], referer: www.google.com
[Thu May 14 18:33:45.647156 2026] [:error] [pid 11588:tid 11663] [client 2.58.56.137:56990] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "agWlCdUr21rOixkeGKacMwAAAIs"]
[Thu May 14 18:33:45.651471 2026] [:error] [pid 11581:tid 11612] [client 2.58.56.137:64664] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "agWlCf0vF48FbzpvQMX6bQAAAA8"], referer: www.google.com
[Thu May 14 18:33:45.652293 2026] [:error] [pid 11581:tid 11598] [client 2.58.56.137:50933] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-plain.php"] [unique_id "agWlCf0vF48FbzpvQMX6bgAAAAE"], referer: www.google.com
[Thu May 14 18:33:46.002979 2026] [:error] [pid 11588:tid 11671] [client 2.58.56.137:63060] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agWlCtUr21rOixkeGKacPAAAAJM"]
[Thu May 14 18:33:46.412945 2026] [:error] [pid 11690:tid 11715] [client 2.58.56.137:63167] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "agWlCinxWuLN8Hptw8kkOwAAANA"]
[Thu May 14 18:33:46.418616 2026] [:error] [pid 11588:tid 11673] [client 2.58.56.137:60748] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "agWlCtUr21rOixkeGKacQwAAAJU"], referer: www.google.com
[Thu May 14 18:33:46.419134 2026] [:error] [pid 11588:tid 11663] [client 2.58.56.137:50410] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "agWlCtUr21rOixkeGKacRQAAAIs"], referer: www.google.com
[Thu May 14 18:33:46.421381 2026] [:error] [pid 47721:tid 47741] [client 2.58.56.137:49174] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-plain.php"] [unique_id "agWlCnEmh7_G0hfOa6sAfQAAAZI"], referer: www.google.com
[Thu May 14 18:33:47.070552 2026] [:error] [pid 11581:tid 11617] [client 2.58.56.137:65064] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-plain.php"] [unique_id "agWlC_0vF48FbzpvQMX6iAAAABQ"], referer: www.google.com
[Thu May 14 18:33:47.071536 2026] [:error] [pid 11588:tid 11661] [client 2.58.56.137:64685] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "agWlC9Ur21rOixkeGKacVAAAAIk"]
[Thu May 14 18:33:47.088547 2026] [:error] [pid 11588:tid 11655] [client 2.58.56.137:63623] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "agWlC9Ur21rOixkeGKacVgAAAIM"], referer: www.google.com
[Thu May 14 18:33:47.163097 2026] [:error] [pid 11588:tid 11673] [client 2.58.56.137:63625] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "agWlC9Ur21rOixkeGKacWQAAAJU"], referer: www.google.com
[Thu May 14 18:33:47.963222 2026] [:error] [pid 63033:tid 63055] [client 2.58.56.137:57386] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agWlC1MY49UWn5BpqVbxnAAAARQ"]
[Thu May 14 18:33:48.316627 2026] [:error] [pid 11588:tid 11659] [client 2.58.56.137:54876] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "agWlDNUr21rOixkeGKacdQAAAIc"], referer: www.google.com
[Thu May 14 18:33:49.562837 2026] [:error] [pid 63033:tid 63045] [client 2.58.56.137:62442] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "agWlDVMY49UWn5BpqVbxsQAAAQo"], referer: www.google.com
[Thu May 14 18:33:49.603880 2026] [:error] [pid 11588:tid 11674] [client 2.58.56.137:62502] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agWlDdUr21rOixkeGKacgwAAAJY"]
[Thu May 14 18:33:50.301035 2026] [:error] [pid 11581:tid 11606] [client 2.58.56.137:62185] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agWlDv0vF48FbzpvQMX6pQAAAAk"]
[Thu May 14 18:33:50.881077 2026] [:error] [pid 11581:tid 11602] [client 2.58.56.137:63132] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "agWlDv0vF48FbzpvQMX6rgAAAAU"], referer: www.google.com
[Thu May 14 18:33:52.037920 2026] [:error] [pid 47721:tid 47732] [client 2.58.56.137:50245] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "agWlEHEmh7_G0hfOa6sAtwAAAYk"], referer: www.google.com
[Thu May 14 18:33:52.138086 2026] [:error] [pid 11581:tid 11610] [client 2.58.56.137:63740] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "agWlEP0vF48FbzpvQMX6vQAAAA0"], referer: www.google.com
[Thu May 14 18:33:53.332780 2026] [:error] [pid 11588:tid 11668] [client 2.58.56.137:60257] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "agWlEdUr21rOixkeGKacwgAAAJA"], referer: www.google.com
[Thu May 14 18:33:53.389669 2026] [:error] [pid 11588:tid 11656] [client 2.58.56.137:53393] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "agWlEdUr21rOixkeGKacxQAAAIQ"], referer: www.google.com
[Thu May 14 18:33:54.540594 2026] [:error] [pid 11581:tid 11614] [client 2.58.56.137:64300] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "agWlEv0vF48FbzpvQMX67gAAABE"], referer: www.google.com
[Thu May 14 18:33:54.663132 2026] [:error] [pid 11581:tid 11603] [client 2.58.56.137:65288] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "agWlEv0vF48FbzpvQMX68QAAAAY"], referer: www.google.com
[Thu May 14 18:33:56.709470 2026] [:error] [pid 11581:tid 11612] [client 2.58.56.137:59858] [client 2.58.56.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "agWlFP0vF48FbzpvQMX7AQAAAA8"], referer: www.google.com
[Thu May 14 19:27:18.053419 2026] [:error] [pid 47721:tid 47737] [client 120.57.122.123:53837] [client 120.57.122.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.57.122.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agWxlnEmh7_G0hfOa6sNjQAAAY4"]
[Thu May 14 19:27:27.884286 2026] [:error] [pid 11581:tid 11620] [client 120.57.122.123:54173] [client 120.57.122.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.57.122.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agWxn_0vF48FbzpvQMUMqAAAABc"]
[Thu May 14 19:27:38.303619 2026] [:error] [pid 47721:tid 47736] [client 120.57.122.123:54502] [client 120.57.122.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.57.122.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agWxqnEmh7_G0hfOa6sNsQAAAY0"]
[Thu May 14 19:27:48.624392 2026] [:error] [pid 11588:tid 11676] [client 120.57.122.123:54765] [client 120.57.122.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.57.122.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agWxtNUr21rOixkeGKam4AAAAJg"]
[Thu May 14 19:27:59.029631 2026] [:error] [pid 11690:tid 11722] [client 120.57.122.123:55025] [client 120.57.122.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.57.122.123, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agWxvynxWuLN8Hptw8kstwAAANc"]
[Fri May 15 00:29:55.776958 2026] [:error] [pid 47721:tid 47731] [client 8.228.39.139:56202] [client 8.228.39.139] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "agX4g3Emh7_G0hfOa6tDgwAAAYg"]
[Fri May 15 01:26:20.745704 2026] [:error] [pid 11582:tid 11633] [client 8.230.104.211:49340] [client 8.230.104.211] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "agYFvPuw2cmFDpGcKhBIjwAAAEg"]
[Fri May 15 02:01:45.209555 2026] [:error] [pid 47721:tid 47738] [client 43.128.87.4:33868] [client 43.128.87.4] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agYOCXEmh7_G0hfOa6tQrwAAAY8"]
[Fri May 15 03:29:51.766522 2026] [:error] [pid 11690:tid 11716] [client 34.118.105.78:43810] [client 34.118.105.78] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "agYirynxWuLN8Hptw8lc0wAAANE"]
[Fri May 15 04:07:27.823101 2026] [:error] [pid 1295:tid 1299] [client 34.158.31.139:34122] [client 34.158.31.139] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "agYrf9mMhqLvs0GYixm_2wAAAME"]
[Fri May 15 04:12:26.575365 2026] [:error] [pid 1295:tid 1302] [client 34.64.250.89:46486] [client 34.64.250.89] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "agYsqtmMhqLvs0GYixnB6gAAAMQ"]
[Fri May 15 04:22:32.414637 2026] [:error] [pid 1295:tid 1299] [client 34.83.104.128:52890] [client 34.83.104.128] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "agYvCNmMhqLvs0GYixnEhAAAAME"]
[Fri May 15 04:31:42.919002 2026] [:error] [pid 1295:tid 1302] [client 40.65.146.60:1168] [client 40.65.146.60] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "agYxLtmMhqLvs0GYixnHwAAAAMQ"]
[Fri May 15 04:31:44.569450 2026] [:error] [pid 1189:tid 1240] [client 40.65.146.60:1029] [client 40.65.146.60] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "agYxMAe36qIGegR4kck_rQAAAE8"]
[Fri May 15 04:53:38.175361 2026] [:error] [pid 50531:tid 50553] [client 43.134.162.36:36444] [client 43.134.162.36] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agY2Uh3WbFwE6voqGzqRVgAAARQ"]
[Fri May 15 09:14:07.196267 2026] [:error] [pid 1188:tid 1215] [client 43.153.87.54:44656] [client 43.153.87.54] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agZzX9Y68iW8yuNkNzPsZwAAABI"]
[Fri May 15 09:56:43.377126 2026] [:error] [pid 1295:tid 1304] [client 84.32.151.190:2572] [client 84.32.151.190] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.expressinteriors.com|F|2"] [data "TX:0=application/zip"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agZ9W9mMhqLvs0GYixkbYgAAAMY"]
[Fri May 15 10:58:27.022692 2026] [:error] [pid 51234:tid 51240] [client 43.166.255.122:45428] [client 43.166.255.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agaL0972N9CbeiqcqgPpGwAAAUQ"]
[Fri May 15 13:17:58.793068 2026] [:error] [pid 9305:tid 9351] [client 129.211.172.249:47954] [client 129.211.172.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agasht5FZyBmdCM8GsFtggAAAE0"]
[Fri May 15 15:10:30.201623 2026] [:error] [pid 9392:tid 9409] [client 149.107.51.83:53455] [client 149.107.51.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.107.51.83, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agbG5tBWJIjH1U9zGfanNQAAAQ8"]
[Fri May 15 15:11:33.280396 2026] [:error] [pid 30240:tid 30249] [client 149.107.51.83:54528] [client 149.107.51.83] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agbHJa8ckHvaA6bpewtC-AAAAUc"]
[Fri May 15 15:12:03.729749 2026] [:error] [pid 9307:tid 9378] [client 149.107.51.83:54974] [client 149.107.51.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.107.51.83, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agbHQyC43jY1IRzK5VZDAAAAAM0"]
[Fri May 15 15:12:26.964899 2026] [:error] [pid 30208:tid 30219] [client 149.107.51.83:55312] [client 149.107.51.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.107.51.83, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agbHWpmLMCJujX-JTvgaXgAAAIk"]
[Fri May 15 15:12:50.269934 2026] [:error] [pid 30240:tid 30257] [client 149.107.51.83:55659] [client 149.107.51.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.107.51.83, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agbHcq8ckHvaA6bpewtDRAAAAU8"]
[Fri May 15 15:13:15.928491 2026] [:error] [pid 9392:tid 9404] [client 149.107.51.83:55992] [client 149.107.51.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 149.107.51.83, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agbHi9BWJIjH1U9zGfan0AAAAQo"]
[Fri May 15 16:37:45.722250 2026] [:error] [pid 30272:tid 30290] [client 116.72.62.233:52425] [client 116.72.62.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.72.62.233, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agbbWXvc_jSFaQ_7_wfAZAAAAZA"]
[Fri May 15 16:37:56.447542 2026] [:error] [pid 30240:tid 30243] [client 116.72.62.233:52760] [client 116.72.62.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.72.62.233, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agbbZK8ckHvaA6bpewtQIwAAAUE"]
[Fri May 15 16:38:06.849480 2026] [:error] [pid 9392:tid 9417] [client 116.72.62.233:52978] [client 116.72.62.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.72.62.233, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agbbbtBWJIjH1U9zGfa3DAAAARc"]
[Fri May 15 16:38:17.268203 2026] [:error] [pid 9392:tid 9415] [client 116.72.62.233:53196] [client 116.72.62.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.72.62.233, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agbbedBWJIjH1U9zGfa3GgAAARU"]
[Fri May 15 16:38:27.618772 2026] [:error] [pid 9305:tid 9347] [client 116.72.62.233:53412] [client 116.72.62.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.72.62.233, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agbbg95FZyBmdCM8GsGB4AAAAEk"]
[Fri May 15 18:34:45.034498 2026] [:error] [pid 9305:tid 9347] [client 129.226.217.17:34054] [client 129.226.217.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agb2xd5FZyBmdCM8GsGIuAAAAEk"]
[Fri May 15 19:39:22.134909 2026] [:error] [pid 9392:tid 9407] [client 190.159.36.43:46708] [client 190.159.36.43] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agcF6tBWJIjH1U9zGfbRRgAAAQ0"]
[Fri May 15 20:45:17.615118 2026] [:error] [pid 30272:tid 30289] [client 43.157.172.39:37388] [client 43.157.172.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agcVXXvc_jSFaQ_7_wfy9wAAAY8"]
[Fri May 15 22:10:19.854110 2026] [:error] [pid 9304:tid 9325] [client 43.130.228.73:32812] [client 43.130.228.73] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agcpS9zcINh7UFIbVoGgRAAAAA8"]
[Fri May 15 23:38:04.985965 2026] [:error] [pid 30208:tid 30223] [client 20.195.199.66:6073] [client 20.195.199.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "agc93JmLMCJujX-JTvhFzQAAAI0"]
[Fri May 15 23:38:06.235039 2026] [:error] [pid 30272:tid 30296] [client 20.195.199.66:1106] [client 20.195.199.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "agc93nvc_jSFaQ_7_wcRqQAAAZY"]
[Fri May 15 23:38:07.526786 2026] [:error] [pid 30272:tid 30286] [client 20.195.199.66:2105] [client 20.195.199.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "agc933vc_jSFaQ_7_wcRrQAAAYw"]
[Fri May 15 23:38:08.803456 2026] [:error] [pid 30272:tid 30294] [client 20.195.199.66:8014] [client 20.195.199.66] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "agc94Hvc_jSFaQ_7_wcRsgAAAZQ"]
[Sat May 16 00:14:03.644287 2026] [:error] [pid 9305:tid 9355] [client 124.156.200.223:35892] [client 124.156.200.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agdGS95FZyBmdCM8GsGdkQAAAFE"]
[Sat May 16 02:01:29.356092 2026] [:error] [pid 30208:tid 30226] [client 192.144.148.122:55812] [client 192.144.148.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agdfeZmLMCJujX-JTvhTZwAAAJA"]
[Sat May 16 02:46:12.333542 2026] [authz_core:error] [pid 30208:tid 30216] [client 64.23.218.208:47754] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Sat May 16 02:46:20.663460 2026] [:error] [pid 59202:tid 59228] [client 64.23.218.208:47814] [client 64.23.218.208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "agdp_EORbjeqf1CKQ2KFAAAAAhA"]
[Sat May 16 02:46:24.678936 2026] [:error] [pid 59453:tid 59463] [client 64.23.218.208:37764] [client 64.23.218.208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "agdqAHnXIIDivY9RkF0t9AAAA0Q"]
[Sat May 16 02:46:33.234972 2026] [:error] [pid 59453:tid 59483] [client 64.23.218.208:56878] [client 64.23.218.208] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "agdqCXnXIIDivY9RkF0t-QAAA1Q"]
[Sat May 16 02:46:48.246970 2026] [:error] [pid 9392:tid 9400] [client 64.23.218.208:40894] [client 64.23.218.208] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.expressinteriors.com|F|2"] [data ".axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/trace.axd"] [unique_id "agdqGNBWJIjH1U9zGfYJqwAAAQY"]
[Sat May 16 03:04:19.513739 2026] [:error] [pid 30272:tid 30282] [client 159.223.121.195:39310] [client 159.223.121.195] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "agduM3vc_jSFaQ_7_wc3SAAAAYg"]
[Sat May 16 08:57:42.020884 2026] [:error] [pid 24979:tid 24986] [client 190.159.36.43:52752] [client 190.159.36.43] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agfBBrvSFUQiwLaOL2pOjAAAAMU"]
[Sat May 16 09:00:39.155549 2026] [:error] [pid 24869:tid 24915] [client 49.51.252.146:34724] [client 49.51.252.146] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agfBt-xo3FMprMltYl4WXAAAAEc"]
[Sat May 16 11:39:33.169849 2026] [:error] [pid 61411:tid 61424] [client 150.109.12.46:53088] [client 150.109.12.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agfm9WVkiEwGnPL_dvHS2gAAAYs"]
[Sat May 16 12:28:23.400303 2026] [:error] [pid 62210:tid 62215] [client 120.88.34.154:41315] [client 120.88.34.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.88.34.154, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agfyZ8jHonCA4ORo40G3hQAAAkM"]
[Sat May 16 12:28:26.345468 2026] [:error] [pid 62341:tid 62369] [client 120.88.34.154:41335] [client 120.88.34.154] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agfyaqnvQ59ep-XG78iW7AAAApc"]
[Sat May 16 12:28:37.125872 2026] [:error] [pid 62341:tid 62370] [client 120.88.34.154:41335] [client 120.88.34.154] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agfydanvQ59ep-XG78iW9gAAApg"]
[Sat May 16 13:43:20.309916 2026] [:error] [pid 61361:tid 61370] [client 175.27.163.171:39108] [client 175.27.163.171] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aggD-JZojzbt3jGziNkxNQAAAUc"]
[Sat May 16 16:27:42.757967 2026] [:error] [pid 61411:tid 61420] [client 173.239.214.212:55431] [client 173.239.214.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggqfmVkiEwGnPL_dvH-ggAAAYc"], referer: https://wordpress.org/
[Sat May 16 16:28:51.772080 2026] [:error] [pid 62210:tid 62231] [client 173.239.214.209:61167] [client 173.239.214.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggqw8jHonCA4ORo40HGtAAAAlM"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:29:22.187737 2026] [:error] [pid 62341:tid 62353] [client 173.239.214.233:33319] [client 173.239.214.233] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.233, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggq4qnvQ59ep-XG78ivhwAAAoc"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:29:45.443444 2026] [:error] [pid 61411:tid 61428] [client 173.239.214.204:32709] [client 173.239.214.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.204, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggq-WVkiEwGnPL_dvH-4gAAAY8"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:30:36.364984 2026] [:error] [pid 5602:tid 5607] [client 173.239.214.233:62603] [client 173.239.214.233] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.233, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggrLNzTTsu77r3UIskq1wAAAQM"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:31:29.075965 2026] [:error] [pid 5602:tid 5626] [client 173.239.214.225:38039] [client 173.239.214.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggrYdzTTsu77r3UIskq5gAAARY"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:32:01.561436 2026] [:error] [pid 61361:tid 61366] [client 173.239.214.225:23023] [client 173.239.214.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggrgZZojzbt3jGziNlXzAAAAUM"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:32:26.782977 2026] [:error] [pid 61463:tid 61466] [client 173.239.214.183:64783] [client 173.239.214.183] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.183, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggrmjXdL1WU7nYXPmTvGwAAAcE"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:33:13.861575 2026] [:error] [pid 24867:tid 24897] [client 173.239.214.195:39929] [client 173.239.214.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggrySDgFLCgyKq-zmYX1wAAABA"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:34:53.147343 2026] [:error] [pid 61411:tid 61415] [client 173.239.214.189:61405] [client 173.239.214.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggsLWVkiEwGnPL_dvH_mAAAAYI"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:35:22.680166 2026] [:error] [pid 24979:tid 25002] [client 173.239.214.202:36029] [client 173.239.214.202] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.202, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggsSrvSFUQiwLaOL2qSyAAAANU"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:37:14.270501 2026] [:error] [pid 24979:tid 24998] [client 173.239.214.229:35255] [client 173.239.214.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggsurvSFUQiwLaOL2qS4gAAANE"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:37:32.980829 2026] [:error] [pid 61361:tid 61378] [client 173.239.214.231:48339] [client 173.239.214.231] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.231, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggszJZojzbt3jGziNlYgAAAAU8"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:38:59.840189 2026] [:error] [pid 24874:tid 24940] [client 173.239.214.195:39351] [client 173.239.214.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggtI8iii6x3XidYGHHYqgAAAIU"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:39:41.872866 2026] [:error] [pid 24869:tid 24927] [client 173.239.214.223:28291] [client 173.239.214.223] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.223, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggtTexo3FMprMltYl4yTAAAAFM"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:40:47.786503 2026] [:error] [pid 24979:tid 24989] [client 173.239.214.216:23867] [client 173.239.214.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggtj7vSFUQiwLaOL2qTOAAAAMg"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:41:35.038031 2026] [:error] [pid 24874:tid 24947] [client 173.239.214.210:60979] [client 173.239.214.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggtv8iii6x3XidYGHHY1gAAAIw"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:42:29.235258 2026] [:error] [pid 61361:tid 61366] [client 173.239.214.187:22107] [client 173.239.214.187] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.187, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggt9ZZojzbt3jGziNlaJAAAAUM"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:42:52.083408 2026] [:error] [pid 61361:tid 61380] [client 173.239.214.210:48515] [client 173.239.214.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agguDJZojzbt3jGziNlaOgAAAVE"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:43:43.331424 2026] [:error] [pid 61361:tid 61374] [client 173.239.214.188:26307] [client 173.239.214.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agguP5Zojzbt3jGziNlaYwAAAUs"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:44:46.464056 2026] [:error] [pid 62210:tid 62229] [client 173.239.214.224:36689] [client 173.239.214.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.224, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggufsjHonCA4ORo40HH6QAAAlE"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:45:53.385420 2026] [:error] [pid 61361:tid 61385] [client 173.239.214.194:26871] [client 173.239.214.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agguwZZojzbt3jGziNla4QAAAVY"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:46:58.227288 2026] [:error] [pid 61361:tid 61385] [client 173.239.214.207:29653] [client 173.239.214.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggvApZojzbt3jGziNlbBAAAAVY"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:47:23.850973 2026] [:error] [pid 24869:tid 24912] [client 173.239.214.229:33397] [client 173.239.214.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggvG-xo3FMprMltYl4ykAAAAEQ"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:47:58.829880 2026] [:error] [pid 61361:tid 61387] [client 173.239.214.232:46345] [client 173.239.214.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.232, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggvPpZojzbt3jGziNlbHAAAAVg"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:48:34.273729 2026] [:error] [pid 62341:tid 62367] [client 173.239.214.213:64177] [client 173.239.214.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.213, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggvYqnvQ59ep-XG78ixKwAAApU"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:49:00.783184 2026] [:error] [pid 24869:tid 24921] [client 173.239.214.197:46873] [client 173.239.214.197] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.197, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggvfOxo3FMprMltYl4ymQAAAE0"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:49:53.438183 2026] [:error] [pid 5602:tid 5627] [client 173.239.214.194:47449] [client 173.239.214.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggvsdzTTsu77r3UIsksFAAAARc"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:50:42.881518 2026] [:error] [pid 24874:tid 24954] [client 173.239.214.193:23453] [client 173.239.214.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggv4siii6x3XidYGHHZSgAAAJM"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:51:07.056394 2026] [:error] [pid 62210:tid 62227] [client 173.239.214.225:22101] [client 173.239.214.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggv-8jHonCA4ORo40HIKgAAAk8"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:52:00.970364 2026] [:error] [pid 5602:tid 5604] [client 173.239.214.183:24599] [client 173.239.214.183] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.183, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggwMNzTTsu77r3UIsksewAAAQA"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:52:14.175324 2026] [:error] [pid 61361:tid 61365] [client 173.239.214.200:20825] [client 173.239.214.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggwPpZojzbt3jGziNlbzgAAAUI"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:52:40.922231 2026] [:error] [pid 61411:tid 61416] [client 173.239.214.220:45515] [client 173.239.214.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggwWGVkiEwGnPL_dvECNwAAAYM"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:54:45.884289 2026] [:error] [pid 24979:tid 24984] [client 173.239.214.232:64043] [client 173.239.214.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.232, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggw1bvSFUQiwLaOL2qVVAAAAMM"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:55:31.628650 2026] [:error] [pid 24869:tid 24920] [client 173.239.214.194:42807] [client 173.239.214.194] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.194, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggxA-xo3FMprMltYl4y4AAAAEw"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:56:20.773960 2026] [:error] [pid 24979:tid 25004] [client 173.239.214.226:38273] [client 173.239.214.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggxNLvSFUQiwLaOL2qVfgAAANc"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:57:03.563048 2026] [:error] [pid 62341:tid 62356] [client 173.239.214.200:49027] [client 173.239.214.200] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.200, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggxX6nvQ59ep-XG78ixpwAAAoo"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:57:49.947842 2026] [:error] [pid 61361:tid 61377] [client 173.239.214.193:38025] [client 173.239.214.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggxjZZojzbt3jGziNlcvAAAAU4"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:57:52.956002 2026] [:error] [pid 61361:tid 61372] [client 173.239.214.193:38025] [client 173.239.214.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggxkJZojzbt3jGziNlcvwAAAUk"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:58:07.128363 2026] [:error] [pid 24867:tid 24894] [client 173.239.214.199:49263] [client 173.239.214.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.199, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggxnyDgFLCgyKq-zmYYsQAAAA0"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:58:42.240449 2026] [:error] [pid 61463:tid 61470] [client 173.239.214.203:21057] [client 173.239.214.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggxwjXdL1WU7nYXPmTwDAAAAcU"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:59:07.231432 2026] [:error] [pid 24979:tid 25004] [client 173.239.214.204:31643] [client 173.239.214.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.204, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggx27vSFUQiwLaOL2qVxwAAANc"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 16:59:33.260014 2026] [:error] [pid 24979:tid 24991] [client 173.239.214.229:36339] [client 173.239.214.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggx9bvSFUQiwLaOL2qVzwAAAMo"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:00:31.545053 2026] [:error] [pid 61361:tid 61382] [client 173.239.214.199:47193] [client 173.239.214.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.199, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggyL5Zojzbt3jGziNldBwAAAVM"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:01:23.671350 2026] [:error] [pid 5602:tid 5613] [client 173.239.214.216:29115] [client 173.239.214.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggyY9zTTsu77r3UIsks0QAAAQk"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:01:44.347429 2026] [:error] [pid 24979:tid 24983] [client 173.239.214.199:42967] [client 173.239.214.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.199, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggyeLvSFUQiwLaOL2qWAgAAAMI"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:02:11.924954 2026] [:error] [pid 5602:tid 5611] [client 173.239.214.187:21493] [client 173.239.214.187] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.187, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggyk9zTTsu77r3UIsks1QAAAQc"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:03:04.651365 2026] [:error] [pid 61411:tid 61436] [client 173.239.214.191:53749] [client 173.239.214.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.191, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggyyGVkiEwGnPL_dvEDcAAAAZc"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:03:33.757415 2026] [:error] [pid 62210:tid 62234] [client 173.239.214.218:55715] [client 173.239.214.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggy5cjHonCA4ORo40HIpgAAAlY"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:04:44.877723 2026] [:error] [pid 24874:tid 24951] [client 173.239.214.182:56449] [client 173.239.214.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.182, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggzLMiii6x3XidYGHHZoQAAAJA"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:06:16.633606 2026] [:error] [pid 24869:tid 24926] [client 173.239.214.222:54227] [client 173.239.214.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.222, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggziOxo3FMprMltYl4zHQAAAFI"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:07:32.884476 2026] [:error] [pid 24979:tid 24997] [client 173.239.214.209:43189] [client 173.239.214.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggz1LvSFUQiwLaOL2qWXwAAANA"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:08:05.450603 2026] [:error] [pid 61361:tid 61384] [client 173.239.214.207:26787] [client 173.239.214.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aggz9ZZojzbt3jGziNleFwAAAVU"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:09:13.433563 2026] [:error] [pid 24979:tid 24989] [client 173.239.214.226:58499] [client 173.239.214.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg0ObvSFUQiwLaOL2qWZwAAAMg"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:10:45.578646 2026] [:error] [pid 24874:tid 24948] [client 173.239.214.188:59697] [client 173.239.214.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg0lciii6x3XidYGHHZ3AAAAI0"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:11:07.139790 2026] [:error] [pid 24869:tid 24929] [client 173.239.214.182:57067] [client 173.239.214.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.182, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg0q-xo3FMprMltYl4zVQAAAFU"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:11:31.536477 2026] [:error] [pid 5602:tid 5604] [client 173.239.214.213:47255] [client 173.239.214.213] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.213, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg0w9zTTsu77r3UIsktSAAAAQA"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:12:21.056314 2026] [:error] [pid 61361:tid 61379] [client 173.239.214.205:50211] [client 173.239.214.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.205, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg09ZZojzbt3jGziNlezgAAAVA"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:13:11.052688 2026] [:error] [pid 61411:tid 61435] [client 173.239.214.208:26735] [client 173.239.214.208] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.208, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg1J2VkiEwGnPL_dvEETwAAAZY"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:14:53.449028 2026] [:error] [pid 5602:tid 5618] [client 173.239.214.193:31027] [client 173.239.214.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg1jdzTTsu77r3UIsktiAAAAQ4"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:15:51.228586 2026] [:error] [pid 61361:tid 61367] [client 173.239.214.203:23717] [client 173.239.214.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg1x5Zojzbt3jGziNlfiAAAAUQ"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:17:15.552189 2026] [:error] [pid 61361:tid 61387] [client 173.239.214.208:45975] [client 173.239.214.208] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.208, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg2G5Zojzbt3jGziNlfvgAAAVg"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:18:24.143344 2026] [:error] [pid 61361:tid 61374] [client 173.239.214.182:23685] [client 173.239.214.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.182, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg2YJZojzbt3jGziNlf8AAAAUs"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:19:52.031591 2026] [:error] [pid 62210:tid 62231] [client 173.239.214.202:56855] [client 173.239.214.202] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.202, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg2uMjHonCA4ORo40HJrgAAAlM"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:26:18.934446 2026] [:error] [pid 5602:tid 5620] [client 173.239.214.191:44397] [client 173.239.214.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.191, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg4OtzTTsu77r3UIskuPwAAARA"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:26:44.453131 2026] [:error] [pid 61361:tid 61365] [client 173.239.214.204:35397] [client 173.239.214.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.204, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg4VJZojzbt3jGziNliBwAAAUI"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:27:45.476152 2026] [:error] [pid 5602:tid 5608] [client 173.239.214.216:50591] [client 173.239.214.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg4kdzTTsu77r3UIskuXQAAAQQ"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:28:19.121203 2026] [:error] [pid 5602:tid 5611] [client 173.239.214.208:28113] [client 173.239.214.208] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.208, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg4s9zTTsu77r3UIskucAAAAQc"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:29:42.161185 2026] [:error] [pid 61411:tid 61417] [client 173.239.214.203:63603] [client 173.239.214.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg5BmVkiEwGnPL_dvEHegAAAYQ"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:30:17.172015 2026] [:error] [pid 5602:tid 5606] [client 173.239.214.191:60855] [client 173.239.214.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.191, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg5KdzTTsu77r3UIskujgAAAQI"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:31:07.644622 2026] [:error] [pid 61463:tid 61483] [client 173.239.214.227:41347] [client 173.239.214.227] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.227, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg5WzXdL1WU7nYXPmTxhAAAAdI"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:31:55.885368 2026] [:error] [pid 61361:tid 61374] [client 173.239.214.201:28855] [client 173.239.214.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg5i5Zojzbt3jGziNljmgAAAUs"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:32:36.341044 2026] [:error] [pid 24867:tid 24884] [client 173.239.214.201:58055] [client 173.239.214.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg5tCDgFLCgyKq-zmYZkAAAAAM"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:34:22.870083 2026] [:error] [pid 62210:tid 62220] [client 173.239.214.182:25165] [client 173.239.214.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.182, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg6HsjHonCA4ORo40HKRQAAAkg"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:35:01.721321 2026] [:error] [pid 62341:tid 62357] [client 173.239.214.203:38771] [client 173.239.214.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg6RanvQ59ep-XG78i0fwAAAos"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:38:29.443403 2026] [:error] [pid 61361:tid 61384] [client 173.239.214.185:50327] [client 173.239.214.185] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.185, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg7FZZojzbt3jGziNlkpQAAAVU"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:38:56.657357 2026] [:error] [pid 61411:tid 61416] [client 173.239.214.222:41377] [client 173.239.214.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.222, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg7MGVkiEwGnPL_dvEIQQAAAYM"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:42:08.983828 2026] [:error] [pid 62341:tid 62360] [client 173.239.214.215:52229] [client 173.239.214.215] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.215, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg78KnvQ59ep-XG78i00gAAAo4"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:43:14.454959 2026] [:error] [pid 61463:tid 61468] [client 173.239.214.189:35279] [client 173.239.214.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg8MjXdL1WU7nYXPmTxxQAAAcM"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:43:39.538607 2026] [:error] [pid 61361:tid 61376] [client 173.239.214.204:49511] [client 173.239.214.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.204, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg8S5Zojzbt3jGziNllHAAAAU0"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:45:08.456499 2026] [:error] [pid 61361:tid 61380] [client 173.239.214.207:24951] [client 173.239.214.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg8pJZojzbt3jGziNllTwAAAVE"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:45:43.661970 2026] [:error] [pid 5602:tid 5612] [client 173.239.214.224:29191] [client 173.239.214.224] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.224, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg8x9zTTsu77r3UIskvaQAAAQg"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:48:01.066883 2026] [:error] [pid 5602:tid 5605] [client 173.239.214.221:45107] [client 173.239.214.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.221, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg9UdzTTsu77r3UIskvdwAAAQE"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:49:26.498473 2026] [:error] [pid 24979:tid 24982] [client 173.239.214.211:55871] [client 173.239.214.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg9prvSFUQiwLaOL2qZpQAAAME"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:51:27.239706 2026] [:error] [pid 62341:tid 62364] [client 173.239.214.220:62883] [client 173.239.214.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg-H6nvQ59ep-XG78i13gAAApI"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:53:06.684191 2026] [:error] [pid 24869:tid 24911] [client 173.239.214.182:58535] [client 173.239.214.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.182, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg-guxo3FMprMltYl40sgAAAEM"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:53:29.439529 2026] [:error] [pid 62341:tid 62363] [client 173.239.214.183:45007] [client 173.239.214.183] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.183, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg-manvQ59ep-XG78i2HQAAApE"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 17:53:50.988601 2026] [:error] [pid 61411:tid 61436] [client 173.239.214.189:34743] [client 173.239.214.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agg-rmVkiEwGnPL_dvEKHwAAAZc"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:00:22.868608 2026] [:error] [pid 24979:tid 24982] [client 173.239.214.207:54521] [client 173.239.214.207] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.207, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghANrvSFUQiwLaOL2qalAAAAME"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:02:54.353467 2026] [:error] [pid 62210:tid 62220] [client 173.239.214.226:26651] [client 173.239.214.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghAzsjHonCA4ORo40HLgwAAAkg"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:03:45.576592 2026] [:error] [pid 5602:tid 5608] [client 173.239.214.208:51923] [client 173.239.214.208] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.208, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghBAdzTTsu77r3UIskwMQAAAQQ"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:05:58.940485 2026] [:error] [pid 24979:tid 24981] [client 173.239.214.226:54099] [client 173.239.214.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghBhrvSFUQiwLaOL2qbIgAAAMA"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:07:52.033186 2026] [:error] [pid 24869:tid 24930] [client 173.239.214.195:40121] [client 173.239.214.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghB-Oxo3FMprMltYl41DQAAAFY"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:10:29.632924 2026] [:error] [pid 5602:tid 5627] [client 173.239.214.218:55693] [client 173.239.214.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghCldzTTsu77r3UIskwoAAAARc"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:10:47.546148 2026] [:error] [pid 5602:tid 5620] [client 173.239.214.188:39007] [client 173.239.214.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghCp9zTTsu77r3UIskwpgAAARA"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:12:14.453180 2026] [:error] [pid 24874:tid 24936] [client 173.239.214.220:24217] [client 173.239.214.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghC_siii6x3XidYGHHcowAAAIE"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:12:50.650153 2026] [:error] [pid 61361:tid 61367] [client 173.239.214.210:36323] [client 173.239.214.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghDIpZojzbt3jGziNlpmwAAAUQ"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:15:39.056749 2026] [:error] [pid 5602:tid 5619] [client 173.239.214.216:62271] [client 173.239.214.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghDy9zTTsu77r3UIskw1AAAAQ8"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:17:38.228489 2026] [:error] [pid 24979:tid 24981] [client 173.239.214.188:61065] [client 173.239.214.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghEQrvSFUQiwLaOL2qcWgAAAMA"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:18:50.878852 2026] [:error] [pid 61361:tid 61384] [client 173.239.214.210:43089] [client 173.239.214.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.210, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghEipZojzbt3jGziNlqsQAAAVU"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:23:55.067667 2026] [:error] [pid 61463:tid 61479] [client 173.239.214.219:43383] [client 173.239.214.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.219, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghFuzXdL1WU7nYXPmTzNAAAAc4"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:26:57.057200 2026] [:error] [pid 62341:tid 62346] [client 173.239.214.218:45103] [client 173.239.214.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.218, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghGcanvQ59ep-XG78i4VgAAAoA"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:28:31.161981 2026] [:error] [pid 61361:tid 61385] [client 173.239.214.228:21585] [client 173.239.214.228] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.228, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghGz5Zojzbt3jGziNlr7wAAAVY"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:30:28.047496 2026] [:error] [pid 24869:tid 24923] [client 173.239.214.195:55715] [client 173.239.214.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.195, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghHROxo3FMprMltYl41xQAAAE8"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:31:16.963995 2026] [:error] [pid 61411:tid 61437] [client 173.239.214.219:39615] [client 173.239.214.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.219, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghHdGVkiEwGnPL_dvEM_wAAAZg"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:36:27.956574 2026] [:error] [pid 61411:tid 61427] [client 173.239.214.183:64151] [client 173.239.214.183] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.183, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghIq2VkiEwGnPL_dvENQwAAAY4"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:38:08.924635 2026] [:error] [pid 61411:tid 61421] [client 173.239.214.216:46043] [client 173.239.214.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghJEGVkiEwGnPL_dvENXgAAAYg"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:38:37.936559 2026] [:error] [pid 5602:tid 5608] [client 173.239.214.197:46385] [client 173.239.214.197] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.197, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghJLdzTTsu77r3UIskxgwAAAQQ"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:41:07.982829 2026] [:error] [pid 24869:tid 24927] [client 173.239.214.220:60831] [client 173.239.214.220] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.220, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghJw-xo3FMprMltYl418gAAAFM"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:43:18.158738 2026] [:error] [pid 24867:tid 24894] [client 173.239.214.197:50211] [client 173.239.214.197] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.197, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghKRiDgFLCgyKq-zmYa4AAAAA0"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:50:21.446072 2026] [:error] [pid 61463:tid 61469] [client 173.239.214.216:26517] [client 173.239.214.216] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.216, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghL7TXdL1WU7nYXPmT0DAAAAcQ"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 18:55:29.064632 2026] [:error] [pid 61411:tid 61431] [client 173.239.214.209:59153] [client 173.239.214.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghNIWVkiEwGnPL_dvEPpAAAAZI"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 19:07:47.078563 2026] [:error] [pid 24869:tid 24912] [client 173.239.214.221:42951] [client 173.239.214.221] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.214.221, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "aghQA-xo3FMprMltYl42jQAAAEQ"], referer: https://cdbdinteriors.com.au/wp-login.php
[Sat May 16 19:30:09.768619 2026] [:error] [pid 61361:tid 61375] [client 43.134.57.179:56330] [client 43.134.57.179] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aghVQZZojzbt3jGziNlyiAAAAUw"]
[Sat May 16 21:01:52.214847 2026] [:error] [pid 24867:tid 24895] [client 43.132.214.228:36278] [client 43.132.214.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aghqwCDgFLCgyKq-zmYeKAAAAA4"]
[Sat May 16 21:48:40.703326 2026] [:error] [pid 62210:tid 62218] [client 23.251.47.13:39364] [client 23.251.47.13] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.expressinteriors.com|F|2"] [data "TX:0=text/csv"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agh1uMjHonCA4ORo40HUTgAAAkY"]
[Sat May 16 23:11:09.118840 2026] [:error] [pid 61411:tid 61429] [client 43.133.69.37:57458] [client 43.133.69.37] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agiJDWVkiEwGnPL_dvEqOAAAAZA"]
[Sat May 16 23:43:49.277356 2026] [:error] [pid 24874:tid 24959] [client 92.118.39.29:59456] [client 92.118.39.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "agiQtciii6x3XidYGHHoCgAAAJg"]
[Sun May 17 00:02:26.661049 2026] [:error] [pid 5602:tid 5609] [client 13.221.70.26:41824] [client 13.221.70.26] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||expressinteriors.com|F|4"] [data "EmailWolf"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agiVEtzTTsu77r3UIslDbAAAAQU"]
[Sun May 17 00:41:39.793340 2026] [:error] [pid 24979:tid 25001] [client 52.231.25.233:1522] [client 52.231.25.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "agieQ7vSFUQiwLaOL2q-cAAAANQ"]
[Sun May 17 00:41:40.346161 2026] [:error] [pid 61411:tid 61423] [client 52.231.25.233:5693] [client 52.231.25.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "agieRGVkiEwGnPL_dvE2MgAAAYo"]
[Sun May 17 00:41:40.985933 2026] [:error] [pid 24979:tid 25002] [client 52.231.25.233:1535] [client 52.231.25.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "agieRLvSFUQiwLaOL2q-cwAAANU"]
[Sun May 17 00:41:41.535406 2026] [:error] [pid 61411:tid 61415] [client 52.231.25.233:4731] [client 52.231.25.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/adminfuns.php"] [unique_id "agieRWVkiEwGnPL_dvE2NQAAAYI"]
[Sun May 17 01:59:28.409678 2026] [:error] [pid 24867:tid 24896] [client 208.84.102.234:18242] [client 208.84.102.234] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "agiwgCDgFLCgyKq-zmYmLwAAAA8"]
[Sun May 17 01:59:29.173156 2026] [:error] [pid 24979:tid 25004] [client 208.84.102.234:18272] [client 208.84.102.234] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/app/.env"] [unique_id "agiwgbvSFUQiwLaOL2rFvwAAANc"]
[Sun May 17 01:59:29.173813 2026] [:error] [pid 24979:tid 24988] [client 208.84.102.234:18288] [client 208.84.102.234] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/api/.env"] [unique_id "agiwgbvSFUQiwLaOL2rFwAAAAMc"]
[Sun May 17 01:59:29.176642 2026] [:error] [pid 61411:tid 61422] [client 208.84.102.234:18270] [client 208.84.102.234] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.production"] [unique_id "agiwgWVkiEwGnPL_dvFCHQAAAYk"]
[Sun May 17 01:59:29.181767 2026] [:error] [pid 24979:tid 24982] [client 208.84.102.234:18296] [client 208.84.102.234] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/backend/.env"] [unique_id "agiwgbvSFUQiwLaOL2rFwgAAAME"]
[Sun May 17 01:59:29.182426 2026] [:error] [pid 61411:tid 61413] [client 208.84.102.234:18254] [client 208.84.102.234] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.local"] [unique_id "agiwgWVkiEwGnPL_dvFCHwAAAYA"]
[Sun May 17 02:24:34.895288 2026] [:error] [pid 24979:tid 25002] [client 101.42.46.71:59694] [client 101.42.46.71] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agi2YrvSFUQiwLaOL2rI8AAAANU"]
[Sun May 17 04:22:22.504914 2026] [:error] [pid 36652:tid 36672] [client 43.163.199.209:59828] [client 43.163.199.209] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agjR_jZrzQadnZADvj_3SQAAARI"]
[Sun May 17 06:15:04.323663 2026] [:error] [pid 36652:tid 36664] [client 43.166.128.187:53948] [client 43.166.128.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agjsaDZrzQadnZADvj8RUAAAAQo"]
[Sun May 17 06:20:35.361966 2026] [:error] [pid 59061:tid 59116] [client 103.153.183.69:5686] [client 103.153.183.69] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "Multipart parsing error: Multipart: No boundaries found in payload."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agjts4YS410zAmsYkoL2EgAAAFQ"]
[Sun May 17 06:20:35.362076 2026] [:error] [pid 59061:tid 59116] [client 103.153.183.69:5686] [client 103.153.183.69] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agjts4YS410zAmsYkoL2EgAAAFQ"]
[Sun May 17 07:01:41.355451 2026] [:error] [pid 59062:tid 59136] [client 74.7.227.148:59302] [client 74.7.227.148] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.7.227.148, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agj3VT4V9GkVWmCFmGbAewAAAI0"], referer: https://expressinteriors.com/
[Sun May 17 09:13:59.746608 2026] [:error] [pid 36652:tid 36665] [client 43.156.18.240:46306] [client 43.156.18.240] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agkWVzZrzQadnZADvj8q1QAAAQs"]
[Sun May 17 10:57:42.317475 2026] [:error] [pid 59166:tid 59168] [client 43.156.116.44:56150] [client 43.156.116.44] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agkupk_puQ1I47_0UrjM4gAAAMA"]
[Sun May 17 12:04:51.792706 2026] [:error] [pid 17234:tid 17246] [client 4.193.204.100:2073] [client 4.193.204.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "agk-Y9J4QOrYRCeDR2gwhwAAAUo"]
[Sun May 17 12:04:52.386382 2026] [:error] [pid 59061:tid 59119] [client 4.193.204.100:2237] [client 4.193.204.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "agk-ZIYS410zAmsYkoIOYQAAAFc"]
[Sun May 17 12:04:52.787367 2026] [:error] [pid 59062:tid 59133] [client 4.193.204.100:2187] [client 4.193.204.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "agk-ZD4V9GkVWmCFmGbarAAAAIo"]
[Sun May 17 12:04:53.158137 2026] [:error] [pid 59060:tid 59069] [client 4.193.204.100:1586] [client 4.193.204.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/404.php"] [unique_id "agk-Zfvwvq3bndkPE4nY4gAAAAA"]
[Sun May 17 13:03:23.677846 2026] [:error] [pid 59060:tid 59090] [client 192.96.159.129:64092] [client 192.96.159.129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "aglMG_vwvq3bndkPE4ndIgAAABU"]
[Sun May 17 13:23:25.661148 2026] [:error] [pid 11079:tid 11100] [client 43.135.133.194:53436] [client 43.135.133.194] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aglQzWeR3-DrxhvUqxGghAAAAkA"]
[Sun May 17 13:24:31.866854 2026] [:error] [pid 10835:tid 10889] [client 177.223.46.226:52831] [client 177.223.46.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.223.46.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aglRD0k8lW0-dtknLl_1ZQAAAhA"]
[Sun May 17 13:25:39.139501 2026] [:error] [pid 59062:tid 59127] [client 177.223.46.226:53817] [client 177.223.46.226] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aglRUz4V9GkVWmCFmGbinQAAAIQ"]
[Sun May 17 13:26:05.354674 2026] [:error] [pid 10835:tid 10885] [client 177.223.46.226:54186] [client 177.223.46.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.223.46.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aglRbUk8lW0-dtknLl_1dAAAAgw"]
[Sun May 17 13:26:28.402373 2026] [:error] [pid 11079:tid 11100] [client 177.223.46.226:54475] [client 177.223.46.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.223.46.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aglRhGeR3-DrxhvUqxGg3QAAAkA"]
[Sun May 17 13:26:52.765513 2026] [:error] [pid 59062:tid 59128] [client 177.223.46.226:54796] [client 177.223.46.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.223.46.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aglRnD4V9GkVWmCFmGbirgAAAIU"]
[Sun May 17 13:27:13.344594 2026] [:error] [pid 59060:tid 59093] [client 177.223.46.226:55047] [client 177.223.46.226] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.223.46.226, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "aglRsfvwvq3bndkPE4neDQAAABg"]
[Sun May 17 14:11:27.155913 2026] [:error] [pid 59061:tid 59109] [client 1.12.70.96:54612] [client 1.12.70.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "aglcD4YS410zAmsYkoIWdwAAAE0"]
[Sun May 17 14:56:30.412512 2026] [:error] [pid 10835:tid 10893] [client 43.166.129.247:49678] [client 43.166.129.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aglmnkk8lW0-dtknLl_8vQAAAhQ"]
[Sun May 17 17:10:08.272750 2026] [:error] [pid 59060:tid 59074] [client 171.76.86.177:9538] [client 171.76.86.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.76.86.177, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agmF8Pvwvq3bndkPE4no9wAAAAU"]
[Sun May 17 17:10:18.690019 2026] [:error] [pid 10834:tid 10859] [client 171.76.86.177:5022] [client 171.76.86.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.76.86.177, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agmF-hISNQ_Nf83-VpqbZwAAAc0"]
[Sun May 17 17:10:29.596616 2026] [:error] [pid 59062:tid 59134] [client 171.76.86.177:20334] [client 171.76.86.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.76.86.177, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agmGBT4V9GkVWmCFmGYCSAAAAIs"]
[Sun May 17 17:10:39.776630 2026] [:error] [pid 59062:tid 59127] [client 171.76.86.177:1250] [client 171.76.86.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.76.86.177, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agmGDz4V9GkVWmCFmGYCSQAAAIQ"]
[Sun May 17 17:10:50.329757 2026] [:error] [pid 11079:tid 11102] [client 171.76.86.177:7174] [client 171.76.86.177] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.76.86.177, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agmGGmeR3-DrxhvUqxHPrwAAAkI"]
[Sun May 17 17:20:32.043523 2026] [:error] [pid 59062:tid 59142] [client 170.106.165.76:35324] [client 170.106.165.76] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agmIYD4V9GkVWmCFmGYDNQAAAJM"]
[Sun May 17 18:49:29.699874 2026] [:error] [pid 11079:tid 11121] [client 43.135.182.43:51368] [client 43.135.182.43] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agmdOWeR3-DrxhvUqxHh5gAAAlE"]
[Sun May 17 20:59:53.243566 2026] [:error] [pid 11079:tid 11124] [client 43.153.192.98:49436] [client 43.153.192.98] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agm7yWeR3-DrxhvUqxH7JgAAAlQ"]
[Sun May 17 22:20:00.950640 2026] [:error] [pid 10784:tid 10813] [client 35.227.19.175:43742] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "agnOkGBWRlKsFkSZGxBSlwAAAY4"]
[Sun May 17 22:20:02.850223 2026] [:error] [pid 10835:tid 10892] [client 35.227.19.175:43746] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "agnOkkk8lW0-dtknLl81PQAAAhM"]
[Sun May 17 22:20:03.700412 2026] [:error] [pid 10835:tid 10885] [client 35.227.19.175:43748] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.local"] [unique_id "agnOk0k8lW0-dtknLl81PwAAAgw"]
[Sun May 17 22:20:04.541985 2026] [:error] [pid 59060:tid 59079] [client 35.227.19.175:59584] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.production"] [unique_id "agnOlPvwvq3bndkPE4n5mQAAAAo"]
[Sun May 17 22:20:05.390750 2026] [:error] [pid 10784:tid 10806] [client 35.227.19.175:59594] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.staging"] [unique_id "agnOlWBWRlKsFkSZGxBSmgAAAYc"]
[Sun May 17 22:20:06.239820 2026] [:error] [pid 59060:tid 59073] [client 35.227.19.175:59598] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.development"] [unique_id "agnOlvvwvq3bndkPE4n5mgAAAAQ"]
[Sun May 17 22:20:07.094980 2026] [:error] [pid 59062:tid 59139] [client 35.227.19.175:59614] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.test"] [unique_id "agnOlz4V9GkVWmCFmGY4_wAAAJA"]
[Sun May 17 22:20:07.941606 2026] [:error] [pid 59062:tid 59143] [client 35.227.19.175:59620] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.remote"] [unique_id "agnOlz4V9GkVWmCFmGY5AQAAAJQ"]
[Sun May 17 22:20:08.788466 2026] [:error] [pid 59060:tid 59091] [client 35.227.19.175:59632] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.bak"] [unique_id "agnOmPvwvq3bndkPE4n5nQAAABY"]
[Sun May 17 22:20:09.638688 2026] [:error] [pid 10784:tid 10807] [client 35.227.19.175:59636] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.backup"] [unique_id "agnOmWBWRlKsFkSZGxBSnAAAAYg"]
[Sun May 17 22:20:10.487633 2026] [:error] [pid 10834:tid 10858] [client 35.227.19.175:59638] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.save"] [unique_id "agnOmhISNQ_Nf83-Vpq4LgAAAcw"]
[Sun May 17 22:20:11.336399 2026] [:error] [pid 59060:tid 59083] [client 35.227.19.175:59644] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.old"] [unique_id "agnOm_vwvq3bndkPE4n5nwAAAA4"]
[Sun May 17 22:20:12.184096 2026] [:error] [pid 17234:tid 17256] [client 35.227.19.175:59656] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.sample"] [unique_id "agnOnNJ4QOrYRCeDR2hjeAAAAVQ"]
[Sun May 17 22:20:13.033681 2026] [:error] [pid 11079:tid 11119] [client 35.227.19.175:59666] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.example"] [unique_id "agnOnWeR3-DrxhvUqxEIeQAAAk8"]
[Sun May 17 22:20:13.874506 2026] [:error] [pid 59062:tid 59142] [client 35.227.19.175:57918] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.dev"] [unique_id "agnOnT4V9GkVWmCFmGY5BgAAAJM"]
[Sun May 17 22:20:14.723747 2026] [:error] [pid 10835:tid 10887] [client 35.227.19.175:57926] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.prod"] [unique_id "agnOnkk8lW0-dtknLl81SwAAAg4"]
[Sun May 17 22:20:15.569514 2026] [:error] [pid 11079:tid 11102] [client 35.227.19.175:57930] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.stage"] [unique_id "agnOn2eR3-DrxhvUqxEIhgAAAkI"]
[Sun May 17 22:20:16.416784 2026] [:error] [pid 11079:tid 11127] [client 35.227.19.175:57932] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.ci"] [unique_id "agnOoGeR3-DrxhvUqxEIiAAAAlc"]
[Sun May 17 22:20:17.257740 2026] [:error] [pid 59062:tid 59137] [client 35.227.19.175:57946] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.docker"] [unique_id "agnOoT4V9GkVWmCFmGY5CQAAAI4"]
[Sun May 17 22:20:18.098415 2026] [:error] [pid 11079:tid 11114] [client 35.227.19.175:57954] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.live"] [unique_id "agnOomeR3-DrxhvUqxEIjAAAAko"]
[Sun May 17 22:20:18.944782 2026] [:error] [pid 10784:tid 10818] [client 35.227.19.175:57958] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.preprod"] [unique_id "agnOomBWRlKsFkSZGxBSoQAAAZI"]
[Sun May 17 22:20:19.796387 2026] [:error] [pid 11079:tid 11100] [client 35.227.19.175:57972] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.uat"] [unique_id "agnOo2eR3-DrxhvUqxEIlAAAAkA"]
[Sun May 17 22:20:22.164043 2026] [:error] [pid 10784:tid 10822] [client 35.227.19.175:57984] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.swp"] [unique_id "agnOpmBWRlKsFkSZGxBSogAAAZY"]
[Sun May 17 22:20:23.010454 2026] [:error] [pid 59166:tid 59189] [client 35.227.19.175:58000] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env~"] [unique_id "agnOp0_puQ1I47_0Urj0wgAAANU"]
[Sun May 17 22:20:23.859456 2026] [:error] [pid 11079:tid 11104] [client 35.227.19.175:39686] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/app/.env"] [unique_id "agnOp2eR3-DrxhvUqxEIogAAAkQ"]
[Sun May 17 22:20:24.705763 2026] [:error] [pid 10835:tid 10876] [client 35.227.19.175:39694] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/apps/.env"] [unique_id "agnOqEk8lW0-dtknLl81VgAAAgM"]
[Sun May 17 22:20:25.561069 2026] [:error] [pid 11079:tid 11123] [client 35.227.19.175:39698] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/api/.env"] [unique_id "agnOqWeR3-DrxhvUqxEIqQAAAlM"]
[Sun May 17 22:20:26.405349 2026] [:error] [pid 11079:tid 11114] [client 35.227.19.175:39702] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/web/.env"] [unique_id "agnOqmeR3-DrxhvUqxEIrQAAAko"]
[Sun May 17 22:20:27.491939 2026] [:error] [pid 11079:tid 11116] [client 35.227.19.175:39710] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/site/.env"] [unique_id "agnOq2eR3-DrxhvUqxEIswAAAkw"]
[Sun May 17 22:20:28.340987 2026] [:error] [pid 11079:tid 11102] [client 35.227.19.175:39726] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/public/.env"] [unique_id "agnOrGeR3-DrxhvUqxEItQAAAkI"]
[Sun May 17 22:20:29.183861 2026] [:error] [pid 59061:tid 59099] [client 35.227.19.175:39742] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/admin/.env"] [unique_id "agnOrYYS410zAmsYkoIzowAAAEM"]
[Sun May 17 22:20:30.028287 2026] [:error] [pid 11079:tid 11119] [client 35.227.19.175:39756] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/backend/.env"] [unique_id "agnOrmeR3-DrxhvUqxEIuAAAAk8"]
[Sun May 17 22:20:30.873497 2026] [:error] [pid 11079:tid 11113] [client 35.227.19.175:39762] [client 35.227.19.175] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/server/.env"] [unique_id "agnOrmeR3-DrxhvUqxEIuQAAAkk"]
[Mon May 18 00:31:25.927919 2026] [:error] [pid 11079:tid 11118] [client 196.234.208.104:45173] [client 196.234.208.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.234.208.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agntXWeR3-DrxhvUqxEXbgAAAk4"]
[Mon May 18 00:31:36.484622 2026] [:error] [pid 59062:tid 59128] [client 196.234.208.104:45387] [client 196.234.208.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.234.208.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agntaD4V9GkVWmCFmGZOlQAAAIU"]
[Mon May 18 00:31:57.724899 2026] [:error] [pid 59062:tid 59131] [client 196.234.208.104:45801] [client 196.234.208.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.234.208.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agntfT4V9GkVWmCFmGZOqgAAAIg"]
[Mon May 18 00:32:08.406977 2026] [:error] [pid 11079:tid 11115] [client 196.234.208.104:45989] [client 196.234.208.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.234.208.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agntiGeR3-DrxhvUqxEXnQAAAks"]
[Mon May 18 00:32:29.483500 2026] [:error] [pid 10784:tid 10802] [client 196.234.208.104:1376] [client 196.234.208.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.234.208.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agntnWBWRlKsFkSZGxBZNAAAAYM"]
[Mon May 18 00:34:56.871726 2026] [:error] [pid 59166:tid 59187] [client 43.134.177.47:58694] [client 43.134.177.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agnuME_puQ1I47_0Urj5hwAAANM"]
[Mon May 18 02:20:32.517343 2026] [:error] [pid 17234:tid 17259] [client 20.214.161.107:8642] [client 20.214.161.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "agoG8NJ4QOrYRCeDR2hx2QAAAVc"]
[Mon May 18 02:20:35.061581 2026] [:error] [pid 10784:tid 10806] [client 20.214.161.107:8840] [client 20.214.161.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "agoG82BWRlKsFkSZGxBhAQAAAYc"]
[Mon May 18 02:20:35.788968 2026] [:error] [pid 17234:tid 17245] [client 20.214.161.107:8838] [client 20.214.161.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "agoG89J4QOrYRCeDR2hx2wAAAUk"]
[Mon May 18 02:20:36.525791 2026] [:error] [pid 10835:tid 10888] [client 20.214.161.107:8617] [client 20.214.161.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "agoG9Ek8lW0-dtknLl9MlgAAAg8"]
[Mon May 18 02:20:37.281318 2026] [:error] [pid 10835:tid 10887] [client 20.214.161.107:8884] [client 20.214.161.107] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "agoG9Uk8lW0-dtknLl9MmAAAAg4"]
[Mon May 18 02:23:24.999283 2026] [:error] [pid 59062:tid 59131] [client 43.163.84.198:51550] [client 43.163.84.198] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agoHnD4V9GkVWmCFmGZlBAAAAIg"]
[Mon May 18 02:58:34.070121 2026] [:error] [pid 10834:tid 10863] [client 175.178.110.121:45302] [client 175.178.110.121] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agoP2hISNQ_Nf83-VprOPAAAAdE"]
[Mon May 18 05:02:52.460941 2026] [:error] [pid 20779:tid 20851] [client 170.106.35.187:36770] [client 170.106.35.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agos_CF3Tl5ZGU-QyEDTFwAAAIU"]
[Mon May 18 07:20:40.541675 2026] [:error] [pid 20884:tid 20905] [client 20.226.33.48:5303] [client 20.226.33.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "agpNSHv9K_lRldrJG3PCUQAAANM"]
[Mon May 18 07:20:43.111871 2026] [:error] [pid 20778:tid 20828] [client 20.226.33.48:5255] [client 20.226.33.48] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "agpNS2b9K2_TPGoCpAr_kAAAAEo"]
[Mon May 18 11:10:55.584430 2026] [:error] [pid 36492:tid 36523] [client 170.106.165.186:57934] [client 170.106.165.186] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agqDP2CVlogrkn9m2w5wwQAAAAE"]
[Mon May 18 13:02:51.934397 2026] [:error] [pid 36492:tid 36540] [client 106.205.45.42:1954] [client 106.205.45.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.205.45.42, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agqde2CVlogrkn9m2w6H5QAAABI"]
[Mon May 18 13:03:02.643931 2026] [:error] [pid 44087:tid 44090] [client 106.205.45.42:1982] [client 106.205.45.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.205.45.42, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agqdhm5HPHbH9GK7l6zS-wAAAcE"]
[Mon May 18 13:03:12.551325 2026] [:error] [pid 36491:tid 36506] [client 106.205.45.42:2540] [client 106.205.45.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.205.45.42, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agqdkE555B9CZb6D60mKOAAAAUs"]
[Mon May 18 13:03:23.223702 2026] [:error] [pid 44010:tid 44032] [client 106.205.45.42:1992] [client 106.205.45.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.205.45.42, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agqdmzcFUuogD3-74-ZgPwAAANQ"]
[Mon May 18 13:03:33.638953 2026] [:error] [pid 44087:tid 44089] [client 106.205.45.42:1581] [client 106.205.45.42] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.205.45.42, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agqdpW5HPHbH9GK7l6zS_gAAAcA"]
[Mon May 18 13:48:14.633080 2026] [:error] [pid 44046:tid 44050] [client 43.153.54.138:33500] [client 43.153.54.138] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agqoHoYF4k2jfXJBXk3flAAAAYI"]
[Mon May 18 14:38:07.962203 2026] [:error] [pid 36492:tid 36529] [client 34.181.196.233:51015] [client 34.181.196.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.181.196.233, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agqzz2CVlogrkn9m2w6ejwAAAAc"]
[Mon May 18 14:38:10.316206 2026] [:error] [pid 36492:tid 36538] [client 34.181.196.233:51015] [client 34.181.196.233] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "agqz0mCVlogrkn9m2w6ekgAAABA"]
[Mon May 18 14:38:10.531666 2026] [:error] [pid 36492:tid 36528] [client 34.181.196.233:51015] [client 34.181.196.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.181.196.233, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agqz0mCVlogrkn9m2w6ekwAAAAY"]
[Mon May 18 14:38:12.218592 2026] [:error] [pid 36579:tid 36599] [client 34.181.196.233:53771] [client 34.181.196.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.181.196.233, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agqz1F-aoZxBfgL5vDxqsQAAAFE"]
[Mon May 18 14:38:13.929950 2026] [:error] [pid 36493:tid 36557] [client 34.181.196.233:64215] [client 34.181.196.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.181.196.233, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agqz1QynkzQB5nM668qoogAAAQg"]
[Mon May 18 14:38:15.578037 2026] [:error] [pid 36579:tid 36591] [client 34.181.196.233:50178] [client 34.181.196.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.181.196.233, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agqz11-aoZxBfgL5vDxqtAAAAEk"]
[Mon May 18 14:38:17.261389 2026] [:error] [pid 36491:tid 36496] [client 34.181.196.233:57953] [client 34.181.196.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.181.196.233, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agqz2U555B9CZb6D60mZVwAAAUE"]
[Mon May 18 14:38:17.261546 2026] [:error] [pid 36491:tid 36496] [client 34.181.196.233:57953] [client 34.181.196.233] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.181.196.233, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agqz2U555B9CZb6D60mZVwAAAUE"]
[Mon May 18 14:49:48.730785 2026] [:error] [pid 44010:tid 44028] [client 162.14.109.170:40816] [client 162.14.109.170] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agq2jDcFUuogD3-74-Zm3QAAANA"]
[Mon May 18 15:19:40.815208 2026] [:error] [pid 43916:tid 43948] [client 43.135.183.82:43912] [client 43.135.183.82] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agq9jNQC236p33zJJvm80wAAAJg"]
[Mon May 18 21:25:11.543544 2026] [:error] [pid 36493:tid 36562] [client 43.134.104.17:37750] [client 43.134.104.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agsTNwynkzQB5nM668rNTwAAAQ0"]
[Tue May 19 00:21:44.434355 2026] [:error] [pid 44010:tid 44027] [client 20.63.211.172:2807] [client 20.63.211.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "ags8mDcFUuogD3-74-aHkwAAAM8"]
[Tue May 19 00:21:44.961470 2026] [:error] [pid 36492:tid 36533] [client 20.63.211.172:4813] [client 20.63.211.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "ags8mGCVlogrkn9m2w4WjwAAAAs"]
[Tue May 19 00:21:45.571312 2026] [:error] [pid 36492:tid 36537] [client 20.63.211.172:4818] [client 20.63.211.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "ags8mWCVlogrkn9m2w4WkAAAAA8"]
[Tue May 19 00:21:46.162985 2026] [:error] [pid 36492:tid 36540] [client 20.63.211.172:4841] [client 20.63.211.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "ags8mmCVlogrkn9m2w4WkQAAABI"]
[Tue May 19 00:43:08.719062 2026] [:error] [pid 44010:tid 44014] [client 34.69.109.7:51730] [client 34.69.109.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.109.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agtBnDcFUuogD3-74-aI7wAAAMI"]
[Tue May 19 00:43:10.841622 2026] [:error] [pid 44010:tid 44018] [client 34.69.109.7:51730] [client 34.69.109.7] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "agtBnjcFUuogD3-74-aI8gAAAMY"]
[Tue May 19 00:43:11.038033 2026] [:error] [pid 44010:tid 44036] [client 34.69.109.7:51730] [client 34.69.109.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.109.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agtBnzcFUuogD3-74-aI8wAAANg"]
[Tue May 19 00:43:12.411302 2026] [:error] [pid 44010:tid 44034] [client 34.69.109.7:57279] [client 34.69.109.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.109.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agtBoDcFUuogD3-74-aI9AAAANY"]
[Tue May 19 00:43:13.761707 2026] [:error] [pid 44010:tid 44032] [client 34.69.109.7:64497] [client 34.69.109.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.109.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agtBoTcFUuogD3-74-aI9QAAANQ"]
[Tue May 19 00:43:15.119126 2026] [:error] [pid 44046:tid 44058] [client 34.69.109.7:56042] [client 34.69.109.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.109.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agtBo4YF4k2jfXJBXk0MAgAAAYo"]
[Tue May 19 00:43:16.454877 2026] [:error] [pid 44010:tid 44026] [client 34.69.109.7:49365] [client 34.69.109.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.69.109.7, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agtBpDcFUuogD3-74-aI9gAAAM4"]
[Tue May 19 00:43:16.455046 2026] [:error] [pid 44010:tid 44026] [client 34.69.109.7:49365] [client 34.69.109.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.69.109.7, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agtBpDcFUuogD3-74-aI9gAAAM4"]
[Tue May 19 01:08:59.771222 2026] [:error] [pid 44087:tid 44098] [client 194.26.192.149:61727] [client 194.26.192.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/widgets/txets.php"] [unique_id "agtHq25HPHbH9GK7l6wLMAAAAck"]
[Tue May 19 01:09:00.328941 2026] [:error] [pid 36579:tid 36597] [client 194.26.192.149:62371] [client 194.26.192.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/rest-api/txets.php"] [unique_id "agtHrF-aoZxBfgL5vDywFgAAAE8"]
[Tue May 19 01:09:00.839810 2026] [:error] [pid 43916:tid 43924] [client 194.26.192.149:62619] [client 194.26.192.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-template/txets.php"] [unique_id "agtHrNQC236p33zJJvncAwAAAIA"]
[Tue May 19 01:09:02.902833 2026] [:error] [pid 36491:tid 36505] [client 194.26.192.149:65290] [client 194.26.192.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/txets.php"] [unique_id "agtHrk555B9CZb6D60n1qAAAAUo"]
[Tue May 19 01:43:05.571465 2026] [:error] [pid 44010:tid 44020] [client 159.223.44.189:55430] [client 159.223.44.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.44.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agtPqTcFUuogD3-74-aMeAAAAMg"]
[Tue May 19 01:43:07.350610 2026] [:error] [pid 44010:tid 44026] [client 159.223.44.189:55430] [client 159.223.44.189] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "agtPqzcFUuogD3-74-aMfAAAAM4"]
[Tue May 19 01:43:07.438317 2026] [:error] [pid 44010:tid 44027] [client 159.223.44.189:55430] [client 159.223.44.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.44.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agtPqzcFUuogD3-74-aMfQAAAM8"]
[Tue May 19 01:43:08.373780 2026] [:error] [pid 36579:tid 36599] [client 159.223.44.189:49464] [client 159.223.44.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.44.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agtPrF-aoZxBfgL5vDyznQAAAFE"]
[Tue May 19 01:43:09.265531 2026] [:error] [pid 44087:tid 44092] [client 159.223.44.189:62555] [client 159.223.44.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.44.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agtPrW5HPHbH9GK7l6wNqQAAAcM"]
[Tue May 19 01:43:10.187668 2026] [:error] [pid 36493:tid 36566] [client 159.223.44.189:55985] [client 159.223.44.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.44.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agtPrgynkzQB5nM668rjaAAAARE"]
[Tue May 19 01:43:11.077739 2026] [:error] [pid 36579:tid 36592] [client 159.223.44.189:57966] [client 159.223.44.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.44.189, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agtPr1-aoZxBfgL5vDyzowAAAEo"]
[Tue May 19 01:43:11.077860 2026] [:error] [pid 36579:tid 36592] [client 159.223.44.189:57966] [client 159.223.44.189] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 159.223.44.189, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agtPr1-aoZxBfgL5vDyzowAAAEo"]
[Tue May 19 03:38:01.786766 2026] [:error] [pid 36491:tid 36496] [client 119.91.20.139:48762] [client 119.91.20.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agtqmU555B9CZb6D60kZaAAAAUE"]
[Tue May 19 04:46:56.107167 2026] [:error] [pid 38699:tid 38762] [client 103.65.237.216:50175] [client 103.65.237.216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/sftp-config.json"] [unique_id "agt6wL--Adsw_P-dthYg4AAAAFQ"]
[Tue May 19 04:46:56.332173 2026] [:error] [pid 38699:tid 38757] [client 103.65.237.216:50199] [client 103.65.237.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.vscode/sftp.json"] [unique_id "agt6wL--Adsw_P-dthYg4gAAAE8"]
[Tue May 19 06:44:59.484846 2026] [:error] [pid 38697:tid 38717] [client 43.155.157.239:37708] [client 43.155.157.239] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "aguWa6XP9pP6Kgt-msSvuwAAAAI"]
[Tue May 19 09:14:45.368834 2026] [:error] [pid 38814:tid 38821] [client 170.106.107.87:39832] [client 170.106.107.87] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agu5hQvkKuBwP0epzWdmiwAAAMU"]
[Tue May 19 10:02:56.821231 2026] [:error] [pid 46896:tid 46912] [client 162.243.236.109:62023] [client 162.243.236.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.243.236.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvE0KCHyzL3Ci9LGE0KPQAAAY4"]
[Tue May 19 10:02:58.951606 2026] [:error] [pid 46896:tid 46915] [client 162.243.236.109:62023] [client 162.243.236.109] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "agvE0qCHyzL3Ci9LGE0KQgAAAZE"]
[Tue May 19 10:02:59.156839 2026] [:error] [pid 46896:tid 46902] [client 162.243.236.109:62023] [client 162.243.236.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.243.236.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvE06CHyzL3Ci9LGE0KQwAAAYQ"]
[Tue May 19 10:02:59.158525 2026] [:error] [pid 46896:tid 46902] [client 162.243.236.109:62023] [client 162.243.236.109] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvE06CHyzL3Ci9LGE0KQwAAAYQ"]
[Tue May 19 10:02:59.160161 2026] [:error] [pid 46896:tid 46902] [client 162.243.236.109:62023] [client 162.243.236.109] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvE06CHyzL3Ci9LGE0KQwAAAYQ"]
[Tue May 19 10:03:00.585630 2026] [:error] [pid 46815:tid 46828] [client 162.243.236.109:62630] [client 162.243.236.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.243.236.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvE1CPnRhJOmA06LgoaZgAAAUs"]
[Tue May 19 10:03:00.587051 2026] [:error] [pid 46815:tid 46828] [client 162.243.236.109:62630] [client 162.243.236.109] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvE1CPnRhJOmA06LgoaZgAAAUs"]
[Tue May 19 10:03:00.588196 2026] [:error] [pid 46815:tid 46828] [client 162.243.236.109:62630] [client 162.243.236.109] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||expressinteriors.com|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvE1CPnRhJOmA06LgoaZgAAAUs"]
[Tue May 19 10:03:02.029269 2026] [:error] [pid 38814:tid 38818] [client 162.243.236.109:62825] [client 162.243.236.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.243.236.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvE1gvkKuBwP0epzWdqrwAAAMI"]
[Tue May 19 10:03:03.503492 2026] [:error] [pid 38699:tid 38766] [client 162.243.236.109:63016] [client 162.243.236.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.243.236.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvE17--Adsw_P-dthZZkwAAAFg"]
[Tue May 19 10:03:04.899054 2026] [:error] [pid 46896:tid 46906] [client 162.243.236.109:63189] [client 162.243.236.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.243.236.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvE2KCHyzL3Ci9LGE0KTQAAAYg"]
[Tue May 19 10:03:04.899273 2026] [:error] [pid 46896:tid 46906] [client 162.243.236.109:63189] [client 162.243.236.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 162.243.236.109, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvE2KCHyzL3Ci9LGE0KTQAAAYg"]
[Tue May 19 10:03:05.721685 2026] [:error] [pid 46896:tid 46904] [client 162.243.236.109:63271] [client 162.243.236.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.243.236.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvE2aCHyzL3Ci9LGE0KUAAAAYY"]
[Tue May 19 10:03:05.721893 2026] [:error] [pid 46896:tid 46904] [client 162.243.236.109:63271] [client 162.243.236.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 162.243.236.109, counter = 7"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvE2aCHyzL3Ci9LGE0KUAAAAYY"]
[Tue May 19 10:03:06.543926 2026] [:error] [pid 38705:tid 38791] [client 162.243.236.109:63401] [client 162.243.236.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.243.236.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvE2sg5dNOZ5umN9ls1BAAAAJY"]
[Tue May 19 10:03:06.544122 2026] [:error] [pid 38705:tid 38791] [client 162.243.236.109:63401] [client 162.243.236.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 162.243.236.109, counter = 8"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvE2sg5dNOZ5umN9ls1BAAAAJY"]
[Tue May 19 10:03:07.377440 2026] [:error] [pid 46896:tid 46911] [client 162.243.236.109:63514] [client 162.243.236.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.243.236.109, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvE26CHyzL3Ci9LGE0KaQAAAY0"]
[Tue May 19 10:03:07.377655 2026] [:error] [pid 46896:tid 46911] [client 162.243.236.109:63514] [client 162.243.236.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 162.243.236.109, counter = 9"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvE26CHyzL3Ci9LGE0KaQAAAY0"]
[Tue May 19 10:52:39.669715 2026] [:error] [pid 46896:tid 46916] [client 43.159.143.139:59592] [client 43.159.143.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agvQd6CHyzL3Ci9LGE0ZEQAAAZI"]
[Tue May 19 11:20:30.204254 2026] [:error] [pid 38699:tid 38748] [client 93.86.49.84:33187] [client 93.86.49.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.86.49.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvW_r--Adsw_P-dthZmeQAAAEY"]
[Tue May 19 11:21:14.817162 2026] [:error] [pid 38705:tid 38778] [client 93.86.49.84:43048] [client 93.86.49.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.86.49.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvXKsg5dNOZ5umN9ls95wAAAIk"]
[Tue May 19 11:21:39.116351 2026] [:error] [pid 38697:tid 38738] [client 93.86.49.84:36271] [client 93.86.49.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.86.49.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvXQ6XP9pP6Kgt-msT-6gAAABc"]
[Tue May 19 11:22:00.521838 2026] [:error] [pid 38697:tid 38720] [client 93.86.49.84:50201] [client 93.86.49.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.86.49.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvXWKXP9pP6Kgt-msT_BQAAAAU"]
[Tue May 19 11:22:58.694998 2026] [:error] [pid 46815:tid 46832] [client 93.86.49.84:12931] [client 93.86.49.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.86.49.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvXkiPnRhJOmA06LgomRwAAAU8"]
[Tue May 19 12:35:22.419184 2026] [:error] [pid 38697:tid 38729] [client 122.160.119.33:51465] [client 122.160.119.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.160.119.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvoiqXP9pP6Kgt-msQPmQAAAA4"]
[Tue May 19 12:35:33.579846 2026] [:error] [pid 46815:tid 46817] [client 122.160.119.33:51919] [client 122.160.119.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.160.119.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvolSPnRhJOmA06Lgoy-wAAAUA"]
[Tue May 19 12:35:44.820024 2026] [:error] [pid 38705:tid 38785] [client 122.160.119.33:52289] [client 122.160.119.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.160.119.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvooMg5dNOZ5umN9ltE2gAAAJA"]
[Tue May 19 12:35:55.653965 2026] [:error] [pid 38699:tid 38761] [client 122.160.119.33:52641] [client 122.160.119.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.160.119.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvoq7--Adsw_P-dthZwcwAAAFM"]
[Tue May 19 12:36:06.576988 2026] [:error] [pid 38814:tid 38827] [client 122.160.119.33:52998] [client 122.160.119.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.160.119.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agvotgvkKuBwP0epzWd3IgAAAMs"]
[Tue May 19 13:46:40.665233 2026] [:error] [pid 41573:tid 41592] [client 106.214.2.181:29555] [client 106.214.2.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.214.2.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agv5QC1A2bd6JDSW9RZfQQAAARE"]
[Tue May 19 13:46:50.885130 2026] [:error] [pid 38814:tid 38824] [client 106.214.2.181:1360] [client 106.214.2.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.214.2.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agv5SgvkKuBwP0epzWd71wAAAMg"]
[Tue May 19 13:47:01.796029 2026] [:error] [pid 38697:tid 38721] [client 106.214.2.181:22020] [client 106.214.2.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.214.2.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agv5VaXP9pP6Kgt-msQX-gAAAAY"]
[Tue May 19 13:47:12.332967 2026] [:error] [pid 46896:tid 46915] [client 106.214.2.181:29539] [client 106.214.2.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.214.2.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agv5YKCHyzL3Ci9LGE1AkAAAAZE"]
[Tue May 19 13:47:26.253612 2026] [:error] [pid 38697:tid 38739] [client 106.214.2.181:26186] [client 106.214.2.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.214.2.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agv5bqXP9pP6Kgt-msQX_AAAABg"]
[Tue May 19 13:47:33.963720 2026] [:error] [pid 46815:tid 46837] [client 106.214.2.181:6774] [client 106.214.2.181] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.214.2.181, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agv5dSPnRhJOmA06LgpFogAAAVQ"]
[Tue May 19 14:57:04.316442 2026] [:error] [pid 38705:tid 38789] [client 43.134.53.242:33666] [client 43.134.53.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agwJwMg5dNOZ5umN9ltOrQAAAJQ"]
[Tue May 19 16:39:29.246213 2026] [:error] [pid 38814:tid 38817] [client 49.145.35.50:57243] [client 49.145.35.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.35.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agwhwQvkKuBwP0epzWeR-wAAAME"]
[Tue May 19 16:50:12.182785 2026] [:error] [pid 41573:tid 41583] [client 49.145.35.50:54667] [client 49.145.35.50] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agwkRC1A2bd6JDSW9RZwHgAAAQg"]
[Tue May 19 16:50:44.171837 2026] [:error] [pid 38697:tid 38727] [client 49.145.35.50:56090] [client 49.145.35.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.35.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agwkZKXP9pP6Kgt-msQ0xAAAAAw"]
[Tue May 19 16:51:14.678273 2026] [:error] [pid 41573:tid 41595] [client 49.145.35.50:57426] [client 49.145.35.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.35.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agwkgi1A2bd6JDSW9RZwSwAAARQ"]
[Tue May 19 16:51:44.142565 2026] [:error] [pid 38814:tid 38835] [client 49.145.35.50:54537] [client 49.145.35.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.35.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agwkoAvkKuBwP0epzWeTXQAAANM"]
[Tue May 19 16:52:20.116376 2026] [:error] [pid 38697:tid 38720] [client 49.145.35.50:56154] [client 49.145.35.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.145.35.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agwkxKXP9pP6Kgt-msQ1CgAAAAU"]
[Tue May 19 17:22:58.689925 2026] [:error] [pid 55881:tid 55883] [client 150.109.119.38:59828] [client 150.109.119.38] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agwr8u-UExma0LUC7WD5pgAAAkA"]
[Tue May 19 18:13:56.632894 2026] [:error] [pid 46815:tid 46837] [client 20.226.97.125:45176] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "agw35CPnRhJOmA06LgpqXgAAAVQ"]
[Tue May 19 18:13:57.609509 2026] [:error] [pid 38697:tid 38737] [client 20.226.97.125:46603] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "agw35aXP9pP6Kgt-msRA_AAAABY"]
[Tue May 19 18:13:58.763911 2026] [:error] [pid 38699:tid 38763] [client 20.226.97.125:45151] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "agw35r--Adsw_P-dthaVbAAAAFU"]
[Tue May 19 18:13:59.849499 2026] [:error] [pid 46815:tid 46827] [client 20.226.97.125:46629] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/class.php"] [unique_id "agw35yPnRhJOmA06LgpqYQAAAUo"]
[Tue May 19 18:14:00.697183 2026] [:error] [pid 38699:tid 38743] [client 20.226.97.125:46610] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "agw36L--Adsw_P-dthaVbQAAAEE"]
[Tue May 19 18:14:01.503040 2026] [:error] [pid 38699:tid 38766] [client 20.226.97.125:46081] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "agw36b--Adsw_P-dthaVcgAAAFg"]
[Tue May 19 18:14:03.278501 2026] [:error] [pid 38697:tid 38717] [client 20.226.97.125:46086] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "agw366XP9pP6Kgt-msRA_gAAAAI"]
[Tue May 19 18:14:04.688881 2026] [:error] [pid 55881:tid 55904] [client 20.226.97.125:45229] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/goods.php"] [unique_id "agw37O-UExma0LUC7WD9FQAAAlU"]
[Tue May 19 18:14:06.032102 2026] [:error] [pid 55881:tid 55896] [client 20.226.97.125:23619] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "agw37u-UExma0LUC7WD9FgAAAk0"]
[Tue May 19 18:14:06.798125 2026] [:error] [pid 29823:tid 29835] [client 20.226.97.125:45182] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "agw37mO09C0nAz8vRk4xPwAAAcA"]
[Tue May 19 18:14:08.412425 2026] [:error] [pid 38697:tid 38736] [client 20.226.97.125:45236] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "agw38KXP9pP6Kgt-msRBAQAAABU"]
[Tue May 19 18:14:09.380781 2026] [:error] [pid 29622:tid 29648] [client 20.226.97.125:44381] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/info.php"] [unique_id "agw38TkOqPKWkPs_P15NuQAAAhg"]
[Tue May 19 18:14:10.073899 2026] [:error] [pid 46896:tid 46903] [client 20.226.97.125:44382] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "agw38qCHyzL3Ci9LGE1c2AAAAYU"]
[Tue May 19 18:14:10.874220 2026] [:error] [pid 29622:tid 29647] [client 20.226.97.125:44441] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "agw38jkOqPKWkPs_P15NugAAAhc"]
[Tue May 19 18:14:11.510807 2026] [:error] [pid 38697:tid 38732] [client 20.226.97.125:46560] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "agw386XP9pP6Kgt-msRBBQAAABE"]
[Tue May 19 18:14:12.176108 2026] [:error] [pid 29622:tid 29630] [client 20.226.97.125:44422] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "agw39DkOqPKWkPs_P15NvAAAAgY"]
[Tue May 19 18:14:12.864537 2026] [:error] [pid 46815:tid 46838] [client 20.226.97.125:45155] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aw.php"] [unique_id "agw39CPnRhJOmA06LgpqYwAAAVU"]
[Tue May 19 18:14:13.556795 2026] [:error] [pid 41573:tid 41591] [client 20.226.97.125:44431] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aw.php"] [unique_id "agw39S1A2bd6JDSW9RZ9BgAAARA"]
[Tue May 19 18:14:14.284138 2026] [:error] [pid 38814:tid 38830] [client 20.226.97.125:45137] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aw.php"] [unique_id "agw39gvkKuBwP0epzWeXiQAAAM4"]
[Tue May 19 18:14:14.941776 2026] [:error] [pid 41573:tid 41595] [client 20.226.97.125:45207] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aw.php"] [unique_id "agw39i1A2bd6JDSW9RZ9BwAAARQ"]
[Tue May 19 18:14:15.732843 2026] [:error] [pid 41573:tid 41576] [client 20.226.97.125:45139] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bb.php"] [unique_id "agw39y1A2bd6JDSW9RZ9CQAAAQE"]
[Tue May 19 18:14:17.318904 2026] [:error] [pid 38697:tid 38739] [client 20.226.97.125:44358] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bb.php"] [unique_id "agw3-aXP9pP6Kgt-msRBFAAAABg"]
[Tue May 19 18:14:18.109613 2026] [:error] [pid 38697:tid 38732] [client 20.226.97.125:44408] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bb.php"] [unique_id "agw3-qXP9pP6Kgt-msRBGgAAABE"]
[Tue May 19 18:14:18.920632 2026] [:error] [pid 38697:tid 38724] [client 20.226.97.125:44411] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bb.php"] [unique_id "agw3-qXP9pP6Kgt-msRBHQAAAAk"]
[Tue May 19 18:14:19.586996 2026] [:error] [pid 46896:tid 46920] [client 20.226.97.125:45238] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "agw3-6CHyzL3Ci9LGE1c2wAAAZY"]
[Tue May 19 18:14:20.230185 2026] [:error] [pid 38697:tid 38721] [client 20.226.97.125:46620] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "agw3_KXP9pP6Kgt-msRBIAAAAAY"]
[Tue May 19 18:14:20.869012 2026] [:error] [pid 38697:tid 38731] [client 20.226.97.125:44460] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "agw3_KXP9pP6Kgt-msRBIQAAABA"]
[Tue May 19 18:14:21.742199 2026] [:error] [pid 38699:tid 38763] [client 20.226.97.125:46109] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "agw3_b--Adsw_P-dthaVfAAAAFU"]
[Tue May 19 18:14:22.363414 2026] [:error] [pid 38697:tid 38725] [client 20.226.97.125:45233] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "agw3_qXP9pP6Kgt-msRBIwAAAAo"]
[Tue May 19 18:14:23.374328 2026] [:error] [pid 38699:tid 38743] [client 20.226.97.125:47393] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "agw3_7--Adsw_P-dthaVfQAAAEE"]
[Tue May 19 18:14:24.058131 2026] [:error] [pid 38697:tid 38739] [client 20.226.97.125:44430] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "agw4AKXP9pP6Kgt-msRBJQAAABg"]
[Tue May 19 18:14:24.721833 2026] [:error] [pid 38697:tid 38716] [client 20.226.97.125:47370] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/222.php"] [unique_id "agw4AKXP9pP6Kgt-msRBJgAAAAE"]
[Tue May 19 18:14:25.341205 2026] [:error] [pid 38697:tid 38733] [client 20.226.97.125:43789] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test1.php"] [unique_id "agw4AaXP9pP6Kgt-msRBJwAAABI"]
[Tue May 19 18:14:26.007136 2026] [:error] [pid 38697:tid 38738] [client 20.226.97.125:46062] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test1.php"] [unique_id "agw4AqXP9pP6Kgt-msRBKAAAABc"]
[Tue May 19 18:14:26.657847 2026] [:error] [pid 38814:tid 38837] [client 20.226.97.125:45191] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test1.php"] [unique_id "agw4AgvkKuBwP0epzWeXmAAAANU"]
[Tue May 19 18:14:28.020179 2026] [:error] [pid 38697:tid 38719] [client 20.226.97.125:45157] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test1.php"] [unique_id "agw4BKXP9pP6Kgt-msRBKQAAAAQ"]
[Tue May 19 18:14:29.953566 2026] [:error] [pid 38697:tid 38721] [client 20.226.97.125:45210] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "agw4BaXP9pP6Kgt-msRBKwAAAAY"]
[Tue May 19 18:14:34.834708 2026] [:error] [pid 38699:tid 38766] [client 20.226.97.125:46092] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "agw4Cr--Adsw_P-dthaVgAAAAFg"]
[Tue May 19 18:14:40.708727 2026] [:error] [pid 38699:tid 38760] [client 20.226.97.125:43811] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-mail.php"] [unique_id "agw4EL--Adsw_P-dthaVhAAAAFI"]
[Tue May 19 18:14:51.779604 2026] [:error] [pid 38699:tid 38743] [client 20.226.97.125:44445] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "agw4G7--Adsw_P-dthaViQAAAEE"]
[Tue May 19 18:15:06.663398 2026] [:error] [pid 38705:tid 38771] [client 20.226.97.125:45190] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX2.php"] [unique_id "agw4Ksg5dNOZ5umN9ltbTAAAAII"]
[Tue May 19 18:15:08.356144 2026] [:error] [pid 55881:tid 55907] [client 20.226.97.125:47311] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX2.php"] [unique_id "agw4LO-UExma0LUC7WD9HgAAAlg"]
[Tue May 19 18:15:11.803934 2026] [:error] [pid 55881:tid 55885] [client 20.226.97.125:26859] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX2.php"] [unique_id "agw4L--UExma0LUC7WD9HwAAAkI"]
[Tue May 19 18:15:13.246596 2026] [:error] [pid 46815:tid 46825] [client 20.226.97.125:46623] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/CDX2.php"] [unique_id "agw4MSPnRhJOmA06LgpqdQAAAUg"]
[Tue May 19 18:15:14.024206 2026] [:error] [pid 38814:tid 38829] [client 20.226.97.125:47828] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/profile.php"] [unique_id "agw4MgvkKuBwP0epzWeXmwAAAM0"]
[Tue May 19 18:15:14.777801 2026] [:error] [pid 29823:tid 29837] [client 20.226.97.125:47388] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/profile.php"] [unique_id "agw4MmO09C0nAz8vRk4xQgAAAcI"]
[Tue May 19 18:15:15.509979 2026] [:error] [pid 29622:tid 29632] [client 20.226.97.125:45239] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/profile.php"] [unique_id "agw4MzkOqPKWkPs_P15N0gAAAgg"]
[Tue May 19 18:15:16.330732 2026] [:error] [pid 29823:tid 29849] [client 20.226.97.125:46604] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/profile.php"] [unique_id "agw4NGO09C0nAz8vRk4xQwAAAco"]
[Tue May 19 18:15:17.078820 2026] [:error] [pid 29622:tid 29642] [client 20.226.97.125:47886] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "agw4NTkOqPKWkPs_P15N0wAAAhI"]
[Tue May 19 18:15:18.254038 2026] [:error] [pid 46815:tid 46832] [client 20.226.97.125:46625] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "agw4NiPnRhJOmA06LgpqdwAAAU8"]
[Tue May 19 18:15:19.026376 2026] [:error] [pid 29823:tid 29851] [client 20.226.97.125:46052] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "agw4N2O09C0nAz8vRk4xRQAAAcw"]
[Tue May 19 18:15:20.004708 2026] [:error] [pid 29823:tid 29859] [client 20.226.97.125:45219] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ws80.php"] [unique_id "agw4OGO09C0nAz8vRk4xRgAAAdQ"]
[Tue May 19 18:15:20.663144 2026] [:error] [pid 29622:tid 29636] [client 20.226.97.125:46587] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "agw4ODkOqPKWkPs_P15N1AAAAgw"]
[Tue May 19 18:15:21.316162 2026] [:error] [pid 46896:tid 46921] [client 20.226.97.125:47365] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "agw4OaCHyzL3Ci9LGE1c7QAAAZc"]
[Tue May 19 18:15:21.976486 2026] [:error] [pid 38699:tid 38751] [client 20.226.97.125:47383] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "agw4Ob--Adsw_P-dthaVkwAAAEk"]
[Tue May 19 18:15:22.793230 2026] [:error] [pid 55881:tid 55886] [client 20.226.97.125:46016] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a4.php"] [unique_id "agw4Ou-UExma0LUC7WD9JAAAAkM"]
[Tue May 19 18:15:23.538006 2026] [:error] [pid 29622:tid 29631] [client 20.226.97.125:46038] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "agw4OzkOqPKWkPs_P15N1wAAAgc"]
[Tue May 19 18:15:24.254512 2026] [:error] [pid 29622:tid 29624] [client 20.226.97.125:46653] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "agw4PDkOqPKWkPs_P15N2AAAAgA"]
[Tue May 19 18:15:24.892891 2026] [:error] [pid 29823:tid 29842] [client 20.226.97.125:47374] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "agw4PGO09C0nAz8vRk4xRwAAAcc"]
[Tue May 19 18:15:25.549291 2026] [:error] [pid 55881:tid 55893] [client 20.226.97.125:46058] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "agw4Pe-UExma0LUC7WD9KAAAAko"]
[Tue May 19 18:15:26.293825 2026] [:error] [pid 29823:tid 29862] [client 20.226.97.125:47829] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "agw4PmO09C0nAz8vRk4xSAAAAdc"]
[Tue May 19 18:15:27.046798 2026] [:error] [pid 55881:tid 55892] [client 20.226.97.125:47358] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "agw4P--UExma0LUC7WD9KgAAAkk"]
[Tue May 19 18:15:27.893900 2026] [:error] [pid 41573:tid 41576] [client 20.226.97.125:46599] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "agw4Py1A2bd6JDSW9RZ9GgAAAQE"]
[Tue May 19 18:15:28.691333 2026] [:error] [pid 41573:tid 41597] [client 20.226.97.125:47898] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "agw4QC1A2bd6JDSW9RZ9HAAAARY"]
[Tue May 19 18:15:29.382745 2026] [:error] [pid 41573:tid 41579] [client 20.226.97.125:47321] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "agw4QS1A2bd6JDSW9RZ9HQAAAQQ"]
[Tue May 19 18:15:30.377478 2026] [:error] [pid 38699:tid 38759] [client 20.226.97.125:46532] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "agw4Qr--Adsw_P-dthaVlgAAAFE"]
[Tue May 19 18:15:31.239852 2026] [:error] [pid 55881:tid 55884] [client 20.226.97.125:47405] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "agw4Q--UExma0LUC7WD9LwAAAkE"]
[Tue May 19 18:15:31.899002 2026] [:error] [pid 38705:tid 38784] [client 20.226.97.125:46107] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/core.php"] [unique_id "agw4Q8g5dNOZ5umN9ltbUAAAAI8"]
[Tue May 19 18:15:32.856823 2026] [:error] [pid 41573:tid 41594] [client 20.226.97.125:46134] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "agw4RC1A2bd6JDSW9RZ9IgAAARM"]
[Tue May 19 18:15:34.005495 2026] [:error] [pid 41573:tid 41575] [client 20.226.97.125:47932] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "agw4Ri1A2bd6JDSW9RZ9JAAAAQA"]
[Tue May 19 18:15:35.309277 2026] [:error] [pid 46815:tid 46817] [client 20.226.97.125:48593] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "agw4RyPnRhJOmA06LgpqeQAAAUA"]
[Tue May 19 18:15:35.996862 2026] [:error] [pid 41573:tid 41598] [client 20.226.97.125:47884] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lock360.php"] [unique_id "agw4Ry1A2bd6JDSW9RZ9JgAAARc"]
[Tue May 19 18:15:36.700892 2026] [:error] [pid 55881:tid 55905] [client 20.226.97.125:48601] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bc.php"] [unique_id "agw4SO-UExma0LUC7WD9MgAAAlY"]
[Tue May 19 18:15:37.326019 2026] [:error] [pid 41573:tid 41595] [client 20.226.97.125:46098] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bc.php"] [unique_id "agw4SS1A2bd6JDSW9RZ9KAAAARQ"]
[Tue May 19 18:15:38.049501 2026] [:error] [pid 55881:tid 55893] [client 20.226.97.125:47353] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bc.php"] [unique_id "agw4Su-UExma0LUC7WD9MwAAAko"]
[Tue May 19 18:15:38.969745 2026] [:error] [pid 46815:tid 46824] [client 20.226.97.125:48674] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bc.php"] [unique_id "agw4SiPnRhJOmA06LgpqewAAAUc"]
[Tue May 19 18:15:39.634797 2026] [:error] [pid 38814:tid 38818] [client 20.226.97.125:46654] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "agw4SwvkKuBwP0epzWeXngAAAMI"]
[Tue May 19 18:15:40.374323 2026] [:error] [pid 29622:tid 29647] [client 20.226.97.125:47326] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "agw4TDkOqPKWkPs_P15N2wAAAhc"]
[Tue May 19 18:15:41.181462 2026] [:error] [pid 41573:tid 41596] [client 20.226.97.125:46551] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "agw4TS1A2bd6JDSW9RZ9KQAAARU"]
[Tue May 19 18:15:41.803889 2026] [:error] [pid 38699:tid 38744] [client 20.226.97.125:47911] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "agw4Tb--Adsw_P-dthaVmAAAAEI"]
[Tue May 19 18:15:42.445793 2026] [:error] [pid 41573:tid 41578] [client 20.226.97.125:46627] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp1.php"] [unique_id "agw4Ti1A2bd6JDSW9RZ9KwAAAQM"]
[Tue May 19 18:15:43.169102 2026] [:error] [pid 41573:tid 41580] [client 20.226.97.125:47894] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp1.php"] [unique_id "agw4Ty1A2bd6JDSW9RZ9LQAAAQU"]
[Tue May 19 18:15:43.888712 2026] [:error] [pid 41573:tid 41589] [client 20.226.97.125:46114] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp1.php"] [unique_id "agw4Ty1A2bd6JDSW9RZ9LwAAAQ4"]
[Tue May 19 18:15:44.544700 2026] [:error] [pid 38699:tid 38753] [client 20.226.97.125:46594] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp1.php"] [unique_id "agw4UL--Adsw_P-dthaVmgAAAEs"]
[Tue May 19 18:15:45.611643 2026] [:error] [pid 38699:tid 38760] [client 20.226.97.125:47330] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file6.php"] [unique_id "agw4Ub--Adsw_P-dthaVmwAAAFI"]
[Tue May 19 18:15:46.731322 2026] [:error] [pid 46896:tid 46914] [client 20.226.97.125:47391] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file6.php"] [unique_id "agw4UqCHyzL3Ci9LGE1c8wAAAZA"]
[Tue May 19 18:15:47.442230 2026] [:error] [pid 38699:tid 38748] [client 20.226.97.125:48658] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file6.php"] [unique_id "agw4U7--Adsw_P-dthaVngAAAEY"]
[Tue May 19 18:15:48.101393 2026] [:error] [pid 38699:tid 38765] [client 20.226.97.125:48668] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file6.php"] [unique_id "agw4VL--Adsw_P-dthaVpAAAAFc"]
[Tue May 19 18:15:48.724699 2026] [:error] [pid 46815:tid 46830] [client 20.226.97.125:47402] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xs.php"] [unique_id "agw4VCPnRhJOmA06LgpqfgAAAU0"]
[Tue May 19 18:15:49.902477 2026] [:error] [pid 46815:tid 46827] [client 20.226.97.125:47831] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xs.php"] [unique_id "agw4VSPnRhJOmA06LgpqfwAAAUo"]
[Tue May 19 18:15:50.796750 2026] [:error] [pid 38699:tid 38744] [client 20.226.97.125:46099] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xs.php"] [unique_id "agw4Vr--Adsw_P-dthaVsAAAAEI"]
[Tue May 19 18:15:51.521734 2026] [:error] [pid 46815:tid 46840] [client 20.226.97.125:47813] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xs.php"] [unique_id "agw4VyPnRhJOmA06LgpqggAAAVc"]
[Tue May 19 18:15:52.225065 2026] [:error] [pid 55881:tid 55907] [client 20.226.97.125:46600] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxa.php"] [unique_id "agw4WO-UExma0LUC7WD9NwAAAlg"]
[Tue May 19 18:15:53.611750 2026] [:error] [pid 55881:tid 55904] [client 20.226.97.125:46562] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxa.php"] [unique_id "agw4We-UExma0LUC7WD9OAAAAlU"]
[Tue May 19 18:15:54.373142 2026] [:error] [pid 38699:tid 38762] [client 20.226.97.125:46578] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxa.php"] [unique_id "agw4Wr--Adsw_P-dthaVswAAAFQ"]
[Tue May 19 18:15:55.015085 2026] [:error] [pid 29823:tid 29860] [client 20.226.97.125:46094] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxa.php"] [unique_id "agw4W2O09C0nAz8vRk4xSQAAAdU"]
[Tue May 19 18:15:56.116036 2026] [:error] [pid 55881:tid 55895] [client 20.226.97.125:48597] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index0.php"] [unique_id "agw4XO-UExma0LUC7WD9OQAAAkw"]
[Tue May 19 18:15:56.786974 2026] [:error] [pid 38699:tid 38761] [client 20.226.97.125:46582] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index0.php"] [unique_id "agw4XL--Adsw_P-dthaVtAAAAFM"]
[Tue May 19 18:15:57.488566 2026] [:error] [pid 38699:tid 38751] [client 20.226.97.125:47313] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index0.php"] [unique_id "agw4Xb--Adsw_P-dthaVtQAAAEk"]
[Tue May 19 18:15:58.550521 2026] [:error] [pid 38699:tid 38747] [client 20.226.97.125:48653] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/index0.php"] [unique_id "agw4Xr--Adsw_P-dthaVtwAAAEU"]
[Tue May 19 18:15:59.342872 2026] [:error] [pid 38699:tid 38763] [client 20.226.97.125:46095] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kz.php"] [unique_id "agw4X7--Adsw_P-dthaVuAAAAFU"]
[Tue May 19 18:16:01.203682 2026] [:error] [pid 38699:tid 38743] [client 20.226.97.125:46597] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kz.php"] [unique_id "agw4Yb--Adsw_P-dthaVugAAAEE"]
[Tue May 19 18:16:02.202197 2026] [:error] [pid 46815:tid 46820] [client 20.226.97.125:46631] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kz.php"] [unique_id "agw4YiPnRhJOmA06LgpqgwAAAUM"]
[Tue May 19 18:16:02.988970 2026] [:error] [pid 38699:tid 38750] [client 20.226.97.125:47322] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kz.php"] [unique_id "agw4Yr--Adsw_P-dthaVvAAAAEg"]
[Tue May 19 18:16:03.954200 2026] [:error] [pid 29622:tid 29626] [client 20.226.97.125:47399] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/19.php"] [unique_id "agw4YzkOqPKWkPs_P15N3AAAAgI"]
[Tue May 19 18:16:04.819830 2026] [:error] [pid 38699:tid 38752] [client 20.226.97.125:48582] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/19.php"] [unique_id "agw4ZL--Adsw_P-dthaVvQAAAEo"]
[Tue May 19 18:16:16.235732 2026] [:error] [pid 46815:tid 46823] [client 20.226.97.125:48671] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xltt.php"] [unique_id "agw4cCPnRhJOmA06LgpqlwAAAUY"]
[Tue May 19 18:16:17.112587 2026] [:error] [pid 38814:tid 38817] [client 20.226.97.125:49183] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xltt.php"] [unique_id "agw4cQvkKuBwP0epzWeXogAAAME"]
[Tue May 19 18:16:17.917808 2026] [:error] [pid 46815:tid 46834] [client 20.226.97.125:46647] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xltt.php"] [unique_id "agw4cSPnRhJOmA06LgpqmQAAAVE"]
[Tue May 19 18:16:18.665865 2026] [:error] [pid 46896:tid 46908] [client 20.226.97.125:47929] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xltt.php"] [unique_id "agw4cqCHyzL3Ci9LGE1c9AAAAYo"]
[Tue May 19 18:16:19.797880 2026] [:error] [pid 46896:tid 46901] [client 20.226.97.125:44472] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/son.php"] [unique_id "agw4c6CHyzL3Ci9LGE1c9QAAAYM"]
[Tue May 19 18:16:21.536359 2026] [:error] [pid 38699:tid 38747] [client 20.226.97.125:46615] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/son.php"] [unique_id "agw4db--Adsw_P-dthaV1wAAAEU"]
[Tue May 19 18:16:22.558115 2026] [:error] [pid 38699:tid 38757] [client 20.226.97.125:48655] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/son.php"] [unique_id "agw4dr--Adsw_P-dthaV2AAAAE8"]
[Tue May 19 18:16:23.340324 2026] [:error] [pid 46815:tid 46832] [client 20.226.97.125:46628] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/son.php"] [unique_id "agw4dyPnRhJOmA06LgpqtwAAAU8"]
[Tue May 19 18:16:24.204281 2026] [:error] [pid 38697:tid 38723] [client 20.226.97.125:47840] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "agw4eKXP9pP6Kgt-msRBTQAAAAg"]
[Tue May 19 18:16:25.002952 2026] [:error] [pid 46815:tid 46829] [client 20.226.97.125:47902] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "agw4eSPnRhJOmA06LgpquAAAAUw"]
[Tue May 19 18:16:26.348573 2026] [:error] [pid 38699:tid 38755] [client 20.226.97.125:47315] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "agw4er--Adsw_P-dthaV2QAAAE0"]
[Tue May 19 18:16:27.215409 2026] [:error] [pid 38697:tid 38718] [client 20.226.97.125:47856] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/doc.php"] [unique_id "agw4e6XP9pP6Kgt-msRBTwAAAAM"]
[Tue May 19 18:16:28.579413 2026] [:error] [pid 46815:tid 46824] [client 20.226.97.125:48623] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zo.php"] [unique_id "agw4fCPnRhJOmA06LgpqugAAAUc"]
[Tue May 19 18:16:29.308509 2026] [:error] [pid 41573:tid 41588] [client 20.226.97.125:48644] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zo.php"] [unique_id "agw4fS1A2bd6JDSW9RZ9MQAAAQ0"]
[Tue May 19 18:16:30.508638 2026] [:error] [pid 38814:tid 38830] [client 20.226.97.125:47329] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zo.php"] [unique_id "agw4fgvkKuBwP0epzWeXzwAAAM4"]
[Tue May 19 18:16:32.818396 2026] [:error] [pid 41573:tid 41591] [client 20.226.97.125:47373] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zo.php"] [unique_id "agw4gC1A2bd6JDSW9RZ9NAAAARA"]
[Tue May 19 18:16:34.497853 2026] [:error] [pid 38699:tid 38750] [client 20.226.97.125:47336] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xper1.php"] [unique_id "agw4gr--Adsw_P-dthaV2gAAAEg"]
[Tue May 19 18:16:36.785718 2026] [:error] [pid 29823:tid 29840] [client 20.226.97.125:49113] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xper1.php"] [unique_id "agw4hGO09C0nAz8vRk4xYAAAAcU"]
[Tue May 19 18:16:38.939398 2026] [:error] [pid 55881:tid 55884] [client 20.226.97.125:49184] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xper1.php"] [unique_id "agw4hu-UExma0LUC7WD9YQAAAkE"]
[Tue May 19 18:16:39.617261 2026] [:error] [pid 55881:tid 55886] [client 20.226.97.125:47812] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xper1.php"] [unique_id "agw4h--UExma0LUC7WD9YgAAAkM"]
[Tue May 19 18:16:40.643803 2026] [:error] [pid 55881:tid 55894] [client 20.226.97.125:47859] [client 20.226.97.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "agw4iO-UExma0LUC7WD9YwAAAks"]
[Tue May 19 18:16:41.734789 2026] [:error] [pid 55881:tid 55883] [client 20.226.97.125:48590] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s1.php"] [unique_id "agw4ie-UExma0LUC7WD9ZAAAAkA"]
[Tue May 19 18:16:42.666192 2026] [:error] [pid 46896:tid 46918] [client 20.226.97.125:47870] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s1.php"] [unique_id "agw4iqCHyzL3Ci9LGE1c-AAAAZQ"]
[Tue May 19 18:16:43.770568 2026] [:error] [pid 41573:tid 41597] [client 20.226.97.125:48676] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s1.php"] [unique_id "agw4iy1A2bd6JDSW9RZ9PAAAARY"]
[Tue May 19 18:16:44.438753 2026] [:error] [pid 41573:tid 41599] [client 20.226.97.125:46131] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/s1.php"] [unique_id "agw4jC1A2bd6JDSW9RZ9PwAAARg"]
[Tue May 19 18:16:45.259460 2026] [:error] [pid 46815:tid 46832] [client 20.226.97.125:46638] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/de.php"] [unique_id "agw4jSPnRhJOmA06LgprOwAAAU8"]
[Tue May 19 18:16:46.037888 2026] [:error] [pid 38699:tid 38749] [client 20.226.97.125:48651] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/de.php"] [unique_id "agw4jr--Adsw_P-dthaV3wAAAEc"]
[Tue May 19 18:16:46.716095 2026] [:error] [pid 38697:tid 38722] [client 20.226.97.125:49167] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/de.php"] [unique_id "agw4jqXP9pP6Kgt-msRBVAAAAAc"]
[Tue May 19 18:16:47.359097 2026] [:error] [pid 38697:tid 38728] [client 20.226.97.125:49148] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/de.php"] [unique_id "agw4j6XP9pP6Kgt-msRBVwAAAA0"]
[Tue May 19 18:16:47.989643 2026] [:error] [pid 38697:tid 38719] [client 20.226.97.125:46624] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1a.php"] [unique_id "agw4j6XP9pP6Kgt-msRBWQAAAAQ"]
[Tue May 19 18:16:48.690694 2026] [:error] [pid 38697:tid 38720] [client 20.226.97.125:47360] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1a.php"] [unique_id "agw4kKXP9pP6Kgt-msRBWgAAAAU"]
[Tue May 19 18:16:49.340871 2026] [:error] [pid 38814:tid 38819] [client 20.226.97.125:48645] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1a.php"] [unique_id "agw4kQvkKuBwP0epzWeX1AAAAMM"]
[Tue May 19 18:16:49.972538 2026] [:error] [pid 29622:tid 29638] [client 20.226.97.125:49181] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1a.php"] [unique_id "agw4kTkOqPKWkPs_P15N6gAAAg4"]
[Tue May 19 18:16:50.678407 2026] [:error] [pid 38697:tid 38730] [client 20.226.97.125:47379] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "agw4kqXP9pP6Kgt-msRBXAAAAA8"]
[Tue May 19 18:16:51.391109 2026] [:error] [pid 41573:tid 41583] [client 20.226.97.125:48700] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "agw4ky1A2bd6JDSW9RZ9QQAAAQg"]
[Tue May 19 18:16:52.043023 2026] [:error] [pid 38814:tid 38824] [client 20.226.97.125:49147] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "agw4lAvkKuBwP0epzWeX1QAAAMg"]
[Tue May 19 18:16:52.785110 2026] [:error] [pid 46815:tid 46820] [client 20.226.97.125:48696] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2.php"] [unique_id "agw4lCPnRhJOmA06LgprRQAAAUM"]
[Tue May 19 18:16:53.878333 2026] [:error] [pid 46896:tid 46905] [client 20.226.97.125:48592] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "agw4laCHyzL3Ci9LGE1c-gAAAYc"]
[Tue May 19 18:16:54.614170 2026] [:error] [pid 55881:tid 55895] [client 20.226.97.125:44453] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "agw4lu-UExma0LUC7WD9ZwAAAkw"]
[Tue May 19 18:16:55.231614 2026] [:error] [pid 46896:tid 46904] [client 20.226.97.125:47905] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "agw4l6CHyzL3Ci9LGE1c-wAAAYY"]
[Tue May 19 18:16:55.944412 2026] [:error] [pid 38697:tid 38733] [client 20.226.97.125:47896] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "agw4l6XP9pP6Kgt-msRBXwAAABI"]
[Tue May 19 18:16:56.609281 2026] [:error] [pid 38697:tid 38735] [client 20.226.97.125:49088] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sky.php"] [unique_id "agw4mKXP9pP6Kgt-msRBYAAAABQ"]
[Tue May 19 18:16:57.429709 2026] [:error] [pid 55881:tid 55900] [client 20.226.97.125:47838] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sky.php"] [unique_id "agw4me-UExma0LUC7WD9aAAAAlE"]
[Tue May 19 18:16:58.229180 2026] [:error] [pid 55881:tid 55888] [client 20.226.97.125:48698] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sky.php"] [unique_id "agw4mu-UExma0LUC7WD9agAAAkU"]
[Tue May 19 18:16:58.884525 2026] [:error] [pid 38814:tid 38821] [client 20.226.97.125:49903] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sky.php"] [unique_id "agw4mgvkKuBwP0epzWeX1wAAAMU"]
[Tue May 19 18:16:59.556916 2026] [:error] [pid 41573:tid 41594] [client 20.226.97.125:47372] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/man.php"] [unique_id "agw4my1A2bd6JDSW9RZ9RAAAARM"]
[Tue May 19 18:17:00.359158 2026] [:error] [pid 55881:tid 55889] [client 20.226.97.125:47917] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/man.php"] [unique_id "agw4nO-UExma0LUC7WD9awAAAkY"]
[Tue May 19 18:17:01.122837 2026] [:error] [pid 38699:tid 38747] [client 20.226.97.125:46579] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/man.php"] [unique_id "agw4nb--Adsw_P-dthaV4QAAAEU"]
[Tue May 19 18:17:01.807523 2026] [:error] [pid 38699:tid 38743] [client 20.226.97.125:48611] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/man.php"] [unique_id "agw4nb--Adsw_P-dthaV4gAAAEE"]
[Tue May 19 18:17:02.456793 2026] [:error] [pid 41573:tid 41587] [client 20.226.97.125:47376] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "agw4ni1A2bd6JDSW9RZ9RQAAAQw"]
[Tue May 19 18:17:03.126312 2026] [:error] [pid 41573:tid 41575] [client 20.226.97.125:46078] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "agw4ny1A2bd6JDSW9RZ9RgAAAQA"]
[Tue May 19 18:17:03.752592 2026] [:error] [pid 55881:tid 55896] [client 20.226.97.125:26857] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "agw4n--UExma0LUC7WD9bAAAAk0"]
[Tue May 19 18:17:04.389969 2026] [:error] [pid 38699:tid 38746] [client 20.226.97.125:49095] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ms-edit.php"] [unique_id "agw4oL--Adsw_P-dthaV4wAAAEQ"]
[Tue May 19 18:17:05.133871 2026] [:error] [pid 41573:tid 41582] [client 20.226.97.125:49858] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "agw4oS1A2bd6JDSW9RZ9RwAAAQc"]
[Tue May 19 18:17:05.837420 2026] [:error] [pid 38699:tid 38750] [client 20.226.97.125:49122] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "agw4ob--Adsw_P-dthaV5gAAAEg"]
[Tue May 19 18:17:06.539851 2026] [:error] [pid 41573:tid 41598] [client 20.226.97.125:48587] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "agw4oi1A2bd6JDSW9RZ9SQAAARc"]
[Tue May 19 18:17:07.303517 2026] [:error] [pid 38697:tid 38719] [client 20.226.97.125:47361] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "agw4o6XP9pP6Kgt-msRBYgAAAAQ"]
[Tue May 19 18:17:08.342359 2026] [:error] [pid 38697:tid 38723] [client 20.226.97.125:46550] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "agw4pKXP9pP6Kgt-msRBYwAAAAg"]
[Tue May 19 18:17:09.012540 2026] [:error] [pid 38697:tid 38730] [client 20.226.97.125:44473] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "agw4paXP9pP6Kgt-msRBZgAAAA8"]
[Tue May 19 18:17:09.655892 2026] [:error] [pid 46815:tid 46829] [client 20.226.97.125:49124] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "agw4pSPnRhJOmA06LgprRgAAAUw"]
[Tue May 19 18:17:10.277907 2026] [:error] [pid 46815:tid 46830] [client 20.226.97.125:49954] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "agw4piPnRhJOmA06LgprSAAAAU0"]
[Tue May 19 18:17:11.228791 2026] [:error] [pid 38699:tid 38759] [client 20.226.97.125:47933] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "agw4p7--Adsw_P-dthaV6AAAAFE"]
[Tue May 19 18:17:11.855056 2026] [:error] [pid 38814:tid 38820] [client 20.226.97.125:47842] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mar.php"] [unique_id "agw4pwvkKuBwP0epzWeX2QAAAMQ"]
[Tue May 19 18:17:26.709769 2026] [:error] [pid 55881:tid 55907] [client 20.226.97.125:47397] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "agw4tu-UExma0LUC7WD9eQAAAlg"]
[Tue May 19 18:17:27.677642 2026] [:error] [pid 38699:tid 38746] [client 20.226.97.125:47417] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "agw4t7--Adsw_P-dthaV8gAAAEQ"]
[Tue May 19 18:17:28.327903 2026] [:error] [pid 38699:tid 38757] [client 20.226.97.125:48680] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "agw4uL--Adsw_P-dthaV8wAAAE8"]
[Tue May 19 18:17:28.950445 2026] [:error] [pid 29622:tid 29634] [client 20.226.97.125:50541] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "agw4uDkOqPKWkPs_P15N7gAAAgo"]
[Tue May 19 18:17:29.647577 2026] [:error] [pid 38814:tid 38837] [client 20.226.97.125:49097] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/options.php"] [unique_id "agw4uQvkKuBwP0epzWeX2wAAANU"]
[Tue May 19 18:17:30.440208 2026] [:error] [pid 38699:tid 38760] [client 20.226.97.125:49856] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/options.php"] [unique_id "agw4ur--Adsw_P-dthaV9gAAAFI"]
[Tue May 19 18:17:31.770591 2026] [:error] [pid 29823:tid 29862] [client 20.226.97.125:49931] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/options.php"] [unique_id "agw4u2O09C0nAz8vRk4xZwAAAdc"]
[Tue May 19 18:17:32.950294 2026] [:error] [pid 38814:tid 38826] [client 20.226.97.125:37196] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/options.php"] [unique_id "agw4vAvkKuBwP0epzWeX3gAAAMo"]
[Tue May 19 18:17:34.128289 2026] [:error] [pid 46815:tid 46821] [client 20.226.97.125:50609] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f5.php"] [unique_id "agw4viPnRhJOmA06LgprSgAAAUQ"]
[Tue May 19 18:17:34.988851 2026] [:error] [pid 38697:tid 38718] [client 20.226.97.125:50563] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f5.php"] [unique_id "agw4vqXP9pP6Kgt-msRBZwAAAAM"]
[Tue May 19 18:17:36.272371 2026] [:error] [pid 55881:tid 55885] [client 20.226.97.125:49933] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f5.php"] [unique_id "agw4wO-UExma0LUC7WD9fAAAAkI"]
[Tue May 19 18:17:38.353185 2026] [:error] [pid 46815:tid 46817] [client 20.226.97.125:38438] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f5.php"] [unique_id "agw4wiPnRhJOmA06LgprTAAAAUA"]
[Tue May 19 18:17:39.150964 2026] [:error] [pid 38697:tid 38737] [client 20.226.97.125:49157] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "agw4w6XP9pP6Kgt-msRBaQAAABY"]
[Tue May 19 18:17:39.841381 2026] [:error] [pid 29823:tid 29848] [client 20.226.97.125:50554] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "agw4w2O09C0nAz8vRk4xaQAAAck"]
[Tue May 19 18:17:40.800448 2026] [:error] [pid 46896:tid 46901] [client 20.226.97.125:49914] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "agw4xKCHyzL3Ci9LGE1dAQAAAYM"]
[Tue May 19 18:17:41.499595 2026] [:error] [pid 38814:tid 38818] [client 20.226.97.125:30586] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alpha.php"] [unique_id "agw4xQvkKuBwP0epzWeX4QAAAMI"]
[Tue May 19 18:17:42.246747 2026] [:error] [pid 29823:tid 29836] [client 20.226.97.125:50575] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/son1.php"] [unique_id "agw4xmO09C0nAz8vRk4xagAAAcE"]
[Tue May 19 18:17:42.967808 2026] [:error] [pid 55881:tid 55896] [client 20.226.97.125:30539] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/son1.php"] [unique_id "agw4xu-UExma0LUC7WD9fgAAAk0"]
[Tue May 19 18:17:43.732273 2026] [:error] [pid 46815:tid 46834] [client 20.226.97.125:32675] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/son1.php"] [unique_id "agw4xyPnRhJOmA06LgprUwAAAVE"]
[Tue May 19 18:17:44.640220 2026] [:error] [pid 38814:tid 38821] [client 20.226.97.125:50533] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/son1.php"] [unique_id "agw4yAvkKuBwP0epzWeX4wAAAMU"]
[Tue May 19 18:17:45.290976 2026] [:error] [pid 46896:tid 46898] [client 20.226.97.125:32288] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggb.php"] [unique_id "agw4yaCHyzL3Ci9LGE1dBQAAAYA"]
[Tue May 19 18:17:46.015865 2026] [:error] [pid 46896:tid 46904] [client 20.226.97.125:37228] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggb.php"] [unique_id "agw4yqCHyzL3Ci9LGE1dBgAAAYY"]
[Tue May 19 18:17:46.686194 2026] [:error] [pid 46896:tid 46921] [client 20.226.97.125:49163] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggb.php"] [unique_id "agw4yqCHyzL3Ci9LGE1dBwAAAZc"]
[Tue May 19 18:17:47.805334 2026] [:error] [pid 46896:tid 46900] [client 20.226.97.125:32274] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ggb.php"] [unique_id "agw4y6CHyzL3Ci9LGE1dCgAAAYI"]
[Tue May 19 18:17:48.708035 2026] [:error] [pid 29823:tid 29858] [client 20.226.97.125:50570] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amxloxxr.php"] [unique_id "agw4zGO09C0nAz8vRk4xbAAAAdM"]
[Tue May 19 18:17:49.379053 2026] [:error] [pid 46896:tid 46911] [client 20.226.97.125:32279] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amxloxxr.php"] [unique_id "agw4zaCHyzL3Ci9LGE1dCwAAAY0"]
[Tue May 19 18:17:50.193789 2026] [:error] [pid 46896:tid 46916] [client 20.226.97.125:28544] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amxloxxr.php"] [unique_id "agw4zqCHyzL3Ci9LGE1dDAAAAZI"]
[Tue May 19 18:17:51.197187 2026] [:error] [pid 29823:tid 29853] [client 20.226.97.125:28603] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/amxloxxr.php"] [unique_id "agw4z2O09C0nAz8vRk4xbQAAAc4"]
[Tue May 19 18:17:52.442108 2026] [:error] [pid 46896:tid 46922] [client 20.226.97.125:49089] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "agw40KCHyzL3Ci9LGE1dDQAAAZg"]
[Tue May 19 18:17:53.241034 2026] [:error] [pid 38705:tid 38779] [client 20.226.97.125:38421] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "agw40cg5dNOZ5umN9ltbcwAAAIo"]
[Tue May 19 18:17:54.305175 2026] [:error] [pid 38697:tid 38735] [client 20.226.97.125:28270] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "agw40qXP9pP6Kgt-msRBbAAAABQ"]
[Tue May 19 18:17:55.303975 2026] [:error] [pid 46896:tid 46901] [client 20.226.97.125:32674] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "agw406CHyzL3Ci9LGE1dEAAAAYM"]
[Tue May 19 18:17:56.163678 2026] [:error] [pid 29622:tid 29642] [client 20.226.97.125:32662] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "agw41DkOqPKWkPs_P15N7wAAAhI"]
[Tue May 19 18:17:57.041125 2026] [:error] [pid 55881:tid 55886] [client 20.226.97.125:32293] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "agw41e-UExma0LUC7WD9hAAAAkM"]
[Tue May 19 18:17:58.420174 2026] [:error] [pid 55881:tid 55883] [client 20.226.97.125:28265] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "agw41u-UExma0LUC7WD9hQAAAkA"]
[Tue May 19 18:17:59.237953 2026] [:error] [pid 38814:tid 38832] [client 20.226.97.125:51087] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sadcut1.php"] [unique_id "agw41wvkKuBwP0epzWeX6wAAANA"]
[Tue May 19 18:18:00.440598 2026] [:error] [pid 38699:tid 38750] [client 20.226.97.125:32368] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "agw42L--Adsw_P-dthaV_AAAAEg"]
[Tue May 19 18:18:01.631446 2026] [:error] [pid 38699:tid 38766] [client 20.226.97.125:51016] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "agw42b--Adsw_P-dthaV_wAAAFg"]
[Tue May 19 18:18:02.669958 2026] [:error] [pid 38697:tid 38722] [client 20.226.97.125:28599] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "agw42qXP9pP6Kgt-msRBbQAAAAc"]
[Tue May 19 18:18:03.295665 2026] [:error] [pid 38814:tid 38836] [client 20.226.97.125:32343] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/rh.php"] [unique_id "agw42wvkKuBwP0epzWeX7QAAANQ"]
[Tue May 19 18:18:04.144348 2026] [:error] [pid 29823:tid 29839] [client 20.226.97.125:51117] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/99.php"] [unique_id "agw43GO09C0nAz8vRk4xcQAAAcQ"]
[Tue May 19 18:18:06.324005 2026] [:error] [pid 38705:tid 38777] [client 20.226.97.125:51135] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/99.php"] [unique_id "agw43sg5dNOZ5umN9ltbdAAAAIg"]
[Tue May 19 18:18:07.055417 2026] [:error] [pid 46896:tid 46909] [client 20.226.97.125:33904] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/99.php"] [unique_id "agw436CHyzL3Ci9LGE1dEQAAAYs"]
[Tue May 19 18:18:07.859535 2026] [:error] [pid 38705:tid 38771] [client 20.226.97.125:51031] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/99.php"] [unique_id "agw438g5dNOZ5umN9ltbdQAAAII"]
[Tue May 19 18:18:08.500669 2026] [:error] [pid 29823:tid 29838] [client 20.226.97.125:27312] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/layout.php"] [unique_id "agw44GO09C0nAz8vRk4xcwAAAcM"]
[Tue May 19 18:18:09.305931 2026] [:error] [pid 46896:tid 46906] [client 20.226.97.125:51026] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/layout.php"] [unique_id "agw44aCHyzL3Ci9LGE1dEgAAAYg"]
[Tue May 19 18:18:10.039036 2026] [:error] [pid 29823:tid 29863] [client 20.226.97.125:33000] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/layout.php"] [unique_id "agw44mO09C0nAz8vRk4xdQAAAdg"]
[Tue May 19 18:18:10.780318 2026] [:error] [pid 46896:tid 46915] [client 20.226.97.125:27285] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/layout.php"] [unique_id "agw44qCHyzL3Ci9LGE1dFAAAAZE"]
[Tue May 19 18:18:11.736153 2026] [:error] [pid 46896:tid 46908] [client 20.226.97.125:33877] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "agw446CHyzL3Ci9LGE1dFgAAAYo"]
[Tue May 19 18:18:12.663110 2026] [:error] [pid 46896:tid 46905] [client 20.226.97.125:34533] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "agw45KCHyzL3Ci9LGE1dFwAAAYc"]
[Tue May 19 18:18:13.533920 2026] [:error] [pid 46896:tid 46904] [client 20.226.97.125:30924] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "agw45aCHyzL3Ci9LGE1dGAAAAYY"]
[Tue May 19 18:18:14.246661 2026] [:error] [pid 38705:tid 38788] [client 20.226.97.125:30914] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/12.php"] [unique_id "agw45sg5dNOZ5umN9ltbdgAAAJM"]
[Tue May 19 18:18:14.936081 2026] [:error] [pid 38705:tid 38792] [client 20.226.97.125:34502] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "agw45sg5dNOZ5umN9ltbdwAAAJc"]
[Tue May 19 18:18:15.824890 2026] [:error] [pid 38705:tid 38782] [client 20.226.97.125:27712] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "agw458g5dNOZ5umN9ltbeQAAAI0"]
[Tue May 19 18:18:16.454927 2026] [:error] [pid 38699:tid 38763] [client 20.226.97.125:27346] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "agw46L--Adsw_P-dthaWAAAAAFU"]
[Tue May 19 18:18:17.134310 2026] [:error] [pid 38814:tid 38822] [client 20.226.97.125:24205] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fs.php"] [unique_id "agw46QvkKuBwP0epzWeX8QAAAMY"]
[Tue May 19 18:18:17.766262 2026] [:error] [pid 38814:tid 38840] [client 20.226.97.125:32636] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "agw46QvkKuBwP0epzWeX8gAAANg"]
[Tue May 19 18:18:18.413640 2026] [:error] [pid 38705:tid 38784] [client 20.226.97.125:34498] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "agw46sg5dNOZ5umN9ltbewAAAI8"]
[Tue May 19 18:18:19.882628 2026] [:error] [pid 38699:tid 38764] [client 20.226.97.125:23931] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "agw467--Adsw_P-dthaWBQAAAFY"]
[Tue May 19 18:18:20.582898 2026] [:error] [pid 38814:tid 38837] [client 20.226.97.125:27387] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "agw47AvkKuBwP0epzWeX9AAAANU"]
[Tue May 19 18:18:21.458772 2026] [:error] [pid 46896:tid 46898] [client 20.226.97.125:33889] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Ov-Simple1.php"] [unique_id "agw47aCHyzL3Ci9LGE1dGgAAAYA"]
[Tue May 19 18:18:22.092526 2026] [:error] [pid 38699:tid 38746] [client 20.226.97.125:27756] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Ov-Simple1.php"] [unique_id "agw47r--Adsw_P-dthaWBgAAAEQ"]
[Tue May 19 18:18:22.795891 2026] [:error] [pid 38697:tid 38721] [client 20.226.97.125:34518] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Ov-Simple1.php"] [unique_id "agw47qXP9pP6Kgt-msRBcQAAAAY"]
[Tue May 19 18:18:23.519620 2026] [:error] [pid 38697:tid 38737] [client 20.226.97.125:30899] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Ov-Simple1.php"] [unique_id "agw476XP9pP6Kgt-msRBdAAAABY"]
[Tue May 19 18:18:24.384523 2026] [:error] [pid 38697:tid 38715] [client 20.226.97.125:30203] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "agw48KXP9pP6Kgt-msRBdgAAAAA"]
[Tue May 19 18:18:37.294216 2026] [:error] [pid 38697:tid 38722] [client 20.226.97.125:30161] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mah.php"] [unique_id "agw4_aXP9pP6Kgt-msRBiQAAAAc"]
[Tue May 19 18:18:38.023750 2026] [:error] [pid 38697:tid 38738] [client 20.226.97.125:35670] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mah.php"] [unique_id "agw4_qXP9pP6Kgt-msRBigAAABc"]
[Tue May 19 18:18:39.146291 2026] [:error] [pid 38699:tid 38765] [client 20.226.97.125:29737] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mah.php"] [unique_id "agw4_7--Adsw_P-dthaWFQAAAFc"]
[Tue May 19 18:18:39.871389 2026] [:error] [pid 46815:tid 46820] [client 20.226.97.125:30523] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mah.php"] [unique_id "agw4_yPnRhJOmA06LgprXgAAAUM"]
[Tue May 19 18:18:40.544429 2026] [:error] [pid 38697:tid 38726] [client 20.226.97.125:23449] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins.php"] [unique_id "agw5AKXP9pP6Kgt-msRBjQAAAAs"]
[Tue May 19 18:18:41.180619 2026] [:error] [pid 41573:tid 41597] [client 20.226.97.125:33536] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins.php"] [unique_id "agw5AS1A2bd6JDSW9RZ9VwAAARY"]
[Tue May 19 18:18:42.046786 2026] [:error] [pid 38814:tid 38833] [client 20.226.97.125:30509] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins.php"] [unique_id "agw5AgvkKuBwP0epzWeYAwAAANE"]
[Tue May 19 18:18:43.162686 2026] [:error] [pid 41573:tid 41583] [client 20.226.97.125:29750] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/plugins.php"] [unique_id "agw5Ay1A2bd6JDSW9RZ9XQAAAQg"]
[Tue May 19 18:18:44.039446 2026] [:error] [pid 41573:tid 41582] [client 20.226.97.125:23471] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "agw5BC1A2bd6JDSW9RZ9YgAAAQc"]
[Tue May 19 18:18:45.235538 2026] [:error] [pid 41573:tid 41586] [client 20.226.97.125:46579] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "agw5BS1A2bd6JDSW9RZ9ZwAAAQs"]
[Tue May 19 18:18:45.896829 2026] [:error] [pid 41573:tid 41585] [client 20.226.97.125:29323] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "agw5BS1A2bd6JDSW9RZ9aQAAAQo"]
[Tue May 19 18:18:46.583586 2026] [:error] [pid 38697:tid 38715] [client 20.226.97.125:23454] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "agw5BqXP9pP6Kgt-msRBlwAAAAA"]
[Tue May 19 18:18:47.219069 2026] [:error] [pid 38705:tid 38770] [client 20.226.97.125:35656] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "agw5B8g5dNOZ5umN9ltbfQAAAIE"]
[Tue May 19 18:18:48.992347 2026] [:error] [pid 46815:tid 46831] [client 20.226.97.125:30476] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "agw5CCPnRhJOmA06LgpraQAAAU4"]
[Tue May 19 18:18:49.705065 2026] [:error] [pid 38705:tid 38781] [client 20.226.97.125:30889] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "agw5Ccg5dNOZ5umN9ltbfgAAAIw"]
[Tue May 19 18:18:50.599798 2026] [:error] [pid 38705:tid 38774] [client 20.226.97.125:30131] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a.php"] [unique_id "agw5Csg5dNOZ5umN9ltbfwAAAIU"]
[Tue May 19 18:18:51.281231 2026] [:error] [pid 46896:tid 46915] [client 20.226.97.125:30497] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "agw5C6CHyzL3Ci9LGE1dIgAAAZE"]
[Tue May 19 18:18:51.950109 2026] [:error] [pid 41573:tid 41578] [client 20.226.97.125:29728] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "agw5Cy1A2bd6JDSW9RZ9fAAAAQM"]
[Tue May 19 18:18:52.583027 2026] [:error] [pid 29823:tid 29835] [client 20.226.97.125:29384] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "agw5DGO09C0nAz8vRk4xegAAAcA"]
[Tue May 19 18:18:53.389286 2026] [:error] [pid 46815:tid 46825] [client 20.226.97.125:30504] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/k.php"] [unique_id "agw5DSPnRhJOmA06LgprcQAAAUg"]
[Tue May 19 18:18:54.213976 2026] [:error] [pid 55881:tid 55890] [client 20.226.97.125:29795] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ini.php"] [unique_id "agw5Du-UExma0LUC7WD9jgAAAkc"]
[Tue May 19 18:18:55.647616 2026] [:error] [pid 46815:tid 46837] [client 20.226.97.125:29745] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ini.php"] [unique_id "agw5DyPnRhJOmA06LgprcgAAAVQ"]
[Tue May 19 18:18:57.261910 2026] [:error] [pid 29823:tid 29841] [client 20.226.97.125:52203] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ini.php"] [unique_id "agw5EWO09C0nAz8vRk4xewAAAcY"]
[Tue May 19 18:18:58.469132 2026] [:error] [pid 38814:tid 38839] [client 20.226.97.125:52240] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ini.php"] [unique_id "agw5EgvkKuBwP0epzWeYEwAAANc"]
[Tue May 19 18:18:59.676797 2026] [:error] [pid 29622:tid 29646] [client 20.226.97.125:52261] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ca4.php"] [unique_id "agw5EzkOqPKWkPs_P15N8gAAAhY"]
[Tue May 19 18:19:00.926203 2026] [:error] [pid 38697:tid 38737] [client 20.226.97.125:34752] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ca4.php"] [unique_id "agw5FKXP9pP6Kgt-msRBnQAAABY"]
[Tue May 19 18:19:02.122172 2026] [:error] [pid 38699:tid 38754] [client 20.226.97.125:23768] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ca4.php"] [unique_id "agw5Fr--Adsw_P-dthaWGwAAAEw"]
[Tue May 19 18:19:02.926552 2026] [:error] [pid 41573:tid 41578] [client 20.226.97.125:34812] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ca4.php"] [unique_id "agw5Fi1A2bd6JDSW9RZ9hQAAAQM"]
[Tue May 19 18:19:03.927800 2026] [:error] [pid 41573:tid 41590] [client 20.226.97.125:30125] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/index.php"] [unique_id "agw5Fy1A2bd6JDSW9RZ9hwAAAQ8"]
[Tue May 19 18:19:04.886635 2026] [:error] [pid 41573:tid 41576] [client 20.226.97.125:34811] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/index.php"] [unique_id "agw5GC1A2bd6JDSW9RZ9igAAAQE"]
[Tue May 19 18:19:05.663485 2026] [:error] [pid 41573:tid 41575] [client 20.226.97.125:29434] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/index.php"] [unique_id "agw5GS1A2bd6JDSW9RZ9iwAAAQA"]
[Tue May 19 18:19:06.642134 2026] [:error] [pid 38697:tid 38719] [client 20.226.97.125:34790] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/includes/index.php"] [unique_id "agw5GqXP9pP6Kgt-msRBxAAAAAQ"]
[Tue May 19 18:19:07.479847 2026] [:error] [pid 38699:tid 38743] [client 20.226.97.125:34802] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "agw5G7--Adsw_P-dthaWHgAAAEE"]
[Tue May 19 18:19:08.484687 2026] [:error] [pid 41573:tid 41586] [client 20.226.97.125:28844] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "agw5HC1A2bd6JDSW9RZ9jwAAAQs"]
[Tue May 19 18:19:09.364514 2026] [:error] [pid 41573:tid 41580] [client 20.226.97.125:34606] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "agw5HS1A2bd6JDSW9RZ9kgAAAQU"]
[Tue May 19 18:19:10.171324 2026] [:error] [pid 41573:tid 41585] [client 20.226.97.125:52286] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-info.php"] [unique_id "agw5Hi1A2bd6JDSW9RZ9lQAAAQo"]
[Tue May 19 18:19:11.305729 2026] [:error] [pid 38699:tid 38747] [client 20.226.97.125:28812] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/init.php"] [unique_id "agw5H7--Adsw_P-dthaWIgAAAEU"]
[Tue May 19 18:19:12.284213 2026] [:error] [pid 38699:tid 38752] [client 20.226.97.125:29419] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/init.php"] [unique_id "agw5IL--Adsw_P-dthaWJAAAAEo"]
[Tue May 19 18:19:13.598672 2026] [:error] [pid 41573:tid 41591] [client 20.226.97.125:34568] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/init.php"] [unique_id "agw5IS1A2bd6JDSW9RZ9nQAAARA"]
[Tue May 19 18:19:14.533895 2026] [:error] [pid 46815:tid 46836] [client 20.226.97.125:29425] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/init.php"] [unique_id "agw5IiPnRhJOmA06LgpreAAAAVM"]
[Tue May 19 18:19:15.804558 2026] [:error] [pid 41573:tid 41585] [client 20.226.97.125:27678] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "agw5Iy1A2bd6JDSW9RZ9ngAAAQo"]
[Tue May 19 18:19:16.541522 2026] [:error] [pid 46815:tid 46819] [client 20.226.97.125:29415] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "agw5JCPnRhJOmA06LgpreQAAAUI"]
[Tue May 19 18:19:18.123129 2026] [:error] [pid 46815:tid 46826] [client 20.226.97.125:34764] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "agw5JiPnRhJOmA06LgpregAAAUk"]
[Tue May 19 18:19:20.487853 2026] [:error] [pid 38699:tid 38746] [client 20.226.97.125:34601] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "agw5KL--Adsw_P-dthaWKwAAAEQ"]
[Tue May 19 18:19:24.037757 2026] [:error] [pid 55881:tid 55890] [client 20.226.97.125:28211] [client 20.226.97.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/fm.php"] [unique_id "agw5LO-UExma0LUC7WD9mgAAAkc"]
[Tue May 19 18:19:27.360317 2026] [:error] [pid 38814:tid 38834] [client 20.226.97.125:34264] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z.ph"] [unique_id "agw5LwvkKuBwP0epzWeYGgAAANI"]
[Tue May 19 18:19:29.475592 2026] [:error] [pid 29622:tid 29624] [client 20.226.97.125:38389] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z.ph"] [unique_id "agw5MTkOqPKWkPs_P15N9AAAAgA"]
[Tue May 19 18:19:30.178085 2026] [:error] [pid 41573:tid 41579] [client 20.226.97.125:52667] [client 20.226.97.125] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/z.ph"] [unique_id "agw5Mi1A2bd6JDSW9RZ9oAAAAQQ"]
[Tue May 19 19:07:31.375830 2026] [:error] [pid 38697:tid 38721] [client 40.74.77.197:5892] [client 40.74.77.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "agxEc6XP9pP6Kgt-msRHCAAAAAY"]
[Tue May 19 19:07:31.905775 2026] [:error] [pid 46815:tid 46821] [client 40.74.77.197:2612] [client 40.74.77.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "agxEcyPnRhJOmA06LgpuRgAAAUQ"]
[Tue May 19 19:07:32.416138 2026] [:error] [pid 55881:tid 55884] [client 40.74.77.197:4706] [client 40.74.77.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "agxEdO-UExma0LUC7WAASwAAAkE"]
[Tue May 19 19:07:33.096538 2026] [:error] [pid 41573:tid 41583] [client 40.74.77.197:5842] [client 40.74.77.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "agxEdS1A2bd6JDSW9RaDZQAAAQg"]
[Tue May 19 20:08:34.315112 2026] [:error] [pid 41573:tid 41578] [client 104.196.217.25:56910] [client 104.196.217.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.196.217.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agxSwi1A2bd6JDSW9RaMxAAAAQM"]
[Tue May 19 20:08:36.723423 2026] [:error] [pid 41573:tid 41583] [client 104.196.217.25:56910] [client 104.196.217.25] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "agxSxC1A2bd6JDSW9RaMywAAAQg"]
[Tue May 19 20:08:36.963431 2026] [:error] [pid 41573:tid 41593] [client 104.196.217.25:56910] [client 104.196.217.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.196.217.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agxSxC1A2bd6JDSW9RaMzQAAARI"]
[Tue May 19 20:08:38.644788 2026] [:error] [pid 29823:tid 29861] [client 104.196.217.25:50848] [client 104.196.217.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.196.217.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agxSxmO09C0nAz8vRk5CSgAAAdY"]
[Tue May 19 20:08:40.479149 2026] [:error] [pid 46815:tid 46831] [client 104.196.217.25:65370] [client 104.196.217.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.196.217.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agxSyCPnRhJOmA06Lgpy4AAAAU4"]
[Tue May 19 20:08:42.126664 2026] [:error] [pid 29823:tid 29851] [client 104.196.217.25:55052] [client 104.196.217.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.196.217.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agxSymO09C0nAz8vRk5CTgAAAcw"]
[Tue May 19 20:08:43.710415 2026] [:error] [pid 29823:tid 29841] [client 104.196.217.25:57770] [client 104.196.217.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.196.217.25, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agxSy2O09C0nAz8vRk5CUAAAAcY"]
[Tue May 19 20:08:43.710600 2026] [:error] [pid 29823:tid 29841] [client 104.196.217.25:57770] [client 104.196.217.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 104.196.217.25, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agxSy2O09C0nAz8vRk5CUAAAAcY"]
[Wed May 20 00:46:32.286785 2026] [:error] [pid 46815:tid 46840] [client 43.165.7.135:53568] [client 43.165.7.135] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agyT6CPnRhJOmA06LgqITwAAAVc"]
[Wed May 20 01:48:35.113402 2026] [:error] [pid 41573:tid 41587] [client 146.19.215.249:57918] [client 146.19.215.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/core.php"] [unique_id "agyicy1A2bd6JDSW9RbNKAAAAQw"]
[Wed May 20 02:28:58.577838 2026] [:error] [pid 29622:tid 29639] [client 43.130.72.40:52316] [client 43.130.72.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agyr6jkOqPKWkPs_P15gmQAAAg8"]
[Wed May 20 02:53:26.710634 2026] [:error] [pid 38699:tid 38748] [client 74.249.157.90:12360] [client 74.249.157.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "agyxpr--Adsw_P-dthbfFQAAAEY"]
[Wed May 20 02:53:27.487003 2026] [:error] [pid 38705:tid 38789] [client 74.249.157.90:5293] [client 74.249.157.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "agyxp8g5dNOZ5umN9ltz-QAAAJQ"]
[Wed May 20 02:53:28.264387 2026] [:error] [pid 29823:tid 29856] [client 74.249.157.90:5615] [client 74.249.157.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "agyxqGO09C0nAz8vRk57qgAAAdE"]
[Wed May 20 02:53:29.049162 2026] [:error] [pid 55881:tid 55907] [client 74.249.157.90:5607] [client 74.249.157.90] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "agyxqe-UExma0LUC7WAgWwAAAlg"]
[Wed May 20 04:26:24.944464 2026] [:error] [pid 36145:tid 36170] [client 1.12.70.96:53476] [client 1.12.70.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agzHcKtS18KtvF2Vagsp3gAAARY"]
[Wed May 20 04:43:10.739162 2026] [:error] [pid 36145:tid 36168] [client 194.62.107.53:56203] [client 194.62.107.53] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "agzLXqtS18KtvF2VagsumAAAARQ"]
[Wed May 20 05:13:49.305885 2026] [:error] [pid 59349:tid 59367] [client 43.152.72.247:53218] [client 43.152.72.247] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "agzSjTvvxTUy-ppKSZWFlwAAANA"]
[Wed May 20 05:28:14.417174 2026] [:error] [pid 36145:tid 36156] [client 217.174.152.96:39284] [client 217.174.152.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 217.174.152.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agzV7qtS18KtvF2Vags7MQAAAQg"]
[Wed May 20 05:28:46.363231 2026] [:error] [pid 57834:tid 57902] [client 85.17.244.83:48652] [client 85.17.244.83] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agzWDnTOfwZ09EhqoYD6-AAAAos"]
[Wed May 20 05:33:43.547723 2026] [:error] [pid 57742:tid 57745] [client 176.95.46.127:39668] [client 176.95.46.127] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.95.46.127, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "agzXN6Q_304u6rVT2w-jeQAAAUE"]
[Wed May 20 06:53:35.348661 2026] [:error] [pid 59244:tid 59263] [client 150.109.230.210:38760] [client 150.109.230.210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "agzp77xU0SdQQE7pLs3CfwAAAAo"]
[Wed May 20 06:57:33.039351 2026] [:error] [pid 59349:tid 59351] [client 4.240.1.229:1105] [client 4.240.1.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "agzq3TvvxTUy-ppKSZWe2AAAAMA"]
[Wed May 20 06:57:33.597466 2026] [:error] [pid 59245:tid 59293] [client 4.240.1.229:13854] [client 4.240.1.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "agzq3aOutR70QIZRVkTZPQAAAE0"]
[Wed May 20 06:57:34.198754 2026] [:error] [pid 59349:tid 59375] [client 4.240.1.229:1177] [client 4.240.1.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "agzq3jvvxTUy-ppKSZWe2gAAANg"]
[Wed May 20 06:57:34.783394 2026] [:error] [pid 59349:tid 59361] [client 4.240.1.229:2087] [client 4.240.1.229] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "agzq3jvvxTUy-ppKSZWe2wAAAMo"]
[Wed May 20 06:58:22.179558 2026] [autoindex:error] [pid 59349:tid 59371] [client 161.118.239.144:51439] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 20 06:58:22.466972 2026] [autoindex:error] [pid 59349:tid 59356] [client 161.118.239.144:51439] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed May 20 06:58:23.967390 2026] [:error] [pid 36145:tid 36165] [client 161.118.239.144:55460] [client 161.118.239.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.239.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agzrD6tS18KtvF2VagtHbQAAARE"]
[Wed May 20 06:58:24.258092 2026] [:error] [pid 57835:tid 57922] [client 161.118.239.144:53758] [client 161.118.239.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.118.239.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "agzrEGYoVRVVHvoOYbpHrwAAAsQ"]
[Wed May 20 08:57:48.302928 2026] [:error] [pid 44059:tid 44082] [client 181.166.192.131:60890] [client 181.166.192.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.166.192.131, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag0HDBfFs-oSOOcyjyxZHgAAARU"]
[Wed May 20 09:00:01.369899 2026] [:error] [pid 41364:tid 41382] [client 181.166.192.131:62499] [client 181.166.192.131] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ag0HkRKTmyvxtNXrN-hB9wAAAJA"]
[Wed May 20 09:00:37.158503 2026] [:error] [pid 41279:tid 41341] [client 181.166.192.131:62906] [client 181.166.192.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.166.192.131, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag0HtbEFyfaehGZbt4w-xwAAAMU"]
[Wed May 20 09:01:12.473697 2026] [:error] [pid 41277:tid 41286] [client 181.166.192.131:63275] [client 181.166.192.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.166.192.131, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag0H2LTTCltJmboB5ufB4AAAAAQ"]
[Wed May 20 09:01:48.633936 2026] [:error] [pid 44059:tid 44080] [client 181.166.192.131:63562] [client 181.166.192.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.166.192.131, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag0H_BfFs-oSOOcyjyxavgAAARM"]
[Wed May 20 09:02:18.400190 2026] [:error] [pid 41364:tid 41376] [client 181.166.192.131:51558] [client 181.166.192.131] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.166.192.131, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag0IGhKTmyvxtNXrN-hClwAAAIo"]
[Wed May 20 10:04:05.485226 2026] [:error] [pid 41279:tid 41341] [client 45.130.203.150:52067] [client 45.130.203.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/HEAD"] [unique_id "ag0WlbEFyfaehGZbt4xKkAAAAMU"]
[Wed May 20 10:25:45.812179 2026] [:error] [pid 44059:tid 44082] [client 175.27.136.83:54846] [client 175.27.136.83] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ag0bqRfFs-oSOOcyjyx8mgAAARU"]
[Wed May 20 11:03:59.876647 2026] [:error] [pid 41364:tid 41384] [client 43.159.149.56:54084] [client 43.159.149.56] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ag0knxKTmyvxtNXrN-hlcAAAAJI"]
[Wed May 20 13:28:02.116177 2026] [:error] [pid 41279:tid 41348] [client 43.131.23.154:37684] [client 43.131.23.154] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ag1GYrEFyfaehGZbt4xsoAAAAMw"]
[Wed May 20 14:34:00.376435 2026] [:error] [pid 7731:tid 7756] [client 34.46.57.55:62759] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ag1V2H9qQlHXbkl2nEuebwAAAZc"]
[Wed May 20 14:34:00.758561 2026] [:error] [pid 7731:tid 7739] [client 34.46.57.55:62775] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ag1V2H9qQlHXbkl2nEueqwAAAYY"]
[Wed May 20 14:34:00.763137 2026] [:error] [pid 41278:tid 41332] [client 34.46.57.55:55790] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ag1V2PWiNKASEfiGdwaXLwAAAFc"]
[Wed May 20 14:34:01.159319 2026] [:error] [pid 44059:tid 44068] [client 34.46.57.55:51010] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "ag1V2RfFs-oSOOcyjyzQdQAAAQc"]
[Wed May 20 14:34:01.545794 2026] [:error] [pid 41279:tid 41358] [client 34.46.57.55:60617] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "ag1V2bEFyfaehGZbt4xzQwAAANY"]
[Wed May 20 15:03:22.606053 2026] [:error] [pid 7664:tid 7668] [client 43.157.38.228:56802] [client 43.157.38.228] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ag1cunZ8s7o3eiqT2kvTGgAAAUE"]
[Wed May 20 16:06:38.891266 2026] [:error] [pid 41277:tid 41306] [client 126.209.47.76:64047] [client 126.209.47.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 126.209.47.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag1rjrTTCltJmboB5ufs9QAAABg"]
[Wed May 20 16:06:51.970921 2026] [:error] [pid 7664:tid 7671] [client 126.209.47.76:64339] [client 126.209.47.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 126.209.47.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag1rm3Z8s7o3eiqT2kvbXAAAAUQ"]
[Wed May 20 16:07:03.951190 2026] [:error] [pid 7664:tid 7667] [client 126.209.47.76:64629] [client 126.209.47.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 126.209.47.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag1rp3Z8s7o3eiqT2kvbYAAAAUA"]
[Wed May 20 16:07:15.882461 2026] [:error] [pid 41279:tid 41358] [client 126.209.47.76:64880] [client 126.209.47.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 126.209.47.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag1rs7EFyfaehGZbt4x7rQAAANY"]
[Wed May 20 16:07:18.813830 2026] [:error] [pid 41277:tid 41283] [client 94.231.223.11:30368] [client 94.231.223.11] ModSecurity: XML parsing error: XML: Failed parsing document. [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ag1rtrTTCltJmboB5uftAAAAAAE"]
[Wed May 20 16:07:18.814731 2026] [:error] [pid 41277:tid 41283] [client 94.231.223.11:30368] [client 94.231.223.11] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||www.expressinteriors.com|F|2"] [data "XML parsing error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ag1rtrTTCltJmboB5uftAAAAAAE"]
[Wed May 20 16:07:27.448158 2026] [:error] [pid 41364:tid 41388] [client 126.209.47.76:65104] [client 126.209.47.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 126.209.47.76, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag1rvxKTmyvxtNXrN-ikAwAAAJY"]
[Wed May 20 16:34:26.971524 2026] [:error] [pid 7731:tid 7750] [client 162.14.81.106:54850] [client 162.14.81.106] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ag1yEn9qQlHXbkl2nEu9zAAAAZE"]
[Wed May 20 17:19:54.041887 2026] [:error] [pid 44059:tid 44073] [client 43.157.181.189:44312] [client 43.157.181.189] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ag18uhfFs-oSOOcyjyz1dgAAAQw"]
[Wed May 20 18:54:29.762918 2026] [:error] [pid 41279:tid 41351] [client 43.164.196.47:38258] [client 43.164.196.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ag2S5bEFyfaehGZbt4yLXQAAAM8"]
[Wed May 20 20:02:58.348764 2026] [:error] [pid 7731:tid 7741] [client 104.207.38.204:63765] [client 104.207.38.204] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.expressinteriors.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/s3cmd.ini"] [unique_id "ag2i8n9qQlHXbkl2nEsG4AAAAYg"]
[Wed May 20 20:03:42.975027 2026] [:error] [pid 41278:tid 41317] [client 195.63.31.203:26477] [client 195.63.31.203] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "ag2jHvWiNKASEfiGdwa0NgAAAEg"]
[Wed May 20 21:06:06.642437 2026] [:error] [pid 7731:tid 7745] [client 119.28.177.175:57704] [client 119.28.177.175] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ag2xvn9qQlHXbkl2nEsdYAAAAYw"]
[Wed May 20 22:17:39.768526 2026] [:error] [pid 41278:tid 41333] [client 52.232.35.131:49744] [client 52.232.35.131] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ag3Cg_WiNKASEfiGdwbCngAAAFg"]
[Wed May 20 22:33:25.182897 2026] [:error] [pid 41364:tid 41372] [client 101.32.128.28:52136] [client 101.32.128.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ag3GNRKTmyvxtNXrN-jyuQAAAIY"]
[Wed May 20 22:57:46.365267 2026] [:error] [pid 7731:tid 7733] [client 13.78.12.223:1302] [client 13.78.12.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "ag3L6n9qQlHXbkl2nEs89AAAAYA"]
[Wed May 20 22:57:46.902808 2026] [:error] [pid 41279:tid 41338] [client 13.78.12.223:1300] [client 13.78.12.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "ag3L6rEFyfaehGZbt4yr8wAAAMI"]
[Wed May 20 22:57:47.456860 2026] [:error] [pid 41279:tid 41353] [client 13.78.12.223:1195] [client 13.78.12.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "ag3L67EFyfaehGZbt4yr9QAAANE"]
[Wed May 20 22:57:47.953918 2026] [:error] [pid 44059:tid 44082] [client 13.78.12.223:4420] [client 13.78.12.223] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/as.php"] [unique_id "ag3L6xfFs-oSOOcyjyxA3AAAARU"]
[Thu May 21 02:11:10.208581 2026] [:error] [pid 7664:tid 7686] [client 64.236.133.195:52745] [client 64.236.133.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 64.236.133.195, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/wp/xmlrpc.php"] [unique_id "ag35PnZ8s7o3eiqT2ks3oQAAAVM"]
[Thu May 21 05:00:38.940047 2026] [:error] [pid 49982:tid 49990] [client 49.235.136.28:47802] [client 49.235.136.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ag4g9mFwIDa5Tf8O4bYF3QAAAMY"]
[Thu May 21 05:26:00.490458 2026] [:error] [pid 49879:tid 49931] [client 43.165.67.31:40050] [client 43.165.67.31] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ag4m6IVqYDjFSyG2gFoChgAAAEs"]
[Thu May 21 05:56:40.715756 2026] [:error] [pid 49877:tid 49910] [client 109.158.77.104:63048] [client 109.158.77.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.158.77.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag4uGBgN4MeSe4kIL9D14AAAABY"]
[Thu May 21 05:58:20.951933 2026] [:error] [pid 49884:tid 49961] [client 109.158.77.104:53182] [client 109.158.77.104] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ag4ufK5MPpsTNNHWS6iwyAAAAI4"]
[Thu May 21 05:58:49.195311 2026] [:error] [pid 49884:tid 49953] [client 109.158.77.104:53586] [client 109.158.77.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.158.77.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag4uma5MPpsTNNHWS6ixPAAAAIY"]
[Thu May 21 05:59:14.751609 2026] [:error] [pid 49884:tid 49958] [client 109.158.77.104:52580] [client 109.158.77.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.158.77.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag4usq5MPpsTNNHWS6ixeAAAAIs"]
[Thu May 21 05:59:38.144254 2026] [:error] [pid 49884:tid 49967] [client 109.158.77.104:63112] [client 109.158.77.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.158.77.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag4uyq5MPpsTNNHWS6ixjgAAAJQ"]
[Thu May 21 05:59:58.280713 2026] [:error] [pid 49879:tid 49921] [client 109.158.77.104:49765] [client 109.158.77.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.158.77.104, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag4u3oVqYDjFSyG2gFoLXAAAAEE"]
[Thu May 21 07:06:47.546908 2026] [:error] [pid 9189:tid 9223] [client 129.226.94.18:52248] [client 129.226.94.18] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ag4-h5vTDh1NbYizKVwV6AAAAgQ"]
[Thu May 21 08:15:43.098573 2026] [:error] [pid 51613:tid 51617] [client 178.71.224.229:56079] [client 178.71.224.229] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.71.224.229, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag5OrmbP0MDvqrVnweqf5AAAAQI"], referer: https://expressinteriors.com/wp-login.php
[Thu May 21 08:15:46.338897 2026] [:error] [pid 51613:tid 51628] [client 95.55.116.193:48164] [client 95.55.116.193] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 95.55.116.193, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag5OsmbP0MDvqrVnweqf5wAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Thu May 21 09:12:50.076460 2026] [:error] [pid 49884:tid 49958] [client 76.74.150.109:48114] [client 76.74.150.109] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ag5cEq5MPpsTNNHWS6j6oQAAAIs"]
[Thu May 21 09:13:18.405134 2026] [:error] [pid 9114:tid 9120] [client 78.142.63.9:39522] [client 78.142.63.9] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ag5cLm8FiJqDBEoTvqw4cQAAAUQ"]
[Thu May 21 09:14:23.837013 2026] [:error] [pid 49884:tid 49956] [client 69.158.138.119:37687] [client 69.158.138.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.158.138.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag5cb65MPpsTNNHWS6j7UgAAAIk"]
[Thu May 21 09:14:34.010250 2026] [:error] [pid 51613:tid 51629] [client 69.158.138.119:37411] [client 69.158.138.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.158.138.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag5cembP0MDvqrVnweqnqwAAAQ4"]
[Thu May 21 09:14:44.457725 2026] [:error] [pid 9114:tid 9131] [client 69.158.138.119:37750] [client 69.158.138.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.158.138.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag5chG8FiJqDBEoTvqw4lwAAAU8"]
[Thu May 21 09:14:55.108724 2026] [:error] [pid 49884:tid 49958] [client 69.158.138.119:37625] [client 69.158.138.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.158.138.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag5cj65MPpsTNNHWS6j7eQAAAIs"]
[Thu May 21 09:15:05.695332 2026] [:error] [pid 9189:tid 9237] [client 69.158.138.119:37633] [client 69.158.138.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 69.158.138.119, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag5cmZvTDh1NbYizKVwv0gAAAhI"]
[Thu May 21 09:21:33.645467 2026] [ssl:error] [pid 51613:tid 51625] [client 15.204.183.221:19114] AH02032: Hostname cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup, referer: http://cdbdinteriors.com.au/
[Thu May 21 10:04:22.813144 2026] [:error] [pid 49884:tid 49949] [client 198.199.89.223:60810] [client 198.199.89.223] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.199.89.223, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag5oJq5MPpsTNNHWS6gJ7gAAAII"]
[Thu May 21 10:04:24.296273 2026] [:error] [pid 49982:tid 50003] [client 198.199.89.223:57730] [client 198.199.89.223] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.199.89.223, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag5oKGFwIDa5Tf8O4bZcQgAAANM"]
[Thu May 21 10:42:44.265697 2026] [ssl:error] [pid 49884:tid 49971] [client 15.204.183.221:28886] AH02032: Hostname www.cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup, referer: http://www.cdbdinteriors.com.au/
[Thu May 21 11:16:08.328635 2026] [:error] [pid 49877:tid 49894] [client 124.156.206.78:33992] [client 124.156.206.78] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ag54-BgN4MeSe4kIL9ATTQAAAAY"]
[Thu May 21 13:29:48.105384 2026] [ssl:error] [pid 9114:tid 9134] [client 15.204.161.7:10634] AH02032: Hostname cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup, referer: https://cdbdinteriors.com.au/
[Thu May 21 13:30:30.412375 2026] [:error] [pid 9188:tid 9203] [client 54.253.157.231:22968] [client 54.253.157.231] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.253.157.231, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag6YdrGYm6q5dNSUvA-iYQAAAcs"]
[Thu May 21 13:30:31.591912 2026] [:error] [pid 49884:tid 49955] [client 54.253.157.231:27046] [client 54.253.157.231] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 54.253.157.231, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag6Yd65MPpsTNNHWS6hSpAAAAIg"]
[Thu May 21 13:46:06.164302 2026] [:error] [pid 49884:tid 49965] [client 164.92.212.216:51282] [client 164.92.212.216] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||expressinteriors.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "expressinteriors.com"] [uri "/wp-content/debug.log"] [unique_id "ag6cHq5MPpsTNNHWS6hXwQAAAJI"]
[Thu May 21 13:46:06.167168 2026] [:error] [pid 49884:tid 49967] [client 164.92.212.216:51314] [client 164.92.212.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.92.212.216, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag6cHq5MPpsTNNHWS6hXwwAAAJQ"]
[Thu May 21 13:52:55.051173 2026] [:error] [pid 49884:tid 49959] [client 173.239.224.157:21923] [client 173.239.224.157] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ahax.php"] [unique_id "ag6dt65MPpsTNNHWS6haTgAAAIw"]
[Thu May 21 13:52:55.458868 2026] [:error] [pid 49982:tid 50008] [client 173.239.224.152:41371] [client 173.239.224.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "ag6dt2FwIDa5Tf8O4baZGQAAANg"]
[Thu May 21 13:52:56.252649 2026] [:error] [pid 49884:tid 49964] [client 173.239.224.174:46407] [client 173.239.224.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/file.php"] [unique_id "ag6duK5MPpsTNNHWS6haTwAAAJE"]
[Thu May 21 13:52:56.661565 2026] [:error] [pid 49884:tid 49958] [client 173.239.224.152:45239] [client 173.239.224.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/flower.php"] [unique_id "ag6duK5MPpsTNNHWS6haUAAAAIs"]
[Thu May 21 13:52:57.068850 2026] [:error] [pid 49884:tid 49951] [client 173.239.224.164:59981] [client 173.239.224.164] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/gifclass.php"] [unique_id "ag6dua5MPpsTNNHWS6haUgAAAIQ"]
[Thu May 21 13:52:57.472173 2026] [:error] [pid 49982:tid 49987] [client 173.239.224.155:43881] [client 173.239.224.155] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/bless.php"] [unique_id "ag6duWFwIDa5Tf8O4baZIAAAAMM"]
[Thu May 21 13:52:57.903732 2026] [:error] [pid 9188:tid 9206] [client 173.239.224.158:53155] [client 173.239.224.158] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/class-t.api.php"] [unique_id "ag6dubGYm6q5dNSUvA-mhAAAAc4"]
[Thu May 21 13:52:59.254563 2026] [:error] [pid 49879:tid 49933] [client 173.239.224.169:51195] [client 173.239.224.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/blurbs.php"] [unique_id "ag6du4VqYDjFSyG2gFo95QAAAE0"]
[Thu May 21 13:53:16.622090 2026] [:error] [pid 9114:tid 9134] [client 43.130.16.140:58496] [client 43.130.16.140] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ag6dzG8FiJqDBEoTvqxT5AAAAVI"]
[Thu May 21 14:49:33.675809 2026] [ssl:error] [pid 49982:tid 49998] [client 15.204.161.7:29802] AH02032: Hostname www.cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup, referer: https://www.cdbdinteriors.com.au/
[Thu May 21 15:21:51.131553 2026] [:error] [pid 51613:tid 51637] [client 3.107.233.49:40468] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "ag6yj2bP0MDvqrVnwerZlQAAARY"]
[Thu May 21 15:21:51.896179 2026] [:error] [pid 49982:tid 49994] [client 3.107.233.49:49012] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "ag6yj2FwIDa5Tf8O4bazvAAAAMo"]
[Thu May 21 15:21:51.961640 2026] [:error] [pid 49982:tid 49993] [client 3.107.233.49:49022] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.local"] [unique_id "ag6yj2FwIDa5Tf8O4bazvQAAAMk"]
[Thu May 21 15:21:52.024165 2026] [:error] [pid 49982:tid 49997] [client 3.107.233.49:49038] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.production"] [unique_id "ag6ykGFwIDa5Tf8O4bazvwAAAM0"]
[Thu May 21 15:21:52.097117 2026] [:error] [pid 49884:tid 49951] [client 3.107.233.49:49052] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.staging"] [unique_id "ag6ykK5MPpsTNNHWS6iBLAAAAIQ"]
[Thu May 21 15:21:52.160051 2026] [:error] [pid 49982:tid 50008] [client 3.107.233.49:49060] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.development"] [unique_id "ag6ykGFwIDa5Tf8O4bazwAAAANg"]
[Thu May 21 15:21:53.788250 2026] [:error] [pid 49884:tid 49957] [client 3.107.233.49:49074] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.remote"] [unique_id "ag6yka5MPpsTNNHWS6iBMQAAAIo"]
[Thu May 21 15:21:53.852810 2026] [:error] [pid 9189:tid 9235] [client 3.107.233.49:49076] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.bak"] [unique_id "ag6ykZvTDh1NbYizKVx_oQAAAhA"]
[Thu May 21 15:21:53.921203 2026] [:error] [pid 9189:tid 9240] [client 3.107.233.49:49082] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.backup"] [unique_id "ag6ykZvTDh1NbYizKVx_owAAAhU"]
[Thu May 21 15:21:53.985538 2026] [:error] [pid 9189:tid 9237] [client 3.107.233.49:49086] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.save"] [unique_id "ag6ykZvTDh1NbYizKVx_pAAAAhI"]
[Thu May 21 15:21:54.043115 2026] [:error] [pid 9189:tid 9239] [client 3.107.233.49:49090] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.old"] [unique_id "ag6ykpvTDh1NbYizKVx_pQAAAhQ"]
[Thu May 21 15:21:54.101987 2026] [:error] [pid 9189:tid 9243] [client 3.107.233.49:49096] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.sample"] [unique_id "ag6ykpvTDh1NbYizKVx_pgAAAhg"]
[Thu May 21 15:21:54.159128 2026] [:error] [pid 9189:tid 9242] [client 3.107.233.49:49100] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.example"] [unique_id "ag6ykpvTDh1NbYizKVx_qAAAAhc"]
[Thu May 21 15:21:54.228899 2026] [:error] [pid 9189:tid 9224] [client 3.107.233.49:49112] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.dev"] [unique_id "ag6ykpvTDh1NbYizKVx_qwAAAgU"]
[Thu May 21 15:21:54.287886 2026] [:error] [pid 9189:tid 9232] [client 3.107.233.49:49122] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.prod"] [unique_id "ag6ykpvTDh1NbYizKVx_rAAAAg0"]
[Thu May 21 15:21:54.352071 2026] [:error] [pid 9157:tid 9178] [client 3.107.233.49:49126] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.stage"] [unique_id "ag6yksGfHcLNqE8m88JvRAAAAZM"]
[Thu May 21 15:21:54.418955 2026] [:error] [pid 9157:tid 9172] [client 3.107.233.49:49134] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.ci"] [unique_id "ag6yksGfHcLNqE8m88JvRQAAAY0"]
[Thu May 21 15:21:54.476846 2026] [:error] [pid 49879:tid 49930] [client 3.107.233.49:49144] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.docker"] [unique_id "ag6ykoVqYDjFSyG2gFpIFgAAAEo"]
[Thu May 21 15:21:54.548056 2026] [:error] [pid 9189:tid 9231] [client 3.107.233.49:49152] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.live"] [unique_id "ag6ykpvTDh1NbYizKVx_rQAAAgw"]
[Thu May 21 15:21:54.606132 2026] [:error] [pid 9157:tid 9159] [client 3.107.233.49:49160] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.preprod"] [unique_id "ag6yksGfHcLNqE8m88JvRgAAAYA"]
[Thu May 21 15:21:54.666757 2026] [:error] [pid 9157:tid 9176] [client 3.107.233.49:49172] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.uat"] [unique_id "ag6yksGfHcLNqE8m88JvRwAAAZE"]
[Thu May 21 15:21:54.723250 2026] [:error] [pid 9157:tid 9168] [client 3.107.233.49:49188] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.dist"] [unique_id "ag6yksGfHcLNqE8m88JvSAAAAYk"]
[Thu May 21 15:21:54.782734 2026] [:error] [pid 49982:tid 49996] [client 3.107.233.49:49196] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.swp"] [unique_id "ag6ykmFwIDa5Tf8O4bazxAAAAMw"]
[Thu May 21 15:21:54.853709 2026] [:error] [pid 9157:tid 9166] [client 3.107.233.49:49198] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env~"] [unique_id "ag6yksGfHcLNqE8m88JvSgAAAYc"]
[Thu May 21 15:21:54.908903 2026] [:error] [pid 9157:tid 9160] [client 3.107.233.49:49212] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env1"] [unique_id "ag6yksGfHcLNqE8m88JvSwAAAYE"]
[Thu May 21 15:21:54.963517 2026] [:error] [pid 9157:tid 9180] [client 3.107.233.49:49220] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env2"] [unique_id "ag6yksGfHcLNqE8m88JvTAAAAZU"]
[Thu May 21 15:21:55.021102 2026] [:error] [pid 49982:tid 49990] [client 3.107.233.49:49236] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env_copy"] [unique_id "ag6yk2FwIDa5Tf8O4bazxQAAAMY"]
[Thu May 21 15:21:55.077399 2026] [:error] [pid 9157:tid 9173] [client 3.107.233.49:49246] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.txt"] [unique_id "ag6yk8GfHcLNqE8m88JvTQAAAY4"]
[Thu May 21 15:21:55.146020 2026] [:error] [pid 9157:tid 9178] [client 3.107.233.49:49258] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.json"] [unique_id "ag6yk8GfHcLNqE8m88JvTgAAAZM"]
[Thu May 21 15:21:55.206174 2026] [:error] [pid 9157:tid 9172] [client 3.107.233.49:49270] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.yaml"] [unique_id "ag6yk8GfHcLNqE8m88JvTwAAAY0"]
[Thu May 21 15:21:55.260947 2026] [:error] [pid 49879:tid 49943] [client 3.107.233.49:49278] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env.yml"] [unique_id "ag6yk4VqYDjFSyG2gFpIFwAAAFc"]
[Thu May 21 15:21:55.327625 2026] [:error] [pid 9188:tid 9208] [client 3.107.233.49:49284] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/app/.env"] [unique_id "ag6yk7GYm6q5dNSUvA-4zgAAAdA"]
[Thu May 21 15:21:55.388164 2026] [:error] [pid 49879:tid 49922] [client 3.107.233.49:49298] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/apps/.env"] [unique_id "ag6yk4VqYDjFSyG2gFpIGAAAAEI"]
[Thu May 21 15:21:55.470509 2026] [:error] [pid 9189:tid 9238] [client 3.107.233.49:49300] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/api/.env"] [unique_id "ag6yk5vTDh1NbYizKVx_rwAAAhM"]
[Thu May 21 15:21:55.530555 2026] [:error] [pid 9189:tid 9243] [client 3.107.233.49:49304] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/web/.env"] [unique_id "ag6yk5vTDh1NbYizKVx_sAAAAhg"]
[Thu May 21 15:21:55.588180 2026] [:error] [pid 9188:tid 9194] [client 3.107.233.49:49308] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/site/.env"] [unique_id "ag6yk7GYm6q5dNSUvA-4zwAAAcI"]
[Thu May 21 15:21:55.651563 2026] [:error] [pid 9188:tid 9213] [client 3.107.233.49:49318] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/public/.env"] [unique_id "ag6yk7GYm6q5dNSUvA-40AAAAdU"]
[Thu May 21 15:21:55.715039 2026] [:error] [pid 49877:tid 49892] [client 3.107.233.49:49334] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/admin/.env"] [unique_id "ag6ykxgN4MeSe4kIL9Am3wAAAAQ"]
[Thu May 21 15:21:55.794614 2026] [:error] [pid 9188:tid 9211] [client 3.107.233.49:49342] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/backend/.env"] [unique_id "ag6yk7GYm6q5dNSUvA-40QAAAdM"]
[Thu May 21 15:21:55.865561 2026] [:error] [pid 49884:tid 49959] [client 3.107.233.49:49344] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/server/.env"] [unique_id "ag6yk65MPpsTNNHWS6iBMwAAAIw"]
[Thu May 21 15:21:55.930869 2026] [:error] [pid 9189:tid 9221] [client 3.107.233.49:49350] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/frontend/.env"] [unique_id "ag6yk5vTDh1NbYizKVx_uwAAAgI"]
[Thu May 21 15:21:56.004057 2026] [:error] [pid 9189:tid 9219] [client 3.107.233.49:49356] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/src/.env"] [unique_id "ag6ylJvTDh1NbYizKVx_vAAAAgA"]
[Thu May 21 15:21:56.079333 2026] [:error] [pid 9189:tid 9229] [client 3.107.233.49:49358] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/core/.env"] [unique_id "ag6ylJvTDh1NbYizKVx_vQAAAgo"]
[Thu May 21 15:21:56.138780 2026] [:error] [pid 9189:tid 9235] [client 3.107.233.49:49370] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/core/app/.env"] [unique_id "ag6ylJvTDh1NbYizKVx_vgAAAhA"]
[Thu May 21 15:21:56.202197 2026] [:error] [pid 9189:tid 9228] [client 3.107.233.49:49384] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/config/.env"] [unique_id "ag6ylJvTDh1NbYizKVx_vwAAAgk"]
[Thu May 21 15:21:56.264539 2026] [:error] [pid 9189:tid 9233] [client 3.107.233.49:49396] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/private/.env"] [unique_id "ag6ylJvTDh1NbYizKVx_wQAAAg4"]
[Thu May 21 15:21:56.325491 2026] [:error] [pid 9189:tid 9234] [client 3.107.233.49:49408] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/application/.env"] [unique_id "ag6ylJvTDh1NbYizKVx_wgAAAg8"]
[Thu May 21 15:21:56.401704 2026] [:error] [pid 9189:tid 9226] [client 3.107.233.49:49422] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/bootstrap/.env"] [unique_id "ag6ylJvTDh1NbYizKVx_wwAAAgc"]
[Thu May 21 15:21:56.464223 2026] [:error] [pid 9189:tid 9225] [client 3.107.233.49:49432] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/database/.env"] [unique_id "ag6ylJvTDh1NbYizKVx_xAAAAgY"]
[Thu May 21 15:21:56.534132 2026] [:error] [pid 9114:tid 9127] [client 3.107.233.49:49436] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/storage/.env"] [unique_id "ag6ylG8FiJqDBEoTvqxfAQAAAUs"]
[Thu May 21 15:21:56.602329 2026] [:error] [pid 9189:tid 9230] [client 3.107.233.49:49442] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/var/www/.env"] [unique_id "ag6ylJvTDh1NbYizKVx_xgAAAgs"]
[Thu May 21 15:21:56.677653 2026] [:error] [pid 9189:tid 9219] [client 3.107.233.49:49454] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/var/www/html/.env"] [unique_id "ag6ylJvTDh1NbYizKVx_xwAAAgA"]
[Thu May 21 15:21:56.734199 2026] [:error] [pid 49879:tid 49942] [client 3.107.233.49:49460] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/current/.env"] [unique_id "ag6ylIVqYDjFSyG2gFpIGQAAAFY"]
[Thu May 21 15:21:56.793961 2026] [:error] [pid 49884:tid 49961] [client 3.107.233.49:49462] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/release/.env"] [unique_id "ag6ylK5MPpsTNNHWS6iBNAAAAI4"]
[Thu May 21 15:21:56.854436 2026] [:error] [pid 49879:tid 49926] [client 3.107.233.49:49468] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/releases/.env"] [unique_id "ag6ylIVqYDjFSyG2gFpIGgAAAEY"]
[Thu May 21 15:21:56.918044 2026] [:error] [pid 9114:tid 9120] [client 3.107.233.49:49476] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/shared/.env"] [unique_id "ag6ylG8FiJqDBEoTvqxfAgAAAUQ"]
[Thu May 21 15:21:57.001027 2026] [:error] [pid 9114:tid 9116] [client 3.107.233.49:49488] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/deploy/.env"] [unique_id "ag6ylW8FiJqDBEoTvqxfAwAAAUA"]
[Thu May 21 15:21:57.065924 2026] [:error] [pid 49879:tid 49931] [client 3.107.233.49:49490] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/build/.env"] [unique_id "ag6ylYVqYDjFSyG2gFpIHAAAAEs"]
[Thu May 21 15:21:57.127168 2026] [:error] [pid 9157:tid 9179] [client 3.107.233.49:49504] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/dist/.env"] [unique_id "ag6ylcGfHcLNqE8m88JvUwAAAZQ"]
[Thu May 21 15:21:57.194502 2026] [:error] [pid 9157:tid 9177] [client 3.107.233.49:49506] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/public_html/.env"] [unique_id "ag6ylcGfHcLNqE8m88JvVAAAAZI"]
[Thu May 21 15:21:57.259777 2026] [:error] [pid 49884:tid 49966] [client 3.107.233.49:49520] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/htdocs/.env"] [unique_id "ag6yla5MPpsTNNHWS6iBNQAAAJM"]
[Thu May 21 15:21:57.331282 2026] [:error] [pid 51613:tid 51627] [client 3.107.233.49:49524] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/www/.env"] [unique_id "ag6ylWbP0MDvqrVnwerZlgAAAQw"]
[Thu May 21 15:21:57.389773 2026] [:error] [pid 51613:tid 51616] [client 3.107.233.49:49540] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/html/.env"] [unique_id "ag6ylWbP0MDvqrVnwerZlwAAAQE"]
[Thu May 21 15:21:57.444448 2026] [:error] [pid 49884:tid 49947] [client 3.107.233.49:49552] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/live/.env"] [unique_id "ag6yla5MPpsTNNHWS6iBNgAAAIA"]
[Thu May 21 15:21:57.500528 2026] [:error] [pid 49879:tid 49920] [client 3.107.233.49:49562] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/prod/.env"] [unique_id "ag6ylYVqYDjFSyG2gFpIHQAAAEA"]
[Thu May 21 15:21:57.555464 2026] [:error] [pid 49982:tid 50008] [client 3.107.233.49:49572] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/dev/.env"] [unique_id "ag6ylWFwIDa5Tf8O4bazxwAAANg"]
[Thu May 21 15:21:57.635361 2026] [:error] [pid 9189:tid 9231] [client 3.107.233.49:49580] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/staging/.env"] [unique_id "ag6ylZvTDh1NbYizKVx_ygAAAgw"]
[Thu May 21 15:21:57.692676 2026] [:error] [pid 49884:tid 49952] [client 3.107.233.49:49592] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/opt/.env"] [unique_id "ag6yla5MPpsTNNHWS6iBOAAAAIU"]
[Thu May 21 15:21:57.749840 2026] [:error] [pid 49884:tid 49962] [client 3.107.233.49:49604] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/laravel/.env"] [unique_id "ag6yla5MPpsTNNHWS6iBOQAAAI8"]
[Thu May 21 15:21:57.807034 2026] [:error] [pid 49879:tid 49925] [client 3.107.233.49:49614] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/symfony/.env"] [unique_id "ag6ylYVqYDjFSyG2gFpIHgAAAEU"]
[Thu May 21 15:21:57.866083 2026] [:error] [pid 49982:tid 49991] [client 3.107.233.49:49618] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/wordpress/.env"] [unique_id "ag6ylWFwIDa5Tf8O4bazyAAAAMc"]
[Thu May 21 15:21:57.933492 2026] [:error] [pid 49982:tid 50007] [client 3.107.233.49:49626] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/wp/.env"] [unique_id "ag6ylWFwIDa5Tf8O4bazyQAAANc"]
[Thu May 21 15:21:57.989333 2026] [:error] [pid 49982:tid 50004] [client 3.107.233.49:49634] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/cms/.env"] [unique_id "ag6ylWFwIDa5Tf8O4bazygAAANQ"]
[Thu May 21 15:21:58.045355 2026] [:error] [pid 49982:tid 50002] [client 3.107.233.49:49642] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/drupal/.env"] [unique_id "ag6ylmFwIDa5Tf8O4bazywAAANI"]
[Thu May 21 15:21:58.105917 2026] [:error] [pid 49982:tid 49999] [client 3.107.233.49:49652] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/joomla/.env"] [unique_id "ag6ylmFwIDa5Tf8O4bazzAAAAM8"]
[Thu May 21 15:21:58.168590 2026] [:error] [pid 49982:tid 50000] [client 3.107.233.49:49668] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/magento/.env"] [unique_id "ag6ylmFwIDa5Tf8O4bazzQAAANA"]
[Thu May 21 15:21:58.227556 2026] [:error] [pid 49982:tid 49995] [client 3.107.233.49:49682] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/shopify/.env"] [unique_id "ag6ylmFwIDa5Tf8O4bazzgAAAMs"]
[Thu May 21 15:21:58.286356 2026] [:error] [pid 49982:tid 49997] [client 3.107.233.49:49692] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/prestashop/.env"] [unique_id "ag6ylmFwIDa5Tf8O4bazzwAAAM0"]
[Thu May 21 15:21:58.350027 2026] [:error] [pid 9189:tid 9220] [client 3.107.233.49:49700] [client 3.107.233.49] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/codeigniter/.env"] [unique_id "ag6ylpvTDh1NbYizKVx_ywAAAgE"]
[Thu May 21 15:24:38.813023 2026] [:error] [pid 49982:tid 49986] [client 43.156.55.246:39410] [client 43.156.55.246] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ag6zNmFwIDa5Tf8O4ba0fgAAAMI"]
[Thu May 21 16:04:45.070463 2026] [:error] [pid 9189:tid 9232] [client 13.56.155.143:43150] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "ag68nZvTDh1NbYizKVyH9gAAAg0"]
[Thu May 21 16:04:46.668501 2026] [:error] [pid 51613:tid 51615] [client 13.56.155.143:49850] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "ag68nmbP0MDvqrVnwerewwAAAQA"]
[Thu May 21 16:04:47.325230 2026] [:error] [pid 9188:tid 9193] [client 13.56.155.143:49866] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.local"] [unique_id "ag68n7GYm6q5dNSUvA-_9QAAAcE"]
[Thu May 21 16:04:47.982525 2026] [:error] [pid 9188:tid 9205] [client 13.56.155.143:49880] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.production"] [unique_id "ag68n7GYm6q5dNSUvA-_9wAAAc0"]
[Thu May 21 16:04:48.631408 2026] [:error] [pid 49884:tid 49966] [client 13.56.155.143:49886] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.staging"] [unique_id "ag68oK5MPpsTNNHWS6iP9wAAAJM"]
[Thu May 21 16:04:49.287602 2026] [:error] [pid 9114:tid 9139] [client 13.56.155.143:49894] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.development"] [unique_id "ag68oW8FiJqDBEoTvqxj-gAAAVc"]
[Thu May 21 16:04:49.942455 2026] [:error] [pid 9189:tid 9230] [client 13.56.155.143:49900] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.test"] [unique_id "ag68oZvTDh1NbYizKVyH-AAAAgs"]
[Thu May 21 16:04:50.593807 2026] [:error] [pid 49982:tid 49996] [client 13.56.155.143:49916] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.remote"] [unique_id "ag68omFwIDa5Tf8O4ba-5wAAAMw"]
[Thu May 21 16:04:51.249720 2026] [:error] [pid 49982:tid 49997] [client 13.56.155.143:49926] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.bak"] [unique_id "ag68o2FwIDa5Tf8O4ba-6QAAAM0"]
[Thu May 21 16:04:51.905424 2026] [:error] [pid 9188:tid 9192] [client 13.56.155.143:49930] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.backup"] [unique_id "ag68o7GYm6q5dNSUvA-_-gAAAcA"]
[Thu May 21 16:04:52.558659 2026] [:error] [pid 9188:tid 9202] [client 13.56.155.143:49932] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.save"] [unique_id "ag68pLGYm6q5dNSUvA-_-wAAAco"]
[Thu May 21 16:04:53.217351 2026] [:error] [pid 49879:tid 49932] [client 13.56.155.143:49936] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.old"] [unique_id "ag68pYVqYDjFSyG2gFpMpQAAAEw"]
[Thu May 21 16:04:53.873923 2026] [:error] [pid 9157:tid 9165] [client 13.56.155.143:49938] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.sample"] [unique_id "ag68pcGfHcLNqE8m88J1AgAAAYY"]
[Thu May 21 16:04:54.531496 2026] [:error] [pid 49879:tid 49936] [client 13.56.155.143:49952] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.example"] [unique_id "ag68poVqYDjFSyG2gFpMpgAAAFA"]
[Thu May 21 16:04:55.188013 2026] [:error] [pid 49877:tid 49896] [client 13.56.155.143:49960] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.dev"] [unique_id "ag68pxgN4MeSe4kIL9AqAAAAAAg"]
[Thu May 21 16:04:55.845482 2026] [:error] [pid 9157:tid 9176] [client 13.56.155.143:38158] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.prod"] [unique_id "ag68p8GfHcLNqE8m88J1BQAAAZE"]
[Thu May 21 16:04:56.502341 2026] [:error] [pid 9157:tid 9182] [client 13.56.155.143:38164] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.stage"] [unique_id "ag68qMGfHcLNqE8m88J1BgAAAZc"]
[Thu May 21 16:04:57.153493 2026] [:error] [pid 49877:tid 49900] [client 13.56.155.143:38176] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.docker"] [unique_id "ag68qRgN4MeSe4kIL9AqBgAAAAw"]
[Thu May 21 16:04:59.070571 2026] [:error] [pid 49877:tid 49900] [client 13.56.155.143:38176] [client 13.56.155.143] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "66.249.74.133_59c3d4f2509c82627f0eeb8e0e13ae1254eb4065"): Internal error (specific information not available) [hostname "expressinteriors.com"] [uri "/.env.docker"] [unique_id "ag68qRgN4MeSe4kIL9AqBgAAAAw"]
[Thu May 21 16:04:59.731674 2026] [:error] [pid 49884:tid 49967] [client 13.56.155.143:38184] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.preprod"] [unique_id "ag68q65MPpsTNNHWS6iQBQAAAJQ"]
[Thu May 21 16:05:00.388999 2026] [:error] [pid 49884:tid 49955] [client 13.56.155.143:38188] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.uat"] [unique_id "ag68rK5MPpsTNNHWS6iQCAAAAIg"]
[Thu May 21 16:05:01.046653 2026] [:error] [pid 9189:tid 9225] [client 13.56.155.143:38198] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.dist"] [unique_id "ag68rZvTDh1NbYizKVyH-QAAAgY"]
[Thu May 21 16:05:01.696439 2026] [:error] [pid 9114:tid 9140] [client 13.56.155.143:38206] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.swp"] [unique_id "ag68rW8FiJqDBEoTvqxj_QAAAVg"]
[Thu May 21 16:05:02.355432 2026] [:error] [pid 9189:tid 9238] [client 13.56.155.143:38216] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env~"] [unique_id "ag68rpvTDh1NbYizKVyH-gAAAhM"]
[Thu May 21 16:05:03.011133 2026] [:error] [pid 9189:tid 9221] [client 13.56.155.143:38220] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env1"] [unique_id "ag68r5vTDh1NbYizKVyH-wAAAgI"]
[Thu May 21 16:05:03.670055 2026] [:error] [pid 9157:tid 9160] [client 13.56.155.143:38230] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env2"] [unique_id "ag68r8GfHcLNqE8m88J1CwAAAYE"]
[Thu May 21 16:05:04.329447 2026] [:error] [pid 9157:tid 9179] [client 13.56.155.143:38236] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env_copy"] [unique_id "ag68sMGfHcLNqE8m88J1DQAAAZQ"]
[Thu May 21 16:05:04.989486 2026] [:error] [pid 9157:tid 9172] [client 13.56.155.143:38250] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.txt"] [unique_id "ag68sMGfHcLNqE8m88J1DwAAAY0"]
[Thu May 21 16:05:05.647102 2026] [:error] [pid 9157:tid 9166] [client 13.56.155.143:34590] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.json"] [unique_id "ag68scGfHcLNqE8m88J1EQAAAYc"]
[Thu May 21 16:05:06.299576 2026] [:error] [pid 49982:tid 49987] [client 13.56.155.143:34598] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.yaml"] [unique_id "ag68smFwIDa5Tf8O4ba-8AAAAMM"]
[Thu May 21 16:05:06.960678 2026] [:error] [pid 49982:tid 50001] [client 13.56.155.143:34612] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.yml"] [unique_id "ag68smFwIDa5Tf8O4ba-8gAAANE"]
[Thu May 21 16:05:07.621685 2026] [:error] [pid 9189:tid 9240] [client 13.56.155.143:34620] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/app/.env"] [unique_id "ag68s5vTDh1NbYizKVyH_AAAAhU"]
[Thu May 21 16:05:08.279892 2026] [:error] [pid 9188:tid 9204] [client 13.56.155.143:34628] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/apps/.env"] [unique_id "ag68tLGYm6q5dNSUvA_ABAAAAcw"]
[Thu May 21 16:05:08.951679 2026] [:error] [pid 49877:tid 49910] [client 13.56.155.143:34630] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/api/.env"] [unique_id "ag68tBgN4MeSe4kIL9AqCQAAABY"]
[Thu May 21 16:05:09.610196 2026] [:error] [pid 9188:tid 9213] [client 13.56.155.143:34642] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/web/.env"] [unique_id "ag68tbGYm6q5dNSUvA_ABQAAAdU"]
[Thu May 21 16:05:10.269421 2026] [:error] [pid 9114:tid 9127] [client 13.56.155.143:34658] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/site/.env"] [unique_id "ag68tm8FiJqDBEoTvqxj_wAAAUs"]
[Thu May 21 16:05:10.926126 2026] [:error] [pid 9157:tid 9179] [client 13.56.155.143:34672] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/public/.env"] [unique_id "ag68tsGfHcLNqE8m88J1EwAAAZQ"]
[Thu May 21 16:05:11.585329 2026] [:error] [pid 49982:tid 50007] [client 13.56.155.143:34678] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/admin/.env"] [unique_id "ag68t2FwIDa5Tf8O4ba--AAAANc"]
[Thu May 21 16:05:12.242619 2026] [:error] [pid 49982:tid 50002] [client 13.56.155.143:34684] [client 13.56.155.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/backend/.env"] [unique_id "ag68uGFwIDa5Tf8O4ba--gAAANI"]
[Thu May 21 17:18:47.797776 2026] [ssl:error] [pid 51613:tid 51638] [client 40.160.16.154:12672] AH02032: Hostname cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup, referer: https://cdbdinteriors.com.au/
[Thu May 21 17:29:39.344109 2026] [:error] [pid 49982:tid 50008] [client 45.13.225.121:35356] [client 45.13.225.121] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/HEAD"] [unique_id "ag7Qg2FwIDa5Tf8O4bbUFgAAANg"]
[Thu May 21 17:29:46.009547 2026] [:error] [pid 9114:tid 9136] [client 45.13.225.121:40650] [client 45.13.225.121] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "ag7Qim8FiJqDBEoTvqxt3gAAAVQ"]
[Thu May 21 17:52:48.926723 2026] [:error] [pid 9188:tid 9215] [client 43.131.253.14:53240] [client 43.131.253.14] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ag7V8LGYm6q5dNSUvA_QHwAAAdc"]
[Thu May 21 18:07:26.110999 2026] [ssl:error] [pid 9188:tid 9214] [client 40.160.16.154:26202] AH02032: Hostname www.cdbdinteriors.com.au provided via SNI and hostname expressinteriors.com provided via HTTP have no compatible SSL setup, referer: https://www.cdbdinteriors.com.au/
[Thu May 21 18:39:42.040435 2026] [:error] [pid 49884:tid 49952] [client 162.240.101.155:46958] [client 162.240.101.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.101.155, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag7g7q5MPpsTNNHWS6jDnQAAAIU"]
[Thu May 21 18:39:43.483584 2026] [:error] [pid 49884:tid 49963] [client 162.240.101.155:46958] [client 162.240.101.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.101.155, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag7g765MPpsTNNHWS6jDoAAAAJA"], referer: https://expressinteriors.com/wp-login.php
[Thu May 21 18:42:04.861445 2026] [:error] [pid 9157:tid 9159] [client 193.42.61.12:37294] [client 193.42.61.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.42.61.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag7hfMGfHcLNqE8m88KHhgAAAYA"]
[Thu May 21 18:42:05.807910 2026] [:error] [pid 9157:tid 9166] [client 193.42.61.12:37294] [client 193.42.61.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.42.61.12, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag7hfcGfHcLNqE8m88KHiAAAAYc"], referer: https://expressinteriors.com/wp-login.php
[Thu May 21 19:21:05.303074 2026] [:error] [pid 49877:tid 49890] [client 124.221.140.98:41718] [client 124.221.140.98] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ag7qoRgN4MeSe4kIL9A4UwAAAAI"]
[Thu May 21 19:23:46.252051 2026] [:error] [pid 49877:tid 49897] [client 43.130.111.40:51790] [client 43.130.111.40] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ag7rQhgN4MeSe4kIL9A4ewAAAAk"]
[Thu May 21 19:40:32.468381 2026] [:error] [pid 49879:tid 49941] [client 47.130.126.163:51878] [client 47.130.126.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.130.126.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag7vMIVqYDjFSyG2gFpfxwAAAFU"]
[Thu May 21 19:40:33.768761 2026] [:error] [pid 49879:tid 49939] [client 47.130.126.163:51878] [client 47.130.126.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 47.130.126.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag7vMYVqYDjFSyG2gFpfyQAAAFM"], referer: https://expressinteriors.com/wp-login.php
[Thu May 21 20:07:34.069300 2026] [:error] [pid 51613:tid 51628] [client 102.129.223.92:48658] [client 102.129.223.92] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.129.223.92, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag71hmbP0MDvqrVnwer-PwAAAQ0"], referer: https://expressinteriors.com/
[Thu May 21 20:36:40.834933 2026] [:error] [pid 49884:tid 49964] [client 144.16.144.93:18052] [client 144.16.144.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 144.16.144.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag78WK5MPpsTNNHWS6jnXQAAAJE"]
[Thu May 21 20:36:42.374850 2026] [:error] [pid 49884:tid 49957] [client 144.16.144.93:18052] [client 144.16.144.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 144.16.144.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag78Wq5MPpsTNNHWS6jnXwAAAIo"], referer: https://expressinteriors.com/wp-login.php
[Thu May 21 21:02:08.987081 2026] [:error] [pid 49884:tid 49949] [client 45.55.33.147:40778] [client 45.55.33.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.55.33.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag8CUK5MPpsTNNHWS6jwHQAAAII"]
[Thu May 21 21:02:11.189668 2026] [:error] [pid 49884:tid 49954] [client 45.55.33.147:40778] [client 45.55.33.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.55.33.147, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag8CU65MPpsTNNHWS6jwHwAAAIc"], referer: https://expressinteriors.com/wp-login.php
[Thu May 21 21:14:49.098042 2026] [:error] [pid 49982:tid 50000] [client 63.247.93.90:41828] [client 63.247.93.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.247.93.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag8FSWFwIDa5Tf8O4bYH6QAAANA"]
[Thu May 21 21:14:51.091622 2026] [:error] [pid 49982:tid 50008] [client 63.247.93.90:41828] [client 63.247.93.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 63.247.93.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag8FS2FwIDa5Tf8O4bYH7gAAANg"], referer: https://expressinteriors.com/wp-login.php
[Thu May 21 21:26:51.328925 2026] [:error] [pid 9157:tid 9167] [client 34.34.115.96:51469] [client 34.34.115.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.34.115.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag8IG8GfHcLNqE8m88KYuwAAAYg"]
[Thu May 21 21:26:53.643278 2026] [:error] [pid 9157:tid 9174] [client 34.34.115.96:51469] [client 34.34.115.96] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ag8IHcGfHcLNqE8m88KYwQAAAY8"]
[Thu May 21 21:26:54.011244 2026] [:error] [pid 9157:tid 9183] [client 34.34.115.96:51469] [client 34.34.115.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.34.115.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag8IHsGfHcLNqE8m88KYwgAAAZg"]
[Thu May 21 21:26:55.755722 2026] [:error] [pid 49982:tid 50000] [client 34.34.115.96:55237] [client 34.34.115.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.34.115.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag8IH2FwIDa5Tf8O4bYKRgAAANA"]
[Thu May 21 21:26:57.415454 2026] [:error] [pid 49982:tid 49999] [client 34.34.115.96:61167] [client 34.34.115.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.34.115.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag8IIWFwIDa5Tf8O4bYKTQAAAM8"]
[Thu May 21 21:26:59.341503 2026] [:error] [pid 49884:tid 49962] [client 34.34.115.96:63323] [client 34.34.115.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.34.115.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag8II65MPpsTNNHWS6j40QAAAI8"]
[Thu May 21 21:27:01.014617 2026] [:error] [pid 49884:tid 49947] [client 34.34.115.96:62298] [client 34.34.115.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.34.115.96, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag8IJa5MPpsTNNHWS6j40wAAAIA"]
[Thu May 21 21:27:01.014776 2026] [:error] [pid 49884:tid 49947] [client 34.34.115.96:62298] [client 34.34.115.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.34.115.96, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag8IJa5MPpsTNNHWS6j40wAAAIA"]
[Thu May 21 21:39:31.801569 2026] [:error] [pid 49879:tid 49921] [client 43.156.249.28:45728] [client 43.156.249.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ag8LE4VqYDjFSyG2gFpqbwAAAEE"]
[Thu May 21 22:23:22.075281 2026] [:error] [pid 49884:tid 49947] [client 167.71.136.93:42086] [client 167.71.136.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.136.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag8VWq5MPpsTNNHWS6gH0wAAAIA"]
[Thu May 21 22:23:24.613544 2026] [:error] [pid 49884:tid 49952] [client 167.71.136.93:42086] [client 167.71.136.93] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.136.93, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag8VXK5MPpsTNNHWS6gH2gAAAIU"], referer: https://expressinteriors.com/wp-login.php
[Thu May 21 23:03:58.793050 2026] [:error] [pid 51613:tid 51621] [client 34.63.170.52:63844] [client 34.63.170.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.63.170.52, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag8e3mbP0MDvqrVnweoR_wAAAQY"]
[Thu May 21 23:04:01.152923 2026] [:error] [pid 51613:tid 51630] [client 34.63.170.52:63844] [client 34.63.170.52] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ag8e4WbP0MDvqrVnweoSAgAAAQ8"]
[Thu May 21 23:04:01.353028 2026] [:error] [pid 51613:tid 51634] [client 34.63.170.52:63844] [client 34.63.170.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.63.170.52, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag8e4WbP0MDvqrVnweoSAwAAARM"]
[Thu May 21 23:04:02.808542 2026] [:error] [pid 9157:tid 9181] [client 34.63.170.52:63959] [client 34.63.170.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.63.170.52, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag8e4sGfHcLNqE8m88KhygAAAZY"]
[Thu May 21 23:04:04.210346 2026] [:error] [pid 9189:tid 9223] [client 34.63.170.52:57828] [client 34.63.170.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.63.170.52, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag8e5JvTDh1NbYizKVzSOAAAAgQ"]
[Thu May 21 23:04:05.580761 2026] [:error] [pid 9189:tid 9226] [client 34.63.170.52:52008] [client 34.63.170.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.63.170.52, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag8e5ZvTDh1NbYizKVzSOgAAAgc"]
[Thu May 21 23:04:06.889140 2026] [:error] [pid 49884:tid 49961] [client 34.63.170.52:63829] [client 34.63.170.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.63.170.52, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag8e5q5MPpsTNNHWS6gSfwAAAI4"]
[Thu May 21 23:04:06.889324 2026] [:error] [pid 49884:tid 49961] [client 34.63.170.52:63829] [client 34.63.170.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.63.170.52, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag8e5q5MPpsTNNHWS6gSfwAAAI4"]
[Thu May 21 23:24:09.942072 2026] [:error] [pid 49879:tid 49924] [client 34.150.255.112:63628] [client 34.150.255.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ag8jmYVqYDjFSyG2gFpx3AAAAEQ"]
[Thu May 21 23:24:10.363141 2026] [:error] [pid 49884:tid 49966] [client 34.150.255.112:54181] [client 34.150.255.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ag8jmq5MPpsTNNHWS6gXnwAAAJM"]
[Thu May 21 23:24:10.790462 2026] [:error] [pid 9188:tid 9212] [client 34.150.255.112:58268] [client 34.150.255.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "ag8jmrGYm6q5dNSUvA__AQAAAdQ"]
[Thu May 21 23:51:08.482656 2026] [:error] [pid 49982:tid 49990] [client 209.141.37.7:55485] [client 209.141.37.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.37.7, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag8p7GFwIDa5Tf8O4bYnAgAAAMY"]
[Thu May 21 23:51:13.789959 2026] [:error] [pid 49982:tid 49986] [client 209.141.37.7:55848] [client 209.141.37.7] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ag8p8WFwIDa5Tf8O4bYnCgAAAMI"]
[Thu May 21 23:51:20.617131 2026] [:error] [pid 49884:tid 49965] [client 209.141.37.7:50507] [client 209.141.37.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.37.7, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag8p-K5MPpsTNNHWS6gdMwAAAJI"]
[Thu May 21 23:51:21.273211 2026] [:error] [pid 49884:tid 49950] [client 209.141.37.7:50507] [client 209.141.37.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.37.7, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag8p-a5MPpsTNNHWS6gdNAAAAIM"], referer: https://expressinteriors.com/wp-login.php
[Fri May 22 00:03:27.359544 2026] [:error] [pid 9157:tid 9163] [client 34.26.82.59:50686] [client 34.26.82.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.26.82.59, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag8sz8GfHcLNqE8m88KmmAAAAYQ"]
[Fri May 22 00:03:29.838522 2026] [:error] [pid 9157:tid 9176] [client 34.26.82.59:50686] [client 34.26.82.59] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ag8s0cGfHcLNqE8m88KmnQAAAZE"]
[Fri May 22 00:03:30.081250 2026] [:error] [pid 9157:tid 9162] [client 34.26.82.59:50686] [client 34.26.82.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.26.82.59, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag8s0sGfHcLNqE8m88KmngAAAYM"]
[Fri May 22 00:03:31.779707 2026] [:error] [pid 9189:tid 9232] [client 34.26.82.59:51848] [client 34.26.82.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.26.82.59, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag8s05vTDh1NbYizKVzb3AAAAg0"]
[Fri May 22 00:03:33.381479 2026] [:error] [pid 9189:tid 9233] [client 34.26.82.59:65156] [client 34.26.82.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.26.82.59, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag8s1ZvTDh1NbYizKVzb3wAAAg4"]
[Fri May 22 00:03:34.940163 2026] [:error] [pid 49982:tid 49986] [client 34.26.82.59:64469] [client 34.26.82.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.26.82.59, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag8s1mFwIDa5Tf8O4bYp4wAAAMI"]
[Fri May 22 00:03:36.491755 2026] [:error] [pid 9157:tid 9180] [client 34.26.82.59:52047] [client 34.26.82.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.26.82.59, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag8s2MGfHcLNqE8m88KmoAAAAZU"]
[Fri May 22 00:03:36.491893 2026] [:error] [pid 9157:tid 9180] [client 34.26.82.59:52047] [client 34.26.82.59] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.26.82.59, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag8s2MGfHcLNqE8m88KmoAAAAZU"]
[Fri May 22 00:32:05.222187 2026] [:error] [pid 9188:tid 9206] [client 209.235.136.147:51934] [client 209.235.136.147] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ag8zhbGYm6q5dNSUvA8GjAAAAc4"]
[Fri May 22 01:46:07.588609 2026] [:error] [pid 9188:tid 9199] [client 129.226.146.134:55434] [client 129.226.146.134] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ag9E37GYm6q5dNSUvA8PkwAAAcc"]
[Fri May 22 02:27:35.000117 2026] [:error] [pid 49982:tid 50005] [client 39.97.110.217:51450] [client 39.97.110.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 39.97.110.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag9OlmFwIDa5Tf8O4bY6kwAAANU"]
[Fri May 22 02:27:36.575987 2026] [:error] [pid 49982:tid 49997] [client 39.97.110.217:51450] [client 39.97.110.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 39.97.110.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag9OmGFwIDa5Tf8O4bY6lQAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Fri May 22 03:45:29.381354 2026] [:error] [pid 9157:tid 9160] [client 43.160.225.169:58206] [client 43.160.225.169] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ag9g2cGfHcLNqE8m88LSuAAAAYE"]
[Fri May 22 04:25:26.561479 2026] [:error] [pid 15584:tid 15644] [client 177.156.168.84:62832] [client 177.156.168.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.156.168.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag9qNt9Z_TVLbNEx52hkYgAAAFg"]
[Fri May 22 04:27:52.978460 2026] [:error] [pid 15584:tid 15634] [client 177.156.168.84:58411] [client 177.156.168.84] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ag9qyN9Z_TVLbNEx52hlAAAAAE4"]
[Fri May 22 04:28:30.723921 2026] [:error] [pid 15583:tid 15591] [client 177.156.168.84:58841] [client 177.156.168.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.156.168.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag9q7nnaOncRcIm17YVkwgAAAAM"]
[Fri May 22 04:29:10.815185 2026] [:error] [pid 15583:tid 15601] [client 177.156.168.84:59200] [client 177.156.168.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.156.168.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag9rFnnaOncRcIm17YVk4QAAAA0"]
[Fri May 22 04:29:46.123851 2026] [:error] [pid 15679:tid 15694] [client 177.156.168.84:59410] [client 177.156.168.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.156.168.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag9rOih8tgGc38WJ-GxPXwAAAM0"]
[Fri May 22 04:30:19.967091 2026] [:error] [pid 15584:tid 15638] [client 177.156.168.84:59538] [client 177.156.168.84] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.156.168.84, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag9rW99Z_TVLbNEx52hliQAAAFI"]
[Fri May 22 04:47:08.345721 2026] [:error] [pid 15583:tid 15600] [client 153.123.7.211:45366] [client 153.123.7.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 153.123.7.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag9vTHnaOncRcIm17YVoowAAAAw"]
[Fri May 22 04:47:11.935519 2026] [:error] [pid 15583:tid 15599] [client 153.123.7.211:45366] [client 153.123.7.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 153.123.7.211, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag9vT3naOncRcIm17YVorAAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Fri May 22 05:06:00.982566 2026] [:error] [pid 15679:tid 15688] [client 191.234.188.166:36623] [client 191.234.188.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ag9zuCh8tgGc38WJ-GxcDAAAAMc"]
[Fri May 22 05:06:04.428019 2026] [:error] [pid 58813:tid 58835] [client 191.234.188.166:7358] [client 191.234.188.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ag9zvJ6yyKWDKULhxJ3yBAAAAVM"]
[Fri May 22 05:06:06.808129 2026] [:error] [pid 58782:tid 58799] [client 191.234.188.166:35248] [client 191.234.188.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ag9zvoxsdTFafgO8vhSjGgAAAQ8"]
[Fri May 22 05:06:13.255831 2026] [:error] [pid 15585:tid 15656] [client 191.234.188.166:36625] [client 191.234.188.166] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ag9zxSKb-vB41AF-LC0tSAAAAIk"]
[Fri May 22 06:26:07.144802 2026] [:error] [pid 58813:tid 58828] [client 49.51.253.26:59182] [client 49.51.253.26] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ag-Gf56yyKWDKULhxJ3-AgAAAUw"]
[Fri May 22 07:23:44.742390 2026] [:error] [pid 58813:tid 58830] [client 91.142.222.105:36040] [client 91.142.222.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.142.222.105, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag-UAJ6yyKWDKULhxJ0FSwAAAU4"]
[Fri May 22 07:23:48.505323 2026] [:error] [pid 58813:tid 58836] [client 91.142.222.105:36040] [client 91.142.222.105] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.142.222.105, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag-UBJ6yyKWDKULhxJ0FUQAAAVQ"], referer: https://expressinteriors.com/wp-login.php
[Fri May 22 07:38:15.835872 2026] [:error] [pid 15584:tid 15624] [client 209.141.34.188:55684] [client 209.141.34.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.34.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag-XZ99Z_TVLbNEx52iLKQAAAEQ"]
[Fri May 22 07:38:16.929796 2026] [:error] [pid 15584:tid 15640] [client 209.141.34.188:55684] [client 209.141.34.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.34.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag-XaN9Z_TVLbNEx52iLLQAAAFQ"]
[Fri May 22 07:40:10.930146 2026] [:error] [pid 15585:tid 15669] [client 20.205.110.7:2112] [client 20.205.110.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "ag-X2iKb-vB41AF-LC1iqgAAAJY"]
[Fri May 22 07:40:11.408890 2026] [:error] [pid 15584:tid 15635] [client 20.205.110.7:19556] [client 20.205.110.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "ag-X299Z_TVLbNEx52iLngAAAE8"]
[Fri May 22 07:40:11.880741 2026] [:error] [pid 58782:tid 58798] [client 20.205.110.7:19563] [client 20.205.110.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "ag-X24xsdTFafgO8vhS3agAAAQ4"]
[Fri May 22 07:40:12.406332 2026] [:error] [pid 58813:tid 58822] [client 20.205.110.7:2188] [client 20.205.110.7] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "ag-X3J6yyKWDKULhxJ0IMAAAAUY"]
[Fri May 22 08:17:18.295036 2026] [:error] [pid 15679:tid 15685] [client 43.135.182.95:49272] [client 43.135.182.95] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ag-gjih8tgGc38WJ-GyOrQAAAMQ"]
[Fri May 22 08:19:47.290623 2026] [:error] [pid 58782:tid 58797] [client 175.145.176.12:53489] [client 175.145.176.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.145.176.12, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ag-hI4xsdTFafgO8vhS9rQAAAQ0"]
[Fri May 22 08:28:19.580736 2026] [:error] [pid 15584:tid 15633] [client 216.251.35.201:40576] [client 216.251.35.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.251.35.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag-jI99Z_TVLbNEx52iWkgAAAE0"]
[Fri May 22 08:28:20.923476 2026] [:error] [pid 15584:tid 15638] [client 216.251.35.201:40576] [client 216.251.35.201] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.251.35.201, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag-jJN9Z_TVLbNEx52iWlAAAAFI"], referer: https://expressinteriors.com/wp-login.php
[Fri May 22 08:36:38.990066 2026] [:error] [pid 15585:tid 15664] [client 34.158.222.65:57184] [client 34.158.222.65] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.158.222.65, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag-lFiKb-vB41AF-LC177QAAAJE"]
[Fri May 22 08:36:40.331231 2026] [:error] [pid 15585:tid 15648] [client 34.158.222.65:57184] [client 34.158.222.65] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.158.222.65, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag-lGCKb-vB41AF-LC178AAAAIE"], referer: https://expressinteriors.com/wp-login.php
[Fri May 22 08:40:32.157531 2026] [:error] [pid 15583:tid 15603] [client 35.209.83.189:51980] [client 35.209.83.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.209.83.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag-mAHnaOncRcIm17YWTQAAAAA8"], referer: https://expressinteriors.com/login/
[Fri May 22 08:53:03.101396 2026] [:error] [pid 15585:tid 15659] [client 185.227.134.44:42172] [client 185.227.134.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.227.134.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag-o7yKb-vB41AF-LC2F-QAAAIw"]
[Fri May 22 08:53:04.038410 2026] [:error] [pid 15585:tid 15649] [client 185.227.134.44:42172] [client 185.227.134.44] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.227.134.44, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag-o8CKb-vB41AF-LC2F-gAAAII"], referer: https://expressinteriors.com/wp-login.php
[Fri May 22 09:11:03.131455 2026] [:error] [pid 15584:tid 15643] [client 104.244.73.103:55527] [client 104.244.73.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.244.73.103, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag-tJ99Z_TVLbNEx52intwAAAFc"]
[Fri May 22 09:11:04.397946 2026] [:error] [pid 15584:tid 15641] [client 104.244.73.103:55527] [client 104.244.73.103] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.244.73.103, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag-tKN9Z_TVLbNEx52inuAAAAFU"]
[Fri May 22 09:54:12.157704 2026] [:error] [pid 15585:tid 15648] [client 34.100.157.153:2560] [client 34.100.157.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.100.157.153, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag-3RCKb-vB41AF-LC2mYwAAAIE"]
[Fri May 22 09:54:13.689589 2026] [:error] [pid 15585:tid 15657] [client 34.100.157.153:2560] [client 34.100.157.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.100.157.153, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag-3RSKb-vB41AF-LC2mZgAAAIo"], referer: https://expressinteriors.com/wp-login.php
[Fri May 22 11:03:47.309140 2026] [:error] [pid 15679:tid 15705] [client 43.164.3.182:53828] [client 43.164.3.182] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ag_Hkyh8tgGc38WJ-GzHrgAAANg"]
[Fri May 22 11:14:29.036083 2026] [:error] [pid 15585:tid 15649] [client 209.141.44.244:35443] [client 209.141.44.244] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.44.244, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag_KFSKb-vB41AF-LC3EmwAAAII"]
[Fri May 22 11:15:24.469232 2026] [:error] [pid 58813:tid 58831] [client 209.141.44.244:39884] [client 209.141.44.244] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.44.244, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag_KTJ6yyKWDKULhxJ0vkAAAAU8"]
[Fri May 22 12:21:55.895641 2026] [:error] [pid 15679:tid 15703] [client 27.112.79.157:45448] [client 27.112.79.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 27.112.79.157, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag_Z4yh8tgGc38WJ-GzbsAAAANY"]
[Fri May 22 12:21:56.913119 2026] [:error] [pid 15679:tid 15700] [client 27.112.79.157:45448] [client 27.112.79.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 27.112.79.157, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag_Z5Ch8tgGc38WJ-GzbsQAAANM"], referer: https://expressinteriors.com/wp-login.php
[Fri May 22 12:32:53.527629 2026] [autoindex:error] [pid 58782:tid 58803] [client 62.84.183.159:49837] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Fri May 22 12:50:20.500686 2026] [:error] [pid 15584:tid 15638] [client 43.156.18.240:60216] [client 43.156.18.240] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ag_gjN9Z_TVLbNEx52jToQAAAFI"]
[Fri May 22 13:53:54.276447 2026] [:error] [pid 15583:tid 15599] [client 192.248.32.140:38098] [client 192.248.32.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.248.32.140, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag_vcnnaOncRcIm17YXSaAAAAAs"]
[Fri May 22 13:53:55.527436 2026] [:error] [pid 15583:tid 15605] [client 192.248.32.140:38098] [client 192.248.32.140] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.248.32.140, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag_vc3naOncRcIm17YXSaQAAABE"], referer: https://expressinteriors.com/wp-login.php
[Fri May 22 14:51:22.339828 2026] [:error] [pid 15584:tid 15623] [client 107.189.4.58:64485] [client 107.189.4.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.189.4.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag_86t9Z_TVLbNEx52jvgwAAAEM"]
[Fri May 22 14:54:25.801875 2026] [:error] [pid 58813:tid 58827] [client 107.189.4.58:64390] [client 107.189.4.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.189.4.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ag_9oZ6yyKWDKULhxJ1WOAAAAUs"]
[Fri May 22 15:08:06.737161 2026] [:error] [pid 15679:tid 15690] [client 20.222.17.182:6731] [client 20.222.17.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "ahAA1ih8tgGc38WJ-GwOygAAAMk"]
[Fri May 22 15:08:07.217545 2026] [:error] [pid 15583:tid 15589] [client 20.222.17.182:6757] [client 20.222.17.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "ahAA13naOncRcIm17YXgGQAAAAE"]
[Fri May 22 15:08:07.673382 2026] [:error] [pid 15584:tid 15641] [client 20.222.17.182:11554] [client 20.222.17.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "ahAA199Z_TVLbNEx52jyowAAAFU"]
[Fri May 22 15:08:08.147887 2026] [:error] [pid 15584:tid 15636] [client 20.222.17.182:11537] [client 20.222.17.182] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/num.php"] [unique_id "ahAA2N9Z_TVLbNEx52jypgAAAFA"]
[Fri May 22 15:28:55.673184 2026] [:error] [pid 15679:tid 15702] [client 170.106.167.214:47002] [client 170.106.167.214] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ahAFtyh8tgGc38WJ-GwVTwAAANU"]
[Fri May 22 15:32:57.518184 2026] [:error] [pid 15679:tid 15703] [client 119.91.20.139:55524] [client 119.91.20.139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ahAGqSh8tgGc38WJ-GwWmQAAANY"]
[Fri May 22 16:50:47.311989 2026] [:error] [pid 15679:tid 15702] [client 209.141.41.219:60857] [client 209.141.41.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.41.219, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahAY5yh8tgGc38WJ-GwrQQAAANU"]
[Fri May 22 16:51:03.341204 2026] [:error] [pid 15585:tid 15662] [client 209.141.41.219:61861] [client 209.141.41.219] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.41.219, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahAY9yKb-vB41AF-LC1BGwAAAI8"]
[Fri May 22 17:11:07.622300 2026] [:error] [pid 15585:tid 15647] [client 34.93.63.75:58736] [client 34.93.63.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahAdqyKb-vB41AF-LC1JCgAAAIA"]
[Fri May 22 17:11:07.914516 2026] [:error] [pid 15585:tid 15671] [client 34.93.63.75:59723] [client 34.93.63.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/license.txt"] [unique_id "ahAdqyKb-vB41AF-LC1JJgAAAJg"]
[Fri May 22 17:11:08.199888 2026] [:error] [pid 15584:tid 15632] [client 34.93.63.75:61301] [client 34.93.63.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/feed/"] [unique_id "ahAdrN9Z_TVLbNEx52gL6gAAAEw"]
[Fri May 22 17:11:08.840297 2026] [:error] [pid 58782:tid 58807] [client 34.93.63.75:62979] [client 34.93.63.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/license.txt"] [unique_id "ahAdrIxsdTFafgO8vhQN1AAAARc"]
[Fri May 22 17:11:09.416900 2026] [:error] [pid 58782:tid 58795] [client 34.93.63.75:49676] [client 34.93.63.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/feed/"] [unique_id "ahAdrYxsdTFafgO8vhQN4gAAAQs"]
[Fri May 22 17:32:25.692508 2026] [:error] [pid 15679:tid 15686] [client 43.134.104.17:49348] [client 43.134.104.17] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahAiqSh8tgGc38WJ-Gw1HAAAAMU"]
[Fri May 22 20:04:10.433436 2026] [:error] [pid 15583:tid 15608] [client 150.109.230.210:54846] [client 150.109.230.210] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ahBGOnnaOncRcIm17YURDAAAABQ"]
[Fri May 22 20:17:56.999547 2026] [:error] [pid 15585:tid 15650] [client 140.213.217.108:16415] [client 140.213.217.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.213.217.108, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahBJdCKb-vB41AF-LC2BwwAAAIM"]
[Fri May 22 20:17:58.702864 2026] [:error] [pid 15585:tid 15658] [client 140.213.217.108:16415] [client 140.213.217.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.213.217.108, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahBJdiKb-vB41AF-LC2ByAAAAIs"], referer: https://expressinteriors.com/wp-login.php
[Fri May 22 20:26:54.798872 2026] [:error] [pid 58782:tid 58790] [client 103.174.152.203:38768] [client 103.174.152.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.174.152.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahBLjoxsdTFafgO8vhQlwwAAAQY"]
[Fri May 22 20:26:57.989609 2026] [:error] [pid 58782:tid 58793] [client 103.174.152.203:38768] [client 103.174.152.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.174.152.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahBLkYxsdTFafgO8vhQlxAAAAQk"], referer: https://expressinteriors.com/wp-login.php
[Fri May 22 21:52:50.474783 2026] [:error] [pid 15583:tid 15594] [client 43.157.20.63:38986] [client 43.157.20.63] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahBfsnnaOncRcIm17YUkKQAAAAY"]
[Fri May 22 22:01:11.939935 2026] [:error] [pid 15583:tid 15589] [client 23.111.143.234:53344] [client 23.111.143.234] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 23.111.143.234, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahBhp3naOncRcIm17YUnJwAAAAE"]
[Fri May 22 22:01:12.907440 2026] [:error] [pid 15583:tid 15588] [client 23.111.143.234:53344] [client 23.111.143.234] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 23.111.143.234, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahBhqHnaOncRcIm17YUnLwAAAAA"], referer: https://expressinteriors.com/wp-login.php
[Fri May 22 23:08:35.287373 2026] [:error] [pid 15585:tid 15655] [client 35.168.16.231:35602] [client 35.168.16.231] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.168.16.231, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahBxcyKb-vB41AF-LC2r3AAAAIg"]
[Fri May 22 23:08:36.423987 2026] [:error] [pid 15585:tid 15671] [client 35.168.16.231:35602] [client 35.168.16.231] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.168.16.231, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahBxdCKb-vB41AF-LC2r4wAAAJg"], referer: https://expressinteriors.com/wp-login.php
[Sat May 23 00:16:34.555896 2026] [:error] [pid 15584:tid 15630] [client 8.229.78.253:51060] [client 8.229.78.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "ahCBYt9Z_TVLbNEx52hXogAAAEo"]
[Sat May 23 01:00:22.462227 2026] [:error] [pid 15679:tid 15705] [client 43.128.67.187:51994] [client 43.128.67.187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ahCLpih8tgGc38WJ-GyhswAAANg"]
[Sat May 23 01:47:35.987935 2026] [:error] [pid 15584:tid 15621] [client 13.200.118.32:42020] [client 13.200.118.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 13.200.118.32, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahCWt99Z_TVLbNEx52hodAAAAEE"]
[Sat May 23 01:47:36.944249 2026] [:error] [pid 15584:tid 15632] [client 13.200.118.32:42020] [client 13.200.118.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 13.200.118.32, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahCWuN9Z_TVLbNEx52hodgAAAEw"], referer: https://expressinteriors.com/wp-login.php
[Sat May 23 01:55:49.758773 2026] [:error] [pid 58813:tid 58830] [client 209.141.34.188:65211] [client 209.141.34.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.34.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahCYpZ6yyKWDKULhxJ25jgAAAU4"]
[Sat May 23 01:55:51.517715 2026] [:error] [pid 58813:tid 58829] [client 209.141.34.188:65211] [client 209.141.34.188] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.34.188, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahCYp56yyKWDKULhxJ25kAAAAU0"]
[Sat May 23 02:35:23.516582 2026] [:error] [pid 15585:tid 15666] [client 162.240.101.155:46510] [client 162.240.101.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.101.155, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahCh6yKb-vB41AF-LC3YKwAAAJM"]
[Sat May 23 02:35:24.764578 2026] [:error] [pid 15585:tid 15655] [client 162.240.101.155:46510] [client 162.240.101.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 162.240.101.155, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahCh7CKb-vB41AF-LC3YLQAAAIg"], referer: https://expressinteriors.com/wp-login.php
[Sat May 23 03:28:17.697083 2026] [:error] [pid 58813:tid 58830] [client 164.163.13.73:57641] [client 164.163.13.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.163.13.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahCuUZ6yyKWDKULhxJ3I9AAAAU4"]
[Sat May 23 03:28:27.706052 2026] [:error] [pid 58782:tid 58785] [client 164.163.13.73:57565] [client 164.163.13.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.163.13.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahCuW4xsdTFafgO8vhRhOAAAAQE"]
[Sat May 23 03:28:38.098420 2026] [:error] [pid 15679:tid 15704] [client 164.163.13.73:58318] [client 164.163.13.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.163.13.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahCuZih8tgGc38WJ-GzOygAAANc"]
[Sat May 23 03:28:48.443770 2026] [:error] [pid 15679:tid 15682] [client 164.163.13.73:57763] [client 164.163.13.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.163.13.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahCucCh8tgGc38WJ-GzO1QAAAME"]
[Sat May 23 03:28:58.180988 2026] [:error] [pid 15585:tid 15663] [client 164.163.13.73:57711] [client 164.163.13.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.163.13.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahCueiKb-vB41AF-LC3k8wAAAJA"]
[Sat May 23 03:57:25.225696 2026] [:error] [pid 30940:tid 30968] [client 201.33.82.47:34813] [client 201.33.82.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.33.82.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahC1JZqUP2XZmzp7RDpgegAAABM"]
[Sat May 23 03:58:48.996998 2026] [:error] [pid 31039:tid 31043] [client 201.33.82.47:22679] [client 201.33.82.47] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahC1eKIYDYo8WvA5zLIq0gAAAMI"]
[Sat May 23 03:59:27.501483 2026] [:error] [pid 30940:tid 30960] [client 201.33.82.47:1867] [client 201.33.82.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.33.82.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahC1n5qUP2XZmzp7RDphHQAAAAs"]
[Sat May 23 03:59:57.781879 2026] [:error] [pid 31039:tid 31051] [client 201.33.82.47:22542] [client 201.33.82.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.33.82.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahC1vaIYDYo8WvA5zLIrQgAAAMo"]
[Sat May 23 04:00:24.884660 2026] [:error] [pid 30941:tid 31000] [client 201.33.82.47:2101] [client 201.33.82.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.33.82.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahC12HTIgjSDhiZmvlX_jwAAAFg"]
[Sat May 23 04:01:00.433671 2026] [:error] [pid 30941:tid 30981] [client 201.33.82.47:27749] [client 201.33.82.47] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 201.33.82.47, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahC1_HTIgjSDhiZmvlX_vQAAAEU"]
[Sat May 23 04:51:47.507116 2026] [:error] [pid 30942:tid 31019] [client 43.159.63.116:55144] [client 43.159.63.116] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahDB49Uosz64YFiBlG2k6QAAAJA"]
[Sat May 23 05:44:04.897947 2026] [authz_core:error] [pid 25876:tid 25880] [client 157.230.19.140:42124] AH01630: client denied by server configuration: /home/expressi/public_html/server-status
[Sat May 23 05:44:12.924322 2026] [:error] [pid 30941:tid 30996] [client 157.230.19.140:36936] [client 157.230.19.140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.env"] [unique_id "ahDOLHTIgjSDhiZmvlUbzwAAAFQ"]
[Sat May 23 05:44:16.948022 2026] [:error] [pid 31039:tid 31049] [client 157.230.19.140:36952] [client 157.230.19.140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.expressinteriors.com"] [uri "/.git/config"] [unique_id "ahDOMKIYDYo8WvA5zLJYfgAAAMg"]
[Sat May 23 05:44:26.179661 2026] [:error] [pid 25876:tid 25892] [client 157.230.19.140:42700] [client 157.230.19.140] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd cgi.force_redirect=0 \\xadd disable_functions="" \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/usr/local/apache/modsecurity-cwaf/rules/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.expressinteriors.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd cgi.force_redirect=0 \\x5cxadd disable_functions=\\x22\\x22 \\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd cgi.force_redirect=0 \\xadd disable_functions=\\x22\\x22 \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.expressinteriors.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "ahDOOgSpWUCKPezIBJBxjQAAAQ4"]
[Sat May 23 05:44:41.264140 2026] [:error] [pid 25876:tid 25879] [client 157.230.19.140:57784] [client 157.230.19.140] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.expressinteriors.com|F|2"] [data ".axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expressinteriors.com"] [uri "/trace.axd"] [unique_id "ahDOSQSpWUCKPezIBJBxuQAAAQE"]
[Sat May 23 07:59:06.012147 2026] [:error] [pid 30942:tid 31007] [client 65.254.225.225:48978] [client 65.254.225.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahDtytUosz64YFiBlG3TngAAAIQ"]
[Sat May 23 07:59:08.141699 2026] [:error] [pid 30942:tid 31027] [client 65.254.225.225:48978] [client 65.254.225.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahDtzNUosz64YFiBlG3TnwAAAJg"], referer: https://expressinteriors.com/wp-login.php
[Sat May 23 08:33:38.286980 2026] [:error] [pid 25876:tid 25902] [client 20.200.215.186:7937] [client 20.200.215.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahD14gSpWUCKPezIBJCtegAAARg"]
[Sat May 23 08:33:38.890096 2026] [:error] [pid 30941:tid 30994] [client 20.200.215.186:2064] [client 20.200.215.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahD14nTIgjSDhiZmvlU53wAAAFI"]
[Sat May 23 08:33:39.487735 2026] [:error] [pid 30941:tid 30997] [client 20.200.215.186:2063] [client 20.200.215.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahD143TIgjSDhiZmvlU54QAAAFU"]
[Sat May 23 08:33:40.137702 2026] [:error] [pid 30941:tid 30993] [client 20.200.215.186:4653] [client 20.200.215.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahD15HTIgjSDhiZmvlU54wAAAFE"]
[Sat May 23 08:42:08.975427 2026] [:error] [pid 30942:tid 31006] [client 138.249.138.2:51430] [client 138.249.138.2] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "ahD34NUosz64YFiBlG3btwAAAIM"]
[Sat May 23 09:09:17.213862 2026] [:error] [pid 25876:tid 25890] [client 173.236.211.239:57158] [client 173.236.211.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.211.239, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahD-PQSpWUCKPezIBJC9MQAAAQw"]
[Sat May 23 09:09:19.847946 2026] [:error] [pid 25876:tid 25899] [client 173.236.211.239:57158] [client 173.236.211.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.211.239, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahD-PwSpWUCKPezIBJC9NAAAARU"], referer: https://expressinteriors.com/wp-login.php
[Sat May 23 09:43:07.734469 2026] [:error] [pid 31039:tid 31046] [client 43.130.32.245:43434] [client 43.130.32.245] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ahEGK6IYDYo8WvA5zLKaIwAAAMU"]
[Sat May 23 10:18:00.221762 2026] [:error] [pid 25876:tid 25900] [client 185.61.152.26:50940] [client 185.61.152.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.61.152.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahEOWASpWUCKPezIBJDV3QAAARY"]
[Sat May 23 10:18:01.529738 2026] [:error] [pid 25876:tid 25889] [client 185.61.152.26:50940] [client 185.61.152.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.61.152.26, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahEOWQSpWUCKPezIBJDV4QAAAQs"], referer: https://expressinteriors.com/wp-login.php
[Sat May 23 11:32:22.794145 2026] [:error] [pid 25876:tid 25897] [client 107.189.4.58:57113] [client 107.189.4.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.189.4.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahEfxgSpWUCKPezIBJD4AwAAARM"]
[Sat May 23 11:32:24.061222 2026] [:error] [pid 25876:tid 25883] [client 107.189.4.58:57113] [client 107.189.4.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.189.4.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahEfyASpWUCKPezIBJD4BwAAAQU"]
[Sat May 23 12:14:29.930933 2026] [:error] [pid 31039:tid 31042] [client 43.156.202.34:56940] [client 43.156.202.34] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahEppaIYDYo8WvA5zLLG0wAAAME"]
[Sat May 23 12:39:11.160205 2026] [:error] [pid 31039:tid 31057] [client 176.65.132.73:54264] [client 176.65.132.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.65.132.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahEvb6IYDYo8WvA5zLLOHQAAANA"]
[Sat May 23 12:39:12.733773 2026] [:error] [pid 31039:tid 31049] [client 176.65.132.73:54291] [client 176.65.132.73] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahEvcKIYDYo8WvA5zLLOJAAAAMg"]
[Sat May 23 12:39:13.755777 2026] [:error] [pid 31039:tid 31055] [client 176.65.132.73:54306] [client 176.65.132.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.65.132.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahEvcaIYDYo8WvA5zLLOJwAAAM4"]
[Sat May 23 12:39:15.601865 2026] [:error] [pid 31039:tid 31062] [client 176.65.132.73:54341] [client 176.65.132.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.65.132.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahEvc6IYDYo8WvA5zLLOKgAAANU"]
[Sat May 23 12:39:17.435496 2026] [:error] [pid 30941:tid 30983] [client 176.65.132.73:54386] [client 176.65.132.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.65.132.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahEvdXTIgjSDhiZmvlVpjgAAAEc"]
[Sat May 23 12:39:19.255875 2026] [:error] [pid 25876:tid 25890] [client 176.65.132.73:54411] [client 176.65.132.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.65.132.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahEvdwSpWUCKPezIBJATbQAAAQw"]
[Sat May 23 12:39:21.109897 2026] [:error] [pid 30940:tid 30963] [client 176.65.132.73:54440] [client 176.65.132.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.65.132.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahEveZqUP2XZmzp7RDq-9QAAAA4"]
[Sat May 23 12:39:23.069066 2026] [:error] [pid 30942:tid 31021] [client 176.65.132.73:54477] [client 176.65.132.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.65.132.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahEve9Uosz64YFiBlG0UJQAAAJI"]
[Sat May 23 12:39:23.069201 2026] [:error] [pid 30942:tid 31021] [client 176.65.132.73:54477] [client 176.65.132.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 176.65.132.73, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahEve9Uosz64YFiBlG0UJQAAAJI"]
[Sat May 23 12:39:24.079185 2026] [:error] [pid 31039:tid 31058] [client 176.65.132.73:54494] [client 176.65.132.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.65.132.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahEvfKIYDYo8WvA5zLLOLwAAANE"]
[Sat May 23 12:39:24.079359 2026] [:error] [pid 31039:tid 31058] [client 176.65.132.73:54494] [client 176.65.132.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 176.65.132.73, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahEvfKIYDYo8WvA5zLLOLwAAANE"]
[Sat May 23 12:39:25.089323 2026] [:error] [pid 30941:tid 30989] [client 176.65.132.73:54514] [client 176.65.132.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.65.132.73, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahEvfXTIgjSDhiZmvlVpkQAAAE0"]
[Sat May 23 12:39:25.089471 2026] [:error] [pid 30941:tid 30989] [client 176.65.132.73:54514] [client 176.65.132.73] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 176.65.132.73, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahEvfXTIgjSDhiZmvlVpkQAAAE0"]
[Sat May 23 15:44:15.185272 2026] [:error] [pid 25876:tid 25885] [client 51.79.254.190:50720] [client 51.79.254.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.79.254.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahFazwSpWUCKPezIBJBqZwAAAQc"]
[Sat May 23 15:44:16.402285 2026] [:error] [pid 25876:tid 25892] [client 51.79.254.190:50720] [client 51.79.254.190] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 51.79.254.190, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahFa0ASpWUCKPezIBJBqaQAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Sat May 23 16:05:08.876466 2026] [:error] [pid 30940:tid 30964] [client 20.210.129.142:4680] [client 20.210.129.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahFftJqUP2XZmzp7RDrolQAAAA8"]
[Sat May 23 16:05:09.355851 2026] [:error] [pid 31039:tid 31064] [client 20.210.129.142:11408] [client 20.210.129.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahFftaIYDYo8WvA5zLIWmgAAANc"]
[Sat May 23 16:05:09.862288 2026] [:error] [pid 30941:tid 31000] [client 20.210.129.142:6236] [client 20.210.129.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahFftXTIgjSDhiZmvlWZEQAAAFg"]
[Sat May 23 16:05:10.421988 2026] [:error] [pid 25876:tid 25887] [client 20.210.129.142:4694] [client 20.210.129.142] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahFftgSpWUCKPezIBJB0fAAAAQk"]
[Sat May 23 16:05:11.961728 2026] [:error] [pid 30941:tid 30979] [client 43.164.0.96:41954] [client 43.164.0.96] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ahFft3TIgjSDhiZmvlWZFAAAAEM"]
[Sat May 23 16:23:23.161887 2026] [:error] [pid 30941:tid 30986] [client 34.83.52.194:52278] [client 34.83.52.194] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.83.52.194, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahFj-3TIgjSDhiZmvlWdKgAAAEo"]
[Sat May 23 18:02:50.309585 2026] [:error] [pid 30940:tid 30952] [client 43.134.92.251:40108] [client 43.134.92.251] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahF7SpqUP2XZmzp7RDr7wAAAAAM"]
[Sat May 23 18:57:08.041487 2026] [:error] [pid 30942:tid 31012] [client 159.223.117.90:46890] [client 159.223.117.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.223.117.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahGIBNUosz64YFiBlG1qcQAAAIk"]
[Sat May 23 18:57:08.947631 2026] [:error] [pid 30942:tid 31024] [client 159.223.117.90:46890] [client 159.223.117.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.223.117.90, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahGIBNUosz64YFiBlG1qdAAAAJU"], referer: https://expressinteriors.com/wp-login.php
[Sat May 23 19:21:40.223978 2026] [autoindex:error] [pid 30940:tid 30954] [client 104.214.188.148:49194] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Sat May 23 22:44:02.282012 2026] [:error] [pid 30941:tid 30979] [client 65.254.225.225:49334] [client 65.254.225.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahG9MnTIgjSDhiZmvlUYNQAAAEM"]
[Sat May 23 22:44:03.513075 2026] [:error] [pid 30941:tid 30986] [client 65.254.225.225:49334] [client 65.254.225.225] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 65.254.225.225, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahG9M3TIgjSDhiZmvlUYOwAAAEo"], referer: https://expressinteriors.com/wp-login.php
[Sat May 23 22:57:59.643103 2026] [:error] [pid 44296:tid 44309] [client 43.165.167.72:36700] [client 43.165.167.72] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahHAd5drUdFI6ijvMkmmPAAAAUs"]
[Sat May 23 23:57:21.666780 2026] [:error] [pid 44296:tid 44308] [client 20.196.97.33:4999] [client 20.196.97.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "ahHOYZdrUdFI6ijvMkmw1gAAAUo"]
[Sat May 23 23:57:22.292111 2026] [:error] [pid 31039:tid 31064] [client 20.196.97.33:3518] [client 20.196.97.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "ahHOYqIYDYo8WvA5zLJhcwAAANc"]
[Sat May 23 23:57:23.447756 2026] [:error] [pid 30942:tid 31015] [client 20.196.97.33:1801] [client 20.196.97.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "ahHOY9Uosz64YFiBlG2OaAAAAIw"]
[Sat May 23 23:57:24.350218 2026] [:error] [pid 44326:tid 44359] [client 20.196.97.33:1828] [client 20.196.97.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "ahHOZMyrPrcAqE-FOKLUQgAAAcQ"]
[Sun May 24 01:55:12.076466 2026] [:error] [pid 30941:tid 30990] [client 182.93.80.120:51522] [client 182.93.80.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 182.93.80.120, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahHqAHTIgjSDhiZmvlVbpAAAAE4"]
[Sun May 24 01:55:12.966873 2026] [:error] [pid 30941:tid 30986] [client 182.93.80.120:51522] [client 182.93.80.120] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 182.93.80.120, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahHqAHTIgjSDhiZmvlVbpQAAAEo"], referer: https://expressinteriors.com/wp-login.php
[Sun May 24 02:13:38.664628 2026] [:error] [pid 44325:tid 44346] [client 159.203.25.248:59132] [client 159.203.25.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.203.25.248, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahHuUlgUQb4puB_2yV9r8wAAAZI"]
[Sun May 24 02:13:41.396136 2026] [:error] [pid 44325:tid 44344] [client 159.203.25.248:59132] [client 159.203.25.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 159.203.25.248, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahHuVVgUQb4puB_2yV9r-gAAAZA"], referer: https://expressinteriors.com/wp-login.php
[Sun May 24 03:18:52.602182 2026] [:error] [pid 44296:tid 44311] [client 87.106.70.198:49094] [client 87.106.70.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 87.106.70.198, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahH9nJdrUdFI6ijvMknXLgAAAU0"]
[Sun May 24 03:18:53.647355 2026] [:error] [pid 44296:tid 44300] [client 87.106.70.198:49094] [client 87.106.70.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 87.106.70.198, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahH9nZdrUdFI6ijvMknXLwAAAUI"], referer: https://expressinteriors.com/wp-login.php
[Sun May 24 04:07:25.006366 2026] [:error] [pid 50978:tid 50999] [client 45.133.176.18:28685] [client 45.133.176.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.133.176.18, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahII_Su0qFnUKJJuyO5t5AAAAMw"]
[Sun May 24 04:07:28.813798 2026] [:error] [pid 58521:tid 58525] [client 45.133.176.49:38615] [client 45.133.176.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.133.176.49, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahIJAGu03QVCX-cF2G-5pQAAAQI"]
[Sun May 24 04:07:35.002967 2026] [:error] [pid 58797:tid 58819] [client 45.133.176.32:23197] [client 45.133.176.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.133.176.32, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahIJB_zoIKLVypLB5NgGBAAAAVM"]
[Sun May 24 04:07:42.524921 2026] [:error] [pid 58918:tid 58922] [client 45.133.176.18:26327] [client 45.133.176.18] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.133.176.18, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahIJDqT5tvv40jh4HYbhVwAAAYI"]
[Sun May 24 04:07:48.243251 2026] [:error] [pid 50978:tid 50988] [client 45.133.176.29:32955] [client 45.133.176.29] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.133.176.29, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahIJFCu0qFnUKJJuyO5uHwAAAMM"]
[Sun May 24 04:07:52.685683 2026] [:error] [pid 58521:tid 58527] [client 45.133.176.33:28819] [client 45.133.176.33] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.133.176.33, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahIJGGu03QVCX-cF2G-6FgAAAQQ"]
[Sun May 24 04:07:56.535830 2026] [:error] [pid 50873:tid 50957] [client 45.133.176.41:57253] [client 45.133.176.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.133.176.41, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahIJHOlYxsqwDcWZbhK9dAAAAJE"]
[Sun May 24 04:07:58.874816 2026] [:error] [pid 58797:tid 58803] [client 45.133.176.38:39017] [client 45.133.176.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.133.176.38, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahIJHvzoIKLVypLB5NgGSQAAAUM"]
[Sun May 24 04:08:30.859399 2026] [:error] [pid 58918:tid 58920] [client 45.133.176.19:51651] [client 45.133.176.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.133.176.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahIJPqT5tvv40jh4HYbhlwAAAYA"]
[Sun May 24 04:08:32.775107 2026] [:error] [pid 58797:tid 58814] [client 45.133.176.30:52293] [client 45.133.176.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.133.176.30, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahIJQPzoIKLVypLB5NgGhQAAAU4"]
[Sun May 24 04:09:37.628465 2026] [:error] [pid 58918:tid 58942] [client 193.46.81.195:54220] [client 193.46.81.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ahIJgaT5tvv40jh4HYbiQwAAAZY"]
[Sun May 24 04:13:20.851340 2026] [:error] [pid 50873:tid 50960] [client 205.185.121.3:51414] [client 205.185.121.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 205.185.121.3, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahIKYOlYxsqwDcWZbhK-FgAAAJQ"]
[Sun May 24 04:16:21.666388 2026] [:error] [pid 58521:tid 58543] [client 205.185.121.3:59933] [client 205.185.121.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 205.185.121.3, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahILFWu03QVCX-cF2G-8QAAAARQ"]
[Sun May 24 05:11:33.556638 2026] [:error] [pid 58797:tid 58824] [client 43.130.39.254:41712] [client 43.130.39.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahIYBfzoIKLVypLB5NgdoQAAAVg"]
[Sun May 24 06:16:22.725041 2026] [:error] [pid 58918:tid 58940] [client 103.174.152.203:42830] [client 103.174.152.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.174.152.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahInNqT5tvv40jh4HYYNVAAAAZQ"]
[Sun May 24 06:16:27.556848 2026] [:error] [pid 58918:tid 58932] [client 103.174.152.203:42830] [client 103.174.152.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.174.152.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahInO6T5tvv40jh4HYYNXgAAAYw"], referer: https://expressinteriors.com/wp-login.php
[Sun May 24 07:01:13.380606 2026] [:error] [pid 50873:tid 50958] [client 109.118.84.43:23734] [client 109.118.84.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.118.84.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahIxuelYxsqwDcWZbhLSrQAAAJI"]
[Sun May 24 07:02:58.629687 2026] [:error] [pid 58797:tid 58823] [client 109.118.84.43:14201] [client 109.118.84.43] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahIyIvzoIKLVypLB5NgvegAAAVc"]
[Sun May 24 07:03:25.659894 2026] [:error] [pid 50873:tid 50949] [client 109.118.84.43:29212] [client 109.118.84.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.118.84.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahIyPelYxsqwDcWZbhLTQwAAAIk"]
[Sun May 24 07:03:56.581326 2026] [:error] [pid 58797:tid 58803] [client 109.118.84.43:29270] [client 109.118.84.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.118.84.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahIyXPzoIKLVypLB5NgvlAAAAUM"]
[Sun May 24 07:04:25.584752 2026] [:error] [pid 58918:tid 58944] [client 109.118.84.43:29282] [client 109.118.84.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.118.84.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahIyeaT5tvv40jh4HYYawwAAAZg"]
[Sun May 24 07:04:52.963384 2026] [:error] [pid 50978:tid 50985] [client 109.118.84.43:29251] [client 109.118.84.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.118.84.43, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahIylCu0qFnUKJJuyO6I3AAAAMA"]
[Sun May 24 09:58:13.822558 2026] [:error] [pid 49744:tid 49766] [client 20.63.33.98:23606] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahJbNTsE5kPdFpUbbHFpfQAAANQ"]
[Sun May 24 09:58:14.259173 2026] [:error] [pid 49775:tid 49777] [client 20.63.33.98:23582] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahJbNovZb8G6T8WpI1ghQwAAAAA"]
[Sun May 24 09:58:14.692379 2026] [:error] [pid 49688:tid 49713] [client 20.63.33.98:23583] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahJbNmYoQ9V6a_4pBshiMAAAAFY"]
[Sun May 24 09:58:15.128964 2026] [:error] [pid 49688:tid 49694] [client 20.63.33.98:23613] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahJbN2YoQ9V6a_4pBshiMQAAAEM"]
[Sun May 24 09:58:15.599789 2026] [:error] [pid 49688:tid 49701] [client 20.63.33.98:23588] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "ahJbN2YoQ9V6a_4pBshiNQAAAEo"]
[Sun May 24 09:58:16.028590 2026] [:error] [pid 49688:tid 49706] [client 20.63.33.98:10217] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "ahJbOGYoQ9V6a_4pBshiOAAAAE8"]
[Sun May 24 09:58:16.457706 2026] [:error] [pid 49689:tid 49737] [client 20.63.33.98:10503] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "ahJbOAaxiY3NxLUD97UbuQAAAJM"]
[Sun May 24 09:58:16.887141 2026] [:error] [pid 49689:tid 49736] [client 20.63.33.98:10515] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "ahJbOAaxiY3NxLUD97UbuwAAAJI"]
[Sun May 24 09:58:17.314102 2026] [:error] [pid 49689:tid 49725] [client 20.63.33.98:10182] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "ahJbOQaxiY3NxLUD97UbvgAAAIc"]
[Sun May 24 09:58:17.741827 2026] [:error] [pid 49688:tid 49710] [client 20.63.33.98:10532] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "ahJbOWYoQ9V6a_4pBshiPAAAAFM"]
[Sun May 24 09:58:18.175167 2026] [:error] [pid 49689:tid 49734] [client 20.63.33.98:10528] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "ahJbOgaxiY3NxLUD97UbwwAAAJA"]
[Sun May 24 09:58:18.659787 2026] [:error] [pid 49688:tid 49700] [client 20.63.33.98:23570] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "ahJbOmYoQ9V6a_4pBshiPwAAAEk"]
[Sun May 24 09:58:19.092363 2026] [:error] [pid 49775:tid 49781] [client 20.63.33.98:14729] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-der.php"] [unique_id "ahJbO4vZb8G6T8WpI1ghTQAAAAQ"]
[Sun May 24 09:58:19.521447 2026] [:error] [pid 49688:tid 49707] [client 20.63.33.98:10194] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-der.php"] [unique_id "ahJbO2YoQ9V6a_4pBshiQAAAAFA"]
[Sun May 24 09:58:19.952944 2026] [:error] [pid 49688:tid 49713] [client 20.63.33.98:23577] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-der.php"] [unique_id "ahJbO2YoQ9V6a_4pBshiQgAAAFY"]
[Sun May 24 09:58:20.412552 2026] [:error] [pid 49688:tid 49694] [client 20.63.33.98:23592] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-der.php"] [unique_id "ahJbPGYoQ9V6a_4pBshiRQAAAEM"]
[Sun May 24 09:58:20.852469 2026] [:error] [pid 49775:tid 49791] [client 20.63.33.98:10227] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftde.php"] [unique_id "ahJbPIvZb8G6T8WpI1ghVQAAAA4"]
[Sun May 24 09:58:21.272165 2026] [:error] [pid 49775:tid 49786] [client 20.63.33.98:10190] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftde.php"] [unique_id "ahJbPYvZb8G6T8WpI1ghVgAAAAk"]
[Sun May 24 09:58:21.700672 2026] [:error] [pid 49689:tid 49719] [client 20.63.33.98:10204] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftde.php"] [unique_id "ahJbPQaxiY3NxLUD97UbxgAAAIE"]
[Sun May 24 09:58:22.145586 2026] [:error] [pid 49744:tid 49770] [client 20.63.33.98:23612] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftde.php"] [unique_id "ahJbPjsE5kPdFpUbbHFphAAAANg"]
[Sun May 24 09:58:22.573141 2026] [:error] [pid 49775:tid 49800] [client 20.63.33.98:10193] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "ahJbPovZb8G6T8WpI1ghWAAAABc"]
[Sun May 24 09:58:23.005638 2026] [:error] [pid 49775:tid 49796] [client 20.63.33.98:10192] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "ahJbP4vZb8G6T8WpI1ghWQAAABM"]
[Sun May 24 09:58:23.435722 2026] [:error] [pid 49689:tid 49720] [client 20.63.33.98:23580] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "ahJbPwaxiY3NxLUD97UbxwAAAII"]
[Sun May 24 09:58:23.863971 2026] [:error] [pid 49689:tid 49740] [client 20.63.33.98:10537] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "ahJbPwaxiY3NxLUD97UbyQAAAJY"]
[Sun May 24 09:58:24.283386 2026] [:error] [pid 49689:tid 49722] [client 20.63.33.98:23600] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "ahJbQAaxiY3NxLUD97UbygAAAIQ"]
[Sun May 24 09:58:24.776525 2026] [:error] [pid 49689:tid 49721] [client 20.63.33.98:10237] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "ahJbQAaxiY3NxLUD97UbzQAAAIM"]
[Sun May 24 09:58:25.214249 2026] [:error] [pid 49775:tid 49801] [client 20.63.33.98:23572] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "ahJbQYvZb8G6T8WpI1ghYAAAABg"]
[Sun May 24 09:58:25.634122 2026] [:error] [pid 49744:tid 49766] [client 20.63.33.98:10211] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "ahJbQTsE5kPdFpUbbHFpiwAAANQ"]
[Sun May 24 09:58:26.065353 2026] [:error] [pid 49775:tid 49790] [client 20.63.33.98:10509] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "ahJbQovZb8G6T8WpI1ghZQAAAA0"]
[Sun May 24 09:58:26.501893 2026] [:error] [pid 49775:tid 49781] [client 20.63.33.98:10555] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "ahJbQovZb8G6T8WpI1ghZwAAAAQ"]
[Sun May 24 09:58:26.931119 2026] [:error] [pid 49775:tid 49795] [client 20.63.33.98:23604] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "ahJbQovZb8G6T8WpI1ghaAAAABI"]
[Sun May 24 09:58:27.374204 2026] [:error] [pid 49744:tid 49761] [client 20.63.33.98:23603] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "ahJbQzsE5kPdFpUbbHFpjwAAAM8"]
[Sun May 24 09:58:27.851144 2026] [:error] [pid 49688:tid 49700] [client 20.63.33.98:10236] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "ahJbQ2YoQ9V6a_4pBshiTgAAAEk"]
[Sun May 24 09:58:28.279004 2026] [:error] [pid 49775:tid 49784] [client 20.63.33.98:10224] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "ahJbRIvZb8G6T8WpI1ghbgAAAAc"]
[Sun May 24 09:58:28.700456 2026] [:error] [pid 49744:tid 49752] [client 20.63.33.98:23556] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "ahJbRDsE5kPdFpUbbHFpkQAAAMY"]
[Sun May 24 09:58:29.133678 2026] [:error] [pid 49775:tid 49799] [client 20.63.33.98:23595] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "ahJbRYvZb8G6T8WpI1ghcAAAABY"]
[Sun May 24 09:58:29.559077 2026] [:error] [pid 49775:tid 49792] [client 20.63.33.98:10210] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wuasr.php"] [unique_id "ahJbRYvZb8G6T8WpI1ghcQAAAA8"]
[Sun May 24 09:58:30.014078 2026] [:error] [pid 49775:tid 49777] [client 20.63.33.98:14757] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wuasr.php"] [unique_id "ahJbRovZb8G6T8WpI1ghcwAAAAA"]
[Sun May 24 09:58:30.449910 2026] [:error] [pid 49689:tid 49726] [client 20.63.33.98:23571] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wuasr.php"] [unique_id "ahJbRgaxiY3NxLUD97Ub1AAAAIg"]
[Sun May 24 09:58:30.870187 2026] [:error] [pid 49775:tid 49779] [client 20.63.33.98:10508] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wuasr.php"] [unique_id "ahJbRovZb8G6T8WpI1gheAAAAAI"]
[Sun May 24 09:58:31.290128 2026] [:error] [pid 49744:tid 49763] [client 20.63.33.98:10180] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "ahJbRzsE5kPdFpUbbHFplQAAANE"]
[Sun May 24 09:58:31.725120 2026] [:error] [pid 49689:tid 49722] [client 20.63.33.98:10497] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "ahJbRwaxiY3NxLUD97Ub1gAAAIQ"]
[Sun May 24 09:58:32.166103 2026] [:error] [pid 49689:tid 49730] [client 20.63.33.98:10540] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "ahJbSAaxiY3NxLUD97Ub1wAAAIw"]
[Sun May 24 09:58:32.603115 2026] [:error] [pid 49744:tid 49761] [client 20.63.33.98:10546] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "ahJbSDsE5kPdFpUbbHFpmQAAAM8"]
[Sun May 24 09:58:33.034689 2026] [:error] [pid 49744:tid 49753] [client 20.63.33.98:10232] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "ahJbSTsE5kPdFpUbbHFpnQAAAMc"]
[Sun May 24 09:58:33.462811 2026] [:error] [pid 49744:tid 49755] [client 20.63.33.98:23586] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "ahJbSTsE5kPdFpUbbHFpnwAAAMk"]
[Sun May 24 09:58:33.942133 2026] [:error] [pid 49688:tid 49709] [client 20.63.33.98:14728] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "ahJbSWYoQ9V6a_4pBshiWAAAAFI"]
[Sun May 24 09:58:34.378466 2026] [:error] [pid 49689:tid 49738] [client 20.63.33.98:23590] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "ahJbSgaxiY3NxLUD97Ub2gAAAJQ"]
[Sun May 24 09:58:34.804018 2026] [:error] [pid 49688:tid 49707] [client 20.63.33.98:10543] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wefile.php"] [unique_id "ahJbSmYoQ9V6a_4pBshiXAAAAFA"]
[Sun May 24 09:58:35.237916 2026] [:error] [pid 49744:tid 49757] [client 20.63.33.98:10199] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wefile.php"] [unique_id "ahJbSzsE5kPdFpUbbHFpqQAAAMs"]
[Sun May 24 09:58:35.718821 2026] [:error] [pid 49744:tid 49752] [client 20.63.33.98:10209] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wefile.php"] [unique_id "ahJbSzsE5kPdFpUbbHFprgAAAMY"]
[Sun May 24 09:58:36.149469 2026] [:error] [pid 49744:tid 49767] [client 20.63.33.98:10207] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wefile.php"] [unique_id "ahJbTDsE5kPdFpUbbHFpsQAAANU"]
[Sun May 24 09:58:36.576142 2026] [:error] [pid 49689:tid 49725] [client 20.63.33.98:10223] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "ahJbTAaxiY3NxLUD97Ub3QAAAIc"]
[Sun May 24 09:58:37.014229 2026] [:error] [pid 49744:tid 49749] [client 20.63.33.98:23564] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "ahJbTTsE5kPdFpUbbHFpswAAAMM"]
[Sun May 24 09:58:37.444687 2026] [:error] [pid 49775:tid 49786] [client 20.63.33.98:23579] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "ahJbTYvZb8G6T8WpI1ghfQAAAAk"]
[Sun May 24 09:58:37.931481 2026] [:error] [pid 49775:tid 49791] [client 20.63.33.98:10183] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "ahJbTYvZb8G6T8WpI1ghfwAAAA4"]
[Sun May 24 09:58:38.364862 2026] [:error] [pid 49689:tid 49722] [client 20.63.33.98:23609] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "ahJbTgaxiY3NxLUD97Ub4AAAAIQ"]
[Sun May 24 09:58:38.824595 2026] [:error] [pid 49775:tid 49797] [client 20.63.33.98:14753] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "ahJbTovZb8G6T8WpI1ghhgAAABQ"]
[Sun May 24 09:58:39.256409 2026] [:error] [pid 49744:tid 49753] [client 20.63.33.98:10234] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "ahJbTzsE5kPdFpUbbHFpuAAAAMc"]
[Sun May 24 09:58:39.680813 2026] [:error] [pid 49744:tid 49758] [client 20.63.33.98:10196] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "ahJbTzsE5kPdFpUbbHFpuQAAAMw"]
[Sun May 24 09:58:40.104050 2026] [:error] [pid 49688:tid 49710] [client 20.63.33.98:10189] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "ahJbUGYoQ9V6a_4pBshiYwAAAFM"]
[Sun May 24 09:58:40.535733 2026] [:error] [pid 49689:tid 49719] [client 20.63.33.98:23557] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "ahJbUAaxiY3NxLUD97Ub5AAAAIE"]
[Sun May 24 09:58:41.015532 2026] [:error] [pid 49775:tid 49785] [client 20.63.33.98:10176] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "ahJbUYvZb8G6T8WpI1ghjAAAAAg"]
[Sun May 24 09:58:41.448475 2026] [:error] [pid 49775:tid 49784] [client 20.63.33.98:10539] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "ahJbUYvZb8G6T8WpI1ghjwAAAAc"]
[Sun May 24 09:58:41.876747 2026] [:error] [pid 49775:tid 49801] [client 20.63.33.98:10231] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "ahJbUYvZb8G6T8WpI1ghkwAAABg"]
[Sun May 24 09:58:42.301019 2026] [:error] [pid 49689:tid 49739] [client 20.63.33.98:10233] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "ahJbUgaxiY3NxLUD97Ub5wAAAJU"]
[Sun May 24 09:58:42.732623 2026] [:error] [pid 49775:tid 49789] [client 20.63.33.98:23607] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "ahJbUovZb8G6T8WpI1ghlwAAAAw"]
[Sun May 24 09:58:43.184657 2026] [:error] [pid 49744:tid 49761] [client 20.63.33.98:10556] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "ahJbUzsE5kPdFpUbbHFpvAAAAM8"]
[Sun May 24 09:58:43.621355 2026] [:error] [pid 49689:tid 49742] [client 20.63.33.98:10501] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "ahJbUwaxiY3NxLUD97Ub6QAAAJg"]
[Sun May 24 09:58:44.256584 2026] [:error] [pid 49688:tid 49700] [client 20.63.33.98:10526] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "ahJbVGYoQ9V6a_4pBshibgAAAEk"]
[Sun May 24 09:58:44.686588 2026] [:error] [pid 49689:tid 49726] [client 20.63.33.98:14725] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "ahJbVAaxiY3NxLUD97Ub6gAAAIg"]
[Sun May 24 09:58:45.190218 2026] [:error] [pid 49775:tid 49792] [client 20.63.33.98:10218] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "ahJbVYvZb8G6T8WpI1ghnwAAAA8"]
[Sun May 24 09:58:45.618251 2026] [:error] [pid 49688:tid 49694] [client 20.63.33.98:10221] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "ahJbVWYoQ9V6a_4pBshicAAAAEM"]
[Sun May 24 09:58:46.258072 2026] [:error] [pid 49775:tid 49791] [client 20.63.33.98:10558] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "ahJbVovZb8G6T8WpI1ghpAAAAA4"]
[Sun May 24 09:58:46.803535 2026] [:error] [pid 49688:tid 49713] [client 20.63.33.98:23566] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "ahJbVmYoQ9V6a_4pBshicgAAAFY"]
[Sun May 24 09:58:47.312692 2026] [:error] [pid 49775:tid 49778] [client 20.63.33.98:17011] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "ahJbV4vZb8G6T8WpI1ghqAAAAAE"]
[Sun May 24 09:58:47.770520 2026] [:error] [pid 49689:tid 49723] [client 20.63.33.98:10549] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "ahJbVwaxiY3NxLUD97Ub7AAAAIU"]
[Sun May 24 09:58:48.504507 2026] [:error] [pid 49744:tid 49752] [client 20.63.33.98:23601] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "ahJbWDsE5kPdFpUbbHFpxgAAAMY"]
[Sun May 24 09:58:48.971286 2026] [:error] [pid 49775:tid 49800] [client 20.63.33.98:14775] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "ahJbWIvZb8G6T8WpI1ghsQAAABc"]
[Sun May 24 09:58:49.633481 2026] [:error] [pid 49744:tid 49759] [client 20.63.33.98:14723] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "ahJbWTsE5kPdFpUbbHFpyAAAAM0"]
[Sun May 24 09:58:50.120382 2026] [:error] [pid 49744:tid 49761] [client 20.63.33.98:10542] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-wz.php"] [unique_id "ahJbWjsE5kPdFpUbbHFpyQAAAM8"]
[Sun May 24 09:58:50.601571 2026] [:error] [pid 49775:tid 49788] [client 20.63.33.98:23602] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-wz.php"] [unique_id "ahJbWovZb8G6T8WpI1ghuwAAAAs"]
[Sun May 24 09:58:51.092918 2026] [:error] [pid 49688:tid 49696] [client 20.63.33.98:23593] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-wz.php"] [unique_id "ahJbW2YoQ9V6a_4pBshieQAAAEU"]
[Sun May 24 09:58:51.674751 2026] [:error] [pid 49689:tid 49741] [client 20.63.33.98:14774] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-wz.php"] [unique_id "ahJbWwaxiY3NxLUD97Ub8QAAAJc"]
[Sun May 24 09:58:52.127597 2026] [:error] [pid 49688:tid 49692] [client 20.63.33.98:10195] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/crgio.php"] [unique_id "ahJbXGYoQ9V6a_4pBshiewAAAEE"]
[Sun May 24 09:58:52.749757 2026] [:error] [pid 49775:tid 49792] [client 20.63.33.98:23575] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/crgio.php"] [unique_id "ahJbXIvZb8G6T8WpI1ghwAAAAA8"]
[Sun May 24 09:58:53.195622 2026] [:error] [pid 49689:tid 49728] [client 20.63.33.98:10507] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/crgio.php"] [unique_id "ahJbXQaxiY3NxLUD97Ub9wAAAIo"]
[Sun May 24 09:58:53.779574 2026] [:error] [pid 49689:tid 49726] [client 20.63.33.98:23578] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/crgio.php"] [unique_id "ahJbXQaxiY3NxLUD97Ub-QAAAIg"]
[Sun May 24 09:58:54.298130 2026] [:error] [pid 49744:tid 49756] [client 20.63.33.98:14766] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "ahJbXjsE5kPdFpUbbHFpzQAAAMo"]
[Sun May 24 09:58:54.814003 2026] [:error] [pid 49688:tid 49714] [client 20.63.33.98:23611] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "ahJbXmYoQ9V6a_4pBshihQAAAFc"]
[Sun May 24 09:58:55.291500 2026] [:error] [pid 49775:tid 49797] [client 20.63.33.98:14764] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "ahJbX4vZb8G6T8WpI1ghxwAAABQ"]
[Sun May 24 09:58:55.931736 2026] [:error] [pid 49775:tid 49783] [client 20.63.33.98:14741] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "ahJbX4vZb8G6T8WpI1ghygAAAAY"]
[Sun May 24 09:58:56.566291 2026] [:error] [pid 49688:tid 49710] [client 20.63.33.98:10206] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ahJbYGYoQ9V6a_4pBshiiQAAAFM"]
[Sun May 24 09:58:57.107986 2026] [:error] [pid 49744:tid 49765] [client 20.63.33.98:10203] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ahJbYTsE5kPdFpUbbHFpzgAAANM"]
[Sun May 24 09:58:57.561178 2026] [:error] [pid 49775:tid 49787] [client 20.63.33.98:10535] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ahJbYYvZb8G6T8WpI1gh0wAAAAo"]
[Sun May 24 09:58:58.100332 2026] [:error] [pid 49744:tid 49760] [client 20.63.33.98:14724] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp.php"] [unique_id "ahJbYjsE5kPdFpUbbHFp0AAAAM4"]
[Sun May 24 09:58:58.561004 2026] [:error] [pid 49688:tid 49698] [client 20.63.33.98:23565] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "ahJbYmYoQ9V6a_4pBshijAAAAEc"]
[Sun May 24 09:58:59.079711 2026] [:error] [pid 49688:tid 49711] [client 20.63.33.98:10226] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "ahJbY2YoQ9V6a_4pBshijwAAAFQ"]
[Sun May 24 09:58:59.548739 2026] [:error] [pid 49688:tid 49691] [client 20.63.33.98:10205] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "ahJbY2YoQ9V6a_4pBshikgAAAEA"]
[Sun May 24 09:59:00.002758 2026] [:error] [pid 49689:tid 49732] [client 20.63.33.98:23573] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccou.php"] [unique_id "ahJbZAaxiY3NxLUD97UcCAAAAI4"]
[Sun May 24 09:59:00.506296 2026] [:error] [pid 49689:tid 49730] [client 20.63.33.98:10510] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/db.php"] [unique_id "ahJbZAaxiY3NxLUD97UcCwAAAIw"]
[Sun May 24 09:59:00.942376 2026] [:error] [pid 49688:tid 49698] [client 20.63.33.98:14727] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/db.php"] [unique_id "ahJbZGYoQ9V6a_4pBshimgAAAEc"]
[Sun May 24 09:59:01.393219 2026] [:error] [pid 49689:tid 49725] [client 20.63.33.98:16989] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/db.php"] [unique_id "ahJbZQaxiY3NxLUD97UcDQAAAIc"]
[Sun May 24 09:59:01.874593 2026] [:error] [pid 49775:tid 49778] [client 20.63.33.98:14771] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/db.php"] [unique_id "ahJbZYvZb8G6T8WpI1gh2wAAAAE"]
[Sun May 24 09:59:02.315215 2026] [:error] [pid 49744:tid 49767] [client 20.63.33.98:23610] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "ahJbZjsE5kPdFpUbbHFp1wAAANU"]
[Sun May 24 09:59:02.750770 2026] [:error] [pid 49744:tid 49758] [client 20.63.33.98:23555] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "ahJbZjsE5kPdFpUbbHFp2AAAAMw"]
[Sun May 24 09:59:03.210916 2026] [:error] [pid 49775:tid 49800] [client 20.63.33.98:18773] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "ahJbZ4vZb8G6T8WpI1gh4QAAABc"]
[Sun May 24 09:59:03.748772 2026] [:error] [pid 49688:tid 49703] [client 20.63.33.98:14761] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "ahJbZ2YoQ9V6a_4pBshioQAAAEw"]
[Sun May 24 09:59:04.186151 2026] [:error] [pid 49775:tid 49798] [client 20.63.33.98:23569] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "ahJbaIvZb8G6T8WpI1gh6wAAABU"]
[Sun May 24 09:59:04.703168 2026] [:error] [pid 49775:tid 49794] [client 20.63.33.98:10544] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "ahJbaIvZb8G6T8WpI1gh7wAAABE"]
[Sun May 24 09:59:05.133455 2026] [:error] [pid 49775:tid 49782] [client 20.63.33.98:10506] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "ahJbaYvZb8G6T8WpI1gh9AAAAAU"]
[Sun May 24 09:59:05.623306 2026] [:error] [pid 49775:tid 49795] [client 20.63.33.98:10208] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yellow.php"] [unique_id "ahJbaYvZb8G6T8WpI1gh9gAAABI"]
[Sun May 24 09:59:06.042809 2026] [:error] [pid 49775:tid 49799] [client 20.63.33.98:16973] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mifta.php"] [unique_id "ahJbaovZb8G6T8WpI1gh-AAAABY"]
[Sun May 24 09:59:06.523180 2026] [:error] [pid 49775:tid 49778] [client 20.63.33.98:18765] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mifta.php"] [unique_id "ahJbaovZb8G6T8WpI1gh_QAAAAE"]
[Sun May 24 09:59:06.965603 2026] [:error] [pid 49775:tid 49787] [client 20.63.33.98:10222] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mifta.php"] [unique_id "ahJbaovZb8G6T8WpI1gh_wAAAAo"]
[Sun May 24 09:59:07.404728 2026] [:error] [pid 49689:tid 49736] [client 20.63.33.98:16992] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mifta.php"] [unique_id "ahJbawaxiY3NxLUD97UcFAAAAJI"]
[Sun May 24 09:59:07.836223 2026] [:error] [pid 49775:tid 49791] [client 20.63.33.98:16991] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-firewall.php"] [unique_id "ahJba4vZb8G6T8WpI1giBQAAAA4"]
[Sun May 24 09:59:08.264792 2026] [:error] [pid 49775:tid 49795] [client 20.63.33.98:10496] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-firewall.php"] [unique_id "ahJbbIvZb8G6T8WpI1giCQAAABI"]
[Sun May 24 09:59:08.694924 2026] [:error] [pid 49775:tid 49778] [client 20.63.33.98:23585] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-firewall.php"] [unique_id "ahJbbIvZb8G6T8WpI1giDAAAAAE"]
[Sun May 24 09:59:09.139544 2026] [:error] [pid 49775:tid 49787] [client 20.63.33.98:23608] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-firewall.php"] [unique_id "ahJbbYvZb8G6T8WpI1giDQAAAAo"]
[Sun May 24 09:59:09.577704 2026] [:error] [pid 49744:tid 49769] [client 20.63.33.98:18752] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fun.php"] [unique_id "ahJbbTsE5kPdFpUbbHFp4gAAANc"]
[Sun May 24 09:59:10.017412 2026] [:error] [pid 49688:tid 49702] [client 20.63.33.98:14745] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fun.php"] [unique_id "ahJbbmYoQ9V6a_4pBshirQAAAEs"]
[Sun May 24 09:59:10.438454 2026] [:error] [pid 49744:tid 49755] [client 20.63.33.98:23559] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fun.php"] [unique_id "ahJbbjsE5kPdFpUbbHFp5AAAAMk"]
[Sun May 24 09:59:10.889963 2026] [:error] [pid 49744:tid 49762] [client 20.63.33.98:10239] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fun.php"] [unique_id "ahJbbjsE5kPdFpUbbHFp5wAAANA"]
[Sun May 24 09:59:11.316475 2026] [:error] [pid 49744:tid 49763] [client 20.63.33.98:10216] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drykl.php"] [unique_id "ahJbbzsE5kPdFpUbbHFp6gAAANE"]
[Sun May 24 09:59:11.736511 2026] [:error] [pid 49744:tid 49748] [client 20.63.33.98:10522] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drykl.php"] [unique_id "ahJbbzsE5kPdFpUbbHFp7QAAAMI"]
[Sun May 24 09:59:12.170945 2026] [:error] [pid 49775:tid 49795] [client 20.63.33.98:34243] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drykl.php"] [unique_id "ahJbcIvZb8G6T8WpI1giEAAAABI"]
[Sun May 24 09:59:12.602809 2026] [:error] [pid 49688:tid 49691] [client 20.63.33.98:10186] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drykl.php"] [unique_id "ahJbcGYoQ9V6a_4pBshitgAAAEA"]
[Sun May 24 09:59:22.332382 2026] [:error] [pid 49688:tid 49699] [client 20.63.33.98:10215] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff.php"] [unique_id "ahJbemYoQ9V6a_4pBshi0QAAAEg"]
[Sun May 24 09:59:22.780134 2026] [:error] [pid 49775:tid 49792] [client 20.63.33.98:14756] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff.php"] [unique_id "ahJbeovZb8G6T8WpI1giPgAAAA8"]
[Sun May 24 09:59:23.214461 2026] [:error] [pid 49775:tid 49797] [client 20.63.33.98:23599] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff.php"] [unique_id "ahJbe4vZb8G6T8WpI1giQQAAABQ"]
[Sun May 24 09:59:23.701702 2026] [:error] [pid 49744:tid 49761] [client 20.63.33.98:14749] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff.php"] [unique_id "ahJbezsE5kPdFpUbbHFqFAAAAM8"]
[Sun May 24 09:59:24.122908 2026] [:error] [pid 49744:tid 49770] [client 20.63.33.98:18808] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "ahJbfDsE5kPdFpUbbHFqGAAAANg"]
[Sun May 24 09:59:24.588541 2026] [:error] [pid 49689:tid 49725] [client 20.63.33.98:14768] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "ahJbfAaxiY3NxLUD97UcMQAAAIc"]
[Sun May 24 09:59:25.049205 2026] [:error] [pid 49744:tid 49760] [client 20.63.33.98:18754] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "ahJbfTsE5kPdFpUbbHFqHQAAAM4"]
[Sun May 24 09:59:25.500173 2026] [:error] [pid 49744:tid 49750] [client 20.63.33.98:23552] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "ahJbfTsE5kPdFpUbbHFqHgAAAMQ"]
[Sun May 24 09:59:25.975793 2026] [:error] [pid 49689:tid 49741] [client 20.63.33.98:23594] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/png.php"] [unique_id "ahJbfQaxiY3NxLUD97UcNQAAAJc"]
[Sun May 24 09:59:26.423920 2026] [:error] [pid 49689:tid 49734] [client 20.63.33.98:23598] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/png.php"] [unique_id "ahJbfgaxiY3NxLUD97UcOgAAAJA"]
[Sun May 24 09:59:26.911032 2026] [:error] [pid 49689:tid 49719] [client 20.63.33.98:10179] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/png.php"] [unique_id "ahJbfgaxiY3NxLUD97UcPgAAAIE"]
[Sun May 24 09:59:27.553908 2026] [:error] [pid 49744:tid 49755] [client 20.63.33.98:23574] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/png.php"] [unique_id "ahJbfzsE5kPdFpUbbHFqIgAAAMk"]
[Sun May 24 09:59:28.004524 2026] [:error] [pid 49689:tid 49723] [client 20.63.33.98:10197] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "ahJbgAaxiY3NxLUD97UcQwAAAIU"]
[Sun May 24 09:59:28.493805 2026] [:error] [pid 49744:tid 49757] [client 20.63.33.98:18789] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "ahJbgDsE5kPdFpUbbHFqIwAAAMs"]
[Sun May 24 09:59:28.930309 2026] [:error] [pid 49689:tid 49732] [client 20.63.33.98:14739] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "ahJbgAaxiY3NxLUD97UcSQAAAI4"]
[Sun May 24 09:59:29.412710 2026] [:error] [pid 49689:tid 49719] [client 20.63.33.98:18785] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "ahJbgQaxiY3NxLUD97UcSwAAAIE"]
[Sun May 24 09:59:29.871569 2026] [:error] [pid 49775:tid 49786] [client 20.63.33.98:10527] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "ahJbgYvZb8G6T8WpI1giSQAAAAk"]
[Sun May 24 09:59:30.369777 2026] [:error] [pid 49689:tid 49731] [client 20.63.33.98:14758] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "ahJbggaxiY3NxLUD97UcUAAAAI0"]
[Sun May 24 09:59:30.815055 2026] [:error] [pid 49689:tid 49741] [client 20.63.33.98:23581] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "ahJbggaxiY3NxLUD97UcUwAAAJc"]
[Sun May 24 09:59:31.284841 2026] [:error] [pid 49744:tid 49757] [client 20.63.33.98:10230] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "ahJbgzsE5kPdFpUbbHFqLgAAAMs"]
[Sun May 24 09:59:31.718647 2026] [:error] [pid 49689:tid 49727] [client 20.63.33.98:16970] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/forbidals.php"] [unique_id "ahJbgwaxiY3NxLUD97UcWAAAAIk"]
[Sun May 24 09:59:32.185323 2026] [:error] [pid 49689:tid 49735] [client 20.63.33.98:10525] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/forbidals.php"] [unique_id "ahJbhAaxiY3NxLUD97UcWwAAAJE"]
[Sun May 24 09:59:32.617163 2026] [:error] [pid 49775:tid 49787] [client 20.63.33.98:10530] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/forbidals.php"] [unique_id "ahJbhIvZb8G6T8WpI1giTgAAAAo"]
[Sun May 24 09:59:33.045020 2026] [:error] [pid 49689:tid 49741] [client 20.63.33.98:14726] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/forbidals.php"] [unique_id "ahJbhQaxiY3NxLUD97UcYQAAAJc"]
[Sun May 24 09:59:33.526555 2026] [:error] [pid 49775:tid 49800] [client 20.63.33.98:10505] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "ahJbhYvZb8G6T8WpI1giUgAAABc"]
[Sun May 24 09:59:34.002856 2026] [:error] [pid 49744:tid 49761] [client 20.63.33.98:23558] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "ahJbhjsE5kPdFpUbbHFqMwAAAM8"]
[Sun May 24 09:59:34.459894 2026] [:error] [pid 49689:tid 49720] [client 20.63.33.98:17004] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "ahJbhgaxiY3NxLUD97UcZwAAAII"]
[Sun May 24 09:59:34.880933 2026] [:error] [pid 49744:tid 49753] [client 20.63.33.98:16974] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "ahJbhjsE5kPdFpUbbHFqNwAAAMc"]
[Sun May 24 09:59:35.330996 2026] [:error] [pid 49775:tid 49794] [client 20.63.33.98:10198] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/explorer/index_.php"] [unique_id "ahJbh4vZb8G6T8WpI1giXAAAABE"]
[Sun May 24 09:59:35.758441 2026] [:error] [pid 49689:tid 49718] [client 20.63.33.98:16999] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/explorer/index_.php"] [unique_id "ahJbhwaxiY3NxLUD97UcaQAAAIA"]
[Sun May 24 09:59:36.199521 2026] [:error] [pid 49775:tid 49793] [client 20.63.33.98:23576] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/explorer/index_.php"] [unique_id "ahJbiIvZb8G6T8WpI1giYwAAABA"]
[Sun May 24 09:59:36.618254 2026] [:error] [pid 49744:tid 49756] [client 20.63.33.98:16990] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/explorer/index_.php"] [unique_id "ahJbiDsE5kPdFpUbbHFqOgAAAMo"]
[Sun May 24 09:59:37.072552 2026] [:error] [pid 49689:tid 49723] [client 20.63.33.98:14722] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "ahJbiQaxiY3NxLUD97UcawAAAIU"]
[Sun May 24 09:59:37.567663 2026] [:error] [pid 49688:tid 49713] [client 20.63.33.98:10225] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "ahJbiWYoQ9V6a_4pBshi3gAAAFY"]
[Sun May 24 09:59:38.052916 2026] [:error] [pid 49744:tid 49746] [client 20.63.33.98:17002] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "ahJbijsE5kPdFpUbbHFqPgAAAMA"]
[Sun May 24 09:59:38.624220 2026] [:error] [pid 49775:tid 49798] [client 20.63.33.98:14740] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "ahJbiovZb8G6T8WpI1giaAAAABU"]
[Sun May 24 09:59:39.084932 2026] [:error] [pid 49689:tid 49729] [client 20.63.33.98:10238] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/samll.php"] [unique_id "ahJbiwaxiY3NxLUD97UcdQAAAIs"]
[Sun May 24 09:59:39.521408 2026] [:error] [pid 49744:tid 49754] [client 20.63.33.98:10228] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/samll.php"] [unique_id "ahJbizsE5kPdFpUbbHFqQAAAAMg"]
[Sun May 24 09:59:39.953209 2026] [:error] [pid 49775:tid 49790] [client 20.63.33.98:10191] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/samll.php"] [unique_id "ahJbi4vZb8G6T8WpI1gibwAAAA0"]
[Sun May 24 09:59:40.390300 2026] [:error] [pid 49775:tid 49791] [client 20.63.33.98:10519] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/samll.php"] [unique_id "ahJbjIvZb8G6T8WpI1gicwAAAA4"]
[Sun May 24 09:59:40.817153 2026] [:error] [pid 49775:tid 49780] [client 20.63.33.98:16995] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-at.php"] [unique_id "ahJbjIvZb8G6T8WpI1gidgAAAAM"]
[Sun May 24 09:59:41.462095 2026] [:error] [pid 49744:tid 49765] [client 20.63.33.98:14721] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-at.php"] [unique_id "ahJbjTsE5kPdFpUbbHFqRwAAANM"]
[Sun May 24 09:59:42.056111 2026] [:error] [pid 49688:tid 49700] [client 20.63.33.98:23561] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-at.php"] [unique_id "ahJbjmYoQ9V6a_4pBshi4gAAAEk"]
[Sun May 24 09:59:42.562082 2026] [:error] [pid 49775:tid 49786] [client 20.63.33.98:10545] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-at.php"] [unique_id "ahJbjovZb8G6T8WpI1giegAAAAk"]
[Sun May 24 09:59:43.088843 2026] [:error] [pid 49744:tid 49767] [client 20.63.33.98:10213] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahJbjzsE5kPdFpUbbHFqTgAAANU"]
[Sun May 24 09:59:43.850006 2026] [:error] [pid 49775:tid 49780] [client 20.63.33.98:10548] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahJbj4vZb8G6T8WpI1gifwAAAAM"]
[Sun May 24 09:59:44.421802 2026] [:error] [pid 49744:tid 49765] [client 20.63.33.98:14770] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahJbkDsE5kPdFpUbbHFqUgAAANM"]
[Sun May 24 09:59:45.099953 2026] [:error] [pid 49744:tid 49748] [client 20.63.33.98:10520] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahJbkTsE5kPdFpUbbHFqVAAAAMI"]
[Sun May 24 09:59:45.805545 2026] [:error] [pid 49688:tid 49703] [client 20.63.33.98:14783] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "ahJbkWYoQ9V6a_4pBshi6gAAAEw"]
[Sun May 24 09:59:46.612107 2026] [:error] [pid 49775:tid 49784] [client 20.63.33.98:14744] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "ahJbkovZb8G6T8WpI1gijgAAAAc"]
[Sun May 24 09:59:47.168062 2026] [:error] [pid 49775:tid 49790] [client 20.63.33.98:10187] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "ahJbk4vZb8G6T8WpI1gikQAAAA0"]
[Sun May 24 09:59:47.889039 2026] [:error] [pid 49775:tid 49780] [client 20.63.33.98:10219] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "ahJbk4vZb8G6T8WpI1gilQAAAAM"]
[Sun May 24 09:59:48.536192 2026] [:error] [pid 49775:tid 49801] [client 20.63.33.98:14779] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff1.php"] [unique_id "ahJblIvZb8G6T8WpI1gimQAAABg"]
[Sun May 24 09:59:49.173650 2026] [:error] [pid 49744:tid 49764] [client 20.63.33.98:10550] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff1.php"] [unique_id "ahJblTsE5kPdFpUbbHFqXAAAANI"]
[Sun May 24 09:59:49.756426 2026] [:error] [pid 49775:tid 49781] [client 20.63.33.98:34244] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff1.php"] [unique_id "ahJblYvZb8G6T8WpI1gioAAAAAQ"]
[Sun May 24 09:59:50.358514 2026] [:error] [pid 49775:tid 49799] [client 20.63.33.98:18795] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff1.php"] [unique_id "ahJblovZb8G6T8WpI1gipAAAABY"]
[Sun May 24 09:59:51.037480 2026] [:error] [pid 49775:tid 49781] [client 20.63.33.98:18786] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "ahJbl4vZb8G6T8WpI1giqgAAAAQ"]
[Sun May 24 09:59:51.491698 2026] [:error] [pid 49775:tid 49783] [client 20.63.33.98:17014] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "ahJbl4vZb8G6T8WpI1girwAAAAY"]
[Sun May 24 09:59:51.946697 2026] [:error] [pid 49689:tid 49734] [client 20.63.33.98:16941] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "ahJblwaxiY3NxLUD97UcjQAAAJA"]
[Sun May 24 09:59:52.386019 2026] [:error] [pid 49744:tid 49762] [client 20.63.33.98:14777] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cilus.php"] [unique_id "ahJbmDsE5kPdFpUbbHFqZwAAANA"]
[Sun May 24 09:59:52.818140 2026] [:error] [pid 49744:tid 49757] [client 20.63.33.98:23591] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "ahJbmDsE5kPdFpUbbHFqagAAAMs"]
[Sun May 24 09:59:53.248439 2026] [:error] [pid 49744:tid 49747] [client 20.63.33.98:18756] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "ahJbmTsE5kPdFpUbbHFqbAAAAME"]
[Sun May 24 09:59:53.669921 2026] [:error] [pid 49689:tid 49726] [client 20.63.33.98:16988] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "ahJbmQaxiY3NxLUD97UckAAAAIg"]
[Sun May 24 09:59:54.099804 2026] [:error] [pid 49689:tid 49740] [client 20.63.33.98:10502] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Okxob.php"] [unique_id "ahJbmgaxiY3NxLUD97UckQAAAJY"]
[Sun May 24 09:59:54.529796 2026] [:error] [pid 49744:tid 49758] [client 20.63.33.98:10202] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pass4.php"] [unique_id "ahJbmjsE5kPdFpUbbHFqdQAAAMw"]
[Sun May 24 09:59:54.971171 2026] [:error] [pid 49744:tid 49747] [client 20.63.33.98:18806] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pass4.php"] [unique_id "ahJbmjsE5kPdFpUbbHFqeQAAAME"]
[Sun May 24 09:59:55.403596 2026] [:error] [pid 49744:tid 49756] [client 20.63.33.98:34271] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pass4.php"] [unique_id "ahJbmzsE5kPdFpUbbHFqewAAAMo"]
[Sun May 24 09:59:55.842058 2026] [:error] [pid 49689:tid 49723] [client 20.63.33.98:10185] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pass4.php"] [unique_id "ahJbmwaxiY3NxLUD97UclgAAAIU"]
[Sun May 24 09:59:56.270471 2026] [:error] [pid 49744:tid 49770] [client 20.63.33.98:14781] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-su.php"] [unique_id "ahJbnDsE5kPdFpUbbHFqgAAAANg"]
[Sun May 24 09:59:56.709040 2026] [:error] [pid 49744:tid 49761] [client 20.63.33.98:23562] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-su.php"] [unique_id "ahJbnDsE5kPdFpUbbHFqgwAAAM8"]
[Sun May 24 09:59:57.186416 2026] [:error] [pid 49688:tid 49691] [client 20.63.33.98:23553] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-su.php"] [unique_id "ahJbnWYoQ9V6a_4pBshi9wAAAEA"]
[Sun May 24 09:59:57.614244 2026] [:error] [pid 49689:tid 49720] [client 20.63.33.98:10220] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-su.php"] [unique_id "ahJbnQaxiY3NxLUD97UcngAAAII"]
[Sun May 24 09:59:58.039692 2026] [:error] [pid 49689:tid 49726] [client 20.63.33.98:14748] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/like.php"] [unique_id "ahJbngaxiY3NxLUD97UcoQAAAIg"]
[Sun May 24 09:59:58.470587 2026] [:error] [pid 49689:tid 49730] [client 20.63.33.98:10517] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/like.php"] [unique_id "ahJbngaxiY3NxLUD97UcowAAAIw"]
[Sun May 24 09:59:58.901241 2026] [:error] [pid 49744:tid 49763] [client 20.63.33.98:18783] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/like.php"] [unique_id "ahJbnjsE5kPdFpUbbHFqigAAANE"]
[Sun May 24 09:59:59.330868 2026] [:error] [pid 49744:tid 49758] [client 20.63.33.98:18803] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/like.php"] [unique_id "ahJbnzsE5kPdFpUbbHFqjgAAAMw"]
[Sun May 24 09:59:59.761213 2026] [:error] [pid 49744:tid 49766] [client 20.63.33.98:18768] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mass.php"] [unique_id "ahJbnzsE5kPdFpUbbHFqkgAAANQ"]
[Sun May 24 10:00:00.208851 2026] [:error] [pid 49744:tid 49763] [client 20.63.33.98:10551] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mass.php"] [unique_id "ahJboDsE5kPdFpUbbHFqlQAAANE"]
[Sun May 24 10:00:00.628293 2026] [:error] [pid 49744:tid 49750] [client 20.63.33.98:14731] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mass.php"] [unique_id "ahJboDsE5kPdFpUbbHFqmgAAAMQ"]
[Sun May 24 10:00:01.055170 2026] [:error] [pid 49775:tid 49800] [client 20.63.33.98:16907] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mass.php"] [unique_id "ahJboYvZb8G6T8WpI1gitQAAABc"]
[Sun May 24 10:00:01.495710 2026] [:error] [pid 49775:tid 49784] [client 20.63.33.98:14743] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i.php"] [unique_id "ahJboYvZb8G6T8WpI1gitwAAAAc"]
[Sun May 24 10:00:01.945340 2026] [:error] [pid 49775:tid 49780] [client 20.63.33.98:14751] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i.php"] [unique_id "ahJboYvZb8G6T8WpI1givgAAAAM"]
[Sun May 24 10:00:02.369176 2026] [:error] [pid 49775:tid 49789] [client 20.63.33.98:18763] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i.php"] [unique_id "ahJboovZb8G6T8WpI1giwAAAAAw"]
[Sun May 24 10:00:02.789406 2026] [:error] [pid 49775:tid 49787] [client 20.63.33.98:16964] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/i.php"] [unique_id "ahJboovZb8G6T8WpI1gixAAAAAo"]
[Sun May 24 10:00:03.213226 2026] [:error] [pid 49775:tid 49800] [client 20.63.33.98:18774] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test.php"] [unique_id "ahJbo4vZb8G6T8WpI1giyQAAABc"]
[Sun May 24 10:00:03.642147 2026] [:error] [pid 49689:tid 49721] [client 20.63.33.98:18797] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test.php"] [unique_id "ahJbowaxiY3NxLUD97UcqwAAAIM"]
[Sun May 24 10:00:04.077017 2026] [:error] [pid 49688:tid 49700] [client 20.63.33.98:16984] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test.php"] [unique_id "ahJbpGYoQ9V6a_4pBshi-gAAAEk"]
[Sun May 24 10:00:04.513915 2026] [:error] [pid 49775:tid 49791] [client 20.63.33.98:10529] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/test.php"] [unique_id "ahJbpIvZb8G6T8WpI1gi0AAAAA4"]
[Sun May 24 10:00:04.968088 2026] [:error] [pid 49744:tid 49770] [client 20.63.33.98:18811] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "ahJbpDsE5kPdFpUbbHFqpwAAANg"]
[Sun May 24 10:00:05.409869 2026] [:error] [pid 49775:tid 49783] [client 20.63.33.98:14720] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "ahJbpYvZb8G6T8WpI1gi0gAAAAY"]
[Sun May 24 10:00:05.850450 2026] [:error] [pid 49688:tid 49712] [client 20.63.33.98:16969] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "ahJbpWYoQ9V6a_4pBshi_QAAAFU"]
[Sun May 24 10:00:06.278590 2026] [:error] [pid 49744:tid 49754] [client 20.63.33.98:23560] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/la.php"] [unique_id "ahJbpjsE5kPdFpUbbHFqrwAAAMg"]
[Sun May 24 10:00:06.712693 2026] [:error] [pid 49688:tid 49701] [client 20.63.33.98:16975] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/reze.php"] [unique_id "ahJbpmYoQ9V6a_4pBshjAAAAAEo"]
[Sun May 24 10:00:07.165272 2026] [:error] [pid 49744:tid 49753] [client 20.63.33.98:17012] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/reze.php"] [unique_id "ahJbpzsE5kPdFpUbbHFqswAAAMc"]
[Sun May 24 10:00:07.612706 2026] [:error] [pid 49775:tid 49800] [client 20.63.33.98:23563] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/reze.php"] [unique_id "ahJbp4vZb8G6T8WpI1gi1wAAABc"]
[Sun May 24 10:00:08.100423 2026] [:error] [pid 49775:tid 49799] [client 20.63.33.98:10514] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/reze.php"] [unique_id "ahJbqIvZb8G6T8WpI1gi2wAAABY"]
[Sun May 24 10:00:08.577647 2026] [:error] [pid 49775:tid 49783] [client 20.63.33.98:34260] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/database.php"] [unique_id "ahJbqIvZb8G6T8WpI1gi3wAAAAY"]
[Sun May 24 10:00:09.007983 2026] [:error] [pid 49689:tid 49731] [client 20.63.33.98:10229] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/database.php"] [unique_id "ahJbqQaxiY3NxLUD97UctQAAAI0"]
[Sun May 24 10:00:09.454857 2026] [:error] [pid 49775:tid 49798] [client 20.63.33.98:18772] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/database.php"] [unique_id "ahJbqYvZb8G6T8WpI1gi4wAAABU"]
[Sun May 24 10:00:09.891969 2026] [:error] [pid 49689:tid 49740] [client 20.63.33.98:34241] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/database.php"] [unique_id "ahJbqQaxiY3NxLUD97UcuAAAAJY"]
[Sun May 24 10:00:10.321827 2026] [:error] [pid 49775:tid 49780] [client 20.63.33.98:17007] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/favicon.php"] [unique_id "ahJbqovZb8G6T8WpI1gi6AAAAAM"]
[Sun May 24 10:00:10.744310 2026] [:error] [pid 49744:tid 49769] [client 20.63.33.98:14780] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/favicon.php"] [unique_id "ahJbqjsE5kPdFpUbbHFquQAAANc"]
[Sun May 24 10:00:11.168092 2026] [:error] [pid 49744:tid 49757] [client 20.63.33.98:18794] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/favicon.php"] [unique_id "ahJbqzsE5kPdFpUbbHFquwAAAMs"]
[Sun May 24 10:00:11.602899 2026] [:error] [pid 49744:tid 49753] [client 20.63.33.98:10523] [client 20.63.33.98] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/favicon.php"] [unique_id "ahJbqzsE5kPdFpUbbHFqvQAAAMc"]
[Sun May 24 11:08:52.311567 2026] [:error] [pid 49775:tid 49792] [client 43.157.170.126:47776] [client 43.157.170.126] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahJrxIvZb8G6T8WpI1hASwAAAA8"]
[Sun May 24 11:17:25.860675 2026] [:error] [pid 49744:tid 49747] [client 4.228.100.214:29510] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahJtxTsE5kPdFpUbbHGEWwAAAME"]
[Sun May 24 11:17:26.478996 2026] [:error] [pid 49689:tid 49734] [client 4.228.100.214:29540] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahJtxgaxiY3NxLUD97UzAgAAAJA"]
[Sun May 24 11:17:27.106950 2026] [:error] [pid 49775:tid 49795] [client 4.228.100.214:39036] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahJtx4vZb8G6T8WpI1hCeQAAABI"]
[Sun May 24 11:17:27.751434 2026] [:error] [pid 49688:tid 49696] [client 4.228.100.214:39033] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahJtx2YoQ9V6a_4pBsh20QAAAEU"]
[Sun May 24 11:17:28.377491 2026] [:error] [pid 49689:tid 49722] [client 4.228.100.214:29518] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "ahJtyAaxiY3NxLUD97UzBAAAAIQ"]
[Sun May 24 11:17:29.002687 2026] [:error] [pid 2639:tid 2645] [client 4.228.100.214:48193] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "ahJtyUzQncQTd0Z0Oe__XgAAAQQ"]
[Sun May 24 11:17:29.631072 2026] [:error] [pid 49775:tid 49786] [client 4.228.100.214:29543] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "ahJtyYvZb8G6T8WpI1hChAAAAAk"]
[Sun May 24 11:17:30.262519 2026] [:error] [pid 49744:tid 49752] [client 4.228.100.214:39008] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "ahJtyjsE5kPdFpUbbHGEYwAAAMY"]
[Sun May 24 11:17:30.904064 2026] [:error] [pid 2639:tid 2642] [client 4.228.100.214:29526] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "ahJtykzQncQTd0Z0Oe__YgAAAQE"]
[Sun May 24 11:17:31.616567 2026] [:error] [pid 49744:tid 49749] [client 4.228.100.214:48225] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "ahJtyzsE5kPdFpUbbHGEbAAAAMM"]
[Sun May 24 11:17:32.322810 2026] [:error] [pid 49744:tid 49756] [client 4.228.100.214:48230] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "ahJtzDsE5kPdFpUbbHGEcwAAAMo"]
[Sun May 24 11:17:33.076314 2026] [:error] [pid 49775:tid 49791] [client 4.228.100.214:29508] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atomlib.php"] [unique_id "ahJtzYvZb8G6T8WpI1hCkQAAAA4"]
[Sun May 24 11:17:33.730137 2026] [:error] [pid 23497:tid 23522] [client 4.228.100.214:48251] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-der.php"] [unique_id "ahJtzSPlV47QcYwd2v9YoAAAAVY"]
[Sun May 24 11:17:34.409486 2026] [:error] [pid 49744:tid 49755] [client 4.228.100.214:39038] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-der.php"] [unique_id "ahJtzjsE5kPdFpUbbHGEgQAAAMk"]
[Sun May 24 11:17:35.121626 2026] [:error] [pid 23497:tid 23523] [client 4.228.100.214:48243] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-der.php"] [unique_id "ahJtzyPlV47QcYwd2v9YpQAAAVc"]
[Sun May 24 11:17:35.792180 2026] [:error] [pid 23497:tid 23510] [client 4.228.100.214:29540] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-der.php"] [unique_id "ahJtzyPlV47QcYwd2v9YpwAAAUo"]
[Sun May 24 11:17:36.419829 2026] [:error] [pid 23497:tid 23519] [client 4.228.100.214:39009] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftde.php"] [unique_id "ahJt0CPlV47QcYwd2v9YqgAAAVM"]
[Sun May 24 11:17:37.053947 2026] [:error] [pid 23497:tid 23502] [client 4.228.100.214:48203] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftde.php"] [unique_id "ahJt0SPlV47QcYwd2v9YrQAAAUI"]
[Sun May 24 11:17:37.754138 2026] [:error] [pid 23497:tid 23520] [client 4.228.100.214:48218] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftde.php"] [unique_id "ahJt0SPlV47QcYwd2v9YsgAAAVQ"]
[Sun May 24 11:17:38.371981 2026] [:error] [pid 2639:tid 2662] [client 4.228.100.214:29511] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ftde.php"] [unique_id "ahJt0kzQncQTd0Z0Oe__dQAAARU"]
[Sun May 24 11:17:39.014770 2026] [:error] [pid 49689:tid 49734] [client 4.228.100.214:29515] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "ahJt0waxiY3NxLUD97UzCwAAAJA"]
[Sun May 24 11:17:39.663659 2026] [:error] [pid 23497:tid 23500] [client 4.228.100.214:39015] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "ahJt0yPlV47QcYwd2v9YuwAAAUA"]
[Sun May 24 11:17:40.295769 2026] [:error] [pid 49689:tid 49726] [client 4.228.100.214:39021] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "ahJt1AaxiY3NxLUD97UzDAAAAIg"]
[Sun May 24 11:17:40.985141 2026] [:error] [pid 23497:tid 23523] [client 4.228.100.214:38997] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/asasx.php"] [unique_id "ahJt1CPlV47QcYwd2v9YvwAAAVc"]
[Sun May 24 11:17:41.615379 2026] [:error] [pid 49775:tid 49797] [client 4.228.100.214:29537] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "ahJt1YvZb8G6T8WpI1hCmAAAABQ"]
[Sun May 24 11:17:42.279271 2026] [:error] [pid 49775:tid 49795] [client 4.228.100.214:39002] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "ahJt1ovZb8G6T8WpI1hCmwAAABI"]
[Sun May 24 11:17:42.973119 2026] [:error] [pid 49688:tid 49707] [client 4.228.100.214:29556] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "ahJt1mYoQ9V6a_4pBsh26QAAAFA"]
[Sun May 24 11:17:43.698065 2026] [:error] [pid 49744:tid 49767] [client 4.228.100.214:39030] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-good.php"] [unique_id "ahJt1zsE5kPdFpUbbHGEjAAAANU"]
[Sun May 24 11:17:44.399341 2026] [:error] [pid 49688:tid 49695] [client 4.228.100.214:28245] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "ahJt2GYoQ9V6a_4pBsh28gAAAEQ"]
[Sun May 24 11:17:45.058895 2026] [:error] [pid 49744:tid 49768] [client 4.228.100.214:38978] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "ahJt2TsE5kPdFpUbbHGEkgAAANY"]
[Sun May 24 11:17:45.681998 2026] [:error] [pid 49688:tid 49699] [client 4.228.100.214:29505] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "ahJt2WYoQ9V6a_4pBsh29gAAAEg"]
[Sun May 24 11:17:46.370011 2026] [:error] [pid 49744:tid 49760] [client 4.228.100.214:48235] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/app.php"] [unique_id "ahJt2jsE5kPdFpUbbHGElQAAAM4"]
[Sun May 24 11:17:47.007834 2026] [:error] [pid 49744:tid 49751] [client 4.228.100.214:39024] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "ahJt2zsE5kPdFpUbbHGElwAAAMU"]
[Sun May 24 11:17:47.646012 2026] [:error] [pid 49744:tid 49750] [client 4.228.100.214:29520] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "ahJt2zsE5kPdFpUbbHGEnwAAAMQ"]
[Sun May 24 11:17:48.318413 2026] [:error] [pid 49688:tid 49698] [client 4.228.100.214:28255] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "ahJt3GYoQ9V6a_4pBsh2_AAAAEc"]
[Sun May 24 11:17:48.947015 2026] [:error] [pid 49688:tid 49709] [client 4.228.100.214:48197] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/file.php"] [unique_id "ahJt3GYoQ9V6a_4pBsh2_QAAAFI"]
[Sun May 24 11:17:49.590408 2026] [:error] [pid 49744:tid 49761] [client 4.228.100.214:29542] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wuasr.php"] [unique_id "ahJt3TsE5kPdFpUbbHGEpgAAAM8"]
[Sun May 24 11:17:50.252744 2026] [:error] [pid 2639:tid 2659] [client 4.228.100.214:29509] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wuasr.php"] [unique_id "ahJt3kzQncQTd0Z0Oe__eQAAARI"]
[Sun May 24 11:17:50.888423 2026] [:error] [pid 49744:tid 49760] [client 4.228.100.214:48211] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wuasr.php"] [unique_id "ahJt3jsE5kPdFpUbbHGEqwAAAM4"]
[Sun May 24 11:17:51.515712 2026] [:error] [pid 23497:tid 23520] [client 4.228.100.214:48206] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wuasr.php"] [unique_id "ahJt3yPlV47QcYwd2v9YywAAAVQ"]
[Sun May 24 11:17:52.155892 2026] [:error] [pid 49744:tid 49749] [client 4.228.100.214:38992] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "ahJt4DsE5kPdFpUbbHGEtAAAAMM"]
[Sun May 24 11:17:52.801291 2026] [:error] [pid 49775:tid 49798] [client 4.228.100.214:48205] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "ahJt4IvZb8G6T8WpI1hCqwAAABU"]
[Sun May 24 11:17:53.426678 2026] [:error] [pid 49775:tid 49788] [client 4.228.100.214:48244] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "ahJt4YvZb8G6T8WpI1hCrQAAAAs"]
[Sun May 24 11:17:54.052253 2026] [:error] [pid 23497:tid 23517] [client 4.228.100.214:48226] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "ahJt4iPlV47QcYwd2v9Y1AAAAVE"]
[Sun May 24 11:17:54.678157 2026] [:error] [pid 2639:tid 2658] [client 4.228.100.214:28278] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "ahJt4kzQncQTd0Z0Oe__kwAAARE"]
[Sun May 24 11:17:55.304267 2026] [:error] [pid 23497:tid 23519] [client 4.228.100.214:39034] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "ahJt4yPlV47QcYwd2v9Y2QAAAVM"]
[Sun May 24 11:17:56.042739 2026] [:error] [pid 49689:tid 49723] [client 4.228.100.214:48204] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "ahJt5AaxiY3NxLUD97UzHwAAAIU"]
[Sun May 24 11:17:56.711619 2026] [:error] [pid 49775:tid 49801] [client 4.228.100.214:48237] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/albin.php"] [unique_id "ahJt5IvZb8G6T8WpI1hCtgAAABg"]
[Sun May 24 11:17:57.382947 2026] [:error] [pid 2639:tid 2645] [client 4.228.100.214:48208] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wefile.php"] [unique_id "ahJt5UzQncQTd0Z0Oe__lQAAAQQ"]
[Sun May 24 11:17:58.021218 2026] [:error] [pid 23497:tid 23517] [client 4.228.100.214:29504] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wefile.php"] [unique_id "ahJt5iPlV47QcYwd2v9Y4wAAAVE"]
[Sun May 24 11:17:58.667322 2026] [:error] [pid 49744:tid 49761] [client 4.228.100.214:28239] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wefile.php"] [unique_id "ahJt5jsE5kPdFpUbbHGEvAAAAM8"]
[Sun May 24 11:17:59.322454 2026] [:error] [pid 23497:tid 23503] [client 4.228.100.214:48223] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wefile.php"] [unique_id "ahJt5yPlV47QcYwd2v9Y6AAAAUM"]
[Sun May 24 11:17:59.979100 2026] [:error] [pid 49744:tid 49750] [client 4.228.100.214:39037] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "ahJt5zsE5kPdFpUbbHGEvQAAAMQ"]
[Sun May 24 11:18:00.616377 2026] [:error] [pid 23497:tid 23513] [client 4.228.100.214:29512] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "ahJt6CPlV47QcYwd2v9Y8AAAAU0"]
[Sun May 24 11:18:01.323278 2026] [:error] [pid 23497:tid 23507] [client 4.228.100.214:28253] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "ahJt6SPlV47QcYwd2v9Y9AAAAUc"]
[Sun May 24 11:18:01.957040 2026] [:error] [pid 49744:tid 49752] [client 4.228.100.214:29523] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file30.php"] [unique_id "ahJt6TsE5kPdFpUbbHGEvgAAAMY"]
[Sun May 24 11:18:02.608553 2026] [:error] [pid 49744:tid 49765] [client 4.228.100.214:29506] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "ahJt6jsE5kPdFpUbbHGEvwAAANM"]
[Sun May 24 11:18:03.314530 2026] [:error] [pid 49689:tid 49725] [client 4.228.100.214:38986] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "ahJt6waxiY3NxLUD97UzIAAAAIc"]
[Sun May 24 11:18:03.972539 2026] [:error] [pid 49775:tid 49795] [client 4.228.100.214:48209] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "ahJt64vZb8G6T8WpI1hCvAAAABI"]
[Sun May 24 11:18:04.629073 2026] [:error] [pid 49689:tid 49726] [client 4.228.100.214:35665] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file4.php"] [unique_id "ahJt7AaxiY3NxLUD97UzIwAAAIg"]
[Sun May 24 11:18:05.320694 2026] [:error] [pid 23497:tid 23502] [client 4.228.100.214:39005] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "ahJt7SPlV47QcYwd2v9Y9wAAAUI"]
[Sun May 24 11:18:05.959159 2026] [:error] [pid 49688:tid 49708] [client 4.228.100.214:29532] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "ahJt7WYoQ9V6a_4pBsh3BQAAAFE"]
[Sun May 24 11:18:06.630140 2026] [:error] [pid 23497:tid 23522] [client 4.228.100.214:38988] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "ahJt7iPlV47QcYwd2v9Y-AAAAVY"]
[Sun May 24 11:18:07.334821 2026] [:error] [pid 49744:tid 49767] [client 4.228.100.214:38985] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "ahJt7zsE5kPdFpUbbHGEwQAAANU"]
[Sun May 24 11:18:07.989512 2026] [:error] [pid 49689:tid 49722] [client 4.228.100.214:35686] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "ahJt7waxiY3NxLUD97UzKAAAAIQ"]
[Sun May 24 11:18:08.611550 2026] [:error] [pid 23497:tid 23518] [client 4.228.100.214:38991] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "ahJt8CPlV47QcYwd2v9Y-QAAAVI"]
[Sun May 24 11:18:09.238931 2026] [:error] [pid 23497:tid 23510] [client 4.228.100.214:29513] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "ahJt8SPlV47QcYwd2v9Y_AAAAUo"]
[Sun May 24 11:18:09.916563 2026] [:error] [pid 23497:tid 23524] [client 4.228.100.214:48236] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/txets.php"] [unique_id "ahJt8SPlV47QcYwd2v9Y_gAAAVg"]
[Sun May 24 11:18:10.551322 2026] [:error] [pid 49744:tid 49757] [client 4.228.100.214:48202] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "ahJt8jsE5kPdFpUbbHGExAAAAMs"]
[Sun May 24 11:18:11.236742 2026] [:error] [pid 49689:tid 49738] [client 4.228.100.214:48194] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "ahJt8waxiY3NxLUD97UzKQAAAJQ"]
[Sun May 24 11:18:11.902698 2026] [:error] [pid 49775:tid 49795] [client 4.228.100.214:29538] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "ahJt84vZb8G6T8WpI1hCwwAAABI"]
[Sun May 24 11:18:12.543111 2026] [:error] [pid 49775:tid 49797] [client 4.228.100.214:28246] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-access.php"] [unique_id "ahJt9IvZb8G6T8WpI1hCxAAAABQ"]
[Sun May 24 11:18:13.166575 2026] [:error] [pid 23497:tid 23516] [client 4.228.100.214:38981] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "ahJt9SPlV47QcYwd2v9ZAgAAAVA"]
[Sun May 24 11:18:13.801127 2026] [:error] [pid 2639:tid 2655] [client 4.228.100.214:29539] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "ahJt9UzQncQTd0Z0Oe__ngAAAQ4"]
[Sun May 24 11:18:14.425104 2026] [:error] [pid 49689:tid 49741] [client 4.228.100.214:48255] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "ahJt9gaxiY3NxLUD97UzKwAAAJc"]
[Sun May 24 11:18:15.063171 2026] [:error] [pid 49775:tid 49801] [client 4.228.100.214:38977] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aevly.php"] [unique_id "ahJt94vZb8G6T8WpI1hCxwAAABg"]
[Sun May 24 11:18:15.690731 2026] [:error] [pid 49689:tid 49734] [client 4.228.100.214:48215] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "ahJt9waxiY3NxLUD97UzLQAAAJA"]
[Sun May 24 11:18:16.342589 2026] [:error] [pid 2639:tid 2644] [client 4.228.100.214:48232] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "ahJt-EzQncQTd0Z0Oe__nwAAAQM"]
[Sun May 24 11:18:16.962355 2026] [:error] [pid 49775:tid 49789] [client 4.228.100.214:39039] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "ahJt-IvZb8G6T8WpI1hCyAAAAAw"]
[Sun May 24 11:18:17.610471 2026] [:error] [pid 49688:tid 49702] [client 4.228.100.214:39019] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/vx.php"] [unique_id "ahJt-WYoQ9V6a_4pBsh3DgAAAEs"]
[Sun May 24 11:18:18.242875 2026] [:error] [pid 49689:tid 49727] [client 4.228.100.214:48207] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-wz.php"] [unique_id "ahJt-gaxiY3NxLUD97UzMAAAAIk"]
[Sun May 24 11:18:18.884235 2026] [:error] [pid 23497:tid 23506] [client 4.228.100.214:38998] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-wz.php"] [unique_id "ahJt-iPlV47QcYwd2v9ZDQAAAUY"]
[Sun May 24 11:18:19.547604 2026] [:error] [pid 2639:tid 2662] [client 4.228.100.214:48217] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-wz.php"] [unique_id "ahJt-0zQncQTd0Z0Oe__owAAARU"]
[Sun May 24 11:18:20.203413 2026] [:error] [pid 49744:tid 49762] [client 4.228.100.214:35666] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-wz.php"] [unique_id "ahJt_DsE5kPdFpUbbHGEyAAAANA"]
[Sun May 24 11:18:20.934309 2026] [:error] [pid 49775:tid 49801] [client 4.228.100.214:29528] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/crgio.php"] [unique_id "ahJt_IvZb8G6T8WpI1hCzwAAABg"]
[Sun May 24 11:18:21.580712 2026] [:error] [pid 2639:tid 2660] [client 4.228.100.214:28287] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/crgio.php"] [unique_id "ahJt_UzQncQTd0Z0Oe__pQAAARM"]
[Sun May 24 11:18:22.236937 2026] [:error] [pid 2639:tid 2663] [client 4.228.100.214:29524] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/crgio.php"] [unique_id "ahJt_kzQncQTd0Z0Oe__pwAAARY"]
[Sun May 24 11:18:22.880072 2026] [:error] [pid 2639:tid 2658] [client 4.228.100.214:29547] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/crgio.php"] [unique_id "ahJt_kzQncQTd0Z0Oe__qgAAARE"]
[Sun May 24 11:18:23.533704 2026] [:error] [pid 49689:tid 49732] [client 4.228.100.214:39006] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/new.php"] [unique_id "ahJt_waxiY3NxLUD97UzMwAAAI4"]
[Sun May 24 11:18:34.441414 2026] [:error] [pid 49744:tid 49752] [client 4.228.100.214:28271] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1index.php"] [unique_id "ahJuCjsE5kPdFpUbbHGE4wAAAMY"]
[Sun May 24 11:18:35.073683 2026] [:error] [pid 2639:tid 2658] [client 4.228.100.214:38989] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1index.php"] [unique_id "ahJuC0zQncQTd0Z0Oe__vwAAARE"]
[Sun May 24 11:18:35.699353 2026] [:error] [pid 23497:tid 23518] [client 4.228.100.214:39020] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1index.php"] [unique_id "ahJuCyPlV47QcYwd2v9ZFQAAAVI"]
[Sun May 24 11:18:36.348645 2026] [:error] [pid 49744:tid 49769] [client 4.228.100.214:48240] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1index.php"] [unique_id "ahJuDDsE5kPdFpUbbHGE5AAAANc"]
[Sun May 24 11:18:36.971640 2026] [:error] [pid 49689:tid 49719] [client 4.228.100.214:28231] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "ahJuDAaxiY3NxLUD97UzVwAAAIE"]
[Sun May 24 11:18:37.610109 2026] [:error] [pid 49689:tid 49720] [client 4.228.100.214:29531] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "ahJuDQaxiY3NxLUD97UzWAAAAII"]
[Sun May 24 11:18:38.227959 2026] [:error] [pid 23497:tid 23522] [client 4.228.100.214:38996] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "ahJuDiPlV47QcYwd2v9ZHAAAAVY"]
[Sun May 24 11:18:38.845855 2026] [:error] [pid 23497:tid 23503] [client 4.228.100.214:39027] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/shell20211028.php"] [unique_id "ahJuDiPlV47QcYwd2v9ZHwAAAUM"]
[Sun May 24 11:18:39.468161 2026] [:error] [pid 23497:tid 23512] [client 4.228.100.214:48220] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ver.php"] [unique_id "ahJuDyPlV47QcYwd2v9ZIQAAAUw"]
[Sun May 24 11:18:40.096083 2026] [:error] [pid 23497:tid 23519] [client 4.228.100.214:48200] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ver.php"] [unique_id "ahJuECPlV47QcYwd2v9ZJAAAAVM"]
[Sun May 24 11:18:40.712321 2026] [:error] [pid 49744:tid 49767] [client 4.228.100.214:39004] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ver.php"] [unique_id "ahJuEDsE5kPdFpUbbHGE6AAAANU"]
[Sun May 24 11:18:41.337343 2026] [:error] [pid 49688:tid 49712] [client 4.228.100.214:39012] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-ver.php"] [unique_id "ahJuEWYoQ9V6a_4pBsh3GgAAAFU"]
[Sun May 24 11:18:41.960707 2026] [:error] [pid 23497:tid 23512] [client 4.228.100.214:48201] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "ahJuESPlV47QcYwd2v9ZLgAAAUw"]
[Sun May 24 11:18:42.583221 2026] [:error] [pid 49744:tid 49753] [client 4.228.100.214:29550] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "ahJuEjsE5kPdFpUbbHGE6gAAAMc"]
[Sun May 24 11:18:43.206819 2026] [:error] [pid 49744:tid 49765] [client 4.228.100.214:29519] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "ahJuEzsE5kPdFpUbbHGE7AAAANM"]
[Sun May 24 11:18:43.835851 2026] [:error] [pid 49689:tid 49741] [client 4.228.100.214:28274] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lala.php"] [unique_id "ahJuEwaxiY3NxLUD97UzXQAAAJc"]
[Sun May 24 11:18:44.464401 2026] [:error] [pid 49744:tid 49752] [client 4.228.100.214:29534] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "ahJuFDsE5kPdFpUbbHGE8AAAAMY"]
[Sun May 24 11:18:45.082376 2026] [:error] [pid 49689:tid 49739] [client 4.228.100.214:39014] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "ahJuFQaxiY3NxLUD97UzYAAAAJU"]
[Sun May 24 11:18:45.703161 2026] [:error] [pid 49744:tid 49770] [client 4.228.100.214:29559] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "ahJuFTsE5kPdFpUbbHGE9QAAANg"]
[Sun May 24 11:18:46.322383 2026] [:error] [pid 49744:tid 49753] [client 4.228.100.214:48250] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sbhu.php"] [unique_id "ahJuFjsE5kPdFpUbbHGE-AAAAMc"]
[Sun May 24 11:18:46.943854 2026] [:error] [pid 49688:tid 49711] [client 4.228.100.214:29529] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-sing.php"] [unique_id "ahJuFmYoQ9V6a_4pBsh3HwAAAFQ"]
[Sun May 24 11:18:47.573726 2026] [:error] [pid 49689:tid 49740] [client 4.228.100.214:38999] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-sing.php"] [unique_id "ahJuFwaxiY3NxLUD97UzYgAAAJY"]
[Sun May 24 11:18:48.196307 2026] [:error] [pid 49689:tid 49724] [client 4.228.100.214:29544] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-sing.php"] [unique_id "ahJuGAaxiY3NxLUD97UzZQAAAIY"]
[Sun May 24 11:18:48.816028 2026] [:error] [pid 49744:tid 49758] [client 4.228.100.214:29521] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-sing.php"] [unique_id "ahJuGDsE5kPdFpUbbHGFAAAAAMw"]
[Sun May 24 11:18:49.453495 2026] [:error] [pid 23497:tid 23524] [client 4.228.100.214:38982] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file59.php"] [unique_id "ahJuGSPlV47QcYwd2v9ZMwAAAVg"]
[Sun May 24 11:18:50.071692 2026] [:error] [pid 2639:tid 2651] [client 4.228.100.214:48224] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file59.php"] [unique_id "ahJuGkzQncQTd0Z0Oe__wgAAAQo"]
[Sun May 24 11:18:50.698838 2026] [:error] [pid 49689:tid 49722] [client 4.228.100.214:28236] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file59.php"] [unique_id "ahJuGgaxiY3NxLUD97UzbAAAAIQ"]
[Sun May 24 11:18:51.388903 2026] [:error] [pid 49689:tid 49721] [client 4.228.100.214:35655] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file59.php"] [unique_id "ahJuGwaxiY3NxLUD97UzcAAAAIM"]
[Sun May 24 11:18:52.094677 2026] [:error] [pid 49689:tid 49738] [client 4.228.100.214:35660] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-slss.php"] [unique_id "ahJuHAaxiY3NxLUD97UzcwAAAJQ"]
[Sun May 24 11:18:52.775985 2026] [:error] [pid 49744:tid 49759] [client 4.228.100.214:48247] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-slss.php"] [unique_id "ahJuHDsE5kPdFpUbbHGFCAAAAM0"]
[Sun May 24 11:18:53.401905 2026] [:error] [pid 2639:tid 2662] [client 4.228.100.214:29549] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-slss.php"] [unique_id "ahJuHUzQncQTd0Z0Oe__xQAAARU"]
[Sun May 24 11:18:54.089461 2026] [:error] [pid 49775:tid 49780] [client 4.228.100.214:29525] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-slss.php"] [unique_id "ahJuHovZb8G6T8WpI1hC_wAAAAM"]
[Sun May 24 11:18:54.734875 2026] [:error] [pid 49775:tid 49791] [client 4.228.100.214:28233] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "ahJuHovZb8G6T8WpI1hDAQAAAA4"]
[Sun May 24 11:18:55.355101 2026] [:error] [pid 2639:tid 2656] [client 4.228.100.214:28228] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "ahJuH0zQncQTd0Z0Oe__xwAAAQ8"]
[Sun May 24 11:18:55.978828 2026] [:error] [pid 49688:tid 49700] [client 4.228.100.214:29548] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "ahJuH2YoQ9V6a_4pBsh3KAAAAEk"]
[Sun May 24 11:18:56.607324 2026] [:error] [pid 49775:tid 49793] [client 4.228.100.214:28280] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x.php"] [unique_id "ahJuIIvZb8G6T8WpI1hDBQAAABA"]
[Sun May 24 11:18:57.252512 2026] [:error] [pid 2639:tid 2660] [client 4.228.100.214:48222] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atkno.php"] [unique_id "ahJuIUzQncQTd0Z0Oe__yQAAARM"]
[Sun May 24 11:18:57.882037 2026] [:error] [pid 23497:tid 23504] [client 4.228.100.214:35703] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atkno.php"] [unique_id "ahJuISPlV47QcYwd2v9ZNgAAAUQ"]
[Sun May 24 11:18:58.514617 2026] [:error] [pid 49775:tid 49800] [client 4.228.100.214:48242] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atkno.php"] [unique_id "ahJuIovZb8G6T8WpI1hDCAAAABc"]
[Sun May 24 11:18:59.143162 2026] [:error] [pid 49744:tid 49757] [client 4.228.100.214:35657] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/atkno.php"] [unique_id "ahJuIzsE5kPdFpUbbHGFFAAAAMs"]
[Sun May 24 11:18:59.769172 2026] [:error] [pid 23497:tid 23521] [client 4.228.100.214:48214] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff.php"] [unique_id "ahJuIyPlV47QcYwd2v9ZPAAAAVU"]
[Sun May 24 11:19:00.403149 2026] [:error] [pid 2639:tid 2665] [client 4.228.100.214:48198] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff.php"] [unique_id "ahJuJEzQncQTd0Z0Oe__zwAAARg"]
[Sun May 24 11:19:01.035295 2026] [:error] [pid 49689:tid 49734] [client 4.228.100.214:39017] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff.php"] [unique_id "ahJuJQaxiY3NxLUD97UzgAAAAJA"]
[Sun May 24 11:19:01.685503 2026] [:error] [pid 23497:tid 23516] [client 4.228.100.214:35662] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff.php"] [unique_id "ahJuJSPlV47QcYwd2v9ZRAAAAVA"]
[Sun May 24 11:19:02.319570 2026] [:error] [pid 2639:tid 2653] [client 4.228.100.214:35694] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "ahJuJkzQncQTd0Z0Oe__0QAAAQw"]
[Sun May 24 11:19:03.024995 2026] [:error] [pid 49775:tid 49789] [client 4.228.100.214:29541] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "ahJuJ4vZb8G6T8WpI1hDDgAAAAw"]
[Sun May 24 11:19:03.661574 2026] [:error] [pid 49744:tid 49767] [client 4.228.100.214:29514] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "ahJuJzsE5kPdFpUbbHGFGQAAANU"]
[Sun May 24 11:19:04.289227 2026] [:error] [pid 2639:tid 2657] [client 4.228.100.214:22939] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yas.php"] [unique_id "ahJuKEzQncQTd0Z0Oe__1AAAARA"]
[Sun May 24 11:19:04.953613 2026] [:error] [pid 49744:tid 49746] [client 4.228.100.214:39026] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/png.php"] [unique_id "ahJuKDsE5kPdFpUbbHGFHAAAAMA"]
[Sun May 24 11:19:05.592225 2026] [:error] [pid 49689:tid 49718] [client 4.228.100.214:28276] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/png.php"] [unique_id "ahJuKQaxiY3NxLUD97UzhAAAAIA"]
[Sun May 24 11:19:06.231941 2026] [:error] [pid 49744:tid 49752] [client 4.228.100.214:48216] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/png.php"] [unique_id "ahJuKjsE5kPdFpUbbHGFHgAAAMY"]
[Sun May 24 11:19:06.868944 2026] [:error] [pid 49688:tid 49702] [client 4.228.100.214:48238] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/png.php"] [unique_id "ahJuKmYoQ9V6a_4pBsh3LQAAAEs"]
[Sun May 24 11:19:07.523536 2026] [:error] [pid 49744:tid 49760] [client 4.228.100.214:34509] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "ahJuKzsE5kPdFpUbbHGFIgAAAM4"]
[Sun May 24 11:19:08.179745 2026] [:error] [pid 49744:tid 49764] [client 4.228.100.214:35663] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "ahJuLDsE5kPdFpUbbHGFJAAAANI"]
[Sun May 24 11:19:08.810963 2026] [:error] [pid 2639:tid 2661] [client 4.228.100.214:48233] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "ahJuLEzQncQTd0Z0Oe__1wAAARQ"]
[Sun May 24 11:19:09.445478 2026] [:error] [pid 23497:tid 23512] [client 4.228.100.214:39003] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wmore1.php"] [unique_id "ahJuLSPlV47QcYwd2v9ZTQAAAUw"]
[Sun May 24 11:19:10.101874 2026] [:error] [pid 23497:tid 23523] [client 4.228.100.214:39022] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "ahJuLiPlV47QcYwd2v9ZTgAAAVc"]
[Sun May 24 11:19:10.848199 2026] [:error] [pid 49744:tid 49746] [client 4.228.100.214:29567] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "ahJuLjsE5kPdFpUbbHGFKQAAAMA"]
[Sun May 24 11:19:11.513173 2026] [:error] [pid 23497:tid 23513] [client 4.228.100.214:48253] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "ahJuLyPlV47QcYwd2v9ZUAAAAU0"]
[Sun May 24 11:19:12.135525 2026] [:error] [pid 49688:tid 49692] [client 4.228.100.214:38984] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ah25.php"] [unique_id "ahJuMGYoQ9V6a_4pBsh3LwAAAEE"]
[Sun May 24 11:19:12.755355 2026] [:error] [pid 49775:tid 49781] [client 4.228.100.214:35672] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/forbidals.php"] [unique_id "ahJuMIvZb8G6T8WpI1hDEQAAAAQ"]
[Sun May 24 11:19:13.376970 2026] [:error] [pid 2639:tid 2641] [client 4.228.100.214:28279] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/forbidals.php"] [unique_id "ahJuMUzQncQTd0Z0Oe__2gAAAQA"]
[Sun May 24 11:19:14.198813 2026] [:error] [pid 2639:tid 2655] [client 4.228.100.214:22914] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/forbidals.php"] [unique_id "ahJuMkzQncQTd0Z0Oe__3QAAAQ4"]
[Sun May 24 11:19:14.834605 2026] [:error] [pid 49775:tid 49780] [client 4.228.100.214:48254] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/forbidals.php"] [unique_id "ahJuMovZb8G6T8WpI1hDEgAAAAM"]
[Sun May 24 11:19:15.506630 2026] [:error] [pid 23497:tid 23500] [client 4.228.100.214:28224] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "ahJuMyPlV47QcYwd2v9ZWAAAAUA"]
[Sun May 24 11:19:16.123725 2026] [:error] [pid 2639:tid 2664] [client 4.228.100.214:29535] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "ahJuNEzQncQTd0Z0Oe__3wAAARc"]
[Sun May 24 11:19:16.756738 2026] [:error] [pid 2639:tid 2660] [client 4.228.100.214:28232] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "ahJuNEzQncQTd0Z0Oe__4AAAARM"]
[Sun May 24 11:19:17.415260 2026] [:error] [pid 23497:tid 23509] [client 4.228.100.214:35653] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lv.php"] [unique_id "ahJuNSPlV47QcYwd2v9ZXQAAAUk"]
[Sun May 24 11:19:18.080787 2026] [:error] [pid 23497:tid 23521] [client 4.228.100.214:39025] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/explorer/index_.php"] [unique_id "ahJuNiPlV47QcYwd2v9ZXgAAAVU"]
[Sun May 24 11:19:18.713830 2026] [:error] [pid 23497:tid 23511] [client 4.228.100.214:29557] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/explorer/index_.php"] [unique_id "ahJuNiPlV47QcYwd2v9ZYgAAAUs"]
[Sun May 24 11:19:19.339339 2026] [:error] [pid 49689:tid 49720] [client 4.228.100.214:39001] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/explorer/index_.php"] [unique_id "ahJuNwaxiY3NxLUD97UzlgAAAII"]
[Sun May 24 11:19:19.971838 2026] [:error] [pid 23497:tid 23515] [client 4.228.100.214:35693] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/explorer/index_.php"] [unique_id "ahJuNyPlV47QcYwd2v9ZYwAAAU8"]
[Sun May 24 11:19:20.613447 2026] [:error] [pid 23497:tid 23509] [client 4.228.100.214:35664] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "ahJuOCPlV47QcYwd2v9ZZQAAAUk"]
[Sun May 24 11:19:21.289872 2026] [:error] [pid 23497:tid 23522] [client 4.228.100.214:38987] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "ahJuOSPlV47QcYwd2v9ZaAAAAVY"]
[Sun May 24 11:19:21.934293 2026] [:error] [pid 49689:tid 49721] [client 4.228.100.214:29522] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "ahJuOQaxiY3NxLUD97UzmAAAAIM"]
[Sun May 24 11:19:22.582620 2026] [:error] [pid 49744:tid 49746] [client 4.228.100.214:39011] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xda.php"] [unique_id "ahJuOjsE5kPdFpUbbHGFLwAAAMA"]
[Sun May 24 11:19:23.322810 2026] [:error] [pid 23497:tid 23504] [client 4.228.100.214:29527] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/samll.php"] [unique_id "ahJuOyPlV47QcYwd2v9ZbgAAAUQ"]
[Sun May 24 11:19:23.968211 2026] [:error] [pid 23497:tid 23509] [client 4.228.100.214:29546] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/samll.php"] [unique_id "ahJuOyPlV47QcYwd2v9ZcAAAAUk"]
[Sun May 24 11:19:24.703250 2026] [:error] [pid 49744:tid 49766] [client 4.228.100.214:28242] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/samll.php"] [unique_id "ahJuPDsE5kPdFpUbbHGFMAAAANQ"]
[Sun May 24 11:19:25.377085 2026] [:error] [pid 49744:tid 49753] [client 4.228.100.214:35697] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/samll.php"] [unique_id "ahJuPTsE5kPdFpUbbHGFMwAAAMc"]
[Sun May 24 11:19:26.046684 2026] [:error] [pid 49689:tid 49730] [client 4.228.100.214:35654] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-at.php"] [unique_id "ahJuPgaxiY3NxLUD97UzngAAAIw"]
[Sun May 24 11:19:26.828694 2026] [:error] [pid 49689:tid 49735] [client 4.228.100.214:48228] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-at.php"] [unique_id "ahJuPgaxiY3NxLUD97UzoQAAAJE"]
[Sun May 24 11:19:27.585114 2026] [:error] [pid 49744:tid 49766] [client 4.228.100.214:38994] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-at.php"] [unique_id "ahJuPzsE5kPdFpUbbHGFPQAAANQ"]
[Sun May 24 11:19:28.285125 2026] [:error] [pid 49744:tid 49755] [client 4.228.100.214:29533] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-at.php"] [unique_id "ahJuQDsE5kPdFpUbbHGFQAAAAMk"]
[Sun May 24 11:19:29.018107 2026] [:error] [pid 23497:tid 23518] [client 4.228.100.214:48227] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahJuQSPlV47QcYwd2v9ZdAAAAVI"]
[Sun May 24 11:19:29.761957 2026] [:error] [pid 49775:tid 49795] [client 4.228.100.214:35682] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahJuQYvZb8G6T8WpI1hDFgAAABI"]
[Sun May 24 11:19:30.448383 2026] [:error] [pid 23497:tid 23507] [client 4.228.100.214:35648] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahJuQiPlV47QcYwd2v9ZeAAAAUc"]
[Sun May 24 11:19:31.178066 2026] [:error] [pid 2639:tid 2664] [client 4.228.100.214:29563] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kd4xalrg7m.php"] [unique_id "ahJuQ0zQncQTd0Z0Oe__5gAAARc"]
[Sun May 24 11:19:31.981727 2026] [:error] [pid 49744:tid 49757] [client 4.228.100.214:29536] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "ahJuQzsE5kPdFpUbbHGFRwAAAMs"]
[Sun May 24 11:19:32.815379 2026] [:error] [pid 23497:tid 23508] [client 4.228.100.214:34545] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-the.php"] [unique_id "ahJuRCPlV47QcYwd2v9ZfQAAAUg"]
[Sun May 24 11:19:44.686228 2026] [:error] [pid 23497:tid 23502] [client 4.228.100.214:22912] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/reze.php"] [unique_id "ahJuUCPlV47QcYwd2v9ZpAAAAUI"]
[Sun May 24 11:19:45.471476 2026] [:error] [pid 23497:tid 23507] [client 4.228.100.214:28254] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/reze.php"] [unique_id "ahJuUSPlV47QcYwd2v9ZpQAAAUc"]
[Sun May 24 11:19:46.138959 2026] [:error] [pid 23497:tid 23501] [client 4.228.100.214:38983] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/reze.php"] [unique_id "ahJuUiPlV47QcYwd2v9ZqAAAAUE"]
[Sun May 24 11:19:46.808301 2026] [:error] [pid 2639:tid 2657] [client 4.228.100.214:28252] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/reze.php"] [unique_id "ahJuUkzQncQTd0Z0Oe__8wAAARA"]
[Sun May 24 11:19:47.438794 2026] [:error] [pid 49775:tid 49794] [client 4.228.100.214:34506] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/database.php"] [unique_id "ahJuU4vZb8G6T8WpI1hDHwAAABE"]
[Sun May 24 11:19:48.100271 2026] [:error] [pid 23497:tid 23506] [client 4.228.100.214:28266] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/database.php"] [unique_id "ahJuVCPlV47QcYwd2v9ZqwAAAUY"]
[Sun May 24 11:19:48.788873 2026] [:error] [pid 23497:tid 23513] [client 4.228.100.214:22931] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/database.php"] [unique_id "ahJuVCPlV47QcYwd2v9ZrQAAAU0"]
[Sun May 24 11:19:49.502956 2026] [:error] [pid 23497:tid 23500] [client 4.228.100.214:39016] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/database.php"] [unique_id "ahJuVSPlV47QcYwd2v9ZrgAAAUA"]
[Sun May 24 11:19:50.135930 2026] [:error] [pid 2639:tid 2663] [client 4.228.100.214:39007] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/favicon.php"] [unique_id "ahJuVkzQncQTd0Z0Oe__9wAAARY"]
[Sun May 24 11:19:50.788628 2026] [:error] [pid 23497:tid 23504] [client 4.228.100.214:28258] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/favicon.php"] [unique_id "ahJuViPlV47QcYwd2v9ZswAAAUQ"]
[Sun May 24 11:19:51.442740 2026] [:error] [pid 23497:tid 23512] [client 4.228.100.214:29554] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/favicon.php"] [unique_id "ahJuVyPlV47QcYwd2v9ZtgAAAUw"]
[Sun May 24 11:19:52.138979 2026] [:error] [pid 23497:tid 23524] [client 4.228.100.214:29560] [client 4.228.100.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/favicon.php"] [unique_id "ahJuWCPlV47QcYwd2v9ZugAAAVg"]
[Sun May 24 11:36:03.112888 2026] [:error] [pid 2639:tid 2654] [client 173.236.211.239:44414] [client 173.236.211.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.211.239, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahJyI0zQncQTd0Z0Oe8G_AAAAQ0"]
[Sun May 24 11:36:04.186297 2026] [:error] [pid 2639:tid 2656] [client 173.236.211.239:44414] [client 173.236.211.239] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.236.211.239, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahJyJEzQncQTd0Z0Oe8HAgAAAQ8"], referer: https://expressinteriors.com/wp-login.php
[Sun May 24 12:11:45.787903 2026] [:error] [pid 23497:tid 23506] [client 134.209.100.212:40286] [client 134.209.100.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.209.100.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahJ6gSPlV47QcYwd2v9voAAAAUY"]
[Sun May 24 12:11:46.650172 2026] [:error] [pid 23497:tid 23504] [client 134.209.100.212:40286] [client 134.209.100.212] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.209.100.212, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahJ6giPlV47QcYwd2v9vpAAAAUQ"], referer: https://expressinteriors.com/wp-login.php
[Sun May 24 12:24:05.122154 2026] [:error] [pid 23497:tid 23503] [client 192.185.176.177:30356] [client 192.185.176.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.176.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahJ9ZSPlV47QcYwd2v90WAAAAUM"]
[Sun May 24 12:24:06.386949 2026] [:error] [pid 23497:tid 23511] [client 192.185.176.177:30356] [client 192.185.176.177] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 192.185.176.177, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahJ9ZiPlV47QcYwd2v90WgAAAUs"], referer: https://expressinteriors.com/wp-login.php
[Sun May 24 12:43:37.525084 2026] [:error] [pid 49689:tid 49733] [client 209.74.67.144:59952] [client 209.74.67.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.74.67.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahKB-QaxiY3NxLUD97VD8wAAAI8"]
[Sun May 24 12:43:38.963940 2026] [:error] [pid 49689:tid 49731] [client 209.74.67.144:59952] [client 209.74.67.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.74.67.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahKB-gaxiY3NxLUD97VD9AAAAI0"], referer: https://expressinteriors.com/wp-login.php
[Sun May 24 13:57:50.905350 2026] [:error] [pid 23497:tid 23502] [client 138.68.243.214:40418] [client 138.68.243.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.68.243.214, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahKTXiPlV47QcYwd2v-Z6AAAAUI"]
[Sun May 24 13:57:52.114847 2026] [:error] [pid 23497:tid 23507] [client 138.68.243.214:40418] [client 138.68.243.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 138.68.243.214, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahKTYCPlV47QcYwd2v-Z7AAAAUc"], referer: https://expressinteriors.com/wp-login.php
[Sun May 24 14:20:03.011072 2026] [:error] [pid 23497:tid 23511] [client 43.130.71.237:36436] [client 43.130.71.237] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ahKYkyPlV47QcYwd2v-jLwAAAUs"]
[Sun May 24 14:22:54.561501 2026] [:error] [pid 49775:tid 49788] [client 62.181.233.16:49166] [client 62.181.233.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.181.233.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahKZPovZb8G6T8WpI1hyJAAAAAs"]
[Sun May 24 14:22:56.413722 2026] [:error] [pid 49775:tid 49796] [client 62.181.233.16:49166] [client 62.181.233.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 62.181.233.16, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahKZQIvZb8G6T8WpI1hyKwAAABM"], referer: https://expressinteriors.com/wp-login.php
[Sun May 24 15:36:55.695279 2026] [:error] [pid 41708:tid 41720] [client 40.89.161.203:16912] [client 40.89.161.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.89.161.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahKql_4tQzoTxpuHBF6g9AAAAYo"]
[Sun May 24 15:36:56.567924 2026] [:error] [pid 41708:tid 41721] [client 40.89.161.203:16912] [client 40.89.161.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.89.161.203, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahKqmP4tQzoTxpuHBF6g9wAAAYs"], referer: https://expressinteriors.com/wp-login.php
[Sun May 24 15:45:46.278081 2026] [:error] [pid 23497:tid 23520] [client 34.86.71.250:55696] [client 34.86.71.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.86.71.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahKsqiPlV47QcYwd2v_IFAAAAVQ"]
[Sun May 24 15:45:48.562776 2026] [:error] [pid 23497:tid 23519] [client 34.86.71.250:55696] [client 34.86.71.250] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ahKsrCPlV47QcYwd2v_IHAAAAVM"]
[Sun May 24 15:45:48.838662 2026] [:error] [pid 23497:tid 23502] [client 34.86.71.250:55696] [client 34.86.71.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.86.71.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahKsrCPlV47QcYwd2v_IHQAAAUI"]
[Sun May 24 15:45:50.677472 2026] [:error] [pid 49689:tid 49720] [client 34.86.71.250:63689] [client 34.86.71.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.86.71.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahKsrgaxiY3NxLUD97VkIAAAAII"]
[Sun May 24 15:45:52.178932 2026] [:error] [pid 49689:tid 49736] [client 34.86.71.250:59013] [client 34.86.71.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.86.71.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahKssAaxiY3NxLUD97VkIQAAAJI"]
[Sun May 24 15:45:53.819352 2026] [:error] [pid 49744:tid 49759] [client 34.86.71.250:63242] [client 34.86.71.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.86.71.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahKssTsE5kPdFpUbbHG7gwAAAM0"]
[Sun May 24 15:45:55.297279 2026] [:error] [pid 23497:tid 23522] [client 34.86.71.250:62538] [client 34.86.71.250] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.86.71.250, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahKssyPlV47QcYwd2v_IIAAAAVY"]
[Sun May 24 15:45:55.297444 2026] [:error] [pid 23497:tid 23522] [client 34.86.71.250:62538] [client 34.86.71.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.86.71.250, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahKssyPlV47QcYwd2v_IIAAAAVY"]
[Sun May 24 15:59:02.192692 2026] [:error] [pid 23497:tid 23522] [client 209.141.36.175:49695] [client 209.141.36.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.36.175, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahKvxiPlV47QcYwd2v_LjgAAAVY"]
[Sun May 24 15:59:24.247287 2026] [:error] [pid 23497:tid 23518] [client 209.141.36.175:51432] [client 209.141.36.175] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.141.36.175, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahKv3CPlV47QcYwd2v_LowAAAVI"]
[Sun May 24 16:12:03.522201 2026] [:error] [pid 2639:tid 2656] [client 20.196.97.33:1483] [client 20.196.97.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahKy00zQncQTd0Z0Oe9YKQAAAQ8"]
[Sun May 24 16:12:04.139920 2026] [:error] [pid 49744:tid 49750] [client 20.196.97.33:1494] [client 20.196.97.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahKy1DsE5kPdFpUbbHHAmwAAAMQ"]
[Sun May 24 16:12:04.827430 2026] [:error] [pid 49688:tid 49700] [client 20.196.97.33:1680] [client 20.196.97.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahKy1GYoQ9V6a_4pBsij3AAAAEk"]
[Sun May 24 16:12:05.457191 2026] [:error] [pid 23497:tid 23523] [client 20.196.97.33:1689] [client 20.196.97.33] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahKy1SPlV47QcYwd2v_PUAAAAVc"]
[Sun May 24 16:23:15.495464 2026] [:error] [pid 23497:tid 23516] [client 43.156.47.42:48690] [client 43.156.47.42] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahK1cyPlV47QcYwd2v_RtAAAAVA"]
[Sun May 24 19:20:58.015978 2026] [:error] [pid 49775:tid 49788] [client 43.157.172.39:50288] [client 43.157.172.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ahLfGovZb8G6T8WpI1ijRAAAAAs"]
[Sun May 24 21:01:25.573680 2026] [:error] [pid 11282:tid 11352] [client 39.97.110.217:33722] [client 39.97.110.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 39.97.110.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahL2pe0bPyN3C7HZ1R-S7wAAAMw"]
[Sun May 24 21:01:26.919954 2026] [:error] [pid 11282:tid 11349] [client 39.97.110.217:33722] [client 39.97.110.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 39.97.110.217, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahL2pu0bPyN3C7HZ1R-S9AAAAMk"], referer: https://expressinteriors.com/wp-login.php
[Sun May 24 21:05:01.723549 2026] [:error] [pid 11368:tid 11392] [client 20.195.178.143:6746] [client 20.195.178.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "ahL3fYfq_sTmmtTKm1UeXgAAARY"]
[Sun May 24 21:05:03.307464 2026] [:error] [pid 11281:tid 11333] [client 20.195.178.143:6756] [client 20.195.178.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "ahL3f5KmC9taWvA91j55xAAAAJQ"]
[Sun May 24 21:05:05.308282 2026] [:error] [pid 11280:tid 11302] [client 20.195.178.143:6778] [client 20.195.178.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "ahL3gYRn5s7laoSxy1QOLgAAAFE"]
[Sun May 24 21:05:07.093421 2026] [:error] [pid 11368:tid 11392] [client 20.195.178.143:11618] [client 20.195.178.143] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "ahL3g4fq_sTmmtTKm1UebwAAARY"]
[Sun May 24 21:17:58.239314 2026] [:error] [pid 15835:tid 15855] [client 43.153.85.46:33668] [client 43.153.85.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahL6hmWbknYlUM9P0qPOpwAAABI"]
[Sun May 24 21:24:30.297900 2026] [:error] [pid 11280:tid 11302] [client 185.102.115.179:55331] [client 185.102.115.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.102.115.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahL8DoRn5s7laoSxy1QTqgAAAFE"]
[Sun May 24 21:25:35.063184 2026] [:error] [pid 15835:tid 15846] [client 185.102.115.179:60311] [client 185.102.115.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.102.115.179, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahL8T2WbknYlUM9P0qPUAQAAAAk"]
[Sun May 24 23:36:10.845532 2026] [:error] [pid 11280:tid 11309] [client 103.74.123.7:39908] [client 103.74.123.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.74.123.7, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahMa6oRn5s7laoSxy1QsNwAAAFg"]
[Sun May 24 23:36:12.054642 2026] [:error] [pid 11280:tid 11286] [client 103.74.123.7:39908] [client 103.74.123.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.74.123.7, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahMa7IRn5s7laoSxy1QsOgAAAEE"], referer: https://expressinteriors.com/wp-login.php
[Mon May 25 00:07:04.034722 2026] [:error] [pid 15835:tid 15847] [client 43.164.0.21:33174] [client 43.164.0.21] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ahMiKGWbknYlUM9P0qMZ3wAAAAo"]
[Mon May 25 03:00:33.145841 2026] [autoindex:error] [pid 11282:tid 11348] [client 20.197.11.101:58040] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Mon May 25 03:09:45.738652 2026] [:error] [pid 3748:tid 3775] [client 107.189.4.58:58969] [client 107.189.4.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.189.4.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahNM-TXPrvfxERhcjYXCxwAAAEo"]
[Mon May 25 03:13:07.084675 2026] [:error] [pid 4038:tid 4128] [client 107.189.4.58:63175] [client 107.189.4.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.189.4.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahNNw-JhpWAIJpC9htfRJwAAAJY"]
[Mon May 25 04:03:33.503275 2026] [:error] [pid 9398:tid 9420] [client 67.205.18.1:49932] [client 67.205.18.1] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 67.205.18.1, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahNZlehIu7KstzsCua93owAAANA"]
[Mon May 25 04:03:40.856979 2026] [:error] [pid 9303:tid 9353] [client 67.205.18.1:58678] [client 67.205.18.1] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ahNZnH3bQScbssitjPQS3wAAAFM"]
[Mon May 25 05:22:17.355456 2026] [:error] [pid 9304:tid 9366] [client 43.156.249.28:43754] [client 43.156.249.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ahNsCeVEV2qpMC_1UzRtDQAAAIU"]
[Mon May 25 05:26:18.062928 2026] [:error] [pid 9398:tid 9407] [client 182.69.179.108:12642] [client 182.69.179.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.69.179.108, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahNs-uhIu7KstzsCua-bkAAAAMc"], referer: https://expressinteriors.com/
[Mon May 25 06:54:19.603919 2026] [:error] [pid 21606:tid 21631] [client 46.151.182.172:49169] [client 46.151.182.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahOBm2swdp0RYkH5t9XFzAAAAVc"]
[Mon May 25 06:54:19.605508 2026] [:error] [pid 9303:tid 9343] [client 46.151.182.172:49170] [client 46.151.182.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahOBm33bQScbssitjPQ-jwAAAEk"]
[Mon May 25 06:54:20.875786 2026] [:error] [pid 9398:tid 9401] [client 46.151.182.172:51702] [client 46.151.182.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahOBnOhIu7KstzsCua-x1gAAAME"]
[Mon May 25 06:54:20.880597 2026] [:error] [pid 9304:tid 9376] [client 46.151.182.172:51729] [client 46.151.182.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahOBnOVEV2qpMC_1UzSMzwAAAI8"]
[Mon May 25 06:54:21.457580 2026] [:error] [pid 9398:tid 9427] [client 46.151.182.172:59787] [client 46.151.182.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahOBnehIu7KstzsCua-x3AAAANc"]
[Mon May 25 06:54:21.519383 2026] [:error] [pid 9302:tid 9326] [client 46.151.182.172:50880] [client 46.151.182.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahOBnS1RaFfTSnDQnqFXlAAAABM"]
[Mon May 25 06:54:22.035699 2026] [:error] [pid 9302:tid 9322] [client 46.151.182.172:57371] [client 46.151.182.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahOBni1RaFfTSnDQnqFXnwAAAA8"]
[Mon May 25 06:54:22.099734 2026] [:error] [pid 9302:tid 9326] [client 46.151.182.172:61755] [client 46.151.182.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahOBni1RaFfTSnDQnqFXqQAAABM"]
[Mon May 25 06:54:22.706328 2026] [:error] [pid 9304:tid 9376] [client 46.151.182.172:57194] [client 46.151.182.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahOBnuVEV2qpMC_1UzSM7QAAAI8"]
[Mon May 25 06:54:22.790628 2026] [:error] [pid 9398:tid 9404] [client 46.151.182.172:60912] [client 46.151.182.172] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahOBnuhIu7KstzsCua-x7QAAAMQ"]
[Mon May 25 07:08:18.767969 2026] [:error] [pid 50423:tid 50425] [client 158.158.44.35:47205] [client 158.158.44.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "ahOE4qJWO7En4nKEQ3g-SQAAAQA"]
[Mon May 25 07:08:19.785398 2026] [:error] [pid 9302:tid 9328] [client 158.158.44.35:47104] [client 158.158.44.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "ahOE4y1RaFfTSnDQnqFbRwAAABU"]
[Mon May 25 07:08:20.821641 2026] [:error] [pid 9304:tid 9382] [client 158.158.44.35:47176] [client 158.158.44.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "ahOE5OVEV2qpMC_1UzSVoQAAAJU"]
[Mon May 25 07:08:21.840452 2026] [:error] [pid 9304:tid 9384] [client 158.158.44.35:47193] [client 158.158.44.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "ahOE5eVEV2qpMC_1UzSVpAAAAJc"]
[Mon May 25 07:09:18.610038 2026] [:error] [pid 50423:tid 50437] [client 104.28.214.122:38795] [client 104.28.214.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/ms-themes.php"] [unique_id "ahOFHqJWO7En4nKEQ3g-pgAAAQw"]
[Mon May 25 07:13:24.956579 2026] [:error] [pid 21606:tid 21625] [client 45.154.98.96:58479] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahOGFGswdp0RYkH5t9XKwwAAAVE"]
[Mon May 25 07:13:25.067134 2026] [:error] [pid 9303:tid 9339] [client 45.154.98.96:57589] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfacgiapi/perl.alfa"] [unique_id "ahOGFX3bQScbssitjPRFvAAAAEU"], referer: www.google.com
[Mon May 25 07:13:25.567818 2026] [:error] [pid 9304:tid 9362] [client 45.154.98.96:59568] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfacgiapi/perl.alfa"] [unique_id "ahOGFeVEV2qpMC_1UzSZFwAAAIE"], referer: www.google.com
[Mon May 25 07:13:25.797891 2026] [:error] [pid 9302:tid 9308] [client 45.154.98.96:59137] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "ahOGFS1RaFfTSnDQnqFdIgAAAAE"], referer: www.google.com
[Mon May 25 07:13:25.981079 2026] [:error] [pid 50423:tid 50431] [client 45.154.98.96:59432] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahOGFaJWO7En4nKEQ3hArQAAAQY"]
[Mon May 25 07:13:26.071182 2026] [:error] [pid 9304:tid 9385] [client 45.154.98.96:60110] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfacgiapi/perl.alfa"] [unique_id "ahOGFuVEV2qpMC_1UzSZKwAAAJg"], referer: www.google.com
[Mon May 25 07:13:26.555653 2026] [:error] [pid 9303:tid 9334] [client 45.154.98.96:60709] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfacgiapi/perl.alfa"] [unique_id "ahOGFn3bQScbssitjPRF1AAAAEA"], referer: www.google.com
[Mon May 25 07:13:26.625699 2026] [:error] [pid 9303:tid 9357] [client 45.154.98.96:57592] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/omcpqivu.php"] [unique_id "ahOGFn3bQScbssitjPRF1wAAAFc"], referer: www.google.com
[Mon May 25 07:13:26.761558 2026] [:error] [pid 21606:tid 21624] [client 45.154.98.96:60340] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "ahOGFmswdp0RYkH5t9XKzQAAAVA"], referer: www.google.com
[Mon May 25 07:13:26.886319 2026] [:error] [pid 21606:tid 21613] [client 45.154.98.96:57591] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/omcpqivu.php"] [unique_id "ahOGFmswdp0RYkH5t9XK0QAAAUU"], referer: www.google.com
[Mon May 25 07:13:26.985472 2026] [:error] [pid 9303:tid 9347] [client 45.154.98.96:60602] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahOGFn3bQScbssitjPRF3AAAAE0"]
[Mon May 25 07:13:27.101191 2026] [:error] [pid 50423:tid 50437] [client 45.154.98.96:61377] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/alfacgiapi/perl.alfa"] [unique_id "ahOGF6JWO7En4nKEQ3hAsgAAAQw"], referer: www.google.com
[Mon May 25 07:13:27.141547 2026] [:error] [pid 21606:tid 21615] [client 45.154.98.96:57594] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/omcpqivu.php"] [unique_id "ahOGF2swdp0RYkH5t9XK0gAAAUc"], referer: www.google.com
[Mon May 25 07:13:27.386181 2026] [:error] [pid 21606:tid 21621] [client 45.154.98.96:57588] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/omcpqivu.php"] [unique_id "ahOGF2swdp0RYkH5t9XK0wAAAU0"], referer: www.google.com
[Mon May 25 07:13:27.799138 2026] [:error] [pid 9303:tid 9337] [client 45.154.98.96:61679] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "ahOGF33bQScbssitjPRF6gAAAEM"], referer: www.google.com
[Mon May 25 07:13:27.888533 2026] [:error] [pid 50423:tid 50447] [client 45.154.98.96:62666] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/omcpqivu.php"] [unique_id "ahOGF6JWO7En4nKEQ3hAvgAAARY"], referer: www.google.com
[Mon May 25 07:13:27.962033 2026] [:error] [pid 9303:tid 9357] [client 45.154.98.96:61924] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahOGF33bQScbssitjPRF7gAAAFc"]
[Mon May 25 07:13:28.098986 2026] [:error] [pid 9303:tid 9347] [client 45.154.98.96:62273] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "ahOGGH3bQScbssitjPRF9AAAAE0"], referer: www.google.com
[Mon May 25 07:13:28.786858 2026] [:error] [pid 50423:tid 50441] [client 45.154.98.96:63308] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "ahOGGKJWO7En4nKEQ3hAywAAARA"], referer: www.google.com
[Mon May 25 07:13:28.935271 2026] [:error] [pid 9303:tid 9340] [client 45.154.98.96:63568] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahOGGH3bQScbssitjPRF_AAAAEY"]
[Mon May 25 07:13:29.066931 2026] [:error] [pid 50423:tid 50439] [client 45.154.98.96:63825] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "ahOGGaJWO7En4nKEQ3hA1AAAAQ4"], referer: www.google.com
[Mon May 25 07:13:29.756484 2026] [:error] [pid 9304:tid 9363] [client 45.154.98.96:64695] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "ahOGGeVEV2qpMC_1UzSZbQAAAII"], referer: www.google.com
[Mon May 25 07:13:30.045411 2026] [:error] [pid 9398:tid 9428] [client 45.154.98.96:65086] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "ahOGGuhIu7KstzsCua-5RgAAANg"], referer: www.google.com
[Mon May 25 07:13:31.039091 2026] [:error] [pid 9398:tid 9425] [client 45.154.98.96:49996] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "ahOGG-hIu7KstzsCua-5SQAAANU"], referer: www.google.com
[Mon May 25 07:13:32.020012 2026] [:error] [pid 9304:tid 9366] [client 45.154.98.96:51198] [client 45.154.98.96] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "ahOGHOVEV2qpMC_1UzSZhAAAAIU"], referer: www.google.com
[Mon May 25 07:20:12.232232 2026] [:error] [pid 50423:tid 50435] [client 43.135.145.77:59794] [client 43.135.145.77] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahOHrKJWO7En4nKEQ3hDzwAAAQo"]
[Mon May 25 08:06:18.295317 2026] [:error] [pid 62426:tid 62436] [client 34.220.145.84:35580] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/config"] [unique_id "ahOSekj3D3Mo8ANpTRBwnwAAAAY"]
[Mon May 25 08:06:20.523984 2026] [:error] [pid 62426:tid 62448] [client 34.220.145.84:52788] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.git/credentials"] [unique_id "ahOSfEj3D3Mo8ANpTRBwpAAAABI"]
[Mon May 25 08:06:22.943717 2026] [:error] [pid 62427:tid 62458] [client 34.220.145.84:52794] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env"] [unique_id "ahOSfvMUa83fc4GDyBzwDAAAAUE"]
[Mon May 25 08:06:24.014901 2026] [:error] [pid 62722:tid 62724] [client 34.220.145.84:52802] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.local"] [unique_id "ahOSgKM6ssnLWYf6CVBByQAAAEA"]
[Mon May 25 08:06:25.058709 2026] [:error] [pid 62722:tid 62742] [client 34.220.145.84:52804] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.production"] [unique_id "ahOSgaM6ssnLWYf6CVBBzAAAAFI"]
[Mon May 25 08:06:25.990112 2026] [:error] [pid 62515:tid 62521] [client 34.220.145.84:52820] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.staging"] [unique_id "ahOSgRig0_XsOwmnrv9NNwAAAMQ"]
[Mon May 25 08:06:27.149570 2026] [:error] [pid 62722:tid 62731] [client 34.220.145.84:42856] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.development"] [unique_id "ahOSg6M6ssnLWYf6CVBB0AAAAEc"]
[Mon May 25 08:06:27.984501 2026] [:error] [pid 62722:tid 62746] [client 34.220.145.84:42858] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.test"] [unique_id "ahOSg6M6ssnLWYf6CVBB0wAAAFY"]
[Mon May 25 08:06:28.710621 2026] [:error] [pid 62426:tid 62450] [client 34.220.145.84:42872] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.remote"] [unique_id "ahOShEj3D3Mo8ANpTRBwrAAAABQ"]
[Mon May 25 08:06:29.540493 2026] [:error] [pid 62515:tid 62536] [client 34.220.145.84:42874] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.bak"] [unique_id "ahOShRig0_XsOwmnrv9NSAAAANM"]
[Mon May 25 08:06:30.327447 2026] [:error] [pid 62515:tid 62518] [client 34.220.145.84:42884] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.backup"] [unique_id "ahOShhig0_XsOwmnrv9NTQAAAME"]
[Mon May 25 08:06:31.092228 2026] [:error] [pid 62722:tid 62746] [client 34.220.145.84:42896] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.save"] [unique_id "ahOSh6M6ssnLWYf6CVBB2wAAAFY"]
[Mon May 25 08:06:31.908874 2026] [:error] [pid 62722:tid 62733] [client 34.220.145.84:42908] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.old"] [unique_id "ahOSh6M6ssnLWYf6CVBB4QAAAEk"]
[Mon May 25 08:06:32.718537 2026] [:error] [pid 62722:tid 62737] [client 34.220.145.84:42910] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.sample"] [unique_id "ahOSiKM6ssnLWYf6CVBB6QAAAE0"]
[Mon May 25 08:06:33.956006 2026] [:error] [pid 62722:tid 62740] [client 34.220.145.84:42924] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.example"] [unique_id "ahOSiaM6ssnLWYf6CVBB7QAAAFA"]
[Mon May 25 08:06:34.761164 2026] [:error] [pid 62722:tid 62732] [client 34.220.145.84:42926] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.dev"] [unique_id "ahOSiqM6ssnLWYf6CVBB7wAAAEg"]
[Mon May 25 08:06:35.527602 2026] [:error] [pid 62722:tid 62744] [client 34.220.145.84:42934] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.prod"] [unique_id "ahOSi6M6ssnLWYf6CVBB8QAAAFQ"]
[Mon May 25 08:06:36.381642 2026] [:error] [pid 62722:tid 62746] [client 34.220.145.84:42948] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.stage"] [unique_id "ahOSjKM6ssnLWYf6CVBB9AAAAFY"]
[Mon May 25 08:06:37.258874 2026] [:error] [pid 62428:tid 62500] [client 34.220.145.84:43880] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.ci"] [unique_id "ahOSjZNosGBa7mui3VScfgAAAJA"]
[Mon May 25 08:06:38.074798 2026] [:error] [pid 62428:tid 62491] [client 34.220.145.84:43894] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.docker"] [unique_id "ahOSjpNosGBa7mui3VScfwAAAIc"]
[Mon May 25 08:06:39.149157 2026] [:error] [pid 62427:tid 62468] [client 34.220.145.84:43898] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.live"] [unique_id "ahOSj_MUa83fc4GDyBzwGAAAAUs"]
[Mon May 25 08:06:39.993947 2026] [:error] [pid 62427:tid 62473] [client 34.220.145.84:43902] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.preprod"] [unique_id "ahOSj_MUa83fc4GDyBzwGQAAAVA"]
[Mon May 25 08:06:41.249030 2026] [:error] [pid 62426:tid 62436] [client 34.220.145.84:43904] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.uat"] [unique_id "ahOSkUj3D3Mo8ANpTRBwtwAAAAY"]
[Mon May 25 08:06:42.031891 2026] [:error] [pid 62515:tid 62526] [client 34.220.145.84:43914] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.dist"] [unique_id "ahOSkhig0_XsOwmnrv9NXwAAAMk"]
[Mon May 25 08:06:43.095102 2026] [:error] [pid 62515:tid 62531] [client 34.220.145.84:43920] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.swp"] [unique_id "ahOSkxig0_XsOwmnrv9NZAAAAM4"]
[Mon May 25 08:06:43.968136 2026] [:error] [pid 62722:tid 62740] [client 34.220.145.84:43926] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env~"] [unique_id "ahOSk6M6ssnLWYf6CVBB_QAAAFA"]
[Mon May 25 08:06:44.832429 2026] [:error] [pid 62722:tid 62745] [client 34.220.145.84:43934] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env1"] [unique_id "ahOSlKM6ssnLWYf6CVBB_wAAAFU"]
[Mon May 25 08:06:45.934145 2026] [:error] [pid 62722:tid 62731] [client 34.220.145.84:43940] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env2"] [unique_id "ahOSlaM6ssnLWYf6CVBCAwAAAEc"]
[Mon May 25 08:06:47.264440 2026] [:error] [pid 62428:tid 62508] [client 34.220.145.84:39992] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env_copy"] [unique_id "ahOSl5NosGBa7mui3VSchAAAAJg"]
[Mon May 25 08:06:47.996451 2026] [:error] [pid 62427:tid 62459] [client 34.220.145.84:39996] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.txt"] [unique_id "ahOSl_MUa83fc4GDyBzwIQAAAUI"]
[Mon May 25 08:06:49.359496 2026] [:error] [pid 62427:tid 62464] [client 34.220.145.84:40010] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.json"] [unique_id "ahOSmfMUa83fc4GDyBzwIwAAAUc"]
[Mon May 25 08:06:50.332882 2026] [:error] [pid 62428:tid 62492] [client 34.220.145.84:40024] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.yaml"] [unique_id "ahOSmpNosGBa7mui3VSchgAAAIg"]
[Mon May 25 08:06:51.178773 2026] [:error] [pid 62427:tid 62475] [client 34.220.145.84:40034] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/.env.yml"] [unique_id "ahOSm_MUa83fc4GDyBzwKAAAAVI"]
[Mon May 25 08:06:52.031710 2026] [:error] [pid 62428:tid 62500] [client 34.220.145.84:40040] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/app/.env"] [unique_id "ahOSnJNosGBa7mui3VSchwAAAJA"]
[Mon May 25 08:06:52.963049 2026] [:error] [pid 62515:tid 62524] [client 34.220.145.84:40050] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/apps/.env"] [unique_id "ahOSnBig0_XsOwmnrv9NaQAAAMc"]
[Mon May 25 08:06:53.687747 2026] [:error] [pid 62722:tid 62746] [client 34.220.145.84:40066] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/api/.env"] [unique_id "ahOSnaM6ssnLWYf6CVBCCgAAAFY"]
[Mon May 25 08:06:54.429132 2026] [:error] [pid 62722:tid 62728] [client 34.220.145.84:40072] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/web/.env"] [unique_id "ahOSnqM6ssnLWYf6CVBCDAAAAEQ"]
[Mon May 25 08:06:55.642481 2026] [:error] [pid 62722:tid 62732] [client 34.220.145.84:40084] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/site/.env"] [unique_id "ahOSn6M6ssnLWYf6CVBCDQAAAEg"]
[Mon May 25 08:06:56.373469 2026] [:error] [pid 62428:tid 62501] [client 34.220.145.84:40094] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/public/.env"] [unique_id "ahOSoJNosGBa7mui3VSciwAAAJE"]
[Mon May 25 08:06:57.100049 2026] [:error] [pid 62428:tid 62499] [client 34.220.145.84:33088] [client 34.220.145.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "expressinteriors.com"] [uri "/admin/.env"] [unique_id "ahOSoZNosGBa7mui3VScjgAAAI8"]
[Mon May 25 09:28:18.570325 2026] [:error] [pid 62428:tid 62508] [client 187.94.6.152:30452] [client 187.94.6.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.94.6.152, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahOlspNosGBa7mui3VS0dgAAAJg"]
[Mon May 25 09:28:29.431423 2026] [:error] [pid 62722:tid 62728] [client 187.94.6.152:30251] [client 187.94.6.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.94.6.152, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahOlvaM6ssnLWYf6CVBt-gAAAEQ"]
[Mon May 25 09:28:40.227954 2026] [:error] [pid 62426:tid 62436] [client 187.94.6.152:33384] [client 187.94.6.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.94.6.152, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahOlyEj3D3Mo8ANpTRCCbAAAAAY"]
[Mon May 25 09:28:50.806791 2026] [:error] [pid 62722:tid 62738] [client 187.94.6.152:21041] [client 187.94.6.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.94.6.152, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahOl0qM6ssnLWYf6CVBuQwAAAE4"]
[Mon May 25 09:29:01.479777 2026] [:error] [pid 62426:tid 62443] [client 187.94.6.152:64936] [client 187.94.6.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.94.6.152, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahOl3Uj3D3Mo8ANpTRCCdAAAAA0"]
[Mon May 25 10:14:50.853260 2026] [:error] [pid 62722:tid 62742] [client 122.183.33.150:26881] [client 122.183.33.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.183.33.150, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahOwmqM6ssnLWYf6CVCFhQAAAFI"]
[Mon May 25 10:15:01.232432 2026] [:error] [pid 62722:tid 62732] [client 122.183.33.150:17321] [client 122.183.33.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.183.33.150, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahOwpaM6ssnLWYf6CVCFnQAAAEg"]
[Mon May 25 10:15:11.883141 2026] [:error] [pid 62515:tid 62537] [client 122.183.33.150:22568] [client 122.183.33.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.183.33.150, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahOwrxig0_XsOwmnrv9_DAAAANQ"]
[Mon May 25 10:15:21.927626 2026] [:error] [pid 62722:tid 62746] [client 122.183.33.150:25321] [client 122.183.33.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.183.33.150, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahOwuaM6ssnLWYf6CVCF7AAAAFY"]
[Mon May 25 10:15:32.184778 2026] [:error] [pid 62428:tid 62507] [client 122.183.33.150:1618] [client 122.183.33.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.183.33.150, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahOwxJNosGBa7mui3VTEpgAAAJc"]
[Mon May 25 10:23:23.831012 2026] [:error] [pid 62427:tid 62467] [client 162.62.132.25:44640] [client 162.62.132.25] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ahOym_MUa83fc4GDyBwVyAAAAUo"]
[Mon May 25 12:16:04.482063 2026] [:error] [pid 62722:tid 62736] [client 112.202.122.217:58416] [client 112.202.122.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.202.122.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahPNBKM6ssnLWYf6CVC86AAAAEw"]
[Mon May 25 12:17:27.412378 2026] [:error] [pid 62722:tid 62746] [client 112.202.122.217:59640] [client 112.202.122.217] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahPNV6M6ssnLWYf6CVC9SgAAAFY"]
[Mon May 25 12:18:45.469137 2026] [:error] [pid 62515:tid 62517] [client 112.202.122.217:60683] [client 112.202.122.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.202.122.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahPNpRig0_XsOwmnrv-l5gAAAMA"]
[Mon May 25 12:19:20.147162 2026] [:error] [pid 62722:tid 62746] [client 112.202.122.217:60942] [client 112.202.122.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.202.122.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahPNyKM6ssnLWYf6CVC-XgAAAFY"]
[Mon May 25 12:19:51.795667 2026] [:error] [pid 62515:tid 62524] [client 112.202.122.217:61173] [client 112.202.122.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.202.122.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahPN5xig0_XsOwmnrv-mEgAAAMc"]
[Mon May 25 12:20:23.467333 2026] [:error] [pid 62427:tid 62472] [client 112.202.122.217:61339] [client 112.202.122.217] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.202.122.217, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahPOB_MUa83fc4GDyBwroQAAAU8"]
[Mon May 25 12:22:54.471990 2026] [:error] [pid 62722:tid 62727] [client 4.225.163.177:32415] [client 4.225.163.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "ahPOnqM6ssnLWYf6CVC_uQAAAEM"]
[Mon May 25 12:22:55.690331 2026] [:error] [pid 62515:tid 62517] [client 4.225.163.177:56892] [client 4.225.163.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "ahPOnxig0_XsOwmnrv-mtQAAAMA"]
[Mon May 25 12:22:56.843895 2026] [:error] [pid 62722:tid 62738] [client 4.225.163.177:56880] [client 4.225.163.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "ahPOoKM6ssnLWYf6CVC_xgAAAE4"]
[Mon May 25 12:22:58.151195 2026] [:error] [pid 62722:tid 62726] [client 4.225.163.177:56839] [client 4.225.163.177] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "ahPOoqM6ssnLWYf6CVC_0wAAAEI"]
[Mon May 25 12:50:36.477466 2026] [:error] [pid 62426:tid 62452] [client 43.165.4.2:33326] [client 43.165.4.2] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahPVHEj3D3Mo8ANpTRCkigAAABY"]
[Mon May 25 14:22:02.389348 2026] [:error] [pid 62427:tid 62463] [client 107.189.4.58:50749] [client 107.189.4.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.189.4.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahPqivMUa83fc4GDyBxJBgAAAUY"]
[Mon May 25 14:22:03.240309 2026] [:error] [pid 62427:tid 62468] [client 107.189.4.58:50749] [client 107.189.4.58] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 107.189.4.58, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahPqi_MUa83fc4GDyBxJCAAAAUs"]
[Mon May 25 14:27:19.076022 2026] [:error] [pid 62722:tid 62742] [client 103.124.95.168:47256] [client 103.124.95.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.124.95.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahPrx6M6ssnLWYf6CVD9fwAAAFI"]
[Mon May 25 14:27:20.190039 2026] [:error] [pid 62722:tid 62747] [client 103.124.95.168:47256] [client 103.124.95.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.124.95.168, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahPryKM6ssnLWYf6CVD9gQAAAFc"], referer: https://expressinteriors.com/wp-login.php
[Mon May 25 14:30:27.296908 2026] [:error] [pid 62515:tid 62518] [client 143.244.182.226:45254] [client 143.244.182.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.244.182.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahPsgxig0_XsOwmnrv_TVQAAAME"]
[Mon May 25 14:30:28.180125 2026] [:error] [pid 62515:tid 62539] [client 143.244.182.226:45254] [client 143.244.182.226] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 143.244.182.226, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahPshBig0_XsOwmnrv_TVwAAANY"], referer: https://expressinteriors.com/wp-login.php
[Mon May 25 14:39:16.451387 2026] [:error] [pid 62722:tid 62741] [client 82.156.88.97:49042] [client 82.156.88.97] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahPulKM6ssnLWYf6CVACWgAAAFE"]
[Mon May 25 16:03:35.384804 2026] [:error] [pid 62515:tid 62540] [client 20.226.59.228:15346] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/koala.php"] [unique_id "ahQCVxig0_XsOwmnrv_sIgAAANc"]
[Mon May 25 16:03:36.247651 2026] [:error] [pid 62722:tid 62740] [client 20.226.59.228:15354] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/koala.php"] [unique_id "ahQCWKM6ssnLWYf6CVAdlwAAAFA"]
[Mon May 25 16:03:36.974352 2026] [:error] [pid 62426:tid 62435] [client 20.226.59.228:15308] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/koala.php"] [unique_id "ahQCWEj3D3Mo8ANpTRDGjgAAAAU"]
[Mon May 25 16:03:37.742437 2026] [:error] [pid 62428:tid 62489] [client 20.226.59.228:15358] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/koala.php"] [unique_id "ahQCWZNosGBa7mui3VQZ3wAAAIU"]
[Mon May 25 16:03:38.442349 2026] [:error] [pid 62427:tid 62474] [client 20.226.59.228:15248] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mac.php"] [unique_id "ahQCWvMUa83fc4GDyBxb9AAAAVE"]
[Mon May 25 16:03:39.409396 2026] [:error] [pid 62722:tid 62735] [client 20.226.59.228:15313] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mac.php"] [unique_id "ahQCW6M6ssnLWYf6CVAdnwAAAEs"]
[Mon May 25 16:03:40.241920 2026] [:error] [pid 3698:tid 3721] [client 20.226.59.228:15336] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mac.php"] [unique_id "ahQCXAtZBEwA4fyFLKO6wAAAARU"]
[Mon May 25 16:03:40.967341 2026] [:error] [pid 62428:tid 62498] [client 20.226.59.228:15311] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/mac.php"] [unique_id "ahQCXJNosGBa7mui3VQZ5QAAAI4"]
[Mon May 25 16:03:41.640744 2026] [:error] [pid 53791:tid 53815] [client 20.226.59.228:15236] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/25d653587fdfd1.php"] [unique_id "ahQCXSCRhhNTD40Nf1XUJgAAAZY"]
[Mon May 25 16:03:42.459605 2026] [:error] [pid 62427:tid 62461] [client 20.226.59.228:15261] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/25d653587fdfd1.php"] [unique_id "ahQCXvMUa83fc4GDyBxb-AAAAUQ"]
[Mon May 25 16:03:43.215190 2026] [:error] [pid 53791:tid 53795] [client 20.226.59.228:15348] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/25d653587fdfd1.php"] [unique_id "ahQCXyCRhhNTD40Nf1XUKgAAAYI"]
[Mon May 25 16:03:43.948013 2026] [:error] [pid 62515:tid 62518] [client 20.226.59.228:15242] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/25d653587fdfd1.php"] [unique_id "ahQCXxig0_XsOwmnrv_sJgAAAME"]
[Mon May 25 16:03:44.714159 2026] [:error] [pid 53791:tid 53810] [client 20.226.59.228:15233] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wefile.php"] [unique_id "ahQCYCCRhhNTD40Nf1XULwAAAZE"]
[Mon May 25 16:03:45.691949 2026] [:error] [pid 62515:tid 62532] [client 20.226.59.228:15331] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wefile.php"] [unique_id "ahQCYRig0_XsOwmnrv_sKQAAAM8"]
[Mon May 25 16:03:46.739004 2026] [:error] [pid 62428:tid 62490] [client 20.226.59.228:15232] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wefile.php"] [unique_id "ahQCYpNosGBa7mui3VQZ7QAAAIY"]
[Mon May 25 16:03:47.471908 2026] [:error] [pid 62515:tid 62527] [client 20.226.59.228:15173] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wefile.php"] [unique_id "ahQCYxig0_XsOwmnrv_sLwAAAMo"]
[Mon May 25 16:03:48.230491 2026] [:error] [pid 62428:tid 62485] [client 20.226.59.228:15250] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp3.php"] [unique_id "ahQCZJNosGBa7mui3VQZ7wAAAIE"]
[Mon May 25 16:03:49.033039 2026] [:error] [pid 62722:tid 62729] [client 20.226.59.228:15334] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp3.php"] [unique_id "ahQCZaM6ssnLWYf6CVAdqgAAAEU"]
[Mon May 25 16:03:49.774539 2026] [:error] [pid 62515:tid 62522] [client 20.226.59.228:15340] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp3.php"] [unique_id "ahQCZRig0_XsOwmnrv_sMwAAAMU"]
[Mon May 25 16:03:50.527676 2026] [:error] [pid 53791:tid 53810] [client 20.226.59.228:15171] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/casp3.php"] [unique_id "ahQCZiCRhhNTD40Nf1XUSQAAAZE"]
[Mon May 25 16:03:51.301801 2026] [:error] [pid 53791:tid 53815] [client 20.226.59.228:15252] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "ahQCZyCRhhNTD40Nf1XUTAAAAZY"]
[Mon May 25 16:03:52.278144 2026] [:error] [pid 62426:tid 62431] [client 20.226.59.228:15189] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "ahQCaEj3D3Mo8ANpTRDGoAAAAAE"]
[Mon May 25 16:03:53.080099 2026] [:error] [pid 62427:tid 62481] [client 20.226.59.228:15277] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "ahQCafMUa83fc4GDyBxb-wAAAVg"]
[Mon May 25 16:03:53.988805 2026] [:error] [pid 53791:tid 53816] [client 20.226.59.228:15235] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "ahQCaSCRhhNTD40Nf1XUUwAAAZc"]
[Mon May 25 16:03:54.808312 2026] [:error] [pid 3698:tid 3714] [client 20.226.59.228:15357] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/"] [unique_id "ahQCagtZBEwA4fyFLKO64AAAAQ4"]
[Mon May 25 16:03:55.970351 2026] [:error] [pid 3698:tid 3724] [client 20.226.59.228:15176] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/"] [unique_id "ahQCawtZBEwA4fyFLKO67AAAARg"]
[Mon May 25 16:03:56.761369 2026] [:error] [pid 53791:tid 53805] [client 20.226.59.228:15286] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/"] [unique_id "ahQCbCCRhhNTD40Nf1XUWwAAAYw"]
[Mon May 25 16:03:57.444815 2026] [:error] [pid 53791:tid 53801] [client 20.226.59.228:15338] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/js/"] [unique_id "ahQCbSCRhhNTD40Nf1XUXgAAAYg"]
[Mon May 25 16:03:58.377930 2026] [:error] [pid 62722:tid 62741] [client 20.226.59.228:15212] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colour.php"] [unique_id "ahQCbqM6ssnLWYf6CVAdsQAAAFE"]
[Mon May 25 16:03:59.226036 2026] [:error] [pid 53791:tid 53814] [client 20.226.59.228:15298] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colour.php"] [unique_id "ahQCbyCRhhNTD40Nf1XUYwAAAZU"]
[Mon May 25 16:04:00.225901 2026] [:error] [pid 53791:tid 53807] [client 20.226.59.228:15280] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colour.php"] [unique_id "ahQCcCCRhhNTD40Nf1XUZQAAAY4"]
[Mon May 25 16:04:00.936199 2026] [:error] [pid 3698:tid 3723] [client 20.226.59.228:15323] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colour.php"] [unique_id "ahQCcAtZBEwA4fyFLKO69gAAARc"]
[Mon May 25 16:04:01.640807 2026] [:error] [pid 3698:tid 3710] [client 20.226.59.228:15300] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/half.php"] [unique_id "ahQCcQtZBEwA4fyFLKO6-gAAAQo"]
[Mon May 25 16:04:02.324207 2026] [:error] [pid 53791:tid 53802] [client 20.226.59.228:15238] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/half.php"] [unique_id "ahQCciCRhhNTD40Nf1XUawAAAYk"]
[Mon May 25 16:04:03.093681 2026] [:error] [pid 62515:tid 62526] [client 20.226.59.228:15297] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/half.php"] [unique_id "ahQCcxig0_XsOwmnrv_sPQAAAMk"]
[Mon May 25 16:04:03.864572 2026] [:error] [pid 53791:tid 53809] [client 20.226.59.228:15341] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/half.php"] [unique_id "ahQCcyCRhhNTD40Nf1XUcQAAAZA"]
[Mon May 25 16:04:04.620327 2026] [:error] [pid 62515:tid 62521] [client 20.226.59.228:15265] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2P.php"] [unique_id "ahQCdBig0_XsOwmnrv_sPgAAAMQ"]
[Mon May 25 16:04:05.394273 2026] [:error] [pid 62515:tid 62518] [client 20.226.59.228:15296] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2P.php"] [unique_id "ahQCdRig0_XsOwmnrv_sQQAAAME"]
[Mon May 25 16:04:06.170294 2026] [:error] [pid 62515:tid 62537] [client 20.226.59.228:15254] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2P.php"] [unique_id "ahQCdhig0_XsOwmnrv_sQgAAANQ"]
[Mon May 25 16:04:07.114118 2026] [:error] [pid 62515:tid 62541] [client 20.226.59.228:15239] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2P.php"] [unique_id "ahQCdxig0_XsOwmnrv_sRAAAANg"]
[Mon May 25 16:04:07.973876 2026] [:error] [pid 62428:tid 62499] [client 20.226.59.228:15199] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tires.php"] [unique_id "ahQCd5NosGBa7mui3VQaBwAAAI8"]
[Mon May 25 16:04:08.817562 2026] [:error] [pid 3698:tid 3703] [client 20.226.59.228:15351] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tires.php"] [unique_id "ahQCeAtZBEwA4fyFLKO7AgAAAQM"]
[Mon May 25 16:04:09.883257 2026] [:error] [pid 3698:tid 3718] [client 20.226.59.228:15310] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tires.php"] [unique_id "ahQCeQtZBEwA4fyFLKO7AwAAARI"]
[Mon May 25 16:04:10.578921 2026] [:error] [pid 62426:tid 62452] [client 20.226.59.228:15325] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tires.php"] [unique_id "ahQCekj3D3Mo8ANpTRDGqgAAABY"]
[Mon May 25 16:04:11.402359 2026] [:error] [pid 62426:tid 62436] [client 20.226.59.228:15244] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "ahQCe0j3D3Mo8ANpTRDGqwAAAAY"]
[Mon May 25 16:04:12.138697 2026] [:error] [pid 62426:tid 62449] [client 20.226.59.228:15322] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "ahQCfEj3D3Mo8ANpTRDGrAAAABM"]
[Mon May 25 16:04:12.992793 2026] [:error] [pid 53791:tid 53813] [client 20.226.59.228:15247] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "ahQCfCCRhhNTD40Nf1XUeAAAAZQ"]
[Mon May 25 16:04:13.728284 2026] [:error] [pid 62426:tid 62443] [client 20.226.59.228:15270] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wordpress/wp-admin/maint/"] [unique_id "ahQCfUj3D3Mo8ANpTRDGrwAAAA0"]
[Mon May 25 16:04:14.625965 2026] [:error] [pid 62515:tid 62526] [client 20.226.59.228:15191] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/like.php"] [unique_id "ahQCfhig0_XsOwmnrv_sUgAAAMk"]
[Mon May 25 16:04:15.407296 2026] [:error] [pid 53791:tid 53815] [client 20.226.59.228:15320] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/like.php"] [unique_id "ahQCfyCRhhNTD40Nf1XUfgAAAZY"]
[Mon May 25 16:04:16.189277 2026] [:error] [pid 62428:tid 62488] [client 20.226.59.228:15353] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/like.php"] [unique_id "ahQCgJNosGBa7mui3VQaFQAAAIQ"]
[Mon May 25 16:04:16.936300 2026] [:error] [pid 53791:tid 53816] [client 20.226.59.228:15245] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/like.php"] [unique_id "ahQCgCCRhhNTD40Nf1XUiAAAAZc"]
[Mon May 25 16:04:17.628779 2026] [:error] [pid 53791:tid 53795] [client 20.226.59.228:15251] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/about.php"] [unique_id "ahQCgSCRhhNTD40Nf1XUjAAAAYI"]
[Mon May 25 16:04:18.309286 2026] [:error] [pid 62515:tid 62521] [client 20.226.59.228:15255] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/about.php"] [unique_id "ahQCghig0_XsOwmnrv_sWgAAAMQ"]
[Mon May 25 16:04:19.000745 2026] [:error] [pid 62515:tid 62518] [client 20.226.59.228:15267] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/about.php"] [unique_id "ahQCghig0_XsOwmnrv_sXwAAAME"]
[Mon May 25 16:04:19.908080 2026] [:error] [pid 3698:tid 3712] [client 20.226.59.228:15269] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/.well-known/about.php"] [unique_id "ahQCgwtZBEwA4fyFLKO7CgAAAQw"]
[Mon May 25 16:04:20.609738 2026] [:error] [pid 62515:tid 62520] [client 20.226.59.228:15335] [client 20.226.59.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/about.php"] [unique_id "ahQChBig0_XsOwmnrv_sYgAAAMM"]
[Mon May 25 16:04:21.319107 2026] [:error] [pid 62428:tid 62492] [client 20.226.59.228:15271] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bob.php"] [unique_id "ahQChZNosGBa7mui3VQaHQAAAIg"]
[Mon May 25 16:04:22.322298 2026] [:error] [pid 62515:tid 62528] [client 20.226.59.228:15283] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bob.php"] [unique_id "ahQChhig0_XsOwmnrv_sZQAAAMs"]
[Mon May 25 16:04:23.098638 2026] [:error] [pid 62428:tid 62489] [client 20.226.59.228:15190] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bob.php"] [unique_id "ahQCh5NosGBa7mui3VQaIAAAAIU"]
[Mon May 25 16:04:23.884389 2026] [:error] [pid 62722:tid 62728] [client 20.226.59.228:15241] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bob.php"] [unique_id "ahQCh6M6ssnLWYf6CVAdvAAAAEQ"]
[Mon May 25 16:04:24.706362 2026] [:error] [pid 62515:tid 62535] [client 20.226.59.228:15324] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t3s.php"] [unique_id "ahQCiBig0_XsOwmnrv_sawAAANI"]
[Mon May 25 16:04:25.625708 2026] [:error] [pid 62722:tid 62730] [client 20.226.59.228:15349] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t3s.php"] [unique_id "ahQCiaM6ssnLWYf6CVAdvgAAAEY"]
[Mon May 25 16:04:26.488949 2026] [:error] [pid 62722:tid 62731] [client 20.226.59.228:15355] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t3s.php"] [unique_id "ahQCiqM6ssnLWYf6CVAdwAAAAEc"]
[Mon May 25 16:04:27.235875 2026] [:error] [pid 62722:tid 62748] [client 20.226.59.228:15344] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/t3s.php"] [unique_id "ahQCi6M6ssnLWYf6CVAdwgAAAFg"]
[Mon May 25 16:04:28.093401 2026] [:error] [pid 62722:tid 62727] [client 20.226.59.228:15258] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "ahQCjKM6ssnLWYf6CVAdxQAAAEM"]
[Mon May 25 16:04:28.925433 2026] [:error] [pid 62722:tid 62729] [client 20.226.59.228:15268] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "ahQCjKM6ssnLWYf6CVAdyAAAAEU"]
[Mon May 25 16:04:29.712102 2026] [:error] [pid 62722:tid 62739] [client 20.226.59.228:15246] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "ahQCjaM6ssnLWYf6CVAdywAAAE8"]
[Mon May 25 16:04:30.370287 2026] [:error] [pid 62515:tid 62527] [client 20.226.59.228:15234] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/"] [unique_id "ahQCjhig0_XsOwmnrv_seAAAAMo"]
[Mon May 25 16:04:31.049900 2026] [:error] [pid 53791:tid 53802] [client 20.226.59.228:15350] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x/"] [unique_id "ahQCjyCRhhNTD40Nf1XUnQAAAYk"]
[Mon May 25 16:04:31.755310 2026] [:error] [pid 62722:tid 62729] [client 20.226.59.228:15237] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x/"] [unique_id "ahQCj6M6ssnLWYf6CVAd1AAAAEU"]
[Mon May 25 16:04:32.399333 2026] [:error] [pid 53791:tid 53794] [client 20.226.59.228:15279] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x/"] [unique_id "ahQCkCCRhhNTD40Nf1XUoQAAAYE"]
[Mon May 25 16:04:33.136908 2026] [:error] [pid 62515:tid 62541] [client 20.226.59.228:15249] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/x/"] [unique_id "ahQCkRig0_XsOwmnrv_sfAAAANg"]
[Mon May 25 16:04:33.890993 2026] [:error] [pid 62428:tid 62507] [client 20.226.59.228:15301] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/modern/"] [unique_id "ahQCkZNosGBa7mui3VQaMgAAAJc"]
[Mon May 25 16:04:34.639085 2026] [autoindex:error] [pid 62515:tid 62532] [client 20.226.59.228:15319] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 25 16:04:40.002767 2026] [autoindex:error] [pid 62515:tid 62519] [client 20.226.59.228:15319] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 25 16:04:40.317976 2026] [autoindex:error] [pid 62515:tid 62528] [client 20.226.59.228:15319] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/audio/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 25 16:04:42.333750 2026] [autoindex:error] [pid 62515:tid 62538] [client 20.226.59.228:15319] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/blocks/buttons/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 25 16:04:45.164466 2026] [autoindex:error] [pid 62515:tid 62527] [client 20.226.59.228:15319] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 25 16:04:47.215791 2026] [:error] [pid 62515:tid 62524] [client 20.226.59.228:15319] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "ahQCnxig0_XsOwmnrv_smQAAAMc"]
[Mon May 25 16:04:47.921028 2026] [:error] [pid 62722:tid 62724] [client 20.226.59.228:15169] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "ahQCn6M6ssnLWYf6CVAd5QAAAEA"]
[Mon May 25 16:04:48.599828 2026] [:error] [pid 53791:tid 53807] [client 20.226.59.228:15201] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "ahQCoCCRhhNTD40Nf1XU1QAAAY4"]
[Mon May 25 16:04:49.315145 2026] [:error] [pid 62428:tid 62497] [client 20.226.59.228:15347] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/themes.php"] [unique_id "ahQCoZNosGBa7mui3VQaQwAAAI0"]
[Mon May 25 16:04:50.227507 2026] [:error] [pid 62722:tid 62742] [client 20.226.59.228:15281] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "ahQCoqM6ssnLWYf6CVAd5wAAAFI"]
[Mon May 25 16:04:51.171043 2026] [:error] [pid 3698:tid 3722] [client 20.226.59.228:15327] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "ahQCowtZBEwA4fyFLKO7IQAAARY"]
[Mon May 25 16:04:52.209985 2026] [:error] [pid 62428:tid 62507] [client 20.226.59.228:15195] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "ahQCpJNosGBa7mui3VQaRwAAAJc"]
[Mon May 25 16:04:53.072020 2026] [:error] [pid 53791:tid 53815] [client 20.226.59.228:15243] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dx.php"] [unique_id "ahQCpSCRhhNTD40Nf1XU2AAAAZY"]
[Mon May 25 16:04:53.899586 2026] [:error] [pid 62515:tid 62521] [client 20.226.59.228:15222] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "ahQCpRig0_XsOwmnrv_snAAAAMQ"]
[Mon May 25 16:04:54.620820 2026] [:error] [pid 62426:tid 62449] [client 20.226.59.228:15181] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "ahQCpkj3D3Mo8ANpTRDGxAAAABM"]
[Mon May 25 16:04:55.313042 2026] [:error] [pid 62428:tid 62489] [client 20.226.59.228:15293] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "ahQCp5NosGBa7mui3VQaTQAAAIU"]
[Mon May 25 16:04:56.218758 2026] [:error] [pid 3698:tid 3713] [client 20.226.59.228:15266] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/11.php"] [unique_id "ahQCqAtZBEwA4fyFLKO7KQAAAQ0"]
[Mon May 25 16:04:57.085982 2026] [:error] [pid 53791:tid 53799] [client 20.226.59.228:15288] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "ahQCqSCRhhNTD40Nf1XU2gAAAYY"]
[Mon May 25 16:04:57.985815 2026] [:error] [pid 62515:tid 62526] [client 20.226.59.228:15240] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "ahQCqRig0_XsOwmnrv_sowAAAMk"]
[Mon May 25 16:04:58.926802 2026] [:error] [pid 62722:tid 62739] [client 20.226.59.228:15182] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "ahQCqqM6ssnLWYf6CVAd6gAAAE8"]
[Mon May 25 16:04:59.965686 2026] [:error] [pid 53791:tid 53814] [client 20.226.59.228:15175] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/p.php"] [unique_id "ahQCqyCRhhNTD40Nf1XU3AAAAZU"]
[Mon May 25 16:05:01.173873 2026] [:error] [pid 53791:tid 53793] [client 20.226.59.228:15330] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/"] [unique_id "ahQCrSCRhhNTD40Nf1XU3QAAAYA"]
[Mon May 25 16:05:02.661024 2026] [:error] [pid 53791:tid 53815] [client 20.226.59.228:15209] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/"] [unique_id "ahQCriCRhhNTD40Nf1XU5QAAAZY"]
[Mon May 25 16:05:04.101080 2026] [:error] [pid 62428:tid 62498] [client 20.226.59.228:15343] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/"] [unique_id "ahQCsJNosGBa7mui3VQaVwAAAI4"]
[Mon May 25 16:05:04.973377 2026] [:error] [pid 53791:tid 53807] [client 20.226.59.228:15304] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/Requests/"] [unique_id "ahQCsCCRhhNTD40Nf1XU6AAAAY4"]
[Mon May 25 16:05:05.956567 2026] [:error] [pid 53791:tid 53801] [client 20.226.59.228:15339] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "ahQCsSCRhhNTD40Nf1XU6QAAAYg"]
[Mon May 25 16:05:07.064687 2026] [:error] [pid 62428:tid 62491] [client 20.226.59.228:15194] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "ahQCs5NosGBa7mui3VQaWgAAAIc"]
[Mon May 25 16:05:08.054303 2026] [:error] [pid 62722:tid 62736] [client 20.226.59.228:15329] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "ahQCtKM6ssnLWYf6CVAd8QAAAEw"]
[Mon May 25 16:05:09.002812 2026] [:error] [pid 53791:tid 53816] [client 20.226.59.228:15138] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bthil.php"] [unique_id "ahQCtSCRhhNTD40Nf1XU8AAAAZc"]
[Mon May 25 16:05:09.758503 2026] [:error] [pid 62722:tid 62747] [client 20.226.59.228:15124] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "ahQCtaM6ssnLWYf6CVAd9gAAAFc"]
[Mon May 25 16:05:10.908692 2026] [:error] [pid 53791:tid 53809] [client 20.226.59.228:15347] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "ahQCtiCRhhNTD40Nf1XU9wAAAZA"]
[Mon May 25 16:05:11.864837 2026] [:error] [pid 62515:tid 62527] [client 20.226.59.228:15148] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "ahQCtxig0_XsOwmnrv_sqgAAAMo"]
[Mon May 25 16:05:12.602854 2026] [:error] [pid 62427:tid 62473] [client 20.226.59.228:15332] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "ahQCuPMUa83fc4GDyBxcFAAAAVA"]
[Mon May 25 16:05:13.638224 2026] [:error] [pid 62515:tid 62528] [client 20.226.59.228:15292] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "ahQCuRig0_XsOwmnrv_srQAAAMs"]
[Mon May 25 16:05:14.655010 2026] [:error] [pid 62426:tid 62453] [client 20.226.59.228:15273] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "ahQCukj3D3Mo8ANpTRDGzgAAABc"]
[Mon May 25 16:05:15.911140 2026] [:error] [pid 62427:tid 62459] [client 20.226.59.228:15215] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "ahQCu_MUa83fc4GDyBxcHgAAAUI"]
[Mon May 25 16:05:16.881386 2026] [:error] [pid 53791:tid 53799] [client 20.226.59.228:15318] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/8.php"] [unique_id "ahQCvCCRhhNTD40Nf1XU-QAAAYY"]
[Mon May 25 16:05:17.664041 2026] [:error] [pid 53791:tid 53795] [client 20.226.59.228:15306] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "ahQCvSCRhhNTD40Nf1XU_AAAAYI"]
[Mon May 25 16:05:18.361819 2026] [:error] [pid 3698:tid 3708] [client 20.226.59.228:15299] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "ahQCvgtZBEwA4fyFLKO7MwAAAQg"]
[Mon May 25 16:05:19.078541 2026] [:error] [pid 62426:tid 62437] [client 20.226.59.228:15253] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "ahQCv0j3D3Mo8ANpTRDG0AAAAAc"]
[Mon May 25 16:05:19.947262 2026] [:error] [pid 62428:tid 62485] [client 20.226.59.228:15213] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/1.php"] [unique_id "ahQCv5NosGBa7mui3VQaZgAAAIE"]
[Mon May 25 16:05:20.619171 2026] [:error] [pid 62426:tid 62444] [client 20.226.59.228:15342] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "ahQCwEj3D3Mo8ANpTRDG0wAAAA4"]
[Mon May 25 16:05:21.360994 2026] [:error] [pid 62428:tid 62496] [client 20.226.59.228:15228] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "ahQCwZNosGBa7mui3VQaaQAAAIw"]
[Mon May 25 16:05:22.228919 2026] [:error] [pid 53791:tid 53809] [client 20.226.59.228:15200] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "ahQCwiCRhhNTD40Nf1XVDwAAAZA"]
[Mon May 25 16:05:22.994339 2026] [:error] [pid 62428:tid 62491] [client 20.226.59.228:15170] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/100.php"] [unique_id "ahQCwpNosGBa7mui3VQabwAAAIc"]
[Mon May 25 16:05:23.670027 2026] [:error] [pid 53791:tid 53806] [client 20.226.59.228:15187] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "ahQCwyCRhhNTD40Nf1XVFAAAAY0"]
[Mon May 25 16:05:24.465522 2026] [:error] [pid 62428:tid 62492] [client 20.226.59.228:15294] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "ahQCxJNosGBa7mui3VQacAAAAIg"]
[Mon May 25 16:05:25.133478 2026] [:error] [pid 3698:tid 3722] [client 20.226.59.228:15356] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "ahQCxQtZBEwA4fyFLKO7OgAAARY"]
[Mon May 25 16:05:25.964903 2026] [:error] [pid 53791:tid 53794] [client 20.226.59.228:15305] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/about.php"] [unique_id "ahQCxSCRhhNTD40Nf1XVFwAAAYE"]
[Mon May 25 16:05:26.767634 2026] [:error] [pid 53791:tid 53804] [client 20.226.59.228:15122] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "ahQCxiCRhhNTD40Nf1XVHQAAAYs"]
[Mon May 25 16:05:27.600553 2026] [:error] [pid 62427:tid 62462] [client 20.226.59.228:15111] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "ahQCx_MUa83fc4GDyBxcKQAAAUU"]
[Mon May 25 16:05:28.573439 2026] [:error] [pid 62428:tid 62504] [client 20.226.59.228:15359] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "ahQCyJNosGBa7mui3VQacwAAAJQ"]
[Mon May 25 16:05:29.429952 2026] [:error] [pid 62428:tid 62494] [client 20.226.59.228:15328] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/admin.php"] [unique_id "ahQCyZNosGBa7mui3VQadQAAAIo"]
[Mon May 25 16:05:30.174647 2026] [:error] [pid 62427:tid 62469] [client 20.226.59.228:15284] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahQCyvMUa83fc4GDyBxcMgAAAUw"]
[Mon May 25 16:05:30.886574 2026] [:error] [pid 53791:tid 53813] [client 20.226.59.228:15116] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahQCyiCRhhNTD40Nf1XVKQAAAZQ"]
[Mon May 25 16:05:31.642870 2026] [:error] [pid 3698:tid 3710] [client 20.226.59.228:15186] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahQCywtZBEwA4fyFLKO7QQAAAQo"]
[Mon May 25 16:05:32.529009 2026] [:error] [pid 3698:tid 3719] [client 20.226.59.228:15263] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahQCzAtZBEwA4fyFLKO7RQAAARM"]
[Mon May 25 16:05:33.415110 2026] [:error] [pid 3698:tid 3723] [client 20.226.59.228:15257] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "ahQCzQtZBEwA4fyFLKO7SAAAARc"]
[Mon May 25 16:05:34.210486 2026] [:error] [pid 62426:tid 62433] [client 20.226.59.228:15287] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "ahQCzkj3D3Mo8ANpTRDG3QAAAAM"]
[Mon May 25 16:05:35.005048 2026] [:error] [pid 62428:tid 62501] [client 20.226.59.228:15262] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "ahQCz5NosGBa7mui3VQaewAAAJE"]
[Mon May 25 16:05:35.728540 2026] [:error] [pid 3698:tid 3716] [client 20.226.59.228:15345] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/admin.php"] [unique_id "ahQCzwtZBEwA4fyFLKO7UQAAARA"]
[Mon May 25 16:05:36.534913 2026] [:error] [pid 62515:tid 62541] [client 20.226.59.228:15259] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "ahQC0Big0_XsOwmnrv_syQAAANg"]
[Mon May 25 16:05:37.372775 2026] [:error] [pid 62515:tid 62533] [client 20.226.59.228:15352] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "ahQC0Rig0_XsOwmnrv_szgAAANA"]
[Mon May 25 16:05:38.202549 2026] [:error] [pid 62722:tid 62740] [client 20.226.59.228:15179] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "ahQC0qM6ssnLWYf6CVAd_QAAAFA"]
[Mon May 25 16:05:38.948592 2026] [:error] [pid 53791:tid 53810] [client 20.226.59.228:15214] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f6.php"] [unique_id "ahQC0iCRhhNTD40Nf1XVLgAAAZE"]
[Mon May 25 16:05:39.720699 2026] [:error] [pid 53791:tid 53793] [client 20.226.59.228:15218] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "ahQC0yCRhhNTD40Nf1XVMwAAAYA"]
[Mon May 25 16:05:40.643668 2026] [:error] [pid 62428:tid 62508] [client 20.226.59.228:15291] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "ahQC1JNosGBa7mui3VQaiAAAAJg"]
[Mon May 25 16:05:41.509061 2026] [:error] [pid 53791:tid 53815] [client 20.226.59.228:15126] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "ahQC1SCRhhNTD40Nf1XVOAAAAZY"]
[Mon May 25 16:05:42.186514 2026] [:error] [pid 62722:tid 62733] [client 20.226.59.228:15275] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/inputs.php"] [unique_id "ahQC1qM6ssnLWYf6CVAeAgAAAEk"]
[Mon May 25 16:05:42.936047 2026] [:error] [pid 53791:tid 53801] [client 20.226.59.228:15129] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "ahQC1iCRhhNTD40Nf1XVOwAAAYg"]
[Mon May 25 16:05:43.692108 2026] [:error] [pid 62426:tid 62445] [client 20.226.59.228:15272] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "ahQC10j3D3Mo8ANpTRDG4gAAAA8"]
[Mon May 25 16:05:44.402697 2026] [:error] [pid 62722:tid 62742] [client 20.226.59.228:15317] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "ahQC2KM6ssnLWYf6CVAeBwAAAFI"]
[Mon May 25 16:05:45.053165 2026] [:error] [pid 62428:tid 62502] [client 20.226.59.228:15289] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "ahQC2ZNosGBa7mui3VQalAAAAJI"]
[Mon May 25 16:05:45.679150 2026] [:error] [pid 62515:tid 62530] [client 20.226.59.228:15202] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/classwithtostring.php"] [unique_id "ahQC2Rig0_XsOwmnrv_s6gAAAM0"]
[Mon May 25 16:05:50.268272 2026] [autoindex:error] [pid 62428:tid 62501] [client 20.226.59.228:15303] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 25 16:05:58.734417 2026] [autoindex:error] [pid 62428:tid 62502] [client 20.226.59.228:15303] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 25 16:06:00.024102 2026] [autoindex:error] [pid 62428:tid 62486] [client 20.226.59.228:15303] AH01276: Cannot serve directory /home/expressi/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 25 16:06:00.385181 2026] [autoindex:error] [pid 62428:tid 62495] [client 20.226.59.228:15303] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Mon May 25 16:06:03.472851 2026] [:error] [pid 62428:tid 62505] [client 20.226.59.228:15303] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "ahQC65NosGBa7mui3VQayAAAAJU"]
[Mon May 25 16:06:04.297680 2026] [:error] [pid 3698:tid 3713] [client 20.226.59.228:15109] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "ahQC7AtZBEwA4fyFLKO7dAAAAQ0"]
[Mon May 25 16:06:05.100141 2026] [:error] [pid 3698:tid 3716] [client 20.226.59.228:15225] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "ahQC7QtZBEwA4fyFLKO7dQAAARA"]
[Mon May 25 16:06:05.894454 2026] [:error] [pid 3698:tid 3714] [client 20.226.59.228:15177] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a1.php"] [unique_id "ahQC7QtZBEwA4fyFLKO7eAAAAQ4"]
[Mon May 25 16:06:06.899344 2026] [:error] [pid 62427:tid 62476] [client 20.226.59.228:15168] [client 20.226.59.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "expressinteriors.com"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ahQC7vMUa83fc4GDyBxcSAAAAVM"]
[Mon May 25 16:06:07.641696 2026] [:error] [pid 3698:tid 3700] [client 20.226.59.228:15285] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "ahQC7wtZBEwA4fyFLKO7fAAAAQA"]
[Mon May 25 16:06:08.343111 2026] [:error] [pid 3698:tid 3716] [client 20.226.59.228:15108] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "ahQC8AtZBEwA4fyFLKO7hgAAARA"]
[Mon May 25 16:06:09.360294 2026] [:error] [pid 53791:tid 53794] [client 20.226.59.228:15231] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "ahQC8SCRhhNTD40Nf1XVbQAAAYE"]
[Mon May 25 16:06:10.056588 2026] [:error] [pid 3698:tid 3720] [client 20.226.59.228:15105] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/admin.php"] [unique_id "ahQC8gtZBEwA4fyFLKO7jQAAARQ"]
[Mon May 25 16:06:10.743323 2026] [:error] [pid 3698:tid 3712] [client 20.226.59.228:15164] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/admin.php"] [unique_id "ahQC8gtZBEwA4fyFLKO7kAAAAQw"]
[Mon May 25 16:06:11.439374 2026] [:error] [pid 62428:tid 62493] [client 20.226.59.228:15178] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/admin.php"] [unique_id "ahQC85NosGBa7mui3VQa1AAAAIk"]
[Mon May 25 16:06:12.257419 2026] [:error] [pid 62427:tid 62474] [client 20.226.59.228:15154] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cgi-bin/admin.php"] [unique_id "ahQC9PMUa83fc4GDyBxcWQAAAVE"]
[Mon May 25 16:06:12.994163 2026] [:error] [pid 62722:tid 62742] [client 20.226.59.228:15312] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "ahQC9KM6ssnLWYf6CVAeNQAAAFI"]
[Mon May 25 16:06:13.941320 2026] [:error] [pid 53791:tid 53817] [client 20.226.59.228:15204] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "ahQC9SCRhhNTD40Nf1XVhgAAAZg"]
[Mon May 25 16:06:14.663916 2026] [:error] [pid 62722:tid 62740] [client 20.226.59.228:15314] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "ahQC9qM6ssnLWYf6CVAeOAAAAFA"]
[Mon May 25 16:06:15.385154 2026] [:error] [pid 62428:tid 62491] [client 20.226.59.228:15188] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/gettest.php"] [unique_id "ahQC95NosGBa7mui3VQa2AAAAIc"]
[Mon May 25 16:06:16.118949 2026] [:error] [pid 53791:tid 53799] [client 20.226.59.228:15140] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/BypassBest.php"] [unique_id "ahQC-CCRhhNTD40Nf1XVjQAAAYY"]
[Mon May 25 16:06:16.866493 2026] [:error] [pid 53791:tid 53817] [client 20.226.59.228:15180] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/BypassBest.php"] [unique_id "ahQC-CCRhhNTD40Nf1XVjwAAAZg"]
[Mon May 25 16:06:17.596506 2026] [:error] [pid 3698:tid 3700] [client 20.226.59.228:15141] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/BypassBest.php"] [unique_id "ahQC-QtZBEwA4fyFLKO7oAAAAQA"]
[Mon May 25 16:06:18.284681 2026] [:error] [pid 3698:tid 3716] [client 20.226.59.228:15192] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/BypassBest.php"] [unique_id "ahQC-gtZBEwA4fyFLKO7ogAAARA"]
[Mon May 25 16:06:18.975091 2026] [:error] [pid 53791:tid 53810] [client 20.226.59.228:15096] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "ahQC-iCRhhNTD40Nf1XVmAAAAZE"]
[Mon May 25 16:06:19.724613 2026] [:error] [pid 62722:tid 62741] [client 20.226.59.228:15274] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "ahQC-6M6ssnLWYf6CVAePQAAAFE"]
[Mon May 25 16:06:20.446937 2026] [:error] [pid 62515:tid 62536] [client 20.226.59.228:15114] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "ahQC_Big0_XsOwmnrv_tOwAAANM"]
[Mon May 25 16:06:21.180540 2026] [:error] [pid 53791:tid 53802] [client 20.226.59.228:15119] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-content/"] [unique_id "ahQC_SCRhhNTD40Nf1XVowAAAYk"]
[Mon May 25 16:06:21.958104 2026] [:error] [pid 53791:tid 53815] [client 20.226.59.228:15147] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "ahQC_SCRhhNTD40Nf1XVqAAAAZY"]
[Mon May 25 16:06:22.653713 2026] [:error] [pid 62515:tid 62531] [client 20.226.59.228:15185] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "ahQC_hig0_XsOwmnrv_tQAAAAM4"]
[Mon May 25 16:06:23.335608 2026] [:error] [pid 62722:tid 62736] [client 20.226.59.228:15106] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "ahQC_6M6ssnLWYf6CVAeQAAAAEw"]
[Mon May 25 16:06:24.075647 2026] [:error] [pid 53791:tid 53802] [client 20.226.59.228:15094] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/simple.php"] [unique_id "ahQDACCRhhNTD40Nf1XVsAAAAYk"]
[Mon May 25 16:06:24.880731 2026] [:error] [pid 53791:tid 53794] [client 20.226.59.228:15224] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "ahQDACCRhhNTD40Nf1XVswAAAYE"]
[Mon May 25 16:06:25.873102 2026] [:error] [pid 3698:tid 3717] [client 20.226.59.228:15278] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "ahQDAQtZBEwA4fyFLKO7rQAAARE"]
[Mon May 25 16:06:26.718982 2026] [:error] [pid 53791:tid 53808] [client 20.226.59.228:15193] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "ahQDAiCRhhNTD40Nf1XVugAAAY8"]
[Mon May 25 16:06:27.620558 2026] [:error] [pid 53791:tid 53814] [client 20.226.59.228:15307] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/buy.php"] [unique_id "ahQDAyCRhhNTD40Nf1XVvwAAAZU"]
[Mon May 25 16:06:28.300766 2026] [:error] [pid 53791:tid 53816] [client 20.226.59.228:15136] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxx.php"] [unique_id "ahQDBCCRhhNTD40Nf1XVwgAAAZc"]
[Mon May 25 16:06:28.949836 2026] [:error] [pid 53791:tid 53799] [client 20.226.59.228:15333] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxx.php"] [unique_id "ahQDBCCRhhNTD40Nf1XVxQAAAYY"]
[Mon May 25 16:06:29.639900 2026] [:error] [pid 53791:tid 53803] [client 20.226.59.228:15174] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxx.php"] [unique_id "ahQDBSCRhhNTD40Nf1XVygAAAYo"]
[Mon May 25 16:06:30.411003 2026] [:error] [pid 62515:tid 62534] [client 20.226.59.228:15211] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxx.php"] [unique_id "ahQDBhig0_XsOwmnrv_tSgAAANE"]
[Mon May 25 16:06:31.096710 2026] [:error] [pid 53791:tid 53796] [client 20.226.59.228:15264] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hypo.php"] [unique_id "ahQDByCRhhNTD40Nf1XV0wAAAYM"]
[Mon May 25 16:06:31.922853 2026] [:error] [pid 53791:tid 53799] [client 20.226.59.228:15064] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hypo.php"] [unique_id "ahQDByCRhhNTD40Nf1XV2wAAAYY"]
[Mon May 25 16:06:32.704619 2026] [:error] [pid 62722:tid 62728] [client 20.226.59.228:15149] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hypo.php"] [unique_id "ahQDCKM6ssnLWYf6CVAeRgAAAEQ"]
[Mon May 25 16:06:33.389151 2026] [:error] [pid 62722:tid 62744] [client 20.226.59.228:15144] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hypo.php"] [unique_id "ahQDCaM6ssnLWYf6CVAeTAAAAFQ"]
[Mon May 25 16:06:34.585510 2026] [:error] [pid 62722:tid 62727] [client 20.226.59.228:15260] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "ahQDCqM6ssnLWYf6CVAeTwAAAEM"]
[Mon May 25 16:06:35.370498 2026] [:error] [pid 62722:tid 62741] [client 20.226.59.228:15220] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "ahQDC6M6ssnLWYf6CVAeUQAAAFE"]
[Mon May 25 16:06:36.071892 2026] [:error] [pid 53791:tid 53810] [client 20.226.59.228:15295] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "ahQDDCCRhhNTD40Nf1XV9gAAAZE"]
[Mon May 25 16:06:36.759426 2026] [:error] [pid 62722:tid 62728] [client 20.226.59.228:15130] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "ahQDDKM6ssnLWYf6CVAeUwAAAEQ"]
[Mon May 25 16:06:37.498059 2026] [:error] [pid 62722:tid 62730] [client 20.226.59.228:15196] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "ahQDDaM6ssnLWYf6CVAeVAAAAEY"]
[Mon May 25 16:06:38.176716 2026] [:error] [pid 62515:tid 62532] [client 20.226.59.228:15157] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "ahQDDhig0_XsOwmnrv_tWgAAAM8"]
[Mon May 25 16:06:38.870860 2026] [:error] [pid 62426:tid 62431] [client 20.226.59.228:15110] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "ahQDDkj3D3Mo8ANpTRDHMgAAAAE"]
[Mon May 25 16:06:39.584276 2026] [:error] [pid 62722:tid 62737] [client 20.226.59.228:15183] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/chosen.php"] [unique_id "ahQDD6M6ssnLWYf6CVAeVwAAAE0"]
[Mon May 25 16:06:40.256494 2026] [:error] [pid 62428:tid 62503] [client 20.226.59.228:15133] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/"] [unique_id "ahQDEJNosGBa7mui3VQa5gAAAJM"]
[Mon May 25 16:06:40.992548 2026] [:error] [pid 62427:tid 62474] [client 20.226.59.228:15198] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/"] [unique_id "ahQDEPMUa83fc4GDyBxcaQAAAVE"]
[Mon May 25 16:06:41.702930 2026] [:error] [pid 62427:tid 62475] [client 20.226.59.228:15256] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/"] [unique_id "ahQDEfMUa83fc4GDyBxcagAAAVI"]
[Mon May 25 16:06:42.506851 2026] [:error] [pid 62428:tid 62490] [client 20.226.59.228:15150] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/block-bindings/"] [unique_id "ahQDEpNosGBa7mui3VQa6AAAAIY"]
[Mon May 25 16:06:43.295661 2026] [:error] [pid 3698:tid 3711] [client 20.226.59.228:15121] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/00.php"] [unique_id "ahQDEwtZBEwA4fyFLKO7twAAAQs"]
[Mon May 25 16:06:44.460786 2026] [:error] [pid 53791:tid 53816] [client 20.226.59.228:15226] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/00.php"] [unique_id "ahQDFCCRhhNTD40Nf1XV_wAAAZc"]
[Mon May 25 16:06:45.242436 2026] [:error] [pid 53791:tid 53809] [client 20.226.59.228:15219] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/00.php"] [unique_id "ahQDFSCRhhNTD40Nf1XWBAAAAZA"]
[Mon May 25 16:06:46.008316 2026] [:error] [pid 53791:tid 53810] [client 20.226.59.228:15070] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/00.php"] [unique_id "ahQDFiCRhhNTD40Nf1XWBwAAAZE"]
[Mon May 25 16:06:46.754468 2026] [:error] [pid 3698:tid 3704] [client 20.226.59.228:15208] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/als.php"] [unique_id "ahQDFgtZBEwA4fyFLKO7vgAAAQQ"]
[Mon May 25 16:06:47.461115 2026] [:error] [pid 62515:tid 62541] [client 20.226.59.228:15118] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/als.php"] [unique_id "ahQDFxig0_XsOwmnrv_tZAAAANg"]
[Mon May 25 16:06:48.153061 2026] [:error] [pid 62722:tid 62724] [client 20.226.59.228:15107] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/als.php"] [unique_id "ahQDGKM6ssnLWYf6CVAeZAAAAEA"]
[Mon May 25 16:06:48.878872 2026] [:error] [pid 62515:tid 62537] [client 20.226.59.228:15221] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/als.php"] [unique_id "ahQDGBig0_XsOwmnrv_tZgAAANQ"]
[Mon May 25 16:06:49.565788 2026] [:error] [pid 3698:tid 3716] [client 20.226.59.228:15115] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pol.php"] [unique_id "ahQDGQtZBEwA4fyFLKO7vwAAARA"]
[Mon May 25 16:06:50.376072 2026] [:error] [pid 62515:tid 62539] [client 20.226.59.228:15153] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pol.php"] [unique_id "ahQDGhig0_XsOwmnrv_taAAAANY"]
[Mon May 25 16:06:51.072117 2026] [:error] [pid 53791:tid 53807] [client 20.226.59.228:15047] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pol.php"] [unique_id "ahQDGyCRhhNTD40Nf1XWEAAAAY4"]
[Mon May 25 16:06:51.838029 2026] [:error] [pid 62426:tid 62445] [client 20.226.59.228:15068] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pol.php"] [unique_id "ahQDG0j3D3Mo8ANpTRDHNgAAAA8"]
[Mon May 25 16:06:52.925373 2026] [:error] [pid 62426:tid 62446] [client 20.226.59.228:15139] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ll.php"] [unique_id "ahQDHEj3D3Mo8ANpTRDHOAAAABA"]
[Mon May 25 16:06:53.748368 2026] [:error] [pid 62515:tid 62537] [client 20.226.59.228:15159] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ll.php"] [unique_id "ahQDHRig0_XsOwmnrv_tcQAAANQ"]
[Mon May 25 16:06:54.497639 2026] [:error] [pid 62428:tid 62486] [client 20.226.59.228:15156] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ll.php"] [unique_id "ahQDHpNosGBa7mui3VQbFQAAAII"]
[Mon May 25 16:06:55.601386 2026] [:error] [pid 62427:tid 62467] [client 20.226.59.228:15135] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ll.php"] [unique_id "ahQDH_MUa83fc4GDyBxciAAAAUo"]
[Mon May 25 16:06:56.480108 2026] [:error] [pid 62427:tid 62474] [client 20.226.59.228:15117] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "ahQDIPMUa83fc4GDyBxcigAAAVE"]
[Mon May 25 16:06:57.292667 2026] [:error] [pid 62515:tid 62539] [client 20.226.59.228:15161] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "ahQDIRig0_XsOwmnrv_tdAAAANY"]
[Mon May 25 16:06:57.957614 2026] [:error] [pid 62427:tid 62478] [client 20.226.59.228:15078] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "ahQDIfMUa83fc4GDyBxciwAAAVU"]
[Mon May 25 16:06:58.665189 2026] [:error] [pid 62426:tid 62430] [client 20.226.59.228:15309] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sf.php"] [unique_id "ahQDIkj3D3Mo8ANpTRDHOwAAAAA"]
[Mon May 25 16:06:59.373861 2026] [:error] [pid 62515:tid 62518] [client 20.226.59.228:15125] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file5.php"] [unique_id "ahQDIxig0_XsOwmnrv_teAAAAME"]
[Mon May 25 16:07:00.103440 2026] [:error] [pid 62515:tid 62532] [client 20.226.59.228:15120] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file5.php"] [unique_id "ahQDJBig0_XsOwmnrv_teQAAAM8"]
[Mon May 25 16:07:00.912716 2026] [:error] [pid 62426:tid 62440] [client 20.226.59.228:14993] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file5.php"] [unique_id "ahQDJEj3D3Mo8ANpTRDHQQAAAAo"]
[Mon May 25 16:07:01.754926 2026] [:error] [pid 62515:tid 62530] [client 20.226.59.228:15167] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file5.php"] [unique_id "ahQDJRig0_XsOwmnrv_tfAAAAM0"]
[Mon May 25 16:07:13.853007 2026] [:error] [pid 62515:tid 62520] [client 20.226.59.228:15123] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xamp.php"] [unique_id "ahQDMRig0_XsOwmnrv_toQAAAMM"]
[Mon May 25 16:07:14.642856 2026] [:error] [pid 53791:tid 53813] [client 20.226.59.228:15197] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xamp.php"] [unique_id "ahQDMiCRhhNTD40Nf1XWHgAAAZQ"]
[Mon May 25 16:07:15.331890 2026] [:error] [pid 53791:tid 53816] [client 20.226.59.228:15302] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xamp.php"] [unique_id "ahQDMyCRhhNTD40Nf1XWIQAAAZc"]
[Mon May 25 16:07:16.021644 2026] [:error] [pid 53791:tid 53802] [client 20.226.59.228:15056] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xamp.php"] [unique_id "ahQDNCCRhhNTD40Nf1XWJAAAAYk"]
[Mon May 25 16:07:16.724801 2026] [:error] [pid 53791:tid 53798] [client 20.226.59.228:15290] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cA3bHIkVhgP.php"] [unique_id "ahQDNCCRhhNTD40Nf1XWJwAAAYU"]
[Mon May 25 16:07:17.458187 2026] [:error] [pid 62428:tid 62488] [client 20.226.59.228:15184] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cA3bHIkVhgP.php"] [unique_id "ahQDNZNosGBa7mui3VQbHgAAAIQ"]
[Mon May 25 16:07:18.136624 2026] [:error] [pid 53791:tid 53796] [client 20.226.59.228:15216] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cA3bHIkVhgP.php"] [unique_id "ahQDNiCRhhNTD40Nf1XWKwAAAYM"]
[Mon May 25 16:07:18.779312 2026] [:error] [pid 62722:tid 62744] [client 20.226.59.228:15155] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cA3bHIkVhgP.php"] [unique_id "ahQDNqM6ssnLWYf6CVAeZwAAAFQ"]
[Mon May 25 16:07:19.451870 2026] [:error] [pid 62426:tid 62444] [client 20.226.59.228:15276] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clas11.php"] [unique_id "ahQDN0j3D3Mo8ANpTRDHSAAAAA4"]
[Mon May 25 16:07:20.240839 2026] [:error] [pid 62722:tid 62733] [client 20.226.59.228:15316] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clas11.php"] [unique_id "ahQDOKM6ssnLWYf6CVAeaQAAAEk"]
[Mon May 25 16:07:20.984034 2026] [:error] [pid 62722:tid 62737] [client 20.226.59.228:15217] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clas11.php"] [unique_id "ahQDOKM6ssnLWYf6CVAeagAAAE0"]
[Mon May 25 16:07:21.627928 2026] [:error] [pid 62428:tid 62491] [client 20.226.59.228:14984] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/clas11.php"] [unique_id "ahQDOZNosGBa7mui3VQbIAAAAIc"]
[Mon May 25 16:07:22.311042 2026] [:error] [pid 62722:tid 62727] [client 20.226.59.228:15049] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cxl.php"] [unique_id "ahQDOqM6ssnLWYf6CVAebAAAAEM"]
[Mon May 25 16:07:23.032652 2026] [:error] [pid 62722:tid 62731] [client 20.226.59.228:15045] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cxl.php"] [unique_id "ahQDO6M6ssnLWYf6CVAebQAAAEc"]
[Mon May 25 16:07:23.816078 2026] [:error] [pid 53791:tid 53797] [client 20.226.59.228:15227] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cxl.php"] [unique_id "ahQDOyCRhhNTD40Nf1XWOwAAAYQ"]
[Mon May 25 16:07:24.638523 2026] [:error] [pid 62428:tid 62504] [client 20.226.59.228:15055] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/cxl.php"] [unique_id "ahQDPJNosGBa7mui3VQbIQAAAJQ"]
[Mon May 25 16:07:25.493770 2026] [:error] [pid 62722:tid 62738] [client 20.226.59.228:15006] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bb.php"] [unique_id "ahQDPaM6ssnLWYf6CVAecAAAAE4"]
[Mon May 25 16:07:26.216756 2026] [:error] [pid 62722:tid 62745] [client 20.226.59.228:15127] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bb.php"] [unique_id "ahQDPqM6ssnLWYf6CVAecgAAAFU"]
[Mon May 25 16:07:27.101776 2026] [:error] [pid 62722:tid 62741] [client 20.226.59.228:15076] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bb.php"] [unique_id "ahQDP6M6ssnLWYf6CVAedAAAAFE"]
[Mon May 25 16:07:27.908486 2026] [:error] [pid 62722:tid 62728] [client 20.226.59.228:15326] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bb.php"] [unique_id "ahQDP6M6ssnLWYf6CVAeeAAAAEQ"]
[Mon May 25 16:07:28.729716 2026] [:error] [pid 62428:tid 62489] [client 20.226.59.228:15063] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dtox.php"] [unique_id "ahQDQJNosGBa7mui3VQbJAAAAIU"]
[Mon May 25 16:07:29.373332 2026] [:error] [pid 62427:tid 62466] [client 20.226.59.228:15087] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dtox.php"] [unique_id "ahQDQfMUa83fc4GDyBxclAAAAUk"]
[Mon May 25 16:07:30.164516 2026] [:error] [pid 53791:tid 53808] [client 20.226.59.228:15052] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dtox.php"] [unique_id "ahQDQiCRhhNTD40Nf1XWRAAAAY8"]
[Mon May 25 16:07:30.887463 2026] [:error] [pid 53791:tid 53796] [client 20.226.59.228:15132] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dtox.php"] [unique_id "ahQDQiCRhhNTD40Nf1XWSAAAAYM"]
[Mon May 25 16:07:31.717533 2026] [:error] [pid 62722:tid 62739] [client 20.226.59.228:14994] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eee.php"] [unique_id "ahQDQ6M6ssnLWYf6CVAeggAAAE8"]
[Mon May 25 16:07:32.537158 2026] [:error] [pid 62428:tid 62496] [client 20.226.59.228:15206] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eee.php"] [unique_id "ahQDRJNosGBa7mui3VQbJwAAAIw"]
[Mon May 25 16:07:33.186971 2026] [:error] [pid 62428:tid 62499] [client 20.226.59.228:15158] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eee.php"] [unique_id "ahQDRZNosGBa7mui3VQbKAAAAI8"]
[Mon May 25 16:07:33.921183 2026] [:error] [pid 3698:tid 3716] [client 20.226.59.228:15205] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/eee.php"] [unique_id "ahQDRQtZBEwA4fyFLKO71AAAARA"]
[Mon May 25 16:07:34.622157 2026] [:error] [pid 62722:tid 62736] [client 20.226.59.228:15152] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5BltUjE9CrY.php"] [unique_id "ahQDRqM6ssnLWYf6CVAehgAAAEw"]
[Mon May 25 16:07:35.375085 2026] [:error] [pid 62428:tid 62500] [client 20.226.59.228:15048] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5BltUjE9CrY.php"] [unique_id "ahQDR5NosGBa7mui3VQbLAAAAJA"]
[Mon May 25 16:07:36.116974 2026] [:error] [pid 62427:tid 62464] [client 20.226.59.228:15091] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5BltUjE9CrY.php"] [unique_id "ahQDSPMUa83fc4GDyBxclgAAAUc"]
[Mon May 25 16:07:36.800471 2026] [:error] [pid 3698:tid 3706] [client 20.226.59.228:15086] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/5BltUjE9CrY.php"] [unique_id "ahQDSAtZBEwA4fyFLKO71gAAAQY"]
[Mon May 25 16:07:37.433881 2026] [:error] [pid 62428:tid 62484] [client 20.226.59.228:15142] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/come.php"] [unique_id "ahQDSZNosGBa7mui3VQbLQAAAIA"]
[Mon May 25 16:07:38.179357 2026] [:error] [pid 62427:tid 62471] [client 20.226.59.228:15315] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/come.php"] [unique_id "ahQDSvMUa83fc4GDyBxcmQAAAU4"]
[Mon May 25 16:07:38.924810 2026] [:error] [pid 62428:tid 62504] [client 20.226.59.228:15166] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/come.php"] [unique_id "ahQDSpNosGBa7mui3VQbMAAAAJQ"]
[Mon May 25 16:07:39.621480 2026] [:error] [pid 53791:tid 53808] [client 20.226.59.228:15160] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/come.php"] [unique_id "ahQDSyCRhhNTD40Nf1XWXwAAAY8"]
[Mon May 25 16:07:40.368703 2026] [:error] [pid 62515:tid 62520] [client 20.226.59.228:15210] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hg.php"] [unique_id "ahQDTBig0_XsOwmnrv_tpgAAAMM"]
[Mon May 25 16:07:41.141991 2026] [:error] [pid 62426:tid 62435] [client 20.226.59.228:15143] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hg.php"] [unique_id "ahQDTUj3D3Mo8ANpTRDHSgAAAAU"]
[Mon May 25 16:07:42.013894 2026] [:error] [pid 62428:tid 62493] [client 20.226.59.228:15162] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hg.php"] [unique_id "ahQDTpNosGBa7mui3VQbMgAAAIk"]
[Mon May 25 16:07:42.686381 2026] [:error] [pid 62427:tid 62475] [client 20.226.59.228:15346] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/hg.php"] [unique_id "ahQDTvMUa83fc4GDyBxcnAAAAVI"]
[Mon May 25 16:07:43.548368 2026] [:error] [pid 53791:tid 53802] [client 20.226.59.228:15072] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "ahQDTyCRhhNTD40Nf1XWaAAAAYk"]
[Mon May 25 16:07:44.274049 2026] [:error] [pid 62428:tid 62501] [client 20.226.59.228:15137] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "ahQDUJNosGBa7mui3VQbMwAAAJE"]
[Mon May 25 16:07:45.010943 2026] [:error] [pid 62428:tid 62502] [client 20.226.59.228:15134] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "ahQDUZNosGBa7mui3VQbNQAAAJI"]
[Mon May 25 16:07:45.809295 2026] [:error] [pid 62722:tid 62725] [client 20.226.59.228:15131] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "ahQDUaM6ssnLWYf6CVAelAAAAEE"]
[Mon May 25 16:07:46.590739 2026] [:error] [pid 62428:tid 62507] [client 20.226.59.228:15035] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/at.php"] [unique_id "ahQDUpNosGBa7mui3VQbNwAAAJc"]
[Mon May 25 16:07:47.321583 2026] [:error] [pid 62515:tid 62533] [client 20.226.59.228:15003] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/at.php"] [unique_id "ahQDUxig0_XsOwmnrv_trAAAANA"]
[Mon May 25 16:07:48.064545 2026] [:error] [pid 3698:tid 3710] [client 20.226.59.228:15313] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/at.php"] [unique_id "ahQDVAtZBEwA4fyFLKO72wAAAQo"]
[Mon May 25 16:07:48.927083 2026] [:error] [pid 62428:tid 62490] [client 20.226.59.228:15282] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/at.php"] [unique_id "ahQDVJNosGBa7mui3VQbPQAAAIY"]
[Mon May 25 16:07:49.751371 2026] [:error] [pid 62515:tid 62525] [client 20.226.59.228:15058] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff.php"] [unique_id "ahQDVRig0_XsOwmnrv_trwAAAMg"]
[Mon May 25 16:07:50.504718 2026] [:error] [pid 62426:tid 62447] [client 20.226.59.228:15104] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff.php"] [unique_id "ahQDVkj3D3Mo8ANpTRDHTAAAABE"]
[Mon May 25 16:07:51.200366 2026] [:error] [pid 62515:tid 62519] [client 20.226.59.228:15081] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff.php"] [unique_id "ahQDVxig0_XsOwmnrv_tsAAAAMI"]
[Mon May 25 16:07:51.988354 2026] [:error] [pid 3698:tid 3715] [client 20.226.59.228:15337] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ff.php"] [unique_id "ahQDVwtZBEwA4fyFLKO74QAAAQ8"]
[Mon May 25 16:07:52.735864 2026] [:error] [pid 62428:tid 62506] [client 20.226.59.228:15069] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file31.php"] [unique_id "ahQDWJNosGBa7mui3VQbQAAAAJY"]
[Mon May 25 16:07:53.356667 2026] [:error] [pid 62428:tid 62502] [client 20.226.59.228:15232] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file31.php"] [unique_id "ahQDWZNosGBa7mui3VQbQgAAAJI"]
[Mon May 25 16:07:54.058472 2026] [:error] [pid 62722:tid 62736] [client 20.226.59.228:15014] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file31.php"] [unique_id "ahQDWqM6ssnLWYf6CVAemQAAAEw"]
[Mon May 25 16:07:54.841904 2026] [:error] [pid 53791:tid 53806] [client 20.226.59.228:15098] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file31.php"] [unique_id "ahQDWiCRhhNTD40Nf1XWygAAAY0"]
[Mon May 25 16:07:55.595064 2026] [:error] [pid 53791:tid 53793] [client 20.226.59.228:15299] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Crypto.php"] [unique_id "ahQDWyCRhhNTD40Nf1XWywAAAYA"]
[Mon May 25 16:07:56.432958 2026] [:error] [pid 3698:tid 3700] [client 20.226.59.228:15041] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Crypto.php"] [unique_id "ahQDXAtZBEwA4fyFLKO77QAAAQA"]
[Mon May 25 16:07:57.213082 2026] [:error] [pid 3698:tid 3715] [client 20.226.59.228:15252] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Crypto.php"] [unique_id "ahQDXQtZBEwA4fyFLKO77wAAAQ8"]
[Mon May 25 16:07:57.904042 2026] [:error] [pid 62428:tid 62504] [client 20.226.59.228:15358] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/Crypto.php"] [unique_id "ahQDXZNosGBa7mui3VQbQwAAAJQ"]
[Mon May 25 16:07:58.613609 2026] [:error] [pid 53791:tid 53816] [client 20.226.59.228:15066] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/firewall.php"] [unique_id "ahQDXiCRhhNTD40Nf1XWzAAAAZc"]
[Mon May 25 16:07:59.316668 2026] [:error] [pid 62515:tid 62536] [client 20.226.59.228:14976] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/firewall.php"] [unique_id "ahQDXxig0_XsOwmnrv_ttAAAANM"]
[Mon May 25 16:08:00.055790 2026] [:error] [pid 62515:tid 62541] [client 20.226.59.228:15248] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/firewall.php"] [unique_id "ahQDYBig0_XsOwmnrv_ttgAAANg"]
[Mon May 25 16:08:00.837804 2026] [:error] [pid 3698:tid 3719] [client 20.226.59.228:15242] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/firewall.php"] [unique_id "ahQDYAtZBEwA4fyFLKO79QAAARM"]
[Mon May 25 16:08:01.665567 2026] [:error] [pid 62515:tid 62530] [client 20.226.59.228:15171] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pi.php"] [unique_id "ahQDYRig0_XsOwmnrv_tuQAAAM0"]
[Mon May 25 16:08:02.372702 2026] [:error] [pid 62515:tid 62524] [client 20.226.59.228:15146] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pi.php"] [unique_id "ahQDYhig0_XsOwmnrv_tuwAAAMc"]
[Mon May 25 16:08:03.118612 2026] [:error] [pid 62722:tid 62744] [client 20.226.59.228:15235] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pi.php"] [unique_id "ahQDY6M6ssnLWYf6CVAepAAAAFQ"]
[Mon May 25 16:08:03.890569 2026] [:error] [pid 3698:tid 3723] [client 20.226.59.228:15173] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pi.php"] [unique_id "ahQDYwtZBEwA4fyFLKO7_wAAARc"]
[Mon May 25 16:08:04.608620 2026] [:error] [pid 62515:tid 62521] [client 20.226.59.228:15348] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/testphp.php"] [unique_id "ahQDZBig0_XsOwmnrv_tvQAAAMQ"]
[Mon May 25 16:08:05.362699 2026] [:error] [pid 62722:tid 62747] [client 20.226.59.228:14992] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/testphp.php"] [unique_id "ahQDZaM6ssnLWYf6CVAepgAAAFc"]
[Mon May 25 16:08:06.195165 2026] [:error] [pid 3698:tid 3706] [client 20.226.59.228:15172] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/testphp.php"] [unique_id "ahQDZgtZBEwA4fyFLKO8AwAAAQY"]
[Mon May 25 16:08:06.898307 2026] [:error] [pid 62515:tid 62531] [client 20.226.59.228:14995] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/testphp.php"] [unique_id "ahQDZhig0_XsOwmnrv_twQAAAM4"]
[Mon May 25 16:08:07.526198 2026] [:error] [pid 62427:tid 62480] [client 20.226.59.228:15059] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/build.php"] [unique_id "ahQDZ_MUa83fc4GDyBxcngAAAVc"]
[Mon May 25 16:08:08.486224 2026] [:error] [pid 3698:tid 3719] [client 20.226.59.228:14986] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/build.php"] [unique_id "ahQDaAtZBEwA4fyFLKO8BgAAARM"]
[Mon May 25 16:08:09.164565 2026] [:error] [pid 62426:tid 62439] [client 20.226.59.228:15261] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/build.php"] [unique_id "ahQDaUj3D3Mo8ANpTRDHUQAAAAk"]
[Mon May 25 16:08:09.946358 2026] [:error] [pid 3698:tid 3711] [client 20.226.59.228:15043] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/build.php"] [unique_id "ahQDaQtZBEwA4fyFLKO8DQAAAQs"]
[Mon May 25 16:08:10.793015 2026] [:error] [pid 53791:tid 53801] [client 20.226.59.228:15250] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file6.php"] [unique_id "ahQDaiCRhhNTD40Nf1XWzgAAAYg"]
[Mon May 25 16:08:11.549719 2026] [:error] [pid 53791:tid 53813] [client 20.226.59.228:15036] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file6.php"] [unique_id "ahQDayCRhhNTD40Nf1XW0gAAAZQ"]
[Mon May 25 16:08:23.354383 2026] [:error] [pid 62515:tid 62523] [client 20.226.59.228:15357] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "ahQDdxig0_XsOwmnrv_t1gAAAMY"]
[Mon May 25 16:08:24.073348 2026] [:error] [pid 3698:tid 3724] [client 20.226.59.228:15112] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "ahQDeAtZBEwA4fyFLKO8IwAAARg"]
[Mon May 25 16:08:24.794131 2026] [:error] [pid 3698:tid 3713] [client 20.226.59.228:15212] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "ahQDeAtZBEwA4fyFLKO8JwAAAQ0"]
[Mon May 25 16:08:25.512165 2026] [:error] [pid 62722:tid 62725] [client 20.226.59.228:15267] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "ahQDeaM6ssnLWYf6CVAetAAAAEE"]
[Mon May 25 16:08:26.236605 2026] [:error] [pid 62515:tid 62527] [client 20.226.59.228:14979] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "ahQDehig0_XsOwmnrv_t2QAAAMo"]
[Mon May 25 16:08:27.042510 2026] [:error] [pid 62722:tid 62726] [client 20.226.59.228:15233] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "ahQDe6M6ssnLWYf6CVAetgAAAEI"]
[Mon May 25 16:08:27.787318 2026] [:error] [pid 62722:tid 62728] [client 20.226.59.228:15286] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "ahQDe6M6ssnLWYf6CVAeuQAAAEQ"]
[Mon May 25 16:08:28.584892 2026] [:error] [pid 62427:tid 62471] [client 20.226.59.228:15085] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xa.php"] [unique_id "ahQDfPMUa83fc4GDyBxcqQAAAU4"]
[Mon May 25 16:08:29.340999 2026] [:error] [pid 62427:tid 62472] [client 20.226.59.228:15340] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "ahQDffMUa83fc4GDyBxcrAAAAU8"]
[Mon May 25 16:08:30.055906 2026] [:error] [pid 62515:tid 62529] [client 20.226.59.228:15113] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "ahQDfhig0_XsOwmnrv_t3wAAAMw"]
[Mon May 25 16:08:30.969668 2026] [:error] [pid 62426:tid 62437] [client 20.226.59.228:15308] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "ahQDfkj3D3Mo8ANpTRDHXgAAAAc"]
[Mon May 25 16:08:31.710484 2026] [:error] [pid 53791:tid 53802] [client 20.226.59.228:15203] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-load.php"] [unique_id "ahQDfyCRhhNTD40Nf1XW6wAAAYk"]
[Mon May 25 16:08:32.425460 2026] [:error] [pid 62427:tid 62460] [client 20.226.59.228:15199] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwpg.php"] [unique_id "ahQDgPMUa83fc4GDyBxcsgAAAUM"]
[Mon May 25 16:08:33.185717 2026] [:error] [pid 62428:tid 62506] [client 20.226.59.228:15251] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwpg.php"] [unique_id "ahQDgZNosGBa7mui3VQbVQAAAJY"]
[Mon May 25 16:08:33.909810 2026] [:error] [pid 62427:tid 62465] [client 20.226.59.228:15354] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwpg.php"] [unique_id "ahQDgfMUa83fc4GDyBxctAAAAUg"]
[Mon May 25 16:08:34.677453 2026] [:error] [pid 62426:tid 62439] [client 20.226.59.228:15320] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwpg.php"] [unique_id "ahQDgkj3D3Mo8ANpTRDHbgAAAAk"]
[Mon May 25 16:08:35.486176 2026] [:error] [pid 62722:tid 62745] [client 20.226.59.228:15207] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "ahQDg6M6ssnLWYf6CVAeyAAAAFU"]
[Mon May 25 16:08:36.224509 2026] [:error] [pid 62722:tid 62726] [client 20.226.59.228:15067] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "ahQDhKM6ssnLWYf6CVAeyQAAAEI"]
[Mon May 25 16:08:37.050113 2026] [:error] [pid 62722:tid 62742] [client 20.226.59.228:15004] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "ahQDhaM6ssnLWYf6CVAezgAAAFI"]
[Mon May 25 16:08:37.798367 2026] [:error] [pid 3698:tid 3721] [client 20.226.59.228:15268] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/a5.php"] [unique_id "ahQDhQtZBEwA4fyFLKO8MgAAARU"]
[Mon May 25 16:08:38.556194 2026] [:error] [pid 3698:tid 3703] [client 20.226.59.228:15350] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/"] [unique_id "ahQDhgtZBEwA4fyFLKO8NAAAAQM"]
[Mon May 25 16:08:39.410807 2026] [:error] [pid 62428:tid 62492] [client 20.226.59.228:15338] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/"] [unique_id "ahQDh5NosGBa7mui3VQbWAAAAIg"]
[Mon May 25 16:08:40.308148 2026] [:error] [pid 53791:tid 53816] [client 20.226.59.228:15163] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/"] [unique_id "ahQDiCCRhhNTD40Nf1XW7gAAAZc"]
[Mon May 25 16:08:41.147191 2026] [:error] [pid 62722:tid 62739] [client 20.226.59.228:15249] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/assets/"] [unique_id "ahQDiaM6ssnLWYf6CVAe0wAAAE8"]
[Mon May 25 16:08:42.035598 2026] [:error] [pid 53791:tid 53814] [client 20.226.59.228:15099] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "ahQDiiCRhhNTD40Nf1XW9QAAAZU"]
[Mon May 25 16:08:42.873342 2026] [:error] [pid 62722:tid 62733] [client 20.226.59.228:15239] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "ahQDiqM6ssnLWYf6CVAe1AAAAEk"]
[Mon May 25 16:08:43.675773 2026] [:error] [pid 62426:tid 62440] [client 20.226.59.228:15353] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "ahQDi0j3D3Mo8ANpTRDHdwAAAAo"]
[Mon May 25 16:08:44.419800 2026] [:error] [pid 62427:tid 62468] [client 20.226.59.228:15283] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/dropdown.php"] [unique_id "ahQDjPMUa83fc4GDyBxcugAAAUs"]
[Mon May 25 16:08:45.213043 2026] [:error] [pid 62427:tid 62460] [client 20.226.59.228:15344] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ddd.php"] [unique_id "ahQDjfMUa83fc4GDyBxcvQAAAUM"]
[Mon May 25 16:08:46.033115 2026] [:error] [pid 3698:tid 3715] [client 20.226.59.228:15271] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ddd.php"] [unique_id "ahQDjgtZBEwA4fyFLKO8QQAAAQ8"]
[Mon May 25 16:08:47.010110 2026] [:error] [pid 62722:tid 62740] [client 20.226.59.228:15065] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ddd.php"] [unique_id "ahQDj6M6ssnLWYf6CVAe1QAAAFA"]
[Mon May 25 16:08:47.930149 2026] [:error] [pid 3698:tid 3705] [client 20.226.59.228:15238] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ddd.php"] [unique_id "ahQDjwtZBEwA4fyFLKO8SAAAAQU"]
[Mon May 25 16:08:48.705666 2026] [:error] [pid 62428:tid 62508] [client 20.226.59.228:15018] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "ahQDkJNosGBa7mui3VQbXgAAAJg"]
[Mon May 25 16:08:49.475269 2026] [:error] [pid 53791:tid 53812] [client 20.226.59.228:15296] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "ahQDkSCRhhNTD40Nf1XW_gAAAZM"]
[Mon May 25 16:08:50.264135 2026] [:error] [pid 62427:tid 62481] [client 20.226.59.228:15301] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "ahQDkvMUa83fc4GDyBxcwQAAAVg"]
[Mon May 25 16:08:51.061751 2026] [:error] [pid 62515:tid 62519] [client 20.226.59.228:15336] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "ahQDkxig0_XsOwmnrv_t9gAAAMI"]
[Mon May 25 16:08:51.960254 2026] [:error] [pid 62722:tid 62732] [client 20.226.59.228:15325] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jj.php"] [unique_id "ahQDk6M6ssnLWYf6CVAe3QAAAEg"]
[Mon May 25 16:08:52.713725 2026] [:error] [pid 53791:tid 53802] [client 20.226.59.228:15054] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jj.php"] [unique_id "ahQDlCCRhhNTD40Nf1XXBQAAAYk"]
[Mon May 25 16:08:53.462424 2026] [:error] [pid 62722:tid 62743] [client 20.226.59.228:15042] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jj.php"] [unique_id "ahQDlaM6ssnLWYf6CVAe4QAAAFM"]
[Mon May 25 16:08:54.462064 2026] [:error] [pid 62722:tid 62737] [client 20.226.59.228:15234] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/jj.php"] [unique_id "ahQDlqM6ssnLWYf6CVAe4gAAAE0"]
[Mon May 25 16:08:55.247832 2026] [:error] [pid 53791:tid 53814] [client 20.226.59.228:15254] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccc.php"] [unique_id "ahQDlyCRhhNTD40Nf1XXCAAAAZU"]
[Mon May 25 16:08:56.387989 2026] [:error] [pid 62722:tid 62745] [client 20.226.59.228:15101] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccc.php"] [unique_id "ahQDmKM6ssnLWYf6CVAe6AAAAFU"]
[Mon May 25 16:08:57.569664 2026] [:error] [pid 62722:tid 62733] [client 20.226.59.228:15241] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccc.php"] [unique_id "ahQDmaM6ssnLWYf6CVAe6wAAAEk"]
[Mon May 25 16:08:58.666320 2026] [:error] [pid 3698:tid 3717] [client 20.226.59.228:15176] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ccc.php"] [unique_id "ahQDmgtZBEwA4fyFLKO8TQAAARE"]
[Mon May 25 16:08:59.486610 2026] [:error] [pid 53791:tid 53800] [client 20.226.59.228:14980] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-link-snpm.php"] [unique_id "ahQDmyCRhhNTD40Nf1XXGQAAAYc"]
[Mon May 25 16:09:00.432780 2026] [:error] [pid 53791:tid 53798] [client 20.226.59.228:15246] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-link-snpm.php"] [unique_id "ahQDnCCRhhNTD40Nf1XXHgAAAYU"]
[Mon May 25 16:09:01.669217 2026] [:error] [pid 62515:tid 62531] [client 20.226.59.228:15040] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-link-snpm.php"] [unique_id "ahQDnRig0_XsOwmnrv_t_wAAAM4"]
[Mon May 25 16:09:02.678809 2026] [:error] [pid 53791:tid 53805] [client 20.226.59.228:15009] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-link-snpm.php"] [unique_id "ahQDniCRhhNTD40Nf1XXJQAAAYw"]
[Mon May 25 16:09:03.765781 2026] [:error] [pid 62722:tid 62746] [client 20.226.59.228:15201] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "ahQDn6M6ssnLWYf6CVAe9QAAAFY"]
[Mon May 25 16:09:04.625216 2026] [:error] [pid 62428:tid 62492] [client 20.226.59.228:14981] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "ahQDoJNosGBa7mui3VQbbQAAAIg"]
[Mon May 25 16:09:05.486924 2026] [:error] [pid 62515:tid 62538] [client 20.226.59.228:15073] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "ahQDoRig0_XsOwmnrv_uBwAAANU"]
[Mon May 25 16:09:06.470766 2026] [:error] [pid 53791:tid 53810] [client 20.226.59.228:15201] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/4.php"] [unique_id "ahQDoiCRhhNTD40Nf1XXKwAAAZE"]
[Mon May 25 16:09:07.629163 2026] [:error] [pid 53791:tid 53802] [client 20.226.59.228:15128] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xstelth.php"] [unique_id "ahQDoyCRhhNTD40Nf1XXMAAAAYk"]
[Mon May 25 16:09:08.941784 2026] [:error] [pid 62515:tid 62537] [client 20.226.59.228:15045] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xstelth.php"] [unique_id "ahQDpBig0_XsOwmnrv_uDgAAANQ"]
[Mon May 25 16:09:09.848445 2026] [:error] [pid 62722:tid 62746] [client 20.226.59.228:15046] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xstelth.php"] [unique_id "ahQDpaM6ssnLWYf6CVAfAgAAAFY"]
[Mon May 25 16:09:10.833157 2026] [:error] [pid 3698:tid 3704] [client 20.226.59.228:15258] [client 20.226.59.228] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xstelth.php"] [unique_id "ahQDpgtZBEwA4fyFLKO8XgAAAQQ"]
[Mon May 25 17:55:32.492292 2026] [:error] [pid 62426:tid 62454] [client 35.203.159.121:52743] [client 35.203.159.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.203.159.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahQclEj3D3Mo8ANpTRDalAAAABg"]
[Mon May 25 17:55:34.623813 2026] [:error] [pid 62426:tid 62445] [client 35.203.159.121:52743] [client 35.203.159.121] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ahQclkj3D3Mo8ANpTRDaoQAAAA8"]
[Mon May 25 17:55:34.790765 2026] [:error] [pid 62426:tid 62439] [client 35.203.159.121:52743] [client 35.203.159.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.203.159.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahQclkj3D3Mo8ANpTRDaogAAAAk"]
[Mon May 25 17:55:36.179022 2026] [:error] [pid 62428:tid 62486] [client 35.203.159.121:52425] [client 35.203.159.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.203.159.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahQcmJNosGBa7mui3VQrZQAAAII"]
[Mon May 25 17:55:37.572060 2026] [:error] [pid 62426:tid 62435] [client 35.203.159.121:63452] [client 35.203.159.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.203.159.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahQcmUj3D3Mo8ANpTRDasgAAAAU"]
[Mon May 25 17:55:38.976820 2026] [:error] [pid 62515:tid 62529] [client 35.203.159.121:60122] [client 35.203.159.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.203.159.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahQcmhig0_XsOwmnrv8LAgAAAMw"]
[Mon May 25 17:55:40.624219 2026] [:error] [pid 62426:tid 62437] [client 35.203.159.121:60900] [client 35.203.159.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.203.159.121, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahQcnEj3D3Mo8ANpTRDatQAAAAc"]
[Mon May 25 17:55:40.624431 2026] [:error] [pid 62426:tid 62437] [client 35.203.159.121:60900] [client 35.203.159.121] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.203.159.121, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahQcnEj3D3Mo8ANpTRDatQAAAAc"]
[Mon May 25 19:07:44.446534 2026] [:error] [pid 62722:tid 62724] [client 87.106.228.31:37948] [client 87.106.228.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 87.106.228.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahQtgKM6ssnLWYf6CVA-pAAAAEA"]
[Mon May 25 19:07:45.358657 2026] [:error] [pid 62722:tid 62740] [client 87.106.228.31:37948] [client 87.106.228.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 87.106.228.31, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahQtgaM6ssnLWYf6CVA-pgAAAFA"], referer: https://expressinteriors.com/wp-login.php
[Mon May 25 19:18:20.913466 2026] [:error] [pid 62515:tid 62540] [client 43.166.136.153:37818] [client 43.166.136.153] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahQv_Big0_XsOwmnrv8kLwAAANc"]
[Mon May 25 20:25:20.441994 2026] [:error] [pid 53791:tid 53801] [client 35.231.156.19:58567] [client 35.231.156.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.231.156.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahQ_sCCRhhNTD40Nf1UYtwAAAYg"]
[Mon May 25 20:25:22.920736 2026] [:error] [pid 53791:tid 53814] [client 35.231.156.19:58567] [client 35.231.156.19] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ahQ_siCRhhNTD40Nf1UYvAAAAZU"]
[Mon May 25 20:25:23.308199 2026] [:error] [pid 53791:tid 53795] [client 35.231.156.19:58567] [client 35.231.156.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.231.156.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahQ_syCRhhNTD40Nf1UYvwAAAYI"]
[Mon May 25 20:25:25.226071 2026] [:error] [pid 62426:tid 62442] [client 35.231.156.19:62120] [client 35.231.156.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.231.156.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahQ_tUj3D3Mo8ANpTRD9UAAAAAw"]
[Mon May 25 20:25:26.718749 2026] [:error] [pid 62426:tid 62434] [client 35.231.156.19:53402] [client 35.231.156.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.231.156.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahQ_tkj3D3Mo8ANpTRD9UQAAAAQ"]
[Mon May 25 20:25:28.336803 2026] [:error] [pid 53791:tid 53812] [client 35.231.156.19:49715] [client 35.231.156.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.231.156.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahQ_uCCRhhNTD40Nf1UYxAAAAZM"]
[Mon May 25 20:25:29.958270 2026] [:error] [pid 62427:tid 62465] [client 35.231.156.19:63463] [client 35.231.156.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 35.231.156.19, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahQ_ufMUa83fc4GDyBx7QwAAAUg"]
[Mon May 25 20:25:29.958431 2026] [:error] [pid 62427:tid 62465] [client 35.231.156.19:63463] [client 35.231.156.19] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 35.231.156.19, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahQ_ufMUa83fc4GDyBx7QwAAAUg"]
[Mon May 25 21:18:24.293288 2026] [:error] [pid 62426:tid 62433] [client 34.6.62.186:56274] [client 34.6.62.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.6.62.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahRMIEj3D3Mo8ANpTRAH6QAAAAM"]
[Mon May 25 21:18:26.682195 2026] [:error] [pid 62426:tid 62445] [client 34.6.62.186:56274] [client 34.6.62.186] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ahRMIkj3D3Mo8ANpTRAH7QAAAA8"]
[Mon May 25 21:18:26.957339 2026] [:error] [pid 62426:tid 62446] [client 34.6.62.186:56274] [client 34.6.62.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.6.62.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahRMIkj3D3Mo8ANpTRAH7wAAABA"]
[Mon May 25 21:18:28.664450 2026] [:error] [pid 62426:tid 62444] [client 34.6.62.186:56765] [client 34.6.62.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.6.62.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahRMJEj3D3Mo8ANpTRAH9AAAAA4"]
[Mon May 25 21:18:30.350762 2026] [:error] [pid 62722:tid 62735] [client 34.6.62.186:62708] [client 34.6.62.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.6.62.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahRMJqM6ssnLWYf6CVBQlgAAAEs"]
[Mon May 25 21:18:32.332050 2026] [:error] [pid 62427:tid 62473] [client 34.6.62.186:50250] [client 34.6.62.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.6.62.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahRMKPMUa83fc4GDyByBagAAAVA"]
[Mon May 25 21:18:34.068070 2026] [:error] [pid 62428:tid 62501] [client 34.6.62.186:58652] [client 34.6.62.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.6.62.186, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahRMKpNosGBa7mui3VRi3gAAAJE"]
[Mon May 25 21:18:34.068206 2026] [:error] [pid 62428:tid 62501] [client 34.6.62.186:58652] [client 34.6.62.186] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.6.62.186, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahRMKpNosGBa7mui3VRi3gAAAJE"]
[Mon May 25 21:34:11.519870 2026] [:error] [pid 3698:tid 3701] [client 167.71.132.111:48506] [client 167.71.132.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.132.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahRP0wtZBEwA4fyFLKP6RQAAAQE"]
[Mon May 25 21:34:12.936410 2026] [:error] [pid 3698:tid 3713] [client 167.71.132.111:48506] [client 167.71.132.111] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.132.111, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahRP1AtZBEwA4fyFLKP6RgAAAQ0"], referer: https://expressinteriors.com/wp-login.php
[Mon May 25 22:43:37.143713 2026] [:error] [pid 53791:tid 53805] [client 34.55.146.50:57375] [client 34.55.146.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.55.146.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahRgGSCRhhNTD40Nf1Uy0gAAAYw"]
[Mon May 25 22:43:39.415717 2026] [:error] [pid 53791:tid 53801] [client 34.55.146.50:57375] [client 34.55.146.50] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ahRgGyCRhhNTD40Nf1Uy1QAAAYg"]
[Mon May 25 22:43:39.614635 2026] [:error] [pid 53791:tid 53800] [client 34.55.146.50:57375] [client 34.55.146.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.55.146.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahRgGyCRhhNTD40Nf1Uy1gAAAYc"]
[Mon May 25 22:43:40.985008 2026] [:error] [pid 62426:tid 62439] [client 34.55.146.50:62287] [client 34.55.146.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.55.146.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahRgHEj3D3Mo8ANpTRAqpgAAAAk"]
[Mon May 25 22:43:42.367940 2026] [:error] [pid 62426:tid 62440] [client 34.55.146.50:58916] [client 34.55.146.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.55.146.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahRgHkj3D3Mo8ANpTRAqqwAAAAo"]
[Mon May 25 22:43:43.761379 2026] [:error] [pid 62426:tid 62431] [client 34.55.146.50:58921] [client 34.55.146.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.55.146.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahRgH0j3D3Mo8ANpTRAqsQAAAAE"]
[Mon May 25 22:43:45.174858 2026] [:error] [pid 62722:tid 62739] [client 34.55.146.50:65188] [client 34.55.146.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.55.146.50, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahRgIaM6ssnLWYf6CVBblAAAAE8"]
[Mon May 25 22:43:45.174984 2026] [:error] [pid 62722:tid 62739] [client 34.55.146.50:65188] [client 34.55.146.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.55.146.50, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahRgIaM6ssnLWYf6CVBblAAAAE8"]
[Mon May 25 22:58:15.690377 2026] [:error] [pid 3698:tid 3718] [client 34.136.61.58:52039] [client 34.136.61.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.136.61.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahRjhwtZBEwA4fyFLKMH1gAAARI"]
[Mon May 25 22:58:17.807848 2026] [:error] [pid 3698:tid 3722] [client 34.136.61.58:52039] [client 34.136.61.58] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "ahRjiQtZBEwA4fyFLKMH2QAAARY"]
[Mon May 25 22:58:18.005924 2026] [:error] [pid 3698:tid 3705] [client 34.136.61.58:52039] [client 34.136.61.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.136.61.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahRjigtZBEwA4fyFLKMH2gAAAQU"]
[Mon May 25 22:58:19.420158 2026] [:error] [pid 62426:tid 62444] [client 34.136.61.58:60814] [client 34.136.61.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.136.61.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahRji0j3D3Mo8ANpTRAuqgAAAA4"]
[Mon May 25 22:58:20.799007 2026] [:error] [pid 62426:tid 62454] [client 34.136.61.58:50590] [client 34.136.61.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.136.61.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahRjjEj3D3Mo8ANpTRAurgAAABg"]
[Mon May 25 22:58:22.121868 2026] [:error] [pid 62428:tid 62491] [client 34.136.61.58:52926] [client 34.136.61.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.136.61.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahRjjpNosGBa7mui3VR47wAAAIc"]
[Mon May 25 22:58:23.464819 2026] [:error] [pid 62428:tid 62492] [client 34.136.61.58:63853] [client 34.136.61.58] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.136.61.58, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahRjj5NosGBa7mui3VR48AAAAIg"]
[Mon May 25 22:58:23.464988 2026] [:error] [pid 62428:tid 62492] [client 34.136.61.58:63853] [client 34.136.61.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 34.136.61.58, counter = 6"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahRjj5NosGBa7mui3VR48AAAAIg"]
[Mon May 25 23:11:40.394837 2026] [:error] [pid 62426:tid 62449] [client 43.153.58.28:58990] [client 43.153.58.28] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ahRmrEj3D3Mo8ANpTRAyygAAABM"]
[Mon May 25 23:16:56.710401 2026] [:error] [pid 3698:tid 3713] [client 5.189.150.2:33432] [client 5.189.150.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.189.150.2, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahRn6AtZBEwA4fyFLKMK0QAAAQ0"]
[Mon May 25 23:16:57.646943 2026] [:error] [pid 3698:tid 3720] [client 5.189.150.2:33432] [client 5.189.150.2] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 5.189.150.2, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahRn6QtZBEwA4fyFLKMK1QAAARQ"], referer: https://expressinteriors.com/wp-login.php
[Mon May 25 23:52:07.628129 2026] [:error] [pid 62722:tid 62734] [client 91.192.110.113:50502] [client 91.192.110.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.192.110.113, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahRwJ6M6ssnLWYf6CVBlNwAAAEo"]
[Mon May 25 23:52:08.478322 2026] [:error] [pid 62722:tid 62730] [client 91.192.110.113:50502] [client 91.192.110.113] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.192.110.113, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahRwKKM6ssnLWYf6CVBlOAAAAEY"], referer: https://expressinteriors.com/wp-login.php
[Mon May 25 23:57:35.656743 2026] [:error] [pid 62428:tid 62508] [client 185.15.230.106:58034] [client 185.15.230.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.15.230.106, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahRxb5NosGBa7mui3VSGtAAAAJg"]
[Mon May 25 23:57:36.486555 2026] [:error] [pid 62428:tid 62492] [client 185.15.230.106:58034] [client 185.15.230.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.15.230.106, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahRxcJNosGBa7mui3VSGtgAAAIg"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 00:01:42.054626 2026] [:error] [pid 62722:tid 62742] [client 45.130.18.144:59910] [client 45.130.18.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.18.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahRyZqM6ssnLWYf6CVBmmgAAAFI"]
[Tue May 26 00:01:42.937674 2026] [:error] [pid 62722:tid 62732] [client 45.130.18.144:59910] [client 45.130.18.144] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.130.18.144, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahRyZqM6ssnLWYf6CVBmnQAAAEg"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 00:04:50.179185 2026] [:error] [pid 62426:tid 62440] [client 78.153.200.57:35578] [client 78.153.200.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.153.200.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahRzIkj3D3Mo8ANpTRBIegAAAAo"]
[Tue May 26 00:04:51.040603 2026] [:error] [pid 62426:tid 62441] [client 78.153.200.57:35578] [client 78.153.200.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 78.153.200.57, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahRzI0j3D3Mo8ANpTRBIfgAAAAs"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 00:05:11.145966 2026] [:error] [pid 62515:tid 62527] [client 52.242.130.50:65526] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-link-spm.php"] [unique_id "ahRzNxig0_XsOwmnrv95qQAAAMo"]
[Tue May 26 00:05:15.468811 2026] [:error] [pid 62428:tid 62494] [client 52.242.130.50:64745] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-link-spm.php"] [unique_id "ahRzO5NosGBa7mui3VSIWwAAAIo"]
[Tue May 26 00:05:20.423893 2026] [:error] [pid 53791:tid 53810] [client 52.242.130.50:64712] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-link-spm.php"] [unique_id "ahRzQCCRhhNTD40Nf1VDTQAAAZE"]
[Tue May 26 00:05:24.329654 2026] [:error] [pid 53791:tid 53800] [client 52.242.130.50:65519] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-link-spm.php"] [unique_id "ahRzRCCRhhNTD40Nf1VDTwAAAYc"]
[Tue May 26 00:05:28.161423 2026] [:error] [pid 62427:tid 62469] [client 52.242.130.50:65481] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-link-snpm.php"] [unique_id "ahRzSPMUa83fc4GDyByXEgAAAUw"]
[Tue May 26 00:05:29.992730 2026] [:error] [pid 62427:tid 62464] [client 52.242.130.50:64753] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-link-snpm.php"] [unique_id "ahRzSfMUa83fc4GDyByXFgAAAUc"]
[Tue May 26 00:05:31.324718 2026] [:error] [pid 62515:tid 62535] [client 52.242.130.50:65475] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-link-snpm.php"] [unique_id "ahRzSxig0_XsOwmnrv95wQAAANI"]
[Tue May 26 00:05:33.096801 2026] [:error] [pid 53791:tid 53805] [client 52.242.130.50:64724] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-link-snpm.php"] [unique_id "ahRzTSCRhhNTD40Nf1VDVAAAAYw"]
[Tue May 26 00:05:33.949518 2026] [:error] [pid 3698:tid 3714] [client 52.242.130.50:64707] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xminie.php"] [unique_id "ahRzTQtZBEwA4fyFLKMTDQAAAQ4"]
[Tue May 26 00:05:35.718626 2026] [:error] [pid 62515:tid 62525] [client 52.242.130.50:65522] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xminie.php"] [unique_id "ahRzTxig0_XsOwmnrv950wAAAMg"]
[Tue May 26 00:05:41.626076 2026] [:error] [pid 62427:tid 62467] [client 52.242.130.50:64726] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xminie.php"] [unique_id "ahRzVfMUa83fc4GDyByXIQAAAUo"]
[Tue May 26 00:05:43.884095 2026] [:error] [pid 62722:tid 62734] [client 52.242.130.50:64714] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xminie.php"] [unique_id "ahRzV6M6ssnLWYf6CVBnDQAAAEo"]
[Tue May 26 00:05:46.784257 2026] [:error] [pid 62428:tid 62503] [client 52.242.130.50:64708] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "ahRzWpNosGBa7mui3VSIbgAAAJM"]
[Tue May 26 00:05:48.697558 2026] [:error] [pid 62426:tid 62433] [client 52.242.130.50:65487] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "ahRzXEj3D3Mo8ANpTRBIoQAAAAM"]
[Tue May 26 00:05:49.923231 2026] [:error] [pid 62722:tid 62728] [client 52.242.130.50:65479] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "ahRzXaM6ssnLWYf6CVBnEwAAAEQ"]
[Tue May 26 00:05:50.917037 2026] [:error] [pid 62722:tid 62732] [client 52.242.130.50:65478] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/aaa.php"] [unique_id "ahRzXqM6ssnLWYf6CVBnFQAAAEg"]
[Tue May 26 00:05:51.657060 2026] [:error] [pid 62722:tid 62731] [client 52.242.130.50:65480] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "ahRzX6M6ssnLWYf6CVBnFwAAAEc"]
[Tue May 26 00:05:52.497231 2026] [:error] [pid 53791:tid 53797] [client 52.242.130.50:64643] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "ahRzYCCRhhNTD40Nf1VDZQAAAYQ"]
[Tue May 26 00:05:53.777825 2026] [:error] [pid 53791:tid 53816] [client 52.242.130.50:64669] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "ahRzYSCRhhNTD40Nf1VDaAAAAZc"]
[Tue May 26 00:05:54.500523 2026] [:error] [pid 62426:tid 62442] [client 52.242.130.50:65486] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/bal.php"] [unique_id "ahRzYkj3D3Mo8ANpTRBIowAAAAw"]
[Tue May 26 00:05:55.343831 2026] [:error] [pid 62427:tid 62475] [client 52.242.130.50:64721] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drykl.php"] [unique_id "ahRzY_MUa83fc4GDyByXKQAAAVI"]
[Tue May 26 00:05:56.185155 2026] [:error] [pid 53791:tid 53815] [client 52.242.130.50:65474] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drykl.php"] [unique_id "ahRzZCCRhhNTD40Nf1VDbgAAAZY"]
[Tue May 26 00:05:57.414499 2026] [:error] [pid 3698:tid 3707] [client 52.242.130.50:65525] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drykl.php"] [unique_id "ahRzZQtZBEwA4fyFLKMTFgAAAQc"]
[Tue May 26 00:05:58.536659 2026] [:error] [pid 62426:tid 62448] [client 52.242.130.50:64733] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/drykl.php"] [unique_id "ahRzZkj3D3Mo8ANpTRBIrgAAABI"]
[Tue May 26 00:06:00.969372 2026] [:error] [pid 62515:tid 62532] [client 52.242.130.50:65482] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "ahRzaBig0_XsOwmnrv95-wAAAM8"]
[Tue May 26 00:06:03.914490 2026] [:error] [pid 62426:tid 62438] [client 52.242.130.50:64725] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "ahRza0j3D3Mo8ANpTRBItAAAAAg"]
[Tue May 26 00:06:05.338648 2026] [:error] [pid 62722:tid 62747] [client 52.242.130.50:65509] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "ahRzbaM6ssnLWYf6CVBnGAAAAFc"]
[Tue May 26 00:06:09.582922 2026] [:error] [pid 62722:tid 62729] [client 52.242.130.50:64752] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/av.php"] [unique_id "ahRzcaM6ssnLWYf6CVBnHgAAAEU"]
[Tue May 26 00:06:16.051558 2026] [:error] [pid 62426:tid 62440] [client 52.242.130.50:65504] [client 52.242.130.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "expressinteriors.com"] [uri "/tiny.php"] [unique_id "ahRzeEj3D3Mo8ANpTRBI2AAAAAo"]
[Tue May 26 00:06:23.002386 2026] [:error] [pid 62515:tid 62534] [client 52.242.130.50:65498] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "ahRzfxig0_XsOwmnrv96HAAAANE"]
[Tue May 26 00:06:24.069790 2026] [:error] [pid 62722:tid 62740] [client 52.242.130.50:65476] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "ahRzgKM6ssnLWYf6CVBnJAAAAFA"]
[Tue May 26 00:06:25.097676 2026] [:error] [pid 62427:tid 62473] [client 52.242.130.50:64741] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "ahRzgfMUa83fc4GDyByXPwAAAVA"]
[Tue May 26 00:06:25.786848 2026] [:error] [pid 62426:tid 62449] [client 52.242.130.50:64732] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/fone1.php"] [unique_id "ahRzgUj3D3Mo8ANpTRBI9AAAABM"]
[Tue May 26 00:06:26.764788 2026] [:error] [pid 62426:tid 62442] [client 52.242.130.50:64650] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sallu.php"] [unique_id "ahRzgkj3D3Mo8ANpTRBI-wAAAAw"]
[Tue May 26 00:06:27.790529 2026] [:error] [pid 62426:tid 62452] [client 52.242.130.50:65506] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sallu.php"] [unique_id "ahRzg0j3D3Mo8ANpTRBJAgAAABY"]
[Tue May 26 00:06:28.830472 2026] [:error] [pid 62515:tid 62527] [client 52.242.130.50:65518] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sallu.php"] [unique_id "ahRzhBig0_XsOwmnrv96HgAAAMo"]
[Tue May 26 00:06:29.553696 2026] [:error] [pid 3698:tid 3705] [client 52.242.130.50:65508] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/sallu.php"] [unique_id "ahRzhQtZBEwA4fyFLKMTGwAAAQU"]
[Tue May 26 00:06:30.247518 2026] [:error] [pid 62426:tid 62434] [client 52.242.130.50:64656] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "ahRzhkj3D3Mo8ANpTRBJDAAAAAQ"]
[Tue May 26 00:06:32.262249 2026] [:error] [pid 62426:tid 62449] [client 52.242.130.50:64684] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "ahRziEj3D3Mo8ANpTRBJEQAAABM"]
[Tue May 26 00:06:33.630516 2026] [:error] [pid 62428:tid 62500] [client 52.242.130.50:65505] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "ahRziZNosGBa7mui3VSIiAAAAJA"]
[Tue May 26 00:06:35.471472 2026] [:error] [pid 62428:tid 62505] [client 52.242.130.50:64742] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ng.php"] [unique_id "ahRzi5NosGBa7mui3VSIigAAAJU"]
[Tue May 26 00:06:39.083835 2026] [:error] [pid 62428:tid 62485] [client 52.242.130.50:65477] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "ahRzj5NosGBa7mui3VSIjwAAAIE"]
[Tue May 26 00:06:42.458038 2026] [:error] [pid 62428:tid 62508] [client 52.242.130.50:65523] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "ahRzkpNosGBa7mui3VSIlQAAAJg"]
[Tue May 26 00:06:44.045540 2026] [:error] [pid 53791:tid 53812] [client 52.242.130.50:64710] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "ahRzlCCRhhNTD40Nf1VDhAAAAZM"]
[Tue May 26 00:06:46.672653 2026] [:error] [pid 62428:tid 62504] [client 52.242.130.50:64691] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/link.php"] [unique_id "ahRzlpNosGBa7mui3VSImgAAAJQ"]
[Tue May 26 00:06:49.525183 2026] [:error] [pid 62722:tid 62746] [client 52.242.130.50:65515] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxx.php"] [unique_id "ahRzmaM6ssnLWYf6CVBnTAAAAFY"]
[Tue May 26 00:06:51.567106 2026] [:error] [pid 62428:tid 62490] [client 52.242.130.50:64754] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxx.php"] [unique_id "ahRzm5NosGBa7mui3VSIngAAAIY"]
[Tue May 26 00:06:52.904469 2026] [:error] [pid 62426:tid 62430] [client 52.242.130.50:64755] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxx.php"] [unique_id "ahRznEj3D3Mo8ANpTRBJVgAAAAA"]
[Tue May 26 00:06:54.624011 2026] [:error] [pid 53791:tid 53797] [client 52.242.130.50:64711] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xxx.php"] [unique_id "ahRzniCRhhNTD40Nf1VDuAAAAYQ"]
[Tue May 26 00:06:57.936601 2026] [:error] [pid 62426:tid 62440] [client 52.242.130.50:64705] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "ahRzoUj3D3Mo8ANpTRBJiAAAAAo"]
[Tue May 26 00:06:59.490229 2026] [:error] [pid 62722:tid 62728] [client 52.242.130.50:64716] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "ahRzo6M6ssnLWYf6CVBnUAAAAEQ"]
[Tue May 26 00:07:01.204403 2026] [:error] [pid 62426:tid 62437] [client 52.242.130.50:64751] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "ahRzpUj3D3Mo8ANpTRBJmAAAAAc"]
[Tue May 26 00:07:03.753808 2026] [:error] [pid 62426:tid 62450] [client 52.242.130.50:64740] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/BDKR28WP.php"] [unique_id "ahRzp0j3D3Mo8ANpTRBJnAAAABQ"]
[Tue May 26 00:07:04.979808 2026] [:error] [pid 62722:tid 62742] [client 52.242.130.50:64687] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahRzqKM6ssnLWYf6CVBnVQAAAFI"]
[Tue May 26 00:07:06.905616 2026] [:error] [pid 62426:tid 62441] [client 52.242.130.50:65501] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahRzqkj3D3Mo8ANpTRBJogAAAAs"]
[Tue May 26 00:07:09.973540 2026] [:error] [pid 3698:tid 3712] [client 52.242.130.50:64717] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahRzrQtZBEwA4fyFLKMTNAAAAQw"]
[Tue May 26 00:07:15.596962 2026] [:error] [pid 3698:tid 3700] [client 52.242.130.50:6341] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/edit.php"] [unique_id "ahRzswtZBEwA4fyFLKMTPQAAAQA"]
[Tue May 26 00:07:17.003100 2026] [:error] [pid 62427:tid 62466] [client 52.242.130.50:64649] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "ahRztfMUa83fc4GDyByXZQAAAUk"]
[Tue May 26 00:07:18.675905 2026] [:error] [pid 62515:tid 62526] [client 52.242.130.50:64746] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "ahRzthig0_XsOwmnrv96bAAAAMk"]
[Tue May 26 00:07:19.970520 2026] [:error] [pid 62428:tid 62495] [client 52.242.130.50:65524] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "ahRzt5NosGBa7mui3VSIxgAAAIs"]
[Tue May 26 00:07:21.939627 2026] [:error] [pid 62428:tid 62505] [client 52.242.130.50:65525] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/pp.php"] [unique_id "ahRzuZNosGBa7mui3VSIygAAAJU"]
[Tue May 26 00:07:34.153901 2026] [:error] [pid 62515:tid 62528] [client 52.242.130.50:65488] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "ahRzxhig0_XsOwmnrv96mQAAAMs"]
[Tue May 26 00:07:36.200334 2026] [:error] [pid 62515:tid 62534] [client 52.242.130.50:64664] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "ahRzyBig0_XsOwmnrv96mwAAANE"]
[Tue May 26 00:07:38.473949 2026] [:error] [pid 62515:tid 62525] [client 52.242.130.50:64706] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/tx79.php"] [unique_id "ahRzyhig0_XsOwmnrv96oAAAAMg"]
[Tue May 26 00:07:51.980281 2026] [:error] [pid 62427:tid 62466] [client 52.242.130.50:65507] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moshou.php"] [unique_id "ahRz1_MUa83fc4GDyByXeAAAAUk"]
[Tue May 26 00:07:59.812620 2026] [:error] [pid 3698:tid 3720] [client 52.242.130.50:6343] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/moshou.php"] [unique_id "ahRz3wtZBEwA4fyFLKMTZgAAARQ"]
[Tue May 26 00:08:07.162487 2026] [:error] [pid 53791:tid 53815] [client 52.242.130.50:64766] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "ahRz5yCRhhNTD40Nf1VD8AAAAZY"]
[Tue May 26 00:08:10.062472 2026] [:error] [pid 62426:tid 62450] [client 52.242.130.50:65494] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "ahRz6kj3D3Mo8ANpTRBKQgAAABQ"]
[Tue May 26 00:08:12.704085 2026] [:error] [pid 62426:tid 62453] [client 52.242.130.50:65520] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "ahRz7Ej3D3Mo8ANpTRBKUQAAABc"]
[Tue May 26 00:08:19.934067 2026] [:error] [pid 62427:tid 62465] [client 52.242.130.50:65512] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/lib.php"] [unique_id "ahRz8_MUa83fc4GDyByXjwAAAUg"]
[Tue May 26 00:08:24.168885 2026] [:error] [pid 62426:tid 62438] [client 52.242.130.50:64665] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "ahRz-Ej3D3Mo8ANpTRBKdgAAAAg"]
[Tue May 26 00:08:31.596716 2026] [:error] [pid 62426:tid 62438] [client 52.242.130.50:64688] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "ahRz_0j3D3Mo8ANpTRBKnQAAAAg"]
[Tue May 26 00:08:32.853143 2026] [:error] [pid 62426:tid 62431] [client 52.242.130.50:65527] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/zoper1.php"] [unique_id "ahR0AEj3D3Mo8ANpTRBKpwAAAAE"]
[Tue May 26 00:08:49.575185 2026] [:error] [pid 62428:tid 62495] [client 52.242.130.50:65489] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "ahR0EZNosGBa7mui3VSJRgAAAIs"]
[Tue May 26 00:08:50.930563 2026] [:error] [pid 62426:tid 62448] [client 52.242.130.50:64682] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "ahR0Ekj3D3Mo8ANpTRBK6gAAABI"]
[Tue May 26 00:08:52.405553 2026] [:error] [pid 62722:tid 62731] [client 52.242.130.50:64767] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "ahR0FKM6ssnLWYf6CVBnhwAAAEc"]
[Tue May 26 00:08:55.012136 2026] [:error] [pid 62426:tid 62438] [client 52.242.130.50:64655] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/press.php"] [unique_id "ahR0F0j3D3Mo8ANpTRBK_AAAAAg"]
[Tue May 26 00:08:55.825705 2026] [:error] [pid 62426:tid 62443] [client 52.242.130.50:65511] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file6.php"] [unique_id "ahR0F0j3D3Mo8ANpTRBLAAAAAA0"]
[Tue May 26 00:08:56.977344 2026] [:error] [pid 62426:tid 62435] [client 52.242.130.50:65500] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file6.php"] [unique_id "ahR0GEj3D3Mo8ANpTRBLBwAAAAU"]
[Tue May 26 00:08:58.442833 2026] [:error] [pid 53791:tid 53814] [client 52.242.130.50:64698] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file6.php"] [unique_id "ahR0GiCRhhNTD40Nf1VEIAAAAZU"]
[Tue May 26 00:09:01.277017 2026] [:error] [pid 62515:tid 62530] [client 52.242.130.50:64718] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/file6.php"] [unique_id "ahR0HRig0_XsOwmnrv97JwAAAM0"]
[Tue May 26 00:09:02.653278 2026] [:error] [pid 62426:tid 62440] [client 52.242.130.50:64760] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "ahR0Hkj3D3Mo8ANpTRBLFgAAAAo"]
[Tue May 26 00:09:03.785592 2026] [:error] [pid 62427:tid 62468] [client 52.242.130.50:64671] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "ahR0H_MUa83fc4GDyByXngAAAUs"]
[Tue May 26 00:09:05.330739 2026] [:error] [pid 62428:tid 62489] [client 52.242.130.50:64673] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "ahR0IZNosGBa7mui3VSJTQAAAIU"]
[Tue May 26 00:09:06.240032 2026] [:error] [pid 62722:tid 62748] [client 52.242.130.50:64722] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/ss.php"] [unique_id "ahR0IqM6ssnLWYf6CVBnjgAAAFg"]
[Tue May 26 00:09:07.786768 2026] [:error] [pid 62426:tid 62440] [client 52.242.130.50:65484] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/options.php"] [unique_id "ahR0I0j3D3Mo8ANpTRBLGwAAAAo"]
[Tue May 26 00:09:10.019223 2026] [:error] [pid 62426:tid 62453] [client 52.242.130.50:64736] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/options.php"] [unique_id "ahR0Jkj3D3Mo8ANpTRBLIgAAABc"]
[Tue May 26 00:09:12.605664 2026] [:error] [pid 62427:tid 62474] [client 52.242.130.50:64719] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/options.php"] [unique_id "ahR0KPMUa83fc4GDyByXoQAAAVE"]
[Tue May 26 00:09:15.174618 2026] [:error] [pid 62515:tid 62529] [client 52.242.130.50:64749] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/options.php"] [unique_id "ahR0Kxig0_XsOwmnrv97NgAAAMw"]
[Tue May 26 00:09:16.526281 2026] [:error] [pid 62426:tid 62444] [client 52.242.130.50:64735] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/min.php"] [unique_id "ahR0LEj3D3Mo8ANpTRBLKQAAAA4"]
[Tue May 26 00:09:19.172318 2026] [:error] [pid 62426:tid 62433] [client 52.242.130.50:64750] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/min.php"] [unique_id "ahR0L0j3D3Mo8ANpTRBLLAAAAAM"]
[Tue May 26 00:09:19.854444 2026] [:error] [pid 62426:tid 62437] [client 52.242.130.50:64644] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/min.php"] [unique_id "ahR0L0j3D3Mo8ANpTRBLLwAAAAc"]
[Tue May 26 00:09:21.735855 2026] [:error] [pid 62722:tid 62739] [client 52.242.130.50:6360] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/min.php"] [unique_id "ahR0MaM6ssnLWYf6CVBnlgAAAE8"]
[Tue May 26 00:09:22.711251 2026] [:error] [pid 53791:tid 53805] [client 52.242.130.50:64675] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/img.php"] [unique_id "ahR0MiCRhhNTD40Nf1VEMQAAAYw"]
[Tue May 26 00:09:25.041310 2026] [:error] [pid 53791:tid 53800] [client 52.242.130.50:64728] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/img.php"] [unique_id "ahR0NSCRhhNTD40Nf1VENAAAAYc"]
[Tue May 26 00:09:27.596366 2026] [:error] [pid 62722:tid 62743] [client 52.242.130.50:64651] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/img.php"] [unique_id "ahR0N6M6ssnLWYf6CVBnnAAAAFM"]
[Tue May 26 00:09:34.069742 2026] [:error] [pid 62426:tid 62434] [client 52.242.130.50:64727] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/img.php"] [unique_id "ahR0Pkj3D3Mo8ANpTRBLQgAAAAQ"]
[Tue May 26 00:09:36.932060 2026] [:error] [pid 53791:tid 53806] [client 52.242.130.50:65503] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "ahR0QCCRhhNTD40Nf1VETAAAAY0"]
[Tue May 26 00:09:40.364071 2026] [:error] [pid 62427:tid 62474] [client 52.242.130.50:64744] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "ahR0RPMUa83fc4GDyByXqwAAAVE"]
[Tue May 26 00:09:43.370669 2026] [:error] [pid 62515:tid 62528] [client 52.242.130.50:65499] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "ahR0Rxig0_XsOwmnrv97RgAAAMs"]
[Tue May 26 00:09:44.988206 2026] [:error] [pid 62428:tid 62496] [client 52.242.130.50:65490] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/7.php"] [unique_id "ahR0SJNosGBa7mui3VSJXwAAAIw"]
[Tue May 26 00:09:59.415926 2026] [:error] [pid 62428:tid 62502] [client 52.242.130.50:64753] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yuzuru1.php"] [unique_id "ahR0V5NosGBa7mui3VSJfgAAAJI"]
[Tue May 26 00:10:00.344442 2026] [:error] [pid 62722:tid 62743] [client 52.242.130.50:64685] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yuzuru1.php"] [unique_id "ahR0WKM6ssnLWYf6CVBnogAAAFM"]
[Tue May 26 00:10:04.629233 2026] [:error] [pid 62722:tid 62734] [client 52.242.130.50:64692] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yuzuru1.php"] [unique_id "ahR0XKM6ssnLWYf6CVBnpgAAAEo"]
[Tue May 26 00:10:08.282174 2026] [:error] [pid 62428:tid 62500] [client 52.242.130.50:64763] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/yuzuru1.php"] [unique_id "ahR0YJNosGBa7mui3VSJlgAAAJA"]
[Tue May 26 00:10:11.238058 2026] [:error] [pid 62722:tid 62735] [client 52.242.130.50:64708] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/insta.php"] [unique_id "ahR0Y6M6ssnLWYf6CVBnsgAAAEs"]
[Tue May 26 00:10:13.098393 2026] [:error] [pid 53791:tid 53804] [client 52.242.130.50:64725] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/insta.php"] [unique_id "ahR0ZSCRhhNTD40Nf1VEXAAAAYs"]
[Tue May 26 00:10:14.828636 2026] [:error] [pid 62515:tid 62539] [client 52.242.130.50:6387] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/insta.php"] [unique_id "ahR0Zhig0_XsOwmnrv97ZgAAANY"]
[Tue May 26 00:10:16.587897 2026] [:error] [pid 62722:tid 62743] [client 52.242.130.50:64714] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/insta.php"] [unique_id "ahR0aKM6ssnLWYf6CVBnuAAAAFM"]
[Tue May 26 00:10:17.516032 2026] [:error] [pid 62515:tid 62532] [client 52.242.130.50:65487] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kz.php"] [unique_id "ahR0aRig0_XsOwmnrv97fgAAAM8"]
[Tue May 26 00:10:18.725252 2026] [:error] [pid 53791:tid 53795] [client 52.242.130.50:65509] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kz.php"] [unique_id "ahR0aiCRhhNTD40Nf1VEXwAAAYI"]
[Tue May 26 00:10:20.122206 2026] [:error] [pid 53791:tid 53797] [client 52.242.130.50:64654] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kz.php"] [unique_id "ahR0bCCRhhNTD40Nf1VEYgAAAYQ"]
[Tue May 26 00:10:22.966979 2026] [:error] [pid 53791:tid 53802] [client 52.242.130.50:64672] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-kz.php"] [unique_id "ahR0biCRhhNTD40Nf1VEZQAAAYk"]
[Tue May 26 00:10:25.095706 2026] [:error] [pid 53791:tid 53799] [client 52.242.130.50:65479] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xs.php"] [unique_id "ahR0cSCRhhNTD40Nf1VEagAAAYY"]
[Tue May 26 00:10:28.870847 2026] [:error] [pid 62515:tid 62539] [client 52.242.130.50:65483] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xs.php"] [unique_id "ahR0dBig0_XsOwmnrv97jQAAANY"]
[Tue May 26 00:10:30.525296 2026] [:error] [pid 62722:tid 62742] [client 52.242.130.50:6351] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xs.php"] [unique_id "ahR0dqM6ssnLWYf6CVBnwgAAAFI"]
[Tue May 26 00:10:35.160519 2026] [:error] [pid 62426:tid 62440] [client 52.242.130.50:64643] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xs.php"] [unique_id "ahR0e0j3D3Mo8ANpTRBLiQAAAAo"]
[Tue May 26 00:10:37.894645 2026] [:error] [pid 62426:tid 62453] [client 52.242.130.50:64752] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "ahR0fUj3D3Mo8ANpTRBLjQAAABc"]
[Tue May 26 00:10:39.349670 2026] [:error] [pid 62426:tid 62439] [client 52.242.130.50:65514] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "ahR0f0j3D3Mo8ANpTRBLjwAAAAk"]
[Tue May 26 00:10:41.685284 2026] [:error] [pid 62428:tid 62499] [client 52.242.130.50:64699] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "ahR0gZNosGBa7mui3VSJygAAAI8"]
[Tue May 26 00:10:43.021930 2026] [:error] [pid 62426:tid 62438] [client 52.242.130.50:64667] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/2026w.php"] [unique_id "ahR0g0j3D3Mo8ANpTRBLlgAAAAg"]
[Tue May 26 00:10:44.377110 2026] [:error] [pid 62427:tid 62481] [client 52.242.130.50:64704] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "ahR0hPMUa83fc4GDyByXzAAAAVg"]
[Tue May 26 00:10:46.010645 2026] [:error] [pid 62426:tid 62453] [client 52.242.130.50:64669] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "ahR0hkj3D3Mo8ANpTRBLnwAAABc"]
[Tue May 26 00:10:50.415050 2026] [:error] [pid 62428:tid 62499] [client 52.242.130.50:64737] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "ahR0ipNosGBa7mui3VSJ0QAAAI8"]
[Tue May 26 00:10:54.002411 2026] [:error] [pid 53791:tid 53810] [client 52.242.130.50:64641] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/f35.php"] [unique_id "ahR0jiCRhhNTD40Nf1VEfgAAAZE"]
[Tue May 26 00:10:56.142420 2026] [:error] [pid 62428:tid 62485] [client 52.242.130.50:64733] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/xwx1.php"] [unique_id "ahR0kJNosGBa7mui3VSJ2QAAAIE"]
[Tue May 26 00:11:10.367128 2026] [:error] [pid 62515:tid 62524] [client 52.242.130.50:65476] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3369.php"] [unique_id "ahR0nhig0_XsOwmnrv97tQAAAMc"]
[Tue May 26 00:11:12.108098 2026] [:error] [pid 53791:tid 53799] [client 52.242.130.50:65498] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3369.php"] [unique_id "ahR0oCCRhhNTD40Nf1VEgQAAAYY"]
[Tue May 26 00:11:13.477679 2026] [:error] [pid 53791:tid 53793] [client 52.242.130.50:65519] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3369.php"] [unique_id "ahR0oSCRhhNTD40Nf1VEggAAAYA"]
[Tue May 26 00:11:14.153686 2026] [:error] [pid 62428:tid 62493] [client 52.242.130.50:64721] [client 52.242.130.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/3369.php"] [unique_id "ahR0opNosGBa7mui3VSJ7AAAAIk"]
[Tue May 26 00:18:30.533111 2026] [:error] [pid 53791:tid 53803] [client 185.190.18.72:33828] [client 185.190.18.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.190.18.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahR2ViCRhhNTD40Nf1VGHAAAAYo"]
[Tue May 26 00:18:31.380465 2026] [:error] [pid 53791:tid 53804] [client 185.190.18.72:33828] [client 185.190.18.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.190.18.72, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahR2VyCRhhNTD40Nf1VGHgAAAYs"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 00:25:42.486982 2026] [:error] [pid 62515:tid 62520] [client 8.137.116.248:57402] [client 8.137.116.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 8.137.116.248, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahR4Bhig0_XsOwmnrv-AMwAAAMM"]
[Tue May 26 00:25:43.726956 2026] [:error] [pid 62515:tid 62537] [client 8.137.116.248:57402] [client 8.137.116.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 8.137.116.248, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahR4Bxig0_XsOwmnrv-AOQAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 00:30:46.892821 2026] [:error] [pid 62722:tid 62730] [client 49.255.68.22:54300] [client 49.255.68.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 49.255.68.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahR5NqM6ssnLWYf6CVBqDQAAAEY"]
[Tue May 26 00:30:47.534082 2026] [:error] [pid 62722:tid 62741] [client 49.255.68.22:54300] [client 49.255.68.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 49.255.68.22, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahR5N6M6ssnLWYf6CVBqDgAAAFE"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 00:42:12.656035 2026] [:error] [pid 62722:tid 62740] [client 167.71.130.119:35498] [client 167.71.130.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.130.119, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahR75KM6ssnLWYf6CVBrjwAAAFA"]
[Tue May 26 00:42:13.565148 2026] [:error] [pid 62722:tid 62744] [client 167.71.130.119:35498] [client 167.71.130.119] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.71.130.119, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahR75aM6ssnLWYf6CVBrkQAAAFQ"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 00:45:12.867160 2026] [:error] [pid 62428:tid 62499] [client 84.247.181.196:48092] [client 84.247.181.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 84.247.181.196, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahR8mJNosGBa7mui3VSQtQAAAI8"]
[Tue May 26 00:45:13.795589 2026] [:error] [pid 62428:tid 62488] [client 84.247.181.196:48092] [client 84.247.181.196] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 84.247.181.196, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahR8mZNosGBa7mui3VSQtgAAAIQ"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 00:51:08.119631 2026] [:error] [pid 53791:tid 53806] [client 178.156.182.155:33674] [client 178.156.182.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.156.182.155, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahR9_CCRhhNTD40Nf1VLYQAAAY0"]
[Tue May 26 00:51:08.831415 2026] [:error] [pid 53791:tid 53802] [client 178.156.182.155:33674] [client 178.156.182.155] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.156.182.155, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahR9_CCRhhNTD40Nf1VLYgAAAYk"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 00:56:32.569000 2026] [:error] [pid 3698:tid 3715] [client 43.157.175.122:58254] [client 43.157.175.122] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahR_QAtZBEwA4fyFLKMZ8AAAAQ8"]
[Tue May 26 00:59:00.228172 2026] [:error] [pid 62426:tid 62436] [client 185.51.190.189:37920] [client 185.51.190.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.51.190.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahR_1Ej3D3Mo8ANpTRBcCAAAAAY"]
[Tue May 26 00:59:01.162634 2026] [:error] [pid 62426:tid 62439] [client 185.51.190.189:37920] [client 185.51.190.189] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.51.190.189, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahR_1Uj3D3Mo8ANpTRBcCQAAAAk"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 01:14:17.835601 2026] [:error] [pid 62515:tid 62529] [client 104.248.158.232:61989] [client 104.248.158.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.248.158.232, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSDaRig0_XsOwmnrv-MqQAAAMw"]
[Tue May 26 01:14:22.504134 2026] [:error] [pid 62515:tid 62530] [client 104.248.158.232:61989] [client 104.248.158.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.248.158.232, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSDbhig0_XsOwmnrv-MswAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 01:14:28.204527 2026] [:error] [pid 3698:tid 3724] [client 104.248.158.232:62699] [client 104.248.158.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.248.158.232, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSDdAtZBEwA4fyFLKMcWQAAARg"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 01:14:29.888613 2026] [:error] [pid 3698:tid 3714] [client 104.248.158.232:62699] [client 104.248.158.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.248.158.232, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSDdQtZBEwA4fyFLKMcWgAAAQ4"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 01:14:32.239579 2026] [:error] [pid 3698:tid 3701] [client 104.248.158.232:62699] [client 104.248.158.232] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.248.158.232, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSDeAtZBEwA4fyFLKMcXgAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 01:17:58.351557 2026] [:error] [pid 62515:tid 62517] [client 161.248.147.209:36414] [client 161.248.147.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.248.147.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSERhig0_XsOwmnrv-NcQAAAMA"]
[Tue May 26 01:17:59.163005 2026] [:error] [pid 62515:tid 62523] [client 161.248.147.209:36414] [client 161.248.147.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.248.147.209, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSERxig0_XsOwmnrv-NdAAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 01:21:27.354893 2026] [:error] [pid 53791:tid 53815] [client 136.110.38.51:44712] [client 136.110.38.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.110.38.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSFFyCRhhNTD40Nf1VPwgAAAZY"]
[Tue May 26 01:21:29.074903 2026] [:error] [pid 53791:tid 53808] [client 136.110.38.51:44712] [client 136.110.38.51] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.110.38.51, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSFGSCRhhNTD40Nf1VPwwAAAY8"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 01:32:03.979566 2026] [:error] [pid 62427:tid 62458] [client 213.160.71.154:45476] [client 213.160.71.154] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.160.71.154, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSHk_MUa83fc4GDyByeiQAAAUE"]
[Tue May 26 01:32:04.910523 2026] [:error] [pid 62427:tid 62476] [client 213.160.71.154:45476] [client 213.160.71.154] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 213.160.71.154, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSHlPMUa83fc4GDyByeigAAAVM"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 01:34:24.209219 2026] [:error] [pid 53791:tid 53813] [client 18.116.210.19:43290] [client 18.116.210.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.116.210.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSIICCRhhNTD40Nf1VRhgAAAZQ"]
[Tue May 26 01:34:25.091925 2026] [:error] [pid 53791:tid 53795] [client 18.116.210.19:43290] [client 18.116.210.19] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 18.116.210.19, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSIISCRhhNTD40Nf1VRjAAAAYI"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 01:35:24.603038 2026] [:error] [pid 62515:tid 62541] [client 35.229.206.236:44002] [client 35.229.206.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.229.206.236, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSIXBig0_XsOwmnrv-PnwAAANg"]
[Tue May 26 01:35:25.508433 2026] [:error] [pid 62515:tid 62536] [client 35.229.206.236:44002] [client 35.229.206.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.229.206.236, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSIXRig0_XsOwmnrv-PoAAAANM"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 02:00:15.762784 2026] [:error] [pid 53791:tid 53815] [client 162.14.109.170:49804] [client 162.14.109.170] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ahSOLyCRhhNTD40Nf1VU6wAAAZY"]
[Tue May 26 02:06:28.097463 2026] [:error] [pid 62426:tid 62449] [client 34.124.190.8:35040] [client 34.124.190.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.124.190.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSPpEj3D3Mo8ANpTRBrkAAAABM"]
[Tue May 26 02:06:28.969283 2026] [:error] [pid 62426:tid 62440] [client 34.124.190.8:35040] [client 34.124.190.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.124.190.8, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSPpEj3D3Mo8ANpTRBrkgAAAAo"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 02:10:57.555795 2026] [:error] [pid 62427:tid 62477] [client 88.198.91.116:54144] [client 88.198.91.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.198.91.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSQsfMUa83fc4GDyByikwAAAVQ"]
[Tue May 26 02:10:58.380792 2026] [:error] [pid 62427:tid 62462] [client 88.198.91.116:54144] [client 88.198.91.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 88.198.91.116, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSQsvMUa83fc4GDyByilAAAAUU"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 02:24:49.356872 2026] [:error] [pid 3698:tid 3714] [client 108.181.153.97:43426] [client 108.181.153.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.181.153.97, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahST8QtZBEwA4fyFLKMjtAAAAQ4"]
[Tue May 26 02:24:50.069268 2026] [:error] [pid 3698:tid 3701] [client 108.181.153.97:43426] [client 108.181.153.97] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 108.181.153.97, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahST8gtZBEwA4fyFLKMjtQAAAQE"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 02:45:08.347124 2026] [:error] [pid 62428:tid 62484] [client 144.76.198.88:40340] [client 144.76.198.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 144.76.198.88, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSYtJNosGBa7mui3VSkswAAAIA"]
[Tue May 26 02:45:09.200734 2026] [:error] [pid 62428:tid 62499] [client 144.76.198.88:40340] [client 144.76.198.88] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 144.76.198.88, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSYtZNosGBa7mui3VSktQAAAI8"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 02:56:34.001844 2026] [:error] [pid 62426:tid 62437] [client 134.175.108.163:53918] [client 134.175.108.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.175.108.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSbYkj3D3Mo8ANpTRB5-gAAAAc"]
[Tue May 26 02:56:34.879540 2026] [:error] [pid 62426:tid 62454] [client 134.175.108.163:53918] [client 134.175.108.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.175.108.163, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahSbYkj3D3Mo8ANpTRB5_QAAABg"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 04:03:50.251714 2026] [:error] [pid 20024:tid 20047] [client 101.32.49.171:42108] [client 101.32.49.171] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ahSrJldk7QtxEB93Npf2dAAAAAk"]
[Tue May 26 04:52:47.131121 2026] [:error] [pid 20125:tid 20149] [client 34.100.157.153:2560] [client 34.100.157.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.100.157.153, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahS2n9k9jeWERFDLJc5r_AAAANY"]
[Tue May 26 04:52:48.329390 2026] [:error] [pid 20125:tid 20147] [client 34.100.157.153:2560] [client 34.100.157.153] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 34.100.157.153, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahS2oNk9jeWERFDLJc5r_QAAANQ"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 06:29:31.636979 2026] [:error] [pid 20024:tid 20043] [client 43.130.39.254:55660] [client 43.130.39.254] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahTNS1dk7QtxEB93NpcREwAAAAU"]
[Tue May 26 07:02:38.625176 2026] [:error] [pid 20125:tid 20151] [client 87.106.70.198:57402] [client 87.106.70.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 87.106.70.198, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahTVDtk9jeWERFDLJc6XSQAAANg"]
[Tue May 26 07:02:39.540967 2026] [:error] [pid 20125:tid 20133] [client 87.106.70.198:57402] [client 87.106.70.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 87.106.70.198, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahTVD9k9jeWERFDLJc6XSwAAAMY"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 07:24:09.807861 2026] [:error] [pid 20025:tid 20072] [client 157.230.148.169:53450] [client 157.230.148.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.148.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahTaGX7k8Vts-JPOkgW4_wAAAEc"]
[Tue May 26 07:24:10.928100 2026] [:error] [pid 20025:tid 20079] [client 157.230.148.169:53450] [client 157.230.148.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.148.169, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahTaGn7k8Vts-JPOkgW5AQAAAE4"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 09:10:52.600936 2026] [:error] [pid 20026:tid 20095] [client 74.7.242.1:37730] [client 74.7.242.1] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 74.7.242.1, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahTzHDXIXIr-5BZ8nR4WhgAAAIM"], referer: https://expressinteriors.com/
[Tue May 26 09:43:16.815276 2026] [autoindex:error] [pid 20025:tid 20078] [client 74.7.242.1:34416] AH01276: Cannot serve directory /home/expressi/public_html/wp-content/plugins/elementor/assets/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://expressinteriors.com/
[Tue May 26 09:56:13.879421 2026] [:error] [pid 20125:tid 20141] [client 35.244.122.64:44078] [client 35.244.122.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.244.122.64, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahT9vdk9jeWERFDLJc7HpQAAAM4"]
[Tue May 26 09:56:14.931696 2026] [:error] [pid 20125:tid 20140] [client 35.244.122.64:44078] [client 35.244.122.64] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.244.122.64, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahT9vtk9jeWERFDLJc7HpwAAAM0"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 10:35:38.135055 2026] [:error] [pid 20125:tid 20129] [client 43.239.92.149:37136] [client 43.239.92.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.239.92.149, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahUG-tk9jeWERFDLJc7RogAAAMI"]
[Tue May 26 10:35:39.752930 2026] [:error] [pid 20125:tid 20135] [client 43.239.92.149:37136] [client 43.239.92.149] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 43.239.92.149, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahUG-9k9jeWERFDLJc7RqAAAAMg"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 11:10:49.553215 2026] [:error] [pid 20026:tid 20096] [client 103.166.184.148:49324] [client 103.166.184.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.166.184.148, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahUPOTXIXIr-5BZ8nR4u1AAAAIQ"]
[Tue May 26 11:11:08.310445 2026] [:error] [pid 20024:tid 20052] [client 103.166.184.148:58664] [client 103.166.184.148] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ahUPTFdk7QtxEB93NpdE8AAAAA4"]
[Tue May 26 11:12:37.268191 2026] [:error] [pid 55988:tid 56010] [client 68.183.88.172:33646] [client 68.183.88.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahUPpf3kVIz2sql52sfXCAAAARM"]
[Tue May 26 11:52:48.916153 2026] [:error] [pid 20025:tid 20084] [client 223.185.28.183:4946] [client 223.185.28.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.28.183, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahUZEH7k8Vts-JPOkgU_3wAAAFM"]
[Tue May 26 11:53:00.411204 2026] [:error] [pid 55988:tid 56010] [client 223.185.28.183:27057] [client 223.185.28.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.28.183, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahUZHP3kVIz2sql52sfonwAAARM"]
[Tue May 26 11:53:09.928372 2026] [:error] [pid 55988:tid 56002] [client 223.185.28.183:23561] [client 223.185.28.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.28.183, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahUZJf3kVIz2sql52sfowgAAAQs"]
[Tue May 26 11:53:31.352746 2026] [:error] [pid 20025:tid 20086] [client 223.185.28.183:27109] [client 223.185.28.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.28.183, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahUZO37k8Vts-JPOkgVALAAAAFU"]
[Tue May 26 11:53:42.793440 2026] [:error] [pid 20125:tid 20143] [client 223.185.28.183:24651] [client 223.185.28.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.185.28.183, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahUZRtk9jeWERFDLJc7njwAAANA"]
[Tue May 26 12:02:32.987679 2026] [:error] [pid 20024:tid 20054] [client 43.162.109.249:44284] [client 43.162.109.249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahUbWFdk7QtxEB93NpdQAAAAABA"]
[Tue May 26 12:09:43.931566 2026] [:error] [pid 20125:tid 20130] [client 178.104.90.233:47376] [client 178.104.90.233] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.104.90.233, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahUdB9k9jeWERFDLJc7sDQAAAMM"]
[Tue May 26 12:09:44.745495 2026] [:error] [pid 20125:tid 20144] [client 178.104.90.233:47376] [client 178.104.90.233] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.104.90.233, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahUdCNk9jeWERFDLJc7sDgAAANE"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 12:18:40.591510 2026] [:error] [pid 20025:tid 20079] [client 45.127.235.87:61957] [client 45.127.235.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.127.235.87, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahUfIH7k8Vts-JPOkgVPLAAAAE4"]
[Tue May 26 12:20:30.958800 2026] [:error] [pid 55988:tid 56009] [client 52.63.6.60:44630] [client 52.63.6.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.63.6.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahUfjv3kVIz2sql52sfzYAAAARI"]
[Tue May 26 12:20:31.481346 2026] [:error] [pid 55988:tid 56014] [client 52.63.6.60:44630] [client 52.63.6.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.63.6.60, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahUfj_3kVIz2sql52sfzYgAAARc"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 12:30:48.477323 2026] [:error] [pid 55988:tid 56013] [client 45.127.235.87:60074] [client 45.127.235.87] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahUh-P3kVIz2sql52sf1jgAAARY"]
[Tue May 26 12:31:38.786419 2026] [:error] [pid 20025:tid 20078] [client 45.127.235.87:60723] [client 45.127.235.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.127.235.87, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahUiKn7k8Vts-JPOkgVUOQAAAE0"]
[Tue May 26 12:32:05.508769 2026] [:error] [pid 20026:tid 20098] [client 45.127.235.87:56197] [client 45.127.235.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.127.235.87, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahUiRTXIXIr-5BZ8nR5BjgAAAIY"]
[Tue May 26 12:32:27.404036 2026] [:error] [pid 39336:tid 39354] [client 45.127.235.87:56509] [client 45.127.235.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.127.235.87, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahUiW9wmp9MmyaRNgiAMdwAAAU8"]
[Tue May 26 12:32:51.750370 2026] [:error] [pid 20025:tid 20072] [client 45.127.235.87:56870] [client 45.127.235.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.127.235.87, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahUic37k8Vts-JPOkgVUjQAAAEc"]
[Tue May 26 12:37:02.903482 2026] [:error] [pid 20026:tid 20107] [client 185.183.110.54:55946] [client 185.183.110.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.183.110.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahUjbjXIXIr-5BZ8nR5CeQAAAI8"]
[Tue May 26 12:37:05.934654 2026] [:error] [pid 20026:tid 20102] [client 185.183.110.54:55946] [client 185.183.110.54] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.183.110.54, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahUjcTXIXIr-5BZ8nR5CfAAAAIo"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 12:57:46.766811 2026] [:error] [pid 55988:tid 56005] [client 111.230.233.46:37788] [client 111.230.233.46] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ahUoSv3kVIz2sql52sf8ZAAAAQ4"]
[Tue May 26 13:10:27.032036 2026] [:error] [pid 20026:tid 20104] [client 116.203.77.78:56572] [client 116.203.77.78] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 116.203.77.78, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahUrQzXIXIr-5BZ8nR5JJQAAAIw"]
[Tue May 26 13:10:40.181194 2026] [:error] [pid 20125:tid 20144] [client 116.203.77.78:56140] [client 116.203.77.78] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||expressinteriors.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "expressinteriors.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "ahUrUNk9jeWERFDLJc75hAAAANE"]
[Tue May 26 13:29:28.233078 2026] [:error] [pid 55988:tid 55998] [client 168.119.95.46:39772] [client 168.119.95.46] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 168.119.95.46, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahUvuP3kVIz2sql52scFJgAAAQc"]
[Tue May 26 13:29:29.513134 2026] [:error] [pid 55988:tid 56013] [client 168.119.95.46:39772] [client 168.119.95.46] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 168.119.95.46, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahUvuf3kVIz2sql52scFKQAAARY"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 13:43:22.412144 2026] [:error] [pid 55988:tid 56013] [client 109.228.50.118:60338] [client 109.228.50.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.228.50.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahUy-v3kVIz2sql52scJKwAAARY"]
[Tue May 26 13:43:24.833016 2026] [:error] [pid 55988:tid 56014] [client 109.228.50.118:60338] [client 109.228.50.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 109.228.50.118, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahUy_P3kVIz2sql52scJNAAAARc"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 14:00:10.265963 2026] [:error] [pid 20026:tid 20100] [client 171.79.106.242:60719] [client 171.79.106.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.79.106.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahU26jXIXIr-5BZ8nR5SVgAAAIg"]
[Tue May 26 14:00:21.269732 2026] [:error] [pid 20026:tid 20115] [client 171.79.106.242:60947] [client 171.79.106.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.79.106.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahU29TXIXIr-5BZ8nR5SXgAAAJc"]
[Tue May 26 14:00:32.111114 2026] [:error] [pid 39336:tid 39362] [client 171.79.106.242:61240] [client 171.79.106.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.79.106.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahU3ANwmp9MmyaRNgiAqlgAAAVc"]
[Tue May 26 14:00:42.642287 2026] [:error] [pid 39336:tid 39353] [client 171.79.106.242:61507] [client 171.79.106.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.79.106.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahU3Ctwmp9MmyaRNgiAqnwAAAU4"]
[Tue May 26 14:00:53.113729 2026] [:error] [pid 20025:tid 20085] [client 171.79.106.242:61749] [client 171.79.106.242] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 171.79.106.242, incrementing ddos counter"] [hostname "expressinteriors.com"] [uri "/xmlrpc.php"] [unique_id "ahU3FX7k8Vts-JPOkgWC-QAAAFQ"]
[Tue May 26 14:06:29.897427 2026] [autoindex:error] [pid 20024:tid 20045] [client 91.224.92.120:63553] AH01276: Cannot serve directory /home/expressi/public_html/wp-admin/css/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: binance.com
[Tue May 26 14:35:46.483173 2026] [:error] [pid 55988:tid 55991] [client 91.206.200.156:50692] [client 91.206.200.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.206.200.156, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahU_Qv3kVIz2sql52scYKAAAAQA"]
[Tue May 26 14:35:47.590110 2026] [:error] [pid 55988:tid 55997] [client 91.206.200.156:50692] [client 91.206.200.156] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.206.200.156, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahU_Q_3kVIz2sql52scYKgAAAQY"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 14:47:20.101262 2026] [:error] [pid 55988:tid 56015] [client 43.134.165.242:39288] [client 43.134.165.242] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.expressinteriors.com"] [uri "/"] [unique_id "ahVB-P3kVIz2sql52scbcgAAARg"]
[Tue May 26 15:32:52.745180 2026] [:error] [pid 20125:tid 20133] [client 35.229.206.236:60046] [client 35.229.206.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.229.206.236, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahVMpNk9jeWERFDLJc4arwAAAMY"]
[Tue May 26 15:32:53.887321 2026] [:error] [pid 20125:tid 20148] [client 35.229.206.236:60046] [client 35.229.206.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 35.229.206.236, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahVMpdk9jeWERFDLJc4asQAAANU"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 16:55:24.492387 2026] [:error] [pid 20125:tid 20133] [client 164.138.208.104:46084] [client 164.138.208.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 164.138.208.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahVf_Nk9jeWERFDLJc4wJwAAAMY"]
[Tue May 26 16:55:25.655379 2026] [:error] [pid 20125:tid 20150] [client 164.138.208.104:46084] [client 164.138.208.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 164.138.208.104, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahVf_dk9jeWERFDLJc4wKAAAANc"], referer: https://expressinteriors.com/wp-login.php
[Tue May 26 17:05:07.901917 2026] [:error] [pid 20025:tid 20065] [client 34.11.17.55:58150] [client 34.11.17.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahViQ37k8Vts-JPOkgXPggAAAEA"]
[Tue May 26 17:05:08.355509 2026] [:error] [pid 20024:tid 20047] [client 34.11.17.55:57534] [client 34.11.17.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/license.txt"] [unique_id "ahViRFdk7QtxEB93NpeBpQAAAAk"]
[Tue May 26 17:05:08.843112 2026] [:error] [pid 20026:tid 20103] [client 34.11.17.55:56547] [client 34.11.17.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/wp-includes/ID3/license.txt"] [unique_id "ahViRDXIXIr-5BZ8nR52tQAAAIs"]
[Tue May 26 17:05:09.700805 2026] [:error] [pid 55988:tid 56001] [client 34.11.17.55:59273] [client 34.11.17.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "expressinteriors.com"] [uri "/feed/"] [unique_id "ahViRf3kVIz2sql52sdiJAAAAQo"]
[Tue May 26 17:22:51.381743 2026] [:error] [pid 39336:tid 39340] [client 43.134.111.60:38128] [client 43.134.111.60] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||expressinteriors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "expressinteriors.com"] [uri "/"] [unique_id "ahVma9wmp9MmyaRNgiB5agAAAUE"]
[Tue May 26 20:41:40.976796 2026] [:error] [pid 33887:tid 33940] [client 208.68.37.246:47938] [client 208.68.37.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.68.37.246, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahWVBNCOI_FV7meOxGcwdwAAAJU"]
[Tue May 26 20:41:44.582432 2026] [:error] [pid 33887:tid 33936] [client 208.68.37.246:47938] [client 208.68.37.246] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 208.68.37.246, incrementing brute counter"] [hostname "expressinteriors.com"] [uri "/wp-login.php"] [unique_id "ahWVCNCOI_FV7meOxGcwegAAAJE"], referer: https://expressinteriors.com/wp-login.php